3057 files changed, 452346 insertions, 55054 deletions

diff --git a/usr/src/Makefile b/usr/src/Makefile
index ab1aedfc46..ce8962609a 100644
--- a/usr/src/Makefile
+++ b/usr/src/Makefile
@@ -50,7 +50,7 @@ $(SPARC_BLD)psm: stand
 
 SUBDIRS= $(COMMON_SUBDIRS) $($(MACH)_SUBDIRS)
 
-HDRSUBDIRS=	uts head lib cmd
+HDRSUBDIRS=	uts head lib cmd ucbhead
 
 # UCB headers are bug-for-bug compatible and not checkable against the header
 # standards.
@@ -60,7 +60,7 @@ CHKHDRSUBDIRS=	head uts lib
 #
 # Headers that can be built in parallel
 #
-PARALLEL_HEADERS = sysheaders userheaders libheaders cmdheaders
+PARALLEL_HEADERS = sysheaders userheaders libheaders ucbheaders cmdheaders
 
 #
 # Directories that can be built in parallel
@@ -115,7 +115,7 @@ all: mapfiles closedbins sgs .WAIT $(SUBDIRS) pkg
 # packaging to be pulled from $(SRC) and $(CLOSED) and staged in
 # $(ROOT)/licenses.
 #
-install: install1 install2 _msg stage-licenses
+install: install1 install2 _msg
 	@cd msg; pwd; $(MAKE) _msg
 	@rm -rf "$(ROOT)/catalog"
 
@@ -175,13 +175,13 @@ closedbins: bldtools $(ROOTDIRS) FRC
 .PARALLEL: $(PARALLEL_HEADERS) DUMMY
 .PARALLEL: $(PARALLEL_DIRS) DUMMY
 
-$(SUBDIRS) head pkg: FRC
+$(SUBDIRS) head ucbhead pkg: FRC
 	@cd $@; pwd; $(MAKE) $(TARGET)
 
 # librpcsvc has a dependency on headers installed by
 # userheaders, hence the .WAIT before libheaders.
 sgs: rootdirs .WAIT sysheaders userheaders .WAIT \
-	libheaders cmdheaders
+	libheaders ucbheaders cmdheaders
 
 #
 # Top-level setup target to setup the development environment that includes
@@ -218,6 +218,9 @@ libheaders: bldtools
 sysheaders: FRC
 	@cd uts; pwd; $(MAKE) install_h
 
+ucbheaders: FRC
+	@cd ucbhead; pwd; $(MAKE) install_h
+
 cmdheaders: FRC
 	@cd cmd/devfsadm; pwd; $(MAKE) install_h
 	@cd cmd/fm; pwd; $(MAKE) install_h
diff --git a/usr/src/Makefile.lint b/usr/src/Makefile.lint
index 295d86054f..85feac38e1 100644
--- a/usr/src/Makefile.lint
+++ b/usr/src/Makefile.lint
@@ -24,6 +24,7 @@
 # Copyright (c) 2012 by Delphix. All rights reserved.
 # Copyright 2015 Garrett D'Amore <garrett@damore.org>
 # Copyright 2018 Nexenta Systems, Inc.
+# Copyright 2018 Joyent, Inc.
 #
 
 # include global definitions
@@ -190,6 +191,7 @@ COMMON_SUBDIRS = \
 	cmd/logins \
 	cmd/ls \
 	cmd/luxadm \
+	cmd/machid \
 	cmd/mailwrapper \
 	cmd/makekey \
 	cmd/mdb \
@@ -233,6 +235,7 @@ COMMON_SUBDIRS = \
 	cmd/printf \
 	cmd/latencytop \
 	cmd/ppgsz \
+	cmd/pptadm \
 	cmd/praudit \
 	cmd/prctl \
 	cmd/priocntl \
@@ -404,6 +407,7 @@ COMMON_SUBDIRS = \
 	lib/libpicltree \
 	lib/libpkg \
 	lib/libpool \
+	lib/libppt \
 	lib/libproc \
 	lib/libpthread \
 	lib/libraidcfg \
@@ -447,7 +451,6 @@ COMMON_SUBDIRS = \
 	lib/pam_modules \
 	lib/passwdutil \
 	lib/pkcs11 \
-	lib/print \
 	lib/raidcfg_plugins \
 	lib/scsi \
 	lib/smbsrv \
@@ -472,6 +475,7 @@ i386_SUBDIRS= \
 	cmd/biosdev \
 	cmd/rtc \
 	cmd/ucodeadm \
+	lib/brand/lx \
 	lib/cfgadm_plugins/sata \
 	lib/cfgadm_plugins/sbd \
 	lib/libfdisk
diff --git a/usr/src/Makefile.master b/usr/src/Makefile.master
index a264148c67..6be49e5104 100644
--- a/usr/src/Makefile.master
+++ b/usr/src/Makefile.master
@@ -27,6 +27,7 @@
 # Copyright 2015 Gary Mills
 # Copyright 2015 Igor Kozhukhov <ikozhukhov@gmail.com>
 # Copyright 2016 Toomas Soome <tsoome@me.com>
+# Copyright 2017 Joyent, Inc.
 # Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 #
 
@@ -47,6 +48,12 @@ ADJUNCT_PROTO=
 NATIVE_ADJUNCT=	/usr
 
 #
+# Compatibility code for FreeBSD etc.
+#
+COMPAT=	$(SRC)/compat
+CONTRIB= $(SRC)/../contrib
+
+#
 # RELEASE_BUILD should be cleared for final release builds.
 # NOT_RELEASE_BUILD is exactly what the name implies.
 #
@@ -167,10 +174,12 @@ MCS=		/usr/ccs/bin/mcs
 CAT=            /usr/bin/cat
 ELFDUMP=	/usr/ccs/bin/elfdump
 M4=		/usr/bin/m4
+GM4=		/usr/bin/gm4
 STRIP=		/usr/ccs/bin/strip
 LEX=		/usr/ccs/bin/lex
 FLEX=		/usr/bin/flex
 YACC=		/usr/ccs/bin/yacc
+BISON=		/usr/bin/bison
 CPP=		/usr/lib/cpp
 ANSI_CPP=	$(GCC_ROOT)/bin/cpp
 JAVAC=		$(JAVA_ROOT)/bin/javac
@@ -179,16 +188,18 @@ JAVADOC=	$(JAVA_ROOT)/bin/javadoc
 RMIC=		$(JAVA_ROOT)/bin/rmic
 JAR=		$(JAVA_ROOT)/bin/jar
 CTFCONVERT=	$(ONBLD_TOOLS)/bin/$(MACH)/ctfconvert
+CTFDIFF=	$(ONBLD_TOOLS)/bin/$(MACH)/ctfdiff
 CTFMERGE=	$(ONBLD_TOOLS)/bin/$(MACH)/ctfmerge
 CTFSTABS=	$(ONBLD_TOOLS)/bin/$(MACH)/ctfstabs
 CTFSTRIP=	$(ONBLD_TOOLS)/bin/$(MACH)/ctfstrip
 NDRGEN=		$(ONBLD_TOOLS)/bin/$(MACH)/ndrgen
 GENOFFSETS=	$(ONBLD_TOOLS)/bin/genoffsets
+GENSETDEFS=	$(ONBLD_TOOLS)/bin/gensetdefs
 XREF=		$(ONBLD_TOOLS)/bin/xref
 FIND=		/usr/bin/find
 PERL=		/usr/bin/perl
-PERL_VERSION=	5.10.0
-PERL_PKGVERS=	-510
+PERL_VERSION=	5.12
+PERL_PKGVERS=	-512
 PERL_ARCH =		i86pc-solaris-64int
 $(SPARC_BLD)PERL_ARCH =	sun4-solaris-64int
 PYTHON_VERSION=	2.7
@@ -262,7 +273,8 @@ INS.symlink=	$(RM) $@; $(SYMLINK) $(INSLINKTARGET) $@
 # rebuilds if the baked-in mtime != the mtime of the source file
 # (rather than only if it's less than), thus when installing python
 # files we must make certain to not adjust the mtime of the source
-# (.py) file.
+# (.py) file. As a part of this we also go through and change the #!
+# line in the python script to that of the actual python we are using.
 #
 INS.pyfile=	$(RM) $@; $(SED) -e "1s:^\#!@PYTHON@:\#!$(PYTHON):" < $< > $@; $(CHMOD) $(FILEMODE) $@; $(TOUCH) -r $< $@
 
@@ -444,9 +456,17 @@ sparcv9_COPTFLAG=	-xO3
 i386_COPTFLAG=		-O
 amd64_COPTFLAG=		-xO3
 
+# This would normally be added by cw(1) but cannot be while we want to support
+# Both GCC 3.x and GCC 4.x
+$(__GNUC4)$(MACH)_COPTFLAG += -_gcc=-fno-inline-small-functions \
+	-_gcc=-fno-inline-functions-called-once
+$(__GNUC4)$(MACH64)_COPTFLAG += -_gcc=-fno-inline-small-functions \
+	-_gcc=-fno-inline-functions-called-once
+
 COPTFLAG= $($(MACH)_COPTFLAG)
 COPTFLAG64= $($(MACH64)_COPTFLAG)
 
+
 # When -g is used, the compiler globalizes static objects
 # (gives them a unique prefix). Disable that.
 CNOGLOBAL= -W0,-noglobal
@@ -578,8 +598,7 @@ CPPFLAGS.first=	# Please keep empty.  Only lower makefiles should set this.
 CPPFLAGS.master=$(DTEXTDOM) $(DTS_ERRNO) \
 	$(ENVCPPFLAGS1) $(ENVCPPFLAGS2) $(ENVCPPFLAGS3) $(ENVCPPFLAGS4) \
 	$(ADJUNCT_PROTO:%=-I%/usr/include)
-CPPFLAGS.native=$(ENVCPPFLAGS1) $(ENVCPPFLAGS2) $(ENVCPPFLAGS3) \
-		$(ENVCPPFLAGS4) -I$(NATIVE_ADJUNCT)/include
+CPPFLAGS.native=-I$(NATIVE_ADJUNCT)/include
 CPPFLAGS=	$(CPPFLAGS.first) $(CPPFLAGS.master)
 AS_CPPFLAGS=	$(CPPFLAGS.first) $(CPPFLAGS.master)
 JAVAFLAGS=	-source 1.6 -target 1.6 -Xlint:deprecation,-options
@@ -931,6 +950,14 @@ CTFCVTFLAGS=		-i -L VERSION
 #
 CTFMRGFLAGS=
 
+#
+# Make the transition between old and new CTF Tools. The new ctf tools
+# do not support stabs (eg. Sun Studio), so if GNUC is not set, we don't
+# honor them.
+#
+$(__GNUC)CTFCONVERT=	$(ONBLD_TOOLS)/bin/$(MACH)/ctfconvert-altexec
+$(__GNUC)CTFMERGE=	$(ONBLD_TOOLS)/bin/$(MACH)/ctfmerge-altexec
+
 CTFCONVERT_O		= $(CTFCONVERT) $(CTFCVTFLAGS) $@
 
 # Rules (normally from make.rules) and macros which are used for post
diff --git a/usr/src/Makefile.master.64 b/usr/src/Makefile.master.64
index f671406fef..704a0411a4 100644
--- a/usr/src/Makefile.master.64
+++ b/usr/src/Makefile.master.64
@@ -21,6 +21,7 @@
 #
 # Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
 #
 
 # rebind basic build macros to 64-bit versions
@@ -67,7 +68,7 @@ REAL_CC=	$(CW_CC_CMD:sh)
 REAL_CCC=	$(CW_CCC_CMD:sh)
 
 BUILD.SO=	$(CC) $(CFLAGS) -o $@ $(GSHARED) $(DYNFLAGS) \
-		$(PICS) $(EXTPICS) -L $(ROOTLIBDIR64) $(LDLIBS)
+		$(PICS) $(EXTPICS) $(USDT_PICS) -L $(ROOTLIBDIR64) $(LDLIBS)
 
 #
 # ld(1) requires the -64 option to create a 64-bit filter solely from a mapfile
diff --git a/usr/src/Targetdirs b/usr/src/Targetdirs
index 25d0a14e02..e7ec8b9a39 100644
--- a/usr/src/Targetdirs
+++ b/usr/src/Targetdirs
@@ -28,6 +28,7 @@
 # Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
 # Copyright 2016 Nexenta Systems, Inc.
 # Copyright 2017 RackTop Systems.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 #
@@ -47,17 +48,22 @@ $(BUILD64)	TARGETDIRS += $(DIRS64)
 
 TARGETDIRS	+= $(FILELINKS) $(DIRLINKS)
 
-i386_DIRS=			\
-	/boot/acpi		\
-	/boot/acpi/tables	\
-	/boot/grub		\
-	/boot/grub/bin		\
-	/platform/i86pc		\
-	/lib/libmvec		\
-	/usr/lib/xen		\
-	/usr/lib/xen/bin
+i386_DIRS= \
+	/boot/acpi \
+	/boot/acpi/tables \
+	/boot/grub \
+	/boot/grub/bin \
+	/lib/libmvec \
+	/platform/i86pc \
+	/usr/lib/brand/bhyve \
+	/usr/lib/brand/lx \
+	/usr/lib/brand/lx/amd64 \
+	/usr/lib/brand/lx/distros \
+	/usr/lib/xen \
+	/usr/lib/xen/bin \
+	/usr/share/bhyve
 
-sparc_DIRS=				\
+sparc_DIRS= \
 	/usr/lib/ldoms
 
 sparc_64ONLY= $(POUND_SIGN)
@@ -279,6 +285,7 @@ DIRS= \
 	/usr/lib/mdb/kvm \
 	/usr/lib/mdb/proc \
 	/usr/lib/nfs \
+	/usr/lib/varpd \
 	/usr/net \
 	/usr/net/servers \
 	/usr/lib/pool \
@@ -463,6 +470,7 @@ DIRS64= \
 	/usr/lib/security/$(MACH64) \
 	/usr/lib/smbsrv/$(MACH64) \
 	/usr/lib/abi/$(MACH64) \
+	/usr/lib/varpd/$(MACH64) \
 	/usr/sbin/$(MACH64) \
 	/usr/ucb/$(MACH64) \
 	/usr/ucblib/$(MACH64) \
@@ -505,6 +513,9 @@ SYM.DIRS= \
 	/usr/ucblib/32 \
 	/var/ld/32
 
+i386_SYM.DIRS64= \
+	/usr/lib/brand/lx/64
+
 sparc_SYM.DIRS64=
 
 SYM.DIRS64= \
@@ -520,6 +531,7 @@ SYM.DIRS64= \
 	/usr/lib/lwp/64 \
 	/usr/lib/secure/64 \
 	/usr/lib/security/64 \
+	/usr/lib/varpd/64 \
 	/usr/xpg4/lib/64 \
 	/var/ld/64 \
 	/usr/ucblib/64
@@ -620,12 +632,14 @@ $(BUILD64) $(ROOT)/lib/crypto/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/lib/secure/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/64:=		LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/elfedit/64:=	LINKDEST=$(MACH64)
+$(BUILD64) $(ROOT)/usr/lib/brand/lx/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/brand/sn1/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/brand/solaris10/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/lwp/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/link_audit/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/secure/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/lib/security/64:=	LINKDEST=$(MACH64)
+$(BUILD64) $(ROOT)/usr/lib/varpd/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/xpg4/lib/64:=	LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/var/ld/64:=		LINKDEST=$(MACH64)
 $(BUILD64) $(ROOT)/usr/ucblib/64:=	LINKDEST=$(MACH64)
diff --git a/usr/src/cmd/Makefile b/usr/src/cmd/Makefile
index 57644f077b..e303927b65 100644
--- a/usr/src/cmd/Makefile
+++ b/usr/src/cmd/Makefile
@@ -21,7 +21,7 @@
 
 #
 # Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
-# Copyright (c) 2017, Joyent, Inc.
+# Copyright (c) 2018, Joyent, Inc.
 # Copyright (c) 2012 by Delphix. All rights reserved.
 # Copyright (c) 2013 DEY Storage Systems, Inc. All rights reserved.
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
@@ -33,8 +33,8 @@
 include ../Makefile.master
 
 #
-#	Note that the commands 'lp', and 'perl' are first in
-#	the list, violating alphabetical order.  This is because they are very
+#	Note that if the 'lp' command were built, it would be first in
+#	the list, violating alphabetical order.  This is because it is very
 #	long-running and should be given the most wall-clock time for a
 #	parallel build.
 #
@@ -55,13 +55,13 @@ FIRST_SUBDIRS=		\
 COMMON_SUBDIRS=		\
 	allocate	\
 	availdevs	\
-	lp		\
 	perl		\
 	Adm		\
 	abi		\
 	adbgen		\
 	acct		\
 	acctadm		\
+	ahciem		\
 	arch		\
 	asa		\
 	ast		\
@@ -96,6 +96,7 @@ COMMON_SUBDIRS=		\
 	cmd-crypto	\
 	cmd-inet	\
 	col		\
+	column		\
 	compress	\
 	consadm		\
 	coreadm		\
@@ -105,6 +106,10 @@ COMMON_SUBDIRS=		\
 	crypt		\
 	csh		\
 	csplit		\
+	ctfconvert	\
+	ctfdiff		\
+	ctfdump		\
+	ctfmerge	\
 	ctrun		\
 	ctstat		\
 	ctwatch		\
@@ -190,7 +195,6 @@ COMMON_SUBDIRS=		\
 	growfs		\
 	grpck		\
 	gss		\
-	hal		\
 	halt		\
 	head		\
 	hostid		\
@@ -227,7 +231,6 @@ COMMON_SUBDIRS=		\
 	kvmstat		\
 	last		\
 	lastcomm	\
-	latencytop	\
 	ldap		\
 	ldapcachemgr	\
 	lgrpinfo	\
@@ -249,6 +252,7 @@ COMMON_SUBDIRS=		\
 	ls		\
 	luxadm		\
 	mach		\
+	machid		\
 	mail		\
 	mailwrapper	\
 	mailx		\
@@ -283,6 +287,7 @@ COMMON_SUBDIRS=		\
 	news		\
 	newtask		\
 	nice		\
+	nicstat		\
 	nl		\
 	nlsadmin	\
 	nohup		\
@@ -313,9 +318,9 @@ COMMON_SUBDIRS=		\
 	ppgsz		\
 	pg		\
 	plockstat	\
+	pptadm		\
 	pr		\
 	prctl		\
-	print		\
 	printf		\
 	priocntl	\
 	profiles	\
@@ -333,7 +338,6 @@ COMMON_SUBDIRS=		\
 	pwck		\
 	pwconv		\
 	pwd		\
-	pyzfs		\
 	raidctl		\
 	ramdiskadm	\
 	rcap		\
@@ -383,7 +387,6 @@ COMMON_SUBDIRS=		\
 	srchtxt		\
 	srptadm		\
 	srptsvc		\
-	ssh		\
 	stat		\
 	stmfadm		\
 	stmfproxy	\
@@ -435,8 +438,11 @@ COMMON_SUBDIRS=		\
 	utmpd		\
 	uuidgen		\
 	valtools	\
+	varpd		\
 	vgrind		\
 	vi		\
+	vndadm		\
+	vndstat		\
 	volcheck	\
 	volrmmount	\
 	vrrpadm		\
@@ -476,6 +482,8 @@ i386_SUBDIRS=		\
 	acpi		\
 	acpihpd		\
 	addbadsec	\
+	bhyve		\
+	bhyvectl	\
 	biosdev		\
 	diskscan	\
 	nvmeadm		\
@@ -505,7 +513,6 @@ sparc_SUBDIRS=		\
 # (see previous comment about 'lp'.)
 #
 MSGSUBDIRS=		\
-	lp		\
 	abi		\
 	acctadm		\
 	allocate	\
@@ -645,7 +652,6 @@ MSGSUBDIRS=		\
 	power		\
 	pr		\
 	praudit		\
-	print		\
 	profiles	\
 	projadd		\
 	projects	\
@@ -656,7 +662,6 @@ MSGSUBDIRS=		\
 	ptools		\
 	pwconv		\
 	pwd		\
-	pyzfs		\
 	raidctl		\
 	ramdiskadm	\
 	rcap		\
diff --git a/usr/src/cmd/Makefile.check b/usr/src/cmd/Makefile.check
index 2ad038596b..2914437f40 100644
--- a/usr/src/cmd/Makefile.check
+++ b/usr/src/cmd/Makefile.check
@@ -118,16 +118,12 @@ MANIFEST_SUBDIRS=			\
 	krb5/krb5kdc			\
 	krb5/kwarn			\
 	krb5/slave			\
-	lp/cmd/lpsched			\
 	picl/picld			\
 	pools/poold			\
-	print/bsd-sysv-commands		\
-	print/ppdmgr			\
 	rcap/rcapd			\
 	rpcsvc/rpc.bootparamd		\
 	sendmail/lib			\
 	smbsrv/smbd			\
-	ssh/etc				\
 	svc/milestone			\
 	tsol/labeld			\
 	tsol/tnctl			\
diff --git a/usr/src/cmd/acpi/Makefile b/usr/src/cmd/acpi/Makefile
index 0e59da4aa6..ce78ff94c0 100644
--- a/usr/src/cmd/acpi/Makefile
+++ b/usr/src/cmd/acpi/Makefile
@@ -8,12 +8,12 @@
 # source.  A copy of the CDDL is also available via the Internet at
 # http://www.illumos.org/license/CDDL.
 #
-# Copyright 2016 Joyent, Inc.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 include ../Makefile.cmd
 
-SUBDIRS= acpidump acpixtract
+SUBDIRS= acpidump acpixtract iasl
 
 all:=		TARGET= all
 install:=	TARGET= install
@@ -39,10 +39,7 @@ clobber: $(SUBDIRS)
 
 lint:
 
-$(SUBDIRS): common FRC
-	@cd $@; pwd; $(MAKE) $(MFLAGS) $(TARGET)
-
-common: FRC
+$(SUBDIRS): FRC
 	@cd $@; pwd; $(MAKE) $(MFLAGS) $(TARGET)
 
 FRC:
diff --git a/usr/src/cmd/acpi/Readme b/usr/src/cmd/acpi/Readme
index 86e502a917..953d0254e9 100644
--- a/usr/src/cmd/acpi/Readme
+++ b/usr/src/cmd/acpi/Readme
@@ -1,7 +1,48 @@
-The ACPI utilities are based on the Intel ACPI source code drops. No changes
-are made to Intel-provided source code. Most of the ACPI lives in the kernel
-under usr/src/uts/intel/io/acpica and usr/src/uts/intel/sys/acpi.
+This file and its contents are supplied under the terms of the
+Common Development and Distribution License ("CDDL"), version 1.0.
+You may only use this file in accordance with the terms of version
+1.0 of the CDDL.
 
-The assembler/disassembler (iasl) is currently not being built here, but it
-can be used on the dumped tables from within a non-native environment, such
-as within an lx-branded zone.
+A full copy of the text of the CDDL should have accompanied this
+source.  A copy of the CDDL is also available via the Internet at
+http://www.illumos.org/license/CDDL.
+
+Copyright (c) 2018, Joyent, Inc.
+
+---
+
+The ACPI utilities are based on the Intel ACPI source code drops.  Aside from
+notes in Readme.resync files, no changes are made to Intel-provided source code.
+Most of the ACPI source code lives in
+the following directories:
+
+   usr/src/uts/common/acpica		Common to kernel and commands
+   usr/src/uts/intel/io/acpica		Kernel
+   usr/src/uts/intel/sys/acpi		Headers
+   usr/src/cmd/acpi			Commands
+
+The acpica-update script in this directory can serve as a guide for performing
+updates.  It is expected that it will need to be tweaked as the upstream acpica
+software evolves.
+
+The expected workflow for updating is
+
+1. Clone the appropriate acpica workspace from github.  Until such a time
+   as Joyent's changes to acpica are in the Intel distribution, this probably
+   means:
+
+     git clone -b smartos git@github.com:joyent/acpica.git
+
+2. Do any required development work in the workspace checked out in step 1.
+   This probably includes rebasing Joyent's changes on the latest release.
+   Don't forget to push these to github and submit a pull request if
+   appropriate.
+
+3. Build and test the modified acpica disto as described in the documentation
+   in that workspace.
+
+4. Run acpica-update from within an illumos workspace.  That is:
+
+     ./acpica-update ~/acpica
+
+5. Build, test, code review, etc.
diff --git a/usr/src/cmd/acpi/acpica-update b/usr/src/cmd/acpi/acpica-update
new file mode 100755
index 0000000000..5015084f52
--- /dev/null
+++ b/usr/src/cmd/acpi/acpica-update
@@ -0,0 +1,251 @@
+#!/bin/ksh -e
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+export PATH=/usr/bin:/usr/sbin:$PATH
+
+# Comment this when you are ready to run it for real.
+dry_run=--dry-run
+
+# This uses rsync.  Trailing slashes are signficant.
+function sync {		# srcdir dstdir [excludepatterns]
+	set -e
+	typeset src=$1
+	typeset dst=$2
+	typeset -a exclude
+	typeset patch=acpica-resync.patch
+
+	shift 2
+	for arg in "$@"; do
+		exclude+=( --exclude "$arg" )
+	done
+
+	echo ""
+	echo "sync $src"
+	echo "  to: $dst"
+	if (( $# > 0 )); then
+		echo "  excluding: $@"
+	fi
+
+	add_files "$dst"
+
+	rsync $dry_run --out-format '%i %n' -r \
+	    --checksum --delete --exclude "$patch" "${exclude[@]}" \
+	    "$src" "$dst"
+
+	if [[ -f $dst/$patch ]]; then
+		typeset ws_patch
+		ws_patch=$(ws_path "${dst%%/}/$patch")
+		if grep '^@@ ' "$ws_patch" >/dev/null 2>&1; then
+			if [[ -z $dry_run ]]; then
+				echo "Applying patch in $ws_patch"
+				if patch -f -p1 < "$ws_patch"; then
+					patches["$ws_patch"]="Patch Applied"
+				else
+					patches["$ws_patch"]="Patch FAILED"
+				fi
+			else
+				echo "Patch in $ws_patch"
+				if [[ -n $diffstat ]]; then
+					diffstat < $ws_patch
+				fi
+				patches["$ws_patch"]="Has Patch"
+			fi
+		else
+			echo "Important resync info in $ws_patch:"
+			cat "$ws_patch"
+			patches["$ws_patch"]="MUST READ"
+		fi
+	fi
+}
+
+function copy {		# srcfile dst{file|dir}
+	typeset src=$1
+	typeset dst=$2
+
+	if [[ -d "$dst" ]]; then
+		add_files "$dst"
+	else
+		add_files "$(dirname "$dst")"
+	fi
+
+	if diff "$src" "$dst" >/dev/null 2>&1; then
+		echo ""
+		echo "copy $src"
+		echo "  to: $dst"
+		if [[ -z $dry_run ]]; then
+			cp "$src" "$dst" || return $?
+		fi
+	fi
+	return 0
+}
+
+function add_files {	# dir
+	typeset dir=$(ws_path "$1")
+	typeset file
+
+	if [[ -n ${alldirs["$dir"]} ]]; then
+		return
+	fi
+	alldirs["$dir"]=added
+
+	find "$dir" -type f | while read file; do
+		skip_file "$file" && continue
+		[[ -n ${allfiles["$file"]} ]] && continue
+		set -- $(md5sum "$file")
+		allfiles["$file"]="md5:$1"
+	done
+}
+
+function compare_files {
+	typeset dir
+	typeset file
+	typeset ufile
+	typeset header="\nThe following file changes happened:"
+
+	for dir in ${!alldirs[@]}; do
+		find "$dir" -type f | while read file; do
+			skip_file "$file" && continue
+			if [[ -z ${allfiles["$file"]} ]]; then
+				allfiles["$file"]=new
+				continue
+			fi
+			set -- $(md5sum "$file")
+			if [[ ${allfiles["$file"]} == "md5:$1" ]]; then
+				allfiles["$file"]=same
+				continue
+			fi
+			allfiles["$file"]=modified
+		done
+	done
+	for ufile in "${!allfiles[@]}"; do
+		echo "$ufile"
+	done | sort | while read file; do
+		typeset val=${allfiles["$file"]}
+
+		[[ $val == same ]] && continue
+		[[ $val == md5:* ]] && val=removed
+
+		if [[ -n $header ]]; then
+			print "$header"
+			header=
+		fi
+		printf "  %-12s %s\n" "$val" "$file"
+	done
+}
+
+function skip_file {	# filename
+	typeset file=$1
+
+	# Remember reserved meaning of return codes
+	[[ $file == *.o ]] && return 0
+	[[ $file == *.rej ]] && return 0
+	[[ $file == *.orig ]] && return 0
+	[[ $(file "$file") == *ELF* ]] && return 0
+
+	return 1
+}
+
+# Translate absolute path into one relative to $ws_top
+function ws_path {	# path
+	typeset path=$1
+
+	if [[ $path != /* ]]; then
+		print -u2 "ws_path: bad absolute path: '%s'"
+		exit 1
+	fi
+
+	# Strip excessive leading and all trailing slashes
+	path=${path%%/}
+	path=/${path##/}
+
+	echo "${path#$ws_top/}"
+}
+
+#
+# First argument is the acpica source directory
+#
+if [[ $1 != /* || ! -d $1 ]]; then
+	print -u2 "Usage: $0 <acpica-git-directory>"
+	exit 1
+fi
+ac_top=$1
+
+ac_source=$ac_top/source
+ac_include=$ac_source/include
+ac_components=$ac_source/components
+
+ws_top=${CODEMGR_WS:-$(git rev-parse --show-toplevel)}
+ws_common=$ws_top/usr/src/common/acpica
+ws_include=$ws_top/usr/src/uts/intel/sys/acpi
+ws_cmd=$ws_top/usr/src/cmd/acpi
+
+cd "$ws_top"
+
+typeset -A patches
+typeset -A alldirs
+typeset -A allfiles
+diffstat=$(type -p diffstat 2>/dev/null)
+
+#
+# Sync acpica/source/comonents/<comp> to illumos/usr/src/common/acpica/<comp>
+#
+for dir in disassembler dispatcher events executer hardware \
+    namespace parser resources tables utilities; do
+	sync "$ac_components/$dir/" "$ws_common/$dir/"
+done
+
+#
+# Sync acpica/source/include to illumos/usr/src/uts/intel/sys/acpi
+#
+sync "$ac_include/" "$ws_include/" acsolaris.h acpi_pci.h acpi_enum.h
+
+#
+# Sync some acpica/source/tools/<tool> to usr/src/cmd/acpi/<tool>
+# acpidump requires some special treatment because of OS-specific files.
+#
+sync "$ac_source/tools/acpidump/" "$ws_cmd/acpidump/" \
+    Makefile osillumostbl.c osunixdir.c
+copy "$ac_source/os_specific/service_layers/osunixdir.c" "$ws_cmd/acpidump/"
+sync "$ac_source/tools/acpixtract/" "$ws_cmd/acpixtract/" \
+    Makefile
+
+#
+# Sync iasl from acpica/source/compiler to usr/src/cmd/acpi/iasl
+#
+sync "$ac_source/compiler/" "$ws_cmd/iasl/" \
+    Makefile
+
+#
+# Sync common user space code from acpica/source/common to
+# usr/src/cmd/acpi/comon
+#
+sync "$ac_source/common/" "$ws_cmd/common/" osl.c osunixxf.c
+copy "$ac_source/os_specific/service_layers/osunixxf.c" "$ws_cmd/common/"
+
+if [[ -n $dry_run ]]; then
+	echo ""
+	echo "NOTICE: That was a dry run: nothing was changed."
+fi
+
+if (( ${#patches[@]} != 0 )); then
+	echo ""
+	echo "NOTICE: You reviewed all the $patch files, right?"
+	for file in "${!patches[@]}"; do
+		printf "   %-12s %s\n" "${patches["$file"]}" "$file"
+	done
+fi
+
+compare_files
+
+exit 0
diff --git a/usr/src/cmd/acpi/acpidump/Makefile b/usr/src/cmd/acpi/acpidump/Makefile
index 5c9b24ccbe..50d08269c3 100644
--- a/usr/src/cmd/acpi/acpidump/Makefile
+++ b/usr/src/cmd/acpi/acpidump/Makefile
@@ -8,7 +8,7 @@
 # source.  A copy of the CDDL is also available via the Internet at
 # http://www.illumos.org/license/CDDL.
 #
-# Copyright 2016 Joyent, Inc.
+# Copyright (c) 2018, Joyent, Inc.
 # Copyright 2016 RackTop Systems.
 #
 
@@ -17,10 +17,13 @@ PROG=		acpidump
 include ../../Makefile.cmd
 include ../../Makefile.ctf
 
-OBJS= apmain.o apdump.o apfiles.o tbprint.o tbxfroot.o osillumostbl.o \
-	utbuffer.o osunixdir.o
+OBJS= apmain.o apdump.o apfiles.o getopt.o tbprint.o tbxfroot.o osillumostbl.o \
+	utascii.o utbuffer.o utdebug.o utexcep.o utmath.o utnonansi.o \
+	utxferror.o utglobal.o utprint.o osunixdir.o osl.o osunixxf.o
 SRCS = $(OBJS:.o=.c)
 
+VPATH = ../common:$(SRC)/common/acpica/utilities:$(SRC)/common/acpica/tables
+
 CERRWARN += -_gcc=-Wno-unused-function
 
 CPPFLAGS += -I$(SRC)/uts/intel/sys/acpi -DACPI_DUMP_APP
@@ -32,13 +35,13 @@ LDLIBS += -ldevinfo
 all: $(PROG)
 
 $(PROG): $(OBJS)
-	$(LINK.c) -o $@ $(OBJS) ../common/acpi.a $(LDLIBS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
 	$(POST_PROCESS)
 
 install: all $(ROOTUSRSBINPROG)
 
 clean:
-	$(RM) $(OBJS)
+	$(RM) $(OBJS) $(PROG)
 
 lint:	lint_SRCS
 
diff --git a/usr/src/cmd/acpi/acpidump/Readme b/usr/src/cmd/acpi/acpidump/Readme
deleted file mode 100644
index 58271787f1..0000000000
--- a/usr/src/cmd/acpi/acpidump/Readme
+++ /dev/null
@@ -1,44 +0,0 @@
-
-
-This file and its contents are supplied under the terms of the
-Common Development and Distribution License ("CDDL"), version 1.0.
-You may only use this file in accordance with the terms of version
-1.0 of the CDDL.
-
-A full copy of the text of the CDDL should have accompanied this
-source.  A copy of the CDDL is also available via the Internet at
-http://www.illumos.org/license/CDDL.
-
-Copyright 2016 Joyent, Inc.
-
----
-
-There is a bug in the interaction of acpidump and acpixtract when the table
-size is greater than 1MB. The acpixtract code will stop parsing a table if
-the first character on a line is not a space (' '). The acpidump code will
-overflow the offset into the first character after 1MB. Until this is fixed
-upstream, the following patch can be used against new versions of the acpi
-source.
-
-
---- a/usr/src/cmd/acpi/acpidump/utbuffer.c
-+++ b/usr/src/cmd/acpi/acpidump/utbuffer.c
-@@ -97,7 +97,7 @@ AcpiUtDumpBuffer (
-     {
-         /* Print current offset */
- 
--        AcpiOsPrintf ("%6.4X: ", (BaseOffset + i));
-+        AcpiOsPrintf ("%7.4X: ", (BaseOffset + i));
- 
-         /* Print 16 hex chars */
- 
-@@ -279,7 +279,7 @@ AcpiUtDumpBufferToFile (
-     {
-         /* Print current offset */
- 
--        AcpiUtFilePrintf (File, "%6.4X: ", (BaseOffset + i));
-+        AcpiUtFilePrintf (File, "%7.4X: ", (BaseOffset + i));
- 
-         /* Print 16 hex chars */
- 
-
diff --git a/usr/src/cmd/acpi/acpidump/acpidump.h b/usr/src/cmd/acpi/acpidump/acpidump.h
index f36c853875..0817338dac 100644
--- a/usr/src/cmd/acpi/acpidump/acpidump.h
+++ b/usr/src/cmd/acpi/acpidump/acpidump.h
@@ -60,7 +60,6 @@
 #include <fcntl.h>
 #include <errno.h>
 #include <sys/stat.h>
-#include <strings.h>
 
 
 /* Globals */
diff --git a/usr/src/cmd/acpi/acpidump/osillumostbl.c b/usr/src/cmd/acpi/acpidump/osillumostbl.c
index 12bf145f7e..2ccde61c9c 100644
--- a/usr/src/cmd/acpi/acpidump/osillumostbl.c
+++ b/usr/src/cmd/acpi/acpidump/osillumostbl.c
@@ -43,7 +43,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #include <stdarg.h>
@@ -1003,57 +1003,6 @@ OslTableNameFromFile(char *Filename, char *Signature, UINT32 *Instance)
 	return (AE_OK);
 }
 
-UINT32
-CmGetFileSize(ACPI_FILE File)
-{
-	int fd;
-	struct stat sb;
-
-	fd = fileno(File);
-	if (fstat(fd, &sb) != 0)
-		return (ACPI_UINT32_MAX);
-	return ((UINT32)sb.st_size);
-}
-
-void *
-AcpiOsAllocateZeroed(ACPI_SIZE Size)
-{
-	return (calloc(1, Size));
-}
-
-void
-AcpiOsFree(void *p)
-{
-	free(p);
-}
-
-ACPI_FILE
-AcpiOsOpenFile(const char *Path, UINT8 Modes)
-{
-	char mode[3];
-
-	bzero(mode, sizeof (mode));
-	if ((Modes & ACPI_FILE_READING) != 0)
-		(void) strlcat(mode, "r", sizeof (mode));
-
-	if ((Modes & ACPI_FILE_WRITING) != 0)
-		(void) strlcat(mode, "w", sizeof (mode));
-
-	return (fopen(Path, mode));
-}
-
-void
-AcpiOsCloseFile(ACPI_FILE File)
-{
-	fclose(File);
-}
-
-int
-AcpiOsReadFile(ACPI_FILE File, void *Buffer, ACPI_SIZE Size, ACPI_SIZE Count)
-{
-	return (fread(Buffer, Size, Count, File));
-}
-
 void *
 AcpiOsMapMemory(ACPI_PHYSICAL_ADDRESS Where, ACPI_SIZE Length)
 {
diff --git a/usr/src/cmd/acpi/acpixtract/Makefile b/usr/src/cmd/acpi/acpixtract/Makefile
index deba09c0cc..f2204b9941 100644
--- a/usr/src/cmd/acpi/acpixtract/Makefile
+++ b/usr/src/cmd/acpi/acpixtract/Makefile
@@ -8,7 +8,7 @@
 # source.  A copy of the CDDL is also available via the Internet at
 # http://www.illumos.org/license/CDDL.
 #
-# Copyright 2016 Joyent, Inc.
+# Copyright (c) 2018, Joyent, Inc.
 # Copyright 2016 RackTop Systems.
 #
 
@@ -17,9 +17,13 @@ PROG=		acpixtract
 include ../../Makefile.cmd
 include ../../Makefile.ctf
 
-OBJS= axmain.o acpixtract.o axutils.o
+OBJS =	axmain.o acpixtract.o axutils.o osunixxf.o utglobal.o getopt.o \
+	utdebug.o utprint.o osl.o utascii.o utmath.o utxferror.o utnonansi.o \
+	utexcep.o
 SRCS = $(OBJS:.o=.c)
 
+VPATH = ../common:$(SRC)/common/acpica/utilities
+
 CERRWARN += -_gcc=-Wno-unused-function
 
 CPPFLAGS += -I$(SRC)/uts/intel/sys/acpi -DACPI_XTRACT_APP
@@ -29,13 +33,13 @@ CPPFLAGS += -I$(SRC)/uts/intel/sys/acpi -DACPI_XTRACT_APP
 all: $(PROG)
 
 $(PROG): $(OBJS)
-	$(LINK.c) -o $@ $(OBJS) ../common/acpi.a $(LDLIBS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
 	$(POST_PROCESS)
 
 install: all $(ROOTUSRSBINPROG)
 
 clean:
-	$(RM) $(OBJS)
+	$(RM) $(OBJS) $(PROG)
 
 lint:	lint_SRCS
 
diff --git a/usr/src/cmd/acpi/common/acfileio.c b/usr/src/cmd/acpi/common/acfileio.c
new file mode 100644
index 0000000000..589eaea263
--- /dev/null
+++ b/usr/src/cmd/acpi/common/acfileio.c
@@ -0,0 +1,538 @@
+/******************************************************************************
+ *
+ * Module Name: acfileio - Get ACPI tables from file
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acapps.h"
+#include "actables.h"
+#include "acutils.h"
+#include <errno.h>
+
+#define _COMPONENT          ACPI_UTILITIES
+        ACPI_MODULE_NAME    ("acfileio")
+
+
+/* Local prototypes */
+
+static ACPI_STATUS
+AcGetOneTableFromFile (
+    char                    *Filename,
+    FILE                    *File,
+    UINT8                   GetOnlyAmlTables,
+    ACPI_TABLE_HEADER       **Table);
+
+static ACPI_STATUS
+AcCheckTextModeCorruption (
+    ACPI_TABLE_HEADER       *Table);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcGetAllTablesFromFile
+ *
+ * PARAMETERS:  Filename            - Table filename
+ *              GetOnlyAmlTables    - TRUE if the tables must be AML tables
+ *              ReturnListHead      - Where table list is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Get all ACPI tables from within a single file.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AcGetAllTablesFromFile (
+    char                    *Filename,
+    UINT8                   GetOnlyAmlTables,
+    ACPI_NEW_TABLE_DESC     **ReturnListHead)
+{
+    ACPI_NEW_TABLE_DESC     *ListHead = NULL;
+    ACPI_NEW_TABLE_DESC     *ListTail = NULL;
+    ACPI_NEW_TABLE_DESC     *TableDesc;
+    FILE                    *File;
+    ACPI_TABLE_HEADER       *Table = NULL;
+    UINT32                  FileSize;
+    ACPI_STATUS             Status = AE_OK;
+
+
+    File = fopen (Filename, "rb");
+    if (!File)
+    {
+        perror ("Could not open input file");
+        if (errno == ENOENT)
+        {
+            return (AE_NOT_EXIST);
+        }
+
+        return (AE_ERROR);
+    }
+
+    /* Get the file size */
+
+    FileSize = CmGetFileSize (File);
+    if (FileSize == ACPI_UINT32_MAX)
+    {
+        Status = AE_ERROR;
+        goto ErrorExit;
+    }
+
+    fprintf (stderr,
+        "Input file %s, Length 0x%X (%u) bytes\n",
+        Filename, FileSize, FileSize);
+
+    /* We must have at least one ACPI table header */
+
+    if (FileSize < sizeof (ACPI_TABLE_HEADER))
+    {
+        Status = AE_BAD_HEADER;
+        goto ErrorExit;
+    }
+
+    /* Check for an non-binary file */
+
+    if (!AcIsFileBinary (File))
+    {
+        fprintf (stderr,
+            "    %s: File does not appear to contain a valid AML table\n",
+            Filename);
+        return (AE_TYPE);
+    }
+
+    /* Read all tables within the file */
+
+    while (ACPI_SUCCESS (Status))
+    {
+        /* Get one entire ACPI table */
+
+        Status = AcGetOneTableFromFile (
+            Filename, File, GetOnlyAmlTables, &Table);
+
+        if (Status == AE_CTRL_TERMINATE)
+        {
+            Status = AE_OK;
+            break;
+        }
+        else if (Status == AE_TYPE)
+        {
+            return (AE_OK);
+        }
+        else if (ACPI_FAILURE (Status))
+        {
+            goto ErrorExit;
+        }
+
+        /* Print table header for iASL/disassembler only */
+
+#ifdef ACPI_ASL_COMPILER
+
+            AcpiTbPrintTableHeader (0, Table);
+#endif
+
+        /* Allocate and link a table descriptor */
+
+        TableDesc = AcpiOsAllocate (sizeof (ACPI_NEW_TABLE_DESC));
+        TableDesc->Table = Table;
+        TableDesc->Next = NULL;
+
+        /* Link at the end of the local table list */
+
+        if (!ListHead)
+        {
+            ListHead = TableDesc;
+            ListTail = TableDesc;
+        }
+        else
+        {
+            ListTail->Next = TableDesc;
+            ListTail = TableDesc;
+        }
+    }
+
+    /* Add the local table list to the end of the global list */
+
+    if (*ReturnListHead)
+    {
+        ListTail = *ReturnListHead;
+        while (ListTail->Next)
+        {
+            ListTail = ListTail->Next;
+        }
+
+        ListTail->Next = ListHead;
+    }
+    else
+    {
+        *ReturnListHead = ListHead;
+    }
+
+ErrorExit:
+    fclose(File);
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcGetOneTableFromFile
+ *
+ * PARAMETERS:  Filename            - File where table is located
+ *              File                - Open FILE pointer to Filename
+ *              GetOnlyAmlTables    - TRUE if the tables must be AML tables.
+ *              ReturnTable         - Where a pointer to the table is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Read the next ACPI table from a file. Implements support
+ *              for multiple tables within a single file. File must already
+ *              be open.
+ *
+ * Note: Loading an RSDP is not supported.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcGetOneTableFromFile (
+    char                    *Filename,
+    FILE                    *File,
+    UINT8                   GetOnlyAmlTables,
+    ACPI_TABLE_HEADER       **ReturnTable)
+{
+    ACPI_STATUS             Status = AE_OK;
+    ACPI_TABLE_HEADER       TableHeader;
+    ACPI_TABLE_HEADER       *Table;
+    INT32                   Count;
+    long                    TableOffset;
+
+
+    *ReturnTable = NULL;
+
+    /* Get the table header to examine signature and length */
+
+    TableOffset = ftell (File);
+    Count = fread (&TableHeader, 1, sizeof (ACPI_TABLE_HEADER), File);
+    if (Count != sizeof (ACPI_TABLE_HEADER))
+    {
+        return (AE_CTRL_TERMINATE);
+    }
+
+    /* Validate the table signature/header (limited ASCII chars) */
+
+    Status = AcValidateTableHeader (File, TableOffset);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    if (GetOnlyAmlTables)
+    {
+        /* Table must be an AML table (DSDT/SSDT) or FADT */
+
+        if (!ACPI_COMPARE_NAME (TableHeader.Signature, ACPI_SIG_FADT) &&
+            !AcpiUtIsAmlTable (&TableHeader))
+        {
+            fprintf (stderr,
+                "    %s: Table [%4.4s] is not an AML table - ignoring\n",
+                Filename, TableHeader.Signature);
+
+            return (AE_TYPE);
+        }
+    }
+
+    /* Allocate a buffer for the entire table */
+
+    Table = AcpiOsAllocate ((size_t) TableHeader.Length);
+    if (!Table)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    /* Read the entire ACPI table, including header */
+
+    fseek (File, TableOffset, SEEK_SET);
+
+    Count = fread (Table, 1, TableHeader.Length, File);
+    if (Count != (INT32) TableHeader.Length)
+    {
+        Status = AE_ERROR;
+        goto ErrorExit;
+    }
+
+    /* Validate the checksum (just issue a warning) */
+
+    Status = AcpiTbVerifyChecksum (Table, TableHeader.Length);
+    if (ACPI_FAILURE (Status))
+    {
+        Status = AcCheckTextModeCorruption (Table);
+        if (ACPI_FAILURE (Status))
+        {
+            goto ErrorExit;
+        }
+    }
+
+    *ReturnTable = Table;
+    return (AE_OK);
+
+
+ErrorExit:
+    AcpiOsFree (Table);
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcIsFileBinary
+ *
+ * PARAMETERS:  File                - Open input file
+ *
+ * RETURN:      TRUE if file appears to be binary
+ *
+ * DESCRIPTION: Scan a file for any non-ASCII bytes.
+ *
+ * Note: Maintains current file position.
+ *
+ ******************************************************************************/
+
+BOOLEAN
+AcIsFileBinary (
+    FILE                    *File)
+{
+    UINT8                   Byte;
+    BOOLEAN                 IsBinary = FALSE;
+    long                    FileOffset;
+
+
+    /* Scan entire file for any non-ASCII bytes */
+
+    FileOffset = ftell (File);
+    while (fread (&Byte, 1, 1, File) == 1)
+    {
+        if (!isprint (Byte) && !isspace (Byte))
+        {
+            IsBinary = TRUE;
+            goto Exit;
+        }
+    }
+
+Exit:
+    fseek (File, FileOffset, SEEK_SET);
+    return (IsBinary);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcValidateTableHeader
+ *
+ * PARAMETERS:  File                - Open input file
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Determine if a file seems to contain one or more binary ACPI
+ *              tables, via the
+ *              following checks on what would be the table header:
+ *              1) File must be at least as long as an ACPI_TABLE_HEADER
+ *              2) There must be enough room in the file to hold entire table
+ *              3) Signature, OemId, OemTableId, AslCompilerId must be ASCII
+ *
+ * Note: There can be multiple definition blocks per file, so we cannot
+ * expect/compare the file size to be equal to the table length. 12/2015.
+ *
+ * Note: Maintains current file position.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AcValidateTableHeader (
+    FILE                    *File,
+    long                    TableOffset)
+{
+    ACPI_TABLE_HEADER       TableHeader;
+    size_t                  Actual;
+    long                    OriginalOffset;
+    UINT32                  FileSize;
+    UINT32                  i;
+
+
+    ACPI_FUNCTION_TRACE ("AcValidateTableHeader");
+
+
+    /* Read a potential table header */
+
+    OriginalOffset = ftell (File);
+    fseek (File, TableOffset, SEEK_SET);
+
+    Actual = fread (&TableHeader, 1, sizeof (ACPI_TABLE_HEADER), File);
+    fseek (File, OriginalOffset, SEEK_SET);
+
+    if (Actual < sizeof (ACPI_TABLE_HEADER))
+    {
+        return (AE_ERROR);
+    }
+
+    /* Validate the signature (limited ASCII chars) */
+
+    if (!AcpiUtValidNameseg (TableHeader.Signature))
+    {
+        fprintf (stderr, "Invalid table signature: 0x%8.8X\n",
+            *ACPI_CAST_PTR (UINT32, TableHeader.Signature));
+        return (AE_BAD_SIGNATURE);
+    }
+
+    /* Validate table length against bytes remaining in the file */
+
+    FileSize = CmGetFileSize (File);
+    if (TableHeader.Length > (UINT32) (FileSize - TableOffset))
+    {
+        fprintf (stderr, "Table [%4.4s] is too long for file - "
+            "needs: 0x%.2X, remaining in file: 0x%.2X\n",
+            TableHeader.Signature, TableHeader.Length,
+            (UINT32) (FileSize - TableOffset));
+        return (AE_BAD_HEADER);
+    }
+
+    /*
+     * These fields must be ASCII: OemId, OemTableId, AslCompilerId.
+     * We allow a NULL terminator in OemId and OemTableId.
+     */
+    for (i = 0; i < ACPI_NAME_SIZE; i++)
+    {
+        if (!ACPI_IS_ASCII ((UINT8) TableHeader.AslCompilerId[i]))
+        {
+            goto BadCharacters;
+        }
+    }
+
+    for (i = 0; (i < ACPI_OEM_ID_SIZE) && (TableHeader.OemId[i]); i++)
+    {
+        if (!ACPI_IS_ASCII ((UINT8) TableHeader.OemId[i]))
+        {
+            goto BadCharacters;
+        }
+    }
+
+    for (i = 0; (i < ACPI_OEM_TABLE_ID_SIZE) && (TableHeader.OemTableId[i]); i++)
+    {
+        if (!ACPI_IS_ASCII ((UINT8) TableHeader.OemTableId[i]))
+        {
+            goto BadCharacters;
+        }
+    }
+
+    return (AE_OK);
+
+
+BadCharacters:
+
+    ACPI_WARNING ((AE_INFO,
+        "Table header for [%4.4s] has invalid ASCII character(s)",
+        TableHeader.Signature));
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcCheckTextModeCorruption
+ *
+ * PARAMETERS:  Table           - Table buffer starting with table header
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Check table for text mode file corruption where all linefeed
+ *              characters (LF) have been replaced by carriage return linefeed
+ *              pairs (CR/LF).
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcCheckTextModeCorruption (
+    ACPI_TABLE_HEADER       *Table)
+{
+    UINT32                  i;
+    UINT32                  Pairs = 0;
+    UINT8                   *Buffer = ACPI_CAST_PTR (UINT8, Table);
+
+
+    /* Scan entire table to determine if each LF has been prefixed with a CR */
+
+    for (i = 1; i < Table->Length; i++)
+    {
+        if (Buffer[i] == 0x0A)
+        {
+            if (Buffer[i - 1] != 0x0D)
+            {
+                /* The LF does not have a preceding CR, table not corrupted */
+
+                return (AE_OK);
+            }
+            else
+            {
+                /* Found a CR/LF pair */
+
+                Pairs++;
+            }
+
+            i++;
+        }
+    }
+
+    if (!Pairs)
+    {
+        return (AE_OK);
+    }
+
+    /*
+     * Entire table scanned, each CR is part of a CR/LF pair --
+     * meaning that the table was treated as a text file somewhere.
+     *
+     * NOTE: We can't "fix" the table, because any existing CR/LF pairs in the
+     * original table are left untouched by the text conversion process --
+     * meaning that we cannot simply replace CR/LF pairs with LFs.
+     */
+    AcpiOsPrintf ("Table has been corrupted by text mode conversion\n");
+    AcpiOsPrintf ("All LFs (%u) were changed to CR/LF pairs\n", Pairs);
+    AcpiOsPrintf ("Table cannot be repaired!\n");
+
+    return (AE_BAD_VALUE);
+}
diff --git a/usr/src/cmd/acpi/common/acgetline.c b/usr/src/cmd/acpi/common/acgetline.c
new file mode 100644
index 0000000000..b08fb637d0
--- /dev/null
+++ b/usr/src/cmd/acpi/common/acgetline.c
@@ -0,0 +1,441 @@
+/******************************************************************************
+ *
+ * Module Name: acgetline - local line editing
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "amlcode.h"
+#include "acparser.h"
+#include "acdebug.h"
+
+#include <stdio.h>
+
+/*
+ * This is an os-independent implementation of line-editing services needed
+ * by the AcpiExec utility. It uses getchar() and putchar() and the existing
+ * history support provided by the AML debugger. It assumes that the terminal
+ * is in the correct line-editing mode such as raw and noecho. The OSL
+ * interface AcpiOsInitialize should do this. AcpiOsTerminate should put the
+ * terminal back into the original mode.
+ */
+#define _COMPONENT          ACPI_OS_SERVICES
+        ACPI_MODULE_NAME    ("acgetline")
+
+
+/* Local prototypes */
+
+static void
+AcpiAcClearLine (
+    UINT32                  EndOfLine,
+    UINT32                  CursorPosition);
+
+/* Various ASCII constants */
+
+#define _ASCII_NUL                  0
+#define _ASCII_BACKSPACE            0x08
+#define _ASCII_TAB                  0x09
+#define _ASCII_ESCAPE               0x1B
+#define _ASCII_SPACE                0x20
+#define _ASCII_LEFT_BRACKET         0x5B
+#define _ASCII_DEL                  0x7F
+#define _ASCII_UP_ARROW             'A'
+#define _ASCII_DOWN_ARROW           'B'
+#define _ASCII_RIGHT_ARROW          'C'
+#define _ASCII_LEFT_ARROW           'D'
+#define _ASCII_NEWLINE              '\n'
+
+extern UINT32               AcpiGbl_NextCmdNum;
+
+/* Erase a single character on the input command line */
+
+#define ACPI_CLEAR_CHAR() \
+    putchar (_ASCII_BACKSPACE); \
+    putchar (_ASCII_SPACE); \
+    putchar (_ASCII_BACKSPACE);
+
+/* Backup cursor by Count positions */
+
+#define ACPI_BACKUP_CURSOR(i, Count) \
+    for (i = 0; i < (Count); i++) \
+        {putchar (_ASCII_BACKSPACE);}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiAcClearLine
+ *
+ * PARAMETERS:  EndOfLine           - Current end-of-line index
+ *              CursorPosition      - Current cursor position within line
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Clear the entire command line the hard way, but probably the
+ *              most portable.
+ *
+ *****************************************************************************/
+
+static void
+AcpiAcClearLine (
+    UINT32                  EndOfLine,
+    UINT32                  CursorPosition)
+{
+    UINT32                  i;
+
+
+    if (CursorPosition < EndOfLine)
+    {
+        /* Clear line from current position to end of line */
+
+        for (i = 0; i < (EndOfLine - CursorPosition); i++)
+        {
+            putchar (' ');
+        }
+    }
+
+    /* Clear the entire line */
+
+    for (; EndOfLine > 0; EndOfLine--)
+    {
+        ACPI_CLEAR_CHAR ();
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsGetLine
+ *
+ * PARAMETERS:  Buffer              - Where to return the command line
+ *              BufferLength        - Maximum length of Buffer
+ *              BytesRead           - Where the actual byte count is returned
+ *
+ * RETURN:      Status and actual bytes read
+ *
+ * DESCRIPTION: Get the next input line from the terminal. NOTE: terminal
+ *              is expected to be in a mode that supports line-editing (raw,
+ *              noecho). This function is intended to be very portable. Also,
+ *              it uses the history support implemented in the AML debugger.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsGetLine (
+    char                    *Buffer,
+    UINT32                  BufferLength,
+    UINT32                  *BytesRead)
+{
+    char                    *NextCommand;
+    UINT32                  MaxCommandIndex = AcpiGbl_NextCmdNum - 1;
+    UINT32                  CurrentCommandIndex = MaxCommandIndex;
+    UINT32                  PreviousCommandIndex = MaxCommandIndex;
+    int                     InputChar;
+    UINT32                  CursorPosition = 0;
+    UINT32                  EndOfLine = 0;
+    UINT32                  i;
+
+
+    /* Always clear the line buffer before we read a new line */
+
+    memset (Buffer, 0, BufferLength);
+
+    /*
+     * This loop gets one character at a time (except for esc sequences)
+     * until a newline or error is detected.
+     *
+     * Note: Don't attempt to write terminal control ESC sequences, even
+     * though it makes certain things more difficult.
+     */
+    while (1)
+    {
+        if (EndOfLine >= (BufferLength - 1))
+        {
+            return (AE_BUFFER_OVERFLOW);
+        }
+
+        InputChar = getchar ();
+        switch (InputChar)
+        {
+        default: /* This is the normal character case */
+
+            /* Echo the character (at EOL) and copy it to the line buffer */
+
+            if (EndOfLine == CursorPosition)
+            {
+                putchar (InputChar);
+                Buffer[EndOfLine] = (char) InputChar;
+
+                EndOfLine++;
+                CursorPosition++;
+                Buffer[EndOfLine] = 0;
+                continue;
+            }
+
+            /* Insert character into the middle of the buffer */
+
+            memmove (&Buffer[CursorPosition + 1], &Buffer[CursorPosition],
+                (EndOfLine - CursorPosition + 1));
+
+            Buffer [CursorPosition] = (char) InputChar;
+            Buffer [EndOfLine + 1] = 0;
+
+            /* Display the new part of line starting at the new character */
+
+            fprintf (stdout, "%s", &Buffer[CursorPosition]);
+
+            /* Restore cursor */
+
+            ACPI_BACKUP_CURSOR (i, EndOfLine - CursorPosition);
+            CursorPosition++;
+            EndOfLine++;
+            continue;
+
+        case _ASCII_DEL: /* Backspace key */
+
+            if (!EndOfLine) /* Any characters on the command line? */
+            {
+                continue;
+            }
+
+            if (EndOfLine == CursorPosition) /* Erase the final character */
+            {
+                ACPI_CLEAR_CHAR ();
+                EndOfLine--;
+                CursorPosition--;
+                continue;
+            }
+
+            if (!CursorPosition) /* Do not backup beyond start of line */
+            {
+                continue;
+            }
+
+            /* Remove the character from the line */
+
+            memmove (&Buffer[CursorPosition - 1], &Buffer[CursorPosition],
+                (EndOfLine - CursorPosition + 1));
+
+            /* Display the new part of line starting at the new character */
+
+            putchar (_ASCII_BACKSPACE);
+            fprintf (stdout, "%s ", &Buffer[CursorPosition - 1]);
+
+            /* Restore cursor */
+
+            ACPI_BACKUP_CURSOR (i, EndOfLine - CursorPosition + 1);
+            EndOfLine--;
+
+            if (CursorPosition > 0)
+            {
+                CursorPosition--;
+            }
+            continue;
+
+        case _ASCII_NEWLINE: /* Normal exit case at end of command line */
+        case _ASCII_NUL:
+
+            /* Return the number of bytes in the command line string */
+
+            if (BytesRead)
+            {
+                *BytesRead = EndOfLine;
+            }
+
+            /* Echo, terminate string buffer, and exit */
+
+            putchar (InputChar);
+            Buffer[EndOfLine] = 0;
+            return (AE_OK);
+
+        case _ASCII_TAB:
+
+            /* Ignore */
+
+            continue;
+
+        case EOF:
+
+            return (AE_ERROR);
+
+        case _ASCII_ESCAPE:
+
+            /* Check for escape sequences of the form "ESC[x" */
+
+            InputChar = getchar ();
+            if (InputChar != _ASCII_LEFT_BRACKET)
+            {
+                continue; /* Ignore this ESC, does not have the '[' */
+            }
+
+            /* Get the code following the ESC [ */
+
+            InputChar = getchar (); /* Backup one character */
+            switch (InputChar)
+            {
+            case _ASCII_LEFT_ARROW:
+
+                if (CursorPosition > 0)
+                {
+                    putchar (_ASCII_BACKSPACE);
+                    CursorPosition--;
+                }
+                continue;
+
+            case _ASCII_RIGHT_ARROW:
+                /*
+                 * Move one character forward. Do this without sending
+                 * ESC sequence to the terminal for max portability.
+                 */
+                if (CursorPosition < EndOfLine)
+                {
+                    /* Backup to start of line and print the entire line */
+
+                    ACPI_BACKUP_CURSOR (i, CursorPosition);
+                    fprintf (stdout, "%s", Buffer);
+
+                    /* Backup to where the cursor should be */
+
+                    CursorPosition++;
+                    ACPI_BACKUP_CURSOR (i, EndOfLine - CursorPosition);
+                }
+                continue;
+
+            case _ASCII_UP_ARROW:
+
+                /* If no commands available or at start of history list, ignore */
+
+                if (!CurrentCommandIndex)
+                {
+                    continue;
+                }
+
+                /* Manage our up/down progress */
+
+                if (CurrentCommandIndex > PreviousCommandIndex)
+                {
+                    CurrentCommandIndex = PreviousCommandIndex;
+                }
+
+                /* Get the historical command from the debugger */
+
+                NextCommand = AcpiDbGetHistoryByIndex (CurrentCommandIndex);
+                if (!NextCommand)
+                {
+                    return (AE_ERROR);
+                }
+
+                /* Make this the active command and echo it */
+
+                AcpiAcClearLine (EndOfLine, CursorPosition);
+                strcpy (Buffer, NextCommand);
+                fprintf (stdout, "%s", Buffer);
+                EndOfLine = CursorPosition = strlen (Buffer);
+
+                PreviousCommandIndex = CurrentCommandIndex;
+                CurrentCommandIndex--;
+                continue;
+
+            case _ASCII_DOWN_ARROW:
+
+                if (!MaxCommandIndex) /* Any commands available? */
+                {
+                    continue;
+                }
+
+                /* Manage our up/down progress */
+
+                if (CurrentCommandIndex < PreviousCommandIndex)
+                {
+                    CurrentCommandIndex = PreviousCommandIndex;
+                }
+
+                /* If we are the end of the history list, output a clear new line */
+
+                if ((CurrentCommandIndex + 1) > MaxCommandIndex)
+                {
+                    AcpiAcClearLine (EndOfLine, CursorPosition);
+                    EndOfLine = CursorPosition = 0;
+                    PreviousCommandIndex = CurrentCommandIndex;
+                    continue;
+                }
+
+                PreviousCommandIndex = CurrentCommandIndex;
+                CurrentCommandIndex++;
+
+                 /* Get the historical command from the debugger */
+
+                NextCommand = AcpiDbGetHistoryByIndex (CurrentCommandIndex);
+                if (!NextCommand)
+                {
+                    return (AE_ERROR);
+                }
+
+                /* Make this the active command and echo it */
+
+                AcpiAcClearLine (EndOfLine, CursorPosition);
+                strcpy (Buffer, NextCommand);
+                fprintf (stdout, "%s", Buffer);
+                EndOfLine = CursorPosition = strlen (Buffer);
+                continue;
+
+            case 0x31:
+            case 0x32:
+            case 0x33:
+            case 0x34:
+            case 0x35:
+            case 0x36:
+                /*
+                 * Ignore the various keys like insert/delete/home/end, etc.
+                 * But we must eat the final character of the ESC sequence.
+                 */
+                InputChar = getchar ();
+                continue;
+
+            default:
+
+                /* Ignore random escape sequences that we don't care about */
+
+                continue;
+            }
+            continue;
+        }
+    }
+}
diff --git a/usr/src/cmd/acpi/common/adfile.c b/usr/src/cmd/acpi/common/adfile.c
new file mode 100644
index 0000000000..78f29fd9f5
--- /dev/null
+++ b/usr/src/cmd/acpi/common/adfile.c
@@ -0,0 +1,358 @@
+/******************************************************************************
+ *
+ * Module Name: adfile - Application-level disassembler file support routines
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acpi.h"
+#include "accommon.h"
+#include "acapps.h"
+
+#include <stdio.h>
+
+
+#define _COMPONENT          ACPI_TOOLS
+        ACPI_MODULE_NAME    ("adfile")
+
+/* Local prototypes */
+
+static INT32
+AdWriteBuffer (
+    char                    *Filename,
+    char                    *Buffer,
+    UINT32                  Length);
+
+static char                 FilenameBuf[20];
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AfGenerateFilename
+ *
+ * PARAMETERS:  Prefix              - prefix string
+ *              TableId             - The table ID
+ *
+ * RETURN:      Pointer to the completed string
+ *
+ * DESCRIPTION: Build an output filename from an ACPI table ID string
+ *
+ ******************************************************************************/
+
+char *
+AdGenerateFilename (
+    char                    *Prefix,
+    char                    *TableId)
+{
+    UINT32                  i;
+    UINT32                  j;
+
+
+    for (i = 0; Prefix[i]; i++)
+    {
+        FilenameBuf[i] = Prefix[i];
+    }
+
+    FilenameBuf[i] = '_';
+    i++;
+
+    for (j = 0; j < 8 && (TableId[j] != ' ') && (TableId[j] != 0); i++, j++)
+    {
+        FilenameBuf[i] = TableId[j];
+    }
+
+    FilenameBuf[i] = 0;
+    strcat (FilenameBuf, FILE_SUFFIX_BINARY_TABLE);
+    return (FilenameBuf);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AfWriteBuffer
+ *
+ * PARAMETERS:  Filename            - name of file
+ *              Buffer              - data to write
+ *              Length              - length of data
+ *
+ * RETURN:      Actual number of bytes written
+ *
+ * DESCRIPTION: Open a file and write out a single buffer
+ *
+ ******************************************************************************/
+
+static INT32
+AdWriteBuffer (
+    char                    *Filename,
+    char                    *Buffer,
+    UINT32                  Length)
+{
+    FILE                    *File;
+    ACPI_SIZE               Actual;
+
+
+    File = fopen (Filename, "wb");
+    if (!File)
+    {
+        printf ("Could not open file %s\n", Filename);
+        return (-1);
+    }
+
+    Actual = fwrite (Buffer, 1, (size_t) Length, File);
+    if (Actual != Length)
+    {
+        printf ("Could not write to file %s\n", Filename);
+    }
+
+    fclose (File);
+    return ((INT32) Actual);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AfWriteTable
+ *
+ * PARAMETERS:  Table               - pointer to the ACPI table
+ *              Length              - length of the table
+ *              TableName           - the table signature
+ *              OemTableID          - from the table header
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump the loaded tables to a file (or files)
+ *
+ ******************************************************************************/
+
+void
+AdWriteTable (
+    ACPI_TABLE_HEADER       *Table,
+    UINT32                  Length,
+    char                    *TableName,
+    char                    *OemTableId)
+{
+    char                    *Filename;
+
+
+    Filename = AdGenerateFilename (TableName, OemTableId);
+    AdWriteBuffer (Filename, (char *) Table, Length);
+
+    AcpiOsPrintf ("Table [%s] written to \"%s\"\n", TableName, Filename);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlGenerateFilename
+ *
+ * PARAMETERS:  InputFilename       - Original ASL source filename
+ *              Suffix              - New extension.
+ *
+ * RETURN:      New filename containing the original base + the new suffix
+ *
+ * DESCRIPTION: Generate a new filename from the ASL source filename and a new
+ *              extension. Used to create the *.LST, *.TXT, etc. files.
+ *
+ ******************************************************************************/
+
+char *
+FlGenerateFilename (
+    char                    *InputFilename,
+    char                    *Suffix)
+{
+    char                    *Position;
+    char                    *NewFilename;
+    char                    *DirectoryPosition;
+
+
+    /*
+     * Copy the original filename to a new buffer. Leave room for the worst
+     * case where we append the suffix, an added dot and the null terminator.
+     */
+    NewFilename = UtStringCacheCalloc ((ACPI_SIZE)
+        strlen (InputFilename) + strlen (Suffix) + 2);
+    if (!NewFilename)
+    {
+        return (NULL);
+    }
+
+    strcpy (NewFilename, InputFilename);
+
+    /* Try to find the last dot in the filename */
+
+    DirectoryPosition = strrchr (NewFilename, '/');
+    Position = strrchr (NewFilename, '.');
+
+    if (Position && (Position > DirectoryPosition))
+    {
+        /* Tack on the new suffix */
+
+        Position++;
+        *Position = 0;
+        strcat (Position, Suffix);
+    }
+    else
+    {
+        /* No dot, add one and then the suffix */
+
+        strcat (NewFilename, ".");
+        strcat (NewFilename, Suffix);
+    }
+
+    return (NewFilename);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlStrdup
+ *
+ * DESCRIPTION: Local strdup function
+ *
+ ******************************************************************************/
+
+static char *
+FlStrdup (
+    char                *String)
+{
+    char                *NewString;
+
+
+    NewString = UtStringCacheCalloc ((ACPI_SIZE) strlen (String) + 1);
+    if (!NewString)
+    {
+        return (NULL);
+    }
+
+    strcpy (NewString, String);
+    return (NewString);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlSplitInputPathname
+ *
+ * PARAMETERS:  InputFilename       - The user-specified ASL source file to be
+ *                                    compiled
+ *              OutDirectoryPath    - Where the directory path prefix is
+ *                                    returned
+ *              OutFilename         - Where the filename part is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Split the input path into a directory and filename part
+ *              1) Directory part used to open include files
+ *              2) Filename part used to generate output filenames
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+FlSplitInputPathname (
+    char                    *InputPath,
+    char                    **OutDirectoryPath,
+    char                    **OutFilename)
+{
+    char                    *Substring;
+    char                    *DirectoryPath;
+    char                    *Filename;
+
+
+    if (OutDirectoryPath)
+    {
+        *OutDirectoryPath = NULL;
+    }
+
+    if (!InputPath)
+    {
+        return (AE_OK);
+    }
+
+    /* Get the path to the input filename's directory */
+
+    DirectoryPath = FlStrdup (InputPath);
+    if (!DirectoryPath)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    /* Convert backslashes to slashes in the entire path */
+
+    UtConvertBackslashes (DirectoryPath);
+
+    /* Backup to last slash or colon */
+
+    Substring = strrchr (DirectoryPath, '/');
+    if (!Substring)
+    {
+        Substring = strrchr (DirectoryPath, ':');
+    }
+
+    /* Extract the simple filename */
+
+    if (!Substring)
+    {
+        Filename = FlStrdup (DirectoryPath);
+        DirectoryPath[0] = 0;
+    }
+    else
+    {
+        Filename = FlStrdup (Substring + 1);
+        *(Substring+1) = 0;
+    }
+
+    if (!Filename)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    if (OutDirectoryPath)
+    {
+        *OutDirectoryPath = DirectoryPath;
+    }
+
+    if (OutFilename)
+    {
+        *OutFilename = Filename;
+        return (AE_OK);
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/common/adisasm.c b/usr/src/cmd/acpi/common/adisasm.c
new file mode 100644
index 0000000000..bb83ab6f4c
--- /dev/null
+++ b/usr/src/cmd/acpi/common/adisasm.c
@@ -0,0 +1,656 @@
+/******************************************************************************
+ *
+ * Module Name: adisasm - Application-level disassembler routines
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "amlcode.h"
+#include "acdisasm.h"
+#include "acdispat.h"
+#include "acnamesp.h"
+#include "acparser.h"
+#include "acapps.h"
+
+#include <stdio.h>
+
+
+#define _COMPONENT          ACPI_TOOLS
+        ACPI_MODULE_NAME    ("adisasm")
+
+/* Local prototypes */
+
+static ACPI_STATUS
+AdDoExternalFileList (
+    char                    *Filename);
+
+static ACPI_STATUS
+AdDisassembleOneTable (
+    ACPI_TABLE_HEADER       *Table,
+    FILE                    *File,
+    char                    *Filename,
+    char                    *DisasmFilename);
+
+static ACPI_STATUS
+AdReparseOneTable (
+    ACPI_TABLE_HEADER       *Table,
+    FILE                    *File,
+    ACPI_OWNER_ID           OwnerId);
+
+
+ACPI_TABLE_DESC             LocalTables[1];
+ACPI_PARSE_OBJECT           *AcpiGbl_ParseOpRoot;
+
+
+/* Stubs for everything except ASL compiler */
+
+#ifndef ACPI_ASL_COMPILER
+BOOLEAN
+AcpiDsIsResultUsed (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return (TRUE);
+}
+
+ACPI_STATUS
+AcpiDsMethodError (
+    ACPI_STATUS             Status,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return (Status);
+}
+#endif
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AdInitialize
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: ACPICA and local initialization
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AdInitialize (
+    void)
+{
+    ACPI_STATUS             Status;
+
+
+    /* ACPICA subsystem initialization */
+
+    Status = AcpiOsInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = AcpiUtInitGlobals ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = AcpiUtMutexInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = AcpiNsRootInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* Setup the Table Manager (cheat - there is no RSDT) */
+
+    AcpiGbl_RootTableList.MaxTableCount = 1;
+    AcpiGbl_RootTableList.CurrentTableCount = 0;
+    AcpiGbl_RootTableList.Tables = LocalTables;
+
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdAmlDisassemble
+ *
+ * PARAMETERS:  Filename            - AML input filename
+ *              OutToFile           - TRUE if output should go to a file
+ *              Prefix              - Path prefix for output
+ *              OutFilename         - where the filename is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Disassembler entry point. Disassemble an entire ACPI table.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AdAmlDisassemble (
+    BOOLEAN                 OutToFile,
+    char                    *Filename,
+    char                    *Prefix,
+    char                    **OutFilename)
+{
+    ACPI_STATUS             Status;
+    char                    *DisasmFilename = NULL;
+    FILE                    *File = NULL;
+    ACPI_TABLE_HEADER       *Table = NULL;
+    ACPI_NEW_TABLE_DESC     *ListHead = NULL;
+
+
+    /*
+     * Input: AML code from either a file or via GetTables (memory or
+     * registry)
+     */
+    if (Filename)
+    {
+        /* Get the list of all AML tables in the file */
+
+        Status = AcGetAllTablesFromFile (Filename,
+            ACPI_GET_ALL_TABLES, &ListHead);
+        if (ACPI_FAILURE (Status))
+        {
+            AcpiOsPrintf ("Could not get ACPI tables from %s, %s\n",
+                Filename, AcpiFormatException (Status));
+            return (Status);
+        }
+
+        /* Process any user-specified files for external objects */
+
+        Status = AdDoExternalFileList (Filename);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+    }
+    else
+    {
+        Status = AdGetLocalTables ();
+        if (ACPI_FAILURE (Status))
+        {
+            AcpiOsPrintf ("Could not get ACPI tables, %s\n",
+                AcpiFormatException (Status));
+            return (Status);
+        }
+
+        if (!AcpiGbl_DmOpt_Disasm)
+        {
+            return (AE_OK);
+        }
+
+        /* Obtained the local tables, just disassemble the DSDT */
+
+        Status = AcpiGetTable (ACPI_SIG_DSDT, 0, &Table);
+        if (ACPI_FAILURE (Status))
+        {
+            AcpiOsPrintf ("Could not get DSDT, %s\n",
+                AcpiFormatException (Status));
+            return (Status);
+        }
+
+        AcpiOsPrintf ("\nDisassembly of DSDT\n");
+        Prefix = AdGenerateFilename ("dsdt", Table->OemTableId);
+    }
+
+    /*
+     * Output: ASL code. Redirect to a file if requested
+     */
+    if (OutToFile)
+    {
+        /* Create/Open a disassembly output file */
+
+        DisasmFilename = FlGenerateFilename (Prefix, FILE_SUFFIX_DISASSEMBLY);
+        if (!DisasmFilename)
+        {
+            fprintf (stderr, "Could not generate output filename\n");
+            Status = AE_ERROR;
+            goto Cleanup;
+        }
+
+        File = fopen (DisasmFilename, "w+");
+        if (!File)
+        {
+            fprintf (stderr, "Could not open output file %s\n",
+                DisasmFilename);
+            Status = AE_ERROR;
+            goto Cleanup;
+        }
+
+        AcpiOsRedirectOutput (File);
+    }
+
+    *OutFilename = DisasmFilename;
+
+    /* Disassemble all AML tables within the file */
+
+    while (ListHead)
+    {
+        Status = AdDisassembleOneTable (ListHead->Table,
+            File, Filename, DisasmFilename);
+        if (ACPI_FAILURE (Status))
+        {
+            break;
+        }
+
+        ListHead = ListHead->Next;
+    }
+
+Cleanup:
+
+    if (Table &&
+        !AcpiGbl_ForceAmlDisassembly &&
+        !AcpiUtIsAmlTable (Table))
+    {
+        ACPI_FREE (Table);
+    }
+
+    if (File)
+    {
+        fclose (File);
+        AcpiOsRedirectOutput (stdout);
+    }
+
+    AcpiPsDeleteParseTree (AcpiGbl_ParseOpRoot);
+    AcpiGbl_ParseOpRoot = NULL;
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdDisassembleOneTable
+ *
+ * PARAMETERS:  Table               - Raw AML table
+ *              File                - Pointer for the input file
+ *              Filename            - AML input filename
+ *              DisasmFilename      - Output filename
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Disassemble a single ACPI table. AML or data table.
+ *
+ *****************************************************************************/
+
+static ACPI_STATUS
+AdDisassembleOneTable (
+    ACPI_TABLE_HEADER       *Table,
+    FILE                    *File,
+    char                    *Filename,
+    char                    *DisasmFilename)
+{
+    ACPI_STATUS             Status;
+    ACPI_OWNER_ID           OwnerId;
+
+
+    /* ForceAmlDisassembly means to assume the table contains valid AML */
+
+    if (!AcpiGbl_ForceAmlDisassembly && !AcpiUtIsAmlTable (Table))
+    {
+        AdDisassemblerHeader (Filename, ACPI_IS_DATA_TABLE);
+
+        /* This is a "Data Table" (non-AML table) */
+
+        AcpiOsPrintf (" * ACPI Data Table [%4.4s]\n *\n",
+            Table->Signature);
+        AcpiOsPrintf (" * Format: [HexOffset DecimalOffset ByteLength]  "
+            "FieldName : FieldValue\n */\n\n");
+
+        AcpiDmDumpDataTable (Table);
+        fprintf (stderr, "Acpi Data Table [%4.4s] decoded\n",
+            Table->Signature);
+
+        if (File)
+        {
+            fprintf (stderr, "Formatted output:  %s - %u bytes\n",
+                DisasmFilename, CmGetFileSize (File));
+        }
+
+        return (AE_OK);
+    }
+
+    /*
+     * This is an AML table (DSDT or SSDT).
+     * Always parse the tables, only option is what to display
+     */
+    Status = AdParseTable (Table, &OwnerId, TRUE, FALSE);
+    if (ACPI_FAILURE (Status))
+    {
+        AcpiOsPrintf ("Could not parse ACPI tables, %s\n",
+            AcpiFormatException (Status));
+        return (Status);
+    }
+
+    /* Debug output, namespace and parse tree */
+
+    if (AslCompilerdebug && File)
+    {
+        AcpiOsPrintf ("/**** Before second load\n");
+
+        NsSetupNamespaceListing (File);
+        NsDisplayNamespace ();
+
+        AcpiOsPrintf ("*****/\n");
+    }
+
+    /* Load namespace from names created within control methods */
+
+    AcpiDmFinishNamespaceLoad (AcpiGbl_ParseOpRoot,
+        AcpiGbl_RootNode, OwnerId);
+
+    /*
+     * Cross reference the namespace here, in order to
+     * generate External() statements
+     */
+    AcpiDmCrossReferenceNamespace (AcpiGbl_ParseOpRoot,
+        AcpiGbl_RootNode, OwnerId);
+
+    if (AslCompilerdebug)
+    {
+        AcpiDmDumpTree (AcpiGbl_ParseOpRoot);
+    }
+
+    /* Find possible calls to external control methods */
+
+    AcpiDmFindOrphanMethods (AcpiGbl_ParseOpRoot);
+
+    /*
+     * If we found any external control methods, we must reparse
+     * the entire tree with the new information (namely, the
+     * number of arguments per method)
+     */
+    if (AcpiDmGetExternalMethodCount ())
+    {
+        Status = AdReparseOneTable (Table, File, OwnerId);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+    }
+
+    /*
+     * Now that the namespace is finalized, we can perform namespace
+     * transforms.
+     *
+     * 1) Convert fixed-offset references to resource descriptors
+     *    to symbolic references (Note: modifies namespace)
+     */
+    AcpiDmConvertResourceIndexes (AcpiGbl_ParseOpRoot, AcpiGbl_RootNode);
+
+    /* Optional displays */
+
+    if (AcpiGbl_DmOpt_Disasm)
+    {
+        /* This is the real disassembly */
+
+        AdDisplayTables (Filename, Table);
+
+        /* Dump hex table if requested (-vt) */
+
+        AcpiDmDumpDataTable (Table);
+
+        fprintf (stderr, "Disassembly completed\n");
+        if (File)
+        {
+            fprintf (stderr, "ASL Output:    %s - %u bytes\n",
+                DisasmFilename, CmGetFileSize (File));
+        }
+
+        if (Gbl_MapfileFlag)
+        {
+            fprintf (stderr, "%14s %s - %u bytes\n",
+                Gbl_Files[ASL_FILE_MAP_OUTPUT].ShortDescription,
+                Gbl_Files[ASL_FILE_MAP_OUTPUT].Filename,
+                FlGetFileSize (ASL_FILE_MAP_OUTPUT));
+        }
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdReparseOneTable
+ *
+ * PARAMETERS:  Table               - Raw AML table
+ *              File                - Pointer for the input file
+ *              OwnerId             - ID for this table
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Reparse a table that has already been loaded. Used to
+ *              integrate information about external control methods.
+ *              These methods may have been previously parsed incorrectly.
+ *
+ *****************************************************************************/
+
+static ACPI_STATUS
+AdReparseOneTable (
+    ACPI_TABLE_HEADER       *Table,
+    FILE                    *File,
+    ACPI_OWNER_ID           OwnerId)
+{
+    ACPI_STATUS             Status;
+
+
+    fprintf (stderr,
+        "\nFound %u external control methods, "
+        "reparsing with new information\n",
+        AcpiDmGetExternalMethodCount ());
+
+    /* Reparse, rebuild namespace */
+
+    AcpiPsDeleteParseTree (AcpiGbl_ParseOpRoot);
+    AcpiGbl_ParseOpRoot = NULL;
+    AcpiNsDeleteNamespaceSubtree (AcpiGbl_RootNode);
+
+    AcpiGbl_RootNode                    = NULL;
+    AcpiGbl_RootNodeStruct.Name.Integer = ACPI_ROOT_NAME;
+    AcpiGbl_RootNodeStruct.DescriptorType = ACPI_DESC_TYPE_NAMED;
+    AcpiGbl_RootNodeStruct.Type         = ACPI_TYPE_DEVICE;
+    AcpiGbl_RootNodeStruct.Parent       = NULL;
+    AcpiGbl_RootNodeStruct.Child        = NULL;
+    AcpiGbl_RootNodeStruct.Peer         = NULL;
+    AcpiGbl_RootNodeStruct.Object       = NULL;
+    AcpiGbl_RootNodeStruct.Flags        = 0;
+
+    Status = AcpiNsRootInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* New namespace, add the external definitions first */
+
+    AcpiDmAddExternalsToNamespace ();
+
+    /* Parse the table again. No need to reload it, however */
+
+    Status = AdParseTable (Table, NULL, FALSE, FALSE);
+    if (ACPI_FAILURE (Status))
+    {
+        AcpiOsPrintf ("Could not parse ACPI tables, %s\n",
+            AcpiFormatException (Status));
+        return (Status);
+    }
+
+    /* Cross reference the namespace again */
+
+    AcpiDmFinishNamespaceLoad (AcpiGbl_ParseOpRoot,
+        AcpiGbl_RootNode, OwnerId);
+
+    AcpiDmCrossReferenceNamespace (AcpiGbl_ParseOpRoot,
+        AcpiGbl_RootNode, OwnerId);
+
+    /* Debug output - namespace and parse tree */
+
+    if (AslCompilerdebug)
+    {
+        AcpiOsPrintf ("/**** After second load and resource conversion\n");
+        if (File)
+        {
+            NsSetupNamespaceListing (File);
+            NsDisplayNamespace ();
+        }
+
+        AcpiOsPrintf ("*****/\n");
+        AcpiDmDumpTree (AcpiGbl_ParseOpRoot);
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdDoExternalFileList
+ *
+ * PARAMETERS:  Filename            - Input file for the table
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Process all tables found in the -e external files list
+ *
+ *****************************************************************************/
+
+static ACPI_STATUS
+AdDoExternalFileList (
+    char                    *Filename)
+{
+    ACPI_EXTERNAL_FILE      *ExternalFileList;
+    char                    *ExternalFilename;
+    ACPI_NEW_TABLE_DESC     *ExternalListHead = NULL;
+    ACPI_STATUS             Status;
+    ACPI_STATUS             GlobalStatus = AE_OK;
+    ACPI_OWNER_ID           OwnerId;
+
+
+    /*
+     * External filenames are specified on the command line like this:
+     * Example: iasl -e file1,file2,file3 -d xxx.aml
+     */
+    ExternalFileList = AcpiGbl_ExternalFileList;
+
+    /* Process each external file */
+
+    while (ExternalFileList)
+    {
+        ExternalFilename = ExternalFileList->Path;
+        if (!strcmp (ExternalFilename, Filename))
+        {
+            /* Next external file */
+
+            ExternalFileList = ExternalFileList->Next;
+            continue;
+        }
+
+        AcpiOsPrintf ("External object resolution file %16s\n",
+            ExternalFilename);
+
+        Status = AcGetAllTablesFromFile (
+            ExternalFilename, ACPI_GET_ONLY_AML_TABLES, &ExternalListHead);
+        if (ACPI_FAILURE (Status))
+        {
+            if (Status == AE_TYPE)
+            {
+                ExternalFileList = ExternalFileList->Next;
+                GlobalStatus = AE_TYPE;
+                Status = AE_OK;
+                continue;
+            }
+
+            return (Status);
+        }
+
+        /* Load external tables for symbol resolution */
+
+        while (ExternalListHead)
+        {
+            Status = AdParseTable (
+                ExternalListHead->Table, &OwnerId, TRUE, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                AcpiOsPrintf ("Could not parse external ACPI tables, %s\n",
+                    AcpiFormatException (Status));
+                return (Status);
+            }
+
+            /*
+             * Load namespace from names created within control methods
+             * Set owner id of nodes in external table
+             */
+            AcpiDmFinishNamespaceLoad (AcpiGbl_ParseOpRoot,
+                AcpiGbl_RootNode, OwnerId);
+            AcpiPsDeleteParseTree (AcpiGbl_ParseOpRoot);
+
+            ExternalListHead = ExternalListHead->Next;
+        }
+
+        /* Next external file */
+
+        ExternalFileList = ExternalFileList->Next;
+    }
+
+    if (ACPI_FAILURE (GlobalStatus))
+    {
+        return (GlobalStatus);
+    }
+
+    /* Clear external list generated by Scope in external tables */
+
+    if (AcpiGbl_ExternalFileList)
+    {
+        AcpiDmClearExternalList ();
+    }
+
+    /* Load any externals defined in the optional external ref file */
+
+    AcpiDmGetExternalsFromFile ();
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/common/adwalk.c b/usr/src/cmd/acpi/common/adwalk.c
new file mode 100644
index 0000000000..714d837d5e
--- /dev/null
+++ b/usr/src/cmd/acpi/common/adwalk.c
@@ -0,0 +1,1138 @@
+/******************************************************************************
+ *
+ * Module Name: adwalk - Application-level disassembler parse tree walk routines
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acparser.h"
+#include "amlcode.h"
+#include "acdisasm.h"
+#include "acdispat.h"
+#include "acnamesp.h"
+#include "acapps.h"
+
+
+#define _COMPONENT          ACPI_TOOLS
+        ACPI_MODULE_NAME    ("adwalk")
+
+/*
+ * aslmap - opcode mappings and reserved method names
+ */
+ACPI_OBJECT_TYPE
+AslMapNamedOpcodeToDataType (
+    UINT16                  Opcode);
+
+/* Local prototypes */
+
+static ACPI_STATUS
+AcpiDmFindOrphanDescending (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+AcpiDmDumpDescending (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+AcpiDmXrefDescendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+AcpiDmCommonAscendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+AcpiDmLoadDescendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static UINT32
+AcpiDmInspectPossibleArgs (
+    UINT32                  CurrentOpArgCount,
+    UINT32                  TargetCount,
+    ACPI_PARSE_OBJECT       *Op);
+
+static ACPI_STATUS
+AcpiDmResourceDescendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpTree
+ *
+ * PARAMETERS:  Origin              - Starting object
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Parse tree walk to format and output the nodes
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpTree (
+    ACPI_PARSE_OBJECT       *Origin)
+{
+    ACPI_OP_WALK_INFO       Info;
+
+
+    if (!Origin)
+    {
+        return;
+    }
+
+    AcpiOsPrintf ("/*\nAML Parse Tree\n\n");
+    Info.Flags = 0;
+    Info.Count = 0;
+    Info.Level = 0;
+    Info.WalkState = NULL;
+
+    AcpiDmWalkParseTree (Origin, AcpiDmDumpDescending, NULL, &Info);
+    AcpiOsPrintf ("*/\n\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmFindOrphanMethods
+ *
+ * PARAMETERS:  Origin              - Starting object
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Parse tree walk to find "orphaned" method invocations -- methods
+ *              that are not resolved in the namespace
+ *
+ ******************************************************************************/
+
+void
+AcpiDmFindOrphanMethods (
+    ACPI_PARSE_OBJECT       *Origin)
+{
+    ACPI_OP_WALK_INFO       Info;
+
+
+    if (!Origin)
+    {
+        return;
+    }
+
+    Info.Flags = 0;
+    Info.Level = 0;
+    Info.WalkState = NULL;
+
+    AcpiDmWalkParseTree (Origin, AcpiDmFindOrphanDescending, NULL, &Info);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmFinishNamespaceLoad
+ *
+ * PARAMETERS:  ParseTreeRoot       - Root of the parse tree
+ *              NamespaceRoot       - Root of the internal namespace
+ *              OwnerId             - OwnerId of the table to be disassembled
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Load all namespace items that are created within control
+ *              methods. Used before namespace cross reference
+ *
+ ******************************************************************************/
+
+void
+AcpiDmFinishNamespaceLoad (
+    ACPI_PARSE_OBJECT       *ParseTreeRoot,
+    ACPI_NAMESPACE_NODE     *NamespaceRoot,
+    ACPI_OWNER_ID           OwnerId)
+{
+    ACPI_STATUS             Status;
+    ACPI_OP_WALK_INFO       Info;
+    ACPI_WALK_STATE         *WalkState;
+
+
+    if (!ParseTreeRoot)
+    {
+        return;
+    }
+
+    /* Create and initialize a new walk state */
+
+    WalkState = AcpiDsCreateWalkState (OwnerId, ParseTreeRoot, NULL, NULL);
+    if (!WalkState)
+    {
+        return;
+    }
+
+    Status = AcpiDsScopeStackPush (NamespaceRoot, NamespaceRoot->Type,
+        WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    Info.Flags = 0;
+    Info.Level = 0;
+    Info.WalkState = WalkState;
+
+    AcpiDmWalkParseTree (ParseTreeRoot, AcpiDmLoadDescendingOp,
+        AcpiDmCommonAscendingOp, &Info);
+    ACPI_FREE (WalkState);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmCrossReferenceNamespace
+ *
+ * PARAMETERS:  ParseTreeRoot       - Root of the parse tree
+ *              NamespaceRoot       - Root of the internal namespace
+ *              OwnerId             - OwnerId of the table to be disassembled
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Cross reference the namespace to create externals
+ *
+ ******************************************************************************/
+
+void
+AcpiDmCrossReferenceNamespace (
+    ACPI_PARSE_OBJECT       *ParseTreeRoot,
+    ACPI_NAMESPACE_NODE     *NamespaceRoot,
+    ACPI_OWNER_ID           OwnerId)
+{
+    ACPI_STATUS             Status;
+    ACPI_OP_WALK_INFO       Info;
+    ACPI_WALK_STATE         *WalkState;
+
+
+    if (!ParseTreeRoot)
+    {
+        return;
+    }
+
+    /* Create and initialize a new walk state */
+
+    WalkState = AcpiDsCreateWalkState (OwnerId, ParseTreeRoot, NULL, NULL);
+    if (!WalkState)
+    {
+        return;
+    }
+
+    Status = AcpiDsScopeStackPush (NamespaceRoot, NamespaceRoot->Type,
+        WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    Info.Flags = 0;
+    Info.Level = 0;
+    Info.WalkState = WalkState;
+
+    AcpiDmWalkParseTree (ParseTreeRoot, AcpiDmXrefDescendingOp,
+        AcpiDmCommonAscendingOp, &Info);
+    ACPI_FREE (WalkState);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmConvertResourceIndexes
+ *
+ * PARAMETERS:  ParseTreeRoot       - Root of the parse tree
+ *              NamespaceRoot       - Root of the internal namespace
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert fixed-offset references to resource descriptors to
+ *              symbolic references. Should only be called after namespace has
+ *              been cross referenced.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmConvertResourceIndexes (
+    ACPI_PARSE_OBJECT       *ParseTreeRoot,
+    ACPI_NAMESPACE_NODE     *NamespaceRoot)
+{
+    ACPI_STATUS             Status;
+    ACPI_OP_WALK_INFO       Info;
+    ACPI_WALK_STATE         *WalkState;
+
+
+    if (!ParseTreeRoot)
+    {
+        return;
+    }
+
+    /* Create and initialize a new walk state */
+
+    WalkState = AcpiDsCreateWalkState (0, ParseTreeRoot, NULL, NULL);
+    if (!WalkState)
+    {
+        return;
+    }
+
+    Status = AcpiDsScopeStackPush (NamespaceRoot, NamespaceRoot->Type,
+        WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        ACPI_FREE (WalkState);
+        return;
+    }
+
+    Info.Flags = 0;
+    Info.Level = 0;
+    Info.WalkState = WalkState;
+
+    AcpiDmWalkParseTree (ParseTreeRoot, AcpiDmResourceDescendingOp,
+        AcpiDmCommonAscendingOp, &Info);
+    ACPI_FREE (WalkState);
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpDescending
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Format and print contents of one parse Op.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmDumpDescending (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_OP_WALK_INFO       *Info = Context;
+    char                    *Path;
+
+
+    if (!Op)
+    {
+        return (AE_OK);
+    }
+
+    /* Most of the information (count, level, name) here */
+
+    Info->Count++;
+    AcpiOsPrintf ("% 5d [%2.2d] ", Info->Count, Level);
+    AcpiDmIndent (Level);
+    AcpiOsPrintf ("%-28s", AcpiPsGetOpcodeName (Op->Common.AmlOpcode));
+
+    /* Extra info is helpful */
+
+    switch (Op->Common.AmlOpcode)
+    {
+    case AML_BYTE_OP:
+
+        AcpiOsPrintf ("%2.2X", (UINT32) Op->Common.Value.Integer);
+        break;
+
+    case AML_WORD_OP:
+
+        AcpiOsPrintf ("%4.4X", (UINT32) Op->Common.Value.Integer);
+        break;
+
+    case AML_DWORD_OP:
+
+        AcpiOsPrintf ("%8.8X", (UINT32) Op->Common.Value.Integer);
+        break;
+
+    case AML_QWORD_OP:
+
+        AcpiOsPrintf ("%8.8X%8.8X", ACPI_FORMAT_UINT64 (Op->Common.Value.Integer));
+        break;
+
+    case AML_INT_NAMEPATH_OP:
+
+        if (Op->Common.Value.String)
+        {
+            AcpiNsExternalizeName (ACPI_UINT32_MAX, Op->Common.Value.String,
+                NULL, &Path);
+            AcpiOsPrintf ("%s %p", Path, Op->Common.Node);
+            ACPI_FREE (Path);
+        }
+        else
+        {
+            AcpiOsPrintf ("[NULL]");
+        }
+        break;
+
+    case AML_NAME_OP:
+    case AML_METHOD_OP:
+    case AML_DEVICE_OP:
+    case AML_INT_NAMEDFIELD_OP:
+
+        AcpiOsPrintf ("%4.4s", ACPI_CAST_PTR (char, &Op->Named.Name));
+        break;
+
+    default:
+
+        break;
+    }
+
+    AcpiOsPrintf ("\n");
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmFindOrphanDescending
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Check namepath Ops for orphaned method invocations
+ *
+ * Note: Parts of this are experimental, under possible further development.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmFindOrphanDescending (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    const ACPI_OPCODE_INFO  *OpInfo;
+    ACPI_PARSE_OBJECT       *ChildOp;
+    ACPI_PARSE_OBJECT       *NextOp;
+    ACPI_PARSE_OBJECT       *ParentOp;
+    UINT32                  ArgCount;
+
+
+    if (!Op)
+    {
+        return (AE_OK);
+    }
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+
+    switch (Op->Common.AmlOpcode)
+    {
+#ifdef ACPI_UNDER_DEVELOPMENT
+    case AML_ADD_OP:
+
+        ChildOp = Op->Common.Value.Arg;
+        if ((ChildOp->Common.AmlOpcode == AML_INT_NAMEPATH_OP) &&
+            !ChildOp->Common.Node)
+        {
+            AcpiNsExternalizeName (ACPI_UINT32_MAX, ChildOp->Common.Value.String,
+                NULL, &Path);
+            AcpiOsPrintf ("/* %-16s A-NAMEPATH: %s  */\n",
+                Op->Common.AmlOpName, Path);
+            ACPI_FREE (Path);
+
+            NextOp = Op->Common.Next;
+            if (!NextOp)
+            {
+                /* This NamePath has no args, assume it is an integer */
+
+                AcpiDmAddOpToExternalList (ChildOp,
+                    ChildOp->Common.Value.String, ACPI_TYPE_INTEGER, 0, 0);
+                return (AE_OK);
+            }
+
+            ArgCount = AcpiDmInspectPossibleArgs (3, 1, NextOp);
+            AcpiOsPrintf ("/* A-CHILDREN: %u Actual %u */\n",
+                ArgCount, AcpiDmCountChildren (Op));
+
+            if (ArgCount < 1)
+            {
+                /* One Arg means this is just a Store(Name,Target) */
+
+                AcpiDmAddOpToExternalList (ChildOp,
+                    ChildOp->Common.Value.String, ACPI_TYPE_INTEGER, 0, 0);
+                return (AE_OK);
+            }
+
+            AcpiDmAddOpToExternalList (ChildOp,
+                ChildOp->Common.Value.String, ACPI_TYPE_METHOD, ArgCount, 0);
+        }
+        break;
+
+#endif
+
+    case AML_STORE_OP:
+
+        ChildOp = Op->Common.Value.Arg;
+        if ((ChildOp->Common.AmlOpcode == AML_INT_NAMEPATH_OP) &&
+            !ChildOp->Common.Node)
+        {
+            NextOp = Op->Common.Next;
+            if (!NextOp)
+            {
+                /* This NamePath has no args, assume it is an integer */
+
+                AcpiDmAddOpToExternalList (ChildOp,
+                    ChildOp->Common.Value.String, ACPI_TYPE_INTEGER, 0, 0);
+                return (AE_OK);
+            }
+
+            ArgCount = AcpiDmInspectPossibleArgs (2, 1, NextOp);
+            if (ArgCount <= 1)
+            {
+                /* One Arg means this is just a Store(Name,Target) */
+
+                AcpiDmAddOpToExternalList (ChildOp,
+                    ChildOp->Common.Value.String, ACPI_TYPE_INTEGER, ArgCount, 0);
+                return (AE_OK);
+            }
+
+            AcpiDmAddOpToExternalList (ChildOp,
+                ChildOp->Common.Value.String, ACPI_TYPE_METHOD, ArgCount, 0);
+        }
+        break;
+
+    case AML_INT_NAMEPATH_OP:
+
+        /* Must examine parent to see if this namepath is an argument */
+
+        ParentOp = Op->Common.Parent;
+        OpInfo = AcpiPsGetOpcodeInfo (ParentOp->Common.AmlOpcode);
+
+        if ((OpInfo->Class != AML_CLASS_EXECUTE) &&
+            (OpInfo->Class != AML_CLASS_CREATE) &&
+            (OpInfo->ObjectType != ACPI_TYPE_LOCAL_ALIAS) &&
+            (ParentOp->Common.AmlOpcode != AML_INT_METHODCALL_OP) &&
+            !Op->Common.Node)
+        {
+            ArgCount = AcpiDmInspectPossibleArgs (0, 0, Op);
+
+            /*
+             * Check if namepath is a predicate for if/while or lone parameter to
+             * a return.
+             */
+            if (ArgCount == 0)
+            {
+                if (((ParentOp->Common.AmlOpcode == AML_IF_OP) ||
+                     (ParentOp->Common.AmlOpcode == AML_WHILE_OP) ||
+                     (ParentOp->Common.AmlOpcode == AML_RETURN_OP)) &&
+
+                     /* And namepath is the first argument */
+                     (ParentOp->Common.Value.Arg == Op))
+                {
+                    AcpiDmAddOpToExternalList (Op,
+                        Op->Common.Value.String, ACPI_TYPE_INTEGER, 0, 0);
+                    break;
+                }
+            }
+
+            /*
+             * This is a standalone namestring (not a parameter to another
+             * operator) - it *must* be a method invocation, nothing else is
+             * grammatically possible.
+             */
+            AcpiDmAddOpToExternalList (Op,
+                Op->Common.Value.String, ACPI_TYPE_METHOD, ArgCount, 0);
+        }
+        break;
+
+    default:
+
+        break;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmLoadDescendingOp
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending handler for namespace control method object load
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmLoadDescendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_OP_WALK_INFO       *Info = Context;
+    const ACPI_OPCODE_INFO  *OpInfo;
+    ACPI_WALK_STATE         *WalkState;
+    ACPI_OBJECT_TYPE        ObjectType;
+    ACPI_STATUS             Status;
+    char                    *Path = NULL;
+    ACPI_PARSE_OBJECT       *NextOp;
+    ACPI_NAMESPACE_NODE     *Node;
+    char                    FieldPath[5];
+    BOOLEAN                 PreDefined = FALSE;
+    UINT8                   PreDefineIndex = 0;
+
+
+    WalkState = Info->WalkState;
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+    ObjectType = OpInfo->ObjectType;
+    ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+
+    /* Only interested in operators that create new names */
+
+    if (!(OpInfo->Flags & AML_NAMED) &&
+        !(OpInfo->Flags & AML_CREATE))
+    {
+        goto Exit;
+    }
+
+    /* Get the NamePath from the appropriate place */
+
+    if (OpInfo->Flags & AML_NAMED)
+    {
+        /* For all named operators, get the new name */
+
+        Path = (char *) Op->Named.Path;
+
+        if (!Path && Op->Common.AmlOpcode == AML_INT_NAMEDFIELD_OP)
+        {
+            *ACPI_CAST_PTR (UINT32, &FieldPath[0]) = Op->Named.Name;
+            FieldPath[4] = 0;
+            Path = FieldPath;
+        }
+    }
+    else if (OpInfo->Flags & AML_CREATE)
+    {
+        /* New name is the last child */
+
+        NextOp = Op->Common.Value.Arg;
+
+        while (NextOp->Common.Next)
+        {
+            NextOp = NextOp->Common.Next;
+        }
+
+        Path = NextOp->Common.Value.String;
+    }
+
+    if (!Path)
+    {
+        goto Exit;
+    }
+
+    /* Insert the name into the namespace */
+
+    Status = AcpiNsLookup (WalkState->ScopeInfo, Path, ObjectType,
+        ACPI_IMODE_LOAD_PASS2, ACPI_NS_DONT_OPEN_SCOPE,
+        WalkState, &Node);
+
+    Op->Common.Node = Node;
+
+    if (ACPI_SUCCESS (Status))
+    {
+        /* Check if it's a predefined node */
+
+        while (AcpiGbl_PreDefinedNames[PreDefineIndex].Name)
+        {
+            if (ACPI_COMPARE_NAME (Node->Name.Ascii,
+                AcpiGbl_PreDefinedNames[PreDefineIndex].Name))
+            {
+                PreDefined = TRUE;
+                break;
+            }
+
+            PreDefineIndex++;
+        }
+
+        /*
+         * Set node owner id if it satisfies all the following conditions:
+         * 1) Not a predefined node, _SB_ etc
+         * 2) Not the root node
+         * 3) Not a node created by Scope
+         */
+
+        if (!PreDefined && Node != AcpiGbl_RootNode &&
+            Op->Common.AmlOpcode != AML_SCOPE_OP)
+        {
+            Node->OwnerId = WalkState->OwnerId;
+        }
+    }
+
+
+Exit:
+
+    if (AcpiNsOpensScope (ObjectType))
+    {
+        if (Op->Common.Node)
+        {
+            Status = AcpiDsScopeStackPush (Op->Common.Node, ObjectType,
+                WalkState);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+        }
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmXrefDescendingOp
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending handler for namespace cross reference
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmXrefDescendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_OP_WALK_INFO       *Info = Context;
+    const ACPI_OPCODE_INFO  *OpInfo;
+    ACPI_WALK_STATE         *WalkState;
+    ACPI_OBJECT_TYPE        ObjectType;
+    ACPI_OBJECT_TYPE        ObjectType2;
+    ACPI_STATUS             Status;
+    char                    *Path = NULL;
+    ACPI_PARSE_OBJECT       *NextOp;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_OPERAND_OBJECT     *Object;
+    UINT32                  ParamCount = 0;
+    char                    *Pathname;
+    UINT16                  Flags = 0;
+
+
+    WalkState = Info->WalkState;
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+    ObjectType = OpInfo->ObjectType;
+    ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+
+    if ((!(OpInfo->Flags & AML_NAMED)) &&
+        (!(OpInfo->Flags & AML_CREATE)) &&
+        (Op->Common.AmlOpcode != AML_INT_NAMEPATH_OP) &&
+        (Op->Common.AmlOpcode != AML_NOTIFY_OP))
+    {
+        goto Exit;
+    }
+    else if (Op->Common.Parent &&
+             Op->Common.Parent->Common.AmlOpcode == AML_EXTERNAL_OP)
+    {
+        /* External() NamePath */
+
+        Path = Op->Common.Value.String;
+        ObjectType = (ACPI_OBJECT_TYPE) Op->Common.Next->Common.Value.Integer;
+        if (ObjectType == ACPI_TYPE_METHOD)
+        {
+            ParamCount = (UINT32)
+                Op->Common.Next->Common.Next->Common.Value.Integer;
+        }
+
+        Flags |= ACPI_EXT_RESOLVED_REFERENCE | ACPI_EXT_ORIGIN_FROM_OPCODE;
+        AcpiDmAddOpToExternalList (Op, Path,
+            (UINT8) ObjectType, ParamCount, Flags);
+
+        goto Exit;
+    }
+
+    /* Get the NamePath from the appropriate place */
+
+    if (OpInfo->Flags & AML_NAMED)
+    {
+        /*
+         * Only these two operators (Alias, Scope) refer to an existing
+         * name, it is the first argument
+         */
+        if (Op->Common.AmlOpcode == AML_ALIAS_OP)
+        {
+            ObjectType = ACPI_TYPE_ANY;
+
+            NextOp = Op->Common.Value.Arg;
+            NextOp = NextOp->Common.Value.Arg;
+            if (NextOp->Common.AmlOpcode == AML_INT_NAMEPATH_OP)
+            {
+                Path = NextOp->Common.Value.String;
+            }
+        }
+        else if (Op->Common.AmlOpcode == AML_SCOPE_OP)
+        {
+            Path = (char *) Op->Named.Path;
+        }
+    }
+    else if (OpInfo->Flags & AML_CREATE)
+    {
+        /* Referenced Buffer Name is the first child */
+
+        ObjectType = ACPI_TYPE_BUFFER; /* Change from TYPE_BUFFER_FIELD */
+
+        NextOp = Op->Common.Value.Arg;
+        if (NextOp->Common.AmlOpcode == AML_INT_NAMEPATH_OP)
+        {
+            Path = NextOp->Common.Value.String;
+        }
+    }
+    else if (Op->Common.AmlOpcode == AML_NOTIFY_OP)
+    {
+        Path = Op->Common.Value.Arg->Asl.Value.String;
+    }
+    else
+    {
+        Path = Op->Common.Value.String;
+    }
+
+    if (!Path)
+    {
+        goto Exit;
+    }
+
+    /*
+     * Lookup the name in the namespace. Name must exist at this point, or it
+     * is an invalid reference.
+     *
+     * The namespace is also used as a lookup table for references to resource
+     * descriptors and the fields within them.
+     */
+    Node = NULL;
+    Status = AcpiNsLookup (WalkState->ScopeInfo, Path, ACPI_TYPE_ANY,
+        ACPI_IMODE_EXECUTE, ACPI_NS_SEARCH_PARENT | ACPI_NS_DONT_OPEN_SCOPE,
+        WalkState, &Node);
+
+    if (ACPI_SUCCESS (Status) && (Node->Flags & ANOBJ_IS_EXTERNAL))
+    {
+        /* Node was created by an External() statement */
+
+        Status = AE_NOT_FOUND;
+    }
+
+    if (ACPI_FAILURE (Status))
+    {
+        if (Status == AE_NOT_FOUND)
+        {
+            /*
+             * Add this symbol as an external declaration, except if the
+             * parent is a CondRefOf operator. For this operator, we do not
+             * need an external, nor do we want one, since this can cause
+             * disassembly problems if the symbol is actually a control
+             * method.
+             */
+            if (!(Op->Asl.Parent &&
+                (Op->Asl.Parent->Asl.AmlOpcode == AML_COND_REF_OF_OP)))
+            {
+                if (Node)
+                {
+                    AcpiDmAddNodeToExternalList (Node,
+                        (UINT8) ObjectType, 7, Flags);
+                }
+                else
+                {
+                    AcpiDmAddOpToExternalList (Op, Path,
+                        (UINT8) ObjectType, 7, Flags);
+                }
+            }
+        }
+    }
+
+    /*
+     * Found the node, but check if it came from an external table.
+     * Add it to external list. Note: Node->OwnerId == 0 indicates
+     * one of the built-in ACPI Names (_OS_ etc.) which can safely
+     * be ignored.
+     */
+    else if (Node->OwnerId &&
+            (WalkState->OwnerId != Node->OwnerId))
+    {
+        ObjectType2 = ObjectType;
+
+        Object = AcpiNsGetAttachedObject (Node);
+        if (Object)
+        {
+            ObjectType2 = Object->Common.Type;
+            if (ObjectType2 == ACPI_TYPE_METHOD)
+            {
+                ParamCount = Object->Method.ParamCount;
+            }
+        }
+
+        Pathname = AcpiNsGetExternalPathname (Node);
+        if (!Pathname)
+        {
+            return (AE_NO_MEMORY);
+        }
+
+        AcpiDmAddNodeToExternalList (Node, (UINT8) ObjectType2,
+            ParamCount, ACPI_EXT_RESOLVED_REFERENCE);
+
+        ACPI_FREE (Pathname);
+        Op->Common.Node = Node;
+    }
+    else
+    {
+        Op->Common.Node = Node;
+    }
+
+
+Exit:
+    /* Open new scope if necessary */
+
+    if (AcpiNsOpensScope (ObjectType))
+    {
+        if (Op->Common.Node)
+        {
+            Status = AcpiDsScopeStackPush (Op->Common.Node, ObjectType,
+                WalkState);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+        }
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmResourceDescendingOp
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Process one parse op during symbolic resource index conversion.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmResourceDescendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_OP_WALK_INFO       *Info = Context;
+    const ACPI_OPCODE_INFO  *OpInfo;
+    ACPI_WALK_STATE         *WalkState;
+    ACPI_OBJECT_TYPE        ObjectType;
+    ACPI_STATUS             Status;
+
+
+    WalkState = Info->WalkState;
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+
+    /* Open new scope if necessary */
+
+    ObjectType = OpInfo->ObjectType;
+    if (AcpiNsOpensScope (ObjectType))
+    {
+        if (Op->Common.Node)
+        {
+
+            Status = AcpiDsScopeStackPush (Op->Common.Node, ObjectType,
+                WalkState);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+        }
+    }
+
+    /*
+     * Check if this operator contains a reference to a resource descriptor.
+     * If so, convert the reference into a symbolic reference.
+     */
+    AcpiDmCheckResourceReference (Op, WalkState);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmCommonAscendingOp
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Ascending handler for combined parse/namespace walks. Closes
+ *              scope if necessary.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmCommonAscendingOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_OP_WALK_INFO       *Info = Context;
+    const ACPI_OPCODE_INFO  *OpInfo;
+    ACPI_OBJECT_TYPE        ObjectType;
+
+
+    /* Close scope if necessary */
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+    ObjectType = OpInfo->ObjectType;
+    ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+
+    if (AcpiNsOpensScope (ObjectType))
+    {
+        (void) AcpiDsScopeStackPop (Info->WalkState);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmInspectPossibleArgs
+ *
+ * PARAMETERS:  CurrentOpArgCount   - Which arg of the current op was the
+ *                                    possible method invocation found
+ *              TargetCount         - Number of targets (0,1,2) for this op
+ *              Op                  - Parse op
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Examine following args and next ops for possible arguments
+ *              for an unrecognized method invocation.
+ *
+ ******************************************************************************/
+
+static UINT32
+AcpiDmInspectPossibleArgs (
+    UINT32                  CurrentOpArgCount,
+    UINT32                  TargetCount,
+    ACPI_PARSE_OBJECT       *Op)
+{
+    const ACPI_OPCODE_INFO  *OpInfo;
+    UINT32                  i;
+    UINT32                  ArgumentCount = 0;
+    ACPI_PARSE_OBJECT       *NextOp;
+    ACPI_PARSE_OBJECT       *ExecuteOp;
+
+
+    if (!Op)
+    {
+        return (0);
+    }
+
+    /* Lookahead for the maximum number of possible arguments */
+
+    NextOp = Op->Common.Next;
+
+    for (i = 0; (i < ACPI_METHOD_NUM_ARGS) && NextOp; i++)
+    {
+        OpInfo = AcpiPsGetOpcodeInfo (NextOp->Common.AmlOpcode);
+
+        /* Any one of these operators is "very probably" not a method arg */
+
+        if ((NextOp->Common.AmlOpcode == AML_STORE_OP) ||
+            (NextOp->Common.AmlOpcode == AML_NOTIFY_OP) ||
+            (OpInfo->Class == AML_CLASS_CONTROL) ||
+            (OpInfo->Class == AML_CLASS_CREATE) ||
+            (OpInfo->Class == AML_CLASS_NAMED_OBJECT))
+        {
+            break;
+        }
+
+        if (OpInfo->Class == AML_CLASS_EXECUTE)
+        {
+            /* Probable that this is method arg if there is no target */
+
+            ExecuteOp = NextOp->Common.Value.Arg;
+            while (ExecuteOp)
+            {
+                if ((ExecuteOp->Common.AmlOpcode == AML_INT_NAMEPATH_OP) &&
+                    (ExecuteOp->Common.Value.Arg == NULL))
+                {
+                    /* No target, could be a method arg */
+
+                    break;
+                }
+
+                if (NextOp->Common.AmlOpcode == AML_REF_OF_OP)
+                {
+                    break;
+                }
+
+                ExecuteOp = ExecuteOp->Common.Next;
+            }
+
+            if (!ExecuteOp)
+            {
+                /* Has a target, not method arg */
+
+                return (ArgumentCount);
+            }
+        }
+
+        ArgumentCount++;
+        NextOp = NextOp->Common.Next;
+    }
+
+    return (ArgumentCount);
+}
diff --git a/usr/src/cmd/acpi/common/ahids.c b/usr/src/cmd/acpi/common/ahids.c
new file mode 100644
index 0000000000..51dc8dc803
--- /dev/null
+++ b/usr/src/cmd/acpi/common/ahids.c
@@ -0,0 +1,245 @@
+/******************************************************************************
+ *
+ * Module Name: ahids - Table of ACPI/PNP _HID/_CID values
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+
+#define _COMPONENT          ACPI_UTILITIES
+        ACPI_MODULE_NAME    ("ahids")
+
+
+/*
+ * ACPI/PNP Device IDs with description strings
+ */
+const AH_DEVICE_ID  AslDeviceIds[] =
+{
+    {"10EC5640",    "Realtek I2S Audio Codec"},
+    {"80860F09",    "Intel PWM Controller"},
+    {"80860F0A",    "Intel Atom UART Controller"},
+    {"80860F0E",    "Intel SPI Controller"},
+    {"80860F14",    "Intel Baytrail SDIO/MMC Host Controller"},
+    {"80860F28",    "Intel SST Audio DSP"},
+    {"80860F41",    "Intel Baytrail I2C Host Controller"},
+    {"ACPI0001",    "SMBus 1.0 Host Controller"},
+    {"ACPI0002",    "Smart Battery Subsystem"},
+    {"ACPI0003",    "Power Source Device"},
+    {"ACPI0004",    "Module Device"},
+    {"ACPI0005",    "SMBus 2.0 Host Controller"},
+    {"ACPI0006",    "GPE Block Device"},
+    {"ACPI0007",    "Processor Device"},
+    {"ACPI0008",    "Ambient Light Sensor Device"},
+    {"ACPI0009",    "I/O xAPIC Device"},
+    {"ACPI000A",    "I/O APIC Device"},
+    {"ACPI000B",    "I/O SAPIC Device"},
+    {"ACPI000C",    "Processor Aggregator Device"},
+    {"ACPI000D",    "Power Meter Device"},
+    {"ACPI000E",    "Time and Alarm Device"},
+    {"ACPI000F",    "User Presence Detection Device"},
+    {"ACPI0010",    "Processor Container Device"},
+    {"ACPI0011",    "Generic Buttons Device"},
+    {"ACPI0012",    "NVDIMM Root Device"},
+    {"ACPI0013",    "Generic Event Device"},
+    {"ADMA0F28",    "Intel Audio DMA"},
+    {"AMCR0F28",    "Intel Audio Machine Driver"},
+    {"ATK4001",     "Asus Radio Control Button"},
+    {"ATML1000",    "Atmel Touchscreen Controller"},
+    {"AUTH2750",    "AuthenTec AES2750"},
+    {"BCM2E39",     "Broadcom BT Serial Bus Driver over UART Bus Enumerator"},
+    {"BCM4752E",    "Broadcom GPS Controller"},
+    {"BMG0160",     "Bosch Gyro Sensor"},
+    {"CPLM3218",    "Capella Micro CM3218x Ambient Light Sensor"},
+    {"DELLABCE",    "Dell Airplane Mode Switch Driver"},
+    {"DLAC3002",    "Qualcomm Atheros Bluetooth UART Transport"},
+    {"FTTH5506",    "FocalTech 5506 Touch Controller"},
+    {"HAD0F28",     "Intel HDMI Audio Driver"},
+    {"INBC0000",    "GPIO Expander"},
+    {"INT0002",     "Virtual GPIO Controller"},
+    {"INT0800",     "Intel 82802 Firmware Hub Device"},
+    {"INT3394",     "ACPI System Fan"},
+    {"INT3396",     "Standard Power Management Controller"},
+    {"INT33A0",     "Intel Smart Connect Technology Device"},
+    {"INT33A1",     "Intel Power Engine"},
+    {"INT33BB",     "Intel Baytrail SD Host Controller"},
+    {"INT33BD",     "Intel Baytrail Mailbox Device"},
+    {"INT33BE",     "Camera Sensor OV5693"},
+    {"INT33C0",     "Intel Serial I/O SPI Host Controller"},
+    {"INT33C1",     "Intel Serial I/O SPI Host Controller"},
+    {"INT33C2",     "Intel Serial I/O I2C Host Controller"},
+    {"INT33C3",     "Intel Serial I/O I2C Host Controller"},
+    {"INT33C4",     "Intel Serial I/O UART Host Controller"},
+    {"INT33C5",     "Intel Serial I/O UART Host Controller"},
+    {"INT33C6",     "Intel SD Host Controller"},
+    {"INT33C7",     "Intel Serial I/O GPIO Host Controller"},
+    {"INT33C8",     "Intel Smart Sound Technology Host Controller"},
+    {"INT33C9",     "Wolfson Microelectronics Audio WM5102"},
+    {"INT33CA",     "Intel SPB Peripheral"},
+    {"INT33CB",     "Intel Smart Sound Technology Audio Codec"},
+    {"INT33D1",     "Intel GPIO Buttons"},
+    {"INT33D2",     "Intel GPIO Buttons"},
+    {"INT33D3",     "Intel GPIO Buttons"},
+    {"INT33D4",     "Intel GPIO Buttons"},
+    {"INT33D6",     "Intel Virtual Buttons Device"},
+    {"INT33F0",     "Camera Sensor MT9M114"},
+    {"INT33F4",     "XPOWER PMIC Controller"},
+    {"INT33F5",     "TI PMIC Controller"},
+    {"INT33FB",     "MIPI-CSI Camera Sensor OV2722"},
+    {"INT33FC",     "Intel Baytrail GPIO Controller"},
+    {"INT33FD",     "Intel Baytrail Power Management IC"},
+    {"INT33FE",     "XPOWER Battery Device"},
+    {"INT3400",     "Intel Dynamic Power Performance Management"},
+    {"INT3401",     "Intel Extended Thermal Model CPU"},
+    {"INT3403",     "DPTF Temperature Sensor"},
+    {"INT3406",     "Intel Dynamic Platform & Thermal Framework Display Participant"},
+    {"INT3407",     "DPTF Platform Power Meter"},
+    {"INT340E",     "Motherboard Resources"},
+    {"INT3420",     "Intel Bluetooth RF Kill"},
+    {"INT3F0D",     "ACPI Motherboard Resources"},
+    {"INTCF1A",     "Sony IMX175 Camera Sensor"},
+    {"INTCFD9",     "Intel Baytrail SOC GPIO Controller"},
+    {"INTL9C60",    "Intel Baytrail SOC DMA Controller"},
+    {"INVN6500",    "InvenSense MPU-6500 Six Axis Gyroscope and Accelerometer"},
+    {"LNXCPU",      "Linux Logical CPU"},
+    {"LNXPOWER",    "ACPI Power Resource (power gating)"},
+    {"LNXPWRBN",    "System Power Button"},
+    {"LNXSYBUS",    "System Bus"},
+    {"LNXSYSTM",    "ACPI Root Node"},
+    {"LNXTHERM",    "ACPI Thermal Zone"},
+    {"LNXVIDEO",    "ACPI Video Controller"},
+    {"MAX17047",    "Fuel Gauge Controller"},
+    {"MSFT0101",    "TPM 2.0 Security Device"},
+    {"NXP5442",     "NXP 5442 Near Field Communications Controller"},
+    {"NXP5472",     "NXP NFC"},
+    {"PNP0000",     "8259-compatible Programmable Interrupt Controller"},
+    {"PNP0001",     "EISA Interrupt Controller"},
+    {"PNP0002",     "MCA Interrupt Controller"},
+    {"PNP0003",     "IO-APIC Interrupt Controller"},
+    {"PNP0100",     "PC-class System Timer"},
+    {"PNP0103",     "HPET System Timer"},
+    {"PNP0200",     "PC-class DMA Controller"},
+    {"PNP0300",     "IBM PC/XT Keyboard Controller (83 key)"},
+    {"PNP0301",     "IBM PC/XT Keyboard Controller (86 key)"},
+    {"PNP0302",     "IBM PC/XT Keyboard Controller (84 key)"},
+    {"PNP0303",     "IBM Enhanced Keyboard (101/102-key, PS/2 Mouse)"},
+    {"PNP0400",     "Standard LPT Parallel Port"},
+    {"PNP0401",     "ECP Parallel Port"},
+    {"PNP0500",     "Standard PC COM Serial Port"},
+    {"PNP0501",     "16550A-compatible COM Serial Port"},
+    {"PNP0510",     "Generic IRDA-compatible Device"},
+    {"PNP0800",     "Microsoft Sound System Compatible Device"},
+    {"PNP0A03",     "PCI Bus"},
+    {"PNP0A05",     "Generic Container Device"},
+    {"PNP0A06",     "Generic Container Device"},
+    {"PNP0A08",     "PCI Express Bus"},
+    {"PNP0B00",     "AT Real-Time Clock"},
+    {"PNP0B01",     "Intel PIIX4-compatible RTC/CMOS Device"},
+    {"PNP0B02",     "Dallas Semiconductor-compatible RTC/CMOS Device"},
+    {"PNP0C01",     "System Board"},
+    {"PNP0C02",     "PNP Motherboard Resources"},
+    {"PNP0C04",     "x87-compatible Floating Point Processing Unit"},
+    {"PNP0C08",     "ACPI Core Hardware"},
+    {"PNP0C09",     "Embedded Controller Device"},
+    {"PNP0C0A",     "Control Method Battery"},
+    {"PNP0C0B",     "Fan (Thermal Solution)"},
+    {"PNP0C0C",     "Power Button Device"},
+    {"PNP0C0D",     "Lid Device"},
+    {"PNP0C0E",     "Sleep Button Device"},
+    {"PNP0C0F",     "PCI Interrupt Link Device"},
+    {"PNP0C10",     "System Indicator Device"},
+    {"PNP0C11",     "Thermal Zone"},
+    {"PNP0C12",     "Device Bay Controller"},
+    {"PNP0C14",     "Windows Management Instrumentation Device"},
+    {"PNP0C15",     "Docking Station"},
+    {"PNP0C33",     "Error Device"},
+    {"PNP0C40",     "Standard Button Controller"},
+    {"PNP0C50",     "HID Protocol Device (I2C bus)"},
+    {"PNP0C60",     "Display Sensor Device"},
+    {"PNP0C70",     "Dock Sensor Device"},
+    {"PNP0C80",     "Memory Device"},
+    {"PNP0D10",     "XHCI USB Controller with debug"},
+    {"PNP0D15",     "XHCI USB Controller without debug"},
+    {"PNP0D20",     "EHCI USB Controller without debug"},
+    {"PNP0D25",     "EHCI USB Controller with debug"},
+    {"PNP0D40",     "SDA Standard Compliant SD Host Controller"},
+    {"PNP0D80",     "Windows-compatible System Power Management Controller"},
+    {"PNP0F03",     "Microsoft PS/2-style Mouse"},
+    {"PNP0F13",     "PS/2 Mouse"},
+    {"RTL8723",     "Realtek Wireless Controller"},
+    {"SMB0349",     "Charger"},
+    {"SMO91D0",     "Sensor Hub"},
+    {"SMSC3750",    "SMSC 3750 USB MUX"},
+    {"SSPX0000",    "Intel SSP Device"},
+    {"TBQ24296",    "Charger"},
+
+    {NULL, NULL}
+};
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiAhMatchHardwareId
+ *
+ * PARAMETERS:  HardwareId          - String representation of an _HID or _CID
+ *
+ * RETURN:      ID info struct. NULL if HardwareId is not found
+ *
+ * DESCRIPTION: Lookup an _HID/_CID in the device ID table
+ *
+ ******************************************************************************/
+
+const AH_DEVICE_ID *
+AcpiAhMatchHardwareId (
+    char                    *HardwareId)
+{
+    const AH_DEVICE_ID      *Info;
+
+
+    for (Info = AslDeviceIds; Info->Name; Info++)
+    {
+        if (!strcmp (HardwareId, Info->Name))
+        {
+            return (Info);
+        }
+    }
+
+    return (NULL);
+}
diff --git a/usr/src/cmd/acpi/common/ahpredef.c b/usr/src/cmd/acpi/common/ahpredef.c
new file mode 100644
index 0000000000..c3991be3a2
--- /dev/null
+++ b/usr/src/cmd/acpi/common/ahpredef.c
@@ -0,0 +1,372 @@
+/******************************************************************************
+ *
+ * Module Name: ahpredef - Table of all known ACPI predefined names
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+
+#define _COMPONENT          ACPI_UTILITIES
+        ACPI_MODULE_NAME    ("ahpredef")
+
+/*
+ * iASL only needs a partial table (short descriptions only).
+ * AcpiHelp needs the full table.
+ */
+#ifdef ACPI_ASL_COMPILER
+#define AH_PREDEF(Name, ShortDesc, LongDesc) {Name, ShortDesc}
+#else
+#define AH_PREDEF(Name, ShortDesc, LongDesc) {Name, ShortDesc, LongDesc}
+#endif
+
+/*
+ * Predefined ACPI names, with short description and return value.
+ * This table was extracted directly from the ACPI specification.
+ */
+const AH_PREDEFINED_NAME    AslPredefinedInfo[] =
+{
+    AH_PREDEF ("_ACx",    "Active Cooling", "Returns the active cooling policy threshold values"),
+    AH_PREDEF ("_ADR",    "Address", "Returns address of a device on parent bus, and resource field"),
+    AH_PREDEF ("_AEI",    "ACPI Event Interrupts", "Returns a list of GPIO events to be used as ACPI events"),
+    AH_PREDEF ("_ALC",    "Ambient Light Chromaticity", "Returns the ambient light color chromaticity"),
+    AH_PREDEF ("_ALI",    "Ambient Light Illuminance", "Returns the ambient light brightness"),
+    AH_PREDEF ("_ALN",    "Alignment", "Base alignment, Resource Descriptor field"),
+    AH_PREDEF ("_ALP",    "Ambient Light Polling", "Returns the ambient light sensor polling frequency"),
+    AH_PREDEF ("_ALR",    "Ambient Light Response", "Returns the ambient light brightness to display brightness mappings"),
+    AH_PREDEF ("_ALT",    "Ambient Light Temperature", "Returns the ambient light color temperature"),
+    AH_PREDEF ("_ALx",    "Active List", "Returns a list of active cooling device objects"),
+    AH_PREDEF ("_ART",    "Active Cooling Relationship Table", "Returns thermal relationship information between platform devices and fan devices"),
+    AH_PREDEF ("_ASI",    "Address Space Id", "Resource Descriptor field"),
+    AH_PREDEF ("_ASZ",    "Access Size", "Resource Descriptor field"),
+    AH_PREDEF ("_ATT",    "Type-Specific Attribute", "Resource Descriptor field"),
+    AH_PREDEF ("_BAS",    "Base Address", "Range base address, Resource Descriptor field"),
+    AH_PREDEF ("_BBN",    "BIOS Bus Number", "Returns the PCI bus number returned by the BIOS"),
+    AH_PREDEF ("_BCL",    "Brightness Control Levels", "Returns a list of supported brightness control levels"),
+    AH_PREDEF ("_BCM",    "Brightness Control Method", "Sets the brightness level of the display device"),
+    AH_PREDEF ("_BCT",    "Battery Charge Time", "Returns time remaining to complete charging battery"),
+    AH_PREDEF ("_BDN",    "BIOS Dock Name", "Returns the Dock ID returned by the BIOS"),
+    AH_PREDEF ("_BFS",    "Back From Sleep", "Inform AML of a wake event"),
+    AH_PREDEF ("_BIF",    "Battery Information", "Returns a Control Method Battery information block"),
+    AH_PREDEF ("_BIX",    "Battery Information Extended", "Returns a Control Method Battery extended information block"),
+    AH_PREDEF ("_BLT",    "Battery Level Threshold", "Set battery level threshold preferences"),
+    AH_PREDEF ("_BM_",    "Bus Master", "Resource Descriptor field"),
+    AH_PREDEF ("_BMA",    "Battery Measurement Averaging Interval", "Sets battery measurement averaging interval"),
+    AH_PREDEF ("_BMC",    "Battery Maintenance Control", "Sets battery maintenance and control features"),
+    AH_PREDEF ("_BMD",    "Battery Maintenance Data", "Returns battery maintenance, control, and state data"),
+    AH_PREDEF ("_BMS",    "Battery Measurement Sampling Time", "Sets the battery measurement sampling time"),
+    AH_PREDEF ("_BQC",    "Brightness Query Current", "Returns the current display brightness level"),
+    AH_PREDEF ("_BST",    "Battery Status", "Returns a Control Method Battery status block"),
+    AH_PREDEF ("_BTH",    "Battery Throttle Limit", "Thermal limit for charging and discharging"),
+    AH_PREDEF ("_BTM",    "Battery Time", "Returns the battery runtime"),
+    AH_PREDEF ("_BTP",    "Battery Trip Point", "Sets a Control Method Battery trip point"),
+    AH_PREDEF ("_CBA",    "Configuration Base Address", "Sets the base address for a PCI Express host bridge"),
+    AH_PREDEF ("_CCA",    "Cache Coherency Attribute", "Returns a device's support level for cache coherency"),
+    AH_PREDEF ("_CDM",    "Clock Domain", "Returns a logical processor's clock domain identifier"),
+    AH_PREDEF ("_CID",    "Compatible ID", "Returns a device's Plug and Play Compatible ID list"),
+    AH_PREDEF ("_CLS",    "Class Code", "Returns PCI class code and subclass"),
+    AH_PREDEF ("_CPC",    "Continuous Performance Control", "Returns a list of performance control interfaces"),
+    AH_PREDEF ("_CR3",    "Warm/Standby Temperature", "Temperature for a fast low power state"),
+    AH_PREDEF ("_CRS",    "Current Resource Settings", "Returns the current resource settings for a device"),
+    AH_PREDEF ("_CRT",    "Critical Temperature", "Returns the shutdown critical temperature"),
+    AH_PREDEF ("_CSD",    "C-State Dependencies", "Returns a list of C-state dependencies"),
+    AH_PREDEF ("_CST",    "C-States", "Returns a list of supported C-states"),
+    AH_PREDEF ("_CWS",    "Clear Wake Alarm Status", "Clear the status of wake alarms"),
+    AH_PREDEF ("_DBT",    "Debounce Timeout", "Timeout value, Resource Descriptor field"),
+    AH_PREDEF ("_DCK",    "Dock Present", "Sets docking isolation. Presence indicates device is a docking station"),
+    AH_PREDEF ("_DCS",    "Display Current Status", "Returns status of the display output device"),
+    AH_PREDEF ("_DDC",    "Display Data Current", "Returns the EDID for the display output device"),
+    AH_PREDEF ("_DDN",    "DOS Device Name", "Returns a device logical name"),
+    AH_PREDEF ("_DEC",    "Decode", "Device decoding type, Resource Descriptor field"),
+    AH_PREDEF ("_DEP",    "Dependencies", "Returns a list of operation region dependencies"),
+    AH_PREDEF ("_DGS",    "Display Graphics State", "Return the current state of the output device"),
+    AH_PREDEF ("_DIS",    "Disable Device", "Disables a device"),
+    AH_PREDEF ("_DLM",    "Device Lock Mutex", "Defines mutex for OS/AML sharing"),
+    AH_PREDEF ("_DMA",    "Direct Memory Access", "Returns device current resources for DMA transactions, and resource field"),
+    AH_PREDEF ("_DOD",    "Display Output Devices", "Enumerate all devices attached to the display adapter"),
+    AH_PREDEF ("_DOS",    "Disable Output Switching", "Sets the display output switching mode"),
+    AH_PREDEF ("_DPL",    "Device Selection Polarity", "Polarity of Device Selection signal, Resource Descriptor field"),
+    AH_PREDEF ("_DRS",    "Drive Strength", "Drive Strength setting for GPIO connection, Resource Descriptor field"),
+    AH_PREDEF ("_DSD",    "Device-Specific Data", "Returns a list of device property information"),
+    AH_PREDEF ("_DSM",    "Device-Specific Method", "Executes device-specific functions"),
+    AH_PREDEF ("_DSS",    "Device Set State", "Sets the display device state"),
+    AH_PREDEF ("_DSW",    "Device Sleep Wake", "Sets the sleep and wake transition states for a device"),
+    AH_PREDEF ("_DTI",    "Device Temperature Indication", "Conveys native device temperature to the platform"),
+    AH_PREDEF ("_Exx",    "Edge-Triggered GPE", "Method executed as a result of a general-purpose event"),
+    AH_PREDEF ("_EC_",    "Embedded Controller", "returns EC offset and query information"),
+    AH_PREDEF ("_EDL",    "Eject Device List", "Returns a list of devices that are dependent on a device (docking)"),
+    AH_PREDEF ("_EJD",    "Ejection Dependent Device", "Returns the name of dependent (parent) device (docking)"),
+    AH_PREDEF ("_EJx",    "Eject Device", "Begin or cancel a device ejection request (docking)"),
+    AH_PREDEF ("_END",    "Endianness", "Endian orientation, Resource Descriptor field"),
+    AH_PREDEF ("_EVT",    "Event", "Event method for GPIO events"),
+    AH_PREDEF ("_FDE",    "Floppy Disk Enumerate", "Returns floppy disk configuration information"),
+    AH_PREDEF ("_FDI",    "Floppy Drive Information", "Returns a floppy drive information block"),
+    AH_PREDEF ("_FDM",    "Floppy Drive Mode", "Sets a floppy drive speed"),
+    AH_PREDEF ("_FIF",    "Fan Information", "Returns fan device information"),
+    AH_PREDEF ("_FIT",    "Firmware Interface Table", "Returns a list of NFIT structures"),
+    AH_PREDEF ("_FIX",    "Fixed Register Resource Provider", "Returns a list of devices that implement FADT register blocks"),
+    AH_PREDEF ("_FLC",    "Flow Control", "Flow control, Resource Descriptor field"),
+    AH_PREDEF ("_FPS",    "Fan Performance States", "Returns a list of supported fan performance states"),
+    AH_PREDEF ("_FSL",    "Fan Set Level", "Control method that sets the fan device's speed level (performance state)"),
+    AH_PREDEF ("_FST",    "Fan Status", "Returns current status information for a fan device"),
+    AH_PREDEF ("_GAI",    "Get Averaging Interval", "Returns the power meter averaging interval"),
+    AH_PREDEF ("_GCP",    "Get Capabilities", "Get device time capabilities"),
+    AH_PREDEF ("_GHL",    "Get Hardware Limit", "Returns the hardware limit enforced by the power meter"),
+    AH_PREDEF ("_GL_",    "Global Lock", "OS-defined Global Lock mutex object"),
+    AH_PREDEF ("_GLK",    "Get Global Lock Requirement", "Returns a device's Global Lock requirement for device access"),
+    AH_PREDEF ("_GPD",    "Get Post Data", "Returns the value of the VGA device that will be posted at boot"),
+    AH_PREDEF ("_GPE",    "General Purpose Events", "Predefined scope (\\_GPE) or SCI number for EC"),
+    AH_PREDEF ("_GRA",    "Granularity", "Address space granularity, Resource Descriptor field"),
+    AH_PREDEF ("_GRT",    "Get Real Time", "Returns current time-of-day from a time/alarm device"),
+    AH_PREDEF ("_GSB",    "Global System Interrupt Base", "Returns the GSB for a I/O APIC device"),
+    AH_PREDEF ("_GTF",    "Get Task File", "Returns a list of ATA commands to restore a drive to default state"),
+    AH_PREDEF ("_GTM",    "Get Timing Mode", "Returns a list of IDE controller timing information"),
+    AH_PREDEF ("_GTS",    "Going To Sleep", "Inform AML of pending sleep"),
+    AH_PREDEF ("_GWS",    "Get Wake Status", "Return status of wake alarms"),
+    AH_PREDEF ("_HE_",    "High-Edge", "Interrupt triggering, Resource Descriptor field"),
+    AH_PREDEF ("_HID",    "Hardware ID", "Returns a device's Plug and Play Hardware ID"),
+    AH_PREDEF ("_HOT",    "Hot Temperature", "Returns the critical temperature for sleep (entry to S4)"),
+    AH_PREDEF ("_HPP",    "Hot Plug Parameters", "Returns a list of hot-plug information for a PCI device"),
+    AH_PREDEF ("_HPX",    "Hot Plug Parameter Extensions", "Returns a list of hot-plug information for a PCI device. Supersedes _HPP"),
+    AH_PREDEF ("_HRV",    "Hardware Revision", "Returns a hardware revision value"),
+    AH_PREDEF ("_IFT",    "IPMI Interface Type", "See the Intelligent Platform Management Interface Specification"),
+    AH_PREDEF ("_INI",    "Initialize", "Performs device specific initialization"),
+    AH_PREDEF ("_INT",    "Interrupts", "Interrupt mask bits, Resource Descriptor field"),
+    AH_PREDEF ("_IOR",    "I/O Restriction", "Restriction type, Resource Descriptor field"),
+    AH_PREDEF ("_IRC",    "Inrush Current", "Presence indicates that a device has a significant inrush current draw"),
+    AH_PREDEF ("_Lxx",    "Level-Triggered GPE", "Control method executed as a result of a general-purpose event"),
+    AH_PREDEF ("_LCK",    "Lock Device", "Locks or unlocks a device (docking)"),
+    AH_PREDEF ("_LEN",    "Length", "Range length, Resource Descriptor field"),
+    AH_PREDEF ("_LID",    "Lid Status", "Returns the open/closed status of the lid on a mobile system"),
+    AH_PREDEF ("_LIN",    "Lines In Use", "Handshake lines, Resource Descriptor field"),
+    AH_PREDEF ("_LL_",    "Low Level", "Interrupt polarity, Resource Descriptor field"),
+    AH_PREDEF ("_LPD",    "Low Power Dependencies", "Returns a list of dependencies for low power idle entry"),
+    AH_PREDEF ("_LPI",    "Low Power Idle States", "Returns a list of supported low power idle states"),
+    AH_PREDEF ("_MAF",    "Maximum Address Fixed", "Resource Descriptor field"),
+    AH_PREDEF ("_MAT",    "Multiple APIC Table Entry", "Returns a list of MADT APIC structure entries"),
+    AH_PREDEF ("_MAX",    "Maximum Base Address", "Resource Descriptor field"),
+    AH_PREDEF ("_MBM",    "Memory Bandwidth Monitoring Data", "Returns bandwidth monitoring data for a memory device"),
+    AH_PREDEF ("_MEM",    "Memory Attributes", "Resource Descriptor field"),
+    AH_PREDEF ("_MIF",    "Minimum Address Fixed", "Resource Descriptor field"),
+    AH_PREDEF ("_MIN",    "Minimum Base Address", "Resource Descriptor field"),
+    AH_PREDEF ("_MLS",    "Multiple Language String", "Returns a device description in multiple languages"),
+    AH_PREDEF ("_MOD",    "Mode", "Interrupt mode, Resource Descriptor field"),
+    AH_PREDEF ("_MSG",    "Message", "Sets the system message waiting status indicator"),
+    AH_PREDEF ("_MSM",    "Memory Set Monitoring", "Sets bandwidth monitoring parameters for a memory device"),
+    AH_PREDEF ("_MTL",    "Minimum Throttle Limit", "Returns the minimum throttle limit for a thermal zone"),
+    AH_PREDEF ("_MTP",    "Memory Type", "Resource Descriptor field"),
+    AH_PREDEF ("_NTT",    "Notification Temperature Threshold", "Returns a threshold for device temperature change that requires platform notification"),
+    AH_PREDEF ("_OFF",    "Power Off", "Sets a power resource to the off state"),
+    AH_PREDEF ("_ON_",    "Power On", "Sets a power resource to the on state"),
+    AH_PREDEF ("_OS_",    "Operating System", "Returns a string that identifies the operating system"),
+    AH_PREDEF ("_OSC",    "Operating System Capabilities", "Inform AML of host features and capabilities"),
+    AH_PREDEF ("_OSI",    "Operating System Interfaces", "Returns supported interfaces, behaviors, and features"),
+    AH_PREDEF ("_OST",    "OSPM Status Indication", "Inform AML of event processing status"),
+    AH_PREDEF ("_PAI",    "Power Averaging Interval", "Sets the averaging interval for a power meter"),
+    AH_PREDEF ("_PAR",    "Parity", "Parity bits, Resource Descriptor field"),
+    AH_PREDEF ("_PCL",    "Power Consumer List", "Returns a list of devices powered by a power source"),
+    AH_PREDEF ("_PCT",    "Performance Control", "Returns processor performance control and status registers"),
+    AH_PREDEF ("_PDC",    "Processor Driver Capabilities", "Inform AML of processor driver capabilities"),
+    AH_PREDEF ("_PDL",    "P-state Depth Limit", "Returns the lowest available performance P-state"),
+    AH_PREDEF ("_PHA",    "Clock Phase", "Clock phase, Resource Descriptor field"),
+    AH_PREDEF ("_PIC",    "Interrupt Model", "Inform AML of the interrupt model in use"),
+    AH_PREDEF ("_PIF",    "Power Source Information", "Returns a Power Source information block"),
+    AH_PREDEF ("_PIN",    "Pin List", "Pin list, Resource Descriptor field"),
+    AH_PREDEF ("_PLD",    "Physical Location of Device", "Returns a device's physical location information"),
+    AH_PREDEF ("_PMC",    "Power Meter Capabilities", "Returns a list of Power Meter capabilities info"),
+    AH_PREDEF ("_PMD",    "Power Metered Devices", "Returns a list of devices that are measured by the power meter device"),
+    AH_PREDEF ("_PMM",    "Power Meter Measurement", "Returns the current value of the Power Meter"),
+    AH_PREDEF ("_POL",    "Polarity", "Interrupt polarity, Resource Descriptor field"),
+    AH_PREDEF ("_PPC",    "Performance Present Capabilities", "Returns a list of the performance states currently supported by the platform"),
+    AH_PREDEF ("_PPE",    "Polling for Platform Error", "Returns the polling interval to retrieve Corrected Platform Error information"),
+    AH_PREDEF ("_PPI",    "Pin Configuration", "Resource Descriptor field"),
+    AH_PREDEF ("_PR",     "Processor", "Predefined scope for processor objects"),
+    AH_PREDEF ("_PR0",    "Power Resources for D0", "Returns a list of dependent power resources to enter state D0 (fully on)"),
+    AH_PREDEF ("_PR1",    "Power Resources for D1", "Returns a list of dependent power resources to enter state D1"),
+    AH_PREDEF ("_PR2",    "Power Resources for D2", "Returns a list of dependent power resources to enter state D2"),
+    AH_PREDEF ("_PR3",    "Power Resources for D3hot", "Returns a list of dependent power resources to enter state D3hot"),
+    AH_PREDEF ("_PRE",    "Power Resources for Enumeration", "Returns a list of dependent power resources to enumerate devices on a bus"),
+    AH_PREDEF ("_PRL",    "Power Source Redundancy List", "Returns a list of power source devices in the same redundancy grouping"),
+    AH_PREDEF ("_PRR",    "Power Resource for Reset", "Execute a reset on a device"),
+    AH_PREDEF ("_PRS",    "Possible Resource Settings", "Returns a list of a device's possible resource settings"),
+    AH_PREDEF ("_PRT",    "PCI Routing Table", "Returns a list of PCI interrupt mappings"),
+    AH_PREDEF ("_PRW",    "Power Resources for Wake", "Returns a list of dependent power resources for waking"),
+    AH_PREDEF ("_PS0",    "Power State 0", "Sets a device's power state to D0 (device fully on)"),
+    AH_PREDEF ("_PS1",    "Power State 1", "Sets a device's power state to D1"),
+    AH_PREDEF ("_PS2",    "Power State 2", "Sets a device's power state to D2"),
+    AH_PREDEF ("_PS3",    "Power State 3", "Sets a device's power state to D3 (device off)"),
+    AH_PREDEF ("_PSC",    "Power State Current", "Returns a device's current power state"),
+    AH_PREDEF ("_PSD",    "Power State Dependencies", "Returns processor P-State dependencies"),
+    AH_PREDEF ("_PSE",    "Power State for Enumeration", "Put a bus into enumeration power mode"),
+    AH_PREDEF ("_PSL",    "Passive List", "Returns a list of passive cooling device objects"),
+    AH_PREDEF ("_PSR",    "Power Source", "Returns the power source device currently in use"),
+    AH_PREDEF ("_PSS",    "Performance Supported States", "Returns a list of supported processor performance states"),
+    AH_PREDEF ("_PSV",    "Passive Temperature", "Returns the passive trip point temperature"),
+    AH_PREDEF ("_PSW",    "Power State Wake", "Sets a device's wake function"),
+    AH_PREDEF ("_PTC",    "Processor Throttling Control", "Returns throttling control and status registers"),
+    AH_PREDEF ("_PTP",    "Power Trip Points", "Sets trip points for the Power Meter device"),
+    AH_PREDEF ("_PTS",    "Prepare To Sleep", "Inform the platform of an impending sleep transition"),
+    AH_PREDEF ("_PUR",    "Processor Utilization Request", "Returns the number of processors that the platform would like to idle"),
+    AH_PREDEF ("_PXM",    "Device Proximity", "Returns a device's proximity domain identifier"),
+    AH_PREDEF ("_Qxx",    "EC Query", "Embedded Controller query and SMBus Alarm control method"),
+    AH_PREDEF ("_RBO",    "Register Bit Offset", "Resource Descriptor field"),
+    AH_PREDEF ("_RBW",    "Register Bit Width", "Resource Descriptor field"),
+    AH_PREDEF ("_RDI",    "Resource Dependencies for Idle", "Returns a list of dependencies for idle states"),
+    AH_PREDEF ("_REG",    "Region Availability", "Inform AML code of an operation region availability change"),
+    AH_PREDEF ("_REV",    "Supported Integer Width", "Returns the supported integer width (<= 1: 32 bits only, >=2: both 32 and 64 bits"),
+    AH_PREDEF ("_RMV",    "Removal Status", "Returns a device's removal ability status (docking)"),
+    AH_PREDEF ("_RNG",    "Range", "Memory range type, Resource Descriptor field"),
+    AH_PREDEF ("_RST",    "Device Reset", "Executes a reset on a device"),
+    AH_PREDEF ("_ROM",    "Read-Only Memory", "Returns a copy of the ROM data for a display device"),
+    AH_PREDEF ("_RT_",    "Resource Type", "Resource Descriptor field"),
+    AH_PREDEF ("_RTV",    "Relative Temperature Values", "Returns temperature value information"),
+    AH_PREDEF ("_RW_",    "Read-Write Status", "Resource Descriptor field"),
+    AH_PREDEF ("_RXL",    "Receive Buffer Size", "Serial channel buffer, Resource Descriptor field"),
+    AH_PREDEF ("_S0_",    "S0 System State", "Returns values to enter the system into the S0 state"),
+    AH_PREDEF ("_S1_",    "S1 System State", "Returns values to enter the system into the S1 state"),
+    AH_PREDEF ("_S2_",    "S2 System State", "Returns values to enter the system into the S2 state"),
+    AH_PREDEF ("_S3_",    "S3 System State", "Returns values to enter the system into the S3 state"),
+    AH_PREDEF ("_S4_",    "S4 System State", "Returns values to enter the system into the S4 state"),
+    AH_PREDEF ("_S5_",    "S5 System State", "Returns values to enter the system into the S5 state"),
+    AH_PREDEF ("_S1D",    "S1 Device State", "Returns the highest D-state supported by a device when in the S1 state"),
+    AH_PREDEF ("_S2D",    "S2 Device State", "Returns the highest D-state supported by a device when in the S2 state"),
+    AH_PREDEF ("_S3D",    "S3 Device State", "Returns the highest D-state supported by a device when in the S3 state"),
+    AH_PREDEF ("_S4D",    "S4 Device State", "Returns the highest D-state supported by a device when in the S4 state"),
+    AH_PREDEF ("_S0W",    "S0 Device Wake State", "Returns the lowest D-state that the device can wake itself from S0"),
+    AH_PREDEF ("_S1W",    "S1 Device Wake State", "Returns the lowest D-state for this device that can wake the system from S1"),
+    AH_PREDEF ("_S2W",    "S2 Device Wake State", "Returns the lowest D-state for this device that can wake the system from S2"),
+    AH_PREDEF ("_S3W",    "S3 Device Wake State", "Returns the lowest D-state for this device that can wake the system from S3"),
+    AH_PREDEF ("_S4W",    "S4 Device Wake State", "Returns the lowest D-state for this device that can wake the system from S4"),
+    AH_PREDEF ("_SB_",    "System Bus", "Predefined scope for device and bus objects"),
+    AH_PREDEF ("_SBS",    "Smart Battery Subsystem", "Returns the subsystem configuration"),
+    AH_PREDEF ("_SCP",    "Set Cooling Policy", "Sets the cooling policy (active or passive)"),
+    AH_PREDEF ("_SDD",    "Set Device Data", "Sets data for a SATA device"),
+    AH_PREDEF ("_SEG",    "PCI Segment", "Returns a device's PCI Segment Group number"),
+    AH_PREDEF ("_SHL",    "Set Hardware Limit", "Sets the hardware limit enforced by the Power Meter"),
+    AH_PREDEF ("_SHR",    "Sharable", "Interrupt share status, Resource Descriptor field"),
+    AH_PREDEF ("_SI_",    "System Indicators", "Predefined scope"),
+    AH_PREDEF ("_SIZ",    "Size", "DMA transfer size, Resource Descriptor field"),
+    AH_PREDEF ("_SLI",    "System Locality Information", "Returns a list of NUMA system localities"),
+    AH_PREDEF ("_SLV",    "Slave Mode", "Mode setting, Resource Descriptor field"),
+    AH_PREDEF ("_SPD",    "Set Post Device", "Sets which video device will be posted at boot"),
+    AH_PREDEF ("_SPE",    "Speed", "Connection speed, Resource Descriptor field"),
+    AH_PREDEF ("_SRS",    "Set Resource Settings", "Sets a device's resource allocation"),
+    AH_PREDEF ("_SRT",    "Set Real Time", "Sets the current time for a time/alarm device"),
+    AH_PREDEF ("_SRV",    "IPMI Spec Revision", "See the Intelligent Platform Management Interface Specification"),
+    AH_PREDEF ("_SST",    "System Status", "Sets the system status indicator"),
+    AH_PREDEF ("_STA",    "Status", "Returns the current status of a Device or Power Resource"),
+    AH_PREDEF ("_STB",    "Stop Bits", "Serial channel stop bits, Resource Descriptor field"),
+    AH_PREDEF ("_STM",    "Set Timing Mode", "Sets an IDE controller transfer timings"),
+    AH_PREDEF ("_STP",    "Set Expired Timer Wake Policy", "Sets expired timer policies of the wake alarm device"),
+    AH_PREDEF ("_STR",    "Description String", "Returns a device's description string"),
+    AH_PREDEF ("_STV",    "Set Timer Value", "Set timer values of the wake alarm device"),
+    AH_PREDEF ("_SUB",    "Subsystem ID", "Returns the subsystem ID for a device"),
+    AH_PREDEF ("_SUN",    "Slot User Number", "Returns the slot unique ID number"),
+    AH_PREDEF ("_SWS",    "System Wake Source", "Returns the source event that caused the system to wake"),
+    AH_PREDEF ("_T_x",    "Emitted by ASL Compiler", "Reserved for use by ASL compilers"),
+    AH_PREDEF ("_TC1",    "Thermal Constant 1", "Returns TC1 for the passive cooling formula"),
+    AH_PREDEF ("_TC2",    "Thermal Constant 2", "Returns TC2 for the passive cooling formula"),
+    AH_PREDEF ("_TDL",    "T-State Depth Limit", "Returns the _TSS entry number of the lowest power throttling state"),
+    AH_PREDEF ("_TFP",    "Thermal Fast Sampling Period", "Returns the sampling period for passive cooling"),
+    AH_PREDEF ("_TIP",    "Expired Timer Wake Policy", "Returns timer policies of the wake alarm device"),
+    AH_PREDEF ("_TIV",    "Timer Values", "Returns remaining time of the wake alarm device"),
+    AH_PREDEF ("_TMP",    "Temperature", "Returns a thermal zone's current temperature"),
+    AH_PREDEF ("_TPC",    "Throttling Present Capabilities", "Returns the current number of supported throttling states"),
+    AH_PREDEF ("_TPT",    "Trip Point Temperature", "Inform AML that a device's embedded temperature sensor has crossed a temperature trip point"),
+    AH_PREDEF ("_TRA",    "Translation", "Address translation offset, Resource Descriptor field"),
+    AH_PREDEF ("_TRS",    "Translation Sparse", "Sparse/dense flag, Resource Descriptor field"),
+    AH_PREDEF ("_TRT",    "Thermal Relationship Table", "Returns thermal relationships between platform devices"),
+    AH_PREDEF ("_TSD",    "Throttling State Dependencies", "Returns a list of T-state dependencies"),
+    AH_PREDEF ("_TSF",    "Type-Specific Flags", "Resource Descriptor field"),
+    AH_PREDEF ("_TSN",    "Thermal Sensor Device", "Returns a reference to a thermal sensor"),
+    AH_PREDEF ("_TSP",    "Thermal Sampling Period", "Returns the thermal sampling period for passive cooling"),
+    AH_PREDEF ("_TSS",    "Throttling Supported States", "Returns supported throttling state information"),
+    AH_PREDEF ("_TST",    "Temperature Sensor Threshold", "Returns the minimum separation for a device's temperature trip points"),
+    AH_PREDEF ("_TTP",    "Translation Type", "Translation/static flag, Resource Descriptor field"),
+    AH_PREDEF ("_TTS",    "Transition To State", "Inform AML of an S-state transition"),
+    AH_PREDEF ("_TXL",    "Transmit Buffer Size", "Serial Channel buffer, Resource Descriptor field"),
+    AH_PREDEF ("_TYP",    "Type", "DMA channel type (speed), Resource Descriptor field"),
+    AH_PREDEF ("_TZ_",    "Thermal Zone", "Predefined scope: ACPI 1.0"),
+    AH_PREDEF ("_TZD",    "Thermal Zone Devices", "Returns a list of device names associated with a Thermal Zone"),
+    AH_PREDEF ("_TZM",    "Thermal Zone Member", "Returns a reference to the thermal zone of which a device is a member"),
+    AH_PREDEF ("_TZP",    "Thermal Zone Polling", "Returns a Thermal zone's polling frequency"),
+    AH_PREDEF ("_UID",    "Unique ID", "Return a device's unique persistent ID"),
+    AH_PREDEF ("_UPC",    "USB Port Capabilities", "Returns a list of USB port capabilities"),
+    AH_PREDEF ("_UPD",    "User Presence Detect", "Returns user detection information"),
+    AH_PREDEF ("_UPP",    "User Presence Polling", "Returns the recommended user presence polling interval"),
+    AH_PREDEF ("_VEN",    "Vendor Data", "Resource Descriptor field"),
+    AH_PREDEF ("_VPO",    "Video Post Options", "Returns the implemented video post options"),
+    AH_PREDEF ("_Wxx",    "Wake Event", "Method executed as a result of a wake event"),
+    AH_PREDEF ("_WAK",    "Wake", "Inform AML that the system has just awakened"),
+    AH_PREDEF ("_WPC",    "Wireless Power Calibration", "Calibrate power and notify wireless device"),
+    AH_PREDEF ("_WPP",    "Wireless Power Polling", "Get recommended polling interval"),
+    AH_PREDEF (NULL,      NULL, NULL)
+};
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiAhMatchPredefinedName
+ *
+ * PARAMETERS:  Nameseg                 - Predefined name string
+ *
+ * RETURN:      ID info struct. NULL if Nameseg not found
+ *
+ * DESCRIPTION: Lookup a predefined name.
+ *
+ ******************************************************************************/
+
+const AH_PREDEFINED_NAME *
+AcpiAhMatchPredefinedName (
+    char                        *Nameseg)
+{
+    const AH_PREDEFINED_NAME    *Info;
+
+
+    for (Info = AslPredefinedInfo; Info->Name; Info++)
+    {
+        if (ACPI_COMPARE_NAME (Nameseg, Info->Name))
+        {
+            return (Info);
+        }
+    }
+
+    return (NULL);
+}
diff --git a/usr/src/cmd/acpi/common/ahtable.c b/usr/src/cmd/acpi/common/ahtable.c
new file mode 100644
index 0000000000..beb64c85ed
--- /dev/null
+++ b/usr/src/cmd/acpi/common/ahtable.c
@@ -0,0 +1,150 @@
+/******************************************************************************
+ *
+ * Module Name: ahtable - Table of known ACPI tables with descriptions
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+
+
+/* Local prototypes */
+
+const AH_TABLE *
+AcpiAhGetTableInfo (
+    char                    *Signature);
+
+extern const AH_TABLE      AcpiSupportedTables[];
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiAhGetTableInfo
+ *
+ * PARAMETERS:  Signature           - ACPI signature (4 chars) to match
+ *
+ * RETURN:      Pointer to a valid AH_TABLE. Null if no match found.
+ *
+ * DESCRIPTION: Find a match in the "help" table of supported ACPI tables
+ *
+ ******************************************************************************/
+
+const AH_TABLE *
+AcpiAhGetTableInfo (
+    char                    *Signature)
+{
+    const AH_TABLE      *Info;
+
+
+    for (Info = AcpiSupportedTables; Info->Signature; Info++)
+    {
+        if (ACPI_COMPARE_NAME (Signature, Info->Signature))
+        {
+            return (Info);
+        }
+    }
+
+    return (NULL);
+}
+
+
+/*
+ * Note: Any tables added here should be duplicated within AcpiDmTableData
+ * in the file common/dmtable.c
+ */
+const AH_TABLE      AcpiSupportedTables[] =
+{
+    {ACPI_SIG_ASF,  "Alert Standard Format table"},
+    {ACPI_SIG_BERT, "Boot Error Record Table"},
+    {ACPI_SIG_BGRT, "Boot Graphics Resource Table"},
+    {ACPI_SIG_BOOT, "Simple Boot Flag Table"},
+    {ACPI_SIG_CPEP, "Corrected Platform Error Polling table"},
+    {ACPI_SIG_CSRT, "Core System Resource Table"},
+    {ACPI_SIG_DBG2, "Debug Port table type 2"},
+    {ACPI_SIG_DBGP, "Debug Port table"},
+    {ACPI_SIG_DMAR, "DMA Remapping table"},
+    {ACPI_SIG_DRTM, "Dynamic Root of Trust for Measurement table"},
+    {ACPI_SIG_DSDT, "Differentiated System Description Table (AML table)"},
+    {ACPI_SIG_ECDT, "Embedded Controller Boot Resources Table"},
+    {ACPI_SIG_EINJ, "Error Injection table"},
+    {ACPI_SIG_ERST, "Error Record Serialization Table"},
+    {ACPI_SIG_FACS, "Firmware ACPI Control Structure"},
+    {ACPI_SIG_FADT, "Fixed ACPI Description Table (FADT)"},
+    {ACPI_SIG_FPDT, "Firmware Performance Data Table"},
+    {ACPI_SIG_GTDT, "Generic Timer Description Table"},
+    {ACPI_SIG_HEST, "Hardware Error Source Table"},
+    {ACPI_SIG_HPET, "High Precision Event Timer table"},
+    {ACPI_SIG_IORT, "IO Remapping Table"},
+    {ACPI_SIG_IVRS, "I/O Virtualization Reporting Structure"},
+    {ACPI_SIG_LPIT, "Low Power Idle Table"},
+    {ACPI_SIG_MADT, "Multiple APIC Description Table (MADT)"},
+    {ACPI_SIG_MCFG, "Memory Mapped Configuration table"},
+    {ACPI_SIG_MCHI, "Management Controller Host Interface table"},
+    {ACPI_SIG_MPST, "Memory Power State Table"},
+    {ACPI_SIG_MSCT, "Maximum System Characteristics Table"},
+    {ACPI_SIG_MSDM, "Microsoft Data Management table"},
+    {ACPI_SIG_MTMR, "MID Timer Table"},
+    {ACPI_SIG_NFIT, "NVDIMM Firmware Interface Table"},
+    {ACPI_SIG_PCCT, "Platform Communications Channel Table"},
+    {ACPI_SIG_PMTT, "Platform Memory Topology Table"},
+    {ACPI_RSDP_NAME,"Root System Description Pointer"},
+    {ACPI_SIG_RSDT, "Root System Description Table"},
+    {ACPI_SIG_S3PT, "S3 Performance Table"},
+    {ACPI_SIG_SBST, "Smart Battery Specification Table"},
+    {ACPI_SIG_SLIC, "Software Licensing Description Table"},
+    {ACPI_SIG_SLIT, "System Locality Information Table"},
+    {ACPI_SIG_SPCR, "Serial Port Console Redirection table"},
+    {ACPI_SIG_SPMI, "Server Platform Management Interface table"},
+    {ACPI_SIG_SRAT, "System Resource Affinity Table"},
+    {ACPI_SIG_SSDT, "Secondary System Description Table (AML table)"},
+    {ACPI_SIG_STAO, "Status Override table"},
+    {ACPI_SIG_TCPA, "Trusted Computing Platform Alliance table"},
+    {ACPI_SIG_TPM2, "Trusted Platform Module hardware interface table"},
+    {ACPI_SIG_UEFI, "UEFI Boot Optimization Table"},
+    {ACPI_SIG_VRTC, "Virtual Real-Time Clock Table"},
+    {ACPI_SIG_WAET, "Windows ACPI Emulated Devices Table"},
+    {ACPI_SIG_WDAT, "Watchdog Action Table"},
+    {ACPI_SIG_WDDT, "Watchdog Description Table"},
+    {ACPI_SIG_WDRT, "Watchdog Resource Table"},
+    {ACPI_SIG_WPBT, "Windows Platform Binary Table"},
+    {ACPI_SIG_XENV, "Xen Environment table"},
+    {ACPI_SIG_XSDT, "Extended System Description Table"},
+    {NULL,          NULL}
+};
diff --git a/usr/src/cmd/acpi/common/ahuuids.c b/usr/src/cmd/acpi/common/ahuuids.c
new file mode 100644
index 0000000000..ec75624d46
--- /dev/null
+++ b/usr/src/cmd/acpi/common/ahuuids.c
@@ -0,0 +1,133 @@
+/******************************************************************************
+ *
+ * Module Name: ahuuids - Table of known ACPI-related UUIDs
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acuuid.h"
+
+#define _COMPONENT          ACPI_UTILITIES
+        ACPI_MODULE_NAME    ("ahuuids")
+
+
+/*
+ * Table of "known" (ACPI-related) UUIDs
+ */
+const AH_UUID  AcpiUuids[] =
+{
+    {"[Controllers]",               NULL},
+    {"GPIO Controller",             UUID_GPIO_CONTROLLER},
+    {"USB Controller",              UUID_USB_CONTROLLER},
+    {"SATA Controller",             UUID_SATA_CONTROLLER},
+
+    {"[Devices]",                   NULL},
+    {"PCI Host Bridge Device",      UUID_PCI_HOST_BRIDGE},
+    {"HID I2C Device",              UUID_I2C_DEVICE},
+    {"Power Button Device",         UUID_POWER_BUTTON},
+
+    {"[Interfaces]",                NULL},
+    {"Device Labeling Interface",   UUID_DEVICE_LABELING},
+    {"Physical Presence Interface", UUID_PHYSICAL_PRESENCE},
+
+    {"[Non-volatile DIMM and NFIT table]",       NULL},
+    {"Volatile Memory Region",      UUID_VOLATILE_MEMORY},
+    {"Persistent Memory Region",    UUID_PERSISTENT_MEMORY},
+    {"NVDIMM Control Region",       UUID_CONTROL_REGION},
+    {"NVDIMM Data Region",          UUID_DATA_REGION},
+    {"Volatile Virtual Disk",       UUID_VOLATILE_VIRTUAL_DISK},
+    {"Volatile Virtual CD",         UUID_VOLATILE_VIRTUAL_CD},
+    {"Persistent Virtual Disk",     UUID_PERSISTENT_VIRTUAL_DISK},
+    {"Persistent Virtual CD",       UUID_PERSISTENT_VIRTUAL_CD},
+
+    {"[Miscellaneous]",             NULL},
+    {"Platform-wide Capabilities",  UUID_PLATFORM_CAPABILITIES},
+    {"Dynamic Enumeration",         UUID_DYNAMIC_ENUMERATION},
+    {"Battery Thermal Limit",       UUID_BATTERY_THERMAL_LIMIT},
+    {"Thermal Extensions",          UUID_THERMAL_EXTENSIONS},
+    {"Device Properties for _DSD",  UUID_DEVICE_PROPERTIES},
+
+    {NULL, NULL}
+};
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiAhMatchUuid
+ *
+ * PARAMETERS:  Data                - Data buffer containing a UUID
+ *
+ * RETURN:      ASCII description string for the UUID if it is found.
+ *
+ * DESCRIPTION: Returns a description string for "known" UUIDs, which are
+ *              are UUIDs that are related to ACPI in some way.
+ *
+ ******************************************************************************/
+
+const char *
+AcpiAhMatchUuid (
+    UINT8                   *Data)
+{
+    const AH_UUID           *Info;
+    UINT8                   UuidBuffer[UUID_BUFFER_LENGTH];
+
+
+    /* Walk the table of known ACPI-related UUIDs */
+
+    for (Info = AcpiUuids; Info->Description; Info++)
+    {
+        /* Null string means desciption is a UUID class */
+
+        if (!Info->String)
+        {
+            continue;
+        }
+
+        AcpiUtConvertStringToUuid (Info->String, UuidBuffer);
+
+        if (!memcmp (Data, UuidBuffer, UUID_BUFFER_LENGTH))
+        {
+            return (Info->Description);
+        }
+    }
+
+    return (NULL);
+}
diff --git a/usr/src/cmd/acpi/common/cmfsize.c b/usr/src/cmd/acpi/common/cmfsize.c
new file mode 100644
index 0000000000..d9df6bc06c
--- /dev/null
+++ b/usr/src/cmd/acpi/common/cmfsize.c
@@ -0,0 +1,113 @@
+/******************************************************************************
+ *
+ * Module Name: cfsize - Common get file size function
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acapps.h"
+#include <stdio.h>
+
+#define _COMPONENT          ACPI_TOOLS
+        ACPI_MODULE_NAME    ("cmfsize")
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CmGetFileSize
+ *
+ * PARAMETERS:  File                    - Open file descriptor
+ *
+ * RETURN:      File Size. On error, -1 (ACPI_UINT32_MAX)
+ *
+ * DESCRIPTION: Get the size of a file. Uses seek-to-EOF. File must be open.
+ *              Does not disturb the current file pointer.
+ *
+ ******************************************************************************/
+
+UINT32
+CmGetFileSize (
+    ACPI_FILE               File)
+{
+    long                    FileSize;
+    long                    CurrentOffset;
+    ACPI_STATUS             Status;
+
+
+    /* Save the current file pointer, seek to EOF to obtain file size */
+
+    CurrentOffset = AcpiOsGetFileOffset (File);
+    if (CurrentOffset < 0)
+    {
+        goto OffsetError;
+    }
+
+    Status = AcpiOsSetFileOffset (File, 0, ACPI_FILE_END);
+    if (ACPI_FAILURE (Status))
+    {
+        goto SeekError;
+    }
+
+    FileSize = AcpiOsGetFileOffset (File);
+    if (FileSize < 0)
+    {
+        goto OffsetError;
+    }
+
+    /* Restore original file pointer */
+
+    Status = AcpiOsSetFileOffset (File, CurrentOffset, ACPI_FILE_BEGIN);
+    if (ACPI_FAILURE (Status))
+    {
+        goto SeekError;
+    }
+
+    return ((UINT32) FileSize);
+
+
+OffsetError:
+    AcpiLogError ("Could not get file offset");
+    return (ACPI_UINT32_MAX);
+
+SeekError:
+    AcpiLogError ("Could not set file offset");
+    return (ACPI_UINT32_MAX);
+}
diff --git a/usr/src/cmd/acpi/common/dmextern.c b/usr/src/cmd/acpi/common/dmextern.c
new file mode 100644
index 0000000000..d1a6755791
--- /dev/null
+++ b/usr/src/cmd/acpi/common/dmextern.c
@@ -0,0 +1,1352 @@
+/******************************************************************************
+ *
+ * Module Name: dmextern - Support for External() ASL statements
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "amlcode.h"
+#include "acnamesp.h"
+#include "acdisasm.h"
+#include "aslcompiler.h"
+#include <stdio.h>
+#include <errno.h>
+
+
+/*
+ * This module is used for application-level code (iASL disassembler) only.
+ *
+ * It contains the code to create and emit any necessary External() ASL
+ * statements for the module being disassembled.
+ */
+#define _COMPONENT          ACPI_CA_DISASSEMBLER
+        ACPI_MODULE_NAME    ("dmextern")
+
+
+/*
+ * This table maps ACPI_OBJECT_TYPEs to the corresponding ASL
+ * ObjectTypeKeyword. Used to generate typed external declarations
+ */
+static const char           *AcpiGbl_DmTypeNames[] =
+{
+    /* 00 */ ", UnknownObj",        /* Type ANY */
+    /* 01 */ ", IntObj",
+    /* 02 */ ", StrObj",
+    /* 03 */ ", BuffObj",
+    /* 04 */ ", PkgObj",
+    /* 05 */ ", FieldUnitObj",
+    /* 06 */ ", DeviceObj",
+    /* 07 */ ", EventObj",
+    /* 08 */ ", MethodObj",
+    /* 09 */ ", MutexObj",
+    /* 10 */ ", OpRegionObj",
+    /* 11 */ ", PowerResObj",
+    /* 12 */ ", ProcessorObj",
+    /* 13 */ ", ThermalZoneObj",
+    /* 14 */ ", BuffFieldObj",
+    /* 15 */ ", DDBHandleObj",
+    /* 16 */ "",                    /* Debug object */
+    /* 17 */ ", FieldUnitObj",
+    /* 18 */ ", FieldUnitObj",
+    /* 19 */ ", FieldUnitObj"
+};
+
+#define METHOD_SEPARATORS           " \t,()\n"
+
+
+/* Local prototypes */
+
+static const char *
+AcpiDmGetObjectTypeName (
+    ACPI_OBJECT_TYPE        Type);
+
+static char *
+AcpiDmNormalizeParentPrefix (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Path);
+
+static void
+AcpiDmAddPathToExternalList (
+    char                    *Path,
+    UINT8                   Type,
+    UINT32                  Value,
+    UINT16                  Flags);
+
+static ACPI_STATUS
+AcpiDmCreateNewExternal (
+    char                    *ExternalPath,
+    char                    *InternalPath,
+    UINT8                   Type,
+    UINT32                  Value,
+    UINT16                  Flags);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmGetObjectTypeName
+ *
+ * PARAMETERS:  Type                - An ACPI_OBJECT_TYPE
+ *
+ * RETURN:      Pointer to a string
+ *
+ * DESCRIPTION: Map an object type to the ASL object type string.
+ *
+ ******************************************************************************/
+
+static const char *
+AcpiDmGetObjectTypeName (
+    ACPI_OBJECT_TYPE        Type)
+{
+
+    if (Type == ACPI_TYPE_LOCAL_SCOPE)
+    {
+        Type = ACPI_TYPE_DEVICE;
+    }
+    else if (Type > ACPI_TYPE_LOCAL_INDEX_FIELD)
+    {
+        return ("");
+    }
+
+    return (AcpiGbl_DmTypeNames[Type]);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmNormalizeParentPrefix
+ *
+ * PARAMETERS:  Op                  - Parse op
+ *              Path                - Path with parent prefix
+ *
+ * RETURN:      The full pathname to the object (from the namespace root)
+ *
+ * DESCRIPTION: Returns the full pathname of a path with parent prefix
+ *              The caller must free the fullpath returned.
+ *
+ ******************************************************************************/
+
+static char *
+AcpiDmNormalizeParentPrefix (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Path)
+{
+    ACPI_NAMESPACE_NODE     *Node;
+    char                    *Fullpath;
+    char                    *ParentPath;
+    ACPI_SIZE               Length;
+    UINT32                  Index = 0;
+
+
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    /* Search upwards in the parse tree until we reach the next namespace node */
+
+    Op = Op->Common.Parent;
+    while (Op)
+    {
+        if (Op->Common.Node)
+        {
+            break;
+        }
+
+        Op = Op->Common.Parent;
+    }
+
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    /*
+     * Find the actual parent node for the reference:
+     * Remove all carat prefixes from the input path.
+     * There may be multiple parent prefixes (For example, ^^^M000)
+     */
+    Node = Op->Common.Node;
+    while (Node && (*Path == (UINT8) AML_PARENT_PREFIX))
+    {
+        Node = Node->Parent;
+        Path++;
+    }
+
+    if (!Node)
+    {
+        return (NULL);
+    }
+
+    /* Get the full pathname for the parent node */
+
+    ParentPath = AcpiNsGetExternalPathname (Node);
+    if (!ParentPath)
+    {
+        return (NULL);
+    }
+
+    Length = (strlen (ParentPath) + strlen (Path) + 1);
+    if (ParentPath[1])
+    {
+        /*
+         * If ParentPath is not just a simple '\', increment the length
+         * for the required dot separator (ParentPath.Path)
+         */
+        Length++;
+
+        /* For External() statements, we do not want a leading '\' */
+
+        if (*ParentPath == AML_ROOT_PREFIX)
+        {
+            Index = 1;
+        }
+    }
+
+    Fullpath = ACPI_ALLOCATE_ZEROED (Length);
+    if (!Fullpath)
+    {
+        goto Cleanup;
+    }
+
+    /*
+     * Concatenate parent fullpath and path. For example,
+     * parent fullpath "\_SB_", Path "^INIT", Fullpath "\_SB_.INIT"
+     *
+     * Copy the parent path
+     */
+    strcpy (Fullpath, &ParentPath[Index]);
+
+    /*
+     * Add dot separator
+     * (don't need dot if parent fullpath is a single backslash)
+     */
+    if (ParentPath[1])
+    {
+        strcat (Fullpath, ".");
+    }
+
+    /* Copy child path (carat parent prefix(es) were skipped above) */
+
+    strcat (Fullpath, Path);
+
+Cleanup:
+    ACPI_FREE (ParentPath);
+    return (Fullpath);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmAddToExternalFileList
+ *
+ * PARAMETERS:  PathList            - Single path or list separated by comma
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add external files to global list
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AcpiDmAddToExternalFileList (
+    char                    *Pathname)
+{
+    ACPI_EXTERNAL_FILE      *ExternalFile;
+    char                    *LocalPathname;
+
+
+    if (!Pathname)
+    {
+        return (AE_OK);
+    }
+
+    LocalPathname = ACPI_ALLOCATE (strlen (Pathname) + 1);
+    if (!LocalPathname)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    ExternalFile = ACPI_ALLOCATE_ZEROED (sizeof (ACPI_EXTERNAL_FILE));
+    if (!ExternalFile)
+    {
+        ACPI_FREE (LocalPathname);
+        return (AE_NO_MEMORY);
+    }
+
+    /* Take a copy of the file pathname */
+
+    strcpy (LocalPathname, Pathname);
+    ExternalFile->Path = LocalPathname;
+
+    if (AcpiGbl_ExternalFileList)
+    {
+        ExternalFile->Next = AcpiGbl_ExternalFileList;
+    }
+
+    AcpiGbl_ExternalFileList = ExternalFile;
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmClearExternalFileList
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Clear the external file list
+ *
+ ******************************************************************************/
+
+void
+AcpiDmClearExternalFileList (
+    void)
+{
+    ACPI_EXTERNAL_FILE      *NextExternal;
+
+
+    while (AcpiGbl_ExternalFileList)
+    {
+        NextExternal = AcpiGbl_ExternalFileList->Next;
+        ACPI_FREE (AcpiGbl_ExternalFileList->Path);
+        ACPI_FREE (AcpiGbl_ExternalFileList);
+        AcpiGbl_ExternalFileList = NextExternal;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmGetExternalsFromFile
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Process the optional external reference file.
+ *
+ * Each line in the file should be of the form:
+ *      External (<Method namepath>, MethodObj, <ArgCount>)
+ *
+ * Example:
+ *      External (_SB_.PCI0.XHC_.PS0X, MethodObj, 4)
+ *
+ ******************************************************************************/
+
+void
+AcpiDmGetExternalsFromFile (
+    void)
+{
+    FILE                    *ExternalRefFile;
+    char                    *Token;
+    char                    *MethodName;
+    UINT32                  ArgCount;
+    UINT32                  ImportCount = 0;
+
+
+    if (!Gbl_ExternalRefFilename)
+    {
+        return;
+    }
+
+    /* Open the file */
+
+    ExternalRefFile = fopen (Gbl_ExternalRefFilename, "r");
+    if (!ExternalRefFile)
+    {
+        fprintf (stderr, "Could not open external reference file \"%s\"\n",
+            Gbl_ExternalRefFilename);
+        AslAbort ();
+        return;
+    }
+
+    /* Each line defines a method */
+
+    while (fgets (StringBuffer, ASL_MSG_BUFFER_SIZE, ExternalRefFile))
+    {
+        Token = strtok (StringBuffer, METHOD_SEPARATORS);   /* "External" */
+        if (!Token)
+        {
+            continue;
+        }
+
+        if (strcmp (Token, "External"))
+        {
+            continue;
+        }
+
+        MethodName = strtok (NULL, METHOD_SEPARATORS);      /* Method namepath */
+        if (!MethodName)
+        {
+            continue;
+        }
+
+        Token = strtok (NULL, METHOD_SEPARATORS);           /* "MethodObj" */
+        if (!Token)
+        {
+            continue;
+        }
+
+        if (strcmp (Token, "MethodObj"))
+        {
+            continue;
+        }
+
+        Token = strtok (NULL, METHOD_SEPARATORS);           /* Arg count */
+        if (!Token)
+        {
+            continue;
+        }
+
+        /* Convert arg count string to an integer */
+
+        errno = 0;
+        ArgCount = strtoul (Token, NULL, 0);
+        if (errno)
+        {
+            fprintf (stderr, "Invalid argument count (%s)\n", Token);
+            continue;
+        }
+
+        if (ArgCount > 7)
+        {
+            fprintf (stderr, "Invalid argument count (%u)\n", ArgCount);
+            continue;
+        }
+
+        /* Add this external to the global list */
+
+        AcpiOsPrintf ("%s: Importing method external (%u arguments) %s\n",
+            Gbl_ExternalRefFilename, ArgCount, MethodName);
+
+        AcpiDmAddPathToExternalList (MethodName, ACPI_TYPE_METHOD,
+            ArgCount, (ACPI_EXT_RESOLVED_REFERENCE | ACPI_EXT_ORIGIN_FROM_FILE));
+        ImportCount++;
+    }
+
+    if (!ImportCount)
+    {
+        fprintf (stderr,
+            "Did not find any external methods in reference file \"%s\"\n",
+            Gbl_ExternalRefFilename);
+    }
+    else
+    {
+        /* Add the external(s) to the namespace */
+
+        AcpiDmAddExternalsToNamespace ();
+
+        AcpiOsPrintf ("%s: Imported %u external method definitions\n",
+            Gbl_ExternalRefFilename, ImportCount);
+    }
+
+    fclose (ExternalRefFile);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmAddOpToExternalList
+ *
+ * PARAMETERS:  Op                  - Current parser Op
+ *              Path                - Internal (AML) path to the object
+ *              Type                - ACPI object type to be added
+ *              Value               - Arg count if adding a Method object
+ *              Flags               - To be passed to the external object
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert a new name into the global list of Externals which
+ *              will in turn be later emitted as an External() declaration
+ *              in the disassembled output.
+ *
+ *              This function handles the most common case where the referenced
+ *              name is simply not found in the constructed namespace.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmAddOpToExternalList (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Path,
+    UINT8                   Type,
+    UINT32                  Value,
+    UINT16                  Flags)
+{
+    char                    *ExternalPath;
+    char                    *InternalPath = Path;
+    char                    *Temp;
+    ACPI_STATUS             Status;
+
+
+    ACPI_FUNCTION_TRACE (DmAddOpToExternalList);
+
+
+    if (!Path)
+    {
+        return_VOID;
+    }
+
+    /* Remove a root backslash if present */
+
+    if ((*Path == AML_ROOT_PREFIX) && (Path[1]))
+    {
+        Path++;
+    }
+
+    /* Externalize the pathname */
+
+    Status = AcpiNsExternalizeName (ACPI_UINT32_MAX, Path,
+        NULL, &ExternalPath);
+    if (ACPI_FAILURE (Status))
+    {
+        return_VOID;
+    }
+
+    /*
+     * Get the full pathname from the root if "Path" has one or more
+     * parent prefixes (^). Note: path will not contain a leading '\'.
+     */
+    if (*Path == (UINT8) AML_PARENT_PREFIX)
+    {
+        Temp = AcpiDmNormalizeParentPrefix (Op, ExternalPath);
+
+        /* Set new external path */
+
+        ACPI_FREE (ExternalPath);
+        ExternalPath = Temp;
+        if (!Temp)
+        {
+            return_VOID;
+        }
+
+        /* Create the new internal pathname */
+
+        Flags |= ACPI_EXT_INTERNAL_PATH_ALLOCATED;
+        Status = AcpiNsInternalizeName (ExternalPath, &InternalPath);
+        if (ACPI_FAILURE (Status))
+        {
+            ACPI_FREE (ExternalPath);
+            return_VOID;
+        }
+    }
+
+    /* Create the new External() declaration node */
+
+    Status = AcpiDmCreateNewExternal (ExternalPath, InternalPath,
+        Type, Value, Flags);
+    if (ACPI_FAILURE (Status))
+    {
+        ACPI_FREE (ExternalPath);
+        if (Flags & ACPI_EXT_INTERNAL_PATH_ALLOCATED)
+        {
+            ACPI_FREE (InternalPath);
+        }
+    }
+
+    return_VOID;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmAddNodeToExternalList
+ *
+ * PARAMETERS:  Node                - Namespace node for object to be added
+ *              Type                - ACPI object type to be added
+ *              Value               - Arg count if adding a Method object
+ *              Flags               - To be passed to the external object
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert a new name into the global list of Externals which
+ *              will in turn be later emitted as an External() declaration
+ *              in the disassembled output.
+ *
+ *              This function handles the case where the referenced name has
+ *              been found in the namespace, but the name originated in a
+ *              table other than the one that is being disassembled (such
+ *              as a table that is added via the iASL -e option).
+ *
+ ******************************************************************************/
+
+void
+AcpiDmAddNodeToExternalList (
+    ACPI_NAMESPACE_NODE     *Node,
+    UINT8                   Type,
+    UINT32                  Value,
+    UINT16                  Flags)
+{
+    char                    *ExternalPath;
+    char                    *InternalPath;
+    char                    *Temp;
+    ACPI_STATUS             Status;
+
+
+    ACPI_FUNCTION_TRACE (DmAddNodeToExternalList);
+
+
+    if (!Node)
+    {
+        return_VOID;
+    }
+
+    /* Get the full external and internal pathnames to the node */
+
+    ExternalPath = AcpiNsGetExternalPathname (Node);
+    if (!ExternalPath)
+    {
+        return_VOID;
+    }
+
+    Status = AcpiNsInternalizeName (ExternalPath, &InternalPath);
+    if (ACPI_FAILURE (Status))
+    {
+        ACPI_FREE (ExternalPath);
+        return_VOID;
+    }
+
+    /* Remove the root backslash */
+
+    if ((*ExternalPath == AML_ROOT_PREFIX) && (ExternalPath[1]))
+    {
+        Temp = ACPI_ALLOCATE_ZEROED (strlen (ExternalPath) + 1);
+        if (!Temp)
+        {
+            return_VOID;
+        }
+
+        strcpy (Temp, &ExternalPath[1]);
+        ACPI_FREE (ExternalPath);
+        ExternalPath = Temp;
+    }
+
+    /* Create the new External() declaration node */
+
+    Status = AcpiDmCreateNewExternal (ExternalPath, InternalPath, Type,
+        Value, (Flags | ACPI_EXT_INTERNAL_PATH_ALLOCATED));
+    if (ACPI_FAILURE (Status))
+    {
+        ACPI_FREE (ExternalPath);
+        ACPI_FREE (InternalPath);
+    }
+
+    return_VOID;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmAddPathToExternalList
+ *
+ * PARAMETERS:  Path                - External name of the object to be added
+ *              Type                - ACPI object type to be added
+ *              Value               - Arg count if adding a Method object
+ *              Flags               - To be passed to the external object
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert a new name into the global list of Externals which
+ *              will in turn be later emitted as an External() declaration
+ *              in the disassembled output.
+ *
+ *              This function currently is used to add externals via a
+ *              reference file (via the -fe iASL option).
+ *
+ ******************************************************************************/
+
+static void
+AcpiDmAddPathToExternalList (
+    char                    *Path,
+    UINT8                   Type,
+    UINT32                  Value,
+    UINT16                  Flags)
+{
+    char                    *InternalPath;
+    char                    *ExternalPath;
+    ACPI_STATUS             Status;
+
+
+    ACPI_FUNCTION_TRACE (DmAddPathToExternalList);
+
+
+    if (!Path)
+    {
+        return_VOID;
+    }
+
+    /* Remove a root backslash if present */
+
+    if ((*Path == AML_ROOT_PREFIX) && (Path[1]))
+    {
+        Path++;
+    }
+
+    /* Create the internal and external pathnames */
+
+    Status = AcpiNsInternalizeName (Path, &InternalPath);
+    if (ACPI_FAILURE (Status))
+    {
+        return_VOID;
+    }
+
+    Status = AcpiNsExternalizeName (ACPI_UINT32_MAX, InternalPath,
+        NULL, &ExternalPath);
+    if (ACPI_FAILURE (Status))
+    {
+        ACPI_FREE (InternalPath);
+        return_VOID;
+    }
+
+    /* Create the new External() declaration node */
+
+    Status = AcpiDmCreateNewExternal (ExternalPath, InternalPath,
+        Type, Value, (Flags | ACPI_EXT_INTERNAL_PATH_ALLOCATED));
+    if (ACPI_FAILURE (Status))
+    {
+        ACPI_FREE (ExternalPath);
+        ACPI_FREE (InternalPath);
+    }
+
+    return_VOID;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmCreateNewExternal
+ *
+ * PARAMETERS:  ExternalPath        - External path to the object
+ *              InternalPath        - Internal (AML) path to the object
+ *              Type                - ACPI object type to be added
+ *              Value               - Arg count if adding a Method object
+ *              Flags               - To be passed to the external object
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Common low-level function to insert a new name into the global
+ *              list of Externals which will in turn be later emitted as
+ *              External() declarations in the disassembled output.
+ *
+ *              Note: The external name should not include a root prefix
+ *              (backslash). We do not want External() statements to contain
+ *              a leading '\', as this prevents duplicate external statements
+ *              of the form:
+ *
+ *                  External (\ABCD)
+ *                  External (ABCD)
+ *
+ *              This would cause a compile time error when the disassembled
+ *              output file is recompiled.
+ *
+ *              There are two cases that are handled here. For both, we emit
+ *              an External() statement:
+ *              1) The name was simply not found in the namespace.
+ *              2) The name was found, but it originated in a table other than
+ *              the table that is being disassembled.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmCreateNewExternal (
+    char                    *ExternalPath,
+    char                    *InternalPath,
+    UINT8                   Type,
+    UINT32                  Value,
+    UINT16                  Flags)
+{
+    ACPI_EXTERNAL_LIST      *NewExternal;
+    ACPI_EXTERNAL_LIST      *NextExternal;
+    ACPI_EXTERNAL_LIST      *PrevExternal = NULL;
+
+
+    ACPI_FUNCTION_TRACE (DmCreateNewExternal);
+
+
+    /* Check all existing externals to ensure no duplicates */
+
+    NextExternal = AcpiGbl_ExternalList;
+    while (NextExternal)
+    {
+        /* Check for duplicates */
+
+        if (!strcmp (ExternalPath, NextExternal->Path))
+        {
+            /*
+             * If this external came from an External() opcode, we are
+             * finished with this one. (No need to check any further).
+             */
+            if (NextExternal->Flags & ACPI_EXT_ORIGIN_FROM_OPCODE)
+            {
+                return_ACPI_STATUS (AE_ALREADY_EXISTS);
+            }
+
+            /* Allow upgrade of type from ANY */
+
+            else if ((NextExternal->Type == ACPI_TYPE_ANY) &&
+                (Type != ACPI_TYPE_ANY))
+            {
+                NextExternal->Type = Type;
+            }
+
+            /* Update the argument count as necessary */
+
+            if (Value < NextExternal->Value)
+            {
+                NextExternal->Value = Value;
+            }
+
+            /* Update flags. */
+
+            NextExternal->Flags |= Flags;
+            NextExternal->Flags &= ~ACPI_EXT_INTERNAL_PATH_ALLOCATED;
+
+            return_ACPI_STATUS (AE_ALREADY_EXISTS);
+        }
+
+        NextExternal = NextExternal->Next;
+    }
+
+    /* Allocate and init a new External() descriptor */
+
+    NewExternal = ACPI_ALLOCATE_ZEROED (sizeof (ACPI_EXTERNAL_LIST));
+    if (!NewExternal)
+    {
+        return_ACPI_STATUS (AE_NO_MEMORY);
+    }
+
+    ACPI_DEBUG_PRINT ((ACPI_DB_NAMES,
+        "Adding external reference node (%s) type [%s]\n",
+        ExternalPath, AcpiUtGetTypeName (Type)));
+
+    NewExternal->Flags = Flags;
+    NewExternal->Value = Value;
+    NewExternal->Path = ExternalPath;
+    NewExternal->Type = Type;
+    NewExternal->Length = (UINT16) strlen (ExternalPath);
+    NewExternal->InternalPath = InternalPath;
+
+    /* Link the new descriptor into the global list, alphabetically ordered */
+
+    NextExternal = AcpiGbl_ExternalList;
+    while (NextExternal)
+    {
+        if (AcpiUtStricmp (NewExternal->Path, NextExternal->Path) < 0)
+        {
+            if (PrevExternal)
+            {
+                PrevExternal->Next = NewExternal;
+            }
+            else
+            {
+                AcpiGbl_ExternalList = NewExternal;
+            }
+
+            NewExternal->Next = NextExternal;
+            return_ACPI_STATUS (AE_OK);
+        }
+
+        PrevExternal = NextExternal;
+        NextExternal = NextExternal->Next;
+    }
+
+    if (PrevExternal)
+    {
+        PrevExternal->Next = NewExternal;
+    }
+    else
+    {
+        AcpiGbl_ExternalList = NewExternal;
+    }
+
+    return_ACPI_STATUS (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmAddExternalsToNamespace
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add all externals to the namespace. Allows externals to be
+ *              "resolved".
+ *
+ ******************************************************************************/
+
+void
+AcpiDmAddExternalsToNamespace (
+    void)
+{
+    ACPI_STATUS             Status;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_OPERAND_OBJECT     *ObjDesc;
+    ACPI_EXTERNAL_LIST      *External = AcpiGbl_ExternalList;
+
+
+    while (External)
+    {
+        /* Add the external name (object) into the namespace */
+
+        Status = AcpiNsLookup (NULL, External->InternalPath, External->Type,
+            ACPI_IMODE_LOAD_PASS1,
+            ACPI_NS_ERROR_IF_FOUND | ACPI_NS_EXTERNAL | ACPI_NS_DONT_OPEN_SCOPE,
+            NULL, &Node);
+
+        if (ACPI_FAILURE (Status))
+        {
+            ACPI_EXCEPTION ((AE_INFO, Status,
+                "while adding external to namespace [%s]",
+                External->Path));
+        }
+
+        else switch (External->Type)
+        {
+        case ACPI_TYPE_METHOD:
+
+            /* For methods, we need to save the argument count */
+
+            ObjDesc = AcpiUtCreateInternalObject (ACPI_TYPE_METHOD);
+            ObjDesc->Method.ParamCount = (UINT8) External->Value;
+            Node->Object = ObjDesc;
+            break;
+
+        case ACPI_TYPE_REGION:
+
+            /* Regions require a region sub-object */
+
+            ObjDesc = AcpiUtCreateInternalObject (ACPI_TYPE_REGION);
+            ObjDesc->Region.Node = Node;
+            Node->Object = ObjDesc;
+            break;
+
+        default:
+
+            break;
+        }
+
+        External = External->Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmGetExternalMethodCount
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      The number of control method externals in the external list
+ *
+ * DESCRIPTION: Return the number of method externals that have been generated.
+ *              If any control method externals have been found, we must
+ *              re-parse the entire definition block with the new information
+ *              (number of arguments for the methods.) This is limitation of
+ *              AML, we don't know the number of arguments from the control
+ *              method invocation itself.
+ *
+ ******************************************************************************/
+
+UINT32
+AcpiDmGetExternalMethodCount (
+    void)
+{
+    ACPI_EXTERNAL_LIST      *External = AcpiGbl_ExternalList;
+    UINT32                  Count = 0;
+
+
+    while (External)
+    {
+        if (External->Type == ACPI_TYPE_METHOD)
+        {
+            Count++;
+        }
+
+        External = External->Next;
+    }
+
+    return (Count);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmClearExternalList
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Free the entire External info list
+ *
+ ******************************************************************************/
+
+void
+AcpiDmClearExternalList (
+    void)
+{
+    ACPI_EXTERNAL_LIST      *NextExternal;
+
+
+    while (AcpiGbl_ExternalList)
+    {
+        NextExternal = AcpiGbl_ExternalList->Next;
+        ACPI_FREE (AcpiGbl_ExternalList->Path);
+        ACPI_FREE (AcpiGbl_ExternalList);
+        AcpiGbl_ExternalList = NextExternal;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmEmitExternals
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emit an External() ASL statement for each of the externals in
+ *              the global external info list.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmEmitExternals (
+    void)
+{
+    ACPI_EXTERNAL_LIST      *NextExternal;
+
+
+    if (!AcpiGbl_ExternalList)
+    {
+        return;
+    }
+
+    /*
+     * Determine the number of control methods in the external list, and
+     * also how many of those externals were resolved via the namespace.
+     */
+    NextExternal = AcpiGbl_ExternalList;
+    while (NextExternal)
+    {
+        if (NextExternal->Type == ACPI_TYPE_METHOD)
+        {
+            AcpiGbl_NumExternalMethods++;
+            if (NextExternal->Flags & ACPI_EXT_RESOLVED_REFERENCE)
+            {
+                AcpiGbl_ResolvedExternalMethods++;
+            }
+        }
+
+        NextExternal = NextExternal->Next;
+    }
+
+    /* Check if any control methods were unresolved */
+
+    AcpiDmUnresolvedWarning (1);
+
+    if (Gbl_ExternalRefFilename)
+    {
+        AcpiOsPrintf (
+            "    /*\n     * External declarations were imported from\n"
+            "     * a reference file -- %s\n     */\n\n",
+            Gbl_ExternalRefFilename);
+    }
+
+    /*
+     * Walk and emit the list of externals found during the AML parsing
+     */
+    while (AcpiGbl_ExternalList)
+    {
+        if (!(AcpiGbl_ExternalList->Flags & ACPI_EXT_EXTERNAL_EMITTED))
+        {
+            AcpiOsPrintf ("    External (%s%s)",
+                AcpiGbl_ExternalList->Path,
+                AcpiDmGetObjectTypeName (AcpiGbl_ExternalList->Type));
+
+            /* Check for "unresolved" method reference */
+
+            if ((AcpiGbl_ExternalList->Type == ACPI_TYPE_METHOD) &&
+                (!(AcpiGbl_ExternalList->Flags & ACPI_EXT_RESOLVED_REFERENCE)))
+            {
+                AcpiOsPrintf ("    // Warning: Unknown method, "
+                    "guessing %u arguments",
+                    AcpiGbl_ExternalList->Value);
+            }
+
+            /* Check for external from a external references file */
+
+            else if (AcpiGbl_ExternalList->Flags & ACPI_EXT_ORIGIN_FROM_FILE)
+            {
+                if (AcpiGbl_ExternalList->Type == ACPI_TYPE_METHOD)
+                {
+                    AcpiOsPrintf ("    // %u Arguments",
+                        AcpiGbl_ExternalList->Value);
+                }
+
+                AcpiOsPrintf ("    // From external reference file");
+            }
+
+            /* This is the normal external case */
+
+            else
+            {
+                /* For methods, add a comment with the number of arguments */
+
+                if (AcpiGbl_ExternalList->Type == ACPI_TYPE_METHOD)
+                {
+                    AcpiOsPrintf ("    // %u Arguments",
+                        AcpiGbl_ExternalList->Value);
+                }
+            }
+
+            AcpiOsPrintf ("\n");
+        }
+
+        /* Free this external info block and move on to next external */
+
+        NextExternal = AcpiGbl_ExternalList->Next;
+        if (AcpiGbl_ExternalList->Flags & ACPI_EXT_INTERNAL_PATH_ALLOCATED)
+        {
+            ACPI_FREE (AcpiGbl_ExternalList->InternalPath);
+        }
+
+        ACPI_FREE (AcpiGbl_ExternalList->Path);
+        ACPI_FREE (AcpiGbl_ExternalList);
+        AcpiGbl_ExternalList = NextExternal;
+    }
+
+    AcpiOsPrintf ("\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmUnresolvedWarning
+ *
+ * PARAMETERS:  Type                - Where to output the warning.
+ *                                    0 means write to stderr
+ *                                    1 means write to AcpiOsPrintf
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Issue warning message if there are unresolved external control
+ *              methods within the disassembly.
+ *
+ ******************************************************************************/
+
+#if 0
+Summary of the external control method problem:
+
+When the -e option is used with disassembly, the various SSDTs are simply
+loaded into a global namespace for the disassembler to use in order to
+resolve control method references (invocations).
+
+The disassembler tracks any such references, and will emit an External()
+statement for these types of methods, with the proper number of arguments .
+
+Without the SSDTs, the AML does not contain enough information to properly
+disassemble the control method invocation -- because the disassembler does
+not know how many arguments to parse.
+
+An example: Assume we have two control methods. ABCD has one argument, and
+EFGH has zero arguments. Further, we have two additional control methods
+that invoke ABCD and EFGH, named T1 and T2:
+
+    Method (ABCD, 1)
+    {
+    }
+    Method (EFGH, 0)
+    {
+    }
+    Method (T1)
+    {
+        ABCD (Add (2, 7, Local0))
+    }
+    Method (T2)
+    {
+        EFGH ()
+        Add (2, 7, Local0)
+    }
+
+Here is the AML code that is generated for T1 and T2:
+
+     185:      Method (T1)
+
+0000034C:  14 10 54 31 5F 5F 00 ...    "..T1__."
+
+     186:      {
+     187:          ABCD (Add (2, 7, Local0))
+
+00000353:  41 42 43 44 ............    "ABCD"
+00000357:  72 0A 02 0A 07 60 ......    "r....`"
+
+     188:      }
+
+     190:      Method (T2)
+
+0000035D:  14 10 54 32 5F 5F 00 ...    "..T2__."
+
+     191:      {
+     192:          EFGH ()
+
+00000364:  45 46 47 48 ............    "EFGH"
+
+     193:          Add (2, 7, Local0)
+
+00000368:  72 0A 02 0A 07 60 ......    "r....`"
+     194:      }
+
+Note that the AML code for T1 and T2 is essentially identical. When
+disassembling this code, the methods ABCD and EFGH must be known to the
+disassembler, otherwise it does not know how to handle the method invocations.
+
+In other words, if ABCD and EFGH are actually external control methods
+appearing in an SSDT, the disassembler does not know what to do unless
+the owning SSDT has been loaded via the -e option.
+#endif
+
+static char             ExternalWarningPart1[600];
+static char             ExternalWarningPart2[400];
+static char             ExternalWarningPart3[400];
+static char             ExternalWarningPart4[200];
+
+void
+AcpiDmUnresolvedWarning (
+    UINT8                   Type)
+{
+    char                    *Format;
+    char                    Pad[] = "     *";
+    char                    NoPad[] = "";
+
+
+    if (!AcpiGbl_NumExternalMethods)
+    {
+        return;
+    }
+
+    if (AcpiGbl_NumExternalMethods == AcpiGbl_ResolvedExternalMethods)
+    {
+        return;
+    }
+
+    Format = Type ? Pad : NoPad;
+
+    sprintf (ExternalWarningPart1,
+        "%s iASL Warning: There %s %u external control method%s found during\n"
+        "%s disassembly, but only %u %s resolved (%u unresolved). Additional\n"
+        "%s ACPI tables may be required to properly disassemble the code. This\n"
+        "%s resulting disassembler output file may not compile because the\n"
+        "%s disassembler did not know how many arguments to assign to the\n"
+        "%s unresolved methods. Note: SSDTs can be dynamically loaded at\n"
+        "%s runtime and may or may not be available via the host OS.\n",
+        Format, (AcpiGbl_NumExternalMethods != 1 ? "were" : "was"),
+        AcpiGbl_NumExternalMethods, (AcpiGbl_NumExternalMethods != 1 ? "s" : ""),
+        Format, AcpiGbl_ResolvedExternalMethods,
+        (AcpiGbl_ResolvedExternalMethods != 1 ? "were" : "was"),
+        (AcpiGbl_NumExternalMethods - AcpiGbl_ResolvedExternalMethods),
+        Format, Format, Format, Format, Format);
+
+    sprintf (ExternalWarningPart2,
+        "%s To specify the tables needed to resolve external control method\n"
+        "%s references, the -e option can be used to specify the filenames.\n"
+        "%s Example iASL invocations:\n"
+        "%s     iasl -e ssdt1.aml ssdt2.aml ssdt3.aml -d dsdt.aml\n"
+        "%s     iasl -e dsdt.aml ssdt2.aml -d ssdt1.aml\n"
+        "%s     iasl -e ssdt*.aml -d dsdt.aml\n",
+        Format, Format, Format, Format, Format, Format);
+
+    sprintf (ExternalWarningPart3,
+        "%s In addition, the -fe option can be used to specify a file containing\n"
+        "%s control method external declarations with the associated method\n"
+        "%s argument counts. Each line of the file must be of the form:\n"
+        "%s     External (<method pathname>, MethodObj, <argument count>)\n"
+        "%s Invocation:\n"
+        "%s     iasl -fe refs.txt -d dsdt.aml\n",
+        Format, Format, Format, Format, Format, Format);
+
+    sprintf (ExternalWarningPart4,
+        "%s The following methods were unresolved and many not compile properly\n"
+        "%s because the disassembler had to guess at the number of arguments\n"
+        "%s required for each:\n",
+        Format, Format, Format);
+
+    if (Type)
+    {
+        if (!AcpiGbl_ExternalFileList)
+        {
+            /* The -e option was not specified */
+
+           AcpiOsPrintf ("    /*\n%s     *\n%s     *\n%s     *\n%s     */\n",
+               ExternalWarningPart1, ExternalWarningPart2, ExternalWarningPart3,
+               ExternalWarningPart4);
+        }
+        else
+        {
+            /* The -e option was specified, but there are still some unresolved externals */
+
+            AcpiOsPrintf ("    /*\n%s     *\n%s     *\n%s     */\n",
+               ExternalWarningPart1, ExternalWarningPart3, ExternalWarningPart4);
+        }
+    }
+    else
+    {
+        if (!AcpiGbl_ExternalFileList)
+        {
+            /* The -e option was not specified */
+
+            fprintf (stderr, "\n%s\n%s\n%s\n",
+               ExternalWarningPart1, ExternalWarningPart2, ExternalWarningPart3);
+        }
+        else
+        {
+            /* The -e option was specified, but there are still some unresolved externals */
+
+            fprintf (stderr, "\n%s\n%s\n",
+               ExternalWarningPart1, ExternalWarningPart3);
+        }
+    }
+}
diff --git a/usr/src/cmd/acpi/common/dmrestag.c b/usr/src/cmd/acpi/common/dmrestag.c
new file mode 100644
index 0000000000..bfeb2833aa
--- /dev/null
+++ b/usr/src/cmd/acpi/common/dmrestag.c
@@ -0,0 +1,1052 @@
+/******************************************************************************
+ *
+ * Module Name: dmrestag - Add tags to resource descriptors (Application-level)
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acparser.h"
+#include "acdisasm.h"
+#include "acnamesp.h"
+#include "amlcode.h"
+
+/* This module used for application-level code only */
+
+#define _COMPONENT          ACPI_CA_DISASSEMBLER
+        ACPI_MODULE_NAME    ("dmrestag")
+
+/* Local prototypes */
+
+static void
+AcpiDmUpdateResourceName (
+    ACPI_NAMESPACE_NODE     *ResourceNode);
+
+static char *
+AcpiDmSearchTagList (
+    UINT32                  BitIndex,
+    const ACPI_RESOURCE_TAG *TagList);
+
+static char *
+AcpiDmGetResourceTag (
+    UINT32                  BitIndex,
+    AML_RESOURCE            *Resource,
+    UINT8                   ResourceIndex);
+
+static char *
+AcpiGetTagPathname (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_NAMESPACE_NODE     *BufferNode,
+    ACPI_NAMESPACE_NODE     *ResourceNode,
+    UINT32                  BitIndex);
+
+static ACPI_NAMESPACE_NODE *
+AcpiDmGetResourceNode (
+    ACPI_NAMESPACE_NODE     *BufferNode,
+    UINT32                  BitIndex);
+
+static ACPI_STATUS
+AcpiDmAddResourceToNamespace (
+    UINT8                   *Aml,
+    UINT32                  Length,
+    UINT32                  Offset,
+    UINT8                   ResourceIndex,
+    void                    **Context);
+
+static void
+AcpiDmAddResourcesToNamespace (
+    ACPI_NAMESPACE_NODE     *BufferNode,
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/******************************************************************************
+ *
+ * Resource Tag tables
+ *
+ * These are the predefined tags that refer to elements of a resource
+ * descriptor. Each name and offset is defined in the ACPI specification.
+ *
+ * Each table entry contains the bit offset of the field and the associated
+ * name.
+ *
+ ******************************************************************************/
+
+static const ACPI_RESOURCE_TAG      AcpiDmIrqTags[] =
+{
+    {( 1 * 8),      ACPI_RESTAG_INTERRUPT},
+    {( 3 * 8) + 0,  ACPI_RESTAG_INTERRUPTTYPE},
+    {( 3 * 8) + 3,  ACPI_RESTAG_INTERRUPTLEVEL},
+    {( 3 * 8) + 4,  ACPI_RESTAG_INTERRUPTSHARE},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmDmaTags[] =
+{
+    {( 1 * 8),      ACPI_RESTAG_DMA},
+    {( 2 * 8) + 0,  ACPI_RESTAG_XFERTYPE},
+    {( 2 * 8) + 2,  ACPI_RESTAG_BUSMASTER},
+    {( 2 * 8) + 5,  ACPI_RESTAG_DMATYPE},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmIoTags[] =
+{
+    {( 1 * 8) + 0,  ACPI_RESTAG_DECODE},
+    {( 2 * 8),      ACPI_RESTAG_MINADDR},
+    {( 4 * 8),      ACPI_RESTAG_MAXADDR},
+    {( 6 * 8),      ACPI_RESTAG_ALIGNMENT},
+    {( 7 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmFixedIoTags[] =
+{
+    {( 1 * 8),      ACPI_RESTAG_BASEADDRESS},
+    {( 3 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmFixedDmaTags[] =
+{
+    {( 1 * 8),      ACPI_RESTAG_DMA},
+    {( 3 * 8),      ACPI_RESTAG_DMATYPE},
+    {( 5 * 8),      ACPI_RESTAG_XFERTYPE},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmMemory24Tags[] =
+{
+    {( 3 * 8) + 0,  ACPI_RESTAG_READWRITETYPE},
+    {( 4 * 8),      ACPI_RESTAG_MINADDR},
+    {( 6 * 8),      ACPI_RESTAG_MAXADDR},
+    {( 8 * 8),      ACPI_RESTAG_ALIGNMENT},
+    {(10 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmRegisterTags[] =
+{
+    {( 3 * 8),      ACPI_RESTAG_ADDRESSSPACE},
+    {( 4 * 8),      ACPI_RESTAG_REGISTERBITWIDTH},
+    {( 5 * 8),      ACPI_RESTAG_REGISTERBITOFFSET},
+    {( 6 * 8),      ACPI_RESTAG_ACCESSSIZE},
+    {( 7 * 8),      ACPI_RESTAG_ADDRESS},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmMemory32Tags[] =
+{
+    {( 3 * 8) + 0,  ACPI_RESTAG_READWRITETYPE},
+    {( 4 * 8),      ACPI_RESTAG_MINADDR},
+    {( 8 * 8),      ACPI_RESTAG_MAXADDR},
+    {(12 * 8),      ACPI_RESTAG_ALIGNMENT},
+    {(16 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmFixedMemory32Tags[] =
+{
+    {( 3 * 8) + 0,  ACPI_RESTAG_READWRITETYPE},
+    {( 4 * 8),      ACPI_RESTAG_BASEADDRESS},
+    {( 8 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmInterruptTags[] =
+{
+    {( 3 * 8) + 1,  ACPI_RESTAG_INTERRUPTTYPE},
+    {( 3 * 8) + 2,  ACPI_RESTAG_INTERRUPTLEVEL},
+    {( 3 * 8) + 3,  ACPI_RESTAG_INTERRUPTSHARE},
+    {( 5 * 8),      ACPI_RESTAG_INTERRUPT},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmAddress16Tags[] =
+{
+    {( 4 * 8) + 1,  ACPI_RESTAG_DECODE},
+    {( 4 * 8) + 2,  ACPI_RESTAG_MINTYPE},
+    {( 4 * 8) + 3,  ACPI_RESTAG_MAXTYPE},
+    {( 6 * 8),      ACPI_RESTAG_GRANULARITY},
+    {( 8 * 8),      ACPI_RESTAG_MINADDR},
+    {(10 * 8),      ACPI_RESTAG_MAXADDR},
+    {(12 * 8),      ACPI_RESTAG_TRANSLATION},
+    {(14 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmAddress32Tags[] =
+{
+    {( 4 * 8) + 1,  ACPI_RESTAG_DECODE},
+    {( 4 * 8) + 2,  ACPI_RESTAG_MINTYPE},
+    {( 4 * 8) + 3,  ACPI_RESTAG_MAXTYPE},
+    {( 6 * 8),      ACPI_RESTAG_GRANULARITY},
+    {(10 * 8),      ACPI_RESTAG_MINADDR},
+    {(14 * 8),      ACPI_RESTAG_MAXADDR},
+    {(18 * 8),      ACPI_RESTAG_TRANSLATION},
+    {(22 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmAddress64Tags[] =
+{
+    {( 4 * 8) + 1,  ACPI_RESTAG_DECODE},
+    {( 4 * 8) + 2,  ACPI_RESTAG_MINTYPE},
+    {( 4 * 8) + 3,  ACPI_RESTAG_MAXTYPE},
+    {( 6 * 8),      ACPI_RESTAG_GRANULARITY},
+    {(14 * 8),      ACPI_RESTAG_MINADDR},
+    {(22 * 8),      ACPI_RESTAG_MAXADDR},
+    {(30 * 8),      ACPI_RESTAG_TRANSLATION},
+    {(38 * 8),      ACPI_RESTAG_LENGTH},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmExtendedAddressTags[] =
+{
+    {( 4 * 8) + 1,  ACPI_RESTAG_DECODE},
+    {( 4 * 8) + 2,  ACPI_RESTAG_MINTYPE},
+    {( 4 * 8) + 3,  ACPI_RESTAG_MAXTYPE},
+    {( 8 * 8),      ACPI_RESTAG_GRANULARITY},
+    {(16 * 8),      ACPI_RESTAG_MINADDR},
+    {(24 * 8),      ACPI_RESTAG_MAXADDR},
+    {(32 * 8),      ACPI_RESTAG_TRANSLATION},
+    {(40 * 8),      ACPI_RESTAG_LENGTH},
+    {(48 * 8),      ACPI_RESTAG_TYPESPECIFICATTRIBUTES},
+    {0,             NULL}
+};
+
+/* Subtype tables for GPIO descriptors */
+
+static const ACPI_RESOURCE_TAG      AcpiDmGpioIntTags[] =
+{
+    {( 7 * 8) + 0,  ACPI_RESTAG_MODE},
+    {( 7 * 8) + 1,  ACPI_RESTAG_POLARITY},
+    {( 7 * 8) + 3,  ACPI_RESTAG_INTERRUPTSHARE},
+    {( 9 * 8),      ACPI_RESTAG_PINCONFIG},
+    {(10 * 8),      ACPI_RESTAG_DRIVESTRENGTH},
+    {(12 * 8),      ACPI_RESTAG_DEBOUNCETIME},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmGpioIoTags[] =
+{
+    {( 7 * 8) + 0,  ACPI_RESTAG_IORESTRICTION},
+    {( 7 * 8) + 3,  ACPI_RESTAG_INTERRUPTSHARE},
+    {( 9 * 8),      ACPI_RESTAG_PINCONFIG},
+    {(10 * 8),      ACPI_RESTAG_DRIVESTRENGTH},
+    {(12 * 8),      ACPI_RESTAG_DEBOUNCETIME},
+    {0,             NULL}
+};
+
+/* Subtype tables for SerialBus descriptors */
+
+static const ACPI_RESOURCE_TAG      AcpiDmI2cSerialBusTags[] =
+{
+    {( 6 * 8) + 0,  ACPI_RESTAG_SLAVEMODE},
+    {( 6 * 8) + 2,  ACPI_RESTAG_INTERRUPTSHARE},    /* V2 - ACPI 6.0 */
+    {( 7 * 8) + 0,  ACPI_RESTAG_MODE},
+    {(12 * 8),      ACPI_RESTAG_SPEED},
+    {(16 * 8),      ACPI_RESTAG_ADDRESS},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmSpiSerialBusTags[] =
+{
+    {( 6 * 8) + 0,  ACPI_RESTAG_SLAVEMODE},
+    {( 6 * 8) + 2,  ACPI_RESTAG_INTERRUPTSHARE},    /* V2 - ACPI 6.0 */
+    {( 7 * 8) + 0,  ACPI_RESTAG_MODE},
+    {( 7 * 8) + 1,  ACPI_RESTAG_DEVICEPOLARITY},
+    {(12 * 8),      ACPI_RESTAG_SPEED},
+    {(16 * 8),      ACPI_RESTAG_LENGTH},
+    {(17 * 8),      ACPI_RESTAG_PHASE},
+    {(18 * 8),      ACPI_RESTAG_POLARITY},
+    {(19 * 8),      ACPI_RESTAG_ADDRESS},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmUartSerialBusTags[] =
+{
+    {( 6 * 8) + 0,  ACPI_RESTAG_SLAVEMODE},         /* Note: not part of original macro */
+    {( 6 * 8) + 2,  ACPI_RESTAG_INTERRUPTSHARE},    /* V2 - ACPI 6.0 */
+    {( 7 * 8) + 0,  ACPI_RESTAG_FLOWCONTROL},
+    {( 7 * 8) + 2,  ACPI_RESTAG_STOPBITS},
+    {( 7 * 8) + 4,  ACPI_RESTAG_LENGTH},
+    {( 7 * 8) + 7,  ACPI_RESTAG_ENDIANNESS},
+    {(12 * 8),      ACPI_RESTAG_SPEED},
+    {(16 * 8),      ACPI_RESTAG_LENGTH_RX},
+    {(18 * 8),      ACPI_RESTAG_LENGTH_TX},
+    {(20 * 8),      ACPI_RESTAG_PARITY},
+    {(21 * 8),      ACPI_RESTAG_LINE},
+    {0,             NULL}
+};
+
+/* Subtype tables for Address descriptor type-specific flags */
+
+static const ACPI_RESOURCE_TAG      AcpiDmMemoryFlagTags[] =
+{
+    {( 5 * 8) + 0,  ACPI_RESTAG_READWRITETYPE},
+    {( 5 * 8) + 1,  ACPI_RESTAG_MEMTYPE},
+    {( 5 * 8) + 3,  ACPI_RESTAG_MEMATTRIBUTES},
+    {( 5 * 8) + 5,  ACPI_RESTAG_TYPE},
+    {0,             NULL}
+};
+
+static const ACPI_RESOURCE_TAG      AcpiDmIoFlagTags[] =
+{
+    {( 5 * 8) + 0,  ACPI_RESTAG_RANGETYPE},
+    {( 5 * 8) + 4,  ACPI_RESTAG_TYPE},
+    {( 5 * 8) + 5,  ACPI_RESTAG_TRANSTYPE},
+    {0,             NULL}
+};
+
+
+/*
+ * Dispatch table used to obtain the correct tag table for a descriptor.
+ *
+ * A NULL in this table means one of three things:
+ * 1) The descriptor ID is reserved and invalid
+ * 2) The descriptor has no tags associated with it
+ * 3) The descriptor has subtypes and a separate table will be used.
+ */
+static const ACPI_RESOURCE_TAG      *AcpiGbl_ResourceTags[] =
+{
+    /* Small descriptors */
+
+    NULL,                           /* 0x00, Reserved */
+    NULL,                           /* 0x01, Reserved */
+    NULL,                           /* 0x02, Reserved */
+    NULL,                           /* 0x03, Reserved */
+    AcpiDmIrqTags,                  /* 0x04, ACPI_RESOURCE_NAME_IRQ_FORMAT */
+    AcpiDmDmaTags,                  /* 0x05, ACPI_RESOURCE_NAME_DMA_FORMAT */
+    NULL,                           /* 0x06, ACPI_RESOURCE_NAME_START_DEPENDENT */
+    NULL,                           /* 0x07, ACPI_RESOURCE_NAME_END_DEPENDENT */
+    AcpiDmIoTags,                   /* 0x08, ACPI_RESOURCE_NAME_IO_PORT */
+    AcpiDmFixedIoTags,              /* 0x09, ACPI_RESOURCE_NAME_FIXED_IO_PORT */
+    AcpiDmFixedDmaTags,             /* 0x0A, ACPI_RESOURCE_NAME_FIXED_DMA */
+    NULL,                           /* 0x0B, Reserved */
+    NULL,                           /* 0x0C, Reserved */
+    NULL,                           /* 0x0D, Reserved */
+    NULL,                           /* 0x0E, ACPI_RESOURCE_NAME_SMALL_VENDOR */
+    NULL,                           /* 0x0F, ACPI_RESOURCE_NAME_END_TAG (not used) */
+
+    /* Large descriptors */
+
+    NULL,                           /* 0x00, Reserved */
+    AcpiDmMemory24Tags,             /* 0x01, ACPI_RESOURCE_NAME_MEMORY_24 */
+    AcpiDmRegisterTags,             /* 0x02, ACPI_RESOURCE_NAME_GENERIC_REGISTER */
+    NULL,                           /* 0x03, Reserved */
+    NULL,                           /* 0x04, ACPI_RESOURCE_NAME_LARGE_VENDOR */
+    AcpiDmMemory32Tags,             /* 0x05, ACPI_RESOURCE_NAME_MEMORY_32 */
+    AcpiDmFixedMemory32Tags,        /* 0x06, ACPI_RESOURCE_NAME_FIXED_MEMORY_32 */
+    AcpiDmAddress32Tags,            /* 0x07, ACPI_RESOURCE_NAME_DWORD_ADDRESS_SPACE */
+    AcpiDmAddress16Tags,            /* 0x08, ACPI_RESOURCE_NAME_WORD_ADDRESS_SPACE */
+    AcpiDmInterruptTags,            /* 0x09, ACPI_RESOURCE_NAME_EXTENDED_XRUPT */
+    AcpiDmAddress64Tags,            /* 0x0A, ACPI_RESOURCE_NAME_QWORD_ADDRESS_SPACE */
+    AcpiDmExtendedAddressTags,      /* 0x0B, ACPI_RESOURCE_NAME_EXTENDED_ADDRESS_SPACE */
+    NULL,                           /* 0x0C, ACPI_RESOURCE_NAME_GPIO - Use Subtype table below */
+    NULL,                           /* 0x0D, Reserved */
+    NULL                            /* 0x0E, ACPI_RESOURCE_NAME_SERIAL_BUS - Use Subtype table below */
+};
+
+/* GPIO Subtypes */
+
+static const ACPI_RESOURCE_TAG      *AcpiGbl_GpioResourceTags[] =
+{
+    AcpiDmGpioIntTags,              /* 0x00 Interrupt Connection */
+    AcpiDmGpioIoTags                /* 0x01 I/O Connection */
+};
+
+/* Serial Bus Subtypes */
+
+static const ACPI_RESOURCE_TAG      *AcpiGbl_SerialResourceTags[] =
+{
+    NULL,                           /* 0x00 Reserved */
+    AcpiDmI2cSerialBusTags,         /* 0x01 I2C SerialBus */
+    AcpiDmSpiSerialBusTags,         /* 0x02 SPI SerialBus */
+    AcpiDmUartSerialBusTags         /* 0x03 UART SerialBus */
+};
+
+/*
+ * Globals used to generate unique resource descriptor names. We use names that
+ * start with underscore and a prefix letter that is not used by other ACPI
+ * reserved names. To this, we append hex 0x00 through 0xFF. These 5 prefixes
+ * allow for 5*256 = 1280 unique names, probably sufficient for any single ASL
+ * file. If this becomes too small, we can use alpha+numerals for a total
+ * of 5*36*36 = 6480.
+ */
+#define ACPI_NUM_RES_PREFIX     5
+
+static UINT32                   AcpiGbl_NextResourceId = 0;
+static UINT8                    AcpiGbl_NextPrefix = 0;
+static char                     AcpiGbl_Prefix[ACPI_NUM_RES_PREFIX] =
+                                    {'Y','Z','J','K','X'};
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmCheckResourceReference
+ *
+ * PARAMETERS:  Op                  - Parse Op for the AML opcode
+ *              WalkState           - Current walk state (with valid scope)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert a reference to a resource descriptor to a symbolic
+ *              reference if possible
+ *
+ * NOTE:        Bit index is used to transparently handle both resource bit
+ *              fields and byte fields.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmCheckResourceReference (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+{
+    ACPI_STATUS             Status;
+    ACPI_PARSE_OBJECT       *BufferNameOp;
+    ACPI_PARSE_OBJECT       *IndexOp;
+    ACPI_NAMESPACE_NODE     *BufferNode;
+    ACPI_NAMESPACE_NODE     *ResourceNode;
+    const ACPI_OPCODE_INFO  *OpInfo;
+    UINT32                  BitIndex;
+
+
+    /* We are only interested in the CreateXxxxField opcodes */
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+    if (OpInfo->Type != AML_TYPE_CREATE_FIELD)
+    {
+        return;
+    }
+
+    /* Get the buffer term operand */
+
+    BufferNameOp = AcpiPsGetDepthNext (NULL, Op);
+
+    /* Must be a named buffer, not an arg or local or method call */
+
+    if (BufferNameOp->Common.AmlOpcode != AML_INT_NAMEPATH_OP)
+    {
+        return;
+    }
+
+    /* Get the Index term, must be an integer constant to convert */
+
+    IndexOp = BufferNameOp->Common.Next;
+
+    /* Major cheat: The Node field is also used for the Tag ptr. Clear it now */
+
+    IndexOp->Common.Node = NULL;
+
+    OpInfo = AcpiPsGetOpcodeInfo (IndexOp->Common.AmlOpcode);
+    if (OpInfo->ObjectType != ACPI_TYPE_INTEGER)
+    {
+        return;
+    }
+
+    /* Get the bit offset of the descriptor within the buffer */
+
+    if ((Op->Common.AmlOpcode == AML_CREATE_BIT_FIELD_OP) ||
+        (Op->Common.AmlOpcode == AML_CREATE_FIELD_OP))
+    {
+        /* Index operand is a bit offset */
+
+        BitIndex = (UINT32) IndexOp->Common.Value.Integer;
+    }
+    else
+    {
+        /* Index operand is a byte offset, convert to bits */
+
+        BitIndex = (UINT32) ACPI_MUL_8 (IndexOp->Common.Value.Integer);
+    }
+
+    /* Lookup the buffer in the namespace */
+
+    Status = AcpiNsLookup (WalkState->ScopeInfo,
+        BufferNameOp->Common.Value.String, ACPI_TYPE_BUFFER,
+        ACPI_IMODE_EXECUTE, ACPI_NS_SEARCH_PARENT, WalkState,
+        &BufferNode);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Validate object type, we must have a buffer */
+
+    if (BufferNode->Type != ACPI_TYPE_BUFFER)
+    {
+        return;
+    }
+
+    /* Find the resource descriptor node corresponding to the index */
+
+    ResourceNode = AcpiDmGetResourceNode (BufferNode, BitIndex);
+    if (!ResourceNode)
+    {
+        return;
+    }
+
+    /* Translate the Index to a resource tag pathname */
+
+    AcpiGetTagPathname (IndexOp, BufferNode, ResourceNode, BitIndex);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmGetResourceNode
+ *
+ * PARAMETERS:  BufferNode          - Node for the parent buffer
+ *              BitIndex            - Index into the resource descriptor
+ *
+ * RETURN:      Namespace node for the resource descriptor. NULL if not found
+ *
+ * DESCRIPTION: Find a resource descriptor that corresponds to the bit index
+ *
+ ******************************************************************************/
+
+static ACPI_NAMESPACE_NODE *
+AcpiDmGetResourceNode (
+    ACPI_NAMESPACE_NODE     *BufferNode,
+    UINT32                  BitIndex)
+{
+    ACPI_NAMESPACE_NODE     *Node;
+    UINT32                  ByteIndex = ACPI_DIV_8 (BitIndex);
+
+
+    /*
+     * Child list contains an entry for each resource descriptor. Find
+     * the descriptor that corresponds to the Index.
+     *
+     * If there are no children, this is not a resource template
+     */
+    Node = BufferNode->Child;
+    while (Node)
+    {
+        /*
+         * Check if the Index falls within this resource.
+         *
+         * Value contains the resource offset, Object contains the resource
+         * length (both in bytes)
+         */
+        if ((ByteIndex >= Node->Value) &&
+            (ByteIndex < (Node->Value + Node->Length)))
+        {
+            return (Node);
+        }
+
+        Node = Node->Peer;
+    }
+
+    return (NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiGetTagPathname
+ *
+ * PARAMETERS:  BufferNode          - Node for the parent buffer
+ *              ResourceNode        - Node for a resource descriptor
+ *              BitIndex            - Index into the resource descriptor
+ *
+ * RETURN:      Full pathname for a resource tag. NULL if no match.
+ *              Path is returned in AML (packed) format.
+ *
+ * DESCRIPTION: Convert a BitIndex into a symbolic resource tag (full pathname)
+ *
+ ******************************************************************************/
+
+static char *
+AcpiGetTagPathname (
+    ACPI_PARSE_OBJECT       *IndexOp,
+    ACPI_NAMESPACE_NODE     *BufferNode,
+    ACPI_NAMESPACE_NODE     *ResourceNode,
+    UINT32                  BitIndex)
+{
+    ACPI_STATUS             Status;
+    UINT32                  ResourceBitIndex;
+    UINT8                   ResourceTableIndex;
+    ACPI_SIZE               RequiredSize;
+    char                    *Pathname;
+    AML_RESOURCE            *Aml;
+    ACPI_PARSE_OBJECT       *Op;
+    char                    *InternalPath;
+    char                    *Tag;
+
+
+    /* Get the Op that contains the actual buffer data */
+
+    Op = BufferNode->Op->Common.Value.Arg;
+    Op = Op->Common.Next;
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    /* Get the individual resource descriptor and validate it */
+
+    Aml = ACPI_CAST_PTR (
+        AML_RESOURCE, &Op->Named.Data[ResourceNode->Value]);
+
+    Status = AcpiUtValidateResource (NULL, Aml, &ResourceTableIndex);
+    if (ACPI_FAILURE (Status))
+    {
+        return (NULL);
+    }
+
+    /* Get offset into this descriptor (from offset into entire buffer) */
+
+    ResourceBitIndex = BitIndex - ACPI_MUL_8 (ResourceNode->Value);
+
+    /* Get the tag associated with this resource descriptor and offset */
+
+    Tag = AcpiDmGetResourceTag (ResourceBitIndex, Aml, ResourceTableIndex);
+    if (!Tag)
+    {
+        return (NULL);
+    }
+
+    /*
+     * Now that we know that we have a reference that can be converted to a
+     * symbol, change the name of the resource to a unique name.
+     */
+    AcpiDmUpdateResourceName (ResourceNode);
+
+    /* Get the full pathname to the parent buffer */
+
+    RequiredSize = AcpiNsBuildNormalizedPath (BufferNode, NULL, 0, FALSE);
+    if (!RequiredSize)
+    {
+        return (NULL);
+    }
+
+    Pathname = ACPI_ALLOCATE_ZEROED (RequiredSize + ACPI_PATH_SEGMENT_LENGTH);
+    if (!Pathname)
+    {
+        return (NULL);
+    }
+
+    (void) AcpiNsBuildNormalizedPath (BufferNode, Pathname,
+        RequiredSize, FALSE);
+
+    /*
+     * Create the full path to the resource and tag by: remove the buffer name,
+     * append the resource descriptor name, append a dot, append the tag name.
+     *
+     * TBD: Always using the full path is a bit brute force, the path can be
+     * often be optimized with carats (if the original buffer namepath is a
+     * single nameseg). This doesn't really matter, because these paths do not
+     * end up in the final compiled AML, it's just an appearance issue for the
+     * disassembled code.
+     */
+    Pathname[strlen (Pathname) - ACPI_NAME_SIZE] = 0;
+    strncat (Pathname, ResourceNode->Name.Ascii, ACPI_NAME_SIZE);
+    strcat (Pathname, ".");
+    strncat (Pathname, Tag, ACPI_NAME_SIZE);
+
+    /* Internalize the namepath to AML format */
+
+    AcpiNsInternalizeName (Pathname, &InternalPath);
+    ACPI_FREE (Pathname);
+
+    /* Update the Op with the symbol */
+
+    AcpiPsInitOp (IndexOp, AML_INT_NAMEPATH_OP);
+    IndexOp->Common.Value.String = InternalPath;
+
+    /* We will need the tag later. Cheat by putting it in the Node field */
+
+    IndexOp->Common.Node = ACPI_CAST_PTR (ACPI_NAMESPACE_NODE, Tag);
+    return (InternalPath);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmUpdateResourceName
+ *
+ * PARAMETERS:  ResourceNode        - Node for a resource descriptor
+ *
+ * RETURN:      Stores new name in the ResourceNode
+ *
+ * DESCRIPTION: Create a new, unique name for a resource descriptor. Used by
+ *              both the disassembly of the descriptor itself and any symbolic
+ *              references to the descriptor. Ignored if a unique name has
+ *              already been assigned to the resource.
+ *
+ * NOTE: Single threaded, suitable for applications only!
+ *
+ ******************************************************************************/
+
+static void
+AcpiDmUpdateResourceName (
+    ACPI_NAMESPACE_NODE     *ResourceNode)
+{
+    char                    Name[ACPI_NAME_SIZE];
+
+
+    /* Ignore if a unique name has already been assigned */
+
+    if (ResourceNode->Name.Integer != ACPI_DEFAULT_RESNAME)
+    {
+        return;
+    }
+
+    /* Generate a new ACPI name for the descriptor */
+
+    Name[0] = '_';
+    Name[1] = AcpiGbl_Prefix[AcpiGbl_NextPrefix];
+    Name[2] = AcpiUtHexToAsciiChar ((UINT64) AcpiGbl_NextResourceId, 4);
+    Name[3] = AcpiUtHexToAsciiChar ((UINT64) AcpiGbl_NextResourceId, 0);
+
+    /* Update globals for next name */
+
+    AcpiGbl_NextResourceId++;
+    if (AcpiGbl_NextResourceId >= 256)
+    {
+        AcpiGbl_NextResourceId = 0;
+        AcpiGbl_NextPrefix++;
+
+        if (AcpiGbl_NextPrefix > ACPI_NUM_RES_PREFIX)
+        {
+            AcpiGbl_NextPrefix = 0;
+        }
+    }
+
+    /* Change the resource descriptor name */
+
+    ResourceNode->Name.Integer = *ACPI_CAST_PTR (UINT32, &Name[0]);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmGetResourceTag
+ *
+ * PARAMETERS:  BitIndex            - Index into the resource descriptor
+ *              Resource            - Pointer to the raw resource data
+ *              ResourceIndex       - Index correspoinding to the resource type
+ *
+ * RETURN:      Pointer to the resource tag (ACPI_NAME). NULL if no match.
+ *
+ * DESCRIPTION: Convert a BitIndex into a symbolic resource tag.
+ *
+ * Note: ResourceIndex should be previously validated and guaranteed to ve
+ *       valid.
+ *
+ ******************************************************************************/
+
+static char *
+AcpiDmGetResourceTag (
+    UINT32                  BitIndex,
+    AML_RESOURCE            *Resource,
+    UINT8                   ResourceIndex)
+{
+    const ACPI_RESOURCE_TAG *TagList;
+    char                    *Tag = NULL;
+
+
+    /* Get the tag list for this resource descriptor type */
+
+    TagList = AcpiGbl_ResourceTags[ResourceIndex];
+
+    /*
+     * Handle descriptors that have multiple subtypes
+     */
+    switch (Resource->DescriptorType)
+    {
+    case ACPI_RESOURCE_NAME_ADDRESS16:
+    case ACPI_RESOURCE_NAME_ADDRESS32:
+    case ACPI_RESOURCE_NAME_ADDRESS64:
+    case ACPI_RESOURCE_NAME_EXTENDED_ADDRESS64:
+        /*
+         * Subtype differentiation is the flags.
+         * Kindof brute force, but just blindly search for an index match
+         */
+        if (Resource->Address.ResourceType == ACPI_ADDRESS_TYPE_MEMORY_RANGE)
+        {
+            Tag = AcpiDmSearchTagList (BitIndex, AcpiDmMemoryFlagTags);
+        }
+        else if (Resource->Address.ResourceType == ACPI_ADDRESS_TYPE_IO_RANGE)
+        {
+            Tag = AcpiDmSearchTagList (BitIndex, AcpiDmIoFlagTags);
+        }
+
+        /* If we found a match, all done. Else, drop to normal search below */
+
+        if (Tag)
+        {
+            return (Tag);
+        }
+        break;
+
+    case ACPI_RESOURCE_NAME_GPIO:
+
+        /* GPIO connection has 2 subtypes: Interrupt and I/O */
+
+        if (Resource->Gpio.ConnectionType > AML_RESOURCE_MAX_GPIOTYPE)
+        {
+            return (NULL);
+        }
+
+        TagList = AcpiGbl_GpioResourceTags[Resource->Gpio.ConnectionType];
+        break;
+
+    case ACPI_RESOURCE_NAME_SERIAL_BUS:
+
+        /* SerialBus has 3 subtypes: I2C, SPI, and UART */
+
+        if ((Resource->CommonSerialBus.Type == 0) ||
+            (Resource->CommonSerialBus.Type > AML_RESOURCE_MAX_SERIALBUSTYPE))
+        {
+            return (NULL);
+        }
+
+        TagList = AcpiGbl_SerialResourceTags[Resource->CommonSerialBus.Type];
+        break;
+
+    default:
+
+        break;
+    }
+
+    /* Search for a match against the BitIndex */
+
+    if (TagList)
+    {
+        Tag = AcpiDmSearchTagList (BitIndex, TagList);
+    }
+
+    return (Tag);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmSearchTagList
+ *
+ * PARAMETERS:  BitIndex            - Index into the resource descriptor
+ *              TagList             - List to search
+ *
+ * RETURN:      Pointer to a tag (ACPI_NAME). NULL if no match found.
+ *
+ * DESCRIPTION: Search a tag list for a match to the input BitIndex. Matches
+ *              a fixed offset to a symbolic resource tag name.
+ *
+ ******************************************************************************/
+
+static char *
+AcpiDmSearchTagList (
+    UINT32                  BitIndex,
+    const ACPI_RESOURCE_TAG *TagList)
+{
+
+    /*
+     * Walk the null-terminated tag list to find a matching bit offset.
+     * We are looking for an exact match.
+     */
+    for ( ; TagList->Tag; TagList++)
+    {
+        if (BitIndex == TagList->BitIndex)
+        {
+            return (TagList->Tag);
+        }
+    }
+
+    /* A matching offset was not found */
+
+    return (NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmFindResources
+ *
+ * PARAMETERS:  Root                - Root of the parse tree
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add all ResourceTemplate declarations to the namespace. Each
+ *              resource descriptor in each template is given a node -- used
+ *              for later conversion of resource references to symbolic refs.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmFindResources (
+    ACPI_PARSE_OBJECT       *Root)
+{
+    ACPI_PARSE_OBJECT       *Op = Root;
+    ACPI_PARSE_OBJECT       *Parent;
+
+
+    /* Walk the entire parse tree */
+
+    while (Op)
+    {
+        /* We are interested in Buffer() declarations */
+
+        if (Op->Common.AmlOpcode == AML_BUFFER_OP)
+        {
+            /* And only declarations of the form Name (XXXX, Buffer()... ) */
+
+            Parent = Op->Common.Parent;
+            if (Parent->Common.AmlOpcode == AML_NAME_OP)
+            {
+                /*
+                 * If the buffer is a resource template, add the individual
+                 * resource descriptors to the namespace, as children of the
+                 * buffer node.
+                 */
+                if (ACPI_SUCCESS (AcpiDmIsResourceTemplate (NULL, Op)))
+                {
+                    Op->Common.DisasmOpcode = ACPI_DASM_RESOURCE;
+                    AcpiDmAddResourcesToNamespace (Parent->Common.Node, Op);
+                }
+            }
+        }
+
+        Op = AcpiPsGetDepthNext (Root, Op);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmAddResourcesToNamespace
+ *
+ * PARAMETERS:  BufferNode          - Node for the parent buffer
+ *              Op                  - Parse op for the buffer
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add an entire resource template to the namespace. Each
+ *              resource descriptor is added as a namespace node.
+ *
+ ******************************************************************************/
+
+static void
+AcpiDmAddResourcesToNamespace (
+    ACPI_NAMESPACE_NODE     *BufferNode,
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *NextOp;
+
+
+    /* Get to the ByteData list */
+
+    NextOp = Op->Common.Value.Arg;
+    NextOp = NextOp->Common.Next;
+    if (!NextOp)
+    {
+        return;
+    }
+
+    /* Set Node and Op to point to each other */
+
+    BufferNode->Op = Op;
+    Op->Common.Node = BufferNode;
+
+    /*
+     * Insert each resource into the namespace
+     * NextOp contains the Aml pointer and the Aml length
+     */
+    AcpiUtWalkAmlResources (NULL, (UINT8 *) NextOp->Named.Data,
+        (ACPI_SIZE) NextOp->Common.Value.Integer,
+        AcpiDmAddResourceToNamespace, (void **) BufferNode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmAddResourceToNamespace
+ *
+ * PARAMETERS:  ACPI_WALK_AML_CALLBACK
+ *              BufferNode              - Node for the parent buffer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Add one resource descriptor to the namespace as a child of the
+ *              parent buffer. The same name is used for each descriptor. This
+ *              is changed later to a unique name if the resource is actually
+ *              referenced by an AML operator.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AcpiDmAddResourceToNamespace (
+    UINT8                   *Aml,
+    UINT32                  Length,
+    UINT32                  Offset,
+    UINT8                   ResourceIndex,
+    void                    **Context)
+{
+    ACPI_STATUS             Status;
+    ACPI_GENERIC_STATE      ScopeInfo;
+    ACPI_NAMESPACE_NODE     *Node;
+
+
+    /* TBD: Don't need to add descriptors that have no tags defined? */
+
+    /* Add the resource to the namespace, as child of the buffer */
+
+    ScopeInfo.Scope.Node = ACPI_CAST_PTR (ACPI_NAMESPACE_NODE, Context);
+    Status = AcpiNsLookup (&ScopeInfo, "_TMP", ACPI_TYPE_LOCAL_RESOURCE,
+        ACPI_IMODE_LOAD_PASS2,
+        ACPI_NS_NO_UPSEARCH | ACPI_NS_DONT_OPEN_SCOPE | ACPI_NS_PREFIX_IS_SCOPE,
+        NULL, &Node);
+    if (ACPI_FAILURE (Status))
+    {
+        return (AE_OK);
+    }
+
+    /* Set the name to the default, changed later if resource is referenced */
+
+    Node->Name.Integer = ACPI_DEFAULT_RESNAME;
+
+    /* Save the offset of the descriptor (within the original buffer) */
+
+    Node->Value = Offset;
+    Node->Length = Length;
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/common/dmtable.c b/usr/src/cmd/acpi/common/dmtable.c
new file mode 100644
index 0000000000..5ad46e9ff4
--- /dev/null
+++ b/usr/src/cmd/acpi/common/dmtable.c
@@ -0,0 +1,1484 @@
+/******************************************************************************
+ *
+ * Module Name: dmtable - Support for ACPI tables that contain no AML code
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acdisasm.h"
+#include "actables.h"
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+/* This module used for application-level code only */
+
+#define _COMPONENT          ACPI_CA_DISASSEMBLER
+        ACPI_MODULE_NAME    ("dmtable")
+
+const AH_TABLE *
+AcpiAhGetTableInfo (
+    char                    *Signature);
+
+
+/* Common format strings for commented values */
+
+#define UINT8_FORMAT        "%2.2X [%s]\n"
+#define UINT16_FORMAT       "%4.4X [%s]\n"
+#define UINT32_FORMAT       "%8.8X [%s]\n"
+#define STRING_FORMAT       "[%s]\n"
+
+/* These tables map a subtable type to a description string */
+
+static const char           *AcpiDmAsfSubnames[] =
+{
+    "ASF Information",
+    "ASF Alerts",
+    "ASF Remote Control",
+    "ASF RMCP Boot Options",
+    "ASF Address",
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+static const char           *AcpiDmDmarSubnames[] =
+{
+    "Hardware Unit Definition",
+    "Reserved Memory Region",
+    "Root Port ATS Capability",
+    "Remapping Hardware Static Affinity",
+    "ACPI Namespace Device Declaration",
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+static const char           *AcpiDmDmarScope[] =
+{
+    "Reserved value",
+    "PCI Endpoint Device",
+    "PCI Bridge Device",
+    "IOAPIC Device",
+    "Message-capable HPET Device",
+    "Namespace Device",
+    "Unknown Scope Type"            /* Reserved */
+};
+
+static const char           *AcpiDmEinjActions[] =
+{
+    "Begin Operation",
+    "Get Trigger Table",
+    "Set Error Type",
+    "Get Error Type",
+    "End Operation",
+    "Execute Operation",
+    "Check Busy Status",
+    "Get Command Status",
+    "Set Error Type With Address",
+    "Get Execute Timings",
+    "Unknown Action"
+};
+
+static const char           *AcpiDmEinjInstructions[] =
+{
+    "Read Register",
+    "Read Register Value",
+    "Write Register",
+    "Write Register Value",
+    "Noop",
+    "Flush Cacheline",
+    "Unknown Instruction"
+};
+
+static const char           *AcpiDmErstActions[] =
+{
+    "Begin Write Operation",
+    "Begin Read Operation",
+    "Begin Clear Operation",
+    "End Operation",
+    "Set Record Offset",
+    "Execute Operation",
+    "Check Busy Status",
+    "Get Command Status",
+    "Get Record Identifier",
+    "Set Record Identifier",
+    "Get Record Count",
+    "Begin Dummy Write",
+    "Unused/Unknown Action",
+    "Get Error Address Range",
+    "Get Error Address Length",
+    "Get Error Attributes",
+    "Execute Timings",
+    "Unknown Action"
+};
+
+static const char           *AcpiDmErstInstructions[] =
+{
+    "Read Register",
+    "Read Register Value",
+    "Write Register",
+    "Write Register Value",
+    "Noop",
+    "Load Var1",
+    "Load Var2",
+    "Store Var1",
+    "Add",
+    "Subtract",
+    "Add Value",
+    "Subtract Value",
+    "Stall",
+    "Stall While True",
+    "Skip Next If True",
+    "GoTo",
+    "Set Source Address",
+    "Set Destination Address",
+    "Move Data",
+    "Unknown Instruction"
+};
+
+static const char           *AcpiDmGtdtSubnames[] =
+{
+    "Generic Timer Block",
+    "Generic Watchdog Timer",
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+static const char           *AcpiDmHestSubnames[] =
+{
+    "IA-32 Machine Check Exception",
+    "IA-32 Corrected Machine Check",
+    "IA-32 Non-Maskable Interrupt",
+    "Unknown SubTable Type",        /* 3 - Reserved */
+    "Unknown SubTable Type",        /* 4 - Reserved */
+    "Unknown SubTable Type",        /* 5 - Reserved */
+    "PCI Express Root Port AER",
+    "PCI Express AER (AER Endpoint)",
+    "PCI Express/PCI-X Bridge AER",
+    "Generic Hardware Error Source",
+    "Generic Hardware Error Source V2",
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+static const char           *AcpiDmHestNotifySubnames[] =
+{
+    "Polled",
+    "External Interrupt",
+    "Local Interrupt",
+    "SCI",
+    "NMI",
+    "CMCI",                         /* ACPI 5.0 */
+    "MCE",                          /* ACPI 5.0 */
+    "GPIO",                         /* ACPI 6.0 */
+    "SEA",                          /* ACPI 6.1 */
+    "SEI",                          /* ACPI 6.1 */
+    "GSIV",                         /* ACPI 6.1 */
+    "Unknown Notify Type"           /* Reserved */
+};
+
+static const char           *AcpiDmMadtSubnames[] =
+{
+    "Processor Local APIC",             /* ACPI_MADT_TYPE_LOCAL_APIC */
+    "I/O APIC",                         /* ACPI_MADT_TYPE_IO_APIC */
+    "Interrupt Source Override",        /* ACPI_MADT_TYPE_INTERRUPT_OVERRIDE */
+    "NMI Source",                       /* ACPI_MADT_TYPE_NMI_SOURCE */
+    "Local APIC NMI",                   /* ACPI_MADT_TYPE_LOCAL_APIC_NMI */
+    "Local APIC Address Override",      /* ACPI_MADT_TYPE_LOCAL_APIC_OVERRIDE */
+    "I/O SAPIC",                        /* ACPI_MADT_TYPE_IO_SAPIC */
+    "Local SAPIC",                      /* ACPI_MADT_TYPE_LOCAL_SAPIC */
+    "Platform Interrupt Sources",       /* ACPI_MADT_TYPE_INTERRUPT_SOURCE */
+    "Processor Local x2APIC",           /* ACPI_MADT_TYPE_LOCAL_X2APIC */
+    "Local x2APIC NMI",                 /* ACPI_MADT_TYPE_LOCAL_X2APIC_NMI */
+    "Generic Interrupt Controller",     /* ACPI_MADT_GENERIC_INTERRUPT */
+    "Generic Interrupt Distributor",    /* ACPI_MADT_GENERIC_DISTRIBUTOR */
+    "Generic MSI Frame",                /* ACPI_MADT_GENERIC_MSI_FRAME */
+    "Generic Interrupt Redistributor",  /* ACPI_MADT_GENERIC_REDISTRIBUTOR */
+    "Generic Interrupt Translator",     /* ACPI_MADT_GENERIC_TRANSLATOR */
+    "Unknown Subtable Type"             /* Reserved */
+};
+
+static const char           *AcpiDmNfitSubnames[] =
+{
+    "System Physical Address Range",    /* ACPI_NFIT_TYPE_SYSTEM_ADDRESS */
+    "Memory Range Map",                 /* ACPI_NFIT_TYPE_MEMORY_MAP */
+    "Interleave Info",                  /* ACPI_NFIT_TYPE_INTERLEAVE */
+    "SMBIOS Information",               /* ACPI_NFIT_TYPE_SMBIOS */
+    "NVDIMM Control Region",            /* ACPI_NFIT_TYPE_CONTROL_REGION */
+    "NVDIMM Block Data Window Region",  /* ACPI_NFIT_TYPE_DATA_REGION */
+    "Flush Hint Address",               /* ACPI_NFIT_TYPE_FLUSH_ADDRESS */
+    "Unknown Subtable Type"             /* Reserved */
+};
+
+static const char           *AcpiDmPcctSubnames[] =
+{
+    "Generic Communications Subspace",  /* ACPI_PCCT_TYPE_GENERIC_SUBSPACE */
+    "HW-Reduced Comm Subspace",         /* ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE */
+    "HW-Reduced Comm Subspace Type2",   /* ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE_TYPE2 */
+    "Unknown Subtable Type"             /* Reserved */
+};
+
+static const char           *AcpiDmPmttSubnames[] =
+{
+    "Socket",                       /* ACPI_PMTT_TYPE_SOCKET */
+    "Memory Controller",            /* ACPI_PMTT_TYPE_CONTROLLER */
+    "Physical Component (DIMM)",    /* ACPI_PMTT_TYPE_DIMM  */
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+static const char           *AcpiDmSratSubnames[] =
+{
+    "Processor Local APIC/SAPIC Affinity",
+    "Memory Affinity",
+    "Processor Local x2APIC Affinity",
+    "GICC Affinity",
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+static const char           *AcpiDmIvrsSubnames[] =
+{
+    "Hardware Definition Block",
+    "Memory Definition Block",
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+static const char           *AcpiDmLpitSubnames[] =
+{
+    "Native C-state Idle Structure",
+    "Unknown Subtable Type"         /* Reserved */
+};
+
+#define ACPI_FADT_PM_RESERVED       9
+
+static const char           *AcpiDmFadtProfiles[] =
+{
+    "Unspecified",
+    "Desktop",
+    "Mobile",
+    "Workstation",
+    "Enterprise Server",
+    "SOHO Server",
+    "Appliance PC",
+    "Performance Server",
+    "Tablet",
+    "Unknown Profile Type"
+};
+
+#define ACPI_GAS_WIDTH_RESERVED     5
+
+static const char           *AcpiDmGasAccessWidth[] =
+{
+    "Undefined/Legacy",
+    "Byte Access:8",
+    "Word Access:16",
+    "DWord Access:32",
+    "QWord Access:64",
+    "Unknown Width Encoding"
+};
+
+
+/*******************************************************************************
+ *
+ * ACPI Table Data, indexed by signature.
+ *
+ * Each entry contains: Signature, Table Info, Handler, DtHandler,
+ *  Template, Description
+ *
+ * Simple tables have only a TableInfo structure, complex tables have a
+ * handler. This table must be NULL terminated. RSDP and FACS are
+ * special-cased elsewhere.
+ *
+ * Note: Any tables added here should be duplicated within AcpiSupportedTables
+ * in the file common/ahtable.c
+ *
+ ******************************************************************************/
+
+const ACPI_DMTABLE_DATA     AcpiDmTableData[] =
+{
+    {ACPI_SIG_ASF,  NULL,                   AcpiDmDumpAsf,  DtCompileAsf,   TemplateAsf},
+    {ACPI_SIG_BERT, AcpiDmTableInfoBert,    NULL,           NULL,           TemplateBert},
+    {ACPI_SIG_BGRT, AcpiDmTableInfoBgrt,    NULL,           NULL,           TemplateBgrt},
+    {ACPI_SIG_BOOT, AcpiDmTableInfoBoot,    NULL,           NULL,           TemplateBoot},
+    {ACPI_SIG_CPEP, NULL,                   AcpiDmDumpCpep, DtCompileCpep,  TemplateCpep},
+    {ACPI_SIG_CSRT, NULL,                   AcpiDmDumpCsrt, DtCompileCsrt,  TemplateCsrt},
+    {ACPI_SIG_DBG2, AcpiDmTableInfoDbg2,    AcpiDmDumpDbg2, DtCompileDbg2,  TemplateDbg2},
+    {ACPI_SIG_DBGP, AcpiDmTableInfoDbgp,    NULL,           NULL,           TemplateDbgp},
+    {ACPI_SIG_DMAR, NULL,                   AcpiDmDumpDmar, DtCompileDmar,  TemplateDmar},
+    {ACPI_SIG_DRTM, NULL,                   AcpiDmDumpDrtm, DtCompileDrtm,  TemplateDrtm},
+    {ACPI_SIG_ECDT, AcpiDmTableInfoEcdt,    NULL,           NULL,           TemplateEcdt},
+    {ACPI_SIG_EINJ, NULL,                   AcpiDmDumpEinj, DtCompileEinj,  TemplateEinj},
+    {ACPI_SIG_ERST, NULL,                   AcpiDmDumpErst, DtCompileErst,  TemplateErst},
+    {ACPI_SIG_FADT, NULL,                   AcpiDmDumpFadt, DtCompileFadt,  TemplateFadt},
+    {ACPI_SIG_FPDT, NULL,                   AcpiDmDumpFpdt, DtCompileFpdt,  TemplateFpdt},
+    {ACPI_SIG_GTDT, NULL,                   AcpiDmDumpGtdt, DtCompileGtdt,  TemplateGtdt},
+    {ACPI_SIG_HEST, NULL,                   AcpiDmDumpHest, DtCompileHest,  TemplateHest},
+    {ACPI_SIG_HPET, AcpiDmTableInfoHpet,    NULL,           NULL,           TemplateHpet},
+    {ACPI_SIG_IORT, NULL,                   AcpiDmDumpIort, DtCompileIort,  TemplateIort},
+    {ACPI_SIG_IVRS, NULL,                   AcpiDmDumpIvrs, DtCompileIvrs,  TemplateIvrs},
+    {ACPI_SIG_LPIT, NULL,                   AcpiDmDumpLpit, DtCompileLpit,  TemplateLpit},
+    {ACPI_SIG_MADT, NULL,                   AcpiDmDumpMadt, DtCompileMadt,  TemplateMadt},
+    {ACPI_SIG_MCFG, NULL,                   AcpiDmDumpMcfg, DtCompileMcfg,  TemplateMcfg},
+    {ACPI_SIG_MCHI, AcpiDmTableInfoMchi,    NULL,           NULL,           TemplateMchi},
+    {ACPI_SIG_MPST, AcpiDmTableInfoMpst,    AcpiDmDumpMpst, DtCompileMpst,  TemplateMpst},
+    {ACPI_SIG_MSCT, NULL,                   AcpiDmDumpMsct, DtCompileMsct,  TemplateMsct},
+    {ACPI_SIG_MSDM, NULL,                   AcpiDmDumpSlic, DtCompileSlic,  TemplateMsdm},
+    {ACPI_SIG_MTMR, NULL,                   AcpiDmDumpMtmr, DtCompileMtmr,  TemplateMtmr},
+    {ACPI_SIG_NFIT, AcpiDmTableInfoNfit,    AcpiDmDumpNfit, DtCompileNfit,  TemplateNfit},
+    {ACPI_SIG_PCCT, AcpiDmTableInfoPcct,    AcpiDmDumpPcct, DtCompilePcct,  TemplatePcct},
+    {ACPI_SIG_PMTT, NULL,                   AcpiDmDumpPmtt, DtCompilePmtt,  TemplatePmtt},
+    {ACPI_SIG_RSDT, NULL,                   AcpiDmDumpRsdt, DtCompileRsdt,  TemplateRsdt},
+    {ACPI_SIG_S3PT, NULL,                   NULL,           NULL,           TemplateS3pt},
+    {ACPI_SIG_SBST, AcpiDmTableInfoSbst,    NULL,           NULL,           TemplateSbst},
+    {ACPI_SIG_SLIC, NULL,                   AcpiDmDumpSlic, DtCompileSlic,  TemplateSlic},
+    {ACPI_SIG_SLIT, NULL,                   AcpiDmDumpSlit, DtCompileSlit,  TemplateSlit},
+    {ACPI_SIG_SPCR, AcpiDmTableInfoSpcr,    NULL,           NULL,           TemplateSpcr},
+    {ACPI_SIG_SPMI, AcpiDmTableInfoSpmi,    NULL,           NULL,           TemplateSpmi},
+    {ACPI_SIG_SRAT, NULL,                   AcpiDmDumpSrat, DtCompileSrat,  TemplateSrat},
+    {ACPI_SIG_STAO, NULL,                   AcpiDmDumpStao, DtCompileStao,  TemplateStao},
+    {ACPI_SIG_TCPA, NULL,                   AcpiDmDumpTcpa, DtCompileTcpa,  TemplateTcpa},
+    {ACPI_SIG_TPM2, AcpiDmTableInfoTpm2,    NULL,           NULL,           TemplateTpm2},
+    {ACPI_SIG_UEFI, AcpiDmTableInfoUefi,    NULL,           DtCompileUefi,  TemplateUefi},
+    {ACPI_SIG_VRTC, AcpiDmTableInfoVrtc,    AcpiDmDumpVrtc, DtCompileVrtc,  TemplateVrtc},
+    {ACPI_SIG_WAET, AcpiDmTableInfoWaet,    NULL,           NULL,           TemplateWaet},
+    {ACPI_SIG_WDAT, NULL,                   AcpiDmDumpWdat, DtCompileWdat,  TemplateWdat},
+    {ACPI_SIG_WDDT, AcpiDmTableInfoWddt,    NULL,           NULL,           TemplateWddt},
+    {ACPI_SIG_WDRT, AcpiDmTableInfoWdrt,    NULL,           NULL,           TemplateWdrt},
+    {ACPI_SIG_WPBT, NULL,                   AcpiDmDumpWpbt, DtCompileWpbt,  TemplateWpbt},
+    {ACPI_SIG_XENV, AcpiDmTableInfoXenv,    NULL,           NULL,           TemplateXenv},
+    {ACPI_SIG_XSDT, NULL,                   AcpiDmDumpXsdt, DtCompileXsdt,  TemplateXsdt},
+    {NULL,          NULL,                   NULL,           NULL,           NULL}
+};
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmGenerateChecksum
+ *
+ * PARAMETERS:  Table               - Pointer to table to be checksummed
+ *              Length              - Length of the table
+ *              OriginalChecksum    - Value of the checksum field
+ *
+ * RETURN:      8 bit checksum of buffer
+ *
+ * DESCRIPTION: Computes an 8 bit checksum of the table.
+ *
+ ******************************************************************************/
+
+UINT8
+AcpiDmGenerateChecksum (
+    void                    *Table,
+    UINT32                  Length,
+    UINT8                   OriginalChecksum)
+{
+    UINT8                   Checksum;
+
+
+    /* Sum the entire table as-is */
+
+    Checksum = AcpiTbChecksum ((UINT8 *) Table, Length);
+
+    /* Subtract off the existing checksum value in the table */
+
+    Checksum = (UINT8) (Checksum - OriginalChecksum);
+
+    /* Compute the final checksum */
+
+    Checksum = (UINT8) (0 - Checksum);
+    return (Checksum);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmGetTableData
+ *
+ * PARAMETERS:  Signature           - ACPI signature (4 chars) to match
+ *
+ * RETURN:      Pointer to a valid ACPI_DMTABLE_DATA. Null if no match found.
+ *
+ * DESCRIPTION: Find a match in the global table of supported ACPI tables
+ *
+ ******************************************************************************/
+
+const ACPI_DMTABLE_DATA *
+AcpiDmGetTableData (
+    char                    *Signature)
+{
+    const ACPI_DMTABLE_DATA *Info;
+
+
+    for (Info = AcpiDmTableData; Info->Signature; Info++)
+    {
+        if (ACPI_COMPARE_NAME (Signature, Info->Signature))
+        {
+            return (Info);
+        }
+    }
+
+    return (NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpDataTable
+ *
+ * PARAMETERS:  Table               - An ACPI table
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Format the contents of an ACPI data table (any table other
+ *              than an SSDT or DSDT that does not contain executable AML code)
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpDataTable (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    const ACPI_DMTABLE_DATA *TableData;
+    UINT32                  Length;
+
+
+    /* Ignore tables that contain AML */
+
+    if (AcpiUtIsAmlTable (Table))
+    {
+        if (Gbl_VerboseTemplates)
+        {
+            /* Dump the raw table data */
+
+            Length = Table->Length;
+
+            AcpiOsPrintf ("\n/*\n%s: Length %d (0x%X)\n\n",
+                ACPI_RAW_TABLE_DATA_HEADER, Length, Length);
+            AcpiUtDumpBuffer (ACPI_CAST_PTR (UINT8, Table),
+                Length, DB_BYTE_DISPLAY, 0);
+            AcpiOsPrintf (" */\n");
+        }
+        return;
+    }
+
+    /*
+     * Handle tables that don't use the common ACPI table header structure.
+     * Currently, these are the FACS, RSDP, and S3PT.
+     */
+    if (ACPI_COMPARE_NAME (Table->Signature, ACPI_SIG_FACS))
+    {
+        Length = Table->Length;
+        Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoFacs);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+    }
+    else if (ACPI_VALIDATE_RSDP_SIG (Table->Signature))
+    {
+        Length = AcpiDmDumpRsdp (Table);
+    }
+    else if (ACPI_COMPARE_NAME (Table->Signature, ACPI_SIG_S3PT))
+    {
+        Length = AcpiDmDumpS3pt (Table);
+    }
+    else
+    {
+        /*
+         * All other tables must use the common ACPI table header, dump it now
+         */
+        Length = Table->Length;
+        Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoHeader);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+        AcpiOsPrintf ("\n");
+
+        /* Match signature and dispatch appropriately */
+
+        TableData = AcpiDmGetTableData (Table->Signature);
+        if (!TableData)
+        {
+            if (!strncmp (Table->Signature, "OEM", 3))
+            {
+                AcpiOsPrintf ("\n**** OEM-defined ACPI table [%4.4s], unknown contents\n\n",
+                    Table->Signature);
+            }
+            else
+            {
+                AcpiOsPrintf ("\n**** Unknown ACPI table signature [%4.4s]\n\n",
+                    Table->Signature);
+
+                fprintf (stderr, "Unknown ACPI table signature [%4.4s], ",
+                    Table->Signature);
+
+                if (!AcpiGbl_ForceAmlDisassembly)
+                {
+                    fprintf (stderr, "decoding ACPI table header only\n");
+                }
+                else
+                {
+                    fprintf (stderr, "assuming table contains valid AML code\n");
+                }
+            }
+        }
+        else if (TableData->TableHandler)
+        {
+            /* Complex table, has a handler */
+
+            TableData->TableHandler (Table);
+        }
+        else if (TableData->TableInfo)
+        {
+            /* Simple table, just walk the info table */
+
+            Status = AcpiDmDumpTable (Length, 0, Table, 0, TableData->TableInfo);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+        }
+    }
+
+    if (!Gbl_DoTemplates || Gbl_VerboseTemplates)
+    {
+        /* Dump the raw table data */
+
+        AcpiOsPrintf ("\n%s: Length %d (0x%X)\n\n",
+            ACPI_RAW_TABLE_DATA_HEADER, Length, Length);
+        AcpiUtDumpBuffer (ACPI_CAST_PTR (UINT8, Table),
+            Length, DB_BYTE_DISPLAY, 0);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmLineHeader
+ *
+ * PARAMETERS:  Offset              - Current byte offset, from table start
+ *              ByteLength          - Length of the field in bytes, 0 for flags
+ *              Name                - Name of this field
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Utility routines for formatting output lines. Displays the
+ *              current table offset in hex and decimal, the field length,
+ *              and the field name.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmLineHeader (
+    UINT32                  Offset,
+    UINT32                  ByteLength,
+    char                    *Name)
+{
+
+    /* Allow a null name for fields that span multiple lines (large buffers) */
+
+    if (!Name)
+    {
+        Name = "";
+    }
+
+    if (Gbl_DoTemplates && !Gbl_VerboseTemplates) /* Terse template */
+    {
+        if (ByteLength)
+        {
+            AcpiOsPrintf ("[%.4d] %34s : ", ByteLength, Name);
+        }
+        else
+        {
+            if (*Name)
+            {
+                AcpiOsPrintf ("%41s : ", Name);
+            }
+            else
+            {
+                AcpiOsPrintf ("%41s   ", Name);
+            }
+        }
+    }
+    else /* Normal disassembler or verbose template */
+    {
+        if (ByteLength)
+        {
+            AcpiOsPrintf ("[%3.3Xh %4.4d% 4d] %28s : ",
+                Offset, Offset, ByteLength, Name);
+        }
+        else
+        {
+            if (*Name)
+            {
+                AcpiOsPrintf ("%44s : ", Name);
+            }
+            else
+            {
+                AcpiOsPrintf ("%44s   ", Name);
+            }
+        }
+    }
+}
+
+void
+AcpiDmLineHeader2 (
+    UINT32                  Offset,
+    UINT32                  ByteLength,
+    char                    *Name,
+    UINT32                  Value)
+{
+
+    if (Gbl_DoTemplates && !Gbl_VerboseTemplates) /* Terse template */
+    {
+        if (ByteLength)
+        {
+            AcpiOsPrintf ("[%.4d] %30s %3d : ",
+                ByteLength, Name, Value);
+        }
+        else
+        {
+            AcpiOsPrintf ("%36s % 3d : ",
+                Name, Value);
+        }
+    }
+    else /* Normal disassembler or verbose template */
+    {
+        if (ByteLength)
+        {
+            AcpiOsPrintf ("[%3.3Xh %4.4d %3d] %24s %3d : ",
+                Offset, Offset, ByteLength, Name, Value);
+        }
+        else
+        {
+            AcpiOsPrintf ("[%3.3Xh %4.4d   ] %24s %3d : ",
+                Offset, Offset, Name, Value);
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpTable
+ *
+ * PARAMETERS:  TableLength         - Length of the entire ACPI table
+ *              TableOffset         - Starting offset within the table for this
+ *                                    sub-descriptor (0 if main table)
+ *              Table               - The ACPI table
+ *              SubtableLength      - Length of this sub-descriptor
+ *              Info                - Info table for this ACPI table
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Display ACPI table contents by walking the Info table.
+ *
+ * Note: This function must remain in sync with DtGetFieldLength.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AcpiDmDumpTable (
+    UINT32                  TableLength,
+    UINT32                  TableOffset,
+    void                    *Table,
+    UINT32                  SubtableLength,
+    ACPI_DMTABLE_INFO       *Info)
+{
+    UINT8                   *Target;
+    UINT32                  CurrentOffset;
+    UINT32                  ByteLength;
+    UINT8                   Temp8;
+    UINT16                  Temp16;
+    UINT32                  Temp32;
+    UINT64                  Value;
+    const AH_TABLE          *TableData;
+    const char              *Name;
+    BOOLEAN                 LastOutputBlankLine = FALSE;
+    ACPI_STATUS             Status;
+    char                    RepairedName[8];
+
+
+    if (!Info)
+    {
+        AcpiOsPrintf ("Display not implemented\n");
+        return (AE_NOT_IMPLEMENTED);
+    }
+
+    /* Walk entire Info table; Null name terminates */
+
+    for (; Info->Name; Info++)
+    {
+        /*
+         * Target points to the field within the ACPI Table. CurrentOffset is
+         * the offset of the field from the start of the main table.
+         */
+        Target = ACPI_ADD_PTR (UINT8, Table, Info->Offset);
+        CurrentOffset = TableOffset + Info->Offset;
+
+        /* Check for beyond subtable end or (worse) beyond EOT */
+
+        if (SubtableLength && (Info->Offset >= SubtableLength))
+        {
+            AcpiOsPrintf (
+                "/**** ACPI subtable terminates early - "
+                "may be older version (dump table) */\n");
+
+            /* Move on to next subtable */
+
+            return (AE_OK);
+        }
+
+        if (CurrentOffset >= TableLength)
+        {
+            AcpiOsPrintf (
+                "/**** ACPI table terminates "
+                "in the middle of a data structure! (dump table) */\n");
+            return (AE_BAD_DATA);
+        }
+
+        /* Generate the byte length for this field */
+
+        switch (Info->Opcode)
+        {
+        case ACPI_DMT_UINT8:
+        case ACPI_DMT_CHKSUM:
+        case ACPI_DMT_SPACEID:
+        case ACPI_DMT_ACCWIDTH:
+        case ACPI_DMT_IVRS:
+        case ACPI_DMT_GTDT:
+        case ACPI_DMT_MADT:
+        case ACPI_DMT_PCCT:
+        case ACPI_DMT_PMTT:
+        case ACPI_DMT_SRAT:
+        case ACPI_DMT_ASF:
+        case ACPI_DMT_HESTNTYP:
+        case ACPI_DMT_FADTPM:
+        case ACPI_DMT_EINJACT:
+        case ACPI_DMT_EINJINST:
+        case ACPI_DMT_ERSTACT:
+        case ACPI_DMT_ERSTINST:
+        case ACPI_DMT_DMAR_SCOPE:
+
+            ByteLength = 1;
+            break;
+
+        case ACPI_DMT_UINT16:
+        case ACPI_DMT_DMAR:
+        case ACPI_DMT_HEST:
+        case ACPI_DMT_NFIT:
+
+            ByteLength = 2;
+            break;
+
+        case ACPI_DMT_UINT24:
+
+            ByteLength = 3;
+            break;
+
+        case ACPI_DMT_UINT32:
+        case ACPI_DMT_NAME4:
+        case ACPI_DMT_SIG:
+        case ACPI_DMT_LPIT:
+
+            ByteLength = 4;
+            break;
+
+        case ACPI_DMT_UINT40:
+
+            ByteLength = 5;
+            break;
+
+        case ACPI_DMT_UINT48:
+        case ACPI_DMT_NAME6:
+
+            ByteLength = 6;
+            break;
+
+        case ACPI_DMT_UINT56:
+        case ACPI_DMT_BUF7:
+
+            ByteLength = 7;
+            break;
+
+        case ACPI_DMT_UINT64:
+        case ACPI_DMT_NAME8:
+
+            ByteLength = 8;
+            break;
+
+        case ACPI_DMT_BUF10:
+
+            ByteLength = 10;
+            break;
+
+        case ACPI_DMT_BUF16:
+        case ACPI_DMT_UUID:
+
+            ByteLength = 16;
+            break;
+
+        case ACPI_DMT_BUF128:
+
+            ByteLength = 128;
+            break;
+
+        case ACPI_DMT_UNICODE:
+        case ACPI_DMT_BUFFER:
+        case ACPI_DMT_RAW_BUFFER:
+
+            ByteLength = SubtableLength;
+            break;
+
+        case ACPI_DMT_STRING:
+
+            ByteLength = strlen (ACPI_CAST_PTR (char, Target)) + 1;
+            break;
+
+        case ACPI_DMT_GAS:
+
+            if (!LastOutputBlankLine)
+            {
+                AcpiOsPrintf ("\n");
+                LastOutputBlankLine = TRUE;
+            }
+
+            ByteLength = sizeof (ACPI_GENERIC_ADDRESS);
+            break;
+
+        case ACPI_DMT_HESTNTFY:
+
+            if (!LastOutputBlankLine)
+            {
+                AcpiOsPrintf ("\n");
+                LastOutputBlankLine = TRUE;
+            }
+
+            ByteLength = sizeof (ACPI_HEST_NOTIFY);
+            break;
+
+        case ACPI_DMT_IORTMEM:
+
+            if (!LastOutputBlankLine)
+            {
+                LastOutputBlankLine = FALSE;
+            }
+
+            ByteLength = sizeof (ACPI_IORT_MEMORY_ACCESS);
+            break;
+
+        default:
+
+            ByteLength = 0;
+            break;
+        }
+
+        /* Check if we are beyond a subtable, or (worse) beyond EOT */
+
+        if (CurrentOffset + ByteLength > TableLength)
+        {
+            if (SubtableLength)
+            {
+                AcpiOsPrintf (
+                    "/**** ACPI subtable terminates early - "
+                    "may be older version (dump table) */\n");
+
+                /* Move on to next subtable */
+
+                return (AE_OK);
+            }
+
+            AcpiOsPrintf (
+                "/**** ACPI table terminates "
+                "in the middle of a data structure! */\n");
+            return (AE_BAD_DATA);
+        }
+
+        if (Info->Opcode == ACPI_DMT_EXTRA_TEXT)
+        {
+            AcpiOsPrintf ("%s", Info->Name);
+            continue;
+        }
+
+        /* Start a new line and decode the opcode */
+
+        AcpiDmLineHeader (CurrentOffset, ByteLength, Info->Name);
+
+        switch (Info->Opcode)
+        {
+        /* Single-bit Flag fields. Note: Opcode is the bit position */
+
+        case ACPI_DMT_FLAG0:
+        case ACPI_DMT_FLAG1:
+        case ACPI_DMT_FLAG2:
+        case ACPI_DMT_FLAG3:
+        case ACPI_DMT_FLAG4:
+        case ACPI_DMT_FLAG5:
+        case ACPI_DMT_FLAG6:
+        case ACPI_DMT_FLAG7:
+
+            AcpiOsPrintf ("%1.1X\n", (*Target >> Info->Opcode) & 0x01);
+            break;
+
+        /* 2-bit Flag fields */
+
+        case ACPI_DMT_FLAGS0:
+
+            AcpiOsPrintf ("%1.1X\n", *Target & 0x03);
+            break;
+
+        case ACPI_DMT_FLAGS1:
+
+            AcpiOsPrintf ("%1.1X\n", (*Target >> 1) & 0x03);
+            break;
+
+        case ACPI_DMT_FLAGS2:
+
+            AcpiOsPrintf ("%1.1X\n", (*Target >> 2) & 0x03);
+            break;
+
+        case ACPI_DMT_FLAGS4:
+
+            AcpiOsPrintf ("%1.1X\n", (*Target >> 4) & 0x03);
+            break;
+
+        /* Integer Data Types */
+
+        case ACPI_DMT_UINT8:
+        case ACPI_DMT_UINT16:
+        case ACPI_DMT_UINT24:
+        case ACPI_DMT_UINT32:
+        case ACPI_DMT_UINT40:
+        case ACPI_DMT_UINT48:
+        case ACPI_DMT_UINT56:
+        case ACPI_DMT_UINT64:
+            /*
+             * Dump bytes - high byte first, low byte last.
+             * Note: All ACPI tables are little-endian.
+             */
+            Value = 0;
+            for (Temp8 = (UINT8) ByteLength; Temp8 > 0; Temp8--)
+            {
+                AcpiOsPrintf ("%2.2X", Target[Temp8 - 1]);
+                Value |= Target[Temp8 - 1];
+                Value <<= 8;
+            }
+
+            if (!Value && (Info->Flags & DT_DESCRIBES_OPTIONAL))
+            {
+                AcpiOsPrintf (" [Optional field not present]");
+            }
+
+            AcpiOsPrintf ("\n");
+            break;
+
+        case ACPI_DMT_BUF7:
+        case ACPI_DMT_BUF10:
+        case ACPI_DMT_BUF16:
+        case ACPI_DMT_BUF128:
+            /*
+             * Buffer: Size depends on the opcode and was set above.
+             * Each hex byte is separated with a space.
+             * Multiple lines are separated by line continuation char.
+             */
+            for (Temp16 = 0; Temp16 < ByteLength; Temp16++)
+            {
+                AcpiOsPrintf ("%2.2X", Target[Temp16]);
+                if ((UINT32) (Temp16 + 1) < ByteLength)
+                {
+                    if ((Temp16 > 0) && (!((Temp16+1) % 16)))
+                    {
+                        AcpiOsPrintf (" \\\n"); /* Line continuation */
+                        AcpiDmLineHeader (0, 0, NULL);
+                    }
+                    else
+                    {
+                        AcpiOsPrintf (" ");
+                    }
+                }
+            }
+
+            AcpiOsPrintf ("\n");
+            break;
+
+        case ACPI_DMT_UUID:
+
+            /* Convert 16-byte UUID buffer to 36-byte formatted UUID string */
+
+            (void) AuConvertUuidToString ((char *) Target, MsgBuffer);
+
+            AcpiOsPrintf ("%s\n", MsgBuffer);
+            break;
+
+        case ACPI_DMT_STRING:
+
+            AcpiOsPrintf ("\"%s\"\n", ACPI_CAST_PTR (char, Target));
+            break;
+
+        /* Fixed length ASCII name fields */
+
+        case ACPI_DMT_SIG:
+
+            AcpiUtCheckAndRepairAscii (Target, RepairedName, 4);
+            AcpiOsPrintf ("\"%.4s\"    ", RepairedName);
+
+            TableData = AcpiAhGetTableInfo (ACPI_CAST_PTR (char, Target));
+            if (TableData)
+            {
+                AcpiOsPrintf (STRING_FORMAT, TableData->Description);
+            }
+            else
+            {
+                AcpiOsPrintf ("\n");
+            }
+            break;
+
+        case ACPI_DMT_NAME4:
+
+            AcpiUtCheckAndRepairAscii (Target, RepairedName, 4);
+            AcpiOsPrintf ("\"%.4s\"\n", RepairedName);
+            break;
+
+        case ACPI_DMT_NAME6:
+
+            AcpiUtCheckAndRepairAscii (Target, RepairedName, 6);
+            AcpiOsPrintf ("\"%.6s\"\n", RepairedName);
+            break;
+
+        case ACPI_DMT_NAME8:
+
+            AcpiUtCheckAndRepairAscii (Target, RepairedName, 8);
+            AcpiOsPrintf ("\"%.8s\"\n", RepairedName);
+            break;
+
+        /* Special Data Types */
+
+        case ACPI_DMT_CHKSUM:
+
+            /* Checksum, display and validate */
+
+            AcpiOsPrintf ("%2.2X", *Target);
+            Temp8 = AcpiDmGenerateChecksum (Table,
+                ACPI_CAST_PTR (ACPI_TABLE_HEADER, Table)->Length,
+                ACPI_CAST_PTR (ACPI_TABLE_HEADER, Table)->Checksum);
+
+            if (Temp8 != ACPI_CAST_PTR (ACPI_TABLE_HEADER, Table)->Checksum)
+            {
+                AcpiOsPrintf (
+                    "     /* Incorrect checksum, should be %2.2X */", Temp8);
+            }
+
+            AcpiOsPrintf ("\n");
+            break;
+
+        case ACPI_DMT_SPACEID:
+
+            /* Address Space ID */
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target, AcpiUtGetRegionName (*Target));
+            break;
+
+        case ACPI_DMT_ACCWIDTH:
+
+            /* Encoded Access Width */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_GAS_WIDTH_RESERVED)
+            {
+                Temp8 = ACPI_GAS_WIDTH_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target, AcpiDmGasAccessWidth[Temp8]);
+            break;
+
+        case ACPI_DMT_GAS:
+
+            /* Generic Address Structure */
+
+            AcpiOsPrintf (STRING_FORMAT, "Generic Address Structure");
+            Status = AcpiDmDumpTable (TableLength, CurrentOffset, Target,
+                sizeof (ACPI_GENERIC_ADDRESS), AcpiDmTableInfoGas);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            AcpiOsPrintf ("\n");
+            LastOutputBlankLine = TRUE;
+            break;
+
+        case ACPI_DMT_ASF:
+
+            /* ASF subtable types */
+
+            Temp16 = (UINT16) ((*Target) & 0x7F);  /* Top bit can be zero or one */
+            if (Temp16 > ACPI_ASF_TYPE_RESERVED)
+            {
+                Temp16 = ACPI_ASF_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target, AcpiDmAsfSubnames[Temp16]);
+            break;
+
+        case ACPI_DMT_DMAR:
+
+            /* DMAR subtable types */
+
+            Temp16 = ACPI_GET16 (Target);
+            if (Temp16 > ACPI_DMAR_TYPE_RESERVED)
+            {
+                Temp16 = ACPI_DMAR_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT16_FORMAT, ACPI_GET16 (Target),
+                AcpiDmDmarSubnames[Temp16]);
+            break;
+
+        case ACPI_DMT_DMAR_SCOPE:
+
+            /* DMAR device scope types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_DMAR_SCOPE_TYPE_RESERVED)
+            {
+                Temp8 = ACPI_DMAR_SCOPE_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmDmarScope[Temp8]);
+            break;
+
+        case ACPI_DMT_EINJACT:
+
+            /* EINJ Action types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_EINJ_ACTION_RESERVED)
+            {
+                Temp8 = ACPI_EINJ_ACTION_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmEinjActions[Temp8]);
+            break;
+
+        case ACPI_DMT_EINJINST:
+
+            /* EINJ Instruction types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_EINJ_INSTRUCTION_RESERVED)
+            {
+                Temp8 = ACPI_EINJ_INSTRUCTION_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmEinjInstructions[Temp8]);
+            break;
+
+        case ACPI_DMT_ERSTACT:
+
+            /* ERST Action types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_ERST_ACTION_RESERVED)
+            {
+                Temp8 = ACPI_ERST_ACTION_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmErstActions[Temp8]);
+            break;
+
+        case ACPI_DMT_ERSTINST:
+
+            /* ERST Instruction types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_ERST_INSTRUCTION_RESERVED)
+            {
+                Temp8 = ACPI_ERST_INSTRUCTION_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmErstInstructions[Temp8]);
+            break;
+
+        case ACPI_DMT_GTDT:
+
+            /* GTDT subtable types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_GTDT_TYPE_RESERVED)
+            {
+                Temp8 = ACPI_GTDT_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmGtdtSubnames[Temp8]);
+            break;
+
+        case ACPI_DMT_HEST:
+
+            /* HEST subtable types */
+
+            Temp16 = ACPI_GET16 (Target);
+            if (Temp16 > ACPI_HEST_TYPE_RESERVED)
+            {
+                Temp16 = ACPI_HEST_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT16_FORMAT, ACPI_GET16 (Target),
+                AcpiDmHestSubnames[Temp16]);
+            break;
+
+        case ACPI_DMT_HESTNTFY:
+
+            AcpiOsPrintf (STRING_FORMAT,
+                "Hardware Error Notification Structure");
+
+            Status = AcpiDmDumpTable (TableLength, CurrentOffset, Target,
+                sizeof (ACPI_HEST_NOTIFY), AcpiDmTableInfoHestNotify);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            AcpiOsPrintf ("\n");
+            LastOutputBlankLine = TRUE;
+            break;
+
+        case ACPI_DMT_HESTNTYP:
+
+            /* HEST Notify types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_HEST_NOTIFY_RESERVED)
+            {
+                Temp8 = ACPI_HEST_NOTIFY_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmHestNotifySubnames[Temp8]);
+            break;
+
+        case ACPI_DMT_IORTMEM:
+
+            AcpiOsPrintf (STRING_FORMAT,
+                "IORT Memory Access Properties");
+
+            Status = AcpiDmDumpTable (TableLength, CurrentOffset, Target,
+                sizeof (ACPI_IORT_MEMORY_ACCESS), AcpiDmTableInfoIortAcc);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            LastOutputBlankLine = TRUE;
+            break;
+
+        case ACPI_DMT_MADT:
+
+            /* MADT subtable types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_MADT_TYPE_RESERVED)
+            {
+                Temp8 = ACPI_MADT_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmMadtSubnames[Temp8]);
+            break;
+
+        case ACPI_DMT_NFIT:
+
+            /* NFIT subtable types */
+
+            Temp16 = ACPI_GET16 (Target);
+            if (Temp16 > ACPI_NFIT_TYPE_RESERVED)
+            {
+                Temp16 = ACPI_NFIT_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT16_FORMAT, ACPI_GET16 (Target),
+                AcpiDmNfitSubnames[Temp16]);
+            break;
+
+        case ACPI_DMT_PCCT:
+
+            /* PCCT subtable types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_PCCT_TYPE_RESERVED)
+            {
+                Temp8 = ACPI_PCCT_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmPcctSubnames[Temp8]);
+            break;
+
+        case ACPI_DMT_PMTT:
+
+            /* PMTT subtable types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_PMTT_TYPE_RESERVED)
+            {
+                Temp8 = ACPI_PMTT_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmPmttSubnames[Temp8]);
+            break;
+
+        case ACPI_DMT_UNICODE:
+
+            if (ByteLength == 0)
+            {
+                AcpiOsPrintf ("/* Zero-length Data */\n");
+                break;
+            }
+
+            AcpiDmDumpUnicode (Table, CurrentOffset, ByteLength);
+            break;
+
+        case ACPI_DMT_RAW_BUFFER:
+
+            if (ByteLength == 0)
+            {
+                AcpiOsPrintf ("/* Zero-length Data */\n");
+                break;
+            }
+
+            AcpiDmDumpBuffer (Table, CurrentOffset, ByteLength,
+                CurrentOffset, NULL);
+            break;
+
+        case ACPI_DMT_SRAT:
+
+            /* SRAT subtable types */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_SRAT_TYPE_RESERVED)
+            {
+                Temp8 = ACPI_SRAT_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmSratSubnames[Temp8]);
+            break;
+
+        case ACPI_DMT_FADTPM:
+
+            /* FADT Preferred PM Profile names */
+
+            Temp8 = *Target;
+            if (Temp8 > ACPI_FADT_PM_RESERVED)
+            {
+                Temp8 = ACPI_FADT_PM_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target,
+                AcpiDmFadtProfiles[Temp8]);
+            break;
+
+        case ACPI_DMT_IVRS:
+
+            /* IVRS subtable types */
+
+            Temp8 = *Target;
+            switch (Temp8)
+            {
+            case ACPI_IVRS_TYPE_HARDWARE:
+
+                Name = AcpiDmIvrsSubnames[0];
+                break;
+
+            case ACPI_IVRS_TYPE_MEMORY1:
+            case ACPI_IVRS_TYPE_MEMORY2:
+            case ACPI_IVRS_TYPE_MEMORY3:
+
+                Name = AcpiDmIvrsSubnames[1];
+                break;
+
+            default:
+
+                Name = AcpiDmIvrsSubnames[2];
+                break;
+            }
+
+            AcpiOsPrintf (UINT8_FORMAT, *Target, Name);
+            break;
+
+        case ACPI_DMT_LPIT:
+
+            /* LPIT subtable types */
+
+            Temp32 = ACPI_GET32 (Target);
+            if (Temp32 > ACPI_LPIT_TYPE_RESERVED)
+            {
+                Temp32 = ACPI_LPIT_TYPE_RESERVED;
+            }
+
+            AcpiOsPrintf (UINT32_FORMAT, ACPI_GET32 (Target),
+                AcpiDmLpitSubnames[Temp32]);
+            break;
+
+        case ACPI_DMT_EXIT:
+
+            return (AE_OK);
+
+        default:
+
+            ACPI_ERROR ((AE_INFO,
+                "**** Invalid table opcode [0x%X] ****\n", Info->Opcode));
+            return (AE_SUPPORT);
+        }
+    }
+
+    if (TableOffset && !SubtableLength)
+    {
+        /*
+         * If this table is not the main table, the subtable must have a
+         * valid length
+         */
+        AcpiOsPrintf ("Invalid zero length subtable\n");
+        return (AE_BAD_DATA);
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/common/dmtables.c b/usr/src/cmd/acpi/common/dmtables.c
new file mode 100644
index 0000000000..85abfe7e7f
--- /dev/null
+++ b/usr/src/cmd/acpi/common/dmtables.c
@@ -0,0 +1,485 @@
+/******************************************************************************
+ *
+ * Module Name: dmtables - disassembler ACPI table support
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acapps.h"
+#include "acdispat.h"
+#include "acnamesp.h"
+#include "actables.h"
+#include "acparser.h"
+
+#include <stdio.h>
+#include <time.h>
+
+#define _COMPONENT          ACPI_TOOLS
+        ACPI_MODULE_NAME    ("dmtables")
+
+
+/* Local prototypes */
+
+static void
+AdCreateTableHeader (
+    char                    *Filename,
+    ACPI_TABLE_HEADER       *Table);
+
+static ACPI_STATUS
+AdStoreTable (
+    ACPI_TABLE_HEADER       *Table,
+    UINT32                  *TableIndex);
+
+
+extern ACPI_TABLE_DESC      LocalTables[1];
+extern ACPI_PARSE_OBJECT    *AcpiGbl_ParseOpRoot;
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdDisassemblerHeader
+ *
+ * PARAMETERS:  Filename            - Input file for the table
+ *              TableType           - Either AML or DataTable
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create the disassembler header, including ACPICA signon with
+ *              current time and date.
+ *
+ *****************************************************************************/
+
+void
+AdDisassemblerHeader (
+    char                    *Filename,
+    UINT8                   TableType)
+{
+    time_t                  Timer;
+
+
+    time (&Timer);
+
+    /* Header and input table info */
+
+    AcpiOsPrintf ("/*\n");
+    AcpiOsPrintf (ACPI_COMMON_HEADER (AML_DISASSEMBLER_NAME, " * "));
+
+    if (TableType == ACPI_IS_AML_TABLE)
+    {
+        if (AcpiGbl_CstyleDisassembly)
+        {
+            AcpiOsPrintf (
+                " * Disassembling to symbolic ASL+ operators\n"
+                " *\n");
+        }
+        else
+        {
+            AcpiOsPrintf (
+                " * Disassembling to non-symbolic legacy ASL operators\n"
+                " *\n");
+        }
+    }
+
+    AcpiOsPrintf (" * Disassembly of %s, %s", Filename, ctime (&Timer));
+    AcpiOsPrintf (" *\n");
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdCreateTableHeader
+ *
+ * PARAMETERS:  Filename            - Input file for the table
+ *              Table               - Pointer to the raw table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create the ASL table header, including ACPICA signon with
+ *              current time and date.
+ *
+ *****************************************************************************/
+
+static void
+AdCreateTableHeader (
+    char                    *Filename,
+    ACPI_TABLE_HEADER       *Table)
+{
+    UINT8                   Checksum;
+
+
+    /* Reset globals for External statements */
+
+    AcpiGbl_NumExternalMethods = 0;
+    AcpiGbl_ResolvedExternalMethods = 0;
+
+    /*
+     * Print file header and dump original table header
+     */
+    AdDisassemblerHeader (Filename, ACPI_IS_AML_TABLE);
+
+    AcpiOsPrintf (" * Original Table Header:\n");
+    AcpiOsPrintf (" *     Signature        \"%4.4s\"\n",    Table->Signature);
+    AcpiOsPrintf (" *     Length           0x%8.8X (%u)\n", Table->Length, Table->Length);
+
+    /* Print and validate the revision */
+
+    AcpiOsPrintf (" *     Revision         0x%2.2X",      Table->Revision);
+
+    switch (Table->Revision)
+    {
+    case 0:
+
+        AcpiOsPrintf (" **** Invalid Revision");
+        break;
+
+    case 1:
+
+        /* Revision of DSDT controls the ACPI integer width */
+
+        if (ACPI_COMPARE_NAME (Table->Signature, ACPI_SIG_DSDT))
+        {
+            AcpiOsPrintf (" **** 32-bit table (V1), no 64-bit math support");
+        }
+        break;
+
+    default:
+
+        break;
+    }
+
+    /* Print and validate the table checksum */
+
+    AcpiOsPrintf ("\n *     Checksum         0x%2.2X",        Table->Checksum);
+
+    Checksum = AcpiTbChecksum (ACPI_CAST_PTR (UINT8, Table), Table->Length);
+    if (Checksum)
+    {
+        AcpiOsPrintf (" **** Incorrect checksum, should be 0x%2.2X",
+            (UINT8) (Table->Checksum - Checksum));
+    }
+
+    AcpiOsPrintf ("\n");
+    AcpiOsPrintf (" *     OEM ID           \"%.6s\"\n",     Table->OemId);
+    AcpiOsPrintf (" *     OEM Table ID     \"%.8s\"\n",     Table->OemTableId);
+    AcpiOsPrintf (" *     OEM Revision     0x%8.8X (%u)\n", Table->OemRevision, Table->OemRevision);
+    AcpiOsPrintf (" *     Compiler ID      \"%.4s\"\n",     Table->AslCompilerId);
+    AcpiOsPrintf (" *     Compiler Version 0x%8.8X (%u)\n", Table->AslCompilerRevision, Table->AslCompilerRevision);
+    AcpiOsPrintf (" */\n");
+
+    /*
+     * Open the ASL definition block.
+     *
+     * Note: the AMLFilename string is left zero-length in order to just let
+     * the compiler create it when the disassembled file is compiled. This
+     * makes it easier to rename the disassembled ASL file if needed.
+     */
+    AcpiOsPrintf (
+        "DefinitionBlock (\"\", \"%4.4s\", %hu, \"%.6s\", \"%.8s\", 0x%8.8X)\n",
+        Table->Signature, Table->Revision,
+        Table->OemId, Table->OemTableId, Table->OemRevision);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdDisplayTables
+ *
+ * PARAMETERS:  Filename            - Input file for the table
+ *              Table               - Pointer to the raw table
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Display (disassemble) loaded tables and dump raw tables
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AdDisplayTables (
+    char                    *Filename,
+    ACPI_TABLE_HEADER       *Table)
+{
+
+
+    if (!AcpiGbl_ParseOpRoot)
+    {
+        return (AE_NOT_EXIST);
+    }
+
+    if (!AcpiGbl_DmOpt_Listing)
+    {
+        AdCreateTableHeader (Filename, Table);
+    }
+
+    AcpiDmDisassemble (NULL, AcpiGbl_ParseOpRoot, ACPI_UINT32_MAX);
+    MpEmitMappingInfo ();
+
+    if (AcpiGbl_DmOpt_Listing)
+    {
+        AcpiOsPrintf ("\n\nTable Header:\n");
+        AcpiUtDebugDumpBuffer ((UINT8 *) Table, sizeof (ACPI_TABLE_HEADER),
+            DB_BYTE_DISPLAY, ACPI_UINT32_MAX);
+
+        AcpiOsPrintf ("Table Body (Length 0x%X)\n", Table->Length);
+        AcpiUtDebugDumpBuffer (((UINT8 *) Table + sizeof (ACPI_TABLE_HEADER)),
+            Table->Length, DB_BYTE_DISPLAY, ACPI_UINT32_MAX);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AdStoreTable
+ *
+ * PARAMETERS:  Table               - Table header
+ *              TableIndex          - Where the table index is returned
+ *
+ * RETURN:      Status and table index.
+ *
+ * DESCRIPTION: Add an ACPI table to the global table list
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AdStoreTable (
+    ACPI_TABLE_HEADER       *Table,
+    UINT32                  *TableIndex)
+{
+    ACPI_STATUS             Status;
+    ACPI_TABLE_DESC         *TableDesc;
+
+
+    Status = AcpiTbGetNextTableDescriptor (TableIndex, &TableDesc);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* Initialize added table */
+
+    AcpiTbInitTableDescriptor (TableDesc, ACPI_PTR_TO_PHYSADDR (Table),
+        ACPI_TABLE_ORIGIN_INTERNAL_VIRTUAL, Table);
+    Status = AcpiTbValidateTable (TableDesc);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdGetLocalTables
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Get the ACPI tables from either memory or a file
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AdGetLocalTables (
+    void)
+{
+    ACPI_STATUS             Status;
+    ACPI_TABLE_HEADER       TableHeader;
+    ACPI_TABLE_HEADER       *NewTable;
+    UINT32                  TableIndex;
+
+
+    /* Get the DSDT via table override */
+
+    ACPI_MOVE_32_TO_32 (TableHeader.Signature, ACPI_SIG_DSDT);
+    AcpiOsTableOverride (&TableHeader, &NewTable);
+    if (!NewTable)
+    {
+        fprintf (stderr, "Could not obtain DSDT\n");
+        return (AE_NO_ACPI_TABLES);
+    }
+
+    AdWriteTable (NewTable, NewTable->Length,
+        ACPI_SIG_DSDT, NewTable->OemTableId);
+
+    /* Store DSDT in the Table Manager */
+
+    Status = AdStoreTable (NewTable, &TableIndex);
+    if (ACPI_FAILURE (Status))
+    {
+        fprintf (stderr, "Could not store DSDT\n");
+        return (AE_NO_ACPI_TABLES);
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AdParseTable
+ *
+ * PARAMETERS:  Table               - Pointer to the raw table
+ *              OwnerId             - Returned OwnerId of the table
+ *              LoadTable           - If add table to the global table list
+ *              External            - If this is an external table
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Parse an ACPI AML table
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AdParseTable (
+    ACPI_TABLE_HEADER       *Table,
+    ACPI_OWNER_ID           *OwnerId,
+    BOOLEAN                 LoadTable,
+    BOOLEAN                 External)
+{
+    ACPI_STATUS             Status = AE_OK;
+    ACPI_WALK_STATE         *WalkState;
+    UINT8                   *AmlStart;
+    UINT32                  AmlLength;
+    UINT32                  TableIndex;
+
+
+    if (!Table)
+    {
+        return (AE_NOT_EXIST);
+    }
+
+    /* Pass 1:  Parse everything except control method bodies */
+
+    fprintf (stderr, "Pass 1 parse of [%4.4s]\n", (char *) Table->Signature);
+
+    AmlLength = Table->Length - sizeof (ACPI_TABLE_HEADER);
+    AmlStart = ((UINT8 *) Table + sizeof (ACPI_TABLE_HEADER));
+
+    /* Create the root object */
+
+    AcpiGbl_ParseOpRoot = AcpiPsCreateScopeOp (AmlStart);
+    if (!AcpiGbl_ParseOpRoot)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    /* Create and initialize a new walk state */
+
+    WalkState = AcpiDsCreateWalkState (0, AcpiGbl_ParseOpRoot, NULL, NULL);
+    if (!WalkState)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    Status = AcpiDsInitAmlWalk (WalkState, AcpiGbl_ParseOpRoot,
+        NULL, AmlStart, AmlLength, NULL, ACPI_IMODE_LOAD_PASS1);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    WalkState->ParseFlags &= ~ACPI_PARSE_DELETE_TREE;
+    WalkState->ParseFlags |= ACPI_PARSE_DISASSEMBLE;
+
+    Status = AcpiPsParseAml (WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* If LoadTable is FALSE, we are parsing the last loaded table */
+
+    TableIndex = AcpiGbl_RootTableList.CurrentTableCount - 1;
+
+    /* Pass 2 */
+
+    if (LoadTable)
+    {
+        Status = AdStoreTable (Table, &TableIndex);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+        Status = AcpiTbAllocateOwnerId (TableIndex);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+        if (OwnerId)
+        {
+            Status = AcpiTbGetOwnerId (TableIndex, OwnerId);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+        }
+    }
+
+    fprintf (stderr, "Pass 2 parse of [%4.4s]\n", (char *) Table->Signature);
+
+    Status = AcpiNsOneCompleteParse (ACPI_IMODE_LOAD_PASS2, TableIndex, NULL);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* No need to parse control methods of external table */
+
+    if (External)
+    {
+        return (AE_OK);
+    }
+
+    /*
+     * Pass 3: Parse control methods and link their parse trees
+     * into the main parse tree
+     */
+    fprintf (stderr,
+        "Parsing Deferred Opcodes (Methods/Buffers/Packages/Regions)\n");
+
+    Status = AcpiDmParseDeferredOps (AcpiGbl_ParseOpRoot);
+    fprintf (stderr, "\n");
+
+    /* Process Resource Templates */
+
+    AcpiDmFindResources (AcpiGbl_ParseOpRoot);
+
+    fprintf (stderr, "Parsing completed\n");
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/common/dmtbdump.c b/usr/src/cmd/acpi/common/dmtbdump.c
new file mode 100644
index 0000000000..789256c12d
--- /dev/null
+++ b/usr/src/cmd/acpi/common/dmtbdump.c
@@ -0,0 +1,3692 @@
+/******************************************************************************
+ *
+ * Module Name: dmtbdump - Dump ACPI data tables that contain no AML code
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acdisasm.h"
+#include "actables.h"
+
+/* This module used for application-level code only */
+
+#define _COMPONENT          ACPI_CA_DISASSEMBLER
+        ACPI_MODULE_NAME    ("dmtbdump")
+
+
+/* Local prototypes */
+
+static void
+AcpiDmValidateFadtLength (
+    UINT32                  Revision,
+    UINT32                  Length);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpBuffer
+ *
+ * PARAMETERS:  Table               - ACPI Table or subtable
+ *              BufferOffset        - Offset of buffer from Table above
+ *              Length              - Length of the buffer
+ *              AbsoluteOffset      - Offset of buffer in the main ACPI table
+ *              Header              - Name of the buffer field (printed on the
+ *                                    first line only.)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of an arbitrary length data buffer (in the
+ *              disassembler output format.)
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpBuffer (
+    void                    *Table,
+    UINT32                  BufferOffset,
+    UINT32                  Length,
+    UINT32                  AbsoluteOffset,
+    char                    *Header)
+{
+    UINT8                   *Buffer;
+    UINT32                  i;
+
+
+    if (!Length)
+    {
+        return;
+    }
+
+    Buffer = ACPI_CAST_PTR (UINT8, Table) + BufferOffset;
+    i = 0;
+
+    while (i < Length)
+    {
+        if (!(i % 16))
+        {
+            /* Insert a backslash - line continuation character */
+
+            if (Length > 16)
+            {
+                AcpiOsPrintf ("\\\n    ");
+            }
+        }
+
+        AcpiOsPrintf ("%.02X ", *Buffer);
+        i++;
+        Buffer++;
+        AbsoluteOffset++;
+    }
+
+    AcpiOsPrintf ("\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpUnicode
+ *
+ * PARAMETERS:  Table               - ACPI Table or subtable
+ *              BufferOffset        - Offset of buffer from Table above
+ *              ByteLength          - Length of the buffer
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Validate and dump the contents of a buffer that contains
+ *              unicode data. The output is a standard ASCII string. If it
+ *              appears that the data is not unicode, the buffer is dumped
+ *              as hex characters.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpUnicode (
+    void                    *Table,
+    UINT32                  BufferOffset,
+    UINT32                  ByteLength)
+{
+    UINT8                   *Buffer;
+    UINT32                  Length;
+    UINT32                  i;
+
+
+    Buffer = ((UINT8 *) Table) + BufferOffset;
+    Length = ByteLength - 2; /* Last two bytes are the null terminator */
+
+    /* Ensure all low bytes are entirely printable ASCII */
+
+    for (i = 0; i < Length; i += 2)
+    {
+        if (!isprint (Buffer[i]))
+        {
+            goto DumpRawBuffer;
+        }
+    }
+
+    /* Ensure all high bytes are zero */
+
+    for (i = 1; i < Length; i += 2)
+    {
+        if (Buffer[i])
+        {
+            goto DumpRawBuffer;
+        }
+    }
+
+    /* Dump the buffer as a normal string */
+
+    AcpiOsPrintf ("\"");
+    for (i = 0; i < Length; i += 2)
+    {
+        AcpiOsPrintf ("%c", Buffer[i]);
+    }
+
+    AcpiOsPrintf ("\"\n");
+    return;
+
+DumpRawBuffer:
+    AcpiDmDumpBuffer (Table, BufferOffset, ByteLength,
+        BufferOffset, NULL);
+    AcpiOsPrintf ("\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpRsdp
+ *
+ * PARAMETERS:  Table               - A RSDP
+ *
+ * RETURN:      Length of the table (there is not always a length field,
+ *              use revision or length if available (ACPI 2.0+))
+ *
+ * DESCRIPTION: Format the contents of a RSDP
+ *
+ ******************************************************************************/
+
+UINT32
+AcpiDmDumpRsdp (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_TABLE_RSDP         *Rsdp = ACPI_CAST_PTR (ACPI_TABLE_RSDP, Table);
+    UINT32                  Length = sizeof (ACPI_RSDP_COMMON);
+    UINT8                   Checksum;
+    ACPI_STATUS             Status;
+
+
+    /* Dump the common ACPI 1.0 portion */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoRsdp1);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Length);
+    }
+
+    /* Validate the first checksum */
+
+    Checksum = AcpiDmGenerateChecksum (Rsdp, sizeof (ACPI_RSDP_COMMON),
+        Rsdp->Checksum);
+    if (Checksum != Rsdp->Checksum)
+    {
+        AcpiOsPrintf ("/* Incorrect Checksum above, should be 0x%2.2X */\n",
+            Checksum);
+    }
+
+    /* The RSDP for ACPI 2.0+ contains more data and has a Length field */
+
+    if (Rsdp->Revision > 0)
+    {
+        Length = Rsdp->Length;
+        Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoRsdp2);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Length);
+        }
+
+        /* Validate the extended checksum over entire RSDP */
+
+        Checksum = AcpiDmGenerateChecksum (Rsdp, sizeof (ACPI_TABLE_RSDP),
+            Rsdp->ExtendedChecksum);
+        if (Checksum != Rsdp->ExtendedChecksum)
+        {
+            AcpiOsPrintf (
+                "/* Incorrect Extended Checksum above, should be 0x%2.2X */\n",
+                Checksum);
+        }
+    }
+
+    return (Length);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpRsdt
+ *
+ * PARAMETERS:  Table               - A RSDT
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a RSDT
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpRsdt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    UINT32                  *Array;
+    UINT32                  Entries;
+    UINT32                  Offset;
+    UINT32                  i;
+
+
+    /* Point to start of table pointer array */
+
+    Array = ACPI_CAST_PTR (ACPI_TABLE_RSDT, Table)->TableOffsetEntry;
+    Offset = sizeof (ACPI_TABLE_HEADER);
+
+    /* RSDT uses 32-bit pointers */
+
+    Entries = (Table->Length - sizeof (ACPI_TABLE_HEADER)) / sizeof (UINT32);
+
+    for (i = 0; i < Entries; i++)
+    {
+        AcpiDmLineHeader2 (Offset, sizeof (UINT32), "ACPI Table Address", i);
+        AcpiOsPrintf ("%8.8X\n", Array[i]);
+        Offset += sizeof (UINT32);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpXsdt
+ *
+ * PARAMETERS:  Table               - A XSDT
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a XSDT
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpXsdt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    UINT64                  *Array;
+    UINT32                  Entries;
+    UINT32                  Offset;
+    UINT32                  i;
+
+
+    /* Point to start of table pointer array */
+
+    Array = ACPI_CAST_PTR (ACPI_TABLE_XSDT, Table)->TableOffsetEntry;
+    Offset = sizeof (ACPI_TABLE_HEADER);
+
+    /* XSDT uses 64-bit pointers */
+
+    Entries = (Table->Length - sizeof (ACPI_TABLE_HEADER)) / sizeof (UINT64);
+
+    for (i = 0; i < Entries; i++)
+    {
+        AcpiDmLineHeader2 (Offset, sizeof (UINT64), "ACPI Table Address", i);
+        AcpiOsPrintf ("%8.8X%8.8X\n", ACPI_FORMAT_UINT64 (Array[i]));
+        Offset += sizeof (UINT64);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpFadt
+ *
+ * PARAMETERS:  Table               - A FADT
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a FADT
+ *
+ * NOTE:        We cannot depend on the FADT version to indicate the actual
+ *              contents of the FADT because of BIOS bugs. The table length
+ *              is the only reliable indicator.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpFadt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+
+
+    /* Always dump the minimum FADT revision 1 fields (ACPI 1.0) */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0,
+        AcpiDmTableInfoFadt1);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Check for FADT revision 2 fields (ACPI 1.0B MS extensions) */
+
+    if ((Table->Length > ACPI_FADT_V1_SIZE) &&
+        (Table->Length <= ACPI_FADT_V2_SIZE))
+    {
+        Status = AcpiDmDumpTable (Table->Length, 0, Table, 0,
+            AcpiDmTableInfoFadt2);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+    }
+
+    /* Check for FADT revision 3/4 fields and up (ACPI 2.0+ extended data) */
+
+    else if (Table->Length > ACPI_FADT_V2_SIZE)
+    {
+        Status = AcpiDmDumpTable (Table->Length, 0, Table, 0,
+            AcpiDmTableInfoFadt3);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Check for FADT revision 5 fields and up (ACPI 5.0+) */
+
+        if (Table->Length > ACPI_FADT_V3_SIZE)
+        {
+            Status = AcpiDmDumpTable (Table->Length, 0, Table, 0,
+                AcpiDmTableInfoFadt5);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+        }
+
+        /* Check for FADT revision 6 fields and up (ACPI 6.0+) */
+
+        if (Table->Length > ACPI_FADT_V3_SIZE)
+        {
+            Status = AcpiDmDumpTable (Table->Length, 0, Table, 0,
+                AcpiDmTableInfoFadt6);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+        }
+    }
+
+    /* Validate various fields in the FADT, including length */
+
+    AcpiTbCreateLocalFadt (Table, Table->Length);
+
+    /* Validate FADT length against the revision */
+
+    AcpiDmValidateFadtLength (Table->Revision, Table->Length);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmValidateFadtLength
+ *
+ * PARAMETERS:  Revision            - FADT revision (Header->Revision)
+ *              Length              - FADT length (Header->Length
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check the FADT revision against the expected table length for
+ *              that revision. Issue a warning if the length is not what was
+ *              expected. This seems to be such a common BIOS bug that the
+ *              FADT revision has been rendered virtually meaningless.
+ *
+ ******************************************************************************/
+
+static void
+AcpiDmValidateFadtLength (
+    UINT32                  Revision,
+    UINT32                  Length)
+{
+    UINT32                  ExpectedLength;
+
+
+    switch (Revision)
+    {
+    case 0:
+
+        AcpiOsPrintf ("// ACPI Warning: Invalid FADT revision: 0\n");
+        return;
+
+    case 1:
+
+        ExpectedLength = ACPI_FADT_V1_SIZE;
+        break;
+
+    case 2:
+
+        ExpectedLength = ACPI_FADT_V2_SIZE;
+        break;
+
+    case 3:
+    case 4:
+
+        ExpectedLength = ACPI_FADT_V3_SIZE;
+        break;
+
+    case 5:
+
+        ExpectedLength = ACPI_FADT_V5_SIZE;
+        break;
+
+    default:
+
+        return;
+    }
+
+    if (Length == ExpectedLength)
+    {
+        return;
+    }
+
+    AcpiOsPrintf (
+        "\n// ACPI Warning: FADT revision %X does not match length: "
+        "found %X expected %X\n",
+        Revision, Length, ExpectedLength);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpAsf
+ *
+ * PARAMETERS:  Table               - A ASF table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a ASF table
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpAsf (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_HEADER);
+    ACPI_ASF_INFO           *SubTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_DMTABLE_INFO       *DataInfoTable = NULL;
+    UINT8                   *DataTable = NULL;
+    UINT32                  DataCount = 0;
+    UINT32                  DataLength = 0;
+    UINT32                  DataOffset = 0;
+    UINT32                  i;
+    UINT8                   Type;
+
+
+    /* No main table, only subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_ASF_INFO, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Header.Length, AcpiDmTableInfoAsfHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* The actual type is the lower 7 bits of Type */
+
+        Type = (UINT8) (SubTable->Header.Type & 0x7F);
+
+        switch (Type)
+        {
+        case ACPI_ASF_TYPE_INFO:
+
+            InfoTable = AcpiDmTableInfoAsf0;
+            break;
+
+        case ACPI_ASF_TYPE_ALERT:
+
+            InfoTable = AcpiDmTableInfoAsf1;
+            DataInfoTable = AcpiDmTableInfoAsf1a;
+            DataTable = ACPI_ADD_PTR (UINT8, SubTable, sizeof (ACPI_ASF_ALERT));
+            DataCount = ACPI_CAST_PTR (ACPI_ASF_ALERT, SubTable)->Alerts;
+            DataLength = ACPI_CAST_PTR (ACPI_ASF_ALERT, SubTable)->DataLength;
+            DataOffset = Offset + sizeof (ACPI_ASF_ALERT);
+            break;
+
+        case ACPI_ASF_TYPE_CONTROL:
+
+            InfoTable = AcpiDmTableInfoAsf2;
+            DataInfoTable = AcpiDmTableInfoAsf2a;
+            DataTable = ACPI_ADD_PTR (UINT8, SubTable, sizeof (ACPI_ASF_REMOTE));
+            DataCount = ACPI_CAST_PTR (ACPI_ASF_REMOTE, SubTable)->Controls;
+            DataLength = ACPI_CAST_PTR (ACPI_ASF_REMOTE, SubTable)->DataLength;
+            DataOffset = Offset + sizeof (ACPI_ASF_REMOTE);
+            break;
+
+        case ACPI_ASF_TYPE_BOOT:
+
+            InfoTable = AcpiDmTableInfoAsf3;
+            break;
+
+        case ACPI_ASF_TYPE_ADDRESS:
+
+            InfoTable = AcpiDmTableInfoAsf4;
+            DataTable = ACPI_ADD_PTR (UINT8, SubTable, sizeof (ACPI_ASF_ADDRESS));
+            DataLength = ACPI_CAST_PTR (ACPI_ASF_ADDRESS, SubTable)->Devices;
+            DataOffset = Offset + sizeof (ACPI_ASF_ADDRESS);
+            break;
+
+        default:
+
+            AcpiOsPrintf ("\n**** Unknown ASF subtable type 0x%X\n",
+                SubTable->Header.Type);
+            return;
+        }
+
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Header.Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Dump variable-length extra data */
+
+        switch (Type)
+        {
+        case ACPI_ASF_TYPE_ALERT:
+        case ACPI_ASF_TYPE_CONTROL:
+
+            for (i = 0; i < DataCount; i++)
+            {
+                AcpiOsPrintf ("\n");
+                Status = AcpiDmDumpTable (Table->Length, DataOffset,
+                    DataTable, DataLength, DataInfoTable);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                DataTable = ACPI_ADD_PTR (UINT8, DataTable, DataLength);
+                DataOffset += DataLength;
+            }
+            break;
+
+        case ACPI_ASF_TYPE_ADDRESS:
+
+            for (i = 0; i < DataLength; i++)
+            {
+                if (!(i % 16))
+                {
+                    AcpiDmLineHeader (DataOffset, 1, "Addresses");
+                }
+
+                AcpiOsPrintf ("%2.2X ", *DataTable);
+                DataTable++;
+                DataOffset++;
+
+                if (DataOffset > Table->Length)
+                {
+                    AcpiOsPrintf (
+                        "**** ACPI table terminates in the middle of a "
+                        "data structure! (ASF! table)\n");
+                    return;
+                }
+            }
+
+            AcpiOsPrintf ("\n");
+            break;
+
+        default:
+
+            break;
+        }
+
+        AcpiOsPrintf ("\n");
+
+        /* Point to next subtable */
+
+        if (!SubTable->Header.Length)
+        {
+            AcpiOsPrintf ("Invalid zero subtable header length\n");
+            return;
+        }
+
+        Offset += SubTable->Header.Length;
+        SubTable = ACPI_ADD_PTR (ACPI_ASF_INFO, SubTable,
+            SubTable->Header.Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpCpep
+ *
+ * PARAMETERS:  Table               - A CPEP table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a CPEP. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpCpep (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_CPEP_POLLING       *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_CPEP);
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoCpep);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_CPEP_POLLING, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Header.Length, AcpiDmTableInfoCpep0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable */
+
+        Offset += SubTable->Header.Length;
+        SubTable = ACPI_ADD_PTR (ACPI_CPEP_POLLING, SubTable,
+            SubTable->Header.Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpCsrt
+ *
+ * PARAMETERS:  Table               - A CSRT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a CSRT. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpCsrt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_CSRT_GROUP         *SubTable;
+    ACPI_CSRT_SHARED_INFO   *SharedInfoTable;
+    ACPI_CSRT_DESCRIPTOR    *SubSubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_CSRT);
+    UINT32                  SubOffset;
+    UINT32                  SubSubOffset;
+    UINT32                  InfoLength;
+
+
+    /* The main table only contains the ACPI header, thus already handled */
+
+    /* Subtables (Resource Groups) */
+
+    SubTable = ACPI_ADD_PTR (ACPI_CSRT_GROUP, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Resource group subtable */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoCsrt0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Shared info subtable (One per resource group) */
+
+        SubOffset = sizeof (ACPI_CSRT_GROUP);
+        SharedInfoTable = ACPI_ADD_PTR (ACPI_CSRT_SHARED_INFO, Table,
+            Offset + SubOffset);
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset + SubOffset, SharedInfoTable,
+            sizeof (ACPI_CSRT_SHARED_INFO), AcpiDmTableInfoCsrt1);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        SubOffset += SubTable->SharedInfoLength;
+
+        /* Sub-Subtables (Resource Descriptors) */
+
+        SubSubTable = ACPI_ADD_PTR (ACPI_CSRT_DESCRIPTOR, Table,
+            Offset + SubOffset);
+
+        while ((SubOffset < SubTable->Length) &&
+              ((Offset + SubOffset) < Table->Length))
+        {
+            AcpiOsPrintf ("\n");
+            Status = AcpiDmDumpTable (Length, Offset + SubOffset, SubSubTable,
+                SubSubTable->Length, AcpiDmTableInfoCsrt2);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+
+            SubSubOffset = sizeof (ACPI_CSRT_DESCRIPTOR);
+
+            /* Resource-specific info buffer */
+
+            InfoLength = SubSubTable->Length - SubSubOffset;
+            if (InfoLength)
+            {
+                Status = AcpiDmDumpTable (Length,
+                    Offset + SubOffset + SubSubOffset, Table,
+                    InfoLength, AcpiDmTableInfoCsrt2a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+                SubSubOffset += InfoLength;
+            }
+
+            /* Point to next sub-subtable */
+
+            SubOffset += SubSubTable->Length;
+            SubSubTable = ACPI_ADD_PTR (ACPI_CSRT_DESCRIPTOR, SubSubTable,
+                SubSubTable->Length);
+        }
+
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_CSRT_GROUP, SubTable,
+            SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpDbg2
+ *
+ * PARAMETERS:  Table               - A DBG2 table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a DBG2. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpDbg2 (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_DBG2_DEVICE        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_DBG2);
+    UINT32                  i;
+    UINT32                  ArrayOffset;
+    UINT32                  AbsoluteOffset;
+    UINT8                   *Array;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoDbg2);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_DBG2_DEVICE, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoDbg2Device);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Dump the BaseAddress array */
+
+        for (i = 0; i < SubTable->RegisterCount; i++)
+        {
+            ArrayOffset = SubTable->BaseAddressOffset +
+                (sizeof (ACPI_GENERIC_ADDRESS) * i);
+            AbsoluteOffset = Offset + ArrayOffset;
+            Array = (UINT8 *) SubTable + ArrayOffset;
+
+            Status = AcpiDmDumpTable (Length, AbsoluteOffset, Array,
+                SubTable->Length, AcpiDmTableInfoDbg2Addr);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+        }
+
+        /* Dump the AddressSize array */
+
+        for (i = 0; i < SubTable->RegisterCount; i++)
+        {
+            ArrayOffset = SubTable->AddressSizeOffset +
+                (sizeof (UINT32) * i);
+            AbsoluteOffset = Offset + ArrayOffset;
+            Array = (UINT8 *) SubTable + ArrayOffset;
+
+            Status = AcpiDmDumpTable (Length, AbsoluteOffset, Array,
+                SubTable->Length, AcpiDmTableInfoDbg2Size);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+        }
+
+        /* Dump the Namestring (required) */
+
+        AcpiOsPrintf ("\n");
+        ArrayOffset = SubTable->NamepathOffset;
+        AbsoluteOffset = Offset + ArrayOffset;
+        Array = (UINT8 *) SubTable + ArrayOffset;
+
+        Status = AcpiDmDumpTable (Length, AbsoluteOffset, Array,
+            SubTable->Length, AcpiDmTableInfoDbg2Name);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Dump the OemData (optional) */
+
+        if (SubTable->OemDataOffset)
+        {
+            Status = AcpiDmDumpTable (Length, Offset + SubTable->OemDataOffset,
+                Table, SubTable->OemDataLength,
+                AcpiDmTableInfoDbg2OemData);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+        }
+
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_DBG2_DEVICE, SubTable,
+            SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpDmar
+ *
+ * PARAMETERS:  Table               - A DMAR table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a DMAR. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpDmar (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_DMAR_HEADER        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_DMAR);
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_DMAR_DEVICE_SCOPE  *ScopeTable;
+    UINT32                  ScopeOffset;
+    UINT8                   *PciPath;
+    UINT32                  PathOffset;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoDmar);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_DMAR_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoDmarHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        AcpiOsPrintf ("\n");
+
+        switch (SubTable->Type)
+        {
+        case ACPI_DMAR_TYPE_HARDWARE_UNIT:
+
+            InfoTable = AcpiDmTableInfoDmar0;
+            ScopeOffset = sizeof (ACPI_DMAR_HARDWARE_UNIT);
+            break;
+
+        case ACPI_DMAR_TYPE_RESERVED_MEMORY:
+
+            InfoTable = AcpiDmTableInfoDmar1;
+            ScopeOffset = sizeof (ACPI_DMAR_RESERVED_MEMORY);
+            break;
+
+        case ACPI_DMAR_TYPE_ROOT_ATS:
+
+            InfoTable = AcpiDmTableInfoDmar2;
+            ScopeOffset = sizeof (ACPI_DMAR_ATSR);
+            break;
+
+        case ACPI_DMAR_TYPE_HARDWARE_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoDmar3;
+            ScopeOffset = sizeof (ACPI_DMAR_RHSA);
+            break;
+
+        case ACPI_DMAR_TYPE_NAMESPACE:
+
+            InfoTable = AcpiDmTableInfoDmar4;
+            ScopeOffset = sizeof (ACPI_DMAR_ANDD);
+            break;
+
+        default:
+
+            AcpiOsPrintf ("\n**** Unknown DMAR subtable type 0x%X\n\n",
+                SubTable->Type);
+            return;
+        }
+
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /*
+         * Dump the optional device scope entries
+         */
+        if ((SubTable->Type == ACPI_DMAR_TYPE_HARDWARE_AFFINITY) ||
+            (SubTable->Type == ACPI_DMAR_TYPE_NAMESPACE))
+        {
+            /* These types do not support device scopes */
+
+            goto NextSubtable;
+        }
+
+        ScopeTable = ACPI_ADD_PTR (ACPI_DMAR_DEVICE_SCOPE, SubTable, ScopeOffset);
+        while (ScopeOffset < SubTable->Length)
+        {
+            AcpiOsPrintf ("\n");
+            Status = AcpiDmDumpTable (Length, Offset + ScopeOffset, ScopeTable,
+                ScopeTable->Length, AcpiDmTableInfoDmarScope);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+            AcpiOsPrintf ("\n");
+
+            /* Dump the PCI Path entries for this device scope */
+
+            PathOffset = sizeof (ACPI_DMAR_DEVICE_SCOPE); /* Path entries start at this offset */
+
+            PciPath = ACPI_ADD_PTR (UINT8, ScopeTable,
+                sizeof (ACPI_DMAR_DEVICE_SCOPE));
+
+            while (PathOffset < ScopeTable->Length)
+            {
+                AcpiDmLineHeader ((PathOffset + ScopeOffset + Offset), 2,
+                    "PCI Path");
+                AcpiOsPrintf ("%2.2X,%2.2X\n", PciPath[0], PciPath[1]);
+
+                /* Point to next PCI Path entry */
+
+                PathOffset += 2;
+                PciPath += 2;
+                AcpiOsPrintf ("\n");
+            }
+
+            /* Point to next device scope entry */
+
+            ScopeOffset += ScopeTable->Length;
+            ScopeTable = ACPI_ADD_PTR (ACPI_DMAR_DEVICE_SCOPE,
+                ScopeTable, ScopeTable->Length);
+        }
+
+NextSubtable:
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_DMAR_HEADER, SubTable,
+            SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpDrtm
+ *
+ * PARAMETERS:  Table               - A DRTM table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a DRTM.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpDrtm (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset;
+    ACPI_DRTM_VTABLE_LIST   *DrtmVtl;
+    ACPI_DRTM_RESOURCE_LIST *DrtmRl;
+    ACPI_DRTM_DPS_ID        *DrtmDps;
+    UINT32                  Count;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0,
+        AcpiDmTableInfoDrtm);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    Offset = sizeof (ACPI_TABLE_DRTM);
+
+    /* Sub-tables */
+
+    /* Dump ValidatedTable length */
+
+    DrtmVtl = ACPI_ADD_PTR (ACPI_DRTM_VTABLE_LIST, Table, Offset);
+    AcpiOsPrintf ("\n");
+    Status = AcpiDmDumpTable (Table->Length, Offset,
+        DrtmVtl, ACPI_OFFSET (ACPI_DRTM_VTABLE_LIST, ValidatedTables),
+        AcpiDmTableInfoDrtm0);
+    if (ACPI_FAILURE (Status))
+    {
+            return;
+    }
+
+    Offset += ACPI_OFFSET (ACPI_DRTM_VTABLE_LIST, ValidatedTables);
+
+    /* Dump Validated table addresses */
+
+    Count = 0;
+    while ((Offset < Table->Length) &&
+            (DrtmVtl->ValidatedTableCount > Count))
+    {
+        Status = AcpiDmDumpTable (Table->Length, Offset,
+            ACPI_ADD_PTR (void, Table, Offset), sizeof (UINT64),
+            AcpiDmTableInfoDrtm0a);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        Offset += sizeof (UINT64);
+        Count++;
+    }
+
+    /* Dump ResourceList length */
+
+    DrtmRl = ACPI_ADD_PTR (ACPI_DRTM_RESOURCE_LIST, Table, Offset);
+    AcpiOsPrintf ("\n");
+    Status = AcpiDmDumpTable (Table->Length, Offset,
+        DrtmRl, ACPI_OFFSET (ACPI_DRTM_RESOURCE_LIST, Resources),
+        AcpiDmTableInfoDrtm1);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    Offset += ACPI_OFFSET (ACPI_DRTM_RESOURCE_LIST, Resources);
+
+    /* Dump the Resource List */
+
+    Count = 0;
+    while ((Offset < Table->Length) &&
+           (DrtmRl->ResourceCount > Count))
+    {
+        Status = AcpiDmDumpTable (Table->Length, Offset,
+            ACPI_ADD_PTR (void, Table, Offset),
+            sizeof (ACPI_DRTM_RESOURCE), AcpiDmTableInfoDrtm1a);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        Offset += sizeof (ACPI_DRTM_RESOURCE);
+        Count++;
+    }
+
+    /* Dump DPS */
+
+    DrtmDps = ACPI_ADD_PTR (ACPI_DRTM_DPS_ID, Table, Offset);
+    AcpiOsPrintf ("\n");
+    (void) AcpiDmDumpTable (Table->Length, Offset,
+        DrtmDps, sizeof (ACPI_DRTM_DPS_ID), AcpiDmTableInfoDrtm2);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpEinj
+ *
+ * PARAMETERS:  Table               - A EINJ table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a EINJ. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpEinj (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_WHEA_HEADER        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_EINJ);
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoEinj);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_WHEA_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            sizeof (ACPI_WHEA_HEADER), AcpiDmTableInfoEinj0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable (each subtable is of fixed length) */
+
+        Offset += sizeof (ACPI_WHEA_HEADER);
+        SubTable = ACPI_ADD_PTR (ACPI_WHEA_HEADER, SubTable,
+            sizeof (ACPI_WHEA_HEADER));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpErst
+ *
+ * PARAMETERS:  Table               - A ERST table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a ERST. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpErst (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_WHEA_HEADER        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_ERST);
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoErst);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_WHEA_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            sizeof (ACPI_WHEA_HEADER), AcpiDmTableInfoErst0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable (each subtable is of fixed length) */
+
+        Offset += sizeof (ACPI_WHEA_HEADER);
+        SubTable = ACPI_ADD_PTR (ACPI_WHEA_HEADER, SubTable,
+            sizeof (ACPI_WHEA_HEADER));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpFpdt
+ *
+ * PARAMETERS:  Table               - A FPDT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a FPDT. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpFpdt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_FPDT_HEADER        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_FPDT);
+    ACPI_DMTABLE_INFO       *InfoTable;
+
+
+    /* There is no main table (other than the standard ACPI header) */
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_FPDT_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoFpdtHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        switch (SubTable->Type)
+        {
+        case ACPI_FPDT_TYPE_BOOT:
+
+            InfoTable = AcpiDmTableInfoFpdt0;
+            break;
+
+        case ACPI_FPDT_TYPE_S3PERF:
+
+            InfoTable = AcpiDmTableInfoFpdt1;
+            break;
+
+        default:
+
+            AcpiOsPrintf ("\n**** Unknown FPDT subtable type 0x%X\n\n",
+                SubTable->Type);
+
+            /* Attempt to continue */
+
+            if (!SubTable->Length)
+            {
+                AcpiOsPrintf ("Invalid zero length subtable\n");
+                return;
+            }
+            goto NextSubTable;
+        }
+
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+NextSubTable:
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_FPDT_HEADER, SubTable,
+            SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpGtdt
+ *
+ * PARAMETERS:  Table               - A GTDT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a GTDT. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpGtdt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_GTDT_HEADER        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_GTDT);
+    ACPI_DMTABLE_INFO       *InfoTable;
+    UINT32                  SubTableLength;
+    UINT32                  GtCount;
+    ACPI_GTDT_TIMER_ENTRY   *GtxTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoGtdt);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_GTDT_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoGtdtHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        GtCount = 0;
+        switch (SubTable->Type)
+        {
+        case ACPI_GTDT_TYPE_TIMER_BLOCK:
+
+            SubTableLength = sizeof (ACPI_GTDT_TIMER_BLOCK);
+            GtCount = (ACPI_CAST_PTR (ACPI_GTDT_TIMER_BLOCK,
+                SubTable))->TimerCount;
+
+            InfoTable = AcpiDmTableInfoGtdt0;
+            break;
+
+        case ACPI_GTDT_TYPE_WATCHDOG:
+
+            SubTableLength = sizeof (ACPI_GTDT_WATCHDOG);
+
+            InfoTable = AcpiDmTableInfoGtdt1;
+            break;
+
+        default:
+
+            /* Cannot continue on unknown type - no length */
+
+            AcpiOsPrintf ("\n**** Unknown GTDT subtable type 0x%X\n",
+                SubTable->Type);
+            return;
+        }
+
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to end of current subtable (each subtable above is of fixed length) */
+
+        Offset += SubTableLength;
+
+        /* If there are any Gt Timer Blocks from above, dump them now */
+
+        if (GtCount)
+        {
+            GtxTable = ACPI_ADD_PTR (
+                ACPI_GTDT_TIMER_ENTRY, SubTable, SubTableLength);
+            SubTableLength += GtCount * sizeof (ACPI_GTDT_TIMER_ENTRY);
+
+            while (GtCount)
+            {
+                AcpiOsPrintf ("\n");
+                Status = AcpiDmDumpTable (Length, Offset, GtxTable,
+                    sizeof (ACPI_GTDT_TIMER_ENTRY), AcpiDmTableInfoGtdt0a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+                Offset += sizeof (ACPI_GTDT_TIMER_ENTRY);
+                GtxTable++;
+                GtCount--;
+            }
+        }
+
+        /* Point to next subtable */
+
+        SubTable = ACPI_ADD_PTR (ACPI_GTDT_HEADER, SubTable, SubTableLength);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpHest
+ *
+ * PARAMETERS:  Table               - A HEST table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a HEST. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpHest (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_HEST_HEADER        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_HEST);
+    ACPI_DMTABLE_INFO       *InfoTable;
+    UINT32                  SubTableLength;
+    UINT32                  BankCount;
+    ACPI_HEST_IA_ERROR_BANK *BankTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoHest);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_HEST_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        BankCount = 0;
+        switch (SubTable->Type)
+        {
+        case ACPI_HEST_TYPE_IA32_CHECK:
+
+            InfoTable = AcpiDmTableInfoHest0;
+            SubTableLength = sizeof (ACPI_HEST_IA_MACHINE_CHECK);
+            BankCount = (ACPI_CAST_PTR (ACPI_HEST_IA_MACHINE_CHECK,
+                SubTable))->NumHardwareBanks;
+            break;
+
+        case ACPI_HEST_TYPE_IA32_CORRECTED_CHECK:
+
+            InfoTable = AcpiDmTableInfoHest1;
+            SubTableLength = sizeof (ACPI_HEST_IA_CORRECTED);
+            BankCount = (ACPI_CAST_PTR (ACPI_HEST_IA_CORRECTED,
+                SubTable))->NumHardwareBanks;
+            break;
+
+        case ACPI_HEST_TYPE_IA32_NMI:
+
+            InfoTable = AcpiDmTableInfoHest2;
+            SubTableLength = sizeof (ACPI_HEST_IA_NMI);
+            break;
+
+        case ACPI_HEST_TYPE_AER_ROOT_PORT:
+
+            InfoTable = AcpiDmTableInfoHest6;
+            SubTableLength = sizeof (ACPI_HEST_AER_ROOT);
+            break;
+
+        case ACPI_HEST_TYPE_AER_ENDPOINT:
+
+            InfoTable = AcpiDmTableInfoHest7;
+            SubTableLength = sizeof (ACPI_HEST_AER);
+            break;
+
+        case ACPI_HEST_TYPE_AER_BRIDGE:
+
+            InfoTable = AcpiDmTableInfoHest8;
+            SubTableLength = sizeof (ACPI_HEST_AER_BRIDGE);
+            break;
+
+        case ACPI_HEST_TYPE_GENERIC_ERROR:
+
+            InfoTable = AcpiDmTableInfoHest9;
+            SubTableLength = sizeof (ACPI_HEST_GENERIC);
+            break;
+
+        case ACPI_HEST_TYPE_GENERIC_ERROR_V2:
+
+            InfoTable = AcpiDmTableInfoHest10;
+            SubTableLength = sizeof (ACPI_HEST_GENERIC_V2);
+            break;
+
+        default:
+
+            /* Cannot continue on unknown type - no length */
+
+            AcpiOsPrintf ("\n**** Unknown HEST subtable type 0x%X\n",
+                SubTable->Type);
+            return;
+        }
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTableLength, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to end of current subtable (each subtable above is of fixed length) */
+
+        Offset += SubTableLength;
+
+        /* If there are any (fixed-length) Error Banks from above, dump them now */
+
+        if (BankCount)
+        {
+            BankTable = ACPI_ADD_PTR (ACPI_HEST_IA_ERROR_BANK, SubTable,
+                SubTableLength);
+            SubTableLength += BankCount * sizeof (ACPI_HEST_IA_ERROR_BANK);
+
+            while (BankCount)
+            {
+                AcpiOsPrintf ("\n");
+                Status = AcpiDmDumpTable (Length, Offset, BankTable,
+                    sizeof (ACPI_HEST_IA_ERROR_BANK), AcpiDmTableInfoHestBank);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                Offset += sizeof (ACPI_HEST_IA_ERROR_BANK);
+                BankTable++;
+                BankCount--;
+            }
+        }
+
+        /* Point to next subtable */
+
+        SubTable = ACPI_ADD_PTR (ACPI_HEST_HEADER, SubTable, SubTableLength);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpIort
+ *
+ * PARAMETERS:  Table               - A IORT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a IORT
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpIort (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_TABLE_IORT         *Iort;
+    ACPI_IORT_NODE          *IortNode;
+    ACPI_IORT_ITS_GROUP     *IortItsGroup = NULL;
+    ACPI_IORT_SMMU          *IortSmmu = NULL;
+    UINT32                  Offset;
+    UINT32                  NodeOffset;
+    UINT32                  Length;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    char                    *String;
+    UINT32                  i;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoIort);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    Iort = ACPI_CAST_PTR (ACPI_TABLE_IORT, Table);
+    Offset = sizeof (ACPI_TABLE_IORT);
+
+    /* Dump the OptionalPadding (optional) */
+
+    if (Iort->NodeOffset > Offset)
+    {
+        Status = AcpiDmDumpTable (Table->Length, Offset, Table,
+            Iort->NodeOffset - Offset, AcpiDmTableInfoIortPad);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+    }
+
+    Offset = Iort->NodeOffset;
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        IortNode = ACPI_ADD_PTR (ACPI_IORT_NODE, Table, Offset);
+        AcpiOsPrintf ("\n");
+        Length = ACPI_OFFSET (ACPI_IORT_NODE, NodeData);
+        Status = AcpiDmDumpTable (Table->Length, Offset,
+            IortNode, Length, AcpiDmTableInfoIortHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        NodeOffset = Length;
+
+        switch (IortNode->Type)
+        {
+        case ACPI_IORT_NODE_ITS_GROUP:
+
+            InfoTable = AcpiDmTableInfoIort0;
+            Length = ACPI_OFFSET (ACPI_IORT_ITS_GROUP, Identifiers);
+            IortItsGroup = ACPI_ADD_PTR (ACPI_IORT_ITS_GROUP, IortNode, NodeOffset);
+            break;
+
+        case ACPI_IORT_NODE_NAMED_COMPONENT:
+
+            InfoTable = AcpiDmTableInfoIort1;
+            Length = ACPI_OFFSET (ACPI_IORT_NAMED_COMPONENT, DeviceName);
+            String = ACPI_ADD_PTR (char, IortNode, NodeOffset + Length);
+            Length += strlen (String) + 1;
+            break;
+
+        case ACPI_IORT_NODE_PCI_ROOT_COMPLEX:
+
+            InfoTable = AcpiDmTableInfoIort2;
+            Length = IortNode->Length - NodeOffset;
+            break;
+
+        case ACPI_IORT_NODE_SMMU:
+
+            InfoTable = AcpiDmTableInfoIort3;
+            Length = ACPI_OFFSET (ACPI_IORT_SMMU, Interrupts);
+            IortSmmu = ACPI_ADD_PTR (ACPI_IORT_SMMU, IortNode, NodeOffset);
+            break;
+
+        case ACPI_IORT_NODE_SMMU_V3:
+
+            InfoTable = AcpiDmTableInfoIort4;
+            Length = IortNode->Length - NodeOffset;
+            break;
+
+        default:
+
+            AcpiOsPrintf ("\n**** Unknown IORT node type 0x%X\n",
+                IortNode->Type);
+
+            /* Attempt to continue */
+
+            if (!IortNode->Length)
+            {
+                AcpiOsPrintf ("Invalid zero length IORT node\n");
+                return;
+            }
+            goto NextSubTable;
+        }
+
+        /* Dump the node subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset + NodeOffset,
+            ACPI_ADD_PTR (ACPI_IORT_NODE, IortNode, NodeOffset),
+            Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        NodeOffset += Length;
+
+        /* Dump the node specific data */
+
+        switch (IortNode->Type)
+        {
+        case ACPI_IORT_NODE_ITS_GROUP:
+
+            /* Validate IortItsGroup to avoid compiler warnings */
+
+            if (IortItsGroup)
+            {
+                for (i = 0; i < IortItsGroup->ItsCount; i++)
+                {
+                    Status = AcpiDmDumpTable (Table->Length, Offset + NodeOffset,
+                        ACPI_ADD_PTR (ACPI_IORT_NODE, IortNode, NodeOffset),
+                        4, AcpiDmTableInfoIort0a);
+                    NodeOffset += 4;
+                }
+            }
+            break;
+
+        case ACPI_IORT_NODE_NAMED_COMPONENT:
+
+            /* Dump the Padding (optional) */
+
+            if (IortNode->Length > NodeOffset)
+            {
+                Status = AcpiDmDumpTable (Table->Length, Offset + NodeOffset,
+                    Table, IortNode->Length - NodeOffset,
+                    AcpiDmTableInfoIort1a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+            }
+            break;
+
+        case ACPI_IORT_NODE_SMMU:
+
+            AcpiOsPrintf ("\n");
+
+            /* Validate IortSmmu to avoid compiler warnings */
+
+            if (IortSmmu)
+            {
+                Length = 2 * sizeof (UINT64);
+                NodeOffset = IortSmmu->GlobalInterruptOffset;
+                Status = AcpiDmDumpTable (Table->Length, Offset + NodeOffset,
+                    ACPI_ADD_PTR (ACPI_IORT_NODE, IortNode, NodeOffset),
+                    Length, AcpiDmTableInfoIort3a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                NodeOffset = IortSmmu->ContextInterruptOffset;
+                for (i = 0; i < IortSmmu->ContextInterruptCount; i++)
+                {
+                    Status = AcpiDmDumpTable (Table->Length, Offset + NodeOffset,
+                        ACPI_ADD_PTR (ACPI_IORT_NODE, IortNode, NodeOffset),
+                        8, AcpiDmTableInfoIort3b);
+                    if (ACPI_FAILURE (Status))
+                    {
+                        return;
+                    }
+
+                    NodeOffset += 8;
+                }
+
+                NodeOffset = IortSmmu->PmuInterruptOffset;
+                for (i = 0; i < IortSmmu->PmuInterruptCount; i++)
+                {
+                    Status = AcpiDmDumpTable (Table->Length, Offset + NodeOffset,
+                        ACPI_ADD_PTR (ACPI_IORT_NODE, IortNode, NodeOffset),
+                        8, AcpiDmTableInfoIort3c);
+                    if (ACPI_FAILURE (Status))
+                    {
+                        return;
+                    }
+
+                    NodeOffset += 8;
+                }
+            }
+            break;
+
+        default:
+
+            break;
+        }
+
+        /* Dump the ID mappings */
+
+        NodeOffset = IortNode->MappingOffset;
+        for (i = 0; i < IortNode->MappingCount; i++)
+        {
+            AcpiOsPrintf ("\n");
+            Length = sizeof (ACPI_IORT_ID_MAPPING);
+            Status = AcpiDmDumpTable (Table->Length, Offset + NodeOffset,
+                ACPI_ADD_PTR (ACPI_IORT_NODE, IortNode, NodeOffset),
+                Length, AcpiDmTableInfoIortMap);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+
+            NodeOffset += Length;
+        }
+
+NextSubTable:
+        /* Point to next node subtable */
+
+        Offset += IortNode->Length;
+        IortNode = ACPI_ADD_PTR (ACPI_IORT_NODE, IortNode, IortNode->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpIvrs
+ *
+ * PARAMETERS:  Table               - A IVRS table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a IVRS
+ *
+ ******************************************************************************/
+
+static UINT8 EntrySizes[] = {4,8,16,32};
+
+void
+AcpiDmDumpIvrs (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_IVRS);
+    UINT32                  EntryOffset;
+    UINT32                  EntryLength;
+    UINT32                  EntryType;
+    ACPI_IVRS_DE_HEADER     *DeviceEntry;
+    ACPI_IVRS_HEADER        *SubTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoIvrs);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_IVRS_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoIvrsHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        switch (SubTable->Type)
+        {
+        case ACPI_IVRS_TYPE_HARDWARE:
+
+            InfoTable = AcpiDmTableInfoIvrs0;
+            break;
+
+        case ACPI_IVRS_TYPE_MEMORY1:
+        case ACPI_IVRS_TYPE_MEMORY2:
+        case ACPI_IVRS_TYPE_MEMORY3:
+
+            InfoTable = AcpiDmTableInfoIvrs1;
+            break;
+
+        default:
+
+            AcpiOsPrintf ("\n**** Unknown IVRS subtable type 0x%X\n",
+                SubTable->Type);
+
+            /* Attempt to continue */
+
+            if (!SubTable->Length)
+            {
+                AcpiOsPrintf ("Invalid zero length subtable\n");
+                return;
+            }
+            goto NextSubTable;
+        }
+
+        /* Dump the subtable */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* The hardware subtable can contain multiple device entries */
+
+        if (SubTable->Type == ACPI_IVRS_TYPE_HARDWARE)
+        {
+            EntryOffset = Offset + sizeof (ACPI_IVRS_HARDWARE);
+            DeviceEntry = ACPI_ADD_PTR (ACPI_IVRS_DE_HEADER, SubTable,
+                sizeof (ACPI_IVRS_HARDWARE));
+
+            while (EntryOffset < (Offset + SubTable->Length))
+            {
+                AcpiOsPrintf ("\n");
+                /*
+                 * Upper 2 bits of Type encode the length of the device entry
+                 *
+                 * 00 = 4 byte
+                 * 01 = 8 byte
+                 * 10 = 16 byte - currently no entries defined
+                 * 11 = 32 byte - currently no entries defined
+                 */
+                EntryType = DeviceEntry->Type;
+                EntryLength = EntrySizes [EntryType >> 6];
+
+                switch (EntryType)
+                {
+                /* 4-byte device entries */
+
+                case ACPI_IVRS_TYPE_PAD4:
+                case ACPI_IVRS_TYPE_ALL:
+                case ACPI_IVRS_TYPE_SELECT:
+                case ACPI_IVRS_TYPE_START:
+                case ACPI_IVRS_TYPE_END:
+
+                    InfoTable = AcpiDmTableInfoIvrs4;
+                    break;
+
+                /* 8-byte entries, type A */
+
+                case ACPI_IVRS_TYPE_ALIAS_SELECT:
+                case ACPI_IVRS_TYPE_ALIAS_START:
+
+                    InfoTable = AcpiDmTableInfoIvrs8a;
+                    break;
+
+                /* 8-byte entries, type B */
+
+                case ACPI_IVRS_TYPE_PAD8:
+                case ACPI_IVRS_TYPE_EXT_SELECT:
+                case ACPI_IVRS_TYPE_EXT_START:
+
+                    InfoTable = AcpiDmTableInfoIvrs8b;
+                    break;
+
+                /* 8-byte entries, type C */
+
+                case ACPI_IVRS_TYPE_SPECIAL:
+
+                    InfoTable = AcpiDmTableInfoIvrs8c;
+                    break;
+
+                default:
+                    InfoTable = AcpiDmTableInfoIvrs4;
+                    AcpiOsPrintf (
+                        "\n**** Unknown IVRS device entry type/length: "
+                        "0x%.2X/0x%X at offset 0x%.4X: (header below)\n",
+                        EntryType, EntryLength, EntryOffset);
+                    break;
+                }
+
+                /* Dump the Device Entry */
+
+                Status = AcpiDmDumpTable (Table->Length, EntryOffset,
+                    DeviceEntry, EntryLength, InfoTable);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                EntryOffset += EntryLength;
+                DeviceEntry = ACPI_ADD_PTR (ACPI_IVRS_DE_HEADER, DeviceEntry,
+                    EntryLength);
+            }
+        }
+
+NextSubTable:
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_IVRS_HEADER, SubTable, SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpLpit
+ *
+ * PARAMETERS:  Table               - A LPIT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a LPIT. This table type consists
+ *              of an open-ended number of subtables. Note: There are no
+ *              entries in the main table. An LPIT consists of the table
+ *              header and then subtables only.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpLpit (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_LPIT_HEADER        *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_LPIT);
+    ACPI_DMTABLE_INFO       *InfoTable;
+    UINT32                  SubTableLength;
+
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_LPIT_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            sizeof (ACPI_LPIT_HEADER), AcpiDmTableInfoLpitHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        switch (SubTable->Type)
+        {
+        case ACPI_LPIT_TYPE_NATIVE_CSTATE:
+
+            InfoTable = AcpiDmTableInfoLpit0;
+            SubTableLength = sizeof (ACPI_LPIT_NATIVE);
+            break;
+
+        default:
+
+            /* Cannot continue on unknown type - no length */
+
+            AcpiOsPrintf ("\n**** Unknown LPIT subtable type 0x%X\n",
+                SubTable->Type);
+            return;
+        }
+
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTableLength, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        AcpiOsPrintf ("\n");
+
+        /* Point to next subtable */
+
+        Offset += SubTableLength;
+        SubTable = ACPI_ADD_PTR (ACPI_LPIT_HEADER, SubTable, SubTableLength);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpMadt
+ *
+ * PARAMETERS:  Table               - A MADT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a MADT. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpMadt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_SUBTABLE_HEADER    *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_MADT);
+    ACPI_DMTABLE_INFO       *InfoTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoMadt);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_SUBTABLE_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoMadtHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        switch (SubTable->Type)
+        {
+        case ACPI_MADT_TYPE_LOCAL_APIC:
+
+            InfoTable = AcpiDmTableInfoMadt0;
+            break;
+
+        case ACPI_MADT_TYPE_IO_APIC:
+
+            InfoTable = AcpiDmTableInfoMadt1;
+            break;
+
+        case ACPI_MADT_TYPE_INTERRUPT_OVERRIDE:
+
+            InfoTable = AcpiDmTableInfoMadt2;
+            break;
+
+        case ACPI_MADT_TYPE_NMI_SOURCE:
+
+            InfoTable = AcpiDmTableInfoMadt3;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_APIC_NMI:
+
+            InfoTable = AcpiDmTableInfoMadt4;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_APIC_OVERRIDE:
+
+            InfoTable = AcpiDmTableInfoMadt5;
+            break;
+
+        case ACPI_MADT_TYPE_IO_SAPIC:
+
+            InfoTable = AcpiDmTableInfoMadt6;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_SAPIC:
+
+            InfoTable = AcpiDmTableInfoMadt7;
+            break;
+
+        case ACPI_MADT_TYPE_INTERRUPT_SOURCE:
+
+            InfoTable = AcpiDmTableInfoMadt8;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_X2APIC:
+
+            InfoTable = AcpiDmTableInfoMadt9;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_X2APIC_NMI:
+
+            InfoTable = AcpiDmTableInfoMadt10;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_INTERRUPT:
+
+            InfoTable = AcpiDmTableInfoMadt11;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_DISTRIBUTOR:
+
+            InfoTable = AcpiDmTableInfoMadt12;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_MSI_FRAME:
+
+            InfoTable = AcpiDmTableInfoMadt13;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_REDISTRIBUTOR:
+
+            InfoTable = AcpiDmTableInfoMadt14;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_TRANSLATOR:
+
+            InfoTable = AcpiDmTableInfoMadt15;
+            break;
+
+        default:
+
+            AcpiOsPrintf ("\n**** Unknown MADT subtable type 0x%X\n\n",
+                SubTable->Type);
+
+            /* Attempt to continue */
+
+            if (!SubTable->Length)
+            {
+                AcpiOsPrintf ("Invalid zero length subtable\n");
+                return;
+            }
+
+            goto NextSubTable;
+        }
+
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+NextSubTable:
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_SUBTABLE_HEADER, SubTable,
+            SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpMcfg
+ *
+ * PARAMETERS:  Table               - A MCFG Table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a MCFG table
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpMcfg (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_MCFG);
+    ACPI_MCFG_ALLOCATION    *SubTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoMcfg);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_MCFG_ALLOCATION, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        if (Offset + sizeof (ACPI_MCFG_ALLOCATION) > Table->Length)
+        {
+            AcpiOsPrintf ("Warning: there are %u invalid trailing bytes\n",
+                sizeof (ACPI_MCFG_ALLOCATION) - (Offset - Table->Length));
+            return;
+        }
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            sizeof (ACPI_MCFG_ALLOCATION), AcpiDmTableInfoMcfg0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable (each subtable is of fixed length) */
+
+        Offset += sizeof (ACPI_MCFG_ALLOCATION);
+        SubTable = ACPI_ADD_PTR (ACPI_MCFG_ALLOCATION, SubTable,
+            sizeof (ACPI_MCFG_ALLOCATION));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpMpst
+ *
+ * PARAMETERS:  Table               - A MPST Table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a MPST table
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpMpst (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_MPST);
+    ACPI_MPST_POWER_NODE    *SubTable0;
+    ACPI_MPST_POWER_STATE   *SubTable0A;
+    ACPI_MPST_COMPONENT     *SubTable0B;
+    ACPI_MPST_DATA_HDR      *SubTable1;
+    ACPI_MPST_POWER_DATA    *SubTable2;
+    UINT16                  SubtableCount;
+    UINT32                  PowerStateCount;
+    UINT32                  ComponentCount;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoMpst);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtable: Memory Power Node(s) */
+
+    SubtableCount = (ACPI_CAST_PTR (ACPI_TABLE_MPST, Table))->PowerNodeCount;
+    SubTable0 = ACPI_ADD_PTR (ACPI_MPST_POWER_NODE, Table, Offset);
+
+    while ((Offset < Table->Length) && SubtableCount)
+    {
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable0,
+            sizeof (ACPI_MPST_POWER_NODE), AcpiDmTableInfoMpst0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Extract the sub-subtable counts */
+
+        PowerStateCount = SubTable0->NumPowerStates;
+        ComponentCount = SubTable0->NumPhysicalComponents;
+        Offset += sizeof (ACPI_MPST_POWER_NODE);
+
+        /* Sub-subtables - Memory Power State Structure(s) */
+
+        SubTable0A = ACPI_ADD_PTR (ACPI_MPST_POWER_STATE, SubTable0,
+            sizeof (ACPI_MPST_POWER_NODE));
+
+        while (PowerStateCount)
+        {
+            AcpiOsPrintf ("\n");
+            Status = AcpiDmDumpTable (Table->Length, Offset, SubTable0A,
+                sizeof (ACPI_MPST_POWER_STATE), AcpiDmTableInfoMpst0A);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+
+            SubTable0A++;
+            PowerStateCount--;
+            Offset += sizeof (ACPI_MPST_POWER_STATE);
+       }
+
+        /* Sub-subtables - Physical Component ID Structure(s) */
+
+        SubTable0B = ACPI_CAST_PTR (ACPI_MPST_COMPONENT, SubTable0A);
+
+        if (ComponentCount)
+        {
+            AcpiOsPrintf ("\n");
+        }
+
+        while (ComponentCount)
+        {
+            Status = AcpiDmDumpTable (Table->Length, Offset, SubTable0B,
+                sizeof (ACPI_MPST_COMPONENT), AcpiDmTableInfoMpst0B);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+
+            SubTable0B++;
+            ComponentCount--;
+            Offset += sizeof (ACPI_MPST_COMPONENT);
+        }
+
+        /* Point to next Memory Power Node subtable */
+
+        SubtableCount--;
+        SubTable0 = ACPI_ADD_PTR (ACPI_MPST_POWER_NODE, SubTable0,
+            sizeof (ACPI_MPST_POWER_NODE) +
+            (sizeof (ACPI_MPST_POWER_STATE) * SubTable0->NumPowerStates) +
+            (sizeof (ACPI_MPST_COMPONENT) * SubTable0->NumPhysicalComponents));
+    }
+
+    /* Subtable: Count of Memory Power State Characteristic structures */
+
+    AcpiOsPrintf ("\n");
+    SubTable1 = ACPI_CAST_PTR (ACPI_MPST_DATA_HDR, SubTable0);
+    Status = AcpiDmDumpTable (Table->Length, Offset, SubTable1,
+        sizeof (ACPI_MPST_DATA_HDR), AcpiDmTableInfoMpst1);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    SubtableCount = SubTable1->CharacteristicsCount;
+    Offset += sizeof (ACPI_MPST_DATA_HDR);
+
+    /* Subtable: Memory Power State Characteristics structure(s) */
+
+    SubTable2 = ACPI_ADD_PTR (ACPI_MPST_POWER_DATA, SubTable1,
+        sizeof (ACPI_MPST_DATA_HDR));
+
+    while ((Offset < Table->Length) && SubtableCount)
+    {
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable2,
+            sizeof (ACPI_MPST_POWER_DATA), AcpiDmTableInfoMpst2);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        SubTable2++;
+        SubtableCount--;
+        Offset += sizeof (ACPI_MPST_POWER_DATA);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpMsct
+ *
+ * PARAMETERS:  Table               - A MSCT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a MSCT
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpMsct (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_MSCT);
+    ACPI_MSCT_PROXIMITY     *SubTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoMsct);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_MSCT_PROXIMITY, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            sizeof (ACPI_MSCT_PROXIMITY), AcpiDmTableInfoMsct0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable */
+
+        Offset += sizeof (ACPI_MSCT_PROXIMITY);
+        SubTable = ACPI_ADD_PTR (ACPI_MSCT_PROXIMITY, SubTable,
+            sizeof (ACPI_MSCT_PROXIMITY));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpMtmr
+ *
+ * PARAMETERS:  Table               - A MTMR table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a MTMR
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpMtmr (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_MTMR);
+    ACPI_MTMR_ENTRY         *SubTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoMtmr);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_MTMR_ENTRY, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            sizeof (ACPI_MTMR_ENTRY), AcpiDmTableInfoMtmr0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable */
+
+        Offset += sizeof (ACPI_MTMR_ENTRY);
+        SubTable = ACPI_ADD_PTR (ACPI_MTMR_ENTRY, SubTable,
+            sizeof (ACPI_MTMR_ENTRY));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpNfit
+ *
+ * PARAMETERS:  Table               - A NFIT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of an NFIT.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpNfit (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_NFIT);
+    UINT32                  FieldOffset = 0;
+    UINT32                  Length;
+    ACPI_NFIT_HEADER        *SubTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_NFIT_INTERLEAVE    *Interleave = NULL;
+    ACPI_NFIT_SMBIOS        *SmbiosInfo = NULL;
+    ACPI_NFIT_FLUSH_ADDRESS *Hint = NULL;
+    UINT32                  i;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoNfit);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_NFIT_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* NFIT subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoNfitHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        switch (SubTable->Type)
+        {
+        case ACPI_NFIT_TYPE_SYSTEM_ADDRESS:
+
+            InfoTable = AcpiDmTableInfoNfit0;
+            break;
+
+        case ACPI_NFIT_TYPE_MEMORY_MAP:
+
+            InfoTable = AcpiDmTableInfoNfit1;
+            break;
+
+        case ACPI_NFIT_TYPE_INTERLEAVE:
+
+            /* Has a variable number of 32-bit values at the end */
+
+            InfoTable = AcpiDmTableInfoNfit2;
+            Interleave = ACPI_CAST_PTR (ACPI_NFIT_INTERLEAVE, SubTable);
+            FieldOffset = sizeof (ACPI_NFIT_INTERLEAVE);
+            break;
+
+        case ACPI_NFIT_TYPE_SMBIOS:
+
+            SmbiosInfo = ACPI_CAST_PTR (ACPI_NFIT_SMBIOS, SubTable);
+            InfoTable = AcpiDmTableInfoNfit3;
+            break;
+
+        case ACPI_NFIT_TYPE_CONTROL_REGION:
+
+            InfoTable = AcpiDmTableInfoNfit4;
+            break;
+
+        case ACPI_NFIT_TYPE_DATA_REGION:
+
+            InfoTable = AcpiDmTableInfoNfit5;
+            break;
+
+        case ACPI_NFIT_TYPE_FLUSH_ADDRESS:
+
+            /* Has a variable number of 64-bit addresses at the end */
+
+            InfoTable = AcpiDmTableInfoNfit6;
+            Hint = ACPI_CAST_PTR (ACPI_NFIT_FLUSH_ADDRESS, SubTable);
+            FieldOffset = sizeof (ACPI_NFIT_FLUSH_ADDRESS) - sizeof (UINT64);
+            break;
+
+        default:
+            AcpiOsPrintf ("\n**** Unknown NFIT subtable type 0x%X\n",
+                SubTable->Type);
+
+            /* Attempt to continue */
+
+            if (!SubTable->Length)
+            {
+                AcpiOsPrintf ("Invalid zero length subtable\n");
+                return;
+            }
+            goto NextSubTable;
+        }
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Per-subtable variable-length fields */
+
+        switch (SubTable->Type)
+        {
+        case ACPI_NFIT_TYPE_INTERLEAVE:
+
+            for (i = 0; i < Interleave->LineCount; i++)
+            {
+                Status = AcpiDmDumpTable (Table->Length, Offset + FieldOffset,
+                    &Interleave->LineOffset[i],
+                    sizeof (UINT32), AcpiDmTableInfoNfit2a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                FieldOffset += sizeof (UINT32);
+            }
+            break;
+
+        case ACPI_NFIT_TYPE_SMBIOS:
+
+            Length = SubTable->Length -
+                sizeof (ACPI_NFIT_SMBIOS) + sizeof (UINT8);
+
+            if (Length)
+            {
+                Status = AcpiDmDumpTable (Table->Length,
+                    sizeof (ACPI_NFIT_SMBIOS) - sizeof (UINT8),
+                    SmbiosInfo,
+                    Length, AcpiDmTableInfoNfit3a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+            }
+
+            break;
+
+        case ACPI_NFIT_TYPE_FLUSH_ADDRESS:
+
+            for (i = 0; i < Hint->HintCount; i++)
+            {
+                Status = AcpiDmDumpTable (Table->Length, Offset + FieldOffset,
+                    &Hint->HintAddress[i],
+                    sizeof (UINT64), AcpiDmTableInfoNfit6a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                FieldOffset += sizeof (UINT64);
+            }
+            break;
+
+        default:
+            break;
+        }
+
+NextSubTable:
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_NFIT_HEADER, SubTable, SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpPcct
+ *
+ * PARAMETERS:  Table               - A PCCT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a PCCT. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpPcct (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_PCCT_SUBSPACE      *SubTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_PCCT);
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoPcct);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_PCCT_SUBSPACE, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Header.Length, AcpiDmTableInfoPcctHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        switch (SubTable->Header.Type)
+        {
+        case ACPI_PCCT_TYPE_GENERIC_SUBSPACE:
+
+            InfoTable = AcpiDmTableInfoPcct0;
+            break;
+
+        case ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE:
+
+            InfoTable = AcpiDmTableInfoPcct1;
+            break;
+
+        case ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE_TYPE2:
+
+            InfoTable = AcpiDmTableInfoPcct2;
+            break;
+
+        default:
+
+            AcpiOsPrintf (
+                "\n**** Unexpected or unknown PCCT subtable type 0x%X\n\n",
+                SubTable->Header.Type);
+            return;
+        }
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Header.Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable */
+
+        Offset += SubTable->Header.Length;
+        SubTable = ACPI_ADD_PTR (ACPI_PCCT_SUBSPACE, SubTable,
+            SubTable->Header.Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpPmtt
+ *
+ * PARAMETERS:  Table               - A PMTT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a PMTT. This table type consists
+ *              of an open-ended number of subtables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpPmtt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_PMTT_HEADER        *SubTable;
+    ACPI_PMTT_HEADER        *MemSubTable;
+    ACPI_PMTT_HEADER        *DimmSubTable;
+    ACPI_PMTT_DOMAIN        *DomainArray;
+    UINT32                  Length = Table->Length;
+    UINT32                  Offset = sizeof (ACPI_TABLE_PMTT);
+    UINT32                  MemOffset;
+    UINT32                  DimmOffset;
+    UINT32                  DomainOffset;
+    UINT32                  DomainCount;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoPmtt);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_PMTT_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoPmttHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Only Socket subtables are expected at this level */
+
+        if (SubTable->Type != ACPI_PMTT_TYPE_SOCKET)
+        {
+            AcpiOsPrintf (
+                "\n**** Unexpected or unknown PMTT subtable type 0x%X\n\n",
+                SubTable->Type);
+            return;
+        }
+
+        /* Dump the fixed-length portion of the subtable */
+
+        Status = AcpiDmDumpTable (Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoPmtt0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Walk the memory controller subtables */
+
+        MemOffset = sizeof (ACPI_PMTT_SOCKET);
+        MemSubTable = ACPI_ADD_PTR (ACPI_PMTT_HEADER, SubTable,
+            sizeof (ACPI_PMTT_SOCKET));
+
+        while (((Offset + MemOffset) < Table->Length) &&
+            (MemOffset < SubTable->Length))
+        {
+            /* Common subtable header */
+
+            AcpiOsPrintf ("\n");
+            Status = AcpiDmDumpTable (Length,
+                Offset + MemOffset, MemSubTable,
+                MemSubTable->Length, AcpiDmTableInfoPmttHdr);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+
+            /* Only memory controller subtables are expected at this level */
+
+            if (MemSubTable->Type != ACPI_PMTT_TYPE_CONTROLLER)
+            {
+                AcpiOsPrintf (
+                    "\n**** Unexpected or unknown PMTT subtable type 0x%X\n\n",
+                    MemSubTable->Type);
+                return;
+            }
+
+            /* Dump the fixed-length portion of the controller subtable */
+
+            Status = AcpiDmDumpTable (Length,
+                Offset + MemOffset, MemSubTable,
+                MemSubTable->Length, AcpiDmTableInfoPmtt1);
+            if (ACPI_FAILURE (Status))
+            {
+                return;
+            }
+
+            /* Walk the variable count of proximity domains */
+
+            DomainCount = ((ACPI_PMTT_CONTROLLER *) MemSubTable)->DomainCount;
+            DomainOffset = sizeof (ACPI_PMTT_CONTROLLER);
+            DomainArray = ACPI_ADD_PTR (ACPI_PMTT_DOMAIN, MemSubTable,
+                sizeof (ACPI_PMTT_CONTROLLER));
+
+            while (((Offset + MemOffset + DomainOffset) < Table->Length) &&
+                ((MemOffset + DomainOffset) < SubTable->Length) &&
+                DomainCount)
+            {
+                Status = AcpiDmDumpTable (Length,
+                    Offset + MemOffset + DomainOffset, DomainArray,
+                    sizeof (ACPI_PMTT_DOMAIN), AcpiDmTableInfoPmtt1a);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                DomainOffset += sizeof (ACPI_PMTT_DOMAIN);
+                DomainArray++;
+                DomainCount--;
+            }
+
+            if (DomainCount)
+            {
+                AcpiOsPrintf (
+                    "\n**** DomainCount exceeds subtable length\n\n");
+            }
+
+            /* Walk the physical component (DIMM) subtables */
+
+            DimmOffset = DomainOffset;
+            DimmSubTable = ACPI_ADD_PTR (ACPI_PMTT_HEADER, MemSubTable,
+                DomainOffset);
+
+            while (((Offset + MemOffset + DimmOffset) < Table->Length) &&
+                (DimmOffset < MemSubTable->Length))
+            {
+                /* Common subtable header */
+
+                AcpiOsPrintf ("\n");
+                Status = AcpiDmDumpTable (Length,
+                    Offset + MemOffset + DimmOffset, DimmSubTable,
+                    DimmSubTable->Length, AcpiDmTableInfoPmttHdr);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                /* Only DIMM subtables are expected at this level */
+
+                if (DimmSubTable->Type != ACPI_PMTT_TYPE_DIMM)
+                {
+                    AcpiOsPrintf (
+                        "\n**** Unexpected or unknown PMTT subtable type 0x%X\n\n",
+                        DimmSubTable->Type);
+                    return;
+                }
+
+                /* Dump the fixed-length DIMM subtable */
+
+                Status = AcpiDmDumpTable (Length,
+                    Offset + MemOffset + DimmOffset, DimmSubTable,
+                    DimmSubTable->Length, AcpiDmTableInfoPmtt2);
+                if (ACPI_FAILURE (Status))
+                {
+                    return;
+                }
+
+                /* Point to next DIMM subtable */
+
+                DimmOffset += DimmSubTable->Length;
+                DimmSubTable = ACPI_ADD_PTR (ACPI_PMTT_HEADER,
+                    DimmSubTable, DimmSubTable->Length);
+            }
+
+            /* Point to next Controller subtable */
+
+            MemOffset += MemSubTable->Length;
+            MemSubTable = ACPI_ADD_PTR (ACPI_PMTT_HEADER,
+                MemSubTable, MemSubTable->Length);
+        }
+
+        /* Point to next Socket subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_PMTT_HEADER,
+            SubTable, SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpS3pt
+ *
+ * PARAMETERS:  Table               - A S3PT table
+ *
+ * RETURN:      Length of the table
+ *
+ * DESCRIPTION: Format the contents of a S3PT
+ *
+ ******************************************************************************/
+
+UINT32
+AcpiDmDumpS3pt (
+    ACPI_TABLE_HEADER       *Tables)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_S3PT);
+    ACPI_FPDT_HEADER        *SubTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_TABLE_S3PT         *S3ptTable = ACPI_CAST_PTR (ACPI_TABLE_S3PT, Tables);
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Offset, 0, S3ptTable, 0, AcpiDmTableInfoS3pt);
+    if (ACPI_FAILURE (Status))
+    {
+        return 0;
+    }
+
+    SubTable = ACPI_ADD_PTR (ACPI_FPDT_HEADER, S3ptTable, Offset);
+    while (Offset < S3ptTable->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (S3ptTable->Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoS3ptHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return 0;
+        }
+
+        switch (SubTable->Type)
+        {
+        case ACPI_S3PT_TYPE_RESUME:
+
+            InfoTable = AcpiDmTableInfoS3pt0;
+            break;
+
+        case ACPI_S3PT_TYPE_SUSPEND:
+
+            InfoTable = AcpiDmTableInfoS3pt1;
+            break;
+
+        default:
+
+            AcpiOsPrintf ("\n**** Unknown S3PT subtable type 0x%X\n",
+                SubTable->Type);
+
+            /* Attempt to continue */
+
+            if (!SubTable->Length)
+            {
+                AcpiOsPrintf ("Invalid zero length subtable\n");
+                return 0;
+            }
+            goto NextSubTable;
+        }
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (S3ptTable->Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return 0;
+        }
+
+NextSubTable:
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_FPDT_HEADER, SubTable, SubTable->Length);
+    }
+
+    return (S3ptTable->Length);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpSlic
+ *
+ * PARAMETERS:  Table               - A SLIC table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a SLIC
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpSlic (
+    ACPI_TABLE_HEADER       *Table)
+{
+
+    (void) AcpiDmDumpTable (Table->Length, sizeof (ACPI_TABLE_HEADER), Table,
+        Table->Length - sizeof (*Table), AcpiDmTableInfoSlic);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpSlit
+ *
+ * PARAMETERS:  Table               - An SLIT
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a SLIT
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpSlit (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset;
+    UINT8                   *Row;
+    UINT32                  Localities;
+    UINT32                  i;
+    UINT32                  j;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoSlit);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Display the Locality NxN Matrix */
+
+    Localities = (UINT32) ACPI_CAST_PTR (ACPI_TABLE_SLIT, Table)->LocalityCount;
+    Offset = ACPI_OFFSET (ACPI_TABLE_SLIT, Entry[0]);
+    Row = (UINT8 *) ACPI_CAST_PTR (ACPI_TABLE_SLIT, Table)->Entry;
+
+    for (i = 0; i < Localities; i++)
+    {
+        /* Display one row of the matrix */
+
+        AcpiDmLineHeader2 (Offset, Localities, "Locality", i);
+        for  (j = 0; j < Localities; j++)
+        {
+            /* Check for beyond EOT */
+
+            if (Offset >= Table->Length)
+            {
+                AcpiOsPrintf (
+                    "\n**** Not enough room in table for all localities\n");
+                return;
+            }
+
+            AcpiOsPrintf ("%2.2X", Row[j]);
+            Offset++;
+
+            /* Display up to 16 bytes per output row */
+
+            if ((j+1) < Localities)
+            {
+                AcpiOsPrintf (" ");
+
+                if (j && (((j+1) % 16) == 0))
+                {
+                    AcpiOsPrintf ("\\\n"); /* With line continuation char */
+                    AcpiDmLineHeader (Offset, 0, NULL);
+                }
+            }
+        }
+
+        /* Point to next row */
+
+        AcpiOsPrintf ("\n");
+        Row += Localities;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpSrat
+ *
+ * PARAMETERS:  Table               - A SRAT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a SRAT
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpSrat (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_SRAT);
+    ACPI_SUBTABLE_HEADER    *SubTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoSrat);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_SUBTABLE_HEADER, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Length, AcpiDmTableInfoSratHdr);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        switch (SubTable->Type)
+        {
+        case ACPI_SRAT_TYPE_CPU_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat0;
+            break;
+
+        case ACPI_SRAT_TYPE_MEMORY_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat1;
+            break;
+
+        case ACPI_SRAT_TYPE_X2APIC_CPU_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat2;
+            break;
+
+        case ACPI_SRAT_TYPE_GICC_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat3;
+            break;
+
+        default:
+            AcpiOsPrintf ("\n**** Unknown SRAT subtable type 0x%X\n",
+                SubTable->Type);
+
+            /* Attempt to continue */
+
+            if (!SubTable->Length)
+            {
+                AcpiOsPrintf ("Invalid zero length subtable\n");
+                return;
+            }
+            goto NextSubTable;
+        }
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            SubTable->Length, InfoTable);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+NextSubTable:
+        /* Point to next subtable */
+
+        Offset += SubTable->Length;
+        SubTable = ACPI_ADD_PTR (ACPI_SUBTABLE_HEADER, SubTable,
+            SubTable->Length);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpStao
+ *
+ * PARAMETERS:  Table               - A STAO table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a STAO. This is a variable-length
+ *              table that contains an open-ended number of ASCII strings
+ *              at the end of the table.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpStao (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    char                    *Namepath;
+    UINT32                  Length = Table->Length;
+    UINT32                  StringLength;
+    UINT32                  Offset = sizeof (ACPI_TABLE_STAO);
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoStao);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* The rest of the table consists of Namepath strings */
+
+    while (Offset < Table->Length)
+    {
+        Namepath = ACPI_ADD_PTR (char, Table, Offset);
+        StringLength = strlen (Namepath) + 1;
+
+        AcpiDmLineHeader (Offset, StringLength, "Namestring");
+        AcpiOsPrintf ("\"%s\"\n", Namepath);
+
+        /* Point to next namepath */
+
+        Offset += StringLength;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpTcpa
+ *
+ * PARAMETERS:  Table               - A TCPA table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a TCPA.
+ *
+ * NOTE:        There are two versions of the table with the same signature:
+ *              the client version and the server version. The common
+ *              PlatformClass field is used to differentiate the two types of
+ *              tables.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpTcpa (
+    ACPI_TABLE_HEADER       *Table)
+{
+    UINT32                  Offset = sizeof (ACPI_TABLE_TCPA_HDR);
+    ACPI_TABLE_TCPA_HDR     *CommonHeader = ACPI_CAST_PTR (
+                                ACPI_TABLE_TCPA_HDR, Table);
+    ACPI_TABLE_TCPA_HDR     *SubTable = ACPI_ADD_PTR (
+                                ACPI_TABLE_TCPA_HDR, Table, Offset);
+    ACPI_STATUS             Status;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table,
+        0, AcpiDmTableInfoTcpaHdr);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /*
+     * Examine the PlatformClass field to determine the table type.
+     * Either a client or server table. Only one.
+     */
+    switch (CommonHeader->PlatformClass)
+    {
+    case ACPI_TCPA_CLIENT_TABLE:
+
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            Table->Length - Offset, AcpiDmTableInfoTcpaClient);
+        break;
+
+    case ACPI_TCPA_SERVER_TABLE:
+
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            Table->Length - Offset, AcpiDmTableInfoTcpaServer);
+        break;
+
+    default:
+
+        AcpiOsPrintf ("\n**** Unknown TCPA Platform Class 0x%X\n",
+            CommonHeader->PlatformClass);
+        Status = AE_ERROR;
+        break;
+    }
+
+    if (ACPI_FAILURE (Status))
+    {
+        AcpiOsPrintf ("\n**** Cannot disassemble TCPA table\n");
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpVrtc
+ *
+ * PARAMETERS:  Table               - A VRTC table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a VRTC
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpVrtc (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_VRTC);
+    ACPI_VRTC_ENTRY         *SubTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoVrtc);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_VRTC_ENTRY, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            sizeof (ACPI_VRTC_ENTRY), AcpiDmTableInfoVrtc0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable */
+
+        Offset += sizeof (ACPI_VRTC_ENTRY);
+        SubTable = ACPI_ADD_PTR (ACPI_VRTC_ENTRY, SubTable,
+            sizeof (ACPI_VRTC_ENTRY));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpWdat
+ *
+ * PARAMETERS:  Table               - A WDAT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a WDAT
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpWdat (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset = sizeof (ACPI_TABLE_WDAT);
+    ACPI_WDAT_ENTRY         *SubTable;
+
+
+    /* Main table */
+
+    Status = AcpiDmDumpTable (Table->Length, 0, Table, 0, AcpiDmTableInfoWdat);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Subtables */
+
+    SubTable = ACPI_ADD_PTR (ACPI_WDAT_ENTRY, Table, Offset);
+    while (Offset < Table->Length)
+    {
+        /* Common subtable header */
+
+        AcpiOsPrintf ("\n");
+        Status = AcpiDmDumpTable (Table->Length, Offset, SubTable,
+            sizeof (ACPI_WDAT_ENTRY), AcpiDmTableInfoWdat0);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        /* Point to next subtable */
+
+        Offset += sizeof (ACPI_WDAT_ENTRY);
+        SubTable = ACPI_ADD_PTR (ACPI_WDAT_ENTRY, SubTable,
+            sizeof (ACPI_WDAT_ENTRY));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiDmDumpWpbt
+ *
+ * PARAMETERS:  Table               - A WPBT table
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Format the contents of a WPBT. This table type consists
+ *              of an open-ended arguments buffer at the end of the table.
+ *
+ ******************************************************************************/
+
+void
+AcpiDmDumpWpbt (
+    ACPI_TABLE_HEADER       *Table)
+{
+    ACPI_STATUS             Status;
+    ACPI_TABLE_WPBT         *SubTable;
+    UINT32                  Length = Table->Length;
+    UINT16                  ArgumentsLength;
+
+
+    /* Dump the main table */
+
+    Status = AcpiDmDumpTable (Length, 0, Table, 0, AcpiDmTableInfoWpbt);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* Extract the arguments buffer length from the main table */
+
+    SubTable = ACPI_CAST_PTR (ACPI_TABLE_WPBT, Table);
+    ArgumentsLength = SubTable->ArgumentsLength;
+
+    /* Dump the arguments buffer */
+
+    (void) AcpiDmDumpTable (Table->Length, 0, Table, ArgumentsLength,
+        AcpiDmTableInfoWpbt0);
+}
diff --git a/usr/src/cmd/acpi/common/dmtbinfo.c b/usr/src/cmd/acpi/common/dmtbinfo.c
new file mode 100644
index 0000000000..2ae6594d25
--- /dev/null
+++ b/usr/src/cmd/acpi/common/dmtbinfo.c
@@ -0,0 +1,2991 @@
+/******************************************************************************
+ *
+ * Module Name: dmtbinfo - Table info for non-AML tables
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acdisasm.h"
+
+/* This module used for application-level code only */
+
+#define _COMPONENT          ACPI_CA_DISASSEMBLER
+        ACPI_MODULE_NAME    ("dmtbinfo")
+
+/*
+ * How to add a new table:
+ *
+ * - Add the C table definition to the actbl1.h or actbl2.h header.
+ * - Add ACPI_xxxx_OFFSET macro(s) for the table (and subtables) to list below.
+ * - Define the table in this file (for the disassembler). If any
+ *   new data types are required (ACPI_DMT_*), see below.
+ * - Add an external declaration for the new table definition (AcpiDmTableInfo*)
+ *     in acdisam.h
+ * - Add new table definition to the dispatch table in dmtable.c (AcpiDmTableData)
+ *     If a simple table (with no subtables), no disassembly code is needed.
+ *     Otherwise, create the AcpiDmDump* function for to disassemble the table
+ *     and add it to the dmtbdump.c file.
+ * - Add an external declaration for the new AcpiDmDump* function in acdisasm.h
+ * - Add the new AcpiDmDump* function to the dispatch table in dmtable.c
+ * - Create a template for the new table
+ * - Add data table compiler support
+ *
+ * How to add a new data type (ACPI_DMT_*):
+ *
+ * - Add new type at the end of the ACPI_DMT list in acdisasm.h
+ * - Add length and implementation cases in dmtable.c  (disassembler)
+ * - Add type and length cases in dtutils.c (DT compiler)
+ */
+
+/*
+ * Macros used to generate offsets to specific table fields
+ */
+#define ACPI_FACS_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_FACS,f)
+#define ACPI_GAS_OFFSET(f)              (UINT16) ACPI_OFFSET (ACPI_GENERIC_ADDRESS,f)
+#define ACPI_HDR_OFFSET(f)              (UINT16) ACPI_OFFSET (ACPI_TABLE_HEADER,f)
+#define ACPI_RSDP_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_RSDP,f)
+#define ACPI_BERT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_BERT,f)
+#define ACPI_BGRT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_BGRT,f)
+#define ACPI_BOOT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_BOOT,f)
+#define ACPI_CPEP_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_CPEP,f)
+#define ACPI_DBG2_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_DBG2,f)
+#define ACPI_DBGP_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_DBGP,f)
+#define ACPI_DMAR_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_DMAR,f)
+#define ACPI_DRTM_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_DRTM,f)
+#define ACPI_ECDT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_ECDT,f)
+#define ACPI_EINJ_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_EINJ,f)
+#define ACPI_ERST_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_ERST,f)
+#define ACPI_GTDT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_GTDT,f)
+#define ACPI_HEST_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_HEST,f)
+#define ACPI_HPET_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_HPET,f)
+#define ACPI_IORT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_IORT,f)
+#define ACPI_IVRS_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_IVRS,f)
+#define ACPI_MADT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_MADT,f)
+#define ACPI_MCFG_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_MCFG,f)
+#define ACPI_MCHI_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_MCHI,f)
+#define ACPI_MPST_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_MPST,f)
+#define ACPI_MSCT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_MSCT,f)
+#define ACPI_NFIT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_NFIT,f)
+#define ACPI_PCCT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_PCCT,f)
+#define ACPI_PMTT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_PMTT,f)
+#define ACPI_S3PT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_S3PT,f)
+#define ACPI_SBST_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_SBST,f)
+#define ACPI_SLIT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_SLIT,f)
+#define ACPI_SPCR_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_SPCR,f)
+#define ACPI_SPMI_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_SPMI,f)
+#define ACPI_SRAT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_SRAT,f)
+#define ACPI_STAO_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_STAO,f)
+#define ACPI_TCPA_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_TCPA_HDR,f)
+#define ACPI_TPM2_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_TPM2,f)
+#define ACPI_UEFI_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_UEFI,f)
+#define ACPI_WAET_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_WAET,f)
+#define ACPI_WDAT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_WDAT,f)
+#define ACPI_WDDT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_WDDT,f)
+#define ACPI_WDRT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_WDRT,f)
+#define ACPI_WPBT_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_WPBT,f)
+#define ACPI_XENV_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_XENV,f)
+
+/* Subtables */
+
+#define ACPI_ASF0_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_ASF_INFO,f)
+#define ACPI_ASF1_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_ASF_ALERT,f)
+#define ACPI_ASF1a_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_ASF_ALERT_DATA,f)
+#define ACPI_ASF2_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_ASF_REMOTE,f)
+#define ACPI_ASF2a_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_ASF_CONTROL_DATA,f)
+#define ACPI_ASF3_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_ASF_RMCP,f)
+#define ACPI_ASF4_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_ASF_ADDRESS,f)
+#define ACPI_CPEP0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_CPEP_POLLING,f)
+#define ACPI_CSRT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_CSRT_GROUP,f)
+#define ACPI_CSRT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_CSRT_SHARED_INFO,f)
+#define ACPI_CSRT2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_CSRT_DESCRIPTOR,f)
+#define ACPI_DBG20_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DBG2_DEVICE,f)
+#define ACPI_DMARS_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DMAR_DEVICE_SCOPE,f)
+#define ACPI_DMAR0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DMAR_HARDWARE_UNIT,f)
+#define ACPI_DMAR1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DMAR_RESERVED_MEMORY,f)
+#define ACPI_DMAR2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DMAR_ATSR,f)
+#define ACPI_DMAR3_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DMAR_RHSA,f)
+#define ACPI_DMAR4_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DMAR_ANDD,f)
+#define ACPI_DRTM0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DRTM_VTABLE_LIST,f)
+#define ACPI_DRTM1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DRTM_RESOURCE_LIST,f)
+#define ACPI_DRTM1a_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_DRTM_RESOURCE,f)
+#define ACPI_DRTM2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_DRTM_DPS_ID,f)
+#define ACPI_EINJ0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_WHEA_HEADER,f)
+#define ACPI_ERST0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_WHEA_HEADER,f)
+#define ACPI_FPDTH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_FPDT_HEADER,f)
+#define ACPI_FPDT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_FPDT_BOOT_POINTER,f)
+#define ACPI_FPDT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_FPDT_S3PT_POINTER,f)
+#define ACPI_GTDT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_GTDT_TIMER_BLOCK,f)
+#define ACPI_GTDT0a_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_GTDT_TIMER_ENTRY,f)
+#define ACPI_GTDT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_GTDT_WATCHDOG,f)
+#define ACPI_GTDTH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_GTDT_HEADER,f)
+#define ACPI_HEST0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_IA_MACHINE_CHECK,f)
+#define ACPI_HEST1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_IA_CORRECTED,f)
+#define ACPI_HEST2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_IA_NMI,f)
+#define ACPI_HEST6_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_AER_ROOT,f)
+#define ACPI_HEST7_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_AER,f)
+#define ACPI_HEST8_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_AER_BRIDGE,f)
+#define ACPI_HEST9_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_GENERIC,f)
+#define ACPI_HEST10_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_HEST_GENERIC_V2,f)
+#define ACPI_HESTN_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_NOTIFY,f)
+#define ACPI_HESTB_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_HEST_IA_ERROR_BANK,f)
+#define ACPI_IORT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_ITS_GROUP,f)
+#define ACPI_IORT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_NAMED_COMPONENT,f)
+#define ACPI_IORT2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_ROOT_COMPLEX,f)
+#define ACPI_IORT3_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_SMMU,f)
+#define ACPI_IORT4_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_SMMU_V3,f)
+#define ACPI_IORTA_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_MEMORY_ACCESS,f)
+#define ACPI_IORTH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_NODE,f)
+#define ACPI_IORTM_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IORT_ID_MAPPING,f)
+#define ACPI_IVRSH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IVRS_HEADER,f)
+#define ACPI_IVRS0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IVRS_HARDWARE,f)
+#define ACPI_IVRS1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IVRS_MEMORY,f)
+#define ACPI_IVRSD_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_IVRS_DE_HEADER,f)
+#define ACPI_IVRS8A_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_IVRS_DEVICE8A,f)
+#define ACPI_IVRS8B_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_IVRS_DEVICE8B,f)
+#define ACPI_IVRS8C_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_IVRS_DEVICE8C,f)
+#define ACPI_LPITH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_LPIT_HEADER,f)
+#define ACPI_LPIT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_LPIT_NATIVE,f)
+#define ACPI_MADT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_LOCAL_APIC,f)
+#define ACPI_MADT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_IO_APIC,f)
+#define ACPI_MADT2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_INTERRUPT_OVERRIDE,f)
+#define ACPI_MADT3_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_NMI_SOURCE,f)
+#define ACPI_MADT4_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_LOCAL_APIC_NMI,f)
+#define ACPI_MADT5_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_LOCAL_APIC_OVERRIDE,f)
+#define ACPI_MADT6_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_IO_SAPIC,f)
+#define ACPI_MADT7_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_LOCAL_SAPIC,f)
+#define ACPI_MADT8_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_INTERRUPT_SOURCE,f)
+#define ACPI_MADT9_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MADT_LOCAL_X2APIC,f)
+#define ACPI_MADT10_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MADT_LOCAL_X2APIC_NMI,f)
+#define ACPI_MADT11_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MADT_GENERIC_INTERRUPT,f)
+#define ACPI_MADT12_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MADT_GENERIC_DISTRIBUTOR,f)
+#define ACPI_MADT13_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MADT_GENERIC_MSI_FRAME,f)
+#define ACPI_MADT14_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MADT_GENERIC_REDISTRIBUTOR,f)
+#define ACPI_MADT15_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MADT_GENERIC_TRANSLATOR,f)
+#define ACPI_MADTH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_SUBTABLE_HEADER,f)
+#define ACPI_MCFG0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MCFG_ALLOCATION,f)
+#define ACPI_MPST0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MPST_POWER_NODE,f)
+#define ACPI_MPST0A_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MPST_POWER_STATE,f)
+#define ACPI_MPST0B_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_MPST_COMPONENT,f)
+#define ACPI_MPST1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MPST_DATA_HDR,f)
+#define ACPI_MPST2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MPST_POWER_DATA,f)
+#define ACPI_MSCT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MSCT_PROXIMITY,f)
+#define ACPI_MTMR0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_MTMR_ENTRY,f)
+#define ACPI_NFITH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_HEADER,f)
+#define ACPI_NFIT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_SYSTEM_ADDRESS,f)
+#define ACPI_NFIT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_MEMORY_MAP,f)
+#define ACPI_NFIT2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_INTERLEAVE,f)
+#define ACPI_NFIT3_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_SMBIOS,f)
+#define ACPI_NFIT4_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_CONTROL_REGION,f)
+#define ACPI_NFIT5_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_DATA_REGION,f)
+#define ACPI_NFIT6_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_NFIT_FLUSH_ADDRESS,f)
+#define ACPI_PCCT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_PCCT_SUBSPACE,f)
+#define ACPI_PCCT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_PCCT_HW_REDUCED,f)
+#define ACPI_PCCT2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_PCCT_HW_REDUCED_TYPE2,f)
+#define ACPI_PMTT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_PMTT_SOCKET,f)
+#define ACPI_PMTT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_PMTT_CONTROLLER,f)
+#define ACPI_PMTT1A_OFFSET(f)           (UINT16) ACPI_OFFSET (ACPI_PMTT_DOMAIN,f)
+#define ACPI_PMTT2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_PMTT_PHYSICAL_COMPONENT,f)
+#define ACPI_PMTTH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_PMTT_HEADER,f)
+#define ACPI_S3PTH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_FPDT_HEADER,f)
+#define ACPI_S3PT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_S3PT_RESUME,f)
+#define ACPI_S3PT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_S3PT_SUSPEND,f)
+#define ACPI_SLIC_OFFSET(f)             (UINT16) ACPI_OFFSET (ACPI_TABLE_SLIC,f)
+#define ACPI_SRATH_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_SUBTABLE_HEADER,f)
+#define ACPI_SRAT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_SRAT_CPU_AFFINITY,f)
+#define ACPI_SRAT1_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_SRAT_MEM_AFFINITY,f)
+#define ACPI_SRAT2_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_SRAT_X2APIC_CPU_AFFINITY,f)
+#define ACPI_SRAT3_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_SRAT_GICC_AFFINITY,f)
+#define ACPI_TCPA_CLIENT_OFFSET(f)      (UINT16) ACPI_OFFSET (ACPI_TABLE_TCPA_CLIENT,f)
+#define ACPI_TCPA_SERVER_OFFSET(f)      (UINT16) ACPI_OFFSET (ACPI_TABLE_TCPA_SERVER,f)
+#define ACPI_VRTC0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_VRTC_ENTRY,f)
+#define ACPI_WDAT0_OFFSET(f)            (UINT16) ACPI_OFFSET (ACPI_WDAT_ENTRY,f)
+
+/*
+ * Simplify access to flag fields by breaking them up into bytes
+ */
+#define ACPI_FLAG_OFFSET(d,f,o)         (UINT16) (ACPI_OFFSET (d,f) + o)
+
+/* Flags */
+
+#define ACPI_DRTM_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_DRTM,f,o)
+#define ACPI_DRTM1a_FLAG_OFFSET(f,o)    ACPI_FLAG_OFFSET (ACPI_DRTM_RESOURCE,f,o)
+#define ACPI_FADT_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_FADT,f,o)
+#define ACPI_FACS_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_FACS,f,o)
+#define ACPI_HPET_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_HPET,f,o)
+#define ACPI_SRAT0_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_SRAT_CPU_AFFINITY,f,o)
+#define ACPI_SRAT1_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_SRAT_MEM_AFFINITY,f,o)
+#define ACPI_SRAT2_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_SRAT_X2APIC_CPU_AFFINITY,f,o)
+#define ACPI_SRAT3_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_SRAT_GICC_AFFINITY,f,o)
+#define ACPI_GTDT_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_GTDT,f,o)
+#define ACPI_GTDT0a_FLAG_OFFSET(f,o)    ACPI_FLAG_OFFSET (ACPI_GTDT_TIMER_ENTRY,f,o)
+#define ACPI_GTDT1_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_GTDT_WATCHDOG,f,o)
+#define ACPI_IORT3_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_IORT_SMMU,f,o)
+#define ACPI_IORT4_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_IORT_SMMU_V3,f,o)
+#define ACPI_IORTA_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_IORT_MEMORY_ACCESS,f,o)
+#define ACPI_IORTM_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_IORT_ID_MAPPING,f,o)
+#define ACPI_LPITH_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_LPIT_HEADER,f,o)
+#define ACPI_MADT_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_MADT,f,o)
+#define ACPI_MADT0_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MADT_LOCAL_APIC,f,o)
+#define ACPI_MADT2_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MADT_INTERRUPT_OVERRIDE,f,o)
+#define ACPI_MADT3_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MADT_NMI_SOURCE,f,o)
+#define ACPI_MADT4_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MADT_LOCAL_APIC_NMI,f,o)
+#define ACPI_MADT7_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MADT_LOCAL_SAPIC,f,o)
+#define ACPI_MADT8_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MADT_INTERRUPT_SOURCE,f,o)
+#define ACPI_MADT9_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MADT_LOCAL_X2APIC,f,o)
+#define ACPI_MADT10_FLAG_OFFSET(f,o)    ACPI_FLAG_OFFSET (ACPI_MADT_LOCAL_X2APIC_NMI,f,o)
+#define ACPI_MADT11_FLAG_OFFSET(f,o)    ACPI_FLAG_OFFSET (ACPI_MADT_GENERIC_INTERRUPT,f,o)
+#define ACPI_MADT13_FLAG_OFFSET(f,o)    ACPI_FLAG_OFFSET (ACPI_MADT_GENERIC_MSI_FRAME,f,o)
+#define ACPI_MPST0_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MPST_POWER_NODE,f,o)
+#define ACPI_MPST2_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_MPST_POWER_DATA,f,o)
+#define ACPI_NFIT0_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_NFIT_SYSTEM_ADDRESS,f,o)
+#define ACPI_NFIT1_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_NFIT_MEMORY_MAP,f,o)
+#define ACPI_NFIT4_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_NFIT_CONTROL_REGION,f,o)
+#define ACPI_PCCT_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_PCCT,f,o)
+#define ACPI_PCCT1_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_PCCT_HW_REDUCED,f,o)
+#define ACPI_PCCT2_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_PCCT_HW_REDUCED_TYPE2,f,o)
+#define ACPI_PMTTH_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_PMTT_HEADER,f,o)
+#define ACPI_WDDT_FLAG_OFFSET(f,o)      ACPI_FLAG_OFFSET (ACPI_TABLE_WDDT,f,o)
+#define ACPI_EINJ0_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_WHEA_HEADER,f,o)
+#define ACPI_ERST0_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_WHEA_HEADER,f,o)
+#define ACPI_HEST0_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_HEST_IA_MACHINE_CHECK,f,o)
+#define ACPI_HEST1_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_HEST_IA_CORRECTED,f,o)
+#define ACPI_HEST6_FLAG_OFFSET(f,o)     ACPI_FLAG_OFFSET (ACPI_HEST_AER_ROOT,f,o)
+
+/*
+ * Required terminator for all tables below
+ */
+#define ACPI_DMT_TERMINATOR             {ACPI_DMT_EXIT, 0, NULL, 0}
+#define ACPI_DMT_NEW_LINE               {ACPI_DMT_EXTRA_TEXT, 0, "\n", 0}
+
+
+/*
+ * ACPI Table Information, used to dump formatted ACPI tables
+ *
+ * Each entry is of the form:  <Field Type, Field Offset, Field Name>
+ */
+
+/*******************************************************************************
+ *
+ * Common ACPI table header
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHeader[] =
+{
+    {ACPI_DMT_SIG,      ACPI_HDR_OFFSET (Signature[0]),             "Signature", 0},
+    {ACPI_DMT_UINT32,   ACPI_HDR_OFFSET (Length),                   "Table Length", DT_LENGTH},
+    {ACPI_DMT_UINT8,    ACPI_HDR_OFFSET (Revision),                 "Revision", 0},
+    {ACPI_DMT_CHKSUM,   ACPI_HDR_OFFSET (Checksum),                 "Checksum", 0},
+    {ACPI_DMT_NAME6,    ACPI_HDR_OFFSET (OemId[0]),                 "Oem ID", 0},
+    {ACPI_DMT_NAME8,    ACPI_HDR_OFFSET (OemTableId[0]),            "Oem Table ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_HDR_OFFSET (OemRevision),              "Oem Revision", 0},
+    {ACPI_DMT_NAME4,    ACPI_HDR_OFFSET (AslCompilerId[0]),         "Asl Compiler ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_HDR_OFFSET (AslCompilerRevision),      "Asl Compiler Revision", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * GAS - Generic Address Structure
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoGas[] =
+{
+    {ACPI_DMT_SPACEID,  ACPI_GAS_OFFSET (SpaceId),                  "Space ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_GAS_OFFSET (BitWidth),                 "Bit Width", 0},
+    {ACPI_DMT_UINT8,    ACPI_GAS_OFFSET (BitOffset),                "Bit Offset", 0},
+    {ACPI_DMT_ACCWIDTH, ACPI_GAS_OFFSET (AccessWidth),              "Encoded Access Width", 0},
+    {ACPI_DMT_UINT64,   ACPI_GAS_OFFSET (Address),                  "Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * RSDP - Root System Description Pointer (Signature is "RSD PTR ")
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoRsdp1[] =
+{
+    {ACPI_DMT_NAME8,    ACPI_RSDP_OFFSET (Signature[0]),            "Signature", 0},
+    {ACPI_DMT_UINT8,    ACPI_RSDP_OFFSET (Checksum),                "Checksum", 0},
+    {ACPI_DMT_NAME6,    ACPI_RSDP_OFFSET (OemId[0]),                "Oem ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_RSDP_OFFSET (Revision),                "Revision", 0},
+    {ACPI_DMT_UINT32,   ACPI_RSDP_OFFSET (RsdtPhysicalAddress),     "RSDT Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* ACPI 2.0+ Extensions */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoRsdp2[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_RSDP_OFFSET (Length),                  "Length", DT_LENGTH},
+    {ACPI_DMT_UINT64,   ACPI_RSDP_OFFSET (XsdtPhysicalAddress),     "XSDT Address", 0},
+    {ACPI_DMT_UINT8,    ACPI_RSDP_OFFSET (ExtendedChecksum),        "Extended Checksum", 0},
+    {ACPI_DMT_UINT24,   ACPI_RSDP_OFFSET (Reserved[0]),             "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * FACS - Firmware ACPI Control Structure
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFacs[] =
+{
+    {ACPI_DMT_NAME4,    ACPI_FACS_OFFSET (Signature[0]),            "Signature", 0},
+    {ACPI_DMT_UINT32,   ACPI_FACS_OFFSET (Length),                  "Length", DT_LENGTH},
+    {ACPI_DMT_UINT32,   ACPI_FACS_OFFSET (HardwareSignature),       "Hardware Signature", 0},
+    {ACPI_DMT_UINT32,   ACPI_FACS_OFFSET (FirmwareWakingVector),    "32 Firmware Waking Vector", 0},
+    {ACPI_DMT_UINT32,   ACPI_FACS_OFFSET (GlobalLock),              "Global Lock", 0},
+    {ACPI_DMT_UINT32,   ACPI_FACS_OFFSET (Flags),                   "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_FACS_FLAG_OFFSET (Flags,0),            "S4BIOS Support Present", 0},
+    {ACPI_DMT_FLAG1,    ACPI_FACS_FLAG_OFFSET (Flags,0),            "64-bit Wake Supported (V2)", 0},
+    {ACPI_DMT_UINT64,   ACPI_FACS_OFFSET (XFirmwareWakingVector),   "64 Firmware Waking Vector", 0},
+    {ACPI_DMT_UINT8,    ACPI_FACS_OFFSET (Version),                 "Version", 0},
+    {ACPI_DMT_UINT24,   ACPI_FACS_OFFSET (Reserved[0]),             "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_FACS_OFFSET (OspmFlags),               "OspmFlags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_FACS_FLAG_OFFSET (OspmFlags,0),        "64-bit Wake Env Required (V2)", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * FADT - Fixed ACPI Description Table (Signature is FACP)
+ *
+ ******************************************************************************/
+
+/* ACPI 1.0 FADT (Version 1) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFadt1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Facs),                    "FACS Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Dsdt),                    "DSDT Address", DT_NON_ZERO},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Model),                   "Model", 0},
+    {ACPI_DMT_FADTPM,   ACPI_FADT_OFFSET (PreferredProfile),        "PM Profile", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (SciInterrupt),            "SCI Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (SmiCommand),              "SMI Command Port", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (AcpiEnable),              "ACPI Enable Value", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (AcpiDisable),             "ACPI Disable Value", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (S4BiosRequest),           "S4BIOS Command", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (PstateControl),           "P-State Control", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Pm1aEventBlock),          "PM1A Event Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Pm1bEventBlock),          "PM1B Event Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Pm1aControlBlock),        "PM1A Control Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Pm1bControlBlock),        "PM1B Control Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Pm2ControlBlock),         "PM2 Control Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (PmTimerBlock),            "PM Timer Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Gpe0Block),               "GPE0 Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Gpe1Block),               "GPE1 Block Address", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Pm1EventLength),          "PM1 Event Block Length", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Pm1ControlLength),        "PM1 Control Block Length", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Pm2ControlLength),        "PM2 Control Block Length", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (PmTimerLength),           "PM Timer Block Length", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Gpe0BlockLength),         "GPE0 Block Length", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Gpe1BlockLength),         "GPE1 Block Length", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Gpe1Base),                "GPE1 Base Offset", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (CstControl),              "_CST Support", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (C2Latency),               "C2 Latency", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (C3Latency),               "C3 Latency", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (FlushSize),               "CPU Cache Size", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (FlushStride),             "Cache Flush Stride", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (DutyOffset),              "Duty Cycle Offset", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (DutyWidth),               "Duty Cycle Width", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (DayAlarm),                "RTC Day Alarm Index", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (MonthAlarm),              "RTC Month Alarm Index", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Century),                 "RTC Century Index", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (BootFlags),               "Boot Flags (decoded below)", DT_FLAG},
+
+    /* Boot Architecture Flags byte 0 */
+
+    {ACPI_DMT_FLAG0,    ACPI_FADT_FLAG_OFFSET (BootFlags,0),        "Legacy Devices Supported (V2)", 0},
+    {ACPI_DMT_FLAG1,    ACPI_FADT_FLAG_OFFSET (BootFlags,0),        "8042 Present on ports 60/64 (V2)", 0},
+    {ACPI_DMT_FLAG2,    ACPI_FADT_FLAG_OFFSET (BootFlags,0),        "VGA Not Present (V4)", 0},
+    {ACPI_DMT_FLAG3,    ACPI_FADT_FLAG_OFFSET (BootFlags,0),        "MSI Not Supported (V4)", 0},
+    {ACPI_DMT_FLAG4,    ACPI_FADT_FLAG_OFFSET (BootFlags,0),        "PCIe ASPM Not Supported (V4)", 0},
+    {ACPI_DMT_FLAG5,    ACPI_FADT_FLAG_OFFSET (BootFlags,0),        "CMOS RTC Not Present (V5)", 0},
+
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (Reserved),                "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_FADT_OFFSET (Flags),                   "Flags (decoded below)", DT_FLAG},
+
+    /* Flags byte 0 */
+
+    {ACPI_DMT_FLAG0,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "WBINVD instruction is operational (V1)", 0},
+    {ACPI_DMT_FLAG1,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "WBINVD flushes all caches (V1)", 0},
+    {ACPI_DMT_FLAG2,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "All CPUs support C1 (V1)", 0},
+    {ACPI_DMT_FLAG3,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "C2 works on MP system (V1)", 0},
+    {ACPI_DMT_FLAG4,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "Control Method Power Button (V1)", 0},
+    {ACPI_DMT_FLAG5,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "Control Method Sleep Button (V1)", 0},
+    {ACPI_DMT_FLAG6,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "RTC wake not in fixed reg space (V1)", 0},
+    {ACPI_DMT_FLAG7,    ACPI_FADT_FLAG_OFFSET (Flags,0),            "RTC can wake system from S4 (V1)", 0},
+
+    /* Flags byte 1 */
+
+    {ACPI_DMT_FLAG0,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "32-bit PM Timer (V1)", 0},
+    {ACPI_DMT_FLAG1,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "Docking Supported (V1)", 0},
+    {ACPI_DMT_FLAG2,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "Reset Register Supported (V2)", 0},
+    {ACPI_DMT_FLAG3,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "Sealed Case (V3)", 0},
+    {ACPI_DMT_FLAG4,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "Headless - No Video (V3)", 0},
+    {ACPI_DMT_FLAG5,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "Use native instr after SLP_TYPx (V3)", 0},
+    {ACPI_DMT_FLAG6,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "PCIEXP_WAK Bits Supported (V4)", 0},
+    {ACPI_DMT_FLAG7,    ACPI_FADT_FLAG_OFFSET (Flags,1),            "Use Platform Timer (V4)", 0},
+
+    /* Flags byte 2 */
+
+    {ACPI_DMT_FLAG0,    ACPI_FADT_FLAG_OFFSET (Flags,2),            "RTC_STS valid on S4 wake (V4)", 0},
+    {ACPI_DMT_FLAG1,    ACPI_FADT_FLAG_OFFSET (Flags,2),            "Remote Power-on capable (V4)", 0},
+    {ACPI_DMT_FLAG2,    ACPI_FADT_FLAG_OFFSET (Flags,2),            "Use APIC Cluster Model (V4)", 0},
+    {ACPI_DMT_FLAG3,    ACPI_FADT_FLAG_OFFSET (Flags,2),            "Use APIC Physical Destination Mode (V4)", 0},
+    {ACPI_DMT_FLAG4,    ACPI_FADT_FLAG_OFFSET (Flags,2),            "Hardware Reduced (V5)", 0},
+    {ACPI_DMT_FLAG5,    ACPI_FADT_FLAG_OFFSET (Flags,2),            "Low Power S0 Idle (V5)", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* ACPI 1.0 MS Extensions (FADT version 2) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFadt2[] =
+{
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (ResetRegister),           "Reset Register", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (ResetValue),              "Value to cause reset", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (ArmBootFlags),            "Reserved", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (MinorRevision),           "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* ACPI 2.0+ Extensions (FADT version 3, 4, and 5) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFadt3[] =
+{
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (ResetRegister),           "Reset Register", 0},
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (ResetValue),              "Value to cause reset", 0},
+    {ACPI_DMT_UINT16,   ACPI_FADT_OFFSET (ArmBootFlags),            "ARM Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_FADT_FLAG_OFFSET(ArmBootFlags,0),      "PSCI Compliant", 0},
+    {ACPI_DMT_FLAG1,    ACPI_FADT_FLAG_OFFSET(ArmBootFlags,0),      "Must use HVC for PSCI", 0},
+    ACPI_DMT_NEW_LINE,
+    {ACPI_DMT_UINT8,    ACPI_FADT_OFFSET (MinorRevision),           "FADT Minor Revision", 0},
+    {ACPI_DMT_UINT64,   ACPI_FADT_OFFSET (XFacs),                   "FACS Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_FADT_OFFSET (XDsdt),                   "DSDT Address", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XPm1aEventBlock),         "PM1A Event Block", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XPm1bEventBlock),         "PM1B Event Block", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XPm1aControlBlock),       "PM1A Control Block", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XPm1bControlBlock),       "PM1B Control Block", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XPm2ControlBlock),        "PM2 Control Block", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XPmTimerBlock),           "PM Timer Block", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XGpe0Block),              "GPE0 Block", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (XGpe1Block),              "GPE1 Block", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* ACPI 5.0 Extensions (FADT version 5) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFadt5[] =
+{
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (SleepControl),            "Sleep Control Register", 0},
+    {ACPI_DMT_GAS,      ACPI_FADT_OFFSET (SleepStatus),             "Sleep Status Register", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* ACPI 6.0 Extensions (FADT version 6) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFadt6[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_FADT_OFFSET (HypervisorId),            "Hypervisor ID", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*
+ * Remaining tables are not consumed directly by the ACPICA subsystem
+ */
+
+/*******************************************************************************
+ *
+ * ASF - Alert Standard Format table (Signature "ASF!")
+ *
+ ******************************************************************************/
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsfHdr[] =
+{
+    {ACPI_DMT_ASF,      ACPI_ASF0_OFFSET (Header.Type),             "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF0_OFFSET (Header.Reserved),         "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_ASF0_OFFSET (Header.Length),           "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0: ASF Information */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsf0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_ASF0_OFFSET (MinResetValue),           "Minimum Reset Value", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF0_OFFSET (MinPollInterval),         "Minimum Polling Interval", 0},
+    {ACPI_DMT_UINT16,   ACPI_ASF0_OFFSET (SystemId),                "System ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_ASF0_OFFSET (MfgId),                   "Manufacturer ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF0_OFFSET (Flags),                   "Flags", 0},
+    {ACPI_DMT_UINT24,   ACPI_ASF0_OFFSET (Reserved2[0]),            "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: ASF Alerts */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsf1[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_ASF1_OFFSET (AssertMask),              "AssertMask", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1_OFFSET (DeassertMask),            "DeassertMask", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1_OFFSET (Alerts),                  "Alert Count", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1_OFFSET (DataLength),              "Alert Data Length", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1a: ASF Alert data */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsf1a[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Address),                "Address", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Command),                "Command", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Mask),                   "Mask", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Value),                  "Value", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (SensorType),             "SensorType", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Type),                   "Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Offset),                 "Offset", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (SourceType),             "SourceType", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Severity),               "Severity", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (SensorNumber),           "SensorNumber", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Entity),                 "Entity", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF1a_OFFSET (Instance),               "Instance", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: ASF Remote Control */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsf2[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_ASF2_OFFSET (Controls),                "Control Count", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF2_OFFSET (DataLength),              "Control Data Length", 0},
+    {ACPI_DMT_UINT16,   ACPI_ASF2_OFFSET (Reserved2),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2a: ASF Control data */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsf2a[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_ASF2a_OFFSET (Function),               "Function", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF2a_OFFSET (Address),                "Address", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF2a_OFFSET (Command),                "Command", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF2a_OFFSET (Value),                  "Value", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 3: ASF RMCP Boot Options */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsf3[] =
+{
+    {ACPI_DMT_BUF7,     ACPI_ASF3_OFFSET (Capabilities[0]),         "Capabilities", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF3_OFFSET (CompletionCode),          "Completion Code", 0},
+    {ACPI_DMT_UINT32,   ACPI_ASF3_OFFSET (EnterpriseId),            "Enterprise ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF3_OFFSET (Command),                 "Command", 0},
+    {ACPI_DMT_UINT16,   ACPI_ASF3_OFFSET (Parameter),               "Parameter", 0},
+    {ACPI_DMT_UINT16,   ACPI_ASF3_OFFSET (BootOptions),             "Boot Options", 0},
+    {ACPI_DMT_UINT16,   ACPI_ASF3_OFFSET (OemParameters),           "Oem Parameters", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 4: ASF Address */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoAsf4[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_ASF4_OFFSET (EpromAddress),            "Eprom Address", 0},
+    {ACPI_DMT_UINT8,    ACPI_ASF4_OFFSET (Devices),                 "Device Count", DT_COUNT},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * BERT -  Boot Error Record table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoBert[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_BERT_OFFSET (RegionLength),            "Boot Error Region Length", 0},
+    {ACPI_DMT_UINT64,   ACPI_BERT_OFFSET (Address),                 "Boot Error Region Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * BGRT -  Boot Graphics Resource Table (ACPI 5.0)
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoBgrt[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_BGRT_OFFSET (Version),                 "Version", 0},
+    {ACPI_DMT_UINT8,    ACPI_BGRT_OFFSET (Status),                  "Status", 0},
+    {ACPI_DMT_UINT8,    ACPI_BGRT_OFFSET (ImageType),               "Image Type", 0},
+    {ACPI_DMT_UINT64,   ACPI_BGRT_OFFSET (ImageAddress),            "Image Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_BGRT_OFFSET (ImageOffsetX),            "Image OffsetX", 0},
+    {ACPI_DMT_UINT32,   ACPI_BGRT_OFFSET (ImageOffsetY),            "Image OffsetY", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * BOOT - Simple Boot Flag Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoBoot[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_BOOT_OFFSET (CmosIndex),               "Boot Register Index", 0},
+    {ACPI_DMT_UINT24,   ACPI_BOOT_OFFSET (Reserved[0]),             "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * CPEP - Corrected Platform Error Polling table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoCpep[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_CPEP_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoCpep0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_CPEP0_OFFSET (Header.Type),            "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_CPEP0_OFFSET (Header.Length),          "Length", DT_LENGTH},
+    {ACPI_DMT_UINT8,    ACPI_CPEP0_OFFSET (Id),                     "Processor ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_CPEP0_OFFSET (Eid),                    "Processor EID", 0},
+    {ACPI_DMT_UINT32,   ACPI_CPEP0_OFFSET (Interval),               "Polling Interval", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * CSRT - Core System Resource Table
+ *
+ ******************************************************************************/
+
+/* Main table consists only of the standard ACPI table header */
+
+/* Resource Group subtable */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoCsrt0[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_CSRT0_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT32,   ACPI_CSRT0_OFFSET (VendorId),               "Vendor ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_CSRT0_OFFSET (SubvendorId),            "Subvendor ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT0_OFFSET (DeviceId),               "Device ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT0_OFFSET (SubdeviceId),            "Subdevice ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT0_OFFSET (Revision),               "Revision", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_CSRT0_OFFSET (SharedInfoLength),       "Shared Info Length", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Shared Info subtable */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoCsrt1[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_CSRT1_OFFSET (MajorVersion),           "Major Version", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT1_OFFSET (MinorVersion),           "Minor Version", 0},
+    {ACPI_DMT_UINT32,   ACPI_CSRT1_OFFSET (MmioBaseLow),            "MMIO Base Address Low", 0},
+    {ACPI_DMT_UINT32,   ACPI_CSRT1_OFFSET (MmioBaseHigh),           "MMIO Base Address High", 0},
+    {ACPI_DMT_UINT32,   ACPI_CSRT1_OFFSET (GsiInterrupt),           "GSI Interrupt", 0},
+    {ACPI_DMT_UINT8,    ACPI_CSRT1_OFFSET (InterruptPolarity),      "Interrupt Polarity", 0},
+    {ACPI_DMT_UINT8,    ACPI_CSRT1_OFFSET (InterruptMode),          "Interrupt Mode", 0},
+    {ACPI_DMT_UINT8,    ACPI_CSRT1_OFFSET (NumChannels),            "Num Channels", 0},
+    {ACPI_DMT_UINT8,    ACPI_CSRT1_OFFSET (DmaAddressWidth),        "DMA Address Width", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT1_OFFSET (BaseRequestLine),        "Base Request Line", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT1_OFFSET (NumHandshakeSignals),    "Num Handshake Signals", 0},
+    {ACPI_DMT_UINT32,   ACPI_CSRT1_OFFSET (MaxBlockSize),           "Max Block Size", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/* Resource Descriptor subtable */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoCsrt2[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_CSRT2_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT16,   ACPI_CSRT2_OFFSET (Type),                   "Type", 0},
+    {ACPI_DMT_UINT16,   ACPI_CSRT2_OFFSET (Subtype),                "Subtype", 0},
+    {ACPI_DMT_UINT32,   ACPI_CSRT2_OFFSET (Uid),                    "UID", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoCsrt2a[] =
+{
+    {ACPI_DMT_RAW_BUFFER, 0,                                        "ResourceInfo", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * DBG2 - Debug Port Table 2
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDbg2[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_DBG2_OFFSET (InfoOffset),              "Info Offset", 0},
+    {ACPI_DMT_UINT32,   ACPI_DBG2_OFFSET (InfoCount),               "Info Count", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Debug Device Information Subtable */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDbg2Device[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_DBG20_OFFSET (Revision),               "Revision", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT8,    ACPI_DBG20_OFFSET (RegisterCount),          "Register Count", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (NamepathLength),         "Namepath Length", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (NamepathOffset),         "Namepath Offset", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (OemDataLength),          "OEM Data Length", DT_DESCRIBES_OPTIONAL},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (OemDataOffset),          "OEM Data Offset", DT_DESCRIBES_OPTIONAL},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (PortType),               "Port Type", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (PortSubtype),            "Port Subtype", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (BaseAddressOffset),      "Base Address Offset", 0},
+    {ACPI_DMT_UINT16,   ACPI_DBG20_OFFSET (AddressSizeOffset),      "Address Size Offset", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Variable-length data for the subtable */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDbg2Addr[] =
+{
+    {ACPI_DMT_GAS,      0,                                          "Base Address Register", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDbg2Size[] =
+{
+    {ACPI_DMT_UINT32,   0,                                          "Address Size", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDbg2Name[] =
+{
+    {ACPI_DMT_STRING,   0,                                          "Namepath", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDbg2OemData[] =
+{
+    {ACPI_DMT_RAW_BUFFER, 0,                                        "OEM Data", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * DBGP - Debug Port
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDbgp[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_DBGP_OFFSET (Type),                    "Interface Type", 0},
+    {ACPI_DMT_UINT24,   ACPI_DBGP_OFFSET (Reserved[0]),             "Reserved", 0},
+    {ACPI_DMT_GAS,      ACPI_DBGP_OFFSET (DebugPort),               "Debug Port Register", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * DMAR - DMA Remapping table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmar[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_DMAR_OFFSET (Width),                   "Host Address Width", 0},
+    {ACPI_DMT_UINT8,    ACPI_DMAR_OFFSET (Flags),                   "Flags", 0},
+    {ACPI_DMT_BUF10,    ACPI_DMAR_OFFSET (Reserved[0]),             "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmarHdr[] =
+{
+    {ACPI_DMT_DMAR,     ACPI_DMAR0_OFFSET (Header.Type),            "Subtable Type", 0},
+    {ACPI_DMT_UINT16,   ACPI_DMAR0_OFFSET (Header.Length),          "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common device scope entry */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmarScope[] =
+{
+    {ACPI_DMT_DMAR_SCOPE, ACPI_DMARS_OFFSET (EntryType),            "Device Scope Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_DMARS_OFFSET (Length),                 "Entry Length", DT_LENGTH},
+    {ACPI_DMT_UINT16,   ACPI_DMARS_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT8,    ACPI_DMARS_OFFSET (EnumerationId),          "Enumeration ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_DMARS_OFFSET (Bus),                    "PCI Bus Number", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* DMAR Subtables */
+
+/* 0: Hardware Unit Definition */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmar0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_DMAR0_OFFSET (Flags),                  "Flags", 0},
+    {ACPI_DMT_UINT8,    ACPI_DMAR0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_DMAR0_OFFSET (Segment),                "PCI Segment Number", 0},
+    {ACPI_DMT_UINT64,   ACPI_DMAR0_OFFSET (Address),                "Register Base Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: Reserved Memory Definition */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmar1[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_DMAR1_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_DMAR1_OFFSET (Segment),                "PCI Segment Number", 0},
+    {ACPI_DMT_UINT64,   ACPI_DMAR1_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_DMAR1_OFFSET (EndAddress),             "End Address (limit)", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: Root Port ATS Capability Definition */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmar2[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_DMAR2_OFFSET (Flags),                  "Flags", 0},
+    {ACPI_DMT_UINT8,    ACPI_DMAR2_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_DMAR2_OFFSET (Segment),                "PCI Segment Number", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 3: Remapping Hardware Static Affinity Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmar3[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_DMAR3_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_DMAR3_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_DMAR3_OFFSET (ProximityDomain),        "Proximity Domain", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 4: ACPI Namespace Device Declaration Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDmar4[] =
+{
+    {ACPI_DMT_UINT24,   ACPI_DMAR4_OFFSET (Reserved[0]),            "Reserved", 0},
+    {ACPI_DMT_UINT8,    ACPI_DMAR4_OFFSET (DeviceNumber),           "Device Number", 0},
+    {ACPI_DMT_STRING,   ACPI_DMAR4_OFFSET (DeviceName[0]),          "Device Name", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * DRTM - Dynamic Root of Trust for Measurement table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDrtm[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_DRTM_OFFSET (EntryBaseAddress),        "Entry Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_DRTM_OFFSET (EntryLength),             "Entry Length", 0},
+    {ACPI_DMT_UINT32,   ACPI_DRTM_OFFSET (EntryAddress32),          "Entry 32", 0},
+    {ACPI_DMT_UINT64,   ACPI_DRTM_OFFSET (EntryAddress64),          "Entry 64", 0},
+    {ACPI_DMT_UINT64,   ACPI_DRTM_OFFSET (ExitAddress),             "Exit Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_DRTM_OFFSET (LogAreaAddress),          "Log Area Start", 0},
+    {ACPI_DMT_UINT32,   ACPI_DRTM_OFFSET (LogAreaLength),           "Log Area Length", 0},
+    {ACPI_DMT_UINT64,   ACPI_DRTM_OFFSET (ArchDependentAddress),    "Arch Dependent Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_DRTM_OFFSET (Flags),                   "Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_DRTM_FLAG_OFFSET (Flags, 0),           "Namespace in TCB", 0},
+    {ACPI_DMT_FLAG1,    ACPI_DRTM_FLAG_OFFSET (Flags, 0),           "Gap Code on S3 Resume", 0},
+    {ACPI_DMT_FLAG2,    ACPI_DRTM_FLAG_OFFSET (Flags, 0),           "Gap Code on DLME_Exit", 0},
+    {ACPI_DMT_FLAG3,    ACPI_DRTM_FLAG_OFFSET (Flags, 0),           "PCR_Authorities Changed", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDrtm0[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_DRTM0_OFFSET (ValidatedTableCount),    "Validated Table Count", DT_COUNT},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDrtm0a[] =
+{
+    {ACPI_DMT_UINT64,   0,                                          "Table Address", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDrtm1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_DRTM1_OFFSET (ResourceCount),          "Resource Count", DT_COUNT},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDrtm1a[] =
+{
+    {ACPI_DMT_UINT56,   ACPI_DRTM1a_OFFSET (Size[0]),               "Size", DT_OPTIONAL},
+    {ACPI_DMT_UINT8,    ACPI_DRTM1a_OFFSET (Type),                  "Type", 0},
+    {ACPI_DMT_FLAG0,    ACPI_DRTM1a_FLAG_OFFSET (Type, 0),          "Resource Type", 0},
+    {ACPI_DMT_FLAG7,    ACPI_DRTM1a_FLAG_OFFSET (Type, 0),          "Protections", 0},
+    {ACPI_DMT_UINT64,   ACPI_DRTM1a_OFFSET (Address),               "Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoDrtm2[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_DRTM2_OFFSET (DpsIdLength),            "DLME Platform Id Length", DT_COUNT},
+    {ACPI_DMT_BUF16,    ACPI_DRTM2_OFFSET (DpsId),                  "DLME Platform Id", DT_COUNT},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * ECDT - Embedded Controller Boot Resources Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoEcdt[] =
+{
+    {ACPI_DMT_GAS,      ACPI_ECDT_OFFSET (Control),                 "Command/Status Register", 0},
+    {ACPI_DMT_GAS,      ACPI_ECDT_OFFSET (Data),                    "Data Register", 0},
+    {ACPI_DMT_UINT32,   ACPI_ECDT_OFFSET (Uid),                     "UID", 0},
+    {ACPI_DMT_UINT8,    ACPI_ECDT_OFFSET (Gpe),                     "GPE Number", 0},
+    {ACPI_DMT_STRING,   ACPI_ECDT_OFFSET (Id[0]),                   "Namepath", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * EINJ - Error Injection table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoEinj[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_EINJ_OFFSET (HeaderLength),            "Injection Header Length", 0},
+    {ACPI_DMT_UINT8,    ACPI_EINJ_OFFSET (Flags),                   "Flags", 0},
+    {ACPI_DMT_UINT24,   ACPI_EINJ_OFFSET (Reserved[0]),             "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_EINJ_OFFSET (Entries),                 "Injection Entry Count", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoEinj0[] =
+{
+    {ACPI_DMT_EINJACT,  ACPI_EINJ0_OFFSET (Action),                 "Action", 0},
+    {ACPI_DMT_EINJINST, ACPI_EINJ0_OFFSET (Instruction),            "Instruction", 0},
+    {ACPI_DMT_UINT8,    ACPI_EINJ0_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_EINJ0_FLAG_OFFSET (Flags,0),           "Preserve Register Bits", 0},
+
+    {ACPI_DMT_UINT8,    ACPI_EINJ0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_GAS,      ACPI_EINJ0_OFFSET (RegisterRegion),         "Register Region", 0},
+    {ACPI_DMT_UINT64,   ACPI_EINJ0_OFFSET (Value),                  "Value", 0},
+    {ACPI_DMT_UINT64,   ACPI_EINJ0_OFFSET (Mask),                   "Mask", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * ERST - Error Record Serialization table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoErst[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_ERST_OFFSET (HeaderLength),            "Serialization Header Length", 0},
+    {ACPI_DMT_UINT32,   ACPI_ERST_OFFSET (Reserved),                "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_ERST_OFFSET (Entries),                 "Instruction Entry Count", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoErst0[] =
+{
+    {ACPI_DMT_ERSTACT,  ACPI_ERST0_OFFSET (Action),                 "Action", 0},
+    {ACPI_DMT_ERSTINST, ACPI_ERST0_OFFSET (Instruction),            "Instruction", 0},
+    {ACPI_DMT_UINT8,    ACPI_ERST0_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_ERST0_FLAG_OFFSET (Flags,0),           "Preserve Register Bits", 0},
+
+    {ACPI_DMT_UINT8,    ACPI_ERST0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_GAS,      ACPI_ERST0_OFFSET (RegisterRegion),         "Register Region", 0},
+    {ACPI_DMT_UINT64,   ACPI_ERST0_OFFSET (Value),                  "Value", 0},
+    {ACPI_DMT_UINT64,   ACPI_ERST0_OFFSET (Mask),                   "Mask", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * FPDT - Firmware Performance Data Table (ACPI 5.0)
+ *
+ ******************************************************************************/
+
+/* Main table consists of only the standard ACPI header - subtables follow */
+
+/* FPDT subtable header */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFpdtHdr[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_FPDTH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_FPDTH_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT8,    ACPI_FPDTH_OFFSET (Revision),               "Revision", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0: Firmware Basic Boot Performance Record */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFpdt0[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_FPDT0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_FPDT1_OFFSET (Address),                "FPDT Boot Record Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: S3 Performance Table Pointer Record */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoFpdt1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_FPDT1_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_FPDT1_OFFSET (Address),                "S3PT Record Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+#if 0
+    /* Boot Performance Record, not supported at this time. */
+    {ACPI_DMT_UINT64,   ACPI_FPDT0_OFFSET (ResetEnd),               "Reset End", 0},
+    {ACPI_DMT_UINT64,   ACPI_FPDT0_OFFSET (LoadStart),              "Load Image Start", 0},
+    {ACPI_DMT_UINT64,   ACPI_FPDT0_OFFSET (StartupStart),           "Start Image Start", 0},
+    {ACPI_DMT_UINT64,   ACPI_FPDT0_OFFSET (ExitServicesEntry),      "Exit Services Entry", 0},
+    {ACPI_DMT_UINT64,   ACPI_FPDT0_OFFSET (ExitServicesExit),       "Exit Services Exit", 0},
+#endif
+
+/*******************************************************************************
+ *
+ * GTDT - Generic Timer Description Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoGtdt[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_GTDT_OFFSET (CounterBlockAddresss),    "Counter Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_NEW_LINE,
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (SecureEl1Interrupt),      "Secure EL1 Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (SecureEl1Flags),          "EL1 Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT_FLAG_OFFSET (SecureEl1Flags,0),   "Trigger Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT_FLAG_OFFSET (SecureEl1Flags,0),   "Polarity", 0},
+    {ACPI_DMT_FLAG2,    ACPI_GTDT_FLAG_OFFSET (SecureEl1Flags,0),   "Always On", 0},
+    ACPI_DMT_NEW_LINE,
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (NonSecureEl1Interrupt),   "Non-Secure EL1 Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (NonSecureEl1Flags),       "NEL1 Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT_FLAG_OFFSET (NonSecureEl1Flags,0),"Trigger Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT_FLAG_OFFSET (NonSecureEl1Flags,0),"Polarity", 0},
+    {ACPI_DMT_FLAG2,    ACPI_GTDT_FLAG_OFFSET (NonSecureEl1Flags,0),"Always On", 0},
+    ACPI_DMT_NEW_LINE,
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (VirtualTimerInterrupt),   "Virtual Timer Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (VirtualTimerFlags),       "VT Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT_FLAG_OFFSET (VirtualTimerFlags,0),"Trigger Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT_FLAG_OFFSET (VirtualTimerFlags,0),"Polarity", 0},
+    {ACPI_DMT_FLAG2,    ACPI_GTDT_FLAG_OFFSET (VirtualTimerFlags,0),"Always On", 0},
+    ACPI_DMT_NEW_LINE,
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (NonSecureEl2Interrupt),   "Non-Secure EL2 Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (NonSecureEl2Flags),       "NEL2 Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT_FLAG_OFFSET (NonSecureEl2Flags,0),"Trigger Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT_FLAG_OFFSET (NonSecureEl2Flags,0),"Polarity", 0},
+    {ACPI_DMT_FLAG2,    ACPI_GTDT_FLAG_OFFSET (NonSecureEl2Flags,0),"Always On", 0},
+    {ACPI_DMT_UINT64,   ACPI_GTDT_OFFSET (CounterReadBlockAddress), "Counter Read Block Address", 0},
+    ACPI_DMT_NEW_LINE,
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (PlatformTimerCount),      "Platform Timer Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT_OFFSET (PlatformTimerOffset),     "Platform Timer Offset", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* GTDT Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoGtdtHdr[] =
+{
+    {ACPI_DMT_GTDT,     ACPI_GTDTH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT16,   ACPI_GTDTH_OFFSET (Length),                 "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* GTDT Subtables */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoGtdt0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_GTDT0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_GTDT0_OFFSET (BlockAddress),           "Block Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT0_OFFSET (TimerCount),             "Timer Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT0_OFFSET (TimerOffset),            "Timer Offset", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoGtdt0a[] =
+{
+    {ACPI_DMT_UINT8 ,   ACPI_GTDT0a_OFFSET (FrameNumber),               "Frame Number", 0},
+    {ACPI_DMT_UINT24,   ACPI_GTDT0a_OFFSET (Reserved[0]),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_GTDT0a_OFFSET (BaseAddress),               "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_GTDT0a_OFFSET (El0BaseAddress),            "EL0 Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT0a_OFFSET (TimerInterrupt),            "Timer Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT0a_OFFSET (TimerFlags),                "Timer Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT0a_FLAG_OFFSET (TimerFlags,0),         "Trigger Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT0a_FLAG_OFFSET (TimerFlags,0),         "Polarity", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT0a_OFFSET (VirtualTimerInterrupt),     "Virtual Timer Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT0a_OFFSET (VirtualTimerFlags),         "Virtual Timer Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT0a_FLAG_OFFSET (VirtualTimerFlags,0),  "Trigger Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT0a_FLAG_OFFSET (VirtualTimerFlags,0),  "Polarity", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT0a_OFFSET (CommonFlags),               "Common Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT0a_FLAG_OFFSET (CommonFlags,0),        "Secure", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT0a_FLAG_OFFSET (CommonFlags,0),        "Always On", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoGtdt1[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_GTDT1_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_GTDT1_OFFSET (RefreshFrameAddress),    "Refresh Frame Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_GTDT1_OFFSET (ControlFrameAddress),    "Control Frame Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT1_OFFSET (TimerInterrupt),         "Timer Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_GTDT1_OFFSET (TimerFlags),             "Timer Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_GTDT1_FLAG_OFFSET (TimerFlags,0),      "Trigger Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_GTDT1_FLAG_OFFSET (TimerFlags,0),      "Polarity", 0},
+    {ACPI_DMT_FLAG2,    ACPI_GTDT1_FLAG_OFFSET (TimerFlags,0),      "Security", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * HEST - Hardware Error Source table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_HEST_OFFSET (ErrorSourceCount),        "Error Source Count", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common HEST structures for subtables */
+
+#define ACPI_DM_HEST_HEADER \
+    {ACPI_DMT_HEST,     ACPI_HEST0_OFFSET (Header.Type),            "Subtable Type", 0}, \
+    {ACPI_DMT_UINT16,   ACPI_HEST0_OFFSET (Header.SourceId),        "Source Id", 0}
+
+#define ACPI_DM_HEST_AER \
+    {ACPI_DMT_UINT16,   ACPI_HEST6_OFFSET (Aer.Reserved1),              "Reserved", 0}, \
+    {ACPI_DMT_UINT8,    ACPI_HEST6_OFFSET (Aer.Flags),                  "Flags (decoded below)", DT_FLAG}, \
+    {ACPI_DMT_FLAG0,    ACPI_HEST6_FLAG_OFFSET (Aer.Flags,0),           "Firmware First", 0}, \
+    {ACPI_DMT_UINT8,    ACPI_HEST6_OFFSET (Aer.Enabled),                "Enabled", 0}, \
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (Aer.RecordsToPreallocate),   "Records To Preallocate", 0}, \
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (Aer.MaxSectionsPerRecord),   "Max Sections Per Record", 0}, \
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (Aer.Bus),                    "Bus", 0}, \
+    {ACPI_DMT_UINT16,   ACPI_HEST6_OFFSET (Aer.Device),                 "Device", 0}, \
+    {ACPI_DMT_UINT16,   ACPI_HEST6_OFFSET (Aer.Function),               "Function", 0}, \
+    {ACPI_DMT_UINT16,   ACPI_HEST6_OFFSET (Aer.DeviceControl),          "DeviceControl", 0}, \
+    {ACPI_DMT_UINT16,   ACPI_HEST6_OFFSET (Aer.Reserved2),              "Reserved", 0}, \
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (Aer.UncorrectableMask),      "Uncorrectable Mask", 0}, \
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (Aer.UncorrectableSeverity),  "Uncorrectable Severity", 0}, \
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (Aer.CorrectableMask),        "Correctable Mask", 0}, \
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (Aer.AdvancedCapabilities),   "Advanced Capabilities", 0}
+
+
+/* HEST Subtables */
+
+/* 0: IA32 Machine Check Exception */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest0[] =
+{
+    ACPI_DM_HEST_HEADER,
+    {ACPI_DMT_UINT16,   ACPI_HEST0_OFFSET (Reserved1),              "Reserved1", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST0_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_HEST0_FLAG_OFFSET (Flags,0),           "Firmware First", 0},
+
+    {ACPI_DMT_UINT8,    ACPI_HEST0_OFFSET (Enabled),                "Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST0_OFFSET (RecordsToPreallocate),   "Records To Preallocate", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST0_OFFSET (MaxSectionsPerRecord),   "Max Sections Per Record", 0},
+    {ACPI_DMT_UINT64,   ACPI_HEST0_OFFSET (GlobalCapabilityData),   "Global Capability Data", 0},
+    {ACPI_DMT_UINT64,   ACPI_HEST0_OFFSET (GlobalControlData),      "Global Control Data", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST0_OFFSET (NumHardwareBanks),       "Num Hardware Banks", 0},
+    {ACPI_DMT_UINT56,   ACPI_HEST0_OFFSET (Reserved3[0]),           "Reserved2", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: IA32 Corrected Machine Check */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest1[] =
+{
+    ACPI_DM_HEST_HEADER,
+    {ACPI_DMT_UINT16,   ACPI_HEST1_OFFSET (Reserved1),              "Reserved1", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST1_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_HEST1_FLAG_OFFSET (Flags,0),           "Firmware First", 0},
+
+    {ACPI_DMT_UINT8,    ACPI_HEST1_OFFSET (Enabled),                "Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST1_OFFSET (RecordsToPreallocate),   "Records To Preallocate", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST1_OFFSET (MaxSectionsPerRecord),   "Max Sections Per Record", 0},
+    {ACPI_DMT_HESTNTFY, ACPI_HEST1_OFFSET (Notify),                 "Notify", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST1_OFFSET (NumHardwareBanks),       "Num Hardware Banks", 0},
+    {ACPI_DMT_UINT24,   ACPI_HEST1_OFFSET (Reserved2[0]),           "Reserved2", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: IA32 Non-Maskable Interrupt */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest2[] =
+{
+    ACPI_DM_HEST_HEADER,
+    {ACPI_DMT_UINT32,   ACPI_HEST2_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST2_OFFSET (RecordsToPreallocate),   "Records To Preallocate", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST2_OFFSET (MaxSectionsPerRecord),   "Max Sections Per Record", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST2_OFFSET (MaxRawDataLength),       "Max Raw Data Length", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 6: PCI Express Root Port AER */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest6[] =
+{
+    ACPI_DM_HEST_HEADER,
+    ACPI_DM_HEST_AER,
+    {ACPI_DMT_UINT32,   ACPI_HEST6_OFFSET (RootErrorCommand),       "Root Error Command", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 7: PCI Express AER (AER Endpoint) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest7[] =
+{
+    ACPI_DM_HEST_HEADER,
+    ACPI_DM_HEST_AER,
+    ACPI_DMT_TERMINATOR
+};
+
+/* 8: PCI Express/PCI-X Bridge AER */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest8[] =
+{
+    ACPI_DM_HEST_HEADER,
+    ACPI_DM_HEST_AER,
+    {ACPI_DMT_UINT32,   ACPI_HEST8_OFFSET (UncorrectableMask2),     "2nd Uncorrectable Mask", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST8_OFFSET (UncorrectableSeverity2), "2nd Uncorrectable Severity", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST8_OFFSET (AdvancedCapabilities2),  "2nd Advanced Capabilities", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 9: Generic Hardware Error Source */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest9[] =
+{
+    ACPI_DM_HEST_HEADER,
+    {ACPI_DMT_UINT16,   ACPI_HEST9_OFFSET (RelatedSourceId),        "Related Source Id", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST9_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST9_OFFSET (Enabled),                "Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST9_OFFSET (RecordsToPreallocate),   "Records To Preallocate", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST9_OFFSET (MaxSectionsPerRecord),   "Max Sections Per Record", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST9_OFFSET (MaxRawDataLength),       "Max Raw Data Length", 0},
+    {ACPI_DMT_GAS,      ACPI_HEST9_OFFSET (ErrorStatusAddress),     "Error Status Address", 0},
+    {ACPI_DMT_HESTNTFY, ACPI_HEST9_OFFSET (Notify),                 "Notify", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST9_OFFSET (ErrorBlockLength),       "Error Status Block Length", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 10: Generic Hardware Error Source - Version 2 */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHest10[] =
+{
+    ACPI_DM_HEST_HEADER,
+    {ACPI_DMT_UINT16,   ACPI_HEST10_OFFSET (RelatedSourceId),       "Related Source Id", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST10_OFFSET (Reserved),              "Reserved", 0},
+    {ACPI_DMT_UINT8,    ACPI_HEST10_OFFSET (Enabled),               "Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST10_OFFSET (RecordsToPreallocate),  "Records To Preallocate", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST10_OFFSET (MaxSectionsPerRecord),  "Max Sections Per Record", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST10_OFFSET (MaxRawDataLength),      "Max Raw Data Length", 0},
+    {ACPI_DMT_GAS,      ACPI_HEST10_OFFSET (ErrorStatusAddress),    "Error Status Address", 0},
+    {ACPI_DMT_HESTNTFY, ACPI_HEST10_OFFSET (Notify),                "Notify", 0},
+    {ACPI_DMT_UINT32,   ACPI_HEST10_OFFSET (ErrorBlockLength),      "Error Status Block Length", 0},
+    {ACPI_DMT_GAS,      ACPI_HEST10_OFFSET (ReadAckRegister),       "Read Ack Register", 0},
+    {ACPI_DMT_UINT64,   ACPI_HEST10_OFFSET (ReadAckPreserve),       "Read Ack Preserve", 0},
+    {ACPI_DMT_UINT64,   ACPI_HEST10_OFFSET (ReadAckWrite),          "Read Ack Write", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHestNotify[] =
+{
+    {ACPI_DMT_HESTNTYP, ACPI_HESTN_OFFSET (Type),                   "Notify Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_HESTN_OFFSET (Length),                 "Notify Length", DT_LENGTH},
+    {ACPI_DMT_UINT16,   ACPI_HESTN_OFFSET (ConfigWriteEnable),      "Configuration Write Enable", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTN_OFFSET (PollInterval),           "PollInterval", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTN_OFFSET (Vector),                 "Vector", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTN_OFFSET (PollingThresholdValue),  "Polling Threshold Value", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTN_OFFSET (PollingThresholdWindow), "Polling Threshold Window", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTN_OFFSET (ErrorThresholdValue),    "Error Threshold Value", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTN_OFFSET (ErrorThresholdWindow),   "Error Threshold Window", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*
+ * IA32 Error Bank(s) - Follows the ACPI_HEST_IA_MACHINE_CHECK and
+ * ACPI_HEST_IA_CORRECTED structures.
+ */
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHestBank[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_HESTB_OFFSET (BankNumber),             "Bank Number", 0},
+    {ACPI_DMT_UINT8,    ACPI_HESTB_OFFSET (ClearStatusOnInit),      "Clear Status On Init", 0},
+    {ACPI_DMT_UINT8,    ACPI_HESTB_OFFSET (StatusFormat),           "Status Format", 0},
+    {ACPI_DMT_UINT8,    ACPI_HESTB_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTB_OFFSET (ControlRegister),        "Control Register", 0},
+    {ACPI_DMT_UINT64,   ACPI_HESTB_OFFSET (ControlData),            "Control Data", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTB_OFFSET (StatusRegister),         "Status Register", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTB_OFFSET (AddressRegister),        "Address Register", 0},
+    {ACPI_DMT_UINT32,   ACPI_HESTB_OFFSET (MiscRegister),           "Misc Register", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * HPET - High Precision Event Timer table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoHpet[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_HPET_OFFSET (Id),                      "Hardware Block ID", 0},
+    {ACPI_DMT_GAS,      ACPI_HPET_OFFSET (Address),                 "Timer Block Register", 0},
+    {ACPI_DMT_UINT8,    ACPI_HPET_OFFSET (Sequence),                "Sequence Number", 0},
+    {ACPI_DMT_UINT16,   ACPI_HPET_OFFSET (MinimumTick),             "Minimum Clock Ticks", 0},
+    {ACPI_DMT_UINT8,    ACPI_HPET_OFFSET (Flags),                   "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_HPET_FLAG_OFFSET (Flags,0),            "4K Page Protect", 0},
+    {ACPI_DMT_FLAG1,    ACPI_HPET_FLAG_OFFSET (Flags,0),            "64K Page Protect", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * IORT - IO Remapping Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_IORT_OFFSET (NodeCount),               "Node Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT_OFFSET (NodeOffset),              "Node Offset", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Optional padding field */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIortPad[] =
+{
+    {ACPI_DMT_RAW_BUFFER, 0,                                        "Optional Padding", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIortHdr[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_IORTH_OFFSET (Type),                   "Type", 0},
+    {ACPI_DMT_UINT16,   ACPI_IORTH_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT8,    ACPI_IORTH_OFFSET (Revision),               "Revision", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORTH_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORTH_OFFSET (MappingCount),           "Mapping Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORTH_OFFSET (MappingOffset),          "Mapping Offset", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIortMap[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_IORTM_OFFSET (InputBase),              "Input base", DT_OPTIONAL},
+    {ACPI_DMT_UINT32,   ACPI_IORTM_OFFSET (IdCount),                "ID Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORTM_OFFSET (OutputBase),             "Output Base", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORTM_OFFSET (OutputReference),        "Output Reference", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORTM_OFFSET (Flags),                  "Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_IORTM_FLAG_OFFSET (Flags, 0),          "Single Mapping", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIortAcc[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_IORTA_OFFSET (CacheCoherency),         "Cache Coherency", 0},
+    {ACPI_DMT_UINT8,    ACPI_IORTA_OFFSET (Hints),                  "Hints (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_IORTA_FLAG_OFFSET (Hints, 0),          "Transient", 0},
+    {ACPI_DMT_FLAG1,    ACPI_IORTA_FLAG_OFFSET (Hints, 0),          "Write Allocate", 0},
+    {ACPI_DMT_FLAG2,    ACPI_IORTA_FLAG_OFFSET (Hints, 0),          "Read Allocate", 0},
+    {ACPI_DMT_FLAG3,    ACPI_IORTA_FLAG_OFFSET (Hints, 0),          "Override", 0},
+    {ACPI_DMT_UINT16,   ACPI_IORTA_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT8,    ACPI_IORTA_OFFSET (MemoryFlags),            "Memory Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_IORTA_FLAG_OFFSET (MemoryFlags, 0),    "Coherency", 0},
+    {ACPI_DMT_FLAG1,    ACPI_IORTA_FLAG_OFFSET (MemoryFlags, 0),    "Device Attribute", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* IORT subtables */
+
+/* 0x00: ITS Group */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort0[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_IORT0_OFFSET (ItsCount),               "ItsCount", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort0a[] =
+{
+    {ACPI_DMT_UINT32,   0,                                          "Identifiers", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0x01: Named Component */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_IORT1_OFFSET (NodeFlags),              "Node Flags", 0},
+    {ACPI_DMT_IORTMEM,  ACPI_IORT1_OFFSET (MemoryProperties),       "Memory Properties", 0},
+    {ACPI_DMT_UINT8,    ACPI_IORT1_OFFSET (MemoryAddressLimit),     "Memory Size Limit", 0},
+    {ACPI_DMT_STRING,   ACPI_IORT1_OFFSET (DeviceName[0]),          "Device Name", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort1a[] =
+{
+    {ACPI_DMT_RAW_BUFFER, 0,                                        "Padding", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0x02: PCI Root Complex */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort2[] =
+{
+    {ACPI_DMT_IORTMEM,  ACPI_IORT2_OFFSET (MemoryProperties),       "Memory Properties", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT2_OFFSET (AtsAttribute),           "ATS Attribute", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT2_OFFSET (PciSegmentNumber),       "PCI Segment Number", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0x03: SMMUv1/2 */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort3[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_IORT3_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_IORT3_OFFSET (Span),                   "Span", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT3_OFFSET (Model),                  "Model", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT3_OFFSET (Flags),                  "Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_IORT3_FLAG_OFFSET (Flags, 0),          "DVM Supported", 0},
+    {ACPI_DMT_FLAG1,    ACPI_IORT3_FLAG_OFFSET (Flags, 0),          "Coherent Walk", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT3_OFFSET (GlobalInterruptOffset),  "Global Interrupt Offset", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT3_OFFSET (ContextInterruptCount),  "Context Interrupt Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT3_OFFSET (ContextInterruptOffset), "Context Interrupt Offset", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT3_OFFSET (PmuInterruptCount),      "PMU Interrupt Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT3_OFFSET (PmuInterruptOffset),     "PMU Interrupt Offset", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort3a[] =
+{
+    {ACPI_DMT_UINT64,   0,                                          "SMMU_NSgIrpt Interrupt", 0},
+    {ACPI_DMT_UINT64,   0,                                          "SMMU_NSgCfgIrpt Interrupt", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort3b[] =
+{
+    {ACPI_DMT_UINT64,   0,                                          "Context Interrupt", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort3c[] =
+{
+    {ACPI_DMT_UINT64,   0,                                          "PMU Interrupt", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0x04: SMMUv3 */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIort4[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_IORT4_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT4_OFFSET (Flags),                  "Flags (decoded below)", 0},
+    {ACPI_DMT_FLAG0,    ACPI_IORT4_FLAG_OFFSET (Flags, 0),          "COHACC Override", 0},
+    {ACPI_DMT_FLAG1,    ACPI_IORT4_FLAG_OFFSET (Flags, 0),          "HTTU Override", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT4_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_IORT4_OFFSET (VatosAddress),           "VATOS Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT4_OFFSET (Model),                  "Model", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT4_OFFSET (EventGsiv),              "Event GSIV", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT4_OFFSET (PriGsiv),                "PRI GSIV", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT4_OFFSET (GerrGsiv),               "GERR GSIV", 0},
+    {ACPI_DMT_UINT32,   ACPI_IORT4_OFFSET (SyncGsiv),               "Sync GSIV", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/*******************************************************************************
+ *
+ * IVRS - I/O Virtualization Reporting Structure
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrs[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_IVRS_OFFSET (Info),                    "Virtualization Info", 0},
+    {ACPI_DMT_UINT64,   ACPI_IVRS_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrsHdr[] =
+{
+    {ACPI_DMT_IVRS,     ACPI_IVRSH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_IVRSH_OFFSET (Flags),                  "Flags", 0},
+    {ACPI_DMT_UINT16,   ACPI_IVRSH_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT16,   ACPI_IVRSH_OFFSET (DeviceId),               "DeviceId", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* IVRS subtables */
+
+/* 0x10: I/O Virtualization Hardware Definition (IVHD) Block */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrs0[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_IVRS0_OFFSET (CapabilityOffset),       "Capability Offset", 0},
+    {ACPI_DMT_UINT64,   ACPI_IVRS0_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT16,   ACPI_IVRS0_OFFSET (PciSegmentGroup),        "PCI Segment Group", 0},
+    {ACPI_DMT_UINT16,   ACPI_IVRS0_OFFSET (Info),                   "Virtualization Info", 0},
+    {ACPI_DMT_UINT32,   ACPI_IVRS0_OFFSET (Reserved),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0x20, 0x21, 0x22: I/O Virtualization Memory Definition (IVMD) Block */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrs1[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_IVRS1_OFFSET (AuxData),                "Auxiliary Data", 0},
+    {ACPI_DMT_UINT64,   ACPI_IVRS1_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_IVRS1_OFFSET (StartAddress),           "Start Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_IVRS1_OFFSET (MemoryLength),           "Memory Length", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Device entry header for IVHD block */
+
+#define ACPI_DMT_IVRS_DE_HEADER \
+    {ACPI_DMT_UINT8,    ACPI_IVRSD_OFFSET (Type),                   "Entry Type", 0}, \
+    {ACPI_DMT_UINT16,   ACPI_IVRSD_OFFSET (Id),                     "Device ID", 0}, \
+    {ACPI_DMT_UINT8,    ACPI_IVRSD_OFFSET (DataSetting),            "Data Setting", 0}
+
+/* 4-byte device entry */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrs4[] =
+{
+    ACPI_DMT_IVRS_DE_HEADER,
+    {ACPI_DMT_EXIT,     0,                                          NULL, 0},
+};
+
+/* 8-byte device entry */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrs8a[] =
+{
+    ACPI_DMT_IVRS_DE_HEADER,
+    {ACPI_DMT_UINT8,    ACPI_IVRS8A_OFFSET (Reserved1),             "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_IVRS8A_OFFSET (UsedId),                "Source Used Device ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_IVRS8A_OFFSET (Reserved2),             "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 8-byte device entry */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrs8b[] =
+{
+    ACPI_DMT_IVRS_DE_HEADER,
+    {ACPI_DMT_UINT32,   ACPI_IVRS8B_OFFSET (ExtendedData),          "Extended Data", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 8-byte device entry */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoIvrs8c[] =
+{
+    ACPI_DMT_IVRS_DE_HEADER,
+    {ACPI_DMT_UINT8,    ACPI_IVRS8C_OFFSET (Handle),                "Handle", 0},
+    {ACPI_DMT_UINT16,   ACPI_IVRS8C_OFFSET (UsedId),                "Source Used Device ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_IVRS8C_OFFSET (Variety),               "Variety", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * LPIT - Low Power Idle Table
+ *
+ ******************************************************************************/
+
+/* Main table consists only of the standard ACPI table header */
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoLpitHdr[] =
+{
+    {ACPI_DMT_LPIT,     ACPI_LPITH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT32,   ACPI_LPITH_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT16,   ACPI_LPITH_OFFSET (UniqueId),               "Unique ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_LPITH_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_LPITH_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_LPITH_FLAG_OFFSET (Flags, 0),          "State Disabled", 0},
+    {ACPI_DMT_FLAG1,    ACPI_LPITH_FLAG_OFFSET (Flags, 0),          "No Counter", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* LPIT Subtables */
+
+/* 0: Native C-state */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoLpit0[] =
+{
+    {ACPI_DMT_GAS,      ACPI_LPIT0_OFFSET (EntryTrigger),           "Entry Trigger", 0},
+    {ACPI_DMT_UINT32,   ACPI_LPIT0_OFFSET (Residency),              "Residency", 0},
+    {ACPI_DMT_UINT32,   ACPI_LPIT0_OFFSET (Latency),                "Latency", 0},
+    {ACPI_DMT_GAS,      ACPI_LPIT0_OFFSET (ResidencyCounter),       "Residency Counter", 0},
+    {ACPI_DMT_UINT64,   ACPI_LPIT0_OFFSET (CounterFrequency),       "Counter Frequency", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * MADT - Multiple APIC Description Table and subtables
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_MADT_OFFSET (Address),                 "Local Apic Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT_OFFSET (Flags),                   "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MADT_FLAG_OFFSET (Flags,0),            "PC-AT Compatibility", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadtHdr[] =
+{
+    {ACPI_DMT_MADT,     ACPI_MADTH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADTH_OFFSET (Length),                 "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* MADT Subtables */
+
+/* 0: processor APIC */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MADT0_OFFSET (ProcessorId),            "Processor ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT0_OFFSET (Id),                     "Local Apic ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT0_OFFSET (LapicFlags),             "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MADT0_FLAG_OFFSET (LapicFlags,0),      "Processor Enabled", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: IO APIC */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt1[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MADT1_OFFSET (Id),                     "I/O Apic ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT1_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT1_OFFSET (Address),                "Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT1_OFFSET (GlobalIrqBase),          "Interrupt", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: Interrupt Override */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt2[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MADT2_OFFSET (Bus),                    "Bus", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT2_OFFSET (SourceIrq),              "Source", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT2_OFFSET (GlobalIrq),              "Interrupt", 0},
+    {ACPI_DMT_UINT16,   ACPI_MADT2_OFFSET (IntiFlags),              "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAGS0,   ACPI_MADT2_FLAG_OFFSET (IntiFlags,0),       "Polarity", 0},
+    {ACPI_DMT_FLAGS2,   ACPI_MADT2_FLAG_OFFSET (IntiFlags,0),       "Trigger Mode", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 3: NMI Sources */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt3[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT3_OFFSET (IntiFlags),              "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAGS0,   ACPI_MADT3_FLAG_OFFSET (IntiFlags,0),       "Polarity", 0},
+    {ACPI_DMT_FLAGS2,   ACPI_MADT3_FLAG_OFFSET (IntiFlags,0),       "Trigger Mode", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT3_OFFSET (GlobalIrq),              "Interrupt", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 4: Local APIC NMI */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt4[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MADT4_OFFSET (ProcessorId),            "Processor ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_MADT4_OFFSET (IntiFlags),              "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAGS0,   ACPI_MADT4_FLAG_OFFSET (IntiFlags,0),       "Polarity", 0},
+    {ACPI_DMT_FLAGS2,   ACPI_MADT4_FLAG_OFFSET (IntiFlags,0),       "Trigger Mode", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT4_OFFSET (Lint),                   "Interrupt Input LINT", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 5: Address Override */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt5[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT5_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT5_OFFSET (Address),                "APIC Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 6: I/O Sapic */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt6[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MADT6_OFFSET (Id),                     "I/O Sapic ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT6_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT6_OFFSET (GlobalIrqBase),          "Interrupt Base", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT6_OFFSET (Address),                "Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 7: Local Sapic */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt7[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MADT7_OFFSET (ProcessorId),            "Processor ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT7_OFFSET (Id),                     "Local Sapic ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT7_OFFSET (Eid),                    "Local Sapic EID", 0},
+    {ACPI_DMT_UINT24,   ACPI_MADT7_OFFSET (Reserved[0]),            "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT7_OFFSET (LapicFlags),             "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MADT7_FLAG_OFFSET (LapicFlags,0),      "Processor Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT7_OFFSET (Uid),                    "Processor UID", 0},
+    {ACPI_DMT_STRING,   ACPI_MADT7_OFFSET (UidString[0]),           "Processor UID String", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 8: Platform Interrupt Source */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt8[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT8_OFFSET (IntiFlags),              "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAGS0,   ACPI_MADT8_FLAG_OFFSET (IntiFlags,0),       "Polarity", 0},
+    {ACPI_DMT_FLAGS2,   ACPI_MADT8_FLAG_OFFSET (IntiFlags,0),       "Trigger Mode", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT8_OFFSET (Type),                   "InterruptType", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT8_OFFSET (Id),                     "Processor ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT8_OFFSET (Eid),                    "Processor EID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT8_OFFSET (IoSapicVector),          "I/O Sapic Vector", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT8_OFFSET (GlobalIrq),              "Interrupt", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT8_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MADT8_OFFSET (Flags),                  "CPEI Override", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 9: Processor Local X2_APIC (ACPI 4.0) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt9[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT9_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT9_OFFSET (LocalApicId),            "Processor x2Apic ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT9_OFFSET (LapicFlags),             "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MADT9_FLAG_OFFSET (LapicFlags,0),      "Processor Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT9_OFFSET (Uid),                    "Processor UID", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 10: Local X2_APIC NMI (ACPI 4.0) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt10[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT10_OFFSET (IntiFlags),             "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAGS0,   ACPI_MADT10_FLAG_OFFSET (IntiFlags,0),      "Polarity", 0},
+    {ACPI_DMT_FLAGS2,   ACPI_MADT10_FLAG_OFFSET (IntiFlags,0),      "Trigger Mode", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT10_OFFSET (Uid),                   "Processor UID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT10_OFFSET (Lint),                  "Interrupt Input LINT", 0},
+    {ACPI_DMT_UINT24,   ACPI_MADT10_OFFSET (Reserved[0]),           "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 11: Generic Interrupt Controller (ACPI 5.0) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt11[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT11_OFFSET (Reserved),              "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT11_OFFSET (CpuInterfaceNumber),    "CPU Interface Number", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT11_OFFSET (Uid),                   "Processor UID", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT11_OFFSET (Flags),                 "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MADT11_FLAG_OFFSET (Flags,0),          "Processor Enabled", 0},
+    {ACPI_DMT_FLAG1,    ACPI_MADT11_FLAG_OFFSET (Flags,0),          "Performance Interrupt Trigger Mode", 0},
+    {ACPI_DMT_FLAG2,    ACPI_MADT11_FLAG_OFFSET (Flags,0),          "Virtual GIC Interrupt Trigger Mode", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT11_OFFSET (ParkingVersion),        "Parking Protocol Version", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT11_OFFSET (PerformanceInterrupt),  "Performance Interrupt", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT11_OFFSET (ParkedAddress),         "Parked Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT11_OFFSET (BaseAddress),           "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT11_OFFSET (GicvBaseAddress),       "Virtual GIC Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT11_OFFSET (GichBaseAddress),       "Hypervisor GIC Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT11_OFFSET (VgicInterrupt),         "Virtual GIC Interrupt", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT11_OFFSET (GicrBaseAddress),       "Redistributor Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT11_OFFSET (ArmMpidr),              "ARM MPIDR", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT11_OFFSET (EfficiencyClass),       "Efficiency Class", 0},
+    {ACPI_DMT_UINT24,   ACPI_MADT11_OFFSET (Reserved2[0]),          "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 12: Generic Interrupt Distributor (ACPI 5.0) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt12[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT12_OFFSET (Reserved),              "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT12_OFFSET (GicId),                 "Local GIC Hardware ID", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT12_OFFSET (BaseAddress),           "Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT12_OFFSET (GlobalIrqBase),         "Interrupt Base", 0},
+    {ACPI_DMT_UINT8,    ACPI_MADT12_OFFSET (Version),               "Version", 0},
+    {ACPI_DMT_UINT24,   ACPI_MADT12_OFFSET (Reserved2[0]),          "Reserved", 0},
+   ACPI_DMT_TERMINATOR
+};
+
+/* 13: Generic MSI Frame (ACPI 5.1) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt13[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT13_OFFSET (Reserved),              "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT13_OFFSET (MsiFrameId),            "MSI Frame ID", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT13_OFFSET (BaseAddress),           "Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT13_OFFSET (Flags),                 "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MADT13_FLAG_OFFSET (Flags,0),          "Select SPI", 0},
+    {ACPI_DMT_UINT16,   ACPI_MADT13_OFFSET (SpiCount),              "SPI Count", 0},
+    {ACPI_DMT_UINT16,   ACPI_MADT13_OFFSET (SpiBase),               "SPI Base", 0},
+   ACPI_DMT_TERMINATOR
+};
+
+/* 14: Generic Redistributor (ACPI 5.1) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt14[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT14_OFFSET (Reserved),              "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT14_OFFSET (BaseAddress),           "Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT14_OFFSET (Length),                "Length", 0},
+   ACPI_DMT_TERMINATOR
+};
+
+/* 15: Generic Translator (ACPI 6.0) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMadt15[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MADT15_OFFSET (Reserved),              "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT15_OFFSET (TranslationId),         "Translation ID", 0},
+    {ACPI_DMT_UINT64,   ACPI_MADT15_OFFSET (BaseAddress),           "Base Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_MADT15_OFFSET (Reserved2),             "Reserved", 0},
+   ACPI_DMT_TERMINATOR
+};
+
+/*******************************************************************************
+ *
+ * MCFG - PCI Memory Mapped Configuration table and Subtable
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMcfg[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_MCFG_OFFSET (Reserved[0]),             "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMcfg0[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_MCFG0_OFFSET (Address),                "Base Address", 0},
+    {ACPI_DMT_UINT16,   ACPI_MCFG0_OFFSET (PciSegment),             "Segment Group Number", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCFG0_OFFSET (StartBusNumber),         "Start Bus Number", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCFG0_OFFSET (EndBusNumber),           "End Bus Number", 0},
+    {ACPI_DMT_UINT32,   ACPI_MCFG0_OFFSET (Reserved),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * MCHI - Management Controller Host Interface table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMchi[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (InterfaceType),           "Interface Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (Protocol),                "Protocol", 0},
+    {ACPI_DMT_UINT64,   ACPI_MCHI_OFFSET (ProtocolData),            "Protocol Data", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (InterruptType),           "Interrupt Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (Gpe),                     "Gpe", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (PciDeviceFlag),           "Pci Device Flag", 0},
+    {ACPI_DMT_UINT32,   ACPI_MCHI_OFFSET (GlobalInterrupt),         "Global Interrupt", 0},
+    {ACPI_DMT_GAS,      ACPI_MCHI_OFFSET (ControlRegister),         "Control Register", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (PciSegment),              "Pci Segment", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (PciBus),                  "Pci Bus", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (PciDevice),               "Pci Device", 0},
+    {ACPI_DMT_UINT8,    ACPI_MCHI_OFFSET (PciFunction),             "Pci Function", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * MPST - Memory Power State Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMpst[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MPST_OFFSET (ChannelId),               "Channel ID", 0},
+    {ACPI_DMT_UINT24,   ACPI_MPST_OFFSET (Reserved1[0]),            "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_MPST_OFFSET (PowerNodeCount),          "Power Node Count", 0},
+    {ACPI_DMT_UINT16,   ACPI_MPST_OFFSET (Reserved2),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* MPST subtables */
+
+/* 0: Memory Power Node Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMpst0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MPST0_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MPST0_FLAG_OFFSET (Flags,0),           "Node Enabled", 0},
+    {ACPI_DMT_FLAG1,    ACPI_MPST0_FLAG_OFFSET (Flags,0),           "Power Managed", 0},
+    {ACPI_DMT_FLAG2,    ACPI_MPST0_FLAG_OFFSET (Flags,0),           "Hot Plug Capable", 0},
+
+    {ACPI_DMT_UINT8,    ACPI_MPST0_OFFSET (Reserved1),              "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_MPST0_OFFSET (NodeId),                 "Node ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_MPST0_OFFSET (Length),                 "Length", 0},
+    {ACPI_DMT_UINT64,   ACPI_MPST0_OFFSET (RangeAddress),           "Range Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_MPST0_OFFSET (RangeLength),            "Range Length", 0},
+    {ACPI_DMT_UINT32,   ACPI_MPST0_OFFSET (NumPowerStates),         "Num Power States", 0},
+    {ACPI_DMT_UINT32,   ACPI_MPST0_OFFSET (NumPhysicalComponents),  "Num Physical Components", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0A: Sub-subtable - Memory Power State Structure (follows Memory Power Node above) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMpst0A[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MPST0A_OFFSET (PowerState),            "Power State", 0},
+    {ACPI_DMT_UINT8,    ACPI_MPST0A_OFFSET (InfoIndex),             "InfoIndex", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0B: Sub-subtable - Physical Component ID Structure (follows Memory Power State(s) above) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMpst0B[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MPST0B_OFFSET (ComponentId),           "Component Id", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 01: Power Characteristics Count (follows all Power Node(s) above) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMpst1[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_MPST1_OFFSET (CharacteristicsCount),   "Characteristics Count", 0},
+    {ACPI_DMT_UINT16,   ACPI_MPST1_OFFSET (Reserved),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 02: Memory Power State Characteristics Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMpst2[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MPST2_OFFSET (StructureId),            "Structure ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_MPST2_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_MPST2_FLAG_OFFSET (Flags,0),           "Memory Preserved", 0},
+    {ACPI_DMT_FLAG1,    ACPI_MPST2_FLAG_OFFSET (Flags,0),           "Auto Entry", 0},
+    {ACPI_DMT_FLAG2,    ACPI_MPST2_FLAG_OFFSET (Flags,0),           "Auto Exit", 0},
+
+    {ACPI_DMT_UINT16,   ACPI_MPST2_OFFSET (Reserved1),              "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_MPST2_OFFSET (AveragePower),           "Average Power", 0},
+    {ACPI_DMT_UINT32,   ACPI_MPST2_OFFSET (PowerSaving),            "Power Saving", 0},
+    {ACPI_DMT_UINT64,   ACPI_MPST2_OFFSET (ExitLatency),            "Exit Latency", 0},
+    {ACPI_DMT_UINT64,   ACPI_MPST2_OFFSET (Reserved2),              "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * MSCT - Maximum System Characteristics Table (ACPI 4.0)
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMsct[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_MSCT_OFFSET (ProximityOffset),         "Proximity Offset", 0},
+    {ACPI_DMT_UINT32,   ACPI_MSCT_OFFSET (MaxProximityDomains),     "Max Proximity Domains", 0},
+    {ACPI_DMT_UINT32,   ACPI_MSCT_OFFSET (MaxClockDomains),         "Max Clock Domains", 0},
+    {ACPI_DMT_UINT64,   ACPI_MSCT_OFFSET (MaxAddress),              "Max Physical Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Subtable - Maximum Proximity Domain Information. Version 1 */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMsct0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_MSCT0_OFFSET (Revision),               "Revision", 0},
+    {ACPI_DMT_UINT8,    ACPI_MSCT0_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT32,   ACPI_MSCT0_OFFSET (RangeStart),             "Domain Range Start", 0},
+    {ACPI_DMT_UINT32,   ACPI_MSCT0_OFFSET (RangeEnd),               "Domain Range End", 0},
+    {ACPI_DMT_UINT32,   ACPI_MSCT0_OFFSET (ProcessorCapacity),      "Processor Capacity", 0},
+    {ACPI_DMT_UINT64,   ACPI_MSCT0_OFFSET (MemoryCapacity),         "Memory Capacity", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * MTMR - MID Timer Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMtmr[] =
+{
+    ACPI_DMT_TERMINATOR
+};
+
+/* MTMR Subtables - MTMR Entry */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoMtmr0[] =
+{
+    {ACPI_DMT_GAS,      ACPI_MTMR0_OFFSET (PhysicalAddress),        "PhysicalAddress", 0},
+    {ACPI_DMT_UINT32,   ACPI_MTMR0_OFFSET (Frequency),              "Frequency", 0},
+    {ACPI_DMT_UINT32,   ACPI_MTMR0_OFFSET (Irq),                    "IRQ", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * NFIT - NVDIMM Firmware Interface Table and Subtables - (ACPI 6.0)
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_NFIT_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common Subtable header */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfitHdr[] =
+{
+    {ACPI_DMT_NFIT,     ACPI_NFITH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFITH_OFFSET (Length),                 "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0: System Physical Address Range Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit0[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_NFIT0_OFFSET (RangeIndex),             "Range Index", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT0_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_NFIT0_FLAG_OFFSET (Flags,0),           "Add/Online Operation Only", 0},
+    {ACPI_DMT_FLAG1,    ACPI_NFIT0_FLAG_OFFSET (Flags,0),           "Proximity Domain Valid", 0},
+    {ACPI_DMT_UINT32,   ACPI_NFIT0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_NFIT0_OFFSET (ProximityDomain),        "Proximity Domain", 0},
+    {ACPI_DMT_UUID,     ACPI_NFIT0_OFFSET (RangeGuid[0]),           "Address Range GUID", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT0_OFFSET (Address),                "Address Range Base", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT0_OFFSET (Length),                 "Address Range Length", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT0_OFFSET (MemoryMapping),          "Memory Map Attribute", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: Memory Device to System Address Range Map Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_NFIT1_OFFSET (DeviceHandle),           "Device Handle", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (PhysicalId),             "Physical Id", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (RegionId),               "Region Id", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (RangeIndex),             "Range Index", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (RegionIndex),            "Control Region Index", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT1_OFFSET (RegionSize),             "Region Size", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT1_OFFSET (RegionOffset),           "Region Offset", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT1_OFFSET (Address),                "Address Region Base", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (InterleaveIndex),        "Interleave Index", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (InterleaveWays),         "Interleave Ways", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (Flags),                  "Flags", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_NFIT1_FLAG_OFFSET (Flags,0),           "Save to device failed", 0},
+    {ACPI_DMT_FLAG1,    ACPI_NFIT1_FLAG_OFFSET (Flags,0),           "Restore from device failed", 0},
+    {ACPI_DMT_FLAG2,    ACPI_NFIT1_FLAG_OFFSET (Flags,0),           "Platform flush failed", 0},
+    {ACPI_DMT_FLAG3,    ACPI_NFIT1_FLAG_OFFSET (Flags,0),           "Device not armed", 0},
+    {ACPI_DMT_FLAG4,    ACPI_NFIT1_FLAG_OFFSET (Flags,0),           "Health events observed", 0},
+    {ACPI_DMT_FLAG5,    ACPI_NFIT1_FLAG_OFFSET (Flags,0),           "Health events enabled", 0},
+    {ACPI_DMT_FLAG6,    ACPI_NFIT1_FLAG_OFFSET (Flags,0),           "Mapping failed", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT1_OFFSET (Reserved),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: Interleave Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit2[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_NFIT2_OFFSET (InterleaveIndex),        "Interleave Index", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT2_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_NFIT2_OFFSET (LineCount),              "Line Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_NFIT2_OFFSET (LineSize),               "Line Size", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit2a[] =
+{
+    {ACPI_DMT_UINT32,   0,                                          "Line Offset", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 3: SMBIOS Management Information Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit3[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_NFIT3_OFFSET (Reserved),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit3a[] =
+{
+    {ACPI_DMT_RAW_BUFFER, 0,                                        "SMBIOS Table Entries", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 4: NVDIMM Control Region Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit4[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (RegionIndex),            "Region Index", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (VendorId),               "Vendor Id", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (DeviceId),               "Device Id", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (RevisionId),             "Revision Id", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (SubsystemVendorId),      "Subsystem Vendor Id", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (SubsystemDeviceId),      "Subsystem Device Id", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (SubsystemRevisionId),    "Subsystem Revision Id", 0},
+    {ACPI_DMT_UINT8,    ACPI_NFIT4_OFFSET (ValidFields),            "Valid Fields", 0},
+    {ACPI_DMT_UINT8,    ACPI_NFIT4_OFFSET (ManufacturingLocation),  "Manufacturing Location", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (ManufacturingDate),      "Manufacturing Date", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (Reserved[0]),            "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_NFIT4_OFFSET (SerialNumber),           "Serial Number", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (Code),                   "Code", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (Windows),                "Window Count", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT4_OFFSET (WindowSize),             "Window Size", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT4_OFFSET (CommandOffset),          "Command Offset", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT4_OFFSET (CommandSize),            "Command Size", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT4_OFFSET (StatusOffset),           "Status Offset", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT4_OFFSET (StatusSize),             "Status Size", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT4_OFFSET (Flags),                  "Flags", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_NFIT4_FLAG_OFFSET (Flags,0),           "Windows buffered", 0},
+    {ACPI_DMT_UINT48,   ACPI_NFIT4_OFFSET (Reserved1[0]),           "Reserved1", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 5: NVDIMM Block Data Window Region Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit5[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_NFIT5_OFFSET (RegionIndex),            "Region Index", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT5_OFFSET (Windows),                "Window Count", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT5_OFFSET (Offset),                 "Offset", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT5_OFFSET (Size),                   "Size", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT5_OFFSET (Capacity),               "Capacity", 0},
+    {ACPI_DMT_UINT64,   ACPI_NFIT5_OFFSET (StartAddress),           "Start Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 6: Flush Hint Address Structure */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit6[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_NFIT6_OFFSET (DeviceHandle),           "Device Handle", 0},
+    {ACPI_DMT_UINT16,   ACPI_NFIT6_OFFSET (HintCount),              "Hint Count", 0},
+    {ACPI_DMT_UINT48,   ACPI_NFIT6_OFFSET (Reserved[0]),            "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoNfit6a[] =
+{
+    {ACPI_DMT_UINT64,   0,                                          "Hint Address", DT_OPTIONAL},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * PCCT - Platform Communications Channel Table (ACPI 5.0)
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPcct[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_PCCT_OFFSET (Flags),                   "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_PCCT_FLAG_OFFSET (Flags,0),            "Doorbell", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* PCCT subtables */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPcctHdr[] =
+{
+    {ACPI_DMT_PCCT,     ACPI_PCCT0_OFFSET (Header.Type),            "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_PCCT0_OFFSET (Header.Length),          "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0: Generic Communications Subspace */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPcct0[] =
+{
+    {ACPI_DMT_UINT48,   ACPI_PCCT0_OFFSET (Reserved[0]),            "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT0_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT0_OFFSET (Length),                 "Address Length", 0},
+    {ACPI_DMT_GAS,      ACPI_PCCT0_OFFSET (DoorbellRegister),       "Doorbell Register", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT0_OFFSET (PreserveMask),           "Preserve Mask", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT0_OFFSET (WriteMask),              "Write Mask", 0},
+    {ACPI_DMT_UINT32,   ACPI_PCCT0_OFFSET (Latency),                "Command Latency", 0},
+    {ACPI_DMT_UINT32,   ACPI_PCCT0_OFFSET (MaxAccessRate),          "Maximum Access Rate", 0},
+    {ACPI_DMT_UINT16,   ACPI_PCCT0_OFFSET (MinTurnaroundTime),      "Minimum Turnaround Time", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: HW-reduced Communications Subspace (ACPI 5.1) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPcct1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_PCCT1_OFFSET (DoorbellInterrupt),      "Doorbell Interrupt", 0},
+    {ACPI_DMT_UINT8,    ACPI_PCCT1_OFFSET (Flags),                  "Flags (Decoded Below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_PCCT1_FLAG_OFFSET (Flags,0),           "Polarity", 0},
+    {ACPI_DMT_FLAG1,    ACPI_PCCT1_FLAG_OFFSET (Flags,0),           "Mode", 0},
+    {ACPI_DMT_UINT8,    ACPI_PCCT1_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT1_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT1_OFFSET (Length),                 "Address Length", 0},
+    {ACPI_DMT_GAS,      ACPI_PCCT1_OFFSET (DoorbellRegister),       "Doorbell Register", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT1_OFFSET (PreserveMask),           "Preserve Mask", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT1_OFFSET (WriteMask),              "Write Mask", 0},
+    {ACPI_DMT_UINT32,   ACPI_PCCT1_OFFSET (Latency),                "Command Latency", 0},
+    {ACPI_DMT_UINT32,   ACPI_PCCT1_OFFSET (MaxAccessRate),          "Maximum Access Rate", 0},
+    {ACPI_DMT_UINT16,   ACPI_PCCT1_OFFSET (MinTurnaroundTime),      "Minimum Turnaround Time", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: HW-reduced Communications Subspace Type 2 (ACPI 6.1) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPcct2[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_PCCT2_OFFSET (DoorbellInterrupt),      "Doorbell Interrupt", 0},
+    {ACPI_DMT_UINT8,    ACPI_PCCT2_OFFSET (Flags),                  "Flags (Decoded Below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_PCCT2_FLAG_OFFSET (Flags,0),           "Polarity", 0},
+    {ACPI_DMT_FLAG1,    ACPI_PCCT2_FLAG_OFFSET (Flags,0),           "Mode", 0},
+    {ACPI_DMT_UINT8,    ACPI_PCCT2_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT2_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT2_OFFSET (Length),                 "Address Length", 0},
+    {ACPI_DMT_GAS,      ACPI_PCCT2_OFFSET (DoorbellRegister),       "Doorbell Register", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT2_OFFSET (PreserveMask),           "Preserve Mask", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT2_OFFSET (WriteMask),              "Write Mask", 0},
+    {ACPI_DMT_UINT32,   ACPI_PCCT2_OFFSET (Latency),                "Command Latency", 0},
+    {ACPI_DMT_UINT32,   ACPI_PCCT2_OFFSET (MaxAccessRate),          "Maximum Access Rate", 0},
+    {ACPI_DMT_UINT16,   ACPI_PCCT2_OFFSET (MinTurnaroundTime),      "Minimum Turnaround Time", 0},
+    {ACPI_DMT_GAS,      ACPI_PCCT2_OFFSET (DoorbellAckRegister),    "Doorbell ACK Register", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT2_OFFSET (AckPreserveMask),        "ACK Preserve Mask", 0},
+    {ACPI_DMT_UINT64,   ACPI_PCCT2_OFFSET (AckWriteMask),           "ACK Write Mask", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * PMTT - Platform Memory Topology Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPmtt[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_PMTT_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPmttHdr[] =
+{
+    {ACPI_DMT_PMTT,     ACPI_PMTTH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_PMTTH_OFFSET (Reserved1),              "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTTH_OFFSET (Length),                 "Length", DT_LENGTH},
+    {ACPI_DMT_UINT16,   ACPI_PMTTH_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_PMTTH_FLAG_OFFSET (Flags,0),           "Top-level Device", 0},
+    {ACPI_DMT_FLAG1,    ACPI_PMTTH_FLAG_OFFSET (Flags,0),           "Physical Element", 0},
+    {ACPI_DMT_FLAGS2,   ACPI_PMTTH_FLAG_OFFSET (Flags,0),           "Memory Type", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTTH_OFFSET (Reserved2),              "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* PMTT Subtables */
+
+/* 0: Socket */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPmtt0[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_PMTT0_OFFSET (SocketId),               "Socket ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTT0_OFFSET (Reserved),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: Memory Controller */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPmtt1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_PMTT1_OFFSET (ReadLatency),            "Read Latency", 0},
+    {ACPI_DMT_UINT32,   ACPI_PMTT1_OFFSET (WriteLatency),           "Write Latency", 0},
+    {ACPI_DMT_UINT32,   ACPI_PMTT1_OFFSET (ReadBandwidth),          "Read Bandwidth", 0},
+    {ACPI_DMT_UINT32,   ACPI_PMTT1_OFFSET (WriteBandwidth),         "Write Bandwidth", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTT1_OFFSET (AccessWidth),            "Access Width", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTT1_OFFSET (Alignment),              "Alignment", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTT1_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTT1_OFFSET (DomainCount),            "Domain Count", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1a: Proximity Domain */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPmtt1a[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_PMTT1A_OFFSET (ProximityDomain),       "Proximity Domain", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: Physical Component */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoPmtt2[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_PMTT2_OFFSET (ComponentId),            "Component ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_PMTT2_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_PMTT2_OFFSET (MemorySize),             "Memory Size", 0},
+    {ACPI_DMT_UINT32,   ACPI_PMTT2_OFFSET (BiosHandle),             "Bios Handle", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * S3PT - S3 Performance Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoS3pt[] =
+{
+    {ACPI_DMT_SIG,     ACPI_S3PT_OFFSET (Signature[0]),             "Signature", 0},
+    {ACPI_DMT_UINT32,  ACPI_S3PT_OFFSET (Length),                   "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* S3PT subtable header */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoS3ptHdr[] =
+{
+    {ACPI_DMT_UINT16,  ACPI_S3PTH_OFFSET (Type),                    "Type", 0},
+    {ACPI_DMT_UINT8,   ACPI_S3PTH_OFFSET (Length),                  "Length", DT_LENGTH},
+    {ACPI_DMT_UINT8,   ACPI_S3PTH_OFFSET (Revision),                "Revision", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 0: Basic S3 Resume Performance Record */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoS3pt0[] =
+{
+    {ACPI_DMT_UINT32,  ACPI_S3PT0_OFFSET (ResumeCount),             "Resume Count", 0},
+    {ACPI_DMT_UINT64,  ACPI_S3PT0_OFFSET (FullResume),              "Full Resume", 0},
+    {ACPI_DMT_UINT64,  ACPI_S3PT0_OFFSET (AverageResume),           "Average Resume", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: Basic S3 Suspend Performance Record */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoS3pt1[] =
+{
+    {ACPI_DMT_UINT64,  ACPI_S3PT1_OFFSET (SuspendStart),            "Suspend Start", 0},
+    {ACPI_DMT_UINT64,  ACPI_S3PT1_OFFSET (SuspendEnd),              "Suspend End", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * SBST - Smart Battery Specification Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSbst[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_SBST_OFFSET (WarningLevel),            "Warning Level", 0},
+    {ACPI_DMT_UINT32,   ACPI_SBST_OFFSET (LowLevel),                "Low Level", 0},
+    {ACPI_DMT_UINT32,   ACPI_SBST_OFFSET (CriticalLevel),           "Critical Level", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * SLIC - Software Licensing Description Table. This table contains the standard
+ * ACPI header followed by proprietary data structures
+ *
+ ******************************************************************************/
+
+/* Single subtable, a proprietary format, so treat it as a buffer */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSlic[] =
+{
+    {ACPI_DMT_RAW_BUFFER, 0,                                        "Software Licensing Structure", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * SLIT - System Locality Information Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSlit[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_SLIT_OFFSET (LocalityCount),           "Localities", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * SPCR - Serial Port Console Redirection table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSpcr[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (InterfaceType),           "Interface Type", 0},
+    {ACPI_DMT_UINT24,   ACPI_SPCR_OFFSET (Reserved[0]),             "Reserved", 0},
+    {ACPI_DMT_GAS,      ACPI_SPCR_OFFSET (SerialPort),              "Serial Port Register", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (InterruptType),           "Interrupt Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (PcInterrupt),             "PCAT-compatible IRQ", 0},
+    {ACPI_DMT_UINT32,   ACPI_SPCR_OFFSET (Interrupt),               "Interrupt", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (BaudRate),                "Baud Rate", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (Parity),                  "Parity", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (StopBits),                "Stop Bits", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (FlowControl),             "Flow Control", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (TerminalType),            "Terminal Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (Reserved2),               "Reserved", 0},
+    {ACPI_DMT_UINT16,   ACPI_SPCR_OFFSET (PciDeviceId),             "PCI Device ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_SPCR_OFFSET (PciVendorId),             "PCI Vendor ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (PciBus),                  "PCI Bus", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (PciDevice),               "PCI Device", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (PciFunction),             "PCI Function", 0},
+    {ACPI_DMT_UINT32,   ACPI_SPCR_OFFSET (PciFlags),                "PCI Flags", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPCR_OFFSET (PciSegment),              "PCI Segment", 0},
+    {ACPI_DMT_UINT32,   ACPI_SPCR_OFFSET (Reserved2),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * SPMI - Server Platform Management Interface table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSpmi[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (InterfaceType),           "Interface Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (Reserved),                "Reserved", DT_NON_ZERO}, /* Value must be 1 */
+    {ACPI_DMT_UINT16,   ACPI_SPMI_OFFSET (SpecRevision),            "IPMI Spec Version", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (InterruptType),           "Interrupt Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (GpeNumber),               "GPE Number", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (Reserved1),               "Reserved", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (PciDeviceFlag),           "PCI Device Flag", 0},
+    {ACPI_DMT_UINT32,   ACPI_SPMI_OFFSET (Interrupt),               "Interrupt", 0},
+    {ACPI_DMT_GAS,      ACPI_SPMI_OFFSET (IpmiRegister),            "IPMI Register", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (PciSegment),              "PCI Segment", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (PciBus),                  "PCI Bus", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (PciDevice),               "PCI Device", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (PciFunction),             "PCI Function", 0},
+    {ACPI_DMT_UINT8,    ACPI_SPMI_OFFSET (Reserved2),               "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * SRAT - System Resource Affinity Table and Subtables
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSrat[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_SRAT_OFFSET (TableRevision),           "Table Revision", 0},
+    {ACPI_DMT_UINT64,   ACPI_SRAT_OFFSET (Reserved),                "Reserved", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* Common Subtable header (one per Subtable) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSratHdr[] =
+{
+    {ACPI_DMT_SRAT,     ACPI_SRATH_OFFSET (Type),                   "Subtable Type", 0},
+    {ACPI_DMT_UINT8,    ACPI_SRATH_OFFSET (Length),                 "Length", DT_LENGTH},
+    ACPI_DMT_TERMINATOR
+};
+
+/* SRAT Subtables */
+
+/* 0: Processor Local APIC/SAPIC Affinity */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSrat0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_SRAT0_OFFSET (ProximityDomainLo),      "Proximity Domain Low(8)", 0},
+    {ACPI_DMT_UINT8,    ACPI_SRAT0_OFFSET (ApicId),                 "Apic ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT0_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_SRAT0_FLAG_OFFSET (Flags,0),           "Enabled", 0},
+    {ACPI_DMT_UINT8,    ACPI_SRAT0_OFFSET (LocalSapicEid),          "Local Sapic EID", 0},
+    {ACPI_DMT_UINT24,   ACPI_SRAT0_OFFSET (ProximityDomainHi[0]),   "Proximity Domain High(24)", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT0_OFFSET (ClockDomain),            "Clock Domain", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 1: Memory Affinity */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSrat1[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_SRAT1_OFFSET (ProximityDomain),        "Proximity Domain", 0},
+    {ACPI_DMT_UINT16,   ACPI_SRAT1_OFFSET (Reserved),               "Reserved1", 0},
+    {ACPI_DMT_UINT64,   ACPI_SRAT1_OFFSET (BaseAddress),            "Base Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_SRAT1_OFFSET (Length),                 "Address Length", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT1_OFFSET (Reserved1),              "Reserved2", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT1_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_SRAT1_FLAG_OFFSET (Flags,0),           "Enabled", 0},
+    {ACPI_DMT_FLAG1,    ACPI_SRAT1_FLAG_OFFSET (Flags,0),           "Hot Pluggable", 0},
+    {ACPI_DMT_FLAG2,    ACPI_SRAT1_FLAG_OFFSET (Flags,0),           "Non-Volatile", 0},
+    {ACPI_DMT_UINT64,   ACPI_SRAT1_OFFSET (Reserved2),              "Reserved3", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* 2: Processor Local X2_APIC Affinity (ACPI 4.0) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSrat2[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_SRAT2_OFFSET (Reserved),               "Reserved1", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT2_OFFSET (ProximityDomain),        "Proximity Domain", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT2_OFFSET (ApicId),                 "Apic ID", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT2_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_SRAT2_FLAG_OFFSET (Flags,0),           "Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT2_OFFSET (ClockDomain),            "Clock Domain", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT2_OFFSET (Reserved2),              "Reserved2", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* : GICC Affinity (ACPI 5.1) */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoSrat3[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_SRAT3_OFFSET (ProximityDomain),        "Proximity Domain", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT3_OFFSET (AcpiProcessorUid),       "Acpi Processor UID", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT3_OFFSET (Flags),                  "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_SRAT3_FLAG_OFFSET (Flags,0),           "Enabled", 0},
+    {ACPI_DMT_UINT32,   ACPI_SRAT3_OFFSET (ClockDomain),            "Clock Domain", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * STAO - Status Override Table (_STA override) - ACPI 6.0
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoStao[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_STAO_OFFSET (IgnoreUart),              "Ignore UART", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoStaoStr[] =
+{
+    {ACPI_DMT_STRING,   0,                                          "Namepath", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * TCPA - Trusted Computing Platform Alliance table (Client)
+ *
+ * NOTE: There are two versions of the table with the same signature --
+ * the client version and the server version. The common PlatformClass
+ * field is used to differentiate the two types of tables.
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoTcpaHdr[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_TCPA_OFFSET (PlatformClass),           "Platform Class", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoTcpaClient[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_TCPA_CLIENT_OFFSET (MinimumLogLength), "Min Event Log Length", 0},
+    {ACPI_DMT_UINT64,   ACPI_TCPA_CLIENT_OFFSET (LogAddress),       "Event Log Address", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoTcpaServer[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_TCPA_SERVER_OFFSET (Reserved),         "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_TCPA_SERVER_OFFSET (MinimumLogLength), "Min Event Log Length", 0},
+    {ACPI_DMT_UINT64,   ACPI_TCPA_SERVER_OFFSET (LogAddress),       "Event Log Address", 0},
+    {ACPI_DMT_UINT16,   ACPI_TCPA_SERVER_OFFSET (SpecRevision),     "Specification Revision", 0},
+    {ACPI_DMT_UINT8,    ACPI_TCPA_SERVER_OFFSET (DeviceFlags),      "Device Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_TCPA_SERVER_OFFSET (DeviceFlags),      "Pci Device", 0},
+    {ACPI_DMT_FLAG1,    ACPI_TCPA_SERVER_OFFSET (DeviceFlags),      "Bus is Pnp", 0},
+    {ACPI_DMT_FLAG2,    ACPI_TCPA_SERVER_OFFSET (DeviceFlags),      "Address Valid", 0},
+    {ACPI_DMT_UINT8,    ACPI_TCPA_SERVER_OFFSET (InterruptFlags),   "Interrupt Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_TCPA_SERVER_OFFSET (InterruptFlags),   "Mode", 0},
+    {ACPI_DMT_FLAG1,    ACPI_TCPA_SERVER_OFFSET (InterruptFlags),   "Polarity", 0},
+    {ACPI_DMT_FLAG2,    ACPI_TCPA_SERVER_OFFSET (InterruptFlags),   "GPE SCI Triggered", 0},
+    {ACPI_DMT_FLAG3,    ACPI_TCPA_SERVER_OFFSET (InterruptFlags),   "Global System Interrupt", 0},
+    {ACPI_DMT_UINT8,    ACPI_TCPA_SERVER_OFFSET (GpeNumber),        "Gpe Number", 0},
+    {ACPI_DMT_UINT24,   ACPI_TCPA_SERVER_OFFSET (Reserved2[0]),     "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_TCPA_SERVER_OFFSET (GlobalInterrupt),  "Global Interrupt", 0},
+    {ACPI_DMT_GAS,      ACPI_TCPA_SERVER_OFFSET (Address),          "Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_TCPA_SERVER_OFFSET (Reserved3),        "Reserved", 0},
+    {ACPI_DMT_GAS,      ACPI_TCPA_SERVER_OFFSET (ConfigAddress),    "Configuration Address", 0},
+    {ACPI_DMT_UINT8,    ACPI_TCPA_SERVER_OFFSET (Group),            "Pci Group", 0},
+    {ACPI_DMT_UINT8,    ACPI_TCPA_SERVER_OFFSET (Bus),              "Pci Bus", 0},
+    {ACPI_DMT_UINT8,    ACPI_TCPA_SERVER_OFFSET (Device),           "Pci Device", 0},
+    {ACPI_DMT_UINT8,    ACPI_TCPA_SERVER_OFFSET (Function),         "Pci Function", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * TPM2 - Trusted Platform Module (TPM) 2.0 Hardware Interface Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoTpm2[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_TPM2_OFFSET (PlatformClass),           "Platform Class", 0},
+    {ACPI_DMT_UINT16,   ACPI_TPM2_OFFSET (Reserved),                "Reserved", 0},
+    {ACPI_DMT_UINT64,   ACPI_TPM2_OFFSET (ControlAddress),          "Control Address", 0},
+    {ACPI_DMT_UINT32,   ACPI_TPM2_OFFSET (StartMethod),             "Start Method", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * UEFI - UEFI Boot optimization Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoUefi[] =
+{
+    {ACPI_DMT_UUID,     ACPI_UEFI_OFFSET (Identifier[0]),           "UUID Identifier", 0},
+    {ACPI_DMT_UINT16,   ACPI_UEFI_OFFSET (DataOffset),              "Data Offset", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * VRTC - Virtual Real Time Clock Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoVrtc[] =
+{
+    ACPI_DMT_TERMINATOR
+};
+
+/* VRTC Subtables - VRTC Entry */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoVrtc0[] =
+{
+    {ACPI_DMT_GAS,      ACPI_VRTC0_OFFSET (PhysicalAddress),        "PhysicalAddress", 0},
+    {ACPI_DMT_UINT32,   ACPI_VRTC0_OFFSET (Irq),                    "IRQ", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * WAET - Windows ACPI Emulated devices Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoWaet[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_WAET_OFFSET (Flags),                   "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_WAET_OFFSET (Flags),                   "RTC needs no INT ack", 0},
+    {ACPI_DMT_FLAG1,    ACPI_WAET_OFFSET (Flags),                   "PM timer, one read only", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * WDAT - Watchdog Action Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoWdat[] =
+{
+    {ACPI_DMT_UINT32,   ACPI_WDAT_OFFSET (HeaderLength),            "Header Length", DT_LENGTH},
+    {ACPI_DMT_UINT16,   ACPI_WDAT_OFFSET (PciSegment),              "PCI Segment", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDAT_OFFSET (PciBus),                  "PCI Bus", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDAT_OFFSET (PciDevice),               "PCI Device", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDAT_OFFSET (PciFunction),             "PCI Function", 0},
+    {ACPI_DMT_UINT24,   ACPI_WDAT_OFFSET (Reserved[0]),             "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_WDAT_OFFSET (TimerPeriod),             "Timer Period", 0},
+    {ACPI_DMT_UINT32,   ACPI_WDAT_OFFSET (MaxCount),                "Max Count", 0},
+    {ACPI_DMT_UINT32,   ACPI_WDAT_OFFSET (MinCount),                "Min Count", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDAT_OFFSET (Flags),                   "Flags (decoded below)", DT_FLAG},
+    {ACPI_DMT_FLAG0,    ACPI_WDAT_OFFSET (Flags),                   "Enabled", 0},
+    {ACPI_DMT_FLAG7,    ACPI_WDAT_OFFSET (Flags),                   "Stopped When Asleep", 0},
+    {ACPI_DMT_UINT24,   ACPI_WDAT_OFFSET (Reserved2[0]),            "Reserved", 0},
+    {ACPI_DMT_UINT32,   ACPI_WDAT_OFFSET (Entries),                 "Watchdog Entry Count", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+/* WDAT Subtables - Watchdog Instruction Entries */
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoWdat0[] =
+{
+    {ACPI_DMT_UINT8,    ACPI_WDAT0_OFFSET (Action),                 "Watchdog Action", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDAT0_OFFSET (Instruction),            "Instruction", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDAT0_OFFSET (Reserved),               "Reserved", 0},
+    {ACPI_DMT_GAS,      ACPI_WDAT0_OFFSET (RegisterRegion),         "Register Region", 0},
+    {ACPI_DMT_UINT32,   ACPI_WDAT0_OFFSET (Value),                  "Value", 0},
+    {ACPI_DMT_UINT32,   ACPI_WDAT0_OFFSET (Mask),                   "Register Mask", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * WDDT - Watchdog Description Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoWddt[] =
+{
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (SpecVersion),             "Specification Version", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (TableVersion),            "Table Version", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (PciVendorId),             "PCI Vendor ID", 0},
+    {ACPI_DMT_GAS,      ACPI_WDDT_OFFSET (Address),                 "Timer Register", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (MaxCount),                "Max Count", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (MinCount),                "Min Count", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (Period),                  "Period", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (Status),                  "Status (decoded below)", 0},
+
+    /* Status Flags byte 0 */
+
+    {ACPI_DMT_FLAG0,    ACPI_WDDT_FLAG_OFFSET (Status,0),           "Available", 0},
+    {ACPI_DMT_FLAG1,    ACPI_WDDT_FLAG_OFFSET (Status,0),           "Active", 0},
+    {ACPI_DMT_FLAG2,    ACPI_WDDT_FLAG_OFFSET (Status,0),           "OS Owns", 0},
+
+    /* Status Flags byte 1 */
+
+    {ACPI_DMT_FLAG3,    ACPI_WDDT_FLAG_OFFSET (Status,1),           "User Reset", 0},
+    {ACPI_DMT_FLAG4,    ACPI_WDDT_FLAG_OFFSET (Status,1),           "Timeout Reset", 0},
+    {ACPI_DMT_FLAG5,    ACPI_WDDT_FLAG_OFFSET (Status,1),           "Power Fail Reset", 0},
+    {ACPI_DMT_FLAG6,    ACPI_WDDT_FLAG_OFFSET (Status,1),           "Unknown Reset", 0},
+
+    {ACPI_DMT_UINT16,   ACPI_WDDT_OFFSET (Capability),              "Capability (decoded below)", 0},
+
+    /* Capability Flags byte 0 */
+
+    {ACPI_DMT_FLAG0,    ACPI_WDDT_FLAG_OFFSET (Capability,0),       "Auto Reset", 0},
+    {ACPI_DMT_FLAG1,    ACPI_WDDT_FLAG_OFFSET (Capability,0),       "Timeout Alert", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * WDRT - Watchdog Resource Table
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoWdrt[] =
+{
+    {ACPI_DMT_GAS,      ACPI_WDRT_OFFSET (ControlRegister),         "Control Register", 0},
+    {ACPI_DMT_GAS,      ACPI_WDRT_OFFSET (CountRegister),           "Count Register", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDRT_OFFSET (PciDeviceId),             "PCI Device ID", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDRT_OFFSET (PciVendorId),             "PCI Vendor ID", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDRT_OFFSET (PciBus),                  "PCI Bus", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDRT_OFFSET (PciDevice),               "PCI Device", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDRT_OFFSET (PciFunction),             "PCI Function", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDRT_OFFSET (PciSegment),              "PCI Segment", 0},
+    {ACPI_DMT_UINT16,   ACPI_WDRT_OFFSET (MaxCount),                "Max Count", 0},
+    {ACPI_DMT_UINT8,    ACPI_WDRT_OFFSET (Units),                   "Counter Units", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * WPBT - Windows Platform Environment Table (ACPI 6.0)
+ *        Version 1
+ *
+ * Conforms to "Windows Platform Binary Table (WPBT)" 29 November 2011
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoWpbt[] =
+{
+    {ACPI_DMT_UINT32,      ACPI_WPBT_OFFSET (HandoffSize),          "Handoff Size", 0},
+    {ACPI_DMT_UINT64,      ACPI_WPBT_OFFSET (HandoffAddress),       "Handoff Address", 0},
+    {ACPI_DMT_UINT8,       ACPI_WPBT_OFFSET (Layout),               "Layout", 0},
+    {ACPI_DMT_UINT8,       ACPI_WPBT_OFFSET (Type),                 "Type", 0},
+    {ACPI_DMT_UINT16,      ACPI_WPBT_OFFSET (ArgumentsLength),      "Arguments Length", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoWpbt0[] =
+{
+    {ACPI_DMT_UNICODE,     sizeof (ACPI_TABLE_WPBT),                "Command-line Arguments", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*******************************************************************************
+ *
+ * XENV -  Xen Environment table (ACPI 6.0)
+ *
+ ******************************************************************************/
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoXenv[] =
+{
+    {ACPI_DMT_UINT64,   ACPI_XENV_OFFSET (GrantTableAddress),       "Grant Table Address", 0},
+    {ACPI_DMT_UINT64,   ACPI_XENV_OFFSET (GrantTableSize),          "Grant Table Size", 0},
+    {ACPI_DMT_UINT32,   ACPI_XENV_OFFSET (EventInterrupt),          "Event Interrupt", 0},
+    {ACPI_DMT_UINT8,    ACPI_XENV_OFFSET (EventFlags),              "Event Flags", 0},
+    ACPI_DMT_TERMINATOR
+};
+
+
+/*! [Begin] no source code translation */
+
+/*
+ * Generic types (used in UEFI and custom tables)
+ *
+ * Examples:
+ *
+ *     Buffer : cc 04 ff bb
+ *      UINT8 : 11
+ *     UINT16 : 1122
+ *     UINT24 : 112233
+ *     UINT32 : 11223344
+ *     UINT56 : 11223344556677
+ *     UINT64 : 1122334455667788
+ *
+ *     String : "This is string"
+ *    Unicode : "This string encoded to Unicode"
+ *
+ *       GUID : 11223344-5566-7788-99aa-bbccddeeff00
+ * DevicePath : "\PciRoot(0)\Pci(0x1f,1)\Usb(0,0)"
+ */
+
+#define ACPI_DM_GENERIC_ENTRY(FieldType, FieldName) \
+    {{FieldType, 0, FieldName, 0}, ACPI_DMT_TERMINATOR}
+
+ACPI_DMTABLE_INFO           AcpiDmTableInfoGeneric[][2] =
+{
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT8,      "UINT8"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT16,     "UINT16"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT24,     "UINT24"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT32,     "UINT32"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT40,     "UINT40"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT48,     "UINT48"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT56,     "UINT56"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UINT64,     "UINT64"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_STRING,     "String"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UNICODE,    "Unicode"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_BUFFER,     "Buffer"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_UUID,       "GUID"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_STRING,     "DevicePath"),
+    ACPI_DM_GENERIC_ENTRY (ACPI_DMT_LABEL,      "Label"),
+    {ACPI_DMT_TERMINATOR}
+};
+/*! [End] no source code translation !*/
diff --git a/usr/src/cmd/acpi/common/osl.c b/usr/src/cmd/acpi/common/osl.c
index 599592b6de..f7e00ad757 100644
--- a/usr/src/cmd/acpi/common/osl.c
+++ b/usr/src/cmd/acpi/common/osl.c
@@ -10,55 +10,60 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
-#include <stdio.h>
+#include <fcntl.h>
 #include <stdarg.h>
+#include <stdio.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
 #include "acpi.h"
 #include "accommon.h"
 
-ACPI_STATUS
-AcpiOsInitialize(void)
+UINT32
+CmGetFileSize(ACPI_FILE File)
 {
-	return (AE_OK);
-}
+	int fd;
+	struct stat sb;
 
-/*
- * The locking functions are no-ops because the application tools that use
- * these are all single threaded. However, due to the common code base that we
- * pull in from Intel, these functions are also called when the software is
- * compiled into the kernel, where it does need to do locking.
- */
-ACPI_CPU_FLAGS
-AcpiOsAcquireLock(ACPI_HANDLE Handle)
-{
-	return (AE_OK);
+	fd = fileno(File);
+	if (fstat(fd, &sb) != 0)
+		return (ACPI_UINT32_MAX);
+	return ((UINT32)sb.st_size);
 }
 
-void
-AcpiOsReleaseLock(ACPI_HANDLE Handle, ACPI_CPU_FLAGS Flags)
+int
+AcpiOsWriteFile(ACPI_FILE File, void *Buffer, ACPI_SIZE Size, ACPI_SIZE Count)
 {
+	return (fwrite(Buffer, Size, Count, File));
 }
 
-void
-AcpiOsVprintf(const char *Format, va_list Args)
+ACPI_FILE
+AcpiOsOpenFile(const char *Path, UINT8 Modes)
 {
-	vprintf(Format, Args);
+	char mode[3];
+
+	bzero(mode, sizeof (mode));
+	if ((Modes & ACPI_FILE_READING) != 0)
+		(void) strlcat(mode, "r", sizeof (mode));
+
+	if ((Modes & ACPI_FILE_WRITING) != 0)
+		(void) strlcat(mode, "w", sizeof (mode));
+
+	return (fopen(Path, mode));
 }
 
-void ACPI_INTERNAL_VAR_XFACE
-AcpiOsPrintf(const char *Format, ...)
+void
+AcpiOsCloseFile(ACPI_FILE File)
 {
-	va_list ap;
-
-	va_start(ap, Format);
-	AcpiOsVprintf(Format, ap);
-	va_end(ap);
+	fclose(File);
 }
 
 int
-AcpiOsWriteFile(ACPI_FILE File, void *Buffer, ACPI_SIZE Size, ACPI_SIZE Count)
+AcpiOsReadFile(ACPI_FILE File, void *Buffer, ACPI_SIZE Size, ACPI_SIZE Count)
 {
-	return (fwrite(Buffer, Size, Count, File));
+	return (fread(Buffer, Size, Count, File));
 }
diff --git a/usr/src/cmd/acpi/common/osunixxf.c b/usr/src/cmd/acpi/common/osunixxf.c
new file mode 100644
index 0000000000..21ac91d847
--- /dev/null
+++ b/usr/src/cmd/acpi/common/osunixxf.c
@@ -0,0 +1,1540 @@
+/******************************************************************************
+ *
+ * Module Name: osunixxf - UNIX OSL interfaces
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+/*
+ * These interfaces are required in order to compile the ASL compiler and the
+ * various ACPICA tools under Linux or other Unix-like system.
+ */
+#include "acpi.h"
+#include "accommon.h"
+#include "amlcode.h"
+#include "acparser.h"
+#include "acdebug.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <unistd.h>
+#include <sys/time.h>
+#include <semaphore.h>
+#include <pthread.h>
+#include <errno.h>
+
+#define _COMPONENT          ACPI_OS_SERVICES
+        ACPI_MODULE_NAME    ("osunixxf")
+
+
+BOOLEAN                        AcpiGbl_DebugTimeout = FALSE;
+
+
+/* Upcalls to AcpiExec */
+
+void
+AeTableOverride (
+    ACPI_TABLE_HEADER       *ExistingTable,
+    ACPI_TABLE_HEADER       **NewTable);
+
+typedef void* (*PTHREAD_CALLBACK) (void *);
+
+/* Buffer used by AcpiOsVprintf */
+
+#define ACPI_VPRINTF_BUFFER_SIZE    512
+#define _ASCII_NEWLINE              '\n'
+
+/* Terminal support for AcpiExec only */
+
+#ifdef ACPI_EXEC_APP
+#include <termios.h>
+
+struct termios              OriginalTermAttributes;
+int                         TermAttributesWereSet = 0;
+
+ACPI_STATUS
+AcpiUtReadLine (
+    char                    *Buffer,
+    UINT32                  BufferLength,
+    UINT32                  *BytesRead);
+
+static void
+OsEnterLineEditMode (
+    void);
+
+static void
+OsExitLineEditMode (
+    void);
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    OsEnterLineEditMode, OsExitLineEditMode
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Enter/Exit the raw character input mode for the terminal.
+ *
+ * Interactive line-editing support for the AML debugger. Used with the
+ * common/acgetline module.
+ *
+ * readline() is not used because of non-portability. It is not available
+ * on all systems, and if it is, often the package must be manually installed.
+ *
+ * Therefore, we use the POSIX tcgetattr/tcsetattr and do the minimal line
+ * editing that we need in AcpiOsGetLine.
+ *
+ * If the POSIX tcgetattr/tcsetattr interfaces are unavailable, these
+ * calls will also work:
+ *     For OsEnterLineEditMode: system ("stty cbreak -echo")
+ *     For OsExitLineEditMode:  system ("stty cooked echo")
+ *
+ *****************************************************************************/
+
+static void
+OsEnterLineEditMode (
+    void)
+{
+    struct termios          LocalTermAttributes;
+
+
+    TermAttributesWereSet = 0;
+
+    /* STDIN must be a terminal */
+
+    if (!isatty (STDIN_FILENO))
+    {
+        return;
+    }
+
+    /* Get and keep the original attributes */
+
+    if (tcgetattr (STDIN_FILENO, &OriginalTermAttributes))
+    {
+        fprintf (stderr, "Could not get terminal attributes!\n");
+        return;
+    }
+
+    /* Set the new attributes to enable raw character input */
+
+    memcpy (&LocalTermAttributes, &OriginalTermAttributes,
+        sizeof (struct termios));
+
+    LocalTermAttributes.c_lflag &= ~(ICANON | ECHO);
+    LocalTermAttributes.c_cc[VMIN] = 1;
+    LocalTermAttributes.c_cc[VTIME] = 0;
+
+    if (tcsetattr (STDIN_FILENO, TCSANOW, &LocalTermAttributes))
+    {
+        fprintf (stderr, "Could not set terminal attributes!\n");
+        return;
+    }
+
+    TermAttributesWereSet = 1;
+}
+
+
+static void
+OsExitLineEditMode (
+    void)
+{
+
+    if (!TermAttributesWereSet)
+    {
+        return;
+    }
+
+    /* Set terminal attributes back to the original values */
+
+    if (tcsetattr (STDIN_FILENO, TCSANOW, &OriginalTermAttributes))
+    {
+        fprintf (stderr, "Could not restore terminal attributes!\n");
+    }
+}
+
+
+#else
+
+/* These functions are not needed for other ACPICA utilities */
+
+#define OsEnterLineEditMode()
+#define OsExitLineEditMode()
+#endif
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsInitialize, AcpiOsTerminate
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Initialize and terminate this module.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsInitialize (
+    void)
+{
+    ACPI_STATUS            Status;
+
+
+    AcpiGbl_OutputFile = stdout;
+
+    OsEnterLineEditMode ();
+
+    Status = AcpiOsCreateLock (&AcpiGbl_PrintLock);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiOsTerminate (
+    void)
+{
+
+    OsExitLineEditMode ();
+    return (AE_OK);
+}
+
+
+#ifndef ACPI_USE_NATIVE_RSDP_POINTER
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsGetRootPointer
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      RSDP physical address
+ *
+ * DESCRIPTION: Gets the ACPI root pointer (RSDP)
+ *
+ *****************************************************************************/
+
+ACPI_PHYSICAL_ADDRESS
+AcpiOsGetRootPointer (
+    void)
+{
+
+    return (0);
+}
+#endif
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsPredefinedOverride
+ *
+ * PARAMETERS:  InitVal             - Initial value of the predefined object
+ *              NewVal              - The new value for the object
+ *
+ * RETURN:      Status, pointer to value. Null pointer returned if not
+ *              overriding.
+ *
+ * DESCRIPTION: Allow the OS to override predefined names
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsPredefinedOverride (
+    const ACPI_PREDEFINED_NAMES *InitVal,
+    ACPI_STRING                 *NewVal)
+{
+
+    if (!InitVal || !NewVal)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+    *NewVal = NULL;
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsTableOverride
+ *
+ * PARAMETERS:  ExistingTable       - Header of current table (probably
+ *                                    firmware)
+ *              NewTable            - Where an entire new table is returned.
+ *
+ * RETURN:      Status, pointer to new table. Null pointer returned if no
+ *              table is available to override
+ *
+ * DESCRIPTION: Return a different version of a table if one is available
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsTableOverride (
+    ACPI_TABLE_HEADER       *ExistingTable,
+    ACPI_TABLE_HEADER       **NewTable)
+{
+
+    if (!ExistingTable || !NewTable)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+    *NewTable = NULL;
+
+#ifdef ACPI_EXEC_APP
+
+    AeTableOverride (ExistingTable, NewTable);
+    return (AE_OK);
+#else
+
+    return (AE_NO_ACPI_TABLES);
+#endif
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsPhysicalTableOverride
+ *
+ * PARAMETERS:  ExistingTable       - Header of current table (probably firmware)
+ *              NewAddress          - Where new table address is returned
+ *                                    (Physical address)
+ *              NewTableLength      - Where new table length is returned
+ *
+ * RETURN:      Status, address/length of new table. Null pointer returned
+ *              if no table is available to override.
+ *
+ * DESCRIPTION: Returns AE_SUPPORT, function not used in user space.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsPhysicalTableOverride (
+    ACPI_TABLE_HEADER       *ExistingTable,
+    ACPI_PHYSICAL_ADDRESS   *NewAddress,
+    UINT32                  *NewTableLength)
+{
+
+    return (AE_SUPPORT);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsRedirectOutput
+ *
+ * PARAMETERS:  Destination         - An open file handle/pointer
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Causes redirect of AcpiOsPrintf and AcpiOsVprintf
+ *
+ *****************************************************************************/
+
+void
+AcpiOsRedirectOutput (
+    void                    *Destination)
+{
+
+    AcpiGbl_OutputFile = Destination;
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsPrintf
+ *
+ * PARAMETERS:  fmt, ...            - Standard printf format
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Formatted output. Note: very similar to AcpiOsVprintf
+ *              (performance), changes should be tracked in both functions.
+ *
+ *****************************************************************************/
+
+void ACPI_INTERNAL_VAR_XFACE
+AcpiOsPrintf (
+    const char              *Fmt,
+    ...)
+{
+    va_list                 Args;
+    UINT8                   Flags;
+
+
+    Flags = AcpiGbl_DbOutputFlags;
+    if (Flags & ACPI_DB_REDIRECTABLE_OUTPUT)
+    {
+        /* Output is directable to either a file (if open) or the console */
+
+        if (AcpiGbl_DebugFile)
+        {
+            /* Output file is open, send the output there */
+
+            va_start (Args, Fmt);
+            vfprintf (AcpiGbl_DebugFile, Fmt, Args);
+            va_end (Args);
+        }
+        else
+        {
+            /* No redirection, send output to console (once only!) */
+
+            Flags |= ACPI_DB_CONSOLE_OUTPUT;
+        }
+    }
+
+    if (Flags & ACPI_DB_CONSOLE_OUTPUT)
+    {
+        va_start (Args, Fmt);
+        vfprintf (AcpiGbl_OutputFile, Fmt, Args);
+        va_end (Args);
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsVprintf
+ *
+ * PARAMETERS:  fmt                 - Standard printf format
+ *              args                - Argument list
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Formatted output with argument list pointer. Note: very
+ *              similar to AcpiOsPrintf, changes should be tracked in both
+ *              functions.
+ *
+ *****************************************************************************/
+
+void
+AcpiOsVprintf (
+    const char              *Fmt,
+    va_list                 Args)
+{
+    UINT8                   Flags;
+    char                    Buffer[ACPI_VPRINTF_BUFFER_SIZE];
+
+
+    /*
+     * We build the output string in a local buffer because we may be
+     * outputting the buffer twice. Using vfprintf is problematic because
+     * some implementations modify the args pointer/structure during
+     * execution. Thus, we use the local buffer for portability.
+     *
+     * Note: Since this module is intended for use by the various ACPICA
+     * utilities/applications, we can safely declare the buffer on the stack.
+     * Also, This function is used for relatively small error messages only.
+     */
+    vsnprintf (Buffer, ACPI_VPRINTF_BUFFER_SIZE, Fmt, Args);
+
+    Flags = AcpiGbl_DbOutputFlags;
+    if (Flags & ACPI_DB_REDIRECTABLE_OUTPUT)
+    {
+        /* Output is directable to either a file (if open) or the console */
+
+        if (AcpiGbl_DebugFile)
+        {
+            /* Output file is open, send the output there */
+
+            fputs (Buffer, AcpiGbl_DebugFile);
+        }
+        else
+        {
+            /* No redirection, send output to console (once only!) */
+
+            Flags |= ACPI_DB_CONSOLE_OUTPUT;
+        }
+    }
+
+    if (Flags & ACPI_DB_CONSOLE_OUTPUT)
+    {
+        fputs (Buffer, AcpiGbl_OutputFile);
+    }
+}
+
+
+#ifndef ACPI_EXEC_APP
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsGetLine
+ *
+ * PARAMETERS:  Buffer              - Where to return the command line
+ *              BufferLength        - Maximum length of Buffer
+ *              BytesRead           - Where the actual byte count is returned
+ *
+ * RETURN:      Status and actual bytes read
+ *
+ * DESCRIPTION: Get the next input line from the terminal. NOTE: For the
+ *              AcpiExec utility, we use the acgetline module instead to
+ *              provide line-editing and history support.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsGetLine (
+    char                    *Buffer,
+    UINT32                  BufferLength,
+    UINT32                  *BytesRead)
+{
+    int                     InputChar;
+    UINT32                  EndOfLine;
+
+
+    /* Standard AcpiOsGetLine for all utilities except AcpiExec */
+
+    for (EndOfLine = 0; ; EndOfLine++)
+    {
+        if (EndOfLine >= BufferLength)
+        {
+            return (AE_BUFFER_OVERFLOW);
+        }
+
+        if ((InputChar = getchar ()) == EOF)
+        {
+            return (AE_ERROR);
+        }
+
+        if (!InputChar || InputChar == _ASCII_NEWLINE)
+        {
+            break;
+        }
+
+        Buffer[EndOfLine] = (char) InputChar;
+    }
+
+    /* Null terminate the buffer */
+
+    Buffer[EndOfLine] = 0;
+
+    /* Return the number of bytes in the string */
+
+    if (BytesRead)
+    {
+        *BytesRead = EndOfLine;
+    }
+
+    return (AE_OK);
+}
+#endif
+
+
+#ifndef ACPI_USE_NATIVE_MEMORY_MAPPING
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsMapMemory
+ *
+ * PARAMETERS:  where               - Physical address of memory to be mapped
+ *              length              - How much memory to map
+ *
+ * RETURN:      Pointer to mapped memory. Null on error.
+ *
+ * DESCRIPTION: Map physical memory into caller's address space
+ *
+ *****************************************************************************/
+
+void *
+AcpiOsMapMemory (
+    ACPI_PHYSICAL_ADDRESS   where,
+    ACPI_SIZE               length)
+{
+
+    return (ACPI_TO_POINTER ((ACPI_SIZE) where));
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsUnmapMemory
+ *
+ * PARAMETERS:  where               - Logical address of memory to be unmapped
+ *              length              - How much memory to unmap
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Delete a previously created mapping. Where and Length must
+ *              correspond to a previous mapping exactly.
+ *
+ *****************************************************************************/
+
+void
+AcpiOsUnmapMemory (
+    void                    *where,
+    ACPI_SIZE               length)
+{
+
+    return;
+}
+#endif
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsAllocate
+ *
+ * PARAMETERS:  Size                - Amount to allocate, in bytes
+ *
+ * RETURN:      Pointer to the new allocation. Null on error.
+ *
+ * DESCRIPTION: Allocate memory. Algorithm is dependent on the OS.
+ *
+ *****************************************************************************/
+
+void *
+AcpiOsAllocate (
+    ACPI_SIZE               size)
+{
+    void                    *Mem;
+
+
+    Mem = (void *) malloc ((size_t) size);
+    return (Mem);
+}
+
+
+#ifdef USE_NATIVE_ALLOCATE_ZEROED
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsAllocateZeroed
+ *
+ * PARAMETERS:  Size                - Amount to allocate, in bytes
+ *
+ * RETURN:      Pointer to the new allocation. Null on error.
+ *
+ * DESCRIPTION: Allocate and zero memory. Algorithm is dependent on the OS.
+ *
+ *****************************************************************************/
+
+void *
+AcpiOsAllocateZeroed (
+    ACPI_SIZE               size)
+{
+    void                    *Mem;
+
+
+    Mem = (void *) calloc (1, (size_t) size);
+    return (Mem);
+}
+#endif
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsFree
+ *
+ * PARAMETERS:  mem                 - Pointer to previously allocated memory
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Free memory allocated via AcpiOsAllocate
+ *
+ *****************************************************************************/
+
+void
+AcpiOsFree (
+    void                    *mem)
+{
+
+    free (mem);
+}
+
+
+#ifdef ACPI_SINGLE_THREADED
+/******************************************************************************
+ *
+ * FUNCTION:    Semaphore stub functions
+ *
+ * DESCRIPTION: Stub functions used for single-thread applications that do
+ *              not require semaphore synchronization. Full implementations
+ *              of these functions appear after the stubs.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsCreateSemaphore (
+    UINT32              MaxUnits,
+    UINT32              InitialUnits,
+    ACPI_HANDLE         *OutHandle)
+{
+    *OutHandle = (ACPI_HANDLE) 1;
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiOsDeleteSemaphore (
+    ACPI_HANDLE         Handle)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiOsWaitSemaphore (
+    ACPI_HANDLE         Handle,
+    UINT32              Units,
+    UINT16              Timeout)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiOsSignalSemaphore (
+    ACPI_HANDLE         Handle,
+    UINT32              Units)
+{
+    return (AE_OK);
+}
+
+#else
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsCreateSemaphore
+ *
+ * PARAMETERS:  InitialUnits        - Units to be assigned to the new semaphore
+ *              OutHandle           - Where a handle will be returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Create an OS semaphore
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsCreateSemaphore (
+    UINT32              MaxUnits,
+    UINT32              InitialUnits,
+    ACPI_HANDLE         *OutHandle)
+{
+    sem_t               *Sem;
+
+
+    if (!OutHandle)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+#ifdef __APPLE__
+    {
+        char            *SemaphoreName = tmpnam (NULL);
+
+        Sem = sem_open (SemaphoreName, O_EXCL|O_CREAT, 0755, InitialUnits);
+        if (!Sem)
+        {
+            return (AE_NO_MEMORY);
+        }
+        sem_unlink (SemaphoreName); /* This just deletes the name */
+    }
+
+#else
+    Sem = AcpiOsAllocate (sizeof (sem_t));
+    if (!Sem)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    if (sem_init (Sem, 0, InitialUnits) == -1)
+    {
+        AcpiOsFree (Sem);
+        return (AE_BAD_PARAMETER);
+    }
+#endif
+
+    *OutHandle = (ACPI_HANDLE) Sem;
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsDeleteSemaphore
+ *
+ * PARAMETERS:  Handle              - Handle returned by AcpiOsCreateSemaphore
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Delete an OS semaphore
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsDeleteSemaphore (
+    ACPI_HANDLE         Handle)
+{
+    sem_t               *Sem = (sem_t *) Handle;
+
+
+    if (!Sem)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+    if (sem_destroy (Sem) == -1)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsWaitSemaphore
+ *
+ * PARAMETERS:  Handle              - Handle returned by AcpiOsCreateSemaphore
+ *              Units               - How many units to wait for
+ *              MsecTimeout         - How long to wait (milliseconds)
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Wait for units
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsWaitSemaphore (
+    ACPI_HANDLE         Handle,
+    UINT32              Units,
+    UINT16              MsecTimeout)
+{
+    ACPI_STATUS         Status = AE_OK;
+    sem_t               *Sem = (sem_t *) Handle;
+#ifndef ACPI_USE_ALTERNATE_TIMEOUT
+    struct timespec     Time;
+    int                 RetVal;
+#endif
+
+
+    if (!Sem)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+    switch (MsecTimeout)
+    {
+    /*
+     * No Wait:
+     * --------
+     * A zero timeout value indicates that we shouldn't wait - just
+     * acquire the semaphore if available otherwise return AE_TIME
+     * (a.k.a. 'would block').
+     */
+    case 0:
+
+        if (sem_trywait(Sem) == -1)
+        {
+            Status = (AE_TIME);
+        }
+        break;
+
+    /* Wait Indefinitely */
+
+    case ACPI_WAIT_FOREVER:
+
+        if (sem_wait (Sem))
+        {
+            Status = (AE_TIME);
+        }
+        break;
+
+    /* Wait with MsecTimeout */
+
+    default:
+
+#ifdef ACPI_USE_ALTERNATE_TIMEOUT
+        /*
+         * Alternate timeout mechanism for environments where
+         * sem_timedwait is not available or does not work properly.
+         */
+        while (MsecTimeout)
+        {
+            if (sem_trywait (Sem) == 0)
+            {
+                /* Got the semaphore */
+                return (AE_OK);
+            }
+
+            if (MsecTimeout >= 10)
+            {
+                MsecTimeout -= 10;
+                usleep (10 * ACPI_USEC_PER_MSEC); /* ten milliseconds */
+            }
+            else
+            {
+                MsecTimeout--;
+                usleep (ACPI_USEC_PER_MSEC); /* one millisecond */
+            }
+        }
+        Status = (AE_TIME);
+#else
+        /*
+         * The interface to sem_timedwait is an absolute time, so we need to
+         * get the current time, then add in the millisecond Timeout value.
+         */
+        if (clock_gettime (CLOCK_REALTIME, &Time) == -1)
+        {
+            perror ("clock_gettime");
+            return (AE_TIME);
+        }
+
+        Time.tv_sec += (MsecTimeout / ACPI_MSEC_PER_SEC);
+        Time.tv_nsec += ((MsecTimeout % ACPI_MSEC_PER_SEC) * ACPI_NSEC_PER_MSEC);
+
+        /* Handle nanosecond overflow (field must be less than one second) */
+
+        if (Time.tv_nsec >= ACPI_NSEC_PER_SEC)
+        {
+            Time.tv_sec += (Time.tv_nsec / ACPI_NSEC_PER_SEC);
+            Time.tv_nsec = (Time.tv_nsec % ACPI_NSEC_PER_SEC);
+        }
+
+        while (((RetVal = sem_timedwait (Sem, &Time)) == -1) && (errno == EINTR))
+        {
+            continue;
+        }
+
+        if (RetVal != 0)
+        {
+            if (errno != ETIMEDOUT)
+            {
+                perror ("sem_timedwait");
+            }
+            Status = (AE_TIME);
+        }
+#endif
+        break;
+    }
+
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsSignalSemaphore
+ *
+ * PARAMETERS:  Handle              - Handle returned by AcpiOsCreateSemaphore
+ *              Units               - Number of units to send
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Send units
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsSignalSemaphore (
+    ACPI_HANDLE         Handle,
+    UINT32              Units)
+{
+    sem_t               *Sem = (sem_t *)Handle;
+
+
+    if (!Sem)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+    if (sem_post (Sem) == -1)
+    {
+        return (AE_LIMIT);
+    }
+
+    return (AE_OK);
+}
+
+#endif /* ACPI_SINGLE_THREADED */
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    Spinlock interfaces
+ *
+ * DESCRIPTION: Map these interfaces to semaphore interfaces
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsCreateLock (
+    ACPI_SPINLOCK           *OutHandle)
+{
+
+    return (AcpiOsCreateSemaphore (1, 1, OutHandle));
+}
+
+
+void
+AcpiOsDeleteLock (
+    ACPI_SPINLOCK           Handle)
+{
+    AcpiOsDeleteSemaphore (Handle);
+}
+
+
+ACPI_CPU_FLAGS
+AcpiOsAcquireLock (
+    ACPI_HANDLE             Handle)
+{
+    AcpiOsWaitSemaphore (Handle, 1, 0xFFFF);
+    return (0);
+}
+
+
+void
+AcpiOsReleaseLock (
+    ACPI_SPINLOCK           Handle,
+    ACPI_CPU_FLAGS          Flags)
+{
+    AcpiOsSignalSemaphore (Handle, 1);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsInstallInterruptHandler
+ *
+ * PARAMETERS:  InterruptNumber     - Level handler should respond to.
+ *              Isr                 - Address of the ACPI interrupt handler
+ *              ExceptPtr           - Where status is returned
+ *
+ * RETURN:      Handle to the newly installed handler.
+ *
+ * DESCRIPTION: Install an interrupt handler. Used to install the ACPI
+ *              OS-independent handler.
+ *
+ *****************************************************************************/
+
+UINT32
+AcpiOsInstallInterruptHandler (
+    UINT32                  InterruptNumber,
+    ACPI_OSD_HANDLER        ServiceRoutine,
+    void                    *Context)
+{
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsRemoveInterruptHandler
+ *
+ * PARAMETERS:  Handle              - Returned when handler was installed
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Uninstalls an interrupt handler.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsRemoveInterruptHandler (
+    UINT32                  InterruptNumber,
+    ACPI_OSD_HANDLER        ServiceRoutine)
+{
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsStall
+ *
+ * PARAMETERS:  microseconds        - Time to sleep
+ *
+ * RETURN:      Blocks until sleep is completed.
+ *
+ * DESCRIPTION: Sleep at microsecond granularity
+ *
+ *****************************************************************************/
+
+void
+AcpiOsStall (
+    UINT32                  microseconds)
+{
+
+    if (microseconds)
+    {
+        usleep (microseconds);
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsSleep
+ *
+ * PARAMETERS:  milliseconds        - Time to sleep
+ *
+ * RETURN:      Blocks until sleep is completed.
+ *
+ * DESCRIPTION: Sleep at millisecond granularity
+ *
+ *****************************************************************************/
+
+void
+AcpiOsSleep (
+    UINT64                  milliseconds)
+{
+
+    /* Sleep for whole seconds */
+
+    sleep (milliseconds / ACPI_MSEC_PER_SEC);
+
+    /*
+     * Sleep for remaining microseconds.
+     * Arg to usleep() is in usecs and must be less than 1,000,000 (1 second).
+     */
+    usleep ((milliseconds % ACPI_MSEC_PER_SEC) * ACPI_USEC_PER_MSEC);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsGetTimer
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Current time in 100 nanosecond units
+ *
+ * DESCRIPTION: Get the current system time
+ *
+ *****************************************************************************/
+
+UINT64
+AcpiOsGetTimer (
+    void)
+{
+    struct timeval          time;
+
+
+    /* This timer has sufficient resolution for user-space application code */
+
+    gettimeofday (&time, NULL);
+
+    /* (Seconds * 10^7 = 100ns(10^-7)) + (Microseconds(10^-6) * 10^1 = 100ns) */
+
+    return (((UINT64) time.tv_sec * ACPI_100NSEC_PER_SEC) +
+            ((UINT64) time.tv_usec * ACPI_100NSEC_PER_USEC));
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsReadPciConfiguration
+ *
+ * PARAMETERS:  PciId               - Seg/Bus/Dev
+ *              PciRegister         - Device Register
+ *              Value               - Buffer where value is placed
+ *              Width               - Number of bits
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Read data from PCI configuration space
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsReadPciConfiguration (
+    ACPI_PCI_ID             *PciId,
+    UINT32                  PciRegister,
+    UINT64                  *Value,
+    UINT32                  Width)
+{
+
+    *Value = 0;
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsWritePciConfiguration
+ *
+ * PARAMETERS:  PciId               - Seg/Bus/Dev
+ *              PciRegister         - Device Register
+ *              Value               - Value to be written
+ *              Width               - Number of bits
+ *
+ * RETURN:      Status.
+ *
+ * DESCRIPTION: Write data to PCI configuration space
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsWritePciConfiguration (
+    ACPI_PCI_ID             *PciId,
+    UINT32                  PciRegister,
+    UINT64                  Value,
+    UINT32                  Width)
+{
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsReadPort
+ *
+ * PARAMETERS:  Address             - Address of I/O port/register to read
+ *              Value               - Where value is placed
+ *              Width               - Number of bits
+ *
+ * RETURN:      Value read from port
+ *
+ * DESCRIPTION: Read data from an I/O port or register
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsReadPort (
+    ACPI_IO_ADDRESS         Address,
+    UINT32                  *Value,
+    UINT32                  Width)
+{
+
+    switch (Width)
+    {
+    case 8:
+
+        *Value = 0xFF;
+        break;
+
+    case 16:
+
+        *Value = 0xFFFF;
+        break;
+
+    case 32:
+
+        *Value = 0xFFFFFFFF;
+        break;
+
+    default:
+
+        return (AE_BAD_PARAMETER);
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsWritePort
+ *
+ * PARAMETERS:  Address             - Address of I/O port/register to write
+ *              Value               - Value to write
+ *              Width               - Number of bits
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write data to an I/O port or register
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsWritePort (
+    ACPI_IO_ADDRESS         Address,
+    UINT32                  Value,
+    UINT32                  Width)
+{
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsReadMemory
+ *
+ * PARAMETERS:  Address             - Physical Memory Address to read
+ *              Value               - Where value is placed
+ *              Width               - Number of bits (8,16,32, or 64)
+ *
+ * RETURN:      Value read from physical memory address. Always returned
+ *              as a 64-bit integer, regardless of the read width.
+ *
+ * DESCRIPTION: Read data from a physical memory address
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsReadMemory (
+    ACPI_PHYSICAL_ADDRESS   Address,
+    UINT64                  *Value,
+    UINT32                  Width)
+{
+
+    switch (Width)
+    {
+    case 8:
+    case 16:
+    case 32:
+    case 64:
+
+        *Value = 0;
+        break;
+
+    default:
+
+        return (AE_BAD_PARAMETER);
+    }
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsWriteMemory
+ *
+ * PARAMETERS:  Address             - Physical Memory Address to write
+ *              Value               - Value to write
+ *              Width               - Number of bits (8,16,32, or 64)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write data to a physical memory address
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsWriteMemory (
+    ACPI_PHYSICAL_ADDRESS   Address,
+    UINT64                  Value,
+    UINT32                  Width)
+{
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsReadable
+ *
+ * PARAMETERS:  Pointer             - Area to be verified
+ *              Length              - Size of area
+ *
+ * RETURN:      TRUE if readable for entire length
+ *
+ * DESCRIPTION: Verify that a pointer is valid for reading
+ *
+ *****************************************************************************/
+
+BOOLEAN
+AcpiOsReadable (
+    void                    *Pointer,
+    ACPI_SIZE               Length)
+{
+
+    return (TRUE);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsWritable
+ *
+ * PARAMETERS:  Pointer             - Area to be verified
+ *              Length              - Size of area
+ *
+ * RETURN:      TRUE if writable for entire length
+ *
+ * DESCRIPTION: Verify that a pointer is valid for writing
+ *
+ *****************************************************************************/
+
+BOOLEAN
+AcpiOsWritable (
+    void                    *Pointer,
+    ACPI_SIZE               Length)
+{
+
+    return (TRUE);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsSignal
+ *
+ * PARAMETERS:  Function            - ACPI A signal function code
+ *              Info                - Pointer to function-dependent structure
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Miscellaneous functions. Example implementation only.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsSignal (
+    UINT32                  Function,
+    void                    *Info)
+{
+
+    switch (Function)
+    {
+    case ACPI_SIGNAL_FATAL:
+
+        break;
+
+    case ACPI_SIGNAL_BREAKPOINT:
+
+        break;
+
+    default:
+
+        break;
+    }
+
+    return (AE_OK);
+}
+
+/* Optional multi-thread support */
+
+#ifndef ACPI_SINGLE_THREADED
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsGetThreadId
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Id of the running thread
+ *
+ * DESCRIPTION: Get the ID of the current (running) thread
+ *
+ *****************************************************************************/
+
+ACPI_THREAD_ID
+AcpiOsGetThreadId (
+    void)
+{
+    pthread_t               thread;
+
+
+    thread = pthread_self();
+    return (ACPI_CAST_PTHREAD_T (thread));
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsExecute
+ *
+ * PARAMETERS:  Type                - Type of execution
+ *              Function            - Address of the function to execute
+ *              Context             - Passed as a parameter to the function
+ *
+ * RETURN:      Status.
+ *
+ * DESCRIPTION: Execute a new thread
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+AcpiOsExecute (
+    ACPI_EXECUTE_TYPE       Type,
+    ACPI_OSD_EXEC_CALLBACK  Function,
+    void                    *Context)
+{
+    pthread_t               thread;
+    int                     ret;
+
+
+    ret = pthread_create (&thread, NULL, (PTHREAD_CALLBACK) Function, Context);
+    if (ret)
+    {
+        AcpiOsPrintf("Create thread failed");
+    }
+    return (0);
+}
+
+#else /* ACPI_SINGLE_THREADED */
+ACPI_THREAD_ID
+AcpiOsGetThreadId (
+    void)
+{
+    return (1);
+}
+
+ACPI_STATUS
+AcpiOsExecute (
+    ACPI_EXECUTE_TYPE       Type,
+    ACPI_OSD_EXEC_CALLBACK  Function,
+    void                    *Context)
+{
+
+    Function (Context);
+
+    return (AE_OK);
+}
+
+#endif /* ACPI_SINGLE_THREADED */
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AcpiOsWaitEventsComplete
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Wait for all asynchronous events to complete. This
+ *              implementation does nothing.
+ *
+ *****************************************************************************/
+
+void
+AcpiOsWaitEventsComplete (
+    void)
+{
+    return;
+}
diff --git a/usr/src/cmd/acpi/common/utprint.c b/usr/src/cmd/acpi/common/utprint.c
deleted file mode 100644
index 8ecea6aad0..0000000000
--- a/usr/src/cmd/acpi/common/utprint.c
+++ /dev/null
@@ -1,813 +0,0 @@
-/******************************************************************************
- *
- * Module Name: utprint - Formatted printing routines
- *
- *****************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#include "acpi.h"
-#include "accommon.h"
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utprint")
-
-
-#define ACPI_FORMAT_SIGN            0x01
-#define ACPI_FORMAT_SIGN_PLUS       0x02
-#define ACPI_FORMAT_SIGN_PLUS_SPACE 0x04
-#define ACPI_FORMAT_ZERO            0x08
-#define ACPI_FORMAT_LEFT            0x10
-#define ACPI_FORMAT_UPPER           0x20
-#define ACPI_FORMAT_PREFIX          0x40
-
-
-/* Local prototypes */
-
-static ACPI_SIZE
-AcpiUtBoundStringLength (
-    const char              *String,
-    ACPI_SIZE               Count);
-
-static char *
-AcpiUtBoundStringOutput (
-    char                    *String,
-    const char              *End,
-    char                    c);
-
-static char *
-AcpiUtFormatNumber (
-    char                    *String,
-    char                    *End,
-    UINT64                  Number,
-    UINT8                   Base,
-    INT32                   Width,
-    INT32                   Precision,
-    UINT8                   Type);
-
-static char *
-AcpiUtPutNumber (
-    char                    *String,
-    UINT64                  Number,
-    UINT8                   Base,
-    BOOLEAN                 Upper);
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtBoundStringLength
- *
- * PARAMETERS:  String              - String with boundary
- *              Count               - Boundary of the string
- *
- * RETURN:      Length of the string. Less than or equal to Count.
- *
- * DESCRIPTION: Calculate the length of a string with boundary.
- *
- ******************************************************************************/
-
-static ACPI_SIZE
-AcpiUtBoundStringLength (
-    const char              *String,
-    ACPI_SIZE               Count)
-{
-    UINT32                  Length = 0;
-
-
-    while (*String && Count)
-    {
-        Length++;
-        String++;
-        Count--;
-    }
-
-    return (Length);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtBoundStringOutput
- *
- * PARAMETERS:  String              - String with boundary
- *              End                 - Boundary of the string
- *              c                   - Character to be output to the string
- *
- * RETURN:      Updated position for next valid character
- *
- * DESCRIPTION: Output a character into a string with boundary check.
- *
- ******************************************************************************/
-
-static char *
-AcpiUtBoundStringOutput (
-    char                    *String,
-    const char              *End,
-    char                    c)
-{
-
-    if (String < End)
-    {
-        *String = c;
-    }
-
-    ++String;
-    return (String);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtPutNumber
- *
- * PARAMETERS:  String              - Buffer to hold reverse-ordered string
- *              Number              - Integer to be converted
- *              Base                - Base of the integer
- *              Upper               - Whether or not using upper cased digits
- *
- * RETURN:      Updated position for next valid character
- *
- * DESCRIPTION: Convert an integer into a string, note that, the string holds a
- *              reversed ordered number without the trailing zero.
- *
- ******************************************************************************/
-
-static char *
-AcpiUtPutNumber (
-    char                    *String,
-    UINT64                  Number,
-    UINT8                   Base,
-    BOOLEAN                 Upper)
-{
-    const char              *Digits;
-    UINT64                  DigitIndex;
-    char                    *Pos;
-
-
-    Pos = String;
-    Digits = Upper ? AcpiGbl_UpperHexDigits : AcpiGbl_LowerHexDigits;
-
-    if (Number == 0)
-    {
-        *(Pos++) = '0';
-    }
-    else
-    {
-        while (Number)
-        {
-            (void) AcpiUtDivide (Number, Base, &Number, &DigitIndex);
-            *(Pos++) = Digits[DigitIndex];
-        }
-    }
-
-    /* *(Pos++) = '0'; */
-    return (Pos);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtScanNumber
- *
- * PARAMETERS:  String              - String buffer
- *              NumberPtr           - Where the number is returned
- *
- * RETURN:      Updated position for next valid character
- *
- * DESCRIPTION: Scan a string for a decimal integer.
- *
- ******************************************************************************/
-
-const char *
-AcpiUtScanNumber (
-    const char              *String,
-    UINT64                  *NumberPtr)
-{
-    UINT64                  Number = 0;
-
-
-    while (isdigit ((int) *String))
-    {
-        Number *= 10;
-        Number += *(String++) - '0';
-    }
-
-    *NumberPtr = Number;
-    return (String);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtPrintNumber
- *
- * PARAMETERS:  String              - String buffer
- *              Number              - The number to be converted
- *
- * RETURN:      Updated position for next valid character
- *
- * DESCRIPTION: Print a decimal integer into a string.
- *
- ******************************************************************************/
-
-const char *
-AcpiUtPrintNumber (
-    char                    *String,
-    UINT64                  Number)
-{
-    char                    AsciiString[20];
-    const char              *Pos1;
-    char                    *Pos2;
-
-
-    Pos1 = AcpiUtPutNumber (AsciiString, Number, 10, FALSE);
-    Pos2 = String;
-
-    while (Pos1 != AsciiString)
-    {
-        *(Pos2++) = *(--Pos1);
-    }
-
-    *Pos2 = 0;
-    return (String);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtFormatNumber
- *
- * PARAMETERS:  String              - String buffer with boundary
- *              End                 - Boundary of the string
- *              Number              - The number to be converted
- *              Base                - Base of the integer
- *              Width               - Field width
- *              Precision           - Precision of the integer
- *              Type                - Special printing flags
- *
- * RETURN:      Updated position for next valid character
- *
- * DESCRIPTION: Print an integer into a string with any base and any precision.
- *
- ******************************************************************************/
-
-static char *
-AcpiUtFormatNumber (
-    char                    *String,
-    char                    *End,
-    UINT64                  Number,
-    UINT8                   Base,
-    INT32                   Width,
-    INT32                   Precision,
-    UINT8                   Type)
-{
-    char                    *Pos;
-    char                    Sign;
-    char                    Zero;
-    BOOLEAN                 NeedPrefix;
-    BOOLEAN                 Upper;
-    INT32                   i;
-    char                    ReversedString[66];
-
-
-    /* Parameter validation */
-
-    if (Base < 2 || Base > 16)
-    {
-        return (NULL);
-    }
-
-    if (Type & ACPI_FORMAT_LEFT)
-    {
-        Type &= ~ACPI_FORMAT_ZERO;
-    }
-
-    NeedPrefix = ((Type & ACPI_FORMAT_PREFIX) && Base != 10) ? TRUE : FALSE;
-    Upper = (Type & ACPI_FORMAT_UPPER) ? TRUE : FALSE;
-    Zero = (Type & ACPI_FORMAT_ZERO) ? '0' : ' ';
-
-    /* Calculate size according to sign and prefix */
-
-    Sign = '\0';
-    if (Type & ACPI_FORMAT_SIGN)
-    {
-        if ((INT64) Number < 0)
-        {
-            Sign = '-';
-            Number = - (INT64) Number;
-            Width--;
-        }
-        else if (Type & ACPI_FORMAT_SIGN_PLUS)
-        {
-            Sign = '+';
-            Width--;
-        }
-        else if (Type & ACPI_FORMAT_SIGN_PLUS_SPACE)
-        {
-            Sign = ' ';
-            Width--;
-        }
-    }
-    if (NeedPrefix)
-    {
-        Width--;
-        if (Base == 16)
-        {
-            Width--;
-        }
-    }
-
-    /* Generate full string in reverse order */
-
-    Pos = AcpiUtPutNumber (ReversedString, Number, Base, Upper);
-    i = ACPI_PTR_DIFF (Pos, ReversedString);
-
-    /* Printing 100 using %2d gives "100", not "00" */
-
-    if (i > Precision)
-    {
-        Precision = i;
-    }
-
-    Width -= Precision;
-
-    /* Output the string */
-
-    if (!(Type & (ACPI_FORMAT_ZERO | ACPI_FORMAT_LEFT)))
-    {
-        while (--Width >= 0)
-        {
-            String = AcpiUtBoundStringOutput (String, End, ' ');
-        }
-    }
-    if (Sign)
-    {
-        String = AcpiUtBoundStringOutput (String, End, Sign);
-    }
-    if (NeedPrefix)
-    {
-        String = AcpiUtBoundStringOutput (String, End, '0');
-        if (Base == 16)
-        {
-            String = AcpiUtBoundStringOutput (
-                String, End, Upper ? 'X' : 'x');
-        }
-    }
-    if (!(Type & ACPI_FORMAT_LEFT))
-    {
-        while (--Width >= 0)
-        {
-            String = AcpiUtBoundStringOutput (String, End, Zero);
-        }
-    }
-
-    while (i <= --Precision)
-    {
-        String = AcpiUtBoundStringOutput (String, End, '0');
-    }
-    while (--i >= 0)
-    {
-        String = AcpiUtBoundStringOutput (String, End,
-                    ReversedString[i]);
-    }
-    while (--Width >= 0)
-    {
-        String = AcpiUtBoundStringOutput (String, End, ' ');
-    }
-
-    return (String);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtVsnprintf
- *
- * PARAMETERS:  String              - String with boundary
- *              Size                - Boundary of the string
- *              Format              - Standard printf format
- *              Args                - Argument list
- *
- * RETURN:      Number of bytes actually written.
- *
- * DESCRIPTION: Formatted output to a string using argument list pointer.
- *
- ******************************************************************************/
-
-int
-AcpiUtVsnprintf (
-    char                    *String,
-    ACPI_SIZE               Size,
-    const char              *Format,
-    va_list                 Args)
-{
-    UINT8                   Base;
-    UINT8                   Type;
-    INT32                   Width;
-    INT32                   Precision;
-    char                    Qualifier;
-    UINT64                  Number;
-    char                    *Pos;
-    char                    *End;
-    char                    c;
-    const char              *s;
-    const void              *p;
-    INT32                   Length;
-    int                     i;
-
-
-    Pos = String;
-    End = String + Size;
-
-    for (; *Format; ++Format)
-    {
-        if (*Format != '%')
-        {
-            Pos = AcpiUtBoundStringOutput (Pos, End, *Format);
-            continue;
-        }
-
-        Type = 0;
-        Base = 10;
-
-        /* Process sign */
-
-        do
-        {
-            ++Format;
-            if (*Format == '#')
-            {
-                Type |= ACPI_FORMAT_PREFIX;
-            }
-            else if (*Format == '0')
-            {
-                Type |= ACPI_FORMAT_ZERO;
-            }
-            else if (*Format == '+')
-            {
-                Type |= ACPI_FORMAT_SIGN_PLUS;
-            }
-            else if (*Format == ' ')
-            {
-                Type |= ACPI_FORMAT_SIGN_PLUS_SPACE;
-            }
-            else if (*Format == '-')
-            {
-                Type |= ACPI_FORMAT_LEFT;
-            }
-            else
-            {
-                break;
-            }
-
-        } while (1);
-
-        /* Process width */
-
-        Width = -1;
-        if (isdigit ((int) *Format))
-        {
-            Format = AcpiUtScanNumber (Format, &Number);
-            Width = (INT32) Number;
-        }
-        else if (*Format == '*')
-        {
-            ++Format;
-            Width = va_arg (Args, int);
-            if (Width < 0)
-            {
-                Width = -Width;
-                Type |= ACPI_FORMAT_LEFT;
-            }
-        }
-
-        /* Process precision */
-
-        Precision = -1;
-        if (*Format == '.')
-        {
-            ++Format;
-            if (isdigit ((int) *Format))
-            {
-                Format = AcpiUtScanNumber (Format, &Number);
-                Precision = (INT32) Number;
-            }
-            else if (*Format == '*')
-            {
-                ++Format;
-                Precision = va_arg (Args, int);
-            }
-
-            if (Precision < 0)
-            {
-                Precision = 0;
-            }
-        }
-
-        /* Process qualifier */
-
-        Qualifier = -1;
-        if (*Format == 'h' || *Format == 'l' || *Format == 'L')
-        {
-            Qualifier = *Format;
-            ++Format;
-
-            if (Qualifier == 'l' && *Format == 'l')
-            {
-                Qualifier = 'L';
-                ++Format;
-            }
-        }
-
-        switch (*Format)
-        {
-        case '%':
-
-            Pos = AcpiUtBoundStringOutput (Pos, End, '%');
-            continue;
-
-        case 'c':
-
-            if (!(Type & ACPI_FORMAT_LEFT))
-            {
-                while (--Width > 0)
-                {
-                    Pos = AcpiUtBoundStringOutput (Pos, End, ' ');
-                }
-            }
-
-            c = (char) va_arg (Args, int);
-            Pos = AcpiUtBoundStringOutput (Pos, End, c);
-
-            while (--Width > 0)
-            {
-                Pos = AcpiUtBoundStringOutput (Pos, End, ' ');
-            }
-            continue;
-
-        case 's':
-
-            s = va_arg (Args, char *);
-            if (!s)
-            {
-                s = "<NULL>";
-            }
-            Length = AcpiUtBoundStringLength (s, Precision);
-            if (!(Type & ACPI_FORMAT_LEFT))
-            {
-                while (Length < Width--)
-                {
-                    Pos = AcpiUtBoundStringOutput (Pos, End, ' ');
-                }
-            }
-
-            for (i = 0; i < Length; ++i)
-            {
-                Pos = AcpiUtBoundStringOutput (Pos, End, *s);
-                ++s;
-            }
-
-            while (Length < Width--)
-            {
-                Pos = AcpiUtBoundStringOutput (Pos, End, ' ');
-            }
-            continue;
-
-        case 'o':
-
-            Base = 8;
-            break;
-
-        case 'X':
-
-            Type |= ACPI_FORMAT_UPPER;
-	    /* FALLTHROUGH */
-
-        case 'x':
-
-            Base = 16;
-            break;
-
-        case 'd':
-        case 'i':
-
-            Type |= ACPI_FORMAT_SIGN;
-
-        case 'u':
-
-            break;
-
-        case 'p':
-
-            if (Width == -1)
-            {
-                Width = 2 * sizeof (void *);
-                Type |= ACPI_FORMAT_ZERO;
-            }
-
-            p = va_arg (Args, void *);
-            Pos = AcpiUtFormatNumber (
-                Pos, End, ACPI_TO_INTEGER (p), 16, Width, Precision, Type);
-            continue;
-
-        default:
-
-            Pos = AcpiUtBoundStringOutput (Pos, End, '%');
-            if (*Format)
-            {
-                Pos = AcpiUtBoundStringOutput (Pos, End, *Format);
-            }
-            else
-            {
-                --Format;
-            }
-            continue;
-        }
-
-        if (Qualifier == 'L')
-        {
-            Number = va_arg (Args, UINT64);
-            if (Type & ACPI_FORMAT_SIGN)
-            {
-                Number = (INT64) Number;
-            }
-        }
-        else if (Qualifier == 'l')
-        {
-            Number = va_arg (Args, unsigned long);
-            if (Type & ACPI_FORMAT_SIGN)
-            {
-                Number = (INT32) Number;
-            }
-        }
-        else if (Qualifier == 'h')
-        {
-            Number = (UINT16) va_arg (Args, int);
-            if (Type & ACPI_FORMAT_SIGN)
-            {
-                Number = (INT16) Number;
-            }
-        }
-        else
-        {
-            Number = va_arg (Args, unsigned int);
-            if (Type & ACPI_FORMAT_SIGN)
-            {
-                Number = (signed int) Number;
-            }
-        }
-
-        Pos = AcpiUtFormatNumber (Pos, End, Number, Base,
-            Width, Precision, Type);
-    }
-
-    if (Size > 0)
-    {
-        if (Pos < End)
-        {
-            *Pos = '\0';
-        }
-        else
-        {
-            End[-1] = '\0';
-        }
-    }
-
-    return (ACPI_PTR_DIFF (Pos, String));
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtSnprintf
- *
- * PARAMETERS:  String              - String with boundary
- *              Size                - Boundary of the string
- *              Format, ...         - Standard printf format
- *
- * RETURN:      Number of bytes actually written.
- *
- * DESCRIPTION: Formatted output to a string.
- *
- ******************************************************************************/
-
-int
-AcpiUtSnprintf (
-    char                    *String,
-    ACPI_SIZE               Size,
-    const char              *Format,
-    ...)
-{
-    va_list                 Args;
-    int                     Length;
-
-
-    va_start (Args, Format);
-    Length = AcpiUtVsnprintf (String, Size, Format, Args);
-    va_end (Args);
-
-    return (Length);
-}
-
-
-#ifdef ACPI_APPLICATION
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtFileVprintf
- *
- * PARAMETERS:  File                - File descriptor
- *              Format              - Standard printf format
- *              Args                - Argument list
- *
- * RETURN:      Number of bytes actually written.
- *
- * DESCRIPTION: Formatted output to a file using argument list pointer.
- *
- ******************************************************************************/
-
-int
-AcpiUtFileVprintf (
-    ACPI_FILE               File,
-    const char              *Format,
-    va_list                 Args)
-{
-    ACPI_CPU_FLAGS          Flags;
-    int                     Length;
-
-
-    Flags = AcpiOsAcquireLock (AcpiGbl_PrintLock);
-    Length = AcpiUtVsnprintf (AcpiGbl_PrintBuffer,
-        sizeof (AcpiGbl_PrintBuffer), Format, Args);
-
-    (void) AcpiOsWriteFile (File, AcpiGbl_PrintBuffer, Length, 1);
-    AcpiOsReleaseLock (AcpiGbl_PrintLock, Flags);
-
-    return (Length);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtFilePrintf
- *
- * PARAMETERS:  File                - File descriptor
- *              Format, ...         - Standard printf format
- *
- * RETURN:      Number of bytes actually written.
- *
- * DESCRIPTION: Formatted output to a file.
- *
- ******************************************************************************/
-
-int
-AcpiUtFilePrintf (
-    ACPI_FILE               File,
-    const char              *Format,
-    ...)
-{
-    va_list                 Args;
-    int                     Length;
-
-
-    va_start (Args, Format);
-    Length = AcpiUtFileVprintf (File, Format, Args);
-    va_end (Args);
-
-    return (Length);
-}
-#endif
diff --git a/usr/src/cmd/acpi/iasl/Makefile b/usr/src/cmd/acpi/iasl/Makefile
new file mode 100644
index 0000000000..eb09b61e8c
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/Makefile
@@ -0,0 +1,160 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+# Adapted from acpica/generate/unix/iasl/Makefile, which lacked a copyright
+# notice.
+#
+PROG=		iasl
+
+include ../../Makefile.cmd
+include ../../Makefile.cmd.64
+include ../../Makefile.ctf
+
+OBJS =	aslanalyze.o aslascii.o aslbtypes.o aslcodegen.o aslcompile.o \
+	asldebug.o aslerror.o aslexternal.o aslfileio.o \
+	aslfiles.o aslfold.o aslhex.o asllength.o asllisting.o asllistsup.o \
+	aslload.o asllookup.o aslmain.o aslmap.o aslmapenter.o aslmapoutput.o \
+	aslmaputils.o aslmessages.o aslmethod.o aslnamesp.o asloffset.o \
+	aslopcodes.o asloperands.o aslopt.o asloptions.o aslpld.o aslpredef.o \
+	aslprepkg.o aslprintf.o aslprune.o aslresource.o aslrestype1.o \
+	aslrestype1i.o aslrestype2.o aslrestype2d.o aslrestype2e.o \
+	aslrestype2q.o aslrestype2s.o aslrestype2w.o aslstartup.o aslstubs.o \
+	asltransform.o asltree.o aslutils.o asluuid.o aslwalks.o aslxref.o \
+	aslxrefout.o dtcompile.o dtexpress.o dtfield.o dtio.o \
+	dtsubtable.o dttable.o dttable1.o dttable2.o dttemplate.o dtutils.o \
+	prexpress.o prmacros.o prscan.o prutils.o
+# ../common
+OBJS +=	adfile.o acfileio.o adisasm.o adwalk.o ahids.o ahtable.o ahpredef.o \
+	ahuuids.o dmextern.o dmrestag.o dmtbinfo.o dmtable.o dmtbdump.o \
+	getopt.o osl.o osunixxf.o
+# usr/src/common/acpica/disassembler
+OBJS += dmbuffer.o dmcstyle.o dmdeferred.o dmnames.o dmopcode.o dmresrc.o \
+	dmresrcl.o dmresrcl2.o dmresrcs.o dmtables.o dmutils.o dmwalk.o
+# usr/src/common/acpica/dispatcher
+OBJS += dsargs.o dscontrol.o dsfield.o dsobject.o dsopcode.o dsutils.o \
+	dswload.o dswload2.o dswexec.o dswscope.o dswstate.o
+# usr/src/common/acpica/executer
+OBJS += exconcat.o exconvrt.o excreate.o exdump.o exmisc.o exmutex.o exnames.o \
+	exoparg1.o exoparg2.o exoparg3.o exoparg6.o exprep.o exresolv.o \
+	exresop.o exresnte.o exstore.o exstoren.o exstorob.o exsystem.o \
+	exutils.o
+# usr/src/common/acpica/namespace
+OBJS += nsaccess.o nsalloc.o nsdump.o nsnames.o nsobject.o nsparse.o \
+	nssearch.o nsutils.o nswalk.o
+# usr/src/common/acpica/parser
+OBJS += psargs.o psloop.o psobject.o psopcode.o psopinfo.o psparse.o psscope.o pstree.o \
+	psutils.o pswalk.o
+# usr/src/common/acpica/tables
+OBJS +=	tbdata.o tbfadt.o tbinstal.o tbprint.o tbutils.o tbxface.o
+# usr/src/common/acpica/utilities
+OBJS += utaddress.o utalloc.o utascii.o utbuffer.o utcache.o utcopy.o \
+	utdebug.o utdecode.o utdelete.o uterror.o utexcep.o utglobal.o uthex.o \
+	utinit.o utlock.o utmath.o utmisc.o utmutex.o utnonansi.o utobject.o \
+	utownerid.o utpredef.o utprint.o utresrc.o utstate.o utstring.o \
+	utuuid.o utxface.o utxferror.o
+
+SRCS = $(OBJS:.o=.c)
+
+ACPI_CMN_SRC		= $(SRC)/common/acpica
+
+# Source used only by iasl
+ASL_COMPILER		= compiler
+ACPICA_DEBUGGER		= debugger
+# Source used by kernel module and iasl
+ACPICA_DISASSEMBLER	= $(ACPI_CMN_SRC)/disassembler
+ACPICA_DISPATCHER	= $(ACPI_CMN_SRC)/dispatcher
+ACPICA_EXECUTER		= $(ACPI_CMN_SRC)/executer
+ACPICA_NAMESPACE	= $(ACPI_CMN_SRC)/namespace
+ACPICA_PARSER		= $(ACPI_CMN_SRC)/parser
+ACPICA_TABLES		= $(ACPI_CMN_SRC)/tables
+ACPICA_UTILITIES	= $(ACPI_CMN_SRC)/utilities
+# Source used by other programs and iasl
+ACPICA_COMMON		= ../common
+
+VPATH = $(ACPICA_DEBUGGER):$(ACPICA_DISASSEMBLER):\
+	$(ACPICA_DISPATCHER):$(ACPICA_EXECUTER):$(ACPICA_NAMESPACE):\
+	$(ACPICA_PARSER):$(ACPICA_TABLES):$(ACPICA_UTILITIES):\
+	$(ACPICA_COMMON):$(ACPICA_OSL)
+
+INTERMEDIATES = \
+	aslcompiler.y \
+	aslcompilerlex.c \
+	aslcompilerparse.c \
+	dtparserlex.c \
+	dtparserparse.c \
+	prparserlex.c \
+	prparserparse.c \
+	aslcompiler.y.h \
+	dtparser.y.h \
+	prparser.y.h
+
+CERRWARN += -_gcc=-Wno-unused-function
+
+CPPFLAGS += -I$(SRC)/uts/intel/sys/acpi -DACPI_ASL_COMPILER -I.
+
+LEX_C_FILES = aslcompilerlex.c dtparserlex.c prparserlex.c
+YACC_C_FILES = aslcompilerparse.c dtparserparse.c prparserparse.c
+YACC_H_FILES = aslcompiler.y.h dtparser.y.h prparser.y.h
+YACC_FILES = $(YACC_C_FILES) $(YACC_H_FILES)
+
+aslcompilerlex.c aslcompilerparse.c aslcompiler.y.h := PARSER = AslCompiler
+aslcompilerlex.c aslcompilerparse.c aslcompiler.y.h := LY_BASE = aslcompiler
+
+dtparserlex.c dtparserparse.c dtparser.y.h := PARSER = DtParser
+dtparserlex.c dtparserparse.c dtparser.y.h := LY_BASE = dtparser
+
+prparserlex.c prparserparse.c prparser.y.h := PARSER = PrParser
+prparserlex.c prparserparse.c prparser.y.h := LY_BASE = prparser
+
+$(LEX_C_FILES) := LEXFILE = $(LY_BASE).l
+$(LEX_C_FILES) := LEXFILE = $(LY_BASE).l
+$(YACC_FILES) := YTABC = $(LY_BASE)parse.c
+
+OBJS += $(LEX_C_FILES:.c=.o) $(YACC_C_FILES:.c=.o)
+
+GM4FLAGS = -P
+LFLAGS = -i -s
+
+.KEEP_STATE:
+
+all: $(YACC_FILES) .WAIT $(PROG)
+
+aslcompiler.y: aslparser.y
+	$(GM4) $(GM4FLAGS) aslparser.y > $@
+
+$(LEX_C_FILES):
+	$(FLEX) $(LFLAGS) -P$(PARSER) -o $@ $(LEXFILE)
+
+%parse.h: %parse.c
+
+%parse.c %.y.h: %.y
+	_suffix=`echo $@ | awk -F. '{print $$NF}'` && \
+	_d=`mktemp -d $(PARSER).XXXXXX` && \
+	(cd $$_d && $(BISON) -y -v -d -p$(PARSER) ../$(LY_BASE).y) && \
+	mv $$_d/y.tab.$$_suffix $@; \
+	_ret=$$?; \
+	rm -rf $$_d; \
+	exit $$_ret
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+install: all $(ROOTUSRSBINPROG)
+
+clean:
+	$(RM) $(OBJS) $(INTERMEDIATES) $(PROG)
+	$(RM) -r AslCompiler.?????? DtParser.?????? PrParser.??????
+
+lint:	lint_SRCS
+
+include ../../Makefile.targ
diff --git a/usr/src/cmd/acpi/iasl/aslanalyze.c b/usr/src/cmd/acpi/iasl/aslanalyze.c
new file mode 100644
index 0000000000..bf5b37cdef
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslanalyze.c
@@ -0,0 +1,736 @@
+/******************************************************************************
+ *
+ * Module Name: aslanalyze.c - Support functions for parse tree walks
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include <string.h>
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslanalyze")
+
+
+/* Local Prototypes */
+
+static ACPI_STATUS
+ApDeviceSubtreeWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnIsInternalMethod
+ *
+ * PARAMETERS:  Op                  - Current op
+ *
+ * RETURN:      Boolean
+ *
+ * DESCRIPTION: Check for an internal control method.
+ *
+ ******************************************************************************/
+
+BOOLEAN
+AnIsInternalMethod (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    if ((!strcmp (Op->Asl.ExternalName, "\\_OSI")) ||
+        (!strcmp (Op->Asl.ExternalName, "_OSI")))
+    {
+        return (TRUE);
+    }
+
+    return (FALSE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnGetInternalMethodReturnType
+ *
+ * PARAMETERS:  Op                  - Current op
+ *
+ * RETURN:      Btype
+ *
+ * DESCRIPTION: Get the return type of an internal method
+ *
+ ******************************************************************************/
+
+UINT32
+AnGetInternalMethodReturnType (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    if ((!strcmp (Op->Asl.ExternalName, "\\_OSI")) ||
+        (!strcmp (Op->Asl.ExternalName, "_OSI")))
+    {
+        return (ACPI_BTYPE_STRING);
+    }
+
+    return (0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnCheckId
+ *
+ * PARAMETERS:  Op                  - Current parse op
+ *              Type                - HID or CID
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Perform various checks on _HID and _CID strings. Only limited
+ *              checks can be performed on _CID strings.
+ *
+ ******************************************************************************/
+
+void
+AnCheckId (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_NAME               Type)
+{
+    UINT32                  i;
+    ACPI_SIZE               Length;
+
+
+    /* Only care about string versions of _HID/_CID (integers are legal) */
+
+    if (Op->Asl.ParseOpcode != PARSEOP_STRING_LITERAL)
+    {
+        return;
+    }
+
+    /* For both _HID and _CID, the string must be non-null */
+
+    Length = strlen (Op->Asl.Value.String);
+    if (!Length)
+    {
+        AslError (ASL_ERROR, ASL_MSG_NULL_STRING, Op, NULL);
+        return;
+    }
+
+    /*
+     * One of the things we want to catch here is the use of a leading
+     * asterisk in the string -- an odd construct that certain platform
+     * manufacturers are fond of. Technically, a leading asterisk is OK
+     * for _CID, but a valid use of this has not been seen.
+     */
+    if (*Op->Asl.Value.String == '*')
+    {
+        AslError (ASL_ERROR, ASL_MSG_LEADING_ASTERISK,
+            Op, Op->Asl.Value.String);
+        return;
+    }
+
+    /* _CID strings are bus-specific, no more checks can be performed */
+
+    if (Type == ASL_TYPE_CID)
+    {
+        return;
+    }
+
+    /* For _HID, all characters must be alphanumeric */
+
+    for (i = 0; Op->Asl.Value.String[i]; i++)
+    {
+        if (!isalnum ((int) Op->Asl.Value.String[i]))
+        {
+            AslError (ASL_ERROR, ASL_MSG_ALPHANUMERIC_STRING,
+                Op, Op->Asl.Value.String);
+            return;
+        }
+    }
+
+    /*
+     * _HID String must be one of these forms:
+     *
+     * "AAA####"    A is an uppercase letter and # is a hex digit
+     * "ACPI####"   # is a hex digit
+     * "NNNN####"   N is an uppercase letter or decimal digit (0-9)
+     *              # is a hex digit (ACPI 5.0)
+     */
+    if ((Length < 7) || (Length > 8))
+    {
+        AslError (ASL_ERROR, ASL_MSG_HID_LENGTH,
+            Op, Op->Asl.Value.String);
+        return;
+    }
+
+    /* _HID Length is valid (7 or 8), now check prefix (first 3 or 4 chars) */
+
+    if (Length == 7)
+    {
+        /* AAA####: Ensure the alphabetic prefix is all uppercase */
+
+        for (i = 0; i < 3; i++)
+        {
+            if (!isupper ((int) Op->Asl.Value.String[i]))
+            {
+                AslError (ASL_ERROR, ASL_MSG_UPPER_CASE,
+                    Op, &Op->Asl.Value.String[i]);
+                return;
+            }
+        }
+    }
+    else /* Length == 8 */
+    {
+        /*
+         * ACPI#### or NNNN####:
+         * Ensure the prefix contains only uppercase alpha or decimal digits
+         */
+        for (i = 0; i < 4; i++)
+        {
+            if (!isupper ((int) Op->Asl.Value.String[i]) &&
+                !isdigit ((int) Op->Asl.Value.String[i]))
+            {
+                AslError (ASL_ERROR, ASL_MSG_HID_PREFIX,
+                    Op, &Op->Asl.Value.String[i]);
+                return;
+            }
+        }
+    }
+
+    /* Remaining characters (suffix) must be hex digits */
+
+    for (; i < Length; i++)
+    {
+        if (!isxdigit ((int) Op->Asl.Value.String[i]))
+        {
+            AslError (ASL_ERROR, ASL_MSG_HID_SUFFIX,
+                Op, &Op->Asl.Value.String[i]);
+            break;
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnLastStatementIsReturn
+ *
+ * PARAMETERS:  Op                  - A method parse node
+ *
+ * RETURN:      TRUE if last statement is an ASL RETURN. False otherwise
+ *
+ * DESCRIPTION: Walk down the list of top level statements within a method
+ *              to find the last one. Check if that last statement is in
+ *              fact a RETURN statement.
+ *
+ ******************************************************************************/
+
+BOOLEAN
+AnLastStatementIsReturn (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    /* Check if last statement is a return */
+
+    Next = ASL_GET_CHILD_NODE (Op);
+    while (Next)
+    {
+        if ((!Next->Asl.Next) &&
+            (Next->Asl.ParseOpcode == PARSEOP_RETURN))
+        {
+            return (TRUE);
+        }
+
+        Next = ASL_GET_PEER_NODE (Next);
+    }
+
+    return (FALSE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnCheckMethodReturnValue
+ *
+ * PARAMETERS:  Op                  - Parent
+ *              OpInfo              - Parent info
+ *              ArgOp               - Method invocation op
+ *              RequiredBtypes      - What caller requires
+ *              ThisNodeBtype       - What this node returns (if anything)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check a method invocation for 1) A return value and if it does
+ *              in fact return a value, 2) check the type of the return value.
+ *
+ ******************************************************************************/
+
+void
+AnCheckMethodReturnValue (
+    ACPI_PARSE_OBJECT       *Op,
+    const ACPI_OPCODE_INFO  *OpInfo,
+    ACPI_PARSE_OBJECT       *ArgOp,
+    UINT32                  RequiredBtypes,
+    UINT32                  ThisNodeBtype)
+{
+    ACPI_PARSE_OBJECT       *OwningOp;
+    ACPI_NAMESPACE_NODE     *Node;
+
+
+    Node = ArgOp->Asl.Node;
+
+    if (!Node)
+    {
+        /* No error message, this can happen and is OK */
+
+        return;
+    }
+
+    /* Examine the parent op of this method */
+
+    OwningOp = Node->Op;
+    if (OwningOp->Asl.CompileFlags & NODE_METHOD_NO_RETVAL)
+    {
+        /* Method NEVER returns a value */
+
+        AslError (ASL_ERROR, ASL_MSG_NO_RETVAL, Op, Op->Asl.ExternalName);
+    }
+    else if (OwningOp->Asl.CompileFlags & NODE_METHOD_SOME_NO_RETVAL)
+    {
+        /* Method SOMETIMES returns a value, SOMETIMES not */
+
+        AslError (ASL_WARNING, ASL_MSG_SOME_NO_RETVAL,
+            Op, Op->Asl.ExternalName);
+    }
+    else if (!(ThisNodeBtype & RequiredBtypes))
+    {
+        /* Method returns a value, but the type is wrong */
+
+        AnFormatBtype (StringBuffer, ThisNodeBtype);
+        AnFormatBtype (StringBuffer2, RequiredBtypes);
+
+        /*
+         * The case where the method does not return any value at all
+         * was already handled in the namespace cross reference
+         * -- Only issue an error if the method in fact returns a value,
+         * but it is of the wrong type
+         */
+        if (ThisNodeBtype != 0)
+        {
+            sprintf (MsgBuffer,
+                "Method returns [%s], %s operator requires [%s]",
+                StringBuffer, OpInfo->Name, StringBuffer2);
+
+            AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ArgOp, MsgBuffer);
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnIsResultUsed
+ *
+ * PARAMETERS:  Op                  - Parent op for the operator
+ *
+ * RETURN:      TRUE if result from this operation is actually consumed
+ *
+ * DESCRIPTION: Determine if the function result value from an operator is
+ *              used.
+ *
+ ******************************************************************************/
+
+BOOLEAN
+AnIsResultUsed (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Parent;
+
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_INCREMENT:
+    case PARSEOP_DECREMENT:
+
+        /* These are standalone operators, no return value */
+
+        return (TRUE);
+
+    default:
+
+        break;
+    }
+
+    /* Examine parent to determine if the return value is used */
+
+    Parent = Op->Asl.Parent;
+    switch (Parent->Asl.ParseOpcode)
+    {
+    /* If/While - check if the operator is the predicate */
+
+    case PARSEOP_IF:
+    case PARSEOP_WHILE:
+
+        /* First child is the predicate */
+
+        if (Parent->Asl.Child == Op)
+        {
+            return (TRUE);
+        }
+
+        return (FALSE);
+
+    /* Not used if one of these is the parent */
+
+    case PARSEOP_METHOD:
+    case PARSEOP_DEFINITION_BLOCK:
+    case PARSEOP_ELSE:
+
+        return (FALSE);
+
+    default:
+
+        /* Any other type of parent means that the result is used */
+
+        return (TRUE);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckForGpeNameConflict
+ *
+ * PARAMETERS:  Op                  - Current parse op
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check for a conflict between GPE names within this scope.
+ *              Conflict means two GPE names with the same GPE number, but
+ *              different types -- such as _L1C and _E1C.
+ *
+ ******************************************************************************/
+
+void
+ApCheckForGpeNameConflict (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *NextOp;
+    UINT32                  GpeNumber;
+    char                    Name[ACPI_NAME_SIZE + 1];
+    char                    Target[ACPI_NAME_SIZE];
+
+
+    /* Need a null-terminated string version of NameSeg */
+
+    ACPI_MOVE_32_TO_32 (Name, &Op->Asl.NameSeg);
+    Name[ACPI_NAME_SIZE] = 0;
+
+    /*
+     * For a GPE method:
+     * 1st char must be underscore
+     * 2nd char must be L or E
+     * 3rd/4th chars must be a hex number
+     */
+    if ((Name[0] != '_') ||
+       ((Name[1] != 'L') && (Name[1] != 'E')))
+    {
+        return;
+    }
+
+    /* Verify 3rd/4th chars are a valid hex value */
+
+    GpeNumber = strtoul (&Name[2], NULL, 16);
+    if (GpeNumber == ACPI_UINT32_MAX)
+    {
+        return;
+    }
+
+    /*
+     * We are now sure we have an _Lxx or _Exx.
+     * Create the target name that would cause collision (Flip E/L)
+     */
+    ACPI_MOVE_32_TO_32 (Target, Name);
+
+    /* Inject opposite letter ("L" versus "E") */
+
+    if (Name[1] == 'L')
+    {
+        Target[1] = 'E';
+    }
+    else /* Name[1] == 'E' */
+    {
+        Target[1] = 'L';
+    }
+
+    /* Search all peers (objects within this scope) for target match */
+
+    NextOp = Op->Asl.Next;
+    while (NextOp)
+    {
+        /*
+         * We mostly care about methods, but check Name() constructs also,
+         * even though they will get another error for not being a method.
+         * All GPE names must be defined as control methods.
+         */
+        if ((NextOp->Asl.ParseOpcode == PARSEOP_METHOD) ||
+            (NextOp->Asl.ParseOpcode == PARSEOP_NAME))
+        {
+            if (ACPI_COMPARE_NAME (Target, NextOp->Asl.NameSeg))
+            {
+                /* Found both _Exy and _Lxy in the same scope, error */
+
+                AslError (ASL_ERROR, ASL_MSG_GPE_NAME_CONFLICT, NextOp,
+                    Name);
+                return;
+            }
+        }
+
+        NextOp = NextOp->Asl.Next;
+    }
+
+    /* OK, no conflict found */
+
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckRegMethod
+ *
+ * PARAMETERS:  Op                  - Current parse op
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Ensure that a _REG method has a corresponding Operation
+ *              Region declaration within the same scope. Note: _REG is defined
+ *              to have two arguments and must therefore be defined as a
+ *              control method.
+ *
+ ******************************************************************************/
+
+void
+ApCheckRegMethod (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+    ACPI_PARSE_OBJECT       *Parent;
+
+
+    /* We are only interested in _REG methods */
+
+    if (!ACPI_COMPARE_NAME (METHOD_NAME__REG, &Op->Asl.NameSeg))
+    {
+        return;
+    }
+
+    /* Get the start of the current scope */
+
+    Parent = Op->Asl.Parent;
+    Next = Parent->Asl.Child;
+
+    /* Search entire scope for an operation region declaration */
+
+    while (Next)
+    {
+        if (Next->Asl.ParseOpcode == PARSEOP_OPERATIONREGION)
+        {
+            return; /* Found region, OK */
+        }
+
+        Next = Next->Asl.Next;
+    }
+
+    /* No region found, issue warning */
+
+    AslError (ASL_WARNING, ASL_MSG_NO_REGION, Op, NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApFindNameInDeviceTree
+ *
+ * PARAMETERS:  Name                - Name to search for
+ *              Op                  - Current parse op
+ *
+ * RETURN:      TRUE if name found in the same scope as Op.
+ *
+ * DESCRIPTION: Determine if a name appears in the same scope as Op, as either
+ *              a Method() or a Name(). "Same scope" can mean under an If or
+ *              Else statement.
+ *
+ * NOTE: Detects _HID/_ADR in this type of construct (legal in ACPI 6.1+)
+ *
+ * Scope (\_SB.PCI0)
+ * {
+ *     Device (I2C0)
+ *     {
+ *         If (SMD0 != 4) {
+ *             Name (_HID, "INT3442")
+ *         } Else {
+ *             Name (_ADR, 0x400)
+ *         }
+ *     }
+ * }
+ ******************************************************************************/
+
+BOOLEAN
+ApFindNameInDeviceTree (
+    char                    *Name,
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = TrWalkParseTree (Op, ASL_WALK_VISIT_DOWNWARD,
+        ApDeviceSubtreeWalk, NULL, Name);
+
+    if (Status == AE_CTRL_TRUE)
+    {
+        return (TRUE);  /* Found a match */
+    }
+
+    return (FALSE);
+}
+
+
+/* Callback function for interface above */
+
+static ACPI_STATUS
+ApDeviceSubtreeWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    char                    *Name = ACPI_CAST_PTR (char, Context);
+
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_DEVICE:
+
+        /* Level 0 is the starting device, ignore it */
+
+        if (Level > 0)
+        {
+            /* Ignore sub-devices */
+
+            return (AE_CTRL_DEPTH);
+        }
+        break;
+
+    case PARSEOP_NAME:
+    case PARSEOP_METHOD:
+
+        /* These are what we are looking for */
+
+        if (ACPI_COMPARE_NAME (Name, Op->Asl.NameSeg))
+        {
+            return (AE_CTRL_TRUE);
+        }
+        return (AE_CTRL_DEPTH);
+
+    case PARSEOP_SCOPE:
+    case PARSEOP_FIELD:
+    case PARSEOP_OPERATIONREGION:
+
+        /*
+         * We want to ignore these, because either they can be large
+         * subtrees or open a scope to somewhere else.
+         */
+        return (AE_CTRL_DEPTH);
+
+    default:
+        break;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApFindNameInScope
+ *
+ * PARAMETERS:  Name                - Name to search for
+ *              Op                  - Current parse op
+ *
+ * RETURN:      TRUE if name found in the same scope as Op.
+ *
+ * DESCRIPTION: Determine if a name appears in the same scope as Op, as either
+ *              a Method() or a Name().
+ *
+ ******************************************************************************/
+
+BOOLEAN
+ApFindNameInScope (
+    char                    *Name,
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+    ACPI_PARSE_OBJECT       *Parent;
+
+
+    /* Get the start of the current scope */
+
+    Parent = Op->Asl.Parent;
+    Next = Parent->Asl.Child;
+
+    /* Search entire scope for a match to the name */
+
+    while (Next)
+    {
+        if ((Next->Asl.ParseOpcode == PARSEOP_METHOD) ||
+            (Next->Asl.ParseOpcode == PARSEOP_NAME))
+        {
+            if (ACPI_COMPARE_NAME (Name, Next->Asl.NameSeg))
+            {
+                return (TRUE);
+            }
+        }
+
+        Next = Next->Asl.Next;
+    }
+
+    return (FALSE);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslascii.c b/usr/src/cmd/acpi/iasl/aslascii.c
new file mode 100644
index 0000000000..8a1d57dccc
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslascii.c
@@ -0,0 +1,288 @@
+/******************************************************************************
+ *
+ * Module Name: aslascii - ASCII detection and support routines
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include <actables.h>
+#include <acapps.h>
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslascii")
+
+
+/* Local prototypes */
+
+static void
+FlConsumeAnsiComment (
+    FILE                    *Handle,
+    ASL_FILE_STATUS         *Status);
+
+static void
+FlConsumeNewComment (
+    FILE                    *Handle,
+    ASL_FILE_STATUS         *Status);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlIsFileAsciiSource
+ *
+ * PARAMETERS:  Filename            - Full input filename
+ *              DisplayErrors       - TRUE if error messages desired
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Verify that the input file is entirely ASCII. Ignores characters
+ *              within comments. Note: does not handle nested comments and does
+ *              not handle comment delimiters within string literals. However,
+ *              on the rare chance this happens and an invalid character is
+ *              missed, the parser will catch the error by failing in some
+ *              spectactular manner.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+FlIsFileAsciiSource (
+    char                    *Filename,
+    BOOLEAN                 DisplayErrors)
+{
+    UINT8                   Byte;
+    ACPI_SIZE               BadBytes = 0;
+    BOOLEAN                 OpeningComment = FALSE;
+    ASL_FILE_STATUS         Status;
+    FILE                    *Handle;
+
+
+    /* Open file in text mode so file offset is always accurate */
+
+    Handle = fopen (Filename, "rb");
+    if (!Handle)
+    {
+        perror ("Could not open input file");
+        return (AE_ERROR);
+    }
+
+    Status.Line = 1;
+    Status.Offset = 0;
+
+    /* Read the entire file */
+
+    while (fread (&Byte, 1, 1, Handle) == 1)
+    {
+        /* Ignore comment fields (allow non-ascii within) */
+
+        if (OpeningComment)
+        {
+            /* Check for second comment open delimiter */
+
+            if (Byte == '*')
+            {
+                FlConsumeAnsiComment (Handle, &Status);
+            }
+
+            if (Byte == '/')
+            {
+                FlConsumeNewComment (Handle, &Status);
+            }
+
+            /* Reset */
+
+            OpeningComment = FALSE;
+        }
+        else if (Byte == '/')
+        {
+            OpeningComment = TRUE;
+        }
+
+        /* Check for an ASCII character */
+
+        if (!ACPI_IS_ASCII (Byte))
+        {
+            if ((BadBytes < 10) && (DisplayErrors))
+            {
+                AcpiOsPrintf (
+                    "Found non-ASCII character in source text: "
+                    "0x%2.2X in line %u, file offset 0x%2.2X\n",
+                    Byte, Status.Line, Status.Offset);
+            }
+            BadBytes++;
+        }
+
+        /* Ensure character is either printable or a "space" char */
+
+        else if (!isprint (Byte) && !isspace (Byte))
+        {
+            if ((BadBytes < 10) && (DisplayErrors))
+            {
+                AcpiOsPrintf (
+                    "Found invalid character in source text: "
+                    "0x%2.2X in line %u, file offset 0x%2.2X\n",
+                    Byte, Status.Line, Status.Offset);
+            }
+            BadBytes++;
+        }
+
+        /* Update line counter as necessary */
+
+        if (Byte == 0x0A)
+        {
+            Status.Line++;
+        }
+
+        Status.Offset++;
+    }
+
+    fclose (Handle);
+
+    /* Were there any non-ASCII characters in the file? */
+
+    if (BadBytes)
+    {
+        if (DisplayErrors)
+        {
+            AcpiOsPrintf (
+                "Total %u invalid characters found in input source text, "
+                "could be a binary file\n", BadBytes);
+            AslError (ASL_ERROR, ASL_MSG_NON_ASCII, NULL, Filename);
+        }
+
+        return (AE_BAD_CHARACTER);
+    }
+
+    /* File is OK (100% ASCII) */
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlConsumeAnsiComment
+ *
+ * PARAMETERS:  Handle              - Open input file
+ *              Status              - File current status struct
+ *
+ * RETURN:      Number of lines consumed
+ *
+ * DESCRIPTION: Step over a normal slash-star type comment
+ *
+ ******************************************************************************/
+
+static void
+FlConsumeAnsiComment (
+    FILE                    *Handle,
+    ASL_FILE_STATUS         *Status)
+{
+    UINT8                   Byte;
+    BOOLEAN                 ClosingComment = FALSE;
+
+
+    while (fread (&Byte, 1, 1, Handle) == 1)
+    {
+        /* Scan until comment close is found */
+
+        if (ClosingComment)
+        {
+            if (Byte == '/')
+            {
+                Status->Offset++;
+                return;
+            }
+
+            if (Byte != '*')
+            {
+                /* Reset */
+
+                ClosingComment = FALSE;
+            }
+        }
+        else if (Byte == '*')
+        {
+            ClosingComment = TRUE;
+        }
+
+        /* Maintain line count */
+
+        if (Byte == 0x0A)
+        {
+            Status->Line++;
+        }
+
+        Status->Offset++;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlConsumeNewComment
+ *
+ * PARAMETERS:  Handle              - Open input file
+ *              Status              - File current status struct
+ *
+ * RETURN:      Number of lines consumed
+ *
+ * DESCRIPTION: Step over a slash-slash type of comment
+ *
+ ******************************************************************************/
+
+static void
+FlConsumeNewComment (
+    FILE                    *Handle,
+    ASL_FILE_STATUS         *Status)
+{
+    UINT8                   Byte;
+
+
+    while (fread (&Byte, 1, 1, Handle) == 1)
+    {
+        Status->Offset++;
+
+        /* Comment ends at newline */
+
+        if (Byte == 0x0A)
+        {
+            Status->Line++;
+            return;
+        }
+    }
+}
diff --git a/usr/src/cmd/acpi/iasl/aslbtypes.c b/usr/src/cmd/acpi/iasl/aslbtypes.c
new file mode 100644
index 0000000000..c956516f8b
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslbtypes.c
@@ -0,0 +1,595 @@
+/******************************************************************************
+ *
+ * Module Name: aslbtypes - Support for bitfield types
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslbtypes")
+
+/* Local prototypes */
+
+static UINT32
+AnMapEtypeToBtype (
+    UINT32                  Etype);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnMapArgTypeToBtype
+ *
+ * PARAMETERS:  ArgType             - The ARGI required type(s) for this
+ *                                    argument, from the opcode info table
+ *
+ * RETURN:      The corresponding Bit-encoded types
+ *
+ * DESCRIPTION: Convert an encoded ARGI required argument type code into a
+ *              bitfield type code. Implements the implicit source conversion
+ *              rules.
+ *
+ ******************************************************************************/
+
+UINT32
+AnMapArgTypeToBtype (
+    UINT32                  ArgType)
+{
+
+    switch (ArgType)
+    {
+    /* Simple types */
+
+    case ARGI_ANYTYPE:
+
+        return (ACPI_BTYPE_OBJECTS_AND_REFS);
+
+    case ARGI_PACKAGE:
+
+        return (ACPI_BTYPE_PACKAGE);
+
+    case ARGI_EVENT:
+
+        return (ACPI_BTYPE_EVENT);
+
+    case ARGI_MUTEX:
+
+        return (ACPI_BTYPE_MUTEX);
+
+    case ARGI_DDBHANDLE:
+        /*
+         * DDBHandleObject := SuperName
+         * ACPI_BTYPE_REFERENCE_OBJECT:
+         *      Index reference as parameter of Load/Unload
+         */
+        return (ACPI_BTYPE_DDB_HANDLE | ACPI_BTYPE_REFERENCE_OBJECT);
+
+    /* Interchangeable types */
+    /*
+     * Source conversion rules:
+     * Integer, String, and Buffer are all interchangeable
+     */
+    case ARGI_INTEGER:
+    case ARGI_STRING:
+    case ARGI_BUFFER:
+    case ARGI_BUFFER_OR_STRING:
+    case ARGI_COMPUTEDATA:
+
+        return (ACPI_BTYPE_COMPUTE_DATA);
+
+    /* References */
+
+    case ARGI_INTEGER_REF:
+
+        return (ACPI_BTYPE_INTEGER);
+
+    case ARGI_OBJECT_REF:
+
+        return (ACPI_BTYPE_ALL_OBJECTS);
+
+    case ARGI_DEVICE_REF:
+
+        return (ACPI_BTYPE_DEVICE_OBJECTS);
+
+    case ARGI_REFERENCE:
+
+        return (ACPI_BTYPE_NAMED_REFERENCE); /* Name or Namestring */
+
+    case ARGI_TARGETREF:
+
+        /*
+         * Target operand for most math and logic operators.
+         * Package objects not allowed as target.
+         */
+        return (ACPI_BTYPE_COMPUTE_DATA | ACPI_BTYPE_DEBUG_OBJECT |
+            ACPI_BTYPE_REFERENCE_OBJECT);
+
+    case ARGI_STORE_TARGET:
+
+        /* Special target for Store(), includes packages */
+
+        return (ACPI_BTYPE_DATA | ACPI_BTYPE_DEBUG_OBJECT |
+            ACPI_BTYPE_REFERENCE_OBJECT);
+
+    case ARGI_FIXED_TARGET:
+    case ARGI_SIMPLE_TARGET:
+
+        return (ACPI_BTYPE_OBJECTS_AND_REFS);
+
+    /* Complex types */
+
+    case ARGI_DATAOBJECT:
+        /*
+         * Buffer, string, package or reference to a Op -
+         * Used only by SizeOf operator
+         */
+        return (ACPI_BTYPE_STRING | ACPI_BTYPE_BUFFER |
+            ACPI_BTYPE_PACKAGE | ACPI_BTYPE_REFERENCE_OBJECT);
+
+    case ARGI_COMPLEXOBJ:
+
+        /* Buffer, String, or package */
+
+        return (ACPI_BTYPE_STRING | ACPI_BTYPE_BUFFER |
+            ACPI_BTYPE_PACKAGE);
+
+    case ARGI_REF_OR_STRING:
+
+        /* Used by DeRefOf operator only */
+
+        return (ACPI_BTYPE_STRING | ACPI_BTYPE_REFERENCE_OBJECT);
+
+    case ARGI_REGION_OR_BUFFER:
+
+        /* Used by Load() only. Allow buffers in addition to regions/fields */
+
+        return (ACPI_BTYPE_REGION | ACPI_BTYPE_BUFFER |
+            ACPI_BTYPE_FIELD_UNIT);
+
+    case ARGI_DATAREFOBJ:
+
+        /* Used by Store() only, as the source operand */
+
+        return (ACPI_BTYPE_DATA_REFERENCE | ACPI_BTYPE_REFERENCE_OBJECT);
+
+    default:
+
+        break;
+    }
+
+    return (ACPI_BTYPE_OBJECTS_AND_REFS);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnMapEtypeToBtype
+ *
+ * PARAMETERS:  Etype               - Encoded ACPI Type
+ *
+ * RETURN:      Btype corresponding to the Etype
+ *
+ * DESCRIPTION: Convert an encoded ACPI type to a bitfield type applying the
+ *              operand conversion rules. In other words, returns the type(s)
+ *              this Etype is implicitly converted to during interpretation.
+ *
+ ******************************************************************************/
+
+static UINT32
+AnMapEtypeToBtype (
+    UINT32                  Etype)
+{
+
+    if (Etype == ACPI_TYPE_ANY)
+    {
+        return (ACPI_BTYPE_OBJECTS_AND_REFS);
+    }
+
+    /* Try the standard ACPI data types */
+
+    if (Etype <= ACPI_TYPE_EXTERNAL_MAX)
+    {
+        /*
+         * This switch statement implements the allowed operand conversion
+         * rules as per the "ASL Data Types" section of the ACPI
+         * specification.
+         */
+        switch (Etype)
+        {
+        case ACPI_TYPE_INTEGER:
+
+            return (ACPI_BTYPE_COMPUTE_DATA | ACPI_BTYPE_DDB_HANDLE);
+
+        case ACPI_TYPE_STRING:
+        case ACPI_TYPE_BUFFER:
+
+            return (ACPI_BTYPE_COMPUTE_DATA);
+
+        case ACPI_TYPE_PACKAGE:
+
+            return (ACPI_BTYPE_PACKAGE);
+
+        case ACPI_TYPE_FIELD_UNIT:
+
+            return (ACPI_BTYPE_COMPUTE_DATA | ACPI_BTYPE_FIELD_UNIT);
+
+        case ACPI_TYPE_BUFFER_FIELD:
+
+            return (ACPI_BTYPE_COMPUTE_DATA | ACPI_BTYPE_BUFFER_FIELD);
+
+        case ACPI_TYPE_DDB_HANDLE:
+
+            return (ACPI_BTYPE_INTEGER | ACPI_BTYPE_DDB_HANDLE);
+
+        case ACPI_TYPE_DEBUG_OBJECT:
+
+            /* Cannot be used as a source operand */
+
+            return (0);
+
+        default:
+
+            return (1 << (Etype - 1));
+        }
+    }
+
+    /* Try the internal data types */
+
+    switch (Etype)
+    {
+    case ACPI_TYPE_LOCAL_REGION_FIELD:
+    case ACPI_TYPE_LOCAL_BANK_FIELD:
+    case ACPI_TYPE_LOCAL_INDEX_FIELD:
+
+        /* Named fields can be either Integer/Buffer/String */
+
+        return (ACPI_BTYPE_COMPUTE_DATA | ACPI_BTYPE_FIELD_UNIT);
+
+    case ACPI_TYPE_LOCAL_ALIAS:
+
+        return (ACPI_BTYPE_INTEGER);
+
+
+    case ACPI_TYPE_LOCAL_RESOURCE:
+    case ACPI_TYPE_LOCAL_RESOURCE_FIELD:
+
+        return (ACPI_BTYPE_REFERENCE_OBJECT);
+
+    default:
+
+        printf ("Unhandled encoded type: %X\n", Etype);
+        return (0);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnFormatBtype
+ *
+ * PARAMETERS:  Btype               - Bitfield of ACPI types
+ *              Buffer              - Where to put the ascii string
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Convert a Btype to a string of ACPI types
+ *
+ ******************************************************************************/
+
+void
+AnFormatBtype (
+    char                    *Buffer,
+    UINT32                  Btype)
+{
+    UINT32                  Type;
+    BOOLEAN                 First = TRUE;
+
+
+    *Buffer = 0;
+    if (Btype == 0)
+    {
+        strcat (Buffer, "NoReturnValue");
+        return;
+    }
+
+    for (Type = 1; Type <= ACPI_TYPE_EXTERNAL_MAX; Type++)
+    {
+        if (Btype & 0x00000001)
+        {
+            if (!First)
+            {
+                strcat (Buffer, "|");
+            }
+
+            First = FALSE;
+            strcat (Buffer, AcpiUtGetTypeName (Type));
+        }
+        Btype >>= 1;
+    }
+
+    if (Btype & 0x00000001)
+    {
+        if (!First)
+        {
+            strcat (Buffer, "|");
+        }
+
+        First = FALSE;
+        strcat (Buffer, "Reference");
+    }
+
+    Btype >>= 1;
+    if (Btype & 0x00000001)
+    {
+        if (!First)
+        {
+            strcat (Buffer, "|");
+        }
+
+        First = FALSE;
+        strcat (Buffer, "Resource");
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnGetBtype
+ *
+ * PARAMETERS:  Op                  - Parse node whose type will be returned.
+ *
+ * RETURN:      The Btype associated with the Op.
+ *
+ * DESCRIPTION: Get the (bitfield) ACPI type associated with the parse node.
+ *              Handles the case where the node is a name or method call and
+ *              the actual type must be obtained from the namespace node.
+ *
+ ******************************************************************************/
+
+UINT32
+AnGetBtype (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_PARSE_OBJECT       *ReferencedNode;
+    UINT32                  ThisNodeBtype = 0;
+
+
+    if (!Op)
+    {
+        AcpiOsPrintf ("Null Op in AnGetBtype\n");
+        return (ACPI_UINT32_MAX);
+    }
+
+    if ((Op->Asl.ParseOpcode == PARSEOP_NAMESEG)     ||
+        (Op->Asl.ParseOpcode == PARSEOP_NAMESTRING)  ||
+        (Op->Asl.ParseOpcode == PARSEOP_METHODCALL))
+    {
+        Node = Op->Asl.Node;
+        if (!Node)
+        {
+            /* These are not expected to have a node at this time */
+
+            if ((Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CREATEWORDFIELD) ||
+                (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CREATEDWORDFIELD) ||
+                (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CREATEQWORDFIELD) ||
+                (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CREATEBYTEFIELD) ||
+                (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CREATEBITFIELD) ||
+                (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CREATEFIELD)    ||
+                (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CONDREFOF))
+            {
+                return (ACPI_UINT32_MAX - 1);
+            }
+
+            DbgPrint (ASL_DEBUG_OUTPUT,
+                "No attached Nsnode: [%s] at line %u name [%s], "
+                "ignoring typecheck. Parent [%s]\n",
+                Op->Asl.ParseOpName, Op->Asl.LineNumber,
+                Op->Asl.ExternalName, Op->Asl.Parent->Asl.ParseOpName);
+            return (ACPI_UINT32_MAX - 1);
+        }
+
+        ThisNodeBtype = AnMapEtypeToBtype (Node->Type);
+        if (!ThisNodeBtype)
+        {
+            AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL, Op,
+                "could not map type");
+        }
+
+        if (Op->Asl.ParseOpcode == PARSEOP_METHODCALL)
+        {
+            ReferencedNode = Node->Op;
+            if (!ReferencedNode)
+            {
+                /* Check for an internal method */
+
+                if (AnIsInternalMethod (Op))
+                {
+                    return (AnGetInternalMethodReturnType (Op));
+                }
+
+                AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL, Op,
+                    "null Op pointer");
+                return (ACPI_UINT32_MAX);
+            }
+
+            if (ReferencedNode->Asl.CompileFlags & NODE_METHOD_TYPED)
+            {
+                ThisNodeBtype = ReferencedNode->Asl.AcpiBtype;
+            }
+            else
+            {
+                return (ACPI_UINT32_MAX -1);
+            }
+        }
+    }
+    else
+    {
+        ThisNodeBtype = Op->Asl.AcpiBtype;
+    }
+
+    return (ThisNodeBtype);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnMapObjTypeToBtype
+ *
+ * PARAMETERS:  Op                  - A parse node
+ *
+ * RETURN:      A Btype
+ *
+ * DESCRIPTION: Map object to the associated "Btype"
+ *
+ ******************************************************************************/
+
+UINT32
+AnMapObjTypeToBtype (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_OBJECTTYPE_BFF:        /* "BuffFieldObj" */
+
+        return (ACPI_BTYPE_BUFFER_FIELD);
+
+    case PARSEOP_OBJECTTYPE_BUF:        /* "BuffObj" */
+
+        return (ACPI_BTYPE_BUFFER);
+
+    case PARSEOP_OBJECTTYPE_DDB:        /* "DDBHandleObj" */
+
+        return (ACPI_BTYPE_DDB_HANDLE);
+
+    case PARSEOP_OBJECTTYPE_DEV:        /* "DeviceObj" */
+
+        return (ACPI_BTYPE_DEVICE);
+
+    case PARSEOP_OBJECTTYPE_EVT:        /* "EventObj" */
+
+        return (ACPI_BTYPE_EVENT);
+
+    case PARSEOP_OBJECTTYPE_FLD:        /* "FieldUnitObj" */
+
+        return (ACPI_BTYPE_FIELD_UNIT);
+
+    case PARSEOP_OBJECTTYPE_INT:        /* "IntObj" */
+
+        return (ACPI_BTYPE_INTEGER);
+
+    case PARSEOP_OBJECTTYPE_MTH:        /* "MethodObj" */
+
+        return (ACPI_BTYPE_METHOD);
+
+    case PARSEOP_OBJECTTYPE_MTX:        /* "MutexObj" */
+
+        return (ACPI_BTYPE_MUTEX);
+
+    case PARSEOP_OBJECTTYPE_OPR:        /* "OpRegionObj" */
+
+        return (ACPI_BTYPE_REGION);
+
+    case PARSEOP_OBJECTTYPE_PKG:        /* "PkgObj" */
+
+        return (ACPI_BTYPE_PACKAGE);
+
+    case PARSEOP_OBJECTTYPE_POW:        /* "PowerResObj" */
+
+        return (ACPI_BTYPE_POWER);
+
+    case PARSEOP_OBJECTTYPE_STR:        /* "StrObj" */
+
+        return (ACPI_BTYPE_STRING);
+
+    case PARSEOP_OBJECTTYPE_THZ:        /* "ThermalZoneObj" */
+
+        return (ACPI_BTYPE_THERMAL);
+
+    case PARSEOP_OBJECTTYPE_UNK:        /* "UnknownObj" */
+
+        return (ACPI_BTYPE_OBJECTS_AND_REFS);
+
+    default:
+
+        return (0);
+    }
+}
+
+
+#ifdef ACPI_OBSOLETE_FUNCTIONS
+/*******************************************************************************
+ *
+ * FUNCTION:    AnMapBtypeToEtype
+ *
+ * PARAMETERS:  Btype               - Bitfield of ACPI types
+ *
+ * RETURN:      The Etype corresponding the the Btype
+ *
+ * DESCRIPTION: Convert a bitfield type to an encoded type
+ *
+ ******************************************************************************/
+
+UINT32
+AnMapBtypeToEtype (
+    UINT32              Btype)
+{
+    UINT32              i;
+    UINT32              Etype;
+
+
+    if (Btype == 0)
+    {
+        return (0);
+    }
+
+    Etype = 1;
+    for (i = 1; i < Btype; i *= 2)
+    {
+        Etype++;
+    }
+
+    return (Etype);
+}
+#endif
diff --git a/usr/src/cmd/acpi/iasl/aslcodegen.c b/usr/src/cmd/acpi/iasl/aslcodegen.c
new file mode 100644
index 0000000000..30e79841a2
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslcodegen.c
@@ -0,0 +1,658 @@
+/******************************************************************************
+ *
+ * Module Name: aslcodegen - AML code generation
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslcodegen")
+
+/* Local prototypes */
+
+static ACPI_STATUS
+CgAmlWriteWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static void
+CgLocalWriteAmlData (
+    ACPI_PARSE_OBJECT       *Op,
+    void                    *Buffer,
+    UINT32                  Length);
+
+static void
+CgWriteAmlOpcode (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+CgWriteTableHeader (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+CgCloseTable (
+    void);
+
+static void
+CgWriteNode (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgGenerateAmlOutput
+ *
+ * PARAMETERS:  None.
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Generate AML code. Currently generates the listing file
+ *              simultaneously.
+ *
+ ******************************************************************************/
+
+void
+CgGenerateAmlOutput (
+    void)
+{
+
+    /* Generate the AML output file */
+
+    FlSeekFile (ASL_FILE_SOURCE_OUTPUT, 0);
+    Gbl_SourceLine = 0;
+    Gbl_NextError = Gbl_ErrorLog;
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        CgAmlWriteWalk, NULL, NULL);
+
+    DbgPrint (ASL_TREE_OUTPUT, ASL_PARSE_TREE_HEADER2);
+    CgCloseTable ();
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgAmlWriteWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Parse tree walk to generate the AML code.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+CgAmlWriteWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    /* Generate the AML for this node */
+
+    CgWriteNode (Op);
+
+    if (!Gbl_DebugFlag)
+    {
+        return (AE_OK);
+    }
+
+    /* Print header at level 0. Alignment assumes 32-bit pointers */
+
+    if (!Level)
+    {
+        DbgPrint (ASL_TREE_OUTPUT,
+            "\nFinal parse tree used for AML output:\n");
+        DbgPrint (ASL_TREE_OUTPUT, ASL_PARSE_TREE_HEADER2);
+    }
+
+    /* Dump ParseOp name and possible value */
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_NAMESEG:
+    case PARSEOP_NAMESTRING:
+    case PARSEOP_METHODCALL:
+    case PARSEOP_STRING_LITERAL:
+
+        UtDumpStringOp (Op, Level);
+        break;
+
+    default:
+
+        UtDumpBasicOp (Op, Level);
+        break;
+    }
+
+    DbgPrint (ASL_TREE_OUTPUT, ASL_PARSE_TREE_DEBUG2,
+        /* 1  */ (UINT32) Op->Asl.Value.Integer,
+        /* 2  */ Op->Asl.ParseOpcode,
+        /* 3  */ Op->Asl.AmlOpcode,
+        /* 4  */ Op->Asl.AmlOpcodeLength,
+        /* 5  */ Op->Asl.AmlPkgLenBytes,
+        /* 6  */ Op->Asl.AmlLength,
+        /* 7  */ Op->Asl.AmlSubtreeLength,
+        /* 8  */ Op->Asl.Parent ? Op->Asl.Parent->Asl.AmlSubtreeLength : 0,
+        /* 9  */ Op,
+        /* 10 */ Op->Asl.Parent,
+        /* 11 */ Op->Asl.Child,
+        /* 12 */ Op->Asl.Next,
+        /* 13 */ Op->Asl.CompileFlags,
+        /* 14 */ Op->Asl.AcpiBtype,
+        /* 15 */ Op->Asl.FinalAmlLength,
+        /* 16 */ Op->Asl.Column,
+        /* 17 */ Op->Asl.LineNumber,
+        /* 18 */ Op->Asl.EndLine,
+        /* 19 */ Op->Asl.LogicalLineNumber,
+        /* 20 */ Op->Asl.EndLogicalLine);
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgLocalWriteAmlData
+ *
+ * PARAMETERS:  Op              - Current parse op
+ *              Buffer          - Buffer to write
+ *              Length          - Size of data in buffer
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write a buffer of AML data to the AML output file.
+ *
+ ******************************************************************************/
+
+static void
+CgLocalWriteAmlData (
+    ACPI_PARSE_OBJECT       *Op,
+    void                    *Buffer,
+    UINT32                  Length)
+{
+
+    /* Write the raw data to the AML file */
+
+    FlWriteFile (ASL_FILE_AML_OUTPUT, Buffer, Length);
+
+    /* Update the final AML length for this node (used for listings) */
+
+    if (Op)
+    {
+        Op->Asl.FinalAmlLength += Length;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgWriteAmlOpcode
+ *
+ * PARAMETERS:  Op            - Parse node with an AML opcode
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Write the AML opcode corresponding to a parse node.
+ *
+ ******************************************************************************/
+
+static void
+CgWriteAmlOpcode (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    UINT8                   PkgLenFirstByte;
+    UINT32                  i;
+    union {
+        UINT16                  Opcode;
+        UINT8                   OpcodeBytes[2];
+    } Aml;
+    union {
+        UINT32                  Len;
+        UINT8                   LenBytes[4];
+    } PkgLen;
+
+
+    /* We expect some DEFAULT_ARGs, just ignore them */
+
+    if (Op->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+    {
+        return;
+    }
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_UNASSIGNED_OPCODE:
+
+        /* These opcodes should not get here */
+
+        printf ("Found a node with an unassigned AML opcode\n");
+        FlPrintFile (ASL_FILE_STDERR,
+            "Found a node with an unassigned AML opcode\n");
+        return;
+
+    case AML_INT_RESERVEDFIELD_OP:
+
+        /* Special opcodes for within a field definition */
+
+        Aml.Opcode = AML_FIELD_OFFSET_OP;
+        break;
+
+    case AML_INT_ACCESSFIELD_OP:
+
+        Aml.Opcode = AML_FIELD_ACCESS_OP;
+        break;
+
+    case AML_INT_CONNECTION_OP:
+
+        Aml.Opcode = AML_FIELD_CONNECTION_OP;
+        break;
+
+    default:
+
+        Aml.Opcode = Op->Asl.AmlOpcode;
+        break;
+    }
+
+
+    switch (Aml.Opcode)
+    {
+    case AML_PACKAGE_LENGTH:
+
+        /* Value is the length to be encoded (Used in field definitions) */
+
+        PkgLen.Len = (UINT32) Op->Asl.Value.Integer;
+        break;
+
+    default:
+
+        /* Check for two-byte opcode */
+
+        if (Aml.Opcode > 0x00FF)
+        {
+            /* Write the high byte first */
+
+            CgLocalWriteAmlData (Op, &Aml.OpcodeBytes[1], 1);
+        }
+
+        CgLocalWriteAmlData (Op, &Aml.OpcodeBytes[0], 1);
+
+        /* Subtreelength doesn't include length of package length bytes */
+
+        PkgLen.Len = Op->Asl.AmlSubtreeLength + Op->Asl.AmlPkgLenBytes;
+        break;
+    }
+
+    /* Does this opcode have an associated "PackageLength" field? */
+
+    if (Op->Asl.CompileFlags & NODE_AML_PACKAGE)
+    {
+        if (Op->Asl.AmlPkgLenBytes == 1)
+        {
+            /* Simplest case -- no bytes to follow, just write the count */
+
+            CgLocalWriteAmlData (Op, &PkgLen.LenBytes[0], 1);
+        }
+        else if (Op->Asl.AmlPkgLenBytes != 0)
+        {
+            /*
+             * Encode the "bytes to follow" in the first byte, top two bits.
+             * The low-order nybble of the length is in the bottom 4 bits
+             */
+            PkgLenFirstByte = (UINT8)
+                (((UINT32) (Op->Asl.AmlPkgLenBytes - 1) << 6) |
+                (PkgLen.LenBytes[0] & 0x0F));
+
+            CgLocalWriteAmlData (Op, &PkgLenFirstByte, 1);
+
+            /*
+             * Shift the length over by the 4 bits we just stuffed
+             * in the first byte
+             */
+            PkgLen.Len >>= 4;
+
+            /*
+             * Now we can write the remaining bytes -
+             * either 1, 2, or 3 bytes
+             */
+            for (i = 0; i < (UINT32) (Op->Asl.AmlPkgLenBytes - 1); i++)
+            {
+                CgLocalWriteAmlData (Op, &PkgLen.LenBytes[i], 1);
+            }
+        }
+    }
+
+    switch (Aml.Opcode)
+    {
+    case AML_BYTE_OP:
+
+        CgLocalWriteAmlData (Op, &Op->Asl.Value.Integer, 1);
+        break;
+
+    case AML_WORD_OP:
+
+        CgLocalWriteAmlData (Op, &Op->Asl.Value.Integer, 2);
+       break;
+
+    case AML_DWORD_OP:
+
+        CgLocalWriteAmlData (Op, &Op->Asl.Value.Integer, 4);
+        break;
+
+    case AML_QWORD_OP:
+
+        CgLocalWriteAmlData (Op, &Op->Asl.Value.Integer, 8);
+        break;
+
+    case AML_STRING_OP:
+
+        CgLocalWriteAmlData (Op, Op->Asl.Value.String, Op->Asl.AmlLength);
+        break;
+
+    default:
+
+        /* All data opcodes must appear above */
+
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgWriteTableHeader
+ *
+ * PARAMETERS:  Op        - The DEFINITIONBLOCK node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write a table header corresponding to the DEFINITIONBLOCK
+ *
+ ******************************************************************************/
+
+static void
+CgWriteTableHeader (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Child;
+
+
+    /* AML filename */
+
+    Child = Op->Asl.Child;
+
+    /* Signature */
+
+    Child = Child->Asl.Next;
+    strncpy (TableHeader.Signature, Child->Asl.Value.String, 4);
+
+    /* Revision */
+
+    Child = Child->Asl.Next;
+    TableHeader.Revision = (UINT8) Child->Asl.Value.Integer;
+
+    /* Command-line Revision override */
+
+    if (Gbl_RevisionOverride)
+    {
+        TableHeader.Revision = Gbl_RevisionOverride;
+    }
+
+    /* OEMID */
+
+    Child = Child->Asl.Next;
+    strncpy (TableHeader.OemId, Child->Asl.Value.String, 6);
+
+    /* OEM TableID */
+
+    Child = Child->Asl.Next;
+    strncpy (TableHeader.OemTableId, Child->Asl.Value.String, 8);
+
+    /* OEM Revision */
+
+    Child = Child->Asl.Next;
+    TableHeader.OemRevision = (UINT32) Child->Asl.Value.Integer;
+
+    /* Compiler ID */
+
+    ACPI_MOVE_NAME (TableHeader.AslCompilerId, ASL_CREATOR_ID);
+
+    /* Compiler version */
+
+    TableHeader.AslCompilerRevision = ACPI_CA_VERSION;
+
+    /* Table length. Checksum zero for now, will rewrite later */
+
+    TableHeader.Length = sizeof (ACPI_TABLE_HEADER) +
+        Op->Asl.AmlSubtreeLength;
+    TableHeader.Checksum = 0;
+
+    Op->Asl.FinalAmlOffset = ftell (Gbl_Files[ASL_FILE_AML_OUTPUT].Handle);
+
+    /* Write entire header and clear the table header global */
+
+    CgLocalWriteAmlData (Op, &TableHeader, sizeof (ACPI_TABLE_HEADER));
+    memset (&TableHeader, 0, sizeof (ACPI_TABLE_HEADER));
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgUpdateHeader
+ *
+ * PARAMETERS:  Op                  - Op for the Definition Block
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Complete the ACPI table by calculating the checksum and
+ *              re-writing the header for the input definition block
+ *
+ ******************************************************************************/
+
+static void
+CgUpdateHeader (
+    ACPI_PARSE_OBJECT   *Op)
+{
+    signed char         Sum;
+    UINT32              i;
+    UINT32              Length;
+    UINT8               FileByte;
+    UINT8               Checksum;
+
+
+    /* Calculate the checksum over the entire definition block */
+
+    Sum = 0;
+    Length = sizeof (ACPI_TABLE_HEADER) + Op->Asl.AmlSubtreeLength;
+    FlSeekFile (ASL_FILE_AML_OUTPUT, Op->Asl.FinalAmlOffset);
+
+    for (i = 0; i < Length; i++)
+    {
+        if (FlReadFile (ASL_FILE_AML_OUTPUT, &FileByte, 1) != AE_OK)
+        {
+            printf ("EOF while reading checksum bytes\n");
+            return;
+        }
+
+        Sum = (signed char) (Sum + FileByte);
+    }
+
+    Checksum = (UINT8) (0 - Sum);
+
+    /* Re-write the the checksum byte */
+
+    FlSeekFile (ASL_FILE_AML_OUTPUT, Op->Asl.FinalAmlOffset +
+        ACPI_OFFSET (ACPI_TABLE_HEADER, Checksum));
+
+    FlWriteFile (ASL_FILE_AML_OUTPUT, &Checksum, 1);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgCloseTable
+ *
+ * PARAMETERS:  None.
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Complete the ACPI table by calculating the checksum and
+ *              re-writing each table header. This allows support for
+ *              multiple definition blocks in a single source file.
+ *
+ ******************************************************************************/
+
+static void
+CgCloseTable (
+    void)
+{
+    ACPI_PARSE_OBJECT   *Op;
+
+
+    /* Process all definition blocks */
+
+    Op = Gbl_ParseTreeRoot->Asl.Child;
+    while (Op)
+    {
+        CgUpdateHeader (Op);
+        Op = Op->Asl.Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgWriteNode
+ *
+ * PARAMETERS:  Op            - Parse node to write.
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Write the AML that corresponds to a parse node.
+ *
+ ******************************************************************************/
+
+static void
+CgWriteNode (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ASL_RESOURCE_NODE       *Rnode;
+
+
+    /* Always check for DEFAULT_ARG and other "Noop" nodes */
+    /* TBD: this may not be the best place for this check */
+
+    if ((Op->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)  ||
+        (Op->Asl.ParseOpcode == PARSEOP_INCLUDE)      ||
+        (Op->Asl.ParseOpcode == PARSEOP_INCLUDE_END))
+    {
+        return;
+    }
+
+    if ((Op->Asl.ParseOpcode == PARSEOP_EXTERNAL) &&
+        Gbl_DoExternals == FALSE)
+    {
+        return;
+    }
+
+    Op->Asl.FinalAmlLength = 0;
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_RAW_DATA_BYTE:
+    case AML_RAW_DATA_WORD:
+    case AML_RAW_DATA_DWORD:
+    case AML_RAW_DATA_QWORD:
+
+        CgLocalWriteAmlData (Op, &Op->Asl.Value.Integer, Op->Asl.AmlLength);
+        return;
+
+
+    case AML_RAW_DATA_BUFFER:
+
+        CgLocalWriteAmlData (Op, Op->Asl.Value.Buffer, Op->Asl.AmlLength);
+        return;
+
+
+    case AML_RAW_DATA_CHAIN:
+
+        Rnode = ACPI_CAST_PTR (ASL_RESOURCE_NODE, Op->Asl.Value.Buffer);
+        while (Rnode)
+        {
+            CgLocalWriteAmlData (Op, Rnode->Buffer, Rnode->BufferLength);
+            Rnode = Rnode->Next;
+        }
+        return;
+
+    default:
+
+        /* Internal data opcodes must all appear above */
+
+        break;
+    }
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_DEFAULT_ARG:
+
+        break;
+
+    case PARSEOP_DEFINITION_BLOCK:
+
+        CgWriteTableHeader (Op);
+        break;
+
+    case PARSEOP_NAMESEG:
+    case PARSEOP_NAMESTRING:
+    case PARSEOP_METHODCALL:
+
+        CgLocalWriteAmlData (Op, Op->Asl.Value.String, Op->Asl.AmlLength);
+        break;
+
+    default:
+
+        CgWriteAmlOpcode (Op);
+        break;
+    }
+}
diff --git a/usr/src/cmd/acpi/iasl/aslcompile.c b/usr/src/cmd/acpi/iasl/aslcompile.c
new file mode 100644
index 0000000000..ce070ef511
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslcompile.c
@@ -0,0 +1,867 @@
+/******************************************************************************
+ *
+ * Module Name: aslcompile - top level compile module
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+#include "acnamesp.h"
+
+#include <stdio.h>
+#include <time.h>
+#include <acapps.h>
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslcompile")
+
+/*
+ * Main parser entry
+ * External is here in case the parser emits the same external in the
+ * generated header. (Newer versions of Bison)
+ */
+int
+AslCompilerparse(
+    void);
+
+/* Local prototypes */
+
+static void
+CmFlushSourceCode (
+    void);
+
+static void
+CmDumpAllEvents (
+    void);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CmDoCompile
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status (0 = OK)
+ *
+ * DESCRIPTION: This procedure performs the entire compile
+ *
+ ******************************************************************************/
+
+int
+CmDoCompile (
+    void)
+{
+    ACPI_STATUS             Status;
+    UINT8                   FullCompile;
+    UINT8                   Event;
+
+
+    FullCompile = UtBeginEvent ("*** Total Compile time ***");
+    Event = UtBeginEvent ("Open input and output files");
+    UtEndEvent (Event);
+
+    Event = UtBeginEvent ("Preprocess input file");
+    if (Gbl_PreprocessFlag)
+    {
+        /* Enter compiler name as a #define */
+
+        PrAddDefine (ASL_DEFINE, "", FALSE);
+
+        /* Preprocessor */
+
+        PrDoPreprocess ();
+        Gbl_CurrentLineNumber = 1;
+        Gbl_LogicalLineNumber = 1;
+
+        if (Gbl_PreprocessOnly)
+        {
+            UtEndEvent (Event);
+            CmCleanupAndExit ();
+            return (0);
+        }
+    }
+    UtEndEvent (Event);
+
+
+    /* Build the parse tree */
+
+    Event = UtBeginEvent ("Parse source code and build parse tree");
+    AslCompilerparse();
+    UtEndEvent (Event);
+
+    /* Check for parser-detected syntax errors */
+
+    if (Gbl_SyntaxError)
+    {
+        fprintf (stderr,
+            "Compiler aborting due to parser-detected syntax error(s)\n");
+        LsDumpParseTree ();
+        goto ErrorExit;
+    }
+
+    /* Did the parse tree get successfully constructed? */
+
+    if (!Gbl_ParseTreeRoot)
+    {
+        /*
+         * If there are no errors, then we have some sort of
+         * internal problem.
+         */
+        AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL,
+            NULL, "- Could not resolve parse tree root node");
+
+        goto ErrorExit;
+    }
+
+    /* Flush out any remaining source after parse tree is complete */
+
+    Event = UtBeginEvent ("Flush source input");
+    CmFlushSourceCode ();
+
+    /* Prune the parse tree if requested (debug purposes only) */
+
+    if (Gbl_PruneParseTree)
+    {
+        AslPruneParseTree (Gbl_PruneDepth, Gbl_PruneType);
+    }
+
+    /* Optional parse tree dump, compiler debug output only */
+
+    LsDumpParseTree ();
+
+    OpcGetIntegerWidth (Gbl_ParseTreeRoot->Asl.Child);
+    UtEndEvent (Event);
+
+    /* Pre-process parse tree for any operator transforms */
+
+    Event = UtBeginEvent ("Parse tree transforms");
+    DbgPrint (ASL_DEBUG_OUTPUT, "\nParse tree transforms\n\n");
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_TWICE,
+        TrAmlTransformWalkBegin, TrAmlTransformWalkEnd, NULL);
+    UtEndEvent (Event);
+
+    /* Generate AML opcodes corresponding to the parse tokens */
+
+    Event = UtBeginEvent ("Generate AML opcodes");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Generating AML opcodes\n\n");
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD, NULL,
+        OpcAmlOpcodeWalk, NULL);
+    UtEndEvent (Event);
+
+    /*
+     * Now that the input is parsed, we can open the AML output file.
+     * Note: by default, the name of this file comes from the table
+     * descriptor within the input file.
+     */
+    Event = UtBeginEvent ("Open AML output file");
+    Status = FlOpenAmlOutputFile (Gbl_OutputFilenamePrefix);
+    UtEndEvent (Event);
+    if (ACPI_FAILURE (Status))
+    {
+        AePrintErrorLog (ASL_FILE_STDERR);
+        return (-1);
+    }
+
+    /* Interpret and generate all compile-time constants */
+
+    Event = UtBeginEvent ("Constant folding via AML interpreter");
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "Interpreting compile-time constant expressions\n\n");
+
+    if (Gbl_FoldConstants)
+    {
+        TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD,
+            NULL, OpcAmlConstantWalk, NULL);
+    }
+    else
+    {
+        DbgPrint (ASL_PARSE_OUTPUT, "    Optional folding disabled\n");
+    }
+    UtEndEvent (Event);
+
+    /* Update AML opcodes if necessary, after constant folding */
+
+    Event = UtBeginEvent ("Updating AML opcodes after constant folding");
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "Updating AML opcodes after constant folding\n\n");
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD,
+        NULL, OpcAmlOpcodeUpdateWalk, NULL);
+    UtEndEvent (Event);
+
+    /* Calculate all AML package lengths */
+
+    Event = UtBeginEvent ("Generate AML package lengths");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Generating Package lengths\n\n");
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD, NULL,
+        LnPackageLengthWalk, NULL);
+    UtEndEvent (Event);
+
+    if (Gbl_ParseOnlyFlag)
+    {
+        AePrintErrorLog (ASL_FILE_STDERR);
+        UtDisplaySummary (ASL_FILE_STDERR);
+        if (Gbl_DebugFlag)
+        {
+            /* Print error summary to the stdout also */
+
+            AePrintErrorLog (ASL_FILE_STDOUT);
+            UtDisplaySummary (ASL_FILE_STDOUT);
+        }
+        UtEndEvent (FullCompile);
+        return (0);
+    }
+
+    /*
+     * Create an internal namespace and use it as a symbol table
+     */
+
+    /* Namespace loading */
+
+    Event = UtBeginEvent ("Create ACPI Namespace");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Creating ACPI Namespace\n\n");
+    Status = LdLoadNamespace (Gbl_ParseTreeRoot);
+    UtEndEvent (Event);
+    if (ACPI_FAILURE (Status))
+    {
+        goto ErrorExit;
+    }
+
+    /* Namespace cross-reference */
+
+    AslGbl_NamespaceEvent = UtBeginEvent (
+        "Cross reference parse tree and Namespace");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Cross referencing namespace\n\n");
+    Status = XfCrossReferenceNamespace ();
+    if (ACPI_FAILURE (Status))
+    {
+        goto ErrorExit;
+    }
+
+    /* Namespace - Check for non-referenced objects */
+
+    LkFindUnreferencedObjects ();
+    UtEndEvent (AslGbl_NamespaceEvent);
+
+    /* Resolve External Declarations */
+
+    if (Gbl_DoExternals)
+    {
+        Event = UtBeginEvent ("Resolve all Externals");
+        DbgPrint (ASL_DEBUG_OUTPUT, "\nResolve Externals\n\n");
+        TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_TWICE,
+            ExAmlExternalWalkBegin, ExAmlExternalWalkEnd, NULL);
+        UtEndEvent (Event);
+    }
+
+    /*
+     * Semantic analysis. This can happen only after the
+     * namespace has been loaded and cross-referenced.
+     *
+     * part one - check control methods
+     */
+    Event = UtBeginEvent ("Analyze control method return types");
+    AnalysisWalkInfo.MethodStack = NULL;
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "Semantic analysis - Method analysis\n\n");
+
+    if (Gbl_CrossReferenceOutput)
+    {
+        OtPrintHeaders ("Part 1: Object Reference Map "
+            "(Object references from within each control method)");
+    }
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_TWICE,
+        MtMethodAnalysisWalkBegin,
+        MtMethodAnalysisWalkEnd, &AnalysisWalkInfo);
+    UtEndEvent (Event);
+
+    /* Generate the object cross-reference file if requested */
+
+    Event = UtBeginEvent ("Generate cross-reference file");
+    OtCreateXrefFile ();
+    UtEndEvent (Event);
+
+    /* Semantic error checking part two - typing of method returns */
+
+    Event = UtBeginEvent ("Determine object types returned by methods");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Semantic analysis - Method typing\n\n");
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD,
+        NULL, AnMethodTypingWalkEnd, NULL);
+    UtEndEvent (Event);
+
+    /* Semantic error checking part three - operand type checking */
+
+    Event = UtBeginEvent ("Analyze AML operand types");
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "Semantic analysis - Operand type checking\n\n");
+    if (Gbl_DoTypechecking)
+    {
+        TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD,
+            NULL, AnOperandTypecheckWalkEnd, &AnalysisWalkInfo);
+    }
+    UtEndEvent (Event);
+
+    /* Semantic error checking part four - other miscellaneous checks */
+
+    Event = UtBeginEvent ("Miscellaneous analysis");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Semantic analysis - miscellaneous\n\n");
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        AnOtherSemanticAnalysisWalkBegin,
+        NULL, &AnalysisWalkInfo);
+    UtEndEvent (Event);
+
+    /* Calculate all AML package lengths */
+
+    Event = UtBeginEvent ("Finish AML package length generation");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Generating Package lengths\n\n");
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD, NULL,
+        LnInitLengthsWalk, NULL);
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_UPWARD, NULL,
+        LnPackageLengthWalk, NULL);
+    UtEndEvent (Event);
+
+    /* Code generation - emit the AML */
+
+    Event = UtBeginEvent ("Generate AML code and write output files");
+    DbgPrint (ASL_DEBUG_OUTPUT, "Writing AML byte code\n\n");
+    CgGenerateAmlOutput ();
+    UtEndEvent (Event);
+
+    Event = UtBeginEvent ("Write optional output files");
+    CmDoOutputFiles ();
+    UtEndEvent (Event);
+
+    UtEndEvent (FullCompile);
+    CmCleanupAndExit ();
+    return (0);
+
+ErrorExit:
+    UtEndEvent (FullCompile);
+    CmCleanupAndExit ();
+    return (-1);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCompilerSignon
+ *
+ * PARAMETERS:  FileId      - ID of the output file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Display compiler signon
+ *
+ ******************************************************************************/
+
+void
+AslCompilerSignon (
+    UINT32                  FileId)
+{
+    char                    *Prefix = "";
+    char                    *UtilityName;
+
+
+    /* Set line prefix depending on the destination file type */
+
+    switch (FileId)
+    {
+    case ASL_FILE_ASM_SOURCE_OUTPUT:
+    case ASL_FILE_ASM_INCLUDE_OUTPUT:
+
+        Prefix = "; ";
+        break;
+
+    case ASL_FILE_HEX_OUTPUT:
+
+        if (Gbl_HexOutputFlag == HEX_OUTPUT_ASM)
+        {
+            Prefix = "; ";
+        }
+        else if ((Gbl_HexOutputFlag == HEX_OUTPUT_C) ||
+                 (Gbl_HexOutputFlag == HEX_OUTPUT_ASL))
+        {
+            FlPrintFile (ASL_FILE_HEX_OUTPUT, "/*\n");
+            Prefix = " * ";
+        }
+        break;
+
+    case ASL_FILE_C_SOURCE_OUTPUT:
+    case ASL_FILE_C_OFFSET_OUTPUT:
+    case ASL_FILE_C_INCLUDE_OUTPUT:
+
+        Prefix = " * ";
+        break;
+
+    default:
+
+        /* No other output types supported */
+
+        break;
+    }
+
+    /* Running compiler or disassembler? */
+
+    if (Gbl_DisasmFlag)
+    {
+        UtilityName = AML_DISASSEMBLER_NAME;
+    }
+    else
+    {
+        UtilityName = ASL_COMPILER_NAME;
+    }
+
+    /* Compiler signon with copyright */
+
+    FlPrintFile (FileId, "%s\n", Prefix);
+    FlPrintFile (FileId, ACPI_COMMON_HEADER (UtilityName, Prefix));
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCompilerFileHeader
+ *
+ * PARAMETERS:  FileId      - ID of the output file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Header used at the beginning of output files
+ *
+ ******************************************************************************/
+
+void
+AslCompilerFileHeader (
+    UINT32                  FileId)
+{
+    struct tm               *NewTime;
+    time_t                  Aclock;
+    char                    *Prefix = "";
+
+
+    /* Set line prefix depending on the destination file type */
+
+    switch (FileId)
+    {
+    case ASL_FILE_ASM_SOURCE_OUTPUT:
+    case ASL_FILE_ASM_INCLUDE_OUTPUT:
+
+        Prefix = "; ";
+        break;
+
+    case ASL_FILE_HEX_OUTPUT:
+
+        if (Gbl_HexOutputFlag == HEX_OUTPUT_ASM)
+        {
+            Prefix = "; ";
+        }
+        else if ((Gbl_HexOutputFlag == HEX_OUTPUT_C) ||
+                 (Gbl_HexOutputFlag == HEX_OUTPUT_ASL))
+        {
+            Prefix = " * ";
+        }
+        break;
+
+    case ASL_FILE_C_SOURCE_OUTPUT:
+    case ASL_FILE_C_OFFSET_OUTPUT:
+    case ASL_FILE_C_INCLUDE_OUTPUT:
+
+        Prefix = " * ";
+        break;
+
+    default:
+
+        /* No other output types supported */
+
+        break;
+    }
+
+    /* Compilation header with timestamp */
+
+    (void) time (&Aclock);
+    NewTime = localtime (&Aclock);
+
+    FlPrintFile (FileId,
+        "%sCompilation of \"%s\" - %s%s\n",
+        Prefix, Gbl_Files[ASL_FILE_INPUT].Filename, asctime (NewTime),
+        Prefix);
+
+    switch (FileId)
+    {
+    case ASL_FILE_C_SOURCE_OUTPUT:
+    case ASL_FILE_C_OFFSET_OUTPUT:
+    case ASL_FILE_C_INCLUDE_OUTPUT:
+
+        FlPrintFile (FileId, " */\n");
+        break;
+
+    default:
+
+        /* Nothing to do for other output types */
+
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CmFlushSourceCode
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Read in any remaining source code after the parse tree
+ *              has been constructed.
+ *
+ ******************************************************************************/
+
+static void
+CmFlushSourceCode (
+    void)
+{
+    char                    Buffer;
+
+
+    while (FlReadFile (ASL_FILE_INPUT, &Buffer, 1) != AE_ERROR)
+    {
+        AslInsertLineBuffer ((int) Buffer);
+    }
+
+    AslResetCurrentLineBuffer ();
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CmDoOutputFiles
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Create all "listing" type files
+ *
+ ******************************************************************************/
+
+void
+CmDoOutputFiles (
+    void)
+{
+
+    /* Create listings and hex files */
+
+    LsDoListings ();
+    HxDoHexOutput ();
+
+    /* Dump the namespace to the .nsp file if requested */
+
+    (void) NsDisplayNamespace ();
+
+    /* Dump the device mapping file */
+
+    MpEmitMappingInfo ();
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CmDumpAllEvents
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Dump all compiler events
+ *
+ ******************************************************************************/
+
+static void
+CmDumpAllEvents (
+    void)
+{
+    ASL_EVENT_INFO          *Event;
+    UINT32                  Delta;
+    UINT32                  MicroSeconds;
+    UINT32                  MilliSeconds;
+    UINT32                  i;
+
+
+    Event = AslGbl_Events;
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "\n\nElapsed time for major events\n\n");
+    if (Gbl_CompileTimesFlag)
+    {
+        printf ("\nElapsed time for major events\n\n");
+    }
+
+    for (i = 0; i < AslGbl_NextEvent; i++)
+    {
+        if (Event->Valid)
+        {
+            /* Delta will be in 100-nanosecond units */
+
+            Delta = (UINT32) (Event->EndTime - Event->StartTime);
+
+            MicroSeconds = Delta / ACPI_100NSEC_PER_USEC;
+            MilliSeconds = Delta / ACPI_100NSEC_PER_MSEC;
+
+            /* Round milliseconds up */
+
+            if ((MicroSeconds - (MilliSeconds * ACPI_USEC_PER_MSEC)) >= 500)
+            {
+                MilliSeconds++;
+            }
+
+            DbgPrint (ASL_DEBUG_OUTPUT, "%8u usec %8u msec - %s\n",
+                MicroSeconds, MilliSeconds, Event->EventName);
+
+            if (Gbl_CompileTimesFlag)
+            {
+                printf ("%8u usec %8u msec - %s\n",
+                    MicroSeconds, MilliSeconds, Event->EventName);
+            }
+        }
+
+        Event++;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CmCleanupAndExit
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Close all open files and exit the compiler
+ *
+ ******************************************************************************/
+
+void
+CmCleanupAndExit (
+    void)
+{
+    UINT32                  i;
+    BOOLEAN                 DeleteAmlFile = FALSE;
+
+
+    AePrintErrorLog (ASL_FILE_STDERR);
+    if (Gbl_DebugFlag)
+    {
+        /* Print error summary to stdout also */
+
+        AePrintErrorLog (ASL_FILE_STDOUT);
+    }
+
+    /* Emit compile times if enabled */
+
+    CmDumpAllEvents ();
+
+    if (Gbl_CompileTimesFlag)
+    {
+        printf ("\nMiscellaneous compile statistics\n\n");
+        printf ("%11u : %s\n", TotalParseNodes, "Parse nodes");
+        printf ("%11u : %s\n", Gbl_NsLookupCount, "Namespace searches");
+        printf ("%11u : %s\n", TotalNamedObjects, "Named objects");
+        printf ("%11u : %s\n", TotalMethods, "Control methods");
+        printf ("%11u : %s\n", TotalAllocations, "Memory Allocations");
+        printf ("%11u : %s\n", TotalAllocated, "Total allocated memory");
+        printf ("%11u : %s\n", TotalFolds, "Constant subtrees folded");
+        printf ("\n");
+    }
+
+    if (Gbl_NsLookupCount)
+    {
+        DbgPrint (ASL_DEBUG_OUTPUT,
+            "\n\nMiscellaneous compile statistics\n\n");
+
+        DbgPrint (ASL_DEBUG_OUTPUT,
+            "%32s : %u\n", "Total Namespace searches",
+            Gbl_NsLookupCount);
+
+        DbgPrint (ASL_DEBUG_OUTPUT,
+            "%32s : %u usec\n", "Time per search", ((UINT32)
+            (AslGbl_Events[AslGbl_NamespaceEvent].EndTime -
+                AslGbl_Events[AslGbl_NamespaceEvent].StartTime) / 10) /
+                Gbl_NsLookupCount);
+    }
+
+    if (Gbl_ExceptionCount[ASL_ERROR] > ASL_MAX_ERROR_COUNT)
+    {
+        printf ("\nMaximum error count (%u) exceeded\n",
+            ASL_MAX_ERROR_COUNT);
+    }
+
+    UtDisplaySummary (ASL_FILE_STDOUT);
+
+    /*
+     * We will delete the AML file if there are errors and the
+     * force AML output option has not been used.
+     */
+    if ((Gbl_ExceptionCount[ASL_ERROR] > 0) &&
+        (!Gbl_IgnoreErrors) &&
+        Gbl_Files[ASL_FILE_AML_OUTPUT].Handle)
+    {
+        DeleteAmlFile = TRUE;
+    }
+
+    /* Close all open files */
+
+    /*
+     * Take care with the preprocessor file (.pre), it might be the same
+     * as the "input" file, depending on where the compiler has terminated
+     * or aborted. Prevent attempt to close the same file twice in
+     * loop below.
+     */
+    if (Gbl_Files[ASL_FILE_PREPROCESSOR].Handle ==
+        Gbl_Files[ASL_FILE_INPUT].Handle)
+    {
+        Gbl_Files[ASL_FILE_PREPROCESSOR].Handle = NULL;
+    }
+
+    /* Close the standard I/O files */
+
+    for (i = ASL_FILE_INPUT; i < ASL_MAX_FILE_TYPE; i++)
+    {
+        FlCloseFile (i);
+    }
+
+    /* Delete AML file if there are errors */
+
+    if (DeleteAmlFile)
+    {
+        FlDeleteFile (ASL_FILE_AML_OUTPUT);
+    }
+
+    /* Delete the preprocessor temp file unless full debug was specified */
+
+    if (Gbl_PreprocessFlag && !Gbl_KeepPreprocessorTempFile)
+    {
+        FlDeleteFile (ASL_FILE_PREPROCESSOR);
+    }
+
+    /*
+     * Delete intermediate ("combined") source file (if -ls flag not set)
+     * This file is created during normal ASL/AML compiles. It is not
+     * created by the data table compiler.
+     *
+     * If the -ls flag is set, then the .SRC file should not be deleted.
+     * In this case, Gbl_SourceOutputFlag is set to TRUE.
+     *
+     * Note: Handles are cleared by FlCloseFile above, so we look at the
+     * filename instead, to determine if the .SRC file was actually
+     * created.
+     */
+    if (!Gbl_SourceOutputFlag)
+    {
+        FlDeleteFile (ASL_FILE_SOURCE_OUTPUT);
+    }
+
+    /* Final cleanup after compiling one file */
+
+    CmDeleteCaches ();
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CmDeleteCaches
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Delete all local cache buffer blocks
+ *
+ ******************************************************************************/
+
+void
+CmDeleteCaches (
+    void)
+{
+    UINT32                  BufferCount;
+    ASL_CACHE_INFO          *Next;
+
+
+    /* Parse Op cache */
+
+    BufferCount = 0;
+    while (Gbl_ParseOpCacheList)
+    {
+        Next = Gbl_ParseOpCacheList->Next;
+        ACPI_FREE (Gbl_ParseOpCacheList);
+        Gbl_ParseOpCacheList = Next;
+        BufferCount++;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "%u ParseOps, Buffer size: %u ops (%u bytes), %u Buffers\n",
+        Gbl_ParseOpCount, ASL_PARSEOP_CACHE_SIZE,
+        (sizeof (ACPI_PARSE_OBJECT) * ASL_PARSEOP_CACHE_SIZE), BufferCount);
+
+    Gbl_ParseOpCount = 0;
+    Gbl_ParseOpCacheNext = NULL;
+    Gbl_ParseOpCacheLast = NULL;
+    Gbl_ParseTreeRoot = NULL;
+
+    /* Generic string cache */
+
+    BufferCount = 0;
+    while (Gbl_StringCacheList)
+    {
+        Next = Gbl_StringCacheList->Next;
+        ACPI_FREE (Gbl_StringCacheList);
+        Gbl_StringCacheList = Next;
+        BufferCount++;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "%u Strings (%u bytes), Buffer size: %u bytes, %u Buffers\n",
+        Gbl_StringCount, Gbl_StringSize, ASL_STRING_CACHE_SIZE, BufferCount);
+
+    Gbl_StringSize = 0;
+    Gbl_StringCount = 0;
+    Gbl_StringCacheNext = NULL;
+    Gbl_StringCacheLast = NULL;
+}
diff --git a/usr/src/cmd/acpi/iasl/aslcompiler.h b/usr/src/cmd/acpi/iasl/aslcompiler.h
new file mode 100644
index 0000000000..b34686325f
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslcompiler.h
@@ -0,0 +1,1359 @@
+/******************************************************************************
+ *
+ * Module Name: aslcompiler.h - common include file for iASL
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#ifndef __ASLCOMPILER_H
+#define __ASLCOMPILER_H
+
+#include "acpi.h"
+#include "accommon.h"
+#include "amlresrc.h"
+#include "acdebug.h"
+
+/* Microsoft-specific */
+
+#if (defined WIN32 || defined WIN64)
+
+/* warn : used #pragma pack */
+#pragma warning(disable:4103)
+
+/* warn : named type definition in parentheses */
+#pragma warning(disable:4115)
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <errno.h>
+#include <ctype.h>
+
+/* Compiler headers */
+
+#include "asldefine.h"
+#include "asltypes.h"
+#include "aslmessages.h"
+#include "aslglobal.h"
+#include "preprocess.h"
+
+
+/*******************************************************************************
+ *
+ * Compiler prototypes
+ *
+ ******************************************************************************/
+
+/*
+ * Main ASL parser - generated from flex/bison, lex/yacc, etc.
+ */
+ACPI_PARSE_OBJECT *
+AslDoError (
+    void);
+
+int
+AslCompilerlex(
+    void);
+
+void
+AslResetCurrentLineBuffer (
+    void);
+
+void
+AslInsertLineBuffer (
+    int                     SourceChar);
+
+int
+AslPopInputFileStack (
+    void);
+
+void
+AslPushInputFileStack (
+    FILE                    *InputFile,
+    char                    *Filename);
+
+void
+AslParserCleanup (
+    void);
+
+
+/*
+ * aslstartup - entered from main()
+ */
+void
+AslInitializeGlobals (
+    void);
+
+typedef
+ACPI_STATUS (*ASL_PATHNAME_CALLBACK) (
+    char *);
+
+ACPI_STATUS
+AslDoOneFile (
+    char                    *Filename);
+
+ACPI_STATUS
+AslCheckForErrorExit (
+    void);
+
+
+/*
+ * aslcompile - compile mainline
+ */
+void
+AslCompilerSignon (
+    UINT32                  FileId);
+
+void
+AslCompilerFileHeader (
+    UINT32                  FileId);
+
+int
+CmDoCompile (
+    void);
+
+void
+CmDoOutputFiles (
+    void);
+
+void
+CmCleanupAndExit (
+    void);
+
+void
+CmDeleteCaches (
+    void);
+
+
+/*
+ * aslascii - ascii support
+ */
+ACPI_STATUS
+FlIsFileAsciiSource (
+    char                    *Filename,
+    BOOLEAN                 DisplayErrors);
+
+
+/*
+ * aslwalks - semantic analysis and parse tree walks
+ */
+ACPI_STATUS
+AnOtherSemanticAnalysisWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+AnOtherSemanticAnalysisWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+AnOperandTypecheckWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+AnMethodTypingWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*
+ * aslmethod - Control method analysis walk
+ */
+ACPI_STATUS
+MtMethodAnalysisWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+MtMethodAnalysisWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*
+ * aslbtypes - bitfield data types
+ */
+UINT32
+AnMapObjTypeToBtype (
+    ACPI_PARSE_OBJECT       *Op);
+
+UINT32
+AnMapArgTypeToBtype (
+    UINT32                  ArgType);
+
+UINT32
+AnGetBtype (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+AnFormatBtype (
+    char                    *Buffer,
+    UINT32                  Btype);
+
+
+/*
+ * aslanalyze - Support functions for parse tree walks
+ */
+void
+AnCheckId (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_NAME               Type);
+
+/* Values for Type argument above */
+
+#define ASL_TYPE_HID        0
+#define ASL_TYPE_CID        1
+
+BOOLEAN
+AnIsInternalMethod (
+    ACPI_PARSE_OBJECT       *Op);
+
+UINT32
+AnGetInternalMethodReturnType (
+    ACPI_PARSE_OBJECT       *Op);
+
+BOOLEAN
+AnLastStatementIsReturn (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+AnCheckMethodReturnValue (
+    ACPI_PARSE_OBJECT       *Op,
+    const ACPI_OPCODE_INFO  *OpInfo,
+    ACPI_PARSE_OBJECT       *ArgOp,
+    UINT32                  RequiredBtypes,
+    UINT32                  ThisNodeBtype);
+
+BOOLEAN
+AnIsResultUsed (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+ApCheckForGpeNameConflict (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+ApCheckRegMethod (
+    ACPI_PARSE_OBJECT       *Op);
+
+BOOLEAN
+ApFindNameInScope (
+    char                    *Name,
+    ACPI_PARSE_OBJECT       *Op);
+
+BOOLEAN
+ApFindNameInDeviceTree (
+    char                    *Name,
+    ACPI_PARSE_OBJECT       *Op);
+
+/*
+ * aslerror - error handling/reporting
+ */
+void
+AslAbort (
+    void);
+
+void
+AslError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *ExtraMessage);
+
+ACPI_STATUS
+AslDisableException (
+    char                    *MessageIdString);
+
+BOOLEAN
+AslIsExceptionDisabled (
+    UINT8                   Level,
+    UINT16                  MessageId);
+
+void
+AslCoreSubsystemError (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_STATUS             Status,
+    char                    *ExtraMessage,
+    BOOLEAN                 Abort);
+
+int
+AslCompilererror(
+    const char              *s);
+
+void
+AslCommonError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    UINT32                  CurrentLineNumber,
+    UINT32                  LogicalLineNumber,
+    UINT32                  LogicalByteOffset,
+    UINT32                  Column,
+    char                    *Filename,
+    char                    *ExtraMessage);
+
+void
+AslCommonError2 (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    UINT32                  LineNumber,
+    UINT32                  Column,
+    char                    *SourceLine,
+    char                    *Filename,
+    char                    *ExtraMessage);
+
+void
+AePrintException (
+    UINT32                  FileId,
+    ASL_ERROR_MSG           *Enode,
+    char                    *Header);
+
+void
+AePrintErrorLog (
+    UINT32                  FileId);
+
+void
+AeClearErrorLog (
+    void);
+
+
+/*
+ * asllisting - generate all "listing" type files
+ */
+void
+LsDoListings (
+    void);
+
+void
+LsWriteNodeToAsmListing (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+LsWriteNode (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  FileId);
+
+void
+LsDumpParseTree (
+    void);
+
+
+/*
+ * asllistsup - Listing file support utilities
+ */
+void
+LsDumpAscii (
+    UINT32                  FileId,
+    UINT32                  Count,
+    UINT8                   *Buffer);
+
+void
+LsDumpAsciiInComment (
+    UINT32                  FileId,
+    UINT32                  Count,
+    UINT8                   *Buffer);
+
+void
+LsCheckException (
+    UINT32                  LineNumber,
+    UINT32                  FileId);
+
+void
+LsFlushListingBuffer (
+    UINT32                  FileId);
+
+void
+LsWriteListingHexBytes (
+    UINT8                   *Buffer,
+    UINT32                  Length,
+    UINT32                  FileId);
+
+void
+LsWriteSourceLines (
+    UINT32                  ToLineNumber,
+    UINT32                  ToLogicalLineNumber,
+    UINT32                  FileId);
+
+UINT32
+LsWriteOneSourceLine (
+    UINT32                  FileId);
+
+void
+LsPushNode (
+    char                    *Filename);
+
+ASL_LISTING_NODE *
+LsPopNode (
+    void);
+
+
+/*
+ * aslhex - generate all "hex" output files (C, ASM, ASL)
+ */
+void
+HxDoHexOutput (
+    void);
+
+
+/*
+ * aslfold - constant folding
+ */
+ACPI_STATUS
+OpcAmlConstantWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*
+ * aslmessages - exception strings
+ */
+const char *
+AeDecodeMessageId (
+    UINT16                  MessageId);
+
+const char *
+AeDecodeExceptionLevel (
+    UINT8                   Level);
+
+UINT16
+AeBuildFullExceptionCode (
+    UINT8                   Level,
+    UINT16                  MessageId);
+
+/*
+ * asloffset - generate C offset file for BIOS support
+ */
+ACPI_STATUS
+LsAmlOffsetWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+void
+LsDoOffsetTableHeader (
+    UINT32                  FileId);
+
+void
+LsDoOffsetTableFooter (
+    UINT32                  FileId);
+
+
+/*
+ * aslopcodes - generate AML opcodes
+ */
+ACPI_STATUS
+OpcAmlOpcodeWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+OpcAmlOpcodeUpdateWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+void
+OpcGenerateAmlOpcode (
+    ACPI_PARSE_OBJECT       *Op);
+
+UINT32
+OpcSetOptimalIntegerSize (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+OpcGetIntegerWidth (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*
+ * asloperands - generate AML operands for the AML opcodes
+ */
+ACPI_PARSE_OBJECT  *
+UtGetArg (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Argn);
+
+void
+OpnGenerateAmlOperands (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+OpnDoPackage (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*
+ * aslopt - optmization
+ */
+void
+OptOptimizeNamePath (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Flags,
+    ACPI_WALK_STATE         *WalkState,
+    char                    *AmlNameString,
+    ACPI_NAMESPACE_NODE     *TargetNode);
+
+
+/*
+ * aslpld - ToPLD macro support
+ */
+void
+OpcDoPld (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*
+ * aslprintf - Printf/Fprintf macros
+ */
+void
+OpcDoPrintf (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+OpcDoFprintf (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*
+ * aslprune - parse tree pruner
+ */
+void
+AslPruneParseTree (
+    UINT32                  PruneDepth,
+    UINT32                  Type);
+
+
+/*
+ * aslcodegen - code generation
+ */
+void
+CgGenerateAmlOutput (
+    void);
+
+
+/*
+ * aslfile
+ */
+void
+FlOpenFile (
+    UINT32                  FileId,
+    char                    *Filename,
+    char                    *Mode);
+
+
+/*
+ * asllength - calculate/adjust AML package lengths
+ */
+ACPI_STATUS
+LnPackageLengthWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+LnInitLengthsWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+void
+CgGenerateAmlLengths (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*
+ * aslmap - opcode mappings and reserved method names
+ */
+ACPI_OBJECT_TYPE
+AslMapNamedOpcodeToDataType (
+    UINT16                  Opcode);
+
+
+/*
+ * aslpredef - ACPI predefined names support
+ */
+BOOLEAN
+ApCheckForPredefinedMethod (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo);
+
+void
+ApCheckPredefinedReturnValue (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo);
+
+UINT32
+ApCheckForPredefinedName (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name);
+
+void
+ApCheckForPredefinedObject (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name);
+
+ACPI_STATUS
+ApCheckObjectType (
+    const char              *PredefinedName,
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  ExpectedBtypes,
+    UINT32                  PackageIndex);
+
+void
+ApDisplayReservedNames (
+    void);
+
+
+/*
+ * aslprepkg - ACPI predefined names support for packages
+ */
+void
+ApCheckPackage (
+    ACPI_PARSE_OBJECT           *ParentOp,
+    const ACPI_PREDEFINED_INFO  *Predefined);
+
+
+/*
+ * asltransform - parse tree transformations
+ */
+ACPI_STATUS
+TrAmlTransformWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+TrAmlTransformWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*
+ * asltree - parse tree support
+ */
+ACPI_STATUS
+TrWalkParseTree (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Visitation,
+    ASL_WALK_CALLBACK       DescendingCallback,
+    ASL_WALK_CALLBACK       AscendingCallback,
+    void                    *Context);
+
+/*
+ * aslexternal - External opcode support
+ */
+ACPI_STATUS
+ExAmlExternalWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+ACPI_STATUS
+ExAmlExternalWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+void
+ExDoExternal (
+    ACPI_PARSE_OBJECT       *Op);
+
+/* Values for "Visitation" parameter above */
+
+#define ASL_WALK_VISIT_DOWNWARD     0x01
+#define ASL_WALK_VISIT_UPWARD       0x02
+#define ASL_WALK_VISIT_TWICE        (ASL_WALK_VISIT_DOWNWARD | ASL_WALK_VISIT_UPWARD)
+
+
+void
+TrSetParent (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *ParentOp);
+
+ACPI_PARSE_OBJECT *
+TrAllocateNode (
+    UINT32                  ParseOpcode);
+
+void
+TrPrintNodeCompileFlags (
+    UINT32                  Flags);
+
+void
+TrReleaseNode (
+    ACPI_PARSE_OBJECT       *Op);
+
+ACPI_PARSE_OBJECT *
+TrUpdateNode (
+    UINT32                  ParseOpcode,
+    ACPI_PARSE_OBJECT       *Op);
+
+ACPI_PARSE_OBJECT *
+TrCreateNode (
+    UINT32                  ParseOpcode,
+    UINT32                  NumChildren,
+    ...);
+
+ACPI_PARSE_OBJECT *
+TrCreateLeafNode (
+    UINT32                  ParseOpcode);
+
+ACPI_PARSE_OBJECT *
+TrCreateNullTarget (
+    void);
+
+ACPI_PARSE_OBJECT *
+TrCreateAssignmentNode (
+    ACPI_PARSE_OBJECT       *Target,
+    ACPI_PARSE_OBJECT       *Source);
+
+ACPI_PARSE_OBJECT *
+TrCreateTargetOperand (
+    ACPI_PARSE_OBJECT       *OriginalOp,
+    ACPI_PARSE_OBJECT       *ParentOp);
+
+ACPI_PARSE_OBJECT *
+TrCreateValuedLeafNode (
+    UINT32                  ParseOpcode,
+    UINT64                  Value);
+
+ACPI_PARSE_OBJECT *
+TrCreateConstantLeafNode (
+    UINT32                  ParseOpcode);
+
+ACPI_PARSE_OBJECT *
+TrLinkChildren (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  NumChildren,
+    ...);
+
+void
+TrSetEndLineNumber (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+TrSetCurrentFilename (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+TrWalkTree (
+    void);
+
+ACPI_PARSE_OBJECT *
+TrLinkPeerNode (
+    ACPI_PARSE_OBJECT       *Op1,
+    ACPI_PARSE_OBJECT       *Op2);
+
+ACPI_PARSE_OBJECT *
+TrLinkChildNode (
+    ACPI_PARSE_OBJECT       *Op1,
+    ACPI_PARSE_OBJECT       *Op2);
+
+ACPI_PARSE_OBJECT *
+TrSetNodeFlags (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Flags);
+
+ACPI_PARSE_OBJECT *
+TrSetNodeAmlLength (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Length);
+
+ACPI_PARSE_OBJECT *
+TrLinkPeerNodes (
+    UINT32                  NumPeers,
+    ...);
+
+
+/*
+ * aslfiles - File I/O support
+ */
+void
+FlAddIncludeDirectory (
+    char                    *Dir);
+
+char *
+FlMergePathnames (
+    char                    *PrefixDir,
+    char                    *FilePathname);
+
+void
+FlOpenIncludeFile (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+FlFileError (
+    UINT32                  FileId,
+    UINT8                   ErrorId);
+
+UINT32
+FlGetFileSize (
+    UINT32                  FileId);
+
+ACPI_STATUS
+FlReadFile (
+    UINT32                  FileId,
+    void                    *Buffer,
+    UINT32                  Length);
+
+void
+FlWriteFile (
+    UINT32                  FileId,
+    void                    *Buffer,
+    UINT32                  Length);
+
+void
+FlSeekFile (
+    UINT32                  FileId,
+    long                    Offset);
+
+void
+FlCloseFile (
+    UINT32                  FileId);
+
+void
+FlPrintFile (
+    UINT32                  FileId,
+    char                    *Format,
+    ...);
+
+void
+FlDeleteFile (
+    UINT32                  FileId);
+
+void
+FlSetLineNumber (
+    UINT32                  LineNumber);
+
+void
+FlSetFilename (
+    char                    *Filename);
+
+ACPI_STATUS
+FlOpenInputFile (
+    char                    *InputFilename);
+
+ACPI_STATUS
+FlOpenAmlOutputFile (
+    char                    *InputFilename);
+
+ACPI_STATUS
+FlOpenMiscOutputFiles (
+    char                    *InputFilename);
+
+/*
+ * aslhwmap - hardware map summary
+ */
+void
+MpEmitMappingInfo (
+    void);
+
+
+/*
+ * asload - load namespace in prep for cross reference
+ */
+ACPI_STATUS
+LdLoadNamespace (
+    ACPI_PARSE_OBJECT       *RootOp);
+
+
+/*
+ * asllookup - namespace lookup functions
+ */
+void
+LkFindUnreferencedObjects (
+    void);
+
+/*
+ * aslmain - startup
+ */
+void
+Usage (
+    void);
+
+void
+AslFilenameHelp (
+    void);
+
+
+/*
+ * aslnamesp - namespace output file generation
+ */
+ACPI_STATUS
+NsDisplayNamespace (
+    void);
+
+void
+NsSetupNamespaceListing (
+    void                    *Handle);
+
+/*
+ * asloptions - command line processing
+ */
+int
+AslCommandLine (
+    int                     argc,
+    char                    **argv);
+
+/*
+ * aslxref - namespace cross reference
+ */
+ACPI_STATUS
+XfCrossReferenceNamespace (
+    void);
+
+
+/*
+ * aslxrefout
+ */
+void
+OtPrintHeaders (
+    char                    *Message);
+
+void
+OtCreateXrefFile (
+    void);
+
+void
+OtXrefWalkPart1 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    ASL_METHOD_INFO         *MethodInfo);
+
+
+/*
+ * aslutils - common compiler utilites
+ */
+void
+DbgPrint (
+    UINT32                  Type,
+    char                    *Format,
+    ...);
+
+/* Type values for above */
+
+#define ASL_DEBUG_OUTPUT    0
+#define ASL_PARSE_OUTPUT    1
+#define ASL_TREE_OUTPUT     2
+
+UINT8
+UtIsBigEndianMachine (
+    void);
+
+BOOLEAN
+UtQueryForOverwrite (
+    char                    *Pathname);
+
+void
+UtDumpStringOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level);
+
+void
+UtDumpIntegerOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    UINT32                  IntegerLength);
+
+void
+UtDumpBasicOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level);
+
+void
+UtDisplaySupportedTables (
+    void);
+
+void
+UtDisplayConstantOpcodes (
+    void);
+
+UINT8
+UtBeginEvent (
+    char                    *Name);
+
+void
+UtEndEvent (
+    UINT8                   Event);
+
+void *
+UtLocalCalloc (
+    UINT32                  Size);
+
+void
+UtDisplaySummary (
+    UINT32                  FileId);
+
+void
+UtConvertByteToHex (
+    UINT8                   RawByte,
+    UINT8                   *Buffer);
+
+void
+UtConvertByteToAsmHex (
+    UINT8                   RawByte,
+    UINT8                   *Buffer);
+
+char *
+UtGetOpName (
+    UINT32                  ParseOpcode);
+
+void
+UtSetParseOpName (
+    ACPI_PARSE_OBJECT       *Op);
+
+char *
+UtStringCacheCalloc (
+    UINT32                  Length);
+
+void
+UtExpandLineBuffers (
+    void);
+
+void
+UtFreeLineBuffers (
+    void);
+
+ACPI_STATUS
+UtInternalizeName (
+    char                    *ExternalName,
+    char                    **ConvertedName);
+
+void
+UtAttachNamepathToOwner (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *NameNode);
+
+ACPI_PARSE_OBJECT *
+UtCheckIntegerRange (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  LowValue,
+    UINT32                  HighValue);
+
+UINT64
+UtDoConstant (
+    char                    *String);
+
+
+/*
+ * asluuid - UUID support
+ */
+ACPI_STATUS
+AuValidateUuid (
+    char                    *InString);
+
+ACPI_STATUS
+AuConvertUuidToString (
+    char                    *UuIdBuffer,
+    char                    *OutString);
+
+/*
+ * aslresource - Resource template generation utilities
+ */
+void
+RsSmallAddressCheck (
+    UINT8                   Type,
+    UINT32                  Minimum,
+    UINT32                  Maximum,
+    UINT32                  Length,
+    UINT32                  Alignment,
+    ACPI_PARSE_OBJECT       *MinOp,
+    ACPI_PARSE_OBJECT       *MaxOp,
+    ACPI_PARSE_OBJECT       *LengthOp,
+    ACPI_PARSE_OBJECT       *AlignOp,
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+RsLargeAddressCheck (
+    UINT64                  Minimum,
+    UINT64                  Maximum,
+    UINT64                  Length,
+    UINT64                  Granularity,
+    UINT8                   Flags,
+    ACPI_PARSE_OBJECT       *MinOp,
+    ACPI_PARSE_OBJECT       *MaxOp,
+    ACPI_PARSE_OBJECT       *LengthOp,
+    ACPI_PARSE_OBJECT       *GranOp,
+    ACPI_PARSE_OBJECT       *Op);
+
+UINT16
+RsGetStringDataLength (
+    ACPI_PARSE_OBJECT       *InitializerOp);
+
+ASL_RESOURCE_NODE *
+RsAllocateResourceNode (
+    UINT32                  Size);
+
+void
+RsCreateResourceField (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name,
+    UINT32                  ByteOffset,
+    UINT32                  BitOffset,
+    UINT32                  BitLength);
+
+void
+RsSetFlagBits (
+    UINT8                   *Flags,
+    ACPI_PARSE_OBJECT       *Op,
+    UINT8                   Position,
+    UINT8                   DefaultBit);
+
+void
+RsSetFlagBits16 (
+    UINT16                  *Flags,
+    ACPI_PARSE_OBJECT       *Op,
+    UINT8                   Position,
+    UINT8                   DefaultBit);
+
+ACPI_PARSE_OBJECT *
+RsCompleteNodeAndGetNext (
+    ACPI_PARSE_OBJECT       *Op);
+
+void
+RsCheckListForDuplicates (
+    ACPI_PARSE_OBJECT       *Op);
+
+ASL_RESOURCE_NODE *
+RsDoOneResourceDescriptor (
+    ASL_RESOURCE_INFO       *Info,
+    UINT8                   *State);
+
+/* Values for State above */
+
+#define ACPI_RSTATE_NORMAL              0
+#define ACPI_RSTATE_START_DEPENDENT     1
+#define ACPI_RSTATE_DEPENDENT_LIST      2
+
+UINT32
+RsLinkDescriptorChain (
+    ASL_RESOURCE_NODE       **PreviousRnode,
+    ASL_RESOURCE_NODE       *Rnode);
+
+void
+RsDoResourceTemplate (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*
+ * aslrestype1 - Miscellaneous Small descriptors
+ */
+ASL_RESOURCE_NODE *
+RsDoEndTagDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoEndDependentDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoMemory24Descriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoMemory32Descriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoMemory32FixedDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoStartDependentDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoStartDependentNoPriDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoVendorSmallDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+
+/*
+ * aslrestype1i - I/O-related Small descriptors
+ */
+ASL_RESOURCE_NODE *
+RsDoDmaDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoFixedDmaDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoFixedIoDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoIoDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoIrqDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoIrqNoFlagsDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+
+/*
+ * aslrestype2 - Large resource descriptors
+ */
+ASL_RESOURCE_NODE *
+RsDoInterruptDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoVendorLargeDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoGeneralRegisterDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoGpioIntDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoGpioIoDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoI2cSerialBusDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoSpiSerialBusDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoUartSerialBusDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+/*
+ * aslrestype2d - DWord address descriptors
+ */
+ASL_RESOURCE_NODE *
+RsDoDwordIoDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoDwordMemoryDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoDwordSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+
+/*
+ * aslrestype2e - Extended address descriptors
+ */
+ASL_RESOURCE_NODE *
+RsDoExtendedIoDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoExtendedMemoryDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoExtendedSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+
+/*
+ * aslrestype2q - QWord address descriptors
+ */
+ASL_RESOURCE_NODE *
+RsDoQwordIoDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoQwordMemoryDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoQwordSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+
+/*
+ * aslrestype2w - Word address descriptors
+ */
+ASL_RESOURCE_NODE *
+RsDoWordIoDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoWordSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+ASL_RESOURCE_NODE *
+RsDoWordBusNumberDescriptor (
+    ASL_RESOURCE_INFO       *Info);
+
+
+/*
+ * Entry to data table compiler subsystem
+ */
+ACPI_STATUS
+DtDoCompile(
+    void);
+
+ACPI_STATUS
+DtCreateTemplates (
+    char                    **argv);
+
+#endif /*  __ASLCOMPILER_H */
diff --git a/usr/src/cmd/acpi/iasl/aslcompiler.l b/usr/src/cmd/acpi/iasl/aslcompiler.l
new file mode 100644
index 0000000000..15c9dae0d1
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslcompiler.l
@@ -0,0 +1,749 @@
+%{
+/******************************************************************************
+ *
+ * Module Name: aslcompiler.l - Flex/lex input file
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#include <stdlib.h>
+#include <string.h>
+YYSTYPE AslCompilerlval;
+
+/*
+ * Generation:  Use the following command line:
+ *
+ * flex.exe -PAslCompiler -i -o$(InputPath).c $(InputPath)
+ *
+ * -i: Scanner must be case-insensitive
+ */
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslscanner")
+
+
+/* Local prototypes */
+
+static void
+AslDoLineDirective (void);
+
+static char
+AslDoComment (void);
+
+static char
+AslDoCommentType2 (void);
+
+static char
+AslDoStringLiteral (void);
+
+static void
+count (int type);
+
+
+/*! [Begin] no source code translation */
+
+%}
+    /* Definitions */
+
+LeadNameChar                [A-Za-z_]
+DigitChar                   [0-9]
+HexDigitChar                [A-Fa-f0-9]
+RootChar                    [\\]
+Nothing                     []
+
+NameChar                    [A-Za-z_0-9]
+NameSeg1                    {LeadNameChar}{NameChar}
+NameSeg2                    {LeadNameChar}{NameChar}{NameChar}
+NameSeg3                    {LeadNameChar}{NameChar}{NameChar}{NameChar}
+NameSeg                     {LeadNameChar}|{NameSeg1}|{NameSeg2}|{NameSeg3}
+
+NameString                  {RootChar}|{RootChar}{NamePath}|[\^]+{NamePath}|{NonEmptyNamePath}
+NamePath                    {NonEmptyNamePath}?
+NonEmptyNamePath            {NameSeg}{NamePathTail}*
+NamePathTail                [.]{NameSeg}
+
+%%
+    /* Rules */
+
+[ ]                         { count (0); }
+[\n]                        { count (0); } /* Handle files with both LF and CR/LF */
+[\r]                        { count (0); } /* termination on both Unix and Windows */
+[ \t]                       { count (0); }
+
+
+"/*"                        { if (!AslDoComment ()) {yyterminate ();} }
+"//"                        { if (!AslDoCommentType2 ()) {yyterminate ();} }
+
+"\""                        { if (AslDoStringLiteral ()) {return (PARSEOP_STRING_LITERAL);}
+                              else {yyterminate ();} }
+";"                         { count (0); return(';'); }
+
+    /* ASL Extension: Standard C operators */
+
+"~"                         { count (3); return (PARSEOP_EXP_NOT); }
+"!"                         { count (3); return (PARSEOP_EXP_LOGICAL_NOT); }
+"*"                         { count (3); return (PARSEOP_EXP_MULTIPLY); }
+"/"                         { count (3); return (PARSEOP_EXP_DIVIDE); }
+"%"                         { count (3); return (PARSEOP_EXP_MODULO); }
+"+"                         { count (3); return (PARSEOP_EXP_ADD); }
+"-"                         { count (3); return (PARSEOP_EXP_SUBTRACT); }
+">>"                        { count (3); return (PARSEOP_EXP_SHIFT_RIGHT); }
+"<<"                        { count (3); return (PARSEOP_EXP_SHIFT_LEFT); }
+"<"                         { count (3); return (PARSEOP_EXP_LESS); }
+">"                         { count (3); return (PARSEOP_EXP_GREATER); }
+"&"                         { count (3); return (PARSEOP_EXP_AND); }
+"<="                        { count (3); return (PARSEOP_EXP_LESS_EQUAL); }
+">="                        { count (3); return (PARSEOP_EXP_GREATER_EQUAL); }
+"=="                        { count (3); return (PARSEOP_EXP_EQUAL); }
+"!="                        { count (3); return (PARSEOP_EXP_NOT_EQUAL); }
+"|"                         { count (3); return (PARSEOP_EXP_OR); }
+"&&"                        { count (3); return (PARSEOP_EXP_LOGICAL_AND); }
+"||"                        { count (3); return (PARSEOP_EXP_LOGICAL_OR); }
+"++"                        { count (3); return (PARSEOP_EXP_INCREMENT); }
+"--"                        { count (3); return (PARSEOP_EXP_DECREMENT); }
+"^ "                        { count (3); return (PARSEOP_EXP_XOR); }
+
+    /* ASL Extension: Standard C assignment operators */
+
+"="                         { count (3); return (PARSEOP_EXP_EQUALS); }
+"+="                        { count (3); return (PARSEOP_EXP_ADD_EQ); }
+"-="                        { count (3); return (PARSEOP_EXP_SUB_EQ); }
+"*="                        { count (3); return (PARSEOP_EXP_MUL_EQ); }
+"/="                        { count (3); return (PARSEOP_EXP_DIV_EQ); }
+"%="                        { count (3); return (PARSEOP_EXP_MOD_EQ); }
+"<<="                       { count (3); return (PARSEOP_EXP_SHL_EQ); }
+">>="                       { count (3); return (PARSEOP_EXP_SHR_EQ); }
+"&="                        { count (3); return (PARSEOP_EXP_AND_EQ); }
+"^="                        { count (3); return (PARSEOP_EXP_XOR_EQ); }
+"|="                        { count (3); return (PARSEOP_EXP_OR_EQ); }
+
+"["                         { count (3); return(PARSEOP_EXP_INDEX_LEFT); }
+"]"                         { count (0); return(PARSEOP_EXP_INDEX_RIGHT); }
+
+
+    /*
+     * Begin standard ASL grammar
+     */
+0[xX]{HexDigitChar}+ |
+{DigitChar}+                { AslCompilerlval.i = UtDoConstant ((char *) AslCompilertext);
+                                count (1); return (PARSEOP_INTEGER); }
+
+"Include"                   { count (1); return (PARSEOP_INCLUDE); }
+"External"                  { count (1); return (PARSEOP_EXTERNAL); }
+
+ /*
+  * The #line directive is emitted by the preprocessor and handled
+  * here in the main iASL lexer - simply set the line number and
+  * optionally the current filename.
+  */
+"#line"                     { AslDoLineDirective ();}
+
+
+ /****************************************************************************
+  *
+  * Main ASL operators
+  *
+  ****************************************************************************/
+
+"AccessAs"                  { count (1); return (PARSEOP_ACCESSAS); }
+"Acquire"                   { count (3); return (PARSEOP_ACQUIRE); }
+"Add"                       { count (3); return (PARSEOP_ADD); }
+"Alias"                     { count (2); return (PARSEOP_ALIAS); }
+"And"                       { count (3); return (PARSEOP_AND); }
+"BankField"                 { count (2); return (PARSEOP_BANKFIELD); }
+"Break"                     { count (3); return (PARSEOP_BREAK); }
+"BreakPoint"                { count (3); return (PARSEOP_BREAKPOINT); }
+"Buffer"                    { count (1); return (PARSEOP_BUFFER); }
+"Case"                      { count (3); return (PARSEOP_CASE); }
+"Concatenate"               { count (3); return (PARSEOP_CONCATENATE); }
+"ConcatenateResTemplate"    { count (3); return (PARSEOP_CONCATENATERESTEMPLATE); }
+"CondRefOf"                 { count (3); return (PARSEOP_CONDREFOF); }
+"Connection"                { count (2); return (PARSEOP_CONNECTION); }
+"Continue"                  { count (3); return (PARSEOP_CONTINUE); }
+"CopyObject"                { count (3); return (PARSEOP_COPYOBJECT); }
+"CreateBitField"            { count (2); return (PARSEOP_CREATEBITFIELD); }
+"CreateByteField"           { count (2); return (PARSEOP_CREATEBYTEFIELD); }
+"CreateDWordField"          { count (2); return (PARSEOP_CREATEDWORDFIELD); }
+"CreateField"               { count (2); return (PARSEOP_CREATEFIELD); }
+"CreateQWordField"          { count (2); return (PARSEOP_CREATEQWORDFIELD); }
+"CreateWordField"           { count (2); return (PARSEOP_CREATEWORDFIELD); }
+"DataTableRegion"           { count (2); return (PARSEOP_DATATABLEREGION); }
+"Debug"                     { count (1); return (PARSEOP_DEBUG); }
+"Decrement"                 { count (3); return (PARSEOP_DECREMENT); }
+"Default"                   { count (3); return (PARSEOP_DEFAULT); }
+"DefinitionBlock"           { count (1); return (PARSEOP_DEFINITION_BLOCK); }
+"DeRefOf"                   { count (3); return (PARSEOP_DEREFOF); }
+"Device"                    { count (2); return (PARSEOP_DEVICE); }
+"Divide"                    { count (3); return (PARSEOP_DIVIDE); }
+"Eisaid"                    { count (1); return (PARSEOP_EISAID); }
+"Else"                      { count (3); return (PARSEOP_ELSE); }
+"ElseIf"                    { count (3); return (PARSEOP_ELSEIF); }
+"Event"                     { count (2); return (PARSEOP_EVENT); }
+"Fatal"                     { count (3); return (PARSEOP_FATAL); }
+"Field"                     { count (2); return (PARSEOP_FIELD); }
+"FindSetLeftBit"            { count (3); return (PARSEOP_FINDSETLEFTBIT); }
+"FindSetRightBit"           { count (3); return (PARSEOP_FINDSETRIGHTBIT); }
+"FromBcd"                   { count (3); return (PARSEOP_FROMBCD); }
+"Function"                  { count (2); return (PARSEOP_FUNCTION); }
+"If"                        { count (3); return (PARSEOP_IF); }
+"Increment"                 { count (3); return (PARSEOP_INCREMENT); }
+"Index"                     { count (3); return (PARSEOP_INDEX); }
+"IndexField"                { count (2); return (PARSEOP_INDEXFIELD); }
+"LAnd"                      { count (3); return (PARSEOP_LAND); }
+"LEqual"                    { count (3); return (PARSEOP_LEQUAL); }
+"LGreater"                  { count (3); return (PARSEOP_LGREATER); }
+"LGreaterEqual"             { count (3); return (PARSEOP_LGREATEREQUAL); }
+"LLess"                     { count (3); return (PARSEOP_LLESS); }
+"LLessEqual"                { count (3); return (PARSEOP_LLESSEQUAL); }
+"LNot"                      { count (3); return (PARSEOP_LNOT); }
+"LNotEqual"                 { count (3); return (PARSEOP_LNOTEQUAL); }
+"Load"                      { count (3); return (PARSEOP_LOAD); }
+"LoadTable"                 { count (3); return (PARSEOP_LOADTABLE); }
+"LOr"                       { count (3); return (PARSEOP_LOR); }
+"Match"                     { count (3); return (PARSEOP_MATCH); }
+"Method"                    { count (2); return (PARSEOP_METHOD); }
+"Mid"                       { count (3); return (PARSEOP_MID); }
+"Mod"                       { count (3); return (PARSEOP_MOD); }
+"Multiply"                  { count (3); return (PARSEOP_MULTIPLY); }
+"Mutex"                     { count (2); return (PARSEOP_MUTEX); }
+"Name"                      { count (2); return (PARSEOP_NAME); }
+"NAnd"                      { count (3); return (PARSEOP_NAND); }
+"Noop"                      { if (!AcpiGbl_IgnoreNoopOperator) {count (3); return (PARSEOP_NOOP);} }
+"NOr"                       { count (3); return (PARSEOP_NOR); }
+"Not"                       { count (3); return (PARSEOP_NOT); }
+"Notify"                    { count (3); return (PARSEOP_NOTIFY); }
+"ObjectType"                { count (3); return (PARSEOP_OBJECTTYPE); }
+"Offset"                    { count (1); return (PARSEOP_OFFSET); }
+"One"                       { count (1); return (PARSEOP_ONE); }
+"Ones"                      { count (1); return (PARSEOP_ONES); }
+"OperationRegion"           { count (2); return (PARSEOP_OPERATIONREGION); }
+"Or"                        { count (3); return (PARSEOP_OR); }
+"Package"                   { count (1); return (PARSEOP_PACKAGE); }
+"PowerResource"             { count (2); return (PARSEOP_POWERRESOURCE); }
+"Processor"                 { count (2); return (PARSEOP_PROCESSOR); }
+"RefOf"                     { count (3); return (PARSEOP_REFOF); }
+"Release"                   { count (3); return (PARSEOP_RELEASE); }
+"Reset"                     { count (3); return (PARSEOP_RESET); }
+"Return"                    { count (3); return (PARSEOP_RETURN); }
+"Revision"                  { count (1); return (PARSEOP_REVISION); }
+"Scope"                     { count (2); return (PARSEOP_SCOPE); }
+"ShiftLeft"                 { count (3); return (PARSEOP_SHIFTLEFT); }
+"ShiftRight"                { count (3); return (PARSEOP_SHIFTRIGHT); }
+"Signal"                    { count (3); return (PARSEOP_SIGNAL); }
+"SizeOf"                    { count (3); return (PARSEOP_SIZEOF); }
+"Sleep"                     { count (3); return (PARSEOP_SLEEP); }
+"Stall"                     { count (3); return (PARSEOP_STALL); }
+"Store"                     { count (3); return (PARSEOP_STORE); }
+"Subtract"                  { count (3); return (PARSEOP_SUBTRACT); }
+"Switch"                    { count (3); return (PARSEOP_SWITCH); }
+"ThermalZone"               { count (2); return (PARSEOP_THERMALZONE); }
+"Timer"                     { count (3); return (PARSEOP_TIMER); }
+"ToBcd"                     { count (3); return (PARSEOP_TOBCD); }
+"ToBuffer"                  { count (3); return (PARSEOP_TOBUFFER); }
+"ToDecimalString"           { count (3); return (PARSEOP_TODECIMALSTRING); }
+"ToHexString"               { count (3); return (PARSEOP_TOHEXSTRING); }
+"ToInteger"                 { count (3); return (PARSEOP_TOINTEGER); }
+"ToString"                  { count (3); return (PARSEOP_TOSTRING); }
+"ToUuid"                    { count (1); return (PARSEOP_TOUUID); }
+"Unicode"                   { count (1); return (PARSEOP_UNICODE); }
+"Unload"                    { count (3); return (PARSEOP_UNLOAD); }
+"Wait"                      { count (3); return (PARSEOP_WAIT); }
+"While"                     { count (3); return (PARSEOP_WHILE); }
+"XOr"                       { count (3); return (PARSEOP_XOR); }
+"Zero"                      { count (1); return (PARSEOP_ZERO); }
+
+    /* Control method arguments and locals */
+
+"Arg0"                      { count (1); return (PARSEOP_ARG0); }
+"Arg1"                      { count (1); return (PARSEOP_ARG1); }
+"Arg2"                      { count (1); return (PARSEOP_ARG2); }
+"Arg3"                      { count (1); return (PARSEOP_ARG3); }
+"Arg4"                      { count (1); return (PARSEOP_ARG4); }
+"Arg5"                      { count (1); return (PARSEOP_ARG5); }
+"Arg6"                      { count (1); return (PARSEOP_ARG6); }
+"Local0"                    { count (1); return (PARSEOP_LOCAL0); }
+"Local1"                    { count (1); return (PARSEOP_LOCAL1); }
+"Local2"                    { count (1); return (PARSEOP_LOCAL2); }
+"Local3"                    { count (1); return (PARSEOP_LOCAL3); }
+"Local4"                    { count (1); return (PARSEOP_LOCAL4); }
+"Local5"                    { count (1); return (PARSEOP_LOCAL5); }
+"Local6"                    { count (1); return (PARSEOP_LOCAL6); }
+"Local7"                    { count (1); return (PARSEOP_LOCAL7); }
+
+
+ /****************************************************************************
+  *
+  * Resource Descriptor macros
+  *
+  ****************************************************************************/
+
+"ResourceTemplate"          { count (1); return (PARSEOP_RESOURCETEMPLATE); }
+"RawDataBuffer"             { count (1); return (PARSEOP_DATABUFFER); }
+
+"DMA"                       { count (1); return (PARSEOP_DMA); }
+"DWordIO"                   { count (1); return (PARSEOP_DWORDIO); }
+"DWordMemory"               { count (1); return (PARSEOP_DWORDMEMORY); }
+"DWordSpace"                { count (1); return (PARSEOP_DWORDSPACE); }
+"EndDependentFn"            { count (1); return (PARSEOP_ENDDEPENDENTFN); }
+"ExtendedIO"                { count (1); return (PARSEOP_EXTENDEDIO); }
+"ExtendedMemory"            { count (1); return (PARSEOP_EXTENDEDMEMORY); }
+"ExtendedSpace"             { count (1); return (PARSEOP_EXTENDEDSPACE); }
+"FixedDma"                  { count (1); return (PARSEOP_FIXEDDMA); }
+"FixedIO"                   { count (1); return (PARSEOP_FIXEDIO); }
+"GpioInt"                   { count (1); return (PARSEOP_GPIO_INT); }
+"GpioIo"                    { count (1); return (PARSEOP_GPIO_IO); }
+"I2cSerialBus"              { count (1); return (PARSEOP_I2C_SERIALBUS); }
+"I2cSerialBusV2"            { count (1); return (PARSEOP_I2C_SERIALBUS_V2); }
+"Interrupt"                 { count (1); return (PARSEOP_INTERRUPT); }
+"IO"                        { count (1); return (PARSEOP_IO); }
+"IRQ"                       { count (1); return (PARSEOP_IRQ); }
+"IRQNoFlags"                { count (1); return (PARSEOP_IRQNOFLAGS); }
+"Memory24"                  { count (1); return (PARSEOP_MEMORY24); }
+"Memory32"                  { count (1); return (PARSEOP_MEMORY32); }
+"Memory32Fixed"             { count (1); return (PARSEOP_MEMORY32FIXED); }
+"QWordIO"                   { count (1); return (PARSEOP_QWORDIO); }
+"QWordMemory"               { count (1); return (PARSEOP_QWORDMEMORY); }
+"QWordSpace"                { count (1); return (PARSEOP_QWORDSPACE); }
+"Register"                  { count (1); return (PARSEOP_REGISTER); }
+"SpiSerialBus"              { count (1); return (PARSEOP_SPI_SERIALBUS); }
+"SpiSerialBusV2"            { count (1); return (PARSEOP_SPI_SERIALBUS_V2); }
+"StartDependentFn"          { count (1); return (PARSEOP_STARTDEPENDENTFN); }
+"StartDependentFnNoPri"     { count (1); return (PARSEOP_STARTDEPENDENTFN_NOPRI); }
+"UartSerialBus"             { count (1); return (PARSEOP_UART_SERIALBUS); }
+"UartSerialBusV2"           { count (1); return (PARSEOP_UART_SERIALBUS_V2); }
+"VendorLong"                { count (1); return (PARSEOP_VENDORLONG); }
+"VendorShort"               { count (1); return (PARSEOP_VENDORSHORT); }
+"WordBusNumber"             { count (1); return (PARSEOP_WORDBUSNUMBER); }
+"WordIO"                    { count (1); return (PARSEOP_WORDIO); }
+"WordSpace"                 { count (1); return (PARSEOP_WORDSPACE); }
+
+
+ /****************************************************************************
+  *
+  * Keywords used as arguments to ASL operators and macros
+  *
+  ****************************************************************************/
+
+    /*  AccessAttribKeyword: Serial Bus Attributes (ACPI 5.0) */
+
+"AttribQuick"               { count (0); return (PARSEOP_ACCESSATTRIB_QUICK); }
+"AttribSendReceive"         { count (0); return (PARSEOP_ACCESSATTRIB_SND_RCV); }
+"AttribByte"                { count (0); return (PARSEOP_ACCESSATTRIB_BYTE); }
+"AttribWord"                { count (0); return (PARSEOP_ACCESSATTRIB_WORD); }
+"AttribBlock"               { count (0); return (PARSEOP_ACCESSATTRIB_BLOCK); }
+"AttribProcessCall"         { count (0); return (PARSEOP_ACCESSATTRIB_WORD_CALL); }
+"AttribBlockProcessCall"    { count (0); return (PARSEOP_ACCESSATTRIB_BLOCK_CALL); }
+
+    /* AccessAttribKeyword: Legacy synonyms for above (pre-ACPI 5.0) */
+
+"SMBQuick"                  { count (0); return (PARSEOP_ACCESSATTRIB_QUICK); }
+"SMBSendReceive"            { count (0); return (PARSEOP_ACCESSATTRIB_SND_RCV); }
+"SMBByte"                   { count (0); return (PARSEOP_ACCESSATTRIB_BYTE); }
+"SMBWord"                   { count (0); return (PARSEOP_ACCESSATTRIB_WORD); }
+"SMBBlock"                  { count (0); return (PARSEOP_ACCESSATTRIB_BLOCK); }
+"SMBProcessCall"            { count (0); return (PARSEOP_ACCESSATTRIB_WORD_CALL); }
+"SMBBlockProcessCall"       { count (0); return (PARSEOP_ACCESSATTRIB_BLOCK_CALL); }
+
+    /* AccessTypeKeyword: Field Access Types */
+
+"AnyAcc"                    { count (0); return (PARSEOP_ACCESSTYPE_ANY); }
+"ByteAcc"                   { count (0); return (PARSEOP_ACCESSTYPE_BYTE); }
+"WordAcc"                   { count (0); return (PARSEOP_ACCESSTYPE_WORD); }
+"DWordAcc"                  { count (0); return (PARSEOP_ACCESSTYPE_DWORD); }
+"QWordAcc"                  { count (0); return (PARSEOP_ACCESSTYPE_QWORD); }
+"BufferAcc"                 { count (0); return (PARSEOP_ACCESSTYPE_BUF); }
+
+    /* AddressingModeKeyword: Mode - Resource Descriptors (ACPI 5.0) */
+
+"AddressingMode7Bit"        { count (0); return (PARSEOP_ADDRESSINGMODE_7BIT); }
+"AddressingMode10Bit"       { count (0); return (PARSEOP_ADDRESSINGMODE_10BIT); }
+
+    /* AddressKeyword: ACPI memory range types */
+
+"AddressRangeMemory"        { count (0); return (PARSEOP_ADDRESSTYPE_MEMORY); }
+"AddressRangeReserved"      { count (0); return (PARSEOP_ADDRESSTYPE_RESERVED); }
+"AddressRangeNVS"           { count (0); return (PARSEOP_ADDRESSTYPE_NVS); }
+"AddressRangeACPI"          { count (0); return (PARSEOP_ADDRESSTYPE_ACPI); }
+
+    /* BusMasterKeyword: DMA Bus Mastering */
+
+"BusMaster"                 { count (0); return (PARSEOP_BUSMASTERTYPE_MASTER); }
+"NotBusMaster"              { count (0); return (PARSEOP_BUSMASTERTYPE_NOTMASTER); }
+
+    /* ByteLengthKeyword: Bits per Byte - Resource Descriptors (ACPI 5.0) */
+
+"DataBitsFive"              { count (0); return (PARSEOP_BITSPERBYTE_FIVE); }
+"DataBitsSix"               { count (0); return (PARSEOP_BITSPERBYTE_SIX); }
+"DataBitsSeven"             { count (0); return (PARSEOP_BITSPERBYTE_SEVEN); }
+"DataBitsEight"             { count (0); return (PARSEOP_BITSPERBYTE_EIGHT); }
+"DataBitsNine"              { count (0); return (PARSEOP_BITSPERBYTE_NINE); }
+
+    /* ClockPhaseKeyword: Resource Descriptors (ACPI 5.0) */
+
+"ClockPhaseFirst"           { count (0); return (PARSEOP_CLOCKPHASE_FIRST); }
+"ClockPhaseSecond"          { count (0); return (PARSEOP_CLOCKPHASE_SECOND); }
+
+    /* ClockPolarityKeyword: Resource Descriptors (ACPI 5.0) */
+
+"ClockPolarityLow"          { count (0); return (PARSEOP_CLOCKPOLARITY_LOW); }
+"ClockPolarityHigh"         { count (0); return (PARSEOP_CLOCKPOLARITY_HIGH); }
+
+    /* DecodeKeyword: Type of Memory Decoding - Resource Descriptors */
+
+"PosDecode"                 { count (0); return (PARSEOP_DECODETYPE_POS); }
+"SubDecode"                 { count (0); return (PARSEOP_DECODETYPE_SUB); }
+
+    /* DmaTypeKeyword: DMA Types - DMA Resource Descriptor */
+
+"Compatibility"             { count (0); return (PARSEOP_DMATYPE_COMPATIBILITY); }
+"TypeA"                     { count (0); return (PARSEOP_DMATYPE_A); }
+"TypeB"                     { count (0); return (PARSEOP_DMATYPE_B); }
+"TypeF"                     { count (0); return (PARSEOP_DMATYPE_F); }
+
+    /* EndianKeyword: Endian type - Resource Descriptor (ACPI 5.0) */
+
+"LittleEndian"              { count (0); return (PARSEOP_ENDIAN_LITTLE); }
+"BigEndian"                 { count (0); return (PARSEOP_ENDIAN_BIG); }
+
+    /* ExtendedAttribKeyword: Bus attributes, AccessAs operator (ACPI 5.0) */
+
+"AttribBytes"               { count (0); return (PARSEOP_ACCESSATTRIB_MULTIBYTE); }
+"AttribRawBytes"            { count (0); return (PARSEOP_ACCESSATTRIB_RAW_BYTES); }
+"AttribRawProcessBytes"     { count (0); return (PARSEOP_ACCESSATTRIB_RAW_PROCESS); }
+
+    /* FlowControlKeyword: Resource Descriptors (ACPI 5.0) */
+
+"FlowControlHardware"       { count (0); return (PARSEOP_FLOWCONTROL_HW); }
+"FlowControlNone"           { count (0); return (PARSEOP_FLOWCONTROL_NONE); }
+"FlowControlXon"            { count (0); return (PARSEOP_FLOWCONTROL_SW); }
+
+    /* InterruptLevelKeyword: Interrupt Active Types */
+
+"ActiveBoth"                { count (0); return (PARSEOP_INTLEVEL_ACTIVEBOTH); }
+"ActiveHigh"                { count (0); return (PARSEOP_INTLEVEL_ACTIVEHIGH); }
+"ActiveLow"                 { count (0); return (PARSEOP_INTLEVEL_ACTIVELOW); }
+
+    /* InterruptTypeKeyword: Interrupt Types */
+
+"Edge"                      { count (0); return (PARSEOP_INTTYPE_EDGE); }
+"Level"                     { count (0); return (PARSEOP_INTTYPE_LEVEL); }
+
+    /* IoDecodeKeyword: Type of Memory Decoding - Resource Descriptors */
+
+"Decode10"                  { count (0); return (PARSEOP_IODECODETYPE_10); }
+"Decode16"                  { count (0); return (PARSEOP_IODECODETYPE_16); }
+
+    /* IoRestrictionKeyword: I/O Restriction - GPIO Resource Descriptors (ACPI 5.0) */
+
+"IoRestrictionNone"         { count (0); return (PARSEOP_IORESTRICT_NONE); }
+"IoRestrictionInputOnly"    { count (0); return (PARSEOP_IORESTRICT_IN); }
+"IoRestrictionOutputOnly"   { count (0); return (PARSEOP_IORESTRICT_OUT); }
+"IoRestrictionNoneAndPreserve"   { count (0); return (PARSEOP_IORESTRICT_PRESERVE); }
+
+    /* LockRuleKeyword: Global Lock use for Field Operator */
+
+"Lock"                      { count (0); return (PARSEOP_LOCKRULE_LOCK); }
+"NoLock"                    { count (0); return (PARSEOP_LOCKRULE_NOLOCK); }
+
+    /* MatchOpKeyword: Types for Match Operator */
+
+"MTR"                       { count (0); return (PARSEOP_MATCHTYPE_MTR); }
+"MEQ"                       { count (0); return (PARSEOP_MATCHTYPE_MEQ); }
+"MLE"                       { count (0); return (PARSEOP_MATCHTYPE_MLE); }
+"MLT"                       { count (0); return (PARSEOP_MATCHTYPE_MLT); }
+"MGE"                       { count (0); return (PARSEOP_MATCHTYPE_MGE); }
+"MGT"                       { count (0); return (PARSEOP_MATCHTYPE_MGT); }
+
+    /* MaxKeyword: Max Range Type - Resource Descriptors */
+
+"MaxFixed"                  { count (0); return (PARSEOP_MAXTYPE_FIXED); }
+"MaxNotFixed"               { count (0); return (PARSEOP_MAXTYPE_NOTFIXED); }
+
+    /* MemTypeKeyword: Memory Types - Resource Descriptors */
+
+"Cacheable"                 { count (0); return (PARSEOP_MEMTYPE_CACHEABLE); }
+"WriteCombining"            { count (0); return (PARSEOP_MEMTYPE_WRITECOMBINING); }
+"Prefetchable"              { count (0); return (PARSEOP_MEMTYPE_PREFETCHABLE); }
+"NonCacheable"              { count (0); return (PARSEOP_MEMTYPE_NONCACHEABLE); }
+
+    /* MinKeyword: Min Range Type - Resource Descriptors */
+
+"MinFixed"                  { count (0); return (PARSEOP_MINTYPE_FIXED); }
+"MinNotFixed"               { count (0); return (PARSEOP_MINTYPE_NOTFIXED); }
+
+    /* ObjectTypeKeyword: ACPI Object Types */
+
+"UnknownObj"                { count (0); return (PARSEOP_OBJECTTYPE_UNK); }
+"IntObj"                    { count (0); return (PARSEOP_OBJECTTYPE_INT); }
+"StrObj"                    { count (0); return (PARSEOP_OBJECTTYPE_STR); }
+"BuffObj"                   { count (0); return (PARSEOP_OBJECTTYPE_BUF); }
+"PkgObj"                    { count (0); return (PARSEOP_OBJECTTYPE_PKG); }
+"FieldUnitObj"              { count (0); return (PARSEOP_OBJECTTYPE_FLD); }
+"DeviceObj"                 { count (0); return (PARSEOP_OBJECTTYPE_DEV); }
+"EventObj"                  { count (0); return (PARSEOP_OBJECTTYPE_EVT); }
+"MethodObj"                 { count (0); return (PARSEOP_OBJECTTYPE_MTH); }
+"MutexObj"                  { count (0); return (PARSEOP_OBJECTTYPE_MTX); }
+"OpRegionObj"               { count (0); return (PARSEOP_OBJECTTYPE_OPR); }
+"PowerResObj"               { count (0); return (PARSEOP_OBJECTTYPE_POW); }
+"ProcessorObj"              { count (0); return (PARSEOP_OBJECTTYPE_PRO); }
+"ThermalZoneObj"            { count (0); return (PARSEOP_OBJECTTYPE_THZ); }
+"BuffFieldObj"              { count (0); return (PARSEOP_OBJECTTYPE_BFF); }
+"DDBHandleObj"              { count (0); return (PARSEOP_OBJECTTYPE_DDB); }
+
+    /* ParityKeyword: Resource Descriptors (ACPI 5.0) */
+
+"ParityTypeSpace"           { count (0); return (PARSEOP_PARITYTYPE_SPACE); }
+"ParityTypeMark"            { count (0); return (PARSEOP_PARITYTYPE_MARK); }
+"ParityTypeOdd"             { count (0); return (PARSEOP_PARITYTYPE_ODD); }
+"ParityTypeEven"            { count (0); return (PARSEOP_PARITYTYPE_EVEN); }
+"ParityTypeNone"            { count (0); return (PARSEOP_PARITYTYPE_NONE); }
+
+    /* PinConfigKeyword: Pin Configuration - GPIO Resource Descriptors (ACPI 5.0) */
+
+"PullDefault"               { count (0); return (PARSEOP_PIN_PULLDEFAULT); }
+"PullUp"                    { count (0); return (PARSEOP_PIN_PULLUP); }
+"PullDown"                  { count (0); return (PARSEOP_PIN_PULLDOWN); }
+"PullNone"                  { count (0); return (PARSEOP_PIN_NOPULL); }
+
+    /* PolarityKeyword: Resource Descriptors (ACPI 5.0) */
+
+"PolarityLow"               { count (0); return (PARSEOP_DEVICEPOLARITY_LOW); }
+"PolarityHigh"              { count (0); return (PARSEOP_DEVICEPOLARITY_HIGH); }
+
+    /* RangeTypeKeyword: I/O Range Types - Resource Descriptors */
+
+"ISAOnlyRanges"             { count (0); return (PARSEOP_RANGETYPE_ISAONLY); }
+"NonISAOnlyRanges"          { count (0); return (PARSEOP_RANGETYPE_NONISAONLY); }
+"EntireRange"               { count (0); return (PARSEOP_RANGETYPE_ENTIRE); }
+
+    /* ReadWriteKeyword: Memory Access Types - Resource Descriptors */
+
+"ReadWrite"                 { count (0); return (PARSEOP_READWRITETYPE_BOTH); }
+"ReadOnly"                  { count (0); return (PARSEOP_READWRITETYPE_READONLY); }
+
+    /* RegionSpaceKeyword: Operation Region Address Space Types */
+
+"SystemIO"                  { count (0); return (PARSEOP_REGIONSPACE_IO); }
+"SystemMemory"              { count (0); return (PARSEOP_REGIONSPACE_MEM); }
+"PCI_Config"                { count (0); return (PARSEOP_REGIONSPACE_PCI); }
+"EmbeddedControl"           { count (0); return (PARSEOP_REGIONSPACE_EC); }
+"SMBus"                     { count (0); return (PARSEOP_REGIONSPACE_SMBUS); }
+"SystemCMOS"                { count (0); return (PARSEOP_REGIONSPACE_CMOS); }
+"PciBarTarget"              { count (0); return (PARSEOP_REGIONSPACE_PCIBAR); }
+"IPMI"                      { count (0); return (PARSEOP_REGIONSPACE_IPMI); }
+"GeneralPurposeIo"          { count (0); return (PARSEOP_REGIONSPACE_GPIO); }       /* ACPI 5.0 */
+"GenericSerialBus"          { count (0); return (PARSEOP_REGIONSPACE_GSBUS); }      /* ACPI 5.0 */
+"PCC"                       { count (0); return (PARSEOP_REGIONSPACE_PCC); }        /* ACPI 5.0 */
+"FFixedHW"                  { count (0); return (PARSEOP_REGIONSPACE_FFIXEDHW); }
+
+    /* ResourceTypeKeyword: Resource Usage - Resource Descriptors */
+
+"ResourceConsumer"          { count (0); return (PARSEOP_RESOURCETYPE_CONSUMER); }
+"ResourceProducer"          { count (0); return (PARSEOP_RESOURCETYPE_PRODUCER); }
+
+    /* SerializeRuleKeyword: Control Method Serialization */
+
+"Serialized"                { count (0); return (PARSEOP_SERIALIZERULE_SERIAL); }
+"NotSerialized"             { count (0); return (PARSEOP_SERIALIZERULE_NOTSERIAL); }
+
+    /* ShareTypeKeyword: Interrupt Sharing - Resource Descriptors */
+
+"Shared"                    { count (0); return (PARSEOP_SHARETYPE_SHARED); }
+"Exclusive"                 { count (0); return (PARSEOP_SHARETYPE_EXCLUSIVE); }
+"SharedAndWake"             { count (0); return (PARSEOP_SHARETYPE_SHAREDWAKE); }       /* ACPI 5.0 */
+"ExclusiveAndWake"          { count (0); return (PARSEOP_SHARETYPE_EXCLUSIVEWAKE); }    /* ACPI 5.0 */
+
+    /* SlaveModeKeyword: Resource Descriptors (ACPI 5.0) */
+
+"ControllerInitiated"       { count (0); return (PARSEOP_SLAVEMODE_CONTROLLERINIT); }
+"DeviceInitiated"           { count (0); return (PARSEOP_SLAVEMODE_DEVICEINIT); }
+
+    /* StopBitsKeyword: Resource Descriptors (ACPI 5.0) */
+
+"StopBitsOne"               { count (0); return (PARSEOP_STOPBITS_ONE); }
+"StopBitsOnePlusHalf"       { count (0); return (PARSEOP_STOPBITS_ONEPLUSHALF); }
+"StopBitsTwo"               { count (0); return (PARSEOP_STOPBITS_TWO); }
+"StopBitsZero"              { count (0); return (PARSEOP_STOPBITS_ZERO); }
+
+    /* TransferWidthKeyword: DMA Widths - Fixed DMA Resource Descriptor (ACPI 5.0) */
+
+"Width8bit"                 { count (0); return (PARSEOP_XFERSIZE_8); }
+"Width16bit"                { count (0); return (PARSEOP_XFERSIZE_16); }
+"Width32bit"                { count (0); return (PARSEOP_XFERSIZE_32); }
+"Width64bit"                { count (0); return (PARSEOP_XFERSIZE_64); }
+"Width128bit"               { count (0); return (PARSEOP_XFERSIZE_128); }
+"Width256bit"               { count (0); return (PARSEOP_XFERSIZE_256); }
+
+    /* TranslationKeyword: Translation Density Types - Resource Descriptors */
+
+"SparseTranslation"         { count (0); return (PARSEOP_TRANSLATIONTYPE_SPARSE); }
+"DenseTranslation"          { count (0); return (PARSEOP_TRANSLATIONTYPE_DENSE); }
+
+    /* TypeKeyword: Translation Types - Resource Descriptors */
+
+"TypeTranslation"           { count (0); return (PARSEOP_TYPE_TRANSLATION); }
+"TypeStatic"                { count (0); return (PARSEOP_TYPE_STATIC); }
+
+    /* UpdateRuleKeyword: Field Update Rules */
+
+"Preserve"                  { count (0); return (PARSEOP_UPDATERULE_PRESERVE); }
+"WriteAsOnes"               { count (0); return (PARSEOP_UPDATERULE_ONES); }
+"WriteAsZeros"              { count (0); return (PARSEOP_UPDATERULE_ZEROS); }
+
+    /* WireModeKeyword: SPI Wire Mode - Resource Descriptors (ACPI 5.0) */
+
+"FourWireMode"              { count (0); return (PARSEOP_WIREMODE_FOUR); }
+"ThreeWireMode"             { count (0); return (PARSEOP_WIREMODE_THREE); }
+
+    /* XferTypeKeyword: DMA Transfer Types */
+
+"Transfer8"                 { count (0); return (PARSEOP_XFERTYPE_8); }
+"Transfer8_16"              { count (0); return (PARSEOP_XFERTYPE_8_16); }
+"Transfer16"                { count (0); return (PARSEOP_XFERTYPE_16); }
+
+    /* ToPld macro */
+
+"ToPLD"                     { count (0); return (PARSEOP_TOPLD); }
+
+"PLD_Revision"              { count (0); return (PARSEOP_PLD_REVISION); }
+"PLD_IgnoreColor"           { count (0); return (PARSEOP_PLD_IGNORECOLOR); }
+"PLD_Red"                   { count (0); return (PARSEOP_PLD_RED); }
+"PLD_Green"                 { count (0); return (PARSEOP_PLD_GREEN); }
+"PLD_Blue"                  { count (0); return (PARSEOP_PLD_BLUE); }
+"PLD_Width"                 { count (0); return (PARSEOP_PLD_WIDTH); }
+"PLD_Height"                { count (0); return (PARSEOP_PLD_HEIGHT); }
+"PLD_UserVisible"           { count (0); return (PARSEOP_PLD_USERVISIBLE); }
+"PLD_Dock"                  { count (0); return (PARSEOP_PLD_DOCK); }
+"PLD_Lid"                   { count (0); return (PARSEOP_PLD_LID); }
+"PLD_Panel"                 { count (0); return (PARSEOP_PLD_PANEL); }
+"PLD_VerticalPosition"      { count (0); return (PARSEOP_PLD_VERTICALPOSITION); }
+"PLD_HorizontalPosition"    { count (0); return (PARSEOP_PLD_HORIZONTALPOSITION); }
+"PLD_Shape"                 { count (0); return (PARSEOP_PLD_SHAPE); }
+"PLD_GroupOrientation"      { count (0); return (PARSEOP_PLD_GROUPORIENTATION); }
+"PLD_GroupToken"            { count (0); return (PARSEOP_PLD_GROUPTOKEN); }
+"PLD_GroupPosition"         { count (0); return (PARSEOP_PLD_GROUPPOSITION); }
+"PLD_Bay"                   { count (0); return (PARSEOP_PLD_BAY); }
+"PLD_Ejectable"             { count (0); return (PARSEOP_PLD_EJECTABLE); }
+"PLD_EjectRequired"         { count (0); return (PARSEOP_PLD_EJECTREQUIRED); }
+"PLD_CabinetNumber"         { count (0); return (PARSEOP_PLD_CABINETNUMBER); }
+"PLD_CardCageNumber"        { count (0); return (PARSEOP_PLD_CARDCAGENUMBER); }
+"PLD_Reference"             { count (0); return (PARSEOP_PLD_REFERENCE); }
+"PLD_Rotation"              { count (0); return (PARSEOP_PLD_ROTATION); }
+"PLD_Order"                 { count (0); return (PARSEOP_PLD_ORDER); }
+"PLD_Reserved"              { count (0); return (PARSEOP_PLD_RESERVED); }
+"PLD_VerticalOffset"        { count (0); return (PARSEOP_PLD_VERTICALOFFSET); }
+"PLD_HorizontalOffset"      { count (0); return (PARSEOP_PLD_HORIZONTALOFFSET); }
+
+
+    /* printf debug macros */
+
+"printf"                    { count (0); return (PARSEOP_PRINTF); }
+"fprintf"                   { count (0); return (PARSEOP_FPRINTF); }
+
+    /* Other macros */
+
+"For"                       { count (0); return (PARSEOP_FOR); }
+
+    /* Predefined compiler names */
+
+"__DATE__"                  { count (0); return (PARSEOP___DATE__); }
+"__FILE__"                  { count (0); return (PARSEOP___FILE__); }
+"__LINE__"                  { count (0); return (PARSEOP___LINE__); }
+"__PATH__"                  { count (0); return (PARSEOP___PATH__); }
+
+
+"{"                         { count (0); return('{'); }
+"}"                         { count (0); return('}'); }
+","                         { count (0); return(','); }
+"("                         { count (0); return('('); }
+")"                         { count (0); return(')'); }
+
+{NameSeg}                   { char *s;
+                                count (0);
+                                s=UtStringCacheCalloc (ACPI_NAME_SIZE + 1);
+                                if (strcmp (AslCompilertext, "\\"))
+                                {
+                                    strcpy (s, "____");
+                                    AcpiUtStrupr (AslCompilertext);
+                                }
+                                memcpy (s, AslCompilertext, strlen (AslCompilertext));
+                                AslCompilerlval.s = s;
+                                DbgPrint (ASL_PARSE_OUTPUT, "NameSeg: %s\n", s);
+                                return (PARSEOP_NAMESEG); }
+
+{NameString}                { char *s;
+                                count (0);
+                                s=UtStringCacheCalloc (strlen (AslCompilertext)+1);
+                                AcpiUtStrupr (AslCompilertext);
+                                strcpy (s, AslCompilertext);
+                                AslCompilerlval.s = s;
+                                DbgPrint (ASL_PARSE_OUTPUT, "NameString: %s\n", s);
+                                return (PARSEOP_NAMESTRING); }
+
+.                           { count (1);
+                                if (isprint ((int) *AslCompilertext))
+                                {
+                                    sprintf (MsgBuffer,
+                                        "Invalid character (%c), expecting ASL keyword or name",
+                                        *AslCompilertext);
+                                }
+                                else
+                                {
+                                    sprintf (MsgBuffer,
+                                        "Invalid character (0x%2.2X), expecting ASL keyword or name",
+                                        *AslCompilertext);
+                                }
+                                AslCompilererror (MsgBuffer);}
+
+<<EOF>>                     { if (AslPopInputFileStack ())
+                                {yyterminate();}
+                              else
+                                {return (PARSEOP_INCLUDE_END);} };
+
+%%
+
+/*! [End] no source code translation !*/
+
+/*
+ * Bring in the scanner support routines
+ */
+#include "aslsupport.l"
diff --git a/usr/src/cmd/acpi/iasl/aslcstyle.y b/usr/src/cmd/acpi/iasl/aslcstyle.y
new file mode 100644
index 0000000000..62a7b65f76
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslcstyle.y
@@ -0,0 +1,209 @@
+NoEcho('
+/******************************************************************************
+ *
+ * Module Name: aslcstyle.y - Production rules for symbolic operators
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+')
+
+/*******************************************************************************
+ *
+ * Production rules for the symbolic (c-style) operators
+ *
+ ******************************************************************************/
+
+/*
+ * ASL Extensions: C-style math/logical operators and expressions.
+ * The implementation transforms these operators into the standard
+ * AML opcodes and syntax.
+ *
+ * Supported operators and precedence rules (high-to-low)
+ *
+ * NOTE: The operator precedence and associativity rules are
+ * implemented by the tokens in asltokens.y
+ *
+ * (left-to-right):
+ *  1)      ( ) expr++ expr--
+ *
+ * (right-to-left):
+ *  2)      ! ~
+ *
+ * (left-to-right):
+ *  3)      *   /   %
+ *  4)      +   -
+ *  5)      >>  <<
+ *  6)      <   >   <=  >=
+ *  7)      ==  !=
+ *  8)      &
+ *  9)      ^
+ *  10)     |
+ *  11)     &&
+ *  12)     ||
+ *
+ * (right-to-left):
+ *  13)     = += -= *= /= %= <<= >>= &= ^= |=
+ */
+
+Expression
+
+    /* Unary operators */
+
+    : PARSEOP_EXP_LOGICAL_NOT           {$<n>$ = TrCreateLeafNode (PARSEOP_LNOT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>2,1,$3);}
+    | PARSEOP_EXP_NOT                   {$<n>$ = TrCreateLeafNode (PARSEOP_NOT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>2,2,$3,TrCreateNullTarget ());}
+
+    | SuperName PARSEOP_EXP_INCREMENT   {$<n>$ = TrCreateLeafNode (PARSEOP_INCREMENT);}
+                                        {$$ = TrLinkChildren ($<n>3,1,$1);}
+    | SuperName PARSEOP_EXP_DECREMENT   {$<n>$ = TrCreateLeafNode (PARSEOP_DECREMENT);}
+                                        {$$ = TrLinkChildren ($<n>3,1,$1);}
+
+    /* Binary operators: math and logical */
+
+    | TermArg PARSEOP_EXP_ADD           {$<n>$ = TrCreateLeafNode (PARSEOP_ADD);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_DIVIDE        {$<n>$ = TrCreateLeafNode (PARSEOP_DIVIDE);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,4,$1,$4,TrCreateNullTarget (),
+                                            TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_MODULO        {$<n>$ = TrCreateLeafNode (PARSEOP_MOD);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_MULTIPLY      {$<n>$ = TrCreateLeafNode (PARSEOP_MULTIPLY);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_SHIFT_LEFT    {$<n>$ = TrCreateLeafNode (PARSEOP_SHIFTLEFT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_SHIFT_RIGHT   {$<n>$ = TrCreateLeafNode (PARSEOP_SHIFTRIGHT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_SUBTRACT      {$<n>$ = TrCreateLeafNode (PARSEOP_SUBTRACT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+
+    | TermArg PARSEOP_EXP_AND           {$<n>$ = TrCreateLeafNode (PARSEOP_AND);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_OR            {$<n>$ = TrCreateLeafNode (PARSEOP_OR);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+    | TermArg PARSEOP_EXP_XOR           {$<n>$ = TrCreateLeafNode (PARSEOP_XOR);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,TrCreateNullTarget ());}
+
+    | TermArg PARSEOP_EXP_GREATER       {$<n>$ = TrCreateLeafNode (PARSEOP_LGREATER);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+    | TermArg PARSEOP_EXP_GREATER_EQUAL {$<n>$ = TrCreateLeafNode (PARSEOP_LGREATEREQUAL);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+    | TermArg PARSEOP_EXP_LESS          {$<n>$ = TrCreateLeafNode (PARSEOP_LLESS);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+    | TermArg PARSEOP_EXP_LESS_EQUAL    {$<n>$ = TrCreateLeafNode (PARSEOP_LLESSEQUAL);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+
+    | TermArg PARSEOP_EXP_EQUAL         {$<n>$ = TrCreateLeafNode (PARSEOP_LEQUAL);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+    | TermArg PARSEOP_EXP_NOT_EQUAL     {$<n>$ = TrCreateLeafNode (PARSEOP_LNOTEQUAL);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+
+    | TermArg PARSEOP_EXP_LOGICAL_AND   {$<n>$ = TrCreateLeafNode (PARSEOP_LAND);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+    | TermArg PARSEOP_EXP_LOGICAL_OR    {$<n>$ = TrCreateLeafNode (PARSEOP_LOR);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,2,$1,$4);}
+
+        /* Parentheses */
+
+    | '(' TermArg ')'                   { $$ = $2;}
+
+        /* Index term -- "= BUF1[5]" on right-hand side of an equals (source) */
+
+    | SuperName PARSEOP_EXP_INDEX_LEFT TermArg PARSEOP_EXP_INDEX_RIGHT
+                                        {$$ = TrCreateLeafNode (PARSEOP_INDEX);
+                                        TrLinkChildren ($$,3,$1,$3,TrCreateNullTarget ());}
+    ;
+
+        /* Index term -- "BUF1[5] = " on left-hand side of an equals (target) */
+
+IndexExpTerm
+
+    : SuperName PARSEOP_EXP_INDEX_LEFT TermArg PARSEOP_EXP_INDEX_RIGHT
+                                        {$$ = TrCreateLeafNode (PARSEOP_INDEX);
+                                        TrLinkChildren ($$,3,$1,$3,TrCreateNullTarget ());}
+    ;
+
+EqualsTerm
+
+    /* All assignment-type operations */
+
+    : SuperName PARSEOP_EXP_EQUALS
+        TermArg                         {$$ = TrCreateAssignmentNode ($1, $3);}
+
+    | TermArg PARSEOP_EXP_ADD_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_ADD);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_DIV_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_DIVIDE);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,4,$1,$4,TrCreateNullTarget (),
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_MOD_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_MOD);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_MUL_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_MULTIPLY);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_SHL_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_SHIFTLEFT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_SHR_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_SHIFTRIGHT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_SUB_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_SUBTRACT);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_AND_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_AND);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_OR_EQ         {$<n>$ = TrCreateLeafNode (PARSEOP_OR);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+
+    | TermArg PARSEOP_EXP_XOR_EQ        {$<n>$ = TrCreateLeafNode (PARSEOP_XOR);}
+        TermArg                         {$$ = TrLinkChildren ($<n>3,3,$1,$4,
+                                            TrSetNodeFlags (TrCreateTargetOperand ($1, NULL), NODE_IS_TARGET));}
+    ;
diff --git a/usr/src/cmd/acpi/iasl/asldebug.c b/usr/src/cmd/acpi/iasl/asldebug.c
new file mode 100644
index 0000000000..6ba60668b1
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asldebug.c
@@ -0,0 +1,253 @@
+/******************************************************************************
+ *
+ * Module Name: asldebug -- Debug output support
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asldebug")
+
+
+/* Local prototypes */
+
+static void
+UtDumpParseOpName (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    UINT32                  DataLength);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDumpIntegerOp
+ *
+ * PARAMETERS:  Op                  - Current parse op
+ *              Level               - Current output indentation level
+ *              IntegerLength       - Output length of the integer (2/4/8/16)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emit formatted debug output for "integer" ops.
+ *              Note: IntegerLength must be one of 2,4,8,16.
+ *
+ ******************************************************************************/
+
+void
+UtDumpIntegerOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    UINT32                  IntegerLength)
+{
+
+    /* Emit the ParseOp name, leaving room for the integer */
+
+    UtDumpParseOpName (Op, Level, IntegerLength);
+
+    /* Emit the integer based upon length */
+
+    switch (IntegerLength)
+    {
+    case 2: /* Byte */
+    case 4: /* Word */
+    case 8: /* Dword */
+
+        DbgPrint (ASL_TREE_OUTPUT,
+            "%*.*X", IntegerLength, IntegerLength, Op->Asl.Value.Integer);
+        break;
+
+    case 16: /* Qword and Integer */
+
+        DbgPrint (ASL_TREE_OUTPUT,
+            "%8.8X%8.8X", ACPI_FORMAT_UINT64 (Op->Asl.Value.Integer));
+        break;
+
+    default:
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDumpStringOp
+ *
+ * PARAMETERS:  Op                  - Current parse op
+ *              Level               - Current output indentation level
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emit formatted debug output for String/Pathname ops.
+ *
+ ******************************************************************************/
+
+void
+UtDumpStringOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level)
+{
+    char                    *String;
+
+
+    String = Op->Asl.Value.String;
+
+    if (Op->Asl.ParseOpcode != PARSEOP_STRING_LITERAL)
+    {
+        /*
+         * For the "path" ops NAMEPATH, NAMESEG, METHODCALL -- if the
+         * ExternalName is valid, it takes precedence. In these cases the
+         * Value.String is the raw "internal" name from the AML code, which
+         * we don't want to use, because it contains non-ascii characters.
+         */
+        if (Op->Asl.ExternalName)
+        {
+            String = Op->Asl.ExternalName;
+        }
+    }
+
+    if (!String)
+    {
+        DbgPrint (ASL_TREE_OUTPUT,
+            " ERROR: Could not find a valid String/Path pointer\n");
+        return;
+    }
+
+    /* Emit the ParseOp name, leaving room for the string */
+
+    UtDumpParseOpName (Op, Level, strlen (String));
+    DbgPrint (ASL_TREE_OUTPUT, "%s", String);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDumpBasicOp
+ *
+ * PARAMETERS:  Op                  - Current parse op
+ *              Level               - Current output indentation level
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Generic formatted debug output for "basic" ops that have no
+ *              associated strings or integer values.
+ *
+ ******************************************************************************/
+
+void
+UtDumpBasicOp (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level)
+{
+
+    /* Just print out the ParseOp name, there is no extra data */
+
+    UtDumpParseOpName (Op, Level, 0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDumpParseOpName
+ *
+ * PARAMETERS:  Op                  - Current parse op
+ *              Level               - Current output indentation level
+ *              DataLength          - Length of data to appear after the name
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Indent and emit the ascii ParseOp name for the op
+ *
+ ******************************************************************************/
+
+static void
+UtDumpParseOpName (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    UINT32                  DataLength)
+{
+    char                    *ParseOpName;
+    UINT32                  IndentLength;
+    UINT32                  NameLength;
+    UINT32                  LineLength;
+    UINT32                  PaddingLength;
+
+
+    /* Emit the LineNumber/IndentLevel prefix on each output line */
+
+    DbgPrint (ASL_TREE_OUTPUT,
+        "%5.5d [%2d]", Op->Asl.LogicalLineNumber, Level);
+
+    ParseOpName = UtGetOpName (Op->Asl.ParseOpcode);
+
+    /* Calculate various lengths for output alignment */
+
+    IndentLength = Level * DEBUG_SPACES_PER_INDENT;
+    NameLength = strlen (ParseOpName);
+    LineLength = IndentLength + 1 + NameLength + 1 + DataLength;
+    PaddingLength = (DEBUG_MAX_LINE_LENGTH + 1) - LineLength;
+
+    /* Parse tree indentation is based upon the nesting/indent level */
+
+    if (Level)
+    {
+        DbgPrint (ASL_TREE_OUTPUT, "%*s", IndentLength, " ");
+    }
+
+    /* Emit the actual name here */
+
+    DbgPrint (ASL_TREE_OUTPUT, " %s", ParseOpName);
+
+    /* Emit extra padding blanks for alignment of later data items */
+
+    if (LineLength > DEBUG_MAX_LINE_LENGTH)
+    {
+        /* Split a long line immediately after the ParseOpName string */
+
+        DbgPrint (ASL_TREE_OUTPUT, "\n%*s",
+            (DEBUG_FULL_LINE_LENGTH - DataLength), " ");
+    }
+    else
+    {
+        DbgPrint (ASL_TREE_OUTPUT, "%*s", PaddingLength, " ");
+    }
+}
diff --git a/usr/src/cmd/acpi/iasl/asldefine.h b/usr/src/cmd/acpi/iasl/asldefine.h
new file mode 100644
index 0000000000..f615cb2195
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asldefine.h
@@ -0,0 +1,188 @@
+/******************************************************************************
+ *
+ * Module Name: asldefine.h - Common defines for the iASL compiler
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#ifndef __ASLDEFINE_H
+#define __ASLDEFINE_H
+
+
+/*
+ * Compiler versions and names
+ */
+#define ASL_COMPILER_NAME           "ASL+ Optimizing Compiler"
+#define AML_DISASSEMBLER_NAME       "AML/ASL+ Disassembler"
+#define ASL_INVOCATION_NAME         "iasl"
+#define ASL_CREATOR_ID              "INTL"
+#define ASL_DEFINE                  "__IASL__"
+
+#define ASL_COMPLIANCE              "Supports ACPI Specification Revision 6.1"
+
+
+/* Configuration constants */
+
+#define ASL_MAX_ERROR_COUNT         200
+#define ASL_PARSEOP_CACHE_SIZE      (1024 * 16)
+#define ASL_STRING_CACHE_SIZE       (1024 * 64)
+
+#define ASL_FIRST_PARSE_OPCODE      PARSEOP_ACCESSAS
+#define ASL_PARSE_OPCODE_BASE       PARSEOP_ACCESSAS        /* First Lex type */
+
+
+/*
+ * Per-parser-generator configuration. These values are used to cheat and
+ * directly access the bison/yacc token name table (yyname or yytname).
+ * Note: These values are the index in yyname for the first lex token
+ * (PARSEOP_ACCCESSAS).
+ */
+#if defined (YYBISON)
+#define ASL_YYTNAME_START           3   /* Bison */
+#elif defined (YYBYACC)
+#define ASL_YYTNAME_START           257 /* Berkeley yacc */
+#endif
+
+
+/*
+ * Macros
+ */
+#define ASL_RESDESC_OFFSET(m)       ACPI_OFFSET (AML_RESOURCE, m)
+#define ASL_PTR_DIFF(a,b)           ((UINT8 *)(b) - (UINT8 *)(a))
+#define ASL_PTR_ADD(a,b)            ((UINT8 *)(a) = ((UINT8 *)(a) + (b)))
+#define ASL_GET_CHILD_NODE(a)       (a)->Asl.Child
+#define ASL_GET_PEER_NODE(a)        (a)->Asl.Next
+#define OP_TABLE_ENTRY(a,b,c,d)     {b,d,a,c}
+
+
+/* Internal AML opcodes */
+
+#define AML_RAW_DATA_BYTE           (UINT16) 0xAA01 /* write one raw byte */
+#define AML_RAW_DATA_WORD           (UINT16) 0xAA02 /* write 2 raw bytes */
+#define AML_RAW_DATA_DWORD          (UINT16) 0xAA04 /* write 4 raw bytes */
+#define AML_RAW_DATA_QWORD          (UINT16) 0xAA08 /* write 8 raw bytes */
+#define AML_RAW_DATA_BUFFER         (UINT16) 0xAA0B /* raw buffer with length */
+#define AML_RAW_DATA_CHAIN          (UINT16) 0xAA0C /* chain of raw buffers */
+#define AML_PACKAGE_LENGTH          (UINT16) 0xAA10
+#define AML_UNASSIGNED_OPCODE       (UINT16) 0xEEEE
+#define AML_DEFAULT_ARG_OP          (UINT16) 0xDDDD
+
+
+/* Types for input files */
+
+#define ASL_INPUT_TYPE_BINARY               0
+#define ASL_INPUT_TYPE_BINARY_ACPI_TABLE    1
+#define ASL_INPUT_TYPE_ASCII_ASL            2
+#define ASL_INPUT_TYPE_ASCII_DATA           3
+
+
+/* Misc */
+
+#define ASL_EXTERNAL_METHOD         255
+#define ASL_ABORT                   TRUE
+#define ASL_NO_ABORT                FALSE
+#define ASL_EOF                     ACPI_UINT32_MAX
+#define ASL_IGNORE_LINE            (ACPI_UINT32_MAX -1)
+
+
+/* Listings */
+
+#define ASL_LISTING_LINE_PREFIX         ":  "
+
+
+/* Support for reserved method names */
+
+#define ACPI_VALID_RESERVED_NAME_MAX    0x80000000
+#define ACPI_NOT_RESERVED_NAME          ACPI_UINT32_MAX
+#define ACPI_PREDEFINED_NAME            (ACPI_UINT32_MAX - 1)
+#define ACPI_EVENT_RESERVED_NAME        (ACPI_UINT32_MAX - 2)
+#define ACPI_COMPILER_RESERVED_NAME     (ACPI_UINT32_MAX - 3)
+
+
+/* Helper macros for resource tag creation */
+
+#define RsCreateMultiBitField \
+    RsCreateResourceField
+
+#define RsCreateBitField(Op, Name, ByteOffset, BitOffset) \
+    RsCreateResourceField (Op, Name, ByteOffset, BitOffset, 1)
+
+#define RsCreateByteField(Op, Name, ByteOffset) \
+    RsCreateResourceField (Op, Name, ByteOffset, 0, 8);
+
+#define RsCreateWordField(Op, Name, ByteOffset) \
+    RsCreateResourceField (Op, Name, ByteOffset, 0, 16);
+
+#define RsCreateDwordField(Op, Name, ByteOffset) \
+    RsCreateResourceField (Op, Name, ByteOffset, 0, 32);
+
+#define RsCreateQwordField(Op, Name, ByteOffset) \
+    RsCreateResourceField (Op, Name, ByteOffset, 0, 64);
+
+
+/*
+ * Macros for debug output
+ */
+
+#define DEBUG_MAX_LINE_LENGTH       61
+#define DEBUG_SPACES_PER_INDENT     3
+#define DEBUG_FULL_LINE_LENGTH      71
+
+#define ASL_PARSE_TREE_FULL_LINE    "\n%71.71s"
+
+/* Header/Trailer for original parse tree directly from the parser */
+
+#define ASL_PARSE_TREE_HEADER1 \
+    "%*s Value P_Op Flags     Line#  End# LogL# EndL#\n", 65, " "
+
+#define ASL_PARSE_TREE_DEBUG1 \
+    " %4.4X %8.8X %5d %5d %5d %5d"
+
+/* Header/Trailer for processed parse tree used for AML generation */
+
+#define ASL_PARSE_TREE_HEADER2 \
+    "%*s NameString Value    P_Op A_Op OpLen PByts Len  SubLen PSubLen OpPtr"\
+    "    Parent   Child    Next     Flags    AcTyp    Final Col"\
+    " Line#  End# LogL# EndL#\n", 60, " "
+
+#define ASL_PARSE_TREE_DEBUG2 \
+    " %08X %04X %04X %01X     %04X  %04X %05X  %05X   "\
+    "%08X %08X %08X %08X %08X %08X %04X  %02d  %5d %5d %5d %5d\n"
+
+#endif /* ASLDEFINE.H */
diff --git a/usr/src/cmd/acpi/iasl/aslerror.c b/usr/src/cmd/acpi/iasl/aslerror.c
new file mode 100644
index 0000000000..dfb6676f18
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslerror.c
@@ -0,0 +1,932 @@
+/******************************************************************************
+ *
+ * Module Name: aslerror - Error handling and statistics
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslerror")
+
+/* Local prototypes */
+
+static void
+AeAddToErrorLog (
+    ASL_ERROR_MSG           *Enode);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslAbort
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump the error log and abort the compiler. Used for serious
+ *              I/O errors.
+ *
+ ******************************************************************************/
+
+void
+AslAbort (
+    void)
+{
+
+    AePrintErrorLog (ASL_FILE_STDERR);
+    if (Gbl_DebugFlag)
+    {
+        /* Print error summary to stdout also */
+
+        AePrintErrorLog (ASL_FILE_STDOUT);
+    }
+
+    exit (1);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AeClearErrorLog
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Empty the error list
+ *
+ ******************************************************************************/
+
+void
+AeClearErrorLog (
+    void)
+{
+    ASL_ERROR_MSG           *Enode = Gbl_ErrorLog;
+    ASL_ERROR_MSG           *Next;
+
+    /* Walk the error node list */
+
+    while (Enode)
+    {
+        Next = Enode->Next;
+        ACPI_FREE (Enode);
+        Enode = Next;
+    }
+
+    Gbl_ErrorLog = NULL;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AeAddToErrorLog
+ *
+ * PARAMETERS:  Enode       - An error node to add to the log
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add a new error node to the error log. The error log is
+ *              ordered by the "logical" line number (cumulative line number
+ *              including all include files.)
+ *
+ ******************************************************************************/
+
+static void
+AeAddToErrorLog (
+    ASL_ERROR_MSG           *Enode)
+{
+    ASL_ERROR_MSG           *Next;
+    ASL_ERROR_MSG           *Prev;
+
+
+    /* If Gbl_ErrorLog is null, this is the first error node */
+
+    if (!Gbl_ErrorLog)
+    {
+        Gbl_ErrorLog = Enode;
+        return;
+    }
+
+    /*
+     * Walk error list until we find a line number greater than ours.
+     * List is sorted according to line number.
+     */
+    Prev = NULL;
+    Next = Gbl_ErrorLog;
+
+    while ((Next) &&
+           (Next->LogicalLineNumber <= Enode->LogicalLineNumber))
+    {
+        Prev = Next;
+        Next = Next->Next;
+    }
+
+    /* Found our place in the list */
+
+    Enode->Next = Next;
+
+    if (Prev)
+    {
+        Prev->Next = Enode;
+    }
+    else
+    {
+        Gbl_ErrorLog = Enode;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AePrintException
+ *
+ * PARAMETERS:  FileId          - ID of output file
+ *              Enode           - Error node to print
+ *              Header          - Additional text before each message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Print the contents of an error node.
+ *
+ * NOTE:        We don't use the FlxxxFile I/O functions here because on error
+ *              they abort the compiler and call this function!  Since we
+ *              are reporting errors here, we ignore most output errors and
+ *              just try to get out as much as we can.
+ *
+ ******************************************************************************/
+
+void
+AePrintException (
+    UINT32                  FileId,
+    ASL_ERROR_MSG           *Enode,
+    char                    *Header)
+{
+    UINT8                   SourceByte;
+    int                     Actual;
+    size_t                  RActual;
+    UINT32                  MsgLength;
+    const char              *MainMessage;
+    char                    *ExtraMessage;
+    UINT32                  SourceColumn;
+    UINT32                  ErrorColumn;
+    FILE                    *OutputFile;
+    FILE                    *SourceFile = NULL;
+    long                    FileSize;
+    BOOLEAN                 PrematureEOF = FALSE;
+    UINT32                  Total = 0;
+
+
+    if (Gbl_NoErrors)
+    {
+        return;
+    }
+
+    /*
+     * Only listing files have a header, and remarks/optimizations
+     * are always output
+     */
+    if (!Header)
+    {
+        /* Ignore remarks if requested */
+
+        switch (Enode->Level)
+        {
+        case ASL_WARNING:
+        case ASL_WARNING2:
+        case ASL_WARNING3:
+
+            if (!Gbl_DisplayWarnings)
+            {
+                return;
+            }
+            break;
+
+        case ASL_REMARK:
+
+            if (!Gbl_DisplayRemarks)
+            {
+                return;
+            }
+            break;
+
+        case ASL_OPTIMIZATION:
+
+            if (!Gbl_DisplayOptimizations)
+            {
+                return;
+            }
+            break;
+
+        default:
+
+            break;
+        }
+    }
+
+    /* Get the various required file handles */
+
+    OutputFile = Gbl_Files[FileId].Handle;
+
+    if (!Enode->SourceLine)
+    {
+        /*
+         * Use the merged header/source file if present, otherwise
+         * use input file
+         */
+        SourceFile = Gbl_Files[ASL_FILE_SOURCE_OUTPUT].Handle;
+        if (!SourceFile)
+        {
+            SourceFile = Gbl_Files[ASL_FILE_INPUT].Handle;
+        }
+
+        if (SourceFile)
+        {
+            /* Determine if the error occurred at source file EOF */
+
+            fseek (SourceFile, 0, SEEK_END);
+            FileSize = ftell (SourceFile);
+
+            if ((long) Enode->LogicalByteOffset >= FileSize)
+            {
+                PrematureEOF = TRUE;
+            }
+        }
+    }
+
+    if (Header)
+    {
+        fprintf (OutputFile, "%s", Header);
+    }
+
+    /* Print filename and line number if present and valid */
+
+    if (Enode->Filename)
+    {
+        if (Gbl_VerboseErrors)
+        {
+            fprintf (OutputFile, "%-8s", Enode->Filename);
+
+            if (Enode->LineNumber)
+            {
+                if (Enode->SourceLine)
+                {
+                    fprintf (OutputFile, " %6u: %s",
+                        Enode->LineNumber, Enode->SourceLine);
+                }
+                else
+                {
+                    fprintf (OutputFile, " %6u: ", Enode->LineNumber);
+
+                    /*
+                     * If not at EOF, get the corresponding source code line
+                     * and display it. Don't attempt this if we have a
+                     * premature EOF condition.
+                     */
+                    if (!PrematureEOF)
+                    {
+                        /*
+                         * Seek to the offset in the combined source file,
+                         * read the source line, and write it to the output.
+                         */
+                        Actual = fseek (SourceFile,
+                            (long) Enode->LogicalByteOffset, (int) SEEK_SET);
+                        if (Actual)
+                        {
+                            fprintf (OutputFile,
+                                "[*** iASL: Seek error on source code temp file %s ***]",
+                                Gbl_Files[ASL_FILE_SOURCE_OUTPUT].Filename);
+                        }
+                        else
+                        {
+                            RActual = fread (&SourceByte, 1, 1, SourceFile);
+                            if (RActual != 1)
+                            {
+                                fprintf (OutputFile,
+                                    "[*** iASL: Read error on source code temp file %s ***]",
+                                    Gbl_Files[ASL_FILE_SOURCE_OUTPUT].Filename);
+                            }
+                            else
+                            {
+                                /* Read/write the source line, up to the maximum line length */
+
+                                while (RActual && SourceByte && (SourceByte != '\n'))
+                                {
+                                    if (Total < 256)
+                                    {
+                                        /* After the max line length, we will just read the line, no write */
+
+                                        if (fwrite (&SourceByte, 1, 1, OutputFile) != 1)
+                                        {
+                                            printf ("[*** iASL: Write error on output file ***]\n");
+                                            return;
+                                        }
+                                    }
+                                    else if (Total == 256)
+                                    {
+                                        fprintf (OutputFile,
+                                            "\n[*** iASL: Very long input line, message below refers to column %u ***]",
+                                            Enode->Column);
+                                    }
+
+                                    RActual = fread (&SourceByte, 1, 1, SourceFile);
+                                    if (RActual != 1)
+                                    {
+                                        fprintf (OutputFile,
+                                            "[*** iASL: Read error on source code temp file %s ***]",
+                                            Gbl_Files[ASL_FILE_SOURCE_OUTPUT].Filename);
+                                        return;
+                                    }
+                                    Total++;
+                                }
+                            }
+                        }
+                    }
+
+                    fprintf (OutputFile, "\n");
+                }
+            }
+        }
+        else
+        {
+            /*
+             * Less verbose version of the error message, enabled via the
+             * -vi switch. The format is compatible with MS Visual Studio.
+             */
+            fprintf (OutputFile, "%s", Enode->Filename);
+
+            if (Enode->LineNumber)
+            {
+                fprintf (OutputFile, "(%u) : ",
+                    Enode->LineNumber);
+            }
+        }
+    }
+
+    /* If a NULL message ID, just print the raw message */
+
+    if (Enode->MessageId == 0)
+    {
+        fprintf (OutputFile, "%s\n", Enode->Message);
+        return;
+    }
+
+    /* Decode the message ID */
+
+    fprintf (OutputFile, "%s %4.4d -",
+        AeDecodeExceptionLevel (Enode->Level),
+        AeBuildFullExceptionCode (Enode->Level, Enode->MessageId));
+
+    MainMessage = AeDecodeMessageId (Enode->MessageId);
+    ExtraMessage = Enode->Message;
+
+    /* If a NULL line number, just print the decoded message */
+
+    if (!Enode->LineNumber)
+    {
+        fprintf (OutputFile, " %s %s\n\n", MainMessage, ExtraMessage);
+        return;
+    }
+
+    MsgLength = strlen (MainMessage);
+    if (MsgLength == 0)
+    {
+        /* Use the secondary/extra message as main message */
+
+        MainMessage = Enode->Message;
+        if (!MainMessage)
+        {
+            MainMessage = "";
+        }
+
+        MsgLength = strlen (MainMessage);
+        ExtraMessage = NULL;
+    }
+
+    if (Gbl_VerboseErrors && !PrematureEOF)
+    {
+        if (Total >= 256)
+        {
+            fprintf (OutputFile, "    %s",
+                MainMessage);
+        }
+        else
+        {
+            SourceColumn = Enode->Column + Enode->FilenameLength + 6 + 2;
+            ErrorColumn = ASL_ERROR_LEVEL_LENGTH + 5 + 2 + 1;
+
+            if ((MsgLength + ErrorColumn) < (SourceColumn - 1))
+            {
+                fprintf (OutputFile, "%*s%s",
+                    (int) ((SourceColumn - 1) - ErrorColumn),
+                    MainMessage, " ^ ");
+            }
+            else
+            {
+                fprintf (OutputFile, "%*s %s",
+                    (int) ((SourceColumn - ErrorColumn) + 1), "^",
+                    MainMessage);
+            }
+        }
+    }
+    else
+    {
+        fprintf (OutputFile, " %s", MainMessage);
+    }
+
+    /* Print the extra info message if present */
+
+    if (ExtraMessage)
+    {
+        fprintf (OutputFile, " (%s)", ExtraMessage);
+    }
+
+    if (PrematureEOF)
+    {
+        fprintf (OutputFile, " and premature End-Of-File");
+    }
+
+    fprintf (OutputFile, "\n");
+    if (Gbl_VerboseErrors)
+    {
+        fprintf (OutputFile, "\n");
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AePrintErrorLog
+ *
+ * PARAMETERS:  FileId           - Where to output the error log
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Print the entire contents of the error log
+ *
+ ******************************************************************************/
+
+void
+AePrintErrorLog (
+    UINT32                  FileId)
+{
+    ASL_ERROR_MSG           *Enode = Gbl_ErrorLog;
+
+
+    /* Walk the error node list */
+
+    while (Enode)
+    {
+        AePrintException (FileId, Enode, NULL);
+        Enode = Enode->Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCommonError2
+ *
+ * PARAMETERS:  Level               - Seriousness (Warning/error, etc.)
+ *              MessageId           - Index into global message buffer
+ *              LineNumber          - Actual file line number
+ *              Column              - Column in current line
+ *              SourceLine          - Actual source code line
+ *              Filename            - source filename
+ *              ExtraMessage        - additional error message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create a new error node and add it to the error log
+ *
+ ******************************************************************************/
+
+void
+AslCommonError2 (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    UINT32                  LineNumber,
+    UINT32                  Column,
+    char                    *SourceLine,
+    char                    *Filename,
+    char                    *ExtraMessage)
+{
+    char                    *MessageBuffer = NULL;
+    char                    *LineBuffer;
+    ASL_ERROR_MSG           *Enode;
+
+
+    Enode = UtLocalCalloc (sizeof (ASL_ERROR_MSG));
+
+    if (ExtraMessage)
+    {
+        /* Allocate a buffer for the message and a new error node */
+
+        MessageBuffer = UtStringCacheCalloc (strlen (ExtraMessage) + 1);
+
+        /* Keep a copy of the extra message */
+
+        strcpy (MessageBuffer, ExtraMessage);
+    }
+
+    LineBuffer = UtLocalCalloc (strlen (SourceLine) + 1);
+    strcpy (LineBuffer, SourceLine);
+
+    /* Initialize the error node */
+
+    if (Filename)
+    {
+        Enode->Filename = Filename;
+        Enode->FilenameLength = strlen (Filename);
+        if (Enode->FilenameLength < 6)
+        {
+            Enode->FilenameLength = 6;
+        }
+    }
+
+    Enode->MessageId            = MessageId;
+    Enode->Level                = Level;
+    Enode->LineNumber           = LineNumber;
+    Enode->LogicalLineNumber    = LineNumber;
+    Enode->LogicalByteOffset    = 0;
+    Enode->Column               = Column;
+    Enode->Message              = MessageBuffer;
+    Enode->SourceLine           = LineBuffer;
+
+    /* Add the new node to the error node list */
+
+    AeAddToErrorLog (Enode);
+
+    if (Gbl_DebugFlag)
+    {
+        /* stderr is a file, send error to it immediately */
+
+        AePrintException (ASL_FILE_STDERR, Enode, NULL);
+    }
+
+    Gbl_ExceptionCount[Level]++;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCommonError
+ *
+ * PARAMETERS:  Level               - Seriousness (Warning/error, etc.)
+ *              MessageId           - Index into global message buffer
+ *              CurrentLineNumber   - Actual file line number
+ *              LogicalLineNumber   - Cumulative line number
+ *              LogicalByteOffset   - Byte offset in source file
+ *              Column              - Column in current line
+ *              Filename            - source filename
+ *              ExtraMessage        - additional error message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create a new error node and add it to the error log
+ *
+ ******************************************************************************/
+
+void
+AslCommonError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    UINT32                  CurrentLineNumber,
+    UINT32                  LogicalLineNumber,
+    UINT32                  LogicalByteOffset,
+    UINT32                  Column,
+    char                    *Filename,
+    char                    *ExtraMessage)
+{
+    char                    *MessageBuffer = NULL;
+    ASL_ERROR_MSG           *Enode;
+
+
+    Enode = UtLocalCalloc (sizeof (ASL_ERROR_MSG));
+
+    if (ExtraMessage)
+    {
+        /* Allocate a buffer for the message and a new error node */
+
+        MessageBuffer = UtStringCacheCalloc (strlen (ExtraMessage) + 1);
+
+        /* Keep a copy of the extra message */
+
+        strcpy (MessageBuffer, ExtraMessage);
+    }
+
+    /* Initialize the error node */
+
+    if (Filename)
+    {
+        Enode->Filename = Filename;
+        Enode->FilenameLength = strlen (Filename);
+        if (Enode->FilenameLength < 6)
+        {
+            Enode->FilenameLength = 6;
+        }
+    }
+
+    Enode->MessageId            = MessageId;
+    Enode->Level                = Level;
+    Enode->LineNumber           = CurrentLineNumber;
+    Enode->LogicalLineNumber    = LogicalLineNumber;
+    Enode->LogicalByteOffset    = LogicalByteOffset;
+    Enode->Column               = Column;
+    Enode->Message              = MessageBuffer;
+    Enode->SourceLine           = NULL;
+
+    /* Add the new node to the error node list */
+
+    AeAddToErrorLog (Enode);
+
+    if (Gbl_DebugFlag)
+    {
+        /* stderr is a file, send error to it immediately */
+
+        AePrintException (ASL_FILE_STDERR, Enode, NULL);
+    }
+
+    Gbl_ExceptionCount[Level]++;
+    if (Gbl_ExceptionCount[ASL_ERROR] > ASL_MAX_ERROR_COUNT)
+    {
+        printf ("\nMaximum error count (%u) exceeded\n", ASL_MAX_ERROR_COUNT);
+
+        Gbl_SourceLine = 0;
+        Gbl_NextError = Gbl_ErrorLog;
+        CmCleanupAndExit ();
+        exit(1);
+    }
+
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDisableException
+ *
+ * PARAMETERS:  MessageIdString     - ID to be disabled
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Enter a message ID into the global disabled messages table
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AslDisableException (
+    char                    *MessageIdString)
+{
+    UINT32                  MessageId;
+
+
+    /* Convert argument to an integer and validate it */
+
+    MessageId = (UINT32) strtoul (MessageIdString, NULL, 0);
+
+    if ((MessageId < 2000) || (MessageId > 5999))
+    {
+        printf ("\"%s\" is not a valid warning/remark ID\n",
+            MessageIdString);
+        return (AE_BAD_PARAMETER);
+    }
+
+    /* Insert value into the global disabled message array */
+
+    if (Gbl_DisabledMessagesIndex >= ASL_MAX_DISABLED_MESSAGES)
+    {
+        printf ("Too many messages have been disabled (max %u)\n",
+            ASL_MAX_DISABLED_MESSAGES);
+        return (AE_LIMIT);
+    }
+
+    Gbl_DisabledMessages[Gbl_DisabledMessagesIndex] = MessageId;
+    Gbl_DisabledMessagesIndex++;
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslIsExceptionDisabled
+ *
+ * PARAMETERS:  Level               - Seriousness (Warning/error, etc.)
+ *              MessageId           - Index into global message buffer
+ *
+ * RETURN:      TRUE if exception/message should be ignored
+ *
+ * DESCRIPTION: Check if the user has specified options such that this
+ *              exception should be ignored
+ *
+ ******************************************************************************/
+
+BOOLEAN
+AslIsExceptionDisabled (
+    UINT8                   Level,
+    UINT16                  MessageId)
+{
+    UINT32                  EncodedMessageId;
+    UINT32                  i;
+
+
+    switch (Level)
+    {
+    case ASL_WARNING2:
+    case ASL_WARNING3:
+
+        /* Check for global disable via -w1/-w2/-w3 options */
+
+        if (Level > Gbl_WarningLevel)
+        {
+            return (TRUE);
+        }
+        /* Fall through */
+
+    case ASL_WARNING:
+    case ASL_REMARK:
+        /*
+         * Ignore this warning/remark if it has been disabled by
+         * the user (-vw option)
+         */
+        EncodedMessageId = AeBuildFullExceptionCode (Level, MessageId);
+        for (i = 0; i < Gbl_DisabledMessagesIndex; i++)
+        {
+            /* Simple implementation via fixed array */
+
+            if (EncodedMessageId == Gbl_DisabledMessages[i])
+            {
+                return (TRUE);
+            }
+        }
+        break;
+
+    default:
+        break;
+    }
+
+    return (FALSE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslError
+ *
+ * PARAMETERS:  Level               - Seriousness (Warning/error, etc.)
+ *              MessageId           - Index into global message buffer
+ *              Op                  - Parse node where error happened
+ *              ExtraMessage        - additional error message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Main error reporting routine for the ASL compiler (all code
+ *              except the parser.)
+ *
+ ******************************************************************************/
+
+void
+AslError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *ExtraMessage)
+{
+
+    /* Check if user wants to ignore this exception */
+
+    if (Gbl_AllExceptionsDisabled ||
+        AslIsExceptionDisabled (Level, MessageId))
+    {
+        return;
+    }
+
+    if (Op)
+    {
+        AslCommonError (Level, MessageId, Op->Asl.LineNumber,
+            Op->Asl.LogicalLineNumber,
+            Op->Asl.LogicalByteOffset,
+            Op->Asl.Column,
+            Op->Asl.Filename, ExtraMessage);
+    }
+    else
+    {
+        AslCommonError (Level, MessageId, 0,
+            0, 0, 0, NULL, ExtraMessage);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCoreSubsystemError
+ *
+ * PARAMETERS:  Op                  - Parse node where error happened
+ *              Status              - The ACPICA Exception
+ *              ExtraMessage        - additional error message
+ *              Abort               - TRUE -> Abort compilation
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Error reporting routine for exceptions returned by the ACPICA
+ *              core subsystem.
+ *
+ ******************************************************************************/
+
+void
+AslCoreSubsystemError (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_STATUS             Status,
+    char                    *ExtraMessage,
+    BOOLEAN                 Abort)
+{
+
+    sprintf (MsgBuffer, "%s %s", AcpiFormatException (Status), ExtraMessage);
+
+    if (Op)
+    {
+        AslCommonError (ASL_ERROR, ASL_MSG_CORE_EXCEPTION,
+            Op->Asl.LineNumber,
+            Op->Asl.LogicalLineNumber,
+            Op->Asl.LogicalByteOffset,
+            Op->Asl.Column,
+            Op->Asl.Filename, MsgBuffer);
+    }
+    else
+    {
+        AslCommonError (ASL_ERROR, ASL_MSG_CORE_EXCEPTION,
+            0, 0, 0, 0, NULL, MsgBuffer);
+    }
+
+    if (Abort)
+    {
+        AslAbort ();
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCompilererror
+ *
+ * PARAMETERS:  CompilerMessage         - Error message from the parser
+ *
+ * RETURN:      Status (0 for now)
+ *
+ * DESCRIPTION: Report an error situation discovered in a production
+ *              NOTE: don't change the name of this function, it is called
+ *              from the auto-generated parser.
+ *
+ ******************************************************************************/
+
+int
+AslCompilererror (
+    const char              *CompilerMessage)
+{
+
+    Gbl_SyntaxError++;
+
+    AslCommonError (ASL_ERROR, ASL_MSG_SYNTAX, Gbl_CurrentLineNumber,
+        Gbl_LogicalLineNumber, Gbl_CurrentLineOffset,
+        Gbl_CurrentColumn, Gbl_Files[ASL_FILE_INPUT].Filename,
+        ACPI_CAST_PTR (char, CompilerMessage));
+
+    return (0);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslexternal.c b/usr/src/cmd/acpi/iasl/aslexternal.c
new file mode 100644
index 0000000000..a814efddd5
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslexternal.c
@@ -0,0 +1,498 @@
+/******************************************************************************
+ *
+ * Module Name: aslexternal - ASL External opcode compiler support
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acparser.h"
+#include "amlcode.h"
+#include "acnamesp.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslexternal")
+
+
+/* Local prototypes */
+
+static void
+ExInsertArgCount (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+ExMoveExternals (
+    ACPI_PARSE_OBJECT       *DefinitionBlockOp);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ExDoExternal
+ *
+ * PARAMETERS:  Op                  - Current Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add an External() definition to the global list. This list
+ *              is used to generate External opcodes.
+ *
+ ******************************************************************************/
+
+void
+ExDoExternal (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *ListOp;
+    ACPI_PARSE_OBJECT       *Prev;
+    ACPI_PARSE_OBJECT       *Next;
+    ACPI_PARSE_OBJECT       *ArgCountOp;
+
+
+    ArgCountOp = Op->Asl.Child->Asl.Next->Asl.Next;
+    ArgCountOp->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+    ArgCountOp->Asl.ParseOpcode = PARSEOP_BYTECONST;
+    ArgCountOp->Asl.Value.Integer = 0;
+    UtSetParseOpName (ArgCountOp);
+
+    /* Create new list node of arbitrary type */
+
+    ListOp = TrAllocateNode (PARSEOP_DEFAULT_ARG);
+
+    /* Store External node as child */
+
+    ListOp->Asl.Child = Op;
+    ListOp->Asl.Next = NULL;
+
+    if (Gbl_ExternalsListHead)
+    {
+        /* Link new External to end of list */
+
+        Prev = Gbl_ExternalsListHead;
+        Next = Prev;
+        while (Next)
+        {
+            Prev = Next;
+            Next = Next->Asl.Next;
+        }
+
+        Prev->Asl.Next = ListOp;
+    }
+    else
+    {
+        Gbl_ExternalsListHead = ListOp;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ExInsertArgCount
+ *
+ * PARAMETERS:  Op              - Op for a method invocation
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Obtain the number of arguments for a control method -- from
+ *              the actual invocation.
+ *
+ ******************************************************************************/
+
+static void
+ExInsertArgCount (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+    ACPI_PARSE_OBJECT       *NameOp;
+    ACPI_PARSE_OBJECT       *Child;
+    ACPI_PARSE_OBJECT       *ArgCountOp;
+    char *                  ExternalName;
+    char *                  CallName;
+    UINT16                  ArgCount = 0;
+    ACPI_STATUS             Status;
+
+
+    CallName = AcpiNsGetNormalizedPathname (Op->Asl.Node, TRUE);
+
+    Next = Gbl_ExternalsListHead;
+    while (Next)
+    {
+        ArgCount = 0;
+
+        /* Skip if External node already handled */
+
+        if (Next->Asl.Child->Asl.CompileFlags & NODE_VISITED)
+        {
+            Next = Next->Asl.Next;
+            continue;
+        }
+
+        NameOp = Next->Asl.Child->Asl.Child;
+        ExternalName = AcpiNsGetNormalizedPathname (NameOp->Asl.Node, TRUE);
+
+        if (strcmp (CallName, ExternalName))
+        {
+            ACPI_FREE (ExternalName);
+            Next = Next->Asl.Next;
+            continue;
+        }
+
+        Next->Asl.Child->Asl.CompileFlags |= NODE_VISITED;
+
+        /*
+         * Since we will reposition Externals to the Root, set Namepath
+         * to the fully qualified name and recalculate the aml length
+         */
+        Status = UtInternalizeName (ExternalName,
+            &NameOp->Asl.Value.String);
+
+        ACPI_FREE (ExternalName);
+        if (ACPI_FAILURE (Status))
+        {
+            AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL,
+                NULL, "- Could not Internalize External");
+            break;
+        }
+
+        NameOp->Asl.AmlLength = strlen (NameOp->Asl.Value.String);
+
+        /* Get argument count */
+
+        Child = Op->Asl.Child;
+        while (Child)
+        {
+            ArgCount++;
+            Child = Child->Asl.Next;
+        }
+
+        /* Setup ArgCount operand */
+
+        ArgCountOp = Next->Asl.Child->Asl.Child->Asl.Next->Asl.Next;
+        ArgCountOp->Asl.Value.Integer = ArgCount;
+        break;
+    }
+
+    ACPI_FREE (CallName);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ExAmlExternalWalkBegin
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Parse tree walk to create external opcode list for methods.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+ExAmlExternalWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    /* External list head saved in the definition block op */
+
+    if (Op->Asl.ParseOpcode == PARSEOP_DEFINITION_BLOCK)
+    {
+        Gbl_ExternalsListHead = Op->Asl.Value.Arg;
+    }
+
+    if (!Gbl_ExternalsListHead)
+    {
+        return (AE_OK);
+    }
+
+    if (Op->Asl.ParseOpcode != PARSEOP_METHODCALL)
+    {
+        return (AE_OK);
+    }
+
+    /*
+     * The NameOp child under an ExternalOp gets turned into PARSE_METHODCALL
+     * by XfNamespaceLocateBegin(). Ignore these.
+     */
+    if (Op->Asl.Parent &&
+        Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_EXTERNAL)
+    {
+        return (AE_OK);
+    }
+
+    ExInsertArgCount (Op);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ExAmlExternalWalkEnd
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Parse tree walk to create external opcode list for methods.
+ *              Here, we just want to catch the case where a definition block
+ *              has been completed. Then we move all of the externals into
+ *              a single block in the parse tree and thus the AML code.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+ExAmlExternalWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    if (Op->Asl.ParseOpcode == PARSEOP_DEFINITION_BLOCK)
+    {
+        /*
+         * Process any existing external list. (Support for
+         * multiple definition blocks in a single file/compile)
+         */
+        ExMoveExternals (Op);
+        Gbl_ExternalsListHead = NULL;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ExMoveExternals
+ *
+ * PARAMETERS:  DefinitionBlockOp       - Op for current definition block
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Move all externals present in the source file into a single
+ *              block of AML code, surrounded by an "If (0)" to prevent
+ *              AML interpreters from attempting to execute the External
+ *              opcodes.
+ *
+ ******************************************************************************/
+
+static void
+ExMoveExternals (
+    ACPI_PARSE_OBJECT       *DefinitionBlockOp)
+{
+    ACPI_PARSE_OBJECT       *ParentOp;
+    ACPI_PARSE_OBJECT       *ExternalOp;
+    ACPI_PARSE_OBJECT       *PredicateOp;
+    ACPI_PARSE_OBJECT       *NextOp;
+    ACPI_PARSE_OBJECT       *Prev;
+    ACPI_PARSE_OBJECT       *Next;
+    ACPI_OBJECT_TYPE        ObjType;
+    UINT32                  i;
+
+
+    if (!Gbl_ExternalsListHead)
+    {
+        return;
+    }
+
+    /* Remove the External nodes from the tree */
+
+    NextOp = Gbl_ExternalsListHead;
+    while (NextOp)
+    {
+        /*
+         * The External is stored in child pointer of each node in the
+         * list
+         */
+        ExternalOp = NextOp->Asl.Child;
+
+        /* Set line numbers (for listings, etc.) */
+
+        ExternalOp->Asl.LineNumber = 0;
+        ExternalOp->Asl.LogicalLineNumber = 0;
+
+        Next = ExternalOp->Asl.Child;
+        Next->Asl.LineNumber = 0;
+        Next->Asl.LogicalLineNumber = 0;
+
+        Next = Next->Asl.Next;
+        Next->Asl.LineNumber = 0;
+        Next->Asl.LogicalLineNumber = 0;
+
+        Next = Next->Asl.Next;
+        Next->Asl.LineNumber = 0;
+        Next->Asl.LogicalLineNumber = 0;
+
+        Next = Next->Asl.Next;
+        Next->Asl.LineNumber = 0;
+        Next->Asl.LogicalLineNumber = 0;
+
+        ParentOp = ExternalOp->Asl.Parent;
+        Prev = Next = ParentOp->Asl.Child;
+
+        /* Now find the External node's position in parse tree */
+
+        while (Next != ExternalOp)
+        {
+            Prev = Next;
+            Next = Next->Asl.Next;
+        }
+
+        /* Remove the External from the parse tree */
+
+        if (Prev == ExternalOp)
+        {
+            /* External was the first child node */
+
+            ParentOp->Asl.Child = ExternalOp->Asl.Next;
+        }
+
+        Prev->Asl.Next = ExternalOp->Asl.Next;
+        ExternalOp->Asl.Next = NULL;
+        ExternalOp->Asl.Parent = Gbl_ExternalsListHead;
+
+        /* Point the External to the next in the list */
+
+        if (NextOp->Asl.Next)
+        {
+            ExternalOp->Asl.Next = NextOp->Asl.Next->Asl.Child;
+        }
+
+        NextOp = NextOp->Asl.Next;
+    }
+
+    /*
+     * Loop again to remove MethodObj Externals for which
+     * a MethodCall was not found (dead external reference)
+     */
+    Prev = Gbl_ExternalsListHead->Asl.Child;
+    Next = Prev;
+    while (Next)
+    {
+        ObjType = (ACPI_OBJECT_TYPE)
+            Next->Asl.Child->Asl.Next->Asl.Value.Integer;
+
+        if (ObjType == ACPI_TYPE_METHOD &&
+            !(Next->Asl.CompileFlags & NODE_VISITED))
+        {
+            if (Next == Prev)
+            {
+                Gbl_ExternalsListHead->Asl.Child = Next->Asl.Next;
+                Next->Asl.Next = NULL;
+                Prev = Gbl_ExternalsListHead->Asl.Child;
+                Next = Prev;
+                continue;
+            }
+            else
+            {
+                Prev->Asl.Next = Next->Asl.Next;
+                Next->Asl.Next = NULL;
+                Next = Prev->Asl.Next;
+                continue;
+            }
+        }
+
+        Prev = Next;
+        Next = Next->Asl.Next;
+    }
+
+    /* If list is now empty, don't bother to make If (0) block */
+
+    if (!Gbl_ExternalsListHead->Asl.Child)
+    {
+        return;
+    }
+
+    /* Convert Gbl_ExternalsListHead parent to If(). */
+
+    Gbl_ExternalsListHead->Asl.ParseOpcode = PARSEOP_IF;
+    Gbl_ExternalsListHead->Asl.AmlOpcode = AML_IF_OP;
+    Gbl_ExternalsListHead->Asl.CompileFlags = NODE_AML_PACKAGE;
+    UtSetParseOpName (Gbl_ExternalsListHead);
+
+    /* Create a Zero op for the If predicate */
+
+    PredicateOp = TrAllocateNode (PARSEOP_ZERO);
+    PredicateOp->Asl.AmlOpcode = AML_ZERO_OP;
+
+    PredicateOp->Asl.Parent = Gbl_ExternalsListHead;
+    PredicateOp->Asl.Child = NULL;
+    PredicateOp->Asl.Next = Gbl_ExternalsListHead->Asl.Child;
+    Gbl_ExternalsListHead->Asl.Child = PredicateOp;
+
+    /* Set line numbers (for listings, etc.) */
+
+    Gbl_ExternalsListHead->Asl.LineNumber = 0;
+    Gbl_ExternalsListHead->Asl.LogicalLineNumber = 0;
+
+    PredicateOp->Asl.LineNumber = 0;
+    PredicateOp->Asl.LogicalLineNumber = 0;
+
+    /* Insert block back in the list */
+
+    Prev = DefinitionBlockOp->Asl.Child;
+    Next = Prev;
+
+    /* Find last default arg */
+
+    for (i = 0; i < 6; i++)
+    {
+        Prev = Next;
+        Next = Prev->Asl.Next;
+    }
+
+    if (Next)
+    {
+        /* Definition Block is not empty */
+
+        Gbl_ExternalsListHead->Asl.Next = Next;
+    }
+    else
+    {
+        /* Definition Block is empty. */
+
+        Gbl_ExternalsListHead->Asl.Next = NULL;
+    }
+
+    Prev->Asl.Next = Gbl_ExternalsListHead;
+    Gbl_ExternalsListHead->Asl.Parent = Prev->Asl.Parent;
+}
diff --git a/usr/src/cmd/acpi/iasl/aslfileio.c b/usr/src/cmd/acpi/iasl/aslfileio.c
new file mode 100644
index 0000000000..40f3562c0e
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslfileio.c
@@ -0,0 +1,401 @@
+/******************************************************************************
+ *
+ * Module Name: aslfileio - File I/O support
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acapps.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslfileio")
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlFileError
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *              ErrorId             - Index into error message array
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Decode errno to an error message and add the entire error
+ *              to the error log.
+ *
+ ******************************************************************************/
+
+void
+FlFileError (
+    UINT32                  FileId,
+    UINT8                   ErrorId)
+{
+
+    sprintf (MsgBuffer, "\"%s\" (%s) - %s", Gbl_Files[FileId].Filename,
+        Gbl_Files[FileId].Description, strerror (errno));
+
+    AslCommonError (ASL_ERROR, ErrorId, 0, 0, 0, 0, NULL, MsgBuffer);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlOpenFile
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *              Filename            - file pathname to open
+ *              Mode                - Open mode for fopen
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Open a file.
+ *              NOTE: Aborts compiler on any error.
+ *
+ ******************************************************************************/
+
+void
+FlOpenFile (
+    UINT32                  FileId,
+    char                    *Filename,
+    char                    *Mode)
+{
+    FILE                    *File;
+
+
+    Gbl_Files[FileId].Filename = Filename;
+    Gbl_Files[FileId].Handle = NULL;
+
+    File = fopen (Filename, Mode);
+    if (!File)
+    {
+        FlFileError (FileId, ASL_MSG_OPEN);
+        AslAbort ();
+    }
+
+    Gbl_Files[FileId].Handle = File;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlGetFileSize
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *
+ * RETURN:      File Size
+ *
+ * DESCRIPTION: Get current file size. Uses common seek-to-EOF function.
+ *              File must be open. Aborts compiler on error.
+ *
+ ******************************************************************************/
+
+UINT32
+FlGetFileSize (
+    UINT32                  FileId)
+{
+    UINT32                  FileSize;
+
+
+    FileSize = CmGetFileSize (Gbl_Files[FileId].Handle);
+    if (FileSize == ACPI_UINT32_MAX)
+    {
+        AslAbort();
+    }
+
+    return (FileSize);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlReadFile
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *              Buffer              - Where to place the data
+ *              Length              - Amount to read
+ *
+ * RETURN:      Status. AE_ERROR indicates EOF.
+ *
+ * DESCRIPTION: Read data from an open file.
+ *              NOTE: Aborts compiler on any error.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+FlReadFile (
+    UINT32                  FileId,
+    void                    *Buffer,
+    UINT32                  Length)
+{
+    UINT32                  Actual;
+
+
+    /* Read and check for error */
+
+    Actual = fread (Buffer, 1, Length, Gbl_Files[FileId].Handle);
+    if (Actual < Length)
+    {
+        if (feof (Gbl_Files[FileId].Handle))
+        {
+            /* End-of-file, just return error */
+
+            return (AE_ERROR);
+        }
+
+        FlFileError (FileId, ASL_MSG_READ);
+        AslAbort ();
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlWriteFile
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *              Buffer              - Data to write
+ *              Length              - Amount of data to write
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write data to an open file.
+ *              NOTE: Aborts compiler on any error.
+ *
+ ******************************************************************************/
+
+void
+FlWriteFile (
+    UINT32                  FileId,
+    void                    *Buffer,
+    UINT32                  Length)
+{
+    UINT32                  Actual;
+
+
+    /* Write and check for error */
+
+    Actual = fwrite ((char *) Buffer, 1, Length, Gbl_Files[FileId].Handle);
+    if (Actual != Length)
+    {
+        FlFileError (FileId, ASL_MSG_WRITE);
+        AslAbort ();
+    }
+
+    if ((FileId == ASL_FILE_PREPROCESSOR) && Gbl_PreprocessorOutputFlag)
+    {
+        /* Duplicate the output to the user preprocessor (.i) file */
+
+        Actual = fwrite ((char *) Buffer, 1, Length,
+            Gbl_Files[ASL_FILE_PREPROCESSOR_USER].Handle);
+        if (Actual != Length)
+        {
+            FlFileError (FileId, ASL_MSG_WRITE);
+            AslAbort ();
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlPrintFile
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *              Format              - Printf format string
+ *              ...                 - Printf arguments
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Formatted write to an open file.
+ *              NOTE: Aborts compiler on any error.
+ *
+ ******************************************************************************/
+
+void
+FlPrintFile (
+    UINT32                  FileId,
+    char                    *Format,
+    ...)
+{
+    INT32                   Actual;
+    va_list                 Args;
+
+
+    va_start (Args, Format);
+    Actual = vfprintf (Gbl_Files[FileId].Handle, Format, Args);
+    va_end (Args);
+
+    if (Actual == -1)
+    {
+        FlFileError (FileId, ASL_MSG_WRITE);
+        AslAbort ();
+    }
+
+    if ((FileId == ASL_FILE_PREPROCESSOR) &&
+        Gbl_PreprocessorOutputFlag)
+    {
+        /*
+         * Duplicate the output to the user preprocessor (.i) file,
+         * except: no #line directives.
+         */
+        if (!strncmp (Format, "#line", 5))
+        {
+            return;
+        }
+
+        va_start (Args, Format);
+        Actual = vfprintf (Gbl_Files[ASL_FILE_PREPROCESSOR_USER].Handle,
+            Format, Args);
+        va_end (Args);
+
+        if (Actual == -1)
+        {
+            FlFileError (FileId, ASL_MSG_WRITE);
+            AslAbort ();
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlSeekFile
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *              Offset              - Absolute byte offset in file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Seek to absolute offset.
+ *              NOTE: Aborts compiler on any error.
+ *
+ ******************************************************************************/
+
+void
+FlSeekFile (
+    UINT32                  FileId,
+    long                    Offset)
+{
+    int                     Error;
+
+
+    Error = fseek (Gbl_Files[FileId].Handle, Offset, SEEK_SET);
+    if (Error)
+    {
+        FlFileError (FileId, ASL_MSG_SEEK);
+        AslAbort ();
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlCloseFile
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Close an open file. Aborts compiler on error
+ *
+ ******************************************************************************/
+
+void
+FlCloseFile (
+    UINT32                  FileId)
+{
+    int                     Error;
+
+
+    if (!Gbl_Files[FileId].Handle)
+    {
+        return;
+    }
+
+    Error = fclose (Gbl_Files[FileId].Handle);
+    if (Error)
+    {
+        FlFileError (FileId, ASL_MSG_CLOSE);
+        AslAbort ();
+    }
+
+    /* Do not clear/free the filename string */
+
+    Gbl_Files[FileId].Handle = NULL;
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlDeleteFile
+ *
+ * PARAMETERS:  FileId              - Index into file info array
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Delete a file.
+ *
+ ******************************************************************************/
+
+void
+FlDeleteFile (
+    UINT32                  FileId)
+{
+    ASL_FILE_INFO           *Info = &Gbl_Files[FileId];
+
+
+    if (!Info->Filename)
+    {
+        return;
+    }
+
+    if (remove (Info->Filename))
+    {
+        printf ("%s (%s file) ",
+            Info->Filename, Info->Description);
+        perror ("Could not delete");
+    }
+
+    Info->Filename = NULL;
+    return;
+}
diff --git a/usr/src/cmd/acpi/iasl/aslfiles.c b/usr/src/cmd/acpi/iasl/aslfiles.c
new file mode 100644
index 0000000000..52939f433d
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslfiles.c
@@ -0,0 +1,927 @@
+/******************************************************************************
+ *
+ * Module Name: aslfiles - File support functions
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acapps.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslfiles")
+
+/* Local prototypes */
+
+static FILE *
+FlOpenIncludeWithPrefix (
+    char                    *PrefixDir,
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Filename);
+
+#ifdef ACPI_OBSOLETE_FUNCTIONS
+ACPI_STATUS
+FlParseInputPathname (
+    char                    *InputFilename);
+#endif
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlSetLineNumber
+ *
+ * PARAMETERS:  Op        - Parse node for the LINE asl statement
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Set the current line number
+ *
+ ******************************************************************************/
+
+void
+FlSetLineNumber (
+    UINT32                  LineNumber)
+{
+
+    DbgPrint (ASL_PARSE_OUTPUT, "\n#line: New line number %u (old %u)\n",
+         LineNumber, Gbl_LogicalLineNumber);
+
+    Gbl_CurrentLineNumber = LineNumber;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlSetFilename
+ *
+ * PARAMETERS:  Op        - Parse node for the LINE asl statement
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Set the current filename
+ *
+ ******************************************************************************/
+
+void
+FlSetFilename (
+    char                    *Filename)
+{
+
+    DbgPrint (ASL_PARSE_OUTPUT, "\n#line: New filename %s (old %s)\n",
+         Filename, Gbl_Files[ASL_FILE_INPUT].Filename);
+
+    /* No need to free any existing filename */
+
+    Gbl_Files[ASL_FILE_INPUT].Filename = Filename;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlAddIncludeDirectory
+ *
+ * PARAMETERS:  Dir             - Directory pathname string
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add a directory the list of include prefix directories.
+ *
+ ******************************************************************************/
+
+void
+FlAddIncludeDirectory (
+    char                    *Dir)
+{
+    ASL_INCLUDE_DIR         *NewDir;
+    ASL_INCLUDE_DIR         *NextDir;
+    ASL_INCLUDE_DIR         *PrevDir = NULL;
+    UINT32                  NeedsSeparator = 0;
+    size_t                  DirLength;
+
+
+    DirLength = strlen (Dir);
+    if (!DirLength)
+    {
+        return;
+    }
+
+    /* Make sure that the pathname ends with a path separator */
+
+    if ((Dir[DirLength-1] != '/') &&
+        (Dir[DirLength-1] != '\\'))
+    {
+        NeedsSeparator = 1;
+    }
+
+    NewDir = ACPI_ALLOCATE_ZEROED (sizeof (ASL_INCLUDE_DIR));
+    NewDir->Dir = ACPI_ALLOCATE (DirLength + 1 + NeedsSeparator);
+    strcpy (NewDir->Dir, Dir);
+    if (NeedsSeparator)
+    {
+        strcat (NewDir->Dir, "/");
+    }
+
+    /*
+     * Preserve command line ordering of -I options by adding new elements
+     * at the end of the list
+     */
+    NextDir = Gbl_IncludeDirList;
+    while (NextDir)
+    {
+        PrevDir = NextDir;
+        NextDir = NextDir->Next;
+    }
+
+    if (PrevDir)
+    {
+        PrevDir->Next = NewDir;
+    }
+    else
+    {
+        Gbl_IncludeDirList = NewDir;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlMergePathnames
+ *
+ * PARAMETERS:  PrefixDir       - Prefix directory pathname. Can be NULL or
+ *                                a zero length string.
+ *              FilePathname    - The include filename from the source ASL.
+ *
+ * RETURN:      Merged pathname string
+ *
+ * DESCRIPTION: Merge two pathnames that (probably) have common elements, to
+ *              arrive at a minimal length string. Merge can occur if the
+ *              FilePathname is relative to the PrefixDir.
+ *
+ ******************************************************************************/
+
+char *
+FlMergePathnames (
+    char                    *PrefixDir,
+    char                    *FilePathname)
+{
+    char                    *CommonPath;
+    char                    *Pathname;
+    char                    *LastElement;
+
+
+    DbgPrint (ASL_PARSE_OUTPUT, "Include: Prefix path - \"%s\"\n"
+        "Include: FilePathname - \"%s\"\n",
+         PrefixDir, FilePathname);
+
+    /*
+     * If there is no prefix directory or if the file pathname is absolute,
+     * just return the original file pathname
+     */
+    if (!PrefixDir || (!*PrefixDir) ||
+        (*FilePathname == '/') ||
+         (FilePathname[1] == ':'))
+    {
+        Pathname = UtStringCacheCalloc (strlen (FilePathname) + 1);
+        strcpy (Pathname, FilePathname);
+        goto ConvertBackslashes;
+    }
+
+    /* Need a local copy of the prefix directory path */
+
+    CommonPath = UtStringCacheCalloc (strlen (PrefixDir) + 1);
+    strcpy (CommonPath, PrefixDir);
+
+    /*
+     * Walk forward through the file path, and simultaneously backward
+     * through the prefix directory path until there are no more
+     * relative references at the start of the file path.
+     */
+    while (*FilePathname && (!strncmp (FilePathname, "../", 3)))
+    {
+        /* Remove last element of the prefix directory path */
+
+        LastElement = strrchr (CommonPath, '/');
+        if (!LastElement)
+        {
+            goto ConcatenatePaths;
+        }
+
+        *LastElement = 0;   /* Terminate CommonPath string */
+        FilePathname += 3;  /* Point to next path element */
+    }
+
+    /*
+     * Remove the last element of the prefix directory path (it is the same as
+     * the first element of the file pathname), and build the final merged
+     * pathname.
+     */
+    LastElement = strrchr (CommonPath, '/');
+    if (LastElement)
+    {
+        *LastElement = 0;
+    }
+
+    /* Build the final merged pathname */
+
+ConcatenatePaths:
+    Pathname = UtStringCacheCalloc (
+        strlen (CommonPath) + strlen (FilePathname) + 2);
+    if (LastElement && *CommonPath)
+    {
+        strcpy (Pathname, CommonPath);
+        strcat (Pathname, "/");
+    }
+    strcat (Pathname, FilePathname);
+
+    /* Convert all backslashes to normal slashes */
+
+ConvertBackslashes:
+    UtConvertBackslashes (Pathname);
+
+    DbgPrint (ASL_PARSE_OUTPUT, "Include: Merged Pathname - \"%s\"\n",
+         Pathname);
+    return (Pathname);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlOpenIncludeWithPrefix
+ *
+ * PARAMETERS:  PrefixDir       - Prefix directory pathname. Can be a zero
+ *                                length string.
+ *              Filename        - The include filename from the source ASL.
+ *
+ * RETURN:      Valid file descriptor if successful. Null otherwise.
+ *
+ * DESCRIPTION: Open an include file and push it on the input file stack.
+ *
+ ******************************************************************************/
+
+static FILE *
+FlOpenIncludeWithPrefix (
+    char                    *PrefixDir,
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Filename)
+{
+    FILE                    *IncludeFile;
+    char                    *Pathname;
+    UINT32                  OriginalLineNumber;
+
+
+    /* Build the full pathname to the file */
+
+    Pathname = FlMergePathnames (PrefixDir, Filename);
+
+    DbgPrint (ASL_PARSE_OUTPUT, "Include: Opening file - \"%s\"\n\n",
+        Pathname);
+
+    /* Attempt to open the file, push if successful */
+
+    IncludeFile = fopen (Pathname, "r");
+    if (!IncludeFile)
+    {
+        fprintf (stderr, "Could not open include file %s\n", Pathname);
+        ACPI_FREE (Pathname);
+        return (NULL);
+    }
+
+    /*
+     * Check the entire include file for any # preprocessor directives.
+     * This is because there may be some confusion between the #include
+     * preprocessor directive and the ASL Include statement. A file included
+     * by the ASL include cannot contain preprocessor directives because
+     * the preprocessor has already run by the time the ASL include is
+     * recognized (by the compiler, not the preprocessor.)
+     *
+     * Note: DtGetNextLine strips/ignores comments.
+     * Save current line number since DtGetNextLine modifies it.
+     */
+    Gbl_CurrentLineNumber--;
+    OriginalLineNumber = Gbl_CurrentLineNumber;
+
+    while (DtGetNextLine (IncludeFile, DT_ALLOW_MULTILINE_QUOTES) != ASL_EOF)
+    {
+        if (Gbl_CurrentLineBuffer[0] == '#')
+        {
+            AslError (ASL_ERROR, ASL_MSG_INCLUDE_FILE,
+                Op, "use #include instead");
+        }
+    }
+
+    Gbl_CurrentLineNumber = OriginalLineNumber;
+
+    /* Must seek back to the start of the file */
+
+    fseek (IncludeFile, 0, SEEK_SET);
+
+    /* Push the include file on the open input file stack */
+
+    AslPushInputFileStack (IncludeFile, Pathname);
+    return (IncludeFile);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlOpenIncludeFile
+ *
+ * PARAMETERS:  Op        - Parse node for the INCLUDE ASL statement
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Open an include file and push it on the input file stack.
+ *
+ ******************************************************************************/
+
+void
+FlOpenIncludeFile (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    FILE                    *IncludeFile;
+    ASL_INCLUDE_DIR         *NextDir;
+
+
+    /* Op must be valid */
+
+    if (!Op)
+    {
+        AslCommonError (ASL_ERROR, ASL_MSG_INCLUDE_FILE_OPEN,
+            Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+            Gbl_InputByteCount, Gbl_CurrentColumn,
+            Gbl_Files[ASL_FILE_INPUT].Filename, " - Null parse node");
+
+        return;
+    }
+
+    /*
+     * Flush out the "include ()" statement on this line, start
+     * the actual include file on the next line
+     */
+    AslResetCurrentLineBuffer ();
+    FlPrintFile (ASL_FILE_SOURCE_OUTPUT, "\n");
+    Gbl_CurrentLineOffset++;
+
+
+    /* Attempt to open the include file */
+
+    /* If the file specifies an absolute path, just open it */
+
+    if ((Op->Asl.Value.String[0] == '/')  ||
+        (Op->Asl.Value.String[0] == '\\') ||
+        (Op->Asl.Value.String[1] == ':'))
+    {
+        IncludeFile = FlOpenIncludeWithPrefix ("", Op, Op->Asl.Value.String);
+        if (!IncludeFile)
+        {
+            goto ErrorExit;
+        }
+        return;
+    }
+
+    /*
+     * The include filename is not an absolute path.
+     *
+     * First, search for the file within the "local" directory -- meaning
+     * the same directory that contains the source file.
+     *
+     * Construct the file pathname from the global directory name.
+     */
+    IncludeFile = FlOpenIncludeWithPrefix (
+        Gbl_DirectoryPath, Op, Op->Asl.Value.String);
+    if (IncludeFile)
+    {
+        return;
+    }
+
+    /*
+     * Second, search for the file within the (possibly multiple) directories
+     * specified by the -I option on the command line.
+     */
+    NextDir = Gbl_IncludeDirList;
+    while (NextDir)
+    {
+        IncludeFile = FlOpenIncludeWithPrefix (
+            NextDir->Dir, Op, Op->Asl.Value.String);
+        if (IncludeFile)
+        {
+            return;
+        }
+
+        NextDir = NextDir->Next;
+    }
+
+    /* We could not open the include file after trying very hard */
+
+ErrorExit:
+    sprintf (MsgBuffer, "%s, %s", Op->Asl.Value.String, strerror (errno));
+    AslError (ASL_ERROR, ASL_MSG_INCLUDE_FILE_OPEN, Op, MsgBuffer);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlOpenInputFile
+ *
+ * PARAMETERS:  InputFilename       - The user-specified ASL source file to be
+ *                                    compiled
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Open the specified input file, and save the directory path to
+ *              the file so that include files can be opened in
+ *              the same directory.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+FlOpenInputFile (
+    char                    *InputFilename)
+{
+
+    /* Open the input ASL file, text mode */
+
+    FlOpenFile (ASL_FILE_INPUT, InputFilename, "rt");
+    AslCompilerin = Gbl_Files[ASL_FILE_INPUT].Handle;
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlOpenAmlOutputFile
+ *
+ * PARAMETERS:  FilenamePrefix       - The user-specified ASL source file
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Create the output filename (*.AML) and open the file. The file
+ *              is created in the same directory as the parent input file.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+FlOpenAmlOutputFile (
+    char                    *FilenamePrefix)
+{
+    char                    *Filename;
+
+
+    /* Output filename usually comes from the ASL itself */
+
+    Filename = Gbl_Files[ASL_FILE_AML_OUTPUT].Filename;
+    if (!Filename)
+    {
+        /* Create the output AML filename */
+
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_AML_CODE);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_OUTPUT_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        Gbl_Files[ASL_FILE_AML_OUTPUT].Filename = Filename;
+    }
+
+    /* Open the output AML file in binary mode */
+
+    FlOpenFile (ASL_FILE_AML_OUTPUT, Filename, "w+b");
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlOpenMiscOutputFiles
+ *
+ * PARAMETERS:  FilenamePrefix       - The user-specified ASL source file
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Create and open the various output files needed, depending on
+ *              the command line options
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+FlOpenMiscOutputFiles (
+    char                    *FilenamePrefix)
+{
+    char                    *Filename;
+
+
+     /* Create/Open a map file if requested */
+
+    if (Gbl_MapfileFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_MAP);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the hex file, text mode (closed at compiler exit) */
+
+        FlOpenFile (ASL_FILE_MAP_OUTPUT, Filename, "w+t");
+
+        AslCompilerSignon (ASL_FILE_MAP_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_MAP_OUTPUT);
+    }
+
+    /* All done for disassembler */
+
+    if (Gbl_FileType == ASL_INPUT_TYPE_BINARY_ACPI_TABLE)
+    {
+        return (AE_OK);
+    }
+
+    /* Create/Open a hex output file if asked */
+
+    if (Gbl_HexOutputFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_HEX_DUMP);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the hex file, text mode */
+
+        FlOpenFile (ASL_FILE_HEX_OUTPUT, Filename, "w+t");
+
+        AslCompilerSignon (ASL_FILE_HEX_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_HEX_OUTPUT);
+    }
+
+    /* Create/Open a debug output file if asked */
+
+    if (Gbl_DebugFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_DEBUG);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_DEBUG_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the debug file as STDERR, text mode */
+
+        Gbl_Files[ASL_FILE_DEBUG_OUTPUT].Filename = Filename;
+        Gbl_Files[ASL_FILE_DEBUG_OUTPUT].Handle =
+            freopen (Filename, "w+t", stderr);
+
+        if (!Gbl_Files[ASL_FILE_DEBUG_OUTPUT].Handle)
+        {
+            /*
+             * A problem with freopen is that on error, we no longer
+             * have stderr and cannot emit normal error messages.
+             * Emit error to stdout, close files, and exit.
+             */
+            fprintf (stdout,
+                "\nCould not open debug output file: %s\n\n", Filename);
+
+            CmCleanupAndExit ();
+            exit (1);
+        }
+
+        AslCompilerSignon (ASL_FILE_DEBUG_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_DEBUG_OUTPUT);
+    }
+
+    /* Create/Open a cross-reference output file if asked */
+
+    if (Gbl_CrossReferenceOutput)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_XREF);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_DEBUG_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        FlOpenFile (ASL_FILE_XREF_OUTPUT, Filename, "w+t");
+
+        AslCompilerSignon (ASL_FILE_XREF_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_XREF_OUTPUT);
+    }
+
+    /* Create/Open a listing output file if asked */
+
+    if (Gbl_ListingFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_LISTING);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the listing file, text mode */
+
+        FlOpenFile (ASL_FILE_LISTING_OUTPUT, Filename, "w+t");
+
+        AslCompilerSignon (ASL_FILE_LISTING_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_LISTING_OUTPUT);
+    }
+
+    /* Create the preprocessor output temp file if preprocessor enabled */
+
+    if (Gbl_PreprocessFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_PREPROCESSOR);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_PREPROCESSOR_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        FlOpenFile (ASL_FILE_PREPROCESSOR, Filename, "w+t");
+    }
+
+    /*
+     * Create the "user" preprocessor output file if -li flag set.
+     * Note, this file contains no embedded #line directives.
+     */
+    if (Gbl_PreprocessorOutputFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_PREPROC_USER);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_PREPROCESSOR_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        FlOpenFile (ASL_FILE_PREPROCESSOR_USER, Filename, "w+t");
+    }
+
+    /* All done for data table compiler */
+
+    if (Gbl_FileType == ASL_INPUT_TYPE_ASCII_DATA)
+    {
+        return (AE_OK);
+    }
+
+    /* Create/Open a combined source output file */
+
+    Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_SOURCE);
+    if (!Filename)
+    {
+        AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+            0, 0, 0, 0, NULL, NULL);
+        return (AE_ERROR);
+    }
+
+    /*
+     * Open the source output file, binary mode (so that LF does not get
+     * expanded to CR/LF on some systems, messing up our seek
+     * calculations.)
+     */
+    FlOpenFile (ASL_FILE_SOURCE_OUTPUT, Filename, "w+b");
+
+/*
+// TBD: TEMP
+//    AslCompilerin = Gbl_Files[ASL_FILE_SOURCE_OUTPUT].Handle;
+*/
+    /* Create/Open a assembly code source output file if asked */
+
+    if (Gbl_AsmOutputFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_ASM_SOURCE);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the assembly code source file, text mode */
+
+        FlOpenFile (ASL_FILE_ASM_SOURCE_OUTPUT, Filename, "w+t");
+
+        AslCompilerSignon (ASL_FILE_ASM_SOURCE_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_ASM_SOURCE_OUTPUT);
+    }
+
+    /* Create/Open a C code source output file if asked */
+
+    if (Gbl_C_OutputFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_C_SOURCE);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the C code source file, text mode */
+
+        FlOpenFile (ASL_FILE_C_SOURCE_OUTPUT, Filename, "w+t");
+
+        FlPrintFile (ASL_FILE_C_SOURCE_OUTPUT, "/*\n");
+        AslCompilerSignon (ASL_FILE_C_SOURCE_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_C_SOURCE_OUTPUT);
+    }
+
+    /* Create/Open a C code source output file for the offset table if asked */
+
+    if (Gbl_C_OffsetTableFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_C_OFFSET);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the C code source file, text mode */
+
+        FlOpenFile (ASL_FILE_C_OFFSET_OUTPUT, Filename, "w+t");
+
+        FlPrintFile (ASL_FILE_C_OFFSET_OUTPUT, "/*\n");
+        AslCompilerSignon (ASL_FILE_C_OFFSET_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_C_OFFSET_OUTPUT);
+    }
+
+    /* Create/Open a assembly include output file if asked */
+
+    if (Gbl_AsmIncludeOutputFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_ASM_INCLUDE);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the assembly include file, text mode */
+
+        FlOpenFile (ASL_FILE_ASM_INCLUDE_OUTPUT, Filename, "w+t");
+
+        AslCompilerSignon (ASL_FILE_ASM_INCLUDE_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_ASM_INCLUDE_OUTPUT);
+    }
+
+    /* Create/Open a C include output file if asked */
+
+    if (Gbl_C_IncludeOutputFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_C_INCLUDE);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the C include file, text mode */
+
+        FlOpenFile (ASL_FILE_C_INCLUDE_OUTPUT, Filename, "w+t");
+
+        FlPrintFile (ASL_FILE_C_INCLUDE_OUTPUT, "/*\n");
+        AslCompilerSignon (ASL_FILE_C_INCLUDE_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_C_INCLUDE_OUTPUT);
+    }
+
+    /* Create a namespace output file if asked */
+
+    if (Gbl_NsOutputFlag)
+    {
+        Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_NAMESPACE);
+        if (!Filename)
+        {
+            AslCommonError (ASL_ERROR, ASL_MSG_LISTING_FILENAME,
+                0, 0, 0, 0, NULL, NULL);
+            return (AE_ERROR);
+        }
+
+        /* Open the namespace file, text mode */
+
+        FlOpenFile (ASL_FILE_NAMESPACE_OUTPUT, Filename, "w+t");
+
+        AslCompilerSignon (ASL_FILE_NAMESPACE_OUTPUT);
+        AslCompilerFileHeader (ASL_FILE_NAMESPACE_OUTPUT);
+    }
+
+    return (AE_OK);
+}
+
+
+#ifdef ACPI_OBSOLETE_FUNCTIONS
+/*******************************************************************************
+ *
+ * FUNCTION:    FlParseInputPathname
+ *
+ * PARAMETERS:  InputFilename       - The user-specified ASL source file to be
+ *                                    compiled
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Split the input path into a directory and filename part
+ *              1) Directory part used to open include files
+ *              2) Filename part used to generate output filenames
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+FlParseInputPathname (
+    char                    *InputFilename)
+{
+    char                    *Substring;
+
+
+    if (!InputFilename)
+    {
+        return (AE_OK);
+    }
+
+    /* Get the path to the input filename's directory */
+
+    Gbl_DirectoryPath = strdup (InputFilename);
+    if (!Gbl_DirectoryPath)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    Substring = strrchr (Gbl_DirectoryPath, '\\');
+    if (!Substring)
+    {
+        Substring = strrchr (Gbl_DirectoryPath, '/');
+        if (!Substring)
+        {
+            Substring = strrchr (Gbl_DirectoryPath, ':');
+        }
+    }
+
+    if (!Substring)
+    {
+        Gbl_DirectoryPath[0] = 0;
+        if (Gbl_UseDefaultAmlFilename)
+        {
+            Gbl_OutputFilenamePrefix = strdup (InputFilename);
+        }
+    }
+    else
+    {
+        if (Gbl_UseDefaultAmlFilename)
+        {
+            Gbl_OutputFilenamePrefix = strdup (Substring + 1);
+        }
+        *(Substring+1) = 0;
+    }
+
+    UtConvertBackslashes (Gbl_OutputFilenamePrefix);
+    return (AE_OK);
+}
+#endif
diff --git a/usr/src/cmd/acpi/iasl/aslfold.c b/usr/src/cmd/acpi/iasl/aslfold.c
new file mode 100644
index 0000000000..93b49b0515
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslfold.c
@@ -0,0 +1,884 @@
+/******************************************************************************
+ *
+ * Module Name: aslfold - Constant folding
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#include "acdispat.h"
+#include "acparser.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslfold")
+
+/* Local prototypes */
+
+static ACPI_STATUS
+OpcAmlEvaluationWalk1 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+OpcAmlEvaluationWalk2 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+OpcAmlCheckForConstant (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static void
+OpcUpdateIntegerNode (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT64                  Value);
+
+static ACPI_STATUS
+TrTransformToStoreOp (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState);
+
+static ACPI_STATUS
+TrSimpleConstantReduction (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState);
+
+static void
+TrInstallReducedConstant (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_OPERAND_OBJECT     *ObjDesc);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcAmlConstantWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Reduce an Op and its subtree to a constant if possible.
+ *              Called during ascent of the parse tree.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+OpcAmlConstantWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState;
+    ACPI_STATUS             Status = AE_OK;
+
+
+    if (Op->Asl.CompileFlags == 0)
+    {
+        return (AE_OK);
+    }
+
+    /*
+     * Only interested in subtrees that could possibly contain
+     * expressions that can be evaluated at this time
+     */
+    if ((!(Op->Asl.CompileFlags & NODE_COMPILE_TIME_CONST)) ||
+          (Op->Asl.CompileFlags & NODE_IS_TARGET))
+    {
+        return (AE_OK);
+    }
+
+    /* Create a new walk state */
+
+    WalkState = AcpiDsCreateWalkState (0, NULL, NULL, NULL);
+    if (!WalkState)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    WalkState->NextOp = NULL;
+    WalkState->Params = NULL;
+
+    /*
+     * Examine the entire subtree -- all nodes must be constants
+     * or type 3/4/5 opcodes
+     */
+    Status = TrWalkParseTree (Op, ASL_WALK_VISIT_DOWNWARD,
+        OpcAmlCheckForConstant, NULL, WalkState);
+
+    /*
+     * Did we find an entire subtree that contains all constants
+     * and type 3/4/5 opcodes?
+     */
+    switch (Status)
+    {
+    case AE_OK:
+
+        /* Simple case, like Add(3,4) -> 7 */
+
+        Status = TrSimpleConstantReduction (Op, WalkState);
+        break;
+
+    case AE_CTRL_RETURN_VALUE:
+
+        /* More complex case, like Add(3,4,Local0) -> Store(7,Local0) */
+
+        Status = TrTransformToStoreOp (Op, WalkState);
+        break;
+
+    case AE_TYPE:
+
+        AcpiDsDeleteWalkState (WalkState);
+        return (AE_OK);
+
+    default:
+        AcpiDsDeleteWalkState (WalkState);
+        break;
+    }
+
+    if (ACPI_FAILURE (Status))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT, "Cannot resolve, %s\n",
+            AcpiFormatException (Status));
+
+        /* We could not resolve the subtree for some reason */
+
+        AslError (ASL_ERROR, ASL_MSG_CONSTANT_EVALUATION, Op,
+            (char *) AcpiFormatException (Status));
+
+        /* Set the subtree value to ZERO anyway. Eliminates further errors */
+
+        OpcUpdateIntegerNode (Op, 0);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcAmlCheckForConstant
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Check one Op for a reducible type 3/4/5 AML opcode.
+ *              This is performed via an upward walk of the parse subtree.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OpcAmlCheckForConstant (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = Context;
+    ACPI_STATUS             Status = AE_OK;
+    ACPI_PARSE_OBJECT       *NextOp;
+    const ACPI_OPCODE_INFO  *OpInfo;
+
+
+    WalkState->Op = Op;
+    WalkState->Opcode = Op->Common.AmlOpcode;
+    WalkState->OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+
+    DbgPrint (ASL_PARSE_OUTPUT, "[%.4d] Opcode: %12.12s ",
+        Op->Asl.LogicalLineNumber, Op->Asl.ParseOpName);
+
+    /*
+     * These opcodes do not appear in the OpcodeInfo table, but
+     * they represent constants, so abort the constant walk now.
+     */
+    if ((WalkState->Opcode == AML_RAW_DATA_BYTE) ||
+        (WalkState->Opcode == AML_RAW_DATA_WORD) ||
+        (WalkState->Opcode == AML_RAW_DATA_DWORD) ||
+        (WalkState->Opcode == AML_RAW_DATA_QWORD))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT, "RAW DATA");
+        Status = AE_TYPE;
+        goto CleanupAndExit;
+    }
+
+    /*
+     * Search upwards for a possible Name() operator. This is done
+     * because a type 3/4/5 opcode within a Name() expression
+     * MUST be reduced to a simple constant.
+     */
+    NextOp = Op->Asl.Parent;
+    while (NextOp)
+    {
+        /* Finished if we find a Name() opcode */
+
+        if (NextOp->Asl.AmlOpcode == AML_NAME_OP)
+        {
+            break;
+        }
+
+        /*
+         * Any "deferred" opcodes contain one or more TermArg parameters,
+         * and thus are not required to be folded to constants at compile
+         * time. This affects things like Buffer() and Package() objects.
+         * We just ignore them here. However, any sub-expressions can and
+         * will still be typechecked. Note: These are called the
+         * "deferred" opcodes in the AML interpreter.
+         */
+        OpInfo = AcpiPsGetOpcodeInfo (NextOp->Common.AmlOpcode);
+        if (OpInfo->Flags & AML_DEFER)
+        {
+            NextOp = NULL;
+            break;
+        }
+
+        NextOp = NextOp->Asl.Parent;
+    }
+
+    /* Type 3/4/5 opcodes have the AML_CONSTANT flag set */
+
+    if (!(WalkState->OpInfo->Flags & AML_CONSTANT))
+    {
+        /*
+         * From the ACPI specification:
+         *
+         * "The Type 3/4/5 opcodes return a value and can be used in an
+         * expression that evaluates to a constant. These opcodes may be
+         * evaluated at ASL compile-time. To ensure that these opcodes
+         * will evaluate to a constant, the following rules apply: The
+         * term cannot have a destination (target) operand, and must have
+         * either a Type3Opcode, Type4Opcode, Type5Opcode, ConstExprTerm,
+         * Integer, BufferTerm, Package, or String for all arguments."
+         */
+
+        /*
+         * The value (second) operand for the Name() operator MUST
+         * reduce to a single constant, as per the ACPI specification
+         * (the operand is a DataObject). This also implies that there
+         * can be no target operand. Name() is the only ASL operator
+         * with a "DataObject" as an operand and is thus special-
+         * cased here.
+         */
+        if (NextOp) /* Inspect a Name() operator */
+        {
+            /* Error if there is a target operand */
+
+            if (Op->Asl.CompileFlags & NODE_IS_TARGET)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TARGET, Op, NULL);
+                Status = AE_TYPE;
+            }
+
+            /* Error if expression cannot be reduced (folded) */
+
+            if (!(NextOp->Asl.CompileFlags & NODE_COULD_NOT_REDUCE))
+            {
+                /* Ensure only one error message per statement */
+
+                NextOp->Asl.CompileFlags |= NODE_COULD_NOT_REDUCE;
+                DbgPrint (ASL_PARSE_OUTPUT,
+                    "**** Could not reduce operands for NAME opcode ****\n");
+
+                AslError (ASL_ERROR, ASL_MSG_CONSTANT_REQUIRED, Op,
+                    "Constant is required for Name operator");
+                Status = AE_TYPE;
+            }
+        }
+
+        if (ACPI_FAILURE (Status))
+        {
+            goto CleanupAndExit;
+        }
+
+        /* This is not a 3/4/5 opcode, but maybe can convert to STORE */
+
+        if (Op->Asl.CompileFlags & NODE_IS_TARGET)
+        {
+            DbgPrint (ASL_PARSE_OUTPUT,
+                "**** Valid Target, transform to Store ****\n");
+            return (AE_CTRL_RETURN_VALUE);
+        }
+
+        /* Expression cannot be reduced */
+
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "**** Not a Type 3/4/5 opcode or cannot reduce/fold (%s) ****\n",
+             Op->Asl.ParseOpName);
+
+        Status = AE_TYPE;
+        goto CleanupAndExit;
+    }
+
+    /*
+     * TBD: Ignore buffer constants for now. The problem is that these
+     * constants have been transformed into RAW_DATA at this point, from
+     * the parse tree transform process which currently happens before
+     * the constant folding process. We may need to defer this transform
+     * for buffer until after the constant folding.
+     */
+    if (WalkState->Opcode == AML_BUFFER_OP)
+    {
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "\nBuffer constant reduction is not supported yet\n");
+
+        if (NextOp) /* Found a Name() operator, error */
+        {
+            AslError (ASL_ERROR, ASL_MSG_UNSUPPORTED, Op,
+                "Buffer expression cannot be reduced");
+        }
+
+        Status = AE_TYPE;
+        goto CleanupAndExit;
+    }
+
+    /* Debug output */
+
+    DbgPrint (ASL_PARSE_OUTPUT, "TYPE_345");
+
+    if (Op->Asl.CompileFlags & NODE_IS_TARGET)
+    {
+        if (Op->Asl.ParseOpcode == PARSEOP_ZERO)
+        {
+            DbgPrint (ASL_PARSE_OUTPUT, "%-16s", " NULL TARGET");
+        }
+        else
+        {
+            DbgPrint (ASL_PARSE_OUTPUT, "%-16s", " VALID TARGET");
+        }
+    }
+
+    if (Op->Asl.CompileFlags & NODE_IS_TERM_ARG)
+    {
+        DbgPrint (ASL_PARSE_OUTPUT, "%-16s", " TERMARG");
+    }
+
+CleanupAndExit:
+
+    /* Dump the node compile flags also */
+
+    TrPrintNodeCompileFlags (Op->Asl.CompileFlags);
+    DbgPrint (ASL_PARSE_OUTPUT, "\n");
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrSimpleConstantReduction
+ *
+ * PARAMETERS:  Op                  - Parent operator to be transformed
+ *              WalkState           - Current walk state
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Reduce an entire AML operation to a single constant. The
+ *              operation must not have a target operand.
+ *
+ *              Add (32,64) --> 96
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+TrSimpleConstantReduction (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+{
+    ACPI_PARSE_OBJECT       *RootOp;
+    ACPI_PARSE_OBJECT       *OriginalParentOp;
+    ACPI_OPERAND_OBJECT     *ObjDesc;
+    ACPI_STATUS             Status;
+
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "Simple subtree constant reduction, operator to constant\n");
+
+    /* Allocate a new temporary root for this subtree */
+
+    RootOp = TrAllocateNode (PARSEOP_INTEGER);
+    if (!RootOp)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    RootOp->Common.AmlOpcode = AML_INT_EVAL_SUBTREE_OP;
+
+    OriginalParentOp = Op->Common.Parent;
+    Op->Common.Parent = RootOp;
+
+    /* Hand off the subtree to the AML interpreter */
+
+    WalkState->CallerReturnDesc = &ObjDesc;
+
+    Status = TrWalkParseTree (Op, ASL_WALK_VISIT_TWICE,
+        OpcAmlEvaluationWalk1, OpcAmlEvaluationWalk2, WalkState);
+
+    /* Restore original parse tree */
+
+    Op->Common.Parent = OriginalParentOp;
+
+    if (ACPI_FAILURE (Status))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "Constant Subtree evaluation(1), %s\n",
+            AcpiFormatException (Status));
+        return (Status);
+    }
+
+    /* Get the final result */
+
+    Status = AcpiDsResultPop (&ObjDesc, WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "Constant Subtree evaluation(2), %s\n",
+            AcpiFormatException (Status));
+        return (Status);
+    }
+
+    /* Disconnect any existing children, install new constant */
+
+    Op->Asl.Child = NULL;
+    TrInstallReducedConstant (Op, ObjDesc);
+
+    UtSetParseOpName (Op);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrTransformToStoreOp
+ *
+ * PARAMETERS:  Op                  - Parent operator to be transformed
+ *              WalkState           - Current walk state
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Transforms a single AML operation with a constant and target
+ *              to a simple store operation:
+ *
+ *              Add (32,64,DATA) --> Store (96,DATA)
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+TrTransformToStoreOp (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+{
+    ACPI_PARSE_OBJECT       *OriginalTarget;
+    ACPI_PARSE_OBJECT       *NewTarget;
+    ACPI_PARSE_OBJECT       *Child1;
+    ACPI_PARSE_OBJECT       *Child2;
+    ACPI_OPERAND_OBJECT     *ObjDesc;
+    ACPI_PARSE_OBJECT       *NewParent;
+    ACPI_PARSE_OBJECT       *OriginalParent;
+    ACPI_STATUS             Status;
+
+
+    /* Extract the operands */
+
+    Child1 = Op->Asl.Child;
+    Child2 = Child1->Asl.Next;
+
+    /*
+     * Special case for DIVIDE -- it has two targets. The first
+     * is for the remainder and if present, we will not attempt
+     * to reduce the expression.
+     */
+    if (Op->Asl.ParseOpcode == PARSEOP_DIVIDE)
+    {
+        Child2 = Child2->Asl.Next;
+        if (Child2->Asl.ParseOpcode != PARSEOP_ZERO)
+        {
+            DbgPrint (ASL_PARSE_OUTPUT,
+                "Cannot reduce DIVIDE - has two targets\n\n");
+            return (AE_OK);
+        }
+    }
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "Reduction/Transform to StoreOp: Store(%s, %s)\n",
+        Child1->Asl.ParseOpName, Child2->Asl.ParseOpName);
+
+    /*
+     * Create a NULL (zero) target so that we can use the
+     * interpreter to evaluate the expression.
+     */
+    NewTarget = TrCreateNullTarget ();
+    NewTarget->Common.AmlOpcode = AML_INT_NAMEPATH_OP;
+
+    /* Handle one-operand cases (NOT, TOBCD, etc.) */
+
+    if (!Child2->Asl.Next)
+    {
+        Child2 = Child1;
+    }
+
+    /* Link in new NULL target as the last operand */
+
+    OriginalTarget = Child2->Asl.Next;
+    Child2->Asl.Next = NewTarget;
+    NewTarget->Asl.Parent = OriginalTarget->Asl.Parent;
+
+    NewParent = TrAllocateNode (PARSEOP_INTEGER);
+    NewParent->Common.AmlOpcode = AML_INT_EVAL_SUBTREE_OP;
+
+    OriginalParent = Op->Common.Parent;
+    Op->Common.Parent = NewParent;
+
+    /* Hand off the subtree to the AML interpreter */
+
+    WalkState->CallerReturnDesc = &ObjDesc;
+
+    Status = TrWalkParseTree (Op, ASL_WALK_VISIT_TWICE,
+        OpcAmlEvaluationWalk1, OpcAmlEvaluationWalk2, WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "Constant Subtree evaluation(3), %s\n",
+            AcpiFormatException (Status));
+        goto EvalError;
+    }
+
+    /* Get the final result */
+
+    Status = AcpiDsResultPop (&ObjDesc, WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "Constant Subtree evaluation(4), %s\n",
+            AcpiFormatException (Status));
+        goto EvalError;
+    }
+
+    /* Truncate any subtree expressions, they have been evaluated */
+
+    Child1->Asl.Child = NULL;
+
+    /* Folded constant is in ObjDesc, store into Child1 */
+
+    TrInstallReducedConstant (Child1, ObjDesc);
+
+    /* Convert operator to STORE */
+
+    Op->Asl.ParseOpcode = PARSEOP_STORE;
+    Op->Asl.AmlOpcode = AML_STORE_OP;
+    UtSetParseOpName (Op);
+    Op->Common.Parent = OriginalParent;
+
+    /* First child is the folded constant */
+
+    /* Second child will be the target */
+
+    Child1->Asl.Next = OriginalTarget;
+    return (AE_OK);
+
+
+EvalError:
+
+    /* Restore original links */
+
+    Op->Common.Parent = OriginalParent;
+    Child2->Asl.Next = OriginalTarget;
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrInstallReducedConstant
+ *
+ * PARAMETERS:  Op                  - Parent operator to be transformed
+ *              ObjDesc             - Reduced constant to be installed
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Transform the original operator to a simple constant.
+ *              Handles Integers, Strings, and Buffers.
+ *
+ ******************************************************************************/
+
+static void
+TrInstallReducedConstant (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_OPERAND_OBJECT     *ObjDesc)
+{
+    ACPI_PARSE_OBJECT       *LengthOp;
+    ACPI_PARSE_OBJECT       *DataOp;
+
+
+    TotalFolds++;
+    AslError (ASL_OPTIMIZATION, ASL_MSG_CONSTANT_FOLDED, Op,
+        Op->Asl.ParseOpName);
+
+    /*
+     * Because we know we executed type 3/4/5 opcodes above, we know that
+     * the result must be either an Integer, String, or Buffer.
+     */
+    switch (ObjDesc->Common.Type)
+    {
+    case ACPI_TYPE_INTEGER:
+
+        OpcUpdateIntegerNode (Op, ObjDesc->Integer.Value);
+
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "Constant expression reduced to (%s) %8.8X%8.8X\n\n",
+            Op->Asl.ParseOpName,
+            ACPI_FORMAT_UINT64 (Op->Common.Value.Integer));
+        break;
+
+    case ACPI_TYPE_STRING:
+
+        Op->Asl.ParseOpcode = PARSEOP_STRING_LITERAL;
+        Op->Common.AmlOpcode = AML_STRING_OP;
+        Op->Asl.AmlLength = strlen (ObjDesc->String.Pointer) + 1;
+        Op->Common.Value.String = ObjDesc->String.Pointer;
+
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "Constant expression reduced to (STRING) %s\n\n",
+            Op->Common.Value.String);
+        break;
+
+    case ACPI_TYPE_BUFFER:
+        /*
+         * Create a new parse subtree of the form:
+         *
+         * BUFFER (Buffer AML opcode)
+         *    INTEGER (Buffer length in bytes)
+         *    RAW_DATA (Buffer byte data)
+         */
+        Op->Asl.ParseOpcode = PARSEOP_BUFFER;
+        Op->Common.AmlOpcode = AML_BUFFER_OP;
+        Op->Asl.CompileFlags = NODE_AML_PACKAGE;
+        UtSetParseOpName (Op);
+
+        /* Child node is the buffer length */
+
+        LengthOp = TrAllocateNode (PARSEOP_INTEGER);
+
+        LengthOp->Asl.AmlOpcode = AML_DWORD_OP;
+        LengthOp->Asl.Value.Integer = ObjDesc->Buffer.Length;
+        LengthOp->Asl.Parent = Op;
+        (void) OpcSetOptimalIntegerSize (LengthOp);
+
+        Op->Asl.Child = LengthOp;
+
+        /* Next child is the raw buffer data */
+
+        DataOp = TrAllocateNode (PARSEOP_RAW_DATA);
+        DataOp->Asl.AmlOpcode = AML_RAW_DATA_BUFFER;
+        DataOp->Asl.AmlLength = ObjDesc->Buffer.Length;
+        DataOp->Asl.Value.String = (char *) ObjDesc->Buffer.Pointer;
+        DataOp->Asl.Parent = Op;
+
+        LengthOp->Asl.Next = DataOp;
+
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "Constant expression reduced to (BUFFER) length %X\n\n",
+            ObjDesc->Buffer.Length);
+        break;
+
+    default:
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcUpdateIntegerNode
+ *
+ * PARAMETERS:  Op                  - Current parse object
+ *              Value               - Value for the integer op
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Update node to the correct Integer type and value
+ *
+ ******************************************************************************/
+
+static void
+OpcUpdateIntegerNode (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT64                  Value)
+{
+
+    Op->Common.Value.Integer = Value;
+
+    /*
+     * The AmlLength is used by the parser to indicate a constant,
+     * (if non-zero). Length is either (1/2/4/8)
+     */
+    switch (Op->Asl.AmlLength)
+    {
+    case 1:
+
+        TrUpdateNode (PARSEOP_BYTECONST, Op);
+        Op->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+        break;
+
+    case 2:
+
+        TrUpdateNode (PARSEOP_WORDCONST, Op);
+        Op->Asl.AmlOpcode = AML_RAW_DATA_WORD;
+        break;
+
+    case 4:
+
+        TrUpdateNode (PARSEOP_DWORDCONST, Op);
+        Op->Asl.AmlOpcode = AML_RAW_DATA_DWORD;
+        break;
+
+    case 8:
+
+        TrUpdateNode (PARSEOP_QWORDCONST, Op);
+        Op->Asl.AmlOpcode = AML_RAW_DATA_QWORD;
+        break;
+
+    case 0:
+    default:
+
+        OpcSetOptimalIntegerSize (Op);
+        TrUpdateNode (PARSEOP_INTEGER, Op);
+        break;
+    }
+
+    Op->Asl.AmlLength = 0;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcAmlEvaluationWalk1
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending callback for AML execution of constant subtrees
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OpcAmlEvaluationWalk1 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = Context;
+    ACPI_STATUS             Status;
+    ACPI_PARSE_OBJECT       *OutOp;
+
+
+    WalkState->Op = Op;
+    WalkState->Opcode = Op->Common.AmlOpcode;
+    WalkState->OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+
+    /* Copy child pointer to Arg for compatibility with Interpreter */
+
+    if (Op->Asl.Child)
+    {
+        Op->Common.Value.Arg = Op->Asl.Child;
+    }
+
+    /* Call AML dispatcher */
+
+    Status = AcpiDsExecBeginOp (WalkState, &OutOp);
+    if (ACPI_FAILURE (Status))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "%s Constant interpretation failed (1) - %s\n",
+            Op->Asl.ParseOpName, AcpiFormatException (Status));
+    }
+
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcAmlEvaluationWalk2
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Ascending callback for AML execution of constant subtrees
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OpcAmlEvaluationWalk2 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = Context;
+    ACPI_STATUS             Status;
+
+
+    WalkState->Op = Op;
+    WalkState->Opcode = Op->Common.AmlOpcode;
+    WalkState->OpInfo = AcpiPsGetOpcodeInfo (Op->Common.AmlOpcode);
+
+    /* Copy child pointer to Arg for compatibility with Interpreter */
+
+    if (Op->Asl.Child)
+    {
+        Op->Common.Value.Arg = Op->Asl.Child;
+    }
+
+    /* Call AML dispatcher */
+
+    Status = AcpiDsExecEndOp (WalkState);
+    if (ACPI_FAILURE (Status))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT,
+            "%s: Constant interpretation failed (2) - %s\n",
+            Op->Asl.ParseOpName, AcpiFormatException (Status));
+    }
+
+    return (Status);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslglobal.h b/usr/src/cmd/acpi/iasl/aslglobal.h
new file mode 100644
index 0000000000..6f35c248ec
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslglobal.h
@@ -0,0 +1,290 @@
+/******************************************************************************
+ *
+ * Module Name: aslglobal.h - Global variable definitions
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#ifndef __ASLGLOBAL_H
+#define __ASLGLOBAL_H
+
+
+/*
+ * Global variables. Defined in aslmain.c only, externed in all other files
+ */
+
+#undef ASL_EXTERN
+
+#ifdef _DECLARE_GLOBALS
+#define ASL_EXTERN
+#define ASL_INIT_GLOBAL(a,b)        (a)=(b)
+#else
+#define ASL_EXTERN                  extern
+#define ASL_INIT_GLOBAL(a,b)        (a)
+#endif
+
+
+#ifdef _DECLARE_GLOBALS
+UINT32                              Gbl_ExceptionCount[ASL_NUM_REPORT_LEVELS] = {0,0,0,0,0,0};
+
+/* Table below must match ASL_FILE_TYPES in asltypes.h */
+
+ASL_FILE_INFO                       Gbl_Files [ASL_NUM_FILES] =
+{
+    {NULL, NULL, "stdout:       ", "Standard Output"},
+    {NULL, NULL, "stderr:       ", "Standard Error"},
+    {NULL, NULL, "Table Input:  ", "Source Input"},
+    {NULL, NULL, "Binary Output:", "AML Output"},
+    {NULL, NULL, "Source Output:", "Source Output"},
+    {NULL, NULL, "Preprocessor: ", "Preprocessor Output"},
+    {NULL, NULL, "Preprocessor: ", "Preprocessor Temp File"},
+    {NULL, NULL, "Listing File: ", "Listing Output"},
+    {NULL, NULL, "Hex Dump:     ", "Hex Table Output"},
+    {NULL, NULL, "Namespace:    ", "Namespace Output"},
+    {NULL, NULL, "Debug File:   ", "Debug Output"},
+    {NULL, NULL, "ASM Source:   ", "Assembly Code Output"},
+    {NULL, NULL, "C Source:     ", "C Code Output"},
+    {NULL, NULL, "ASM Include:  ", "Assembly Header Output"},
+    {NULL, NULL, "C Include:    ", "C Header Output"},
+    {NULL, NULL, "Offset Table: ", "C Offset Table Output"},
+    {NULL, NULL, "Device Map:   ", "Device Map Output"},
+    {NULL, NULL, "Cross Ref:    ", "Cross-reference Output"}
+};
+
+#else
+extern UINT32                       Gbl_ExceptionCount[ASL_NUM_REPORT_LEVELS];
+extern ASL_FILE_INFO                Gbl_Files [ASL_NUM_FILES];
+#endif
+
+
+/*
+ * Parser and other externals
+ */
+extern int                          yydebug;
+extern FILE                         *AslCompilerin;
+extern int                          DtParserdebug;
+extern int                          PrParserdebug;
+extern const ASL_MAPPING_ENTRY      AslKeywordMapping[];
+extern char                         *AslCompilertext;
+
+/*
+ * Older versions of Bison won't emit this external in the generated header.
+ * Newer versions do emit the external, so we don't need to do it.
+ */
+#ifndef ASLCOMPILER_ASLCOMPILERPARSE_H
+extern int                  AslCompilerdebug;
+#endif
+
+
+#define ASL_DEFAULT_LINE_BUFFER_SIZE    (1024 * 32) /* 32K */
+#define ASL_MSG_BUFFER_SIZE             4096
+#define ASL_MAX_DISABLED_MESSAGES       32
+#define HEX_TABLE_LINE_SIZE             8
+#define HEX_LISTING_LINE_SIZE           8
+
+
+/* Source code buffers and pointers for error reporting */
+
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_CurrentLineBuffer, NULL);
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_LineBufPtr, NULL);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_LineBufferSize, ASL_DEFAULT_LINE_BUFFER_SIZE);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_CurrentColumn, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_CurrentLineNumber, 1);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_LogicalLineNumber, 1);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_CurrentLineOffset, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_OriginalInputFileSize, 0);
+ASL_EXTERN UINT8                    ASL_INIT_GLOBAL (Gbl_SyntaxError, 0);
+
+/* Exception reporting */
+
+ASL_EXTERN ASL_ERROR_MSG            ASL_INIT_GLOBAL (*Gbl_ErrorLog,NULL);
+ASL_EXTERN ASL_ERROR_MSG            ASL_INIT_GLOBAL (*Gbl_NextError,NULL);
+
+/* Option flags */
+
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DoCompile, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DoSignon, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_PreprocessOnly, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_PreprocessFlag, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DisassembleAll, FALSE);
+
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_UseDefaultAmlFilename, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_MapfileFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_NsOutputFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_PreprocessorOutputFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_KeepPreprocessorTempFile, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DebugFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_CrossReferenceOutput, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_AsmOutputFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_C_OutputFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_C_OffsetTableFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_AsmIncludeOutputFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_C_IncludeOutputFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_ListingFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_IgnoreErrors, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_SourceOutputFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_ParseOnlyFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_CompileTimesFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_FoldConstants, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_VerboseErrors, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_NoErrors, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_WarningsAsErrors, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_NoResourceChecking, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DisasmFlag, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_IntegerOptimizationFlag, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_ReferenceOptimizationFlag, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DisplayRemarks, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DisplayWarnings, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DisplayOptimizations, FALSE);
+ASL_EXTERN UINT8                    ASL_INIT_GLOBAL (Gbl_WarningLevel, ASL_WARNING);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_UseOriginalCompilerId, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_VerboseTemplates, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DoTemplates, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_CompileGeneric, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_AllExceptionsDisabled, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_PruneParseTree, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DoTypechecking, TRUE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_EnableReferenceTypechecking, FALSE);
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_DoExternals, TRUE);
+
+
+#define HEX_OUTPUT_NONE             0
+#define HEX_OUTPUT_C                1
+#define HEX_OUTPUT_ASM              2
+#define HEX_OUTPUT_ASL              3
+
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_HexOutputFlag, HEX_OUTPUT_NONE);
+
+
+/* Files */
+
+ASL_EXTERN char                     *Gbl_DirectoryPath;
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_IncludeFilename, NULL);
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_OutputFilenamePrefix, NULL);
+ASL_EXTERN ASL_INCLUDE_DIR          ASL_INIT_GLOBAL (*Gbl_IncludeDirList, NULL);
+ASL_EXTERN char                     *Gbl_CurrentInputFilename;
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_ExternalRefFilename, NULL);
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_PreviousIncludeFilename, NULL);
+
+ASL_EXTERN BOOLEAN                  ASL_INIT_GLOBAL (Gbl_HasIncludeFiles, FALSE);
+
+
+/* Statistics */
+
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_InputByteCount, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_InputFieldCount, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_NsLookupCount, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalKeywords, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalNamedObjects, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalExecutableOpcodes, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalParseNodes, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalMethods, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalAllocations, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalAllocated, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (TotalFolds, 0);
+
+
+/* Local caches */
+
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_ParseOpCount, 0);
+ASL_EXTERN ASL_CACHE_INFO           ASL_INIT_GLOBAL (*Gbl_ParseOpCacheList, NULL);
+ASL_EXTERN ACPI_PARSE_OBJECT        ASL_INIT_GLOBAL (*Gbl_ParseOpCacheNext, NULL);
+ASL_EXTERN ACPI_PARSE_OBJECT        ASL_INIT_GLOBAL (*Gbl_ParseOpCacheLast, NULL);
+
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_StringCount, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_StringSize, 0);
+ASL_EXTERN ASL_CACHE_INFO           ASL_INIT_GLOBAL (*Gbl_StringCacheList, NULL);
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_StringCacheNext, NULL);
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_StringCacheLast, NULL);
+
+/* Map file */
+
+ASL_EXTERN ACPI_GPIO_INFO           ASL_INIT_GLOBAL (*Gbl_GpioList, NULL);
+ASL_EXTERN ACPI_SERIAL_INFO         ASL_INIT_GLOBAL (*Gbl_SerialList, NULL);
+
+
+/* Misc */
+
+ASL_EXTERN UINT8                    ASL_INIT_GLOBAL (Gbl_RevisionOverride, 0);
+ASL_EXTERN UINT8                    ASL_INIT_GLOBAL (Gbl_TempCount, 0);
+ASL_EXTERN ACPI_PARSE_OBJECT        ASL_INIT_GLOBAL (*Gbl_ParseTreeRoot, NULL);
+ASL_EXTERN ACPI_PARSE_OBJECT        ASL_INIT_GLOBAL (*Gbl_ExternalsListHead, NULL);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_TableLength, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_SourceLine, 0);
+ASL_EXTERN ASL_LISTING_NODE         ASL_INIT_GLOBAL (*Gbl_ListingNode, NULL);
+ASL_EXTERN UINT8                    ASL_INIT_GLOBAL (Gbl_FileType, 0);
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_Signature, NULL);
+
+ASL_EXTERN ACPI_PARSE_OBJECT        *Gbl_FirstLevelInsertionNode;
+
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_CurrentHexColumn, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_CurrentAmlOffset, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_CurrentLine, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_DisabledMessagesIndex, 0);
+ASL_EXTERN UINT8                    ASL_INIT_GLOBAL (Gbl_HexBytesWereWritten, FALSE);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_NumNamespaceObjects, 0);
+ASL_EXTERN UINT32                   ASL_INIT_GLOBAL (Gbl_ReservedMethods, 0);
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_TableSignature, "NO_SIG");
+ASL_EXTERN char                     ASL_INIT_GLOBAL (*Gbl_TableId, "NO_ID");
+ASL_EXTERN UINT8                    ASL_INIT_GLOBAL (Gbl_PruneDepth, 0);
+ASL_EXTERN UINT16                   ASL_INIT_GLOBAL (Gbl_PruneType, 0);
+
+
+/* Static structures */
+
+ASL_EXTERN ASL_ANALYSIS_WALK_INFO   AnalysisWalkInfo;
+ASL_EXTERN ACPI_TABLE_HEADER        TableHeader;
+
+/* Event timing */
+
+#define ASL_NUM_EVENTS              24
+ASL_EXTERN ASL_EVENT_INFO           AslGbl_Events[ASL_NUM_EVENTS];
+ASL_EXTERN UINT8                    AslGbl_NextEvent;
+ASL_EXTERN UINT8                    AslGbl_NamespaceEvent;
+
+/* Scratch buffers */
+
+ASL_EXTERN UINT8                    Gbl_AmlBuffer[HEX_LISTING_LINE_SIZE];
+ASL_EXTERN char                     MsgBuffer[ASL_MSG_BUFFER_SIZE];
+ASL_EXTERN char                     StringBuffer[ASL_MSG_BUFFER_SIZE];
+ASL_EXTERN char                     StringBuffer2[ASL_MSG_BUFFER_SIZE];
+ASL_EXTERN UINT32                   Gbl_DisabledMessages[ASL_MAX_DISABLED_MESSAGES];
+
+
+#endif /* __ASLGLOBAL_H */
diff --git a/usr/src/cmd/acpi/iasl/aslhex.c b/usr/src/cmd/acpi/iasl/aslhex.c
new file mode 100644
index 0000000000..afa395e97e
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslhex.c
@@ -0,0 +1,404 @@
+/******************************************************************************
+ *
+ * Module Name: aslhex - ASCII hex output file generation (C, ASM, and ASL)
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("ashex")
+
+/*
+ * This module emits ASCII hex output files in either C, ASM, or ASL format
+ */
+
+/* Local prototypes */
+
+static void
+HxDoHexOutputC (
+    void);
+
+static void
+HxDoHexOutputAsl (
+    void);
+
+static void
+HxDoHexOutputAsm (
+    void);
+
+static UINT32
+HxReadAmlOutputFile (
+    UINT8                   *Buffer);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    HxDoHexOutput
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create the hex output file. Note: data is obtained by reading
+ *              the entire AML output file that was previously generated.
+ *
+ ******************************************************************************/
+
+void
+HxDoHexOutput (
+    void)
+{
+
+    switch (Gbl_HexOutputFlag)
+    {
+    case HEX_OUTPUT_C:
+
+        HxDoHexOutputC ();
+        break;
+
+    case HEX_OUTPUT_ASM:
+
+        HxDoHexOutputAsm ();
+        break;
+
+    case HEX_OUTPUT_ASL:
+
+        HxDoHexOutputAsl ();
+        break;
+
+    default:
+
+        /* No other output types supported */
+
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    HxReadAmlOutputFile
+ *
+ * PARAMETERS:  Buffer              - Where to return data
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Read a line of the AML output prior to formatting the data
+ *
+ ******************************************************************************/
+
+static UINT32
+HxReadAmlOutputFile (
+    UINT8                   *Buffer)
+{
+    UINT32                  Actual;
+
+
+    Actual = fread (Buffer, 1, HEX_TABLE_LINE_SIZE,
+        Gbl_Files[ASL_FILE_AML_OUTPUT].Handle);
+
+    if (ferror (Gbl_Files[ASL_FILE_AML_OUTPUT].Handle))
+    {
+        FlFileError (ASL_FILE_AML_OUTPUT, ASL_MSG_READ);
+        AslAbort ();
+    }
+
+    return (Actual);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    HxDoHexOutputC
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create the hex output file. This is the same data as the AML
+ *              output file, but formatted into hex/ascii bytes suitable for
+ *              inclusion into a C source file.
+ *
+ ******************************************************************************/
+
+static void
+HxDoHexOutputC (
+    void)
+{
+    UINT8                   FileData[HEX_TABLE_LINE_SIZE];
+    UINT32                  LineLength;
+    UINT32                  Offset = 0;
+    UINT32                  AmlFileSize;
+    UINT32                  i;
+
+
+    /* Get AML size, seek back to start */
+
+    AmlFileSize = FlGetFileSize (ASL_FILE_AML_OUTPUT);
+    FlSeekFile (ASL_FILE_AML_OUTPUT, 0);
+
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, " * C source code output\n");
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, " * AML code block contains 0x%X bytes\n *\n */\n",
+        AmlFileSize);
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, "unsigned char AmlCode[] =\n{\n");
+
+    while (Offset < AmlFileSize)
+    {
+        /* Read enough bytes needed for one output line */
+
+        LineLength = HxReadAmlOutputFile (FileData);
+        if (!LineLength)
+        {
+            break;
+        }
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "    ");
+
+        for (i = 0; i < LineLength; i++)
+        {
+            /*
+             * Print each hex byte.
+             * Add a comma until the very last byte of the AML file
+             * (Some C compilers complain about a trailing comma)
+             */
+            FlPrintFile (ASL_FILE_HEX_OUTPUT, "0x%2.2X", FileData[i]);
+            if ((Offset + i + 1) < AmlFileSize)
+            {
+                FlPrintFile (ASL_FILE_HEX_OUTPUT, ",");
+            }
+            else
+            {
+                FlPrintFile (ASL_FILE_HEX_OUTPUT, " ");
+            }
+        }
+
+        /* Add fill spaces if needed for last line */
+
+        if (LineLength < HEX_TABLE_LINE_SIZE)
+        {
+            FlPrintFile (ASL_FILE_HEX_OUTPUT, "%*s",
+                5 * (HEX_TABLE_LINE_SIZE - LineLength), " ");
+        }
+
+        /* Emit the offset and ascii dump for the entire line */
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "  /* %8.8X", Offset);
+        LsDumpAsciiInComment (ASL_FILE_HEX_OUTPUT, LineLength, FileData);
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "%*s*/\n",
+            HEX_TABLE_LINE_SIZE - LineLength + 1, " ");
+
+        Offset += LineLength;
+    }
+
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, "};\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    HxDoHexOutputAsl
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create the hex output file. This is the same data as the AML
+ *              output file, but formatted into hex/ascii bytes suitable for
+ *              inclusion into a C source file.
+ *
+ ******************************************************************************/
+
+static void
+HxDoHexOutputAsl (
+    void)
+{
+    UINT8                   FileData[HEX_TABLE_LINE_SIZE];
+    UINT32                  LineLength;
+    UINT32                  Offset = 0;
+    UINT32                  AmlFileSize;
+    UINT32                  i;
+
+
+    /* Get AML size, seek back to start */
+
+    AmlFileSize = FlGetFileSize (ASL_FILE_AML_OUTPUT);
+    FlSeekFile (ASL_FILE_AML_OUTPUT, 0);
+
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, " * ASL source code output\n");
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, " * AML code block contains 0x%X bytes\n *\n */\n",
+        AmlFileSize);
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, "    Name (BUF1, Buffer()\n    {\n");
+
+    while (Offset < AmlFileSize)
+    {
+        /* Read enough bytes needed for one output line */
+
+        LineLength = HxReadAmlOutputFile (FileData);
+        if (!LineLength)
+        {
+            break;
+        }
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "        ");
+
+        for (i = 0; i < LineLength; i++)
+        {
+            /*
+             * Print each hex byte.
+             * Add a comma until the very last byte of the AML file
+             * (Some C compilers complain about a trailing comma)
+             */
+            FlPrintFile (ASL_FILE_HEX_OUTPUT, "0x%2.2X", FileData[i]);
+            if ((Offset + i + 1) < AmlFileSize)
+            {
+                FlPrintFile (ASL_FILE_HEX_OUTPUT, ",");
+            }
+            else
+            {
+                FlPrintFile (ASL_FILE_HEX_OUTPUT, " ");
+            }
+        }
+
+        /* Add fill spaces if needed for last line */
+
+        if (LineLength < HEX_TABLE_LINE_SIZE)
+        {
+            FlPrintFile (ASL_FILE_HEX_OUTPUT, "%*s",
+                5 * (HEX_TABLE_LINE_SIZE - LineLength), " ");
+        }
+
+        /* Emit the offset and ascii dump for the entire line */
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "  /* %8.8X", Offset);
+        LsDumpAsciiInComment (ASL_FILE_HEX_OUTPUT, LineLength, FileData);
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "%*s*/\n",
+            HEX_TABLE_LINE_SIZE - LineLength + 1, " ");
+
+        Offset += LineLength;
+    }
+
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, "    })\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    HxDoHexOutputAsm
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create the hex output file. This is the same data as the AML
+ *              output file, but formatted into hex/ascii bytes suitable for
+ *              inclusion into a ASM source file.
+ *
+ ******************************************************************************/
+
+static void
+HxDoHexOutputAsm (
+    void)
+{
+    UINT8                   FileData[HEX_TABLE_LINE_SIZE];
+    UINT32                  LineLength;
+    UINT32                  Offset = 0;
+    UINT32                  AmlFileSize;
+    UINT32                  i;
+
+
+    /* Get AML size, seek back to start */
+
+    AmlFileSize = FlGetFileSize (ASL_FILE_AML_OUTPUT);
+    FlSeekFile (ASL_FILE_AML_OUTPUT, 0);
+
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, "; Assembly code source output\n");
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, "; AML code block contains 0x%X bytes\n;\n",
+        AmlFileSize);
+
+    while (Offset < AmlFileSize)
+    {
+        /* Read enough bytes needed for one output line */
+
+        LineLength = HxReadAmlOutputFile (FileData);
+        if (!LineLength)
+        {
+            break;
+        }
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "  db  ");
+
+        for (i = 0; i < LineLength; i++)
+        {
+            /*
+             * Print each hex byte.
+             * Add a comma until the last byte of the line
+             */
+            FlPrintFile (ASL_FILE_HEX_OUTPUT, "0%2.2Xh", FileData[i]);
+            if ((i + 1) < LineLength)
+            {
+                FlPrintFile (ASL_FILE_HEX_OUTPUT, ",");
+            }
+        }
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, " ");
+
+        /* Add fill spaces if needed for last line */
+
+        if (LineLength < HEX_TABLE_LINE_SIZE)
+        {
+            FlPrintFile (ASL_FILE_HEX_OUTPUT, "%*s",
+                5 * (HEX_TABLE_LINE_SIZE - LineLength), " ");
+        }
+
+        /* Emit the offset and ascii dump for the entire line */
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "  ; %8.8X", Offset);
+        LsDumpAsciiInComment (ASL_FILE_HEX_OUTPUT, LineLength, FileData);
+
+        FlPrintFile (ASL_FILE_HEX_OUTPUT, "\n");
+
+        Offset += LineLength;
+    }
+
+    FlPrintFile (ASL_FILE_HEX_OUTPUT, "\n");
+}
diff --git a/usr/src/cmd/acpi/iasl/asllength.c b/usr/src/cmd/acpi/iasl/asllength.c
new file mode 100644
index 0000000000..626c2e7f3e
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asllength.c
@@ -0,0 +1,462 @@
+/******************************************************************************
+ *
+ * Module Name: asllength - Tree walk to determine package and opcode lengths
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asllength")
+
+/* Local prototypes */
+
+static UINT8
+CgGetPackageLenByteCount (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  PackageLength);
+
+static void
+CgGenerateAmlOpcodeLength (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+#ifdef ACPI_OBSOLETE_FUNCTIONS
+void
+LnAdjustLengthToRoot (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  LengthDelta);
+#endif
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LnInitLengthsWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Walk callback to initialize (and re-initialize) the node
+ *              subtree length(s) to zero. The Subtree lengths are bubbled
+ *              up to the root node in order to get a total AML length.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+LnInitLengthsWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    Op->Asl.AmlSubtreeLength = 0;
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LnPackageLengthWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Walk callback to calculate the total AML length.
+ *              1) Calculate the AML lengths (opcode, package length, etc.) for
+ *                 THIS node.
+ *              2) Bubbble up all of these lengths to the parent node by summing
+ *                 them all into the parent subtree length.
+ *
+ * Note:  The SubtreeLength represents the total AML length of all child nodes
+ *        in all subtrees under a given node. Therefore, once this walk is
+ *        complete, the Root Node subtree length is the AML length of the entire
+ *        tree (and thus, the entire ACPI table)
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+LnPackageLengthWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    /* Generate the AML lengths for this node */
+
+    CgGenerateAmlLengths (Op);
+
+    /* Bubble up all lengths (this node and all below it) to the parent */
+
+    if ((Op->Asl.Parent) &&
+        (Op->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG))
+    {
+        Op->Asl.Parent->Asl.AmlSubtreeLength += (
+            Op->Asl.AmlLength +
+            Op->Asl.AmlOpcodeLength +
+            Op->Asl.AmlPkgLenBytes +
+            Op->Asl.AmlSubtreeLength);
+    }
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgGetPackageLenByteCount
+ *
+ * PARAMETERS:  Op              - Parse node
+ *              PackageLength   - Length to be encoded
+ *
+ * RETURN:      Required length of the package length encoding
+ *
+ * DESCRIPTION: Calculate the number of bytes required to encode the given
+ *              package length.
+ *
+ ******************************************************************************/
+
+static UINT8
+CgGetPackageLenByteCount (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  PackageLength)
+{
+
+    /*
+     * Determine the number of bytes required to encode the package length
+     * Note: the package length includes the number of bytes used to encode
+     * the package length, so we must account for this also.
+     */
+    if (PackageLength <= (0x0000003F - 1))
+    {
+        return (1);
+    }
+    else if (PackageLength <= (0x00000FFF - 2))
+    {
+        return (2);
+    }
+    else if (PackageLength <= (0x000FFFFF - 3))
+    {
+        return (3);
+    }
+    else if (PackageLength <= (0x0FFFFFFF - 4))
+    {
+        return (4);
+    }
+    else
+    {
+        /* Fatal error - the package length is too large to encode */
+
+        AslError (ASL_ERROR, ASL_MSG_ENCODING_LENGTH, Op, NULL);
+    }
+
+    return (0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgGenerateAmlOpcodeLength
+ *
+ * PARAMETERS:  Op          - Parse node whose AML opcode lengths will be
+ *                            calculated
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Calculate the AmlOpcodeLength, AmlPkgLenBytes, and AmlLength
+ *              fields for this node.
+ *
+ ******************************************************************************/
+
+static void
+CgGenerateAmlOpcodeLength (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    /* Check for two-byte opcode */
+
+    if (Op->Asl.AmlOpcode > 0x00FF)
+    {
+        Op->Asl.AmlOpcodeLength = 2;
+    }
+    else
+    {
+        Op->Asl.AmlOpcodeLength = 1;
+    }
+
+    /* Does this opcode have an associated "PackageLength" field? */
+
+    Op->Asl.AmlPkgLenBytes = 0;
+    if (Op->Asl.CompileFlags & NODE_AML_PACKAGE)
+    {
+        Op->Asl.AmlPkgLenBytes = CgGetPackageLenByteCount (
+            Op, Op->Asl.AmlSubtreeLength);
+    }
+
+    /* Data opcode lengths are easy */
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_BYTE_OP:
+
+        Op->Asl.AmlLength = 1;
+        break;
+
+    case AML_WORD_OP:
+
+        Op->Asl.AmlLength = 2;
+        break;
+
+    case AML_DWORD_OP:
+
+        Op->Asl.AmlLength = 4;
+        break;
+
+    case AML_QWORD_OP:
+
+        Op->Asl.AmlLength = 8;
+        break;
+
+    default:
+
+        /* All data opcodes must be above */
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    CgGenerateAmlLengths
+ *
+ * PARAMETERS:  Op        - Parse node
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Generate internal length fields based on the AML opcode or
+ *              parse opcode.
+ *
+ ******************************************************************************/
+
+void
+CgGenerateAmlLengths (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    char                    *Buffer;
+    ACPI_STATUS             Status;
+
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_RAW_DATA_BYTE:
+
+        Op->Asl.AmlOpcodeLength = 0;
+        Op->Asl.AmlLength = 1;
+        return;
+
+    case AML_RAW_DATA_WORD:
+
+        Op->Asl.AmlOpcodeLength = 0;
+        Op->Asl.AmlLength = 2;
+        return;
+
+    case AML_RAW_DATA_DWORD:
+
+        Op->Asl.AmlOpcodeLength = 0;
+        Op->Asl.AmlLength = 4;
+        return;
+
+    case AML_RAW_DATA_QWORD:
+
+        Op->Asl.AmlOpcodeLength = 0;
+        Op->Asl.AmlLength = 8;
+        return;
+
+    case AML_RAW_DATA_BUFFER:
+
+        /* Aml length is/was set by creator */
+
+        Op->Asl.AmlOpcodeLength = 0;
+        return;
+
+    case AML_RAW_DATA_CHAIN:
+
+        /* Aml length is/was set by creator */
+
+        Op->Asl.AmlOpcodeLength = 0;
+        return;
+
+    default:
+
+        break;
+    }
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_DEFINITION_BLOCK:
+
+        Gbl_TableLength = sizeof (ACPI_TABLE_HEADER) + Op->Asl.AmlSubtreeLength;
+        break;
+
+    case PARSEOP_NAMESEG:
+
+        Op->Asl.AmlOpcodeLength = 0;
+        Op->Asl.AmlLength = 4;
+        Op->Asl.ExternalName = Op->Asl.Value.String;
+        break;
+
+    case PARSEOP_NAMESTRING:
+    case PARSEOP_METHODCALL:
+
+        if (Op->Asl.CompileFlags & NODE_NAME_INTERNALIZED)
+        {
+            break;
+        }
+
+        Op->Asl.AmlOpcodeLength = 0;
+        Status = UtInternalizeName (Op->Asl.Value.String, &Buffer);
+        if (ACPI_FAILURE (Status))
+        {
+            DbgPrint (ASL_DEBUG_OUTPUT,
+                "Failure from internalize name %X\n", Status);
+            break;
+        }
+
+        Op->Asl.ExternalName = Op->Asl.Value.String;
+        Op->Asl.Value.String = Buffer;
+        Op->Asl.CompileFlags |= NODE_NAME_INTERNALIZED;
+        Op->Asl.AmlLength = strlen (Buffer);
+
+        /*
+         * Check for single backslash reference to root,
+         * make it a null terminated string in the AML
+         */
+        if (Op->Asl.AmlLength == 1)
+        {
+            Op->Asl.AmlLength = 2;
+        }
+        break;
+
+    case PARSEOP_STRING_LITERAL:
+
+        Op->Asl.AmlOpcodeLength = 1;
+
+        /* Get null terminator */
+
+        Op->Asl.AmlLength = strlen (Op->Asl.Value.String) + 1;
+        break;
+
+    case PARSEOP_PACKAGE_LENGTH:
+
+        Op->Asl.AmlOpcodeLength = 0;
+        Op->Asl.AmlPkgLenBytes = CgGetPackageLenByteCount (Op,
+            (UINT32) Op->Asl.Value.Integer);
+        break;
+
+    case PARSEOP_RAW_DATA:
+
+        Op->Asl.AmlOpcodeLength = 0;
+        break;
+
+    case PARSEOP_DEFAULT_ARG:
+    case PARSEOP_INCLUDE:
+    case PARSEOP_INCLUDE_END:
+
+        /* Ignore the "default arg" nodes, they are extraneous at this point */
+
+        break;
+
+    case PARSEOP_EXTERNAL:
+
+        if (Gbl_DoExternals == TRUE)
+        {
+            CgGenerateAmlOpcodeLength (Op);
+        }
+        break;
+
+    default:
+
+        CgGenerateAmlOpcodeLength (Op);
+        break;
+    }
+}
+
+
+#ifdef ACPI_OBSOLETE_FUNCTIONS
+/*******************************************************************************
+ *
+ * FUNCTION:    LnAdjustLengthToRoot
+ *
+ * PARAMETERS:  Op      - Node whose Length was changed
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Change the Subtree length of the given node, and bubble the
+ *              change all the way up to the root node. This allows for
+ *              last second changes to a package length (for example, if the
+ *              package length encoding gets shorter or longer.)
+ *
+ ******************************************************************************/
+
+void
+LnAdjustLengthToRoot (
+    ACPI_PARSE_OBJECT       *SubtreeOp,
+    UINT32                  LengthDelta)
+{
+    ACPI_PARSE_OBJECT       *Op;
+
+
+    /* Adjust all subtree lengths up to the root */
+
+    Op = SubtreeOp->Asl.Parent;
+    while (Op)
+    {
+        Op->Asl.AmlSubtreeLength -= LengthDelta;
+        Op = Op->Asl.Parent;
+    }
+
+    /* Adjust the global table length */
+
+    Gbl_TableLength -= LengthDelta;
+}
+#endif
diff --git a/usr/src/cmd/acpi/iasl/asllisting.c b/usr/src/cmd/acpi/iasl/asllisting.c
new file mode 100644
index 0000000000..692d199e35
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asllisting.c
@@ -0,0 +1,745 @@
+/******************************************************************************
+ *
+ * Module Name: asllisting - Listing file generation
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+#include "acparser.h"
+#include "acnamesp.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asllisting")
+
+
+/* Local prototypes */
+
+static void
+LsGenerateListing (
+    UINT32                  FileId);
+
+static ACPI_STATUS
+LsAmlListingWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+LsTreeWriteWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static void
+LsWriteNodeToListing (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  FileId);
+
+static void
+LsFinishSourceListing (
+    UINT32                  FileId);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsDoListings
+ *
+ * PARAMETERS:  None. Examines the various output file global flags.
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Generate all requested listing files.
+ *
+ ******************************************************************************/
+
+void
+LsDoListings (
+    void)
+{
+
+    if (Gbl_C_OutputFlag)
+    {
+        LsGenerateListing (ASL_FILE_C_SOURCE_OUTPUT);
+    }
+
+    if (Gbl_ListingFlag)
+    {
+        LsGenerateListing (ASL_FILE_LISTING_OUTPUT);
+    }
+
+    if (Gbl_AsmOutputFlag)
+    {
+        LsGenerateListing (ASL_FILE_ASM_SOURCE_OUTPUT);
+    }
+
+    if (Gbl_C_IncludeOutputFlag)
+    {
+        LsGenerateListing (ASL_FILE_C_INCLUDE_OUTPUT);
+    }
+
+    if (Gbl_AsmIncludeOutputFlag)
+    {
+        LsGenerateListing (ASL_FILE_ASM_INCLUDE_OUTPUT);
+    }
+
+    if (Gbl_C_OffsetTableFlag)
+    {
+        LsGenerateListing (ASL_FILE_C_OFFSET_OUTPUT);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsGenerateListing
+ *
+ * PARAMETERS:  FileId      - ID of listing file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Generate a listing file. This can be one of the several types
+ *              of "listings" supported.
+ *
+ ******************************************************************************/
+
+static void
+LsGenerateListing (
+    UINT32                  FileId)
+{
+
+    /* Start at the beginning of both the source and AML files */
+
+    FlSeekFile (ASL_FILE_SOURCE_OUTPUT, 0);
+    FlSeekFile (ASL_FILE_AML_OUTPUT, 0);
+    Gbl_SourceLine = 0;
+    Gbl_CurrentHexColumn = 0;
+    LsPushNode (Gbl_Files[ASL_FILE_INPUT].Filename);
+
+    if (FileId == ASL_FILE_C_OFFSET_OUTPUT)
+    {
+        Gbl_CurrentAmlOffset = 0;
+
+        /* Offset table file has a special header and footer */
+
+        LsDoOffsetTableHeader (FileId);
+
+        TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+            LsAmlOffsetWalk, NULL, (void *) ACPI_TO_POINTER (FileId));
+        LsDoOffsetTableFooter (FileId);
+        return;
+    }
+
+    /* Process all parse nodes */
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        LsAmlListingWalk, NULL, (void *) ACPI_TO_POINTER (FileId));
+
+    /* Final processing */
+
+    LsFinishSourceListing (FileId);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsAmlListingWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Process one node during a listing file generation.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+LsAmlListingWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    UINT8                   FileByte;
+    UINT32                  i;
+    UINT32                  FileId = (UINT32) ACPI_TO_INTEGER (Context);
+
+
+    LsWriteNodeToListing (Op, FileId);
+
+    if (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DATA)
+    {
+        /* Buffer is a resource template, don't dump the data all at once */
+
+        return (AE_OK);
+    }
+
+    if ((FileId == ASL_FILE_ASM_INCLUDE_OUTPUT) ||
+        (FileId == ASL_FILE_C_INCLUDE_OUTPUT))
+    {
+        return (AE_OK);
+    }
+
+    /* Write the hex bytes to the listing file(s) (if requested) */
+
+    for (i = 0; i < Op->Asl.FinalAmlLength; i++)
+    {
+        if (ACPI_FAILURE (FlReadFile (ASL_FILE_AML_OUTPUT, &FileByte, 1)))
+        {
+            FlFileError (ASL_FILE_AML_OUTPUT, ASL_MSG_READ);
+            AslAbort ();
+        }
+
+        LsWriteListingHexBytes (&FileByte, 1, FileId);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsDumpParseTree, LsTreeWriteWalk
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump entire parse tree, for compiler debug only
+ *
+ ******************************************************************************/
+
+void
+LsDumpParseTree (
+    void)
+{
+
+    if (!Gbl_DebugFlag)
+    {
+        return;
+    }
+
+    DbgPrint (ASL_TREE_OUTPUT, "\nOriginal parse tree from parser:\n\n");
+    DbgPrint (ASL_TREE_OUTPUT, ASL_PARSE_TREE_HEADER1);
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        LsTreeWriteWalk, NULL, NULL);
+
+    DbgPrint (ASL_TREE_OUTPUT, ASL_PARSE_TREE_HEADER1);
+}
+
+
+static ACPI_STATUS
+LsTreeWriteWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    /* Dump ParseOp name and possible value */
+
+    switch (Op->Asl.ParseOpcode)
+    {
+        case PARSEOP_NAMESEG:
+        case PARSEOP_NAMESTRING:
+        case PARSEOP_METHODCALL:
+        case PARSEOP_STRING_LITERAL:
+
+        UtDumpStringOp (Op, Level);
+        break;
+
+    case PARSEOP_BYTECONST:
+
+        UtDumpIntegerOp (Op, Level, 2);
+        break;
+
+    case PARSEOP_WORDCONST:
+    case PARSEOP_PACKAGE_LENGTH:
+
+        UtDumpIntegerOp (Op, Level, 4);
+        break;
+
+    case PARSEOP_DWORDCONST:
+    case PARSEOP_EISAID:
+
+        UtDumpIntegerOp (Op, Level, 8);
+        break;
+
+    case PARSEOP_QWORDCONST:
+    case PARSEOP_INTEGER:
+    case PARSEOP_ONE:
+    case PARSEOP_ZERO:
+    case PARSEOP_ONES:
+
+        UtDumpIntegerOp (Op, Level, 16);
+        break;
+
+    case PARSEOP_INCLUDE:
+
+        DbgPrint (ASL_TREE_OUTPUT,
+            "Open: %s\n", Op->Asl.Value.String);
+        return (AE_OK);
+
+    case PARSEOP_INCLUDE_END:
+
+        DbgPrint (ASL_TREE_OUTPUT,
+            "Close: %s\n", Op->Asl.Filename);
+        return (AE_OK);
+
+    default:
+
+        UtDumpBasicOp (Op, Level);
+        break;
+    }
+
+    /* Dump the remaining data */
+
+    DbgPrint (ASL_TREE_OUTPUT, ASL_PARSE_TREE_DEBUG1,
+        Op->Asl.ParseOpcode, Op->Asl.CompileFlags,
+        Op->Asl.LineNumber, Op->Asl.EndLine,
+        Op->Asl.LogicalLineNumber, Op->Asl.EndLogicalLine);
+
+    TrPrintNodeCompileFlags (Op->Asl.CompileFlags);
+    DbgPrint (ASL_TREE_OUTPUT, "\n");
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsWriteNodeToListing
+ *
+ * PARAMETERS:  Op              - Parse node to write to the listing file.
+ *              FileId          - ID of current listing file
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Write "a node" to the listing file. This means to
+ *              1) Write out all of the source text associated with the node
+ *              2) Write out all of the AML bytes associated with the node
+ *              3) Write any compiler exceptions associated with the node
+ *
+ ******************************************************************************/
+
+static void
+LsWriteNodeToListing (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  FileId)
+{
+    const ACPI_OPCODE_INFO  *OpInfo;
+    UINT32                  OpClass;
+    char                    *Pathname;
+    UINT32                  Length;
+    UINT32                  i;
+
+
+    OpInfo  = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+    OpClass = OpInfo->Class;
+
+    /* TBD: clean this up with a single flag that says:
+     * I start a named output block
+     */
+    if (FileId == ASL_FILE_C_SOURCE_OUTPUT)
+    {
+        switch (Op->Asl.ParseOpcode)
+        {
+        case PARSEOP_DEFINITION_BLOCK:
+        case PARSEOP_METHODCALL:
+        case PARSEOP_INCLUDE:
+        case PARSEOP_INCLUDE_END:
+        case PARSEOP_DEFAULT_ARG:
+
+            break;
+
+        default:
+
+            switch (OpClass)
+            {
+            case AML_CLASS_NAMED_OBJECT:
+
+                switch (Op->Asl.AmlOpcode)
+                {
+                case AML_SCOPE_OP:
+                case AML_ALIAS_OP:
+
+                    break;
+
+                default:
+
+                    if (Op->Asl.ExternalName)
+                    {
+                        LsFlushListingBuffer (FileId);
+                        FlPrintFile (FileId, "    };\n");
+                    }
+                    break;
+                }
+                break;
+
+            default:
+
+                /* Don't care about other objects */
+
+                break;
+            }
+            break;
+        }
+    }
+
+    /* These cases do not have a corresponding AML opcode */
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_DEFINITION_BLOCK:
+
+        /* Always start a definition block at AML offset zero */
+
+        Gbl_CurrentAmlOffset = 0;
+        LsWriteSourceLines (Op->Asl.EndLine, Op->Asl.EndLogicalLine, FileId);
+
+        /* Use the table Signature and TableId to build a unique name */
+
+        switch (FileId)
+        {
+        case ASL_FILE_ASM_SOURCE_OUTPUT:
+
+            FlPrintFile (FileId,
+                "%s_%s_Header \\\n",
+                Gbl_TableSignature, Gbl_TableId);
+            break;
+
+        case ASL_FILE_C_SOURCE_OUTPUT:
+
+            FlPrintFile (FileId,
+                "    unsigned char    %s_%s_Header [] =\n    {\n",
+                Gbl_TableSignature, Gbl_TableId);
+            break;
+
+        case ASL_FILE_ASM_INCLUDE_OUTPUT:
+
+            FlPrintFile (FileId,
+                "extrn %s_%s_Header : byte\n",
+                Gbl_TableSignature, Gbl_TableId);
+            break;
+
+        case ASL_FILE_C_INCLUDE_OUTPUT:
+
+            FlPrintFile (FileId,
+                "extern unsigned char    %s_%s_Header [];\n",
+                Gbl_TableSignature, Gbl_TableId);
+            break;
+
+        default:
+            break;
+        }
+
+        return;
+
+
+    case PARSEOP_METHODCALL:
+
+        LsWriteSourceLines (Op->Asl.LineNumber, Op->Asl.LogicalLineNumber,
+            FileId);
+        return;
+
+
+    case PARSEOP_INCLUDE:
+
+        /* Flush everything up to and including the include source line */
+
+        LsWriteSourceLines (Op->Asl.LineNumber, Op->Asl.LogicalLineNumber,
+            FileId);
+
+        /* Create a new listing node and push it */
+
+        LsPushNode (Op->Asl.Value.String);
+        return;
+
+
+    case PARSEOP_INCLUDE_END:
+
+        /* Flush out the rest of the include file */
+
+        LsWriteSourceLines (Op->Asl.LineNumber, Op->Asl.LogicalLineNumber,
+            FileId);
+
+        /* Pop off this listing node and go back to the parent file */
+
+        (void) LsPopNode ();
+        return;
+
+
+    case PARSEOP_DEFAULT_ARG:
+
+        if (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DESC)
+        {
+            LsWriteSourceLines (Op->Asl.LineNumber, Op->Asl.EndLogicalLine,
+                FileId);
+        }
+        return;
+
+
+    default:
+
+        /* All other opcodes have an AML opcode */
+
+        break;
+    }
+
+    /*
+     * Otherwise, we look at the AML opcode because we can
+     * switch on the opcode type, getting an entire class
+     * at once
+     */
+    switch (OpClass)
+    {
+    case AML_CLASS_ARGUMENT:       /* argument type only */
+    case AML_CLASS_INTERNAL:
+
+        break;
+
+    case AML_CLASS_NAMED_OBJECT:
+
+        switch (Op->Asl.AmlOpcode)
+        {
+        case AML_FIELD_OP:
+        case AML_INDEX_FIELD_OP:
+        case AML_BANK_FIELD_OP:
+            /*
+             * For fields, we want to dump all the AML after the
+             * entire definition
+             */
+            LsWriteSourceLines (Op->Asl.EndLine, Op->Asl.EndLogicalLine,
+                FileId);
+            break;
+
+        case AML_NAME_OP:
+
+            if (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DESC)
+            {
+                LsWriteSourceLines (Op->Asl.LineNumber, Op->Asl.LogicalLineNumber,
+                    FileId);
+            }
+            else
+            {
+                /*
+                 * For fields, we want to dump all the AML after the
+                 * entire definition
+                 */
+                LsWriteSourceLines (Op->Asl.EndLine, Op->Asl.EndLogicalLine,
+                    FileId);
+            }
+            break;
+
+        default:
+
+            LsWriteSourceLines (Op->Asl.LineNumber, Op->Asl.LogicalLineNumber,
+                FileId);
+            break;
+        }
+
+        switch (Op->Asl.AmlOpcode)
+        {
+        case AML_SCOPE_OP:
+        case AML_ALIAS_OP:
+
+            /* These opcodes do not declare a new object, ignore them */
+
+            break;
+
+        default:
+
+            /* All other named object opcodes come here */
+
+            switch (FileId)
+            {
+            case ASL_FILE_ASM_SOURCE_OUTPUT:
+            case ASL_FILE_C_SOURCE_OUTPUT:
+            case ASL_FILE_ASM_INCLUDE_OUTPUT:
+            case ASL_FILE_C_INCLUDE_OUTPUT:
+                /*
+                 * For named objects, we will create a valid symbol so that the
+                 * AML code can be referenced from C or ASM
+                 */
+                if (Op->Asl.ExternalName)
+                {
+                    /* Get the full pathname associated with this node */
+
+                    Pathname = AcpiNsGetExternalPathname (Op->Asl.Node);
+                    Length = strlen (Pathname);
+                    if (Length >= 4)
+                    {
+                        /* Convert all dots in the path to underscores */
+
+                        for (i = 0; i < Length; i++)
+                        {
+                            if (Pathname[i] == '.')
+                            {
+                                Pathname[i] = '_';
+                            }
+                        }
+
+                        /* Create the appropriate symbol in the output file */
+
+                        switch (FileId)
+                        {
+                        case ASL_FILE_ASM_SOURCE_OUTPUT:
+
+                            FlPrintFile (FileId,
+                                "%s_%s_%s  \\\n",
+                                Gbl_TableSignature, Gbl_TableId, &Pathname[1]);
+                            break;
+
+                        case ASL_FILE_C_SOURCE_OUTPUT:
+
+                            FlPrintFile (FileId,
+                                "    unsigned char    %s_%s_%s [] =\n    {\n",
+                                Gbl_TableSignature, Gbl_TableId, &Pathname[1]);
+                            break;
+
+                        case ASL_FILE_ASM_INCLUDE_OUTPUT:
+
+                            FlPrintFile (FileId,
+                                "extrn %s_%s_%s : byte\n",
+                                Gbl_TableSignature, Gbl_TableId, &Pathname[1]);
+                            break;
+
+                        case ASL_FILE_C_INCLUDE_OUTPUT:
+
+                            FlPrintFile (FileId,
+                                "extern unsigned char    %s_%s_%s [];\n",
+                                Gbl_TableSignature, Gbl_TableId, &Pathname[1]);
+                            break;
+
+                        default:
+                            break;
+                        }
+                    }
+
+                    ACPI_FREE (Pathname);
+                }
+                break;
+
+            default:
+
+                /* Nothing to do for listing file */
+
+                break;
+            }
+        }
+        break;
+
+    case AML_CLASS_EXECUTE:
+    case AML_CLASS_CREATE:
+    default:
+
+        if ((Op->Asl.ParseOpcode == PARSEOP_BUFFER) &&
+            (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DESC))
+        {
+            return;
+        }
+
+        LsWriteSourceLines (Op->Asl.LineNumber, Op->Asl.LogicalLineNumber,
+            FileId);
+        break;
+
+    case AML_CLASS_UNKNOWN:
+
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsFinishSourceListing
+ *
+ * PARAMETERS:  FileId          - ID of current listing file.
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Cleanup routine for the listing file. Flush the hex AML
+ *              listing buffer, and flush out any remaining lines in the
+ *              source input file.
+ *
+ ******************************************************************************/
+
+static void
+LsFinishSourceListing (
+    UINT32                  FileId)
+{
+
+    if ((FileId == ASL_FILE_ASM_INCLUDE_OUTPUT) ||
+        (FileId == ASL_FILE_C_INCLUDE_OUTPUT))
+    {
+        return;
+    }
+
+    LsFlushListingBuffer (FileId);
+    Gbl_CurrentAmlOffset = 0;
+
+    /* Flush any remaining text in the source file */
+
+    if (FileId == ASL_FILE_C_SOURCE_OUTPUT)
+    {
+        FlPrintFile (FileId, "    /*\n");
+    }
+
+    while (LsWriteOneSourceLine (FileId))
+    { ; }
+
+    if (FileId == ASL_FILE_C_SOURCE_OUTPUT)
+    {
+        FlPrintFile (FileId, "\n     */\n    };\n");
+    }
+
+    FlPrintFile (FileId, "\n");
+
+    if (FileId == ASL_FILE_LISTING_OUTPUT)
+    {
+        /* Print a summary of the compile exceptions */
+
+        FlPrintFile (FileId, "\n\nSummary of errors and warnings\n\n");
+        AePrintErrorLog (FileId);
+        FlPrintFile (FileId, "\n");
+        UtDisplaySummary (FileId);
+        FlPrintFile (FileId, "\n");
+    }
+}
diff --git a/usr/src/cmd/acpi/iasl/asllistsup.c b/usr/src/cmd/acpi/iasl/asllistsup.c
new file mode 100644
index 0000000000..daae21b959
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asllistsup.c
@@ -0,0 +1,711 @@
+/******************************************************************************
+ *
+ * Module Name: asllistsup - Listing file support utilities
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslistsup")
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsDumpAscii
+ *
+ * PARAMETERS:  FileId          - ID of current listing file
+ *              Count           - Number of bytes to convert
+ *              Buffer          - Buffer of bytes to convert
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert hex bytes to ascii
+ *
+ ******************************************************************************/
+
+void
+LsDumpAscii (
+    UINT32                  FileId,
+    UINT32                  Count,
+    UINT8                   *Buffer)
+{
+    UINT8                   BufChar;
+    UINT32                  i;
+
+
+    FlPrintFile (FileId, "    \"");
+    for (i = 0; i < Count; i++)
+    {
+        BufChar = Buffer[i];
+        if (isprint (BufChar))
+        {
+            FlPrintFile (FileId, "%c", BufChar);
+        }
+        else
+        {
+            /* Not a printable character, just put out a dot */
+
+            FlPrintFile (FileId, ".");
+        }
+    }
+
+    FlPrintFile (FileId, "\"");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsDumpAsciiInComment
+ *
+ * PARAMETERS:  FileId          - ID of current listing file
+ *              Count           - Number of bytes to convert
+ *              Buffer          - Buffer of bytes to convert
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert hex bytes to ascii
+ *
+ ******************************************************************************/
+
+void
+LsDumpAsciiInComment (
+    UINT32                  FileId,
+    UINT32                  Count,
+    UINT8                   *Buffer)
+{
+    UINT8                   BufChar = 0;
+    UINT8                   LastChar;
+    UINT32                  i;
+
+
+    FlPrintFile (FileId, "    \"");
+    for (i = 0; i < Count; i++)
+    {
+        LastChar = BufChar;
+        BufChar = Buffer[i];
+
+        if (isprint (BufChar))
+        {
+            /* Handle embedded C comment sequences */
+
+            if (((LastChar == '*') && (BufChar == '/')) ||
+                ((LastChar == '/') && (BufChar == '*')))
+            {
+                /* Insert a space to break the sequence */
+
+                FlPrintFile (FileId, ".", BufChar);
+            }
+
+            FlPrintFile (FileId, "%c", BufChar);
+        }
+        else
+        {
+            /* Not a printable character, just put out a dot */
+
+            FlPrintFile (FileId, ".");
+        }
+    }
+
+    FlPrintFile (FileId, "\"");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsCheckException
+ *
+ * PARAMETERS:  LineNumber          - Current logical (cumulative) line #
+ *              FileId              - ID of output listing file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check if there is an exception for this line, and if there is,
+ *              put it in the listing immediately. Handles multiple errors
+ *              per line. Gbl_NextError points to the next error in the
+ *              sorted (by line #) list of compile errors/warnings.
+ *
+ ******************************************************************************/
+
+void
+LsCheckException (
+    UINT32                  LineNumber,
+    UINT32                  FileId)
+{
+
+    if ((!Gbl_NextError) ||
+        (LineNumber < Gbl_NextError->LogicalLineNumber ))
+    {
+        return;
+    }
+
+    /* Handle multiple errors per line */
+
+    if (FileId == ASL_FILE_LISTING_OUTPUT)
+    {
+        while (Gbl_NextError &&
+              (LineNumber >= Gbl_NextError->LogicalLineNumber))
+        {
+            AePrintException (FileId, Gbl_NextError, "\n[****iasl****]\n");
+            Gbl_NextError = Gbl_NextError->Next;
+        }
+
+        FlPrintFile (FileId, "\n");
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsWriteListingHexBytes
+ *
+ * PARAMETERS:  Buffer          - AML code buffer
+ *              Length          - Number of AML bytes to write
+ *              FileId          - ID of current listing file.
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write the contents of the AML buffer to the listing file via
+ *              the listing buffer. The listing buffer is flushed every 16
+ *              AML bytes.
+ *
+ ******************************************************************************/
+
+void
+LsWriteListingHexBytes (
+    UINT8                   *Buffer,
+    UINT32                  Length,
+    UINT32                  FileId)
+{
+    UINT32                  i;
+
+
+    /* Transfer all requested bytes */
+
+    for (i = 0; i < Length; i++)
+    {
+        /* Print line header when buffer is empty */
+
+        if (Gbl_CurrentHexColumn == 0)
+        {
+            if (Gbl_HasIncludeFiles)
+            {
+                FlPrintFile (FileId, "%*s", 10, " ");
+            }
+
+            switch (FileId)
+            {
+            case ASL_FILE_LISTING_OUTPUT:
+
+                FlPrintFile (FileId, "%8.8X%s", Gbl_CurrentAmlOffset,
+                    ASL_LISTING_LINE_PREFIX);
+                break;
+
+            case ASL_FILE_ASM_SOURCE_OUTPUT:
+
+                FlPrintFile (FileId, "    db ");
+                break;
+
+            case ASL_FILE_C_SOURCE_OUTPUT:
+
+                FlPrintFile (FileId, "        ");
+                break;
+
+            default:
+
+                /* No other types supported */
+
+                return;
+            }
+        }
+
+        /* Transfer AML byte and update counts */
+
+        Gbl_AmlBuffer[Gbl_CurrentHexColumn] = Buffer[i];
+
+        Gbl_CurrentHexColumn++;
+        Gbl_CurrentAmlOffset++;
+
+        /* Flush buffer when it is full */
+
+        if (Gbl_CurrentHexColumn >= HEX_LISTING_LINE_SIZE)
+        {
+            LsFlushListingBuffer (FileId);
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsWriteSourceLines
+ *
+ * PARAMETERS:  ToLineNumber            -
+ *              ToLogicalLineNumber     - Write up to this source line number
+ *              FileId                  - ID of current listing file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Read then write source lines to the listing file until we have
+ *              reached the specified logical (cumulative) line number. This
+ *              automatically echos out comment blocks and other non-AML
+ *              generating text until we get to the actual AML-generating line
+ *              of ASL code specified by the logical line number.
+ *
+ ******************************************************************************/
+
+void
+LsWriteSourceLines (
+    UINT32                  ToLineNumber,
+    UINT32                  ToLogicalLineNumber,
+    UINT32                  FileId)
+{
+
+    /* Nothing to do for these file types */
+
+    if ((FileId == ASL_FILE_ASM_INCLUDE_OUTPUT) ||
+        (FileId == ASL_FILE_C_INCLUDE_OUTPUT))
+    {
+        return;
+    }
+
+    Gbl_CurrentLine = ToLogicalLineNumber;
+
+    /* Flush any hex bytes remaining from the last opcode */
+
+    LsFlushListingBuffer (FileId);
+
+    /* Read lines and write them as long as we are not caught up */
+
+    if (Gbl_SourceLine < Gbl_CurrentLine)
+    {
+        /*
+         * If we just completed writing some AML hex bytes, output a linefeed
+         * to add some whitespace for readability.
+         */
+        if (Gbl_HexBytesWereWritten)
+        {
+            FlPrintFile (FileId, "\n");
+            Gbl_HexBytesWereWritten = FALSE;
+        }
+
+        if (FileId == ASL_FILE_C_SOURCE_OUTPUT)
+        {
+            FlPrintFile (FileId, "    /*\n");
+        }
+
+        /* Write one line at a time until we have reached the target line # */
+
+        while ((Gbl_SourceLine < Gbl_CurrentLine) &&
+                LsWriteOneSourceLine (FileId))
+        { ; }
+
+        if (FileId == ASL_FILE_C_SOURCE_OUTPUT)
+        {
+            FlPrintFile (FileId, "     */");
+        }
+
+        FlPrintFile (FileId, "\n");
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsWriteOneSourceLine
+ *
+ * PARAMETERS:  FileId          - ID of current listing file
+ *
+ * RETURN:      FALSE on EOF (input source file), TRUE otherwise
+ *
+ * DESCRIPTION: Read one line from the input source file and echo it to the
+ *              listing file, prefixed with the line number, and if the source
+ *              file contains include files, prefixed with the current filename
+ *
+ ******************************************************************************/
+
+UINT32
+LsWriteOneSourceLine (
+    UINT32                  FileId)
+{
+    UINT8                   FileByte;
+    UINT32                  Column = 0;
+    UINT32                  Index = 16;
+    BOOLEAN                 StartOfLine = FALSE;
+    BOOLEAN                 ProcessLongLine = FALSE;
+
+
+    Gbl_SourceLine++;
+    Gbl_ListingNode->LineNumber++;
+
+    /* Ignore lines that are completely blank (but count the line above) */
+
+    if (FlReadFile (ASL_FILE_SOURCE_OUTPUT, &FileByte, 1) != AE_OK)
+    {
+        return (0);
+    }
+    if (FileByte == '\n')
+    {
+        return (1);
+    }
+
+    /*
+     * This is a non-empty line, we will print the entire line with
+     * the line number and possibly other prefixes and transforms.
+     */
+
+    /* Line prefixes for special files, C and ASM output */
+
+    if (FileId == ASL_FILE_C_SOURCE_OUTPUT)
+    {
+        FlPrintFile (FileId, "     *");
+    }
+    if (FileId == ASL_FILE_ASM_SOURCE_OUTPUT)
+    {
+        FlPrintFile (FileId, "; ");
+    }
+
+    if (Gbl_HasIncludeFiles)
+    {
+        /*
+         * This file contains "include" statements, print the current
+         * filename and line number within the current file
+         */
+        FlPrintFile (FileId, "%12s %5d%s",
+            Gbl_ListingNode->Filename, Gbl_ListingNode->LineNumber,
+            ASL_LISTING_LINE_PREFIX);
+    }
+    else
+    {
+        /* No include files, just print the line number */
+
+        FlPrintFile (FileId, "%8u%s", Gbl_SourceLine,
+            ASL_LISTING_LINE_PREFIX);
+    }
+
+    /* Read the rest of this line (up to a newline or EOF) */
+
+    do
+    {
+        if (FileId == ASL_FILE_C_SOURCE_OUTPUT)
+        {
+            if (FileByte == '/')
+            {
+                FileByte = '*';
+            }
+        }
+
+        /* Split long input lines for readability in the listing */
+
+        Column++;
+        if (Column >= 128)
+        {
+            if (!ProcessLongLine)
+            {
+                if ((FileByte != '}') &&
+                    (FileByte != '{'))
+                {
+                    goto WriteByte;
+                }
+
+                ProcessLongLine = TRUE;
+            }
+
+            if (FileByte == '{')
+            {
+                FlPrintFile (FileId, "\n%*s{\n", Index, " ");
+                StartOfLine = TRUE;
+                Index += 4;
+                continue;
+            }
+
+            else if (FileByte == '}')
+            {
+                if (!StartOfLine)
+                {
+                    FlPrintFile (FileId, "\n");
+                }
+
+                StartOfLine = TRUE;
+                Index -= 4;
+                FlPrintFile (FileId, "%*s}\n", Index, " ");
+                continue;
+            }
+
+            /* Ignore spaces/tabs at the start of line */
+
+            else if ((FileByte == ' ') && StartOfLine)
+            {
+                continue;
+            }
+
+            else if (StartOfLine)
+            {
+                StartOfLine = FALSE;
+                FlPrintFile (FileId, "%*s", Index, " ");
+            }
+
+WriteByte:
+            FlWriteFile (FileId, &FileByte, 1);
+            if (FileByte == '\n')
+            {
+                /*
+                 * This line has been completed.
+                 * Check if an error occurred on this source line during the compile.
+                 * If so, we print the error message after the source line.
+                 */
+                LsCheckException (Gbl_SourceLine, FileId);
+                return (1);
+            }
+        }
+        else
+        {
+            FlWriteFile (FileId, &FileByte, 1);
+            if (FileByte == '\n')
+            {
+                /*
+                 * This line has been completed.
+                 * Check if an error occurred on this source line during the compile.
+                 * If so, we print the error message after the source line.
+                 */
+                LsCheckException (Gbl_SourceLine, FileId);
+                return (1);
+            }
+        }
+
+    } while (FlReadFile (ASL_FILE_SOURCE_OUTPUT, &FileByte, 1) == AE_OK);
+
+    /* EOF on the input file was reached */
+
+    return (0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsFlushListingBuffer
+ *
+ * PARAMETERS:  FileId          - ID of the listing file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Flush out the current contents of the 16-byte hex AML code
+ *              buffer. Usually called at the termination of a single line
+ *              of source code or when the buffer is full.
+ *
+ ******************************************************************************/
+
+void
+LsFlushListingBuffer (
+    UINT32                  FileId)
+{
+    UINT32                  i;
+
+
+    if (Gbl_CurrentHexColumn == 0)
+    {
+        return;
+    }
+
+    /* Write the hex bytes */
+
+    switch (FileId)
+    {
+    case ASL_FILE_LISTING_OUTPUT:
+
+        for (i = 0; i < Gbl_CurrentHexColumn; i++)
+        {
+            FlPrintFile (FileId, "%2.2X ", Gbl_AmlBuffer[i]);
+        }
+
+        for (i = 0; i < ((HEX_LISTING_LINE_SIZE - Gbl_CurrentHexColumn) * 3); i++)
+        {
+            FlWriteFile (FileId, ".", 1);
+        }
+
+        /* Write the ASCII character associated with each of the bytes */
+
+        LsDumpAscii (FileId, Gbl_CurrentHexColumn, Gbl_AmlBuffer);
+        break;
+
+
+    case ASL_FILE_ASM_SOURCE_OUTPUT:
+
+        for (i = 0; i < Gbl_CurrentHexColumn; i++)
+        {
+            if (i > 0)
+            {
+                FlPrintFile (FileId, ",");
+            }
+
+            FlPrintFile (FileId, "0%2.2Xh", Gbl_AmlBuffer[i]);
+        }
+
+        for (i = 0; i < ((HEX_LISTING_LINE_SIZE - Gbl_CurrentHexColumn) * 5); i++)
+        {
+            FlWriteFile (FileId, " ", 1);
+        }
+
+        FlPrintFile (FileId, "  ;%8.8X",
+            Gbl_CurrentAmlOffset - HEX_LISTING_LINE_SIZE);
+
+        /* Write the ASCII character associated with each of the bytes */
+
+        LsDumpAscii (FileId, Gbl_CurrentHexColumn, Gbl_AmlBuffer);
+        break;
+
+
+    case ASL_FILE_C_SOURCE_OUTPUT:
+
+        for (i = 0; i < Gbl_CurrentHexColumn; i++)
+        {
+            FlPrintFile (FileId, "0x%2.2X,", Gbl_AmlBuffer[i]);
+        }
+
+        /* Pad hex output with spaces if line is shorter than max line size */
+
+        for (i = 0; i < ((HEX_LISTING_LINE_SIZE - Gbl_CurrentHexColumn) * 5); i++)
+        {
+            FlWriteFile (FileId, " ", 1);
+        }
+
+        /* AML offset for the start of the line */
+
+        FlPrintFile (FileId, "    /* %8.8X",
+            Gbl_CurrentAmlOffset - Gbl_CurrentHexColumn);
+
+        /* Write the ASCII character associated with each of the bytes */
+
+        LsDumpAsciiInComment (FileId, Gbl_CurrentHexColumn, Gbl_AmlBuffer);
+        FlPrintFile (FileId, " */");
+        break;
+
+    default:
+
+        /* No other types supported */
+
+        return;
+    }
+
+    FlPrintFile (FileId, "\n");
+
+    Gbl_CurrentHexColumn = 0;
+    Gbl_HexBytesWereWritten = TRUE;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsPushNode
+ *
+ * PARAMETERS:  Filename        - Pointer to the include filename
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Push a listing node on the listing/include file stack. This
+ *              stack enables tracking of include files (infinitely nested)
+ *              and resumption of the listing of the parent file when the
+ *              include file is finished.
+ *
+ ******************************************************************************/
+
+void
+LsPushNode (
+    char                    *Filename)
+{
+    ASL_LISTING_NODE        *Lnode;
+
+
+    /* Create a new node */
+
+    Lnode = UtLocalCalloc (sizeof (ASL_LISTING_NODE));
+
+    /* Initialize */
+
+    Lnode->Filename = Filename;
+    Lnode->LineNumber = 0;
+
+    /* Link (push) */
+
+    Lnode->Next = Gbl_ListingNode;
+    Gbl_ListingNode = Lnode;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsPopNode
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      List head after current head is popped off
+ *
+ * DESCRIPTION: Pop the current head of the list, free it, and return the
+ *              next node on the stack (the new current node).
+ *
+ ******************************************************************************/
+
+ASL_LISTING_NODE *
+LsPopNode (
+    void)
+{
+    ASL_LISTING_NODE        *Lnode;
+
+
+    /* Just grab the node at the head of the list */
+
+    Lnode = Gbl_ListingNode;
+    if ((!Lnode) ||
+        (!Lnode->Next))
+    {
+        AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL, NULL,
+            "Could not pop empty listing stack");
+        return (Gbl_ListingNode);
+    }
+
+    Gbl_ListingNode = Lnode->Next;
+    ACPI_FREE (Lnode);
+
+    /* New "Current" node is the new head */
+
+    return (Gbl_ListingNode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslload.c b/usr/src/cmd/acpi/iasl/aslload.c
new file mode 100644
index 0000000000..99ec1bfe06
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslload.c
@@ -0,0 +1,982 @@
+/******************************************************************************
+ *
+ * Module Name: dswload - Dispatcher namespace load callbacks
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "amlcode.h"
+#include "acdispat.h"
+#include "acnamesp.h"
+
+#include "aslcompiler.y.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslload")
+
+/* Local prototypes */
+
+static ACPI_STATUS
+LdLoadFieldElements (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState);
+
+static ACPI_STATUS
+LdLoadResourceElements (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState);
+
+static ACPI_STATUS
+LdNamespace1Begin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+LdNamespace2Begin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+LdCommonNamespaceEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LdLoadNamespace
+ *
+ * PARAMETERS:  RootOp      - Root of the parse tree
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Perform a walk of the parse tree that in turn loads all of the
+ *              named ASL/AML objects into the namespace. The namespace is
+ *              constructed in order to resolve named references and references
+ *              to named fields within resource templates/descriptors.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+LdLoadNamespace (
+    ACPI_PARSE_OBJECT       *RootOp)
+{
+    ACPI_WALK_STATE         *WalkState;
+
+
+    /* Create a new walk state */
+
+    WalkState = AcpiDsCreateWalkState (0, NULL, NULL, NULL);
+    if (!WalkState)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    /* Walk the entire parse tree, first pass */
+
+    TrWalkParseTree (RootOp, ASL_WALK_VISIT_TWICE, LdNamespace1Begin,
+        LdCommonNamespaceEnd, WalkState);
+
+    /* Second pass to handle forward references */
+
+    TrWalkParseTree (RootOp, ASL_WALK_VISIT_TWICE, LdNamespace2Begin,
+        LdCommonNamespaceEnd, WalkState);
+
+    /* Dump the namespace if debug is enabled */
+
+    AcpiNsDumpTables (ACPI_NS_ALL, ACPI_UINT32_MAX);
+    ACPI_FREE (WalkState);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LdLoadFieldElements
+ *
+ * PARAMETERS:  Op              - Parent node (Field)
+ *              WalkState       - Current walk state
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Enter the named elements of the field (children of the parent)
+ *              into the namespace.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+LdLoadFieldElements (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+{
+    ACPI_PARSE_OBJECT       *Child = NULL;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_STATUS             Status;
+
+
+    /* Get the first named field element */
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_BANK_FIELD_OP:
+
+        Child = UtGetArg (Op, 6);
+        break;
+
+    case AML_INDEX_FIELD_OP:
+
+        Child = UtGetArg (Op, 5);
+        break;
+
+    case AML_FIELD_OP:
+
+        Child = UtGetArg (Op, 4);
+        break;
+
+    default:
+
+        /* No other opcodes should arrive here */
+
+        return (AE_BAD_PARAMETER);
+    }
+
+    /* Enter all elements into the namespace */
+
+    while (Child)
+    {
+        switch (Child->Asl.AmlOpcode)
+        {
+        case AML_INT_RESERVEDFIELD_OP:
+        case AML_INT_ACCESSFIELD_OP:
+        case AML_INT_CONNECTION_OP:
+            break;
+
+        default:
+
+            Status = AcpiNsLookup (WalkState->ScopeInfo,
+                Child->Asl.Value.String,
+                ACPI_TYPE_LOCAL_REGION_FIELD,
+                ACPI_IMODE_LOAD_PASS1,
+                ACPI_NS_NO_UPSEARCH | ACPI_NS_DONT_OPEN_SCOPE |
+                    ACPI_NS_ERROR_IF_FOUND, NULL, &Node);
+            if (ACPI_FAILURE (Status))
+            {
+                if (Status != AE_ALREADY_EXISTS)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_CORE_EXCEPTION, Child,
+                        Child->Asl.Value.String);
+                    return (Status);
+                }
+
+                /*
+                 * The name already exists in this scope
+                 * But continue processing the elements
+                 */
+                AslError (ASL_ERROR, ASL_MSG_NAME_EXISTS, Child,
+                    Child->Asl.Value.String);
+            }
+            else
+            {
+                Child->Asl.Node = Node;
+                Node->Op = Child;
+            }
+            break;
+        }
+
+        Child = Child->Asl.Next;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LdLoadResourceElements
+ *
+ * PARAMETERS:  Op              - Parent node (Resource Descriptor)
+ *              WalkState       - Current walk state
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Enter the named elements of the resource descriptor (children
+ *              of the parent) into the namespace.
+ *
+ * NOTE: In the real AML namespace, these named elements never exist. But
+ *       we simply use the namespace here as a symbol table so we can look
+ *       them up as they are referenced.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+LdLoadResourceElements (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+{
+    ACPI_PARSE_OBJECT       *InitializerOp = NULL;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_STATUS             Status;
+
+
+    /*
+     * Enter the resource name into the namespace. Name must not already exist.
+     * This opens a scope, so later field names are guaranteed to be new/unique.
+     */
+    Status = AcpiNsLookup (WalkState->ScopeInfo, Op->Asl.Namepath,
+        ACPI_TYPE_LOCAL_RESOURCE, ACPI_IMODE_LOAD_PASS1,
+        ACPI_NS_NO_UPSEARCH | ACPI_NS_ERROR_IF_FOUND,
+        WalkState, &Node);
+    if (ACPI_FAILURE (Status))
+    {
+        if (Status == AE_ALREADY_EXISTS)
+        {
+            /* Actual node causing the error was saved in ParentMethod */
+
+            AslError (ASL_ERROR, ASL_MSG_NAME_EXISTS,
+                (ACPI_PARSE_OBJECT *) Op->Asl.ParentMethod, Op->Asl.Namepath);
+            return (AE_OK);
+        }
+        return (Status);
+    }
+
+    Node->Value = (UINT32) Op->Asl.Value.Integer;
+    Node->Op = Op;
+    Op->Asl.Node = Node;
+
+    /*
+     * Now enter the predefined fields, for easy lookup when referenced
+     * by the source ASL
+     */
+    InitializerOp = ASL_GET_CHILD_NODE (Op);
+    while (InitializerOp)
+    {
+        if (InitializerOp->Asl.ExternalName)
+        {
+            Status = AcpiNsLookup (WalkState->ScopeInfo,
+                InitializerOp->Asl.ExternalName,
+                ACPI_TYPE_LOCAL_RESOURCE_FIELD,
+                ACPI_IMODE_LOAD_PASS1,
+                ACPI_NS_NO_UPSEARCH | ACPI_NS_DONT_OPEN_SCOPE,
+                NULL, &Node);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            /*
+             * Store the field offset and length in the namespace node
+             * so it can be used when the field is referenced
+             */
+            Node->Value = InitializerOp->Asl.Value.Tag.BitOffset;
+            Node->Length = InitializerOp->Asl.Value.Tag.BitLength;
+            InitializerOp->Asl.Node = Node;
+            Node->Op = InitializerOp;
+        }
+
+        InitializerOp = ASL_GET_PEER_NODE (InitializerOp);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LdNamespace1Begin
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending callback used during the parse tree walk. If this
+ *              is a named AML opcode, enter into the namespace
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+LdNamespace1Begin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = (ACPI_WALK_STATE *) Context;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_PARSE_OBJECT       *MethodOp;
+    ACPI_STATUS             Status;
+    ACPI_OBJECT_TYPE        ObjectType;
+    ACPI_OBJECT_TYPE        ActualObjectType = ACPI_TYPE_ANY;
+    char                    *Path;
+    UINT32                  Flags = ACPI_NS_NO_UPSEARCH;
+    ACPI_PARSE_OBJECT       *Arg;
+    UINT32                  i;
+    BOOLEAN                 ForceNewScope = FALSE;
+
+
+    ACPI_FUNCTION_NAME (LdNamespace1Begin);
+    ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH, "Op %p [%s]\n",
+        Op, Op->Asl.ParseOpName));
+
+    /*
+     * We are only interested in opcodes that have an associated name
+     * (or multiple names)
+     */
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_BANK_FIELD_OP:
+    case AML_INDEX_FIELD_OP:
+    case AML_FIELD_OP:
+
+        Status = LdLoadFieldElements (Op, WalkState);
+        return (Status);
+
+    case AML_INT_CONNECTION_OP:
+
+
+        if (Op->Asl.Child->Asl.AmlOpcode != AML_INT_NAMEPATH_OP)
+        {
+            break;
+        }
+        Arg = Op->Asl.Child;
+
+        Status = AcpiNsLookup (WalkState->ScopeInfo, Arg->Asl.ExternalName,
+            ACPI_TYPE_ANY, ACPI_IMODE_EXECUTE, ACPI_NS_SEARCH_PARENT,
+            WalkState, &Node);
+        if (ACPI_FAILURE (Status))
+        {
+            break;
+        }
+
+        if (Node->Type == ACPI_TYPE_BUFFER)
+        {
+            Arg->Asl.Node = Node;
+
+            Arg = Node->Op->Asl.Child;  /* Get namepath */
+            Arg = Arg->Asl.Next;        /* Get actual buffer */
+            Arg = Arg->Asl.Child;       /* Buffer length */
+            Arg = Arg->Asl.Next;        /* RAW_DATA buffer */
+        }
+        break;
+
+    default:
+
+        /* All other opcodes go below */
+
+        break;
+    }
+
+    /* Check if this object has already been installed in the namespace */
+
+    if (Op->Asl.Node)
+    {
+        return (AE_OK);
+    }
+
+    Path = Op->Asl.Namepath;
+    if (!Path)
+    {
+        return (AE_OK);
+    }
+
+    /* Map the raw opcode into an internal object type */
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_NAME:
+
+        Arg = Op->Asl.Child;  /* Get the NameSeg/NameString node */
+        Arg = Arg->Asl.Next;  /* First peer is the object to be associated with the name */
+
+        /*
+         * If this name refers to a ResourceTemplate, we will need to open
+         * a new scope so that the resource subfield names can be entered into
+         * the namespace underneath this name
+         */
+        if (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DESC)
+        {
+            ForceNewScope = TRUE;
+        }
+
+        /* Get the data type associated with the named object, not the name itself */
+
+        /* Log2 loop to convert from Btype (binary) to Etype (encoded) */
+
+        ObjectType = 1;
+        for (i = 1; i < Arg->Asl.AcpiBtype; i *= 2)
+        {
+            ObjectType++;
+        }
+        break;
+
+
+    case PARSEOP_EXTERNAL:
+        /*
+         * "External" simply enters a name and type into the namespace.
+         * We must be careful to not open a new scope, however, no matter
+         * what type the external name refers to (e.g., a method)
+         *
+         * first child is name, next child is ObjectType
+         */
+        ActualObjectType = (UINT8) Op->Asl.Child->Asl.Next->Asl.Value.Integer;
+        ObjectType = ACPI_TYPE_ANY;
+
+        /*
+         * We will mark every new node along the path as "External". This
+         * allows some or all of the nodes to be created later in the ASL
+         * code. Handles cases like this:
+         *
+         *   External (\_SB_.PCI0.ABCD, IntObj)
+         *   Scope (_SB_)
+         *   {
+         *       Device (PCI0)
+         *       {
+         *       }
+         *   }
+         *   Method (X)
+         *   {
+         *       Store (\_SB_.PCI0.ABCD, Local0)
+         *   }
+         */
+        Flags |= ACPI_NS_EXTERNAL;
+        break;
+
+    case PARSEOP_DEFAULT_ARG:
+
+        if (Op->Asl.CompileFlags == NODE_IS_RESOURCE_DESC)
+        {
+            Status = LdLoadResourceElements (Op, WalkState);
+            return_ACPI_STATUS (Status);
+        }
+
+        ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+        break;
+
+    case PARSEOP_SCOPE:
+        /*
+         * The name referenced by Scope(Name) must already exist at this point.
+         * In other words, forward references for Scope() are not supported.
+         * The only real reason for this is that the MS interpreter cannot
+         * handle this case. Perhaps someday this case can go away.
+         */
+        Status = AcpiNsLookup (WalkState->ScopeInfo, Path, ACPI_TYPE_ANY,
+            ACPI_IMODE_EXECUTE, ACPI_NS_SEARCH_PARENT,
+            WalkState, &(Node));
+        if (ACPI_FAILURE (Status))
+        {
+            if (Status == AE_NOT_FOUND)
+            {
+                /* The name was not found, go ahead and create it */
+
+                Status = AcpiNsLookup (WalkState->ScopeInfo, Path,
+                    ACPI_TYPE_LOCAL_SCOPE,
+                    ACPI_IMODE_LOAD_PASS1, Flags,
+                    WalkState, &(Node));
+                if (ACPI_FAILURE (Status))
+                {
+                    return_ACPI_STATUS (Status);
+                }
+
+                /*
+                 * However, this is an error -- primarily because the MS
+                 * interpreter can't handle a forward reference from the
+                 * Scope() operator.
+                 */
+                AslError (ASL_ERROR, ASL_MSG_NOT_FOUND, Op,
+                    Op->Asl.ExternalName);
+                AslError (ASL_ERROR, ASL_MSG_SCOPE_FWD_REF, Op,
+                    Op->Asl.ExternalName);
+                goto FinishNode;
+            }
+
+            AslCoreSubsystemError (Op, Status,
+                "Failure from namespace lookup", FALSE);
+
+            return_ACPI_STATUS (Status);
+        }
+        else /* Status AE_OK */
+        {
+            /*
+             * Do not allow references to external scopes from the DSDT.
+             * This is because the DSDT is always loaded first, and the
+             * external reference cannot be resolved -- causing a runtime
+             * error because Scope() must be resolved immediately.
+             * 10/2015.
+             */
+            if ((Node->Flags & ANOBJ_IS_EXTERNAL) &&
+                (ACPI_COMPARE_NAME (Gbl_TableSignature, "DSDT")))
+            {
+                /* However, allowed if the reference is within a method */
+
+                MethodOp = Op->Asl.Parent;
+                while (MethodOp &&
+                      (MethodOp->Asl.ParseOpcode != PARSEOP_METHOD))
+                {
+                    MethodOp = MethodOp->Asl.Parent;
+                }
+
+                if (!MethodOp)
+                {
+                    /* Not in a control method, error */
+
+                    AslError (ASL_ERROR, ASL_MSG_CROSS_TABLE_SCOPE, Op, NULL);
+                }
+            }
+        }
+
+        /* We found a node with this name, now check the type */
+
+        switch (Node->Type)
+        {
+        case ACPI_TYPE_LOCAL_SCOPE:
+        case ACPI_TYPE_DEVICE:
+        case ACPI_TYPE_POWER:
+        case ACPI_TYPE_PROCESSOR:
+        case ACPI_TYPE_THERMAL:
+
+            /* These are acceptable types - they all open a new scope */
+            break;
+
+        case ACPI_TYPE_INTEGER:
+        case ACPI_TYPE_STRING:
+        case ACPI_TYPE_BUFFER:
+            /*
+             * These types we will allow, but we will change the type.
+             * This enables some existing code of the form:
+             *
+             *  Name (DEB, 0)
+             *  Scope (DEB) { ... }
+             *
+             * Which is used to workaround the fact that the MS interpreter
+             * does not allow Scope() forward references.
+             */
+            sprintf (MsgBuffer, "%s [%s], changing type to [Scope]",
+                Op->Asl.ExternalName, AcpiUtGetTypeName (Node->Type));
+            AslError (ASL_REMARK, ASL_MSG_SCOPE_TYPE, Op, MsgBuffer);
+
+            /* Switch the type to scope, open the new scope */
+
+            Node->Type = ACPI_TYPE_LOCAL_SCOPE;
+            Status = AcpiDsScopeStackPush (Node, ACPI_TYPE_LOCAL_SCOPE,
+                WalkState);
+            if (ACPI_FAILURE (Status))
+            {
+                return_ACPI_STATUS (Status);
+            }
+            break;
+
+        default:
+
+            /* All other types are an error */
+
+            sprintf (MsgBuffer, "%s [%s]", Op->Asl.ExternalName,
+                AcpiUtGetTypeName (Node->Type));
+            AslError (ASL_ERROR, ASL_MSG_SCOPE_TYPE, Op, MsgBuffer);
+
+            /*
+             * However, switch the type to be an actual scope so
+             * that compilation can continue without generating a whole
+             * cascade of additional errors. Open the new scope.
+             */
+            Node->Type = ACPI_TYPE_LOCAL_SCOPE;
+            Status = AcpiDsScopeStackPush (Node, ACPI_TYPE_LOCAL_SCOPE,
+                WalkState);
+            if (ACPI_FAILURE (Status))
+            {
+                return_ACPI_STATUS (Status);
+            }
+            break;
+        }
+
+        Status = AE_OK;
+        goto FinishNode;
+
+
+    default:
+
+        ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+        break;
+    }
+
+
+    ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH, "Loading name: %s, (%s)\n",
+        Op->Asl.ExternalName, AcpiUtGetTypeName (ObjectType)));
+
+    /* The name must not already exist */
+
+    Flags |= ACPI_NS_ERROR_IF_FOUND;
+
+    /*
+     * Enter the named type into the internal namespace. We enter the name
+     * as we go downward in the parse tree. Any necessary subobjects that
+     * involve arguments to the opcode must be created as we go back up the
+     * parse tree later.
+     */
+    Status = AcpiNsLookup (WalkState->ScopeInfo, Path, ObjectType,
+        ACPI_IMODE_LOAD_PASS1, Flags, WalkState, &Node);
+    if (ACPI_FAILURE (Status))
+    {
+        if (Status == AE_ALREADY_EXISTS)
+        {
+            /* The name already exists in this scope */
+
+            if (Node->Type == ACPI_TYPE_LOCAL_SCOPE)
+            {
+                /* Allow multiple references to the same scope */
+
+                Node->Type = (UINT8) ObjectType;
+                Status = AE_OK;
+            }
+            else if ((Node->Flags & ANOBJ_IS_EXTERNAL) &&
+                     (Op->Asl.ParseOpcode != PARSEOP_EXTERNAL))
+            {
+                /*
+                 * Allow one create on an object or segment that was
+                 * previously declared External
+                 */
+                Node->Flags &= ~ANOBJ_IS_EXTERNAL;
+                Node->Type = (UINT8) ObjectType;
+
+                /* Just retyped a node, probably will need to open a scope */
+
+                if (AcpiNsOpensScope (ObjectType))
+                {
+                    Status = AcpiDsScopeStackPush (Node, ObjectType, WalkState);
+                    if (ACPI_FAILURE (Status))
+                    {
+                        return_ACPI_STATUS (Status);
+                    }
+                }
+
+                Status = AE_OK;
+            }
+            else if (!(Node->Flags & ANOBJ_IS_EXTERNAL) &&
+                     (Op->Asl.ParseOpcode == PARSEOP_EXTERNAL))
+            {
+                /*
+                 * Allow externals in same scope as the definition of the
+                 * actual object. Similar to C. Allows multiple definition
+                 * blocks that refer to each other in the same file.
+                 */
+                Status = AE_OK;
+            }
+            else if ((Node->Flags & ANOBJ_IS_EXTERNAL) &&
+                     (Op->Asl.ParseOpcode == PARSEOP_EXTERNAL) &&
+                     (ObjectType == ACPI_TYPE_ANY))
+            {
+                /* Allow update of externals of unknown type. */
+
+                if (AcpiNsOpensScope (ActualObjectType))
+                {
+                    Node->Type = (UINT8) ActualObjectType;
+                    Status = AE_OK;
+                }
+                else
+                {
+                    sprintf (MsgBuffer, "%s [%s]", Op->Asl.ExternalName,
+                        AcpiUtGetTypeName (Node->Type));
+                    AslError (ASL_ERROR, ASL_MSG_SCOPE_TYPE, Op, MsgBuffer);
+                    return_ACPI_STATUS (AE_OK);
+                }
+            }
+            else
+            {
+                /* Valid error, object already exists */
+
+                AslError (ASL_ERROR, ASL_MSG_NAME_EXISTS, Op,
+                    Op->Asl.ExternalName);
+                return_ACPI_STATUS (AE_OK);
+            }
+        }
+        else
+        {
+            AslCoreSubsystemError (Op, Status,
+                "Failure from namespace lookup", FALSE);
+            return_ACPI_STATUS (Status);
+        }
+    }
+
+    if (ForceNewScope)
+    {
+        Status = AcpiDsScopeStackPush (Node, ObjectType, WalkState);
+        if (ACPI_FAILURE (Status))
+        {
+            return_ACPI_STATUS (Status);
+        }
+    }
+
+FinishNode:
+    /*
+     * Point the parse node to the new namespace node, and point
+     * the Node back to the original Parse node
+     */
+    Op->Asl.Node = Node;
+    Node->Op = Op;
+
+    /* Set the actual data type if appropriate (EXTERNAL term only) */
+
+    if (ActualObjectType != ACPI_TYPE_ANY)
+    {
+        Node->Type = (UINT8) ActualObjectType;
+        Node->Value = ASL_EXTERNAL_METHOD;
+    }
+
+    if (Op->Asl.ParseOpcode == PARSEOP_METHOD)
+    {
+        /*
+         * Get the method argument count from "Extra" and save
+         * it in the namespace node
+         */
+        Node->Value = (UINT32) Op->Asl.Extra;
+    }
+
+    return_ACPI_STATUS (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LdNamespace2Begin
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending callback used during the pass 2 parse tree walk.
+ *              Second pass resolves some forward references.
+ *
+ * Notes:
+ * Currently only needs to handle the Alias operator.
+ * Could be used to allow forward references from the Scope() operator, but
+ * the MS interpreter does not allow this, so this compiler does not either.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+LdNamespace2Begin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = (ACPI_WALK_STATE *) Context;
+    ACPI_STATUS             Status;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_OBJECT_TYPE        ObjectType;
+    BOOLEAN                 ForceNewScope = FALSE;
+    ACPI_PARSE_OBJECT       *Arg;
+    char                    *Path;
+    ACPI_NAMESPACE_NODE     *TargetNode;
+
+
+    ACPI_FUNCTION_NAME (LdNamespace2Begin);
+    ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH, "Op %p [%s]\n",
+        Op, Op->Asl.ParseOpName));
+
+
+    /* Ignore Ops with no namespace node */
+
+    Node = Op->Asl.Node;
+    if (!Node)
+    {
+        return (AE_OK);
+    }
+
+    /* Get the type to determine if we should push the scope */
+
+    if ((Op->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG) &&
+        (Op->Asl.CompileFlags == NODE_IS_RESOURCE_DESC))
+    {
+        ObjectType = ACPI_TYPE_LOCAL_RESOURCE;
+    }
+    else
+    {
+        ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+    }
+
+    /* Push scope for Resource Templates */
+
+    if (Op->Asl.ParseOpcode == PARSEOP_NAME)
+    {
+        if (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DESC)
+        {
+            ForceNewScope = TRUE;
+        }
+    }
+
+    /* Push the scope stack */
+
+    if (ForceNewScope || AcpiNsOpensScope (ObjectType))
+    {
+        Status = AcpiDsScopeStackPush (Node, ObjectType, WalkState);
+        if (ACPI_FAILURE (Status))
+        {
+            return_ACPI_STATUS (Status);
+        }
+    }
+
+    if (Op->Asl.ParseOpcode == PARSEOP_ALIAS)
+    {
+        /* Complete the alias node by getting and saving the target node */
+
+        /* First child is the alias target */
+
+        Arg = Op->Asl.Child;
+
+        /* Get the target pathname */
+
+        Path = Arg->Asl.Namepath;
+        if (!Path)
+        {
+            Status = UtInternalizeName (Arg->Asl.ExternalName, &Path);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+        }
+
+        /* Get the NS node associated with the target. It must exist. */
+
+        Status = AcpiNsLookup (WalkState->ScopeInfo, Path, ACPI_TYPE_ANY,
+            ACPI_IMODE_EXECUTE, ACPI_NS_SEARCH_PARENT | ACPI_NS_DONT_OPEN_SCOPE,
+            WalkState, &TargetNode);
+        if (ACPI_FAILURE (Status))
+        {
+            if (Status == AE_NOT_FOUND)
+            {
+                AslError (ASL_ERROR, ASL_MSG_NOT_FOUND, Op,
+                    Op->Asl.ExternalName);
+
+                /*
+                 * The name was not found, go ahead and create it.
+                 * This prevents more errors later.
+                 */
+                Status = AcpiNsLookup (WalkState->ScopeInfo, Path,
+                    ACPI_TYPE_ANY,
+                    ACPI_IMODE_LOAD_PASS1, ACPI_NS_NO_UPSEARCH,
+                    WalkState, &(Node));
+                return (AE_OK);
+            }
+
+            AslCoreSubsystemError (Op, Status,
+                "Failure from namespace lookup", FALSE);
+            return (AE_OK);
+        }
+
+        /* Save the target node within the alias node */
+
+        Node->Object = ACPI_CAST_PTR (ACPI_OPERAND_OBJECT, TargetNode);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LdCommonNamespaceEnd
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Ascending callback used during the loading of the namespace,
+ *              We only need to worry about managing the scope stack here.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+LdCommonNamespaceEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = (ACPI_WALK_STATE *) Context;
+    ACPI_OBJECT_TYPE        ObjectType;
+    BOOLEAN                 ForceNewScope = FALSE;
+
+
+    ACPI_FUNCTION_NAME (LdCommonNamespaceEnd);
+
+
+    /* We are only interested in opcodes that have an associated name */
+
+    if (!Op->Asl.Namepath)
+    {
+        return (AE_OK);
+    }
+
+    /* Get the type to determine if we should pop the scope */
+
+    if ((Op->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG) &&
+        (Op->Asl.CompileFlags == NODE_IS_RESOURCE_DESC))
+    {
+        /* TBD: Merge into AcpiDsMapNamedOpcodeToDataType */
+
+        ObjectType = ACPI_TYPE_LOCAL_RESOURCE;
+    }
+    else
+    {
+        ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+    }
+
+    /* Pop scope that was pushed for Resource Templates */
+
+    if (Op->Asl.ParseOpcode == PARSEOP_NAME)
+    {
+        if (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DESC)
+        {
+            ForceNewScope = TRUE;
+        }
+    }
+
+    /* Pop the scope stack */
+
+    if (ForceNewScope || AcpiNsOpensScope (ObjectType))
+    {
+        ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH,
+            "(%s): Popping scope for Op [%s] %p\n",
+            AcpiUtGetTypeName (ObjectType), Op->Asl.ParseOpName, Op));
+
+        (void) AcpiDsScopeStackPop (WalkState);
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/asllookup.c b/usr/src/cmd/acpi/iasl/asllookup.c
new file mode 100644
index 0000000000..fed35fd787
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asllookup.c
@@ -0,0 +1,315 @@
+/******************************************************************************
+ *
+ * Module Name: asllookup- Namespace lookup functions
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acparser.h"
+#include "amlcode.h"
+#include "acnamesp.h"
+#include "acdispat.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asllookup")
+
+/* Local prototypes */
+
+static ACPI_STATUS
+LkIsObjectUsed (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue);
+
+static ACPI_PARSE_OBJECT *
+LkGetNameOp (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LkFindUnreferencedObjects
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Namespace walk to find objects that are not referenced in any
+ *              way. Must be called after the namespace has been cross
+ *              referenced.
+ *
+ ******************************************************************************/
+
+void
+LkFindUnreferencedObjects (
+    void)
+{
+
+    /* Walk entire namespace from the supplied root */
+
+    (void) AcpiNsWalkNamespace (ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
+                ACPI_UINT32_MAX, FALSE, LkIsObjectUsed, NULL,
+                NULL, NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LkIsObjectUsed
+ *
+ * PARAMETERS:  ACPI_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Check for an unreferenced namespace object and emit a warning.
+ *              We have to be careful, because some types and names are
+ *              typically or always unreferenced, we don't want to issue
+ *              excessive warnings. Note: Names that are declared within a
+ *              control method are temporary, so we always issue a remark
+ *              if they are not referenced.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+LkIsObjectUsed (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue)
+{
+    ACPI_NAMESPACE_NODE     *Node = ACPI_CAST_PTR (ACPI_NAMESPACE_NODE, ObjHandle);
+    ACPI_NAMESPACE_NODE     *Next;
+    ASL_METHOD_LOCAL        *MethodLocals;
+    ASL_METHOD_LOCAL        *MethodArgs;
+    UINT32                  i;
+
+
+    if (Node->Type == ACPI_TYPE_METHOD)
+    {
+        if (!Node->Op || !Node->MethodLocals)
+        {
+            return (AE_OK);
+        }
+
+        MethodLocals = (ASL_METHOD_LOCAL *) Node->MethodLocals;
+        MethodArgs = (ASL_METHOD_LOCAL *) Node->MethodArgs;
+
+        /*
+         * Analysis of LocalX variables
+         */
+        for (i = 0; i < ACPI_METHOD_NUM_LOCALS; i++)
+        {
+            /* Warn for Locals that are set but never referenced */
+
+            if ((MethodLocals[i].Flags & ASL_LOCAL_INITIALIZED) &&
+                (!(MethodLocals[i].Flags & ASL_LOCAL_REFERENCED)))
+            {
+                sprintf (MsgBuffer, "Local%u", i);
+                AslError (ASL_WARNING, ASL_MSG_LOCAL_NOT_USED,
+                    MethodLocals[i].Op, MsgBuffer);
+            }
+        }
+
+        /*
+         * Analysis of ArgX variables (standard method arguments,
+         * and remaining unused ArgX can also be used as locals)
+         */
+        for (i = 0; i < ACPI_METHOD_NUM_ARGS; i++)
+        {
+            if (MethodArgs[i].Flags & ASL_ARG_IS_LOCAL)
+            {
+                /* Warn if ArgX is being used as a local, but not referenced */
+
+                if ((MethodArgs[i].Flags & ASL_ARG_INITIALIZED) &&
+                    (!(MethodArgs[i].Flags & ASL_ARG_REFERENCED)))
+                {
+                    sprintf (MsgBuffer, "Arg%u", i);
+                    AslError (ASL_WARNING, ASL_MSG_ARG_AS_LOCAL_NOT_USED,
+                        MethodArgs[i].Op, MsgBuffer);
+                }
+            }
+            else
+            {
+                /*
+                 * Remark if a normal method ArgX is not referenced.
+                 * We ignore the predefined methods since often, not
+                 * all arguments are needed or used.
+                 */
+                if ((Node->Name.Ascii[0] != '_') &&
+                    (!(MethodArgs[i].Flags & ASL_ARG_REFERENCED)))
+                {
+                    sprintf (MsgBuffer, "Arg%u", i);
+                    AslError (ASL_REMARK, ASL_MSG_ARG_NOT_USED,
+                        MethodArgs[i].Op, MsgBuffer);
+                }
+            }
+        }
+    }
+
+    /* Referenced flag is set during the namespace xref */
+
+    if (Node->Flags & ANOBJ_IS_REFERENCED)
+    {
+        return (AE_OK);
+    }
+
+    if (!Node->Op)
+    {
+        return (AE_OK);
+    }
+
+    /* These types are typically never directly referenced, ignore them */
+
+    switch (Node->Type)
+    {
+    case ACPI_TYPE_DEVICE:
+    case ACPI_TYPE_PROCESSOR:
+    case ACPI_TYPE_POWER:
+    case ACPI_TYPE_THERMAL:
+    case ACPI_TYPE_LOCAL_RESOURCE:
+    case ACPI_TYPE_LOCAL_RESOURCE_FIELD: /* Names assigned to descriptor elements */
+
+        return (AE_OK);
+
+    default:
+
+        break;
+    }
+
+    /* Determine if the name is within a control method */
+
+    Next = Node->Parent;
+    while (Next)
+    {
+        if (Next->Type == ACPI_TYPE_METHOD)
+        {
+            /*
+             * Name is within a method, therefore it is temporary.
+             * Issue a remark even if it is a reserved name (starts
+             * with an underscore).
+             */
+            sprintf (MsgBuffer, "Name [%4.4s] is within a method [%4.4s]",
+                Node->Name.Ascii, Next->Name.Ascii);
+            AslError (ASL_REMARK, ASL_MSG_NOT_REFERENCED,
+                LkGetNameOp (Node->Op), MsgBuffer);
+            return (AE_OK);
+        }
+
+        Next = Next->Parent;
+    }
+
+    /* The name is not within a control method */
+
+    /*
+     * Ignore names that start with an underscore. These are the reserved
+     * ACPI names and are typically not referenced since they are meant
+     * to be called by the host OS.
+     */
+    if (Node->Name.Ascii[0] == '_')
+    {
+        return (AE_OK);
+    }
+
+    /*
+     * What remains is an unresolved user name that is not within a method.
+     * However, the object could be referenced via another table, so issue
+     * the warning at level 2.
+     */
+    AslError (ASL_WARNING2, ASL_MSG_NOT_REFERENCED,
+        LkGetNameOp (Node->Op), NULL);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LkGetNameOp
+ *
+ * PARAMETERS:  Op              - Current Op
+ *
+ * RETURN:      NameOp associated with the input op
+ *
+ * DESCRIPTION: Find the name declaration op associated with the operator
+ *
+ ******************************************************************************/
+
+static ACPI_PARSE_OBJECT *
+LkGetNameOp (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    const ACPI_OPCODE_INFO  *OpInfo;
+    ACPI_PARSE_OBJECT       *NameOp = Op;
+
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+
+
+    /* Get the NamePath from the appropriate place */
+
+    if (OpInfo->Flags & AML_NAMED)
+    {
+        /* For nearly all NAMED operators, the name reference is the first child */
+
+        NameOp = Op->Asl.Child;
+        if (Op->Asl.AmlOpcode == AML_ALIAS_OP)
+        {
+            /*
+             * ALIAS is the only oddball opcode, the name declaration
+             * (alias name) is the second operand
+             */
+            NameOp = Op->Asl.Child->Asl.Next;
+        }
+    }
+    else if (OpInfo->Flags & AML_CREATE)
+    {
+        /* Name must appear as the last parameter */
+
+        NameOp = Op->Asl.Child;
+        while (!(NameOp->Asl.CompileFlags & NODE_IS_NAME_DECLARATION))
+        {
+            NameOp = NameOp->Asl.Next;
+        }
+    }
+
+    return (NameOp);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslmain.c b/usr/src/cmd/acpi/iasl/aslmain.c
new file mode 100644
index 0000000000..064e790a59
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmain.c
@@ -0,0 +1,403 @@
+/******************************************************************************
+ *
+ * Module Name: aslmain - compiler main and utilities
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#define _DECLARE_GLOBALS
+
+#include "aslcompiler.h"
+#include "acapps.h"
+#include "acdisasm.h"
+#include <signal.h>
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslmain")
+
+/*
+ * Main routine for the iASL compiler.
+ *
+ * Portability note: The compiler depends upon the host for command-line
+ * wildcard support - it is not implemented locally. For example:
+ *
+ * Linux/Unix systems: Shell expands wildcards automatically.
+ *
+ * Windows: The setargv.obj module must be linked in to automatically
+ * expand wildcards.
+ */
+
+/* Local prototypes */
+
+static void ACPI_SYSTEM_XFACE
+AslSignalHandler (
+    int                     Sig);
+
+static void
+AslInitialize (
+    void);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    Usage
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Display option help message.
+ *              Optional items in square brackets.
+ *
+ ******************************************************************************/
+
+void
+Usage (
+    void)
+{
+    printf ("%s\n\n", ASL_COMPLIANCE);
+    ACPI_USAGE_HEADER ("iasl [Options] [Files]");
+
+    printf ("\nGeneral:\n");
+    ACPI_OPTION ("-@ <file>",       "Specify command file");
+    ACPI_OPTION ("-I <dir>",        "Specify additional include directory");
+    ACPI_OPTION ("-T <sig list>|ALL",   "Create ACPI table template/example files");
+    ACPI_OPTION ("-T <count>",      "Emit DSDT and <count> SSDTs to same file");
+    ACPI_OPTION ("-p <prefix>",     "Specify path/filename prefix for all output files");
+    ACPI_OPTION ("-v",              "Display compiler version");
+    ACPI_OPTION ("-vo",             "Enable optimization comments");
+    ACPI_OPTION ("-vs",             "Disable signon");
+
+    printf ("\nHelp:\n");
+    ACPI_OPTION ("-h",              "This message");
+    ACPI_OPTION ("-hc",             "Display operators allowed in constant expressions");
+    ACPI_OPTION ("-hf",             "Display help for output filename generation");
+    ACPI_OPTION ("-hr",             "Display ACPI reserved method names");
+    ACPI_OPTION ("-ht",             "Display currently supported ACPI table names");
+
+    printf ("\nPreprocessor:\n");
+    ACPI_OPTION ("-D <symbol>",     "Define symbol for preprocessor use");
+    ACPI_OPTION ("-li",             "Create preprocessed output file (*.i)");
+    ACPI_OPTION ("-P",              "Preprocess only and create preprocessor output file (*.i)");
+    ACPI_OPTION ("-Pn",             "Disable preprocessor");
+
+    printf ("\nErrors, Warnings, and Remarks:\n");
+    ACPI_OPTION ("-va",             "Disable all errors/warnings/remarks");
+    ACPI_OPTION ("-ve",             "Report only errors (ignore warnings and remarks)");
+    ACPI_OPTION ("-vi",             "Less verbose errors and warnings for use with IDEs");
+    ACPI_OPTION ("-vr",             "Disable remarks");
+    ACPI_OPTION ("-vw <messageid>", "Disable specific warning or remark");
+    ACPI_OPTION ("-w1 -w2 -w3",     "Set warning reporting level");
+    ACPI_OPTION ("-we",             "Report warnings as errors");
+
+    printf ("\nAML Code Generation (*.aml):\n");
+    ACPI_OPTION ("-oa",             "Disable all optimizations (compatibility mode)");
+    ACPI_OPTION ("-of",             "Disable constant folding");
+    ACPI_OPTION ("-oi",             "Disable integer optimization to Zero/One/Ones");
+    ACPI_OPTION ("-on",             "Disable named reference string optimization");
+    ACPI_OPTION ("-ot",             "Disable typechecking");
+    ACPI_OPTION ("-cr",             "Disable Resource Descriptor error checking");
+    ACPI_OPTION ("-in",             "Ignore NoOp operators");
+    ACPI_OPTION ("-r <revision>",   "Override table header Revision (1-255)");
+
+    printf ("\nOptional Source Code Output Files:\n");
+    ACPI_OPTION ("-sc -sa",         "Create source file in C or assembler (*.c or *.asm)");
+    ACPI_OPTION ("-ic -ia",         "Create include file in C or assembler (*.h or *.inc)");
+    ACPI_OPTION ("-tc -ta -ts",     "Create hex AML table in C, assembler, or ASL (*.hex)");
+    ACPI_OPTION ("-so",             "Create offset table in C (*.offset.h)");
+
+    printf ("\nOptional Listing Files:\n");
+    ACPI_OPTION ("-l",              "Create mixed listing file (ASL source and AML) (*.lst)");
+    ACPI_OPTION ("-lm",             "Create hardware summary map file (*.map)");
+    ACPI_OPTION ("-ln",             "Create namespace file (*.nsp)");
+    ACPI_OPTION ("-ls",             "Create combined source file (expanded includes) (*.src)");
+    ACPI_OPTION ("-lx",             "Create cross-reference file (*.xrf)");
+
+    printf ("\nData Table Compiler:\n");
+    ACPI_OPTION ("-G",              "Compile custom table that contains generic operators");
+    ACPI_OPTION ("-vt",             "Create verbose template files (full disassembly)");
+
+    printf ("\nAML Disassembler:\n");
+    ACPI_OPTION ("-d  <f1 f2 ...>", "Disassemble or decode binary ACPI tables to file (*.dsl)");
+    ACPI_OPTION ("",                "  (Optional, file type is automatically detected)");
+    ACPI_OPTION ("-da <f1 f2 ...>", "Disassemble multiple tables from single namespace");
+    ACPI_OPTION ("-db",             "Do not translate Buffers to Resource Templates");
+    ACPI_OPTION ("-dc <f1 f2 ...>", "Disassemble AML and immediately compile it");
+    ACPI_OPTION ("",                "  (Obtain DSDT from current system if no input file)");
+    ACPI_OPTION ("-df",             "Force disassembler to assume table contains valid AML");
+    ACPI_OPTION ("-dl",             "Emit legacy ASL code only (no C-style operators)");
+    ACPI_OPTION ("-e  <f1 f2 ...>", "Include ACPI table(s) for external symbol resolution");
+    ACPI_OPTION ("-fe <file>",      "Specify external symbol declaration file");
+    ACPI_OPTION ("-in",             "Ignore NoOp opcodes");
+    ACPI_OPTION ("-l",              "Disassemble to mixed ASL and AML code");
+    ACPI_OPTION ("-vt",             "Dump binary table data in hex format within output file");
+
+    printf ("\nDebug Options:\n");
+    ACPI_OPTION ("-bf",             "Create debug file (full output) (*.txt)");
+    ACPI_OPTION ("-bs",             "Create debug file (parse tree only) (*.txt)");
+    ACPI_OPTION ("-bp <depth>",     "Prune ASL parse tree");
+    ACPI_OPTION ("-bt <type>",      "Object type to be pruned from the parse tree");
+    ACPI_OPTION ("-f",              "Ignore errors, force creation of AML output file(s)");
+    ACPI_OPTION ("-m <size>",       "Set internal line buffer size (in Kbytes)");
+    ACPI_OPTION ("-n",              "Parse only, no output generation");
+    ACPI_OPTION ("-oc",             "Display compile times and statistics");
+    ACPI_OPTION ("-x <level>",      "Set debug level for trace output");
+    ACPI_OPTION ("-z",              "Do not insert new compiler ID for DataTables");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FilenameHelp
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Display help message for output filename generation
+ *
+ ******************************************************************************/
+
+void
+AslFilenameHelp (
+    void)
+{
+
+    printf ("\nAML output filename generation:\n");
+    printf ("  Output filenames are generated by appending an extension to a common\n");
+    printf ("  filename prefix. The filename prefix is obtained via one of the\n");
+    printf ("  following methods (in priority order):\n");
+    printf ("    1) The -p option specifies the prefix\n");
+    printf ("    2) The prefix of the AMLFileName in the ASL Definition Block\n");
+    printf ("    3) The prefix of the input filename\n");
+    printf ("\n");
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    AslSignalHandler
+ *
+ * PARAMETERS:  Sig                 - Signal that invoked this handler
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Control-C handler. Delete any intermediate files and any
+ *              output files that may be left in an indeterminate state.
+ *
+ *****************************************************************************/
+
+static void ACPI_SYSTEM_XFACE
+AslSignalHandler (
+    int                     Sig)
+{
+    UINT32                  i;
+
+
+    signal (Sig, SIG_IGN);
+    printf ("Aborting\n\n");
+
+    /* Close all open files */
+
+    Gbl_Files[ASL_FILE_PREPROCESSOR].Handle = NULL; /* the .pre file is same as source file */
+
+    for (i = ASL_FILE_INPUT; i < ASL_MAX_FILE_TYPE; i++)
+    {
+        FlCloseFile (i);
+    }
+
+    /* Delete any output files */
+
+    for (i = ASL_FILE_AML_OUTPUT; i < ASL_MAX_FILE_TYPE; i++)
+    {
+        FlDeleteFile (i);
+    }
+
+    exit (0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslInitialize
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Initialize compiler globals
+ *
+ ******************************************************************************/
+
+static void
+AslInitialize (
+    void)
+{
+    UINT32                  i;
+
+
+    AcpiGbl_DmOpt_Verbose = FALSE;
+
+    /* Default integer width is 64 bits */
+
+    AcpiGbl_IntegerBitWidth = 64;
+    AcpiGbl_IntegerNybbleWidth = 16;
+    AcpiGbl_IntegerByteWidth = 8;
+
+    for (i = 0; i < ASL_NUM_FILES; i++)
+    {
+        Gbl_Files[i].Handle = NULL;
+        Gbl_Files[i].Filename = NULL;
+    }
+
+    Gbl_Files[ASL_FILE_STDOUT].Handle   = stdout;
+    Gbl_Files[ASL_FILE_STDOUT].Filename = "STDOUT";
+
+    Gbl_Files[ASL_FILE_STDERR].Handle   = stderr;
+    Gbl_Files[ASL_FILE_STDERR].Filename = "STDERR";
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    main
+ *
+ * PARAMETERS:  Standard argc/argv
+ *
+ * RETURN:      Program termination code
+ *
+ * DESCRIPTION: C main routine for the Asl Compiler. Handle command line
+ *              options and begin the compile for each file on the command line
+ *
+ ******************************************************************************/
+
+int ACPI_SYSTEM_XFACE
+main (
+    int                     argc,
+    char                    **argv)
+{
+    ACPI_STATUS             Status;
+    int                     Index1;
+    int                     Index2;
+    int                     ReturnStatus = 0;
+
+
+    /*
+     * Big-endian machines are not currently supported. ACPI tables must
+     * be little-endian, and support for big-endian machines needs to
+     * be implemented.
+     */
+    if (UtIsBigEndianMachine ())
+    {
+        fprintf (stderr,
+            "iASL is not currently supported on big-endian machines.\n");
+        return (-1);
+    }
+
+    AcpiOsInitialize ();
+    ACPI_DEBUG_INITIALIZE (); /* For debug version only */
+
+    /* Initialize preprocessor and compiler before command line processing */
+
+    signal (SIGINT, AslSignalHandler);
+    AcpiGbl_ExternalFileList = NULL;
+    AcpiDbgLevel = 0;
+    PrInitializePreprocessor ();
+    AslInitialize ();
+
+    Index1 = Index2 = AslCommandLine (argc, argv);
+
+    /* Allocate the line buffer(s), must be after command line */
+
+    Gbl_LineBufferSize /= 2;
+    UtExpandLineBuffers ();
+
+    /* Perform global actions first/only */
+
+    if (Gbl_DisassembleAll)
+    {
+        while (argv[Index1])
+        {
+            Status = AcpiDmAddToExternalFileList (argv[Index1]);
+            if (ACPI_FAILURE (Status))
+            {
+                return (-1);
+            }
+
+            Index1++;
+        }
+    }
+
+    /* Process each pathname/filename in the list, with possible wildcards */
+
+    while (argv[Index2])
+    {
+        /*
+         * If -p not specified, we will use the input filename as the
+         * output filename prefix
+         */
+        if (Gbl_UseDefaultAmlFilename)
+        {
+            Gbl_OutputFilenamePrefix = argv[Index2];
+            UtConvertBackslashes (Gbl_OutputFilenamePrefix);
+        }
+
+        Status = AslDoOneFile (argv[Index2]);
+        if (ACPI_FAILURE (Status))
+        {
+            ReturnStatus = -1;
+            goto CleanupAndExit;
+        }
+
+        Index2++;
+    }
+
+
+CleanupAndExit:
+
+    UtFreeLineBuffers ();
+    AslParserCleanup ();
+
+    if (AcpiGbl_ExternalFileList)
+    {
+        AcpiDmClearExternalFileList();
+    }
+
+    return (ReturnStatus);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslmap.c b/usr/src/cmd/acpi/iasl/aslmap.c
new file mode 100644
index 0000000000..78756216a6
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmap.c
@@ -0,0 +1,488 @@
+/******************************************************************************
+ *
+ * Module Name: aslmap - parser to AML opcode mapping table
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "amlcode.h"
+#include "acparser.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslmap")
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslMapNamedOpcodeToDataType
+ *
+ * PARAMETERS:  Opcode              - The Named AML opcode to map
+ *
+ * RETURN:      The ACPI type associated with the named opcode
+ *
+ * DESCRIPTION: Convert a raw Named AML opcode to the associated data type.
+ *              Named opcodes are a subset of the AML opcodes.
+ *
+ ******************************************************************************/
+
+ACPI_OBJECT_TYPE
+AslMapNamedOpcodeToDataType (
+    UINT16                  Opcode)
+{
+    const ACPI_OPCODE_INFO  *OpInfo;
+
+
+    /*
+     * There are some differences from the opcode table types, we
+     * catch them here.
+     */
+    OpInfo = AcpiPsGetOpcodeInfo (Opcode);
+
+    if (Opcode == AML_INT_NAMEPATH_OP)
+    {
+        return (ACPI_TYPE_ANY);
+    }
+
+    if (Opcode == AML_INT_METHODCALL_OP)
+    {
+        return (ACPI_TYPE_ANY);
+    }
+
+    if (OpInfo->Flags & AML_NSOBJECT)
+    {
+        return (OpInfo->ObjectType);
+    }
+
+    return (ACPI_TYPE_ANY);
+}
+
+
+/*******************************************************************************
+ *
+ * DATA STRUCTURE:  AslKeywordMapping
+ *
+ * DESCRIPTION:     Maps the ParseOpcode to the actual AML opcode. The parse
+ *                  opcodes are generated from Bison, and this table must
+ *                  track any additions to them.
+ *
+ * Each entry in the table contains the following items:
+ *
+ * AML opcode   - Opcode that is written to the AML file
+ * Value        - Value of the object to be written (if applicable)
+ * Flags        - 1) Whether this opcode opens an AML "package".
+ *
+ ******************************************************************************/
+/*
+ * TBD:
+ * AccessAttrib
+ * AccessType
+ * AMlop for DMA?
+ * ObjectType keywords
+ * Register
+ */
+
+const ASL_MAPPING_ENTRY     AslKeywordMapping [] =
+{
+/*! [Begin] no source code translation (keep the table structure) */
+
+                                            /*  AML Opcode                  Value                           Flags               Btype */
+
+/* ACCESSAS */                  OP_TABLE_ENTRY (AML_INT_ACCESSFIELD_OP,     0,                              0,                  0),
+/* ACCESSATTRIB_BLOCK */        OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_BLOCK,         0,                  0),
+/* ACCESSATTRIB_BLOCK_CALL */   OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_BLOCK_CALL,    0,                  0),
+/* ACCESSATTRIB_BYTE */         OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_BYTE,          0,                  0),
+/* ACCESSATTRIB_MULTIBYTE */    OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_MULTIBYTE,     0,                  0),
+/* ACCESSATTRIB_QUICK */        OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_QUICK,         0,                  0),
+/* ACCESSATTRIB_RAW_BYTES */    OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_RAW_BYTES,     0,                  0),
+/* ACCESSATTRIB_RAW_PROCESS */  OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_RAW_PROCESS,   0,                  0),
+/* ACCESSATTRIB_SND_RCV */      OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_SEND_RCV,      0,                  0),
+/* ACCESSATTRIB_WORD */         OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_WORD,          0,                  0),
+/* ACCESSATTRIB_WORD_CALL */    OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ATTRIB_WORD_CALL,     0,                  0),
+/* ACCESSTYPE_ANY */            OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ACCESS_ANY,           0,                  0),
+/* ACCESSTYPE_BUF */            OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ACCESS_BUFFER,        0,                  0),
+/* ACCESSTYPE_BYTE */           OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ACCESS_BYTE,          0,                  0),
+/* ACCESSTYPE_DWORD */          OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ACCESS_DWORD,         0,                  0),
+/* ACCESSTYPE_QWORD */          OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ACCESS_QWORD,         0,                  0),
+/* ACCESSTYPE_WORD */           OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_ACCESS_WORD,          0,                  0),
+/* ACQUIRE */                   OP_TABLE_ENTRY (AML_ACQUIRE_OP,             0,                              0,                  ACPI_BTYPE_INTEGER),
+/* ADD */                       OP_TABLE_ENTRY (AML_ADD_OP,                 0,                              0,                  ACPI_BTYPE_INTEGER),
+/* ADDRESSINGMODE_7BIT */       OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* ADDRESSINGMODE_10BIT */      OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* ADDRESSTYPE_ACPI */          OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* ADDRESSTYPE_MEMORY */        OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* ADDRESSTYPE_NVS */           OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* ADDRESSTYPE_RESERVED */      OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* ALIAS */                     OP_TABLE_ENTRY (AML_ALIAS_OP,               0,                              0,                  0),
+/* AND */                       OP_TABLE_ENTRY (AML_BIT_AND_OP,             0,                              0,                  ACPI_BTYPE_INTEGER),
+/* ARG0 */                      OP_TABLE_ENTRY (AML_ARG0,                   0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* ARG1 */                      OP_TABLE_ENTRY (AML_ARG1,                   0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* ARG2 */                      OP_TABLE_ENTRY (AML_ARG2,                   0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* ARG3 */                      OP_TABLE_ENTRY (AML_ARG3,                   0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* ARG4 */                      OP_TABLE_ENTRY (AML_ARG4,                   0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* ARG5 */                      OP_TABLE_ENTRY (AML_ARG5,                   0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* ARG6 */                      OP_TABLE_ENTRY (AML_ARG6,                   0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* BANKFIELD */                 OP_TABLE_ENTRY (AML_BANK_FIELD_OP,          0,                              NODE_AML_PACKAGE,   0),
+/* BITSPERBYTE_EIGHT */         OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* BITSPERBYTE_FIVE */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* BITSPERBYTE_NINE */          OP_TABLE_ENTRY (AML_BYTE_OP,                4,                              0,                  0),
+/* BITSPERBYTE_SEVEN */         OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* BITSPERBYTE_SIX */           OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* BREAK */                     OP_TABLE_ENTRY (AML_BREAK_OP,               0,                              0,                  0),
+/* BREAKPOINT */                OP_TABLE_ENTRY (AML_BREAK_POINT_OP,         0,                              0,                  0),
+/* BUFFER */                    OP_TABLE_ENTRY (AML_BUFFER_OP,              0,                              NODE_AML_PACKAGE,   ACPI_BTYPE_BUFFER),
+/* BUSMASTERTYPE_MASTER */      OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* BUSMASTERTYPE_NOTMASTER */   OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* BYTECONST */                 OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          0,                              0,                  ACPI_BTYPE_INTEGER),
+/* CASE */                      OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* CLOCKPHASE_FIRST */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* CLOCKPHASE_SECOND */         OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* CLOCKPOLARITY_HIGH */        OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* CLOCKPOLARITY_LOW */         OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* CONCATENATE */               OP_TABLE_ENTRY (AML_CONCAT_OP,              0,                              0,                  ACPI_BTYPE_COMPUTE_DATA),
+/* CONCATENATERESTEMPLATE */    OP_TABLE_ENTRY (AML_CONCAT_RES_OP,          0,                              0,                  ACPI_BTYPE_BUFFER),
+/* CONDREFOF */                 OP_TABLE_ENTRY (AML_COND_REF_OF_OP,         0,                              0,                  ACPI_BTYPE_INTEGER),
+/* CONNECTION */                OP_TABLE_ENTRY (AML_INT_CONNECTION_OP,      0,                              0,                  0),
+/* CONTINUE */                  OP_TABLE_ENTRY (AML_CONTINUE_OP,            0,                              0,                  0),
+/* COPY */                      OP_TABLE_ENTRY (AML_COPY_OP,                0,                              0,                  ACPI_BTYPE_DATA_REFERENCE),
+/* CREATEBITFIELD */            OP_TABLE_ENTRY (AML_CREATE_BIT_FIELD_OP,    0,                              0,                  0),
+/* CREATEBYTEFIELD */           OP_TABLE_ENTRY (AML_CREATE_BYTE_FIELD_OP,   0,                              0,                  0),
+/* CREATEDWORDFIELD */          OP_TABLE_ENTRY (AML_CREATE_DWORD_FIELD_OP,  0,                              0,                  0),
+/* CREATEFIELD */               OP_TABLE_ENTRY (AML_CREATE_FIELD_OP,        0,                              0,                  0),
+/* CREATEQWORDFIELD */          OP_TABLE_ENTRY (AML_CREATE_QWORD_FIELD_OP,  0,                              0,                  0),
+/* CREATEWORDFIELD */           OP_TABLE_ENTRY (AML_CREATE_WORD_FIELD_OP,   0,                              0,                  0),
+/* DATABUFFER */                OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* DATATABLEREGION */           OP_TABLE_ENTRY (AML_DATA_REGION_OP,         0,                              0,                  0),
+/* DEBUG */                     OP_TABLE_ENTRY (AML_DEBUG_OP,               0,                              0,                  ACPI_BTYPE_DEBUG_OBJECT),
+/* DECODETYPE_POS */            OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* DECODETYPE_SUB */            OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* DECREMENT */                 OP_TABLE_ENTRY (AML_DECREMENT_OP,           0,                              0,                  ACPI_BTYPE_INTEGER),
+/* DEFAULT */                   OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* DEFAULT_ARG */               OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* DEFINITIONBLOCK */           OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* DEREFOF */                   OP_TABLE_ENTRY (AML_DEREF_OF_OP,            0,                              0,                  ACPI_BTYPE_DATA_REFERENCE | ACPI_BTYPE_STRING),
+/* DEVICE */                    OP_TABLE_ENTRY (AML_DEVICE_OP,              0,                              NODE_AML_PACKAGE,   0),
+/* DEVICEPOLARITY_HIGH */       OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* DEVICEPOLARITY_LOW */        OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* DIVIDE */                    OP_TABLE_ENTRY (AML_DIVIDE_OP,              0,                              0,                  ACPI_BTYPE_INTEGER),
+/* DMA */                       OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* DMATYPE_A */                 OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* DMATYPE_COMPATIBILITY */     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* DMATYPE_B */                 OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* DMATYPE_F */                 OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* DWORDCONST */                OP_TABLE_ENTRY (AML_RAW_DATA_DWORD,         0,                              0,                  ACPI_BTYPE_INTEGER),
+/* DWORDIO */                   OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* DWORDMEMORY */               OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* DWORDSPACE */                OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* EISAID */                    OP_TABLE_ENTRY (AML_DWORD_OP,               0,                              0,                  ACPI_BTYPE_INTEGER),
+/* ELSE */                      OP_TABLE_ENTRY (AML_ELSE_OP,                0,                              NODE_AML_PACKAGE,   0),
+/* ELSEIF */                    OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              NODE_AML_PACKAGE,   0),
+/* ENDDEPENDENTFN */            OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* ENDIAN_BIG */                OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* ENDIAN_LITTLE */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* ENDTAG */                    OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* ERRORNODE */                 OP_TABLE_ENTRY (AML_NOOP_OP,                0,                              0,                  0),
+/* EVENT */                     OP_TABLE_ENTRY (AML_EVENT_OP,               0,                              0,                  0),
+/* EXTENDEDIO */                OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* EXTENDEDMEMORY */            OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* EXTENDEDSPACE */             OP_TABLE_ENTRY (AML_RAW_DATA_QWORD,         0,                              0,                  ACPI_BTYPE_INTEGER),
+/* EXTERNAL */                  OP_TABLE_ENTRY (AML_EXTERNAL_OP,            0,                              0,                  0),
+/* FATAL */                     OP_TABLE_ENTRY (AML_FATAL_OP,               0,                              0,                  0),
+/* FIELD */                     OP_TABLE_ENTRY (AML_FIELD_OP,               0,                              NODE_AML_PACKAGE,   0),
+/* FINDSETLEFTBIT */            OP_TABLE_ENTRY (AML_FIND_SET_LEFT_BIT_OP,   0,                              0,                  ACPI_BTYPE_INTEGER),
+/* FINDSETRIGHTBIT */           OP_TABLE_ENTRY (AML_FIND_SET_RIGHT_BIT_OP,  0,                              0,                  ACPI_BTYPE_INTEGER),
+/* FIXEDDMA */                  OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* FIXEDIO */                   OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* FLOWCONTROL_HW */            OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* FLOWCONTROL_NONE */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* FLOWCONTROL_SW */            OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* FROMBCD */                   OP_TABLE_ENTRY (AML_FROM_BCD_OP,            0,                              0,                  ACPI_BTYPE_INTEGER),
+/* FUNCTION */                  OP_TABLE_ENTRY (AML_METHOD_OP,              0,                              NODE_AML_PACKAGE,   0),
+/* GPIOINT */                   OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* GPIOIO */                    OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* I2CSERIALBUS */              OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* I2CSERIALBUSV2 */            OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* IF */                        OP_TABLE_ENTRY (AML_IF_OP,                  0,                              NODE_AML_PACKAGE,   0),
+/* INCLUDE */                   OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* INCLUDE_END */               OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* INCREMENT */                 OP_TABLE_ENTRY (AML_INCREMENT_OP,           0,                              0,                  ACPI_BTYPE_INTEGER),
+/* INDEX */                     OP_TABLE_ENTRY (AML_INDEX_OP,               0,                              0,                  ACPI_BTYPE_REFERENCE_OBJECT),
+/* INDEXFIELD */                OP_TABLE_ENTRY (AML_INDEX_FIELD_OP,         0,                              NODE_AML_PACKAGE,   0),
+/* INTEGER */                   OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  ACPI_BTYPE_INTEGER),
+/* INTERRUPT */                 OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* INTLEVEL_ACTIVEBOTH */       OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* INTLEVEL_ACTIVEHIGH */       OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* INTLEVEL_ACTIVELOW */        OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* INTTYPE_EDGE */              OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* INTTYPE_LEVEL */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* IO */                        OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* IODECODETYPE_10 */           OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* IODECODETYPE_16 */           OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* IORESTRICT_IN */             OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* IORESTRICT_NONE */           OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* IORESTRICT_OUT */            OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* IORESTRICT_PRESERVE */       OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* IRQ */                       OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* IRQNOFLAGS */                OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* LAND */                      OP_TABLE_ENTRY (AML_LAND_OP,                0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LEQUAL */                    OP_TABLE_ENTRY (AML_LEQUAL_OP,              0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LGREATER */                  OP_TABLE_ENTRY (AML_LGREATER_OP,            0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LGREATEREQUAL */             OP_TABLE_ENTRY (AML_LGREATEREQUAL_OP,       0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LLESS */                     OP_TABLE_ENTRY (AML_LLESS_OP,               0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LLESSEQUAL */                OP_TABLE_ENTRY (AML_LLESSEQUAL_OP,          0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LNOT */                      OP_TABLE_ENTRY (AML_LNOT_OP,                0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LNOTEQUAL */                 OP_TABLE_ENTRY (AML_LNOTEQUAL_OP,           0,                              0,                  ACPI_BTYPE_INTEGER),
+/* LOAD */                      OP_TABLE_ENTRY (AML_LOAD_OP,                0,                              0,                  0),
+/* LOADTABLE */                 OP_TABLE_ENTRY (AML_LOAD_TABLE_OP,          0,                              0,                  ACPI_BTYPE_DDB_HANDLE),
+/* LOCAL0 */                    OP_TABLE_ENTRY (AML_LOCAL0,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCAL1 */                    OP_TABLE_ENTRY (AML_LOCAL1,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCAL2 */                    OP_TABLE_ENTRY (AML_LOCAL2,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCAL3 */                    OP_TABLE_ENTRY (AML_LOCAL3,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCAL4 */                    OP_TABLE_ENTRY (AML_LOCAL4,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCAL5 */                    OP_TABLE_ENTRY (AML_LOCAL5,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCAL6 */                    OP_TABLE_ENTRY (AML_LOCAL6,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCAL7 */                    OP_TABLE_ENTRY (AML_LOCAL7,                 0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* LOCKRULE_LOCK */             OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_LOCK_ALWAYS,          0,                  0),
+/* LOCKRULE_NOLOCK */           OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_LOCK_NEVER,           0,                  0),
+/* LOR */                       OP_TABLE_ENTRY (AML_LOR_OP,                 0,                              0,                  ACPI_BTYPE_INTEGER),
+/* MATCH */                     OP_TABLE_ENTRY (AML_MATCH_OP,               0,                              0,                  ACPI_BTYPE_INTEGER),
+/* MATCHTYPE_MEQ */             OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          MATCH_MEQ,                      0,                  ACPI_BTYPE_INTEGER),
+/* MATCHTYPE_MGE */             OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          MATCH_MGE,                      0,                  ACPI_BTYPE_INTEGER),
+/* MATCHTYPE_MGT */             OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          MATCH_MGT,                      0,                  ACPI_BTYPE_INTEGER),
+/* MATCHTYPE_MLE */             OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          MATCH_MLE,                      0,                  ACPI_BTYPE_INTEGER),
+/* MATCHTYPE_MLT */             OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          MATCH_MLT,                      0,                  ACPI_BTYPE_INTEGER),
+/* MATCHTYPE_MTR */             OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          MATCH_MTR,                      0,                  ACPI_BTYPE_INTEGER),
+/* MAXTYPE_FIXED */             OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* MAXTYPE_NOTFIXED */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* MEMORY24 */                  OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* MEMORY32 */                  OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* MEMORY32FIXED */             OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* MEMTYPE_CACHEABLE */         OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* MEMTYPE_NONCACHEABLE */      OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* MEMTYPE_PREFETCHABLE */      OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* MEMTYPE_WRITECOMBINING */    OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* METHOD */                    OP_TABLE_ENTRY (AML_METHOD_OP,              0,                              NODE_AML_PACKAGE,   0),
+/* METHODCALL */                OP_TABLE_ENTRY (AML_INT_METHODCALL_OP,      0,                              0,                  ACPI_BTYPE_OBJECTS_AND_REFS),
+/* MID */                       OP_TABLE_ENTRY (AML_MID_OP,                 0,                              0,                  ACPI_BTYPE_STRING | ACPI_BTYPE_BUFFER),
+/* MINTYPE_FIXED */             OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* MINTYPE_NOTFIXED */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* MOD */                       OP_TABLE_ENTRY (AML_MOD_OP,                 0,                              0,                  ACPI_BTYPE_INTEGER),
+/* MULTIPLY */                  OP_TABLE_ENTRY (AML_MULTIPLY_OP,            0,                              0,                  ACPI_BTYPE_INTEGER),
+/* MUTEX */                     OP_TABLE_ENTRY (AML_MUTEX_OP,               0,                              0,                  0),
+/* NAME */                      OP_TABLE_ENTRY (AML_NAME_OP,                0,                              0,                  0),
+/* NAMESEG */                   OP_TABLE_ENTRY (AML_INT_NAMEPATH_OP,        0,                              0,                  0),
+/* NAMESTRING */                OP_TABLE_ENTRY (AML_INT_NAMEPATH_OP,        0,                              0,                  0),
+/* NAND */                      OP_TABLE_ENTRY (AML_BIT_NAND_OP,            0,                              0,                  ACPI_BTYPE_INTEGER),
+/* NOOP */                      OP_TABLE_ENTRY (AML_NOOP_OP,                0,                              0,                  0),
+/* NOR */                       OP_TABLE_ENTRY (AML_BIT_NOR_OP,             0,                              0,                  ACPI_BTYPE_INTEGER),
+/* NOT */                       OP_TABLE_ENTRY (AML_BIT_NOT_OP,             0,                              0,                  ACPI_BTYPE_INTEGER),
+/* NOTIFY */                    OP_TABLE_ENTRY (AML_NOTIFY_OP,              0,                              0,                  0),
+/* OBJECTTYPE */                OP_TABLE_ENTRY (AML_OBJECT_TYPE_OP,         0,                              0,                  ACPI_BTYPE_INTEGER),
+/* OBJECTTYPE_BFF */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_BUFFER_FIELD,         0,                  0),
+/* OBJECTTYPE_BUF */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_BUFFER,               0,                  0),
+/* OBJECTTYPE_DDB */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_DDB_HANDLE,           0,                  0),
+/* OBJECTTYPE_DEV */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_DEVICE,               0,                  0),
+/* OBJECTTYPE_EVT */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_EVENT,                0,                  0),
+/* OBJECTTYPE_FLD */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_FIELD_UNIT,           0,                  0),
+/* OBJECTTYPE_INT */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_INTEGER,              0,                  0),
+/* OBJECTTYPE_MTH */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_METHOD,               0,                  0),
+/* OBJECTTYPE_MTX */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_MUTEX,                0,                  0),
+/* OBJECTTYPE_OPR */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_REGION,               0,                  0),
+/* OBJECTTYPE_PKG */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_PACKAGE,              0,                  0),
+/* OBJECTTYPE_POW */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_POWER,                0,                  0),
+/* OBJECTTYPE_PRO */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_PROCESSOR,            0,                  0),
+/* OBJECTTYPE_STR */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_STRING,               0,                  0),
+/* OBJECTTYPE_THZ */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_THERMAL,              0,                  0),
+/* OBJECTTYPE_UNK */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_TYPE_ANY,                  0,                  0),
+/* OFFSET */                    OP_TABLE_ENTRY (AML_INT_RESERVEDFIELD_OP,   0,                              0,                  0),
+/* ONE */                       OP_TABLE_ENTRY (AML_ONE_OP,                 0,                              0,                  ACPI_BTYPE_INTEGER),
+/* ONES */                      OP_TABLE_ENTRY (AML_ONES_OP,                0,                              0,                  ACPI_BTYPE_INTEGER),
+/* OPERATIONREGION */           OP_TABLE_ENTRY (AML_REGION_OP,              0,                              0,                  0),
+/* OR */                        OP_TABLE_ENTRY (AML_BIT_OR_OP,              0,                              0,                  ACPI_BTYPE_INTEGER),
+/* PACKAGE */                   OP_TABLE_ENTRY (AML_PACKAGE_OP,             0,                              NODE_AML_PACKAGE,   ACPI_BTYPE_PACKAGE),
+/* PACKAGEP_LENGTH */           OP_TABLE_ENTRY (AML_PACKAGE_LENGTH,         0,                              NODE_AML_PACKAGE,   0),
+/* PARITYTYPE_EVEN */           OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* PARITYTYPE_MARK */           OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* PARITYTYPE_NONE */           OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* PARITYTYPE_ODD */            OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* PARITYTYPE_SPACE */          OP_TABLE_ENTRY (AML_BYTE_OP,                4,                              0,                  0),
+/* PIN_NOPULL */                OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* PIN_PULLDEFAULT */           OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* PIN_PULLDOWN */              OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* PIN_PULLUP */                OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* POWERRESOURCE */             OP_TABLE_ENTRY (AML_POWER_RES_OP,           0,                              NODE_AML_PACKAGE,   0),
+/* PROCESSOR */                 OP_TABLE_ENTRY (AML_PROCESSOR_OP,           0,                              NODE_AML_PACKAGE,   0),
+/* QWORDCONST */                OP_TABLE_ENTRY (AML_RAW_DATA_QWORD,         0,                              0,                  ACPI_BTYPE_INTEGER),
+/* QWORDIO */                   OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* QWORDMEMORY */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* QWORDSPACE */                OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* RANGE_TYPE_ENTIRE */         OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* RANGE_TYPE_ISAONLY */        OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* RANGE_TYPE_NONISAONLY */     OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* RAW_DATA */                  OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* READWRITETYPE_BOTH */        OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* READWRITETYPE_READONLY */    OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* REFOF */                     OP_TABLE_ENTRY (AML_REF_OF_OP,              0,                              0,                  ACPI_BTYPE_REFERENCE_OBJECT),
+/* REGIONSPACE_CMOS */          OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_CMOS,            0,                  0),
+/* REGIONSPACE_EC */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_EC,              0,                  0),
+/* REGIONSPACE_FFIXEDHW */      OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_FIXED_HARDWARE,  0,                  0),
+/* REGIONSPACE_GPIO */          OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_GPIO,            0,                  0),
+/* REGIONSPACE_GSBUS */         OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_GSBUS,           0,                  0),
+/* REGIONSPACE_IO */            OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_SYSTEM_IO,       0,                  0),
+/* REGIONSPACE_IPMI */          OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_IPMI,            0,                  0),
+/* REGIONSPACE_MEM */           OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_SYSTEM_MEMORY,   0,                  0),
+/* REGIONSPACE_PCC */           OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_PLATFORM_COMM,   0,                  0),
+/* REGIONSPACE_PCI */           OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_PCI_CONFIG,      0,                  0),
+/* REGIONSPACE_PCIBAR */        OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_PCI_BAR_TARGET,  0,                  0),
+/* REGIONSPACE_SMBUS */         OP_TABLE_ENTRY (AML_RAW_DATA_BYTE,          ACPI_ADR_SPACE_SMBUS,           0,                  0),
+/* REGISTER */                  OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* RELEASE */                   OP_TABLE_ENTRY (AML_RELEASE_OP,             0,                              0,                  0),
+/* RESERVED_BYTES */            OP_TABLE_ENTRY (AML_INT_RESERVEDFIELD_OP,   0,                              0,                  0),
+/* RESET */                     OP_TABLE_ENTRY (AML_RESET_OP,               0,                              0,                  0),
+/* RESOURCETEMPLATE */          OP_TABLE_ENTRY (AML_BUFFER_OP,              0,                              0,                  ACPI_BTYPE_BUFFER),
+/* RESOURCETYPE_CONSUMER */     OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* RESOURCETYPE_PRODUCER */     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* RETURN */                    OP_TABLE_ENTRY (AML_RETURN_OP,              0,                              0,                  0),
+/* REVISION */                  OP_TABLE_ENTRY (AML_REVISION_OP,            0,                              0,                  ACPI_BTYPE_INTEGER),
+/* SCOPE */                     OP_TABLE_ENTRY (AML_SCOPE_OP,               0,                              NODE_AML_PACKAGE,   0),
+/* SERIALIZERULE_NOTSERIAL */   OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* SERIALIZERULE_SERIAL */      OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* SHARETYPE_EXCLUSIVE */       OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* SHARETYPE_EXCLUSIVEWAKE */   OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* SHARETYPE_SHARED */          OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* SHARETYPE_SHAREDWAKE */      OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* SHIFTLEFT */                 OP_TABLE_ENTRY (AML_SHIFT_LEFT_OP,          0,                              0,                  ACPI_BTYPE_INTEGER),
+/* SHIFTRIGHT */                OP_TABLE_ENTRY (AML_SHIFT_RIGHT_OP,         0,                              0,                  ACPI_BTYPE_INTEGER),
+/* SIGNAL */                    OP_TABLE_ENTRY (AML_SIGNAL_OP,              0,                              0,                  0),
+/* SIZEOF */                    OP_TABLE_ENTRY (AML_SIZE_OF_OP,             0,                              0,                  ACPI_BTYPE_INTEGER),
+/* SLAVEMODE_CONTROLLERINIT */  OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* SLAVEMODE_DEVICEINIT */      OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* SLEEP */                     OP_TABLE_ENTRY (AML_SLEEP_OP,               0,                              0,                  0),
+/* SPISERIALBUS */              OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* SPISERIALBUSV2 */            OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* STALL */                     OP_TABLE_ENTRY (AML_STALL_OP,               0,                              0,                  0),
+/* STARTDEPENDENTFN */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* STARTDEPENDENTFN_NOPRI */    OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* STOPBITS_ONE */              OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* STOPBITS_ONEPLUSHALF */      OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* STOPBITS_TWO */              OP_TABLE_ENTRY (AML_BYTE_OP,                3,                              0,                  0),
+/* STOPBITS_ZERO */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* STORE */                     OP_TABLE_ENTRY (AML_STORE_OP,               0,                              0,                  ACPI_BTYPE_DATA_REFERENCE),
+/* STRING_LITERAL */            OP_TABLE_ENTRY (AML_STRING_OP,              0,                              0,                  ACPI_BTYPE_STRING),
+/* SUBTRACT */                  OP_TABLE_ENTRY (AML_SUBTRACT_OP,            0,                              0,                  ACPI_BTYPE_INTEGER),
+/* SWITCH */                    OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* THERMALZONE */               OP_TABLE_ENTRY (AML_THERMAL_ZONE_OP,        0,                              NODE_AML_PACKAGE,   0),
+/* TIMER */                     OP_TABLE_ENTRY (AML_TIMER_OP,               0,                              0,                  ACPI_BTYPE_INTEGER),
+/* TOBCD */                     OP_TABLE_ENTRY (AML_TO_BCD_OP,              0,                              0,                  ACPI_BTYPE_INTEGER),
+/* TOBUFFER */                  OP_TABLE_ENTRY (AML_TO_BUFFER_OP,           0,                              0,                  ACPI_BTYPE_BUFFER),
+/* TODECIMALSTRING */           OP_TABLE_ENTRY (AML_TO_DECSTRING_OP,        0,                              0,                  ACPI_BTYPE_STRING),
+/* TOHEXSTRING */               OP_TABLE_ENTRY (AML_TO_HEXSTRING_OP,        0,                              0,                  ACPI_BTYPE_STRING),
+/* TOINTEGER */                 OP_TABLE_ENTRY (AML_TO_INTEGER_OP,          0,                              0,                  ACPI_BTYPE_INTEGER),
+/* TOSTRING */                  OP_TABLE_ENTRY (AML_TO_STRING_OP,           0,                              0,                  ACPI_BTYPE_STRING),
+/* TOUUID */                    OP_TABLE_ENTRY (AML_DWORD_OP,               0,                              NODE_AML_PACKAGE,   ACPI_BTYPE_INTEGER),
+/* TRANSLATIONTYPE_DENSE */     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* TRANSLATIONTYPE_SPARSE */    OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* TYPE_STATIC */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* TYPE_TRANSLATION */          OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* UART_SERIALBUS */            OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* UART_SERIALBUSV2 */          OP_TABLE_ENTRY (AML_DEFAULT_ARG_OP,         0,                              0,                  0),
+/* UNICODE */                   OP_TABLE_ENTRY (AML_BUFFER_OP,              0,                              NODE_AML_PACKAGE,   0),
+/* UNLOAD */                    OP_TABLE_ENTRY (AML_UNLOAD_OP,              0,                              0,                  0),
+/* UPDATERULE_ONES */           OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_UPDATE_WRITE_AS_ONES, 0,                  0),
+/* UPDATERULE_PRESERVE */       OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_UPDATE_PRESERVE,      0,                  0),
+/* UPDATERULE_ZEROS */          OP_TABLE_ENTRY (AML_BYTE_OP,                AML_FIELD_UPDATE_WRITE_AS_ZEROS,0,                  0),
+/* VAR_PACKAGE */               OP_TABLE_ENTRY (AML_VAR_PACKAGE_OP,         0,                              NODE_AML_PACKAGE,   ACPI_BTYPE_PACKAGE),
+/* VENDORLONG */                OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* VENDORSHORT */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* WAIT */                      OP_TABLE_ENTRY (AML_WAIT_OP,                0,                              0,                  ACPI_BTYPE_INTEGER),
+/* WHILE */                     OP_TABLE_ENTRY (AML_WHILE_OP,               0,                              NODE_AML_PACKAGE,   0),
+/* WIREMODE_FOUR */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* WIREMODE_THREE */            OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* WORDBUSNUMBER */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* WORDCONST */                 OP_TABLE_ENTRY (AML_RAW_DATA_WORD,          0,                              0,                  ACPI_BTYPE_INTEGER),
+/* WORDIO */                    OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* WORDSPACE */                 OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERSIZE_8 */                OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERSIZE_16 */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERSIZE_32 */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERSIZE_64 */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERSIZE_128 */              OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERSIZE_256 */              OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERTYPE_8 */                OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* XFERTYPE_8_16 */             OP_TABLE_ENTRY (AML_BYTE_OP,                1,                              0,                  0),
+/* XFERTYPE_16 */               OP_TABLE_ENTRY (AML_BYTE_OP,                2,                              0,                  0),
+/* XOR */                       OP_TABLE_ENTRY (AML_BIT_XOR_OP,             0,                              0,                  ACPI_BTYPE_INTEGER),
+/* ZERO */                      OP_TABLE_ENTRY (AML_ZERO_OP,                0,                              0,                  ACPI_BTYPE_INTEGER),
+/* TOPLD */                     OP_TABLE_ENTRY (AML_DWORD_OP,               0,                              NODE_AML_PACKAGE,   ACPI_BTYPE_INTEGER),
+/* XFERSIZE_128 */              OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* REVISION */                  OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* IGNORECOLOR */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* RED */                       OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* GREEN */                     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* BLUE */                      OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* WIDTH */                     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* HEIGHT */                    OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* USERVISIBLE */               OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* DOCK */                      OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* LID */                       OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* PANEL */                     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* VERTICALPOSITION */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* HORIZONTALPOSITION */        OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* SHAPE */                     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* GROUPORIENTATION */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* GROUPTOKEN */                OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* GROUPPOSITION */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* BAY */                       OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* EJECTABLE */                 OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* EJECTREQUIRED */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* CABINETNUMBER */             OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* CARDCAGENUMBER */            OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* REFERENCE */                 OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* ROTATION */                  OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* ORDER */                     OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* RESERVED */                  OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* VERTICALOFFSET */            OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* HORIZONTALOFFSET */          OP_TABLE_ENTRY (AML_BYTE_OP,                0,                              0,                  0),
+/* PRINTF */                    OP_TABLE_ENTRY (AML_STORE_OP,               0,                              0,                  ACPI_BTYPE_DATA_REFERENCE),
+/* FPRINTF */                   OP_TABLE_ENTRY (AML_STORE_OP,               0,                              0,                  ACPI_BTYPE_DATA_REFERENCE),
+/* ASLCODE  */                  OP_TABLE_ENTRY (0,                          0,                              0,                  0)
+/*! [End] no source code translation !*/
+
+};
diff --git a/usr/src/cmd/acpi/iasl/aslmapenter.c b/usr/src/cmd/acpi/iasl/aslmapenter.c
new file mode 100644
index 0000000000..e4ab4f25d9
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmapenter.c
@@ -0,0 +1,348 @@
+/******************************************************************************
+ *
+ * Module Name: aslmapenter - Build resource descriptor/device maps
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acapps.h"
+#include "aslcompiler.h"
+
+/* This module used for application-level code only */
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslmapenter")
+
+/* Local prototypes */
+
+static ACPI_GPIO_INFO *
+MpCreateGpioInfo (
+    UINT16                  PinNumber,
+    char                    *DeviceName);
+
+static ACPI_SERIAL_INFO *
+MpCreateSerialInfo (
+    char                    *DeviceName,
+    UINT16                  Address);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpSaveGpioInfo
+ *
+ * PARAMETERS:  Resource                - GPIO resource descriptor
+ *              PinCount                - From GPIO descriptor
+ *              PinList                 - From GPIO descriptor
+ *              DeviceName              - The "ResourceSource" name
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: External Interface.
+ *              Save GPIO resource descriptor information.
+ *              Creates new GPIO info blocks, one for each pin defined by the
+ *              GPIO descriptor.
+ *
+ ******************************************************************************/
+
+void
+MpSaveGpioInfo (
+    ACPI_PARSE_OBJECT       *Op,
+    AML_RESOURCE            *Resource,
+    UINT32                  PinCount,
+    UINT16                  *PinList,
+    char                    *DeviceName)
+{
+    ACPI_GPIO_INFO          *Info;
+    UINT32                  i;
+
+
+    /* Mapfile option enabled? */
+
+    if (!Gbl_MapfileFlag)
+    {
+        return;
+    }
+
+    /* Create an info block for each pin defined in the descriptor */
+
+    for (i = 0; i < PinCount; i++)
+    {
+        Info = MpCreateGpioInfo (PinList[i], DeviceName);
+
+        Info->Op = Op;
+        Info->DeviceName = DeviceName;
+        Info->PinCount = PinCount;
+        Info->PinIndex = i;
+        Info->PinNumber = PinList[i];
+        Info->Type = Resource->Gpio.ConnectionType;
+        Info->Direction = (UINT8) (Resource->Gpio.IntFlags & 0x0003);       /* _IOR, for IO descriptor */
+        Info->Polarity = (UINT8) ((Resource->Gpio.IntFlags >> 1) & 0x0003); /* _POL, for INT descriptor */
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpSaveSerialInfo
+ *
+ * PARAMETERS:  Resource                - A Serial resource descriptor
+ *              DeviceName              - The "ResourceSource" name.
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: External Interface.
+ *              Save serial resource descriptor information.
+ *              Creates a new serial info block.
+ *
+ ******************************************************************************/
+
+void
+MpSaveSerialInfo (
+    ACPI_PARSE_OBJECT       *Op,
+    AML_RESOURCE            *Resource,
+    char                    *DeviceName)
+{
+    ACPI_SERIAL_INFO        *Info;
+    UINT16                  Address;
+    UINT32                  Speed;
+
+
+    /* Mapfile option enabled? */
+
+    if (!Gbl_MapfileFlag)
+    {
+        return;
+    }
+
+    if (Resource->DescriptorType != ACPI_RESOURCE_NAME_SERIAL_BUS)
+    {
+        return;
+    }
+
+    /* Extract address and speed from the resource descriptor */
+
+    switch (Resource->CommonSerialBus.Type)
+    {
+    case AML_RESOURCE_I2C_SERIALBUSTYPE:
+
+        Address = Resource->I2cSerialBus.SlaveAddress;
+        Speed = Resource->I2cSerialBus.ConnectionSpeed;
+        break;
+
+    case AML_RESOURCE_SPI_SERIALBUSTYPE:
+
+        Address = Resource->SpiSerialBus.DeviceSelection;
+        Speed = Resource->SpiSerialBus.ConnectionSpeed;
+        break;
+
+    case AML_RESOURCE_UART_SERIALBUSTYPE:
+
+        Address = 0;
+        Speed = Resource->UartSerialBus.DefaultBaudRate;
+        break;
+
+    default:    /* Invalid bus subtype */
+        return;
+    }
+
+    Info = MpCreateSerialInfo (DeviceName, Address);
+
+    Info->Op = Op;
+    Info->DeviceName = DeviceName;
+    Info->Resource = Resource;
+    Info->Address = Address;
+    Info->Speed = Speed;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpCreateGpioInfo
+ *
+ * PARAMETERS:  PinNumber               - GPIO pin number
+ *              DeviceName              - The "ResourceSource" name
+ *
+ * RETURN:      New GPIO info block.
+ *
+ * DESCRIPTION: Create a new GPIO info block and place it on the global list.
+ *              The list is sorted by GPIO device names first, and pin numbers
+ *              secondarily.
+ *
+ ******************************************************************************/
+
+static ACPI_GPIO_INFO *
+MpCreateGpioInfo (
+    UINT16                  PinNumber,
+    char                    *DeviceName)
+{
+    ACPI_GPIO_INFO          *Info;
+    ACPI_GPIO_INFO          *NextGpio;
+    ACPI_GPIO_INFO          *PrevGpio;
+    char                    *Buffer;
+
+
+    /*
+     * Allocate a new info block and insert it into the global GPIO list
+     * sorted by both source device name and then the pin number. There is
+     * one block per pin.
+     */
+    Buffer = UtStringCacheCalloc (sizeof (ACPI_GPIO_INFO));
+    Info = ACPI_CAST_PTR (ACPI_GPIO_INFO, Buffer);
+
+    NextGpio = Gbl_GpioList;
+    PrevGpio = NULL;
+    if (!Gbl_GpioList)
+    {
+        Gbl_GpioList = Info;
+        Info->Next = NULL;
+        return (Info);
+    }
+
+    /* Sort on source DeviceName first */
+
+    while (NextGpio &&
+        (strcmp (DeviceName, NextGpio->DeviceName) > 0))
+    {
+        PrevGpio = NextGpio;
+        NextGpio = NextGpio->Next;
+    }
+
+    /* Now sort on the PinNumber */
+
+    while (NextGpio &&
+        (NextGpio->PinNumber < PinNumber) &&
+        !strcmp (DeviceName, NextGpio->DeviceName))
+    {
+        PrevGpio = NextGpio;
+        NextGpio = NextGpio->Next;
+    }
+
+    /* Finish the list insertion */
+
+    if (PrevGpio)
+    {
+        PrevGpio->Next = Info;
+    }
+    else
+    {
+        Gbl_GpioList = Info;
+    }
+
+    Info->Next = NextGpio;
+    return (Info);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpCreateSerialInfo
+ *
+ * PARAMETERS:  DeviceName              - The "ResourceSource" name.
+ *              Address                 - Physical address for the device
+ *
+ * RETURN:      New Serial info block.
+ *
+ * DESCRIPTION: Create a new Serial info block and place it on the global list.
+ *              The list is sorted by Serial device names first, and addresses
+ *              secondarily.
+ *
+ ******************************************************************************/
+
+static ACPI_SERIAL_INFO *
+MpCreateSerialInfo (
+    char                    *DeviceName,
+    UINT16                  Address)
+{
+    ACPI_SERIAL_INFO        *Info;
+    ACPI_SERIAL_INFO        *NextSerial;
+    ACPI_SERIAL_INFO        *PrevSerial;
+    char                    *Buffer;
+
+
+    /*
+     * Allocate a new info block and insert it into the global Serial list
+     * sorted by both source device name and then the address.
+     */
+    Buffer = UtStringCacheCalloc (sizeof (ACPI_SERIAL_INFO));
+    Info = ACPI_CAST_PTR (ACPI_SERIAL_INFO, Buffer);
+
+    NextSerial = Gbl_SerialList;
+    PrevSerial = NULL;
+    if (!Gbl_SerialList)
+    {
+        Gbl_SerialList = Info;
+        Info->Next = NULL;
+        return (Info);
+    }
+
+    /* Sort on source DeviceName */
+
+    while (NextSerial &&
+        (strcmp (DeviceName, NextSerial->DeviceName) > 0))
+    {
+        PrevSerial = NextSerial;
+        NextSerial = NextSerial->Next;
+    }
+
+    /* Now sort on the Address */
+
+    while (NextSerial &&
+        (NextSerial->Address < Address) &&
+        !strcmp (DeviceName, NextSerial->DeviceName))
+    {
+        PrevSerial = NextSerial;
+        NextSerial = NextSerial->Next;
+    }
+
+    /* Finish the list insertion */
+
+    if (PrevSerial)
+    {
+        PrevSerial->Next = Info;
+    }
+    else
+    {
+        Gbl_SerialList = Info;
+    }
+
+    Info->Next = NextSerial;
+    return (Info);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslmapoutput.c b/usr/src/cmd/acpi/iasl/aslmapoutput.c
new file mode 100644
index 0000000000..a5b19e775e
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmapoutput.c
@@ -0,0 +1,642 @@
+/******************************************************************************
+ *
+ * Module Name: aslmapoutput - Output/emit the resource descriptor/device maps
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acapps.h"
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acinterp.h"
+#include "acparser.h"
+#include "acnamesp.h"
+#include "amlcode.h"
+
+/* This module used for application-level code only */
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslmapoutput")
+
+/* Local prototypes */
+
+static void
+MpEmitGpioInfo (
+    void);
+
+static void
+MpEmitSerialInfo (
+    void);
+
+static void
+MpEmitDeviceTree (
+    void);
+
+static ACPI_STATUS
+MpEmitOneDevice (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  NestingLevel,
+    void                    *Context,
+    void                    **ReturnValue);
+
+static void
+MpXrefDevices (
+    ACPI_GPIO_INFO          *Info);
+
+static ACPI_STATUS
+MpNamespaceXrefBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/* Strings used to decode flag bits */
+
+const char                  *DirectionDecode[] =
+{
+    "Both I/O   ",
+    "InputOnly  ",
+    "OutputOnly ",
+    "Preserve   "
+};
+
+const char                  *PolarityDecode[] =
+{
+    "ActiveHigh",
+    "ActiveLow ",
+    "ActiveBoth",
+    "Reserved  "
+};
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpEmitMappingInfo
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: External interface.
+ *              Map file has already been opened. Emit all of the collected
+ *              hardware mapping information. Includes: GPIO information,
+ *              Serial information, and a dump of the entire ACPI device tree.
+ *
+ ******************************************************************************/
+
+void
+MpEmitMappingInfo (
+    void)
+{
+
+    /* Mapfile option enabled? */
+
+    if (!Gbl_MapfileFlag)
+    {
+        return;
+    }
+
+    if (!Gbl_GpioList)
+    {
+        FlPrintFile (ASL_FILE_MAP_OUTPUT,
+            "\nNo GPIO devices found\n");
+    }
+
+    if (!Gbl_SerialList)
+    {
+        FlPrintFile (ASL_FILE_MAP_OUTPUT,
+            "\nNo Serial devices found (I2C/SPI/UART)\n");
+    }
+
+    if (!Gbl_GpioList && !Gbl_SerialList)
+    {
+        return;
+    }
+
+    /* Headers */
+
+    FlPrintFile (ASL_FILE_MAP_OUTPUT, "\nResource Descriptor Connectivity Map\n");
+    FlPrintFile (ASL_FILE_MAP_OUTPUT,   "------------------------------------\n");
+
+    /* Emit GPIO and Serial descriptors, then entire ACPI device tree */
+
+    MpEmitGpioInfo ();
+    MpEmitSerialInfo ();
+    MpEmitDeviceTree ();
+
+    /* Clear the lists - no need to free memory here */
+
+    Gbl_SerialList = NULL;
+    Gbl_GpioList = NULL;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpEmitGpioInfo
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emit the info about all GPIO devices found during the
+ *              compile or disassembly.
+ *
+ ******************************************************************************/
+
+static void
+MpEmitGpioInfo (
+    void)
+{
+    ACPI_GPIO_INFO          *Info;
+    char                    *Type;
+    char                    *PrevDeviceName = NULL;
+    const char              *Direction;
+    const char              *Polarity;
+    char                    *ParentPathname;
+    const char              *Description;
+    char                    *HidString;
+    const AH_DEVICE_ID      *HidInfo;
+
+
+    /* Walk the GPIO descriptor list */
+
+    Info = Gbl_GpioList;
+    while (Info)
+    {
+        HidString = MpGetHidViaNamestring (Info->DeviceName);
+
+        /* Print header info for the controller itself */
+
+        if (!PrevDeviceName ||
+            strcmp (PrevDeviceName, Info->DeviceName))
+        {
+            FlPrintFile (ASL_FILE_MAP_OUTPUT,
+                "\n\nGPIO Controller:  %-8s  %-28s",
+                HidString, Info->DeviceName);
+
+            HidInfo = AcpiAhMatchHardwareId (HidString);
+            if (HidInfo)
+            {
+                FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // %s",
+                    HidInfo->Description);
+            }
+
+            FlPrintFile (ASL_FILE_MAP_OUTPUT,
+                "\n\nPin   Type     Direction    Polarity"
+                "    Dest _HID  Destination\n");
+        }
+
+        PrevDeviceName = Info->DeviceName;
+
+        /* Setup various strings based upon the type (GpioInt or GpioIo) */
+
+        switch (Info->Type)
+        {
+        case AML_RESOURCE_GPIO_TYPE_INT:
+
+            Type = "GpioInt";
+            Direction = "-Interrupt-";
+            Polarity = PolarityDecode[Info->Polarity];
+            break;
+
+        case AML_RESOURCE_GPIO_TYPE_IO:
+
+            Type = "GpioIo ";
+            Direction = DirectionDecode[Info->Direction];
+            Polarity = "          ";
+            break;
+
+        default:
+            continue;
+        }
+
+        /* Emit the GPIO info */
+
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "%4.4X  %s  %s  %s  ",
+            Info->PinNumber, Type, Direction, Polarity);
+
+        ParentPathname = NULL;
+        HidString = MpGetConnectionInfo (Info->Op, Info->PinIndex,
+            &Info->TargetNode, &ParentPathname);
+        if (HidString)
+        {
+            /*
+             * This is a Connection() field
+             * Attempt to find all references to the field.
+             */
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, "%8s   %-28s",
+                HidString, ParentPathname);
+
+            MpXrefDevices (Info);
+        }
+        else
+        {
+            /*
+             * For Devices, attempt to get the _HID description string.
+             * Failing that (many _HIDs are not recognized), attempt to
+             * get the _DDN description string.
+             */
+            HidString = MpGetParentDeviceHid (Info->Op, &Info->TargetNode,
+                &ParentPathname);
+
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, "%8s   %-28s",
+                HidString, ParentPathname);
+
+            /* Get the _HID description or _DDN string */
+
+            HidInfo = AcpiAhMatchHardwareId (HidString);
+            if (HidInfo)
+            {
+                FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // %s",
+                    HidInfo->Description);
+            }
+            else if ((Description = MpGetDdnValue (ParentPathname)))
+            {
+                FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // %s (_DDN)",
+                    Description);
+            }
+        }
+
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "\n");
+        ACPI_FREE (ParentPathname);
+        Info = Info->Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpEmitSerialInfo
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emit the info about all Serial devices found during the
+ *              compile or disassembly.
+ *
+ ******************************************************************************/
+
+static void
+MpEmitSerialInfo (
+    void)
+{
+    ACPI_SERIAL_INFO        *Info;
+    char                    *Type;
+    char                    *ParentPathname;
+    char                    *PrevDeviceName = NULL;
+    char                    *HidString;
+    const AH_DEVICE_ID      *HidInfo;
+    const char              *Description;
+    AML_RESOURCE            *Resource;
+
+
+    /* Walk the constructed serial descriptor list */
+
+    Info = Gbl_SerialList;
+    while (Info)
+    {
+        Resource = Info->Resource;
+        switch (Resource->CommonSerialBus.Type)
+        {
+        case AML_RESOURCE_I2C_SERIALBUSTYPE:
+            Type = "I2C ";
+            break;
+
+        case AML_RESOURCE_SPI_SERIALBUSTYPE:
+            Type = "SPI ";
+            break;
+
+        case AML_RESOURCE_UART_SERIALBUSTYPE:
+            Type = "UART";
+            break;
+
+        default:
+            Type = "UNKN";
+            break;
+        }
+
+        HidString = MpGetHidViaNamestring (Info->DeviceName);
+
+        /* Print header info for the controller itself */
+
+        if (!PrevDeviceName ||
+            strcmp (PrevDeviceName, Info->DeviceName))
+        {
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, "\n\n%s Controller:  ",
+                Type);
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, "%-8s  %-28s",
+                HidString, Info->DeviceName);
+
+            HidInfo = AcpiAhMatchHardwareId (HidString);
+            if (HidInfo)
+            {
+                FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // %s",
+                    HidInfo->Description);
+            }
+
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, "\n\n");
+            FlPrintFile (ASL_FILE_MAP_OUTPUT,
+                "Type  Address   Speed      Dest _HID  Destination\n");
+        }
+
+        PrevDeviceName = Info->DeviceName;
+
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "%s   %4.4X    %8.8X    ",
+            Type, Info->Address, Info->Speed);
+
+        ParentPathname = NULL;
+        HidString = MpGetConnectionInfo (Info->Op, 0, &Info->TargetNode,
+            &ParentPathname);
+        if (HidString)
+        {
+            /*
+             * This is a Connection() field
+             * Attempt to find all references to the field.
+             */
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, "%8s   %-28s",
+                HidString, ParentPathname);
+        }
+        else
+        {
+            /* Normal resource template */
+
+            HidString = MpGetParentDeviceHid (Info->Op, &Info->TargetNode,
+                &ParentPathname);
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, "%8s   %-28s",
+                HidString, ParentPathname);
+
+            /* Get the _HID description or _DDN string */
+
+            HidInfo = AcpiAhMatchHardwareId (HidString);
+            if (HidInfo)
+            {
+                FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // %s",
+                    HidInfo->Description);
+            }
+            else if ((Description = MpGetDdnValue (ParentPathname)))
+            {
+                FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // %s (_DDN)",
+                    Description);
+            }
+        }
+
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "\n");
+        ACPI_FREE (ParentPathname);
+        Info = Info->Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpEmitDeviceTree
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emit information about all devices within the ACPI namespace.
+ *
+ ******************************************************************************/
+
+static void
+MpEmitDeviceTree (
+    void)
+{
+
+    FlPrintFile (ASL_FILE_MAP_OUTPUT, "\n\nACPI Device Tree\n");
+    FlPrintFile (ASL_FILE_MAP_OUTPUT,     "----------------\n\n");
+
+    FlPrintFile (ASL_FILE_MAP_OUTPUT, "Device Pathname                   "
+        "_HID      Description\n\n");
+
+    /* Walk the namespace from the root */
+
+    (void) AcpiNsWalkNamespace (ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
+        ACPI_UINT32_MAX, FALSE, MpEmitOneDevice, NULL, NULL, NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpEmitOneDevice
+ *
+ * PARAMETERS:  ACPI_NAMESPACE_WALK callback
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Emit information about one ACPI device in the namespace. Used
+ *              during dump of all device objects within the namespace.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+MpEmitOneDevice (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  NestingLevel,
+    void                    *Context,
+    void                    **ReturnValue)
+{
+    char                    *DevicePathname;
+    char                    *DdnString;
+    char                    *HidString;
+    const AH_DEVICE_ID      *HidInfo;
+
+
+    /* Device pathname */
+
+    DevicePathname = AcpiNsGetExternalPathname (
+        ACPI_CAST_PTR (ACPI_NAMESPACE_NODE, ObjHandle));
+
+    FlPrintFile (ASL_FILE_MAP_OUTPUT, "%-32s", DevicePathname);
+
+    /* _HID or _DDN */
+
+    HidString = MpGetHidValue (
+        ACPI_CAST_PTR (ACPI_NAMESPACE_NODE, ObjHandle));
+    FlPrintFile (ASL_FILE_MAP_OUTPUT, "%8s", HidString);
+
+    HidInfo = AcpiAhMatchHardwareId (HidString);
+    if (HidInfo)
+    {
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "    // %s",
+            HidInfo->Description);
+    }
+    else if ((DdnString = MpGetDdnValue (DevicePathname)))
+    {
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "    // %s (_DDN)", DdnString);
+    }
+
+    FlPrintFile (ASL_FILE_MAP_OUTPUT, "\n");
+    ACPI_FREE (DevicePathname);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpXrefDevices
+ *
+ * PARAMETERS:  Info                    - A GPIO Info block
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Cross-reference the parse tree and find all references to the
+ *              specified GPIO device.
+ *
+ ******************************************************************************/
+
+static void
+MpXrefDevices (
+    ACPI_GPIO_INFO          *Info)
+{
+
+    /* Walk the entire parse tree */
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        MpNamespaceXrefBegin, NULL, Info);
+
+    if (!Info->References)
+    {
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // **** No references in table");
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpNamespaceXrefBegin
+ *
+ * PARAMETERS:  WALK_PARSE_TREE callback
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Walk parse tree callback used to cross-reference GPIO pins.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+MpNamespaceXrefBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_GPIO_INFO          *Info = ACPI_CAST_PTR (ACPI_GPIO_INFO, Context);
+    const ACPI_OPCODE_INFO  *OpInfo;
+    char                    *DevicePathname;
+    ACPI_PARSE_OBJECT       *ParentOp;
+    char                    *HidString;
+
+
+    ACPI_FUNCTION_TRACE_PTR (MpNamespaceXrefBegin, Op);
+
+    /*
+     * If this node is the actual declaration of a name
+     * [such as the XXXX name in "Method (XXXX)"],
+     * we are not interested in it here. We only care about names that
+     * are references to other objects within the namespace and the
+     * parent objects of name declarations
+     */
+    if (Op->Asl.CompileFlags & NODE_IS_NAME_DECLARATION)
+    {
+        return (AE_OK);
+    }
+
+    /* We are only interested in opcodes that have an associated name */
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+
+    if ((OpInfo->Flags & AML_NAMED) ||
+        (OpInfo->Flags & AML_CREATE))
+    {
+        return (AE_OK);
+    }
+
+    if ((Op->Asl.ParseOpcode != PARSEOP_NAMESTRING) &&
+        (Op->Asl.ParseOpcode != PARSEOP_NAMESEG)    &&
+        (Op->Asl.ParseOpcode != PARSEOP_METHODCALL))
+    {
+        return (AE_OK);
+    }
+
+    if (!Op->Asl.Node)
+    {
+        return (AE_OK);
+    }
+
+    ParentOp = Op->Asl.Parent;
+    if (ParentOp->Asl.ParseOpcode == PARSEOP_FIELD)
+    {
+        return (AE_OK);
+    }
+
+    if (Op->Asl.Node == Info->TargetNode)
+    {
+        while (ParentOp && (!ParentOp->Asl.Node))
+        {
+            ParentOp = ParentOp->Asl.Parent;
+        }
+
+        if (ParentOp)
+        {
+            DevicePathname = AcpiNsGetExternalPathname (
+                ParentOp->Asl.Node);
+
+            if (!Info->References)
+            {
+                FlPrintFile (ASL_FILE_MAP_OUTPUT, "  // References:");
+            }
+
+            HidString = MpGetHidViaNamestring (DevicePathname);
+
+            FlPrintFile (ASL_FILE_MAP_OUTPUT, " %s [%s]",
+                DevicePathname, HidString);
+
+            Info->References++;
+
+            ACPI_FREE (DevicePathname);
+        }
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslmaputils.c b/usr/src/cmd/acpi/iasl/aslmaputils.c
new file mode 100644
index 0000000000..ebdab7daa7
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmaputils.c
@@ -0,0 +1,402 @@
+/******************************************************************************
+ *
+ * Module Name: aslmaputils - Utilities for the resource descriptor/device maps
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "acpi.h"
+#include "accommon.h"
+#include "acapps.h"
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acinterp.h"
+#include "acnamesp.h"
+#include "amlcode.h"
+
+/* This module used for application-level code only */
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslmaputils")
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpGetHidFromParseTree
+ *
+ * PARAMETERS:  HidNode             - Node for a _HID object
+ *
+ * RETURN:      An _HID string value. Automatically converts _HID integers
+ *              to strings. Never NULL.
+ *
+ * DESCRIPTION: Extract a _HID value from the parse tree, not the namespace.
+ *              Used when a fully initialized namespace is not available.
+ *
+ ******************************************************************************/
+
+char *
+MpGetHidFromParseTree (
+    ACPI_NAMESPACE_NODE     *HidNode)
+{
+    ACPI_PARSE_OBJECT       *Op;
+    ACPI_PARSE_OBJECT       *Arg;
+    char                    *HidString;
+
+
+    Op = HidNode->Op;
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_NAME:
+
+        Arg = Op->Asl.Child;  /* Get the NameSeg/NameString node */
+        Arg = Arg->Asl.Next;  /* First peer is the object to be associated with the name */
+
+        switch (Arg->Asl.ParseOpcode)
+        {
+        case PARSEOP_STRING_LITERAL:
+
+            return (Arg->Asl.Value.String);
+
+        case PARSEOP_INTEGER:
+
+            /* Convert EISAID to a string */
+
+            HidString = UtStringCacheCalloc (ACPI_EISAID_STRING_SIZE);
+            AcpiExEisaIdToString (HidString, Arg->Asl.Value.Integer);
+            return (HidString);
+
+        default:
+
+            return ("UNKNOWN");
+        }
+
+    default:
+        return ("-No HID-");
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpGetHidValue
+ *
+ * PARAMETERS:  DeviceNode          - Node for parent device
+ *
+ * RETURN:      An _HID string value. Automatically converts _HID integers
+ *              to strings. Never NULL.
+ *
+ * DESCRIPTION: Extract _HID value from within a device scope. Does not
+ *              actually execute a method, just gets the string or integer
+ *              value for the _HID.
+ *
+ ******************************************************************************/
+
+char *
+MpGetHidValue (
+    ACPI_NAMESPACE_NODE     *DeviceNode)
+{
+    ACPI_NAMESPACE_NODE     *HidNode;
+    char                    *HidString;
+    ACPI_STATUS             Status;
+
+
+    Status = AcpiNsGetNode (DeviceNode, METHOD_NAME__HID,
+        ACPI_NS_NO_UPSEARCH, &HidNode);
+    if (ACPI_FAILURE (Status))
+    {
+        goto ErrorExit;
+    }
+
+    /* If only partial namespace, get the _HID from the parse tree */
+
+    if (!HidNode->Object)
+    {
+        return (MpGetHidFromParseTree (HidNode));
+    }
+
+    /* Handle the different _HID flavors */
+
+    switch (HidNode->Type)
+    {
+    case ACPI_TYPE_STRING:
+
+        return (HidNode->Object->String.Pointer);
+
+    case ACPI_TYPE_INTEGER:
+
+        /* Convert EISAID to a string */
+
+        HidString = UtStringCacheCalloc (ACPI_EISAID_STRING_SIZE);
+        AcpiExEisaIdToString (HidString, HidNode->Object->Integer.Value);
+        return (HidString);
+
+    case ACPI_TYPE_METHOD:
+
+        return ("-Method-");
+
+    default:
+
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, "BAD HID TYPE: %u", HidNode->Type);
+        break;
+    }
+
+
+ErrorExit:
+    return ("-No HID-");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpGetHidViaNamestring
+ *
+ * PARAMETERS:  DeviceName          - Namepath for parent device
+ *
+ * RETURN:      _HID string. Never NULL.
+ *
+ * DESCRIPTION: Get a _HID value via a device pathname (instead of just simply
+ *              a device node.)
+ *
+ ******************************************************************************/
+
+char *
+MpGetHidViaNamestring (
+    char                    *DeviceName)
+{
+    ACPI_NAMESPACE_NODE     *DeviceNode;
+    ACPI_STATUS             Status;
+
+
+    Status = AcpiNsGetNode (NULL, DeviceName, ACPI_NS_NO_UPSEARCH,
+        &DeviceNode);
+    if (ACPI_FAILURE (Status))
+    {
+        goto ErrorExit;
+    }
+
+    return (MpGetHidValue (DeviceNode));
+
+
+ErrorExit:
+    return ("-No HID-");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpGetParentDeviceHid
+ *
+ * PARAMETERS:  Op                      - Parse Op to be examined
+ *              TargetNode              - Where the field node is returned
+ *              ParentDeviceName        - Where the node path is returned
+ *
+ * RETURN:      _HID string. Never NULL.
+ *
+ * DESCRIPTION: Find the parent Device or Scope Op, get the full pathname to
+ *              the parent, and get the _HID associated with the parent.
+ *
+ ******************************************************************************/
+
+char *
+MpGetParentDeviceHid (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_NAMESPACE_NODE     **TargetNode,
+    char                    **ParentDeviceName)
+{
+    ACPI_NAMESPACE_NODE     *DeviceNode;
+
+
+    /* Find parent Device() or Scope() Op */
+
+    while (Op &&
+        (Op->Asl.AmlOpcode != AML_DEVICE_OP) &&
+        (Op->Asl.AmlOpcode != AML_SCOPE_OP))
+    {
+        Op = Op->Asl.Parent;
+    }
+
+    if (!Op)
+    {
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, " No_Parent_Device ");
+        goto ErrorExit;
+    }
+
+    /* Get the full pathname to the device and the _HID */
+
+    DeviceNode = Op->Asl.Node;
+    if (!DeviceNode)
+    {
+        FlPrintFile (ASL_FILE_MAP_OUTPUT, " No_Device_Node ");
+        goto ErrorExit;
+    }
+
+    *ParentDeviceName = AcpiNsGetExternalPathname (DeviceNode);
+    return (MpGetHidValue (DeviceNode));
+
+
+ErrorExit:
+    return ("-No HID-");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpGetDdnValue
+ *
+ * PARAMETERS:  DeviceName          - Namepath for parent device
+ *
+ * RETURN:      _DDN description string. NULL on failure.
+ *
+ * DESCRIPTION: Execute the _DDN method for the device.
+ *
+ ******************************************************************************/
+
+char *
+MpGetDdnValue (
+    char                    *DeviceName)
+{
+    ACPI_NAMESPACE_NODE     *DeviceNode;
+    ACPI_NAMESPACE_NODE     *DdnNode;
+    ACPI_STATUS             Status;
+
+
+    Status = AcpiNsGetNode (NULL, DeviceName, ACPI_NS_NO_UPSEARCH,
+        &DeviceNode);
+    if (ACPI_FAILURE (Status))
+    {
+        goto ErrorExit;
+    }
+
+    Status = AcpiNsGetNode (DeviceNode, METHOD_NAME__DDN, ACPI_NS_NO_UPSEARCH,
+        &DdnNode);
+    if (ACPI_FAILURE (Status))
+    {
+        goto ErrorExit;
+    }
+
+    if ((DdnNode->Type != ACPI_TYPE_STRING) ||
+        !DdnNode->Object)
+    {
+        goto ErrorExit;
+    }
+
+    return (DdnNode->Object->String.Pointer);
+
+
+ErrorExit:
+    return (NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MpGetConnectionInfo
+ *
+ * PARAMETERS:  Op                      - Parse Op to be examined
+ *              PinIndex                - Index into GPIO PinList
+ *              TargetNode              - Where the field node is returned
+ *              TargetName              - Where the node path is returned
+ *
+ * RETURN:      A substitute _HID string, indicating that the name is actually
+ *              a field. NULL if the Op does not refer to a Connection.
+ *
+ * DESCRIPTION: Get the Field Unit that corresponds to the PinIndex after
+ *              a Connection() invocation.
+ *
+ ******************************************************************************/
+
+char *
+MpGetConnectionInfo (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  PinIndex,
+    ACPI_NAMESPACE_NODE     **TargetNode,
+    char                    **TargetName)
+{
+    ACPI_PARSE_OBJECT       *NextOp;
+    UINT32                  i;
+
+
+    /*
+     * Handle Connection() here. Find the next named FieldUnit.
+     * Note: we look at the ParseOpcode for the compiler, look
+     * at the AmlOpcode for the disassembler.
+     */
+    if ((Op->Asl.AmlOpcode == AML_INT_CONNECTION_OP) ||
+        (Op->Asl.ParseOpcode == PARSEOP_CONNECTION))
+    {
+        /* Find the correct field unit definition */
+
+        NextOp = Op;
+        for (i = 0; i <= PinIndex;)
+        {
+            NextOp = NextOp->Asl.Next;
+            while (NextOp &&
+                (NextOp->Asl.ParseOpcode != PARSEOP_NAMESEG) &&
+                (NextOp->Asl.AmlOpcode != AML_INT_NAMEDFIELD_OP))
+            {
+                NextOp = NextOp->Asl.Next;
+            }
+
+            if (!NextOp)
+            {
+                return ("UNKNOWN");
+            }
+
+            /* Add length of this field to the current pin index */
+
+            if (NextOp->Asl.ParseOpcode == PARSEOP_NAMESEG)
+            {
+                i += (UINT32) NextOp->Asl.Child->Asl.Value.Integer;
+            }
+            else /* AML_INT_NAMEDFIELD_OP */
+            {
+                i += (UINT32) NextOp->Asl.Value.Integer;
+            }
+        }
+
+        /* Return the node and pathname for the field unit */
+
+        *TargetNode = NextOp->Asl.Node;
+        *TargetName = AcpiNsGetExternalPathname (*TargetNode);
+        return ("-Field-");
+    }
+
+    return (NULL);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslmessages.c b/usr/src/cmd/acpi/iasl/aslmessages.c
new file mode 100644
index 0000000000..7a6506b8a9
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmessages.c
@@ -0,0 +1,415 @@
+/******************************************************************************
+ *
+ * Module Name: aslmessages.c - Compiler error/warning message strings
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslmessages")
+
+
+/*
+ * Strings for message reporting levels, must match error
+ * type string tables in aslmessages.c
+ */
+const char              *AslErrorLevel [ASL_NUM_REPORT_LEVELS] = {
+    "Optimize",
+    "Remark  ",
+    "Warning ",
+    "Warning ",
+    "Warning ",
+    "Error   "
+};
+
+/* All lowercase versions for IDEs */
+
+const char              *AslErrorLevelIde [ASL_NUM_REPORT_LEVELS] = {
+    "optimize",
+    "remark  ",
+    "warning ",
+    "warning ",
+    "warning ",
+    "error   "
+};
+
+
+/*
+ * Actual message strings for each compiler message ID. There are currently
+ * three distinct blocks of error messages (so that they can be expanded
+ * individually):
+ *      Main ASL compiler
+ *      Data Table compiler
+ *      Preprocessor
+ *
+ * NOTE1: These tables must match the enum list of message IDs in the file
+ * aslmessages.h exactly.
+ *
+ * NOTE2: With the introduction of the -vw option to disable specific messages,
+ * new messages should only be added to the end of this list, so that values
+ * for existing messages are not disturbed.
+ */
+
+/* ASL compiler */
+
+const char                      *AslCompilerMsgs [] =
+{
+/*    The zeroth message is reserved */    "",
+/*    ASL_MSG_ALIGNMENT */                  "Must be a multiple of alignment/granularity value",
+/*    ASL_MSG_ALPHANUMERIC_STRING */        "String must be entirely alphanumeric",
+/*    ASL_MSG_AML_NOT_IMPLEMENTED */        "Opcode is not implemented in compiler AML code generator",
+/*    ASL_MSG_ARG_COUNT_HI */               "Too many arguments",
+/*    ASL_MSG_ARG_COUNT_LO */               "Too few arguments",
+/*    ASL_MSG_ARG_INIT */                   "Method argument is not initialized",
+/*    ASL_MSG_BACKWARDS_OFFSET */           "Invalid backwards offset",
+/*    ASL_MSG_BUFFER_LENGTH */              "Effective AML buffer length is zero",
+/*    ASL_MSG_CLOSE */                      "Could not close file",
+/*    ASL_MSG_COMPILER_INTERNAL */          "Internal compiler error",
+/*    ASL_MSG_COMPILER_RESERVED */          "Use of compiler reserved name",
+/*    ASL_MSG_CONNECTION_MISSING */         "A Connection operator is required for this field SpaceId",
+/*    ASL_MSG_CONNECTION_INVALID */         "Invalid OpRegion SpaceId for use of Connection operator",
+/*    ASL_MSG_CONSTANT_EVALUATION */        "Could not evaluate constant expression",
+/*    ASL_MSG_CONSTANT_FOLDED */            "Constant expression evaluated and reduced",
+/*    ASL_MSG_CORE_EXCEPTION */             "From ACPICA Subsystem",
+/*    ASL_MSG_DEBUG_FILE_OPEN */            "Could not open debug file",
+/*    ASL_MSG_DEBUG_FILENAME */             "Could not create debug filename",
+/*    ASL_MSG_DEPENDENT_NESTING */          "Dependent function macros cannot be nested",
+/*    ASL_MSG_DMA_CHANNEL */                "Invalid DMA channel (must be 0-7)",
+/*    ASL_MSG_DMA_LIST */                   "Too many DMA channels (8 max)",
+/*    ASL_MSG_DUPLICATE_CASE */             "Case value already specified",
+/*    ASL_MSG_DUPLICATE_ITEM */             "Duplicate value in list",
+/*    ASL_MSG_EARLY_EOF */                  "Premature end-of-file reached",
+/*    ASL_MSG_ENCODING_LENGTH */            "Package length too long to encode",
+/*    ASL_MSG_EX_INTERRUPT_LIST */          "Too many interrupts (255 max)",
+/*    ASL_MSG_EX_INTERRUPT_LIST_MIN */      "Too few interrupts (1 minimum required)",
+/*    ASL_MSG_EX_INTERRUPT_NUMBER */        "Invalid interrupt number (must be 32 bits)",
+/*    ASL_MSG_FIELD_ACCESS_WIDTH */         "Access width is greater than region size",
+/*    ASL_MSG_FIELD_UNIT_ACCESS_WIDTH */    "Access width of Field Unit extends beyond region limit",
+/*    ASL_MSG_FIELD_UNIT_OFFSET */          "Field Unit extends beyond region limit",
+/*    ASL_MSG_GPE_NAME_CONFLICT */          "Name conflicts with a previous GPE method",
+/*    ASL_MSG_HID_LENGTH */                 "_HID string must be exactly 7 or 8 characters",
+/*    ASL_MSG_HID_PREFIX */                 "_HID prefix must be all uppercase or decimal digits",
+/*    ASL_MSG_HID_SUFFIX */                 "_HID suffix must be all hex digits",
+/*    ASL_MSG_INCLUDE_FILE_OPEN */          "Could not open include file",
+/*    ASL_MSG_INPUT_FILE_OPEN */            "Could not open input file",
+/*    ASL_MSG_INTEGER_LENGTH */             "64-bit integer in 32-bit table, truncating (DSDT or SSDT version < 2)",
+/*    ASL_MSG_INTEGER_OPTIMIZATION */       "Integer optimized to single-byte AML opcode",
+/*    ASL_MSG_INTERRUPT_LIST */             "Too many interrupts (16 max)",
+/*    ASL_MSG_INTERRUPT_NUMBER */           "Invalid interrupt number (must be 0-15)",
+/*    ASL_MSG_INVALID_ACCESS_SIZE */        "Invalid AccessSize (Maximum is 4 - QWord access)",
+/*    ASL_MSG_INVALID_ADDR_FLAGS */         "Invalid combination of Length and Min/Max fixed flags",
+/*    ASL_MSG_INVALID_CONSTANT_OP */        "Invalid operator in constant expression (not type 3/4/5)",
+/*    ASL_MSG_INVALID_EISAID */             "EISAID string must be of the form \"UUUXXXX\" (3 uppercase, 4 hex digits)",
+/*    ASL_MSG_INVALID_ESCAPE */             "Invalid or unknown escape sequence",
+/*    ASL_MSG_INVALID_GRAN_FIXED */         "Granularity must be zero for fixed Min/Max",
+/*    ASL_MSG_INVALID_GRANULARITY */        "Granularity must be zero or a power of two minus one",
+/*    ASL_MSG_INVALID_LENGTH */             "Length is larger than Min/Max window",
+/*    ASL_MSG_INVALID_LENGTH_FIXED */       "Length is not equal to fixed Min/Max window",
+/*    ASL_MSG_INVALID_MIN_MAX */            "Address Min is greater than Address Max",
+/*    ASL_MSG_INVALID_OPERAND */            "Invalid operand",
+/*    ASL_MSG_INVALID_PERFORMANCE */        "Invalid performance/robustness value",
+/*    ASL_MSG_INVALID_PRIORITY */           "Invalid priority value",
+/*    ASL_MSG_INVALID_STRING */             "Invalid Hex/Octal Escape - Non-ASCII or NULL",
+/*    ASL_MSG_INVALID_TARGET */             "Target operand not allowed in constant expression",
+/*    ASL_MSG_INVALID_TIME */               "Time parameter too long (255 max)",
+/*    ASL_MSG_INVALID_TYPE */               "Invalid type",
+/*    ASL_MSG_INVALID_UUID */               "UUID string must be of the form \"aabbccdd-eeff-gghh-iijj-kkllmmnnoopp\"",
+/*    ASL_MSG_ISA_ADDRESS */                "Maximum 10-bit ISA address (0x3FF)",
+/*    ASL_MSG_LEADING_ASTERISK */           "Invalid leading asterisk",
+/*    ASL_MSG_LIST_LENGTH_LONG */           "Initializer list longer than declared package length",
+/*    ASL_MSG_LIST_LENGTH_SHORT */          "Initializer list shorter than declared package length",
+/*    ASL_MSG_LISTING_FILE_OPEN */          "Could not open listing file",
+/*    ASL_MSG_LISTING_FILENAME */           "Could not create listing filename",
+/*    ASL_MSG_LOCAL_INIT */                 "Method local variable is not initialized",
+/*    ASL_MSG_LOCAL_OUTSIDE_METHOD */       "Local or Arg used outside a control method",
+/*    ASL_MSG_LONG_LINE */                  "Splitting long input line",
+/*    ASL_MSG_MEMORY_ALLOCATION */          "Memory allocation failure",
+/*    ASL_MSG_MISSING_ENDDEPENDENT */       "Missing EndDependentFn() macro in dependent resource list",
+/*    ASL_MSG_MISSING_STARTDEPENDENT */     "Missing StartDependentFn() macro in dependent resource list",
+/*    ASL_MSG_MULTIPLE_DEFAULT */           "More than one Default statement within Switch construct",
+/*    ASL_MSG_MULTIPLE_TYPES */             "Multiple types",
+/*    ASL_MSG_NAME_EXISTS */                "Name already exists in scope",
+/*    ASL_MSG_NAME_OPTIMIZATION */          "NamePath optimized",
+/*    ASL_MSG_NAMED_OBJECT_IN_WHILE */      "Creating a named object in a While loop",
+/*    ASL_MSG_NESTED_COMMENT */             "Nested comment found",
+/*    ASL_MSG_NO_CASES */                   "No Case statements under Switch",
+/*    ASL_MSG_NO_REGION */                  "_REG has no corresponding Operation Region",
+/*    ASL_MSG_NO_RETVAL */                  "Called method returns no value",
+/*    ASL_MSG_NO_WHILE */                   "No enclosing While statement",
+/*    ASL_MSG_NON_ASCII */                  "Invalid characters found in file",
+/*    ASL_MSG_NON_ZERO */                   "Operand evaluates to zero",
+/*    ASL_MSG_NOT_EXIST */                  "Object does not exist",
+/*    ASL_MSG_NOT_FOUND */                  "Object not found or not accessible from scope",
+/*    ASL_MSG_NOT_METHOD */                 "Not a control method, cannot invoke",
+/*    ASL_MSG_NOT_PARAMETER */              "Not a parameter, used as local only",
+/*    ASL_MSG_NOT_REACHABLE */              "Object is not accessible from this scope",
+/*    ASL_MSG_NOT_REFERENCED */             "Object is not referenced",
+/*    ASL_MSG_NULL_DESCRIPTOR */            "Min/Max/Length/Gran are all zero, but no resource tag",
+/*    ASL_MSG_NULL_STRING */                "Invalid zero-length (null) string",
+/*    ASL_MSG_OPEN */                       "Could not open file",
+/*    ASL_MSG_OUTPUT_FILE_OPEN */           "Could not open output AML file",
+/*    ASL_MSG_OUTPUT_FILENAME */            "Could not create output filename",
+/*    ASL_MSG_PACKAGE_LENGTH */             "Effective AML package length is zero",
+/*    ASL_MSG_PREPROCESSOR_FILENAME */      "Could not create preprocessor filename",
+/*    ASL_MSG_READ */                       "Could not read file",
+/*    ASL_MSG_RECURSION */                  "Recursive method call",
+/*    ASL_MSG_REGION_BUFFER_ACCESS */       "Host Operation Region requires BufferAcc access",
+/*    ASL_MSG_REGION_BYTE_ACCESS */         "Host Operation Region requires ByteAcc access",
+/*    ASL_MSG_RESERVED_ARG_COUNT_HI */      "Reserved method has too many arguments",
+/*    ASL_MSG_RESERVED_ARG_COUNT_LO */      "Reserved method has too few arguments",
+/*    ASL_MSG_RESERVED_METHOD */            "Reserved name must be a control method",
+/*    ASL_MSG_RESERVED_NO_RETURN_VAL */     "Reserved method should not return a value",
+/*    ASL_MSG_RESERVED_OPERAND_TYPE */      "Invalid object type for reserved name",
+/*    ASL_MSG_RESERVED_PACKAGE_LENGTH */    "Invalid package length for reserved name",
+/*    ASL_MSG_RESERVED_RETURN_VALUE */      "Reserved method must return a value",
+/*    ASL_MSG_RESERVED_USE */               "Invalid use of reserved name",
+/*    ASL_MSG_RESERVED_WORD */              "Use of reserved name",
+/*    ASL_MSG_RESOURCE_FIELD */             "Resource field name cannot be used as a target",
+/*    ASL_MSG_RESOURCE_INDEX */             "Missing ResourceSourceIndex (required)",
+/*    ASL_MSG_RESOURCE_LIST */              "Too many resource items (internal error)",
+/*    ASL_MSG_RESOURCE_SOURCE */            "Missing ResourceSource string (required)",
+/*    ASL_MSG_RESULT_NOT_USED */            "Result is not used, operator has no effect",
+/*    ASL_MSG_RETURN_TYPES */               "Not all control paths return a value",
+/*    ASL_MSG_SCOPE_FWD_REF */              "Forward references from Scope operator not allowed",
+/*    ASL_MSG_SCOPE_TYPE */                 "Existing object has invalid type for Scope operator",
+/*    ASL_MSG_SEEK */                       "Could not seek file",
+/*    ASL_MSG_SERIALIZED */                 "Control Method marked Serialized",
+/*    ASL_MSG_SERIALIZED_REQUIRED */        "Control Method should be made Serialized",
+/*    ASL_MSG_SINGLE_NAME_OPTIMIZATION */   "NamePath optimized to NameSeg (uses run-time search path)",
+/*    ASL_MSG_SOME_NO_RETVAL */             "Called method may not always return a value",
+/*    ASL_MSG_STRING_LENGTH */              "String literal too long",
+/*    ASL_MSG_SWITCH_TYPE */                "Switch expression is not a static Integer/Buffer/String data type, defaulting to Integer",
+/*    ASL_MSG_SYNC_LEVEL */                 "SyncLevel must be in the range 0-15",
+/*    ASL_MSG_SYNTAX */                     "",
+/*    ASL_MSG_TABLE_SIGNATURE */            "Invalid Table Signature",
+/*    ASL_MSG_TAG_LARGER */                 "ResourceTag larger than Field",
+/*    ASL_MSG_TAG_SMALLER */                "ResourceTag smaller than Field",
+/*    ASL_MSG_TIMEOUT */                    "Result is not used, possible operator timeout will be missed",
+/*    ASL_MSG_TOO_MANY_TEMPS */             "Method requires too many temporary variables (_T_x)",
+/*    ASL_MSG_TRUNCATION */                 "64-bit return value will be truncated to 32 bits (DSDT or SSDT version < 2)",
+/*    ASL_MSG_UNKNOWN_RESERVED_NAME */      "Unknown reserved name",
+/*    ASL_MSG_UNREACHABLE_CODE */           "Statement is unreachable",
+/*    ASL_MSG_UNSUPPORTED */                "Unsupported feature",
+/*    ASL_MSG_UPPER_CASE */                 "Non-hex letters must be upper case",
+/*    ASL_MSG_VENDOR_LIST */                "Too many vendor data bytes (7 max)",
+/*    ASL_MSG_WRITE */                      "Could not write file",
+/*    ASL_MSG_RANGE */                      "Constant out of range",
+/*    ASL_MSG_BUFFER_ALLOCATION */          "Could not allocate line buffer",
+/*    ASL_MSG_MISSING_DEPENDENCY */         "Missing dependency",
+/*    ASL_MSG_ILLEGAL_FORWARD_REF */        "Illegal forward reference within a method",
+/*    ASL_MSG_ILLEGAL_METHOD_REF */         "Illegal reference across two methods",
+/*    ASL_MSG_LOCAL_NOT_USED */             "Method Local is set but never used",
+/*    ASL_MSG_ARG_AS_LOCAL_NOT_USED */      "Method Argument (as a local) is set but never used",
+/*    ASL_MSG_ARG_NOT_USED */               "Method Argument is never used",
+/*    ASL_MSG_CONSTANT_REQUIRED */          "Non-reducible expression",
+/*    ASL_MSG_CROSS_TABLE_SCOPE */          "Illegal open scope on external object from within DSDT"
+};
+
+/* Table compiler */
+
+const char                      *AslTableCompilerMsgs [] =
+{
+/*    ASL_MSG_BUFFER_ELEMENT */             "Invalid element in buffer initializer list",
+/*    ASL_MSG_DIVIDE_BY_ZERO */             "Expression contains divide-by-zero",
+/*    ASL_MSG_FLAG_VALUE */                 "Flag value is too large",
+/*    ASL_MSG_INTEGER_SIZE */               "Integer too large for target",
+/*    ASL_MSG_INVALID_EXPRESSION */         "Invalid expression",
+/*    ASL_MSG_INVALID_FIELD_NAME */         "Invalid Field Name",
+/*    ASL_MSG_INVALID_HEX_INTEGER */        "Invalid hex integer constant",
+/*    ASL_MSG_OEM_TABLE */                  "OEM table - unknown contents",
+/*    ASL_MSG_RESERVED_VALUE */             "Reserved field",
+/*    ASL_MSG_UNKNOWN_LABEL */              "Label is undefined",
+/*    ASL_MSG_UNKNOWN_SUBTABLE */           "Unknown subtable type",
+/*    ASL_MSG_UNKNOWN_TABLE */              "Unknown ACPI table signature",
+/*    ASL_MSG_ZERO_VALUE */                 "Value must be non-zero"
+};
+
+/* Preprocessor */
+
+const char                      *AslPreprocessorMsgs [] =
+{
+/*    ASL_MSG_DIRECTIVE_SYNTAX */           "Invalid directive syntax",
+/*    ASL_MSG_ENDIF_MISMATCH */             "Mismatched #endif",
+/*    ASL_MSG_ERROR_DIRECTIVE */            "#error",
+/*    ASL_MSG_EXISTING_NAME */              "Name is already defined",
+/*    ASL_MSG_INVALID_INVOCATION */         "Invalid macro invocation",
+/*    ASL_MSG_MACRO_SYNTAX */               "Invalid macro syntax",
+/*    ASL_MSG_TOO_MANY_ARGUMENTS */         "Too many macro arguments",
+/*    ASL_MSG_UNKNOWN_DIRECTIVE */          "Unknown directive",
+/*    ASL_MSG_UNKNOWN_PRAGMA */             "Unknown pragma",
+/*    ASL_MSG_WARNING_DIRECTIVE */          "#warning",
+/*    ASL_MSG_INCLUDE_FILE */               "Found a # preprocessor directive in ASL Include() file"
+};
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AeDecodeMessageId
+ *
+ * PARAMETERS:  MessageId               - ASL message ID (exception code) to be
+ *                                        formatted. Possibly fully encoded.
+ *
+ * RETURN:      A string containing the exception message text.
+ *
+ * DESCRIPTION: This function validates and translates an ASL message ID into
+ *              an ASCII string.
+ *
+ ******************************************************************************/
+
+const char *
+AeDecodeMessageId (
+    UINT16                  MessageId)
+{
+    UINT32                  Index;
+    const char              **MessageTable;
+
+
+    /* Main ASL Compiler messages */
+
+    if (MessageId <= ASL_MSG_MAIN_COMPILER_END)
+    {
+        MessageTable = AslCompilerMsgs;
+        Index = MessageId;
+
+        if (Index >= ACPI_ARRAY_LENGTH (AslCompilerMsgs))
+        {
+            return ("[Unknown ASL Compiler exception ID]");
+        }
+    }
+
+    /* Data Table Compiler messages */
+
+    else if (MessageId <= ASL_MSG_TABLE_COMPILER_END)
+    {
+        MessageTable = AslTableCompilerMsgs;
+        Index = MessageId - ASL_MSG_TABLE_COMPILER;
+
+        if (Index >= ACPI_ARRAY_LENGTH (AslTableCompilerMsgs))
+        {
+            return ("[Unknown Table Compiler exception ID]");
+        }
+    }
+
+    /* Preprocessor messages */
+
+    else if (MessageId <= ASL_MSG_PREPROCESSOR_END)
+    {
+        MessageTable = AslPreprocessorMsgs;
+        Index = MessageId - ASL_MSG_PREPROCESSOR;
+
+        if (Index >= ACPI_ARRAY_LENGTH (AslPreprocessorMsgs))
+        {
+            return ("[Unknown Preprocessor exception ID]");
+        }
+    }
+
+    /* Everything else is unknown */
+
+    else
+    {
+        return ("[Unknown exception/component ID]");
+    }
+
+    return (MessageTable[Index]);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AeDecodeExceptionLevel
+ *
+ * PARAMETERS:  Level               - The ASL error level to be decoded
+ *
+ * RETURN:      A string containing the error level text
+ *
+ * DESCRIPTION: This function validates and translates an ASL error level into
+ *              an ASCII string.
+ *
+ ******************************************************************************/
+
+const char *
+AeDecodeExceptionLevel (
+    UINT8                   Level)
+{
+    /* Range check on Level */
+
+    if (Level >= ACPI_ARRAY_LENGTH (AslErrorLevel))
+    {
+        return ("Unknown exception level");
+    }
+
+    /* Differentiate the string type to be used (IDE is all lower case) */
+
+    if (Gbl_VerboseErrors)
+    {
+        return (AslErrorLevel[Level]);
+    }
+
+    return (AslErrorLevelIde[Level]);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AeBuildFullExceptionCode
+ *
+ * PARAMETERS:  Level               - ASL error level
+ *              MessageId           - ASL exception code to be formatted
+ *
+ * RETURN:      Fully encoded exception code
+ *
+ * DESCRIPTION: Build the full exception code from the error level and the
+ *              actual message ID.
+ *
+ ******************************************************************************/
+
+UINT16
+AeBuildFullExceptionCode (
+    UINT8                   Level,
+    UINT16                  MessageId)
+{
+
+    /*
+     * Error level is in the thousands slot (error/warning/remark, etc.)
+     * Error codes are 0 - 999
+     */
+    return (((Level + 1) * 1000) + MessageId);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslmessages.h b/usr/src/cmd/acpi/iasl/aslmessages.h
new file mode 100644
index 0000000000..0ee063fa59
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmessages.h
@@ -0,0 +1,280 @@
+/******************************************************************************
+ *
+ * Module Name: aslmessages.h - Compiler error/warning messages
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#ifndef __ASLMESSAGES_H
+#define __ASLMESSAGES_H
+
+
+/* These values must match error type string tables in aslmessages.c */
+
+typedef enum
+{
+    ASL_OPTIMIZATION = 0,
+    ASL_REMARK,
+    ASL_WARNING,
+    ASL_WARNING2,
+    ASL_WARNING3,
+    ASL_ERROR,
+    ASL_NUM_REPORT_LEVELS
+
+} ASL_MESSAGE_TYPES;
+
+
+#define ASL_ERROR_LEVEL_LENGTH          8 /* Length of strings for types above */
+
+/*
+ * Exception code blocks, 0 - 999
+ * Available for new exception blocks: 600 - 999
+ */
+#define ASL_MSG_MAIN_COMPILER           0       /* 0 - 299 */
+#define ASL_MSG_MAIN_COMPILER_END       299
+
+#define ASL_MSG_TABLE_COMPILER          300     /* 300 - 499 */
+#define ASL_MSG_TABLE_COMPILER_END      499
+
+#define ASL_MSG_PREPROCESSOR            500     /* 500 - 599 */
+#define ASL_MSG_PREPROCESSOR_END        599
+
+
+/*
+ * Values (message IDs) for all compiler messages. There are currently
+ * three distinct blocks of error messages (so that they can be expanded
+ * individually):
+ *      Main ASL compiler
+ *      Data Table compiler
+ *      Preprocessor
+ *
+ * NOTE1: This list must match the tables of message strings in the file
+ * aslmessages.c exactly.
+ *
+ * NOTE2: With the introduction of the -vw option to disable specific
+ * messages, new messages should only be added to the end of these
+ * lists, so that values for existing messages are not disturbed.
+ */
+typedef enum
+{
+    ASL_MSG_RESERVED = ASL_MSG_MAIN_COMPILER,
+
+    ASL_MSG_ALIGNMENT,
+    ASL_MSG_ALPHANUMERIC_STRING,
+    ASL_MSG_AML_NOT_IMPLEMENTED,
+    ASL_MSG_ARG_COUNT_HI,
+    ASL_MSG_ARG_COUNT_LO,
+    ASL_MSG_ARG_INIT,
+    ASL_MSG_BACKWARDS_OFFSET,
+    ASL_MSG_BUFFER_LENGTH,
+    ASL_MSG_CLOSE,
+    ASL_MSG_COMPILER_INTERNAL,
+    ASL_MSG_COMPILER_RESERVED,
+    ASL_MSG_CONNECTION_MISSING,
+    ASL_MSG_CONNECTION_INVALID,
+    ASL_MSG_CONSTANT_EVALUATION,
+    ASL_MSG_CONSTANT_FOLDED,
+    ASL_MSG_CORE_EXCEPTION,
+    ASL_MSG_DEBUG_FILE_OPEN,
+    ASL_MSG_DEBUG_FILENAME,
+    ASL_MSG_DEPENDENT_NESTING,
+    ASL_MSG_DMA_CHANNEL,
+    ASL_MSG_DMA_LIST,
+    ASL_MSG_DUPLICATE_CASE,
+    ASL_MSG_DUPLICATE_ITEM,
+    ASL_MSG_EARLY_EOF,
+    ASL_MSG_ENCODING_LENGTH,
+    ASL_MSG_EX_INTERRUPT_LIST,
+    ASL_MSG_EX_INTERRUPT_LIST_MIN,
+    ASL_MSG_EX_INTERRUPT_NUMBER,
+    ASL_MSG_FIELD_ACCESS_WIDTH,
+    ASL_MSG_FIELD_UNIT_ACCESS_WIDTH,
+    ASL_MSG_FIELD_UNIT_OFFSET,
+    ASL_MSG_GPE_NAME_CONFLICT,
+    ASL_MSG_HID_LENGTH,
+    ASL_MSG_HID_PREFIX,
+    ASL_MSG_HID_SUFFIX,
+    ASL_MSG_INCLUDE_FILE_OPEN,
+    ASL_MSG_INPUT_FILE_OPEN,
+    ASL_MSG_INTEGER_LENGTH,
+    ASL_MSG_INTEGER_OPTIMIZATION,
+    ASL_MSG_INTERRUPT_LIST,
+    ASL_MSG_INTERRUPT_NUMBER,
+    ASL_MSG_INVALID_ACCESS_SIZE,
+    ASL_MSG_INVALID_ADDR_FLAGS,
+    ASL_MSG_INVALID_CONSTANT_OP,
+    ASL_MSG_INVALID_EISAID,
+    ASL_MSG_INVALID_ESCAPE,
+    ASL_MSG_INVALID_GRAN_FIXED,
+    ASL_MSG_INVALID_GRANULARITY,
+    ASL_MSG_INVALID_LENGTH,
+    ASL_MSG_INVALID_LENGTH_FIXED,
+    ASL_MSG_INVALID_MIN_MAX,
+    ASL_MSG_INVALID_OPERAND,
+    ASL_MSG_INVALID_PERFORMANCE,
+    ASL_MSG_INVALID_PRIORITY,
+    ASL_MSG_INVALID_STRING,
+    ASL_MSG_INVALID_TARGET,
+    ASL_MSG_INVALID_TIME,
+    ASL_MSG_INVALID_TYPE,
+    ASL_MSG_INVALID_UUID,
+    ASL_MSG_ISA_ADDRESS,
+    ASL_MSG_LEADING_ASTERISK,
+    ASL_MSG_LIST_LENGTH_LONG,
+    ASL_MSG_LIST_LENGTH_SHORT,
+    ASL_MSG_LISTING_FILE_OPEN,
+    ASL_MSG_LISTING_FILENAME,
+    ASL_MSG_LOCAL_INIT,
+    ASL_MSG_LOCAL_OUTSIDE_METHOD,
+    ASL_MSG_LONG_LINE,
+    ASL_MSG_MEMORY_ALLOCATION,
+    ASL_MSG_MISSING_ENDDEPENDENT,
+    ASL_MSG_MISSING_STARTDEPENDENT,
+    ASL_MSG_MULTIPLE_DEFAULT,
+    ASL_MSG_MULTIPLE_TYPES,
+    ASL_MSG_NAME_EXISTS,
+    ASL_MSG_NAME_OPTIMIZATION,
+    ASL_MSG_NAMED_OBJECT_IN_WHILE,
+    ASL_MSG_NESTED_COMMENT,
+    ASL_MSG_NO_CASES,
+    ASL_MSG_NO_REGION,
+    ASL_MSG_NO_RETVAL,
+    ASL_MSG_NO_WHILE,
+    ASL_MSG_NON_ASCII,
+    ASL_MSG_NON_ZERO,
+    ASL_MSG_NOT_EXIST,
+    ASL_MSG_NOT_FOUND,
+    ASL_MSG_NOT_METHOD,
+    ASL_MSG_NOT_PARAMETER,
+    ASL_MSG_NOT_REACHABLE,
+    ASL_MSG_NOT_REFERENCED,
+    ASL_MSG_NULL_DESCRIPTOR,
+    ASL_MSG_NULL_STRING,
+    ASL_MSG_OPEN,
+    ASL_MSG_OUTPUT_FILE_OPEN,
+    ASL_MSG_OUTPUT_FILENAME,
+    ASL_MSG_PACKAGE_LENGTH,
+    ASL_MSG_PREPROCESSOR_FILENAME,
+    ASL_MSG_READ,
+    ASL_MSG_RECURSION,
+    ASL_MSG_REGION_BUFFER_ACCESS,
+    ASL_MSG_REGION_BYTE_ACCESS,
+    ASL_MSG_RESERVED_ARG_COUNT_HI,
+    ASL_MSG_RESERVED_ARG_COUNT_LO,
+    ASL_MSG_RESERVED_METHOD,
+    ASL_MSG_RESERVED_NO_RETURN_VAL,
+    ASL_MSG_RESERVED_OPERAND_TYPE,
+    ASL_MSG_RESERVED_PACKAGE_LENGTH,
+    ASL_MSG_RESERVED_RETURN_VALUE,
+    ASL_MSG_RESERVED_USE,
+    ASL_MSG_RESERVED_WORD,
+    ASL_MSG_RESOURCE_FIELD,
+    ASL_MSG_RESOURCE_INDEX,
+    ASL_MSG_RESOURCE_LIST,
+    ASL_MSG_RESOURCE_SOURCE,
+    ASL_MSG_RESULT_NOT_USED,
+    ASL_MSG_RETURN_TYPES,
+    ASL_MSG_SCOPE_FWD_REF,
+    ASL_MSG_SCOPE_TYPE,
+    ASL_MSG_SEEK,
+    ASL_MSG_SERIALIZED,
+    ASL_MSG_SERIALIZED_REQUIRED,
+    ASL_MSG_SINGLE_NAME_OPTIMIZATION,
+    ASL_MSG_SOME_NO_RETVAL,
+    ASL_MSG_STRING_LENGTH,
+    ASL_MSG_SWITCH_TYPE,
+    ASL_MSG_SYNC_LEVEL,
+    ASL_MSG_SYNTAX,
+    ASL_MSG_TABLE_SIGNATURE,
+    ASL_MSG_TAG_LARGER,
+    ASL_MSG_TAG_SMALLER,
+    ASL_MSG_TIMEOUT,
+    ASL_MSG_TOO_MANY_TEMPS,
+    ASL_MSG_TRUNCATION,
+    ASL_MSG_UNKNOWN_RESERVED_NAME,
+    ASL_MSG_UNREACHABLE_CODE,
+    ASL_MSG_UNSUPPORTED,
+    ASL_MSG_UPPER_CASE,
+    ASL_MSG_VENDOR_LIST,
+    ASL_MSG_WRITE,
+    ASL_MSG_RANGE,
+    ASL_MSG_BUFFER_ALLOCATION,
+    ASL_MSG_MISSING_DEPENDENCY,
+    ASL_MSG_ILLEGAL_FORWARD_REF,
+    ASL_MSG_ILLEGAL_METHOD_REF,
+    ASL_MSG_LOCAL_NOT_USED,
+    ASL_MSG_ARG_AS_LOCAL_NOT_USED,
+    ASL_MSG_ARG_NOT_USED,
+    ASL_MSG_CONSTANT_REQUIRED,
+    ASL_MSG_CROSS_TABLE_SCOPE,
+
+    /* These messages are used by the Data Table compiler only */
+
+    ASL_MSG_BUFFER_ELEMENT = ASL_MSG_TABLE_COMPILER,
+    ASL_MSG_DIVIDE_BY_ZERO,
+    ASL_MSG_FLAG_VALUE,
+    ASL_MSG_INTEGER_SIZE,
+    ASL_MSG_INVALID_EXPRESSION,
+    ASL_MSG_INVALID_FIELD_NAME,
+    ASL_MSG_INVALID_HEX_INTEGER,
+    ASL_MSG_OEM_TABLE,
+    ASL_MSG_RESERVED_VALUE,
+    ASL_MSG_UNKNOWN_LABEL,
+    ASL_MSG_UNKNOWN_SUBTABLE,
+    ASL_MSG_UNKNOWN_TABLE,
+    ASL_MSG_ZERO_VALUE,
+
+    /* These messages are used by the Preprocessor only */
+
+    ASL_MSG_DIRECTIVE_SYNTAX = ASL_MSG_PREPROCESSOR,
+    ASL_MSG_ENDIF_MISMATCH,
+    ASL_MSG_ERROR_DIRECTIVE,
+    ASL_MSG_EXISTING_NAME,
+    ASL_MSG_INVALID_INVOCATION,
+    ASL_MSG_MACRO_SYNTAX,
+    ASL_MSG_TOO_MANY_ARGUMENTS,
+    ASL_MSG_UNKNOWN_DIRECTIVE,
+    ASL_MSG_UNKNOWN_PRAGMA,
+    ASL_MSG_WARNING_DIRECTIVE,
+    ASL_MSG_INCLUDE_FILE
+
+} ASL_MESSAGE_IDS;
+
+
+#endif  /* __ASLMESSAGES_H */
diff --git a/usr/src/cmd/acpi/iasl/aslmethod.c b/usr/src/cmd/acpi/iasl/aslmethod.c
new file mode 100644
index 0000000000..226aa79c46
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslmethod.c
@@ -0,0 +1,739 @@
+/******************************************************************************
+ *
+ * Module Name: aslmethod.c - Control method analysis walk
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acparser.h"
+#include "amlcode.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslmethod")
+
+
+/* Local prototypes */
+
+static void
+MtCheckNamedObjectInMethod (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MtMethodAnalysisWalkBegin
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending callback for the analysis walk. Check methods for:
+ *              1) Initialized local variables
+ *              2) Valid arguments
+ *              3) Return types
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+MtMethodAnalysisWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ASL_ANALYSIS_WALK_INFO  *WalkInfo = (ASL_ANALYSIS_WALK_INFO *) Context;
+    ASL_METHOD_INFO         *MethodInfo = WalkInfo->MethodStack;
+    ACPI_PARSE_OBJECT       *Next;
+    UINT32                  RegisterNumber;
+    UINT32                  i;
+    char                    LocalName[] = "Local0";
+    char                    ArgName[] = "Arg0";
+    ACPI_PARSE_OBJECT       *ArgNode;
+    ACPI_PARSE_OBJECT       *NextType;
+    ACPI_PARSE_OBJECT       *NextParamType;
+    UINT8                   ActualArgs = 0;
+
+
+    /* Build cross-reference output file if requested */
+
+    if (Gbl_CrossReferenceOutput)
+    {
+        OtXrefWalkPart1 (Op, Level, MethodInfo);
+    }
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_METHOD:
+
+        TotalMethods++;
+
+        /* Create and init method info */
+
+        MethodInfo = UtLocalCalloc (sizeof (ASL_METHOD_INFO));
+        MethodInfo->Next = WalkInfo->MethodStack;
+        MethodInfo->Op = Op;
+
+        WalkInfo->MethodStack = MethodInfo;
+
+        /*
+         * Special handling for _PSx methods. Dependency rules (same scope):
+         *
+         * 1) _PS0 - One of these must exist: _PS1, _PS2, _PS3
+         * 2) _PS1/_PS2/_PS3: A _PS0 must exist
+         */
+        if (ACPI_COMPARE_NAME (METHOD_NAME__PS0, Op->Asl.NameSeg))
+        {
+            /* For _PS0, one of _PS1/_PS2/_PS3 must exist */
+
+            if ((!ApFindNameInScope (METHOD_NAME__PS1, Op)) &&
+                (!ApFindNameInScope (METHOD_NAME__PS2, Op)) &&
+                (!ApFindNameInScope (METHOD_NAME__PS3, Op)))
+            {
+                AslError (ASL_WARNING, ASL_MSG_MISSING_DEPENDENCY, Op,
+                    "_PS0 requires one of _PS1/_PS2/_PS3 in same scope");
+            }
+        }
+        else if (
+            ACPI_COMPARE_NAME (METHOD_NAME__PS1, Op->Asl.NameSeg) ||
+            ACPI_COMPARE_NAME (METHOD_NAME__PS2, Op->Asl.NameSeg) ||
+            ACPI_COMPARE_NAME (METHOD_NAME__PS3, Op->Asl.NameSeg))
+        {
+            /* For _PS1/_PS2/_PS3, a _PS0 must exist */
+
+            if (!ApFindNameInScope (METHOD_NAME__PS0, Op))
+            {
+                sprintf (MsgBuffer,
+                    "%4.4s requires _PS0 in same scope", Op->Asl.NameSeg);
+
+                AslError (ASL_WARNING, ASL_MSG_MISSING_DEPENDENCY, Op,
+                    MsgBuffer);
+            }
+        }
+
+        /* Get the name node */
+
+        Next = Op->Asl.Child;
+
+        /* Get the NumArguments node */
+
+        Next = Next->Asl.Next;
+        MethodInfo->NumArguments = (UINT8)
+            (((UINT8) Next->Asl.Value.Integer) & 0x07);
+
+        /* Get the SerializeRule and SyncLevel nodes, ignored here */
+
+        Next = Next->Asl.Next;
+        MethodInfo->ShouldBeSerialized = (UINT8) Next->Asl.Value.Integer;
+
+        Next = Next->Asl.Next;
+        ArgNode = Next;
+
+        /* Get the ReturnType node */
+
+        Next = Next->Asl.Next;
+
+        NextType = Next->Asl.Child;
+        while (NextType)
+        {
+            /* Get and map each of the ReturnTypes */
+
+            MethodInfo->ValidReturnTypes |= AnMapObjTypeToBtype (NextType);
+            NextType->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+            NextType = NextType->Asl.Next;
+        }
+
+        /* Get the ParameterType node */
+
+        Next = Next->Asl.Next;
+
+        NextType = Next->Asl.Child;
+        while (NextType)
+        {
+            if (NextType->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+            {
+                NextParamType = NextType->Asl.Child;
+                while (NextParamType)
+                {
+                    MethodInfo->ValidArgTypes[ActualArgs] |=
+                        AnMapObjTypeToBtype (NextParamType);
+
+                    NextParamType->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+                    NextParamType = NextParamType->Asl.Next;
+                }
+            }
+            else
+            {
+                MethodInfo->ValidArgTypes[ActualArgs] =
+                    AnMapObjTypeToBtype (NextType);
+
+                NextType->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+                ActualArgs++;
+            }
+
+            NextType = NextType->Asl.Next;
+        }
+
+        if ((MethodInfo->NumArguments) &&
+            (MethodInfo->NumArguments != ActualArgs))
+        {
+            /* error: Param list did not match number of args */
+        }
+
+        /* Allow numarguments == 0 for Function() */
+
+        if ((!MethodInfo->NumArguments) && (ActualArgs))
+        {
+            MethodInfo->NumArguments = ActualArgs;
+            ArgNode->Asl.Value.Integer |= ActualArgs;
+        }
+
+        /*
+         * Actual arguments are initialized at method entry.
+         * All other ArgX "registers" can be used as locals, so we
+         * track their initialization.
+         */
+        for (i = 0; i < MethodInfo->NumArguments; i++)
+        {
+            MethodInfo->ArgInitialized[i] = TRUE;
+        }
+        break;
+
+    case PARSEOP_METHODCALL:
+
+        if (MethodInfo &&
+           (Op->Asl.Node == MethodInfo->Op->Asl.Node))
+        {
+            AslError (ASL_REMARK, ASL_MSG_RECURSION, Op, Op->Asl.ExternalName);
+        }
+        break;
+
+    case PARSEOP_LOCAL0:
+    case PARSEOP_LOCAL1:
+    case PARSEOP_LOCAL2:
+    case PARSEOP_LOCAL3:
+    case PARSEOP_LOCAL4:
+    case PARSEOP_LOCAL5:
+    case PARSEOP_LOCAL6:
+    case PARSEOP_LOCAL7:
+
+        if (!MethodInfo)
+        {
+            /*
+             * Local was used outside a control method, or there was an error
+             * in the method declaration.
+             */
+            AslError (ASL_REMARK, ASL_MSG_LOCAL_OUTSIDE_METHOD,
+                Op, Op->Asl.ExternalName);
+            return (AE_ERROR);
+        }
+
+        RegisterNumber = (Op->Asl.AmlOpcode & 0x0007);
+
+        /*
+         * If the local is being used as a target, mark the local
+         * initialized
+         */
+        if (Op->Asl.CompileFlags & NODE_IS_TARGET)
+        {
+            MethodInfo->LocalInitialized[RegisterNumber] = TRUE;
+        }
+
+        /*
+         * Otherwise, this is a reference, check if the local
+         * has been previously initialized.
+         *
+         * The only operator that accepts an uninitialized value is ObjectType()
+         */
+        else if ((!MethodInfo->LocalInitialized[RegisterNumber]) &&
+                 (Op->Asl.Parent->Asl.ParseOpcode != PARSEOP_OBJECTTYPE))
+        {
+            LocalName[strlen (LocalName) -1] = (char) (RegisterNumber + 0x30);
+            AslError (ASL_ERROR, ASL_MSG_LOCAL_INIT, Op, LocalName);
+        }
+        break;
+
+    case PARSEOP_ARG0:
+    case PARSEOP_ARG1:
+    case PARSEOP_ARG2:
+    case PARSEOP_ARG3:
+    case PARSEOP_ARG4:
+    case PARSEOP_ARG5:
+    case PARSEOP_ARG6:
+
+        if (!MethodInfo)
+        {
+            /*
+             * Arg was used outside a control method, or there was an error
+             * in the method declaration.
+             */
+            AslError (ASL_REMARK, ASL_MSG_LOCAL_OUTSIDE_METHOD,
+                Op, Op->Asl.ExternalName);
+            return (AE_ERROR);
+        }
+
+        RegisterNumber = (Op->Asl.AmlOpcode & 0x000F) - 8;
+        ArgName[strlen (ArgName) -1] = (char) (RegisterNumber + 0x30);
+
+        /*
+         * If the Arg is being used as a target, mark the local
+         * initialized
+         */
+        if (Op->Asl.CompileFlags & NODE_IS_TARGET)
+        {
+            MethodInfo->ArgInitialized[RegisterNumber] = TRUE;
+        }
+
+        /*
+         * Otherwise, this is a reference, check if the Arg
+         * has been previously initialized.
+         *
+         * The only operator that accepts an uninitialized value is ObjectType()
+         */
+        else if ((!MethodInfo->ArgInitialized[RegisterNumber]) &&
+            (Op->Asl.Parent->Asl.ParseOpcode != PARSEOP_OBJECTTYPE))
+        {
+            AslError (ASL_ERROR, ASL_MSG_ARG_INIT, Op, ArgName);
+        }
+
+        /* Flag this arg if it is not a "real" argument to the method */
+
+        if (RegisterNumber >= MethodInfo->NumArguments)
+        {
+            AslError (ASL_REMARK, ASL_MSG_NOT_PARAMETER, Op, ArgName);
+        }
+        break;
+
+    case PARSEOP_RETURN:
+
+        if (!MethodInfo)
+        {
+            /*
+             * Probably was an error in the method declaration,
+             * no additional error here
+             */
+            ACPI_WARNING ((AE_INFO, "%p, No parent method", Op));
+            return (AE_ERROR);
+        }
+
+        /*
+         * A child indicates a possible return value. A simple Return or
+         * Return() is marked with NODE_IS_NULL_RETURN by the parser so
+         * that it is not counted as a "real" return-with-value, although
+         * the AML code that is actually emitted is Return(0). The AML
+         * definition of Return has a required parameter, so we are
+         * forced to convert a null return to Return(0).
+         */
+        if ((Op->Asl.Child) &&
+            (Op->Asl.Child->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+            (!(Op->Asl.Child->Asl.CompileFlags & NODE_IS_NULL_RETURN)))
+        {
+            MethodInfo->NumReturnWithValue++;
+        }
+        else
+        {
+            MethodInfo->NumReturnNoValue++;
+        }
+        break;
+
+    case PARSEOP_BREAK:
+    case PARSEOP_CONTINUE:
+
+        Next = Op->Asl.Parent;
+        while (Next)
+        {
+            if (Next->Asl.ParseOpcode == PARSEOP_WHILE)
+            {
+                break;
+            }
+            Next = Next->Asl.Parent;
+        }
+
+        if (!Next)
+        {
+            AslError (ASL_ERROR, ASL_MSG_NO_WHILE, Op, NULL);
+        }
+        break;
+
+    case PARSEOP_STALL:
+
+        /* We can range check if the argument is an integer */
+
+        if ((Op->Asl.Child->Asl.ParseOpcode == PARSEOP_INTEGER) &&
+            (Op->Asl.Child->Asl.Value.Integer > ACPI_UINT8_MAX))
+        {
+            AslError (ASL_ERROR, ASL_MSG_INVALID_TIME, Op, NULL);
+        }
+        break;
+
+    case PARSEOP_DEVICE:
+
+        if (!ApFindNameInDeviceTree (METHOD_NAME__HID, Op) &&
+            !ApFindNameInDeviceTree (METHOD_NAME__ADR, Op))
+        {
+            AslError (ASL_WARNING, ASL_MSG_MISSING_DEPENDENCY, Op,
+                "Device object requires a _HID or _ADR in same scope");
+        }
+        break;
+
+    case PARSEOP_EVENT:
+    case PARSEOP_MUTEX:
+    case PARSEOP_OPERATIONREGION:
+    case PARSEOP_POWERRESOURCE:
+    case PARSEOP_PROCESSOR:
+    case PARSEOP_THERMALZONE:
+
+        /*
+         * The first operand is a name to be created in the namespace.
+         * Check against the reserved list.
+         */
+        i = ApCheckForPredefinedName (Op, Op->Asl.NameSeg);
+        if (i < ACPI_VALID_RESERVED_NAME_MAX)
+        {
+            AslError (ASL_ERROR, ASL_MSG_RESERVED_USE,
+                Op, Op->Asl.ExternalName);
+        }
+        break;
+
+    case PARSEOP_NAME:
+
+        /* Typecheck any predefined names statically defined with Name() */
+
+        ApCheckForPredefinedObject (Op, Op->Asl.NameSeg);
+
+        /* Special typechecking for _HID */
+
+        if (!strcmp (METHOD_NAME__HID, Op->Asl.NameSeg))
+        {
+            Next = Op->Asl.Child->Asl.Next;
+            AnCheckId (Next, ASL_TYPE_HID);
+        }
+
+        /* Special typechecking for _CID */
+
+        else if (!strcmp (METHOD_NAME__CID, Op->Asl.NameSeg))
+        {
+            Next = Op->Asl.Child->Asl.Next;
+
+            if ((Next->Asl.ParseOpcode == PARSEOP_PACKAGE) ||
+                (Next->Asl.ParseOpcode == PARSEOP_VAR_PACKAGE))
+            {
+                Next = Next->Asl.Child;
+                while (Next)
+                {
+                    AnCheckId (Next, ASL_TYPE_CID);
+                    Next = Next->Asl.Next;
+                }
+            }
+            else
+            {
+                AnCheckId (Next, ASL_TYPE_CID);
+            }
+        }
+
+        break;
+
+    default:
+
+        break;
+    }
+
+    /* Check for named object creation within a non-serialized method */
+
+    MtCheckNamedObjectInMethod (Op, MethodInfo);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MtCheckNamedObjectInMethod
+ *
+ * PARAMETERS:  Op                  - Current parser op
+ *              MethodInfo          - Info for method being parsed
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Detect if a non-serialized method is creating a named object,
+ *              which could possibly cause problems if two threads execute
+ *              the method concurrently. Emit a remark in this case.
+ *
+ ******************************************************************************/
+
+static void
+MtCheckNamedObjectInMethod (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo)
+{
+    const ACPI_OPCODE_INFO  *OpInfo;
+
+
+    /* We don't care about actual method declarations or scopes */
+
+    if ((Op->Asl.AmlOpcode == AML_METHOD_OP) ||
+        (Op->Asl.AmlOpcode == AML_SCOPE_OP))
+    {
+        return;
+    }
+
+    /* Determine if we are creating a named object */
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+    if (OpInfo->Class == AML_CLASS_NAMED_OBJECT)
+    {
+        /*
+         * If we have a named object created within a non-serialized method,
+         * emit a remark that the method should be serialized.
+         *
+         * Reason: If a thread blocks within the method for any reason, and
+         * another thread enters the method, the method will fail because an
+         * attempt will be made to create the same object twice.
+         */
+        if (MethodInfo && !MethodInfo->ShouldBeSerialized)
+        {
+            AslError (ASL_REMARK, ASL_MSG_SERIALIZED_REQUIRED, MethodInfo->Op,
+                "due to creation of named objects within");
+
+            /* Emit message only ONCE per method */
+
+            MethodInfo->ShouldBeSerialized = TRUE;
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    MtMethodAnalysisWalkEnd
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Ascending callback for analysis walk. Complete method
+ *              return analysis.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+MtMethodAnalysisWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ASL_ANALYSIS_WALK_INFO  *WalkInfo = (ASL_ANALYSIS_WALK_INFO *) Context;
+    ASL_METHOD_INFO         *MethodInfo = WalkInfo->MethodStack;
+
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_METHOD:
+    case PARSEOP_RETURN:
+
+        if (!MethodInfo)
+        {
+            printf ("No method info for method! [%s]\n", Op->Asl.Namepath);
+            AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL, Op,
+                "No method info for this method");
+
+            CmCleanupAndExit ();
+            return (AE_AML_INTERNAL);
+        }
+        break;
+
+    default:
+
+        break;
+    }
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_METHOD:
+
+        WalkInfo->MethodStack = MethodInfo->Next;
+
+        /*
+         * Check if there is no return statement at the end of the
+         * method AND we can actually get there -- i.e., the execution
+         * of the method can possibly terminate without a return statement.
+         */
+        if ((!AnLastStatementIsReturn (Op)) &&
+            (!(Op->Asl.CompileFlags & NODE_HAS_NO_EXIT)))
+        {
+            /*
+             * No return statement, and execution can possibly exit
+             * via this path. This is equivalent to Return ()
+             */
+            MethodInfo->NumReturnNoValue++;
+        }
+
+        /*
+         * Check for case where some return statements have a return value
+         * and some do not. Exit without a return statement is a return with
+         * no value
+         */
+        if (MethodInfo->NumReturnNoValue &&
+            MethodInfo->NumReturnWithValue)
+        {
+            AslError (ASL_WARNING, ASL_MSG_RETURN_TYPES, Op,
+                Op->Asl.ExternalName);
+        }
+
+        /*
+         * If there are any RETURN() statements with no value, or there is a
+         * control path that allows the method to exit without a return value,
+         * we mark the method as a method that does not return a value. This
+         * knowledge can be used to check method invocations that expect a
+         * returned value.
+         */
+        if (MethodInfo->NumReturnNoValue)
+        {
+            if (MethodInfo->NumReturnWithValue)
+            {
+                Op->Asl.CompileFlags |= NODE_METHOD_SOME_NO_RETVAL;
+            }
+            else
+            {
+                Op->Asl.CompileFlags |= NODE_METHOD_NO_RETVAL;
+            }
+        }
+
+        /*
+         * Check predefined method names for correct return behavior
+         * and correct number of arguments. Also, some special checks
+         * For GPE and _REG methods.
+         */
+        if (ApCheckForPredefinedMethod (Op, MethodInfo))
+        {
+            /* Special check for two names like _L01 and _E01 in same scope */
+
+            ApCheckForGpeNameConflict (Op);
+
+            /*
+             * Special check for _REG: Must have an operation region definition
+             * within the same scope!
+             */
+            ApCheckRegMethod (Op);
+        }
+
+        ACPI_FREE (MethodInfo);
+        break;
+
+    case PARSEOP_NAME:
+
+         /* Special check for two names like _L01 and _E01 in same scope */
+
+        ApCheckForGpeNameConflict (Op);
+        break;
+
+    case PARSEOP_RETURN:
+
+        /*
+         * If the parent is a predefined method name, attempt to typecheck
+         * the return value. Only static types can be validated.
+         */
+        ApCheckPredefinedReturnValue (Op, MethodInfo);
+
+        /*
+         * The parent block does not "exit" and continue execution -- the
+         * method is terminated here with the Return() statement.
+         */
+        Op->Asl.Parent->Asl.CompileFlags |= NODE_HAS_NO_EXIT;
+
+        /* Used in the "typing" pass later */
+
+        Op->Asl.ParentMethod = MethodInfo->Op;
+
+        /*
+         * If there is a peer node after the return statement, then this
+         * node is unreachable code -- i.e., it won't be executed because of
+         * the preceding Return() statement.
+         */
+        if (Op->Asl.Next)
+        {
+            AslError (ASL_WARNING, ASL_MSG_UNREACHABLE_CODE,
+                Op->Asl.Next, NULL);
+        }
+        break;
+
+    case PARSEOP_IF:
+
+        if ((Op->Asl.CompileFlags & NODE_HAS_NO_EXIT) &&
+            (Op->Asl.Next) &&
+            (Op->Asl.Next->Asl.ParseOpcode == PARSEOP_ELSE))
+        {
+            /*
+             * This IF has a corresponding ELSE. The IF block has no exit,
+             * (it contains an unconditional Return)
+             * mark the ELSE block to remember this fact.
+             */
+            Op->Asl.Next->Asl.CompileFlags |= NODE_IF_HAS_NO_EXIT;
+        }
+        break;
+
+    case PARSEOP_ELSE:
+
+        if ((Op->Asl.CompileFlags & NODE_HAS_NO_EXIT) &&
+            (Op->Asl.CompileFlags & NODE_IF_HAS_NO_EXIT))
+        {
+            /*
+             * This ELSE block has no exit and the corresponding IF block
+             * has no exit either. Therefore, the parent node has no exit.
+             */
+            Op->Asl.Parent->Asl.CompileFlags |= NODE_HAS_NO_EXIT;
+        }
+        break;
+
+
+    default:
+
+        if ((Op->Asl.CompileFlags & NODE_HAS_NO_EXIT) &&
+            (Op->Asl.Parent))
+        {
+            /* If this node has no exit, then the parent has no exit either */
+
+            Op->Asl.Parent->Asl.CompileFlags |= NODE_HAS_NO_EXIT;
+        }
+        break;
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslnamesp.c b/usr/src/cmd/acpi/iasl/aslnamesp.c
new file mode 100644
index 0000000000..9a2bc14974
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslnamesp.c
@@ -0,0 +1,429 @@
+/******************************************************************************
+ *
+ * Module Name: aslnamesp - Namespace output file generation
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acnamesp.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslnamesp")
+
+/* Local prototypes */
+
+static ACPI_STATUS
+NsDoOneNamespaceObject (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue);
+
+static ACPI_STATUS
+NsDoOnePathname (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    NsSetupNamespaceListing
+ *
+ * PARAMETERS:  Handle          - local file handle
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Set the namespace output file to the input handle
+ *
+ ******************************************************************************/
+
+void
+NsSetupNamespaceListing (
+    void                    *Handle)
+{
+
+    Gbl_NsOutputFlag = TRUE;
+    Gbl_Files[ASL_FILE_NAMESPACE_OUTPUT].Handle = Handle;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    NsDisplayNamespace
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Walk the namespace an display information about each node
+ *              in the tree. Information is written to the optional
+ *              namespace output file.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+NsDisplayNamespace (
+    void)
+{
+    ACPI_STATUS             Status;
+
+
+    if (!Gbl_NsOutputFlag)
+    {
+        return (AE_OK);
+    }
+
+    Gbl_NumNamespaceObjects = 0;
+
+    /* File header */
+
+    FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "Contents of ACPI Namespace\n\n");
+    FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "Count  Depth    Name - Type\n\n");
+
+    /* Walk entire namespace from the root */
+
+    Status = AcpiNsWalkNamespace (ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
+        ACPI_UINT32_MAX, FALSE, NsDoOneNamespaceObject, NULL,
+        NULL, NULL);
+
+    /* Print the full pathname for each namespace node */
+
+    FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "\nNamespace pathnames\n\n");
+
+    Status = AcpiNsWalkNamespace (ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
+        ACPI_UINT32_MAX, FALSE, NsDoOnePathname, NULL,
+        NULL, NULL);
+
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    NsDoOneNamespaceObject
+ *
+ * PARAMETERS:  ACPI_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Dump a namespace object to the namespace output file.
+ *              Called during the walk of the namespace to dump all objects.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+NsDoOneNamespaceObject (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue)
+{
+    ACPI_NAMESPACE_NODE     *Node = (ACPI_NAMESPACE_NODE *) ObjHandle;
+    ACPI_OPERAND_OBJECT     *ObjDesc;
+    ACPI_PARSE_OBJECT       *Op;
+
+
+    Gbl_NumNamespaceObjects++;
+
+    FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "%5u  [%u]  %*s %4.4s - %s",
+        Gbl_NumNamespaceObjects, Level, (Level * 3), " ",
+        &Node->Name, AcpiUtGetTypeName (Node->Type));
+
+    Op = Node->Op;
+    ObjDesc = ACPI_CAST_PTR (ACPI_OPERAND_OBJECT, Node->Object);
+
+    if (!Op)
+    {
+        FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "\n");
+        return (AE_OK);
+    }
+
+
+    if ((ObjDesc) &&
+        (ACPI_GET_DESCRIPTOR_TYPE (ObjDesc) == ACPI_DESC_TYPE_OPERAND))
+    {
+        switch (Node->Type)
+        {
+        case ACPI_TYPE_INTEGER:
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "       [Initial Value   0x%8.8X%8.8X]",
+                ACPI_FORMAT_UINT64 (ObjDesc->Integer.Value));
+            break;
+
+        case ACPI_TYPE_STRING:
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "        [Initial Value   \"%s\"]",
+                ObjDesc->String.Pointer);
+            break;
+
+        default:
+
+            /* Nothing to do for other types */
+
+            break;
+        }
+
+    }
+    else
+    {
+        switch (Node->Type)
+        {
+        case ACPI_TYPE_INTEGER:
+
+            if (Op->Asl.ParseOpcode == PARSEOP_NAME)
+            {
+                Op = Op->Asl.Child;
+            }
+
+            if ((Op->Asl.ParseOpcode == PARSEOP_NAMESEG)  ||
+                (Op->Asl.ParseOpcode == PARSEOP_NAMESTRING))
+            {
+                Op = Op->Asl.Next;
+            }
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "       [Initial Value   0x%8.8X%8.8X]",
+                ACPI_FORMAT_UINT64 (Op->Asl.Value.Integer));
+            break;
+
+        case ACPI_TYPE_STRING:
+
+            if (Op->Asl.ParseOpcode == PARSEOP_NAME)
+            {
+                Op = Op->Asl.Child;
+            }
+
+            if ((Op->Asl.ParseOpcode == PARSEOP_NAMESEG)  ||
+                (Op->Asl.ParseOpcode == PARSEOP_NAMESTRING))
+            {
+                Op = Op->Asl.Next;
+            }
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "        [Initial Value   \"%s\"]",
+                Op->Asl.Value.String);
+            break;
+
+        case ACPI_TYPE_LOCAL_REGION_FIELD:
+
+            if ((Op->Asl.ParseOpcode == PARSEOP_NAMESEG)  ||
+                (Op->Asl.ParseOpcode == PARSEOP_NAMESTRING))
+            {
+                Op = Op->Asl.Child;
+            }
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "   [Offset 0x%04X   Length 0x%04X bits]",
+                Op->Asl.Parent->Asl.ExtraValue, (UINT32) Op->Asl.Value.Integer);
+            break;
+
+        case ACPI_TYPE_BUFFER_FIELD:
+
+            switch (Op->Asl.ParseOpcode)
+            {
+            case PARSEOP_CREATEBYTEFIELD:
+
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "   [BYTE  ( 8 bit)]");
+                break;
+
+            case PARSEOP_CREATEDWORDFIELD:
+
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "   [DWORD (32 bit)]");
+                break;
+
+            case PARSEOP_CREATEQWORDFIELD:
+
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "   [QWORD (64 bit)]");
+                break;
+
+            case PARSEOP_CREATEWORDFIELD:
+
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "   [WORD  (16 bit)]");
+                break;
+
+            case PARSEOP_CREATEBITFIELD:
+
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "   [BIT   ( 1 bit)]");
+                break;
+
+            case PARSEOP_CREATEFIELD:
+
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "   [Arbitrary Bit Field]");
+                break;
+
+            default:
+
+                break;
+
+            }
+            break;
+
+        case ACPI_TYPE_PACKAGE:
+
+            if (Op->Asl.ParseOpcode == PARSEOP_NAME)
+            {
+                Op = Op->Asl.Child;
+            }
+
+            if ((Op->Asl.ParseOpcode == PARSEOP_NAMESEG)  ||
+                (Op->Asl.ParseOpcode == PARSEOP_NAMESTRING))
+            {
+                Op = Op->Asl.Next;
+            }
+
+            Op = Op->Asl.Child;
+
+            if ((Op->Asl.ParseOpcode == PARSEOP_BYTECONST) ||
+                (Op->Asl.ParseOpcode == PARSEOP_RAW_DATA))
+            {
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                    "       [Initial Length  0x%.2X elements]",
+                    Op->Asl.Value.Integer);
+            }
+            break;
+
+        case ACPI_TYPE_BUFFER:
+
+            if (Op->Asl.ParseOpcode == PARSEOP_NAME)
+            {
+                Op = Op->Asl.Child;
+            }
+
+            if ((Op->Asl.ParseOpcode == PARSEOP_NAMESEG)  ||
+                (Op->Asl.ParseOpcode == PARSEOP_NAMESTRING))
+            {
+                Op = Op->Asl.Next;
+            }
+
+            Op = Op->Asl.Child;
+
+            if (Op && (Op->Asl.ParseOpcode == PARSEOP_INTEGER))
+            {
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                    "        [Initial Length  0x%.2X bytes]",
+                    Op->Asl.Value.Integer);
+            }
+            break;
+
+        case ACPI_TYPE_METHOD:
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "        [Code Length     0x%.4X bytes]",
+                Op->Asl.AmlSubtreeLength);
+            break;
+
+        case ACPI_TYPE_LOCAL_RESOURCE:
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "  [Desc Offset     0x%.4X Bytes]", Node->Value);
+            break;
+
+        case ACPI_TYPE_LOCAL_RESOURCE_FIELD:
+
+            FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                "   [Field Offset    0x%.4X Bits 0x%.4X Bytes] ",
+                Node->Value, Node->Value / 8);
+
+            if (Node->Flags & ANOBJ_IS_REFERENCED)
+            {
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                    "Referenced");
+            }
+            else
+            {
+                FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT,
+                    "Name not referenced");
+            }
+            break;
+
+        default:
+
+            /* Nothing to do for other types */
+
+            break;
+        }
+    }
+
+    FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "\n");
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    NsDoOnePathname
+ *
+ * PARAMETERS:  ACPI_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Print the full pathname for a namespace node.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+NsDoOnePathname (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue)
+{
+    ACPI_NAMESPACE_NODE     *Node = (ACPI_NAMESPACE_NODE *) ObjHandle;
+    ACPI_STATUS             Status;
+    ACPI_BUFFER             TargetPath;
+
+
+    TargetPath.Length = ACPI_ALLOCATE_LOCAL_BUFFER;
+    Status = AcpiNsHandleToPathname (Node, &TargetPath, FALSE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    FlPrintFile (ASL_FILE_NAMESPACE_OUTPUT, "%s\n", TargetPath.Pointer);
+    ACPI_FREE (TargetPath.Pointer);
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/asloffset.c b/usr/src/cmd/acpi/iasl/asloffset.c
new file mode 100644
index 0000000000..0e55c6b856
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asloffset.c
@@ -0,0 +1,472 @@
+/******************************************************************************
+ *
+ * Module Name: asloffset - Generate a C "offset table" for BIOS use.
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+#include "acnamesp.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asloffset")
+
+
+/* Local prototypes */
+
+static void
+LsEmitOffsetTableEntry (
+    UINT32                  FileId,
+    ACPI_NAMESPACE_NODE     *Node,
+    UINT32                  NamepathOffset,
+    UINT32                  Offset,
+    char                    *OpName,
+    UINT64                  Value,
+    UINT8                   AmlOpcode,
+    UINT16                  ParentOpcode);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsAmlOffsetWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Process one node during a offset table file generation.
+ *
+ * Three types of objects are currently emitted to the offset table:
+ *   1) Tagged (named) resource descriptors
+ *   2) Named integer objects with constant integer values
+ *   3) Named package objects
+ *   4) Operation Regions that have constant Offset (address) parameters
+ *   5) Control methods
+ *
+ * The offset table allows the BIOS to dynamically update the values of these
+ * objects at boot time.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+LsAmlOffsetWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    UINT32                  FileId = (UINT32) ACPI_TO_INTEGER (Context);
+    ACPI_NAMESPACE_NODE     *Node;
+    UINT32                  Length;
+    UINT32                  NamepathOffset;
+    UINT32                  DataOffset;
+    ACPI_PARSE_OBJECT       *NextOp;
+
+
+    /* Ignore actual data blocks for resource descriptors */
+
+    if (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DATA)
+    {
+        return (AE_OK); /* Do NOT update the global AML offset */
+    }
+
+    /* We are only interested in named objects (have a namespace node) */
+
+    Node = Op->Asl.Node;
+    if (!Node)
+    {
+        Gbl_CurrentAmlOffset += Op->Asl.FinalAmlLength;
+        return (AE_OK);
+    }
+
+    /* Named resource descriptor (has a descriptor tag) */
+
+    if ((Node->Type == ACPI_TYPE_LOCAL_RESOURCE) &&
+        (Op->Asl.CompileFlags & NODE_IS_RESOURCE_DESC))
+    {
+        LsEmitOffsetTableEntry (FileId, Node, 0, Gbl_CurrentAmlOffset,
+            Op->Asl.ParseOpName, 0, Op->Asl.Extra, AML_BUFFER_OP);
+
+        Gbl_CurrentAmlOffset += Op->Asl.FinalAmlLength;
+        return (AE_OK);
+    }
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_NAME_OP:
+
+        /* Named object -- Name (NameString, DataRefObject) */
+
+        if (!Op->Asl.Child)
+        {
+            FlPrintFile (FileId, "%s NO CHILD!\n", MsgBuffer);
+            return (AE_OK);
+        }
+
+        Length = Op->Asl.FinalAmlLength;
+        NamepathOffset = Gbl_CurrentAmlOffset + Length;
+
+        /* Get to the NameSeg/NamePath Op (and length of the name) */
+
+        Op = Op->Asl.Child;
+
+        /* Get offset of last nameseg and the actual data */
+
+        NamepathOffset = Gbl_CurrentAmlOffset + Length +
+            (Op->Asl.FinalAmlLength - ACPI_NAME_SIZE);
+
+        DataOffset = Gbl_CurrentAmlOffset + Length +
+            Op->Asl.FinalAmlLength;
+
+        /* Get actual value associated with the name */
+
+        Op = Op->Asl.Next;
+        switch (Op->Asl.AmlOpcode)
+        {
+        case AML_BYTE_OP:
+        case AML_WORD_OP:
+        case AML_DWORD_OP:
+        case AML_QWORD_OP:
+
+            /* The +1 is to handle the integer size prefix (opcode) */
+
+            LsEmitOffsetTableEntry (FileId, Node, NamepathOffset, (DataOffset + 1),
+                Op->Asl.ParseOpName, Op->Asl.Value.Integer,
+                (UINT8) Op->Asl.AmlOpcode, AML_NAME_OP);
+            break;
+
+        case AML_ONE_OP:
+        case AML_ONES_OP:
+        case AML_ZERO_OP:
+
+            /* For these, offset will point to the opcode */
+
+            LsEmitOffsetTableEntry (FileId, Node, NamepathOffset, DataOffset,
+                Op->Asl.ParseOpName, Op->Asl.Value.Integer,
+                (UINT8) Op->Asl.AmlOpcode, AML_NAME_OP);
+            break;
+
+        case AML_PACKAGE_OP:
+        case AML_VAR_PACKAGE_OP:
+
+            /* Get the package element count */
+
+            NextOp = Op->Asl.Child;
+
+            LsEmitOffsetTableEntry (FileId, Node, NamepathOffset, DataOffset,
+                Op->Asl.ParseOpName, NextOp->Asl.Value.Integer,
+                (UINT8) Op->Asl.AmlOpcode, AML_NAME_OP);
+            break;
+
+         default:
+             break;
+        }
+
+        Gbl_CurrentAmlOffset += Length;
+        return (AE_OK);
+
+    case AML_REGION_OP:
+
+        /* OperationRegion (NameString, RegionSpace, RegionOffset, RegionLength) */
+
+        Length = Op->Asl.FinalAmlLength;
+
+        /* Get the name/namepath node */
+
+        NextOp = Op->Asl.Child;
+
+        /* Get offset of last nameseg and the actual data */
+
+        NamepathOffset = Gbl_CurrentAmlOffset + Length +
+            (NextOp->Asl.FinalAmlLength - ACPI_NAME_SIZE);
+
+        DataOffset = Gbl_CurrentAmlOffset + Length +
+            (NextOp->Asl.FinalAmlLength + 1);
+
+        /* Get the SpaceId node, then the Offset (address) node */
+
+        NextOp = NextOp->Asl.Next;
+        NextOp = NextOp->Asl.Next;
+
+        switch (NextOp->Asl.AmlOpcode)
+        {
+        /*
+         * We are only interested in integer constants that can be changed
+         * at boot time. Note, the One/Ones/Zero opcodes are considered
+         * non-changeable, so we ignore them here.
+         */
+        case AML_BYTE_OP:
+        case AML_WORD_OP:
+        case AML_DWORD_OP:
+        case AML_QWORD_OP:
+
+            LsEmitOffsetTableEntry (FileId, Node, NamepathOffset, (DataOffset + 1),
+                Op->Asl.ParseOpName, NextOp->Asl.Value.Integer,
+                (UINT8) NextOp->Asl.AmlOpcode, AML_REGION_OP);
+
+            Gbl_CurrentAmlOffset += Length;
+            return (AE_OK);
+
+        default:
+            break;
+        }
+        break;
+
+    case AML_METHOD_OP:
+
+        /* Method (Namepath, ...) */
+
+        Length = Op->Asl.FinalAmlLength;
+
+        /* Get the NameSeg/NamePath Op */
+
+        NextOp = Op->Asl.Child;
+
+        /* Get offset of last nameseg and the actual data (flags byte) */
+
+        NamepathOffset = Gbl_CurrentAmlOffset + Length +
+            (NextOp->Asl.FinalAmlLength - ACPI_NAME_SIZE);
+
+        DataOffset = Gbl_CurrentAmlOffset + Length +
+            NextOp->Asl.FinalAmlLength;
+
+        /* Get the flags byte Op */
+
+        NextOp = NextOp->Asl.Next;
+
+        LsEmitOffsetTableEntry (FileId, Node, NamepathOffset, DataOffset,
+            Op->Asl.ParseOpName, NextOp->Asl.Value.Integer,
+            (UINT8) Op->Asl.AmlOpcode, AML_METHOD_OP);
+        break;
+
+    case AML_PROCESSOR_OP:
+
+        /* Processor (Namepath, ProcessorId, Address, Length) */
+
+        Length = Op->Asl.FinalAmlLength;
+        NextOp = Op->Asl.Child;     /* Get Namepath */
+
+        /* Get offset of last nameseg and the actual data (PBlock address) */
+
+        NamepathOffset = Gbl_CurrentAmlOffset + Length +
+            (NextOp->Asl.FinalAmlLength - ACPI_NAME_SIZE);
+
+        DataOffset = Gbl_CurrentAmlOffset + Length +
+            (NextOp->Asl.FinalAmlLength + 1);
+
+        NextOp = NextOp->Asl.Next;  /* Get ProcessorID (BYTE) */
+        NextOp = NextOp->Asl.Next;  /* Get Address (DWORD) */
+
+        LsEmitOffsetTableEntry (FileId, Node, NamepathOffset, DataOffset,
+            Op->Asl.ParseOpName, NextOp->Asl.Value.Integer,
+            (UINT8) AML_DWORD_OP, AML_PROCESSOR_OP);
+        break;
+
+    case AML_DEVICE_OP:
+    case AML_SCOPE_OP:
+    case AML_THERMAL_ZONE_OP:
+
+        /* Device/Scope/ThermalZone (Namepath) */
+
+        Length = Op->Asl.FinalAmlLength;
+        NextOp = Op->Asl.Child;     /* Get Namepath */
+
+        /* Get offset of last nameseg */
+
+        NamepathOffset = Gbl_CurrentAmlOffset + Length +
+            (NextOp->Asl.FinalAmlLength - ACPI_NAME_SIZE);
+
+        LsEmitOffsetTableEntry (FileId, Node, NamepathOffset, 0,
+            Op->Asl.ParseOpName, 0, (UINT8) 0, Op->Asl.AmlOpcode);
+        break;
+
+    default:
+        break;
+    }
+
+    Gbl_CurrentAmlOffset += Op->Asl.FinalAmlLength;
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsEmitOffsetTableEntry
+ *
+ * PARAMETERS:  FileId          - ID of current listing file
+ *              Node            - Namespace node associated with the name
+ *              Offset          - Offset of the value within the AML table
+ *              OpName          - Name of the AML opcode
+ *              Value           - Current value of the AML field
+ *              AmlOpcode       - Opcode associated with the field
+ *              ObjectType      - ACPI object type
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emit a line of the offset table (-so option)
+ *
+ ******************************************************************************/
+
+static void
+LsEmitOffsetTableEntry (
+    UINT32                  FileId,
+    ACPI_NAMESPACE_NODE     *Node,
+    UINT32                  NamepathOffset,
+    UINT32                  Offset,
+    char                    *OpName,
+    UINT64                  Value,
+    UINT8                   AmlOpcode,
+    UINT16                  ParentOpcode)
+{
+    ACPI_BUFFER             TargetPath;
+    ACPI_STATUS             Status;
+
+
+    /* Get the full pathname to the namespace node */
+
+    TargetPath.Length = ACPI_ALLOCATE_LOCAL_BUFFER;
+    Status = AcpiNsHandleToPathname (Node, &TargetPath, FALSE);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /* [1] - Skip the opening backslash for the path */
+
+    strcpy (MsgBuffer, "\"");
+    strcat (MsgBuffer, &((char *) TargetPath.Pointer)[1]);
+    strcat (MsgBuffer, "\",");
+    ACPI_FREE (TargetPath.Pointer);
+
+    /*
+     * Max offset is 4G, constrained by 32-bit ACPI table length.
+     * Max Length for Integers is 8 bytes.
+     */
+    FlPrintFile (FileId,
+        "    {%-29s 0x%4.4X, 0x%8.8X, 0x%2.2X, 0x%8.8X, 0x%8.8X%8.8X}, /* %s */\n",
+        MsgBuffer, ParentOpcode, NamepathOffset, AmlOpcode,
+        Offset, ACPI_FORMAT_UINT64 (Value), OpName);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    LsDoOffsetTableHeader, LsDoOffsetTableFooter
+ *
+ * PARAMETERS:  FileId          - ID of current listing file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Header and footer for the offset table file.
+ *
+ ******************************************************************************/
+
+void
+LsDoOffsetTableHeader (
+    UINT32                  FileId)
+{
+
+    FlPrintFile (FileId,
+        "#ifndef __AML_OFFSET_TABLE_H\n"
+        "#define __AML_OFFSET_TABLE_H\n\n");
+
+    FlPrintFile (FileId, "typedef struct {\n"
+        "    char                   *Pathname;      /* Full pathname (from root) to the object */\n"
+        "    unsigned short         ParentOpcode;   /* AML opcode for the parent object */\n"
+        "    unsigned long          NamesegOffset;  /* Offset of last nameseg in the parent namepath */\n"
+        "    unsigned char          Opcode;         /* AML opcode for the data */\n"
+        "    unsigned long          Offset;         /* Offset for the data */\n"
+        "    unsigned long long     Value;          /* Original value of the data (as applicable) */\n"
+        "} AML_OFFSET_TABLE_ENTRY;\n\n");
+
+    FlPrintFile (FileId,
+        "#endif /* __AML_OFFSET_TABLE_H */\n\n");
+
+    FlPrintFile (FileId,
+        "/*\n"
+        " * Information specific to the supported object types:\n"
+        " *\n"
+        " * Integers:\n"
+        " *    Opcode is the integer prefix, indicates length of the data\n"
+        " *        (One of: BYTE, WORD, DWORD, QWORD, ZERO, ONE, ONES)\n"
+        " *    Offset points to the actual integer data\n"
+        " *    Value is the existing value in the AML\n"
+        " *\n"
+        " * Packages:\n"
+        " *    Opcode is the package or var_package opcode\n"
+        " *    Offset points to the package opcode\n"
+        " *    Value is the package element count\n"
+        " *\n"
+        " * Operation Regions:\n"
+        " *    Opcode is the address integer prefix, indicates length of the data\n"
+        " *    Offset points to the region address\n"
+        " *    Value is the existing address value in the AML\n"
+        " *\n"
+        " * Control Methods:\n"
+        " *    Offset points to the method flags byte\n"
+        " *    Value is the existing flags value in the AML\n"
+        " *\n"
+        " * Processors:\n"
+        " *    Offset points to the first byte of the PBlock Address\n"
+        " *\n"
+        " * Resource Descriptors:\n"
+        " *    Opcode is the descriptor type\n"
+        " *    Offset points to the start of the descriptor\n"
+        " *\n"
+        " * Scopes/Devices/ThermalZones:\n"
+        " *    Nameseg offset only\n"
+        " */\n");
+
+    FlPrintFile (FileId,
+        "AML_OFFSET_TABLE_ENTRY   %s_%s_OffsetTable[] =\n{\n",
+        Gbl_TableSignature, Gbl_TableId);
+}
+
+
+void
+LsDoOffsetTableFooter (
+    UINT32                  FileId)
+{
+
+    FlPrintFile (FileId,
+        "    {NULL,0,0,0,0,0} /* Table terminator */\n};\n\n");
+    Gbl_CurrentAmlOffset = 0;
+}
diff --git a/usr/src/cmd/acpi/iasl/aslopcodes.c b/usr/src/cmd/acpi/iasl/aslopcodes.c
new file mode 100644
index 0000000000..de9ffe1baf
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslopcodes.c
@@ -0,0 +1,843 @@
+/******************************************************************************
+ *
+ * Module Name: aslopcode - AML opcode generation
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslopcodes")
+
+
+/* Local prototypes */
+
+static void
+OpcDoAccessAs (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpcDoConnection (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpcDoUnicode (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpcDoEisaId (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpcDoUuId (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcAmlOpcodeUpdateWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Opcode update walk, ascending callback
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+OpcAmlOpcodeUpdateWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    /*
+     * Handle the Package() case where the actual opcode cannot be determined
+     * until the PackageLength operand has been folded and minimized.
+     * (PackageOp versus VarPackageOp)
+     *
+     * This is (as of ACPI 3.0) the only case where the AML opcode can change
+     * based upon the value of a parameter.
+     *
+     * The parser always inserts a VarPackage opcode, which can possibly be
+     * optimized to a Package opcode.
+     */
+    if (Op->Asl.ParseOpcode == PARSEOP_VAR_PACKAGE)
+    {
+        OpnDoPackage (Op);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcAmlOpcodeWalk
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Parse tree walk to generate both the AML opcodes and the AML
+ *              operands.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+OpcAmlOpcodeWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    TotalParseNodes++;
+
+    OpcGenerateAmlOpcode (Op);
+    OpnGenerateAmlOperands (Op);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcGetIntegerWidth
+ *
+ * PARAMETERS:  Op          - DEFINITION BLOCK op
+ *
+ * RETURN:      none
+ *
+ * DESCRIPTION: Extract integer width from the table revision
+ *
+ ******************************************************************************/
+
+void
+OpcGetIntegerWidth (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Child;
+
+
+    if (!Op)
+    {
+        return;
+    }
+
+    if (Gbl_RevisionOverride)
+    {
+        AcpiUtSetIntegerWidth (Gbl_RevisionOverride);
+    }
+    else
+    {
+        Child = Op->Asl.Child;
+        Child = Child->Asl.Next;
+        Child = Child->Asl.Next;
+
+        /* Use the revision to set the integer width */
+
+        AcpiUtSetIntegerWidth ((UINT8) Child->Asl.Value.Integer);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcSetOptimalIntegerSize
+ *
+ * PARAMETERS:  Op        - A parse tree node
+ *
+ * RETURN:      Integer width, in bytes. Also sets the node AML opcode to the
+ *              optimal integer AML prefix opcode.
+ *
+ * DESCRIPTION: Determine the optimal AML encoding of an integer. All leading
+ *              zeros can be truncated to squeeze the integer into the
+ *              minimal number of AML bytes.
+ *
+ ******************************************************************************/
+
+UINT32
+OpcSetOptimalIntegerSize (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+#if 0
+    /*
+     * TBD: - we don't want to optimize integers in the block header, but the
+     * code below does not work correctly.
+     */
+    if (Op->Asl.Parent &&
+        Op->Asl.Parent->Asl.Parent &&
+       (Op->Asl.Parent->Asl.Parent->Asl.ParseOpcode == PARSEOP_DEFINITION_BLOCK))
+    {
+        return (0);
+    }
+#endif
+
+    /*
+     * Check for the special AML integers first - Zero, One, Ones.
+     * These are single-byte opcodes that are the smallest possible
+     * representation of an integer.
+     *
+     * This optimization is optional.
+     */
+    if (Gbl_IntegerOptimizationFlag)
+    {
+        switch (Op->Asl.Value.Integer)
+        {
+        case 0:
+
+            Op->Asl.AmlOpcode = AML_ZERO_OP;
+            AslError (ASL_OPTIMIZATION, ASL_MSG_INTEGER_OPTIMIZATION,
+                Op, "Zero");
+            return (1);
+
+        case 1:
+
+            Op->Asl.AmlOpcode = AML_ONE_OP;
+            AslError (ASL_OPTIMIZATION, ASL_MSG_INTEGER_OPTIMIZATION,
+                Op, "One");
+            return (1);
+
+        case ACPI_UINT32_MAX:
+
+            /* Check for table integer width (32 or 64) */
+
+            if (AcpiGbl_IntegerByteWidth == 4)
+            {
+                Op->Asl.AmlOpcode = AML_ONES_OP;
+                AslError (ASL_OPTIMIZATION, ASL_MSG_INTEGER_OPTIMIZATION,
+                    Op, "Ones");
+                return (1);
+            }
+            break;
+
+        case ACPI_UINT64_MAX:
+
+            /* Check for table integer width (32 or 64) */
+
+            if (AcpiGbl_IntegerByteWidth == 8)
+            {
+                Op->Asl.AmlOpcode = AML_ONES_OP;
+                AslError (ASL_OPTIMIZATION, ASL_MSG_INTEGER_OPTIMIZATION,
+                    Op, "Ones");
+                return (1);
+            }
+            break;
+
+        default:
+
+            break;
+        }
+    }
+
+    /* Find the best fit using the various AML integer prefixes */
+
+    if (Op->Asl.Value.Integer <= ACPI_UINT8_MAX)
+    {
+        Op->Asl.AmlOpcode = AML_BYTE_OP;
+        return (1);
+    }
+
+    if (Op->Asl.Value.Integer <= ACPI_UINT16_MAX)
+    {
+        Op->Asl.AmlOpcode = AML_WORD_OP;
+        return (2);
+    }
+
+    if (Op->Asl.Value.Integer <= ACPI_UINT32_MAX)
+    {
+        Op->Asl.AmlOpcode = AML_DWORD_OP;
+        return (4);
+    }
+    else
+    {
+        if (AcpiGbl_IntegerByteWidth == 4)
+        {
+            AslError (ASL_WARNING, ASL_MSG_INTEGER_LENGTH,
+                Op, NULL);
+
+            if (!Gbl_IgnoreErrors)
+            {
+                /* Truncate the integer to 32-bit */
+                Op->Asl.AmlOpcode = AML_DWORD_OP;
+                return (4);
+            }
+        }
+
+        Op->Asl.AmlOpcode = AML_QWORD_OP;
+        return (8);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoAccessAs
+ *
+ * PARAMETERS:  Op        - Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Implement the ACCESS_AS ASL keyword.
+ *
+ ******************************************************************************/
+
+static void
+OpcDoAccessAs (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *TypeOp;
+    ACPI_PARSE_OBJECT       *AttribOp;
+    ACPI_PARSE_OBJECT       *LengthOp;
+    UINT8                   Attribute;
+
+
+    Op->Asl.AmlOpcodeLength = 1;
+    TypeOp = Op->Asl.Child;
+
+    /* First child is the access type */
+
+    TypeOp->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+    TypeOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+
+    /* Second child is the optional access attribute */
+
+    AttribOp = TypeOp->Asl.Next;
+    if (AttribOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+    {
+        AttribOp->Asl.Value.Integer = 0;
+    }
+
+    AttribOp->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+    AttribOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+
+    /* Only a few AccessAttributes support AccessLength */
+
+    Attribute = (UINT8) AttribOp->Asl.Value.Integer;
+    if ((Attribute != AML_FIELD_ATTRIB_MULTIBYTE) &&
+        (Attribute != AML_FIELD_ATTRIB_RAW_BYTES) &&
+        (Attribute != AML_FIELD_ATTRIB_RAW_PROCESS))
+    {
+        return;
+    }
+
+    Op->Asl.AmlOpcode = AML_FIELD_EXT_ACCESS_OP;
+
+    /*
+     * Child of Attributes is the AccessLength (required for Multibyte,
+     * RawBytes, RawProcess.)
+     */
+    LengthOp = AttribOp->Asl.Child;
+    if (!LengthOp)
+    {
+        return;
+    }
+
+    /* TBD: probably can remove */
+
+    if (LengthOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+    {
+        LengthOp->Asl.Value.Integer = 16;
+    }
+
+    LengthOp->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+    LengthOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoConnection
+ *
+ * PARAMETERS:  Op        - Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Implement the Connection ASL keyword.
+ *
+ ******************************************************************************/
+
+static void
+OpcDoConnection (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ASL_RESOURCE_NODE       *Rnode;
+    ACPI_PARSE_OBJECT       *BufferOp;
+    ACPI_PARSE_OBJECT       *BufferLengthOp;
+    ACPI_PARSE_OBJECT       *BufferDataOp;
+    ASL_RESOURCE_INFO       Info;
+    UINT8                   State;
+
+
+    Op->Asl.AmlOpcodeLength = 1;
+
+    if (Op->Asl.Child->Asl.AmlOpcode == AML_INT_NAMEPATH_OP)
+    {
+        return;
+    }
+
+    BufferOp = Op->Asl.Child;
+    BufferLengthOp = BufferOp->Asl.Child;
+    BufferDataOp = BufferLengthOp->Asl.Next;
+
+    Info.DescriptorTypeOp = BufferDataOp->Asl.Next;
+    Info.CurrentByteOffset = 0;
+    State = ACPI_RSTATE_NORMAL;
+    Rnode = RsDoOneResourceDescriptor (&Info, &State);
+    if (!Rnode)
+    {
+        return; /* error */
+    }
+
+    /*
+     * Transform the nodes into the following
+     *
+     * Op           -> AML_BUFFER_OP
+     * First Child  -> BufferLength
+     * Second Child -> Descriptor Buffer (raw byte data)
+     */
+    BufferOp->Asl.ParseOpcode = PARSEOP_BUFFER;
+    BufferOp->Asl.AmlOpcode = AML_BUFFER_OP;
+    BufferOp->Asl.CompileFlags = NODE_AML_PACKAGE | NODE_IS_RESOURCE_DESC;
+    UtSetParseOpName (BufferOp);
+
+    BufferLengthOp->Asl.ParseOpcode = PARSEOP_INTEGER;
+    BufferLengthOp->Asl.Value.Integer = Rnode->BufferLength;
+    (void) OpcSetOptimalIntegerSize (BufferLengthOp);
+    UtSetParseOpName (BufferLengthOp);
+
+    BufferDataOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+    BufferDataOp->Asl.AmlOpcode = AML_RAW_DATA_CHAIN;
+    BufferDataOp->Asl.AmlOpcodeLength = 0;
+    BufferDataOp->Asl.AmlLength = Rnode->BufferLength;
+    BufferDataOp->Asl.Value.Buffer = (UINT8 *) Rnode;
+    UtSetParseOpName (BufferDataOp);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoUnicode
+ *
+ * PARAMETERS:  Op        - Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Implement the UNICODE ASL "macro".  Convert the input string
+ *              to a unicode buffer. There is no Unicode AML opcode.
+ *
+ * Note:  The Unicode string is 16 bits per character, no leading signature,
+ *        with a 16-bit terminating NULL.
+ *
+ ******************************************************************************/
+
+static void
+OpcDoUnicode (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    UINT32                  Length;
+    UINT32                  Count;
+    UINT32                  i;
+    UINT8                   *AsciiString;
+    UINT16                  *UnicodeString;
+    ACPI_PARSE_OBJECT       *BufferLengthOp;
+
+
+    /* Change op into a buffer object */
+
+    Op->Asl.CompileFlags &= ~NODE_COMPILE_TIME_CONST;
+    Op->Asl.ParseOpcode = PARSEOP_BUFFER;
+    UtSetParseOpName (Op);
+
+    /* Buffer Length is first, followed by the string */
+
+    BufferLengthOp = Op->Asl.Child;
+    InitializerOp = BufferLengthOp->Asl.Next;
+
+    AsciiString = (UINT8 *) InitializerOp->Asl.Value.String;
+
+    /* Create a new buffer for the Unicode string */
+
+    Count = strlen (InitializerOp->Asl.Value.String) + 1;
+    Length = Count * sizeof (UINT16);
+    UnicodeString = UtLocalCalloc (Length);
+
+    /* Convert to Unicode string (including null terminator) */
+
+    for (i = 0; i < Count; i++)
+    {
+        UnicodeString[i] = (UINT16) AsciiString[i];
+    }
+
+    /*
+     * Just set the buffer size node to be the buffer length, regardless
+     * of whether it was previously an integer or a default_arg placeholder
+     */
+    BufferLengthOp->Asl.ParseOpcode = PARSEOP_INTEGER;
+    BufferLengthOp->Asl.AmlOpcode = AML_DWORD_OP;
+    BufferLengthOp->Asl.Value.Integer = Length;
+    UtSetParseOpName (BufferLengthOp);
+
+    (void) OpcSetOptimalIntegerSize (BufferLengthOp);
+
+    /* The Unicode string is a raw data buffer */
+
+    InitializerOp->Asl.Value.Buffer = (UINT8 *) UnicodeString;
+    InitializerOp->Asl.AmlOpcode = AML_RAW_DATA_BUFFER;
+    InitializerOp->Asl.AmlLength = Length;
+    InitializerOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+    InitializerOp->Asl.Child = NULL;
+    UtSetParseOpName (InitializerOp);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoEisaId
+ *
+ * PARAMETERS:  Op        - Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert a string EISA ID to numeric representation. See the
+ *              Pnp BIOS Specification for details. Here is an excerpt:
+ *
+ *              A seven character ASCII representation of the product
+ *              identifier compressed into a 32-bit identifier. The seven
+ *              character ID consists of a three character manufacturer code,
+ *              a three character hexadecimal product identifier, and a one
+ *              character hexadecimal revision number. The manufacturer code
+ *              is a 3 uppercase character code that is compressed into 3 5-bit
+ *              values as follows:
+ *                  1) Find hex ASCII value for each letter
+ *                  2) Subtract 40h from each ASCII value
+ *                  3) Retain 5 least significant bits for each letter by
+ *                     discarding upper 3 bits because they are always 0.
+ *                  4) Compressed code = concatenate 0 and the 3 5-bit values
+ *
+ *              The format of the compressed product identifier is as follows:
+ *              Byte 0: Bit 7       - Reserved (0)
+ *                      Bits 6-2:   - 1st character of compressed mfg code
+ *                      Bits 1-0    - Upper 2 bits of 2nd character of mfg code
+ *              Byte 1: Bits 7-5    - Lower 3 bits of 2nd character of mfg code
+ *                      Bits 4-0    - 3rd character of mfg code
+ *              Byte 2: Bits 7-4    - 1st hex digit of product number
+ *                      Bits 3-0    - 2nd hex digit of product number
+ *              Byte 3: Bits 7-4    - 3st hex digit of product number
+ *                      Bits 3-0    - Hex digit of the revision number
+ *
+ ******************************************************************************/
+
+static void
+OpcDoEisaId (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    UINT32                  EisaId = 0;
+    UINT32                  BigEndianId;
+    char                    *InString;
+    ACPI_STATUS             Status = AE_OK;
+    UINT32                  i;
+
+
+    InString = (char *) Op->Asl.Value.String;
+
+    /*
+     * The EISAID string must be exactly 7 characters and of the form
+     * "UUUXXXX" -- 3 uppercase letters and 4 hex digits (e.g., "PNP0001")
+     */
+    if (strlen (InString) != 7)
+    {
+        Status = AE_BAD_PARAMETER;
+    }
+    else
+    {
+        /* Check all 7 characters for correct format */
+
+        for (i = 0; i < 7; i++)
+        {
+            /* First 3 characters must be uppercase letters */
+
+            if (i < 3)
+            {
+                if (!isupper ((int) InString[i]))
+                {
+                    Status = AE_BAD_PARAMETER;
+                }
+            }
+
+            /* Last 4 characters must be hex digits */
+
+            else if (!isxdigit ((int) InString[i]))
+            {
+                Status = AE_BAD_PARAMETER;
+            }
+        }
+    }
+
+    if (ACPI_FAILURE (Status))
+    {
+        AslError (ASL_ERROR, ASL_MSG_INVALID_EISAID, Op, Op->Asl.Value.String);
+    }
+    else
+    {
+        /* Create ID big-endian first (bits are contiguous) */
+
+        BigEndianId =
+            (UINT32) ((UINT8) (InString[0] - 0x40)) << 26 |
+            (UINT32) ((UINT8) (InString[1] - 0x40)) << 21 |
+            (UINT32) ((UINT8) (InString[2] - 0x40)) << 16 |
+
+            (AcpiUtAsciiCharToHex (InString[3])) << 12 |
+            (AcpiUtAsciiCharToHex (InString[4])) << 8  |
+            (AcpiUtAsciiCharToHex (InString[5])) << 4  |
+             AcpiUtAsciiCharToHex (InString[6]);
+
+        /* Swap to little-endian to get final ID (see function header) */
+
+        EisaId = AcpiUtDwordByteSwap (BigEndianId);
+    }
+
+    /*
+     * Morph the Op into an integer, regardless of whether there
+     * was an error in the EISAID string
+     */
+    Op->Asl.Value.Integer = EisaId;
+
+    Op->Asl.CompileFlags &= ~NODE_COMPILE_TIME_CONST;
+    Op->Asl.ParseOpcode = PARSEOP_INTEGER;
+    (void) OpcSetOptimalIntegerSize (Op);
+
+    /* Op is now an integer */
+
+    UtSetParseOpName (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoUuId
+ *
+ * PARAMETERS:  Op                  - Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert UUID string to 16-byte buffer
+ *
+ ******************************************************************************/
+
+static void
+OpcDoUuId (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    char                    *InString;
+    UINT8                   *Buffer;
+    ACPI_STATUS             Status = AE_OK;
+    ACPI_PARSE_OBJECT       *NewOp;
+
+
+    InString = ACPI_CAST_PTR (char, Op->Asl.Value.String);
+    Buffer = UtLocalCalloc (16);
+
+    Status = AuValidateUuid (InString);
+    if (ACPI_FAILURE (Status))
+    {
+        AslError (ASL_ERROR, ASL_MSG_INVALID_UUID, Op, Op->Asl.Value.String);
+    }
+    else
+    {
+        AcpiUtConvertStringToUuid (InString, Buffer);
+    }
+
+    /* Change Op to a Buffer */
+
+    Op->Asl.ParseOpcode = PARSEOP_BUFFER;
+    Op->Common.AmlOpcode = AML_BUFFER_OP;
+
+    /* Disable further optimization */
+
+    Op->Asl.CompileFlags &= ~NODE_COMPILE_TIME_CONST;
+    UtSetParseOpName (Op);
+
+    /* Child node is the buffer length */
+
+    NewOp = TrAllocateNode (PARSEOP_INTEGER);
+
+    NewOp->Asl.AmlOpcode = AML_BYTE_OP;
+    NewOp->Asl.Value.Integer = 16;
+    NewOp->Asl.Parent = Op;
+
+    Op->Asl.Child = NewOp;
+    Op = NewOp;
+
+    /* Peer to the child is the raw buffer data */
+
+    NewOp = TrAllocateNode (PARSEOP_RAW_DATA);
+    NewOp->Asl.AmlOpcode = AML_RAW_DATA_BUFFER;
+    NewOp->Asl.AmlLength = 16;
+    NewOp->Asl.Value.String = ACPI_CAST_PTR (char, Buffer);
+    NewOp->Asl.Parent = Op->Asl.Parent;
+
+    Op->Asl.Next = NewOp;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcGenerateAmlOpcode
+ *
+ * PARAMETERS:  Op                  - Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Generate the AML opcode associated with the node and its
+ *              parse (lex/flex) keyword opcode. Essentially implements
+ *              a mapping between the parse opcodes and the actual AML opcodes.
+ *
+ ******************************************************************************/
+
+void
+OpcGenerateAmlOpcode (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    UINT16                  Index;
+
+
+    Index = (UINT16) (Op->Asl.ParseOpcode - ASL_PARSE_OPCODE_BASE);
+
+    Op->Asl.AmlOpcode     = AslKeywordMapping[Index].AmlOpcode;
+    Op->Asl.AcpiBtype     = AslKeywordMapping[Index].AcpiBtype;
+    Op->Asl.CompileFlags |= AslKeywordMapping[Index].Flags;
+
+    if (!Op->Asl.Value.Integer)
+    {
+        Op->Asl.Value.Integer = AslKeywordMapping[Index].Value;
+    }
+
+    /* Special handling for some opcodes */
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_INTEGER:
+        /*
+         * Set the opcode based on the size of the integer
+         */
+        (void) OpcSetOptimalIntegerSize (Op);
+        break;
+
+    case PARSEOP_OFFSET:
+
+        Op->Asl.AmlOpcodeLength = 1;
+        break;
+
+    case PARSEOP_ACCESSAS:
+
+        OpcDoAccessAs (Op);
+        break;
+
+    case PARSEOP_CONNECTION:
+
+        OpcDoConnection (Op);
+        break;
+
+    case PARSEOP_EISAID:
+
+        OpcDoEisaId (Op);
+        break;
+
+    case PARSEOP_PRINTF:
+
+        OpcDoPrintf (Op);
+        break;
+
+    case PARSEOP_FPRINTF:
+
+        OpcDoFprintf (Op);
+        break;
+
+    case PARSEOP_TOPLD:
+
+        OpcDoPld (Op);
+        break;
+
+    case PARSEOP_TOUUID:
+
+        OpcDoUuId (Op);
+        break;
+
+    case PARSEOP_UNICODE:
+
+        OpcDoUnicode (Op);
+        break;
+
+    case PARSEOP_INCLUDE:
+
+        Gbl_HasIncludeFiles = TRUE;
+        break;
+
+    case PARSEOP_EXTERNAL:
+
+        if (Gbl_DoExternals == FALSE)
+        {
+            Op->Asl.Child->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+            Op->Asl.Child->Asl.Next->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+        }
+        break;
+
+    case PARSEOP_TIMER:
+
+        if (AcpiGbl_IntegerBitWidth == 32)
+        {
+            AslError (ASL_REMARK, ASL_MSG_TRUNCATION, Op, NULL);
+        }
+        break;
+
+    default:
+
+        /* Nothing to do for other opcodes */
+
+        break;
+    }
+
+    return;
+}
diff --git a/usr/src/cmd/acpi/iasl/asloperands.c b/usr/src/cmd/acpi/iasl/asloperands.c
new file mode 100644
index 0000000000..3f84114282
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asloperands.c
@@ -0,0 +1,1196 @@
+/******************************************************************************
+ *
+ * Module Name: asloperands - AML operand processing
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asloperands")
+
+/* Local prototypes */
+
+static void
+OpnDoField (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoBankField (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoBuffer (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoDefinitionBlock (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoFieldCommon (
+    ACPI_PARSE_OBJECT       *FieldOp,
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoIndexField (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoLoadTable (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoMethod (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoMutex (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnDoRegion (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+OpnAttachNameToNode (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoMutex
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the operands for the MUTEX ASL keyword.
+ *
+ ******************************************************************************/
+
+static void
+OpnDoMutex (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    Next = Op->Asl.Child;
+    Next = Next->Asl.Next;
+
+    if (Next->Asl.Value.Integer > 15)
+    {
+        AslError (ASL_ERROR, ASL_MSG_SYNC_LEVEL, Next, NULL);
+    }
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoMethod
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the operands for the METHOD ASL keyword.
+ *
+ ******************************************************************************/
+
+static void
+OpnDoMethod (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+    /* Optional arguments for this opcode with defaults */
+
+    UINT8                   NumArgs = 0;
+    UINT8                   Serialized = 0;
+    UINT8                   Concurrency = 0;
+    UINT8                   MethodFlags;
+
+
+    /* Opcode and package length first */
+    /* Method name */
+
+    Next = Op->Asl.Child;
+
+    /* Num args */
+
+    Next = Next->Asl.Next;
+    if (Next->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+    {
+        NumArgs = (UINT8) Next->Asl.Value.Integer;
+        Next->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+    }
+
+    /* Serialized Flag */
+
+    Next = Next->Asl.Next;
+    if (Next->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+    {
+        Serialized = (UINT8) Next->Asl.Value.Integer;
+        Next->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+    }
+
+    /* Concurrency value (valid values are 0-15) */
+
+    Next = Next->Asl.Next;
+    if (Next->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+    {
+        /* This is a ByteConstExpr, so eval the constant now */
+
+        OpcAmlConstantWalk (Next, 0, NULL);
+
+        if (Next->Asl.Value.Integer > 15)
+        {
+            AslError (ASL_ERROR, ASL_MSG_SYNC_LEVEL, Next, NULL);
+        }
+
+        Concurrency = (UINT8) Next->Asl.Value.Integer;
+    }
+
+    /* Put the bits in their proper places */
+
+    MethodFlags = (UINT8)
+        ((NumArgs & 0x7) |
+        ((Serialized & 0x1) << 3) |
+        ((Concurrency & 0xF) << 4));
+
+    /* Use the last node for the combined flags byte */
+
+    Next->Asl.Value.Integer = MethodFlags;
+    Next->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+    Next->Asl.AmlLength = 1;
+    Next->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+
+    /* Save the arg count in the first node */
+
+    Op->Asl.Extra = NumArgs;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoFieldCommon
+ *
+ * PARAMETERS:  FieldOp       - Node for an ASL field
+ *              Op            - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the various field keywords,
+ *              FIELD, BANKFIELD, INDEXFIELD
+ *
+ ******************************************************************************/
+
+static void
+OpnDoFieldCommon (
+    ACPI_PARSE_OBJECT       *FieldOp,
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+    ACPI_PARSE_OBJECT       *PkgLengthNode;
+    UINT32                  CurrentBitOffset;
+    UINT32                  NewBitOffset;
+    UINT8                   AccessType;
+    UINT8                   LockRule;
+    UINT8                   UpdateRule;
+    UINT8                   FieldFlags;
+    UINT32                  MinimumLength;
+
+
+    /* AccessType -- not optional, so no need to check for DEFAULT_ARG */
+
+    AccessType = (UINT8) Op->Asl.Value.Integer;
+    Op->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+
+    /* Set the access type in the parent (field) node for use later */
+
+    FieldOp->Asl.Value.Integer = AccessType;
+
+    /* LockRule -- not optional, so no need to check for DEFAULT_ARG */
+
+    Next = Op->Asl.Next;
+    LockRule = (UINT8) Next->Asl.Value.Integer;
+    Next->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+
+    /* UpdateRule -- not optional, so no need to check for DEFAULT_ARG */
+
+    Next = Next->Asl.Next;
+    UpdateRule = (UINT8) Next->Asl.Value.Integer;
+
+    /*
+     * Generate the flags byte. The various fields are already
+     * in the right bit position via translation from the
+     * keywords by the parser.
+     */
+    FieldFlags = (UINT8) (AccessType | LockRule | UpdateRule);
+
+    /* Use the previous node to be the FieldFlags node */
+
+    /* Set the node to RAW_DATA */
+
+    Next->Asl.Value.Integer = FieldFlags;
+    Next->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+    Next->Asl.AmlLength = 1;
+    Next->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+
+    /* Process the FieldUnitList */
+
+    Next = Next->Asl.Next;
+    CurrentBitOffset = 0;
+
+    while (Next)
+    {
+        /* Save the offset of this field unit */
+
+        Next->Asl.ExtraValue = CurrentBitOffset;
+
+        switch (Next->Asl.ParseOpcode)
+        {
+        case PARSEOP_ACCESSAS:
+
+            PkgLengthNode = Next->Asl.Child;
+            AccessType = (UINT8) PkgLengthNode->Asl.Value.Integer;
+
+            /* Nothing additional to do */
+            break;
+
+        case PARSEOP_OFFSET:
+
+            /* New offset into the field */
+
+            PkgLengthNode = Next->Asl.Child;
+            NewBitOffset = ((UINT32) PkgLengthNode->Asl.Value.Integer) * 8;
+
+            /*
+             * Examine the specified offset in relation to the
+             * current offset counter.
+             */
+            if (NewBitOffset < CurrentBitOffset)
+            {
+                /*
+                 * Not allowed to specify a backwards offset!
+                 * Issue error and ignore this node.
+                 */
+                AslError (ASL_ERROR, ASL_MSG_BACKWARDS_OFFSET, PkgLengthNode,
+                    NULL);
+                Next->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+                PkgLengthNode->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+            }
+            else if (NewBitOffset == CurrentBitOffset)
+            {
+                /*
+                 * Offset is redundant; we don't need to output an
+                 * offset opcode. Just set these nodes to default
+                 */
+                Next->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+                PkgLengthNode->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+            }
+            else
+            {
+                /*
+                 * Valid new offset - set the value to be inserted into the AML
+                 * and update the offset counter.
+                 */
+                PkgLengthNode->Asl.Value.Integer =
+                    NewBitOffset - CurrentBitOffset;
+                CurrentBitOffset = NewBitOffset;
+            }
+            break;
+
+        case PARSEOP_NAMESEG:
+        case PARSEOP_RESERVED_BYTES:
+
+            /* Named or reserved field entry */
+
+            PkgLengthNode = Next->Asl.Child;
+            NewBitOffset = (UINT32) PkgLengthNode->Asl.Value.Integer;
+            CurrentBitOffset += NewBitOffset;
+
+            /* Save the current AccessAs value for error checking later */
+
+            switch (AccessType)
+            {
+                case AML_FIELD_ACCESS_ANY:
+                case AML_FIELD_ACCESS_BYTE:
+                case AML_FIELD_ACCESS_BUFFER:
+                default:
+
+                    MinimumLength = 8;
+                    break;
+
+                case AML_FIELD_ACCESS_WORD:
+                    MinimumLength = 16;
+                    break;
+
+                case AML_FIELD_ACCESS_DWORD:
+                    MinimumLength = 32;
+                    break;
+
+                case AML_FIELD_ACCESS_QWORD:
+                    MinimumLength = 64;
+                    break;
+            }
+
+            PkgLengthNode->Asl.ExtraValue = MinimumLength;
+            break;
+
+        default:
+
+            /* All supported field opcodes must appear above */
+
+            break;
+        }
+
+        /* Move on to next entry in the field list */
+
+        Next = Next->Asl.Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoField
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the FIELD ASL keyword
+ *
+ ******************************************************************************/
+
+static void
+OpnDoField (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    /* Opcode is parent node */
+    /* First child is field name */
+
+    Next = Op->Asl.Child;
+
+    /* Second child is the AccessType */
+
+    OpnDoFieldCommon (Op, Next->Asl.Next);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoIndexField
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the INDEXFIELD ASL keyword
+ *
+ ******************************************************************************/
+
+static void
+OpnDoIndexField (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    /* Opcode is parent node */
+    /* First child is the index name */
+
+    Next = Op->Asl.Child;
+
+    /* Second child is the data name */
+
+    Next = Next->Asl.Next;
+
+    /* Third child is the AccessType */
+
+    OpnDoFieldCommon (Op, Next->Asl.Next);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoBankField
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the BANKFIELD ASL keyword
+ *
+ ******************************************************************************/
+
+static void
+OpnDoBankField (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    /* Opcode is parent node */
+    /* First child is the region name */
+
+    Next = Op->Asl.Child;
+
+    /* Second child is the bank name */
+
+    Next = Next->Asl.Next;
+
+    /* Third child is the bank value */
+
+    Next = Next->Asl.Next;
+
+    /* Fourth child is the AccessType */
+
+    OpnDoFieldCommon (Op, Next->Asl.Next);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoRegion
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Tries to get the length of the region. Can only do this at
+ *              compile time if the length is a constant.
+ *
+ ******************************************************************************/
+
+static void
+OpnDoRegion (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    /* Opcode is parent node */
+    /* First child is the region name */
+
+    Next = Op->Asl.Child;
+
+    /* Second child is the space ID*/
+
+    Next = Next->Asl.Next;
+
+    /* Third child is the region offset */
+
+    Next = Next->Asl.Next;
+
+    /* Fourth child is the region length */
+
+    Next = Next->Asl.Next;
+    if (Next->Asl.ParseOpcode == PARSEOP_INTEGER)
+    {
+        Op->Asl.Value.Integer = Next->Asl.Value.Integer;
+    }
+    else
+    {
+        Op->Asl.Value.Integer = ACPI_UINT64_MAX;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoBuffer
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the BUFFER ASL keyword. We
+ *              build a single raw byte buffer from the initialization nodes,
+ *              each parse node contains a buffer byte.
+ *
+ ******************************************************************************/
+
+static void
+OpnDoBuffer (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *BufferLengthOp;
+
+    /* Optional arguments for this opcode with defaults */
+
+    UINT32                  BufferLength = 0;
+
+
+    /* Opcode and package length first */
+    /* Buffer Length is next, followed by the initializer list */
+
+    BufferLengthOp = Op->Asl.Child;
+    InitializerOp = BufferLengthOp->Asl.Next;
+
+    /*
+     * If the BufferLength is not an INTEGER or was not specified in the ASL
+     * (DEFAULT_ARG), it is a TermArg that is
+     * evaluated at run-time, and we are therefore finished.
+     */
+    if ((BufferLengthOp->Asl.ParseOpcode != PARSEOP_INTEGER) &&
+        (BufferLengthOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG))
+    {
+        return;
+    }
+
+    /*
+     * We want to count the number of items in the initializer list, because if
+     * it is larger than the buffer length, we will define the buffer size
+     * to be the size of the initializer list (as per the ACPI Specification)
+     */
+    switch (InitializerOp->Asl.ParseOpcode)
+    {
+    case PARSEOP_INTEGER:
+    case PARSEOP_BYTECONST:
+    case PARSEOP_WORDCONST:
+    case PARSEOP_DWORDCONST:
+
+        /* The peer list contains the byte list (if any...) */
+
+        while (InitializerOp)
+        {
+            /* For buffers, this is a list of raw bytes */
+
+            InitializerOp->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+            InitializerOp->Asl.AmlLength = 1;
+            InitializerOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+
+            BufferLength++;
+            InitializerOp = ASL_GET_PEER_NODE (InitializerOp);
+        }
+        break;
+
+    case PARSEOP_STRING_LITERAL:
+
+        /*
+         * Only one initializer, the string. Buffer must be big enough to hold
+         * the string plus the null termination byte
+         */
+        BufferLength = strlen (InitializerOp->Asl.Value.String) + 1;
+
+        InitializerOp->Asl.AmlOpcode = AML_RAW_DATA_BUFFER;
+        InitializerOp->Asl.AmlLength = BufferLength;
+        InitializerOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+        break;
+
+    case PARSEOP_RAW_DATA:
+
+        /* Buffer nodes are already initialized (e.g. Unicode operator) */
+        return;
+
+    case PARSEOP_DEFAULT_ARG:
+        break;
+
+    default:
+
+        AslError (ASL_ERROR, ASL_MSG_INVALID_OPERAND, InitializerOp,
+            "Unknown buffer initializer opcode");
+        printf ("Unknown buffer initializer opcode [%s]\n",
+            UtGetOpName (InitializerOp->Asl.ParseOpcode));
+        return;
+    }
+
+    /* Check if initializer list is longer than the buffer length */
+
+    if (BufferLengthOp->Asl.Value.Integer > BufferLength)
+    {
+        BufferLength = (UINT32) BufferLengthOp->Asl.Value.Integer;
+    }
+
+    if (!BufferLength)
+    {
+        /* No length AND no items -- issue notice */
+
+        AslError (ASL_REMARK, ASL_MSG_BUFFER_LENGTH, BufferLengthOp, NULL);
+
+        /* But go ahead and put the buffer length of zero into the AML */
+    }
+
+    /*
+     * Just set the buffer size node to be the buffer length, regardless
+     * of whether it was previously an integer or a default_arg placeholder
+     */
+    BufferLengthOp->Asl.ParseOpcode = PARSEOP_INTEGER;
+    BufferLengthOp->Asl.AmlOpcode = AML_DWORD_OP;
+    BufferLengthOp->Asl.Value.Integer = BufferLength;
+
+    (void) OpcSetOptimalIntegerSize (BufferLengthOp);
+
+    /* Remaining nodes are handled via the tree walk */
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoPackage
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the PACKAGE ASL keyword. NOTE:
+ *              can only be called after constants have been folded, to ensure
+ *              that the PackageLength operand has been fully reduced.
+ *
+ ******************************************************************************/
+
+void
+OpnDoPackage (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *PackageLengthOp;
+    UINT32                  PackageLength = 0;
+
+
+    /* Opcode and package length first, followed by the initializer list */
+
+    PackageLengthOp = Op->Asl.Child;
+    InitializerOp = PackageLengthOp->Asl.Next;
+
+    /* Count the number of items in the initializer list */
+
+    if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+    {
+        /* The peer list contains the byte list (if any...) */
+
+        while (InitializerOp)
+        {
+            PackageLength++;
+            InitializerOp = InitializerOp->Asl.Next;
+        }
+    }
+
+    /* If package length is a constant, compare to the initializer list */
+
+    if ((PackageLengthOp->Asl.ParseOpcode == PARSEOP_INTEGER)      ||
+        (PackageLengthOp->Asl.ParseOpcode == PARSEOP_QWORDCONST))
+    {
+        if (PackageLengthOp->Asl.Value.Integer > PackageLength)
+        {
+            /*
+             * Allow package length to be longer than the initializer
+             * list -- but if the length of initializer list is nonzero,
+             * issue a message since this is probably a coding error,
+             * even though technically legal.
+             */
+            if (PackageLength > 0)
+            {
+                AslError (ASL_REMARK, ASL_MSG_LIST_LENGTH_SHORT,
+                    PackageLengthOp, NULL);
+            }
+
+            PackageLength = (UINT32) PackageLengthOp->Asl.Value.Integer;
+        }
+        else if (PackageLengthOp->Asl.Value.Integer < PackageLength)
+        {
+            /*
+             * The package length is smaller than the length of the
+             * initializer list. This is an error as per the ACPI spec.
+             */
+            AslError (ASL_ERROR, ASL_MSG_LIST_LENGTH_LONG,
+                PackageLengthOp, NULL);
+        }
+    }
+
+    if (PackageLengthOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+    {
+        /*
+         * This is the case if the PackageLength was left empty - Package()
+         * The package length becomes the length of the initializer list
+         */
+        Op->Asl.Child->Asl.ParseOpcode = PARSEOP_INTEGER;
+        Op->Asl.Child->Asl.Value.Integer = PackageLength;
+
+        /* Set the AML opcode */
+
+        (void) OpcSetOptimalIntegerSize (Op->Asl.Child);
+    }
+
+    /* If not a variable-length package, check for a zero package length */
+
+    if ((PackageLengthOp->Asl.ParseOpcode == PARSEOP_INTEGER)      ||
+        (PackageLengthOp->Asl.ParseOpcode == PARSEOP_QWORDCONST)   ||
+        (PackageLengthOp->Asl.ParseOpcode == PARSEOP_ZERO)         ||
+        (PackageLengthOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG))
+    {
+        if (!PackageLength)
+        {
+            /* No length AND no initializer list -- issue a remark */
+
+            AslError (ASL_REMARK, ASL_MSG_PACKAGE_LENGTH,
+                PackageLengthOp, NULL);
+
+            /* But go ahead and put the buffer length of zero into the AML */
+        }
+    }
+
+    /*
+     * If the PackageLength is a constant <= 255, we can change the
+     * AML opcode from VarPackage to a simple (ACPI 1.0) Package opcode.
+     */
+    if (((Op->Asl.Child->Asl.ParseOpcode == PARSEOP_INTEGER) &&
+            (Op->Asl.Child->Asl.Value.Integer <= 255))  ||
+        (Op->Asl.Child->Asl.ParseOpcode == PARSEOP_ONE) ||
+        (Op->Asl.Child->Asl.ParseOpcode == PARSEOP_ONES)||
+        (Op->Asl.Child->Asl.ParseOpcode == PARSEOP_ZERO))
+    {
+        Op->Asl.AmlOpcode = AML_PACKAGE_OP;
+        Op->Asl.ParseOpcode = PARSEOP_PACKAGE;
+
+        /*
+         * Just set the package size node to be the package length, regardless
+         * of whether it was previously an integer or a default_arg placeholder
+         */
+        PackageLengthOp->Asl.AmlOpcode = AML_RAW_DATA_BYTE;
+        PackageLengthOp->Asl.AmlLength = 1;
+        PackageLengthOp->Asl.ParseOpcode = PARSEOP_RAW_DATA;
+        PackageLengthOp->Asl.Value.Integer = PackageLength;
+    }
+
+    /* Remaining nodes are handled via the tree walk */
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoLoadTable
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the LOADTABLE ASL keyword.
+ *
+ ******************************************************************************/
+
+static void
+OpnDoLoadTable (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    /* Opcode is parent node */
+    /* First child is the table signature */
+
+    Next = Op->Asl.Child;
+
+    /* Second child is the OEM ID*/
+
+    Next = Next->Asl.Next;
+
+    /* Third child is the OEM table ID */
+
+    Next = Next->Asl.Next;
+
+    /* Fourth child is the RootPath string */
+
+    Next = Next->Asl.Next;
+    if (Next->Asl.ParseOpcode == PARSEOP_ZERO)
+    {
+        Next->Asl.ParseOpcode = PARSEOP_STRING_LITERAL;
+        Next->Asl.Value.String = "\\";
+        Next->Asl.AmlLength = 2;
+        OpcGenerateAmlOpcode (Next);
+    }
+
+#ifdef ASL_FUTURE_IMPLEMENTATION
+
+    /* TBD: NOT IMPLEMENTED */
+    /* Fifth child is the [optional] ParameterPathString */
+    /* Sixth child is the [optional] ParameterData */
+
+    Next = Next->Asl.Next;
+    if (Next->Asl.ParseOpcode == DEFAULT_ARG)
+    {
+        Next->Asl.AmlLength = 1;
+        Next->Asl.ParseOpcode = ZERO;
+        OpcGenerateAmlOpcode (Next);
+    }
+
+
+    Next = Next->Asl.Next;
+    if (Next->Asl.ParseOpcode == DEFAULT_ARG)
+    {
+        Next->Asl.AmlLength = 1;
+        Next->Asl.ParseOpcode = ZERO;
+        OpcGenerateAmlOpcode (Next);
+    }
+#endif
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnDoDefinitionBlock
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Construct the AML operands for the DEFINITIONBLOCK ASL keyword
+ *
+ ******************************************************************************/
+
+static void
+OpnDoDefinitionBlock (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Child;
+    ACPI_SIZE               Length;
+    UINT32                  i;
+    char                    *Filename;
+
+
+    /*
+     * These nodes get stuffed into the table header. They are special
+     * cased when the table is written to the output file.
+     *
+     * Mark all of these nodes as non-usable so they won't get output
+     * as AML opcodes!
+     */
+
+    /* Get AML filename. Use it if non-null */
+
+    Child = Op->Asl.Child;
+    if (Child->Asl.Value.Buffer  &&
+        *Child->Asl.Value.Buffer &&
+        (Gbl_UseDefaultAmlFilename))
+    {
+        /*
+         * We will use the AML filename that is embedded in the source file
+         * for the output filename.
+         */
+        Filename = UtStringCacheCalloc (strlen (Gbl_DirectoryPath) +
+            strlen ((char *) Child->Asl.Value.Buffer) + 1);
+
+        /* Prepend the current directory path */
+
+        strcpy (Filename, Gbl_DirectoryPath);
+        strcat (Filename, (char *) Child->Asl.Value.Buffer);
+
+        Gbl_OutputFilenamePrefix = Filename;
+        UtConvertBackslashes (Gbl_OutputFilenamePrefix);
+    }
+
+    Child->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+
+    /* Signature */
+
+    Child = Child->Asl.Next;
+    Child->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+    if (Child->Asl.Value.String)
+    {
+        Gbl_TableSignature = Child->Asl.Value.String;
+        if (strlen (Gbl_TableSignature) != ACPI_NAME_SIZE)
+        {
+            AslError (ASL_ERROR, ASL_MSG_TABLE_SIGNATURE, Child,
+                "Length is not exactly 4");
+        }
+
+        for (i = 0; i < ACPI_NAME_SIZE; i++)
+        {
+            if (!isalnum ((int) Gbl_TableSignature[i]))
+            {
+                AslError (ASL_ERROR, ASL_MSG_TABLE_SIGNATURE, Child,
+                    "Contains non-alphanumeric characters");
+            }
+        }
+    }
+
+    /* Revision */
+
+    Child = Child->Asl.Next;
+    Child->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+    /*
+     * We used the revision to set the integer width earlier
+     */
+
+    /* OEMID */
+
+    Child = Child->Asl.Next;
+    Child->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+
+    /* OEM TableID */
+
+    Child = Child->Asl.Next;
+    Child->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+    if (Child->Asl.Value.String)
+    {
+        Length = strlen (Child->Asl.Value.String);
+        Gbl_TableId = UtStringCacheCalloc (Length + 1);
+        strcpy (Gbl_TableId, Child->Asl.Value.String);
+
+        /*
+         * Convert anything non-alphanumeric to an underscore. This
+         * allows us to use the TableID to generate unique C symbols.
+         */
+        for (i = 0; i < Length; i++)
+        {
+            if (!isalnum ((int) Gbl_TableId[i]))
+            {
+                Gbl_TableId[i] = '_';
+            }
+        }
+    }
+
+    /* OEM Revision */
+
+    Child = Child->Asl.Next;
+    Child->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtGetArg
+ *
+ * PARAMETERS:  Op              - Get an argument for this op
+ *              Argn            - Nth argument to get
+ *
+ * RETURN:      The argument (as an Op object). NULL if argument does not exist
+ *
+ * DESCRIPTION: Get the specified op's argument (peer)
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+UtGetArg (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Argn)
+{
+    ACPI_PARSE_OBJECT       *Arg = NULL;
+
+
+    /* Get the requested argument object */
+
+    Arg = Op->Asl.Child;
+    while (Arg && Argn)
+    {
+        Argn--;
+        Arg = Arg->Asl.Next;
+    }
+
+    return (Arg);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnAttachNameToNode
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: For the named ASL/AML operators, get the actual name from the
+ *              argument list and attach it to the parent node so that we
+ *              can get to it quickly later.
+ *
+ ******************************************************************************/
+
+static void
+OpnAttachNameToNode (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Child = NULL;
+
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_DATA_REGION_OP:
+    case AML_DEVICE_OP:
+    case AML_EVENT_OP:
+    case AML_EXTERNAL_OP:
+    case AML_METHOD_OP:
+    case AML_MUTEX_OP:
+    case AML_REGION_OP:
+    case AML_POWER_RES_OP:
+    case AML_PROCESSOR_OP:
+    case AML_THERMAL_ZONE_OP:
+    case AML_NAME_OP:
+    case AML_SCOPE_OP:
+
+        Child = UtGetArg (Op, 0);
+        break;
+
+    case AML_ALIAS_OP:
+
+        Child = UtGetArg (Op, 1);
+        break;
+
+    case AML_CREATE_BIT_FIELD_OP:
+    case AML_CREATE_BYTE_FIELD_OP:
+    case AML_CREATE_WORD_FIELD_OP:
+    case AML_CREATE_DWORD_FIELD_OP:
+    case AML_CREATE_QWORD_FIELD_OP:
+
+        Child = UtGetArg (Op, 2);
+        break;
+
+    case AML_CREATE_FIELD_OP:
+
+        Child = UtGetArg (Op, 3);
+        break;
+
+    case AML_BANK_FIELD_OP:
+    case AML_INDEX_FIELD_OP:
+    case AML_FIELD_OP:
+
+        return;
+
+    default:
+
+        return;
+    }
+
+    if (Child)
+    {
+        UtAttachNamepathToOwner (Op, Child);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpnGenerateAmlOperands
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Prepare nodes to be output as AML data and operands. The more
+ *              complex AML opcodes require processing of the child nodes
+ *              (arguments/operands).
+ *
+ ******************************************************************************/
+
+void
+OpnGenerateAmlOperands (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+
+    if (Op->Asl.AmlOpcode == AML_RAW_DATA_BYTE)
+    {
+        return;
+    }
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_DEFINITION_BLOCK:
+
+        OpnDoDefinitionBlock (Op);
+        break;
+
+    case PARSEOP_METHOD:
+
+        OpnDoMethod (Op);
+        break;
+
+    case PARSEOP_MUTEX:
+
+        OpnDoMutex (Op);
+        break;
+
+    case PARSEOP_FIELD:
+
+        OpnDoField (Op);
+        break;
+
+    case PARSEOP_INDEXFIELD:
+
+        OpnDoIndexField (Op);
+        break;
+
+    case PARSEOP_BANKFIELD:
+
+        OpnDoBankField (Op);
+        break;
+
+    case PARSEOP_BUFFER:
+
+        OpnDoBuffer (Op);
+        break;
+
+    case PARSEOP_LOADTABLE:
+
+        OpnDoLoadTable (Op);
+        break;
+
+    case PARSEOP_OPERATIONREGION:
+
+        OpnDoRegion (Op);
+        break;
+
+    case PARSEOP_RESOURCETEMPLATE:
+
+        RsDoResourceTemplate (Op);
+        break;
+
+    case PARSEOP_NAMESEG:
+    case PARSEOP_NAMESTRING:
+    case PARSEOP_METHODCALL:
+    case PARSEOP_STRING_LITERAL:
+    default:
+
+        break;
+    }
+
+    /* TBD: move */
+
+    OpnAttachNameToNode (Op);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslopt.c b/usr/src/cmd/acpi/iasl/aslopt.c
new file mode 100644
index 0000000000..a07f10c181
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslopt.c
@@ -0,0 +1,817 @@
+/******************************************************************************
+ *
+ * Module Name: aslopt- Compiler optimizations
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#include "acparser.h"
+#include "amlcode.h"
+#include "acnamesp.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslopt")
+
+
+static UINT32               OptTotal = 0;
+
+/* Local prototypes */
+
+static ACPI_STATUS
+OptSearchToRoot (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_NAMESPACE_NODE     *CurrentNode,
+    ACPI_NAMESPACE_NODE     *TargetNode,
+    ACPI_BUFFER             *TargetPath,
+    char                    **NewPath);
+
+static ACPI_STATUS
+OptBuildShortestPath (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_NAMESPACE_NODE     *CurrentNode,
+    ACPI_NAMESPACE_NODE     *TargetNode,
+    ACPI_BUFFER             *CurrentPath,
+    ACPI_BUFFER             *TargetPath,
+    ACPI_SIZE               AmlNameStringLength,
+    UINT8                   IsDeclaration,
+    char                    **ReturnNewPath);
+
+static ACPI_STATUS
+OptOptimizeNameDeclaration (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_NAMESPACE_NODE     *CurrentNode,
+    ACPI_NAMESPACE_NODE     *TargetNode,
+    char                    *AmlNameString,
+    char                    **NewPath);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OptSearchToRoot
+ *
+ * PARAMETERS:  Op                  - Current parser op
+ *              WalkState           - Current state
+ *              CurrentNode         - Where we are in the namespace
+ *              TargetNode          - Node to which we are referring
+ *              TargetPath          - External full path to the target node
+ *              NewPath             - Where the optimized path is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Attempt to optimize a reference to a single 4-character ACPI
+ *              name utilizing the search-to-root name resolution algorithm
+ *              that is used by AML interpreters.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OptSearchToRoot (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_NAMESPACE_NODE     *CurrentNode,
+    ACPI_NAMESPACE_NODE     *TargetNode,
+    ACPI_BUFFER             *TargetPath,
+    char                    **NewPath)
+{
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_GENERIC_STATE      ScopeInfo;
+    ACPI_STATUS             Status;
+    char                    *Path;
+
+
+    ACPI_FUNCTION_NAME (OptSearchToRoot);
+
+
+    /*
+     * Check if search-to-root can be utilized. Use the last NameSeg of
+     * the NamePath and 1) See if can be found and 2) If found, make
+     * sure that it is the same node that we want. If there is another
+     * name in the search path before the one we want, the nodes will
+     * not match, and we cannot use this optimization.
+     */
+    Path = &(((char *) TargetPath->Pointer)[
+        TargetPath->Length - ACPI_NAME_SIZE]),
+    ScopeInfo.Scope.Node = CurrentNode;
+
+    /* Lookup the NameSeg using SEARCH_PARENT (search-to-root) */
+
+    Status = AcpiNsLookup (&ScopeInfo, Path, ACPI_TYPE_ANY, ACPI_IMODE_EXECUTE,
+        ACPI_NS_SEARCH_PARENT | ACPI_NS_DONT_OPEN_SCOPE,
+        WalkState, &(Node));
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /*
+     * We found the name, but we must check to make sure that the node
+     * matches. Otherwise, there is another identical name in the search
+     * path that precludes the use of this optimization.
+     */
+    if (Node != TargetNode)
+    {
+        /*
+         * This means that another object with the same name was found first,
+         * and we cannot use this optimization.
+         */
+        return (AE_NOT_FOUND);
+    }
+
+    /* Found the node, we can use this optimization */
+
+    ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+        "NAMESEG:   %-24s", Path));
+
+    /* We must allocate a new string for the name (TargetPath gets deleted) */
+
+    *NewPath = UtStringCacheCalloc (ACPI_NAME_SIZE + 1);
+    strcpy (*NewPath, Path);
+
+    if (strncmp (*NewPath, "_T_", 3))
+    {
+        AslError (ASL_OPTIMIZATION, ASL_MSG_SINGLE_NAME_OPTIMIZATION,
+            Op, *NewPath);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OptBuildShortestPath
+ *
+ * PARAMETERS:  Op                  - Current parser op
+ *              WalkState           - Current state
+ *              CurrentNode         - Where we are in the namespace
+ *              TargetNode          - Node to which we are referring
+ *              CurrentPath         - External full path to the current node
+ *              TargetPath          - External full path to the target node
+ *              AmlNameStringLength - Length of the original namepath
+ *              IsDeclaration       - TRUE for declaration, FALSE for reference
+ *              ReturnNewPath       - Where the optimized path is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Build an optimal NamePath using carats
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OptBuildShortestPath (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_NAMESPACE_NODE     *CurrentNode,
+    ACPI_NAMESPACE_NODE     *TargetNode,
+    ACPI_BUFFER             *CurrentPath,
+    ACPI_BUFFER             *TargetPath,
+    ACPI_SIZE               AmlNameStringLength,
+    UINT8                   IsDeclaration,
+    char                    **ReturnNewPath)
+{
+    UINT32                  NumCommonSegments;
+    UINT32                  MaxCommonSegments;
+    UINT32                  Index;
+    UINT32                  NumCarats;
+    UINT32                  i;
+    char                    *NewPathInternal;
+    char                    *NewPathExternal;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_GENERIC_STATE      ScopeInfo;
+    ACPI_STATUS             Status;
+    BOOLEAN                 SubPath = FALSE;
+
+
+    ACPI_FUNCTION_NAME (OptBuildShortestPath);
+
+
+    ScopeInfo.Scope.Node = CurrentNode;
+
+    /*
+     * Determine the maximum number of NameSegs that the Target and Current paths
+     * can possibly have in common. (To optimize, we have to have at least 1)
+     *
+     * Note: The external NamePath string lengths are always a multiple of 5
+     * (ACPI_NAME_SIZE + separator)
+     */
+    MaxCommonSegments = TargetPath->Length / ACPI_PATH_SEGMENT_LENGTH;
+    if (CurrentPath->Length < TargetPath->Length)
+    {
+        MaxCommonSegments = CurrentPath->Length / ACPI_PATH_SEGMENT_LENGTH;
+    }
+
+    /*
+     * Determine how many NameSegs the two paths have in common.
+     * (Starting from the root)
+     */
+    for (NumCommonSegments = 0;
+         NumCommonSegments < MaxCommonSegments;
+         NumCommonSegments++)
+    {
+        /* Compare two single NameSegs */
+
+        Index = (NumCommonSegments * ACPI_PATH_SEGMENT_LENGTH) + 1;
+
+        if (!ACPI_COMPARE_NAME (
+            &(ACPI_CAST_PTR (char, TargetPath->Pointer)) [Index],
+            &(ACPI_CAST_PTR (char, CurrentPath->Pointer)) [Index]))
+        {
+            /* Mismatch */
+
+            break;
+        }
+    }
+
+    ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, " COMMON: %u",
+        NumCommonSegments));
+
+    /* There must be at least 1 common NameSeg in order to optimize */
+
+    if (NumCommonSegments == 0)
+    {
+        return (AE_NOT_FOUND);
+    }
+
+    if (NumCommonSegments == MaxCommonSegments)
+    {
+        if (CurrentPath->Length == TargetPath->Length)
+        {
+            ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, " SAME PATH"));
+            return (AE_NOT_FOUND);
+        }
+        else
+        {
+            ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, " SUBPATH"));
+            SubPath = TRUE;
+        }
+    }
+
+    /* Determine how many prefix Carats are required */
+
+    NumCarats = (CurrentPath->Length / ACPI_PATH_SEGMENT_LENGTH) -
+        NumCommonSegments;
+
+    /*
+     * Construct a new target string
+     */
+    NewPathExternal =
+        ACPI_ALLOCATE_ZEROED (TargetPath->Length + NumCarats + 1);
+
+    /* Insert the Carats into the Target string */
+
+    for (i = 0; i < NumCarats; i++)
+    {
+        NewPathExternal[i] = AML_PARENT_PREFIX;
+    }
+
+    /*
+     * Copy only the necessary (optimal) segments from the original
+     * target string
+     */
+    Index = (NumCommonSegments * ACPI_PATH_SEGMENT_LENGTH) + 1;
+
+    /* Special handling for exact subpath in a name declaration */
+
+    if (IsDeclaration && SubPath &&
+        (CurrentPath->Length > TargetPath->Length))
+    {
+        /*
+         * The current path is longer than the target, and the target is a
+         * subpath of the current path. We must include one more NameSeg of
+         * the target path
+         */
+        Index -= ACPI_PATH_SEGMENT_LENGTH;
+
+        /* Special handling for Scope() operator */
+
+        if (Op->Asl.AmlOpcode == AML_SCOPE_OP)
+        {
+            NewPathExternal[i] = AML_PARENT_PREFIX;
+            i++;
+            ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, "(EXTRA ^)"));
+        }
+    }
+
+    /* Make sure we haven't gone off the end of the target path */
+
+    if (Index > TargetPath->Length)
+    {
+        Index = TargetPath->Length;
+    }
+
+    strcpy (&NewPathExternal[i],
+        &(ACPI_CAST_PTR (char, TargetPath->Pointer))[Index]);
+    ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, " %-24s", NewPathExternal));
+
+    /*
+     * Internalize the new target string and check it against the original
+     * string to make sure that this is in fact an optimization. If the
+     * original string is already optimal, there is no point in continuing.
+     */
+    Status = AcpiNsInternalizeName (NewPathExternal, &NewPathInternal);
+    if (ACPI_FAILURE (Status))
+    {
+        AslCoreSubsystemError (Op, Status, "Internalizing new NamePath",
+            ASL_NO_ABORT);
+        goto Cleanup;
+    }
+
+    if (strlen (NewPathInternal) >= AmlNameStringLength)
+    {
+        ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+            " NOT SHORTER (New %u old %u)",
+            (UINT32) strlen (NewPathInternal),
+            (UINT32) AmlNameStringLength));
+
+        ACPI_FREE (NewPathInternal);
+        Status = AE_NOT_FOUND;
+        goto Cleanup;
+    }
+
+    /*
+     * Check to make sure that the optimization finds the node we are
+     * looking for. This is simply a sanity check on the new
+     * path that has been created.
+     */
+    Status = AcpiNsLookup (&ScopeInfo, NewPathInternal,
+        ACPI_TYPE_ANY, ACPI_IMODE_EXECUTE,
+        ACPI_NS_DONT_OPEN_SCOPE, WalkState, &(Node));
+    if (ACPI_SUCCESS (Status))
+    {
+        /* Found the namepath, but make sure the node is correct */
+
+        if (Node == TargetNode)
+        {
+            /* The lookup matched the node, accept this optimization */
+
+            AslError (ASL_OPTIMIZATION, ASL_MSG_NAME_OPTIMIZATION,
+                Op, NewPathExternal);
+            *ReturnNewPath = NewPathInternal;
+        }
+        else
+        {
+            /* Node is not correct, do not use this optimization */
+
+            Status = AE_NOT_FOUND;
+            ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, " ***** WRONG NODE"));
+            AslError (ASL_WARNING, ASL_MSG_COMPILER_INTERNAL, Op,
+                "Not using optimized name - found wrong node");
+        }
+    }
+    else
+    {
+        /* The lookup failed, we obviously cannot use this optimization */
+
+        ACPI_FREE (NewPathInternal);
+
+        ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, " ***** NOT FOUND"));
+        AslError (ASL_WARNING, ASL_MSG_COMPILER_INTERNAL, Op,
+            "Not using optimized name - did not find node");
+    }
+
+Cleanup:
+
+    ACPI_FREE (NewPathExternal);
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OptOptimizeNameDeclaration
+ *
+ * PARAMETERS:  Op                  - Current parser op
+ *              WalkState           - Current state
+ *              CurrentNode         - Where we are in the namespace
+ *              AmlNameString       - Unoptimized namepath
+ *              NewPath             - Where the optimized path is returned
+ *
+ * RETURN:      Status. AE_OK If path is optimized
+ *
+ * DESCRIPTION: Perform a simple optimization of removing an extraneous
+ *              backslash prefix if we are already at the root scope.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OptOptimizeNameDeclaration (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_NAMESPACE_NODE     *CurrentNode,
+    ACPI_NAMESPACE_NODE     *TargetNode,
+    char                    *AmlNameString,
+    char                    **NewPath)
+{
+    ACPI_STATUS             Status;
+    char                    *NewPathExternal;
+    ACPI_NAMESPACE_NODE     *Node;
+
+
+    ACPI_FUNCTION_TRACE (OptOptimizeNameDeclaration);
+
+
+    if (((CurrentNode == AcpiGbl_RootNode) ||
+        (Op->Common.Parent->Asl.ParseOpcode == PARSEOP_DEFINITION_BLOCK)) &&
+            (ACPI_IS_ROOT_PREFIX (AmlNameString[0])))
+    {
+        /*
+         * The current scope is the root, and the namepath has a root prefix
+         * that is therefore extraneous. Remove it.
+         */
+        *NewPath = &AmlNameString[1];
+
+        /* Debug output */
+
+        Status = AcpiNsExternalizeName (ACPI_UINT32_MAX, *NewPath,
+            NULL, &NewPathExternal);
+        if (ACPI_FAILURE (Status))
+        {
+            AslCoreSubsystemError (Op, Status, "Externalizing NamePath",
+                ASL_NO_ABORT);
+            return (Status);
+        }
+
+        /*
+         * Check to make sure that the optimization finds the node we are
+         * looking for. This is simply a sanity check on the new
+         * path that has been created.
+         *
+         * We know that we are at the root, so NULL is used for the scope.
+         */
+        Status = AcpiNsLookup (NULL, *NewPath,
+            ACPI_TYPE_ANY, ACPI_IMODE_EXECUTE,
+            ACPI_NS_DONT_OPEN_SCOPE, WalkState, &(Node));
+        if (ACPI_SUCCESS (Status))
+        {
+            /* Found the namepath, but make sure the node is correct */
+
+            if (Node == TargetNode)
+            {
+                /* The lookup matched the node, accept this optimization */
+
+                AslError (ASL_OPTIMIZATION, ASL_MSG_NAME_OPTIMIZATION,
+                    Op, NewPathExternal);
+
+                ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+                    "AT ROOT:   %-24s", NewPathExternal));
+            }
+            else
+            {
+                /* Node is not correct, do not use this optimization */
+
+                Status = AE_NOT_FOUND;
+                ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+                    " ***** WRONG NODE"));
+                AslError (ASL_WARNING, ASL_MSG_COMPILER_INTERNAL, Op,
+                    "Not using optimized name - found wrong node");
+            }
+        }
+        else
+        {
+            /* The lookup failed, we obviously cannot use this optimization */
+
+            ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+                " ***** NOT FOUND"));
+            AslError (ASL_WARNING, ASL_MSG_COMPILER_INTERNAL, Op,
+                "Not using optimized name - did not find node");
+        }
+
+        ACPI_FREE (NewPathExternal);
+        return (Status);
+    }
+
+    /* Could not optimize */
+
+    return (AE_NOT_FOUND);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OptOptimizeNamePath
+ *
+ * PARAMETERS:  Op                  - Current parser op
+ *              Flags               - Opcode info flags
+ *              WalkState           - Current state
+ *              AmlNameString       - Unoptimized namepath
+ *              TargetNode          - Node to which AmlNameString refers
+ *
+ * RETURN:      None. If path is optimized, the Op is updated with new path
+ *
+ * DESCRIPTION: Optimize a Named Declaration or Reference to the minimal length.
+ *              Must take into account both the current location in the
+ *              namespace and the actual reference path.
+ *
+ ******************************************************************************/
+
+void
+OptOptimizeNamePath (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Flags,
+    ACPI_WALK_STATE         *WalkState,
+    char                    *AmlNameString,
+    ACPI_NAMESPACE_NODE     *TargetNode)
+{
+    ACPI_STATUS             Status;
+    ACPI_BUFFER             TargetPath;
+    ACPI_BUFFER             CurrentPath;
+    ACPI_SIZE               AmlNameStringLength;
+    ACPI_NAMESPACE_NODE     *CurrentNode;
+    char                    *ExternalNameString;
+    char                    *NewPath = NULL;
+    ACPI_SIZE               HowMuchShorter;
+    ACPI_PARSE_OBJECT       *NextOp;
+
+
+    ACPI_FUNCTION_TRACE (OptOptimizeNamePath);
+
+
+    /* This is an optional optimization */
+
+    if (!Gbl_ReferenceOptimizationFlag)
+    {
+        return_VOID;
+    }
+
+    /* Various required items */
+
+    if (!TargetNode || !WalkState || !AmlNameString || !Op->Common.Parent)
+    {
+        return_VOID;
+    }
+
+    ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+        "PATH OPTIMIZE: Line %5d ParentOp [%12.12s] ThisOp [%12.12s] ",
+        Op->Asl.LogicalLineNumber,
+        AcpiPsGetOpcodeName (Op->Common.Parent->Common.AmlOpcode),
+        AcpiPsGetOpcodeName (Op->Common.AmlOpcode)));
+
+    if (!(Flags & (AML_NAMED | AML_CREATE)))
+    {
+        if (Op->Asl.CompileFlags & NODE_IS_NAME_DECLARATION)
+        {
+            /* We don't want to fuss with actual name declaration nodes here */
+
+            ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+                "******* NAME DECLARATION\n"));
+            return_VOID;
+        }
+    }
+
+    /*
+     * The original path must be longer than one NameSeg (4 chars) for there
+     * to be any possibility that it can be optimized to a shorter string
+     */
+    AmlNameStringLength = strlen (AmlNameString);
+    if (AmlNameStringLength <= ACPI_NAME_SIZE)
+    {
+        ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+            "NAMESEG %4.4s\n", AmlNameString));
+        return_VOID;
+    }
+
+    /*
+     * We need to obtain the node that represents the current scope -- where
+     * we are right now in the namespace. We will compare this path
+     * against the Namepath, looking for commonality.
+     */
+    CurrentNode = AcpiGbl_RootNode;
+    if (WalkState->ScopeInfo)
+    {
+        CurrentNode = WalkState->ScopeInfo->Scope.Node;
+    }
+
+    if (Flags & (AML_NAMED | AML_CREATE))
+    {
+        /* This is the declaration of a new name */
+
+        ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, "NAME\n"));
+
+        /*
+         * The node of interest is the parent of this node (the containing
+         * scope). The actual namespace node may be up more than one level
+         * of parse op or it may not exist at all (if we traverse back
+         * up to the root.)
+         */
+        NextOp = Op->Asl.Parent;
+        while (NextOp && (!NextOp->Asl.Node))
+        {
+            NextOp = NextOp->Asl.Parent;
+        }
+
+        if (NextOp && NextOp->Asl.Node)
+        {
+            CurrentNode = NextOp->Asl.Node;
+        }
+        else
+        {
+            CurrentNode = AcpiGbl_RootNode;
+        }
+    }
+    else
+    {
+        /* This is a reference to an existing named object */
+
+        ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, "REFERENCE\n"));
+    }
+
+    /*
+     * Obtain the full paths to the two nodes that we are interested in
+     * (Target and current namespace location) in external
+     * format -- something we can easily manipulate
+     */
+    TargetPath.Length = ACPI_ALLOCATE_LOCAL_BUFFER;
+    Status = AcpiNsHandleToPathname (TargetNode, &TargetPath, FALSE);
+    if (ACPI_FAILURE (Status))
+    {
+        AslCoreSubsystemError (Op, Status, "Getting Target NamePath",
+            ASL_NO_ABORT);
+        return_VOID;
+    }
+
+    TargetPath.Length--;    /* Subtract one for null terminator */
+
+    /* CurrentPath is the path to this scope (where we are in the namespace) */
+
+    CurrentPath.Length = ACPI_ALLOCATE_LOCAL_BUFFER;
+    Status = AcpiNsHandleToPathname (CurrentNode, &CurrentPath, FALSE);
+    if (ACPI_FAILURE (Status))
+    {
+        AslCoreSubsystemError (Op, Status, "Getting Current NamePath",
+            ASL_NO_ABORT);
+        return_VOID;
+    }
+
+    CurrentPath.Length--;   /* Subtract one for null terminator */
+
+    /* Debug output only */
+
+    Status = AcpiNsExternalizeName (ACPI_UINT32_MAX, AmlNameString,
+        NULL, &ExternalNameString);
+    if (ACPI_FAILURE (Status))
+    {
+        AslCoreSubsystemError (Op, Status, "Externalizing NamePath",
+            ASL_NO_ABORT);
+        return_VOID;
+    }
+
+    ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+        "CURRENT SCOPE: (%2u) %-37s FULL PATH TO NAME: (%2u) %-32s ACTUAL AML:%-32s\n",
+        (UINT32) CurrentPath.Length, (char *) CurrentPath.Pointer,
+        (UINT32) TargetPath.Length, (char *) TargetPath.Pointer,
+        ExternalNameString));
+
+    ACPI_FREE (ExternalNameString);
+
+    /*
+     * Attempt an optmization depending on the type of namepath
+     */
+    if (Flags & (AML_NAMED | AML_CREATE))
+    {
+        /*
+         * This is a named opcode and the namepath is a name declaration, not
+         * a reference.
+         */
+        Status = OptOptimizeNameDeclaration (Op, WalkState, CurrentNode,
+            TargetNode, AmlNameString, &NewPath);
+        if (ACPI_FAILURE (Status))
+        {
+            /*
+             * 2) now attempt to
+             *    optimize the namestring with carats (up-arrow)
+             */
+            Status = OptBuildShortestPath (Op, WalkState, CurrentNode,
+                TargetNode, &CurrentPath, &TargetPath,
+                AmlNameStringLength, 1, &NewPath);
+        }
+    }
+    else
+    {
+        /*
+         * This is a reference to an existing named object
+         *
+         * 1) Check if search-to-root can be utilized using the last
+         *    NameSeg of the NamePath
+         */
+        Status = OptSearchToRoot (Op, WalkState, CurrentNode,
+            TargetNode, &TargetPath, &NewPath);
+        if (ACPI_FAILURE (Status))
+        {
+            /*
+             * 2) Search-to-root could not be used, now attempt to
+             *    optimize the namestring with carats (up-arrow)
+             */
+            Status = OptBuildShortestPath (Op, WalkState, CurrentNode,
+                TargetNode, &CurrentPath, &TargetPath,
+                AmlNameStringLength, 0, &NewPath);
+        }
+    }
+
+    /*
+     * Success from above indicates that the NamePath was successfully
+     * optimized. We need to update the parse op with the new name
+     */
+    if (ACPI_SUCCESS (Status))
+    {
+        HowMuchShorter = (AmlNameStringLength - strlen (NewPath));
+        OptTotal += HowMuchShorter;
+
+        ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS,
+            " REDUCED BY %2u (TOTAL SAVED %2u)",
+            (UINT32) HowMuchShorter, OptTotal));
+
+        if (Flags & AML_NAMED)
+        {
+            if (Op->Asl.AmlOpcode == AML_ALIAS_OP)
+            {
+                /*
+                 * ALIAS is the only oddball opcode, the name declaration
+                 * (alias name) is the second operand
+                 */
+                Op->Asl.Child->Asl.Next->Asl.Value.String = NewPath;
+                Op->Asl.Child->Asl.Next->Asl.AmlLength = strlen (NewPath);
+            }
+            else
+            {
+                Op->Asl.Child->Asl.Value.String = NewPath;
+                Op->Asl.Child->Asl.AmlLength = strlen (NewPath);
+            }
+        }
+        else if (Flags & AML_CREATE)
+        {
+            /* Name must appear as the last parameter */
+
+            NextOp = Op->Asl.Child;
+            while (!(NextOp->Asl.CompileFlags & NODE_IS_NAME_DECLARATION))
+            {
+                NextOp = NextOp->Asl.Next;
+            }
+            /* Update the parse node with the new NamePath */
+
+            NextOp->Asl.Value.String = NewPath;
+            NextOp->Asl.AmlLength = strlen (NewPath);
+        }
+        else
+        {
+            /* Update the parse node with the new NamePath */
+
+            Op->Asl.Value.String = NewPath;
+            Op->Asl.AmlLength = strlen (NewPath);
+        }
+    }
+    else
+    {
+        ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, " ALREADY OPTIMAL"));
+    }
+
+    /* Cleanup path buffers */
+
+    ACPI_FREE (TargetPath.Pointer);
+    ACPI_FREE (CurrentPath.Pointer);
+
+    ACPI_DEBUG_PRINT_RAW ((ACPI_DB_OPTIMIZATIONS, "\n"));
+    return_VOID;
+}
diff --git a/usr/src/cmd/acpi/iasl/asloptions.c b/usr/src/cmd/acpi/iasl/asloptions.c
new file mode 100644
index 0000000000..d19c3f3f64
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asloptions.c
@@ -0,0 +1,916 @@
+/******************************************************************************
+ *
+ * Module Name: asloptions - compiler command line processing
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acapps.h"
+#include "acdisasm.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asloption")
+
+
+/* Local prototypes */
+
+static int
+AslDoOptions (
+    int                     argc,
+    char                    **argv,
+    BOOLEAN                 IsResponseFile);
+
+static void
+AslMergeOptionTokens (
+    char                    *InBuffer,
+    char                    *OutBuffer);
+
+static int
+AslDoResponseFile (
+    char                    *Filename);
+
+
+#define ASL_TOKEN_SEPARATORS    " \t\n"
+#define ASL_SUPPORTED_OPTIONS   "@:a:b|c|d^D:e:f^gh^i|I:l^m:no|p:P^r:s|t|T+G^v^w|x:z"
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCommandLine
+ *
+ * PARAMETERS:  argc/argv
+ *
+ * RETURN:      Last argv index
+ *
+ * DESCRIPTION: Command line processing
+ *
+ ******************************************************************************/
+
+int
+AslCommandLine (
+    int                     argc,
+    char                    **argv)
+{
+    int                     BadCommandLine = 0;
+    ACPI_STATUS             Status;
+
+
+    /* Minimum command line contains at least the command and an input file */
+
+    if (argc < 2)
+    {
+        printf (ACPI_COMMON_SIGNON (ASL_COMPILER_NAME));
+        Usage ();
+        exit (1);
+    }
+
+    /* Process all command line options */
+
+    BadCommandLine = AslDoOptions (argc, argv, FALSE);
+
+    if (Gbl_DoTemplates)
+    {
+        Status = DtCreateTemplates (argv);
+        if (ACPI_FAILURE (Status))
+        {
+            exit (-1);
+        }
+        exit (1);
+    }
+
+    /* Next parameter must be the input filename */
+
+    if (!argv[AcpiGbl_Optind] &&
+        !Gbl_DisasmFlag)
+    {
+        printf ("Missing input filename\n");
+        BadCommandLine = TRUE;
+    }
+
+    if (Gbl_DoSignon)
+    {
+        printf (ACPI_COMMON_SIGNON (ASL_COMPILER_NAME));
+        if (Gbl_IgnoreErrors)
+        {
+            printf ("Ignoring all errors, forcing AML file generation\n\n");
+        }
+    }
+
+    if (BadCommandLine)
+    {
+        printf ("Use -h option for help information\n");
+        exit (1);
+    }
+
+    return (AcpiGbl_Optind);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoOptions
+ *
+ * PARAMETERS:  argc/argv           - Standard argc/argv
+ *              IsResponseFile      - TRUE if executing a response file.
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Command line option processing
+ *
+ ******************************************************************************/
+
+static int
+AslDoOptions (
+    int                     argc,
+    char                    **argv,
+    BOOLEAN                 IsResponseFile)
+{
+    ACPI_STATUS             Status;
+    UINT32                  j;
+
+
+    /* Get the command line options */
+
+    while ((j = AcpiGetopt (argc, argv, ASL_SUPPORTED_OPTIONS)) != ACPI_OPT_END) switch (j)
+    {
+    case '@':   /* Begin a response file */
+
+        if (IsResponseFile)
+        {
+            printf ("Nested command files are not supported\n");
+            return (-1);
+        }
+
+        if (AslDoResponseFile (AcpiGbl_Optarg))
+        {
+            return (-1);
+        }
+        break;
+
+    case 'a':   /* Debug options */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case 'r':
+
+            Gbl_EnableReferenceTypechecking = TRUE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -a%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+
+        break;
+
+
+    case 'b':   /* Debug options */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case 'f':
+
+            AslCompilerdebug = 1; /* same as yydebug */
+            DtParserdebug = 1;
+            PrParserdebug = 1;
+            Gbl_DebugFlag = TRUE;
+            Gbl_KeepPreprocessorTempFile = TRUE;
+            break;
+
+        case 'p':   /* Prune ASL parse tree */
+
+            /* Get the required argument */
+
+            if (AcpiGetoptArgument (argc, argv))
+            {
+                return (-1);
+            }
+
+            Gbl_PruneParseTree = TRUE;
+            Gbl_PruneDepth = (UINT8) strtoul (AcpiGbl_Optarg, NULL, 0);
+            break;
+
+        case 's':
+
+            Gbl_DebugFlag = TRUE;
+            break;
+
+        case 't':
+
+            /* Get the required argument */
+
+            if (AcpiGetoptArgument (argc, argv))
+            {
+                return (-1);
+            }
+
+            Gbl_PruneType = (UINT8) strtoul (AcpiGbl_Optarg, NULL, 0);
+            break;
+
+        default:
+
+            printf ("Unknown option: -b%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+
+        break;
+
+    case 'c':
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case 'r':
+
+            Gbl_NoResourceChecking = TRUE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -c%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'd':   /* Disassembler */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case '^':
+
+            Gbl_DoCompile = FALSE;
+            break;
+
+        case 'a':
+
+            Gbl_DoCompile = FALSE;
+            Gbl_DisassembleAll = TRUE;
+            break;
+
+        case 'b':   /* Do not convert buffers to resource descriptors */
+
+            AcpiGbl_NoResourceDisassembly = TRUE;
+            break;
+
+        case 'c':
+
+            break;
+
+        case 'f':
+
+            AcpiGbl_ForceAmlDisassembly = TRUE;
+            break;
+
+        case 'l':   /* Use legacy ASL code (not ASL+) for disassembly */
+
+            Gbl_DoCompile = FALSE;
+            AcpiGbl_CstyleDisassembly = FALSE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -d%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+
+        Gbl_DisasmFlag = TRUE;
+        break;
+
+    case 'D':   /* Define a symbol */
+
+        PrAddDefine (AcpiGbl_Optarg, NULL, TRUE);
+        break;
+
+    case 'e':   /* External files for disassembler */
+
+        /* Get entire list of external files */
+
+        AcpiGbl_Optind--;
+        argv[AcpiGbl_Optind] = AcpiGbl_Optarg;
+
+        while (argv[AcpiGbl_Optind] &&
+              (argv[AcpiGbl_Optind][0] != '-'))
+        {
+            Status = AcpiDmAddToExternalFileList (argv[AcpiGbl_Optind]);
+            if (ACPI_FAILURE (Status))
+            {
+                printf ("Could not add %s to external list\n",
+                    argv[AcpiGbl_Optind]);
+                return (-1);
+            }
+
+            AcpiGbl_Optind++;
+        }
+        break;
+
+    case 'f':
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case '^':   /* Ignore errors and force creation of aml file */
+
+            Gbl_IgnoreErrors = TRUE;
+            break;
+
+        case 'e':   /* Disassembler: Get external declaration file */
+
+            if (AcpiGetoptArgument (argc, argv))
+            {
+                return (-1);
+            }
+
+            Gbl_ExternalRefFilename = AcpiGbl_Optarg;
+            break;
+
+        default:
+
+            printf ("Unknown option: -f%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'G':
+
+        Gbl_CompileGeneric = TRUE;
+        break;
+
+    case 'g':   /* Get all ACPI tables */
+
+        printf ("-g option is deprecated, use acpidump utility instead\n");
+        exit (1);
+
+    case 'h':
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case '^':
+
+            Usage ();
+            exit (0);
+
+        case 'c':
+
+            UtDisplayConstantOpcodes ();
+            exit (0);
+
+        case 'f':
+
+            AslFilenameHelp ();
+            exit (0);
+
+        case 'r':
+
+            /* reserved names */
+
+            ApDisplayReservedNames ();
+            exit (0);
+
+        case 't':
+
+            UtDisplaySupportedTables ();
+            exit (0);
+
+        default:
+
+            printf ("Unknown option: -h%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+
+    case 'I':   /* Add an include file search directory */
+
+        FlAddIncludeDirectory (AcpiGbl_Optarg);
+        break;
+
+    case 'i':   /* Output AML as an include file */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case 'a':
+
+            /* Produce assembly code include file */
+
+            Gbl_AsmIncludeOutputFlag = TRUE;
+            break;
+
+        case 'c':
+
+            /* Produce C include file */
+
+            Gbl_C_IncludeOutputFlag = TRUE;
+            break;
+
+        case 'n':
+
+            /* Compiler/Disassembler: Ignore the NOOP operator */
+
+            AcpiGbl_IgnoreNoopOperator = TRUE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -i%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'l':   /* Listing files */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case '^':
+
+            /* Produce listing file (Mixed source/aml) */
+
+            Gbl_ListingFlag = TRUE;
+            AcpiGbl_DmOpt_Listing = TRUE;
+            break;
+
+        case 'i':
+
+            /* Produce preprocessor output file */
+
+            Gbl_PreprocessorOutputFlag = TRUE;
+            break;
+
+        case 'm':
+
+            /* Produce hardware map summary file */
+
+            Gbl_MapfileFlag = TRUE;
+            break;
+
+        case 'n':
+
+            /* Produce namespace file */
+
+            Gbl_NsOutputFlag = TRUE;
+            break;
+
+        case 's':
+
+            /* Produce combined source file */
+
+            Gbl_SourceOutputFlag = TRUE;
+            break;
+
+        case 'x':
+
+            /* Produce cross-reference file */
+
+            Gbl_CrossReferenceOutput = TRUE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -l%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'm':   /* Set line buffer size */
+
+        Gbl_LineBufferSize = (UINT32) strtoul (AcpiGbl_Optarg, NULL, 0) * 1024;
+        if (Gbl_LineBufferSize < ASL_DEFAULT_LINE_BUFFER_SIZE)
+        {
+            Gbl_LineBufferSize = ASL_DEFAULT_LINE_BUFFER_SIZE;
+        }
+        printf ("Line Buffer Size: %u\n", Gbl_LineBufferSize);
+        break;
+
+    case 'n':   /* Parse only */
+
+        Gbl_ParseOnlyFlag = TRUE;
+        break;
+
+    case 'o':   /* Control compiler AML optimizations */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case 'a':
+
+            /* Disable all optimizations */
+
+            Gbl_FoldConstants = FALSE;
+            Gbl_IntegerOptimizationFlag = FALSE;
+            Gbl_ReferenceOptimizationFlag = FALSE;
+            break;
+
+        case 'c':
+
+            /* Display compile time(s) */
+
+            Gbl_CompileTimesFlag = TRUE;
+            break;
+
+        case 'e':
+
+            /* iASL: Disable External opcode generation */
+
+            Gbl_DoExternals = FALSE;
+
+            /* Disassembler: Emit embedded external operators */
+
+            AcpiGbl_DmEmitExternalOpcodes = TRUE;
+            break;
+
+        case 'f':
+
+            /* Disable folding on "normal" expressions */
+
+            Gbl_FoldConstants = FALSE;
+            break;
+
+        case 'i':
+
+            /* Disable integer optimization to constants */
+
+            Gbl_IntegerOptimizationFlag = FALSE;
+            break;
+
+        case 'n':
+
+            /* Disable named reference optimization */
+
+            Gbl_ReferenceOptimizationFlag = FALSE;
+            break;
+
+        case 't':
+
+            /* Disable heavy typechecking */
+
+            Gbl_DoTypechecking = FALSE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -c%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'P':   /* Preprocessor options */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case '^':   /* Proprocess only, emit (.i) file */
+
+            Gbl_PreprocessOnly = TRUE;
+            Gbl_PreprocessorOutputFlag = TRUE;
+            break;
+
+        case 'n':   /* Disable preprocessor */
+
+            Gbl_PreprocessFlag = FALSE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -P%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'p':   /* Override default AML output filename */
+
+        Gbl_OutputFilenamePrefix = AcpiGbl_Optarg;
+        UtConvertBackslashes (Gbl_OutputFilenamePrefix);
+        Gbl_UseDefaultAmlFilename = FALSE;
+        break;
+
+    case 'r':   /* Override revision found in table header */
+
+        Gbl_RevisionOverride = (UINT8) strtoul (AcpiGbl_Optarg, NULL, 0);
+        break;
+
+    case 's':   /* Create AML in a source code file */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case 'a':
+
+            /* Produce assembly code output file */
+
+            Gbl_AsmOutputFlag = TRUE;
+            break;
+
+        case 'c':
+
+            /* Produce C hex output file */
+
+            Gbl_C_OutputFlag = TRUE;
+            break;
+
+        case 'o':
+
+            /* Produce AML offset table in C */
+
+            Gbl_C_OffsetTableFlag = TRUE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -s%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 't':   /* Produce hex table output file */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case 'a':
+
+            Gbl_HexOutputFlag = HEX_OUTPUT_ASM;
+            break;
+
+        case 'c':
+
+            Gbl_HexOutputFlag = HEX_OUTPUT_C;
+            break;
+
+        case 's':
+
+            Gbl_HexOutputFlag = HEX_OUTPUT_ASL;
+            break;
+
+        default:
+
+            printf ("Unknown option: -t%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'T':   /* Create a ACPI table template file */
+
+        Gbl_DoTemplates = TRUE;
+        break;
+
+    case 'v':   /* Version and verbosity settings */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case '^':
+
+            printf (ACPI_COMMON_SIGNON (ASL_COMPILER_NAME));
+            exit (0);
+
+        case 'a':
+
+            /* Disable all error/warning/remark messages */
+
+            Gbl_NoErrors = TRUE;
+            break;
+
+        case 'e':
+
+            /* Disable all warning/remark messages (errors only) */
+
+            Gbl_DisplayRemarks = FALSE;
+            Gbl_DisplayWarnings = FALSE;
+            break;
+
+        case 'i':
+            /*
+             * Support for integrated development environment(s).
+             *
+             * 1) No compiler signon
+             * 2) Send stderr messages to stdout
+             * 3) Less verbose error messages (single line only for each)
+             * 4) Error/warning messages are formatted appropriately to
+             *    be recognized by MS Visual Studio
+             */
+            Gbl_VerboseErrors = FALSE;
+            Gbl_DoSignon = FALSE;
+            Gbl_Files[ASL_FILE_STDERR].Handle = stdout;
+            break;
+
+        case 'o':
+
+            Gbl_DisplayOptimizations = TRUE;
+            break;
+
+        case 'r':
+
+            Gbl_DisplayRemarks = FALSE;
+            break;
+
+        case 's':
+
+            Gbl_DoSignon = FALSE;
+            break;
+
+        case 't':
+
+            Gbl_VerboseTemplates = TRUE;
+            break;
+
+        case 'w':
+
+            /* Get the required argument */
+
+            if (AcpiGetoptArgument (argc, argv))
+            {
+                return (-1);
+            }
+
+            Status = AslDisableException (AcpiGbl_Optarg);
+            if (ACPI_FAILURE (Status))
+            {
+                return (-1);
+            }
+            break;
+
+        default:
+
+            printf ("Unknown option: -v%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'w': /* Set warning levels */
+
+        switch (AcpiGbl_Optarg[0])
+        {
+        case '1':
+
+            Gbl_WarningLevel = ASL_WARNING;
+            break;
+
+        case '2':
+
+            Gbl_WarningLevel = ASL_WARNING2;
+            break;
+
+        case '3':
+
+            Gbl_WarningLevel = ASL_WARNING3;
+            break;
+
+        case 'e':
+
+            Gbl_WarningsAsErrors = TRUE;
+            break;
+
+        default:
+
+            printf ("Unknown option: -w%s\n", AcpiGbl_Optarg);
+            return (-1);
+        }
+        break;
+
+    case 'x':   /* Set debug print output level */
+
+        AcpiDbgLevel = strtoul (AcpiGbl_Optarg, NULL, 16);
+        break;
+
+    case 'z':
+
+        Gbl_UseOriginalCompilerId = TRUE;
+        break;
+
+    default:
+
+        return (-1);
+    }
+
+    return (0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslMergeOptionTokens
+ *
+ * PARAMETERS:  InBuffer            - Input containing an option string
+ *              OutBuffer           - Merged output buffer
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Remove all whitespace from an option string.
+ *
+ ******************************************************************************/
+
+static void
+AslMergeOptionTokens (
+    char                    *InBuffer,
+    char                    *OutBuffer)
+{
+    char                    *Token;
+
+
+    *OutBuffer = 0;
+
+    Token = strtok (InBuffer, ASL_TOKEN_SEPARATORS);
+    while (Token)
+    {
+        strcat (OutBuffer, Token);
+        Token = strtok (NULL, ASL_TOKEN_SEPARATORS);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoResponseFile
+ *
+ * PARAMETERS:  Filename        - Name of the response file
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Open a response file and process all options within.
+ *
+ ******************************************************************************/
+
+static int
+AslDoResponseFile (
+    char                    *Filename)
+{
+    char                    *argv = StringBuffer2;
+    FILE                    *ResponseFile;
+    int                     OptStatus = 0;
+    int                     Opterr;
+    int                     Optind;
+
+
+    ResponseFile = fopen (Filename, "r");
+    if (!ResponseFile)
+    {
+        printf ("Could not open command file %s, %s\n",
+            Filename, strerror (errno));
+        return (-1);
+    }
+
+    /* Must save the current GetOpt globals */
+
+    Opterr = AcpiGbl_Opterr;
+    Optind = AcpiGbl_Optind;
+
+    /*
+     * Process all lines in the response file. There must be one complete
+     * option per line
+     */
+    while (fgets (StringBuffer, ASL_MSG_BUFFER_SIZE, ResponseFile))
+    {
+        /* Compress all tokens, allowing us to use a single argv entry */
+
+        AslMergeOptionTokens (StringBuffer, StringBuffer2);
+
+        /* Process the option */
+
+        AcpiGbl_Opterr = 0;
+        AcpiGbl_Optind = 0;
+
+        OptStatus = AslDoOptions (1, &argv, TRUE);
+        if (OptStatus)
+        {
+            printf ("Invalid option in command file %s: %s\n",
+                Filename, StringBuffer);
+            break;
+        }
+    }
+
+    /* Restore the GetOpt globals */
+
+    AcpiGbl_Opterr = Opterr;
+    AcpiGbl_Optind = Optind;
+
+    fclose (ResponseFile);
+    return (OptStatus);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslparser.y b/usr/src/cmd/acpi/iasl/aslparser.y
new file mode 100644
index 0000000000..b3d83b8392
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslparser.y
@@ -0,0 +1,133 @@
+%{
+/******************************************************************************
+ *
+ * Module Name: aslparser.y - Master Bison/Yacc input file for iASL
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acpi.h"
+#include "accommon.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslparse")
+
+/*
+ * Global Notes:
+ *
+ * October 2005: The following list terms have been optimized (from the
+ * original ASL grammar in the ACPI specification) to force the immediate
+ * reduction of each list item so that the parse stack use doesn't increase on
+ * each list element and possibly overflow on very large lists (>4000 items).
+ * This dramatically reduces use of the parse stack overall.
+ *
+ *      ArgList, TermList, ByteList, DWordList, PackageList,
+ *      ResourceMacroList, and FieldUnitList
+ */
+
+void *
+AslLocalAllocate (
+    unsigned int            Size);
+
+/* Bison/yacc configuration */
+
+#define static
+#undef malloc
+#define malloc              AslLocalAllocate
+#undef alloca
+#define alloca              AslLocalAllocate
+#define yytname             AslCompilername
+
+#define YYINITDEPTH         600             /* State stack depth */
+#define YYDEBUG             1               /* Enable debug output */
+#define YYERROR_VERBOSE     1               /* Verbose error messages */
+#define YYFLAG              -32768
+
+/* Define YYMALLOC/YYFREE to prevent redefinition errors  */
+
+#define YYMALLOC            AslLocalAllocate
+#define YYFREE              ACPI_FREE
+%}
+
+/*
+ * Declare the type of values in the grammar
+ */
+%union {
+    UINT64              i;
+    char                *s;
+    ACPI_PARSE_OBJECT   *n;
+}
+
+/*
+ * These shift/reduce conflicts are expected. There should be zero
+ * reduce/reduce conflicts.
+ */
+%expect 101
+
+/*! [Begin] no source code translation */
+
+/*
+ * The M4 macro processor is used to bring in the parser items,
+ * in order to keep this master file smaller, and to break up
+ * the various parser items.
+ */
+m4_define(NoEcho)
+
+/* Token types */
+
+m4_include(asltokens.y)
+
+/* Production types/names */
+
+m4_include(asltypes.y)
+%%
+
+/* Production rules */
+
+m4_include(aslrules.y)
+m4_include(aslcstyle.y)
+m4_include(aslresources.y)
+%%
+
+/*! [End] no source code translation !*/
+
+/* Local support functions in C */
+
+m4_include(aslsupport.y)
diff --git a/usr/src/cmd/acpi/iasl/aslpld.c b/usr/src/cmd/acpi/iasl/aslpld.c
new file mode 100644
index 0000000000..afc4683527
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslpld.c
@@ -0,0 +1,729 @@
+/******************************************************************************
+ *
+ * Module Name: aslpld - Implementation of ASL ToPLD macro
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslpld")
+
+
+/* Local prototypes */
+
+static UINT8 *
+OpcEncodePldBuffer (
+    ACPI_PLD_INFO           *PldInfo);
+
+static BOOLEAN
+OpcFindName (
+    const char              **List,
+    char                    *Name,
+    UINT32                  *Index);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoPld
+ *
+ * PARAMETERS:  Op                  - Current parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert ToPLD macro to 20-byte buffer
+ *
+ * The ToPLD parse tree looks like this:
+ *
+ *      TOPLD
+ *          PLD_REVISION
+ *              INTEGER
+ *          PLD_IGNORECOLOR
+ *              INTEGER
+ *          ...
+ *          etc.
+ *
+ ******************************************************************************/
+
+void
+OpcDoPld (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PLD_INFO           PldInfo;
+    UINT8                   *Buffer;
+    ACPI_PARSE_OBJECT       *ThisOp;
+    ACPI_PARSE_OBJECT       *NewOp;
+    UINT16                  ParseOpcode;
+    UINT32                  Value;
+
+
+    if (!Op)
+    {
+        AslError (ASL_ERROR, ASL_MSG_NOT_EXIST, Op, NULL);
+        return;
+    }
+
+    if (Op->Asl.ParseOpcode != PARSEOP_TOPLD)
+    {
+        AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, Op, NULL);
+        return;
+    }
+
+    memset (&PldInfo, 0, sizeof (ACPI_PLD_INFO));
+
+    /* Traverse the list of PLD Ops (one per PLD field) */
+
+    ThisOp = Op->Asl.Child;
+    while (ThisOp)
+    {
+        /* Get child values */
+
+        ParseOpcode = ThisOp->Asl.Child->Asl.ParseOpcode;
+        Value = (UINT32) ThisOp->Asl.Child->Asl.Value.Integer;
+
+        switch (ThisOp->Asl.ParseOpcode)
+        {
+        case PARSEOP_PLD_REVISION:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 127)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            PldInfo.Revision = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_IGNORECOLOR:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 1)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            PldInfo.IgnoreColor = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_RED:
+        case PARSEOP_PLD_GREEN:
+        case PARSEOP_PLD_BLUE:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 255)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_RED)
+            {
+                PldInfo.Red = (UINT8) Value;
+            }
+            else if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_GREEN)
+            {
+                PldInfo.Green = (UINT8) Value;
+            }
+            else /* PARSEOP_PLD_BLUE */
+            {
+                PldInfo.Blue = (UINT8) Value;
+            }
+            break;
+
+        case PARSEOP_PLD_WIDTH:
+        case PARSEOP_PLD_HEIGHT:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 65535)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_WIDTH)
+            {
+                PldInfo.Width = (UINT16) Value;
+            }
+            else /* PARSEOP_PLD_HEIGHT */
+            {
+                PldInfo.Height = (UINT16) Value;
+            }
+
+            break;
+
+        case PARSEOP_PLD_USERVISIBLE:
+        case PARSEOP_PLD_DOCK:
+        case PARSEOP_PLD_LID:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 1)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_USERVISIBLE)
+            {
+                PldInfo.UserVisible = (UINT8) Value;
+            }
+            else if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_DOCK)
+            {
+                PldInfo.Dock = (UINT8) Value;
+            }
+            else
+            {
+                PldInfo.Lid = (UINT8) Value;
+            }
+
+            break;
+
+        case PARSEOP_PLD_PANEL:
+
+            if (ParseOpcode == PARSEOP_INTEGER)
+            {
+                if (Value > 6)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                    break;
+                }
+            }
+            else /* PARSEOP_STRING */
+            {
+                if (!OpcFindName (AcpiGbl_PldPanelList,
+                    ThisOp->Asl.Child->Asl.Value.String,
+                    &Value))
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INVALID_OPERAND, ThisOp, NULL);
+                    break;
+                }
+            }
+
+            PldInfo.Panel = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_VERTICALPOSITION:
+
+            if (ParseOpcode == PARSEOP_INTEGER)
+            {
+                if (Value > 2)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                    break;
+                }
+            }
+            else /* PARSEOP_STRING */
+            {
+                if (!OpcFindName (AcpiGbl_PldVerticalPositionList,
+                    ThisOp->Asl.Child->Asl.Value.String,
+                    &Value))
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INVALID_OPERAND, ThisOp, NULL);
+                    break;
+                }
+            }
+
+            PldInfo.VerticalPosition = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_HORIZONTALPOSITION:
+
+            if (ParseOpcode == PARSEOP_INTEGER)
+            {
+                if (Value > 2)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                    break;
+                }
+            }
+            else /* PARSEOP_STRING */
+            {
+                if (!OpcFindName (AcpiGbl_PldHorizontalPositionList,
+                    ThisOp->Asl.Child->Asl.Value.String,
+                    &Value))
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INVALID_OPERAND, ThisOp, NULL);
+                    break;
+                }
+            }
+
+            PldInfo.HorizontalPosition = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_SHAPE:
+
+            if (ParseOpcode == PARSEOP_INTEGER)
+            {
+                if (Value > 8)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                    break;
+                }
+            }
+            else /* PARSEOP_STRING */
+            {
+                if (!OpcFindName (AcpiGbl_PldShapeList,
+                    ThisOp->Asl.Child->Asl.Value.String,
+                    &Value))
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INVALID_OPERAND, ThisOp, NULL);
+                    break;
+                }
+            }
+
+            PldInfo.Shape = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_GROUPORIENTATION:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 1)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            PldInfo.GroupOrientation = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_GROUPTOKEN:
+        case PARSEOP_PLD_GROUPPOSITION:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 255)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_GROUPTOKEN)
+            {
+                PldInfo.GroupToken = (UINT8) Value;
+            }
+            else /* PARSEOP_PLD_GROUPPOSITION */
+            {
+                PldInfo.GroupPosition = (UINT8) Value;
+            }
+
+            break;
+
+        case PARSEOP_PLD_BAY:
+        case PARSEOP_PLD_EJECTABLE:
+        case PARSEOP_PLD_EJECTREQUIRED:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 1)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_BAY)
+            {
+                PldInfo.Bay = (UINT8) Value;
+            }
+            else if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_EJECTABLE)
+            {
+                PldInfo.Ejectable = (UINT8) Value;
+            }
+            else /* PARSEOP_PLD_EJECTREQUIRED */
+            {
+                PldInfo.OspmEjectRequired = (UINT8) Value;
+            }
+
+            break;
+
+        case PARSEOP_PLD_CABINETNUMBER:
+        case PARSEOP_PLD_CARDCAGENUMBER:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 255)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_CABINETNUMBER)
+            {
+                PldInfo.CabinetNumber = (UINT8) Value;
+            }
+            else /* PARSEOP_PLD_CARDCAGENUMBER */
+            {
+                PldInfo.CardCageNumber = (UINT8) Value;
+            }
+
+            break;
+
+        case PARSEOP_PLD_REFERENCE:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 1)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            PldInfo.Reference = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_ROTATION:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 7)
+            {
+                switch (Value)
+                {
+                case 45:
+
+                    Value = 1;
+                    break;
+
+                case 90:
+
+                    Value = 2;
+                    break;
+
+                case 135:
+
+                    Value = 3;
+                    break;
+
+                case 180:
+
+                    Value = 4;
+                    break;
+
+                case 225:
+
+                    Value = 5;
+                    break;
+
+                case 270:
+
+                    Value = 6;
+                    break;
+
+                case 315:
+
+                    Value = 7;
+                    break;
+
+                default:
+
+                    AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                    break;
+                }
+            }
+
+            PldInfo.Rotation = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_ORDER:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 31)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            PldInfo.Order = (UINT8) Value;
+            break;
+
+        case PARSEOP_PLD_VERTICALOFFSET:
+        case PARSEOP_PLD_HORIZONTALOFFSET:
+
+            if (ParseOpcode != PARSEOP_INTEGER)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+                break;
+            }
+
+            if (Value > 65535)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RANGE, ThisOp, NULL);
+                break;
+            }
+
+            if (ThisOp->Asl.ParseOpcode == PARSEOP_PLD_VERTICALOFFSET)
+            {
+                PldInfo.VerticalOffset = (UINT16) Value;
+            }
+            else /* PARSEOP_PLD_HORIZONTALOFFSET */
+            {
+                PldInfo.HorizontalOffset = (UINT16) Value;
+            }
+
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, ThisOp, NULL);
+            break;
+        }
+
+        ThisOp = ThisOp->Asl.Next;
+    }
+
+    Buffer = OpcEncodePldBuffer (&PldInfo);
+
+    /* Change Op to a Buffer */
+
+    Op->Asl.ParseOpcode = PARSEOP_BUFFER;
+    Op->Common.AmlOpcode = AML_BUFFER_OP;
+
+    /* Disable further optimization */
+
+    Op->Asl.CompileFlags &= ~NODE_COMPILE_TIME_CONST;
+    UtSetParseOpName (Op);
+
+    /* Child node is the buffer length */
+
+    NewOp = TrAllocateNode (PARSEOP_INTEGER);
+
+    NewOp->Asl.AmlOpcode = AML_BYTE_OP;
+    NewOp->Asl.Value.Integer = 20;
+    NewOp->Asl.Parent = Op;
+
+    Op->Asl.Child = NewOp;
+    Op = NewOp;
+
+    /* Peer to the child is the raw buffer data */
+
+    NewOp = TrAllocateNode (PARSEOP_RAW_DATA);
+    NewOp->Asl.AmlOpcode = AML_RAW_DATA_BUFFER;
+    NewOp->Asl.AmlLength = 20;
+    NewOp->Asl.Value.String = ACPI_CAST_PTR (char, Buffer);
+    NewOp->Asl.Parent = Op->Asl.Parent;
+
+    Op->Asl.Next = NewOp;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcEncodePldBuffer
+ *
+ * PARAMETERS:  PldInfo             - _PLD buffer struct (Using local struct)
+ *
+ * RETURN:      Encode _PLD buffer suitable for return value from _PLD
+ *
+ * DESCRIPTION: Bit-packs a _PLD buffer struct.
+ *
+ ******************************************************************************/
+
+static UINT8 *
+OpcEncodePldBuffer (
+    ACPI_PLD_INFO           *PldInfo)
+{
+    UINT32                  *Buffer;
+    UINT32                  Dword;
+
+
+    Buffer = ACPI_ALLOCATE_ZEROED (ACPI_PLD_BUFFER_SIZE);
+    if (!Buffer)
+    {
+        return (NULL);
+    }
+
+    /* First 32 bits */
+
+    Dword = 0;
+    ACPI_PLD_SET_REVISION       (&Dword, PldInfo->Revision);
+    ACPI_PLD_SET_IGNORE_COLOR   (&Dword, PldInfo->IgnoreColor);
+    ACPI_PLD_SET_RED            (&Dword, PldInfo->Red);
+    ACPI_PLD_SET_GREEN          (&Dword, PldInfo->Green);
+    ACPI_PLD_SET_BLUE           (&Dword, PldInfo->Blue);
+    ACPI_MOVE_32_TO_32          (&Buffer[0], &Dword);
+
+    /* Second 32 bits */
+
+    Dword = 0;
+    ACPI_PLD_SET_WIDTH          (&Dword, PldInfo->Width);
+    ACPI_PLD_SET_HEIGHT         (&Dword, PldInfo->Height);
+    ACPI_MOVE_32_TO_32          (&Buffer[1], &Dword);
+
+    /* Third 32 bits */
+
+    Dword = 0;
+    ACPI_PLD_SET_USER_VISIBLE   (&Dword, PldInfo->UserVisible);
+    ACPI_PLD_SET_DOCK           (&Dword, PldInfo->Dock);
+    ACPI_PLD_SET_LID            (&Dword, PldInfo->Lid);
+    ACPI_PLD_SET_PANEL          (&Dword, PldInfo->Panel);
+    ACPI_PLD_SET_VERTICAL       (&Dword, PldInfo->VerticalPosition);
+    ACPI_PLD_SET_HORIZONTAL     (&Dword, PldInfo->HorizontalPosition);
+    ACPI_PLD_SET_SHAPE          (&Dword, PldInfo->Shape);
+    ACPI_PLD_SET_ORIENTATION    (&Dword, PldInfo->GroupOrientation);
+    ACPI_PLD_SET_TOKEN          (&Dword, PldInfo->GroupToken);
+    ACPI_PLD_SET_POSITION       (&Dword, PldInfo->GroupPosition);
+    ACPI_PLD_SET_BAY            (&Dword, PldInfo->Bay);
+    ACPI_MOVE_32_TO_32          (&Buffer[2], &Dword);
+
+    /* Fourth 32 bits */
+
+    Dword = 0;
+    ACPI_PLD_SET_EJECTABLE      (&Dword, PldInfo->Ejectable);
+    ACPI_PLD_SET_OSPM_EJECT     (&Dword, PldInfo->OspmEjectRequired);
+    ACPI_PLD_SET_CABINET        (&Dword, PldInfo->CabinetNumber);
+    ACPI_PLD_SET_CARD_CAGE      (&Dword, PldInfo->CardCageNumber);
+    ACPI_PLD_SET_REFERENCE      (&Dword, PldInfo->Reference);
+    ACPI_PLD_SET_ROTATION       (&Dword, PldInfo->Rotation);
+    ACPI_PLD_SET_ORDER          (&Dword, PldInfo->Order);
+    ACPI_MOVE_32_TO_32          (&Buffer[3], &Dword);
+
+    /* Revision 2 adds an additional DWORD */
+
+    if (PldInfo->Revision >= 2)
+    {
+        /* Fifth 32 bits */
+
+        Dword = 0;
+        ACPI_PLD_SET_VERT_OFFSET    (&Dword, PldInfo->VerticalOffset);
+        ACPI_PLD_SET_HORIZ_OFFSET   (&Dword, PldInfo->HorizontalOffset);
+        ACPI_MOVE_32_TO_32          (&Buffer[4], &Dword);
+    }
+
+    return (ACPI_CAST_PTR (UINT8, Buffer));
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcFindName
+ *
+ * PARAMETERS:  List                - Array of char strings to be searched
+ *              Name                - Char string to string for
+ *              Index               - Index value to set if found
+ *
+ * RETURN:      TRUE if any names matched, FALSE otherwise
+ *
+ * DESCRIPTION: Match PLD name to value in lookup table. Sets Value to
+ *              equivalent parameter value.
+ *
+ ******************************************************************************/
+
+static BOOLEAN
+OpcFindName (
+    const char              **List,
+    char                    *Name,
+    UINT32                  *Index)
+{
+    const char              *NameString;
+    UINT32                  i;
+
+
+    AcpiUtStrupr (Name);
+
+    for (i = 0, NameString = List[0];
+            NameString;
+            i++, NameString = List[i])
+    {
+        if (!(strncmp (NameString, Name, strlen (Name))))
+        {
+            *Index = i;
+            return (TRUE);
+        }
+    }
+
+    return (FALSE);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslpredef.c b/usr/src/cmd/acpi/iasl/aslpredef.c
new file mode 100644
index 0000000000..1aa627b251
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslpredef.c
@@ -0,0 +1,788 @@
+/******************************************************************************
+ *
+ * Module Name: aslpredef - support for ACPI predefined names
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#define ACPI_CREATE_PREDEFINED_TABLE
+#define ACPI_CREATE_RESOURCE_TABLE
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acpredef.h"
+#include "acnamesp.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslpredef")
+
+
+/* Local prototypes */
+
+static void
+ApCheckForUnexpectedReturnValue (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo);
+
+static UINT32
+ApCheckForSpecialName (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckForPredefinedMethod
+ *
+ * PARAMETERS:  Op              - A parse node of type "METHOD".
+ *              MethodInfo      - Saved info about this method
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: If method is a predefined name, check that the number of
+ *              arguments and the return type (returns a value or not)
+ *              is correct.
+ *
+ ******************************************************************************/
+
+BOOLEAN
+ApCheckForPredefinedMethod (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo)
+{
+    UINT32                      Index;
+    UINT32                      RequiredArgCount;
+    const ACPI_PREDEFINED_INFO  *ThisName;
+
+
+    /* Check for a match against the predefined name list */
+
+    Index = ApCheckForPredefinedName (Op, Op->Asl.NameSeg);
+
+    switch (Index)
+    {
+    case ACPI_NOT_RESERVED_NAME:        /* No underscore or _Txx or _xxx name not matched */
+    case ACPI_PREDEFINED_NAME:          /* Resource Name or reserved scope name */
+    case ACPI_COMPILER_RESERVED_NAME:   /* A _Txx that was not emitted by compiler */
+
+        /* Just return, nothing to do */
+        return (FALSE);
+
+
+    case ACPI_EVENT_RESERVED_NAME:      /* _Lxx/_Exx/_Wxx/_Qxx methods */
+
+        Gbl_ReservedMethods++;
+
+        /* NumArguments must be zero for all _Lxx/_Exx/_Wxx/_Qxx methods */
+
+        if (MethodInfo->NumArguments != 0)
+        {
+            sprintf (MsgBuffer, "%s requires %u", Op->Asl.ExternalName, 0);
+
+            AslError (ASL_WARNING, ASL_MSG_RESERVED_ARG_COUNT_HI, Op,
+                MsgBuffer);
+        }
+        break;
+
+
+    default:
+        /*
+         * Matched a predefined method name - validate the ASL-defined
+         * argument count against the ACPI specification.
+         *
+         * Some methods are allowed to have a "minimum" number of args
+         * (_SCP) because their definition in ACPI has changed over time.
+         */
+        Gbl_ReservedMethods++;
+        ThisName = &AcpiGbl_PredefinedMethods[Index];
+        RequiredArgCount = METHOD_GET_ARG_COUNT (ThisName->Info.ArgumentList);
+
+        if (MethodInfo->NumArguments != RequiredArgCount)
+        {
+            sprintf (MsgBuffer, "%4.4s requires %u",
+                ThisName->Info.Name, RequiredArgCount);
+
+            if (MethodInfo->NumArguments < RequiredArgCount)
+            {
+                AslError (ASL_WARNING, ASL_MSG_RESERVED_ARG_COUNT_LO, Op,
+                    MsgBuffer);
+            }
+            else if ((MethodInfo->NumArguments > RequiredArgCount) &&
+                !(ThisName->Info.ArgumentList & ARG_COUNT_IS_MINIMUM))
+            {
+                AslError (ASL_WARNING, ASL_MSG_RESERVED_ARG_COUNT_HI, Op,
+                    MsgBuffer);
+            }
+        }
+
+        /*
+         * Check if method returns no value, but the predefined name is
+         * required to return a value
+         */
+        if (MethodInfo->NumReturnNoValue &&
+            ThisName->Info.ExpectedBtypes)
+        {
+            AcpiUtGetExpectedReturnTypes (StringBuffer,
+                ThisName->Info.ExpectedBtypes);
+
+            sprintf (MsgBuffer, "%s required for %4.4s",
+                StringBuffer, ThisName->Info.Name);
+
+            AslError (ASL_WARNING, ASL_MSG_RESERVED_RETURN_VALUE, Op,
+                MsgBuffer);
+        }
+        break;
+    }
+
+    return (TRUE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckForUnexpectedReturnValue
+ *
+ * PARAMETERS:  Op              - A parse node of type "RETURN".
+ *              MethodInfo      - Saved info about this method
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check for an unexpected return value from a predefined method.
+ *              Invoked for predefined methods that are defined to not return
+ *              any value. If there is a return value, issue a remark, since
+ *              the ASL writer may be confused as to the method definition
+ *              and/or functionality.
+ *
+ * Note: We ignore all return values of "Zero", since this is what a standalone
+ *       Return() statement will always generate -- so we ignore it here --
+ *       i.e., there is no difference between Return() and Return(Zero).
+ *       Also, a null Return() will be disassembled to return(Zero) -- so, we
+ *       don't want to generate extraneous remarks/warnings for a disassembled
+ *       ASL file.
+ *
+ ******************************************************************************/
+
+static void
+ApCheckForUnexpectedReturnValue (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo)
+{
+    ACPI_PARSE_OBJECT       *ReturnValueOp;
+
+
+    /* Ignore Return() and Return(Zero) (they are the same) */
+
+    ReturnValueOp = Op->Asl.Child;
+    if (ReturnValueOp->Asl.ParseOpcode == PARSEOP_ZERO)
+    {
+        return;
+    }
+
+    /* We have a valid return value, but the reserved name did not expect it */
+
+    AslError (ASL_WARNING, ASL_MSG_RESERVED_NO_RETURN_VAL,
+        Op, MethodInfo->Op->Asl.ExternalName);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckPredefinedReturnValue
+ *
+ * PARAMETERS:  Op              - A parse node of type "RETURN".
+ *              MethodInfo      - Saved info about this method
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: If method is a predefined name, attempt to validate the return
+ *              value. Only "static" types can be validated - a simple return
+ *              of an integer/string/buffer/package or a named reference to
+ *              a static object. Values such as a Localx or Argx or a control
+ *              method invocation are not checked. Issue a warning if there is
+ *              a valid return value, but the reserved method defines no
+ *              return value.
+ *
+ ******************************************************************************/
+
+void
+ApCheckPredefinedReturnValue (
+    ACPI_PARSE_OBJECT       *Op,
+    ASL_METHOD_INFO         *MethodInfo)
+{
+    UINT32                      Index;
+    ACPI_PARSE_OBJECT           *ReturnValueOp;
+    const ACPI_PREDEFINED_INFO  *ThisName;
+
+
+    /*
+     * Check parent method for a match against the predefined name list.
+     *
+     * Note: Disable compiler errors/warnings because any errors will be
+     * caught when analyzing the parent method. Eliminates duplicate errors.
+     */
+    Gbl_AllExceptionsDisabled = TRUE;
+    Index = ApCheckForPredefinedName (MethodInfo->Op,
+        MethodInfo->Op->Asl.NameSeg);
+    Gbl_AllExceptionsDisabled = FALSE;
+
+    switch (Index)
+    {
+    case ACPI_EVENT_RESERVED_NAME:      /* _Lxx/_Exx/_Wxx/_Qxx methods */
+
+        /* No return value expected, warn if there is one */
+
+        ApCheckForUnexpectedReturnValue (Op, MethodInfo);
+        return;
+
+    case ACPI_NOT_RESERVED_NAME:        /* No underscore or _Txx or _xxx name not matched */
+    case ACPI_PREDEFINED_NAME:          /* Resource Name or reserved scope name */
+    case ACPI_COMPILER_RESERVED_NAME:   /* A _Txx that was not emitted by compiler */
+
+        /* Just return, nothing to do */
+        return;
+
+    default: /* A standard predefined ACPI name */
+
+        ThisName = &AcpiGbl_PredefinedMethods[Index];
+        if (!ThisName->Info.ExpectedBtypes)
+        {
+            /* No return value expected, warn if there is one */
+
+            ApCheckForUnexpectedReturnValue (Op, MethodInfo);
+            return;
+        }
+
+        /* Get the object returned, it is the next argument */
+
+        ReturnValueOp = Op->Asl.Child;
+        switch (ReturnValueOp->Asl.ParseOpcode)
+        {
+        case PARSEOP_ZERO:
+        case PARSEOP_ONE:
+        case PARSEOP_ONES:
+        case PARSEOP_INTEGER:
+        case PARSEOP_STRING_LITERAL:
+        case PARSEOP_BUFFER:
+        case PARSEOP_PACKAGE:
+
+            /* Static data return object - check against expected type */
+
+            ApCheckObjectType (ThisName->Info.Name, ReturnValueOp,
+                ThisName->Info.ExpectedBtypes, ACPI_NOT_PACKAGE_ELEMENT);
+
+            /* For packages, check the individual package elements */
+
+            if (ReturnValueOp->Asl.ParseOpcode == PARSEOP_PACKAGE)
+            {
+                ApCheckPackage (ReturnValueOp, ThisName);
+            }
+            break;
+
+        default:
+            /*
+             * All other ops are very difficult or impossible to typecheck at
+             * compile time. These include all Localx, Argx, and method
+             * invocations. Also, NAMESEG and NAMESTRING because the type of
+             * any named object can be changed at runtime (for example,
+             * CopyObject will change the type of the target object.)
+             */
+            break;
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckForPredefinedObject
+ *
+ * PARAMETERS:  Op              - A parse node
+ *              Name            - The ACPI name to be checked
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check for a predefined name for a static object (created via
+ *              the ASL Name operator). If it is a predefined ACPI name, ensure
+ *              that the name does not require any arguments (which would
+ *              require a control method implemenation of the name), and that
+ *              the type of the object is one of the expected types for the
+ *              predefined name.
+ *
+ ******************************************************************************/
+
+void
+ApCheckForPredefinedObject (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name)
+{
+    UINT32                      Index;
+    ACPI_PARSE_OBJECT           *ObjectOp;
+    const ACPI_PREDEFINED_INFO  *ThisName;
+
+
+    /*
+     * Check for a real predefined name -- not a resource descriptor name
+     * or a predefined scope name
+     */
+    Index = ApCheckForPredefinedName (Op, Name);
+
+    switch (Index)
+    {
+    case ACPI_NOT_RESERVED_NAME:        /* No underscore or _Txx or _xxx name not matched */
+    case ACPI_PREDEFINED_NAME:          /* Resource Name or reserved scope name */
+    case ACPI_COMPILER_RESERVED_NAME:   /* A _Txx that was not emitted by compiler */
+
+        /* Nothing to do */
+        return;
+
+    case ACPI_EVENT_RESERVED_NAME:      /* _Lxx/_Exx/_Wxx/_Qxx methods */
+
+        /*
+         * These names must be control methods, by definition in ACPI spec.
+         * Also because they are defined to return no value. None of them
+         * require any arguments.
+         */
+        AslError (ASL_ERROR, ASL_MSG_RESERVED_METHOD, Op,
+            "with zero arguments");
+        return;
+
+    default:
+
+        break;
+    }
+
+    /* A standard predefined ACPI name */
+
+    /*
+     * If this predefined name requires input arguments, then
+     * it must be implemented as a control method
+     */
+    ThisName = &AcpiGbl_PredefinedMethods[Index];
+    if (METHOD_GET_ARG_COUNT (ThisName->Info.ArgumentList) > 0)
+    {
+        AslError (ASL_ERROR, ASL_MSG_RESERVED_METHOD, Op,
+            "with arguments");
+        return;
+    }
+
+    /*
+     * If no return value is expected from this predefined name, then
+     * it follows that it must be implemented as a control method
+     * (with zero args, because the args > 0 case was handled above)
+     * Examples are: _DIS, _INI, _IRC, _OFF, _ON, _PSx
+     */
+    if (!ThisName->Info.ExpectedBtypes)
+    {
+        AslError (ASL_ERROR, ASL_MSG_RESERVED_METHOD, Op,
+            "with zero arguments");
+        return;
+    }
+
+    /* Typecheck the actual object, it is the next argument */
+
+    ObjectOp = Op->Asl.Child->Asl.Next;
+    ApCheckObjectType (ThisName->Info.Name, Op->Asl.Child->Asl.Next,
+        ThisName->Info.ExpectedBtypes, ACPI_NOT_PACKAGE_ELEMENT);
+
+    /* For packages, check the individual package elements */
+
+    if (ObjectOp->Asl.ParseOpcode == PARSEOP_PACKAGE)
+    {
+        ApCheckPackage (ObjectOp, ThisName);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckForPredefinedName
+ *
+ * PARAMETERS:  Op              - A parse node
+ *              Name            - NameSeg to check
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check a NameSeg against the reserved list.
+ *
+ ******************************************************************************/
+
+UINT32
+ApCheckForPredefinedName (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name)
+{
+    UINT32                      i;
+    const ACPI_PREDEFINED_INFO  *ThisName;
+
+
+    if (Name[0] == 0)
+    {
+        AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL, Op,
+            "zero length name found");
+    }
+
+    /* All reserved names are prefixed with a single underscore */
+
+    if (Name[0] != '_')
+    {
+        return (ACPI_NOT_RESERVED_NAME);
+    }
+
+    /* Check for a standard predefined method name */
+
+    ThisName = AcpiGbl_PredefinedMethods;
+    for (i = 0; ThisName->Info.Name[0]; i++)
+    {
+        if (ACPI_COMPARE_NAME (Name, ThisName->Info.Name))
+        {
+            /* Return index into predefined array */
+            return (i);
+        }
+
+        ThisName++; /* Does not account for extra package data, but is OK */
+    }
+
+    /* Check for resource names and predefined scope names */
+
+    ThisName = AcpiGbl_ResourceNames;
+    while (ThisName->Info.Name[0])
+    {
+        if (ACPI_COMPARE_NAME (Name, ThisName->Info.Name))
+        {
+            return (ACPI_PREDEFINED_NAME);
+        }
+
+        ThisName++;
+    }
+
+    ThisName = AcpiGbl_ScopeNames;
+    while (ThisName->Info.Name[0])
+    {
+        if (ACPI_COMPARE_NAME (Name, ThisName->Info.Name))
+        {
+            return (ACPI_PREDEFINED_NAME);
+        }
+
+        ThisName++;
+    }
+
+    /* Check for _Lxx/_Exx/_Wxx/_Qxx/_T_x. Warning if unknown predefined name */
+
+    return (ApCheckForSpecialName (Op, Name));
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckForSpecialName
+ *
+ * PARAMETERS:  Op              - A parse node
+ *              Name            - NameSeg to check
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check for the "special" predefined names -
+ *              _Lxx, _Exx, _Qxx, _Wxx, and _T_x
+ *
+ ******************************************************************************/
+
+static UINT32
+ApCheckForSpecialName (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name)
+{
+
+    /*
+     * Check for the "special" predefined names. We already know that the
+     * first character is an underscore.
+     *   GPE:  _Lxx
+     *   GPE:  _Exx
+     *   GPE:  _Wxx
+     *   EC:   _Qxx
+     */
+    if ((Name[1] == 'L') ||
+        (Name[1] == 'E') ||
+        (Name[1] == 'W') ||
+        (Name[1] == 'Q'))
+    {
+        /* The next two characters must be hex digits */
+
+        if ((isxdigit ((int) Name[2])) &&
+            (isxdigit ((int) Name[3])))
+        {
+            return (ACPI_EVENT_RESERVED_NAME);
+        }
+    }
+
+    /* Check for the names reserved for the compiler itself: _T_x */
+
+    else if ((Op->Asl.ExternalName[1] == 'T') &&
+             (Op->Asl.ExternalName[2] == '_'))
+    {
+        /* Ignore if actually emitted by the compiler */
+
+        if (Op->Asl.CompileFlags & NODE_COMPILER_EMITTED)
+        {
+            return (ACPI_NOT_RESERVED_NAME);
+        }
+
+        /*
+         * Was not actually emitted by the compiler. This is a special case,
+         * however. If the ASL code being compiled was the result of a
+         * dissasembly, it may possibly contain valid compiler-emitted names
+         * of the form "_T_x". We don't want to issue an error or even a
+         * warning and force the user to manually change the names. So, we
+         * will issue a remark instead.
+         */
+        AslError (ASL_REMARK, ASL_MSG_COMPILER_RESERVED,
+            Op, Op->Asl.ExternalName);
+        return (ACPI_COMPILER_RESERVED_NAME);
+    }
+
+    /*
+     * The name didn't match any of the known predefined names. Flag it as a
+     * warning, since the entire namespace starting with an underscore is
+     * reserved by the ACPI spec.
+     */
+    AslError (ASL_WARNING, ASL_MSG_UNKNOWN_RESERVED_NAME,
+        Op, Op->Asl.ExternalName);
+
+    return (ACPI_NOT_RESERVED_NAME);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckObjectType
+ *
+ * PARAMETERS:  PredefinedName  - Name of the predefined object we are checking
+ *              Op              - Current parse node
+ *              ExpectedBtypes  - Bitmap of expected return type(s)
+ *              PackageIndex    - Index of object within parent package (if
+ *                                applicable - ACPI_NOT_PACKAGE_ELEMENT
+ *                                otherwise)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check if the object type is one of the types that is expected
+ *              by the predefined name. Only a limited number of object types
+ *              can be returned by the predefined names.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+ApCheckObjectType (
+    const char              *PredefinedName,
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  ExpectedBtypes,
+    UINT32                  PackageIndex)
+{
+    UINT32                  ReturnBtype;
+    char                    *TypeName;
+
+
+    if (!Op)
+    {
+        return (AE_TYPE);
+    }
+
+    /* Map the parse opcode to a bitmapped return type (RTYPE) */
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_ZERO:
+    case PARSEOP_ONE:
+    case PARSEOP_ONES:
+    case PARSEOP_INTEGER:
+
+        ReturnBtype = ACPI_RTYPE_INTEGER;
+        TypeName = "Integer";
+        break;
+
+    case PARSEOP_STRING_LITERAL:
+
+        ReturnBtype = ACPI_RTYPE_STRING;
+        TypeName = "String";
+        break;
+
+    case PARSEOP_BUFFER:
+
+        ReturnBtype = ACPI_RTYPE_BUFFER;
+        TypeName = "Buffer";
+        break;
+
+    case PARSEOP_PACKAGE:
+    case PARSEOP_VAR_PACKAGE:
+
+        ReturnBtype = ACPI_RTYPE_PACKAGE;
+        TypeName = "Package";
+        break;
+
+    case PARSEOP_NAMESEG:
+    case PARSEOP_NAMESTRING:
+        /*
+         * Ignore any named references within a package object.
+         *
+         * For Package objects, references are allowed instead of any of the
+         * standard data types (Integer/String/Buffer/Package). These
+         * references are resolved at runtime. NAMESEG and NAMESTRING are
+         * impossible to typecheck at compile time because the type of
+         * any named object can be changed at runtime (for example,
+         * CopyObject will change the type of the target object).
+         */
+        if (PackageIndex != ACPI_NOT_PACKAGE_ELEMENT)
+        {
+            return (AE_OK);
+        }
+
+        ReturnBtype = ACPI_RTYPE_REFERENCE;
+        TypeName = "Reference";
+        break;
+
+    default:
+
+        /* Not one of the supported object types */
+
+        TypeName = UtGetOpName (Op->Asl.ParseOpcode);
+        goto TypeErrorExit;
+    }
+
+    /* Exit if the object is one of the expected types */
+
+    if (ReturnBtype & ExpectedBtypes)
+    {
+        return (AE_OK);
+    }
+
+
+TypeErrorExit:
+
+    /* Format the expected types and emit an error message */
+
+    AcpiUtGetExpectedReturnTypes (StringBuffer, ExpectedBtypes);
+
+    if (PackageIndex == ACPI_NOT_PACKAGE_ELEMENT)
+    {
+        sprintf (MsgBuffer, "%4.4s: found %s, %s required",
+            PredefinedName, TypeName, StringBuffer);
+    }
+    else
+    {
+        sprintf (MsgBuffer, "%4.4s: found %s at index %u, %s required",
+            PredefinedName, TypeName, PackageIndex, StringBuffer);
+    }
+
+    AslError (ASL_ERROR, ASL_MSG_RESERVED_OPERAND_TYPE, Op, MsgBuffer);
+    return (AE_TYPE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApDisplayReservedNames
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump information about the ACPI predefined names and predefined
+ *              resource descriptor names.
+ *
+ ******************************************************************************/
+
+void
+ApDisplayReservedNames (
+    void)
+{
+    const ACPI_PREDEFINED_INFO  *ThisName;
+    UINT32                      Count;
+    UINT32                      NumTypes;
+
+
+    /*
+     * Predefined names/methods
+     */
+    printf ("\nPredefined Name Information\n\n");
+
+    Count = 0;
+    ThisName = AcpiGbl_PredefinedMethods;
+    while (ThisName->Info.Name[0])
+    {
+        AcpiUtDisplayPredefinedMethod (MsgBuffer, ThisName, FALSE);
+        Count++;
+        ThisName = AcpiUtGetNextPredefinedMethod (ThisName);
+    }
+
+    printf ("%u Predefined Names are recognized\n", Count);
+
+    /*
+     * Resource Descriptor names
+     */
+    printf ("\nPredefined Names for Resource Descriptor Fields\n\n");
+
+    Count = 0;
+    ThisName = AcpiGbl_ResourceNames;
+    while (ThisName->Info.Name[0])
+    {
+        NumTypes = AcpiUtGetResourceBitWidth (MsgBuffer,
+            ThisName->Info.ArgumentList);
+
+        printf ("%4.4s    Field is %s bits wide%s\n",
+            ThisName->Info.Name, MsgBuffer,
+            (NumTypes > 1) ? " (depending on descriptor type)" : "");
+
+        Count++;
+        ThisName++;
+    }
+
+    printf ("%u Resource Descriptor Field Names are recognized\n", Count);
+
+    /*
+     * Predefined scope names
+     */
+    printf ("\nPredefined Scope/Device Names (automatically created at root)\n\n");
+
+    ThisName = AcpiGbl_ScopeNames;
+    while (ThisName->Info.Name[0])
+    {
+        printf ("%4.4s    Scope/Device\n", ThisName->Info.Name);
+        ThisName++;
+    }
+}
diff --git a/usr/src/cmd/acpi/iasl/aslprepkg.c b/usr/src/cmd/acpi/iasl/aslprepkg.c
new file mode 100644
index 0000000000..824a0c5c77
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslprepkg.c
@@ -0,0 +1,874 @@
+/******************************************************************************
+ *
+ * Module Name: aslprepkg - support for ACPI predefined name package objects
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acpredef.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslprepkg")
+
+
+/* Local prototypes */
+
+static ACPI_PARSE_OBJECT *
+ApCheckPackageElements (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *Op,
+    UINT8                       Type1,
+    UINT32                      Count1,
+    UINT8                       Type2,
+    UINT32                      Count2);
+
+static void
+ApCheckPackageList (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *ParentOp,
+    const ACPI_PREDEFINED_INFO  *Package,
+    UINT32                      StartIndex,
+    UINT32                      Count);
+
+static void
+ApPackageTooSmall (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *Op,
+    UINT32                      Count,
+    UINT32                      ExpectedCount);
+
+static void
+ApZeroLengthPackage (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *Op);
+
+static void
+ApPackageTooLarge (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *Op,
+    UINT32                      Count,
+    UINT32                      ExpectedCount);
+
+static void
+ApCustomPackage (
+    ACPI_PARSE_OBJECT           *ParentOp,
+    const ACPI_PREDEFINED_INFO  *Predefined);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckPackage
+ *
+ * PARAMETERS:  ParentOp            - Parser op for the package
+ *              Predefined          - Pointer to package-specific info for
+ *                                    the method
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Top-level validation for predefined name return package
+ *              objects.
+ *
+ ******************************************************************************/
+
+void
+ApCheckPackage (
+    ACPI_PARSE_OBJECT           *ParentOp,
+    const ACPI_PREDEFINED_INFO  *Predefined)
+{
+    ACPI_PARSE_OBJECT           *Op;
+    const ACPI_PREDEFINED_INFO  *Package;
+    ACPI_STATUS                 Status;
+    UINT32                      ExpectedCount;
+    UINT32                      Count;
+    UINT32                      i;
+
+
+    /* The package info for this name is in the next table entry */
+
+    Package = Predefined + 1;
+
+    /* First child is the package length */
+
+    Op = ParentOp->Asl.Child;
+    Count = (UINT32) Op->Asl.Value.Integer;
+
+    /*
+     * Many of the variable-length top-level packages are allowed to simply
+     * have zero elements. This allows the BIOS to tell the host that even
+     * though the predefined name/method exists, the feature is not supported.
+     * Other package types require one or more elements. In any case, there
+     * is no need to continue validation.
+     */
+    if (!Count)
+    {
+        switch (Package->RetInfo.Type)
+        {
+        case ACPI_PTYPE1_FIXED:
+        case ACPI_PTYPE1_OPTION:
+        case ACPI_PTYPE2_PKG_COUNT:
+        case ACPI_PTYPE2_REV_FIXED:
+
+            ApZeroLengthPackage (Predefined->Info.Name, ParentOp);
+            break;
+
+        case ACPI_PTYPE1_VAR:
+        case ACPI_PTYPE2:
+        case ACPI_PTYPE2_COUNT:
+        case ACPI_PTYPE2_FIXED:
+        case ACPI_PTYPE2_MIN:
+        case ACPI_PTYPE2_FIX_VAR:
+        case ACPI_PTYPE2_VAR_VAR:
+        default:
+
+            break;
+        }
+
+        return;
+    }
+
+    /* Get the first element of the package */
+
+    Op = Op->Asl.Next;
+
+    /* Decode the package type */
+
+    switch (Package->RetInfo.Type)
+    {
+    case ACPI_PTYPE_CUSTOM:
+
+        ApCustomPackage (ParentOp, Predefined);
+        break;
+
+    case ACPI_PTYPE1_FIXED:
+        /*
+         * The package count is fixed and there are no subpackages
+         *
+         * If package is too small, exit.
+         * If package is larger than expected, issue warning but continue
+         */
+        ExpectedCount = Package->RetInfo.Count1 + Package->RetInfo.Count2;
+        if (Count < ExpectedCount)
+        {
+            goto PackageTooSmall;
+        }
+        else if (Count > ExpectedCount)
+        {
+            ApPackageTooLarge (Predefined->Info.Name, ParentOp,
+                Count, ExpectedCount);
+        }
+
+        /* Validate all elements of the package */
+
+        ApCheckPackageElements (Predefined->Info.Name, Op,
+            Package->RetInfo.ObjectType1, Package->RetInfo.Count1,
+            Package->RetInfo.ObjectType2, Package->RetInfo.Count2);
+        break;
+
+    case ACPI_PTYPE1_VAR:
+        /*
+         * The package count is variable, there are no subpackages,
+         * and all elements must be of the same type
+         */
+        for (i = 0; i < Count; i++)
+        {
+            ApCheckObjectType (Predefined->Info.Name, Op,
+                Package->RetInfo.ObjectType1, i);
+            Op = Op->Asl.Next;
+        }
+        break;
+
+    case ACPI_PTYPE1_OPTION:
+        /*
+         * The package count is variable, there are no subpackages.
+         * There are a fixed number of required elements, and a variable
+         * number of optional elements.
+         *
+         * Check if package is at least as large as the minimum required
+         */
+        ExpectedCount = Package->RetInfo3.Count;
+        if (Count < ExpectedCount)
+        {
+            goto PackageTooSmall;
+        }
+
+        /* Variable number of sub-objects */
+
+        for (i = 0; i < Count; i++)
+        {
+            if (i < Package->RetInfo3.Count)
+            {
+                /* These are the required package elements (0, 1, or 2) */
+
+                ApCheckObjectType (Predefined->Info.Name, Op,
+                    Package->RetInfo3.ObjectType[i], i);
+            }
+            else
+            {
+                /* These are the optional package elements */
+
+                ApCheckObjectType (Predefined->Info.Name, Op,
+                    Package->RetInfo3.TailObjectType, i);
+            }
+
+            Op = Op->Asl.Next;
+        }
+        break;
+
+    case ACPI_PTYPE2_REV_FIXED:
+
+        /* First element is the (Integer) revision */
+
+        ApCheckObjectType (Predefined->Info.Name, Op,
+            ACPI_RTYPE_INTEGER, 0);
+
+        Op = Op->Asl.Next;
+        Count--;
+
+        /* Examine the subpackages */
+
+        ApCheckPackageList (Predefined->Info.Name, Op,
+            Package, 1, Count);
+        break;
+
+    case ACPI_PTYPE2_PKG_COUNT:
+
+        /* First element is the (Integer) count of subpackages to follow */
+
+        Status = ApCheckObjectType (Predefined->Info.Name, Op,
+            ACPI_RTYPE_INTEGER, 0);
+
+        /* We must have an integer count from above (otherwise, use Count) */
+
+        if (ACPI_SUCCESS (Status))
+        {
+            /*
+             * Count cannot be larger than the parent package length, but
+             * allow it to be smaller. The >= accounts for the Integer above.
+             */
+            ExpectedCount = (UINT32) Op->Asl.Value.Integer;
+            if (ExpectedCount >= Count)
+            {
+                goto PackageTooSmall;
+            }
+
+            Count = ExpectedCount;
+        }
+
+        Op = Op->Asl.Next;
+
+        /* Examine the subpackages */
+
+        ApCheckPackageList (Predefined->Info.Name, Op,
+            Package, 1, Count);
+        break;
+
+    case ACPI_PTYPE2_UUID_PAIR:
+
+        /* The package contains a variable list of UUID Buffer/Package pairs */
+
+        /* The length of the package must be even */
+
+        if (Count & 1)
+        {
+            sprintf (MsgBuffer, "%4.4s: Package length, %d, must be even.",
+                Predefined->Info.Name, Count);
+
+            AslError (ASL_ERROR, ASL_MSG_RESERVED_PACKAGE_LENGTH,
+                ParentOp->Asl.Child, MsgBuffer);
+        }
+
+        /* Validate the alternating types */
+
+        for (i = 0; i < Count; ++i)
+        {
+            if (i & 1)
+            {
+                ApCheckObjectType (Predefined->Info.Name, Op,
+                    Package->RetInfo.ObjectType2, i);
+            }
+            else
+            {
+                ApCheckObjectType (Predefined->Info.Name, Op,
+                    Package->RetInfo.ObjectType1, i);
+            }
+
+            Op = Op->Asl.Next;
+        }
+
+        break;
+
+    case ACPI_PTYPE2_VAR_VAR:
+
+        /* Check for minimum size (ints at beginning + 1 subpackage) */
+
+        ExpectedCount = Package->RetInfo4.Count1 + 1;
+        if (Count < ExpectedCount)
+        {
+            goto PackageTooSmall;
+        }
+
+        /* Check the non-package elements at beginning of main package */
+
+        for (i = 0; i < Package->RetInfo4.Count1; ++i)
+        {
+            Status = ApCheckObjectType (Predefined->Info.Name, Op,
+                Package->RetInfo4.ObjectType1, i);
+            Op = Op->Asl.Next;
+        }
+
+        /* Examine the variable-length list of subpackages */
+
+        ApCheckPackageList (Predefined->Info.Name, Op,
+            Package, Package->RetInfo4.Count1, Count);
+
+        break;
+
+    case ACPI_PTYPE2:
+    case ACPI_PTYPE2_FIXED:
+    case ACPI_PTYPE2_MIN:
+    case ACPI_PTYPE2_COUNT:
+    case ACPI_PTYPE2_FIX_VAR:
+        /*
+         * These types all return a single Package that consists of a
+         * variable number of subpackages.
+         */
+
+        /* Examine the subpackages */
+
+        ApCheckPackageList (Predefined->Info.Name, Op,
+            Package, 0, Count);
+        break;
+
+    default:
+        return;
+    }
+
+    return;
+
+PackageTooSmall:
+    ApPackageTooSmall (Predefined->Info.Name, ParentOp,
+        Count, ExpectedCount);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCustomPackage
+ *
+ * PARAMETERS:  ParentOp            - Parse op for the package
+ *              Predefined          - Pointer to package-specific info for
+ *                                    the method
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Validate packages that don't fit into the standard model and
+ *              require custom code.
+ *
+ * NOTE: Currently used for the _BIX method only. When needed for two or more
+ * methods, probably a detect/dispatch mechanism will be required.
+ *
+ ******************************************************************************/
+
+static void
+ApCustomPackage (
+    ACPI_PARSE_OBJECT           *ParentOp,
+    const ACPI_PREDEFINED_INFO  *Predefined)
+{
+    ACPI_PARSE_OBJECT           *Op;
+    UINT32                      Count;
+    UINT32                      ExpectedCount;
+    UINT32                      Version;
+
+
+    /* First child is the package length */
+
+    Op = ParentOp->Asl.Child;
+    Count = (UINT32) Op->Asl.Value.Integer;
+
+    /* Get the version number, must be Integer */
+
+    Op = Op->Asl.Next;
+    Version = (UINT32) Op->Asl.Value.Integer;
+    if (Op->Asl.ParseOpcode != PARSEOP_INTEGER)
+    {
+        AslError (ASL_ERROR, ASL_MSG_RESERVED_OPERAND_TYPE, Op, MsgBuffer);
+        return;
+    }
+
+    /* Validate count (# of elements) */
+
+    ExpectedCount = 21;         /* Version 1 */
+    if (Version == 0)
+    {
+        ExpectedCount = 20;     /* Version 0 */
+    }
+
+    if (Count < ExpectedCount)
+    {
+        ApPackageTooSmall (Predefined->Info.Name, ParentOp,
+            Count, ExpectedCount);
+        return;
+    }
+    else if (Count > ExpectedCount)
+    {
+        ApPackageTooLarge (Predefined->Info.Name, ParentOp,
+            Count, ExpectedCount);
+    }
+
+    /* Validate all elements of the package */
+
+    Op = ApCheckPackageElements (Predefined->Info.Name, Op,
+        ACPI_RTYPE_INTEGER, 16,
+        ACPI_RTYPE_STRING, 4);
+
+    /* Version 1 has a single trailing integer */
+
+    if (Version > 0)
+    {
+        ApCheckPackageElements (Predefined->Info.Name, Op,
+            ACPI_RTYPE_INTEGER, 1, 0, 0);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckPackageElements
+ *
+ * PARAMETERS:  PredefinedName      - Name of the predefined object
+ *              Op                  - Parser op for the package
+ *              Type1               - Object type for first group
+ *              Count1              - Count for first group
+ *              Type2               - Object type for second group
+ *              Count2              - Count for second group
+ *
+ * RETURN:      Next Op peer in the parse tree, after all specified elements
+ *              have been validated. Used for multiple validations (calls
+ *              to this function).
+ *
+ * DESCRIPTION: Validate all elements of a package. Works with packages that
+ *              are defined to contain up to two groups of different object
+ *              types.
+ *
+ ******************************************************************************/
+
+static ACPI_PARSE_OBJECT *
+ApCheckPackageElements (
+    const char              *PredefinedName,
+    ACPI_PARSE_OBJECT       *Op,
+    UINT8                   Type1,
+    UINT32                  Count1,
+    UINT8                   Type2,
+    UINT32                  Count2)
+{
+    UINT32                  i;
+
+
+    /*
+     * Up to two groups of package elements are supported by the data
+     * structure. All elements in each group must be of the same type.
+     * The second group can have a count of zero.
+     *
+     * Aborts check upon a NULL package element, as this means (at compile
+     * time) that the remainder of the package elements are also NULL
+     * (This is the only way to create NULL package elements.)
+     */
+    for (i = 0; (i < Count1) && Op; i++)
+    {
+        ApCheckObjectType (PredefinedName, Op, Type1, i);
+        Op = Op->Asl.Next;
+    }
+
+    for (i = 0; (i < Count2) && Op; i++)
+    {
+        ApCheckObjectType (PredefinedName, Op, Type2, (i + Count1));
+        Op = Op->Asl.Next;
+    }
+
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApCheckPackageList
+ *
+ * PARAMETERS:  PredefinedName      - Name of the predefined object
+ *              ParentOp            - Parser op of the parent package
+ *              Package             - Package info for this predefined name
+ *              StartIndex          - Index in parent package where list begins
+ *              ParentCount         - Element count of parent package
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Validate the individual package elements for a predefined name.
+ *              Handles the cases where the predefined name is defined as a
+ *              Package of Packages (subpackages). These are the types:
+ *
+ *              ACPI_PTYPE2
+ *              ACPI_PTYPE2_FIXED
+ *              ACPI_PTYPE2_MIN
+ *              ACPI_PTYPE2_COUNT
+ *              ACPI_PTYPE2_FIX_VAR
+ *              ACPI_PTYPE2_VAR_VAR
+ *
+ ******************************************************************************/
+
+static void
+ApCheckPackageList (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *ParentOp,
+    const ACPI_PREDEFINED_INFO  *Package,
+    UINT32                      StartIndex,
+    UINT32                      ParentCount)
+{
+    ACPI_PARSE_OBJECT           *SubPackageOp = ParentOp;
+    ACPI_PARSE_OBJECT           *Op;
+    ACPI_STATUS                 Status;
+    UINT32                      Count;
+    UINT32                      ExpectedCount;
+    UINT32                      i;
+    UINT32                      j;
+
+
+    /*
+     * Validate each subpackage in the parent Package
+     *
+     * Note: We ignore NULL package elements on the assumption that
+     * they will be initialized by the BIOS or other ASL code.
+     */
+    for (i = 0; (i < ParentCount) && SubPackageOp; i++)
+    {
+        /* Each object in the list must be of type Package */
+
+        Status = ApCheckObjectType (PredefinedName, SubPackageOp,
+            ACPI_RTYPE_PACKAGE, i + StartIndex);
+        if (ACPI_FAILURE (Status))
+        {
+            goto NextSubpackage;
+        }
+
+        /* Examine the different types of expected subpackages */
+
+        Op = SubPackageOp->Asl.Child;
+
+        /* First child is the package length */
+
+        Count = (UINT32) Op->Asl.Value.Integer;
+        Op = Op->Asl.Next;
+
+        /*
+         * Most subpackage must have at least one element, with
+         * only rare exceptions. (_RDI)
+         */
+        if (!Count &&
+            (Package->RetInfo.Type != ACPI_PTYPE2_VAR_VAR))
+        {
+            ApZeroLengthPackage (PredefinedName, SubPackageOp);
+            goto NextSubpackage;
+        }
+
+        /*
+         * Decode the package type.
+         * PTYPE2 indicates that a "package of packages" is expected for
+         * this name. The various flavors of PTYPE2 indicate the number
+         * and format of the subpackages.
+         */
+        switch (Package->RetInfo.Type)
+        {
+        case ACPI_PTYPE2:
+        case ACPI_PTYPE2_PKG_COUNT:
+        case ACPI_PTYPE2_REV_FIXED:
+
+            /* Each subpackage has a fixed number of elements */
+
+            ExpectedCount = Package->RetInfo.Count1 + Package->RetInfo.Count2;
+            if (Count < ExpectedCount)
+            {
+                ApPackageTooSmall (PredefinedName, SubPackageOp,
+                    Count, ExpectedCount);
+                break;
+            }
+            if (Count > ExpectedCount)
+            {
+                ApPackageTooLarge (PredefinedName, SubPackageOp,
+                    Count, ExpectedCount);
+                break;
+            }
+
+            ApCheckPackageElements (PredefinedName, Op,
+                Package->RetInfo.ObjectType1, Package->RetInfo.Count1,
+                Package->RetInfo.ObjectType2, Package->RetInfo.Count2);
+            break;
+
+        case ACPI_PTYPE2_FIX_VAR:
+            /*
+             * Each subpackage has a fixed number of elements and an
+             * optional element
+             */
+            ExpectedCount = Package->RetInfo.Count1 + Package->RetInfo.Count2;
+            if (Count < ExpectedCount)
+            {
+                ApPackageTooSmall (PredefinedName, SubPackageOp,
+                    Count, ExpectedCount);
+                break;
+            }
+
+            ApCheckPackageElements (PredefinedName, Op,
+                Package->RetInfo.ObjectType1, Package->RetInfo.Count1,
+                Package->RetInfo.ObjectType2,
+                Count - Package->RetInfo.Count1);
+            break;
+
+        case ACPI_PTYPE2_VAR_VAR:
+            /*
+             * Must have at least the minimum number elements.
+             * A zero PkgCount means the number of elements is variable.
+             */
+            ExpectedCount = Package->RetInfo4.PkgCount;
+            if (ExpectedCount && (Count < ExpectedCount))
+            {
+                ApPackageTooSmall (PredefinedName, SubPackageOp,
+                    Count, 1);
+                break;
+            }
+
+            ApCheckPackageElements (PredefinedName, Op,
+                Package->RetInfo4.SubObjectTypes,
+                Package->RetInfo4.PkgCount,
+                0, 0);
+            break;
+
+        case ACPI_PTYPE2_FIXED:
+
+            /* Each subpackage has a fixed length */
+
+            ExpectedCount = Package->RetInfo2.Count;
+            if (Count < ExpectedCount)
+            {
+                ApPackageTooSmall (PredefinedName, SubPackageOp,
+                    Count, ExpectedCount);
+                break;
+            }
+            if (Count > ExpectedCount)
+            {
+                ApPackageTooLarge (PredefinedName, SubPackageOp,
+                    Count, ExpectedCount);
+                break;
+            }
+
+            /* Check each object/type combination */
+
+            for (j = 0; j < ExpectedCount; j++)
+            {
+                ApCheckObjectType (PredefinedName, Op,
+                    Package->RetInfo2.ObjectType[j], j);
+
+                Op = Op->Asl.Next;
+            }
+            break;
+
+        case ACPI_PTYPE2_MIN:
+
+            /* Each subpackage has a variable but minimum length */
+
+            ExpectedCount = Package->RetInfo.Count1;
+            if (Count < ExpectedCount)
+            {
+                ApPackageTooSmall (PredefinedName, SubPackageOp,
+                    Count, ExpectedCount);
+                break;
+            }
+
+            /* Check the type of each subpackage element */
+
+            ApCheckPackageElements (PredefinedName, Op,
+                Package->RetInfo.ObjectType1, Count, 0, 0);
+            break;
+
+        case ACPI_PTYPE2_COUNT:
+            /*
+             * First element is the (Integer) count of elements, including
+             * the count field (the ACPI name is NumElements)
+             */
+            Status = ApCheckObjectType (PredefinedName, Op,
+                ACPI_RTYPE_INTEGER, 0);
+
+            /* We must have an integer count from above (otherwise, use Count) */
+
+            if (ACPI_SUCCESS (Status))
+            {
+                /*
+                 * Make sure package is large enough for the Count and is
+                 * is as large as the minimum size
+                 */
+                ExpectedCount = (UINT32) Op->Asl.Value.Integer;
+
+                if (Count < ExpectedCount)
+                {
+                    ApPackageTooSmall (PredefinedName, SubPackageOp,
+                        Count, ExpectedCount);
+                    break;
+                }
+                else if (Count > ExpectedCount)
+                {
+                    ApPackageTooLarge (PredefinedName, SubPackageOp,
+                        Count, ExpectedCount);
+                }
+
+                /* Some names of this type have a minimum length */
+
+                if (Count < Package->RetInfo.Count1)
+                {
+                    ExpectedCount = Package->RetInfo.Count1;
+                    ApPackageTooSmall (PredefinedName, SubPackageOp,
+                        Count, ExpectedCount);
+                    break;
+                }
+
+                Count = ExpectedCount;
+            }
+
+            /* Check the type of each subpackage element */
+
+            Op = Op->Asl.Next;
+            ApCheckPackageElements (PredefinedName, Op,
+                Package->RetInfo.ObjectType1, (Count - 1), 0, 0);
+            break;
+
+        default:
+            break;
+        }
+
+NextSubpackage:
+        SubPackageOp = SubPackageOp->Asl.Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApPackageTooSmall
+ *
+ * PARAMETERS:  PredefinedName      - Name of the predefined object
+ *              Op                  - Current parser op
+ *              Count               - Actual package element count
+ *              ExpectedCount       - Expected package element count
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Issue error message for a package that is smaller than
+ *              required.
+ *
+ ******************************************************************************/
+
+static void
+ApPackageTooSmall (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *Op,
+    UINT32                      Count,
+    UINT32                      ExpectedCount)
+{
+
+    sprintf (MsgBuffer, "%s: length %u, required minimum is %u",
+        PredefinedName, Count, ExpectedCount);
+
+    AslError (ASL_ERROR, ASL_MSG_RESERVED_PACKAGE_LENGTH, Op, MsgBuffer);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApZeroLengthPackage
+ *
+ * PARAMETERS:  PredefinedName      - Name of the predefined object
+ *              Op                  - Current parser op
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Issue error message for a zero-length package (a package that
+ *              is required to have a non-zero length). Variable length
+ *              packages seem to be allowed to have zero length, however.
+ *              Even if not allowed, BIOS code does it.
+ *
+ ******************************************************************************/
+
+static void
+ApZeroLengthPackage (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *Op)
+{
+
+    sprintf (MsgBuffer, "%s: length is zero", PredefinedName);
+
+    AslError (ASL_ERROR, ASL_MSG_RESERVED_PACKAGE_LENGTH, Op, MsgBuffer);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    ApPackageTooLarge
+ *
+ * PARAMETERS:  PredefinedName      - Name of the predefined object
+ *              Op                  - Current parser op
+ *              Count               - Actual package element count
+ *              ExpectedCount       - Expected package element count
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Issue a remark for a package that is larger than expected.
+ *
+ ******************************************************************************/
+
+static void
+ApPackageTooLarge (
+    const char                  *PredefinedName,
+    ACPI_PARSE_OBJECT           *Op,
+    UINT32                      Count,
+    UINT32                      ExpectedCount)
+{
+
+    sprintf (MsgBuffer, "%s: length is %u, only %u required",
+        PredefinedName, Count, ExpectedCount);
+
+    AslError (ASL_REMARK, ASL_MSG_RESERVED_PACKAGE_LENGTH, Op, MsgBuffer);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslprintf.c b/usr/src/cmd/acpi/iasl/aslprintf.c
new file mode 100644
index 0000000000..c27114cf3c
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslprintf.c
@@ -0,0 +1,380 @@
+/******************************************************************************
+ *
+ * Module Name: aslprintf - ASL Printf/Fprintf macro support
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslprintf")
+
+
+/* Local prototypes */
+
+static void
+OpcCreateConcatenateNode (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *Node);
+
+static void
+OpcParsePrintf (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *DestOp);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoPrintf
+ *
+ * PARAMETERS:  Op                  - printf parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert printf macro to a Store(..., Debug) AML operation.
+ *
+ ******************************************************************************/
+
+void
+OpcDoPrintf (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *DestOp;
+
+
+    /* Store destination is the Debug op */
+
+    DestOp = TrAllocateNode (PARSEOP_DEBUG);
+    DestOp->Asl.AmlOpcode = AML_DEBUG_OP;
+    DestOp->Asl.Parent = Op;
+    DestOp->Asl.LogicalLineNumber = Op->Asl.LogicalLineNumber;
+
+    OpcParsePrintf (Op, DestOp);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcDoFprintf
+ *
+ * PARAMETERS:  Op                  - fprintf parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert fprintf macro to a Store AML operation.
+ *
+ ******************************************************************************/
+
+void
+OpcDoFprintf (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *DestOp;
+
+
+    /* Store destination is the first argument of fprintf */
+
+    DestOp = Op->Asl.Child;
+    Op->Asl.Child = DestOp->Asl.Next;
+    DestOp->Asl.Next = NULL;
+
+    OpcParsePrintf (Op, DestOp);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcParsePrintf
+ *
+ * PARAMETERS:  Op                  - Printf parse node
+ *              DestOp              - Destination of Store operation
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert printf macro to a Store AML operation. The printf
+ *              macro parse tree is layed out as follows:
+ *
+ *              Op        - printf parse op
+ *              Op->Child - Format string
+ *              Op->Next  - Format string arguments
+ *
+ ******************************************************************************/
+
+static void
+OpcParsePrintf (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *DestOp)
+{
+    char                    *Format;
+    char                    *StartPosition = NULL;
+    ACPI_PARSE_OBJECT       *ArgNode;
+    ACPI_PARSE_OBJECT       *NextNode;
+    UINT32                  StringLength = 0;
+    char                    *NewString;
+    BOOLEAN                 StringToProcess = FALSE;
+    ACPI_PARSE_OBJECT       *NewOp;
+
+
+    /* Get format string */
+
+    Format = ACPI_CAST_PTR (char, Op->Asl.Child->Asl.Value.String);
+    ArgNode = Op->Asl.Child->Asl.Next;
+
+    /*
+     * Detach argument list so that we can use a NULL check to distinguish
+     * the first concatenation operation we need to make
+     */
+    Op->Asl.Child = NULL;
+
+    for (; *Format; ++Format)
+    {
+        if (*Format != '%')
+        {
+            if (!StringToProcess)
+            {
+                /* Mark the beginning of a string */
+
+                StartPosition = Format;
+                StringToProcess = TRUE;
+            }
+
+            ++StringLength;
+            continue;
+        }
+
+        /* Save string, if any, to new string object and concat it */
+
+        if (StringToProcess)
+        {
+            NewString = UtStringCacheCalloc (StringLength + 1);
+            strncpy (NewString, StartPosition, StringLength);
+
+            NewOp = TrAllocateNode (PARSEOP_STRING_LITERAL);
+            NewOp->Asl.Value.String = NewString;
+            NewOp->Asl.AmlOpcode = AML_STRING_OP;
+            NewOp->Asl.AcpiBtype = ACPI_BTYPE_STRING;
+            NewOp->Asl.LogicalLineNumber = Op->Asl.LogicalLineNumber;
+
+            OpcCreateConcatenateNode(Op, NewOp);
+
+            StringLength = 0;
+            StringToProcess = FALSE;
+        }
+
+        ++Format;
+
+        /*
+         * We have a format parameter and will need an argument to go
+         * with it
+         */
+        if (!ArgNode ||
+            ArgNode->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+        {
+            AslError(ASL_ERROR, ASL_MSG_ARG_COUNT_LO, Op, NULL);
+            return;
+        }
+
+        /*
+         * We do not support sub-specifiers of printf (flags, width,
+         * precision, length). For specifiers we only support %x/%X for
+         * hex or %s for strings. Also, %o for generic "acpi object".
+         */
+        switch (*Format)
+        {
+        case 's':
+
+            if (ArgNode->Asl.ParseOpcode != PARSEOP_STRING_LITERAL)
+            {
+                AslError(ASL_ERROR, ASL_MSG_INVALID_TYPE, ArgNode,
+                    "String required");
+                return;
+            }
+
+            NextNode = ArgNode->Asl.Next;
+            ArgNode->Asl.Next = NULL;
+            OpcCreateConcatenateNode(Op, ArgNode);
+            ArgNode = NextNode;
+            continue;
+
+        case 'X':
+        case 'x':
+        case 'o':
+
+            NextNode = ArgNode->Asl.Next;
+            ArgNode->Asl.Next = NULL;
+
+            /*
+             * Append an empty string if the first argument is
+             * not a string. This will implicitly conver the 2nd
+             * concat source to a string per the ACPI specification.
+             */
+            if (!Op->Asl.Child)
+            {
+                NewOp = TrAllocateNode (PARSEOP_STRING_LITERAL);
+                NewOp->Asl.Value.String = "";
+                NewOp->Asl.AmlOpcode = AML_STRING_OP;
+                NewOp->Asl.AcpiBtype = ACPI_BTYPE_STRING;
+                NewOp->Asl.LogicalLineNumber = Op->Asl.LogicalLineNumber;
+
+                OpcCreateConcatenateNode(Op, NewOp);
+            }
+
+            OpcCreateConcatenateNode(Op, ArgNode);
+            ArgNode = NextNode;
+            break;
+
+        default:
+
+            AslError(ASL_ERROR, ASL_MSG_INVALID_OPERAND, Op,
+                "Unrecognized format specifier");
+            continue;
+        }
+    }
+
+    /* Process any remaining string */
+
+    if (StringToProcess)
+    {
+        NewString = UtStringCacheCalloc (StringLength + 1);
+        strncpy (NewString, StartPosition, StringLength);
+
+        NewOp = TrAllocateNode (PARSEOP_STRING_LITERAL);
+        NewOp->Asl.Value.String = NewString;
+        NewOp->Asl.AcpiBtype = ACPI_BTYPE_STRING;
+        NewOp->Asl.AmlOpcode = AML_STRING_OP;
+        NewOp->Asl.LogicalLineNumber = Op->Asl.LogicalLineNumber;
+
+        OpcCreateConcatenateNode(Op, NewOp);
+    }
+
+    /*
+     * If we get here and there's no child node then Format
+     * was an empty string. Just make a no op.
+     */
+    if (!Op->Asl.Child)
+    {
+        Op->Asl.ParseOpcode = PARSEOP_NOOP;
+        AslError(ASL_WARNING, ASL_MSG_NULL_STRING, Op,
+            "Converted to NOOP");
+        return;
+    }
+
+     /* Check for erroneous extra arguments */
+
+    if (ArgNode &&
+        ArgNode->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+    {
+        AslError(ASL_WARNING, ASL_MSG_ARG_COUNT_HI, ArgNode,
+            "Extra arguments ignored");
+    }
+
+    /* Change Op to a Store */
+
+    Op->Asl.ParseOpcode = PARSEOP_STORE;
+    Op->Common.AmlOpcode = AML_STORE_OP;
+    Op->Asl.CompileFlags  = 0;
+
+    /* Disable further optimization */
+
+    Op->Asl.CompileFlags &= ~NODE_COMPILE_TIME_CONST;
+    UtSetParseOpName (Op);
+
+    /* Set Store destination */
+
+    Op->Asl.Child->Asl.Next = DestOp;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OpcCreateConcatenateNode
+ *
+ * PARAMETERS:  Op                  - Parse node
+ *              Node                - Parse node to be concatenated
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Make Node the child of Op. If child node already exists, then
+ *              concat child with Node and makes concat node the child of Op.
+ *
+ ******************************************************************************/
+
+static void
+OpcCreateConcatenateNode (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *Node)
+{
+    ACPI_PARSE_OBJECT       *NewConcatOp;
+
+
+    if (!Op->Asl.Child)
+    {
+        Op->Asl.Child = Node;
+        Node->Asl.Parent = Op;
+        return;
+    }
+
+    NewConcatOp = TrAllocateNode (PARSEOP_CONCATENATE);
+    NewConcatOp->Asl.AmlOpcode = AML_CONCAT_OP;
+    NewConcatOp->Asl.AcpiBtype = 0x7;
+    NewConcatOp->Asl.LogicalLineNumber = Op->Asl.LogicalLineNumber;
+
+    /* First arg is child of Op*/
+
+    NewConcatOp->Asl.Child = Op->Asl.Child;
+    Op->Asl.Child->Asl.Parent = NewConcatOp;
+
+    /* Second arg is Node */
+
+    NewConcatOp->Asl.Child->Asl.Next = Node;
+    Node->Asl.Parent = NewConcatOp;
+
+    /* Third arg is Zero (not used) */
+
+    NewConcatOp->Asl.Child->Asl.Next->Asl.Next =
+        TrAllocateNode (PARSEOP_ZERO);
+    NewConcatOp->Asl.Child->Asl.Next->Asl.Next->Asl.Parent =
+        NewConcatOp;
+
+    Op->Asl.Child = NewConcatOp;
+    NewConcatOp->Asl.Parent = Op;
+}
diff --git a/usr/src/cmd/acpi/iasl/aslprune.c b/usr/src/cmd/acpi/iasl/aslprune.c
new file mode 100644
index 0000000000..11b3ad97ee
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslprune.c
@@ -0,0 +1,241 @@
+/******************************************************************************
+ *
+ * Module Name: aslprune - Parse tree prune utility
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acapps.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslprune")
+
+
+/* Local prototypes */
+
+static ACPI_STATUS
+PrTreePruneWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static void
+PrPrintObjectAtLevel (
+    UINT32                  Level,
+    const char              *ObjectName);
+
+
+/* Structure used for the pruning parse tree walk */
+
+typedef struct acpi_prune_info
+{
+    UINT32                  PruneLevel;
+    UINT16                  ParseOpcode;
+    UINT16                  Count;
+
+} ACPI_PRUNE_INFO;
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslPruneParseTree
+ *
+ * PARAMETERS:  PruneDepth              - Number of levels to prune
+ *              Type                    - Prune type (Device, Method, etc.)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Prune off one or more levels of the ASL parse tree
+ *
+ ******************************************************************************/
+
+void
+AslPruneParseTree (
+    UINT32                  PruneDepth,
+    UINT32                  Type)
+{
+    ACPI_PRUNE_INFO         PruneObj;
+
+
+    PruneObj.PruneLevel = PruneDepth;
+    PruneObj.Count = 0;
+
+    switch (Type)
+    {
+    case 0:
+        PruneObj.ParseOpcode = (UINT16) PARSEOP_DEVICE;
+        break;
+
+    case 1:
+        PruneObj.ParseOpcode = (UINT16) PARSEOP_METHOD;
+        break;
+
+    case 2:
+        PruneObj.ParseOpcode = (UINT16) PARSEOP_IF;
+        break;
+
+    default:
+        AcpiOsPrintf ("Unsupported type: %u\n", Type);
+        return;
+    }
+
+    AcpiOsPrintf ("Pruning parse tree, from depth %u\n",
+        PruneDepth);
+
+    AcpiOsPrintf ("\nRemoving Objects:\n");
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        PrTreePruneWalk, NULL, ACPI_CAST_PTR (void, &PruneObj));
+
+    AcpiOsPrintf ("\n%u Total Objects Removed\n", PruneObj.Count);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrPrintObjectAtLevel
+ *
+ * PARAMETERS:  Level                   - Current nesting level
+ *              ObjectName              - ACPI name for the object
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Print object name with indent
+ *
+ ******************************************************************************/
+
+static void
+PrPrintObjectAtLevel (
+    UINT32                  Level,
+    const char              *ObjectName)
+{
+    UINT32                  i;
+
+
+    for (i = 0; i < Level; i++)
+    {
+        AcpiOsPrintf ("  ");
+    }
+
+    AcpiOsPrintf ("[%s] at Level [%u]\n", ObjectName, Level);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrTreePruneWalk
+ *
+ * PARAMETERS:  Parse tree walk callback
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Prune off one or more levels of the ASL parse tree
+ *
+ * Current objects that can be pruned are: Devices, Methods, and If/Else
+ * blocks.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+PrTreePruneWalk (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_PRUNE_INFO         *PruneObj = (ACPI_PRUNE_INFO *) Context;
+
+
+    /* We only care about objects below the Prune Level threshold */
+
+    if (Level <= PruneObj->PruneLevel)
+    {
+        return (AE_OK);
+    }
+
+    if ((Op->Asl.ParseOpcode != PruneObj->ParseOpcode) &&
+       !(Op->Asl.ParseOpcode == PARSEOP_ELSE &&
+             PruneObj->ParseOpcode == PARSEOP_IF))
+    {
+        return (AE_OK);
+    }
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_METHOD:
+
+        AcpiOsPrintf ("Method");
+        PrPrintObjectAtLevel (Level, Op->Asl.Child->Asl.Value.Name);
+        Op->Asl.Child->Asl.Next->Asl.Next->Asl.Next->Asl.Next->Asl.Next->Asl.Next = NULL;
+        PruneObj->Count++;
+        break;
+
+    case PARSEOP_DEVICE:
+
+        AcpiOsPrintf ("Device");
+        PrPrintObjectAtLevel (Level, Op->Asl.Child->Asl.Value.Name);
+        Op->Asl.Child->Asl.Next = NULL;
+        PruneObj->Count++;
+        break;
+
+    case PARSEOP_IF:
+    case PARSEOP_ELSE:
+
+        if (Op->Asl.ParseOpcode == PARSEOP_ELSE)
+        {
+            PrPrintObjectAtLevel(Level, "Else");
+            Op->Asl.Child = NULL;
+        }
+        else
+        {
+            PrPrintObjectAtLevel(Level, "If");
+            Op->Asl.Child->Asl.Next = NULL;
+        }
+
+        PruneObj->Count++;
+        break;
+
+    default:
+
+        break;
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslresource.c b/usr/src/cmd/acpi/iasl/aslresource.c
new file mode 100644
index 0000000000..9c023ffcc6
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslresource.c
@@ -0,0 +1,1093 @@
+/******************************************************************************
+ *
+ * Module Name: aslresource - Resource template/descriptor utilities
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslresource")
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsSmallAddressCheck
+ *
+ * PARAMETERS:  Minimum             - Address Min value
+ *              Maximum             - Address Max value
+ *              Length              - Address range value
+ *              Alignment           - Address alignment value
+ *              MinOp               - Original Op for Address Min
+ *              MaxOp               - Original Op for Address Max
+ *              LengthOp            - Original Op for address range
+ *              AlignOp             - Original Op for address alignment. If
+ *                                    NULL, means "zero value for alignment is
+ *                                    OK, and means 64K alignment" (for
+ *                                    Memory24 descriptor)
+ *              Op                  - Parent Op for entire construct
+ *
+ * RETURN:      None. Adds error messages to error log if necessary
+ *
+ * DESCRIPTION: Perform common value checks for "small" address descriptors.
+ *              Currently:
+ *                  Io, Memory24, Memory32
+ *
+ ******************************************************************************/
+
+void
+RsSmallAddressCheck (
+    UINT8                   Type,
+    UINT32                  Minimum,
+    UINT32                  Maximum,
+    UINT32                  Length,
+    UINT32                  Alignment,
+    ACPI_PARSE_OBJECT       *MinOp,
+    ACPI_PARSE_OBJECT       *MaxOp,
+    ACPI_PARSE_OBJECT       *LengthOp,
+    ACPI_PARSE_OBJECT       *AlignOp,
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    if (Gbl_NoResourceChecking)
+    {
+        return;
+    }
+
+    /*
+     * Check for a so-called "null descriptor". These are descriptors that are
+     * created with most fields set to zero. The intent is that the descriptor
+     * will be updated/completed at runtime via a BufferField.
+     *
+     * If the descriptor does NOT have a resource tag, it cannot be referenced
+     * by a BufferField and we will flag this as an error. Conversely, if
+     * the descriptor has a resource tag, we will assume that a BufferField
+     * will be used to dynamically update it, so no error.
+     *
+     * A possible enhancement to this check would be to verify that in fact
+     * a BufferField is created using the resource tag, and perhaps even
+     * verify that a Store is performed to the BufferField.
+     *
+     * Note: for these descriptors, Alignment is allowed to be zero
+     */
+    if (!Minimum && !Maximum && !Length)
+    {
+        if (!Op->Asl.ExternalName)
+        {
+            /* No resource tag. Descriptor is fixed and is also illegal */
+
+            AslError (ASL_ERROR, ASL_MSG_NULL_DESCRIPTOR, Op, NULL);
+        }
+
+        return;
+    }
+
+    /*
+     * Range checks for Memory24 and Memory32.
+     * IO descriptor has different definition of min/max, don't check.
+     */
+    if (Type != ACPI_RESOURCE_NAME_IO)
+    {
+        /* Basic checks on Min/Max/Length */
+
+        if (Minimum > Maximum)
+        {
+            AslError (ASL_ERROR, ASL_MSG_INVALID_MIN_MAX, MinOp, NULL);
+        }
+        else if (Length > (Maximum - Minimum + 1))
+        {
+            AslError (ASL_ERROR, ASL_MSG_INVALID_LENGTH, LengthOp, NULL);
+        }
+
+        /* Special case for Memory24, min/max values are compressed */
+
+        if (Type == ACPI_RESOURCE_NAME_MEMORY24)
+        {
+            if (!Alignment) /* Alignment==0 means 64K alignment */
+            {
+                Alignment = ACPI_UINT16_MAX + 1;
+            }
+
+            Minimum <<= 8;
+            Maximum <<= 8;
+        }
+    }
+
+    /* Alignment of zero is not in ACPI spec, but is used to mean byte acc */
+
+    if (!Alignment)
+    {
+        Alignment = 1;
+    }
+
+    /* Addresses must be an exact multiple of the alignment value */
+
+    if (Minimum % Alignment)
+    {
+        AslError (ASL_ERROR, ASL_MSG_ALIGNMENT, MinOp, NULL);
+    }
+    if (Maximum % Alignment)
+    {
+        AslError (ASL_ERROR, ASL_MSG_ALIGNMENT, MaxOp, NULL);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsLargeAddressCheck
+ *
+ * PARAMETERS:  Minimum             - Address Min value
+ *              Maximum             - Address Max value
+ *              Length              - Address range value
+ *              Granularity         - Address granularity value
+ *              Flags               - General flags for address descriptors:
+ *                                    _MIF, _MAF, _DEC
+ *              MinOp               - Original Op for Address Min
+ *              MaxOp               - Original Op for Address Max
+ *              LengthOp            - Original Op for address range
+ *              GranOp              - Original Op for address granularity
+ *              Op                  - Parent Op for entire construct
+ *
+ * RETURN:      None. Adds error messages to error log if necessary
+ *
+ * DESCRIPTION: Perform common value checks for "large" address descriptors.
+ *              Currently:
+ *                  WordIo,     WordBusNumber,  WordSpace
+ *                  DWordIo,    DWordMemory,    DWordSpace
+ *                  QWordIo,    QWordMemory,    QWordSpace
+ *                  ExtendedIo, ExtendedMemory, ExtendedSpace
+ *
+ * _MIF flag set means that the minimum address is fixed and is not relocatable
+ * _MAF flag set means that the maximum address is fixed and is not relocatable
+ * Length of zero means that the record size is variable
+ *
+ * This function implements the LEN/MIF/MAF/MIN/MAX/GRA rules within Table 6-40
+ * of the ACPI 4.0a specification. Added 04/2010.
+ *
+ ******************************************************************************/
+
+void
+RsLargeAddressCheck (
+    UINT64                  Minimum,
+    UINT64                  Maximum,
+    UINT64                  Length,
+    UINT64                  Granularity,
+    UINT8                   Flags,
+    ACPI_PARSE_OBJECT       *MinOp,
+    ACPI_PARSE_OBJECT       *MaxOp,
+    ACPI_PARSE_OBJECT       *LengthOp,
+    ACPI_PARSE_OBJECT       *GranOp,
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    if (Gbl_NoResourceChecking)
+    {
+        return;
+    }
+
+    /*
+     * Check for a so-called "null descriptor". These are descriptors that are
+     * created with most fields set to zero. The intent is that the descriptor
+     * will be updated/completed at runtime via a BufferField.
+     *
+     * If the descriptor does NOT have a resource tag, it cannot be referenced
+     * by a BufferField and we will flag this as an error. Conversely, if
+     * the descriptor has a resource tag, we will assume that a BufferField
+     * will be used to dynamically update it, so no error.
+     *
+     * A possible enhancement to this check would be to verify that in fact
+     * a BufferField is created using the resource tag, and perhaps even
+     * verify that a Store is performed to the BufferField.
+     */
+    if (!Minimum && !Maximum && !Length && !Granularity)
+    {
+        if (!Op->Asl.ExternalName)
+        {
+            /* No resource tag. Descriptor is fixed and is also illegal */
+
+            AslError (ASL_ERROR, ASL_MSG_NULL_DESCRIPTOR, Op, NULL);
+        }
+
+        return;
+    }
+
+    /* Basic checks on Min/Max/Length */
+
+    if (Minimum > Maximum)
+    {
+        AslError (ASL_ERROR, ASL_MSG_INVALID_MIN_MAX, MinOp, NULL);
+        return;
+    }
+    else if (Length > (Maximum - Minimum + 1))
+    {
+        AslError (ASL_ERROR, ASL_MSG_INVALID_LENGTH, LengthOp, NULL);
+        return;
+    }
+
+    /* If specified (non-zero), ensure granularity is a power-of-two minus one */
+
+    if (Granularity)
+    {
+        if ((Granularity + 1) &
+             Granularity)
+        {
+            AslError (ASL_ERROR, ASL_MSG_INVALID_GRANULARITY, GranOp, NULL);
+            return;
+        }
+    }
+
+    /*
+     * Check the various combinations of Length, MinFixed, and MaxFixed
+     */
+    if (Length)
+    {
+        /* Fixed non-zero length */
+
+        switch (Flags & (ACPI_RESOURCE_FLAG_MIF | ACPI_RESOURCE_FLAG_MAF))
+        {
+        case 0:
+            /*
+             * Fixed length, variable locations (both _MIN and _MAX).
+             * Length must be a multiple of granularity
+             */
+            if (Granularity & Length)
+            {
+                AslError (ASL_ERROR, ASL_MSG_ALIGNMENT, LengthOp, NULL);
+            }
+            break;
+
+        case (ACPI_RESOURCE_FLAG_MIF | ACPI_RESOURCE_FLAG_MAF):
+
+            /* Fixed length, fixed location. Granularity must be zero */
+
+            if (Granularity != 0)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_GRAN_FIXED, GranOp, NULL);
+            }
+
+            /* Length must be exactly the size of the min/max window */
+
+            if (Length != (Maximum - Minimum + 1))
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_LENGTH_FIXED, LengthOp, NULL);
+            }
+            break;
+
+        /* All other combinations are invalid */
+
+        case ACPI_RESOURCE_FLAG_MIF:
+        case ACPI_RESOURCE_FLAG_MAF:
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_INVALID_ADDR_FLAGS, LengthOp, NULL);
+        }
+    }
+    else
+    {
+        /* Variable length (length==0) */
+
+        switch (Flags & (ACPI_RESOURCE_FLAG_MIF | ACPI_RESOURCE_FLAG_MAF))
+        {
+        case 0:
+            /*
+             * Both _MIN and _MAX are variable.
+             * No additional requirements, just exit
+             */
+            break;
+
+        case ACPI_RESOURCE_FLAG_MIF:
+
+            /* _MIN is fixed. _MIN must be multiple of _GRA */
+
+            /*
+             * The granularity is defined by the ACPI specification to be a
+             * power-of-two minus one, therefore the granularity is a
+             * bitmask which can be used to easily validate the addresses.
+             */
+            if (Granularity & Minimum)
+            {
+                AslError (ASL_ERROR, ASL_MSG_ALIGNMENT, MinOp, NULL);
+            }
+            break;
+
+        case ACPI_RESOURCE_FLAG_MAF:
+
+            /* _MAX is fixed. (_MAX + 1) must be multiple of _GRA */
+
+            if (Granularity & (Maximum + 1))
+            {
+                AslError (ASL_ERROR, ASL_MSG_ALIGNMENT, MaxOp, "-1");
+            }
+            break;
+
+        /* Both MIF/MAF set is invalid if length is zero */
+
+        case (ACPI_RESOURCE_FLAG_MIF | ACPI_RESOURCE_FLAG_MAF):
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_INVALID_ADDR_FLAGS, LengthOp, NULL);
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsGetStringDataLength
+ *
+ * PARAMETERS:  InitializerOp     - Start of a subtree of init nodes
+ *
+ * RETURN:      Valid string length if a string node is found (otherwise 0)
+ *
+ * DESCRIPTION: In a list of peer nodes, find the first one that contains a
+ *              string and return the length of the string.
+ *
+ ******************************************************************************/
+
+UINT16
+RsGetStringDataLength (
+    ACPI_PARSE_OBJECT       *InitializerOp)
+{
+
+    while (InitializerOp)
+    {
+        if (InitializerOp->Asl.ParseOpcode == PARSEOP_STRING_LITERAL)
+        {
+            return ((UINT16) (strlen (InitializerOp->Asl.Value.String) + 1));
+        }
+
+        InitializerOp = ASL_GET_PEER_NODE (InitializerOp);
+    }
+
+    return (0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsAllocateResourceNode
+ *
+ * PARAMETERS:  Size        - Size of node in bytes
+ *
+ * RETURN:      The allocated node - aborts on allocation failure
+ *
+ * DESCRIPTION: Allocate a resource description node and the resource
+ *              descriptor itself (the nodes are used to link descriptors).
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsAllocateResourceNode (
+    UINT32                  Size)
+{
+    ASL_RESOURCE_NODE       *Rnode;
+
+
+    /* Allocate the node */
+
+    Rnode = UtLocalCalloc (sizeof (ASL_RESOURCE_NODE));
+
+    /* Allocate the resource descriptor itself */
+
+    Rnode->Buffer = UtLocalCalloc (Size);
+    Rnode->BufferLength = Size;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsCreateResourceField
+ *
+ * PARAMETERS:  Op              - Resource field node
+ *              Name            - Name of the field (Used only to reference
+ *                                the field in the ASL, not in the AML)
+ *              ByteOffset      - Offset from the field start
+ *              BitOffset       - Additional bit offset
+ *              BitLength       - Number of bits in the field
+ *
+ * RETURN:      None, sets fields within the input node
+ *
+ * DESCRIPTION: Utility function to generate a named bit field within a
+ *              resource descriptor. Mark a node as 1) a field in a resource
+ *              descriptor, and 2) set the value to be a BIT offset
+ *
+ ******************************************************************************/
+
+void
+RsCreateResourceField (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name,
+    UINT32                  ByteOffset,
+    UINT32                  BitOffset,
+    UINT32                  BitLength)
+{
+
+    Op->Asl.ExternalName = Name;
+    Op->Asl.CompileFlags |= NODE_IS_RESOURCE_FIELD;
+
+    Op->Asl.Value.Tag.BitOffset = (ByteOffset * 8) + BitOffset;
+    Op->Asl.Value.Tag.BitLength = BitLength;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsSetFlagBits
+ *
+ * PARAMETERS:  *Flags          - Pointer to the flag byte
+ *              Op              - Flag initialization node
+ *              Position        - Bit position within the flag byte
+ *              Default         - Used if the node is DEFAULT.
+ *
+ * RETURN:      Sets bits within the *Flags output byte.
+ *
+ * DESCRIPTION: Set a bit in a cumulative flags word from an initialization
+ *              node. Will use a default value if the node is DEFAULT, meaning
+ *              that no value was specified in the ASL. Used to merge multiple
+ *              keywords into a single flags byte.
+ *
+ ******************************************************************************/
+
+void
+RsSetFlagBits (
+    UINT8                   *Flags,
+    ACPI_PARSE_OBJECT       *Op,
+    UINT8                   Position,
+    UINT8                   DefaultBit)
+{
+
+    if (Op->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+    {
+        /* Use the default bit */
+
+        *Flags |= (DefaultBit << Position);
+    }
+    else
+    {
+        /* Use the bit specified in the initialization node */
+
+        *Flags |= (((UINT8) Op->Asl.Value.Integer) << Position);
+    }
+}
+
+
+void
+RsSetFlagBits16 (
+    UINT16                  *Flags,
+    ACPI_PARSE_OBJECT       *Op,
+    UINT8                   Position,
+    UINT8                   DefaultBit)
+{
+
+    if (Op->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+    {
+        /* Use the default bit */
+
+        *Flags |= (DefaultBit << Position);
+    }
+    else
+    {
+        /* Use the bit specified in the initialization node */
+
+        *Flags |= (((UINT16) Op->Asl.Value.Integer) << Position);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsCompleteNodeAndGetNext
+ *
+ * PARAMETERS:  Op            - Resource node to be completed
+ *
+ * RETURN:      The next peer to the input node.
+ *
+ * DESCRIPTION: Mark the current node completed and return the next peer.
+ *              The node ParseOpcode is set to DEFAULT_ARG, meaning that
+ *              this node is to be ignored from now on.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+RsCompleteNodeAndGetNext (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    /* Mark this node unused */
+
+    Op->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+
+    /* Move on to the next peer node in the initializer list */
+
+    return (ASL_GET_PEER_NODE (Op));
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsCheckListForDuplicates
+ *
+ * PARAMETERS:  Op                  - First op in the initializer list
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check an initializer list for duplicate values. Emits an error
+ *              if any duplicates are found.
+ *
+ ******************************************************************************/
+
+void
+RsCheckListForDuplicates (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *NextValueOp = Op;
+    ACPI_PARSE_OBJECT       *NextOp;
+    UINT32                  Value;
+
+
+    if (!Op)
+    {
+        return;
+    }
+
+    /* Search list once for each value in the list */
+
+    while (NextValueOp)
+    {
+        Value = (UINT32) NextValueOp->Asl.Value.Integer;
+
+        /* Compare this value to all remaining values in the list */
+
+        NextOp = ASL_GET_PEER_NODE (NextValueOp);
+        while (NextOp)
+        {
+            if (NextOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                /* Compare values */
+
+                if (Value == (UINT32) NextOp->Asl.Value.Integer)
+                {
+                    /* Emit error only once per duplicate node */
+
+                    if (!(NextOp->Asl.CompileFlags & NODE_IS_DUPLICATE))
+                    {
+                        NextOp->Asl.CompileFlags |= NODE_IS_DUPLICATE;
+                        AslError (ASL_ERROR, ASL_MSG_DUPLICATE_ITEM,
+                            NextOp, NULL);
+                    }
+                }
+            }
+
+            NextOp = ASL_GET_PEER_NODE (NextOp);
+        }
+
+        NextValueOp = ASL_GET_PEER_NODE (NextValueOp);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoOneResourceDescriptor
+ *
+ * PARAMETERS:  DescriptorTypeOp    - Parent parse node of the descriptor
+ *              CurrentByteOffset   - Offset in the resource descriptor
+ *                                    buffer.
+ *
+ * RETURN:      A valid resource node for the descriptor
+ *
+ * DESCRIPTION: Dispatches the processing of one resource descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoOneResourceDescriptor (
+    ASL_RESOURCE_INFO       *Info,
+    UINT8                   *State)
+{
+    ASL_RESOURCE_NODE       *Rnode = NULL;
+
+
+    /* Construct the resource */
+
+    switch (Info->DescriptorTypeOp->Asl.ParseOpcode)
+    {
+    case PARSEOP_DMA:
+
+        Rnode = RsDoDmaDescriptor (Info);
+        break;
+
+    case PARSEOP_FIXEDDMA:
+
+        Rnode = RsDoFixedDmaDescriptor (Info);
+        break;
+
+    case PARSEOP_DWORDIO:
+
+        Rnode = RsDoDwordIoDescriptor (Info);
+        break;
+
+    case PARSEOP_DWORDMEMORY:
+
+        Rnode = RsDoDwordMemoryDescriptor (Info);
+        break;
+
+    case PARSEOP_DWORDSPACE:
+
+        Rnode = RsDoDwordSpaceDescriptor (Info);
+        break;
+
+    case PARSEOP_ENDDEPENDENTFN:
+
+        switch (*State)
+        {
+        case ACPI_RSTATE_NORMAL:
+
+            AslError (ASL_ERROR, ASL_MSG_MISSING_STARTDEPENDENT,
+                Info->DescriptorTypeOp, NULL);
+            break;
+
+        case ACPI_RSTATE_START_DEPENDENT:
+
+            AslError (ASL_ERROR, ASL_MSG_DEPENDENT_NESTING,
+                Info->DescriptorTypeOp, NULL);
+            break;
+
+        case ACPI_RSTATE_DEPENDENT_LIST:
+        default:
+
+            break;
+        }
+
+        *State = ACPI_RSTATE_NORMAL;
+        Rnode = RsDoEndDependentDescriptor (Info);
+        break;
+
+    case PARSEOP_ENDTAG:
+
+        Rnode = RsDoEndTagDescriptor (Info);
+        break;
+
+    case PARSEOP_EXTENDEDIO:
+
+        Rnode = RsDoExtendedIoDescriptor (Info);
+        break;
+
+    case PARSEOP_EXTENDEDMEMORY:
+
+        Rnode = RsDoExtendedMemoryDescriptor (Info);
+        break;
+
+    case PARSEOP_EXTENDEDSPACE:
+
+        Rnode = RsDoExtendedSpaceDescriptor (Info);
+        break;
+
+    case PARSEOP_FIXEDIO:
+
+        Rnode = RsDoFixedIoDescriptor (Info);
+        break;
+
+    case PARSEOP_INTERRUPT:
+
+        Rnode = RsDoInterruptDescriptor (Info);
+        break;
+
+    case PARSEOP_IO:
+
+        Rnode = RsDoIoDescriptor (Info);
+        break;
+
+    case PARSEOP_IRQ:
+
+        Rnode = RsDoIrqDescriptor (Info);
+        break;
+
+    case PARSEOP_IRQNOFLAGS:
+
+        Rnode = RsDoIrqNoFlagsDescriptor (Info);
+        break;
+
+    case PARSEOP_MEMORY24:
+
+        Rnode = RsDoMemory24Descriptor (Info);
+        break;
+
+    case PARSEOP_MEMORY32:
+
+        Rnode = RsDoMemory32Descriptor (Info);
+        break;
+
+    case PARSEOP_MEMORY32FIXED:
+
+        Rnode = RsDoMemory32FixedDescriptor (Info);
+        break;
+
+    case PARSEOP_QWORDIO:
+
+        Rnode = RsDoQwordIoDescriptor (Info);
+        break;
+
+    case PARSEOP_QWORDMEMORY:
+
+        Rnode = RsDoQwordMemoryDescriptor (Info);
+        break;
+
+    case PARSEOP_QWORDSPACE:
+
+        Rnode = RsDoQwordSpaceDescriptor (Info);
+        break;
+
+    case PARSEOP_REGISTER:
+
+        Rnode = RsDoGeneralRegisterDescriptor (Info);
+        break;
+
+    case PARSEOP_STARTDEPENDENTFN:
+
+        switch (*State)
+        {
+        case ACPI_RSTATE_START_DEPENDENT:
+
+            AslError (ASL_ERROR, ASL_MSG_DEPENDENT_NESTING,
+                Info->DescriptorTypeOp, NULL);
+            break;
+
+        case ACPI_RSTATE_NORMAL:
+        case ACPI_RSTATE_DEPENDENT_LIST:
+        default:
+
+            break;
+        }
+
+        *State = ACPI_RSTATE_START_DEPENDENT;
+        Rnode = RsDoStartDependentDescriptor (Info);
+        *State = ACPI_RSTATE_DEPENDENT_LIST;
+        break;
+
+    case PARSEOP_STARTDEPENDENTFN_NOPRI:
+
+        switch (*State)
+        {
+        case ACPI_RSTATE_START_DEPENDENT:
+
+            AslError (ASL_ERROR, ASL_MSG_DEPENDENT_NESTING,
+                Info->DescriptorTypeOp, NULL);
+            break;
+
+        case ACPI_RSTATE_NORMAL:
+        case ACPI_RSTATE_DEPENDENT_LIST:
+        default:
+
+            break;
+        }
+
+        *State = ACPI_RSTATE_START_DEPENDENT;
+        Rnode = RsDoStartDependentNoPriDescriptor (Info);
+        *State = ACPI_RSTATE_DEPENDENT_LIST;
+        break;
+
+    case PARSEOP_VENDORLONG:
+
+        Rnode = RsDoVendorLargeDescriptor (Info);
+        break;
+
+    case PARSEOP_VENDORSHORT:
+
+        Rnode = RsDoVendorSmallDescriptor (Info);
+        break;
+
+    case PARSEOP_WORDBUSNUMBER:
+
+        Rnode = RsDoWordBusNumberDescriptor (Info);
+        break;
+
+    case PARSEOP_WORDIO:
+
+        Rnode = RsDoWordIoDescriptor (Info);
+        break;
+
+    case PARSEOP_WORDSPACE:
+
+        Rnode = RsDoWordSpaceDescriptor (Info);
+        break;
+
+    case PARSEOP_GPIO_INT:
+
+        Rnode = RsDoGpioIntDescriptor (Info);
+        break;
+
+    case PARSEOP_GPIO_IO:
+
+        Rnode = RsDoGpioIoDescriptor (Info);
+        break;
+
+    case PARSEOP_I2C_SERIALBUS:
+    case PARSEOP_I2C_SERIALBUS_V2:
+
+        Rnode = RsDoI2cSerialBusDescriptor (Info);
+        break;
+
+    case PARSEOP_SPI_SERIALBUS:
+    case PARSEOP_SPI_SERIALBUS_V2:
+
+        Rnode = RsDoSpiSerialBusDescriptor (Info);
+        break;
+
+    case PARSEOP_UART_SERIALBUS:
+    case PARSEOP_UART_SERIALBUS_V2:
+
+        Rnode = RsDoUartSerialBusDescriptor (Info);
+        break;
+
+    case PARSEOP_DEFAULT_ARG:
+
+        /* Just ignore any of these, they are used as fillers/placeholders */
+        break;
+
+    default:
+
+        printf ("Unknown resource descriptor type [%s]\n",
+            Info->DescriptorTypeOp->Asl.ParseOpName);
+        break;
+    }
+
+    /*
+     * Mark original node as unused, but head of a resource descriptor.
+     * This allows the resource to be installed in the namespace so that
+     * references to the descriptor can be resolved.
+     */
+    Info->DescriptorTypeOp->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+    Info->DescriptorTypeOp->Asl.CompileFlags = NODE_IS_RESOURCE_DESC;
+    Info->DescriptorTypeOp->Asl.Value.Integer = Info->CurrentByteOffset;
+
+    if (Rnode)
+    {
+        Info->DescriptorTypeOp->Asl.FinalAmlLength = Rnode->BufferLength;
+        Info->DescriptorTypeOp->Asl.Extra =
+            ((AML_RESOURCE *) Rnode->Buffer)->DescriptorType;
+    }
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsLinkDescriptorChain
+ *
+ * PARAMETERS:  PreviousRnode       - Pointer to the node that will be previous
+ *                                    to the linked node,  At exit, set to the
+ *                                    last node in the new chain.
+ *              Rnode               - Resource node to link into the list
+ *
+ * RETURN:      Cumulative buffer byte offset of the new segment of chain
+ *
+ * DESCRIPTION: Link a descriptor chain at the end of an existing chain.
+ *
+ ******************************************************************************/
+
+UINT32
+RsLinkDescriptorChain (
+    ASL_RESOURCE_NODE       **PreviousRnode,
+    ASL_RESOURCE_NODE       *Rnode)
+{
+    ASL_RESOURCE_NODE       *LastRnode;
+    UINT32                  CurrentByteOffset;
+
+
+    /* Anything to do? */
+
+    if (!Rnode)
+    {
+        return (0);
+    }
+
+    /* Point the previous node to the new node */
+
+    (*PreviousRnode)->Next = Rnode;
+    CurrentByteOffset = Rnode->BufferLength;
+
+    /* Walk to the end of the chain headed by Rnode */
+
+    LastRnode = Rnode;
+    while (LastRnode->Next)
+    {
+        LastRnode = LastRnode->Next;
+        CurrentByteOffset += LastRnode->BufferLength;
+    }
+
+    /* Previous node becomes the last node in the chain */
+
+    *PreviousRnode = LastRnode;
+    return (CurrentByteOffset);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoResourceTemplate
+ *
+ * PARAMETERS:  Op        - Parent of a resource template list
+ *
+ * RETURN:      None. Sets input node to point to a list of AML code
+ *
+ * DESCRIPTION: Merge a list of resource descriptors into a single AML buffer,
+ *              in preparation for output to the AML output file.
+ *
+ ******************************************************************************/
+
+void
+RsDoResourceTemplate (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *BufferLengthOp;
+    ACPI_PARSE_OBJECT       *BufferOp;
+    ACPI_PARSE_OBJECT       *DescriptorTypeOp;
+    ACPI_PARSE_OBJECT       *LastOp = NULL;
+    UINT32                  CurrentByteOffset = 0;
+    ASL_RESOURCE_NODE       HeadRnode;
+    ASL_RESOURCE_NODE       *PreviousRnode;
+    ASL_RESOURCE_NODE       *Rnode;
+    ASL_RESOURCE_INFO       Info;
+    UINT8                   State;
+
+
+    /* Mark parent as containing a resource template */
+
+    if (Op->Asl.Parent)
+    {
+        Op->Asl.Parent->Asl.CompileFlags |= NODE_IS_RESOURCE_DESC;
+    }
+
+    /* ResourceTemplate Opcode is first (Op) */
+    /* Buffer Length node is first child */
+
+    BufferLengthOp = ASL_GET_CHILD_NODE (Op);
+
+    /* Buffer Op is first peer */
+
+    BufferOp = ASL_GET_PEER_NODE (BufferLengthOp);
+
+    /* First Descriptor type is next */
+
+    DescriptorTypeOp = ASL_GET_PEER_NODE (BufferOp);
+
+    /*
+     * Process all resource descriptors in the list
+     * Note: It is assumed that the EndTag node has been automatically
+     * inserted at the end of the template by the parser.
+     */
+    State = ACPI_RSTATE_NORMAL;
+    PreviousRnode = &HeadRnode;
+    while (DescriptorTypeOp)
+    {
+        /* Save information for optional mapfile */
+
+        if (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CONNECTION)
+        {
+            Info.MappingOp = Op->Asl.Parent;
+        }
+        else
+        {
+            Info.MappingOp = DescriptorTypeOp;
+        }
+
+        Info.DescriptorTypeOp = DescriptorTypeOp;
+        Info.CurrentByteOffset = CurrentByteOffset;
+
+        DescriptorTypeOp->Asl.CompileFlags |= NODE_IS_RESOURCE_DESC;
+        Rnode = RsDoOneResourceDescriptor (&Info, &State);
+
+        /*
+         * Update current byte offset to indicate the number of bytes from the
+         * start of the buffer. Buffer can include multiple descriptors, we
+         * must keep track of the offset of not only each descriptor, but each
+         * element (field) within each descriptor as well.
+         */
+        CurrentByteOffset += RsLinkDescriptorChain (&PreviousRnode, Rnode);
+
+        /* Get the next descriptor in the list */
+
+        LastOp = DescriptorTypeOp;
+        DescriptorTypeOp = ASL_GET_PEER_NODE (DescriptorTypeOp);
+    }
+
+    if (State == ACPI_RSTATE_DEPENDENT_LIST)
+    {
+        if (LastOp)
+        {
+            LastOp = LastOp->Asl.Parent;
+        }
+        AslError (ASL_ERROR, ASL_MSG_MISSING_ENDDEPENDENT, LastOp, NULL);
+    }
+
+    /*
+     * Transform the nodes into the following
+     *
+     * Op           -> AML_BUFFER_OP
+     * First Child  -> BufferLength
+     * Second Child -> Descriptor Buffer (raw byte data)
+     */
+    Op->Asl.ParseOpcode               = PARSEOP_BUFFER;
+    Op->Asl.AmlOpcode                 = AML_BUFFER_OP;
+    Op->Asl.CompileFlags              = NODE_AML_PACKAGE | NODE_IS_RESOURCE_DESC;
+    UtSetParseOpName (Op);
+
+    BufferLengthOp->Asl.ParseOpcode   = PARSEOP_INTEGER;
+    BufferLengthOp->Asl.Value.Integer = CurrentByteOffset;
+    (void) OpcSetOptimalIntegerSize (BufferLengthOp);
+    UtSetParseOpName (BufferLengthOp);
+
+    BufferOp->Asl.ParseOpcode         = PARSEOP_RAW_DATA;
+    BufferOp->Asl.AmlOpcode           = AML_RAW_DATA_CHAIN;
+    BufferOp->Asl.AmlOpcodeLength     = 0;
+    BufferOp->Asl.AmlLength           = CurrentByteOffset;
+    BufferOp->Asl.Value.Buffer        = (UINT8 *) HeadRnode.Next;
+    BufferOp->Asl.CompileFlags       |= NODE_IS_RESOURCE_DATA;
+    UtSetParseOpName (BufferOp);
+
+    return;
+}
diff --git a/usr/src/cmd/acpi/iasl/aslresources.y b/usr/src/cmd/acpi/iasl/aslresources.y
new file mode 100644
index 0000000000..074536bb0d
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslresources.y
@@ -0,0 +1,1248 @@
+NoEcho('
+/******************************************************************************
+ *
+ * Module Name: aslresources.y - Bison/Yacc production rules for resources
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+')
+
+/*******************************************************************************
+ *
+ * ASL Parameter Keyword Terms
+ *
+ ******************************************************************************/
+
+AccessAttribKeyword
+    : PARSEOP_ACCESSATTRIB_BLOCK            {$$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_BLOCK);}
+    | PARSEOP_ACCESSATTRIB_BLOCK_CALL       {$$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_BLOCK_CALL);}
+    | PARSEOP_ACCESSATTRIB_BYTE             {$$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_BYTE);}
+    | PARSEOP_ACCESSATTRIB_QUICK            {$$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_QUICK );}
+    | PARSEOP_ACCESSATTRIB_SND_RCV          {$$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_SND_RCV);}
+    | PARSEOP_ACCESSATTRIB_WORD             {$$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_WORD);}
+    | PARSEOP_ACCESSATTRIB_WORD_CALL        {$$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_WORD_CALL);}
+    | PARSEOP_ACCESSATTRIB_MULTIBYTE '('    {$<n>$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_MULTIBYTE);}
+        ByteConst
+        ')'                                 {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_ACCESSATTRIB_RAW_BYTES '('    {$<n>$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_RAW_BYTES);}
+        ByteConst
+        ')'                                 {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_ACCESSATTRIB_RAW_PROCESS '('  {$<n>$ = TrCreateLeafNode (PARSEOP_ACCESSATTRIB_RAW_PROCESS);}
+        ByteConst
+        ')'                                 {$$ = TrLinkChildren ($<n>3,1,$4);}
+    ;
+
+AccessTypeKeyword
+    : PARSEOP_ACCESSTYPE_ANY                {$$ = TrCreateLeafNode (PARSEOP_ACCESSTYPE_ANY);}
+    | PARSEOP_ACCESSTYPE_BYTE               {$$ = TrCreateLeafNode (PARSEOP_ACCESSTYPE_BYTE);}
+    | PARSEOP_ACCESSTYPE_WORD               {$$ = TrCreateLeafNode (PARSEOP_ACCESSTYPE_WORD);}
+    | PARSEOP_ACCESSTYPE_DWORD              {$$ = TrCreateLeafNode (PARSEOP_ACCESSTYPE_DWORD);}
+    | PARSEOP_ACCESSTYPE_QWORD              {$$ = TrCreateLeafNode (PARSEOP_ACCESSTYPE_QWORD);}
+    | PARSEOP_ACCESSTYPE_BUF                {$$ = TrCreateLeafNode (PARSEOP_ACCESSTYPE_BUF);}
+    ;
+
+AddressingModeKeyword
+    : PARSEOP_ADDRESSINGMODE_7BIT           {$$ = TrCreateLeafNode (PARSEOP_ADDRESSINGMODE_7BIT);}
+    | PARSEOP_ADDRESSINGMODE_10BIT          {$$ = TrCreateLeafNode (PARSEOP_ADDRESSINGMODE_10BIT);}
+    ;
+
+AddressKeyword
+    : PARSEOP_ADDRESSTYPE_MEMORY            {$$ = TrCreateLeafNode (PARSEOP_ADDRESSTYPE_MEMORY);}
+    | PARSEOP_ADDRESSTYPE_RESERVED          {$$ = TrCreateLeafNode (PARSEOP_ADDRESSTYPE_RESERVED);}
+    | PARSEOP_ADDRESSTYPE_NVS               {$$ = TrCreateLeafNode (PARSEOP_ADDRESSTYPE_NVS);}
+    | PARSEOP_ADDRESSTYPE_ACPI              {$$ = TrCreateLeafNode (PARSEOP_ADDRESSTYPE_ACPI);}
+    ;
+
+AddressSpaceKeyword
+    : ByteConst                             {$$ = UtCheckIntegerRange ($1, 0x0A, 0xFF);}
+    | RegionSpaceKeyword                    {}
+    ;
+
+BitsPerByteKeyword
+    : PARSEOP_BITSPERBYTE_FIVE              {$$ = TrCreateLeafNode (PARSEOP_BITSPERBYTE_FIVE);}
+    | PARSEOP_BITSPERBYTE_SIX               {$$ = TrCreateLeafNode (PARSEOP_BITSPERBYTE_SIX);}
+    | PARSEOP_BITSPERBYTE_SEVEN             {$$ = TrCreateLeafNode (PARSEOP_BITSPERBYTE_SEVEN);}
+    | PARSEOP_BITSPERBYTE_EIGHT             {$$ = TrCreateLeafNode (PARSEOP_BITSPERBYTE_EIGHT);}
+    | PARSEOP_BITSPERBYTE_NINE              {$$ = TrCreateLeafNode (PARSEOP_BITSPERBYTE_NINE);}
+    ;
+
+ClockPhaseKeyword
+    : PARSEOP_CLOCKPHASE_FIRST              {$$ = TrCreateLeafNode (PARSEOP_CLOCKPHASE_FIRST);}
+    | PARSEOP_CLOCKPHASE_SECOND             {$$ = TrCreateLeafNode (PARSEOP_CLOCKPHASE_SECOND);}
+    ;
+
+ClockPolarityKeyword
+    : PARSEOP_CLOCKPOLARITY_LOW             {$$ = TrCreateLeafNode (PARSEOP_CLOCKPOLARITY_LOW);}
+    | PARSEOP_CLOCKPOLARITY_HIGH            {$$ = TrCreateLeafNode (PARSEOP_CLOCKPOLARITY_HIGH);}
+    ;
+
+DecodeKeyword
+    : PARSEOP_DECODETYPE_POS                {$$ = TrCreateLeafNode (PARSEOP_DECODETYPE_POS);}
+    | PARSEOP_DECODETYPE_SUB                {$$ = TrCreateLeafNode (PARSEOP_DECODETYPE_SUB);}
+    ;
+
+DevicePolarityKeyword
+    : PARSEOP_DEVICEPOLARITY_LOW            {$$ = TrCreateLeafNode (PARSEOP_DEVICEPOLARITY_LOW);}
+    | PARSEOP_DEVICEPOLARITY_HIGH           {$$ = TrCreateLeafNode (PARSEOP_DEVICEPOLARITY_HIGH);}
+    ;
+
+DMATypeKeyword
+    : PARSEOP_DMATYPE_A                     {$$ = TrCreateLeafNode (PARSEOP_DMATYPE_A);}
+    | PARSEOP_DMATYPE_COMPATIBILITY         {$$ = TrCreateLeafNode (PARSEOP_DMATYPE_COMPATIBILITY);}
+    | PARSEOP_DMATYPE_B                     {$$ = TrCreateLeafNode (PARSEOP_DMATYPE_B);}
+    | PARSEOP_DMATYPE_F                     {$$ = TrCreateLeafNode (PARSEOP_DMATYPE_F);}
+    ;
+
+EndianKeyword
+    : PARSEOP_ENDIAN_LITTLE                 {$$ = TrCreateLeafNode (PARSEOP_ENDIAN_LITTLE);}
+    | PARSEOP_ENDIAN_BIG                    {$$ = TrCreateLeafNode (PARSEOP_ENDIAN_BIG);}
+    ;
+
+FlowControlKeyword
+    : PARSEOP_FLOWCONTROL_HW                {$$ = TrCreateLeafNode (PARSEOP_FLOWCONTROL_HW);}
+    | PARSEOP_FLOWCONTROL_NONE              {$$ = TrCreateLeafNode (PARSEOP_FLOWCONTROL_NONE);}
+    | PARSEOP_FLOWCONTROL_SW                {$$ = TrCreateLeafNode (PARSEOP_FLOWCONTROL_SW);}
+    ;
+
+InterruptLevel
+    : PARSEOP_INTLEVEL_ACTIVEBOTH           {$$ = TrCreateLeafNode (PARSEOP_INTLEVEL_ACTIVEBOTH);}
+    | PARSEOP_INTLEVEL_ACTIVEHIGH           {$$ = TrCreateLeafNode (PARSEOP_INTLEVEL_ACTIVEHIGH);}
+    | PARSEOP_INTLEVEL_ACTIVELOW            {$$ = TrCreateLeafNode (PARSEOP_INTLEVEL_ACTIVELOW);}
+    ;
+
+InterruptTypeKeyword
+    : PARSEOP_INTTYPE_EDGE                  {$$ = TrCreateLeafNode (PARSEOP_INTTYPE_EDGE);}
+    | PARSEOP_INTTYPE_LEVEL                 {$$ = TrCreateLeafNode (PARSEOP_INTTYPE_LEVEL);}
+    ;
+
+IODecodeKeyword
+    : PARSEOP_IODECODETYPE_16               {$$ = TrCreateLeafNode (PARSEOP_IODECODETYPE_16);}
+    | PARSEOP_IODECODETYPE_10               {$$ = TrCreateLeafNode (PARSEOP_IODECODETYPE_10);}
+    ;
+
+IoRestrictionKeyword
+    : PARSEOP_IORESTRICT_IN                 {$$ = TrCreateLeafNode (PARSEOP_IORESTRICT_IN);}
+    | PARSEOP_IORESTRICT_OUT                {$$ = TrCreateLeafNode (PARSEOP_IORESTRICT_OUT);}
+    | PARSEOP_IORESTRICT_NONE               {$$ = TrCreateLeafNode (PARSEOP_IORESTRICT_NONE);}
+    | PARSEOP_IORESTRICT_PRESERVE           {$$ = TrCreateLeafNode (PARSEOP_IORESTRICT_PRESERVE);}
+    ;
+
+LockRuleKeyword
+    : PARSEOP_LOCKRULE_LOCK                 {$$ = TrCreateLeafNode (PARSEOP_LOCKRULE_LOCK);}
+    | PARSEOP_LOCKRULE_NOLOCK               {$$ = TrCreateLeafNode (PARSEOP_LOCKRULE_NOLOCK);}
+    ;
+
+MatchOpKeyword
+    : PARSEOP_MATCHTYPE_MTR                 {$$ = TrCreateLeafNode (PARSEOP_MATCHTYPE_MTR);}
+    | PARSEOP_MATCHTYPE_MEQ                 {$$ = TrCreateLeafNode (PARSEOP_MATCHTYPE_MEQ);}
+    | PARSEOP_MATCHTYPE_MLE                 {$$ = TrCreateLeafNode (PARSEOP_MATCHTYPE_MLE);}
+    | PARSEOP_MATCHTYPE_MLT                 {$$ = TrCreateLeafNode (PARSEOP_MATCHTYPE_MLT);}
+    | PARSEOP_MATCHTYPE_MGE                 {$$ = TrCreateLeafNode (PARSEOP_MATCHTYPE_MGE);}
+    | PARSEOP_MATCHTYPE_MGT                 {$$ = TrCreateLeafNode (PARSEOP_MATCHTYPE_MGT);}
+    ;
+
+MaxKeyword
+    : PARSEOP_MAXTYPE_FIXED                 {$$ = TrCreateLeafNode (PARSEOP_MAXTYPE_FIXED);}
+    | PARSEOP_MAXTYPE_NOTFIXED              {$$ = TrCreateLeafNode (PARSEOP_MAXTYPE_NOTFIXED);}
+    ;
+
+MemTypeKeyword
+    : PARSEOP_MEMTYPE_CACHEABLE             {$$ = TrCreateLeafNode (PARSEOP_MEMTYPE_CACHEABLE);}
+    | PARSEOP_MEMTYPE_WRITECOMBINING        {$$ = TrCreateLeafNode (PARSEOP_MEMTYPE_WRITECOMBINING);}
+    | PARSEOP_MEMTYPE_PREFETCHABLE          {$$ = TrCreateLeafNode (PARSEOP_MEMTYPE_PREFETCHABLE);}
+    | PARSEOP_MEMTYPE_NONCACHEABLE          {$$ = TrCreateLeafNode (PARSEOP_MEMTYPE_NONCACHEABLE);}
+    ;
+
+MinKeyword
+    : PARSEOP_MINTYPE_FIXED                 {$$ = TrCreateLeafNode (PARSEOP_MINTYPE_FIXED);}
+    | PARSEOP_MINTYPE_NOTFIXED              {$$ = TrCreateLeafNode (PARSEOP_MINTYPE_NOTFIXED);}
+    ;
+
+ObjectTypeKeyword
+    : PARSEOP_OBJECTTYPE_UNK                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_UNK);}
+    | PARSEOP_OBJECTTYPE_INT                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_INT);}
+    | PARSEOP_OBJECTTYPE_STR                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_STR);}
+    | PARSEOP_OBJECTTYPE_BUF                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_BUF);}
+    | PARSEOP_OBJECTTYPE_PKG                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_PKG);}
+    | PARSEOP_OBJECTTYPE_FLD                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_FLD);}
+    | PARSEOP_OBJECTTYPE_DEV                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_DEV);}
+    | PARSEOP_OBJECTTYPE_EVT                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_EVT);}
+    | PARSEOP_OBJECTTYPE_MTH                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_MTH);}
+    | PARSEOP_OBJECTTYPE_MTX                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_MTX);}
+    | PARSEOP_OBJECTTYPE_OPR                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_OPR);}
+    | PARSEOP_OBJECTTYPE_POW                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_POW);}
+    | PARSEOP_OBJECTTYPE_PRO                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_PRO);}
+    | PARSEOP_OBJECTTYPE_THZ                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_THZ);}
+    | PARSEOP_OBJECTTYPE_BFF                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_BFF);}
+    | PARSEOP_OBJECTTYPE_DDB                {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_DDB);}
+    ;
+
+ParityTypeKeyword
+    : PARSEOP_PARITYTYPE_SPACE              {$$ = TrCreateLeafNode (PARSEOP_PARITYTYPE_SPACE);}
+    | PARSEOP_PARITYTYPE_MARK               {$$ = TrCreateLeafNode (PARSEOP_PARITYTYPE_MARK);}
+    | PARSEOP_PARITYTYPE_ODD                {$$ = TrCreateLeafNode (PARSEOP_PARITYTYPE_ODD);}
+    | PARSEOP_PARITYTYPE_EVEN               {$$ = TrCreateLeafNode (PARSEOP_PARITYTYPE_EVEN);}
+    | PARSEOP_PARITYTYPE_NONE               {$$ = TrCreateLeafNode (PARSEOP_PARITYTYPE_NONE);}
+    ;
+
+PinConfigByte
+    : PinConfigKeyword                      {$$ = $1;}
+    | ByteConstExpr                         {$$ = UtCheckIntegerRange ($1, 0x80, 0xFF);}
+    ;
+
+PinConfigKeyword
+    : PARSEOP_PIN_NOPULL                    {$$ = TrCreateLeafNode (PARSEOP_PIN_NOPULL);}
+    | PARSEOP_PIN_PULLDOWN                  {$$ = TrCreateLeafNode (PARSEOP_PIN_PULLDOWN);}
+    | PARSEOP_PIN_PULLUP                    {$$ = TrCreateLeafNode (PARSEOP_PIN_PULLUP);}
+    | PARSEOP_PIN_PULLDEFAULT               {$$ = TrCreateLeafNode (PARSEOP_PIN_PULLDEFAULT);}
+    ;
+
+PldKeyword
+    : PARSEOP_PLD_REVISION                  {$$ = TrCreateLeafNode (PARSEOP_PLD_REVISION);}
+    | PARSEOP_PLD_IGNORECOLOR               {$$ = TrCreateLeafNode (PARSEOP_PLD_IGNORECOLOR);}
+    | PARSEOP_PLD_RED                       {$$ = TrCreateLeafNode (PARSEOP_PLD_RED);}
+    | PARSEOP_PLD_GREEN                     {$$ = TrCreateLeafNode (PARSEOP_PLD_GREEN);}
+    | PARSEOP_PLD_BLUE                      {$$ = TrCreateLeafNode (PARSEOP_PLD_BLUE);}
+    | PARSEOP_PLD_WIDTH                     {$$ = TrCreateLeafNode (PARSEOP_PLD_WIDTH);}
+    | PARSEOP_PLD_HEIGHT                    {$$ = TrCreateLeafNode (PARSEOP_PLD_HEIGHT);}
+    | PARSEOP_PLD_USERVISIBLE               {$$ = TrCreateLeafNode (PARSEOP_PLD_USERVISIBLE);}
+    | PARSEOP_PLD_DOCK                      {$$ = TrCreateLeafNode (PARSEOP_PLD_DOCK);}
+    | PARSEOP_PLD_LID                       {$$ = TrCreateLeafNode (PARSEOP_PLD_LID);}
+    | PARSEOP_PLD_PANEL                     {$$ = TrCreateLeafNode (PARSEOP_PLD_PANEL);}
+    | PARSEOP_PLD_VERTICALPOSITION          {$$ = TrCreateLeafNode (PARSEOP_PLD_VERTICALPOSITION);}
+    | PARSEOP_PLD_HORIZONTALPOSITION        {$$ = TrCreateLeafNode (PARSEOP_PLD_HORIZONTALPOSITION);}
+    | PARSEOP_PLD_SHAPE                     {$$ = TrCreateLeafNode (PARSEOP_PLD_SHAPE);}
+    | PARSEOP_PLD_GROUPORIENTATION          {$$ = TrCreateLeafNode (PARSEOP_PLD_GROUPORIENTATION);}
+    | PARSEOP_PLD_GROUPTOKEN                {$$ = TrCreateLeafNode (PARSEOP_PLD_GROUPTOKEN);}
+    | PARSEOP_PLD_GROUPPOSITION             {$$ = TrCreateLeafNode (PARSEOP_PLD_GROUPPOSITION);}
+    | PARSEOP_PLD_BAY                       {$$ = TrCreateLeafNode (PARSEOP_PLD_BAY);}
+    | PARSEOP_PLD_EJECTABLE                 {$$ = TrCreateLeafNode (PARSEOP_PLD_EJECTABLE);}
+    | PARSEOP_PLD_EJECTREQUIRED             {$$ = TrCreateLeafNode (PARSEOP_PLD_EJECTREQUIRED);}
+    | PARSEOP_PLD_CABINETNUMBER             {$$ = TrCreateLeafNode (PARSEOP_PLD_CABINETNUMBER);}
+    | PARSEOP_PLD_CARDCAGENUMBER            {$$ = TrCreateLeafNode (PARSEOP_PLD_CARDCAGENUMBER);}
+    | PARSEOP_PLD_REFERENCE                 {$$ = TrCreateLeafNode (PARSEOP_PLD_REFERENCE);}
+    | PARSEOP_PLD_ROTATION                  {$$ = TrCreateLeafNode (PARSEOP_PLD_ROTATION);}
+    | PARSEOP_PLD_ORDER                     {$$ = TrCreateLeafNode (PARSEOP_PLD_ORDER);}
+    | PARSEOP_PLD_RESERVED                  {$$ = TrCreateLeafNode (PARSEOP_PLD_RESERVED);}
+    | PARSEOP_PLD_VERTICALOFFSET            {$$ = TrCreateLeafNode (PARSEOP_PLD_VERTICALOFFSET);}
+    | PARSEOP_PLD_HORIZONTALOFFSET          {$$ = TrCreateLeafNode (PARSEOP_PLD_HORIZONTALOFFSET);}
+    ;
+
+RangeTypeKeyword
+    : PARSEOP_RANGETYPE_ISAONLY             {$$ = TrCreateLeafNode (PARSEOP_RANGETYPE_ISAONLY);}
+    | PARSEOP_RANGETYPE_NONISAONLY          {$$ = TrCreateLeafNode (PARSEOP_RANGETYPE_NONISAONLY);}
+    | PARSEOP_RANGETYPE_ENTIRE              {$$ = TrCreateLeafNode (PARSEOP_RANGETYPE_ENTIRE);}
+    ;
+
+RegionSpaceKeyword
+    : PARSEOP_REGIONSPACE_IO                {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_IO);}
+    | PARSEOP_REGIONSPACE_MEM               {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_MEM);}
+    | PARSEOP_REGIONSPACE_PCI               {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_PCI);}
+    | PARSEOP_REGIONSPACE_EC                {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_EC);}
+    | PARSEOP_REGIONSPACE_SMBUS             {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_SMBUS);}
+    | PARSEOP_REGIONSPACE_CMOS              {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_CMOS);}
+    | PARSEOP_REGIONSPACE_PCIBAR            {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_PCIBAR);}
+    | PARSEOP_REGIONSPACE_IPMI              {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_IPMI);}
+    | PARSEOP_REGIONSPACE_GPIO              {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_GPIO);}
+    | PARSEOP_REGIONSPACE_GSBUS             {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_GSBUS);}
+    | PARSEOP_REGIONSPACE_PCC               {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_PCC);}
+    | PARSEOP_REGIONSPACE_FFIXEDHW          {$$ = TrCreateLeafNode (PARSEOP_REGIONSPACE_FFIXEDHW);}
+    ;
+
+ResourceTypeKeyword
+    : PARSEOP_RESOURCETYPE_CONSUMER         {$$ = TrCreateLeafNode (PARSEOP_RESOURCETYPE_CONSUMER);}
+    | PARSEOP_RESOURCETYPE_PRODUCER         {$$ = TrCreateLeafNode (PARSEOP_RESOURCETYPE_PRODUCER);}
+    ;
+
+SerializeRuleKeyword
+    : PARSEOP_SERIALIZERULE_SERIAL          {$$ = TrCreateLeafNode (PARSEOP_SERIALIZERULE_SERIAL);}
+    | PARSEOP_SERIALIZERULE_NOTSERIAL       {$$ = TrCreateLeafNode (PARSEOP_SERIALIZERULE_NOTSERIAL);}
+    ;
+
+ShareTypeKeyword
+    : PARSEOP_SHARETYPE_SHARED              {$$ = TrCreateLeafNode (PARSEOP_SHARETYPE_SHARED);}
+    | PARSEOP_SHARETYPE_EXCLUSIVE           {$$ = TrCreateLeafNode (PARSEOP_SHARETYPE_EXCLUSIVE);}
+    | PARSEOP_SHARETYPE_SHAREDWAKE          {$$ = TrCreateLeafNode (PARSEOP_SHARETYPE_SHAREDWAKE);}
+    | PARSEOP_SHARETYPE_EXCLUSIVEWAKE       {$$ = TrCreateLeafNode (PARSEOP_SHARETYPE_EXCLUSIVEWAKE);}
+   ;
+
+SlaveModeKeyword
+    : PARSEOP_SLAVEMODE_CONTROLLERINIT      {$$ = TrCreateLeafNode (PARSEOP_SLAVEMODE_CONTROLLERINIT);}
+    | PARSEOP_SLAVEMODE_DEVICEINIT          {$$ = TrCreateLeafNode (PARSEOP_SLAVEMODE_DEVICEINIT);}
+    ;
+
+StopBitsKeyword
+    : PARSEOP_STOPBITS_TWO                  {$$ = TrCreateLeafNode (PARSEOP_STOPBITS_TWO);}
+    | PARSEOP_STOPBITS_ONEPLUSHALF          {$$ = TrCreateLeafNode (PARSEOP_STOPBITS_ONEPLUSHALF);}
+    | PARSEOP_STOPBITS_ONE                  {$$ = TrCreateLeafNode (PARSEOP_STOPBITS_ONE);}
+    | PARSEOP_STOPBITS_ZERO                 {$$ = TrCreateLeafNode (PARSEOP_STOPBITS_ZERO);}
+    ;
+
+TranslationKeyword
+    : PARSEOP_TRANSLATIONTYPE_SPARSE        {$$ = TrCreateLeafNode (PARSEOP_TRANSLATIONTYPE_SPARSE);}
+    | PARSEOP_TRANSLATIONTYPE_DENSE         {$$ = TrCreateLeafNode (PARSEOP_TRANSLATIONTYPE_DENSE);}
+    ;
+
+TypeKeyword
+    : PARSEOP_TYPE_TRANSLATION              {$$ = TrCreateLeafNode (PARSEOP_TYPE_TRANSLATION);}
+    | PARSEOP_TYPE_STATIC                   {$$ = TrCreateLeafNode (PARSEOP_TYPE_STATIC);}
+    ;
+
+UpdateRuleKeyword
+    : PARSEOP_UPDATERULE_PRESERVE           {$$ = TrCreateLeafNode (PARSEOP_UPDATERULE_PRESERVE);}
+    | PARSEOP_UPDATERULE_ONES               {$$ = TrCreateLeafNode (PARSEOP_UPDATERULE_ONES);}
+    | PARSEOP_UPDATERULE_ZEROS              {$$ = TrCreateLeafNode (PARSEOP_UPDATERULE_ZEROS);}
+    ;
+
+WireModeKeyword
+    : PARSEOP_WIREMODE_FOUR                 {$$ = TrCreateLeafNode (PARSEOP_WIREMODE_FOUR);}
+    | PARSEOP_WIREMODE_THREE                {$$ = TrCreateLeafNode (PARSEOP_WIREMODE_THREE);}
+    ;
+
+XferSizeKeyword
+    : PARSEOP_XFERSIZE_8                    {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_8,   0);}
+    | PARSEOP_XFERSIZE_16                   {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_16,  1);}
+    | PARSEOP_XFERSIZE_32                   {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_32,  2);}
+    | PARSEOP_XFERSIZE_64                   {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_64,  3);}
+    | PARSEOP_XFERSIZE_128                  {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_128, 4);}
+    | PARSEOP_XFERSIZE_256                  {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_256, 5);}
+    ;
+
+XferTypeKeyword
+    : PARSEOP_XFERTYPE_8                    {$$ = TrCreateLeafNode (PARSEOP_XFERTYPE_8);}
+    | PARSEOP_XFERTYPE_8_16                 {$$ = TrCreateLeafNode (PARSEOP_XFERTYPE_8_16);}
+    | PARSEOP_XFERTYPE_16                   {$$ = TrCreateLeafNode (PARSEOP_XFERTYPE_16);}
+    ;
+
+
+/*******************************************************************************
+ *
+ * ASL Resource Template Terms
+ *
+ ******************************************************************************/
+
+/*
+ * Note: Create two default nodes to allow conversion to a Buffer AML opcode
+ * Also, insert the EndTag at the end of the template.
+ */
+ResourceTemplateTerm
+    : PARSEOP_RESOURCETEMPLATE '(' ')'
+        '{'
+        ResourceMacroList '}'       {$$ = TrCreateNode (PARSEOP_RESOURCETEMPLATE,4,
+                                          TrCreateLeafNode (PARSEOP_DEFAULT_ARG),
+                                          TrCreateLeafNode (PARSEOP_DEFAULT_ARG),
+                                          $5,
+                                          TrCreateLeafNode (PARSEOP_ENDTAG));}
+    ;
+
+ResourceMacroList
+    :                               {$$ = NULL;}
+    | ResourceMacroList
+        ResourceMacroTerm           {$$ = TrLinkPeerNode ($1,$2);}
+    ;
+
+ResourceMacroTerm
+    : DMATerm                       {}
+    | DWordIOTerm                   {}
+    | DWordMemoryTerm               {}
+    | DWordSpaceTerm                {}
+    | EndDependentFnTerm            {}
+    | ExtendedIOTerm                {}
+    | ExtendedMemoryTerm            {}
+    | ExtendedSpaceTerm             {}
+    | FixedDmaTerm                  {}
+    | FixedIOTerm                   {}
+    | GpioIntTerm                   {}
+    | GpioIoTerm                    {}
+    | I2cSerialBusTerm              {}
+    | I2cSerialBusTermV2            {}
+    | InterruptTerm                 {}
+    | IOTerm                        {}
+    | IRQNoFlagsTerm                {}
+    | IRQTerm                       {}
+    | Memory24Term                  {}
+    | Memory32FixedTerm             {}
+    | Memory32Term                  {}
+    | QWordIOTerm                   {}
+    | QWordMemoryTerm               {}
+    | QWordSpaceTerm                {}
+    | RegisterTerm                  {}
+    | SpiSerialBusTerm              {}
+    | SpiSerialBusTermV2            {}
+    | StartDependentFnNoPriTerm     {}
+    | StartDependentFnTerm          {}
+    | UartSerialBusTerm             {}
+    | UartSerialBusTermV2           {}
+    | VendorLongTerm                {}
+    | VendorShortTerm               {}
+    | WordBusNumberTerm             {}
+    | WordIOTerm                    {}
+    | WordSpaceTerm                 {}
+    ;
+
+DMATerm
+    : PARSEOP_DMA '('               {$<n>$ = TrCreateLeafNode (PARSEOP_DMA);}
+        DMATypeKeyword
+        OptionalBusMasterKeyword
+        ',' XferTypeKeyword
+        OptionalNameString_Last
+        ')' '{'
+            ByteList '}'            {$$ = TrLinkChildren ($<n>3,5,$4,$5,$7,$8,$11);}
+    | PARSEOP_DMA '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DWordIOTerm
+    : PARSEOP_DWORDIO '('           {$<n>$ = TrCreateLeafNode (PARSEOP_DWORDIO);}
+        OptionalResourceType_First
+        OptionalMinType
+        OptionalMaxType
+        OptionalDecodeType
+        OptionalRangeType
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString
+        OptionalType
+        OptionalTranslationType_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,15,$4,$5,$6,$7,$8,$10,$12,$14,$16,$18,$19,$20,$21,$22,$23);}
+    | PARSEOP_DWORDIO '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DWordMemoryTerm
+    : PARSEOP_DWORDMEMORY '('       {$<n>$ = TrCreateLeafNode (PARSEOP_DWORDMEMORY);}
+        OptionalResourceType_First
+        OptionalDecodeType
+        OptionalMinType
+        OptionalMaxType
+        OptionalMemType
+        ',' OptionalReadWriteKeyword
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString
+        OptionalAddressRange
+        OptionalType_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,16,$4,$5,$6,$7,$8,$10,$12,$14,$16,$18,$20,$21,$22,$23,$24,$25);}
+    | PARSEOP_DWORDMEMORY '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DWordSpaceTerm
+    : PARSEOP_DWORDSPACE '('        {$<n>$ = TrCreateLeafNode (PARSEOP_DWORDSPACE);}
+        ByteConstExpr               {UtCheckIntegerRange ($4, 0xC0, 0xFF);}
+        OptionalResourceType
+        OptionalDecodeType
+        OptionalMinType
+        OptionalMaxType
+        ',' ByteConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,14,$4,$6,$7,$8,$9,$11,$13,$15,$17,$19,$21,$22,$23,$24);}
+    | PARSEOP_DWORDSPACE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+EndDependentFnTerm
+    : PARSEOP_ENDDEPENDENTFN '('
+        ')'                         {$$ = TrCreateLeafNode (PARSEOP_ENDDEPENDENTFN);}
+    | PARSEOP_ENDDEPENDENTFN '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ExtendedIOTerm
+    : PARSEOP_EXTENDEDIO '('        {$<n>$ = TrCreateLeafNode (PARSEOP_EXTENDEDIO);}
+        OptionalResourceType_First
+        OptionalMinType
+        OptionalMaxType
+        OptionalDecodeType
+        OptionalRangeType
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        OptionalQWordConstExpr
+        OptionalNameString
+        OptionalType
+        OptionalTranslationType_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,14,$4,$5,$6,$7,$8,$10,$12,$14,$16,$18,$19,$20,$21,$22);}
+    | PARSEOP_EXTENDEDIO '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ExtendedMemoryTerm
+    : PARSEOP_EXTENDEDMEMORY '('    {$<n>$ = TrCreateLeafNode (PARSEOP_EXTENDEDMEMORY);}
+        OptionalResourceType_First
+        OptionalDecodeType
+        OptionalMinType
+        OptionalMaxType
+        OptionalMemType
+        ',' OptionalReadWriteKeyword
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        OptionalQWordConstExpr
+        OptionalNameString
+        OptionalAddressRange
+        OptionalType_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,15,$4,$5,$6,$7,$8,$10,$12,$14,$16,$18,$20,$21,$22,$23,$24);}
+    | PARSEOP_EXTENDEDMEMORY '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ExtendedSpaceTerm
+    : PARSEOP_EXTENDEDSPACE '('     {$<n>$ = TrCreateLeafNode (PARSEOP_EXTENDEDSPACE);}
+        ByteConstExpr               {UtCheckIntegerRange ($4, 0xC0, 0xFF);}
+        OptionalResourceType
+        OptionalDecodeType
+        OptionalMinType
+        OptionalMaxType
+        ',' ByteConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        OptionalQWordConstExpr
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,13,$4,$6,$7,$8,$9,$11,$13,$15,$17,$19,$21,$22,$23);}
+    | PARSEOP_EXTENDEDSPACE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+FixedDmaTerm
+    : PARSEOP_FIXEDDMA '('          {$<n>$ = TrCreateLeafNode (PARSEOP_FIXEDDMA);}
+        WordConstExpr               /* 04: DMA RequestLines */
+        ',' WordConstExpr           /* 06: DMA Channels */
+        OptionalXferSize            /* 07: DMA TransferSize */
+        OptionalNameString          /* 08: DescriptorName */
+        ')'                         {$$ = TrLinkChildren ($<n>3,4,$4,$6,$7,$8);}
+    | PARSEOP_FIXEDDMA '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+FixedIOTerm
+    : PARSEOP_FIXEDIO '('           {$<n>$ = TrCreateLeafNode (PARSEOP_FIXEDIO);}
+        WordConstExpr
+        ',' ByteConstExpr
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$6,$7);}
+    | PARSEOP_FIXEDIO '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+GpioIntTerm
+    : PARSEOP_GPIO_INT '('          {$<n>$ = TrCreateLeafNode (PARSEOP_GPIO_INT);}
+        InterruptTypeKeyword        /* 04: InterruptType */
+        ',' InterruptLevel          /* 06: InterruptLevel */
+        OptionalShareType           /* 07: SharedType */
+        ',' PinConfigByte           /* 09: PinConfig */
+        OptionalWordConstExpr       /* 10: DebounceTimeout */
+        ',' StringData              /* 12: ResourceSource */
+        OptionalByteConstExpr       /* 13: ResourceSourceIndex */
+        OptionalResourceType        /* 14: ResourceType */
+        OptionalNameString          /* 15: DescriptorName */
+        OptionalBuffer_Last         /* 16: VendorData */
+        ')' '{'
+            DWordConstExpr '}'      {$$ = TrLinkChildren ($<n>3,11,$4,$6,$7,$9,$10,$12,$13,$14,$15,$16,$19);}
+    | PARSEOP_GPIO_INT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+GpioIoTerm
+    : PARSEOP_GPIO_IO '('           {$<n>$ = TrCreateLeafNode (PARSEOP_GPIO_IO);}
+        OptionalShareType_First     /* 04: SharedType */
+        ',' PinConfigByte           /* 06: PinConfig */
+        OptionalWordConstExpr       /* 07: DebounceTimeout */
+        OptionalWordConstExpr       /* 08: DriveStrength */
+        OptionalIoRestriction       /* 09: IoRestriction */
+        ',' StringData              /* 11: ResourceSource */
+        OptionalByteConstExpr       /* 12: ResourceSourceIndex */
+        OptionalResourceType        /* 13: ResourceType */
+        OptionalNameString          /* 14: DescriptorName */
+        OptionalBuffer_Last         /* 15: VendorData */
+        ')' '{'
+            DWordList '}'           {$$ = TrLinkChildren ($<n>3,11,$4,$6,$7,$8,$9,$11,$12,$13,$14,$15,$18);}
+    | PARSEOP_GPIO_IO '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+I2cSerialBusTerm
+    : PARSEOP_I2C_SERIALBUS '('     {$<n>$ = TrCreateLeafNode (PARSEOP_I2C_SERIALBUS);}
+        WordConstExpr               /* 04: SlaveAddress */
+        OptionalSlaveMode           /* 05: SlaveMode */
+        ',' DWordConstExpr          /* 07: ConnectionSpeed */
+        OptionalAddressingMode      /* 08: AddressingMode */
+        ',' StringData              /* 10: ResourceSource */
+        OptionalByteConstExpr       /* 11: ResourceSourceIndex */
+        OptionalResourceType        /* 12: ResourceType */
+        OptionalNameString          /* 13: DescriptorName */
+        OptionalBuffer_Last         /* 14: VendorData */
+        ')'                         {$$ = TrLinkChildren ($<n>3,10,$4,$5,$7,$8,$10,$11,$12,$13,
+                                        TrCreateLeafNode (PARSEOP_DEFAULT_ARG),$14);}
+    | PARSEOP_I2C_SERIALBUS '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+I2cSerialBusTermV2
+    : PARSEOP_I2C_SERIALBUS_V2 '('  {$<n>$ = TrCreateLeafNode (PARSEOP_I2C_SERIALBUS_V2);}
+        WordConstExpr               /* 04: SlaveAddress */
+        OptionalSlaveMode           /* 05: SlaveMode */
+        ',' DWordConstExpr          /* 07: ConnectionSpeed */
+        OptionalAddressingMode      /* 08: AddressingMode */
+        ',' StringData              /* 10: ResourceSource */
+        OptionalByteConstExpr       /* 11: ResourceSourceIndex */
+        OptionalResourceType        /* 12: ResourceType */
+        OptionalNameString          /* 13: DescriptorName */
+        OptionalShareType           /* 14: Share */
+        OptionalBuffer_Last         /* 15: VendorData */
+        ')'                         {$$ = TrLinkChildren ($<n>3,10,$4,$5,$7,$8,$10,$11,$12,$13,
+                                        $14,$15);}
+    | PARSEOP_I2C_SERIALBUS_V2 '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+InterruptTerm
+    : PARSEOP_INTERRUPT '('         {$<n>$ = TrCreateLeafNode (PARSEOP_INTERRUPT);}
+        OptionalResourceType_First
+        ',' InterruptTypeKeyword
+        ',' InterruptLevel
+        OptionalShareType
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString_Last
+        ')' '{'
+            DWordList '}'           {$$ = TrLinkChildren ($<n>3,8,$4,$6,$8,$9,$10,$11,$12,$15);}
+    | PARSEOP_INTERRUPT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+IOTerm
+    : PARSEOP_IO '('                {$<n>$ = TrCreateLeafNode (PARSEOP_IO);}
+        IODecodeKeyword
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' ByteConstExpr
+        ',' ByteConstExpr
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,6,$4,$6,$8,$10,$12,$13);}
+    | PARSEOP_IO '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+IRQNoFlagsTerm
+    : PARSEOP_IRQNOFLAGS '('        {$<n>$ = TrCreateLeafNode (PARSEOP_IRQNOFLAGS);}
+        OptionalNameString_First
+        ')' '{'
+            ByteList '}'            {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_IRQNOFLAGS '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+IRQTerm
+    : PARSEOP_IRQ '('               {$<n>$ = TrCreateLeafNode (PARSEOP_IRQ);}
+        InterruptTypeKeyword
+        ',' InterruptLevel
+        OptionalShareType
+        OptionalNameString_Last
+        ')' '{'
+            ByteList '}'            {$$ = TrLinkChildren ($<n>3,5,$4,$6,$7,$8,$11);}
+    | PARSEOP_IRQ '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+Memory24Term
+    : PARSEOP_MEMORY24 '('          {$<n>$ = TrCreateLeafNode (PARSEOP_MEMORY24);}
+        OptionalReadWriteKeyword
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,6,$4,$6,$8,$10,$12,$13);}
+    | PARSEOP_MEMORY24 '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+Memory32FixedTerm
+    : PARSEOP_MEMORY32FIXED '('     {$<n>$ = TrCreateLeafNode (PARSEOP_MEMORY32FIXED);}
+        OptionalReadWriteKeyword
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,4,$4,$6,$8,$9);}
+    | PARSEOP_MEMORY32FIXED '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+Memory32Term
+    : PARSEOP_MEMORY32 '('          {$<n>$ = TrCreateLeafNode (PARSEOP_MEMORY32);}
+        OptionalReadWriteKeyword
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        ',' DWordConstExpr
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,6,$4,$6,$8,$10,$12,$13);}
+    | PARSEOP_MEMORY32 '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+QWordIOTerm
+    : PARSEOP_QWORDIO '('           {$<n>$ = TrCreateLeafNode (PARSEOP_QWORDIO);}
+        OptionalResourceType_First
+        OptionalMinType
+        OptionalMaxType
+        OptionalDecodeType
+        OptionalRangeType
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString
+        OptionalType
+        OptionalTranslationType_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,15,$4,$5,$6,$7,$8,$10,$12,$14,$16,$18,$19,$20,$21,$22,$23);}
+    | PARSEOP_QWORDIO '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+QWordMemoryTerm
+    : PARSEOP_QWORDMEMORY '('       {$<n>$ = TrCreateLeafNode (PARSEOP_QWORDMEMORY);}
+        OptionalResourceType_First
+        OptionalDecodeType
+        OptionalMinType
+        OptionalMaxType
+        OptionalMemType
+        ',' OptionalReadWriteKeyword
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString
+        OptionalAddressRange
+        OptionalType_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,16,$4,$5,$6,$7,$8,$10,$12,$14,$16,$18,$20,$21,$22,$23,$24,$25);}
+    | PARSEOP_QWORDMEMORY '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+QWordSpaceTerm
+    : PARSEOP_QWORDSPACE '('        {$<n>$ = TrCreateLeafNode (PARSEOP_QWORDSPACE);}
+        ByteConstExpr               {UtCheckIntegerRange ($4, 0xC0, 0xFF);}
+        OptionalResourceType
+        OptionalDecodeType
+        OptionalMinType
+        OptionalMaxType
+        ',' ByteConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        ',' QWordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,14,$4,$6,$7,$8,$9,$11,$13,$15,$17,$19,$21,$22,$23,$24);}
+    | PARSEOP_QWORDSPACE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+RegisterTerm
+    : PARSEOP_REGISTER '('          {$<n>$ = TrCreateLeafNode (PARSEOP_REGISTER);}
+        AddressSpaceKeyword
+        ',' ByteConstExpr
+        ',' ByteConstExpr
+        ',' QWordConstExpr
+        OptionalAccessSize
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,6,$4,$6,$8,$10,$11,$12);}
+    | PARSEOP_REGISTER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+SpiSerialBusTerm
+    : PARSEOP_SPI_SERIALBUS '('     {$<n>$ = TrCreateLeafNode (PARSEOP_SPI_SERIALBUS);}
+        WordConstExpr               /* 04: DeviceSelection */
+        OptionalDevicePolarity      /* 05: DevicePolarity */
+        OptionalWireMode            /* 06: WireMode */
+        ',' ByteConstExpr           /* 08: DataBitLength */
+        OptionalSlaveMode           /* 09: SlaveMode */
+        ',' DWordConstExpr          /* 11: ConnectionSpeed */
+        ',' ClockPolarityKeyword    /* 13: ClockPolarity */
+        ',' ClockPhaseKeyword       /* 15: ClockPhase */
+        ',' StringData              /* 17: ResourceSource */
+        OptionalByteConstExpr       /* 18: ResourceSourceIndex */
+        OptionalResourceType        /* 19: ResourceType */
+        OptionalNameString          /* 20: DescriptorName */
+        OptionalBuffer_Last         /* 21: VendorData */
+        ')'                         {$$ = TrLinkChildren ($<n>3,14,$4,$5,$6,$8,$9,$11,$13,$15,$17,$18,$19,$20,
+                                        TrCreateLeafNode (PARSEOP_DEFAULT_ARG),$21);}
+    | PARSEOP_SPI_SERIALBUS '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+SpiSerialBusTermV2
+    : PARSEOP_SPI_SERIALBUS_V2 '('  {$<n>$ = TrCreateLeafNode (PARSEOP_SPI_SERIALBUS_V2);}
+        WordConstExpr               /* 04: DeviceSelection */
+        OptionalDevicePolarity      /* 05: DevicePolarity */
+        OptionalWireMode            /* 06: WireMode */
+        ',' ByteConstExpr           /* 08: DataBitLength */
+        OptionalSlaveMode           /* 09: SlaveMode */
+        ',' DWordConstExpr          /* 11: ConnectionSpeed */
+        ',' ClockPolarityKeyword    /* 13: ClockPolarity */
+        ',' ClockPhaseKeyword       /* 15: ClockPhase */
+        ',' StringData              /* 17: ResourceSource */
+        OptionalByteConstExpr       /* 18: ResourceSourceIndex */
+        OptionalResourceType        /* 19: ResourceType */
+        OptionalNameString          /* 20: DescriptorName */
+        OptionalShareType           /* 21: Share */
+        OptionalBuffer_Last         /* 22: VendorData */
+        ')'                         {$$ = TrLinkChildren ($<n>3,14,$4,$5,$6,$8,$9,$11,$13,$15,$17,$18,$19,$20,
+                                        $21,$22);}
+    | PARSEOP_SPI_SERIALBUS_V2 '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+StartDependentFnNoPriTerm
+    : PARSEOP_STARTDEPENDENTFN_NOPRI '('    {$<n>$ = TrCreateLeafNode (PARSEOP_STARTDEPENDENTFN_NOPRI);}
+        ')' '{'
+        ResourceMacroList '}'       {$$ = TrLinkChildren ($<n>3,1,$6);}
+    | PARSEOP_STARTDEPENDENTFN_NOPRI '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+StartDependentFnTerm
+    : PARSEOP_STARTDEPENDENTFN '('  {$<n>$ = TrCreateLeafNode (PARSEOP_STARTDEPENDENTFN);}
+        ByteConstExpr
+        ',' ByteConstExpr
+        ')' '{'
+        ResourceMacroList '}'       {$$ = TrLinkChildren ($<n>3,3,$4,$6,$9);}
+    | PARSEOP_STARTDEPENDENTFN '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+UartSerialBusTerm
+    : PARSEOP_UART_SERIALBUS '('    {$<n>$ = TrCreateLeafNode (PARSEOP_UART_SERIALBUS);}
+        DWordConstExpr              /* 04: ConnectionSpeed */
+        OptionalBitsPerByte         /* 05: BitsPerByte */
+        OptionalStopBits            /* 06: StopBits */
+        ',' ByteConstExpr           /* 08: LinesInUse */
+        OptionalEndian              /* 09: Endianess */
+        OptionalParityType          /* 10: Parity */
+        OptionalFlowControl         /* 11: FlowControl */
+        ',' WordConstExpr           /* 13: Rx BufferSize */
+        ',' WordConstExpr           /* 15: Tx BufferSize */
+        ',' StringData              /* 17: ResourceSource */
+        OptionalByteConstExpr       /* 18: ResourceSourceIndex */
+        OptionalResourceType        /* 19: ResourceType */
+        OptionalNameString          /* 20: DescriptorName */
+        OptionalBuffer_Last         /* 21: VendorData */
+        ')'                         {$$ = TrLinkChildren ($<n>3,15,$4,$5,$6,$8,$9,$10,$11,$13,$15,$17,$18,$19,$20,
+                                        TrCreateLeafNode (PARSEOP_DEFAULT_ARG),$21);}
+    | PARSEOP_UART_SERIALBUS '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+UartSerialBusTermV2
+    : PARSEOP_UART_SERIALBUS_V2 '(' {$<n>$ = TrCreateLeafNode (PARSEOP_UART_SERIALBUS_V2);}
+        DWordConstExpr              /* 04: ConnectionSpeed */
+        OptionalBitsPerByte         /* 05: BitsPerByte */
+        OptionalStopBits            /* 06: StopBits */
+        ',' ByteConstExpr           /* 08: LinesInUse */
+        OptionalEndian              /* 09: Endianess */
+        OptionalParityType          /* 10: Parity */
+        OptionalFlowControl         /* 11: FlowControl */
+        ',' WordConstExpr           /* 13: Rx BufferSize */
+        ',' WordConstExpr           /* 15: Tx BufferSize */
+        ',' StringData              /* 17: ResourceSource */
+        OptionalByteConstExpr       /* 18: ResourceSourceIndex */
+        OptionalResourceType        /* 19: ResourceType */
+        OptionalNameString          /* 20: DescriptorName */
+        OptionalShareType           /* 21: Share */
+        OptionalBuffer_Last         /* 22: VendorData */
+        ')'                         {$$ = TrLinkChildren ($<n>3,15,$4,$5,$6,$8,$9,$10,$11,$13,$15,$17,$18,$19,$20,
+                                        $21,$22);}
+    | PARSEOP_UART_SERIALBUS_V2 '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+VendorLongTerm
+    : PARSEOP_VENDORLONG '('        {$<n>$ = TrCreateLeafNode (PARSEOP_VENDORLONG);}
+        OptionalNameString_First
+        ')' '{'
+            ByteList '}'            {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_VENDORLONG '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+VendorShortTerm
+    : PARSEOP_VENDORSHORT '('       {$<n>$ = TrCreateLeafNode (PARSEOP_VENDORSHORT);}
+        OptionalNameString_First
+        ')' '{'
+            ByteList '}'            {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_VENDORSHORT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+WordBusNumberTerm
+    : PARSEOP_WORDBUSNUMBER '('     {$<n>$ = TrCreateLeafNode (PARSEOP_WORDBUSNUMBER);}
+        OptionalResourceType_First
+        OptionalMinType
+        OptionalMaxType
+        OptionalDecodeType
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,12,$4,$5,$6,$7,$9,$11,$13,$15,$17,$18,$19,$20);}
+    | PARSEOP_WORDBUSNUMBER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+WordIOTerm
+    : PARSEOP_WORDIO '('            {$<n>$ = TrCreateLeafNode (PARSEOP_WORDIO);}
+        OptionalResourceType_First
+        OptionalMinType
+        OptionalMaxType
+        OptionalDecodeType
+        OptionalRangeType
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString
+        OptionalType
+        OptionalTranslationType_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,15,$4,$5,$6,$7,$8,$10,$12,$14,$16,$18,$19,$20,$21,$22,$23);}
+    | PARSEOP_WORDIO '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+WordSpaceTerm
+    : PARSEOP_WORDSPACE '('         {$<n>$ = TrCreateLeafNode (PARSEOP_WORDSPACE);}
+        ByteConstExpr               {UtCheckIntegerRange ($4, 0xC0, 0xFF);}
+        OptionalResourceType
+        OptionalDecodeType
+        OptionalMinType
+        OptionalMaxType
+        ',' ByteConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        ',' WordConstExpr
+        OptionalByteConstExpr
+        OptionalStringData
+        OptionalNameString_Last
+        ')'                         {$$ = TrLinkChildren ($<n>3,14,$4,$6,$7,$8,$9,$11,$13,$15,$17,$19,$21,$22,$23,$24);}
+    | PARSEOP_WORDSPACE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+
+/******* Object References ***********************************************/
+
+/* Allow IO, DMA, IRQ Resource macro names to also be used as identifiers */
+
+NameString
+    : NameSeg                       {}
+    | PARSEOP_NAMESTRING            {$$ = TrCreateValuedLeafNode (PARSEOP_NAMESTRING, (ACPI_NATIVE_INT) AslCompilerlval.s);}
+    | PARSEOP_IO                    {$$ = TrCreateValuedLeafNode (PARSEOP_NAMESTRING, (ACPI_NATIVE_INT) "IO");}
+    | PARSEOP_DMA                   {$$ = TrCreateValuedLeafNode (PARSEOP_NAMESTRING, (ACPI_NATIVE_INT) "DMA");}
+    | PARSEOP_IRQ                   {$$ = TrCreateValuedLeafNode (PARSEOP_NAMESTRING, (ACPI_NATIVE_INT) "IRQ");}
+    ;
+
+NameSeg
+    : PARSEOP_NAMESEG               {$$ = TrCreateValuedLeafNode (PARSEOP_NAMESEG, (ACPI_NATIVE_INT) AslCompilerlval.s);}
+    ;
+
+
+/*******************************************************************************
+ *
+ * ASL Helper Terms
+ *
+ ******************************************************************************/
+
+OptionalBusMasterKeyword
+    : ','                                       {$$ = TrCreateLeafNode (PARSEOP_BUSMASTERTYPE_MASTER);}
+    | ',' PARSEOP_BUSMASTERTYPE_MASTER          {$$ = TrCreateLeafNode (PARSEOP_BUSMASTERTYPE_MASTER);}
+    | ',' PARSEOP_BUSMASTERTYPE_NOTMASTER       {$$ = TrCreateLeafNode (PARSEOP_BUSMASTERTYPE_NOTMASTER);}
+    ;
+
+OptionalAccessAttribTerm
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' ByteConstExpr             {$$ = $2;}
+    | ',' AccessAttribKeyword       {$$ = $2;}
+    ;
+
+OptionalAccessSize
+    :                               {$$ = TrCreateValuedLeafNode (PARSEOP_BYTECONST, 0);}
+    | ','                           {$$ = TrCreateValuedLeafNode (PARSEOP_BYTECONST, 0);}
+    | ',' ByteConstExpr             {$$ = $2;}
+    ;
+
+OptionalAddressingMode
+    : ','                           {$$ = NULL;}
+    | ',' AddressingModeKeyword     {$$ = $2;}
+    ;
+
+OptionalAddressRange
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' AddressKeyword            {$$ = $2;}
+    ;
+
+OptionalBitsPerByte
+    : ','                           {$$ = NULL;}
+    | ',' BitsPerByteKeyword        {$$ = $2;}
+    ;
+
+OptionalBuffer_Last
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' RawDataBufferTerm         {$$ = $2;}
+    ;
+
+OptionalByteConstExpr
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' ByteConstExpr             {$$ = $2;}
+    ;
+
+OptionalDecodeType
+    : ','                           {$$ = NULL;}
+    | ',' DecodeKeyword             {$$ = $2;}
+    ;
+
+OptionalDevicePolarity
+    : ','                           {$$ = NULL;}
+    | ',' DevicePolarityKeyword     {$$ = $2;}
+    ;
+
+OptionalDWordConstExpr
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' DWordConstExpr            {$$ = $2;}
+    ;
+
+OptionalEndian
+    : ','                           {$$ = NULL;}
+    | ',' EndianKeyword             {$$ = $2;}
+    ;
+
+OptionalFlowControl
+    : ','                           {$$ = NULL;}
+    | ',' FlowControlKeyword        {$$ = $2;}
+    ;
+
+OptionalIoRestriction
+    : ','                           {$$ = NULL;}
+    | ',' IoRestrictionKeyword      {$$ = $2;}
+    ;
+
+OptionalListString
+    :                               {$$ = TrCreateValuedLeafNode (PARSEOP_STRING_LITERAL, ACPI_TO_INTEGER (""));}   /* Placeholder is a NULL string */
+    | ','                           {$$ = TrCreateValuedLeafNode (PARSEOP_STRING_LITERAL, ACPI_TO_INTEGER (""));}   /* Placeholder is a NULL string */
+    | ',' TermArg                   {$$ = $2;}
+    ;
+
+OptionalMaxType
+    : ','                           {$$ = NULL;}
+    | ',' MaxKeyword                {$$ = $2;}
+    ;
+
+OptionalMemType
+    : ','                           {$$ = NULL;}
+    | ',' MemTypeKeyword            {$$ = $2;}
+    ;
+
+OptionalMinType
+    : ','                           {$$ = NULL;}
+    | ',' MinKeyword                {$$ = $2;}
+    ;
+
+OptionalNameString
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' NameString                {$$ = $2;}
+    ;
+
+OptionalNameString_Last
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' NameString                {$$ = $2;}
+    ;
+
+OptionalNameString_First
+    :                               {$$ = TrCreateLeafNode (PARSEOP_ZERO);}
+    | NameString                    {$$ = $1;}
+    ;
+
+OptionalObjectTypeKeyword
+    :                               {$$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE_UNK);}
+    | ',' ObjectTypeKeyword         {$$ = $2;}
+    ;
+
+OptionalParityType
+    : ','                           {$$ = NULL;}
+    | ',' ParityTypeKeyword         {$$ = $2;}
+    ;
+
+OptionalQWordConstExpr
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' QWordConstExpr            {$$ = $2;}
+    ;
+
+OptionalRangeType
+    : ','                           {$$ = NULL;}
+    | ',' RangeTypeKeyword          {$$ = $2;}
+    ;
+
+OptionalReadWriteKeyword
+    :                                   {$$ = TrCreateLeafNode (PARSEOP_READWRITETYPE_BOTH);}
+    | PARSEOP_READWRITETYPE_BOTH        {$$ = TrCreateLeafNode (PARSEOP_READWRITETYPE_BOTH);}
+    | PARSEOP_READWRITETYPE_READONLY    {$$ = TrCreateLeafNode (PARSEOP_READWRITETYPE_READONLY);}
+    ;
+
+OptionalResourceType_First
+    :                               {$$ = TrCreateLeafNode (PARSEOP_RESOURCETYPE_CONSUMER);}
+    | ResourceTypeKeyword           {$$ = $1;}
+    ;
+
+OptionalResourceType
+    :                               {$$ = TrCreateLeafNode (PARSEOP_RESOURCETYPE_CONSUMER);}
+    | ','                           {$$ = TrCreateLeafNode (PARSEOP_RESOURCETYPE_CONSUMER);}
+    | ',' ResourceTypeKeyword       {$$ = $2;}
+    ;
+
+OptionalSlaveMode
+    : ','                           {$$ = NULL;}
+    | ',' SlaveModeKeyword          {$$ = $2;}
+    ;
+
+OptionalShareType
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' ShareTypeKeyword          {$$ = $2;}
+    ;
+
+OptionalShareType_First
+    :                               {$$ = NULL;}
+    | ShareTypeKeyword              {$$ = $1;}
+    ;
+
+OptionalStopBits
+    : ','                           {$$ = NULL;}
+    | ',' StopBitsKeyword           {$$ = $2;}
+    ;
+
+OptionalStringData
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' StringData                {$$ = $2;}
+    ;
+
+OptionalTranslationType_Last
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' TranslationKeyword        {$$ = $2;}
+    ;
+
+OptionalType
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' TypeKeyword               {$$ = $2;}
+    ;
+
+OptionalType_Last
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' TypeKeyword               {$$ = $2;}
+    ;
+
+OptionalWireMode
+    : ','                           {$$ = NULL;}
+    | ',' WireModeKeyword           {$$ = $2;}
+    ;
+
+OptionalWordConstExpr
+    : ','                           {$$ = NULL;}
+    | ',' WordConstExpr             {$$ = $2;}
+    ;
+
+OptionalXferSize
+    :                               {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_32, 2);}
+    | ','                           {$$ = TrCreateValuedLeafNode (PARSEOP_XFERSIZE_32, 2);}
+    | ',' XferSizeKeyword           {$$ = $2;}
+    ;
diff --git a/usr/src/cmd/acpi/iasl/aslrestype1.c b/usr/src/cmd/acpi/iasl/aslrestype1.c
new file mode 100644
index 0000000000..4bd9059781
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype1.c
@@ -0,0 +1,641 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype1 - Miscellaneous small resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype1")
+
+/*
+ * This module contains miscellaneous small resource descriptors:
+ *
+ * EndTag
+ * EndDependentFn
+ * Memory24
+ * Memory32
+ * Memory32Fixed
+ * StartDependentFn
+ * StartDependentFnNoPri
+ * VendorShort
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoEndTagDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "EndDependentFn" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoEndTagDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ASL_RESOURCE_NODE       *Rnode;
+
+
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_END_TAG));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->EndTag.DescriptorType = ACPI_RESOURCE_NAME_END_TAG |
+                                        ASL_RDESC_END_TAG_SIZE;
+    Descriptor->EndTag.Checksum = 0;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoEndDependentDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "EndDependentFn" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoEndDependentDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ASL_RESOURCE_NODE       *Rnode;
+
+
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_END_DEPENDENT));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->EndDpf.DescriptorType =
+        ACPI_RESOURCE_NAME_END_DEPENDENT | ASL_RDESC_END_DEPEND_SIZE;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoMemory24Descriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "Memory24" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoMemory24Descriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_MEMORY24));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Memory24.DescriptorType = ACPI_RESOURCE_NAME_MEMORY24;
+    Descriptor->Memory24.ResourceLength = 9;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Read/Write type */
+
+            RsSetFlagBits (&Descriptor->Memory24.Flags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_READWRITETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory24.Flags), 0);
+            break;
+
+        case 1: /* Min Address */
+
+            Descriptor->Memory24.Minimum = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory24.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 2: /* Max Address */
+
+            Descriptor->Memory24.Maximum = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory24.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 3: /* Alignment */
+
+            Descriptor->Memory24.Alignment = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_ALIGNMENT,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory24.Alignment));
+            break;
+
+        case 4: /* Length */
+
+            Descriptor->Memory24.AddressLength = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory24.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 5: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Align values (Alignment==0 means 64K) */
+
+    RsSmallAddressCheck (ACPI_RESOURCE_NAME_MEMORY24,
+        Descriptor->Memory24.Minimum,
+        Descriptor->Memory24.Maximum,
+        Descriptor->Memory24.AddressLength,
+        Descriptor->Memory24.Alignment,
+        MinOp, MaxOp, LengthOp, NULL, Info->DescriptorTypeOp);
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoMemory32Descriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "Memory32" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoMemory32Descriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *AlignOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_MEMORY32));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Memory32.DescriptorType = ACPI_RESOURCE_NAME_MEMORY32;
+    Descriptor->Memory32.ResourceLength = 17;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Read/Write type */
+
+            RsSetFlagBits (&Descriptor->Memory32.Flags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_READWRITETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory32.Flags), 0);
+            break;
+
+        case 1:  /* Min Address */
+
+            Descriptor->Memory32.Minimum = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory32.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 2: /* Max Address */
+
+            Descriptor->Memory32.Maximum = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory32.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 3: /* Alignment */
+
+            Descriptor->Memory32.Alignment = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_ALIGNMENT,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory32.Alignment));
+            AlignOp = InitializerOp;
+            break;
+
+        case 4: /* Length */
+
+            Descriptor->Memory32.AddressLength = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Memory32.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 5: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Align values */
+
+    RsSmallAddressCheck (ACPI_RESOURCE_NAME_MEMORY32,
+        Descriptor->Memory32.Minimum,
+        Descriptor->Memory32.Maximum,
+        Descriptor->Memory32.AddressLength,
+        Descriptor->Memory32.Alignment,
+        MinOp, MaxOp, LengthOp, AlignOp, Info->DescriptorTypeOp);
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoMemory32FixedDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "Memory32Fixed" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoMemory32FixedDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_FIXED_MEMORY32));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->FixedMemory32.DescriptorType = ACPI_RESOURCE_NAME_FIXED_MEMORY32;
+    Descriptor->FixedMemory32.ResourceLength = 9;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Read/Write type */
+
+            RsSetFlagBits (&Descriptor->FixedMemory32.Flags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_READWRITETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedMemory32.Flags), 0);
+            break;
+
+        case 1: /* Address */
+
+            Descriptor->FixedMemory32.Address = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_BASEADDRESS,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedMemory32.Address));
+            break;
+
+        case 2: /* Length */
+
+            Descriptor->FixedMemory32.AddressLength = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedMemory32.AddressLength));
+            break;
+
+        case 3: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoStartDependentDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "StartDependentFn" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoStartDependentDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    ASL_RESOURCE_NODE       *PreviousRnode;
+    ASL_RESOURCE_NODE       *NextRnode;
+    ASL_RESOURCE_INFO       NextInfo;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    UINT8                   State;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_START_DEPENDENT));
+
+    PreviousRnode = Rnode;
+    Descriptor = Rnode->Buffer;
+
+    /* Increment offset past StartDependent descriptor */
+
+    CurrentByteOffset += sizeof (AML_RESOURCE_START_DEPENDENT);
+
+    /* Descriptor has priority byte */
+
+    Descriptor->StartDpf.DescriptorType =
+        ACPI_RESOURCE_NAME_START_DEPENDENT | (ASL_RDESC_ST_DEPEND_SIZE + 0x01);
+
+    /* Process all child initialization nodes */
+
+    State = ACPI_RSTATE_START_DEPENDENT;
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Compatibility Priority */
+
+            if ((UINT8) InitializerOp->Asl.Value.Integer > 2)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_PRIORITY,
+                    InitializerOp, NULL);
+            }
+
+            RsSetFlagBits (&Descriptor->StartDpf.Flags, InitializerOp, 0, 0);
+            break;
+
+        case 1: /* Performance/Robustness Priority */
+
+            if ((UINT8) InitializerOp->Asl.Value.Integer > 2)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_PERFORMANCE,
+                    InitializerOp, NULL);
+            }
+
+            RsSetFlagBits (&Descriptor->StartDpf.Flags, InitializerOp, 2, 0);
+            break;
+
+        default:
+
+            NextInfo.CurrentByteOffset = CurrentByteOffset;
+            NextInfo.DescriptorTypeOp = InitializerOp;
+
+            NextRnode = RsDoOneResourceDescriptor (&NextInfo, &State);
+
+            /*
+             * Update current byte offset to indicate the number of bytes from the
+             * start of the buffer. Buffer can include multiple descriptors, we
+             * must keep track of the offset of not only each descriptor, but each
+             * element (field) within each descriptor as well.
+             */
+            CurrentByteOffset += RsLinkDescriptorChain (
+                &PreviousRnode, NextRnode);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoStartDependentNoPriDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "StartDependentNoPri" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoStartDependentNoPriDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    ASL_RESOURCE_NODE       *PreviousRnode;
+    ASL_RESOURCE_NODE       *NextRnode;
+    ASL_RESOURCE_INFO       NextInfo;
+    UINT32                  CurrentByteOffset;
+    UINT8                   State;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_START_DEPENDENT_NOPRIO));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->StartDpf.DescriptorType =
+        ACPI_RESOURCE_NAME_START_DEPENDENT | ASL_RDESC_ST_DEPEND_SIZE;
+    PreviousRnode = Rnode;
+
+    /* Increment offset past StartDependentNoPri descriptor */
+
+    CurrentByteOffset += sizeof (AML_RESOURCE_START_DEPENDENT_NOPRIO);
+
+    /* Process all child initialization nodes */
+
+    State = ACPI_RSTATE_START_DEPENDENT;
+    while (InitializerOp)
+    {
+        NextInfo.CurrentByteOffset = CurrentByteOffset;
+        NextInfo.DescriptorTypeOp = InitializerOp;
+
+        NextRnode = RsDoOneResourceDescriptor (&NextInfo, &State);
+
+        /*
+         * Update current byte offset to indicate the number of bytes from the
+         * start of the buffer. Buffer can include multiple descriptors, we
+         * must keep track of the offset of not only each descriptor, but each
+         * element (field) within each descriptor as well.
+         */
+        CurrentByteOffset += RsLinkDescriptorChain (&PreviousRnode, NextRnode);
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoVendorSmallDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "VendorShort" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoVendorSmallDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *VendorData;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+
+    /* Allocate worst case - 7 vendor bytes */
+
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_VENDOR_SMALL) + 7);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->VendorSmall.DescriptorType = ACPI_RESOURCE_NAME_VENDOR_SMALL;
+    VendorData = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_SMALL_HEADER);
+
+    /* Process all child initialization nodes */
+
+    InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    for (i = 0; InitializerOp; i++)
+    {
+        if (InitializerOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+        {
+            break;
+        }
+
+        /* Maximum 7 vendor data bytes allowed (0-6) */
+
+        if (i >= 7)
+        {
+            AslError (ASL_ERROR, ASL_MSG_VENDOR_LIST, InitializerOp, NULL);
+
+            /* Eat the excess initializers */
+
+            while (InitializerOp)
+            {
+                InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+            }
+            break;
+        }
+
+        VendorData[i] = (UINT8) InitializerOp->Asl.Value.Integer;
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Adjust the Rnode buffer size, so correct number of bytes are emitted */
+
+    Rnode->BufferLength -= (7 - i);
+
+    /* Set the length in the Type Tag */
+
+    Descriptor->VendorSmall.DescriptorType |= (UINT8) i;
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrestype1i.c b/usr/src/cmd/acpi/iasl/aslrestype1i.c
new file mode 100644
index 0000000000..0f38e40da6
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype1i.c
@@ -0,0 +1,665 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype1i - Small I/O-related resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype1i")
+
+/*
+ * This module contains the I/O-related small resource descriptors:
+ *
+ * DMA
+ * FixedDMA
+ * FixedIO
+ * IO
+ * IRQ
+ * IRQNoFlags
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoDmaDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "DMA" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoDmaDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    UINT8                   DmaChannelMask = 0;
+    UINT8                   DmaChannels = 0;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_DMA));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Dma.DescriptorType =
+        ACPI_RESOURCE_NAME_DMA | ASL_RDESC_DMA_SIZE;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* DMA type */
+
+            RsSetFlagBits (&Descriptor->Dma.Flags, InitializerOp, 5, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_DMATYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Dma.Flags), 5, 2);
+            break;
+
+        case 1: /* Bus Master */
+
+            RsSetFlagBits (&Descriptor->Dma.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_BUSMASTER,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Dma.Flags), 2);
+            break;
+
+        case 2: /* Xfer Type (transfer width) */
+
+            RsSetFlagBits (&Descriptor->Dma.Flags, InitializerOp, 0, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_XFERTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Dma.Flags), 0, 2);
+            break;
+
+        case 3: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            /* All DMA channel bytes are handled here, after flags and name */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                /* Up to 8 channels can be specified in the list */
+
+                DmaChannels++;
+                if (DmaChannels > 8)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_DMA_LIST,
+                        InitializerOp, NULL);
+                    return (Rnode);
+                }
+
+                /* Only DMA channels 0-7 are allowed (mask is 8 bits) */
+
+                if (InitializerOp->Asl.Value.Integer > 7)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_DMA_CHANNEL,
+                        InitializerOp, NULL);
+                }
+
+                /* Build the mask */
+
+                DmaChannelMask |=
+                    (1 << ((UINT8) InitializerOp->Asl.Value.Integer));
+            }
+
+            if (i == 4) /* case 4: First DMA byte */
+            {
+                /* Check now for duplicates in list */
+
+                RsCheckListForDuplicates (InitializerOp);
+
+                /* Create a named field at the start of the list */
+
+                RsCreateByteField (InitializerOp, ACPI_RESTAG_DMA,
+                    CurrentByteOffset +
+                    ASL_RESDESC_OFFSET (Dma.DmaChannelMask));
+            }
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Now we can set the channel mask */
+
+    Descriptor->Dma.DmaChannelMask = DmaChannelMask;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoFixedDmaDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "FixedDMA" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoFixedDmaDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_FIXED_DMA));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->FixedDma.DescriptorType =
+        ACPI_RESOURCE_NAME_FIXED_DMA | ASL_RDESC_FIXED_DMA_SIZE;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* DMA Request Lines [WORD] (_DMA) */
+
+            Descriptor->FixedDma.RequestLines = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_DMA,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedDma.RequestLines));
+            break;
+
+        case 1: /* DMA Channel [WORD] (_TYP) */
+
+            Descriptor->FixedDma.Channels = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_DMATYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedDma.Channels));
+            break;
+
+        case 2: /* Transfer Width [BYTE] (_SIZ) */
+
+            Descriptor->FixedDma.Width = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_XFERTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedDma.Width));
+            break;
+
+        case 3: /* Descriptor Name (optional) */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:    /* Ignore any extra nodes */
+
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoFixedIoDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "FixedIO" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoFixedIoDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *AddressOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_FIXED_IO));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Io.DescriptorType =
+        ACPI_RESOURCE_NAME_FIXED_IO | ASL_RDESC_FIXED_IO_SIZE;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Base Address */
+
+            Descriptor->FixedIo.Address =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_BASEADDRESS,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedIo.Address));
+            AddressOp = InitializerOp;
+            break;
+
+        case 1: /* Length */
+
+            Descriptor->FixedIo.AddressLength =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (FixedIo.AddressLength));
+            break;
+
+        case 2: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Error checks */
+
+    if (Descriptor->FixedIo.Address > 0x03FF)
+    {
+        AslError (ASL_WARNING, ASL_MSG_ISA_ADDRESS, AddressOp, NULL);
+    }
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoIoDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "IO" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoIoDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *AlignOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_IO));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Io.DescriptorType =
+        ACPI_RESOURCE_NAME_IO | ASL_RDESC_IO_SIZE;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Decode size */
+
+            RsSetFlagBits (&Descriptor->Io.Flags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Io.Flags), 0);
+            break;
+
+        case 1:  /* Min Address */
+
+            Descriptor->Io.Minimum =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Io.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 2: /* Max Address */
+
+            Descriptor->Io.Maximum =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Io.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 3: /* Alignment */
+
+            Descriptor->Io.Alignment =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_ALIGNMENT,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Io.Alignment));
+            AlignOp = InitializerOp;
+            break;
+
+        case 4: /* Length */
+
+            Descriptor->Io.AddressLength =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Io.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 5: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Align values */
+
+    RsSmallAddressCheck (ACPI_RESOURCE_NAME_IO,
+        Descriptor->Io.Minimum,
+        Descriptor->Io.Maximum,
+        Descriptor->Io.AddressLength,
+        Descriptor->Io.Alignment,
+        MinOp, MaxOp, LengthOp, AlignOp, Info->DescriptorTypeOp);
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoIrqDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "IRQ" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoIrqDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  Interrupts = 0;
+    UINT16                  IrqMask = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_IRQ));
+
+    /* Length = 3 (with flag byte) */
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Irq.DescriptorType =
+        ACPI_RESOURCE_NAME_IRQ | (ASL_RDESC_IRQ_SIZE + 0x01);
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Interrupt Type (or Mode - edge/level) */
+
+            RsSetFlagBits (&Descriptor->Irq.Flags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Irq.Flags), 0);
+            break;
+
+        case 1: /* Interrupt Level (or Polarity - Active high/low) */
+
+            RsSetFlagBits (&Descriptor->Irq.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTLEVEL,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Irq.Flags), 3);
+            break;
+
+        case 2: /* Share Type - Default: exclusive (0) */
+
+            RsSetFlagBits (&Descriptor->Irq.Flags, InitializerOp, 4, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTSHARE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Irq.Flags), 4);
+            break;
+
+        case 3: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            /* All IRQ bytes are handled here, after the flags and name */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                /* Up to 16 interrupts can be specified in the list */
+
+                Interrupts++;
+                if (Interrupts > 16)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INTERRUPT_LIST,
+                        InitializerOp, NULL);
+                    return (Rnode);
+                }
+
+                /* Only interrupts 0-15 are allowed (mask is 16 bits) */
+
+                if (InitializerOp->Asl.Value.Integer > 15)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INTERRUPT_NUMBER,
+                        InitializerOp, NULL);
+                }
+                else
+                {
+                    IrqMask |= (1 << (UINT8) InitializerOp->Asl.Value.Integer);
+                }
+            }
+
+            /* Case 4: First IRQ value in list */
+
+            if (i == 4)
+            {
+                /* Check now for duplicates in list */
+
+                RsCheckListForDuplicates (InitializerOp);
+
+                /* Create a named field at the start of the list */
+
+                RsCreateWordField (InitializerOp, ACPI_RESTAG_INTERRUPT,
+                    CurrentByteOffset + ASL_RESDESC_OFFSET (Irq.IrqMask));
+            }
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Now we can set the channel mask */
+
+    Descriptor->Irq.IrqMask = IrqMask;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoIrqNoFlagsDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a short "IRQNoFlags" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoIrqNoFlagsDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT16                  IrqMask = 0;
+    UINT32                  Interrupts = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_IRQ_NOFLAGS));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Irq.DescriptorType =
+        ACPI_RESOURCE_NAME_IRQ | ASL_RDESC_IRQ_SIZE;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Name */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            /* IRQ bytes are handled here, after the flags and name */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                /* Up to 16 interrupts can be specified in the list */
+
+                Interrupts++;
+                if (Interrupts > 16)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INTERRUPT_LIST,
+                        InitializerOp, NULL);
+                    return (Rnode);
+                }
+
+                /* Only interrupts 0-15 are allowed (mask is 16 bits) */
+
+                if (InitializerOp->Asl.Value.Integer > 15)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_INTERRUPT_NUMBER,
+                        InitializerOp, NULL);
+                }
+                else
+                {
+                    IrqMask |= (1 << ((UINT8) InitializerOp->Asl.Value.Integer));
+                }
+            }
+
+            /* Case 1: First IRQ value in list */
+
+            if (i == 1)
+            {
+                /* Check now for duplicates in list */
+
+                RsCheckListForDuplicates (InitializerOp);
+
+                /* Create a named field at the start of the list */
+
+                RsCreateWordField (InitializerOp, ACPI_RESTAG_INTERRUPT,
+                    CurrentByteOffset + ASL_RESDESC_OFFSET (Irq.IrqMask));
+            }
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Now we can set the interrupt mask */
+
+    Descriptor->Irq.IrqMask = IrqMask;
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrestype2.c b/usr/src/cmd/acpi/iasl/aslrestype2.c
new file mode 100644
index 0000000000..b75c1184eb
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype2.c
@@ -0,0 +1,457 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype2 - Miscellaneous Large resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype2")
+
+/*
+ * This module contains miscellaneous large resource descriptors:
+ *
+ * Register
+ * Interrupt
+ * VendorLong
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoGeneralRegisterDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "Register" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoGeneralRegisterDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_GENERIC_REGISTER));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->GenericReg.DescriptorType = ACPI_RESOURCE_NAME_GENERIC_REGISTER;
+    Descriptor->GenericReg.ResourceLength = 12;
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Address space */
+
+            Descriptor->GenericReg.AddressSpaceId = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_ADDRESSSPACE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (GenericReg.AddressSpaceId));
+           break;
+
+        case 1: /* Register Bit Width */
+
+            Descriptor->GenericReg.BitWidth = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_REGISTERBITWIDTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (GenericReg.BitWidth));
+            break;
+
+        case 2: /* Register Bit Offset */
+
+            Descriptor->GenericReg.BitOffset = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_REGISTERBITOFFSET,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (GenericReg.BitOffset));
+            break;
+
+        case 3: /* Register Address */
+
+            Descriptor->GenericReg.Address = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_ADDRESS,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (GenericReg.Address));
+            break;
+
+        case 4: /* Access Size (ACPI 3.0) */
+
+            Descriptor->GenericReg.AccessSize = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_ACCESSSIZE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (GenericReg.AccessSize));
+
+            if (Descriptor->GenericReg.AccessSize > AML_FIELD_ACCESS_QWORD)
+            {
+                AslError (ASL_ERROR, ASL_MSG_INVALID_ACCESS_SIZE,
+                    InitializerOp, NULL);
+            }
+            break;
+
+        case 5: /* ResourceTag (ACPI 3.0b) */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoInterruptDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "Interrupt" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoInterruptDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    AML_RESOURCE            *Rover = NULL;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 HasResSourceIndex = FALSE;
+    UINT8                   ResSourceIndex = 0;
+    UINT8                   *ResSourceString = NULL;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+    StringLength = RsGetStringDataLength (InitializerOp);
+
+    /* Count the interrupt numbers */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        InitializerOp = ASL_GET_PEER_NODE (InitializerOp);
+
+        if (i <= 6)
+        {
+            if (i == 3 &&
+                InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                /*
+                 * ResourceSourceIndex was specified, always make room for
+                 * it, even if the ResourceSource was omitted.
+                 */
+                OptionIndex++;
+            }
+
+            continue;
+        }
+
+        OptionIndex += 4;
+    }
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_EXTENDED_IRQ) +
+        1 + OptionIndex + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->ExtendedIrq.DescriptorType = ACPI_RESOURCE_NAME_EXTENDED_IRQ;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    Descriptor->ExtendedIrq.ResourceLength  = 2;  /* Flags and table length byte */
+    Descriptor->ExtendedIrq.InterruptCount  = 0;
+
+    Rover = ACPI_CAST_PTR (AML_RESOURCE,
+        (&(Descriptor->ExtendedIrq.Interrupts[0])));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage (Default: consumer (1) */
+
+            RsSetFlagBits (&Descriptor->ExtendedIrq.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* Interrupt Type (or Mode - edge/level) */
+
+            RsSetFlagBits (&Descriptor->ExtendedIrq.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtendedIrq.Flags), 1);
+            break;
+
+        case 2: /* Interrupt Level (or Polarity - Active high/low) */
+
+            RsSetFlagBits (&Descriptor->ExtendedIrq.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTLEVEL,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtendedIrq.Flags), 2);
+            break;
+
+        case 3: /* Share Type - Default: exclusive (0) */
+
+            RsSetFlagBits (&Descriptor->ExtendedIrq.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTSHARE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtendedIrq.Flags), 3);
+            break;
+
+        case 4: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                HasResSourceIndex = TRUE;
+                ResSourceIndex = (UINT8) InitializerOp->Asl.Value.Integer;
+            }
+            break;
+
+        case 5: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    ResSourceString = (UINT8 *) InitializerOp->Asl.Value.String;
+                }
+
+                /* ResourceSourceIndex must also be valid */
+
+                if (!HasResSourceIndex)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                        InitializerOp, NULL);
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (HasResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 6: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+            /*
+             * Interrupt Numbers come through here, repeatedly
+             */
+
+            /* Maximum 255 interrupts allowed for this descriptor */
+
+            if (Descriptor->ExtendedIrq.InterruptCount == 255)
+            {
+                AslError (ASL_ERROR, ASL_MSG_EX_INTERRUPT_LIST,
+                    InitializerOp, NULL);
+                return (Rnode);
+            }
+
+            /* Each interrupt number must be a 32-bit value */
+
+            if (InitializerOp->Asl.Value.Integer > ACPI_UINT32_MAX)
+            {
+                AslError (ASL_ERROR, ASL_MSG_EX_INTERRUPT_NUMBER,
+                    InitializerOp, NULL);
+            }
+
+            /* Save the integer and move pointer to the next one */
+
+            Rover->DwordItem = (UINT32) InitializerOp->Asl.Value.Integer;
+            Rover = ACPI_ADD_PTR (AML_RESOURCE, &(Rover->DwordItem), 4);
+            Descriptor->ExtendedIrq.InterruptCount++;
+            Descriptor->ExtendedIrq.ResourceLength += 4;
+
+            /* Case 7: First interrupt number in list */
+
+            if (i == 7)
+            {
+                if (InitializerOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+                {
+                    /* Must be at least one interrupt */
+
+                    AslError (ASL_ERROR, ASL_MSG_EX_INTERRUPT_LIST_MIN,
+                        InitializerOp, NULL);
+                }
+
+                /* Check now for duplicates in list */
+
+                RsCheckListForDuplicates (InitializerOp);
+
+                /* Create a named field at the start of the list */
+
+                RsCreateDwordField (InitializerOp, ACPI_RESTAG_INTERRUPT,
+                    CurrentByteOffset +
+                    ASL_RESDESC_OFFSET (ExtendedIrq.Interrupts[0]));
+            }
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+
+    /* Add optional ResSourceIndex if present */
+
+    if (HasResSourceIndex)
+    {
+        Rover->ByteItem = ResSourceIndex;
+        Rover = ACPI_ADD_PTR (AML_RESOURCE, &(Rover->ByteItem), 1);
+        Descriptor->ExtendedIrq.ResourceLength += 1;
+    }
+
+    /* Add optional ResSource string if present */
+
+    if (StringLength && ResSourceString)
+    {
+
+        strcpy ((char *) Rover, (char *) ResSourceString);
+        Rover = ACPI_ADD_PTR (
+                    AML_RESOURCE, &(Rover->ByteItem), StringLength);
+
+        Descriptor->ExtendedIrq.ResourceLength = (UINT16)
+            (Descriptor->ExtendedIrq.ResourceLength + StringLength);
+    }
+
+    Rnode->BufferLength =
+        (ASL_RESDESC_OFFSET (ExtendedIrq.Interrupts[0]) -
+        ASL_RESDESC_OFFSET (ExtendedIrq.DescriptorType))
+        + OptionIndex + StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoVendorLargeDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "VendorLong" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoVendorLargeDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *VendorData;
+    UINT32                  i;
+
+
+    /* Count the number of data bytes */
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+
+    for (i = 0; InitializerOp; i++)
+    {
+        if (InitializerOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+        {
+            break;
+        }
+        InitializerOp = InitializerOp->Asl.Next;
+    }
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    Rnode = RsAllocateResourceNode (sizeof (AML_RESOURCE_VENDOR_LARGE) + i);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->VendorLarge.DescriptorType = ACPI_RESOURCE_NAME_VENDOR_LARGE;
+    Descriptor->VendorLarge.ResourceLength = (UINT16) i;
+
+    /* Point to end-of-descriptor for vendor data */
+
+    VendorData = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_LARGE_HEADER);
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        if (InitializerOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+        {
+            break;
+        }
+
+        VendorData[i] = (UINT8) InitializerOp->Asl.Value.Integer;
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrestype2d.c b/usr/src/cmd/acpi/iasl/aslrestype2d.c
new file mode 100644
index 0000000000..c7841b0fcc
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype2d.c
@@ -0,0 +1,737 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype2d - Large DWord address resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype2d")
+
+/*
+ * This module contains the Dword (32-bit) address space descriptors:
+ *
+ * DwordIO
+ * DwordMemory
+ * DwordSpace
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoDwordIoDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "DwordIO" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoDwordIoDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT8                   *OptionalFields;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS32) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address32.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS32;
+    Descriptor->Address32.ResourceType  = ACPI_ADDRESS_TYPE_IO_RANGE;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS32);
+    Descriptor->Address32.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS32) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 2);
+            break;
+
+        case 2: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 3);
+            break;
+
+        case 3: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 1);
+            break;
+
+        case 4: /* Range Type */
+
+            RsSetFlagBits (&Descriptor->Address32.SpecificFlags, InitializerOp, 0, 3);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_RANGETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.SpecificFlags), 0, 2);
+            break;
+
+        case 5: /* Address Granularity */
+
+            Descriptor->Address32.Granularity =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 6: /* Address Min */
+
+            Descriptor->Address32.Minimum =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 7: /* Address Max */
+
+            Descriptor->Address32.Maximum =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 8: /* Translation Offset */
+
+            Descriptor->Address32.TranslationOffset =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.TranslationOffset));
+            break;
+
+        case 9: /* Address Length */
+
+            Descriptor->Address32.AddressLength =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 10: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                /* Found a valid ResourceSourceIndex */
+
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address32.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 11: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    /* Found a valid ResourceSource */
+
+                    Descriptor->Address32.ResourceLength = (UINT16)
+                        (Descriptor->Address32.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 12: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 13: /* Type */
+
+            RsSetFlagBits (&Descriptor->Address32.SpecificFlags, InitializerOp, 4, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.SpecificFlags), 4);
+            break;
+
+        case 14: /* Translation Type */
+
+            RsSetFlagBits (&Descriptor->Address32.SpecificFlags, InitializerOp, 5, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TRANSTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.SpecificFlags), 5);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        (UINT64) Descriptor->Address32.Minimum,
+        (UINT64) Descriptor->Address32.Maximum,
+        (UINT64) Descriptor->Address32.AddressLength,
+        (UINT64) Descriptor->Address32.Granularity,
+        Descriptor->Address32.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS32) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoDwordMemoryDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "DwordMemory" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoDwordMemoryDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+                sizeof (AML_RESOURCE_ADDRESS32) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address32.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS32;
+    Descriptor->Address32.ResourceType  = ACPI_ADDRESS_TYPE_MEMORY_RANGE;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS32);
+    Descriptor->Address32.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS32) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 1);
+            break;
+
+        case 2: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 2);
+            break;
+
+        case 3: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 3);
+            break;
+
+        case 4: /* Memory Type */
+
+            RsSetFlagBits (&Descriptor->Address32.SpecificFlags, InitializerOp, 1, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_MEMTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.SpecificFlags), 1, 2);
+            break;
+
+        case 5: /* Read/Write Type */
+
+            RsSetFlagBits (&Descriptor->Address32.SpecificFlags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_READWRITETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.SpecificFlags), 0);
+            break;
+
+        case 6: /* Address Granularity */
+
+            Descriptor->Address32.Granularity =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 7: /* Min Address */
+
+            Descriptor->Address32.Minimum =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 8: /* Max Address */
+
+            Descriptor->Address32.Maximum =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 9: /* Translation Offset */
+
+            Descriptor->Address32.TranslationOffset =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.TranslationOffset));
+            break;
+
+        case 10: /* Address Length */
+
+            Descriptor->Address32.AddressLength =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 11: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address32.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 12: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address32.ResourceLength = (UINT16)
+                        (Descriptor->Address32.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 13: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+
+        case 14: /* Address Range */
+
+            RsSetFlagBits (&Descriptor->Address32.SpecificFlags, InitializerOp, 3, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_MEMATTRIBUTES,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.SpecificFlags), 3, 2);
+            break;
+
+        case 15: /* Type */
+
+            RsSetFlagBits (&Descriptor->Address32.SpecificFlags, InitializerOp, 5, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.SpecificFlags), 5);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        (UINT64) Descriptor->Address32.Minimum,
+        (UINT64) Descriptor->Address32.Maximum,
+        (UINT64) Descriptor->Address32.AddressLength,
+        (UINT64) Descriptor->Address32.Granularity,
+        Descriptor->Address32.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS32) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoDwordSpaceDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "DwordSpace" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoDwordSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS32) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address32.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS32;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS32);
+    Descriptor->Address32.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS32) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Type */
+
+            Descriptor->Address32.ResourceType =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 1: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 2: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 1);
+            break;
+
+        case 3: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 2);
+            break;
+
+        case 4: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address32.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Flags), 3);
+            break;
+
+        case 5: /* Type-Specific flags */
+
+            Descriptor->Address32.SpecificFlags =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 6: /* Address Granularity */
+
+            Descriptor->Address32.Granularity =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 7: /* Min Address */
+
+            Descriptor->Address32.Minimum =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 8: /* Max Address */
+
+            Descriptor->Address32.Maximum =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 9: /* Translation Offset */
+
+            Descriptor->Address32.TranslationOffset =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.TranslationOffset));
+            break;
+
+        case 10: /* Address Length */
+
+            Descriptor->Address32.AddressLength =
+                (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address32.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 11: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address32.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 12: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address32.ResourceLength = (UINT16)
+                        (Descriptor->Address32.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 13: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST,
+                InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        (UINT64) Descriptor->Address32.Minimum,
+        (UINT64) Descriptor->Address32.Maximum,
+        (UINT64) Descriptor->Address32.AddressLength,
+        (UINT64) Descriptor->Address32.Granularity,
+        Descriptor->Address32.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS32) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrestype2e.c b/usr/src/cmd/acpi/iasl/aslrestype2e.c
new file mode 100644
index 0000000000..aa17a755ab
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype2e.c
@@ -0,0 +1,571 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype2e - Large Extended address resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype2e")
+
+/*
+ * This module contains the Extended (64-bit) address space descriptors:
+ *
+ * ExtendedIO
+ * ExtendedMemory
+ * ExtendedSpace
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoExtendedIoDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "ExtendedIO" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoExtendedIoDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT16                  StringLength = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->ExtAddress64.DescriptorType = ACPI_RESOURCE_NAME_EXTENDED_ADDRESS64;
+    Descriptor->ExtAddress64.ResourceType = ACPI_ADDRESS_TYPE_IO_RANGE;
+    Descriptor->ExtAddress64.RevisionID = AML_RESOURCE_EXTENDED_ADDRESS_REVISION;
+
+    Descriptor->ExtAddress64.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* MinType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 2);
+            break;
+
+        case 2: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 3);
+            break;
+
+        case 3: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 1);
+            break;
+
+        case 4: /* Range Type */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.SpecificFlags, InitializerOp, 0, 3);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_RANGETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.SpecificFlags), 0, 2);
+            break;
+
+        case 5: /* Address Granularity */
+
+            Descriptor->ExtAddress64.Granularity = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 6: /* Address Min */
+
+            Descriptor->ExtAddress64.Minimum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 7: /* Address Max */
+
+            Descriptor->ExtAddress64.Maximum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 8: /* Translation Offset */
+
+            Descriptor->ExtAddress64.TranslationOffset = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.TranslationOffset));
+            break;
+
+        case 9: /* Address Length */
+
+            Descriptor->ExtAddress64.AddressLength = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 10: /* Type-Specific Attributes */
+
+            Descriptor->ExtAddress64.TypeSpecific = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TYPESPECIFICATTRIBUTES,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.TypeSpecific));
+            break;
+
+        case 11: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 12: /* Type */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.SpecificFlags, InitializerOp, 4, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.SpecificFlags), 4);
+            break;
+
+        case 13: /* Translation Type */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.SpecificFlags, InitializerOp, 5, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TRANSTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.SpecificFlags), 5);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        Descriptor->ExtAddress64.Minimum,
+        Descriptor->ExtAddress64.Maximum,
+        Descriptor->ExtAddress64.AddressLength,
+        Descriptor->ExtAddress64.Granularity,
+        Descriptor->ExtAddress64.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) +
+        StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoExtendedMemoryDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "ExtendedMemory" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoExtendedMemoryDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT16                  StringLength = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+                sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->ExtAddress64.DescriptorType = ACPI_RESOURCE_NAME_EXTENDED_ADDRESS64;
+    Descriptor->ExtAddress64.ResourceType = ACPI_ADDRESS_TYPE_MEMORY_RANGE;
+    Descriptor->ExtAddress64.RevisionID = AML_RESOURCE_EXTENDED_ADDRESS_REVISION;
+
+    Descriptor->ExtAddress64.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 1);
+            break;
+
+        case 2: /* MinType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 2);
+            break;
+
+        case 3: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 3);
+            break;
+
+        case 4: /* Memory Type */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.SpecificFlags, InitializerOp, 1, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_MEMTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.SpecificFlags), 1, 2);
+            break;
+
+        case 5: /* Read/Write Type */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.SpecificFlags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_READWRITETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.SpecificFlags), 0);
+            break;
+
+        case 6: /* Address Granularity */
+
+            Descriptor->ExtAddress64.Granularity = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 7: /* Min Address */
+
+            Descriptor->ExtAddress64.Minimum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 8: /* Max Address */
+
+            Descriptor->ExtAddress64.Maximum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 9: /* Translation Offset */
+
+            Descriptor->ExtAddress64.TranslationOffset = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.TranslationOffset));
+            break;
+
+        case 10: /* Address Length */
+
+            Descriptor->ExtAddress64.AddressLength = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 11: /* Type-Specific Attributes */
+
+            Descriptor->ExtAddress64.TypeSpecific = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TYPESPECIFICATTRIBUTES,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.TypeSpecific));
+            break;
+
+        case 12: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+
+        case 13: /* Address Range */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.SpecificFlags, InitializerOp, 3, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_MEMATTRIBUTES,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.SpecificFlags), 3, 2);
+            break;
+
+        case 14: /* Type */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.SpecificFlags, InitializerOp, 5, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.SpecificFlags), 5);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        Descriptor->ExtAddress64.Minimum,
+        Descriptor->ExtAddress64.Maximum,
+        Descriptor->ExtAddress64.AddressLength,
+        Descriptor->ExtAddress64.Granularity,
+        Descriptor->ExtAddress64.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) +
+        StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoExtendedSpaceDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "ExtendedSpace" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoExtendedSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT16                  StringLength = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->ExtAddress64.DescriptorType = ACPI_RESOURCE_NAME_EXTENDED_ADDRESS64;
+    Descriptor->ExtAddress64.RevisionID = AML_RESOURCE_EXTENDED_ADDRESS_REVISION;
+
+    Descriptor->ExtAddress64.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Type */
+
+            Descriptor->ExtAddress64.ResourceType =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 1: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 2: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 1);
+            break;
+
+        case 3: /* MinType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 2);
+            break;
+
+        case 4: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->ExtAddress64.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Flags), 3);
+            break;
+
+        case 5: /* Type-Specific flags */
+
+            Descriptor->ExtAddress64.SpecificFlags =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 6: /* Address Granularity */
+
+            Descriptor->ExtAddress64.Granularity = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 7: /* Min Address */
+
+            Descriptor->ExtAddress64.Minimum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 8: /* Max Address */
+
+            Descriptor->ExtAddress64.Maximum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 9: /* Translation Offset */
+
+            Descriptor->ExtAddress64.TranslationOffset = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.TranslationOffset));
+            break;
+
+        case 10: /* Address Length */
+
+            Descriptor->ExtAddress64.AddressLength = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 11: /* Type-Specific Attributes */
+
+            Descriptor->ExtAddress64.TypeSpecific = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TYPESPECIFICATTRIBUTES,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (ExtAddress64.TypeSpecific));
+            break;
+
+        case 12: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        Descriptor->ExtAddress64.Minimum,
+        Descriptor->ExtAddress64.Maximum,
+        Descriptor->ExtAddress64.AddressLength,
+        Descriptor->ExtAddress64.Granularity,
+        Descriptor->ExtAddress64.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_EXTENDED_ADDRESS64) +
+        StringLength;
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrestype2q.c b/usr/src/cmd/acpi/iasl/aslrestype2q.c
new file mode 100644
index 0000000000..c8d8cabea9
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype2q.c
@@ -0,0 +1,716 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype2q - Large QWord address resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype2q")
+
+/*
+ * This module contains the QWord (64-bit) address space descriptors:
+ *
+ * QWordIO
+ * QWordMemory
+ * QWordSpace
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoQwordIoDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "QwordIO" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoQwordIoDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS64) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address64.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS64;
+    Descriptor->Address64.ResourceType = ACPI_ADDRESS_TYPE_IO_RANGE;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS64);
+    Descriptor->Address64.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS64) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 2);
+            break;
+
+        case 2: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 3);
+            break;
+
+        case 3: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 1);
+            break;
+
+        case 4: /* Range Type */
+
+            RsSetFlagBits (&Descriptor->Address64.SpecificFlags, InitializerOp, 0, 3);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_RANGETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.SpecificFlags), 0, 2);
+            break;
+
+        case 5: /* Address Granularity */
+
+            Descriptor->Address64.Granularity = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 6: /* Address Min */
+
+            Descriptor->Address64.Minimum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 7: /* Address Max */
+
+            Descriptor->Address64.Maximum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 8: /* Translation Offset */
+
+            Descriptor->Address64.TranslationOffset = InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.TranslationOffset));
+            break;
+
+        case 9: /* Address Length */
+
+            Descriptor->Address64.AddressLength = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 10: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address64.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 11: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address64.ResourceLength = (UINT16)
+                        (Descriptor->Address64.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 12: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 13: /* Type */
+
+            RsSetFlagBits (&Descriptor->Address64.SpecificFlags, InitializerOp, 4, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.SpecificFlags), 4);
+            break;
+
+        case 14: /* Translation Type */
+
+            RsSetFlagBits (&Descriptor->Address64.SpecificFlags, InitializerOp, 5, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TRANSTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.SpecificFlags), 5);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        Descriptor->Address64.Minimum,
+        Descriptor->Address64.Maximum,
+        Descriptor->Address64.AddressLength,
+        Descriptor->Address64.Granularity,
+        Descriptor->Address64.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS64) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoQwordMemoryDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "QwordMemory" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoQwordMemoryDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS64) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address64.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS64;
+    Descriptor->Address64.ResourceType = ACPI_ADDRESS_TYPE_MEMORY_RANGE;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS64);
+    Descriptor->Address64.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS64) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 1);
+            break;
+
+        case 2: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 2);
+            break;
+
+        case 3: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 3);
+            break;
+
+        case 4: /* Memory Type */
+
+            RsSetFlagBits (&Descriptor->Address64.SpecificFlags, InitializerOp, 1, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_MEMTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.SpecificFlags), 1, 2);
+            break;
+
+        case 5: /* Read/Write Type */
+
+            RsSetFlagBits (&Descriptor->Address64.SpecificFlags, InitializerOp, 0, 1);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_READWRITETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.SpecificFlags), 0);
+            break;
+
+        case 6: /* Address Granularity */
+
+            Descriptor->Address64.Granularity = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 7: /* Min Address */
+
+            Descriptor->Address64.Minimum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 8: /* Max Address */
+
+            Descriptor->Address64.Maximum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 9: /* Translation Offset */
+
+            Descriptor->Address64.TranslationOffset = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.TranslationOffset));
+            break;
+
+        case 10: /* Address Length */
+
+            Descriptor->Address64.AddressLength = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 11: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address64.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 12: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address64.ResourceLength = (UINT16)
+                        (Descriptor->Address64.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 13: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+
+        case 14: /* Address Range */
+
+            RsSetFlagBits (&Descriptor->Address64.SpecificFlags, InitializerOp, 3, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_MEMATTRIBUTES,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.SpecificFlags), 3, 2);
+            break;
+
+        case 15: /* Type */
+
+            RsSetFlagBits (&Descriptor->Address64.SpecificFlags, InitializerOp, 5, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.SpecificFlags), 5);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        Descriptor->Address64.Minimum,
+        Descriptor->Address64.Maximum,
+        Descriptor->Address64.AddressLength,
+        Descriptor->Address64.Granularity,
+        Descriptor->Address64.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS64) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoQwordSpaceDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "QwordSpace" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoQwordSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS64) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address64.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS64;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS64);
+    Descriptor->Address64.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS64) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Type */
+
+            Descriptor->Address64.ResourceType =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 1: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 2: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 1);
+            break;
+
+        case 3: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 2);
+            break;
+
+        case 4: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address64.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Flags), 3);
+            break;
+
+        case 5: /* Type-Specific flags */
+
+            Descriptor->Address64.SpecificFlags =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 6: /* Address Granularity */
+
+            Descriptor->Address64.Granularity = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 7: /* Min Address */
+
+            Descriptor->Address64.Minimum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 8: /* Max Address */
+
+            Descriptor->Address64.Maximum = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 9: /* Translation Offset */
+
+            Descriptor->Address64.TranslationOffset = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.TranslationOffset));
+            break;
+
+        case 10: /* Address Length */
+
+            Descriptor->Address64.AddressLength = InitializerOp->Asl.Value.Integer;
+            RsCreateQwordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address64.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 11: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address64.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 12: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address64.ResourceLength = (UINT16)
+                        (Descriptor->Address64.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 13: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        Descriptor->Address64.Minimum,
+        Descriptor->Address64.Maximum,
+        Descriptor->Address64.AddressLength,
+        Descriptor->Address64.Granularity,
+        Descriptor->Address64.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS64) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrestype2s.c b/usr/src/cmd/acpi/iasl/aslrestype2s.c
new file mode 100644
index 0000000000..fcd8e23781
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype2s.c
@@ -0,0 +1,1230 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype2s - Serial Large resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype2s")
+
+
+static UINT16
+RsGetBufferDataLength (
+    ACPI_PARSE_OBJECT       *InitializerOp);
+
+static UINT16
+RsGetInterruptDataLength (
+    ACPI_PARSE_OBJECT       *InitializerOp);
+
+static BOOLEAN
+RsGetVendorData (
+    ACPI_PARSE_OBJECT       *InitializerOp,
+    UINT8                   *VendorData,
+    ACPI_SIZE               DescriptorOffset);
+
+/*
+ * This module contains descriptors for serial buses and GPIO:
+ *
+ * GpioInt
+ * GpioIo
+ * I2cSerialBus
+ * SpiSerialBus
+ * UartSerialBus
+ */
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsGetBufferDataLength
+ *
+ * PARAMETERS:  InitializerOp       - Current parse op, start of the resource
+ *                                    descriptor
+ *
+ * RETURN:      Length of the data buffer
+ *
+ * DESCRIPTION: Get the length of a RawDataBuffer, used for vendor data.
+ *
+ ******************************************************************************/
+
+static UINT16
+RsGetBufferDataLength (
+    ACPI_PARSE_OBJECT       *InitializerOp)
+{
+    UINT16                  ExtraDataSize = 0;
+    ACPI_PARSE_OBJECT       *DataList;
+
+
+    /* Find the byte-initializer list */
+
+    while (InitializerOp)
+    {
+        if (InitializerOp->Asl.ParseOpcode == PARSEOP_DATABUFFER)
+        {
+            /* First child is the optional length (ignore it here) */
+
+            DataList = InitializerOp->Asl.Child;
+            DataList = ASL_GET_PEER_NODE (DataList);
+
+            /* Count the data items (each one is a byte of data) */
+
+            while (DataList)
+            {
+                ExtraDataSize++;
+                DataList = ASL_GET_PEER_NODE (DataList);
+            }
+
+            return (ExtraDataSize);
+        }
+
+        InitializerOp = ASL_GET_PEER_NODE (InitializerOp);
+    }
+
+    return (ExtraDataSize);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsGetInterruptDataLength
+ *
+ * PARAMETERS:  InitializerOp       - Current parse op, start of the resource
+ *                                    descriptor
+ *
+ * RETURN:      Length of the interrupt data list
+ *
+ * DESCRIPTION: Get the length of a list of interrupt DWORDs for the GPIO
+ *              descriptors.
+ *
+ ******************************************************************************/
+
+static UINT16
+RsGetInterruptDataLength (
+    ACPI_PARSE_OBJECT       *InitializerOp)
+{
+    UINT16                  InterruptLength;
+    UINT32                  i;
+
+
+    /* Count the interrupt numbers */
+
+    InterruptLength = 0;
+    for (i = 0; InitializerOp; i++)
+    {
+        InitializerOp = ASL_GET_PEER_NODE (InitializerOp);
+
+        /* Interrupt list starts at offset 10 (Gpio descriptors) */
+
+        if (i >= 10)
+        {
+            InterruptLength += 2;
+        }
+    }
+
+    return (InterruptLength);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsGetVendorData
+ *
+ * PARAMETERS:  InitializerOp       - Current parse op, start of the resource
+ *                                    descriptor.
+ *              VendorData          - Where the vendor data is returned
+ *              DescriptorOffset    - Where vendor data begins in descriptor
+ *
+ * RETURN:      TRUE if valid vendor data was returned, FALSE otherwise.
+ *
+ * DESCRIPTION: Extract the vendor data and construct a vendor data buffer.
+ *
+ ******************************************************************************/
+
+static BOOLEAN
+RsGetVendorData (
+    ACPI_PARSE_OBJECT       *InitializerOp,
+    UINT8                   *VendorData,
+    ACPI_SIZE               DescriptorOffset)
+{
+    ACPI_PARSE_OBJECT       *BufferOp;
+    UINT32                  SpecifiedLength = ACPI_UINT32_MAX;
+    UINT16                  ActualLength = 0;
+
+
+    /* Vendor Data field is always optional */
+
+    if (InitializerOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+    {
+        return (FALSE);
+    }
+
+    BufferOp = InitializerOp->Asl.Child;
+    if (!BufferOp)
+    {
+        AslError (ASL_ERROR, ASL_MSG_SYNTAX, InitializerOp, "");
+        return (FALSE);
+    }
+
+    /* First child is the optional buffer length (WORD) */
+
+    if (BufferOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+    {
+        SpecifiedLength = (UINT16) BufferOp->Asl.Value.Integer;
+    }
+
+    /* Insert field tag _VEN */
+
+    RsCreateByteField (InitializerOp, ACPI_RESTAG_VENDORDATA,
+        (UINT16) DescriptorOffset);
+
+    /* Walk the list of buffer initializers (each is one byte) */
+
+    BufferOp = RsCompleteNodeAndGetNext (BufferOp);
+    if (BufferOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+    {
+        while (BufferOp)
+        {
+            *VendorData = (UINT8) BufferOp->Asl.Value.Integer;
+            VendorData++;
+            ActualLength++;
+            BufferOp = RsCompleteNodeAndGetNext (BufferOp);
+        }
+    }
+
+    /* Length validation. Buffer cannot be of zero length */
+
+    if ((SpecifiedLength == 0) ||
+        ((SpecifiedLength == ACPI_UINT32_MAX) && (ActualLength == 0)))
+    {
+        AslError (ASL_ERROR, ASL_MSG_BUFFER_LENGTH, InitializerOp, NULL);
+        return (FALSE);
+    }
+
+    if (SpecifiedLength != ACPI_UINT32_MAX)
+    {
+        /* ActualLength > SpecifiedLength -> error */
+
+        if (ActualLength > SpecifiedLength)
+        {
+            AslError (ASL_ERROR, ASL_MSG_LIST_LENGTH_LONG, InitializerOp, NULL);
+            return (FALSE);
+        }
+
+        /* ActualLength < SpecifiedLength -> remark */
+
+        else if (ActualLength < SpecifiedLength)
+        {
+            AslError (ASL_REMARK, ASL_MSG_LIST_LENGTH_SHORT, InitializerOp, NULL);
+            return (FALSE);
+        }
+    }
+
+    return (TRUE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoGpioIntDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "GpioInt" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoGpioIntDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    char                    *ResourceSource = NULL;
+    UINT8                   *VendorData = NULL;
+    UINT16                  *InterruptList = NULL;
+    UINT16                  *PinList = NULL;
+    UINT16                  ResSourceLength;
+    UINT16                  VendorLength;
+    UINT16                  InterruptLength;
+    UINT16                  DescriptorSize;
+    UINT32                  CurrentByteOffset;
+    UINT32                  PinCount = 0;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    /*
+     * Calculate lengths for fields that have variable length:
+     * 1) Resource Source string
+     * 2) Vendor Data buffer
+     * 3) PIN (interrupt) list
+     */
+    ResSourceLength = RsGetStringDataLength (InitializerOp);
+    VendorLength = RsGetBufferDataLength (InitializerOp);
+    InterruptLength = RsGetInterruptDataLength (InitializerOp);
+
+    DescriptorSize = ACPI_AML_SIZE_LARGE (AML_RESOURCE_GPIO) +
+        ResSourceLength + VendorLength + InterruptLength;
+
+    /* Allocate the local resource node and initialize */
+
+    Rnode = RsAllocateResourceNode (DescriptorSize +
+        sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Gpio.ResourceLength = DescriptorSize;
+    Descriptor->Gpio.DescriptorType = ACPI_RESOURCE_NAME_GPIO;
+    Descriptor->Gpio.RevisionId = AML_RESOURCE_GPIO_REVISION;
+    Descriptor->Gpio.ConnectionType = AML_RESOURCE_GPIO_TYPE_INT;
+
+    /* Build pointers to optional areas */
+
+    InterruptList = ACPI_ADD_PTR (UINT16, Descriptor,
+        sizeof (AML_RESOURCE_GPIO));
+    PinList = InterruptList;
+    ResourceSource = ACPI_ADD_PTR (char, InterruptList, InterruptLength);
+    VendorData = ACPI_ADD_PTR (UINT8, ResourceSource, ResSourceLength);
+
+    /* Setup offsets within the descriptor */
+
+    Descriptor->Gpio.PinTableOffset = (UINT16)
+        ACPI_PTR_DIFF (InterruptList, Descriptor);
+
+    Descriptor->Gpio.ResSourceOffset = (UINT16)
+        ACPI_PTR_DIFF (ResourceSource, Descriptor);
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Interrupt Mode - edge/level [Flag] (_MOD) */
+
+            RsSetFlagBits16 (&Descriptor->Gpio.IntFlags, InitializerOp, 0, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.IntFlags), 0);
+            break;
+
+        case 1: /* Interrupt Polarity - Active high/low [Flags] (_POL) */
+
+            RsSetFlagBits16 (&Descriptor->Gpio.IntFlags, InitializerOp, 1, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_POLARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.IntFlags), 1, 2);
+            break;
+
+        case 2: /* Share Type - Default: exclusive (0) [Flags] (_SHR) */
+
+            RsSetFlagBits16 (&Descriptor->Gpio.IntFlags, InitializerOp, 3, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_INTERRUPTSHARE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.IntFlags), 3, 2);
+            break;
+
+        case 3: /* Pin Config [BYTE] (_PPI) */
+
+            Descriptor->Gpio.PinConfig = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_PINCONFIG,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.PinConfig));
+            break;
+
+        case 4: /* Debounce Timeout [WORD] (_DBT) */
+
+            Descriptor->Gpio.DebounceTimeout = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_DEBOUNCETIME,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.DebounceTimeout));
+            break;
+
+        case 5: /* ResSource [Optional Field - STRING] */
+
+            if (ResSourceLength)
+            {
+                /* Copy string to the descriptor */
+
+                strcpy (ResourceSource,
+                    InitializerOp->Asl.Value.String);
+            }
+            break;
+
+        case 6: /* Resource Index */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                Descriptor->Gpio.ResSourceIndex =
+                    (UINT8) InitializerOp->Asl.Value.Integer;
+            }
+            break;
+
+        case 7: /* Resource Usage (consumer/producer) */
+
+            RsSetFlagBits16 (&Descriptor->Gpio.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 8: /* Resource Tag (Descriptor Name) */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 9: /* Vendor Data (Optional - Buffer of BYTEs) (_VEN) */
+
+            /*
+             * Always set the VendorOffset even if there is no Vendor Data.
+             * This field is required in order to calculate the length
+             * of the ResourceSource at runtime.
+             */
+            Descriptor->Gpio.VendorOffset = (UINT16)
+                ACPI_PTR_DIFF (VendorData, Descriptor);
+
+            if (RsGetVendorData (InitializerOp, VendorData,
+                (CurrentByteOffset +  Descriptor->Gpio.VendorOffset)))
+            {
+                Descriptor->Gpio.VendorLength = VendorLength;
+            }
+            break;
+
+        default:
+            /*
+             * PINs come through here, repeatedly. Each PIN must be a WORD.
+             * NOTE: there is no "length" field for this, so from ACPI spec:
+             *  The number of pins in the table can be calculated from:
+             *  PinCount = (Resource Source Name Offset - Pin Table Offset) / 2
+             *  (implies resource source must immediately follow the pin list.)
+             *  Name: _PIN
+             */
+            *InterruptList = (UINT16) InitializerOp->Asl.Value.Integer;
+            InterruptList++;
+            PinCount++;
+
+            /* Case 10: First interrupt number in list */
+
+            if (i == 10)
+            {
+                if (InitializerOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+                {
+                    /* Must be at least one interrupt */
+
+                    AslError (ASL_ERROR, ASL_MSG_EX_INTERRUPT_LIST_MIN,
+                        InitializerOp, NULL);
+                }
+
+                /* Check now for duplicates in list */
+
+                RsCheckListForDuplicates (InitializerOp);
+
+                /* Create a named field at the start of the list */
+
+                RsCreateWordField (InitializerOp, ACPI_RESTAG_PIN,
+                    CurrentByteOffset + Descriptor->Gpio.PinTableOffset);
+            }
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    MpSaveGpioInfo (Info->MappingOp, Descriptor,
+        PinCount, PinList, ResourceSource);
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoGpioIoDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "GpioIo" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoGpioIoDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    char                    *ResourceSource = NULL;
+    UINT8                   *VendorData = NULL;
+    UINT16                  *InterruptList = NULL;
+    UINT16                  *PinList = NULL;
+    UINT16                  ResSourceLength;
+    UINT16                  VendorLength;
+    UINT16                  InterruptLength;
+    UINT16                  DescriptorSize;
+    UINT32                  CurrentByteOffset;
+    UINT32                  PinCount = 0;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    /*
+     * Calculate lengths for fields that have variable length:
+     * 1) Resource Source string
+     * 2) Vendor Data buffer
+     * 3) PIN (interrupt) list
+     */
+    ResSourceLength = RsGetStringDataLength (InitializerOp);
+    VendorLength = RsGetBufferDataLength (InitializerOp);
+    InterruptLength = RsGetInterruptDataLength (InitializerOp);
+    PinList = InterruptList;
+
+    DescriptorSize = ACPI_AML_SIZE_LARGE (AML_RESOURCE_GPIO) +
+        ResSourceLength + VendorLength + InterruptLength;
+
+    /* Allocate the local resource node and initialize */
+
+    Rnode = RsAllocateResourceNode (DescriptorSize +
+        sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Gpio.ResourceLength = DescriptorSize;
+    Descriptor->Gpio.DescriptorType = ACPI_RESOURCE_NAME_GPIO;
+    Descriptor->Gpio.RevisionId = AML_RESOURCE_GPIO_REVISION;
+    Descriptor->Gpio.ConnectionType = AML_RESOURCE_GPIO_TYPE_IO;
+
+    /* Build pointers to optional areas */
+
+    InterruptList = ACPI_ADD_PTR (UINT16, Descriptor, sizeof (AML_RESOURCE_GPIO));
+    PinList = InterruptList;
+    ResourceSource = ACPI_ADD_PTR (char, InterruptList, InterruptLength);
+    VendorData = ACPI_ADD_PTR (UINT8, ResourceSource, ResSourceLength);
+
+    /* Setup offsets within the descriptor */
+
+    Descriptor->Gpio.PinTableOffset = (UINT16)
+        ACPI_PTR_DIFF (InterruptList, Descriptor);
+
+    Descriptor->Gpio.ResSourceOffset = (UINT16)
+        ACPI_PTR_DIFF (ResourceSource, Descriptor);
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Share Type [Flags] (_SHR) */
+
+            RsSetFlagBits16 (&Descriptor->Gpio.IntFlags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTSHARE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.IntFlags), 3);
+            break;
+
+        case 1: /* Pin Config [BYTE] (_PPI) */
+
+            Descriptor->Gpio.PinConfig = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_PINCONFIG,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.PinConfig));
+            break;
+
+        case 2: /* Debounce Timeout [WORD] (_DBT) */
+
+            Descriptor->Gpio.DebounceTimeout = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_DEBOUNCETIME,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.DebounceTimeout));
+            break;
+
+        case 3: /* Drive Strength [WORD] (_DRS) */
+
+            Descriptor->Gpio.DriveStrength = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_DRIVESTRENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.DriveStrength));
+            break;
+
+        case 4: /* I/O Restriction [Flag] (_IOR) */
+
+            RsSetFlagBits16 (&Descriptor->Gpio.IntFlags, InitializerOp, 0, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_IORESTRICTION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Gpio.IntFlags), 0, 2);
+            break;
+
+        case 5: /* ResSource [Optional Field - STRING] */
+
+            if (ResSourceLength)
+            {
+                /* Copy string to the descriptor */
+
+                strcpy (ResourceSource,
+                    InitializerOp->Asl.Value.String);
+            }
+            break;
+
+        case 6: /* Resource Index */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                Descriptor->Gpio.ResSourceIndex = (UINT8) InitializerOp->Asl.Value.Integer;
+            }
+            break;
+
+        case 7: /* Resource Usage (consumer/producer) */
+
+            RsSetFlagBits16 (&Descriptor->Gpio.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 8: /* Resource Tag (Descriptor Name) */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 9: /* Vendor Data (Optional - Buffer of BYTEs) (_VEN) */
+            /*
+             * Always set the VendorOffset even if there is no Vendor Data.
+             * This field is required in order to calculate the length
+             * of the ResourceSource at runtime.
+             */
+            Descriptor->Gpio.VendorOffset = (UINT16)
+                ACPI_PTR_DIFF (VendorData, Descriptor);
+
+            if (RsGetVendorData (InitializerOp, VendorData,
+                (CurrentByteOffset + Descriptor->Gpio.VendorOffset)))
+            {
+                Descriptor->Gpio.VendorLength = VendorLength;
+            }
+            break;
+
+        default:
+            /*
+             * PINs come through here, repeatedly. Each PIN must be a WORD.
+             * NOTE: there is no "length" field for this, so from ACPI spec:
+             *  The number of pins in the table can be calculated from:
+             *  PinCount = (Resource Source Name Offset - Pin Table Offset) / 2
+             *  (implies resource source must immediately follow the pin list.)
+             *  Name: _PIN
+             */
+            *InterruptList = (UINT16) InitializerOp->Asl.Value.Integer;
+            InterruptList++;
+            PinCount++;
+
+            /* Case 10: First interrupt number in list */
+
+            if (i == 10)
+            {
+                if (InitializerOp->Asl.ParseOpcode == PARSEOP_DEFAULT_ARG)
+                {
+                    /* Must be at least one interrupt */
+
+                    AslError (ASL_ERROR, ASL_MSG_EX_INTERRUPT_LIST_MIN,
+                        InitializerOp, NULL);
+                }
+
+                /* Check now for duplicates in list */
+
+                RsCheckListForDuplicates (InitializerOp);
+
+                /* Create a named field at the start of the list */
+
+                RsCreateWordField (InitializerOp, ACPI_RESTAG_PIN,
+                    CurrentByteOffset + Descriptor->Gpio.PinTableOffset);
+            }
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    MpSaveGpioInfo (Info->MappingOp, Descriptor,
+        PinCount, PinList, ResourceSource);
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoI2cSerialBusDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "I2cSerialBus" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoI2cSerialBusDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    char                    *ResourceSource = NULL;
+    UINT8                   *VendorData = NULL;
+    UINT16                  ResSourceLength;
+    UINT16                  VendorLength;
+    UINT16                  DescriptorSize;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    /*
+     * Calculate lengths for fields that have variable length:
+     * 1) Resource Source string
+     * 2) Vendor Data buffer
+     */
+    ResSourceLength = RsGetStringDataLength (InitializerOp);
+    VendorLength = RsGetBufferDataLength (InitializerOp);
+
+    DescriptorSize = ACPI_AML_SIZE_LARGE (AML_RESOURCE_I2C_SERIALBUS) +
+        ResSourceLength + VendorLength;
+
+    /* Allocate the local resource node and initialize */
+
+    Rnode = RsAllocateResourceNode (DescriptorSize +
+        sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->I2cSerialBus.ResourceLength = DescriptorSize;
+    Descriptor->I2cSerialBus.DescriptorType = ACPI_RESOURCE_NAME_SERIAL_BUS;
+    Descriptor->I2cSerialBus.RevisionId = AML_RESOURCE_I2C_REVISION;
+    Descriptor->I2cSerialBus.TypeRevisionId = AML_RESOURCE_I2C_TYPE_REVISION;
+    Descriptor->I2cSerialBus.Type = AML_RESOURCE_I2C_SERIALBUSTYPE;
+    Descriptor->I2cSerialBus.TypeDataLength = AML_RESOURCE_I2C_MIN_DATA_LEN + VendorLength;
+
+    if (Info->DescriptorTypeOp->Asl.ParseOpcode == PARSEOP_I2C_SERIALBUS_V2)
+    {
+        Descriptor->I2cSerialBus.RevisionId = 2;
+    }
+
+    /* Build pointers to optional areas */
+
+    VendorData = ACPI_ADD_PTR (UINT8, Descriptor, sizeof (AML_RESOURCE_I2C_SERIALBUS));
+    ResourceSource = ACPI_ADD_PTR (char, VendorData, VendorLength);
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Slave Address [WORD] (_ADR) */
+
+            Descriptor->I2cSerialBus.SlaveAddress = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_ADDRESS,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (I2cSerialBus.SlaveAddress));
+            break;
+
+        case 1: /* Slave Mode [Flag] (_SLV) */
+
+            RsSetFlagBits (&Descriptor->I2cSerialBus.Flags, InitializerOp, 0, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_SLAVEMODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (I2cSerialBus.Flags), 0);
+            break;
+
+        case 2: /* Connection Speed [DWORD] (_SPE) */
+
+            Descriptor->I2cSerialBus.ConnectionSpeed = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_SPEED,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (I2cSerialBus.ConnectionSpeed));
+            break;
+
+        case 3: /* Addressing Mode [Flag] (_MOD) */
+
+            RsSetFlagBits16 (&Descriptor->I2cSerialBus.TypeSpecificFlags, InitializerOp, 0, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (I2cSerialBus.TypeSpecificFlags), 0);
+            break;
+
+        case 4: /* ResSource [Optional Field - STRING] */
+
+            if (ResSourceLength)
+            {
+                /* Copy string to the descriptor */
+
+                strcpy (ResourceSource,
+                    InitializerOp->Asl.Value.String);
+            }
+            break;
+
+        case 5: /* Resource Index */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                Descriptor->I2cSerialBus.ResSourceIndex =
+                    (UINT8) InitializerOp->Asl.Value.Integer;
+            }
+            break;
+
+        case 6: /* Resource Usage (consumer/producer) */
+
+            RsSetFlagBits (&Descriptor->I2cSerialBus.Flags, InitializerOp, 1, 1);
+            break;
+
+        case 7: /* Resource Tag (Descriptor Name) */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 8:
+            /*
+             * Connection Share - Added for V2 (ACPI 6.0) version of the descriptor
+             * Note: For V1, the share bit will be zero (Op is DEFAULT_ARG from
+             * the ASL parser)
+             */
+            RsSetFlagBits (&Descriptor->I2cSerialBus.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTSHARE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (I2cSerialBus.Flags), 2);
+            break;
+
+        case 9: /* Vendor Data (Optional - Buffer of BYTEs) (_VEN) */
+
+            RsGetVendorData (InitializerOp, VendorData,
+                CurrentByteOffset + sizeof (AML_RESOURCE_I2C_SERIALBUS));
+            break;
+
+        default:    /* Ignore any extra nodes */
+
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    MpSaveSerialInfo (Info->MappingOp, Descriptor, ResourceSource);
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoSpiSerialBusDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "SPI Serial Bus" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoSpiSerialBusDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    char                    *ResourceSource = NULL;
+    UINT8                   *VendorData = NULL;
+    UINT16                  ResSourceLength;
+    UINT16                  VendorLength;
+    UINT16                  DescriptorSize;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    /*
+     * Calculate lengths for fields that have variable length:
+     * 1) Resource Source string
+     * 2) Vendor Data buffer
+     */
+    ResSourceLength = RsGetStringDataLength (InitializerOp);
+    VendorLength = RsGetBufferDataLength (InitializerOp);
+
+    DescriptorSize = ACPI_AML_SIZE_LARGE (AML_RESOURCE_SPI_SERIALBUS) +
+        ResSourceLength + VendorLength;
+
+    /* Allocate the local resource node and initialize */
+
+    Rnode = RsAllocateResourceNode (DescriptorSize +
+        sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->SpiSerialBus.ResourceLength = DescriptorSize;
+    Descriptor->SpiSerialBus.DescriptorType = ACPI_RESOURCE_NAME_SERIAL_BUS;
+    Descriptor->SpiSerialBus.RevisionId = AML_RESOURCE_SPI_REVISION;
+    Descriptor->SpiSerialBus.TypeRevisionId = AML_RESOURCE_SPI_TYPE_REVISION;
+    Descriptor->SpiSerialBus.Type = AML_RESOURCE_SPI_SERIALBUSTYPE;
+    Descriptor->SpiSerialBus.TypeDataLength = AML_RESOURCE_SPI_MIN_DATA_LEN + VendorLength;
+
+    if (Info->DescriptorTypeOp->Asl.ParseOpcode == PARSEOP_SPI_SERIALBUS_V2)
+    {
+        Descriptor->I2cSerialBus.RevisionId = 2;
+    }
+
+    /* Build pointers to optional areas */
+
+    VendorData = ACPI_ADD_PTR (UINT8, Descriptor,
+        sizeof (AML_RESOURCE_SPI_SERIALBUS));
+    ResourceSource = ACPI_ADD_PTR (char, VendorData, VendorLength);
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Device Selection [WORD] (_ADR) */
+
+            Descriptor->SpiSerialBus.DeviceSelection = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_ADDRESS,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.DeviceSelection));
+            break;
+
+        case 1: /* Device Polarity [Flag] (_DPL) */
+
+            RsSetFlagBits16 (&Descriptor->SpiSerialBus.TypeSpecificFlags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DEVICEPOLARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.TypeSpecificFlags), 1);
+            break;
+
+        case 2: /* Wire Mode [Flag] (_MOD) */
+
+            RsSetFlagBits16 (&Descriptor->SpiSerialBus.TypeSpecificFlags, InitializerOp, 0, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.TypeSpecificFlags), 0);
+            break;
+
+        case 3: /* Device Bit Length [BYTE] (_LEN) */
+
+            Descriptor->SpiSerialBus.DataBitLength = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.DataBitLength));
+            break;
+
+        case 4: /* Slave Mode [Flag] (_SLV) */
+
+            RsSetFlagBits (&Descriptor->SpiSerialBus.Flags, InitializerOp, 0, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_SLAVEMODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.Flags), 0);
+            break;
+
+        case 5: /* Connection Speed [DWORD] (_SPE) */
+
+            Descriptor->SpiSerialBus.ConnectionSpeed = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_SPEED,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.ConnectionSpeed));
+            break;
+
+        case 6: /* Clock Polarity [BYTE] (_POL) */
+
+            Descriptor->SpiSerialBus.ClockPolarity = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_POLARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.ClockPolarity));
+            break;
+
+        case 7: /* Clock Phase [BYTE] (_PHA) */
+
+            Descriptor->SpiSerialBus.ClockPhase = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_PHASE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.ClockPhase));
+            break;
+
+        case 8: /* ResSource [Optional Field - STRING] */
+
+            if (ResSourceLength)
+            {
+                /* Copy string to the descriptor */
+
+                strcpy (ResourceSource,
+                    InitializerOp->Asl.Value.String);
+            }
+            break;
+
+        case 9: /* Resource Index */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                Descriptor->SpiSerialBus.ResSourceIndex =
+                    (UINT8) InitializerOp->Asl.Value.Integer;
+            }
+            break;
+
+        case 10: /* Resource Usage (consumer/producer) */
+
+            RsSetFlagBits (&Descriptor->SpiSerialBus.Flags, InitializerOp, 1, 1);
+            break;
+
+        case 11: /* Resource Tag (Descriptor Name) */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 12:
+            /*
+             * Connection Share - Added for V2 (ACPI 6.0) version of the descriptor
+             * Note: For V1, the share bit will be zero (Op is DEFAULT_ARG from
+             * the ASL parser)
+             */
+            RsSetFlagBits (&Descriptor->SpiSerialBus.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTSHARE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (SpiSerialBus.Flags), 2);
+            break;
+
+        case 13: /* Vendor Data (Optional - Buffer of BYTEs) (_VEN) */
+
+            RsGetVendorData (InitializerOp, VendorData,
+                CurrentByteOffset + sizeof (AML_RESOURCE_SPI_SERIALBUS));
+            break;
+
+        default:    /* Ignore any extra nodes */
+
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    MpSaveSerialInfo (Info->MappingOp, Descriptor, ResourceSource);
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoUartSerialBusDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "UART Serial Bus" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoUartSerialBusDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ASL_RESOURCE_NODE       *Rnode;
+    char                    *ResourceSource = NULL;
+    UINT8                   *VendorData = NULL;
+    UINT16                  ResSourceLength;
+    UINT16                  VendorLength;
+    UINT16                  DescriptorSize;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    /*
+     * Calculate lengths for fields that have variable length:
+     * 1) Resource Source string
+     * 2) Vendor Data buffer
+     */
+    ResSourceLength = RsGetStringDataLength (InitializerOp);
+    VendorLength = RsGetBufferDataLength (InitializerOp);
+
+    DescriptorSize = ACPI_AML_SIZE_LARGE (AML_RESOURCE_UART_SERIALBUS) +
+        ResSourceLength + VendorLength;
+
+    /* Allocate the local resource node and initialize */
+
+    Rnode = RsAllocateResourceNode (DescriptorSize +
+        sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->UartSerialBus.ResourceLength = DescriptorSize;
+    Descriptor->UartSerialBus.DescriptorType = ACPI_RESOURCE_NAME_SERIAL_BUS;
+    Descriptor->UartSerialBus.RevisionId = AML_RESOURCE_UART_REVISION;
+    Descriptor->UartSerialBus.TypeRevisionId = AML_RESOURCE_UART_TYPE_REVISION;
+    Descriptor->UartSerialBus.Type = AML_RESOURCE_UART_SERIALBUSTYPE;
+    Descriptor->UartSerialBus.TypeDataLength = AML_RESOURCE_UART_MIN_DATA_LEN + VendorLength;
+
+    if (Info->DescriptorTypeOp->Asl.ParseOpcode == PARSEOP_UART_SERIALBUS_V2)
+    {
+        Descriptor->I2cSerialBus.RevisionId = 2;
+    }
+
+    /* Build pointers to optional areas */
+
+    VendorData = ACPI_ADD_PTR (UINT8, Descriptor, sizeof (AML_RESOURCE_UART_SERIALBUS));
+    ResourceSource = ACPI_ADD_PTR (char, VendorData, VendorLength);
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Connection Speed (Baud Rate) [DWORD] (_SPE) */
+
+            Descriptor->UartSerialBus.DefaultBaudRate = (UINT32) InitializerOp->Asl.Value.Integer;
+            RsCreateDwordField (InitializerOp, ACPI_RESTAG_SPEED,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.DefaultBaudRate));
+            break;
+
+        case 1: /* Bits Per Byte [Flags] (_LEN) */
+
+            RsSetFlagBits16 (&Descriptor->UartSerialBus.TypeSpecificFlags, InitializerOp, 4, 3);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.TypeSpecificFlags), 4, 3);
+            break;
+
+        case 2: /* Stop Bits [Flags] (_STB) */
+
+            RsSetFlagBits16 (&Descriptor->UartSerialBus.TypeSpecificFlags, InitializerOp, 2, 1);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_STOPBITS,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.TypeSpecificFlags), 2, 2);
+            break;
+
+        case 3: /* Lines In Use [BYTE] (_LIN) */
+
+            Descriptor->UartSerialBus.LinesEnabled = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_LINE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.LinesEnabled));
+            break;
+
+        case 4: /* Endianness [Flag] (_END) */
+
+            RsSetFlagBits16 (&Descriptor->UartSerialBus.TypeSpecificFlags, InitializerOp, 7, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_ENDIANNESS,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.TypeSpecificFlags), 7);
+            break;
+
+        case 5: /* Parity [BYTE] (_PAR) */
+
+            Descriptor->UartSerialBus.Parity = (UINT8) InitializerOp->Asl.Value.Integer;
+            RsCreateByteField (InitializerOp, ACPI_RESTAG_PARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.Parity));
+            break;
+
+        case 6: /* Flow Control [Flags] (_FLC) */
+
+            RsSetFlagBits16 (&Descriptor->UartSerialBus.TypeSpecificFlags, InitializerOp, 0, 0);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_FLOWCONTROL,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.TypeSpecificFlags), 0, 2);
+            break;
+
+        case 7: /* Rx Buffer Size [WORD] (_RXL) */
+
+            Descriptor->UartSerialBus.RxFifoSize = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_LENGTH_RX,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.RxFifoSize));
+            break;
+
+        case 8: /* Tx Buffer Size [WORD] (_TXL) */
+
+            Descriptor->UartSerialBus.TxFifoSize = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_LENGTH_TX,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.TxFifoSize));
+            break;
+
+        case 9: /* ResSource [Optional Field - STRING] */
+
+            if (ResSourceLength)
+            {
+                /* Copy string to the descriptor */
+
+                strcpy (ResourceSource,
+                    InitializerOp->Asl.Value.String);
+            }
+            break;
+
+        case 10: /* Resource Index */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                Descriptor->UartSerialBus.ResSourceIndex =
+                    (UINT8) InitializerOp->Asl.Value.Integer;
+            }
+            break;
+
+        case 11: /* Resource Usage (consumer/producer) */
+
+            RsSetFlagBits (&Descriptor->UartSerialBus.Flags, InitializerOp, 1, 1);
+
+            /*
+             * Slave Mode [Flag] (_SLV)
+             *
+             * Note: There is no SlaveMode argument to the UartSerialBus macro, but
+             * we add this name anyway to allow the flag to be set by ASL in the
+             * rare case where there is a slave mode associated with the UART.
+             */
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_SLAVEMODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.Flags), 0);
+            break;
+
+        case 12: /* Resource Tag (Descriptor Name) */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 13:
+            /*
+             * Connection Share - Added for V2 (ACPI 6.0) version of the descriptor
+             * Note: For V1, the share bit will be zero (Op is DEFAULT_ARG from
+             * the ASL parser)
+             */
+            RsSetFlagBits (&Descriptor->UartSerialBus.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_INTERRUPTSHARE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (UartSerialBus.Flags), 2);
+            break;
+
+        case 14: /* Vendor Data (Optional - Buffer of BYTEs) (_VEN) */
+
+            RsGetVendorData (InitializerOp, VendorData,
+                CurrentByteOffset + sizeof (AML_RESOURCE_UART_SERIALBUS));
+            break;
+
+        default:    /* Ignore any extra nodes */
+
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    MpSaveSerialInfo (Info->MappingOp, Descriptor, ResourceSource);
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrestype2w.c b/usr/src/cmd/acpi/iasl/aslrestype2w.c
new file mode 100644
index 0000000000..0b88c70acd
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrestype2w.c
@@ -0,0 +1,697 @@
+/******************************************************************************
+ *
+ * Module Name: aslrestype2w - Large Word address resource descriptors
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslrestype2w")
+
+/*
+ * This module contains the Word (16-bit) address space descriptors:
+ *
+ * WordIO
+ * WordMemory
+ * WordSpace
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoWordIoDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "WordIO" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoWordIoDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS16) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address16.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS16;
+    Descriptor->Address16.ResourceType = ACPI_ADDRESS_TYPE_IO_RANGE;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS16);
+    Descriptor->Address16.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS16) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 2);
+            break;
+
+        case 2: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 3);
+            break;
+
+        case 3: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 1);
+            break;
+
+        case 4: /* Range Type */
+
+            RsSetFlagBits (&Descriptor->Address16.SpecificFlags, InitializerOp, 0, 3);
+            RsCreateMultiBitField (InitializerOp, ACPI_RESTAG_RANGETYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.SpecificFlags), 0, 2);
+            break;
+
+        case 5: /* Address Granularity */
+
+            Descriptor->Address16.Granularity = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 6: /* Address Min */
+
+            Descriptor->Address16.Minimum = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 7: /* Address Max */
+
+            Descriptor->Address16.Maximum = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 8: /* Translation Offset */
+
+            Descriptor->Address16.TranslationOffset = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.TranslationOffset));
+            break;
+
+        case 9: /* Address Length */
+
+            Descriptor->Address16.AddressLength = (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                 CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 10: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address16.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 11: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address16.ResourceLength = (UINT16)
+                        (Descriptor->Address16.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 12: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        case 13: /* Type */
+
+            RsSetFlagBits (&Descriptor->Address16.SpecificFlags, InitializerOp, 4, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.SpecificFlags), 4);
+            break;
+
+        case 14: /* Translation Type */
+
+            RsSetFlagBits (&Descriptor->Address16.SpecificFlags, InitializerOp, 5, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_TRANSTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.SpecificFlags), 5);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        (UINT64) Descriptor->Address16.Minimum,
+        (UINT64) Descriptor->Address16.Maximum,
+        (UINT64) Descriptor->Address16.AddressLength,
+        (UINT64) Descriptor->Address16.Granularity,
+        Descriptor->Address16.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS16) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoWordBusNumberDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "WordBusNumber" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoWordBusNumberDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS16) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address16.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS16;
+    Descriptor->Address16.ResourceType = ACPI_ADDRESS_TYPE_BUS_NUMBER_RANGE;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS16);
+    Descriptor->Address16.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS16) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 1: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 2);
+            break;
+
+        case 2: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 3);
+            break;
+
+        case 3: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 1);
+            break;
+
+        case 4: /* Address Granularity */
+
+            Descriptor->Address16.Granularity =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 5: /* Min Address */
+
+            Descriptor->Address16.Minimum =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 6: /* Max Address */
+
+            Descriptor->Address16.Maximum =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 7: /* Translation Offset */
+
+            Descriptor->Address16.TranslationOffset =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.TranslationOffset));
+            break;
+
+        case 8: /* Address Length */
+
+            Descriptor->Address16.AddressLength =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                 CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 9: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address16.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 10: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address16.ResourceLength = (UINT16)
+                        (Descriptor->Address16.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 11: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        (UINT64) Descriptor->Address16.Minimum,
+        (UINT64) Descriptor->Address16.Maximum,
+        (UINT64) Descriptor->Address16.AddressLength,
+        (UINT64) Descriptor->Address16.Granularity,
+        Descriptor->Address16.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS16) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    RsDoWordSpaceDescriptor
+ *
+ * PARAMETERS:  Info                - Parse Op and resource template offset
+ *
+ * RETURN:      Completed resource node
+ *
+ * DESCRIPTION: Construct a long "WordSpace" descriptor
+ *
+ ******************************************************************************/
+
+ASL_RESOURCE_NODE *
+RsDoWordSpaceDescriptor (
+    ASL_RESOURCE_INFO       *Info)
+{
+    AML_RESOURCE            *Descriptor;
+    ACPI_PARSE_OBJECT       *InitializerOp;
+    ACPI_PARSE_OBJECT       *MinOp = NULL;
+    ACPI_PARSE_OBJECT       *MaxOp = NULL;
+    ACPI_PARSE_OBJECT       *LengthOp = NULL;
+    ACPI_PARSE_OBJECT       *GranOp = NULL;
+    ASL_RESOURCE_NODE       *Rnode;
+    UINT8                   *OptionalFields;
+    UINT16                  StringLength = 0;
+    UINT32                  OptionIndex = 0;
+    UINT32                  CurrentByteOffset;
+    UINT32                  i;
+    BOOLEAN                 ResSourceIndex = FALSE;
+
+
+    InitializerOp = Info->DescriptorTypeOp->Asl.Child;
+    StringLength = RsGetStringDataLength (InitializerOp);
+    CurrentByteOffset = Info->CurrentByteOffset;
+
+    Rnode = RsAllocateResourceNode (
+        sizeof (AML_RESOURCE_ADDRESS16) + 1 + StringLength);
+
+    Descriptor = Rnode->Buffer;
+    Descriptor->Address16.DescriptorType = ACPI_RESOURCE_NAME_ADDRESS16;
+
+    /*
+     * Initial descriptor length -- may be enlarged if there are
+     * optional fields present
+     */
+    OptionalFields = ((UINT8 *) Descriptor) + sizeof (AML_RESOURCE_ADDRESS16);
+    Descriptor->Address16.ResourceLength = (UINT16)
+        (sizeof (AML_RESOURCE_ADDRESS16) -
+         sizeof (AML_RESOURCE_LARGE_HEADER));
+
+    /* Process all child initialization nodes */
+
+    for (i = 0; InitializerOp; i++)
+    {
+        switch (i)
+        {
+        case 0: /* Resource Type */
+
+            Descriptor->Address16.ResourceType =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 1: /* Resource Usage */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 0, 1);
+            break;
+
+        case 2: /* DecodeType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 1, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_DECODE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 1);
+            break;
+
+        case 3: /* MinType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 2, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MINTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 2);
+            break;
+
+        case 4: /* MaxType */
+
+            RsSetFlagBits (&Descriptor->Address16.Flags, InitializerOp, 3, 0);
+            RsCreateBitField (InitializerOp, ACPI_RESTAG_MAXTYPE,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Flags), 3);
+            break;
+
+        case 5: /* Type-Specific flags */
+
+            Descriptor->Address16.SpecificFlags =
+                (UINT8) InitializerOp->Asl.Value.Integer;
+            break;
+
+        case 6: /* Address Granularity */
+
+            Descriptor->Address16.Granularity =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_GRANULARITY,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Granularity));
+            GranOp = InitializerOp;
+            break;
+
+        case 7: /* Min Address */
+
+            Descriptor->Address16.Minimum =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MINADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Minimum));
+            MinOp = InitializerOp;
+            break;
+
+        case 8: /* Max Address */
+
+            Descriptor->Address16.Maximum =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_MAXADDR,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.Maximum));
+            MaxOp = InitializerOp;
+            break;
+
+        case 9: /* Translation Offset */
+
+            Descriptor->Address16.TranslationOffset =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_TRANSLATION,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.TranslationOffset));
+            break;
+
+        case 10: /* Address Length */
+
+            Descriptor->Address16.AddressLength =
+                (UINT16) InitializerOp->Asl.Value.Integer;
+            RsCreateWordField (InitializerOp, ACPI_RESTAG_LENGTH,
+                CurrentByteOffset + ASL_RESDESC_OFFSET (Address16.AddressLength));
+            LengthOp = InitializerOp;
+            break;
+
+        case 11: /* ResSourceIndex [Optional Field - BYTE] */
+
+            if (InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG)
+            {
+                OptionalFields[0] = (UINT8) InitializerOp->Asl.Value.Integer;
+                OptionIndex++;
+                Descriptor->Address16.ResourceLength++;
+                ResSourceIndex = TRUE;
+            }
+            break;
+
+        case 12: /* ResSource [Optional Field - STRING] */
+
+            if ((InitializerOp->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG) &&
+                (InitializerOp->Asl.Value.String))
+            {
+                if (StringLength)
+                {
+                    Descriptor->Address16.ResourceLength = (UINT16)
+                        (Descriptor->Address16.ResourceLength + StringLength);
+
+                    strcpy ((char *)
+                        &OptionalFields[OptionIndex],
+                        InitializerOp->Asl.Value.String);
+
+                    /* ResourceSourceIndex must also be valid */
+
+                    if (!ResSourceIndex)
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_INDEX,
+                            InitializerOp, NULL);
+                    }
+                }
+            }
+
+#if 0
+            /*
+             * Not a valid ResourceSource, ResourceSourceIndex must also
+             * be invalid
+             */
+            else if (ResSourceIndex)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESOURCE_SOURCE,
+                    InitializerOp, NULL);
+            }
+#endif
+            break;
+
+        case 13: /* ResourceTag */
+
+            UtAttachNamepathToOwner (Info->DescriptorTypeOp, InitializerOp);
+            break;
+
+        default:
+
+            AslError (ASL_ERROR, ASL_MSG_RESOURCE_LIST, InitializerOp, NULL);
+            break;
+        }
+
+        InitializerOp = RsCompleteNodeAndGetNext (InitializerOp);
+    }
+
+    /* Validate the Min/Max/Len/Gran values */
+
+    RsLargeAddressCheck (
+        (UINT64) Descriptor->Address16.Minimum,
+        (UINT64) Descriptor->Address16.Maximum,
+        (UINT64) Descriptor->Address16.AddressLength,
+        (UINT64) Descriptor->Address16.Granularity,
+        Descriptor->Address16.Flags,
+        MinOp, MaxOp, LengthOp, GranOp, Info->DescriptorTypeOp);
+
+    Rnode->BufferLength = sizeof (AML_RESOURCE_ADDRESS16) +
+        OptionIndex + StringLength;
+    return (Rnode);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslrules.y b/usr/src/cmd/acpi/iasl/aslrules.y
new file mode 100644
index 0000000000..a5d8387d7e
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslrules.y
@@ -0,0 +1,1746 @@
+NoEcho('
+/******************************************************************************
+ *
+ * Module Name: aslrules.y - Main Bison/Yacc production rules
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+')
+
+/*******************************************************************************
+ *
+ * ASL Root and Secondary Terms
+ *
+ ******************************************************************************/
+
+/*
+ * Root term. Allow multiple #line directives before the definition block
+ * to handle output from preprocessors
+ */
+AslCode
+    : DefinitionBlockList           {$<n>$ = TrLinkChildren (TrCreateLeafNode (PARSEOP_ASL_CODE),1, $1);}
+    | error                         {YYABORT; $$ = NULL;}
+    ;
+
+
+/*
+ * Note concerning support for "module-level code".
+ *
+ * ACPI 1.0 allowed Type1 and Type2 executable opcodes outside of control
+ * methods (the so-called module-level code.) This support was explicitly
+ * removed in ACPI 2.0, but this type of code continues to be created by
+ * BIOS vendors. In order to support the disassembly and recompilation of
+ * such code (and the porting of ASL code to iASL), iASL supports this
+ * code in violation of the current ACPI specification.
+ *
+ * The grammar change to support module-level code is to revert the
+ * {ObjectList} portion of the DefinitionBlockTerm in ACPI 2.0 to the
+ * original use of {TermList} instead (see below.) This allows the use
+ * of Type1 and Type2 opcodes at module level.
+ *
+ * 04/2016: The module-level code is now allowed in the following terms:
+ * DeviceTerm, PowerResTerm, ProcessorTerm, ScopeTerm, ThermalZoneTerm.
+ * The ObjectList term is obsolete and has been removed.
+ */
+DefinitionBlockTerm
+    : PARSEOP_DEFINITION_BLOCK '('  {$<n>$ = TrCreateLeafNode (PARSEOP_DEFINITION_BLOCK);}
+        String ','
+        String ','
+        ByteConst ','
+        String ','
+        String ','
+        DWordConst
+        ')'                         {TrSetEndLineNumber ($<n>3);}
+            '{' TermList '}'        {$$ = TrLinkChildren ($<n>3,7,$4,$6,$8,$10,$12,$14,$18);}
+    ;
+
+DefinitionBlockList
+    : DefinitionBlockTerm
+    | DefinitionBlockTerm
+        DefinitionBlockList         {$$ = TrLinkPeerNodes (2, $1,$2);}
+    ;
+
+SuperName
+    : NameString                    {}
+    | ArgTerm                       {}
+    | LocalTerm                     {}
+    | DebugTerm                     {}
+    | Type6Opcode                   {}
+
+Target
+    :                               {$$ = TrCreateNullTarget ();} /* Placeholder is a ZeroOp object */
+    | ','                           {$$ = TrCreateNullTarget ();} /* Placeholder is a ZeroOp object */
+    | ',' SuperName                 {$$ = TrSetNodeFlags ($2, NODE_IS_TARGET);}
+    ;
+
+TermArg
+    : Type2Opcode                   {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    | DataObject                    {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    | NameString                    {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    | ArgTerm                       {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    | LocalTerm                     {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    ;
+
+/*
+ NOTE: Removed from TermArg due to reduce/reduce conflicts:
+    | Type2IntegerOpcode            {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    | Type2StringOpcode             {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    | Type2BufferOpcode             {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+    | Type2BufferOrStringOpcode     {$$ = TrSetNodeFlags ($1, NODE_IS_TERM_ARG);}
+
+*/
+
+MethodInvocationTerm
+    : NameString '('                {TrUpdateNode (PARSEOP_METHODCALL, $1);}
+        ArgList ')'                 {$$ = TrLinkChildNode ($1,$4);}
+    ;
+
+/* OptionalCount must appear before ByteList or an incorrect reduction will result */
+
+OptionalCount
+    :                               {$$ = TrCreateLeafNode (PARSEOP_ONES);}       /* Placeholder is a OnesOp object */
+    | ','                           {$$ = TrCreateLeafNode (PARSEOP_ONES);}       /* Placeholder is a OnesOp object */
+    | ',' TermArg                   {$$ = $2;}
+    ;
+
+VarPackageLengthTerm
+    :                               {$$ = TrCreateLeafNode (PARSEOP_DEFAULT_ARG);}
+    | TermArg                       {$$ = $1;}
+    ;
+
+
+/******* List Terms **************************************************/
+
+ArgList
+    :                               {$$ = NULL;}
+    | TermArg
+    | ArgList ','                   /* Allows a trailing comma at list end */
+    | ArgList ','
+        TermArg                     {$$ = TrLinkPeerNode ($1,$3);}
+    ;
+
+ByteList
+    :                               {$$ = NULL;}
+    | ByteConstExpr
+    | ByteList ','                  /* Allows a trailing comma at list end */
+    | ByteList ','
+        ByteConstExpr               {$$ = TrLinkPeerNode ($1,$3);}
+    ;
+
+DWordList
+    :                               {$$ = NULL;}
+    | DWordConstExpr
+    | DWordList ','                 /* Allows a trailing comma at list end */
+    | DWordList ','
+        DWordConstExpr              {$$ = TrLinkPeerNode ($1,$3);}
+    ;
+
+FieldUnitList
+    :                               {$$ = NULL;}
+    | FieldUnit
+    | FieldUnitList ','             /* Allows a trailing comma at list end */
+    | FieldUnitList ','
+        FieldUnit                   {$$ = TrLinkPeerNode ($1,$3);}
+    ;
+
+FieldUnit
+    : FieldUnitEntry                {}
+    | OffsetTerm                    {}
+    | AccessAsTerm                  {}
+    | ConnectionTerm                {}
+    ;
+
+FieldUnitEntry
+    : ',' AmlPackageLengthTerm      {$$ = TrCreateNode (PARSEOP_RESERVED_BYTES,1,$2);}
+    | NameSeg ','
+        AmlPackageLengthTerm        {$$ = TrLinkChildNode ($1,$3);}
+    ;
+
+Object
+    : CompilerDirective             {}
+    | NamedObject                   {}
+    | NameSpaceModifier             {}
+    ;
+
+PackageList
+    :                               {$$ = NULL;}
+    | PackageElement
+    | PackageList ','               /* Allows a trailing comma at list end */
+    | PackageList ','
+        PackageElement              {$$ = TrLinkPeerNode ($1,$3);}
+    ;
+
+PackageElement
+    : DataObject                    {}
+    | NameString                    {}
+    ;
+
+    /* Rules for specifying the type of one method argument or return value */
+
+ParameterTypePackage
+    :                               {$$ = NULL;}
+    | ObjectTypeKeyword             {$$ = $1;}
+    | ParameterTypePackage ','
+        ObjectTypeKeyword           {$$ = TrLinkPeerNodes (2,$1,$3);}
+    ;
+
+ParameterTypePackageList
+    :                               {$$ = NULL;}
+    | ObjectTypeKeyword             {$$ = $1;}
+    | '{' ParameterTypePackage '}'  {$$ = $2;}
+    ;
+
+OptionalParameterTypePackage
+    :                               {$$ = TrCreateLeafNode (PARSEOP_DEFAULT_ARG);}
+    | ',' ParameterTypePackageList  {$$ = TrLinkChildren (TrCreateLeafNode (PARSEOP_DEFAULT_ARG),1,$2);}
+    ;
+
+    /* Rules for specifying the types for method arguments */
+
+ParameterTypesPackage
+    : ParameterTypePackageList      {$$ = $1;}
+    | ParameterTypesPackage ','
+        ParameterTypePackageList    {$$ = TrLinkPeerNodes (2,$1,$3);}
+    ;
+
+ParameterTypesPackageList
+    :                               {$$ = NULL;}
+    | ObjectTypeKeyword             {$$ = $1;}
+    | '{' ParameterTypesPackage '}' {$$ = $2;}
+    ;
+
+OptionalParameterTypesPackage
+    :                               {$$ = TrCreateLeafNode (PARSEOP_DEFAULT_ARG);}
+    | ',' ParameterTypesPackageList {$$ = TrLinkChildren (TrCreateLeafNode (PARSEOP_DEFAULT_ARG),1,$2);}
+    ;
+
+    /* ACPI 3.0 -- allow semicolons between terms */
+
+TermList
+    :                               {$$ = NULL;}
+    | TermList Term                 {$$ = TrLinkPeerNode (TrSetNodeFlags ($1, NODE_RESULT_NOT_USED),$2);}
+    | TermList Term ';'             {$$ = TrLinkPeerNode (TrSetNodeFlags ($1, NODE_RESULT_NOT_USED),$2);}
+    | TermList ';' Term             {$$ = TrLinkPeerNode (TrSetNodeFlags ($1, NODE_RESULT_NOT_USED),$3);}
+    | TermList ';' Term ';'         {$$ = TrLinkPeerNode (TrSetNodeFlags ($1, NODE_RESULT_NOT_USED),$3);}
+    ;
+
+Term
+    : Object                        {}
+    | Type1Opcode                   {}
+    | Type2Opcode                   {}
+    | Type2IntegerOpcode            {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | Type2StringOpcode             {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | Type2BufferOpcode             {}
+    | Type2BufferOrStringOpcode     {}
+    | error                         {$$ = AslDoError(); yyclearin;}
+    ;
+
+/*
+ * Case-Default list; allow only one Default term and unlimited Case terms
+ */
+CaseDefaultTermList
+    :                               {$$ = NULL;}
+    | CaseTerm  {}
+    | DefaultTerm   {}
+    | CaseDefaultTermList
+        CaseTerm                    {$$ = TrLinkPeerNode ($1,$2);}
+    | CaseDefaultTermList
+        DefaultTerm                 {$$ = TrLinkPeerNode ($1,$2);}
+
+/* Original - attempts to force zero or one default term within the switch */
+
+/*
+CaseDefaultTermList
+    :                               {$$ = NULL;}
+    | CaseTermList
+        DefaultTerm
+        CaseTermList                {$$ = TrLinkPeerNode ($1,TrLinkPeerNode ($2, $3));}
+    | CaseTermList
+        CaseTerm                    {$$ = TrLinkPeerNode ($1,$2);}
+    ;
+
+CaseTermList
+    :                               {$$ = NULL;}
+    | CaseTerm                      {}
+    | CaseTermList
+        CaseTerm                    {$$ = TrLinkPeerNode ($1,$2);}
+    ;
+*/
+
+
+/*******************************************************************************
+ *
+ * ASL Data and Constant Terms
+ *
+ ******************************************************************************/
+
+DataObject
+    : BufferData                    {}
+    | PackageData                   {}
+    | IntegerData                   {}
+    | StringData                    {}
+    ;
+
+BufferData
+    : Type5Opcode                   {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | Type2BufferOrStringOpcode     {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | Type2BufferOpcode             {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | BufferTerm                    {}
+    ;
+
+PackageData
+    : PackageTerm                   {}
+    ;
+
+IntegerData
+    : Type2IntegerOpcode            {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | Type3Opcode                   {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | Integer                       {}
+    | ConstTerm                     {}
+    ;
+
+StringData
+    : Type2StringOpcode             {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | String                        {}
+    ;
+
+ByteConst
+    : Integer                       {$$ = TrUpdateNode (PARSEOP_BYTECONST, $1);}
+    ;
+
+WordConst
+    : Integer                       {$$ = TrUpdateNode (PARSEOP_WORDCONST, $1);}
+    ;
+
+DWordConst
+    : Integer                       {$$ = TrUpdateNode (PARSEOP_DWORDCONST, $1);}
+    ;
+
+QWordConst
+    : Integer                       {$$ = TrUpdateNode (PARSEOP_QWORDCONST, $1);}
+    ;
+
+/*
+ * The NODE_COMPILE_TIME_CONST flag in the following constant expressions
+ * enables compile-time constant folding to reduce the Type3Opcodes/Type2IntegerOpcodes
+ * to simple integers. It is an error if these types of expressions cannot be
+ * reduced, since the AML grammar for ****ConstExpr requires a simple constant.
+ * Note: The required byte length of the constant is passed through to the
+ * constant folding code in the node AmlLength field.
+ */
+ByteConstExpr
+    : Type3Opcode                   {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 1);}
+    | Type2IntegerOpcode            {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 1);}
+    | ConstExprTerm                 {$$ = TrUpdateNode (PARSEOP_BYTECONST, $1);}
+    | ByteConst                     {}
+    ;
+
+WordConstExpr
+    : Type3Opcode                   {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 2);}
+    | Type2IntegerOpcode            {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 2);}
+    | ConstExprTerm                 {$$ = TrUpdateNode (PARSEOP_WORDCONST, $1);}
+    | WordConst                     {}
+    ;
+
+DWordConstExpr
+    : Type3Opcode                   {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 4);}
+    | Type2IntegerOpcode            {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 4);}
+    | ConstExprTerm                 {$$ = TrUpdateNode (PARSEOP_DWORDCONST, $1);}
+    | DWordConst                    {}
+    ;
+
+QWordConstExpr
+    : Type3Opcode                   {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 8);}
+    | Type2IntegerOpcode            {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST); TrSetNodeAmlLength ($1, 8);}
+    | ConstExprTerm                 {$$ = TrUpdateNode (PARSEOP_QWORDCONST, $1);}
+    | QWordConst                    {}
+    ;
+
+ConstTerm
+    : ConstExprTerm                 {}
+    | PARSEOP_REVISION              {$$ = TrCreateLeafNode (PARSEOP_REVISION);}
+    ;
+
+ConstExprTerm
+    : PARSEOP_ZERO                  {$$ = TrCreateValuedLeafNode (PARSEOP_ZERO, 0);}
+    | PARSEOP_ONE                   {$$ = TrCreateValuedLeafNode (PARSEOP_ONE, 1);}
+    | PARSEOP_ONES                  {$$ = TrCreateValuedLeafNode (PARSEOP_ONES, ACPI_UINT64_MAX);}
+    | PARSEOP___DATE__              {$$ = TrCreateConstantLeafNode (PARSEOP___DATE__);}
+    | PARSEOP___FILE__              {$$ = TrCreateConstantLeafNode (PARSEOP___FILE__);}
+    | PARSEOP___LINE__              {$$ = TrCreateConstantLeafNode (PARSEOP___LINE__);}
+    | PARSEOP___PATH__              {$$ = TrCreateConstantLeafNode (PARSEOP___PATH__);}
+    ;
+
+Integer
+    : PARSEOP_INTEGER               {$$ = TrCreateValuedLeafNode (PARSEOP_INTEGER, AslCompilerlval.i);}
+    ;
+
+String
+    : PARSEOP_STRING_LITERAL        {$$ = TrCreateValuedLeafNode (PARSEOP_STRING_LITERAL, (ACPI_NATIVE_INT) AslCompilerlval.s);}
+    ;
+
+
+/*******************************************************************************
+ *
+ * ASL Opcode Terms
+ *
+ ******************************************************************************/
+
+CompilerDirective
+    : IncludeTerm                   {}
+    | IncludeEndTerm                {}
+    | ExternalTerm                  {}
+    ;
+
+NamedObject
+    : BankFieldTerm                 {}
+    | CreateBitFieldTerm            {}
+    | CreateByteFieldTerm           {}
+    | CreateDWordFieldTerm          {}
+    | CreateFieldTerm               {}
+    | CreateQWordFieldTerm          {}
+    | CreateWordFieldTerm           {}
+    | DataRegionTerm                {}
+    | DeviceTerm                    {}
+    | EventTerm                     {}
+    | FieldTerm                     {}
+    | FunctionTerm                  {}
+    | IndexFieldTerm                {}
+    | MethodTerm                    {}
+    | MutexTerm                     {}
+    | OpRegionTerm                  {}
+    | PowerResTerm                  {}
+    | ProcessorTerm                 {}
+    | ThermalZoneTerm               {}
+    ;
+
+NameSpaceModifier
+    : AliasTerm                     {}
+    | NameTerm                      {}
+    | ScopeTerm                     {}
+    ;
+
+/* For ObjectType: SuperName except for MethodInvocationTerm */
+
+ObjectTypeName
+    : NameString                    {}
+    | ArgTerm                       {}
+    | LocalTerm                     {}
+    | DebugTerm                     {}
+    | RefOfTerm                     {}
+    | DerefOfTerm                   {}
+    | IndexTerm                     {}
+/*    | MethodInvocationTerm          {} */  /* Caused reduce/reduce with Type6Opcode->MethodInvocationTerm */
+    ;
+
+RequiredTarget
+    : ',' SuperName                 {$$ = TrSetNodeFlags ($2, NODE_IS_TARGET);}
+    ;
+
+SimpleTarget
+    : NameString                    {}
+    | LocalTerm                     {}
+    | ArgTerm                       {}
+    ;
+
+/* Opcode types */
+
+Type1Opcode
+    : BreakTerm                     {}
+    | BreakPointTerm                {}
+    | ContinueTerm                  {}
+    | FatalTerm                     {}
+    | ForTerm                       {}
+    | ElseIfTerm                    {}
+    | LoadTerm                      {}
+    | NoOpTerm                      {}
+    | NotifyTerm                    {}
+    | ReleaseTerm                   {}
+    | ResetTerm                     {}
+    | ReturnTerm                    {}
+    | SignalTerm                    {}
+    | SleepTerm                     {}
+    | StallTerm                     {}
+    | SwitchTerm                    {}
+    | UnloadTerm                    {}
+    | WhileTerm                     {}
+    ;
+
+Type2Opcode
+    : AcquireTerm                   {}
+    | CondRefOfTerm                 {}
+    | CopyObjectTerm                {}
+    | DerefOfTerm                   {}
+    | ObjectTypeTerm                {}
+    | RefOfTerm                     {}
+    | SizeOfTerm                    {}
+    | StoreTerm                     {}
+    | EqualsTerm                    {}
+    | TimerTerm                     {}
+    | WaitTerm                      {}
+    | MethodInvocationTerm          {}
+    ;
+
+/*
+ * Type 3/4/5 opcodes
+ */
+Type2IntegerOpcode                  /* "Type3" opcodes */
+    : Expression                    {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | AddTerm                       {}
+    | AndTerm                       {}
+    | DecTerm                       {}
+    | DivideTerm                    {}
+    | FindSetLeftBitTerm            {}
+    | FindSetRightBitTerm           {}
+    | FromBCDTerm                   {}
+    | IncTerm                       {}
+    | IndexTerm                     {}
+    | LAndTerm                      {}
+    | LEqualTerm                    {}
+    | LGreaterTerm                  {}
+    | LGreaterEqualTerm             {}
+    | LLessTerm                     {}
+    | LLessEqualTerm                {}
+    | LNotTerm                      {}
+    | LNotEqualTerm                 {}
+    | LoadTableTerm                 {}
+    | LOrTerm                       {}
+    | MatchTerm                     {}
+    | ModTerm                       {}
+    | MultiplyTerm                  {}
+    | NAndTerm                      {}
+    | NOrTerm                       {}
+    | NotTerm                       {}
+    | OrTerm                        {}
+    | ShiftLeftTerm                 {}
+    | ShiftRightTerm                {}
+    | SubtractTerm                  {}
+    | ToBCDTerm                     {}
+    | ToIntegerTerm                 {}
+    | XOrTerm                       {}
+    ;
+
+Type2StringOpcode                   /* "Type4" Opcodes */
+    : ToDecimalStringTerm           {}
+    | ToHexStringTerm               {}
+    | ToStringTerm                  {}
+    ;
+
+Type2BufferOpcode                   /* "Type5" Opcodes */
+    : ToBufferTerm                  {}
+    | ConcatResTerm                 {}
+    ;
+
+Type2BufferOrStringOpcode
+    : ConcatTerm                    {$$ = TrSetNodeFlags ($1, NODE_COMPILE_TIME_CONST);}
+    | PrintfTerm                    {}
+    | FprintfTerm                   {}
+    | MidTerm                       {}
+    ;
+
+/*
+ * A type 3 opcode evaluates to an Integer and cannot have a destination operand
+ */
+Type3Opcode
+    : EISAIDTerm                    {}
+    ;
+
+/* Obsolete
+Type4Opcode
+    : ConcatTerm                    {}
+    | ToDecimalStringTerm           {}
+    | ToHexStringTerm               {}
+    | MidTerm                       {}
+    | ToStringTerm                  {}
+    ;
+*/
+
+Type5Opcode
+    : ResourceTemplateTerm          {}
+    | UnicodeTerm                   {}
+    | ToPLDTerm                     {}
+    | ToUUIDTerm                    {}
+    ;
+
+Type6Opcode
+    : RefOfTerm                     {}
+    | DerefOfTerm                   {}
+    | IndexTerm                     {}
+    | IndexExpTerm                  {}
+    | MethodInvocationTerm          {}
+    ;
+
+
+/*******************************************************************************
+ *
+ * ASL Primary Terms
+ *
+ ******************************************************************************/
+
+AccessAsTerm
+    : PARSEOP_ACCESSAS '('
+        AccessTypeKeyword
+        OptionalAccessAttribTerm
+        ')'                         {$$ = TrCreateNode (PARSEOP_ACCESSAS,2,$3,$4);}
+    | PARSEOP_ACCESSAS '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+AcquireTerm
+    : PARSEOP_ACQUIRE '('           {$<n>$ = TrCreateLeafNode (PARSEOP_ACQUIRE);}
+        SuperName
+        ',' WordConstExpr
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$6);}
+    | PARSEOP_ACQUIRE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+AddTerm
+    : PARSEOP_ADD '('               {$<n>$ = TrCreateLeafNode (PARSEOP_ADD);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_ADD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+AliasTerm
+    : PARSEOP_ALIAS '('             {$<n>$ = TrCreateLeafNode (PARSEOP_ALIAS);}
+        NameString
+        NameStringItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,
+                                        TrSetNodeFlags ($5, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_ALIAS '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+AndTerm
+    : PARSEOP_AND '('               {$<n>$ = TrCreateLeafNode (PARSEOP_AND);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_AND '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ArgTerm
+    : PARSEOP_ARG0                  {$$ = TrCreateLeafNode (PARSEOP_ARG0);}
+    | PARSEOP_ARG1                  {$$ = TrCreateLeafNode (PARSEOP_ARG1);}
+    | PARSEOP_ARG2                  {$$ = TrCreateLeafNode (PARSEOP_ARG2);}
+    | PARSEOP_ARG3                  {$$ = TrCreateLeafNode (PARSEOP_ARG3);}
+    | PARSEOP_ARG4                  {$$ = TrCreateLeafNode (PARSEOP_ARG4);}
+    | PARSEOP_ARG5                  {$$ = TrCreateLeafNode (PARSEOP_ARG5);}
+    | PARSEOP_ARG6                  {$$ = TrCreateLeafNode (PARSEOP_ARG6);}
+    ;
+
+BankFieldTerm
+    : PARSEOP_BANKFIELD '('         {$<n>$ = TrCreateLeafNode (PARSEOP_BANKFIELD);}
+        NameString
+        NameStringItem
+        TermArgItem
+        ',' AccessTypeKeyword
+        ',' LockRuleKeyword
+        ',' UpdateRuleKeyword
+        ')' '{'
+            FieldUnitList '}'       {$$ = TrLinkChildren ($<n>3,7,$4,$5,$6,$8,$10,$12,$15);}
+    | PARSEOP_BANKFIELD '('
+        error ')' '{' error '}'     {$$ = AslDoError(); yyclearin;}
+    ;
+
+BreakTerm
+    : PARSEOP_BREAK                 {$$ = TrCreateNode (PARSEOP_BREAK, 0);}
+    ;
+
+BreakPointTerm
+    : PARSEOP_BREAKPOINT            {$$ = TrCreateNode (PARSEOP_BREAKPOINT, 0);}
+    ;
+
+BufferTerm
+    : PARSEOP_BUFFER '('            {$<n>$ = TrCreateLeafNode (PARSEOP_BUFFER);}
+        OptionalBufferLength
+        ')' '{'
+            BufferTermData '}'      {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_BUFFER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+BufferTermData
+    : ByteList                      {}
+    | StringData                    {}
+    ;
+
+CaseTerm
+    : PARSEOP_CASE '('              {$<n>$ = TrCreateLeafNode (PARSEOP_CASE);}
+        DataObject
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_CASE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ConcatTerm
+    : PARSEOP_CONCATENATE '('       {$<n>$ = TrCreateLeafNode (PARSEOP_CONCATENATE);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_CONCATENATE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ConcatResTerm
+    : PARSEOP_CONCATENATERESTEMPLATE '('    {$<n>$ = TrCreateLeafNode (PARSEOP_CONCATENATERESTEMPLATE);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_CONCATENATERESTEMPLATE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ConnectionTerm
+    : PARSEOP_CONNECTION '('
+        NameString
+        ')'                         {$$ = TrCreateNode (PARSEOP_CONNECTION,1,$3);}
+    | PARSEOP_CONNECTION '('        {$<n>$ = TrCreateLeafNode (PARSEOP_CONNECTION);}
+        ResourceMacroTerm
+        ')'                         {$$ = TrLinkChildren ($<n>3, 1,
+                                            TrLinkChildren (TrCreateLeafNode (PARSEOP_RESOURCETEMPLATE), 3,
+                                                TrCreateLeafNode (PARSEOP_DEFAULT_ARG),
+                                                TrCreateLeafNode (PARSEOP_DEFAULT_ARG),
+                                                $4));}
+    | PARSEOP_CONNECTION '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+CondRefOfTerm
+    : PARSEOP_CONDREFOF '('         {$<n>$ = TrCreateLeafNode (PARSEOP_CONDREFOF);}
+        SuperName
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_CONDREFOF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ContinueTerm
+    : PARSEOP_CONTINUE              {$$ = TrCreateNode (PARSEOP_CONTINUE, 0);}
+    ;
+
+CopyObjectTerm
+    : PARSEOP_COPYOBJECT '('        {$<n>$ = TrCreateLeafNode (PARSEOP_COPYOBJECT);}
+        TermArg
+        ',' SimpleTarget
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,TrSetNodeFlags ($6, NODE_IS_TARGET));}
+    | PARSEOP_COPYOBJECT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+CreateBitFieldTerm
+    : PARSEOP_CREATEBITFIELD '('    {$<n>$ = TrCreateLeafNode (PARSEOP_CREATEBITFIELD);}
+        TermArg
+        TermArgItem
+        NameStringItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,TrSetNodeFlags ($6, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_CREATEBITFIELD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+CreateByteFieldTerm
+    : PARSEOP_CREATEBYTEFIELD '('   {$<n>$ = TrCreateLeafNode (PARSEOP_CREATEBYTEFIELD);}
+        TermArg
+        TermArgItem
+        NameStringItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,TrSetNodeFlags ($6, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_CREATEBYTEFIELD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+CreateDWordFieldTerm
+    : PARSEOP_CREATEDWORDFIELD '('  {$<n>$ = TrCreateLeafNode (PARSEOP_CREATEDWORDFIELD);}
+        TermArg
+        TermArgItem
+        NameStringItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,TrSetNodeFlags ($6, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_CREATEDWORDFIELD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+CreateFieldTerm
+    : PARSEOP_CREATEFIELD '('       {$<n>$ = TrCreateLeafNode (PARSEOP_CREATEFIELD);}
+        TermArg
+        TermArgItem
+        TermArgItem
+        NameStringItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,4,$4,$5,$6,TrSetNodeFlags ($7, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_CREATEFIELD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+CreateQWordFieldTerm
+    : PARSEOP_CREATEQWORDFIELD '('  {$<n>$ = TrCreateLeafNode (PARSEOP_CREATEQWORDFIELD);}
+        TermArg
+        TermArgItem
+        NameStringItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,TrSetNodeFlags ($6, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_CREATEQWORDFIELD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+CreateWordFieldTerm
+    : PARSEOP_CREATEWORDFIELD '('   {$<n>$ = TrCreateLeafNode (PARSEOP_CREATEWORDFIELD);}
+        TermArg
+        TermArgItem
+        NameStringItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,TrSetNodeFlags ($6, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_CREATEWORDFIELD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DataRegionTerm
+    : PARSEOP_DATATABLEREGION '('   {$<n>$ = TrCreateLeafNode (PARSEOP_DATATABLEREGION);}
+        NameString
+        TermArgItem
+        TermArgItem
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,4,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$5,$6,$7);}
+    | PARSEOP_DATATABLEREGION '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DebugTerm
+    : PARSEOP_DEBUG                 {$$ = TrCreateLeafNode (PARSEOP_DEBUG);}
+    ;
+
+DecTerm
+    : PARSEOP_DECREMENT '('         {$<n>$ = TrCreateLeafNode (PARSEOP_DECREMENT);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_DECREMENT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DefaultTerm
+    : PARSEOP_DEFAULT '{'           {$<n>$ = TrCreateLeafNode (PARSEOP_DEFAULT);}
+        TermList '}'                {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_DEFAULT '{'
+        error '}'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DerefOfTerm
+    : PARSEOP_DEREFOF '('           {$<n>$ = TrCreateLeafNode (PARSEOP_DEREFOF);}
+        TermArg
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_DEREFOF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DeviceTerm
+    : PARSEOP_DEVICE '('            {$<n>$ = TrCreateLeafNode (PARSEOP_DEVICE);}
+        NameString
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,2,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$7);}
+    | PARSEOP_DEVICE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+DivideTerm
+    : PARSEOP_DIVIDE '('            {$<n>$ = TrCreateLeafNode (PARSEOP_DIVIDE);}
+        TermArg
+        TermArgItem
+        Target
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,4,$4,$5,$6,$7);}
+    | PARSEOP_DIVIDE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+EISAIDTerm
+    : PARSEOP_EISAID '('
+        StringData ')'              {$$ = TrUpdateNode (PARSEOP_EISAID, $3);}
+    | PARSEOP_EISAID '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ElseIfTerm
+    : IfTerm ElseTerm               {$$ = TrLinkPeerNode ($1,$2);}
+    ;
+
+ElseTerm
+    :                               {$$ = NULL;}
+    | PARSEOP_ELSE '{'              {$<n>$ = TrCreateLeafNode (PARSEOP_ELSE);}
+        TermList '}'                {$$ = TrLinkChildren ($<n>3,1,$4);}
+
+    | PARSEOP_ELSE '{'
+        error '}'                   {$$ = AslDoError(); yyclearin;}
+
+    | PARSEOP_ELSE
+        error                       {$$ = AslDoError(); yyclearin;}
+
+    | PARSEOP_ELSEIF '('            {$<n>$ = TrCreateLeafNode (PARSEOP_ELSE);}
+        TermArg                     {$<n>$ = TrCreateLeafNode (PARSEOP_IF);}
+        ')' '{'
+            TermList '}'            {TrLinkChildren ($<n>5,2,$4,$8);}
+        ElseTerm                    {TrLinkPeerNode ($<n>5,$11);}
+                                    {$$ = TrLinkChildren ($<n>3,1,$<n>5);}
+
+    | PARSEOP_ELSEIF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+
+    | PARSEOP_ELSEIF
+        error                       {$$ = AslDoError(); yyclearin;}
+    ;
+
+EventTerm
+    : PARSEOP_EVENT '('             {$<n>$ = TrCreateLeafNode (PARSEOP_EVENT);}
+        NameString
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION));}
+    | PARSEOP_EVENT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ExternalTerm
+    : PARSEOP_EXTERNAL '('
+        NameString
+        OptionalObjectTypeKeyword
+        OptionalParameterTypePackage
+        OptionalParameterTypesPackage
+        ')'                         {$$ = TrCreateNode (PARSEOP_EXTERNAL,4,$3,$4,$5,$6);}
+    | PARSEOP_EXTERNAL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+FatalTerm
+    : PARSEOP_FATAL '('             {$<n>$ = TrCreateLeafNode (PARSEOP_FATAL);}
+        ByteConstExpr
+        ',' DWordConstExpr
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$6,$7);}
+    | PARSEOP_FATAL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+FieldTerm
+    : PARSEOP_FIELD '('             {$<n>$ = TrCreateLeafNode (PARSEOP_FIELD);}
+        NameString
+        ',' AccessTypeKeyword
+        ',' LockRuleKeyword
+        ',' UpdateRuleKeyword
+        ')' '{'
+            FieldUnitList '}'       {$$ = TrLinkChildren ($<n>3,5,$4,$6,$8,$10,$13);}
+    | PARSEOP_FIELD '('
+        error ')' '{' error '}'     {$$ = AslDoError(); yyclearin;}
+    ;
+
+FindSetLeftBitTerm
+    : PARSEOP_FINDSETLEFTBIT '('    {$<n>$ = TrCreateLeafNode (PARSEOP_FINDSETLEFTBIT);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_FINDSETLEFTBIT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+FindSetRightBitTerm
+    : PARSEOP_FINDSETRIGHTBIT '('   {$<n>$ = TrCreateLeafNode (PARSEOP_FINDSETRIGHTBIT);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_FINDSETRIGHTBIT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+    /* Convert a For() loop to a While() loop */
+ForTerm
+    : PARSEOP_FOR '('               {$<n>$ = TrCreateLeafNode (PARSEOP_WHILE);}
+        OptionalTermArg ','         {}
+        OptionalPredicate ','
+        OptionalTermArg             {$<n>$ = TrLinkPeerNode ($4,$<n>3);
+                                        TrSetParent ($9,$<n>3);}                /* New parent is WHILE */
+        ')' '{' TermList '}'        {$<n>$ = TrLinkChildren ($<n>3,2,$7,$13);}
+                                    {$<n>$ = TrLinkPeerNode ($13,$9);
+                                        $$ = $<n>10;}
+    ;
+
+OptionalPredicate
+    :                               {$$ = TrCreateValuedLeafNode (PARSEOP_INTEGER, 1);}
+    | TermArg                       {$$ = $1;}
+    ;
+
+FprintfTerm
+    : PARSEOP_FPRINTF '('            {$<n>$ = TrCreateLeafNode (PARSEOP_FPRINTF);}
+        TermArg ','
+        StringData
+        PrintfArgList
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$6,$7);}
+    | PARSEOP_FPRINTF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+FromBCDTerm
+    : PARSEOP_FROMBCD '('           {$<n>$ = TrCreateLeafNode (PARSEOP_FROMBCD);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_FROMBCD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+FunctionTerm
+    : PARSEOP_FUNCTION '('          {$<n>$ = TrCreateLeafNode (PARSEOP_METHOD);}
+        NameString
+        OptionalParameterTypePackage
+        OptionalParameterTypesPackage
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,7,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),
+                                        TrCreateValuedLeafNode (PARSEOP_BYTECONST, 0),
+                                        TrCreateLeafNode (PARSEOP_SERIALIZERULE_NOTSERIAL),
+                                        TrCreateValuedLeafNode (PARSEOP_BYTECONST, 0),$5,$6,$9);}
+    | PARSEOP_FUNCTION '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+IfTerm
+    : PARSEOP_IF '('                {$<n>$ = TrCreateLeafNode (PARSEOP_IF);}
+        TermArg
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+
+    | PARSEOP_IF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+IncludeTerm
+    : PARSEOP_INCLUDE '('
+        String  ')'                 {$$ = TrUpdateNode (PARSEOP_INCLUDE, $3);
+                                        FlOpenIncludeFile ($3);}
+    ;
+
+IncludeEndTerm
+    : PARSEOP_INCLUDE_END           {$<n>$ = TrCreateLeafNode (PARSEOP_INCLUDE_END); TrSetCurrentFilename ($$);}
+    ;
+
+IncTerm
+    : PARSEOP_INCREMENT '('         {$<n>$ = TrCreateLeafNode (PARSEOP_INCREMENT);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_INCREMENT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+IndexFieldTerm
+    : PARSEOP_INDEXFIELD '('        {$<n>$ = TrCreateLeafNode (PARSEOP_INDEXFIELD);}
+        NameString
+        NameStringItem
+        ',' AccessTypeKeyword
+        ',' LockRuleKeyword
+        ',' UpdateRuleKeyword
+        ')' '{'
+            FieldUnitList '}'       {$$ = TrLinkChildren ($<n>3,6,$4,$5,$7,$9,$11,$14);}
+    | PARSEOP_INDEXFIELD '('
+        error ')' '{' error '}'     {$$ = AslDoError(); yyclearin;}
+    ;
+
+IndexTerm
+    : PARSEOP_INDEX '('             {$<n>$ = TrCreateLeafNode (PARSEOP_INDEX);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_INDEX '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LAndTerm
+    : PARSEOP_LAND '('              {$<n>$ = TrCreateLeafNode (PARSEOP_LAND);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_LAND '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LEqualTerm
+    : PARSEOP_LEQUAL '('            {$<n>$ = TrCreateLeafNode (PARSEOP_LEQUAL);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_LEQUAL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LGreaterEqualTerm
+    : PARSEOP_LGREATEREQUAL '('     {$<n>$ = TrCreateLeafNode (PARSEOP_LLESS);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrCreateNode (PARSEOP_LNOT, 1, TrLinkChildren ($<n>3,2,$4,$5));}
+    | PARSEOP_LGREATEREQUAL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LGreaterTerm
+    : PARSEOP_LGREATER '('          {$<n>$ = TrCreateLeafNode (PARSEOP_LGREATER);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_LGREATER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LLessEqualTerm
+    : PARSEOP_LLESSEQUAL '('        {$<n>$ = TrCreateLeafNode (PARSEOP_LGREATER);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrCreateNode (PARSEOP_LNOT, 1, TrLinkChildren ($<n>3,2,$4,$5));}
+    | PARSEOP_LLESSEQUAL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LLessTerm
+    : PARSEOP_LLESS '('             {$<n>$ = TrCreateLeafNode (PARSEOP_LLESS);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_LLESS '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LNotEqualTerm
+    : PARSEOP_LNOTEQUAL '('         {$<n>$ = TrCreateLeafNode (PARSEOP_LEQUAL);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrCreateNode (PARSEOP_LNOT, 1, TrLinkChildren ($<n>3,2,$4,$5));}
+    | PARSEOP_LNOTEQUAL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LNotTerm
+    : PARSEOP_LNOT '('              {$<n>$ = TrCreateLeafNode (PARSEOP_LNOT);}
+        TermArg
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_LNOT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LoadTableTerm
+    : PARSEOP_LOADTABLE '('         {$<n>$ = TrCreateLeafNode (PARSEOP_LOADTABLE);}
+        TermArg
+        TermArgItem
+        TermArgItem
+        OptionalListString
+        OptionalListString
+        OptionalReference
+        ')'                         {$$ = TrLinkChildren ($<n>3,6,$4,$5,$6,$7,$8,$9);}
+    | PARSEOP_LOADTABLE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LoadTerm
+    : PARSEOP_LOAD '('              {$<n>$ = TrCreateLeafNode (PARSEOP_LOAD);}
+        NameString
+        RequiredTarget
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_LOAD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+LocalTerm
+    : PARSEOP_LOCAL0                {$$ = TrCreateLeafNode (PARSEOP_LOCAL0);}
+    | PARSEOP_LOCAL1                {$$ = TrCreateLeafNode (PARSEOP_LOCAL1);}
+    | PARSEOP_LOCAL2                {$$ = TrCreateLeafNode (PARSEOP_LOCAL2);}
+    | PARSEOP_LOCAL3                {$$ = TrCreateLeafNode (PARSEOP_LOCAL3);}
+    | PARSEOP_LOCAL4                {$$ = TrCreateLeafNode (PARSEOP_LOCAL4);}
+    | PARSEOP_LOCAL5                {$$ = TrCreateLeafNode (PARSEOP_LOCAL5);}
+    | PARSEOP_LOCAL6                {$$ = TrCreateLeafNode (PARSEOP_LOCAL6);}
+    | PARSEOP_LOCAL7                {$$ = TrCreateLeafNode (PARSEOP_LOCAL7);}
+    ;
+
+LOrTerm
+    : PARSEOP_LOR '('               {$<n>$ = TrCreateLeafNode (PARSEOP_LOR);}
+        TermArg
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_LOR '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+MatchTerm
+    : PARSEOP_MATCH '('             {$<n>$ = TrCreateLeafNode (PARSEOP_MATCH);}
+        TermArg
+        ',' MatchOpKeyword
+        TermArgItem
+        ',' MatchOpKeyword
+        TermArgItem
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,6,$4,$6,$7,$9,$10,$11);}
+    | PARSEOP_MATCH '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+MethodTerm
+    : PARSEOP_METHOD  '('           {$<n>$ = TrCreateLeafNode (PARSEOP_METHOD);}
+        NameString
+        OptionalByteConstExpr       {UtCheckIntegerRange ($5, 0, 7);}
+        OptionalSerializeRuleKeyword
+        OptionalByteConstExpr
+        OptionalParameterTypePackage
+        OptionalParameterTypesPackage
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,7,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$5,$7,$8,$9,$10,$13);}
+    | PARSEOP_METHOD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+MidTerm
+    : PARSEOP_MID '('               {$<n>$ = TrCreateLeafNode (PARSEOP_MID);}
+        TermArg
+        TermArgItem
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,4,$4,$5,$6,$7);}
+    | PARSEOP_MID '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ModTerm
+    : PARSEOP_MOD '('               {$<n>$ = TrCreateLeafNode (PARSEOP_MOD);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_MOD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+MultiplyTerm
+    : PARSEOP_MULTIPLY '('          {$<n>$ = TrCreateLeafNode (PARSEOP_MULTIPLY);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_MULTIPLY '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+MutexTerm
+    : PARSEOP_MUTEX '('             {$<n>$ = TrCreateLeafNode (PARSEOP_MUTEX);}
+        NameString
+        ',' ByteConstExpr
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$6);}
+    | PARSEOP_MUTEX '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+NameTerm
+    : PARSEOP_NAME '('              {$<n>$ = TrCreateLeafNode (PARSEOP_NAME);}
+        NameString
+        ',' DataObject
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$6);}
+    | PARSEOP_NAME '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+NAndTerm
+    : PARSEOP_NAND '('              {$<n>$ = TrCreateLeafNode (PARSEOP_NAND);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_NAND '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+NoOpTerm
+    : PARSEOP_NOOP                  {$$ = TrCreateNode (PARSEOP_NOOP, 0);}
+    ;
+
+NOrTerm
+    : PARSEOP_NOR '('               {$<n>$ = TrCreateLeafNode (PARSEOP_NOR);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_NOR '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+NotifyTerm
+    : PARSEOP_NOTIFY '('            {$<n>$ = TrCreateLeafNode (PARSEOP_NOTIFY);}
+        SuperName
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_NOTIFY '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+NotTerm
+    : PARSEOP_NOT '('               {$<n>$ = TrCreateLeafNode (PARSEOP_NOT);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_NOT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ObjectTypeTerm
+    : PARSEOP_OBJECTTYPE '('        {$<n>$ = TrCreateLeafNode (PARSEOP_OBJECTTYPE);}
+        ObjectTypeName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_OBJECTTYPE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+OffsetTerm
+    : PARSEOP_OFFSET '('
+        AmlPackageLengthTerm
+        ')'                         {$$ = TrCreateNode (PARSEOP_OFFSET,1,$3);}
+    | PARSEOP_OFFSET '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+OpRegionTerm
+    : PARSEOP_OPERATIONREGION '('   {$<n>$ = TrCreateLeafNode (PARSEOP_OPERATIONREGION);}
+        NameString
+        ',' OpRegionSpaceIdTerm
+        TermArgItem
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,4,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$6,$7,$8);}
+    | PARSEOP_OPERATIONREGION '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+OpRegionSpaceIdTerm
+    : RegionSpaceKeyword            {}
+    | ByteConst                     {$$ = UtCheckIntegerRange ($1, 0x80, 0xFF);}
+    ;
+
+OrTerm
+    : PARSEOP_OR '('                {$<n>$ = TrCreateLeafNode (PARSEOP_OR);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_OR '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+PackageTerm
+    : PARSEOP_PACKAGE '('           {$<n>$ = TrCreateLeafNode (PARSEOP_VAR_PACKAGE);}
+        VarPackageLengthTerm
+        ')' '{'
+            PackageList '}'         {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_PACKAGE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+PowerResTerm
+    : PARSEOP_POWERRESOURCE '('     {$<n>$ = TrCreateLeafNode (PARSEOP_POWERRESOURCE);}
+        NameString
+        ',' ByteConstExpr
+        ',' WordConstExpr
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,4,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$6,$8,$11);}
+    | PARSEOP_POWERRESOURCE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+PrintfTerm
+    : PARSEOP_PRINTF '('            {$<n>$ = TrCreateLeafNode (PARSEOP_PRINTF);}
+        StringData
+        PrintfArgList
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_PRINTF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+PrintfArgList
+    :                               {$$ = NULL;}
+    | TermArg                       {$$ = $1;}
+    | PrintfArgList ','
+       TermArg                      {$$ = TrLinkPeerNode ($1, $3);}
+    ;
+
+ProcessorTerm
+    : PARSEOP_PROCESSOR '('         {$<n>$ = TrCreateLeafNode (PARSEOP_PROCESSOR);}
+        NameString
+        ',' ByteConstExpr
+        OptionalDWordConstExpr
+        OptionalByteConstExpr
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,5,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$6,$7,$8,$11);}
+    | PARSEOP_PROCESSOR '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+RawDataBufferTerm
+    : PARSEOP_DATABUFFER  '('       {$<n>$ = TrCreateLeafNode (PARSEOP_DATABUFFER);}
+        OptionalWordConst
+        ')' '{'
+            ByteList '}'            {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_DATABUFFER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+/*
+ * In RefOf, the node isn't really a target, but we can't keep track of it after
+ * we've taken a pointer to it. (hard to tell if a local becomes initialized this way.)
+ */
+RefOfTerm
+    : PARSEOP_REFOF '('             {$<n>$ = TrCreateLeafNode (PARSEOP_REFOF);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,TrSetNodeFlags ($4, NODE_IS_TARGET));}
+    | PARSEOP_REFOF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ReleaseTerm
+    : PARSEOP_RELEASE '('           {$<n>$ = TrCreateLeafNode (PARSEOP_RELEASE);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_RELEASE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ResetTerm
+    : PARSEOP_RESET '('             {$<n>$ = TrCreateLeafNode (PARSEOP_RESET);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_RESET '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ReturnTerm
+    : PARSEOP_RETURN '('            {$<n>$ = TrCreateLeafNode (PARSEOP_RETURN);}
+        OptionalReturnArg
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_RETURN                {$$ = TrLinkChildren (TrCreateLeafNode (PARSEOP_RETURN),1,TrSetNodeFlags (TrCreateLeafNode (PARSEOP_ZERO), NODE_IS_NULL_RETURN));}
+    | PARSEOP_RETURN '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ScopeTerm
+    : PARSEOP_SCOPE '('             {$<n>$ = TrCreateLeafNode (PARSEOP_SCOPE);}
+        NameString
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,2,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$7);}
+    | PARSEOP_SCOPE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ShiftLeftTerm
+    : PARSEOP_SHIFTLEFT '('         {$<n>$ = TrCreateLeafNode (PARSEOP_SHIFTLEFT);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_SHIFTLEFT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ShiftRightTerm
+    : PARSEOP_SHIFTRIGHT '('        {$<n>$ = TrCreateLeafNode (PARSEOP_SHIFTRIGHT);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_SHIFTRIGHT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+SignalTerm
+    : PARSEOP_SIGNAL '('            {$<n>$ = TrCreateLeafNode (PARSEOP_SIGNAL);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_SIGNAL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+SizeOfTerm
+    : PARSEOP_SIZEOF '('            {$<n>$ = TrCreateLeafNode (PARSEOP_SIZEOF);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_SIZEOF '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+SleepTerm
+    : PARSEOP_SLEEP '('             {$<n>$ = TrCreateLeafNode (PARSEOP_SLEEP);}
+        TermArg
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_SLEEP '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+StallTerm
+    : PARSEOP_STALL '('             {$<n>$ = TrCreateLeafNode (PARSEOP_STALL);}
+        TermArg
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_STALL '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+StoreTerm
+    : PARSEOP_STORE '('             {$<n>$ = TrCreateLeafNode (PARSEOP_STORE);}
+        TermArg
+        ',' SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,TrSetNodeFlags ($6, NODE_IS_TARGET));}
+    | PARSEOP_STORE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+SubtractTerm
+    : PARSEOP_SUBTRACT '('          {$<n>$ = TrCreateLeafNode (PARSEOP_SUBTRACT);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_SUBTRACT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+SwitchTerm
+    : PARSEOP_SWITCH '('            {$<n>$ = TrCreateLeafNode (PARSEOP_SWITCH);}
+        TermArg
+        ')' '{'
+            CaseDefaultTermList '}'
+                                    {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_SWITCH '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ThermalZoneTerm
+    : PARSEOP_THERMALZONE '('       {$<n>$ = TrCreateLeafNode (PARSEOP_THERMALZONE);}
+        NameString
+        ')' '{'
+            TermList '}'            {$$ = TrLinkChildren ($<n>3,2,TrSetNodeFlags ($4, NODE_IS_NAME_DECLARATION),$7);}
+    | PARSEOP_THERMALZONE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+TimerTerm
+    : PARSEOP_TIMER '('             {$<n>$ = TrCreateLeafNode (PARSEOP_TIMER);}
+        ')'                         {$$ = TrLinkChildren ($<n>3,0);}
+    | PARSEOP_TIMER                 {$$ = TrLinkChildren (TrCreateLeafNode (PARSEOP_TIMER),0);}
+    | PARSEOP_TIMER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ToBCDTerm
+    : PARSEOP_TOBCD '('             {$<n>$ = TrCreateLeafNode (PARSEOP_TOBCD);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_TOBCD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ToBufferTerm
+    : PARSEOP_TOBUFFER '('          {$<n>$ = TrCreateLeafNode (PARSEOP_TOBUFFER);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_TOBUFFER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ToDecimalStringTerm
+    : PARSEOP_TODECIMALSTRING '('   {$<n>$ = TrCreateLeafNode (PARSEOP_TODECIMALSTRING);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_TODECIMALSTRING '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ToHexStringTerm
+    : PARSEOP_TOHEXSTRING '('       {$<n>$ = TrCreateLeafNode (PARSEOP_TOHEXSTRING);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_TOHEXSTRING '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ToIntegerTerm
+    : PARSEOP_TOINTEGER '('         {$<n>$ = TrCreateLeafNode (PARSEOP_TOINTEGER);}
+        TermArg
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_TOINTEGER '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ToPLDTerm
+    : PARSEOP_TOPLD '('             {$<n>$ = TrCreateLeafNode (PARSEOP_TOPLD);}
+        PldKeywordList
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_TOPLD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+PldKeywordList
+    :                               {$$ = NULL;}
+    | PldKeyword
+        PARSEOP_EXP_EQUALS Integer  {$$ = TrLinkChildren ($1,1,$3);}
+    | PldKeyword
+        PARSEOP_EXP_EQUALS String   {$$ = TrLinkChildren ($1,1,$3);}
+    | PldKeywordList ','            /* Allows a trailing comma at list end */
+    | PldKeywordList ','
+        PldKeyword
+        PARSEOP_EXP_EQUALS Integer  {$$ = TrLinkPeerNode ($1,TrLinkChildren ($3,1,$5));}
+    | PldKeywordList ','
+        PldKeyword
+        PARSEOP_EXP_EQUALS String   {$$ = TrLinkPeerNode ($1,TrLinkChildren ($3,1,$5));}
+    ;
+
+
+ToStringTerm
+    : PARSEOP_TOSTRING '('          {$<n>$ = TrCreateLeafNode (PARSEOP_TOSTRING);}
+        TermArg
+        OptionalCount
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_TOSTRING '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+ToUUIDTerm
+    : PARSEOP_TOUUID '('
+        StringData ')'              {$$ = TrUpdateNode (PARSEOP_TOUUID, $3);}
+    | PARSEOP_TOUUID '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+UnicodeTerm
+    : PARSEOP_UNICODE '('           {$<n>$ = TrCreateLeafNode (PARSEOP_UNICODE);}
+        StringData
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,0,$4);}
+    | PARSEOP_UNICODE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+UnloadTerm
+    : PARSEOP_UNLOAD '('            {$<n>$ = TrCreateLeafNode (PARSEOP_UNLOAD);}
+        SuperName
+        ')'                         {$$ = TrLinkChildren ($<n>3,1,$4);}
+    | PARSEOP_UNLOAD '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+WaitTerm
+    : PARSEOP_WAIT '('              {$<n>$ = TrCreateLeafNode (PARSEOP_WAIT);}
+        SuperName
+        TermArgItem
+        ')'                         {$$ = TrLinkChildren ($<n>3,2,$4,$5);}
+    | PARSEOP_WAIT '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+XOrTerm
+    : PARSEOP_XOR '('               {$<n>$ = TrCreateLeafNode (PARSEOP_XOR);}
+        TermArg
+        TermArgItem
+        Target
+        ')'                         {$$ = TrLinkChildren ($<n>3,3,$4,$5,$6);}
+    | PARSEOP_XOR '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+WhileTerm
+    : PARSEOP_WHILE '('             {$<n>$ = TrCreateLeafNode (PARSEOP_WHILE);}
+        TermArg
+        ')' '{' TermList '}'
+                                    {$$ = TrLinkChildren ($<n>3,2,$4,$7);}
+    | PARSEOP_WHILE '('
+        error ')'                   {$$ = AslDoError(); yyclearin;}
+    ;
+
+
+/*******************************************************************************
+ *
+ * ASL Helper Terms
+ *
+ ******************************************************************************/
+
+AmlPackageLengthTerm
+    : Integer                       {$$ = TrUpdateNode (PARSEOP_PACKAGE_LENGTH,(ACPI_PARSE_OBJECT *) $1);}
+    ;
+
+NameStringItem
+    : ',' NameString                {$$ = $2;}
+    | ',' error                     {$$ = AslDoError (); yyclearin;}
+    ;
+
+TermArgItem
+    : ',' TermArg                   {$$ = $2;}
+    | ',' error                     {$$ = AslDoError (); yyclearin;}
+    ;
+
+OptionalReference
+    :                               {$$ = TrCreateLeafNode (PARSEOP_ZERO);}       /* Placeholder is a ZeroOp object */
+    | ','                           {$$ = TrCreateLeafNode (PARSEOP_ZERO);}       /* Placeholder is a ZeroOp object */
+    | ',' TermArg                   {$$ = $2;}
+    ;
+
+OptionalReturnArg
+    :                               {$$ = TrSetNodeFlags (TrCreateLeafNode (PARSEOP_ZERO), NODE_IS_NULL_RETURN);}       /* Placeholder is a ZeroOp object */
+    | TermArg                       {$$ = $1;}
+    ;
+
+OptionalSerializeRuleKeyword
+    :                               {$$ = NULL;}
+    | ','                           {$$ = NULL;}
+    | ',' SerializeRuleKeyword      {$$ = $2;}
+    ;
+
+OptionalTermArg
+    :                               {$$ = TrCreateLeafNode (PARSEOP_DEFAULT_ARG);}
+    | TermArg                       {$$ = $1;}
+    ;
+
+OptionalBufferLength
+    :                               {$$ = NULL;}
+    | TermArg                       {$$ = $1;}
+    ;
+
+OptionalWordConst
+    :                               {$$ = NULL;}
+    | WordConst                     {$$ = $1;}
+    ;
diff --git a/usr/src/cmd/acpi/iasl/aslstartup.c b/usr/src/cmd/acpi/iasl/aslstartup.c
new file mode 100644
index 0000000000..df90ae5fe7
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslstartup.c
@@ -0,0 +1,525 @@
+/******************************************************************************
+ *
+ * Module Name: aslstartup - Compiler startup routines, called from main
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "actables.h"
+#include "acdisasm.h"
+#include "acapps.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslstartup")
+
+
+/* Local prototypes */
+
+static UINT8
+AslDetectSourceFileType (
+    ASL_FILE_INFO           *Info);
+
+static ACPI_STATUS
+AslDoDisassembly (
+    void);
+
+
+/* Globals */
+
+static BOOLEAN          AslToFile = TRUE;
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslInitializeGlobals
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Re-initialize globals needed to restart the compiler. This
+ *              allows multiple files to be disassembled and/or compiled.
+ *
+ ******************************************************************************/
+
+void
+AslInitializeGlobals (
+    void)
+{
+    UINT32                  i;
+
+
+    /* Init compiler globals */
+
+    Gbl_SyntaxError = 0;
+    Gbl_CurrentColumn = 0;
+    Gbl_CurrentLineNumber = 1;
+    Gbl_LogicalLineNumber = 1;
+    Gbl_CurrentLineOffset = 0;
+    Gbl_InputFieldCount = 0;
+    Gbl_InputByteCount = 0;
+    Gbl_NsLookupCount = 0;
+    Gbl_LineBufPtr = Gbl_CurrentLineBuffer;
+
+    Gbl_ErrorLog = NULL;
+    Gbl_NextError = NULL;
+    Gbl_Signature = NULL;
+    Gbl_FileType = 0;
+
+    TotalExecutableOpcodes = 0;
+    TotalNamedObjects = 0;
+    TotalKeywords = 0;
+    TotalParseNodes = 0;
+    TotalMethods = 0;
+    TotalAllocations = 0;
+    TotalAllocated = 0;
+    TotalFolds = 0;
+
+    AslGbl_NextEvent = 0;
+    for (i = 0; i < ASL_NUM_REPORT_LEVELS; i++)
+    {
+        Gbl_ExceptionCount[i] = 0;
+    }
+
+    for (i = ASL_FILE_INPUT; i <= ASL_MAX_FILE_TYPE; i++)
+    {
+        Gbl_Files[i].Handle = NULL;
+        Gbl_Files[i].Filename = NULL;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDetectSourceFileType
+ *
+ * PARAMETERS:  Info            - Name/Handle for the file (must be open)
+ *
+ * RETURN:      File Type
+ *
+ * DESCRIPTION: Determine the type of the input file. Either binary (contains
+ *              non-ASCII characters), ASL file, or an ACPI Data Table file.
+ *
+ ******************************************************************************/
+
+static UINT8
+AslDetectSourceFileType (
+    ASL_FILE_INFO           *Info)
+{
+    char                    *FileChar;
+    UINT8                   Type = ASL_INPUT_TYPE_ASCII_DATA; /* default */
+    ACPI_STATUS             Status;
+
+
+    /* Check for 100% ASCII source file (comments are ignored) */
+
+    Status = FlIsFileAsciiSource (Info->Filename, FALSE);
+    if (ACPI_SUCCESS (Status))
+    {
+        /*
+         * File contains ASCII source code. Determine if this is an ASL
+         * file or an ACPI data table file.
+         */
+        while (fgets (Gbl_CurrentLineBuffer, Gbl_LineBufferSize, Info->Handle))
+        {
+            /* Uppercase the buffer for caseless compare */
+
+            FileChar = Gbl_CurrentLineBuffer;
+            while (*FileChar)
+            {
+                *FileChar = (char) toupper ((int) *FileChar);
+                FileChar++;
+            }
+
+            /* Presence of "DefinitionBlock" indicates actual ASL code */
+
+            if (strstr (Gbl_CurrentLineBuffer, "DEFINITIONBLOCK"))
+            {
+                /* Appears to be an ASL file */
+
+                Type = ASL_INPUT_TYPE_ASCII_ASL;
+                goto Cleanup;
+            }
+        }
+
+        /* Appears to be an ASCII data table source file */
+
+        Type = ASL_INPUT_TYPE_ASCII_DATA;
+        goto Cleanup;
+    }
+
+    /* We have some sort of binary table, check for valid ACPI table */
+
+    fseek (Info->Handle, 0, SEEK_SET);
+
+    Status = AcValidateTableHeader (Info->Handle, 0);
+    if (ACPI_SUCCESS (Status))
+    {
+        fprintf (stderr,
+            "Binary file appears to be a valid ACPI table, disassembling\n");
+
+        Type = ASL_INPUT_TYPE_BINARY_ACPI_TABLE;
+        goto Cleanup;
+    }
+
+    Type = ASL_INPUT_TYPE_BINARY;
+
+
+Cleanup:
+
+    /* Must seek back to the start of the file */
+
+    fseek (Info->Handle, 0, SEEK_SET);
+    return (Type);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoDisassembly
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Initiate AML file disassembly. Uses ACPICA subsystem to build
+ *              namespace.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+AslDoDisassembly (
+    void)
+{
+    ACPI_STATUS             Status;
+
+
+    /* ACPICA subsystem initialization */
+
+    Status = AdInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = AcpiAllocateRootTable (4);
+    if (ACPI_FAILURE (Status))
+    {
+        AcpiOsPrintf ("Could not initialize ACPI Table Manager, %s\n",
+            AcpiFormatException (Status));
+        return (Status);
+    }
+
+    /* Handle additional output files for disassembler */
+
+    Gbl_FileType = ASL_INPUT_TYPE_BINARY_ACPI_TABLE;
+    Status = FlOpenMiscOutputFiles (Gbl_OutputFilenamePrefix);
+
+    /* This is where the disassembly happens */
+
+    AcpiGbl_DmOpt_Disasm = TRUE;
+    Status = AdAmlDisassemble (AslToFile,
+        Gbl_Files[ASL_FILE_INPUT].Filename, Gbl_OutputFilenamePrefix,
+        &Gbl_Files[ASL_FILE_INPUT].Filename);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* Check if any control methods were unresolved */
+
+    AcpiDmUnresolvedWarning (0);
+
+    /* Shutdown compiler and ACPICA subsystem */
+
+    AeClearErrorLog ();
+    (void) AcpiTerminate ();
+
+    /*
+     * Gbl_Files[ASL_FILE_INPUT].Filename was replaced with the
+     * .DSL disassembly file, which can now be compiled if requested
+     */
+    if (Gbl_DoCompile)
+    {
+        AcpiOsPrintf ("\nCompiling \"%s\"\n",
+            Gbl_Files[ASL_FILE_INPUT].Filename);
+        return (AE_CTRL_CONTINUE);
+    }
+
+    /* No need to free the filename string */
+
+    Gbl_Files[ASL_FILE_INPUT].Filename = NULL;
+
+    CmDeleteCaches ();
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoOneFile
+ *
+ * PARAMETERS:  Filename        - Name of the file
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Process a single file - either disassemble, compile, or both
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AslDoOneFile (
+    char                    *Filename)
+{
+    ACPI_STATUS             Status;
+
+
+    /* Re-initialize "some" compiler/preprocessor globals */
+
+    AslInitializeGlobals ();
+    PrInitializeGlobals ();
+
+    /*
+     * Extract the directory path. This path is used for possible include
+     * files and the optional AML filename embedded in the input file
+     * DefinitionBlock declaration.
+     */
+    Status = FlSplitInputPathname (Filename, &Gbl_DirectoryPath, NULL);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* Take a copy of the input filename, convert any backslashes */
+
+    Gbl_Files[ASL_FILE_INPUT].Filename =
+        UtStringCacheCalloc (strlen (Filename) + 1);
+
+    strcpy (Gbl_Files[ASL_FILE_INPUT].Filename, Filename);
+    UtConvertBackslashes (Gbl_Files[ASL_FILE_INPUT].Filename);
+
+    /*
+     * AML Disassembly (Optional)
+     */
+    if (Gbl_DisasmFlag)
+    {
+        Status = AslDoDisassembly ();
+        if (Status != AE_CTRL_CONTINUE)
+        {
+            return (Status);
+        }
+    }
+
+    /*
+     * Open the input file. Here, this should be an ASCII source file,
+     * either an ASL file or a Data Table file
+     */
+    Status = FlOpenInputFile (Gbl_Files[ASL_FILE_INPUT].Filename);
+    if (ACPI_FAILURE (Status))
+    {
+        AePrintErrorLog (ASL_FILE_STDERR);
+        return (AE_ERROR);
+    }
+
+    Gbl_OriginalInputFileSize = FlGetFileSize (ASL_FILE_INPUT);
+
+    /* Determine input file type */
+
+    Gbl_FileType = AslDetectSourceFileType (&Gbl_Files[ASL_FILE_INPUT]);
+    if (Gbl_FileType == ASL_INPUT_TYPE_BINARY)
+    {
+        return (AE_ERROR);
+    }
+
+    /*
+     * If -p not specified, we will use the input filename as the
+     * output filename prefix
+     */
+    if (Gbl_UseDefaultAmlFilename)
+    {
+        Gbl_OutputFilenamePrefix = Gbl_Files[ASL_FILE_INPUT].Filename;
+    }
+
+    /* Open the optional output files (listings, etc.) */
+
+    Status = FlOpenMiscOutputFiles (Gbl_OutputFilenamePrefix);
+    if (ACPI_FAILURE (Status))
+    {
+        AePrintErrorLog (ASL_FILE_STDERR);
+        return (AE_ERROR);
+    }
+
+    /*
+     * Compilation of ASL source versus DataTable source uses different
+     * compiler subsystems
+     */
+    switch (Gbl_FileType)
+    {
+    /*
+     * Data Table Compilation
+     */
+    case ASL_INPUT_TYPE_ASCII_DATA:
+
+        Status = DtDoCompile ();
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        if (Gbl_Signature)
+        {
+            Gbl_Signature = NULL;
+        }
+
+        /* Check if any errors occurred during compile */
+
+        Status = AslCheckForErrorExit ();
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        /* Cleanup (for next source file) and exit */
+
+        AeClearErrorLog ();
+        PrTerminatePreprocessor ();
+        return (Status);
+
+    /*
+     * ASL Compilation
+     */
+    case ASL_INPUT_TYPE_ASCII_ASL:
+
+        /* ACPICA subsystem initialization */
+
+        Status = AdInitialize ();
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        (void) CmDoCompile ();
+        (void) AcpiTerminate ();
+
+        /* Check if any errors occurred during compile */
+
+        Status = AslCheckForErrorExit ();
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        /* Cleanup (for next source file) and exit */
+
+        AeClearErrorLog ();
+        PrTerminatePreprocessor ();
+        return (AE_OK);
+
+    /*
+     * Binary ACPI table was auto-detected, disassemble it
+     */
+    case ASL_INPUT_TYPE_BINARY_ACPI_TABLE:
+
+        /* We have what appears to be an ACPI table, disassemble it */
+
+        FlCloseFile (ASL_FILE_INPUT);
+        Gbl_DoCompile = FALSE;
+        Gbl_DisasmFlag = TRUE;
+        Status = AslDoDisassembly ();
+        return (Status);
+
+    /* Unknown binary table */
+
+    case ASL_INPUT_TYPE_BINARY:
+
+        AePrintErrorLog (ASL_FILE_STDERR);
+        return (AE_ERROR);
+
+    default:
+
+        printf ("Unknown file type %X\n", Gbl_FileType);
+        return (AE_ERROR);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslCheckForErrorExit
+ *
+ * PARAMETERS:  None. Examines global exception count array
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Determine if compiler should abort with error status
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AslCheckForErrorExit (
+    void)
+{
+
+    /*
+     * Return non-zero exit code if there have been errors, unless the
+     * global ignore error flag has been set
+     */
+    if (!Gbl_IgnoreErrors)
+    {
+        if (Gbl_ExceptionCount[ASL_ERROR] > 0)
+        {
+            return (AE_ERROR);
+        }
+
+        /* Optionally treat warnings as errors */
+
+        if (Gbl_WarningsAsErrors)
+        {
+            if ((Gbl_ExceptionCount[ASL_WARNING] > 0)  ||
+                (Gbl_ExceptionCount[ASL_WARNING2] > 0) ||
+                (Gbl_ExceptionCount[ASL_WARNING3] > 0))
+            {
+                return (AE_ERROR);
+            }
+        }
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslstubs.c b/usr/src/cmd/acpi/iasl/aslstubs.c
new file mode 100644
index 0000000000..f0fbe035b5
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslstubs.c
@@ -0,0 +1,328 @@
+/******************************************************************************
+ *
+ * Module Name: aslstubs - Stubs used to link to Aml interpreter
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acdispat.h"
+#include "actables.h"
+#include "acevents.h"
+#include "acinterp.h"
+#include "acnamesp.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslstubs")
+
+
+/*
+ * Stubs to simplify linkage to the ACPICA core subsystem.
+ * Things like Events, Global Lock, etc. are not used
+ * by the compiler, so they are stubbed out here.
+ */
+void
+AcpiNsExecModuleCodeList (
+    void)
+{
+}
+
+ACPI_STATUS
+AcpiNsInitializeObjects (
+    void)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiHwReadPort (
+    ACPI_IO_ADDRESS         Address,
+    UINT32                  *Value,
+    UINT32                  Width)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiHwWritePort (
+    ACPI_IO_ADDRESS         Address,
+    UINT32                  Value,
+    UINT32                  Width)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiDsMethodError (
+    ACPI_STATUS             Status,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return (Status);
+}
+
+ACPI_STATUS
+AcpiDsMethodDataGetValue (
+    UINT8                   Type,
+    UINT32                  Index,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_OPERAND_OBJECT     **DestDesc)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiDsMethodDataGetNode (
+    UINT8                   Type,
+    UINT32                  Index,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_NAMESPACE_NODE     **Node)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiDsStoreObjectToLocal (
+    UINT8                   Type,
+    UINT32                  Index,
+    ACPI_OPERAND_OBJECT     *SrcDesc,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiEvInstallRegionHandlers (
+    void)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiEvQueueNotifyRequest (
+    ACPI_NAMESPACE_NODE     *Node,
+    UINT32                  NotifyValue)
+{
+    return (AE_OK);
+}
+
+BOOLEAN
+AcpiEvIsNotifyObject (
+    ACPI_NAMESPACE_NODE     *Node)
+{
+    return (FALSE);
+}
+
+#if (!ACPI_REDUCED_HARDWARE)
+ACPI_STATUS
+AcpiEvDeleteGpeBlock (
+    ACPI_GPE_BLOCK_INFO     *GpeBlock)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiEvAcquireGlobalLock (
+    UINT16                  Timeout)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiEvReleaseGlobalLock (
+    void)
+{
+    return (AE_OK);
+}
+#endif /* !ACPI_REDUCED_HARDWARE */
+
+ACPI_STATUS
+AcpiEvInitializeRegion (
+    ACPI_OPERAND_OBJECT     *RegionObj,
+    BOOLEAN                 AcpiNsLocked)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiExReadDataFromField (
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_OPERAND_OBJECT     *ObjDesc,
+    ACPI_OPERAND_OBJECT     **RetBufferDesc)
+{
+    return (AE_SUPPORT);
+}
+
+ACPI_STATUS
+AcpiExWriteDataToField (
+    ACPI_OPERAND_OBJECT     *SourceDesc,
+    ACPI_OPERAND_OBJECT     *ObjDesc,
+    ACPI_OPERAND_OBJECT     **ResultDesc)
+{
+    return (AE_SUPPORT);
+}
+
+ACPI_STATUS
+AcpiExLoadTableOp (
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_OPERAND_OBJECT     **ReturnDesc)
+{
+    return (AE_SUPPORT);
+}
+
+ACPI_STATUS
+AcpiExUnloadTable (
+    ACPI_OPERAND_OBJECT     *DdbHandle)
+{
+    return (AE_SUPPORT);
+}
+
+ACPI_STATUS
+AcpiExLoadOp (
+    ACPI_OPERAND_OBJECT     *ObjDesc,
+    ACPI_OPERAND_OBJECT     *Target,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return (AE_SUPPORT);
+}
+
+void
+AcpiExDoDebugObject (
+    ACPI_OPERAND_OBJECT     *SourceDesc,
+    UINT32                  Level,
+    UINT32                  Index)
+{
+    return;
+}
+
+void
+AcpiExStartTraceMethod (
+    ACPI_NAMESPACE_NODE     *MethodNode,
+    ACPI_OPERAND_OBJECT     *ObjDesc,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return;
+}
+
+void
+AcpiExStopTraceMethod (
+    ACPI_NAMESPACE_NODE     *MethodNode,
+    ACPI_OPERAND_OBJECT     *ObjDesc,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return;
+}
+
+void
+AcpiExStartTraceOpcode (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return;
+}
+
+void
+AcpiExStopTraceOpcode (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_WALK_STATE         *WalkState)
+
+{
+    return;
+}
+
+void
+AcpiExTracePoint (
+    ACPI_TRACE_EVENT_TYPE   Type,
+    BOOLEAN                 Begin,
+    UINT8                   *Aml,
+    char                    *Pathname)
+{
+    return;
+}
+
+ACPI_STATUS
+AcpiTbFindTable (
+    char                    *Signature,
+    char                    *OemId,
+    char                    *OemTableId,
+    UINT32                  *TableIndex)
+{
+    return (AE_SUPPORT);
+}
+
+ACPI_STATUS
+AcpiNsLoadTable (
+    UINT32                  TableIndex,
+    ACPI_NAMESPACE_NODE     *Node)
+{
+    return (AE_NOT_IMPLEMENTED);
+}
+
+ACPI_STATUS
+AcpiDsRestartControlMethod (
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_OPERAND_OBJECT     *ReturnDesc)
+{
+    return (AE_OK);
+}
+
+void
+AcpiDsTerminateControlMethod (
+    ACPI_OPERAND_OBJECT     *MethodDesc,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return;
+}
+
+ACPI_STATUS
+AcpiDsCallControlMethod (
+    ACPI_THREAD_STATE       *Thread,
+    ACPI_WALK_STATE         *WalkState,
+    ACPI_PARSE_OBJECT       *Op)
+{
+    return (AE_OK);
+}
+
+ACPI_STATUS
+AcpiDsMethodDataInitArgs (
+    ACPI_OPERAND_OBJECT     **Params,
+    UINT32                  MaxParamCount,
+    ACPI_WALK_STATE         *WalkState)
+{
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslsupport.l b/usr/src/cmd/acpi/iasl/aslsupport.l
new file mode 100644
index 0000000000..deb9e9a310
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslsupport.l
@@ -0,0 +1,852 @@
+/******************************************************************************
+ *
+ * Module Name: aslsupport.l - Flex/lex scanner C support routines.
+ *              NOTE: Included into aslcompile.l, not compiled by itself.
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+/* Configuration */
+
+#define ASL_SPACES_PER_TAB      4
+
+#define ASL_NORMAL_CHAR         0
+#define ASL_ESCAPE_SEQUENCE     1
+#define ASL_OCTAL_CONSTANT      2
+#define ASL_HEX_CONSTANT        3
+
+
+/* File node - used for "Include" operator file stack */
+
+typedef struct asl_file_node
+{
+    FILE                    *File;
+    UINT32                  CurrentLineNumber;
+    YY_BUFFER_STATE         State;
+    char                    *Filename;
+    struct asl_file_node    *Next;
+
+} ASL_FILE_NODE;
+
+/* File stack for the "Include" operator (NOT #include operator) */
+
+ASL_FILE_NODE               *Gbl_IncludeFileStack = NULL;
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslParserCleanup
+ *
+ * Used to delete the current buffer
+ *
+ ******************************************************************************/
+
+void
+AslParserCleanup (
+    void)
+{
+
+    yy_delete_buffer (YY_CURRENT_BUFFER);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoLineDirective
+ *
+ * PARAMETERS:  None. Uses input() to access current source code line
+ *
+ * RETURN:      Updates global line number and filename
+ *
+ * DESCRIPTION: Handle #line directives emitted by the preprocessor.
+ *
+ * The #line directive is emitted by the preprocesser, and is used to
+ * pass through line numbers from the original source code file to the
+ * preprocessor output file (.i). This allows any compiler-generated
+ * error messages to be displayed with the correct line number.
+ *
+ ******************************************************************************/
+
+static void
+AslDoLineDirective (
+    void)
+{
+    int                     c;
+    char                    *Token;
+    UINT32                  LineNumber;
+    char                    *Filename;
+    UINT32                  i;
+
+   Gbl_HasIncludeFiles = TRUE;
+
+    /* Eat the entire line that contains the #line directive */
+
+    Gbl_LineBufPtr = Gbl_CurrentLineBuffer;
+
+    while ((c = input()) != '\n' && c != EOF)
+    {
+        *Gbl_LineBufPtr = c;
+        Gbl_LineBufPtr++;
+    }
+    *Gbl_LineBufPtr = 0;
+
+    /* First argument is the actual line number */
+
+    Token = strtok (Gbl_CurrentLineBuffer, " ");
+    if (!Token)
+    {
+        goto ResetAndExit;
+    }
+
+    /* First argument is the line number */
+
+    LineNumber = (UINT32) UtDoConstant (Token);
+
+    /* Emit the appropriate number of newlines */
+
+    Gbl_CurrentColumn = 0;
+    if (LineNumber > Gbl_CurrentLineNumber)
+    {
+        for (i = 0; i < (LineNumber - Gbl_CurrentLineNumber); i++)
+        {
+            FlWriteFile (ASL_FILE_SOURCE_OUTPUT, "\n", 1);
+            Gbl_CurrentColumn++;
+        }
+    }
+
+    FlSetLineNumber (LineNumber);
+
+    /* Second argument is the optional filename (in double quotes) */
+
+    Token = strtok (NULL, " \"");
+    if (Token)
+    {
+        Filename = ACPI_ALLOCATE_ZEROED (strlen (Token) + 1);
+        strcpy (Filename, Token);
+        FlSetFilename (Filename);
+    }
+
+    /* Third argument is not supported at this time */
+
+ResetAndExit:
+
+    /* Reset globals for a new line */
+
+    Gbl_CurrentLineOffset += Gbl_CurrentColumn;
+    Gbl_CurrentColumn = 0;
+    Gbl_LineBufPtr = Gbl_CurrentLineBuffer;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslPopInputFileStack
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      0 if a node was popped, -1 otherwise
+ *
+ * DESCRIPTION: Pop the top of the input file stack and point the parser to
+ *              the saved parse buffer contained in the fnode. Also, set the
+ *              global line counters to the saved values. This function is
+ *              called when an include file reaches EOF.
+ *
+ ******************************************************************************/
+
+int
+AslPopInputFileStack (
+    void)
+{
+    ASL_FILE_NODE           *Fnode;
+
+
+    Gbl_PreviousIncludeFilename = Gbl_Files[ASL_FILE_INPUT].Filename;
+    Fnode = Gbl_IncludeFileStack;
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nPop InputFile Stack, Fnode %p\n", Fnode);
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "Include: Closing \"%s\"\n\n", Gbl_Files[ASL_FILE_INPUT].Filename);
+
+    if (!Fnode)
+    {
+        return (-1);
+    }
+
+    /* Close the current include file */
+
+    fclose (yyin);
+
+    /* Update the top-of-stack */
+
+    Gbl_IncludeFileStack = Fnode->Next;
+
+    /* Reset global line counter and filename */
+
+    Gbl_Files[ASL_FILE_INPUT].Filename = Fnode->Filename;
+    Gbl_CurrentLineNumber = Fnode->CurrentLineNumber;
+
+    /* Point the parser to the popped file */
+
+    yy_delete_buffer (YY_CURRENT_BUFFER);
+    yy_switch_to_buffer (Fnode->State);
+
+    /* All done with this node */
+
+    ACPI_FREE (Fnode);
+    return (0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslPushInputFileStack
+ *
+ * PARAMETERS:  InputFile           - Open file pointer
+ *              Filename            - Name of the file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Push the InputFile onto the file stack, and point the parser
+ *              to this file. Called when an include file is successfully
+ *              opened.
+ *
+ ******************************************************************************/
+
+void
+AslPushInputFileStack (
+    FILE                    *InputFile,
+    char                    *Filename)
+{
+    ASL_FILE_NODE           *Fnode;
+    YY_BUFFER_STATE         State;
+
+
+    /* Save the current state in an Fnode */
+
+    Fnode = UtLocalCalloc (sizeof (ASL_FILE_NODE));
+
+    Fnode->File = yyin;
+    Fnode->Next = Gbl_IncludeFileStack;
+    Fnode->State = YY_CURRENT_BUFFER;
+    Fnode->Filename = Gbl_Files[ASL_FILE_INPUT].Filename;
+    Fnode->CurrentLineNumber = Gbl_CurrentLineNumber;
+
+    /* Push it on the stack */
+
+    Gbl_IncludeFileStack = Fnode;
+
+    /* Point the parser to this file */
+
+    State = yy_create_buffer (InputFile, YY_BUF_SIZE);
+    yy_switch_to_buffer (State);
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nPush InputFile Stack, returning %p\n\n", InputFile);
+
+    /* Reset the global line count and filename */
+
+    Gbl_Files[ASL_FILE_INPUT].Filename =
+        UtStringCacheCalloc (strlen (Filename) + 1);
+
+    strcpy (Gbl_Files[ASL_FILE_INPUT].Filename, Filename);
+
+    Gbl_CurrentLineNumber = 1;
+    yyin = InputFile;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslResetCurrentLineBuffer
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Reset the Line Buffer to zero, increment global line numbers.
+ *
+ ******************************************************************************/
+
+void
+AslResetCurrentLineBuffer (
+    void)
+{
+
+    if (Gbl_Files[ASL_FILE_SOURCE_OUTPUT].Handle)
+    {
+        FlWriteFile (ASL_FILE_SOURCE_OUTPUT, Gbl_CurrentLineBuffer,
+            Gbl_LineBufPtr - Gbl_CurrentLineBuffer);
+    }
+
+    Gbl_CurrentLineOffset += Gbl_CurrentColumn;
+    Gbl_CurrentColumn = 0;
+
+    Gbl_CurrentLineNumber++;
+    Gbl_LogicalLineNumber++;
+    Gbl_LineBufPtr = Gbl_CurrentLineBuffer;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslInsertLineBuffer
+ *
+ * PARAMETERS:  SourceChar          - One char from the input ASL source file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Put one character of the source file into the temp line buffer
+ *
+ ******************************************************************************/
+
+void
+AslInsertLineBuffer (
+    int                     SourceChar)
+{
+    UINT32                  i;
+    UINT32                  Count = 1;
+
+
+    if (SourceChar == EOF)
+    {
+        return;
+    }
+
+    Gbl_InputByteCount++;
+
+    /* Handle tabs. Convert to spaces */
+
+    if (SourceChar == '\t')
+    {
+        SourceChar = ' ';
+        Count = ASL_SPACES_PER_TAB -
+                    (Gbl_CurrentColumn & (ASL_SPACES_PER_TAB-1));
+    }
+
+    for (i = 0; i < Count; i++)
+    {
+        Gbl_CurrentColumn++;
+
+        /* Insert the character into the line buffer */
+
+        *Gbl_LineBufPtr = (UINT8) SourceChar;
+        Gbl_LineBufPtr++;
+
+        if (Gbl_LineBufPtr >
+            (Gbl_CurrentLineBuffer + (Gbl_LineBufferSize - 1)))
+        {
+#if 0
+            /*
+             * Warning if we have split a long source line.
+             * <Probably overkill>
+             */
+            sprintf (MsgBuffer, "Max %u", Gbl_LineBufferSize);
+            AslCommonError (ASL_WARNING, ASL_MSG_LONG_LINE,
+                Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+                Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+                Gbl_Files[ASL_FILE_INPUT].Filename, MsgBuffer);
+#endif
+
+            AslResetCurrentLineBuffer ();
+        }
+        else if (SourceChar == '\n')
+        {
+            /* End of line */
+
+            AslResetCurrentLineBuffer ();
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    count
+ *
+ * PARAMETERS:  yytext              - Contains the matched keyword.
+ *              Type                - Keyword/Character type:
+ *                                      0 = anything except a keyword
+ *                                      1 = pseudo-keywords
+ *                                      2 = non-executable ASL keywords
+ *                                      3 = executable ASL keywords
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Count keywords and put them into the line buffer
+ *
+ ******************************************************************************/
+
+static void
+count (
+    int                 Type)
+{
+    int                 i;
+
+
+    switch (Type)
+    {
+    case 2:
+
+        TotalKeywords++;
+        TotalNamedObjects++;
+        break;
+
+    case 3:
+
+        TotalKeywords++;
+        TotalExecutableOpcodes++;
+        break;
+
+    default:
+
+        break;
+    }
+
+    for (i = 0; (yytext[i] != 0) && (yytext[i] != EOF); i++)
+    {
+        AslInsertLineBuffer (yytext[i]);
+        *Gbl_LineBufPtr = 0;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoComment
+ *
+ * PARAMETERS:  none
+ *
+ * RETURN:      none
+ *
+ * DESCRIPTION: Process a standard comment.
+ *
+ ******************************************************************************/
+
+static char
+AslDoComment (
+    void)
+{
+    int                 c;
+    int                 c1 = 0;
+
+
+    AslInsertLineBuffer ('/');
+    AslInsertLineBuffer ('*');
+
+loop:
+
+    /* Eat chars until end-of-comment */
+
+    while (((c = input ()) != '*') && (c != EOF))
+    {
+        AslInsertLineBuffer (c);
+        c1 = c;
+    }
+
+    if (c == EOF)
+    {
+        goto EarlyEOF;
+    }
+
+    /*
+     * Check for nested comment -- can help catch cases where a previous
+     * comment was accidently left unterminated
+     */
+    if ((c1 == '/') && (c == '*'))
+    {
+        AslCommonError (ASL_WARNING, ASL_MSG_NESTED_COMMENT,
+            Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+            Gbl_InputByteCount, Gbl_CurrentColumn,
+            Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+    }
+
+    /* Comment is closed only if the NEXT character is a slash */
+
+    AslInsertLineBuffer (c);
+
+    if (((c1 = input ()) != '/') && (c1 != EOF))
+    {
+        unput(c1);
+        goto loop;
+    }
+
+    if (c1 == EOF)
+    {
+        goto EarlyEOF;
+    }
+
+    AslInsertLineBuffer (c1);
+    return (TRUE);
+
+
+EarlyEOF:
+    /*
+     * Premature End-Of-File
+     */
+    AslCommonError (ASL_ERROR, ASL_MSG_EARLY_EOF,
+        Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+        Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+        Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+    return (FALSE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoCommentType2
+ *
+ * PARAMETERS:  none
+ *
+ * RETURN:      none
+ *
+ * DESCRIPTION: Process a new "//" comment.
+ *
+ ******************************************************************************/
+
+static char
+AslDoCommentType2 (
+    void)
+{
+    int                 c;
+
+
+    AslInsertLineBuffer ('/');
+    AslInsertLineBuffer ('/');
+
+    while (((c = input ()) != '\n') && (c != EOF))
+    {
+        AslInsertLineBuffer (c);
+    }
+
+    if (c == EOF)
+    {
+        /* End of file is OK, change to newline. Let parser detect EOF later */
+
+        c = '\n';
+    }
+
+    AslInsertLineBuffer (c);
+    return (TRUE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslDoStringLiteral
+ *
+ * PARAMETERS:  none
+ *
+ * RETURN:      none
+ *
+ * DESCRIPTION: Process a string literal (surrounded by quotes)
+ *
+ ******************************************************************************/
+
+static char
+AslDoStringLiteral (
+    void)
+{
+    char                *StringBuffer = MsgBuffer;
+    char                *EndBuffer = MsgBuffer + ASL_MSG_BUFFER_SIZE;
+    char                *CleanString;
+    int                 StringChar;
+    UINT32              State = ASL_NORMAL_CHAR;
+    UINT32              i = 0;
+    UINT8               Digit;
+    char                ConvertBuffer[4];
+
+
+    /*
+     * Eat chars until end-of-literal.
+     * NOTE:  Put back the original surrounding quotes into the
+     * source line buffer.
+     */
+    AslInsertLineBuffer ('\"');
+    while ((StringChar = input()) != EOF)
+    {
+        AslInsertLineBuffer (StringChar);
+
+DoCharacter:
+        switch (State)
+        {
+        case ASL_NORMAL_CHAR:
+
+            switch (StringChar)
+            {
+            case '\\':
+                /*
+                 * Special handling for backslash-escape sequence. We will
+                 * toss the backslash and translate the escape char(s).
+                 */
+                State = ASL_ESCAPE_SEQUENCE;
+                continue;
+
+            case '\"':
+
+                /* String terminator */
+
+                goto CompletedString;
+
+            default:
+
+                break;
+            }
+            break;
+
+
+        case ASL_ESCAPE_SEQUENCE:
+
+            State = ASL_NORMAL_CHAR;
+            switch (StringChar)
+            {
+            case 'a':
+
+                StringChar = 0x07;      /* BELL */
+                break;
+
+            case 'b':
+
+                StringChar = 0x08;      /* BACKSPACE */
+                break;
+
+            case 'f':
+
+                StringChar = 0x0C;      /* FORMFEED */
+                break;
+
+            case 'n':
+
+                StringChar = 0x0A;      /* LINEFEED */
+                break;
+
+            case 'r':
+
+                StringChar = 0x0D;      /* CARRIAGE RETURN*/
+                break;
+
+            case 't':
+
+                StringChar = 0x09;      /* HORIZONTAL TAB */
+                break;
+
+            case 'v':
+
+                StringChar = 0x0B;      /* VERTICAL TAB */
+                break;
+
+            case 'x':
+
+                State = ASL_HEX_CONSTANT;
+                i = 0;
+                continue;
+
+            case '\'':                  /* Single Quote */
+            case '\"':                  /* Double Quote */
+            case '\\':                  /* Backslash */
+
+                break;
+
+            default:
+
+                /* Check for an octal digit (0-7) */
+
+                if (ACPI_IS_OCTAL_DIGIT (StringChar))
+                {
+                    State = ASL_OCTAL_CONSTANT;
+                    ConvertBuffer[0] = StringChar;
+                    i = 1;
+                    continue;
+                }
+
+                /* Unknown escape sequence issue warning, but use the character */
+
+                AslCommonError (ASL_WARNING, ASL_MSG_INVALID_ESCAPE,
+                    Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+                    Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+                    Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+                break;
+            }
+            break;
+
+
+        case ASL_OCTAL_CONSTANT:
+
+            /* Up to three octal digits allowed */
+
+            if (!ACPI_IS_OCTAL_DIGIT (StringChar) ||
+                (i > 2))
+            {
+                /*
+                 * Reached end of the constant. Convert the assembled ASCII
+                 * string and resume processing of the next character
+                 */
+                ConvertBuffer[i] = 0;
+                Digit = (UINT8) strtoul (ConvertBuffer, NULL, 8);
+
+                /* Check for NULL or non-ascii character (ignore if so) */
+
+                if ((Digit == 0) || (Digit > ACPI_ASCII_MAX))
+                {
+                    AslCommonError (ASL_WARNING, ASL_MSG_INVALID_STRING,
+                        Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+                        Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+                        Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+                }
+                else
+                {
+                    *StringBuffer = (char) Digit;
+                    StringBuffer++;
+                    if (StringBuffer >= EndBuffer)
+                    {
+                        goto BufferOverflow;
+                    }
+                }
+
+                State = ASL_NORMAL_CHAR;
+                goto DoCharacter;
+                break;
+            }
+
+            /* Append another digit of the constant */
+
+            ConvertBuffer[i] = StringChar;
+            i++;
+            continue;
+
+        case ASL_HEX_CONSTANT:
+
+            /* Up to two hex digits allowed */
+
+            if (!isxdigit (StringChar) ||
+                (i > 1))
+            {
+                /*
+                 * Reached end of the constant. Convert the assembled ASCII
+                 * string and resume processing of the next character
+                 */
+                ConvertBuffer[i] = 0;
+                Digit = (UINT8) strtoul (ConvertBuffer, NULL, 16);
+
+                /* Check for NULL or non-ascii character (ignore if so) */
+
+                if ((Digit == 0) || (Digit > ACPI_ASCII_MAX))
+                {
+                    AslCommonError (ASL_WARNING, ASL_MSG_INVALID_STRING,
+                        Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+                        Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+                        Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+                }
+                else
+                {
+                    *StringBuffer = (char) Digit;
+                    StringBuffer++;
+                    if (StringBuffer >= EndBuffer)
+                    {
+                        goto BufferOverflow;
+                    }
+                }
+
+                State = ASL_NORMAL_CHAR;
+                goto DoCharacter;
+                break;
+            }
+
+            /* Append another digit of the constant */
+
+            ConvertBuffer[i] = StringChar;
+            i++;
+            continue;
+
+        default:
+
+            break;
+        }
+
+        /* Save the finished character */
+
+        *StringBuffer = StringChar;
+        StringBuffer++;
+        if (StringBuffer >= EndBuffer)
+        {
+            goto BufferOverflow;
+        }
+    }
+
+    /*
+     * Premature End-Of-File
+     */
+    AslCommonError (ASL_ERROR, ASL_MSG_EARLY_EOF,
+        Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+        Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+        Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+    return (FALSE);
+
+
+CompletedString:
+    /*
+     * Null terminate the input string and copy string to a new buffer
+     */
+    *StringBuffer = 0;
+
+    CleanString = UtStringCacheCalloc (strlen (MsgBuffer) + 1);
+    if (!CleanString)
+    {
+        AslCommonError (ASL_ERROR, ASL_MSG_MEMORY_ALLOCATION,
+            Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+            Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+            Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+        return (FALSE);
+    }
+
+    strcpy (CleanString, MsgBuffer);
+    AslCompilerlval.s = CleanString;
+    return (TRUE);
+
+
+BufferOverflow:
+
+    /* Literal was too long */
+
+    AslCommonError (ASL_ERROR, ASL_MSG_STRING_LENGTH,
+        Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+        Gbl_CurrentLineOffset, Gbl_CurrentColumn,
+        Gbl_Files[ASL_FILE_INPUT].Filename, "Max length 4096");
+    return (FALSE);
+}
diff --git a/usr/src/cmd/acpi/iasl/aslsupport.y b/usr/src/cmd/acpi/iasl/aslsupport.y
new file mode 100644
index 0000000000..cd2605b836
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslsupport.y
@@ -0,0 +1,120 @@
+NoEcho('
+/******************************************************************************
+ *
+ * Module Name: aslsupport.y - Bison/Yacc C support functions
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+')
+
+/******************************************************************************
+ *
+ * Local support functions
+ *
+ *****************************************************************************/
+
+/*! [Begin] no source code translation */
+int
+AslCompilerwrap(void)
+{
+  return (1);
+}
+/*! [End] no source code translation !*/
+
+
+void *
+AslLocalAllocate (
+    unsigned int        Size)
+{
+    void                *Mem;
+
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nAslLocalAllocate: Expanding Stack to %u\n\n", Size);
+
+    Mem = ACPI_ALLOCATE_ZEROED (Size);
+    if (!Mem)
+    {
+        AslCommonError (ASL_ERROR, ASL_MSG_MEMORY_ALLOCATION,
+            Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+            Gbl_InputByteCount, Gbl_CurrentColumn,
+            Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+        exit (1);
+    }
+
+    return (Mem);
+}
+
+ACPI_PARSE_OBJECT *
+AslDoError (
+    void)
+{
+
+    return (TrCreateLeafNode (PARSEOP_ERRORNODE));
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtGetOpName
+ *
+ * PARAMETERS:  ParseOpcode         - Parser keyword ID
+ *
+ * RETURN:      Pointer to the opcode name
+ *
+ * DESCRIPTION: Get the ascii name of the parse opcode
+ *
+ ******************************************************************************/
+
+char *
+UtGetOpName (
+    UINT32                  ParseOpcode)
+{
+#ifdef ASL_YYTNAME_START
+    /*
+     * First entries (ASL_YYTNAME_START) in yytname are special reserved names.
+     * Ignore first 8 characters of the name
+     */
+    return ((char *) yytname
+        [(ParseOpcode - ASL_FIRST_PARSE_OPCODE) + ASL_YYTNAME_START] + 8);
+#else
+    return ("[Unknown parser generator]");
+#endif
+}
diff --git a/usr/src/cmd/acpi/iasl/asltokens.y b/usr/src/cmd/acpi/iasl/asltokens.y
new file mode 100644
index 0000000000..429fa424cb
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asltokens.y
@@ -0,0 +1,483 @@
+NoEcho('
+/******************************************************************************
+ *
+ * Module Name: asltokens.y - Bison/Yacc token types
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+')
+
+/******************************************************************************
+ *
+ * Token types: These are returned by the lexer
+ *
+ * NOTE: This list MUST match the AslKeywordMapping table found
+ *       in aslmap.c EXACTLY!  Double check any changes!
+ *
+ *****************************************************************************/
+
+%token <i> PARSEOP_ACCESSAS
+%token <i> PARSEOP_ACCESSATTRIB_BLOCK
+%token <i> PARSEOP_ACCESSATTRIB_BLOCK_CALL
+%token <i> PARSEOP_ACCESSATTRIB_BYTE
+%token <i> PARSEOP_ACCESSATTRIB_MULTIBYTE
+%token <i> PARSEOP_ACCESSATTRIB_QUICK
+%token <i> PARSEOP_ACCESSATTRIB_RAW_BYTES
+%token <i> PARSEOP_ACCESSATTRIB_RAW_PROCESS
+%token <i> PARSEOP_ACCESSATTRIB_SND_RCV
+%token <i> PARSEOP_ACCESSATTRIB_WORD
+%token <i> PARSEOP_ACCESSATTRIB_WORD_CALL
+%token <i> PARSEOP_ACCESSTYPE_ANY
+%token <i> PARSEOP_ACCESSTYPE_BUF
+%token <i> PARSEOP_ACCESSTYPE_BYTE
+%token <i> PARSEOP_ACCESSTYPE_DWORD
+%token <i> PARSEOP_ACCESSTYPE_QWORD
+%token <i> PARSEOP_ACCESSTYPE_WORD
+%token <i> PARSEOP_ACQUIRE
+%token <i> PARSEOP_ADD
+%token <i> PARSEOP_ADDRESSINGMODE_7BIT
+%token <i> PARSEOP_ADDRESSINGMODE_10BIT
+%token <i> PARSEOP_ADDRESSTYPE_ACPI
+%token <i> PARSEOP_ADDRESSTYPE_MEMORY
+%token <i> PARSEOP_ADDRESSTYPE_NVS
+%token <i> PARSEOP_ADDRESSTYPE_RESERVED
+%token <i> PARSEOP_ALIAS
+%token <i> PARSEOP_AND
+%token <i> PARSEOP_ARG0
+%token <i> PARSEOP_ARG1
+%token <i> PARSEOP_ARG2
+%token <i> PARSEOP_ARG3
+%token <i> PARSEOP_ARG4
+%token <i> PARSEOP_ARG5
+%token <i> PARSEOP_ARG6
+%token <i> PARSEOP_BANKFIELD
+%token <i> PARSEOP_BITSPERBYTE_EIGHT
+%token <i> PARSEOP_BITSPERBYTE_FIVE
+%token <i> PARSEOP_BITSPERBYTE_NINE
+%token <i> PARSEOP_BITSPERBYTE_SEVEN
+%token <i> PARSEOP_BITSPERBYTE_SIX
+%token <i> PARSEOP_BREAK
+%token <i> PARSEOP_BREAKPOINT
+%token <i> PARSEOP_BUFFER
+%token <i> PARSEOP_BUSMASTERTYPE_MASTER
+%token <i> PARSEOP_BUSMASTERTYPE_NOTMASTER
+%token <i> PARSEOP_BYTECONST
+%token <i> PARSEOP_CASE
+%token <i> PARSEOP_CLOCKPHASE_FIRST
+%token <i> PARSEOP_CLOCKPHASE_SECOND
+%token <i> PARSEOP_CLOCKPOLARITY_HIGH
+%token <i> PARSEOP_CLOCKPOLARITY_LOW
+%token <i> PARSEOP_CONCATENATE
+%token <i> PARSEOP_CONCATENATERESTEMPLATE
+%token <i> PARSEOP_CONDREFOF
+%token <i> PARSEOP_CONNECTION
+%token <i> PARSEOP_CONTINUE
+%token <i> PARSEOP_COPYOBJECT
+%token <i> PARSEOP_CREATEBITFIELD
+%token <i> PARSEOP_CREATEBYTEFIELD
+%token <i> PARSEOP_CREATEDWORDFIELD
+%token <i> PARSEOP_CREATEFIELD
+%token <i> PARSEOP_CREATEQWORDFIELD
+%token <i> PARSEOP_CREATEWORDFIELD
+%token <i> PARSEOP_DATABUFFER
+%token <i> PARSEOP_DATATABLEREGION
+%token <i> PARSEOP_DEBUG
+%token <i> PARSEOP_DECODETYPE_POS
+%token <i> PARSEOP_DECODETYPE_SUB
+%token <i> PARSEOP_DECREMENT
+%token <i> PARSEOP_DEFAULT
+%token <i> PARSEOP_DEFAULT_ARG
+%token <i> PARSEOP_DEFINITION_BLOCK
+%token <i> PARSEOP_DEREFOF
+%token <i> PARSEOP_DEVICE
+%token <i> PARSEOP_DEVICEPOLARITY_HIGH
+%token <i> PARSEOP_DEVICEPOLARITY_LOW
+%token <i> PARSEOP_DIVIDE
+%token <i> PARSEOP_DMA
+%token <i> PARSEOP_DMATYPE_A
+%token <i> PARSEOP_DMATYPE_COMPATIBILITY
+%token <i> PARSEOP_DMATYPE_B
+%token <i> PARSEOP_DMATYPE_F
+%token <i> PARSEOP_DWORDCONST
+%token <i> PARSEOP_DWORDIO
+%token <i> PARSEOP_DWORDMEMORY
+%token <i> PARSEOP_DWORDSPACE
+%token <i> PARSEOP_EISAID
+%token <i> PARSEOP_ELSE
+%token <i> PARSEOP_ELSEIF
+%token <i> PARSEOP_ENDDEPENDENTFN
+%token <i> PARSEOP_ENDIAN_BIG
+%token <i> PARSEOP_ENDIAN_LITTLE
+%token <i> PARSEOP_ENDTAG
+%token <i> PARSEOP_ERRORNODE
+%token <i> PARSEOP_EVENT
+%token <i> PARSEOP_EXTENDEDIO
+%token <i> PARSEOP_EXTENDEDMEMORY
+%token <i> PARSEOP_EXTENDEDSPACE
+%token <i> PARSEOP_EXTERNAL
+%token <i> PARSEOP_FATAL
+%token <i> PARSEOP_FIELD
+%token <i> PARSEOP_FINDSETLEFTBIT
+%token <i> PARSEOP_FINDSETRIGHTBIT
+%token <i> PARSEOP_FIXEDDMA
+%token <i> PARSEOP_FIXEDIO
+%token <i> PARSEOP_FLOWCONTROL_HW
+%token <i> PARSEOP_FLOWCONTROL_NONE
+%token <i> PARSEOP_FLOWCONTROL_SW
+%token <i> PARSEOP_FROMBCD
+%token <i> PARSEOP_FUNCTION
+%token <i> PARSEOP_GPIO_INT
+%token <i> PARSEOP_GPIO_IO
+%token <i> PARSEOP_I2C_SERIALBUS
+%token <i> PARSEOP_I2C_SERIALBUS_V2
+%token <i> PARSEOP_IF
+%token <i> PARSEOP_INCLUDE
+%token <i> PARSEOP_INCLUDE_END
+%token <i> PARSEOP_INCREMENT
+%token <i> PARSEOP_INDEX
+%token <i> PARSEOP_INDEXFIELD
+%token <i> PARSEOP_INTEGER
+%token <i> PARSEOP_INTERRUPT
+%token <i> PARSEOP_INTLEVEL_ACTIVEBOTH
+%token <i> PARSEOP_INTLEVEL_ACTIVEHIGH
+%token <i> PARSEOP_INTLEVEL_ACTIVELOW
+%token <i> PARSEOP_INTTYPE_EDGE
+%token <i> PARSEOP_INTTYPE_LEVEL
+%token <i> PARSEOP_IO
+%token <i> PARSEOP_IODECODETYPE_10
+%token <i> PARSEOP_IODECODETYPE_16
+%token <i> PARSEOP_IORESTRICT_IN
+%token <i> PARSEOP_IORESTRICT_NONE
+%token <i> PARSEOP_IORESTRICT_OUT
+%token <i> PARSEOP_IORESTRICT_PRESERVE
+%token <i> PARSEOP_IRQ
+%token <i> PARSEOP_IRQNOFLAGS
+%token <i> PARSEOP_LAND
+%token <i> PARSEOP_LEQUAL
+%token <i> PARSEOP_LGREATER
+%token <i> PARSEOP_LGREATEREQUAL
+%token <i> PARSEOP_LLESS
+%token <i> PARSEOP_LLESSEQUAL
+%token <i> PARSEOP_LNOT
+%token <i> PARSEOP_LNOTEQUAL
+%token <i> PARSEOP_LOAD
+%token <i> PARSEOP_LOADTABLE
+%token <i> PARSEOP_LOCAL0
+%token <i> PARSEOP_LOCAL1
+%token <i> PARSEOP_LOCAL2
+%token <i> PARSEOP_LOCAL3
+%token <i> PARSEOP_LOCAL4
+%token <i> PARSEOP_LOCAL5
+%token <i> PARSEOP_LOCAL6
+%token <i> PARSEOP_LOCAL7
+%token <i> PARSEOP_LOCKRULE_LOCK
+%token <i> PARSEOP_LOCKRULE_NOLOCK
+%token <i> PARSEOP_LOR
+%token <i> PARSEOP_MATCH
+%token <i> PARSEOP_MATCHTYPE_MEQ
+%token <i> PARSEOP_MATCHTYPE_MGE
+%token <i> PARSEOP_MATCHTYPE_MGT
+%token <i> PARSEOP_MATCHTYPE_MLE
+%token <i> PARSEOP_MATCHTYPE_MLT
+%token <i> PARSEOP_MATCHTYPE_MTR
+%token <i> PARSEOP_MAXTYPE_FIXED
+%token <i> PARSEOP_MAXTYPE_NOTFIXED
+%token <i> PARSEOP_MEMORY24
+%token <i> PARSEOP_MEMORY32
+%token <i> PARSEOP_MEMORY32FIXED
+%token <i> PARSEOP_MEMTYPE_CACHEABLE
+%token <i> PARSEOP_MEMTYPE_NONCACHEABLE
+%token <i> PARSEOP_MEMTYPE_PREFETCHABLE
+%token <i> PARSEOP_MEMTYPE_WRITECOMBINING
+%token <i> PARSEOP_METHOD
+%token <i> PARSEOP_METHODCALL
+%token <i> PARSEOP_MID
+%token <i> PARSEOP_MINTYPE_FIXED
+%token <i> PARSEOP_MINTYPE_NOTFIXED
+%token <i> PARSEOP_MOD
+%token <i> PARSEOP_MULTIPLY
+%token <i> PARSEOP_MUTEX
+%token <i> PARSEOP_NAME
+%token <s> PARSEOP_NAMESEG
+%token <s> PARSEOP_NAMESTRING
+%token <i> PARSEOP_NAND
+%token <i> PARSEOP_NOOP
+%token <i> PARSEOP_NOR
+%token <i> PARSEOP_NOT
+%token <i> PARSEOP_NOTIFY
+%token <i> PARSEOP_OBJECTTYPE
+%token <i> PARSEOP_OBJECTTYPE_BFF
+%token <i> PARSEOP_OBJECTTYPE_BUF
+%token <i> PARSEOP_OBJECTTYPE_DDB
+%token <i> PARSEOP_OBJECTTYPE_DEV
+%token <i> PARSEOP_OBJECTTYPE_EVT
+%token <i> PARSEOP_OBJECTTYPE_FLD
+%token <i> PARSEOP_OBJECTTYPE_INT
+%token <i> PARSEOP_OBJECTTYPE_MTH
+%token <i> PARSEOP_OBJECTTYPE_MTX
+%token <i> PARSEOP_OBJECTTYPE_OPR
+%token <i> PARSEOP_OBJECTTYPE_PKG
+%token <i> PARSEOP_OBJECTTYPE_POW
+%token <i> PARSEOP_OBJECTTYPE_PRO
+%token <i> PARSEOP_OBJECTTYPE_STR
+%token <i> PARSEOP_OBJECTTYPE_THZ
+%token <i> PARSEOP_OBJECTTYPE_UNK
+%token <i> PARSEOP_OFFSET
+%token <i> PARSEOP_ONE
+%token <i> PARSEOP_ONES
+%token <i> PARSEOP_OPERATIONREGION
+%token <i> PARSEOP_OR
+%token <i> PARSEOP_PACKAGE
+%token <i> PARSEOP_PACKAGE_LENGTH
+%token <i> PARSEOP_PARITYTYPE_EVEN
+%token <i> PARSEOP_PARITYTYPE_MARK
+%token <i> PARSEOP_PARITYTYPE_NONE
+%token <i> PARSEOP_PARITYTYPE_ODD
+%token <i> PARSEOP_PARITYTYPE_SPACE
+%token <i> PARSEOP_PIN_NOPULL
+%token <i> PARSEOP_PIN_PULLDEFAULT
+%token <i> PARSEOP_PIN_PULLDOWN
+%token <i> PARSEOP_PIN_PULLUP
+%token <i> PARSEOP_POWERRESOURCE
+%token <i> PARSEOP_PROCESSOR
+%token <i> PARSEOP_QWORDCONST
+%token <i> PARSEOP_QWORDIO
+%token <i> PARSEOP_QWORDMEMORY
+%token <i> PARSEOP_QWORDSPACE
+%token <i> PARSEOP_RANGETYPE_ENTIRE
+%token <i> PARSEOP_RANGETYPE_ISAONLY
+%token <i> PARSEOP_RANGETYPE_NONISAONLY
+%token <i> PARSEOP_RAW_DATA
+%token <i> PARSEOP_READWRITETYPE_BOTH
+%token <i> PARSEOP_READWRITETYPE_READONLY
+%token <i> PARSEOP_REFOF
+%token <i> PARSEOP_REGIONSPACE_CMOS
+%token <i> PARSEOP_REGIONSPACE_EC
+%token <i> PARSEOP_REGIONSPACE_FFIXEDHW
+%token <i> PARSEOP_REGIONSPACE_GPIO
+%token <i> PARSEOP_REGIONSPACE_GSBUS
+%token <i> PARSEOP_REGIONSPACE_IO
+%token <i> PARSEOP_REGIONSPACE_IPMI
+%token <i> PARSEOP_REGIONSPACE_MEM
+%token <i> PARSEOP_REGIONSPACE_PCC
+%token <i> PARSEOP_REGIONSPACE_PCI
+%token <i> PARSEOP_REGIONSPACE_PCIBAR
+%token <i> PARSEOP_REGIONSPACE_SMBUS
+%token <i> PARSEOP_REGISTER
+%token <i> PARSEOP_RELEASE
+%token <i> PARSEOP_RESERVED_BYTES
+%token <i> PARSEOP_RESET
+%token <i> PARSEOP_RESOURCETEMPLATE
+%token <i> PARSEOP_RESOURCETYPE_CONSUMER
+%token <i> PARSEOP_RESOURCETYPE_PRODUCER
+%token <i> PARSEOP_RETURN
+%token <i> PARSEOP_REVISION
+%token <i> PARSEOP_SCOPE
+%token <i> PARSEOP_SERIALIZERULE_NOTSERIAL
+%token <i> PARSEOP_SERIALIZERULE_SERIAL
+%token <i> PARSEOP_SHARETYPE_EXCLUSIVE
+%token <i> PARSEOP_SHARETYPE_EXCLUSIVEWAKE
+%token <i> PARSEOP_SHARETYPE_SHARED
+%token <i> PARSEOP_SHARETYPE_SHAREDWAKE
+%token <i> PARSEOP_SHIFTLEFT
+%token <i> PARSEOP_SHIFTRIGHT
+%token <i> PARSEOP_SIGNAL
+%token <i> PARSEOP_SIZEOF
+%token <i> PARSEOP_SLAVEMODE_CONTROLLERINIT
+%token <i> PARSEOP_SLAVEMODE_DEVICEINIT
+%token <i> PARSEOP_SLEEP
+%token <i> PARSEOP_SPI_SERIALBUS
+%token <i> PARSEOP_SPI_SERIALBUS_V2
+%token <i> PARSEOP_STALL
+%token <i> PARSEOP_STARTDEPENDENTFN
+%token <i> PARSEOP_STARTDEPENDENTFN_NOPRI
+%token <i> PARSEOP_STOPBITS_ONE
+%token <i> PARSEOP_STOPBITS_ONEPLUSHALF
+%token <i> PARSEOP_STOPBITS_TWO
+%token <i> PARSEOP_STOPBITS_ZERO
+%token <i> PARSEOP_STORE
+%token <s> PARSEOP_STRING_LITERAL
+%token <i> PARSEOP_SUBTRACT
+%token <i> PARSEOP_SWITCH
+%token <i> PARSEOP_THERMALZONE
+%token <i> PARSEOP_TIMER
+%token <i> PARSEOP_TOBCD
+%token <i> PARSEOP_TOBUFFER
+%token <i> PARSEOP_TODECIMALSTRING
+%token <i> PARSEOP_TOHEXSTRING
+%token <i> PARSEOP_TOINTEGER
+%token <i> PARSEOP_TOSTRING
+%token <i> PARSEOP_TOUUID
+%token <i> PARSEOP_TRANSLATIONTYPE_DENSE
+%token <i> PARSEOP_TRANSLATIONTYPE_SPARSE
+%token <i> PARSEOP_TYPE_STATIC
+%token <i> PARSEOP_TYPE_TRANSLATION
+%token <i> PARSEOP_UART_SERIALBUS
+%token <i> PARSEOP_UART_SERIALBUS_V2
+%token <i> PARSEOP_UNICODE
+%token <i> PARSEOP_UNLOAD
+%token <i> PARSEOP_UPDATERULE_ONES
+%token <i> PARSEOP_UPDATERULE_PRESERVE
+%token <i> PARSEOP_UPDATERULE_ZEROS
+%token <i> PARSEOP_VAR_PACKAGE
+%token <i> PARSEOP_VENDORLONG
+%token <i> PARSEOP_VENDORSHORT
+%token <i> PARSEOP_WAIT
+%token <i> PARSEOP_WHILE
+%token <i> PARSEOP_WIREMODE_FOUR
+%token <i> PARSEOP_WIREMODE_THREE
+%token <i> PARSEOP_WORDBUSNUMBER
+%token <i> PARSEOP_WORDCONST
+%token <i> PARSEOP_WORDIO
+%token <i> PARSEOP_WORDSPACE
+%token <i> PARSEOP_XFERSIZE_8
+%token <i> PARSEOP_XFERSIZE_16
+%token <i> PARSEOP_XFERSIZE_32
+%token <i> PARSEOP_XFERSIZE_64
+%token <i> PARSEOP_XFERSIZE_128
+%token <i> PARSEOP_XFERSIZE_256
+%token <i> PARSEOP_XFERTYPE_8
+%token <i> PARSEOP_XFERTYPE_8_16
+%token <i> PARSEOP_XFERTYPE_16
+%token <i> PARSEOP_XOR
+%token <i> PARSEOP_ZERO
+
+/* ToPld macro */
+
+%token <i> PARSEOP_TOPLD
+%token <i> PARSEOP_PLD_REVISION
+%token <i> PARSEOP_PLD_IGNORECOLOR
+%token <i> PARSEOP_PLD_RED
+%token <i> PARSEOP_PLD_GREEN
+%token <i> PARSEOP_PLD_BLUE
+%token <i> PARSEOP_PLD_WIDTH
+%token <i> PARSEOP_PLD_HEIGHT
+%token <i> PARSEOP_PLD_USERVISIBLE
+%token <i> PARSEOP_PLD_DOCK
+%token <i> PARSEOP_PLD_LID
+%token <i> PARSEOP_PLD_PANEL
+%token <i> PARSEOP_PLD_VERTICALPOSITION
+%token <i> PARSEOP_PLD_HORIZONTALPOSITION
+%token <i> PARSEOP_PLD_SHAPE
+%token <i> PARSEOP_PLD_GROUPORIENTATION
+%token <i> PARSEOP_PLD_GROUPTOKEN
+%token <i> PARSEOP_PLD_GROUPPOSITION
+%token <i> PARSEOP_PLD_BAY
+%token <i> PARSEOP_PLD_EJECTABLE
+%token <i> PARSEOP_PLD_EJECTREQUIRED
+%token <i> PARSEOP_PLD_CABINETNUMBER
+%token <i> PARSEOP_PLD_CARDCAGENUMBER
+%token <i> PARSEOP_PLD_REFERENCE
+%token <i> PARSEOP_PLD_ROTATION
+%token <i> PARSEOP_PLD_ORDER
+%token <i> PARSEOP_PLD_RESERVED
+%token <i> PARSEOP_PLD_VERTICALOFFSET
+%token <i> PARSEOP_PLD_HORIZONTALOFFSET
+
+/*
+ * C-style expression parser. These must appear after all of the
+ * standard ASL operators and keywords.
+ *
+ * Note: The order of these tokens implements the precedence rules
+ * (low precedence to high). See aslrules.y for an exhaustive list.
+ */
+%right <i> PARSEOP_EXP_EQUALS
+           PARSEOP_EXP_ADD_EQ
+           PARSEOP_EXP_SUB_EQ
+           PARSEOP_EXP_MUL_EQ
+           PARSEOP_EXP_DIV_EQ
+           PARSEOP_EXP_MOD_EQ
+           PARSEOP_EXP_SHL_EQ
+           PARSEOP_EXP_SHR_EQ
+           PARSEOP_EXP_AND_EQ
+           PARSEOP_EXP_XOR_EQ
+           PARSEOP_EXP_OR_EQ
+
+%left <i>  PARSEOP_EXP_LOGICAL_OR
+%left <i>  PARSEOP_EXP_LOGICAL_AND
+%left <i>  PARSEOP_EXP_OR
+%left <i>  PARSEOP_EXP_XOR
+%left <i>  PARSEOP_EXP_AND
+%left <i>  PARSEOP_EXP_EQUAL
+           PARSEOP_EXP_NOT_EQUAL
+%left <i>  PARSEOP_EXP_GREATER
+           PARSEOP_EXP_LESS
+           PARSEOP_EXP_GREATER_EQUAL
+           PARSEOP_EXP_LESS_EQUAL
+%left <i>  PARSEOP_EXP_SHIFT_RIGHT
+           PARSEOP_EXP_SHIFT_LEFT
+%left <i>  PARSEOP_EXP_ADD
+           PARSEOP_EXP_SUBTRACT
+%left <i>  PARSEOP_EXP_MULTIPLY
+           PARSEOP_EXP_DIVIDE
+           PARSEOP_EXP_MODULO
+
+%right <i> PARSEOP_EXP_NOT
+           PARSEOP_EXP_LOGICAL_NOT
+
+%left <i>  PARSEOP_EXP_INCREMENT
+           PARSEOP_EXP_DECREMENT
+
+/* Brackets for Index() support */
+
+%left <i>  PARSEOP_EXP_INDEX_LEFT
+%right <i> PARSEOP_EXP_INDEX_RIGHT
+
+/* Macros */
+
+%token <i> PARSEOP_PRINTF
+%token <i> PARSEOP_FPRINTF
+%token <i> PARSEOP_FOR
+
+/* Specific parentheses tokens are not used at this time */
+           /* PARSEOP_EXP_PAREN_OPEN */
+           /* PARSEOP_EXP_PAREN_CLOSE */
+
+
+%token <i> PARSEOP_ASL_CODE
+
+/*
+ * Special functions. These should probably stay at the end of this
+ * table.
+ */
+%token <i> PARSEOP___DATE__
+%token <i> PARSEOP___FILE__
+%token <i> PARSEOP___LINE__
+%token <i> PARSEOP___PATH__
diff --git a/usr/src/cmd/acpi/iasl/asltransform.c b/usr/src/cmd/acpi/iasl/asltransform.c
new file mode 100644
index 0000000000..e504220839
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asltransform.c
@@ -0,0 +1,822 @@
+/******************************************************************************
+ *
+ * Module Name: asltransform - Parse tree transforms
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asltransform")
+
+/* Local prototypes */
+
+static void
+TrTransformSubtree (
+    ACPI_PARSE_OBJECT       *Op);
+
+static char *
+TrAmlGetNextTempName (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT8                   *TempCount);
+
+static void
+TrAmlInitLineNumbers (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *Neighbor);
+
+static void
+TrAmlInitNode (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT16                  ParseOpcode);
+
+static void
+TrAmlSetSubtreeParent (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *Parent);
+
+static void
+TrAmlInsertPeer (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *NewPeer);
+
+static void
+TrDoDefinitionBlock (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+TrDoSwitch (
+    ACPI_PARSE_OBJECT       *StartNode);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAmlGetNextTempName
+ *
+ * PARAMETERS:  Op              - Current parse op
+ *              TempCount       - Current temporary counter. Was originally
+ *                                per-module; Currently per method, could be
+ *                                expanded to per-scope.
+ *
+ * RETURN:      A pointer to name (allocated here).
+ *
+ * DESCRIPTION: Generate an ACPI name of the form _T_x. These names are
+ *              reserved for use by the ASL compiler. (_T_0 through _T_Z)
+ *
+ ******************************************************************************/
+
+static char *
+TrAmlGetNextTempName (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT8                   *TempCount)
+{
+    char                    *TempName;
+
+
+    if (*TempCount >= (10 + 26))  /* 0-35 valid: 0-9 and A-Z for TempName[3] */
+    {
+        /* Too many temps */
+
+        AslError (ASL_ERROR, ASL_MSG_TOO_MANY_TEMPS, Op, NULL);
+        return (NULL);
+    }
+
+    TempName = UtLocalCalloc (5);
+
+    if (*TempCount < 10)    /* 0-9 */
+    {
+        TempName[3] = (char) (*TempCount + '0');
+    }
+    else                    /* 10-35: A-Z */
+    {
+        TempName[3] = (char) (*TempCount + ('A' - 10));
+    }
+
+    (*TempCount)++;
+
+    /* First three characters are always "_T_" */
+
+    TempName[0] = '_';
+    TempName[1] = 'T';
+    TempName[2] = '_';
+
+    return (TempName);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAmlInitLineNumbers
+ *
+ * PARAMETERS:  Op              - Op to be initialized
+ *              Neighbor        - Op used for initialization values
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Initialized the various line numbers for a parse node.
+ *
+ ******************************************************************************/
+
+static void
+TrAmlInitLineNumbers (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *Neighbor)
+{
+
+    Op->Asl.EndLine           = Neighbor->Asl.EndLine;
+    Op->Asl.EndLogicalLine    = Neighbor->Asl.EndLogicalLine;
+    Op->Asl.LineNumber        = Neighbor->Asl.LineNumber;
+    Op->Asl.LogicalByteOffset = Neighbor->Asl.LogicalByteOffset;
+    Op->Asl.LogicalLineNumber = Neighbor->Asl.LogicalLineNumber;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAmlInitNode
+ *
+ * PARAMETERS:  Op              - Op to be initialized
+ *              ParseOpcode     - Opcode for this node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Initialize a node with the parse opcode and opcode name.
+ *
+ ******************************************************************************/
+
+static void
+TrAmlInitNode (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT16                  ParseOpcode)
+{
+
+    Op->Asl.ParseOpcode = ParseOpcode;
+    UtSetParseOpName (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAmlSetSubtreeParent
+ *
+ * PARAMETERS:  Op              - First node in a list of peer nodes
+ *              Parent          - Parent of the subtree
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Set the parent for all peer nodes in a subtree
+ *
+ ******************************************************************************/
+
+static void
+TrAmlSetSubtreeParent (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *Parent)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    Next = Op;
+    while (Next)
+    {
+        Next->Asl.Parent = Parent;
+        Next = Next->Asl.Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAmlInsertPeer
+ *
+ * PARAMETERS:  Op              - First node in a list of peer nodes
+ *              NewPeer         - Peer node to insert
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert a new peer node into a list of peers.
+ *
+ ******************************************************************************/
+
+static void
+TrAmlInsertPeer (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *NewPeer)
+{
+
+    NewPeer->Asl.Next = Op->Asl.Next;
+    Op->Asl.Next = NewPeer;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAmlTransformWalkBegin
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Parse tree walk to generate both the AML opcodes and the AML
+ *              operands.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+TrAmlTransformWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    TrTransformSubtree (Op);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAmlTransformWalkEnd
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Parse tree walk to generate both the AML opcodes and the AML
+ *              operands.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+TrAmlTransformWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+
+    /* Save possible Externals list in the DefintionBlock Op */
+
+    if (Op->Asl.ParseOpcode == PARSEOP_DEFINITION_BLOCK)
+    {
+        Op->Asl.Value.Arg = Gbl_ExternalsListHead;
+        Gbl_ExternalsListHead = NULL;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrTransformSubtree
+ *
+ * PARAMETERS:  Op        - The parent parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Prepare nodes to be output as AML data and operands. The more
+ *              complex AML opcodes require processing of the child nodes
+ *              (arguments/operands).
+ *
+ ******************************************************************************/
+
+static void
+TrTransformSubtree (
+    ACPI_PARSE_OBJECT           *Op)
+{
+
+    if (Op->Asl.AmlOpcode == AML_RAW_DATA_BYTE)
+    {
+        return;
+    }
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_DEFINITION_BLOCK:
+
+        TrDoDefinitionBlock (Op);
+        break;
+
+    case PARSEOP_SWITCH:
+
+        TrDoSwitch (Op);
+        break;
+
+    case PARSEOP_METHOD:
+        /*
+         * TBD: Zero the tempname (_T_x) count. Probably shouldn't be a global,
+         * however
+         */
+        Gbl_TempCount = 0;
+        break;
+
+    case PARSEOP_EXTERNAL:
+
+        if (Gbl_DoExternals == TRUE)
+        {
+            ExDoExternal (Op);
+        }
+
+        break;
+
+    default:
+
+        /* Nothing to do here for other opcodes */
+
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrDoDefinitionBlock
+ *
+ * PARAMETERS:  Op        - Parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Find the end of the definition block and set a global to this
+ *              node. It is used by the compiler to insert compiler-generated
+ *              names at the root level of the namespace.
+ *
+ ******************************************************************************/
+
+static void
+TrDoDefinitionBlock (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *Next;
+    UINT32                  i;
+
+
+    /* Reset external list when starting a definition block */
+
+    Gbl_ExternalsListHead = NULL;
+
+    Next = Op->Asl.Child;
+    for (i = 0; i < 5; i++)
+    {
+        Next = Next->Asl.Next;
+        if (i == 0)
+        {
+            /*
+             * This is the table signature. Only the DSDT can be assumed
+             * to be at the root of the namespace;  Therefore, namepath
+             * optimization can only be performed on the DSDT.
+             */
+            if (!ACPI_COMPARE_NAME (Next->Asl.Value.String, ACPI_SIG_DSDT))
+            {
+                Gbl_ReferenceOptimizationFlag = FALSE;
+            }
+        }
+    }
+
+    Gbl_FirstLevelInsertionNode = Next;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrDoSwitch
+ *
+ * PARAMETERS:  StartNode        - Parse node for SWITCH
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Translate ASL SWITCH statement to if/else pairs. There is
+ *              no actual AML opcode for SWITCH -- it must be simulated.
+ *
+ ******************************************************************************/
+
+static void
+TrDoSwitch (
+    ACPI_PARSE_OBJECT       *StartNode)
+{
+    ACPI_PARSE_OBJECT       *Next;
+    ACPI_PARSE_OBJECT       *CaseOp = NULL;
+    ACPI_PARSE_OBJECT       *CaseBlock = NULL;
+    ACPI_PARSE_OBJECT       *DefaultOp = NULL;
+    ACPI_PARSE_OBJECT       *CurrentParentNode;
+    ACPI_PARSE_OBJECT       *Conditional = NULL;
+    ACPI_PARSE_OBJECT       *Predicate;
+    ACPI_PARSE_OBJECT       *Peer;
+    ACPI_PARSE_OBJECT       *NewOp;
+    ACPI_PARSE_OBJECT       *NewOp2;
+    ACPI_PARSE_OBJECT       *MethodOp;
+    ACPI_PARSE_OBJECT       *StoreOp;
+    ACPI_PARSE_OBJECT       *BreakOp;
+    ACPI_PARSE_OBJECT       *BufferOp;
+    char                    *PredicateValueName;
+    UINT16                  Index;
+    UINT32                  Btype;
+
+
+    /* Start node is the Switch() node */
+
+    CurrentParentNode  = StartNode;
+
+    /* Create a new temp name of the form _T_x */
+
+    PredicateValueName = TrAmlGetNextTempName (StartNode, &Gbl_TempCount);
+    if (!PredicateValueName)
+    {
+        return;
+    }
+
+    /* First child is the Switch() predicate */
+
+    Next = StartNode->Asl.Child;
+
+    /*
+     * Examine the return type of the Switch Value -
+     * must be Integer/Buffer/String
+     */
+    Index = (UINT16) (Next->Asl.ParseOpcode - ASL_PARSE_OPCODE_BASE);
+    Btype = AslKeywordMapping[Index].AcpiBtype;
+    if ((Btype != ACPI_BTYPE_INTEGER) &&
+        (Btype != ACPI_BTYPE_STRING)  &&
+        (Btype != ACPI_BTYPE_BUFFER))
+    {
+        AslError (ASL_WARNING, ASL_MSG_SWITCH_TYPE, Next, NULL);
+        Btype = ACPI_BTYPE_INTEGER;
+    }
+
+    /* CASE statements start at next child */
+
+    Peer = Next->Asl.Next;
+    while (Peer)
+    {
+        Next = Peer;
+        Peer = Next->Asl.Next;
+
+        if (Next->Asl.ParseOpcode == PARSEOP_CASE)
+        {
+            if (CaseOp)
+            {
+                /* Add an ELSE to complete the previous CASE */
+
+                NewOp = TrCreateLeafNode (PARSEOP_ELSE);
+                NewOp->Asl.Parent = Conditional->Asl.Parent;
+                TrAmlInitLineNumbers (NewOp, NewOp->Asl.Parent);
+
+                /* Link ELSE node as a peer to the previous IF */
+
+                TrAmlInsertPeer (Conditional, NewOp);
+                CurrentParentNode = NewOp;
+            }
+
+            CaseOp = Next;
+            Conditional = CaseOp;
+            CaseBlock = CaseOp->Asl.Child->Asl.Next;
+            Conditional->Asl.Child->Asl.Next = NULL;
+            Predicate = CaseOp->Asl.Child;
+
+            if ((Predicate->Asl.ParseOpcode == PARSEOP_PACKAGE) ||
+                (Predicate->Asl.ParseOpcode == PARSEOP_VAR_PACKAGE))
+            {
+                /*
+                 * Convert the package declaration to this form:
+                 *
+                 * If (LNotEqual (Match (Package(<size>){<data>},
+                 *                       MEQ, _T_x, MTR, Zero, Zero), Ones))
+                 */
+                NewOp2              = TrCreateLeafNode (PARSEOP_MATCHTYPE_MEQ);
+                Predicate->Asl.Next = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Conditional);
+
+                NewOp               = NewOp2;
+                NewOp2              = TrCreateValuedLeafNode (PARSEOP_NAMESTRING,
+                                        (UINT64) ACPI_TO_INTEGER (PredicateValueName));
+                NewOp->Asl.Next     = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Predicate);
+
+                NewOp               = NewOp2;
+                NewOp2              = TrCreateLeafNode (PARSEOP_MATCHTYPE_MTR);
+                NewOp->Asl.Next     = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Predicate);
+
+                NewOp               = NewOp2;
+                NewOp2              = TrCreateLeafNode (PARSEOP_ZERO);
+                NewOp->Asl.Next     = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Predicate);
+
+                NewOp               = NewOp2;
+                NewOp2              = TrCreateLeafNode (PARSEOP_ZERO);
+                NewOp->Asl.Next     = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Predicate);
+
+                NewOp2              = TrCreateLeafNode (PARSEOP_MATCH);
+                NewOp2->Asl.Child   = Predicate;  /* PARSEOP_PACKAGE */
+                TrAmlInitLineNumbers (NewOp2, Conditional);
+                TrAmlSetSubtreeParent (Predicate, NewOp2);
+
+                NewOp               = NewOp2;
+                NewOp2              = TrCreateLeafNode (PARSEOP_ONES);
+                NewOp->Asl.Next     = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Conditional);
+
+                NewOp2              = TrCreateLeafNode (PARSEOP_LEQUAL);
+                NewOp2->Asl.Child   = NewOp;
+                NewOp->Asl.Parent   = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Conditional);
+                TrAmlSetSubtreeParent (NewOp, NewOp2);
+
+                NewOp               = NewOp2;
+                NewOp2              = TrCreateLeafNode (PARSEOP_LNOT);
+                NewOp2->Asl.Child   = NewOp;
+                NewOp2->Asl.Parent  = Conditional;
+                NewOp->Asl.Parent   = NewOp2;
+                TrAmlInitLineNumbers (NewOp2, Conditional);
+
+                Conditional->Asl.Child = NewOp2;
+                NewOp2->Asl.Next = CaseBlock;
+            }
+            else
+            {
+                /*
+                 * Integer and Buffer case.
+                 *
+                 * Change CaseOp() to:  If (LEqual (SwitchValue, CaseValue)) {...}
+                 * Note: SwitchValue is first to allow the CaseValue to be implicitly
+                 * converted to the type of SwitchValue if necessary.
+                 *
+                 * CaseOp->Child is the case value
+                 * CaseOp->Child->Peer is the beginning of the case block
+                 */
+                NewOp = TrCreateValuedLeafNode (PARSEOP_NAMESTRING,
+                    (UINT64) ACPI_TO_INTEGER (PredicateValueName));
+                NewOp->Asl.Next = Predicate;
+                TrAmlInitLineNumbers (NewOp, Predicate);
+
+                NewOp2              = TrCreateLeafNode (PARSEOP_LEQUAL);
+                NewOp2->Asl.Parent  = Conditional;
+                NewOp2->Asl.Child   = NewOp;
+                TrAmlInitLineNumbers (NewOp2, Conditional);
+
+                TrAmlSetSubtreeParent (NewOp, NewOp2);
+
+                Predicate           = NewOp2;
+                Predicate->Asl.Next = CaseBlock;
+
+                TrAmlSetSubtreeParent (Predicate, Conditional);
+                Conditional->Asl.Child = Predicate;
+            }
+
+            /* Reinitialize the CASE node to an IF node */
+
+            TrAmlInitNode (Conditional, PARSEOP_IF);
+
+            /*
+             * The first CASE(IF) is not nested under an ELSE.
+             * All other CASEs are children of a parent ELSE.
+             */
+            if (CurrentParentNode == StartNode)
+            {
+                Conditional->Asl.Next = NULL;
+            }
+            else
+            {
+                /*
+                 * The IF is a child of previous IF/ELSE. It
+                 * is therefore without peer.
+                 */
+                CurrentParentNode->Asl.Child = Conditional;
+                Conditional->Asl.Parent      = CurrentParentNode;
+                Conditional->Asl.Next        = NULL;
+            }
+        }
+        else if (Next->Asl.ParseOpcode == PARSEOP_DEFAULT)
+        {
+            if (DefaultOp)
+            {
+                /*
+                 * More than one Default
+                 * (Parser does not catch this, must check here)
+                 */
+                AslError (ASL_ERROR, ASL_MSG_MULTIPLE_DEFAULT, Next, NULL);
+            }
+            else
+            {
+                /* Save the DEFAULT node for later, after CASEs */
+
+                DefaultOp = Next;
+            }
+        }
+        else
+        {
+            /* Unknown peer opcode */
+
+            AcpiOsPrintf ("Unknown parse opcode for switch statement: %s (%u)\n",
+                Next->Asl.ParseOpName, Next->Asl.ParseOpcode);
+        }
+    }
+
+    /* Add the default case at the end of the if/else construct */
+
+    if (DefaultOp)
+    {
+        /* If no CASE statements, this is an error - see below */
+
+        if (CaseOp)
+        {
+            /* Convert the DEFAULT node to an ELSE */
+
+            TrAmlInitNode (DefaultOp, PARSEOP_ELSE);
+            DefaultOp->Asl.Parent = Conditional->Asl.Parent;
+
+            /* Link ELSE node as a peer to the previous IF */
+
+            TrAmlInsertPeer (Conditional, DefaultOp);
+        }
+    }
+
+    if (!CaseOp)
+    {
+        AslError (ASL_ERROR, ASL_MSG_NO_CASES, StartNode, NULL);
+    }
+
+
+    /*
+     * Create a Name(_T_x, ...) statement. This statement must appear at the
+     * method level, in case a loop surrounds the switch statement and could
+     * cause the name to be created twice (error).
+     */
+
+    /* Create the Name node */
+
+    Predicate = StartNode->Asl.Child;
+    NewOp = TrCreateLeafNode (PARSEOP_NAME);
+    TrAmlInitLineNumbers (NewOp, StartNode);
+
+    /* Find the parent method */
+
+    Next = StartNode;
+    while ((Next->Asl.ParseOpcode != PARSEOP_METHOD) &&
+           (Next->Asl.ParseOpcode != PARSEOP_DEFINITION_BLOCK))
+    {
+        Next = Next->Asl.Parent;
+    }
+    MethodOp = Next;
+
+    NewOp->Asl.CompileFlags |= NODE_COMPILER_EMITTED;
+    NewOp->Asl.Parent = Next;
+
+    /* Insert name after the method name and arguments */
+
+    Next = Next->Asl.Child; /* Name */
+    Next = Next->Asl.Next;  /* NumArgs */
+    Next = Next->Asl.Next;  /* SerializeRule */
+
+    /*
+     * If method is not Serialized, we must make is so, because of the way
+     * that Switch() must be implemented -- we cannot allow multiple threads
+     * to execute this method concurrently since we need to create local
+     * temporary name(s).
+     */
+    if (Next->Asl.ParseOpcode != PARSEOP_SERIALIZERULE_SERIAL)
+    {
+        AslError (ASL_REMARK, ASL_MSG_SERIALIZED, MethodOp,
+            "Due to use of Switch operator");
+        Next->Asl.ParseOpcode = PARSEOP_SERIALIZERULE_SERIAL;
+    }
+
+    Next = Next->Asl.Next;  /* SyncLevel */
+    Next = Next->Asl.Next;  /* ReturnType */
+    Next = Next->Asl.Next;  /* ParameterTypes */
+
+    TrAmlInsertPeer (Next, NewOp);
+    TrAmlInitLineNumbers (NewOp, Next);
+
+    /* Create the NameSeg child for the Name node */
+
+    NewOp2 = TrCreateValuedLeafNode (PARSEOP_NAMESEG,
+        (UINT64) ACPI_TO_INTEGER (PredicateValueName));
+    TrAmlInitLineNumbers (NewOp2, NewOp);
+    NewOp2->Asl.CompileFlags |= NODE_IS_NAME_DECLARATION;
+    NewOp->Asl.Child  = NewOp2;
+
+    /* Create the initial value for the Name. Btype was already validated above */
+
+    switch (Btype)
+    {
+    case ACPI_BTYPE_INTEGER:
+
+        NewOp2->Asl.Next = TrCreateValuedLeafNode (PARSEOP_ZERO,
+            (UINT64) 0);
+        TrAmlInitLineNumbers (NewOp2->Asl.Next, NewOp);
+        break;
+
+    case ACPI_BTYPE_STRING:
+
+        NewOp2->Asl.Next = TrCreateValuedLeafNode (PARSEOP_STRING_LITERAL,
+            (UINT64) ACPI_TO_INTEGER (""));
+        TrAmlInitLineNumbers (NewOp2->Asl.Next, NewOp);
+        break;
+
+    case ACPI_BTYPE_BUFFER:
+
+        (void) TrLinkPeerNode (NewOp2, TrCreateValuedLeafNode (PARSEOP_BUFFER,
+            (UINT64) 0));
+        Next = NewOp2->Asl.Next;
+        TrAmlInitLineNumbers (Next, NewOp2);
+        (void) TrLinkChildren (Next, 1, TrCreateValuedLeafNode (PARSEOP_ZERO,
+            (UINT64) 1));
+        TrAmlInitLineNumbers (Next->Asl.Child, Next);
+
+        BufferOp = TrCreateValuedLeafNode (PARSEOP_DEFAULT_ARG, (UINT64) 0);
+        TrAmlInitLineNumbers (BufferOp, Next->Asl.Child);
+        (void) TrLinkPeerNode (Next->Asl.Child, BufferOp);
+
+        TrAmlSetSubtreeParent (Next->Asl.Child, Next);
+        break;
+
+    default:
+
+        break;
+    }
+
+    TrAmlSetSubtreeParent (NewOp2, NewOp);
+
+    /*
+     * Transform the Switch() into a While(One)-Break node.
+     * And create a Store() node which will be used to save the
+     * Switch() value. The store is of the form: Store (Value, _T_x)
+     * where _T_x is the temp variable.
+     */
+    TrAmlInitNode (StartNode, PARSEOP_WHILE);
+    NewOp = TrCreateLeafNode (PARSEOP_ONE);
+    TrAmlInitLineNumbers (NewOp, StartNode);
+    NewOp->Asl.Next = Predicate->Asl.Next;
+    NewOp->Asl.Parent = StartNode;
+    StartNode->Asl.Child = NewOp;
+
+    /* Create a Store() node */
+
+    StoreOp = TrCreateLeafNode (PARSEOP_STORE);
+    TrAmlInitLineNumbers (StoreOp, NewOp);
+    StoreOp->Asl.Parent = StartNode;
+    TrAmlInsertPeer (NewOp, StoreOp);
+
+    /* Complete the Store subtree */
+
+    StoreOp->Asl.Child = Predicate;
+    Predicate->Asl.Parent = StoreOp;
+
+    NewOp = TrCreateValuedLeafNode (PARSEOP_NAMESEG,
+        (UINT64) ACPI_TO_INTEGER (PredicateValueName));
+    TrAmlInitLineNumbers (NewOp, StoreOp);
+    NewOp->Asl.Parent    = StoreOp;
+    Predicate->Asl.Next  = NewOp;
+
+    /* Create a Break() node and insert it into the end of While() */
+
+    Conditional = StartNode->Asl.Child;
+    while (Conditional->Asl.Next)
+    {
+        Conditional = Conditional->Asl.Next;
+    }
+
+    BreakOp = TrCreateLeafNode (PARSEOP_BREAK);
+    TrAmlInitLineNumbers (BreakOp, NewOp);
+    BreakOp->Asl.Parent = StartNode;
+    TrAmlInsertPeer (Conditional, BreakOp);
+}
diff --git a/usr/src/cmd/acpi/iasl/asltree.c b/usr/src/cmd/acpi/iasl/asltree.c
new file mode 100644
index 0000000000..af67467ef0
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asltree.c
@@ -0,0 +1,1635 @@
+/******************************************************************************
+ *
+ * Module Name: asltree - parse tree management
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acapps.h"
+#include <time.h>
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asltree")
+
+/* Local prototypes */
+
+static ACPI_PARSE_OBJECT *
+TrGetNextNode (
+    void);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrSetParent
+ *
+ * PARAMETERS:  Op                  - To be set to new parent
+ *              ParentOp            - The parent
+ *
+ * RETURN:      None, sets Op parent directly
+ *
+ * DESCRIPTION: Change the parent of a parse op.
+ *
+ ******************************************************************************/
+
+void
+TrSetParent (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *ParentOp)
+{
+
+    Op->Asl.Parent = ParentOp;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrGetNextNode
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      New parse node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Allocate a new parse node for the parse tree. Bypass the local
+ *              dynamic memory manager for performance reasons (This has a
+ *              major impact on the speed of the compiler.)
+ *
+ ******************************************************************************/
+
+static ACPI_PARSE_OBJECT *
+TrGetNextNode (
+    void)
+{
+    ASL_CACHE_INFO          *Cache;
+
+
+    if (Gbl_ParseOpCacheNext >= Gbl_ParseOpCacheLast)
+    {
+        /* Allocate a new buffer */
+
+        Cache = UtLocalCalloc (sizeof (Cache->Next) +
+            (sizeof (ACPI_PARSE_OBJECT) * ASL_PARSEOP_CACHE_SIZE));
+
+        /* Link new cache buffer to head of list */
+
+        Cache->Next = Gbl_ParseOpCacheList;
+        Gbl_ParseOpCacheList = Cache;
+
+        /* Setup cache management pointers */
+
+        Gbl_ParseOpCacheNext = ACPI_CAST_PTR (ACPI_PARSE_OBJECT, Cache->Buffer);
+        Gbl_ParseOpCacheLast = Gbl_ParseOpCacheNext + ASL_PARSEOP_CACHE_SIZE;
+    }
+
+    Gbl_ParseOpCount++;
+    return (Gbl_ParseOpCacheNext++);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrAllocateNode
+ *
+ * PARAMETERS:  ParseOpcode         - Opcode to be assigned to the node
+ *
+ * RETURN:      New parse node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Allocate and initialize a new parse node for the parse tree
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrAllocateNode (
+    UINT32                  ParseOpcode)
+{
+    ACPI_PARSE_OBJECT       *Op;
+
+
+    Op = TrGetNextNode ();
+
+    Op->Asl.ParseOpcode       = (UINT16) ParseOpcode;
+    Op->Asl.Filename          = Gbl_Files[ASL_FILE_INPUT].Filename;
+    Op->Asl.LineNumber        = Gbl_CurrentLineNumber;
+    Op->Asl.LogicalLineNumber = Gbl_LogicalLineNumber;
+    Op->Asl.LogicalByteOffset = Gbl_CurrentLineOffset;
+    Op->Asl.Column            = Gbl_CurrentColumn;
+
+    UtSetParseOpName (Op);
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrReleaseNode
+ *
+ * PARAMETERS:  Op            - Op to be released
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: "release" a node. In truth, nothing is done since the node
+ *              is part of a larger buffer
+ *
+ ******************************************************************************/
+
+void
+TrReleaseNode (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrSetCurrentFilename
+ *
+ * PARAMETERS:  Op                  - An existing parse node
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Save the include file filename. Used for debug output only.
+ *
+ ******************************************************************************/
+
+void
+TrSetCurrentFilename (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    Op->Asl.Filename = Gbl_PreviousIncludeFilename;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrUpdateNode
+ *
+ * PARAMETERS:  ParseOpcode         - New opcode to be assigned to the node
+ *              Op                  - An existing parse node
+ *
+ * RETURN:      The updated node
+ *
+ * DESCRIPTION: Change the parse opcode assigned to a node. Usually used to
+ *              change an opcode to DEFAULT_ARG so that the node is ignored
+ *              during the code generation. Also used to set generic integers
+ *              to a specific size (8, 16, 32, or 64 bits)
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrUpdateNode (
+    UINT32                  ParseOpcode,
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nUpdateNode: Old - %s, New - %s\n",
+        UtGetOpName (Op->Asl.ParseOpcode),
+        UtGetOpName (ParseOpcode));
+
+    /* Assign new opcode and name */
+
+    if (Op->Asl.ParseOpcode == PARSEOP_ONES)
+    {
+        switch (ParseOpcode)
+        {
+        case PARSEOP_BYTECONST:
+
+            Op->Asl.Value.Integer = ACPI_UINT8_MAX;
+            break;
+
+        case PARSEOP_WORDCONST:
+
+            Op->Asl.Value.Integer = ACPI_UINT16_MAX;
+            break;
+
+        case PARSEOP_DWORDCONST:
+
+            Op->Asl.Value.Integer = ACPI_UINT32_MAX;
+            break;
+
+        /* Don't need to do the QWORD case */
+
+        default:
+
+            /* Don't care about others */
+            break;
+        }
+    }
+
+    Op->Asl.ParseOpcode = (UINT16) ParseOpcode;
+    UtSetParseOpName (Op);
+
+    /*
+     * For the BYTE, WORD, and DWORD constants, make sure that the integer
+     * that was passed in will actually fit into the data type
+     */
+    switch (ParseOpcode)
+    {
+    case PARSEOP_BYTECONST:
+
+        UtCheckIntegerRange (Op, 0x00, ACPI_UINT8_MAX);
+        Op->Asl.Value.Integer &= ACPI_UINT8_MAX;
+        break;
+
+    case PARSEOP_WORDCONST:
+
+        UtCheckIntegerRange (Op, 0x00, ACPI_UINT16_MAX);
+        Op->Asl.Value.Integer &= ACPI_UINT16_MAX;
+        break;
+
+    case PARSEOP_DWORDCONST:
+
+        UtCheckIntegerRange (Op, 0x00, ACPI_UINT32_MAX);
+        Op->Asl.Value.Integer &= ACPI_UINT32_MAX;
+        break;
+
+    default:
+
+        /* Don't care about others, don't need to check QWORD */
+
+        break;
+    }
+
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrPrintNodeCompileFlags
+ *
+ * PARAMETERS:  Flags               - Flags word to be decoded
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Decode a flags word to text. Displays all flags that are set.
+ *
+ ******************************************************************************/
+
+void
+TrPrintNodeCompileFlags (
+    UINT32                  Flags)
+{
+    UINT32                  i;
+    UINT32                  FlagBit = 1;
+    char                    *FlagName = NULL;
+
+
+    for (i = 0; i < 32; i++)
+    {
+        switch (Flags & FlagBit)
+        {
+        case NODE_VISITED:
+
+            FlagName = "NODE_VISITED";
+            break;
+
+        case NODE_AML_PACKAGE:
+
+            FlagName = "NODE_AML_PACKAGE";
+            break;
+
+        case NODE_IS_TARGET:
+
+            FlagName = "NODE_IS_TARGET";
+            break;
+
+        case NODE_IS_RESOURCE_DESC:
+
+            FlagName = "NODE_IS_RESOURCE_DESC";
+            break;
+
+        case NODE_IS_RESOURCE_FIELD:
+
+            FlagName = "NODE_IS_RESOURCE_FIELD";
+            break;
+
+        case NODE_HAS_NO_EXIT:
+
+            FlagName = "NODE_HAS_NO_EXIT";
+            break;
+
+        case NODE_IF_HAS_NO_EXIT:
+
+            FlagName = "NODE_IF_HAS_NO_EXIT";
+            break;
+
+        case NODE_NAME_INTERNALIZED:
+
+            FlagName = "NODE_NAME_INTERNALIZED";
+            break;
+
+        case NODE_METHOD_NO_RETVAL:
+
+            FlagName = "NODE_METHOD_NO_RETVAL";
+            break;
+
+        case NODE_METHOD_SOME_NO_RETVAL:
+
+            FlagName = "NODE_METHOD_SOME_NO_RETVAL";
+            break;
+
+        case NODE_RESULT_NOT_USED:
+
+            FlagName = "NODE_RESULT_NOT_USED";
+            break;
+
+        case NODE_METHOD_TYPED:
+
+            FlagName = "NODE_METHOD_TYPED";
+            break;
+
+        case NODE_COULD_NOT_REDUCE:
+
+            FlagName = "NODE_COULD_NOT_REDUCE";
+            break;
+
+        case NODE_COMPILE_TIME_CONST:
+
+            FlagName = "NODE_COMPILE_TIME_CONST";
+            break;
+
+        case NODE_IS_TERM_ARG:
+
+            FlagName = "NODE_IS_TERM_ARG";
+            break;
+
+        case NODE_WAS_ONES_OP:
+
+            FlagName = "NODE_WAS_ONES_OP";
+            break;
+
+        case NODE_IS_NAME_DECLARATION:
+
+            FlagName = "NODE_IS_NAME_DECLARATION";
+            break;
+
+        case NODE_COMPILER_EMITTED:
+
+            FlagName = "NODE_COMPILER_EMITTED";
+            break;
+
+        case NODE_IS_DUPLICATE:
+
+            FlagName = "NODE_IS_DUPLICATE";
+            break;
+
+        case NODE_IS_RESOURCE_DATA:
+
+            FlagName = "NODE_IS_RESOURCE_DATA";
+            break;
+
+        case NODE_IS_NULL_RETURN:
+
+            FlagName = "NODE_IS_NULL_RETURN";
+            break;
+
+        default:
+            break;
+        }
+
+        if (FlagName)
+        {
+            DbgPrint (ASL_PARSE_OUTPUT, " %s", FlagName);
+            FlagName = NULL;
+        }
+
+        FlagBit <<= 1;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrSetNodeFlags
+ *
+ * PARAMETERS:  Op                  - An existing parse node
+ *              Flags               - New flags word
+ *
+ * RETURN:      The updated parser op
+ *
+ * DESCRIPTION: Set bits in the node flags word. Will not clear bits, only set
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrSetNodeFlags (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Flags)
+{
+
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nSetNodeFlags: %s Op %p, %8.8X", Op->Asl.ParseOpName, Op, Flags);
+
+    TrPrintNodeCompileFlags (Flags);
+    DbgPrint (ASL_PARSE_OUTPUT, "\n\n");
+
+    Op->Asl.CompileFlags |= Flags;
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrSetNodeAmlLength
+ *
+ * PARAMETERS:  Op                  - An existing parse node
+ *              Length              - AML Length
+ *
+ * RETURN:      The updated parser op
+ *
+ * DESCRIPTION: Set the AML Length in a node. Used by the parser to indicate
+ *              the presence of a node that must be reduced to a fixed length
+ *              constant.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrSetNodeAmlLength (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Length)
+{
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nSetNodeAmlLength: Op %p, %8.8X\n", Op, Length);
+
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    Op->Asl.AmlLength = Length;
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrSetEndLineNumber
+ *
+ * PARAMETERS:  Op                - An existing parse node
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Set the ending line numbers (file line and logical line) of a
+ *              parse node to the current line numbers.
+ *
+ ******************************************************************************/
+
+void
+TrSetEndLineNumber (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    /* If the end line # is already set, just return */
+
+    if (Op->Asl.EndLine)
+    {
+        return;
+    }
+
+    Op->Asl.EndLine = Gbl_CurrentLineNumber;
+    Op->Asl.EndLogicalLine = Gbl_LogicalLineNumber;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrCreateAssignmentNode
+ *
+ * PARAMETERS:  Target              - Assignment target
+ *              Source              - Assignment source
+ *
+ * RETURN:      Pointer to the new node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Implements the C-style '=' operator. It changes the parse
+ *              tree if possible to utilize the last argument of the math
+ *              operators which is a target operand -- thus saving invocation
+ *              of and additional Store() operator. An optimization.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrCreateAssignmentNode (
+    ACPI_PARSE_OBJECT       *Target,
+    ACPI_PARSE_OBJECT       *Source)
+{
+    ACPI_PARSE_OBJECT       *TargetOp;
+    ACPI_PARSE_OBJECT       *SourceOp1;
+    ACPI_PARSE_OBJECT       *SourceOp2;
+    ACPI_PARSE_OBJECT       *Operator;
+
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nTrCreateAssignmentNode  Line [%u to %u] Source %s Target %s\n",
+        Source->Asl.LineNumber, Source->Asl.EndLine,
+        UtGetOpName (Source->Asl.ParseOpcode),
+        UtGetOpName (Target->Asl.ParseOpcode));
+
+    TrSetNodeFlags (Target, NODE_IS_TARGET);
+
+    switch (Source->Asl.ParseOpcode)
+    {
+    /*
+     * Only these operators can be optimized because they have
+     * a target operand
+     */
+    case PARSEOP_ADD:
+    case PARSEOP_AND:
+    case PARSEOP_DIVIDE:
+    case PARSEOP_INDEX:
+    case PARSEOP_MOD:
+    case PARSEOP_MULTIPLY:
+    case PARSEOP_NOT:
+    case PARSEOP_OR:
+    case PARSEOP_SHIFTLEFT:
+    case PARSEOP_SHIFTRIGHT:
+    case PARSEOP_SUBTRACT:
+    case PARSEOP_XOR:
+
+        break;
+
+    /* Otherwise, just create a normal Store operator */
+
+    default:
+
+        goto CannotOptimize;
+    }
+
+    /*
+     * Transform the parse tree such that the target is moved to the
+     * last operand of the operator
+     */
+    SourceOp1 = Source->Asl.Child;
+    SourceOp2 = SourceOp1->Asl.Next;
+
+    /* NOT only has one operand, but has a target */
+
+    if (Source->Asl.ParseOpcode == PARSEOP_NOT)
+    {
+        SourceOp2 = SourceOp1;
+    }
+
+    /* DIVIDE has an extra target operand (remainder) */
+
+    if (Source->Asl.ParseOpcode == PARSEOP_DIVIDE)
+    {
+        SourceOp2 = SourceOp2->Asl.Next;
+    }
+
+    TargetOp = SourceOp2->Asl.Next;
+
+    /*
+     * Can't perform this optimization if there already is a target
+     * for the operator (ZERO is a "no target" placeholder).
+     */
+    if (TargetOp->Asl.ParseOpcode != PARSEOP_ZERO)
+    {
+        goto CannotOptimize;
+    }
+
+    /* Link in the target as the final operand */
+
+    SourceOp2->Asl.Next = Target;
+    Target->Asl.Parent = Source;
+
+    return (Source);
+
+
+CannotOptimize:
+
+    Operator = TrAllocateNode (PARSEOP_STORE);
+    TrLinkChildren (Operator, 2, Source, Target);
+
+    /* Set the appropriate line numbers for the new node */
+
+    Operator->Asl.LineNumber        = Target->Asl.LineNumber;
+    Operator->Asl.LogicalLineNumber = Target->Asl.LogicalLineNumber;
+    Operator->Asl.LogicalByteOffset = Target->Asl.LogicalByteOffset;
+    Operator->Asl.Column            = Target->Asl.Column;
+
+    return (Operator);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrCreateLeafNode
+ *
+ * PARAMETERS:  ParseOpcode         - New opcode to be assigned to the node
+ *
+ * RETURN:      Pointer to the new node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Create a simple leaf node (no children or peers, and no value
+ *              assigned to the node)
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrCreateLeafNode (
+    UINT32                  ParseOpcode)
+{
+    ACPI_PARSE_OBJECT       *Op;
+
+
+    Op = TrAllocateNode (ParseOpcode);
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nCreateLeafNode  Ln/Col %u/%u NewNode %p  Op %s\n\n",
+        Op->Asl.LineNumber, Op->Asl.Column, Op, UtGetOpName (ParseOpcode));
+
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrCreateNullTarget
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Pointer to the new node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Create a "null" target node. This is defined by the ACPI
+ *              specification to be a zero AML opcode, and indicates that
+ *              no target has been specified for the parent operation
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrCreateNullTarget (
+    void)
+{
+    ACPI_PARSE_OBJECT       *Op;
+
+
+    Op = TrAllocateNode (PARSEOP_ZERO);
+    Op->Asl.CompileFlags |= (NODE_IS_TARGET | NODE_COMPILE_TIME_CONST);
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nCreateNullTarget  Ln/Col %u/%u NewNode %p  Op %s\n",
+        Op->Asl.LineNumber, Op->Asl.Column, Op,
+        UtGetOpName (Op->Asl.ParseOpcode));
+
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrCreateConstantLeafNode
+ *
+ * PARAMETERS:  ParseOpcode         - The constant opcode
+ *
+ * RETURN:      Pointer to the new node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Create a leaf node (no children or peers) for one of the
+ *              special constants - __LINE__, __FILE__, and __DATE__.
+ *
+ * Note: An implemenation of __FUNC__ cannot happen here because we don't
+ * have a full parse tree at this time and cannot find the parent control
+ * method. If it is ever needed, __FUNC__ must be implemented later, after
+ * the parse tree has been fully constructed.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrCreateConstantLeafNode (
+    UINT32                  ParseOpcode)
+{
+    ACPI_PARSE_OBJECT       *Op = NULL;
+    time_t                  CurrentTime;
+    char                    *StaticTimeString;
+    char                    *TimeString;
+    char                    *Filename;
+
+
+    switch (ParseOpcode)
+    {
+    case PARSEOP___LINE__:
+
+        Op = TrAllocateNode (PARSEOP_INTEGER);
+        Op->Asl.Value.Integer = Op->Asl.LineNumber;
+        break;
+
+    case PARSEOP___PATH__:
+
+        Op = TrAllocateNode (PARSEOP_STRING_LITERAL);
+
+        /* Op.Asl.Filename contains the full pathname to the file */
+
+        Op->Asl.Value.String = Op->Asl.Filename;
+        break;
+
+    case PARSEOP___FILE__:
+
+        Op = TrAllocateNode (PARSEOP_STRING_LITERAL);
+
+        /* Get the simple filename from the full path */
+
+        FlSplitInputPathname (Op->Asl.Filename, NULL, &Filename);
+        Op->Asl.Value.String = Filename;
+        break;
+
+    case PARSEOP___DATE__:
+
+        Op = TrAllocateNode (PARSEOP_STRING_LITERAL);
+
+        /* Get a copy of the current time */
+
+        CurrentTime = time (NULL);
+        StaticTimeString = ctime (&CurrentTime);
+        TimeString = UtLocalCalloc (strlen (StaticTimeString) + 1);
+        strcpy (TimeString, StaticTimeString);
+
+        TimeString[strlen(TimeString) -1] = 0;  /* Remove trailing newline */
+        Op->Asl.Value.String = TimeString;
+        break;
+
+    default: /* This would be an internal error */
+
+        return (NULL);
+    }
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nCreateConstantLeafNode  Ln/Col %u/%u NewNode %p  "
+        "Op %s  Value %8.8X%8.8X  \n",
+        Op->Asl.LineNumber, Op->Asl.Column, Op, UtGetOpName (ParseOpcode),
+        ACPI_FORMAT_UINT64 (Op->Asl.Value.Integer));
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrCreateTargetOperand
+ *
+ * PARAMETERS:  OriginalOp          - Op to be copied
+ *
+ * RETURN:      Pointer to the new node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Copy an existing node (and subtree). Used in ASL+ (C-style)
+ *              expressions where the target is the same as one of the
+ *              operands. A new node and subtree must be created from the
+ *              original so that the parse tree can be linked properly.
+ *
+ * NOTE:        This code is specific to target operands that are the last
+ *              operand in an ASL/AML operator. Meaning that the top-level
+ *              parse Op in a possible subtree has a NULL Next pointer.
+ *              This simplifies the recursion.
+ *
+ *              Subtree example:
+ *                  DeRefOf (Local1) += 32
+ *
+ *              This gets converted to:
+ *                  Add (DeRefOf (Local1), 32, DeRefOf (Local1))
+ *
+ *              Each DeRefOf has a single child, Local1. Even more complex
+ *              subtrees can be created via the Index and DeRefOf operators.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrCreateTargetOperand (
+    ACPI_PARSE_OBJECT       *OriginalOp,
+    ACPI_PARSE_OBJECT       *ParentOp)
+{
+    ACPI_PARSE_OBJECT       *Op;
+
+
+    if (!OriginalOp)
+    {
+        return (NULL);
+    }
+
+    Op = TrGetNextNode ();
+
+    /* Copy the pertinent values (omit link pointer fields) */
+
+    Op->Asl.Value               = OriginalOp->Asl.Value;
+    Op->Asl.Filename            = OriginalOp->Asl.Filename;
+    Op->Asl.LineNumber          = OriginalOp->Asl.LineNumber;
+    Op->Asl.LogicalLineNumber   = OriginalOp->Asl.LogicalLineNumber;
+    Op->Asl.LogicalByteOffset   = OriginalOp->Asl.LogicalByteOffset;
+    Op->Asl.Column              = OriginalOp->Asl.Column;
+    Op->Asl.Flags               = OriginalOp->Asl.Flags;
+    Op->Asl.CompileFlags        = OriginalOp->Asl.CompileFlags;
+    Op->Asl.AmlOpcode           = OriginalOp->Asl.AmlOpcode;
+    Op->Asl.ParseOpcode         = OriginalOp->Asl.ParseOpcode;
+    Op->Asl.Parent              = ParentOp;
+    UtSetParseOpName (Op);
+
+    /* Copy a possible subtree below this node */
+
+    if (OriginalOp->Asl.Child)
+    {
+        Op->Asl.Child = TrCreateTargetOperand (OriginalOp->Asl.Child, Op);
+    }
+
+    if (OriginalOp->Asl.Next) /* Null for top-level node */
+    {
+        Op->Asl.Next = TrCreateTargetOperand (OriginalOp->Asl.Next, ParentOp);
+    }
+
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrCreateValuedLeafNode
+ *
+ * PARAMETERS:  ParseOpcode         - New opcode to be assigned to the node
+ *              Value               - Value to be assigned to the node
+ *
+ * RETURN:      Pointer to the new node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Create a leaf node (no children or peers) with a value
+ *              assigned to it
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrCreateValuedLeafNode (
+    UINT32                  ParseOpcode,
+    UINT64                  Value)
+{
+    ACPI_PARSE_OBJECT       *Op;
+
+
+    Op = TrAllocateNode (ParseOpcode);
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nCreateValuedLeafNode  Ln/Col %u/%u NewNode %p  "
+        "Op %s  Value %8.8X%8.8X  ",
+        Op->Asl.LineNumber, Op->Asl.Column, Op, UtGetOpName(ParseOpcode),
+        ACPI_FORMAT_UINT64 (Value));
+    Op->Asl.Value.Integer = Value;
+
+    switch (ParseOpcode)
+    {
+    case PARSEOP_STRING_LITERAL:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "STRING->%s", Value);
+        break;
+
+    case PARSEOP_NAMESEG:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "NAMESEG->%s", Value);
+        break;
+
+    case PARSEOP_NAMESTRING:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "NAMESTRING->%s", Value);
+        break;
+
+    case PARSEOP_EISAID:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "EISAID->%s", Value);
+        break;
+
+    case PARSEOP_METHOD:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "METHOD");
+        break;
+
+    case PARSEOP_INTEGER:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "INTEGER->%8.8X%8.8X",
+            ACPI_FORMAT_UINT64 (Value));
+        break;
+
+    default:
+
+        break;
+    }
+
+    DbgPrint (ASL_PARSE_OUTPUT, "\n\n");
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrCreateNode
+ *
+ * PARAMETERS:  ParseOpcode         - Opcode to be assigned to the node
+ *              NumChildren         - Number of children to follow
+ *              ...                 - A list of child nodes to link to the new
+ *                                    node. NumChildren long.
+ *
+ * RETURN:      Pointer to the new node. Aborts on allocation failure
+ *
+ * DESCRIPTION: Create a new parse node and link together a list of child
+ *              nodes underneath the new node.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrCreateNode (
+    UINT32                  ParseOpcode,
+    UINT32                  NumChildren,
+    ...)
+{
+    ACPI_PARSE_OBJECT       *Op;
+    ACPI_PARSE_OBJECT       *Child;
+    ACPI_PARSE_OBJECT       *PrevChild;
+    va_list                 ap;
+    UINT32                  i;
+    BOOLEAN                 FirstChild;
+
+
+    va_start (ap, NumChildren);
+
+    /* Allocate one new node */
+
+    Op = TrAllocateNode (ParseOpcode);
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nCreateNode  Ln/Col %u/%u NewParent %p Child %u Op %s  ",
+        Op->Asl.LineNumber, Op->Asl.Column, Op,
+        NumChildren, UtGetOpName(ParseOpcode));
+
+    /* Some extra debug output based on the parse opcode */
+
+    switch (ParseOpcode)
+    {
+    case PARSEOP_ASL_CODE:
+
+        Gbl_ParseTreeRoot = Op;
+        Op->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+        DbgPrint (ASL_PARSE_OUTPUT, "ASLCODE (Tree Completed)->");
+        break;
+
+    case PARSEOP_DEFINITION_BLOCK:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "DEFINITION_BLOCK (Tree Completed)->");
+        break;
+
+    case PARSEOP_OPERATIONREGION:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "OPREGION->");
+        break;
+
+    case PARSEOP_OR:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "OR->");
+        break;
+
+    default:
+
+        /* Nothing to do for other opcodes */
+
+        break;
+    }
+
+    /* Link the new node to its children */
+
+    PrevChild = NULL;
+    FirstChild = TRUE;
+    for (i = 0; i < NumChildren; i++)
+    {
+        /* Get the next child */
+
+        Child = va_arg (ap, ACPI_PARSE_OBJECT *);
+        DbgPrint (ASL_PARSE_OUTPUT, "%p, ", Child);
+
+        /*
+         * If child is NULL, this means that an optional argument
+         * was omitted. We must create a placeholder with a special
+         * opcode (DEFAULT_ARG) so that the code generator will know
+         * that it must emit the correct default for this argument
+         */
+        if (!Child)
+        {
+            Child = TrAllocateNode (PARSEOP_DEFAULT_ARG);
+        }
+
+        /* Link first child to parent */
+
+        if (FirstChild)
+        {
+            FirstChild = FALSE;
+            Op->Asl.Child = Child;
+        }
+
+        /* Point all children to parent */
+
+        Child->Asl.Parent = Op;
+
+        /* Link children in a peer list */
+
+        if (PrevChild)
+        {
+            PrevChild->Asl.Next = Child;
+        };
+
+        /*
+         * This child might be a list, point all nodes in the list
+         * to the same parent
+         */
+        while (Child->Asl.Next)
+        {
+            Child = Child->Asl.Next;
+            Child->Asl.Parent = Op;
+        }
+
+        PrevChild = Child;
+    }
+    va_end(ap);
+
+    DbgPrint (ASL_PARSE_OUTPUT, "\n");
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrLinkChildren
+ *
+ * PARAMETERS:  Op                - An existing parse node
+ *              NumChildren         - Number of children to follow
+ *              ...                 - A list of child nodes to link to the new
+ *                                    node. NumChildren long.
+ *
+ * RETURN:      The updated (linked) node
+ *
+ * DESCRIPTION: Link a group of nodes to an existing parse node
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrLinkChildren (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  NumChildren,
+    ...)
+{
+    ACPI_PARSE_OBJECT       *Child;
+    ACPI_PARSE_OBJECT       *PrevChild;
+    va_list                 ap;
+    UINT32                  i;
+    BOOLEAN                 FirstChild;
+
+
+    va_start (ap, NumChildren);
+
+
+    TrSetEndLineNumber (Op);
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nLinkChildren  Line [%u to %u] NewParent %p Child %u Op %s  ",
+        Op->Asl.LineNumber, Op->Asl.EndLine,
+        Op, NumChildren, UtGetOpName(Op->Asl.ParseOpcode));
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_ASL_CODE:
+
+        Gbl_ParseTreeRoot = Op;
+        Op->Asl.ParseOpcode = PARSEOP_DEFAULT_ARG;
+        DbgPrint (ASL_PARSE_OUTPUT, "ASLCODE (Tree Completed)->");
+        break;
+
+    case PARSEOP_DEFINITION_BLOCK:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "DEFINITION_BLOCK (Tree Completed)->");
+        break;
+
+    case PARSEOP_OPERATIONREGION:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "OPREGION->");
+        break;
+
+    case PARSEOP_OR:
+
+        DbgPrint (ASL_PARSE_OUTPUT, "OR->");
+        break;
+
+    default:
+
+        /* Nothing to do for other opcodes */
+
+        break;
+    }
+
+    /* Link the new node to it's children */
+
+    PrevChild = NULL;
+    FirstChild = TRUE;
+    for (i = 0; i < NumChildren; i++)
+    {
+        Child = va_arg (ap, ACPI_PARSE_OBJECT *);
+
+        if ((Child == PrevChild) && (Child != NULL))
+        {
+            AslError (ASL_WARNING, ASL_MSG_COMPILER_INTERNAL, Child,
+                "Child node list invalid");
+            va_end(ap);
+            return (Op);
+        }
+
+        DbgPrint (ASL_PARSE_OUTPUT, "%p, ", Child);
+
+        /*
+         * If child is NULL, this means that an optional argument
+         * was omitted. We must create a placeholder with a special
+         * opcode (DEFAULT_ARG) so that the code generator will know
+         * that it must emit the correct default for this argument
+         */
+        if (!Child)
+        {
+            Child = TrAllocateNode (PARSEOP_DEFAULT_ARG);
+        }
+
+        /* Link first child to parent */
+
+        if (FirstChild)
+        {
+            FirstChild = FALSE;
+            Op->Asl.Child = Child;
+        }
+
+        /* Point all children to parent */
+
+        Child->Asl.Parent = Op;
+
+        /* Link children in a peer list */
+
+        if (PrevChild)
+        {
+            PrevChild->Asl.Next = Child;
+        };
+
+        /*
+         * This child might be a list, point all nodes in the list
+         * to the same parent
+         */
+        while (Child->Asl.Next)
+        {
+            Child = Child->Asl.Next;
+            Child->Asl.Parent = Op;
+        }
+
+        PrevChild = Child;
+    }
+
+    va_end(ap);
+    DbgPrint (ASL_PARSE_OUTPUT, "\n\n");
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrLinkPeerNode
+ *
+ * PARAMETERS:  Op1           - First peer
+ *              Op2           - Second peer
+ *
+ * RETURN:      Op1 or the non-null node.
+ *
+ * DESCRIPTION: Link two nodes as peers. Handles cases where one peer is null.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrLinkPeerNode (
+    ACPI_PARSE_OBJECT       *Op1,
+    ACPI_PARSE_OBJECT       *Op2)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nLinkPeerNode: 1=%p (%s), 2=%p (%s)\n",
+        Op1, Op1 ? UtGetOpName(Op1->Asl.ParseOpcode) : NULL,
+        Op2, Op2 ? UtGetOpName(Op2->Asl.ParseOpcode) : NULL);
+
+
+    if ((!Op1) && (!Op2))
+    {
+        DbgPrint (ASL_PARSE_OUTPUT, "\nTwo Null nodes!\n");
+        return (Op1);
+    }
+
+    /* If one of the nodes is null, just return the non-null node */
+
+    if (!Op2)
+    {
+        return (Op1);
+    }
+
+    if (!Op1)
+    {
+        return (Op2);
+    }
+
+    if (Op1 == Op2)
+    {
+        DbgPrint (ASL_DEBUG_OUTPUT,
+            "\n************* Internal error, linking node to itself %p\n",
+            Op1);
+        AslError (ASL_WARNING, ASL_MSG_COMPILER_INTERNAL, Op1,
+            "Linking node to itself");
+        return (Op1);
+    }
+
+    Op1->Asl.Parent = Op2->Asl.Parent;
+
+    /*
+     * Op 1 may already have a peer list (such as an IF/ELSE pair),
+     * so we must walk to the end of the list and attach the new
+     * peer at the end
+     */
+    Next = Op1;
+    while (Next->Asl.Next)
+    {
+        Next = Next->Asl.Next;
+    }
+
+    Next->Asl.Next = Op2;
+    return (Op1);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrLinkPeerNodes
+ *
+ * PARAMETERS:  NumPeers            - The number of nodes in the list to follow
+ *              ...                 - A list of nodes to link together as peers
+ *
+ * RETURN:      The first node in the list (head of the peer list)
+ *
+ * DESCRIPTION: Link together an arbitrary number of peer nodes.
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrLinkPeerNodes (
+    UINT32                  NumPeers,
+    ...)
+{
+    ACPI_PARSE_OBJECT       *This;
+    ACPI_PARSE_OBJECT       *Next;
+    va_list                 ap;
+    UINT32                  i;
+    ACPI_PARSE_OBJECT       *Start;
+
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nLinkPeerNodes: (%u) ", NumPeers);
+
+    va_start (ap, NumPeers);
+    This = va_arg (ap, ACPI_PARSE_OBJECT *);
+    Start = This;
+
+    /*
+     * Link all peers
+     */
+    for (i = 0; i < (NumPeers -1); i++)
+    {
+        DbgPrint (ASL_PARSE_OUTPUT, "%u=%p ", (i+1), This);
+
+        while (This->Asl.Next)
+        {
+            This = This->Asl.Next;
+        }
+
+        /* Get another peer node */
+
+        Next = va_arg (ap, ACPI_PARSE_OBJECT *);
+        if (!Next)
+        {
+            Next = TrAllocateNode (PARSEOP_DEFAULT_ARG);
+        }
+
+        /* link new node to the current node */
+
+        This->Asl.Next = Next;
+        This = Next;
+    }
+    va_end (ap);
+
+    DbgPrint (ASL_PARSE_OUTPUT,"\n");
+    return (Start);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrLinkChildNode
+ *
+ * PARAMETERS:  Op1           - Parent node
+ *              Op2           - Op to become a child
+ *
+ * RETURN:      The parent node
+ *
+ * DESCRIPTION: Link two nodes together as a parent and child
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+TrLinkChildNode (
+    ACPI_PARSE_OBJECT       *Op1,
+    ACPI_PARSE_OBJECT       *Op2)
+{
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    DbgPrint (ASL_PARSE_OUTPUT,
+        "\nLinkChildNode: Parent=%p (%s), Child=%p (%s)\n",
+        Op1, Op1 ? UtGetOpName(Op1->Asl.ParseOpcode): NULL,
+        Op2, Op2 ? UtGetOpName(Op2->Asl.ParseOpcode): NULL);
+
+    if (!Op1 || !Op2)
+    {
+        return (Op1);
+    }
+
+    Op1->Asl.Child = Op2;
+
+    /* Set the child and all peers of the child to point to the parent */
+
+    Next = Op2;
+    while (Next)
+    {
+        Next->Asl.Parent = Op1;
+        Next = Next->Asl.Next;
+    }
+
+    return (Op1);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    TrWalkParseTree
+ *
+ * PARAMETERS:  Visitation              - Type of walk
+ *              DescendingCallback      - Called during tree descent
+ *              AscendingCallback       - Called during tree ascent
+ *              Context                 - To be passed to the callbacks
+ *
+ * RETURN:      Status from callback(s)
+ *
+ * DESCRIPTION: Walk the entire parse tree.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+TrWalkParseTree (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Visitation,
+    ASL_WALK_CALLBACK       DescendingCallback,
+    ASL_WALK_CALLBACK       AscendingCallback,
+    void                    *Context)
+{
+    UINT32                  Level;
+    BOOLEAN                 NodePreviouslyVisited;
+    ACPI_PARSE_OBJECT       *StartOp = Op;
+    ACPI_STATUS             Status;
+
+
+    if (!Gbl_ParseTreeRoot)
+    {
+        return (AE_OK);
+    }
+
+    Level = 0;
+    NodePreviouslyVisited = FALSE;
+
+    switch (Visitation)
+    {
+    case ASL_WALK_VISIT_DOWNWARD:
+
+        while (Op)
+        {
+            if (!NodePreviouslyVisited)
+            {
+                /* Let the callback process the node. */
+
+                Status = DescendingCallback (Op, Level, Context);
+                if (ACPI_SUCCESS (Status))
+                {
+                    /* Visit children first, once */
+
+                    if (Op->Asl.Child)
+                    {
+                        Level++;
+                        Op = Op->Asl.Child;
+                        continue;
+                    }
+                }
+                else if (Status != AE_CTRL_DEPTH)
+                {
+                    /* Exit immediately on any error */
+
+                    return (Status);
+                }
+            }
+
+            /* Terminate walk at start op */
+
+            if (Op == StartOp)
+            {
+                break;
+            }
+
+            /* No more children, visit peers */
+
+            if (Op->Asl.Next)
+            {
+                Op = Op->Asl.Next;
+                NodePreviouslyVisited = FALSE;
+            }
+            else
+            {
+                /* No children or peers, re-visit parent */
+
+                if (Level != 0 )
+                {
+                    Level--;
+                }
+                Op = Op->Asl.Parent;
+                NodePreviouslyVisited = TRUE;
+            }
+        }
+        break;
+
+    case ASL_WALK_VISIT_UPWARD:
+
+        while (Op)
+        {
+            /* Visit leaf node (no children) or parent node on return trip */
+
+            if ((!Op->Asl.Child) ||
+                (NodePreviouslyVisited))
+            {
+                /* Let the callback process the node. */
+
+                Status = AscendingCallback (Op, Level, Context);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+            }
+            else
+            {
+                /* Visit children first, once */
+
+                Level++;
+                Op = Op->Asl.Child;
+                continue;
+            }
+
+            /* Terminate walk at start op */
+
+            if (Op == StartOp)
+            {
+                break;
+            }
+
+            /* No more children, visit peers */
+
+            if (Op->Asl.Next)
+            {
+                Op = Op->Asl.Next;
+                NodePreviouslyVisited = FALSE;
+            }
+            else
+            {
+                /* No children or peers, re-visit parent */
+
+                if (Level != 0 )
+                {
+                    Level--;
+                }
+                Op = Op->Asl.Parent;
+                NodePreviouslyVisited = TRUE;
+            }
+        }
+        break;
+
+     case ASL_WALK_VISIT_TWICE:
+
+        while (Op)
+        {
+            if (NodePreviouslyVisited)
+            {
+                Status = AscendingCallback (Op, Level, Context);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+            }
+            else
+            {
+                /* Let the callback process the node. */
+
+                Status = DescendingCallback (Op, Level, Context);
+                if (ACPI_SUCCESS (Status))
+                {
+                    /* Visit children first, once */
+
+                    if (Op->Asl.Child)
+                    {
+                        Level++;
+                        Op = Op->Asl.Child;
+                        continue;
+                    }
+                }
+                else if (Status != AE_CTRL_DEPTH)
+                {
+                    /* Exit immediately on any error */
+
+                    return (Status);
+                }
+            }
+
+            /* Terminate walk at start op */
+
+            if (Op == StartOp)
+            {
+                break;
+            }
+
+            /* No more children, visit peers */
+
+            if (Op->Asl.Next)
+            {
+                Op = Op->Asl.Next;
+                NodePreviouslyVisited = FALSE;
+            }
+            else
+            {
+                /* No children or peers, re-visit parent */
+
+                if (Level != 0 )
+                {
+                    Level--;
+                }
+                Op = Op->Asl.Parent;
+                NodePreviouslyVisited = TRUE;
+            }
+        }
+        break;
+
+    default:
+        /* No other types supported */
+        break;
+    }
+
+    /* If we get here, the walk completed with no errors */
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/asltypes.h b/usr/src/cmd/acpi/iasl/asltypes.h
new file mode 100644
index 0000000000..411faede48
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asltypes.h
@@ -0,0 +1,339 @@
+/******************************************************************************
+ *
+ * Module Name: asltypes.h - compiler data types and struct definitions
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#ifndef __ASLTYPES_H
+#define __ASLTYPES_H
+
+
+/*******************************************************************************
+ *
+ * Structure definitions
+ *
+ ******************************************************************************/
+
+
+/* Op flags for the ACPI_PARSE_OBJECT */
+
+#define NODE_VISITED                0x00000001
+#define NODE_AML_PACKAGE            0x00000002
+#define NODE_IS_TARGET              0x00000004
+#define NODE_IS_RESOURCE_DESC       0x00000008
+#define NODE_IS_RESOURCE_FIELD      0x00000010
+#define NODE_HAS_NO_EXIT            0x00000020
+#define NODE_IF_HAS_NO_EXIT         0x00000040
+#define NODE_NAME_INTERNALIZED      0x00000080
+#define NODE_METHOD_NO_RETVAL       0x00000100
+#define NODE_METHOD_SOME_NO_RETVAL  0x00000200
+#define NODE_RESULT_NOT_USED        0x00000400
+#define NODE_METHOD_TYPED           0x00000800
+#define NODE_COULD_NOT_REDUCE       0x00001000
+#define NODE_COMPILE_TIME_CONST     0x00002000
+#define NODE_IS_TERM_ARG            0x00004000
+#define NODE_WAS_ONES_OP            0x00008000
+#define NODE_IS_NAME_DECLARATION    0x00010000
+#define NODE_COMPILER_EMITTED       0x00020000
+#define NODE_IS_DUPLICATE           0x00040000
+#define NODE_IS_RESOURCE_DATA       0x00080000
+#define NODE_IS_NULL_RETURN         0x00100000
+
+/* Keeps information about individual control methods */
+
+typedef struct asl_method_info
+{
+    ACPI_PARSE_OBJECT       *Op;
+    ACPI_PARSE_OBJECT       *CurrentOp;
+    struct asl_method_info  *Next;
+    UINT32                  ValidArgTypes[ACPI_METHOD_NUM_ARGS];
+    UINT32                  ValidReturnTypes;
+    UINT32                  NumReturnNoValue;
+    UINT32                  NumReturnWithValue;
+    UINT8                   NumArguments;
+    UINT8                   LocalInitialized[ACPI_METHOD_NUM_LOCALS];
+    UINT8                   ArgInitialized[ACPI_METHOD_NUM_ARGS];
+    UINT8                   HasBeenTyped;
+    UINT8                   ShouldBeSerialized;
+
+} ASL_METHOD_INFO;
+
+
+/* Parse tree walk info for control method analysis */
+
+typedef struct asl_analysis_walk_info
+{
+    ASL_METHOD_INFO         *MethodStack;
+
+} ASL_ANALYSIS_WALK_INFO;
+
+
+/* An entry in the ParseOpcode to AmlOpcode mapping table */
+
+typedef struct asl_mapping_entry
+{
+    UINT32                      Value;
+    UINT32                      AcpiBtype;   /* Object type or return type */
+    UINT16                      AmlOpcode;
+    UINT8                       Flags;
+
+} ASL_MAPPING_ENTRY;
+
+
+/* Parse tree walk info structure */
+
+typedef struct asl_walk_info
+{
+    ACPI_PARSE_OBJECT           **NodePtr;
+    UINT32                      *LevelPtr;
+
+} ASL_WALK_INFO;
+
+
+/* File info */
+
+typedef struct asl_file_info
+{
+    FILE                        *Handle;
+    char                        *Filename;
+    const char                  *ShortDescription;
+    const char                  *Description;
+
+} ASL_FILE_INFO;
+
+typedef struct asl_file_status
+{
+    UINT32                  Line;
+    UINT32                  Offset;
+
+} ASL_FILE_STATUS;
+
+
+/*
+ * File types. Note: Any changes to this table must also be reflected
+ * in the Gbl_Files array.
+ *
+ * Corresponding filename suffixes are in comments
+ *
+ * NOTE: Don't move the first 4 file types
+ */
+typedef enum
+{
+    ASL_FILE_STDOUT             = 0,
+    ASL_FILE_STDERR,
+    ASL_FILE_INPUT,             /* .asl */
+    ASL_FILE_AML_OUTPUT,        /* .aml */
+    ASL_FILE_SOURCE_OUTPUT,     /* .src */
+    ASL_FILE_PREPROCESSOR,      /* .pre */
+    ASL_FILE_PREPROCESSOR_USER, /* .i   */
+    ASL_FILE_LISTING_OUTPUT,    /* .lst */
+    ASL_FILE_HEX_OUTPUT,        /* .hex */
+    ASL_FILE_NAMESPACE_OUTPUT,  /* .nsp */
+    ASL_FILE_DEBUG_OUTPUT,      /* .txt */
+    ASL_FILE_ASM_SOURCE_OUTPUT, /* .asm */
+    ASL_FILE_C_SOURCE_OUTPUT,   /* .c   */
+    ASL_FILE_ASM_INCLUDE_OUTPUT,/* .inc */
+    ASL_FILE_C_INCLUDE_OUTPUT,  /* .h   */
+    ASL_FILE_C_OFFSET_OUTPUT,   /* .offset.h */
+    ASL_FILE_MAP_OUTPUT,        /* .map */
+    ASL_FILE_XREF_OUTPUT        /* .xrf */
+
+} ASL_FILE_TYPES;
+
+
+#define ASL_MAX_FILE_TYPE       17
+#define ASL_NUM_FILES           (ASL_MAX_FILE_TYPE + 1)
+
+/* Name suffixes used to create filenames for output files */
+
+#define FILE_SUFFIX_ASL_CODE        "asl"
+#define FILE_SUFFIX_AML_CODE        "aml"
+#define FILE_SUFFIX_SOURCE          "src"
+#define FILE_SUFFIX_PREPROCESSOR    "pre"
+#define FILE_SUFFIX_PREPROC_USER    "i"
+#define FILE_SUFFIX_LISTING         "lst"
+#define FILE_SUFFIX_HEX_DUMP        "hex"
+#define FILE_SUFFIX_NAMESPACE       "nsp"
+#define FILE_SUFFIX_DEBUG           "txt"
+#define FILE_SUFFIX_ASM_SOURCE      "asm"
+#define FILE_SUFFIX_C_SOURCE        "c"
+#define FILE_SUFFIX_ASM_INCLUDE     "inc"
+#define FILE_SUFFIX_C_INCLUDE       "h"
+#define FILE_SUFFIX_C_OFFSET        "offset.h"
+#define FILE_SUFFIX_MAP             "map"
+#define FILE_SUFFIX_XREF            "xrf"
+
+
+/* Cache block structure for ParseOps and Strings */
+
+typedef struct asl_cache_info
+{
+    void                            *Next;
+    char                            Buffer[1];
+
+} ASL_CACHE_INFO;
+
+
+typedef struct asl_include_dir
+{
+    char                        *Dir;
+    struct asl_include_dir      *Next;
+
+} ASL_INCLUDE_DIR;
+
+
+/* An entry in the exception list, one for each error/warning */
+
+typedef struct asl_error_msg
+{
+    UINT32                      LineNumber;
+    UINT32                      LogicalLineNumber;
+    UINT32                      LogicalByteOffset;
+    UINT32                      Column;
+    char                        *Message;
+    struct asl_error_msg        *Next;
+    char                        *Filename;
+    char                        *SourceLine;
+    UINT32                      FilenameLength;
+    UINT16                      MessageId;
+    UINT8                       Level;
+
+} ASL_ERROR_MSG;
+
+
+/* An entry in the listing file stack (for include files) */
+
+typedef struct asl_listing_node
+{
+    char                        *Filename;
+    UINT32                      LineNumber;
+    struct asl_listing_node     *Next;
+
+} ASL_LISTING_NODE;
+
+
+/* Callback interface for a parse tree walk */
+
+/*
+ * TBD - another copy of this is in adisasm.h, fix
+ */
+#ifndef ASL_WALK_CALLBACK_DEFINED
+typedef
+ACPI_STATUS (*ASL_WALK_CALLBACK) (
+    ACPI_PARSE_OBJECT           *Op,
+    UINT32                      Level,
+    void                        *Context);
+#define ASL_WALK_CALLBACK_DEFINED
+#endif
+
+
+typedef struct asl_event_info
+{
+    UINT64                      StartTime;
+    UINT64                      EndTime;
+    char                        *EventName;
+    BOOLEAN                     Valid;
+
+} ASL_EVENT_INFO;
+
+
+/* Hardware mapping file structures */
+
+typedef struct acpi_gpio_info
+{
+    struct acpi_gpio_info   *Next;
+    ACPI_PARSE_OBJECT       *Op;
+    char                    *DeviceName;
+    ACPI_NAMESPACE_NODE     *TargetNode;
+    UINT32                  References;
+    UINT32                  PinCount;
+    UINT32                  PinIndex;
+    UINT16                  PinNumber;
+    UINT8                   Type;
+    UINT8                   Direction;
+    UINT8                   Polarity;
+
+} ACPI_GPIO_INFO;
+
+typedef struct acpi_serial_info
+{
+    struct acpi_serial_info *Next;
+    ACPI_PARSE_OBJECT       *Op;
+    char                    *DeviceName;
+    ACPI_NAMESPACE_NODE     *TargetNode;
+    AML_RESOURCE            *Resource;
+    UINT32                  Speed;
+    UINT16                  Address;
+
+} ACPI_SERIAL_INFO;
+
+typedef struct asl_method_local
+{
+    ACPI_PARSE_OBJECT       *Op;
+    UINT8                   Flags;
+
+} ASL_METHOD_LOCAL;
+
+/* Values for Flags field above */
+
+#define ASL_LOCAL_INITIALIZED   (1)
+#define ASL_LOCAL_REFERENCED    (1<<1)
+#define ASL_ARG_IS_LOCAL        (1<<2)
+#define ASL_ARG_INITIALIZED     (1<<3)
+#define ASL_ARG_REFERENCED      (1<<4)
+
+/* Info used to track method counts for cross reference output file */
+
+typedef struct asl_xref_info
+{
+    UINT32                  ThisMethodInvocations;
+    UINT32                  TotalPredefinedMethods;
+    UINT32                  TotalUserMethods;
+    UINT32                  TotalUnreferenceUserMethods;
+    UINT32                  ThisObjectReferences;
+    UINT32                  TotalObjects;
+    UINT32                  TotalUnreferencedObjects;
+    ACPI_PARSE_OBJECT       *MethodOp;
+    ACPI_PARSE_OBJECT       *CurrentMethodOp;
+
+} ASL_XREF_INFO;
+
+
+#endif  /* __ASLTYPES_H */
diff --git a/usr/src/cmd/acpi/iasl/asltypes.y b/usr/src/cmd/acpi/iasl/asltypes.y
new file mode 100644
index 0000000000..1faecb4587
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/asltypes.y
@@ -0,0 +1,400 @@
+NoEcho('
+/******************************************************************************
+ *
+ * Module Name: asltypes.y - Bison/Yacc production types/names
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+')
+
+/******************************************************************************
+ *
+ * Production names
+ *
+ *****************************************************************************/
+
+%type <n> ArgList
+%type <n> AslCode
+%type <n> BufferData
+%type <n> BufferTermData
+%type <n> CompilerDirective
+%type <n> DataObject
+%type <n> DefinitionBlockTerm
+%type <n> DefinitionBlockList
+%type <n> IntegerData
+%type <n> NamedObject
+%type <n> NameSpaceModifier
+%type <n> Object
+%type <n> PackageData
+%type <n> ParameterTypePackage
+%type <n> ParameterTypePackageList
+%type <n> ParameterTypesPackage
+%type <n> ParameterTypesPackageList
+%type <n> RequiredTarget
+%type <n> SimpleTarget
+%type <n> StringData
+%type <n> Target
+%type <n> Term
+%type <n> TermArg
+%type <n> TermList
+%type <n> MethodInvocationTerm
+
+/* Type4Opcode is obsolete */
+
+%type <n> Type1Opcode
+%type <n> Type2BufferOpcode
+%type <n> Type2BufferOrStringOpcode
+%type <n> Type2IntegerOpcode
+%type <n> Type2Opcode
+%type <n> Type2StringOpcode
+%type <n> Type3Opcode
+%type <n> Type5Opcode
+%type <n> Type6Opcode
+
+%type <n> AccessAsTerm
+%type <n> ExternalTerm
+%type <n> FieldUnit
+%type <n> FieldUnitEntry
+%type <n> FieldUnitList
+%type <n> IncludeTerm
+%type <n> OffsetTerm
+%type <n> OptionalAccessAttribTerm
+
+/* Named Objects */
+
+%type <n> BankFieldTerm
+%type <n> CreateBitFieldTerm
+%type <n> CreateByteFieldTerm
+%type <n> CreateDWordFieldTerm
+%type <n> CreateFieldTerm
+%type <n> CreateQWordFieldTerm
+%type <n> CreateWordFieldTerm
+%type <n> DataRegionTerm
+%type <n> DeviceTerm
+%type <n> EventTerm
+%type <n> FieldTerm
+%type <n> FunctionTerm
+%type <n> IndexFieldTerm
+%type <n> MethodTerm
+%type <n> MutexTerm
+%type <n> OpRegionTerm
+%type <n> OpRegionSpaceIdTerm
+%type <n> PowerResTerm
+%type <n> ProcessorTerm
+%type <n> ThermalZoneTerm
+
+/* Namespace modifiers */
+
+%type <n> AliasTerm
+%type <n> NameTerm
+%type <n> ScopeTerm
+
+/* Type 1 opcodes */
+
+%type <n> BreakPointTerm
+%type <n> BreakTerm
+%type <n> CaseDefaultTermList
+%type <n> CaseTerm
+%type <n> ContinueTerm
+%type <n> DefaultTerm
+%type <n> ElseTerm
+%type <n> FatalTerm
+%type <n> ElseIfTerm
+%type <n> IfTerm
+%type <n> LoadTerm
+%type <n> NoOpTerm
+%type <n> NotifyTerm
+%type <n> ReleaseTerm
+%type <n> ResetTerm
+%type <n> ReturnTerm
+%type <n> SignalTerm
+%type <n> SleepTerm
+%type <n> StallTerm
+%type <n> SwitchTerm
+%type <n> UnloadTerm
+%type <n> WhileTerm
+/* %type <n> CaseTermList */
+
+/* Type 2 opcodes */
+
+%type <n> AcquireTerm
+%type <n> AddTerm
+%type <n> AndTerm
+%type <n> ConcatResTerm
+%type <n> ConcatTerm
+%type <n> CondRefOfTerm
+%type <n> CopyObjectTerm
+%type <n> DecTerm
+%type <n> DerefOfTerm
+%type <n> DivideTerm
+%type <n> FindSetLeftBitTerm
+%type <n> FindSetRightBitTerm
+%type <n> FromBCDTerm
+%type <n> IncTerm
+%type <n> IndexTerm
+%type <n> LAndTerm
+%type <n> LEqualTerm
+%type <n> LGreaterEqualTerm
+%type <n> LGreaterTerm
+%type <n> LLessEqualTerm
+%type <n> LLessTerm
+%type <n> LNotEqualTerm
+%type <n> LNotTerm
+%type <n> LoadTableTerm
+%type <n> LOrTerm
+%type <n> MatchTerm
+%type <n> MidTerm
+%type <n> ModTerm
+%type <n> MultiplyTerm
+%type <n> NAndTerm
+%type <n> NOrTerm
+%type <n> NotTerm
+%type <n> ObjectTypeTerm
+%type <n> OrTerm
+%type <n> RawDataBufferTerm
+%type <n> RefOfTerm
+%type <n> ShiftLeftTerm
+%type <n> ShiftRightTerm
+%type <n> SizeOfTerm
+%type <n> StoreTerm
+%type <n> SubtractTerm
+%type <n> TimerTerm
+%type <n> ToBCDTerm
+%type <n> ToBufferTerm
+%type <n> ToDecimalStringTerm
+%type <n> ToHexStringTerm
+%type <n> ToIntegerTerm
+%type <n> ToStringTerm
+%type <n> WaitTerm
+%type <n> XOrTerm
+
+/* Keywords */
+
+%type <n> AccessAttribKeyword
+%type <n> AccessTypeKeyword
+%type <n> AddressingModeKeyword
+%type <n> AddressKeyword
+%type <n> AddressSpaceKeyword
+%type <n> BitsPerByteKeyword
+%type <n> ClockPhaseKeyword
+%type <n> ClockPolarityKeyword
+%type <n> DecodeKeyword
+%type <n> DevicePolarityKeyword
+%type <n> DMATypeKeyword
+%type <n> EndianKeyword
+%type <n> FlowControlKeyword
+%type <n> InterruptLevel
+%type <n> InterruptTypeKeyword
+%type <n> IODecodeKeyword
+%type <n> IoRestrictionKeyword
+%type <n> LockRuleKeyword
+%type <n> MatchOpKeyword
+%type <n> MaxKeyword
+%type <n> MemTypeKeyword
+%type <n> MinKeyword
+%type <n> ObjectTypeKeyword
+%type <n> OptionalBusMasterKeyword
+%type <n> OptionalReadWriteKeyword
+%type <n> ParityTypeKeyword
+%type <n> PinConfigByte
+%type <n> PinConfigKeyword
+%type <n> RangeTypeKeyword
+%type <n> RegionSpaceKeyword
+%type <n> ResourceTypeKeyword
+%type <n> SerializeRuleKeyword
+%type <n> ShareTypeKeyword
+%type <n> SlaveModeKeyword
+%type <n> StopBitsKeyword
+%type <n> TranslationKeyword
+%type <n> TypeKeyword
+%type <n> UpdateRuleKeyword
+%type <n> WireModeKeyword
+%type <n> XferSizeKeyword
+%type <n> XferTypeKeyword
+
+/* Types */
+
+%type <n> SuperName
+%type <n> ObjectTypeName
+%type <n> ArgTerm
+%type <n> LocalTerm
+%type <n> DebugTerm
+
+%type <n> Integer
+%type <n> ByteConst
+%type <n> WordConst
+%type <n> DWordConst
+%type <n> QWordConst
+%type <n> String
+
+%type <n> ConstTerm
+%type <n> ConstExprTerm
+%type <n> ByteConstExpr
+%type <n> WordConstExpr
+%type <n> DWordConstExpr
+%type <n> QWordConstExpr
+
+%type <n> DWordList
+%type <n> BufferTerm
+%type <n> ByteList
+
+%type <n> PackageElement
+%type <n> PackageList
+%type <n> PackageTerm
+%type <n> VarPackageLengthTerm
+
+/* Macros */
+
+%type <n> EISAIDTerm
+%type <n> ResourceMacroList
+%type <n> ResourceMacroTerm
+%type <n> ResourceTemplateTerm
+%type <n> PldKeyword
+%type <n> PldKeywordList
+%type <n> ToPLDTerm
+%type <n> ToUUIDTerm
+%type <n> UnicodeTerm
+%type <n> PrintfArgList
+%type <n> PrintfTerm
+%type <n> FprintfTerm
+%type <n> ForTerm
+
+/* Resource Descriptors */
+
+%type <n> ConnectionTerm
+%type <n> DMATerm
+%type <n> DWordIOTerm
+%type <n> DWordMemoryTerm
+%type <n> DWordSpaceTerm
+%type <n> EndDependentFnTerm
+%type <n> ExtendedIOTerm
+%type <n> ExtendedMemoryTerm
+%type <n> ExtendedSpaceTerm
+%type <n> FixedDmaTerm
+%type <n> FixedIOTerm
+%type <n> GpioIntTerm
+%type <n> GpioIoTerm
+%type <n> I2cSerialBusTerm
+%type <n> I2cSerialBusTermV2
+%type <n> InterruptTerm
+%type <n> IOTerm
+%type <n> IRQNoFlagsTerm
+%type <n> IRQTerm
+%type <n> Memory24Term
+%type <n> Memory32FixedTerm
+%type <n> Memory32Term
+%type <n> NameSeg
+%type <n> NameString
+%type <n> QWordIOTerm
+%type <n> QWordMemoryTerm
+%type <n> QWordSpaceTerm
+%type <n> RegisterTerm
+%type <n> SpiSerialBusTerm
+%type <n> SpiSerialBusTermV2
+%type <n> StartDependentFnNoPriTerm
+%type <n> StartDependentFnTerm
+%type <n> UartSerialBusTerm
+%type <n> UartSerialBusTermV2
+%type <n> VendorLongTerm
+%type <n> VendorShortTerm
+%type <n> WordBusNumberTerm
+%type <n> WordIOTerm
+%type <n> WordSpaceTerm
+
+/* Local types that help construct the AML, not in ACPI spec */
+
+%type <n> AmlPackageLengthTerm
+%type <n> IncludeEndTerm
+%type <n> NameStringItem
+%type <n> TermArgItem
+
+%type <n> OptionalAccessSize
+%type <n> OptionalAddressingMode
+%type <n> OptionalAddressRange
+%type <n> OptionalBitsPerByte
+%type <n> OptionalBuffer_Last
+%type <n> OptionalBufferLength
+%type <n> OptionalByteConstExpr
+%type <n> OptionalCount
+%type <n> OptionalDecodeType
+%type <n> OptionalDevicePolarity
+%type <n> OptionalDWordConstExpr
+%type <n> OptionalEndian
+%type <n> OptionalFlowControl
+%type <n> OptionalIoRestriction
+%type <n> OptionalListString
+%type <n> OptionalMaxType
+%type <n> OptionalMemType
+%type <n> OptionalMinType
+%type <n> OptionalNameString
+%type <n> OptionalNameString_First
+%type <n> OptionalNameString_Last
+%type <n> OptionalObjectTypeKeyword
+%type <n> OptionalParameterTypePackage
+%type <n> OptionalParameterTypesPackage
+%type <n> OptionalParityType
+%type <n> OptionalPredicate
+%type <n> OptionalQWordConstExpr
+%type <n> OptionalRangeType
+%type <n> OptionalReference
+%type <n> OptionalResourceType
+%type <n> OptionalResourceType_First
+%type <n> OptionalReturnArg
+%type <n> OptionalSerializeRuleKeyword
+%type <n> OptionalShareType
+%type <n> OptionalShareType_First
+%type <n> OptionalSlaveMode
+%type <n> OptionalStopBits
+%type <n> OptionalStringData
+%type <n> OptionalTermArg
+%type <n> OptionalTranslationType_Last
+%type <n> OptionalType
+%type <n> OptionalType_Last
+%type <n> OptionalWireMode
+%type <n> OptionalWordConst
+%type <n> OptionalWordConstExpr
+%type <n> OptionalXferSize
+
+/*
+ * C-style expression parser
+ */
+%type <n> Expression
+%type <n> EqualsTerm
+%type <n> IndexExpTerm
diff --git a/usr/src/cmd/acpi/iasl/aslutils.c b/usr/src/cmd/acpi/iasl/aslutils.c
new file mode 100644
index 0000000000..f5ca7b7e86
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslutils.c
@@ -0,0 +1,981 @@
+/******************************************************************************
+ *
+ * Module Name: aslutils -- compiler utilities
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acdisasm.h"
+#include "acnamesp.h"
+#include "amlcode.h"
+#include "acapps.h"
+#include <sys/stat.h>
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslutils")
+
+
+/* Local prototypes */
+
+static void
+UtPadNameWithUnderscores (
+    char                    *NameSeg,
+    char                    *PaddedNameSeg);
+
+static void
+UtAttachNameseg (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtIsBigEndianMachine
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      TRUE if machine is big endian
+ *              FALSE if machine is little endian
+ *
+ * DESCRIPTION: Detect whether machine is little endian or big endian.
+ *
+ ******************************************************************************/
+
+UINT8
+UtIsBigEndianMachine (
+    void)
+{
+    union {
+        UINT32              Integer;
+        UINT8               Bytes[4];
+    } Overlay =                 {0xFF000000};
+
+
+    return (Overlay.Bytes[0]); /* Returns 0xFF (TRUE) for big endian */
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    UtQueryForOverwrite
+ *
+ * PARAMETERS:  Pathname            - Output filename
+ *
+ * RETURN:      TRUE if file does not exist or overwrite is authorized
+ *
+ * DESCRIPTION: Query for file overwrite if it already exists.
+ *
+ ******************************************************************************/
+
+BOOLEAN
+UtQueryForOverwrite (
+    char                    *Pathname)
+{
+    struct stat             StatInfo;
+
+
+    if (!stat (Pathname, &StatInfo))
+    {
+        fprintf (stderr, "Target file \"%s\" already exists, overwrite? [y|n] ",
+            Pathname);
+
+        if (getchar () != 'y')
+        {
+            return (FALSE);
+        }
+    }
+
+    return (TRUE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDisplaySupportedTables
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Print all supported ACPI table names.
+ *
+ ******************************************************************************/
+
+void
+UtDisplaySupportedTables (
+    void)
+{
+    const AH_TABLE          *TableData;
+    UINT32                  i;
+
+
+    printf ("\nACPI tables supported by iASL version %8.8X:\n"
+        "  (Compiler, Disassembler, Template Generator)\n\n",
+        ACPI_CA_VERSION);
+
+    /* All ACPI tables with the common table header */
+
+    printf ("\n  Supported ACPI tables:\n");
+    for (TableData = AcpiSupportedTables, i = 1;
+         TableData->Signature; TableData++, i++)
+    {
+        printf ("%8u) %s    %s\n", i,
+            TableData->Signature, TableData->Description);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDisplayConstantOpcodes
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Print AML opcodes that can be used in constant expressions.
+ *
+ ******************************************************************************/
+
+void
+UtDisplayConstantOpcodes (
+    void)
+{
+    UINT32                  i;
+
+
+    printf ("Constant expression opcode information\n\n");
+
+    for (i = 0; i < sizeof (AcpiGbl_AmlOpInfo) / sizeof (ACPI_OPCODE_INFO); i++)
+    {
+        if (AcpiGbl_AmlOpInfo[i].Flags & AML_CONSTANT)
+        {
+            printf ("%s\n", AcpiGbl_AmlOpInfo[i].Name);
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtLocalCalloc
+ *
+ * PARAMETERS:  Size                - Bytes to be allocated
+ *
+ * RETURN:      Pointer to the allocated memory. Guaranteed to be valid.
+ *
+ * DESCRIPTION: Allocate zero-initialized memory. Aborts the compile on an
+ *              allocation failure, on the assumption that nothing more can be
+ *              accomplished.
+ *
+ ******************************************************************************/
+
+void *
+UtLocalCalloc (
+    UINT32                  Size)
+{
+    void                    *Allocated;
+
+
+    Allocated = ACPI_ALLOCATE_ZEROED (Size);
+    if (!Allocated)
+    {
+        AslCommonError (ASL_ERROR, ASL_MSG_MEMORY_ALLOCATION,
+            Gbl_CurrentLineNumber, Gbl_LogicalLineNumber,
+            Gbl_InputByteCount, Gbl_CurrentColumn,
+            Gbl_Files[ASL_FILE_INPUT].Filename, NULL);
+
+        CmCleanupAndExit ();
+        exit (1);
+    }
+
+    TotalAllocations++;
+    TotalAllocated += Size;
+    return (Allocated);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtBeginEvent
+ *
+ * PARAMETERS:  Name                - Ascii name of this event
+ *
+ * RETURN:      Event number (integer index)
+ *
+ * DESCRIPTION: Saves the current time with this event
+ *
+ ******************************************************************************/
+
+UINT8
+UtBeginEvent (
+    char                    *Name)
+{
+
+    if (AslGbl_NextEvent >= ASL_NUM_EVENTS)
+    {
+        AcpiOsPrintf ("Ran out of compiler event structs!\n");
+        return (AslGbl_NextEvent);
+    }
+
+    /* Init event with current (start) time */
+
+    AslGbl_Events[AslGbl_NextEvent].StartTime = AcpiOsGetTimer ();
+    AslGbl_Events[AslGbl_NextEvent].EventName = Name;
+    AslGbl_Events[AslGbl_NextEvent].Valid = TRUE;
+    return (AslGbl_NextEvent++);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtEndEvent
+ *
+ * PARAMETERS:  Event               - Event number (integer index)
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Saves the current time (end time) with this event
+ *
+ ******************************************************************************/
+
+void
+UtEndEvent (
+    UINT8                   Event)
+{
+
+    if (Event >= ASL_NUM_EVENTS)
+    {
+        return;
+    }
+
+    /* Insert end time for event */
+
+    AslGbl_Events[Event].EndTime = AcpiOsGetTimer ();
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DbgPrint
+ *
+ * PARAMETERS:  Type                - Type of output
+ *              Fmt                 - Printf format string
+ *              ...                 - variable printf list
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Conditional print statement. Prints to stderr only if the
+ *              debug flag is set.
+ *
+ ******************************************************************************/
+
+void
+DbgPrint (
+    UINT32                  Type,
+    char                    *Fmt,
+    ...)
+{
+    va_list                 Args;
+
+
+    if (!Gbl_DebugFlag)
+    {
+        return;
+    }
+
+    if ((Type == ASL_PARSE_OUTPUT) &&
+        (!(AslCompilerdebug)))
+    {
+        return;
+    }
+
+    va_start (Args, Fmt);
+    (void) vfprintf (stderr, Fmt, Args);
+    va_end (Args);
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtSetParseOpName
+ *
+ * PARAMETERS:  Op                  - Parse op to be named.
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert the ascii name of the parse opcode
+ *
+ ******************************************************************************/
+
+void
+UtSetParseOpName (
+    ACPI_PARSE_OBJECT       *Op)
+{
+
+    strncpy (Op->Asl.ParseOpName, UtGetOpName (Op->Asl.ParseOpcode),
+        ACPI_MAX_PARSEOP_NAME);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDisplaySummary
+ *
+ * PARAMETERS:  FileID              - ID of outpout file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Display compilation statistics
+ *
+ ******************************************************************************/
+
+void
+UtDisplaySummary (
+    UINT32                  FileId)
+{
+    UINT32                  i;
+
+
+    if (FileId != ASL_FILE_STDOUT)
+    {
+        /* Compiler name and version number */
+
+        FlPrintFile (FileId, "%s version %X%s [%s]\n\n",
+            ASL_COMPILER_NAME, (UINT32) ACPI_CA_VERSION, ACPI_WIDTH, __DATE__);
+    }
+
+    /* Summary of main input and output files */
+
+    if (Gbl_FileType == ASL_INPUT_TYPE_ASCII_DATA)
+    {
+        FlPrintFile (FileId,
+            "%-14s %s - %u lines, %u bytes, %u fields\n",
+            "Table Input:",
+            Gbl_Files[ASL_FILE_INPUT].Filename, Gbl_CurrentLineNumber,
+            Gbl_InputByteCount, Gbl_InputFieldCount);
+
+        if ((Gbl_ExceptionCount[ASL_ERROR] == 0) || (Gbl_IgnoreErrors))
+        {
+            FlPrintFile (FileId,
+                "%-14s %s - %u bytes\n",
+                "Binary Output:",
+                Gbl_Files[ASL_FILE_AML_OUTPUT].Filename, Gbl_TableLength);
+        }
+    }
+    else
+    {
+        FlPrintFile (FileId,
+            "%-14s %s - %u lines, %u bytes, %u keywords\n",
+            "ASL Input:",
+            Gbl_Files[ASL_FILE_INPUT].Filename, Gbl_CurrentLineNumber,
+            Gbl_OriginalInputFileSize, TotalKeywords);
+
+        /* AML summary */
+
+        if ((Gbl_ExceptionCount[ASL_ERROR] == 0) || (Gbl_IgnoreErrors))
+        {
+            if (Gbl_Files[ASL_FILE_AML_OUTPUT].Handle)
+            {
+                FlPrintFile (FileId,
+                    "%-14s %s - %u bytes, %u named objects, "
+                    "%u executable opcodes\n",
+                    "AML Output:",
+                    Gbl_Files[ASL_FILE_AML_OUTPUT].Filename,
+                    FlGetFileSize (ASL_FILE_AML_OUTPUT),
+                    TotalNamedObjects, TotalExecutableOpcodes);
+            }
+        }
+    }
+
+    /* Display summary of any optional files */
+
+    for (i = ASL_FILE_SOURCE_OUTPUT; i <= ASL_MAX_FILE_TYPE; i++)
+    {
+        if (!Gbl_Files[i].Filename || !Gbl_Files[i].Handle)
+        {
+            continue;
+        }
+
+        /* .SRC is a temp file unless specifically requested */
+
+        if ((i == ASL_FILE_SOURCE_OUTPUT) && (!Gbl_SourceOutputFlag))
+        {
+            continue;
+        }
+
+        /* .PRE is the preprocessor intermediate file */
+
+        if ((i == ASL_FILE_PREPROCESSOR)  && (!Gbl_KeepPreprocessorTempFile))
+        {
+            continue;
+        }
+
+        FlPrintFile (FileId, "%14s %s - %u bytes\n",
+            Gbl_Files[i].ShortDescription,
+            Gbl_Files[i].Filename, FlGetFileSize (i));
+    }
+
+    /* Error summary */
+
+    FlPrintFile (FileId,
+        "\nCompilation complete. %u Errors, %u Warnings, %u Remarks",
+        Gbl_ExceptionCount[ASL_ERROR],
+        Gbl_ExceptionCount[ASL_WARNING] +
+            Gbl_ExceptionCount[ASL_WARNING2] +
+            Gbl_ExceptionCount[ASL_WARNING3],
+        Gbl_ExceptionCount[ASL_REMARK]);
+
+    if (Gbl_FileType != ASL_INPUT_TYPE_ASCII_DATA)
+    {
+        FlPrintFile (FileId, ", %u Optimizations",
+            Gbl_ExceptionCount[ASL_OPTIMIZATION]);
+
+        if (TotalFolds)
+        {
+            FlPrintFile (FileId, ", %u Constants Folded", TotalFolds);
+        }
+    }
+
+    FlPrintFile (FileId, "\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtCheckIntegerRange
+ *
+ * PARAMETERS:  Op                  - Integer parse node
+ *              LowValue            - Smallest allowed value
+ *              HighValue           - Largest allowed value
+ *
+ * RETURN:      Op if OK, otherwise NULL
+ *
+ * DESCRIPTION: Check integer for an allowable range
+ *
+ ******************************************************************************/
+
+ACPI_PARSE_OBJECT *
+UtCheckIntegerRange (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  LowValue,
+    UINT32                  HighValue)
+{
+
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    if ((Op->Asl.Value.Integer < LowValue) ||
+        (Op->Asl.Value.Integer > HighValue))
+    {
+        sprintf (MsgBuffer, "0x%X, allowable: 0x%X-0x%X",
+            (UINT32) Op->Asl.Value.Integer, LowValue, HighValue);
+
+        AslError (ASL_ERROR, ASL_MSG_RANGE, Op, MsgBuffer);
+        return (NULL);
+    }
+
+    return (Op);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtStringCacheCalloc
+ *
+ * PARAMETERS:  Length              - Size of buffer requested
+ *
+ * RETURN:      Pointer to the buffer. Aborts on allocation failure
+ *
+ * DESCRIPTION: Allocate a string buffer. Bypass the local
+ *              dynamic memory manager for performance reasons (This has a
+ *              major impact on the speed of the compiler.)
+ *
+ ******************************************************************************/
+
+char *
+UtStringCacheCalloc (
+    UINT32                  Length)
+{
+    char                    *Buffer;
+    ASL_CACHE_INFO          *Cache;
+    UINT32                  CacheSize = ASL_STRING_CACHE_SIZE;
+
+
+    if (Length > CacheSize)
+    {
+        CacheSize = Length;
+
+        if (Gbl_StringCacheList)
+        {
+            Cache = UtLocalCalloc (sizeof (Cache->Next) + CacheSize);
+
+            /* Link new cache buffer just following head of list */
+
+            Cache->Next = Gbl_StringCacheList->Next;
+            Gbl_StringCacheList->Next = Cache;
+
+            /* Leave cache management pointers alone as they pertain to head */
+
+            Gbl_StringCount++;
+            Gbl_StringSize += Length;
+
+            return (Cache->Buffer);
+        }
+    }
+
+    if ((Gbl_StringCacheNext + Length) >= Gbl_StringCacheLast)
+    {
+        /* Allocate a new buffer */
+
+        Cache = UtLocalCalloc (sizeof (Cache->Next) + CacheSize);
+
+        /* Link new cache buffer to head of list */
+
+        Cache->Next = Gbl_StringCacheList;
+        Gbl_StringCacheList = Cache;
+
+        /* Setup cache management pointers */
+
+        Gbl_StringCacheNext = Cache->Buffer;
+        Gbl_StringCacheLast = Gbl_StringCacheNext + CacheSize;
+    }
+
+    Gbl_StringCount++;
+    Gbl_StringSize += Length;
+
+    Buffer = Gbl_StringCacheNext;
+    Gbl_StringCacheNext += Length;
+    return (Buffer);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    UtExpandLineBuffers
+ *
+ * PARAMETERS:  None. Updates global line buffer pointers.
+ *
+ * RETURN:      None. Reallocates the global line buffers
+ *
+ * DESCRIPTION: Called if the current line buffer becomes filled. Reallocates
+ *              all global line buffers and updates Gbl_LineBufferSize. NOTE:
+ *              Also used for the initial allocation of the buffers, when
+ *              all of the buffer pointers are NULL. Initial allocations are
+ *              of size ASL_DEFAULT_LINE_BUFFER_SIZE
+ *
+ *****************************************************************************/
+
+void
+UtExpandLineBuffers (
+    void)
+{
+    UINT32                  NewSize;
+
+
+    /* Attempt to double the size of all line buffers */
+
+    NewSize = Gbl_LineBufferSize * 2;
+    if (Gbl_CurrentLineBuffer)
+    {
+        DbgPrint (ASL_DEBUG_OUTPUT,
+            "Increasing line buffer size from %u to %u\n",
+            Gbl_LineBufferSize, NewSize);
+    }
+
+    Gbl_CurrentLineBuffer = realloc (Gbl_CurrentLineBuffer, NewSize);
+    Gbl_LineBufPtr = Gbl_CurrentLineBuffer;
+    if (!Gbl_CurrentLineBuffer)
+    {
+        goto ErrorExit;
+    }
+
+    Gbl_MainTokenBuffer = realloc (Gbl_MainTokenBuffer, NewSize);
+    if (!Gbl_MainTokenBuffer)
+    {
+        goto ErrorExit;
+    }
+
+    Gbl_MacroTokenBuffer = realloc (Gbl_MacroTokenBuffer, NewSize);
+    if (!Gbl_MacroTokenBuffer)
+    {
+        goto ErrorExit;
+    }
+
+    Gbl_ExpressionTokenBuffer = realloc (Gbl_ExpressionTokenBuffer, NewSize);
+    if (!Gbl_ExpressionTokenBuffer)
+    {
+        goto ErrorExit;
+    }
+
+    Gbl_LineBufferSize = NewSize;
+    return;
+
+
+    /* On error above, simply issue error messages and abort, cannot continue */
+
+ErrorExit:
+    printf ("Could not increase line buffer size from %u to %u\n",
+        Gbl_LineBufferSize, Gbl_LineBufferSize * 2);
+
+    AslError (ASL_ERROR, ASL_MSG_BUFFER_ALLOCATION,
+        NULL, NULL);
+    AslAbort ();
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    UtFreeLineBuffers
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Free all line buffers
+ *
+ *****************************************************************************/
+
+void
+UtFreeLineBuffers (
+    void)
+{
+
+    free (Gbl_CurrentLineBuffer);
+    free (Gbl_MainTokenBuffer);
+    free (Gbl_MacroTokenBuffer);
+    free (Gbl_ExpressionTokenBuffer);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtInternalizeName
+ *
+ * PARAMETERS:  ExternalName        - Name to convert
+ *              ConvertedName       - Where the converted name is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Convert an external (ASL) name to an internal (AML) name
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+UtInternalizeName (
+    char                    *ExternalName,
+    char                    **ConvertedName)
+{
+    ACPI_NAMESTRING_INFO    Info;
+    ACPI_STATUS             Status;
+
+
+    if (!ExternalName)
+    {
+        return (AE_OK);
+    }
+
+    /* Get the length of the new internal name */
+
+    Info.ExternalName = ExternalName;
+    AcpiNsGetInternalNameLength (&Info);
+
+    /* We need a segment to store the internal name */
+
+    Info.InternalName = UtStringCacheCalloc (Info.Length);
+    if (!Info.InternalName)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    /* Build the name */
+
+    Status = AcpiNsBuildInternalName (&Info);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    *ConvertedName = Info.InternalName;
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtPadNameWithUnderscores
+ *
+ * PARAMETERS:  NameSeg             - Input nameseg
+ *              PaddedNameSeg       - Output padded nameseg
+ *
+ * RETURN:      Padded nameseg.
+ *
+ * DESCRIPTION: Pads a NameSeg with underscores if necessary to form a full
+ *              ACPI_NAME.
+ *
+ ******************************************************************************/
+
+static void
+UtPadNameWithUnderscores (
+    char                    *NameSeg,
+    char                    *PaddedNameSeg)
+{
+    UINT32                  i;
+
+
+    for (i = 0; (i < ACPI_NAME_SIZE); i++)
+    {
+        if (*NameSeg)
+        {
+            *PaddedNameSeg = *NameSeg;
+            NameSeg++;
+        }
+        else
+        {
+            *PaddedNameSeg = '_';
+        }
+
+        PaddedNameSeg++;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtAttachNameseg
+ *
+ * PARAMETERS:  Op                  - Parent parse node
+ *              Name                - Full ExternalName
+ *
+ * RETURN:      None; Sets the NameSeg field in parent node
+ *
+ * DESCRIPTION: Extract the last nameseg of the ExternalName and store it
+ *              in the NameSeg field of the Op.
+ *
+ ******************************************************************************/
+
+static void
+UtAttachNameseg (
+    ACPI_PARSE_OBJECT       *Op,
+    char                    *Name)
+{
+    char                    *NameSeg;
+    char                    PaddedNameSeg[4];
+
+
+    if (!Name)
+    {
+        return;
+    }
+
+    /* Look for the last dot in the namepath */
+
+    NameSeg = strrchr (Name, '.');
+    if (NameSeg)
+    {
+        /* Found last dot, we have also found the final nameseg */
+
+        NameSeg++;
+        UtPadNameWithUnderscores (NameSeg, PaddedNameSeg);
+    }
+    else
+    {
+        /* No dots in the namepath, there is only a single nameseg. */
+        /* Handle prefixes */
+
+        while (ACPI_IS_ROOT_PREFIX (*Name) ||
+               ACPI_IS_PARENT_PREFIX (*Name))
+        {
+            Name++;
+        }
+
+        /* Remaining string should be one single nameseg */
+
+        UtPadNameWithUnderscores (Name, PaddedNameSeg);
+    }
+
+    ACPI_MOVE_NAME (Op->Asl.NameSeg, PaddedNameSeg);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtAttachNamepathToOwner
+ *
+ * PARAMETERS:  Op                  - Parent parse node
+ *              NameOp              - Node that contains the name
+ *
+ * RETURN:      Sets the ExternalName and Namepath in the parent node
+ *
+ * DESCRIPTION: Store the name in two forms in the parent node: The original
+ *              (external) name, and the internalized name that is used within
+ *              the ACPI namespace manager.
+ *
+ ******************************************************************************/
+
+void
+UtAttachNamepathToOwner (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_PARSE_OBJECT       *NameOp)
+{
+    ACPI_STATUS             Status;
+
+
+    /* Full external path */
+
+    Op->Asl.ExternalName = NameOp->Asl.Value.String;
+
+    /* Save the NameOp for possible error reporting later */
+
+    Op->Asl.ParentMethod = (void *) NameOp;
+
+    /* Last nameseg of the path */
+
+    UtAttachNameseg (Op, Op->Asl.ExternalName);
+
+    /* Create internalized path */
+
+    Status = UtInternalizeName (NameOp->Asl.Value.String, &Op->Asl.Namepath);
+    if (ACPI_FAILURE (Status))
+    {
+        /* TBD: abort on no memory */
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtDoConstant
+ *
+ * PARAMETERS:  String              - Hex, Octal, or Decimal string
+ *
+ * RETURN:      Converted Integer
+ *
+ * DESCRIPTION: Convert a string to an integer, with error checking.
+ *
+ ******************************************************************************/
+
+UINT64
+UtDoConstant (
+    char                    *String)
+{
+    ACPI_STATUS             Status;
+    UINT64                  Converted;
+    char                    ErrBuf[64];
+
+
+    Status = AcpiUtStrtoul64 (String, ACPI_ANY_BASE,
+        ACPI_MAX64_BYTE_WIDTH, &Converted);
+
+    if (ACPI_FAILURE (Status))
+    {
+        sprintf (ErrBuf, "%s %s\n", "Conversion error:",
+            AcpiFormatException (Status));
+        AslCompilererror (ErrBuf);
+    }
+
+    return (Converted);
+}
+
+
+#ifdef _OBSOLETE_FUNCTIONS
+/* Removed 01/2016 */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtConvertByteToHex
+ *
+ * PARAMETERS:  RawByte             - Binary data
+ *              Buffer              - Pointer to where the hex bytes will be
+ *                                    stored
+ *
+ * RETURN:      Ascii hex byte is stored in Buffer.
+ *
+ * DESCRIPTION: Perform hex-to-ascii translation. The return data is prefixed
+ *              with "0x"
+ *
+ ******************************************************************************/
+
+void
+UtConvertByteToHex (
+    UINT8                   RawByte,
+    UINT8                   *Buffer)
+{
+
+    Buffer[0] = '0';
+    Buffer[1] = 'x';
+
+    Buffer[2] = (UINT8) AcpiUtHexToAsciiChar (RawByte, 4);
+    Buffer[3] = (UINT8) AcpiUtHexToAsciiChar (RawByte, 0);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtConvertByteToAsmHex
+ *
+ * PARAMETERS:  RawByte             - Binary data
+ *              Buffer              - Pointer to where the hex bytes will be
+ *                                    stored
+ *
+ * RETURN:      Ascii hex byte is stored in Buffer.
+ *
+ * DESCRIPTION: Perform hex-to-ascii translation. The return data is prefixed
+ *              with '0', and a trailing 'h' is added.
+ *
+ ******************************************************************************/
+
+void
+UtConvertByteToAsmHex (
+    UINT8                   RawByte,
+    UINT8                   *Buffer)
+{
+
+    Buffer[0] = '0';
+    Buffer[1] = (UINT8) AcpiUtHexToAsciiChar (RawByte, 4);
+    Buffer[2] = (UINT8) AcpiUtHexToAsciiChar (RawByte, 0);
+    Buffer[3] = 'h';
+}
+#endif /* OBSOLETE_FUNCTIONS */
diff --git a/usr/src/uts/intel/io/acpica/utilities/utascii.c b/usr/src/cmd/acpi/iasl/asluuid.c
index 25c02e674e..9a0fc5c0eb 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utascii.c
+++ b/usr/src/cmd/acpi/iasl/asluuid.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Module Name: utascii - Utility ascii functions
+ * Module Name: asluuid-- compiler UUID support
  *
  *****************************************************************************/
 
@@ -41,121 +41,113 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include "acpi.h"
-#include "accommon.h"
+#include "aslcompiler.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("asluuid")
+
+
+extern UINT8                AcpiGbl_MapToUuidOffset[UUID_BUFFER_LENGTH];
 
 
 /*******************************************************************************
  *
- * FUNCTION:    AcpiUtValidNameseg
+ * FUNCTION:    AuValiduateUuid
  *
- * PARAMETERS:  Name            - The name or table signature to be examined.
- *                                Four characters, does not have to be a
- *                                NULL terminated string.
+ * PARAMETERS:  InString            - 36-byte formatted UUID string
  *
- * RETURN:      TRUE if signature is has 4 valid ACPI characters
+ * RETURN:      Status
  *
- * DESCRIPTION: Validate an ACPI table signature.
+ * DESCRIPTION: Check all 36 characters for correct format
  *
  ******************************************************************************/
 
-BOOLEAN
-AcpiUtValidNameseg (
-    char                    *Name)
+ACPI_STATUS
+AuValidateUuid (
+    char                    *InString)
 {
     UINT32                  i;
 
 
-    /* Validate each character in the signature */
-
-    for (i = 0; i < ACPI_NAME_SIZE; i++)
+    if (!InString || (strlen (InString) != UUID_STRING_LENGTH))
     {
-        if (!AcpiUtValidNameChar (Name[i], i))
-        {
-            return (FALSE);
-        }
+        return (AE_BAD_PARAMETER);
     }
 
-    return (TRUE);
-}
-
+    /* Check all 36 characters for correct format */
 
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtValidNameChar
- *
- * PARAMETERS:  Char            - The character to be examined
- *              Position        - Byte position (0-3)
- *
- * RETURN:      TRUE if the character is valid, FALSE otherwise
- *
- * DESCRIPTION: Check for a valid ACPI character. Must be one of:
- *              1) Upper case alpha
- *              2) numeric
- *              3) underscore
- *
- *              We allow a '!' as the last character because of the ASF! table
- *
- ******************************************************************************/
-
-BOOLEAN
-AcpiUtValidNameChar (
-    char                    Character,
-    UINT32                  Position)
-{
-
-    if (!((Character >= 'A' && Character <= 'Z') ||
-          (Character >= '0' && Character <= '9') ||
-          (Character == '_')))
+    for (i = 0; i < UUID_STRING_LENGTH; i++)
     {
-        /* Allow a '!' in the last position */
+        /* Must have 4 hyphens (dashes) in these positions: */
 
-        if (Character == '!' && Position == 3)
+        if ((i == UUID_HYPHEN1_OFFSET) ||
+            (i == UUID_HYPHEN2_OFFSET) ||
+            (i == UUID_HYPHEN3_OFFSET) ||
+            (i == UUID_HYPHEN4_OFFSET))
         {
-            return (TRUE);
+            if (InString[i] != '-')
+            {
+                return (AE_BAD_PARAMETER);
+            }
         }
+        else
+        {
+            /* All other positions must contain hex digits */
 
-        return (FALSE);
+            if (!isxdigit ((int) InString[i]))
+            {
+                return (AE_BAD_PARAMETER);
+            }
+        }
     }
 
-    return (TRUE);
+    return (AE_OK);
 }
 
 
 /*******************************************************************************
  *
- * FUNCTION:    AcpiUtCheckAndRepairAscii
+ * FUNCTION:    AuConvertUuidToString
  *
- * PARAMETERS:  Name                - Ascii string
- *              Count               - Number of characters to check
+ * PARAMETERS:  UuidBuffer          - 16-byte UUID buffer
+ *              OutString           - 36-byte formatted UUID string
  *
- * RETURN:      None
+ * RETURN:      Status
  *
- * DESCRIPTION: Ensure that the requested number of characters are printable
- *              Ascii characters. Sets non-printable and null chars to <space>.
+ * DESCRIPTION: Convert 16-byte UUID buffer to 36-byte formatted UUID string
+ *              OutString must be 37 bytes to include null terminator.
  *
  ******************************************************************************/
 
-void
-AcpiUtCheckAndRepairAscii (
-    UINT8                   *Name,
-    char                    *RepairedName,
-    UINT32                  Count)
+ACPI_STATUS
+AuConvertUuidToString (
+    char                    *UuidBuffer,
+    char                    *OutString)
 {
     UINT32                  i;
 
 
-    for (i = 0; i < Count; i++)
+    if (!UuidBuffer || !OutString)
     {
-        RepairedName[i] = (char) Name[i];
+        return (AE_BAD_PARAMETER);
+    }
 
-        if (!Name[i])
-        {
-            return;
-        }
-        if (!isprint (Name[i]))
-        {
-            RepairedName[i] = ' ';
-        }
+    for (i = 0; i < UUID_BUFFER_LENGTH; i++)
+    {
+        OutString[AcpiGbl_MapToUuidOffset[i]] =
+            AcpiUtHexToAsciiChar (UuidBuffer[i], 4);
+
+        OutString[AcpiGbl_MapToUuidOffset[i] + 1] =
+            AcpiUtHexToAsciiChar (UuidBuffer[i], 0);
     }
+
+    /* Insert required hyphens (dashes) */
+
+    OutString[UUID_HYPHEN1_OFFSET] =
+    OutString[UUID_HYPHEN2_OFFSET] =
+    OutString[UUID_HYPHEN3_OFFSET] =
+    OutString[UUID_HYPHEN4_OFFSET] = '-';
+
+    OutString[UUID_STRING_LENGTH] = 0; /* Null terminate */
+    return (AE_OK);
 }
diff --git a/usr/src/cmd/acpi/iasl/aslwalks.c b/usr/src/cmd/acpi/iasl/aslwalks.c
new file mode 100644
index 0000000000..357b92d0b3
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslwalks.c
@@ -0,0 +1,977 @@
+/******************************************************************************
+ *
+ * Module Name: aslwalks.c - Miscellaneous analytical parse tree walks
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acparser.h"
+#include "amlcode.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslwalks")
+
+
+/* Local prototypes */
+
+static void
+AnAnalyzeStoreOperator (
+    ACPI_PARSE_OBJECT       *Op);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnMethodTypingWalkEnd
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Ascending callback for typing walk. Complete the method
+ *              return analysis. Check methods for:
+ *              1) Initialized local variables
+ *              2) Valid arguments
+ *              3) Return types
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AnMethodTypingWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    UINT32                  ThisOpBtype;
+
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_METHOD:
+
+        Op->Asl.CompileFlags |= NODE_METHOD_TYPED;
+        break;
+
+    case PARSEOP_RETURN:
+
+        if ((Op->Asl.Child) &&
+            (Op->Asl.Child->Asl.ParseOpcode != PARSEOP_DEFAULT_ARG))
+        {
+            ThisOpBtype = AnGetBtype (Op->Asl.Child);
+
+            if ((Op->Asl.Child->Asl.ParseOpcode == PARSEOP_METHODCALL) &&
+                (ThisOpBtype == (ACPI_UINT32_MAX -1)))
+            {
+                /*
+                 * The called method is untyped at this time (typically a
+                 * forward reference).
+                 *
+                 * Check for a recursive method call first. Note: the
+                 * Child->Node will be null if the method has not been
+                 * resolved.
+                 */
+                if (Op->Asl.Child->Asl.Node &&
+                    (Op->Asl.ParentMethod != Op->Asl.Child->Asl.Node->Op))
+                {
+                    /* We must type the method here */
+
+                    TrWalkParseTree (Op->Asl.Child->Asl.Node->Op,
+                        ASL_WALK_VISIT_UPWARD, NULL,
+                        AnMethodTypingWalkEnd, NULL);
+
+                    ThisOpBtype = AnGetBtype (Op->Asl.Child);
+                }
+            }
+
+            /* Returns a value, save the value type */
+
+            if (Op->Asl.ParentMethod)
+            {
+                Op->Asl.ParentMethod->Asl.AcpiBtype |= ThisOpBtype;
+            }
+        }
+        break;
+
+    default:
+
+        break;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnOperandTypecheckWalkEnd
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Ascending callback for analysis walk. Complete method
+ *              return analysis.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AnOperandTypecheckWalkEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    const ACPI_OPCODE_INFO  *OpInfo;
+    UINT32                  RuntimeArgTypes;
+    UINT32                  RuntimeArgTypes2;
+    UINT32                  RequiredBtypes;
+    UINT32                  ThisNodeBtype;
+    UINT32                  CommonBtypes;
+    UINT32                  OpcodeClass;
+    ACPI_PARSE_OBJECT       *ArgOp;
+    UINT32                  ArgType;
+
+
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_RAW_DATA_BYTE:
+    case AML_RAW_DATA_WORD:
+    case AML_RAW_DATA_DWORD:
+    case AML_RAW_DATA_QWORD:
+    case AML_RAW_DATA_BUFFER:
+    case AML_RAW_DATA_CHAIN:
+    case AML_PACKAGE_LENGTH:
+    case AML_UNASSIGNED_OPCODE:
+    case AML_DEFAULT_ARG_OP:
+
+        /* Ignore the internal (compiler-only) AML opcodes */
+
+        return (AE_OK);
+
+    default:
+
+        break;
+    }
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+    if (!OpInfo)
+    {
+        return (AE_OK);
+    }
+
+    ArgOp = Op->Asl.Child;
+    OpcodeClass = OpInfo->Class;
+    RuntimeArgTypes = OpInfo->RuntimeArgs;
+
+#ifdef ASL_ERROR_NAMED_OBJECT_IN_WHILE
+    /*
+     * Update 11/2008: In practice, we can't perform this check. A simple
+     * analysis is not sufficient. Also, it can cause errors when compiling
+     * disassembled code because of the way Switch operators are implemented
+     * (a While(One) loop with a named temp variable created within.)
+     */
+
+    /*
+     * If we are creating a named object, check if we are within a while loop
+     * by checking if the parent is a WHILE op. This is a simple analysis, but
+     * probably sufficient for many cases.
+     *
+     * Allow Scope(), Buffer(), and Package().
+     */
+    if (((OpcodeClass == AML_CLASS_NAMED_OBJECT) && (Op->Asl.AmlOpcode != AML_SCOPE_OP)) ||
+        ((OpcodeClass == AML_CLASS_CREATE) && (OpInfo->Flags & AML_NSNODE)))
+    {
+        if (Op->Asl.Parent->Asl.AmlOpcode == AML_WHILE_OP)
+        {
+            AslError (ASL_ERROR, ASL_MSG_NAMED_OBJECT_IN_WHILE, Op, NULL);
+        }
+    }
+#endif
+
+    /*
+     * Special case for control opcodes IF/RETURN/WHILE since they
+     * have no runtime arg list (at this time)
+     */
+    switch (Op->Asl.AmlOpcode)
+    {
+    case AML_IF_OP:
+    case AML_WHILE_OP:
+    case AML_RETURN_OP:
+
+        if (ArgOp->Asl.ParseOpcode == PARSEOP_METHODCALL)
+        {
+            /* Check for an internal method */
+
+            if (AnIsInternalMethod (ArgOp))
+            {
+                return (AE_OK);
+            }
+
+            /* The lone arg is a method call, check it */
+
+            RequiredBtypes = AnMapArgTypeToBtype (ARGI_INTEGER);
+            if (Op->Asl.AmlOpcode == AML_RETURN_OP)
+            {
+                RequiredBtypes = 0xFFFFFFFF;
+            }
+
+            ThisNodeBtype = AnGetBtype (ArgOp);
+            if (ThisNodeBtype == ACPI_UINT32_MAX)
+            {
+                return (AE_OK);
+            }
+
+            AnCheckMethodReturnValue (Op, OpInfo, ArgOp,
+                RequiredBtypes, ThisNodeBtype);
+        }
+        return (AE_OK);
+
+    case AML_EXTERNAL_OP:
+        /*
+         * Not really a "runtime" opcode since it used by disassembler only.
+         * The parser will find any issues with the operands.
+         */
+        return (AE_OK);
+
+    default:
+
+        break;
+    }
+
+    /* Ignore the non-executable opcodes */
+
+    if (RuntimeArgTypes == ARGI_INVALID_OPCODE)
+    {
+        return (AE_OK);
+    }
+
+    /*
+     * Special handling for certain opcodes.
+     */
+    switch (Op->Asl.AmlOpcode)
+    {
+        /* BankField has one TermArg */
+
+    case AML_BANK_FIELD_OP:
+
+        OpcodeClass = AML_CLASS_EXECUTE;
+        ArgOp = ArgOp->Asl.Next;
+        ArgOp = ArgOp->Asl.Next;
+        break;
+
+        /* Operation Region has 2 TermArgs */
+
+    case AML_REGION_OP:
+
+        OpcodeClass = AML_CLASS_EXECUTE;
+        ArgOp = ArgOp->Asl.Next;
+        ArgOp = ArgOp->Asl.Next;
+        break;
+
+        /* DataTableRegion has 3 TermArgs */
+
+    case AML_DATA_REGION_OP:
+
+        OpcodeClass = AML_CLASS_EXECUTE;
+        ArgOp = ArgOp->Asl.Next;
+        break;
+
+        /* Buffers/Packages have a length that is a TermArg */
+
+    case AML_BUFFER_OP:
+    case AML_PACKAGE_OP:
+    case AML_VAR_PACKAGE_OP:
+
+            /* If length is a constant, we are done */
+
+        if ((ArgOp->Asl.ParseOpcode == PARSEOP_INTEGER) ||
+            (ArgOp->Asl.ParseOpcode == PARSEOP_RAW_DATA))
+        {
+            return (AE_OK);
+        }
+        break;
+
+        /* Store can write any object to the Debug object */
+
+    case AML_STORE_OP:
+        /*
+         * If this is a Store() to the Debug object, we don't need
+         * to perform any further validation -- because a Store of
+         * any object to Debug is permitted and supported.
+         */
+        if (ArgOp->Asl.Next->Asl.AmlOpcode == AML_DEBUG_OP)
+        {
+            return (AE_OK);
+        }
+        break;
+
+    default:
+        break;
+    }
+
+    switch (OpcodeClass)
+    {
+    case AML_CLASS_EXECUTE:
+    case AML_CLASS_CREATE:
+    case AML_CLASS_CONTROL:
+    case AML_CLASS_RETURN_VALUE:
+
+        /* Reverse the runtime argument list */
+
+        RuntimeArgTypes2 = 0;
+        while ((ArgType = GET_CURRENT_ARG_TYPE (RuntimeArgTypes)))
+        {
+            RuntimeArgTypes2 <<= ARG_TYPE_WIDTH;
+            RuntimeArgTypes2 |= ArgType;
+            INCREMENT_ARG_LIST (RuntimeArgTypes);
+        }
+
+        /* Typecheck each argument */
+
+        while ((ArgType = GET_CURRENT_ARG_TYPE (RuntimeArgTypes2)))
+        {
+            /* Get the required type(s) for the argument */
+
+            RequiredBtypes = AnMapArgTypeToBtype (ArgType);
+
+            if (!ArgOp)
+            {
+                AslError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL, Op,
+                    "Null ArgOp in argument loop");
+                AslAbort ();
+            }
+
+            /* Get the actual type of the argument */
+
+            ThisNodeBtype = AnGetBtype (ArgOp);
+            if (ThisNodeBtype == ACPI_UINT32_MAX)
+            {
+                goto NextArgument;
+            }
+
+            /* Examine the arg based on the required type of the arg */
+
+            switch (ArgType)
+            {
+            case ARGI_TARGETREF:
+
+                if (ArgOp->Asl.ParseOpcode == PARSEOP_ZERO)
+                {
+                    /* ZERO is the placeholder for "don't store result" */
+
+                    ThisNodeBtype = RequiredBtypes;
+                    break;
+                }
+
+            /* Fallthrough */
+
+            case ARGI_STORE_TARGET:
+
+                if (ArgOp->Asl.ParseOpcode == PARSEOP_INTEGER)
+                {
+                    /*
+                     * This is the case where an original reference to a resource
+                     * descriptor field has been replaced by an (Integer) offset.
+                     * These named fields are supported at compile-time only;
+                     * the names are not passed to the interpreter (via the AML).
+                     */
+                    if ((ArgOp->Asl.Node->Type == ACPI_TYPE_LOCAL_RESOURCE_FIELD) ||
+                        (ArgOp->Asl.Node->Type == ACPI_TYPE_LOCAL_RESOURCE))
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_RESOURCE_FIELD,
+                            ArgOp, NULL);
+                    }
+                    else
+                    {
+                        AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE,
+                            ArgOp, NULL);
+                    }
+                }
+                break;
+
+
+#ifdef __FUTURE_IMPLEMENTATION
+/*
+ * Possible future typechecking support
+ */
+            case ARGI_REFERENCE:            /* References */
+            case ARGI_INTEGER_REF:
+            case ARGI_OBJECT_REF:
+            case ARGI_DEVICE_REF:
+
+                switch (ArgOp->Asl.ParseOpcode)
+                {
+                case PARSEOP_LOCAL0:
+                case PARSEOP_LOCAL1:
+                case PARSEOP_LOCAL2:
+                case PARSEOP_LOCAL3:
+                case PARSEOP_LOCAL4:
+                case PARSEOP_LOCAL5:
+                case PARSEOP_LOCAL6:
+                case PARSEOP_LOCAL7:
+
+                    /* TBD: implement analysis of current value (type) of the local */
+                    /* For now, just treat any local as a typematch */
+
+                    /*ThisNodeBtype = RequiredBtypes;*/
+                    break;
+
+                case PARSEOP_ARG0:
+                case PARSEOP_ARG1:
+                case PARSEOP_ARG2:
+                case PARSEOP_ARG3:
+                case PARSEOP_ARG4:
+                case PARSEOP_ARG5:
+                case PARSEOP_ARG6:
+
+                    /* Hard to analyze argument types, so we won't */
+                    /* for now. Just treat any arg as a typematch */
+
+                    /* ThisNodeBtype = RequiredBtypes; */
+                    break;
+
+                case PARSEOP_DEBUG:
+                case PARSEOP_REFOF:
+                case PARSEOP_INDEX:
+                default:
+
+                    break;
+                }
+                break;
+#endif
+            case ARGI_INTEGER:
+            default:
+
+                break;
+            }
+
+
+            /* Check for a type mismatch (required versus actual) */
+
+            CommonBtypes = ThisNodeBtype & RequiredBtypes;
+
+            if (ArgOp->Asl.ParseOpcode == PARSEOP_METHODCALL)
+            {
+                if (AnIsInternalMethod (ArgOp))
+                {
+                    return (AE_OK);
+                }
+
+                /* Check a method call for a valid return value */
+
+                AnCheckMethodReturnValue (Op, OpInfo, ArgOp,
+                    RequiredBtypes, ThisNodeBtype);
+            }
+
+            /*
+             * Now check if the actual type(s) match at least one
+             * bit to the required type
+             */
+            else if (!CommonBtypes)
+            {
+                /* No match -- this is a type mismatch error */
+
+                AnFormatBtype (StringBuffer, ThisNodeBtype);
+                AnFormatBtype (StringBuffer2, RequiredBtypes);
+
+                sprintf (MsgBuffer, "[%s] found, %s operator requires [%s]",
+                    StringBuffer, OpInfo->Name, StringBuffer2);
+
+                AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE,
+                    ArgOp, MsgBuffer);
+            }
+
+        NextArgument:
+            ArgOp = ArgOp->Asl.Next;
+            INCREMENT_ARG_LIST (RuntimeArgTypes2);
+        }
+        break;
+
+    default:
+
+        break;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnOtherSemanticAnalysisWalkBegin
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending callback for the analysis walk. Checks for
+ *              miscellaneous issues in the code.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+AnOtherSemanticAnalysisWalkBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_PARSE_OBJECT       *ArgOp;
+    ACPI_PARSE_OBJECT       *PrevArgOp = NULL;
+    const ACPI_OPCODE_INFO  *OpInfo;
+    ACPI_NAMESPACE_NODE     *Node;
+
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+
+
+    /*
+     * Determine if an execution class operator actually does something by
+     * checking if it has a target and/or the function return value is used.
+     * (Target is optional, so a standalone statement can actually do nothing.)
+     */
+    if ((OpInfo->Class == AML_CLASS_EXECUTE) &&
+        (OpInfo->Flags & AML_HAS_RETVAL) &&
+        (!AnIsResultUsed (Op)))
+    {
+        if (OpInfo->Flags & AML_HAS_TARGET)
+        {
+            /*
+             * Find the target node, it is always the last child. If the target
+             * is not specified in the ASL, a default node of type Zero was
+             * created by the parser.
+             */
+            ArgOp = Op->Asl.Child;
+            while (ArgOp->Asl.Next)
+            {
+                PrevArgOp = ArgOp;
+                ArgOp = ArgOp->Asl.Next;
+            }
+
+            /* Divide() is the only weird case, it has two targets */
+
+            if (Op->Asl.AmlOpcode == AML_DIVIDE_OP)
+            {
+                if ((ArgOp->Asl.ParseOpcode == PARSEOP_ZERO) &&
+                    (PrevArgOp) &&
+                    (PrevArgOp->Asl.ParseOpcode == PARSEOP_ZERO))
+                {
+                    AslError (ASL_ERROR, ASL_MSG_RESULT_NOT_USED,
+                        Op, Op->Asl.ExternalName);
+                }
+            }
+
+            else if (ArgOp->Asl.ParseOpcode == PARSEOP_ZERO)
+            {
+                AslError (ASL_ERROR, ASL_MSG_RESULT_NOT_USED,
+                    Op, Op->Asl.ExternalName);
+            }
+        }
+        else
+        {
+            /*
+             * Has no target and the result is not used. Only a couple opcodes
+             * can have this combination.
+             */
+            switch (Op->Asl.ParseOpcode)
+            {
+            case PARSEOP_ACQUIRE:
+            case PARSEOP_WAIT:
+            case PARSEOP_LOADTABLE:
+
+                break;
+
+            default:
+
+                AslError (ASL_ERROR, ASL_MSG_RESULT_NOT_USED,
+                    Op, Op->Asl.ExternalName);
+                break;
+            }
+        }
+    }
+
+
+    /*
+     * Semantic checks for individual ASL operators
+     */
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_STORE:
+
+        if (Gbl_DoTypechecking)
+        {
+            AnAnalyzeStoreOperator (Op);
+        }
+        break;
+
+
+    case PARSEOP_ACQUIRE:
+    case PARSEOP_WAIT:
+        /*
+         * Emit a warning if the timeout parameter for these operators is not
+         * ACPI_WAIT_FOREVER, and the result value from the operator is not
+         * checked, meaning that a timeout could happen, but the code
+         * would not know about it.
+         */
+
+        /* First child is the namepath, 2nd child is timeout */
+
+        ArgOp = Op->Asl.Child;
+        ArgOp = ArgOp->Asl.Next;
+
+        /*
+         * Check for the WAIT_FOREVER case - defined by the ACPI spec to be
+         * 0xFFFF or greater
+         */
+        if (((ArgOp->Asl.ParseOpcode == PARSEOP_WORDCONST) ||
+             (ArgOp->Asl.ParseOpcode == PARSEOP_INTEGER))  &&
+             (ArgOp->Asl.Value.Integer >= (UINT64) ACPI_WAIT_FOREVER))
+        {
+            break;
+        }
+
+        /*
+         * The operation could timeout. If the return value is not used
+         * (indicates timeout occurred), issue a warning
+         */
+        if (!AnIsResultUsed (Op))
+        {
+            AslError (ASL_WARNING, ASL_MSG_TIMEOUT, ArgOp,
+                Op->Asl.ExternalName);
+        }
+        break;
+
+    case PARSEOP_CREATEFIELD:
+        /*
+         * Check for a zero Length (NumBits) operand. NumBits is the 3rd operand
+         */
+        ArgOp = Op->Asl.Child;
+        ArgOp = ArgOp->Asl.Next;
+        ArgOp = ArgOp->Asl.Next;
+
+        if ((ArgOp->Asl.ParseOpcode == PARSEOP_ZERO) ||
+           ((ArgOp->Asl.ParseOpcode == PARSEOP_INTEGER) &&
+            (ArgOp->Asl.Value.Integer == 0)))
+        {
+            AslError (ASL_ERROR, ASL_MSG_NON_ZERO, ArgOp, NULL);
+        }
+        break;
+
+    case PARSEOP_CONNECTION:
+        /*
+         * Ensure that the referenced operation region has the correct SPACE_ID.
+         * From the grammar/parser, we know the parent is a FIELD definition.
+         */
+        ArgOp = Op->Asl.Parent;     /* Field definition */
+        ArgOp = ArgOp->Asl.Child;   /* First child is the OpRegion Name */
+        Node = ArgOp->Asl.Node;     /* OpRegion namespace node */
+        if (!Node)
+        {
+            break;
+        }
+
+        ArgOp = Node->Op;           /* OpRegion definition */
+        ArgOp = ArgOp->Asl.Child;   /* First child is the OpRegion Name */
+        ArgOp = ArgOp->Asl.Next;    /* Next peer is the SPACE_ID (what we want) */
+
+        /*
+         * The Connection() operator is only valid for the following operation
+         * region SpaceIds: GeneralPurposeIo and GenericSerialBus.
+         */
+        if ((ArgOp->Asl.Value.Integer != ACPI_ADR_SPACE_GPIO) &&
+            (ArgOp->Asl.Value.Integer != ACPI_ADR_SPACE_GSBUS))
+        {
+            AslError (ASL_ERROR, ASL_MSG_CONNECTION_INVALID, Op, NULL);
+        }
+        break;
+
+    case PARSEOP_FIELD:
+        /*
+         * Ensure that fields for GeneralPurposeIo and GenericSerialBus
+         * contain at least one Connection() operator
+         */
+        ArgOp = Op->Asl.Child;      /* 1st child is the OpRegion Name */
+        Node = ArgOp->Asl.Node;     /* OpRegion namespace node */
+        if (!Node)
+        {
+            break;
+        }
+
+        ArgOp = Node->Op;           /* OpRegion definition */
+        ArgOp = ArgOp->Asl.Child;   /* First child is the OpRegion Name */
+        ArgOp = ArgOp->Asl.Next;    /* Next peer is the SPACE_ID (what we want) */
+
+        /* We are only interested in GeneralPurposeIo and GenericSerialBus */
+
+        if ((ArgOp->Asl.Value.Integer != ACPI_ADR_SPACE_GPIO) &&
+            (ArgOp->Asl.Value.Integer != ACPI_ADR_SPACE_GSBUS))
+        {
+            break;
+        }
+
+        ArgOp = Op->Asl.Child;      /* 1st child is the OpRegion Name */
+        ArgOp = ArgOp->Asl.Next;    /* AccessType */
+        ArgOp = ArgOp->Asl.Next;    /* LockRule */
+        ArgOp = ArgOp->Asl.Next;    /* UpdateRule */
+        ArgOp = ArgOp->Asl.Next;    /* Start of FieldUnitList */
+
+        /* Walk the FieldUnitList */
+
+        while (ArgOp)
+        {
+            if (ArgOp->Asl.ParseOpcode == PARSEOP_CONNECTION)
+            {
+                break;
+            }
+            else if (ArgOp->Asl.ParseOpcode == PARSEOP_NAMESEG)
+            {
+                AslError (ASL_ERROR, ASL_MSG_CONNECTION_MISSING, ArgOp, NULL);
+                break;
+            }
+
+            ArgOp = ArgOp->Asl.Next;
+        }
+        break;
+
+    default:
+
+        break;
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AnAnalyzeStoreOperator
+ *
+ * PARAMETERS:  Op                  - Store() operator
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Analyze a store operator. Mostly for stores to/from package
+ *              objects where there are more restrictions than other data
+ *              types.
+ *
+ ******************************************************************************/
+
+static void
+AnAnalyzeStoreOperator (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_NAMESPACE_NODE     *SourceNode;
+    ACPI_NAMESPACE_NODE     *TargetNode;
+    ACPI_PARSE_OBJECT       *SourceOperandOp;
+    ACPI_PARSE_OBJECT       *TargetOperandOp;
+    UINT32                  SourceOperandBtype;
+    UINT32                  TargetOperandBtype;
+
+
+    /* Extract the two operands for STORE */
+
+    SourceOperandOp = Op->Asl.Child;
+    TargetOperandOp = SourceOperandOp->Asl.Next;
+
+    /*
+     * Ignore these Source operand opcodes, they cannot be typechecked,
+     * the actual result is unknown here.
+     */
+    switch (SourceOperandOp->Asl.ParseOpcode)
+    {
+    /* For these, type of the returned value is unknown at compile time */
+
+    case PARSEOP_DEREFOF:
+    case PARSEOP_METHODCALL:
+    case PARSEOP_STORE:
+    case PARSEOP_COPYOBJECT:
+
+        return;
+
+    case PARSEOP_INDEX:
+    case PARSEOP_REFOF:
+
+        if (!Gbl_EnableReferenceTypechecking)
+        {
+            return;
+        }
+
+        /*
+         * These opcodes always return an object reference, and thus
+         * the result can only be stored to a Local, Arg, or Debug.
+         */
+        if (TargetOperandOp->Asl.AmlOpcode == AML_DEBUG_OP)
+        {
+            return;
+        }
+
+        if ((TargetOperandOp->Asl.AmlOpcode < AML_LOCAL0) ||
+            (TargetOperandOp->Asl.AmlOpcode > AML_ARG6))
+        {
+            AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, TargetOperandOp,
+                "Source [Reference], Target must be [Local/Arg/Debug]");
+        }
+        return;
+
+    default:
+        break;
+    }
+
+    /*
+     * Ignore these Target operand opcodes, they cannot be typechecked
+     */
+    switch (TargetOperandOp->Asl.ParseOpcode)
+    {
+    case PARSEOP_DEBUG:
+    case PARSEOP_DEREFOF:
+    case PARSEOP_REFOF:
+    case PARSEOP_INDEX:
+
+        return;
+
+    case PARSEOP_METHODCALL:
+        /*
+         * A target is not allowed to be a method call.
+         * It is not supported by the ACPICA interpreter, nor is it
+         * supported by the MS ASL compiler or the MS interpreter.
+         * Although legal syntax up until ACPI 6.1, support for this
+         * will be removed for ACPI 6.2 (02/2016)
+         */
+        AslError (ASL_ERROR, ASL_MSG_SYNTAX,
+            TargetOperandOp, "Illegal method invocation as a target operand");
+        return;
+
+    default:
+        break;
+    }
+
+    /*
+     * Ignore typecheck for External() operands of type "UnknownObj",
+     * we don't know the actual type (source or target).
+     */
+    SourceNode = SourceOperandOp->Asl.Node;
+    if (SourceNode &&
+        (SourceNode->Flags & ANOBJ_IS_EXTERNAL) &&
+        (SourceNode->Type == ACPI_TYPE_ANY))
+    {
+        return;
+    }
+
+    TargetNode = TargetOperandOp->Asl.Node;
+    if (TargetNode &&
+        (TargetNode->Flags & ANOBJ_IS_EXTERNAL) &&
+        (TargetNode->Type == ACPI_TYPE_ANY))
+    {
+        return;
+    }
+
+    /*
+     * A NULL node with a namepath AML opcode indicates non-existent
+     * name. Just return, the error message is generated elsewhere.
+     */
+    if ((!SourceNode && (SourceOperandOp->Asl.AmlOpcode == AML_INT_NAMEPATH_OP)) ||
+        (!TargetNode && (TargetOperandOp->Asl.AmlOpcode == AML_INT_NAMEPATH_OP)))
+    {
+        return;
+    }
+
+    /*
+     * Simple check for source same as target via NS node.
+     * -- Could be expanded to locals and args.
+     */
+    if (SourceNode && TargetNode)
+    {
+        if (SourceNode == TargetNode)
+        {
+            AslError (ASL_WARNING, ASL_MSG_DUPLICATE_ITEM,
+                TargetOperandOp, "Source is the same as Target");
+            return;
+        }
+    }
+
+    /* Ignore typecheck if either source or target is a local or arg */
+
+    if ((SourceOperandOp->Asl.AmlOpcode >= AML_LOCAL0) &&
+        (SourceOperandOp->Asl.AmlOpcode <= AML_ARG6))
+    {
+        return; /* Cannot type a local/arg at compile time */
+    }
+
+    if ((TargetOperandOp->Asl.AmlOpcode >= AML_LOCAL0) &&
+        (TargetOperandOp->Asl.AmlOpcode <= AML_ARG6))
+    {
+        return; /* Cannot type a local/arg at compile time */
+    }
+
+    /*
+     * Package objects are a special case because they cannot by implicitly
+     * converted to/from anything. Check for these two illegal cases:
+     *
+     *      Store (non-package, package)
+     *      Store (package, non-package)
+     */
+    SourceOperandBtype = AnGetBtype (SourceOperandOp);
+    TargetOperandBtype = AnGetBtype (TargetOperandOp);
+
+    /* Check source first for (package, non-package) case */
+
+    if (SourceOperandBtype & ACPI_BTYPE_PACKAGE)
+    {
+        /* If Source is PACKAGE-->Target must be PACKAGE */
+
+        if (!(TargetOperandBtype & ACPI_BTYPE_PACKAGE))
+        {
+            AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, TargetOperandOp,
+                "Source is [Package], Target must be a package also");
+        }
+    }
+
+    /* Else check target for (non-package, package) case */
+
+    else if (TargetOperandBtype & ACPI_BTYPE_PACKAGE)
+    {
+        /* If Target is PACKAGE, Source must be PACKAGE */
+
+        if (!(SourceOperandBtype & ACPI_BTYPE_PACKAGE))
+        {
+            AslError (ASL_ERROR, ASL_MSG_INVALID_TYPE, SourceOperandOp,
+                "Target is [Package], Source must be a package also");
+        }
+    }
+}
diff --git a/usr/src/cmd/acpi/iasl/aslxref.c b/usr/src/cmd/acpi/iasl/aslxref.c
new file mode 100644
index 0000000000..a2cb6b3324
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslxref.c
@@ -0,0 +1,1272 @@
+/******************************************************************************
+ *
+ * Module Name: aslxref - Namespace cross-reference
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acparser.h"
+#include "amlcode.h"
+#include "acnamesp.h"
+#include "acdispat.h"
+
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslxref")
+
+/* Local prototypes */
+
+static ACPI_STATUS
+XfNamespaceLocateBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+XfNamespaceLocateEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_PARSE_OBJECT *
+XfGetParentMethod (
+    ACPI_PARSE_OBJECT       *Op);
+
+static BOOLEAN
+XfObjectExists (
+    char                    *Name);
+
+static ACPI_STATUS
+XfCompareOneNamespaceObject (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue);
+
+static void
+XfCheckFieldRange (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  RegionBitLength,
+    UINT32                  FieldBitOffset,
+    UINT32                  FieldBitLength,
+    UINT32                  AccessBitWidth);
+
+#ifdef __UNDER_DEVELOPMENT
+static ACPI_PARSE_OBJECT *
+XfGetParentMethod (
+    ACPI_PARSE_OBJECT       *Op);
+
+static void
+XfCheckIllegalReference (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_NAMESPACE_NODE     *Node);
+
+static BOOLEAN
+XfIsObjectParental (
+    ACPI_PARSE_OBJECT       *MethodOp1,
+    ACPI_PARSE_OBJECT       *MethodOp2);
+#endif
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfCrossReferenceNamespace
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Perform a cross reference check of the parse tree against the
+ *              namespace. Every named referenced within the parse tree
+ *              should be get resolved with a namespace lookup. If not, the
+ *              original reference in the ASL code is invalid -- i.e., refers
+ *              to a non-existent object.
+ *
+ * NOTE:  The ASL "External" operator causes the name to be inserted into the
+ *        namespace so that references to the external name will be resolved
+ *        correctly here.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+XfCrossReferenceNamespace (
+    void)
+{
+    ACPI_WALK_STATE         *WalkState;
+
+
+    /*
+     * Create a new walk state for use when looking up names
+     * within the namespace (Passed as context to the callbacks)
+     */
+    WalkState = AcpiDsCreateWalkState (0, NULL, NULL, NULL);
+    if (!WalkState)
+    {
+        return (AE_NO_MEMORY);
+    }
+
+    /* Walk the entire parse tree */
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_TWICE,
+        XfNamespaceLocateBegin, XfNamespaceLocateEnd, WalkState);
+
+    ACPI_FREE (WalkState);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfObjectExists
+ *
+ * PARAMETERS:  Name            - 4 char ACPI name
+ *
+ * RETURN:      TRUE if name exists in namespace
+ *
+ * DESCRIPTION: Walk the namespace to find an object
+ *
+ ******************************************************************************/
+
+static BOOLEAN
+XfObjectExists (
+    char                    *Name)
+{
+    ACPI_STATUS             Status;
+
+
+    /* Walk entire namespace from the supplied root */
+
+    Status = AcpiNsWalkNamespace (ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
+        ACPI_UINT32_MAX, FALSE, XfCompareOneNamespaceObject, NULL,
+        Name, NULL);
+    if (Status == AE_CTRL_TRUE)
+    {
+        /* At least one instance of the name was found */
+
+        return (TRUE);
+    }
+
+    return (FALSE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfCompareOneNamespaceObject
+ *
+ * PARAMETERS:  ACPI_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compare name of one object.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+XfCompareOneNamespaceObject (
+    ACPI_HANDLE             ObjHandle,
+    UINT32                  Level,
+    void                    *Context,
+    void                    **ReturnValue)
+{
+    ACPI_NAMESPACE_NODE     *Node = (ACPI_NAMESPACE_NODE *) ObjHandle;
+
+
+    /* Simply check the name */
+
+    if (*((UINT32 *) (Context)) == Node->Name.Integer)
+    {
+        /* Abort walk if we found one instance */
+
+        return (AE_CTRL_TRUE);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfCheckFieldRange
+ *
+ * PARAMETERS:  RegionBitLength     - Length of entire parent region
+ *              FieldBitOffset      - Start of the field unit (within region)
+ *              FieldBitLength      - Entire length of field unit
+ *              AccessBitWidth      - Access width of the field unit
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Check one field unit to make sure it fits in the parent
+ *              op region.
+ *
+ * Note: AccessBitWidth must be either 8,16,32, or 64
+ *
+ ******************************************************************************/
+
+static void
+XfCheckFieldRange (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  RegionBitLength,
+    UINT32                  FieldBitOffset,
+    UINT32                  FieldBitLength,
+    UINT32                  AccessBitWidth)
+{
+    UINT32                  FieldEndBitOffset;
+
+
+    /*
+     * Check each field unit against the region size. The entire
+     * field unit (start offset plus length) must fit within the
+     * region.
+     */
+    FieldEndBitOffset = FieldBitOffset + FieldBitLength;
+
+    if (FieldEndBitOffset > RegionBitLength)
+    {
+        /* Field definition itself is beyond the end-of-region */
+
+        AslError (ASL_ERROR, ASL_MSG_FIELD_UNIT_OFFSET, Op, NULL);
+        return;
+    }
+
+    /*
+     * Now check that the field plus AccessWidth doesn't go beyond
+     * the end-of-region. Assumes AccessBitWidth is a power of 2
+     */
+    FieldEndBitOffset = ACPI_ROUND_UP (FieldEndBitOffset, AccessBitWidth);
+
+    if (FieldEndBitOffset > RegionBitLength)
+    {
+        /* Field definition combined with the access is beyond EOR */
+
+        AslError (ASL_ERROR, ASL_MSG_FIELD_UNIT_ACCESS_WIDTH, Op, NULL);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfGetParentMethod
+ *
+ * PARAMETERS:  Op                      - Parse Op to be checked
+ *
+ * RETURN:      Control method Op if found. NULL otherwise
+ *
+ * DESCRIPTION: Find the control method parent of a parse op. Returns NULL if
+ *              the input Op is not within a control method.
+ *
+ ******************************************************************************/
+
+static ACPI_PARSE_OBJECT *
+XfGetParentMethod (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *NextOp;
+
+
+    NextOp = Op->Asl.Parent;
+    while (NextOp)
+    {
+        if (NextOp->Asl.AmlOpcode == AML_METHOD_OP)
+        {
+            return (NextOp);
+        }
+
+        NextOp = NextOp->Asl.Parent;
+    }
+
+    return (NULL); /* No parent method found */
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfNamespaceLocateBegin
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Descending callback used during cross-reference. For named
+ *              object references, attempt to locate the name in the
+ *              namespace.
+ *
+ * NOTE: ASL references to named fields within resource descriptors are
+ *       resolved to integer values here. Therefore, this step is an
+ *       important part of the code generation. We don't know that the
+ *       name refers to a resource descriptor until now.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+XfNamespaceLocateBegin (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = (ACPI_WALK_STATE *) Context;
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_STATUS             Status;
+    ACPI_OBJECT_TYPE        ObjectType;
+    char                    *Path;
+    UINT8                   PassedArgs;
+    ACPI_PARSE_OBJECT       *NextOp;
+    ACPI_PARSE_OBJECT       *OwningOp;
+    ACPI_PARSE_OBJECT       *SpaceIdOp;
+    UINT32                  MinimumLength;
+    UINT32                  Offset;
+    UINT32                  FieldBitLength;
+    UINT32                  TagBitLength;
+    UINT8                   Message = 0;
+    const ACPI_OPCODE_INFO  *OpInfo;
+    UINT32                  Flags;
+    ASL_METHOD_LOCAL        *MethodLocals = NULL;
+    ASL_METHOD_LOCAL        *MethodArgs = NULL;
+    int                     RegisterNumber;
+    UINT32                  i;
+
+
+    ACPI_FUNCTION_TRACE_PTR (XfNamespaceLocateBegin, Op);
+
+
+    if ((Op->Asl.AmlOpcode == AML_METHOD_OP) && Op->Asl.Node)
+    {
+        Node = Op->Asl.Node;
+
+        /* Support for method LocalX/ArgX analysis */
+
+        if (!Node->MethodLocals)
+        {
+            /* Create local/arg info blocks */
+
+            MethodLocals = UtLocalCalloc (
+                sizeof (ASL_METHOD_LOCAL) * ACPI_METHOD_NUM_LOCALS);
+            Node->MethodLocals = MethodLocals;
+
+            MethodArgs = UtLocalCalloc (
+                sizeof (ASL_METHOD_LOCAL) * ACPI_METHOD_NUM_ARGS);
+            Node->MethodArgs = MethodArgs;
+
+            /*
+             * Get the method argument count
+             * First, get the name node
+             */
+            NextOp = Op->Asl.Child;
+
+            /* Get the NumArguments node */
+
+            NextOp = NextOp->Asl.Next;
+            Node->ArgCount = (UINT8)
+                (((UINT8) NextOp->Asl.Value.Integer) & 0x07);
+
+            /* We will track all posible ArgXs */
+
+            for (i = 0; i < ACPI_METHOD_NUM_ARGS; i++)
+            {
+                if (i < Node->ArgCount)
+                {
+                    /* Real Args are always "initialized" */
+
+                    MethodArgs[i].Flags = ASL_ARG_INITIALIZED;
+                }
+                else
+                {
+                    /* Other ArgXs can be used as locals */
+
+                    MethodArgs[i].Flags = ASL_ARG_IS_LOCAL;
+                }
+
+                MethodArgs[i].Op = Op;
+            }
+        }
+    }
+
+    /*
+     * If this node is the actual declaration of a name
+     * [such as the XXXX name in "Method (XXXX)"],
+     * we are not interested in it here. We only care about names that are
+     * references to other objects within the namespace and the parent objects
+     * of name declarations
+     */
+    if (Op->Asl.CompileFlags & NODE_IS_NAME_DECLARATION)
+    {
+        return_ACPI_STATUS (AE_OK);
+    }
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+
+    /* Check method LocalX variables */
+
+    if (OpInfo->Type == AML_TYPE_LOCAL_VARIABLE)
+    {
+        /* Find parent method Op */
+
+        NextOp = XfGetParentMethod (Op);
+        if (!NextOp)
+        {
+            return_ACPI_STATUS (AE_OK);
+        }
+
+        /* Get method node */
+
+        Node = NextOp->Asl.Node;
+
+        RegisterNumber = Op->Asl.AmlOpcode & 0x0007; /* 0x60 through 0x67 */
+        MethodLocals = Node->MethodLocals;
+
+        if (Op->Asl.CompileFlags & NODE_IS_TARGET)
+        {
+            /* Local is being initialized */
+
+            MethodLocals[RegisterNumber].Flags |= ASL_LOCAL_INITIALIZED;
+            MethodLocals[RegisterNumber].Op = Op;
+
+            return_ACPI_STATUS (AE_OK);
+        }
+
+        /* Mark this Local as referenced */
+
+        MethodLocals[RegisterNumber].Flags |= ASL_LOCAL_REFERENCED;
+        MethodLocals[RegisterNumber].Op = Op;
+
+        return_ACPI_STATUS (AE_OK);
+    }
+
+    /* Check method ArgX variables */
+
+    if (OpInfo->Type == AML_TYPE_METHOD_ARGUMENT)
+    {
+        /* Find parent method Op */
+
+        NextOp = XfGetParentMethod (Op);
+        if (!NextOp)
+        {
+            return_ACPI_STATUS (AE_OK);
+        }
+
+        /* Get method node */
+
+        Node = NextOp->Asl.Node;
+
+        /* Get Arg # */
+
+        RegisterNumber = Op->Asl.AmlOpcode - AML_ARG0; /* 0x68 through 0x6F */
+        MethodArgs = Node->MethodArgs;
+
+        if (Op->Asl.CompileFlags & NODE_IS_TARGET)
+        {
+            /* Arg is being initialized */
+
+            MethodArgs[RegisterNumber].Flags |= ASL_ARG_INITIALIZED;
+            MethodArgs[RegisterNumber].Op = Op;
+
+            return_ACPI_STATUS (AE_OK);
+        }
+
+        /* Mark this Arg as referenced */
+
+        MethodArgs[RegisterNumber].Flags |= ASL_ARG_REFERENCED;
+        MethodArgs[RegisterNumber].Op = Op;
+
+        return_ACPI_STATUS (AE_OK);
+    }
+
+    /*
+     * After method ArgX and LocalX, we are only interested in opcodes
+     * that have an associated name
+     */
+    if ((!(OpInfo->Flags & AML_NAMED)) &&
+        (!(OpInfo->Flags & AML_CREATE)) &&
+        (Op->Asl.ParseOpcode != PARSEOP_NAMESTRING) &&
+        (Op->Asl.ParseOpcode != PARSEOP_NAMESEG)    &&
+        (Op->Asl.ParseOpcode != PARSEOP_METHODCALL))
+    {
+        return_ACPI_STATUS (AE_OK);
+    }
+
+    /*
+     * One special case: CondRefOf operator - we don't care if the name exists
+     * or not at this point, just ignore it, the point of the operator is to
+     * determine if the name exists at runtime.
+     */
+    if ((Op->Asl.Parent) &&
+        (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CONDREFOF))
+    {
+        return_ACPI_STATUS (AE_OK);
+    }
+
+    /*
+     * We must enable the "search-to-root" for single NameSegs, but
+     * we have to be very careful about opening up scopes
+     */
+    Flags = ACPI_NS_SEARCH_PARENT;
+    if ((Op->Asl.ParseOpcode == PARSEOP_NAMESTRING) ||
+        (Op->Asl.ParseOpcode == PARSEOP_NAMESEG)    ||
+        (Op->Asl.ParseOpcode == PARSEOP_METHODCALL))
+    {
+        /*
+         * These are name references, do not push the scope stack
+         * for them.
+         */
+        Flags |= ACPI_NS_DONT_OPEN_SCOPE;
+    }
+
+    /* Get the NamePath from the appropriate place */
+
+    if (OpInfo->Flags & AML_NAMED)
+    {
+        /* For nearly all NAMED operators, the name reference is the first child */
+
+        Path = Op->Asl.Child->Asl.Value.String;
+        if (Op->Asl.AmlOpcode == AML_ALIAS_OP)
+        {
+            /*
+             * ALIAS is the only oddball opcode, the name declaration
+             * (alias name) is the second operand
+             */
+            Path = Op->Asl.Child->Asl.Next->Asl.Value.String;
+        }
+    }
+    else if (OpInfo->Flags & AML_CREATE)
+    {
+        /* Name must appear as the last parameter */
+
+        NextOp = Op->Asl.Child;
+        while (!(NextOp->Asl.CompileFlags & NODE_IS_NAME_DECLARATION))
+        {
+            NextOp = NextOp->Asl.Next;
+        }
+
+        Path = NextOp->Asl.Value.String;
+    }
+    else
+    {
+        Path = Op->Asl.Value.String;
+    }
+
+    ObjectType = AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode);
+    ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH,
+        "Type=%s\n", AcpiUtGetTypeName (ObjectType)));
+
+    /*
+     * Lookup the name in the namespace. Name must exist at this point, or it
+     * is an invalid reference.
+     *
+     * The namespace is also used as a lookup table for references to resource
+     * descriptors and the fields within them.
+     */
+    Gbl_NsLookupCount++;
+
+    Status = AcpiNsLookup (WalkState->ScopeInfo, Path, ObjectType,
+        ACPI_IMODE_EXECUTE, Flags, WalkState, &(Node));
+    if (ACPI_FAILURE (Status))
+    {
+        if (Status == AE_NOT_FOUND)
+        {
+            /*
+             * We didn't find the name reference by path -- we can qualify this
+             * a little better before we print an error message
+             */
+            if (strlen (Path) == ACPI_NAME_SIZE)
+            {
+                /* A simple, one-segment ACPI name */
+
+                if (XfObjectExists (Path))
+                {
+                    /*
+                     * There exists such a name, but we couldn't get to it
+                     * from this scope
+                     */
+                    AslError (ASL_ERROR, ASL_MSG_NOT_REACHABLE, Op,
+                        Op->Asl.ExternalName);
+                }
+                else
+                {
+                    /* The name doesn't exist, period */
+
+                    AslError (ASL_ERROR, ASL_MSG_NOT_EXIST,
+                        Op, Op->Asl.ExternalName);
+                }
+            }
+            else
+            {
+                /* Check for a fully qualified path */
+
+                if (Path[0] == AML_ROOT_PREFIX)
+                {
+                    /* Gave full path, the object does not exist */
+
+                    AslError (ASL_ERROR, ASL_MSG_NOT_EXIST, Op,
+                        Op->Asl.ExternalName);
+                }
+                else
+                {
+                    /*
+                     * We can't tell whether it doesn't exist or just
+                     * can't be reached.
+                     */
+                    AslError (ASL_ERROR, ASL_MSG_NOT_FOUND, Op,
+                        Op->Asl.ExternalName);
+                }
+            }
+
+            Status = AE_OK;
+        }
+
+        return_ACPI_STATUS (Status);
+    }
+
+    /* Check for a reference vs. name declaration */
+
+    if (!(OpInfo->Flags & AML_NAMED) &&
+        !(OpInfo->Flags & AML_CREATE))
+    {
+        /* This node has been referenced, mark it for reference check */
+
+        Node->Flags |= ANOBJ_IS_REFERENCED;
+
+#ifdef __UNDER_DEVELOPMENT
+
+        /* Check for an illegal reference */
+
+        XfCheckIllegalReference (Op, Node);
+#endif
+    }
+
+    /* Attempt to optimize the NamePath */
+
+    OptOptimizeNamePath (Op, OpInfo->Flags, WalkState, Path, Node);
+
+    /*
+     * 1) Dereference an alias (A name reference that is an alias)
+     *    Aliases are not nested, the alias always points to the final object
+     */
+    if ((Op->Asl.ParseOpcode != PARSEOP_ALIAS) &&
+        (Node->Type == ACPI_TYPE_LOCAL_ALIAS))
+    {
+        /* This node points back to the original PARSEOP_ALIAS */
+
+        NextOp = Node->Op;
+
+        /* The first child is the alias target op */
+
+        NextOp = NextOp->Asl.Child;
+
+        /* That in turn points back to original target alias node */
+
+        if (NextOp->Asl.Node)
+        {
+            Node = NextOp->Asl.Node;
+        }
+
+        /* Else - forward reference to alias, will be resolved later */
+    }
+
+    /* 2) Check for a reference to a resource descriptor */
+
+    if ((Node->Type == ACPI_TYPE_LOCAL_RESOURCE_FIELD) ||
+        (Node->Type == ACPI_TYPE_LOCAL_RESOURCE))
+    {
+        /*
+         * This was a reference to a field within a resource descriptor.
+         * Extract the associated field offset (either a bit or byte
+         * offset depending on the field type) and change the named
+         * reference into an integer for AML code generation
+         */
+        Offset = Node->Value;
+        TagBitLength = Node->Length;
+
+        /*
+         * If a field is being created, generate the length (in bits) of
+         * the field. Note: Opcodes other than CreateXxxField and Index
+         * can come through here. For other opcodes, we just need to
+         * convert the resource tag reference to an integer offset.
+         */
+        switch (Op->Asl.Parent->Asl.AmlOpcode)
+        {
+        case AML_CREATE_FIELD_OP: /* Variable "Length" field, in bits */
+            /*
+             * We know the length operand is an integer constant because
+             * we know that it contains a reference to a resource
+             * descriptor tag.
+             */
+            FieldBitLength = (UINT32) Op->Asl.Next->Asl.Value.Integer;
+            break;
+
+        case AML_CREATE_BIT_FIELD_OP:
+
+            FieldBitLength = 1;
+            break;
+
+        case AML_CREATE_BYTE_FIELD_OP:
+        case AML_INDEX_OP:
+
+            FieldBitLength = 8;
+            break;
+
+        case AML_CREATE_WORD_FIELD_OP:
+
+            FieldBitLength = 16;
+            break;
+
+        case AML_CREATE_DWORD_FIELD_OP:
+
+            FieldBitLength = 32;
+            break;
+
+        case AML_CREATE_QWORD_FIELD_OP:
+
+            FieldBitLength = 64;
+            break;
+
+        default:
+
+            FieldBitLength = 0;
+            break;
+        }
+
+        /* Check the field length against the length of the resource tag */
+
+        if (FieldBitLength)
+        {
+            if (TagBitLength < FieldBitLength)
+            {
+                Message = ASL_MSG_TAG_SMALLER;
+            }
+            else if (TagBitLength > FieldBitLength)
+            {
+                Message = ASL_MSG_TAG_LARGER;
+            }
+
+            if (Message)
+            {
+                sprintf (MsgBuffer,
+                    "Size mismatch, Tag: %u bit%s, Field: %u bit%s",
+                    TagBitLength, (TagBitLength > 1) ? "s" : "",
+                    FieldBitLength, (FieldBitLength > 1) ? "s" : "");
+
+                AslError (ASL_WARNING, Message, Op, MsgBuffer);
+            }
+        }
+
+        /* Convert the BitOffset to a ByteOffset for certain opcodes */
+
+        switch (Op->Asl.Parent->Asl.AmlOpcode)
+        {
+        case AML_CREATE_BYTE_FIELD_OP:
+        case AML_CREATE_WORD_FIELD_OP:
+        case AML_CREATE_DWORD_FIELD_OP:
+        case AML_CREATE_QWORD_FIELD_OP:
+        case AML_INDEX_OP:
+
+            Offset = ACPI_DIV_8 (Offset);
+            break;
+
+        default:
+
+            break;
+        }
+
+        /* Now convert this node to an integer whose value is the field offset */
+
+        Op->Asl.AmlLength = 0;
+        Op->Asl.ParseOpcode = PARSEOP_INTEGER;
+        Op->Asl.Value.Integer = (UINT64) Offset;
+        Op->Asl.CompileFlags |= NODE_IS_RESOURCE_FIELD;
+
+        OpcGenerateAmlOpcode (Op);
+    }
+
+    /* 3) Check for a method invocation */
+
+    else if ((((Op->Asl.ParseOpcode == PARSEOP_NAMESTRING) || (Op->Asl.ParseOpcode == PARSEOP_NAMESEG)) &&
+                (Node->Type == ACPI_TYPE_METHOD) &&
+                (Op->Asl.Parent) &&
+                (Op->Asl.Parent->Asl.ParseOpcode != PARSEOP_METHOD))   ||
+
+                (Op->Asl.ParseOpcode == PARSEOP_METHODCALL))
+    {
+        /*
+         * A reference to a method within one of these opcodes is not an
+         * invocation of the method, it is simply a reference to the method.
+         */
+        if ((Op->Asl.Parent) &&
+           ((Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_REFOF)      ||
+            (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_DEREFOF)    ||
+            (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_PACKAGE)    ||
+            (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_VAR_PACKAGE)||
+            (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_OBJECTTYPE)))
+        {
+            return_ACPI_STATUS (AE_OK);
+        }
+        /*
+         * There are two types of method invocation:
+         * 1) Invocation with arguments -- the parser recognizes this
+         *    as a METHODCALL.
+         * 2) Invocation with no arguments --the parser cannot determine that
+         *    this is a method invocation, therefore we have to figure it out
+         *    here.
+         */
+        if (Node->Type != ACPI_TYPE_METHOD)
+        {
+            sprintf (MsgBuffer, "%s is a %s",
+                Op->Asl.ExternalName, AcpiUtGetTypeName (Node->Type));
+
+            AslError (ASL_ERROR, ASL_MSG_NOT_METHOD, Op, MsgBuffer);
+            return_ACPI_STATUS (AE_OK);
+        }
+
+        /* Save the method node in the caller's op */
+
+        Op->Asl.Node = Node;
+        if (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CONDREFOF)
+        {
+            return_ACPI_STATUS (AE_OK);
+        }
+
+        /*
+         * This is a method invocation, with or without arguments.
+         * Count the number of arguments, each appears as a child
+         * under the parent node
+         */
+        Op->Asl.ParseOpcode = PARSEOP_METHODCALL;
+        UtSetParseOpName (Op);
+
+        PassedArgs = 0;
+        NextOp = Op->Asl.Child;
+
+        while (NextOp)
+        {
+            PassedArgs++;
+            NextOp = NextOp->Asl.Next;
+        }
+
+        if (Node->Value != ASL_EXTERNAL_METHOD &&
+            Op->Asl.Parent->Asl.ParseOpcode != PARSEOP_EXTERNAL)
+        {
+            /*
+             * Check the parsed arguments with the number expected by the
+             * method declaration itself
+             */
+            if (PassedArgs != Node->Value)
+            {
+                sprintf (MsgBuffer, "%s requires %u", Op->Asl.ExternalName,
+                            Node->Value);
+
+                if (PassedArgs < Node->Value)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_ARG_COUNT_LO, Op, MsgBuffer);
+                }
+                else
+                {
+                    AslError (ASL_ERROR, ASL_MSG_ARG_COUNT_HI, Op, MsgBuffer);
+                }
+            }
+        }
+    }
+
+    /* 4) Check for an ASL Field definition */
+
+    else if ((Op->Asl.Parent) &&
+            ((Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_FIELD)     ||
+             (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_BANKFIELD)))
+    {
+        /*
+         * Offset checking for fields. If the parent operation region has a
+         * constant length (known at compile time), we can check fields
+         * defined in that region against the region length. This will catch
+         * fields and field units that cannot possibly fit within the region.
+         *
+         * Note: Index fields do not directly reference an operation region,
+         * thus they are not included in this check.
+         */
+        if (Op == Op->Asl.Parent->Asl.Child)
+        {
+            /*
+             * This is the first child of the field node, which is
+             * the name of the region. Get the parse node for the
+             * region -- which contains the length of the region.
+             */
+            OwningOp = Node->Op;
+            Op->Asl.Parent->Asl.ExtraValue =
+                ACPI_MUL_8 ((UINT32) OwningOp->Asl.Value.Integer);
+
+            /* Examine the field access width */
+
+            switch ((UINT8) Op->Asl.Parent->Asl.Value.Integer)
+            {
+            case AML_FIELD_ACCESS_ANY:
+            case AML_FIELD_ACCESS_BYTE:
+            case AML_FIELD_ACCESS_BUFFER:
+            default:
+
+                MinimumLength = 1;
+                break;
+
+            case AML_FIELD_ACCESS_WORD:
+
+                MinimumLength = 2;
+                break;
+
+            case AML_FIELD_ACCESS_DWORD:
+
+                MinimumLength = 4;
+                break;
+
+            case AML_FIELD_ACCESS_QWORD:
+
+                MinimumLength = 8;
+                break;
+            }
+
+            /*
+             * Is the region at least as big as the access width?
+             * Note: DataTableRegions have 0 length
+             */
+            if (((UINT32) OwningOp->Asl.Value.Integer) &&
+                ((UINT32) OwningOp->Asl.Value.Integer < MinimumLength))
+            {
+                AslError (ASL_ERROR, ASL_MSG_FIELD_ACCESS_WIDTH, Op, NULL);
+            }
+
+            /*
+             * Check EC/CMOS/SMBUS fields to make sure that the correct
+             * access type is used (BYTE for EC/CMOS, BUFFER for SMBUS)
+             */
+            SpaceIdOp = OwningOp->Asl.Child->Asl.Next;
+            switch ((UINT32) SpaceIdOp->Asl.Value.Integer)
+            {
+            case ACPI_ADR_SPACE_EC:
+            case ACPI_ADR_SPACE_CMOS:
+            case ACPI_ADR_SPACE_GPIO:
+
+                if ((UINT8) Op->Asl.Parent->Asl.Value.Integer !=
+                    AML_FIELD_ACCESS_BYTE)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_REGION_BYTE_ACCESS, Op, NULL);
+                }
+                break;
+
+            case ACPI_ADR_SPACE_SMBUS:
+            case ACPI_ADR_SPACE_IPMI:
+            case ACPI_ADR_SPACE_GSBUS:
+
+                if ((UINT8) Op->Asl.Parent->Asl.Value.Integer !=
+                    AML_FIELD_ACCESS_BUFFER)
+                {
+                    AslError (ASL_ERROR, ASL_MSG_REGION_BUFFER_ACCESS, Op, NULL);
+                }
+                break;
+
+            default:
+
+                /* Nothing to do for other address spaces */
+
+                break;
+            }
+        }
+        else
+        {
+            /*
+             * This is one element of the field list. Check to make sure
+             * that it does not go beyond the end of the parent operation region.
+             *
+             * In the code below:
+             *    Op->Asl.Parent->Asl.ExtraValue      - Region Length (bits)
+             *    Op->Asl.ExtraValue                  - Field start offset (bits)
+             *    Op->Asl.Child->Asl.Value.Integer32  - Field length (bits)
+             *    Op->Asl.Child->Asl.ExtraValue       - Field access width (bits)
+             */
+            if (Op->Asl.Parent->Asl.ExtraValue && Op->Asl.Child)
+            {
+                XfCheckFieldRange (Op,
+                    Op->Asl.Parent->Asl.ExtraValue,
+                    Op->Asl.ExtraValue,
+                    (UINT32) Op->Asl.Child->Asl.Value.Integer,
+                    Op->Asl.Child->Asl.ExtraValue);
+            }
+        }
+    }
+
+    /* 5) Check for a connection object */
+#if 0
+    else if (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_CONNECTION)
+    {
+        return_ACPI_STATUS (Status);
+    }
+#endif
+
+    Op->Asl.Node = Node;
+    return_ACPI_STATUS (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfNamespaceLocateEnd
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Ascending callback used during cross reference. We only
+ *              need to worry about scope management here.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+XfNamespaceLocateEnd (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ACPI_WALK_STATE         *WalkState = (ACPI_WALK_STATE *) Context;
+    const ACPI_OPCODE_INFO  *OpInfo;
+
+
+    ACPI_FUNCTION_TRACE (XfNamespaceLocateEnd);
+
+
+    /* We are only interested in opcodes that have an associated name */
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+    if (!(OpInfo->Flags & AML_NAMED))
+    {
+        return_ACPI_STATUS (AE_OK);
+    }
+
+    /* Not interested in name references, we did not open a scope for them */
+
+    if ((Op->Asl.ParseOpcode == PARSEOP_NAMESTRING) ||
+        (Op->Asl.ParseOpcode == PARSEOP_NAMESEG)    ||
+        (Op->Asl.ParseOpcode == PARSEOP_METHODCALL))
+    {
+        return_ACPI_STATUS (AE_OK);
+    }
+
+    /* Pop the scope stack if necessary */
+
+    if (AcpiNsOpensScope (AslMapNamedOpcodeToDataType (Op->Asl.AmlOpcode)))
+    {
+
+        ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH,
+            "%s: Popping scope for Op %p\n",
+            AcpiUtGetTypeName (OpInfo->ObjectType), Op));
+
+        (void) AcpiDsScopeStackPop (WalkState);
+    }
+
+    return_ACPI_STATUS (AE_OK);
+}
+
+
+#ifdef __UNDER_DEVELOPMENT
+/*******************************************************************************
+ *
+ * FUNCTION:    XfIsObjectParental
+ *
+ * PARAMETERS:  ChildOp                 - Op to be checked
+ *              PossibleParentOp        - Determine if this op is in the family
+ *
+ * RETURN:      TRUE if ChildOp is a descendent of PossibleParentOp
+ *
+ * DESCRIPTION: Determine if an Op is a descendent of another Op. Used to
+ *              detect if a method is declared within another method.
+ *
+ ******************************************************************************/
+
+static BOOLEAN
+XfIsObjectParental (
+    ACPI_PARSE_OBJECT       *ChildOp,
+    ACPI_PARSE_OBJECT       *PossibleParentOp)
+{
+    ACPI_PARSE_OBJECT       *ParentOp;
+
+
+    /* Search upwards through the tree for possible parent */
+
+    ParentOp = ChildOp;
+    while (ParentOp)
+    {
+        if (ParentOp == PossibleParentOp)
+        {
+            return (TRUE);
+        }
+
+        ParentOp = ParentOp->Asl.Parent;
+    }
+
+    return (FALSE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfGetParentMethod
+ *
+ * PARAMETERS:  Op                      - Op to be checked
+ *
+ * RETURN:      Op for parent method. NULL if object is not within a method.
+ *
+ * DESCRIPTION: Determine if an object is within a control method. Used to
+ *              implement special rules for named references from within a
+ *              control method.
+ *
+ * NOTE: It would be better to have the parser set a flag in the Op if possible.
+ *
+ ******************************************************************************/
+
+static ACPI_PARSE_OBJECT *
+XfGetParentMethod (
+    ACPI_PARSE_OBJECT       *Op)
+{
+    ACPI_PARSE_OBJECT       *ParentOp;
+
+
+    if (!Op)
+    {
+        return (NULL);
+    }
+
+    if (Op->Asl.ParseOpcode == PARSEOP_METHOD)
+    {
+        return (NULL);
+    }
+
+    /* Walk upwards through the parse tree, up to the root if necessary */
+
+    ParentOp = Op;
+    while (ParentOp)
+    {
+        if (ParentOp->Asl.ParseOpcode == PARSEOP_METHOD)
+        {
+            return (ParentOp);
+        }
+
+        ParentOp = ParentOp->Asl.Parent;
+    }
+
+    /* Object is not within a method */
+
+    return (NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    XfCheckIllegalReference
+ *
+ * PARAMETERS:  Op                      - Op referring to the target
+ *              TargetNode              - Target of the reference
+ *
+ * RETURN:      None. Emits error message for an illegal reference
+ *
+ * DESCRIPTION: Determine if a named reference is legal. A "named" reference
+ *              is something like: Store(ABCD, ...), where ABCD is an AML
+ *              Nameseg or Namepath.
+ *
+ * NOTE: Caller must ensure that the name Op is in fact a reference, and not
+ *       an actual name declaration (creation of a named object).
+ *
+ ******************************************************************************/
+
+static void
+XfCheckIllegalReference (
+    ACPI_PARSE_OBJECT       *Op,
+    ACPI_NAMESPACE_NODE     *TargetNode)
+{
+    ACPI_PARSE_OBJECT       *MethodOp1;
+    ACPI_PARSE_OBJECT       *MethodOp2;
+    ACPI_PARSE_OBJECT       *TargetOp;
+
+
+    /*
+     * Check for an illegal reference to a named object:
+     *
+     * 1) References from one control method to another, non-parent
+     *    method are not allowed, they will fail at runtime.
+     *
+     * 2) Forward references within a control method are not allowed.
+     *    AML interpreters use a one-pass parse of control methods
+     *    so these forward references will fail at runtime.
+     */
+    TargetOp = TargetNode->Op;
+
+    MethodOp1 = XfGetParentMethod (Op);
+    MethodOp2 = XfGetParentMethod (TargetOp);
+
+    /* Are both objects within control method(s)? */
+
+    if (!MethodOp1 || !MethodOp2)
+    {
+        return;
+    }
+
+    /* Objects not in the same method? */
+
+    if (MethodOp1 != MethodOp2)
+    {
+        /*
+         * 1) Cross-method named reference
+         *
+         * This is OK if and only if the target reference is within in a
+         * method that is a parent of current method
+         */
+        if (!XfIsObjectParental (MethodOp1, MethodOp2))
+        {
+            AslError (ASL_ERROR, ASL_MSG_ILLEGAL_METHOD_REF, Op,
+                Op->Asl.ExternalName);
+        }
+    }
+
+    /*
+     * 2) Both reference and target are in the same method. Check if this is
+     * an (illegal) forward reference by examining the exact source code
+     * location of each (the referenced object and the object declaration).
+     * This is a bit nasty, yet effective.
+     */
+    else if (Op->Asl.LogicalByteOffset < TargetOp->Asl.LogicalByteOffset)
+    {
+        AslError (ASL_ERROR, ASL_MSG_ILLEGAL_FORWARD_REF, Op,
+            Op->Asl.ExternalName);
+    }
+
+}
+#endif
diff --git a/usr/src/cmd/acpi/iasl/aslxrefout.c b/usr/src/cmd/acpi/iasl/aslxrefout.c
new file mode 100644
index 0000000000..701399cbae
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/aslxrefout.c
@@ -0,0 +1,814 @@
+/******************************************************************************
+ *
+ * Module Name: aslxrefout.c - support for optional cross-reference file
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "aslcompiler.y.h"
+#include "acnamesp.h"
+#include "acparser.h"
+#include "amlcode.h"
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("aslxrefout")
+
+
+/* Local prototypes */
+
+static ACPI_STATUS
+OtXrefWalkPart2 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+OtXrefWalkPart3 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+OtXrefAnalysisWalkPart1 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+static ACPI_STATUS
+OtXrefAnalysisWalkPart2 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+static ACPI_STATUS
+OtXrefAnalysisWalkPart3 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtPrintHeaders
+ *
+ * PARAMETERS:  Message             - Main header message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Emits the main header message along with field descriptions
+ *
+ ******************************************************************************/
+
+void
+OtPrintHeaders (
+    char                    *Message)
+{
+    UINT32                  Length;
+
+
+    Length = strlen (Message);
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT, "\n\n%s\n", Message);
+    while (Length)
+    {
+        FlPrintFile (ASL_FILE_XREF_OUTPUT, "-");
+        Length--;
+    }
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT, "\n\nLineno   %-40s Description\n",
+        "Full Pathname");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtCreateXrefFile
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION  Main entry point for parts 2 and 3 of the cross-reference
+ *              file.
+ *
+ ******************************************************************************/
+
+void
+OtCreateXrefFile (
+    void)
+{
+    ASL_XREF_INFO           XrefInfo;
+
+
+    /* Build cross-reference output file if requested */
+
+    if (!Gbl_CrossReferenceOutput)
+    {
+        return;
+    }
+
+    memset (&XrefInfo, 0, sizeof (ASL_XREF_INFO));
+
+    /* Cross-reference output file, part 2 (Method invocations) */
+
+    OtPrintHeaders ("Part 2: Method Reference Map "
+        "(Invocations of each user-defined control method)");
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        OtXrefWalkPart2, NULL, &XrefInfo);
+
+    /* Cross-reference output file, part 3 (All other object refs) */
+
+    OtPrintHeaders ("Part 3: Full Object Reference Map "
+        "(Methods that reference each object in namespace");
+
+    TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        OtXrefWalkPart3, NULL, &XrefInfo);
+
+    /* Cross-reference summary */
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT, "\n\nObject Summary\n");
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "\nTotal methods:                   %u\n",
+        XrefInfo.TotalPredefinedMethods + XrefInfo.TotalUserMethods);
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "Total predefined methods:        %u\n",
+        XrefInfo.TotalPredefinedMethods);
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "\nTotal user methods:              %u\n",
+        XrefInfo.TotalUserMethods);
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "Total unreferenced user methods  %u\n",
+        XrefInfo.TotalUnreferenceUserMethods);
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "\nTotal defined objects:           %u\n",
+        XrefInfo.TotalObjects);
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "Total unreferenced objects:      %u\n",
+        XrefInfo.TotalUnreferencedObjects);
+}
+
+
+/*
+ * Part 1 of the cross reference file. This part emits the namespace objects
+ * that are referenced by each control method in the namespace.
+ *
+ * Part 2 and 3 are below part 1.
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtXrefWalkPart1
+ *
+ * PARAMETERS:  Op                      - Current parse Op
+ *              Level                   - Current tree nesting level
+ *              MethodInfo              - Info block for the current method
+ *
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Entry point for the creation of the method call reference map.
+ *              For each control method in the namespace, all other methods
+ *              that invoke the method are listed. Predefined names/methods
+ *              that start with an underscore are ignored, because these are
+ *              essentially external/public interfaces.
+
+ * DESCRIPTION: Entry point for the creation of the object reference map.
+ *              For each control method in the namespace, all objects that
+ *              are referenced by the method are listed.
+ *
+ *              Called during a normal namespace walk, once per namespace
+ *              object. (MtMethodAnalysisWalkBegin)
+ *
+ ******************************************************************************/
+
+void
+OtXrefWalkPart1 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    ASL_METHOD_INFO         *MethodInfo)
+{
+    ACPI_NAMESPACE_NODE     *Node;
+    ACPI_PARSE_OBJECT       *NextOp;
+    ACPI_PARSE_OBJECT       *FieldOp;
+    char                    *ParentPath;
+    UINT32                  Length;
+    ACPI_STATUS             Status;
+
+
+    switch (Op->Asl.ParseOpcode)
+    {
+    case PARSEOP_NAMESEG:
+    case PARSEOP_NAMESTRING:
+    case PARSEOP_METHODCALL:
+
+        if (!MethodInfo ||
+            (MethodInfo->Op->Asl.Child == Op) ||
+            !Op->Asl.Node)
+        {
+            break;
+        }
+
+        MethodInfo->CurrentOp = Op;
+        Node = Op->Asl.Node;
+
+        /* Find all objects referenced by this method */
+
+        Status = TrWalkParseTree (MethodInfo->Op, ASL_WALK_VISIT_DOWNWARD,
+            OtXrefAnalysisWalkPart1, NULL, MethodInfo);
+
+        if (Status == AE_CTRL_TERMINATE)
+        {
+            ParentPath = AcpiNsGetNormalizedPathname (Node, TRUE);
+
+            FlPrintFile (ASL_FILE_XREF_OUTPUT, "            %-40s %s",
+                ParentPath, AcpiUtGetTypeName (Node->Type));
+            ACPI_FREE (ParentPath);
+
+            switch (Node->Type)
+            {
+                /* Handle externals */
+
+            case ACPI_TYPE_ANY:
+            case ACPI_TYPE_FIELD_UNIT:
+
+                FlPrintFile (ASL_FILE_XREF_OUTPUT, " <External Object>");
+                break;
+
+            case ACPI_TYPE_INTEGER:
+
+                FlPrintFile (ASL_FILE_XREF_OUTPUT, " %8.8X%8.8X",
+                    ACPI_FORMAT_UINT64 (Op->Asl.Value.Integer));
+                break;
+
+            case ACPI_TYPE_METHOD:
+
+                FlPrintFile (ASL_FILE_XREF_OUTPUT, " Invocation (%u args)",
+                    Node->ArgCount);
+                break;
+
+            case ACPI_TYPE_BUFFER_FIELD:
+
+                NextOp = Node->Op;              /* Create Buffer Field Op */
+                switch (NextOp->Asl.ParseOpcode)
+                {
+                case PARSEOP_CREATEBITFIELD:
+                    Length = 1;
+                    break;
+
+                case PARSEOP_CREATEBYTEFIELD:
+                    Length = 8;
+                    break;
+
+                case PARSEOP_CREATEWORDFIELD:
+                    Length = 16;
+                    break;
+
+                case PARSEOP_CREATEDWORDFIELD:
+                    Length = 32;
+                    break;
+
+                case PARSEOP_CREATEQWORDFIELD:
+                    Length = 64;
+                    break;
+
+                default:
+                    Length = 0;
+                    break;
+                }
+
+                NextOp = NextOp->Asl.Child;     /* Buffer name */
+
+                if (!NextOp->Asl.ExternalName)
+                {
+                    FlPrintFile (ASL_FILE_XREF_OUTPUT, " in Arg/Local");
+                }
+                else
+                {
+                    ParentPath = AcpiNsGetNormalizedPathname (
+                        NextOp->Asl.Node, TRUE);
+
+                    FlPrintFile (ASL_FILE_XREF_OUTPUT, " (%.2u bit) in Buffer %s",
+                        Length, ParentPath);
+                    ACPI_FREE (ParentPath);
+                }
+                break;
+
+            case ACPI_TYPE_LOCAL_REGION_FIELD:
+
+                NextOp = Node->Op;
+                FieldOp = NextOp->Asl.Parent;
+                NextOp = FieldOp->Asl.Child;
+
+                ParentPath = AcpiNsGetNormalizedPathname (
+                    NextOp->Asl.Node, TRUE);
+
+                FlPrintFile (ASL_FILE_XREF_OUTPUT, " (%.2u bit) in Region %s",
+                    (UINT32) Node->Op->Asl.Child->Asl.Value.Integer,
+                    ParentPath);
+                ACPI_FREE (ParentPath);
+
+                if (FieldOp->Asl.ParseOpcode == PARSEOP_FIELD)
+                {
+                    Node = NextOp->Asl.Node;        /* Region node */
+                    NextOp = Node->Op;              /* PARSEOP_REGION */
+                    NextOp = NextOp->Asl.Child;     /* Region name */
+                    NextOp = NextOp->Asl.Next;
+
+                    /* Get region space/addr/len? */
+
+                    FlPrintFile (ASL_FILE_XREF_OUTPUT, " (%s)",
+                        AcpiUtGetRegionName ((UINT8)
+                        NextOp->Asl.Value.Integer));
+                }
+                break;
+
+            default:
+                break;
+            }
+
+            FlPrintFile (ASL_FILE_XREF_OUTPUT, "\n");
+        }
+        break;
+
+    case PARSEOP_METHOD:
+
+        ParentPath = AcpiNsGetNormalizedPathname (Op->Asl.Node, TRUE);
+
+        FlPrintFile (ASL_FILE_XREF_OUTPUT,
+            "\n[%5u]  %-40s %s Declaration (%u args)\n",
+            Op->Asl.LogicalLineNumber, ParentPath,
+            AcpiUtGetTypeName (Op->Asl.Node->Type), Op->Asl.Node->ArgCount);
+
+        ACPI_FREE (ParentPath);
+        break;
+
+    default:
+        break;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtXrefAnalysisWalkPart1
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Secondary walk for cross-reference part 1.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OtXrefAnalysisWalkPart1 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ASL_METHOD_INFO         *MethodInfo = (ASL_METHOD_INFO *) Context;
+    ACPI_PARSE_OBJECT       *Next;
+
+
+    /* Only interested in name string Ops -- ignore all others */
+
+    if ((Op->Asl.ParseOpcode != PARSEOP_NAMESEG) &&
+        (Op->Asl.ParseOpcode != PARSEOP_NAMESTRING) &&
+        (Op->Asl.ParseOpcode != PARSEOP_METHODCALL))
+    {
+        return (AE_OK);
+    }
+
+    /* No node means a locally declared object -- ignore */
+
+    if (!Op->Asl.Node)
+    {
+        return (AE_OK);
+    }
+
+    /* When we encounter the source Op, we are done */
+
+    Next = MethodInfo->CurrentOp;
+    if (Next == Op)
+    {
+        return (AE_CTRL_TERMINATE);
+    }
+
+    /* If we have a name match, this Op is a duplicate */
+
+    if ((Next->Asl.ParseOpcode == PARSEOP_NAMESEG)      ||
+        (Next->Asl.ParseOpcode == PARSEOP_NAMESTRING)   ||
+        (Next->Asl.ParseOpcode == PARSEOP_METHODCALL))
+    {
+        if (!strcmp (Op->Asl.ExternalName, Next->Asl.ExternalName))
+        {
+            return (AE_ALREADY_EXISTS);
+        }
+    }
+
+    return (AE_OK);
+}
+
+
+/*
+ * Part 2 of the cross reference file. This part emits the names of each
+ * non-predefined method in the namespace (user methods), along with the
+ * names of each control method that references that method.
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtXrefWalkPart2
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: For each control method in the namespace, we will re-walk the
+ *              namespace to find each and every invocation of that control
+ *              method. Brute force, but does not matter, even for large
+ *              namespaces. Ignore predefined names (start with underscore).
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OtXrefWalkPart2 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ASL_XREF_INFO           *XrefInfo = (ASL_XREF_INFO *) Context;
+    ACPI_NAMESPACE_NODE     *Node;
+    char                    *ParentPath;
+
+
+    /* Looking for Method Declaration Ops only */
+
+    if (!Op->Asl.Node ||
+        (Op->Asl.ParseOpcode != PARSEOP_METHOD))
+    {
+        return (AE_OK);
+    }
+
+    /* Ignore predefined names */
+
+    if (Op->Asl.Node->Name.Ascii[0] == '_')
+    {
+        XrefInfo->TotalPredefinedMethods++;
+        return (AE_OK);
+    }
+
+    Node = Op->Asl.Node;
+    ParentPath = AcpiNsGetNormalizedPathname (Node, TRUE);
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "\n[%5u]  %-40s %s Declaration (%u args)\n",
+        Op->Asl.LogicalLineNumber, ParentPath,
+        AcpiUtGetTypeName (Node->Type), Node->ArgCount);
+
+    XrefInfo->TotalUserMethods++;
+    XrefInfo->ThisMethodInvocations = 0;
+    XrefInfo->MethodOp = Op;
+
+    (void) TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        OtXrefAnalysisWalkPart2, NULL, XrefInfo);
+
+    if (!XrefInfo->ThisMethodInvocations)
+    {
+        FlPrintFile (ASL_FILE_XREF_OUTPUT,
+            "            Zero invocations of this method in this module\n");
+        XrefInfo->TotalUnreferenceUserMethods++;
+    }
+    else
+    {
+        FlPrintFile (ASL_FILE_XREF_OUTPUT,
+            "            %u invocations of method %s in this module\n",
+            XrefInfo->ThisMethodInvocations, ParentPath);
+    }
+
+    ACPI_FREE (ParentPath);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtXrefAnalysisWalkPart2
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: For every Op that is a method invocation, emit a reference
+ *              line if the Op is invoking the target method.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OtXrefAnalysisWalkPart2 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ASL_XREF_INFO           *XrefInfo = (ASL_XREF_INFO *) Context;
+    ACPI_PARSE_OBJECT       *CallerOp;
+    char                    *CallerFullPathname;
+
+
+    /* Looking for MethodCall Ops only */
+
+    if (!Op->Asl.Node ||
+        (Op->Asl.ParseOpcode != PARSEOP_METHODCALL))
+    {
+        return (AE_OK);
+    }
+
+    /* If not a match to the target method, we are done */
+
+    if (Op->Asl.Node != XrefInfo->MethodOp->Asl.Node)
+    {
+        return (AE_CTRL_DEPTH);
+    }
+
+    /* Find parent method to get method caller namepath */
+
+    CallerOp = Op->Asl.Parent;
+    while (CallerOp &&
+        (CallerOp->Asl.ParseOpcode != PARSEOP_METHOD))
+    {
+        CallerOp = CallerOp->Asl.Parent;
+    }
+
+    /* There is no parent method for External() statements */
+
+    if (!CallerOp)
+    {
+        return (AE_OK);
+    }
+
+    CallerFullPathname = AcpiNsGetNormalizedPathname (
+        CallerOp->Asl.Node, TRUE);
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "[%5u]     %-40s Invocation path: %s\n",
+        Op->Asl.LogicalLineNumber, CallerFullPathname,
+        Op->Asl.ExternalName);
+
+    ACPI_FREE (CallerFullPathname);
+    XrefInfo->ThisMethodInvocations++;
+    return (AE_OK);
+}
+
+
+/*
+ * Part 3 of the cross reference file. This part emits the names of each
+ * non-predefined method in the namespace (user methods), along with the
+ * names of each control method that references that method.
+ */
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtXrefWalkPart3
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Cross-reference part 3. references to objects other than
+ *              control methods.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OtXrefWalkPart3 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ASL_XREF_INFO           *XrefInfo = (ASL_XREF_INFO *) Context;
+    ACPI_NAMESPACE_NODE     *Node;
+    char                    *ParentPath;
+    const ACPI_OPCODE_INFO  *OpInfo;
+
+
+    /* Ignore method declarations */
+
+    if (!Op->Asl.Node ||
+        (Op->Asl.ParseOpcode == PARSEOP_METHOD))
+    {
+        return (AE_OK);
+    }
+
+    OpInfo = AcpiPsGetOpcodeInfo (Op->Asl.AmlOpcode);
+    if (!(OpInfo->Class & AML_CLASS_NAMED_OBJECT))
+    {
+        return (AE_OK);
+    }
+
+    /* Only care about named object creation opcodes */
+
+    if ((Op->Asl.ParseOpcode != PARSEOP_NAME) &&
+        (Op->Asl.ParseOpcode != PARSEOP_DEVICE) &&
+        (Op->Asl.ParseOpcode != PARSEOP_MUTEX) &&
+        (Op->Asl.ParseOpcode != PARSEOP_OPERATIONREGION) &&
+        (Op->Asl.ParseOpcode != PARSEOP_FIELD) &&
+        (Op->Asl.ParseOpcode != PARSEOP_EVENT))
+    {
+        return (AE_OK);
+    }
+
+    /* Ignore predefined names */
+
+    if (Op->Asl.Node->Name.Ascii[0] == '_')
+    {
+        return (AE_OK);
+    }
+
+    Node = Op->Asl.Node;
+    ParentPath = AcpiNsGetNormalizedPathname (Node, TRUE);
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "\n[%5u]  %-40s %s Declaration\n",
+        Op->Asl.LogicalLineNumber, ParentPath,
+        AcpiUtGetTypeName (Node->Type));
+    ACPI_FREE (ParentPath);
+
+    XrefInfo->MethodOp = Op;
+    XrefInfo->ThisObjectReferences = 0;
+    XrefInfo->TotalObjects = 0;
+
+    (void) TrWalkParseTree (Gbl_ParseTreeRoot, ASL_WALK_VISIT_DOWNWARD,
+        OtXrefAnalysisWalkPart3, NULL, XrefInfo);
+
+    if (!XrefInfo->ThisObjectReferences)
+    {
+        FlPrintFile (ASL_FILE_XREF_OUTPUT,
+            "            Zero references to this object in this module\n");
+        XrefInfo->TotalUnreferencedObjects++;
+    }
+    else
+    {
+        FlPrintFile (ASL_FILE_XREF_OUTPUT,
+            "            %u references to this object in this module\n",
+            XrefInfo->ThisObjectReferences, ParentPath);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    OtXrefAnalysisWalkPart3
+ *
+ * PARAMETERS:  ASL_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Secondary walk for cross-reference part 3.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+OtXrefAnalysisWalkPart3 (
+    ACPI_PARSE_OBJECT       *Op,
+    UINT32                  Level,
+    void                    *Context)
+{
+    ASL_XREF_INFO           *XrefInfo = (ASL_XREF_INFO *) Context;
+    char                    *CallerFullPathname = NULL;
+    ACPI_PARSE_OBJECT       *CallerOp;
+    const char              *Operator;
+
+
+    if (!Op->Asl.Node)
+    {
+        return (AE_OK);
+    }
+
+    XrefInfo->TotalObjects++;
+
+    /* Ignore Op that actually defined the object */
+
+    if (Op == XrefInfo->MethodOp)
+    {
+        return (AE_OK);
+    }
+
+    /* Only interested in Ops that reference the target node */
+
+    if (Op->Asl.Node != XrefInfo->MethodOp->Asl.Node)
+    {
+        return (AE_OK);
+    }
+
+    /* Find parent "open scope" object to get method caller namepath */
+
+    CallerOp = Op->Asl.Parent;
+    while (CallerOp &&
+        (CallerOp->Asl.ParseOpcode != PARSEOP_NAME) &&
+        (CallerOp->Asl.ParseOpcode != PARSEOP_METHOD) &&
+        (CallerOp->Asl.ParseOpcode != PARSEOP_DEVICE) &&
+        (CallerOp->Asl.ParseOpcode != PARSEOP_POWERRESOURCE) &&
+        (CallerOp->Asl.ParseOpcode != PARSEOP_PROCESSOR) &&
+        (CallerOp->Asl.ParseOpcode != PARSEOP_THERMALZONE))
+    {
+        CallerOp = CallerOp->Asl.Parent;
+    }
+
+    if (CallerOp == XrefInfo->CurrentMethodOp)
+    {
+        return (AE_OK);
+    }
+
+    /* Null CallerOp means the caller is at the namespace root */
+
+    if (CallerOp)
+    {
+        CallerFullPathname = AcpiNsGetNormalizedPathname (
+            CallerOp->Asl.Node, TRUE);
+    }
+
+    /* There are some special cases for the oddball operators */
+
+    if (Op->Asl.ParseOpcode == PARSEOP_SCOPE)
+    {
+        Operator = "Scope";
+    }
+    else if (Op->Asl.Parent->Asl.ParseOpcode == PARSEOP_ALIAS)
+    {
+        Operator = "Alias";
+    }
+    else if (!CallerOp)
+    {
+        Operator = "ModLevel";
+    }
+    else
+    {
+        Operator = AcpiUtGetTypeName (CallerOp->Asl.Node->Type);
+    }
+
+    FlPrintFile (ASL_FILE_XREF_OUTPUT,
+        "[%5u]     %-40s %-8s via path: %s, Operator: %s\n",
+        Op->Asl.LogicalLineNumber,
+        CallerFullPathname ? CallerFullPathname : "<root>",
+        Operator,
+        Op->Asl.ExternalName,
+        Op->Asl.Parent->Asl.ParseOpName);
+
+    if (!CallerOp)
+    {
+        CallerOp = ACPI_TO_POINTER (0xFFFFFFFF);
+    }
+
+    if (CallerFullPathname)
+    {
+        ACPI_FREE (CallerFullPathname);
+    }
+
+    XrefInfo->CurrentMethodOp = CallerOp;
+    XrefInfo->ThisObjectReferences++;
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/dtcompile.c b/usr/src/cmd/acpi/iasl/dtcompile.c
new file mode 100644
index 0000000000..704b55f871
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtcompile.c
@@ -0,0 +1,728 @@
+/******************************************************************************
+ *
+ * Module Name: dtcompile.c - Front-end for data table compiler
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#define _DECLARE_DT_GLOBALS
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dtcompile")
+
+static char                 VersionString[9];
+
+
+/* Local prototypes */
+
+static ACPI_STATUS
+DtInitialize (
+    void);
+
+static ACPI_STATUS
+DtCompileDataTable (
+    DT_FIELD                **Field);
+
+static void
+DtInsertCompilerIds (
+    DT_FIELD                *FieldList);
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtDoCompile
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Main entry point for the data table compiler.
+ *
+ * Note: Assumes Gbl_Files[ASL_FILE_INPUT] is initialized and the file is
+ *          open at seek offset zero.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtDoCompile (
+    void)
+{
+    ACPI_STATUS             Status;
+    UINT8                   Event;
+    DT_FIELD                *FieldList;
+
+
+    /* Initialize globals */
+
+    Status = DtInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        printf ("Error during compiler initialization, 0x%X\n", Status);
+        return (Status);
+    }
+
+    /* Preprocessor */
+
+    if (Gbl_PreprocessFlag)
+    {
+        /* Preprocessor */
+
+        Event = UtBeginEvent ("Preprocess input file");
+        PrDoPreprocess ();
+        UtEndEvent (Event);
+
+        if (Gbl_PreprocessOnly)
+        {
+            return (AE_OK);
+        }
+    }
+
+    /*
+     * Scan the input file (file is already open) and
+     * build the parse tree
+     */
+    Event = UtBeginEvent ("Scan and parse input file");
+    FieldList = DtScanFile (Gbl_Files[ASL_FILE_INPUT].Handle);
+    UtEndEvent (Event);
+
+    /* Did the parse tree get successfully constructed? */
+
+    if (!FieldList)
+    {
+        /* TBD: temporary error message. Msgs should come from function above */
+
+        DtError (ASL_ERROR, ASL_MSG_SYNTAX, NULL,
+            "Input file does not appear to be an ASL or data table source file");
+
+        Status = AE_ERROR;
+        goto CleanupAndExit;
+    }
+
+    Event = UtBeginEvent ("Compile parse tree");
+
+    /*
+     * Compile the parse tree
+     */
+    Status = DtCompileDataTable (&FieldList);
+    UtEndEvent (Event);
+
+    if (ACPI_FAILURE (Status))
+    {
+        /* TBD: temporary error message. Msgs should come from function above */
+
+        DtError (ASL_ERROR, ASL_MSG_SYNTAX, NULL,
+            "Could not compile input file");
+
+        goto CleanupAndExit;
+    }
+
+    /* Create/open the binary output file */
+
+    Gbl_Files[ASL_FILE_AML_OUTPUT].Filename = NULL;
+    Status = FlOpenAmlOutputFile (Gbl_OutputFilenamePrefix);
+    if (ACPI_FAILURE (Status))
+    {
+        goto CleanupAndExit;
+    }
+
+    /* Write the binary, then the optional hex file */
+
+    DtOutputBinary (Gbl_RootTable);
+    HxDoHexOutput ();
+    DtWriteTableToListing ();
+
+CleanupAndExit:
+
+    AcpiUtDeleteCaches ();
+    DtDeleteCaches ();
+    CmCleanupAndExit ();
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtInitialize
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Initialize data table compiler globals. Enables multiple
+ *              compiles per invocation.
+ *
+ *****************************************************************************/
+
+static ACPI_STATUS
+DtInitialize (
+    void)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = AcpiOsInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = AcpiUtInitGlobals ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Gbl_FieldList = NULL;
+    Gbl_RootTable = NULL;
+    Gbl_SubtableStack = NULL;
+
+    sprintf (VersionString, "%X", (UINT32) ACPI_CA_VERSION);
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtInsertCompilerIds
+ *
+ * PARAMETERS:  FieldList           - Current field list pointer
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert the IDs (Name, Version) of the current compiler into
+ *              the original ACPI table header.
+ *
+ *****************************************************************************/
+
+static void
+DtInsertCompilerIds (
+    DT_FIELD                *FieldList)
+{
+    DT_FIELD                *Next;
+    UINT32                  i;
+
+
+    /*
+     * Don't insert current compiler ID if requested. Used for compiler
+     * debug/validation only.
+     */
+    if (Gbl_UseOriginalCompilerId)
+    {
+        return;
+    }
+
+    /* Walk to the Compiler fields at the end of the header */
+
+    Next = FieldList;
+    for (i = 0; i < 7; i++)
+    {
+        Next = Next->Next;
+    }
+
+    Next->Value = ASL_CREATOR_ID;
+    Next->Flags = DT_FIELD_NOT_ALLOCATED;
+
+    Next = Next->Next;
+    Next->Value = VersionString;
+    Next->Flags = DT_FIELD_NOT_ALLOCATED;
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileDataTable
+ *
+ * PARAMETERS:  FieldList           - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Entry point to compile one data table
+ *
+ *****************************************************************************/
+
+static ACPI_STATUS
+DtCompileDataTable (
+    DT_FIELD                **FieldList)
+{
+    const ACPI_DMTABLE_DATA *TableData;
+    DT_SUBTABLE             *Subtable;
+    char                    *Signature;
+    ACPI_TABLE_HEADER       *AcpiTableHeader;
+    ACPI_STATUS             Status;
+    DT_FIELD                *RootField = *FieldList;
+
+
+    /* Verify that we at least have a table signature and save it */
+
+    Signature = DtGetFieldValue (*FieldList);
+    if (!Signature)
+    {
+        sprintf (MsgBuffer, "Expected \"%s\"", "Signature");
+        DtNameError (ASL_ERROR, ASL_MSG_INVALID_FIELD_NAME,
+            *FieldList, MsgBuffer);
+        return (AE_ERROR);
+    }
+
+    Gbl_Signature = UtStringCacheCalloc (strlen (Signature) + 1);
+    strcpy (Gbl_Signature, Signature);
+
+    /*
+     * Handle tables that don't use the common ACPI table header structure.
+     * Currently, these are the FACS and RSDP. Also check for an OEMx table,
+     * these tables have user-defined contents.
+     */
+    if (ACPI_COMPARE_NAME (Signature, ACPI_SIG_FACS))
+    {
+        Status = DtCompileFacs (FieldList);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtSetTableLength ();
+        return (Status);
+    }
+    else if (ACPI_VALIDATE_RSDP_SIG (Signature))
+    {
+        Status = DtCompileRsdp (FieldList);
+        return (Status);
+    }
+    else if (ACPI_COMPARE_NAME (Signature, ACPI_SIG_S3PT))
+    {
+        Status = DtCompileS3pt (FieldList);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtSetTableLength ();
+        return (Status);
+    }
+
+    /*
+     * All other tables must use the common ACPI table header. Insert the
+     * current iASL IDs (name, version), and compile the header now.
+     */
+    DtInsertCompilerIds (*FieldList);
+
+    Status = DtCompileTable (FieldList, AcpiDmTableInfoHeader,
+        &Gbl_RootTable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    DtPushSubtable (Gbl_RootTable);
+
+    /* Validate the signature via the ACPI table list */
+
+    TableData = AcpiDmGetTableData (Signature);
+    if (!TableData || Gbl_CompileGeneric)
+    {
+        /* Unknown table signature and/or force generic compile */
+
+        DtCompileGeneric ((void **) FieldList, NULL, NULL);
+        goto FinishHeader;
+    }
+
+    /* Dispatch to per-table compile */
+
+    if (TableData->CmTableHandler)
+    {
+        /* Complex table, has a handler */
+
+        Status = TableData->CmTableHandler ((void **) FieldList);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+    }
+    else if (TableData->TableInfo)
+    {
+        /* Simple table, just walk the info table */
+
+        Subtable = NULL;
+        Status = DtCompileTable (FieldList, TableData->TableInfo,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (Gbl_RootTable, Subtable);
+        DtPopSubtable ();
+    }
+    else
+    {
+        DtFatal (ASL_MSG_COMPILER_INTERNAL, *FieldList,
+            "Missing table dispatch info");
+        return (AE_ERROR);
+    }
+
+FinishHeader:
+
+    /* Set the final table length and then the checksum */
+
+    DtSetTableLength ();
+    AcpiTableHeader = ACPI_CAST_PTR (
+        ACPI_TABLE_HEADER, Gbl_RootTable->Buffer);
+    DtSetTableChecksum (&AcpiTableHeader->Checksum);
+
+    DtDumpFieldList (RootField);
+    DtDumpSubtableList ();
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileTable
+ *
+ * PARAMETERS:  Field               - Current field list pointer
+ *              Info                - Info table for this ACPI table
+ *              RetSubtable         - Compile result of table
+ *              Required            - If this subtable must exist
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile a subtable
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileTable (
+    DT_FIELD                **Field,
+    ACPI_DMTABLE_INFO       *Info,
+    DT_SUBTABLE             **RetSubtable,
+    BOOLEAN                 Required)
+{
+    DT_FIELD                *LocalField;
+    UINT32                  Length;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *InlineSubtable = NULL;
+    UINT32                  FieldLength = 0;
+    UINT8                   FieldType;
+    UINT8                   *Buffer;
+    UINT8                   *FlagBuffer = NULL;
+    char                    *String;
+    UINT32                  CurrentFlagByteOffset = 0;
+    ACPI_STATUS             Status = AE_OK;
+
+
+    if (!Field || !*Field)
+    {
+        return (AE_BAD_PARAMETER);
+    }
+
+    /* Ignore optional subtable if name does not match */
+
+    if ((Info->Flags & DT_OPTIONAL) &&
+        strcmp ((*Field)->Name, Info->Name))
+    {
+        *RetSubtable = NULL;
+        return (AE_OK);
+    }
+
+    Length = DtGetSubtableLength (*Field, Info);
+    if (Length == ASL_EOF)
+    {
+        return (AE_ERROR);
+    }
+
+    Subtable = UtSubtableCacheCalloc ();
+
+    if (Length > 0)
+    {
+        String = UtStringCacheCalloc (Length);
+        Subtable->Buffer = ACPI_CAST_PTR (UINT8, String);
+    }
+
+    Subtable->Length = Length;
+    Subtable->TotalLength = Length;
+    Buffer = Subtable->Buffer;
+
+    LocalField = *Field;
+    Subtable->Name = LocalField->Name;
+
+    /*
+     * Main loop walks the info table for this ACPI table or subtable
+     */
+    for (; Info->Name; Info++)
+    {
+        if (Info->Opcode == ACPI_DMT_EXTRA_TEXT)
+        {
+            continue;
+        }
+
+        if (!LocalField)
+        {
+            sprintf (MsgBuffer, "Found NULL field - Field name \"%s\" needed",
+                Info->Name);
+            DtFatal (ASL_MSG_COMPILER_INTERNAL, NULL, MsgBuffer);
+            Status = AE_BAD_DATA;
+            goto Error;
+        }
+
+        /* Maintain table offsets */
+
+        LocalField->TableOffset = Gbl_CurrentTableOffset;
+        FieldLength = DtGetFieldLength (LocalField, Info);
+        Gbl_CurrentTableOffset += FieldLength;
+
+        FieldType = DtGetFieldType (Info);
+        Gbl_InputFieldCount++;
+
+        switch (FieldType)
+        {
+        case DT_FIELD_TYPE_FLAGS_INTEGER:
+            /*
+             * Start of the definition of a flags field.
+             * This master flags integer starts at value zero, in preparation
+             * to compile and insert the flag fields from the individual bits
+             */
+            LocalField = LocalField->Next;
+            *Field = LocalField;
+
+            FlagBuffer = Buffer;
+            CurrentFlagByteOffset = Info->Offset;
+            break;
+
+        case DT_FIELD_TYPE_FLAG:
+
+            /* Individual Flag field, can be multiple bits */
+
+            if (FlagBuffer)
+            {
+                /*
+                 * We must increment the FlagBuffer when we have crossed
+                 * into the next flags byte within the flags field
+                 * of type DT_FIELD_TYPE_FLAGS_INTEGER.
+                 */
+                FlagBuffer += (Info->Offset - CurrentFlagByteOffset);
+                CurrentFlagByteOffset = Info->Offset;
+
+                DtCompileFlag (FlagBuffer, LocalField, Info);
+            }
+            else
+            {
+                /* TBD - this is an internal error */
+            }
+
+            LocalField = LocalField->Next;
+            *Field = LocalField;
+            break;
+
+        case DT_FIELD_TYPE_INLINE_SUBTABLE:
+            /*
+             * Recursion (one level max): compile GAS (Generic Address)
+             * or Notify in-line subtable
+             */
+            *Field = LocalField;
+
+            switch (Info->Opcode)
+            {
+            case ACPI_DMT_GAS:
+
+                Status = DtCompileTable (Field, AcpiDmTableInfoGas,
+                    &InlineSubtable, TRUE);
+                break;
+
+            case ACPI_DMT_HESTNTFY:
+
+                Status = DtCompileTable (Field, AcpiDmTableInfoHestNotify,
+                    &InlineSubtable, TRUE);
+                break;
+
+            case ACPI_DMT_IORTMEM:
+
+                Status = DtCompileTable (Field, AcpiDmTableInfoIortAcc,
+                    &InlineSubtable, TRUE);
+                break;
+
+            default:
+                sprintf (MsgBuffer, "Invalid DMT opcode: 0x%.2X",
+                    Info->Opcode);
+                DtFatal (ASL_MSG_COMPILER_INTERNAL, NULL, MsgBuffer);
+                Status = AE_BAD_DATA;
+                break;
+            }
+
+            if (ACPI_FAILURE (Status))
+            {
+                goto Error;
+            }
+
+            DtSetSubtableLength (InlineSubtable);
+
+            memcpy (Buffer, InlineSubtable->Buffer, FieldLength);
+            LocalField = *Field;
+            break;
+
+        case DT_FIELD_TYPE_LABEL:
+
+            DtWriteFieldToListing (Buffer, LocalField, 0);
+            LocalField = LocalField->Next;
+            break;
+
+        default:
+
+            /* Normal case for most field types (Integer, String, etc.) */
+
+            DtCompileOneField (Buffer, LocalField,
+                FieldLength, FieldType, Info->Flags);
+
+            DtWriteFieldToListing (Buffer, LocalField, FieldLength);
+            LocalField = LocalField->Next;
+
+            if (Info->Flags & DT_LENGTH)
+            {
+                /* Field is an Integer that will contain a subtable length */
+
+                Subtable->LengthField = Buffer;
+                Subtable->SizeOfLengthField = FieldLength;
+            }
+            break;
+        }
+
+        Buffer += FieldLength;
+    }
+
+    *Field = LocalField;
+    *RetSubtable = Subtable;
+    return (AE_OK);
+
+Error:
+    ACPI_FREE (Subtable->Buffer);
+    ACPI_FREE (Subtable);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileTwoSubtables
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *              TableInfo1          - Info table 1
+ *              TableInfo1          - Info table 2
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile tables with a header and one or more same subtables.
+ *              Include CPEP, EINJ, ERST, MCFG, MSCT, WDAT
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileTwoSubtables (
+    void                    **List,
+    ACPI_DMTABLE_INFO       *TableInfo1,
+    ACPI_DMTABLE_INFO       *TableInfo2)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+
+
+    Status = DtCompileTable (PFieldList, TableInfo1, &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    while (*PFieldList)
+    {
+        Status = DtCompileTable (PFieldList, TableInfo2, &Subtable, FALSE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompilePadding
+ *
+ * PARAMETERS:  Length              - Padding field size
+ *              RetSubtable         - Compile result of table
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile a subtable for padding purpose
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompilePadding (
+    UINT32                  Length,
+    DT_SUBTABLE             **RetSubtable)
+{
+    DT_SUBTABLE             *Subtable;
+    /* UINT8                   *Buffer; */
+    char                    *String;
+
+
+    Subtable = UtSubtableCacheCalloc ();
+
+    if (Length > 0)
+    {
+        String = UtStringCacheCalloc (Length);
+        Subtable->Buffer = ACPI_CAST_PTR (UINT8, String);
+    }
+
+    Subtable->Length = Length;
+    Subtable->TotalLength = Length;
+    /* Buffer = Subtable->Buffer; */
+
+    *RetSubtable = Subtable;
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/dtcompiler.h b/usr/src/cmd/acpi/iasl/dtcompiler.h
new file mode 100644
index 0000000000..8102e8203a
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtcompiler.h
@@ -0,0 +1,633 @@
+/******************************************************************************
+ *
+ * Module Name: dtcompiler.h - header for data table compiler
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#define __DTCOMPILER_H__
+
+#ifndef _DTCOMPILER
+#define _DTCOMPILER
+
+#include <stdio.h>
+#include "acdisasm.h"
+
+
+#define ASL_FIELD_CACHE_SIZE            512
+#define ASL_SUBTABLE_CACHE_SIZE         128
+
+
+#undef DT_EXTERN
+
+#ifdef _DECLARE_DT_GLOBALS
+#define DT_EXTERN
+#define DT_INIT_GLOBAL(a,b)         (a)=(b)
+#else
+#define DT_EXTERN                   extern
+#define DT_INIT_GLOBAL(a,b)         (a)
+#endif
+
+
+/* Types for individual fields (one per input line) */
+
+#define DT_FIELD_TYPE_STRING            0
+#define DT_FIELD_TYPE_INTEGER           1
+#define DT_FIELD_TYPE_BUFFER            2
+#define DT_FIELD_TYPE_PCI_PATH          3
+#define DT_FIELD_TYPE_FLAG              4
+#define DT_FIELD_TYPE_FLAGS_INTEGER     5
+#define DT_FIELD_TYPE_INLINE_SUBTABLE   6
+#define DT_FIELD_TYPE_UUID              7
+#define DT_FIELD_TYPE_UNICODE           8
+#define DT_FIELD_TYPE_DEVICE_PATH       9
+#define DT_FIELD_TYPE_LABEL             10
+
+
+/*
+ * Structure used for each individual field within an ACPI table
+ */
+typedef struct dt_field
+{
+    char                    *Name;       /* Field name (from name : value) */
+    char                    *Value;      /* Field value (from name : value) */
+    UINT32                  StringLength;/* Length of Value */
+    struct dt_field         *Next;       /* Next field */
+    struct dt_field         *NextLabel;  /* If field is a label, next label */
+    UINT32                  Line;        /* Line number for this field */
+    UINT32                  ByteOffset;  /* Offset in source file for field */
+    UINT32                  NameColumn;  /* Start column for field name */
+    UINT32                  Column;      /* Start column for field value */
+    UINT32                  TableOffset; /* Binary offset within ACPI table */
+    UINT8                   Flags;
+
+} DT_FIELD;
+
+/* Flags for above */
+
+#define DT_FIELD_NOT_ALLOCATED      1
+
+
+/*
+ * Structure used for individual subtables within an ACPI table
+ */
+typedef struct dt_subtable
+{
+    struct dt_subtable      *Parent;
+    struct dt_subtable      *Child;
+    struct dt_subtable      *Peer;
+    struct dt_subtable      *StackTop;
+    UINT8                   *Buffer;
+    UINT8                   *LengthField;
+    char                    *Name;
+    UINT32                  Length;
+    UINT32                  TotalLength;
+    UINT32                  SizeOfLengthField;
+    UINT16                  Depth;
+    UINT8                   Flags;
+
+} DT_SUBTABLE;
+
+
+/*
+ * Globals
+ */
+
+/* List of all field names and values from the input source */
+
+DT_EXTERN DT_FIELD          DT_INIT_GLOBAL (*Gbl_FieldList, NULL);
+
+/* List of all compiled tables and subtables */
+
+DT_EXTERN DT_SUBTABLE       DT_INIT_GLOBAL (*Gbl_RootTable, NULL);
+
+/* Stack for subtables */
+
+DT_EXTERN DT_SUBTABLE       DT_INIT_GLOBAL (*Gbl_SubtableStack, NULL);
+
+/* List for defined labels */
+
+DT_EXTERN DT_FIELD          DT_INIT_GLOBAL (*Gbl_LabelList, NULL);
+
+/* Current offset within the binary output table */
+
+DT_EXTERN UINT32            DT_INIT_GLOBAL (Gbl_CurrentTableOffset, 0);
+
+/* Local caches */
+
+DT_EXTERN UINT32            DT_INIT_GLOBAL (Gbl_SubtableCount, 0);
+DT_EXTERN ASL_CACHE_INFO    DT_INIT_GLOBAL (*Gbl_SubtableCacheList, NULL);
+DT_EXTERN DT_SUBTABLE       DT_INIT_GLOBAL (*Gbl_SubtableCacheNext, NULL);
+DT_EXTERN DT_SUBTABLE       DT_INIT_GLOBAL (*Gbl_SubtableCacheLast, NULL);
+
+DT_EXTERN UINT32            DT_INIT_GLOBAL (Gbl_FieldCount, 0);
+DT_EXTERN ASL_CACHE_INFO    DT_INIT_GLOBAL (*Gbl_FieldCacheList, NULL);
+DT_EXTERN DT_FIELD          DT_INIT_GLOBAL (*Gbl_FieldCacheNext, NULL);
+DT_EXTERN DT_FIELD          DT_INIT_GLOBAL (*Gbl_FieldCacheLast, NULL);
+
+
+/* dtcompiler - main module */
+
+ACPI_STATUS
+DtCompileTable (
+    DT_FIELD                **Field,
+    ACPI_DMTABLE_INFO       *Info,
+    DT_SUBTABLE             **RetSubtable,
+    BOOLEAN                 Required);
+
+ACPI_STATUS
+DtCompileTwoSubtables (
+    void                    **List,
+    ACPI_DMTABLE_INFO       *TableInfo1,
+    ACPI_DMTABLE_INFO       *TableInfo2);
+
+ACPI_STATUS
+DtCompilePadding (
+    UINT32                  Length,
+    DT_SUBTABLE             **RetSubtable);
+
+
+/* dtio - binary and text input/output */
+
+UINT32
+DtGetNextLine (
+    FILE                    *Handle,
+    UINT32                  Flags);
+
+/* Flags for DtGetNextLine */
+
+#define DT_ALLOW_MULTILINE_QUOTES   0x01
+
+
+DT_FIELD *
+DtScanFile (
+    FILE                    *Handle);
+
+void
+DtOutputBinary (
+    DT_SUBTABLE             *RootTable);
+
+void
+DtDumpSubtableList (
+    void);
+
+void
+DtDumpFieldList (
+    DT_FIELD                *Field);
+
+void
+DtWriteFieldToListing (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  Length);
+
+void
+DtWriteTableToListing (
+    void);
+
+
+/* dtsubtable - compile subtables */
+
+void
+DtCreateSubtable (
+    UINT8                   *Buffer,
+    UINT32                  Length,
+    DT_SUBTABLE             **RetSubtable);
+
+UINT32
+DtGetSubtableLength (
+    DT_FIELD                *Field,
+    ACPI_DMTABLE_INFO       *Info);
+
+void
+DtSetSubtableLength (
+    DT_SUBTABLE             *Subtable);
+
+void
+DtPushSubtable (
+    DT_SUBTABLE             *Subtable);
+
+void
+DtPopSubtable (
+    void);
+
+DT_SUBTABLE *
+DtPeekSubtable (
+    void);
+
+void
+DtInsertSubtable (
+    DT_SUBTABLE             *ParentTable,
+    DT_SUBTABLE             *Subtable);
+
+DT_SUBTABLE *
+DtGetNextSubtable (
+    DT_SUBTABLE             *ParentTable,
+    DT_SUBTABLE             *ChildTable);
+
+DT_SUBTABLE *
+DtGetParentSubtable (
+    DT_SUBTABLE             *Subtable);
+
+
+/* dtexpress - Integer expressions and labels */
+
+ACPI_STATUS
+DtResolveIntegerExpression (
+    DT_FIELD                *Field,
+    UINT64                  *ReturnValue);
+
+UINT64
+DtDoOperator (
+    UINT64                  LeftValue,
+    UINT32                  Operator,
+    UINT64                  RightValue);
+
+UINT64
+DtResolveLabel (
+    char                    *LabelString);
+
+void
+DtDetectAllLabels (
+    DT_FIELD                *FieldList);
+
+
+/* dtfield - Compile individual fields within a table */
+
+void
+DtCompileOneField (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength,
+    UINT8                   Type,
+    UINT8                   Flags);
+
+void
+DtCompileInteger (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength,
+    UINT8                   Flags);
+
+UINT32
+DtCompileBuffer (
+    UINT8                   *Buffer,
+    char                    *Value,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength);
+
+void
+DtCompileFlag (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    ACPI_DMTABLE_INFO       *Info);
+
+
+/* dtparser - lex/yacc files */
+
+UINT64
+DtEvaluateExpression (
+    char                    *ExprString);
+
+int
+DtInitLexer (
+    char                    *String);
+
+void
+DtTerminateLexer (
+    void);
+
+char *
+DtGetOpName (
+    UINT32                  ParseOpcode);
+
+
+/* dtutils - Miscellaneous utilities */
+
+typedef
+void (*DT_WALK_CALLBACK) (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue);
+
+void
+DtWalkTableTree (
+    DT_SUBTABLE             *StartTable,
+    DT_WALK_CALLBACK        UserFunction,
+    void                    *Context,
+    void                    *ReturnValue);
+
+void
+DtError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    DT_FIELD                *FieldObject,
+    char                    *ExtraMessage);
+
+void
+DtNameError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    DT_FIELD                *FieldObject,
+    char                    *ExtraMessage);
+
+void
+DtFatal (
+    UINT16                  MessageId,
+    DT_FIELD                *FieldObject,
+    char                    *ExtraMessage);
+
+ACPI_STATUS
+DtStrtoul64 (
+    char                    *String,
+    UINT64                  *ReturnInteger);
+
+char*
+DtGetFieldValue (
+    DT_FIELD                *Field);
+
+UINT8
+DtGetFieldType (
+    ACPI_DMTABLE_INFO       *Info);
+
+UINT32
+DtGetBufferLength (
+    char                    *Buffer);
+
+UINT32
+DtGetFieldLength (
+    DT_FIELD                *Field,
+    ACPI_DMTABLE_INFO       *Info);
+
+void
+DtSetTableChecksum (
+    UINT8                   *ChecksumPointer);
+
+void
+DtSetTableLength(
+    void);
+
+DT_SUBTABLE *
+UtSubtableCacheCalloc (
+    void);
+
+DT_FIELD *
+UtFieldCacheCalloc (
+    void);
+
+void
+DtDeleteCaches (
+    void);
+
+
+/* dttable - individual table compilation */
+
+ACPI_STATUS
+DtCompileFacs (
+    DT_FIELD                **PFieldList);
+
+ACPI_STATUS
+DtCompileRsdp (
+    DT_FIELD                **PFieldList);
+
+ACPI_STATUS
+DtCompileAsf (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileCpep (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileCsrt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileDbg2 (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileDmar (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileDrtm (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileEinj (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileErst (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileFadt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileFpdt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileGtdt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileHest (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileIort (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileIvrs (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileLpit (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileMadt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileMcfg (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileMpst (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileMsct (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileMtmr (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileNfit (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompilePmtt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompilePcct (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileRsdt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileS3pt (
+    DT_FIELD                **PFieldList);
+
+ACPI_STATUS
+DtCompileSlic (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileSlit (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileSrat (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileStao (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileTcpa (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileUefi (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileVrtc (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileWdat (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileWpbt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileXsdt (
+    void                    **PFieldList);
+
+ACPI_STATUS
+DtCompileGeneric (
+    void                    **PFieldList,
+    char                    *TermFieldName,
+    UINT32                  *PFieldLength);
+
+ACPI_DMTABLE_INFO *
+DtGetGenericTableInfo (
+    char                    *Name);
+
+/* ACPI Table templates */
+
+extern const unsigned char  TemplateAsf[];
+extern const unsigned char  TemplateBoot[];
+extern const unsigned char  TemplateBert[];
+extern const unsigned char  TemplateBgrt[];
+extern const unsigned char  TemplateCpep[];
+extern const unsigned char  TemplateCsrt[];
+extern const unsigned char  TemplateDbg2[];
+extern const unsigned char  TemplateDbgp[];
+extern const unsigned char  TemplateDmar[];
+extern const unsigned char  TemplateDrtm[];
+extern const unsigned char  TemplateEcdt[];
+extern const unsigned char  TemplateEinj[];
+extern const unsigned char  TemplateErst[];
+extern const unsigned char  TemplateFadt[];
+extern const unsigned char  TemplateFpdt[];
+extern const unsigned char  TemplateGtdt[];
+extern const unsigned char  TemplateHest[];
+extern const unsigned char  TemplateHpet[];
+extern const unsigned char  TemplateIort[];
+extern const unsigned char  TemplateIvrs[];
+extern const unsigned char  TemplateLpit[];
+extern const unsigned char  TemplateMadt[];
+extern const unsigned char  TemplateMcfg[];
+extern const unsigned char  TemplateMchi[];
+extern const unsigned char  TemplateMpst[];
+extern const unsigned char  TemplateMsct[];
+extern const unsigned char  TemplateMsdm[];
+extern const unsigned char  TemplateMtmr[];
+extern const unsigned char  TemplateNfit[];
+extern const unsigned char  TemplatePcct[];
+extern const unsigned char  TemplatePmtt[];
+extern const unsigned char  TemplateRsdt[];
+extern const unsigned char  TemplateS3pt[];
+extern const unsigned char  TemplateSbst[];
+extern const unsigned char  TemplateSlic[];
+extern const unsigned char  TemplateSlit[];
+extern const unsigned char  TemplateSpcr[];
+extern const unsigned char  TemplateSpmi[];
+extern const unsigned char  TemplateSrat[];
+extern const unsigned char  TemplateStao[];
+extern const unsigned char  TemplateTcpa[];
+extern const unsigned char  TemplateTpm2[];
+extern const unsigned char  TemplateUefi[];
+extern const unsigned char  TemplateVrtc[];
+extern const unsigned char  TemplateWaet[];
+extern const unsigned char  TemplateWdat[];
+extern const unsigned char  TemplateWddt[];
+extern const unsigned char  TemplateWdrt[];
+extern const unsigned char  TemplateWpbt[];
+extern const unsigned char  TemplateXenv[];
+extern const unsigned char  TemplateXsdt[];
+
+#endif
diff --git a/usr/src/cmd/acpi/iasl/dtexpress.c b/usr/src/cmd/acpi/iasl/dtexpress.c
new file mode 100644
index 0000000000..278b14f33e
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtexpress.c
@@ -0,0 +1,427 @@
+/******************************************************************************
+ *
+ * Module Name: dtexpress.c - Support for integer expressions and labels
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+#include "dtparser.y.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dtexpress")
+
+
+/* Local prototypes */
+
+static void
+DtInsertLabelField (
+    DT_FIELD                *Field);
+
+static DT_FIELD *
+DtLookupLabel (
+    char                    *Name);
+
+/* Global used for errors during parse and related functions */
+
+DT_FIELD                *Gbl_CurrentField;
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtResolveIntegerExpression
+ *
+ * PARAMETERS:  Field               - Field object with Integer expression
+ *              ReturnValue         - Where the integer is returned
+ *
+ * RETURN:      Status, and the resolved 64-bit integer value
+ *
+ * DESCRIPTION: Resolve an integer expression to a single value. Supports
+ *              both integer constants and labels.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtResolveIntegerExpression (
+    DT_FIELD                *Field,
+    UINT64                  *ReturnValue)
+{
+    UINT64                  Result;
+
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "Full Integer expression: %s\n",
+        Field->Value);
+
+    Gbl_CurrentField = Field;
+
+    Result = DtEvaluateExpression (Field->Value);
+    *ReturnValue = Result;
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtDoOperator
+ *
+ * PARAMETERS:  LeftValue           - First 64-bit operand
+ *              Operator            - Parse token for the operator (EXPOP_*)
+ *              RightValue          - Second 64-bit operand
+ *
+ * RETURN:      64-bit result of the requested operation
+ *
+ * DESCRIPTION: Perform the various 64-bit integer math functions
+ *
+ *****************************************************************************/
+
+UINT64
+DtDoOperator (
+    UINT64                  LeftValue,
+    UINT32                  Operator,
+    UINT64                  RightValue)
+{
+    UINT64                  Result;
+
+
+    /* Perform the requested operation */
+
+    switch (Operator)
+    {
+    case EXPOP_ONES_COMPLIMENT:
+
+        Result = ~RightValue;
+        break;
+
+    case EXPOP_LOGICAL_NOT:
+
+        Result = !RightValue;
+        break;
+
+    case EXPOP_MULTIPLY:
+
+        Result = LeftValue * RightValue;
+        break;
+
+    case EXPOP_DIVIDE:
+
+        if (!RightValue)
+        {
+            DtError (ASL_ERROR, ASL_MSG_DIVIDE_BY_ZERO,
+                Gbl_CurrentField, NULL);
+            return (0);
+        }
+
+        Result = LeftValue / RightValue;
+        break;
+
+    case EXPOP_MODULO:
+
+        if (!RightValue)
+        {
+            DtError (ASL_ERROR, ASL_MSG_DIVIDE_BY_ZERO,
+                Gbl_CurrentField, NULL);
+            return (0);
+        }
+
+        Result = LeftValue % RightValue;
+        break;
+
+    case EXPOP_ADD:
+        Result = LeftValue + RightValue;
+        break;
+
+    case EXPOP_SUBTRACT:
+
+        Result = LeftValue - RightValue;
+        break;
+
+    case EXPOP_SHIFT_RIGHT:
+
+        Result = LeftValue >> RightValue;
+        break;
+
+    case EXPOP_SHIFT_LEFT:
+
+        Result = LeftValue << RightValue;
+        break;
+
+    case EXPOP_LESS:
+
+        Result = LeftValue < RightValue;
+        break;
+
+    case EXPOP_GREATER:
+
+        Result = LeftValue > RightValue;
+        break;
+
+    case EXPOP_LESS_EQUAL:
+
+        Result = LeftValue <= RightValue;
+        break;
+
+    case EXPOP_GREATER_EQUAL:
+
+        Result = LeftValue >= RightValue;
+        break;
+
+    case EXPOP_EQUAL:
+
+        Result = LeftValue == RightValue;
+        break;
+
+    case EXPOP_NOT_EQUAL:
+
+        Result = LeftValue != RightValue;
+        break;
+
+    case EXPOP_AND:
+
+        Result = LeftValue & RightValue;
+        break;
+
+    case EXPOP_XOR:
+
+        Result = LeftValue ^ RightValue;
+        break;
+
+    case EXPOP_OR:
+
+        Result = LeftValue | RightValue;
+        break;
+
+    case EXPOP_LOGICAL_AND:
+
+        Result = LeftValue && RightValue;
+        break;
+
+    case EXPOP_LOGICAL_OR:
+
+        Result = LeftValue || RightValue;
+        break;
+
+   default:
+
+        /* Unknown operator */
+
+        DtFatal (ASL_MSG_INVALID_EXPRESSION,
+            Gbl_CurrentField, NULL);
+        return (0);
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "IntegerEval: (%8.8X%8.8X %s %8.8X%8.8X) = %8.8X%8.8X\n",
+        ACPI_FORMAT_UINT64 (LeftValue),
+        DtGetOpName (Operator),
+        ACPI_FORMAT_UINT64 (RightValue),
+        ACPI_FORMAT_UINT64 (Result));
+
+    return (Result);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtResolveLabel
+ *
+ * PARAMETERS:  LabelString         - Contains the label
+ *
+ * RETURN:      Table offset associated with the label
+ *
+ * DESCRIPTION: Lookup a lable and return its value.
+ *
+ *****************************************************************************/
+
+UINT64
+DtResolveLabel (
+    char                    *LabelString)
+{
+    DT_FIELD                *LabelField;
+
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "Resolve Label: %s\n", LabelString);
+
+    /* Resolve a label reference to an integer (table offset) */
+
+    if (*LabelString != '$')
+    {
+        return (0);
+    }
+
+    LabelField = DtLookupLabel (LabelString);
+    if (!LabelField)
+    {
+        DtError (ASL_ERROR, ASL_MSG_UNKNOWN_LABEL,
+            Gbl_CurrentField, LabelString);
+        return (0);
+    }
+
+    /* All we need from the label is the offset in the table */
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "Resolved Label: 0x%8.8X\n",
+        LabelField->TableOffset);
+
+    return (LabelField->TableOffset);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtDetectAllLabels
+ *
+ * PARAMETERS:  FieldList           - Field object at start of generic list
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Detect all labels in a list of "generic" opcodes (such as
+ *              a UEFI table.) and insert them into the global label list.
+ *
+ *****************************************************************************/
+
+void
+DtDetectAllLabels (
+    DT_FIELD                *FieldList)
+{
+    ACPI_DMTABLE_INFO       *Info;
+    DT_FIELD                *GenericField;
+    UINT32                  TableOffset;
+
+
+    TableOffset = Gbl_CurrentTableOffset;
+    GenericField = FieldList;
+
+    /*
+     * Process all "Label:" fields within the parse tree. We need
+     * to know the offsets for all labels before we can compile
+     * the parse tree in order to handle forward references. Traverse
+     * tree and get/set all field lengths of all operators in order to
+     * determine the label offsets.
+     */
+    while (GenericField)
+    {
+        Info = DtGetGenericTableInfo (GenericField->Name);
+        if (Info)
+        {
+            /* Maintain table offsets */
+
+            GenericField->TableOffset = TableOffset;
+            TableOffset += DtGetFieldLength (GenericField, Info);
+
+            /* Insert all labels in the global label list */
+
+            if (Info->Opcode == ACPI_DMT_LABEL)
+            {
+                DtInsertLabelField (GenericField);
+            }
+        }
+
+        GenericField = GenericField->Next;
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtInsertLabelField
+ *
+ * PARAMETERS:  Field               - Field object with Label to be inserted
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert a label field into the global label list
+ *
+ *****************************************************************************/
+
+static void
+DtInsertLabelField (
+    DT_FIELD                *Field)
+{
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "DtInsertLabelField: Found Label : %s at output table offset %X\n",
+        Field->Value, Field->TableOffset);
+
+    Field->NextLabel = Gbl_LabelList;
+    Gbl_LabelList = Field;
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtLookupLabel
+ *
+ * PARAMETERS:  Name                - Label to be resolved
+ *
+ * RETURN:      Field object associated with the label
+ *
+ * DESCRIPTION: Lookup a label in the global label list. Used during the
+ *              resolution of integer expressions.
+ *
+ *****************************************************************************/
+
+static DT_FIELD *
+DtLookupLabel (
+    char                    *Name)
+{
+    DT_FIELD                *LabelField;
+
+
+    /* Skip a leading $ */
+
+    if (*Name == '$')
+    {
+        Name++;
+    }
+
+    /* Search global list */
+
+    LabelField = Gbl_LabelList;
+    while (LabelField)
+    {
+        if (!strcmp (Name, LabelField->Value))
+        {
+            return (LabelField);
+        }
+
+        LabelField = LabelField->NextLabel;
+    }
+
+    return (NULL);
+}
diff --git a/usr/src/cmd/acpi/iasl/dtfield.c b/usr/src/cmd/acpi/iasl/dtfield.c
new file mode 100644
index 0000000000..a34b8e16a0
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtfield.c
@@ -0,0 +1,587 @@
+/******************************************************************************
+ *
+ * Module Name: dtfield.c - Code generation for individual source fields
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dtfield")
+
+
+/* Local prototypes */
+
+static void
+DtCompileString (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength);
+
+static void
+DtCompileUnicode (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength);
+
+static ACPI_STATUS
+DtCompileUuid (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength);
+
+static char *
+DtNormalizeBuffer (
+    char                    *Buffer,
+    UINT32                  *Count);
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileOneField
+ *
+ * PARAMETERS:  Buffer              - Output buffer
+ *              Field               - Field to be compiled
+ *              ByteLength          - Byte length of the field
+ *              Type                - Field type
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Compile a field value to binary
+ *
+ *****************************************************************************/
+
+void
+DtCompileOneField (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength,
+    UINT8                   Type,
+    UINT8                   Flags)
+{
+    ACPI_STATUS             Status;
+
+
+    switch (Type)
+    {
+    case DT_FIELD_TYPE_INTEGER:
+
+        DtCompileInteger (Buffer, Field, ByteLength, Flags);
+        break;
+
+    case DT_FIELD_TYPE_STRING:
+
+        DtCompileString (Buffer, Field, ByteLength);
+        break;
+
+    case DT_FIELD_TYPE_UUID:
+
+        Status = DtCompileUuid (Buffer, Field, ByteLength);
+        if (ACPI_SUCCESS (Status))
+        {
+            break;
+        }
+
+        /* Fall through. */
+
+    case DT_FIELD_TYPE_BUFFER:
+
+        DtCompileBuffer (Buffer, Field->Value, Field, ByteLength);
+        break;
+
+    case DT_FIELD_TYPE_UNICODE:
+
+        DtCompileUnicode (Buffer, Field, ByteLength);
+        break;
+
+    case DT_FIELD_TYPE_DEVICE_PATH:
+
+        break;
+
+    default:
+
+        DtFatal (ASL_MSG_COMPILER_INTERNAL, Field, "Invalid field type");
+        break;
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileString
+ *
+ * PARAMETERS:  Buffer              - Output buffer
+ *              Field               - String to be copied to buffer
+ *              ByteLength          - Maximum length of string
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Copy string to the buffer
+ *
+ *****************************************************************************/
+
+static void
+DtCompileString (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength)
+{
+    UINT32                  Length;
+
+
+    Length = strlen (Field->Value);
+
+    /* Check if the string is too long for the field */
+
+    if (Length > ByteLength)
+    {
+        sprintf (MsgBuffer, "Maximum %u characters", ByteLength);
+        DtError (ASL_ERROR, ASL_MSG_STRING_LENGTH, Field, MsgBuffer);
+        Length = ByteLength;
+    }
+
+    memcpy (Buffer, Field->Value, Length);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileUnicode
+ *
+ * PARAMETERS:  Buffer              - Output buffer
+ *              Field               - String to be copied to buffer
+ *              ByteLength          - Maximum length of string
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert ASCII string to Unicode string
+ *
+ * Note:  The Unicode string is 16 bits per character, no leading signature,
+ *        with a 16-bit terminating NULL.
+ *
+ *****************************************************************************/
+
+static void
+DtCompileUnicode (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength)
+{
+    UINT32                  Count;
+    UINT32                  i;
+    char                    *AsciiString;
+    UINT16                  *UnicodeString;
+
+
+    AsciiString = Field->Value;
+    UnicodeString = (UINT16 *) Buffer;
+    Count = strlen (AsciiString) + 1;
+
+    /* Convert to Unicode string (including null terminator) */
+
+    for (i = 0; i < Count; i++)
+    {
+        UnicodeString[i] = (UINT16) AsciiString[i];
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtCompileUuid
+ *
+ * PARAMETERS:  Buffer              - Output buffer
+ *              Field               - String to be copied to buffer
+ *              ByteLength          - Maximum length of string
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Convert UUID string to 16-byte buffer
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+DtCompileUuid (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength)
+{
+    char                    *InString;
+    ACPI_STATUS             Status;
+
+
+    InString = Field->Value;
+
+    Status = AuValidateUuid (InString);
+    if (ACPI_FAILURE (Status))
+    {
+        sprintf (MsgBuffer, "%s", Field->Value);
+        DtNameError (ASL_ERROR, ASL_MSG_INVALID_UUID, Field, MsgBuffer);
+    }
+    else
+    {
+        AcpiUtConvertStringToUuid (InString, Buffer);
+    }
+
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileInteger
+ *
+ * PARAMETERS:  Buffer              - Output buffer
+ *              Field               - Field obj with Integer to be compiled
+ *              ByteLength          - Byte length of the integer
+ *              Flags               - Additional compile info
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Compile an integer. Supports integer expressions with C-style
+ *              operators.
+ *
+ *****************************************************************************/
+
+void
+DtCompileInteger (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength,
+    UINT8                   Flags)
+{
+    UINT64                  Value;
+    UINT64                  MaxValue;
+    ACPI_STATUS             Status;
+
+
+    /* Output buffer byte length must be in range 1-8 */
+
+    if ((ByteLength > 8) || (ByteLength == 0))
+    {
+        DtFatal (ASL_MSG_COMPILER_INTERNAL, Field,
+            "Invalid internal Byte length");
+        return;
+    }
+
+    /* Resolve integer expression to a single integer value */
+
+    Status = DtResolveIntegerExpression (Field, &Value);
+    if (ACPI_FAILURE (Status))
+    {
+        return;
+    }
+
+    /*
+     * Ensure that reserved fields are set properly. Note: uses
+     * the DT_NON_ZERO flag to indicate that the reserved value
+     * must be exactly one. Otherwise, the value must be zero.
+     * This is sufficient for now.
+     */
+
+    /* TBD: Should use a flag rather than compare "Reserved" */
+
+    if (!strcmp (Field->Name, "Reserved"))
+    {
+        if (Flags & DT_NON_ZERO)
+        {
+            if (Value != 1)
+            {
+                DtError (ASL_WARNING, ASL_MSG_RESERVED_VALUE, Field,
+                    "Must be one, setting to one");
+                Value = 1;
+            }
+        }
+        else if (Value != 0)
+        {
+            DtError (ASL_WARNING, ASL_MSG_RESERVED_VALUE, Field,
+                "Must be zero, setting to zero");
+            Value = 0;
+        }
+    }
+
+    /* Check if the value must be non-zero */
+
+    else if ((Flags & DT_NON_ZERO) && (Value == 0))
+    {
+        DtError (ASL_ERROR, ASL_MSG_ZERO_VALUE, Field, NULL);
+    }
+
+    /*
+     * Generate the maximum value for the data type (ByteLength)
+     * Note: construct chosen for maximum portability
+     */
+    MaxValue = ((UINT64) (-1)) >> (64 - (ByteLength * 8));
+
+    /* Validate that the input value is within range of the target */
+
+    if (Value > MaxValue)
+    {
+        sprintf (MsgBuffer, "%8.8X%8.8X - max %u bytes",
+            ACPI_FORMAT_UINT64 (Value), ByteLength);
+        DtError (ASL_ERROR, ASL_MSG_INTEGER_SIZE, Field, MsgBuffer);
+    }
+
+    memcpy (Buffer, &Value, ByteLength);
+    return;
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtNormalizeBuffer
+ *
+ * PARAMETERS:  Buffer              - Input buffer
+ *              Count               - Output the count of hex number in
+ *                                    the Buffer
+ *
+ * RETURN:      The normalized buffer, freed by caller
+ *
+ * DESCRIPTION: [1A,2B,3C,4D] or 1A, 2B, 3C, 4D will be normalized
+ *              to 1A 2B 3C 4D
+ *
+ *****************************************************************************/
+
+static char *
+DtNormalizeBuffer (
+    char                    *Buffer,
+    UINT32                  *Count)
+{
+    char                    *NewBuffer;
+    char                    *TmpBuffer;
+    UINT32                  BufferCount = 0;
+    BOOLEAN                 Separator = TRUE;
+    char                    c;
+
+
+    NewBuffer = UtLocalCalloc (strlen (Buffer) + 1);
+    TmpBuffer = NewBuffer;
+
+    while ((c = *Buffer++))
+    {
+        switch (c)
+        {
+        /* Valid separators */
+
+        case '[':
+        case ']':
+        case ' ':
+        case ',':
+
+            Separator = TRUE;
+            break;
+
+        default:
+
+            if (Separator)
+            {
+                /* Insert blank as the standard separator */
+
+                if (NewBuffer[0])
+                {
+                    *TmpBuffer++ = ' ';
+                    BufferCount++;
+                }
+
+                Separator = FALSE;
+            }
+
+            *TmpBuffer++ = c;
+            break;
+        }
+    }
+
+    *Count = BufferCount + 1;
+    return (NewBuffer);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileBuffer
+ *
+ * PARAMETERS:  Buffer              - Output buffer
+ *              StringValue         - Integer list to be compiled
+ *              Field               - Current field object
+ *              ByteLength          - Byte length of the integer list
+ *
+ * RETURN:      Count of remaining data in the input list
+ *
+ * DESCRIPTION: Compile and pack an integer list, for example
+ *              "AA 1F 20 3B" ==> Buffer[] = {0xAA,0x1F,0x20,0x3B}
+ *
+ *****************************************************************************/
+
+UINT32
+DtCompileBuffer (
+    UINT8                   *Buffer,
+    char                    *StringValue,
+    DT_FIELD                *Field,
+    UINT32                  ByteLength)
+{
+    ACPI_STATUS             Status;
+    char                    Hex[3];
+    UINT64                  Value;
+    UINT32                  i;
+    UINT32                  Count;
+
+
+    /* Allow several different types of value separators */
+
+    StringValue = DtNormalizeBuffer (StringValue, &Count);
+
+    Hex[2] = 0;
+    for (i = 0; i < Count; i++)
+    {
+        /* Each element of StringValue is three chars */
+
+        Hex[0] = StringValue[(3 * i)];
+        Hex[1] = StringValue[(3 * i) + 1];
+
+        /* Convert one hex byte */
+
+        Value = 0;
+        Status = DtStrtoul64 (Hex, &Value);
+        if (ACPI_FAILURE (Status))
+        {
+            DtError (ASL_ERROR, ASL_MSG_BUFFER_ELEMENT, Field, MsgBuffer);
+            goto Exit;
+        }
+
+        Buffer[i] = (UINT8) Value;
+    }
+
+Exit:
+    ACPI_FREE (StringValue);
+    return (ByteLength - Count);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileFlag
+ *
+ * PARAMETERS:  Buffer              - Output buffer
+ *              Field               - Field to be compiled
+ *              Info                - Flag info
+ *
+ * RETURN:
+ *
+ * DESCRIPTION: Compile a flag
+ *
+ *****************************************************************************/
+
+void
+DtCompileFlag (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    ACPI_DMTABLE_INFO       *Info)
+{
+    UINT64                  Value = 0;
+    UINT32                  BitLength = 1;
+    UINT8                   BitPosition = 0;
+    ACPI_STATUS             Status;
+
+
+    Status = DtStrtoul64 (Field->Value, &Value);
+    if (ACPI_FAILURE (Status))
+    {
+        DtError (ASL_ERROR, ASL_MSG_INVALID_HEX_INTEGER, Field, NULL);
+    }
+
+    switch (Info->Opcode)
+    {
+    case ACPI_DMT_FLAG0:
+    case ACPI_DMT_FLAG1:
+    case ACPI_DMT_FLAG2:
+    case ACPI_DMT_FLAG3:
+    case ACPI_DMT_FLAG4:
+    case ACPI_DMT_FLAG5:
+    case ACPI_DMT_FLAG6:
+    case ACPI_DMT_FLAG7:
+
+        BitPosition = Info->Opcode;
+        BitLength = 1;
+        break;
+
+    case ACPI_DMT_FLAGS0:
+
+        BitPosition = 0;
+        BitLength = 2;
+        break;
+
+
+    case ACPI_DMT_FLAGS1:
+
+        BitPosition = 1;
+        BitLength = 2;
+        break;
+
+
+    case ACPI_DMT_FLAGS2:
+
+        BitPosition = 2;
+        BitLength = 2;
+        break;
+
+    case ACPI_DMT_FLAGS4:
+
+        BitPosition = 4;
+        BitLength = 2;
+        break;
+
+    default:
+
+        DtFatal (ASL_MSG_COMPILER_INTERNAL, Field, "Invalid flag opcode");
+        break;
+    }
+
+    /* Check range of the input flag value */
+
+    if (Value >= ((UINT64) 1 << BitLength))
+    {
+        sprintf (MsgBuffer, "Maximum %u bit", BitLength);
+        DtError (ASL_ERROR, ASL_MSG_FLAG_VALUE, Field, MsgBuffer);
+        Value = 0;
+    }
+
+    *Buffer |= (UINT8) (Value << BitPosition);
+}
diff --git a/usr/src/cmd/acpi/iasl/dtio.c b/usr/src/cmd/acpi/iasl/dtio.c
new file mode 100644
index 0000000000..a24ad3442c
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtio.c
@@ -0,0 +1,1149 @@
+/******************************************************************************
+ *
+ * Module Name: dtio.c - File I/O support for data table compiler
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+#include "acapps.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dtio")
+
+
+/* Local prototypes */
+
+static char *
+DtTrim (
+    char                    *String);
+
+static void
+DtLinkField (
+    DT_FIELD                *Field);
+
+static ACPI_STATUS
+DtParseLine (
+    char                    *LineBuffer,
+    UINT32                  Line,
+    UINT32                  Offset);
+
+static void
+DtWriteBinary (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue);
+
+static void
+DtDumpBuffer (
+    UINT32                  FileId,
+    UINT8                   *Buffer,
+    UINT32                  Offset,
+    UINT32                  Length);
+
+static void
+DtDumpSubtableInfo (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue);
+
+static void
+DtDumpSubtableTree (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue);
+
+
+/* States for DtGetNextLine */
+
+#define DT_NORMAL_TEXT              0
+#define DT_START_QUOTED_STRING      1
+#define DT_START_COMMENT            2
+#define DT_SLASH_ASTERISK_COMMENT   3
+#define DT_SLASH_SLASH_COMMENT      4
+#define DT_END_COMMENT              5
+#define DT_MERGE_LINES              6
+#define DT_ESCAPE_SEQUENCE          7
+
+static UINT32               Gbl_NextLineOffset;
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtTrim
+ *
+ * PARAMETERS:  String              - Current source code line to trim
+ *
+ * RETURN:      Trimmed line. Must be freed by caller.
+ *
+ * DESCRIPTION: Trim left and right spaces
+ *
+ *****************************************************************************/
+
+static char *
+DtTrim (
+    char                    *String)
+{
+    char                    *Start;
+    char                    *End;
+    char                    *ReturnString;
+    ACPI_SIZE               Length;
+
+
+    /* Skip lines that start with a space */
+
+    if (!strcmp (String, " "))
+    {
+        ReturnString = UtStringCacheCalloc (1);
+        return (ReturnString);
+    }
+
+    /* Setup pointers to start and end of input string */
+
+    Start = String;
+    End = String + strlen (String) - 1;
+
+    /* Find first non-whitespace character */
+
+    while ((Start <= End) && ((*Start == ' ') || (*Start == '\t')))
+    {
+        Start++;
+    }
+
+    /* Find last non-space character */
+
+    while (End >= Start)
+    {
+        if (*End == '\r' || *End == '\n')
+        {
+            End--;
+            continue;
+        }
+
+        if (*End != ' ')
+        {
+            break;
+        }
+
+        End--;
+    }
+
+    /* Remove any quotes around the string */
+
+    if (*Start == '\"')
+    {
+        Start++;
+    }
+    if (*End == '\"')
+    {
+        End--;
+    }
+
+    /* Create the trimmed return string */
+
+    Length = ACPI_PTR_DIFF (End, Start) + 1;
+    ReturnString = UtStringCacheCalloc (Length + 1);
+    if (strlen (Start))
+    {
+        strncpy (ReturnString, Start, Length);
+    }
+
+    ReturnString[Length] = 0;
+    return (ReturnString);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtLinkField
+ *
+ * PARAMETERS:  Field               - New field object to link
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Link one field name and value to the list
+ *
+ *****************************************************************************/
+
+static void
+DtLinkField (
+    DT_FIELD                *Field)
+{
+    DT_FIELD                *Prev;
+    DT_FIELD                *Next;
+
+
+    Prev = Next = Gbl_FieldList;
+
+    while (Next)
+    {
+        Prev = Next;
+        Next = Next->Next;
+    }
+
+    if (Prev)
+    {
+        Prev->Next = Field;
+    }
+    else
+    {
+        Gbl_FieldList = Field;
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtParseLine
+ *
+ * PARAMETERS:  LineBuffer          - Current source code line
+ *              Line                - Current line number in the source
+ *              Offset              - Current byte offset of the line
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Parse one source line
+ *
+ *****************************************************************************/
+
+static ACPI_STATUS
+DtParseLine (
+    char                    *LineBuffer,
+    UINT32                  Line,
+    UINT32                  Offset)
+{
+    char                    *Start;
+    char                    *End;
+    char                    *TmpName;
+    char                    *TmpValue;
+    char                    *Name;
+    char                    *Value;
+    char                    *Colon;
+    UINT32                  Length;
+    DT_FIELD                *Field;
+    UINT32                  Column;
+    UINT32                  NameColumn;
+    BOOLEAN                 IsNullString = FALSE;
+
+
+    if (!LineBuffer)
+    {
+        return (AE_OK);
+    }
+
+    /* All lines after "Raw Table Data" are ingored */
+
+    if (strstr (LineBuffer, ACPI_RAW_TABLE_DATA_HEADER))
+    {
+        return (AE_NOT_FOUND);
+    }
+
+    Colon = strchr (LineBuffer, ':');
+    if (!Colon)
+    {
+        return (AE_OK);
+    }
+
+    Start = LineBuffer;
+    End = Colon;
+
+    while (Start < Colon)
+    {
+        if (*Start == '[')
+        {
+            /* Found left bracket, go to the right bracket */
+
+            while (Start < Colon && *Start != ']')
+            {
+                Start++;
+            }
+        }
+        else if (*Start != ' ')
+        {
+            break;
+        }
+
+        Start++;
+    }
+
+    /*
+     * There are two column values. One for the field name,
+     * and one for the field value.
+     */
+    Column = ACPI_PTR_DIFF (Colon, LineBuffer) + 3;
+    NameColumn = ACPI_PTR_DIFF (Start, LineBuffer) + 1;
+
+    Length = ACPI_PTR_DIFF (End, Start);
+
+    TmpName = UtLocalCalloc (Length + 1);
+    strncpy (TmpName, Start, Length);
+    Name = DtTrim (TmpName);
+    ACPI_FREE (TmpName);
+
+    Start = End = (Colon + 1);
+    while (*End)
+    {
+        /* Found left quotation, go to the right quotation and break */
+
+        if (*End == '"')
+        {
+            End++;
+
+            /* Check for an explicit null string */
+
+            if (*End == '"')
+            {
+                IsNullString = TRUE;
+            }
+            while (*End && (*End != '"'))
+            {
+                End++;
+            }
+
+            End++;
+            break;
+        }
+
+        /*
+         * Special "comment" fields at line end, ignore them.
+         * Note: normal slash-slash and slash-asterisk comments are
+         * stripped already by the DtGetNextLine parser.
+         *
+         * TBD: Perhaps DtGetNextLine should parse the following type
+         * of comments also.
+         */
+        if (*End == '[')
+        {
+            End--;
+            break;
+        }
+
+        End++;
+    }
+
+    Length = ACPI_PTR_DIFF (End, Start);
+    TmpValue = UtLocalCalloc (Length + 1);
+
+    strncpy (TmpValue, Start, Length);
+    Value = DtTrim (TmpValue);
+    ACPI_FREE (TmpValue);
+
+    /* Create a new field object only if we have a valid value field */
+
+    if ((Value && *Value) || IsNullString)
+    {
+        Field = UtFieldCacheCalloc ();
+        Field->Name = Name;
+        Field->Value = Value;
+        Field->Line = Line;
+        Field->ByteOffset = Offset;
+        Field->NameColumn = NameColumn;
+        Field->Column = Column;
+        Field->StringLength = Length;
+
+        DtLinkField (Field);
+    }
+    /* Else -- Ignore this field, it has no valid data */
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetNextLine
+ *
+ * PARAMETERS:  Handle              - Open file handle for the source file
+ *
+ * RETURN:      Filled line buffer and offset of start-of-line (ASL_EOF on EOF)
+ *
+ * DESCRIPTION: Get the next valid source line. Removes all comments.
+ *              Ignores empty lines.
+ *
+ * Handles both slash-asterisk and slash-slash comments.
+ * Also, quoted strings, but no escapes within.
+ *
+ * Line is returned in Gbl_CurrentLineBuffer.
+ * Line number in original file is returned in Gbl_CurrentLineNumber.
+ *
+ *****************************************************************************/
+
+UINT32
+DtGetNextLine (
+    FILE                    *Handle,
+    UINT32                  Flags)
+{
+    BOOLEAN                 LineNotAllBlanks = FALSE;
+    UINT32                  State = DT_NORMAL_TEXT;
+    UINT32                  CurrentLineOffset;
+    UINT32                  i;
+    int                     c;
+
+
+    memset (Gbl_CurrentLineBuffer, 0, Gbl_LineBufferSize);
+    for (i = 0; ;)
+    {
+        /*
+         * If line is too long, expand the line buffers. Also increases
+         * Gbl_LineBufferSize.
+         */
+        if (i >= Gbl_LineBufferSize)
+        {
+            UtExpandLineBuffers ();
+        }
+
+        c = getc (Handle);
+        if (c == EOF)
+        {
+            switch (State)
+            {
+            case DT_START_QUOTED_STRING:
+            case DT_SLASH_ASTERISK_COMMENT:
+
+                AcpiOsPrintf ("**** EOF within comment/string %u\n", State);
+                break;
+
+            default:
+
+                break;
+            }
+
+            /* Standalone EOF is OK */
+
+            if (i == 0)
+            {
+                return (ASL_EOF);
+            }
+
+            /*
+             * Received an EOF in the middle of a line. Terminate the
+             * line with a newline. The next call to this function will
+             * return a standalone EOF. Thus, the upper parsing software
+             * never has to deal with an EOF within a valid line (or
+             * the last line does not get tossed on the floor.)
+             */
+            c = '\n';
+            State = DT_NORMAL_TEXT;
+        }
+
+        switch (State)
+        {
+        case DT_NORMAL_TEXT:
+
+            /* Normal text, insert char into line buffer */
+
+            Gbl_CurrentLineBuffer[i] = (char) c;
+            switch (c)
+            {
+            case '/':
+
+                State = DT_START_COMMENT;
+                break;
+
+            case '"':
+
+                State = DT_START_QUOTED_STRING;
+                LineNotAllBlanks = TRUE;
+                i++;
+                break;
+
+            case '\\':
+                /*
+                 * The continuation char MUST be last char on this line.
+                 * Otherwise, it will be assumed to be a valid ASL char.
+                 */
+                State = DT_MERGE_LINES;
+                break;
+
+            case '\n':
+
+                CurrentLineOffset = Gbl_NextLineOffset;
+                Gbl_NextLineOffset = (UINT32) ftell (Handle);
+                Gbl_CurrentLineNumber++;
+
+                /*
+                 * Exit if line is complete. Ignore empty lines (only \n)
+                 * or lines that contain nothing but blanks.
+                 */
+                if ((i != 0) && LineNotAllBlanks)
+                {
+                    if ((i + 1) >= Gbl_LineBufferSize)
+                    {
+                        UtExpandLineBuffers ();
+                    }
+
+                    Gbl_CurrentLineBuffer[i+1] = 0; /* Terminate string */
+                    return (CurrentLineOffset);
+                }
+
+                /* Toss this line and start a new one */
+
+                i = 0;
+                LineNotAllBlanks = FALSE;
+                break;
+
+            default:
+
+                if (c != ' ')
+                {
+                    LineNotAllBlanks = TRUE;
+                }
+
+                i++;
+                break;
+            }
+            break;
+
+        case DT_START_QUOTED_STRING:
+
+            /* Insert raw chars until end of quoted string */
+
+            Gbl_CurrentLineBuffer[i] = (char) c;
+            i++;
+
+            switch (c)
+            {
+            case '"':
+
+                State = DT_NORMAL_TEXT;
+                break;
+
+            case '\\':
+
+                State = DT_ESCAPE_SEQUENCE;
+                break;
+
+            case '\n':
+
+                if (!(Flags & DT_ALLOW_MULTILINE_QUOTES))
+                {
+                    AcpiOsPrintf (
+                        "ERROR at line %u: Unterminated quoted string\n",
+                        Gbl_CurrentLineNumber++);
+                    State = DT_NORMAL_TEXT;
+                }
+                break;
+
+            default:    /* Get next character */
+
+                break;
+            }
+            break;
+
+        case DT_ESCAPE_SEQUENCE:
+
+            /* Just copy the escaped character. TBD: sufficient for table compiler? */
+
+            Gbl_CurrentLineBuffer[i] = (char) c;
+            i++;
+            State = DT_START_QUOTED_STRING;
+            break;
+
+        case DT_START_COMMENT:
+
+            /* Open comment if this character is an asterisk or slash */
+
+            switch (c)
+            {
+            case '*':
+
+                State = DT_SLASH_ASTERISK_COMMENT;
+                break;
+
+            case '/':
+
+                State = DT_SLASH_SLASH_COMMENT;
+                break;
+
+            default:    /* Not a comment */
+
+                i++;    /* Save the preceding slash */
+                if (i >= Gbl_LineBufferSize)
+                {
+                    UtExpandLineBuffers ();
+                }
+
+                Gbl_CurrentLineBuffer[i] = (char) c;
+                i++;
+                State = DT_NORMAL_TEXT;
+                break;
+            }
+            break;
+
+        case DT_SLASH_ASTERISK_COMMENT:
+
+            /* Ignore chars until an asterisk-slash is found */
+
+            switch (c)
+            {
+            case '\n':
+
+                Gbl_NextLineOffset = (UINT32) ftell (Handle);
+                Gbl_CurrentLineNumber++;
+                break;
+
+            case '*':
+
+                State = DT_END_COMMENT;
+                break;
+
+            default:
+
+                break;
+            }
+            break;
+
+        case DT_SLASH_SLASH_COMMENT:
+
+            /* Ignore chars until end-of-line */
+
+            if (c == '\n')
+            {
+                /* We will exit via the NORMAL_TEXT path */
+
+                ungetc (c, Handle);
+                State = DT_NORMAL_TEXT;
+            }
+            break;
+
+        case DT_END_COMMENT:
+
+            /* End comment if this char is a slash */
+
+            switch (c)
+            {
+            case '/':
+
+                State = DT_NORMAL_TEXT;
+                break;
+
+            case '\n':
+
+                CurrentLineOffset = Gbl_NextLineOffset;
+                Gbl_NextLineOffset = (UINT32) ftell (Handle);
+                Gbl_CurrentLineNumber++;
+                break;
+
+            case '*':
+
+                /* Consume all adjacent asterisks */
+                break;
+
+            default:
+
+                State = DT_SLASH_ASTERISK_COMMENT;
+                break;
+            }
+            break;
+
+        case DT_MERGE_LINES:
+
+            if (c != '\n')
+            {
+                /*
+                 * This is not a continuation backslash, it is a normal
+                 * normal ASL backslash - for example: Scope(\_SB_)
+                 */
+                i++; /* Keep the backslash that is already in the buffer */
+
+                ungetc (c, Handle);
+                State = DT_NORMAL_TEXT;
+            }
+            else
+            {
+                /*
+                 * This is a continuation line -- a backlash followed
+                 * immediately by a newline. Insert a space between the
+                 * lines (overwrite the backslash)
+                 */
+                Gbl_CurrentLineBuffer[i] = ' ';
+                i++;
+
+                /* Ignore newline, this will merge the lines */
+
+                CurrentLineOffset = Gbl_NextLineOffset;
+                Gbl_NextLineOffset = (UINT32) ftell (Handle);
+                Gbl_CurrentLineNumber++;
+                State = DT_NORMAL_TEXT;
+            }
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_COMPILER_INTERNAL, NULL, "Unknown input state");
+            return (ASL_EOF);
+        }
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtScanFile
+ *
+ * PARAMETERS:  Handle              - Open file handle for the source file
+ *
+ * RETURN:      Pointer to start of the constructed parse tree.
+ *
+ * DESCRIPTION: Scan source file, link all field names and values
+ *              to the global parse tree: Gbl_FieldList
+ *
+ *****************************************************************************/
+
+DT_FIELD *
+DtScanFile (
+    FILE                    *Handle)
+{
+    ACPI_STATUS             Status;
+    UINT32                  Offset;
+
+
+    ACPI_FUNCTION_NAME (DtScanFile);
+
+
+    /* Get the file size */
+
+    Gbl_InputByteCount = CmGetFileSize (Handle);
+    if (Gbl_InputByteCount == ACPI_UINT32_MAX)
+    {
+        AslAbort ();
+    }
+
+    Gbl_CurrentLineNumber = 0;
+    Gbl_CurrentLineOffset = 0;
+    Gbl_NextLineOffset = 0;
+
+    /* Scan line-by-line */
+
+    while ((Offset = DtGetNextLine (Handle, 0)) != ASL_EOF)
+    {
+        ACPI_DEBUG_PRINT ((ACPI_DB_PARSE, "Line %2.2u/%4.4X - %s",
+            Gbl_CurrentLineNumber, Offset, Gbl_CurrentLineBuffer));
+
+        Status = DtParseLine (Gbl_CurrentLineBuffer,
+            Gbl_CurrentLineNumber, Offset);
+        if (Status == AE_NOT_FOUND)
+        {
+            break;
+        }
+    }
+
+    /* Dump the parse tree if debug enabled */
+
+    DtDumpFieldList (Gbl_FieldList);
+    return (Gbl_FieldList);
+}
+
+
+/*
+ * Output functions
+ */
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtWriteBinary
+ *
+ * PARAMETERS:  DT_WALK_CALLBACK
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Write one subtable of a binary ACPI table
+ *
+ *****************************************************************************/
+
+static void
+DtWriteBinary (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue)
+{
+
+    FlWriteFile (ASL_FILE_AML_OUTPUT, Subtable->Buffer, Subtable->Length);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtOutputBinary
+ *
+ * PARAMETERS:
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Write entire binary ACPI table (result of compilation)
+ *
+ *****************************************************************************/
+
+void
+DtOutputBinary (
+    DT_SUBTABLE             *RootTable)
+{
+
+    if (!RootTable)
+    {
+        return;
+    }
+
+    /* Walk the entire parse tree, emitting the binary data */
+
+    DtWalkTableTree (RootTable, DtWriteBinary, NULL, NULL);
+
+    Gbl_TableLength = CmGetFileSize (Gbl_Files[ASL_FILE_AML_OUTPUT].Handle);
+    if (Gbl_TableLength == ACPI_UINT32_MAX)
+    {
+        AslAbort ();
+    }
+}
+
+
+/*
+ * Listing support
+ */
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtDumpBuffer
+ *
+ * PARAMETERS:  FileID              - Where to write buffer data
+ *              Buffer              - Buffer to dump
+ *              Offset              - Offset in current table
+ *              Length              - Buffer Length
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Another copy of DumpBuffer routine (unfortunately).
+ *
+ * TBD: merge dump buffer routines
+ *
+ *****************************************************************************/
+
+static void
+DtDumpBuffer (
+    UINT32                  FileId,
+    UINT8                   *Buffer,
+    UINT32                  Offset,
+    UINT32                  Length)
+{
+    UINT32                  i;
+    UINT32                  j;
+    UINT8                   BufChar;
+
+
+    FlPrintFile (FileId, "Output: [%3.3Xh %4.4d %3d] ",
+        Offset, Offset, Length);
+
+    i = 0;
+    while (i < Length)
+    {
+        if (i >= 16)
+        {
+            FlPrintFile (FileId, "%24s", "");
+        }
+
+        /* Print 16 hex chars */
+
+        for (j = 0; j < 16;)
+        {
+            if (i + j >= Length)
+            {
+                /* Dump fill spaces */
+
+                FlPrintFile (FileId, "   ");
+                j++;
+                continue;
+            }
+
+            FlPrintFile (FileId, "%02X ", Buffer[i+j]);
+            j++;
+        }
+
+        FlPrintFile (FileId, " ");
+        for (j = 0; j < 16; j++)
+        {
+            if (i + j >= Length)
+            {
+                FlPrintFile (FileId, "\n\n");
+                return;
+            }
+
+            BufChar = Buffer[(ACPI_SIZE) i + j];
+            if (isprint (BufChar))
+            {
+                FlPrintFile (FileId, "%c", BufChar);
+            }
+            else
+            {
+                FlPrintFile (FileId, ".");
+            }
+        }
+
+        /* Done with that line. */
+
+        FlPrintFile (FileId, "\n");
+        i += 16;
+    }
+
+    FlPrintFile (FileId, "\n\n");
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtDumpFieldList
+ *
+ * PARAMETERS:  Field               - Root field
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump the entire field list
+ *
+ *****************************************************************************/
+
+void
+DtDumpFieldList (
+    DT_FIELD                *Field)
+{
+
+    if (!Gbl_DebugFlag || !Field)
+    {
+        return;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,  "\nField List:\n"
+        "LineNo   ByteOff  NameCol  Column   TableOff "
+        "Flags %32s : %s\n\n", "Name", "Value");
+
+    while (Field)
+    {
+        DbgPrint (ASL_DEBUG_OUTPUT,
+            "%.08X %.08X %.08X %.08X %.08X %2.2X    %32s : %s\n",
+            Field->Line, Field->ByteOffset, Field->NameColumn,
+            Field->Column, Field->TableOffset, Field->Flags,
+            Field->Name, Field->Value);
+
+        Field = Field->Next;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,  "\n\n");
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtDumpSubtableInfo, DtDumpSubtableTree
+ *
+ * PARAMETERS:  DT_WALK_CALLBACK
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Info - dump a subtable tree entry with extra information.
+ *              Tree - dump a subtable tree formatted by depth indentation.
+ *
+ *****************************************************************************/
+
+static void
+DtDumpSubtableInfo (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue)
+{
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "[%.04X] %24s %.08X %.08X %.08X %.08X %.08X %p %p %p\n",
+        Subtable->Depth, Subtable->Name, Subtable->Length, Subtable->TotalLength,
+        Subtable->SizeOfLengthField, Subtable->Flags, Subtable,
+        Subtable->Parent, Subtable->Child, Subtable->Peer);
+}
+
+static void
+DtDumpSubtableTree (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue)
+{
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "[%.04X] %24s %*s%08X (%.02X) - (%.02X)\n",
+        Subtable->Depth, Subtable->Name, (4 * Subtable->Depth), " ",
+        Subtable, Subtable->Length, Subtable->TotalLength);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtDumpSubtableList
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump the raw list of subtables with information, and also
+ *              dump the subtable list in formatted tree format. Assists with
+ *              the development of new table code.
+ *
+ *****************************************************************************/
+
+void
+DtDumpSubtableList (
+    void)
+{
+
+    if (!Gbl_DebugFlag || !Gbl_RootTable)
+    {
+        return;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "Subtable Info:\n"
+        "Depth                      Name Length   TotalLen LenSize  Flags    "
+        "This     Parent   Child    Peer\n\n");
+    DtWalkTableTree (Gbl_RootTable, DtDumpSubtableInfo, NULL, NULL);
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "\nSubtable Tree: (Depth, Name, Subtable, Length, TotalLength)\n\n");
+    DtWalkTableTree (Gbl_RootTable, DtDumpSubtableTree, NULL, NULL);
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "\n");
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtWriteFieldToListing
+ *
+ * PARAMETERS:  Buffer              - Contains the compiled data
+ *              Field               - Field node for the input line
+ *              Length              - Length of the output data
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write one field to the listing file (if listing is enabled).
+ *
+ *****************************************************************************/
+
+void
+DtWriteFieldToListing (
+    UINT8                   *Buffer,
+    DT_FIELD                *Field,
+    UINT32                  Length)
+{
+    UINT8                   FileByte;
+
+
+    if (!Gbl_ListingFlag || !Field)
+    {
+        return;
+    }
+
+    /* Dump the original source line */
+
+    FlPrintFile (ASL_FILE_LISTING_OUTPUT, "Input:  ");
+    FlSeekFile (ASL_FILE_INPUT, Field->ByteOffset);
+
+    while (FlReadFile (ASL_FILE_INPUT, &FileByte, 1) == AE_OK)
+    {
+        FlWriteFile (ASL_FILE_LISTING_OUTPUT, &FileByte, 1);
+        if (FileByte == '\n')
+        {
+            break;
+        }
+    }
+
+    /* Dump the line as parsed and represented internally */
+
+    FlPrintFile (ASL_FILE_LISTING_OUTPUT, "Parsed: %*s : %.64s",
+        Field->Column-4, Field->Name, Field->Value);
+
+    if (strlen (Field->Value) > 64)
+    {
+        FlPrintFile (ASL_FILE_LISTING_OUTPUT, "...Additional data, length 0x%X\n",
+            strlen (Field->Value));
+    }
+
+    FlPrintFile (ASL_FILE_LISTING_OUTPUT, "\n");
+
+    /* Dump the hex data that will be output for this field */
+
+    DtDumpBuffer (ASL_FILE_LISTING_OUTPUT, Buffer, Field->TableOffset, Length);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtWriteTableToListing
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Write the entire compiled table to the listing file
+ *              in hex format
+ *
+ *****************************************************************************/
+
+void
+DtWriteTableToListing (
+    void)
+{
+    UINT8                   *Buffer;
+
+
+    if (!Gbl_ListingFlag)
+    {
+        return;
+    }
+
+    /* Read the entire table from the output file */
+
+    Buffer = UtLocalCalloc (Gbl_TableLength);
+    FlSeekFile (ASL_FILE_AML_OUTPUT, 0);
+    FlReadFile (ASL_FILE_AML_OUTPUT, Buffer, Gbl_TableLength);
+
+    /* Dump the raw table data */
+
+    AcpiOsRedirectOutput (Gbl_Files[ASL_FILE_LISTING_OUTPUT].Handle);
+
+    AcpiOsPrintf ("\n%s: Length %d (0x%X)\n\n",
+        ACPI_RAW_TABLE_DATA_HEADER, Gbl_TableLength, Gbl_TableLength);
+    AcpiUtDumpBuffer (Buffer, Gbl_TableLength, DB_BYTE_DISPLAY, 0);
+
+    AcpiOsRedirectOutput (stdout);
+    ACPI_FREE (Buffer);
+}
diff --git a/usr/src/cmd/acpi/iasl/dtparser.l b/usr/src/cmd/acpi/iasl/dtparser.l
new file mode 100644
index 0000000000..f3a307a2dd
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtparser.l
@@ -0,0 +1,133 @@
+%{
+/******************************************************************************
+ *
+ * Module Name: dtparser.l - Flex input file for table compiler lexer
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtparser.y.h"
+
+#define YY_NO_INPUT     /* No file input, we use strings only */
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("dtscanner")
+%}
+
+%option noyywrap
+%option nounput
+
+Number          [0-9a-fA-F]+
+HexNumber       0[xX][0-9a-fA-F]+
+DecimalNumber   0[dD][0-9]+
+LabelRef        $[a-zA-Z][0-9a-zA-Z]*
+WhiteSpace      [ \t\v\r]+
+NewLine         [\n]
+
+%%
+
+\(              return (EXPOP_PAREN_OPEN);
+\)              return (EXPOP_PAREN_CLOSE);
+\~              return (EXPOP_ONES_COMPLIMENT);
+\!              return (EXPOP_LOGICAL_NOT);
+\*              return (EXPOP_MULTIPLY);
+\/              return (EXPOP_DIVIDE);
+\%              return (EXPOP_MODULO);
+\+              return (EXPOP_ADD);
+\-              return (EXPOP_SUBTRACT);
+">>"            return (EXPOP_SHIFT_RIGHT);
+"<<"            return (EXPOP_SHIFT_LEFT);
+\<              return (EXPOP_LESS);
+\>              return (EXPOP_GREATER);
+"<="            return (EXPOP_LESS_EQUAL);
+">="            return (EXPOP_GREATER_EQUAL);
+"=="            return (EXPOP_EQUAL);
+"!="            return (EXPOP_NOT_EQUAL);
+\&              return (EXPOP_AND);
+\^              return (EXPOP_XOR);
+\|              return (EXPOP_OR);
+"&&"            return (EXPOP_LOGICAL_AND);
+"||"            return (EXPOP_LOGICAL_OR);
+<<EOF>>         return (EXPOP_EOF); /* null end-of-string */
+
+{LabelRef}      return (EXPOP_LABEL);
+{Number}        return (EXPOP_NUMBER);
+{HexNumber}     return (EXPOP_HEX_NUMBER);
+{NewLine}       return (EXPOP_NEW_LINE);
+{WhiteSpace}    /* Ignore */
+
+.               return (EXPOP_EOF);
+
+%%
+
+/*
+ * Local support functions
+ */
+YY_BUFFER_STATE         LexBuffer;
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtInitLexer, DtTerminateLexer
+ *
+ * PARAMETERS:  String              - Input string to be parsed
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Initialization and termination routines for lexer. Lexer needs
+ *              a buffer to handle strings instead of a file.
+ *
+ *****************************************************************************/
+
+int
+DtInitLexer (
+    char                    *String)
+{
+
+    LexBuffer = yy_scan_string (String);
+    return (LexBuffer == NULL);
+}
+
+void
+DtTerminateLexer (
+    void)
+{
+
+    yy_delete_buffer (LexBuffer);
+}
diff --git a/usr/src/cmd/acpi/iasl/dtparser.y b/usr/src/cmd/acpi/iasl/dtparser.y
new file mode 100644
index 0000000000..233aa9614b
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtparser.y
@@ -0,0 +1,284 @@
+%{
+/******************************************************************************
+ *
+ * Module Name: dtparser.y - Bison input file for table compiler parser
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dtparser")
+
+void *                      AslLocalAllocate (unsigned int Size);
+
+/* Bison/yacc configuration */
+
+#undef alloca
+#define alloca              AslLocalAllocate
+
+int                         DtParserlex (void);
+int                         DtParserparse (void);
+void                        DtParsererror (char const *msg);
+extern char                 *DtParsertext;
+extern DT_FIELD             *Gbl_CurrentField;
+
+UINT64                      DtParserResult; /* Expression return value */
+
+/* Bison/yacc configuration */
+
+#define yytname             DtParsername
+#define YYDEBUG             1               /* Enable debug output */
+#define YYERROR_VERBOSE     1               /* Verbose error messages */
+#define YYFLAG              -32768
+
+/* Define YYMALLOC/YYFREE to prevent redefinition errors  */
+
+#define YYMALLOC            malloc
+#define YYFREE              free
+%}
+
+%union
+{
+     UINT64                 value;
+     UINT32                 op;
+}
+
+/*! [Begin] no source code translation */
+
+%type  <value>  Expression
+
+%token <op>     EXPOP_EOF
+%token <op>     EXPOP_NEW_LINE
+%token <op>     EXPOP_NUMBER
+%token <op>     EXPOP_HEX_NUMBER
+%token <op>     EXPOP_DECIMAL_NUMBER
+%token <op>     EXPOP_LABEL
+%token <op>     EXPOP_PAREN_OPEN
+%token <op>     EXPOP_PAREN_CLOSE
+
+%left <op>      EXPOP_LOGICAL_OR
+%left <op>      EXPOP_LOGICAL_AND
+%left <op>      EXPOP_OR
+%left <op>      EXPOP_XOR
+%left <op>      EXPOP_AND
+%left <op>      EXPOP_EQUAL EXPOP_NOT_EQUAL
+%left <op>      EXPOP_GREATER EXPOP_LESS EXPOP_GREATER_EQUAL EXPOP_LESS_EQUAL
+%left <op>      EXPOP_SHIFT_RIGHT EXPOP_SHIFT_LEFT
+%left <op>      EXPOP_ADD EXPOP_SUBTRACT
+%left <op>      EXPOP_MULTIPLY EXPOP_DIVIDE EXPOP_MODULO
+%right <op>     EXPOP_ONES_COMPLIMENT EXPOP_LOGICAL_NOT
+
+%%
+
+/*
+ *  Operator precedence rules (from K&R)
+ *
+ *  1)      ( )
+ *  2)      ! ~ (unary operators that are supported here)
+ *  3)      *   /   %
+ *  4)      +   -
+ *  5)      >>  <<
+ *  6)      <   >   <=  >=
+ *  7)      ==  !=
+ *  8)      &
+ *  9)      ^
+ *  10)     |
+ *  11)     &&
+ *  12)     ||
+ */
+Value
+    : Expression EXPOP_NEW_LINE                     { DtParserResult=$1; return 0; } /* End of line (newline) */
+    | Expression EXPOP_EOF                          { DtParserResult=$1; return 0; } /* End of string (0) */
+    ;
+
+Expression
+
+      /* Unary operators */
+
+    : EXPOP_LOGICAL_NOT         Expression          { $$ = DtDoOperator ($2, EXPOP_LOGICAL_NOT,     $2);}
+    | EXPOP_ONES_COMPLIMENT     Expression          { $$ = DtDoOperator ($2, EXPOP_ONES_COMPLIMENT, $2);}
+
+      /* Binary operators */
+
+    | Expression EXPOP_MULTIPLY         Expression  { $$ = DtDoOperator ($1, EXPOP_MULTIPLY,        $3);}
+    | Expression EXPOP_DIVIDE           Expression  { $$ = DtDoOperator ($1, EXPOP_DIVIDE,          $3);}
+    | Expression EXPOP_MODULO           Expression  { $$ = DtDoOperator ($1, EXPOP_MODULO,          $3);}
+    | Expression EXPOP_ADD              Expression  { $$ = DtDoOperator ($1, EXPOP_ADD,             $3);}
+    | Expression EXPOP_SUBTRACT         Expression  { $$ = DtDoOperator ($1, EXPOP_SUBTRACT,        $3);}
+    | Expression EXPOP_SHIFT_RIGHT      Expression  { $$ = DtDoOperator ($1, EXPOP_SHIFT_RIGHT,     $3);}
+    | Expression EXPOP_SHIFT_LEFT       Expression  { $$ = DtDoOperator ($1, EXPOP_SHIFT_LEFT,      $3);}
+    | Expression EXPOP_GREATER          Expression  { $$ = DtDoOperator ($1, EXPOP_GREATER,         $3);}
+    | Expression EXPOP_LESS             Expression  { $$ = DtDoOperator ($1, EXPOP_LESS,            $3);}
+    | Expression EXPOP_GREATER_EQUAL    Expression  { $$ = DtDoOperator ($1, EXPOP_GREATER_EQUAL,   $3);}
+    | Expression EXPOP_LESS_EQUAL       Expression  { $$ = DtDoOperator ($1, EXPOP_LESS_EQUAL,      $3);}
+    | Expression EXPOP_EQUAL            Expression  { $$ = DtDoOperator ($1, EXPOP_EQUAL,           $3);}
+    | Expression EXPOP_NOT_EQUAL        Expression  { $$ = DtDoOperator ($1, EXPOP_NOT_EQUAL,       $3);}
+    | Expression EXPOP_AND              Expression  { $$ = DtDoOperator ($1, EXPOP_AND,             $3);}
+    | Expression EXPOP_XOR              Expression  { $$ = DtDoOperator ($1, EXPOP_XOR,             $3);}
+    | Expression EXPOP_OR               Expression  { $$ = DtDoOperator ($1, EXPOP_OR,              $3);}
+    | Expression EXPOP_LOGICAL_AND      Expression  { $$ = DtDoOperator ($1, EXPOP_LOGICAL_AND,     $3);}
+    | Expression EXPOP_LOGICAL_OR       Expression  { $$ = DtDoOperator ($1, EXPOP_LOGICAL_OR,      $3);}
+
+      /* Parentheses: '(' Expression ')' */
+
+    | EXPOP_PAREN_OPEN          Expression
+        EXPOP_PAREN_CLOSE                           { $$ = $2;}
+
+      /* Label references (prefixed with $) */
+
+    | EXPOP_LABEL                                   { $$ = DtResolveLabel (DtParsertext);}
+
+      /* Default base for a non-prefixed integer is 16 */
+
+    | EXPOP_NUMBER                                  { AcpiUtStrtoul64 (DtParsertext, 16, ACPI_MAX64_BYTE_WIDTH, &$$);}
+
+      /* Standard hex number (0x1234) */
+
+    | EXPOP_HEX_NUMBER                              { AcpiUtStrtoul64 (DtParsertext, 16, ACPI_MAX64_BYTE_WIDTH, &$$);}
+
+      /* TBD: Decimal number with prefix (0d1234) - Not supported by strtoul64 at this time */
+
+    | EXPOP_DECIMAL_NUMBER                          { AcpiUtStrtoul64 (DtParsertext, 10, ACPI_MAX64_BYTE_WIDTH, &$$);}
+    ;
+%%
+
+/*! [End] no source code translation !*/
+
+/*
+ * Local support functions, including parser entry point
+ */
+#define PR_FIRST_PARSE_OPCODE   EXPOP_EOF
+#define PR_YYTNAME_START        3
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtParsererror
+ *
+ * PARAMETERS:  Message             - Parser-generated error message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Handler for parser errors
+ *
+ *****************************************************************************/
+
+void
+DtParsererror (
+    char const              *Message)
+{
+    DtError (ASL_ERROR, ASL_MSG_SYNTAX,
+        Gbl_CurrentField, (char *) Message);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetOpName
+ *
+ * PARAMETERS:  ParseOpcode         - Parser token (EXPOP_*)
+ *
+ * RETURN:      Pointer to the opcode name
+ *
+ * DESCRIPTION: Get the ascii name of the parse opcode for debug output
+ *
+ *****************************************************************************/
+
+char *
+DtGetOpName (
+    UINT32                  ParseOpcode)
+{
+#ifdef ASL_YYTNAME_START
+    /*
+     * First entries (PR_YYTNAME_START) in yytname are special reserved names.
+     * Ignore first 6 characters of name (EXPOP_)
+     */
+    return ((char *) yytname
+        [(ParseOpcode - PR_FIRST_PARSE_OPCODE) + PR_YYTNAME_START] + 6);
+#else
+    return ("[Unknown parser generator]");
+#endif
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtEvaluateExpression
+ *
+ * PARAMETERS:  ExprString          - Expression to be evaluated. Must be
+ *                                    terminated by either a newline or a NUL
+ *                                    string terminator
+ *
+ * RETURN:      64-bit value for the expression
+ *
+ * DESCRIPTION: Main entry point for the DT expression parser
+ *
+ *****************************************************************************/
+
+UINT64
+DtEvaluateExpression (
+    char                    *ExprString)
+{
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "**** Input expression: %s  (Base 16)\n", ExprString);
+
+    /* Point lexer to the input string */
+
+    if (DtInitLexer (ExprString))
+    {
+        DtError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL,
+            Gbl_CurrentField, "Could not initialize lexer");
+        return (0);
+    }
+
+    /* Parse/Evaluate the input string (value returned in DtParserResult) */
+
+    DtParserparse ();
+    DtTerminateLexer ();
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "**** Parser returned value: %u (%8.8X%8.8X)\n",
+        (UINT32) DtParserResult, ACPI_FORMAT_UINT64 (DtParserResult));
+
+    return (DtParserResult);
+}
diff --git a/usr/src/cmd/acpi/iasl/dtsubtable.c b/usr/src/cmd/acpi/iasl/dtsubtable.c
new file mode 100644
index 0000000000..f63082a368
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtsubtable.c
@@ -0,0 +1,384 @@
+/******************************************************************************
+ *
+ * Module Name: dtsubtable.c - handling of subtables within ACPI tables
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dtsubtable")
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCreateSubtable
+ *
+ * PARAMETERS:  Buffer              - Input buffer
+ *              Length              - Buffer length
+ *              RetSubtable         - Returned newly created subtable
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Create a subtable that is not listed with ACPI_DMTABLE_INFO
+ *              For example, FACS has 24 bytes reserved at the end
+ *              and it's not listed at AcpiDmTableInfoFacs
+ *
+ *****************************************************************************/
+
+void
+DtCreateSubtable (
+    UINT8                   *Buffer,
+    UINT32                  Length,
+    DT_SUBTABLE             **RetSubtable)
+{
+    DT_SUBTABLE             *Subtable;
+    char                    *String;
+
+
+    Subtable = UtSubtableCacheCalloc ();
+
+    /* Create a new buffer for the subtable data */
+
+    String = UtStringCacheCalloc (Length);
+    Subtable->Buffer = ACPI_CAST_PTR (UINT8, String);
+    memcpy (Subtable->Buffer, Buffer, Length);
+
+    Subtable->Length = Length;
+    Subtable->TotalLength = Length;
+
+    *RetSubtable = Subtable;
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtInsertSubtable
+ *
+ * PARAMETERS:  ParentTable         - The Parent of the new subtable
+ *              Subtable            - The new subtable to insert
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Insert the new subtable to the parent table
+ *
+ *****************************************************************************/
+
+void
+DtInsertSubtable (
+    DT_SUBTABLE             *ParentTable,
+    DT_SUBTABLE             *Subtable)
+{
+    DT_SUBTABLE             *ChildTable;
+
+
+    Subtable->Peer = NULL;
+    Subtable->Parent = ParentTable;
+    Subtable->Depth = ParentTable->Depth + 1;
+
+    /* Link the new entry into the child list */
+
+    if (!ParentTable->Child)
+    {
+        ParentTable->Child = Subtable;
+    }
+    else
+    {
+        /* Walk to the end of the child list */
+
+        ChildTable = ParentTable->Child;
+        while (ChildTable->Peer)
+        {
+            ChildTable = ChildTable->Peer;
+        }
+
+        /* Add new subtable at the end of the child list */
+
+        ChildTable->Peer = Subtable;
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtPushSubtable
+ *
+ * PARAMETERS:  Subtable            - Subtable to push
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Push a subtable onto a subtable stack
+ *
+ *****************************************************************************/
+
+void
+DtPushSubtable (
+    DT_SUBTABLE             *Subtable)
+{
+
+    Subtable->StackTop = Gbl_SubtableStack;
+    Gbl_SubtableStack = Subtable;
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtPopSubtable
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Pop a subtable from a subtable stack. Uses global SubtableStack
+ *
+ *****************************************************************************/
+
+void
+DtPopSubtable (
+    void)
+{
+    DT_SUBTABLE             *Subtable;
+
+
+    Subtable = Gbl_SubtableStack;
+
+    if (Subtable)
+    {
+        Gbl_SubtableStack = Subtable->StackTop;
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtPeekSubtable
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      The subtable on top of stack
+ *
+ * DESCRIPTION: Get the subtable on top of stack
+ *
+ *****************************************************************************/
+
+DT_SUBTABLE *
+DtPeekSubtable (
+    void)
+{
+
+    return (Gbl_SubtableStack);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetNextSubtable
+ *
+ * PARAMETERS:  ParentTable         - Parent table whose children we are
+ *                                    getting
+ *              ChildTable          - Previous child that was found.
+ *                                    The NEXT child will be returned
+ *
+ * RETURN:      Pointer to the NEXT child or NULL if none is found.
+ *
+ * DESCRIPTION: Return the next peer subtable within the tree.
+ *
+ *****************************************************************************/
+
+DT_SUBTABLE *
+DtGetNextSubtable (
+    DT_SUBTABLE             *ParentTable,
+    DT_SUBTABLE             *ChildTable)
+{
+    ACPI_FUNCTION_ENTRY ();
+
+
+    if (!ChildTable)
+    {
+        /* It's really the parent's _scope_ that we want */
+
+        return (ParentTable->Child);
+    }
+
+    /* Otherwise just return the next peer (NULL if at end-of-list) */
+
+    return (ChildTable->Peer);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetParentSubtable
+ *
+ * PARAMETERS:  Subtable            - Current subtable
+ *
+ * RETURN:      Parent of the given subtable
+ *
+ * DESCRIPTION: Get the parent of the given subtable in the tree
+ *
+ *****************************************************************************/
+
+DT_SUBTABLE *
+DtGetParentSubtable (
+    DT_SUBTABLE             *Subtable)
+{
+
+    if (!Subtable)
+    {
+        return (NULL);
+    }
+
+    return (Subtable->Parent);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetSubtableLength
+ *
+ * PARAMETERS:  Field               - Current field list pointer
+ *              Info                - Data table info
+ *
+ * RETURN:      Subtable length
+ *
+ * DESCRIPTION: Get length of bytes needed to compile the subtable
+ *
+ *****************************************************************************/
+
+UINT32
+DtGetSubtableLength (
+    DT_FIELD                *Field,
+    ACPI_DMTABLE_INFO       *Info)
+{
+    UINT32                  ByteLength = 0;
+    UINT8                   Step;
+    UINT8                   i;
+
+
+    /* Walk entire Info table; Null name terminates */
+
+    for (; Info->Name; Info++)
+    {
+        if (Info->Opcode == ACPI_DMT_EXTRA_TEXT)
+        {
+            continue;
+        }
+
+        if (!Field)
+        {
+            goto Error;
+        }
+
+        ByteLength += DtGetFieldLength (Field, Info);
+
+        switch (Info->Opcode)
+        {
+        case ACPI_DMT_GAS:
+
+            Step = 5;
+            break;
+
+        case ACPI_DMT_HESTNTFY:
+
+            Step = 9;
+            break;
+
+        case ACPI_DMT_IORTMEM:
+
+            Step = 10;
+            break;
+
+        default:
+
+            Step = 1;
+            break;
+        }
+
+        for (i = 0; i < Step; i++)
+        {
+            if (!Field)
+            {
+                goto Error;
+            }
+
+            Field = Field->Next;
+        }
+    }
+
+    return (ByteLength);
+
+Error:
+    if (!Field)
+    {
+        sprintf (MsgBuffer, "Found NULL field - Field name \"%s\" needed",
+            Info->Name);
+        DtFatal (ASL_MSG_COMPILER_INTERNAL, NULL, MsgBuffer);
+    }
+
+    return (ASL_EOF);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtSetSubtableLength
+ *
+ * PARAMETERS:  Subtable            - Subtable
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Set length of the subtable into its length field
+ *
+ *****************************************************************************/
+
+void
+DtSetSubtableLength (
+    DT_SUBTABLE             *Subtable)
+{
+
+    if (!Subtable->LengthField)
+    {
+        return;
+    }
+
+    memcpy (Subtable->LengthField, &Subtable->TotalLength,
+        Subtable->SizeOfLengthField);
+}
diff --git a/usr/src/cmd/acpi/iasl/dttable.c b/usr/src/cmd/acpi/iasl/dttable.c
new file mode 100644
index 0000000000..7b33e4d230
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dttable.c
@@ -0,0 +1,238 @@
+/******************************************************************************
+ *
+ * Module Name: dttable.c - handling for specific ACPI tables
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+/* Compile routines for the basic ACPI tables */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dttable")
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileRsdp
+ *
+ * PARAMETERS:  PFieldList          - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile RSDP.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileRsdp (
+    DT_FIELD                **PFieldList)
+{
+    DT_SUBTABLE             *Subtable;
+    ACPI_TABLE_RSDP         *Rsdp;
+    ACPI_RSDP_EXTENSION     *RsdpExtension;
+    ACPI_STATUS             Status;
+
+
+    /* Compile the "common" RSDP (ACPI 1.0) */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoRsdp1,
+        &Gbl_RootTable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Rsdp = ACPI_CAST_PTR (ACPI_TABLE_RSDP, Gbl_RootTable->Buffer);
+    DtSetTableChecksum (&Rsdp->Checksum);
+
+    if (Rsdp->Revision > 0)
+    {
+        /* Compile the "extended" part of the RSDP as a subtable */
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoRsdp2,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (Gbl_RootTable, Subtable);
+
+        /* Set length and extended checksum for entire RSDP */
+
+        RsdpExtension = ACPI_CAST_PTR (ACPI_RSDP_EXTENSION, Subtable->Buffer);
+        RsdpExtension->Length = Gbl_RootTable->Length + Subtable->Length;
+        DtSetTableChecksum (&RsdpExtension->ExtendedChecksum);
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileFadt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile FADT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileFadt (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    ACPI_TABLE_HEADER       *Table;
+    UINT8                   Revision;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoFadt1,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    Table = ACPI_CAST_PTR (ACPI_TABLE_HEADER, ParentTable->Buffer);
+    Revision = Table->Revision;
+
+    if (Revision == 2)
+    {
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoFadt2,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+    }
+    else if (Revision >= 2)
+    {
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoFadt3,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+
+        if (Revision >= 5)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoFadt5,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+        }
+
+        if (Revision >= 6)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoFadt6,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+        }
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileFacs
+ *
+ * PARAMETERS:  PFieldList          - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile FACS.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileFacs (
+    DT_FIELD                **PFieldList)
+{
+    DT_SUBTABLE             *Subtable;
+    UINT8                   *ReservedBuffer;
+    ACPI_STATUS             Status;
+    UINT32                  ReservedSize;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoFacs,
+        &Gbl_RootTable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* Large FACS reserved area at the end of the table */
+
+    ReservedSize = (UINT32) sizeof (((ACPI_TABLE_FACS *) NULL)->Reserved1);
+    ReservedBuffer = UtLocalCalloc (ReservedSize);
+
+    DtCreateSubtable (ReservedBuffer, ReservedSize, &Subtable);
+
+    ACPI_FREE (ReservedBuffer);
+    DtInsertSubtable (Gbl_RootTable, Subtable);
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/dttable1.c b/usr/src/cmd/acpi/iasl/dttable1.c
new file mode 100644
index 0000000000..a79d33be63
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dttable1.c
@@ -0,0 +1,1684 @@
+/******************************************************************************
+ *
+ * Module Name: dttable1.c - handling for specific ACPI tables
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+/* Compile all complex data tables, signatures starting with A-I */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dttable1")
+
+
+static ACPI_DMTABLE_INFO           TableInfoAsfAddress[] =
+{
+    {ACPI_DMT_BUFFER,   0,               "Addresses", 0},
+    {ACPI_DMT_EXIT,     0,               NULL, 0}
+};
+
+static ACPI_DMTABLE_INFO           TableInfoDmarPciPath[] =
+{
+    {ACPI_DMT_PCI_PATH, 0,               "PCI Path", 0},
+    {ACPI_DMT_EXIT,     0,               NULL, 0}
+};
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileAsf
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile ASF!.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileAsf (
+    void                    **List)
+{
+    ACPI_ASF_INFO           *AsfTable;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_DMTABLE_INFO       *DataInfoTable = NULL;
+    UINT32                  DataCount = 0;
+    ACPI_STATUS             Status;
+    UINT32                  i;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoAsfHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        AsfTable = ACPI_CAST_PTR (ACPI_ASF_INFO, Subtable->Buffer);
+
+        switch (AsfTable->Header.Type & 0x7F) /* Mask off top bit */
+        {
+        case ACPI_ASF_TYPE_INFO:
+
+            InfoTable = AcpiDmTableInfoAsf0;
+            break;
+
+        case ACPI_ASF_TYPE_ALERT:
+
+            InfoTable = AcpiDmTableInfoAsf1;
+            break;
+
+        case ACPI_ASF_TYPE_CONTROL:
+
+            InfoTable = AcpiDmTableInfoAsf2;
+            break;
+
+        case ACPI_ASF_TYPE_BOOT:
+
+            InfoTable = AcpiDmTableInfoAsf3;
+            break;
+
+        case ACPI_ASF_TYPE_ADDRESS:
+
+            InfoTable = AcpiDmTableInfoAsf4;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "ASF!");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+
+        switch (AsfTable->Header.Type & 0x7F) /* Mask off top bit */
+        {
+        case ACPI_ASF_TYPE_INFO:
+
+            DataInfoTable = NULL;
+            break;
+
+        case ACPI_ASF_TYPE_ALERT:
+
+            DataInfoTable = AcpiDmTableInfoAsf1a;
+            DataCount = ACPI_CAST_PTR (ACPI_ASF_ALERT,
+                ACPI_SUB_PTR (UINT8, Subtable->Buffer,
+                    sizeof (ACPI_ASF_HEADER)))->Alerts;
+            break;
+
+        case ACPI_ASF_TYPE_CONTROL:
+
+            DataInfoTable = AcpiDmTableInfoAsf2a;
+            DataCount = ACPI_CAST_PTR (ACPI_ASF_REMOTE,
+                ACPI_SUB_PTR (UINT8, Subtable->Buffer,
+                    sizeof (ACPI_ASF_HEADER)))->Controls;
+            break;
+
+        case ACPI_ASF_TYPE_BOOT:
+
+            DataInfoTable = NULL;
+            break;
+
+        case ACPI_ASF_TYPE_ADDRESS:
+
+            DataInfoTable = TableInfoAsfAddress;
+            DataCount = ACPI_CAST_PTR (ACPI_ASF_ADDRESS,
+                ACPI_SUB_PTR (UINT8, Subtable->Buffer,
+                    sizeof (ACPI_ASF_HEADER)))->Devices;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "ASF!");
+            return (AE_ERROR);
+        }
+
+        if (DataInfoTable)
+        {
+            switch (AsfTable->Header.Type & 0x7F)
+            {
+            case ACPI_ASF_TYPE_ADDRESS:
+
+                while (DataCount > 0)
+                {
+                    Status = DtCompileTable (PFieldList, DataInfoTable,
+                        &Subtable, TRUE);
+                    if (ACPI_FAILURE (Status))
+                    {
+                        return (Status);
+                    }
+
+                    DtInsertSubtable (ParentTable, Subtable);
+                    DataCount = DataCount - Subtable->Length;
+                }
+                break;
+
+            default:
+
+                for (i = 0; i < DataCount; i++)
+                {
+                    Status = DtCompileTable (PFieldList, DataInfoTable,
+                        &Subtable, TRUE);
+                    if (ACPI_FAILURE (Status))
+                    {
+                        return (Status);
+                    }
+
+                    DtInsertSubtable (ParentTable, Subtable);
+                }
+                break;
+            }
+        }
+
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileCpep
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile CPEP.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileCpep (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoCpep, AcpiDmTableInfoCpep0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileCsrt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile CSRT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileCsrt (
+    void                    **List)
+{
+    ACPI_STATUS             Status = AE_OK;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    UINT32                  DescriptorCount;
+    UINT32                  GroupLength;
+
+
+    /* Subtables (Resource Groups) */
+
+    ParentTable = DtPeekSubtable ();
+    while (*PFieldList)
+    {
+        /* Resource group subtable */
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoCsrt0,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        /* Compute the number of resource descriptors */
+
+        GroupLength =
+            (ACPI_CAST_PTR (ACPI_CSRT_GROUP,
+                Subtable->Buffer))->Length -
+            (ACPI_CAST_PTR (ACPI_CSRT_GROUP,
+                Subtable->Buffer))->SharedInfoLength -
+            sizeof (ACPI_CSRT_GROUP);
+
+        DescriptorCount = (GroupLength  /
+            sizeof (ACPI_CSRT_DESCRIPTOR));
+
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+        ParentTable = DtPeekSubtable ();
+
+        /* Shared info subtable (One per resource group) */
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoCsrt1,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+
+        /* Sub-Subtables (Resource Descriptors) */
+
+        while (*PFieldList && DescriptorCount)
+        {
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoCsrt2,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+
+            DtPushSubtable (Subtable);
+            ParentTable = DtPeekSubtable ();
+            if (*PFieldList)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoCsrt2a,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+                if (Subtable)
+                {
+                    DtInsertSubtable (ParentTable, Subtable);
+                }
+            }
+
+            DtPopSubtable ();
+            ParentTable = DtPeekSubtable ();
+            DescriptorCount--;
+        }
+
+        DtPopSubtable ();
+        ParentTable = DtPeekSubtable ();
+    }
+
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileDbg2
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile DBG2.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileDbg2 (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    UINT32                  SubtableCount;
+    ACPI_DBG2_HEADER        *Dbg2Header;
+    ACPI_DBG2_DEVICE        *DeviceInfo;
+    UINT16                  CurrentOffset;
+    UINT32                  i;
+
+
+    /* Main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoDbg2, &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /* Main table fields */
+
+    Dbg2Header = ACPI_CAST_PTR (ACPI_DBG2_HEADER, Subtable->Buffer);
+    Dbg2Header->InfoOffset = sizeof (ACPI_TABLE_HEADER) + ACPI_PTR_DIFF (
+        ACPI_ADD_PTR (UINT8, Dbg2Header, sizeof (ACPI_DBG2_HEADER)), Dbg2Header);
+
+    SubtableCount = Dbg2Header->InfoCount;
+    DtPushSubtable (Subtable);
+
+    /* Process all Device Information subtables (Count = InfoCount) */
+
+    while (*PFieldList && SubtableCount)
+    {
+        /* Subtable: Debug Device Information */
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoDbg2Device,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DeviceInfo = ACPI_CAST_PTR (ACPI_DBG2_DEVICE, Subtable->Buffer);
+        CurrentOffset = (UINT16) sizeof (ACPI_DBG2_DEVICE);
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        ParentTable = DtPeekSubtable ();
+
+        /* BaseAddressRegister GAS array (Required, size is RegisterCount) */
+
+        DeviceInfo->BaseAddressOffset = CurrentOffset;
+        for (i = 0; *PFieldList && (i < DeviceInfo->RegisterCount); i++)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoDbg2Addr,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            CurrentOffset += (UINT16) sizeof (ACPI_GENERIC_ADDRESS);
+            DtInsertSubtable (ParentTable, Subtable);
+        }
+
+        /* AddressSize array (Required, size = RegisterCount) */
+
+        DeviceInfo->AddressSizeOffset = CurrentOffset;
+        for (i = 0; *PFieldList && (i < DeviceInfo->RegisterCount); i++)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoDbg2Size,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            CurrentOffset += (UINT16) sizeof (UINT32);
+            DtInsertSubtable (ParentTable, Subtable);
+        }
+
+        /* NamespaceString device identifier (Required, size = NamePathLength) */
+
+        DeviceInfo->NamepathOffset = CurrentOffset;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoDbg2Name,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        /* Update the device info header */
+
+        DeviceInfo->NamepathLength = (UINT16) Subtable->Length;
+        CurrentOffset += (UINT16) DeviceInfo->NamepathLength;
+        DtInsertSubtable (ParentTable, Subtable);
+
+        /* OemData - Variable-length data (Optional, size = OemDataLength) */
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoDbg2OemData,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        /* Update the device info header (zeros if no OEM data present) */
+
+        DeviceInfo->OemDataOffset = 0;
+        DeviceInfo->OemDataLength = 0;
+
+        /* Optional subtable (OemData) */
+
+        if (Subtable && Subtable->Length)
+        {
+            DeviceInfo->OemDataOffset = CurrentOffset;
+            DeviceInfo->OemDataLength = (UINT16) Subtable->Length;
+
+            DtInsertSubtable (ParentTable, Subtable);
+        }
+
+        SubtableCount--;
+        DtPopSubtable (); /* Get next Device Information subtable */
+    }
+
+    DtPopSubtable ();
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileDmar
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile DMAR.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileDmar (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_DMAR_HEADER        *DmarHeader;
+    ACPI_DMAR_DEVICE_SCOPE  *DmarDeviceScope;
+    UINT32                  DeviceScopeLength;
+    UINT32                  PciPathLength;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoDmar, &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+    DtPushSubtable (Subtable);
+
+    while (*PFieldList)
+    {
+        /* DMAR Header */
+
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoDmarHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        DmarHeader = ACPI_CAST_PTR (ACPI_DMAR_HEADER, Subtable->Buffer);
+
+        switch (DmarHeader->Type)
+        {
+        case ACPI_DMAR_TYPE_HARDWARE_UNIT:
+
+            InfoTable = AcpiDmTableInfoDmar0;
+            break;
+
+        case ACPI_DMAR_TYPE_RESERVED_MEMORY:
+
+            InfoTable = AcpiDmTableInfoDmar1;
+            break;
+
+        case ACPI_DMAR_TYPE_ROOT_ATS:
+
+            InfoTable = AcpiDmTableInfoDmar2;
+            break;
+
+        case ACPI_DMAR_TYPE_HARDWARE_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoDmar3;
+            break;
+
+        case ACPI_DMAR_TYPE_NAMESPACE:
+
+            InfoTable = AcpiDmTableInfoDmar4;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "DMAR");
+            return (AE_ERROR);
+        }
+
+        /* DMAR Subtable */
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+
+        /*
+         * Optional Device Scope subtables
+         */
+        if ((DmarHeader->Type == ACPI_DMAR_TYPE_HARDWARE_AFFINITY) ||
+            (DmarHeader->Type == ACPI_DMAR_TYPE_NAMESPACE))
+        {
+            /* These types do not support device scopes */
+
+            DtPopSubtable ();
+            continue;
+        }
+
+        DtPushSubtable (Subtable);
+        DeviceScopeLength = DmarHeader->Length - Subtable->Length -
+            ParentTable->Length;
+        while (DeviceScopeLength)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoDmarScope,
+                &Subtable, FALSE);
+            if (Status == AE_NOT_FOUND)
+            {
+                break;
+            }
+
+            ParentTable = DtPeekSubtable ();
+            DtInsertSubtable (ParentTable, Subtable);
+            DtPushSubtable (Subtable);
+
+            DmarDeviceScope = ACPI_CAST_PTR (ACPI_DMAR_DEVICE_SCOPE, Subtable->Buffer);
+
+            /* Optional PCI Paths */
+
+            PciPathLength = DmarDeviceScope->Length - Subtable->Length;
+            while (PciPathLength)
+            {
+                Status = DtCompileTable (PFieldList, TableInfoDmarPciPath,
+                    &Subtable, FALSE);
+                if (Status == AE_NOT_FOUND)
+                {
+                    DtPopSubtable ();
+                    break;
+                }
+
+                ParentTable = DtPeekSubtable ();
+                DtInsertSubtable (ParentTable, Subtable);
+                PciPathLength -= Subtable->Length;
+            }
+
+            DtPopSubtable ();
+            DeviceScopeLength -= DmarDeviceScope->Length;
+        }
+
+        DtPopSubtable ();
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileDrtm
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile DRTM.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileDrtm (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    UINT32                  Count;
+    /* ACPI_TABLE_DRTM         *Drtm; */
+    ACPI_DRTM_VTABLE_LIST   *DrtmVtl;
+    ACPI_DRTM_RESOURCE_LIST *DrtmRl;
+    /* ACPI_DRTM_DPS_ID        *DrtmDps; */
+
+
+    ParentTable = DtPeekSubtable ();
+
+    /* Compile DRTM header */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoDrtm,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /*
+     * Using ACPI_SUB_PTR, We needn't define a seperate structure. Care
+     * should be taken to avoid accessing ACPI_TABLE_HADER fields.
+     */
+#if 0
+    Drtm = ACPI_SUB_PTR (ACPI_TABLE_DRTM,
+        Subtable->Buffer, sizeof (ACPI_TABLE_HEADER));
+#endif
+    /* Compile VTL */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoDrtm0,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    DtInsertSubtable (ParentTable, Subtable);
+    DrtmVtl = ACPI_CAST_PTR (ACPI_DRTM_VTABLE_LIST, Subtable->Buffer);
+
+    DtPushSubtable (Subtable);
+    ParentTable = DtPeekSubtable ();
+    Count = 0;
+
+    while (*PFieldList)
+    {
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoDrtm0a,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+        if (!Subtable)
+        {
+            break;
+        }
+        DtInsertSubtable (ParentTable, Subtable);
+        Count++;
+    }
+
+    DrtmVtl->ValidatedTableCount = Count;
+    DtPopSubtable ();
+    ParentTable = DtPeekSubtable ();
+
+    /* Compile RL */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoDrtm1,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    DtInsertSubtable (ParentTable, Subtable);
+    DrtmRl = ACPI_CAST_PTR (ACPI_DRTM_RESOURCE_LIST, Subtable->Buffer);
+
+    DtPushSubtable (Subtable);
+    ParentTable = DtPeekSubtable ();
+    Count = 0;
+
+    while (*PFieldList)
+    {
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoDrtm1a,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        if (!Subtable)
+        {
+            break;
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+        Count++;
+    }
+
+    DrtmRl->ResourceCount = Count;
+    DtPopSubtable ();
+    ParentTable = DtPeekSubtable ();
+
+    /* Compile DPS */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoDrtm2,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+    DtInsertSubtable (ParentTable, Subtable);
+    /* DrtmDps = ACPI_CAST_PTR (ACPI_DRTM_DPS_ID, Subtable->Buffer);*/
+
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileEinj
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile EINJ.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileEinj (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoEinj, AcpiDmTableInfoEinj0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileErst
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile ERST.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileErst (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoErst, AcpiDmTableInfoEinj0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileGtdt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile GTDT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileGtdt (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_SUBTABLE_HEADER    *GtdtHeader;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    UINT32                  GtCount;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoGtdt,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoGtdtHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        GtdtHeader = ACPI_CAST_PTR (ACPI_SUBTABLE_HEADER, Subtable->Buffer);
+
+        switch (GtdtHeader->Type)
+        {
+        case ACPI_GTDT_TYPE_TIMER_BLOCK:
+
+            InfoTable = AcpiDmTableInfoGtdt0;
+            break;
+
+        case ACPI_GTDT_TYPE_WATCHDOG:
+
+            InfoTable = AcpiDmTableInfoGtdt1;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "GTDT");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+
+        /*
+         * Additional GT block subtable data
+         */
+
+        switch (GtdtHeader->Type)
+        {
+        case ACPI_GTDT_TYPE_TIMER_BLOCK:
+
+            DtPushSubtable (Subtable);
+            ParentTable = DtPeekSubtable ();
+
+            GtCount = (ACPI_CAST_PTR (ACPI_GTDT_TIMER_BLOCK,
+                Subtable->Buffer - sizeof(ACPI_GTDT_HEADER)))->TimerCount;
+
+            while (GtCount)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoGtdt0a,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                DtInsertSubtable (ParentTable, Subtable);
+                GtCount--;
+            }
+
+            DtPopSubtable ();
+            break;
+
+        default:
+
+            break;
+        }
+
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileFpdt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile FPDT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileFpdt (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    ACPI_FPDT_HEADER        *FpdtHeader;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoFpdtHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        FpdtHeader = ACPI_CAST_PTR (ACPI_FPDT_HEADER, Subtable->Buffer);
+
+        switch (FpdtHeader->Type)
+        {
+        case ACPI_FPDT_TYPE_BOOT:
+
+            InfoTable = AcpiDmTableInfoFpdt0;
+            break;
+
+        case ACPI_FPDT_TYPE_S3PERF:
+
+            InfoTable = AcpiDmTableInfoFpdt1;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "FPDT");
+            return (AE_ERROR);
+            break;
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileHest
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile HEST.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileHest (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    UINT16                  Type;
+    UINT32                  BankCount;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoHest,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    while (*PFieldList)
+    {
+        /* Get subtable type */
+
+        SubtableStart = *PFieldList;
+        DtCompileInteger ((UINT8 *) &Type, *PFieldList, 2, 0);
+
+        switch (Type)
+        {
+        case ACPI_HEST_TYPE_IA32_CHECK:
+
+            InfoTable = AcpiDmTableInfoHest0;
+            break;
+
+        case ACPI_HEST_TYPE_IA32_CORRECTED_CHECK:
+
+            InfoTable = AcpiDmTableInfoHest1;
+            break;
+
+        case ACPI_HEST_TYPE_IA32_NMI:
+
+            InfoTable = AcpiDmTableInfoHest2;
+            break;
+
+        case ACPI_HEST_TYPE_AER_ROOT_PORT:
+
+            InfoTable = AcpiDmTableInfoHest6;
+            break;
+
+        case ACPI_HEST_TYPE_AER_ENDPOINT:
+
+            InfoTable = AcpiDmTableInfoHest7;
+            break;
+
+        case ACPI_HEST_TYPE_AER_BRIDGE:
+
+            InfoTable = AcpiDmTableInfoHest8;
+            break;
+
+        case ACPI_HEST_TYPE_GENERIC_ERROR:
+
+            InfoTable = AcpiDmTableInfoHest9;
+            break;
+
+        default:
+
+            /* Cannot continue on unknown type */
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "HEST");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+
+        /*
+         * Additional subtable data - IA32 Error Bank(s)
+         */
+        BankCount = 0;
+        switch (Type)
+        {
+        case ACPI_HEST_TYPE_IA32_CHECK:
+
+            BankCount = (ACPI_CAST_PTR (ACPI_HEST_IA_MACHINE_CHECK,
+                Subtable->Buffer))->NumHardwareBanks;
+            break;
+
+        case ACPI_HEST_TYPE_IA32_CORRECTED_CHECK:
+
+            BankCount = (ACPI_CAST_PTR (ACPI_HEST_IA_CORRECTED,
+                Subtable->Buffer))->NumHardwareBanks;
+            break;
+
+        default:
+
+            break;
+        }
+
+        while (BankCount)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoHestBank,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            BankCount--;
+        }
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileIort
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile IORT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileIort (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_TABLE_IORT         *Iort;
+    ACPI_IORT_NODE          *IortNode;
+    ACPI_IORT_ITS_GROUP     *IortItsGroup;
+    ACPI_IORT_SMMU          *IortSmmu;
+    UINT32                  NodeNumber;
+    UINT32                  NodeLength;
+    UINT32                  IdMappingNumber;
+    UINT32                  ItsNumber;
+    UINT32                  ContextIrptNumber;
+    UINT32                  PmuIrptNumber;
+    UINT32                  PaddingLength;
+
+
+    ParentTable = DtPeekSubtable ();
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /*
+     * Using ACPI_SUB_PTR, We needn't define a separate structure. Care
+     * should be taken to avoid accessing ACPI_TABLE_HEADER fields.
+     */
+    Iort = ACPI_SUB_PTR (ACPI_TABLE_IORT,
+        Subtable->Buffer, sizeof (ACPI_TABLE_HEADER));
+
+    /*
+     * OptionalPadding - Variable-length data
+     * (Optional, size = OffsetToNodes - sizeof (ACPI_TABLE_IORT))
+     * Optionally allows the generic data types to be used for filling
+     * this field.
+     */
+    Iort->NodeOffset = sizeof (ACPI_TABLE_IORT);
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoIortPad,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+    if (Subtable)
+    {
+        DtInsertSubtable (ParentTable, Subtable);
+        Iort->NodeOffset += Subtable->Length;
+    }
+    else
+    {
+        Status = DtCompileGeneric (ACPI_CAST_PTR (void *, PFieldList),
+            AcpiDmTableInfoIortHdr[0].Name, &PaddingLength);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+        Iort->NodeOffset += PaddingLength;
+    }
+
+    NodeNumber = 0;
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoIortHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+        IortNode = ACPI_CAST_PTR (ACPI_IORT_NODE, Subtable->Buffer);
+        NodeLength = ACPI_OFFSET (ACPI_IORT_NODE, NodeData);
+
+        DtPushSubtable (Subtable);
+        ParentTable = DtPeekSubtable ();
+
+        switch (IortNode->Type)
+        {
+        case ACPI_IORT_NODE_ITS_GROUP:
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort0,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            IortItsGroup = ACPI_CAST_PTR (ACPI_IORT_ITS_GROUP, Subtable->Buffer);
+            NodeLength += Subtable->Length;
+
+            ItsNumber = 0;
+            while (*PFieldList)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort0a,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+                if (!Subtable)
+                {
+                    break;
+                }
+
+                DtInsertSubtable (ParentTable, Subtable);
+                NodeLength += Subtable->Length;
+                ItsNumber++;
+            }
+
+            IortItsGroup->ItsCount = ItsNumber;
+            break;
+
+        case ACPI_IORT_NODE_NAMED_COMPONENT:
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort1,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            NodeLength += Subtable->Length;
+
+            /*
+             * Padding - Variable-length data
+             * Optionally allows the offset of the ID mappings to be used
+             * for filling this field.
+             */
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort1a,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            if (Subtable)
+            {
+                DtInsertSubtable (ParentTable, Subtable);
+                NodeLength += Subtable->Length;
+            }
+            else
+            {
+                if (NodeLength > IortNode->MappingOffset)
+                {
+                    return (AE_BAD_DATA);
+                }
+
+                if (NodeLength < IortNode->MappingOffset)
+                {
+                    Status = DtCompilePadding (
+                        IortNode->MappingOffset - NodeLength,
+                        &Subtable);
+                    if (ACPI_FAILURE (Status))
+                    {
+                        return (Status);
+                    }
+
+                    DtInsertSubtable (ParentTable, Subtable);
+                    NodeLength = IortNode->MappingOffset;
+                }
+            }
+            break;
+
+        case ACPI_IORT_NODE_PCI_ROOT_COMPLEX:
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort2,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            NodeLength += Subtable->Length;
+            break;
+
+        case ACPI_IORT_NODE_SMMU:
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort3,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            IortSmmu = ACPI_CAST_PTR (ACPI_IORT_SMMU, Subtable->Buffer);
+            NodeLength += Subtable->Length;
+
+            /* Compile global interrupt array */
+
+            IortSmmu->GlobalInterruptOffset = NodeLength;
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort3a,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            NodeLength += Subtable->Length;
+
+            /* Compile context interrupt array */
+
+            ContextIrptNumber = 0;
+            IortSmmu->ContextInterruptOffset = NodeLength;
+            while (*PFieldList)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort3b,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                if (!Subtable)
+                {
+                    break;
+                }
+
+                DtInsertSubtable (ParentTable, Subtable);
+                NodeLength += Subtable->Length;
+                ContextIrptNumber++;
+            }
+
+            IortSmmu->ContextInterruptCount = ContextIrptNumber;
+
+            /* Compile PMU interrupt array */
+
+            PmuIrptNumber = 0;
+            IortSmmu->PmuInterruptOffset = NodeLength;
+            while (*PFieldList)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort3c,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                if (!Subtable)
+                {
+                    break;
+                }
+
+                DtInsertSubtable (ParentTable, Subtable);
+                NodeLength += Subtable->Length;
+                PmuIrptNumber++;
+            }
+
+            IortSmmu->PmuInterruptCount = PmuIrptNumber;
+            break;
+
+        case ACPI_IORT_NODE_SMMU_V3:
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIort4,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            NodeLength += Subtable->Length;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "IORT");
+            return (AE_ERROR);
+        }
+
+        /* Compile Array of ID mappings */
+
+        IortNode->MappingOffset = NodeLength;
+        IdMappingNumber = 0;
+        while (*PFieldList)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoIortMap,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            if (!Subtable)
+            {
+                break;
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            NodeLength += sizeof (ACPI_IORT_ID_MAPPING);
+            IdMappingNumber++;
+        }
+
+        IortNode->MappingCount = IdMappingNumber;
+
+        /*
+         * Node length can be determined by DT_LENGTH option
+         * IortNode->Length = NodeLength;
+         */
+        DtPopSubtable ();
+        ParentTable = DtPeekSubtable ();
+        NodeNumber++;
+    }
+
+    Iort->NodeCount = NodeNumber;
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileIvrs
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile IVRS.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileIvrs (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_IVRS_HEADER        *IvrsHeader;
+    UINT8                   EntryType;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoIvrs,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoIvrsHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        IvrsHeader = ACPI_CAST_PTR (ACPI_IVRS_HEADER, Subtable->Buffer);
+
+        switch (IvrsHeader->Type)
+        {
+        case ACPI_IVRS_TYPE_HARDWARE:
+
+            InfoTable = AcpiDmTableInfoIvrs0;
+            break;
+
+        case ACPI_IVRS_TYPE_MEMORY1:
+        case ACPI_IVRS_TYPE_MEMORY2:
+        case ACPI_IVRS_TYPE_MEMORY3:
+
+            InfoTable = AcpiDmTableInfoIvrs1;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "IVRS");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+
+        if (IvrsHeader->Type == ACPI_IVRS_TYPE_HARDWARE)
+        {
+            while (*PFieldList &&
+                !strcmp ((*PFieldList)->Name, "Entry Type"))
+            {
+                SubtableStart = *PFieldList;
+                DtCompileInteger (&EntryType, *PFieldList, 1, 0);
+
+                switch (EntryType)
+                {
+                /* 4-byte device entries */
+
+                case ACPI_IVRS_TYPE_PAD4:
+                case ACPI_IVRS_TYPE_ALL:
+                case ACPI_IVRS_TYPE_SELECT:
+                case ACPI_IVRS_TYPE_START:
+                case ACPI_IVRS_TYPE_END:
+
+                    InfoTable = AcpiDmTableInfoIvrs4;
+                    break;
+
+                /* 8-byte entries, type A */
+
+                case ACPI_IVRS_TYPE_ALIAS_SELECT:
+                case ACPI_IVRS_TYPE_ALIAS_START:
+
+                    InfoTable = AcpiDmTableInfoIvrs8a;
+                    break;
+
+                /* 8-byte entries, type B */
+
+                case ACPI_IVRS_TYPE_PAD8:
+                case ACPI_IVRS_TYPE_EXT_SELECT:
+                case ACPI_IVRS_TYPE_EXT_START:
+
+                    InfoTable = AcpiDmTableInfoIvrs8b;
+                    break;
+
+                /* 8-byte entries, type C */
+
+                case ACPI_IVRS_TYPE_SPECIAL:
+
+                    InfoTable = AcpiDmTableInfoIvrs8c;
+                    break;
+
+                default:
+
+                    DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart,
+                        "IVRS Device Entry");
+                    return (AE_ERROR);
+                }
+
+                Status = DtCompileTable (PFieldList, InfoTable,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                DtInsertSubtable (ParentTable, Subtable);
+            }
+        }
+
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/dttable2.c b/usr/src/cmd/acpi/iasl/dttable2.c
new file mode 100644
index 0000000000..9eb04117e2
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dttable2.c
@@ -0,0 +1,1691 @@
+/******************************************************************************
+ *
+ * Module Name: dttable2.c - handling for specific ACPI tables
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+/* Compile all complex data tables, signatures starting with L-Z */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dttable2")
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileLpit
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile LPIT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileLpit (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    ACPI_LPIT_HEADER        *LpitHeader;
+
+
+    /* Note: Main table consists only of the standard ACPI table header */
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+
+        /* LPIT Subtable header */
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoLpitHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        LpitHeader = ACPI_CAST_PTR (ACPI_LPIT_HEADER, Subtable->Buffer);
+
+        switch (LpitHeader->Type)
+        {
+        case ACPI_LPIT_TYPE_NATIVE_CSTATE:
+
+            InfoTable = AcpiDmTableInfoLpit0;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "LPIT");
+            return (AE_ERROR);
+        }
+
+        /* LPIT Subtable */
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileMadt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile MADT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileMadt (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_SUBTABLE_HEADER    *MadtHeader;
+    ACPI_DMTABLE_INFO       *InfoTable;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoMadt,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoMadtHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        MadtHeader = ACPI_CAST_PTR (ACPI_SUBTABLE_HEADER, Subtable->Buffer);
+
+        switch (MadtHeader->Type)
+        {
+        case ACPI_MADT_TYPE_LOCAL_APIC:
+
+            InfoTable = AcpiDmTableInfoMadt0;
+            break;
+
+        case ACPI_MADT_TYPE_IO_APIC:
+
+            InfoTable = AcpiDmTableInfoMadt1;
+            break;
+
+        case ACPI_MADT_TYPE_INTERRUPT_OVERRIDE:
+
+            InfoTable = AcpiDmTableInfoMadt2;
+            break;
+
+        case ACPI_MADT_TYPE_NMI_SOURCE:
+
+            InfoTable = AcpiDmTableInfoMadt3;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_APIC_NMI:
+
+            InfoTable = AcpiDmTableInfoMadt4;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_APIC_OVERRIDE:
+
+            InfoTable = AcpiDmTableInfoMadt5;
+            break;
+
+        case ACPI_MADT_TYPE_IO_SAPIC:
+
+            InfoTable = AcpiDmTableInfoMadt6;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_SAPIC:
+
+            InfoTable = AcpiDmTableInfoMadt7;
+            break;
+
+        case ACPI_MADT_TYPE_INTERRUPT_SOURCE:
+
+            InfoTable = AcpiDmTableInfoMadt8;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_X2APIC:
+
+            InfoTable = AcpiDmTableInfoMadt9;
+            break;
+
+        case ACPI_MADT_TYPE_LOCAL_X2APIC_NMI:
+
+            InfoTable = AcpiDmTableInfoMadt10;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_INTERRUPT:
+
+            InfoTable = AcpiDmTableInfoMadt11;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_DISTRIBUTOR:
+
+            InfoTable = AcpiDmTableInfoMadt12;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_MSI_FRAME:
+
+            InfoTable = AcpiDmTableInfoMadt13;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_REDISTRIBUTOR:
+
+            InfoTable = AcpiDmTableInfoMadt14;
+            break;
+
+        case ACPI_MADT_TYPE_GENERIC_TRANSLATOR:
+
+            InfoTable = AcpiDmTableInfoMadt15;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "MADT");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileMcfg
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile MCFG.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileMcfg (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoMcfg, AcpiDmTableInfoMcfg0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileMpst
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile MPST.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileMpst (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    ACPI_MPST_CHANNEL       *MpstChannelInfo;
+    ACPI_MPST_POWER_NODE    *MpstPowerNode;
+    ACPI_MPST_DATA_HDR      *MpstDataHeader;
+    UINT16                  SubtableCount;
+    UINT32                  PowerStateCount;
+    UINT32                  ComponentCount;
+
+
+    /* Main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoMpst, &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+    DtPushSubtable (Subtable);
+
+    MpstChannelInfo = ACPI_CAST_PTR (ACPI_MPST_CHANNEL, Subtable->Buffer);
+    SubtableCount = MpstChannelInfo->PowerNodeCount;
+
+    while (*PFieldList && SubtableCount)
+    {
+        /* Subtable: Memory Power Node(s) */
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoMpst0,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        MpstPowerNode = ACPI_CAST_PTR (ACPI_MPST_POWER_NODE, Subtable->Buffer);
+        PowerStateCount = MpstPowerNode->NumPowerStates;
+        ComponentCount = MpstPowerNode->NumPhysicalComponents;
+
+        ParentTable = DtPeekSubtable ();
+
+        /* Sub-subtables - Memory Power State Structure(s) */
+
+        while (*PFieldList && PowerStateCount)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoMpst0A,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            PowerStateCount--;
+        }
+
+        /* Sub-subtables - Physical Component ID Structure(s) */
+
+        while (*PFieldList && ComponentCount)
+        {
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoMpst0B,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            DtInsertSubtable (ParentTable, Subtable);
+            ComponentCount--;
+        }
+
+        SubtableCount--;
+        DtPopSubtable ();
+    }
+
+    /* Subtable: Count of Memory Power State Characteristic structures */
+
+    DtPopSubtable ();
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoMpst1, &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+    DtPushSubtable (Subtable);
+
+    MpstDataHeader = ACPI_CAST_PTR (ACPI_MPST_DATA_HDR, Subtable->Buffer);
+    SubtableCount = MpstDataHeader->CharacteristicsCount;
+
+    ParentTable = DtPeekSubtable ();
+
+    /* Subtable: Memory Power State Characteristics structure(s) */
+
+    while (*PFieldList && SubtableCount)
+    {
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoMpst2,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        DtInsertSubtable (ParentTable, Subtable);
+        SubtableCount--;
+    }
+
+    DtPopSubtable ();
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileMsct
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile MSCT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileMsct (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoMsct, AcpiDmTableInfoMsct0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileMtmr
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile MTMR.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileMtmr (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoMtmr, AcpiDmTableInfoMtmr0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileNfit
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile NFIT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileNfit (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_NFIT_HEADER        *NfitHeader;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    UINT32                  Count;
+    ACPI_NFIT_INTERLEAVE    *Interleave = NULL;
+    ACPI_NFIT_FLUSH_ADDRESS *Hint = NULL;
+
+
+    /* Main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoNfit,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+    DtPushSubtable (Subtable);
+
+    /* Subtables */
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoNfitHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        NfitHeader = ACPI_CAST_PTR (ACPI_NFIT_HEADER, Subtable->Buffer);
+
+        switch (NfitHeader->Type)
+        {
+        case ACPI_NFIT_TYPE_SYSTEM_ADDRESS:
+
+            InfoTable = AcpiDmTableInfoNfit0;
+            break;
+
+        case ACPI_NFIT_TYPE_MEMORY_MAP:
+
+            InfoTable = AcpiDmTableInfoNfit1;
+            break;
+
+        case ACPI_NFIT_TYPE_INTERLEAVE:
+
+            Interleave = ACPI_CAST_PTR (ACPI_NFIT_INTERLEAVE, Subtable->Buffer);
+            InfoTable = AcpiDmTableInfoNfit2;
+            break;
+
+        case ACPI_NFIT_TYPE_SMBIOS:
+
+            InfoTable = AcpiDmTableInfoNfit3;
+            break;
+
+        case ACPI_NFIT_TYPE_CONTROL_REGION:
+
+            InfoTable = AcpiDmTableInfoNfit4;
+            break;
+
+        case ACPI_NFIT_TYPE_DATA_REGION:
+
+            InfoTable = AcpiDmTableInfoNfit5;
+            break;
+
+        case ACPI_NFIT_TYPE_FLUSH_ADDRESS:
+
+            Hint = ACPI_CAST_PTR (ACPI_NFIT_FLUSH_ADDRESS, Subtable->Buffer);
+            InfoTable = AcpiDmTableInfoNfit6;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "NFIT");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPopSubtable ();
+
+        switch (NfitHeader->Type)
+        {
+        case ACPI_NFIT_TYPE_INTERLEAVE:
+
+            Count = 0;
+            DtPushSubtable (Subtable);
+            while (*PFieldList)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoNfit2a,
+                    &Subtable, FALSE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                if (!Subtable)
+                {
+                    DtPopSubtable ();
+                    break;
+                }
+
+                ParentTable = DtPeekSubtable ();
+                DtInsertSubtable (ParentTable, Subtable);
+                Count++;
+            }
+
+            Interleave->LineCount = Count;
+            DtPopSubtable ();
+            break;
+
+        case ACPI_NFIT_TYPE_SMBIOS:
+
+            if (*PFieldList)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoNfit3a,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                if (Subtable)
+                {
+                    DtInsertSubtable (ParentTable, Subtable);
+                }
+            }
+            break;
+
+        case ACPI_NFIT_TYPE_FLUSH_ADDRESS:
+
+            Count = 0;
+            DtPushSubtable (Subtable);
+            while (*PFieldList)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoNfit6a,
+                    &Subtable, FALSE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                if (!Subtable)
+                {
+                    DtPopSubtable ();
+                    break;
+                }
+
+                ParentTable = DtPeekSubtable ();
+                DtInsertSubtable (ParentTable, Subtable);
+                Count++;
+            }
+
+            Hint->HintCount = (UINT16) Count;
+            DtPopSubtable ();
+            break;
+
+        default:
+            break;
+        }
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompilePcct
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile PCCT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompilePcct (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_SUBTABLE_HEADER    *PcctHeader;
+    ACPI_DMTABLE_INFO       *InfoTable;
+
+
+    /* Main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoPcct,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /* Subtables */
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoPcctHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        PcctHeader = ACPI_CAST_PTR (ACPI_SUBTABLE_HEADER, Subtable->Buffer);
+
+        switch (PcctHeader->Type)
+        {
+        case ACPI_PCCT_TYPE_GENERIC_SUBSPACE:
+
+            InfoTable = AcpiDmTableInfoPcct0;
+            break;
+
+        case ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE:
+
+            InfoTable = AcpiDmTableInfoPcct1;
+            break;
+
+        case ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE_TYPE2:
+
+            InfoTable = AcpiDmTableInfoPcct2;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "PCCT");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompilePmtt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile PMTT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompilePmtt (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_PMTT_HEADER        *PmttHeader;
+    ACPI_PMTT_CONTROLLER    *PmttController;
+    UINT16                  DomainCount;
+    UINT8                   PrevType = ACPI_PMTT_TYPE_SOCKET;
+
+
+    /* Main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoPmtt, &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+    DtPushSubtable (Subtable);
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoPmttHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        PmttHeader = ACPI_CAST_PTR (ACPI_PMTT_HEADER, Subtable->Buffer);
+        while (PrevType >= PmttHeader->Type)
+        {
+            DtPopSubtable ();
+
+            if (PrevType == ACPI_PMTT_TYPE_SOCKET)
+            {
+                break;
+            }
+
+            PrevType--;
+        }
+
+        PrevType = PmttHeader->Type;
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        switch (PmttHeader->Type)
+        {
+        case ACPI_PMTT_TYPE_SOCKET:
+
+            /* Subtable: Socket Structure */
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoPmtt0,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            ParentTable = DtPeekSubtable ();
+            DtInsertSubtable (ParentTable, Subtable);
+            break;
+
+        case ACPI_PMTT_TYPE_CONTROLLER:
+
+            /* Subtable: Memory Controller Structure */
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoPmtt1,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            ParentTable = DtPeekSubtable ();
+            DtInsertSubtable (ParentTable, Subtable);
+
+            PmttController = ACPI_CAST_PTR (ACPI_PMTT_CONTROLLER,
+                (Subtable->Buffer - sizeof (ACPI_PMTT_HEADER)));
+            DomainCount = PmttController->DomainCount;
+
+            while (DomainCount)
+            {
+                Status = DtCompileTable (PFieldList, AcpiDmTableInfoPmtt1a,
+                    &Subtable, TRUE);
+                if (ACPI_FAILURE (Status))
+                {
+                    return (Status);
+                }
+
+                DtInsertSubtable (ParentTable, Subtable);
+                DomainCount--;
+            }
+            break;
+
+        case ACPI_PMTT_TYPE_DIMM:
+
+            /* Subtable: Physical Component Structure */
+
+            Status = DtCompileTable (PFieldList, AcpiDmTableInfoPmtt2,
+                &Subtable, TRUE);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+
+            ParentTable = DtPeekSubtable ();
+            DtInsertSubtable (ParentTable, Subtable);
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "PMTT");
+            return (AE_ERROR);
+        }
+    }
+
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileRsdt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile RSDT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileRsdt (
+    void                    **List)
+{
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                *FieldList = *(DT_FIELD **) List;
+    UINT32                  Address;
+
+
+    ParentTable = DtPeekSubtable ();
+
+    while (FieldList)
+    {
+        DtCompileInteger ((UINT8 *) &Address, FieldList, 4, DT_NON_ZERO);
+
+        DtCreateSubtable ((UINT8 *) &Address, 4, &Subtable);
+        DtInsertSubtable (ParentTable, Subtable);
+        FieldList = FieldList->Next;
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileS3pt
+ *
+ * PARAMETERS:  PFieldList          - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile S3PT (Pointed to by FPDT)
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileS3pt (
+    DT_FIELD                **PFieldList)
+{
+    ACPI_STATUS             Status;
+    ACPI_FPDT_HEADER        *S3ptHeader;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    ACPI_DMTABLE_INFO       *InfoTable;
+    DT_FIELD                *SubtableStart;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoS3pt,
+        &Gbl_RootTable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    DtPushSubtable (Gbl_RootTable);
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoS3ptHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        S3ptHeader = ACPI_CAST_PTR (ACPI_FPDT_HEADER, Subtable->Buffer);
+
+        switch (S3ptHeader->Type)
+        {
+        case ACPI_S3PT_TYPE_RESUME:
+
+            InfoTable = AcpiDmTableInfoS3pt0;
+            break;
+
+        case ACPI_S3PT_TYPE_SUSPEND:
+
+            InfoTable = AcpiDmTableInfoS3pt1;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "S3PT");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileSlic
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile SLIC.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileSlic (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+
+
+    while (*PFieldList)
+    {
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoSlic,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileSlit
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile SLIT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileSlit (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *FieldList;
+    UINT32                  Localities;
+    UINT8                   *LocalityBuffer;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoSlit,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    Localities = *ACPI_CAST_PTR (UINT32, Subtable->Buffer);
+    LocalityBuffer = UtLocalCalloc (Localities);
+
+    /* Compile each locality buffer */
+
+    FieldList = *PFieldList;
+    while (FieldList)
+    {
+        DtCompileBuffer (LocalityBuffer,
+            FieldList->Value, FieldList, Localities);
+
+        DtCreateSubtable (LocalityBuffer, Localities, &Subtable);
+        DtInsertSubtable (ParentTable, Subtable);
+        FieldList = FieldList->Next;
+    }
+
+    ACPI_FREE (LocalityBuffer);
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileSrat
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile SRAT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileSrat (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_FIELD                *SubtableStart;
+    ACPI_SUBTABLE_HEADER    *SratHeader;
+    ACPI_DMTABLE_INFO       *InfoTable;
+
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoSrat,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    while (*PFieldList)
+    {
+        SubtableStart = *PFieldList;
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoSratHdr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPushSubtable (Subtable);
+
+        SratHeader = ACPI_CAST_PTR (ACPI_SUBTABLE_HEADER, Subtable->Buffer);
+
+        switch (SratHeader->Type)
+        {
+        case ACPI_SRAT_TYPE_CPU_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat0;
+            break;
+
+        case ACPI_SRAT_TYPE_MEMORY_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat1;
+            break;
+
+        case ACPI_SRAT_TYPE_X2APIC_CPU_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat2;
+            break;
+
+        case ACPI_SRAT_TYPE_GICC_AFFINITY:
+
+            InfoTable = AcpiDmTableInfoSrat3;
+            break;
+
+        default:
+
+            DtFatal (ASL_MSG_UNKNOWN_SUBTABLE, SubtableStart, "SRAT");
+            return (AE_ERROR);
+        }
+
+        Status = DtCompileTable (PFieldList, InfoTable, &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+        DtPopSubtable ();
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileStao
+ *
+ * PARAMETERS:  PFieldList          - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile STAO.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileStao (
+    void                    **List)
+{
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    ACPI_STATUS             Status;
+
+
+    /* Compile the main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoStao,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /* Compile each ASCII namestring as a subtable */
+
+    while (*PFieldList)
+    {
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoStaoStr,
+            &Subtable, TRUE);
+        if (ACPI_FAILURE (Status))
+        {
+            return (Status);
+        }
+
+        ParentTable = DtPeekSubtable ();
+        DtInsertSubtable (ParentTable, Subtable);
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileTcpa
+ *
+ * PARAMETERS:  PFieldList          - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile TCPA.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileTcpa (
+    void                    **List)
+{
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_SUBTABLE             *Subtable;
+    ACPI_TABLE_TCPA_HDR     *TcpaHeader;
+    DT_SUBTABLE             *ParentTable;
+    ACPI_STATUS             Status;
+
+
+    /* Compile the main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoTcpaHdr,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /*
+     * Examine the PlatformClass field to determine the table type.
+     * Either a client or server table. Only one.
+     */
+    TcpaHeader = ACPI_CAST_PTR (ACPI_TABLE_TCPA_HDR, ParentTable->Buffer);
+
+    switch (TcpaHeader->PlatformClass)
+    {
+    case ACPI_TCPA_CLIENT_TABLE:
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoTcpaClient,
+            &Subtable, TRUE);
+        break;
+
+    case ACPI_TCPA_SERVER_TABLE:
+
+        Status = DtCompileTable (PFieldList, AcpiDmTableInfoTcpaServer,
+            &Subtable, TRUE);
+        break;
+
+    default:
+
+        AcpiOsPrintf ("\n**** Unknown TCPA Platform Class 0x%X\n",
+            TcpaHeader->PlatformClass);
+        Status = AE_ERROR;
+        break;
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetGenericTableInfo
+ *
+ * PARAMETERS:  Name                - Generic type name
+ *
+ * RETURN:      Info entry
+ *
+ * DESCRIPTION: Obtain table info for a generic name entry
+ *
+ *****************************************************************************/
+
+ACPI_DMTABLE_INFO *
+DtGetGenericTableInfo (
+    char                    *Name)
+{
+    ACPI_DMTABLE_INFO       *Info;
+    UINT32                  i;
+
+
+    if (!Name)
+    {
+        return (NULL);
+    }
+
+    /* Search info table for name match */
+
+    for (i = 0; ; i++)
+    {
+        Info = AcpiDmTableInfoGeneric[i];
+        if (Info->Opcode == ACPI_DMT_EXIT)
+        {
+            Info = NULL;
+            break;
+        }
+
+        /* Use caseless compare for generic keywords */
+
+        if (!AcpiUtStricmp (Name, Info->Name))
+        {
+            break;
+        }
+    }
+
+    return (Info);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileUefi
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile UEFI.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileUefi (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    UINT16                  *DataOffset;
+
+
+    /* Compile the predefined portion of the UEFI table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoUefi,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    DataOffset = (UINT16 *) (Subtable->Buffer + 16);
+    *DataOffset = sizeof (ACPI_TABLE_UEFI);
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /*
+     * Compile the "generic" portion of the UEFI table. This
+     * part of the table is not predefined and any of the generic
+     * operators may be used.
+     */
+    DtCompileGeneric ((void **) PFieldList, NULL, NULL);
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileVrtc
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile VRTC.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileVrtc (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoVrtc, AcpiDmTableInfoVrtc0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileWdat
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile WDAT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileWdat (
+    void                    **List)
+{
+    ACPI_STATUS             Status;
+
+
+    Status = DtCompileTwoSubtables (List,
+        AcpiDmTableInfoWdat, AcpiDmTableInfoWdat0);
+    return (Status);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileWpbt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile WPBT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileWpbt (
+    void                    **List)
+{
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    ACPI_TABLE_WPBT         *Table;
+    ACPI_STATUS             Status;
+    UINT16                  Length;
+
+
+    /* Compile the main table */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoWpbt,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+
+    /* Compile the argument list subtable */
+
+    Status = DtCompileTable (PFieldList, AcpiDmTableInfoWpbt0,
+        &Subtable, TRUE);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /* Extract the length of the Arguments buffer, insert into main table */
+
+    Length = (UINT16) Subtable->TotalLength;
+    Table = ACPI_CAST_PTR (ACPI_TABLE_WPBT, ParentTable->Buffer);
+    Table->ArgumentsLength = Length;
+
+    ParentTable = DtPeekSubtable ();
+    DtInsertSubtable (ParentTable, Subtable);
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileXsdt
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile XSDT.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileXsdt (
+    void                    **List)
+{
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                *FieldList = *(DT_FIELD **) List;
+    UINT64                  Address;
+
+
+    ParentTable = DtPeekSubtable ();
+
+    while (FieldList)
+    {
+        DtCompileInteger ((UINT8 *) &Address, FieldList, 8, DT_NON_ZERO);
+
+        DtCreateSubtable ((UINT8 *) &Address, 8, &Subtable);
+        DtInsertSubtable (ParentTable, Subtable);
+        FieldList = FieldList->Next;
+    }
+
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtCompileGeneric
+ *
+ * PARAMETERS:  List                - Current field list pointer
+ *              Name                - Field name to end generic compiling
+ *              Length              - Compiled table length to return
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compile generic unknown table.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtCompileGeneric (
+    void                    **List,
+    char                    *Name,
+    UINT32                  *Length)
+{
+    ACPI_STATUS             Status;
+    DT_SUBTABLE             *Subtable;
+    DT_SUBTABLE             *ParentTable;
+    DT_FIELD                **PFieldList = (DT_FIELD **) List;
+    ACPI_DMTABLE_INFO       *Info;
+
+
+    ParentTable = DtPeekSubtable ();
+
+    /*
+     * Compile the "generic" portion of the table. This
+     * part of the table is not predefined and any of the generic
+     * operators may be used.
+     */
+
+    /* Find any and all labels in the entire generic portion */
+
+    DtDetectAllLabels (*PFieldList);
+
+    /* Now we can actually compile the parse tree */
+
+    if (Length && *Length)
+    {
+        *Length = 0;
+    }
+    while (*PFieldList)
+    {
+        if (Name && !strcmp ((*PFieldList)->Name, Name))
+        {
+            break;
+        }
+
+        Info = DtGetGenericTableInfo ((*PFieldList)->Name);
+        if (!Info)
+        {
+            sprintf (MsgBuffer, "Generic data type \"%s\" not found",
+                (*PFieldList)->Name);
+            DtNameError (ASL_ERROR, ASL_MSG_INVALID_FIELD_NAME,
+                (*PFieldList), MsgBuffer);
+
+            *PFieldList = (*PFieldList)->Next;
+            continue;
+        }
+
+        Status = DtCompileTable (PFieldList, Info,
+            &Subtable, TRUE);
+        if (ACPI_SUCCESS (Status))
+        {
+            DtInsertSubtable (ParentTable, Subtable);
+            if (Length)
+            {
+                *Length += Subtable->Length;
+            }
+        }
+        else
+        {
+            *PFieldList = (*PFieldList)->Next;
+
+            if (Status == AE_NOT_FOUND)
+            {
+                sprintf (MsgBuffer, "Generic data type \"%s\" not found",
+                    (*PFieldList)->Name);
+                DtNameError (ASL_ERROR, ASL_MSG_INVALID_FIELD_NAME,
+                    (*PFieldList), MsgBuffer);
+            }
+        }
+    }
+
+    return (AE_OK);
+}
diff --git a/usr/src/cmd/acpi/iasl/dttemplate.c b/usr/src/cmd/acpi/iasl/dttemplate.c
new file mode 100644
index 0000000000..0d286c0e15
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dttemplate.c
@@ -0,0 +1,593 @@
+/******************************************************************************
+ *
+ * Module Name: dttemplate - ACPI table template generation
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "acapps.h"
+#include "dtcompiler.h"
+#include "dttemplate.h" /* Contains the hex ACPI table templates */
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dttemplate")
+
+
+/* Local prototypes */
+
+static BOOLEAN
+AcpiUtIsSpecialTable (
+    char                    *Signature);
+
+static ACPI_STATUS
+DtCreateOneTemplateFile (
+    char                    *Signature,
+    UINT32                  TableCount);
+
+static ACPI_STATUS
+DtCreateOneTemplate (
+    char                    *Signature,
+    UINT32                  TableCount,
+    const ACPI_DMTABLE_DATA *TableData);
+
+static ACPI_STATUS
+DtCreateAllTemplates (
+    void);
+
+static int
+DtEmitDefinitionBlock (
+    FILE                    *File,
+    char                    *Filename,
+    char                    *Signature,
+    UINT32                  Instance);
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AcpiUtIsSpecialTable
+ *
+ * PARAMETERS:  Signature           - ACPI table signature
+ *
+ * RETURN:      TRUE if signature is a special ACPI table
+ *
+ * DESCRIPTION: Check for valid ACPI tables that are not in the main ACPI
+ *              table data structure (AcpiDmTableData).
+ *
+ ******************************************************************************/
+
+static BOOLEAN
+AcpiUtIsSpecialTable (
+    char                    *Signature)
+{
+
+    if (ACPI_COMPARE_NAME (Signature, ACPI_SIG_DSDT) ||
+        ACPI_COMPARE_NAME (Signature, ACPI_SIG_OSDT) ||
+        ACPI_COMPARE_NAME (Signature, ACPI_SIG_SSDT) ||
+        ACPI_COMPARE_NAME (Signature, ACPI_SIG_FACS) ||
+        ACPI_COMPARE_NAME (Signature, ACPI_RSDP_NAME))
+    {
+        return (TRUE);
+    }
+
+    return (FALSE);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtCreateTemplates
+ *
+ * PARAMETERS:  argv                - Standard command line arguments
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Create one or more template files.
+ *
+ ******************************************************************************/
+
+ACPI_STATUS
+DtCreateTemplates (
+    char                    **argv)
+{
+    char                    *Signature;
+    char                    *End;
+    unsigned long           TableCount;
+    ACPI_STATUS             Status = AE_OK;
+
+
+    AslInitializeGlobals ();
+
+    Status = AdInitialize ();
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    /*
+     * Special cases for DSDT, ALL, and '*'
+     */
+
+    /* Default (no signature option) is DSDT */
+
+    if (AcpiGbl_Optind < 3)
+    {
+        Status = DtCreateOneTemplateFile (ACPI_SIG_DSDT, 0);
+        goto Exit;
+    }
+
+    AcpiGbl_Optind--;
+    Signature = argv[AcpiGbl_Optind];
+    AcpiUtStrupr (Signature);
+
+    /*
+     * Multiple SSDT support (-T <ssdt count>)
+     */
+    TableCount = strtoul (Signature, &End, 0);
+    if (Signature != End)
+    {
+        /* The count is used for table ID and method name - max is 254(+1) */
+
+        if (TableCount > 254)
+        {
+            fprintf (stderr, "%u SSDTs requested, maximum is 254\n",
+                (unsigned int) TableCount);
+
+            Status = AE_LIMIT;
+            goto Exit;
+        }
+
+        Status = DtCreateOneTemplateFile (ACPI_SIG_DSDT, TableCount);
+        goto Exit;
+    }
+
+    if (!strcmp (Signature, "ALL"))
+    {
+        /* Create all available/known templates */
+
+        Status = DtCreateAllTemplates ();
+        goto Exit;
+    }
+
+    /*
+     * Normal case: Create template for each signature
+     */
+    while (argv[AcpiGbl_Optind])
+    {
+        Signature = argv[AcpiGbl_Optind];
+        AcpiUtStrupr (Signature);
+
+        Status = DtCreateOneTemplateFile (Signature, 0);
+        if (ACPI_FAILURE (Status))
+        {
+            goto Exit;
+        }
+
+        AcpiGbl_Optind++;
+    }
+
+
+Exit:
+    /* Shutdown ACPICA subsystem */
+
+    (void) AcpiTerminate ();
+    CmDeleteCaches ();
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtCreateOneTemplateFile
+ *
+ * PARAMETERS:  Signature           - ACPI table signature
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Create one template file of the requested signature.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+DtCreateOneTemplateFile (
+    char                    *Signature,
+    UINT32                  TableCount)
+{
+    const ACPI_DMTABLE_DATA *TableData;
+    ACPI_STATUS             Status;
+
+
+    /*
+     * Validate signature and get the template data:
+     *  1) Signature must be 4 characters
+     *  2) Signature must be a recognized ACPI table
+     *  3) There must be a template associated with the signature
+     */
+    if (strlen (Signature) != ACPI_NAME_SIZE)
+    {
+        fprintf (stderr,
+            "%s: Invalid ACPI table signature "
+            "(length must be 4 characters)\n", Signature);
+        return (AE_ERROR);
+    }
+
+    /*
+     * Some slack for the two strange tables whose name is different than
+     * their signatures: MADT->APIC and FADT->FACP.
+     */
+    if (!strcmp (Signature, "MADT"))
+    {
+        Signature = "APIC";
+    }
+    else if (!strcmp (Signature, "FADT"))
+    {
+        Signature = "FACP";
+    }
+
+    /* TableData will point to the template */
+
+    TableData = AcpiDmGetTableData (Signature);
+    if (TableData)
+    {
+        if (!TableData->Template)
+        {
+            fprintf (stderr, "%4.4s: No template available\n", Signature);
+            return (AE_ERROR);
+        }
+    }
+    else if (!AcpiUtIsSpecialTable (Signature))
+    {
+        fprintf (stderr,
+            "%4.4s: Unrecognized ACPI table signature\n", Signature);
+        return (AE_ERROR);
+    }
+
+    Status = DtCreateOneTemplate (Signature, TableCount, TableData);
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtCreateAllTemplates
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Create all currently defined template files
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+DtCreateAllTemplates (
+    void)
+{
+    const ACPI_DMTABLE_DATA *TableData;
+    ACPI_STATUS             Status;
+
+
+    fprintf (stderr, "Creating all supported Template files\n");
+
+    /* Walk entire ACPI table data structure */
+
+    for (TableData = AcpiDmTableData; TableData->Signature; TableData++)
+    {
+        /* If table has a template, create the template file */
+
+        if (TableData->Template)
+        {
+            Status = DtCreateOneTemplate (TableData->Signature,
+                0, TableData);
+            if (ACPI_FAILURE (Status))
+            {
+                return (Status);
+            }
+        }
+    }
+
+    /*
+     * Create the special ACPI tables:
+     * 1) DSDT/SSDT are AML tables, not data tables
+     * 2) FACS and RSDP have non-standard headers
+     */
+    Status = DtCreateOneTemplate (ACPI_SIG_DSDT, 0, NULL);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = DtCreateOneTemplate (ACPI_SIG_SSDT, 0, NULL);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = DtCreateOneTemplate (ACPI_SIG_OSDT, 0, NULL);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = DtCreateOneTemplate (ACPI_SIG_FACS, 0, NULL);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    Status = DtCreateOneTemplate (ACPI_RSDP_NAME, 0, NULL);
+    if (ACPI_FAILURE (Status))
+    {
+        return (Status);
+    }
+
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtCreateOneTemplate
+ *
+ * PARAMETERS:  Signature           - ACPI signature, NULL terminated.
+ *              TableCount          - Used for SSDTs in same file as DSDT
+ *              TableData           - Entry in ACPI table data structure.
+ *                                    NULL if a special ACPI table.
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Create one template source file for the requested ACPI table.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+DtCreateOneTemplate (
+    char                    *Signature,
+    UINT32                  TableCount,
+    const ACPI_DMTABLE_DATA  *TableData)
+{
+    char                    *DisasmFilename;
+    FILE                    *File;
+    ACPI_STATUS             Status = AE_OK;
+    int                     Actual;
+    UINT32                  i;
+
+
+    /* New file will have a .asl suffix */
+
+    DisasmFilename = FlGenerateFilename (
+        Signature, FILE_SUFFIX_ASL_CODE);
+    if (!DisasmFilename)
+    {
+        fprintf (stderr, "Could not generate output filename\n");
+        return (AE_ERROR);
+    }
+
+    AcpiUtStrlwr (DisasmFilename);
+    if (!UtQueryForOverwrite (DisasmFilename))
+    {
+        return (AE_ERROR);
+    }
+
+    File = fopen (DisasmFilename, "w+");
+    if (!File)
+    {
+        fprintf (stderr, "Could not open output file %s\n",
+            DisasmFilename);
+        return (AE_ERROR);
+    }
+
+    /* Emit the common file header */
+
+    AcpiOsRedirectOutput (File);
+
+    AcpiOsPrintf ("/*\n");
+    AcpiOsPrintf (ACPI_COMMON_HEADER ("iASL Compiler/Disassembler", " * "));
+
+    if (TableCount == 0)
+    {
+        AcpiOsPrintf (" * Template for [%4.4s] ACPI Table",
+            Signature);
+    }
+    else
+    {
+        AcpiOsPrintf (" * Template for [%4.4s] and %u [SSDT] ACPI Tables",
+            Signature, TableCount);
+    }
+
+    /* Dump the actual ACPI table */
+
+    if (TableData)
+    {
+        /* Normal case, tables that appear in AcpiDmTableData */
+
+        AcpiOsPrintf (" (static data table)\n");
+
+        if (Gbl_VerboseTemplates)
+        {
+            AcpiOsPrintf (" * Format: [HexOffset DecimalOffset ByteLength]"
+                "  FieldName : HexFieldValue\n */\n\n");
+        }
+        else
+        {
+            AcpiOsPrintf (" * Format: [ByteLength]"
+                "  FieldName : HexFieldValue\n */\n");
+        }
+
+        AcpiDmDumpDataTable (ACPI_CAST_PTR (ACPI_TABLE_HEADER,
+            TableData->Template));
+    }
+    else
+    {
+        /* Special ACPI tables - DSDT, SSDT, OSDT, FACS, RSDP */
+
+        AcpiOsPrintf (" (AML byte code table)\n");
+        AcpiOsPrintf (" */\n");
+
+        if (ACPI_COMPARE_NAME (Signature, ACPI_SIG_DSDT))
+        {
+            Actual = DtEmitDefinitionBlock (
+                File, DisasmFilename, ACPI_SIG_DSDT, 1);
+            if (Actual < 0)
+            {
+                Status = AE_ERROR;
+                goto Cleanup;
+            }
+
+            /* Emit any requested SSDTs into the same file */
+
+            for (i = 1; i <= TableCount; i++)
+            {
+                Actual = DtEmitDefinitionBlock (
+                    File, DisasmFilename, ACPI_SIG_SSDT, i + 1);
+                if (Actual < 0)
+                {
+                    Status = AE_ERROR;
+                    goto Cleanup;
+                }
+            }
+        }
+        else if (ACPI_COMPARE_NAME (Signature, ACPI_SIG_SSDT))
+        {
+            Actual = DtEmitDefinitionBlock (
+                File, DisasmFilename, ACPI_SIG_SSDT, 1);
+            if (Actual < 0)
+            {
+                Status = AE_ERROR;
+                goto Cleanup;
+            }
+        }
+        else if (ACPI_COMPARE_NAME (Signature, ACPI_SIG_OSDT))
+        {
+            Actual = DtEmitDefinitionBlock (
+                File, DisasmFilename, ACPI_SIG_OSDT, 1);
+            if (Actual < 0)
+            {
+                Status = AE_ERROR;
+                goto Cleanup;
+            }
+        }
+        else if (ACPI_COMPARE_NAME (Signature, ACPI_SIG_FACS))
+        {
+            AcpiDmDumpDataTable (ACPI_CAST_PTR (ACPI_TABLE_HEADER,
+                TemplateFacs));
+        }
+        else if (ACPI_COMPARE_NAME (Signature, ACPI_RSDP_NAME))
+        {
+            AcpiDmDumpDataTable (ACPI_CAST_PTR (ACPI_TABLE_HEADER,
+                TemplateRsdp));
+        }
+        else
+        {
+            fprintf (stderr,
+                "%4.4s, Unrecognized ACPI table signature\n", Signature);
+            Status = AE_ERROR;
+            goto Cleanup;
+        }
+    }
+
+    if (TableCount == 0)
+    {
+        fprintf (stderr,
+            "Created ACPI table template for [%4.4s], "
+            "written to \"%s\"\n",
+            Signature, DisasmFilename);
+    }
+    else
+    {
+        fprintf (stderr,
+            "Created ACPI table templates for [%4.4s] "
+            "and %u [SSDT], written to \"%s\"\n",
+            Signature, TableCount, DisasmFilename);
+    }
+
+Cleanup:
+    fclose (File);
+    AcpiOsRedirectOutput (stdout);
+    return (Status);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtEmitDefinitionBlock
+ *
+ * PARAMETERS:  File                - An open file for the block
+ *              Filename            - Filename for same, for error msg(s)
+ *              Signature           - ACPI signature for the block
+ *              Instance            - Used for multiple SSDTs in the same file
+ *
+ * RETURN:      Status from fprintf
+ *
+ * DESCRIPTION: Emit the raw ASL for a complete Definition Block (DSDT or SSDT)
+ *
+ * Note: The AMLFileName parameter for DefinitionBlock is left as a NULL
+ * string. This allows the compiler to create the output AML filename from
+ * the input filename.
+ *
+ ******************************************************************************/
+
+static int
+DtEmitDefinitionBlock (
+    FILE                    *File,
+    char                    *Filename,
+    char                    *Signature,
+    UINT32                  Instance)
+{
+    int                     Status;
+
+
+    Status = fprintf (File,
+        "DefinitionBlock (\"\", \"%4.4s\", 2, \"Intel\", \"_%4.4s_%.2X\", 0x00000001)\n"
+        "{\n"
+        "    Method (%2.2s%.2X)\n"
+        "    {\n"
+        "    }\n"
+        "}\n\n",
+        Signature, Signature, Instance, Signature, Instance);
+
+    if (Status < 0)
+    {
+        fprintf (stderr,
+            "Could not write %4.4s to output file %s\n",
+            Signature, Filename);
+    }
+
+    return (Status);
+}
diff --git a/usr/src/cmd/acpi/iasl/dttemplate.h b/usr/src/cmd/acpi/iasl/dttemplate.h
new file mode 100644
index 0000000000..23ef051767
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dttemplate.h
@@ -0,0 +1,1287 @@
+/******************************************************************************
+ *
+ * Module Name: dttemplate.h - ACPI table template definitions
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#ifndef __DTTEMPLATE_H
+#define __DTTEMPLATE_H
+
+
+/* Templates for ACPI data tables */
+
+const unsigned char TemplateAsf[] =
+{
+    0x41,0x53,0x46,0x21,0x72,0x00,0x00,0x00,  /* 00000000    "ASF!r..." */
+    0x10,0x0B,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x10,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x14,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x01,0x0C,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x02,0x00,0x0C,0x00,0x01,0x04,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x03,0x00,0x17,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x84,0x00,0x07,0x00,0x00,  /* 00000068    "........" */
+    0x01,0x00                                 /* 00000070    ".."       */
+};
+
+const unsigned char TemplateBgrt[] =
+{
+    0x42,0x47,0x52,0x54,0x38,0x00,0x00,0x00,  /* 00000000    "BGRT8..." */
+    0x01,0x0D,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x23,0x06,0x11,0x20,0x01,0x00,0x00,0x00,  /* 00000020    "#.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000030    "........" */
+};
+
+const unsigned char TemplateBert[] =
+{
+    0x42,0x45,0x52,0x54,0x30,0x00,0x00,0x00,  /* 00000000    "BERT0..." */
+    0x01,0x15,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000028    "........" */
+};
+
+const unsigned char TemplateBoot[] =
+{
+    0x42,0x4F,0x4F,0x54,0x28,0x00,0x00,0x00,  /* 00000000    "BOOT(..." */
+    0x01,0x0D,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x04,0x06,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00   /* 00000020    "(.. ...." */
+};
+
+const unsigned char TemplateCpep[] =
+{
+    0x43,0x50,0x45,0x50,0x34,0x00,0x00,0x00,  /* 00000000    "CPEP4..." */
+    0x01,0x0F,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x08,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000030    "...."     */
+};
+
+const unsigned char TemplateCsrt[] =
+{
+    0x43,0x53,0x52,0x54,0x4C,0x01,0x00,0x00,  /* 00000000    "CSRTL..." */
+    0x01,0x0D,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x14,0x11,0x12,0x20,0x88,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x49,0x4E,0x54,0x4C,0x00,0x00,0x00,0x00,  /* 00000028    "INTL...." */
+    0x60,0x9C,0x00,0x00,0x02,0x00,0x00,0x00,  /* 00000030    "`......." */
+    0x1C,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0xA0,0xB3,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x2A,0x00,0x00,0x00,0x02,0x00,0x06,0x20,  /* 00000048    "*...... " */
+    0x00,0x00,0x10,0x00,0xFF,0x0F,0x00,0x00,  /* 00000050    "........" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x01,0x00,  /* 00000058    "........" */
+    0x53,0x50,0x49,0x20,0x0C,0x00,0x00,0x00,  /* 00000060    "SPI ...." */
+    0x03,0x00,0x00,0x00,0x43,0x48,0x41,0x30,  /* 00000068    "....CHA0" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x43,0x48,0x41,0x31,0x0C,0x00,0x00,0x00,  /* 00000078    "CHA1...." */
+    0x03,0x00,0x00,0x00,0x43,0x48,0x41,0x32,  /* 00000080    "....CHA2" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x43,0x48,0x41,0x33,0x0C,0x00,0x00,0x00,  /* 00000090    "CHA3...." */
+    0x03,0x00,0x00,0x00,0x43,0x48,0x41,0x34,  /* 00000098    "....CHA4" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x43,0x48,0x41,0x35,0xA0,0x00,0x00,0x00,  /* 000000A8    "CHA5...." */
+    0x49,0x4E,0x54,0x4C,0x00,0x00,0x00,0x00,  /* 000000B0    "INTL...." */
+    0x60,0x9C,0x00,0x00,0x03,0x00,0x00,0x00,  /* 000000B8    "`......." */
+    0x1C,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000C0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C8    "........" */
+    0x2B,0x00,0x00,0x00,0x02,0x00,0x08,0x20,  /* 000000D0    "+...... " */
+    0x10,0x00,0x10,0x00,0xFF,0x0F,0x00,0x00,  /* 000000D8    "........" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x01,0x00,  /* 000000E0    "........" */
+    0x49,0x32,0x43,0x20,0x0C,0x00,0x00,0x00,  /* 000000E8    "I2C ...." */
+    0x03,0x00,0x00,0x00,0x43,0x48,0x41,0x30,  /* 000000F0    "....CHA0" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x43,0x48,0x41,0x31,0x0C,0x00,0x00,0x00,  /* 00000100    "CHA1...." */
+    0x03,0x00,0x00,0x00,0x43,0x48,0x41,0x32,  /* 00000108    "....CHA2" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 00000110    "........" */
+    0x43,0x48,0x41,0x33,0x0C,0x00,0x00,0x00,  /* 00000118    "CHA3...." */
+    0x03,0x00,0x00,0x00,0x43,0x48,0x41,0x34,  /* 00000120    "....CHA4" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 00000128    "........" */
+    0x43,0x48,0x41,0x35,0x0C,0x00,0x00,0x00,  /* 00000130    "CHA5...." */
+    0x03,0x00,0x00,0x00,0x43,0x48,0x41,0x36,  /* 00000138    "....CHA6" */
+    0x0C,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 00000140    "........" */
+    0x43,0x48,0x41,0x37                       /* 00000148    "CHA7"     */
+};
+
+const unsigned char TemplateDbg2[] =
+{
+    0x44,0x42,0x47,0x32,0xB2,0x00,0x00,0x00,  /* 00000000    "DBG2...." */
+    0x01,0xBA,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x15,0x11,0x13,0x20,0x2C,0x00,0x00,0x00,  /* 00000020    "... ,..." */
+    0x02,0x00,0x00,0x00,0xEE,0x3F,0x00,0x02,  /* 00000028    ".....?.." */
+    0x09,0x00,0x36,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "..6....." */
+    0x00,0x80,0x00,0x00,0x00,0x00,0x16,0x00,  /* 00000038    "........" */
+    0x2E,0x00,0x01,0x32,0x00,0x03,0x88,0x77,  /* 00000040    "...2...w" */
+    0x66,0x55,0x44,0x33,0x22,0x11,0x01,0x64,  /* 00000048    "fUD3"..d" */
+    0x00,0x04,0x11,0x00,0xFF,0xEE,0xDD,0xCC,  /* 00000050    "........" */
+    0xBB,0xAA,0x10,0x32,0x54,0x76,0x98,0xBA,  /* 00000058    "...2Tv.." */
+    0xDC,0xFE,0x4D,0x79,0x44,0x65,0x76,0x69,  /* 00000060    "..MyDevi" */
+    0x63,0x65,0x00,0xEE,0x47,0x00,0x01,0x11,  /* 00000068    "ce..G..." */
+    0x00,0x26,0x00,0x10,0x00,0x37,0x00,0x00,  /* 00000070    ".&...7.." */
+    0x80,0x00,0x00,0x00,0x00,0x16,0x00,0x22,  /* 00000078    "......."" */
+    0x00,0x01,0x64,0x00,0x04,0x11,0x00,0xFF,  /* 00000080    "..d....." */
+    0xEE,0xDD,0xCC,0xBB,0xAA,0x98,0xBA,0xDC,  /* 00000088    "........" */
+    0xFE,0x5C,0x5C,0x5F,0x53,0x42,0x5F,0x2E,  /* 00000090    ".\\_SB_." */
+    0x50,0x43,0x49,0x30,0x2E,0x44,0x42,0x47,  /* 00000098    "PCI0.DBG" */
+    0x50,0x00,0x41,0x42,0x43,0x44,0x45,0x46,  /* 000000A0    "P.ABCDEF" */
+    0x47,0x48,0x49,0x50,0x51,0x52,0x53,0x54,  /* 000000A8    "GHIPQRST" */
+    0x55,0x56                                 /* 000000B0    "UV"       */
+};
+
+const unsigned char TemplateDbgp[] =
+{
+    0x44,0x42,0x47,0x50,0x34,0x00,0x00,0x00,  /* 00000000    "DBGP4..." */
+    0x01,0x1A,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000030    "...."     */
+};
+
+const unsigned char TemplateDmar[] =
+{
+    0x44,0x4D,0x41,0x52,0x8C,0x00,0x00,0x00,  /* 00000000    "DMAR...." */
+    0x01,0x03,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x17,0x05,0x13,0x20,0x2F,0x01,0x00,0x00,  /* 00000020    "... /..." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x18,0x00,0x01,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x03,0x08,0x00,0x00,0x08,0x00,0x00,0x01,  /* 00000040    "........" */
+    0x01,0x00,0x20,0x00,0x00,0x00,0x00,0x00,  /* 00000048    ".. ....." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0xFF,0x0F,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x01,0x08,0x00,0x00,0x00,0x00,0x00,0x02,  /* 00000060    "........" */
+    0x02,0x00,0x10,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x02,0x08,0x00,0x00,0x00,0x00,0x00,0x03,  /* 00000070    "........" */
+    0x03,0x00,0x14,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000088    "...."     */
+};
+
+const unsigned char TemplateDrtm[] =
+{
+    0x44,0x52,0x54,0x4D,0x94,0x00,0x00,0x00,  /* 00000000    "DRTM...." */
+    0x01,0xB9,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000090    "...."     */
+};
+
+const unsigned char TemplateEcdt[] =
+{
+    0x45,0x43,0x44,0x54,0x42,0x00,0x00,0x00,  /* 00000000    "ECDTB..." */
+    0x01,0x2D,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ".-INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x01,0x08,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x66,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "f......." */
+    0x01,0x08,0x00,0x00,0x62,0x00,0x00,0x00,  /* 00000030    "....b..." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x09,0x00                                 /* 00000040    ".."       */
+};
+
+const unsigned char TemplateEinj[] =
+{
+    0x45,0x49,0x4E,0x4A,0x30,0x01,0x00,0x00,  /* 00000000    "EINJ0..." */
+    0x01,0x09,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x30,0x00,0x00,0x00,  /* 00000020    "(.. 0..." */
+    0x00,0x00,0x00,0x00,0x0A,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000030    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000048    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000050    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000068    "........" */
+    0x02,0x02,0x01,0x00,0x00,0x40,0x00,0x04,  /* 00000070    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000088    "........" */
+    0x03,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000090    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000000A8    "........" */
+    0x04,0x03,0x01,0x00,0x00,0x40,0x00,0x04,  /* 000000B0    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000000C8    "........" */
+    0x05,0x03,0x01,0x00,0x01,0x10,0x00,0x02,  /* 000000D0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000D8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000000E8    "........" */
+    0x06,0x01,0x00,0x00,0x00,0x40,0x00,0x04,  /* 000000F0    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000100    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000108    "........" */
+    0x07,0x00,0x01,0x00,0x00,0x40,0x00,0x04,  /* 00000110    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000118    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000120    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF   /* 00000128    "........" */
+};
+
+const unsigned char TemplateErst[] =
+{
+    0x45,0x52,0x53,0x54,0x30,0x02,0x00,0x00,  /* 00000000    "ERST0..." */
+    0x01,0xAB,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x30,0x00,0x00,0x00,  /* 00000020    "(.. 0..." */
+    0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x03,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000030    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000048    "........" */
+    0x01,0x03,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000050    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000068    "........" */
+    0x02,0x03,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000070    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000088    "........" */
+    0x03,0x04,0x01,0x00,0x00,0x40,0x00,0x04,  /* 00000090    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000000A8    "........" */
+    0x04,0x02,0x00,0x00,0x00,0x40,0x00,0x04,  /* 000000B0    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000000C8    "........" */
+    0x05,0x03,0x00,0x00,0x01,0x08,0x00,0x01,  /* 000000D0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000D8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000000E8    "........" */
+    0x06,0x01,0x00,0x00,0x00,0x40,0x00,0x04,  /* 000000F0    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000100    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000108    "........" */
+    0x07,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000110    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000118    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000120    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000128    "........" */
+    0x08,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000130    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000138    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000140    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000148    "........" */
+    0x09,0x02,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000150    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000158    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000160    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000168    "........" */
+    0x0A,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000170    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000178    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000180    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000188    "........" */
+    0x0B,0x03,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000190    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000198    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001A0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000001A8    "........" */
+    0x0C,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 000001B0    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001B8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001C0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000001C8    "........" */
+    0x0D,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 000001D0    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001D8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001E0    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 000001E8    "........" */
+    0x0E,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 000001F0    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001F8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000200    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,  /* 00000208    "........" */
+    0x0F,0x00,0x00,0x00,0x00,0x40,0x00,0x04,  /* 00000210    ".....@.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000218    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000220    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF   /* 00000228    "........" */
+};
+
+const unsigned char TemplateFacs[] =
+{
+    0x46,0x41,0x43,0x53,0x40,0x00,0x00,0x00,  /* 00000000    "FACS@..." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000008    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000010    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000018    "........" */
+    0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000020    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000038    "........" */
+};
+
+/* Version 5 FADT */
+
+const unsigned char TemplateFadt[] =
+{
+    0x46,0x41,0x43,0x50,0x14,0x01,0x00,0x00,  /* 00000000    "FACP...." */
+    0x06,0x8A,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x65,0x6D,0x70,0x6C,0x61,0x74,0x65,  /* 00000010    "Template" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x01,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x04,0x02,0x01,0x04,0x08,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x08,0x00,0x01,  /* 00000070    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x01,0x01,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x20,0x00,0x02,  /* 00000090    "..... .." */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x10,0x00,0x02,  /* 000000A8    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B0    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B8    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x08,0x00,0x00,  /* 000000C0    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C8    "........" */
+    0x01,0x20,0x00,0x03,0x01,0x00,0x00,0x00,  /* 000000D0    ". ......" */
+    0x00,0x00,0x00,0x00,0x01,0x40,0x00,0x01,  /* 000000D8    ".....@.." */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E0    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E8    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x08,0x00,0x01,  /* 000000F0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x01,0x08,0x00,0x01,0x00,0x00,0x00,0x00,  /* 00000100    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000108    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000110    "...."     */
+};
+
+const unsigned char TemplateFpdt[] =
+{
+    0x46,0x50,0x44,0x54,0x64,0x00,0x00,0x00,  /* 00000000    "FPDTd..." */
+    0x01,0xBD,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x04,0x08,0x11,0x20,0x00,0x00,0x30,0x01,  /* 00000020    "... ..0." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x10,0x01,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000060    "...."     */
+};
+
+const unsigned char TemplateGtdt[] =
+{
+    0x47,0x54,0x44,0x54,0xe0,0x00,0x00,0x00,  /* 00000000    "GTDT...." */
+    0x02,0xb0,0x4c,0x49,0x4e,0x41,0x52,0x4f,  /* 00000008    "..LINARO" */
+    0x52,0x54,0x53,0x4d,0x56,0x45,0x56,0x38,  /* 00000010    "RTSMVEV8" */
+    0x01,0x00,0x00,0x00,0x49,0x4e,0x54,0x4c,  /* 00000018    "....INTL" */
+    0x24,0x04,0x14,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "$.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x1d,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x1e,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x1b,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x1a,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x02,0x00,0x00,0x00,0x60,0x00,0x00,0x00,  /* 00000058    "....`..." */
+    0x00,0x64,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    ".d......" */
+    0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x14,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000090    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000a0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000a8    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000b0    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000b8    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x1c,0x00,0x00,  /* 000000c0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000c8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000d0    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000d8    "........" */
+};
+
+const unsigned char TemplateHest[] =
+{
+    0x48,0x45,0x53,0x54,0xD4,0x01,0x00,0x00,  /* 00000000    "HEST...." */
+    0x01,0x20,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ". INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x04,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,  /* 00000028    "........" */
+    0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x01,0x00,0x01,0x00,0x00,0x00,0x00,0x01,  /* 00000088    "........" */
+    0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000090    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,  /* 000000B0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C8    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000D0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000D8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E8    "........" */
+    0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x01,  /* 000000F0    "........" */
+    0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000100    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000108    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000110    "........" */
+    0x00,0x00,0x00,0x00,0x08,0x00,0x00,0x00,  /* 00000118    "........" */
+    0x00,0x00,0x00,0x01,0x01,0x00,0x00,0x00,  /* 00000120    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000128    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000130    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000138    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000140    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000148    "........" */
+    0x00,0x00,0x00,0x00,0x09,0x00,0x02,0x00,  /* 00000150    "........" */
+    0xFF,0xFF,0x00,0x01,0x01,0x00,0x00,0x00,  /* 00000158    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x10,0x00,0x00,  /* 00000160    "........" */
+    0x00,0x40,0x00,0x04,0x00,0x00,0x00,0x00,  /* 00000168    ".@......" */
+    0x00,0x00,0x00,0x00,0x03,0x1C,0x00,0x00,  /* 00000170    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000178    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000180    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000188    "........" */
+    0x00,0x10,0x00,0x00,0x09,0x00,0x03,0x00,  /* 00000190    "........" */
+    0x00,0x00,0x00,0x01,0x01,0x00,0x00,0x00,  /* 00000198    "........" */
+    0x01,0x00,0x00,0x00,0x00,0x10,0x00,0x00,  /* 000001A0    "........" */
+    0x00,0x40,0x00,0x04,0x00,0x00,0x00,0x00,  /* 000001A8    ".@......" */
+    0x00,0x00,0x00,0x00,0x04,0x1C,0x00,0x00,  /* 000001B0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001B8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001C0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000001C8    "........" */
+    0x00,0x10,0x00,0x00                       /* 000001D0    "...."     */
+};
+
+const unsigned char TemplateHpet[] =
+{
+    0x48,0x50,0x45,0x54,0x38,0x00,0x00,0x00,  /* 00000000    "HPET8..." */
+    0x01,0x09,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000030    "........" */
+};
+
+const unsigned char TemplateIort[] =
+{
+    0x49,0x4F,0x52,0x54,0x48,0x01,0x00,0x00,  /* 00000000    "IORTH..." */
+    0x00,0x02,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x12,0x02,0x16,0x20,0x05,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x34,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "4......." */
+    0x00,0x00,0x00,0x00,0x00,0x2C,0x00,0x00,  /* 00000030    ".....,.." */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x18,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x01,0x30,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    ".0......" */
+    0x00,0x00,0x00,0x00,0x30,0x00,0x00,0x00,  /* 00000068    "....0..." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x5C,0x5F,0x53,  /* 00000078    ".....\_S" */
+    0x42,0x2E,0x50,0x43,0x49,0x30,0x2E,0x44,  /* 00000080    "B.PCI0.D" */
+    0x45,0x56,0x30,0x00,0x00,0x00,0x00,0x00,  /* 00000088    "EV0....." */
+    0x02,0x20,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000090    ". ......" */
+    0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x00,  /* 00000098    ".... ..." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x03,0x5C,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B0    ".\......" */
+    0x00,0x00,0x00,0x00,0x5C,0x00,0x00,0x00,  /* 000000B8    "....\..." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000D0    "........" */
+    0x3C,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000D8    "<......." */
+    0x4C,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 000000E0    "L......." */
+    0x54,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E8    "T......." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000100    "........" */
+    0x00,0x00,0x00,0x00,0x04,0x3C,0x00,0x00,  /* 00000108    ".....<.." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000110    "........" */
+    0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000118    "<......." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000120    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000128    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000130    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000138    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000140    "........" */
+};
+
+const unsigned char TemplateIvrs[] =
+{
+    0x49,0x56,0x52,0x53,0xBC,0x00,0x00,0x00,  /* 00000000    "IVRS...." */
+    0x01,0x87,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x10,0x14,0x34,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "..4....." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,  /* 00000048    "....@..." */
+    0x00,0x00,0x00,0x00,0x42,0x00,0x00,0x00,  /* 00000050    "....B..." */
+    0x00,0x00,0x00,0x00,0x48,0x00,0x00,0x00,  /* 00000058    "....H..." */
+    0x00,0x00,0x00,0x00,0x20,0x08,0x20,0x00,  /* 00000060    ".... . ." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x21,0x04,0x20,0x00,  /* 00000080    "....!. ." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000090    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x10,0x14,0x18,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B0    "........" */
+    0x00,0x00,0x00,0x00                       /* 000000B8    "...."     */
+};
+
+const unsigned char TemplateLpit[] =
+{
+    0x4C,0x50,0x49,0x54,0x94,0x00,0x00,0x00,  /* 00000000    "LPIT...." */
+    0x00,0xD8,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x65,0x6D,0x70,0x6C,0x61,0x74,0x65,  /* 00000010    "Template" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x38,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "8......." */
+    0x00,0x00,0x00,0x00,0x01,0x08,0x00,0x01,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x7F,0x40,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    ".@......" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x38,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "8......." */
+    0x00,0x00,0x00,0x00,0x01,0x08,0x00,0x01,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x7F,0x40,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    ".@......" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000090    "...."     */
+};
+
+/* MADT with ACPI 6.0 subtables */
+
+const unsigned char TemplateMadt[] =
+{
+    0x41,0x50,0x49,0x43,0x5A,0x01,0x00,0x00,  /* 00000000    "APICZ..." */
+    0x03,0xEA,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x65,0x6D,0x70,0x6C,0x61,0x74,0x65,  /* 00000010    "Template" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x01,0x00,0x00,0x00,0x00,0x08,0x00,0x00,  /* 00000028    "........" */
+    0x01,0x00,0x00,0x00,0x01,0x0C,0x01,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x02,0x0A,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x03,0x08,0x0D,0x00,0x01,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x04,0x06,0x00,0x05,0x00,0x01,  /* 00000050    "........" */
+    0x05,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x06,0x10,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x07,0x16,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x5C,0x43,0x50,0x55,  /* 00000080    "....\CPU" */
+    0x30,0x00,0x08,0x10,0x05,0x00,0x00,0x00,  /* 00000088    "0......." */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,  /* 00000090    "........" */
+    0x00,0x00,0x09,0x10,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x0A,0x0C,0x05,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x0B,0x50,  /* 000000B0    ".......P" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B8    "........" */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,  /* 000000C0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000C8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000D0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000D8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x0C,0x18,  /* 00000100    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000108    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000110    "........" */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x0D,0x18,  /* 00000118    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000120    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,  /* 00000128    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x0E,0x10,  /* 00000130    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000138    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x0F,0x14,  /* 00000140    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000148    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000150    "........" */
+    0x00,0x00                                 /* 00000158    ".."       */
+};
+
+const unsigned char TemplateMcfg[] =
+{
+    0x4D,0x43,0x46,0x47,0x3C,0x00,0x00,0x00,  /* 00000000    "MCFG<..." */
+    0x01,0x19,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000038    "...."     */
+};
+
+const unsigned char TemplateMchi[] =
+{
+    0x4D,0x43,0x48,0x49,0x45,0x00,0x00,0x00,  /* 00000000    "MCHIE..." */
+    0x01,0xE4,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x15,0x07,0x00,0x02,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x01,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x02,0x08,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00                  /* 00000040    "....."    */
+};
+
+const unsigned char TemplateMsdm[] =
+{
+    0x4D,0x53,0x44,0x4D,0x64,0x00,0x00,0x00,  /* 00000000    "MSDMd..." */
+    0x01,0x34,0x49,0x6E,0x74,0x65,0x6C,0x00,  /* 00000008    ".4Intel." */
+    0x54,0x65,0x6D,0x70,0x6C,0x61,0x74,0x65,  /* 00000010    "Template" */
+    0x03,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x04,0x02,0x15,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x0A,0x10,0x16,0x17,0x18,0x19,0x1A,0x1B,  /* 00000028    "........" */
+    0x1C,0x1D,0x1E,0x1F,0x20,0x21,0x22,0x23,  /* 00000030    ".... !"#" */
+    0x24,0x25,0x26,0x27,0x10,0x0A,0x15,0x16,  /* 00000038    "$%&'...." */
+    0x17,0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,  /* 00000040    "........" */
+    0x1F,0x20,0x21,0x22,0x23,0x24,0x25,0x26,  /* 00000048    ". !"#$%&" */
+    0x16,0x15,0x0A,0x10,0x16,0x17,0x18,0x19,  /* 00000050    "........" */
+    0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x20,0x21,  /* 00000058    "...... !" */
+    0x22,0x23,0x24,0x25                       /* 00000060    ""#$%"     */
+};
+
+const unsigned char TemplateMpst[] =
+{
+    0x4D,0x50,0x53,0x54,0xB6,0x00,0x00,0x00,  /* 00000000    "MPST...." */
+    0x01,0x77,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ".wINTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x13,0x09,0x12,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x01,0x00,0x02,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x02,0x00,0x00,0x00,0x01,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000090    "........" */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00             /* 000000B0    "......"   */
+};
+
+const unsigned char TemplateMsct[] =
+{
+    0x4D,0x53,0x43,0x54,0x90,0x00,0x00,0x00,  /* 00000000    "MSCT...." */
+    0x01,0xB7,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x38,0x00,0x00,0x00,  /* 00000020    "(.. 8..." */
+    0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0xFF,0xFF,0xFF,0xFF,0xFF,0x0F,0x00,0x00,  /* 00000030    "........" */
+    0x01,0x16,0x00,0x00,0x00,0x00,0x03,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x40,0x00,0x00,0x00,0x01,0x16,  /* 00000048    "..@....." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x16,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x01,0x16,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000088    "........" */
+};
+
+const unsigned char TemplateNfit[] =
+{
+    0x4E,0x46,0x49,0x54,0x70,0x01,0x00,0x00,  /* 00000000    "NFITp..." */
+    0x01,0x53,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ".SINTEL " */
+    0x54,0x65,0x6D,0x70,0x6C,0x61,0x74,0x65,  /* 00000010    "Template" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x00,0x00,0x38,0x00,0x01,0x00,0x00,0x00,  /* 00000028    "..8....." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x30,0x05,0xAF,0x91,0x86,0x5D,0x0E,0x47,  /* 00000038    "0....].G" */
+    0xA6,0xB0,0x0A,0x2D,0xB9,0x40,0x82,0x49,  /* 00000040    "...-.@.I" */
+    0x00,0x00,0x00,0x7C,0x03,0x00,0x00,0x00,  /* 00000048    "...|...." */
+    0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x01,0x00,0x30,0x00,0x01,0x00,0x00,0x00,  /* 00000060    "..0....." */
+    0x04,0x00,0x00,0x00,0x01,0x00,0x01,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x01,0x00,0x03,0x00,0x2A,0x00,0x00,0x00,  /* 00000088    "....*..." */
+    0x02,0x00,0x20,0x00,0x01,0x00,0x00,0x00,  /* 00000090    ".. ....." */
+    0x04,0x00,0x00,0x00,0x00,0x01,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x06,0x00,0x00,0x00,0x09,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x03,0x00,0x28,0x00,0x00,0x00,0x00,0x00,  /* 000000B0    "..(....." */
+    0xB4,0x13,0x5D,0x40,0x91,0x0B,0x29,0x93,  /* 000000B8    "..]@..)." */
+    0x67,0xE8,0x23,0x4C,0x00,0x00,0x00,0x88,  /* 000000C0    "g.#L...." */
+    0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,  /* 000000C8    ".."3DUfw" */
+    0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF,  /* 000000D0    "........" */
+    0x04,0x00,0x50,0x00,0x01,0x00,0x86,0x80,  /* 000000D8    "..P....." */
+    0x17,0x20,0x01,0x00,0x86,0x80,0x17,0x20,  /* 000000E0    ". ..... " */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E8    "........" */
+    0x89,0x00,0x54,0x76,0x01,0x03,0x00,0x01,  /* 000000F0    "..Tv...." */
+    0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F8    ". ......" */
+    0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,  /* 00000100    "........" */
+    0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000108    "........" */
+    0x00,0x10,0x80,0x00,0x00,0x00,0x00,0x00,  /* 00000110    "........" */
+    0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000118    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000120    "........" */
+    0x05,0x00,0x28,0x00,0x01,0x00,0x00,0x01,  /* 00000128    "..(....." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000130    "........" */
+    0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000138    ". ......" */
+    0x00,0x00,0x00,0xE0,0x0F,0x00,0x00,0x00,  /* 00000140    "........" */
+    0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x00,  /* 00000148    "........" */
+    0x06,0x00,0x20,0x00,0x01,0x00,0x00,0x00,  /* 00000150    ".. ....." */
+    0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000158    "........" */
+    0x00,0x00,0x00,0x18,0x04,0x00,0x00,0x00,  /* 00000160    "........" */
+    0x00,0x00,0x00,0x18,0x06,0x00,0x00,0x00   /* 00000168    "........" */
+};
+
+const unsigned char TemplateMtmr[] =
+{
+    0x4D,0x54,0x4D,0x52,0x4C,0x00,0x00,0x00,  /* 00000000    "MTMRL..." */
+    0x01,0xB0,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x03,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x17,0x01,0x13,0x20,0x00,0x20,0x00,0x03,  /* 00000020    "... . .." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x20,0x00,0x03,0x00,0x00,0x00,0x00,  /* 00000038    ". ......" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000048    "...."     */
+};
+
+const unsigned char TemplatePcct[] =
+{
+    0x50,0x43,0x43,0x54,0x06,0x01,0x00,0x00,  /* 00000000    "PCCT...." */
+    0x01,0xE3,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x18,0x03,0x16,0x20,0x01,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x3E,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    ".>......" */
+    0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,  /* 00000038    "........" */
+    0x22,0x22,0x22,0x22,0x22,0x22,0x22,0x22,  /* 00000040    """""""""" */
+    0x01,0x32,0x00,0x03,0x33,0x33,0x33,0x33,  /* 00000048    ".2..3333" */
+    0x33,0x33,0x33,0x33,0x44,0x44,0x44,0x44,  /* 00000050    "3333DDDD" */
+    0x44,0x44,0x44,0x44,0x55,0x55,0x55,0x55,  /* 00000058    "DDDDUUUU" */
+    0x55,0x55,0x55,0x55,0x66,0x66,0x66,0x66,  /* 00000060    "UUUUffff" */
+    0x77,0x77,0x77,0x77,0x88,0x88,0x01,0x3E,  /* 00000068    "wwww...>" */
+    0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x32,  /* 00000080    ".......2" */
+    0x00,0x03,0x44,0x44,0x44,0x44,0x44,0x44,  /* 00000088    "..DDDDDD" */
+    0x44,0x44,0x44,0x44,0x44,0x44,0x44,0x44,  /* 00000090    "DDDDDDDD" */
+    0x44,0x44,0x55,0x55,0x55,0x55,0x55,0x55,  /* 00000098    "DDUUUUUU" */
+    0x55,0x55,0x66,0x66,0x66,0x66,0x77,0x77,  /* 000000A0    "UUffffww" */
+    0x77,0x77,0x88,0x88,0x02,0x5A,0x01,0x00,  /* 000000A8    "ww...Z.." */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,  /* 000000B0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B8    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x32,0x00,0x03,  /* 000000C0    ".....2.." */
+    0x44,0x44,0x44,0x44,0x44,0x44,0x44,0x44,  /* 000000C8    "DDDDDDDD" */
+    0x44,0x44,0x44,0x44,0x44,0x44,0x44,0x44,  /* 000000D0    "DDDDDDDD" */
+    0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,  /* 000000D8    "UUUUUUUU" */
+    0x66,0x66,0x66,0x66,0x77,0x77,0x77,0x77,  /* 000000E0    "ffffwwww" */
+    0x88,0x88,0x01,0x32,0x00,0x03,0x33,0x33,  /* 000000E8    "...2..33" */
+    0x33,0x33,0x33,0x33,0x33,0x33,0x44,0x44,  /* 000000F0    "333333DD" */
+    0x44,0x44,0x44,0x44,0x44,0x44,0x55,0x55,  /* 000000F8    "DDDDDDUU" */
+    0x55,0x55,0x55,0x55,0x55,0x55             /* 00000100    "UUUUUU"   */
+};
+
+const unsigned char TemplatePmtt[] =
+{
+    0x50,0x4D,0x54,0x54,0xB4,0x00,0x00,0x00,  /* 00000000    "PMTT...." */
+    0x01,0x3A,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ".:INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x26,0x08,0x11,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "&.. ...." */
+    0x00,0x00,0x80,0x00,0x01,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x54,0x00,  /* 00000030    "......T." */
+    0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x02,0x00,0x14,0x00,0x02,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x02,0x00,0x14,0x00,  /* 00000070    "........" */
+    0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x01,0x00,0x20,0x00,0x01,0x00,0x00,0x00,  /* 00000088    ".. ....." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000090    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x0C,0x00,0x01,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x00,0x00,0x00,0x00                       /* 000000B0    "...."     */
+};
+
+const unsigned char TemplateRsdp[] =
+{
+    0x52,0x53,0x44,0x20,0x50,0x54,0x52,0x20,  /* 00000000    "RSD PTR " */
+    0x43,0x49,0x4E,0x54,0x45,0x4C,0x20,0x02,  /* 00000008    "CINTEL ." */
+    0x00,0x00,0x00,0x00,0x24,0x00,0x00,0x00,  /* 00000010    "....$..." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000018    "........" */
+    0xDC,0x00,0x00,0x00                       /* 00000020    "...."     */
+};
+
+const unsigned char TemplateRsdt[] =
+{
+    0x52,0x53,0x44,0x54,0x44,0x00,0x00,0x00,  /* 00000000    "RSDTD..." */
+    0x01,0xB1,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x10,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x20,0x00,0x00,0x00,0x30,0x00,0x00,0x00,  /* 00000028    " ...0..." */
+    0x40,0x00,0x00,0x00,0x50,0x00,0x00,0x00,  /* 00000030    "@...P..." */
+    0x60,0x00,0x00,0x00,0x70,0x00,0x00,0x00,  /* 00000038    "`...p..." */
+    0x80,0x00,0x00,0x00                       /* 00000040    "...."     */
+};
+
+const unsigned char TemplateS3pt[] =
+{
+    0x53,0x33,0x50,0x54,0x34,0x00,0x00,0x00,  /* 00000000    "S3PT4..." */
+    0x00,0x00,0x18,0x01,0x00,0x00,0x00,0x00,  /* 00000008    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000010    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000018    "........" */
+    0x01,0x00,0x14,0x01,0x00,0x00,0x00,0x00,  /* 00000020    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000030    "...."     */
+};
+
+const unsigned char TemplateSbst[] =
+{
+    0x53,0x42,0x53,0x54,0x30,0x00,0x00,0x00,  /* 00000000    "SBST0..." */
+    0x01,0x06,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000028    "........" */
+};
+
+const unsigned char TemplateSlic[] =
+{
+    0x53,0x4C,0x49,0x43,0x76,0x01,0x00,0x00,  /* 00000000    "SLICv..." */
+    0x01,0x07,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x11,0x02,0x11,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x9C,0x00,0x00,0x00,0x06,0x02,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x24,0x00,0x00,0x52,0x53,0x41,0x31,  /* 00000030    ".$..RSA1" */
+    0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000090    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000098    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000A8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000B8    "........" */
+    0x01,0x00,0x00,0x00,0xB6,0x00,0x00,0x00,  /* 000000C0    "........" */
+    0x00,0x00,0x02,0x00,0x49,0x4E,0x54,0x45,  /* 000000C8    "....INTE" */
+    0x4C,0x20,0x54,0x45,0x4D,0x50,0x4C,0x41,  /* 000000D0    "L TEMPLA" */
+    0x54,0x45,0x57,0x49,0x4E,0x44,0x4F,0x57,  /* 000000D8    "TEWINDOW" */
+    0x53,0x20,0x01,0x00,0x02,0x00,0x00,0x00,  /* 000000E0    "S ......" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000E8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F8    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000100    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000108    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000110    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000118    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000120    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000128    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000130    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000138    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000140    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000148    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000150    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000158    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000160    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000168    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00             /* 00000170    "......"   */
+};
+
+const unsigned char TemplateSlit[] =
+{
+    0x53,0x4C,0x49,0x54,0xBC,0x01,0x00,0x00,  /* 00000000    "SLIT...." */
+    0x01,0x00,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x16,0x03,0x11,0x20,0x14,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x00,0x00,0x00,0x00,0x0A,0x10,0x16,0x17,  /* 00000028    "........" */
+    0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,  /* 00000030    "........" */
+    0x20,0x21,0x22,0x23,0x24,0x25,0x26,0x27,  /* 00000038    " !"#$%&'" */
+    0x10,0x0A,0x15,0x16,0x17,0x18,0x19,0x1A,  /* 00000040    "........" */
+    0x1B,0x1C,0x1D,0x1E,0x1F,0x20,0x21,0x22,  /* 00000048    "..... !"" */
+    0x23,0x24,0x25,0x26,0x16,0x15,0x0A,0x10,  /* 00000050    "#$%&...." */
+    0x16,0x17,0x18,0x19,0x1A,0x1B,0x1C,0x1D,  /* 00000058    "........" */
+    0x1E,0x1F,0x20,0x21,0x22,0x23,0x24,0x25,  /* 00000060    ".. !"#$%" */
+    0x17,0x16,0x10,0x0A,0x15,0x16,0x17,0x18,  /* 00000068    "........" */
+    0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x20,  /* 00000070    "....... " */
+    0x21,0x22,0x23,0x24,0x18,0x17,0x16,0x15,  /* 00000078    "!"#$...." */
+    0x0A,0x10,0x16,0x17,0x18,0x19,0x1A,0x1B,  /* 00000080    "........" */
+    0x1C,0x1D,0x1E,0x1F,0x20,0x21,0x22,0x23,  /* 00000088    ".... !"#" */
+    0x19,0x18,0x17,0x16,0x10,0x0A,0x15,0x16,  /* 00000090    "........" */
+    0x17,0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,  /* 00000098    "........" */
+    0x1F,0x20,0x21,0x22,0x1A,0x19,0x18,0x17,  /* 000000A0    ". !"...." */
+    0x16,0x15,0x0A,0x10,0x16,0x17,0x18,0x19,  /* 000000A8    "........" */
+    0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x20,0x21,  /* 000000B0    "...... !" */
+    0x1B,0x1A,0x19,0x18,0x17,0x16,0x10,0x0A,  /* 000000B8    "........" */
+    0x15,0x16,0x17,0x18,0x19,0x1A,0x1B,0x1C,  /* 000000C0    "........" */
+    0x1D,0x1E,0x1F,0x20,0x1C,0x1B,0x1A,0x19,  /* 000000C8    "... ...." */
+    0x18,0x17,0x16,0x15,0x0A,0x10,0x16,0x17,  /* 000000D0    "........" */
+    0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,  /* 000000D8    "........" */
+    0x1D,0x1C,0x1B,0x1A,0x19,0x18,0x17,0x16,  /* 000000E0    "........" */
+    0x10,0x0A,0x15,0x16,0x17,0x18,0x19,0x1A,  /* 000000E8    "........" */
+    0x1B,0x1C,0x1D,0x1E,0x1E,0x1D,0x1C,0x1B,  /* 000000F0    "........" */
+    0x1A,0x19,0x18,0x17,0x16,0x15,0x0A,0x10,  /* 000000F8    "........" */
+    0x16,0x17,0x18,0x19,0x1A,0x1B,0x1C,0x1D,  /* 00000100    "........" */
+    0x1F,0x1E,0x1D,0x1C,0x1B,0x1A,0x19,0x18,  /* 00000108    "........" */
+    0x17,0x16,0x10,0x0A,0x15,0x16,0x17,0x18,  /* 00000110    "........" */
+    0x19,0x1A,0x1B,0x1C,0x20,0x1F,0x1E,0x1D,  /* 00000118    ".... ..." */
+    0x1C,0x1B,0x1A,0x19,0x18,0x17,0x16,0x15,  /* 00000120    "........" */
+    0x0A,0x10,0x16,0x17,0x18,0x19,0x1A,0x1B,  /* 00000128    "........" */
+    0x21,0x20,0x1F,0x1E,0x1D,0x1C,0x1B,0x1A,  /* 00000130    "! ......" */
+    0x19,0x18,0x17,0x16,0x10,0x0A,0x15,0x16,  /* 00000138    "........" */
+    0x17,0x18,0x19,0x1A,0x22,0x21,0x20,0x1F,  /* 00000140    "...."! ." */
+    0x1E,0x1D,0x1C,0x1B,0x1A,0x19,0x18,0x17,  /* 00000148    "........" */
+    0x16,0x15,0x0A,0x10,0x16,0x17,0x18,0x19,  /* 00000150    "........" */
+    0x23,0x22,0x21,0x20,0x1F,0x1E,0x1D,0x1C,  /* 00000158    "#"! ...." */
+    0x1B,0x1A,0x19,0x18,0x17,0x16,0x10,0x0A,  /* 00000160    "........" */
+    0x15,0x16,0x17,0x18,0x24,0x23,0x22,0x21,  /* 00000168    "....$#"!" */
+    0x20,0x1F,0x1E,0x1D,0x1C,0x1B,0x1A,0x19,  /* 00000170    " ......." */
+    0x18,0x17,0x16,0x15,0x0A,0x10,0x16,0x17,  /* 00000178    "........" */
+    0x25,0x24,0x23,0x22,0x21,0x20,0x1F,0x1E,  /* 00000180    "%$#"! .." */
+    0x1D,0x1C,0x1B,0x1A,0x19,0x18,0x17,0x16,  /* 00000188    "........" */
+    0x10,0x0A,0x15,0x16,0x26,0x25,0x24,0x23,  /* 00000190    "....&%$#" */
+    0x22,0x21,0x20,0x1F,0x1E,0x1D,0x1C,0x1B,  /* 00000198    ""! ....." */
+    0x1A,0x19,0x18,0x17,0x16,0x15,0x0A,0x10,  /* 000001A0    "........" */
+    0x27,0x26,0x25,0x24,0x23,0x22,0x21,0x20,  /* 000001A8    "'&%$#"! " */
+    0x1F,0x1E,0x1D,0x1C,0x1B,0x1A,0x19,0x18,  /* 000001B0    "........" */
+    0x17,0x16,0x10,0x0A                       /* 000001B8    "...."     */
+};
+
+const unsigned char TemplateSpcr[] =
+{
+    0x53,0x50,0x43,0x52,0x50,0x00,0x00,0x00,  /* 00000000    "SPCRP..." */
+    0x01,0xE3,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000048    "........" */
+};
+
+const unsigned char TemplateSpmi[] =
+{
+    0x53,0x50,0x4D,0x49,0x41,0x00,0x00,0x00,  /* 00000000    "SPMIA..." */
+    0x04,0x00,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x14,0x01,0x14,0x20,0x00,0x01,0x00,0x00,  /* 00000020    "... ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x08,0x00,0x01,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00                                      /* 00000040    "."        */
+};
+
+const unsigned char TemplateSrat[] =
+{
+    0x53,0x52,0x41,0x54,0x92,0x00,0x00,0x00,  /* 00000000    "SRAT...." */
+    0x03,0x50,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ".PINTEL " */
+    0x54,0x65,0x6D,0x70,0x6C,0x61,0x74,0x65,  /* 00000010    "Template" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x24,0x07,0x14,0x20,0x01,0x00,0x00,0x00,  /* 00000020    "$.. ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x10,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x01,0x28,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000040    ".(......" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0xFC,0x09,0x00,0x00,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000060    "........" */
+    0x02,0x18,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000068    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000070    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000078    "........" */
+    0x03,0x12,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000080    "........" */
+    0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,  /* 00000088    "........" */
+    0x00,0x00                                 /* 00000090    ".."       */
+};
+
+const unsigned char TemplateStao[] =
+{
+    0x53,0x54,0x41,0x4F,0x7E,0x00,0x00,0x00,  /* 00000000    "STAO~..." */
+    0x01,0x7F,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x01,0x5C,0x5F,0x53,  /* 00000020    "... .\_S" */
+    0x42,0x30,0x2E,0x42,0x55,0x53,0x30,0x2E,  /* 00000028    "B0.BUS0." */
+    0x44,0x45,0x56,0x31,0x00,0x5C,0x5F,0x53,  /* 00000030    "DEV1.\_S" */
+    0x42,0x30,0x2E,0x42,0x55,0x53,0x30,0x2E,  /* 00000038    "B0.BUS0." */
+    0x44,0x45,0x56,0x32,0x00,0x5C,0x5F,0x53,  /* 00000040    "DEV2.\_S" */
+    0x42,0x30,0x2E,0x42,0x55,0x53,0x31,0x2E,  /* 00000048    "B0.BUS1." */
+    0x44,0x45,0x56,0x31,0x2E,0x44,0x45,0x56,  /* 00000050    "DEV1.DEV" */
+    0x32,0x00,0x5C,0x5F,0x53,0x42,0x30,0x2E,  /* 00000058    "2.\_SB0." */
+    0x42,0x55,0x53,0x31,0x2E,0x44,0x45,0x56,  /* 00000060    "BUS1.DEV" */
+    0x32,0x2E,0x44,0x45,0x56,0x32,0x00,0x5C,  /* 00000068    "2.DEV2.\" */
+    0x55,0x53,0x42,0x31,0x2E,0x48,0x55,0x42,  /* 00000070    "USB1.HUB" */
+    0x31,0x2E,0x50,0x54,0x31,0x00             /* 00000078    "1.PT1."   */
+};
+
+const unsigned char TemplateTcpa[] =
+{
+    0x54,0x43,0x50,0x41,0x64,0x00,0x00,0x00,  /* 00000000    "TCPAd..." */
+    0x02,0xFF,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x65,0x6D,0x70,0x6C,0x61,0x74,0x65,  /* 00000010    "Template" */
+    0x80,0x31,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    ".1..INTL" */
+    0x19,0x06,0x15,0x20,0x01,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x11,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,  /* 00000030    "........" */
+    0x02,0x01,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x20,0x00,0x03,  /* 00000040    "..... .." */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000048    "........" */
+    0x00,0x00,0x00,0x00,0x01,0x20,0x00,0x03,  /* 00000050    "..... .." */
+    0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x01,0x01,0x01,0x01                       /* 00000060    "...."     */
+};
+
+const unsigned char TemplateTpm2[] =
+{
+    0x54,0x50,0x4D,0x32,0x34,0x00,0x00,0x00,  /* 00000000    "TPM24..." */
+    0x03,0x42,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ".BINTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x14,0x11,0x12,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "... ...." */
+    0x77,0x66,0x55,0x44,0x33,0x22,0x11,0x00,  /* 00000028    "wfUD3".." */
+    0x01,0x00,0x00,0x00                       /* 00000030    "...."     */
+};
+
+const unsigned char TemplateUefi[] =
+{
+    0x55,0x45,0x46,0x49,0x36,0x00,0x00,0x00,  /* 00000000    "UEFI6..." */
+    0x01,0x9B,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x01,0x02,0x03,  /* 00000020    "(.. ...." */
+    0x04,0x05,0x06,0x07,0x08,0x09,0x0A,0x0B,  /* 00000028    "........" */
+    0x0C,0x0D,0x0E,0x0F,0x00,0x00             /* 00000030    "......"   */
+};
+
+const unsigned char TemplateVrtc[] =
+{
+    0x56,0x52,0x54,0x43,0x44,0x00,0x00,0x00,  /* 00000000    "VRTCD..." */
+    0x01,0xEF,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x03,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x17,0x01,0x13,0x20,0x00,0x08,0x00,0x00,  /* 00000020    "... ...." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x08,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000040    "...."     */
+};
+
+const unsigned char TemplateWaet[] =
+{
+    0x57,0x41,0x45,0x54,0x28,0x00,0x00,0x00,  /* 00000000    "WAET(..." */
+    0x01,0x19,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00   /* 00000020    "(.. ...." */
+};
+
+const unsigned char TemplateWdat[] =
+{
+    0x57,0x44,0x41,0x54,0x5C,0x00,0x00,0x00,  /* 00000000    "WDAT\..." */
+    0x01,0xE3,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x20,0x00,0x00,0x00,  /* 00000020    "(..  ..." */
+    0xFF,0x00,0xFF,0xFF,0xFF,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x58,0x02,0x00,0x00,0xFF,0x03,0x00,0x00,  /* 00000030    "X......." */
+    0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000038    "........" */
+    0x0E,0x00,0x00,0x00,0x01,0x02,0x00,0x00,  /* 00000040    "........" */
+    0x01,0x10,0x00,0x02,0x60,0x04,0x00,0x00,  /* 00000048    "....`..." */
+    0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,  /* 00000050    "........" */
+    0x01,0x00,0x00,0x00                       /* 00000058    "...."     */
+};
+
+const unsigned char TemplateWddt[] =
+{
+    0x57,0x44,0x44,0x54,0x40,0x00,0x00,0x00,  /* 00000000    "WDDT@..." */
+    0x01,0x00,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x00,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x01,0xFF,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00   /* 00000038    "........" */
+};
+
+const unsigned char TemplateWdrt[] =
+{
+    0x57,0x44,0x52,0x54,0x47,0x00,0x00,0x00,  /* 00000000    "WDRTG..." */
+    0x01,0xB0,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x00,0x20,0x00,0x00,  /* 00000020    "(.. . .." */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000028    "........" */
+    0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,  /* 00000030    ". ......" */
+    0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,  /* 00000038    "........" */
+    0x00,0x00,0x00,0x00,0xFF,0xFF,0x00        /* 00000040    "......."  */
+};
+
+const unsigned char TemplateWpbt[] =
+{
+    0x57,0x50,0x42,0x54,0x98,0x00,0x00,0x00,  /* 00000000    "WPBT...." */
+    0x01,0x83,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x78,0x56,0x34,0x12,  /* 00000020    "... xV4." */
+    0x00,0x00,0x00,0xBB,0x00,0x00,0x00,0xAA,  /* 00000028    "........" */
+    0x33,0x88,0x64,0x00,0x34,0x00,0x20,0x00,  /* 00000030    "3.d.4. ." */
+    0x73,0x00,0x63,0x00,0x6F,0x00,0x72,0x00,  /* 00000038    "s.c.o.r." */
+    0x65,0x00,0x20,0x00,0x61,0x00,0x6E,0x00,  /* 00000040    "e. .a.n." */
+    0x64,0x00,0x20,0x00,0x37,0x00,0x20,0x00,  /* 00000048    "d. .7. ." */
+    0x79,0x00,0x65,0x00,0x61,0x00,0x72,0x00,  /* 00000050    "y.e.a.r." */
+    0x73,0x00,0x20,0x00,0x61,0x00,0x67,0x00,  /* 00000058    "s. .a.g." */
+    0x6F,0x00,0x20,0x00,0x6F,0x00,0x75,0x00,  /* 00000060    "o. .o.u." */
+    0x72,0x00,0x20,0x00,0x66,0x00,0x61,0x00,  /* 00000068    "r. .f.a." */
+    0x74,0x00,0x68,0x00,0x65,0x00,0x72,0x00,  /* 00000070    "t.h.e.r." */
+    0x73,0x00,0x20,0x00,0x62,0x00,0x72,0x00,  /* 00000078    "s. .b.r." */
+    0x6F,0x00,0x75,0x00,0x67,0x00,0x68,0x00,  /* 00000080    "o.u.g.h." */
+    0x74,0x00,0x20,0x00,0x66,0x00,0x6F,0x00,  /* 00000088    "t. .f.o." */
+    0x72,0x00,0x74,0x00,0x68,0x00,0x00,0x00   /* 00000090    "r.t.h..." */
+};
+
+const unsigned char TemplateXenv[] =
+{
+    0x58,0x45,0x4E,0x56,0x39,0x00,0x00,0x00,  /* 00000000    "XENV9..." */
+    0x01,0x3A,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    ".:INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x10,0x04,0x15,0x20,0x00,0x00,0x00,0x10,  /* 00000020    "... ...." */
+    0x00,0x00,0x00,0x0A,0x00,0x20,0x00,0x00,  /* 00000028    "..... .." */
+    0x00,0x00,0x00,0x0B,0x25,0x00,0xBB,0xAA,  /* 00000030    "....%..." */
+    0x03                                      /* 00000038    "."        */
+};
+
+const unsigned char TemplateXsdt[] =
+{
+    0x58,0x53,0x44,0x54,0x64,0x00,0x00,0x00,  /* 00000000    "XSDTd..." */
+    0x01,0x8B,0x49,0x4E,0x54,0x45,0x4C,0x20,  /* 00000008    "..INTEL " */
+    0x54,0x45,0x4D,0x50,0x4C,0x41,0x54,0x45,  /* 00000010    "TEMPLATE" */
+    0x01,0x00,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
+    0x28,0x05,0x10,0x20,0x10,0x00,0x00,0x00,  /* 00000020    "(.. ...." */
+    0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x00,  /* 00000028    ".... ..." */
+    0x00,0x00,0x00,0x00,0x30,0x00,0x00,0x00,  /* 00000030    "....0..." */
+    0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,  /* 00000038    "....@..." */
+    0x00,0x00,0x00,0x00,0x50,0x00,0x00,0x00,  /* 00000040    "....P..." */
+    0x00,0x00,0x00,0x00,0x60,0x00,0x00,0x00,  /* 00000048    "....`..." */
+    0x00,0x00,0x00,0x00,0x70,0x00,0x00,0x00,  /* 00000050    "....p..." */
+    0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00,  /* 00000058    "........" */
+    0x00,0x00,0x00,0x00                       /* 00000060    "...."     */
+};
+
+#endif
diff --git a/usr/src/cmd/acpi/iasl/dtutils.c b/usr/src/cmd/acpi/iasl/dtutils.c
new file mode 100644
index 0000000000..c9756da9c4
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/dtutils.c
@@ -0,0 +1,1001 @@
+/******************************************************************************
+ *
+ * Module Name: dtutils.c - Utility routines for the data table compiler
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+#include "actables.h"
+
+#define _COMPONENT          DT_COMPILER
+        ACPI_MODULE_NAME    ("dtutils")
+
+/* Local prototypes */
+
+static void
+DtSum (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue);
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtError
+ *
+ * PARAMETERS:  Level               - Seriousness (Warning/error, etc.)
+ *              MessageId           - Index into global message buffer
+ *              Op                  - Parse node where error happened
+ *              ExtraMessage        - additional error message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Common error interface for data table compiler
+ *
+ *****************************************************************************/
+
+void
+DtError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    DT_FIELD                *FieldObject,
+    char                    *ExtraMessage)
+{
+
+    /* Check if user wants to ignore this exception */
+
+    if (AslIsExceptionDisabled (Level, MessageId))
+    {
+        return;
+    }
+
+    if (FieldObject)
+    {
+        AslCommonError (Level, MessageId,
+            FieldObject->Line,
+            FieldObject->Line,
+            FieldObject->ByteOffset,
+            FieldObject->Column,
+            Gbl_Files[ASL_FILE_INPUT].Filename, ExtraMessage);
+    }
+    else
+    {
+        AslCommonError (Level, MessageId, 0,
+            0, 0, 0, 0, ExtraMessage);
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtNameError
+ *
+ * PARAMETERS:  Level               - Seriousness (Warning/error, etc.)
+ *              MessageId           - Index into global message buffer
+ *              Op                  - Parse node where error happened
+ *              ExtraMessage        - additional error message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Error interface for named objects
+ *
+ *****************************************************************************/
+
+void
+DtNameError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    DT_FIELD                *FieldObject,
+    char                    *ExtraMessage)
+{
+
+    switch (Level)
+    {
+    case ASL_WARNING2:
+    case ASL_WARNING3:
+
+        if (Gbl_WarningLevel < Level)
+        {
+            return;
+        }
+        break;
+
+    default:
+
+        break;
+    }
+
+    if (FieldObject)
+    {
+        AslCommonError (Level, MessageId,
+            FieldObject->Line,
+            FieldObject->Line,
+            FieldObject->ByteOffset,
+            FieldObject->NameColumn,
+            Gbl_Files[ASL_FILE_INPUT].Filename, ExtraMessage);
+    }
+    else
+    {
+        AslCommonError (Level, MessageId, 0,
+            0, 0, 0, 0, ExtraMessage);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtFatal
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump the error log and abort the compiler. Used for serious
+ *              compile or I/O errors
+ *
+ ******************************************************************************/
+
+void
+DtFatal (
+    UINT16                  MessageId,
+    DT_FIELD                *FieldObject,
+    char                    *ExtraMessage)
+{
+
+    DtError (ASL_ERROR, MessageId, FieldObject, ExtraMessage);
+
+/*
+ * TBD: remove this entire function, DtFatal
+ *
+ * We cannot abort the compiler on error, because we may be compiling a
+ * list of files. We must move on to the next file.
+ */
+#ifdef __OBSOLETE
+    CmCleanupAndExit ();
+    exit (1);
+#endif
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtStrtoul64
+ *
+ * PARAMETERS:  String              - Null terminated string
+ *              ReturnInteger       - Where the converted integer is returned
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Simple conversion of a string hex integer constant to unsigned
+ *              value. Assumes no leading "0x" for the constant.
+ *
+ * Portability note: The reason this function exists is because a 64-bit
+ * sscanf is not available in all environments.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+DtStrtoul64 (
+    char                    *String,
+    UINT64                  *ReturnInteger)
+{
+    char                    *ThisChar = String;
+    UINT32                  ThisDigit;
+    UINT64                  ReturnValue = 0;
+    int                     DigitCount = 0;
+
+
+    /* Skip over any white space in the buffer */
+
+    while ((*ThisChar == ' ') || (*ThisChar == '\t'))
+    {
+        ThisChar++;
+    }
+
+    /* Skip leading zeros */
+
+    while ((*ThisChar) == '0')
+    {
+        ThisChar++;
+    }
+
+    /* Convert character-by-character */
+
+    while (*ThisChar)
+    {
+        if (isdigit ((int) *ThisChar))
+        {
+            /* Convert ASCII 0-9 to Decimal value */
+
+            ThisDigit = ((UINT8) *ThisChar) - '0';
+        }
+        else /* Letter */
+        {
+            ThisDigit = (UINT32) toupper ((int) *ThisChar);
+            if (!isxdigit ((int) ThisDigit))
+            {
+                /* Not A-F */
+
+                return (AE_BAD_CHARACTER);
+            }
+
+            /* Convert ASCII Hex char (A-F) to value */
+
+            ThisDigit = (ThisDigit - 'A') + 10;
+        }
+
+        /* Insert the 4-bit hex digit */
+
+        ReturnValue <<= 4;
+        ReturnValue += ThisDigit;
+
+        ThisChar++;
+        DigitCount++;
+        if (DigitCount > 16)
+        {
+            /* Value is too large (> 64 bits/8 bytes/16 hex digits) */
+
+            return (AE_LIMIT);
+        }
+    }
+
+    *ReturnInteger = ReturnValue;
+    return (AE_OK);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetFieldValue
+ *
+ * PARAMETERS:  Field               - Current field list pointer
+ *
+ * RETURN:      Field value
+ *
+ * DESCRIPTION: Get field value
+ *
+ *****************************************************************************/
+
+char *
+DtGetFieldValue (
+    DT_FIELD                *Field)
+{
+    if (!Field)
+    {
+        return (NULL);
+    }
+
+    return (Field->Value);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetFieldType
+ *
+ * PARAMETERS:  Info                - Data table info
+ *
+ * RETURN:      Field type
+ *
+ * DESCRIPTION: Get field type
+ *
+ *****************************************************************************/
+
+UINT8
+DtGetFieldType (
+    ACPI_DMTABLE_INFO       *Info)
+{
+    UINT8                   Type;
+
+
+    /* DT_FLAG means that this is the start of a block of flag bits */
+    /* TBD - we can make these a separate opcode later */
+
+    if (Info->Flags & DT_FLAG)
+    {
+        return (DT_FIELD_TYPE_FLAGS_INTEGER);
+    }
+
+    /* Type is based upon the opcode for this field in the info table */
+
+    switch (Info->Opcode)
+    {
+    case ACPI_DMT_FLAG0:
+    case ACPI_DMT_FLAG1:
+    case ACPI_DMT_FLAG2:
+    case ACPI_DMT_FLAG3:
+    case ACPI_DMT_FLAG4:
+    case ACPI_DMT_FLAG5:
+    case ACPI_DMT_FLAG6:
+    case ACPI_DMT_FLAG7:
+    case ACPI_DMT_FLAGS0:
+    case ACPI_DMT_FLAGS1:
+    case ACPI_DMT_FLAGS2:
+    case ACPI_DMT_FLAGS4:
+
+        Type = DT_FIELD_TYPE_FLAG;
+        break;
+
+    case ACPI_DMT_NAME4:
+    case ACPI_DMT_SIG:
+    case ACPI_DMT_NAME6:
+    case ACPI_DMT_NAME8:
+    case ACPI_DMT_STRING:
+
+        Type = DT_FIELD_TYPE_STRING;
+        break;
+
+    case ACPI_DMT_BUFFER:
+    case ACPI_DMT_RAW_BUFFER:
+    case ACPI_DMT_BUF7:
+    case ACPI_DMT_BUF10:
+    case ACPI_DMT_BUF16:
+    case ACPI_DMT_BUF128:
+    case ACPI_DMT_PCI_PATH:
+
+        Type = DT_FIELD_TYPE_BUFFER;
+        break;
+
+    case ACPI_DMT_GAS:
+    case ACPI_DMT_HESTNTFY:
+    case ACPI_DMT_IORTMEM:
+
+        Type = DT_FIELD_TYPE_INLINE_SUBTABLE;
+        break;
+
+    case ACPI_DMT_UNICODE:
+
+        Type = DT_FIELD_TYPE_UNICODE;
+        break;
+
+    case ACPI_DMT_UUID:
+
+        Type = DT_FIELD_TYPE_UUID;
+        break;
+
+    case ACPI_DMT_DEVICE_PATH:
+
+        Type = DT_FIELD_TYPE_DEVICE_PATH;
+        break;
+
+    case ACPI_DMT_LABEL:
+
+        Type = DT_FIELD_TYPE_LABEL;
+        break;
+
+    default:
+
+        Type = DT_FIELD_TYPE_INTEGER;
+        break;
+    }
+
+    return (Type);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetBufferLength
+ *
+ * PARAMETERS:  Buffer              - List of integers,
+ *                                    for example "10 3A 4F 2E"
+ *
+ * RETURN:      Count of integer
+ *
+ * DESCRIPTION: Get length of bytes needed to store the integers
+ *
+ *****************************************************************************/
+
+UINT32
+DtGetBufferLength (
+    char                    *Buffer)
+{
+    UINT32                  ByteLength = 0;
+
+
+    while (*Buffer)
+    {
+        if (*Buffer == ' ')
+        {
+            ByteLength++;
+
+            while (*Buffer == ' ')
+            {
+                Buffer++;
+            }
+        }
+
+        Buffer++;
+    }
+
+    return (++ByteLength);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtGetFieldLength
+ *
+ * PARAMETERS:  Field               - Current field
+ *              Info                - Data table info
+ *
+ * RETURN:      Field length
+ *
+ * DESCRIPTION: Get length of bytes needed to compile the field
+ *
+ * Note: This function must remain in sync with AcpiDmDumpTable.
+ *
+ *****************************************************************************/
+
+UINT32
+DtGetFieldLength (
+    DT_FIELD                *Field,
+    ACPI_DMTABLE_INFO       *Info)
+{
+    UINT32                  ByteLength = 0;
+    char                    *Value;
+
+
+    /* Length is based upon the opcode for this field in the info table */
+
+    switch (Info->Opcode)
+    {
+    case ACPI_DMT_FLAG0:
+    case ACPI_DMT_FLAG1:
+    case ACPI_DMT_FLAG2:
+    case ACPI_DMT_FLAG3:
+    case ACPI_DMT_FLAG4:
+    case ACPI_DMT_FLAG5:
+    case ACPI_DMT_FLAG6:
+    case ACPI_DMT_FLAG7:
+    case ACPI_DMT_FLAGS0:
+    case ACPI_DMT_FLAGS1:
+    case ACPI_DMT_FLAGS2:
+    case ACPI_DMT_FLAGS4:
+    case ACPI_DMT_LABEL:
+    case ACPI_DMT_EXTRA_TEXT:
+
+        ByteLength = 0;
+        break;
+
+    case ACPI_DMT_UINT8:
+    case ACPI_DMT_CHKSUM:
+    case ACPI_DMT_SPACEID:
+    case ACPI_DMT_ACCWIDTH:
+    case ACPI_DMT_IVRS:
+    case ACPI_DMT_GTDT:
+    case ACPI_DMT_MADT:
+    case ACPI_DMT_PCCT:
+    case ACPI_DMT_PMTT:
+    case ACPI_DMT_SRAT:
+    case ACPI_DMT_ASF:
+    case ACPI_DMT_HESTNTYP:
+    case ACPI_DMT_FADTPM:
+    case ACPI_DMT_EINJACT:
+    case ACPI_DMT_EINJINST:
+    case ACPI_DMT_ERSTACT:
+    case ACPI_DMT_ERSTINST:
+    case ACPI_DMT_DMAR_SCOPE:
+
+        ByteLength = 1;
+        break;
+
+    case ACPI_DMT_UINT16:
+    case ACPI_DMT_DMAR:
+    case ACPI_DMT_HEST:
+    case ACPI_DMT_NFIT:
+    case ACPI_DMT_PCI_PATH:
+
+        ByteLength = 2;
+        break;
+
+    case ACPI_DMT_UINT24:
+
+        ByteLength = 3;
+        break;
+
+    case ACPI_DMT_UINT32:
+    case ACPI_DMT_NAME4:
+    case ACPI_DMT_SIG:
+    case ACPI_DMT_LPIT:
+
+        ByteLength = 4;
+        break;
+
+    case ACPI_DMT_UINT40:
+
+        ByteLength = 5;
+        break;
+
+    case ACPI_DMT_UINT48:
+    case ACPI_DMT_NAME6:
+
+        ByteLength = 6;
+        break;
+
+    case ACPI_DMT_UINT56:
+    case ACPI_DMT_BUF7:
+
+        ByteLength = 7;
+        break;
+
+    case ACPI_DMT_UINT64:
+    case ACPI_DMT_NAME8:
+
+        ByteLength = 8;
+        break;
+
+    case ACPI_DMT_STRING:
+
+        Value = DtGetFieldValue (Field);
+        if (Value)
+        {
+            ByteLength = strlen (Value) + 1;
+        }
+        else
+        {   /* At this point, this is a fatal error */
+
+            sprintf (MsgBuffer, "Expected \"%s\"", Info->Name);
+            DtFatal (ASL_MSG_COMPILER_INTERNAL, NULL, MsgBuffer);
+            return (0);
+        }
+        break;
+
+    case ACPI_DMT_GAS:
+
+        ByteLength = sizeof (ACPI_GENERIC_ADDRESS);
+        break;
+
+    case ACPI_DMT_HESTNTFY:
+
+        ByteLength = sizeof (ACPI_HEST_NOTIFY);
+        break;
+
+    case ACPI_DMT_IORTMEM:
+
+        ByteLength = sizeof (ACPI_IORT_MEMORY_ACCESS);
+        break;
+
+    case ACPI_DMT_BUFFER:
+    case ACPI_DMT_RAW_BUFFER:
+
+        Value = DtGetFieldValue (Field);
+        if (Value)
+        {
+            ByteLength = DtGetBufferLength (Value);
+        }
+        else
+        {   /* At this point, this is a fatal error */
+
+            sprintf (MsgBuffer, "Expected \"%s\"", Info->Name);
+            DtFatal (ASL_MSG_COMPILER_INTERNAL, NULL, MsgBuffer);
+            return (0);
+        }
+        break;
+
+    case ACPI_DMT_BUF10:
+
+        ByteLength = 10;
+        break;
+
+    case ACPI_DMT_BUF16:
+    case ACPI_DMT_UUID:
+
+        ByteLength = 16;
+        break;
+
+    case ACPI_DMT_BUF128:
+
+        ByteLength = 128;
+        break;
+
+    case ACPI_DMT_UNICODE:
+
+        Value = DtGetFieldValue (Field);
+
+        /* TBD: error if Value is NULL? (as below?) */
+
+        ByteLength = (strlen (Value) + 1) * sizeof(UINT16);
+        break;
+
+    default:
+
+        DtFatal (ASL_MSG_COMPILER_INTERNAL, Field, "Invalid table opcode");
+        return (0);
+    }
+
+    return (ByteLength);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtSum
+ *
+ * PARAMETERS:  DT_WALK_CALLBACK:
+ *              Subtable            - Subtable
+ *              Context             - Unused
+ *              ReturnValue         - Store the checksum of subtable
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Get the checksum of subtable
+ *
+ *****************************************************************************/
+
+static void
+DtSum (
+    DT_SUBTABLE             *Subtable,
+    void                    *Context,
+    void                    *ReturnValue)
+{
+    UINT8                   Checksum;
+    UINT8                   *Sum = ReturnValue;
+
+
+    Checksum = AcpiTbChecksum (Subtable->Buffer, Subtable->Length);
+    *Sum = (UINT8) (*Sum + Checksum);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtSetTableChecksum
+ *
+ * PARAMETERS:  ChecksumPointer     - Where to return the checksum
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Set checksum of the whole data table into the checksum field
+ *
+ *****************************************************************************/
+
+void
+DtSetTableChecksum (
+    UINT8                   *ChecksumPointer)
+{
+    UINT8                   Checksum = 0;
+    UINT8                   OldSum;
+
+
+    DtWalkTableTree (Gbl_RootTable, DtSum, NULL, &Checksum);
+
+    OldSum = *ChecksumPointer;
+    Checksum = (UINT8) (Checksum - OldSum);
+
+    /* Compute the final checksum */
+
+    Checksum = (UINT8) (0 - Checksum);
+    *ChecksumPointer = Checksum;
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtSetTableLength
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Walk the subtables and set all the length fields
+ *
+ *****************************************************************************/
+
+void
+DtSetTableLength (
+    void)
+{
+    DT_SUBTABLE             *ParentTable;
+    DT_SUBTABLE             *ChildTable;
+
+
+    ParentTable = Gbl_RootTable;
+    ChildTable = NULL;
+
+    if (!ParentTable)
+    {
+        return;
+    }
+
+    DtSetSubtableLength (ParentTable);
+
+    while (1)
+    {
+        ChildTable = DtGetNextSubtable (ParentTable, ChildTable);
+        if (ChildTable)
+        {
+            if (ChildTable->LengthField)
+            {
+                DtSetSubtableLength (ChildTable);
+            }
+
+            if (ChildTable->Child)
+            {
+                ParentTable = ChildTable;
+                ChildTable = NULL;
+            }
+            else
+            {
+                ParentTable->TotalLength += ChildTable->TotalLength;
+                if (ParentTable->LengthField)
+                {
+                    DtSetSubtableLength (ParentTable);
+                }
+            }
+        }
+        else
+        {
+            ChildTable = ParentTable;
+
+            if (ChildTable == Gbl_RootTable)
+            {
+                break;
+            }
+
+            ParentTable = DtGetParentSubtable (ParentTable);
+
+            ParentTable->TotalLength += ChildTable->TotalLength;
+            if (ParentTable->LengthField)
+            {
+                DtSetSubtableLength (ParentTable);
+            }
+        }
+    }
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    DtWalkTableTree
+ *
+ * PARAMETERS:  StartTable          - Subtable in the tree where walking begins
+ *              UserFunction        - Called during the walk
+ *              Context             - Passed to user function
+ *              ReturnValue         - The return value of UserFunction
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Performs a depth-first walk of the subtable tree
+ *
+ *****************************************************************************/
+
+void
+DtWalkTableTree (
+    DT_SUBTABLE             *StartTable,
+    DT_WALK_CALLBACK        UserFunction,
+    void                    *Context,
+    void                    *ReturnValue)
+{
+    DT_SUBTABLE             *ParentTable;
+    DT_SUBTABLE             *ChildTable;
+
+
+    ParentTable = StartTable;
+    ChildTable = NULL;
+
+    if (!ParentTable)
+    {
+        return;
+    }
+
+    UserFunction (ParentTable, Context, ReturnValue);
+
+    while (1)
+    {
+        ChildTable = DtGetNextSubtable (ParentTable, ChildTable);
+        if (ChildTable)
+        {
+            UserFunction (ChildTable, Context, ReturnValue);
+
+            if (ChildTable->Child)
+            {
+                ParentTable = ChildTable;
+                ChildTable = NULL;
+            }
+        }
+        else
+        {
+            ChildTable = ParentTable;
+            if (ChildTable == Gbl_RootTable)
+            {
+                break;
+            }
+
+            ParentTable = DtGetParentSubtable (ParentTable);
+
+            if (ChildTable->Peer == StartTable)
+            {
+                break;
+            }
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtSubtableCacheCalloc
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Pointer to the buffer. Aborts on allocation failure
+ *
+ * DESCRIPTION: Allocate a subtable object buffer. Bypass the local
+ *              dynamic memory manager for performance reasons (This has a
+ *              major impact on the speed of the compiler.)
+ *
+ ******************************************************************************/
+
+DT_SUBTABLE *
+UtSubtableCacheCalloc (
+    void)
+{
+    ASL_CACHE_INFO          *Cache;
+
+
+    if (Gbl_SubtableCacheNext >= Gbl_SubtableCacheLast)
+    {
+        /* Allocate a new buffer */
+
+        Cache = UtLocalCalloc (sizeof (Cache->Next) +
+            (sizeof (DT_SUBTABLE) * ASL_SUBTABLE_CACHE_SIZE));
+
+        /* Link new cache buffer to head of list */
+
+        Cache->Next = Gbl_SubtableCacheList;
+        Gbl_SubtableCacheList = Cache;
+
+        /* Setup cache management pointers */
+
+        Gbl_SubtableCacheNext = ACPI_CAST_PTR (DT_SUBTABLE, Cache->Buffer);
+        Gbl_SubtableCacheLast = Gbl_SubtableCacheNext + ASL_SUBTABLE_CACHE_SIZE;
+    }
+
+    Gbl_SubtableCount++;
+    return (Gbl_SubtableCacheNext++);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    UtFieldCacheCalloc
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Pointer to the buffer. Aborts on allocation failure
+ *
+ * DESCRIPTION: Allocate a field object buffer. Bypass the local
+ *              dynamic memory manager for performance reasons (This has a
+ *              major impact on the speed of the compiler.)
+ *
+ ******************************************************************************/
+
+DT_FIELD *
+UtFieldCacheCalloc (
+    void)
+{
+    ASL_CACHE_INFO          *Cache;
+
+
+    if (Gbl_FieldCacheNext >= Gbl_FieldCacheLast)
+    {
+        /* Allocate a new buffer */
+
+        Cache = UtLocalCalloc (sizeof (Cache->Next) +
+            (sizeof (DT_FIELD) * ASL_FIELD_CACHE_SIZE));
+
+        /* Link new cache buffer to head of list */
+
+        Cache->Next = Gbl_FieldCacheList;
+        Gbl_FieldCacheList = Cache;
+
+        /* Setup cache management pointers */
+
+        Gbl_FieldCacheNext = ACPI_CAST_PTR (DT_FIELD, Cache->Buffer);
+        Gbl_FieldCacheLast = Gbl_FieldCacheNext + ASL_FIELD_CACHE_SIZE;
+    }
+
+    Gbl_FieldCount++;
+    return (Gbl_FieldCacheNext++);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    DtDeleteCaches
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Delete all local cache buffer blocks
+ *
+ ******************************************************************************/
+
+void
+DtDeleteCaches (
+    void)
+{
+    UINT32                  BufferCount;
+    ASL_CACHE_INFO          *Next;
+
+
+    /* Field cache */
+
+    BufferCount = 0;
+    while (Gbl_FieldCacheList)
+    {
+        Next = Gbl_FieldCacheList->Next;
+        ACPI_FREE (Gbl_FieldCacheList);
+        Gbl_FieldCacheList = Next;
+        BufferCount++;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "%u Fields, Buffer size: %u fields (%u bytes), %u Buffers\n",
+        Gbl_FieldCount, ASL_FIELD_CACHE_SIZE,
+        (sizeof (DT_FIELD) * ASL_FIELD_CACHE_SIZE), BufferCount);
+
+    Gbl_FieldCount = 0;
+    Gbl_FieldCacheNext = NULL;
+    Gbl_FieldCacheLast = NULL;
+
+    /* Subtable cache */
+
+    BufferCount = 0;
+    while (Gbl_SubtableCacheList)
+    {
+        Next = Gbl_SubtableCacheList->Next;
+        ACPI_FREE (Gbl_SubtableCacheList);
+        Gbl_SubtableCacheList = Next;
+        BufferCount++;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "%u Subtables, Buffer size: %u subtables (%u bytes), %u Buffers\n",
+        Gbl_SubtableCount, ASL_SUBTABLE_CACHE_SIZE,
+        (sizeof (DT_SUBTABLE) * ASL_SUBTABLE_CACHE_SIZE), BufferCount);
+
+    Gbl_SubtableCount = 0;
+    Gbl_SubtableCacheNext = NULL;
+    Gbl_SubtableCacheLast = NULL;
+}
diff --git a/usr/src/cmd/acpi/iasl/new_table.txt b/usr/src/cmd/acpi/iasl/new_table.txt
new file mode 100644
index 0000000000..1e48d385b6
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/new_table.txt
@@ -0,0 +1,88 @@
+How to add a new ACPI table to ACPICA and the iASL compiler.
+------------------------------------------------------------
+
+There are four main tasks that are needed to provide support for a
+new ACPI table:
+    1) Create a full definition of the table and any subtables
+       in the ACPICA headers.
+    2) Add disassembler support for the new table
+    3) Add iASL table compiler support for the new table
+    4) Create a default template for the new table for iASL -T
+       option.
+
+Notes for each of these tasks provided below.
+
+
+1) Header Support
+-----------------
+
+New tables should be added to the appropriate header:
+    actbl2.h: Used for new tables that are not defined in the ACPI spec.
+    actbl3.h: Used for new tables that are defined in the ACPI spec.
+
+Use ACPI_TABLE_HEADER for the common ACPI table header.
+Subtables should be defined separately from the main table.
+Don't add placeholder fields for subtables and other multiple data items.
+    (Don't use xxxxx[1] for a field that can have multiple items.)
+    The disassembler and data table compiler depends on this.
+For tables not defined in the ACPI spec, add a comment to indicate where
+    the table came from.
+Use other table definitions for additional guidance.
+
+
+2) iASL Disassembler Support
+----------------------------
+
+Add definition of the table (and subtables) in common/dmtbinfo.c
+Add table access macro(s) of the form ACPI_xxxx_OFFSET
+Add ACPI_DMT_TERMINATOR at the end of every table/subtable definition
+
+Add externals for the table/subtable definitions in acdisasm.h
+Add an entry for the new table in the AcpiDmTableData in common/dmtable.c
+
+If there are no subtables, add the AcpiDmTableInfoXXXX name to the
+    AcpiDmTableData and it will automatically be disassembled.
+
+If there are subtables, a dump routine must be written:
+Add an AcpiDmDumpXXXX function to dmtbdump.c -- note, code for another
+    similar table can often be ported for the new table.
+Add an external for this function to acdisasm.h
+Add this function to the AcpiDmTableData entry for the new ACPI table
+
+Debug/Test: Either find an existing example of the new ACPI table, or
+    create one using the "generic ACPI table support" included in the
+    iASL data table compiler. Use the -G option to force a
+    generic compile. It is often best to create the table from scratch,
+    since this clearly exposes the dependencies (lengths, offsets, etc.)
+    that the Table Compiler support will need to generate.
+
+
+3) iASL Table Compiler Support
+------------------------------
+
+Simple tables do not require a compile routine. The definition of the
+    table in common/dmtbinfo.c (created in step 2 above) will suffice.
+
+Complex tables with subtables will require a compile routine with a name
+    of the form DtCompileXXXX.
+Add a DtCompileXXXX function to the dttable.c module.
+Add an external for this function in dtcompiler.h
+Add this function to the AcpiDmTableData entry for the new ACPI table
+    in common/dmtable.c
+
+
+4) Template Support (-T iASL option)
+------------------------------------
+
+Create an example of the new ACPI table. This example should create
+    multiple subtables (if supported), and multiple instances of any
+    variable length data.
+
+Compile the example file with the -sc option. This will create a C
+    array that contains the table contents.
+
+Add this array to the dttemplate.h file. Name the array TemplateXXXX.
+Add this array name to the AcpiDmTableData entry for the new ACPI table
+
+Debug/Test: Create the template file. Compile the file. Disassemble the file.
+    Compile the disassembly file.
diff --git a/usr/src/cmd/acpi/iasl/preprocess.h b/usr/src/cmd/acpi/iasl/preprocess.h
new file mode 100644
index 0000000000..50759b5462
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/preprocess.h
@@ -0,0 +1,292 @@
+/******************************************************************************
+ *
+ * Module Name: preprocess.h - header for iASL Preprocessor
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#define __PREPROCESS_H__
+
+#ifndef _PREPROCESS
+#define _PREPROCESS
+
+#undef PR_EXTERN
+
+#ifdef _DECLARE_PR_GLOBALS
+#define PR_EXTERN
+#define PR_INIT_GLOBAL(a,b)         (a)=(b)
+#else
+#define PR_EXTERN                   extern
+#define PR_INIT_GLOBAL(a,b)         (a)
+#endif
+
+
+/*
+ * Configuration
+ */
+#define PR_MAX_MACRO_ARGS       32              /* Max number of macro args */
+#define PR_MAX_ARG_INSTANCES    24              /* Max instances of any one arg */
+#define PR_LINES_PER_BLOCK      4096            /* Max input source lines per block */
+
+
+/*
+ * Local defines and macros
+ */
+#define PR_TOKEN_SEPARATORS     " ,(){}\t\n"
+#define PR_MACRO_SEPARATORS     " ,(){}~!*/%+-<>=&^|\"\t\n"
+#define PR_MACRO_ARGUMENTS      " ,\t\n"
+#define PR_EXPR_SEPARATORS      " ,(){}~!*/%+-<>=&^|\"\t\n"
+
+#define PR_PREFIX_ID            "Pr(%.4u) - "             /* Used for debug output */
+
+#define THIS_TOKEN_OFFSET(t)    ((t-Gbl_MainTokenBuffer) + 1)
+
+
+/*
+ * Preprocessor structures
+ */
+typedef struct pr_macro_arg
+{
+    char                        *Name;
+    UINT32                      Offset[PR_MAX_ARG_INSTANCES];
+    UINT16                      UseCount;
+
+} PR_MACRO_ARG;
+
+typedef struct pr_define_info
+{
+    struct pr_define_info       *Previous;
+    struct pr_define_info       *Next;
+    char                        *Identifier;
+    char                        *Replacement;
+    char                        *Body;          /* Macro body */
+    PR_MACRO_ARG                *Args;          /* Macro arg list */
+    UINT16                      ArgCount;       /* Macro arg count */
+    BOOLEAN                     Persist;        /* Keep for entire compiler run */
+
+} PR_DEFINE_INFO;
+
+typedef struct pr_directive_info
+{
+    char                        *Name;          /* Directive name */
+    UINT8                       ArgCount;       /* Required # of args */
+
+} PR_DIRECTIVE_INFO;
+
+typedef struct pr_operator_info
+{
+    char                        *Op;
+
+} PR_OPERATOR_INFO;
+
+typedef struct pr_file_node
+{
+    struct pr_file_node         *Next;
+    FILE                        *File;
+    char                        *Filename;
+    UINT32                      CurrentLineNumber;
+
+} PR_FILE_NODE;
+
+#define MAX_ARGUMENT_LENGTH     24
+
+typedef struct directive_info
+{
+    struct directive_info       *Next;
+    char                        Argument[MAX_ARGUMENT_LENGTH];
+    int                         Directive;
+    BOOLEAN                     IgnoringThisCodeBlock;
+
+} DIRECTIVE_INFO;
+
+
+/*
+ * Globals
+ */
+#if 0 /* TBD for macros */
+PR_EXTERN char                  PR_INIT_GLOBAL (*XXXEvalBuffer, NULL); /* [ASL_LINE_BUFFER_SIZE]; */
+#endif
+
+PR_EXTERN char                  PR_INIT_GLOBAL (*Gbl_MainTokenBuffer, NULL); /* [ASL_LINE_BUFFER_SIZE]; */
+PR_EXTERN char                  PR_INIT_GLOBAL (*Gbl_MacroTokenBuffer, NULL); /* [ASL_LINE_BUFFER_SIZE]; */
+PR_EXTERN char                  PR_INIT_GLOBAL (*Gbl_ExpressionTokenBuffer, NULL); /* [ASL_LINE_BUFFER_SIZE]; */
+
+PR_EXTERN UINT32                Gbl_PreprocessorLineNumber;
+PR_EXTERN int                   Gbl_IfDepth;
+PR_EXTERN PR_FILE_NODE          *Gbl_InputFileList;
+PR_EXTERN PR_DEFINE_INFO        PR_INIT_GLOBAL (*Gbl_DefineList, NULL);
+PR_EXTERN BOOLEAN               PR_INIT_GLOBAL (Gbl_PreprocessorError, FALSE);
+PR_EXTERN BOOLEAN               PR_INIT_GLOBAL (Gbl_IgnoringThisCodeBlock, FALSE);
+PR_EXTERN DIRECTIVE_INFO        PR_INIT_GLOBAL (*Gbl_DirectiveStack, NULL);
+
+/*
+ * prscan - Preprocessor entry
+ */
+void
+PrInitializePreprocessor (
+    void);
+
+void
+PrInitializeGlobals (
+    void);
+
+void
+PrTerminatePreprocessor (
+    void);
+
+void
+PrDoPreprocess (
+    void);
+
+UINT64
+PrIsDefined (
+    char                    *Identifier);
+
+UINT64
+PrResolveDefine (
+    char                    *Identifier);
+
+int
+PrInitLexer (
+    char                    *String);
+
+void
+PrTerminateLexer (
+    void);
+
+
+/*
+ * prmacros - Support for #defines and macros
+ */
+void
+PrDumpPredefinedNames (
+    void);
+
+PR_DEFINE_INFO *
+PrAddDefine (
+    char                    *Token,
+    char                    *Token2,
+    BOOLEAN                 Persist);
+
+void
+PrRemoveDefine (
+    char                    *DefineName);
+
+PR_DEFINE_INFO *
+PrMatchDefine (
+    char                    *MatchString);
+
+void
+PrAddMacro (
+    char                    *Name,
+    char                    **Next);
+
+void
+PrDoMacroInvocation (
+    char                    *TokenBuffer,
+    char                    *MacroStart,
+    PR_DEFINE_INFO          *DefineInfo,
+    char                    **Next);
+
+
+/*
+ * prexpress - #if expression support
+ */
+ACPI_STATUS
+PrResolveIntegerExpression (
+    char                    *Line,
+    UINT64                  *ReturnValue);
+
+char *
+PrPrioritizeExpression (
+    char                    *OriginalLine);
+
+/*
+ * prparser - lex/yacc expression parser
+ */
+UINT64
+PrEvaluateExpression (
+    char                    *ExprString);
+
+
+/*
+ * prutils - Preprocesor utilities
+ */
+char *
+PrGetNextToken (
+    char                    *Buffer,
+    char                    *MatchString,
+    char                    **Next);
+
+void
+PrError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    UINT32                  Column);
+
+void
+PrReplaceData (
+    char                    *Buffer,
+    UINT32                  LengthToRemove,
+    char                    *BufferToAdd,
+    UINT32                  LengthToAdd);
+
+FILE *
+PrOpenIncludeFile (
+    char                    *Filename,
+    char                    *OpenMode,
+    char                    **FullPathname);
+
+FILE *
+PrOpenIncludeWithPrefix (
+    char                    *PrefixDir,
+    char                    *Filename,
+    char                    *OpenMode,
+    char                    **FullPathname);
+
+void
+PrPushInputFileStack (
+    FILE                    *InputFile,
+    char                    *Filename);
+
+BOOLEAN
+PrPopInputFileStack (
+    void);
+
+#endif
diff --git a/usr/src/cmd/acpi/iasl/prexpress.c b/usr/src/cmd/acpi/iasl/prexpress.c
new file mode 100644
index 0000000000..b6bc801f25
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/prexpress.c
@@ -0,0 +1,306 @@
+/******************************************************************************
+ *
+ * Module Name: prexpress - Preprocessor #if expression support
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+
+#define _COMPONENT          ASL_PREPROCESSOR
+        ACPI_MODULE_NAME    ("prexpress")
+
+/* Local prototypes */
+
+static char *
+PrExpandMacros (
+    char                    *Line);
+
+
+#ifdef _UNDER_DEVELOPMENT
+/******************************************************************************
+ *
+ * FUNCTION:    PrUnTokenize
+ *
+ * PARAMETERS:  Buffer              - Token Buffer
+ *              Next                - "Next" buffer from GetNextToken
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Un-tokenized the current token buffer. The implementation is
+ *              to simply set the null inserted by GetNextToken to a blank.
+ *              If Next is NULL, there were no tokens found in the Buffer,
+ *              so there is nothing to do.
+ *
+ *****************************************************************************/
+
+static void
+PrUnTokenize (
+    char                    *Buffer,
+    char                    *Next)
+{
+    UINT32                  Length = strlen (Buffer);
+
+
+    if (!Next)
+    {
+        return;
+    }
+
+    if (Buffer[Length] != '\n')
+    {
+        Buffer[strlen(Buffer)] = ' ';
+    }
+}
+#endif
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrExpandMacros
+ *
+ * PARAMETERS:  Line                - Pointer into the current line
+ *
+ * RETURN:      Updated pointer into the current line
+ *
+ * DESCRIPTION: Expand any macros found in the current line buffer.
+ *
+ *****************************************************************************/
+
+static char *
+PrExpandMacros (
+    char                    *Line)
+{
+    char                    *Token;
+    char                    *ReplaceString;
+    PR_DEFINE_INFO          *DefineInfo;
+    ACPI_SIZE               TokenOffset;
+    char                    *Next;
+    int                     OffsetAdjust;
+
+
+    strcpy (Gbl_ExpressionTokenBuffer, Gbl_CurrentLineBuffer);
+    Token = PrGetNextToken (Gbl_ExpressionTokenBuffer, PR_EXPR_SEPARATORS, &Next);
+    OffsetAdjust = 0;
+
+    while (Token)
+    {
+        DefineInfo = PrMatchDefine (Token);
+        if (DefineInfo)
+        {
+            if (DefineInfo->Body)
+            {
+                /* This is a macro. TBD: Is this allowed? */
+
+                DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+                    "Matched Macro: %s->%s\n",
+                    Gbl_CurrentLineNumber, DefineInfo->Identifier,
+                    DefineInfo->Replacement);
+
+                PrDoMacroInvocation (Gbl_ExpressionTokenBuffer, Token,
+                    DefineInfo, &Next);
+            }
+            else
+            {
+                ReplaceString = DefineInfo->Replacement;
+
+                /* Replace the name in the original line buffer */
+
+                TokenOffset = Token - Gbl_ExpressionTokenBuffer + OffsetAdjust;
+                PrReplaceData (
+                    &Gbl_CurrentLineBuffer[TokenOffset], strlen (Token),
+                    ReplaceString, strlen (ReplaceString));
+
+                /* Adjust for length difference between old and new name length */
+
+                OffsetAdjust += strlen (ReplaceString) - strlen (Token);
+
+                DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+                    "Matched #define within expression: %s->%s\n",
+                    Gbl_CurrentLineNumber, Token,
+                    *ReplaceString ? ReplaceString : "(NULL STRING)");
+            }
+        }
+
+        Token = PrGetNextToken (NULL, PR_EXPR_SEPARATORS, &Next);
+    }
+
+    return (Line);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrIsDefined
+ *
+ * PARAMETERS:  Identifier          - Name to be resolved
+ *
+ * RETURN:      64-bit boolean integer value
+ *
+ * DESCRIPTION: Returns TRUE if the name is defined, FALSE otherwise (0).
+ *
+ *****************************************************************************/
+
+UINT64
+PrIsDefined (
+    char                    *Identifier)
+{
+    UINT64                  Value;
+    PR_DEFINE_INFO          *DefineInfo;
+
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "**** Is defined?:  %s\n", Gbl_CurrentLineNumber, Identifier);
+
+    Value = 0; /* Default is "Not defined" -- FALSE */
+
+    DefineInfo = PrMatchDefine (Identifier);
+    if (DefineInfo)
+    {
+        Value = ACPI_UINT64_MAX; /* TRUE */
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "[#if defined %s] resolved to: %8.8X%8.8X\n",
+        Gbl_CurrentLineNumber, Identifier, ACPI_FORMAT_UINT64 (Value));
+
+    return (Value);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrResolveDefine
+ *
+ * PARAMETERS:  Identifier          - Name to be resolved
+ *
+ * RETURN:      A 64-bit boolean integer value
+ *
+ * DESCRIPTION: Returns TRUE if the name is defined, FALSE otherwise (0).
+ *
+ *****************************************************************************/
+
+UINT64
+PrResolveDefine (
+    char                    *Identifier)
+{
+    UINT64                  Value;
+    PR_DEFINE_INFO          *DefineInfo;
+
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "**** Resolve #define:  %s\n", Gbl_CurrentLineNumber, Identifier);
+
+    Value = 0; /* Default is "Not defined" -- FALSE */
+
+    DefineInfo = PrMatchDefine (Identifier);
+    if (DefineInfo)
+    {
+        Value = ACPI_UINT64_MAX; /* TRUE */
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "[#if defined %s] resolved to: %8.8X%8.8X\n",
+        Gbl_CurrentLineNumber, Identifier, ACPI_FORMAT_UINT64 (Value));
+
+    return (Value);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrResolveIntegerExpression
+ *
+ * PARAMETERS:  Line                - Pointer to integer expression
+ *              ReturnValue         - Where the resolved 64-bit integer is
+ *                                    returned.
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Resolve an integer expression to a single value. Supports
+ *              both integer constants and labels.
+ *
+ *****************************************************************************/
+
+ACPI_STATUS
+PrResolveIntegerExpression (
+    char                    *Line,
+    UINT64                  *ReturnValue)
+{
+    UINT64                  Result;
+    char                    *ExpandedLine;
+
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "**** Resolve #if:  %s\n", Gbl_CurrentLineNumber, Line);
+
+    /* Expand all macros within the expression first */
+
+    ExpandedLine = PrExpandMacros (Line);
+
+    /* Now we can evaluate the expression */
+
+    Result = PrEvaluateExpression (ExpandedLine);
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "**** Expression Resolved to: %8.8X%8.8X\n",
+        Gbl_CurrentLineNumber, ACPI_FORMAT_UINT64 (Result));
+
+    *ReturnValue = Result;
+    return (AE_OK);
+
+#if 0
+InvalidExpression:
+
+    ACPI_FREE (EvalBuffer);
+    PrError (ASL_ERROR, ASL_MSG_INVALID_EXPRESSION, 0);
+    return (AE_ERROR);
+
+
+NormalExit:
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "**** Expression Resolved to: %8.8X%8.8X\n",
+        Gbl_CurrentLineNumber, ACPI_FORMAT_UINT64 (Value1));
+
+    *ReturnValue = Value1;
+    return (AE_OK);
+#endif
+}
diff --git a/usr/src/cmd/acpi/iasl/prmacros.c b/usr/src/cmd/acpi/iasl/prmacros.c
new file mode 100644
index 0000000000..8ad9236138
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/prmacros.c
@@ -0,0 +1,582 @@
+/******************************************************************************
+ *
+ * Module Name: prmacros - Preprocessor #define macro support
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+
+#define _COMPONENT          ASL_PREPROCESSOR
+        ACPI_MODULE_NAME    ("prmacros")
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrDumpPredefinedNames
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump the list of #defines. Used as the preprocessor starts, to
+ *              display the names that were defined on the command line.
+ *              Debug information only.
+ *
+ ******************************************************************************/
+
+void
+PrDumpPredefinedNames (
+    void)
+{
+    PR_DEFINE_INFO          *DefineInfo;
+
+
+    DefineInfo = Gbl_DefineList;
+    while (DefineInfo)
+    {
+        DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+            "Predefined #define: %s->%s\n",
+            0, DefineInfo->Identifier, DefineInfo->Replacement);
+
+        DefineInfo = DefineInfo->Next;
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrAddDefine
+ *
+ * PARAMETERS:  Identifier          - Name to be replaced
+ *              Replacement         - Replacement for Identifier
+ *              Persist             - Keep define across multiple compiles?
+ *
+ * RETURN:      A new define_info struct. NULL on error.
+ *
+ * DESCRIPTION: Add a new #define to the global list
+ *
+ ******************************************************************************/
+
+PR_DEFINE_INFO *
+PrAddDefine (
+    char                    *Identifier,
+    char                    *Replacement,
+    BOOLEAN                 Persist)
+{
+    char                    *IdentifierString;
+    char                    *ReplacementString;
+    PR_DEFINE_INFO          *DefineInfo;
+
+
+    if (!Replacement)
+    {
+        Replacement = "";
+    }
+
+    /* Check for already-defined first */
+
+    DefineInfo = PrMatchDefine (Identifier);
+    if (DefineInfo)
+    {
+        DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID,
+            "#define: name already exists: %s\n",
+            Gbl_CurrentLineNumber, Identifier);
+
+        /*
+         * Name already exists. This is only an error if the target name
+         * is different.
+         */
+        if (strcmp (Replacement, DefineInfo->Replacement))
+        {
+            PrError (ASL_ERROR, ASL_MSG_EXISTING_NAME,
+                THIS_TOKEN_OFFSET (Identifier));
+
+            return (NULL);
+        }
+
+        return (DefineInfo);
+    }
+
+    /* Copy input strings */
+
+    IdentifierString = UtLocalCalloc (strlen (Identifier) + 1);
+    strcpy (IdentifierString, Identifier);
+
+    ReplacementString = UtLocalCalloc (strlen (Replacement) + 1);
+    strcpy (ReplacementString, Replacement);
+
+    /* Init and link new define info struct */
+
+    DefineInfo = UtLocalCalloc (sizeof (PR_DEFINE_INFO));
+    DefineInfo->Replacement = ReplacementString;
+    DefineInfo->Identifier = IdentifierString;
+    DefineInfo->Persist = Persist;
+
+    if (Gbl_DefineList)
+    {
+        Gbl_DefineList->Previous = DefineInfo;
+    }
+
+    DefineInfo->Next = Gbl_DefineList;
+    Gbl_DefineList = DefineInfo;
+    return (DefineInfo);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrRemoveDefine
+ *
+ * PARAMETERS:  DefineName          - Name of define to be removed
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Implements #undef. Remove a #define if found in the global
+ *              list. No error if the target of the #undef does not exist,
+ *              as per the C #undef definition.
+ *
+ ******************************************************************************/
+
+void
+PrRemoveDefine (
+    char                    *DefineName)
+{
+    PR_DEFINE_INFO          *DefineInfo;
+
+
+    /* Match name and delete the node */
+
+    DefineInfo = Gbl_DefineList;
+    while (DefineInfo)
+    {
+        if (!strcmp (DefineName, DefineInfo->Identifier))
+        {
+            /* Remove from linked list */
+
+            if (DefineInfo->Previous)
+            {
+                (DefineInfo->Previous)->Next = DefineInfo->Next;
+            }
+            else
+            {
+                Gbl_DefineList = DefineInfo->Next;
+            }
+
+            if (DefineInfo->Next)
+            {
+                (DefineInfo->Next)->Previous = DefineInfo->Previous;
+            }
+
+            free (DefineInfo);
+            return;
+        }
+
+        DefineInfo = DefineInfo->Next;
+    }
+
+    /*
+     * Name was not found. By definition of #undef, this is not
+     * an error, however.
+     */
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "#undef: could not find %s\n",
+        Gbl_CurrentLineNumber, DefineName);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrMatchDefine
+ *
+ * PARAMETERS:  MatchString         - Name associated with the #define
+ *
+ * RETURN:      Matched string if found. NULL otherwise.
+ *
+ * DESCRIPTION: Find a name in global #define list
+ *
+ ******************************************************************************/
+
+PR_DEFINE_INFO *
+PrMatchDefine (
+    char                    *MatchString)
+{
+    PR_DEFINE_INFO          *DefineInfo;
+
+
+    DefineInfo = Gbl_DefineList;
+    while (DefineInfo)
+    {
+        if (!strcmp (MatchString, DefineInfo->Identifier))
+        {
+            return (DefineInfo);
+        }
+
+        DefineInfo = DefineInfo->Next;
+    }
+
+    return (NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrAddMacro
+ *
+ * PARAMETERS:  Name                - Start of the macro definition
+ *              Next                - "Next" buffer from GetNextToken
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Add a new macro to the list of #defines. Handles argument
+ *              processing.
+ *
+ ******************************************************************************/
+
+void
+PrAddMacro (
+    char                    *Name,
+    char                    **Next)
+{
+    char                    *Token = NULL;
+    ACPI_SIZE               TokenOffset;
+    ACPI_SIZE               MacroBodyOffset;
+    PR_DEFINE_INFO          *DefineInfo;
+    PR_MACRO_ARG            *Args;
+    char                    *Body;
+    char                    *BodyInSource;
+    UINT32                  i;
+    UINT16                  UseCount = 0;
+    UINT16                  ArgCount = 0;
+    UINT32                  Depth = 1;
+    UINT32                  EndOfArgList;
+    char                    BufferChar;
+
+
+    /* Find the end of the arguments list */
+
+    TokenOffset = Name - Gbl_MainTokenBuffer + strlen (Name) + 1;
+    while (1)
+    {
+        BufferChar = Gbl_CurrentLineBuffer[TokenOffset];
+        if (BufferChar == '(')
+        {
+            Depth++;
+        }
+        else if (BufferChar == ')')
+        {
+            Depth--;
+        }
+        else if (BufferChar == 0)
+        {
+            PrError (ASL_ERROR, ASL_MSG_MACRO_SYNTAX, TokenOffset);
+            return;
+        }
+
+        if (Depth == 0)
+        {
+            /* Found arg list end */
+
+            EndOfArgList = TokenOffset;
+            break;
+        }
+
+        TokenOffset++;
+    }
+
+    /* At this point, we know that we have a reasonable argument list */
+
+    Args = UtLocalCalloc (sizeof (PR_MACRO_ARG) * PR_MAX_MACRO_ARGS);
+
+    /* Get the macro argument names */
+
+    for (i = 0; i < PR_MAX_MACRO_ARGS; i++)
+    {
+        Token = PrGetNextToken (NULL, PR_MACRO_SEPARATORS, Next);
+        if (!Token)
+        {
+            /* This is the case for a NULL macro body */
+
+            BodyInSource = "";
+            goto AddMacroToList;
+        }
+
+        /* Don't go beyond the argument list */
+
+        TokenOffset = Token - Gbl_MainTokenBuffer + strlen (Token);
+        if (TokenOffset > EndOfArgList)
+        {
+            break;
+        }
+
+        DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+            "Macro arg: %s \n",
+            Gbl_CurrentLineNumber, Token);
+
+        Args[i].Name = UtLocalCalloc (strlen (Token) + 1);
+        strcpy (Args[i].Name, Token);
+
+        Args[i].UseCount = 0;
+
+        ArgCount++;
+        if (ArgCount >= PR_MAX_MACRO_ARGS)
+        {
+            PrError (ASL_ERROR, ASL_MSG_TOO_MANY_ARGUMENTS, TokenOffset);
+            goto ErrorExit;
+        }
+    }
+
+    /* Get the macro body. Token now points to start of body */
+
+    MacroBodyOffset = Token - Gbl_MainTokenBuffer;
+
+    /* Match each method arg in the macro body for later use */
+
+    Token = PrGetNextToken (NULL, PR_MACRO_SEPARATORS, Next);
+    while (Token)
+    {
+        /* Search the macro arg list for matching arg */
+
+        for (i = 0; Args[i].Name && (i < PR_MAX_MACRO_ARGS); i++)
+        {
+            /*
+             * Save argument offset within macro body. This is the mechanism
+             * used to expand the macro upon invocation.
+             *
+             * Handles multiple instances of the same argument
+             */
+            if (!strcmp (Token, Args[i].Name))
+            {
+                UseCount = Args[i].UseCount;
+
+                Args[i].Offset[UseCount] =
+                    (Token - Gbl_MainTokenBuffer) - MacroBodyOffset;
+
+                DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+                    "Macro Arg #%u: %s UseCount %u Offset %u \n",
+                    Gbl_CurrentLineNumber, i, Token,
+                    UseCount+1, Args[i].Offset[UseCount]);
+
+                Args[i].UseCount++;
+                if (Args[i].UseCount >= PR_MAX_ARG_INSTANCES)
+                {
+                    PrError (ASL_ERROR, ASL_MSG_TOO_MANY_ARGUMENTS,
+                        THIS_TOKEN_OFFSET (Token));
+
+                    goto ErrorExit;
+                }
+                break;
+            }
+        }
+
+        Token = PrGetNextToken (NULL, PR_MACRO_SEPARATORS, Next);
+    }
+
+    BodyInSource = &Gbl_CurrentLineBuffer[MacroBodyOffset];
+
+
+AddMacroToList:
+
+    /* Check if name is already defined first */
+
+    DefineInfo = PrMatchDefine (Name);
+    if (DefineInfo)
+    {
+        DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+            "#define: macro name already exists: %s\n",
+            Gbl_CurrentLineNumber, Name);
+
+        /* Error only if not exactly the same macro */
+
+        if (strcmp (DefineInfo->Body, BodyInSource) ||
+            (DefineInfo->ArgCount != ArgCount))
+        {
+            PrError (ASL_ERROR, ASL_MSG_EXISTING_NAME,
+                THIS_TOKEN_OFFSET (Name));
+        }
+
+        goto ErrorExit;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "Macro body: %s \n",
+        Gbl_CurrentLineNumber, BodyInSource);
+
+    /* Add macro to the #define list */
+
+    DefineInfo = PrAddDefine (Name, BodyInSource, FALSE);
+    if (DefineInfo)
+    {
+        Body = UtLocalCalloc (strlen (BodyInSource) + 1);
+        strcpy (Body, BodyInSource);
+
+        DefineInfo->Body = Body;
+        DefineInfo->Args = Args;
+        DefineInfo->ArgCount = ArgCount;
+    }
+
+    return;
+
+
+ErrorExit:
+    ACPI_FREE (Args);
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrDoMacroInvocation
+ *
+ * PARAMETERS:  TokenBuffer         - Current line buffer
+ *              MacroStart          - Start of the macro invocation within
+ *                                    the token buffer
+ *              DefineInfo          - Info for this macro
+ *              Next                - "Next" buffer from GetNextToken
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Expand a macro invocation
+ *
+ ******************************************************************************/
+
+void
+PrDoMacroInvocation (
+    char                    *TokenBuffer,
+    char                    *MacroStart,
+    PR_DEFINE_INFO          *DefineInfo,
+    char                    **Next)
+{
+    PR_MACRO_ARG            *Args;
+    char                    *Token = NULL;
+    UINT32                  TokenOffset;
+    UINT32                  Length;
+    UINT32                  i;
+
+
+    /* Take a copy of the macro body for expansion */
+
+    strcpy (Gbl_MacroTokenBuffer, DefineInfo->Body);
+
+    /* Replace each argument within the prototype body */
+
+    Args = DefineInfo->Args;
+    if (!Args->Name)
+    {
+        /* This macro has no arguments */
+
+        Token = PrGetNextToken (NULL, PR_MACRO_ARGUMENTS, Next);
+        if (!Token)
+        {
+            goto BadInvocation;
+        }
+
+        TokenOffset = (MacroStart - TokenBuffer);
+        Length = Token - MacroStart + strlen (Token) + 1;
+
+        PrReplaceData (
+            &Gbl_CurrentLineBuffer[TokenOffset], Length,
+            Gbl_MacroTokenBuffer, strlen (Gbl_MacroTokenBuffer));
+        return;
+    }
+
+    while (Args->Name)
+    {
+        /* Get the next argument from macro invocation */
+
+        Token = PrGetNextToken (NULL, PR_MACRO_SEPARATORS, Next);
+        if (!Token)
+        {
+            goto BadInvocation;
+        }
+
+        /* Replace all instances of this argument */
+
+        for (i = 0; i < Args->UseCount; i++)
+        {
+            /* Offset zero indicates "arg not used" */
+            /* TBD: Not really needed now, with UseCount available */
+
+            if (Args->Offset[i] == 0)
+            {
+                break;
+            }
+
+            PrReplaceData (
+                &Gbl_MacroTokenBuffer[Args->Offset[i]], strlen (Args->Name),
+                Token, strlen (Token));
+
+            DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+                "ExpandArg: %s \n",
+                Gbl_CurrentLineNumber, Gbl_MacroTokenBuffer);
+        }
+
+        Args++;
+    }
+
+    /* TBD: need to make sure macro was not invoked with too many arguments */
+
+    if (!Token)
+    {
+        return;
+    }
+
+    /* Replace the entire macro invocation with the expanded macro */
+
+    TokenOffset = (MacroStart - TokenBuffer);
+    Length = Token - MacroStart + strlen (Token) + 1;
+
+    PrReplaceData (
+        &Gbl_CurrentLineBuffer[TokenOffset], Length,
+        Gbl_MacroTokenBuffer, strlen (Gbl_MacroTokenBuffer));
+
+    return;
+
+
+BadInvocation:
+    PrError (ASL_ERROR, ASL_MSG_INVALID_INVOCATION,
+        THIS_TOKEN_OFFSET (MacroStart));
+
+    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+        "Bad macro invocation: %s \n",
+        Gbl_CurrentLineNumber, Gbl_MacroTokenBuffer);
+    return;
+}
diff --git a/usr/src/cmd/acpi/iasl/prparser.l b/usr/src/cmd/acpi/iasl/prparser.l
new file mode 100644
index 0000000000..3056699119
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/prparser.l
@@ -0,0 +1,236 @@
+%{
+/******************************************************************************
+ *
+ * Module Name: prparser.l - Flex input file for preprocessor lexer
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "prparser.y.h"
+
+/* Buffer to pass strings to the parser */
+
+#define STRING_SETUP    strcpy (StringBuffer, PrParsertext);\
+    PrParserlval.str = StringBuffer
+
+#define _COMPONENT          ACPI_COMPILER
+        ACPI_MODULE_NAME    ("prscanner")
+
+
+/* Local prototypes */
+
+static char
+PrDoCommentType1 (
+    void);
+
+static char
+PrDoCommentType2 (
+    void);
+%}
+
+%option noyywrap
+
+Number          [0-9a-fA-F]+
+HexNumber       0[xX][0-9a-fA-F]+
+WhiteSpace      [ \t\v\r]+
+NewLine         [\n]
+Identifier      [a-zA-Z][0-9a-zA-Z]*
+
+%%
+"/*"            { if (!PrDoCommentType1 ()) {yyterminate ();} }
+"//"            { if (!PrDoCommentType2 ()) {yyterminate ();} }
+
+\(              return (EXPOP_PAREN_OPEN);
+\)              return (EXPOP_PAREN_CLOSE);
+\~              return (EXPOP_ONES_COMPLIMENT);
+\!              return (EXPOP_LOGICAL_NOT);
+\*              return (EXPOP_MULTIPLY);
+\/              return (EXPOP_DIVIDE);
+\%              return (EXPOP_MODULO);
+\+              return (EXPOP_ADD);
+\-              return (EXPOP_SUBTRACT);
+">>"            return (EXPOP_SHIFT_RIGHT);
+"<<"            return (EXPOP_SHIFT_LEFT);
+\<              return (EXPOP_LESS);
+\>              return (EXPOP_GREATER);
+"<="            return (EXPOP_LESS_EQUAL);
+">="            return (EXPOP_GREATER_EQUAL);
+"=="            return (EXPOP_EQUAL);
+"!="            return (EXPOP_NOT_EQUAL);
+\&              return (EXPOP_AND);
+\^              return (EXPOP_XOR);
+\|              return (EXPOP_OR);
+"&&"            return (EXPOP_LOGICAL_AND);
+"||"            return (EXPOP_LOGICAL_OR);
+
+"defined"       return (EXPOP_DEFINE);
+{Identifier}    {STRING_SETUP; return (EXPOP_IDENTIFIER);}
+
+<<EOF>>         return (EXPOP_EOF); /* null end-of-string */
+
+{Number}        return (EXPOP_NUMBER);
+{HexNumber}     return (EXPOP_HEX_NUMBER);
+{NewLine}       return (EXPOP_NEW_LINE);
+{WhiteSpace}    /* Ignore */
+
+.               return (EXPOP_EOF);
+%%
+
+/*
+ * Local support functions
+ */
+YY_BUFFER_STATE         LexBuffer;
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrInitLexer
+ *
+ * PARAMETERS:  String              - Input string to be parsed
+ *
+ * RETURN:      TRUE if parser returns NULL. FALSE otherwise.
+ *
+ * DESCRIPTION: Initialization routine for lexer. The lexer needs
+ *              a buffer to handle strings instead of a file.
+ *
+ *****************************************************************************/
+
+int
+PrInitLexer (
+    char                    *String)
+{
+
+    LexBuffer = yy_scan_string (String);
+    return (LexBuffer == NULL);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrTerminateLexer
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Termination routine for thelexer.
+ *
+ *****************************************************************************/
+
+void
+PrTerminateLexer (
+    void)
+{
+
+    yy_delete_buffer (LexBuffer);
+}
+
+
+/********************************************************************************
+ *
+ * FUNCTION:    PrDoCommentType1
+ *
+ * PARAMETERS:  none
+ *
+ * RETURN:      none
+ *
+ * DESCRIPTION: Process a new legacy comment. Just toss it.
+ *
+ ******************************************************************************/
+
+static char
+PrDoCommentType1 (
+    void)
+{
+    int                 c;
+
+
+Loop:
+    while (((c = input ()) != '*') && (c != EOF))
+    {
+    }
+    if (c == EOF)
+    {
+        return (FALSE);
+    }
+
+    if (((c = input ()) != '/') && (c != EOF))
+    {
+        unput (c);
+        goto Loop;
+    }
+    if (c == EOF)
+    {
+        return (FALSE);
+    }
+
+    return (TRUE);
+}
+
+
+/********************************************************************************
+ *
+ * FUNCTION:    PrDoCommentType2
+ *
+ * PARAMETERS:  none
+ *
+ * RETURN:      none
+ *
+ * DESCRIPTION: Process a new "//" comment. Just toss it.
+ *
+ ******************************************************************************/
+
+static char
+PrDoCommentType2 (
+    void)
+{
+    int                 c;
+
+
+    while (((c = input ()) != '\n') && (c != EOF))
+    {
+    }
+    if (c == EOF)
+    {
+        return (FALSE);
+    }
+
+    return (TRUE);
+}
diff --git a/usr/src/cmd/acpi/iasl/prparser.y b/usr/src/cmd/acpi/iasl/prparser.y
new file mode 100644
index 0000000000..d2f84059be
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/prparser.y
@@ -0,0 +1,294 @@
+%{
+/******************************************************************************
+ *
+ * Module Name: prparser.y - Bison input file for preprocessor parser
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+#define _COMPONENT          ASL_PREPROCESSOR
+        ACPI_MODULE_NAME    ("prparser")
+
+void *                      AslLocalAllocate (unsigned int Size);
+
+/* Bison/yacc configuration */
+
+#undef alloca
+#define alloca              AslLocalAllocate
+
+int                         PrParserlex (void);
+int                         PrParserparse (void);
+void                        PrParsererror (char const *msg);
+extern char                 *PrParsertext;
+
+UINT64                      PrParserResult; /* Expression return value */
+
+/* Bison/yacc configuration */
+
+#define yytname             PrParsername
+#define YYDEBUG             1               /* Enable debug output */
+#define YYERROR_VERBOSE     1               /* Verbose error messages */
+#define YYFLAG              -32768
+
+/* Define YYMALLOC/YYFREE to prevent redefinition errors  */
+
+#define YYMALLOC            malloc
+#define YYFREE              free
+%}
+
+%union
+{
+     UINT64                 value;
+     UINT32                 op;
+     char                   *str;
+}
+
+/*! [Begin] no source code translation */
+
+%type  <value>  Expression
+
+%token <op>     EXPOP_EOF
+%token <op>     EXPOP_NEW_LINE
+%token <op>     EXPOP_NUMBER
+%token <op>     EXPOP_HEX_NUMBER
+%token <op>     EXPOP_RESERVED1
+%token <op>     EXPOP_RESERVED2
+%token <op>     EXPOP_PAREN_OPEN
+%token <op>     EXPOP_PAREN_CLOSE
+
+%left <op>      EXPOP_LOGICAL_OR
+%left <op>      EXPOP_LOGICAL_AND
+%left <op>      EXPOP_OR
+%left <op>      EXPOP_XOR
+%left <op>      EXPOP_AND
+%left <op>      EXPOP_EQUAL EXPOP_NOT_EQUAL
+%left <op>      EXPOP_GREATER EXPOP_LESS EXPOP_GREATER_EQUAL EXPOP_LESS_EQUAL
+%left <op>      EXPOP_SHIFT_RIGHT EXPOP_SHIFT_LEFT
+%left <op>      EXPOP_ADD EXPOP_SUBTRACT
+%left <op>      EXPOP_MULTIPLY EXPOP_DIVIDE EXPOP_MODULO
+%right <op>     EXPOP_ONES_COMPLIMENT EXPOP_LOGICAL_NOT
+
+/* Tokens above must be kept in synch with dtparser.y */
+
+%token <op>     EXPOP_DEFINE
+%token <op>     EXPOP_IDENTIFIER
+
+%%
+
+/*
+ *  Operator precedence rules (from K&R)
+ *
+ *  1)      ( )
+ *  2)      ! ~ (unary operators that are supported here)
+ *  3)      *   /   %
+ *  4)      +   -
+ *  5)      >>  <<
+ *  6)      <   >   <=  >=
+ *  7)      ==  !=
+ *  8)      &
+ *  9)      ^
+ *  10)     |
+ *  11)     &&
+ *  12)     ||
+ */
+
+/*! [End] no source code translation !*/
+
+Value
+    : Expression EXPOP_NEW_LINE                     { PrParserResult=$1; return 0; } /* End of line (newline) */
+    | Expression EXPOP_EOF                          { PrParserResult=$1; return 0; } /* End of string (0) */
+    ;
+
+Expression
+
+      /* Unary operators */
+
+    : EXPOP_LOGICAL_NOT         Expression          { $$ = DtDoOperator ($2, EXPOP_LOGICAL_NOT,     $2);}
+    | EXPOP_ONES_COMPLIMENT     Expression          { $$ = DtDoOperator ($2, EXPOP_ONES_COMPLIMENT, $2);}
+
+      /* Binary operators */
+
+    | Expression EXPOP_MULTIPLY         Expression  { $$ = DtDoOperator ($1, EXPOP_MULTIPLY,        $3);}
+    | Expression EXPOP_DIVIDE           Expression  { $$ = DtDoOperator ($1, EXPOP_DIVIDE,          $3);}
+    | Expression EXPOP_MODULO           Expression  { $$ = DtDoOperator ($1, EXPOP_MODULO,          $3);}
+    | Expression EXPOP_ADD              Expression  { $$ = DtDoOperator ($1, EXPOP_ADD,             $3);}
+    | Expression EXPOP_SUBTRACT         Expression  { $$ = DtDoOperator ($1, EXPOP_SUBTRACT,        $3);}
+    | Expression EXPOP_SHIFT_RIGHT      Expression  { $$ = DtDoOperator ($1, EXPOP_SHIFT_RIGHT,     $3);}
+    | Expression EXPOP_SHIFT_LEFT       Expression  { $$ = DtDoOperator ($1, EXPOP_SHIFT_LEFT,      $3);}
+    | Expression EXPOP_GREATER          Expression  { $$ = DtDoOperator ($1, EXPOP_GREATER,         $3);}
+    | Expression EXPOP_LESS             Expression  { $$ = DtDoOperator ($1, EXPOP_LESS,            $3);}
+    | Expression EXPOP_GREATER_EQUAL    Expression  { $$ = DtDoOperator ($1, EXPOP_GREATER_EQUAL,   $3);}
+    | Expression EXPOP_LESS_EQUAL       Expression  { $$ = DtDoOperator ($1, EXPOP_LESS_EQUAL,      $3);}
+    | Expression EXPOP_EQUAL            Expression  { $$ = DtDoOperator ($1, EXPOP_EQUAL,           $3);}
+    | Expression EXPOP_NOT_EQUAL        Expression  { $$ = DtDoOperator ($1, EXPOP_NOT_EQUAL,       $3);}
+    | Expression EXPOP_AND              Expression  { $$ = DtDoOperator ($1, EXPOP_AND,             $3);}
+    | Expression EXPOP_XOR              Expression  { $$ = DtDoOperator ($1, EXPOP_XOR,             $3);}
+    | Expression EXPOP_OR               Expression  { $$ = DtDoOperator ($1, EXPOP_OR,              $3);}
+    | Expression EXPOP_LOGICAL_AND      Expression  { $$ = DtDoOperator ($1, EXPOP_LOGICAL_AND,     $3);}
+    | Expression EXPOP_LOGICAL_OR       Expression  { $$ = DtDoOperator ($1, EXPOP_LOGICAL_OR,      $3);}
+
+      /* Parentheses: '(' Expression ')' */
+
+    | EXPOP_PAREN_OPEN          Expression
+        EXPOP_PAREN_CLOSE                           { $$ = $2;}
+
+      /* #if defined (ID) or #if defined ID */
+
+    | EXPOP_DEFINE EXPOP_PAREN_OPEN EXPOP_IDENTIFIER
+        EXPOP_PAREN_CLOSE                           { $$ = PrIsDefined (PrParserlval.str);}
+
+    | EXPOP_DEFINE EXPOP_IDENTIFIER                 { $$ = PrIsDefined (PrParserlval.str);}
+
+    | EXPOP_IDENTIFIER                              { $$ = PrResolveDefine (PrParserlval.str);}
+
+      /* Default base for a non-prefixed integer is 10 */
+
+    | EXPOP_NUMBER                                  { AcpiUtStrtoul64 (PrParsertext, 10, ACPI_MAX64_BYTE_WIDTH, &$$);}
+
+      /* Standard hex number (0x1234) */
+
+    | EXPOP_HEX_NUMBER                              { AcpiUtStrtoul64 (PrParsertext, 16, ACPI_MAX64_BYTE_WIDTH, &$$);}
+    ;
+%%
+
+/*
+ * Local support functions, including parser entry point
+ */
+#define PR_FIRST_PARSE_OPCODE   EXPOP_EOF
+#define PR_YYTNAME_START        3
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrParsererror
+ *
+ * PARAMETERS:  Message             - Parser-generated error message
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Handler for parser errors
+ *
+ *****************************************************************************/
+
+void
+PrParsererror (
+    char const              *Message)
+{
+
+    sprintf (StringBuffer, "Preprocessor Parser : %s (near line %u)",
+        Message, Gbl_CurrentLineNumber);
+    DtError (ASL_ERROR, ASL_MSG_SYNTAX,
+        NULL, (char *) StringBuffer);
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrGetOpName
+ *
+ * PARAMETERS:  ParseOpcode         - Parser token (EXPOP_*)
+ *
+ * RETURN:      Pointer to the opcode name
+ *
+ * DESCRIPTION: Get the ascii name of the parse opcode for debug output
+ *
+ *****************************************************************************/
+
+char *
+PrGetOpName (
+    UINT32                  ParseOpcode)
+{
+#ifdef ASL_YYTNAME_START
+    /*
+     * First entries (PR_YYTNAME_START) in yytname are special reserved names.
+     * Ignore first 6 characters of name (EXPOP_)
+     */
+    return ((char *) yytname
+        [(ParseOpcode - PR_FIRST_PARSE_OPCODE) + PR_YYTNAME_START] + 6);
+#else
+    return ("[Unknown parser generator]");
+#endif
+}
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrEvaluateExpression
+ *
+ * PARAMETERS:  ExprString          - Expression to be evaluated. Must be
+ *                                    terminated by either a newline or a NUL
+ *                                    string terminator
+ *
+ * RETURN:      64-bit value for the expression
+ *
+ * DESCRIPTION: Main entry point for the DT expression parser
+ *
+ *****************************************************************************/
+
+UINT64
+PrEvaluateExpression (
+    char                    *ExprString)
+{
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "**** Input expression: %s\n", ExprString);
+
+    /* Point lexer to the input string */
+
+    if (PrInitLexer (ExprString))
+    {
+        DtError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL,
+            NULL, "Could not initialize lexer");
+        return (0);
+    }
+
+    /* Parse/Evaluate the input string (value returned in PrParserResult) */
+
+    PrParserparse ();
+    PrTerminateLexer ();
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "**** Parser returned value: %u (%8.8X%8.8X)\n",
+        (UINT32) PrParserResult, ACPI_FORMAT_UINT64 (PrParserResult));
+
+    return (PrParserResult);
+}
diff --git a/usr/src/cmd/acpi/iasl/prscan.c b/usr/src/cmd/acpi/iasl/prscan.c
new file mode 100644
index 0000000000..b24b319979
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/prscan.c
@@ -0,0 +1,1267 @@
+/******************************************************************************
+ *
+ * Module Name: prscan - Preprocessor start-up and file scan module
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#define _DECLARE_PR_GLOBALS
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+/*
+ * TBDs:
+ *
+ * No nested macros, maybe never
+ * Implement ASL "Include" as well as "#include" here?
+ */
+#define _COMPONENT          ASL_PREPROCESSOR
+        ACPI_MODULE_NAME    ("prscan")
+
+
+/* Local prototypes */
+
+static void
+PrPreprocessInputFile (
+    void);
+
+static void
+PrDoDirective (
+    char                    *DirectiveToken,
+    char                    **Next);
+
+static void
+PrGetNextLineInit (
+    void);
+
+static UINT32
+PrGetNextLine (
+    FILE                    *Handle);
+
+static int
+PrMatchDirective (
+    char                    *Directive);
+
+static void
+PrPushDirective (
+    int                     Directive,
+    char                    *Argument);
+
+static ACPI_STATUS
+PrPopDirective (
+    void);
+
+static void
+PrDbgPrint (
+    char                    *Action,
+    char                    *DirectiveName);
+
+static void
+PrDoIncludeBuffer (
+    char                    *Pathname,
+    char                    *BufferName);
+
+static void
+PrDoIncludeFile (
+    char                    *Pathname);
+
+
+/*
+ * Supported preprocessor directives
+ * Each entry is of the form "Name, ArgumentCount"
+ */
+static const PR_DIRECTIVE_INFO      Gbl_DirectiveInfo[] =
+{
+    {"define",          1},
+    {"elif",            0}, /* Converted to #else..#if internally */
+    {"else",            0},
+    {"endif",           0},
+    {"error",           1},
+    {"if",              1},
+    {"ifdef",           1},
+    {"ifndef",          1},
+    {"include",         0}, /* Argument is not standard format, so just use 0 here */
+    {"includebuffer",   0}, /* Argument is not standard format, so just use 0 here */
+    {"line",            1},
+    {"pragma",          1},
+    {"undef",           1},
+    {"warning",         1},
+    {NULL,              0}
+};
+
+/* This table must match ordering of above table exactly */
+
+enum Gbl_DirectiveIndexes
+{
+    PR_DIRECTIVE_DEFINE = 0,
+    PR_DIRECTIVE_ELIF,
+    PR_DIRECTIVE_ELSE,
+    PR_DIRECTIVE_ENDIF,
+    PR_DIRECTIVE_ERROR,
+    PR_DIRECTIVE_IF,
+    PR_DIRECTIVE_IFDEF,
+    PR_DIRECTIVE_IFNDEF,
+    PR_DIRECTIVE_INCLUDE,
+    PR_DIRECTIVE_INCLUDEBUFFER,
+    PR_DIRECTIVE_LINE,
+    PR_DIRECTIVE_PRAGMA,
+    PR_DIRECTIVE_UNDEF,
+    PR_DIRECTIVE_WARNING
+};
+
+#define ASL_DIRECTIVE_NOT_FOUND     -1
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrInitializePreprocessor
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Startup initialization for the Preprocessor.
+ *
+ ******************************************************************************/
+
+void
+PrInitializePreprocessor (
+    void)
+{
+    /* Init globals and the list of #defines */
+
+    PrInitializeGlobals ();
+    Gbl_DefineList = NULL;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrInitializeGlobals
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Initialize globals for the Preprocessor. Used for startuup
+ *              initialization and re-initialization between compiles during
+ *              a multiple source file compile.
+ *
+ ******************************************************************************/
+
+void
+PrInitializeGlobals (
+    void)
+{
+    /* Init globals */
+
+    Gbl_InputFileList = NULL;
+    Gbl_CurrentLineNumber = 1;
+    Gbl_PreprocessorLineNumber = 1;
+    Gbl_PreprocessorError = FALSE;
+
+    /* These are used to track #if/#else blocks (possibly nested) */
+
+    Gbl_IfDepth = 0;
+    Gbl_IgnoringThisCodeBlock = FALSE;
+    Gbl_DirectiveStack = NULL;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrTerminatePreprocessor
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Termination of the preprocessor. Delete lists. Keep any
+ *              defines that were specified on the command line, in order to
+ *              support multiple compiles with a single compiler invocation.
+ *
+ ******************************************************************************/
+
+void
+PrTerminatePreprocessor (
+    void)
+{
+    PR_DEFINE_INFO          *DefineInfo;
+
+
+    /*
+     * The persistent defines (created on the command line) are always at the
+     * end of the list. We save them.
+     */
+    while ((Gbl_DefineList) && (!Gbl_DefineList->Persist))
+    {
+        DefineInfo = Gbl_DefineList;
+        Gbl_DefineList = DefineInfo->Next;
+
+        ACPI_FREE (DefineInfo->Replacement);
+        ACPI_FREE (DefineInfo->Identifier);
+        ACPI_FREE (DefineInfo);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrDoPreprocess
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Main entry point for the iASL Preprocessor. Input file must
+ *              be already open. Handles multiple input files via the
+ *              #include directive.
+ *
+ ******************************************************************************/
+
+void
+PrDoPreprocess (
+    void)
+{
+    BOOLEAN                 MoreInputFiles;
+
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "Starting preprocessing phase\n\n");
+
+
+    FlSeekFile (ASL_FILE_INPUT, 0);
+    PrDumpPredefinedNames ();
+
+    /* Main preprocessor loop, handles include files */
+
+    do
+    {
+        PrPreprocessInputFile ();
+        MoreInputFiles = PrPopInputFileStack ();
+
+    } while (MoreInputFiles);
+
+    /* Point compiler input to the new preprocessor output file (.pre) */
+
+    FlCloseFile (ASL_FILE_INPUT);
+    Gbl_Files[ASL_FILE_INPUT].Handle = Gbl_Files[ASL_FILE_PREPROCESSOR].Handle;
+    AslCompilerin = Gbl_Files[ASL_FILE_INPUT].Handle;
+
+    /* Reset globals to allow compiler to run */
+
+    FlSeekFile (ASL_FILE_INPUT, 0);
+    if (!Gbl_PreprocessOnly)
+    {
+        Gbl_CurrentLineNumber = 0;
+    }
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "Preprocessing phase complete \n\n");
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrPreprocessInputFile
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Preprocess one entire file, line-by-line.
+ *
+ * Input:  Raw user ASL from ASL_FILE_INPUT
+ * Output: Preprocessed file written to ASL_FILE_PREPROCESSOR and
+ *         (optionally) ASL_FILE_PREPROCESSOR_USER
+ *
+ ******************************************************************************/
+
+static void
+PrPreprocessInputFile (
+    void)
+{
+    UINT32                  Status;
+    char                    *Token;
+    char                    *ReplaceString;
+    PR_DEFINE_INFO          *DefineInfo;
+    ACPI_SIZE               TokenOffset;
+    char                    *Next;
+    int                     OffsetAdjust;
+
+
+    PrGetNextLineInit ();
+
+    /* Scan source line-by-line and process directives. Then write the .i file */
+
+    while ((Status = PrGetNextLine (Gbl_Files[ASL_FILE_INPUT].Handle)) != ASL_EOF)
+    {
+        Gbl_CurrentLineNumber++;
+        Gbl_LogicalLineNumber++;
+
+        if (Status == ASL_IGNORE_LINE)
+        {
+            goto WriteEntireLine;
+        }
+
+        /* Need a copy of the input line for strok() */
+
+        strcpy (Gbl_MainTokenBuffer, Gbl_CurrentLineBuffer);
+        Token = PrGetNextToken (Gbl_MainTokenBuffer, PR_TOKEN_SEPARATORS, &Next);
+        OffsetAdjust = 0;
+
+        /* All preprocessor directives must begin with '#' */
+
+        if (Token && (*Token == '#'))
+        {
+            if (strlen (Token) == 1)
+            {
+                Token = PrGetNextToken (NULL, PR_TOKEN_SEPARATORS, &Next);
+            }
+            else
+            {
+                Token++;    /* Skip leading # */
+            }
+
+            /* Execute the directive, do not write line to output file */
+
+            PrDoDirective (Token, &Next);
+            continue;
+        }
+
+        /*
+         * If we are currently within the part of an IF/ELSE block that is
+         * FALSE, ignore the line and do not write it to the output file.
+         * This continues until an #else or #endif is encountered.
+         */
+        if (Gbl_IgnoringThisCodeBlock)
+        {
+            continue;
+        }
+
+        /* Match and replace all #defined names within this source line */
+
+        while (Token)
+        {
+            DefineInfo = PrMatchDefine (Token);
+            if (DefineInfo)
+            {
+                if (DefineInfo->Body)
+                {
+                    /* This is a macro */
+
+                    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+                        "Matched Macro: %s->%s\n",
+                        Gbl_CurrentLineNumber, DefineInfo->Identifier,
+                        DefineInfo->Replacement);
+
+                    PrDoMacroInvocation (Gbl_MainTokenBuffer, Token,
+                        DefineInfo, &Next);
+                }
+                else
+                {
+                    ReplaceString = DefineInfo->Replacement;
+
+                    /* Replace the name in the original line buffer */
+
+                    TokenOffset = Token - Gbl_MainTokenBuffer + OffsetAdjust;
+                    PrReplaceData (
+                        &Gbl_CurrentLineBuffer[TokenOffset], strlen (Token),
+                        ReplaceString, strlen (ReplaceString));
+
+                    /* Adjust for length difference between old and new name length */
+
+                    OffsetAdjust += strlen (ReplaceString) - strlen (Token);
+
+                    DbgPrint (ASL_DEBUG_OUTPUT, PR_PREFIX_ID
+                        "Matched #define: %s->%s\n",
+                        Gbl_CurrentLineNumber, Token,
+                        *ReplaceString ? ReplaceString : "(NULL STRING)");
+                }
+            }
+
+            Token = PrGetNextToken (NULL, PR_TOKEN_SEPARATORS, &Next);
+        }
+
+        Gbl_PreprocessorLineNumber++;
+
+
+WriteEntireLine:
+        /*
+         * Now we can write the possibly modified source line to the
+         * preprocessor file(s).
+         */
+        FlWriteFile (ASL_FILE_PREPROCESSOR, Gbl_CurrentLineBuffer,
+            strlen (Gbl_CurrentLineBuffer));
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrDoDirective
+ *
+ * PARAMETERS:  Directive               - Pointer to directive name token
+ *              Next                    - "Next" buffer from GetNextToken
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Main processing for all preprocessor directives
+ *
+ ******************************************************************************/
+
+static void
+PrDoDirective (
+    char                    *DirectiveToken,
+    char                    **Next)
+{
+    char                    *Token = Gbl_MainTokenBuffer;
+    char                    *Token2 = NULL;
+    char                    *End;
+    UINT64                  Value;
+    ACPI_SIZE               TokenOffset;
+    int                     Directive;
+    ACPI_STATUS             Status;
+
+
+    if (!DirectiveToken)
+    {
+        goto SyntaxError;
+    }
+
+    Directive = PrMatchDirective (DirectiveToken);
+    if (Directive == ASL_DIRECTIVE_NOT_FOUND)
+    {
+        PrError (ASL_ERROR, ASL_MSG_UNKNOWN_DIRECTIVE,
+            THIS_TOKEN_OFFSET (DirectiveToken));
+
+        DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+            "#%s: Unknown directive\n",
+            Gbl_CurrentLineNumber, DirectiveToken);
+        return;
+    }
+
+    /*
+     * Emit a line directive into the preprocessor file (.pre) after
+     * every matched directive. This is passed through to the compiler
+     * so that error/warning messages are kept in sync with the
+     * original source file.
+     */
+    FlPrintFile (ASL_FILE_PREPROCESSOR, "#line %u \"%s\" // #%s\n",
+        Gbl_CurrentLineNumber, Gbl_Files[ASL_FILE_INPUT].Filename,
+        Gbl_DirectiveInfo[Directive].Name);
+
+    /*
+     * If we are currently ignoring this block and we encounter a #else or
+     * #elif, we must ignore their blocks also if the parent block is also
+     * being ignored.
+     */
+    if (Gbl_IgnoringThisCodeBlock)
+    {
+        switch (Directive)
+        {
+        case PR_DIRECTIVE_ELSE:
+        case PR_DIRECTIVE_ELIF:
+
+            if (Gbl_DirectiveStack &&
+                Gbl_DirectiveStack->IgnoringThisCodeBlock)
+            {
+                PrDbgPrint ("Ignoring", Gbl_DirectiveInfo[Directive].Name);
+                return;
+            }
+            break;
+
+        default:
+            break;
+        }
+    }
+
+    /*
+     * Need to always check for #else, #elif, #endif regardless of
+     * whether we are ignoring the current code block, since these
+     * are conditional code block terminators.
+     */
+    switch (Directive)
+    {
+    case PR_DIRECTIVE_ELSE:
+
+        Gbl_IgnoringThisCodeBlock = !(Gbl_IgnoringThisCodeBlock);
+        PrDbgPrint ("Executing", "else block");
+        return;
+
+    case PR_DIRECTIVE_ELIF:
+
+        Gbl_IgnoringThisCodeBlock = !(Gbl_IgnoringThisCodeBlock);
+        Directive = PR_DIRECTIVE_IF;
+
+        if (Gbl_IgnoringThisCodeBlock == TRUE)
+        {
+            /* Not executing the ELSE part -- all done here */
+            PrDbgPrint ("Ignoring", "elif block");
+            return;
+        }
+
+        /*
+         * After this, we will execute the IF part further below.
+         * First, however, pop off the original #if directive.
+         */
+        if (ACPI_FAILURE (PrPopDirective ()))
+        {
+            PrError (ASL_ERROR, ASL_MSG_COMPILER_INTERNAL,
+                THIS_TOKEN_OFFSET (DirectiveToken));
+        }
+
+        PrDbgPrint ("Executing", "elif block");
+        break;
+
+    case PR_DIRECTIVE_ENDIF:
+
+        PrDbgPrint ("Executing", "endif");
+
+        /* Pop the owning #if/#ifdef/#ifndef */
+
+        if (ACPI_FAILURE (PrPopDirective ()))
+        {
+            PrError (ASL_ERROR, ASL_MSG_ENDIF_MISMATCH,
+                THIS_TOKEN_OFFSET (DirectiveToken));
+        }
+        return;
+
+    default:
+        break;
+    }
+
+    /* Most directives have at least one argument */
+
+    if (Gbl_DirectiveInfo[Directive].ArgCount >= 1)
+    {
+        Token = PrGetNextToken (NULL, PR_TOKEN_SEPARATORS, Next);
+        if (!Token)
+        {
+            goto SyntaxError;
+        }
+    }
+
+    if (Gbl_DirectiveInfo[Directive].ArgCount >= 2)
+    {
+        Token2 = PrGetNextToken (NULL, PR_TOKEN_SEPARATORS, Next);
+        if (!Token2)
+        {
+            goto SyntaxError;
+        }
+    }
+
+    /*
+     * At this point, if we are ignoring the current code block,
+     * do not process any more directives (i.e., ignore them also.)
+     * For "if" style directives, open/push a new block anyway. We
+     * must do this to keep track of #endif directives
+     */
+    if (Gbl_IgnoringThisCodeBlock)
+    {
+        switch (Directive)
+        {
+        case PR_DIRECTIVE_IF:
+        case PR_DIRECTIVE_IFDEF:
+        case PR_DIRECTIVE_IFNDEF:
+
+            PrPushDirective (Directive, Token);
+            PrDbgPrint ("Ignoring", Gbl_DirectiveInfo[Directive].Name);
+            break;
+
+        default:
+            break;
+        }
+
+        return;
+    }
+
+    /*
+     * Execute the directive
+     */
+    PrDbgPrint ("Begin execution", Gbl_DirectiveInfo[Directive].Name);
+
+    switch (Directive)
+    {
+    case PR_DIRECTIVE_IF:
+
+        TokenOffset = Token - Gbl_MainTokenBuffer;
+
+        /* Need to expand #define macros in the expression string first */
+
+        Status = PrResolveIntegerExpression (
+            &Gbl_CurrentLineBuffer[TokenOffset-1], &Value);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        PrPushDirective (Directive, Token);
+        if (!Value)
+        {
+            Gbl_IgnoringThisCodeBlock = TRUE;
+        }
+
+        DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+            "Resolved #if: %8.8X%8.8X %s\n",
+            Gbl_CurrentLineNumber, ACPI_FORMAT_UINT64 (Value),
+            Gbl_IgnoringThisCodeBlock ? "<Skipping Block>" : "<Executing Block>");
+        break;
+
+    case PR_DIRECTIVE_IFDEF:
+
+        PrPushDirective (Directive, Token);
+        if (!PrMatchDefine (Token))
+        {
+            Gbl_IgnoringThisCodeBlock = TRUE;
+        }
+
+        PrDbgPrint ("Evaluated", "ifdef");
+        break;
+
+    case PR_DIRECTIVE_IFNDEF:
+
+        PrPushDirective (Directive, Token);
+        if (PrMatchDefine (Token))
+        {
+            Gbl_IgnoringThisCodeBlock = TRUE;
+        }
+
+        PrDbgPrint ("Evaluated", "ifndef");
+        break;
+
+    case PR_DIRECTIVE_DEFINE:
+        /*
+         * By definition, if first char after the name is a paren,
+         * this is a function macro.
+         */
+        TokenOffset = Token - Gbl_MainTokenBuffer + strlen (Token);
+        if (*(&Gbl_CurrentLineBuffer[TokenOffset]) == '(')
+        {
+#ifndef MACROS_SUPPORTED
+            AcpiOsPrintf (
+                "%s ERROR - line %u: #define macros are not supported yet\n",
+                Gbl_CurrentLineBuffer, Gbl_LogicalLineNumber);
+            exit(1);
+#else
+            PrAddMacro (Token, Next);
+#endif
+        }
+        else
+        {
+            /* Use the remainder of the line for the #define */
+
+            Token2 = *Next;
+            if (Token2)
+            {
+                while ((*Token2 == ' ') || (*Token2 == '\t'))
+                {
+                    Token2++;
+                }
+
+                End = Token2;
+                while (*End != '\n')
+                {
+                    End++;
+                }
+
+                *End = 0;
+            }
+            else
+            {
+                Token2 = "";
+            }
+#if 0
+            Token2 = PrGetNextToken (NULL, "\n", /*PR_TOKEN_SEPARATORS,*/ Next);
+            if (!Token2)
+            {
+                Token2 = "";
+            }
+#endif
+            DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+                "New #define: %s->%s\n",
+                Gbl_LogicalLineNumber, Token, Token2);
+
+            PrAddDefine (Token, Token2, FALSE);
+        }
+        break;
+
+    case PR_DIRECTIVE_ERROR:
+
+        /* Note: No macro expansion */
+
+        PrError (ASL_ERROR, ASL_MSG_ERROR_DIRECTIVE,
+            THIS_TOKEN_OFFSET (Token));
+
+        Gbl_SourceLine = 0;
+        Gbl_NextError = Gbl_ErrorLog;
+        CmCleanupAndExit ();
+        exit(1);
+
+    case PR_DIRECTIVE_INCLUDE:
+
+        Token = PrGetNextToken (NULL, " \"<>", Next);
+        if (!Token)
+        {
+            goto SyntaxError;
+        }
+
+        DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+            "Start #include file \"%s\"\n", Gbl_CurrentLineNumber,
+            Token, Gbl_CurrentLineNumber);
+
+        PrDoIncludeFile (Token);
+        break;
+
+    case PR_DIRECTIVE_INCLUDEBUFFER:
+
+        Token = PrGetNextToken (NULL, " \"<>", Next);
+        if (!Token)
+        {
+            goto SyntaxError;
+        }
+
+        Token2 = PrGetNextToken (NULL, PR_TOKEN_SEPARATORS, Next);
+        if (!Token2)
+        {
+            goto SyntaxError;
+        }
+
+        DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+            "Start #includebuffer input from file \"%s\", buffer name %s\n",
+            Gbl_CurrentLineNumber, Token, Token2);
+
+        PrDoIncludeBuffer (Token, Token2);
+        break;
+
+    case PR_DIRECTIVE_LINE:
+
+        TokenOffset = Token - Gbl_MainTokenBuffer;
+
+        Status = PrResolveIntegerExpression (
+            &Gbl_CurrentLineBuffer[TokenOffset-1], &Value);
+        if (ACPI_FAILURE (Status))
+        {
+            return;
+        }
+
+        DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+            "User #line invocation %s\n", Gbl_CurrentLineNumber,
+            Token);
+
+        Gbl_CurrentLineNumber = (UINT32) Value;
+
+        /* Emit #line into the preprocessor file */
+
+        FlPrintFile (ASL_FILE_PREPROCESSOR, "#line %u \"%s\"\n",
+            Gbl_CurrentLineNumber, Gbl_Files[ASL_FILE_INPUT].Filename);
+        break;
+
+    case PR_DIRECTIVE_PRAGMA:
+
+        if (!strcmp (Token, "disable"))
+        {
+            Token = PrGetNextToken (NULL, PR_TOKEN_SEPARATORS, Next);
+            if (!Token)
+            {
+                goto SyntaxError;
+            }
+
+            TokenOffset = Token - Gbl_MainTokenBuffer;
+            AslDisableException (&Gbl_CurrentLineBuffer[TokenOffset]);
+        }
+        else if (!strcmp (Token, "message"))
+        {
+            Token = PrGetNextToken (NULL, PR_TOKEN_SEPARATORS, Next);
+            if (!Token)
+            {
+                goto SyntaxError;
+            }
+
+            TokenOffset = Token - Gbl_MainTokenBuffer;
+            AcpiOsPrintf ("%s\n", &Gbl_CurrentLineBuffer[TokenOffset]);
+        }
+        else
+        {
+            PrError (ASL_ERROR, ASL_MSG_UNKNOWN_PRAGMA,
+                THIS_TOKEN_OFFSET (Token));
+            return;
+        }
+
+        break;
+
+    case PR_DIRECTIVE_UNDEF:
+
+        DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+            "#undef: %s\n", Gbl_CurrentLineNumber, Token);
+
+        PrRemoveDefine (Token);
+        break;
+
+    case PR_DIRECTIVE_WARNING:
+
+        PrError (ASL_WARNING, ASL_MSG_WARNING_DIRECTIVE,
+            THIS_TOKEN_OFFSET (Token));
+
+        Gbl_SourceLine = 0;
+        Gbl_NextError = Gbl_ErrorLog;
+        break;
+
+    default:
+
+        /* Should never get here */
+        DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+            "Unrecognized directive: %u\n",
+            Gbl_CurrentLineNumber, Directive);
+        break;
+    }
+
+    return;
+
+SyntaxError:
+
+    PrError (ASL_ERROR, ASL_MSG_DIRECTIVE_SYNTAX,
+        THIS_TOKEN_OFFSET (DirectiveToken));
+    return;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrGetNextLine, PrGetNextLineInit
+ *
+ * PARAMETERS:  Handle              - Open file handle for the source file
+ *
+ * RETURN:      Status of the GetLine operation:
+ *              AE_OK               - Normal line, OK status
+ *              ASL_IGNORE_LINE     - Line is blank or part of a multi-line
+ *                                      comment
+ *              ASL_EOF             - End-of-file reached
+ *
+ * DESCRIPTION: Get the next text line from the input file. Does not strip
+ *              comments.
+ *
+ ******************************************************************************/
+
+#define PR_NORMAL_TEXT          0
+#define PR_MULTI_LINE_COMMENT   1
+#define PR_SINGLE_LINE_COMMENT  2
+#define PR_QUOTED_STRING        3
+
+static UINT8                    AcpiGbl_LineScanState = PR_NORMAL_TEXT;
+
+static void
+PrGetNextLineInit (
+    void)
+{
+    AcpiGbl_LineScanState = 0;
+}
+
+static UINT32
+PrGetNextLine (
+    FILE                    *Handle)
+{
+    UINT32                  i;
+    int                     c = 0;
+    int                     PreviousChar;
+
+
+    /* Always clear the global line buffer */
+
+    memset (Gbl_CurrentLineBuffer, 0, Gbl_LineBufferSize);
+    for (i = 0; ;)
+    {
+        /*
+         * If line is too long, expand the line buffers. Also increases
+         * Gbl_LineBufferSize.
+         */
+        if (i >= Gbl_LineBufferSize)
+        {
+            UtExpandLineBuffers ();
+        }
+
+        PreviousChar = c;
+        c = getc (Handle);
+        if (c == EOF)
+        {
+            /*
+             * On EOF: If there is anything in the line buffer, terminate
+             * it with a newline, and catch the EOF on the next call
+             * to this function.
+             */
+            if (i > 0)
+            {
+                Gbl_CurrentLineBuffer[i] = '\n';
+                return (AE_OK);
+            }
+
+            return (ASL_EOF);
+        }
+
+        /* Update state machine as necessary */
+
+        switch (AcpiGbl_LineScanState)
+        {
+        case PR_NORMAL_TEXT:
+
+            /* Check for multi-line comment start */
+
+            if ((PreviousChar == '/') && (c == '*'))
+            {
+                AcpiGbl_LineScanState = PR_MULTI_LINE_COMMENT;
+            }
+
+            /* Check for single-line comment start */
+
+            else if ((PreviousChar == '/') && (c == '/'))
+            {
+                AcpiGbl_LineScanState = PR_SINGLE_LINE_COMMENT;
+            }
+
+            /* Check for quoted string start */
+
+            else if (PreviousChar == '"')
+            {
+                AcpiGbl_LineScanState = PR_QUOTED_STRING;
+            }
+            break;
+
+        case PR_QUOTED_STRING:
+
+            if (PreviousChar == '"')
+            {
+                AcpiGbl_LineScanState = PR_NORMAL_TEXT;
+            }
+            break;
+
+        case PR_MULTI_LINE_COMMENT:
+
+            /* Check for multi-line comment end */
+
+            if ((PreviousChar == '*') && (c == '/'))
+            {
+                AcpiGbl_LineScanState = PR_NORMAL_TEXT;
+            }
+            break;
+
+        case PR_SINGLE_LINE_COMMENT: /* Just ignore text until EOL */
+        default:
+            break;
+        }
+
+        /* Always copy the character into line buffer */
+
+        Gbl_CurrentLineBuffer[i] = (char) c;
+        i++;
+
+        /* Always exit on end-of-line */
+
+        if (c == '\n')
+        {
+            /* Handle multi-line comments */
+
+            if (AcpiGbl_LineScanState == PR_MULTI_LINE_COMMENT)
+            {
+                return (ASL_IGNORE_LINE);
+            }
+
+            /* End of single-line comment */
+
+            if (AcpiGbl_LineScanState == PR_SINGLE_LINE_COMMENT)
+            {
+                AcpiGbl_LineScanState = PR_NORMAL_TEXT;
+                return (AE_OK);
+            }
+
+            /* Blank line */
+
+            if (i == 1)
+            {
+                return (ASL_IGNORE_LINE);
+            }
+
+            return (AE_OK);
+        }
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrMatchDirective
+ *
+ * PARAMETERS:  Directive           - Pointer to directive name token
+ *
+ * RETURN:      Index into command array, -1 if not found
+ *
+ * DESCRIPTION: Lookup the incoming directive in the known directives table.
+ *
+ ******************************************************************************/
+
+static int
+PrMatchDirective (
+    char                    *Directive)
+{
+    int                     i;
+
+
+    if (!Directive || Directive[0] == 0)
+    {
+        return (ASL_DIRECTIVE_NOT_FOUND);
+    }
+
+    for (i = 0; Gbl_DirectiveInfo[i].Name; i++)
+    {
+        if (!strcmp (Gbl_DirectiveInfo[i].Name, Directive))
+        {
+            return (i);
+        }
+    }
+
+    return (ASL_DIRECTIVE_NOT_FOUND);    /* Command not recognized */
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrPushDirective
+ *
+ * PARAMETERS:  Directive           - Encoded directive ID
+ *              Argument            - String containing argument to the
+ *                                    directive
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Push an item onto the directive stack. Used for processing
+ *              nested #if/#else type conditional compilation directives.
+ *              Specifically: Used on detection of #if/#ifdef/#ifndef to open
+ *              a block.
+ *
+ ******************************************************************************/
+
+static void
+PrPushDirective (
+    int                     Directive,
+    char                    *Argument)
+{
+    DIRECTIVE_INFO          *Info;
+
+
+    /* Allocate and populate a stack info item */
+
+    Info = ACPI_ALLOCATE (sizeof (DIRECTIVE_INFO));
+
+    Info->Next = Gbl_DirectiveStack;
+    Info->Directive = Directive;
+    Info->IgnoringThisCodeBlock = Gbl_IgnoringThisCodeBlock;
+    strncpy (Info->Argument, Argument, MAX_ARGUMENT_LENGTH);
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "Pr(%.4u) - [%u %s] %*s Pushed [#%s %s]: IgnoreFlag = %s\n",
+        Gbl_CurrentLineNumber, Gbl_IfDepth,
+        Gbl_IgnoringThisCodeBlock ? "I" : "E",
+        Gbl_IfDepth * 4, " ",
+        Gbl_DirectiveInfo[Directive].Name,
+        Argument, Gbl_IgnoringThisCodeBlock ? "TRUE" : "FALSE");
+
+    /* Push new item */
+
+    Gbl_DirectiveStack = Info;
+    Gbl_IfDepth++;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrPopDirective
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status. Error if the stack is empty.
+ *
+ * DESCRIPTION: Pop an item off the directive stack. Used for processing
+ *              nested #if/#else type conditional compilation directives.
+ *              Specifically: Used on detection of #elif and #endif to remove
+ *              the original #if/#ifdef/#ifndef from the stack and close
+ *              the block.
+ *
+ ******************************************************************************/
+
+static ACPI_STATUS
+PrPopDirective (
+    void)
+{
+    DIRECTIVE_INFO          *Info;
+
+
+    /* Check for empty stack */
+
+    Info = Gbl_DirectiveStack;
+    if (!Info)
+    {
+        return (AE_ERROR);
+    }
+
+    /* Pop one item, keep globals up-to-date */
+
+    Gbl_IfDepth--;
+    Gbl_IgnoringThisCodeBlock = Info->IgnoringThisCodeBlock;
+    Gbl_DirectiveStack = Info->Next;
+
+    DbgPrint (ASL_DEBUG_OUTPUT,
+        "Pr(%.4u) - [%u %s] %*s Popped [#%s %s]: IgnoreFlag now = %s\n",
+        Gbl_CurrentLineNumber, Gbl_IfDepth,
+        Gbl_IgnoringThisCodeBlock ? "I" : "E",
+        Gbl_IfDepth * 4, " ",
+        Gbl_DirectiveInfo[Info->Directive].Name,
+        Info->Argument, Gbl_IgnoringThisCodeBlock ? "TRUE" : "FALSE");
+
+    ACPI_FREE (Info);
+    return (AE_OK);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrDbgPrint
+ *
+ * PARAMETERS:  Action              - Action being performed
+ *              DirectiveName       - Directive being processed
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Special debug print for directive processing.
+ *
+ ******************************************************************************/
+
+static void
+PrDbgPrint (
+    char                    *Action,
+    char                    *DirectiveName)
+{
+
+    DbgPrint (ASL_DEBUG_OUTPUT, "Pr(%.4u) - [%u %s] "
+        "%*s %s #%s, IfDepth %u\n",
+        Gbl_CurrentLineNumber, Gbl_IfDepth,
+        Gbl_IgnoringThisCodeBlock ? "I" : "E",
+        Gbl_IfDepth * 4, " ",
+        Action, DirectiveName, Gbl_IfDepth);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrDoIncludeFile
+ *
+ * PARAMETERS:  Pathname                - Name of the input file
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Open an include file, from #include.
+ *
+ ******************************************************************************/
+
+static void
+PrDoIncludeFile (
+    char                    *Pathname)
+{
+    char                    *FullPathname;
+
+
+    (void) PrOpenIncludeFile (Pathname, "r", &FullPathname);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrDoIncludeBuffer
+ *
+ * PARAMETERS:  Pathname                - Name of the input binary file
+ *              BufferName              - ACPI namepath of the buffer
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Create an ACPI buffer object from a binary file. The contents
+ *              of the file are emitted into the buffer object as ascii
+ *              hex data. From #includebuffer.
+ *
+ ******************************************************************************/
+
+static void
+PrDoIncludeBuffer (
+    char                    *Pathname,
+    char                    *BufferName)
+{
+    char                    *FullPathname;
+    FILE                    *BinaryBufferFile;
+    UINT32                  i = 0;
+    UINT8                   c;
+
+
+    BinaryBufferFile = PrOpenIncludeFile (Pathname, "rb", &FullPathname);
+    if (!BinaryBufferFile)
+    {
+        return;
+    }
+
+    /* Emit "Name (XXXX, Buffer() {" header */
+
+    FlPrintFile (ASL_FILE_PREPROCESSOR, "Name (%s, Buffer()\n{", BufferName);
+
+    /* Dump the entire file in ascii hex format */
+
+    while (fread (&c, 1, 1, BinaryBufferFile))
+    {
+        if (!(i % 8))
+        {
+            FlPrintFile (ASL_FILE_PREPROCESSOR, "\n   ", c);
+        }
+
+        FlPrintFile (ASL_FILE_PREPROCESSOR, " 0x%2.2X,", c);
+        i++;
+    }
+
+    DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+        "#includebuffer: read %u bytes from %s\n",
+        Gbl_CurrentLineNumber, i, FullPathname);
+
+    /* Close the Name() operator */
+
+    FlPrintFile (ASL_FILE_PREPROCESSOR, "\n})\n", BufferName);
+    fclose (BinaryBufferFile);
+}
diff --git a/usr/src/cmd/acpi/iasl/prutils.c b/usr/src/cmd/acpi/iasl/prutils.c
new file mode 100644
index 0000000000..ec9bf6664f
--- /dev/null
+++ b/usr/src/cmd/acpi/iasl/prutils.c
@@ -0,0 +1,476 @@
+/******************************************************************************
+ *
+ * Module Name: prutils - Preprocessor utilities
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2016, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include "aslcompiler.h"
+#include "dtcompiler.h"
+
+
+#define _COMPONENT          ASL_PREPROCESSOR
+        ACPI_MODULE_NAME    ("prutils")
+
+
+/******************************************************************************
+ *
+ * FUNCTION:    PrGetNextToken
+ *
+ * PARAMETERS:  Buffer              - Current line buffer
+ *              MatchString         - String with valid token delimiters
+ *              Next                - Set to next possible token in buffer
+ *
+ * RETURN:      Next token (null-terminated). Modifies the input line.
+ *              Remainder of line is stored in *Next.
+ *
+ * DESCRIPTION: Local implementation of strtok() with local storage for the
+ *              next pointer. Not only thread-safe, but allows multiple
+ *              parsing of substrings such as expressions.
+ *
+ *****************************************************************************/
+
+char *
+PrGetNextToken (
+    char                    *Buffer,
+    char                    *MatchString,
+    char                    **Next)
+{
+    char                    *TokenStart;
+
+
+    if (!Buffer)
+    {
+        /* Use Next if it is valid */
+
+        Buffer = *Next;
+        if (!(*Next))
+        {
+            return (NULL);
+        }
+    }
+
+    /* Skip any leading delimiters */
+
+    while (*Buffer)
+    {
+        if (strchr (MatchString, *Buffer))
+        {
+            Buffer++;
+        }
+        else
+        {
+            break;
+        }
+    }
+
+    /* Anything left on the line? */
+
+    if (!(*Buffer))
+    {
+        *Next = NULL;
+        return (NULL);
+    }
+
+    TokenStart = Buffer;
+
+    /* Find the end of this token */
+
+    while (*Buffer)
+    {
+        if (strchr (MatchString, *Buffer))
+        {
+            *Buffer = 0;
+            *Next = Buffer+1;
+            if (!**Next)
+            {
+                *Next = NULL;
+            }
+
+            return (TokenStart);
+        }
+
+        Buffer++;
+    }
+
+    *Next = NULL;
+    return (TokenStart);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrError
+ *
+ * PARAMETERS:  Level               - Seriousness (Warning/error, etc.)
+ *              MessageId           - Index into global message buffer
+ *              Column              - Column in current line
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Preprocessor error reporting. Front end to AslCommonError2
+ *
+ ******************************************************************************/
+
+void
+PrError (
+    UINT8                   Level,
+    UINT16                  MessageId,
+    UINT32                  Column)
+{
+#if 0
+    AcpiOsPrintf ("%s (%u) : %s", Gbl_Files[ASL_FILE_INPUT].Filename,
+        Gbl_CurrentLineNumber, Gbl_CurrentLineBuffer);
+#endif
+
+
+    if (Column > 120)
+    {
+        Column = 0;
+    }
+
+    /* TBD: Need Logical line number? */
+
+    AslCommonError2 (Level, MessageId,
+        Gbl_CurrentLineNumber, Column,
+        Gbl_CurrentLineBuffer,
+        Gbl_Files[ASL_FILE_INPUT].Filename, "Preprocessor");
+
+    Gbl_PreprocessorError = TRUE;
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrReplaceData
+ *
+ * PARAMETERS:  Buffer              - Original(target) buffer pointer
+ *              LengthToRemove      - Length to be removed from target buffer
+ *              BufferToAdd         - Data to be inserted into target buffer
+ *              LengthToAdd         - Length of BufferToAdd
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Generic buffer data replacement.
+ *
+ ******************************************************************************/
+
+void
+PrReplaceData (
+    char                    *Buffer,
+    UINT32                  LengthToRemove,
+    char                    *BufferToAdd,
+    UINT32                  LengthToAdd)
+{
+    UINT32                  BufferLength;
+
+
+    /* Buffer is a string, so the length must include the terminating zero */
+
+    BufferLength = strlen (Buffer) + 1;
+
+    if (LengthToRemove != LengthToAdd)
+    {
+        /*
+         * Move some of the existing data
+         * 1) If adding more bytes than removing, make room for the new data
+         * 2) if removing more bytes than adding, delete the extra space
+         */
+        if (LengthToRemove > 0)
+        {
+            memmove ((Buffer + LengthToAdd), (Buffer + LengthToRemove),
+                (BufferLength - LengthToRemove));
+        }
+    }
+
+    /* Now we can move in the new data */
+
+    if (LengthToAdd > 0)
+    {
+        memmove (Buffer, BufferToAdd, LengthToAdd);
+    }
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    PrOpenIncludeFile
+ *
+ * PARAMETERS:  Filename            - Filename or pathname for include file
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Open an include file and push it on the input file stack.
+ *
+ ******************************************************************************/
+
+FILE *
+PrOpenIncludeFile (
+    char                    *Filename,
+    char                    *OpenMode,
+    char                    **FullPathname)
+{
+    FILE                    *IncludeFile;
+    ASL_INCLUDE_DIR         *NextDir;
+
+
+    /* Start the actual include file on the next line */
+
+    Gbl_CurrentLineOffset++;
+
+    /* Attempt to open the include file */
+    /* If the file specifies an absolute path, just open it */
+
+    if ((Filename[0] == '/')  ||
+        (Filename[0] == '\\') ||
+        (Filename[1] == ':'))
+    {
+        IncludeFile = PrOpenIncludeWithPrefix (
+            "", Filename, OpenMode, FullPathname);
+        if (!IncludeFile)
+        {
+            goto ErrorExit;
+        }
+        return (IncludeFile);
+    }
+
+    /*
+     * The include filename is not an absolute path.
+     *
+     * First, search for the file within the "local" directory -- meaning
+     * the same directory that contains the source file.
+     *
+     * Construct the file pathname from the global directory name.
+     */
+    IncludeFile = PrOpenIncludeWithPrefix (
+        Gbl_DirectoryPath, Filename, OpenMode, FullPathname);
+    if (IncludeFile)
+    {
+        return (IncludeFile);
+    }
+
+    /*
+     * Second, search for the file within the (possibly multiple)
+     * directories specified by the -I option on the command line.
+     */
+    NextDir = Gbl_IncludeDirList;
+    while (NextDir)
+    {
+        IncludeFile = PrOpenIncludeWithPrefix (
+            NextDir->Dir, Filename, OpenMode, FullPathname);
+        if (IncludeFile)
+        {
+            return (IncludeFile);
+        }
+
+        NextDir = NextDir->Next;
+    }
+
+    /* We could not open the include file after trying very hard */
+
+ErrorExit:
+    sprintf (Gbl_MainTokenBuffer, "%s, %s", Filename, strerror (errno));
+    PrError (ASL_ERROR, ASL_MSG_INCLUDE_FILE_OPEN, 0);
+    return (NULL);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    FlOpenIncludeWithPrefix
+ *
+ * PARAMETERS:  PrefixDir       - Prefix directory pathname. Can be a zero
+ *                                length string.
+ *              Filename        - The include filename from the source ASL.
+ *
+ * RETURN:      Valid file descriptor if successful. Null otherwise.
+ *
+ * DESCRIPTION: Open an include file and push it on the input file stack.
+ *
+ ******************************************************************************/
+
+FILE *
+PrOpenIncludeWithPrefix (
+    char                    *PrefixDir,
+    char                    *Filename,
+    char                    *OpenMode,
+    char                    **FullPathname)
+{
+    FILE                    *IncludeFile;
+    char                    *Pathname;
+
+
+    /* Build the full pathname to the file */
+
+    Pathname = FlMergePathnames (PrefixDir, Filename);
+
+    DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+        "Include: Opening file - \"%s\"\n",
+        Gbl_CurrentLineNumber, Pathname);
+
+    /* Attempt to open the file, push if successful */
+
+    IncludeFile = fopen (Pathname, OpenMode);
+    if (!IncludeFile)
+    {
+        fprintf (stderr, "Could not open include file %s\n", Pathname);
+        return (NULL);
+    }
+
+    /* Push the include file on the open input file stack */
+
+    PrPushInputFileStack (IncludeFile, Pathname);
+    *FullPathname = Pathname;
+    return (IncludeFile);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslPushInputFileStack
+ *
+ * PARAMETERS:  InputFile           - Open file pointer
+ *              Filename            - Name of the file
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Push the InputFile onto the file stack, and point the parser
+ *              to this file. Called when an include file is successfully
+ *              opened.
+ *
+ ******************************************************************************/
+
+void
+PrPushInputFileStack (
+    FILE                    *InputFile,
+    char                    *Filename)
+{
+    PR_FILE_NODE            *Fnode;
+
+
+    Gbl_HasIncludeFiles = TRUE;
+
+    /* Save the current state in an Fnode */
+
+    Fnode = UtLocalCalloc (sizeof (PR_FILE_NODE));
+
+    Fnode->File = Gbl_Files[ASL_FILE_INPUT].Handle;
+    Fnode->Next = Gbl_InputFileList;
+    Fnode->Filename = Gbl_Files[ASL_FILE_INPUT].Filename;
+    Fnode->CurrentLineNumber = Gbl_CurrentLineNumber;
+
+    /* Push it on the stack */
+
+    Gbl_InputFileList = Fnode;
+
+    DbgPrint (ASL_PARSE_OUTPUT, PR_PREFIX_ID
+        "Push InputFile Stack: handle %p\n\n",
+        Gbl_CurrentLineNumber, InputFile);
+
+    /* Reset the global line count and filename */
+
+    Gbl_Files[ASL_FILE_INPUT].Filename =
+        UtStringCacheCalloc (strlen (Filename) + 1);
+    strcpy (Gbl_Files[ASL_FILE_INPUT].Filename, Filename);
+
+    Gbl_Files[ASL_FILE_INPUT].Handle = InputFile;
+    Gbl_CurrentLineNumber = 1;
+
+    /* Emit a new #line directive for the include file */
+
+    FlPrintFile (ASL_FILE_PREPROCESSOR, "#line %u \"%s\"\n", 1, Filename);
+}
+
+
+/*******************************************************************************
+ *
+ * FUNCTION:    AslPopInputFileStack
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      0 if a node was popped, -1 otherwise
+ *
+ * DESCRIPTION: Pop the top of the input file stack and point the parser to
+ *              the saved parse buffer contained in the fnode. Also, set the
+ *              global line counters to the saved values. This function is
+ *              called when an include file reaches EOF.
+ *
+ ******************************************************************************/
+
+BOOLEAN
+PrPopInputFileStack (
+    void)
+{
+    PR_FILE_NODE            *Fnode;
+
+
+    Fnode = Gbl_InputFileList;
+    DbgPrint (ASL_PARSE_OUTPUT, "\n" PR_PREFIX_ID
+        "Pop InputFile Stack, Fnode %p\n\n",
+        Gbl_CurrentLineNumber, Fnode);
+
+    if (!Fnode)
+    {
+        return (FALSE);
+    }
+
+    /* Close the current include file */
+
+    fclose (Gbl_Files[ASL_FILE_INPUT].Handle);
+
+    /* Update the top-of-stack */
+
+    Gbl_InputFileList = Fnode->Next;
+
+    /* Reset global line counter and filename */
+
+    Gbl_Files[ASL_FILE_INPUT].Filename = Fnode->Filename;
+    Gbl_Files[ASL_FILE_INPUT].Handle = Fnode->File;
+    Gbl_CurrentLineNumber = Fnode->CurrentLineNumber;
+
+    /* Emit a new #line directive after the include file */
+
+    FlPrintFile (ASL_FILE_PREPROCESSOR, "#line %u \"%s\"\n",
+        Gbl_CurrentLineNumber, Fnode->Filename);
+
+    /* All done with this node */
+
+    ACPI_FREE (Fnode);
+    return (TRUE);
+}
diff --git a/usr/src/cmd/ahciem/Makefile b/usr/src/cmd/ahciem/Makefile
new file mode 100644
index 0000000000..7c9efa5f27
--- /dev/null
+++ b/usr/src/cmd/ahciem/Makefile
@@ -0,0 +1,39 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+PROG= ahciem
+LINTPROGS= $(PROG:%=%.ln)
+
+include ../Makefile.cmd
+
+ROOTCMDDIR = $(ROOTLIB)/ahci
+CPPFLAGS += -I$(SRC)/uts/common/
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -ldevinfo
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all $(ROOTCMD)
+
+clean:
+
+%.ln: %.c
+	$(LINT.c) $< $(LDLIBS)
+
+lint:	$(LINTPROGS)
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/ahciem/ahciem.c b/usr/src/cmd/ahciem/ahciem.c
new file mode 100644
index 0000000000..3c3a473f51
--- /dev/null
+++ b/usr/src/cmd/ahciem/ahciem.c
@@ -0,0 +1,302 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018 Joyent, Inc.
+ */
+
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <err.h>
+#include <libgen.h>
+#include <libdevinfo.h>
+
+#include <sys/sata/adapters/ahci/ahciem.h>
+
+#define	AHCIEM_IDENT	"ident"
+#define	AHCIEM_FAULT	"fault"
+#define	AHCIEM_NOACTIVITY	"noactivity"
+#define	AHCIEM_DEFAULT	"default"
+#define	AHCIEM_UNKNOWN	"unknown"
+
+#define	EXIT_USAGE	2
+
+static const char *ahciem_progname;
+
+typedef struct {
+	boolean_t		ahci_set;
+	ahci_em_led_state_t	ahci_led;
+	int			ahci_argc;
+	char			**ahci_argv;
+	boolean_t		*ahci_found;
+	int			ahci_err;
+} ahciem_t;
+
+static void
+ahciem_usage(const char *fmt, ...)
+{
+	if (fmt != NULL) {
+		va_list ap;
+
+		va_start(ap, fmt);
+		vwarnx(fmt, ap);
+		va_end(ap);
+	}
+
+	(void) fprintf(stderr, "Usage: %s [-s mode] [port]\n"
+	    "\n"
+	    "\t-s mode\t\tset LED to mode\n",
+	    ahciem_progname);
+}
+
+static const char *
+ahciem_led_to_string(uint_t led)
+{
+	switch (led) {
+	case AHCI_EM_LED_IDENT_ENABLE:
+		return (AHCIEM_IDENT);
+	case AHCI_EM_LED_FAULT_ENABLE:
+		return (AHCIEM_FAULT);
+	case AHCI_EM_LED_ACTIVITY_DISABLE:
+		return (AHCIEM_NOACTIVITY);
+	case (AHCI_EM_LED_IDENT_ENABLE | AHCI_EM_LED_FAULT_ENABLE):
+		return (AHCIEM_IDENT "," AHCIEM_FAULT);
+	case (AHCI_EM_LED_IDENT_ENABLE | AHCI_EM_LED_ACTIVITY_DISABLE):
+		return (AHCIEM_IDENT "," AHCIEM_NOACTIVITY);
+	case (AHCI_EM_LED_FAULT_ENABLE | AHCI_EM_LED_ACTIVITY_DISABLE):
+		return (AHCIEM_FAULT "," AHCIEM_NOACTIVITY);
+	/* BEGIN CSTYLED */
+	case (AHCI_EM_LED_IDENT_ENABLE | AHCI_EM_LED_FAULT_ENABLE |
+	    AHCI_EM_LED_ACTIVITY_DISABLE):
+		return (AHCIEM_IDENT "," AHCIEM_FAULT "," AHCIEM_NOACTIVITY);
+	/* END CSTYLED */
+	case 0:
+		return (AHCIEM_DEFAULT);
+	default:
+		return (AHCIEM_UNKNOWN);
+	}
+}
+
+static boolean_t
+ahciem_match(ahciem_t *ahci, const char *port)
+{
+	int i;
+
+	if (ahci->ahci_argc == 0)
+		return (B_TRUE);
+
+	for (i = 0; i < ahci->ahci_argc; i++) {
+		size_t len = strlen(ahci->ahci_argv[i]);
+
+		/*
+		 * Perform a partial match on the base name. This allows us to
+		 * match all of a controller by using a string like "ahci0".
+		 */
+		if (strncmp(ahci->ahci_argv[i], port, len) == 0) {
+			ahci->ahci_found[i] = B_TRUE;
+			return (B_TRUE);
+		}
+
+	}
+
+	return (B_FALSE);
+}
+
+static ahci_em_led_state_t
+ahciem_parse(const char *arg)
+{
+	if (strcmp(arg, AHCIEM_IDENT) == 0) {
+		return (AHCI_EM_LED_IDENT_ENABLE);
+	} else if (strcmp(arg, AHCIEM_FAULT) == 0) {
+		return (AHCI_EM_LED_FAULT_ENABLE);
+	} else if (strcmp(arg, AHCIEM_NOACTIVITY) == 0) {
+		return (AHCI_EM_LED_ACTIVITY_DISABLE);
+	} else if (strcmp(arg, AHCIEM_DEFAULT) == 0) {
+		return (0);
+	}
+
+	errx(EXIT_USAGE, "invalid LED mode with -s: %s", arg);
+}
+
+static void
+ahciem_set(ahciem_t *ahci, const char *portstr, int fd, int port)
+{
+	ahci_ioc_em_set_t set;
+
+	bzero(&set, sizeof (set));
+
+	set.aiems_port = port;
+	set.aiems_op = AHCI_EM_IOC_SET_OP_SET;
+	set.aiems_leds = ahci->ahci_led;
+
+	if (ioctl(fd, AHCI_EM_IOC_SET, &set) != 0) {
+		warn("failed to set LEDs on %s", portstr);
+		ahci->ahci_err = 1;
+	}
+}
+
+static int
+ahciem_devinfo(di_node_t node, void *arg)
+{
+	char *driver, *mpath, *fullpath;
+	const char *sup;
+	int inst, fd;
+	uint_t i;
+	ahciem_t *ahci = arg;
+	di_minor_t m;
+	ahci_ioc_em_get_t get;
+
+	if ((driver = di_driver_name(node)) == NULL)
+		return (DI_WALK_CONTINUE);
+	if (strcmp(driver, "ahci") != 0)
+		return (DI_WALK_CONTINUE);
+	inst = di_instance(node);
+
+	m = DI_MINOR_NIL;
+	while ((m = di_minor_next(node, m)) != DI_MINOR_NIL) {
+		char *mname = di_minor_name(m);
+
+		if (mname != NULL && strcmp("devctl", mname) == 0)
+			break;
+	}
+
+	if (m == DI_MINOR_NIL) {
+		warnx("encountered ahci%d without devctl node", inst);
+		return (DI_WALK_PRUNECHILD);
+	}
+
+	if ((mpath = di_devfs_minor_path(m)) == NULL) {
+		warnx("failed to get path for ahci%d devctl minor", inst);
+		return (DI_WALK_PRUNECHILD);
+	}
+
+	if (asprintf(&fullpath, "/devices/%s", mpath) == -1) {
+		warn("failed to construct /devices path from %s", mpath);
+		return (DI_WALK_PRUNECHILD);
+	}
+
+	if ((fd = open(fullpath, O_RDWR)) < 0) {
+		warn("failed to open ahci%d devctl path %s", inst, fullpath);
+		goto out;
+	}
+
+	bzero(&get, sizeof (get));
+	if (ioctl(fd, AHCI_EM_IOC_GET, &get) != 0) {
+		warn("failed to get AHCI enclosure information for ahci%d",
+		    inst);
+		ahci->ahci_err = 1;
+		goto out;
+	}
+
+	if ((get.aiemg_flags & AHCI_EM_FLAG_CONTROL_ACTIVITY) != 0) {
+		sup = ahciem_led_to_string(AHCI_EM_LED_IDENT_ENABLE |
+		    AHCI_EM_LED_FAULT_ENABLE | AHCI_EM_LED_ACTIVITY_DISABLE);
+	} else {
+		sup = ahciem_led_to_string(AHCI_EM_LED_IDENT_ENABLE |
+		    AHCI_EM_LED_FAULT_ENABLE);
+	}
+
+	for (i = 0; i < AHCI_EM_IOC_MAX_PORTS; i++) {
+		char port[64];
+		const char *state;
+
+		if (((1 << i) & get.aiemg_nports) == 0)
+			continue;
+
+		(void) snprintf(port, sizeof (port), "ahci%d/%u", inst, i);
+		if (!ahciem_match(ahci, port))
+			continue;
+
+		if (ahci->ahci_set) {
+			ahciem_set(ahci, port, fd, i);
+			continue;
+		}
+
+		state = ahciem_led_to_string(get.aiemg_status[i]);
+		(void) printf("%-20s %-12s %s,default\n", port, state, sup);
+	}
+
+out:
+	free(fullpath);
+	return (DI_WALK_PRUNECHILD);
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c, i, ret;
+	di_node_t root;
+	ahciem_t ahci;
+
+	ahciem_progname = basename(argv[0]);
+
+	bzero(&ahci, sizeof (ahciem_t));
+	while ((c = getopt(argc, argv, ":s:")) != -1) {
+		switch (c) {
+		case 's':
+			ahci.ahci_set = B_TRUE;
+			ahci.ahci_led = ahciem_parse(optarg);
+			break;
+		case ':':
+			ahciem_usage("option -%c requires an operand\n",
+			    optopt);
+			return (EXIT_USAGE);
+		case '?':
+		default:
+			ahciem_usage("unknown option: -%c\n", optopt);
+			return (EXIT_USAGE);
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+	ahci.ahci_argc = argc;
+	ahci.ahci_argv = argv;
+	if (argc > 0) {
+		ahci.ahci_found = calloc(argc, sizeof (boolean_t));
+		if (ahci.ahci_found == NULL) {
+			err(EXIT_FAILURE, "failed to alloc memory for %d "
+			    "booleans", argc);
+		}
+	}
+
+	if ((root = di_init("/", DINFOCPYALL)) == DI_NODE_NIL) {
+		err(EXIT_FAILURE, "failed to open devinfo tree");
+	}
+
+	if (!ahci.ahci_set) {
+		(void) printf("%-20s %-12s %s\n", "PORT", "ACTIVE",
+		    "SUPPORTED");
+	}
+
+	if (di_walk_node(root, DI_WALK_CLDFIRST, &ahci,
+	    ahciem_devinfo) != 0) {
+		err(EXIT_FAILURE, "failed to walk devinfo tree");
+	}
+
+	ret = ahci.ahci_err;
+	for (i = 0; i < argc; i++) {
+		if (ahci.ahci_found[i])
+			continue;
+		warnx("failed to find ahci enclosure port \"%s\"",
+		    ahci.ahci_argv[i]);
+		ret = 1;
+	}
+
+	return (ret);
+}
diff --git a/usr/src/cmd/bhyve/Makefile b/usr/src/cmd/bhyve/Makefile
new file mode 100644
index 0000000000..554603d4f8
--- /dev/null
+++ b/usr/src/cmd/bhyve/Makefile
@@ -0,0 +1,151 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2014 Pluribus Networks Inc.
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+PROG =		bhyve
+
+include ../Makefile.cmd
+include ../Makefile.cmd.64
+include ../Makefile.ctf
+
+SUBDIRS = test
+
+all	:=	TARGET = all
+install	:=	TARGET = install
+clean	:=	TARGET = clean
+clobber	:=	TARGET = clobber
+lint	:=	TARGET = lint
+
+SRCS =	acpi.c			\
+	atkbdc.c		\
+	bhyvegc.c		\
+	bhyverun.c		\
+	block_if.c		\
+	bootrom.c		\
+	console.c		\
+	consport.c		\
+	dbgport.c		\
+	fwctl.c			\
+	gdb.c			\
+	inout.c			\
+	ioapic.c		\
+	mem.c			\
+	mevent.c		\
+	mptbl.c			\
+	pci_ahci.c		\
+	pci_e82545.c		\
+	pci_emul.c		\
+	pci_fbuf.c		\
+	pci_hostbridge.c	\
+	pci_irq.c		\
+	pci_lpc.c		\
+	pci_passthru.c		\
+	pci_uart.c		\
+	pci_virtio_block.c	\
+	pci_virtio_console.c	\
+	pci_virtio_net.c	\
+	pci_virtio_rnd.c	\
+	pci_virtio_viona.c	\
+	pci_xhci.c		\
+	pm.c			\
+	post.c			\
+	ps2kbd.c		\
+	ps2mouse.c		\
+	rfb.c			\
+	rtc.c			\
+	smbiostbl.c		\
+	sockstream.c		\
+	task_switch.c		\
+	uart_emul.c		\
+	usb_emul.c		\
+	usb_mouse.c		\
+	vga.c			\
+	virtio.c		\
+	vmm_instruction_emul.c	\
+	xmsr.c			\
+	spinup_ap.c		\
+	bhyve_sol_glue.c
+
+OBJS = $(SRCS:.c=.o)
+
+CLOBBERFILES =	$(ROOTUSRSBINPROG) $(ZHYVE)
+
+ZHYVE_DIR =	$(ROOT)/usr/lib/brand/bhyve
+ZHYVE_PROG = 	zhyve
+ZHYVE =		$(ZHYVE_DIR)/$(ZHYVE_PROG)
+
+MEVENT_TEST_PROG = mevent_test
+MEVENT_TEST_SRCS = mevent.c mevent_test.c
+MEVENT_TEST_OBJS = $(MEVENT_TEST_SRCS:.c=.o)
+
+CLEANFILES =	$(PROG) $(ZHYVE_PROG) $(MEVENT_TEST_PROG) $(MEVENT_TEST_OBJS)
+
+CFLAGS +=	$(CCVERBOSE) -_gcc=-Wimplicit-function-declaration -_gcc=-Wno-parentheses
+CPPFLAGS =	-I$(COMPAT)/freebsd -I$(CONTRIB)/freebsd \
+		-I$(COMPAT)/freebsd/amd64 -I$(CONTRIB)/freebsd/amd64 \
+		-I$(CONTRIB)/freebsd/dev/usb/controller \
+		-I$(CONTRIB)/freebsd/dev/mii \
+		-I$(SRC)/uts/common/io/e1000api \
+		$(CPPFLAGS.master) \
+		-I$(ROOT)/usr/platform/i86pc/include \
+		-I$(SRC)/uts/i86pc/io/vmm \
+		-I$(SRC)/uts/common \
+		-I$(SRC)/uts/i86pc \
+		-I$(SRC)/lib/libdladm/common \
+		-DWITHOUT_CAPSICUM
+
+# Disable the crypto code until it is wired up
+CPPFLAGS +=	-DNO_OPENSSL
+
+LDLIBS +=	-lsocket -lnsl -ldlpi -ldladm -lmd -luuid -lvmmapi -lz
+
+zhyve := LDLIBS = -lnvpair
+
+POST_PROCESS += ; $(GENSETDEFS) $@
+
+.KEEP_STATE:
+
+all: $(PROG) $(MEVENT_TEST_PROG) $(ZHYVE_PROG) $(SUBDIRS)
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDFLAGS) $(LDLIBS)
+	$(POST_PROCESS)
+
+$(MEVENT_TEST_PROG): $(MEVENT_TEST_OBJS)
+	$(LINK.c) -o $@ $(MEVENT_TEST_OBJS) -lsocket
+
+install: all $(ZHYVE) $(ROOTUSRSBINPROG) $(SUBDIRS)
+
+clean: $(SUBDIRS)
+	$(RM) $(OBJS) $(CLEANFILES)
+
+clobber: clean $(SUBDIRS)
+	$(RM) $(CLOBBERFILES)
+
+lint:	lint_SRCS $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
+
+$(ZHYVE_DIR)/%: %
+	$(INS.file)
+
+%.o: $(SRC)/uts/i86pc/io/vmm/%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
diff --git a/usr/src/cmd/bhyve/acpi.c b/usr/src/cmd/bhyve/acpi.c
new file mode 100644
index 0000000000..518ff34d69
--- /dev/null
+++ b/usr/src/cmd/bhyve/acpi.c
@@ -0,0 +1,1014 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * bhyve ACPI table generator.
+ *
+ * Create the minimal set of ACPI tables required to boot FreeBSD (and
+ * hopefully other o/s's) by writing out ASL template files for each of
+ * the tables and the compiling them to AML with the Intel iasl compiler.
+ * The AML files are then read into guest memory.
+ *
+ *  The tables are placed in the guest's ROM area just below 1MB physical,
+ * above the MPTable.
+ *
+ *  Layout
+ *  ------
+ *   RSDP  ->   0xf2400    (36 bytes fixed)
+ *     RSDT  ->   0xf2440    (36 bytes + 4*7 table addrs, 4 used)
+ *     XSDT  ->   0xf2480    (36 bytes + 8*7 table addrs, 4 used)
+ *       MADT  ->   0xf2500  (depends on #CPUs)
+ *       FADT  ->   0xf2600  (268 bytes)
+ *       HPET  ->   0xf2740  (56 bytes)
+ *       MCFG  ->   0xf2780  (60 bytes)
+ *         FACS  ->   0xf27C0 (64 bytes)
+ *         DSDT  ->   0xf2800 (variable - can go up to 0x100000)
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/errno.h>
+#include <sys/stat.h>
+
+#include <paths.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include "bhyverun.h"
+#include "acpi.h"
+#include "pci_emul.h"
+
+/*
+ * Define the base address of the ACPI tables, and the offsets to
+ * the individual tables
+ */
+#define BHYVE_ACPI_BASE		0xf2400
+#define RSDT_OFFSET		0x040
+#define XSDT_OFFSET		0x080
+#define MADT_OFFSET		0x100
+#define FADT_OFFSET		0x200
+#define	HPET_OFFSET		0x340
+#define	MCFG_OFFSET		0x380
+#define FACS_OFFSET		0x3C0
+#define DSDT_OFFSET		0x400
+
+#define	BHYVE_ASL_TEMPLATE	"bhyve.XXXXXXX"
+#define BHYVE_ASL_SUFFIX	".aml"
+#define BHYVE_ASL_COMPILER	"/usr/sbin/iasl"
+
+static int basl_keep_temps;
+static int basl_verbose_iasl;
+static int basl_ncpu;
+static uint32_t basl_acpi_base = BHYVE_ACPI_BASE;
+static uint32_t hpet_capabilities;
+
+/*
+ * Contains the full pathname of the template to be passed
+ * to mkstemp/mktemps(3)
+ */
+static char basl_template[MAXPATHLEN];
+static char basl_stemplate[MAXPATHLEN];
+
+/*
+ * State for dsdt_line(), dsdt_indent(), and dsdt_unindent().
+ */
+static FILE *dsdt_fp;
+static int dsdt_indent_level;
+static int dsdt_error;
+
+struct basl_fio {
+	int	fd;
+	FILE	*fp;
+	char	f_name[MAXPATHLEN];
+};
+
+#define EFPRINTF(...) \
+	err = fprintf(__VA_ARGS__); if (err < 0) goto err_exit;
+
+#define EFFLUSH(x) \
+	err = fflush(x); if (err != 0) goto err_exit;
+
+static int
+basl_fwrite_rsdp(FILE *fp)
+{
+	int err;
+
+	err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve RSDP template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0008]\t\tSignature : \"RSD PTR \"\n");
+	EFPRINTF(fp, "[0001]\t\tChecksum : 43\n");
+	EFPRINTF(fp, "[0006]\t\tOem ID : \"BHYVE \"\n");
+	EFPRINTF(fp, "[0001]\t\tRevision : 02\n");
+	EFPRINTF(fp, "[0004]\t\tRSDT Address : %08X\n",
+	    basl_acpi_base + RSDT_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tLength : 00000024\n");
+	EFPRINTF(fp, "[0008]\t\tXSDT Address : 00000000%08X\n",
+	    basl_acpi_base + XSDT_OFFSET);
+	EFPRINTF(fp, "[0001]\t\tExtended Checksum : 00\n");
+	EFPRINTF(fp, "[0003]\t\tReserved : 000000\n");
+
+	EFFLUSH(fp);
+
+	return (0);
+
+err_exit:
+	return (errno);
+}
+
+static int
+basl_fwrite_rsdt(FILE *fp)
+{
+	int err;
+
+	err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve RSDT template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0004]\t\tSignature : \"RSDT\"\n");
+	EFPRINTF(fp, "[0004]\t\tTable Length : 00000000\n");
+	EFPRINTF(fp, "[0001]\t\tRevision : 01\n");
+	EFPRINTF(fp, "[0001]\t\tChecksum : 00\n");
+	EFPRINTF(fp, "[0006]\t\tOem ID : \"BHYVE \"\n");
+	EFPRINTF(fp, "[0008]\t\tOem Table ID : \"BVRSDT  \"\n");
+	EFPRINTF(fp, "[0004]\t\tOem Revision : 00000001\n");
+	/* iasl will fill in the compiler ID/revision fields */
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler ID : \"xxxx\"\n");
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler Revision : 00000000\n");
+	EFPRINTF(fp, "\n");
+
+	/* Add in pointers to the MADT, FADT and HPET */
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 0 : %08X\n",
+	    basl_acpi_base + MADT_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 1 : %08X\n",
+	    basl_acpi_base + FADT_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 2 : %08X\n",
+	    basl_acpi_base + HPET_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 3 : %08X\n",
+	    basl_acpi_base + MCFG_OFFSET);
+
+	EFFLUSH(fp);
+
+	return (0);
+
+err_exit:
+	return (errno);
+}
+
+static int
+basl_fwrite_xsdt(FILE *fp)
+{
+	int err;
+
+	err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve XSDT template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0004]\t\tSignature : \"XSDT\"\n");
+	EFPRINTF(fp, "[0004]\t\tTable Length : 00000000\n");
+	EFPRINTF(fp, "[0001]\t\tRevision : 01\n");
+	EFPRINTF(fp, "[0001]\t\tChecksum : 00\n");
+	EFPRINTF(fp, "[0006]\t\tOem ID : \"BHYVE \"\n");
+	EFPRINTF(fp, "[0008]\t\tOem Table ID : \"BVXSDT  \"\n");
+	EFPRINTF(fp, "[0004]\t\tOem Revision : 00000001\n");
+	/* iasl will fill in the compiler ID/revision fields */
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler ID : \"xxxx\"\n");
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler Revision : 00000000\n");
+	EFPRINTF(fp, "\n");
+
+	/* Add in pointers to the MADT, FADT and HPET */
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 0 : 00000000%08X\n",
+	    basl_acpi_base + MADT_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 1 : 00000000%08X\n",
+	    basl_acpi_base + FADT_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 2 : 00000000%08X\n",
+	    basl_acpi_base + HPET_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tACPI Table Address 3 : 00000000%08X\n",
+	    basl_acpi_base + MCFG_OFFSET);
+
+	EFFLUSH(fp);
+
+	return (0);
+
+err_exit:
+	return (errno);
+}
+
+static int
+basl_fwrite_madt(FILE *fp)
+{
+	int err;
+	int i;
+
+	err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve MADT template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0004]\t\tSignature : \"APIC\"\n");
+	EFPRINTF(fp, "[0004]\t\tTable Length : 00000000\n");
+	EFPRINTF(fp, "[0001]\t\tRevision : 01\n");
+	EFPRINTF(fp, "[0001]\t\tChecksum : 00\n");
+	EFPRINTF(fp, "[0006]\t\tOem ID : \"BHYVE \"\n");
+	EFPRINTF(fp, "[0008]\t\tOem Table ID : \"BVMADT  \"\n");
+	EFPRINTF(fp, "[0004]\t\tOem Revision : 00000001\n");
+
+	/* iasl will fill in the compiler ID/revision fields */
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler ID : \"xxxx\"\n");
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler Revision : 00000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0004]\t\tLocal Apic Address : FEE00000\n");
+	EFPRINTF(fp, "[0004]\t\tFlags (decoded below) : 00000001\n");
+	EFPRINTF(fp, "\t\t\tPC-AT Compatibility : 1\n");
+	EFPRINTF(fp, "\n");
+
+	/* Add a Processor Local APIC entry for each CPU */
+	for (i = 0; i < basl_ncpu; i++) {
+		EFPRINTF(fp, "[0001]\t\tSubtable Type : 00\n");
+		EFPRINTF(fp, "[0001]\t\tLength : 08\n");
+		/* iasl expects hex values for the proc and apic id's */
+		EFPRINTF(fp, "[0001]\t\tProcessor ID : %02x\n", i);
+		EFPRINTF(fp, "[0001]\t\tLocal Apic ID : %02x\n", i);
+		EFPRINTF(fp, "[0004]\t\tFlags (decoded below) : 00000001\n");
+		EFPRINTF(fp, "\t\t\tProcessor Enabled : 1\n");
+		EFPRINTF(fp, "\n");
+	}
+
+	/* Always a single IOAPIC entry, with ID 0 */
+	EFPRINTF(fp, "[0001]\t\tSubtable Type : 01\n");
+	EFPRINTF(fp, "[0001]\t\tLength : 0C\n");
+	/* iasl expects a hex value for the i/o apic id */
+	EFPRINTF(fp, "[0001]\t\tI/O Apic ID : %02x\n", 0);
+	EFPRINTF(fp, "[0001]\t\tReserved : 00\n");
+	EFPRINTF(fp, "[0004]\t\tAddress : fec00000\n");
+	EFPRINTF(fp, "[0004]\t\tInterrupt : 00000000\n");
+	EFPRINTF(fp, "\n");
+
+	/* Legacy IRQ0 is connected to pin 2 of the IOAPIC */
+	EFPRINTF(fp, "[0001]\t\tSubtable Type : 02\n");
+	EFPRINTF(fp, "[0001]\t\tLength : 0A\n");
+	EFPRINTF(fp, "[0001]\t\tBus : 00\n");
+	EFPRINTF(fp, "[0001]\t\tSource : 00\n");
+	EFPRINTF(fp, "[0004]\t\tInterrupt : 00000002\n");
+	EFPRINTF(fp, "[0002]\t\tFlags (decoded below) : 0005\n");
+	EFPRINTF(fp, "\t\t\tPolarity : 1\n");
+	EFPRINTF(fp, "\t\t\tTrigger Mode : 1\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0001]\t\tSubtable Type : 02\n");
+	EFPRINTF(fp, "[0001]\t\tLength : 0A\n");
+	EFPRINTF(fp, "[0001]\t\tBus : 00\n");
+	EFPRINTF(fp, "[0001]\t\tSource : %02X\n", SCI_INT);
+	EFPRINTF(fp, "[0004]\t\tInterrupt : %08X\n", SCI_INT);
+	EFPRINTF(fp, "[0002]\t\tFlags (decoded below) : 0000\n");
+	EFPRINTF(fp, "\t\t\tPolarity : 3\n");
+	EFPRINTF(fp, "\t\t\tTrigger Mode : 3\n");
+	EFPRINTF(fp, "\n");
+
+	/* Local APIC NMI is connected to LINT 1 on all CPUs */
+	EFPRINTF(fp, "[0001]\t\tSubtable Type : 04\n");
+	EFPRINTF(fp, "[0001]\t\tLength : 06\n");
+	EFPRINTF(fp, "[0001]\t\tProcessorId : FF\n");
+	EFPRINTF(fp, "[0002]\t\tFlags (decoded below) : 0005\n");
+	EFPRINTF(fp, "\t\t\tPolarity : 1\n");
+	EFPRINTF(fp, "\t\t\tTrigger Mode : 1\n");
+	EFPRINTF(fp, "[0001]\t\tInterrupt : 01\n");
+	EFPRINTF(fp, "\n");
+
+	EFFLUSH(fp);
+
+	return (0);
+
+err_exit:
+	return (errno);
+}
+
+static int
+basl_fwrite_fadt(FILE *fp)
+{
+	int err;
+
+	err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve FADT template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0004]\t\tSignature : \"FACP\"\n");
+	EFPRINTF(fp, "[0004]\t\tTable Length : 0000010C\n");
+	EFPRINTF(fp, "[0001]\t\tRevision : 05\n");
+	EFPRINTF(fp, "[0001]\t\tChecksum : 00\n");
+	EFPRINTF(fp, "[0006]\t\tOem ID : \"BHYVE \"\n");
+	EFPRINTF(fp, "[0008]\t\tOem Table ID : \"BVFACP  \"\n");
+	EFPRINTF(fp, "[0004]\t\tOem Revision : 00000001\n");
+	/* iasl will fill in the compiler ID/revision fields */
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler ID : \"xxxx\"\n");
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler Revision : 00000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0004]\t\tFACS Address : %08X\n",
+	    basl_acpi_base + FACS_OFFSET);
+	EFPRINTF(fp, "[0004]\t\tDSDT Address : %08X\n",
+	    basl_acpi_base + DSDT_OFFSET);
+	EFPRINTF(fp, "[0001]\t\tModel : 01\n");
+	EFPRINTF(fp, "[0001]\t\tPM Profile : 00 [Unspecified]\n");
+	EFPRINTF(fp, "[0002]\t\tSCI Interrupt : %04X\n",
+	    SCI_INT);
+	EFPRINTF(fp, "[0004]\t\tSMI Command Port : %08X\n",
+	    SMI_CMD);
+	EFPRINTF(fp, "[0001]\t\tACPI Enable Value : %02X\n",
+	    BHYVE_ACPI_ENABLE);
+	EFPRINTF(fp, "[0001]\t\tACPI Disable Value : %02X\n",
+	    BHYVE_ACPI_DISABLE);
+	EFPRINTF(fp, "[0001]\t\tS4BIOS Command : 00\n");
+	EFPRINTF(fp, "[0001]\t\tP-State Control : 00\n");
+	EFPRINTF(fp, "[0004]\t\tPM1A Event Block Address : %08X\n",
+	    PM1A_EVT_ADDR);
+	EFPRINTF(fp, "[0004]\t\tPM1B Event Block Address : 00000000\n");
+	EFPRINTF(fp, "[0004]\t\tPM1A Control Block Address : %08X\n",
+	    PM1A_CNT_ADDR);
+	EFPRINTF(fp, "[0004]\t\tPM1B Control Block Address : 00000000\n");
+	EFPRINTF(fp, "[0004]\t\tPM2 Control Block Address : 00000000\n");
+	EFPRINTF(fp, "[0004]\t\tPM Timer Block Address : %08X\n",
+	    IO_PMTMR);
+	EFPRINTF(fp, "[0004]\t\tGPE0 Block Address : 00000000\n");
+	EFPRINTF(fp, "[0004]\t\tGPE1 Block Address : 00000000\n");
+	EFPRINTF(fp, "[0001]\t\tPM1 Event Block Length : 04\n");
+	EFPRINTF(fp, "[0001]\t\tPM1 Control Block Length : 02\n");
+	EFPRINTF(fp, "[0001]\t\tPM2 Control Block Length : 00\n");
+	EFPRINTF(fp, "[0001]\t\tPM Timer Block Length : 04\n");
+	EFPRINTF(fp, "[0001]\t\tGPE0 Block Length : 00\n");
+	EFPRINTF(fp, "[0001]\t\tGPE1 Block Length : 00\n");
+	EFPRINTF(fp, "[0001]\t\tGPE1 Base Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\t_CST Support : 00\n");
+	EFPRINTF(fp, "[0002]\t\tC2 Latency : 0000\n");
+	EFPRINTF(fp, "[0002]\t\tC3 Latency : 0000\n");
+	EFPRINTF(fp, "[0002]\t\tCPU Cache Size : 0000\n");
+	EFPRINTF(fp, "[0002]\t\tCache Flush Stride : 0000\n");
+	EFPRINTF(fp, "[0001]\t\tDuty Cycle Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\tDuty Cycle Width : 00\n");
+	EFPRINTF(fp, "[0001]\t\tRTC Day Alarm Index : 00\n");
+	EFPRINTF(fp, "[0001]\t\tRTC Month Alarm Index : 00\n");
+	EFPRINTF(fp, "[0001]\t\tRTC Century Index : 32\n");
+	EFPRINTF(fp, "[0002]\t\tBoot Flags (decoded below) : 0000\n");
+	EFPRINTF(fp, "\t\t\tLegacy Devices Supported (V2) : 0\n");
+	EFPRINTF(fp, "\t\t\t8042 Present on ports 60/64 (V2) : 0\n");
+	EFPRINTF(fp, "\t\t\tVGA Not Present (V4) : 1\n");
+	EFPRINTF(fp, "\t\t\tMSI Not Supported (V4) : 0\n");
+	EFPRINTF(fp, "\t\t\tPCIe ASPM Not Supported (V4) : 1\n");
+	EFPRINTF(fp, "\t\t\tCMOS RTC Not Present (V5) : 0\n");
+	EFPRINTF(fp, "[0001]\t\tReserved : 00\n");
+	EFPRINTF(fp, "[0004]\t\tFlags (decoded below) : 00000000\n");
+	EFPRINTF(fp, "\t\t\tWBINVD instruction is operational (V1) : 1\n");
+	EFPRINTF(fp, "\t\t\tWBINVD flushes all caches (V1) : 0\n");
+	EFPRINTF(fp, "\t\t\tAll CPUs support C1 (V1) : 1\n");
+	EFPRINTF(fp, "\t\t\tC2 works on MP system (V1) : 0\n");
+	EFPRINTF(fp, "\t\t\tControl Method Power Button (V1) : 0\n");
+	EFPRINTF(fp, "\t\t\tControl Method Sleep Button (V1) : 1\n");
+	EFPRINTF(fp, "\t\t\tRTC wake not in fixed reg space (V1) : 0\n");
+	EFPRINTF(fp, "\t\t\tRTC can wake system from S4 (V1) : 0\n");
+	EFPRINTF(fp, "\t\t\t32-bit PM Timer (V1) : 1\n");
+	EFPRINTF(fp, "\t\t\tDocking Supported (V1) : 0\n");
+	EFPRINTF(fp, "\t\t\tReset Register Supported (V2) : 1\n");
+	EFPRINTF(fp, "\t\t\tSealed Case (V3) : 0\n");
+	EFPRINTF(fp, "\t\t\tHeadless - No Video (V3) : 1\n");
+	EFPRINTF(fp, "\t\t\tUse native instr after SLP_TYPx (V3) : 0\n");
+	EFPRINTF(fp, "\t\t\tPCIEXP_WAK Bits Supported (V4) : 0\n");
+	EFPRINTF(fp, "\t\t\tUse Platform Timer (V4) : 0\n");
+	EFPRINTF(fp, "\t\t\tRTC_STS valid on S4 wake (V4) : 0\n");
+	EFPRINTF(fp, "\t\t\tRemote Power-on capable (V4) : 0\n");
+	EFPRINTF(fp, "\t\t\tUse APIC Cluster Model (V4) : 0\n");
+	EFPRINTF(fp, "\t\t\tUse APIC Physical Destination Mode (V4) : 1\n");
+	EFPRINTF(fp, "\t\t\tHardware Reduced (V5) : 0\n");
+	EFPRINTF(fp, "\t\t\tLow Power S0 Idle (V5) : 0\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp,
+	    "[0012]\t\tReset Register : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 08\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\tEncoded Access Width : 01 [Byte Access:8]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000CF9\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0001]\t\tValue to cause reset : 06\n");
+	EFPRINTF(fp, "[0002]\t\tARM Flags (decoded below): 0000\n");
+	EFPRINTF(fp, "\t\t\tPSCI Compliant : 0\n");
+	EFPRINTF(fp, "\t\t\tMust use HVC for PSCI : 0\n");
+	EFPRINTF(fp, "[0001]\t\tFADT Minor Revision : 01\n");
+	EFPRINTF(fp, "[0008]\t\tFACS Address : 00000000%08X\n",
+	    basl_acpi_base + FACS_OFFSET);
+	EFPRINTF(fp, "[0008]\t\tDSDT Address : 00000000%08X\n",
+	    basl_acpi_base + DSDT_OFFSET);
+	EFPRINTF(fp,
+	    "[0012]\t\tPM1A Event Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 20\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\tEncoded Access Width : 02 [Word Access:16]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 00000000%08X\n",
+	    PM1A_EVT_ADDR);
+	EFPRINTF(fp, "\n");
+	
+	EFPRINTF(fp,
+	    "[0012]\t\tPM1B Event Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 00\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp,
+	    "[0001]\t\tEncoded Access Width : 00 [Undefined/Legacy]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp,
+	    "[0012]\t\tPM1A Control Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 10\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\tEncoded Access Width : 02 [Word Access:16]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 00000000%08X\n",
+	    PM1A_CNT_ADDR);
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp,
+	    "[0012]\t\tPM1B Control Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 00\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp,
+	    "[0001]\t\tEncoded Access Width : 00 [Undefined/Legacy]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp,
+	    "[0012]\t\tPM2 Control Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 08\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp,
+	    "[0001]\t\tEncoded Access Width : 00 [Undefined/Legacy]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000000\n");
+	EFPRINTF(fp, "\n");
+
+	/* Valid for bhyve */
+	EFPRINTF(fp,
+	    "[0012]\t\tPM Timer Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 20\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp,
+	    "[0001]\t\tEncoded Access Width : 03 [DWord Access:32]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 00000000%08X\n",
+	    IO_PMTMR);
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0012]\t\tGPE0 Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 00\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\tEncoded Access Width : 01 [Byte Access:8]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0012]\t\tGPE1 Block : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 00\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp,
+	    "[0001]\t\tEncoded Access Width : 00 [Undefined/Legacy]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp,
+	   "[0012]\t\tSleep Control Register : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 08\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\tEncoded Access Width : 01 [Byte Access:8]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp,
+	    "[0012]\t\tSleep Status Register : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 01 [SystemIO]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 08\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp, "[0001]\t\tEncoded Access Width : 01 [Byte Access:8]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 0000000000000000\n");
+
+	EFFLUSH(fp);
+
+	return (0);
+
+err_exit:
+	return (errno);
+}
+
+static int
+basl_fwrite_hpet(FILE *fp)
+{
+	int err;
+
+	err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve HPET template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0004]\t\tSignature : \"HPET\"\n");
+	EFPRINTF(fp, "[0004]\t\tTable Length : 00000000\n");
+	EFPRINTF(fp, "[0001]\t\tRevision : 01\n");
+	EFPRINTF(fp, "[0001]\t\tChecksum : 00\n");
+	EFPRINTF(fp, "[0006]\t\tOem ID : \"BHYVE \"\n");
+	EFPRINTF(fp, "[0008]\t\tOem Table ID : \"BVHPET  \"\n");
+	EFPRINTF(fp, "[0004]\t\tOem Revision : 00000001\n");
+
+	/* iasl will fill in the compiler ID/revision fields */
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler ID : \"xxxx\"\n");
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler Revision : 00000000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0004]\t\tTimer Block ID : %08X\n", hpet_capabilities);
+	EFPRINTF(fp,
+	    "[0012]\t\tTimer Block Register : [Generic Address Structure]\n");
+	EFPRINTF(fp, "[0001]\t\tSpace ID : 00 [SystemMemory]\n");
+	EFPRINTF(fp, "[0001]\t\tBit Width : 00\n");
+	EFPRINTF(fp, "[0001]\t\tBit Offset : 00\n");
+	EFPRINTF(fp,
+		 "[0001]\t\tEncoded Access Width : 00 [Undefined/Legacy]\n");
+	EFPRINTF(fp, "[0008]\t\tAddress : 00000000FED00000\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0001]\t\tHPET Number : 00\n");
+	EFPRINTF(fp, "[0002]\t\tMinimum Clock Ticks : 0000\n");
+	EFPRINTF(fp, "[0004]\t\tFlags (decoded below) : 00000001\n");
+	EFPRINTF(fp, "\t\t\t4K Page Protect : 1\n");
+	EFPRINTF(fp, "\t\t\t64K Page Protect : 0\n");
+	EFPRINTF(fp, "\n");
+
+	EFFLUSH(fp);
+
+	return (0);
+
+err_exit:
+	return (errno);
+}
+
+static int
+basl_fwrite_mcfg(FILE *fp)
+{
+	int err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve MCFG template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0004]\t\tSignature : \"MCFG\"\n");
+	EFPRINTF(fp, "[0004]\t\tTable Length : 00000000\n");
+	EFPRINTF(fp, "[0001]\t\tRevision : 01\n");
+	EFPRINTF(fp, "[0001]\t\tChecksum : 00\n");
+	EFPRINTF(fp, "[0006]\t\tOem ID : \"BHYVE \"\n");
+	EFPRINTF(fp, "[0008]\t\tOem Table ID : \"BVMCFG  \"\n");
+	EFPRINTF(fp, "[0004]\t\tOem Revision : 00000001\n");
+
+	/* iasl will fill in the compiler ID/revision fields */
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler ID : \"xxxx\"\n");
+	EFPRINTF(fp, "[0004]\t\tAsl Compiler Revision : 00000000\n");
+	EFPRINTF(fp, "[0008]\t\tReserved : 0\n");
+	EFPRINTF(fp, "\n");
+
+	EFPRINTF(fp, "[0008]\t\tBase Address : %016lX\n", pci_ecfg_base());
+	EFPRINTF(fp, "[0002]\t\tSegment Group: 0000\n");
+	EFPRINTF(fp, "[0001]\t\tStart Bus: 00\n");
+	EFPRINTF(fp, "[0001]\t\tEnd Bus: FF\n");
+	EFPRINTF(fp, "[0004]\t\tReserved : 0\n");
+	EFFLUSH(fp);
+	return (0);
+err_exit:
+	return (errno);
+}
+
+static int
+basl_fwrite_facs(FILE *fp)
+{
+	int err;
+
+	err = 0;
+
+	EFPRINTF(fp, "/*\n");
+	EFPRINTF(fp, " * bhyve FACS template\n");
+	EFPRINTF(fp, " */\n");
+	EFPRINTF(fp, "[0004]\t\tSignature : \"FACS\"\n");
+	EFPRINTF(fp, "[0004]\t\tLength : 00000040\n");
+	EFPRINTF(fp, "[0004]\t\tHardware Signature : 00000000\n");
+	EFPRINTF(fp, "[0004]\t\t32 Firmware Waking Vector : 00000000\n");
+	EFPRINTF(fp, "[0004]\t\tGlobal Lock : 00000000\n");
+	EFPRINTF(fp, "[0004]\t\tFlags (decoded below) : 00000000\n");
+	EFPRINTF(fp, "\t\t\tS4BIOS Support Present : 0\n");
+	EFPRINTF(fp, "\t\t\t64-bit Wake Supported (V2) : 0\n");
+	EFPRINTF(fp,
+	    "[0008]\t\t64 Firmware Waking Vector : 0000000000000000\n");
+	EFPRINTF(fp, "[0001]\t\tVersion : 02\n");
+	EFPRINTF(fp, "[0003]\t\tReserved : 000000\n");
+	EFPRINTF(fp, "[0004]\t\tOspmFlags (decoded below) : 00000000\n");
+	EFPRINTF(fp, "\t\t\t64-bit Wake Env Required (V2) : 0\n");
+
+	EFFLUSH(fp);
+
+	return (0);
+	
+err_exit:
+	return (errno);
+}
+
+/*
+ * Helper routines for writing to the DSDT from other modules.
+ */
+void
+dsdt_line(const char *fmt, ...)
+{
+	va_list ap;
+	int err = 0;
+
+	if (dsdt_error != 0)
+		return;
+
+	if (strcmp(fmt, "") != 0) {
+		if (dsdt_indent_level != 0)
+			EFPRINTF(dsdt_fp, "%*c", dsdt_indent_level * 2, ' ');
+		va_start(ap, fmt);
+		if (vfprintf(dsdt_fp, fmt, ap) < 0)
+			goto err_exit;
+		va_end(ap);
+	}
+	EFPRINTF(dsdt_fp, "\n");
+	return;
+
+err_exit:
+	dsdt_error = errno;
+}
+
+void
+dsdt_indent(int levels)
+{
+
+	dsdt_indent_level += levels;
+	assert(dsdt_indent_level >= 0);
+}
+
+void
+dsdt_unindent(int levels)
+{
+
+	assert(dsdt_indent_level >= levels);
+	dsdt_indent_level -= levels;
+}
+
+void
+dsdt_fixed_ioport(uint16_t iobase, uint16_t length)
+{
+
+	dsdt_line("IO (Decode16,");
+	dsdt_line("  0x%04X,             // Range Minimum", iobase);
+	dsdt_line("  0x%04X,             // Range Maximum", iobase);
+	dsdt_line("  0x01,               // Alignment");
+	dsdt_line("  0x%02X,               // Length", length);
+	dsdt_line("  )");
+}
+
+void
+dsdt_fixed_irq(uint8_t irq)
+{
+
+	dsdt_line("IRQNoFlags ()");
+	dsdt_line("  {%d}", irq);
+}
+
+void
+dsdt_fixed_mem32(uint32_t base, uint32_t length)
+{
+
+	dsdt_line("Memory32Fixed (ReadWrite,");
+	dsdt_line("  0x%08X,         // Address Base", base);
+	dsdt_line("  0x%08X,         // Address Length", length);
+	dsdt_line("  )");
+}
+
+static int
+basl_fwrite_dsdt(FILE *fp)
+{
+	int err;
+
+	err = 0;
+	dsdt_fp = fp;
+	dsdt_error = 0;
+	dsdt_indent_level = 0;
+
+	dsdt_line("/*");
+	dsdt_line(" * bhyve DSDT template");
+	dsdt_line(" */");
+	dsdt_line("DefinitionBlock (\"bhyve_dsdt.aml\", \"DSDT\", 2,"
+		 "\"BHYVE \", \"BVDSDT  \", 0x00000001)");
+	dsdt_line("{");
+	dsdt_line("  Name (_S5, Package ()");
+	dsdt_line("  {");
+	dsdt_line("      0x05,");
+	dsdt_line("      Zero,");
+	dsdt_line("  })");
+
+	pci_write_dsdt();
+
+	dsdt_line("");
+	dsdt_line("  Scope (_SB.PC00)");
+	dsdt_line("  {");
+	dsdt_line("    Device (HPET)");
+	dsdt_line("    {");
+	dsdt_line("      Name (_HID, EISAID(\"PNP0103\"))");
+	dsdt_line("      Name (_UID, 0)");
+	dsdt_line("      Name (_CRS, ResourceTemplate ()");
+	dsdt_line("      {");
+	dsdt_indent(4);
+	dsdt_fixed_mem32(0xFED00000, 0x400);
+	dsdt_unindent(4);
+	dsdt_line("      })");
+	dsdt_line("    }");
+	dsdt_line("  }");
+	dsdt_line("}");
+
+	if (dsdt_error != 0)
+		return (dsdt_error);
+
+	EFFLUSH(fp);
+
+	return (0);
+
+err_exit:
+	return (errno);
+}
+
+static int
+basl_open(struct basl_fio *bf, int suffix)
+{
+	int err;
+
+	err = 0;
+
+	if (suffix) {
+		strlcpy(bf->f_name, basl_stemplate, MAXPATHLEN);
+		bf->fd = mkstemps(bf->f_name, strlen(BHYVE_ASL_SUFFIX));
+	} else {
+		strlcpy(bf->f_name, basl_template, MAXPATHLEN);
+		bf->fd = mkstemp(bf->f_name);
+	}
+
+	if (bf->fd > 0) {
+		bf->fp = fdopen(bf->fd, "w+");
+		if (bf->fp == NULL) {
+			unlink(bf->f_name);
+			close(bf->fd);
+		}
+	} else {
+		err = 1;
+	}
+
+	return (err);
+}
+
+static void
+basl_close(struct basl_fio *bf)
+{
+
+	if (!basl_keep_temps)
+		unlink(bf->f_name);
+	fclose(bf->fp);
+}
+
+static int
+basl_start(struct basl_fio *in, struct basl_fio *out)
+{
+	int err;
+
+	err = basl_open(in, 0);
+	if (!err) {
+		err = basl_open(out, 1);
+		if (err) {
+			basl_close(in);
+		}
+	}
+
+	return (err);
+}
+
+static void
+basl_end(struct basl_fio *in, struct basl_fio *out)
+{
+
+	basl_close(in);
+	basl_close(out);
+}
+
+static int
+basl_load(struct vmctx *ctx, int fd, uint64_t off)
+{
+	struct stat sb;
+	void *gaddr;
+
+	if (fstat(fd, &sb) < 0)
+		return (errno);
+		
+	gaddr = paddr_guest2host(ctx, basl_acpi_base + off, sb.st_size);
+	if (gaddr == NULL)
+		return (EFAULT);
+
+	if (read(fd, gaddr, sb.st_size) < 0)
+		return (errno);
+
+	return (0);
+}
+
+static int
+basl_compile(struct vmctx *ctx, int (*fwrite_section)(FILE *), uint64_t offset)
+{
+	struct basl_fio io[2];
+	static char iaslbuf[3*MAXPATHLEN + 10];
+	char *fmt;
+	int err;
+
+	err = basl_start(&io[0], &io[1]);
+	if (!err) {
+		err = (*fwrite_section)(io[0].fp);
+
+		if (!err) {
+			/*
+			 * iasl sends the results of the compilation to
+			 * stdout. Shut this down by using the shell to
+			 * redirect stdout to /dev/null, unless the user
+			 * has requested verbose output for debugging
+			 * purposes
+			 */
+			fmt = basl_verbose_iasl ?
+				"%s -p %s %s" :
+				"/bin/sh -c \"%s -p %s %s\" 1> /dev/null";
+				
+			snprintf(iaslbuf, sizeof(iaslbuf),
+				 fmt,
+				 BHYVE_ASL_COMPILER,
+				 io[1].f_name, io[0].f_name);
+			err = system(iaslbuf);
+
+			if (!err) {
+				/*
+				 * Copy the aml output file into guest
+				 * memory at the specified location
+				 */
+				err = basl_load(ctx, io[1].fd, offset);
+			}
+		}
+		basl_end(&io[0], &io[1]);
+	}
+
+	return (err);
+}
+
+static int
+basl_make_templates(void)
+{
+	const char *tmpdir;
+	int err;
+	int len;
+
+	err = 0;
+	
+	/*
+	 * 
+	 */
+	if ((tmpdir = getenv("BHYVE_TMPDIR")) == NULL || *tmpdir == '\0' ||
+	    (tmpdir = getenv("TMPDIR")) == NULL || *tmpdir == '\0') {
+		tmpdir = _PATH_TMP;
+	}
+
+	len = strlen(tmpdir);
+
+	if ((len + sizeof(BHYVE_ASL_TEMPLATE) + 1) < MAXPATHLEN) {
+		strcpy(basl_template, tmpdir);
+		while (len > 0 && basl_template[len - 1] == '/')
+			len--;
+		basl_template[len] = '/';
+		strcpy(&basl_template[len + 1], BHYVE_ASL_TEMPLATE);
+	} else
+		err = E2BIG;
+
+	if (!err) {
+		/*
+		 * len has been intialized (and maybe adjusted) above
+		 */
+		if ((len + sizeof(BHYVE_ASL_TEMPLATE) + 1 +
+		     sizeof(BHYVE_ASL_SUFFIX)) < MAXPATHLEN) {
+			strcpy(basl_stemplate, tmpdir);
+			basl_stemplate[len] = '/';
+			strcpy(&basl_stemplate[len + 1], BHYVE_ASL_TEMPLATE);
+			len = strlen(basl_stemplate);
+			strcpy(&basl_stemplate[len], BHYVE_ASL_SUFFIX);
+		} else
+			err = E2BIG;
+	}
+
+	return (err);
+}
+
+static struct {
+	int	(*wsect)(FILE *fp);
+	uint64_t  offset;
+} basl_ftables[] =
+{
+	{ basl_fwrite_rsdp, 0},
+	{ basl_fwrite_rsdt, RSDT_OFFSET },
+	{ basl_fwrite_xsdt, XSDT_OFFSET },
+	{ basl_fwrite_madt, MADT_OFFSET },
+	{ basl_fwrite_fadt, FADT_OFFSET },
+	{ basl_fwrite_hpet, HPET_OFFSET },
+	{ basl_fwrite_mcfg, MCFG_OFFSET },
+	{ basl_fwrite_facs, FACS_OFFSET },
+	{ basl_fwrite_dsdt, DSDT_OFFSET },
+	{ NULL }
+};
+
+int
+acpi_build(struct vmctx *ctx, int ncpu)
+{
+	int err;
+	int i;
+
+	basl_ncpu = ncpu;
+
+	err = vm_get_hpet_capabilities(ctx, &hpet_capabilities);
+	if (err != 0)
+		return (err);
+
+	/*
+	 * For debug, allow the user to have iasl compiler output sent
+	 * to stdout rather than /dev/null
+	 */
+	if (getenv("BHYVE_ACPI_VERBOSE_IASL"))
+		basl_verbose_iasl = 1;
+
+	/*
+	 * Allow the user to keep the generated ASL files for debugging
+	 * instead of deleting them following use
+	 */
+	if (getenv("BHYVE_ACPI_KEEPTMPS"))
+		basl_keep_temps = 1;
+
+	i = 0;
+	err = basl_make_templates();
+
+	/*
+	 * Run through all the ASL files, compiling them and
+	 * copying them into guest memory
+	 */
+	while (!err && basl_ftables[i].wsect != NULL) {
+		err = basl_compile(ctx, basl_ftables[i].wsect,
+				   basl_ftables[i].offset);
+		i++;
+	}
+
+	return (err);
+}
diff --git a/usr/src/cmd/bhyve/acpi.h b/usr/src/cmd/bhyve/acpi.h
new file mode 100644
index 0000000000..4c6d86d091
--- /dev/null
+++ b/usr/src/cmd/bhyve/acpi.h
@@ -0,0 +1,56 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _ACPI_H_
+#define _ACPI_H_
+
+#define	SCI_INT			9
+
+#define	SMI_CMD			0xb2
+#define	BHYVE_ACPI_ENABLE	0xa0
+#define	BHYVE_ACPI_DISABLE	0xa1
+
+#define	PM1A_EVT_ADDR		0x400
+#define	PM1A_CNT_ADDR		0x404
+
+#define	IO_PMTMR		0x408	/* 4-byte i/o port for the timer */
+
+struct vmctx;
+
+int	acpi_build(struct vmctx *ctx, int ncpu);
+void	dsdt_line(const char *fmt, ...);
+void	dsdt_fixed_ioport(uint16_t iobase, uint16_t length);
+void	dsdt_fixed_irq(uint8_t irq);
+void	dsdt_fixed_mem32(uint32_t base, uint32_t length);
+void	dsdt_indent(int levels);
+void	dsdt_unindent(int levels);
+void	sci_init(struct vmctx *ctx);
+
+#endif /* _ACPI_H_ */
diff --git a/usr/src/cmd/bhyve/ahci.h b/usr/src/cmd/bhyve/ahci.h
new file mode 100644
index 0000000000..1fd3bff99c
--- /dev/null
+++ b/usr/src/cmd/bhyve/ahci.h
@@ -0,0 +1,324 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 1998 - 2008 Søren Schmidt <sos@FreeBSD.org>
+ * Copyright (c) 2009-2012 Alexander Motin <mav@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer,
+ *    without modification, immediately at the beginning of the file.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _AHCI_H_
+#define	_AHCI_H_
+
+/* ATA register defines */
+#define ATA_DATA                        0       /* (RW) data */
+
+#define ATA_FEATURE                     1       /* (W) feature */
+#define         ATA_F_DMA               0x01    /* enable DMA */
+#define         ATA_F_OVL               0x02    /* enable overlap */
+
+#define ATA_COUNT                       2       /* (W) sector count */
+
+#define ATA_SECTOR                      3       /* (RW) sector # */
+#define ATA_CYL_LSB                     4       /* (RW) cylinder# LSB */
+#define ATA_CYL_MSB                     5       /* (RW) cylinder# MSB */
+#define ATA_DRIVE                       6       /* (W) Sector/Drive/Head */
+#define         ATA_D_LBA               0x40    /* use LBA addressing */
+#define         ATA_D_IBM               0xa0    /* 512 byte sectors, ECC */
+
+#define ATA_COMMAND                     7       /* (W) command */
+
+#define ATA_ERROR                       8       /* (R) error */
+#define         ATA_E_ILI               0x01    /* illegal length */
+#define         ATA_E_NM                0x02    /* no media */
+#define         ATA_E_ABORT             0x04    /* command aborted */
+#define         ATA_E_MCR               0x08    /* media change request */
+#define         ATA_E_IDNF              0x10    /* ID not found */
+#define         ATA_E_MC                0x20    /* media changed */
+#define         ATA_E_UNC               0x40    /* uncorrectable data */
+#define         ATA_E_ICRC              0x80    /* UDMA crc error */
+#define		ATA_E_ATAPI_SENSE_MASK	0xf0	/* ATAPI sense key mask */
+
+#define ATA_IREASON                     9       /* (R) interrupt reason */
+#define         ATA_I_CMD               0x01    /* cmd (1) | data (0) */
+#define         ATA_I_IN                0x02    /* read (1) | write (0) */
+#define         ATA_I_RELEASE           0x04    /* released bus (1) */
+#define         ATA_I_TAGMASK           0xf8    /* tag mask */
+
+#define ATA_STATUS                      10      /* (R) status */
+#define ATA_ALTSTAT                     11      /* (R) alternate status */
+#define         ATA_S_ERROR             0x01    /* error */
+#define         ATA_S_INDEX             0x02    /* index */
+#define         ATA_S_CORR              0x04    /* data corrected */
+#define         ATA_S_DRQ               0x08    /* data request */
+#define         ATA_S_DSC               0x10    /* drive seek completed */
+#define         ATA_S_SERVICE           0x10    /* drive needs service */
+#define         ATA_S_DWF               0x20    /* drive write fault */
+#define         ATA_S_DMA               0x20    /* DMA ready */
+#define         ATA_S_READY             0x40    /* drive ready */
+#define         ATA_S_BUSY              0x80    /* busy */
+
+#define ATA_CONTROL                     12      /* (W) control */
+#define         ATA_A_IDS               0x02    /* disable interrupts */
+#define         ATA_A_RESET             0x04    /* RESET controller */
+#define         ATA_A_4BIT              0x08    /* 4 head bits */
+#define         ATA_A_HOB               0x80    /* High Order Byte enable */
+
+/* SATA register defines */
+#define ATA_SSTATUS                     13
+#define         ATA_SS_DET_MASK         0x0000000f
+#define         ATA_SS_DET_NO_DEVICE    0x00000000
+#define         ATA_SS_DET_DEV_PRESENT  0x00000001
+#define         ATA_SS_DET_PHY_ONLINE   0x00000003
+#define         ATA_SS_DET_PHY_OFFLINE  0x00000004
+
+#define         ATA_SS_SPD_MASK         0x000000f0
+#define         ATA_SS_SPD_NO_SPEED     0x00000000
+#define         ATA_SS_SPD_GEN1         0x00000010
+#define         ATA_SS_SPD_GEN2         0x00000020
+#define         ATA_SS_SPD_GEN3         0x00000030
+
+#define         ATA_SS_IPM_MASK         0x00000f00
+#define         ATA_SS_IPM_NO_DEVICE    0x00000000
+#define         ATA_SS_IPM_ACTIVE       0x00000100
+#define         ATA_SS_IPM_PARTIAL      0x00000200
+#define         ATA_SS_IPM_SLUMBER      0x00000600
+#define         ATA_SS_IPM_DEVSLEEP     0x00000800
+
+#define ATA_SERROR                      14
+#define         ATA_SE_DATA_CORRECTED   0x00000001
+#define         ATA_SE_COMM_CORRECTED   0x00000002
+#define         ATA_SE_DATA_ERR         0x00000100
+#define         ATA_SE_COMM_ERR         0x00000200
+#define         ATA_SE_PROT_ERR         0x00000400
+#define         ATA_SE_HOST_ERR         0x00000800
+#define         ATA_SE_PHY_CHANGED      0x00010000
+#define         ATA_SE_PHY_IERROR       0x00020000
+#define         ATA_SE_COMM_WAKE        0x00040000
+#define         ATA_SE_DECODE_ERR       0x00080000
+#define         ATA_SE_PARITY_ERR       0x00100000
+#define         ATA_SE_CRC_ERR          0x00200000
+#define         ATA_SE_HANDSHAKE_ERR    0x00400000
+#define         ATA_SE_LINKSEQ_ERR      0x00800000
+#define         ATA_SE_TRANSPORT_ERR    0x01000000
+#define         ATA_SE_UNKNOWN_FIS      0x02000000
+#define         ATA_SE_EXCHANGED        0x04000000
+
+#define ATA_SCONTROL                    15
+#define         ATA_SC_DET_MASK         0x0000000f
+#define         ATA_SC_DET_IDLE         0x00000000
+#define         ATA_SC_DET_RESET        0x00000001
+#define         ATA_SC_DET_DISABLE      0x00000004
+
+#define         ATA_SC_SPD_MASK         0x000000f0
+#define         ATA_SC_SPD_NO_SPEED     0x00000000
+#define         ATA_SC_SPD_SPEED_GEN1   0x00000010
+#define         ATA_SC_SPD_SPEED_GEN2   0x00000020
+#define         ATA_SC_SPD_SPEED_GEN3   0x00000030
+
+#define         ATA_SC_IPM_MASK         0x00000f00
+#define         ATA_SC_IPM_NONE         0x00000000
+#define         ATA_SC_IPM_DIS_PARTIAL  0x00000100
+#define         ATA_SC_IPM_DIS_SLUMBER  0x00000200
+#define         ATA_SC_IPM_DIS_DEVSLEEP 0x00000400
+
+#define ATA_SACTIVE                     16
+
+#define AHCI_MAX_PORTS			32
+#define AHCI_MAX_SLOTS			32
+#define AHCI_MAX_IRQS			16
+
+/* SATA AHCI v1.0 register defines */
+#define AHCI_CAP                    0x00
+#define		AHCI_CAP_NPMASK	0x0000001f
+#define		AHCI_CAP_SXS	0x00000020
+#define		AHCI_CAP_EMS	0x00000040
+#define		AHCI_CAP_CCCS	0x00000080
+#define		AHCI_CAP_NCS	0x00001F00
+#define		AHCI_CAP_NCS_SHIFT	8
+#define		AHCI_CAP_PSC	0x00002000
+#define		AHCI_CAP_SSC	0x00004000
+#define		AHCI_CAP_PMD	0x00008000
+#define		AHCI_CAP_FBSS	0x00010000
+#define		AHCI_CAP_SPM	0x00020000
+#define		AHCI_CAP_SAM	0x00080000
+#define		AHCI_CAP_ISS	0x00F00000
+#define		AHCI_CAP_ISS_SHIFT	20
+#define		AHCI_CAP_SCLO	0x01000000
+#define		AHCI_CAP_SAL	0x02000000
+#define		AHCI_CAP_SALP	0x04000000
+#define		AHCI_CAP_SSS	0x08000000
+#define		AHCI_CAP_SMPS	0x10000000
+#define		AHCI_CAP_SSNTF	0x20000000
+#define		AHCI_CAP_SNCQ	0x40000000
+#define		AHCI_CAP_64BIT	0x80000000
+
+#define AHCI_GHC                    0x04
+#define         AHCI_GHC_AE         0x80000000
+#define         AHCI_GHC_MRSM       0x00000004
+#define         AHCI_GHC_IE         0x00000002
+#define         AHCI_GHC_HR         0x00000001
+
+#define AHCI_IS                     0x08
+#define AHCI_PI                     0x0c
+#define AHCI_VS                     0x10
+
+#define AHCI_CCCC                   0x14
+#define		AHCI_CCCC_TV_MASK	0xffff0000
+#define		AHCI_CCCC_TV_SHIFT	16
+#define		AHCI_CCCC_CC_MASK	0x0000ff00
+#define		AHCI_CCCC_CC_SHIFT	8
+#define		AHCI_CCCC_INT_MASK	0x000000f8
+#define		AHCI_CCCC_INT_SHIFT	3
+#define		AHCI_CCCC_EN		0x00000001
+#define AHCI_CCCP                   0x18
+
+#define AHCI_EM_LOC                 0x1C
+#define AHCI_EM_CTL                 0x20
+#define 	AHCI_EM_MR              0x00000001
+#define 	AHCI_EM_TM              0x00000100
+#define 	AHCI_EM_RST             0x00000200
+#define 	AHCI_EM_LED             0x00010000
+#define 	AHCI_EM_SAFTE           0x00020000
+#define 	AHCI_EM_SES2            0x00040000
+#define 	AHCI_EM_SGPIO           0x00080000
+#define 	AHCI_EM_SMB             0x01000000
+#define 	AHCI_EM_XMT             0x02000000
+#define 	AHCI_EM_ALHD            0x04000000
+#define 	AHCI_EM_PM              0x08000000
+
+#define AHCI_CAP2                   0x24
+#define		AHCI_CAP2_BOH	0x00000001
+#define		AHCI_CAP2_NVMP	0x00000002
+#define		AHCI_CAP2_APST	0x00000004
+#define		AHCI_CAP2_SDS	0x00000008
+#define		AHCI_CAP2_SADM	0x00000010
+#define		AHCI_CAP2_DESO	0x00000020
+
+#define AHCI_OFFSET                 0x100
+#define AHCI_STEP                   0x80
+
+#define AHCI_P_CLB                  0x00
+#define AHCI_P_CLBU                 0x04
+#define AHCI_P_FB                   0x08
+#define AHCI_P_FBU                  0x0c
+#define AHCI_P_IS                   0x10
+#define AHCI_P_IE                   0x14
+#define         AHCI_P_IX_DHR       0x00000001
+#define         AHCI_P_IX_PS        0x00000002
+#define         AHCI_P_IX_DS        0x00000004
+#define         AHCI_P_IX_SDB       0x00000008
+#define         AHCI_P_IX_UF        0x00000010
+#define         AHCI_P_IX_DP        0x00000020
+#define         AHCI_P_IX_PC        0x00000040
+#define         AHCI_P_IX_MP        0x00000080
+
+#define         AHCI_P_IX_PRC       0x00400000
+#define         AHCI_P_IX_IPM       0x00800000
+#define         AHCI_P_IX_OF        0x01000000
+#define         AHCI_P_IX_INF       0x04000000
+#define         AHCI_P_IX_IF        0x08000000
+#define         AHCI_P_IX_HBD       0x10000000
+#define         AHCI_P_IX_HBF       0x20000000
+#define         AHCI_P_IX_TFE       0x40000000
+#define         AHCI_P_IX_CPD       0x80000000
+
+#define AHCI_P_CMD                  0x18
+#define         AHCI_P_CMD_ST       0x00000001
+#define         AHCI_P_CMD_SUD      0x00000002
+#define         AHCI_P_CMD_POD      0x00000004
+#define         AHCI_P_CMD_CLO      0x00000008
+#define         AHCI_P_CMD_FRE      0x00000010
+#define         AHCI_P_CMD_CCS_MASK 0x00001f00
+#define         AHCI_P_CMD_CCS_SHIFT 8
+#define         AHCI_P_CMD_ISS      0x00002000
+#define         AHCI_P_CMD_FR       0x00004000
+#define         AHCI_P_CMD_CR       0x00008000
+#define         AHCI_P_CMD_CPS      0x00010000
+#define         AHCI_P_CMD_PMA      0x00020000
+#define         AHCI_P_CMD_HPCP     0x00040000
+#define         AHCI_P_CMD_MPSP     0x00080000
+#define         AHCI_P_CMD_CPD      0x00100000
+#define         AHCI_P_CMD_ESP      0x00200000
+#define         AHCI_P_CMD_FBSCP    0x00400000
+#define         AHCI_P_CMD_APSTE    0x00800000
+#define         AHCI_P_CMD_ATAPI    0x01000000
+#define         AHCI_P_CMD_DLAE     0x02000000
+#define         AHCI_P_CMD_ALPE     0x04000000
+#define         AHCI_P_CMD_ASP      0x08000000
+#define         AHCI_P_CMD_ICC_MASK 0xf0000000
+#define         AHCI_P_CMD_NOOP     0x00000000
+#define         AHCI_P_CMD_ACTIVE   0x10000000
+#define         AHCI_P_CMD_PARTIAL  0x20000000
+#define         AHCI_P_CMD_SLUMBER  0x60000000
+#define         AHCI_P_CMD_DEVSLEEP 0x80000000
+
+#define AHCI_P_TFD                  0x20
+#define AHCI_P_SIG                  0x24
+#define AHCI_P_SSTS                 0x28
+#define AHCI_P_SCTL                 0x2c
+#define AHCI_P_SERR                 0x30
+#define AHCI_P_SACT                 0x34
+#define AHCI_P_CI                   0x38
+#define AHCI_P_SNTF                 0x3C
+#define AHCI_P_FBS                  0x40
+#define 	AHCI_P_FBS_EN       0x00000001
+#define 	AHCI_P_FBS_DEC      0x00000002
+#define 	AHCI_P_FBS_SDE      0x00000004
+#define 	AHCI_P_FBS_DEV      0x00000f00
+#define 	AHCI_P_FBS_DEV_SHIFT 8
+#define 	AHCI_P_FBS_ADO      0x0000f000
+#define 	AHCI_P_FBS_ADO_SHIFT 12
+#define 	AHCI_P_FBS_DWE      0x000f0000
+#define 	AHCI_P_FBS_DWE_SHIFT 16
+#define AHCI_P_DEVSLP               0x44
+#define 	AHCI_P_DEVSLP_ADSE  0x00000001
+#define 	AHCI_P_DEVSLP_DSP   0x00000002
+#define 	AHCI_P_DEVSLP_DETO  0x000003fc
+#define 	AHCI_P_DEVSLP_DETO_SHIFT 2
+#define 	AHCI_P_DEVSLP_MDAT  0x00007c00
+#define 	AHCI_P_DEVSLP_MDAT_SHIFT 10
+#define 	AHCI_P_DEVSLP_DITO  0x01ff8000
+#define 	AHCI_P_DEVSLP_DITO_SHIFT 15
+#define 	AHCI_P_DEVSLP_DM    0x0e000000
+#define 	AHCI_P_DEVSLP_DM_SHIFT 25
+
+/* Just to be sure, if building as module. */
+#if MAXPHYS < 512 * 1024
+#undef MAXPHYS
+#define MAXPHYS				512 * 1024
+#endif
+/* Pessimistic prognosis on number of required S/G entries */
+#define AHCI_SG_ENTRIES	(roundup(btoc(MAXPHYS) + 1, 8))
+/* Command list. 32 commands. First, 1Kbyte aligned. */
+#define AHCI_CL_OFFSET              0
+#define AHCI_CL_SIZE                32
+/* Command tables. Up to 32 commands, Each, 128byte aligned. */
+#define AHCI_CT_OFFSET              (AHCI_CL_OFFSET + AHCI_CL_SIZE * AHCI_MAX_SLOTS)
+#define AHCI_CT_SIZE                (128 + AHCI_SG_ENTRIES * 16)
+/* Total main work area. */
+#define AHCI_WORK_SIZE              (AHCI_CT_OFFSET + AHCI_CT_SIZE * ch->numslots)
+
+#endif /* _AHCI_H_ */
diff --git a/usr/src/cmd/bhyve/atkbdc.c b/usr/src/cmd/bhyve/atkbdc.c
new file mode 100644
index 0000000000..8e71b0507c
--- /dev/null
+++ b/usr/src/cmd/bhyve/atkbdc.c
@@ -0,0 +1,583 @@
+/*-
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2015 Nahanni Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <machine/vmm.h>
+
+#include <vmmapi.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <pthread_np.h>
+
+#include "acpi.h"
+#include "inout.h"
+#include "pci_emul.h"
+#include "pci_irq.h"
+#include "pci_lpc.h"
+#include "ps2kbd.h"
+#include "ps2mouse.h"
+
+#define	KBD_DATA_PORT		0x60
+
+#define	KBD_STS_CTL_PORT	0x64
+
+#define	KBDC_RESET		0xfe
+
+#define	KBD_DEV_IRQ		1
+#define	AUX_DEV_IRQ		12
+
+/* controller commands */
+#define	KBDC_SET_COMMAND_BYTE	0x60
+#define	KBDC_GET_COMMAND_BYTE	0x20
+#define	KBDC_DISABLE_AUX_PORT	0xa7
+#define	KBDC_ENABLE_AUX_PORT	0xa8
+#define	KBDC_TEST_AUX_PORT	0xa9
+#define	KBDC_TEST_CTRL		0xaa
+#define	KBDC_TEST_KBD_PORT	0xab
+#define	KBDC_DISABLE_KBD_PORT	0xad
+#define	KBDC_ENABLE_KBD_PORT	0xae
+#define	KBDC_READ_INPORT	0xc0
+#define	KBDC_READ_OUTPORT	0xd0
+#define	KBDC_WRITE_OUTPORT	0xd1
+#define	KBDC_WRITE_KBD_OUTBUF	0xd2
+#define	KBDC_WRITE_AUX_OUTBUF	0xd3
+#define	KBDC_WRITE_TO_AUX	0xd4
+
+/* controller command byte (set by KBDC_SET_COMMAND_BYTE) */
+#define	KBD_TRANSLATION		0x40
+#define	KBD_SYS_FLAG_BIT	0x04
+#define	KBD_DISABLE_KBD_PORT	0x10
+#define	KBD_DISABLE_AUX_PORT	0x20
+#define	KBD_ENABLE_AUX_INT	0x02
+#define	KBD_ENABLE_KBD_INT	0x01
+#define	KBD_KBD_CONTROL_BITS	(KBD_DISABLE_KBD_PORT | KBD_ENABLE_KBD_INT)
+#define	KBD_AUX_CONTROL_BITS	(KBD_DISABLE_AUX_PORT | KBD_ENABLE_AUX_INT)
+
+/* controller status bits */
+#define	KBDS_KBD_BUFFER_FULL	0x01
+#define KBDS_SYS_FLAG		0x04
+#define KBDS_CTRL_FLAG		0x08
+#define	KBDS_AUX_BUFFER_FULL	0x20
+
+/* controller output port */
+#define	KBDO_KBD_OUTFULL	0x10
+#define	KBDO_AUX_OUTFULL	0x20
+
+#define	RAMSZ			32
+#define	FIFOSZ			15
+#define	CTRL_CMD_FLAG		0x8000
+
+struct kbd_dev {
+	bool	irq_active;
+	int	irq;
+
+	uint8_t	buffer[FIFOSZ];
+	int	brd, bwr;
+	int	bcnt;
+};
+
+struct aux_dev {
+	bool	irq_active;
+	int	irq;
+};
+
+struct atkbdc_softc {
+	struct vmctx *ctx;
+	pthread_mutex_t mtx;
+
+	struct ps2kbd_softc	*ps2kbd_sc;
+	struct ps2mouse_softc	*ps2mouse_sc;
+
+	uint8_t	status;		/* status register */
+	uint8_t	outport;	/* controller output port */
+	uint8_t	ram[RAMSZ];	/* byte0 = controller config */
+
+	uint32_t curcmd;	/* current command for next byte */
+	uint32_t  ctrlbyte;
+
+	struct kbd_dev kbd;
+	struct aux_dev aux;
+};
+
+static void
+atkbdc_assert_kbd_intr(struct atkbdc_softc *sc)
+{
+	if ((sc->ram[0] & KBD_ENABLE_KBD_INT) != 0) {
+		sc->kbd.irq_active = true;
+		vm_isa_pulse_irq(sc->ctx, sc->kbd.irq, sc->kbd.irq);
+	}
+}
+
+static void
+atkbdc_assert_aux_intr(struct atkbdc_softc *sc)
+{
+	if ((sc->ram[0] & KBD_ENABLE_AUX_INT) != 0) {
+		sc->aux.irq_active = true;
+		vm_isa_pulse_irq(sc->ctx, sc->aux.irq, sc->aux.irq);
+	}
+}
+
+static int
+atkbdc_kbd_queue_data(struct atkbdc_softc *sc, uint8_t val)
+{
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+
+	if (sc->kbd.bcnt < FIFOSZ) {
+		sc->kbd.buffer[sc->kbd.bwr] = val;
+		sc->kbd.bwr = (sc->kbd.bwr + 1) % FIFOSZ;
+		sc->kbd.bcnt++;
+		sc->status |= KBDS_KBD_BUFFER_FULL;
+		sc->outport |= KBDO_KBD_OUTFULL;
+	} else {
+		printf("atkbd data buffer full\n");
+	}
+
+	return (sc->kbd.bcnt < FIFOSZ);
+}
+
+static void
+atkbdc_kbd_read(struct atkbdc_softc *sc)
+{
+	const uint8_t translation[256] = {
+		0xff, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x3c, 0x58,
+		0x64, 0x44, 0x42, 0x40, 0x3e, 0x0f, 0x29, 0x59,
+		0x65, 0x38, 0x2a, 0x70, 0x1d, 0x10, 0x02, 0x5a,
+		0x66, 0x71, 0x2c, 0x1f, 0x1e, 0x11, 0x03, 0x5b,
+		0x67, 0x2e, 0x2d, 0x20, 0x12, 0x05, 0x04, 0x5c,
+		0x68, 0x39, 0x2f, 0x21, 0x14, 0x13, 0x06, 0x5d,
+		0x69, 0x31, 0x30, 0x23, 0x22, 0x15, 0x07, 0x5e,
+		0x6a, 0x72, 0x32, 0x24, 0x16, 0x08, 0x09, 0x5f,
+		0x6b, 0x33, 0x25, 0x17, 0x18, 0x0b, 0x0a, 0x60,
+		0x6c, 0x34, 0x35, 0x26, 0x27, 0x19, 0x0c, 0x61,
+		0x6d, 0x73, 0x28, 0x74, 0x1a, 0x0d, 0x62, 0x6e,
+		0x3a, 0x36, 0x1c, 0x1b, 0x75, 0x2b, 0x63, 0x76,
+		0x55, 0x56, 0x77, 0x78, 0x79, 0x7a, 0x0e, 0x7b,
+		0x7c, 0x4f, 0x7d, 0x4b, 0x47, 0x7e, 0x7f, 0x6f,
+		0x52, 0x53, 0x50, 0x4c, 0x4d, 0x48, 0x01, 0x45,
+		0x57, 0x4e, 0x51, 0x4a, 0x37, 0x49, 0x46, 0x54,
+		0x80, 0x81, 0x82, 0x41, 0x54, 0x85, 0x86, 0x87,
+		0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+		0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+		0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f,
+		0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+		0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
+		0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
+		0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
+		0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+		0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf,
+		0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
+		0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
+		0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7,
+		0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
+		0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+		0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
+	};
+	uint8_t val;
+	uint8_t release = 0;
+
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+
+	if (sc->ram[0] & KBD_TRANSLATION) {
+		while (ps2kbd_read(sc->ps2kbd_sc, &val) != -1) {
+			if (val == 0xf0) {
+				release = 0x80;
+				continue;
+			} else {
+				val = translation[val] | release;
+			}
+			atkbdc_kbd_queue_data(sc, val);
+			break;
+		}
+	} else {
+		while (sc->kbd.bcnt < FIFOSZ) {
+			if (ps2kbd_read(sc->ps2kbd_sc, &val) != -1)
+				atkbdc_kbd_queue_data(sc, val);
+			else
+				break;
+		}
+	}
+
+	if (((sc->ram[0] & KBD_DISABLE_AUX_PORT) ||
+	    ps2mouse_fifocnt(sc->ps2mouse_sc) == 0) && sc->kbd.bcnt > 0)
+		atkbdc_assert_kbd_intr(sc);
+}
+
+static void
+atkbdc_aux_poll(struct atkbdc_softc *sc)
+{
+	if (ps2mouse_fifocnt(sc->ps2mouse_sc) > 0) {
+		sc->status |= KBDS_AUX_BUFFER_FULL | KBDS_KBD_BUFFER_FULL;
+		sc->outport |= KBDO_AUX_OUTFULL;
+		atkbdc_assert_aux_intr(sc);
+	}
+}
+
+static void
+atkbdc_kbd_poll(struct atkbdc_softc *sc)
+{
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+
+	atkbdc_kbd_read(sc);
+}
+
+static void
+atkbdc_poll(struct atkbdc_softc *sc)
+{
+	atkbdc_aux_poll(sc);
+	atkbdc_kbd_poll(sc);
+}
+
+static void
+atkbdc_dequeue_data(struct atkbdc_softc *sc, uint8_t *buf)
+{
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+
+	if (ps2mouse_read(sc->ps2mouse_sc, buf) == 0) {
+		if (ps2mouse_fifocnt(sc->ps2mouse_sc) == 0) {
+			if (sc->kbd.bcnt == 0)
+				sc->status &= ~(KBDS_AUX_BUFFER_FULL |
+				                KBDS_KBD_BUFFER_FULL);
+			else
+				sc->status &= ~(KBDS_AUX_BUFFER_FULL);
+			sc->outport &= ~KBDO_AUX_OUTFULL;
+		}
+
+		atkbdc_poll(sc);
+		return;
+	}
+
+	if (sc->kbd.bcnt > 0) {
+		*buf = sc->kbd.buffer[sc->kbd.brd];
+		sc->kbd.brd = (sc->kbd.brd + 1) % FIFOSZ;
+		sc->kbd.bcnt--;
+		if (sc->kbd.bcnt == 0) {
+			sc->status &= ~KBDS_KBD_BUFFER_FULL;
+			sc->outport &= ~KBDO_KBD_OUTFULL;
+		}
+
+		atkbdc_poll(sc);
+	}
+
+	if (ps2mouse_fifocnt(sc->ps2mouse_sc) == 0 && sc->kbd.bcnt == 0) {
+		sc->status &= ~(KBDS_AUX_BUFFER_FULL | KBDS_KBD_BUFFER_FULL);
+	}
+}
+
+static int
+atkbdc_data_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+    uint32_t *eax, void *arg)
+{
+	struct atkbdc_softc *sc;
+	uint8_t buf;
+	int retval;
+
+	if (bytes != 1)
+		return (-1);
+	sc = arg;
+	retval = 0;
+
+	pthread_mutex_lock(&sc->mtx);
+	if (in) {
+		sc->curcmd = 0;
+		if (sc->ctrlbyte != 0) {
+			*eax = sc->ctrlbyte & 0xff;
+			sc->ctrlbyte = 0;
+		} else {
+			/* read device buffer; includes kbd cmd responses */
+			atkbdc_dequeue_data(sc, &buf);
+			*eax = buf;
+		}
+
+		sc->status &= ~KBDS_CTRL_FLAG;
+		pthread_mutex_unlock(&sc->mtx);
+		return (retval);
+	}
+
+	if (sc->status & KBDS_CTRL_FLAG) {
+		/*
+		 * Command byte for the controller.
+		 */
+		switch (sc->curcmd) {
+		case KBDC_SET_COMMAND_BYTE:
+			sc->ram[0] = *eax;
+			if (sc->ram[0] & KBD_SYS_FLAG_BIT)
+				sc->status |= KBDS_SYS_FLAG;
+			else
+				sc->status &= ~KBDS_SYS_FLAG;
+			break;
+		case KBDC_WRITE_OUTPORT:
+			sc->outport = *eax;
+			break;
+		case KBDC_WRITE_TO_AUX:
+			ps2mouse_write(sc->ps2mouse_sc, *eax, 0);
+			atkbdc_poll(sc);
+			break;
+		case KBDC_WRITE_KBD_OUTBUF:
+			atkbdc_kbd_queue_data(sc, *eax);
+			break;
+		case KBDC_WRITE_AUX_OUTBUF:
+			ps2mouse_write(sc->ps2mouse_sc, *eax, 1);
+			sc->status |= (KBDS_AUX_BUFFER_FULL | KBDS_KBD_BUFFER_FULL);
+			atkbdc_aux_poll(sc);
+			break;
+		default:
+			/* write to particular RAM byte */
+			if (sc->curcmd >= 0x61 && sc->curcmd <= 0x7f) {
+				int byten;
+
+				byten = (sc->curcmd - 0x60) & 0x1f;
+				sc->ram[byten] = *eax & 0xff;
+			}
+			break;
+		}
+
+		sc->curcmd = 0;
+		sc->status &= ~KBDS_CTRL_FLAG;
+
+		pthread_mutex_unlock(&sc->mtx);
+		return (retval);
+	}
+
+	/*
+	 * Data byte for the device.
+	 */
+	ps2kbd_write(sc->ps2kbd_sc, *eax);
+	atkbdc_poll(sc);
+
+	pthread_mutex_unlock(&sc->mtx);
+
+	return (retval);
+}
+
+static int
+atkbdc_sts_ctl_handler(struct vmctx *ctx, int vcpu, int in, int port,
+    int bytes, uint32_t *eax, void *arg)
+{
+	struct atkbdc_softc *sc;
+	int	error, retval;
+
+	if (bytes != 1)
+		return (-1);
+
+	sc = arg;
+	retval = 0;
+
+	pthread_mutex_lock(&sc->mtx);
+
+	if (in) {
+		/* read status register */
+		*eax = sc->status;
+		pthread_mutex_unlock(&sc->mtx);
+		return (retval);
+	}
+
+
+	sc->curcmd = 0;
+	sc->status |= KBDS_CTRL_FLAG;
+	sc->ctrlbyte = 0;
+
+	switch (*eax) {
+	case KBDC_GET_COMMAND_BYTE:
+		sc->ctrlbyte = CTRL_CMD_FLAG | sc->ram[0];
+		break;
+	case KBDC_TEST_CTRL:
+		sc->ctrlbyte = CTRL_CMD_FLAG | 0x55;
+		break;
+	case KBDC_TEST_AUX_PORT:
+	case KBDC_TEST_KBD_PORT:
+		sc->ctrlbyte = CTRL_CMD_FLAG | 0;
+		break;
+	case KBDC_READ_INPORT:
+		sc->ctrlbyte = CTRL_CMD_FLAG | 0;
+		break;
+	case KBDC_READ_OUTPORT:
+		sc->ctrlbyte = CTRL_CMD_FLAG | sc->outport;
+		break;
+	case KBDC_SET_COMMAND_BYTE:
+	case KBDC_WRITE_OUTPORT:
+	case KBDC_WRITE_KBD_OUTBUF:
+	case KBDC_WRITE_AUX_OUTBUF:
+		sc->curcmd = *eax;
+		break;
+	case KBDC_DISABLE_KBD_PORT:
+		sc->ram[0] |= KBD_DISABLE_KBD_PORT;
+		break;
+	case KBDC_ENABLE_KBD_PORT:
+		sc->ram[0] &= ~KBD_DISABLE_KBD_PORT;
+		if (sc->kbd.bcnt > 0)
+			sc->status |= KBDS_KBD_BUFFER_FULL;
+		atkbdc_poll(sc);
+		break;
+	case KBDC_WRITE_TO_AUX:
+		sc->curcmd = *eax;
+		break;
+	case KBDC_DISABLE_AUX_PORT:
+		sc->ram[0] |= KBD_DISABLE_AUX_PORT;
+		ps2mouse_toggle(sc->ps2mouse_sc, 0);
+		sc->status &= ~(KBDS_AUX_BUFFER_FULL | KBDS_KBD_BUFFER_FULL);
+		sc->outport &= ~KBDS_AUX_BUFFER_FULL;
+		break;
+	case KBDC_ENABLE_AUX_PORT:
+		sc->ram[0] &= ~KBD_DISABLE_AUX_PORT;
+		ps2mouse_toggle(sc->ps2mouse_sc, 1);
+		if (ps2mouse_fifocnt(sc->ps2mouse_sc) > 0)
+			sc->status |= KBDS_AUX_BUFFER_FULL | KBDS_KBD_BUFFER_FULL;
+		break;
+	case KBDC_RESET:		/* Pulse "reset" line */
+		error = vm_suspend(ctx, VM_SUSPEND_RESET);
+		assert(error == 0 || errno == EALREADY);
+		break;
+	default:
+		if (*eax >= 0x21 && *eax <= 0x3f) {
+			/* read "byte N" from RAM */
+			int	byten;
+
+			byten = (*eax - 0x20) & 0x1f;
+			sc->ctrlbyte = CTRL_CMD_FLAG | sc->ram[byten];
+		}
+		break;
+	}
+
+	pthread_mutex_unlock(&sc->mtx);
+
+	if (sc->ctrlbyte != 0) {
+		sc->status |= KBDS_KBD_BUFFER_FULL;
+		sc->status &= ~KBDS_AUX_BUFFER_FULL;
+		atkbdc_assert_kbd_intr(sc);
+	} else if (ps2mouse_fifocnt(sc->ps2mouse_sc) > 0 &&
+	           (sc->ram[0] & KBD_DISABLE_AUX_PORT) == 0) {
+		sc->status |= KBDS_AUX_BUFFER_FULL | KBDS_KBD_BUFFER_FULL;
+		atkbdc_assert_aux_intr(sc);
+	} else if (sc->kbd.bcnt > 0 && (sc->ram[0] & KBD_DISABLE_KBD_PORT) == 0) {
+		sc->status |= KBDS_KBD_BUFFER_FULL;
+		atkbdc_assert_kbd_intr(sc);
+	}
+
+	return (retval);
+}
+
+void
+atkbdc_event(struct atkbdc_softc *sc, int iskbd)
+{
+	pthread_mutex_lock(&sc->mtx);
+
+	if (iskbd)
+		atkbdc_kbd_poll(sc);
+	else
+		atkbdc_aux_poll(sc);
+	pthread_mutex_unlock(&sc->mtx);
+}
+
+void
+atkbdc_init(struct vmctx *ctx)
+{
+	struct inout_port iop;
+	struct atkbdc_softc *sc;
+	int error;
+
+	sc = calloc(1, sizeof(struct atkbdc_softc));
+	sc->ctx = ctx;
+
+	pthread_mutex_init(&sc->mtx, NULL);
+
+	bzero(&iop, sizeof(struct inout_port));
+	iop.name = "atkdbc";
+	iop.port = KBD_STS_CTL_PORT;
+	iop.size = 1;
+	iop.flags = IOPORT_F_INOUT;
+	iop.handler = atkbdc_sts_ctl_handler;
+	iop.arg = sc;
+
+	error = register_inout(&iop);
+	assert(error == 0);
+
+	bzero(&iop, sizeof(struct inout_port));
+	iop.name = "atkdbc";
+	iop.port = KBD_DATA_PORT;
+	iop.size = 1;
+	iop.flags = IOPORT_F_INOUT;
+	iop.handler = atkbdc_data_handler;
+	iop.arg = sc;
+
+	error = register_inout(&iop);
+	assert(error == 0);
+
+	pci_irq_reserve(KBD_DEV_IRQ);
+	sc->kbd.irq = KBD_DEV_IRQ;
+
+	pci_irq_reserve(AUX_DEV_IRQ);
+	sc->aux.irq = AUX_DEV_IRQ;
+
+	sc->ps2kbd_sc = ps2kbd_init(sc);
+	sc->ps2mouse_sc = ps2mouse_init(sc);
+}
+
+static void
+atkbdc_dsdt(void)
+{
+
+	dsdt_line("");
+	dsdt_line("Device (KBD)");
+	dsdt_line("{");
+	dsdt_line("  Name (_HID, EisaId (\"PNP0303\"))");
+	dsdt_line("  Name (_CRS, ResourceTemplate ()");
+	dsdt_line("  {");
+	dsdt_indent(2);
+	dsdt_fixed_ioport(KBD_DATA_PORT, 1);
+	dsdt_fixed_ioport(KBD_STS_CTL_PORT, 1);
+	dsdt_fixed_irq(1);
+	dsdt_unindent(2);
+	dsdt_line("  })");
+	dsdt_line("}");
+
+	dsdt_line("");
+	dsdt_line("Device (MOU)");
+	dsdt_line("{");
+	dsdt_line("  Name (_HID, EisaId (\"PNP0F13\"))");
+	dsdt_line("  Name (_CRS, ResourceTemplate ()");
+	dsdt_line("  {");
+	dsdt_indent(2);
+	dsdt_fixed_ioport(KBD_DATA_PORT, 1);
+	dsdt_fixed_ioport(KBD_STS_CTL_PORT, 1);
+	dsdt_fixed_irq(12);
+	dsdt_unindent(2);
+	dsdt_line("  })");
+	dsdt_line("}");
+}
+LPC_DSDT(atkbdc_dsdt);
+
diff --git a/usr/src/cmd/bhyve/atkbdc.h b/usr/src/cmd/bhyve/atkbdc.h
new file mode 100644
index 0000000000..85c8a7141e
--- /dev/null
+++ b/usr/src/cmd/bhyve/atkbdc.h
@@ -0,0 +1,38 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _ATKBDC_H_
+#define _ATKBDC_H_
+
+struct atkbdc_softc;
+struct vmctx;
+
+void atkbdc_init(struct vmctx *ctx);
+void atkbdc_event(struct atkbdc_softc *sc, int iskbd);
+
+#endif /* _ATKBDC_H_ */
diff --git a/usr/src/cmd/bhyve/bhyve_sol_glue.c b/usr/src/cmd/bhyve/bhyve_sol_glue.c
new file mode 100644
index 0000000000..7b24ea7f5d
--- /dev/null
+++ b/usr/src/cmd/bhyve/bhyve_sol_glue.c
@@ -0,0 +1,39 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/uio.h>
+
+#include <termios.h>
+#include <unistd.h>
+
+/*
+ * Make a pre-existing termios structure into "raw" mode: character-at-a-time
+ * mode with no characters interpreted, 8-bit data path.
+ */
+void
+cfmakeraw(struct termios *t)
+{
+	t->c_iflag &= ~(IMAXBEL|IXOFF|INPCK|BRKINT|PARMRK|ISTRIP|INLCR|IGNCR|
+	    ICRNL|IXON|IGNPAR);
+	t->c_iflag |= IGNBRK;
+	t->c_oflag &= ~OPOST;
+	t->c_lflag &= ~(ECHO|ECHOE|ECHOK|ECHONL|ICANON|ISIG|IEXTEN|NOFLSH|
+	    TOSTOP|PENDIN);
+	t->c_cflag &= ~(CSIZE|PARENB);
+	t->c_cflag |= CS8|CREAD;
+	t->c_cc[VMIN] = 1;
+	t->c_cc[VTIME] = 0;
+}
diff --git a/usr/src/cmd/bhyve/bhyvegc.c b/usr/src/cmd/bhyve/bhyvegc.c
new file mode 100644
index 0000000000..11cc2b1fb4
--- /dev/null
+++ b/usr/src/cmd/bhyve/bhyvegc.c
@@ -0,0 +1,101 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "bhyvegc.h"
+
+struct bhyvegc {
+	struct bhyvegc_image	*gc_image;
+	int raw;
+};
+
+struct bhyvegc *
+bhyvegc_init(int width, int height, void *fbaddr)
+{
+	struct bhyvegc *gc;
+	struct bhyvegc_image *gc_image;
+
+	gc = calloc(1, sizeof (struct bhyvegc));
+
+	gc_image = calloc(1, sizeof(struct bhyvegc_image));
+	gc_image->width = width;
+	gc_image->height = height;
+	if (fbaddr) {
+		gc_image->data = fbaddr;
+		gc->raw = 1;
+	} else {
+		gc_image->data = calloc(width * height, sizeof (uint32_t));
+		gc->raw = 0;
+	}
+
+	gc->gc_image = gc_image;
+
+	return (gc);
+}
+
+void
+bhyvegc_set_fbaddr(struct bhyvegc *gc, void *fbaddr)
+{
+	gc->raw = 1;
+	if (gc->gc_image->data && gc->gc_image->data != fbaddr)
+		free(gc->gc_image->data);
+	gc->gc_image->data = fbaddr;
+}
+
+void
+bhyvegc_resize(struct bhyvegc *gc, int width, int height)
+{
+	struct bhyvegc_image *gc_image;
+
+	gc_image = gc->gc_image;
+
+	gc_image->width = width;
+	gc_image->height = height;
+	if (!gc->raw) {
+		gc_image->data = reallocarray(gc_image->data, width * height,
+		    sizeof (uint32_t));
+		if (gc_image->data != NULL)
+			memset(gc_image->data, 0, width * height *
+			    sizeof (uint32_t));
+	}
+}
+
+struct bhyvegc_image *
+bhyvegc_get_image(struct bhyvegc *gc)
+{
+	if (gc == NULL)
+		return (NULL);
+
+	return (gc->gc_image);
+}
diff --git a/usr/src/cmd/bhyve/bhyvegc.h b/usr/src/cmd/bhyve/bhyvegc.h
new file mode 100644
index 0000000000..fa2ab68d9e
--- /dev/null
+++ b/usr/src/cmd/bhyve/bhyvegc.h
@@ -0,0 +1,46 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _BHYVEGC_H_
+#define	_BHYVEGC_H_
+
+struct bhyvegc;
+
+struct bhyvegc_image {
+	int		vgamode;
+	int		width;
+	int		height;
+	uint32_t	*data;
+};
+
+struct bhyvegc *bhyvegc_init(int width, int height, void *fbaddr);
+void bhyvegc_set_fbaddr(struct bhyvegc *gc, void *fbaddr);
+void bhyvegc_resize(struct bhyvegc *gc, int width, int height);
+struct bhyvegc_image *bhyvegc_get_image(struct bhyvegc *gc);
+
+#endif /* _BHYVEGC_H_ */
diff --git a/usr/src/cmd/bhyve/bhyverun.c b/usr/src/cmd/bhyve/bhyverun.c
new file mode 100644
index 0000000000..b12fba0800
--- /dev/null
+++ b/usr/src/cmd/bhyve/bhyverun.c
@@ -0,0 +1,1273 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/mman.h>
+#include <sys/time.h>
+#include <sys/cpuset.h>
+
+#include <machine/segments.h>
+
+#ifndef WITHOUT_CAPSICUM
+#include <capsicum_helpers.h>
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <err.h>
+#include <errno.h>
+#include <libgen.h>
+#include <unistd.h>
+#include <assert.h>
+#include <errno.h>
+#include <pthread.h>
+#include <pthread_np.h>
+#include <sysexits.h>
+#include <stdbool.h>
+#include <stdint.h>
+
+#include <machine/vmm.h>
+#ifndef WITHOUT_CAPSICUM
+#include <machine/vmm_dev.h>
+#endif
+#include <vmmapi.h>
+
+#ifndef __FreeBSD__
+#include <sys/stat.h>
+#endif
+
+#include "bhyverun.h"
+#include "acpi.h"
+#include "atkbdc.h"
+#include "console.h"
+#include "inout.h"
+#include "dbgport.h"
+#include "fwctl.h"
+#include "gdb.h"
+#include "ioapic.h"
+#include "mem.h"
+#include "mevent.h"
+#include "mptbl.h"
+#include "pci_emul.h"
+#include "pci_irq.h"
+#include "pci_lpc.h"
+#include "smbiostbl.h"
+#include "xmsr.h"
+#include "spinup_ap.h"
+#include "rfb.h"
+#include "rtc.h"
+#include "vga.h"
+
+#define GUEST_NIO_PORT		0x488	/* guest upcalls via i/o port */
+
+#define MB		(1024UL * 1024)
+#define GB		(1024UL * MB)
+
+typedef int (*vmexit_handler_t)(struct vmctx *, struct vm_exit *, int *vcpu);
+extern int vmexit_task_switch(struct vmctx *, struct vm_exit *, int *vcpu);
+
+char *vmname;
+
+int guest_ncpus;
+uint16_t cores, maxcpus, sockets, threads;
+
+char *guest_uuid_str;
+
+static int guest_vmexit_on_hlt, guest_vmexit_on_pause;
+static int virtio_msix = 1;
+static int x2apic_mode = 0;	/* default is xAPIC */
+
+static int strictio;
+static int strictmsr = 1;
+
+static int acpi;
+
+static char *progname;
+static const int BSP = 0;
+
+#ifndef	__FreeBSD__
+int bcons_wait = 0;
+int bcons_connected = 0;
+pthread_mutex_t bcons_wait_lock = PTHREAD_MUTEX_INITIALIZER;
+pthread_cond_t bcons_wait_done = PTHREAD_COND_INITIALIZER;
+#endif
+
+static cpuset_t cpumask;
+
+static void vm_loop(struct vmctx *ctx, int vcpu, uint64_t rip);
+
+static struct vm_exit vmexit[VM_MAXCPU];
+
+struct bhyvestats {
+        uint64_t        vmexit_bogus;
+	uint64_t	vmexit_reqidle;
+        uint64_t        vmexit_hlt;
+        uint64_t        vmexit_pause;
+        uint64_t        vmexit_mtrap;
+        uint64_t        vmexit_inst_emul;
+        uint64_t        cpu_switch_rotate;
+        uint64_t        cpu_switch_direct;
+} stats;
+
+struct mt_vmm_info {
+	pthread_t	mt_thr;
+	struct vmctx	*mt_ctx;
+	int		mt_vcpu;	
+} mt_vmm_info[VM_MAXCPU];
+
+#ifdef	__FreeBSD__
+static cpuset_t *vcpumap[VM_MAXCPU] = { NULL };
+#endif
+
+static void
+usage(int code)
+{
+
+        fprintf(stderr,
+		"Usage: %s [-abehuwxACHPSWY]\n"
+		"       %*s [-c [[cpus=]numcpus][,sockets=n][,cores=n][,threads=n]]\n"
+		"       %*s [-g <gdb port>] [-l <lpc>]\n"
+#ifdef	__FreeBSD__
+		"       %*s [-m mem] [-p vcpu:hostcpu] [-s <pci>] [-U uuid] <vm>\n"
+#else
+		"       %*s [-m mem] [-s <pci>] [-U uuid] <vm>\n"
+#endif
+		"       -a: local apic is in xAPIC mode (deprecated)\n"
+		"       -A: create ACPI tables\n"
+		"       -c: number of cpus and/or topology specification"
+		"       -C: include guest memory in core file\n"
+		"       -e: exit on unhandled I/O access\n"
+		"       -g: gdb port\n"
+		"       -h: help\n"
+		"       -H: vmexit from the guest on hlt\n"
+		"       -l: LPC device configuration\n"
+		"       -m: memory size\n"
+#ifdef	__FreeBSD__
+		"       -p: pin 'vcpu' to 'hostcpu'\n"
+#endif
+		"       -P: vmexit from the guest on pause\n"
+		"       -s: <slot,driver,configinfo> PCI slot config\n"
+		"       -S: guest memory cannot be swapped\n"
+		"       -u: RTC keeps UTC time\n"
+		"       -U: uuid\n"
+		"       -w: ignore unimplemented MSRs\n"
+		"       -W: force virtio to use single-vector MSI\n"
+		"       -x: local apic is in x2APIC mode\n"
+		"       -Y: disable MPtable generation\n",
+		progname, (int)strlen(progname), "", (int)strlen(progname), "",
+		(int)strlen(progname), "");
+
+	exit(code);
+}
+
+/*
+ * XXX This parser is known to have the following issues:
+ * 1.  It accepts null key=value tokens ",,".
+ * 2.  It accepts whitespace after = and before value.
+ * 3.  Values out of range of INT are silently wrapped.
+ * 4.  It doesn't check non-final values.
+ * 5.  The apparently bogus limits of UINT16_MAX are for future expansion.
+ *
+ * The acceptance of a null specification ('-c ""') is by design to match the
+ * manual page syntax specification, this results in a topology of 1 vCPU.
+ */
+static int
+topology_parse(const char *opt)
+{
+	uint64_t ncpus;
+	int c, chk, n, s, t, tmp;
+	char *cp, *str;
+	bool ns, scts;
+
+	c = 1, n = 1, s = 1, t = 1;
+	ns = false, scts = false;
+	str = strdup(opt);
+
+	while ((cp = strsep(&str, ",")) != NULL) {
+		if (sscanf(cp, "%i%n", &tmp, &chk) == 1) {
+			n = tmp;
+			ns = true;
+		} else if (sscanf(cp, "cpus=%i%n", &tmp, &chk) == 1) {
+			n = tmp;
+			ns = true;
+		} else if (sscanf(cp, "sockets=%i%n", &tmp, &chk) == 1) {
+			s = tmp;
+			scts = true;
+		} else if (sscanf(cp, "cores=%i%n", &tmp, &chk) == 1) {
+			c = tmp;
+			scts = true;
+		} else if (sscanf(cp, "threads=%i%n", &tmp, &chk) == 1) {
+			t = tmp;
+			scts = true;
+#ifdef notyet  /* Do not expose this until vmm.ko implements it */
+		} else if (sscanf(cp, "maxcpus=%i%n", &tmp, &chk) == 1) {
+			m = tmp;
+#endif
+		/* Skip the empty argument case from -c "" */
+		} else if (cp[0] == '\0')
+			continue;
+		else
+			return (-1);
+		/* Any trailing garbage causes an error */
+		if (cp[chk] != '\0')
+			return (-1);
+	}
+	/*
+	 * Range check 1 <= n <= UINT16_MAX all values
+	 */
+	if (n < 1 || s < 1 || c < 1 || t < 1 ||
+	    n > UINT16_MAX || s > UINT16_MAX || c > UINT16_MAX  ||
+	    t > UINT16_MAX)
+		return (-1);
+
+	/* If only the cpus was specified, use that as sockets */
+	if (!scts)
+		s = n;
+	/*
+	 * Compute sockets * cores * threads avoiding overflow
+	 * The range check above insures these are 16 bit values
+	 * If n was specified check it against computed ncpus
+	 */
+	ncpus = (uint64_t)s * c * t;
+	if (ncpus > UINT16_MAX || (ns && n != ncpus))
+		return (-1);
+
+	guest_ncpus = ncpus;
+	sockets = s;
+	cores = c;
+	threads = t;
+	return(0);
+}
+
+#ifndef WITHOUT_CAPSICUM
+/*
+ * 11-stable capsicum helpers
+ */
+static void
+bhyve_caph_cache_catpages(void)
+{
+
+	(void)catopen("libc", NL_CAT_LOCALE);
+}
+
+static int
+bhyve_caph_limit_stdoe(void)
+{
+	cap_rights_t rights;
+	unsigned long cmds[] = { TIOCGETA, TIOCGWINSZ };
+	int i, fds[] = { STDOUT_FILENO, STDERR_FILENO };
+
+	cap_rights_init(&rights, CAP_FCNTL, CAP_FSTAT, CAP_IOCTL);
+	cap_rights_set(&rights, CAP_WRITE);
+
+	for (i = 0; i < nitems(fds); i++) {
+		if (cap_rights_limit(fds[i], &rights) < 0 && errno != ENOSYS)
+			return (-1);
+
+		if (cap_ioctls_limit(fds[i], cmds, nitems(cmds)) < 0 && errno != ENOSYS)
+			return (-1);
+
+		if (cap_fcntls_limit(fds[i], CAP_FCNTL_GETFL) < 0 && errno != ENOSYS)
+			return (-1);
+	}
+
+	return (0);
+}
+
+#endif
+
+#ifdef	__FreeBSD__
+static int
+pincpu_parse(const char *opt)
+{
+	int vcpu, pcpu;
+
+	if (sscanf(opt, "%d:%d", &vcpu, &pcpu) != 2) {
+		fprintf(stderr, "invalid format: %s\n", opt);
+		return (-1);
+	}
+
+	if (vcpu < 0 || vcpu >= VM_MAXCPU) {
+		fprintf(stderr, "vcpu '%d' outside valid range from 0 to %d\n",
+		    vcpu, VM_MAXCPU - 1);
+		return (-1);
+	}
+
+	if (pcpu < 0 || pcpu >= CPU_SETSIZE) {
+		fprintf(stderr, "hostcpu '%d' outside valid range from "
+		    "0 to %d\n", pcpu, CPU_SETSIZE - 1);
+		return (-1);
+	}
+
+	if (vcpumap[vcpu] == NULL) {
+		if ((vcpumap[vcpu] = malloc(sizeof(cpuset_t))) == NULL) {
+			perror("malloc");
+			return (-1);
+		}
+		CPU_ZERO(vcpumap[vcpu]);
+	}
+	CPU_SET(pcpu, vcpumap[vcpu]);
+	return (0);
+}
+#endif
+
+void
+vm_inject_fault(void *arg, int vcpu, int vector, int errcode_valid,
+    int errcode)
+{
+	struct vmctx *ctx;
+	int error, restart_instruction;
+
+	ctx = arg;
+	restart_instruction = 1;
+
+	error = vm_inject_exception(ctx, vcpu, vector, errcode_valid, errcode,
+	    restart_instruction);
+	assert(error == 0);
+}
+
+void *
+paddr_guest2host(struct vmctx *ctx, uintptr_t gaddr, size_t len)
+{
+
+	return (vm_map_gpa(ctx, gaddr, len));
+}
+
+int
+fbsdrun_vmexit_on_pause(void)
+{
+
+	return (guest_vmexit_on_pause);
+}
+
+int
+fbsdrun_vmexit_on_hlt(void)
+{
+
+	return (guest_vmexit_on_hlt);
+}
+
+int
+fbsdrun_virtio_msix(void)
+{
+
+	return (virtio_msix);
+}
+
+static void *
+fbsdrun_start_thread(void *param)
+{
+	char tname[MAXCOMLEN + 1];
+	struct mt_vmm_info *mtp;
+	int vcpu;
+
+	mtp = param;
+	vcpu = mtp->mt_vcpu;
+
+	snprintf(tname, sizeof(tname), "vcpu %d", vcpu);
+	pthread_set_name_np(mtp->mt_thr, tname);
+
+	gdb_cpu_add(vcpu);
+
+	vm_loop(mtp->mt_ctx, vcpu, vmexit[vcpu].rip);
+
+	/* not reached */
+	exit(1);
+	return (NULL);
+}
+
+void
+fbsdrun_addcpu(struct vmctx *ctx, int fromcpu, int newcpu, uint64_t rip)
+{
+	int error;
+
+	assert(fromcpu == BSP);
+
+	/*
+	 * The 'newcpu' must be activated in the context of 'fromcpu'. If
+	 * vm_activate_cpu() is delayed until newcpu's pthread starts running
+	 * then vmm.ko is out-of-sync with bhyve and this can create a race
+	 * with vm_suspend().
+	 */
+	error = vm_activate_cpu(ctx, newcpu);
+	if (error != 0)
+		err(EX_OSERR, "could not activate CPU %d", newcpu);
+
+	CPU_SET_ATOMIC(newcpu, &cpumask);
+
+	/*
+	 * Set up the vmexit struct to allow execution to start
+	 * at the given RIP
+	 */
+	vmexit[newcpu].rip = rip;
+	vmexit[newcpu].inst_length = 0;
+
+	mt_vmm_info[newcpu].mt_ctx = ctx;
+	mt_vmm_info[newcpu].mt_vcpu = newcpu;
+
+	error = pthread_create(&mt_vmm_info[newcpu].mt_thr, NULL,
+	    fbsdrun_start_thread, &mt_vmm_info[newcpu]);
+	assert(error == 0);
+}
+
+static int
+fbsdrun_deletecpu(struct vmctx *ctx, int vcpu)
+{
+
+	if (!CPU_ISSET(vcpu, &cpumask)) {
+		fprintf(stderr, "Attempting to delete unknown cpu %d\n", vcpu);
+		exit(1);
+	}
+
+	CPU_CLR_ATOMIC(vcpu, &cpumask);
+	return (CPU_EMPTY(&cpumask));
+}
+
+static int
+vmexit_handle_notify(struct vmctx *ctx, struct vm_exit *vme, int *pvcpu,
+		     uint32_t eax)
+{
+#if BHYVE_DEBUG
+	/*
+	 * put guest-driven debug here
+	 */
+#endif
+        return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_inout(struct vmctx *ctx, struct vm_exit *vme, int *pvcpu)
+{
+	int error;
+	int bytes, port, in, out;
+	int vcpu;
+
+	vcpu = *pvcpu;
+
+	port = vme->u.inout.port;
+	bytes = vme->u.inout.bytes;
+	in = vme->u.inout.in;
+	out = !in;
+
+        /* Extra-special case of host notifications */
+        if (out && port == GUEST_NIO_PORT) {
+                error = vmexit_handle_notify(ctx, vme, pvcpu, vme->u.inout.eax);
+		return (error);
+	}
+
+	error = emulate_inout(ctx, vcpu, vme, strictio);
+	if (error) {
+		fprintf(stderr, "Unhandled %s%c 0x%04x at 0x%lx\n",
+		    in ? "in" : "out",
+		    bytes == 1 ? 'b' : (bytes == 2 ? 'w' : 'l'),
+		    port, vmexit->rip);
+		return (VMEXIT_ABORT);
+	} else {
+		return (VMEXIT_CONTINUE);
+	}
+}
+
+static int
+vmexit_rdmsr(struct vmctx *ctx, struct vm_exit *vme, int *pvcpu)
+{
+	uint64_t val;
+	uint32_t eax, edx;
+	int error;
+
+	val = 0;
+	error = emulate_rdmsr(ctx, *pvcpu, vme->u.msr.code, &val);
+	if (error != 0) {
+		fprintf(stderr, "rdmsr to register %#x on vcpu %d\n",
+		    vme->u.msr.code, *pvcpu);
+		if (strictmsr) {
+			vm_inject_gp(ctx, *pvcpu);
+			return (VMEXIT_CONTINUE);
+		}
+	}
+
+	eax = val;
+	error = vm_set_register(ctx, *pvcpu, VM_REG_GUEST_RAX, eax);
+	assert(error == 0);
+
+	edx = val >> 32;
+	error = vm_set_register(ctx, *pvcpu, VM_REG_GUEST_RDX, edx);
+	assert(error == 0);
+
+	return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_wrmsr(struct vmctx *ctx, struct vm_exit *vme, int *pvcpu)
+{
+	int error;
+
+	error = emulate_wrmsr(ctx, *pvcpu, vme->u.msr.code, vme->u.msr.wval);
+	if (error != 0) {
+		fprintf(stderr, "wrmsr to register %#x(%#lx) on vcpu %d\n",
+		    vme->u.msr.code, vme->u.msr.wval, *pvcpu);
+		if (strictmsr) {
+			vm_inject_gp(ctx, *pvcpu);
+			return (VMEXIT_CONTINUE);
+		}
+	}
+	return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_spinup_ap(struct vmctx *ctx, struct vm_exit *vme, int *pvcpu)
+{
+
+	(void)spinup_ap(ctx, *pvcpu,
+		    vme->u.spinup_ap.vcpu, vme->u.spinup_ap.rip);
+
+	return (VMEXIT_CONTINUE);
+}
+
+#define	DEBUG_EPT_MISCONFIG
+#ifdef DEBUG_EPT_MISCONFIG
+#define	EXIT_REASON_EPT_MISCONFIG	49
+#define	VMCS_GUEST_PHYSICAL_ADDRESS	0x00002400
+#define	VMCS_IDENT(x)			((x) | 0x80000000)
+
+static uint64_t ept_misconfig_gpa, ept_misconfig_pte[4];
+static int ept_misconfig_ptenum;
+#endif
+
+static int
+vmexit_vmx(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	fprintf(stderr, "vm exit[%d]\n", *pvcpu);
+	fprintf(stderr, "\treason\t\tVMX\n");
+	fprintf(stderr, "\trip\t\t0x%016lx\n", vmexit->rip);
+	fprintf(stderr, "\tinst_length\t%d\n", vmexit->inst_length);
+	fprintf(stderr, "\tstatus\t\t%d\n", vmexit->u.vmx.status);
+	fprintf(stderr, "\texit_reason\t%u\n", vmexit->u.vmx.exit_reason);
+	fprintf(stderr, "\tqualification\t0x%016lx\n",
+	    vmexit->u.vmx.exit_qualification);
+	fprintf(stderr, "\tinst_type\t\t%d\n", vmexit->u.vmx.inst_type);
+	fprintf(stderr, "\tinst_error\t\t%d\n", vmexit->u.vmx.inst_error);
+#ifdef DEBUG_EPT_MISCONFIG
+	if (vmexit->u.vmx.exit_reason == EXIT_REASON_EPT_MISCONFIG) {
+		vm_get_register(ctx, *pvcpu,
+		    VMCS_IDENT(VMCS_GUEST_PHYSICAL_ADDRESS),
+		    &ept_misconfig_gpa);
+		vm_get_gpa_pmap(ctx, ept_misconfig_gpa, ept_misconfig_pte,
+		    &ept_misconfig_ptenum);
+		fprintf(stderr, "\tEPT misconfiguration:\n");
+		fprintf(stderr, "\t\tGPA: %#lx\n", ept_misconfig_gpa);
+		fprintf(stderr, "\t\tPTE(%d): %#lx %#lx %#lx %#lx\n",
+		    ept_misconfig_ptenum, ept_misconfig_pte[0],
+		    ept_misconfig_pte[1], ept_misconfig_pte[2],
+		    ept_misconfig_pte[3]);
+	}
+#endif	/* DEBUG_EPT_MISCONFIG */
+	return (VMEXIT_ABORT);
+}
+
+static int
+vmexit_svm(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	fprintf(stderr, "vm exit[%d]\n", *pvcpu);
+	fprintf(stderr, "\treason\t\tSVM\n");
+	fprintf(stderr, "\trip\t\t0x%016lx\n", vmexit->rip);
+	fprintf(stderr, "\tinst_length\t%d\n", vmexit->inst_length);
+	fprintf(stderr, "\texitcode\t%#lx\n", vmexit->u.svm.exitcode);
+	fprintf(stderr, "\texitinfo1\t%#lx\n", vmexit->u.svm.exitinfo1);
+	fprintf(stderr, "\texitinfo2\t%#lx\n", vmexit->u.svm.exitinfo2);
+	return (VMEXIT_ABORT);
+}
+
+static int
+vmexit_bogus(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	assert(vmexit->inst_length == 0);
+
+	stats.vmexit_bogus++;
+
+	return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_reqidle(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	assert(vmexit->inst_length == 0);
+
+	stats.vmexit_reqidle++;
+
+	return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_hlt(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	stats.vmexit_hlt++;
+
+	/*
+	 * Just continue execution with the next instruction. We use
+	 * the HLT VM exit as a way to be friendly with the host
+	 * scheduler.
+	 */
+	return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_pause(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	stats.vmexit_pause++;
+
+	return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_mtrap(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	assert(vmexit->inst_length == 0);
+
+	stats.vmexit_mtrap++;
+
+	gdb_cpu_mtrap(*pvcpu);
+
+	return (VMEXIT_CONTINUE);
+}
+
+static int
+vmexit_inst_emul(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+	int err, i;
+	struct vie *vie;
+
+	stats.vmexit_inst_emul++;
+
+	vie = &vmexit->u.inst_emul.vie;
+	err = emulate_mem(ctx, *pvcpu, vmexit->u.inst_emul.gpa,
+	    vie, &vmexit->u.inst_emul.paging);
+
+	if (err) {
+		if (err == ESRCH) {
+			fprintf(stderr, "Unhandled memory access to 0x%lx\n",
+			    vmexit->u.inst_emul.gpa);
+		}
+
+		fprintf(stderr, "Failed to emulate instruction [");
+		for (i = 0; i < vie->num_valid; i++) {
+			fprintf(stderr, "0x%02x%s", vie->inst[i],
+			    i != (vie->num_valid - 1) ? " " : "");
+		}
+		fprintf(stderr, "] at 0x%lx\n", vmexit->rip);
+		return (VMEXIT_ABORT);
+	}
+
+	return (VMEXIT_CONTINUE);
+}
+
+static pthread_mutex_t resetcpu_mtx = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t resetcpu_cond = PTHREAD_COND_INITIALIZER;
+
+static int
+vmexit_suspend(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+	enum vm_suspend_how how;
+
+	how = vmexit->u.suspended.how;
+
+	fbsdrun_deletecpu(ctx, *pvcpu);
+
+	if (*pvcpu != BSP) {
+		pthread_mutex_lock(&resetcpu_mtx);
+		pthread_cond_signal(&resetcpu_cond);
+		pthread_mutex_unlock(&resetcpu_mtx);
+		pthread_exit(NULL);
+	}
+
+	pthread_mutex_lock(&resetcpu_mtx);
+	while (!CPU_EMPTY(&cpumask)) {
+		pthread_cond_wait(&resetcpu_cond, &resetcpu_mtx);
+	}
+	pthread_mutex_unlock(&resetcpu_mtx);
+
+	switch (how) {
+	case VM_SUSPEND_RESET:
+		exit(0);
+	case VM_SUSPEND_POWEROFF:
+		exit(1);
+	case VM_SUSPEND_HALT:
+		exit(2);
+	case VM_SUSPEND_TRIPLEFAULT:
+		exit(3);
+	default:
+		fprintf(stderr, "vmexit_suspend: invalid reason %d\n", how);
+		exit(100);
+	}
+	return (0);	/* NOTREACHED */
+}
+
+static int
+vmexit_debug(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+
+	gdb_cpu_suspend(*pvcpu);
+	return (VMEXIT_CONTINUE);
+}
+
+static vmexit_handler_t handler[VM_EXITCODE_MAX] = {
+	[VM_EXITCODE_INOUT]  = vmexit_inout,
+	[VM_EXITCODE_INOUT_STR]  = vmexit_inout,
+	[VM_EXITCODE_VMX]    = vmexit_vmx,
+	[VM_EXITCODE_SVM]    = vmexit_svm,
+	[VM_EXITCODE_BOGUS]  = vmexit_bogus,
+	[VM_EXITCODE_REQIDLE] = vmexit_reqidle,
+	[VM_EXITCODE_RDMSR]  = vmexit_rdmsr,
+	[VM_EXITCODE_WRMSR]  = vmexit_wrmsr,
+	[VM_EXITCODE_MTRAP]  = vmexit_mtrap,
+	[VM_EXITCODE_INST_EMUL] = vmexit_inst_emul,
+	[VM_EXITCODE_SPINUP_AP] = vmexit_spinup_ap,
+	[VM_EXITCODE_SUSPENDED] = vmexit_suspend,
+	[VM_EXITCODE_TASK_SWITCH] = vmexit_task_switch,
+	[VM_EXITCODE_DEBUG] = vmexit_debug,
+};
+
+static void
+vm_loop(struct vmctx *ctx, int vcpu, uint64_t startrip)
+{
+	int error, rc;
+	enum vm_exitcode exitcode;
+	cpuset_t active_cpus;
+
+#ifdef	__FreeBSD__
+	if (vcpumap[vcpu] != NULL) {
+		error = pthread_setaffinity_np(pthread_self(),
+		    sizeof(cpuset_t), vcpumap[vcpu]);
+		assert(error == 0);
+	}
+#endif
+	error = vm_active_cpus(ctx, &active_cpus);
+	assert(CPU_ISSET(vcpu, &active_cpus));
+
+	error = vm_set_register(ctx, vcpu, VM_REG_GUEST_RIP, startrip);
+	assert(error == 0);
+
+	while (1) {
+		error = vm_run(ctx, vcpu, &vmexit[vcpu]);
+		if (error != 0)
+			break;
+
+		exitcode = vmexit[vcpu].exitcode;
+		if (exitcode >= VM_EXITCODE_MAX || handler[exitcode] == NULL) {
+			fprintf(stderr, "vm_loop: unexpected exitcode 0x%x\n",
+			    exitcode);
+			exit(1);
+		}
+
+		rc = (*handler[exitcode])(ctx, &vmexit[vcpu], &vcpu);
+
+		switch (rc) {
+		case VMEXIT_CONTINUE:
+			break;
+		case VMEXIT_ABORT:
+			abort();
+		default:
+			exit(1);
+		}
+	}
+	fprintf(stderr, "vm_run error %d, errno %d\n", error, errno);
+}
+
+static int
+num_vcpus_allowed(struct vmctx *ctx)
+{
+	int tmp, error;
+
+	error = vm_get_capability(ctx, BSP, VM_CAP_UNRESTRICTED_GUEST, &tmp);
+
+	/*
+	 * The guest is allowed to spinup more than one processor only if the
+	 * UNRESTRICTED_GUEST capability is available.
+	 */
+	if (error == 0)
+		return (VM_MAXCPU);
+	else
+		return (1);
+}
+
+void
+fbsdrun_set_capabilities(struct vmctx *ctx, int cpu)
+{
+	int err, tmp;
+
+	if (fbsdrun_vmexit_on_hlt()) {
+		err = vm_get_capability(ctx, cpu, VM_CAP_HALT_EXIT, &tmp);
+		if (err < 0) {
+			fprintf(stderr, "VM exit on HLT not supported\n");
+			exit(1);
+		}
+		vm_set_capability(ctx, cpu, VM_CAP_HALT_EXIT, 1);
+		if (cpu == BSP)
+			handler[VM_EXITCODE_HLT] = vmexit_hlt;
+	}
+
+        if (fbsdrun_vmexit_on_pause()) {
+		/*
+		 * pause exit support required for this mode
+		 */
+		err = vm_get_capability(ctx, cpu, VM_CAP_PAUSE_EXIT, &tmp);
+		if (err < 0) {
+			fprintf(stderr,
+			    "SMP mux requested, no pause support\n");
+			exit(1);
+		}
+		vm_set_capability(ctx, cpu, VM_CAP_PAUSE_EXIT, 1);
+		if (cpu == BSP)
+			handler[VM_EXITCODE_PAUSE] = vmexit_pause;
+        }
+
+	if (x2apic_mode)
+		err = vm_set_x2apic_state(ctx, cpu, X2APIC_ENABLED);
+	else
+		err = vm_set_x2apic_state(ctx, cpu, X2APIC_DISABLED);
+
+	if (err) {
+		fprintf(stderr, "Unable to set x2apic state (%d)\n", err);
+		exit(1);
+	}
+
+#ifdef	__FreeBSD__
+	vm_set_capability(ctx, cpu, VM_CAP_ENABLE_INVPCID, 1);
+#endif
+}
+
+static struct vmctx *
+do_open(const char *vmname)
+{
+	struct vmctx *ctx;
+	int error;
+	bool reinit, romboot;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+	const cap_ioctl_t *cmds;	
+	size_t ncmds;
+#endif
+
+	reinit = romboot = false;
+
+	if (lpc_bootrom())
+		romboot = true;
+
+	error = vm_create(vmname);
+	if (error) {
+		if (errno == EEXIST) {
+			if (romboot) {
+				reinit = true;
+			} else {
+				/*
+				 * The virtual machine has been setup by the
+				 * userspace bootloader.
+				 */
+			}
+		} else {
+			perror("vm_create");
+			exit(1);
+		}
+	} else {
+		if (!romboot) {
+			/*
+			 * If the virtual machine was just created then a
+			 * bootrom must be configured to boot it.
+			 */
+			fprintf(stderr, "virtual machine cannot be booted\n");
+			exit(1);
+		}
+	}
+
+	ctx = vm_open(vmname);
+	if (ctx == NULL) {
+		perror("vm_open");
+		exit(1);
+	}
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_IOCTL, CAP_MMAP_RW);
+	if (cap_rights_limit(vm_get_device_fd(ctx), &rights) == -1 &&
+	    errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+	vm_get_ioctls(&ncmds);
+	cmds = vm_get_ioctls(NULL);
+	if (cmds == NULL)
+		errx(EX_OSERR, "out of memory");
+	if (cap_ioctls_limit(vm_get_device_fd(ctx), cmds, ncmds) == -1 &&
+	    errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+	free((cap_ioctl_t *)cmds);
+#endif
+ 
+	if (reinit) {
+		error = vm_reinit(ctx);
+		if (error) {
+			perror("vm_reinit");
+			exit(1);
+		}
+	}
+	error = vm_set_topology(ctx, sockets, cores, threads, maxcpus);
+	if (error)
+		errx(EX_OSERR, "vm_set_topology");
+	return (ctx);
+}
+
+#ifndef __FreeBSD__
+
+#define	FILE_PROVISIONING	"/var/svc/provisioning"
+#define	FILE_PROVISION_SUCCESS	"/var/svc/provision_success"
+
+static void
+mark_provisioned(void)
+{
+	struct stat stbuf;
+
+	if (lstat(FILE_PROVISIONING, &stbuf) != 0)
+		return;
+
+	if (rename(FILE_PROVISIONING, FILE_PROVISION_SUCCESS) != 0) {
+		(void) fprintf(stderr, "Cannot rename %s to %s: %s\n",
+		    FILE_PROVISIONING, FILE_PROVISION_SUCCESS,
+		    strerror(errno));
+	}
+}
+
+#endif
+
+int
+main(int argc, char *argv[])
+{
+	int c, error, dbg_port, gdb_port, err, bvmcons;
+	int max_vcpus, mptgen, memflags;
+	int rtc_localtime;
+	bool gdb_stop;
+	struct vmctx *ctx;
+	uint64_t rip;
+	size_t memsize;
+	char *optstr;
+
+	bvmcons = 0;
+	progname = basename(argv[0]);
+	dbg_port = 0;
+	gdb_port = 0;
+	gdb_stop = false;
+	guest_ncpus = 1;
+	sockets = cores = threads = 1;
+	maxcpus = 0;
+	memsize = 256 * MB;
+	mptgen = 1;
+	rtc_localtime = 1;
+	memflags = 0;
+
+#ifdef	__FreeBSD__
+	optstr = "abehuwxACHIPSWYp:g:G:c:s:m:l:B:U:";
+#else
+	optstr = "abehuwxACHIPSWY:g:G:c:s:m:l:B:U:";
+#endif
+	while ((c = getopt(argc, argv, optstr)) != -1) {
+		switch (c) {
+		case 'a':
+			x2apic_mode = 0;
+			break;
+		case 'A':
+			acpi = 1;
+			break;
+		case 'b':
+			bvmcons = 1;
+			break;
+		case 'B':
+			if (smbios_parse(optarg) != 0) {
+				errx(EX_USAGE, "invalid SMBIOS "
+				    "configuration '%s'", optarg);
+			}
+			break;
+#ifdef	__FreeBSD__
+		case 'p':
+			if (pincpu_parse(optarg) != 0) {
+				errx(EX_USAGE, "invalid vcpu pinning "
+				    "configuration '%s'", optarg);
+			}
+			break;
+#endif
+                case 'c':
+			if (topology_parse(optarg) != 0) {
+			    errx(EX_USAGE, "invalid cpu topology "
+				"'%s'", optarg);
+			}
+			break;
+		case 'C':
+			memflags |= VM_MEM_F_INCORE;
+			break;
+		case 'g':
+			dbg_port = atoi(optarg);
+			break;
+		case 'G':
+			if (optarg[0] == 'w') {
+				gdb_stop = true;
+				optarg++;
+			}
+			gdb_port = atoi(optarg);
+			break;
+		case 'l':
+			if (lpc_device_parse(optarg) != 0) {
+				errx(EX_USAGE, "invalid lpc device "
+				    "configuration '%s'", optarg);
+			}
+			break;
+		case 's':
+			if (pci_parse_slot(optarg) != 0)
+				exit(1);
+			else
+				break;
+		case 'S':
+			memflags |= VM_MEM_F_WIRED;
+			break;
+                case 'm':
+			error = vm_parse_memsize(optarg, &memsize);
+			if (error)
+				errx(EX_USAGE, "invalid memsize '%s'", optarg);
+			break;
+		case 'H':
+			guest_vmexit_on_hlt = 1;
+			break;
+		case 'I':
+			/*
+			 * The "-I" option was used to add an ioapic to the
+			 * virtual machine.
+			 *
+			 * An ioapic is now provided unconditionally for each
+			 * virtual machine and this option is now deprecated.
+			 */
+			break;
+		case 'P':
+			guest_vmexit_on_pause = 1;
+			break;
+		case 'e':
+			strictio = 1;
+			break;
+		case 'u':
+			rtc_localtime = 0;
+			break;
+		case 'U':
+			guest_uuid_str = optarg;
+			break;
+		case 'w':
+			strictmsr = 0;
+			break;
+		case 'W':
+			virtio_msix = 0;
+			break;
+		case 'x':
+			x2apic_mode = 1;
+			break;
+		case 'Y':
+			mptgen = 0;
+			break;
+		case 'h':
+			usage(0);			
+		default:
+			usage(1);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if (argc != 1)
+		usage(1);
+
+	vmname = argv[0];
+	ctx = do_open(vmname);
+
+	max_vcpus = num_vcpus_allowed(ctx);
+	if (guest_ncpus > max_vcpus) {
+		fprintf(stderr, "%d vCPUs requested but only %d available\n",
+			guest_ncpus, max_vcpus);
+		exit(1);
+	}
+
+	fbsdrun_set_capabilities(ctx, BSP);
+
+	vm_set_memflags(ctx, memflags);
+#ifdef	__FreeBSD__
+	err = vm_setup_memory(ctx, memsize, VM_MMAP_ALL);
+#else
+	do {
+		errno = 0;
+		err = vm_setup_memory(ctx, memsize, VM_MMAP_ALL);
+		error = errno;
+		if (err != 0 && error == ENOMEM) {
+			(void) fprintf(stderr, "Unable to allocate memory "
+			    "(%llu), retrying in 1 second\n", memsize);
+			sleep(1);
+		}
+	} while (error == ENOMEM);
+#endif
+	if (err) {
+		fprintf(stderr, "Unable to setup memory (%d)\n", errno);
+		exit(1);
+	}
+
+	error = init_msr();
+	if (error) {
+		fprintf(stderr, "init_msr error %d", error);
+		exit(1);
+	}
+
+	init_mem();
+	init_inout();
+	atkbdc_init(ctx);
+	pci_irq_init(ctx);
+	ioapic_init(ctx);
+
+	rtc_init(ctx, rtc_localtime);
+	sci_init(ctx);
+
+	/*
+	 * Exit if a device emulation finds an error in its initilization
+	 */
+	if (init_pci(ctx) != 0)
+		exit(1);
+
+	if (dbg_port != 0)
+		init_dbgport(dbg_port);
+
+	if (gdb_port != 0)
+		init_gdb(ctx, gdb_port, gdb_stop);
+
+	if (bvmcons)
+		init_bvmcons();
+
+	vga_init(1);
+
+	if (lpc_bootrom()) {
+		if (vm_set_capability(ctx, BSP, VM_CAP_UNRESTRICTED_GUEST, 1)) {
+			fprintf(stderr, "ROM boot failed: unrestricted guest "
+			    "capability not available\n");
+			exit(1);
+		}
+		error = vcpu_reset(ctx, BSP);
+		assert(error == 0);
+	}
+
+	error = vm_get_register(ctx, BSP, VM_REG_GUEST_RIP, &rip);
+	assert(error == 0);
+
+	/*
+ 	 * build the guest tables, MP etc.
+	 */
+	if (mptgen) {
+		error = mptable_build(ctx, guest_ncpus);
+		if (error)
+			exit(1);
+	}
+
+	error = smbios_build(ctx);
+	assert(error == 0);
+
+	if (acpi) {
+		error = acpi_build(ctx, guest_ncpus);
+		assert(error == 0);
+	}
+
+	if (lpc_bootrom())
+		fwctl_init();
+
+#ifndef WITHOUT_CAPSICUM
+	caph_cache_catpages();
+
+	if (caph_limit_stdout() == -1 || caph_limit_stderr() == -1)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+
+	if (cap_enter() == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "cap_enter() failed");
+#endif
+
+	/*
+	 * Change the proc title to include the VM name.
+	 */
+	setproctitle("%s", vmname); 
+
+#ifndef	__FreeBSD__
+	/*
+	 * If applicable, wait for bhyveconsole
+	 */
+	if (bcons_wait) {
+		printf("Waiting for bhyveconsole connection...\n");
+		(void) pthread_mutex_lock(&bcons_wait_lock);
+		while (!bcons_connected) {
+			(void) pthread_cond_wait(&bcons_wait_done,
+			    &bcons_wait_lock);
+		}
+		(void) pthread_mutex_unlock(&bcons_wait_lock);
+	}
+#endif
+
+	/*
+	 * Add CPU 0
+	 */
+	fbsdrun_addcpu(ctx, BSP, BSP, rip);
+
+#ifndef __FreeBSD__
+	mark_provisioned();
+#endif
+
+	/*
+	 * Head off to the main event dispatch loop
+	 */
+	mevent_dispatch();
+
+	exit(1);
+}
diff --git a/usr/src/cmd/bhyve/bhyverun.h b/usr/src/cmd/bhyve/bhyverun.h
new file mode 100644
index 0000000000..1d275d5375
--- /dev/null
+++ b/usr/src/cmd/bhyve/bhyverun.h
@@ -0,0 +1,69 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ */
+
+#ifndef	_FBSDRUN_H_
+#define	_FBSDRUN_H_
+
+#define	VMEXIT_CONTINUE		(0)
+#define	VMEXIT_ABORT		(-1)
+
+struct vmctx;
+extern int guest_ncpus;
+extern char *guest_uuid_str;
+extern char *vmname;
+#ifndef	__FreeBSD__
+extern int bcons_wait;
+extern int bcons_connected;
+extern pthread_mutex_t bcons_wait_lock;
+extern pthread_cond_t bcons_wait_done;
+#endif
+
+void *paddr_guest2host(struct vmctx *ctx, uintptr_t addr, size_t len);
+
+void fbsdrun_set_capabilities(struct vmctx *ctx, int cpu);
+void fbsdrun_addcpu(struct vmctx *ctx, int fromcpu, int newcpu, uint64_t rip);
+int  fbsdrun_muxed(void);
+int  fbsdrun_vmexit_on_hlt(void);
+int  fbsdrun_vmexit_on_pause(void);
+int  fbsdrun_disable_x2apic(void);
+int  fbsdrun_virtio_msix(void);
+#endif
diff --git a/usr/src/cmd/bhyve/block_if.c b/usr/src/cmd/bhyve/block_if.c
new file mode 100644
index 0000000000..c8ec96690c
--- /dev/null
+++ b/usr/src/cmd/bhyve/block_if.c
@@ -0,0 +1,901 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013  Peter Grehan <grehan@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/queue.h>
+#include <sys/errno.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/disk.h>
+#include <sys/limits.h>
+#include <sys/uio.h>
+
+#include <assert.h>
+#include <err.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <pthread.h>
+#include <pthread_np.h>
+#include <signal.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include <machine/atomic.h>
+
+#include "bhyverun.h"
+#ifdef	__FreeBSD__
+#include "mevent.h"
+#endif
+#include "block_if.h"
+
+#define BLOCKIF_SIG	0xb109b109
+
+#define BLOCKIF_NUMTHR	8
+#define BLOCKIF_MAXREQ	(64 + BLOCKIF_NUMTHR)
+
+enum blockop {
+	BOP_READ,
+	BOP_WRITE,
+#ifndef __FreeBSD__
+	BOP_WRITE_SYNC,
+#endif
+	BOP_FLUSH,
+	BOP_DELETE
+};
+
+enum blockstat {
+	BST_FREE,
+	BST_BLOCK,
+	BST_PEND,
+	BST_BUSY,
+	BST_DONE
+};
+
+struct blockif_elem {
+	TAILQ_ENTRY(blockif_elem) be_link;
+	struct blockif_req  *be_req;
+	enum blockop	     be_op;
+	enum blockstat	     be_status;
+	pthread_t            be_tid;
+	off_t		     be_block;
+};
+
+struct blockif_ctxt {
+	int			bc_magic;
+	int			bc_fd;
+	int			bc_ischr;
+	int			bc_isgeom;
+	int			bc_candelete;
+	int			bc_rdonly;
+	off_t			bc_size;
+	int			bc_sectsz;
+	int			bc_psectsz;
+	int			bc_psectoff;
+	int			bc_closing;
+	pthread_t		bc_btid[BLOCKIF_NUMTHR];
+        pthread_mutex_t		bc_mtx;
+        pthread_cond_t		bc_cond;
+
+	/* Request elements and free/pending/busy queues */
+	TAILQ_HEAD(, blockif_elem) bc_freeq;       
+	TAILQ_HEAD(, blockif_elem) bc_pendq;
+	TAILQ_HEAD(, blockif_elem) bc_busyq;
+	struct blockif_elem	bc_reqs[BLOCKIF_MAXREQ];
+};
+
+static pthread_once_t blockif_once = PTHREAD_ONCE_INIT;
+
+struct blockif_sig_elem {
+	pthread_mutex_t			bse_mtx;
+	pthread_cond_t			bse_cond;
+	int				bse_pending;
+	struct blockif_sig_elem		*bse_next;
+};
+
+static struct blockif_sig_elem *blockif_bse_head;
+
+static int
+blockif_enqueue(struct blockif_ctxt *bc, struct blockif_req *breq,
+		enum blockop op)
+{
+	struct blockif_elem *be, *tbe;
+	off_t off;
+	int i;
+
+	be = TAILQ_FIRST(&bc->bc_freeq);
+	assert(be != NULL);
+	assert(be->be_status == BST_FREE);
+	TAILQ_REMOVE(&bc->bc_freeq, be, be_link);
+	be->be_req = breq;
+	be->be_op = op;
+	switch (op) {
+	case BOP_READ:
+	case BOP_WRITE:
+#ifndef __FreeBSD__
+	case BOP_WRITE_SYNC:
+#endif
+	case BOP_DELETE:
+		off = breq->br_offset;
+		for (i = 0; i < breq->br_iovcnt; i++)
+			off += breq->br_iov[i].iov_len;
+		break;
+	default:
+		off = OFF_MAX;
+	}
+	be->be_block = off;
+	TAILQ_FOREACH(tbe, &bc->bc_pendq, be_link) {
+		if (tbe->be_block == breq->br_offset)
+			break;
+	}
+	if (tbe == NULL) {
+		TAILQ_FOREACH(tbe, &bc->bc_busyq, be_link) {
+			if (tbe->be_block == breq->br_offset)
+				break;
+		}
+	}
+	if (tbe == NULL)
+		be->be_status = BST_PEND;
+	else
+		be->be_status = BST_BLOCK;
+	TAILQ_INSERT_TAIL(&bc->bc_pendq, be, be_link);
+	return (be->be_status == BST_PEND);
+}
+
+static int
+blockif_dequeue(struct blockif_ctxt *bc, pthread_t t, struct blockif_elem **bep)
+{
+	struct blockif_elem *be;
+
+	TAILQ_FOREACH(be, &bc->bc_pendq, be_link) {
+		if (be->be_status == BST_PEND)
+			break;
+		assert(be->be_status == BST_BLOCK);
+	}
+	if (be == NULL)
+		return (0);
+	TAILQ_REMOVE(&bc->bc_pendq, be, be_link);
+	be->be_status = BST_BUSY;
+	be->be_tid = t;
+	TAILQ_INSERT_TAIL(&bc->bc_busyq, be, be_link);
+	*bep = be;
+	return (1);
+}
+
+static void
+blockif_complete(struct blockif_ctxt *bc, struct blockif_elem *be)
+{
+	struct blockif_elem *tbe;
+
+	if (be->be_status == BST_DONE || be->be_status == BST_BUSY)
+		TAILQ_REMOVE(&bc->bc_busyq, be, be_link);
+	else
+		TAILQ_REMOVE(&bc->bc_pendq, be, be_link);
+	TAILQ_FOREACH(tbe, &bc->bc_pendq, be_link) {
+		if (tbe->be_req->br_offset == be->be_block)
+			tbe->be_status = BST_PEND;
+	}
+	be->be_tid = 0;
+	be->be_status = BST_FREE;
+	be->be_req = NULL;
+	TAILQ_INSERT_TAIL(&bc->bc_freeq, be, be_link);
+}
+
+static void
+blockif_proc(struct blockif_ctxt *bc, struct blockif_elem *be, uint8_t *buf)
+{
+	struct blockif_req *br;
+#ifdef	__FreeBSD__
+	off_t arg[2];
+#else
+	boolean_t sync = B_FALSE;
+#endif
+	ssize_t clen, len, off, boff, voff;
+	int i, err;
+
+	br = be->be_req;
+	if (br->br_iovcnt <= 1)
+		buf = NULL;
+	err = 0;
+	switch (be->be_op) {
+	case BOP_READ:
+		if (buf == NULL) {
+			if ((len = preadv(bc->bc_fd, br->br_iov, br->br_iovcnt,
+				   br->br_offset)) < 0)
+				err = errno;
+			else
+				br->br_resid -= len;
+			break;
+		}
+		i = 0;
+		off = voff = 0;
+		while (br->br_resid > 0) {
+			len = MIN(br->br_resid, MAXPHYS);
+			if (pread(bc->bc_fd, buf, len, br->br_offset +
+			    off) < 0) {
+				err = errno;
+				break;
+			}
+			boff = 0;
+			do {
+				clen = MIN(len - boff, br->br_iov[i].iov_len -
+				    voff);
+				memcpy(br->br_iov[i].iov_base + voff,
+				    buf + boff, clen);
+				if (clen < br->br_iov[i].iov_len - voff)
+					voff += clen;
+				else {
+					i++;
+					voff = 0;
+				}
+				boff += clen;
+			} while (boff < len);
+			off += len;
+			br->br_resid -= len;
+		}
+		break;
+#ifndef __FreeBSD__
+	case BOP_WRITE_SYNC:
+		sync = B_TRUE;
+		/* FALLTHROUGH */
+#endif
+	case BOP_WRITE:
+		if (bc->bc_rdonly) {
+			err = EROFS;
+			break;
+		}
+		if (buf == NULL) {
+			if ((len = pwritev(bc->bc_fd, br->br_iov, br->br_iovcnt,
+				    br->br_offset)) < 0)
+				err = errno;
+			else
+				br->br_resid -= len;
+			break;
+		}
+		i = 0;
+		off = voff = 0;
+		while (br->br_resid > 0) {
+			len = MIN(br->br_resid, MAXPHYS);
+			boff = 0;
+			do {
+				clen = MIN(len - boff, br->br_iov[i].iov_len -
+				    voff);
+				memcpy(buf + boff,
+				    br->br_iov[i].iov_base + voff, clen);
+				if (clen < br->br_iov[i].iov_len - voff)
+					voff += clen;
+				else {
+					i++;
+					voff = 0;
+				}
+				boff += clen;
+			} while (boff < len);
+			if (pwrite(bc->bc_fd, buf, len, br->br_offset +
+			    off) < 0) {
+				err = errno;
+				break;
+			}
+			off += len;
+			br->br_resid -= len;
+		}
+		break;
+	case BOP_FLUSH:
+#ifdef	__FreeBSD__
+		if (bc->bc_ischr) {
+			if (ioctl(bc->bc_fd, DIOCGFLUSH))
+				err = errno;
+		} else if (fsync(bc->bc_fd))
+			err = errno;
+#else
+		if (fsync(bc->bc_fd))
+			err = errno;
+#endif
+		break;
+	case BOP_DELETE:
+		if (!bc->bc_candelete)
+			err = EOPNOTSUPP;
+		else if (bc->bc_rdonly)
+			err = EROFS;
+#ifdef	__FreeBSD__
+		else if (bc->bc_ischr) {
+			arg[0] = br->br_offset;
+			arg[1] = br->br_resid;
+			if (ioctl(bc->bc_fd, DIOCGDELETE, arg))
+				err = errno;
+			else
+				br->br_resid = 0;
+		}
+#endif
+		else
+			 err = EOPNOTSUPP;
+		break;
+	default:
+		err = EINVAL;
+		break;
+	}
+
+#ifndef __FreeBSD__
+	if (sync && err == 0 && fsync(bc->bc_fd) < 0)
+		err = errno;
+#endif
+
+	be->be_status = BST_DONE;
+
+	(*br->br_callback)(br, err);
+}
+
+static void *
+blockif_thr(void *arg)
+{
+	struct blockif_ctxt *bc;
+	struct blockif_elem *be;
+	pthread_t t;
+	uint8_t *buf;
+
+	bc = arg;
+	if (bc->bc_isgeom)
+		buf = malloc(MAXPHYS);
+	else
+		buf = NULL;
+	t = pthread_self();
+
+	pthread_mutex_lock(&bc->bc_mtx);
+	for (;;) {
+		while (blockif_dequeue(bc, t, &be)) {
+			pthread_mutex_unlock(&bc->bc_mtx);
+			blockif_proc(bc, be, buf);
+			pthread_mutex_lock(&bc->bc_mtx);
+			blockif_complete(bc, be);
+		}
+		/* Check ctxt status here to see if exit requested */
+		if (bc->bc_closing)
+			break;
+		pthread_cond_wait(&bc->bc_cond, &bc->bc_mtx);
+	}
+	pthread_mutex_unlock(&bc->bc_mtx);
+
+	if (buf)
+		free(buf);
+	pthread_exit(NULL);
+	return (NULL);
+}
+
+#ifdef	__FreeBSD__
+static void
+blockif_sigcont_handler(int signal, enum ev_type type, void *arg)
+#else
+static void
+blockif_sigcont_handler(int signal)
+#endif
+{
+	struct blockif_sig_elem *bse;
+
+	for (;;) {
+		/*
+		 * Process the entire list even if not intended for
+		 * this thread.
+		 */
+		do {
+			bse = blockif_bse_head;
+			if (bse == NULL)
+				return;
+		} while (!atomic_cmpset_ptr((uintptr_t *)&blockif_bse_head,
+					    (uintptr_t)bse,
+					    (uintptr_t)bse->bse_next));
+
+		pthread_mutex_lock(&bse->bse_mtx);
+		bse->bse_pending = 0;
+		pthread_cond_signal(&bse->bse_cond);
+		pthread_mutex_unlock(&bse->bse_mtx);
+	}
+}
+
+static void
+blockif_init(void)
+{
+#ifdef	__FreeBSD__
+	mevent_add(SIGCONT, EVF_SIGNAL, blockif_sigcont_handler, NULL);
+	(void) signal(SIGCONT, SIG_IGN);
+#else
+	(void) sigset(SIGCONT, blockif_sigcont_handler);
+#endif
+}
+
+struct blockif_ctxt *
+blockif_open(const char *optstr, const char *ident)
+{
+	char tname[MAXCOMLEN + 1];
+#ifdef	__FreeBSD__
+	char name[MAXPATHLEN];
+#endif
+	char *nopt, *xopts, *cp;
+	struct blockif_ctxt *bc;
+	struct stat sbuf;
+#ifdef	__FreeBSD__
+	struct diocgattr_arg arg;
+#endif
+	off_t size, psectsz, psectoff;
+	int extra, fd, i, sectsz;
+	int nocache, sync, ro, candelete, geom, ssopt, pssopt;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+	cap_ioctl_t cmds[] = { DIOCGFLUSH, DIOCGDELETE };
+#endif
+
+	pthread_once(&blockif_once, blockif_init);
+
+	fd = -1;
+	ssopt = 0;
+	nocache = 0;
+	sync = 0;
+	ro = 0;
+
+	/*
+	 * The first element in the optstring is always a pathname.
+	 * Optional elements follow
+	 */
+	nopt = xopts = strdup(optstr);
+	while (xopts != NULL) {
+		cp = strsep(&xopts, ",");
+		if (cp == nopt)		/* file or device pathname */
+			continue;
+		else if (!strcmp(cp, "nocache"))
+			nocache = 1;
+		else if (!strcmp(cp, "sync") || !strcmp(cp, "direct"))
+			sync = 1;
+		else if (!strcmp(cp, "ro"))
+			ro = 1;
+		else if (sscanf(cp, "sectorsize=%d/%d", &ssopt, &pssopt) == 2)
+			;
+		else if (sscanf(cp, "sectorsize=%d", &ssopt) == 1)
+			pssopt = ssopt;
+		else {
+			fprintf(stderr, "Invalid device option \"%s\"\n", cp);
+			goto err;
+		}
+	}
+
+	extra = 0;
+	if (nocache)
+		extra |= O_DIRECT;
+	if (sync)
+		extra |= O_SYNC;
+
+	fd = open(nopt, (ro ? O_RDONLY : O_RDWR) | extra);
+	if (fd < 0 && !ro) {
+		/* Attempt a r/w fail with a r/o open */
+		fd = open(nopt, O_RDONLY | extra);
+		ro = 1;
+	}
+
+	if (fd < 0) {
+		warn("Could not open backing file: %s", nopt);
+		goto err;
+	}
+
+        if (fstat(fd, &sbuf) < 0) {
+		warn("Could not stat backing file %s", nopt);
+		goto err;
+        }
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_FSYNC, CAP_IOCTL, CAP_READ, CAP_SEEK,
+	    CAP_WRITE);
+	if (ro)
+		cap_rights_clear(&rights, CAP_FSYNC, CAP_WRITE);
+
+	if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+        /*
+	 * Deal with raw devices
+	 */
+        size = sbuf.st_size;
+	sectsz = DEV_BSIZE;
+	psectsz = psectoff = 0;
+	candelete = geom = 0;
+#ifdef	__FreeBSD__
+	if (S_ISCHR(sbuf.st_mode)) {
+		if (ioctl(fd, DIOCGMEDIASIZE, &size) < 0 ||
+		    ioctl(fd, DIOCGSECTORSIZE, &sectsz)) {
+			perror("Could not fetch dev blk/sector size");
+			goto err;
+		}
+		assert(size != 0);
+		assert(sectsz != 0);
+		if (ioctl(fd, DIOCGSTRIPESIZE, &psectsz) == 0 && psectsz > 0)
+			ioctl(fd, DIOCGSTRIPEOFFSET, &psectoff);
+		strlcpy(arg.name, "GEOM::candelete", sizeof(arg.name));
+		arg.len = sizeof(arg.value.i);
+		if (ioctl(fd, DIOCGATTR, &arg) == 0)
+			candelete = arg.value.i;
+		if (ioctl(fd, DIOCGPROVIDERNAME, name) == 0)
+			geom = 1;
+	} else
+#endif
+		psectsz = sbuf.st_blksize;
+
+#ifndef WITHOUT_CAPSICUM
+	if (cap_ioctls_limit(fd, cmds, nitems(cmds)) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	if (ssopt != 0) {
+		if (!powerof2(ssopt) || !powerof2(pssopt) || ssopt < 512 ||
+		    ssopt > pssopt) {
+			fprintf(stderr, "Invalid sector size %d/%d\n",
+			    ssopt, pssopt);
+			goto err;
+		}
+
+		/*
+		 * Some backend drivers (e.g. cd0, ada0) require that the I/O
+		 * size be a multiple of the device's sector size.
+		 *
+		 * Validate that the emulated sector size complies with this
+		 * requirement.
+		 */
+		if (S_ISCHR(sbuf.st_mode)) {
+			if (ssopt < sectsz || (ssopt % sectsz) != 0) {
+				fprintf(stderr, "Sector size %d incompatible "
+				    "with underlying device sector size %d\n",
+				    ssopt, sectsz);
+				goto err;
+			}
+		}
+
+		sectsz = ssopt;
+		psectsz = pssopt;
+		psectoff = 0;
+	}
+
+	bc = calloc(1, sizeof(struct blockif_ctxt));
+	if (bc == NULL) {
+		perror("calloc");
+		goto err;
+	}
+
+	bc->bc_magic = BLOCKIF_SIG;
+	bc->bc_fd = fd;
+	bc->bc_ischr = S_ISCHR(sbuf.st_mode);
+	bc->bc_isgeom = geom;
+	bc->bc_candelete = candelete;
+	bc->bc_rdonly = ro;
+	bc->bc_size = size;
+	bc->bc_sectsz = sectsz;
+	bc->bc_psectsz = psectsz;
+	bc->bc_psectoff = psectoff;
+	pthread_mutex_init(&bc->bc_mtx, NULL);
+	pthread_cond_init(&bc->bc_cond, NULL);
+	TAILQ_INIT(&bc->bc_freeq);
+	TAILQ_INIT(&bc->bc_pendq);
+	TAILQ_INIT(&bc->bc_busyq);
+	for (i = 0; i < BLOCKIF_MAXREQ; i++) {
+		bc->bc_reqs[i].be_status = BST_FREE;
+		TAILQ_INSERT_HEAD(&bc->bc_freeq, &bc->bc_reqs[i], be_link);
+	}
+
+	for (i = 0; i < BLOCKIF_NUMTHR; i++) {
+		pthread_create(&bc->bc_btid[i], NULL, blockif_thr, bc);
+		snprintf(tname, sizeof(tname), "blk-%s-%d", ident, i);
+		pthread_set_name_np(bc->bc_btid[i], tname);
+	}
+
+	return (bc);
+err:
+	if (fd >= 0)
+		close(fd);
+	return (NULL);
+}
+
+static int
+blockif_request(struct blockif_ctxt *bc, struct blockif_req *breq,
+		enum blockop op)
+{
+	int err;
+
+	err = 0;
+
+	pthread_mutex_lock(&bc->bc_mtx);
+	if (!TAILQ_EMPTY(&bc->bc_freeq)) {
+		/*
+		 * Enqueue and inform the block i/o thread
+		 * that there is work available
+		 */
+		if (blockif_enqueue(bc, breq, op))
+			pthread_cond_signal(&bc->bc_cond);
+	} else {
+		/*
+		 * Callers are not allowed to enqueue more than
+		 * the specified blockif queue limit. Return an
+		 * error to indicate that the queue length has been
+		 * exceeded.
+		 */
+		err = E2BIG;
+	}
+	pthread_mutex_unlock(&bc->bc_mtx);
+
+	return (err);
+}
+
+int
+blockif_read(struct blockif_ctxt *bc, struct blockif_req *breq)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (blockif_request(bc, breq, BOP_READ));
+}
+
+int
+#ifdef __FreeBSD__
+blockif_write(struct blockif_ctxt *bc, struct blockif_req *breq)
+#else
+blockif_write(struct blockif_ctxt *bc, struct blockif_req *breq, boolean_t sync)
+#endif
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+#ifdef __FreeBSD__
+	return (blockif_request(bc, breq, BOP_WRITE));
+#else
+	return (blockif_request(bc, breq, sync ? BOP_WRITE_SYNC : BOP_WRITE));
+#endif
+}
+
+int
+blockif_flush(struct blockif_ctxt *bc, struct blockif_req *breq)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (blockif_request(bc, breq, BOP_FLUSH));
+}
+
+int
+blockif_delete(struct blockif_ctxt *bc, struct blockif_req *breq)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (blockif_request(bc, breq, BOP_DELETE));
+}
+
+int
+blockif_cancel(struct blockif_ctxt *bc, struct blockif_req *breq)
+{
+	struct blockif_elem *be;
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+
+	pthread_mutex_lock(&bc->bc_mtx);
+	/*
+	 * Check pending requests.
+	 */
+	TAILQ_FOREACH(be, &bc->bc_pendq, be_link) {
+		if (be->be_req == breq)
+			break;
+	}
+	if (be != NULL) {
+		/*
+		 * Found it.
+		 */
+		blockif_complete(bc, be);
+		pthread_mutex_unlock(&bc->bc_mtx);
+
+		return (0);
+	}
+
+	/*
+	 * Check in-flight requests.
+	 */
+	TAILQ_FOREACH(be, &bc->bc_busyq, be_link) {
+		if (be->be_req == breq)
+			break;
+	}
+	if (be == NULL) {
+		/*
+		 * Didn't find it.
+		 */
+		pthread_mutex_unlock(&bc->bc_mtx);
+		return (EINVAL);
+	}
+
+	/*
+	 * Interrupt the processing thread to force it return
+	 * prematurely via it's normal callback path.
+	 */
+	while (be->be_status == BST_BUSY) {
+		struct blockif_sig_elem bse, *old_head;
+
+		pthread_mutex_init(&bse.bse_mtx, NULL);
+		pthread_cond_init(&bse.bse_cond, NULL);
+
+		bse.bse_pending = 1;
+
+		do {
+			old_head = blockif_bse_head;
+			bse.bse_next = old_head;
+		} while (!atomic_cmpset_ptr((uintptr_t *)&blockif_bse_head,
+					    (uintptr_t)old_head,
+					    (uintptr_t)&bse));
+
+		pthread_kill(be->be_tid, SIGCONT);
+
+		pthread_mutex_lock(&bse.bse_mtx);
+		while (bse.bse_pending)
+			pthread_cond_wait(&bse.bse_cond, &bse.bse_mtx);
+		pthread_mutex_unlock(&bse.bse_mtx);
+	}
+
+	pthread_mutex_unlock(&bc->bc_mtx);
+
+	/*
+	 * The processing thread has been interrupted.  Since it's not
+	 * clear if the callback has been invoked yet, return EBUSY.
+	 */
+	return (EBUSY);
+}
+
+int
+blockif_close(struct blockif_ctxt *bc)
+{
+	void *jval;
+	int i;
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+
+	/*
+	 * Stop the block i/o thread
+	 */
+	pthread_mutex_lock(&bc->bc_mtx);
+	bc->bc_closing = 1;
+	pthread_mutex_unlock(&bc->bc_mtx);
+	pthread_cond_broadcast(&bc->bc_cond);
+	for (i = 0; i < BLOCKIF_NUMTHR; i++)
+		pthread_join(bc->bc_btid[i], &jval);
+
+	/* XXX Cancel queued i/o's ??? */
+
+	/*
+	 * Release resources
+	 */
+	bc->bc_magic = 0;
+	close(bc->bc_fd);
+	free(bc);
+
+	return (0);
+}
+
+/*
+ * Return virtual C/H/S values for a given block. Use the algorithm
+ * outlined in the VHD specification to calculate values.
+ */
+void
+blockif_chs(struct blockif_ctxt *bc, uint16_t *c, uint8_t *h, uint8_t *s)
+{
+	off_t sectors;		/* total sectors of the block dev */
+	off_t hcyl;		/* cylinders times heads */
+	uint16_t secpt;		/* sectors per track */
+	uint8_t heads;
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+
+	sectors = bc->bc_size / bc->bc_sectsz;
+
+	/* Clamp the size to the largest possible with CHS */
+	if (sectors > 65535UL*16*255)
+		sectors = 65535UL*16*255;
+
+	if (sectors >= 65536UL*16*63) {
+		secpt = 255;
+		heads = 16;
+		hcyl = sectors / secpt;
+	} else {
+		secpt = 17;
+		hcyl = sectors / secpt;
+		heads = (hcyl + 1023) / 1024;
+
+		if (heads < 4)
+			heads = 4;
+
+		if (hcyl >= (heads * 1024) || heads > 16) {
+			secpt = 31;
+			heads = 16;
+			hcyl = sectors / secpt;
+		}
+		if (hcyl >= (heads * 1024)) {
+			secpt = 63;
+			heads = 16;
+			hcyl = sectors / secpt;
+		}
+	}
+
+	*c = hcyl / heads;
+	*h = heads;
+	*s = secpt;
+}
+
+/*
+ * Accessors
+ */
+off_t
+blockif_size(struct blockif_ctxt *bc)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (bc->bc_size);
+}
+
+int
+blockif_sectsz(struct blockif_ctxt *bc)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (bc->bc_sectsz);
+}
+
+void
+blockif_psectsz(struct blockif_ctxt *bc, int *size, int *off)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	*size = bc->bc_psectsz;
+	*off = bc->bc_psectoff;
+}
+
+int
+blockif_queuesz(struct blockif_ctxt *bc)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (BLOCKIF_MAXREQ - 1);
+}
+
+int
+blockif_is_ro(struct blockif_ctxt *bc)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (bc->bc_rdonly);
+}
+
+int
+blockif_candelete(struct blockif_ctxt *bc)
+{
+
+	assert(bc->bc_magic == BLOCKIF_SIG);
+	return (bc->bc_candelete);
+}
diff --git a/usr/src/cmd/bhyve/block_if.h b/usr/src/cmd/bhyve/block_if.h
new file mode 100644
index 0000000000..930cd62e83
--- /dev/null
+++ b/usr/src/cmd/bhyve/block_if.h
@@ -0,0 +1,81 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013  Peter Grehan <grehan@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * The block API to be used by bhyve block-device emulations. The routines
+ * are thread safe, with no assumptions about the context of the completion
+ * callback - it may occur in the caller's context, or asynchronously in
+ * another thread.
+ */
+
+#ifndef _BLOCK_IF_H_
+#define _BLOCK_IF_H_
+
+#include <sys/uio.h>
+#include <sys/unistd.h>
+
+#ifdef	__FreeBSD__
+#define BLOCKIF_IOV_MAX		33	/* not practical to be IOV_MAX */
+#else
+#define BLOCKIF_IOV_MAX		17	/* not practical to be IOV_MAX */
+#endif
+
+struct blockif_req {
+	struct iovec	br_iov[BLOCKIF_IOV_MAX];
+	int		br_iovcnt;
+	off_t		br_offset;
+	ssize_t		br_resid;
+	void		(*br_callback)(struct blockif_req *req, int err);
+	void		*br_param;
+};
+
+struct blockif_ctxt;
+struct blockif_ctxt *blockif_open(const char *optstr, const char *ident);
+off_t	blockif_size(struct blockif_ctxt *bc);
+void	blockif_chs(struct blockif_ctxt *bc, uint16_t *c, uint8_t *h,
+    uint8_t *s);
+int	blockif_sectsz(struct blockif_ctxt *bc);
+void	blockif_psectsz(struct blockif_ctxt *bc, int *size, int *off);
+int	blockif_queuesz(struct blockif_ctxt *bc);
+int	blockif_is_ro(struct blockif_ctxt *bc);
+int	blockif_candelete(struct blockif_ctxt *bc);
+int	blockif_read(struct blockif_ctxt *bc, struct blockif_req *breq);
+#ifdef __FreeBSD__
+int	blockif_write(struct blockif_ctxt *bc, struct blockif_req *breq);
+#else
+int	blockif_write(struct blockif_ctxt *bc, struct blockif_req *breq,
+    boolean_t sync);
+#endif
+int	blockif_flush(struct blockif_ctxt *bc, struct blockif_req *breq);
+int	blockif_delete(struct blockif_ctxt *bc, struct blockif_req *breq);
+int	blockif_cancel(struct blockif_ctxt *bc, struct blockif_req *breq);
+int	blockif_close(struct blockif_ctxt *bc);
+
+#endif /* _BLOCK_IF_H_ */
diff --git a/usr/src/cmd/bhyve/bootrom.c b/usr/src/cmd/bhyve/bootrom.c
new file mode 100644
index 0000000000..5e4e0e93a2
--- /dev/null
+++ b/usr/src/cmd/bhyve/bootrom.c
@@ -0,0 +1,111 @@
+/*-
+ * Copyright (c) 2015 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+
+#include <machine/vmm.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdbool.h>
+
+#include <vmmapi.h>
+#include "bhyverun.h"
+#include "bootrom.h"
+
+#define	MAX_BOOTROM_SIZE	(16 * 1024 * 1024)	/* 16 MB */
+
+int
+bootrom_init(struct vmctx *ctx, const char *romfile)
+{
+	struct stat sbuf;
+	vm_paddr_t gpa;
+	ssize_t rlen;
+	char *ptr;
+	int fd, i, rv, prot;
+
+	rv = -1;
+	fd = open(romfile, O_RDONLY);
+	if (fd < 0) {
+		fprintf(stderr, "Error opening bootrom \"%s\": %s\n",
+		    romfile, strerror(errno));
+		goto done;
+	}
+
+        if (fstat(fd, &sbuf) < 0) {
+		fprintf(stderr, "Could not fstat bootrom file \"%s\": %s\n",
+		    romfile, strerror(errno));
+		goto done;
+        }
+
+	/*
+	 * Limit bootrom size to 16MB so it doesn't encroach into reserved
+	 * MMIO space (e.g. APIC, HPET, MSI).
+	 */
+	if (sbuf.st_size > MAX_BOOTROM_SIZE || sbuf.st_size < PAGE_SIZE) {
+		fprintf(stderr, "Invalid bootrom size %ld\n", sbuf.st_size);
+		goto done;
+	}
+
+	if (sbuf.st_size & PAGE_MASK) {
+		fprintf(stderr, "Bootrom size %ld is not a multiple of the "
+		    "page size\n", sbuf.st_size);
+		goto done;
+	}
+
+	ptr = vm_create_devmem(ctx, VM_BOOTROM, "bootrom", sbuf.st_size);
+	if (ptr == MAP_FAILED)
+		goto done;
+
+	/* Map the bootrom into the guest address space */
+	prot = PROT_READ | PROT_EXEC;
+	gpa = (1ULL << 32) - sbuf.st_size;
+	if (vm_mmap_memseg(ctx, gpa, VM_BOOTROM, 0, sbuf.st_size, prot) != 0)
+		goto done;
+
+	/* Read 'romfile' into the guest address space */
+	for (i = 0; i < sbuf.st_size / PAGE_SIZE; i++) {
+		rlen = read(fd, ptr + i * PAGE_SIZE, PAGE_SIZE);
+		if (rlen != PAGE_SIZE) {
+			fprintf(stderr, "Incomplete read of page %d of bootrom "
+			    "file %s: %ld bytes\n", i, romfile, rlen);
+			goto done;
+		}
+	}
+	rv = 0;
+done:
+	if (fd >= 0)
+		close(fd);
+	return (rv);
+}
diff --git a/usr/src/cmd/bhyve/bootrom.h b/usr/src/cmd/bhyve/bootrom.h
new file mode 100644
index 0000000000..af150d3255
--- /dev/null
+++ b/usr/src/cmd/bhyve/bootrom.h
@@ -0,0 +1,38 @@
+/*-
+ * Copyright (c) 2015 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_BOOTROM_H_
+#define	_BOOTROM_H_
+
+#include <stdbool.h>
+
+struct vmctx;
+
+int	bootrom_init(struct vmctx *ctx, const char *romfile);
+
+#endif
diff --git a/usr/src/cmd/bhyve/console.c b/usr/src/cmd/bhyve/console.c
new file mode 100644
index 0000000000..ebb9c921bf
--- /dev/null
+++ b/usr/src/cmd/bhyve/console.c
@@ -0,0 +1,118 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include "bhyvegc.h"
+#include "console.h"
+
+static struct {
+	struct bhyvegc		*gc;
+
+	fb_render_func_t	fb_render_cb;
+	void			*fb_arg;
+
+	kbd_event_func_t	kbd_event_cb;
+	void			*kbd_arg;
+	int			kbd_priority;
+
+	ptr_event_func_t	ptr_event_cb;
+	void			*ptr_arg;
+	int			ptr_priority;
+} console;
+
+void
+console_init(int w, int h, void *fbaddr)
+{
+	console.gc = bhyvegc_init(w, h, fbaddr);
+}
+
+void
+console_set_fbaddr(void *fbaddr)
+{
+	bhyvegc_set_fbaddr(console.gc, fbaddr);
+}
+
+struct bhyvegc_image *
+console_get_image(void)
+{
+	struct bhyvegc_image *bhyvegc_image;
+
+	bhyvegc_image = bhyvegc_get_image(console.gc);
+
+	return (bhyvegc_image);
+}
+
+void
+console_fb_register(fb_render_func_t render_cb, void *arg)
+{
+	console.fb_render_cb = render_cb;
+	console.fb_arg = arg;
+}
+
+void
+console_refresh(void)
+{
+	if (console.fb_render_cb)
+		(*console.fb_render_cb)(console.gc, console.fb_arg);
+}
+
+void
+console_kbd_register(kbd_event_func_t event_cb, void *arg, int pri)
+{
+	if (pri > console.kbd_priority) {
+		console.kbd_event_cb = event_cb;
+		console.kbd_arg = arg;
+		console.kbd_priority = pri;
+	}
+}
+
+void
+console_ptr_register(ptr_event_func_t event_cb, void *arg, int pri)
+{
+	if (pri > console.ptr_priority) {
+		console.ptr_event_cb = event_cb;
+		console.ptr_arg = arg;
+		console.ptr_priority = pri;
+	}
+}
+
+void
+console_key_event(int down, uint32_t keysym)
+{
+	if (console.kbd_event_cb)
+		(*console.kbd_event_cb)(down, keysym, console.kbd_arg);
+}
+
+void
+console_ptr_event(uint8_t button, int x, int y)
+{
+	if (console.ptr_event_cb)
+		(*console.ptr_event_cb)(button, x, y, console.ptr_arg);
+}
diff --git a/usr/src/cmd/bhyve/console.h b/usr/src/cmd/bhyve/console.h
new file mode 100644
index 0000000000..47193938a6
--- /dev/null
+++ b/usr/src/cmd/bhyve/console.h
@@ -0,0 +1,53 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _CONSOLE_H_
+#define	_CONSOLE_H_
+
+struct bhyvegc;
+
+typedef void (*fb_render_func_t)(struct bhyvegc *gc, void *arg);
+typedef void (*kbd_event_func_t)(int down, uint32_t keysym, void *arg);
+typedef void (*ptr_event_func_t)(uint8_t mask, int x, int y, void *arg);
+
+void	console_init(int w, int h, void *fbaddr);
+
+void	console_set_fbaddr(void *fbaddr);
+
+struct bhyvegc_image *console_get_image(void);
+
+void	console_fb_register(fb_render_func_t render_cb, void *arg);
+void	console_refresh(void);
+
+void	console_kbd_register(kbd_event_func_t event_cb, void *arg, int pri);
+void	console_key_event(int down, uint32_t keysym);
+
+void	console_ptr_register(ptr_event_func_t event_cb, void *arg, int pri);
+void	console_ptr_event(uint8_t button, int x, int y);
+
+#endif /* _CONSOLE_H_ */
diff --git a/usr/src/cmd/bhyve/consport.c b/usr/src/cmd/bhyve/consport.c
new file mode 100644
index 0000000000..7996e4ffab
--- /dev/null
+++ b/usr/src/cmd/bhyve/consport.c
@@ -0,0 +1,179 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/select.h>
+
+#include <err.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <termios.h>
+#include <unistd.h>
+#include <stdbool.h>
+#include <sysexits.h>
+
+#include "inout.h"
+#include "pci_lpc.h"
+
+#define	BVM_CONSOLE_PORT	0x220
+#define	BVM_CONS_SIG		('b' << 8 | 'v')
+
+#ifdef	__FreeBSD__
+static struct termios tio_orig, tio_new;
+
+static void
+ttyclose(void)
+{
+	tcsetattr(STDIN_FILENO, TCSANOW, &tio_orig);
+}
+#endif
+
+static void
+ttyopen(void)
+{
+#ifdef	__FreeBSD__
+	tcgetattr(STDIN_FILENO, &tio_orig);
+
+	cfmakeraw(&tio_new);
+	tcsetattr(STDIN_FILENO, TCSANOW, &tio_new);	
+
+	atexit(ttyclose);
+#endif
+}
+
+static bool
+tty_char_available(void)
+{
+        fd_set rfds;
+        struct timeval tv;
+
+        FD_ZERO(&rfds);
+        FD_SET(STDIN_FILENO, &rfds);
+        tv.tv_sec = 0;
+        tv.tv_usec = 0;
+        if (select(STDIN_FILENO + 1, &rfds, NULL, NULL, &tv) > 0) {
+		return (true);
+	} else {
+		return (false);
+	}
+}
+
+static int
+ttyread(void)
+{
+	char rb;
+
+	if (tty_char_available()) {
+		read(STDIN_FILENO, &rb, 1);
+		return (rb & 0xff);
+	} else {
+		return (-1);
+	}
+}
+
+static void
+ttywrite(unsigned char wb)
+{
+	(void) write(STDOUT_FILENO, &wb, 1);
+}
+
+static int
+console_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+		uint32_t *eax, void *arg)
+{
+	static int opened;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+	cap_ioctl_t cmds[] = { TIOCGETA, TIOCSETA, TIOCGWINSZ };
+#endif
+
+	if (bytes == 2 && in) {
+		*eax = BVM_CONS_SIG;
+		return (0);
+	}
+
+	/*
+	 * Guests might probe this port to look for old ISA devices
+	 * using single-byte reads.  Return 0xff for those.
+	 */
+	if (bytes == 1 && in) {
+		*eax = 0xff;
+		return (0);
+	}
+
+	if (bytes != 4)
+		return (-1);
+
+	if (!opened) {
+#ifndef WITHOUT_CAPSICUM
+		cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ,
+		    CAP_WRITE);
+		if (cap_rights_limit(STDIN_FILENO, &rights) == -1 &&
+		    errno != ENOSYS)
+			errx(EX_OSERR, "Unable to apply rights for sandbox");
+		if (cap_ioctls_limit(STDIN_FILENO, cmds, nitems(cmds)) == -1 &&
+		    errno != ENOSYS)
+			errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+		ttyopen();
+		opened = 1;
+	}
+	
+	if (in)
+		*eax = ttyread();
+	else
+		ttywrite(*eax);
+
+	return (0);
+}
+
+SYSRES_IO(BVM_CONSOLE_PORT, 4);
+
+static struct inout_port consport = {
+	"bvmcons",
+	BVM_CONSOLE_PORT,
+	1,
+	IOPORT_F_INOUT,
+	console_handler
+};
+
+void
+init_bvmcons(void)
+{
+
+	register_inout(&consport);
+}
diff --git a/usr/src/cmd/bhyve/dbgport.c b/usr/src/cmd/bhyve/dbgport.c
new file mode 100644
index 0000000000..d6c5f9383e
--- /dev/null
+++ b/usr/src/cmd/bhyve/dbgport.c
@@ -0,0 +1,177 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <sys/uio.h>
+
+#include <err.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sysexits.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <errno.h>
+
+#include "inout.h"
+#include "dbgport.h"
+#include "pci_lpc.h"
+
+#define	BVM_DBG_PORT	0x224
+#define	BVM_DBG_SIG	('B' << 8 | 'V')
+
+static int listen_fd, conn_fd;
+
+static struct sockaddr_in sin;
+
+static int
+dbg_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+	    uint32_t *eax, void *arg)
+{
+	int nwritten, nread, printonce;
+	int on = 1;
+	char ch;
+
+	if (bytes == 2 && in) {
+		*eax = BVM_DBG_SIG;
+		return (0);
+	}
+
+	if (bytes != 4)
+		return (-1);
+
+again:
+	printonce = 0;
+	while (conn_fd < 0) {
+		if (!printonce) {
+			printf("Waiting for connection from gdb\r\n");
+			printonce = 1;
+		}
+		conn_fd = accept4(listen_fd, NULL, NULL, SOCK_NONBLOCK);
+		if (conn_fd >= 0) {
+			/* Avoid EPIPE after the client drops off. */
+			(void)setsockopt(conn_fd, SOL_SOCKET, SO_NOSIGPIPE,
+			    &on, sizeof(on));
+			/* Improve latency for one byte at a time tranfers. */
+			(void)setsockopt(conn_fd, IPPROTO_TCP, TCP_NODELAY,
+			    &on, sizeof(on));
+		} else if (errno != EINTR) {
+			perror("accept");
+		}
+	}
+
+	if (in) {
+		nread = read(conn_fd, &ch, 1);
+		if (nread == -1 && errno == EAGAIN)
+			*eax = -1;
+		else if (nread == 1)
+			*eax = ch;
+		else {
+			close(conn_fd);
+			conn_fd = -1;
+			goto again;
+		}
+	} else {
+		ch = *eax;
+		nwritten = write(conn_fd, &ch, 1);
+		if (nwritten != 1) {
+			close(conn_fd);
+			conn_fd = -1;
+			goto again;
+		}
+	}
+	return (0);
+}
+
+static struct inout_port dbgport = {
+	"bvmdbg",
+	BVM_DBG_PORT,
+	1,
+	IOPORT_F_INOUT,
+	dbg_handler
+};
+
+SYSRES_IO(BVM_DBG_PORT, 4);
+
+void
+init_dbgport(int sport)
+{
+	int reuse;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+#endif
+
+	conn_fd = -1;
+
+	if ((listen_fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+		perror("socket");
+		exit(1);
+	}
+
+#ifdef	__FreeBSD__
+	sin.sin_len = sizeof(sin);
+#endif
+	sin.sin_family = AF_INET;
+	sin.sin_addr.s_addr = htonl(INADDR_ANY);
+	sin.sin_port = htons(sport);
+
+	reuse = 1;
+	if (setsockopt(listen_fd, SOL_SOCKET, SO_REUSEADDR, &reuse,
+	    sizeof(reuse)) < 0) {
+		perror("setsockopt");
+		exit(1);
+	}
+
+	if (bind(listen_fd, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
+		perror("bind");
+		exit(1);
+	}
+
+	if (listen(listen_fd, 1) < 0) {
+		perror("listen");
+		exit(1);
+	}
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_ACCEPT, CAP_READ, CAP_WRITE);
+	if (cap_rights_limit(listen_fd, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	register_inout(&dbgport);
+}
diff --git a/usr/src/cmd/bhyve/dbgport.h b/usr/src/cmd/bhyve/dbgport.h
new file mode 100644
index 0000000000..407ff3ffbf
--- /dev/null
+++ b/usr/src/cmd/bhyve/dbgport.h
@@ -0,0 +1,36 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _DBGPORT_H_
+#define	_DBGPORT_H_
+
+void	init_dbgport(int port);
+
+#endif
diff --git a/usr/src/cmd/bhyve/fwctl.c b/usr/src/cmd/bhyve/fwctl.c
new file mode 100644
index 0000000000..9e90c1ade6
--- /dev/null
+++ b/usr/src/cmd/bhyve/fwctl.c
@@ -0,0 +1,549 @@
+/*-
+ * Copyright (c) 2015  Peter Grehan <grehan@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Guest firmware interface. Uses i/o ports x510/x511 as Qemu does,
+ * but with a request/response messaging protocol.
+ */
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/uio.h>
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "bhyverun.h"
+#include "inout.h"
+#include "fwctl.h"
+
+/*
+ * Messaging protocol base operations
+ */
+#define	OP_NULL		1
+#define	OP_ECHO		2
+#define	OP_GET		3
+#define	OP_GET_LEN	4
+#define	OP_SET		5
+#define	OP_MAX		OP_SET
+
+/* I/O ports */
+#define	FWCTL_OUT	0x510
+#define	FWCTL_IN	0x511
+
+/*
+ * Back-end state-machine
+ */
+enum state {
+	DORMANT,
+	IDENT_WAIT,
+	IDENT_SEND,
+	REQ,
+	RESP
+} be_state = DORMANT;
+
+static uint8_t sig[] = { 'B', 'H', 'Y', 'V' };
+static u_int ident_idx;
+
+struct op_info {
+	int op;
+	int  (*op_start)(int len);
+	void (*op_data)(uint32_t data, int len);
+	int  (*op_result)(struct iovec **data);
+	void (*op_done)(struct iovec *data);
+};
+static struct op_info *ops[OP_MAX+1];
+
+/* Return 0-padded uint32_t */
+static uint32_t
+fwctl_send_rest(uint32_t *data, size_t len)
+{
+	union {
+		uint8_t c[4];
+		uint32_t w;
+	} u;
+	uint8_t *cdata;
+	int i;
+
+	cdata = (uint8_t *) data;
+	u.w = 0;	
+
+	for (i = 0, u.w = 0; i < len; i++)
+		u.c[i] = *cdata++;
+
+	return (u.w);
+}
+
+/*
+ * error op dummy proto - drop all data sent and return an error
+*/
+static int errop_code;
+
+static void
+errop_set(int err)
+{
+
+	errop_code = err;
+}
+
+static int
+errop_start(int len)
+{
+	errop_code = ENOENT;
+
+	/* accept any length */
+	return (errop_code);
+}
+
+static void
+errop_data(uint32_t data, int len)
+{
+
+	/* ignore */
+}
+
+static int
+errop_result(struct iovec **data)
+{
+
+	/* no data to send back; always successful */
+	*data = NULL;
+	return (errop_code);
+}
+
+static void
+errop_done(struct iovec *data)
+{
+
+	/* assert data is NULL */
+}
+
+static struct op_info errop_info = {
+	.op_start  = errop_start,
+	.op_data   = errop_data,
+	.op_result = errop_result,
+	.op_done   = errop_done
+};
+
+/* OID search */
+SET_DECLARE(ctl_set, struct ctl);
+
+CTL_NODE("hw.ncpu", &guest_ncpus, sizeof(guest_ncpus));
+
+static struct ctl *
+ctl_locate(const char *str, int maxlen)
+{
+	struct ctl *cp, **cpp;
+
+	SET_FOREACH(cpp, ctl_set)  {
+		cp = *cpp;
+		if (!strncmp(str, cp->c_oid, maxlen))
+			return (cp);
+	}
+
+	return (NULL);
+}
+
+/* uefi-sysctl get-len */
+#define FGET_STRSZ	80
+static struct iovec fget_biov[2];
+static char fget_str[FGET_STRSZ];
+static struct {
+	size_t f_sz;
+	uint32_t f_data[1024];
+} fget_buf;
+static int fget_cnt;
+static size_t fget_size;
+
+static int
+fget_start(int len)
+{
+
+	if (len > FGET_STRSZ)
+		return(E2BIG);
+
+	fget_cnt = 0;
+
+	return (0);
+}
+
+static void
+fget_data(uint32_t data, int len)
+{
+
+	*((uint32_t *) &fget_str[fget_cnt]) = data;
+	fget_cnt += sizeof(uint32_t);
+}
+
+static int
+fget_result(struct iovec **data, int val)
+{
+	struct ctl *cp;
+	int err;
+
+	err = 0;
+
+	/* Locate the OID */
+	cp = ctl_locate(fget_str, fget_cnt);
+	if (cp == NULL) {
+		*data = NULL;
+		err = ENOENT;
+	} else {
+		if (val) {
+			/* For now, copy the len/data into a buffer */
+			memset(&fget_buf, 0, sizeof(fget_buf));
+			fget_buf.f_sz = cp->c_len;
+			memcpy(fget_buf.f_data, cp->c_data, cp->c_len);
+			fget_biov[0].iov_base = (char *)&fget_buf;
+			fget_biov[0].iov_len  = sizeof(fget_buf.f_sz) +
+				cp->c_len;
+		} else {
+			fget_size = cp->c_len;
+			fget_biov[0].iov_base = (char *)&fget_size;
+			fget_biov[0].iov_len  = sizeof(fget_size);
+		}
+
+		fget_biov[1].iov_base = NULL;
+		fget_biov[1].iov_len  = 0;
+		*data = fget_biov;
+	}
+
+	return (err);
+}
+
+static void
+fget_done(struct iovec *data)
+{
+
+	/* nothing needs to be freed */
+}
+
+static int
+fget_len_result(struct iovec **data)
+{
+	return (fget_result(data, 0));
+}
+
+static int
+fget_val_result(struct iovec **data)
+{
+	return (fget_result(data, 1));
+}
+
+static struct op_info fgetlen_info = {
+	.op_start  = fget_start,
+	.op_data   = fget_data,
+	.op_result = fget_len_result,
+	.op_done   = fget_done
+};
+
+static struct op_info fgetval_info = {
+	.op_start  = fget_start,
+	.op_data   = fget_data,
+	.op_result = fget_val_result,
+	.op_done   = fget_done
+};
+
+static struct req_info {
+	int      req_error;
+	u_int    req_count;
+	uint32_t req_size;
+	uint32_t req_type;
+	uint32_t req_txid;
+	struct op_info *req_op;
+	int	 resp_error;
+	int	 resp_count;
+	int	 resp_size;
+	int	 resp_off;
+	struct iovec *resp_biov;
+} rinfo;
+
+static void
+fwctl_response_done(void)
+{
+
+	(*rinfo.req_op->op_done)(rinfo.resp_biov);
+
+	/* reinit the req data struct */
+	memset(&rinfo, 0, sizeof(rinfo));
+}
+
+static void
+fwctl_request_done(void)
+{
+
+	rinfo.resp_error = (*rinfo.req_op->op_result)(&rinfo.resp_biov);
+
+	/* XXX only a single vector supported at the moment */
+	rinfo.resp_off = 0;
+	if (rinfo.resp_biov == NULL) {
+		rinfo.resp_size = 0;
+	} else {
+		rinfo.resp_size = rinfo.resp_biov[0].iov_len;
+	}
+}
+
+static int
+fwctl_request_start(void)
+{
+	int err;
+
+	/* Data size doesn't include header */
+	rinfo.req_size -= 12;
+
+	rinfo.req_op = &errop_info;
+	if (rinfo.req_type <= OP_MAX && ops[rinfo.req_type] != NULL)
+		rinfo.req_op = ops[rinfo.req_type];
+
+	err = (*rinfo.req_op->op_start)(rinfo.req_size);
+
+	if (err) {
+		errop_set(err);
+		rinfo.req_op = &errop_info;
+	}
+
+	/* Catch case of zero-length message here */
+	if (rinfo.req_size == 0) {
+		fwctl_request_done();
+		return (1);
+	}
+
+	return (0);
+}
+
+static int
+fwctl_request_data(uint32_t value)
+{
+	int remlen;
+
+	/* Make sure remaining size is >= 0 */
+	rinfo.req_size -= sizeof(uint32_t);
+	remlen = MAX(rinfo.req_size, 0);
+
+	(*rinfo.req_op->op_data)(value, remlen);
+
+	if (rinfo.req_size < sizeof(uint32_t)) {
+		fwctl_request_done();
+		return (1);
+	}
+
+	return (0);
+}
+
+static int
+fwctl_request(uint32_t value)
+{
+
+	int ret;
+
+	ret = 0;
+
+	switch (rinfo.req_count) {
+	case 0:
+		/* Verify size */
+		if (value < 12) {
+			printf("msg size error");
+			exit(1);
+		}
+		rinfo.req_size = value;
+		rinfo.req_count = 1;
+		break;
+	case 1:
+		rinfo.req_type = value;
+		rinfo.req_count++;
+		break;
+	case 2:
+		rinfo.req_txid = value;
+		rinfo.req_count++;
+		ret = fwctl_request_start();
+		break;
+	default:
+		ret = fwctl_request_data(value);
+		break;
+	}
+
+	return (ret);
+}
+
+static int
+fwctl_response(uint32_t *retval)
+{
+	uint32_t *dp;
+	int remlen;
+
+	switch(rinfo.resp_count) {
+	case 0:
+		/* 4 x u32 header len + data */
+		*retval = 4*sizeof(uint32_t) +
+		    roundup(rinfo.resp_size, sizeof(uint32_t));
+		rinfo.resp_count++;
+		break;
+	case 1:
+		*retval = rinfo.req_type;
+		rinfo.resp_count++;
+		break;
+	case 2:
+		*retval = rinfo.req_txid;
+		rinfo.resp_count++;
+		break;
+	case 3:
+		*retval = rinfo.resp_error;
+		rinfo.resp_count++;
+		break;
+	default:
+		remlen = rinfo.resp_size - rinfo.resp_off;
+		dp = (uint32_t *)
+		    ((uint8_t *)rinfo.resp_biov->iov_base + rinfo.resp_off);
+		if (remlen >= sizeof(uint32_t)) {
+			*retval = *dp;
+		} else if (remlen > 0) {
+			*retval = fwctl_send_rest(dp, remlen);
+		}
+		rinfo.resp_off += sizeof(uint32_t);
+		break;
+	}
+
+	if (rinfo.resp_count > 3 &&
+	    rinfo.resp_size - rinfo.resp_off <= 0) {
+		fwctl_response_done();
+		return (1);
+	}
+
+	return (0);
+}
+
+
+/*
+ * i/o port handling.
+ */
+static uint8_t
+fwctl_inb(void)
+{
+	uint8_t retval;
+
+	retval = 0xff;
+
+	switch (be_state) {
+	case IDENT_SEND:
+		retval = sig[ident_idx++];
+		if (ident_idx >= sizeof(sig))
+			be_state = REQ;
+		break;
+	default:
+		break;
+	}
+
+	return (retval);
+}
+
+static void
+fwctl_outw(uint16_t val)
+{
+	switch (be_state) {
+	case IDENT_WAIT:
+		if (val == 0) {
+			be_state = IDENT_SEND;
+			ident_idx = 0;
+		}
+		break;
+	default:
+		/* ignore */
+		break;
+	}
+}
+
+static uint32_t
+fwctl_inl(void)
+{
+	uint32_t retval;
+
+	switch (be_state) {
+	case RESP:
+		if (fwctl_response(&retval))
+			be_state = REQ;
+		break;
+	default:
+		retval = 0xffffffff;
+		break;
+	}
+
+	return (retval);
+}
+
+static void
+fwctl_outl(uint32_t val)
+{
+
+	switch (be_state) {
+	case REQ:
+		if (fwctl_request(val))
+			be_state = RESP;
+	default:
+		break;
+	}
+
+}
+
+static int
+fwctl_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+    uint32_t *eax, void *arg)
+{
+
+	if (in) {
+		if (bytes == 1)
+			*eax = fwctl_inb();
+		else if (bytes == 4)
+			*eax = fwctl_inl();
+		else
+			*eax = 0xffff;
+	} else {
+		if (bytes == 2)
+			fwctl_outw(*eax);
+		else if (bytes == 4)
+			fwctl_outl(*eax);
+	}
+
+	return (0);
+}
+INOUT_PORT(fwctl_wreg, FWCTL_OUT, IOPORT_F_INOUT, fwctl_handler);
+INOUT_PORT(fwctl_rreg, FWCTL_IN,  IOPORT_F_IN,    fwctl_handler);
+
+void
+fwctl_init(void)
+{
+
+	ops[OP_GET_LEN] = &fgetlen_info;
+	ops[OP_GET]     = &fgetval_info;
+
+	be_state = IDENT_WAIT;
+}
diff --git a/usr/src/cmd/bhyve/fwctl.h b/usr/src/cmd/bhyve/fwctl.h
new file mode 100644
index 0000000000..f5f8d131ab
--- /dev/null
+++ b/usr/src/cmd/bhyve/fwctl.h
@@ -0,0 +1,54 @@
+/*-
+ * Copyright (c) 2015  Peter Grehan <grehan@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _FWCTL_H_
+#define _FWCTL_H_
+
+#include <sys/linker_set.h>
+
+/*
+ * Linker set api for export of information to guest firmware via
+ * a sysctl-like OID interface
+ */
+struct ctl {
+	const char *c_oid;
+	const void *c_data;
+	const int c_len;
+};
+
+#define CTL_NODE(oid, data, len)				\
+	static struct ctl __CONCAT(__ctl, __LINE__) = {		\
+		oid,						\
+		(data),						\
+		(len),						\
+	};							\
+	DATA_SET(ctl_set, __CONCAT(__ctl, __LINE__))
+
+void	fwctl_init(void);
+
+#endif /* _FWCTL_H_ */
diff --git a/usr/src/cmd/bhyve/gdb.c b/usr/src/cmd/bhyve/gdb.c
new file mode 100644
index 0000000000..4414a05e27
--- /dev/null
+++ b/usr/src/cmd/bhyve/gdb.c
@@ -0,0 +1,1328 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2017-2018 John H. Baldwin <jhb@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/socket.h>
+#include <machine/atomic.h>
+#include <machine/specialreg.h>
+#include <machine/vmm.h>
+#include <netinet/in.h>
+#include <assert.h>
+#ifndef WITHOUT_CAPSICUM
+#include <capsicum_helpers.h>
+#endif
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <pthread_np.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+#include <vmmapi.h>
+
+#include "bhyverun.h"
+#include "mem.h"
+#include "mevent.h"
+
+/*
+ * GDB_SIGNAL_* numbers are part of the GDB remote protocol.  Most stops
+ * use SIGTRAP.
+ */
+#define	GDB_SIGNAL_TRAP		5
+
+static void gdb_resume_vcpus(void);
+static void check_command(int fd);
+
+static struct mevent *read_event, *write_event;
+
+static cpuset_t vcpus_active, vcpus_suspended, vcpus_waiting;
+static pthread_mutex_t gdb_lock;
+static pthread_cond_t idle_vcpus;
+static bool stop_pending, first_stop;
+static int stepping_vcpu, stopped_vcpu;
+
+/*
+ * An I/O buffer contains 'capacity' bytes of room at 'data'.  For a
+ * read buffer, 'start' is unused and 'len' contains the number of
+ * valid bytes in the buffer.  For a write buffer, 'start' is set to
+ * the index of the next byte in 'data' to send, and 'len' contains
+ * the remaining number of valid bytes to send.
+ */
+struct io_buffer {
+	uint8_t *data;
+	size_t capacity;
+	size_t start;
+	size_t len;
+};
+
+static struct io_buffer cur_comm, cur_resp;
+static uint8_t cur_csum;
+static int cur_vcpu;
+static struct vmctx *ctx;
+static int cur_fd = -1;
+
+const int gdb_regset[] = {
+	VM_REG_GUEST_RAX,
+	VM_REG_GUEST_RBX,
+	VM_REG_GUEST_RCX,
+	VM_REG_GUEST_RDX,
+	VM_REG_GUEST_RSI,
+	VM_REG_GUEST_RDI,
+	VM_REG_GUEST_RBP,
+	VM_REG_GUEST_RSP,
+	VM_REG_GUEST_R8,
+	VM_REG_GUEST_R9,
+	VM_REG_GUEST_R10,
+	VM_REG_GUEST_R11,
+	VM_REG_GUEST_R12,
+	VM_REG_GUEST_R13,
+	VM_REG_GUEST_R14,
+	VM_REG_GUEST_R15,
+	VM_REG_GUEST_RIP,
+	VM_REG_GUEST_RFLAGS,
+	VM_REG_GUEST_CS,
+	VM_REG_GUEST_SS,
+	VM_REG_GUEST_DS,
+	VM_REG_GUEST_ES,
+	VM_REG_GUEST_FS,
+	VM_REG_GUEST_GS
+};
+
+const int gdb_regsize[] = {
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	8,
+	4,
+	4,
+	4,
+	4,
+	4,
+	4,
+	4
+};
+
+#ifdef GDB_LOG
+#include <stdarg.h>
+#include <stdio.h>
+
+static void __printflike(1, 2)
+debug(const char *fmt, ...)
+{
+	static FILE *logfile;
+	va_list ap;
+
+	if (logfile == NULL) {
+		logfile = fopen("/tmp/bhyve_gdb.log", "w");
+		if (logfile == NULL)
+			return;
+#ifndef WITHOUT_CAPSICUM
+		if (caph_limit_stream(fileno(logfile), CAPH_WRITE) == -1) {
+			fclose(logfile);
+			logfile = NULL;
+			return;
+		}
+#endif
+		setlinebuf(logfile);
+	}
+	va_start(ap, fmt);
+	vfprintf(logfile, fmt, ap);
+	va_end(ap);
+}
+#else
+#define debug(...)
+#endif
+
+static int
+guest_paging_info(int vcpu, struct vm_guest_paging *paging)
+{
+	uint64_t regs[4];
+	const int regset[4] = {
+		VM_REG_GUEST_CR0,
+		VM_REG_GUEST_CR3,
+		VM_REG_GUEST_CR4,
+		VM_REG_GUEST_EFER
+	};
+
+	if (vm_get_register_set(ctx, vcpu, nitems(regset), regset, regs) == -1)
+		return (-1);
+
+	/*
+	 * For the debugger, always pretend to be the kernel (CPL 0),
+	 * and if long-mode is enabled, always parse addresses as if
+	 * in 64-bit mode.
+	 */
+	paging->cr3 = regs[1];
+	paging->cpl = 0;
+	if (regs[3] & EFER_LMA)
+		paging->cpu_mode = CPU_MODE_64BIT;
+	else if (regs[0] & CR0_PE)
+		paging->cpu_mode = CPU_MODE_PROTECTED;
+	else
+		paging->cpu_mode = CPU_MODE_REAL;
+	if (!(regs[0] & CR0_PG))
+		paging->paging_mode = PAGING_MODE_FLAT;
+	else if (!(regs[2] & CR4_PAE))
+		paging->paging_mode = PAGING_MODE_32;
+	else if (regs[3] & EFER_LME)
+		paging->paging_mode = PAGING_MODE_64;
+	else
+		paging->paging_mode = PAGING_MODE_PAE;
+	return (0);
+}
+
+/*
+ * Map a guest virtual address to a physical address (for a given vcpu).
+ * If a guest virtual address is valid, return 1.  If the address is
+ * not valid, return 0.  If an error occurs obtaining the mapping,
+ * return -1.
+ */
+static int
+guest_vaddr2paddr(int vcpu, uint64_t vaddr, uint64_t *paddr)
+{
+	struct vm_guest_paging paging;
+	int fault;
+
+	if (guest_paging_info(vcpu, &paging) == -1)
+		return (-1);
+
+	/*
+	 * Always use PROT_READ.  We really care if the VA is
+	 * accessible, not if the current vCPU can write.
+	 */
+	if (vm_gla2gpa_nofault(ctx, vcpu, &paging, vaddr, PROT_READ, paddr,
+	    &fault) == -1)
+		return (-1);
+	if (fault)
+		return (0);
+	return (1);
+}
+
+static void
+io_buffer_reset(struct io_buffer *io)
+{
+
+	io->start = 0;
+	io->len = 0;
+}
+
+/* Available room for adding data. */
+static size_t
+io_buffer_avail(struct io_buffer *io)
+{
+
+	return (io->capacity - (io->start + io->len));
+}
+
+static uint8_t *
+io_buffer_head(struct io_buffer *io)
+{
+
+	return (io->data + io->start);
+}
+
+static uint8_t *
+io_buffer_tail(struct io_buffer *io)
+{
+
+	return (io->data + io->start + io->len);
+}
+
+static void
+io_buffer_advance(struct io_buffer *io, size_t amount)
+{
+
+	assert(amount <= io->len);
+	io->start += amount;
+	io->len -= amount;
+}
+
+static void
+io_buffer_consume(struct io_buffer *io, size_t amount)
+{
+
+	io_buffer_advance(io, amount);
+	if (io->len == 0) {
+		io->start = 0;
+		return;
+	}
+
+	/*
+	 * XXX: Consider making this move optional and compacting on a
+	 * future read() before realloc().
+	 */
+	memmove(io->data, io_buffer_head(io), io->len);
+	io->start = 0;
+}
+
+static void
+io_buffer_grow(struct io_buffer *io, size_t newsize)
+{
+	uint8_t *new_data;
+	size_t avail, new_cap;
+
+	avail = io_buffer_avail(io);
+	if (newsize <= avail)
+		return;
+
+	new_cap = io->capacity + (newsize - avail);
+	new_data = realloc(io->data, new_cap);
+	if (new_data == NULL)
+		err(1, "Failed to grow GDB I/O buffer");
+	io->data = new_data;
+	io->capacity = new_cap;
+}
+
+static bool
+response_pending(void)
+{
+
+	if (cur_resp.start == 0 && cur_resp.len == 0)
+		return (false);
+	if (cur_resp.start + cur_resp.len == 1 && cur_resp.data[0] == '+')
+		return (false);
+	return (true);
+}
+
+static void
+close_connection(void)
+{
+
+	/*
+	 * XXX: This triggers a warning because mevent does the close
+	 * before the EV_DELETE.
+	 */
+	pthread_mutex_lock(&gdb_lock);
+	mevent_delete(write_event);
+	mevent_delete_close(read_event);
+	write_event = NULL;
+	read_event = NULL;
+	io_buffer_reset(&cur_comm);
+	io_buffer_reset(&cur_resp);
+	cur_fd = -1;
+
+	/* Resume any stopped vCPUs. */
+	gdb_resume_vcpus();
+	pthread_mutex_unlock(&gdb_lock);
+}
+
+static uint8_t
+hex_digit(uint8_t nibble)
+{
+
+	if (nibble <= 9)
+		return (nibble + '0');
+	else
+		return (nibble + 'a' - 10);
+}
+
+static uint8_t
+parse_digit(uint8_t v)
+{
+
+	if (v >= '0' && v <= '9')
+		return (v - '0');
+	if (v >= 'a' && v <= 'f')
+		return (v - 'a' + 10);
+	if (v >= 'A' && v <= 'F')
+		return (v - 'A' + 10);
+	return (0xF);
+}
+
+/* Parses big-endian hexadecimal. */
+static uintmax_t
+parse_integer(const uint8_t *p, size_t len)
+{
+	uintmax_t v;
+
+	v = 0;
+	while (len > 0) {
+		v <<= 4;
+		v |= parse_digit(*p);
+		p++;
+		len--;
+	}
+	return (v);
+}
+
+static uint8_t
+parse_byte(const uint8_t *p)
+{
+
+	return (parse_digit(p[0]) << 4 | parse_digit(p[1]));
+}
+
+static void
+send_pending_data(int fd)
+{
+	ssize_t nwritten;
+
+	if (cur_resp.len == 0) {
+		mevent_disable(write_event);
+		return;
+	}
+	nwritten = write(fd, io_buffer_head(&cur_resp), cur_resp.len);
+	if (nwritten == -1) {
+		warn("Write to GDB socket failed");
+		close_connection();
+	} else {
+		io_buffer_advance(&cur_resp, nwritten);
+		if (cur_resp.len == 0)
+			mevent_disable(write_event);
+		else
+			mevent_enable(write_event);
+	}
+}
+
+/* Append a single character to the output buffer. */
+static void
+send_char(uint8_t data)
+{
+	io_buffer_grow(&cur_resp, 1);
+	*io_buffer_tail(&cur_resp) = data;
+	cur_resp.len++;
+}
+
+/* Append an array of bytes to the output buffer. */
+static void
+send_data(const uint8_t *data, size_t len)
+{
+
+	io_buffer_grow(&cur_resp, len);
+	memcpy(io_buffer_tail(&cur_resp), data, len);
+	cur_resp.len += len;
+}
+
+static void
+format_byte(uint8_t v, uint8_t *buf)
+{
+
+	buf[0] = hex_digit(v >> 4);
+	buf[1] = hex_digit(v & 0xf);
+}
+
+/*
+ * Append a single byte (formatted as two hex characters) to the
+ * output buffer.
+ */
+static void
+send_byte(uint8_t v)
+{
+	uint8_t buf[2];
+
+	format_byte(v, buf);
+	send_data(buf, sizeof(buf));
+}
+
+static void
+start_packet(void)
+{
+
+	send_char('$');
+	cur_csum = 0;
+}
+
+static void
+finish_packet(void)
+{
+
+	send_char('#');
+	send_byte(cur_csum);
+	debug("-> %.*s\n", (int)cur_resp.len, io_buffer_head(&cur_resp));
+}
+
+/*
+ * Append a single character (for the packet payload) and update the
+ * checksum.
+ */
+static void
+append_char(uint8_t v)
+{
+
+	send_char(v);
+	cur_csum += v;
+}
+
+/*
+ * Append an array of bytes (for the packet payload) and update the
+ * checksum.
+ */
+static void
+append_packet_data(const uint8_t *data, size_t len)
+{
+
+	send_data(data, len);
+	while (len > 0) {
+		cur_csum += *data;
+		data++;
+		len--;
+	}
+}
+
+static void
+append_string(const char *str)
+{
+
+#ifdef __FreeBSD__
+	append_packet_data(str, strlen(str));
+#else
+	append_packet_data((const uint8_t *)str, strlen(str));
+#endif
+}
+
+static void
+append_byte(uint8_t v)
+{
+	uint8_t buf[2];
+
+	format_byte(v, buf);
+	append_packet_data(buf, sizeof(buf));
+}
+
+static void
+append_unsigned_native(uintmax_t value, size_t len)
+{
+	size_t i;
+
+	for (i = 0; i < len; i++) {
+		append_byte(value);
+		value >>= 8;
+	}
+}
+
+static void
+append_unsigned_be(uintmax_t value, size_t len)
+{
+	char buf[len * 2];
+	size_t i;
+
+	for (i = 0; i < len; i++) {
+#ifdef __FreeBSD__
+		format_byte(value, buf + (len - i - 1) * 2);
+#else
+		format_byte(value, (uint8_t *)(buf + (len - i - 1) * 2));
+#endif
+		value >>= 8;
+	}
+#ifdef __FreeBSD__
+	append_packet_data(buf, sizeof(buf));
+#else
+	append_packet_data((const uint8_t *)buf, sizeof(buf));
+#endif
+}
+
+static void
+append_integer(unsigned int value)
+{
+
+	if (value == 0)
+		append_char('0');
+	else
+		append_unsigned_be(value, fls(value) + 7 / 8);
+}
+
+static void
+append_asciihex(const char *str)
+{
+
+	while (*str != '\0') {
+		append_byte(*str);
+		str++;
+	}
+}
+
+static void
+send_empty_response(void)
+{
+
+	start_packet();
+	finish_packet();
+}
+
+static void
+send_error(int error)
+{
+
+	start_packet();
+	append_char('E');
+	append_byte(error);
+	finish_packet();
+}
+
+static void
+send_ok(void)
+{
+
+	start_packet();
+	append_string("OK");
+	finish_packet();
+}
+
+static int
+parse_threadid(const uint8_t *data, size_t len)
+{
+
+	if (len == 1 && *data == '0')
+		return (0);
+	if (len == 2 && memcmp(data, "-1", 2) == 0)
+		return (-1);
+	if (len == 0)
+		return (-2);
+	return (parse_integer(data, len));
+}
+
+static void
+report_stop(void)
+{
+
+	start_packet();
+	if (stopped_vcpu == -1)
+		append_char('S');
+	else
+		append_char('T');
+	append_byte(GDB_SIGNAL_TRAP);
+	if (stopped_vcpu != -1) {
+		append_string("thread:");
+		append_integer(stopped_vcpu + 1);
+		append_char(';');
+	}
+	stopped_vcpu = -1;
+	finish_packet();
+}
+
+static void
+gdb_finish_suspend_vcpus(void)
+{
+
+	if (first_stop) {
+		first_stop = false;
+		stopped_vcpu = -1;
+	} else if (response_pending())
+		stop_pending = true;
+	else {
+		report_stop();
+		send_pending_data(cur_fd);
+	}
+}
+
+static void
+_gdb_cpu_suspend(int vcpu, bool report_stop)
+{
+
+	debug("$vCPU %d suspending\n", vcpu);
+	CPU_SET(vcpu, &vcpus_waiting);
+	if (report_stop && CPU_CMP(&vcpus_waiting, &vcpus_suspended) == 0)
+		gdb_finish_suspend_vcpus();
+	while (CPU_ISSET(vcpu, &vcpus_suspended) && vcpu != stepping_vcpu)
+		pthread_cond_wait(&idle_vcpus, &gdb_lock);
+	CPU_CLR(vcpu, &vcpus_waiting);
+	debug("$vCPU %d resuming\n", vcpu);
+}
+
+void
+gdb_cpu_add(int vcpu)
+{
+
+	debug("$vCPU %d starting\n", vcpu);
+	pthread_mutex_lock(&gdb_lock);
+	CPU_SET(vcpu, &vcpus_active);
+
+	/*
+	 * If a vcpu is added while vcpus are stopped, suspend the new
+	 * vcpu so that it will pop back out with a debug exit before
+	 * executing the first instruction.
+	 */
+	if (!CPU_EMPTY(&vcpus_suspended)) {
+		CPU_SET(vcpu, &vcpus_suspended);
+		_gdb_cpu_suspend(vcpu, false);
+	}
+	pthread_mutex_unlock(&gdb_lock);
+}
+
+void
+gdb_cpu_suspend(int vcpu)
+{
+
+	pthread_mutex_lock(&gdb_lock);
+	_gdb_cpu_suspend(vcpu, true);
+	pthread_mutex_unlock(&gdb_lock);
+}
+
+void
+gdb_cpu_mtrap(int vcpu)
+{
+
+	debug("$vCPU %d MTRAP\n", vcpu);
+	pthread_mutex_lock(&gdb_lock);
+	if (vcpu == stepping_vcpu) {
+		stepping_vcpu = -1;
+		vm_set_capability(ctx, vcpu, VM_CAP_MTRAP_EXIT, 0);
+		vm_suspend_cpu(ctx, vcpu);
+		assert(stopped_vcpu == -1);
+		stopped_vcpu = vcpu;
+		_gdb_cpu_suspend(vcpu, true);
+	}
+	pthread_mutex_unlock(&gdb_lock);
+}
+
+static void
+gdb_suspend_vcpus(void)
+{
+
+	assert(pthread_mutex_isowned_np(&gdb_lock));
+	debug("suspending all CPUs\n");
+	vcpus_suspended = vcpus_active;
+	vm_suspend_cpu(ctx, -1);
+	if (CPU_CMP(&vcpus_waiting, &vcpus_suspended) == 0)
+		gdb_finish_suspend_vcpus();
+}
+
+static bool
+gdb_step_vcpu(int vcpu)
+{
+	int error, val;
+
+	debug("$vCPU %d step\n", vcpu);
+	error = vm_get_capability(ctx, vcpu, VM_CAP_MTRAP_EXIT, &val);
+	if (error < 0)
+		return (false);
+	error = vm_set_capability(ctx, vcpu, VM_CAP_MTRAP_EXIT, 1);
+	vm_resume_cpu(ctx, vcpu);
+	stepping_vcpu = vcpu;
+	pthread_cond_broadcast(&idle_vcpus);
+	return (true);
+}
+
+static void
+gdb_resume_vcpus(void)
+{
+
+	assert(pthread_mutex_isowned_np(&gdb_lock));
+	vm_resume_cpu(ctx, -1);
+	debug("resuming all CPUs\n");
+	CPU_ZERO(&vcpus_suspended);
+	pthread_cond_broadcast(&idle_vcpus);
+}
+
+static void
+gdb_read_regs(void)
+{
+	uint64_t regvals[nitems(gdb_regset)];
+	int i;
+
+	if (vm_get_register_set(ctx, cur_vcpu, nitems(gdb_regset),
+	    gdb_regset, regvals) == -1) {
+		send_error(errno);
+		return;
+	}
+	start_packet();
+	for (i = 0; i < nitems(regvals); i++)
+		append_unsigned_native(regvals[i], gdb_regsize[i]);
+	finish_packet();
+}
+
+static void
+gdb_read_mem(const uint8_t *data, size_t len)
+{
+	uint64_t gpa, gva, val;
+	uint8_t *cp;
+	size_t resid, todo, bytes;
+	bool started;
+	int error;
+
+	cp = memchr(data, ',', len);
+	if (cp == NULL) {
+		send_error(EINVAL);
+		return;
+	}
+	gva = parse_integer(data + 1, cp - (data + 1));
+	resid = parse_integer(cp + 1, len - (cp + 1 - data));
+	started = false;
+
+	while (resid > 0) {
+		error = guest_vaddr2paddr(cur_vcpu, gva, &gpa);
+		if (error == -1) {
+			if (started)
+				finish_packet();
+			else
+				send_error(errno);
+			return;
+		}
+		if (error == 0) {
+			if (started)
+				finish_packet();
+			else
+				send_error(EFAULT);
+			return;
+		}
+
+		/* Read bytes from current page. */
+		todo = getpagesize() - gpa % getpagesize();
+		if (todo > resid)
+			todo = resid;
+
+		cp = paddr_guest2host(ctx, gpa, todo);
+		if (cp != NULL) {
+			/*
+			 * If this page is guest RAM, read it a byte
+			 * at a time.
+			 */
+			if (!started) {
+				start_packet();
+				started = true;
+			}
+			while (todo > 0) {
+				append_byte(*cp);
+				cp++;
+				gpa++;
+				gva++;
+				resid--;
+				todo--;
+			}
+		} else {
+			/*
+			 * If this page isn't guest RAM, try to handle
+			 * it via MMIO.  For MMIO requests, use
+			 * aligned reads of words when possible.
+			 */
+			while (todo > 0) {
+				if (gpa & 1 || todo == 1)
+					bytes = 1;
+				else if (gpa & 2 || todo == 2)
+					bytes = 2;
+				else
+					bytes = 4;
+				error = read_mem(ctx, cur_vcpu, gpa, &val,
+				    bytes);
+				if (error == 0) {
+					if (!started) {
+						start_packet();
+						started = true;
+					}
+					gpa += bytes;
+					gva += bytes;
+					resid -= bytes;
+					todo -= bytes;
+					while (bytes > 0) {
+						append_byte(val);
+						val >>= 8;
+						bytes--;
+					}
+				} else {
+					if (started)
+						finish_packet();
+					else
+						send_error(EFAULT);
+					return;
+				}
+			}
+		}
+		assert(resid == 0 || gpa % getpagesize() == 0);
+	}
+	if (!started)
+		start_packet();
+	finish_packet();
+}
+
+static bool
+command_equals(const uint8_t *data, size_t len, const char *cmd)
+{
+
+	if (strlen(cmd) > len)
+		return (false);
+	return (memcmp(data, cmd, strlen(cmd)) == 0);
+}
+
+static void
+gdb_query(const uint8_t *data, size_t len)
+{
+
+	/*
+	 * TODO:
+	 * - qSearch
+	 * - qSupported
+	 */
+	if (command_equals(data, len, "qAttached")) {
+		start_packet();
+		append_char('1');
+		finish_packet();
+	} else if (command_equals(data, len, "qC")) {
+		start_packet();
+		append_string("QC");
+		append_integer(cur_vcpu + 1);
+		finish_packet();
+	} else if (command_equals(data, len, "qfThreadInfo")) {
+		cpuset_t mask;
+		bool first;
+		int vcpu;
+
+		if (CPU_EMPTY(&vcpus_active)) {
+			send_error(EINVAL);
+			return;
+		}
+		mask = vcpus_active;
+		start_packet();
+		append_char('m');
+		first = true;
+		while (!CPU_EMPTY(&mask)) {
+			vcpu = CPU_FFS(&mask) - 1;
+			CPU_CLR(vcpu, &mask);
+			if (first)
+				first = false;
+			else
+				append_char(',');
+			append_integer(vcpu + 1);
+		}
+		finish_packet();
+	} else if (command_equals(data, len, "qsThreadInfo")) {
+		start_packet();
+		append_char('l');
+		finish_packet();
+	} else if (command_equals(data, len, "qThreadExtraInfo")) {
+		char buf[16];
+		int tid;
+
+		data += strlen("qThreadExtraInfo");
+		len -= strlen("qThreadExtraInfo");
+		if (*data != ',') {
+			send_error(EINVAL);
+			return;
+		}
+		tid = parse_threadid(data + 1, len - 1);
+		if (tid <= 0 || !CPU_ISSET(tid - 1, &vcpus_active)) {
+			send_error(EINVAL);
+			return;
+		}
+
+		snprintf(buf, sizeof(buf), "vCPU %d", tid - 1);
+		start_packet();
+		append_asciihex(buf);
+		finish_packet();
+	} else
+		send_empty_response();
+}
+
+static void
+handle_command(const uint8_t *data, size_t len)
+{
+
+	/* Reject packets with a sequence-id. */
+	if (len >= 3 && data[0] >= '0' && data[0] <= '9' &&
+	    data[0] >= '0' && data[0] <= '9' && data[2] == ':') {
+		send_empty_response();
+		return;
+	}
+
+	switch (*data) {
+	case 'c':
+		if (len != 1) {
+			send_error(EINVAL);
+			break;
+		}
+
+		/* Don't send a reply until a stop occurs. */
+		gdb_resume_vcpus();
+		break;
+	case 'D':
+		send_ok();
+
+		/* TODO: Resume any stopped CPUs. */
+		break;
+	case 'g': {
+		gdb_read_regs();
+		break;
+	}
+	case 'H': {
+		int tid;
+
+		if (data[1] != 'g' && data[1] != 'c') {
+			send_error(EINVAL);
+			break;
+		}
+		tid = parse_threadid(data + 2, len - 2);
+		if (tid == -2) {
+			send_error(EINVAL);
+			break;
+		}
+
+		if (CPU_EMPTY(&vcpus_active)) {
+			send_error(EINVAL);
+			break;
+		}
+		if (tid == -1 || tid == 0)
+			cur_vcpu = CPU_FFS(&vcpus_active) - 1;
+		else if (CPU_ISSET(tid - 1, &vcpus_active))
+			cur_vcpu = tid - 1;
+		else {
+			send_error(EINVAL);
+			break;
+		}
+		send_ok();
+		break;
+	}
+	case 'm':
+		gdb_read_mem(data, len);
+		break;
+	case 'T': {
+		int tid;
+
+		tid = parse_threadid(data + 1, len - 1);
+		if (tid <= 0 || !CPU_ISSET(tid - 1, &vcpus_active)) {
+			send_error(EINVAL);
+			return;
+		}
+		send_ok();
+		break;
+	}
+	case 'q':
+		gdb_query(data, len);
+		break;
+	case 's':
+		if (len != 1) {
+			send_error(EINVAL);
+			break;
+		}
+
+		/* Don't send a reply until a stop occurs. */
+		if (!gdb_step_vcpu(cur_vcpu)) {
+			send_error(EOPNOTSUPP);
+			break;
+		}
+		break;
+	case '?':
+		/* XXX: Only if stopped? */
+		/* For now, just report that we are always stopped. */
+		start_packet();
+		append_char('S');
+		append_byte(GDB_SIGNAL_TRAP);
+		finish_packet();
+		break;
+	case 'G': /* TODO */
+	case 'M': /* TODO */
+	case 'v':
+		/* Handle 'vCont' */
+		/* 'vCtrlC' */
+	case 'p': /* TODO */
+	case 'P': /* TODO */
+	case 'Q': /* TODO */
+	case 't': /* TODO */
+	case 'X': /* TODO */
+	case 'z': /* TODO */
+	case 'Z': /* TODO */
+	default:
+		send_empty_response();
+	}
+}
+
+/* Check for a valid packet in the command buffer. */
+static void
+check_command(int fd)
+{
+	uint8_t *head, *hash, *p, sum;
+	size_t avail, plen;
+
+	for (;;) {
+		avail = cur_comm.len;
+		if (avail == 0)
+			return;
+		head = io_buffer_head(&cur_comm);
+		switch (*head) {
+		case 0x03:
+			debug("<- Ctrl-C\n");
+			io_buffer_consume(&cur_comm, 1);
+
+			gdb_suspend_vcpus();
+			break;
+		case '+':
+			/* ACK of previous response. */
+			debug("<- +\n");
+			if (response_pending())
+				io_buffer_reset(&cur_resp);
+			io_buffer_consume(&cur_comm, 1);
+			if (stop_pending) {
+				stop_pending = false;
+				report_stop();
+				send_pending_data(fd);
+			}
+			break;
+		case '-':
+			/* NACK of previous response. */
+			debug("<- -\n");
+			if (response_pending()) {
+				cur_resp.len += cur_resp.start;
+				cur_resp.start = 0;
+				if (cur_resp.data[0] == '+')
+					io_buffer_advance(&cur_resp, 1);
+				debug("-> %.*s\n", (int)cur_resp.len,
+				    io_buffer_head(&cur_resp));
+			}
+			io_buffer_consume(&cur_comm, 1);
+			send_pending_data(fd);
+			break;
+		case '$':
+			/* Packet. */
+
+			if (response_pending()) {
+				warnx("New GDB command while response in "
+				    "progress");
+				io_buffer_reset(&cur_resp);
+			}
+
+			/* Is packet complete? */
+			hash = memchr(head, '#', avail);
+			if (hash == NULL)
+				return;
+			plen = (hash - head + 1) + 2;
+			if (avail < plen)
+				return;
+			debug("<- %.*s\n", (int)plen, head);
+
+			/* Verify checksum. */
+			for (sum = 0, p = head + 1; p < hash; p++)
+				sum += *p;
+			if (sum != parse_byte(hash + 1)) {
+				io_buffer_consume(&cur_comm, plen);
+				debug("-> -\n");
+				send_char('-');
+				send_pending_data(fd);
+				break;
+			}
+			send_char('+');
+
+			handle_command(head + 1, hash - (head + 1));
+			io_buffer_consume(&cur_comm, plen);
+			if (!response_pending()) {
+				debug("-> +\n");
+			}
+			send_pending_data(fd);
+			break;
+		default:
+			/* XXX: Possibly drop connection instead. */
+			debug("-> %02x\n", *head);
+			io_buffer_consume(&cur_comm, 1);
+			break;
+		}
+	}
+}
+
+static void
+gdb_readable(int fd, enum ev_type event, void *arg)
+{
+	ssize_t nread;
+	int pending;
+
+	if (ioctl(fd, FIONREAD, &pending) == -1) {
+		warn("FIONREAD on GDB socket");
+		return;
+	}
+
+	/*
+	 * 'pending' might be zero due to EOF.  We need to call read
+	 * with a non-zero length to detect EOF.
+	 */
+	if (pending == 0)
+		pending = 1;
+
+	/* Ensure there is room in the command buffer. */
+	io_buffer_grow(&cur_comm, pending);
+	assert(io_buffer_avail(&cur_comm) >= pending);
+
+	nread = read(fd, io_buffer_tail(&cur_comm), io_buffer_avail(&cur_comm));
+	if (nread == 0) {
+		close_connection();
+	} else if (nread == -1) {
+		if (errno == EAGAIN)
+			return;
+
+		warn("Read from GDB socket");
+		close_connection();
+	} else {
+		cur_comm.len += nread;
+		pthread_mutex_lock(&gdb_lock);
+		check_command(fd);
+		pthread_mutex_unlock(&gdb_lock);
+	}
+}
+
+static void
+gdb_writable(int fd, enum ev_type event, void *arg)
+{
+
+	send_pending_data(fd);
+}
+
+static void
+new_connection(int fd, enum ev_type event, void *arg)
+{
+	int optval, s;
+
+	s = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
+	if (s == -1) {
+		if (arg != NULL)
+			err(1, "Failed accepting initial GDB connection");
+
+		/* Silently ignore errors post-startup. */
+		return;
+	}
+
+	optval = 1;
+	if (setsockopt(s, SOL_SOCKET, SO_NOSIGPIPE, &optval, sizeof(optval)) ==
+	    -1) {
+		warn("Failed to disable SIGPIPE for GDB connection");
+		close(s);
+		return;
+	}
+
+	pthread_mutex_lock(&gdb_lock);
+	if (cur_fd != -1) {
+		close(s);
+		warnx("Ignoring additional GDB connection.");
+	}
+
+	read_event = mevent_add(s, EVF_READ, gdb_readable, NULL);
+	if (read_event == NULL) {
+		if (arg != NULL)
+			err(1, "Failed to setup initial GDB connection");
+		pthread_mutex_unlock(&gdb_lock);
+		return;
+	}
+	write_event = mevent_add(s, EVF_WRITE, gdb_writable, NULL);
+	if (write_event == NULL) {
+		if (arg != NULL)
+			err(1, "Failed to setup initial GDB connection");
+		mevent_delete_close(read_event);
+		read_event = NULL;
+	}
+
+	cur_fd = s;
+	cur_vcpu = 0;
+	stepping_vcpu = -1;
+	stopped_vcpu = -1;
+	stop_pending = false;
+
+	/* Break on attach. */
+	first_stop = true;
+	gdb_suspend_vcpus();
+	pthread_mutex_unlock(&gdb_lock);
+}
+
+#ifndef WITHOUT_CAPSICUM
+void
+limit_gdb_socket(int s)
+{
+	cap_rights_t rights;
+	unsigned long ioctls[] = { FIONREAD };
+
+	cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE,
+	    CAP_SETSOCKOPT, CAP_IOCTL);
+	if (cap_rights_limit(s, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+	if (cap_ioctls_limit(s, ioctls, nitems(ioctls)) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+}
+#endif
+
+void
+init_gdb(struct vmctx *_ctx, int sport, bool wait)
+{
+	struct sockaddr_in sin;
+	int error, flags, s;
+
+	debug("==> starting on %d, %swaiting\n", sport, wait ? "" : "not ");
+
+	error = pthread_mutex_init(&gdb_lock, NULL);
+	if (error != 0)
+		errc(1, error, "gdb mutex init");
+	error = pthread_cond_init(&idle_vcpus, NULL);
+	if (error != 0)
+		errc(1, error, "gdb cv init");
+
+	ctx = _ctx;
+	s = socket(PF_INET, SOCK_STREAM, 0);
+	if (s < 0)
+		err(1, "gdb socket create");
+
+#ifdef __FreeBSD__
+	sin.sin_len = sizeof(sin);
+#endif
+	sin.sin_family = AF_INET;
+	sin.sin_addr.s_addr = htonl(INADDR_ANY);
+	sin.sin_port = htons(sport);
+
+	if (bind(s, (struct sockaddr *)&sin, sizeof(sin)) < 0)
+		err(1, "gdb socket bind");
+
+	if (listen(s, 1) < 0)
+		err(1, "gdb socket listen");
+
+	if (wait) {
+		/*
+		 * Set vcpu 0 in vcpus_suspended.  This will trigger the
+		 * logic in gdb_cpu_add() to suspend the first vcpu before
+		 * it starts execution.  The vcpu will remain suspended
+		 * until a debugger connects.
+		 */
+		stepping_vcpu = -1;
+		stopped_vcpu = -1;
+		CPU_SET(0, &vcpus_suspended);
+	}
+
+	flags = fcntl(s, F_GETFL);
+	if (fcntl(s, F_SETFL, flags | O_NONBLOCK) == -1)
+		err(1, "Failed to mark gdb socket non-blocking");
+
+#ifndef WITHOUT_CAPSICUM
+	limit_gdb_socket(s);
+#endif
+	mevent_add(s, EVF_READ, new_connection, NULL);
+}
diff --git a/usr/src/cmd/bhyve/gdb.h b/usr/src/cmd/bhyve/gdb.h
new file mode 100644
index 0000000000..fa2184df16
--- /dev/null
+++ b/usr/src/cmd/bhyve/gdb.h
@@ -0,0 +1,39 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2017 John H. Baldwin <jhb@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef __GDB_H__
+#define	__GDB_H__
+
+void	gdb_cpu_add(int vcpu);
+void	gdb_cpu_mtrap(int vcpu);
+void	gdb_cpu_suspend(int vcpu);
+void	init_gdb(struct vmctx *ctx, int sport, bool wait);
+
+#endif /* !__GDB_H__ */
diff --git a/usr/src/cmd/bhyve/inout.c b/usr/src/cmd/bhyve/inout.c
new file mode 100644
index 0000000000..693c4fdbac
--- /dev/null
+++ b/usr/src/cmd/bhyve/inout.c
@@ -0,0 +1,299 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/linker_set.h>
+#include <sys/_iovec.h>
+#include <sys/mman.h>
+
+#include <x86/psl.h>
+#include <x86/segments.h>
+
+#include <machine/vmm.h>
+#include <machine/vmm_instruction_emul.h>
+#include <vmmapi.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+
+#include "bhyverun.h"
+#include "inout.h"
+
+SET_DECLARE(inout_port_set, struct inout_port);
+
+#define	MAX_IOPORTS	(1 << 16)
+
+#define	VERIFY_IOPORT(port, size) \
+	assert((port) >= 0 && (size) > 0 && ((port) + (size)) <= MAX_IOPORTS)
+
+static struct {
+	const char	*name;
+	int		flags;
+	inout_func_t	handler;
+	void		*arg;
+} inout_handlers[MAX_IOPORTS];
+
+static int
+default_inout(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+              uint32_t *eax, void *arg)
+{
+        if (in) {
+                switch (bytes) {
+                case 4:
+                        *eax = 0xffffffff;
+                        break;
+                case 2:
+                        *eax = 0xffff;
+                        break;
+                case 1:
+                        *eax = 0xff;
+                        break;
+                }
+        }
+        
+        return (0);
+}
+
+static void 
+register_default_iohandler(int start, int size)
+{
+	struct inout_port iop;
+	
+	VERIFY_IOPORT(start, size);
+
+	bzero(&iop, sizeof(iop));
+	iop.name = "default";
+	iop.port = start;
+	iop.size = size;
+	iop.flags = IOPORT_F_INOUT | IOPORT_F_DEFAULT;
+	iop.handler = default_inout;
+
+	register_inout(&iop);
+}
+
+int
+emulate_inout(struct vmctx *ctx, int vcpu, struct vm_exit *vmexit, int strict)
+{
+	int addrsize, bytes, flags, in, port, prot, rep;
+	uint32_t eax, val;
+	inout_func_t handler;
+	void *arg;
+	int error, fault, retval;
+	enum vm_reg_name idxreg;
+	uint64_t gla, index, iterations, count;
+	struct vm_inout_str *vis;
+	struct iovec iov[2];
+
+	bytes = vmexit->u.inout.bytes;
+	in = vmexit->u.inout.in;
+	port = vmexit->u.inout.port;
+
+	assert(port < MAX_IOPORTS);
+	assert(bytes == 1 || bytes == 2 || bytes == 4);
+
+	handler = inout_handlers[port].handler;
+
+	if (strict && handler == default_inout)
+		return (-1);
+
+	flags = inout_handlers[port].flags;
+	arg = inout_handlers[port].arg;
+
+	if (in) {
+		if (!(flags & IOPORT_F_IN))
+			return (-1);
+	} else {
+		if (!(flags & IOPORT_F_OUT))
+			return (-1);
+	}
+
+	retval = 0;
+	if (vmexit->u.inout.string) {
+		vis = &vmexit->u.inout_str;
+		rep = vis->inout.rep;
+		addrsize = vis->addrsize;
+		prot = in ? PROT_WRITE : PROT_READ;
+		assert(addrsize == 2 || addrsize == 4 || addrsize == 8);
+
+		/* Index register */
+		idxreg = in ? VM_REG_GUEST_RDI : VM_REG_GUEST_RSI;
+		index = vis->index & vie_size2mask(addrsize);
+
+		/* Count register */
+		count = vis->count & vie_size2mask(addrsize);
+
+		/* Limit number of back-to-back in/out emulations to 16 */
+		iterations = MIN(count, 16);
+		while (iterations > 0) {
+			assert(retval == 0);
+			if (vie_calculate_gla(vis->paging.cpu_mode,
+			    vis->seg_name, &vis->seg_desc, index, bytes,
+			    addrsize, prot, &gla)) {
+				vm_inject_gp(ctx, vcpu);
+				break;
+			}
+
+			error = vm_copy_setup(ctx, vcpu, &vis->paging, gla,
+			    bytes, prot, iov, nitems(iov), &fault);
+			if (error) {
+				retval = -1;  /* Unrecoverable error */
+				break;
+			} else if (fault) {
+				retval = 0;  /* Resume guest to handle fault */
+				break;
+			}
+
+			if (vie_alignment_check(vis->paging.cpl, bytes,
+			    vis->cr0, vis->rflags, gla)) {
+				vm_inject_ac(ctx, vcpu, 0);
+				break;
+			}
+
+			val = 0;
+			if (!in)
+				vm_copyin(ctx, vcpu, iov, &val, bytes);
+
+			retval = handler(ctx, vcpu, in, port, bytes, &val, arg);
+			if (retval != 0)
+				break;
+
+			if (in)
+				vm_copyout(ctx, vcpu, &val, iov, bytes);
+
+			/* Update index */
+			if (vis->rflags & PSL_D)
+				index -= bytes;
+			else
+				index += bytes;
+
+			count--;
+			iterations--;
+		}
+
+		/* Update index register */
+		error = vie_update_register(ctx, vcpu, idxreg, index, addrsize);
+		assert(error == 0);
+
+		/*
+		 * Update count register only if the instruction had a repeat
+		 * prefix.
+		 */
+		if (rep) {
+			error = vie_update_register(ctx, vcpu, VM_REG_GUEST_RCX,
+			    count, addrsize);
+			assert(error == 0);
+		}
+
+		/* Restart the instruction if more iterations remain */
+		if (retval == 0 && count != 0) {
+			error = vm_restart_instruction(ctx, vcpu);
+			assert(error == 0);
+		}
+	} else {
+		eax = vmexit->u.inout.eax;
+		val = eax & vie_size2mask(bytes);
+		retval = handler(ctx, vcpu, in, port, bytes, &val, arg);
+		if (retval == 0 && in) {
+			eax &= ~vie_size2mask(bytes);
+			eax |= val & vie_size2mask(bytes);
+			error = vm_set_register(ctx, vcpu, VM_REG_GUEST_RAX,
+			    eax);
+			assert(error == 0);
+		}
+	}
+	return (retval);
+}
+
+void
+init_inout(void)
+{
+	struct inout_port **iopp, *iop;
+
+	/*
+	 * Set up the default handler for all ports
+	 */
+	register_default_iohandler(0, MAX_IOPORTS);
+
+	/*
+	 * Overwrite with specified handlers
+	 */
+	SET_FOREACH(iopp, inout_port_set) {
+		iop = *iopp;
+		assert(iop->port < MAX_IOPORTS);
+		inout_handlers[iop->port].name = iop->name;
+		inout_handlers[iop->port].flags = iop->flags;
+		inout_handlers[iop->port].handler = iop->handler;
+		inout_handlers[iop->port].arg = NULL;
+	}
+}
+
+int
+register_inout(struct inout_port *iop)
+{
+	int i;
+
+	VERIFY_IOPORT(iop->port, iop->size);
+
+	/*
+	 * Verify that the new registration is not overwriting an already
+	 * allocated i/o range.
+	 */
+	if ((iop->flags & IOPORT_F_DEFAULT) == 0) {
+		for (i = iop->port; i < iop->port + iop->size; i++) {
+			if ((inout_handlers[i].flags & IOPORT_F_DEFAULT) == 0)
+				return (-1);
+		}
+	}
+
+	for (i = iop->port; i < iop->port + iop->size; i++) {
+		inout_handlers[i].name = iop->name;
+		inout_handlers[i].flags = iop->flags;
+		inout_handlers[i].handler = iop->handler;
+		inout_handlers[i].arg = iop->arg;
+	}
+
+	return (0);
+}
+
+int
+unregister_inout(struct inout_port *iop)
+{
+
+	VERIFY_IOPORT(iop->port, iop->size);
+	assert(inout_handlers[iop->port].name == iop->name);
+
+	register_default_iohandler(iop->port, iop->size);
+
+	return (0);
+}
diff --git a/usr/src/cmd/bhyve/inout.h b/usr/src/cmd/bhyve/inout.h
new file mode 100644
index 0000000000..b72ee5d93e
--- /dev/null
+++ b/usr/src/cmd/bhyve/inout.h
@@ -0,0 +1,93 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _INOUT_H_
+#define	_INOUT_H_
+
+#include <sys/linker_set.h>
+
+struct vmctx;
+struct vm_exit;
+
+/*
+ * inout emulation handlers return 0 on success and -1 on failure.
+ */
+typedef int (*inout_func_t)(struct vmctx *ctx, int vcpu, int in, int port,
+			    int bytes, uint32_t *eax, void *arg);
+
+struct inout_port {
+	const char 	*name;
+	int		port;
+	int		size;
+	int		flags;
+	inout_func_t	handler;
+	void		*arg;
+};
+#define	IOPORT_F_IN		0x1
+#define	IOPORT_F_OUT		0x2
+#define	IOPORT_F_INOUT		(IOPORT_F_IN | IOPORT_F_OUT)
+
+/*
+ * The following flags are used internally and must not be used by
+ * device models.
+ */
+#define	IOPORT_F_DEFAULT	0x80000000	/* claimed by default handler */
+
+#define	INOUT_PORT(name, port, flags, handler)				\
+	static struct inout_port __CONCAT(__inout_port, __LINE__) = {	\
+		#name,							\
+		(port),							\
+		1,							\
+		(flags),						\
+		(handler),						\
+		0							\
+	};								\
+	DATA_SET(inout_port_set, __CONCAT(__inout_port, __LINE__))
+	
+void	init_inout(void);
+int	emulate_inout(struct vmctx *, int vcpu, struct vm_exit *vmexit,
+		      int strict);
+int	register_inout(struct inout_port *iop);
+int	unregister_inout(struct inout_port *iop);
+void	init_bvmcons(void);
+
+#endif	/* _INOUT_H_ */
diff --git a/usr/src/cmd/bhyve/ioapic.c b/usr/src/cmd/bhyve/ioapic.c
new file mode 100644
index 0000000000..acdbb5111b
--- /dev/null
+++ b/usr/src/cmd/bhyve/ioapic.c
@@ -0,0 +1,83 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2014 Hudson River Trading LLC
+ * Written by: John H. Baldwin <jhb@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <stdio.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include "ioapic.h"
+#include "pci_emul.h"
+#include "pci_lpc.h"
+
+/*
+ * Assign PCI INTx interrupts to I/O APIC pins in a round-robin
+ * fashion.  Note that we have no idea what the HPET is using, but the
+ * HPET is also programmable whereas this is intended for hardwired
+ * PCI interrupts.
+ *
+ * This assumes a single I/O APIC where pins >= 16 are permitted for
+ * PCI devices.
+ */
+static int pci_pins;
+
+void
+ioapic_init(struct vmctx *ctx)
+{
+
+	if (vm_ioapic_pincount(ctx, &pci_pins) < 0) {
+		pci_pins = 0;
+		return;
+	}
+
+	/* Ignore the first 16 pins. */
+	if (pci_pins <= 16) {
+		pci_pins = 0;
+		return;
+	}
+	pci_pins -= 16;
+}
+
+int
+ioapic_pci_alloc_irq(struct pci_devinst *pi)
+{
+	static int last_pin;
+
+	if (pci_pins == 0)
+		return (-1);
+	if (lpc_bootrom()) {
+		/* For external bootrom use fixed mapping. */
+		return (16 + (4 + pi->pi_slot + pi->pi_lintr.pin) % 8);
+	}
+	return (16 + (last_pin++ % pci_pins));
+}
diff --git a/usr/src/cmd/bhyve/ioapic.h b/usr/src/cmd/bhyve/ioapic.h
new file mode 100644
index 0000000000..3a7fa76192
--- /dev/null
+++ b/usr/src/cmd/bhyve/ioapic.h
@@ -0,0 +1,43 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2014 Hudson River Trading LLC
+ * Written by: John H. Baldwin <jhb@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _IOAPIC_H_
+#define	_IOAPIC_H_
+
+struct pci_devinst;
+
+/*
+ * Allocate a PCI IRQ from the I/O APIC.
+ */
+void	ioapic_init(struct vmctx *ctx);
+int	ioapic_pci_alloc_irq(struct pci_devinst *pi);
+
+#endif
diff --git a/usr/src/cmd/bhyve/mem.c b/usr/src/cmd/bhyve/mem.c
new file mode 100644
index 0000000000..105d37cf56
--- /dev/null
+++ b/usr/src/cmd/bhyve/mem.c
@@ -0,0 +1,348 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Memory ranges are represented with an RB tree. On insertion, the range
+ * is checked for overlaps. On lookup, the key has the same base and limit
+ * so it can be searched within the range.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/tree.h>
+#include <sys/errno.h>
+#include <machine/vmm.h>
+#include <machine/vmm_instruction_emul.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <pthread.h>
+
+#include "mem.h"
+
+struct mmio_rb_range {
+	RB_ENTRY(mmio_rb_range)	mr_link;	/* RB tree links */
+	struct mem_range	mr_param;
+	uint64_t                mr_base;
+	uint64_t                mr_end;
+};
+
+struct mmio_rb_tree;
+RB_PROTOTYPE(mmio_rb_tree, mmio_rb_range, mr_link, mmio_rb_range_compare);
+
+RB_HEAD(mmio_rb_tree, mmio_rb_range) mmio_rb_root, mmio_rb_fallback;
+
+/*
+ * Per-vCPU cache. Since most accesses from a vCPU will be to
+ * consecutive addresses in a range, it makes sense to cache the
+ * result of a lookup.
+ */
+static struct mmio_rb_range	*mmio_hint[VM_MAXCPU];
+
+static pthread_rwlock_t mmio_rwlock;
+
+static int
+mmio_rb_range_compare(struct mmio_rb_range *a, struct mmio_rb_range *b)
+{
+	if (a->mr_end < b->mr_base)
+		return (-1);
+	else if (a->mr_base > b->mr_end)
+		return (1);
+	return (0);
+}
+
+static int
+mmio_rb_lookup(struct mmio_rb_tree *rbt, uint64_t addr,
+    struct mmio_rb_range **entry)
+{
+	struct mmio_rb_range find, *res;
+
+	find.mr_base = find.mr_end = addr;
+
+	res = RB_FIND(mmio_rb_tree, rbt, &find);
+
+	if (res != NULL) {
+		*entry = res;
+		return (0);
+	}
+	
+	return (ENOENT);
+}
+
+static int
+mmio_rb_add(struct mmio_rb_tree *rbt, struct mmio_rb_range *new)
+{
+	struct mmio_rb_range *overlap;
+
+	overlap = RB_INSERT(mmio_rb_tree, rbt, new);
+
+	if (overlap != NULL) {
+#ifdef RB_DEBUG
+		printf("overlap detected: new %lx:%lx, tree %lx:%lx\n",
+		       new->mr_base, new->mr_end,
+		       overlap->mr_base, overlap->mr_end);
+#endif
+
+		return (EEXIST);
+	}
+
+	return (0);
+}
+
+#if 0
+static void
+mmio_rb_dump(struct mmio_rb_tree *rbt)
+{
+	struct mmio_rb_range *np;
+
+	pthread_rwlock_rdlock(&mmio_rwlock);
+	RB_FOREACH(np, mmio_rb_tree, rbt) {
+		printf(" %lx:%lx, %s\n", np->mr_base, np->mr_end,
+		       np->mr_param.name);
+	}
+	pthread_rwlock_unlock(&mmio_rwlock);
+}
+#endif
+
+RB_GENERATE(mmio_rb_tree, mmio_rb_range, mr_link, mmio_rb_range_compare);
+
+typedef int (mem_cb_t)(struct vmctx *ctx, int vcpu, uint64_t gpa,
+    struct mem_range *mr, void *arg);
+
+static int
+mem_read(void *ctx, int vcpu, uint64_t gpa, uint64_t *rval, int size, void *arg)
+{
+	int error;
+	struct mem_range *mr = arg;
+
+	error = (*mr->handler)(ctx, vcpu, MEM_F_READ, gpa, size,
+			       rval, mr->arg1, mr->arg2);
+	return (error);
+}
+
+static int
+mem_write(void *ctx, int vcpu, uint64_t gpa, uint64_t wval, int size, void *arg)
+{
+	int error;
+	struct mem_range *mr = arg;
+
+	error = (*mr->handler)(ctx, vcpu, MEM_F_WRITE, gpa, size,
+			       &wval, mr->arg1, mr->arg2);
+	return (error);
+}
+
+static int
+access_memory(struct vmctx *ctx, int vcpu, uint64_t paddr, mem_cb_t *cb,
+    void *arg)
+{
+	struct mmio_rb_range *entry;
+	int err, immutable;
+	
+	pthread_rwlock_rdlock(&mmio_rwlock);
+	/*
+	 * First check the per-vCPU cache
+	 */
+	if (mmio_hint[vcpu] &&
+	    paddr >= mmio_hint[vcpu]->mr_base &&
+	    paddr <= mmio_hint[vcpu]->mr_end) {
+		entry = mmio_hint[vcpu];
+	} else
+		entry = NULL;
+
+	if (entry == NULL) {
+		if (mmio_rb_lookup(&mmio_rb_root, paddr, &entry) == 0) {
+			/* Update the per-vCPU cache */
+			mmio_hint[vcpu] = entry;			
+		} else if (mmio_rb_lookup(&mmio_rb_fallback, paddr, &entry)) {
+			pthread_rwlock_unlock(&mmio_rwlock);
+			return (ESRCH);
+		}
+	}
+
+	assert(entry != NULL);
+
+	/*
+	 * An 'immutable' memory range is guaranteed to be never removed
+	 * so there is no need to hold 'mmio_rwlock' while calling the
+	 * handler.
+	 *
+	 * XXX writes to the PCIR_COMMAND register can cause register_mem()
+	 * to be called. If the guest is using PCI extended config space
+	 * to modify the PCIR_COMMAND register then register_mem() can
+	 * deadlock on 'mmio_rwlock'. However by registering the extended
+	 * config space window as 'immutable' the deadlock can be avoided.
+	 */
+	immutable = (entry->mr_param.flags & MEM_F_IMMUTABLE);
+	if (immutable)
+		pthread_rwlock_unlock(&mmio_rwlock);
+
+	err = cb(ctx, vcpu, paddr, &entry->mr_param, arg);
+
+	if (!immutable)
+		pthread_rwlock_unlock(&mmio_rwlock);
+
+	return (err);
+}
+
+struct emulate_mem_args {
+	struct vie *vie;
+	struct vm_guest_paging *paging;
+};
+
+static int
+emulate_mem_cb(struct vmctx *ctx, int vcpu, uint64_t paddr, struct mem_range *mr,
+    void *arg)
+{
+	struct emulate_mem_args *ema;
+
+	ema = arg;
+	return (vmm_emulate_instruction(ctx, vcpu, paddr, ema->vie, ema->paging,
+	    mem_read, mem_write, mr));
+}
+
+int
+emulate_mem(struct vmctx *ctx, int vcpu, uint64_t paddr, struct vie *vie,
+    struct vm_guest_paging *paging)
+
+{
+	struct emulate_mem_args ema;
+
+	ema.vie = vie;
+	ema.paging = paging;
+	return (access_memory(ctx, vcpu, paddr, emulate_mem_cb, &ema));
+}
+
+struct read_mem_args {
+	uint64_t *rval;
+	int size;
+};
+
+static int
+read_mem_cb(struct vmctx *ctx, int vcpu, uint64_t paddr, struct mem_range *mr,
+    void *arg)
+{
+	struct read_mem_args *rma;
+
+	rma = arg;
+	return (mr->handler(ctx, vcpu, MEM_F_READ, paddr, rma->size,
+	    rma->rval, mr->arg1, mr->arg2));
+}
+
+int
+read_mem(struct vmctx *ctx, int vcpu, uint64_t gpa, uint64_t *rval, int size)
+{
+	struct read_mem_args rma;
+
+	rma.rval = rval;
+	rma.size = size;
+	return (access_memory(ctx, vcpu, gpa, read_mem_cb, &rma));
+}
+
+static int
+register_mem_int(struct mmio_rb_tree *rbt, struct mem_range *memp)
+{
+	struct mmio_rb_range *entry, *mrp;
+	int		err;
+
+	err = 0;
+
+	mrp = malloc(sizeof(struct mmio_rb_range));
+	
+	if (mrp != NULL) {
+		mrp->mr_param = *memp;
+		mrp->mr_base = memp->base;
+		mrp->mr_end = memp->base + memp->size - 1;
+		pthread_rwlock_wrlock(&mmio_rwlock);
+		if (mmio_rb_lookup(rbt, memp->base, &entry) != 0)
+			err = mmio_rb_add(rbt, mrp);
+		pthread_rwlock_unlock(&mmio_rwlock);
+		if (err)
+			free(mrp);
+	} else
+		err = ENOMEM;
+
+	return (err);
+}
+
+int
+register_mem(struct mem_range *memp)
+{
+
+	return (register_mem_int(&mmio_rb_root, memp));
+}
+
+int
+register_mem_fallback(struct mem_range *memp)
+{
+
+	return (register_mem_int(&mmio_rb_fallback, memp));
+}
+
+int 
+unregister_mem(struct mem_range *memp)
+{
+	struct mem_range *mr;
+	struct mmio_rb_range *entry = NULL;
+	int err, i;
+	
+	pthread_rwlock_wrlock(&mmio_rwlock);
+	err = mmio_rb_lookup(&mmio_rb_root, memp->base, &entry);
+	if (err == 0) {
+		mr = &entry->mr_param;
+		assert(mr->name == memp->name);
+		assert(mr->base == memp->base && mr->size == memp->size); 
+		assert((mr->flags & MEM_F_IMMUTABLE) == 0);
+		RB_REMOVE(mmio_rb_tree, &mmio_rb_root, entry);
+
+		/* flush Per-vCPU cache */	
+		for (i=0; i < VM_MAXCPU; i++) {
+			if (mmio_hint[i] == entry)
+				mmio_hint[i] = NULL;
+		}
+	}
+	pthread_rwlock_unlock(&mmio_rwlock);
+
+	if (entry)
+		free(entry);
+	
+	return (err);
+}
+
+void
+init_mem(void)
+{
+
+	RB_INIT(&mmio_rb_root);
+	RB_INIT(&mmio_rb_fallback);
+	pthread_rwlock_init(&mmio_rwlock, NULL);
+}
diff --git a/usr/src/cmd/bhyve/mem.h b/usr/src/cmd/bhyve/mem.h
new file mode 100644
index 0000000000..f386d67749
--- /dev/null
+++ b/usr/src/cmd/bhyve/mem.h
@@ -0,0 +1,65 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _MEM_H_
+#define	_MEM_H_
+
+#include <sys/linker_set.h>
+
+struct vmctx;
+
+typedef int (*mem_func_t)(struct vmctx *ctx, int vcpu, int dir, uint64_t addr,
+			  int size, uint64_t *val, void *arg1, long arg2);
+
+struct mem_range {
+	const char 	*name;
+	int		flags;
+	mem_func_t	handler;
+	void		*arg1;
+	long		arg2;
+	uint64_t  	base;
+	uint64_t  	size;
+};
+#define	MEM_F_READ		0x1
+#define	MEM_F_WRITE		0x2
+#define	MEM_F_RW		0x3
+#define	MEM_F_IMMUTABLE		0x4	/* mem_range cannot be unregistered */
+
+void	init_mem(void);
+int     emulate_mem(struct vmctx *, int vcpu, uint64_t paddr, struct vie *vie,
+		    struct vm_guest_paging *paging);
+		    
+int	read_mem(struct vmctx *ctx, int vcpu, uint64_t gpa, uint64_t *rval,
+		 int size);
+int	register_mem(struct mem_range *memp);
+int	register_mem_fallback(struct mem_range *memp);
+int	unregister_mem(struct mem_range *memp);
+
+#endif	/* _MEM_H_ */
diff --git a/usr/src/cmd/bhyve/mevent.c b/usr/src/cmd/bhyve/mevent.c
new file mode 100644
index 0000000000..edd5cf14cb
--- /dev/null
+++ b/usr/src/cmd/bhyve/mevent.c
@@ -0,0 +1,677 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * Micro event library for FreeBSD, designed for a single i/o thread 
+ * using kqueue, and having events be persistent by default.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <assert.h>
+#include <err.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include <sys/types.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#ifdef __FreeBSD__
+#include <sys/event.h>
+#else
+#include <port.h>
+#include <sys/poll.h>
+#include <sys/siginfo.h>
+#include <sys/queue.h>
+#endif
+#include <sys/time.h>
+
+#include <pthread.h>
+#include <pthread_np.h>
+
+#include "mevent.h"
+
+#define	MEVENT_MAX	64
+
+#define	MEV_ADD		1
+#define	MEV_ENABLE	2
+#define	MEV_DISABLE	3
+#define	MEV_DEL_PENDING	4
+
+extern char *vmname;
+
+static pthread_t mevent_tid;
+static int mevent_timid = 43;
+static int mevent_pipefd[2];
+static pthread_mutex_t mevent_lmutex = PTHREAD_MUTEX_INITIALIZER;
+
+struct mevent {	
+	void	(*me_func)(int, enum ev_type, void *);
+#define me_msecs me_fd
+	int	me_fd;
+#ifdef __FreeBSD__
+	int	me_timid;
+#else
+	timer_t me_timid;
+#endif
+	enum ev_type me_type;
+	void    *me_param;
+	int	me_cq;
+	int	me_state;
+	int	me_closefd;
+#ifndef __FreeBSD__
+	port_notify_t	me_notify;
+	struct sigevent	me_sigev;
+	boolean_t	me_auto_requeue;
+#endif
+	LIST_ENTRY(mevent) me_list;			   
+};
+
+static LIST_HEAD(listhead, mevent) global_head, change_head;
+
+static void
+mevent_qlock(void)
+{
+	pthread_mutex_lock(&mevent_lmutex);
+}
+
+static void
+mevent_qunlock(void)
+{
+	pthread_mutex_unlock(&mevent_lmutex);
+}
+
+static void
+mevent_pipe_read(int fd, enum ev_type type, void *param)
+{
+	char buf[MEVENT_MAX];
+	int status;
+
+	/*
+	 * Drain the pipe read side. The fd is non-blocking so this is
+	 * safe to do.
+	 */
+	do {
+		status = read(fd, buf, sizeof(buf));
+	} while (status == MEVENT_MAX);
+}
+
+static void
+mevent_notify(void)
+{
+	char c;
+	
+	/*
+	 * If calling from outside the i/o thread, write a byte on the
+	 * pipe to force the i/o thread to exit the blocking kevent call.
+	 */
+	if (mevent_pipefd[1] != 0 && pthread_self() != mevent_tid) {
+		write(mevent_pipefd[1], &c, 1);
+	}
+}
+#ifdef __FreeBSD__
+static int
+mevent_kq_filter(struct mevent *mevp)
+{
+	int retval;
+
+	retval = 0;
+
+	if (mevp->me_type == EVF_READ)
+		retval = EVFILT_READ;
+
+	if (mevp->me_type == EVF_WRITE)
+		retval = EVFILT_WRITE;
+
+	if (mevp->me_type == EVF_TIMER)
+		retval = EVFILT_TIMER;
+
+	if (mevp->me_type == EVF_SIGNAL)
+		retval = EVFILT_SIGNAL;
+
+	return (retval);
+}
+
+static int
+mevent_kq_flags(struct mevent *mevp)
+{
+	int ret;
+
+	switch (mevp->me_state) {
+	case MEV_ADD:
+		ret = EV_ADD;		/* implicitly enabled */
+		break;
+	case MEV_ENABLE:
+		ret = EV_ENABLE;
+		break;
+	case MEV_DISABLE:
+		ret = EV_DISABLE;
+		break;
+	case MEV_DEL_PENDING:
+		ret = EV_DELETE;
+		break;
+	default:
+		assert(0);
+		break;
+	}
+
+	return (ret);
+}
+
+static int
+mevent_kq_fflags(struct mevent *mevp)
+{
+	/* XXX nothing yet, perhaps EV_EOF for reads ? */
+	return (0);
+}
+
+static int
+mevent_build(int mfd, struct kevent *kev)
+{
+	struct mevent *mevp, *tmpp;
+	int i;
+
+	i = 0;
+
+	mevent_qlock();
+
+	LIST_FOREACH_SAFE(mevp, &change_head, me_list, tmpp) {
+		if (mevp->me_closefd) {
+			/*
+			 * A close of the file descriptor will remove the
+			 * event
+			 */
+			close(mevp->me_fd);
+		} else {
+			if (mevp->me_type == EVF_TIMER) {
+				kev[i].ident = mevp->me_timid;
+				kev[i].data = mevp->me_msecs;
+			} else {
+				kev[i].ident = mevp->me_fd;
+				kev[i].data = 0;
+			}
+			kev[i].filter = mevent_kq_filter(mevp);
+			kev[i].flags = mevent_kq_flags(mevp);
+			kev[i].fflags = mevent_kq_fflags(mevp);
+			kev[i].udata = mevp;
+			i++;
+		}
+
+		mevp->me_cq = 0;
+		LIST_REMOVE(mevp, me_list);
+
+		if (mevp->me_state == MEV_DEL_PENDING) {
+			free(mevp);
+		} else {
+			LIST_INSERT_HEAD(&global_head, mevp, me_list);
+		}
+
+		assert(i < MEVENT_MAX);
+	}
+
+	mevent_qunlock();
+
+	return (i);
+}
+
+static void
+mevent_handle(struct kevent *kev, int numev)
+{
+	struct mevent *mevp;
+	int i;
+
+	for (i = 0; i < numev; i++) {
+		mevp = kev[i].udata;
+
+		/* XXX check for EV_ERROR ? */
+
+		(*mevp->me_func)(mevp->me_fd, mevp->me_type, mevp->me_param);
+	}
+}
+
+#else /* __FreeBSD__ */
+
+static void
+mevent_update_one(struct mevent *mevp)
+{
+	int portfd = mevp->me_notify.portnfy_port;
+
+	switch (mevp->me_type) {
+	case EVF_READ:
+	case EVF_WRITE:
+		mevp->me_auto_requeue = B_FALSE;
+
+		switch (mevp->me_state) {
+		case MEV_ADD:
+		case MEV_ENABLE:
+		{
+			int events;
+
+			events = (mevp->me_type == EVF_READ) ? POLLIN : POLLOUT;
+
+			if (port_associate(portfd, PORT_SOURCE_FD, mevp->me_fd,
+			    events, mevp) != 0) {
+				(void) fprintf(stderr,
+				    "port_associate fd %d %p failed: %s\n",
+				    mevp->me_fd, mevp, strerror(errno));
+			}
+			return;
+		}
+		case MEV_DISABLE:
+		case MEV_DEL_PENDING:
+			/*
+			 * A disable that comes in while an event is being
+			 * handled will result in an ENOENT.
+			 */
+			if (port_dissociate(portfd, PORT_SOURCE_FD,
+			    mevp->me_fd) != 0 && errno != ENOENT) {
+				(void) fprintf(stderr, "port_dissociate "
+				    "portfd %d fd %d mevp %p failed: %s\n",
+				    portfd, mevp->me_fd, mevp, strerror(errno));
+			}
+			return;
+		default:
+			goto abort;
+		}
+
+	case EVF_TIMER:
+		mevp->me_auto_requeue = B_TRUE;
+
+		switch (mevp->me_state) {
+		case MEV_ADD:
+		case MEV_ENABLE:
+		{
+			struct itimerspec it = { 0 };
+
+			mevp->me_sigev.sigev_notify = SIGEV_PORT;
+			mevp->me_sigev.sigev_value.sival_ptr = &mevp->me_notify;
+
+			if (timer_create(CLOCK_REALTIME, &mevp->me_sigev,
+			    &mevp->me_timid) != 0) {
+				(void) fprintf(stderr,
+				    "timer_create failed: %s", strerror(errno));
+				return;
+			}
+
+			/* The first timeout */
+			it.it_value.tv_sec = mevp->me_msecs / MILLISEC;
+			it.it_value.tv_nsec =
+				MSEC2NSEC(mevp->me_msecs % MILLISEC);
+			/* Repeat at the same interval */
+			it.it_interval = it.it_value;
+
+			if (timer_settime(mevp->me_timid, 0, &it, NULL) != 0) {
+				(void) fprintf(stderr, "timer_settime failed: "
+				    "%s", strerror(errno));
+			}
+			return;
+		}
+		case MEV_DISABLE:
+		case MEV_DEL_PENDING:
+			if (timer_delete(mevp->me_timid) != 0) {
+				(void) fprintf(stderr, "timer_delete failed: "
+				    "%s", strerror(errno));
+			}
+			return;
+		default:
+			goto abort;
+		}
+	default:
+		/* EVF_SIGNAL not yet implemented. */
+		goto abort;
+	}
+
+abort:
+	(void) fprintf(stderr, "%s: unhandled type %d state %d\n", __func__,
+	    mevp->me_type, mevp->me_state);
+	abort();
+}
+
+static void
+mevent_update_pending(int portfd)
+{
+	struct mevent *mevp, *tmpp;
+
+	mevent_qlock();
+
+	LIST_FOREACH_SAFE(mevp, &change_head, me_list, tmpp) {
+		mevp->me_notify.portnfy_port = portfd;
+		mevp->me_notify.portnfy_user = mevp;
+		if (mevp->me_closefd) {
+			/*
+			 * A close of the file descriptor will remove the
+			 * event
+			 */
+			(void) close(mevp->me_fd);
+			mevp->me_fd = -1;
+		} else {
+			mevent_update_one(mevp);
+		}
+
+		mevp->me_cq = 0;
+		LIST_REMOVE(mevp, me_list);
+
+		if (mevp->me_state == MEV_DEL_PENDING) {
+			free(mevp);
+		} else {
+			LIST_INSERT_HEAD(&global_head, mevp, me_list);
+		}
+	}
+
+	mevent_qunlock();
+}
+
+static void
+mevent_handle_pe(port_event_t *pe)
+{
+	struct mevent *mevp = pe->portev_user;
+
+	mevent_qunlock();
+
+	(*mevp->me_func)(mevp->me_fd, mevp->me_type, mevp->me_param);
+
+	mevent_qlock();
+	if (!mevp->me_cq && !mevp->me_auto_requeue) {
+		mevent_update_one(mevp);
+	}
+	mevent_qunlock();
+}
+#endif
+
+struct mevent *
+mevent_add(int tfd, enum ev_type type,
+	   void (*func)(int, enum ev_type, void *), void *param)
+{
+	struct mevent *lp, *mevp;
+
+	if (tfd < 0 || func == NULL) {
+		return (NULL);
+	}
+
+	mevp = NULL;
+
+	mevent_qlock();
+
+	/*
+	 * Verify that the fd/type tuple is not present in any list
+	 */
+	LIST_FOREACH(lp, &global_head, me_list) {
+		if (type != EVF_TIMER && lp->me_fd == tfd &&
+		    lp->me_type == type) {
+			goto exit;
+		}
+	}
+
+	LIST_FOREACH(lp, &change_head, me_list) {
+		if (type != EVF_TIMER && lp->me_fd == tfd &&
+		    lp->me_type == type) {
+			goto exit;
+		}
+	}
+
+	/*
+	 * Allocate an entry, populate it, and add it to the change list.
+	 */
+	mevp = calloc(1, sizeof(struct mevent));
+	if (mevp == NULL) {
+		goto exit;
+	}
+
+	if (type == EVF_TIMER) {
+		mevp->me_msecs = tfd;
+		mevp->me_timid = mevent_timid++;
+	} else
+		mevp->me_fd = tfd;
+	mevp->me_type = type;
+	mevp->me_func = func;
+	mevp->me_param = param;
+
+	LIST_INSERT_HEAD(&change_head, mevp, me_list);
+	mevp->me_cq = 1;
+	mevp->me_state = MEV_ADD;
+	mevent_notify();
+
+exit:
+	mevent_qunlock();
+
+	return (mevp);
+}
+
+static int
+mevent_update(struct mevent *evp, int newstate)
+{
+	/*
+	 * It's not possible to enable/disable a deleted event
+	 */
+	if (evp->me_state == MEV_DEL_PENDING)
+		return (EINVAL);
+
+	/*
+	 * No update needed if state isn't changing
+	 */
+	if (evp->me_state == newstate)
+		return (0);
+	
+	mevent_qlock();
+
+	evp->me_state = newstate;
+
+	/*
+	 * Place the entry onto the changed list if not already there.
+	 */
+	if (evp->me_cq == 0) {
+		evp->me_cq = 1;
+		LIST_REMOVE(evp, me_list);
+		LIST_INSERT_HEAD(&change_head, evp, me_list);
+		mevent_notify();
+	}
+
+	mevent_qunlock();
+
+	return (0);
+}
+
+int
+mevent_enable(struct mevent *evp)
+{
+
+	return (mevent_update(evp, MEV_ENABLE));
+}
+
+int
+mevent_disable(struct mevent *evp)
+{
+
+	return (mevent_update(evp, MEV_DISABLE));
+}
+
+static int
+mevent_delete_event(struct mevent *evp, int closefd)
+{
+	mevent_qlock();
+
+	/*
+         * Place the entry onto the changed list if not already there, and
+	 * mark as to be deleted.
+         */
+        if (evp->me_cq == 0) {
+		evp->me_cq = 1;
+		LIST_REMOVE(evp, me_list);
+		LIST_INSERT_HEAD(&change_head, evp, me_list);
+		mevent_notify();
+        }
+	evp->me_state = MEV_DEL_PENDING;
+
+	if (closefd)
+		evp->me_closefd = 1;
+
+	mevent_qunlock();
+
+	return (0);
+}
+
+int
+mevent_delete(struct mevent *evp)
+{
+
+	return (mevent_delete_event(evp, 0));
+}
+
+int
+mevent_delete_close(struct mevent *evp)
+{
+
+	return (mevent_delete_event(evp, 1));
+}
+
+static void
+mevent_set_name(void)
+{
+
+	pthread_set_name_np(mevent_tid, "mevent");
+}
+
+void
+mevent_dispatch(void)
+{
+#ifdef __FreeBSD__
+	struct kevent changelist[MEVENT_MAX];
+	struct kevent eventlist[MEVENT_MAX];
+	struct mevent *pipev;
+	int mfd;
+	int numev;
+#else
+	struct mevent *pipev;
+	int portfd;
+#endif
+	int ret;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+#endif
+
+	mevent_tid = pthread_self();
+	mevent_set_name();
+
+#ifdef __FreeBSD__
+	mfd = kqueue();
+	assert(mfd > 0);
+#else
+	portfd = port_create();
+	assert(portfd >= 0);
+#endif
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_KQUEUE);
+	if (cap_rights_limit(mfd, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	/*
+	 * Open the pipe that will be used for other threads to force
+	 * the blocking kqueue call to exit by writing to it. Set the
+	 * descriptor to non-blocking.
+	 */
+	ret = pipe(mevent_pipefd);
+	if (ret < 0) {
+		perror("pipe");
+		exit(0);
+	}
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_EVENT, CAP_READ, CAP_WRITE);
+	if (cap_rights_limit(mevent_pipefd[0], &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+	if (cap_rights_limit(mevent_pipefd[1], &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	/*
+	 * Add internal event handler for the pipe write fd
+	 */
+	pipev = mevent_add(mevent_pipefd[0], EVF_READ, mevent_pipe_read, NULL);
+	assert(pipev != NULL);
+
+	for (;;) {
+#ifdef __FreeBSD__
+		/*
+		 * Build changelist if required.
+		 * XXX the changelist can be put into the blocking call
+		 * to eliminate the extra syscall. Currently better for
+		 * debug.
+		 */
+		numev = mevent_build(mfd, changelist);
+		if (numev) {
+			ret = kevent(mfd, changelist, numev, NULL, 0, NULL);
+			if (ret == -1) {
+				perror("Error return from kevent change");
+			}
+		}
+
+		/*
+		 * Block awaiting events
+		 */
+		ret = kevent(mfd, NULL, 0, eventlist, MEVENT_MAX, NULL);
+		if (ret == -1 && errno != EINTR) {
+			perror("Error return from kevent monitor");
+		}
+		
+		/*
+		 * Handle reported events
+		 */
+		mevent_handle(eventlist, ret);
+
+#else /* __FreeBSD__ */
+		port_event_t pev;
+
+		/* Handle any pending updates */
+		mevent_update_pending(portfd);
+
+		/* Block awaiting events */
+		ret = port_get(portfd, &pev, NULL);
+		if (ret != 0 && errno != EINTR) {
+			perror("Error return from port_get");
+			continue;
+		}
+
+		/* Handle reported event */
+		mevent_handle_pe(&pev);
+#endif /* __FreeBSD__ */
+	}			
+}
diff --git a/usr/src/cmd/bhyve/mevent.h b/usr/src/cmd/bhyve/mevent.h
new file mode 100644
index 0000000000..e6b96f0a7c
--- /dev/null
+++ b/usr/src/cmd/bhyve/mevent.h
@@ -0,0 +1,53 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_MEVENT_H_
+#define	_MEVENT_H_
+
+enum ev_type {
+	EVF_READ,
+	EVF_WRITE,
+	EVF_TIMER,
+	EVF_SIGNAL
+};
+
+struct mevent;
+
+struct mevent *mevent_add(int fd, enum ev_type type, 
+			  void (*func)(int, enum ev_type, void *),
+			  void *param);
+int	mevent_enable(struct mevent *evp);
+int	mevent_disable(struct mevent *evp);
+int	mevent_delete(struct mevent *evp);
+int	mevent_delete_close(struct mevent *evp);
+
+void	mevent_dispatch(void);
+
+#endif	/* _MEVENT_H_ */
diff --git a/usr/src/cmd/bhyve/mevent_test.c b/usr/src/cmd/bhyve/mevent_test.c
new file mode 100644
index 0000000000..22e3561fed
--- /dev/null
+++ b/usr/src/cmd/bhyve/mevent_test.c
@@ -0,0 +1,282 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * Test program for the micro event library. Set up a simple TCP echo
+ * service.
+ *
+ *  cc mevent_test.c mevent.c -lpthread
+ */
+
+#include <sys/types.h>
+#include <sys/stdint.h>
+#ifdef __FreeBSD__
+#include <sys/sysctl.h>
+#endif
+#include <sys/socket.h>
+#include <netinet/in.h>
+#ifdef __FreeBSD__
+#include <machine/cpufunc.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <pthread.h>
+#include <unistd.h>
+
+#include "mevent.h"
+
+#define TEST_PORT	4321
+
+static pthread_mutex_t accept_mutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t accept_condvar = PTHREAD_COND_INITIALIZER;
+
+static struct mevent *tevp;
+
+char *vmname = "test vm";
+
+
+#define MEVENT_ECHO
+
+/* Number of timer events to capture */
+#define TEVSZ	4096
+uint64_t tevbuf[TEVSZ];
+
+static void
+timer_print(void)
+{
+	uint64_t min, max, diff, sum;
+#ifdef __FreeBSD__
+	uint64_t tsc_freq;
+	size_t len;
+#endif
+	int j;
+
+	min = UINT64_MAX;
+	max = 0;
+	sum = 0;
+
+#ifdef __FreeBSD__
+	len = sizeof(tsc_freq);
+	sysctlbyname("machdep.tsc_freq", &tsc_freq, &len, NULL, 0);
+#endif
+
+	for (j = 1; j < TEVSZ; j++) {
+#ifdef __FreeBSD__
+		/* Convert a tsc diff into microseconds */
+		diff = (tevbuf[j] - tevbuf[j-1]) * 1000000 / tsc_freq;
+#else
+		diff = (tevbuf[j] - tevbuf[j-1]) / 1000;
+#endif
+		sum += diff;
+		if (min > diff)
+			min = diff;
+		if (max < diff)
+			max = diff;
+	}
+
+	printf("timers done: usecs, min %ld, max %ld, mean %ld\n", min, max,
+	    sum/(TEVSZ - 1));
+}
+
+static void
+timer_callback(int fd, enum ev_type type, void *param)
+{
+	static int i;
+
+	if (i >= TEVSZ)
+		abort();
+
+#ifdef __FreeBSD__
+	tevbuf[i++] = rdtsc();
+#else
+	tevbuf[i++] = gethrtime();
+#endif
+
+	if (i == TEVSZ) {
+		mevent_delete(tevp);
+		timer_print();
+	}
+}
+
+
+#ifdef MEVENT_ECHO
+struct esync {
+	pthread_mutex_t	e_mt;
+	pthread_cond_t	e_cond;       
+};
+
+static void
+echoer_callback(int fd, enum ev_type type, void *param)
+{
+	struct esync *sync = param;
+
+	pthread_mutex_lock(&sync->e_mt);
+	pthread_cond_signal(&sync->e_cond);
+	pthread_mutex_unlock(&sync->e_mt);
+}
+
+static void *
+echoer(void *param)
+{
+	struct esync sync;
+	struct mevent *mev;
+	char buf[128];
+	int fd = (int)(uintptr_t) param;
+	int len;
+
+	pthread_mutex_init(&sync.e_mt, NULL);
+	pthread_cond_init(&sync.e_cond, NULL);
+
+	pthread_mutex_lock(&sync.e_mt);
+
+	mev = mevent_add(fd, EVF_READ, echoer_callback, &sync);
+	if (mev == NULL) {
+		printf("Could not allocate echoer event\n");
+		exit(1);
+	}
+
+	while (!pthread_cond_wait(&sync.e_cond, &sync.e_mt)) {
+		len = read(fd, buf, sizeof(buf));
+		if (len > 0) {
+			write(fd, buf, len);
+			write(0, buf, len);
+		} else {
+			break;
+		}
+	}
+
+	mevent_delete_close(mev);
+
+	pthread_mutex_unlock(&sync.e_mt);
+	pthread_mutex_destroy(&sync.e_mt);
+	pthread_cond_destroy(&sync.e_cond);
+
+	return (NULL);
+}
+
+#else
+
+static void *
+echoer(void *param)
+{
+	char buf[128];
+	int fd = (int)(uintptr_t) param;
+	int len;
+
+	while ((len = read(fd, buf, sizeof(buf))) > 0) {
+		write(1, buf, len);
+	}
+
+	return (NULL);
+}
+#endif /* MEVENT_ECHO */
+
+static void
+acceptor_callback(int fd, enum ev_type type, void *param)
+{
+	pthread_mutex_lock(&accept_mutex);
+	pthread_cond_signal(&accept_condvar);
+	pthread_mutex_unlock(&accept_mutex);
+}
+
+static void *
+acceptor(void *param)
+{
+	struct sockaddr_in sin;
+	pthread_t tid;
+	int news;
+	int s;
+
+        if ((s = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+                perror("socket");
+                exit(1);
+        }
+
+#ifdef __FreeBSD__
+        sin.sin_len = sizeof(sin);
+#endif
+        sin.sin_family = AF_INET;
+        sin.sin_addr.s_addr = htonl(INADDR_ANY);
+        sin.sin_port = htons(TEST_PORT);
+
+        if (bind(s, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
+                perror("bind");
+                exit(1);
+        }
+
+        if (listen(s, 1) < 0) {
+                perror("listen");
+                exit(1);
+        }
+
+	(void) mevent_add(s, EVF_READ, acceptor_callback, NULL);
+
+	pthread_mutex_lock(&accept_mutex);
+
+	while (!pthread_cond_wait(&accept_condvar, &accept_mutex)) {
+		news = accept(s, NULL, NULL);
+		if (news < 0) {
+			perror("accept error");
+		} else {
+			static int first = 1;
+
+			if (first) {
+				/*
+				 * Start a timer
+				 */
+				first = 0;
+				tevp = mevent_add(1, EVF_TIMER, timer_callback,
+						  NULL);
+			}
+
+			printf("incoming connection, spawning thread\n");
+			pthread_create(&tid, NULL, echoer,
+				       (void *)(uintptr_t)news);
+		}
+	}
+
+	return (NULL);
+}
+
+int
+main()
+{
+	pthread_t tid;
+
+	pthread_create(&tid, NULL, acceptor, NULL);
+
+	mevent_dispatch();
+	return (0);
+}
diff --git a/usr/src/cmd/bhyve/mptbl.c b/usr/src/cmd/bhyve/mptbl.c
new file mode 100644
index 0000000000..e78f88f074
--- /dev/null
+++ b/usr/src/cmd/bhyve/mptbl.c
@@ -0,0 +1,379 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <x86/mptable.h>
+
+#include <stdio.h>
+#include <string.h>
+
+#include "acpi.h"
+#include "bhyverun.h"
+#include "mptbl.h"
+#include "pci_emul.h"
+
+#define MPTABLE_BASE		0xE0000
+
+/* floating pointer length + maximum length of configuration table */
+#define	MPTABLE_MAX_LENGTH	(65536 + 16)
+
+#define LAPIC_PADDR		0xFEE00000
+#define LAPIC_VERSION 		16
+
+#define IOAPIC_PADDR		0xFEC00000
+#define IOAPIC_VERSION		0x11
+
+#define MP_SPECREV		4
+#define MPFP_SIG		"_MP_"
+
+/* Configuration header defines */
+#define MPCH_SIG		"PCMP"
+#define MPCH_OEMID		"BHyVe   "
+#define MPCH_OEMID_LEN          8
+#define MPCH_PRODID             "Hypervisor  "
+#define MPCH_PRODID_LEN         12
+
+/* Processor entry defines */
+#define MPEP_SIG_FAMILY		6	/* XXX bhyve should supply this */
+#define MPEP_SIG_MODEL		26
+#define MPEP_SIG_STEPPING	5
+#define MPEP_SIG		\
+	((MPEP_SIG_FAMILY << 8) | \
+	 (MPEP_SIG_MODEL << 4)	| \
+	 (MPEP_SIG_STEPPING))
+
+#define MPEP_FEATURES           (0xBFEBFBFF) /* XXX Intel i7 */
+
+/* Number of local intr entries */
+#define	MPEII_NUM_LOCAL_IRQ	2
+
+/* Bus entry defines */
+#define MPE_NUM_BUSES		2
+#define MPE_BUSNAME_LEN		6
+#define MPE_BUSNAME_ISA		"ISA   "
+#define MPE_BUSNAME_PCI		"PCI   "
+
+static void *oem_tbl_start;
+static int oem_tbl_size;
+
+static uint8_t
+mpt_compute_checksum(void *base, size_t len)
+{
+	uint8_t	*bytes;
+	uint8_t	sum;
+
+	for(bytes = base, sum = 0; len > 0; len--) {
+		sum += *bytes++;
+	}
+
+	return (256 - sum);
+}
+
+static void
+mpt_build_mpfp(mpfps_t mpfp, vm_paddr_t gpa)
+{
+
+	memset(mpfp, 0, sizeof(*mpfp));
+	memcpy(mpfp->signature, MPFP_SIG, 4);
+	mpfp->pap = gpa + sizeof(*mpfp);
+	mpfp->length = 1;
+	mpfp->spec_rev = MP_SPECREV;
+	mpfp->checksum = mpt_compute_checksum(mpfp, sizeof(*mpfp));
+}
+
+static void
+mpt_build_mpch(mpcth_t mpch)
+{
+
+	memset(mpch, 0, sizeof(*mpch));
+	memcpy(mpch->signature, MPCH_SIG, 4);
+	mpch->spec_rev = MP_SPECREV;
+	memcpy(mpch->oem_id, MPCH_OEMID, MPCH_OEMID_LEN);
+	memcpy(mpch->product_id, MPCH_PRODID, MPCH_PRODID_LEN);
+	mpch->apic_address = LAPIC_PADDR;
+}
+
+static void
+mpt_build_proc_entries(proc_entry_ptr mpep, int ncpu)
+{
+	int i;
+
+	for (i = 0; i < ncpu; i++) {
+		memset(mpep, 0, sizeof(*mpep));
+		mpep->type = MPCT_ENTRY_PROCESSOR;
+		mpep->apic_id = i; // XXX
+		mpep->apic_version = LAPIC_VERSION;
+		mpep->cpu_flags = PROCENTRY_FLAG_EN;
+		if (i == 0)
+			mpep->cpu_flags |= PROCENTRY_FLAG_BP;
+		mpep->cpu_signature = MPEP_SIG;
+		mpep->feature_flags = MPEP_FEATURES;
+		mpep++;
+	}
+}
+
+static void
+mpt_build_localint_entries(int_entry_ptr mpie)
+{
+
+	/* Hardcode LINT0 as ExtINT on all CPUs. */
+	memset(mpie, 0, sizeof(*mpie));
+	mpie->type = MPCT_ENTRY_LOCAL_INT;
+	mpie->int_type = INTENTRY_TYPE_EXTINT;
+	mpie->int_flags = INTENTRY_FLAGS_POLARITY_CONFORM |
+	    INTENTRY_FLAGS_TRIGGER_CONFORM;
+	mpie->dst_apic_id = 0xff;
+	mpie->dst_apic_int = 0;
+	mpie++;
+
+	/* Hardcode LINT1 as NMI on all CPUs. */
+	memset(mpie, 0, sizeof(*mpie));
+	mpie->type = MPCT_ENTRY_LOCAL_INT;
+	mpie->int_type = INTENTRY_TYPE_NMI;
+	mpie->int_flags = INTENTRY_FLAGS_POLARITY_CONFORM |
+	    INTENTRY_FLAGS_TRIGGER_CONFORM;
+	mpie->dst_apic_id = 0xff;
+	mpie->dst_apic_int = 1;
+}
+
+static void
+mpt_build_bus_entries(bus_entry_ptr mpeb)
+{
+
+	memset(mpeb, 0, sizeof(*mpeb));
+	mpeb->type = MPCT_ENTRY_BUS;
+	mpeb->bus_id = 0;
+	memcpy(mpeb->bus_type, MPE_BUSNAME_PCI, MPE_BUSNAME_LEN);
+	mpeb++;
+
+	memset(mpeb, 0, sizeof(*mpeb));
+	mpeb->type = MPCT_ENTRY_BUS;
+	mpeb->bus_id = 1;	
+	memcpy(mpeb->bus_type, MPE_BUSNAME_ISA, MPE_BUSNAME_LEN);
+}
+
+static void
+mpt_build_ioapic_entries(io_apic_entry_ptr mpei, int id)
+{
+
+	memset(mpei, 0, sizeof(*mpei));
+	mpei->type = MPCT_ENTRY_IOAPIC;
+	mpei->apic_id = id;
+	mpei->apic_version = IOAPIC_VERSION;
+	mpei->apic_flags = IOAPICENTRY_FLAG_EN;
+	mpei->apic_address = IOAPIC_PADDR;
+}
+
+static int
+mpt_count_ioint_entries(void)
+{
+	int bus, count;
+
+	count = 0;
+	for (bus = 0; bus <= PCI_BUSMAX; bus++)
+		count += pci_count_lintr(bus);
+
+	/*
+	 * Always include entries for the first 16 pins along with a entry
+	 * for each active PCI INTx pin.
+	 */
+	return (16 + count);
+}
+
+static void
+mpt_generate_pci_int(int bus, int slot, int pin, int pirq_pin, int ioapic_irq,
+    void *arg)
+{
+	int_entry_ptr *mpiep, mpie;
+
+	mpiep = arg;
+	mpie = *mpiep;
+	memset(mpie, 0, sizeof(*mpie));
+
+	/*
+	 * This is always after another I/O interrupt entry, so cheat
+	 * and fetch the I/O APIC ID from the prior entry.
+	 */
+	mpie->type = MPCT_ENTRY_INT;
+	mpie->int_type = INTENTRY_TYPE_INT;
+	mpie->src_bus_id = bus;
+	mpie->src_bus_irq = slot << 2 | (pin - 1);
+	mpie->dst_apic_id = mpie[-1].dst_apic_id;
+	mpie->dst_apic_int = ioapic_irq;
+
+	*mpiep = mpie + 1;
+}
+
+static void
+mpt_build_ioint_entries(int_entry_ptr mpie, int id)
+{
+	int pin, bus;
+
+	/*
+	 * The following config is taken from kernel mptable.c
+	 * mptable_parse_default_config_ints(...), for now 
+	 * just use the default config, tweek later if needed.
+	 */
+
+	/* First, generate the first 16 pins. */
+	for (pin = 0; pin < 16; pin++) {
+		memset(mpie, 0, sizeof(*mpie));
+		mpie->type = MPCT_ENTRY_INT;
+		mpie->src_bus_id = 1;
+		mpie->dst_apic_id = id;
+
+		/*
+		 * All default configs route IRQs from bus 0 to the first 16
+		 * pins of the first I/O APIC with an APIC ID of 2.
+		 */
+		mpie->dst_apic_int = pin;
+		switch (pin) {
+		case 0:
+			/* Pin 0 is an ExtINT pin. */
+			mpie->int_type = INTENTRY_TYPE_EXTINT;
+			break;
+		case 2:
+			/* IRQ 0 is routed to pin 2. */
+			mpie->int_type = INTENTRY_TYPE_INT;
+			mpie->src_bus_irq = 0;
+			break;
+		case SCI_INT:
+			/* ACPI SCI is level triggered and active-lo. */
+			mpie->int_flags = INTENTRY_FLAGS_POLARITY_ACTIVELO |
+			    INTENTRY_FLAGS_TRIGGER_LEVEL;
+			mpie->int_type = INTENTRY_TYPE_INT;
+			mpie->src_bus_irq = SCI_INT;
+			break;
+		default:
+			/* All other pins are identity mapped. */
+			mpie->int_type = INTENTRY_TYPE_INT;
+			mpie->src_bus_irq = pin;
+			break;
+		}
+		mpie++;
+	}
+
+	/* Next, generate entries for any PCI INTx interrupts. */
+	for (bus = 0; bus <= PCI_BUSMAX; bus++)
+		pci_walk_lintr(bus, mpt_generate_pci_int, &mpie); 
+}
+
+void
+mptable_add_oemtbl(void *tbl, int tblsz)
+{
+
+	oem_tbl_start = tbl;
+	oem_tbl_size = tblsz;
+}
+
+int
+mptable_build(struct vmctx *ctx, int ncpu)
+{
+	mpcth_t			mpch;
+	bus_entry_ptr		mpeb;
+	io_apic_entry_ptr	mpei;
+	proc_entry_ptr		mpep;
+	mpfps_t			mpfp;
+	int_entry_ptr		mpie;
+	int			ioints, bus;
+	char 			*curraddr;
+	char 			*startaddr;
+
+	startaddr = paddr_guest2host(ctx, MPTABLE_BASE, MPTABLE_MAX_LENGTH);
+	if (startaddr == NULL) {
+		fprintf(stderr, "mptable requires mapped mem\n");
+		return (ENOMEM);
+	}
+
+	/*
+	 * There is no way to advertise multiple PCI hierarchies via MPtable
+	 * so require that there is no PCI hierarchy with a non-zero bus
+	 * number.
+	 */
+	for (bus = 1; bus <= PCI_BUSMAX; bus++) {
+		if (pci_bus_configured(bus)) {
+			fprintf(stderr, "MPtable is incompatible with "
+			    "multiple PCI hierarchies.\r\n");
+			fprintf(stderr, "MPtable generation can be disabled "
+			    "by passing the -Y option to bhyve(8).\r\n");
+			return (EINVAL);
+		}
+	}
+
+	curraddr = startaddr;
+	mpfp = (mpfps_t)curraddr;
+	mpt_build_mpfp(mpfp, MPTABLE_BASE);
+	curraddr += sizeof(*mpfp);
+
+	mpch = (mpcth_t)curraddr;
+	mpt_build_mpch(mpch);
+	curraddr += sizeof(*mpch);
+
+	mpep = (proc_entry_ptr)curraddr;
+	mpt_build_proc_entries(mpep, ncpu);
+	curraddr += sizeof(*mpep) * ncpu;
+	mpch->entry_count += ncpu;
+
+	mpeb = (bus_entry_ptr) curraddr;
+	mpt_build_bus_entries(mpeb);
+	curraddr += sizeof(*mpeb) * MPE_NUM_BUSES;
+	mpch->entry_count += MPE_NUM_BUSES;
+
+	mpei = (io_apic_entry_ptr)curraddr;
+	mpt_build_ioapic_entries(mpei, 0);
+	curraddr += sizeof(*mpei);
+	mpch->entry_count++;
+
+	mpie = (int_entry_ptr) curraddr;
+	ioints = mpt_count_ioint_entries();
+	mpt_build_ioint_entries(mpie, 0);
+	curraddr += sizeof(*mpie) * ioints;
+	mpch->entry_count += ioints;
+
+	mpie = (int_entry_ptr)curraddr;
+	mpt_build_localint_entries(mpie);
+	curraddr += sizeof(*mpie) * MPEII_NUM_LOCAL_IRQ;
+	mpch->entry_count += MPEII_NUM_LOCAL_IRQ;
+
+	if (oem_tbl_start) {
+		mpch->oem_table_pointer = curraddr - startaddr + MPTABLE_BASE;
+		mpch->oem_table_size = oem_tbl_size;
+		memcpy(curraddr, oem_tbl_start, oem_tbl_size);
+	}
+
+	mpch->base_table_length = curraddr - (char *)mpch;
+	mpch->checksum = mpt_compute_checksum(mpch, mpch->base_table_length);
+
+	return (0);
+}
diff --git a/usr/src/cmd/bhyve/mptbl.h b/usr/src/cmd/bhyve/mptbl.h
new file mode 100644
index 0000000000..ebc8d85ea8
--- /dev/null
+++ b/usr/src/cmd/bhyve/mptbl.h
@@ -0,0 +1,37 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _MPTBL_H_
+#define _MPTBL_H_
+
+int	mptable_build(struct vmctx *ctx, int ncpu);
+void	mptable_add_oemtbl(void *tbl, int tblsz);
+
+#endif /* _MPTBL_H_ */
diff --git a/usr/src/cmd/bhyve/pci_ahci.c b/usr/src/cmd/bhyve/pci_ahci.c
new file mode 100644
index 0000000000..ad0da7c669
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_ahci.c
@@ -0,0 +1,2480 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013  Zhixiang Yu <zcore@freebsd.org>
+ * Copyright (c) 2015-2016 Alexander Motin <mav@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/linker_set.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/ioctl.h>
+#include <sys/disk.h>
+#include <sys/ata.h>
+#include <sys/endian.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+#include <assert.h>
+#include <pthread.h>
+#include <pthread_np.h>
+#include <inttypes.h>
+#include <md5.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "ahci.h"
+#include "block_if.h"
+
+#define	DEF_PORTS	6	/* Intel ICH8 AHCI supports 6 ports */
+#define	MAX_PORTS	32	/* AHCI supports 32 ports */
+
+#define	PxSIG_ATA	0x00000101 /* ATA drive */
+#define	PxSIG_ATAPI	0xeb140101 /* ATAPI drive */
+
+enum sata_fis_type {
+	FIS_TYPE_REGH2D		= 0x27,	/* Register FIS - host to device */
+	FIS_TYPE_REGD2H		= 0x34,	/* Register FIS - device to host */
+	FIS_TYPE_DMAACT		= 0x39,	/* DMA activate FIS - device to host */
+	FIS_TYPE_DMASETUP	= 0x41,	/* DMA setup FIS - bidirectional */
+	FIS_TYPE_DATA		= 0x46,	/* Data FIS - bidirectional */
+	FIS_TYPE_BIST		= 0x58,	/* BIST activate FIS - bidirectional */
+	FIS_TYPE_PIOSETUP	= 0x5F,	/* PIO setup FIS - device to host */
+	FIS_TYPE_SETDEVBITS	= 0xA1,	/* Set dev bits FIS - device to host */
+};
+
+/*
+ * SCSI opcodes
+ */
+#define	TEST_UNIT_READY		0x00
+#define	REQUEST_SENSE		0x03
+#define	INQUIRY			0x12
+#define	START_STOP_UNIT		0x1B
+#define	PREVENT_ALLOW		0x1E
+#define	READ_CAPACITY		0x25
+#define	READ_10			0x28
+#define	POSITION_TO_ELEMENT	0x2B
+#define	READ_TOC		0x43
+#define	GET_EVENT_STATUS_NOTIFICATION 0x4A
+#define	MODE_SENSE_10		0x5A
+#define	REPORT_LUNS		0xA0
+#define	READ_12			0xA8
+#define	READ_CD			0xBE
+
+/*
+ * SCSI mode page codes
+ */
+#define	MODEPAGE_RW_ERROR_RECOVERY	0x01
+#define	MODEPAGE_CD_CAPABILITIES	0x2A
+
+/*
+ * ATA commands
+ */
+#define	ATA_SF_ENAB_SATA_SF		0x10
+#define		ATA_SATA_SF_AN		0x05
+#define	ATA_SF_DIS_SATA_SF		0x90
+
+/*
+ * Debug printf
+ */
+#ifdef AHCI_DEBUG
+static FILE *dbg;
+#define DPRINTF(format, arg...)	do{fprintf(dbg, format, ##arg);fflush(dbg);}while(0)
+#else
+#define DPRINTF(format, arg...)
+#endif
+#define WPRINTF(format, arg...) printf(format, ##arg)
+
+struct ahci_ioreq {
+	struct blockif_req io_req;
+	struct ahci_port *io_pr;
+	STAILQ_ENTRY(ahci_ioreq) io_flist;
+	TAILQ_ENTRY(ahci_ioreq) io_blist;
+	uint8_t *cfis;
+	uint32_t len;
+	uint32_t done;
+	int slot;
+	int more;
+};
+
+struct ahci_port {
+	struct blockif_ctxt *bctx;
+	struct pci_ahci_softc *pr_sc;
+	uint8_t *cmd_lst;
+	uint8_t *rfis;
+	char ident[20 + 1];
+	int port;
+	int atapi;
+	int reset;
+	int waitforclear;
+	int mult_sectors;
+	uint8_t xfermode;
+	uint8_t err_cfis[20];
+	uint8_t sense_key;
+	uint8_t asc;
+	u_int ccs;
+	uint32_t pending;
+
+	uint32_t clb;
+	uint32_t clbu;
+	uint32_t fb;
+	uint32_t fbu;
+	uint32_t is;
+	uint32_t ie;
+	uint32_t cmd;
+	uint32_t unused0;
+	uint32_t tfd;
+	uint32_t sig;
+	uint32_t ssts;
+	uint32_t sctl;
+	uint32_t serr;
+	uint32_t sact;
+	uint32_t ci;
+	uint32_t sntf;
+	uint32_t fbs;
+
+	/*
+	 * i/o request info
+	 */
+	struct ahci_ioreq *ioreq;
+	int ioqsz;
+	STAILQ_HEAD(ahci_fhead, ahci_ioreq) iofhd;
+	TAILQ_HEAD(ahci_bhead, ahci_ioreq) iobhd;
+};
+
+struct ahci_cmd_hdr {
+	uint16_t flags;
+	uint16_t prdtl;
+	uint32_t prdbc;
+	uint64_t ctba;
+	uint32_t reserved[4];
+};
+
+struct ahci_prdt_entry {
+	uint64_t dba;
+	uint32_t reserved;
+#define	DBCMASK		0x3fffff
+	uint32_t dbc;
+};
+
+struct pci_ahci_softc {
+	struct pci_devinst *asc_pi;
+	pthread_mutex_t	mtx;
+	int ports;
+	uint32_t cap;
+	uint32_t ghc;
+	uint32_t is;
+	uint32_t pi;
+	uint32_t vs;
+	uint32_t ccc_ctl;
+	uint32_t ccc_pts;
+	uint32_t em_loc;
+	uint32_t em_ctl;
+	uint32_t cap2;
+	uint32_t bohc;
+	uint32_t lintr;
+	struct ahci_port port[MAX_PORTS];
+};
+#define	ahci_ctx(sc)	((sc)->asc_pi->pi_vmctx)
+
+static void ahci_handle_port(struct ahci_port *p);
+
+static inline void lba_to_msf(uint8_t *buf, int lba)
+{
+	lba += 150;
+	buf[0] = (lba / 75) / 60;
+	buf[1] = (lba / 75) % 60;
+	buf[2] = lba % 75;
+}
+
+/*
+ * Generate HBA interrupts on global IS register write.
+ */
+static void
+ahci_generate_intr(struct pci_ahci_softc *sc, uint32_t mask)
+{
+	struct pci_devinst *pi = sc->asc_pi;
+	struct ahci_port *p;
+	int i, nmsg;
+	uint32_t mmask;
+
+	/* Update global IS from PxIS/PxIE. */
+	for (i = 0; i < sc->ports; i++) {
+		p = &sc->port[i];
+		if (p->is & p->ie)
+			sc->is |= (1 << i);
+	}
+	DPRINTF("%s(%08x) %08x\n", __func__, mask, sc->is);
+
+	/* If there is nothing enabled -- clear legacy interrupt and exit. */
+	if (sc->is == 0 || (sc->ghc & AHCI_GHC_IE) == 0) {
+		if (sc->lintr) {
+			pci_lintr_deassert(pi);
+			sc->lintr = 0;
+		}
+		return;
+	}
+
+	/* If there is anything and no MSI -- assert legacy interrupt. */
+	nmsg = pci_msi_maxmsgnum(pi);
+	if (nmsg == 0) {
+		if (!sc->lintr) {
+			sc->lintr = 1;
+			pci_lintr_assert(pi);
+		}
+		return;
+	}
+
+	/* Assert respective MSIs for ports that were touched. */
+	for (i = 0; i < nmsg; i++) {
+		if (sc->ports <= nmsg || i < nmsg - 1)
+			mmask = 1 << i;
+		else
+			mmask = 0xffffffff << i;
+		if (sc->is & mask && mmask & mask)
+			pci_generate_msi(pi, i);
+	}
+}
+
+/*
+ * Generate HBA interrupt on specific port event.
+ */
+static void
+ahci_port_intr(struct ahci_port *p)
+{
+	struct pci_ahci_softc *sc = p->pr_sc;
+	struct pci_devinst *pi = sc->asc_pi;
+	int nmsg;
+
+	DPRINTF("%s(%d) %08x/%08x %08x\n", __func__,
+	    p->port, p->is, p->ie, sc->is);
+
+	/* If there is nothing enabled -- we are done. */
+	if ((p->is & p->ie) == 0)
+		return;
+
+	/* In case of non-shared MSI always generate interrupt. */
+	nmsg = pci_msi_maxmsgnum(pi);
+	if (sc->ports <= nmsg || p->port < nmsg - 1) {
+		sc->is |= (1 << p->port);
+		if ((sc->ghc & AHCI_GHC_IE) == 0)
+			return;
+		pci_generate_msi(pi, p->port);
+		return;
+	}
+
+	/* If IS for this port is already set -- do nothing. */
+	if (sc->is & (1 << p->port))
+		return;
+
+	sc->is |= (1 << p->port);
+
+	/* If interrupts are enabled -- generate one. */
+	if ((sc->ghc & AHCI_GHC_IE) == 0)
+		return;
+	if (nmsg > 0) {
+		pci_generate_msi(pi, nmsg - 1);
+	} else if (!sc->lintr) {
+		sc->lintr = 1;
+		pci_lintr_assert(pi);
+	}
+}
+
+static void
+ahci_write_fis(struct ahci_port *p, enum sata_fis_type ft, uint8_t *fis)
+{
+	int offset, len, irq;
+
+	if (p->rfis == NULL || !(p->cmd & AHCI_P_CMD_FRE))
+		return;
+
+	switch (ft) {
+	case FIS_TYPE_REGD2H:
+		offset = 0x40;
+		len = 20;
+		irq = (fis[1] & (1 << 6)) ? AHCI_P_IX_DHR : 0;
+		break;
+	case FIS_TYPE_SETDEVBITS:
+		offset = 0x58;
+		len = 8;
+		irq = (fis[1] & (1 << 6)) ? AHCI_P_IX_SDB : 0;
+		break;
+	case FIS_TYPE_PIOSETUP:
+		offset = 0x20;
+		len = 20;
+		irq = (fis[1] & (1 << 6)) ? AHCI_P_IX_PS : 0;
+		break;
+	default:
+		WPRINTF("unsupported fis type %d\n", ft);
+		return;
+	}
+	if (fis[2] & ATA_S_ERROR) {
+		p->waitforclear = 1;
+		irq |= AHCI_P_IX_TFE;
+	}
+	memcpy(p->rfis + offset, fis, len);
+	if (irq) {
+		if (~p->is & irq) {
+			p->is |= irq;
+			ahci_port_intr(p);
+		}
+	}
+}
+
+static void
+ahci_write_fis_piosetup(struct ahci_port *p)
+{
+	uint8_t fis[20];
+
+	memset(fis, 0, sizeof(fis));
+	fis[0] = FIS_TYPE_PIOSETUP;
+	ahci_write_fis(p, FIS_TYPE_PIOSETUP, fis);
+}
+
+static void
+ahci_write_fis_sdb(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t tfd)
+{
+	uint8_t fis[8];
+	uint8_t error;
+
+	error = (tfd >> 8) & 0xff;
+	tfd &= 0x77;
+	memset(fis, 0, sizeof(fis));
+	fis[0] = FIS_TYPE_SETDEVBITS;
+	fis[1] = (1 << 6);
+	fis[2] = tfd;
+	fis[3] = error;
+	if (fis[2] & ATA_S_ERROR) {
+		p->err_cfis[0] = slot;
+		p->err_cfis[2] = tfd;
+		p->err_cfis[3] = error;
+		memcpy(&p->err_cfis[4], cfis + 4, 16);
+	} else {
+		*(uint32_t *)(fis + 4) = (1 << slot);
+		p->sact &= ~(1 << slot);
+	}
+	p->tfd &= ~0x77;
+	p->tfd |= tfd;
+	ahci_write_fis(p, FIS_TYPE_SETDEVBITS, fis);
+}
+
+static void
+ahci_write_fis_d2h(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t tfd)
+{
+	uint8_t fis[20];
+	uint8_t error;
+
+	error = (tfd >> 8) & 0xff;
+	memset(fis, 0, sizeof(fis));
+	fis[0] = FIS_TYPE_REGD2H;
+	fis[1] = (1 << 6);
+	fis[2] = tfd & 0xff;
+	fis[3] = error;
+	fis[4] = cfis[4];
+	fis[5] = cfis[5];
+	fis[6] = cfis[6];
+	fis[7] = cfis[7];
+	fis[8] = cfis[8];
+	fis[9] = cfis[9];
+	fis[10] = cfis[10];
+	fis[11] = cfis[11];
+	fis[12] = cfis[12];
+	fis[13] = cfis[13];
+	if (fis[2] & ATA_S_ERROR) {
+		p->err_cfis[0] = 0x80;
+		p->err_cfis[2] = tfd & 0xff;
+		p->err_cfis[3] = error;
+		memcpy(&p->err_cfis[4], cfis + 4, 16);
+	} else
+		p->ci &= ~(1 << slot);
+	p->tfd = tfd;
+	ahci_write_fis(p, FIS_TYPE_REGD2H, fis);
+}
+
+static void
+ahci_write_fis_d2h_ncq(struct ahci_port *p, int slot)
+{
+	uint8_t fis[20];
+
+	p->tfd = ATA_S_READY | ATA_S_DSC;
+	memset(fis, 0, sizeof(fis));
+	fis[0] = FIS_TYPE_REGD2H;
+	fis[1] = 0;			/* No interrupt */
+	fis[2] = p->tfd;		/* Status */
+	fis[3] = 0;			/* No error */
+	p->ci &= ~(1 << slot);
+	ahci_write_fis(p, FIS_TYPE_REGD2H, fis);
+}
+
+static void
+ahci_write_reset_fis_d2h(struct ahci_port *p)
+{
+	uint8_t fis[20];
+
+	memset(fis, 0, sizeof(fis));
+	fis[0] = FIS_TYPE_REGD2H;
+	fis[3] = 1;
+	fis[4] = 1;
+	if (p->atapi) {
+		fis[5] = 0x14;
+		fis[6] = 0xeb;
+	}
+	fis[12] = 1;
+	ahci_write_fis(p, FIS_TYPE_REGD2H, fis);
+}
+
+static void
+ahci_check_stopped(struct ahci_port *p)
+{
+	/*
+	 * If we are no longer processing the command list and nothing
+	 * is in-flight, clear the running bit, the current command
+	 * slot, the command issue and active bits.
+	 */
+	if (!(p->cmd & AHCI_P_CMD_ST)) {
+		if (p->pending == 0) {
+			p->ccs = 0;
+			p->cmd &= ~(AHCI_P_CMD_CR | AHCI_P_CMD_CCS_MASK);
+			p->ci = 0;
+			p->sact = 0;
+			p->waitforclear = 0;
+		}
+	}
+}
+
+static void
+ahci_port_stop(struct ahci_port *p)
+{
+	struct ahci_ioreq *aior;
+	uint8_t *cfis;
+	int slot;
+	int error;
+
+	assert(pthread_mutex_isowned_np(&p->pr_sc->mtx));
+
+	TAILQ_FOREACH(aior, &p->iobhd, io_blist) {
+		/*
+		 * Try to cancel the outstanding blockif request.
+		 */
+		error = blockif_cancel(p->bctx, &aior->io_req);
+		if (error != 0)
+			continue;
+
+		slot = aior->slot;
+		cfis = aior->cfis;
+		if (cfis[2] == ATA_WRITE_FPDMA_QUEUED ||
+		    cfis[2] == ATA_READ_FPDMA_QUEUED ||
+		    cfis[2] == ATA_SEND_FPDMA_QUEUED)
+			p->sact &= ~(1 << slot);	/* NCQ */
+		else
+			p->ci &= ~(1 << slot);
+
+		/*
+		 * This command is now done.
+		 */
+		p->pending &= ~(1 << slot);
+
+		/*
+		 * Delete the blockif request from the busy list
+		 */
+		TAILQ_REMOVE(&p->iobhd, aior, io_blist);
+
+		/*
+		 * Move the blockif request back to the free list
+		 */
+		STAILQ_INSERT_TAIL(&p->iofhd, aior, io_flist);
+	}
+
+	ahci_check_stopped(p);
+}
+
+static void
+ahci_port_reset(struct ahci_port *pr)
+{
+	pr->serr = 0;
+	pr->sact = 0;
+	pr->xfermode = ATA_UDMA6;
+	pr->mult_sectors = 128;
+
+	if (!pr->bctx) {
+		pr->ssts = ATA_SS_DET_NO_DEVICE;
+		pr->sig = 0xFFFFFFFF;
+		pr->tfd = 0x7F;
+		return;
+	}
+	pr->ssts = ATA_SS_DET_PHY_ONLINE | ATA_SS_IPM_ACTIVE;
+	if (pr->sctl & ATA_SC_SPD_MASK)
+		pr->ssts |= (pr->sctl & ATA_SC_SPD_MASK);
+	else
+		pr->ssts |= ATA_SS_SPD_GEN3;
+	pr->tfd = (1 << 8) | ATA_S_DSC | ATA_S_DMA;
+	if (!pr->atapi) {
+		pr->sig = PxSIG_ATA;
+		pr->tfd |= ATA_S_READY;
+	} else
+		pr->sig = PxSIG_ATAPI;
+	ahci_write_reset_fis_d2h(pr);
+}
+
+static void
+ahci_reset(struct pci_ahci_softc *sc)
+{
+	int i;
+
+	sc->ghc = AHCI_GHC_AE;
+	sc->is = 0;
+
+	if (sc->lintr) {
+		pci_lintr_deassert(sc->asc_pi);
+		sc->lintr = 0;
+	}
+
+	for (i = 0; i < sc->ports; i++) {
+		sc->port[i].ie = 0;
+		sc->port[i].is = 0;
+		sc->port[i].cmd = (AHCI_P_CMD_SUD | AHCI_P_CMD_POD);
+		if (sc->port[i].bctx)
+			sc->port[i].cmd |= AHCI_P_CMD_CPS;
+		sc->port[i].sctl = 0;
+		ahci_port_reset(&sc->port[i]);
+	}
+}
+
+static void
+ata_string(uint8_t *dest, const char *src, int len)
+{
+	int i;
+
+	for (i = 0; i < len; i++) {
+		if (*src)
+			dest[i ^ 1] = *src++;
+		else
+			dest[i ^ 1] = ' ';
+	}
+}
+
+static void
+atapi_string(uint8_t *dest, const char *src, int len)
+{
+	int i;
+
+	for (i = 0; i < len; i++) {
+		if (*src)
+			dest[i] = *src++;
+		else
+			dest[i] = ' ';
+	}
+}
+
+/*
+ * Build up the iovec based on the PRDT, 'done' and 'len'.
+ */
+static void
+ahci_build_iov(struct ahci_port *p, struct ahci_ioreq *aior,
+    struct ahci_prdt_entry *prdt, uint16_t prdtl)
+{
+	struct blockif_req *breq = &aior->io_req;
+	int i, j, skip, todo, left, extra;
+	uint32_t dbcsz;
+
+	/* Copy part of PRDT between 'done' and 'len' bytes into the iov. */
+	skip = aior->done;
+	left = aior->len - aior->done;
+	todo = 0;
+	for (i = 0, j = 0; i < prdtl && j < BLOCKIF_IOV_MAX && left > 0;
+	    i++, prdt++) {
+		dbcsz = (prdt->dbc & DBCMASK) + 1;
+		/* Skip already done part of the PRDT */
+		if (dbcsz <= skip) {
+			skip -= dbcsz;
+			continue;
+		}
+		dbcsz -= skip;
+		if (dbcsz > left)
+			dbcsz = left;
+		breq->br_iov[j].iov_base = paddr_guest2host(ahci_ctx(p->pr_sc),
+		    prdt->dba + skip, dbcsz);
+		breq->br_iov[j].iov_len = dbcsz;
+		todo += dbcsz;
+		left -= dbcsz;
+		skip = 0;
+		j++;
+	}
+
+	/* If we got limited by IOV length, round I/O down to sector size. */
+	if (j == BLOCKIF_IOV_MAX) {
+		extra = todo % blockif_sectsz(p->bctx);
+		todo -= extra;
+		assert(todo > 0);
+		while (extra > 0) {
+			if (breq->br_iov[j - 1].iov_len > extra) {
+				breq->br_iov[j - 1].iov_len -= extra;
+				break;
+			}
+			extra -= breq->br_iov[j - 1].iov_len;
+			j--;
+		}
+	}
+
+	breq->br_iovcnt = j;
+	breq->br_resid = todo;
+	aior->done += todo;
+	aior->more = (aior->done < aior->len && i < prdtl);
+}
+
+static void
+ahci_handle_rw(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done)
+{
+	struct ahci_ioreq *aior;
+	struct blockif_req *breq;
+	struct ahci_prdt_entry *prdt;
+	struct ahci_cmd_hdr *hdr;
+	uint64_t lba;
+	uint32_t len;
+	int err, first, ncq, readop;
+
+	prdt = (struct ahci_prdt_entry *)(cfis + 0x80);
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+	ncq = 0;
+	readop = 1;
+	first = (done == 0);
+
+	if (cfis[2] == ATA_WRITE || cfis[2] == ATA_WRITE48 ||
+	    cfis[2] == ATA_WRITE_MUL || cfis[2] == ATA_WRITE_MUL48 ||
+	    cfis[2] == ATA_WRITE_DMA || cfis[2] == ATA_WRITE_DMA48 ||
+	    cfis[2] == ATA_WRITE_FPDMA_QUEUED)
+		readop = 0;
+
+	if (cfis[2] == ATA_WRITE_FPDMA_QUEUED ||
+	    cfis[2] == ATA_READ_FPDMA_QUEUED) {
+		lba = ((uint64_t)cfis[10] << 40) |
+			((uint64_t)cfis[9] << 32) |
+			((uint64_t)cfis[8] << 24) |
+			((uint64_t)cfis[6] << 16) |
+			((uint64_t)cfis[5] << 8) |
+			cfis[4];
+		len = cfis[11] << 8 | cfis[3];
+		if (!len)
+			len = 65536;
+		ncq = 1;
+	} else if (cfis[2] == ATA_READ48 || cfis[2] == ATA_WRITE48 ||
+	    cfis[2] == ATA_READ_MUL48 || cfis[2] == ATA_WRITE_MUL48 ||
+	    cfis[2] == ATA_READ_DMA48 || cfis[2] == ATA_WRITE_DMA48) {
+		lba = ((uint64_t)cfis[10] << 40) |
+			((uint64_t)cfis[9] << 32) |
+			((uint64_t)cfis[8] << 24) |
+			((uint64_t)cfis[6] << 16) |
+			((uint64_t)cfis[5] << 8) |
+			cfis[4];
+		len = cfis[13] << 8 | cfis[12];
+		if (!len)
+			len = 65536;
+	} else {
+		lba = ((cfis[7] & 0xf) << 24) | (cfis[6] << 16) |
+			(cfis[5] << 8) | cfis[4];
+		len = cfis[12];
+		if (!len)
+			len = 256;
+	}
+	lba *= blockif_sectsz(p->bctx);
+	len *= blockif_sectsz(p->bctx);
+
+	/* Pull request off free list */
+	aior = STAILQ_FIRST(&p->iofhd);
+	assert(aior != NULL);
+	STAILQ_REMOVE_HEAD(&p->iofhd, io_flist);
+
+	aior->cfis = cfis;
+	aior->slot = slot;
+	aior->len = len;
+	aior->done = done;
+	breq = &aior->io_req;
+	breq->br_offset = lba + done;
+	ahci_build_iov(p, aior, prdt, hdr->prdtl);
+
+	/* Mark this command in-flight. */
+	p->pending |= 1 << slot;
+
+	/* Stuff request onto busy list. */
+	TAILQ_INSERT_HEAD(&p->iobhd, aior, io_blist);
+
+	if (ncq && first)
+		ahci_write_fis_d2h_ncq(p, slot);
+
+	if (readop)
+		err = blockif_read(p->bctx, breq);
+	else
+#ifdef __FreeBSD__
+		err = blockif_write(p->bctx, breq);
+#else
+		/*
+		 * XXX: We currently don't handle disabling of the write cache.
+		 * Once this is fixed we need to revisit this code to do sync
+		 * writes when the cache is disabled.
+		 */
+		err = blockif_write(p->bctx, breq, B_FALSE);
+#endif
+	assert(err == 0);
+}
+
+static void
+ahci_handle_flush(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	struct ahci_ioreq *aior;
+	struct blockif_req *breq;
+	int err;
+
+	/*
+	 * Pull request off free list
+	 */
+	aior = STAILQ_FIRST(&p->iofhd);
+	assert(aior != NULL);
+	STAILQ_REMOVE_HEAD(&p->iofhd, io_flist);
+	aior->cfis = cfis;
+	aior->slot = slot;
+	aior->len = 0;
+	aior->done = 0;
+	aior->more = 0;
+	breq = &aior->io_req;
+
+	/*
+	 * Mark this command in-flight.
+	 */
+	p->pending |= 1 << slot;
+
+	/*
+	 * Stuff request onto busy list
+	 */
+	TAILQ_INSERT_HEAD(&p->iobhd, aior, io_blist);
+
+	err = blockif_flush(p->bctx, breq);
+	assert(err == 0);
+}
+
+static inline void
+read_prdt(struct ahci_port *p, int slot, uint8_t *cfis,
+		void *buf, int size)
+{
+	struct ahci_cmd_hdr *hdr;
+	struct ahci_prdt_entry *prdt;
+	void *to;
+	int i, len;
+
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+	len = size;
+	to = buf;
+	prdt = (struct ahci_prdt_entry *)(cfis + 0x80);
+	for (i = 0; i < hdr->prdtl && len; i++) {
+		uint8_t *ptr;
+		uint32_t dbcsz;
+		int sublen;
+
+		dbcsz = (prdt->dbc & DBCMASK) + 1;
+		ptr = paddr_guest2host(ahci_ctx(p->pr_sc), prdt->dba, dbcsz);
+		sublen = MIN(len, dbcsz);
+		memcpy(to, ptr, sublen);
+		len -= sublen;
+		to += sublen;
+		prdt++;
+	}
+}
+
+static void
+ahci_handle_dsm_trim(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done)
+{
+	struct ahci_ioreq *aior;
+	struct blockif_req *breq;
+	uint8_t *entry;
+	uint64_t elba;
+	uint32_t len, elen;
+	int err, first, ncq;
+	uint8_t buf[512];
+
+	first = (done == 0);
+	if (cfis[2] == ATA_DATA_SET_MANAGEMENT) {
+		len = (uint16_t)cfis[13] << 8 | cfis[12];
+		len *= 512;
+		ncq = 0;
+	} else { /* ATA_SEND_FPDMA_QUEUED */
+		len = (uint16_t)cfis[11] << 8 | cfis[3];
+		len *= 512;
+		ncq = 1;
+	}
+	read_prdt(p, slot, cfis, buf, sizeof(buf));
+
+next:
+	entry = &buf[done];
+	elba = ((uint64_t)entry[5] << 40) |
+		((uint64_t)entry[4] << 32) |
+		((uint64_t)entry[3] << 24) |
+		((uint64_t)entry[2] << 16) |
+		((uint64_t)entry[1] << 8) |
+		entry[0];
+	elen = (uint16_t)entry[7] << 8 | entry[6];
+	done += 8;
+	if (elen == 0) {
+		if (done >= len) {
+			if (ncq) {
+				if (first)
+					ahci_write_fis_d2h_ncq(p, slot);
+				ahci_write_fis_sdb(p, slot, cfis,
+				    ATA_S_READY | ATA_S_DSC);
+			} else {
+				ahci_write_fis_d2h(p, slot, cfis,
+				    ATA_S_READY | ATA_S_DSC);
+			}
+			p->pending &= ~(1 << slot);
+			ahci_check_stopped(p);
+			if (!first)
+				ahci_handle_port(p);
+			return;
+		}
+		goto next;
+	}
+
+	/*
+	 * Pull request off free list
+	 */
+	aior = STAILQ_FIRST(&p->iofhd);
+	assert(aior != NULL);
+	STAILQ_REMOVE_HEAD(&p->iofhd, io_flist);
+	aior->cfis = cfis;
+	aior->slot = slot;
+	aior->len = len;
+	aior->done = done;
+	aior->more = (len != done);
+
+	breq = &aior->io_req;
+	breq->br_offset = elba * blockif_sectsz(p->bctx);
+	breq->br_resid = elen * blockif_sectsz(p->bctx);
+
+	/*
+	 * Mark this command in-flight.
+	 */
+	p->pending |= 1 << slot;
+
+	/*
+	 * Stuff request onto busy list
+	 */
+	TAILQ_INSERT_HEAD(&p->iobhd, aior, io_blist);
+
+	if (ncq && first)
+		ahci_write_fis_d2h_ncq(p, slot);
+
+	err = blockif_delete(p->bctx, breq);
+	assert(err == 0);
+}
+
+static inline void
+write_prdt(struct ahci_port *p, int slot, uint8_t *cfis,
+		void *buf, int size)
+{
+	struct ahci_cmd_hdr *hdr;
+	struct ahci_prdt_entry *prdt;
+	void *from;
+	int i, len;
+
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+	len = size;
+	from = buf;
+	prdt = (struct ahci_prdt_entry *)(cfis + 0x80);
+	for (i = 0; i < hdr->prdtl && len; i++) {
+		uint8_t *ptr;
+		uint32_t dbcsz;
+		int sublen;
+
+		dbcsz = (prdt->dbc & DBCMASK) + 1;
+		ptr = paddr_guest2host(ahci_ctx(p->pr_sc), prdt->dba, dbcsz);
+		sublen = MIN(len, dbcsz);
+		memcpy(ptr, from, sublen);
+		len -= sublen;
+		from += sublen;
+		prdt++;
+	}
+	hdr->prdbc = size - len;
+}
+
+static void
+ahci_checksum(uint8_t *buf, int size)
+{
+	int i;
+	uint8_t sum = 0;
+
+	for (i = 0; i < size - 1; i++)
+		sum += buf[i];
+	buf[size - 1] = 0x100 - sum;
+}
+
+static void
+ahci_handle_read_log(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	struct ahci_cmd_hdr *hdr;
+	uint32_t buf[128];
+	uint8_t *buf8 = (uint8_t *)buf;
+	uint16_t *buf16 = (uint16_t *)buf;
+
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+	if (p->atapi || hdr->prdtl == 0 || cfis[5] != 0 ||
+	    cfis[9] != 0 || cfis[12] != 1 || cfis[13] != 0) {
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+		return;
+	}
+
+	memset(buf, 0, sizeof(buf));
+	if (cfis[4] == 0x00) {	/* Log directory */
+		buf16[0x00] = 1; /* Version -- 1 */
+		buf16[0x10] = 1; /* NCQ Command Error Log -- 1 page */
+		buf16[0x13] = 1; /* SATA NCQ Send and Receive Log -- 1 page */
+	} else if (cfis[4] == 0x10) {	/* NCQ Command Error Log */
+		memcpy(buf8, p->err_cfis, sizeof(p->err_cfis));
+		ahci_checksum(buf8, sizeof(buf));
+	} else if (cfis[4] == 0x13) {	/* SATA NCQ Send and Receive Log */
+		if (blockif_candelete(p->bctx) && !blockif_is_ro(p->bctx)) {
+			buf[0x00] = 1;	/* SFQ DSM supported */
+			buf[0x01] = 1;	/* SFQ DSM TRIM supported */
+		}
+	} else {
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+		return;
+	}
+
+	if (cfis[2] == ATA_READ_LOG_EXT)
+		ahci_write_fis_piosetup(p);
+	write_prdt(p, slot, cfis, (void *)buf, sizeof(buf));
+	ahci_write_fis_d2h(p, slot, cfis, ATA_S_DSC | ATA_S_READY);
+}
+
+static void
+handle_identify(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	struct ahci_cmd_hdr *hdr;
+
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+	if (p->atapi || hdr->prdtl == 0) {
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+	} else {
+		uint16_t buf[256];
+		uint64_t sectors;
+		int sectsz, psectsz, psectoff, candelete, ro;
+		uint16_t cyl;
+		uint8_t sech, heads;
+
+		ro = blockif_is_ro(p->bctx);
+		candelete = blockif_candelete(p->bctx);
+		sectsz = blockif_sectsz(p->bctx);
+		sectors = blockif_size(p->bctx) / sectsz;
+		blockif_chs(p->bctx, &cyl, &heads, &sech);
+		blockif_psectsz(p->bctx, &psectsz, &psectoff);
+		memset(buf, 0, sizeof(buf));
+		buf[0] = 0x0040;
+		buf[1] = cyl;
+		buf[3] = heads;
+		buf[6] = sech;
+		ata_string((uint8_t *)(buf+10), p->ident, 20);
+		ata_string((uint8_t *)(buf+23), "001", 8);
+		ata_string((uint8_t *)(buf+27), "BHYVE SATA DISK", 40);
+		buf[47] = (0x8000 | 128);
+		buf[48] = 0;
+		buf[49] = (1 << 8 | 1 << 9 | 1 << 11);
+		buf[50] = (1 << 14);
+		buf[53] = (1 << 1 | 1 << 2);
+		if (p->mult_sectors)
+			buf[59] = (0x100 | p->mult_sectors);
+		if (sectors <= 0x0fffffff) {
+			buf[60] = sectors;
+			buf[61] = (sectors >> 16);
+		} else {
+			buf[60] = 0xffff;
+			buf[61] = 0x0fff;
+		}
+		buf[63] = 0x7;
+		if (p->xfermode & ATA_WDMA0)
+			buf[63] |= (1 << ((p->xfermode & 7) + 8));
+		buf[64] = 0x3;
+		buf[65] = 120;
+		buf[66] = 120;
+		buf[67] = 120;
+		buf[68] = 120;
+		buf[69] = 0;
+		buf[75] = 31;
+		buf[76] = (ATA_SATA_GEN1 | ATA_SATA_GEN2 | ATA_SATA_GEN3 |
+			   ATA_SUPPORT_NCQ);
+		buf[77] = (ATA_SUPPORT_RCVSND_FPDMA_QUEUED |
+			   (p->ssts & ATA_SS_SPD_MASK) >> 3);
+		buf[80] = 0x3f0;
+		buf[81] = 0x28;
+		buf[82] = (ATA_SUPPORT_POWERMGT | ATA_SUPPORT_WRITECACHE|
+			   ATA_SUPPORT_LOOKAHEAD | ATA_SUPPORT_NOP);
+		buf[83] = (ATA_SUPPORT_ADDRESS48 | ATA_SUPPORT_FLUSHCACHE |
+			   ATA_SUPPORT_FLUSHCACHE48 | 1 << 14);
+		buf[84] = (1 << 14);
+		buf[85] = (ATA_SUPPORT_POWERMGT | ATA_SUPPORT_WRITECACHE|
+			   ATA_SUPPORT_LOOKAHEAD | ATA_SUPPORT_NOP);
+		buf[86] = (ATA_SUPPORT_ADDRESS48 | ATA_SUPPORT_FLUSHCACHE |
+			   ATA_SUPPORT_FLUSHCACHE48 | 1 << 15);
+		buf[87] = (1 << 14);
+		buf[88] = 0x7f;
+		if (p->xfermode & ATA_UDMA0)
+			buf[88] |= (1 << ((p->xfermode & 7) + 8));
+		buf[100] = sectors;
+		buf[101] = (sectors >> 16);
+		buf[102] = (sectors >> 32);
+		buf[103] = (sectors >> 48);
+		if (candelete && !ro) {
+			buf[69] |= ATA_SUPPORT_RZAT | ATA_SUPPORT_DRAT;
+			buf[105] = 1;
+			buf[169] = ATA_SUPPORT_DSM_TRIM;
+		}
+		buf[106] = 0x4000;
+		buf[209] = 0x4000;
+		if (psectsz > sectsz) {
+			buf[106] |= 0x2000;
+			buf[106] |= ffsl(psectsz / sectsz) - 1;
+			buf[209] |= (psectoff / sectsz);
+		}
+		if (sectsz > 512) {
+			buf[106] |= 0x1000;
+			buf[117] = sectsz / 2;
+			buf[118] = ((sectsz / 2) >> 16);
+		}
+		buf[119] = (ATA_SUPPORT_RWLOGDMAEXT | 1 << 14);
+		buf[120] = (ATA_SUPPORT_RWLOGDMAEXT | 1 << 14);
+		buf[222] = 0x1020;
+		buf[255] = 0x00a5;
+		ahci_checksum((uint8_t *)buf, sizeof(buf));
+		ahci_write_fis_piosetup(p);
+		write_prdt(p, slot, cfis, (void *)buf, sizeof(buf));
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_DSC | ATA_S_READY);
+	}
+}
+
+static void
+handle_atapi_identify(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	if (!p->atapi) {
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+	} else {
+		uint16_t buf[256];
+
+		memset(buf, 0, sizeof(buf));
+		buf[0] = (2 << 14 | 5 << 8 | 1 << 7 | 2 << 5);
+		ata_string((uint8_t *)(buf+10), p->ident, 20);
+		ata_string((uint8_t *)(buf+23), "001", 8);
+		ata_string((uint8_t *)(buf+27), "BHYVE SATA DVD ROM", 40);
+		buf[49] = (1 << 9 | 1 << 8);
+		buf[50] = (1 << 14 | 1);
+		buf[53] = (1 << 2 | 1 << 1);
+		buf[62] = 0x3f;
+		buf[63] = 7;
+		if (p->xfermode & ATA_WDMA0)
+			buf[63] |= (1 << ((p->xfermode & 7) + 8));
+		buf[64] = 3;
+		buf[65] = 120;
+		buf[66] = 120;
+		buf[67] = 120;
+		buf[68] = 120;
+		buf[76] = (ATA_SATA_GEN1 | ATA_SATA_GEN2 | ATA_SATA_GEN3);
+		buf[77] = ((p->ssts & ATA_SS_SPD_MASK) >> 3);
+		buf[78] = (1 << 5);
+		buf[80] = 0x3f0;
+		buf[82] = (ATA_SUPPORT_POWERMGT | ATA_SUPPORT_PACKET |
+			   ATA_SUPPORT_RESET | ATA_SUPPORT_NOP);
+		buf[83] = (1 << 14);
+		buf[84] = (1 << 14);
+		buf[85] = (ATA_SUPPORT_POWERMGT | ATA_SUPPORT_PACKET |
+			   ATA_SUPPORT_RESET | ATA_SUPPORT_NOP);
+		buf[87] = (1 << 14);
+		buf[88] = 0x7f;
+		if (p->xfermode & ATA_UDMA0)
+			buf[88] |= (1 << ((p->xfermode & 7) + 8));
+		buf[222] = 0x1020;
+		buf[255] = 0x00a5;
+		ahci_checksum((uint8_t *)buf, sizeof(buf));
+		ahci_write_fis_piosetup(p);
+		write_prdt(p, slot, cfis, (void *)buf, sizeof(buf));
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_DSC | ATA_S_READY);
+	}
+}
+
+static void
+atapi_inquiry(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t buf[36];
+	uint8_t *acmd;
+	int len;
+	uint32_t tfd;
+
+	acmd = cfis + 0x40;
+
+	if (acmd[1] & 1) {		/* VPD */
+		if (acmd[2] == 0) {	/* Supported VPD pages */
+			buf[0] = 0x05;
+			buf[1] = 0;
+			buf[2] = 0;
+			buf[3] = 1;
+			buf[4] = 0;
+			len = 4 + buf[3];
+		} else {
+			p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+			p->asc = 0x24;
+			tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+			cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+			ahci_write_fis_d2h(p, slot, cfis, tfd);
+			return;
+		}
+	} else {
+		buf[0] = 0x05;
+		buf[1] = 0x80;
+		buf[2] = 0x00;
+		buf[3] = 0x21;
+		buf[4] = 31;
+		buf[5] = 0;
+		buf[6] = 0;
+		buf[7] = 0;
+		atapi_string(buf + 8, "BHYVE", 8);
+		atapi_string(buf + 16, "BHYVE DVD-ROM", 16);
+		atapi_string(buf + 32, "001", 4);
+		len = sizeof(buf);
+	}
+
+	if (len > acmd[4])
+		len = acmd[4];
+	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+	write_prdt(p, slot, cfis, buf, len);
+	ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+}
+
+static void
+atapi_read_capacity(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t buf[8];
+	uint64_t sectors;
+
+	sectors = blockif_size(p->bctx) / 2048;
+	be32enc(buf, sectors - 1);
+	be32enc(buf + 4, 2048);
+	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+	write_prdt(p, slot, cfis, buf, sizeof(buf));
+	ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+}
+
+static void
+atapi_read_toc(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t *acmd;
+	uint8_t format;
+	int len;
+
+	acmd = cfis + 0x40;
+
+	len = be16dec(acmd + 7);
+	format = acmd[9] >> 6;
+	switch (format) {
+	case 0:
+	{
+		int msf, size;
+		uint64_t sectors;
+		uint8_t start_track, buf[20], *bp;
+
+		msf = (acmd[1] >> 1) & 1;
+		start_track = acmd[6];
+		if (start_track > 1 && start_track != 0xaa) {
+			uint32_t tfd;
+			p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+			p->asc = 0x24;
+			tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+			cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+			ahci_write_fis_d2h(p, slot, cfis, tfd);
+			return;
+		}
+		bp = buf + 2;
+		*bp++ = 1;
+		*bp++ = 1;
+		if (start_track <= 1) {
+			*bp++ = 0;
+			*bp++ = 0x14;
+			*bp++ = 1;
+			*bp++ = 0;
+			if (msf) {
+				*bp++ = 0;
+				lba_to_msf(bp, 0);
+				bp += 3;
+			} else {
+				*bp++ = 0;
+				*bp++ = 0;
+				*bp++ = 0;
+				*bp++ = 0;
+			}
+		}
+		*bp++ = 0;
+		*bp++ = 0x14;
+		*bp++ = 0xaa;
+		*bp++ = 0;
+		sectors = blockif_size(p->bctx) / blockif_sectsz(p->bctx);
+		sectors >>= 2;
+		if (msf) {
+			*bp++ = 0;
+			lba_to_msf(bp, sectors);
+			bp += 3;
+		} else {
+			be32enc(bp, sectors);
+			bp += 4;
+		}
+		size = bp - buf;
+		be16enc(buf, size - 2);
+		if (len > size)
+			len = size;
+		write_prdt(p, slot, cfis, buf, len);
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+		break;
+	}
+	case 1:
+	{
+		uint8_t buf[12];
+
+		memset(buf, 0, sizeof(buf));
+		buf[1] = 0xa;
+		buf[2] = 0x1;
+		buf[3] = 0x1;
+		if (len > sizeof(buf))
+			len = sizeof(buf);
+		write_prdt(p, slot, cfis, buf, len);
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+		break;
+	}
+	case 2:
+	{
+		int msf, size;
+		uint64_t sectors;
+		uint8_t *bp, buf[50];
+
+		msf = (acmd[1] >> 1) & 1;
+		bp = buf + 2;
+		*bp++ = 1;
+		*bp++ = 1;
+
+		*bp++ = 1;
+		*bp++ = 0x14;
+		*bp++ = 0;
+		*bp++ = 0xa0;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 1;
+		*bp++ = 0;
+		*bp++ = 0;
+
+		*bp++ = 1;
+		*bp++ = 0x14;
+		*bp++ = 0;
+		*bp++ = 0xa1;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 1;
+		*bp++ = 0;
+		*bp++ = 0;
+
+		*bp++ = 1;
+		*bp++ = 0x14;
+		*bp++ = 0;
+		*bp++ = 0xa2;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 0;
+		sectors = blockif_size(p->bctx) / blockif_sectsz(p->bctx);
+		sectors >>= 2;
+		if (msf) {
+			*bp++ = 0;
+			lba_to_msf(bp, sectors);
+			bp += 3;
+		} else {
+			be32enc(bp, sectors);
+			bp += 4;
+		}
+
+		*bp++ = 1;
+		*bp++ = 0x14;
+		*bp++ = 0;
+		*bp++ = 1;
+		*bp++ = 0;
+		*bp++ = 0;
+		*bp++ = 0;
+		if (msf) {
+			*bp++ = 0;
+			lba_to_msf(bp, 0);
+			bp += 3;
+		} else {
+			*bp++ = 0;
+			*bp++ = 0;
+			*bp++ = 0;
+			*bp++ = 0;
+		}
+
+		size = bp - buf;
+		be16enc(buf, size - 2);
+		if (len > size)
+			len = size;
+		write_prdt(p, slot, cfis, buf, len);
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+		break;
+	}
+	default:
+	{
+		uint32_t tfd;
+
+		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+		p->asc = 0x24;
+		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		ahci_write_fis_d2h(p, slot, cfis, tfd);
+		break;
+	}
+	}
+}
+
+static void
+atapi_report_luns(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t buf[16];
+
+	memset(buf, 0, sizeof(buf));
+	buf[3] = 8;
+
+	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+	write_prdt(p, slot, cfis, buf, sizeof(buf));
+	ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+}
+
+static void
+atapi_read(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done)
+{
+	struct ahci_ioreq *aior;
+	struct ahci_cmd_hdr *hdr;
+	struct ahci_prdt_entry *prdt;
+	struct blockif_req *breq;
+	uint8_t *acmd;
+	uint64_t lba;
+	uint32_t len;
+	int err;
+
+	acmd = cfis + 0x40;
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+	prdt = (struct ahci_prdt_entry *)(cfis + 0x80);
+
+	lba = be32dec(acmd + 2);
+	if (acmd[0] == READ_10)
+		len = be16dec(acmd + 7);
+	else
+		len = be32dec(acmd + 6);
+	if (len == 0) {
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+	}
+	lba *= 2048;
+	len *= 2048;
+
+	/*
+	 * Pull request off free list
+	 */
+	aior = STAILQ_FIRST(&p->iofhd);
+	assert(aior != NULL);
+	STAILQ_REMOVE_HEAD(&p->iofhd, io_flist);
+	aior->cfis = cfis;
+	aior->slot = slot;
+	aior->len = len;
+	aior->done = done;
+	breq = &aior->io_req;
+	breq->br_offset = lba + done;
+	ahci_build_iov(p, aior, prdt, hdr->prdtl);
+
+	/* Mark this command in-flight. */
+	p->pending |= 1 << slot;
+
+	/* Stuff request onto busy list. */
+	TAILQ_INSERT_HEAD(&p->iobhd, aior, io_blist);
+
+	err = blockif_read(p->bctx, breq);
+	assert(err == 0);
+}
+
+static void
+atapi_request_sense(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t buf[64];
+	uint8_t *acmd;
+	int len;
+
+	acmd = cfis + 0x40;
+	len = acmd[4];
+	if (len > sizeof(buf))
+		len = sizeof(buf);
+	memset(buf, 0, len);
+	buf[0] = 0x70 | (1 << 7);
+	buf[2] = p->sense_key;
+	buf[7] = 10;
+	buf[12] = p->asc;
+	write_prdt(p, slot, cfis, buf, len);
+	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+	ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+}
+
+static void
+atapi_start_stop_unit(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t *acmd = cfis + 0x40;
+	uint32_t tfd;
+
+	switch (acmd[4] & 3) {
+	case 0:
+	case 1:
+	case 3:
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		tfd = ATA_S_READY | ATA_S_DSC;
+		break;
+	case 2:
+		/* TODO eject media */
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+		p->asc = 0x53;
+		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+		break;
+	}
+	ahci_write_fis_d2h(p, slot, cfis, tfd);
+}
+
+static void
+atapi_mode_sense(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t *acmd;
+	uint32_t tfd = 0;
+	uint8_t pc, code;
+	int len;
+
+	acmd = cfis + 0x40;
+	len = be16dec(acmd + 7);
+	pc = acmd[2] >> 6;
+	code = acmd[2] & 0x3f;
+
+	switch (pc) {
+	case 0:
+		switch (code) {
+		case MODEPAGE_RW_ERROR_RECOVERY:
+		{
+			uint8_t buf[16];
+
+			if (len > sizeof(buf))
+				len = sizeof(buf);
+
+			memset(buf, 0, sizeof(buf));
+			be16enc(buf, 16 - 2);
+			buf[2] = 0x70;
+			buf[8] = 0x01;
+			buf[9] = 16 - 10;
+			buf[11] = 0x05;
+			write_prdt(p, slot, cfis, buf, len);
+			tfd = ATA_S_READY | ATA_S_DSC;
+			break;
+		}
+		case MODEPAGE_CD_CAPABILITIES:
+		{
+			uint8_t buf[30];
+
+			if (len > sizeof(buf))
+				len = sizeof(buf);
+
+			memset(buf, 0, sizeof(buf));
+			be16enc(buf, 30 - 2);
+			buf[2] = 0x70;
+			buf[8] = 0x2A;
+			buf[9] = 30 - 10;
+			buf[10] = 0x08;
+			buf[12] = 0x71;
+			be16enc(&buf[18], 2);
+			be16enc(&buf[20], 512);
+			write_prdt(p, slot, cfis, buf, len);
+			tfd = ATA_S_READY | ATA_S_DSC;
+			break;
+		}
+		default:
+			goto error;
+			break;
+		}
+		break;
+	case 3:
+		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+		p->asc = 0x39;
+		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+		break;
+error:
+	case 1:
+	case 2:
+		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+		p->asc = 0x24;
+		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+		break;
+	}
+	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+	ahci_write_fis_d2h(p, slot, cfis, tfd);
+}
+
+static void
+atapi_get_event_status_notification(struct ahci_port *p, int slot,
+    uint8_t *cfis)
+{
+	uint8_t *acmd;
+	uint32_t tfd;
+
+	acmd = cfis + 0x40;
+
+	/* we don't support asynchronous operation */
+	if (!(acmd[1] & 1)) {
+		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+		p->asc = 0x24;
+		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+	} else {
+		uint8_t buf[8];
+		int len;
+
+		len = be16dec(acmd + 7);
+		if (len > sizeof(buf))
+			len = sizeof(buf);
+
+		memset(buf, 0, sizeof(buf));
+		be16enc(buf, 8 - 2);
+		buf[2] = 0x04;
+		buf[3] = 0x10;
+		buf[5] = 0x02;
+		write_prdt(p, slot, cfis, buf, len);
+		tfd = ATA_S_READY | ATA_S_DSC;
+	}
+	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+	ahci_write_fis_d2h(p, slot, cfis, tfd);
+}
+
+static void
+handle_packet_cmd(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+	uint8_t *acmd;
+
+	acmd = cfis + 0x40;
+
+#ifdef AHCI_DEBUG
+	{
+		int i;
+		DPRINTF("ACMD:");
+		for (i = 0; i < 16; i++)
+			DPRINTF("%02x ", acmd[i]);
+		DPRINTF("\n");
+	}
+#endif
+
+	switch (acmd[0]) {
+	case TEST_UNIT_READY:
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+		break;
+	case INQUIRY:
+		atapi_inquiry(p, slot, cfis);
+		break;
+	case READ_CAPACITY:
+		atapi_read_capacity(p, slot, cfis);
+		break;
+	case PREVENT_ALLOW:
+		/* TODO */
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+		break;
+	case READ_TOC:
+		atapi_read_toc(p, slot, cfis);
+		break;
+	case REPORT_LUNS:
+		atapi_report_luns(p, slot, cfis);
+		break;
+	case READ_10:
+	case READ_12:
+		atapi_read(p, slot, cfis, 0);
+		break;
+	case REQUEST_SENSE:
+		atapi_request_sense(p, slot, cfis);
+		break;
+	case START_STOP_UNIT:
+		atapi_start_stop_unit(p, slot, cfis);
+		break;
+	case MODE_SENSE_10:
+		atapi_mode_sense(p, slot, cfis);
+		break;
+	case GET_EVENT_STATUS_NOTIFICATION:
+		atapi_get_event_status_notification(p, slot, cfis);
+		break;
+	default:
+		cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+		p->asc = 0x20;
+		ahci_write_fis_d2h(p, slot, cfis, (p->sense_key << 12) |
+				ATA_S_READY | ATA_S_ERROR);
+		break;
+	}
+}
+
+static void
+ahci_handle_cmd(struct ahci_port *p, int slot, uint8_t *cfis)
+{
+
+	p->tfd |= ATA_S_BUSY;
+	switch (cfis[2]) {
+	case ATA_ATA_IDENTIFY:
+		handle_identify(p, slot, cfis);
+		break;
+	case ATA_SETFEATURES:
+	{
+		switch (cfis[3]) {
+		case ATA_SF_ENAB_SATA_SF:
+			switch (cfis[12]) {
+			case ATA_SATA_SF_AN:
+				p->tfd = ATA_S_DSC | ATA_S_READY;
+				break;
+			default:
+				p->tfd = ATA_S_ERROR | ATA_S_READY;
+				p->tfd |= (ATA_ERROR_ABORT << 8);
+				break;
+			}
+			break;
+		case ATA_SF_ENAB_WCACHE:
+		case ATA_SF_DIS_WCACHE:
+		case ATA_SF_ENAB_RCACHE:
+		case ATA_SF_DIS_RCACHE:
+			p->tfd = ATA_S_DSC | ATA_S_READY;
+			break;
+		case ATA_SF_SETXFER:
+		{
+			switch (cfis[12] & 0xf8) {
+			case ATA_PIO:
+			case ATA_PIO0:
+				break;
+			case ATA_WDMA0:
+			case ATA_UDMA0:
+				p->xfermode = (cfis[12] & 0x7);
+				break;
+			}
+			p->tfd = ATA_S_DSC | ATA_S_READY;
+			break;
+		}
+		default:
+			p->tfd = ATA_S_ERROR | ATA_S_READY;
+			p->tfd |= (ATA_ERROR_ABORT << 8);
+			break;
+		}
+		ahci_write_fis_d2h(p, slot, cfis, p->tfd);
+		break;
+	}
+	case ATA_SET_MULTI:
+		if (cfis[12] != 0 &&
+			(cfis[12] > 128 || (cfis[12] & (cfis[12] - 1)))) {
+			p->tfd = ATA_S_ERROR | ATA_S_READY;
+			p->tfd |= (ATA_ERROR_ABORT << 8);
+		} else {
+			p->mult_sectors = cfis[12];
+			p->tfd = ATA_S_DSC | ATA_S_READY;
+		}
+		ahci_write_fis_d2h(p, slot, cfis, p->tfd);
+		break;
+	case ATA_READ:
+	case ATA_WRITE:
+	case ATA_READ48:
+	case ATA_WRITE48:
+	case ATA_READ_MUL:
+	case ATA_WRITE_MUL:
+	case ATA_READ_MUL48:
+	case ATA_WRITE_MUL48:
+	case ATA_READ_DMA:
+	case ATA_WRITE_DMA:
+	case ATA_READ_DMA48:
+	case ATA_WRITE_DMA48:
+	case ATA_READ_FPDMA_QUEUED:
+	case ATA_WRITE_FPDMA_QUEUED:
+		ahci_handle_rw(p, slot, cfis, 0);
+		break;
+	case ATA_FLUSHCACHE:
+	case ATA_FLUSHCACHE48:
+		ahci_handle_flush(p, slot, cfis);
+		break;
+	case ATA_DATA_SET_MANAGEMENT:
+		if (cfis[11] == 0 && cfis[3] == ATA_DSM_TRIM &&
+		    cfis[13] == 0 && cfis[12] == 1) {
+			ahci_handle_dsm_trim(p, slot, cfis, 0);
+			break;
+		}
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+		break;
+	case ATA_SEND_FPDMA_QUEUED:
+		if ((cfis[13] & 0x1f) == ATA_SFPDMA_DSM &&
+		    cfis[17] == 0 && cfis[16] == ATA_DSM_TRIM &&
+		    cfis[11] == 0 && cfis[3] == 1) {
+			ahci_handle_dsm_trim(p, slot, cfis, 0);
+			break;
+		}
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+		break;
+	case ATA_READ_LOG_EXT:
+	case ATA_READ_LOG_DMA_EXT:
+		ahci_handle_read_log(p, slot, cfis);
+		break;
+	case ATA_SECURITY_FREEZE_LOCK:
+	case ATA_SMART_CMD:
+	case ATA_NOP:
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+		break;
+	case ATA_CHECK_POWER_MODE:
+		cfis[12] = 0xff;	/* always on */
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+		break;
+	case ATA_STANDBY_CMD:
+	case ATA_STANDBY_IMMEDIATE:
+	case ATA_IDLE_CMD:
+	case ATA_IDLE_IMMEDIATE:
+	case ATA_SLEEP:
+	case ATA_READ_VERIFY:
+	case ATA_READ_VERIFY48:
+		ahci_write_fis_d2h(p, slot, cfis, ATA_S_READY | ATA_S_DSC);
+		break;
+	case ATA_ATAPI_IDENTIFY:
+		handle_atapi_identify(p, slot, cfis);
+		break;
+	case ATA_PACKET_CMD:
+		if (!p->atapi) {
+			ahci_write_fis_d2h(p, slot, cfis,
+			    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+		} else
+			handle_packet_cmd(p, slot, cfis);
+		break;
+	default:
+		WPRINTF("Unsupported cmd:%02x\n", cfis[2]);
+		ahci_write_fis_d2h(p, slot, cfis,
+		    (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR);
+		break;
+	}
+}
+
+static void
+ahci_handle_slot(struct ahci_port *p, int slot)
+{
+	struct ahci_cmd_hdr *hdr;
+#ifdef AHCI_DEBUG
+	struct ahci_prdt_entry *prdt;
+#endif
+	struct pci_ahci_softc *sc;
+	uint8_t *cfis;
+#ifdef AHCI_DEBUG
+	int cfl, i;
+#endif
+
+	sc = p->pr_sc;
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+#ifdef AHCI_DEBUG
+	cfl = (hdr->flags & 0x1f) * 4;
+#endif
+	cfis = paddr_guest2host(ahci_ctx(sc), hdr->ctba,
+			0x80 + hdr->prdtl * sizeof(struct ahci_prdt_entry));
+#ifdef AHCI_DEBUG
+	prdt = (struct ahci_prdt_entry *)(cfis + 0x80);
+
+	DPRINTF("\ncfis:");
+	for (i = 0; i < cfl; i++) {
+		if (i % 10 == 0)
+			DPRINTF("\n");
+		DPRINTF("%02x ", cfis[i]);
+	}
+	DPRINTF("\n");
+
+	for (i = 0; i < hdr->prdtl; i++) {
+		DPRINTF("%d@%08"PRIx64"\n", prdt->dbc & 0x3fffff, prdt->dba);
+		prdt++;
+	}
+#endif
+
+	if (cfis[0] != FIS_TYPE_REGH2D) {
+		WPRINTF("Not a H2D FIS:%02x\n", cfis[0]);
+		return;
+	}
+
+	if (cfis[1] & 0x80) {
+		ahci_handle_cmd(p, slot, cfis);
+	} else {
+		if (cfis[15] & (1 << 2))
+			p->reset = 1;
+		else if (p->reset) {
+			p->reset = 0;
+			ahci_port_reset(p);
+		}
+		p->ci &= ~(1 << slot);
+	}
+}
+
+static void
+ahci_handle_port(struct ahci_port *p)
+{
+
+	if (!(p->cmd & AHCI_P_CMD_ST))
+		return;
+
+	/*
+	 * Search for any new commands to issue ignoring those that
+	 * are already in-flight.  Stop if device is busy or in error.
+	 */
+	for (; (p->ci & ~p->pending) != 0; p->ccs = ((p->ccs + 1) & 31)) {
+		if ((p->tfd & (ATA_S_BUSY | ATA_S_DRQ)) != 0)
+			break;
+		if (p->waitforclear)
+			break;
+		if ((p->ci & ~p->pending & (1 << p->ccs)) != 0) {
+			p->cmd &= ~AHCI_P_CMD_CCS_MASK;
+			p->cmd |= p->ccs << AHCI_P_CMD_CCS_SHIFT;
+			ahci_handle_slot(p, p->ccs);
+		}
+	}
+}
+
+/*
+ * blockif callback routine - this runs in the context of the blockif
+ * i/o thread, so the mutex needs to be acquired.
+ */
+static void
+ata_ioreq_cb(struct blockif_req *br, int err)
+{
+	struct ahci_cmd_hdr *hdr;
+	struct ahci_ioreq *aior;
+	struct ahci_port *p;
+	struct pci_ahci_softc *sc;
+	uint32_t tfd;
+	uint8_t *cfis;
+	int slot, ncq, dsm;
+
+	DPRINTF("%s %d\n", __func__, err);
+
+	ncq = dsm = 0;
+	aior = br->br_param;
+	p = aior->io_pr;
+	cfis = aior->cfis;
+	slot = aior->slot;
+	sc = p->pr_sc;
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
+
+	if (cfis[2] == ATA_WRITE_FPDMA_QUEUED ||
+	    cfis[2] == ATA_READ_FPDMA_QUEUED ||
+	    cfis[2] == ATA_SEND_FPDMA_QUEUED)
+		ncq = 1;
+	if (cfis[2] == ATA_DATA_SET_MANAGEMENT ||
+	    (cfis[2] == ATA_SEND_FPDMA_QUEUED &&
+	     (cfis[13] & 0x1f) == ATA_SFPDMA_DSM))
+		dsm = 1;
+
+	pthread_mutex_lock(&sc->mtx);
+
+	/*
+	 * Delete the blockif request from the busy list
+	 */
+	TAILQ_REMOVE(&p->iobhd, aior, io_blist);
+
+	/*
+	 * Move the blockif request back to the free list
+	 */
+	STAILQ_INSERT_TAIL(&p->iofhd, aior, io_flist);
+
+	if (!err)
+		hdr->prdbc = aior->done;
+
+	if (!err && aior->more) {
+		if (dsm)
+			ahci_handle_dsm_trim(p, slot, cfis, aior->done);
+		else 
+			ahci_handle_rw(p, slot, cfis, aior->done);
+		goto out;
+	}
+
+	if (!err)
+		tfd = ATA_S_READY | ATA_S_DSC;
+	else
+		tfd = (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR;
+	if (ncq)
+		ahci_write_fis_sdb(p, slot, cfis, tfd);
+	else
+		ahci_write_fis_d2h(p, slot, cfis, tfd);
+
+	/*
+	 * This command is now complete.
+	 */
+	p->pending &= ~(1 << slot);
+
+	ahci_check_stopped(p);
+	ahci_handle_port(p);
+out:
+	pthread_mutex_unlock(&sc->mtx);
+	DPRINTF("%s exit\n", __func__);
+}
+
+static void
+atapi_ioreq_cb(struct blockif_req *br, int err)
+{
+	struct ahci_cmd_hdr *hdr;
+	struct ahci_ioreq *aior;
+	struct ahci_port *p;
+	struct pci_ahci_softc *sc;
+	uint8_t *cfis;
+	uint32_t tfd;
+	int slot;
+
+	DPRINTF("%s %d\n", __func__, err);
+
+	aior = br->br_param;
+	p = aior->io_pr;
+	cfis = aior->cfis;
+	slot = aior->slot;
+	sc = p->pr_sc;
+	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + aior->slot * AHCI_CL_SIZE);
+
+	pthread_mutex_lock(&sc->mtx);
+
+	/*
+	 * Delete the blockif request from the busy list
+	 */
+	TAILQ_REMOVE(&p->iobhd, aior, io_blist);
+
+	/*
+	 * Move the blockif request back to the free list
+	 */
+	STAILQ_INSERT_TAIL(&p->iofhd, aior, io_flist);
+
+	if (!err)
+		hdr->prdbc = aior->done;
+
+	if (!err && aior->more) {
+		atapi_read(p, slot, cfis, aior->done);
+		goto out;
+	}
+
+	if (!err) {
+		tfd = ATA_S_READY | ATA_S_DSC;
+	} else {
+		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
+		p->asc = 0x21;
+		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
+	}
+	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
+	ahci_write_fis_d2h(p, slot, cfis, tfd);
+
+	/*
+	 * This command is now complete.
+	 */
+	p->pending &= ~(1 << slot);
+
+	ahci_check_stopped(p);
+	ahci_handle_port(p);
+out:
+	pthread_mutex_unlock(&sc->mtx);
+	DPRINTF("%s exit\n", __func__);
+}
+
+static void
+pci_ahci_ioreq_init(struct ahci_port *pr)
+{
+	struct ahci_ioreq *vr;
+	int i;
+
+	pr->ioqsz = blockif_queuesz(pr->bctx);
+	pr->ioreq = calloc(pr->ioqsz, sizeof(struct ahci_ioreq));
+	STAILQ_INIT(&pr->iofhd);
+
+	/*
+	 * Add all i/o request entries to the free queue
+	 */
+	for (i = 0; i < pr->ioqsz; i++) {
+		vr = &pr->ioreq[i];
+		vr->io_pr = pr;
+		if (!pr->atapi)
+			vr->io_req.br_callback = ata_ioreq_cb;
+		else
+			vr->io_req.br_callback = atapi_ioreq_cb;
+		vr->io_req.br_param = vr;
+		STAILQ_INSERT_TAIL(&pr->iofhd, vr, io_flist);
+	}
+
+	TAILQ_INIT(&pr->iobhd);
+}
+
+static void
+pci_ahci_port_write(struct pci_ahci_softc *sc, uint64_t offset, uint64_t value)
+{
+	int port = (offset - AHCI_OFFSET) / AHCI_STEP;
+	offset = (offset - AHCI_OFFSET) % AHCI_STEP;
+	struct ahci_port *p = &sc->port[port];
+
+	DPRINTF("pci_ahci_port %d: write offset 0x%"PRIx64" value 0x%"PRIx64"\n",
+		port, offset, value);
+
+	switch (offset) {
+	case AHCI_P_CLB:
+		p->clb = value;
+		break;
+	case AHCI_P_CLBU:
+		p->clbu = value;
+		break;
+	case AHCI_P_FB:
+		p->fb = value;
+		break;
+	case AHCI_P_FBU:
+		p->fbu = value;
+		break;
+	case AHCI_P_IS:
+		p->is &= ~value;
+		ahci_port_intr(p);
+		break;
+	case AHCI_P_IE:
+		p->ie = value & 0xFDC000FF;
+		ahci_port_intr(p);
+		break;
+	case AHCI_P_CMD:
+	{
+		p->cmd &= ~(AHCI_P_CMD_ST | AHCI_P_CMD_SUD | AHCI_P_CMD_POD |
+		    AHCI_P_CMD_CLO | AHCI_P_CMD_FRE | AHCI_P_CMD_APSTE |
+		    AHCI_P_CMD_ATAPI | AHCI_P_CMD_DLAE | AHCI_P_CMD_ALPE |
+		    AHCI_P_CMD_ASP | AHCI_P_CMD_ICC_MASK);
+		p->cmd |= (AHCI_P_CMD_ST | AHCI_P_CMD_SUD | AHCI_P_CMD_POD |
+		    AHCI_P_CMD_CLO | AHCI_P_CMD_FRE | AHCI_P_CMD_APSTE |
+		    AHCI_P_CMD_ATAPI | AHCI_P_CMD_DLAE | AHCI_P_CMD_ALPE |
+		    AHCI_P_CMD_ASP | AHCI_P_CMD_ICC_MASK) & value;
+
+		if (!(value & AHCI_P_CMD_ST)) {
+			ahci_port_stop(p);
+		} else {
+			uint64_t clb;
+
+			p->cmd |= AHCI_P_CMD_CR;
+			clb = (uint64_t)p->clbu << 32 | p->clb;
+			p->cmd_lst = paddr_guest2host(ahci_ctx(sc), clb,
+					AHCI_CL_SIZE * AHCI_MAX_SLOTS);
+		}
+
+		if (value & AHCI_P_CMD_FRE) {
+			uint64_t fb;
+
+			p->cmd |= AHCI_P_CMD_FR;
+			fb = (uint64_t)p->fbu << 32 | p->fb;
+			/* we don't support FBSCP, so rfis size is 256Bytes */
+			p->rfis = paddr_guest2host(ahci_ctx(sc), fb, 256);
+		} else {
+			p->cmd &= ~AHCI_P_CMD_FR;
+		}
+
+		if (value & AHCI_P_CMD_CLO) {
+			p->tfd &= ~(ATA_S_BUSY | ATA_S_DRQ);
+			p->cmd &= ~AHCI_P_CMD_CLO;
+		}
+
+		if (value & AHCI_P_CMD_ICC_MASK) {
+			p->cmd &= ~AHCI_P_CMD_ICC_MASK;
+		}
+
+		ahci_handle_port(p);
+		break;
+	}
+	case AHCI_P_TFD:
+	case AHCI_P_SIG:
+	case AHCI_P_SSTS:
+		WPRINTF("pci_ahci_port: read only registers 0x%"PRIx64"\n", offset);
+		break;
+	case AHCI_P_SCTL:
+		p->sctl = value;
+		if (!(p->cmd & AHCI_P_CMD_ST)) {
+			if (value & ATA_SC_DET_RESET)
+				ahci_port_reset(p);
+		}
+		break;
+	case AHCI_P_SERR:
+		p->serr &= ~value;
+		break;
+	case AHCI_P_SACT:
+		p->sact |= value;
+		break;
+	case AHCI_P_CI:
+		p->ci |= value;
+		ahci_handle_port(p);
+		break;
+	case AHCI_P_SNTF:
+	case AHCI_P_FBS:
+	default:
+		break;
+	}
+}
+
+static void
+pci_ahci_host_write(struct pci_ahci_softc *sc, uint64_t offset, uint64_t value)
+{
+	DPRINTF("pci_ahci_host: write offset 0x%"PRIx64" value 0x%"PRIx64"\n",
+		offset, value);
+
+	switch (offset) {
+	case AHCI_CAP:
+	case AHCI_PI:
+	case AHCI_VS:
+	case AHCI_CAP2:
+		DPRINTF("pci_ahci_host: read only registers 0x%"PRIx64"\n", offset);
+		break;
+	case AHCI_GHC:
+		if (value & AHCI_GHC_HR) {
+			ahci_reset(sc);
+			break;
+		}
+		if (value & AHCI_GHC_IE)
+			sc->ghc |= AHCI_GHC_IE;
+		else
+			sc->ghc &= ~AHCI_GHC_IE;
+		ahci_generate_intr(sc, 0xffffffff);
+		break;
+	case AHCI_IS:
+		sc->is &= ~value;
+		ahci_generate_intr(sc, value);
+		break;
+	default:
+		break;
+	}
+}
+
+static void
+pci_ahci_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+		int baridx, uint64_t offset, int size, uint64_t value)
+{
+	struct pci_ahci_softc *sc = pi->pi_arg;
+
+	assert(baridx == 5);
+	assert((offset % 4) == 0 && size == 4);
+
+	pthread_mutex_lock(&sc->mtx);
+
+	if (offset < AHCI_OFFSET)
+		pci_ahci_host_write(sc, offset, value);
+	else if (offset < AHCI_OFFSET + sc->ports * AHCI_STEP)
+		pci_ahci_port_write(sc, offset, value);
+	else
+		WPRINTF("pci_ahci: unknown i/o write offset 0x%"PRIx64"\n", offset);
+
+	pthread_mutex_unlock(&sc->mtx);
+}
+
+static uint64_t
+pci_ahci_host_read(struct pci_ahci_softc *sc, uint64_t offset)
+{
+	uint32_t value;
+
+	switch (offset) {
+	case AHCI_CAP:
+	case AHCI_GHC:
+	case AHCI_IS:
+	case AHCI_PI:
+	case AHCI_VS:
+	case AHCI_CCCC:
+	case AHCI_CCCP:
+	case AHCI_EM_LOC:
+	case AHCI_EM_CTL:
+	case AHCI_CAP2:
+	{
+		uint32_t *p = &sc->cap;
+		p += (offset - AHCI_CAP) / sizeof(uint32_t);
+		value = *p;
+		break;
+	}
+	default:
+		value = 0;
+		break;
+	}
+	DPRINTF("pci_ahci_host: read offset 0x%"PRIx64" value 0x%x\n",
+		offset, value);
+
+	return (value);
+}
+
+static uint64_t
+pci_ahci_port_read(struct pci_ahci_softc *sc, uint64_t offset)
+{
+	uint32_t value;
+	int port = (offset - AHCI_OFFSET) / AHCI_STEP;
+	offset = (offset - AHCI_OFFSET) % AHCI_STEP;
+
+	switch (offset) {
+	case AHCI_P_CLB:
+	case AHCI_P_CLBU:
+	case AHCI_P_FB:
+	case AHCI_P_FBU:
+	case AHCI_P_IS:
+	case AHCI_P_IE:
+	case AHCI_P_CMD:
+	case AHCI_P_TFD:
+	case AHCI_P_SIG:
+	case AHCI_P_SSTS:
+	case AHCI_P_SCTL:
+	case AHCI_P_SERR:
+	case AHCI_P_SACT:
+	case AHCI_P_CI:
+	case AHCI_P_SNTF:
+	case AHCI_P_FBS:
+	{
+		uint32_t *p= &sc->port[port].clb;
+		p += (offset - AHCI_P_CLB) / sizeof(uint32_t);
+		value = *p;
+		break;
+	}
+	default:
+		value = 0;
+		break;
+	}
+
+	DPRINTF("pci_ahci_port %d: read offset 0x%"PRIx64" value 0x%x\n",
+		port, offset, value);
+
+	return value;
+}
+
+static uint64_t
+pci_ahci_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+    uint64_t regoff, int size)
+{
+	struct pci_ahci_softc *sc = pi->pi_arg;
+	uint64_t offset;
+	uint32_t value;
+
+	assert(baridx == 5);
+	assert(size == 1 || size == 2 || size == 4);
+	assert((regoff & (size - 1)) == 0);
+
+	pthread_mutex_lock(&sc->mtx);
+
+	offset = regoff & ~0x3;	    /* round down to a multiple of 4 bytes */
+	if (offset < AHCI_OFFSET)
+		value = pci_ahci_host_read(sc, offset);
+	else if (offset < AHCI_OFFSET + sc->ports * AHCI_STEP)
+		value = pci_ahci_port_read(sc, offset);
+	else {
+		value = 0;
+		WPRINTF("pci_ahci: unknown i/o read offset 0x%"PRIx64"\n",
+		    regoff);
+	}
+	value >>= 8 * (regoff & 0x3);
+
+	pthread_mutex_unlock(&sc->mtx);
+
+	return (value);
+}
+
+static int
+pci_ahci_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts, int atapi)
+{
+	char bident[sizeof("XX:XX:XX")];
+	struct blockif_ctxt *bctxt;
+	struct pci_ahci_softc *sc;
+	int ret, slots, p;
+	MD5_CTX mdctx;
+	u_char digest[16];
+	char *next, *next2;
+
+	ret = 0;
+
+#ifdef AHCI_DEBUG
+	dbg = fopen("/tmp/log", "w+");
+#endif
+
+	sc = calloc(1, sizeof(struct pci_ahci_softc));
+	pi->pi_arg = sc;
+	sc->asc_pi = pi;
+	pthread_mutex_init(&sc->mtx, NULL);
+	sc->ports = 0;
+	sc->pi = 0;
+	slots = 32;
+
+	for (p = 0; p < MAX_PORTS && opts != NULL; p++, opts = next) {
+		/* Identify and cut off type of present port. */
+		if (strncmp(opts, "hd:", 3) == 0) {
+			atapi = 0;
+			opts += 3;
+		} else if (strncmp(opts, "cd:", 3) == 0) {
+			atapi = 1;
+			opts += 3;
+		}
+
+		/* Find and cut off the next port options. */
+		next = strstr(opts, ",hd:");
+		next2 = strstr(opts, ",cd:");
+		if (next == NULL || (next2 != NULL && next2 < next))
+			next = next2;
+		if (next != NULL) {
+			next[0] = 0;
+			next++;
+		}
+
+		if (opts[0] == 0)
+			continue;
+
+		/*
+		 * Attempt to open the backing image. Use the PCI slot/func
+		 * and the port number for the identifier string.
+		 */
+		snprintf(bident, sizeof(bident), "%d:%d:%d", pi->pi_slot,
+		    pi->pi_func, p);
+		bctxt = blockif_open(opts, bident);
+		if (bctxt == NULL) {
+			sc->ports = p;
+			ret = 1;
+			goto open_fail;
+		}	
+		sc->port[p].bctx = bctxt;
+		sc->port[p].pr_sc = sc;
+		sc->port[p].port = p;
+		sc->port[p].atapi = atapi;
+
+		/*
+		 * Create an identifier for the backing file.
+		 * Use parts of the md5 sum of the filename
+		 */
+		MD5Init(&mdctx);
+		MD5Update(&mdctx, opts, strlen(opts));
+		MD5Final(digest, &mdctx);
+		sprintf(sc->port[p].ident, "BHYVE-%02X%02X-%02X%02X-%02X%02X",
+		    digest[0], digest[1], digest[2], digest[3], digest[4],
+		    digest[5]);
+
+		/*
+		 * Allocate blockif request structures and add them
+		 * to the free list
+		 */
+		pci_ahci_ioreq_init(&sc->port[p]);
+
+		sc->pi |= (1 << p);
+		if (sc->port[p].ioqsz < slots)
+			slots = sc->port[p].ioqsz;
+	}
+	sc->ports = p;
+
+	/* Intel ICH8 AHCI */
+	--slots;
+	if (sc->ports < DEF_PORTS)
+		sc->ports = DEF_PORTS;
+	sc->cap = AHCI_CAP_64BIT | AHCI_CAP_SNCQ | AHCI_CAP_SSNTF |
+	    AHCI_CAP_SMPS | AHCI_CAP_SSS | AHCI_CAP_SALP |
+	    AHCI_CAP_SAL | AHCI_CAP_SCLO | (0x3 << AHCI_CAP_ISS_SHIFT)|
+	    AHCI_CAP_PMD | AHCI_CAP_SSC | AHCI_CAP_PSC |
+	    (slots << AHCI_CAP_NCS_SHIFT) | AHCI_CAP_SXS | (sc->ports - 1);
+
+	sc->vs = 0x10300;
+	sc->cap2 = AHCI_CAP2_APST;
+	ahci_reset(sc);
+
+	pci_set_cfgdata16(pi, PCIR_DEVICE, 0x2821);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, 0x8086);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_STORAGE);
+	pci_set_cfgdata8(pi, PCIR_SUBCLASS, PCIS_STORAGE_SATA);
+	pci_set_cfgdata8(pi, PCIR_PROGIF, PCIP_STORAGE_SATA_AHCI_1_0);
+	p = MIN(sc->ports, 16);
+	p = flsl(p) - ((p & (p - 1)) ? 0 : 1);
+	pci_emul_add_msicap(pi, 1 << p);
+	pci_emul_alloc_bar(pi, 5, PCIBAR_MEM32,
+	    AHCI_OFFSET + sc->ports * AHCI_STEP);
+
+	pci_lintr_request(pi);
+
+open_fail:
+	if (ret) {
+		for (p = 0; p < sc->ports; p++) {
+			if (sc->port[p].bctx != NULL)
+				blockif_close(sc->port[p].bctx);
+		}
+		free(sc);
+	}
+
+	return (ret);
+}
+
+static int
+pci_ahci_hd_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+
+	return (pci_ahci_init(ctx, pi, opts, 0));
+}
+
+static int
+pci_ahci_atapi_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+
+	return (pci_ahci_init(ctx, pi, opts, 1));
+}
+
+/*
+ * Use separate emulation names to distinguish drive and atapi devices
+ */
+struct pci_devemu pci_de_ahci = {
+	.pe_emu =	"ahci",
+	.pe_init =	pci_ahci_hd_init,
+	.pe_barwrite =	pci_ahci_write,
+	.pe_barread =	pci_ahci_read
+};
+PCI_EMUL_SET(pci_de_ahci);
+
+struct pci_devemu pci_de_ahci_hd = {
+	.pe_emu =	"ahci-hd",
+	.pe_init =	pci_ahci_hd_init,
+	.pe_barwrite =	pci_ahci_write,
+	.pe_barread =	pci_ahci_read
+};
+PCI_EMUL_SET(pci_de_ahci_hd);
+
+struct pci_devemu pci_de_ahci_cd = {
+	.pe_emu =	"ahci-cd",
+	.pe_init =	pci_ahci_atapi_init,
+	.pe_barwrite =	pci_ahci_write,
+	.pe_barread =	pci_ahci_read
+};
+PCI_EMUL_SET(pci_de_ahci_cd);
diff --git a/usr/src/cmd/bhyve/pci_e82545.c b/usr/src/cmd/bhyve/pci_e82545.c
new file mode 100644
index 0000000000..121c0fc773
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_e82545.c
@@ -0,0 +1,2413 @@
+/*
+ * Copyright (c) 2016 Alexander Motin <mav@FreeBSD.org>
+ * Copyright (c) 2015 Peter Grehan <grehan@freebsd.org>
+ * Copyright (c) 2013 Jeremiah Lott, Avere Systems
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/limits.h>
+#include <sys/ioctl.h>
+#include <sys/uio.h>
+#include <net/ethernet.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#ifndef	__FreeBSD__
+#include <sys/filio.h>
+#endif
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <md5.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <pthread_np.h>
+
+#include "e1000_regs.h"
+#include "e1000_defines.h"
+#include "mii.h"
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "mevent.h"
+
+/* Hardware/register definitions XXX: move some to common code. */
+#define E82545_VENDOR_ID_INTEL			0x8086
+#define E82545_DEV_ID_82545EM_COPPER		0x100F
+#define E82545_SUBDEV_ID			0x1008
+
+#define E82545_REVISION_4			4
+
+#define E82545_MDIC_DATA_MASK			0x0000FFFF
+#define E82545_MDIC_OP_MASK			0x0c000000
+#define E82545_MDIC_IE				0x20000000
+
+#define E82545_EECD_FWE_DIS	0x00000010 /* Flash writes disabled */
+#define E82545_EECD_FWE_EN	0x00000020 /* Flash writes enabled */
+#define E82545_EECD_FWE_MASK	0x00000030 /* Flash writes mask */
+
+#define E82545_BAR_REGISTER			0
+#define E82545_BAR_REGISTER_LEN			(128*1024)
+#define E82545_BAR_FLASH			1
+#define E82545_BAR_FLASH_LEN			(64*1024)
+#define E82545_BAR_IO				2
+#define E82545_BAR_IO_LEN			8
+
+#define E82545_IOADDR				0x00000000
+#define E82545_IODATA				0x00000004
+#define E82545_IO_REGISTER_MAX			0x0001FFFF
+#define E82545_IO_FLASH_BASE			0x00080000
+#define E82545_IO_FLASH_MAX			0x000FFFFF
+
+#define E82545_ARRAY_ENTRY(reg, offset)		(reg + (offset<<2))
+#define E82545_RAR_MAX				15
+#define E82545_MTA_MAX				127
+#define E82545_VFTA_MAX				127
+
+/* Slightly modified from the driver versions, hardcoded for 3 opcode bits,
+ * followed by 6 address bits.
+ * TODO: make opcode bits and addr bits configurable?
+ * NVM Commands - Microwire */
+#define E82545_NVM_OPCODE_BITS	3
+#define E82545_NVM_ADDR_BITS	6
+#define E82545_NVM_DATA_BITS	16
+#define E82545_NVM_OPADDR_BITS	(E82545_NVM_OPCODE_BITS + E82545_NVM_ADDR_BITS)
+#define E82545_NVM_ADDR_MASK	((1 << E82545_NVM_ADDR_BITS)-1)
+#define E82545_NVM_OPCODE_MASK	\
+    (((1 << E82545_NVM_OPCODE_BITS) - 1) << E82545_NVM_ADDR_BITS)
+#define E82545_NVM_OPCODE_READ	(0x6 << E82545_NVM_ADDR_BITS)	/* read */
+#define E82545_NVM_OPCODE_WRITE	(0x5 << E82545_NVM_ADDR_BITS)	/* write */
+#define E82545_NVM_OPCODE_ERASE	(0x7 << E82545_NVM_ADDR_BITS)	/* erase */
+#define	E82545_NVM_OPCODE_EWEN	(0x4 << E82545_NVM_ADDR_BITS)	/* wr-enable */
+
+#define	E82545_NVM_EEPROM_SIZE	64 /* 64 * 16-bit values == 128K */
+
+#define E1000_ICR_SRPD		0x00010000
+
+/* This is an arbitrary number.  There is no hard limit on the chip. */
+#define I82545_MAX_TXSEGS	64
+
+/* Legacy receive descriptor */
+struct e1000_rx_desc {
+	uint64_t buffer_addr;	/* Address of the descriptor's data buffer */
+	uint16_t length;	/* Length of data DMAed into data buffer */
+	uint16_t csum;		/* Packet checksum */
+	uint8_t	 status;       	/* Descriptor status */
+	uint8_t  errors;	/* Descriptor Errors */
+	uint16_t special;
+};
+
+/* Transmit descriptor types */
+#define	E1000_TXD_MASK		(E1000_TXD_CMD_DEXT | 0x00F00000)
+#define E1000_TXD_TYP_L		(0)
+#define E1000_TXD_TYP_C		(E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_C)
+#define E1000_TXD_TYP_D		(E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_D)
+
+/* Legacy transmit descriptor */
+struct e1000_tx_desc {
+	uint64_t buffer_addr;   /* Address of the descriptor's data buffer */
+	union {
+		uint32_t data;
+		struct {
+			uint16_t length;  /* Data buffer length */
+			uint8_t  cso;  /* Checksum offset */
+			uint8_t  cmd;  /* Descriptor control */
+		} flags;
+	} lower;
+	union {
+		uint32_t data;
+		struct {
+			uint8_t status; /* Descriptor status */
+			uint8_t css;  /* Checksum start */
+			uint16_t special;
+		} fields;
+	} upper;
+};
+
+/* Context descriptor */
+struct e1000_context_desc {
+	union {
+		uint32_t ip_config;
+		struct {
+			uint8_t ipcss;  /* IP checksum start */
+			uint8_t ipcso;  /* IP checksum offset */
+			uint16_t ipcse;  /* IP checksum end */
+		} ip_fields;
+	} lower_setup;
+	union {
+		uint32_t tcp_config;
+		struct {
+			uint8_t tucss;  /* TCP checksum start */
+			uint8_t tucso;  /* TCP checksum offset */
+			uint16_t tucse;  /* TCP checksum end */
+		} tcp_fields;
+	} upper_setup;
+	uint32_t cmd_and_length;
+	union {
+		uint32_t data;
+		struct {
+			uint8_t status;  /* Descriptor status */
+			uint8_t hdr_len;  /* Header length */
+			uint16_t mss;  /* Maximum segment size */
+		} fields;
+	} tcp_seg_setup;
+};
+
+/* Data descriptor */
+struct e1000_data_desc {
+	uint64_t buffer_addr;  /* Address of the descriptor's buffer address */
+	union {
+		uint32_t data;
+		struct {
+			uint16_t length;  /* Data buffer length */
+			uint8_t typ_len_ext;
+			uint8_t cmd;
+		} flags;
+	} lower;
+	union {
+		uint32_t data;
+		struct {
+			uint8_t status;  /* Descriptor status */
+			uint8_t popts;  /* Packet Options */
+			uint16_t special;
+		} fields;
+	} upper;
+};
+
+union e1000_tx_udesc {
+	struct e1000_tx_desc td;
+	struct e1000_context_desc cd;
+	struct e1000_data_desc dd;
+};
+
+/* Tx checksum info for a packet. */
+struct ck_info {
+	int	ck_valid;	/* ck_info is valid */
+	uint8_t	ck_start;	/* start byte of cksum calcuation */
+	uint8_t	ck_off;		/* offset of cksum insertion */
+	uint16_t ck_len;	/* length of cksum calc: 0 is to packet-end */
+};
+
+/*
+ * Debug printf
+ */
+static int e82545_debug = 0;
+#define DPRINTF(msg,params...) if (e82545_debug) fprintf(stderr, "e82545: " msg, params)
+#define WPRINTF(msg,params...) fprintf(stderr, "e82545: " msg, params)
+
+#define	MIN(a,b) (((a)<(b))?(a):(b))
+#define	MAX(a,b) (((a)>(b))?(a):(b))
+
+/* s/w representation of the RAL/RAH regs */
+struct  eth_uni {
+	int		eu_valid;
+	int		eu_addrsel;
+	struct ether_addr eu_eth;
+};
+
+
+struct e82545_softc {
+	struct pci_devinst *esc_pi;
+	struct vmctx	*esc_ctx;
+	struct mevent   *esc_mevp;
+	struct mevent   *esc_mevpitr;
+	pthread_mutex_t	esc_mtx;
+	struct ether_addr esc_mac;
+	int		esc_tapfd;
+
+	/* General */
+	uint32_t	esc_CTRL;	/* x0000 device ctl */
+	uint32_t	esc_FCAL;	/* x0028 flow ctl addr lo */
+	uint32_t	esc_FCAH;	/* x002C flow ctl addr hi */
+	uint32_t	esc_FCT;	/* x0030 flow ctl type */
+	uint32_t	esc_VET;	/* x0038 VLAN eth type */
+	uint32_t	esc_FCTTV;	/* x0170 flow ctl tx timer */
+	uint32_t	esc_LEDCTL;	/* x0E00 LED control */
+	uint32_t	esc_PBA;	/* x1000 pkt buffer allocation */
+	
+	/* Interrupt control */
+	int		esc_irq_asserted;
+	uint32_t	esc_ICR;	/* x00C0 cause read/clear */
+	uint32_t	esc_ITR;	/* x00C4 intr throttling */
+	uint32_t	esc_ICS;	/* x00C8 cause set */
+	uint32_t	esc_IMS;	/* x00D0 mask set/read */
+	uint32_t	esc_IMC;	/* x00D8 mask clear */
+
+	/* Transmit */
+	union e1000_tx_udesc *esc_txdesc;
+	struct e1000_context_desc esc_txctx;
+	pthread_t	esc_tx_tid;
+	pthread_cond_t	esc_tx_cond;
+	int		esc_tx_enabled;
+	int		esc_tx_active;
+	uint32_t	esc_TXCW;	/* x0178 transmit config */
+	uint32_t	esc_TCTL;	/* x0400 transmit ctl */
+	uint32_t	esc_TIPG;	/* x0410 inter-packet gap */
+	uint16_t	esc_AIT;	/* x0458 Adaptive Interframe Throttle */
+	uint64_t	esc_tdba;      	/* verified 64-bit desc table addr */
+	uint32_t	esc_TDBAL;	/* x3800 desc table addr, low bits */
+	uint32_t	esc_TDBAH;	/* x3804 desc table addr, hi 32-bits */
+	uint32_t	esc_TDLEN;	/* x3808 # descriptors in bytes */
+	uint16_t	esc_TDH;	/* x3810 desc table head idx */
+	uint16_t	esc_TDHr;	/* internal read version of TDH */
+	uint16_t	esc_TDT;	/* x3818 desc table tail idx */
+	uint32_t	esc_TIDV;	/* x3820 intr delay */
+	uint32_t	esc_TXDCTL;	/* x3828 desc control */
+	uint32_t	esc_TADV;	/* x382C intr absolute delay */
+	
+	/* L2 frame acceptance */
+	struct eth_uni	esc_uni[16];	/* 16 x unicast MAC addresses */
+	uint32_t	esc_fmcast[128]; /* Multicast filter bit-match */
+	uint32_t	esc_fvlan[128]; /* VLAN 4096-bit filter */
+	
+	/* Receive */
+	struct e1000_rx_desc *esc_rxdesc;
+	pthread_cond_t	esc_rx_cond;
+	int		esc_rx_enabled;
+	int		esc_rx_active;
+	int		esc_rx_loopback;
+	uint32_t	esc_RCTL;	/* x0100 receive ctl */
+	uint32_t	esc_FCRTL;	/* x2160 flow cntl thresh, low */
+	uint32_t	esc_FCRTH;	/* x2168 flow cntl thresh, hi */
+	uint64_t	esc_rdba;	/* verified 64-bit desc table addr */
+	uint32_t	esc_RDBAL;	/* x2800 desc table addr, low bits */
+	uint32_t	esc_RDBAH;	/* x2804 desc table addr, hi 32-bits*/
+	uint32_t	esc_RDLEN;	/* x2808 #descriptors */
+	uint16_t	esc_RDH;	/* x2810 desc table head idx */
+	uint16_t	esc_RDT;	/* x2818 desc table tail idx */
+	uint32_t	esc_RDTR;	/* x2820 intr delay */
+	uint32_t	esc_RXDCTL;	/* x2828 desc control */
+	uint32_t	esc_RADV;	/* x282C intr absolute delay */
+	uint32_t	esc_RSRPD;	/* x2C00 recv small packet detect */
+	uint32_t	esc_RXCSUM;     /* x5000 receive cksum ctl */
+	
+	/* IO Port register access */
+	uint32_t io_addr;
+
+	/* Shadow copy of MDIC */
+	uint32_t mdi_control;
+	/* Shadow copy of EECD */
+	uint32_t eeprom_control;
+	/* Latest NVM in/out */
+	uint16_t nvm_data;
+	uint16_t nvm_opaddr;
+	/* stats */
+	uint32_t missed_pkt_count; /* dropped for no room in rx queue */
+	uint32_t pkt_rx_by_size[6];
+	uint32_t pkt_tx_by_size[6];
+	uint32_t good_pkt_rx_count;
+	uint32_t bcast_pkt_rx_count;
+	uint32_t mcast_pkt_rx_count;
+	uint32_t good_pkt_tx_count;
+	uint32_t bcast_pkt_tx_count;
+	uint32_t mcast_pkt_tx_count;
+	uint32_t oversize_rx_count;
+	uint32_t tso_tx_count;
+	uint64_t good_octets_rx;
+	uint64_t good_octets_tx;
+	uint64_t missed_octets; /* counts missed and oversized */
+
+	uint8_t nvm_bits:6; /* number of bits remaining in/out */
+	uint8_t nvm_mode:2;
+#define E82545_NVM_MODE_OPADDR  0x0
+#define E82545_NVM_MODE_DATAIN  0x1
+#define E82545_NVM_MODE_DATAOUT 0x2
+        /* EEPROM data */
+        uint16_t eeprom_data[E82545_NVM_EEPROM_SIZE];
+};
+
+static void e82545_reset(struct e82545_softc *sc, int dev);
+static void e82545_rx_enable(struct e82545_softc *sc);
+static void e82545_rx_disable(struct e82545_softc *sc);
+#ifdef	__FreeBSD__
+static void e82545_tap_callback(int fd, enum ev_type type, void *param);
+#endif
+static void e82545_tx_start(struct e82545_softc *sc);
+static void e82545_tx_enable(struct e82545_softc *sc);
+static void e82545_tx_disable(struct e82545_softc *sc);
+
+static inline int
+e82545_size_stat_index(uint32_t size)
+{
+	if (size <= 64) {
+		return 0;
+	} else if (size >= 1024) {
+		return 5;
+	} else {
+		/* should be 1-4 */
+		return (ffs(size) - 6);
+	}
+}
+
+static void
+e82545_init_eeprom(struct e82545_softc *sc)
+{
+	uint16_t checksum, i;
+
+        /* mac addr */
+	sc->eeprom_data[NVM_MAC_ADDR] = ((uint16_t)sc->esc_mac.octet[0]) |
+		(((uint16_t)sc->esc_mac.octet[1]) << 8);
+	sc->eeprom_data[NVM_MAC_ADDR+1] = ((uint16_t)sc->esc_mac.octet[2]) |
+		(((uint16_t)sc->esc_mac.octet[3]) << 8);
+	sc->eeprom_data[NVM_MAC_ADDR+2] = ((uint16_t)sc->esc_mac.octet[4]) |
+		(((uint16_t)sc->esc_mac.octet[5]) << 8);
+
+	/* pci ids */
+	sc->eeprom_data[NVM_SUB_DEV_ID] = E82545_SUBDEV_ID;
+	sc->eeprom_data[NVM_SUB_VEN_ID] = E82545_VENDOR_ID_INTEL;
+	sc->eeprom_data[NVM_DEV_ID] = E82545_DEV_ID_82545EM_COPPER;
+	sc->eeprom_data[NVM_VEN_ID] = E82545_VENDOR_ID_INTEL;
+
+	/* fill in the checksum */
+        checksum = 0;
+	for (i = 0; i < NVM_CHECKSUM_REG; i++) {
+		checksum += sc->eeprom_data[i];
+	}
+	checksum = NVM_SUM - checksum;
+	sc->eeprom_data[NVM_CHECKSUM_REG] = checksum;
+	DPRINTF("eeprom checksum: 0x%x\r\n", checksum);
+}
+
+static void
+e82545_write_mdi(struct e82545_softc *sc, uint8_t reg_addr,
+			uint8_t phy_addr, uint32_t data)
+{
+	DPRINTF("Write mdi reg:0x%x phy:0x%x data: 0x%x\r\n", reg_addr, phy_addr, data);
+}
+
+static uint32_t
+e82545_read_mdi(struct e82545_softc *sc, uint8_t reg_addr,
+			uint8_t phy_addr)
+{
+	//DPRINTF("Read mdi reg:0x%x phy:0x%x\r\n", reg_addr, phy_addr);
+	switch (reg_addr) {
+	case PHY_STATUS:
+		return (MII_SR_LINK_STATUS | MII_SR_AUTONEG_CAPS |
+			MII_SR_AUTONEG_COMPLETE);
+	case PHY_AUTONEG_ADV:
+		return NWAY_AR_SELECTOR_FIELD;
+	case PHY_LP_ABILITY:
+		return 0;
+	case PHY_1000T_STATUS:
+		return (SR_1000T_LP_FD_CAPS | SR_1000T_REMOTE_RX_STATUS |
+			SR_1000T_LOCAL_RX_STATUS);
+	case PHY_ID1:
+		return (M88E1011_I_PHY_ID >> 16) & 0xFFFF;
+	case PHY_ID2:
+		return (M88E1011_I_PHY_ID | E82545_REVISION_4) & 0xFFFF;
+	default:
+		DPRINTF("Unknown mdi read reg:0x%x phy:0x%x\r\n", reg_addr, phy_addr);
+		return 0;
+	}
+	/* not reached */
+}
+
+static void
+e82545_eecd_strobe(struct e82545_softc *sc)
+{
+	/* Microwire state machine */
+	/*
+	DPRINTF("eeprom state machine srtobe "
+		"0x%x 0x%x 0x%x 0x%x\r\n",
+		sc->nvm_mode, sc->nvm_bits,
+		sc->nvm_opaddr, sc->nvm_data);*/
+
+	if (sc->nvm_bits == 0) {
+		DPRINTF("eeprom state machine not expecting data! "
+			"0x%x 0x%x 0x%x 0x%x\r\n",
+			sc->nvm_mode, sc->nvm_bits,
+			sc->nvm_opaddr, sc->nvm_data);
+		return;
+	}
+	sc->nvm_bits--;
+	if (sc->nvm_mode == E82545_NVM_MODE_DATAOUT) {
+		/* shifting out */
+		if (sc->nvm_data & 0x8000) {
+			sc->eeprom_control |= E1000_EECD_DO;
+		} else {
+			sc->eeprom_control &= ~E1000_EECD_DO;
+		}
+		sc->nvm_data <<= 1;
+		if (sc->nvm_bits == 0) {
+			/* read done, back to opcode mode. */
+			sc->nvm_opaddr = 0;
+			sc->nvm_mode = E82545_NVM_MODE_OPADDR;
+			sc->nvm_bits = E82545_NVM_OPADDR_BITS;
+		}
+	} else if (sc->nvm_mode == E82545_NVM_MODE_DATAIN) {
+		/* shifting in */
+		sc->nvm_data <<= 1;
+		if (sc->eeprom_control & E1000_EECD_DI) {
+			sc->nvm_data |= 1;
+		}
+		if (sc->nvm_bits == 0) {
+			/* eeprom write */
+			uint16_t op = sc->nvm_opaddr & E82545_NVM_OPCODE_MASK;
+			uint16_t addr = sc->nvm_opaddr & E82545_NVM_ADDR_MASK;
+			if (op != E82545_NVM_OPCODE_WRITE) {
+				DPRINTF("Illegal eeprom write op 0x%x\r\n",
+					sc->nvm_opaddr);
+			} else if (addr >= E82545_NVM_EEPROM_SIZE) {
+				DPRINTF("Illegal eeprom write addr 0x%x\r\n",
+					sc->nvm_opaddr);
+			} else {
+				DPRINTF("eeprom write eeprom[0x%x] = 0x%x\r\n",
+				addr, sc->nvm_data);
+				sc->eeprom_data[addr] = sc->nvm_data;
+			}
+			/* back to opcode mode */
+			sc->nvm_opaddr = 0;
+			sc->nvm_mode = E82545_NVM_MODE_OPADDR;
+			sc->nvm_bits = E82545_NVM_OPADDR_BITS;
+		}
+	} else if (sc->nvm_mode == E82545_NVM_MODE_OPADDR) {
+		sc->nvm_opaddr <<= 1;
+		if (sc->eeprom_control & E1000_EECD_DI) {
+			sc->nvm_opaddr |= 1;
+		}
+		if (sc->nvm_bits == 0) {
+			uint16_t op = sc->nvm_opaddr & E82545_NVM_OPCODE_MASK;
+			switch (op) {
+			case E82545_NVM_OPCODE_EWEN:
+				DPRINTF("eeprom write enable: 0x%x\r\n",
+					sc->nvm_opaddr);
+				/* back to opcode mode */
+				sc->nvm_opaddr = 0;
+				sc->nvm_mode = E82545_NVM_MODE_OPADDR;
+				sc->nvm_bits = E82545_NVM_OPADDR_BITS;
+				break;
+			case E82545_NVM_OPCODE_READ:
+			{
+				uint16_t addr = sc->nvm_opaddr &
+					E82545_NVM_ADDR_MASK;
+				sc->nvm_mode = E82545_NVM_MODE_DATAOUT;
+				sc->nvm_bits = E82545_NVM_DATA_BITS;
+				if (addr < E82545_NVM_EEPROM_SIZE) {
+					sc->nvm_data = sc->eeprom_data[addr];
+					DPRINTF("eeprom read: eeprom[0x%x] = 0x%x\r\n",
+						addr, sc->nvm_data);
+				} else {
+					DPRINTF("eeprom illegal read: 0x%x\r\n",
+						sc->nvm_opaddr);
+					sc->nvm_data = 0;
+				}
+				break;
+			}
+			case E82545_NVM_OPCODE_WRITE:
+				sc->nvm_mode = E82545_NVM_MODE_DATAIN;
+				sc->nvm_bits = E82545_NVM_DATA_BITS;
+				sc->nvm_data = 0;
+				break;
+			default:
+				DPRINTF("eeprom unknown op: 0x%x\r\r",
+					sc->nvm_opaddr);
+				/* back to opcode mode */
+				sc->nvm_opaddr = 0;
+				sc->nvm_mode = E82545_NVM_MODE_OPADDR;
+				sc->nvm_bits = E82545_NVM_OPADDR_BITS;
+			}
+		}
+	} else {
+		DPRINTF("eeprom state machine wrong state! "
+			"0x%x 0x%x 0x%x 0x%x\r\n",
+			sc->nvm_mode, sc->nvm_bits,
+			sc->nvm_opaddr, sc->nvm_data);
+	}
+}
+
+#ifdef	__FreeBSD__
+static void
+e82545_itr_callback(int fd, enum ev_type type, void *param)
+{
+	uint32_t new;
+	struct e82545_softc *sc = param;
+
+	pthread_mutex_lock(&sc->esc_mtx);
+	new = sc->esc_ICR & sc->esc_IMS;
+	if (new && !sc->esc_irq_asserted) {
+		DPRINTF("itr callback: lintr assert %x\r\n", new);
+		sc->esc_irq_asserted = 1;
+		pci_lintr_assert(sc->esc_pi);
+	} else {
+		mevent_delete(sc->esc_mevpitr);
+		sc->esc_mevpitr = NULL;
+	}
+	pthread_mutex_unlock(&sc->esc_mtx);
+}
+#endif
+
+static void
+e82545_icr_assert(struct e82545_softc *sc, uint32_t bits)
+{
+	uint32_t new;
+
+	DPRINTF("icr assert: 0x%x\r\n", bits);
+	
+	/*
+	 * An interrupt is only generated if bits are set that
+	 * aren't already in the ICR, these bits are unmasked,
+	 * and there isn't an interrupt already pending.
+	 */
+	new = bits & ~sc->esc_ICR & sc->esc_IMS;
+	sc->esc_ICR |= bits;
+
+	if (new == 0) {
+		DPRINTF("icr assert: masked %x, ims %x\r\n", new, sc->esc_IMS);
+	} else if (sc->esc_mevpitr != NULL) {
+		DPRINTF("icr assert: throttled %x, ims %x\r\n", new, sc->esc_IMS);
+	} else if (!sc->esc_irq_asserted) {
+		DPRINTF("icr assert: lintr assert %x\r\n", new);
+		sc->esc_irq_asserted = 1;
+		pci_lintr_assert(sc->esc_pi);
+		if (sc->esc_ITR != 0) {
+#ifdef	__FreeBSD__
+			sc->esc_mevpitr = mevent_add(
+			    (sc->esc_ITR + 3905) / 3906,  /* 256ns -> 1ms */
+			    EVF_TIMER, e82545_itr_callback, sc);
+#endif
+		}
+	}
+}
+
+static void
+e82545_ims_change(struct e82545_softc *sc, uint32_t bits)
+{
+	uint32_t new;
+
+	/*
+	 * Changing the mask may allow previously asserted
+	 * but masked interrupt requests to generate an interrupt.
+	 */
+	new = bits & sc->esc_ICR & ~sc->esc_IMS;
+	sc->esc_IMS |= bits;
+
+	if (new == 0) {
+		DPRINTF("ims change: masked %x, ims %x\r\n", new, sc->esc_IMS);
+	} else if (sc->esc_mevpitr != NULL) {
+		DPRINTF("ims change: throttled %x, ims %x\r\n", new, sc->esc_IMS);
+	} else if (!sc->esc_irq_asserted) {
+		DPRINTF("ims change: lintr assert %x\n\r", new);
+		sc->esc_irq_asserted = 1;
+		pci_lintr_assert(sc->esc_pi);
+		if (sc->esc_ITR != 0) {
+#ifdef	__FreeBSD__
+			sc->esc_mevpitr = mevent_add(
+			    (sc->esc_ITR + 3905) / 3906,  /* 256ns -> 1ms */
+			    EVF_TIMER, e82545_itr_callback, sc);
+#endif
+		}
+	}
+}
+
+static void
+e82545_icr_deassert(struct e82545_softc *sc, uint32_t bits)
+{
+
+	DPRINTF("icr deassert: 0x%x\r\n", bits);
+	sc->esc_ICR &= ~bits;
+
+	/*
+	 * If there are no longer any interrupt sources and there
+	 * was an asserted interrupt, clear it
+	 */
+	if (sc->esc_irq_asserted && !(sc->esc_ICR & sc->esc_IMS)) {
+		DPRINTF("icr deassert: lintr deassert %x\r\n", bits);
+		pci_lintr_deassert(sc->esc_pi);
+		sc->esc_irq_asserted = 0;
+	}
+}
+
+static void
+e82545_intr_write(struct e82545_softc *sc, uint32_t offset, uint32_t value)
+{
+
+	DPRINTF("intr_write: off %x, val %x\n\r", offset, value);
+	
+	switch (offset) {
+	case E1000_ICR:
+		e82545_icr_deassert(sc, value);
+		break;
+	case E1000_ITR:
+		sc->esc_ITR = value;
+		break;
+	case E1000_ICS:
+		sc->esc_ICS = value;	/* not used: store for debug */
+		e82545_icr_assert(sc, value);
+		break;
+	case E1000_IMS:
+		e82545_ims_change(sc, value);
+		break;
+	case E1000_IMC:
+		sc->esc_IMC = value;	/* for debug */
+		sc->esc_IMS &= ~value;
+		// XXX clear interrupts if all ICR bits now masked
+		// and interrupt was pending ?
+		break;
+	default:
+		break;
+	}
+}
+
+static uint32_t
+e82545_intr_read(struct e82545_softc *sc, uint32_t offset)
+{
+	uint32_t retval;
+
+	retval = 0;
+
+	DPRINTF("intr_read: off %x\n\r", offset);
+	
+	switch (offset) {
+	case E1000_ICR:
+		retval = sc->esc_ICR;
+		sc->esc_ICR = 0;
+		e82545_icr_deassert(sc, ~0);
+		break;
+	case E1000_ITR:
+		retval = sc->esc_ITR;
+		break;
+	case E1000_ICS:
+		/* write-only register */
+		break;
+	case E1000_IMS:
+		retval = sc->esc_IMS;
+		break;
+	case E1000_IMC:
+		/* write-only register */
+		break;
+	default:
+		break;
+	}
+
+	return (retval);
+}
+
+static void
+e82545_devctl(struct e82545_softc *sc, uint32_t val)
+{
+
+	sc->esc_CTRL = val & ~E1000_CTRL_RST;
+
+	if (val & E1000_CTRL_RST) {
+		DPRINTF("e1k: s/w reset, ctl %x\n", val);
+		e82545_reset(sc, 1);
+	}
+	/* XXX check for phy reset ? */
+}
+
+static void
+e82545_rx_update_rdba(struct e82545_softc *sc)
+{
+
+	/* XXX verify desc base/len within phys mem range */
+	sc->esc_rdba = (uint64_t)sc->esc_RDBAH << 32 |
+	    sc->esc_RDBAL;
+	
+	/* Cache host mapping of guest descriptor array */
+	sc->esc_rxdesc = paddr_guest2host(sc->esc_ctx,
+	    sc->esc_rdba, sc->esc_RDLEN);	
+}
+
+static void
+e82545_rx_ctl(struct e82545_softc *sc, uint32_t val)
+{
+	int on;
+
+	on = ((val & E1000_RCTL_EN) == E1000_RCTL_EN);
+
+	/* Save RCTL after stripping reserved bits 31:27,24,21,14,11:10,0 */
+	sc->esc_RCTL = val & ~0xF9204c01;
+
+	DPRINTF("rx_ctl - %s RCTL %x, val %x\n",
+		on ? "on" : "off", sc->esc_RCTL, val);
+
+	/* state change requested */
+	if (on != sc->esc_rx_enabled) {
+		if (on) {
+			/* Catch disallowed/unimplemented settings */
+			//assert(!(val & E1000_RCTL_LBM_TCVR));
+
+			if (sc->esc_RCTL & E1000_RCTL_LBM_TCVR) {
+				sc->esc_rx_loopback = 1;
+			} else {
+				sc->esc_rx_loopback = 0;
+			}
+
+			e82545_rx_update_rdba(sc);
+			e82545_rx_enable(sc);
+		} else {
+			e82545_rx_disable(sc);
+			sc->esc_rx_loopback = 0;
+			sc->esc_rdba = 0;
+			sc->esc_rxdesc = NULL;
+		}
+	}
+}
+
+static void
+e82545_tx_update_tdba(struct e82545_softc *sc)
+{
+
+	/* XXX verify desc base/len within phys mem range */
+	sc->esc_tdba = (uint64_t)sc->esc_TDBAH << 32 | sc->esc_TDBAL;
+
+	/* Cache host mapping of guest descriptor array */
+	sc->esc_txdesc = paddr_guest2host(sc->esc_ctx, sc->esc_tdba,
+            sc->esc_TDLEN);
+}
+
+static void
+e82545_tx_ctl(struct e82545_softc *sc, uint32_t val)
+{
+	int on;
+	
+	on = ((val & E1000_TCTL_EN) == E1000_TCTL_EN);
+
+	/* ignore TCTL_EN settings that don't change state */
+	if (on == sc->esc_tx_enabled)
+		return;
+
+	if (on) {
+		e82545_tx_update_tdba(sc);
+		e82545_tx_enable(sc);
+	} else {
+		e82545_tx_disable(sc);
+		sc->esc_tdba = 0;
+		sc->esc_txdesc = NULL;
+	}
+
+	/* Save TCTL value after stripping reserved bits 31:25,23,2,0 */
+	sc->esc_TCTL = val & ~0xFE800005;
+}
+
+int
+e82545_bufsz(uint32_t rctl)
+{
+
+	switch (rctl & (E1000_RCTL_BSEX | E1000_RCTL_SZ_256)) {
+	case (E1000_RCTL_SZ_2048): return (2048);
+	case (E1000_RCTL_SZ_1024): return (1024);
+	case (E1000_RCTL_SZ_512): return (512);
+	case (E1000_RCTL_SZ_256): return (256);
+	case (E1000_RCTL_BSEX|E1000_RCTL_SZ_16384): return (16384);
+	case (E1000_RCTL_BSEX|E1000_RCTL_SZ_8192): return (8192);
+	case (E1000_RCTL_BSEX|E1000_RCTL_SZ_4096): return (4096);
+	}
+	return (256);	/* Forbidden value. */
+}
+
+#ifdef	__FreeBSD__
+static uint8_t dummybuf[2048];
+
+/* XXX one packet at a time until this is debugged */
+static void
+e82545_tap_callback(int fd, enum ev_type type, void *param)
+{
+	struct e82545_softc *sc = param;
+	struct e1000_rx_desc *rxd;
+	struct iovec vec[64];
+	int left, len, lim, maxpktsz, maxpktdesc, bufsz, i, n, size;
+	uint32_t cause = 0;
+	uint16_t *tp, tag, head;
+
+	pthread_mutex_lock(&sc->esc_mtx);
+	DPRINTF("rx_run: head %x, tail %x\r\n", sc->esc_RDH, sc->esc_RDT);
+
+	if (!sc->esc_rx_enabled || sc->esc_rx_loopback) {
+		DPRINTF("rx disabled (!%d || %d) -- packet(s) dropped\r\n",
+		    sc->esc_rx_enabled, sc->esc_rx_loopback);
+		while (read(sc->esc_tapfd, dummybuf, sizeof(dummybuf)) > 0) {
+		}
+		goto done1;
+	}
+	bufsz = e82545_bufsz(sc->esc_RCTL);
+	maxpktsz = (sc->esc_RCTL & E1000_RCTL_LPE) ? 16384 : 1522;
+	maxpktdesc = (maxpktsz + bufsz - 1) / bufsz;
+	size = sc->esc_RDLEN / 16;
+	head = sc->esc_RDH;
+	left = (size + sc->esc_RDT - head) % size;
+	if (left < maxpktdesc) {
+		DPRINTF("rx overflow (%d < %d) -- packet(s) dropped\r\n",
+		    left, maxpktdesc);
+		while (read(sc->esc_tapfd, dummybuf, sizeof(dummybuf)) > 0) {
+		}
+		goto done1;
+	}
+
+	sc->esc_rx_active = 1;
+	pthread_mutex_unlock(&sc->esc_mtx);
+
+	for (lim = size / 4; lim > 0 && left >= maxpktdesc; lim -= n) {
+
+		/* Grab rx descriptor pointed to by the head pointer */
+		for (i = 0; i < maxpktdesc; i++) {
+			rxd = &sc->esc_rxdesc[(head + i) % size];
+			vec[i].iov_base = paddr_guest2host(sc->esc_ctx,
+			    rxd->buffer_addr, bufsz);
+			vec[i].iov_len = bufsz;
+		}
+		len = readv(sc->esc_tapfd, vec, maxpktdesc);
+		if (len <= 0) {
+			DPRINTF("tap: readv() returned %d\n", len);
+			goto done;
+		}
+
+		/*
+		 * Adjust the packet length based on whether the CRC needs
+		 * to be stripped or if the packet is less than the minimum
+		 * eth packet size.
+		 */
+		if (len < ETHER_MIN_LEN - ETHER_CRC_LEN)
+			len = ETHER_MIN_LEN - ETHER_CRC_LEN;
+		if (!(sc->esc_RCTL & E1000_RCTL_SECRC))
+			len += ETHER_CRC_LEN;
+		n = (len + bufsz - 1) / bufsz;
+
+		DPRINTF("packet read %d bytes, %d segs, head %d\r\n",
+		    len, n, head);
+
+		/* Apply VLAN filter. */
+		tp = (uint16_t *)vec[0].iov_base + 6;
+		if ((sc->esc_RCTL & E1000_RCTL_VFE) &&
+		    (ntohs(tp[0]) == sc->esc_VET)) {
+			tag = ntohs(tp[1]) & 0x0fff;
+			if ((sc->esc_fvlan[tag >> 5] &
+			    (1 << (tag & 0x1f))) != 0) {
+				DPRINTF("known VLAN %d\r\n", tag);
+			} else {
+				DPRINTF("unknown VLAN %d\r\n", tag);
+				n = 0;
+				continue;
+			}
+		}
+
+		/* Update all consumed descriptors. */
+		for (i = 0; i < n - 1; i++) {
+			rxd = &sc->esc_rxdesc[(head + i) % size];
+			rxd->length = bufsz;
+			rxd->csum = 0;
+			rxd->errors = 0;
+			rxd->special = 0;
+			rxd->status = E1000_RXD_STAT_DD;
+		}
+		rxd = &sc->esc_rxdesc[(head + i) % size];
+		rxd->length = len % bufsz;
+		rxd->csum = 0;
+		rxd->errors = 0;
+		rxd->special = 0;
+		/* XXX signal no checksum for now */
+		rxd->status = E1000_RXD_STAT_PIF | E1000_RXD_STAT_IXSM |
+		    E1000_RXD_STAT_EOP | E1000_RXD_STAT_DD;
+
+		/* Schedule receive interrupts. */
+		if (len <= sc->esc_RSRPD) {
+			cause |= E1000_ICR_SRPD | E1000_ICR_RXT0;
+		} else {
+			/* XXX: RDRT and RADV timers should be here. */
+			cause |= E1000_ICR_RXT0;
+		}
+
+		head = (head + n) % size;
+		left -= n;
+	}
+
+done:
+	pthread_mutex_lock(&sc->esc_mtx);
+	sc->esc_rx_active = 0;
+	if (sc->esc_rx_enabled == 0)
+		pthread_cond_signal(&sc->esc_rx_cond);
+
+	sc->esc_RDH = head;
+	/* Respect E1000_RCTL_RDMTS */
+	left = (size + sc->esc_RDT - head) % size;
+	if (left < (size >> (((sc->esc_RCTL >> 8) & 3) + 1)))
+		cause |= E1000_ICR_RXDMT0;
+	/* Assert all accumulated interrupts. */
+	if (cause != 0)
+		e82545_icr_assert(sc, cause);
+done1:
+	DPRINTF("rx_run done: head %x, tail %x\r\n", sc->esc_RDH, sc->esc_RDT);
+	pthread_mutex_unlock(&sc->esc_mtx);
+}
+#endif
+
+static uint16_t
+e82545_carry(uint32_t sum)
+{
+
+	sum = (sum & 0xFFFF) + (sum >> 16);
+	if (sum > 0xFFFF)
+		sum -= 0xFFFF;
+	return (sum);
+}
+
+static uint16_t
+#ifdef __FreeBSD__
+e82545_buf_checksum(uint8_t *buf, int len)
+#else
+e82545_buf_checksum(caddr_t buf, int len)
+#endif
+{
+	int i;
+	uint32_t sum = 0;
+
+	/* Checksum all the pairs of bytes first... */
+	for (i = 0; i < (len & ~1U); i += 2)
+		sum += *((u_int16_t *)(buf + i));
+
+	/*
+	 * If there's a single byte left over, checksum it, too.
+	 * Network byte order is big-endian, so the remaining byte is
+	 * the high byte.
+	 */
+	if (i < len)
+		sum += htons(buf[i] << 8);
+
+	return (e82545_carry(sum));
+}
+
+static uint16_t
+e82545_iov_checksum(struct iovec *iov, int iovcnt, int off, int len)
+{
+	int now, odd;
+	uint32_t sum = 0, s;
+
+	/* Skip completely unneeded vectors. */
+	while (iovcnt > 0 && iov->iov_len <= off && off > 0) {
+		off -= iov->iov_len;
+		iov++;
+		iovcnt--;
+	}
+
+	/* Calculate checksum of requested range. */
+	odd = 0;
+	while (len > 0 && iovcnt > 0) {
+		now = MIN(len, iov->iov_len - off);
+		s = e82545_buf_checksum(iov->iov_base + off, now);
+		sum += odd ? (s << 8) : s;
+		odd ^= (now & 1);
+		len -= now;
+		off = 0;
+		iov++;
+		iovcnt--;
+	}
+
+	return (e82545_carry(sum));
+}
+
+/*
+ * Return the transmit descriptor type.
+ */
+int
+e82545_txdesc_type(uint32_t lower)
+{
+	int type;
+
+	type = 0;
+	
+	if (lower & E1000_TXD_CMD_DEXT)
+		type = lower & E1000_TXD_MASK;
+
+	return (type);
+}
+
+static void
+e82545_transmit_checksum(struct iovec *iov, int iovcnt, struct ck_info *ck)
+{
+	uint16_t cksum;
+	int cklen;
+
+	DPRINTF("tx cksum: iovcnt/s/off/len %d/%d/%d/%d\r\n",
+	    iovcnt, ck->ck_start, ck->ck_off, ck->ck_len);
+	cklen = ck->ck_len ? ck->ck_len - ck->ck_start + 1 : INT_MAX;
+	cksum = e82545_iov_checksum(iov, iovcnt, ck->ck_start, cklen);
+	*(uint16_t *)((uint8_t *)iov[0].iov_base + ck->ck_off) = ~cksum;
+}
+
+static void
+e82545_transmit_backend(struct e82545_softc *sc, struct iovec *iov, int iovcnt)
+{
+
+	if (sc->esc_tapfd == -1)
+		return;
+
+	(void) writev(sc->esc_tapfd, iov, iovcnt);
+}
+
+static void
+e82545_transmit_done(struct e82545_softc *sc, uint16_t head, uint16_t tail,
+    uint16_t dsize, int *tdwb)
+{
+	union e1000_tx_udesc *dsc;
+
+	for ( ; head != tail; head = (head + 1) % dsize) {
+		dsc = &sc->esc_txdesc[head];
+		if (dsc->td.lower.data & E1000_TXD_CMD_RS) {
+			dsc->td.upper.data |= E1000_TXD_STAT_DD;
+			*tdwb = 1;
+		}
+	}
+}
+
+static int
+e82545_transmit(struct e82545_softc *sc, uint16_t head, uint16_t tail,
+    uint16_t dsize, uint16_t *rhead, int *tdwb)
+{
+#ifdef	__FreeBSD__
+	uint8_t *hdr, *hdrp;
+#else
+	caddr_t hdr, hdrp;
+#endif
+	struct iovec iovb[I82545_MAX_TXSEGS + 2];
+	struct iovec tiov[I82545_MAX_TXSEGS + 2];
+	struct e1000_context_desc *cd;
+	struct ck_info ckinfo[2];
+	struct iovec *iov;
+	union  e1000_tx_udesc *dsc;
+	int desc, dtype, len, ntype, iovcnt, tlen, hdrlen, vlen, tcp, tso;
+	int mss, paylen, seg, tiovcnt, left, now, nleft, nnow, pv, pvoff;
+	uint32_t tcpsum, tcpseq;
+	uint16_t ipcs, tcpcs, ipid, ohead;
+
+	ckinfo[0].ck_valid = ckinfo[1].ck_valid = 0;
+	iovcnt = 0;
+	tlen = 0;
+	ntype = 0;
+	tso = 0;
+	ohead = head;
+	hdr = NULL;
+
+	/* iovb[0/1] may be used for writable copy of headers. */
+	iov = &iovb[2];
+
+	for (desc = 0; ; desc++, head = (head + 1) % dsize) {
+		if (head == tail) {
+			*rhead = head;
+			return (0);
+		}
+		dsc = &sc->esc_txdesc[head];
+		dtype = e82545_txdesc_type(dsc->td.lower.data);
+
+		if (desc == 0) {
+			switch (dtype) {
+			case E1000_TXD_TYP_C:
+				DPRINTF("tx ctxt desc idx %d: %016jx "
+				    "%08x%08x\r\n",
+				    head, dsc->td.buffer_addr,
+				    dsc->td.upper.data, dsc->td.lower.data);
+				/* Save context and return */
+				sc->esc_txctx = dsc->cd;
+				goto done;
+			case E1000_TXD_TYP_L:
+				DPRINTF("tx legacy desc idx %d: %08x%08x\r\n",
+				    head, dsc->td.upper.data, dsc->td.lower.data);
+				/*
+				 * legacy cksum start valid in first descriptor
+				 */
+				ntype = dtype;
+				ckinfo[0].ck_start = dsc->td.upper.fields.css;
+				break;
+			case E1000_TXD_TYP_D:
+				DPRINTF("tx data desc idx %d: %08x%08x\r\n",
+				    head, dsc->td.upper.data, dsc->td.lower.data);
+				ntype = dtype;
+				break;
+			default:
+				break;
+			}
+		} else {
+			/* Descriptor type must be consistent */
+			assert(dtype == ntype);
+			DPRINTF("tx next desc idx %d: %08x%08x\r\n",
+			    head, dsc->td.upper.data, dsc->td.lower.data);
+		}
+
+		len = (dtype == E1000_TXD_TYP_L) ? dsc->td.lower.flags.length :
+		    dsc->dd.lower.data & 0xFFFFF;
+
+		if (len > 0) {
+			/* Strip checksum supplied by guest. */
+			if ((dsc->td.lower.data & E1000_TXD_CMD_EOP) != 0 &&
+			    (dsc->td.lower.data & E1000_TXD_CMD_IFCS) == 0)
+				len -= 2;
+			tlen += len;
+			if (iovcnt < I82545_MAX_TXSEGS) {
+				iov[iovcnt].iov_base = paddr_guest2host(
+				    sc->esc_ctx, dsc->td.buffer_addr, len);
+				iov[iovcnt].iov_len = len;
+			}
+			iovcnt++;
+		}
+
+		/*
+		 * Pull out info that is valid in the final descriptor
+		 * and exit descriptor loop.
+		 */
+		if (dsc->td.lower.data & E1000_TXD_CMD_EOP) {
+			if (dtype == E1000_TXD_TYP_L) {
+				if (dsc->td.lower.data & E1000_TXD_CMD_IC) {
+					ckinfo[0].ck_valid = 1;
+					ckinfo[0].ck_off =
+					    dsc->td.lower.flags.cso;
+					ckinfo[0].ck_len = 0;
+				}
+			} else {
+				cd = &sc->esc_txctx;
+				if (dsc->dd.lower.data & E1000_TXD_CMD_TSE)
+					tso = 1;
+				if (dsc->dd.upper.fields.popts &
+				    E1000_TXD_POPTS_IXSM)
+					ckinfo[0].ck_valid = 1;
+				if (dsc->dd.upper.fields.popts &
+				    E1000_TXD_POPTS_IXSM || tso) {
+					ckinfo[0].ck_start =
+					    cd->lower_setup.ip_fields.ipcss;
+					ckinfo[0].ck_off =
+					    cd->lower_setup.ip_fields.ipcso;
+					ckinfo[0].ck_len =
+					    cd->lower_setup.ip_fields.ipcse;
+				}
+				if (dsc->dd.upper.fields.popts &
+				    E1000_TXD_POPTS_TXSM)
+					ckinfo[1].ck_valid = 1;
+				if (dsc->dd.upper.fields.popts &
+				    E1000_TXD_POPTS_TXSM || tso) {
+					ckinfo[1].ck_start =
+					    cd->upper_setup.tcp_fields.tucss;
+					ckinfo[1].ck_off =
+					    cd->upper_setup.tcp_fields.tucso;
+					ckinfo[1].ck_len =
+					    cd->upper_setup.tcp_fields.tucse;
+				}
+			}
+			break;
+		}
+	}
+
+	if (iovcnt > I82545_MAX_TXSEGS) {
+		WPRINTF("tx too many descriptors (%d > %d) -- dropped\r\n",
+		    iovcnt, I82545_MAX_TXSEGS);
+		goto done;
+	}
+
+	hdrlen = vlen = 0;
+	/* Estimate writable space for VLAN header insertion. */
+	if ((sc->esc_CTRL & E1000_CTRL_VME) &&
+	    (dsc->td.lower.data & E1000_TXD_CMD_VLE)) {
+		hdrlen = ETHER_ADDR_LEN*2;
+		vlen = ETHER_VLAN_ENCAP_LEN;
+	}
+	if (!tso) {
+		/* Estimate required writable space for checksums. */
+		if (ckinfo[0].ck_valid)
+			hdrlen = MAX(hdrlen, ckinfo[0].ck_off + 2);
+		if (ckinfo[1].ck_valid)
+			hdrlen = MAX(hdrlen, ckinfo[1].ck_off + 2);
+		/* Round up writable space to the first vector. */
+		if (hdrlen != 0 && iov[0].iov_len > hdrlen &&
+		    iov[0].iov_len < hdrlen + 100)
+			hdrlen = iov[0].iov_len;
+	} else {
+		/* In case of TSO header length provided by software. */
+		hdrlen = sc->esc_txctx.tcp_seg_setup.fields.hdr_len;
+	}
+
+	/* Allocate, fill and prepend writable header vector. */
+	if (hdrlen != 0) {
+		hdr = __builtin_alloca(hdrlen + vlen);
+		hdr += vlen;
+		for (left = hdrlen, hdrp = hdr; left > 0;
+		    left -= now, hdrp += now) {
+			now = MIN(left, iov->iov_len);
+			memcpy(hdrp, iov->iov_base, now);
+			iov->iov_base += now;
+			iov->iov_len -= now;
+			if (iov->iov_len == 0) {
+				iov++;
+				iovcnt--;
+			}
+		}
+		iov--;
+		iovcnt++;
+		iov->iov_base = hdr;
+		iov->iov_len = hdrlen;
+	}
+
+	/* Insert VLAN tag. */
+	if (vlen != 0) {
+		hdr -= ETHER_VLAN_ENCAP_LEN;
+		memmove(hdr, hdr + ETHER_VLAN_ENCAP_LEN, ETHER_ADDR_LEN*2);
+		hdrlen += ETHER_VLAN_ENCAP_LEN;
+		hdr[ETHER_ADDR_LEN*2 + 0] = sc->esc_VET >> 8;
+		hdr[ETHER_ADDR_LEN*2 + 1] = sc->esc_VET & 0xff;
+		hdr[ETHER_ADDR_LEN*2 + 2] = dsc->td.upper.fields.special >> 8;
+		hdr[ETHER_ADDR_LEN*2 + 3] = dsc->td.upper.fields.special & 0xff;
+		iov->iov_base = hdr;
+		iov->iov_len += ETHER_VLAN_ENCAP_LEN;
+		/* Correct checksum offsets after VLAN tag insertion. */
+		ckinfo[0].ck_start += ETHER_VLAN_ENCAP_LEN;
+		ckinfo[0].ck_off += ETHER_VLAN_ENCAP_LEN;
+		if (ckinfo[0].ck_len != 0)
+			ckinfo[0].ck_len += ETHER_VLAN_ENCAP_LEN;
+		ckinfo[1].ck_start += ETHER_VLAN_ENCAP_LEN;
+		ckinfo[1].ck_off += ETHER_VLAN_ENCAP_LEN;
+		if (ckinfo[1].ck_len != 0)
+			ckinfo[1].ck_len += ETHER_VLAN_ENCAP_LEN;
+	}
+
+	/* Simple non-TSO case. */
+	if (!tso) {
+		/* Calculate checksums and transmit. */
+		if (ckinfo[0].ck_valid)
+			e82545_transmit_checksum(iov, iovcnt, &ckinfo[0]);
+		if (ckinfo[1].ck_valid)
+			e82545_transmit_checksum(iov, iovcnt, &ckinfo[1]);
+		e82545_transmit_backend(sc, iov, iovcnt);
+		goto done;
+	}
+
+	/* Doing TSO. */
+	tcp = (sc->esc_txctx.cmd_and_length & E1000_TXD_CMD_TCP) != 0;
+	mss = sc->esc_txctx.tcp_seg_setup.fields.mss;
+	paylen = (sc->esc_txctx.cmd_and_length & 0x000fffff);
+	DPRINTF("tx %s segmentation offload %d+%d/%d bytes %d iovs\r\n",
+	    tcp ? "TCP" : "UDP", hdrlen, paylen, mss, iovcnt);
+	ipid = ntohs(*(uint16_t *)&hdr[ckinfo[0].ck_start + 4]);
+	tcpseq = ntohl(*(uint32_t *)&hdr[ckinfo[1].ck_start + 4]);
+	ipcs = *(uint16_t *)&hdr[ckinfo[0].ck_off];
+	tcpcs = 0;
+	if (ckinfo[1].ck_valid)	/* Save partial pseudo-header checksum. */
+		tcpcs = *(uint16_t *)&hdr[ckinfo[1].ck_off];
+	pv = 1;
+	pvoff = 0;
+	for (seg = 0, left = paylen; left > 0; seg++, left -= now) {
+		now = MIN(left, mss);
+
+		/* Construct IOVs for the segment. */
+		/* Include whole original header. */
+		tiov[0].iov_base = hdr;
+		tiov[0].iov_len = hdrlen;
+		tiovcnt = 1;
+		/* Include respective part of payload IOV. */
+		for (nleft = now; pv < iovcnt && nleft > 0; nleft -= nnow) {
+			nnow = MIN(nleft, iov[pv].iov_len - pvoff);
+			tiov[tiovcnt].iov_base = iov[pv].iov_base + pvoff;
+			tiov[tiovcnt++].iov_len = nnow;
+			if (pvoff + nnow == iov[pv].iov_len) {
+				pv++;
+				pvoff = 0;
+			} else
+				pvoff += nnow;
+		}
+		DPRINTF("tx segment %d %d+%d bytes %d iovs\r\n",
+		    seg, hdrlen, now, tiovcnt);
+
+		/* Update IP header. */
+		if (sc->esc_txctx.cmd_and_length & E1000_TXD_CMD_IP) {
+			/* IPv4 -- set length and ID */
+			*(uint16_t *)&hdr[ckinfo[0].ck_start + 2] =
+			    htons(hdrlen - ckinfo[0].ck_start + now);
+			*(uint16_t *)&hdr[ckinfo[0].ck_start + 4] =
+			    htons(ipid + seg);
+		} else {
+			/* IPv6 -- set length */
+			*(uint16_t *)&hdr[ckinfo[0].ck_start + 4] =
+			    htons(hdrlen - ckinfo[0].ck_start - 40 +
+				  now);
+		}
+
+		/* Update pseudo-header checksum. */
+		tcpsum = tcpcs;
+		tcpsum += htons(hdrlen - ckinfo[1].ck_start + now);
+
+		/* Update TCP/UDP headers. */
+		if (tcp) {
+			/* Update sequence number and FIN/PUSH flags. */
+			*(uint32_t *)&hdr[ckinfo[1].ck_start + 4] =
+			    htonl(tcpseq + paylen - left);
+			if (now < left) {
+				hdr[ckinfo[1].ck_start + 13] &=
+				    ~(TH_FIN | TH_PUSH);
+			}
+		} else {
+			/* Update payload length. */
+			*(uint32_t *)&hdr[ckinfo[1].ck_start + 4] =
+			    hdrlen - ckinfo[1].ck_start + now;
+		}
+
+		/* Calculate checksums and transmit. */
+		if (ckinfo[0].ck_valid) {
+			*(uint16_t *)&hdr[ckinfo[0].ck_off] = ipcs;
+			e82545_transmit_checksum(tiov, tiovcnt, &ckinfo[0]);
+		}
+		if (ckinfo[1].ck_valid) {
+			*(uint16_t *)&hdr[ckinfo[1].ck_off] =
+			    e82545_carry(tcpsum);
+			e82545_transmit_checksum(tiov, tiovcnt, &ckinfo[1]);
+		}
+		e82545_transmit_backend(sc, tiov, tiovcnt);
+	}
+
+done:
+	head = (head + 1) % dsize;
+	e82545_transmit_done(sc, ohead, head, dsize, tdwb);
+
+	*rhead = head;
+	return (desc + 1);
+}
+
+static void
+e82545_tx_run(struct e82545_softc *sc)
+{
+	uint32_t cause;
+	uint16_t head, rhead, tail, size;
+	int lim, tdwb, sent;
+
+	head = sc->esc_TDH;
+	tail = sc->esc_TDT;
+	size = sc->esc_TDLEN / 16;
+	DPRINTF("tx_run: head %x, rhead %x, tail %x\r\n",
+	    sc->esc_TDH, sc->esc_TDHr, sc->esc_TDT);
+
+	pthread_mutex_unlock(&sc->esc_mtx);
+	rhead = head;
+	tdwb = 0;
+	for (lim = size / 4; sc->esc_tx_enabled && lim > 0; lim -= sent) {
+		sent = e82545_transmit(sc, head, tail, size, &rhead, &tdwb);
+		if (sent == 0)
+			break;
+		head = rhead;
+	}
+	pthread_mutex_lock(&sc->esc_mtx);
+
+	sc->esc_TDH = head;
+	sc->esc_TDHr = rhead;
+	cause = 0;
+	if (tdwb)
+		cause |= E1000_ICR_TXDW;
+	if (lim != size / 4 && sc->esc_TDH == sc->esc_TDT)
+		cause |= E1000_ICR_TXQE;
+	if (cause)
+		e82545_icr_assert(sc, cause);
+
+	DPRINTF("tx_run done: head %x, rhead %x, tail %x\r\n",
+	    sc->esc_TDH, sc->esc_TDHr, sc->esc_TDT);
+}
+
+static void *
+e82545_tx_thread(void *param)
+{
+	struct e82545_softc *sc = param;
+
+	pthread_mutex_lock(&sc->esc_mtx);
+	for (;;) {
+		while (!sc->esc_tx_enabled || sc->esc_TDHr == sc->esc_TDT) {
+			if (sc->esc_tx_enabled && sc->esc_TDHr != sc->esc_TDT)
+				break;
+			sc->esc_tx_active = 0;
+			if (sc->esc_tx_enabled == 0)
+				pthread_cond_signal(&sc->esc_tx_cond);
+			pthread_cond_wait(&sc->esc_tx_cond, &sc->esc_mtx);
+		}
+		sc->esc_tx_active = 1;
+
+		/* Process some tx descriptors.  Lock dropped inside. */
+		e82545_tx_run(sc);
+	}
+#ifndef	__FreeBSD__
+	return (NULL);
+#endif
+}
+
+static void
+e82545_tx_start(struct e82545_softc *sc)
+{
+
+	if (sc->esc_tx_active == 0)
+		pthread_cond_signal(&sc->esc_tx_cond);
+}
+
+static void
+e82545_tx_enable(struct e82545_softc *sc)
+{
+
+	sc->esc_tx_enabled = 1;
+}
+
+static void
+e82545_tx_disable(struct e82545_softc *sc)
+{
+
+	sc->esc_tx_enabled = 0;
+	while (sc->esc_tx_active)
+		pthread_cond_wait(&sc->esc_tx_cond, &sc->esc_mtx);
+}
+
+static void
+e82545_rx_enable(struct e82545_softc *sc)
+{
+
+	sc->esc_rx_enabled = 1;
+}
+
+static void
+e82545_rx_disable(struct e82545_softc *sc)
+{
+
+	sc->esc_rx_enabled = 0;
+	while (sc->esc_rx_active)
+		pthread_cond_wait(&sc->esc_rx_cond, &sc->esc_mtx);
+}
+
+static void
+e82545_write_ra(struct e82545_softc *sc, int reg, uint32_t wval)
+{
+        struct eth_uni *eu;
+	int idx;
+
+	idx = reg >> 1;
+	assert(idx < 15);
+
+	eu = &sc->esc_uni[idx];
+
+	if (reg & 0x1) {
+		/* RAH */
+		eu->eu_valid = ((wval & E1000_RAH_AV) == E1000_RAH_AV);
+		eu->eu_addrsel = (wval >> 16) & 0x3;
+		eu->eu_eth.octet[5] = wval >> 8;
+		eu->eu_eth.octet[4] = wval;
+	} else {
+		/* RAL */
+		eu->eu_eth.octet[3] = wval >> 24;
+		eu->eu_eth.octet[2] = wval >> 16;
+		eu->eu_eth.octet[1] = wval >> 8;
+		eu->eu_eth.octet[0] = wval;
+	}
+}
+
+static uint32_t
+e82545_read_ra(struct e82545_softc *sc, int reg)
+{
+        struct eth_uni *eu;
+	uint32_t retval;
+	int idx;
+
+	idx = reg >> 1;
+	assert(idx < 15);
+
+	eu = &sc->esc_uni[idx];
+
+	if (reg & 0x1) {
+		/* RAH */
+		retval = (eu->eu_valid << 31) |
+			 (eu->eu_addrsel << 16) |
+			 (eu->eu_eth.octet[5] << 8) |
+			 eu->eu_eth.octet[4];
+	} else {
+		/* RAL */
+		retval = (eu->eu_eth.octet[3] << 24) |
+			 (eu->eu_eth.octet[2] << 16) |
+			 (eu->eu_eth.octet[1] << 8) |
+			 eu->eu_eth.octet[0];
+	}
+
+	return (retval);	
+}
+
+static void
+e82545_write_register(struct e82545_softc *sc, uint32_t offset, uint32_t value)
+{
+	int ridx;
+	
+	if (offset & 0x3) {
+		DPRINTF("Unaligned register write offset:0x%x value:0x%x\r\n", offset, value);
+		return;
+	}
+	DPRINTF("Register write: 0x%x value: 0x%x\r\n", offset, value);
+
+	switch (offset) {
+	case E1000_CTRL:
+	case E1000_CTRL_DUP:
+		e82545_devctl(sc, value);
+		break;
+	case E1000_FCAL:
+		sc->esc_FCAL = value;
+		break;
+	case E1000_FCAH:
+		sc->esc_FCAH = value & ~0xFFFF0000;
+		break;
+	case E1000_FCT:
+		sc->esc_FCT = value & ~0xFFFF0000;
+		break;
+	case E1000_VET:
+		sc->esc_VET = value & ~0xFFFF0000;
+		break;
+	case E1000_FCTTV:
+		sc->esc_FCTTV = value & ~0xFFFF0000;
+		break;
+	case E1000_LEDCTL:
+		sc->esc_LEDCTL = value & ~0x30303000;
+		break;
+	case E1000_PBA:
+		sc->esc_PBA = value & 0x0000FF80;
+		break;
+	case E1000_ICR:
+	case E1000_ITR:
+	case E1000_ICS:
+	case E1000_IMS:
+	case E1000_IMC:
+		e82545_intr_write(sc, offset, value);
+		break;
+	case E1000_RCTL:
+		e82545_rx_ctl(sc, value);
+		break;
+	case E1000_FCRTL:
+		sc->esc_FCRTL = value & ~0xFFFF0007;
+		break;
+	case E1000_FCRTH:
+		sc->esc_FCRTH = value & ~0xFFFF0007;
+		break;
+	case E1000_RDBAL(0):
+		sc->esc_RDBAL = value & ~0xF;
+		if (sc->esc_rx_enabled) {
+			/* Apparently legal: update cached address */
+			e82545_rx_update_rdba(sc);
+		}
+		break;
+	case E1000_RDBAH(0):
+		assert(!sc->esc_rx_enabled);
+		sc->esc_RDBAH = value;
+		break;
+	case E1000_RDLEN(0):
+		assert(!sc->esc_rx_enabled);
+		sc->esc_RDLEN = value & ~0xFFF0007F;
+		break;
+	case E1000_RDH(0):
+		/* XXX should only ever be zero ? Range check ? */
+		sc->esc_RDH = value;
+		break;
+	case E1000_RDT(0):
+		/* XXX if this opens up the rx ring, do something ? */
+		sc->esc_RDT = value;
+		break;
+	case E1000_RDTR:
+		/* ignore FPD bit 31 */
+		sc->esc_RDTR = value & ~0xFFFF0000;
+		break;
+	case E1000_RXDCTL(0):
+		sc->esc_RXDCTL = value & ~0xFEC0C0C0;
+		break;
+	case E1000_RADV:
+		sc->esc_RADV = value & ~0xFFFF0000;
+		break;
+	case E1000_RSRPD:
+		sc->esc_RSRPD = value & ~0xFFFFF000;
+		break;
+	case E1000_RXCSUM:
+		sc->esc_RXCSUM = value & ~0xFFFFF800;
+		break;
+	case E1000_TXCW:
+		sc->esc_TXCW = value & ~0x3FFF0000;
+		break;
+	case E1000_TCTL:
+		e82545_tx_ctl(sc, value);
+		break;
+	case E1000_TIPG:
+		sc->esc_TIPG = value;
+		break;
+	case E1000_AIT:
+		sc->esc_AIT = value;
+		break;
+	case E1000_TDBAL(0):
+		sc->esc_TDBAL = value & ~0xF;
+		if (sc->esc_tx_enabled) {
+			/* Apparently legal */
+			e82545_tx_update_tdba(sc);
+		}
+		break;
+	case E1000_TDBAH(0):
+		//assert(!sc->esc_tx_enabled);		
+		sc->esc_TDBAH = value;
+		break;
+	case E1000_TDLEN(0):
+		//assert(!sc->esc_tx_enabled);
+		sc->esc_TDLEN = value & ~0xFFF0007F;
+		break;
+	case E1000_TDH(0):
+		//assert(!sc->esc_tx_enabled);
+		/* XXX should only ever be zero ? Range check ? */
+		sc->esc_TDHr = sc->esc_TDH = value;
+		break;
+	case E1000_TDT(0):
+		/* XXX range check ? */
+		sc->esc_TDT = value;
+		if (sc->esc_tx_enabled)
+			e82545_tx_start(sc);
+		break;
+	case E1000_TIDV:
+		sc->esc_TIDV = value & ~0xFFFF0000;
+		break;
+	case E1000_TXDCTL(0):
+		//assert(!sc->esc_tx_enabled);
+		sc->esc_TXDCTL = value & ~0xC0C0C0;
+		break;
+	case E1000_TADV:
+		sc->esc_TADV = value & ~0xFFFF0000;
+		break;
+	case E1000_RAL(0) ... E1000_RAH(15):
+		/* convert to u32 offset */
+		ridx = (offset - E1000_RAL(0)) >> 2;
+		e82545_write_ra(sc, ridx, value);
+		break;
+	case E1000_MTA ... (E1000_MTA + (127*4)):
+		sc->esc_fmcast[(offset - E1000_MTA) >> 2] = value;
+		break;
+	case E1000_VFTA ... (E1000_VFTA + (127*4)):
+		sc->esc_fvlan[(offset - E1000_VFTA) >> 2] = value;
+		break;		
+	case E1000_EECD:
+	{
+		//DPRINTF("EECD write 0x%x -> 0x%x\r\n", sc->eeprom_control, value);
+		/* edge triggered low->high */
+		uint32_t eecd_strobe = ((sc->eeprom_control & E1000_EECD_SK) ?
+			0 : (value & E1000_EECD_SK));
+		uint32_t eecd_mask = (E1000_EECD_SK|E1000_EECD_CS|
+					E1000_EECD_DI|E1000_EECD_REQ);
+		sc->eeprom_control &= ~eecd_mask;
+		sc->eeprom_control |= (value & eecd_mask);
+		/* grant/revoke immediately */
+		if (value & E1000_EECD_REQ) {
+			sc->eeprom_control |= E1000_EECD_GNT;
+		} else {
+                        sc->eeprom_control &= ~E1000_EECD_GNT;
+		}
+		if (eecd_strobe && (sc->eeprom_control & E1000_EECD_CS)) {
+			e82545_eecd_strobe(sc);
+		}
+		return;
+	}
+	case E1000_MDIC:
+	{
+		uint8_t reg_addr = (uint8_t)((value & E1000_MDIC_REG_MASK) >>
+						E1000_MDIC_REG_SHIFT);
+		uint8_t phy_addr = (uint8_t)((value & E1000_MDIC_PHY_MASK) >>
+						E1000_MDIC_PHY_SHIFT);
+		sc->mdi_control =
+			(value & ~(E1000_MDIC_ERROR|E1000_MDIC_DEST));
+		if ((value & E1000_MDIC_READY) != 0) {
+			DPRINTF("Incorrect MDIC ready bit: 0x%x\r\n", value);
+			return;
+		}
+		switch (value & E82545_MDIC_OP_MASK) {
+		case E1000_MDIC_OP_READ:
+			sc->mdi_control &= ~E82545_MDIC_DATA_MASK;
+			sc->mdi_control |= e82545_read_mdi(sc, reg_addr, phy_addr);
+			break;
+		case E1000_MDIC_OP_WRITE:
+			e82545_write_mdi(sc, reg_addr, phy_addr,
+				value & E82545_MDIC_DATA_MASK);
+			break;
+		default:
+			DPRINTF("Unknown MDIC op: 0x%x\r\n", value);
+			return;
+		}
+		/* TODO: barrier? */
+		sc->mdi_control |= E1000_MDIC_READY;
+		if (value & E82545_MDIC_IE) {
+			// TODO: generate interrupt
+		}
+		return;
+	}
+	case E1000_MANC:
+	case E1000_STATUS: 
+		return;
+	default:
+		DPRINTF("Unknown write register: 0x%x value:%x\r\n", offset, value);
+		return;
+	}
+}
+
+static uint32_t
+e82545_read_register(struct e82545_softc *sc, uint32_t offset)
+{
+	uint32_t retval;
+	int ridx;
+	
+	if (offset & 0x3) {
+		DPRINTF("Unaligned register read offset:0x%x\r\n", offset);
+		return 0;
+	}
+		
+	DPRINTF("Register read: 0x%x\r\n", offset);
+
+	switch (offset) {
+	case E1000_CTRL:
+		retval = sc->esc_CTRL;
+		break;
+	case E1000_STATUS:
+		retval = E1000_STATUS_FD | E1000_STATUS_LU |
+		    E1000_STATUS_SPEED_1000;
+		break;
+	case E1000_FCAL:
+		retval = sc->esc_FCAL;
+		break;
+	case E1000_FCAH:
+		retval = sc->esc_FCAH;
+		break;
+	case E1000_FCT:
+		retval = sc->esc_FCT;
+		break;
+	case E1000_VET:
+		retval = sc->esc_VET;
+		break;
+	case E1000_FCTTV:
+		retval = sc->esc_FCTTV;
+		break;
+	case E1000_LEDCTL:
+		retval = sc->esc_LEDCTL;
+		break;
+	case E1000_PBA:
+		retval = sc->esc_PBA;
+		break;
+	case E1000_ICR:
+	case E1000_ITR:
+	case E1000_ICS:
+	case E1000_IMS:
+	case E1000_IMC:
+		retval = e82545_intr_read(sc, offset);
+		break;
+	case E1000_RCTL:
+		retval = sc->esc_RCTL;
+		break;
+	case E1000_FCRTL:
+		retval = sc->esc_FCRTL;
+		break;
+	case E1000_FCRTH:
+		retval = sc->esc_FCRTH;
+		break;
+	case E1000_RDBAL(0):
+		retval = sc->esc_RDBAL;
+		break;
+	case E1000_RDBAH(0):
+		retval = sc->esc_RDBAH;
+		break;
+	case E1000_RDLEN(0):
+		retval = sc->esc_RDLEN;
+		break;
+	case E1000_RDH(0):
+		retval = sc->esc_RDH;
+		break;
+	case E1000_RDT(0):
+		retval = sc->esc_RDT;
+		break;
+	case E1000_RDTR:
+		retval = sc->esc_RDTR;
+		break;
+	case E1000_RXDCTL(0):
+		retval = sc->esc_RXDCTL;
+		break;
+	case E1000_RADV:
+		retval = sc->esc_RADV;
+		break;
+	case E1000_RSRPD:
+		retval = sc->esc_RSRPD;
+		break;
+	case E1000_RXCSUM:	       
+		retval = sc->esc_RXCSUM;
+		break;
+	case E1000_TXCW:
+		retval = sc->esc_TXCW;
+		break;
+	case E1000_TCTL:
+		retval = sc->esc_TCTL;
+		break;
+	case E1000_TIPG:
+		retval = sc->esc_TIPG;
+		break;
+	case E1000_AIT:
+		retval = sc->esc_AIT;
+		break;
+	case E1000_TDBAL(0):
+		retval = sc->esc_TDBAL;
+		break;
+	case E1000_TDBAH(0):
+		retval = sc->esc_TDBAH;
+		break;
+	case E1000_TDLEN(0):
+		retval = sc->esc_TDLEN;
+		break;
+	case E1000_TDH(0):
+		retval = sc->esc_TDH;
+		break;
+	case E1000_TDT(0):
+		retval = sc->esc_TDT;
+		break;
+	case E1000_TIDV:
+		retval = sc->esc_TIDV;
+		break;
+	case E1000_TXDCTL(0):
+		retval = sc->esc_TXDCTL;
+		break;
+	case E1000_TADV:
+		retval = sc->esc_TADV;
+		break;
+	case E1000_RAL(0) ... E1000_RAH(15):
+		/* convert to u32 offset */
+		ridx = (offset - E1000_RAL(0)) >> 2;
+		retval = e82545_read_ra(sc, ridx);
+		break;
+	case E1000_MTA ... (E1000_MTA + (127*4)):
+		retval = sc->esc_fmcast[(offset - E1000_MTA) >> 2];
+		break;
+	case E1000_VFTA ... (E1000_VFTA + (127*4)):
+		retval = sc->esc_fvlan[(offset - E1000_VFTA) >> 2];
+		break;		
+	case E1000_EECD:
+		//DPRINTF("EECD read %x\r\n", sc->eeprom_control);
+		retval = sc->eeprom_control;
+		break;
+	case E1000_MDIC:
+		retval = sc->mdi_control;
+		break;
+	case E1000_MANC:
+		retval = 0;
+		break;
+	/* stats that we emulate. */
+	case E1000_MPC:
+		retval = sc->missed_pkt_count;
+		break;
+	case E1000_PRC64:
+		retval = sc->pkt_rx_by_size[0];
+		break;
+	case E1000_PRC127:
+		retval = sc->pkt_rx_by_size[1];
+		break;
+	case E1000_PRC255:
+		retval = sc->pkt_rx_by_size[2];
+		break;
+	case E1000_PRC511:
+		retval = sc->pkt_rx_by_size[3];
+		break;
+	case E1000_PRC1023:
+		retval = sc->pkt_rx_by_size[4];
+		break;
+	case E1000_PRC1522:
+		retval = sc->pkt_rx_by_size[5];
+		break;
+	case E1000_GPRC:
+		retval = sc->good_pkt_rx_count;
+		break;
+	case E1000_BPRC:
+		retval = sc->bcast_pkt_rx_count;
+		break;
+	case E1000_MPRC:
+		retval = sc->mcast_pkt_rx_count;
+		break;
+	case E1000_GPTC:
+	case E1000_TPT:
+		retval = sc->good_pkt_tx_count;
+		break;
+	case E1000_GORCL:
+		retval = (uint32_t)sc->good_octets_rx;
+		break;
+	case E1000_GORCH:
+		retval = (uint32_t)(sc->good_octets_rx >> 32);
+		break;
+	case E1000_TOTL:
+	case E1000_GOTCL:
+		retval = (uint32_t)sc->good_octets_tx;
+		break;
+	case E1000_TOTH:
+	case E1000_GOTCH:
+		retval = (uint32_t)(sc->good_octets_tx >> 32);
+		break;
+	case E1000_ROC:
+		retval = sc->oversize_rx_count;
+		break;
+	case E1000_TORL:
+		retval = (uint32_t)(sc->good_octets_rx + sc->missed_octets);
+		break;
+	case E1000_TORH:
+		retval = (uint32_t)((sc->good_octets_rx +
+		    sc->missed_octets) >> 32);
+		break;
+	case E1000_TPR:
+		retval = sc->good_pkt_rx_count + sc->missed_pkt_count +
+		    sc->oversize_rx_count;
+		break;
+	case E1000_PTC64:
+		retval = sc->pkt_tx_by_size[0];
+		break;
+	case E1000_PTC127:
+		retval = sc->pkt_tx_by_size[1];
+		break;
+	case E1000_PTC255:
+		retval = sc->pkt_tx_by_size[2];
+		break;
+	case E1000_PTC511:
+		retval = sc->pkt_tx_by_size[3];
+		break;
+	case E1000_PTC1023:
+		retval = sc->pkt_tx_by_size[4];
+		break;
+	case E1000_PTC1522:
+		retval = sc->pkt_tx_by_size[5];
+		break;
+	case E1000_MPTC:
+		retval = sc->mcast_pkt_tx_count;
+		break;
+	case E1000_BPTC:
+		retval = sc->bcast_pkt_tx_count;
+		break;
+	case E1000_TSCTC:
+		retval = sc->tso_tx_count;
+		break;
+	/* stats that are always 0. */
+	case E1000_CRCERRS:
+	case E1000_ALGNERRC:
+	case E1000_SYMERRS:
+	case E1000_RXERRC:
+	case E1000_SCC:
+	case E1000_ECOL:
+	case E1000_MCC:
+	case E1000_LATECOL:
+	case E1000_COLC:
+	case E1000_DC:
+	case E1000_TNCRS:
+	case E1000_SEC:
+	case E1000_CEXTERR:
+	case E1000_RLEC:
+	case E1000_XONRXC:
+	case E1000_XONTXC:
+	case E1000_XOFFRXC:
+	case E1000_XOFFTXC:
+	case E1000_FCRUC:
+	case E1000_RNBC:
+	case E1000_RUC:
+	case E1000_RFC:
+	case E1000_RJC:
+	case E1000_MGTPRC:
+	case E1000_MGTPDC:
+	case E1000_MGTPTC:
+	case E1000_TSCTFC:
+		retval = 0;
+		break;
+	default:
+		DPRINTF("Unknown read register: 0x%x\r\n", offset);
+		retval = 0;
+		break;
+	}
+
+	return (retval);
+}
+
+static void
+e82545_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+	     uint64_t offset, int size, uint64_t value)
+{
+	struct e82545_softc *sc;
+
+	//DPRINTF("Write bar:%d offset:0x%lx value:0x%lx size:%d\r\n", baridx, offset, value, size);
+
+	sc = pi->pi_arg;
+
+	pthread_mutex_lock(&sc->esc_mtx);
+
+	switch (baridx) {
+	case E82545_BAR_IO:
+		switch (offset) {
+		case E82545_IOADDR:
+			if (size != 4) {
+				DPRINTF("Wrong io addr write sz:%d value:0x%lx\r\n", size, value);
+			} else
+				sc->io_addr = (uint32_t)value;
+			break;
+		case E82545_IODATA:
+			if (size != 4) {
+				DPRINTF("Wrong io data write size:%d value:0x%lx\r\n", size, value);
+			} else if (sc->io_addr > E82545_IO_REGISTER_MAX) {
+				DPRINTF("Non-register io write addr:0x%x value:0x%lx\r\n", sc->io_addr, value);
+			} else
+				e82545_write_register(sc, sc->io_addr,
+						      (uint32_t)value);
+			break;
+		default:
+			DPRINTF("Unknown io bar write offset:0x%lx value:0x%lx size:%d\r\n", offset, value, size);
+			break;
+		}
+		break;
+	case E82545_BAR_REGISTER:
+		if (size != 4) {
+			DPRINTF("Wrong register write size:%d offset:0x%lx value:0x%lx\r\n", size, offset, value);
+		} else
+			e82545_write_register(sc, (uint32_t)offset,
+					      (uint32_t)value);
+		break;
+	default:
+		DPRINTF("Unknown write bar:%d off:0x%lx val:0x%lx size:%d\r\n",
+			baridx, offset, value, size);
+	}
+
+	pthread_mutex_unlock(&sc->esc_mtx);
+}
+
+static uint64_t
+e82545_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+	    uint64_t offset, int size)
+{
+	struct e82545_softc *sc;
+	uint64_t retval;
+	
+	//DPRINTF("Read  bar:%d offset:0x%lx size:%d\r\n", baridx, offset, size);
+	sc = pi->pi_arg;
+	retval = 0;
+
+	pthread_mutex_lock(&sc->esc_mtx);
+
+	switch (baridx) {
+	case E82545_BAR_IO:
+		switch (offset) {
+		case E82545_IOADDR:
+			if (size != 4) {
+				DPRINTF("Wrong io addr read sz:%d\r\n", size);
+			} else
+				retval = sc->io_addr;
+			break;
+		case E82545_IODATA:
+			if (size != 4) {
+				DPRINTF("Wrong io data read sz:%d\r\n", size);
+			}
+			if (sc->io_addr > E82545_IO_REGISTER_MAX) {
+				DPRINTF("Non-register io read addr:0x%x\r\n",
+					sc->io_addr);
+			} else
+				retval = e82545_read_register(sc, sc->io_addr);
+			break;
+		default:
+			DPRINTF("Unknown io bar read offset:0x%lx size:%d\r\n",
+				offset, size);
+			break;
+		}
+		break;
+	case E82545_BAR_REGISTER:
+		if (size != 4) {
+			DPRINTF("Wrong register read size:%d offset:0x%lx\r\n",
+				size, offset);
+		} else
+			retval = e82545_read_register(sc, (uint32_t)offset);
+		break;
+	default:
+		DPRINTF("Unknown read bar:%d offset:0x%lx size:%d\r\n",
+			baridx, offset, size);
+		break;
+	}
+
+	pthread_mutex_unlock(&sc->esc_mtx);
+
+	return (retval);
+}
+
+static void
+e82545_reset(struct e82545_softc *sc, int drvr)
+{
+	int i;
+
+	e82545_rx_disable(sc);
+	e82545_tx_disable(sc);
+
+	/* clear outstanding interrupts */
+	if (sc->esc_irq_asserted)
+		pci_lintr_deassert(sc->esc_pi);
+
+	/* misc */
+	if (!drvr) {
+		sc->esc_FCAL = 0;
+		sc->esc_FCAH = 0;
+		sc->esc_FCT = 0;
+		sc->esc_VET = 0;
+		sc->esc_FCTTV = 0;
+	}
+	sc->esc_LEDCTL = 0x07061302;
+	sc->esc_PBA = 0x00100030;
+	
+	/* start nvm in opcode mode. */
+	sc->nvm_opaddr = 0;
+	sc->nvm_mode = E82545_NVM_MODE_OPADDR;
+	sc->nvm_bits = E82545_NVM_OPADDR_BITS;
+	sc->eeprom_control = E1000_EECD_PRES | E82545_EECD_FWE_EN;
+	e82545_init_eeprom(sc);
+
+	/* interrupt */
+	sc->esc_ICR = 0;
+	sc->esc_ITR = 250;
+	sc->esc_ICS = 0;
+	sc->esc_IMS = 0;
+	sc->esc_IMC = 0;
+		
+	/* L2 filters */
+	if (!drvr) {
+		memset(sc->esc_fvlan, 0, sizeof(sc->esc_fvlan));
+		memset(sc->esc_fmcast, 0, sizeof(sc->esc_fmcast));
+		memset(sc->esc_uni, 0, sizeof(sc->esc_uni));
+
+		/* XXX not necessary on 82545 ?? */
+		sc->esc_uni[0].eu_valid = 1;
+		memcpy(sc->esc_uni[0].eu_eth.octet, sc->esc_mac.octet,
+		    ETHER_ADDR_LEN);
+	} else {
+		/* Clear RAH valid bits */
+		for (i = 0; i < 16; i++)
+			sc->esc_uni[i].eu_valid = 0;
+	}
+	
+	/* receive */
+	if (!drvr) {
+		sc->esc_RDBAL = 0;
+		sc->esc_RDBAH = 0;
+	}
+	sc->esc_RCTL = 0;
+	sc->esc_FCRTL = 0;
+	sc->esc_FCRTH = 0;
+	sc->esc_RDLEN = 0;
+	sc->esc_RDH = 0;
+	sc->esc_RDT = 0;
+	sc->esc_RDTR = 0;
+	sc->esc_RXDCTL = (1 << 24) | (1 << 16); /* default GRAN/WTHRESH */
+	sc->esc_RADV = 0;
+	sc->esc_RXCSUM = 0;
+
+	/* transmit */
+	if (!drvr) {
+		sc->esc_TDBAL = 0;
+		sc->esc_TDBAH = 0;
+		sc->esc_TIPG = 0;
+		sc->esc_AIT = 0;
+		sc->esc_TIDV = 0;
+		sc->esc_TADV = 0;
+	}
+	sc->esc_tdba = 0;
+	sc->esc_txdesc = NULL;
+	sc->esc_TXCW = 0;
+	sc->esc_TCTL = 0;
+	sc->esc_TDLEN = 0;
+	sc->esc_TDT = 0;
+	sc->esc_TDHr = sc->esc_TDH = 0;
+	sc->esc_TXDCTL = 0;
+}
+
+static void
+e82545_open_tap(struct e82545_softc *sc, char *opts)
+{
+	char tbuf[80];
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+#endif
+	
+	if (opts == NULL) {
+		sc->esc_tapfd = -1;
+		return;
+	}
+
+	strcpy(tbuf, "/dev/");
+	strlcat(tbuf, opts, sizeof(tbuf));
+
+	sc->esc_tapfd = open(tbuf, O_RDWR);
+	if (sc->esc_tapfd == -1) {
+		DPRINTF("unable to open tap device %s\n", opts);
+		exit(1);
+	}
+
+	/*
+	 * Set non-blocking and register for read
+	 * notifications with the event loop
+	 */
+	int opt = 1;
+	if (ioctl(sc->esc_tapfd, FIONBIO, &opt) < 0) {
+		WPRINTF("tap device O_NONBLOCK failed: %d\n", errno);
+		close(sc->esc_tapfd);
+		sc->esc_tapfd = -1;
+	}
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_EVENT, CAP_READ, CAP_WRITE);
+	if (cap_rights_limit(sc->esc_tapfd, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+	
+#ifdef	__FreeBSD__
+	sc->esc_mevp = mevent_add(sc->esc_tapfd,
+				  EVF_READ,
+				  e82545_tap_callback,
+				  sc);
+	if (sc->esc_mevp == NULL) {
+		DPRINTF("Could not register mevent %d\n", EVF_READ);
+		close(sc->esc_tapfd);
+		sc->esc_tapfd = -1;
+	}
+#endif
+}
+
+static int
+e82545_parsemac(char *mac_str, uint8_t *mac_addr)
+{
+	struct ether_addr *ea;
+	char *tmpstr;
+	char zero_addr[ETHER_ADDR_LEN] = { 0, 0, 0, 0, 0, 0 };
+
+	tmpstr = strsep(&mac_str,"=");
+	if ((mac_str != NULL) && (!strcmp(tmpstr,"mac"))) {
+		ea = ether_aton(mac_str);
+		if (ea == NULL || ETHER_IS_MULTICAST(ea->octet) ||
+		    memcmp(ea->octet, zero_addr, ETHER_ADDR_LEN) == 0) {
+			fprintf(stderr, "Invalid MAC %s\n", mac_str);
+			return (1);
+		} else
+			memcpy(mac_addr, ea->octet, ETHER_ADDR_LEN);
+	}
+	return (0);
+}
+
+static int
+e82545_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	DPRINTF("Loading with options: %s\r\n", opts);
+
+	MD5_CTX mdctx;
+	unsigned char digest[16];
+	char nstr[80];
+	struct e82545_softc *sc;
+	char *devname;
+	char *vtopts;
+	int mac_provided;
+
+	/* Setup our softc */
+	sc = calloc(1, sizeof(*sc));
+
+	pi->pi_arg = sc;
+	sc->esc_pi = pi;
+	sc->esc_ctx = ctx;
+
+	pthread_mutex_init(&sc->esc_mtx, NULL);
+	pthread_cond_init(&sc->esc_rx_cond, NULL);
+	pthread_cond_init(&sc->esc_tx_cond, NULL);
+	pthread_create(&sc->esc_tx_tid, NULL, e82545_tx_thread, sc);
+	snprintf(nstr, sizeof(nstr), "e82545-%d:%d tx", pi->pi_slot,
+	    pi->pi_func);
+        pthread_set_name_np(sc->esc_tx_tid, nstr);
+
+	pci_set_cfgdata16(pi, PCIR_DEVICE, E82545_DEV_ID_82545EM_COPPER);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, E82545_VENDOR_ID_INTEL);
+	pci_set_cfgdata8(pi,  PCIR_CLASS, PCIC_NETWORK);
+	pci_set_cfgdata8(pi, PCIR_SUBCLASS, PCIS_NETWORK_ETHERNET);
+	pci_set_cfgdata16(pi, PCIR_SUBDEV_0, E82545_SUBDEV_ID);
+	pci_set_cfgdata16(pi, PCIR_SUBVEND_0, E82545_VENDOR_ID_INTEL);
+
+	pci_set_cfgdata8(pi,  PCIR_HDRTYPE, PCIM_HDRTYPE_NORMAL);
+	pci_set_cfgdata8(pi,  PCIR_INTPIN, 0x1);
+	
+	/* TODO: this card also supports msi, but the freebsd driver for it
+	 * does not, so I have not implemented it. */
+	pci_lintr_request(pi);
+
+	pci_emul_alloc_bar(pi, E82545_BAR_REGISTER, PCIBAR_MEM32,
+		E82545_BAR_REGISTER_LEN);
+	pci_emul_alloc_bar(pi, E82545_BAR_FLASH, PCIBAR_MEM32,
+		E82545_BAR_FLASH_LEN);
+	pci_emul_alloc_bar(pi, E82545_BAR_IO, PCIBAR_IO,
+		E82545_BAR_IO_LEN);
+
+	/*
+	 * Attempt to open the tap device and read the MAC address
+	 * if specified.  Copied from virtio-net, slightly modified.
+	 */
+	mac_provided = 0;
+	sc->esc_tapfd = -1;
+	if (opts != NULL) {
+		int err;
+
+		devname = vtopts = strdup(opts);
+		(void) strsep(&vtopts, ",");
+
+		if (vtopts != NULL) {
+			err = e82545_parsemac(vtopts, sc->esc_mac.octet);
+			if (err != 0) {
+				free(devname);
+				return (err);
+			}
+			mac_provided = 1;
+		}
+
+		if (strncmp(devname, "tap", 3) == 0 ||
+		    strncmp(devname, "vmnet", 5) == 0)
+			e82545_open_tap(sc, devname);
+
+		free(devname);
+	}
+
+	/*
+	 * The default MAC address is the standard NetApp OUI of 00-a0-98,
+	 * followed by an MD5 of the PCI slot/func number and dev name
+	 */
+	if (!mac_provided) {
+		snprintf(nstr, sizeof(nstr), "%d-%d-%s", pi->pi_slot,
+		    pi->pi_func, vmname);
+
+		MD5Init(&mdctx);
+		MD5Update(&mdctx, nstr, strlen(nstr));
+		MD5Final(digest, &mdctx);
+
+		sc->esc_mac.octet[0] = 0x00;
+		sc->esc_mac.octet[1] = 0xa0;
+		sc->esc_mac.octet[2] = 0x98;
+		sc->esc_mac.octet[3] = digest[0];
+		sc->esc_mac.octet[4] = digest[1];
+		sc->esc_mac.octet[5] = digest[2];
+	}
+
+	/* H/w initiated reset */
+	e82545_reset(sc, 0);
+
+	return (0);
+}
+
+struct pci_devemu pci_de_e82545 = {
+	.pe_emu = 	"e1000",
+	.pe_init =	e82545_init,
+	.pe_barwrite =	e82545_write,
+	.pe_barread =	e82545_read
+};
+PCI_EMUL_SET(pci_de_e82545);
+
diff --git a/usr/src/cmd/bhyve/pci_emul.c b/usr/src/cmd/bhyve/pci_emul.c
new file mode 100644
index 0000000000..a35a830f7e
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_emul.c
@@ -0,0 +1,2126 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/linker_set.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdbool.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include "acpi.h"
+#include "bhyverun.h"
+#include "inout.h"
+#include "ioapic.h"
+#include "mem.h"
+#include "pci_emul.h"
+#include "pci_irq.h"
+#include "pci_lpc.h"
+
+#define CONF1_ADDR_PORT    0x0cf8
+#define CONF1_DATA_PORT    0x0cfc
+
+#define CONF1_ENABLE	   0x80000000ul
+
+#define	MAXBUSES	(PCI_BUSMAX + 1)
+#define MAXSLOTS	(PCI_SLOTMAX + 1)
+#define	MAXFUNCS	(PCI_FUNCMAX + 1)
+
+struct funcinfo {
+	char	*fi_name;
+	char	*fi_param;
+	struct pci_devinst *fi_devi;
+};
+
+struct intxinfo {
+	int	ii_count;
+	int	ii_pirq_pin;
+	int	ii_ioapic_irq;
+};
+
+struct slotinfo {
+	struct intxinfo si_intpins[4];
+	struct funcinfo si_funcs[MAXFUNCS];
+};
+
+struct businfo {
+	uint16_t iobase, iolimit;		/* I/O window */
+	uint32_t membase32, memlimit32;		/* mmio window below 4GB */
+	uint64_t membase64, memlimit64;		/* mmio window above 4GB */
+	struct slotinfo slotinfo[MAXSLOTS];
+};
+
+static struct businfo *pci_businfo[MAXBUSES];
+
+SET_DECLARE(pci_devemu_set, struct pci_devemu);
+
+static uint64_t pci_emul_iobase;
+static uint64_t pci_emul_membase32;
+static uint64_t pci_emul_membase64;
+
+#define	PCI_EMUL_IOBASE		0x2000
+#define	PCI_EMUL_IOLIMIT	0x10000
+
+#define	PCI_EMUL_ECFG_BASE	0xE0000000		    /* 3.5GB */
+#define	PCI_EMUL_ECFG_SIZE	(MAXBUSES * 1024 * 1024)    /* 1MB per bus */
+SYSRES_MEM(PCI_EMUL_ECFG_BASE, PCI_EMUL_ECFG_SIZE);
+
+#define	PCI_EMUL_MEMLIMIT32	PCI_EMUL_ECFG_BASE
+
+#define	PCI_EMUL_MEMBASE64	0xD000000000UL
+#define	PCI_EMUL_MEMLIMIT64	0xFD00000000UL
+
+static struct pci_devemu *pci_emul_finddev(char *name);
+static void pci_lintr_route(struct pci_devinst *pi);
+static void pci_lintr_update(struct pci_devinst *pi);
+static void pci_cfgrw(struct vmctx *ctx, int vcpu, int in, int bus, int slot,
+    int func, int coff, int bytes, uint32_t *val);
+
+static __inline void
+CFGWRITE(struct pci_devinst *pi, int coff, uint32_t val, int bytes)
+{
+
+	if (bytes == 1)
+		pci_set_cfgdata8(pi, coff, val);
+	else if (bytes == 2)
+		pci_set_cfgdata16(pi, coff, val);
+	else
+		pci_set_cfgdata32(pi, coff, val);
+}
+
+static __inline uint32_t
+CFGREAD(struct pci_devinst *pi, int coff, int bytes)
+{
+
+	if (bytes == 1)
+		return (pci_get_cfgdata8(pi, coff));
+	else if (bytes == 2)
+		return (pci_get_cfgdata16(pi, coff));
+	else
+		return (pci_get_cfgdata32(pi, coff));
+}
+
+/*
+ * I/O access
+ */
+
+/*
+ * Slot options are in the form:
+ *
+ *  <bus>:<slot>:<func>,<emul>[,<config>]
+ *  <slot>[:<func>],<emul>[,<config>]
+ *
+ *  slot is 0..31
+ *  func is 0..7
+ *  emul is a string describing the type of PCI device e.g. virtio-net
+ *  config is an optional string, depending on the device, that can be
+ *  used for configuration.
+ *   Examples are:
+ *     1,virtio-net,tap0
+ *     3:0,dummy
+ */
+static void
+pci_parse_slot_usage(char *aopt)
+{
+
+	fprintf(stderr, "Invalid PCI slot info field \"%s\"\n", aopt);
+}
+
+int
+pci_parse_slot(char *opt)
+{
+	struct businfo *bi;
+	struct slotinfo *si;
+	char *emul, *config, *str, *cp;
+	int error, bnum, snum, fnum;
+
+	error = -1;
+	str = strdup(opt);
+
+	emul = config = NULL;
+	if ((cp = strchr(str, ',')) != NULL) {
+		*cp = '\0';
+		emul = cp + 1;
+		if ((cp = strchr(emul, ',')) != NULL) {
+			*cp = '\0';
+			config = cp + 1;
+		}
+	} else {
+		pci_parse_slot_usage(opt);
+		goto done;
+	}
+
+	/* <bus>:<slot>:<func> */
+	if (sscanf(str, "%d:%d:%d", &bnum, &snum, &fnum) != 3) {
+		bnum = 0;
+		/* <slot>:<func> */
+		if (sscanf(str, "%d:%d", &snum, &fnum) != 2) {
+			fnum = 0;
+			/* <slot> */
+			if (sscanf(str, "%d", &snum) != 1) {
+				snum = -1;
+			}
+		}
+	}
+
+	if (bnum < 0 || bnum >= MAXBUSES || snum < 0 || snum >= MAXSLOTS ||
+	    fnum < 0 || fnum >= MAXFUNCS) {
+		pci_parse_slot_usage(opt);
+		goto done;
+	}
+
+	if (pci_businfo[bnum] == NULL)
+		pci_businfo[bnum] = calloc(1, sizeof(struct businfo));
+
+	bi = pci_businfo[bnum];
+	si = &bi->slotinfo[snum];
+
+	if (si->si_funcs[fnum].fi_name != NULL) {
+		fprintf(stderr, "pci slot %d:%d already occupied!\n",
+			snum, fnum);
+		goto done;
+	}
+
+	if (pci_emul_finddev(emul) == NULL) {
+		fprintf(stderr, "pci slot %d:%d: unknown device \"%s\"\n",
+			snum, fnum, emul);
+		goto done;
+	}
+
+	error = 0;
+	si->si_funcs[fnum].fi_name = emul;
+	si->si_funcs[fnum].fi_param = config;
+
+done:
+	if (error)
+		free(str);
+
+	return (error);
+}
+
+static int
+pci_valid_pba_offset(struct pci_devinst *pi, uint64_t offset)
+{
+
+	if (offset < pi->pi_msix.pba_offset)
+		return (0);
+
+	if (offset >= pi->pi_msix.pba_offset + pi->pi_msix.pba_size) {
+		return (0);
+	}
+
+	return (1);
+}
+
+int
+pci_emul_msix_twrite(struct pci_devinst *pi, uint64_t offset, int size,
+		     uint64_t value)
+{
+	int msix_entry_offset;
+	int tab_index;
+	char *dest;
+
+	/* support only 4 or 8 byte writes */
+	if (size != 4 && size != 8)
+		return (-1);
+
+	/*
+	 * Return if table index is beyond what device supports
+	 */
+	tab_index = offset / MSIX_TABLE_ENTRY_SIZE;
+	if (tab_index >= pi->pi_msix.table_count)
+		return (-1);
+
+	msix_entry_offset = offset % MSIX_TABLE_ENTRY_SIZE;
+
+	/* support only aligned writes */
+	if ((msix_entry_offset % size) != 0)
+		return (-1);
+
+	dest = (char *)(pi->pi_msix.table + tab_index);
+	dest += msix_entry_offset;
+
+	if (size == 4)
+		*((uint32_t *)dest) = value;
+	else
+		*((uint64_t *)dest) = value;
+
+	return (0);
+}
+
+uint64_t
+pci_emul_msix_tread(struct pci_devinst *pi, uint64_t offset, int size)
+{
+	char *dest;
+	int msix_entry_offset;
+	int tab_index;
+	uint64_t retval = ~0;
+
+	/*
+	 * The PCI standard only allows 4 and 8 byte accesses to the MSI-X
+	 * table but we also allow 1 byte access to accommodate reads from
+	 * ddb.
+	 */
+	if (size != 1 && size != 4 && size != 8)
+		return (retval);
+
+	msix_entry_offset = offset % MSIX_TABLE_ENTRY_SIZE;
+
+	/* support only aligned reads */
+	if ((msix_entry_offset % size) != 0) {
+		return (retval);
+	}
+
+	tab_index = offset / MSIX_TABLE_ENTRY_SIZE;
+
+	if (tab_index < pi->pi_msix.table_count) {
+		/* valid MSI-X Table access */
+		dest = (char *)(pi->pi_msix.table + tab_index);
+		dest += msix_entry_offset;
+
+		if (size == 1)
+			retval = *((uint8_t *)dest);
+		else if (size == 4)
+			retval = *((uint32_t *)dest);
+		else
+			retval = *((uint64_t *)dest);
+	} else if (pci_valid_pba_offset(pi, offset)) {
+		/* return 0 for PBA access */
+		retval = 0;
+	}
+
+	return (retval);
+}
+
+int
+pci_msix_table_bar(struct pci_devinst *pi)
+{
+
+	if (pi->pi_msix.table != NULL)
+		return (pi->pi_msix.table_bar);
+	else
+		return (-1);
+}
+
+int
+pci_msix_pba_bar(struct pci_devinst *pi)
+{
+
+	if (pi->pi_msix.table != NULL)
+		return (pi->pi_msix.pba_bar);
+	else
+		return (-1);
+}
+
+static int
+pci_emul_io_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+		    uint32_t *eax, void *arg)
+{
+	struct pci_devinst *pdi = arg;
+	struct pci_devemu *pe = pdi->pi_d;
+	uint64_t offset;
+	int i;
+
+	for (i = 0; i <= PCI_BARMAX; i++) {
+		if (pdi->pi_bar[i].type == PCIBAR_IO &&
+		    port >= pdi->pi_bar[i].addr &&
+		    port + bytes <= pdi->pi_bar[i].addr + pdi->pi_bar[i].size) {
+			offset = port - pdi->pi_bar[i].addr;
+			if (in)
+				*eax = (*pe->pe_barread)(ctx, vcpu, pdi, i,
+							 offset, bytes);
+			else
+				(*pe->pe_barwrite)(ctx, vcpu, pdi, i, offset,
+						   bytes, *eax);
+			return (0);
+		}
+	}
+	return (-1);
+}
+
+static int
+pci_emul_mem_handler(struct vmctx *ctx, int vcpu, int dir, uint64_t addr,
+		     int size, uint64_t *val, void *arg1, long arg2)
+{
+	struct pci_devinst *pdi = arg1;
+	struct pci_devemu *pe = pdi->pi_d;
+	uint64_t offset;
+	int bidx = (int) arg2;
+
+	assert(bidx <= PCI_BARMAX);
+	assert(pdi->pi_bar[bidx].type == PCIBAR_MEM32 ||
+	       pdi->pi_bar[bidx].type == PCIBAR_MEM64);
+	assert(addr >= pdi->pi_bar[bidx].addr &&
+	       addr + size <= pdi->pi_bar[bidx].addr + pdi->pi_bar[bidx].size);
+
+	offset = addr - pdi->pi_bar[bidx].addr;
+
+	if (dir == MEM_F_WRITE) {
+		if (size == 8) {
+			(*pe->pe_barwrite)(ctx, vcpu, pdi, bidx, offset,
+					   4, *val & 0xffffffff);
+			(*pe->pe_barwrite)(ctx, vcpu, pdi, bidx, offset + 4,
+					   4, *val >> 32);
+		} else {
+			(*pe->pe_barwrite)(ctx, vcpu, pdi, bidx, offset,
+					   size, *val);
+		}
+	} else {
+		if (size == 8) {
+			*val = (*pe->pe_barread)(ctx, vcpu, pdi, bidx,
+						 offset, 4);
+			*val |= (*pe->pe_barread)(ctx, vcpu, pdi, bidx,
+						  offset + 4, 4) << 32;
+		} else {
+			*val = (*pe->pe_barread)(ctx, vcpu, pdi, bidx,
+						 offset, size);
+		}
+	}
+
+	return (0);
+}
+
+
+static int
+pci_emul_alloc_resource(uint64_t *baseptr, uint64_t limit, uint64_t size,
+			uint64_t *addr)
+{
+	uint64_t base;
+
+	assert((size & (size - 1)) == 0);	/* must be a power of 2 */
+
+	base = roundup2(*baseptr, size);
+
+	if (base + size <= limit) {
+		*addr = base;
+		*baseptr = base + size;
+		return (0);
+	} else
+		return (-1);
+}
+
+int
+pci_emul_alloc_bar(struct pci_devinst *pdi, int idx, enum pcibar_type type,
+		   uint64_t size)
+{
+
+	return (pci_emul_alloc_pbar(pdi, idx, 0, type, size));
+}
+
+/*
+ * Register (or unregister) the MMIO or I/O region associated with the BAR
+ * register 'idx' of an emulated pci device.
+ */
+static void
+modify_bar_registration(struct pci_devinst *pi, int idx, int registration)
+{
+	int error;
+	struct inout_port iop;
+	struct mem_range mr;
+
+	switch (pi->pi_bar[idx].type) {
+	case PCIBAR_IO:
+		bzero(&iop, sizeof(struct inout_port));
+		iop.name = pi->pi_name;
+		iop.port = pi->pi_bar[idx].addr;
+		iop.size = pi->pi_bar[idx].size;
+		if (registration) {
+			iop.flags = IOPORT_F_INOUT;
+			iop.handler = pci_emul_io_handler;
+			iop.arg = pi;
+			error = register_inout(&iop);
+		} else 
+			error = unregister_inout(&iop);
+		break;
+	case PCIBAR_MEM32:
+	case PCIBAR_MEM64:
+		bzero(&mr, sizeof(struct mem_range));
+		mr.name = pi->pi_name;
+		mr.base = pi->pi_bar[idx].addr;
+		mr.size = pi->pi_bar[idx].size;
+		if (registration) {
+			mr.flags = MEM_F_RW;
+			mr.handler = pci_emul_mem_handler;
+			mr.arg1 = pi;
+			mr.arg2 = idx;
+			error = register_mem(&mr);
+		} else
+			error = unregister_mem(&mr);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+	assert(error == 0);
+}
+
+static void
+unregister_bar(struct pci_devinst *pi, int idx)
+{
+
+	modify_bar_registration(pi, idx, 0);
+}
+
+static void
+register_bar(struct pci_devinst *pi, int idx)
+{
+
+	modify_bar_registration(pi, idx, 1);
+}
+
+/* Are we decoding i/o port accesses for the emulated pci device? */
+static int
+porten(struct pci_devinst *pi)
+{
+	uint16_t cmd;
+
+	cmd = pci_get_cfgdata16(pi, PCIR_COMMAND);
+
+	return (cmd & PCIM_CMD_PORTEN);
+}
+
+/* Are we decoding memory accesses for the emulated pci device? */
+static int
+memen(struct pci_devinst *pi)
+{
+	uint16_t cmd;
+
+	cmd = pci_get_cfgdata16(pi, PCIR_COMMAND);
+
+	return (cmd & PCIM_CMD_MEMEN);
+}
+
+/*
+ * Update the MMIO or I/O address that is decoded by the BAR register.
+ *
+ * If the pci device has enabled the address space decoding then intercept
+ * the address range decoded by the BAR register.
+ */
+static void
+update_bar_address(struct  pci_devinst *pi, uint64_t addr, int idx, int type)
+{
+	int decode;
+
+	if (pi->pi_bar[idx].type == PCIBAR_IO)
+		decode = porten(pi);
+	else
+		decode = memen(pi);
+
+	if (decode)
+		unregister_bar(pi, idx);
+
+	switch (type) {
+	case PCIBAR_IO:
+	case PCIBAR_MEM32:
+		pi->pi_bar[idx].addr = addr;
+		break;
+	case PCIBAR_MEM64:
+		pi->pi_bar[idx].addr &= ~0xffffffffUL;
+		pi->pi_bar[idx].addr |= addr;
+		break;
+	case PCIBAR_MEMHI64:
+		pi->pi_bar[idx].addr &= 0xffffffff;
+		pi->pi_bar[idx].addr |= addr;
+		break;
+	default:
+		assert(0);
+	}
+
+	if (decode)
+		register_bar(pi, idx);
+}
+
+int
+pci_emul_alloc_pbar(struct pci_devinst *pdi, int idx, uint64_t hostbase,
+		    enum pcibar_type type, uint64_t size)
+{
+	uint64_t *baseptr = NULL;
+	uint64_t limit = 0, lobits = 0;
+	uint64_t addr, mask, bar;
+	int error;
+
+	assert(idx >= 0 && idx <= PCI_BARMAX);
+
+	if ((size & (size - 1)) != 0)
+		size = 1UL << flsl(size);	/* round up to a power of 2 */
+
+	/* Enforce minimum BAR sizes required by the PCI standard */
+	if (type == PCIBAR_IO) {
+		if (size < 4)
+			size = 4;
+	} else {
+		if (size < 16)
+			size = 16;
+	}
+
+	switch (type) {
+	case PCIBAR_NONE:
+		baseptr = NULL;
+		addr = mask = lobits = 0;
+		break;
+	case PCIBAR_IO:
+		baseptr = &pci_emul_iobase;
+		limit = PCI_EMUL_IOLIMIT;
+		mask = PCIM_BAR_IO_BASE;
+		lobits = PCIM_BAR_IO_SPACE;
+		break;
+	case PCIBAR_MEM64:
+		/*
+		 * XXX
+		 * Some drivers do not work well if the 64-bit BAR is allocated
+		 * above 4GB. Allow for this by allocating small requests under
+		 * 4GB unless then allocation size is larger than some arbitrary
+		 * number (32MB currently).
+		 */
+		if (size > 32 * 1024 * 1024) {
+			/*
+			 * XXX special case for device requiring peer-peer DMA
+			 */
+			if (size == 0x100000000UL)
+				baseptr = &hostbase;
+			else
+				baseptr = &pci_emul_membase64;
+			limit = PCI_EMUL_MEMLIMIT64;
+			mask = PCIM_BAR_MEM_BASE;
+			lobits = PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_64 |
+				 PCIM_BAR_MEM_PREFETCH;
+			break;
+		} else {
+			baseptr = &pci_emul_membase32;
+			limit = PCI_EMUL_MEMLIMIT32;
+			mask = PCIM_BAR_MEM_BASE;
+			lobits = PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_64;
+		}
+		break;
+	case PCIBAR_MEM32:
+		baseptr = &pci_emul_membase32;
+		limit = PCI_EMUL_MEMLIMIT32;
+		mask = PCIM_BAR_MEM_BASE;
+		lobits = PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_32;
+		break;
+	default:
+		printf("pci_emul_alloc_base: invalid bar type %d\n", type);
+		assert(0);
+	}
+
+	if (baseptr != NULL) {
+		error = pci_emul_alloc_resource(baseptr, limit, size, &addr);
+		if (error != 0)
+			return (error);
+	}
+
+	pdi->pi_bar[idx].type = type;
+	pdi->pi_bar[idx].addr = addr;
+	pdi->pi_bar[idx].size = size;
+
+	/* Initialize the BAR register in config space */
+	bar = (addr & mask) | lobits;
+	pci_set_cfgdata32(pdi, PCIR_BAR(idx), bar);
+
+	if (type == PCIBAR_MEM64) {
+		assert(idx + 1 <= PCI_BARMAX);
+		pdi->pi_bar[idx + 1].type = PCIBAR_MEMHI64;
+		pci_set_cfgdata32(pdi, PCIR_BAR(idx + 1), bar >> 32);
+	}
+	
+	register_bar(pdi, idx);
+
+	return (0);
+}
+
+#define	CAP_START_OFFSET	0x40
+static int
+pci_emul_add_capability(struct pci_devinst *pi, u_char *capdata, int caplen)
+{
+	int i, capoff, reallen;
+	uint16_t sts;
+
+	assert(caplen > 0);
+
+	reallen = roundup2(caplen, 4);		/* dword aligned */
+
+	sts = pci_get_cfgdata16(pi, PCIR_STATUS);
+	if ((sts & PCIM_STATUS_CAPPRESENT) == 0)
+		capoff = CAP_START_OFFSET;
+	else
+		capoff = pi->pi_capend + 1;
+
+	/* Check if we have enough space */
+	if (capoff + reallen > PCI_REGMAX + 1)
+		return (-1);
+
+	/* Set the previous capability pointer */
+	if ((sts & PCIM_STATUS_CAPPRESENT) == 0) {
+		pci_set_cfgdata8(pi, PCIR_CAP_PTR, capoff);
+		pci_set_cfgdata16(pi, PCIR_STATUS, sts|PCIM_STATUS_CAPPRESENT);
+	} else
+		pci_set_cfgdata8(pi, pi->pi_prevcap + 1, capoff);
+
+	/* Copy the capability */
+	for (i = 0; i < caplen; i++)
+		pci_set_cfgdata8(pi, capoff + i, capdata[i]);
+
+	/* Set the next capability pointer */
+	pci_set_cfgdata8(pi, capoff + 1, 0);
+
+	pi->pi_prevcap = capoff;
+	pi->pi_capend = capoff + reallen - 1;
+	return (0);
+}
+
+static struct pci_devemu *
+pci_emul_finddev(char *name)
+{
+	struct pci_devemu **pdpp, *pdp;
+
+	SET_FOREACH(pdpp, pci_devemu_set) {
+		pdp = *pdpp;
+		if (!strcmp(pdp->pe_emu, name)) {
+			return (pdp);
+		}
+	}
+
+	return (NULL);
+}
+
+static int
+pci_emul_init(struct vmctx *ctx, struct pci_devemu *pde, int bus, int slot,
+    int func, struct funcinfo *fi)
+{
+	struct pci_devinst *pdi;
+	int err;
+
+	pdi = calloc(1, sizeof(struct pci_devinst));
+
+	pdi->pi_vmctx = ctx;
+	pdi->pi_bus = bus;
+	pdi->pi_slot = slot;
+	pdi->pi_func = func;
+	pthread_mutex_init(&pdi->pi_lintr.lock, NULL);
+	pdi->pi_lintr.pin = 0;
+	pdi->pi_lintr.state = IDLE;
+	pdi->pi_lintr.pirq_pin = 0;
+	pdi->pi_lintr.ioapic_irq = 0;
+	pdi->pi_d = pde;
+	snprintf(pdi->pi_name, PI_NAMESZ, "%s-pci-%d", pde->pe_emu, slot);
+
+	/* Disable legacy interrupts */
+	pci_set_cfgdata8(pdi, PCIR_INTLINE, 255);
+	pci_set_cfgdata8(pdi, PCIR_INTPIN, 0);
+
+	pci_set_cfgdata8(pdi, PCIR_COMMAND,
+		    PCIM_CMD_PORTEN | PCIM_CMD_MEMEN | PCIM_CMD_BUSMASTEREN);
+
+	err = (*pde->pe_init)(ctx, pdi, fi->fi_param);
+	if (err == 0)
+		fi->fi_devi = pdi;
+	else
+		free(pdi);
+
+	return (err);
+}
+
+void
+pci_populate_msicap(struct msicap *msicap, int msgnum, int nextptr)
+{
+	int mmc;
+
+	/* Number of msi messages must be a power of 2 between 1 and 32 */
+	assert((msgnum & (msgnum - 1)) == 0 && msgnum >= 1 && msgnum <= 32);
+	mmc = ffs(msgnum) - 1;
+
+	bzero(msicap, sizeof(struct msicap));
+	msicap->capid = PCIY_MSI;
+	msicap->nextptr = nextptr;
+	msicap->msgctrl = PCIM_MSICTRL_64BIT | (mmc << 1);
+}
+
+int
+pci_emul_add_msicap(struct pci_devinst *pi, int msgnum)
+{
+	struct msicap msicap;
+
+	pci_populate_msicap(&msicap, msgnum, 0);
+
+	return (pci_emul_add_capability(pi, (u_char *)&msicap, sizeof(msicap)));
+}
+
+static void
+pci_populate_msixcap(struct msixcap *msixcap, int msgnum, int barnum,
+		     uint32_t msix_tab_size)
+{
+
+	assert(msix_tab_size % 4096 == 0);
+
+	bzero(msixcap, sizeof(struct msixcap));
+	msixcap->capid = PCIY_MSIX;
+
+	/*
+	 * Message Control Register, all fields set to
+	 * zero except for the Table Size.
+	 * Note: Table size N is encoded as N-1
+	 */
+	msixcap->msgctrl = msgnum - 1;
+
+	/*
+	 * MSI-X BAR setup:
+	 * - MSI-X table start at offset 0
+	 * - PBA table starts at a 4K aligned offset after the MSI-X table
+	 */
+	msixcap->table_info = barnum & PCIM_MSIX_BIR_MASK;
+	msixcap->pba_info = msix_tab_size | (barnum & PCIM_MSIX_BIR_MASK);
+}
+
+static void
+pci_msix_table_init(struct pci_devinst *pi, int table_entries)
+{
+	int i, table_size;
+
+	assert(table_entries > 0);
+	assert(table_entries <= MAX_MSIX_TABLE_ENTRIES);
+
+	table_size = table_entries * MSIX_TABLE_ENTRY_SIZE;
+	pi->pi_msix.table = calloc(1, table_size);
+
+	/* set mask bit of vector control register */
+	for (i = 0; i < table_entries; i++)
+		pi->pi_msix.table[i].vector_control |= PCIM_MSIX_VCTRL_MASK;
+}
+
+int
+pci_emul_add_msixcap(struct pci_devinst *pi, int msgnum, int barnum)
+{
+	uint32_t tab_size;
+	struct msixcap msixcap;
+
+	assert(msgnum >= 1 && msgnum <= MAX_MSIX_TABLE_ENTRIES);
+	assert(barnum >= 0 && barnum <= PCIR_MAX_BAR_0);
+	
+	tab_size = msgnum * MSIX_TABLE_ENTRY_SIZE;
+
+	/* Align table size to nearest 4K */
+	tab_size = roundup2(tab_size, 4096);
+
+	pi->pi_msix.table_bar = barnum;
+	pi->pi_msix.pba_bar   = barnum;
+	pi->pi_msix.table_offset = 0;
+	pi->pi_msix.table_count = msgnum;
+	pi->pi_msix.pba_offset = tab_size;
+	pi->pi_msix.pba_size = PBA_SIZE(msgnum);
+
+	pci_msix_table_init(pi, msgnum);
+
+	pci_populate_msixcap(&msixcap, msgnum, barnum, tab_size);
+
+	/* allocate memory for MSI-X Table and PBA */
+	pci_emul_alloc_bar(pi, barnum, PCIBAR_MEM32,
+				tab_size + pi->pi_msix.pba_size);
+
+	return (pci_emul_add_capability(pi, (u_char *)&msixcap,
+					sizeof(msixcap)));
+}
+
+void
+msixcap_cfgwrite(struct pci_devinst *pi, int capoff, int offset,
+		 int bytes, uint32_t val)
+{
+	uint16_t msgctrl, rwmask;
+	int off;
+	
+	off = offset - capoff;
+	/* Message Control Register */
+	if (off == 2 && bytes == 2) {
+		rwmask = PCIM_MSIXCTRL_MSIX_ENABLE | PCIM_MSIXCTRL_FUNCTION_MASK;
+		msgctrl = pci_get_cfgdata16(pi, offset);
+		msgctrl &= ~rwmask;
+		msgctrl |= val & rwmask;
+		val = msgctrl;
+
+		pi->pi_msix.enabled = val & PCIM_MSIXCTRL_MSIX_ENABLE;
+		pi->pi_msix.function_mask = val & PCIM_MSIXCTRL_FUNCTION_MASK;
+		pci_lintr_update(pi);
+	} 
+	
+	CFGWRITE(pi, offset, val, bytes);
+}
+
+void
+msicap_cfgwrite(struct pci_devinst *pi, int capoff, int offset,
+		int bytes, uint32_t val)
+{
+	uint16_t msgctrl, rwmask, msgdata, mme;
+	uint32_t addrlo;
+
+	/*
+	 * If guest is writing to the message control register make sure
+	 * we do not overwrite read-only fields.
+	 */
+	if ((offset - capoff) == 2 && bytes == 2) {
+		rwmask = PCIM_MSICTRL_MME_MASK | PCIM_MSICTRL_MSI_ENABLE;
+		msgctrl = pci_get_cfgdata16(pi, offset);
+		msgctrl &= ~rwmask;
+		msgctrl |= val & rwmask;
+		val = msgctrl;
+
+		addrlo = pci_get_cfgdata32(pi, capoff + 4);
+		if (msgctrl & PCIM_MSICTRL_64BIT)
+			msgdata = pci_get_cfgdata16(pi, capoff + 12);
+		else
+			msgdata = pci_get_cfgdata16(pi, capoff + 8);
+
+		mme = msgctrl & PCIM_MSICTRL_MME_MASK;
+		pi->pi_msi.enabled = msgctrl & PCIM_MSICTRL_MSI_ENABLE ? 1 : 0;
+		if (pi->pi_msi.enabled) {
+			pi->pi_msi.addr = addrlo;
+			pi->pi_msi.msg_data = msgdata;
+			pi->pi_msi.maxmsgnum = 1 << (mme >> 4);
+		} else {
+			pi->pi_msi.maxmsgnum = 0;
+		}
+		pci_lintr_update(pi);
+	}
+
+	CFGWRITE(pi, offset, val, bytes);
+}
+
+void
+pciecap_cfgwrite(struct pci_devinst *pi, int capoff, int offset,
+		 int bytes, uint32_t val)
+{
+
+	/* XXX don't write to the readonly parts */
+	CFGWRITE(pi, offset, val, bytes);
+}
+
+#define	PCIECAP_VERSION	0x2
+int
+pci_emul_add_pciecap(struct pci_devinst *pi, int type)
+{
+	int err;
+	struct pciecap pciecap;
+
+	if (type != PCIEM_TYPE_ROOT_PORT)
+		return (-1);
+
+	bzero(&pciecap, sizeof(pciecap));
+
+	pciecap.capid = PCIY_EXPRESS;
+	pciecap.pcie_capabilities = PCIECAP_VERSION | PCIEM_TYPE_ROOT_PORT;
+	pciecap.link_capabilities = 0x411;	/* gen1, x1 */
+	pciecap.link_status = 0x11;		/* gen1, x1 */
+
+	err = pci_emul_add_capability(pi, (u_char *)&pciecap, sizeof(pciecap));
+	return (err);
+}
+
+/*
+ * This function assumes that 'coff' is in the capabilities region of the
+ * config space.
+ */
+static void
+pci_emul_capwrite(struct pci_devinst *pi, int offset, int bytes, uint32_t val)
+{
+	int capid;
+	uint8_t capoff, nextoff;
+
+	/* Do not allow un-aligned writes */
+	if ((offset & (bytes - 1)) != 0)
+		return;
+
+	/* Find the capability that we want to update */
+	capoff = CAP_START_OFFSET;
+	while (1) {
+		nextoff = pci_get_cfgdata8(pi, capoff + 1);
+		if (nextoff == 0)
+			break;
+		if (offset >= capoff && offset < nextoff)
+			break;
+
+		capoff = nextoff;
+	}
+	assert(offset >= capoff);
+
+	/*
+	 * Capability ID and Next Capability Pointer are readonly.
+	 * However, some o/s's do 4-byte writes that include these.
+	 * For this case, trim the write back to 2 bytes and adjust
+	 * the data.
+	 */
+	if (offset == capoff || offset == capoff + 1) {
+		if (offset == capoff && bytes == 4) {
+			bytes = 2;
+			offset += 2;
+			val >>= 16;
+		} else
+			return;
+	}
+
+	capid = pci_get_cfgdata8(pi, capoff);
+	switch (capid) {
+	case PCIY_MSI:
+		msicap_cfgwrite(pi, capoff, offset, bytes, val);
+		break;
+	case PCIY_MSIX:
+		msixcap_cfgwrite(pi, capoff, offset, bytes, val);
+		break;
+	case PCIY_EXPRESS:
+		pciecap_cfgwrite(pi, capoff, offset, bytes, val);
+		break;
+	default:
+		break;
+	}
+}
+
+static int
+pci_emul_iscap(struct pci_devinst *pi, int offset)
+{
+	uint16_t sts;
+
+	sts = pci_get_cfgdata16(pi, PCIR_STATUS);
+	if ((sts & PCIM_STATUS_CAPPRESENT) != 0) {
+		if (offset >= CAP_START_OFFSET && offset <= pi->pi_capend)
+			return (1);
+	}
+	return (0);
+}
+
+static int
+pci_emul_fallback_handler(struct vmctx *ctx, int vcpu, int dir, uint64_t addr,
+			  int size, uint64_t *val, void *arg1, long arg2)
+{
+	/*
+	 * Ignore writes; return 0xff's for reads. The mem read code
+	 * will take care of truncating to the correct size.
+	 */
+	if (dir == MEM_F_READ) {
+		*val = 0xffffffffffffffff;
+	}
+
+	return (0);
+}
+
+static int
+pci_emul_ecfg_handler(struct vmctx *ctx, int vcpu, int dir, uint64_t addr,
+    int bytes, uint64_t *val, void *arg1, long arg2)
+{
+	int bus, slot, func, coff, in;
+
+	coff = addr & 0xfff;
+	func = (addr >> 12) & 0x7;
+	slot = (addr >> 15) & 0x1f;
+	bus = (addr >> 20) & 0xff;
+	in = (dir == MEM_F_READ);
+	if (in)
+		*val = ~0UL;
+	pci_cfgrw(ctx, vcpu, in, bus, slot, func, coff, bytes, (uint32_t *)val);
+	return (0);
+}
+
+uint64_t
+pci_ecfg_base(void)
+{
+
+	return (PCI_EMUL_ECFG_BASE);
+}
+
+#define	BUSIO_ROUNDUP		32
+#define	BUSMEM_ROUNDUP		(1024 * 1024)
+
+int
+init_pci(struct vmctx *ctx)
+{
+	struct mem_range mr;
+	struct pci_devemu *pde;
+	struct businfo *bi;
+	struct slotinfo *si;
+	struct funcinfo *fi;
+	size_t lowmem;
+	int bus, slot, func;
+	int error;
+
+	pci_emul_iobase = PCI_EMUL_IOBASE;
+	pci_emul_membase32 = vm_get_lowmem_limit(ctx);
+	pci_emul_membase64 = PCI_EMUL_MEMBASE64;
+
+	for (bus = 0; bus < MAXBUSES; bus++) {
+		if ((bi = pci_businfo[bus]) == NULL)
+			continue;
+		/* 
+		 * Keep track of the i/o and memory resources allocated to
+		 * this bus.
+		 */
+		bi->iobase = pci_emul_iobase;
+		bi->membase32 = pci_emul_membase32;
+		bi->membase64 = pci_emul_membase64;
+
+		for (slot = 0; slot < MAXSLOTS; slot++) {
+			si = &bi->slotinfo[slot];
+			for (func = 0; func < MAXFUNCS; func++) {
+				fi = &si->si_funcs[func];
+				if (fi->fi_name == NULL)
+					continue;
+				pde = pci_emul_finddev(fi->fi_name);
+				assert(pde != NULL);
+				error = pci_emul_init(ctx, pde, bus, slot,
+				    func, fi);
+				if (error)
+					return (error);
+			}
+		}
+
+		/*
+		 * Add some slop to the I/O and memory resources decoded by
+		 * this bus to give a guest some flexibility if it wants to
+		 * reprogram the BARs.
+		 */
+		pci_emul_iobase += BUSIO_ROUNDUP;
+		pci_emul_iobase = roundup2(pci_emul_iobase, BUSIO_ROUNDUP);
+		bi->iolimit = pci_emul_iobase;
+
+		pci_emul_membase32 += BUSMEM_ROUNDUP;
+		pci_emul_membase32 = roundup2(pci_emul_membase32,
+		    BUSMEM_ROUNDUP);
+		bi->memlimit32 = pci_emul_membase32;
+
+		pci_emul_membase64 += BUSMEM_ROUNDUP;
+		pci_emul_membase64 = roundup2(pci_emul_membase64,
+		    BUSMEM_ROUNDUP);
+		bi->memlimit64 = pci_emul_membase64;
+	}
+
+	/*
+	 * PCI backends are initialized before routing INTx interrupts
+	 * so that LPC devices are able to reserve ISA IRQs before
+	 * routing PIRQ pins.
+	 */
+	for (bus = 0; bus < MAXBUSES; bus++) {
+		if ((bi = pci_businfo[bus]) == NULL)
+			continue;
+
+		for (slot = 0; slot < MAXSLOTS; slot++) {
+			si = &bi->slotinfo[slot];
+			for (func = 0; func < MAXFUNCS; func++) {
+				fi = &si->si_funcs[func];
+				if (fi->fi_devi == NULL)
+					continue;
+				pci_lintr_route(fi->fi_devi);
+			}
+		}
+	}
+	lpc_pirq_routed();
+
+	/*
+	 * The guest physical memory map looks like the following:
+	 * [0,		    lowmem)		guest system memory
+	 * [lowmem,	    lowmem_limit)	memory hole (may be absent)
+	 * [lowmem_limit,   0xE0000000)		PCI hole (32-bit BAR allocation)
+	 * [0xE0000000,	    0xF0000000)		PCI extended config window
+	 * [0xF0000000,	    4GB)		LAPIC, IOAPIC, HPET, firmware
+	 * [4GB,	    4GB + highmem)
+	 */
+
+	/*
+	 * Accesses to memory addresses that are not allocated to system
+	 * memory or PCI devices return 0xff's.
+	 */
+	lowmem = vm_get_lowmem_size(ctx);
+	bzero(&mr, sizeof(struct mem_range));
+	mr.name = "PCI hole";
+	mr.flags = MEM_F_RW | MEM_F_IMMUTABLE;
+	mr.base = lowmem;
+	mr.size = (4ULL * 1024 * 1024 * 1024) - lowmem;
+	mr.handler = pci_emul_fallback_handler;
+	error = register_mem_fallback(&mr);
+	assert(error == 0);
+
+	/* PCI extended config space */
+	bzero(&mr, sizeof(struct mem_range));
+	mr.name = "PCI ECFG";
+	mr.flags = MEM_F_RW | MEM_F_IMMUTABLE;
+	mr.base = PCI_EMUL_ECFG_BASE;
+	mr.size = PCI_EMUL_ECFG_SIZE;
+	mr.handler = pci_emul_ecfg_handler;
+	error = register_mem(&mr);
+	assert(error == 0);
+
+	return (0);
+}
+
+static void
+pci_apic_prt_entry(int bus, int slot, int pin, int pirq_pin, int ioapic_irq,
+    void *arg)
+{
+
+	dsdt_line("  Package ()");
+	dsdt_line("  {");
+	dsdt_line("    0x%X,", slot << 16 | 0xffff);
+	dsdt_line("    0x%02X,", pin - 1);
+	dsdt_line("    Zero,");
+	dsdt_line("    0x%X", ioapic_irq);
+	dsdt_line("  },");
+}
+
+static void
+pci_pirq_prt_entry(int bus, int slot, int pin, int pirq_pin, int ioapic_irq,
+    void *arg)
+{
+	char *name;
+
+	name = lpc_pirq_name(pirq_pin);
+	if (name == NULL)
+		return;
+	dsdt_line("  Package ()");
+	dsdt_line("  {");
+	dsdt_line("    0x%X,", slot << 16 | 0xffff);
+	dsdt_line("    0x%02X,", pin - 1);
+	dsdt_line("    %s,", name);
+	dsdt_line("    0x00");
+	dsdt_line("  },");
+	free(name);
+}
+
+/*
+ * A bhyve virtual machine has a flat PCI hierarchy with a root port
+ * corresponding to each PCI bus.
+ */
+static void
+pci_bus_write_dsdt(int bus)
+{
+	struct businfo *bi;
+	struct slotinfo *si;
+	struct pci_devinst *pi;
+	int count, func, slot;
+
+	/*
+	 * If there are no devices on this 'bus' then just return.
+	 */
+	if ((bi = pci_businfo[bus]) == NULL) {
+		/*
+		 * Bus 0 is special because it decodes the I/O ports used
+		 * for PCI config space access even if there are no devices
+		 * on it.
+		 */
+		if (bus != 0)
+			return;
+	}
+
+	dsdt_line("  Device (PC%02X)", bus);
+	dsdt_line("  {");
+	dsdt_line("    Name (_HID, EisaId (\"PNP0A03\"))");
+	dsdt_line("    Name (_ADR, Zero)");
+
+	dsdt_line("    Method (_BBN, 0, NotSerialized)");
+	dsdt_line("    {");
+	dsdt_line("        Return (0x%08X)", bus);
+	dsdt_line("    }");
+	dsdt_line("    Name (_CRS, ResourceTemplate ()");
+	dsdt_line("    {");
+	dsdt_line("      WordBusNumber (ResourceProducer, MinFixed, "
+	    "MaxFixed, PosDecode,");
+	dsdt_line("        0x0000,             // Granularity");
+	dsdt_line("        0x%04X,             // Range Minimum", bus);
+	dsdt_line("        0x%04X,             // Range Maximum", bus);
+	dsdt_line("        0x0000,             // Translation Offset");
+	dsdt_line("        0x0001,             // Length");
+	dsdt_line("        ,, )");
+
+	if (bus == 0) {
+		dsdt_indent(3);
+		dsdt_fixed_ioport(0xCF8, 8);
+		dsdt_unindent(3);
+
+		dsdt_line("      WordIO (ResourceProducer, MinFixed, MaxFixed, "
+		    "PosDecode, EntireRange,");
+		dsdt_line("        0x0000,             // Granularity");
+		dsdt_line("        0x0000,             // Range Minimum");
+		dsdt_line("        0x0CF7,             // Range Maximum");
+		dsdt_line("        0x0000,             // Translation Offset");
+		dsdt_line("        0x0CF8,             // Length");
+		dsdt_line("        ,, , TypeStatic)");
+
+		dsdt_line("      WordIO (ResourceProducer, MinFixed, MaxFixed, "
+		    "PosDecode, EntireRange,");
+		dsdt_line("        0x0000,             // Granularity");
+		dsdt_line("        0x0D00,             // Range Minimum");
+		dsdt_line("        0x%04X,             // Range Maximum",
+		    PCI_EMUL_IOBASE - 1);
+		dsdt_line("        0x0000,             // Translation Offset");
+		dsdt_line("        0x%04X,             // Length",
+		    PCI_EMUL_IOBASE - 0x0D00);
+		dsdt_line("        ,, , TypeStatic)");
+
+		if (bi == NULL) {
+			dsdt_line("    })");
+			goto done;
+		}
+	}
+	assert(bi != NULL);
+
+	/* i/o window */
+	dsdt_line("      WordIO (ResourceProducer, MinFixed, MaxFixed, "
+	    "PosDecode, EntireRange,");
+	dsdt_line("        0x0000,             // Granularity");
+	dsdt_line("        0x%04X,             // Range Minimum", bi->iobase);
+	dsdt_line("        0x%04X,             // Range Maximum",
+	    bi->iolimit - 1);
+	dsdt_line("        0x0000,             // Translation Offset");
+	dsdt_line("        0x%04X,             // Length",
+	    bi->iolimit - bi->iobase);
+	dsdt_line("        ,, , TypeStatic)");
+
+	/* mmio window (32-bit) */
+	dsdt_line("      DWordMemory (ResourceProducer, PosDecode, "
+	    "MinFixed, MaxFixed, NonCacheable, ReadWrite,");
+	dsdt_line("        0x00000000,         // Granularity");
+	dsdt_line("        0x%08X,         // Range Minimum\n", bi->membase32);
+	dsdt_line("        0x%08X,         // Range Maximum\n",
+	    bi->memlimit32 - 1);
+	dsdt_line("        0x00000000,         // Translation Offset");
+	dsdt_line("        0x%08X,         // Length\n",
+	    bi->memlimit32 - bi->membase32);
+	dsdt_line("        ,, , AddressRangeMemory, TypeStatic)");
+
+	/* mmio window (64-bit) */
+	dsdt_line("      QWordMemory (ResourceProducer, PosDecode, "
+	    "MinFixed, MaxFixed, NonCacheable, ReadWrite,");
+	dsdt_line("        0x0000000000000000, // Granularity");
+	dsdt_line("        0x%016lX, // Range Minimum\n", bi->membase64);
+	dsdt_line("        0x%016lX, // Range Maximum\n",
+	    bi->memlimit64 - 1);
+	dsdt_line("        0x0000000000000000, // Translation Offset");
+	dsdt_line("        0x%016lX, // Length\n",
+	    bi->memlimit64 - bi->membase64);
+	dsdt_line("        ,, , AddressRangeMemory, TypeStatic)");
+	dsdt_line("    })");
+
+	count = pci_count_lintr(bus);
+	if (count != 0) {
+		dsdt_indent(2);
+		dsdt_line("Name (PPRT, Package ()");
+		dsdt_line("{");
+		pci_walk_lintr(bus, pci_pirq_prt_entry, NULL);
+ 		dsdt_line("})");
+		dsdt_line("Name (APRT, Package ()");
+		dsdt_line("{");
+		pci_walk_lintr(bus, pci_apic_prt_entry, NULL);
+ 		dsdt_line("})");
+		dsdt_line("Method (_PRT, 0, NotSerialized)");
+		dsdt_line("{");
+		dsdt_line("  If (PICM)");
+		dsdt_line("  {");
+		dsdt_line("    Return (APRT)");
+		dsdt_line("  }");
+		dsdt_line("  Else");
+		dsdt_line("  {");
+		dsdt_line("    Return (PPRT)");
+		dsdt_line("  }");
+		dsdt_line("}");
+		dsdt_unindent(2);
+	}
+
+	dsdt_indent(2);
+	for (slot = 0; slot < MAXSLOTS; slot++) {
+		si = &bi->slotinfo[slot];
+		for (func = 0; func < MAXFUNCS; func++) {
+			pi = si->si_funcs[func].fi_devi;
+			if (pi != NULL && pi->pi_d->pe_write_dsdt != NULL)
+				pi->pi_d->pe_write_dsdt(pi);
+		}
+	}
+	dsdt_unindent(2);
+done:
+	dsdt_line("  }");
+}
+
+void
+pci_write_dsdt(void)
+{
+	int bus;
+
+	dsdt_indent(1);
+	dsdt_line("Name (PICM, 0x00)");
+	dsdt_line("Method (_PIC, 1, NotSerialized)");
+	dsdt_line("{");
+	dsdt_line("  Store (Arg0, PICM)");
+	dsdt_line("}");
+	dsdt_line("");
+	dsdt_line("Scope (_SB)");
+	dsdt_line("{");
+	for (bus = 0; bus < MAXBUSES; bus++)
+		pci_bus_write_dsdt(bus);
+	dsdt_line("}");
+	dsdt_unindent(1);
+}
+
+int
+pci_bus_configured(int bus)
+{
+	assert(bus >= 0 && bus < MAXBUSES);
+	return (pci_businfo[bus] != NULL);
+}
+
+int
+pci_msi_enabled(struct pci_devinst *pi)
+{
+	return (pi->pi_msi.enabled);
+}
+
+int
+pci_msi_maxmsgnum(struct pci_devinst *pi)
+{
+	if (pi->pi_msi.enabled)
+		return (pi->pi_msi.maxmsgnum);
+	else
+		return (0);
+}
+
+int
+pci_msix_enabled(struct pci_devinst *pi)
+{
+
+	return (pi->pi_msix.enabled && !pi->pi_msi.enabled);
+}
+
+void
+pci_generate_msix(struct pci_devinst *pi, int index)
+{
+	struct msix_table_entry *mte;
+
+	if (!pci_msix_enabled(pi))
+		return;
+
+	if (pi->pi_msix.function_mask)
+		return;
+
+	if (index >= pi->pi_msix.table_count)
+		return;
+
+	mte = &pi->pi_msix.table[index];
+	if ((mte->vector_control & PCIM_MSIX_VCTRL_MASK) == 0) {
+		/* XXX Set PBA bit if interrupt is disabled */
+		vm_lapic_msi(pi->pi_vmctx, mte->addr, mte->msg_data);
+	}
+}
+
+void
+pci_generate_msi(struct pci_devinst *pi, int index)
+{
+
+	if (pci_msi_enabled(pi) && index < pci_msi_maxmsgnum(pi)) {
+		vm_lapic_msi(pi->pi_vmctx, pi->pi_msi.addr,
+			     pi->pi_msi.msg_data + index);
+	}
+}
+
+static bool
+pci_lintr_permitted(struct pci_devinst *pi)
+{
+	uint16_t cmd;
+
+	cmd = pci_get_cfgdata16(pi, PCIR_COMMAND);
+	return (!(pi->pi_msi.enabled || pi->pi_msix.enabled ||
+		(cmd & PCIM_CMD_INTxDIS)));
+}
+
+void
+pci_lintr_request(struct pci_devinst *pi)
+{
+	struct businfo *bi;
+	struct slotinfo *si;
+	int bestpin, bestcount, pin;
+
+	bi = pci_businfo[pi->pi_bus];
+	assert(bi != NULL);
+
+	/*
+	 * Just allocate a pin from our slot.  The pin will be
+	 * assigned IRQs later when interrupts are routed.
+	 */
+	si = &bi->slotinfo[pi->pi_slot];
+	bestpin = 0;
+	bestcount = si->si_intpins[0].ii_count;
+	for (pin = 1; pin < 4; pin++) {
+		if (si->si_intpins[pin].ii_count < bestcount) {
+			bestpin = pin;
+			bestcount = si->si_intpins[pin].ii_count;
+		}
+	}
+
+	si->si_intpins[bestpin].ii_count++;
+	pi->pi_lintr.pin = bestpin + 1;
+	pci_set_cfgdata8(pi, PCIR_INTPIN, bestpin + 1);
+}
+
+static void
+pci_lintr_route(struct pci_devinst *pi)
+{
+	struct businfo *bi;
+	struct intxinfo *ii;
+
+	if (pi->pi_lintr.pin == 0)
+		return;
+
+	bi = pci_businfo[pi->pi_bus];
+	assert(bi != NULL);
+	ii = &bi->slotinfo[pi->pi_slot].si_intpins[pi->pi_lintr.pin - 1];
+
+	/*
+	 * Attempt to allocate an I/O APIC pin for this intpin if one
+	 * is not yet assigned.
+	 */
+	if (ii->ii_ioapic_irq == 0)
+		ii->ii_ioapic_irq = ioapic_pci_alloc_irq(pi);
+	assert(ii->ii_ioapic_irq > 0);
+
+	/*
+	 * Attempt to allocate a PIRQ pin for this intpin if one is
+	 * not yet assigned.
+	 */
+	if (ii->ii_pirq_pin == 0)
+		ii->ii_pirq_pin = pirq_alloc_pin(pi);
+	assert(ii->ii_pirq_pin > 0);
+
+	pi->pi_lintr.ioapic_irq = ii->ii_ioapic_irq;
+	pi->pi_lintr.pirq_pin = ii->ii_pirq_pin;
+	pci_set_cfgdata8(pi, PCIR_INTLINE, pirq_irq(ii->ii_pirq_pin));
+}
+
+void
+pci_lintr_assert(struct pci_devinst *pi)
+{
+
+	assert(pi->pi_lintr.pin > 0);
+
+	pthread_mutex_lock(&pi->pi_lintr.lock);
+	if (pi->pi_lintr.state == IDLE) {
+		if (pci_lintr_permitted(pi)) {
+			pi->pi_lintr.state = ASSERTED;
+			pci_irq_assert(pi);
+		} else
+			pi->pi_lintr.state = PENDING;
+	}
+	pthread_mutex_unlock(&pi->pi_lintr.lock);
+}
+
+void
+pci_lintr_deassert(struct pci_devinst *pi)
+{
+
+	assert(pi->pi_lintr.pin > 0);
+
+	pthread_mutex_lock(&pi->pi_lintr.lock);
+	if (pi->pi_lintr.state == ASSERTED) {
+		pi->pi_lintr.state = IDLE;
+		pci_irq_deassert(pi);
+	} else if (pi->pi_lintr.state == PENDING)
+		pi->pi_lintr.state = IDLE;
+	pthread_mutex_unlock(&pi->pi_lintr.lock);
+}
+
+static void
+pci_lintr_update(struct pci_devinst *pi)
+{
+
+	pthread_mutex_lock(&pi->pi_lintr.lock);
+	if (pi->pi_lintr.state == ASSERTED && !pci_lintr_permitted(pi)) {
+		pci_irq_deassert(pi);
+		pi->pi_lintr.state = PENDING;
+	} else if (pi->pi_lintr.state == PENDING && pci_lintr_permitted(pi)) {
+		pi->pi_lintr.state = ASSERTED;
+		pci_irq_assert(pi);
+	}
+	pthread_mutex_unlock(&pi->pi_lintr.lock);
+#ifndef __FreeBSD__
+	if (pi->pi_d->pe_lintrupdate != NULL) {
+		pi->pi_d->pe_lintrupdate(pi);
+	}
+#endif /* __FreeBSD__ */
+}
+
+int
+pci_count_lintr(int bus)
+{
+	int count, slot, pin;
+	struct slotinfo *slotinfo;
+
+	count = 0;
+	if (pci_businfo[bus] != NULL) {
+		for (slot = 0; slot < MAXSLOTS; slot++) {
+			slotinfo = &pci_businfo[bus]->slotinfo[slot];
+			for (pin = 0; pin < 4; pin++) {
+				if (slotinfo->si_intpins[pin].ii_count != 0)
+					count++;
+			}
+		}
+	}
+	return (count);
+}
+
+void
+pci_walk_lintr(int bus, pci_lintr_cb cb, void *arg)
+{
+	struct businfo *bi;
+	struct slotinfo *si;
+	struct intxinfo *ii;
+	int slot, pin;
+
+	if ((bi = pci_businfo[bus]) == NULL)
+		return;
+
+	for (slot = 0; slot < MAXSLOTS; slot++) {
+		si = &bi->slotinfo[slot];
+		for (pin = 0; pin < 4; pin++) {
+			ii = &si->si_intpins[pin];
+			if (ii->ii_count != 0)
+				cb(bus, slot, pin + 1, ii->ii_pirq_pin,
+				    ii->ii_ioapic_irq, arg);
+		}
+	}
+}
+
+/*
+ * Return 1 if the emulated device in 'slot' is a multi-function device.
+ * Return 0 otherwise.
+ */
+static int
+pci_emul_is_mfdev(int bus, int slot)
+{
+	struct businfo *bi;
+	struct slotinfo *si;
+	int f, numfuncs;
+
+	numfuncs = 0;
+	if ((bi = pci_businfo[bus]) != NULL) {
+		si = &bi->slotinfo[slot];
+		for (f = 0; f < MAXFUNCS; f++) {
+			if (si->si_funcs[f].fi_devi != NULL) {
+				numfuncs++;
+			}
+		}
+	}
+	return (numfuncs > 1);
+}
+
+/*
+ * Ensure that the PCIM_MFDEV bit is properly set (or unset) depending on
+ * whether or not is a multi-function being emulated in the pci 'slot'.
+ */
+static void
+pci_emul_hdrtype_fixup(int bus, int slot, int off, int bytes, uint32_t *rv)
+{
+	int mfdev;
+
+	if (off <= PCIR_HDRTYPE && off + bytes > PCIR_HDRTYPE) {
+		mfdev = pci_emul_is_mfdev(bus, slot);
+		switch (bytes) {
+		case 1:
+		case 2:
+			*rv &= ~PCIM_MFDEV;
+			if (mfdev) {
+				*rv |= PCIM_MFDEV;
+			}
+			break;
+		case 4:
+			*rv &= ~(PCIM_MFDEV << 16);
+			if (mfdev) {
+				*rv |= (PCIM_MFDEV << 16);
+			}
+			break;
+		}
+	}
+}
+
+static void
+pci_emul_cmdsts_write(struct pci_devinst *pi, int coff, uint32_t new, int bytes)
+{
+	int i, rshift;
+	uint32_t cmd, cmd2, changed, old, readonly;
+
+	cmd = pci_get_cfgdata16(pi, PCIR_COMMAND);	/* stash old value */
+
+	/*
+	 * From PCI Local Bus Specification 3.0 sections 6.2.2 and 6.2.3.
+	 *
+	 * XXX Bits 8, 11, 12, 13, 14 and 15 in the status register are
+	 * 'write 1 to clear'. However these bits are not set to '1' by
+	 * any device emulation so it is simpler to treat them as readonly.
+	 */
+	rshift = (coff & 0x3) * 8;
+	readonly = 0xFFFFF880 >> rshift;
+
+	old = CFGREAD(pi, coff, bytes);
+	new &= ~readonly;
+	new |= (old & readonly);
+	CFGWRITE(pi, coff, new, bytes);			/* update config */
+
+	cmd2 = pci_get_cfgdata16(pi, PCIR_COMMAND);	/* get updated value */
+	changed = cmd ^ cmd2;
+
+	/*
+	 * If the MMIO or I/O address space decoding has changed then
+	 * register/unregister all BARs that decode that address space.
+	 */
+	for (i = 0; i <= PCI_BARMAX; i++) {
+		switch (pi->pi_bar[i].type) {
+			case PCIBAR_NONE:
+			case PCIBAR_MEMHI64:
+				break;
+			case PCIBAR_IO:
+				/* I/O address space decoding changed? */
+				if (changed & PCIM_CMD_PORTEN) {
+					if (porten(pi))
+						register_bar(pi, i);
+					else
+						unregister_bar(pi, i);
+				}
+				break;
+			case PCIBAR_MEM32:
+			case PCIBAR_MEM64:
+				/* MMIO address space decoding changed? */
+				if (changed & PCIM_CMD_MEMEN) {
+					if (memen(pi))
+						register_bar(pi, i);
+					else
+						unregister_bar(pi, i);
+				}
+				break; 
+			default:
+				assert(0); 
+		}
+	}
+
+	/*
+	 * If INTx has been unmasked and is pending, assert the
+	 * interrupt.
+	 */
+	pci_lintr_update(pi);
+}	
+
+static void
+pci_cfgrw(struct vmctx *ctx, int vcpu, int in, int bus, int slot, int func,
+    int coff, int bytes, uint32_t *eax)
+{
+	struct businfo *bi;
+	struct slotinfo *si;
+	struct pci_devinst *pi;
+	struct pci_devemu *pe;
+	int idx, needcfg;
+	uint64_t addr, mask;
+	uint64_t bar = 0;
+
+	if ((bi = pci_businfo[bus]) != NULL) {
+		si = &bi->slotinfo[slot];
+		pi = si->si_funcs[func].fi_devi;
+	} else
+		pi = NULL;
+
+	/*
+	 * Just return if there is no device at this slot:func or if the
+	 * the guest is doing an un-aligned access.
+	 */
+	if (pi == NULL || (bytes != 1 && bytes != 2 && bytes != 4) ||
+	    (coff & (bytes - 1)) != 0) {
+		if (in)
+			*eax = 0xffffffff;
+		return;
+	}
+
+	/*
+	 * Ignore all writes beyond the standard config space and return all
+	 * ones on reads.
+	 */
+	if (coff >= PCI_REGMAX + 1) {
+		if (in) {
+			*eax = 0xffffffff;
+			/*
+			 * Extended capabilities begin at offset 256 in config
+			 * space. Absence of extended capabilities is signaled
+			 * with all 0s in the extended capability header at
+			 * offset 256.
+			 */
+			if (coff <= PCI_REGMAX + 4)
+				*eax = 0x00000000;
+		}
+		return;
+	}
+
+	pe = pi->pi_d;
+
+	/*
+	 * Config read
+	 */
+	if (in) {
+		/* Let the device emulation override the default handler */
+		if (pe->pe_cfgread != NULL) {
+			needcfg = pe->pe_cfgread(ctx, vcpu, pi, coff, bytes,
+			    eax);
+		} else {
+			needcfg = 1;
+		}
+
+		if (needcfg)
+			*eax = CFGREAD(pi, coff, bytes);
+
+		pci_emul_hdrtype_fixup(bus, slot, coff, bytes, eax);
+	} else {
+		/* Let the device emulation override the default handler */
+		if (pe->pe_cfgwrite != NULL &&
+		    (*pe->pe_cfgwrite)(ctx, vcpu, pi, coff, bytes, *eax) == 0)
+			return;
+
+		/*
+		 * Special handling for write to BAR registers
+		 */
+		if (coff >= PCIR_BAR(0) && coff < PCIR_BAR(PCI_BARMAX + 1)) {
+			/*
+			 * Ignore writes to BAR registers that are not
+			 * 4-byte aligned.
+			 */
+			if (bytes != 4 || (coff & 0x3) != 0)
+				return;
+			idx = (coff - PCIR_BAR(0)) / 4;
+			mask = ~(pi->pi_bar[idx].size - 1);
+			switch (pi->pi_bar[idx].type) {
+			case PCIBAR_NONE:
+				pi->pi_bar[idx].addr = bar = 0;
+				break;
+			case PCIBAR_IO:
+				addr = *eax & mask;
+				addr &= 0xffff;
+				bar = addr | PCIM_BAR_IO_SPACE;
+				/*
+				 * Register the new BAR value for interception
+				 */
+				if (addr != pi->pi_bar[idx].addr) {
+					update_bar_address(pi, addr, idx,
+							   PCIBAR_IO);
+				}
+				break;
+			case PCIBAR_MEM32:
+				addr = bar = *eax & mask;
+				bar |= PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_32;
+				if (addr != pi->pi_bar[idx].addr) {
+					update_bar_address(pi, addr, idx,
+							   PCIBAR_MEM32);
+				}
+				break;
+			case PCIBAR_MEM64:
+				addr = bar = *eax & mask;
+				bar |= PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_64 |
+				       PCIM_BAR_MEM_PREFETCH;
+				if (addr != (uint32_t)pi->pi_bar[idx].addr) {
+					update_bar_address(pi, addr, idx,
+							   PCIBAR_MEM64);
+				}
+				break;
+			case PCIBAR_MEMHI64:
+				mask = ~(pi->pi_bar[idx - 1].size - 1);
+				addr = ((uint64_t)*eax << 32) & mask;
+				bar = addr >> 32;
+				if (bar != pi->pi_bar[idx - 1].addr >> 32) {
+					update_bar_address(pi, addr, idx - 1,
+							   PCIBAR_MEMHI64);
+				}
+				break;
+			default:
+				assert(0);
+			}
+			pci_set_cfgdata32(pi, coff, bar);
+
+		} else if (pci_emul_iscap(pi, coff)) {
+			pci_emul_capwrite(pi, coff, bytes, *eax);
+		} else if (coff >= PCIR_COMMAND && coff < PCIR_REVID) {
+			pci_emul_cmdsts_write(pi, coff, *eax, bytes);
+		} else {
+			CFGWRITE(pi, coff, *eax, bytes);
+		}
+	}
+}
+
+static int cfgenable, cfgbus, cfgslot, cfgfunc, cfgoff;
+
+static int
+pci_emul_cfgaddr(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+		 uint32_t *eax, void *arg)
+{
+	uint32_t x;
+
+	if (bytes != 4) {
+		if (in)
+			*eax = (bytes == 2) ? 0xffff : 0xff;
+		return (0);
+	}
+
+	if (in) {
+		x = (cfgbus << 16) | (cfgslot << 11) | (cfgfunc << 8) | cfgoff;
+		if (cfgenable)
+			x |= CONF1_ENABLE;
+		*eax = x;
+	} else {
+		x = *eax;
+		cfgenable = (x & CONF1_ENABLE) == CONF1_ENABLE;
+		cfgoff = x & PCI_REGMAX;
+		cfgfunc = (x >> 8) & PCI_FUNCMAX;
+		cfgslot = (x >> 11) & PCI_SLOTMAX;
+		cfgbus = (x >> 16) & PCI_BUSMAX;
+	}
+
+	return (0);
+}
+INOUT_PORT(pci_cfgaddr, CONF1_ADDR_PORT, IOPORT_F_INOUT, pci_emul_cfgaddr);
+
+static int
+pci_emul_cfgdata(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+		 uint32_t *eax, void *arg)
+{
+	int coff;
+
+	assert(bytes == 1 || bytes == 2 || bytes == 4);
+
+	coff = cfgoff + (port - CONF1_DATA_PORT);
+	if (cfgenable) {
+		pci_cfgrw(ctx, vcpu, in, cfgbus, cfgslot, cfgfunc, coff, bytes,
+		    eax);
+	} else {
+		/* Ignore accesses to cfgdata if not enabled by cfgaddr */
+		if (in)
+			*eax = 0xffffffff;
+	}
+	return (0);
+}
+
+INOUT_PORT(pci_cfgdata, CONF1_DATA_PORT+0, IOPORT_F_INOUT, pci_emul_cfgdata);
+INOUT_PORT(pci_cfgdata, CONF1_DATA_PORT+1, IOPORT_F_INOUT, pci_emul_cfgdata);
+INOUT_PORT(pci_cfgdata, CONF1_DATA_PORT+2, IOPORT_F_INOUT, pci_emul_cfgdata);
+INOUT_PORT(pci_cfgdata, CONF1_DATA_PORT+3, IOPORT_F_INOUT, pci_emul_cfgdata);
+
+#define PCI_EMUL_TEST
+#ifdef PCI_EMUL_TEST
+/*
+ * Define a dummy test device
+ */
+#define DIOSZ	8
+#define DMEMSZ	4096
+struct pci_emul_dsoftc {
+	uint8_t   ioregs[DIOSZ];
+	uint8_t	  memregs[2][DMEMSZ];
+};
+
+#define	PCI_EMUL_MSI_MSGS	 4
+#define	PCI_EMUL_MSIX_MSGS	16
+
+static int
+pci_emul_dinit(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	int error;
+	struct pci_emul_dsoftc *sc;
+
+	sc = calloc(1, sizeof(struct pci_emul_dsoftc));
+
+	pi->pi_arg = sc;
+
+	pci_set_cfgdata16(pi, PCIR_DEVICE, 0x0001);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, 0x10DD);
+	pci_set_cfgdata8(pi, PCIR_CLASS, 0x02);
+
+	error = pci_emul_add_msicap(pi, PCI_EMUL_MSI_MSGS);
+	assert(error == 0);
+
+	error = pci_emul_alloc_bar(pi, 0, PCIBAR_IO, DIOSZ);
+	assert(error == 0);
+
+	error = pci_emul_alloc_bar(pi, 1, PCIBAR_MEM32, DMEMSZ);
+	assert(error == 0);
+
+	error = pci_emul_alloc_bar(pi, 2, PCIBAR_MEM32, DMEMSZ);
+	assert(error == 0);
+
+	return (0);
+}
+
+static void
+pci_emul_diow(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+	      uint64_t offset, int size, uint64_t value)
+{
+	int i;
+	struct pci_emul_dsoftc *sc = pi->pi_arg;
+
+	if (baridx == 0) {
+		if (offset + size > DIOSZ) {
+			printf("diow: iow too large, offset %ld size %d\n",
+			       offset, size);
+			return;
+		}
+
+		if (size == 1) {
+			sc->ioregs[offset] = value & 0xff;
+		} else if (size == 2) {
+			*(uint16_t *)&sc->ioregs[offset] = value & 0xffff;
+		} else if (size == 4) {
+			*(uint32_t *)&sc->ioregs[offset] = value;
+		} else {
+			printf("diow: iow unknown size %d\n", size);
+		}
+
+		/*
+		 * Special magic value to generate an interrupt
+		 */
+		if (offset == 4 && size == 4 && pci_msi_enabled(pi))
+			pci_generate_msi(pi, value % pci_msi_maxmsgnum(pi));
+
+		if (value == 0xabcdef) {
+			for (i = 0; i < pci_msi_maxmsgnum(pi); i++)
+				pci_generate_msi(pi, i);
+		}
+	}
+
+	if (baridx == 1 || baridx == 2) {
+		if (offset + size > DMEMSZ) {
+			printf("diow: memw too large, offset %ld size %d\n",
+			       offset, size);
+			return;
+		}
+
+		i = baridx - 1;		/* 'memregs' index */
+
+		if (size == 1) {
+			sc->memregs[i][offset] = value;
+		} else if (size == 2) {
+			*(uint16_t *)&sc->memregs[i][offset] = value;
+		} else if (size == 4) {
+			*(uint32_t *)&sc->memregs[i][offset] = value;
+		} else if (size == 8) {
+			*(uint64_t *)&sc->memregs[i][offset] = value;
+		} else {
+			printf("diow: memw unknown size %d\n", size);
+		}
+		
+		/*
+		 * magic interrupt ??
+		 */
+	}
+
+	if (baridx > 2 || baridx < 0) {
+		printf("diow: unknown bar idx %d\n", baridx);
+	}
+}
+
+static uint64_t
+pci_emul_dior(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+	      uint64_t offset, int size)
+{
+	struct pci_emul_dsoftc *sc = pi->pi_arg;
+	uint32_t value;
+	int i;
+
+	value = 0;
+	if (baridx == 0) {
+		if (offset + size > DIOSZ) {
+			printf("dior: ior too large, offset %ld size %d\n",
+			       offset, size);
+			return (0);
+		}
+
+		if (size == 1) {
+			value = sc->ioregs[offset];
+		} else if (size == 2) {
+			value = *(uint16_t *) &sc->ioregs[offset];
+		} else if (size == 4) {
+			value = *(uint32_t *) &sc->ioregs[offset];
+		} else {
+			printf("dior: ior unknown size %d\n", size);
+		}
+	}
+
+	if (baridx == 1 || baridx == 2) {
+		if (offset + size > DMEMSZ) {
+			printf("dior: memr too large, offset %ld size %d\n",
+			       offset, size);
+			return (0);
+		}
+		
+		i = baridx - 1;		/* 'memregs' index */
+
+		if (size == 1) {
+			value = sc->memregs[i][offset];
+		} else if (size == 2) {
+			value = *(uint16_t *) &sc->memregs[i][offset];
+		} else if (size == 4) {
+			value = *(uint32_t *) &sc->memregs[i][offset];
+		} else if (size == 8) {
+			value = *(uint64_t *) &sc->memregs[i][offset];
+		} else {
+			printf("dior: ior unknown size %d\n", size);
+		}
+	}
+
+
+	if (baridx > 2 || baridx < 0) {
+		printf("dior: unknown bar idx %d\n", baridx);
+		return (0);
+	}
+
+	return (value);
+}
+
+struct pci_devemu pci_dummy = {
+	.pe_emu = "dummy",
+	.pe_init = pci_emul_dinit,
+	.pe_barwrite = pci_emul_diow,
+	.pe_barread = pci_emul_dior
+};
+PCI_EMUL_SET(pci_dummy);
+
+#endif /* PCI_EMUL_TEST */
diff --git a/usr/src/cmd/bhyve/pci_emul.h b/usr/src/cmd/bhyve/pci_emul.h
new file mode 100644
index 0000000000..0a1dd39f57
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_emul.h
@@ -0,0 +1,297 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _PCI_EMUL_H_
+#define _PCI_EMUL_H_
+
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <sys/kernel.h>
+#include <sys/_pthreadtypes.h>
+
+#include <dev/pci/pcireg.h>
+
+#include <assert.h>
+
+#define	PCI_BARMAX	PCIR_MAX_BAR_0	/* BAR registers in a Type 0 header */
+
+struct vmctx;
+struct pci_devinst;
+struct memory_region;
+
+struct pci_devemu {
+	char      *pe_emu;		/* Name of device emulation */
+
+	/* instance creation */
+	int       (*pe_init)(struct vmctx *, struct pci_devinst *,
+			     char *opts);
+
+	/* ACPI DSDT enumeration */
+	void	(*pe_write_dsdt)(struct pci_devinst *);
+
+	/* config space read/write callbacks */
+	int	(*pe_cfgwrite)(struct vmctx *ctx, int vcpu,
+			       struct pci_devinst *pi, int offset,
+			       int bytes, uint32_t val);
+	int	(*pe_cfgread)(struct vmctx *ctx, int vcpu,
+			      struct pci_devinst *pi, int offset,
+			      int bytes, uint32_t *retval);
+
+	/* BAR read/write callbacks */
+	void      (*pe_barwrite)(struct vmctx *ctx, int vcpu,
+				 struct pci_devinst *pi, int baridx,
+				 uint64_t offset, int size, uint64_t value);
+	uint64_t  (*pe_barread)(struct vmctx *ctx, int vcpu,
+				struct pci_devinst *pi, int baridx,
+				uint64_t offset, int size);
+
+#ifndef __FreeBSD__
+	void	(*pe_lintrupdate)(struct pci_devinst *pi);
+#endif /* __FreeBSD__ */
+};
+#define PCI_EMUL_SET(x)   DATA_SET(pci_devemu_set, x);
+
+enum pcibar_type {
+	PCIBAR_NONE,
+	PCIBAR_IO,
+	PCIBAR_MEM32,
+	PCIBAR_MEM64,
+	PCIBAR_MEMHI64
+};
+
+struct pcibar {
+	enum pcibar_type	type;		/* io or memory */
+	uint64_t		size;
+	uint64_t		addr;
+};
+
+#define PI_NAMESZ	40
+
+struct msix_table_entry {
+	uint64_t	addr;
+	uint32_t	msg_data;
+	uint32_t	vector_control;
+} __packed;
+
+/* 
+ * In case the structure is modified to hold extra information, use a define
+ * for the size that should be emulated.
+ */
+#define	MSIX_TABLE_ENTRY_SIZE	16
+#define MAX_MSIX_TABLE_ENTRIES	2048
+#define	PBA_SIZE(msgnum)	(roundup2((msgnum), 64) / 8)
+
+enum lintr_stat {
+	IDLE,
+	ASSERTED,
+	PENDING
+};
+
+struct pci_devinst {
+	struct pci_devemu *pi_d;
+	struct vmctx *pi_vmctx;
+	uint8_t	  pi_bus, pi_slot, pi_func;
+	char	  pi_name[PI_NAMESZ];
+	int	  pi_bar_getsize;
+	int	  pi_prevcap;
+	int	  pi_capend;
+
+	struct {
+		int8_t    	pin;
+		enum lintr_stat	state;
+		int		pirq_pin;
+		int	  	ioapic_irq;
+		pthread_mutex_t	lock;
+	} pi_lintr;
+
+	struct {
+		int		enabled;
+		uint64_t	addr;
+		uint64_t	msg_data;
+		int		maxmsgnum;
+	} pi_msi;
+
+	struct {
+		int	enabled;
+		int	table_bar;
+		int	pba_bar;
+		uint32_t table_offset;
+		int	table_count;
+		uint32_t pba_offset;
+		int	pba_size;
+		int	function_mask; 	
+		struct msix_table_entry *table;	/* allocated at runtime */
+		void	*pba_page;
+		int	pba_page_offset;
+	} pi_msix;
+
+	void      *pi_arg;		/* devemu-private data */
+
+	u_char	  pi_cfgdata[PCI_REGMAX + 1];
+	struct pcibar pi_bar[PCI_BARMAX + 1];
+};
+
+struct msicap {
+	uint8_t		capid;
+	uint8_t		nextptr;
+	uint16_t	msgctrl;
+	uint32_t	addrlo;
+	uint32_t	addrhi;
+	uint16_t	msgdata;
+} __packed;
+static_assert(sizeof(struct msicap) == 14, "compile-time assertion failed");
+
+struct msixcap {
+	uint8_t		capid;
+	uint8_t		nextptr;
+	uint16_t	msgctrl;
+	uint32_t	table_info;	/* bar index and offset within it */
+	uint32_t	pba_info;	/* bar index and offset within it */
+} __packed;
+static_assert(sizeof(struct msixcap) == 12, "compile-time assertion failed");
+
+struct pciecap {
+	uint8_t		capid;
+	uint8_t		nextptr;
+	uint16_t	pcie_capabilities;
+
+	uint32_t	dev_capabilities;	/* all devices */
+	uint16_t	dev_control;
+	uint16_t	dev_status;
+
+	uint32_t	link_capabilities;	/* devices with links */
+	uint16_t	link_control;
+	uint16_t	link_status;
+
+	uint32_t	slot_capabilities;	/* ports with slots */
+	uint16_t	slot_control;
+	uint16_t	slot_status;
+
+	uint16_t	root_control;		/* root ports */
+	uint16_t	root_capabilities;
+	uint32_t	root_status;
+
+	uint32_t	dev_capabilities2;	/* all devices */
+	uint16_t	dev_control2;
+	uint16_t	dev_status2;
+
+	uint32_t	link_capabilities2;	/* devices with links */
+	uint16_t	link_control2;
+	uint16_t	link_status2;
+
+	uint32_t	slot_capabilities2;	/* ports with slots */
+	uint16_t	slot_control2;
+	uint16_t	slot_status2;
+} __packed;
+static_assert(sizeof(struct pciecap) == 60, "compile-time assertion failed");
+
+typedef void (*pci_lintr_cb)(int b, int s, int pin, int pirq_pin,
+    int ioapic_irq, void *arg);
+
+int	init_pci(struct vmctx *ctx);
+void	msicap_cfgwrite(struct pci_devinst *pi, int capoff, int offset,
+	    int bytes, uint32_t val);
+void	msixcap_cfgwrite(struct pci_devinst *pi, int capoff, int offset,
+	    int bytes, uint32_t val);
+void	pci_callback(void);
+int	pci_emul_alloc_bar(struct pci_devinst *pdi, int idx,
+	    enum pcibar_type type, uint64_t size);
+int	pci_emul_alloc_pbar(struct pci_devinst *pdi, int idx,
+	    uint64_t hostbase, enum pcibar_type type, uint64_t size);
+int	pci_emul_add_msicap(struct pci_devinst *pi, int msgnum);
+int	pci_emul_add_pciecap(struct pci_devinst *pi, int pcie_device_type);
+void	pci_generate_msi(struct pci_devinst *pi, int msgnum);
+void	pci_generate_msix(struct pci_devinst *pi, int msgnum);
+void	pci_lintr_assert(struct pci_devinst *pi);
+void	pci_lintr_deassert(struct pci_devinst *pi);
+void	pci_lintr_request(struct pci_devinst *pi);
+int	pci_msi_enabled(struct pci_devinst *pi);
+int	pci_msix_enabled(struct pci_devinst *pi);
+int	pci_msix_table_bar(struct pci_devinst *pi);
+int	pci_msix_pba_bar(struct pci_devinst *pi);
+int	pci_msi_maxmsgnum(struct pci_devinst *pi);
+int	pci_parse_slot(char *opt);
+void	pci_populate_msicap(struct msicap *cap, int msgs, int nextptr);
+int	pci_emul_add_msixcap(struct pci_devinst *pi, int msgnum, int barnum);
+int	pci_emul_msix_twrite(struct pci_devinst *pi, uint64_t offset, int size,
+			     uint64_t value);
+uint64_t pci_emul_msix_tread(struct pci_devinst *pi, uint64_t offset, int size);
+int	pci_count_lintr(int bus);
+void	pci_walk_lintr(int bus, pci_lintr_cb cb, void *arg);
+void	pci_write_dsdt(void);
+uint64_t pci_ecfg_base(void);
+int	pci_bus_configured(int bus);
+
+static __inline void 
+pci_set_cfgdata8(struct pci_devinst *pi, int offset, uint8_t val)
+{
+	assert(offset <= PCI_REGMAX);
+	*(uint8_t *)(pi->pi_cfgdata + offset) = val;
+}
+
+static __inline void 
+pci_set_cfgdata16(struct pci_devinst *pi, int offset, uint16_t val)
+{
+	assert(offset <= (PCI_REGMAX - 1) && (offset & 1) == 0);
+	*(uint16_t *)(pi->pi_cfgdata + offset) = val;
+}
+
+static __inline void 
+pci_set_cfgdata32(struct pci_devinst *pi, int offset, uint32_t val)
+{
+	assert(offset <= (PCI_REGMAX - 3) && (offset & 3) == 0);
+	*(uint32_t *)(pi->pi_cfgdata + offset) = val;
+}
+
+static __inline uint8_t
+pci_get_cfgdata8(struct pci_devinst *pi, int offset)
+{
+	assert(offset <= PCI_REGMAX);
+	return (*(uint8_t *)(pi->pi_cfgdata + offset));
+}
+
+static __inline uint16_t
+pci_get_cfgdata16(struct pci_devinst *pi, int offset)
+{
+	assert(offset <= (PCI_REGMAX - 1) && (offset & 1) == 0);
+	return (*(uint16_t *)(pi->pi_cfgdata + offset));
+}
+
+static __inline uint32_t
+pci_get_cfgdata32(struct pci_devinst *pi, int offset)
+{
+	assert(offset <= (PCI_REGMAX - 3) && (offset & 3) == 0);
+	return (*(uint32_t *)(pi->pi_cfgdata + offset));
+}
+
+#endif /* _PCI_EMUL_H_ */
diff --git a/usr/src/cmd/bhyve/pci_fbuf.c b/usr/src/cmd/bhyve/pci_fbuf.c
new file mode 100644
index 0000000000..8478f6e531
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_fbuf.c
@@ -0,0 +1,444 @@
+/*-
+ * Copyright (c) 2015 Nahanni Systems, Inc.
+ * Copyright 2018 Joyent, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/mman.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <errno.h>
+#include <unistd.h>
+
+#include "bhyvegc.h"
+#include "bhyverun.h"
+#include "console.h"
+#include "inout.h"
+#include "pci_emul.h"
+#include "rfb.h"
+#include "vga.h"
+
+/*
+ * bhyve Framebuffer device emulation.
+ * BAR0 points to the current mode information.
+ * BAR1 is the 32-bit framebuffer address.
+ *
+ *  -s <b>,fbuf,wait,vga=on|io|off,rfb=<ip>:port,w=width,h=height
+ */
+
+static int fbuf_debug = 1;
+#define	DEBUG_INFO	1
+#define	DEBUG_VERBOSE	4
+#define	DPRINTF(level, params)  if (level <= fbuf_debug) printf params
+
+
+#define	KB	(1024UL)
+#define	MB	(1024 * 1024UL)
+
+#define	DMEMSZ	128
+
+#define	FB_SIZE		(16*MB)
+
+#define COLS_MAX	1920
+#define	ROWS_MAX	1200
+
+#define COLS_DEFAULT	1024
+#define ROWS_DEFAULT	768
+
+#define COLS_MIN	640
+#define ROWS_MIN	480
+
+struct pci_fbuf_softc {
+	struct pci_devinst *fsc_pi;
+	struct {
+		uint32_t fbsize;
+		uint16_t width;
+		uint16_t height;
+		uint16_t depth;
+		uint16_t refreshrate;
+		uint8_t  reserved[116];
+	} __packed memregs;
+
+	/* rfb server */
+	char      *rfb_host;
+	char      *rfb_password;
+	int       rfb_port;
+#ifndef __FreeBSD__
+	char	  *rfb_unix;
+#endif
+	int       rfb_wait;
+	int       vga_enabled;
+	int	  vga_full;
+
+	uint32_t  fbaddr;
+	char      *fb_base;
+	uint16_t  gc_width;
+	uint16_t  gc_height;
+	void      *vgasc;
+	struct bhyvegc_image *gc_image;
+};
+
+static struct pci_fbuf_softc *fbuf_sc;
+
+#define	PCI_FBUF_MSI_MSGS	 4
+
+static void
+pci_fbuf_usage(char *opt)
+{
+
+	fprintf(stderr, "Invalid fbuf emulation \"%s\"\r\n", opt);
+	fprintf(stderr, "fbuf: {wait,}{vga=on|io|off,}rfb=<ip>:port\r\n");
+}
+
+static void
+pci_fbuf_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	       int baridx, uint64_t offset, int size, uint64_t value)
+{
+	struct pci_fbuf_softc *sc;
+	uint8_t *p;
+
+	assert(baridx == 0);
+
+	sc = pi->pi_arg;
+
+	DPRINTF(DEBUG_VERBOSE,
+	    ("fbuf wr: offset 0x%lx, size: %d, value: 0x%lx\n",
+	    offset, size, value));
+
+	if (offset + size > DMEMSZ) {
+		printf("fbuf: write too large, offset %ld size %d\n",
+		       offset, size);
+		return;
+	}
+
+	p = (uint8_t *)&sc->memregs + offset;
+
+	switch (size) {
+	case 1:
+		*p = value;
+		break;
+	case 2:
+		*(uint16_t *)p = value;
+		break;
+	case 4:
+		*(uint32_t *)p = value;
+		break;
+	case 8:
+		*(uint64_t *)p = value;
+		break;
+	default:
+		printf("fbuf: write unknown size %d\n", size);
+		break;
+	}
+
+	if (!sc->gc_image->vgamode && sc->memregs.width == 0 &&
+	    sc->memregs.height == 0) {
+		DPRINTF(DEBUG_INFO, ("switching to VGA mode\r\n"));
+		sc->gc_image->vgamode = 1;
+		sc->gc_width = 0;
+		sc->gc_height = 0;
+	} else if (sc->gc_image->vgamode && sc->memregs.width != 0 &&
+	    sc->memregs.height != 0) {
+		DPRINTF(DEBUG_INFO, ("switching to VESA mode\r\n"));
+		sc->gc_image->vgamode = 0;
+	}
+}
+
+uint64_t
+pci_fbuf_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	      int baridx, uint64_t offset, int size)
+{
+	struct pci_fbuf_softc *sc;
+	uint8_t *p;
+	uint64_t value;
+
+	assert(baridx == 0);
+
+	sc = pi->pi_arg;
+
+
+	if (offset + size > DMEMSZ) {
+		printf("fbuf: read too large, offset %ld size %d\n",
+		       offset, size);
+		return (0);
+	}
+
+	p = (uint8_t *)&sc->memregs + offset;
+	value = 0;
+	switch (size) {
+	case 1:
+		value = *p;
+		break;
+	case 2:
+		value = *(uint16_t *)p;
+		break;
+	case 4:
+		value = *(uint32_t *)p;
+		break;
+	case 8:
+		value = *(uint64_t *)p;
+		break;
+	default:
+		printf("fbuf: read unknown size %d\n", size);
+		break;
+	}
+
+	DPRINTF(DEBUG_VERBOSE,
+	    ("fbuf rd: offset 0x%lx, size: %d, value: 0x%lx\n",
+	     offset, size, value));
+
+	return (value);
+}
+
+static int
+pci_fbuf_parse_opts(struct pci_fbuf_softc *sc, char *opts)
+{
+	char	*uopts, *xopts, *config;
+	char	*tmpstr;
+	int	ret;
+
+	ret = 0;
+	uopts = strdup(opts);
+	for (xopts = strtok(uopts, ",");
+	     xopts != NULL;
+	     xopts = strtok(NULL, ",")) {
+		if (strcmp(xopts, "wait") == 0) {
+			sc->rfb_wait = 1;
+			continue;
+		}
+
+		if ((config = strchr(xopts, '=')) == NULL) {
+			pci_fbuf_usage(xopts);
+			ret = -1;
+			goto done;
+		}
+
+		*config++ = '\0';
+
+		DPRINTF(DEBUG_VERBOSE, ("pci_fbuf option %s = %s\r\n",
+		   xopts, config));
+
+		if (!strcmp(xopts, "tcp") || !strcmp(xopts, "rfb")) {
+			/* parse host-ip:port */
+		        tmpstr = strsep(&config, ":");
+			if (!config)
+				sc->rfb_port = atoi(tmpstr);
+			else {
+				sc->rfb_port = atoi(config);
+				sc->rfb_host = tmpstr;
+			}
+#ifndef __FreeBSD__
+		} else if (!strcmp(xopts, "unix")) {
+			sc->rfb_unix = config;
+#endif
+	        } else if (!strcmp(xopts, "vga")) {
+			if (!strcmp(config, "off")) {
+				sc->vga_enabled = 0;
+			} else if (!strcmp(config, "io")) {
+				sc->vga_enabled = 1;
+				sc->vga_full = 0;
+			} else if (!strcmp(config, "on")) {
+				sc->vga_enabled = 1;
+				sc->vga_full = 1;
+			} else {
+				pci_fbuf_usage(opts);
+				ret = -1;
+				goto done;
+			}
+	        } else if (!strcmp(xopts, "w")) {
+		        sc->memregs.width = atoi(config);
+			if (sc->memregs.width > COLS_MAX) {
+				pci_fbuf_usage(xopts);
+				ret = -1;
+				goto done;
+			} else if (sc->memregs.width == 0)
+				sc->memregs.width = 1920;
+		} else if (!strcmp(xopts, "h")) {
+			sc->memregs.height = atoi(config);
+			if (sc->memregs.height > ROWS_MAX) {
+				pci_fbuf_usage(xopts);
+				ret = -1;
+				goto done;
+			} else if (sc->memregs.height == 0)
+				sc->memregs.height = 1080;
+		} else if (!strcmp(xopts, "password")) {
+			sc->rfb_password = config;
+		} else {
+			pci_fbuf_usage(xopts);
+			ret = -1;
+			goto done;
+		}
+	}
+
+done:
+	return (ret);
+}
+
+
+extern void vga_render(struct bhyvegc *gc, void *arg);
+
+void
+pci_fbuf_render(struct bhyvegc *gc, void *arg)
+{
+	struct pci_fbuf_softc *sc;
+
+	sc = arg;
+
+	if (sc->vga_full && sc->gc_image->vgamode) {
+		/* TODO: mode switching to vga and vesa should use the special
+		 *      EFI-bhyve protocol port.
+		 */
+		vga_render(gc, sc->vgasc);
+		return;
+	}
+	if (sc->gc_width != sc->memregs.width ||
+	    sc->gc_height != sc->memregs.height) {
+		bhyvegc_resize(gc, sc->memregs.width, sc->memregs.height);
+		sc->gc_width = sc->memregs.width;
+		sc->gc_height = sc->memregs.height;
+	}
+
+	return;
+}
+
+static int
+pci_fbuf_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	int error, prot;
+	struct pci_fbuf_softc *sc;
+	
+	if (fbuf_sc != NULL) {
+		fprintf(stderr, "Only one frame buffer device is allowed.\n");
+		return (-1);
+	}
+
+	sc = calloc(1, sizeof(struct pci_fbuf_softc));
+
+	pi->pi_arg = sc;
+
+	/* initialize config space */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, 0x40FB);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, 0xFB5D);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_DISPLAY);
+	pci_set_cfgdata8(pi, PCIR_SUBCLASS, PCIS_DISPLAY_VGA);
+
+	error = pci_emul_alloc_bar(pi, 0, PCIBAR_MEM32, DMEMSZ);
+	assert(error == 0);
+
+	error = pci_emul_alloc_bar(pi, 1, PCIBAR_MEM32, FB_SIZE);
+	assert(error == 0);
+
+	error = pci_emul_add_msicap(pi, PCI_FBUF_MSI_MSGS);
+	assert(error == 0);
+
+	sc->fbaddr = pi->pi_bar[1].addr;
+	sc->memregs.fbsize = FB_SIZE;
+	sc->memregs.width  = COLS_DEFAULT;
+	sc->memregs.height = ROWS_DEFAULT;
+	sc->memregs.depth  = 32;
+
+	sc->vga_enabled = 1;
+	sc->vga_full = 0;
+
+	sc->fsc_pi = pi;
+
+	error = pci_fbuf_parse_opts(sc, opts);
+	if (error != 0)
+		goto done;
+
+	/* XXX until VGA rendering is enabled */
+	if (sc->vga_full != 0) {
+		fprintf(stderr, "pci_fbuf: VGA rendering not enabled");
+		goto done;
+	}
+
+	sc->fb_base = vm_create_devmem(ctx, VM_FRAMEBUFFER, "framebuffer", FB_SIZE);
+	if (sc->fb_base == MAP_FAILED) {
+		error = -1;
+		goto done;
+	}
+	DPRINTF(DEBUG_INFO, ("fbuf frame buffer base: %p [sz %lu]\r\n",
+	        sc->fb_base, FB_SIZE));
+
+	/*
+	 * Map the framebuffer into the guest address space.
+	 * XXX This may fail if the BAR is different than a prior
+	 * run. In this case flag the error. This will be fixed
+	 * when a change_memseg api is available.
+	 */
+	prot = PROT_READ | PROT_WRITE;
+	if (vm_mmap_memseg(ctx, sc->fbaddr, VM_FRAMEBUFFER, 0, FB_SIZE, prot) != 0) {
+		fprintf(stderr, "pci_fbuf: mapseg failed - try deleting VM and restarting\n");
+		error = -1;
+		goto done;
+	}
+
+	console_init(sc->memregs.width, sc->memregs.height, sc->fb_base);
+	console_fb_register(pci_fbuf_render, sc);
+
+	if (sc->vga_enabled)
+		sc->vgasc = vga_init(!sc->vga_full);
+	sc->gc_image = console_get_image();
+
+	fbuf_sc = sc;
+
+	memset((void *)sc->fb_base, 0, FB_SIZE);
+
+#ifdef __FreeBSD__
+	error = rfb_init(sc->rfb_host, sc->rfb_port, sc->rfb_wait, sc->rfb_password);
+#else
+	if (sc->rfb_unix != NULL) {
+		error = rfb_init_unix(sc->rfb_unix, sc->rfb_wait,
+		    sc->rfb_password);
+	} else {
+		error = rfb_init(sc->rfb_host, sc->rfb_port, sc->rfb_wait,
+		    sc->rfb_password);
+	}
+#endif
+done:
+	if (error)
+		free(sc);
+
+	return (error);
+}
+
+struct pci_devemu pci_fbuf = {
+	.pe_emu =	"fbuf",
+	.pe_init =	pci_fbuf_init,
+	.pe_barwrite =	pci_fbuf_write,
+	.pe_barread =	pci_fbuf_read
+};
+PCI_EMUL_SET(pci_fbuf);
diff --git a/usr/src/cmd/bhyve/pci_hostbridge.c b/usr/src/cmd/bhyve/pci_hostbridge.c
new file mode 100644
index 0000000000..559496a9fe
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_hostbridge.c
@@ -0,0 +1,72 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include "pci_emul.h"
+
+static int
+pci_hostbridge_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+
+	/* config space */
+	pci_set_cfgdata16(pi, PCIR_VENDOR, 0x1275);	/* NetApp */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, 0x1275);	/* NetApp */
+	pci_set_cfgdata8(pi, PCIR_HDRTYPE, PCIM_HDRTYPE_NORMAL);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_BRIDGE);
+	pci_set_cfgdata8(pi, PCIR_SUBCLASS, PCIS_BRIDGE_HOST);
+
+	pci_emul_add_pciecap(pi, PCIEM_TYPE_ROOT_PORT);
+
+	return (0);
+}
+
+static int
+pci_amd_hostbridge_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	(void) pci_hostbridge_init(ctx, pi, opts);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, 0x1022);	/* AMD */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, 0x7432);	/* made up */
+
+	return (0);
+}
+
+struct pci_devemu pci_de_amd_hostbridge = {
+	.pe_emu = "amd_hostbridge",
+	.pe_init = pci_amd_hostbridge_init,
+};
+PCI_EMUL_SET(pci_de_amd_hostbridge);
+
+struct pci_devemu pci_de_hostbridge = {
+	.pe_emu = "hostbridge",
+	.pe_init = pci_hostbridge_init,
+};
+PCI_EMUL_SET(pci_de_hostbridge);
diff --git a/usr/src/cmd/bhyve/pci_irq.c b/usr/src/cmd/bhyve/pci_irq.c
new file mode 100644
index 0000000000..4ae9ff3582
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_irq.c
@@ -0,0 +1,352 @@
+/*-
+ * Copyright (c) 2014 Hudson River Trading LLC
+ * Written by: John H. Baldwin <jhb@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <machine/vmm.h>
+
+#include <assert.h>
+#include <pthread.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <vmmapi.h>
+
+#include "acpi.h"
+#include "inout.h"
+#include "pci_emul.h"
+#include "pci_irq.h"
+#include "pci_lpc.h"
+
+/*
+ * Implement an 8 pin PCI interrupt router compatible with the router
+ * present on Intel's ICH10 chip.
+ */
+
+/* Fields in each PIRQ register. */
+#define	PIRQ_DIS	0x80
+#define	PIRQ_IRQ	0x0f
+
+/* Only IRQs 3-7, 9-12, and 14-15 are permitted. */
+#define	PERMITTED_IRQS	0xdef8
+#define	IRQ_PERMITTED(irq)	(((1U << (irq)) & PERMITTED_IRQS) != 0)
+
+/* IRQ count to disable an IRQ. */
+#define	IRQ_DISABLED	0xff
+
+static struct pirq {
+	uint8_t	reg;
+	int	use_count;
+	int	active_count;
+	pthread_mutex_t lock;
+} pirqs[8];
+
+static u_char irq_counts[16];
+static int pirq_cold = 1;
+
+/*
+ * Returns true if this pin is enabled with a valid IRQ.  Setting the
+ * register to a reserved IRQ causes interrupts to not be asserted as
+ * if the pin was disabled.
+ */
+static bool
+pirq_valid_irq(int reg)
+{
+
+	if (reg & PIRQ_DIS)
+		return (false);
+	return (IRQ_PERMITTED(reg & PIRQ_IRQ));
+}
+
+uint8_t
+pirq_read(int pin)
+{
+
+	assert(pin > 0 && pin <= nitems(pirqs));
+	return (pirqs[pin - 1].reg);
+}
+
+void
+pirq_write(struct vmctx *ctx, int pin, uint8_t val)
+{
+	struct pirq *pirq;
+
+	assert(pin > 0 && pin <= nitems(pirqs));
+	pirq = &pirqs[pin - 1];
+	pthread_mutex_lock(&pirq->lock);
+	if (pirq->reg != (val & (PIRQ_DIS | PIRQ_IRQ))) {
+		if (pirq->active_count != 0 && pirq_valid_irq(pirq->reg))
+			vm_isa_deassert_irq(ctx, pirq->reg & PIRQ_IRQ, -1);
+		pirq->reg = val & (PIRQ_DIS | PIRQ_IRQ);
+		if (pirq->active_count != 0 && pirq_valid_irq(pirq->reg))
+			vm_isa_assert_irq(ctx, pirq->reg & PIRQ_IRQ, -1);
+	}
+	pthread_mutex_unlock(&pirq->lock);
+}
+
+void
+pci_irq_reserve(int irq)
+{
+
+	assert(irq >= 0 && irq < nitems(irq_counts));
+	assert(pirq_cold);
+	assert(irq_counts[irq] == 0 || irq_counts[irq] == IRQ_DISABLED);
+	irq_counts[irq] = IRQ_DISABLED;
+}
+
+void
+pci_irq_use(int irq)
+{
+
+	assert(irq >= 0 && irq < nitems(irq_counts));
+	assert(pirq_cold);
+	assert(irq_counts[irq] != IRQ_DISABLED);
+	irq_counts[irq]++;
+}
+
+void
+pci_irq_init(struct vmctx *ctx)
+{
+	int i;
+
+	for (i = 0; i < nitems(pirqs); i++) {
+		pirqs[i].reg = PIRQ_DIS;
+		pirqs[i].use_count = 0;
+		pirqs[i].active_count = 0;
+		pthread_mutex_init(&pirqs[i].lock, NULL);
+	}
+	for (i = 0; i < nitems(irq_counts); i++) {
+		if (IRQ_PERMITTED(i))
+			irq_counts[i] = 0;
+		else
+			irq_counts[i] = IRQ_DISABLED;
+	}
+}
+
+void
+pci_irq_assert(struct pci_devinst *pi)
+{
+	struct pirq *pirq;
+
+	if (pi->pi_lintr.pirq_pin > 0) {
+		assert(pi->pi_lintr.pirq_pin <= nitems(pirqs));
+		pirq = &pirqs[pi->pi_lintr.pirq_pin - 1];
+		pthread_mutex_lock(&pirq->lock);
+		pirq->active_count++;
+		if (pirq->active_count == 1 && pirq_valid_irq(pirq->reg)) {
+			vm_isa_assert_irq(pi->pi_vmctx, pirq->reg & PIRQ_IRQ,
+			    pi->pi_lintr.ioapic_irq);
+			pthread_mutex_unlock(&pirq->lock);
+			return;
+		}
+		pthread_mutex_unlock(&pirq->lock);
+	}
+	vm_ioapic_assert_irq(pi->pi_vmctx, pi->pi_lintr.ioapic_irq);
+}
+
+void
+pci_irq_deassert(struct pci_devinst *pi)
+{
+	struct pirq *pirq;
+
+	if (pi->pi_lintr.pirq_pin > 0) {
+		assert(pi->pi_lintr.pirq_pin <= nitems(pirqs));
+		pirq = &pirqs[pi->pi_lintr.pirq_pin - 1];
+		pthread_mutex_lock(&pirq->lock);
+		pirq->active_count--;
+		if (pirq->active_count == 0 && pirq_valid_irq(pirq->reg)) {
+			vm_isa_deassert_irq(pi->pi_vmctx, pirq->reg & PIRQ_IRQ,
+			    pi->pi_lintr.ioapic_irq);
+			pthread_mutex_unlock(&pirq->lock);
+			return;
+		}
+		pthread_mutex_unlock(&pirq->lock);
+	}
+	vm_ioapic_deassert_irq(pi->pi_vmctx, pi->pi_lintr.ioapic_irq);
+}
+
+int
+pirq_alloc_pin(struct pci_devinst *pi)
+{
+	struct vmctx *ctx = pi->pi_vmctx;
+	int best_count, best_irq, best_pin, irq, pin;
+
+	pirq_cold = 0;
+
+	if (lpc_bootrom()) {
+		/* For external bootrom use fixed mapping. */
+		best_pin = (4 + pi->pi_slot + pi->pi_lintr.pin) % 8;
+	} else {
+		/* Find the least-used PIRQ pin. */
+		best_pin = 0;
+		best_count = pirqs[0].use_count;
+		for (pin = 1; pin < nitems(pirqs); pin++) {
+			if (pirqs[pin].use_count < best_count) {
+				best_pin = pin;
+				best_count = pirqs[pin].use_count;
+			}
+		}
+	}
+	pirqs[best_pin].use_count++;
+
+	/* Second, route this pin to an IRQ. */
+	if (pirqs[best_pin].reg == PIRQ_DIS) {
+		best_irq = -1;
+		best_count = 0;
+		for (irq = 0; irq < nitems(irq_counts); irq++) {
+			if (irq_counts[irq] == IRQ_DISABLED)
+				continue;
+			if (best_irq == -1 || irq_counts[irq] < best_count) {
+				best_irq = irq;
+				best_count = irq_counts[irq];
+			}
+		}
+		assert(best_irq >= 0);
+		irq_counts[best_irq]++;
+		pirqs[best_pin].reg = best_irq;
+		vm_isa_set_irq_trigger(ctx, best_irq, LEVEL_TRIGGER);
+	}
+
+	return (best_pin + 1);
+}
+
+int
+pirq_irq(int pin)
+{
+	assert(pin > 0 && pin <= nitems(pirqs));
+	return (pirqs[pin - 1].reg & PIRQ_IRQ);
+}
+
+/* XXX: Generate $PIR table. */
+
+static void
+pirq_dsdt(void)
+{
+	char *irq_prs, *old;
+	int irq, pin;
+
+	irq_prs = NULL;
+	for (irq = 0; irq < nitems(irq_counts); irq++) {
+		if (!IRQ_PERMITTED(irq))
+			continue;
+		if (irq_prs == NULL)
+			asprintf(&irq_prs, "%d", irq);
+		else {
+			old = irq_prs;
+			asprintf(&irq_prs, "%s,%d", old, irq);
+			free(old);
+		}
+	}
+
+	/*
+	 * A helper method to validate a link register's value.  This
+	 * duplicates pirq_valid_irq().
+	 */
+	dsdt_line("");
+	dsdt_line("Method (PIRV, 1, NotSerialized)");
+	dsdt_line("{");
+	dsdt_line("  If (And (Arg0, 0x%02X))", PIRQ_DIS);
+	dsdt_line("  {");
+	dsdt_line("    Return (0x00)");
+	dsdt_line("  }");
+	dsdt_line("  And (Arg0, 0x%02X, Local0)", PIRQ_IRQ);
+	dsdt_line("  If (LLess (Local0, 0x03))");
+	dsdt_line("  {");
+	dsdt_line("    Return (0x00)");
+	dsdt_line("  }");
+	dsdt_line("  If (LEqual (Local0, 0x08))");
+	dsdt_line("  {");
+	dsdt_line("    Return (0x00)");
+	dsdt_line("  }");
+	dsdt_line("  If (LEqual (Local0, 0x0D))");
+	dsdt_line("  {");
+	dsdt_line("    Return (0x00)");
+	dsdt_line("  }");
+	dsdt_line("  Return (0x01)");
+	dsdt_line("}");
+
+	for (pin = 0; pin < nitems(pirqs); pin++) {
+		dsdt_line("");
+		dsdt_line("Device (LNK%c)", 'A' + pin);
+		dsdt_line("{");
+		dsdt_line("  Name (_HID, EisaId (\"PNP0C0F\"))");
+		dsdt_line("  Name (_UID, 0x%02X)", pin + 1);
+		dsdt_line("  Method (_STA, 0, NotSerialized)");
+		dsdt_line("  {");
+		dsdt_line("    If (PIRV (PIR%c))", 'A' + pin);
+		dsdt_line("    {");
+		dsdt_line("       Return (0x0B)");
+		dsdt_line("    }");
+		dsdt_line("    Else");
+		dsdt_line("    {");
+		dsdt_line("       Return (0x09)");
+		dsdt_line("    }");
+		dsdt_line("  }");
+		dsdt_line("  Name (_PRS, ResourceTemplate ()");
+		dsdt_line("  {");
+		dsdt_line("    IRQ (Level, ActiveLow, Shared, )");
+		dsdt_line("      {%s}", irq_prs);
+		dsdt_line("  })");
+		dsdt_line("  Name (CB%02X, ResourceTemplate ()", pin + 1);
+		dsdt_line("  {");
+		dsdt_line("    IRQ (Level, ActiveLow, Shared, )");
+		dsdt_line("      {}");
+		dsdt_line("  })");
+		dsdt_line("  CreateWordField (CB%02X, 0x01, CIR%c)",
+		    pin + 1, 'A' + pin);
+		dsdt_line("  Method (_CRS, 0, NotSerialized)");
+		dsdt_line("  {");
+		dsdt_line("    And (PIR%c, 0x%02X, Local0)", 'A' + pin,
+		    PIRQ_DIS | PIRQ_IRQ);
+		dsdt_line("    If (PIRV (Local0))");
+		dsdt_line("    {");
+		dsdt_line("      ShiftLeft (0x01, Local0, CIR%c)", 'A' + pin);
+		dsdt_line("    }");
+		dsdt_line("    Else");
+		dsdt_line("    {");
+		dsdt_line("      Store (0x00, CIR%c)", 'A' + pin);
+		dsdt_line("    }");
+		dsdt_line("    Return (CB%02X)", pin + 1);
+		dsdt_line("  }");
+		dsdt_line("  Method (_DIS, 0, NotSerialized)");
+		dsdt_line("  {");
+		dsdt_line("    Store (0x80, PIR%c)", 'A' + pin);
+		dsdt_line("  }");
+		dsdt_line("  Method (_SRS, 1, NotSerialized)");
+		dsdt_line("  {");
+		dsdt_line("    CreateWordField (Arg0, 0x01, SIR%c)", 'A' + pin);
+		dsdt_line("    FindSetRightBit (SIR%c, Local0)", 'A' + pin);
+		dsdt_line("    Store (Decrement (Local0), PIR%c)", 'A' + pin);
+		dsdt_line("  }");
+		dsdt_line("}");
+	}
+	free(irq_prs);
+}
+LPC_DSDT(pirq_dsdt);
diff --git a/usr/src/cmd/bhyve/pci_irq.h b/usr/src/cmd/bhyve/pci_irq.h
new file mode 100644
index 0000000000..aa1a6c356b
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_irq.h
@@ -0,0 +1,45 @@
+/*-
+ * Copyright (c) 2014 Hudson River Trading LLC
+ * Written by: John H. Baldwin <jhb@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef __PCI_IRQ_H__
+#define	__PCI_IRQ_H__
+
+struct pci_devinst;
+
+void	pci_irq_assert(struct pci_devinst *pi);
+void	pci_irq_deassert(struct pci_devinst *pi);
+void	pci_irq_init(struct vmctx *ctx);
+void	pci_irq_reserve(int irq);
+void	pci_irq_use(int irq);
+int	pirq_alloc_pin(struct pci_devinst *pi);
+int	pirq_irq(int pin);
+uint8_t	pirq_read(int pin);
+void	pirq_write(struct vmctx *ctx, int pin, uint8_t val);
+
+#endif
diff --git a/usr/src/cmd/bhyve/pci_lpc.c b/usr/src/cmd/bhyve/pci_lpc.c
new file mode 100644
index 0000000000..70bfed96f6
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_lpc.c
@@ -0,0 +1,471 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * Copyright (c) 2013 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <machine/vmm.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <vmmapi.h>
+
+#include "acpi.h"
+#include "bootrom.h"
+#include "inout.h"
+#include "pci_emul.h"
+#include "pci_irq.h"
+#include "pci_lpc.h"
+#include "uart_emul.h"
+
+#define	IO_ICU1		0x20
+#define	IO_ICU2		0xA0
+
+SET_DECLARE(lpc_dsdt_set, struct lpc_dsdt);
+SET_DECLARE(lpc_sysres_set, struct lpc_sysres);
+
+#define	ELCR_PORT	0x4d0
+SYSRES_IO(ELCR_PORT, 2);
+
+#define	IO_TIMER1_PORT	0x40
+
+#define	NMISC_PORT	0x61
+SYSRES_IO(NMISC_PORT, 1);
+
+static struct pci_devinst *lpc_bridge;
+
+static const char *romfile;
+
+#define	LPC_UART_NUM	2
+static struct lpc_uart_softc {
+	struct uart_softc *uart_softc;
+	const char *opts;
+	int	iobase;
+	int	irq;
+	int	enabled;
+} lpc_uart_softc[LPC_UART_NUM];
+
+static const char *lpc_uart_names[LPC_UART_NUM] = { "COM1", "COM2" };
+
+/*
+ * LPC device configuration is in the following form:
+ * <lpc_device_name>[,<options>]
+ * For e.g. "com1,stdio" or "bootrom,/var/romfile"
+ */
+int
+lpc_device_parse(const char *opts)
+{
+	int unit, error;
+	char *str, *cpy, *lpcdev;
+
+	error = -1;
+	str = cpy = strdup(opts);
+	lpcdev = strsep(&str, ",");
+	if (lpcdev != NULL) {
+		if (strcasecmp(lpcdev, "bootrom") == 0) {
+			romfile = str;
+			error = 0;
+			goto done;
+		}
+		for (unit = 0; unit < LPC_UART_NUM; unit++) {
+			if (strcasecmp(lpcdev, lpc_uart_names[unit]) == 0) {
+				lpc_uart_softc[unit].opts = str;
+				error = 0;
+				goto done;
+			}
+		}
+	}
+
+done:
+	if (error)
+		free(cpy);
+
+	return (error);
+}
+
+const char *
+lpc_bootrom(void)
+{
+
+	return (romfile);
+}
+
+static void
+lpc_uart_intr_assert(void *arg)
+{
+	struct lpc_uart_softc *sc = arg;
+
+	assert(sc->irq >= 0);
+
+	vm_isa_pulse_irq(lpc_bridge->pi_vmctx, sc->irq, sc->irq);
+}
+
+static void
+lpc_uart_intr_deassert(void *arg)
+{
+	/* 
+	 * The COM devices on the LPC bus generate edge triggered interrupts,
+	 * so nothing more to do here.
+	 */
+}
+
+static int
+lpc_uart_io_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+		    uint32_t *eax, void *arg)
+{
+	int offset;
+	struct lpc_uart_softc *sc = arg;
+
+	offset = port - sc->iobase;
+
+	switch (bytes) {
+	case 1:
+		if (in)
+			*eax = uart_read(sc->uart_softc, offset);
+		else
+			uart_write(sc->uart_softc, offset, *eax);
+		break;
+	case 2:
+		if (in) {
+			*eax = uart_read(sc->uart_softc, offset);
+			*eax |= uart_read(sc->uart_softc, offset + 1) << 8;
+		} else {
+			uart_write(sc->uart_softc, offset, *eax);
+			uart_write(sc->uart_softc, offset + 1, *eax >> 8);
+		}
+		break;
+#ifndef __FreeBSD__
+	case 4:
+		if (in) {
+			*eax = uart_read(sc->uart_softc, offset);
+			*eax |= uart_read(sc->uart_softc, offset + 1) << 8;
+			*eax |= uart_read(sc->uart_softc, offset + 2) << 16;
+			*eax |= uart_read(sc->uart_softc, offset + 3) << 24;
+		} else {
+			uart_write(sc->uart_softc, offset, *eax);
+			uart_write(sc->uart_softc, offset + 1, *eax >> 8);
+			uart_write(sc->uart_softc, offset + 2, *eax >> 16);
+			uart_write(sc->uart_softc, offset + 3, *eax >> 24);
+		}
+		break;
+#endif
+	default:
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+lpc_init(struct vmctx *ctx)
+{
+	struct lpc_uart_softc *sc;
+	struct inout_port iop;
+	const char *name;
+	int unit, error;
+
+	if (romfile != NULL) {
+		error = bootrom_init(ctx, romfile);
+		if (error)
+			return (error);
+	}
+
+	/* COM1 and COM2 */
+	for (unit = 0; unit < LPC_UART_NUM; unit++) {
+		sc = &lpc_uart_softc[unit];
+		name = lpc_uart_names[unit];
+
+		if (uart_legacy_alloc(unit, &sc->iobase, &sc->irq) != 0) {
+			fprintf(stderr, "Unable to allocate resources for "
+			    "LPC device %s\n", name);
+			return (-1);
+		}
+		pci_irq_reserve(sc->irq);
+
+		sc->uart_softc = uart_init(lpc_uart_intr_assert,
+				    lpc_uart_intr_deassert, sc);
+
+		if (uart_set_backend(sc->uart_softc, sc->opts) != 0) {
+			fprintf(stderr, "Unable to initialize backend '%s' "
+			    "for LPC device %s\n", sc->opts, name);
+			return (-1);
+		}
+
+		bzero(&iop, sizeof(struct inout_port));
+		iop.name = name;
+		iop.port = sc->iobase;
+		iop.size = UART_IO_BAR_SIZE;
+		iop.flags = IOPORT_F_INOUT;
+		iop.handler = lpc_uart_io_handler;
+		iop.arg = sc;
+
+		error = register_inout(&iop);
+		assert(error == 0);
+		sc->enabled = 1;
+	}
+
+	return (0);
+}
+
+static void
+pci_lpc_write_dsdt(struct pci_devinst *pi)
+{
+	struct lpc_dsdt **ldpp, *ldp;
+
+	dsdt_line("");
+	dsdt_line("Device (ISA)");
+	dsdt_line("{");
+	dsdt_line("  Name (_ADR, 0x%04X%04X)", pi->pi_slot, pi->pi_func);
+	dsdt_line("  OperationRegion (LPCR, PCI_Config, 0x00, 0x100)");
+	dsdt_line("  Field (LPCR, AnyAcc, NoLock, Preserve)");
+	dsdt_line("  {");
+	dsdt_line("    Offset (0x60),");
+	dsdt_line("    PIRA,   8,");
+	dsdt_line("    PIRB,   8,");
+	dsdt_line("    PIRC,   8,");
+	dsdt_line("    PIRD,   8,");
+	dsdt_line("    Offset (0x68),");
+	dsdt_line("    PIRE,   8,");
+	dsdt_line("    PIRF,   8,");
+	dsdt_line("    PIRG,   8,");
+	dsdt_line("    PIRH,   8");
+	dsdt_line("  }");
+	dsdt_line("");
+
+	dsdt_indent(1);
+	SET_FOREACH(ldpp, lpc_dsdt_set) {
+		ldp = *ldpp;
+		ldp->handler();
+	}
+
+	dsdt_line("");
+	dsdt_line("Device (PIC)");
+	dsdt_line("{");
+	dsdt_line("  Name (_HID, EisaId (\"PNP0000\"))");
+	dsdt_line("  Name (_CRS, ResourceTemplate ()");
+	dsdt_line("  {");
+	dsdt_indent(2);
+	dsdt_fixed_ioport(IO_ICU1, 2);
+	dsdt_fixed_ioport(IO_ICU2, 2);
+	dsdt_fixed_irq(2);
+	dsdt_unindent(2);
+	dsdt_line("  })");
+	dsdt_line("}");
+
+	dsdt_line("");
+	dsdt_line("Device (TIMR)");
+	dsdt_line("{");
+	dsdt_line("  Name (_HID, EisaId (\"PNP0100\"))");
+	dsdt_line("  Name (_CRS, ResourceTemplate ()");
+	dsdt_line("  {");
+	dsdt_indent(2);
+	dsdt_fixed_ioport(IO_TIMER1_PORT, 4);
+	dsdt_fixed_irq(0);
+	dsdt_unindent(2);
+	dsdt_line("  })");
+	dsdt_line("}");
+	dsdt_unindent(1);
+
+	dsdt_line("}");
+}
+
+static void
+pci_lpc_sysres_dsdt(void)
+{
+	struct lpc_sysres **lspp, *lsp;
+
+	dsdt_line("");
+	dsdt_line("Device (SIO)");
+	dsdt_line("{");
+	dsdt_line("  Name (_HID, EisaId (\"PNP0C02\"))");
+	dsdt_line("  Name (_CRS, ResourceTemplate ()");
+	dsdt_line("  {");
+
+	dsdt_indent(2);
+	SET_FOREACH(lspp, lpc_sysres_set) {
+		lsp = *lspp;
+		switch (lsp->type) {
+		case LPC_SYSRES_IO:
+			dsdt_fixed_ioport(lsp->base, lsp->length);
+			break;
+		case LPC_SYSRES_MEM:
+			dsdt_fixed_mem32(lsp->base, lsp->length);
+			break;
+		}
+	}
+	dsdt_unindent(2);
+
+	dsdt_line("  })");
+	dsdt_line("}");
+}
+LPC_DSDT(pci_lpc_sysres_dsdt);
+
+static void
+pci_lpc_uart_dsdt(void)
+{
+	struct lpc_uart_softc *sc;
+	int unit;
+
+	for (unit = 0; unit < LPC_UART_NUM; unit++) {
+		sc = &lpc_uart_softc[unit];
+		if (!sc->enabled)
+			continue;
+		dsdt_line("");
+		dsdt_line("Device (%s)", lpc_uart_names[unit]);
+		dsdt_line("{");
+		dsdt_line("  Name (_HID, EisaId (\"PNP0501\"))");
+		dsdt_line("  Name (_UID, %d)", unit + 1);
+		dsdt_line("  Name (_CRS, ResourceTemplate ()");
+		dsdt_line("  {");
+		dsdt_indent(2);
+		dsdt_fixed_ioport(sc->iobase, UART_IO_BAR_SIZE);
+		dsdt_fixed_irq(sc->irq);
+		dsdt_unindent(2);
+		dsdt_line("  })");
+		dsdt_line("}");
+	}
+}
+LPC_DSDT(pci_lpc_uart_dsdt);
+
+static int
+pci_lpc_cfgwrite(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+		  int coff, int bytes, uint32_t val)
+{
+	int pirq_pin;
+
+	if (bytes == 1) {
+		pirq_pin = 0;
+		if (coff >= 0x60 && coff <= 0x63)
+			pirq_pin = coff - 0x60 + 1;
+		if (coff >= 0x68 && coff <= 0x6b)
+			pirq_pin = coff - 0x68 + 5;
+		if (pirq_pin != 0) {
+			pirq_write(ctx, pirq_pin, val);
+			pci_set_cfgdata8(pi, coff, pirq_read(pirq_pin));
+			return (0);
+		}
+	}
+	return (-1);
+}
+
+static void
+pci_lpc_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	       int baridx, uint64_t offset, int size, uint64_t value)
+{
+}
+
+static uint64_t
+pci_lpc_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	      int baridx, uint64_t offset, int size)
+{
+	return (0);
+}
+
+#define	LPC_DEV		0x7000
+#define	LPC_VENDOR	0x8086
+
+static int
+pci_lpc_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+
+	/*
+	 * Do not allow more than one LPC bridge to be configured.
+	 */
+	if (lpc_bridge != NULL) {
+		fprintf(stderr, "Only one LPC bridge is allowed.\n");
+		return (-1);
+	}
+
+	/*
+	 * Enforce that the LPC can only be configured on bus 0. This
+	 * simplifies the ACPI DSDT because it can provide a decode for
+	 * all legacy i/o ports behind bus 0.
+	 */
+	if (pi->pi_bus != 0) {
+		fprintf(stderr, "LPC bridge can be present only on bus 0.\n");
+		return (-1);
+	}
+
+	if (lpc_init(ctx) != 0)
+		return (-1);
+
+	/* initialize config space */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, LPC_DEV);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, LPC_VENDOR);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_BRIDGE);
+	pci_set_cfgdata8(pi, PCIR_SUBCLASS, PCIS_BRIDGE_ISA);
+
+	lpc_bridge = pi;
+
+	return (0);
+}
+
+char *
+lpc_pirq_name(int pin)
+{
+	char *name;
+
+	if (lpc_bridge == NULL)
+		return (NULL);
+	asprintf(&name, "\\_SB.PC00.ISA.LNK%c,", 'A' + pin - 1);
+	return (name);
+}
+
+void
+lpc_pirq_routed(void)
+{
+	int pin;
+
+	if (lpc_bridge == NULL)
+		return;
+
+ 	for (pin = 0; pin < 4; pin++)
+		pci_set_cfgdata8(lpc_bridge, 0x60 + pin, pirq_read(pin + 1));
+	for (pin = 0; pin < 4; pin++)
+		pci_set_cfgdata8(lpc_bridge, 0x68 + pin, pirq_read(pin + 5));
+}
+
+struct pci_devemu pci_de_lpc = {
+	.pe_emu =	"lpc",
+	.pe_init =	pci_lpc_init,
+	.pe_write_dsdt = pci_lpc_write_dsdt,
+	.pe_cfgwrite =	pci_lpc_cfgwrite,
+	.pe_barwrite =	pci_lpc_write,
+	.pe_barread =	pci_lpc_read
+};
+PCI_EMUL_SET(pci_de_lpc);
diff --git a/usr/src/cmd/bhyve/pci_lpc.h b/usr/src/cmd/bhyve/pci_lpc.h
new file mode 100644
index 0000000000..8cab52f372
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_lpc.h
@@ -0,0 +1,75 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _LPC_H_
+#define	_LPC_H_
+
+#include <sys/linker_set.h>
+
+typedef void (*lpc_write_dsdt_t)(void);
+
+struct lpc_dsdt {
+	lpc_write_dsdt_t handler;
+};
+
+#define	LPC_DSDT(handler)						\
+	static struct lpc_dsdt __CONCAT(__lpc_dsdt, __LINE__) = {	\
+		(handler),						\
+	};								\
+	DATA_SET(lpc_dsdt_set, __CONCAT(__lpc_dsdt, __LINE__))
+
+enum lpc_sysres_type {
+	LPC_SYSRES_IO,
+	LPC_SYSRES_MEM
+};
+
+struct lpc_sysres {
+	enum lpc_sysres_type type;
+	uint32_t base;
+	uint32_t length;
+};
+
+#define	LPC_SYSRES(type, base, length)					\
+	static struct lpc_sysres __CONCAT(__lpc_sysres, __LINE__) = {	\
+		(type),							\
+		(base),							\
+		(length)						\
+	};								\
+	DATA_SET(lpc_sysres_set, __CONCAT(__lpc_sysres, __LINE__))
+
+#define	SYSRES_IO(base, length)		LPC_SYSRES(LPC_SYSRES_IO, base, length)
+#define	SYSRES_MEM(base, length)	LPC_SYSRES(LPC_SYSRES_MEM, base, length)
+
+int	lpc_device_parse(const char *opt);
+char	*lpc_pirq_name(int pin);
+void	lpc_pirq_routed(void);
+const char *lpc_bootrom(void);
+
+#endif
diff --git a/usr/src/cmd/bhyve/pci_passthru.c b/usr/src/cmd/bhyve/pci_passthru.c
new file mode 100644
index 0000000000..2ed490c71a
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_passthru.c
@@ -0,0 +1,907 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/types.h>
+#include <sys/mman.h>
+#include <sys/pciio.h>
+#include <sys/ioctl.h>
+
+#include <sys/pci.h>
+
+#include <dev/io/iodev.h>
+#include <dev/pci/pcireg.h>
+
+#include <machine/iodev.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+#include <sys/ppt_dev.h>
+#include "pci_emul.h"
+#include "mem.h"
+
+#define	LEGACY_SUPPORT	1
+
+#define MSIX_TABLE_COUNT(ctrl) (((ctrl) & PCIM_MSIXCTRL_TABLE_SIZE) + 1)
+#define MSIX_CAPLEN 12
+
+struct passthru_softc {
+	struct pci_devinst *psc_pi;
+	struct pcibar psc_bar[PCI_BARMAX + 1];
+	struct {
+		int		capoff;
+		int		msgctrl;
+		int		emulated;
+	} psc_msi;
+	struct {
+		int		capoff;
+	} psc_msix;
+	int pptfd;
+	int msi_limit;
+	int msix_limit;
+};
+
+static int
+msi_caplen(int msgctrl)
+{
+	int len;
+
+	len = 10;		/* minimum length of msi capability */
+
+	if (msgctrl & PCIM_MSICTRL_64BIT)
+		len += 4;
+
+#if 0
+	/*
+	 * Ignore the 'mask' and 'pending' bits in the MSI capability.
+	 * We'll let the guest manipulate them directly.
+	 */
+	if (msgctrl & PCIM_MSICTRL_VECTOR)
+		len += 10;
+#endif
+
+	return (len);
+}
+
+static uint32_t
+read_config(const struct passthru_softc *sc, long reg, int width)
+{
+	struct ppt_cfg_io pi;
+
+	pi.pci_off = reg;
+	pi.pci_width = width;
+
+	if (ioctl(sc->pptfd, PPT_CFG_READ, &pi) != 0) {
+		return (0);
+	}
+	return (pi.pci_data);
+}
+
+static void
+write_config(const struct passthru_softc *sc, long reg, int width,
+    uint32_t data)
+{
+	struct ppt_cfg_io pi;
+
+	pi.pci_off = reg;
+	pi.pci_width = width;
+	pi.pci_data = data;
+
+	(void) ioctl(sc->pptfd, PPT_CFG_WRITE, &pi);
+}
+
+static int
+passthru_get_bar(struct passthru_softc *sc, int bar, enum pcibar_type *type,
+    uint64_t *base, uint64_t *size)
+{
+	struct ppt_bar_query pb;
+
+	pb.pbq_baridx = bar;
+
+	if (ioctl(sc->pptfd, PPT_BAR_QUERY, &pb) != 0) {
+		return (-1);
+	}
+
+	switch (pb.pbq_type) {
+	case PCI_ADDR_IO:
+		*type = PCIBAR_IO;
+		break;
+	case PCI_ADDR_MEM32:
+		*type = PCIBAR_MEM32;
+		break;
+	case PCI_ADDR_MEM64:
+		*type = PCIBAR_MEM64;
+		break;
+	default:
+		err(1, "unrecognized BAR type: %u\n", pb.pbq_type);
+		break;
+	}
+
+	*base = pb.pbq_base;
+	*size = pb.pbq_size;
+	return (0);
+}
+
+static int
+passthru_dev_open(const char *path, int *pptfdp)
+{
+	int pptfd;
+
+	if ((pptfd = open(path, O_RDWR)) < 0) {
+		return (errno);
+	}
+
+	/* XXX: verify fd with ioctl? */
+	*pptfdp = pptfd;
+	return (0);
+}
+
+#ifdef LEGACY_SUPPORT
+static int
+passthru_add_msicap(struct pci_devinst *pi, int msgnum, int nextptr)
+{
+	int capoff, i;
+	struct msicap msicap;
+	u_char *capdata;
+
+	pci_populate_msicap(&msicap, msgnum, nextptr);
+
+	/*
+	 * XXX
+	 * Copy the msi capability structure in the last 16 bytes of the
+	 * config space. This is wrong because it could shadow something
+	 * useful to the device.
+	 */
+	capoff = 256 - roundup(sizeof(msicap), 4);
+	capdata = (u_char *)&msicap;
+	for (i = 0; i < sizeof(msicap); i++)
+		pci_set_cfgdata8(pi, capoff + i, capdata[i]);
+
+	return (capoff);
+}
+#endif	/* LEGACY_SUPPORT */
+
+static void
+passthru_intr_limit(struct passthru_softc *sc, struct msixcap *msixcap)
+{
+	struct pci_devinst *pi = sc->psc_pi;
+	int off;
+
+	/* Reduce the number of MSI vectors if higher than OS limit */
+	if ((off = sc->psc_msi.capoff) != 0 && sc->msi_limit != -1) {
+		int msi_limit, mmc;
+
+		msi_limit =
+		    sc->msi_limit > 16 ? PCIM_MSICTRL_MMC_32 :
+		    sc->msi_limit > 8 ? PCIM_MSICTRL_MMC_16 :
+		    sc->msi_limit > 4 ? PCIM_MSICTRL_MMC_8 :
+		    sc->msi_limit > 2 ? PCIM_MSICTRL_MMC_4 :
+		    sc->msi_limit > 1 ? PCIM_MSICTRL_MMC_2 :
+		    PCIM_MSICTRL_MMC_1;
+		mmc = sc->psc_msi.msgctrl & PCIM_MSICTRL_MMC_MASK;
+
+		if (mmc > msi_limit) {
+			sc->psc_msi.msgctrl &= ~PCIM_MSICTRL_MMC_MASK;
+			sc->psc_msi.msgctrl |= msi_limit;
+			pci_set_cfgdata16(pi, off + 2, sc->psc_msi.msgctrl);
+		}
+	}
+
+	/* Reduce the number of MSI-X vectors if higher than OS limit */
+	if ((off = sc->psc_msix.capoff) != 0 && sc->msix_limit != -1) {
+		if (MSIX_TABLE_COUNT(msixcap->msgctrl) > sc->msix_limit) {
+			msixcap->msgctrl &= ~PCIM_MSIXCTRL_TABLE_SIZE;
+			msixcap->msgctrl |= sc->msix_limit - 1;
+			pci_set_cfgdata16(pi, off + 2, msixcap->msgctrl);
+		}
+	}
+}
+
+static int
+cfginitmsi(struct passthru_softc *sc)
+{
+	int i, ptr, capptr, cap, sts, caplen, table_size;
+	uint32_t u32;
+	struct pci_devinst *pi = sc->psc_pi;
+	struct msixcap msixcap;
+	uint32_t *msixcap_ptr;
+
+	/*
+	 * Parse the capabilities and cache the location of the MSI
+	 * and MSI-X capabilities.
+	 */
+	sts = read_config(sc, PCIR_STATUS, 2);
+	if (sts & PCIM_STATUS_CAPPRESENT) {
+		ptr = read_config(sc, PCIR_CAP_PTR, 1);
+		while (ptr != 0 && ptr != 0xff) {
+			cap = read_config(sc, ptr + PCICAP_ID, 1);
+			if (cap == PCIY_MSI) {
+				/*
+				 * Copy the MSI capability into the config
+				 * space of the emulated pci device
+				 */
+				sc->psc_msi.capoff = ptr;
+				sc->psc_msi.msgctrl = read_config(sc,
+				    ptr + 2, 2);
+				sc->psc_msi.emulated = 0;
+				caplen = msi_caplen(sc->psc_msi.msgctrl);
+				capptr = ptr;
+				while (caplen > 0) {
+					u32 = read_config(sc, capptr, 4);
+					pci_set_cfgdata32(pi, capptr, u32);
+					caplen -= 4;
+					capptr += 4;
+				}
+			} else if (cap == PCIY_MSIX) {
+				/*
+				 * Copy the MSI-X capability
+				 */
+				sc->psc_msix.capoff = ptr;
+				caplen = 12;
+				msixcap_ptr = (uint32_t*) &msixcap;
+				capptr = ptr;
+				while (caplen > 0) {
+					u32 = read_config(sc, capptr, 4);
+					*msixcap_ptr = u32;
+					pci_set_cfgdata32(pi, capptr, u32);
+					caplen -= 4;
+					capptr += 4;
+					msixcap_ptr++;
+				}
+			}
+			ptr = read_config(sc, ptr + PCICAP_NEXTPTR, 1);
+		}
+	}
+
+	passthru_intr_limit(sc, &msixcap);
+
+	if (sc->psc_msix.capoff != 0) {
+		pi->pi_msix.pba_bar =
+		    msixcap.pba_info & PCIM_MSIX_BIR_MASK;
+		pi->pi_msix.pba_offset =
+		    msixcap.pba_info & ~PCIM_MSIX_BIR_MASK;
+		pi->pi_msix.table_bar =
+		    msixcap.table_info & PCIM_MSIX_BIR_MASK;
+		pi->pi_msix.table_offset =
+		    msixcap.table_info & ~PCIM_MSIX_BIR_MASK;
+		pi->pi_msix.table_count = MSIX_TABLE_COUNT(msixcap.msgctrl);
+		pi->pi_msix.pba_size = PBA_SIZE(pi->pi_msix.table_count);
+
+		/* Allocate the emulated MSI-X table array */
+		table_size = pi->pi_msix.table_count * MSIX_TABLE_ENTRY_SIZE;
+		pi->pi_msix.table = calloc(1, table_size);
+
+		/* Mask all table entries */
+		for (i = 0; i < pi->pi_msix.table_count; i++) {
+			pi->pi_msix.table[i].vector_control |=
+						PCIM_MSIX_VCTRL_MASK;
+		}
+	}
+
+#ifdef LEGACY_SUPPORT
+	/*
+	 * If the passthrough device does not support MSI then craft a
+	 * MSI capability for it. We link the new MSI capability at the
+	 * head of the list of capabilities.
+	 */
+	if ((sts & PCIM_STATUS_CAPPRESENT) != 0 && sc->psc_msi.capoff == 0) {
+		int origptr, msiptr;
+		origptr = read_config(sc, PCIR_CAP_PTR, 1);
+		msiptr = passthru_add_msicap(pi, 1, origptr);
+		sc->psc_msi.capoff = msiptr;
+		sc->psc_msi.msgctrl = pci_get_cfgdata16(pi, msiptr + 2);
+		sc->psc_msi.emulated = 1;
+		pci_set_cfgdata8(pi, PCIR_CAP_PTR, msiptr);
+	}
+#endif
+
+	/* Make sure one of the capabilities is present */
+	if (sc->psc_msi.capoff == 0 && sc->psc_msix.capoff == 0) {
+		return (-1);
+	} else {
+		return (0);
+	}
+}
+
+static uint64_t
+passthru_msix_table_read(struct passthru_softc *sc, uint64_t offset, int size)
+{
+	struct pci_devinst *pi;
+	struct msix_table_entry *entry;
+	uint8_t *src8;
+	uint16_t *src16;
+	uint32_t *src32;
+	uint64_t *src64;
+	uint64_t data;
+	size_t entry_offset;
+	int index;
+
+	pi = sc->psc_pi;
+	if (offset >= pi->pi_msix.pba_offset &&
+	    offset < pi->pi_msix.pba_offset + pi->pi_msix.pba_size) {
+		switch(size) {
+		case 1:
+			src8 = (uint8_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			data = *src8;
+			break;
+		case 2:
+			src16 = (uint16_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			data = *src16;
+			break;
+		case 4:
+			src32 = (uint32_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			data = *src32;
+			break;
+		case 8:
+			src64 = (uint64_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			data = *src64;
+			break;
+		default:
+			return (-1);
+		}
+		return (data);
+	}
+
+	if (offset < pi->pi_msix.table_offset)
+		return (-1);
+
+	offset -= pi->pi_msix.table_offset;
+	index = offset / MSIX_TABLE_ENTRY_SIZE;
+	if (index >= pi->pi_msix.table_count)
+		return (-1);
+
+	entry = &pi->pi_msix.table[index];
+	entry_offset = offset % MSIX_TABLE_ENTRY_SIZE;
+
+	switch(size) {
+	case 1:
+		src8 = (uint8_t *)((void *)entry + entry_offset);
+		data = *src8;
+		break;
+	case 2:
+		src16 = (uint16_t *)((void *)entry + entry_offset);
+		data = *src16;
+		break;
+	case 4:
+		src32 = (uint32_t *)((void *)entry + entry_offset);
+		data = *src32;
+		break;
+	case 8:
+		src64 = (uint64_t *)((void *)entry + entry_offset);
+		data = *src64;
+		break;
+	default:
+		return (-1);
+	}
+
+	return (data);
+}
+
+static void
+passthru_msix_table_write(struct vmctx *ctx, int vcpu,
+    struct passthru_softc *sc, uint64_t offset, int size, uint64_t data)
+{
+	struct pci_devinst *pi;
+	struct msix_table_entry *entry;
+	uint8_t *dest8;
+	uint16_t *dest16;
+	uint32_t *dest32;
+	uint64_t *dest64;
+	size_t entry_offset;
+	uint32_t vector_control;
+	int index;
+
+	pi = sc->psc_pi;
+	if (offset >= pi->pi_msix.pba_offset &&
+	    offset < pi->pi_msix.pba_offset + pi->pi_msix.pba_size) {
+		switch(size) {
+		case 1:
+			dest8 = (uint8_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			*dest8 = data;
+			break;
+		case 2:
+			dest16 = (uint16_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			*dest16 = data;
+			break;
+		case 4:
+			dest32 = (uint32_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			*dest32 = data;
+			break;
+		case 8:
+			dest64 = (uint64_t *)(pi->pi_msix.pba_page + offset -
+			    pi->pi_msix.pba_page_offset);
+			*dest64 = data;
+			break;
+		default:
+			break;
+		}
+		return;
+	}
+
+	if (offset < pi->pi_msix.table_offset)
+		return;
+
+	offset -= pi->pi_msix.table_offset;
+	index = offset / MSIX_TABLE_ENTRY_SIZE;
+	if (index >= pi->pi_msix.table_count)
+		return;
+
+	entry = &pi->pi_msix.table[index];
+	entry_offset = offset % MSIX_TABLE_ENTRY_SIZE;
+
+	/* Only 4 byte naturally-aligned writes are supported */
+	assert(size == 4);
+	assert(entry_offset % 4 == 0);
+
+	vector_control = entry->vector_control;
+	dest32 = (uint32_t *)((void *)entry + entry_offset);
+	*dest32 = data;
+	/* If MSI-X hasn't been enabled, do nothing */
+	if (pi->pi_msix.enabled) {
+		/* If the entry is masked, don't set it up */
+		if ((entry->vector_control & PCIM_MSIX_VCTRL_MASK) == 0 ||
+		    (vector_control & PCIM_MSIX_VCTRL_MASK) == 0) {
+			(void) vm_setup_pptdev_msix(ctx, vcpu, sc->pptfd,
+			    index, entry->addr, entry->msg_data,
+			    entry->vector_control);
+		}
+	}
+}
+
+static int
+init_msix_table(struct vmctx *ctx, struct passthru_softc *sc, uint64_t base)
+{
+	int error, idx;
+	size_t len, remaining;
+	uint32_t table_size, table_offset;
+	uint32_t pba_size, pba_offset;
+	vm_paddr_t start;
+	struct pci_devinst *pi = sc->psc_pi;
+
+	assert(pci_msix_table_bar(pi) >= 0 && pci_msix_pba_bar(pi) >= 0);
+
+	/*
+	 * If the MSI-X table BAR maps memory intended for
+	 * other uses, it is at least assured that the table
+	 * either resides in its own page within the region,
+	 * or it resides in a page shared with only the PBA.
+	 */
+	table_offset = rounddown2(pi->pi_msix.table_offset, 4096);
+
+	table_size = pi->pi_msix.table_offset - table_offset;
+	table_size += pi->pi_msix.table_count * MSIX_TABLE_ENTRY_SIZE;
+	table_size = roundup2(table_size, 4096);
+
+	idx = pi->pi_msix.table_bar;
+	start = pi->pi_bar[idx].addr;
+	remaining = pi->pi_bar[idx].size;
+
+	if (pi->pi_msix.pba_bar == pi->pi_msix.table_bar) {
+		pba_offset = pi->pi_msix.pba_offset;
+		pba_size = pi->pi_msix.pba_size;
+		if (pba_offset >= table_offset + table_size ||
+		    table_offset >= pba_offset + pba_size) {
+			/*
+			 * If the PBA does not share a page with the MSI-x
+			 * tables, no PBA emulation is required.
+			 */
+			pi->pi_msix.pba_page = NULL;
+			pi->pi_msix.pba_page_offset = 0;
+		} else {
+			/*
+			 * The PBA overlaps with either the first or last
+			 * page of the MSI-X table region.  Map the
+			 * appropriate page.
+			 */
+			if (pba_offset <= table_offset)
+				pi->pi_msix.pba_page_offset = table_offset;
+			else
+				pi->pi_msix.pba_page_offset = table_offset +
+				    table_size - 4096;
+			pi->pi_msix.pba_page = mmap(NULL, 4096, PROT_READ |
+			    PROT_WRITE, MAP_SHARED, sc->pptfd,
+			    pi->pi_msix.pba_page_offset);
+			if (pi->pi_msix.pba_page == MAP_FAILED) {
+				warn("Failed to map PBA page for MSI-X on %d",
+				    sc->pptfd);
+				return (-1);
+			}
+		}
+	}
+
+	/* Map everything before the MSI-X table */
+	if (table_offset > 0) {
+		len = table_offset;
+		error = vm_map_pptdev_mmio(ctx, sc->pptfd, start, len, base);
+		if (error)
+			return (error);
+
+		base += len;
+		start += len;
+		remaining -= len;
+	}
+
+	/* Skip the MSI-X table */
+	base += table_size;
+	start += table_size;
+	remaining -= table_size;
+
+	/* Map everything beyond the end of the MSI-X table */
+	if (remaining > 0) {
+		len = remaining;
+		error = vm_map_pptdev_mmio(ctx, sc->pptfd, start, len, base);
+		if (error)
+			return (error);
+	}
+
+	return (0);
+}
+
+static int
+cfginitbar(struct vmctx *ctx, struct passthru_softc *sc)
+{
+	struct pci_devinst *pi = sc->psc_pi;
+	uint_t i;
+
+	/*
+	 * Initialize BAR registers
+	 */
+	for (i = 0; i <= PCI_BARMAX; i++) {
+		enum pcibar_type bartype;
+		uint64_t base, size;
+		int error;
+
+		if (passthru_get_bar(sc, i, &bartype, &base, &size) != 0) {
+			continue;
+		}
+
+		if (bartype != PCIBAR_IO) {
+			if (((base | size) & PAGE_MASK) != 0) {
+				warnx("passthru device %d BAR %d: "
+				    "base %#lx or size %#lx not page aligned\n",
+				    sc->pptfd, i, base, size);
+				return (-1);
+			}
+		}
+
+		/* Cache information about the "real" BAR */
+		sc->psc_bar[i].type = bartype;
+		sc->psc_bar[i].size = size;
+		sc->psc_bar[i].addr = base;
+
+		/* Allocate the BAR in the guest I/O or MMIO space */
+		error = pci_emul_alloc_pbar(pi, i, base, bartype, size);
+		if (error)
+			return (-1);
+
+		/* The MSI-X table needs special handling */
+		if (i == pci_msix_table_bar(pi)) {
+			error = init_msix_table(ctx, sc, base);
+			if (error)
+				return (-1);
+		} else if (bartype != PCIBAR_IO) {
+			/* Map the physical BAR in the guest MMIO space */
+			error = vm_map_pptdev_mmio(ctx, sc->pptfd,
+			    pi->pi_bar[i].addr, pi->pi_bar[i].size, base);
+			if (error)
+				return (-1);
+		}
+
+		/*
+		 * 64-bit BAR takes up two slots so skip the next one.
+		 */
+		if (bartype == PCIBAR_MEM64) {
+			i++;
+			assert(i <= PCI_BARMAX);
+			sc->psc_bar[i].type = PCIBAR_MEMHI64;
+		}
+	}
+	return (0);
+}
+
+static int
+cfginit(struct vmctx *ctx, struct passthru_softc *sc)
+{
+	if (cfginitmsi(sc) != 0) {
+		warnx("failed to initialize MSI for PCI %d", sc->pptfd);
+		return (-1);
+	}
+
+	if (cfginitbar(ctx, sc) != 0) {
+		warnx("failed to initialize BARs for PCI %d", sc->pptfd);
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+passthru_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	int error, memflags, pptfd;
+	struct passthru_softc *sc;
+
+	sc = NULL;
+	error = 1;
+
+	memflags = vm_get_memflags(ctx);
+	if (!(memflags & VM_MEM_F_WIRED)) {
+		warnx("passthru requires guest memory to be wired");
+		goto done;
+	}
+
+	if (opts == NULL || passthru_dev_open(opts, &pptfd) != 0) {
+		warnx("invalid passthru options");
+		goto done;
+	}
+
+	if (vm_assign_pptdev(ctx, pptfd) != 0) {
+		warnx("PCI device at %d is not using the ppt driver", pptfd);
+		goto done;
+	}
+
+	sc = calloc(1, sizeof(struct passthru_softc));
+
+	pi->pi_arg = sc;
+	sc->psc_pi = pi;
+	sc->pptfd = pptfd;
+
+	if ((error = vm_get_pptdev_limits(ctx, pptfd, &sc->msi_limit,
+	    &sc->msix_limit)) != 0)
+		goto done;
+
+	/* initialize config space */
+	if ((error = cfginit(ctx, sc)) != 0)
+		goto done;
+
+	error = 0;		/* success */
+done:
+	if (error) {
+		free(sc);
+		vm_unassign_pptdev(ctx, pptfd);
+	}
+	return (error);
+}
+
+static int
+bar_access(int coff)
+{
+	if (coff >= PCIR_BAR(0) && coff < PCIR_BAR(PCI_BARMAX + 1))
+		return (1);
+	else
+		return (0);
+}
+
+static int
+msicap_access(struct passthru_softc *sc, int coff)
+{
+	int caplen;
+
+	if (sc->psc_msi.capoff == 0)
+		return (0);
+
+	caplen = msi_caplen(sc->psc_msi.msgctrl);
+
+	if (coff >= sc->psc_msi.capoff && coff < sc->psc_msi.capoff + caplen)
+		return (1);
+	else
+		return (0);
+}
+
+static int
+msixcap_access(struct passthru_softc *sc, int coff)
+{
+	if (sc->psc_msix.capoff == 0) 
+		return (0);
+
+	return (coff >= sc->psc_msix.capoff && 
+	        coff < sc->psc_msix.capoff + MSIX_CAPLEN);
+}
+
+static int
+passthru_cfgread(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+    int coff, int bytes, uint32_t *rv)
+{
+	struct passthru_softc *sc;
+
+	sc = pi->pi_arg;
+
+	/*
+	 * PCI BARs and MSI capability is emulated.
+	 */
+	if (bar_access(coff) || msicap_access(sc, coff))
+		return (-1);
+
+	/*
+	 * MSI-X is also emulated since a limit on interrupts may be imposed by
+	 * the OS, altering the perceived register state.
+	 */
+	if (msixcap_access(sc, coff))
+		return (-1);
+
+#ifdef LEGACY_SUPPORT
+	/*
+	 * Emulate PCIR_CAP_PTR if this device does not support MSI capability
+	 * natively.
+	 */
+	if (sc->psc_msi.emulated) {
+		if (coff >= PCIR_CAP_PTR && coff < PCIR_CAP_PTR + 4)
+			return (-1);
+	}
+#endif
+
+	/* Everything else just read from the device's config space */
+	*rv = read_config(sc, coff, bytes);
+
+	return (0);
+}
+
+static int
+passthru_cfgwrite(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+    int coff, int bytes, uint32_t val)
+{
+	int error, msix_table_entries, i;
+	struct passthru_softc *sc;
+
+	sc = pi->pi_arg;
+
+	/*
+	 * PCI BARs are emulated
+	 */
+	if (bar_access(coff))
+		return (-1);
+
+	/*
+	 * MSI capability is emulated
+	 */
+	if (msicap_access(sc, coff)) {
+		msicap_cfgwrite(pi, sc->psc_msi.capoff, coff, bytes, val);
+
+		error = vm_setup_pptdev_msi(ctx, vcpu, sc->pptfd,
+		    pi->pi_msi.addr, pi->pi_msi.msg_data, pi->pi_msi.maxmsgnum);
+		if (error != 0)
+			err(1, "vm_setup_pptdev_msi");
+		return (0);
+	}
+
+	if (msixcap_access(sc, coff)) {
+		msixcap_cfgwrite(pi, sc->psc_msix.capoff, coff, bytes, val);
+		if (pi->pi_msix.enabled) {
+			msix_table_entries = pi->pi_msix.table_count;
+			for (i = 0; i < msix_table_entries; i++) {
+				error = vm_setup_pptdev_msix(ctx, vcpu,
+				    sc->pptfd, i,
+				    pi->pi_msix.table[i].addr,
+				    pi->pi_msix.table[i].msg_data,
+				    pi->pi_msix.table[i].vector_control);
+
+				if (error)
+					err(1, "vm_setup_pptdev_msix");
+			}
+		}
+		return (0);
+	}
+
+#ifdef LEGACY_SUPPORT
+	/*
+	 * If this device does not support MSI natively then we cannot let
+	 * the guest disable legacy interrupts from the device. It is the
+	 * legacy interrupt that is triggering the virtual MSI to the guest.
+	 */
+	if (sc->psc_msi.emulated && pci_msi_enabled(pi)) {
+		if (coff == PCIR_COMMAND && bytes == 2)
+			val &= ~PCIM_CMD_INTxDIS;
+	}
+#endif
+
+	write_config(sc, coff, bytes, val);
+
+	return (0);
+}
+
+static void
+passthru_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+    uint64_t offset, int size, uint64_t value)
+{
+	struct passthru_softc *sc = pi->pi_arg;
+
+	if (baridx == pci_msix_table_bar(pi)) {
+		passthru_msix_table_write(ctx, vcpu, sc, offset, size, value);
+	} else {
+		struct ppt_bar_io pbi;
+
+		assert(pi->pi_bar[baridx].type == PCIBAR_IO);
+
+		pbi.pbi_bar = baridx;
+		pbi.pbi_width = size;
+		pbi.pbi_off = offset;
+		pbi.pbi_data = value;
+		(void) ioctl(sc->pptfd, PPT_BAR_WRITE, &pbi);
+	}
+}
+
+static uint64_t
+passthru_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+    uint64_t offset, int size)
+{
+	struct passthru_softc *sc = pi->pi_arg;
+	uint64_t val;
+
+	if (baridx == pci_msix_table_bar(pi)) {
+		val = passthru_msix_table_read(sc, offset, size);
+	} else {
+		struct ppt_bar_io pbi;
+
+		assert(pi->pi_bar[baridx].type == PCIBAR_IO);
+
+		pbi.pbi_bar = baridx;
+		pbi.pbi_width = size;
+		pbi.pbi_off = offset;
+		if (ioctl(sc->pptfd, PPT_BAR_READ, &pbi) == 0) {
+			val = pbi.pbi_data;
+		} else {
+			val = 0;
+		}
+	}
+
+	return (val);
+}
+
+struct pci_devemu passthru = {
+	.pe_emu		= "passthru",
+	.pe_init	= passthru_init,
+	.pe_cfgwrite	= passthru_cfgwrite,
+	.pe_cfgread	= passthru_cfgread,
+	.pe_barwrite 	= passthru_write,
+	.pe_barread    	= passthru_read,
+};
+PCI_EMUL_SET(passthru);
diff --git a/usr/src/cmd/bhyve/pci_uart.c b/usr/src/cmd/bhyve/pci_uart.c
new file mode 100644
index 0000000000..093d0cb361
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_uart.c
@@ -0,0 +1,121 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <stdio.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "uart_emul.h"
+
+/*
+ * Pick a PCI vid/did of a chip with a single uart at
+ * BAR0, that most versions of FreeBSD can understand:
+ * Siig CyberSerial 1-port.
+ */
+#define COM_VENDOR	0x131f
+#define COM_DEV		0x2000
+
+static void
+pci_uart_intr_assert(void *arg)
+{
+	struct pci_devinst *pi = arg;
+
+	pci_lintr_assert(pi);
+}
+
+static void
+pci_uart_intr_deassert(void *arg)
+{
+	struct pci_devinst *pi = arg;
+
+	pci_lintr_deassert(pi);
+}
+
+static void
+pci_uart_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	       int baridx, uint64_t offset, int size, uint64_t value)
+{
+
+	assert(baridx == 0);
+	assert(size == 1);
+
+	uart_write(pi->pi_arg, offset, value);
+}
+
+uint64_t
+pci_uart_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	      int baridx, uint64_t offset, int size)
+{
+	uint8_t val;
+
+	assert(baridx == 0);
+	assert(size == 1);
+
+	val = uart_read(pi->pi_arg, offset);
+	return (val);
+}
+
+static int
+pci_uart_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	struct uart_softc *sc;
+
+	pci_emul_alloc_bar(pi, 0, PCIBAR_IO, UART_IO_BAR_SIZE);
+	pci_lintr_request(pi);
+
+	/* initialize config space */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, COM_DEV);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, COM_VENDOR);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_SIMPLECOMM);
+
+	sc = uart_init(pci_uart_intr_assert, pci_uart_intr_deassert, pi);
+	pi->pi_arg = sc;
+
+	if (uart_set_backend(sc, opts) != 0) {
+		fprintf(stderr, "Unable to initialize backend '%s' for "
+		    "pci uart at %d:%d\n", opts, pi->pi_slot, pi->pi_func);
+		return (-1);
+	}
+
+	return (0);
+}
+
+struct pci_devemu pci_de_com = {
+	.pe_emu =	"uart",
+	.pe_init =	pci_uart_init,
+	.pe_barwrite =	pci_uart_write,
+	.pe_barread =	pci_uart_read
+};
+PCI_EMUL_SET(pci_de_com);
diff --git a/usr/src/cmd/bhyve/pci_virtio_block.c b/usr/src/cmd/bhyve/pci_virtio_block.c
new file mode 100644
index 0000000000..63f59e6468
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_virtio_block.c
@@ -0,0 +1,438 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/linker_set.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/ioctl.h>
+#include <sys/disk.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+#include <assert.h>
+#include <pthread.h>
+#include <md5.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "virtio.h"
+#include "block_if.h"
+
+#define VTBLK_RINGSZ	64
+
+#define VTBLK_S_OK	0
+#define VTBLK_S_IOERR	1
+#define	VTBLK_S_UNSUPP	2
+
+#define	VTBLK_BLK_ID_BYTES	20
+
+/* Capability bits */
+#define	VTBLK_F_SEG_MAX		(1 << 2)	/* Maximum request segments */
+#define	VTBLK_F_BLK_SIZE	(1 << 6)	/* cfg block size valid */
+#define	VTBLK_F_FLUSH		(1 << 9)	/* Cache flush support */
+#define	VTBLK_F_TOPOLOGY	(1 << 10)	/* Optimal I/O alignment */
+
+/*
+ * Host capabilities
+ */
+#define VTBLK_S_HOSTCAPS      \
+  ( VTBLK_F_SEG_MAX  |						    \
+    VTBLK_F_BLK_SIZE |						    \
+    VTBLK_F_FLUSH    |						    \
+    VTBLK_F_TOPOLOGY |						    \
+    VIRTIO_RING_F_INDIRECT_DESC )	/* indirect descriptors */
+
+/*
+ * Config space "registers"
+ */
+struct vtblk_config {
+	uint64_t	vbc_capacity;
+	uint32_t	vbc_size_max;
+	uint32_t	vbc_seg_max;
+	struct {
+		uint16_t cylinders;
+		uint8_t heads;
+		uint8_t sectors;
+	} vbc_geometry;
+	uint32_t	vbc_blk_size;
+	struct {
+		uint8_t physical_block_exp;
+		uint8_t alignment_offset;
+		uint16_t min_io_size;
+		uint32_t opt_io_size;
+	} vbc_topology;
+	uint8_t		vbc_writeback;
+} __packed;
+
+/*
+ * Fixed-size block header
+ */
+struct virtio_blk_hdr {
+#define	VBH_OP_READ		0
+#define	VBH_OP_WRITE		1
+#define	VBH_OP_FLUSH		4
+#define	VBH_OP_FLUSH_OUT	5
+#define	VBH_OP_IDENT		8		
+#define	VBH_FLAG_BARRIER	0x80000000	/* OR'ed into vbh_type */
+	uint32_t       	vbh_type;
+	uint32_t	vbh_ioprio;
+	uint64_t	vbh_sector;
+} __packed;
+
+/*
+ * Debug printf
+ */
+static int pci_vtblk_debug;
+#define DPRINTF(params) if (pci_vtblk_debug) printf params
+#define WPRINTF(params) printf params
+
+struct pci_vtblk_ioreq {
+	struct blockif_req		io_req;
+	struct pci_vtblk_softc	       *io_sc;
+	uint8_t			       *io_status;
+	uint16_t			io_idx;
+};
+
+/*
+ * Per-device softc
+ */
+struct pci_vtblk_softc {
+	struct virtio_softc vbsc_vs;
+	pthread_mutex_t vsc_mtx;
+	struct vqueue_info vbsc_vq;
+	struct vtblk_config vbsc_cfg;
+	struct blockif_ctxt *bc;
+	char vbsc_ident[VTBLK_BLK_ID_BYTES];
+	struct pci_vtblk_ioreq vbsc_ios[VTBLK_RINGSZ];
+};
+
+static void pci_vtblk_reset(void *);
+static void pci_vtblk_notify(void *, struct vqueue_info *);
+static int pci_vtblk_cfgread(void *, int, int, uint32_t *);
+static int pci_vtblk_cfgwrite(void *, int, int, uint32_t);
+
+static struct virtio_consts vtblk_vi_consts = {
+	"vtblk",		/* our name */
+	1,			/* we support 1 virtqueue */
+	sizeof(struct vtblk_config), /* config reg size */
+	pci_vtblk_reset,	/* reset */
+	pci_vtblk_notify,	/* device-wide qnotify */
+	pci_vtblk_cfgread,	/* read PCI config */
+	pci_vtblk_cfgwrite,	/* write PCI config */
+	NULL,			/* apply negotiated features */
+	VTBLK_S_HOSTCAPS,	/* our capabilities */
+};
+
+static void
+pci_vtblk_reset(void *vsc)
+{
+	struct pci_vtblk_softc *sc = vsc;
+
+	DPRINTF(("vtblk: device reset requested !\n"));
+	vi_reset_dev(&sc->vbsc_vs);
+}
+
+static void
+pci_vtblk_done_locked(struct pci_vtblk_ioreq *io, int err)
+{
+	struct pci_vtblk_softc *sc = io->io_sc;
+
+	/* convert errno into a virtio block error return */
+	if (err == EOPNOTSUPP || err == ENOSYS)
+		*io->io_status = VTBLK_S_UNSUPP;
+	else if (err != 0)
+		*io->io_status = VTBLK_S_IOERR;
+	else
+		*io->io_status = VTBLK_S_OK;
+
+	/*
+	 * Return the descriptor back to the host.
+	 * We wrote 1 byte (our status) to host.
+	 */
+	vq_relchain(&sc->vbsc_vq, io->io_idx, 1);
+	vq_endchains(&sc->vbsc_vq, 0);
+}
+
+static void
+pci_vtblk_done(struct blockif_req *br, int err)
+{
+	struct pci_vtblk_ioreq *io = br->br_param;
+	struct pci_vtblk_softc *sc = io->io_sc;
+
+	pthread_mutex_lock(&sc->vsc_mtx);
+	pci_vtblk_done_locked(io, err);
+	pthread_mutex_unlock(&sc->vsc_mtx);
+}
+
+static void
+pci_vtblk_proc(struct pci_vtblk_softc *sc, struct vqueue_info *vq)
+{
+	struct virtio_blk_hdr *vbh;
+	struct pci_vtblk_ioreq *io;
+	int i, n;
+	int err;
+	ssize_t iolen;
+	int writeop, type;
+	struct iovec iov[BLOCKIF_IOV_MAX + 2];
+	uint16_t idx, flags[BLOCKIF_IOV_MAX + 2];
+
+	n = vq_getchain(vq, &idx, iov, BLOCKIF_IOV_MAX + 2, flags);
+
+	/*
+	 * The first descriptor will be the read-only fixed header,
+	 * and the last is for status (hence +2 above and below).
+	 * The remaining iov's are the actual data I/O vectors.
+	 *
+	 * XXX - note - this fails on crash dump, which does a
+	 * VIRTIO_BLK_T_FLUSH with a zero transfer length
+	 */
+	assert(n >= 2 && n <= BLOCKIF_IOV_MAX + 2);
+
+	io = &sc->vbsc_ios[idx];
+	assert((flags[0] & VRING_DESC_F_WRITE) == 0);
+	assert(iov[0].iov_len == sizeof(struct virtio_blk_hdr));
+	vbh = (struct virtio_blk_hdr *)iov[0].iov_base;
+	memcpy(&io->io_req.br_iov, &iov[1], sizeof(struct iovec) * (n - 2));
+	io->io_req.br_iovcnt = n - 2;
+	io->io_req.br_offset = vbh->vbh_sector * DEV_BSIZE;
+	io->io_status = (uint8_t *)iov[--n].iov_base;
+	assert(iov[n].iov_len == 1);
+	assert(flags[n] & VRING_DESC_F_WRITE);
+
+	/*
+	 * XXX
+	 * The guest should not be setting the BARRIER flag because
+	 * we don't advertise the capability.
+	 */
+	type = vbh->vbh_type & ~VBH_FLAG_BARRIER;
+	writeop = (type == VBH_OP_WRITE);
+
+	iolen = 0;
+	for (i = 1; i < n; i++) {
+		/*
+		 * - write op implies read-only descriptor,
+		 * - read/ident op implies write-only descriptor,
+		 * therefore test the inverse of the descriptor bit
+		 * to the op.
+		 */
+		assert(((flags[i] & VRING_DESC_F_WRITE) == 0) == writeop);
+		iolen += iov[i].iov_len;
+	}
+	io->io_req.br_resid = iolen;
+
+	DPRINTF(("virtio-block: %s op, %zd bytes, %d segs, offset %ld\n\r", 
+		 writeop ? "write" : "read/ident", iolen, i - 1,
+		 io->io_req.br_offset));
+
+	switch (type) {
+	case VBH_OP_READ:
+		err = blockif_read(sc->bc, &io->io_req);
+		break;
+	case VBH_OP_WRITE:
+#ifdef __FreeBSD__
+		err = blockif_write(sc->bc, &io->io_req);
+#else
+		err = blockif_write(sc->bc, &io->io_req,
+		    (sc->vbsc_vs.vs_negotiated_caps & VTBLK_F_FLUSH) == 0);
+#endif
+		break;
+	case VBH_OP_FLUSH:
+	case VBH_OP_FLUSH_OUT:
+		err = blockif_flush(sc->bc, &io->io_req);
+		break;
+	case VBH_OP_IDENT:
+		/* Assume a single buffer */
+		/* S/n equal to buffer is not zero-terminated. */
+		memset(iov[1].iov_base, 0, iov[1].iov_len);
+		strncpy(iov[1].iov_base, sc->vbsc_ident,
+		    MIN(iov[1].iov_len, sizeof(sc->vbsc_ident)));
+		pci_vtblk_done_locked(io, 0);
+		return;
+	default:
+		pci_vtblk_done_locked(io, EOPNOTSUPP);
+		return;
+	}
+	assert(err == 0);
+}
+
+static void
+pci_vtblk_notify(void *vsc, struct vqueue_info *vq)
+{
+	struct pci_vtblk_softc *sc = vsc;
+
+	while (vq_has_descs(vq))
+		pci_vtblk_proc(sc, vq);
+}
+
+static int
+pci_vtblk_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	char bident[sizeof("XX:X:X")];
+	struct blockif_ctxt *bctxt;
+	MD5_CTX mdctx;
+	u_char digest[16];
+	struct pci_vtblk_softc *sc;
+	off_t size;
+	int i, sectsz, sts, sto;
+
+	if (opts == NULL) {
+		printf("virtio-block: backing device required\n");
+		return (1);
+	}
+
+	/*
+	 * The supplied backing file has to exist
+	 */
+	snprintf(bident, sizeof(bident), "%d:%d", pi->pi_slot, pi->pi_func);
+	bctxt = blockif_open(opts, bident);
+	if (bctxt == NULL) {       	
+		perror("Could not open backing file");
+		return (1);
+	}
+
+	size = blockif_size(bctxt);
+	sectsz = blockif_sectsz(bctxt);
+	blockif_psectsz(bctxt, &sts, &sto);
+
+	sc = calloc(1, sizeof(struct pci_vtblk_softc));
+	sc->bc = bctxt;
+	for (i = 0; i < VTBLK_RINGSZ; i++) {
+		struct pci_vtblk_ioreq *io = &sc->vbsc_ios[i];
+		io->io_req.br_callback = pci_vtblk_done;
+		io->io_req.br_param = io;
+		io->io_sc = sc;
+		io->io_idx = i;
+	}
+
+	pthread_mutex_init(&sc->vsc_mtx, NULL);
+
+	/* init virtio softc and virtqueues */
+	vi_softc_linkup(&sc->vbsc_vs, &vtblk_vi_consts, sc, pi, &sc->vbsc_vq);
+	sc->vbsc_vs.vs_mtx = &sc->vsc_mtx;
+
+	sc->vbsc_vq.vq_qsize = VTBLK_RINGSZ;
+	/* sc->vbsc_vq.vq_notify = we have no per-queue notify */
+
+	/*
+	 * Create an identifier for the backing file. Use parts of the
+	 * md5 sum of the filename
+	 */
+	MD5Init(&mdctx);
+	MD5Update(&mdctx, opts, strlen(opts));
+	MD5Final(digest, &mdctx);	
+	sprintf(sc->vbsc_ident, "BHYVE-%02X%02X-%02X%02X-%02X%02X",
+	    digest[0], digest[1], digest[2], digest[3], digest[4], digest[5]);
+
+	/* setup virtio block config space */
+	sc->vbsc_cfg.vbc_capacity = size / DEV_BSIZE; /* 512-byte units */
+	sc->vbsc_cfg.vbc_size_max = 0;	/* not negotiated */
+	sc->vbsc_cfg.vbc_seg_max = BLOCKIF_IOV_MAX;
+	sc->vbsc_cfg.vbc_geometry.cylinders = 0;	/* no geometry */
+	sc->vbsc_cfg.vbc_geometry.heads = 0;
+	sc->vbsc_cfg.vbc_geometry.sectors = 0;
+	sc->vbsc_cfg.vbc_blk_size = sectsz;
+	sc->vbsc_cfg.vbc_topology.physical_block_exp =
+	    (sts > sectsz) ? (ffsll(sts / sectsz) - 1) : 0;
+	sc->vbsc_cfg.vbc_topology.alignment_offset =
+	    (sto != 0) ? ((sts - sto) / sectsz) : 0;
+	sc->vbsc_cfg.vbc_topology.min_io_size = 0;
+	sc->vbsc_cfg.vbc_topology.opt_io_size = 0;
+	sc->vbsc_cfg.vbc_writeback = 0;
+
+	/*
+	 * Should we move some of this into virtio.c?  Could
+	 * have the device, class, and subdev_0 as fields in
+	 * the virtio constants structure.
+	 */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, VIRTIO_DEV_BLOCK);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, VIRTIO_VENDOR);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_STORAGE);
+	pci_set_cfgdata16(pi, PCIR_SUBDEV_0, VIRTIO_TYPE_BLOCK);
+	pci_set_cfgdata16(pi, PCIR_SUBVEND_0, VIRTIO_VENDOR);
+
+	if (vi_intr_init(&sc->vbsc_vs, 1, fbsdrun_virtio_msix())) {
+		blockif_close(sc->bc);
+		free(sc);
+		return (1);
+	}
+	vi_set_io_bar(&sc->vbsc_vs, 0);
+	return (0);
+}
+
+static int
+pci_vtblk_cfgwrite(void *vsc, int offset, int size, uint32_t value)
+{
+
+	DPRINTF(("vtblk: write to readonly reg %d\n\r", offset));
+	return (1);
+}
+
+static int
+pci_vtblk_cfgread(void *vsc, int offset, int size, uint32_t *retval)
+{
+	struct pci_vtblk_softc *sc = vsc;
+	void *ptr;
+
+	/* our caller has already verified offset and size */
+	ptr = (uint8_t *)&sc->vbsc_cfg + offset;
+	memcpy(retval, ptr, size);
+	return (0);
+}
+
+struct pci_devemu pci_de_vblk = {
+	.pe_emu =	"virtio-blk",
+	.pe_init =	pci_vtblk_init,
+	.pe_barwrite =	vi_pci_write,
+	.pe_barread =	vi_pci_read
+};
+PCI_EMUL_SET(pci_de_vblk);
diff --git a/usr/src/cmd/bhyve/pci_virtio_console.c b/usr/src/cmd/bhyve/pci_virtio_console.c
new file mode 100644
index 0000000000..c2f5f8fe60
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_virtio_console.c
@@ -0,0 +1,691 @@
+/*-
+ * Copyright (c) 2016 iXsystems Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Jakub Klama <jceel@FreeBSD.org>
+ * under sponsorship from iXsystems Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/linker_set.h>
+#include <sys/uio.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+#include <unistd.h>
+#include <assert.h>
+#include <pthread.h>
+#include <libgen.h>
+#include <sysexits.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "virtio.h"
+#include "mevent.h"
+#include "sockstream.h"
+
+#define	VTCON_RINGSZ	64
+#define	VTCON_MAXPORTS	16
+#define	VTCON_MAXQ	(VTCON_MAXPORTS * 2 + 2)
+
+#define	VTCON_DEVICE_READY	0
+#define	VTCON_DEVICE_ADD	1
+#define	VTCON_DEVICE_REMOVE	2
+#define	VTCON_PORT_READY	3
+#define	VTCON_CONSOLE_PORT	4
+#define	VTCON_CONSOLE_RESIZE	5
+#define	VTCON_PORT_OPEN		6
+#define	VTCON_PORT_NAME		7
+
+#define	VTCON_F_SIZE		0
+#define	VTCON_F_MULTIPORT	1
+#define	VTCON_F_EMERG_WRITE	2
+#define	VTCON_S_HOSTCAPS	\
+    (VTCON_F_SIZE | VTCON_F_MULTIPORT | VTCON_F_EMERG_WRITE)
+
+static int pci_vtcon_debug;
+#define DPRINTF(params) if (pci_vtcon_debug) printf params
+#define WPRINTF(params) printf params
+
+struct pci_vtcon_softc;
+struct pci_vtcon_port;
+struct pci_vtcon_config;
+typedef void (pci_vtcon_cb_t)(struct pci_vtcon_port *, void *, struct iovec *,
+    int);
+
+struct pci_vtcon_port {
+	struct pci_vtcon_softc * vsp_sc;
+	int                      vsp_id;
+	const char *             vsp_name;
+	bool                     vsp_enabled;
+	bool                     vsp_console;
+	bool                     vsp_rx_ready;
+	bool                     vsp_open;
+	int                      vsp_rxq;
+	int                      vsp_txq;
+	void *                   vsp_arg;
+	pci_vtcon_cb_t *         vsp_cb;
+};
+
+struct pci_vtcon_sock
+{
+	struct pci_vtcon_port *  vss_port;
+	const char *             vss_path;
+	struct mevent *          vss_server_evp;
+	struct mevent *          vss_conn_evp;
+	int                      vss_server_fd;
+	int                      vss_conn_fd;
+	bool                     vss_open;
+};
+
+struct pci_vtcon_softc {
+	struct virtio_softc      vsc_vs;
+	struct vqueue_info       vsc_queues[VTCON_MAXQ];
+	pthread_mutex_t          vsc_mtx;
+	uint64_t                 vsc_cfg;
+	uint64_t                 vsc_features;
+	char *                   vsc_rootdir;
+	int                      vsc_kq;
+	int                      vsc_nports;
+	bool                     vsc_ready;
+	struct pci_vtcon_port    vsc_control_port;
+ 	struct pci_vtcon_port    vsc_ports[VTCON_MAXPORTS];
+	struct pci_vtcon_config *vsc_config;
+};
+
+struct pci_vtcon_config {
+	uint16_t cols;
+	uint16_t rows;
+	uint32_t max_nr_ports;
+	uint32_t emerg_wr;
+} __attribute__((packed));
+
+struct pci_vtcon_control {
+	uint32_t id;
+	uint16_t event;
+	uint16_t value;
+} __attribute__((packed));
+
+struct pci_vtcon_console_resize {
+	uint16_t cols;
+	uint16_t rows;
+} __attribute__((packed));
+
+static void pci_vtcon_reset(void *);
+static void pci_vtcon_notify_rx(void *, struct vqueue_info *);
+static void pci_vtcon_notify_tx(void *, struct vqueue_info *);
+static int pci_vtcon_cfgread(void *, int, int, uint32_t *);
+static int pci_vtcon_cfgwrite(void *, int, int, uint32_t);
+static void pci_vtcon_neg_features(void *, uint64_t);
+static void pci_vtcon_sock_accept(int, enum ev_type,  void *);
+static void pci_vtcon_sock_rx(int, enum ev_type, void *);
+static void pci_vtcon_sock_tx(struct pci_vtcon_port *, void *, struct iovec *,
+    int);
+static void pci_vtcon_control_send(struct pci_vtcon_softc *,
+    struct pci_vtcon_control *, const void *, size_t);
+static void pci_vtcon_announce_port(struct pci_vtcon_port *);
+static void pci_vtcon_open_port(struct pci_vtcon_port *, bool);
+
+static struct virtio_consts vtcon_vi_consts = {
+	"vtcon",		/* our name */
+	VTCON_MAXQ,		/* we support VTCON_MAXQ virtqueues */
+	sizeof(struct pci_vtcon_config), /* config reg size */
+	pci_vtcon_reset,	/* reset */
+	NULL,			/* device-wide qnotify */
+	pci_vtcon_cfgread,	/* read virtio config */
+	pci_vtcon_cfgwrite,	/* write virtio config */
+	pci_vtcon_neg_features,	/* apply negotiated features */
+	VTCON_S_HOSTCAPS,	/* our capabilities */
+};
+
+
+static void
+pci_vtcon_reset(void *vsc)
+{
+	struct pci_vtcon_softc *sc;
+
+	sc = vsc;
+
+	DPRINTF(("vtcon: device reset requested!\n"));
+	vi_reset_dev(&sc->vsc_vs);
+}
+
+static void
+pci_vtcon_neg_features(void *vsc, uint64_t negotiated_features)
+{
+	struct pci_vtcon_softc *sc = vsc;
+
+	sc->vsc_features = negotiated_features;
+}
+
+static int
+pci_vtcon_cfgread(void *vsc, int offset, int size, uint32_t *retval)
+{
+	struct pci_vtcon_softc *sc = vsc;
+	void *ptr;
+
+	ptr = (uint8_t *)sc->vsc_config + offset;
+	memcpy(retval, ptr, size);
+	return (0);
+}
+
+static int
+pci_vtcon_cfgwrite(void *vsc, int offset, int size, uint32_t val)
+{
+
+	return (0);
+}
+
+static inline struct pci_vtcon_port *
+pci_vtcon_vq_to_port(struct pci_vtcon_softc *sc, struct vqueue_info *vq)
+{
+	uint16_t num = vq->vq_num;
+
+	if (num == 0 || num == 1)
+		return (&sc->vsc_ports[0]);
+
+	if (num == 2 || num == 3)
+		return (&sc->vsc_control_port);
+
+	return (&sc->vsc_ports[(num / 2) - 1]);
+}
+
+static inline struct vqueue_info *
+pci_vtcon_port_to_vq(struct pci_vtcon_port *port, bool tx_queue)
+{
+	int qnum;
+
+	qnum = tx_queue ? port->vsp_txq : port->vsp_rxq;
+	return (&port->vsp_sc->vsc_queues[qnum]);
+}
+
+static struct pci_vtcon_port *
+pci_vtcon_port_add(struct pci_vtcon_softc *sc, const char *name,
+    pci_vtcon_cb_t *cb, void *arg)
+{
+	struct pci_vtcon_port *port;
+
+	if (sc->vsc_nports == VTCON_MAXPORTS) {
+		errno = EBUSY;
+		return (NULL);
+	}
+
+	port = &sc->vsc_ports[sc->vsc_nports++];
+	port->vsp_id = sc->vsc_nports - 1;
+	port->vsp_sc = sc;
+	port->vsp_name = name;
+	port->vsp_cb = cb;
+	port->vsp_arg = arg;
+
+	if (port->vsp_id == 0) {
+		/* port0 */
+		port->vsp_txq = 0;
+		port->vsp_rxq = 1;
+	} else {
+		port->vsp_txq = sc->vsc_nports * 2;
+		port->vsp_rxq = port->vsp_txq + 1;
+	}
+
+	port->vsp_enabled = true;
+	return (port);
+}
+
+static int
+pci_vtcon_sock_add(struct pci_vtcon_softc *sc, const char *name,
+    const char *path)
+{
+	struct pci_vtcon_sock *sock;
+#ifdef __FreeBSD__
+	struct sockaddr_un sun;
+	char *pathcopy;
+#else
+	/* Our compiler #defines 'sun' as '1'.  Awesome. */
+	struct sockaddr_un addr;
+#endif
+	int s = -1, fd = -1, error = 0;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+#endif
+
+	sock = calloc(1, sizeof(struct pci_vtcon_sock));
+	if (sock == NULL) {
+		error = -1;
+		goto out;
+	}
+
+	s = socket(AF_UNIX, SOCK_STREAM, 0);
+	if (s < 0) {
+		error = -1;
+		goto out;
+	}
+
+#ifdef __FreeBSD__
+	pathcopy = strdup(path);
+	if (pathcopy == NULL) {
+		error = -1;
+		goto out;
+	}
+
+	fd = open(dirname(pathcopy), O_RDONLY | O_DIRECTORY);
+	if (fd < 0) {
+		free(pathcopy);
+		error = -1;
+		goto out;
+	}
+
+	sun.sun_family = AF_UNIX;
+	sun.sun_len = sizeof(struct sockaddr_un);
+	strcpy(pathcopy, path);
+	strncpy(sun.sun_path, basename(pathcopy), sizeof(sun.sun_path));
+	free(pathcopy);
+
+	if (bindat(fd, s, (struct sockaddr *)&sun, sun.sun_len) < 0) {
+		error = -1;
+		goto out;
+	}
+#else /* __FreeBSD__ */
+	/* Do a simple bind rather than the FreeBSD bindat() */
+	addr.sun_family = AF_UNIX;
+	(void) strncpy(addr.sun_path, path, sizeof (addr.sun_path));
+	if (bind(fd, (struct sockaddr *)&addr, sizeof (addr)) < 0) {
+		error = -1;
+		goto out;
+	}
+#endif /* __FreeBSD__ */
+
+	if (fcntl(s, F_SETFL, O_NONBLOCK) < 0) {
+		error = -1;
+		goto out;
+	}
+
+	if (listen(s, 1) < 0) {
+		error = -1;
+		goto out;
+	}
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE);
+	if (cap_rights_limit(s, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	sock->vss_port = pci_vtcon_port_add(sc, name, pci_vtcon_sock_tx, sock);
+	if (sock->vss_port == NULL) {
+		error = -1;
+		goto out;
+	}
+
+	sock->vss_open = false;
+	sock->vss_conn_fd = -1;
+	sock->vss_server_fd = s;
+	sock->vss_server_evp = mevent_add(s, EVF_READ, pci_vtcon_sock_accept,
+	    sock);
+
+	if (sock->vss_server_evp == NULL) {
+		error = -1;
+		goto out;
+	}
+
+out:
+	if (fd != -1)
+		close(fd);
+
+	if (error != 0 && s != -1)
+		close(s);
+
+	return (error);
+}
+
+static void
+pci_vtcon_sock_accept(int fd __unused, enum ev_type t __unused, void *arg)
+{
+	struct pci_vtcon_sock *sock = (struct pci_vtcon_sock *)arg;
+	int s;
+
+	s = accept(sock->vss_server_fd, NULL, NULL);
+	if (s < 0)
+		return;
+
+	if (sock->vss_open) {
+		close(s);
+		return;
+	}
+
+	sock->vss_open = true;
+	sock->vss_conn_fd = s;
+	sock->vss_conn_evp = mevent_add(s, EVF_READ, pci_vtcon_sock_rx, sock);
+
+	pci_vtcon_open_port(sock->vss_port, true);
+}
+
+static void
+pci_vtcon_sock_rx(int fd __unused, enum ev_type t __unused, void *arg)
+{
+	struct pci_vtcon_port *port;
+	struct pci_vtcon_sock *sock = (struct pci_vtcon_sock *)arg;
+	struct vqueue_info *vq;
+	struct iovec iov;
+	static char dummybuf[2048];
+	int len, n;
+	uint16_t idx;
+
+	port = sock->vss_port;
+	vq = pci_vtcon_port_to_vq(port, true);
+
+	if (!sock->vss_open || !port->vsp_rx_ready) {
+		len = read(sock->vss_conn_fd, dummybuf, sizeof(dummybuf));
+		if (len == 0)
+			goto close;
+
+		return;
+	}
+
+	if (!vq_has_descs(vq)) {
+		len = read(sock->vss_conn_fd, dummybuf, sizeof(dummybuf));
+		vq_endchains(vq, 1);
+		if (len == 0)
+			goto close;
+
+		return;
+	}
+
+	do {
+		n = vq_getchain(vq, &idx, &iov, 1, NULL);
+		len = readv(sock->vss_conn_fd, &iov, n);
+
+		if (len == 0 || (len < 0 && errno == EWOULDBLOCK)) {
+			vq_retchain(vq);
+			vq_endchains(vq, 0);
+			if (len == 0)
+				goto close;
+
+			return;
+		}
+
+		vq_relchain(vq, idx, len);
+	} while (vq_has_descs(vq));
+
+	vq_endchains(vq, 1);
+
+close:
+	mevent_delete_close(sock->vss_conn_evp);
+	sock->vss_conn_fd = -1;
+	sock->vss_open = false;
+}
+
+static void
+pci_vtcon_sock_tx(struct pci_vtcon_port *port, void *arg, struct iovec *iov,
+    int niov)
+{
+	struct pci_vtcon_sock *sock;
+#ifdef __FreeBSD__
+	int i, ret;
+#else
+	int i, ret = 0;
+#endif
+
+	sock = (struct pci_vtcon_sock *)arg;
+
+	if (sock->vss_conn_fd == -1)
+		return;
+
+	for (i = 0; i < niov; i++) {
+		ret = stream_write(sock->vss_conn_fd, iov[i].iov_base,
+		    iov[i].iov_len);
+		if (ret <= 0)
+			break;
+	}
+
+	if (ret <= 0) {
+		mevent_delete_close(sock->vss_conn_evp);
+		sock->vss_conn_fd = -1;
+		sock->vss_open = false;
+	}
+}
+
+static void
+pci_vtcon_control_tx(struct pci_vtcon_port *port, void *arg, struct iovec *iov,
+    int niov)
+{
+	struct pci_vtcon_softc *sc;
+	struct pci_vtcon_port *tmp;
+	struct pci_vtcon_control resp, *ctrl;
+	int i;
+
+	assert(niov == 1);
+
+	sc = port->vsp_sc;
+	ctrl = (struct pci_vtcon_control *)iov->iov_base;
+
+	switch (ctrl->event) {
+	case VTCON_DEVICE_READY:
+		sc->vsc_ready = true;
+		/* set port ready events for registered ports */
+		for (i = 0; i < VTCON_MAXPORTS; i++) {
+			tmp = &sc->vsc_ports[i];
+			if (tmp->vsp_enabled)
+				pci_vtcon_announce_port(tmp);
+
+			if (tmp->vsp_open)
+				pci_vtcon_open_port(tmp, true);
+		}
+		break;
+
+	case VTCON_PORT_READY:
+		if (ctrl->id >= sc->vsc_nports) {
+			WPRINTF(("VTCON_PORT_READY event for unknown port %d\n",
+			    ctrl->id));
+			return;
+		}
+
+		tmp = &sc->vsc_ports[ctrl->id];
+		if (tmp->vsp_console) {
+			resp.event = VTCON_CONSOLE_PORT;
+			resp.id = ctrl->id;
+			resp.value = 1;
+			pci_vtcon_control_send(sc, &resp, NULL, 0);
+		}
+		break;
+	}
+}
+
+static void
+pci_vtcon_announce_port(struct pci_vtcon_port *port)
+{
+	struct pci_vtcon_control event;
+
+	event.id = port->vsp_id;
+	event.event = VTCON_DEVICE_ADD;
+	event.value = 1;
+	pci_vtcon_control_send(port->vsp_sc, &event, NULL, 0);
+
+	event.event = VTCON_PORT_NAME;
+	pci_vtcon_control_send(port->vsp_sc, &event, port->vsp_name,
+	    strlen(port->vsp_name));
+}
+
+static void
+pci_vtcon_open_port(struct pci_vtcon_port *port, bool open)
+{
+	struct pci_vtcon_control event;
+
+	if (!port->vsp_sc->vsc_ready) {
+		port->vsp_open = true;
+		return;
+	}
+
+	event.id = port->vsp_id;
+	event.event = VTCON_PORT_OPEN;
+	event.value = (int)open;
+	pci_vtcon_control_send(port->vsp_sc, &event, NULL, 0);
+}
+
+static void
+pci_vtcon_control_send(struct pci_vtcon_softc *sc,
+    struct pci_vtcon_control *ctrl, const void *payload, size_t len)
+{
+	struct vqueue_info *vq;
+	struct iovec iov;
+	uint16_t idx;
+	int n;
+
+	vq = pci_vtcon_port_to_vq(&sc->vsc_control_port, true);
+
+	if (!vq_has_descs(vq))
+		return;
+
+	n = vq_getchain(vq, &idx, &iov, 1, NULL);
+
+	assert(n == 1);
+
+	memcpy(iov.iov_base, ctrl, sizeof(struct pci_vtcon_control));
+	if (payload != NULL && len > 0)
+		memcpy(iov.iov_base + sizeof(struct pci_vtcon_control),
+		     payload, len);
+
+	vq_relchain(vq, idx, sizeof(struct pci_vtcon_control) + len);
+	vq_endchains(vq, 1);
+}
+    
+
+static void
+pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
+{
+	struct pci_vtcon_softc *sc;
+	struct pci_vtcon_port *port;
+	struct iovec iov[1];
+	uint16_t idx, n;
+	uint16_t flags[8];
+
+	sc = vsc;
+	port = pci_vtcon_vq_to_port(sc, vq);
+
+	while (vq_has_descs(vq)) {
+		n = vq_getchain(vq, &idx, iov, 1, flags);
+		if (port != NULL)
+			port->vsp_cb(port, port->vsp_arg, iov, 1);
+
+		/*
+		 * Release this chain and handle more
+		 */
+		vq_relchain(vq, idx, 0);
+	}
+	vq_endchains(vq, 1);	/* Generate interrupt if appropriate. */
+}
+
+static void
+pci_vtcon_notify_rx(void *vsc, struct vqueue_info *vq)
+{
+	struct pci_vtcon_softc *sc;
+	struct pci_vtcon_port *port;
+
+	sc = vsc;
+	port = pci_vtcon_vq_to_port(sc, vq);
+
+	if (!port->vsp_rx_ready) {
+		port->vsp_rx_ready = 1;
+		vq->vq_used->vu_flags |= VRING_USED_F_NO_NOTIFY;
+	}
+}
+
+static int
+pci_vtcon_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	struct pci_vtcon_softc *sc;
+	char *portname = NULL;
+	char *portpath = NULL;
+	char *opt;
+	int i;	
+
+	sc = calloc(1, sizeof(struct pci_vtcon_softc));
+	sc->vsc_config = calloc(1, sizeof(struct pci_vtcon_config));
+	sc->vsc_config->max_nr_ports = VTCON_MAXPORTS;
+	sc->vsc_config->cols = 80;
+	sc->vsc_config->rows = 25; 
+
+	vi_softc_linkup(&sc->vsc_vs, &vtcon_vi_consts, sc, pi, sc->vsc_queues);
+	sc->vsc_vs.vs_mtx = &sc->vsc_mtx;
+
+	for (i = 0; i < VTCON_MAXQ; i++) {
+		sc->vsc_queues[i].vq_qsize = VTCON_RINGSZ;
+		sc->vsc_queues[i].vq_notify = i % 2 == 0
+		    ? pci_vtcon_notify_rx
+		    : pci_vtcon_notify_tx;
+	}
+
+	/* initialize config space */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, VIRTIO_DEV_CONSOLE);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, VIRTIO_VENDOR);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_SIMPLECOMM);
+	pci_set_cfgdata16(pi, PCIR_SUBDEV_0, VIRTIO_TYPE_CONSOLE);
+	pci_set_cfgdata16(pi, PCIR_SUBVEND_0, VIRTIO_VENDOR);
+
+	if (vi_intr_init(&sc->vsc_vs, 1, fbsdrun_virtio_msix()))
+		return (1);
+	vi_set_io_bar(&sc->vsc_vs, 0);
+
+	/* create control port */
+	sc->vsc_control_port.vsp_sc = sc;
+	sc->vsc_control_port.vsp_txq = 2;
+	sc->vsc_control_port.vsp_rxq = 3;
+	sc->vsc_control_port.vsp_cb = pci_vtcon_control_tx;
+	sc->vsc_control_port.vsp_enabled = true;
+
+	while ((opt = strsep(&opts, ",")) != NULL) {
+		portname = strsep(&opt, "=");
+		portpath = strdup(opt);
+
+		/* create port */
+		if (pci_vtcon_sock_add(sc, portname, portpath) < 0) {
+			fprintf(stderr, "cannot create port %s: %s\n",
+			    portname, strerror(errno));
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+struct pci_devemu pci_de_vcon = {
+	.pe_emu =	"virtio-console",
+	.pe_init =	pci_vtcon_init,
+	.pe_barwrite =	vi_pci_write,
+	.pe_barread =	vi_pci_read
+};
+PCI_EMUL_SET(pci_de_vcon);
diff --git a/usr/src/cmd/bhyve/pci_virtio_net.c b/usr/src/cmd/bhyve/pci_virtio_net.c
new file mode 100644
index 0000000000..7a1c1f580a
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_virtio_net.c
@@ -0,0 +1,1163 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/linker_set.h>
+#include <sys/select.h>
+#include <sys/uio.h>
+#include <sys/ioctl.h>
+#include <machine/atomic.h>
+#include <net/ethernet.h>
+#ifdef __FreeBSD__
+#ifndef NETMAP_WITH_LIBS
+#define NETMAP_WITH_LIBS
+#endif
+#include <net/netmap_user.h>
+#endif
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+#include <assert.h>
+#include <md5.h>
+#include <pthread.h>
+#include <pthread_np.h>
+#include <sysexits.h>
+#ifndef __FreeBSD__
+#include <poll.h>
+#include <libdlpi.h>
+#endif
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#ifdef __FreeBSD__
+#include "mevent.h"
+#endif
+#include "virtio.h"
+
+#define VTNET_RINGSZ	1024
+
+#define VTNET_MAXSEGS	256
+
+/*
+ * Host capabilities.  Note that we only offer a few of these.
+ */
+#define	VIRTIO_NET_F_CSUM	(1 <<  0) /* host handles partial cksum */
+#define	VIRTIO_NET_F_GUEST_CSUM	(1 <<  1) /* guest handles partial cksum */
+#define	VIRTIO_NET_F_MAC	(1 <<  5) /* host supplies MAC */
+#define	VIRTIO_NET_F_GSO_DEPREC	(1 <<  6) /* deprecated: host handles GSO */
+#define	VIRTIO_NET_F_GUEST_TSO4	(1 <<  7) /* guest can rcv TSOv4 */
+#define	VIRTIO_NET_F_GUEST_TSO6	(1 <<  8) /* guest can rcv TSOv6 */
+#define	VIRTIO_NET_F_GUEST_ECN	(1 <<  9) /* guest can rcv TSO with ECN */
+#define	VIRTIO_NET_F_GUEST_UFO	(1 << 10) /* guest can rcv UFO */
+#define	VIRTIO_NET_F_HOST_TSO4	(1 << 11) /* host can rcv TSOv4 */
+#define	VIRTIO_NET_F_HOST_TSO6	(1 << 12) /* host can rcv TSOv6 */
+#define	VIRTIO_NET_F_HOST_ECN	(1 << 13) /* host can rcv TSO with ECN */
+#define	VIRTIO_NET_F_HOST_UFO	(1 << 14) /* host can rcv UFO */
+#define	VIRTIO_NET_F_MRG_RXBUF	(1 << 15) /* host can merge RX buffers */
+#define	VIRTIO_NET_F_STATUS	(1 << 16) /* config status field available */
+#define	VIRTIO_NET_F_CTRL_VQ	(1 << 17) /* control channel available */
+#define	VIRTIO_NET_F_CTRL_RX	(1 << 18) /* control channel RX mode support */
+#define	VIRTIO_NET_F_CTRL_VLAN	(1 << 19) /* control channel VLAN filtering */
+#define	VIRTIO_NET_F_GUEST_ANNOUNCE \
+				(1 << 21) /* guest can send gratuitous pkts */
+
+#define VTNET_S_HOSTCAPS      \
+  ( VIRTIO_NET_F_MAC | VIRTIO_NET_F_MRG_RXBUF | VIRTIO_NET_F_STATUS | \
+    VIRTIO_F_NOTIFY_ON_EMPTY | VIRTIO_RING_F_INDIRECT_DESC)
+
+/*
+ * PCI config-space "registers"
+ */
+struct virtio_net_config {
+	uint8_t  mac[6];
+	uint16_t status;
+} __packed;
+
+/*
+ * Queue definitions.
+ */
+#define VTNET_RXQ	0
+#define VTNET_TXQ	1
+#define VTNET_CTLQ	2	/* NB: not yet supported */
+
+#define VTNET_MAXQ	3
+
+/*
+ * Fixed network header size
+ */
+struct virtio_net_rxhdr {
+	uint8_t		vrh_flags;
+	uint8_t		vrh_gso_type;
+	uint16_t	vrh_hdr_len;
+	uint16_t	vrh_gso_size;
+	uint16_t	vrh_csum_start;
+	uint16_t	vrh_csum_offset;
+	uint16_t	vrh_bufs;
+} __packed;
+
+/*
+ * Debug printf
+ */
+static int pci_vtnet_debug;
+#define DPRINTF(params) if (pci_vtnet_debug) printf params
+#define WPRINTF(params) printf params
+
+/*
+ * Per-device softc
+ */
+struct pci_vtnet_softc {
+	struct virtio_softc vsc_vs;
+	struct vqueue_info vsc_queues[VTNET_MAXQ - 1];
+	pthread_mutex_t vsc_mtx;
+	struct mevent	*vsc_mevp;
+
+#ifdef	__FreeBSD
+	int		vsc_tapfd;
+#else
+	dlpi_handle_t	vsc_dhp;
+	int		vsc_dlpifd;
+#endif
+	struct nm_desc	*vsc_nmd;
+
+	int		vsc_rx_ready;
+	volatile int	resetting;	/* set and checked outside lock */
+
+	uint64_t	vsc_features;	/* negotiated features */
+
+	struct virtio_net_config vsc_config;
+
+	pthread_mutex_t	rx_mtx;
+	int		rx_in_progress;
+	int		rx_vhdrlen;
+	int		rx_merge;	/* merged rx bufs in use */
+
+	pthread_t 	tx_tid;
+	pthread_mutex_t	tx_mtx;
+	pthread_cond_t	tx_cond;
+	int		tx_in_progress;
+
+	void (*pci_vtnet_rx)(struct pci_vtnet_softc *sc);
+	void (*pci_vtnet_tx)(struct pci_vtnet_softc *sc, struct iovec *iov,
+			     int iovcnt, int len);
+};
+
+static void pci_vtnet_reset(void *);
+/* static void pci_vtnet_notify(void *, struct vqueue_info *); */
+static int pci_vtnet_cfgread(void *, int, int, uint32_t *);
+static int pci_vtnet_cfgwrite(void *, int, int, uint32_t);
+static void pci_vtnet_neg_features(void *, uint64_t);
+
+static struct virtio_consts vtnet_vi_consts = {
+	"vtnet",		/* our name */
+	VTNET_MAXQ - 1,		/* we currently support 2 virtqueues */
+	sizeof(struct virtio_net_config), /* config reg size */
+	pci_vtnet_reset,	/* reset */
+	NULL,			/* device-wide qnotify -- not used */
+	pci_vtnet_cfgread,	/* read PCI config */
+	pci_vtnet_cfgwrite,	/* write PCI config */
+	pci_vtnet_neg_features,	/* apply negotiated features */
+	VTNET_S_HOSTCAPS,	/* our capabilities */
+};
+
+/*
+ * If the transmit thread is active then stall until it is done.
+ */
+static void
+pci_vtnet_txwait(struct pci_vtnet_softc *sc)
+{
+
+	pthread_mutex_lock(&sc->tx_mtx);
+	while (sc->tx_in_progress) {
+		pthread_mutex_unlock(&sc->tx_mtx);
+		usleep(10000);
+		pthread_mutex_lock(&sc->tx_mtx);
+	}
+	pthread_mutex_unlock(&sc->tx_mtx);
+}
+
+/*
+ * If the receive thread is active then stall until it is done.
+ */
+static void
+pci_vtnet_rxwait(struct pci_vtnet_softc *sc)
+{
+
+	pthread_mutex_lock(&sc->rx_mtx);
+	while (sc->rx_in_progress) {
+		pthread_mutex_unlock(&sc->rx_mtx);
+		usleep(10000);
+		pthread_mutex_lock(&sc->rx_mtx);
+	}
+	pthread_mutex_unlock(&sc->rx_mtx);
+}
+
+static void
+pci_vtnet_reset(void *vsc)
+{
+	struct pci_vtnet_softc *sc = vsc;
+
+	DPRINTF(("vtnet: device reset requested !\n"));
+
+	sc->resetting = 1;
+
+	/*
+	 * Wait for the transmit and receive threads to finish their
+	 * processing.
+	 */
+	pci_vtnet_txwait(sc);
+	pci_vtnet_rxwait(sc);
+
+	sc->vsc_rx_ready = 0;
+	sc->rx_merge = 1;
+	sc->rx_vhdrlen = sizeof(struct virtio_net_rxhdr);
+
+	/* now reset rings, MSI-X vectors, and negotiated capabilities */
+	vi_reset_dev(&sc->vsc_vs);
+
+	sc->resetting = 0;
+}
+
+/*
+ * Called to send a buffer chain out to the tap device
+ */
+#ifdef __FreeBSD__
+static void
+pci_vtnet_tap_tx(struct pci_vtnet_softc *sc, struct iovec *iov, int iovcnt,
+		 int len)
+{
+	static char pad[60]; /* all zero bytes */
+
+	if (sc->vsc_tapfd == -1)
+		return;
+
+	/*
+	 * If the length is < 60, pad out to that and add the
+	 * extra zero'd segment to the iov. It is guaranteed that
+	 * there is always an extra iov available by the caller.
+	 */
+	if (len < 60) {
+		iov[iovcnt].iov_base = pad;
+		iov[iovcnt].iov_len = 60 - len;
+		iovcnt++;
+	}
+	(void) writev(sc->vsc_tapfd, iov, iovcnt);
+}
+#else
+static void
+pci_vtnet_tap_tx(struct pci_vtnet_softc *sc, struct iovec *iov, int iovcnt,
+		 int len)
+{
+	int i;
+
+	for (i = 0; i < iovcnt; i++) {
+		(void) dlpi_send(sc->vsc_dhp, NULL, NULL,
+				 iov[i].iov_base, iov[i].iov_len, NULL);
+	}
+}
+#endif /* __FreeBSD__ */
+
+#ifdef __FreeBSD__
+/*
+ *  Called when there is read activity on the tap file descriptor.
+ * Each buffer posted by the guest is assumed to be able to contain
+ * an entire ethernet frame + rx header.
+ *  MP note: the dummybuf is only used for discarding frames, so there
+ * is no need for it to be per-vtnet or locked.
+ */
+static uint8_t dummybuf[2048];
+#endif /* __FreeBSD__ */
+
+static __inline struct iovec *
+rx_iov_trim(struct iovec *iov, int *niov, int tlen)
+{
+	struct iovec *riov;
+
+	/* XXX short-cut: assume first segment is >= tlen */
+	assert(iov[0].iov_len >= tlen);
+
+	iov[0].iov_len -= tlen;
+	if (iov[0].iov_len == 0) {
+		assert(*niov > 1);
+		*niov -= 1;
+		riov = &iov[1];
+	} else {
+		iov[0].iov_base = (void *)((uintptr_t)iov[0].iov_base + tlen);
+		riov = &iov[0];
+	}
+
+	return (riov);
+}
+
+static void
+pci_vtnet_tap_rx(struct pci_vtnet_softc *sc)
+{
+	struct iovec iov[VTNET_MAXSEGS], *riov;
+	struct vqueue_info *vq;
+	void *vrx;
+	int n;
+#ifdef	__FreeBSD__
+	int len;
+#else
+	size_t len;
+	int ret;
+#endif
+	uint16_t idx;
+
+	/*
+	 * Should never be called without a valid tap fd
+	 */
+#ifdef	__FreeBSD__
+	assert(sc->vsc_tapfd != -1);
+#else
+	assert(sc->vsc_dlpifd != -1);
+#endif
+
+	/*
+	 * But, will be called when the rx ring hasn't yet
+	 * been set up or the guest is resetting the device.
+	 */
+	if (!sc->vsc_rx_ready || sc->resetting) {
+#ifdef	__FreeBSD__
+		/*
+		 * Drop the packet and try later.
+		 */
+		(void) read(sc->vsc_tapfd, dummybuf, sizeof(dummybuf));
+#endif
+		return;
+	}
+
+	/*
+	 * Check for available rx buffers
+	 */
+	vq = &sc->vsc_queues[VTNET_RXQ];
+	if (!vq_has_descs(vq)) {
+		/*
+		 * Drop the packet and try later.  Interrupt on
+		 * empty, if that's negotiated.
+		 */
+#ifdef	__FreeBSD__
+		(void) read(sc->vsc_tapfd, dummybuf, sizeof(dummybuf));
+#endif
+		vq_endchains(vq, 1);
+		return;
+	}
+
+	do {
+		/*
+		 * Get descriptor chain
+		 */
+		n = vq_getchain(vq, &idx, iov, VTNET_MAXSEGS, NULL);
+		assert(n >= 1 && n <= VTNET_MAXSEGS);
+
+		/*
+		 * Get a pointer to the rx header, and use the
+		 * data immediately following it for the packet buffer.
+		 */
+		vrx = iov[0].iov_base;
+		riov = rx_iov_trim(iov, &n, sc->rx_vhdrlen);
+#ifdef	__FreeBSD__
+		len = readv(sc->vsc_tapfd, riov, n);
+#else
+		len = riov[0].iov_len;
+		ret = dlpi_recv(sc->vsc_dhp, NULL, NULL,
+		    (uint8_t *)riov[0].iov_base, &len, 0, NULL);
+		if (ret != DLPI_SUCCESS) {
+			errno = EWOULDBLOCK;
+			len = 0;
+		}
+#endif
+		if (len <= 0 && errno == EWOULDBLOCK) {
+			/*
+			 * No more packets, but still some avail ring
+			 * entries.  Interrupt if needed/appropriate.
+			 */
+			vq_retchain(vq);
+			vq_endchains(vq, 0);
+			return;
+		}
+
+		/*
+		 * The only valid field in the rx packet header is the
+		 * number of buffers if merged rx bufs were negotiated.
+		 */
+		memset(vrx, 0, sc->rx_vhdrlen);
+
+		if (sc->rx_merge) {
+			struct virtio_net_rxhdr *vrxh;
+
+			vrxh = vrx;
+			vrxh->vrh_bufs = 1;
+		}
+
+		/*
+		 * Release this chain and handle more chains.
+		 */
+		vq_relchain(vq, idx, len + sc->rx_vhdrlen);
+	} while (vq_has_descs(vq));
+
+	/* Interrupt if needed, including for NOTIFY_ON_EMPTY. */
+	vq_endchains(vq, 1);
+}
+
+#ifdef __FreeBSD__
+static __inline int
+pci_vtnet_netmap_writev(struct nm_desc *nmd, struct iovec *iov, int iovcnt)
+{
+	int r, i;
+	int len = 0;
+
+	for (r = nmd->cur_tx_ring; ; ) {
+		struct netmap_ring *ring = NETMAP_TXRING(nmd->nifp, r);
+		uint32_t cur, idx;
+		char *buf;
+
+		if (nm_ring_empty(ring)) {
+			r++;
+			if (r > nmd->last_tx_ring)
+				r = nmd->first_tx_ring;
+			if (r == nmd->cur_tx_ring)
+				break;
+			continue;
+		}
+		cur = ring->cur;
+		idx = ring->slot[cur].buf_idx;
+		buf = NETMAP_BUF(ring, idx);
+
+		for (i = 0; i < iovcnt; i++) {
+			if (len + iov[i].iov_len > 2048)
+				break;
+			memcpy(&buf[len], iov[i].iov_base, iov[i].iov_len);
+			len += iov[i].iov_len;
+		}
+		ring->slot[cur].len = len;
+		ring->head = ring->cur = nm_ring_next(ring, cur);
+		nmd->cur_tx_ring = r;
+		ioctl(nmd->fd, NIOCTXSYNC, NULL);
+		break;
+	}
+
+	return (len);
+}
+
+static __inline int
+pci_vtnet_netmap_readv(struct nm_desc *nmd, struct iovec *iov, int iovcnt)
+{
+	int len = 0;
+	int i = 0;
+	int r;
+
+	for (r = nmd->cur_rx_ring; ; ) {
+		struct netmap_ring *ring = NETMAP_RXRING(nmd->nifp, r);
+		uint32_t cur, idx;
+		char *buf;
+		size_t left;
+
+		if (nm_ring_empty(ring)) {
+			r++;
+			if (r > nmd->last_rx_ring)
+				r = nmd->first_rx_ring;
+			if (r == nmd->cur_rx_ring)
+				break;
+			continue;
+		}
+		cur = ring->cur;
+		idx = ring->slot[cur].buf_idx;
+		buf = NETMAP_BUF(ring, idx);
+		left = ring->slot[cur].len;
+
+		for (i = 0; i < iovcnt && left > 0; i++) {
+			if (iov[i].iov_len > left)
+				iov[i].iov_len = left;
+			memcpy(iov[i].iov_base, &buf[len], iov[i].iov_len);
+			len += iov[i].iov_len;
+			left -= iov[i].iov_len;
+		}
+		ring->head = ring->cur = nm_ring_next(ring, cur);
+		nmd->cur_rx_ring = r;
+		ioctl(nmd->fd, NIOCRXSYNC, NULL);
+		break;
+	}
+	for (; i < iovcnt; i++)
+		iov[i].iov_len = 0;
+
+	return (len);
+}
+
+/*
+ * Called to send a buffer chain out to the vale port
+ */
+static void
+pci_vtnet_netmap_tx(struct pci_vtnet_softc *sc, struct iovec *iov, int iovcnt,
+		    int len)
+{
+	static char pad[60]; /* all zero bytes */
+
+	if (sc->vsc_nmd == NULL)
+		return;
+
+	/*
+	 * If the length is < 60, pad out to that and add the
+	 * extra zero'd segment to the iov. It is guaranteed that
+	 * there is always an extra iov available by the caller.
+	 */
+	if (len < 60) {
+		iov[iovcnt].iov_base = pad;
+		iov[iovcnt].iov_len = 60 - len;
+		iovcnt++;
+	}
+	(void) pci_vtnet_netmap_writev(sc->vsc_nmd, iov, iovcnt);
+}
+
+static void
+pci_vtnet_netmap_rx(struct pci_vtnet_softc *sc)
+{
+	struct iovec iov[VTNET_MAXSEGS], *riov;
+	struct vqueue_info *vq;
+	void *vrx;
+	int len, n;
+	uint16_t idx;
+
+	/*
+	 * Should never be called without a valid netmap descriptor
+	 */
+	assert(sc->vsc_nmd != NULL);
+
+	/*
+	 * But, will be called when the rx ring hasn't yet
+	 * been set up or the guest is resetting the device.
+	 */
+	if (!sc->vsc_rx_ready || sc->resetting) {
+		/*
+		 * Drop the packet and try later.
+		 */
+		(void) nm_nextpkt(sc->vsc_nmd, (void *)dummybuf);
+		return;
+	}
+
+	/*
+	 * Check for available rx buffers
+	 */
+	vq = &sc->vsc_queues[VTNET_RXQ];
+	if (!vq_has_descs(vq)) {
+		/*
+		 * Drop the packet and try later.  Interrupt on
+		 * empty, if that's negotiated.
+		 */
+		(void) nm_nextpkt(sc->vsc_nmd, (void *)dummybuf);
+		vq_endchains(vq, 1);
+		return;
+	}
+
+	do {
+		/*
+		 * Get descriptor chain.
+		 */
+		n = vq_getchain(vq, &idx, iov, VTNET_MAXSEGS, NULL);
+		assert(n >= 1 && n <= VTNET_MAXSEGS);
+
+		/*
+		 * Get a pointer to the rx header, and use the
+		 * data immediately following it for the packet buffer.
+		 */
+		vrx = iov[0].iov_base;
+		riov = rx_iov_trim(iov, &n, sc->rx_vhdrlen);
+
+		len = pci_vtnet_netmap_readv(sc->vsc_nmd, riov, n);
+
+		if (len == 0) {
+			/*
+			 * No more packets, but still some avail ring
+			 * entries.  Interrupt if needed/appropriate.
+			 */
+			vq_retchain(vq);
+			vq_endchains(vq, 0);
+			return;
+		}
+
+		/*
+		 * The only valid field in the rx packet header is the
+		 * number of buffers if merged rx bufs were negotiated.
+		 */
+		memset(vrx, 0, sc->rx_vhdrlen);
+
+		if (sc->rx_merge) {
+			struct virtio_net_rxhdr *vrxh;
+
+			vrxh = vrx;
+			vrxh->vrh_bufs = 1;
+		}
+
+		/*
+		 * Release this chain and handle more chains.
+		 */
+		vq_relchain(vq, idx, len + sc->rx_vhdrlen);
+	} while (vq_has_descs(vq));
+
+	/* Interrupt if needed, including for NOTIFY_ON_EMPTY. */
+	vq_endchains(vq, 1);
+}
+#endif /* __FreeBSD__ */
+
+#ifdef __FreeBSD__
+static void
+pci_vtnet_rx_callback(int fd, enum ev_type type, void *param)
+{
+	struct pci_vtnet_softc *sc = param;
+
+	pthread_mutex_lock(&sc->rx_mtx);
+	sc->rx_in_progress = 1;
+	sc->pci_vtnet_rx(sc);
+	sc->rx_in_progress = 0;
+	pthread_mutex_unlock(&sc->rx_mtx);
+
+}
+#else
+static void *
+pci_vtnet_poll_thread(void *param)
+{
+	struct pci_vtnet_softc *sc = param;
+	pollfd_t pollset;
+
+	pollset.fd = sc->vsc_dlpifd;
+	pollset.events = POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND;
+
+	for (;;) {
+		if (poll(&pollset, 1, -1) < 0) {
+			if (errno == EINTR)
+				continue;
+			fprintf(stderr, "pci_vtnet_poll_thread poll() error %d\n", errno);
+			continue;
+		}
+		pthread_mutex_lock(&sc->vsc_mtx);
+		sc->rx_in_progress = 1;
+		pci_vtnet_tap_rx(sc);
+		sc->rx_in_progress = 0;
+		pthread_mutex_unlock(&sc->vsc_mtx);
+	}
+
+	return (NULL);
+}
+#endif /* __FreeBSD__ */
+
+static void
+pci_vtnet_ping_rxq(void *vsc, struct vqueue_info *vq)
+{
+	struct pci_vtnet_softc *sc = vsc;
+
+	/*
+	 * A qnotify means that the rx process can now begin
+	 */
+	if (sc->vsc_rx_ready == 0) {
+		sc->vsc_rx_ready = 1;
+		vq->vq_used->vu_flags |= VRING_USED_F_NO_NOTIFY;
+	}
+}
+
+static void
+pci_vtnet_proctx(struct pci_vtnet_softc *sc, struct vqueue_info *vq)
+{
+	struct iovec iov[VTNET_MAXSEGS + 1];
+	int i, n;
+	int plen, tlen;
+	uint16_t idx;
+
+	/*
+	 * Obtain chain of descriptors.  The first one is
+	 * really the header descriptor, so we need to sum
+	 * up two lengths: packet length and transfer length.
+	 */
+	n = vq_getchain(vq, &idx, iov, VTNET_MAXSEGS, NULL);
+	assert(n >= 1 && n <= VTNET_MAXSEGS);
+	plen = 0;
+	tlen = iov[0].iov_len;
+	for (i = 1; i < n; i++) {
+		plen += iov[i].iov_len;
+		tlen += iov[i].iov_len;
+	}
+
+	DPRINTF(("virtio: packet send, %d bytes, %d segs\n\r", plen, n));
+	sc->pci_vtnet_tx(sc, &iov[1], n - 1, plen);
+
+	/* chain is processed, release it and set tlen */
+	vq_relchain(vq, idx, tlen);
+}
+
+static void
+pci_vtnet_ping_txq(void *vsc, struct vqueue_info *vq)
+{
+	struct pci_vtnet_softc *sc = vsc;
+
+	/*
+	 * Any ring entries to process?
+	 */
+	if (!vq_has_descs(vq))
+		return;
+
+	/* Signal the tx thread for processing */
+	pthread_mutex_lock(&sc->tx_mtx);
+	vq->vq_used->vu_flags |= VRING_USED_F_NO_NOTIFY;
+	if (sc->tx_in_progress == 0)
+		pthread_cond_signal(&sc->tx_cond);
+	pthread_mutex_unlock(&sc->tx_mtx);
+}
+
+/*
+ * Thread which will handle processing of TX desc
+ */
+static void *
+pci_vtnet_tx_thread(void *param)
+{
+	struct pci_vtnet_softc *sc = param;
+	struct vqueue_info *vq;
+	int error;
+
+	vq = &sc->vsc_queues[VTNET_TXQ];
+
+	/*
+	 * Let us wait till the tx queue pointers get initialised &
+	 * first tx signaled
+	 */
+	pthread_mutex_lock(&sc->tx_mtx);
+	error = pthread_cond_wait(&sc->tx_cond, &sc->tx_mtx);
+	assert(error == 0);
+
+	for (;;) {
+		/* note - tx mutex is locked here */
+		while (sc->resetting || !vq_has_descs(vq)) {
+			vq->vq_used->vu_flags &= ~VRING_USED_F_NO_NOTIFY;
+			mb();
+			if (!sc->resetting && vq_has_descs(vq))
+				break;
+
+			sc->tx_in_progress = 0;
+			error = pthread_cond_wait(&sc->tx_cond, &sc->tx_mtx);
+			assert(error == 0);
+		}
+		vq->vq_used->vu_flags |= VRING_USED_F_NO_NOTIFY;
+		sc->tx_in_progress = 1;
+		pthread_mutex_unlock(&sc->tx_mtx);
+
+		do {
+			/*
+			 * Run through entries, placing them into
+			 * iovecs and sending when an end-of-packet
+			 * is found
+			 */
+			pci_vtnet_proctx(sc, vq);
+		} while (vq_has_descs(vq));
+
+		/*
+		 * Generate an interrupt if needed.
+		 */
+		vq_endchains(vq, 1);
+
+		pthread_mutex_lock(&sc->tx_mtx);
+	}
+	return (NULL);
+}
+
+#ifdef __FreeBSD__
+static void
+pci_vtnet_ping_ctlq(void *vsc, struct vqueue_info *vq)
+{
+
+	DPRINTF(("vtnet: control qnotify!\n\r"));
+}
+#endif /* __FreeBSD__ */
+
+#ifdef __FreeBSD__
+static int
+pci_vtnet_parsemac(char *mac_str, uint8_t *mac_addr)
+{
+        struct ether_addr *ea;
+        char *tmpstr;
+        char zero_addr[ETHER_ADDR_LEN] = { 0, 0, 0, 0, 0, 0 };
+
+        tmpstr = strsep(&mac_str,"=");
+       
+        if ((mac_str != NULL) && (!strcmp(tmpstr,"mac"))) {
+                ea = ether_aton(mac_str);
+
+                if (ea == NULL || ETHER_IS_MULTICAST(ea->octet) ||
+                    memcmp(ea->octet, zero_addr, ETHER_ADDR_LEN) == 0) {
+			fprintf(stderr, "Invalid MAC %s\n", mac_str);
+                        return (EINVAL);
+                } else
+                        memcpy(mac_addr, ea->octet, ETHER_ADDR_LEN);
+        }
+
+        return (0);
+}
+#endif /* __FreeBSD__ */
+
+static void
+pci_vtnet_tap_setup(struct pci_vtnet_softc *sc, char *devname)
+{
+	char tbuf[80];
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+#endif
+#ifndef	__FreeBSD__
+	uchar_t physaddr[DLPI_PHYSADDR_MAX];
+	size_t physaddrlen = DLPI_PHYSADDR_MAX;
+	int error;
+#endif
+
+	strcpy(tbuf, "/dev/");
+	strlcat(tbuf, devname, sizeof(tbuf));
+
+	sc->pci_vtnet_rx = pci_vtnet_tap_rx;
+	sc->pci_vtnet_tx = pci_vtnet_tap_tx;
+#ifdef	__FreeBSD__
+	sc->vsc_tapfd = open(tbuf, O_RDWR);
+	if (sc->vsc_tapfd == -1) {
+		WPRINTF(("open of tap device %s failed\n", tbuf));
+		return;
+	}
+
+	/*
+	 * Set non-blocking and register for read
+	 * notifications with the event loop
+	 */
+	int opt = 1;
+	if (ioctl(sc->vsc_tapfd, FIONBIO, &opt) < 0) {
+		WPRINTF(("tap device O_NONBLOCK failed\n"));
+		close(sc->vsc_tapfd);
+		sc->vsc_tapfd = -1;
+	}
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_EVENT, CAP_READ, CAP_WRITE);
+	if (cap_rights_limit(sc->vsc_tapfd, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	sc->vsc_mevp = mevent_add(sc->vsc_tapfd,
+				  EVF_READ,
+				  pci_vtnet_rx_callback,
+				  sc);
+	if (sc->vsc_mevp == NULL) {
+		WPRINTF(("Could not register event\n"));
+		close(sc->vsc_tapfd);
+		sc->vsc_tapfd = -1;
+	}
+#else
+	if (dlpi_open(devname, &sc->vsc_dhp, DLPI_RAW) != DLPI_SUCCESS) {
+		WPRINTF(("open of vnic device %s failed\n", devname));
+	}
+
+	if (dlpi_get_physaddr(sc->vsc_dhp, DL_CURR_PHYS_ADDR, physaddr,
+	    &physaddrlen) != DLPI_SUCCESS) {
+		WPRINTF(("read MAC address of vnic device %s failed\n",
+		    devname));
+	}
+	if (physaddrlen != ETHERADDRL) {
+		WPRINTF(("bad MAC address len %d on vnic device %s\n",
+		    physaddrlen, devname));
+	}
+	memcpy(sc->vsc_config.mac, physaddr, ETHERADDRL);
+
+	if (dlpi_bind(sc->vsc_dhp, DLPI_ANY_SAP, NULL) != DLPI_SUCCESS) {
+		WPRINTF(("bind of vnic device %s failed\n", devname));
+	}
+
+	if (dlpi_promiscon(sc->vsc_dhp, DL_PROMISC_PHYS) != DLPI_SUCCESS) {
+		WPRINTF(("enable promiscous mode(physical) of vnic device %s "
+		    "failed\n", devname));
+	}
+	if (dlpi_promiscon(sc->vsc_dhp, DL_PROMISC_SAP) != DLPI_SUCCESS) {
+		WPRINTF(("enable promiscous mode(SAP) of vnic device %s "
+		    "failed\n", devname));
+	}
+
+	sc->vsc_dlpifd = dlpi_fd(sc->vsc_dhp);
+
+	if (fcntl(sc->vsc_dlpifd, F_SETFL, O_NONBLOCK) < 0) {
+		WPRINTF(("enable O_NONBLOCK of vnic device %s failed\n",
+		    devname));
+		dlpi_close(sc->vsc_dhp);
+		sc->vsc_dlpifd = -1;
+	}
+
+	error = pthread_create(NULL, NULL, pci_vtnet_poll_thread, sc);
+	assert(error == 0);
+#endif
+}
+
+#ifdef __FreeBSD__
+static void
+pci_vtnet_netmap_setup(struct pci_vtnet_softc *sc, char *ifname)
+{
+	sc->pci_vtnet_rx = pci_vtnet_netmap_rx;
+	sc->pci_vtnet_tx = pci_vtnet_netmap_tx;
+
+	sc->vsc_nmd = nm_open(ifname, NULL, 0, 0);
+	if (sc->vsc_nmd == NULL) {
+		WPRINTF(("open of netmap device %s failed\n", ifname));
+		return;
+	}
+
+	sc->vsc_mevp = mevent_add(sc->vsc_nmd->fd,
+				  EVF_READ,
+				  pci_vtnet_rx_callback,
+				  sc);
+	if (sc->vsc_mevp == NULL) {
+		WPRINTF(("Could not register event\n"));
+		nm_close(sc->vsc_nmd);
+		sc->vsc_nmd = NULL;
+	}
+}
+#endif /* __FreeBSD__ */
+
+static int
+pci_vtnet_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+#ifdef	__FreeBSD__
+	MD5_CTX mdctx;
+	unsigned char digest[16];
+	char nstr[80];
+#endif
+	char tname[MAXCOMLEN + 1];
+	struct pci_vtnet_softc *sc;
+	const char *env_msi;
+	char *devname;
+	char *vtopts;
+	int mac_provided;
+	int use_msix;
+
+	sc = calloc(1, sizeof(struct pci_vtnet_softc));
+
+	pthread_mutex_init(&sc->vsc_mtx, NULL);
+
+	vi_softc_linkup(&sc->vsc_vs, &vtnet_vi_consts, sc, pi, sc->vsc_queues);
+	sc->vsc_vs.vs_mtx = &sc->vsc_mtx;
+
+	sc->vsc_queues[VTNET_RXQ].vq_qsize = VTNET_RINGSZ;
+	sc->vsc_queues[VTNET_RXQ].vq_notify = pci_vtnet_ping_rxq;
+	sc->vsc_queues[VTNET_TXQ].vq_qsize = VTNET_RINGSZ;
+	sc->vsc_queues[VTNET_TXQ].vq_notify = pci_vtnet_ping_txq;
+#ifdef __FreeBSD__
+	sc->vsc_queues[VTNET_CTLQ].vq_qsize = VTNET_RINGSZ;
+        sc->vsc_queues[VTNET_CTLQ].vq_notify = pci_vtnet_ping_ctlq;
+#endif
+ 
+	/*
+	 * Use MSI if set by user
+	 */
+	use_msix = 1;
+	if ((env_msi = getenv("BHYVE_USE_MSI")) != NULL) {
+		if (strcasecmp(env_msi, "yes") == 0)
+			use_msix = 0;
+	}
+
+	/*
+	 * Attempt to open the tap device and read the MAC address
+	 * if specified
+	 */
+	mac_provided = 0;
+#ifdef	__FreeBSD__
+	sc->vsc_tapfd = -1;
+#endif
+	sc->vsc_nmd = NULL;
+	if (opts != NULL) {
+#ifdef	__FreeBSD__
+		int err;
+#endif
+
+		devname = vtopts = strdup(opts);
+		(void) strsep(&vtopts, ",");
+
+#ifdef	__FreBSD__
+		if (vtopts != NULL) {
+			err = pci_vtnet_parsemac(vtopts, sc->vsc_config.mac);
+			if (err != 0) {
+				free(devname);
+				return (err);
+			}
+			mac_provided = 1;
+		}
+#endif
+
+#ifdef __FreeBSD__
+		if (strncmp(devname, "vale", 4) == 0)
+			pci_vtnet_netmap_setup(sc, devname);
+#endif
+		if (strncmp(devname, "tap", 3) == 0 ||
+		    strncmp(devname, "vmnet", 5) == 0)
+			pci_vtnet_tap_setup(sc, devname);
+
+		free(devname);
+	}
+
+#ifdef	__FreeBSD__
+	/*
+	 * The default MAC address is the standard NetApp OUI of 00-a0-98,
+	 * followed by an MD5 of the PCI slot/func number and dev name
+	 */
+	if (!mac_provided) {
+		snprintf(nstr, sizeof(nstr), "%d-%d-%s", pi->pi_slot,
+	            pi->pi_func, vmname);
+
+		MD5Init(&mdctx);
+		MD5Update(&mdctx, nstr, strlen(nstr));
+		MD5Final(digest, &mdctx);
+
+		sc->vsc_config.mac[0] = 0x00;
+		sc->vsc_config.mac[1] = 0xa0;
+		sc->vsc_config.mac[2] = 0x98;
+		sc->vsc_config.mac[3] = digest[0];
+		sc->vsc_config.mac[4] = digest[1];
+		sc->vsc_config.mac[5] = digest[2];
+	}
+#endif
+
+	/* initialize config space */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, VIRTIO_DEV_NET);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, VIRTIO_VENDOR);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_NETWORK);
+	pci_set_cfgdata16(pi, PCIR_SUBDEV_0, VIRTIO_TYPE_NET);
+	pci_set_cfgdata16(pi, PCIR_SUBVEND_0, VIRTIO_VENDOR);
+
+	/* Link is up if we managed to open tap device or vale port. */
+#ifdef	__FreeBSD__
+	sc->vsc_config.status = (opts == NULL || sc->vsc_tapfd >= 0 ||
+#else
+	sc->vsc_config.status = (opts == NULL || sc->vsc_dlpifd >= 0 ||
+#endif
+	    sc->vsc_nmd != NULL);
+	
+	/* use BAR 1 to map MSI-X table and PBA, if we're using MSI-X */
+	if (vi_intr_init(&sc->vsc_vs, 1, use_msix))
+		return (1);
+
+	/* use BAR 0 to map config regs in IO space */
+	vi_set_io_bar(&sc->vsc_vs, 0);
+
+	sc->resetting = 0;
+
+	sc->rx_merge = 1;
+	sc->rx_vhdrlen = sizeof(struct virtio_net_rxhdr);
+	sc->rx_in_progress = 0;
+	pthread_mutex_init(&sc->rx_mtx, NULL); 
+
+	/* 
+	 * Initialize tx semaphore & spawn TX processing thread.
+	 * As of now, only one thread for TX desc processing is
+	 * spawned. 
+	 */
+	sc->tx_in_progress = 0;
+	pthread_mutex_init(&sc->tx_mtx, NULL);
+	pthread_cond_init(&sc->tx_cond, NULL);
+	pthread_create(&sc->tx_tid, NULL, pci_vtnet_tx_thread, (void *)sc);
+        snprintf(tname, sizeof(tname), "%s vtnet%d tx", vmname, pi->pi_slot);
+        pthread_set_name_np(sc->tx_tid, tname);
+
+	return (0);
+}
+
+static int
+pci_vtnet_cfgwrite(void *vsc, int offset, int size, uint32_t value)
+{
+	struct pci_vtnet_softc *sc = vsc;
+	void *ptr;
+
+	if (offset < 6) {
+		assert(offset + size <= 6);
+		/*
+		 * The driver is allowed to change the MAC address
+		 */
+		ptr = &sc->vsc_config.mac[offset];
+		memcpy(ptr, &value, size);
+	} else {
+		/* silently ignore other writes */
+		DPRINTF(("vtnet: write to readonly reg %d\n\r", offset));
+	}
+
+	return (0);
+}
+
+static int
+pci_vtnet_cfgread(void *vsc, int offset, int size, uint32_t *retval)
+{
+	struct pci_vtnet_softc *sc = vsc;
+	void *ptr;
+
+	ptr = (uint8_t *)&sc->vsc_config + offset;
+	memcpy(retval, ptr, size);
+	return (0);
+}
+
+static void
+pci_vtnet_neg_features(void *vsc, uint64_t negotiated_features)
+{
+	struct pci_vtnet_softc *sc = vsc;
+
+	sc->vsc_features = negotiated_features;
+
+	if (!(sc->vsc_features & VIRTIO_NET_F_MRG_RXBUF)) {
+		sc->rx_merge = 0;
+		/* non-merge rx header is 2 bytes shorter */
+		sc->rx_vhdrlen -= 2;
+	}
+}
+
+struct pci_devemu pci_de_vnet = {
+	.pe_emu = 	"virtio-net",
+	.pe_init =	pci_vtnet_init,
+	.pe_barwrite =	vi_pci_write,
+	.pe_barread =	vi_pci_read
+};
+PCI_EMUL_SET(pci_de_vnet);
diff --git a/usr/src/cmd/bhyve/pci_virtio_rnd.c b/usr/src/cmd/bhyve/pci_virtio_rnd.c
new file mode 100644
index 0000000000..4ce749053c
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_virtio_rnd.c
@@ -0,0 +1,203 @@
+/*-
+ * Copyright (c) 2014 Nahanni Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * virtio entropy device emulation.
+ * Randomness is sourced from /dev/random which does not block
+ * once it has been seeded at bootup.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/linker_set.h>
+#include <sys/uio.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <assert.h>
+#include <pthread.h>
+#include <sysexits.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "virtio.h"
+
+#define VTRND_RINGSZ	64
+
+
+static int pci_vtrnd_debug;
+#define DPRINTF(params) if (pci_vtrnd_debug) printf params
+#define WPRINTF(params) printf params
+
+/*
+ * Per-device softc
+ */
+struct pci_vtrnd_softc {
+	struct virtio_softc vrsc_vs;
+	struct vqueue_info  vrsc_vq;
+	pthread_mutex_t     vrsc_mtx;
+	uint64_t            vrsc_cfg;
+	int                 vrsc_fd;
+};
+
+static void pci_vtrnd_reset(void *);
+static void pci_vtrnd_notify(void *, struct vqueue_info *);
+
+static struct virtio_consts vtrnd_vi_consts = {
+	"vtrnd",		/* our name */
+	1,			/* we support 1 virtqueue */
+	0,			/* config reg size */
+	pci_vtrnd_reset,	/* reset */
+	pci_vtrnd_notify,	/* device-wide qnotify */
+	NULL,			/* read virtio config */
+	NULL,			/* write virtio config */
+	NULL,			/* apply negotiated features */
+	0,			/* our capabilities */
+};
+
+
+static void
+pci_vtrnd_reset(void *vsc)
+{
+	struct pci_vtrnd_softc *sc;
+
+	sc = vsc;
+
+	DPRINTF(("vtrnd: device reset requested !\n"));
+	vi_reset_dev(&sc->vrsc_vs);
+}
+
+
+static void
+pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
+{
+	struct iovec iov;
+	struct pci_vtrnd_softc *sc;
+	int len;
+	uint16_t idx;
+
+	sc = vsc;
+
+	if (sc->vrsc_fd < 0) {
+		vq_endchains(vq, 0);
+		return;
+	}
+
+	while (vq_has_descs(vq)) {
+		vq_getchain(vq, &idx, &iov, 1, NULL);
+
+		len = read(sc->vrsc_fd, iov.iov_base, iov.iov_len);
+
+		DPRINTF(("vtrnd: vtrnd_notify(): %d\r\n", len));
+
+		/* Catastrophe if unable to read from /dev/random */
+		assert(len > 0);
+
+		/*
+		 * Release this chain and handle more
+		 */
+		vq_relchain(vq, idx, len);
+	}
+	vq_endchains(vq, 1);	/* Generate interrupt if appropriate. */
+}
+
+
+static int
+pci_vtrnd_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	struct pci_vtrnd_softc *sc;
+	int fd;
+	int len;
+	uint8_t v;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+#endif
+
+	/*
+	 * Should always be able to open /dev/random.
+	 */
+	fd = open("/dev/random", O_RDONLY | O_NONBLOCK);
+
+	assert(fd >= 0);
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_READ);
+	if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	/*
+	 * Check that device is seeded and non-blocking.
+	 */
+	len = read(fd, &v, sizeof(v));
+	if (len <= 0) {
+		WPRINTF(("vtrnd: /dev/random not ready, read(): %d", len));
+		return (1);
+	}
+
+	sc = calloc(1, sizeof(struct pci_vtrnd_softc));
+
+	vi_softc_linkup(&sc->vrsc_vs, &vtrnd_vi_consts, sc, pi, &sc->vrsc_vq);
+	sc->vrsc_vs.vs_mtx = &sc->vrsc_mtx;
+
+	sc->vrsc_vq.vq_qsize = VTRND_RINGSZ;
+
+	/* keep /dev/random opened while emulating */
+	sc->vrsc_fd = fd;
+
+	/* initialize config space */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, VIRTIO_DEV_RANDOM);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, VIRTIO_VENDOR);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_CRYPTO);
+	pci_set_cfgdata16(pi, PCIR_SUBDEV_0, VIRTIO_TYPE_ENTROPY);
+	pci_set_cfgdata16(pi, PCIR_SUBVEND_0, VIRTIO_VENDOR);
+
+	if (vi_intr_init(&sc->vrsc_vs, 1, fbsdrun_virtio_msix()))
+		return (1);
+	vi_set_io_bar(&sc->vrsc_vs, 0);
+
+	return (0);
+}
+
+
+struct pci_devemu pci_de_vrnd = {
+	.pe_emu =	"virtio-rnd",
+	.pe_init =	pci_vtrnd_init,
+	.pe_barwrite =	vi_pci_write,
+	.pe_barread =	vi_pci_read
+};
+PCI_EMUL_SET(pci_de_vrnd);
diff --git a/usr/src/cmd/bhyve/pci_virtio_viona.c b/usr/src/cmd/bhyve/pci_virtio_viona.c
new file mode 100644
index 0000000000..a671617258
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_virtio_viona.c
@@ -0,0 +1,834 @@
+/*
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+
+#include <sys/param.h>
+#include <sys/linker_set.h>
+#include <sys/ioctl.h>
+#include <sys/viona_io.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+#include <assert.h>
+#include <pthread.h>
+#include <signal.h>
+#include <poll.h>
+#include <libdladm.h>
+#include <libdllink.h>
+#include <libdlvnic.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "virtio.h"
+
+#define	VIONA_RINGSZ	1024
+
+/*
+ * PCI config-space register offsets
+ */
+#define	VIONA_R_CFG0	24
+#define	VIONA_R_CFG1	25
+#define	VIONA_R_CFG2	26
+#define	VIONA_R_CFG3	27
+#define	VIONA_R_CFG4	28
+#define	VIONA_R_CFG5	29
+#define	VIONA_R_CFG6	30
+#define	VIONA_R_CFG7	31
+#define	VIONA_R_MAX	31
+
+#define	VIONA_REGSZ	VIONA_R_MAX+1
+
+/*
+ * Queue definitions.
+ */
+#define	VIONA_RXQ	0
+#define	VIONA_TXQ	1
+#define	VIONA_CTLQ	2
+
+#define	VIONA_MAXQ	3
+
+/*
+ * Debug printf
+ */
+static volatile int pci_viona_debug;
+#define	DPRINTF(params) if (pci_viona_debug) printf params
+#define	WPRINTF(params) printf params
+
+/*
+ * Per-device softc
+ */
+struct pci_viona_softc {
+	struct pci_devinst *vsc_pi;
+	pthread_mutex_t vsc_mtx;
+
+	int		vsc_curq;
+	int		vsc_status;
+	int		vsc_isr;
+
+	datalink_id_t	vsc_linkid;
+	int		vsc_vnafd;
+
+	/* Configurable parameters */
+	char		vsc_linkname[MAXLINKNAMELEN];
+	uint32_t	vsc_feature_mask;
+	uint16_t	vsc_vq_size;
+
+	uint32_t	vsc_features;
+	uint8_t		vsc_macaddr[6];
+
+	uint64_t	vsc_pfn[VIONA_MAXQ];
+	uint16_t	vsc_msix_table_idx[VIONA_MAXQ];
+	boolean_t	vsc_msix_active;
+};
+
+/*
+ * Return the size of IO BAR that maps virtio header and device specific
+ * region. The size would vary depending on whether MSI-X is enabled or
+ * not.
+ */
+static uint64_t
+pci_viona_iosize(struct pci_devinst *pi)
+{
+	if (pci_msix_enabled(pi))
+		return (VIONA_REGSZ);
+	else
+		return (VIONA_REGSZ - (VTCFG_R_CFG1 - VTCFG_R_MSIX));
+}
+
+static uint16_t
+pci_viona_qsize(struct pci_viona_softc *sc, int qnum)
+{
+	/* XXX no ctl queue currently */
+	if (qnum == VIONA_CTLQ) {
+		return (0);
+	}
+
+	return (sc->vsc_vq_size);
+}
+
+static void
+pci_viona_ring_reset(struct pci_viona_softc *sc, int ring)
+{
+	assert(ring < VIONA_MAXQ);
+
+	switch (ring) {
+	case VIONA_RXQ:
+	case VIONA_TXQ:
+		break;
+	case VIONA_CTLQ:
+	default:
+		return;
+	}
+
+	for (;;) {
+		int res;
+
+		res = ioctl(sc->vsc_vnafd, VNA_IOC_RING_RESET, ring);
+		if (res == 0) {
+			break;
+		} else if (errno != EINTR) {
+			WPRINTF(("ioctl viona ring %d reset failed %d\n",
+			    ring, errno));
+			return;
+		}
+	}
+
+	sc->vsc_pfn[ring] = 0;
+}
+
+static void
+pci_viona_update_status(struct pci_viona_softc *sc, uint32_t value)
+{
+
+	if (value == 0) {
+		DPRINTF(("viona: device reset requested !\n"));
+		pci_viona_ring_reset(sc, VIONA_RXQ);
+		pci_viona_ring_reset(sc, VIONA_TXQ);
+	}
+
+	sc->vsc_status = value;
+}
+
+static void *
+pci_viona_poll_thread(void *param)
+{
+	struct pci_viona_softc *sc = param;
+	pollfd_t pollset;
+	const int fd = sc->vsc_vnafd;
+
+	pollset.fd = fd;
+	pollset.events = POLLRDBAND;
+
+	for (;;) {
+		if (poll(&pollset, 1, -1) < 0) {
+			if (errno == EINTR || errno == EAGAIN) {
+				continue;
+			} else {
+				WPRINTF(("pci_viona_poll_thread poll()"
+				    "error %d\n", errno));
+				break;
+			}
+		}
+		if (pollset.revents & POLLRDBAND) {
+			vioc_intr_poll_t vip;
+			uint_t i;
+			int res;
+			boolean_t assert_lintr = B_FALSE;
+			const boolean_t do_msix = pci_msix_enabled(sc->vsc_pi);
+
+			res = ioctl(fd, VNA_IOC_INTR_POLL, &vip);
+			for (i = 0; res > 0 && i < VIONA_VQ_MAX; i++) {
+				if (vip.vip_status[i] == 0) {
+					continue;
+				}
+				if (do_msix) {
+					pci_generate_msix(sc->vsc_pi,
+					    sc->vsc_msix_table_idx[i]);
+				} else {
+					assert_lintr = B_TRUE;
+				}
+				res = ioctl(fd, VNA_IOC_RING_INTR_CLR, i);
+				if (res != 0) {
+					WPRINTF(("ioctl viona vq %d intr "
+					    "clear failed %d\n", i, errno));
+				}
+			}
+			if (assert_lintr) {
+				pthread_mutex_lock(&sc->vsc_mtx);
+				sc->vsc_isr |= VTCFG_ISR_QUEUES;
+				pci_lintr_assert(sc->vsc_pi);
+				pthread_mutex_unlock(&sc->vsc_mtx);
+			}
+		}
+	}
+
+	pthread_exit(NULL);
+}
+
+static void
+pci_viona_ring_init(struct pci_viona_softc *sc, uint64_t pfn)
+{
+	int			qnum = sc->vsc_curq;
+	vioc_ring_init_t	vna_ri;
+	int			error;
+
+	assert(qnum < VIONA_MAXQ);
+
+	if (qnum == VIONA_CTLQ) {
+		return;
+	}
+
+	sc->vsc_pfn[qnum] = (pfn << VRING_PFN);
+
+	vna_ri.ri_index = qnum;
+	vna_ri.ri_qsize = pci_viona_qsize(sc, qnum);
+	vna_ri.ri_qaddr = (pfn << VRING_PFN);
+	error = ioctl(sc->vsc_vnafd, VNA_IOC_RING_INIT, &vna_ri);
+
+	if (error != 0) {
+		WPRINTF(("ioctl viona ring %u init failed %d\n", qnum, errno));
+	}
+}
+
+static int
+pci_viona_viona_init(struct vmctx *ctx, struct pci_viona_softc *sc)
+{
+	vioc_create_t		vna_create;
+	int			error;
+
+	sc->vsc_vnafd = open("/dev/viona", O_RDWR | O_EXCL);
+	if (sc->vsc_vnafd == -1) {
+		WPRINTF(("open viona ctl failed: %d\n", errno));
+		return (-1);
+	}
+
+	vna_create.c_linkid = sc->vsc_linkid;
+	vna_create.c_vmfd = vm_get_device_fd(ctx);
+	error = ioctl(sc->vsc_vnafd, VNA_IOC_CREATE, &vna_create);
+	if (error != 0) {
+		(void) close(sc->vsc_vnafd);
+		WPRINTF(("ioctl viona create failed %d\n", errno));
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+pci_viona_parse_opts(struct pci_viona_softc *sc, char *opts)
+{
+	char *next, *cp, *vnic = NULL;
+	int err = 0;
+
+	sc->vsc_vq_size = VIONA_RINGSZ;
+	sc->vsc_feature_mask = 0;
+
+	for (; opts != NULL && *opts != '\0'; opts = next) {
+		char *val;
+
+		if ((cp = strchr(opts, ',')) != NULL) {
+			*cp = '\0';
+			next = cp + 1;
+		} else {
+			next = NULL;
+		}
+
+		if ((cp = strchr(opts, '=')) == NULL) {
+			/* vnic chosen with bare name */
+			if (vnic != NULL) {
+				fprintf(stderr,
+				    "viona: unexpected vnic name '%s'", opts);
+				err = -1;
+			} else {
+				vnic = opts;
+			}
+			continue;
+		}
+
+		/* <param>=<value> handling */
+		val = cp + 1;
+		*cp = '\0';
+		if (strcmp(opts, "feature_mask") == 0) {
+			long num;
+
+			errno = 0;
+			num = strtol(val, NULL, 0);
+			if (errno != 0 || num < 0) {
+				fprintf(stderr,
+				    "viona: invalid mask '%s'", val);
+			} else {
+				sc->vsc_feature_mask = num;
+			}
+		} else if (strcmp(opts, "vqsize") == 0) {
+			long num;
+
+			errno = 0;
+			num = strtol(val, NULL, 0);
+			if (errno != 0) {
+				fprintf(stderr,
+				    "viona: invalid vsqize '%s'", val);
+				err = -1;
+			} else if (num <= 2 || num > 32768) {
+				fprintf(stderr,
+				    "viona: vqsize out of range", num);
+				err = -1;
+			} else if ((1 << (ffs(num) - 1)) != num) {
+				fprintf(stderr,
+				    "viona: vqsize must be power of 2", num);
+				err = -1;
+			} else {
+				sc->vsc_vq_size = num;
+			}
+		} else {
+			fprintf(stderr,
+			    "viona: unrecognized option '%s'", opts);
+			err = -1;
+		}
+	}
+	if (vnic == NULL) {
+		fprintf(stderr, "viona: vnic name required");
+		sc->vsc_linkname[0] = '\0';
+		err = -1;
+	} else {
+		(void) strlcpy(sc->vsc_linkname, vnic, MAXLINKNAMELEN);
+	}
+
+	DPRINTF(("viona=%p dev=%s vqsize=%x feature_mask=%x\n", sc,
+	    sc->vsc_linkname, sc->vsc_vq_size, sc->vsc_feature_mask));
+	return (err);
+}
+
+static int
+pci_viona_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	dladm_handle_t		handle;
+	dladm_status_t		status;
+	dladm_vnic_attr_t	attr;
+	char			errmsg[DLADM_STRSIZE];
+	int error, i;
+	struct pci_viona_softc *sc;
+	uint64_t ioport;
+
+	if (opts == NULL) {
+		printf("virtio-viona: vnic required\n");
+		return (1);
+	}
+
+	sc = malloc(sizeof (struct pci_viona_softc));
+	memset(sc, 0, sizeof (struct pci_viona_softc));
+
+	pi->pi_arg = sc;
+	sc->vsc_pi = pi;
+
+	pthread_mutex_init(&sc->vsc_mtx, NULL);
+
+	if (pci_viona_parse_opts(sc, opts) != 0) {
+		free(sc);
+		return (1);
+	}
+
+	if ((status = dladm_open(&handle)) != DLADM_STATUS_OK) {
+		WPRINTF(("could not open /dev/dld"));
+		free(sc);
+		return (1);
+	}
+
+	if (dladm_name2info(handle, sc->vsc_linkname, &sc->vsc_linkid,
+	    NULL, NULL, NULL) != DLADM_STATUS_OK) {
+		WPRINTF(("dladm_name2info() for %s failed: %s\n", opts,
+		    dladm_status2str(status, errmsg)));
+		dladm_close(handle);
+		free(sc);
+		return (1);
+	}
+
+	if (dladm_vnic_info(handle, sc->vsc_linkid, &attr,
+	    DLADM_OPT_ACTIVE) != DLADM_STATUS_OK) {
+		WPRINTF(("dladm_vnic_info() for %s failed: %s\n", opts,
+		    dladm_status2str(status, errmsg)));
+		dladm_close(handle);
+		free(sc);
+		return (1);
+	}
+
+	memcpy(sc->vsc_macaddr, attr.va_mac_addr, ETHERADDRL);
+
+	dladm_close(handle);
+
+	error = pci_viona_viona_init(ctx, sc);
+	if (error != 0) {
+		free(sc);
+		return (1);
+	}
+
+	error = pthread_create(NULL, NULL, pci_viona_poll_thread, sc);
+	assert(error == 0);
+
+	/* initialize config space */
+	pci_set_cfgdata16(pi, PCIR_DEVICE, VIRTIO_DEV_NET);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, VIRTIO_VENDOR);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_NETWORK);
+	pci_set_cfgdata16(pi, PCIR_SUBDEV_0, VIRTIO_TYPE_NET);
+	pci_set_cfgdata16(pi, PCIR_SUBVEND_0, VIRTIO_VENDOR);
+
+	/* MSI-X support */
+	for (i = 0; i < VIONA_MAXQ; i++)
+		sc->vsc_msix_table_idx[i] = VIRTIO_MSI_NO_VECTOR;
+
+	/* BAR 1 used to map MSI-X table and PBA */
+	if (pci_emul_add_msixcap(pi, VIONA_MAXQ, 1)) {
+		free(sc);
+		return (1);
+	}
+
+	/* BAR 0 for legacy-style virtio register access. */
+	error = pci_emul_alloc_bar(pi, 0, PCIBAR_IO, VIONA_REGSZ);
+	if (error != NULL) {
+		WPRINTF(("could not allocate virtio BAR\n"));
+		free(sc);
+		return (1);
+	}
+
+	/* Install ioport hook for virtqueue notification */
+	ioport = pi->pi_bar[0].addr + VTCFG_R_QNOTIFY;
+	error = ioctl(sc->vsc_vnafd, VNA_IOC_SET_NOTIFY_IOP, ioport);
+	if (error != 0) {
+		WPRINTF(("could not install ioport hook at %x\n", ioport));
+		free(sc);
+		return (1);
+	}
+
+	/*
+	 * Need a legacy interrupt for virtio compliance, even though MSI-X
+	 * operation is _strongly_ suggested for adequate performance.
+	 */
+	pci_lintr_request(pi);
+
+	return (0);
+}
+
+static uint64_t
+viona_adjust_offset(struct pci_devinst *pi, uint64_t offset)
+{
+	/*
+	 * Device specific offsets used by guest would change based on
+	 * whether MSI-X capability is enabled or not
+	 */
+	if (!pci_msix_enabled(pi)) {
+		if (offset >= VTCFG_R_MSIX)
+			return (offset + (VTCFG_R_CFG1 - VTCFG_R_MSIX));
+	}
+
+	return (offset);
+}
+
+static void
+pci_viona_ring_set_msix(struct pci_devinst *pi, uint_t ring)
+{
+	struct pci_viona_softc *sc = pi->pi_arg;
+	struct msix_table_entry mte;
+	uint16_t tab_index;
+	vioc_ring_msi_t vrm;
+	int res;
+
+	assert(ring <= VIONA_VQ_TX);
+
+	vrm.rm_index = ring;
+	vrm.rm_addr = 0;
+	vrm.rm_msg = 0;
+	tab_index = sc->vsc_msix_table_idx[ring];
+
+	if (tab_index != VIRTIO_MSI_NO_VECTOR && sc->vsc_msix_active) {
+		mte = pi->pi_msix.table[tab_index];
+		if ((mte.vector_control & PCIM_MSIX_VCTRL_MASK) == 0) {
+			vrm.rm_addr = mte.addr;
+			vrm.rm_msg = mte.msg_data;
+		}
+	}
+
+	res = ioctl(sc->vsc_vnafd, VNA_IOC_RING_SET_MSI, &vrm);
+	if (res != 0) {
+		WPRINTF(("ioctl viona set_msi %d failed %d\n", ring, errno));
+	}
+}
+
+static void
+pci_viona_lintrupdate(struct pci_devinst *pi)
+{
+	struct pci_viona_softc *sc = pi->pi_arg;
+	boolean_t msix_on = B_FALSE;
+
+	pthread_mutex_lock(&sc->vsc_mtx);
+	msix_on = pci_msix_enabled(pi) && (pi->pi_msix.function_mask == 0);
+	if ((sc->vsc_msix_active && !msix_on) ||
+	    (msix_on && !sc->vsc_msix_active)) {
+		uint_t i;
+
+		sc->vsc_msix_active = msix_on;
+		/* Update in-kernel ring configs */
+		for (i = 0; i <= VIONA_VQ_TX; i++) {
+			pci_viona_ring_set_msix(pi, i);
+		}
+	}
+	pthread_mutex_unlock(&sc->vsc_mtx);
+}
+
+static void
+pci_viona_msix_update(struct pci_devinst *pi, uint64_t offset)
+{
+	struct pci_viona_softc *sc = pi->pi_arg;
+	uint_t tab_index, i;
+
+	pthread_mutex_lock(&sc->vsc_mtx);
+	if (!sc->vsc_msix_active) {
+		pthread_mutex_unlock(&sc->vsc_mtx);
+		return;
+	}
+
+	/*
+	 * Rather than update every possible MSI-X vector, cheat and use the
+	 * offset to calculate the entry within the table.  Since this should
+	 * only be called when a write to the table succeeds, the index should
+	 * be valid.
+	 */
+	tab_index = offset / MSIX_TABLE_ENTRY_SIZE;
+
+	for (i = 0; i <= VIONA_VQ_TX; i++) {
+		if (sc->vsc_msix_table_idx[i] != tab_index) {
+			continue;
+		}
+		pci_viona_ring_set_msix(pi, i);
+	}
+
+	pthread_mutex_unlock(&sc->vsc_mtx);
+}
+
+static void
+pci_viona_qnotify(struct pci_viona_softc *sc, int ring)
+{
+	int error;
+
+	switch (ring) {
+	case VIONA_TXQ:
+	case VIONA_RXQ:
+		error = ioctl(sc->vsc_vnafd, VNA_IOC_RING_KICK, ring);
+		if (error != 0) {
+			WPRINTF(("ioctl viona ring %d kick failed %d\n",
+			    ring, errno));
+		}
+		break;
+	case VIONA_CTLQ:
+		DPRINTF(("viona: control qnotify!\n"));
+		break;
+	default:
+		break;
+	}
+}
+
+static void
+pci_viona_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+    int baridx, uint64_t offset, int size, uint64_t value)
+{
+	struct pci_viona_softc *sc = pi->pi_arg;
+	void *ptr;
+	int err = 0;
+
+	if (baridx == pci_msix_table_bar(pi) ||
+	    baridx == pci_msix_pba_bar(pi)) {
+		if (pci_emul_msix_twrite(pi, offset, size, value) == 0) {
+			pci_viona_msix_update(pi, offset);
+		}
+		return;
+	}
+
+	assert(baridx == 0);
+
+	if (offset + size > pci_viona_iosize(pi)) {
+		DPRINTF(("viona_write: 2big, offset %ld size %d\n",
+		    offset, size));
+		return;
+	}
+
+	pthread_mutex_lock(&sc->vsc_mtx);
+
+	offset = viona_adjust_offset(pi, offset);
+
+	switch (offset) {
+	case VTCFG_R_GUESTCAP:
+		assert(size == 4);
+		value &= ~(sc->vsc_feature_mask);
+		err = ioctl(sc->vsc_vnafd, VNA_IOC_SET_FEATURES, &value);
+		if (err != 0) {
+			WPRINTF(("ioctl feature negotiation returned"
+			    " err = %d\n", errno));
+		} else {
+			sc->vsc_features = value;
+		}
+		break;
+	case VTCFG_R_PFN:
+		assert(size == 4);
+		pci_viona_ring_init(sc, value);
+		break;
+	case VTCFG_R_QSEL:
+		assert(size == 2);
+		assert(value < VIONA_MAXQ);
+		sc->vsc_curq = value;
+		break;
+	case VTCFG_R_QNOTIFY:
+		assert(size == 2);
+		assert(value < VIONA_MAXQ);
+		pci_viona_qnotify(sc, value);
+		break;
+	case VTCFG_R_STATUS:
+		assert(size == 1);
+		pci_viona_update_status(sc, value);
+		break;
+	case VTCFG_R_CFGVEC:
+		assert(size == 2);
+		sc->vsc_msix_table_idx[VIONA_CTLQ] = value;
+		break;
+	case VTCFG_R_QVEC:
+		assert(size == 2);
+		assert(sc->vsc_curq != VIONA_CTLQ);
+		sc->vsc_msix_table_idx[sc->vsc_curq] = value;
+		pci_viona_ring_set_msix(pi, sc->vsc_curq);
+		break;
+	case VIONA_R_CFG0:
+	case VIONA_R_CFG1:
+	case VIONA_R_CFG2:
+	case VIONA_R_CFG3:
+	case VIONA_R_CFG4:
+	case VIONA_R_CFG5:
+		assert((size + offset) <= (VIONA_R_CFG5 + 1));
+		ptr = &sc->vsc_macaddr[offset - VIONA_R_CFG0];
+		/*
+		 * The driver is allowed to change the MAC address
+		 */
+		sc->vsc_macaddr[offset - VIONA_R_CFG0] = value;
+		if (size == 1) {
+			*(uint8_t *)ptr = value;
+		} else if (size == 2) {
+			*(uint16_t *)ptr = value;
+		} else {
+			*(uint32_t *)ptr = value;
+		}
+		break;
+	case VTCFG_R_HOSTCAP:
+	case VTCFG_R_QNUM:
+	case VTCFG_R_ISR:
+	case VIONA_R_CFG6:
+	case VIONA_R_CFG7:
+		DPRINTF(("viona: write to readonly reg %ld\n\r", offset));
+		break;
+	default:
+		DPRINTF(("viona: unknown i/o write offset %ld\n\r", offset));
+		value = 0;
+		break;
+	}
+
+	pthread_mutex_unlock(&sc->vsc_mtx);
+}
+
+static uint64_t
+pci_viona_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+    int baridx, uint64_t offset, int size)
+{
+	struct pci_viona_softc *sc = pi->pi_arg;
+	void *ptr;
+	uint64_t value;
+	int err = 0;
+
+	if (baridx == pci_msix_table_bar(pi) ||
+	    baridx == pci_msix_pba_bar(pi)) {
+		return (pci_emul_msix_tread(pi, offset, size));
+	}
+
+	assert(baridx == 0);
+
+	if (offset + size > pci_viona_iosize(pi)) {
+		DPRINTF(("viona_read: 2big, offset %ld size %d\n",
+		    offset, size));
+		return (0);
+	}
+
+	pthread_mutex_lock(&sc->vsc_mtx);
+
+	offset = viona_adjust_offset(pi, offset);
+
+	switch (offset) {
+	case VTCFG_R_HOSTCAP:
+		assert(size == 4);
+		err = ioctl(sc->vsc_vnafd, VNA_IOC_GET_FEATURES, &value);
+		if (err != 0) {
+			WPRINTF(("ioctl get host features returned"
+			    " err = %d\n", errno));
+		}
+		value &= ~sc->vsc_feature_mask;
+		break;
+	case VTCFG_R_GUESTCAP:
+		assert(size == 4);
+		value = sc->vsc_features; /* XXX never read ? */
+		break;
+	case VTCFG_R_PFN:
+		assert(size == 4);
+		value = sc->vsc_pfn[sc->vsc_curq] >> VRING_PFN;
+		break;
+	case VTCFG_R_QNUM:
+		assert(size == 2);
+		value = pci_viona_qsize(sc, sc->vsc_curq);
+		break;
+	case VTCFG_R_QSEL:
+		assert(size == 2);
+		value = sc->vsc_curq;  /* XXX never read ? */
+		break;
+	case VTCFG_R_QNOTIFY:
+		assert(size == 2);
+		value = sc->vsc_curq;  /* XXX never read ? */
+		break;
+	case VTCFG_R_STATUS:
+		assert(size == 1);
+		value = sc->vsc_status;
+		break;
+	case VTCFG_R_ISR:
+		assert(size == 1);
+		value = sc->vsc_isr;
+		sc->vsc_isr = 0;	/* a read clears this flag */
+		break;
+	case VTCFG_R_CFGVEC:
+		assert(size == 2);
+		value = sc->vsc_msix_table_idx[VIONA_CTLQ];
+		break;
+	case VTCFG_R_QVEC:
+		assert(size == 2);
+		assert(sc->vsc_curq != VIONA_CTLQ);
+		value = sc->vsc_msix_table_idx[sc->vsc_curq];
+		break;
+	case VIONA_R_CFG0:
+	case VIONA_R_CFG1:
+	case VIONA_R_CFG2:
+	case VIONA_R_CFG3:
+	case VIONA_R_CFG4:
+	case VIONA_R_CFG5:
+		assert((size + offset) <= (VIONA_R_CFG5 + 1));
+		ptr = &sc->vsc_macaddr[offset - VIONA_R_CFG0];
+		if (size == 1) {
+			value = *(uint8_t *)ptr;
+		} else if (size == 2) {
+			value = *(uint16_t *)ptr;
+		} else {
+			value = *(uint32_t *)ptr;
+		}
+		break;
+	case VIONA_R_CFG6:
+		assert(size != 4);
+		value = 0x01;	/* XXX link always up */
+		break;
+	case VIONA_R_CFG7:
+		assert(size == 1);
+		value = 0;	/* XXX link status in LSB */
+		break;
+	default:
+		DPRINTF(("viona: unknown i/o read offset %ld\n\r", offset));
+		value = 0;
+		break;
+	}
+
+	pthread_mutex_unlock(&sc->vsc_mtx);
+
+	return (value);
+}
+
+struct pci_devemu pci_de_viona = {
+	.pe_emu =	"virtio-net-viona",
+	.pe_init =	pci_viona_init,
+	.pe_barwrite =	pci_viona_write,
+	.pe_barread =	pci_viona_read,
+	.pe_lintrupdate = pci_viona_lintrupdate
+};
+PCI_EMUL_SET(pci_de_viona);
diff --git a/usr/src/cmd/bhyve/pci_xhci.c b/usr/src/cmd/bhyve/pci_xhci.c
new file mode 100644
index 0000000000..1cb2246486
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_xhci.c
@@ -0,0 +1,2851 @@
+/*-
+ * Copyright (c) 2014 Leon Dang <ldang@nahannisys.com>
+ * Copyright 2018 Joyent, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+   XHCI options:
+    -s <n>,xhci,{devices}
+
+   devices:
+     tablet             USB tablet mouse
+ */
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/uio.h>
+#include <sys/types.h>
+#include <sys/queue.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+#include <pthread.h>
+#include <unistd.h>
+
+#include <dev/usb/usbdi.h>
+#include <dev/usb/usb.h>
+#include <dev/usb/usb_freebsd.h>
+#include <xhcireg.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "pci_xhci.h"
+#include "usb_emul.h"
+
+
+static int xhci_debug = 0;
+#define	DPRINTF(params) if (xhci_debug) printf params
+#define	WPRINTF(params) printf params
+
+
+#define	XHCI_NAME		"xhci"
+#define	XHCI_MAX_DEVS		8	/* 4 USB3 + 4 USB2 devs */
+
+#define	XHCI_MAX_SLOTS		64	/* min allowed by Windows drivers */
+
+/*
+ * XHCI data structures can be up to 64k, but limit paddr_guest2host mapping
+ * to 4k to avoid going over the guest physical memory barrier.
+ */
+#define	XHCI_PADDR_SZ		4096	/* paddr_guest2host max size */
+
+#define	XHCI_ERST_MAX		0	/* max 2^entries event ring seg tbl */
+
+#define	XHCI_CAPLEN		(4*8)	/* offset of op register space */
+#define	XHCI_HCCPRAMS2		0x1C	/* offset of HCCPARAMS2 register */
+#define	XHCI_PORTREGS_START	0x400
+#define	XHCI_DOORBELL_MAX	256
+
+#define	XHCI_STREAMS_MAX	1	/* 4-15 in XHCI spec */
+
+/* caplength and hci-version registers */
+#define	XHCI_SET_CAPLEN(x)		((x) & 0xFF)
+#define	XHCI_SET_HCIVERSION(x)		(((x) & 0xFFFF) << 16)
+#define	XHCI_GET_HCIVERSION(x)		(((x) >> 16) & 0xFFFF)
+
+/* hcsparams1 register */
+#define	XHCI_SET_HCSP1_MAXSLOTS(x)	((x) & 0xFF)
+#define	XHCI_SET_HCSP1_MAXINTR(x)	(((x) & 0x7FF) << 8)
+#define	XHCI_SET_HCSP1_MAXPORTS(x)	(((x) & 0xFF) << 24)
+
+/* hcsparams2 register */
+#define	XHCI_SET_HCSP2_IST(x)		((x) & 0x0F)
+#define	XHCI_SET_HCSP2_ERSTMAX(x)	(((x) & 0x0F) << 4)
+#define	XHCI_SET_HCSP2_MAXSCRATCH_HI(x)	(((x) & 0x1F) << 21)
+#define	XHCI_SET_HCSP2_MAXSCRATCH_LO(x)	(((x) & 0x1F) << 27)
+
+/* hcsparams3 register */
+#define	XHCI_SET_HCSP3_U1EXITLATENCY(x)	((x) & 0xFF)
+#define	XHCI_SET_HCSP3_U2EXITLATENCY(x)	(((x) & 0xFFFF) << 16)
+
+/* hccparams1 register */
+#define	XHCI_SET_HCCP1_AC64(x)		((x) & 0x01)
+#define	XHCI_SET_HCCP1_BNC(x)		(((x) & 0x01) << 1)
+#define	XHCI_SET_HCCP1_CSZ(x)		(((x) & 0x01) << 2)
+#define	XHCI_SET_HCCP1_PPC(x)		(((x) & 0x01) << 3)
+#define	XHCI_SET_HCCP1_PIND(x)		(((x) & 0x01) << 4)
+#define	XHCI_SET_HCCP1_LHRC(x)		(((x) & 0x01) << 5)
+#define	XHCI_SET_HCCP1_LTC(x)		(((x) & 0x01) << 6)
+#define	XHCI_SET_HCCP1_NSS(x)		(((x) & 0x01) << 7)
+#define	XHCI_SET_HCCP1_PAE(x)		(((x) & 0x01) << 8)
+#define	XHCI_SET_HCCP1_SPC(x)		(((x) & 0x01) << 9)
+#define	XHCI_SET_HCCP1_SEC(x)		(((x) & 0x01) << 10)
+#define	XHCI_SET_HCCP1_CFC(x)		(((x) & 0x01) << 11)
+#define	XHCI_SET_HCCP1_MAXPSA(x)	(((x) & 0x0F) << 12)
+#define	XHCI_SET_HCCP1_XECP(x)		(((x) & 0xFFFF) << 16)
+
+/* hccparams2 register */
+#define	XHCI_SET_HCCP2_U3C(x)		((x) & 0x01)
+#define	XHCI_SET_HCCP2_CMC(x)		(((x) & 0x01) << 1)
+#define	XHCI_SET_HCCP2_FSC(x)		(((x) & 0x01) << 2)
+#define	XHCI_SET_HCCP2_CTC(x)		(((x) & 0x01) << 3)
+#define	XHCI_SET_HCCP2_LEC(x)		(((x) & 0x01) << 4)
+#define	XHCI_SET_HCCP2_CIC(x)		(((x) & 0x01) << 5)
+
+/* other registers */
+#define	XHCI_SET_DOORBELL(x)		((x) & ~0x03)
+#define	XHCI_SET_RTSOFFSET(x)		((x) & ~0x0F)
+
+/* register masks */
+#define	XHCI_PS_PLS_MASK		(0xF << 5)	/* port link state */
+#define	XHCI_PS_SPEED_MASK		(0xF << 10)	/* port speed */
+#define	XHCI_PS_PIC_MASK		(0x3 << 14)	/* port indicator */
+
+/* port register set */
+#define	XHCI_PORTREGS_BASE		0x400		/* base offset */
+#define	XHCI_PORTREGS_PORT0		0x3F0
+#define	XHCI_PORTREGS_SETSZ		0x10		/* size of a set */
+
+#define	MASK_64_HI(x)			((x) & ~0xFFFFFFFFULL)
+#define	MASK_64_LO(x)			((x) & 0xFFFFFFFFULL)
+
+#define	FIELD_REPLACE(a,b,m,s)		(((a) & ~((m) << (s))) | \
+					(((b) & (m)) << (s)))
+#define	FIELD_COPY(a,b,m,s)		(((a) & ~((m) << (s))) | \
+					(((b) & ((m) << (s)))))
+
+struct pci_xhci_trb_ring {
+	uint64_t ringaddr;		/* current dequeue guest address */
+	uint32_t ccs;			/* consumer cycle state */
+};
+
+/* device endpoint transfer/stream rings */
+struct pci_xhci_dev_ep {
+	union {
+		struct xhci_trb		*_epu_tr;
+		struct xhci_stream_ctx	*_epu_sctx;
+	} _ep_trbsctx;
+#define	ep_tr		_ep_trbsctx._epu_tr
+#define	ep_sctx		_ep_trbsctx._epu_sctx
+
+	union {
+		struct pci_xhci_trb_ring _epu_trb;
+		struct pci_xhci_trb_ring *_epu_sctx_trbs;
+	} _ep_trb_rings;
+#define	ep_ringaddr	_ep_trb_rings._epu_trb.ringaddr
+#define	ep_ccs		_ep_trb_rings._epu_trb.ccs
+#define	ep_sctx_trbs	_ep_trb_rings._epu_sctx_trbs
+
+	struct usb_data_xfer *ep_xfer;	/* transfer chain */
+};
+
+/* device context base address array: maps slot->device context */
+struct xhci_dcbaa {
+	uint64_t dcba[USB_MAX_DEVICES+1]; /* xhci_dev_ctx ptrs */
+};
+
+/* port status registers */
+struct pci_xhci_portregs {
+	uint32_t	portsc;		/* port status and control */
+	uint32_t	portpmsc;	/* port pwr mgmt status & control */
+	uint32_t	portli;		/* port link info */
+	uint32_t	porthlpmc;	/* port hardware LPM control */
+} __packed;
+#define	XHCI_PS_SPEED_SET(x)	(((x) & 0xF) << 10)
+
+/* xHC operational registers */
+struct pci_xhci_opregs {
+	uint32_t	usbcmd;		/* usb command */
+	uint32_t	usbsts;		/* usb status */
+	uint32_t	pgsz;		/* page size */
+	uint32_t	dnctrl;		/* device notification control */
+	uint64_t	crcr;		/* command ring control */
+	uint64_t	dcbaap;		/* device ctx base addr array ptr */
+	uint32_t	config;		/* configure */
+
+	/* guest mapped addresses: */
+	struct xhci_trb	*cr_p;		/* crcr dequeue */
+	struct xhci_dcbaa *dcbaa_p;	/* dev ctx array ptr */
+};
+
+/* xHC runtime registers */
+struct pci_xhci_rtsregs {
+	uint32_t	mfindex;	/* microframe index */
+	struct {			/* interrupter register set */
+		uint32_t	iman;	/* interrupter management */
+		uint32_t	imod;	/* interrupter moderation */
+		uint32_t	erstsz;	/* event ring segment table size */
+		uint32_t	rsvd;
+		uint64_t	erstba;	/* event ring seg-tbl base addr */
+		uint64_t	erdp;	/* event ring dequeue ptr */
+	} intrreg __packed;
+
+	/* guest mapped addresses */
+	struct xhci_event_ring_seg *erstba_p;
+	struct xhci_trb *erst_p;	/* event ring segment tbl */
+	int		er_deq_seg;	/* event ring dequeue segment */
+	int		er_enq_idx;	/* event ring enqueue index - xHCI */
+	int		er_enq_seg;	/* event ring enqueue segment */
+	uint32_t	er_events_cnt;	/* number of events in ER */
+	uint32_t	event_pcs;	/* producer cycle state flag */
+};
+
+
+struct pci_xhci_softc;
+
+
+/*
+ * USB device emulation container.
+ * This is referenced from usb_hci->hci_sc; 1 pci_xhci_dev_emu for each
+ * emulated device instance.
+ */
+struct pci_xhci_dev_emu {
+	struct pci_xhci_softc	*xsc;
+
+	/* XHCI contexts */
+	struct xhci_dev_ctx	*dev_ctx;
+	struct pci_xhci_dev_ep	eps[XHCI_MAX_ENDPOINTS];
+	int			dev_slotstate;
+
+	struct usb_devemu	*dev_ue;	/* USB emulated dev */
+	void			*dev_sc;	/* device's softc */
+
+	struct usb_hci		hci;
+};
+
+struct pci_xhci_softc {
+	struct pci_devinst *xsc_pi;
+
+	pthread_mutex_t	mtx;
+
+	uint32_t	caplength;	/* caplen & hciversion */
+	uint32_t	hcsparams1;	/* structural parameters 1 */
+	uint32_t	hcsparams2;	/* structural parameters 2 */
+	uint32_t	hcsparams3;	/* structural parameters 3 */
+	uint32_t	hccparams1;	/* capability parameters 1 */
+	uint32_t	dboff;		/* doorbell offset */
+	uint32_t	rtsoff;		/* runtime register space offset */
+	uint32_t	hccparams2;	/* capability parameters 2 */
+
+	uint32_t	regsend;	/* end of configuration registers */
+
+	struct pci_xhci_opregs  opregs;
+	struct pci_xhci_rtsregs rtsregs;
+
+	struct pci_xhci_portregs *portregs;
+	struct pci_xhci_dev_emu  **devices; /* XHCI[port] = device */
+	struct pci_xhci_dev_emu  **slots;   /* slots assigned from 1 */
+	int		ndevices;
+
+	int		usb2_port_start;
+	int		usb3_port_start;
+};
+
+
+/* portregs and devices arrays are set up to start from idx=1 */
+#define	XHCI_PORTREG_PTR(x,n)	&(x)->portregs[(n)]
+#define	XHCI_DEVINST_PTR(x,n)	(x)->devices[(n)]
+#define	XHCI_SLOTDEV_PTR(x,n)	(x)->slots[(n)]
+
+#define	XHCI_HALTED(sc)		((sc)->opregs.usbsts & XHCI_STS_HCH)
+
+#define	XHCI_GADDR(sc,a)	paddr_guest2host((sc)->xsc_pi->pi_vmctx, \
+				    (a),                                 \
+				    XHCI_PADDR_SZ - ((a) & (XHCI_PADDR_SZ-1)))
+
+static int xhci_in_use;
+
+/* map USB errors to XHCI */
+static const int xhci_usb_errors[USB_ERR_MAX] = {
+	[USB_ERR_NORMAL_COMPLETION]	= XHCI_TRB_ERROR_SUCCESS,
+	[USB_ERR_PENDING_REQUESTS]	= XHCI_TRB_ERROR_RESOURCE,
+	[USB_ERR_NOT_STARTED]		= XHCI_TRB_ERROR_ENDP_NOT_ON,
+	[USB_ERR_INVAL]			= XHCI_TRB_ERROR_INVALID,
+	[USB_ERR_NOMEM]			= XHCI_TRB_ERROR_RESOURCE,
+	[USB_ERR_CANCELLED]		= XHCI_TRB_ERROR_STOPPED,
+	[USB_ERR_BAD_ADDRESS]		= XHCI_TRB_ERROR_PARAMETER,
+	[USB_ERR_BAD_BUFSIZE]		= XHCI_TRB_ERROR_PARAMETER,
+	[USB_ERR_BAD_FLAG]		= XHCI_TRB_ERROR_PARAMETER,
+	[USB_ERR_NO_CALLBACK]		= XHCI_TRB_ERROR_STALL,
+	[USB_ERR_IN_USE]		= XHCI_TRB_ERROR_RESOURCE,
+	[USB_ERR_NO_ADDR]		= XHCI_TRB_ERROR_RESOURCE,
+	[USB_ERR_NO_PIPE]               = XHCI_TRB_ERROR_RESOURCE,
+	[USB_ERR_ZERO_NFRAMES]          = XHCI_TRB_ERROR_UNDEFINED,
+	[USB_ERR_ZERO_MAXP]             = XHCI_TRB_ERROR_UNDEFINED,
+	[USB_ERR_SET_ADDR_FAILED]       = XHCI_TRB_ERROR_RESOURCE,
+	[USB_ERR_NO_POWER]              = XHCI_TRB_ERROR_ENDP_NOT_ON,
+	[USB_ERR_TOO_DEEP]              = XHCI_TRB_ERROR_RESOURCE,
+	[USB_ERR_IOERROR]               = XHCI_TRB_ERROR_TRB,
+	[USB_ERR_NOT_CONFIGURED]        = XHCI_TRB_ERROR_ENDP_NOT_ON,
+	[USB_ERR_TIMEOUT]               = XHCI_TRB_ERROR_CMD_ABORTED,
+	[USB_ERR_SHORT_XFER]            = XHCI_TRB_ERROR_SHORT_PKT,
+	[USB_ERR_STALLED]               = XHCI_TRB_ERROR_STALL,
+	[USB_ERR_INTERRUPTED]           = XHCI_TRB_ERROR_CMD_ABORTED,
+	[USB_ERR_DMA_LOAD_FAILED]       = XHCI_TRB_ERROR_DATA_BUF,
+	[USB_ERR_BAD_CONTEXT]           = XHCI_TRB_ERROR_TRB,
+	[USB_ERR_NO_ROOT_HUB]           = XHCI_TRB_ERROR_UNDEFINED,
+	[USB_ERR_NO_INTR_THREAD]        = XHCI_TRB_ERROR_UNDEFINED,
+	[USB_ERR_NOT_LOCKED]            = XHCI_TRB_ERROR_UNDEFINED,
+};
+#define	USB_TO_XHCI_ERR(e)	((e) < USB_ERR_MAX ? xhci_usb_errors[(e)] : \
+				XHCI_TRB_ERROR_INVALID)
+
+static int pci_xhci_insert_event(struct pci_xhci_softc *sc,
+    struct xhci_trb *evtrb, int do_intr);
+static void pci_xhci_dump_trb(struct xhci_trb *trb);
+static void pci_xhci_assert_interrupt(struct pci_xhci_softc *sc);
+static void pci_xhci_reset_slot(struct pci_xhci_softc *sc, int slot);
+static void pci_xhci_reset_port(struct pci_xhci_softc *sc, int portn, int warm);
+static void pci_xhci_update_ep_ring(struct pci_xhci_softc *sc,
+    struct pci_xhci_dev_emu *dev, struct pci_xhci_dev_ep *devep,
+    struct xhci_endp_ctx *ep_ctx, uint32_t streamid,
+    uint64_t ringaddr, int ccs);
+
+static void
+pci_xhci_set_evtrb(struct xhci_trb *evtrb, uint64_t port, uint32_t errcode,
+    uint32_t evtype)
+{
+	evtrb->qwTrb0 = port << 24;
+	evtrb->dwTrb2 = XHCI_TRB_2_ERROR_SET(errcode);
+	evtrb->dwTrb3 = XHCI_TRB_3_TYPE_SET(evtype);
+}
+
+
+/* controller reset */
+static void
+pci_xhci_reset(struct pci_xhci_softc *sc)
+{
+	int i;
+
+	sc->rtsregs.er_enq_idx = 0;
+	sc->rtsregs.er_events_cnt = 0;
+	sc->rtsregs.event_pcs = 1;
+
+	for (i = 1; i <= XHCI_MAX_SLOTS; i++) {
+		pci_xhci_reset_slot(sc, i);
+	}
+}
+
+static uint32_t
+pci_xhci_usbcmd_write(struct pci_xhci_softc *sc, uint32_t cmd)
+{
+	int do_intr = 0;
+	int i;
+
+	if (cmd & XHCI_CMD_RS) {
+		do_intr = (sc->opregs.usbcmd & XHCI_CMD_RS) == 0;
+
+		sc->opregs.usbcmd |= XHCI_CMD_RS;
+		sc->opregs.usbsts &= ~XHCI_STS_HCH;
+		sc->opregs.usbsts |= XHCI_STS_PCD;
+
+		/* Queue port change event on controller run from stop */
+		if (do_intr)
+			for (i = 1; i <= XHCI_MAX_DEVS; i++) {
+				struct pci_xhci_dev_emu *dev;
+				struct pci_xhci_portregs *port;
+				struct xhci_trb		evtrb;
+
+				if ((dev = XHCI_DEVINST_PTR(sc, i)) == NULL)
+					continue;
+
+				port = XHCI_PORTREG_PTR(sc, i);
+				port->portsc |= XHCI_PS_CSC | XHCI_PS_CCS;
+				port->portsc &= ~XHCI_PS_PLS_MASK;
+
+				/*
+				 * XHCI 4.19.3 USB2 RxDetect->Polling,
+				 *             USB3 Polling->U0
+				 */
+				if (dev->dev_ue->ue_usbver == 2)
+					port->portsc |=
+					    XHCI_PS_PLS_SET(UPS_PORT_LS_POLL);
+				else
+					port->portsc |=
+					    XHCI_PS_PLS_SET(UPS_PORT_LS_U0);
+
+				pci_xhci_set_evtrb(&evtrb, i,
+				    XHCI_TRB_ERROR_SUCCESS,
+				    XHCI_TRB_EVENT_PORT_STS_CHANGE);
+
+				if (pci_xhci_insert_event(sc, &evtrb, 0) !=
+				    XHCI_TRB_ERROR_SUCCESS)
+					break;
+			}
+	} else {
+		sc->opregs.usbcmd &= ~XHCI_CMD_RS;
+		sc->opregs.usbsts |= XHCI_STS_HCH;
+		sc->opregs.usbsts &= ~XHCI_STS_PCD;
+	}
+
+	/* start execution of schedule; stop when set to 0 */
+	cmd |= sc->opregs.usbcmd & XHCI_CMD_RS;
+
+	if (cmd & XHCI_CMD_HCRST) {
+		/* reset controller */
+		pci_xhci_reset(sc);
+		cmd &= ~XHCI_CMD_HCRST;
+	}
+
+	cmd &= ~(XHCI_CMD_CSS | XHCI_CMD_CRS);
+
+	if (do_intr)
+		pci_xhci_assert_interrupt(sc);
+
+	return (cmd);
+}
+
+static void
+pci_xhci_portregs_write(struct pci_xhci_softc *sc, uint64_t offset,
+    uint64_t value)
+{
+	struct xhci_trb		evtrb;
+	struct pci_xhci_portregs *p;
+	int port;
+	uint32_t oldpls, newpls;
+
+	if (sc->portregs == NULL)
+		return;
+
+	port = (offset - XHCI_PORTREGS_PORT0) / XHCI_PORTREGS_SETSZ;
+	offset = (offset - XHCI_PORTREGS_PORT0) % XHCI_PORTREGS_SETSZ;
+
+	DPRINTF(("pci_xhci: portregs wr offset 0x%lx, port %u: 0x%lx\r\n",
+	        offset, port, value));
+
+	assert(port >= 0);
+
+	if (port > XHCI_MAX_DEVS) {
+		DPRINTF(("pci_xhci: portregs_write port %d > ndevices\r\n",
+		    port));
+		return;
+	}
+
+	if (XHCI_DEVINST_PTR(sc, port) == NULL) {
+		DPRINTF(("pci_xhci: portregs_write to unattached port %d\r\n",
+		     port));
+	}
+
+	p = XHCI_PORTREG_PTR(sc, port);
+	switch (offset) {
+	case 0:
+		/* port reset or warm reset */
+		if (value & (XHCI_PS_PR | XHCI_PS_WPR)) {
+			pci_xhci_reset_port(sc, port, value & XHCI_PS_WPR);
+			break;
+		}
+
+		if ((p->portsc & XHCI_PS_PP) == 0) {
+			WPRINTF(("pci_xhci: portregs_write to unpowered "
+			         "port %d\r\n", port));
+			break;
+		}
+
+		/* Port status and control register  */
+		oldpls = XHCI_PS_PLS_GET(p->portsc);
+		newpls = XHCI_PS_PLS_GET(value);
+
+		p->portsc &= XHCI_PS_PED | XHCI_PS_PLS_MASK |
+		             XHCI_PS_SPEED_MASK | XHCI_PS_PIC_MASK;
+  
+		if (XHCI_DEVINST_PTR(sc, port))
+			p->portsc |= XHCI_PS_CCS;
+
+		p->portsc |= (value &
+		              ~(XHCI_PS_OCA |
+		                XHCI_PS_PR  |
+			        XHCI_PS_PED |
+			        XHCI_PS_PLS_MASK   |	/* link state */
+			        XHCI_PS_SPEED_MASK |
+			        XHCI_PS_PIC_MASK   |	/* port indicator */
+			        XHCI_PS_LWS | XHCI_PS_DR | XHCI_PS_WPR));
+
+		/* clear control bits */
+		p->portsc &= ~(value &
+		               (XHCI_PS_CSC |
+		                XHCI_PS_PEC |
+		                XHCI_PS_WRC |
+		                XHCI_PS_OCC |
+		                XHCI_PS_PRC |
+		                XHCI_PS_PLC |
+		                XHCI_PS_CEC |
+		                XHCI_PS_CAS));
+
+		/* port disable request; for USB3, don't care */
+		if (value & XHCI_PS_PED)
+			DPRINTF(("Disable port %d request\r\n", port));
+
+		if (!(value & XHCI_PS_LWS))
+			break;
+
+		DPRINTF(("Port new PLS: %d\r\n", newpls));
+		switch (newpls) {
+		case 0: /* U0 */
+		case 3: /* U3 */
+			if (oldpls != newpls) {
+				p->portsc &= ~XHCI_PS_PLS_MASK;
+				p->portsc |= XHCI_PS_PLS_SET(newpls) |
+				             XHCI_PS_PLC;
+
+				if (oldpls != 0 && newpls == 0) {
+					pci_xhci_set_evtrb(&evtrb, port,
+					    XHCI_TRB_ERROR_SUCCESS,
+					    XHCI_TRB_EVENT_PORT_STS_CHANGE);
+
+					pci_xhci_insert_event(sc, &evtrb, 1);
+				}
+			}
+			break;
+
+		default:
+			DPRINTF(("Unhandled change port %d PLS %u\r\n",
+			         port, newpls));
+			break;
+		}
+		break;
+	case 4: 
+		/* Port power management status and control register  */
+		p->portpmsc = value;
+		break;
+	case 8:
+		/* Port link information register */
+		DPRINTF(("pci_xhci attempted write to PORTLI, port %d\r\n",
+		        port));
+		break;
+	case 12:
+		/*
+		 * Port hardware LPM control register.
+		 * For USB3, this register is reserved.
+		 */
+		p->porthlpmc = value;
+		break;
+	}
+}
+
+struct xhci_dev_ctx *
+pci_xhci_get_dev_ctx(struct pci_xhci_softc *sc, uint32_t slot)
+{
+	uint64_t devctx_addr;
+	struct xhci_dev_ctx *devctx;
+
+	assert(slot > 0 && slot <= sc->ndevices);
+	assert(sc->opregs.dcbaa_p != NULL);
+
+	devctx_addr = sc->opregs.dcbaa_p->dcba[slot];
+
+	if (devctx_addr == 0) {
+		DPRINTF(("get_dev_ctx devctx_addr == 0\r\n"));
+		return (NULL);
+	}
+
+	DPRINTF(("pci_xhci: get dev ctx, slot %u devctx addr %016lx\r\n",
+	        slot, devctx_addr));
+	devctx = XHCI_GADDR(sc, devctx_addr & ~0x3FUL);
+
+	return (devctx);
+}
+
+struct xhci_trb *
+pci_xhci_trb_next(struct pci_xhci_softc *sc, struct xhci_trb *curtrb,
+    uint64_t *guestaddr)
+{
+	struct xhci_trb *next;
+
+	assert(curtrb != NULL);
+
+	if (XHCI_TRB_3_TYPE_GET(curtrb->dwTrb3) == XHCI_TRB_TYPE_LINK) {
+		if (guestaddr)
+			*guestaddr = curtrb->qwTrb0 & ~0xFUL;
+		
+		next = XHCI_GADDR(sc, curtrb->qwTrb0 & ~0xFUL);
+	} else {
+		if (guestaddr)
+			*guestaddr += sizeof(struct xhci_trb) & ~0xFUL;
+
+		next = curtrb + 1;
+	}
+
+	return (next);
+}
+
+static void
+pci_xhci_assert_interrupt(struct pci_xhci_softc *sc)
+{
+
+	sc->rtsregs.intrreg.erdp |= XHCI_ERDP_LO_BUSY;
+	sc->rtsregs.intrreg.iman |= XHCI_IMAN_INTR_PEND;
+	sc->opregs.usbsts |= XHCI_STS_EINT;
+
+	/* only trigger interrupt if permitted */
+	if ((sc->opregs.usbcmd & XHCI_CMD_INTE) &&
+	    (sc->rtsregs.intrreg.iman & XHCI_IMAN_INTR_ENA)) {
+		if (pci_msi_enabled(sc->xsc_pi))
+			pci_generate_msi(sc->xsc_pi, 0);
+		else
+			pci_lintr_assert(sc->xsc_pi);
+	}
+}
+
+static void
+pci_xhci_deassert_interrupt(struct pci_xhci_softc *sc)
+{
+
+	if (!pci_msi_enabled(sc->xsc_pi))
+		pci_lintr_assert(sc->xsc_pi);
+}
+
+static void
+pci_xhci_init_ep(struct pci_xhci_dev_emu *dev, int epid)
+{
+	struct xhci_dev_ctx    *dev_ctx;
+	struct pci_xhci_dev_ep *devep;
+	struct xhci_endp_ctx   *ep_ctx;
+	uint32_t	pstreams;
+	int		i;
+
+	dev_ctx = dev->dev_ctx;
+	ep_ctx = &dev_ctx->ctx_ep[epid];
+	devep = &dev->eps[epid];
+	pstreams = XHCI_EPCTX_0_MAXP_STREAMS_GET(ep_ctx->dwEpCtx0);
+	if (pstreams > 0) {
+		DPRINTF(("init_ep %d with pstreams %d\r\n", epid, pstreams));
+		assert(devep->ep_sctx_trbs == NULL);
+
+		devep->ep_sctx = XHCI_GADDR(dev->xsc, ep_ctx->qwEpCtx2 &
+		                            XHCI_EPCTX_2_TR_DQ_PTR_MASK);
+		devep->ep_sctx_trbs = calloc(pstreams,
+		                      sizeof(struct pci_xhci_trb_ring));
+		for (i = 0; i < pstreams; i++) {
+			devep->ep_sctx_trbs[i].ringaddr =
+			                         devep->ep_sctx[i].qwSctx0 &
+			                         XHCI_SCTX_0_TR_DQ_PTR_MASK;
+			devep->ep_sctx_trbs[i].ccs =
+			     XHCI_SCTX_0_DCS_GET(devep->ep_sctx[i].qwSctx0);
+		}
+	} else {
+		DPRINTF(("init_ep %d with no pstreams\r\n", epid));
+		devep->ep_ringaddr = ep_ctx->qwEpCtx2 &
+		                     XHCI_EPCTX_2_TR_DQ_PTR_MASK;
+		devep->ep_ccs = XHCI_EPCTX_2_DCS_GET(ep_ctx->qwEpCtx2);
+		devep->ep_tr = XHCI_GADDR(dev->xsc, devep->ep_ringaddr);
+		DPRINTF(("init_ep tr DCS %x\r\n", devep->ep_ccs));
+	}
+
+	if (devep->ep_xfer == NULL) {
+		devep->ep_xfer = malloc(sizeof(struct usb_data_xfer));
+		USB_DATA_XFER_INIT(devep->ep_xfer);
+	}
+}
+
+static void
+pci_xhci_disable_ep(struct pci_xhci_dev_emu *dev, int epid)
+{
+	struct xhci_dev_ctx    *dev_ctx;
+	struct pci_xhci_dev_ep *devep;
+	struct xhci_endp_ctx   *ep_ctx;
+
+	DPRINTF(("pci_xhci disable_ep %d\r\n", epid));
+
+	dev_ctx = dev->dev_ctx;
+	ep_ctx = &dev_ctx->ctx_ep[epid];
+	ep_ctx->dwEpCtx0 = (ep_ctx->dwEpCtx0 & ~0x7) | XHCI_ST_EPCTX_DISABLED;
+
+	devep = &dev->eps[epid];
+	if (XHCI_EPCTX_0_MAXP_STREAMS_GET(ep_ctx->dwEpCtx0) > 0 &&
+	    devep->ep_sctx_trbs != NULL)
+			free(devep->ep_sctx_trbs);
+
+	if (devep->ep_xfer != NULL) {
+		free(devep->ep_xfer);
+		devep->ep_xfer = NULL;
+	}
+
+	memset(devep, 0, sizeof(struct pci_xhci_dev_ep));
+}
+
+
+/* reset device at slot and data structures related to it */
+static void
+pci_xhci_reset_slot(struct pci_xhci_softc *sc, int slot)
+{
+	struct pci_xhci_dev_emu *dev;
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+
+	if (!dev) {
+		DPRINTF(("xhci reset unassigned slot (%d)?\r\n", slot));
+	} else {
+		dev->dev_slotstate = XHCI_ST_DISABLED;
+	}
+
+	/* TODO: reset ring buffer pointers */
+}
+
+static int
+pci_xhci_insert_event(struct pci_xhci_softc *sc, struct xhci_trb *evtrb,
+    int do_intr)
+{
+	struct pci_xhci_rtsregs *rts;
+	uint64_t	erdp;
+	int		erdp_idx;
+	int		err;
+	struct xhci_trb *evtrbptr;
+
+	err = XHCI_TRB_ERROR_SUCCESS;
+
+	rts = &sc->rtsregs;
+
+	erdp = rts->intrreg.erdp & ~0xF;
+	erdp_idx = (erdp - rts->erstba_p[rts->er_deq_seg].qwEvrsTablePtr) /
+	           sizeof(struct xhci_trb);
+
+	DPRINTF(("pci_xhci: insert event 0[%lx] 2[%x] 3[%x]\r\n"
+	         "\terdp idx %d/seg %d, enq idx %d/seg %d, pcs %u\r\n"
+	         "\t(erdp=0x%lx, erst=0x%lx, tblsz=%u, do_intr %d)\r\n",
+	         evtrb->qwTrb0, evtrb->dwTrb2, evtrb->dwTrb3,
+	         erdp_idx, rts->er_deq_seg, rts->er_enq_idx,
+	         rts->er_enq_seg,
+	         rts->event_pcs, erdp, rts->erstba_p->qwEvrsTablePtr,
+	         rts->erstba_p->dwEvrsTableSize, do_intr));
+
+	evtrbptr = &rts->erst_p[rts->er_enq_idx];
+
+	/* TODO: multi-segment table */
+	if (rts->er_events_cnt >= rts->erstba_p->dwEvrsTableSize) {
+		DPRINTF(("pci_xhci[%d] cannot insert event; ring full\r\n",
+		         __LINE__));
+		err = XHCI_TRB_ERROR_EV_RING_FULL;
+		goto done;
+	}
+
+	if (rts->er_events_cnt == rts->erstba_p->dwEvrsTableSize - 1) {
+		struct xhci_trb	errev;
+
+		if ((evtrbptr->dwTrb3 & 0x1) == (rts->event_pcs & 0x1)) {
+
+			DPRINTF(("pci_xhci[%d] insert evt err: ring full\r\n",
+			         __LINE__));
+
+			errev.qwTrb0 = 0;
+			errev.dwTrb2 = XHCI_TRB_2_ERROR_SET(
+			                    XHCI_TRB_ERROR_EV_RING_FULL);
+			errev.dwTrb3 = XHCI_TRB_3_TYPE_SET(
+			                    XHCI_TRB_EVENT_HOST_CTRL) |
+			               rts->event_pcs;
+			rts->er_events_cnt++;
+			memcpy(&rts->erst_p[rts->er_enq_idx], &errev,
+			       sizeof(struct xhci_trb));
+			rts->er_enq_idx = (rts->er_enq_idx + 1) %
+			                  rts->erstba_p->dwEvrsTableSize;
+			err = XHCI_TRB_ERROR_EV_RING_FULL;
+			do_intr = 1;
+
+			goto done;
+		}
+	} else {
+		rts->er_events_cnt++;
+	}
+
+	evtrb->dwTrb3 &= ~XHCI_TRB_3_CYCLE_BIT;
+	evtrb->dwTrb3 |= rts->event_pcs;
+
+	memcpy(&rts->erst_p[rts->er_enq_idx], evtrb, sizeof(struct xhci_trb));
+	rts->er_enq_idx = (rts->er_enq_idx + 1) %
+	                  rts->erstba_p->dwEvrsTableSize;
+
+	if (rts->er_enq_idx == 0)
+		rts->event_pcs ^= 1;
+
+done:
+	if (do_intr)
+		pci_xhci_assert_interrupt(sc);
+
+	return (err);
+}
+
+static uint32_t
+pci_xhci_cmd_enable_slot(struct pci_xhci_softc *sc, uint32_t *slot)
+{
+	struct pci_xhci_dev_emu *dev;
+	uint32_t	cmderr;
+	int		i;
+
+	cmderr = XHCI_TRB_ERROR_NO_SLOTS;
+	if (sc->portregs != NULL)
+		for (i = 1; i <= XHCI_MAX_SLOTS; i++) {
+			dev = XHCI_SLOTDEV_PTR(sc, i);
+			if (dev && dev->dev_slotstate == XHCI_ST_DISABLED) {
+				*slot = i;
+				dev->dev_slotstate = XHCI_ST_ENABLED;
+				cmderr = XHCI_TRB_ERROR_SUCCESS;
+				dev->hci.hci_address = i;
+				break;
+			}
+		}
+
+	DPRINTF(("pci_xhci enable slot (error=%d) slot %u\r\n",
+		cmderr != XHCI_TRB_ERROR_SUCCESS, *slot));
+
+	return (cmderr);
+}
+
+static uint32_t
+pci_xhci_cmd_disable_slot(struct pci_xhci_softc *sc, uint32_t slot)
+{
+	struct pci_xhci_dev_emu *dev;
+	uint32_t cmderr;
+
+	DPRINTF(("pci_xhci disable slot %u\r\n", slot));
+
+	cmderr = XHCI_TRB_ERROR_NO_SLOTS;
+	if (sc->portregs == NULL)
+		goto done;
+
+	if (slot > sc->ndevices) {
+		cmderr = XHCI_TRB_ERROR_SLOT_NOT_ON;
+		goto done;
+	}
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	if (dev) {
+		if (dev->dev_slotstate == XHCI_ST_DISABLED) {
+			cmderr = XHCI_TRB_ERROR_SLOT_NOT_ON;
+		} else {
+			dev->dev_slotstate = XHCI_ST_DISABLED;
+			cmderr = XHCI_TRB_ERROR_SUCCESS;
+			/* TODO: reset events and endpoints */
+		}
+	}
+
+done:
+	return (cmderr);
+}
+
+static uint32_t
+pci_xhci_cmd_reset_device(struct pci_xhci_softc *sc, uint32_t slot)
+{
+	struct pci_xhci_dev_emu *dev;
+	struct xhci_dev_ctx     *dev_ctx;
+	struct xhci_endp_ctx    *ep_ctx;
+	uint32_t	cmderr;
+	int		i;
+
+	cmderr = XHCI_TRB_ERROR_NO_SLOTS;
+	if (sc->portregs == NULL)
+		goto done;
+
+	DPRINTF(("pci_xhci reset device slot %u\r\n", slot));
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	if (!dev || dev->dev_slotstate == XHCI_ST_DISABLED)
+		cmderr = XHCI_TRB_ERROR_SLOT_NOT_ON;
+	else {
+		dev->dev_slotstate = XHCI_ST_DEFAULT;
+
+		dev->hci.hci_address = 0;
+		dev_ctx = pci_xhci_get_dev_ctx(sc, slot);
+
+		/* slot state */
+		dev_ctx->ctx_slot.dwSctx3 = FIELD_REPLACE(
+		    dev_ctx->ctx_slot.dwSctx3, XHCI_ST_SLCTX_DEFAULT,
+		    0x1F, 27);
+
+		/* number of contexts */
+		dev_ctx->ctx_slot.dwSctx0 = FIELD_REPLACE(
+		    dev_ctx->ctx_slot.dwSctx0, 1, 0x1F, 27);
+
+		/* reset all eps other than ep-0 */
+		for (i = 2; i <= 31; i++) {
+			ep_ctx = &dev_ctx->ctx_ep[i];
+			ep_ctx->dwEpCtx0 = FIELD_REPLACE( ep_ctx->dwEpCtx0,
+			    XHCI_ST_EPCTX_DISABLED, 0x7, 0);
+		}
+
+		cmderr = XHCI_TRB_ERROR_SUCCESS;
+	}
+
+	pci_xhci_reset_slot(sc, slot);
+
+done:
+	return (cmderr);
+}
+
+static uint32_t
+pci_xhci_cmd_address_device(struct pci_xhci_softc *sc, uint32_t slot,
+    struct xhci_trb *trb)
+{
+	struct pci_xhci_dev_emu	*dev;
+	struct xhci_input_dev_ctx *input_ctx;
+	struct xhci_slot_ctx	*islot_ctx;
+	struct xhci_dev_ctx	*dev_ctx;
+	struct xhci_endp_ctx	*ep0_ctx;
+	uint32_t		cmderr;
+
+	input_ctx = XHCI_GADDR(sc, trb->qwTrb0 & ~0xFUL);
+	islot_ctx = &input_ctx->ctx_slot;
+	ep0_ctx = &input_ctx->ctx_ep[1];
+
+	cmderr = XHCI_TRB_ERROR_SUCCESS;
+
+	DPRINTF(("pci_xhci: address device, input ctl: D 0x%08x A 0x%08x,\r\n"
+	         "          slot %08x %08x %08x %08x\r\n"
+	         "          ep0  %08x %08x %016lx %08x\r\n",
+	        input_ctx->ctx_input.dwInCtx0, input_ctx->ctx_input.dwInCtx1,
+	        islot_ctx->dwSctx0, islot_ctx->dwSctx1,
+	        islot_ctx->dwSctx2, islot_ctx->dwSctx3,
+	        ep0_ctx->dwEpCtx0, ep0_ctx->dwEpCtx1, ep0_ctx->qwEpCtx2,
+	        ep0_ctx->dwEpCtx4));
+
+	/* when setting address: drop-ctx=0, add-ctx=slot+ep0 */
+	if ((input_ctx->ctx_input.dwInCtx0 != 0) ||
+	    (input_ctx->ctx_input.dwInCtx1 & 0x03) != 0x03) {
+		DPRINTF(("pci_xhci: address device, input ctl invalid\r\n"));
+		cmderr = XHCI_TRB_ERROR_TRB;
+		goto done;
+	}
+
+	/* assign address to slot */
+	dev_ctx = pci_xhci_get_dev_ctx(sc, slot);
+
+	DPRINTF(("pci_xhci: address device, dev ctx\r\n"
+	         "          slot %08x %08x %08x %08x\r\n",
+	        dev_ctx->ctx_slot.dwSctx0, dev_ctx->ctx_slot.dwSctx1,
+	        dev_ctx->ctx_slot.dwSctx2, dev_ctx->ctx_slot.dwSctx3));
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	assert(dev != NULL);
+
+	dev->hci.hci_address = slot;
+	dev->dev_ctx = dev_ctx;
+
+	if (dev->dev_ue->ue_reset == NULL ||
+	    dev->dev_ue->ue_reset(dev->dev_sc) < 0) {
+		cmderr = XHCI_TRB_ERROR_ENDP_NOT_ON;
+		goto done;
+	}
+
+	memcpy(&dev_ctx->ctx_slot, islot_ctx, sizeof(struct xhci_slot_ctx));
+
+	dev_ctx->ctx_slot.dwSctx3 =
+	    XHCI_SCTX_3_SLOT_STATE_SET(XHCI_ST_SLCTX_ADDRESSED) |
+	    XHCI_SCTX_3_DEV_ADDR_SET(slot);
+
+	memcpy(&dev_ctx->ctx_ep[1], ep0_ctx, sizeof(struct xhci_endp_ctx));
+	ep0_ctx = &dev_ctx->ctx_ep[1];
+	ep0_ctx->dwEpCtx0 = (ep0_ctx->dwEpCtx0 & ~0x7) |
+	    XHCI_EPCTX_0_EPSTATE_SET(XHCI_ST_EPCTX_RUNNING);
+
+	pci_xhci_init_ep(dev, 1);
+
+	dev->dev_slotstate = XHCI_ST_ADDRESSED;
+
+	DPRINTF(("pci_xhci: address device, output ctx\r\n"
+	         "          slot %08x %08x %08x %08x\r\n"
+	         "          ep0  %08x %08x %016lx %08x\r\n",
+	        dev_ctx->ctx_slot.dwSctx0, dev_ctx->ctx_slot.dwSctx1,
+	        dev_ctx->ctx_slot.dwSctx2, dev_ctx->ctx_slot.dwSctx3,
+	        ep0_ctx->dwEpCtx0, ep0_ctx->dwEpCtx1, ep0_ctx->qwEpCtx2,
+	        ep0_ctx->dwEpCtx4));
+
+done:
+	return (cmderr);
+}
+
+static uint32_t
+pci_xhci_cmd_config_ep(struct pci_xhci_softc *sc, uint32_t slot,
+    struct xhci_trb *trb)
+{
+	struct xhci_input_dev_ctx *input_ctx;
+	struct pci_xhci_dev_emu	*dev;
+	struct xhci_dev_ctx	*dev_ctx;
+	struct xhci_endp_ctx	*ep_ctx, *iep_ctx;
+	uint32_t	cmderr;
+	int		i;
+
+	cmderr = XHCI_TRB_ERROR_SUCCESS;
+
+	DPRINTF(("pci_xhci config_ep slot %u\r\n", slot));
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	assert(dev != NULL);
+
+	if ((trb->dwTrb3 & XHCI_TRB_3_DCEP_BIT) != 0) {
+		DPRINTF(("pci_xhci config_ep - deconfigure ep slot %u\r\n",
+		        slot));
+		if (dev->dev_ue->ue_stop != NULL)
+			dev->dev_ue->ue_stop(dev->dev_sc);
+
+		dev->dev_slotstate = XHCI_ST_ADDRESSED;
+
+		dev->hci.hci_address = 0;
+		dev_ctx = pci_xhci_get_dev_ctx(sc, slot);
+
+		/* number of contexts */
+		dev_ctx->ctx_slot.dwSctx0 = FIELD_REPLACE(
+		    dev_ctx->ctx_slot.dwSctx0, 1, 0x1F, 27);
+
+		/* slot state */
+		dev_ctx->ctx_slot.dwSctx3 = FIELD_REPLACE(
+		    dev_ctx->ctx_slot.dwSctx3, XHCI_ST_SLCTX_ADDRESSED,
+		    0x1F, 27);
+
+		/* disable endpoints */
+		for (i = 2; i < 32; i++)
+			pci_xhci_disable_ep(dev, i);
+
+		cmderr = XHCI_TRB_ERROR_SUCCESS;
+
+		goto done;
+	}
+
+	if (dev->dev_slotstate < XHCI_ST_ADDRESSED) {
+		DPRINTF(("pci_xhci: config_ep slotstate x%x != addressed\r\n",
+		        dev->dev_slotstate));
+		cmderr = XHCI_TRB_ERROR_SLOT_NOT_ON;
+		goto done;
+	}
+
+	/* In addressed/configured state;
+	 * for each drop endpoint ctx flag:
+	 *   ep->state = DISABLED
+	 * for each add endpoint ctx flag:
+	 *   cp(ep-in, ep-out)
+	 *   ep->state = RUNNING
+	 * for each drop+add endpoint flag:
+	 *   reset ep resources
+	 *   cp(ep-in, ep-out)
+	 *   ep->state = RUNNING
+	 * if input->DisabledCtx[2-31] < 30: (at least 1 ep not disabled)
+	 *   slot->state = configured
+	 */
+
+	input_ctx = XHCI_GADDR(sc, trb->qwTrb0 & ~0xFUL);
+	dev_ctx = dev->dev_ctx;
+	DPRINTF(("pci_xhci: config_ep inputctx: D:x%08x A:x%08x 7:x%08x\r\n",
+		input_ctx->ctx_input.dwInCtx0, input_ctx->ctx_input.dwInCtx1,
+	        input_ctx->ctx_input.dwInCtx7));
+
+	for (i = 2; i <= 31; i++) {
+		ep_ctx = &dev_ctx->ctx_ep[i];
+
+		if (input_ctx->ctx_input.dwInCtx0 &
+		    XHCI_INCTX_0_DROP_MASK(i)) {
+			DPRINTF((" config ep - dropping ep %d\r\n", i));
+			pci_xhci_disable_ep(dev, i);
+		}
+
+		if (input_ctx->ctx_input.dwInCtx1 &
+		    XHCI_INCTX_1_ADD_MASK(i)) {
+			iep_ctx = &input_ctx->ctx_ep[i];
+
+			DPRINTF((" enable ep[%d]  %08x %08x %016lx %08x\r\n",
+			   i, iep_ctx->dwEpCtx0, iep_ctx->dwEpCtx1,
+			   iep_ctx->qwEpCtx2, iep_ctx->dwEpCtx4));
+
+			memcpy(ep_ctx, iep_ctx, sizeof(struct xhci_endp_ctx));
+
+			pci_xhci_init_ep(dev, i);
+
+			/* ep state */
+			ep_ctx->dwEpCtx0 = FIELD_REPLACE(
+			    ep_ctx->dwEpCtx0, XHCI_ST_EPCTX_RUNNING, 0x7, 0);
+		}
+	}
+
+	/* slot state to configured */
+	dev_ctx->ctx_slot.dwSctx3 = FIELD_REPLACE(
+	    dev_ctx->ctx_slot.dwSctx3, XHCI_ST_SLCTX_CONFIGURED, 0x1F, 27);
+	dev_ctx->ctx_slot.dwSctx0 = FIELD_COPY(
+	    dev_ctx->ctx_slot.dwSctx0, input_ctx->ctx_slot.dwSctx0, 0x1F, 27);
+	dev->dev_slotstate = XHCI_ST_CONFIGURED;
+
+	DPRINTF(("EP configured; slot %u [0]=0x%08x [1]=0x%08x [2]=0x%08x "
+	         "[3]=0x%08x\r\n",
+	    slot, dev_ctx->ctx_slot.dwSctx0, dev_ctx->ctx_slot.dwSctx1,
+	    dev_ctx->ctx_slot.dwSctx2, dev_ctx->ctx_slot.dwSctx3));
+
+done:
+	return (cmderr);
+}
+
+static uint32_t
+pci_xhci_cmd_reset_ep(struct pci_xhci_softc *sc, uint32_t slot,
+    struct xhci_trb *trb)
+{
+	struct pci_xhci_dev_emu	*dev;
+	struct pci_xhci_dev_ep *devep;
+	struct xhci_dev_ctx	*dev_ctx;
+	struct xhci_endp_ctx	*ep_ctx;
+	uint32_t	cmderr, epid;
+	uint32_t	type;
+
+	epid = XHCI_TRB_3_EP_GET(trb->dwTrb3);
+
+	DPRINTF(("pci_xhci: reset ep %u: slot %u\r\n", epid, slot));
+
+	cmderr = XHCI_TRB_ERROR_SUCCESS;
+
+	type = XHCI_TRB_3_TYPE_GET(trb->dwTrb3);
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	assert(dev != NULL);
+
+	if (type == XHCI_TRB_TYPE_STOP_EP &&
+	    (trb->dwTrb3 & XHCI_TRB_3_SUSP_EP_BIT) != 0) {
+		/* XXX suspend endpoint for 10ms */
+	}
+
+	if (epid < 1 || epid > 31) {
+		DPRINTF(("pci_xhci: reset ep: invalid epid %u\r\n", epid));
+		cmderr = XHCI_TRB_ERROR_TRB;
+		goto done;
+	}
+
+	devep = &dev->eps[epid];
+	if (devep->ep_xfer != NULL)
+		USB_DATA_XFER_RESET(devep->ep_xfer);
+
+	dev_ctx = dev->dev_ctx;
+	assert(dev_ctx != NULL);
+
+	ep_ctx = &dev_ctx->ctx_ep[epid];
+
+	ep_ctx->dwEpCtx0 = (ep_ctx->dwEpCtx0 & ~0x7) | XHCI_ST_EPCTX_STOPPED;
+
+	if (XHCI_EPCTX_0_MAXP_STREAMS_GET(ep_ctx->dwEpCtx0) == 0)
+		ep_ctx->qwEpCtx2 = devep->ep_ringaddr | devep->ep_ccs;
+
+	DPRINTF(("pci_xhci: reset ep[%u] %08x %08x %016lx %08x\r\n",
+	        epid, ep_ctx->dwEpCtx0, ep_ctx->dwEpCtx1, ep_ctx->qwEpCtx2,
+	        ep_ctx->dwEpCtx4));
+
+	if (type == XHCI_TRB_TYPE_RESET_EP &&
+	    (dev->dev_ue->ue_reset == NULL ||
+	    dev->dev_ue->ue_reset(dev->dev_sc) < 0)) {
+		cmderr = XHCI_TRB_ERROR_ENDP_NOT_ON;
+		goto done;
+	}
+
+done:
+	return (cmderr);
+}
+
+
+static uint32_t
+pci_xhci_find_stream(struct pci_xhci_softc *sc, struct xhci_endp_ctx *ep,
+    uint32_t streamid, struct xhci_stream_ctx **osctx)
+{
+	struct xhci_stream_ctx *sctx;
+	uint32_t	maxpstreams;
+
+	maxpstreams = XHCI_EPCTX_0_MAXP_STREAMS_GET(ep->dwEpCtx0);
+	if (maxpstreams == 0)
+		return (XHCI_TRB_ERROR_TRB);
+
+	if (maxpstreams > XHCI_STREAMS_MAX)
+		return (XHCI_TRB_ERROR_INVALID_SID);
+
+	if (XHCI_EPCTX_0_LSA_GET(ep->dwEpCtx0) == 0) {
+		DPRINTF(("pci_xhci: find_stream; LSA bit not set\r\n"));
+		return (XHCI_TRB_ERROR_INVALID_SID);
+	}
+
+	/* only support primary stream */
+	if (streamid > maxpstreams)
+		return (XHCI_TRB_ERROR_STREAM_TYPE);
+
+	sctx = XHCI_GADDR(sc, ep->qwEpCtx2 & ~0xFUL) + streamid;
+	if (!XHCI_SCTX_0_SCT_GET(sctx->qwSctx0))
+		return (XHCI_TRB_ERROR_STREAM_TYPE);
+
+	*osctx = sctx;
+
+	return (XHCI_TRB_ERROR_SUCCESS);
+}
+
+
+static uint32_t
+pci_xhci_cmd_set_tr(struct pci_xhci_softc *sc, uint32_t slot,
+    struct xhci_trb *trb)
+{
+	struct pci_xhci_dev_emu	*dev;
+	struct pci_xhci_dev_ep	*devep;
+	struct xhci_dev_ctx	*dev_ctx;
+	struct xhci_endp_ctx	*ep_ctx;
+	uint32_t	cmderr, epid;
+	uint32_t	streamid;
+
+	cmderr = XHCI_TRB_ERROR_SUCCESS;
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	assert(dev != NULL);
+
+	DPRINTF(("pci_xhci set_tr: new-tr x%016lx, SCT %u DCS %u\r\n"
+	         "                 stream-id %u, slot %u, epid %u, C %u\r\n",
+	         (trb->qwTrb0 & ~0xF),  (uint32_t)((trb->qwTrb0 >> 1) & 0x7),
+	         (uint32_t)(trb->qwTrb0 & 0x1), (trb->dwTrb2 >> 16) & 0xFFFF,
+	         XHCI_TRB_3_SLOT_GET(trb->dwTrb3),
+	         XHCI_TRB_3_EP_GET(trb->dwTrb3), trb->dwTrb3 & 0x1));
+
+	epid = XHCI_TRB_3_EP_GET(trb->dwTrb3);
+	if (epid < 1 || epid > 31) {
+		DPRINTF(("pci_xhci: set_tr_deq: invalid epid %u\r\n", epid));
+		cmderr = XHCI_TRB_ERROR_TRB;
+		goto done;
+	}
+
+	dev_ctx = dev->dev_ctx;
+	assert(dev_ctx != NULL);
+
+	ep_ctx = &dev_ctx->ctx_ep[epid];
+	devep = &dev->eps[epid];
+
+	switch (XHCI_EPCTX_0_EPSTATE_GET(ep_ctx->dwEpCtx0)) {
+	case XHCI_ST_EPCTX_STOPPED:
+	case XHCI_ST_EPCTX_ERROR:
+		break;
+	default:
+		DPRINTF(("pci_xhci cmd set_tr invalid state %x\r\n",
+		        XHCI_EPCTX_0_EPSTATE_GET(ep_ctx->dwEpCtx0)));
+		cmderr = XHCI_TRB_ERROR_CONTEXT_STATE;
+		goto done;
+	}
+
+	streamid = XHCI_TRB_2_STREAM_GET(trb->dwTrb2);
+	if (XHCI_EPCTX_0_MAXP_STREAMS_GET(ep_ctx->dwEpCtx0) > 0) {
+		struct xhci_stream_ctx *sctx;
+
+		sctx = NULL;
+		cmderr = pci_xhci_find_stream(sc, ep_ctx, streamid, &sctx);
+		if (sctx != NULL) {
+			assert(devep->ep_sctx != NULL);
+			
+			devep->ep_sctx[streamid].qwSctx0 = trb->qwTrb0;
+			devep->ep_sctx_trbs[streamid].ringaddr =
+			    trb->qwTrb0 & ~0xF;
+			devep->ep_sctx_trbs[streamid].ccs =
+			    XHCI_EPCTX_2_DCS_GET(trb->qwTrb0);
+		}
+	} else {
+		if (streamid != 0) {
+			DPRINTF(("pci_xhci cmd set_tr streamid %x != 0\r\n",
+			        streamid));
+		}
+		ep_ctx->qwEpCtx2 = trb->qwTrb0 & ~0xFUL;
+		devep->ep_ringaddr = ep_ctx->qwEpCtx2 & ~0xFUL;
+		devep->ep_ccs = trb->qwTrb0 & 0x1;
+		devep->ep_tr = XHCI_GADDR(sc, devep->ep_ringaddr);
+
+		DPRINTF(("pci_xhci set_tr first TRB:\r\n"));
+		pci_xhci_dump_trb(devep->ep_tr);
+	}
+	ep_ctx->dwEpCtx0 = (ep_ctx->dwEpCtx0 & ~0x7) | XHCI_ST_EPCTX_STOPPED;
+
+done:
+	return (cmderr);
+}
+
+static uint32_t
+pci_xhci_cmd_eval_ctx(struct pci_xhci_softc *sc, uint32_t slot,
+    struct xhci_trb *trb)
+{
+	struct xhci_input_dev_ctx *input_ctx;
+	struct xhci_slot_ctx      *islot_ctx;
+	struct xhci_dev_ctx       *dev_ctx;
+	struct xhci_endp_ctx      *ep0_ctx;
+	uint32_t cmderr;
+
+	input_ctx = XHCI_GADDR(sc, trb->qwTrb0 & ~0xFUL);
+	islot_ctx = &input_ctx->ctx_slot;
+	ep0_ctx = &input_ctx->ctx_ep[1];
+
+	cmderr = XHCI_TRB_ERROR_SUCCESS;
+	DPRINTF(("pci_xhci: eval ctx, input ctl: D 0x%08x A 0x%08x,\r\n"
+	         "          slot %08x %08x %08x %08x\r\n"
+	         "          ep0  %08x %08x %016lx %08x\r\n",
+	        input_ctx->ctx_input.dwInCtx0, input_ctx->ctx_input.dwInCtx1,
+	        islot_ctx->dwSctx0, islot_ctx->dwSctx1,
+	        islot_ctx->dwSctx2, islot_ctx->dwSctx3,
+	        ep0_ctx->dwEpCtx0, ep0_ctx->dwEpCtx1, ep0_ctx->qwEpCtx2,
+	        ep0_ctx->dwEpCtx4));
+
+	/* this command expects drop-ctx=0 & add-ctx=slot+ep0 */
+	if ((input_ctx->ctx_input.dwInCtx0 != 0) ||
+	    (input_ctx->ctx_input.dwInCtx1 & 0x03) == 0) {
+		DPRINTF(("pci_xhci: eval ctx, input ctl invalid\r\n"));
+		cmderr = XHCI_TRB_ERROR_TRB;
+		goto done;
+	}
+
+	/* assign address to slot; in this emulation, slot_id = address */
+	dev_ctx = pci_xhci_get_dev_ctx(sc, slot);
+
+	DPRINTF(("pci_xhci: eval ctx, dev ctx\r\n"
+	         "          slot %08x %08x %08x %08x\r\n",
+	        dev_ctx->ctx_slot.dwSctx0, dev_ctx->ctx_slot.dwSctx1,
+	        dev_ctx->ctx_slot.dwSctx2, dev_ctx->ctx_slot.dwSctx3));
+
+	if (input_ctx->ctx_input.dwInCtx1 & 0x01) {	/* slot ctx */
+		/* set max exit latency */
+		dev_ctx->ctx_slot.dwSctx1 = FIELD_COPY(
+		    dev_ctx->ctx_slot.dwSctx1, input_ctx->ctx_slot.dwSctx1,
+		    0xFFFF, 0);
+
+		/* set interrupter target */
+		dev_ctx->ctx_slot.dwSctx2 = FIELD_COPY(
+		    dev_ctx->ctx_slot.dwSctx2, input_ctx->ctx_slot.dwSctx2,
+		    0x3FF, 22);
+	}
+	if (input_ctx->ctx_input.dwInCtx1 & 0x02) {	/* control ctx */
+		/* set max packet size */
+		dev_ctx->ctx_ep[1].dwEpCtx1 = FIELD_COPY(
+		    dev_ctx->ctx_ep[1].dwEpCtx1, ep0_ctx->dwEpCtx1,
+		    0xFFFF, 16);
+
+		ep0_ctx = &dev_ctx->ctx_ep[1];
+	}
+
+	DPRINTF(("pci_xhci: eval ctx, output ctx\r\n"
+	         "          slot %08x %08x %08x %08x\r\n"
+	         "          ep0  %08x %08x %016lx %08x\r\n",
+	        dev_ctx->ctx_slot.dwSctx0, dev_ctx->ctx_slot.dwSctx1,
+	        dev_ctx->ctx_slot.dwSctx2, dev_ctx->ctx_slot.dwSctx3,
+	        ep0_ctx->dwEpCtx0, ep0_ctx->dwEpCtx1, ep0_ctx->qwEpCtx2,
+	        ep0_ctx->dwEpCtx4));
+
+done:
+	return (cmderr);
+}
+
+static int
+pci_xhci_complete_commands(struct pci_xhci_softc *sc)
+{
+	struct xhci_trb	evtrb;
+	struct xhci_trb	*trb;
+	uint64_t	crcr;
+	uint32_t	ccs;		/* cycle state (XHCI 4.9.2) */
+	uint32_t	type;
+	uint32_t	slot;
+	uint32_t	cmderr;
+	int		error;
+
+	error = 0;
+	sc->opregs.crcr |= XHCI_CRCR_LO_CRR;
+
+	trb = sc->opregs.cr_p;
+	ccs = sc->opregs.crcr & XHCI_CRCR_LO_RCS;
+	crcr = sc->opregs.crcr & ~0xF;
+
+	while (1) {
+		sc->opregs.cr_p = trb;
+	
+		type = XHCI_TRB_3_TYPE_GET(trb->dwTrb3);
+
+		if ((trb->dwTrb3 & XHCI_TRB_3_CYCLE_BIT) !=
+		    (ccs & XHCI_TRB_3_CYCLE_BIT))
+			break;
+
+		DPRINTF(("pci_xhci: cmd type 0x%x, Trb0 x%016lx dwTrb2 x%08x"
+		        " dwTrb3 x%08x, TRB_CYCLE %u/ccs %u\r\n",
+		        type, trb->qwTrb0, trb->dwTrb2, trb->dwTrb3,
+		        trb->dwTrb3 & XHCI_TRB_3_CYCLE_BIT, ccs));
+
+		cmderr = XHCI_TRB_ERROR_SUCCESS;
+		evtrb.dwTrb2 = 0;
+		evtrb.dwTrb3 = (ccs & XHCI_TRB_3_CYCLE_BIT) |
+		      XHCI_TRB_3_TYPE_SET(XHCI_TRB_EVENT_CMD_COMPLETE);
+		slot = 0;
+
+		switch (type) {
+		case XHCI_TRB_TYPE_LINK:			/* 0x06 */
+			if (trb->dwTrb3 & XHCI_TRB_3_TC_BIT)
+				ccs ^= XHCI_CRCR_LO_RCS;
+			break;
+
+		case XHCI_TRB_TYPE_ENABLE_SLOT:			/* 0x09 */
+			cmderr = pci_xhci_cmd_enable_slot(sc, &slot);
+			break;
+
+		case XHCI_TRB_TYPE_DISABLE_SLOT:		/* 0x0A */
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_disable_slot(sc, slot);
+			break;
+
+		case XHCI_TRB_TYPE_ADDRESS_DEVICE:		/* 0x0B */
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_address_device(sc, slot, trb);
+			break;
+
+		case XHCI_TRB_TYPE_CONFIGURE_EP:		/* 0x0C */
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_config_ep(sc, slot, trb);
+			break;
+
+		case XHCI_TRB_TYPE_EVALUATE_CTX:		/* 0x0D */
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_eval_ctx(sc, slot, trb);
+			break;
+
+		case XHCI_TRB_TYPE_RESET_EP:			/* 0x0E */
+			DPRINTF(("Reset Endpoint on slot %d\r\n", slot));
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_reset_ep(sc, slot, trb);
+			break;
+
+		case XHCI_TRB_TYPE_STOP_EP:			/* 0x0F */
+			DPRINTF(("Stop Endpoint on slot %d\r\n", slot));
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_reset_ep(sc, slot, trb);
+			break;
+
+		case XHCI_TRB_TYPE_SET_TR_DEQUEUE:		/* 0x10 */
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_set_tr(sc, slot, trb);
+			break;
+
+		case XHCI_TRB_TYPE_RESET_DEVICE:		/* 0x11 */
+			slot = XHCI_TRB_3_SLOT_GET(trb->dwTrb3);
+			cmderr = pci_xhci_cmd_reset_device(sc, slot);
+			break;
+
+		case XHCI_TRB_TYPE_FORCE_EVENT:			/* 0x12 */
+			/* TODO: */
+			break;
+
+		case XHCI_TRB_TYPE_NEGOTIATE_BW:		/* 0x13 */
+			break;
+
+		case XHCI_TRB_TYPE_SET_LATENCY_TOL:		/* 0x14 */
+			break;
+
+		case XHCI_TRB_TYPE_GET_PORT_BW:			/* 0x15 */
+			break;
+
+		case XHCI_TRB_TYPE_FORCE_HEADER:		/* 0x16 */
+			break;
+
+		case XHCI_TRB_TYPE_NOOP_CMD:			/* 0x17 */
+			break;
+
+		default:
+			DPRINTF(("pci_xhci: unsupported cmd %x\r\n", type));
+			break;
+		}
+
+		if (type != XHCI_TRB_TYPE_LINK) {
+			/* 
+			 * insert command completion event and assert intr
+			 */
+			evtrb.qwTrb0 = crcr;
+			evtrb.dwTrb2 |= XHCI_TRB_2_ERROR_SET(cmderr);
+			evtrb.dwTrb3 |= XHCI_TRB_3_SLOT_SET(slot);
+			DPRINTF(("pci_xhci: command 0x%x result: 0x%x\r\n",
+			        type, cmderr));
+			pci_xhci_insert_event(sc, &evtrb, 1);
+		}
+
+		trb = pci_xhci_trb_next(sc, trb, &crcr);
+	}
+
+	sc->opregs.crcr = crcr | (sc->opregs.crcr & XHCI_CRCR_LO_CA) | ccs;
+	sc->opregs.crcr &= ~XHCI_CRCR_LO_CRR;
+	return (error);
+}
+
+static void
+pci_xhci_dump_trb(struct xhci_trb *trb)
+{
+	static const char *trbtypes[] = {
+		"RESERVED",
+		"NORMAL",
+		"SETUP_STAGE",
+		"DATA_STAGE",
+		"STATUS_STAGE",
+		"ISOCH",
+		"LINK",
+		"EVENT_DATA",
+		"NOOP",
+		"ENABLE_SLOT",
+		"DISABLE_SLOT",
+		"ADDRESS_DEVICE",
+		"CONFIGURE_EP",
+		"EVALUATE_CTX",
+		"RESET_EP",
+		"STOP_EP",
+		"SET_TR_DEQUEUE",
+		"RESET_DEVICE",
+		"FORCE_EVENT",
+		"NEGOTIATE_BW",
+		"SET_LATENCY_TOL",
+		"GET_PORT_BW",
+		"FORCE_HEADER",
+		"NOOP_CMD"
+	};
+	uint32_t type;
+
+	type = XHCI_TRB_3_TYPE_GET(trb->dwTrb3);
+	DPRINTF(("pci_xhci: trb[@%p] type x%02x %s 0:x%016lx 2:x%08x 3:x%08x\r\n",
+	         trb, type,
+	         type <= XHCI_TRB_TYPE_NOOP_CMD ? trbtypes[type] : "INVALID",
+	         trb->qwTrb0, trb->dwTrb2, trb->dwTrb3));
+}
+
+static int
+pci_xhci_xfer_complete(struct pci_xhci_softc *sc, struct usb_data_xfer *xfer,
+     uint32_t slot, uint32_t epid, int *do_intr)
+{
+	struct pci_xhci_dev_emu *dev;
+	struct pci_xhci_dev_ep	*devep;
+	struct xhci_dev_ctx	*dev_ctx;
+	struct xhci_endp_ctx	*ep_ctx;
+	struct xhci_trb		*trb;
+	struct xhci_trb		evtrb;
+	uint32_t trbflags;
+	uint32_t edtla;
+	int i, err;
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	devep = &dev->eps[epid];
+	dev_ctx = pci_xhci_get_dev_ctx(sc, slot);
+
+	assert(dev_ctx != NULL);
+
+	ep_ctx = &dev_ctx->ctx_ep[epid];
+
+	err = XHCI_TRB_ERROR_SUCCESS;
+	*do_intr = 0;
+	edtla = 0;
+
+	/* go through list of TRBs and insert event(s) */
+	for (i = xfer->head; xfer->ndata > 0; ) {
+		evtrb.qwTrb0 = (uint64_t)xfer->data[i].hci_data;
+		trb = XHCI_GADDR(sc, evtrb.qwTrb0);
+		trbflags = trb->dwTrb3;
+
+		DPRINTF(("pci_xhci: xfer[%d] done?%u:%d trb %x %016lx %x "
+		         "(err %d) IOC?%d\r\n",
+		     i, xfer->data[i].processed, xfer->data[i].blen,
+		     XHCI_TRB_3_TYPE_GET(trbflags), evtrb.qwTrb0,
+		     trbflags, err,
+		     trb->dwTrb3 & XHCI_TRB_3_IOC_BIT ? 1 : 0));
+
+		if (!xfer->data[i].processed) {
+			xfer->head = i;
+			break;
+		}
+
+		xfer->ndata--;
+		edtla += xfer->data[i].bdone;
+
+		trb->dwTrb3 = (trb->dwTrb3 & ~0x1) | (xfer->data[i].ccs);
+
+		pci_xhci_update_ep_ring(sc, dev, devep, ep_ctx,
+		    xfer->data[i].streamid, xfer->data[i].trbnext,
+		    xfer->data[i].ccs);
+
+		/* Only interrupt if IOC or short packet */
+		if (!(trb->dwTrb3 & XHCI_TRB_3_IOC_BIT) &&
+		    !((err == XHCI_TRB_ERROR_SHORT_PKT) &&
+		      (trb->dwTrb3 & XHCI_TRB_3_ISP_BIT))) {
+
+			i = (i + 1) % USB_MAX_XFER_BLOCKS;
+			continue;
+		}
+
+		evtrb.dwTrb2 = XHCI_TRB_2_ERROR_SET(err) |
+		               XHCI_TRB_2_REM_SET(xfer->data[i].blen);
+
+		evtrb.dwTrb3 = XHCI_TRB_3_TYPE_SET(XHCI_TRB_EVENT_TRANSFER) |
+		    XHCI_TRB_3_SLOT_SET(slot) | XHCI_TRB_3_EP_SET(epid);
+
+		if (XHCI_TRB_3_TYPE_GET(trbflags) == XHCI_TRB_TYPE_EVENT_DATA) {
+			DPRINTF(("pci_xhci EVENT_DATA edtla %u\r\n", edtla));
+			evtrb.qwTrb0 = trb->qwTrb0;
+			evtrb.dwTrb2 = (edtla & 0xFFFFF) | 
+			         XHCI_TRB_2_ERROR_SET(err);
+			evtrb.dwTrb3 |= XHCI_TRB_3_ED_BIT;
+			edtla = 0;
+		}
+
+		*do_intr = 1;
+
+		err = pci_xhci_insert_event(sc, &evtrb, 0);
+		if (err != XHCI_TRB_ERROR_SUCCESS) {
+			break;
+		}
+
+		i = (i + 1) % USB_MAX_XFER_BLOCKS;
+	}
+
+	return (err);
+}
+
+static void
+pci_xhci_update_ep_ring(struct pci_xhci_softc *sc, struct pci_xhci_dev_emu *dev,
+    struct pci_xhci_dev_ep *devep, struct xhci_endp_ctx *ep_ctx,
+    uint32_t streamid, uint64_t ringaddr, int ccs)
+{
+
+	if (XHCI_EPCTX_0_MAXP_STREAMS_GET(ep_ctx->dwEpCtx0) != 0) {
+		devep->ep_sctx[streamid].qwSctx0 = (ringaddr & ~0xFUL) |
+		                                   (ccs & 0x1);
+
+		devep->ep_sctx_trbs[streamid].ringaddr = ringaddr & ~0xFUL;
+		devep->ep_sctx_trbs[streamid].ccs = ccs & 0x1;
+		ep_ctx->qwEpCtx2 = (ep_ctx->qwEpCtx2 & ~0x1) | (ccs & 0x1);
+
+		DPRINTF(("xhci update ep-ring stream %d, addr %lx\r\n",
+		    streamid, devep->ep_sctx[streamid].qwSctx0));
+	} else {
+		devep->ep_ringaddr = ringaddr & ~0xFUL;
+		devep->ep_ccs = ccs & 0x1;
+		devep->ep_tr = XHCI_GADDR(sc, ringaddr & ~0xFUL);
+		ep_ctx->qwEpCtx2 = (ringaddr & ~0xFUL) | (ccs & 0x1);
+
+		DPRINTF(("xhci update ep-ring, addr %lx\r\n",
+		    (devep->ep_ringaddr | devep->ep_ccs)));
+	}
+}
+
+/*
+ * Outstanding transfer still in progress (device NAK'd earlier) so retry
+ * the transfer again to see if it succeeds.
+ */
+static int
+pci_xhci_try_usb_xfer(struct pci_xhci_softc *sc,
+    struct pci_xhci_dev_emu *dev, struct pci_xhci_dev_ep *devep,
+    struct xhci_endp_ctx *ep_ctx, uint32_t slot, uint32_t epid)
+{
+	struct usb_data_xfer *xfer;
+	int		err;
+	int		do_intr;
+
+	ep_ctx->dwEpCtx0 = FIELD_REPLACE(
+		    ep_ctx->dwEpCtx0, XHCI_ST_EPCTX_RUNNING, 0x7, 0);
+
+	err = 0;
+	do_intr = 0;
+
+	xfer = devep->ep_xfer;
+#ifdef __FreeBSD__
+	USB_DATA_XFER_LOCK(xfer);
+#else
+	/*
+	 * At least one caller needs to hold this lock across the call to this
+	 * function and other code.  To avoid deadlock from a recursive mutex
+	 * enter, we ensure that all callers hold this lock.
+	 */
+	assert(USB_DATA_XFER_LOCK_HELD(xfer));
+#endif
+
+	/* outstanding requests queued up */
+	if (dev->dev_ue->ue_data != NULL) {
+		err = dev->dev_ue->ue_data(dev->dev_sc, xfer,
+		            epid & 0x1 ? USB_XFER_IN : USB_XFER_OUT, epid/2);
+		if (err == USB_ERR_CANCELLED) {
+			if (USB_DATA_GET_ERRCODE(&xfer->data[xfer->head]) ==
+			    USB_NAK)
+				err = XHCI_TRB_ERROR_SUCCESS;
+		} else {
+			err = pci_xhci_xfer_complete(sc, xfer, slot, epid,
+			                             &do_intr);
+			if (err == XHCI_TRB_ERROR_SUCCESS && do_intr) {
+				pci_xhci_assert_interrupt(sc);
+			}
+
+
+			/* XXX should not do it if error? */
+			USB_DATA_XFER_RESET(xfer);
+		}
+	}
+
+#ifdef __FreeBSD__
+	USB_DATA_XFER_UNLOCK(xfer);
+#endif
+
+	return (err);
+}
+
+
+static int
+pci_xhci_handle_transfer(struct pci_xhci_softc *sc,
+    struct pci_xhci_dev_emu *dev, struct pci_xhci_dev_ep *devep,
+    struct xhci_endp_ctx *ep_ctx, struct xhci_trb *trb, uint32_t slot,
+    uint32_t epid, uint64_t addr, uint32_t ccs, uint32_t streamid)
+{
+	struct xhci_trb *setup_trb;
+	struct usb_data_xfer *xfer;
+	struct usb_data_xfer_block *xfer_block;
+	uint64_t	val;
+	uint32_t	trbflags;
+	int		do_intr, err;
+	int		do_retry;
+
+	ep_ctx->dwEpCtx0 = FIELD_REPLACE(ep_ctx->dwEpCtx0,
+	                                 XHCI_ST_EPCTX_RUNNING, 0x7, 0);
+
+	xfer = devep->ep_xfer;
+	USB_DATA_XFER_LOCK(xfer);
+
+	DPRINTF(("pci_xhci handle_transfer slot %u\r\n", slot));
+
+retry:
+	err = 0;
+	do_retry = 0;
+	do_intr = 0;
+	setup_trb = NULL;
+
+	while (1) {
+		pci_xhci_dump_trb(trb);
+
+		trbflags = trb->dwTrb3;
+
+		if (XHCI_TRB_3_TYPE_GET(trbflags) != XHCI_TRB_TYPE_LINK &&
+		    (trbflags & XHCI_TRB_3_CYCLE_BIT) !=
+		    (ccs & XHCI_TRB_3_CYCLE_BIT)) {
+			DPRINTF(("Cycle-bit changed trbflags %x, ccs %x\r\n",
+			    trbflags & XHCI_TRB_3_CYCLE_BIT, ccs));
+			break;
+		}
+
+		xfer_block = NULL;
+
+		switch (XHCI_TRB_3_TYPE_GET(trbflags)) {
+		case XHCI_TRB_TYPE_LINK:
+			if (trb->dwTrb3 & XHCI_TRB_3_TC_BIT)
+				ccs ^= 0x1;
+
+			xfer_block = usb_data_xfer_append(xfer, NULL, 0,
+			                                  (void *)addr, ccs);
+			xfer_block->processed = 1;
+			break;
+
+		case XHCI_TRB_TYPE_SETUP_STAGE:
+			if ((trbflags & XHCI_TRB_3_IDT_BIT) == 0 ||
+			    XHCI_TRB_2_BYTES_GET(trb->dwTrb2) != 8) {
+				DPRINTF(("pci_xhci: invalid setup trb\r\n"));
+				err = XHCI_TRB_ERROR_TRB;
+				goto errout;
+			}
+			setup_trb = trb;
+
+			val = trb->qwTrb0;
+			if (!xfer->ureq)
+				xfer->ureq = malloc(
+				           sizeof(struct usb_device_request));
+			memcpy(xfer->ureq, &val,
+			       sizeof(struct usb_device_request));
+
+			xfer_block = usb_data_xfer_append(xfer, NULL, 0,
+			                                  (void *)addr, ccs);
+			xfer_block->processed = 1;
+			break;
+
+		case XHCI_TRB_TYPE_NORMAL:
+		case XHCI_TRB_TYPE_ISOCH:
+			if (setup_trb != NULL) {
+				DPRINTF(("pci_xhci: trb not supposed to be in "
+				         "ctl scope\r\n"));
+				err = XHCI_TRB_ERROR_TRB;
+				goto errout;
+			}
+			/* fall through */
+
+		case XHCI_TRB_TYPE_DATA_STAGE:
+			xfer_block = usb_data_xfer_append(xfer,
+			     (void *)(trbflags & XHCI_TRB_3_IDT_BIT ?
+			         &trb->qwTrb0 : XHCI_GADDR(sc, trb->qwTrb0)),
+			     trb->dwTrb2 & 0x1FFFF, (void *)addr, ccs);
+			break;
+
+		case XHCI_TRB_TYPE_STATUS_STAGE:
+			xfer_block = usb_data_xfer_append(xfer, NULL, 0,
+			                                  (void *)addr, ccs);
+			break;
+
+		case XHCI_TRB_TYPE_NOOP:
+			xfer_block = usb_data_xfer_append(xfer, NULL, 0,
+			                                  (void *)addr, ccs);
+			xfer_block->processed = 1;
+			break;
+
+		case XHCI_TRB_TYPE_EVENT_DATA:
+			xfer_block = usb_data_xfer_append(xfer, NULL, 0,
+			                                  (void *)addr, ccs);
+			if ((epid > 1) && (trbflags & XHCI_TRB_3_IOC_BIT)) {
+				xfer_block->processed = 1;
+			}
+			break;
+
+		default:
+			DPRINTF(("pci_xhci: handle xfer unexpected trb type "
+			         "0x%x\r\n",
+			         XHCI_TRB_3_TYPE_GET(trbflags)));
+			err = XHCI_TRB_ERROR_TRB;
+			goto errout;
+		}
+
+		trb = pci_xhci_trb_next(sc, trb, &addr);
+
+		DPRINTF(("pci_xhci: next trb: 0x%lx\r\n", (uint64_t)trb));
+
+		if (xfer_block) {
+			xfer_block->trbnext = addr;
+			xfer_block->streamid = streamid;
+		}
+
+		if (!setup_trb && !(trbflags & XHCI_TRB_3_CHAIN_BIT) &&
+		    XHCI_TRB_3_TYPE_GET(trbflags) != XHCI_TRB_TYPE_LINK) {
+			break;
+		}
+
+		/* handle current batch that requires interrupt on complete */
+		if (trbflags & XHCI_TRB_3_IOC_BIT) {
+			DPRINTF(("pci_xhci: trb IOC bit set\r\n"));
+			if (epid == 1)
+				do_retry = 1;
+			break;
+		}
+	}
+
+	DPRINTF(("pci_xhci[%d]: xfer->ndata %u\r\n", __LINE__, xfer->ndata));
+
+	if (epid == 1) {
+		err = USB_ERR_NOT_STARTED;
+		if (dev->dev_ue->ue_request != NULL)
+			err = dev->dev_ue->ue_request(dev->dev_sc, xfer);
+		setup_trb = NULL;
+	} else {
+		/* handle data transfer */
+		pci_xhci_try_usb_xfer(sc, dev, devep, ep_ctx, slot, epid);
+		err = XHCI_TRB_ERROR_SUCCESS;
+		goto errout;
+	}
+
+	err = USB_TO_XHCI_ERR(err);
+	if ((err == XHCI_TRB_ERROR_SUCCESS) ||
+	    (err == XHCI_TRB_ERROR_SHORT_PKT)) {
+		err = pci_xhci_xfer_complete(sc, xfer, slot, epid, &do_intr);
+		if (err != XHCI_TRB_ERROR_SUCCESS)
+			do_retry = 0;
+	}
+
+errout:
+	if (err == XHCI_TRB_ERROR_EV_RING_FULL)
+		DPRINTF(("pci_xhci[%d]: event ring full\r\n", __LINE__));
+
+	if (!do_retry)
+		USB_DATA_XFER_UNLOCK(xfer);
+
+	if (do_intr)
+		pci_xhci_assert_interrupt(sc);
+
+	if (do_retry) {
+		USB_DATA_XFER_RESET(xfer);
+		DPRINTF(("pci_xhci[%d]: retry:continuing with next TRBs\r\n",
+		         __LINE__));
+		goto retry;
+	}
+
+	if (epid == 1)
+		USB_DATA_XFER_RESET(xfer);
+
+	return (err);
+}
+
+static void
+pci_xhci_device_doorbell(struct pci_xhci_softc *sc, uint32_t slot,
+    uint32_t epid, uint32_t streamid)
+{
+	struct pci_xhci_dev_emu *dev;
+	struct pci_xhci_dev_ep	*devep;
+	struct xhci_dev_ctx	*dev_ctx;
+	struct xhci_endp_ctx	*ep_ctx;
+	struct pci_xhci_trb_ring *sctx_tr;
+	struct xhci_trb	*trb;
+	uint64_t	ringaddr;
+	uint32_t	ccs;
+
+	DPRINTF(("pci_xhci doorbell slot %u epid %u stream %u\r\n",
+	    slot, epid, streamid));
+
+	if (slot == 0 || slot > sc->ndevices) {
+		DPRINTF(("pci_xhci: invalid doorbell slot %u\r\n", slot));
+		return;
+	}
+
+	dev = XHCI_SLOTDEV_PTR(sc, slot);
+	devep = &dev->eps[epid];
+	dev_ctx = pci_xhci_get_dev_ctx(sc, slot);
+	if (!dev_ctx) {
+		return;
+	}
+	ep_ctx = &dev_ctx->ctx_ep[epid];
+
+	sctx_tr = NULL;
+
+	DPRINTF(("pci_xhci: device doorbell ep[%u] %08x %08x %016lx %08x\r\n",
+	        epid, ep_ctx->dwEpCtx0, ep_ctx->dwEpCtx1, ep_ctx->qwEpCtx2,
+	        ep_ctx->dwEpCtx4));
+
+	if (ep_ctx->qwEpCtx2 == 0)
+		return;
+
+	/* handle pending transfers */
+	if (devep->ep_xfer->ndata > 0) {
+#ifndef __FreeBSD__
+		USB_DATA_XFER_LOCK(devep->ep_xfer);
+#endif
+		pci_xhci_try_usb_xfer(sc, dev, devep, ep_ctx, slot, epid);
+#ifndef __FreeBSD__
+		USB_DATA_XFER_UNLOCK(devep->ep_xfer);
+#endif
+		return;
+	}
+
+	/* get next trb work item */
+	if (XHCI_EPCTX_0_MAXP_STREAMS_GET(ep_ctx->dwEpCtx0) != 0) {
+		sctx_tr = &devep->ep_sctx_trbs[streamid];
+		ringaddr = sctx_tr->ringaddr;
+		ccs = sctx_tr->ccs;
+		trb = XHCI_GADDR(sc, sctx_tr->ringaddr & ~0xFUL);
+		DPRINTF(("doorbell, stream %u, ccs %lx, trb ccs %x\r\n",
+		        streamid, ep_ctx->qwEpCtx2 & XHCI_TRB_3_CYCLE_BIT,
+		        trb->dwTrb3 & XHCI_TRB_3_CYCLE_BIT));
+	} else {
+		ringaddr = devep->ep_ringaddr;
+		ccs = devep->ep_ccs;
+		trb = devep->ep_tr;
+		DPRINTF(("doorbell, ccs %lx, trb ccs %x\r\n",
+		        ep_ctx->qwEpCtx2 & XHCI_TRB_3_CYCLE_BIT,
+		        trb->dwTrb3 & XHCI_TRB_3_CYCLE_BIT));
+	}
+
+	if (XHCI_TRB_3_TYPE_GET(trb->dwTrb3) == 0) {
+		DPRINTF(("pci_xhci: ring %lx trb[%lx] EP %u is RESERVED?\r\n",
+		        ep_ctx->qwEpCtx2, devep->ep_ringaddr, epid));
+		return;
+	}
+
+	pci_xhci_handle_transfer(sc, dev, devep, ep_ctx, trb, slot, epid,
+	                         ringaddr, ccs, streamid);
+}
+
+static void
+pci_xhci_dbregs_write(struct pci_xhci_softc *sc, uint64_t offset,
+    uint64_t value)
+{
+
+	offset = (offset - sc->dboff) / sizeof(uint32_t);
+
+	DPRINTF(("pci_xhci: doorbell write offset 0x%lx: 0x%lx\r\n",
+	        offset, value));
+
+	if (XHCI_HALTED(sc)) {
+		DPRINTF(("pci_xhci: controller halted\r\n"));
+		return;
+	}
+
+	if (offset == 0)
+		pci_xhci_complete_commands(sc);
+	else if (sc->portregs != NULL)
+		pci_xhci_device_doorbell(sc, offset,
+		   XHCI_DB_TARGET_GET(value), XHCI_DB_SID_GET(value));
+}
+
+static void
+pci_xhci_rtsregs_write(struct pci_xhci_softc *sc, uint64_t offset,
+    uint64_t value)
+{
+	struct pci_xhci_rtsregs *rts;
+
+	offset -= sc->rtsoff;
+
+	if (offset == 0) {
+		DPRINTF(("pci_xhci attempted write to MFINDEX\r\n"));
+		return;
+	}
+
+	DPRINTF(("pci_xhci: runtime regs write offset 0x%lx: 0x%lx\r\n",
+	        offset, value));
+
+	offset -= 0x20;		/* start of intrreg */
+
+	rts = &sc->rtsregs;
+
+	switch (offset) {
+	case 0x00:
+		if (value & XHCI_IMAN_INTR_PEND)
+			rts->intrreg.iman &= ~XHCI_IMAN_INTR_PEND;
+		rts->intrreg.iman = (value & XHCI_IMAN_INTR_ENA) |
+		                    (rts->intrreg.iman & XHCI_IMAN_INTR_PEND);
+
+		if (!(value & XHCI_IMAN_INTR_ENA))
+			pci_xhci_deassert_interrupt(sc);
+
+		break;
+
+	case 0x04:
+		rts->intrreg.imod = value;
+		break;
+
+	case 0x08:
+		rts->intrreg.erstsz = value & 0xFFFF;
+		break;
+
+	case 0x10:
+		/* ERSTBA low bits */
+		rts->intrreg.erstba = MASK_64_HI(sc->rtsregs.intrreg.erstba) |
+		                      (value & ~0x3F);
+		break;
+
+	case 0x14:
+		/* ERSTBA high bits */
+		rts->intrreg.erstba = (value << 32) |
+		    MASK_64_LO(sc->rtsregs.intrreg.erstba);
+
+		rts->erstba_p = XHCI_GADDR(sc,
+		                        sc->rtsregs.intrreg.erstba & ~0x3FUL);
+
+		rts->erst_p = XHCI_GADDR(sc,
+		              sc->rtsregs.erstba_p->qwEvrsTablePtr & ~0x3FUL);
+
+		rts->er_enq_idx = 0;
+		rts->er_events_cnt = 0;
+
+		DPRINTF(("pci_xhci: wr erstba erst (%p) ptr 0x%lx, sz %u\r\n",
+		        rts->erstba_p,
+		        rts->erstba_p->qwEvrsTablePtr,
+		        rts->erstba_p->dwEvrsTableSize));
+		break;
+
+	case 0x18:
+		/* ERDP low bits */
+		rts->intrreg.erdp =
+		    MASK_64_HI(sc->rtsregs.intrreg.erdp) |
+		    (rts->intrreg.erdp & XHCI_ERDP_LO_BUSY) |
+		    (value & ~0xF);
+		if (value & XHCI_ERDP_LO_BUSY) {
+			rts->intrreg.erdp &= ~XHCI_ERDP_LO_BUSY;
+			rts->intrreg.iman &= ~XHCI_IMAN_INTR_PEND;
+		}
+
+		rts->er_deq_seg = XHCI_ERDP_LO_SINDEX(value);
+
+		break;
+
+	case 0x1C:
+		/* ERDP high bits */
+		rts->intrreg.erdp = (value << 32) |
+		    MASK_64_LO(sc->rtsregs.intrreg.erdp);
+
+		if (rts->er_events_cnt > 0) {
+			uint64_t erdp;
+			uint32_t erdp_i;
+
+			erdp = rts->intrreg.erdp & ~0xF;
+			erdp_i = (erdp - rts->erstba_p->qwEvrsTablePtr) /
+			           sizeof(struct xhci_trb);
+
+			if (erdp_i <= rts->er_enq_idx)
+				rts->er_events_cnt = rts->er_enq_idx - erdp_i;
+			else
+				rts->er_events_cnt =
+				          rts->erstba_p->dwEvrsTableSize -
+				          (erdp_i - rts->er_enq_idx);
+
+			DPRINTF(("pci_xhci: erdp 0x%lx, events cnt %u\r\n",
+			        erdp, rts->er_events_cnt));
+		}
+
+		break;
+
+	default:
+		DPRINTF(("pci_xhci attempted write to RTS offset 0x%lx\r\n",
+		        offset));
+		break;
+	}
+}
+
+static uint64_t
+pci_xhci_portregs_read(struct pci_xhci_softc *sc, uint64_t offset)
+{
+	int port;
+	uint32_t *p;
+
+	if (sc->portregs == NULL)
+		return (0);
+
+	port = (offset - 0x3F0) / 0x10;
+
+	if (port > XHCI_MAX_DEVS) {
+		DPRINTF(("pci_xhci: portregs_read port %d >= XHCI_MAX_DEVS\r\n",
+		    port));
+
+		/* return default value for unused port */
+		return (XHCI_PS_SPEED_SET(3));
+	}
+
+	offset = (offset - 0x3F0) % 0x10;
+
+	p = &sc->portregs[port].portsc;
+	p += offset / sizeof(uint32_t);
+
+	DPRINTF(("pci_xhci: portregs read offset 0x%lx port %u -> 0x%x\r\n",
+	        offset, port, *p));
+
+	return (*p);
+}
+
+static void
+pci_xhci_hostop_write(struct pci_xhci_softc *sc, uint64_t offset,
+    uint64_t value)
+{
+	offset -= XHCI_CAPLEN;
+
+	if (offset < 0x400)
+		DPRINTF(("pci_xhci: hostop write offset 0x%lx: 0x%lx\r\n",
+		         offset, value));
+
+	switch (offset) {
+	case XHCI_USBCMD:
+		sc->opregs.usbcmd = pci_xhci_usbcmd_write(sc, value & 0x3F0F);
+		break;
+
+	case XHCI_USBSTS:
+		/* clear bits on write */
+		sc->opregs.usbsts &= ~(value &
+		      (XHCI_STS_HSE|XHCI_STS_EINT|XHCI_STS_PCD|XHCI_STS_SSS|
+		       XHCI_STS_RSS|XHCI_STS_SRE|XHCI_STS_CNR));
+		break;
+
+	case XHCI_PAGESIZE:
+		/* read only */
+		break;
+
+	case XHCI_DNCTRL:
+		sc->opregs.dnctrl = value & 0xFFFF;
+		break;
+
+	case XHCI_CRCR_LO:
+		if (sc->opregs.crcr & XHCI_CRCR_LO_CRR) {
+			sc->opregs.crcr &= ~(XHCI_CRCR_LO_CS|XHCI_CRCR_LO_CA);
+			sc->opregs.crcr |= value &
+			                   (XHCI_CRCR_LO_CS|XHCI_CRCR_LO_CA);
+		} else {
+			sc->opregs.crcr = MASK_64_HI(sc->opregs.crcr) |
+			           (value & (0xFFFFFFC0 | XHCI_CRCR_LO_RCS));
+		}
+		break;
+
+	case XHCI_CRCR_HI:
+		if (!(sc->opregs.crcr & XHCI_CRCR_LO_CRR)) {
+			sc->opregs.crcr = MASK_64_LO(sc->opregs.crcr) |
+			                  (value << 32);
+
+			sc->opregs.cr_p = XHCI_GADDR(sc,
+			                  sc->opregs.crcr & ~0xF);
+		}
+
+		if (sc->opregs.crcr & XHCI_CRCR_LO_CS) {
+			/* Stop operation of Command Ring */
+		}
+
+		if (sc->opregs.crcr & XHCI_CRCR_LO_CA) {
+			/* Abort command */
+		}
+
+		break;
+
+	case XHCI_DCBAAP_LO:
+		sc->opregs.dcbaap = MASK_64_HI(sc->opregs.dcbaap) |
+		                    (value & 0xFFFFFFC0);
+		break;
+
+	case XHCI_DCBAAP_HI:
+		sc->opregs.dcbaap =  MASK_64_LO(sc->opregs.dcbaap) |
+		                     (value << 32);
+		sc->opregs.dcbaa_p = XHCI_GADDR(sc, sc->opregs.dcbaap & ~0x3FUL);
+
+		DPRINTF(("pci_xhci: opregs dcbaap = 0x%lx (vaddr 0x%lx)\r\n",
+		    sc->opregs.dcbaap, (uint64_t)sc->opregs.dcbaa_p));
+		break;
+
+	case XHCI_CONFIG:
+		sc->opregs.config = value & 0x03FF;
+		break;
+
+	default:
+		if (offset >= 0x400)
+			pci_xhci_portregs_write(sc, offset, value);
+
+		break;
+	}
+}
+
+
+static void
+pci_xhci_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+                int baridx, uint64_t offset, int size, uint64_t value)
+{
+	struct pci_xhci_softc *sc;
+
+	sc = pi->pi_arg;
+
+        assert(baridx == 0);
+
+
+        pthread_mutex_lock(&sc->mtx);
+	if (offset < XHCI_CAPLEN)	/* read only registers */
+                WPRINTF(("pci_xhci: write RO-CAPs offset %ld\r\n", offset));
+	else if (offset < sc->dboff)
+		pci_xhci_hostop_write(sc, offset, value);
+	else if (offset < sc->rtsoff)
+		pci_xhci_dbregs_write(sc, offset, value);
+	else if (offset < sc->regsend)
+		pci_xhci_rtsregs_write(sc, offset, value);
+	else
+                WPRINTF(("pci_xhci: write invalid offset %ld\r\n", offset));
+
+        pthread_mutex_unlock(&sc->mtx);
+}
+
+static uint64_t
+pci_xhci_hostcap_read(struct pci_xhci_softc *sc, uint64_t offset)
+{
+	uint64_t	value;
+
+	switch (offset) {
+	case XHCI_CAPLENGTH:	/* 0x00 */
+		value = sc->caplength;
+		break;
+
+	case XHCI_HCSPARAMS1:	/* 0x04 */
+		value = sc->hcsparams1;
+		break;
+
+	case XHCI_HCSPARAMS2:	/* 0x08 */
+		value = sc->hcsparams2;
+		break;
+
+	case XHCI_HCSPARAMS3:	/* 0x0C */
+		value = sc->hcsparams3;
+		break;
+
+	case XHCI_HCSPARAMS0:	/* 0x10 */
+		value = sc->hccparams1;
+		break;
+
+	case XHCI_DBOFF:	/* 0x14 */
+		value = sc->dboff;
+		break;
+
+	case XHCI_RTSOFF:	/* 0x18 */
+		value = sc->rtsoff;
+		break;
+
+	case XHCI_HCCPRAMS2:	/* 0x1C */
+		value = sc->hccparams2;
+		break;
+
+	default:
+		value = 0;
+		break;
+	}
+
+	DPRINTF(("pci_xhci: hostcap read offset 0x%lx -> 0x%lx\r\n",
+	        offset, value));
+
+	return (value);
+}
+
+static uint64_t
+pci_xhci_hostop_read(struct pci_xhci_softc *sc, uint64_t offset)
+{
+	uint64_t value;
+
+	offset = (offset - XHCI_CAPLEN);
+
+	switch (offset) {
+	case XHCI_USBCMD:	/* 0x00 */
+		value = sc->opregs.usbcmd;
+		break;
+
+	case XHCI_USBSTS:	/* 0x04 */
+		value = sc->opregs.usbsts;
+		break;
+
+	case XHCI_PAGESIZE:	/* 0x08 */
+		value = sc->opregs.pgsz;
+		break;
+
+	case XHCI_DNCTRL:	/* 0x14 */
+		value = sc->opregs.dnctrl;
+		break;
+
+	case XHCI_CRCR_LO:	/* 0x18 */
+		value = sc->opregs.crcr & XHCI_CRCR_LO_CRR;
+		break;
+
+	case XHCI_CRCR_HI:	/* 0x1C */
+		value = 0;
+		break;
+
+	case XHCI_DCBAAP_LO:	/* 0x30 */
+		value = sc->opregs.dcbaap & 0xFFFFFFFF;
+		break;
+
+	case XHCI_DCBAAP_HI:	/* 0x34 */
+		value = (sc->opregs.dcbaap >> 32) & 0xFFFFFFFF;
+		break;
+
+	case XHCI_CONFIG:	/* 0x38 */
+		value = sc->opregs.config;
+		break;
+
+	default:
+		if (offset >= 0x400)
+			value = pci_xhci_portregs_read(sc, offset);
+		else
+			value = 0;
+
+		break;
+	}
+
+	if (offset < 0x400)
+		DPRINTF(("pci_xhci: hostop read offset 0x%lx -> 0x%lx\r\n",
+		        offset, value));
+
+	return (value);
+}
+
+static uint64_t
+pci_xhci_dbregs_read(struct pci_xhci_softc *sc, uint64_t offset)
+{
+
+	/* read doorbell always returns 0 */
+	return (0);
+}
+
+static uint64_t
+pci_xhci_rtsregs_read(struct pci_xhci_softc *sc, uint64_t offset)
+{
+	uint32_t	value;
+
+	offset -= sc->rtsoff;
+	value = 0;
+
+	if (offset == XHCI_MFINDEX) {
+		value = sc->rtsregs.mfindex;
+	} else if (offset >= 0x20) {
+		int item;
+		uint32_t *p;
+
+		offset -= 0x20;
+		item = offset % 32;
+
+		assert(offset < sizeof(sc->rtsregs.intrreg));
+
+		p = &sc->rtsregs.intrreg.iman;
+		p += item / sizeof(uint32_t);
+		value = *p;
+	}
+
+	DPRINTF(("pci_xhci: rtsregs read offset 0x%lx -> 0x%x\r\n",
+	        offset, value));
+
+	return (value);
+}
+
+static uint64_t
+pci_xhci_xecp_read(struct pci_xhci_softc *sc, uint64_t offset)
+{
+	uint32_t	value;
+
+	offset -= sc->regsend;
+	value = 0;
+
+	switch (offset) {
+	case 0:
+		/* rev major | rev minor | next-cap | cap-id */
+		value = (0x02 << 24) | (4 << 8) | XHCI_ID_PROTOCOLS;
+		break;
+	case 4:
+		/* name string = "USB" */
+		value = 0x20425355;
+		break;
+	case 8:
+		/* psic | proto-defined | compat # | compat offset */
+		value = ((XHCI_MAX_DEVS/2) << 8) | sc->usb2_port_start;
+		break;
+	case 12:
+		break;
+	case 16:
+		/* rev major | rev minor | next-cap | cap-id */
+		value = (0x03 << 24) | XHCI_ID_PROTOCOLS;
+		break;
+	case 20:
+		/* name string = "USB" */
+		value = 0x20425355;
+		break;
+	case 24:
+		/* psic | proto-defined | compat # | compat offset */
+		value = ((XHCI_MAX_DEVS/2) << 8) | sc->usb3_port_start;
+		break;
+	case 28:
+		break;
+	default:
+		DPRINTF(("pci_xhci: xecp invalid offset 0x%lx\r\n", offset));
+		break;
+	}
+
+	DPRINTF(("pci_xhci: xecp read offset 0x%lx -> 0x%x\r\n",
+	        offset, value));
+
+	return (value);
+}
+
+
+static uint64_t
+pci_xhci_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
+    uint64_t offset, int size)
+{
+	struct pci_xhci_softc *sc;
+	uint32_t	value;
+
+	sc = pi->pi_arg;
+
+        assert(baridx == 0);
+
+        pthread_mutex_lock(&sc->mtx);
+	if (offset < XHCI_CAPLEN)
+		value = pci_xhci_hostcap_read(sc, offset);
+	else if (offset < sc->dboff)
+		value = pci_xhci_hostop_read(sc, offset);
+	else if (offset < sc->rtsoff)
+		value = pci_xhci_dbregs_read(sc, offset);
+	else if (offset < sc->regsend)
+		value = pci_xhci_rtsregs_read(sc, offset);
+	else if (offset < (sc->regsend + 4*32))
+		value = pci_xhci_xecp_read(sc, offset);
+	else {
+		value = 0;
+                WPRINTF(("pci_xhci: read invalid offset %ld\r\n", offset));
+	}
+
+        pthread_mutex_unlock(&sc->mtx);
+
+	switch (size) {
+	case 1:
+		value &= 0xFF;
+		break;
+	case 2:
+		value &= 0xFFFF;
+		break;
+	case 4:
+		value &= 0xFFFFFFFF;
+		break;
+	}
+
+	return (value);
+}
+
+static void
+pci_xhci_reset_port(struct pci_xhci_softc *sc, int portn, int warm)
+{
+	struct pci_xhci_portregs *port;
+	struct pci_xhci_dev_emu	*dev;
+	struct xhci_trb		evtrb;
+	int	error;
+
+	assert(portn <= XHCI_MAX_DEVS);
+
+	DPRINTF(("xhci reset port %d\r\n", portn));
+
+	port = XHCI_PORTREG_PTR(sc, portn);
+	dev = XHCI_DEVINST_PTR(sc, portn);
+	if (dev) {
+		port->portsc &= ~(XHCI_PS_PLS_MASK | XHCI_PS_PR | XHCI_PS_PRC);
+		port->portsc |= XHCI_PS_PED |
+		    XHCI_PS_SPEED_SET(dev->dev_ue->ue_usbspeed);
+
+		if (warm && dev->dev_ue->ue_usbver == 3) {
+			port->portsc |= XHCI_PS_WRC;
+		}
+
+		if ((port->portsc & XHCI_PS_PRC) == 0) {
+			port->portsc |= XHCI_PS_PRC;
+
+			pci_xhci_set_evtrb(&evtrb, portn,
+			     XHCI_TRB_ERROR_SUCCESS,
+			     XHCI_TRB_EVENT_PORT_STS_CHANGE);
+			error = pci_xhci_insert_event(sc, &evtrb, 1);
+			if (error != XHCI_TRB_ERROR_SUCCESS)
+				DPRINTF(("xhci reset port insert event "
+				         "failed\r\n"));
+		}
+	}
+}
+
+static void
+pci_xhci_init_port(struct pci_xhci_softc *sc, int portn)
+{
+	struct pci_xhci_portregs *port;
+	struct pci_xhci_dev_emu	*dev;
+
+	port = XHCI_PORTREG_PTR(sc, portn);
+	dev = XHCI_DEVINST_PTR(sc, portn);
+	if (dev) {
+		port->portsc = XHCI_PS_CCS |		/* connected */
+		               XHCI_PS_PP;		/* port power */
+		
+		if (dev->dev_ue->ue_usbver == 2) {
+			port->portsc |= XHCI_PS_PLS_SET(UPS_PORT_LS_POLL) |
+		               XHCI_PS_SPEED_SET(dev->dev_ue->ue_usbspeed);
+		} else {
+			port->portsc |= XHCI_PS_PLS_SET(UPS_PORT_LS_U0) |
+		               XHCI_PS_PED |		/* enabled */
+		               XHCI_PS_SPEED_SET(dev->dev_ue->ue_usbspeed);
+		}
+		
+		DPRINTF(("Init port %d 0x%x\n", portn, port->portsc));
+	} else {
+		port->portsc = XHCI_PS_PLS_SET(UPS_PORT_LS_RX_DET) | XHCI_PS_PP;
+		DPRINTF(("Init empty port %d 0x%x\n", portn, port->portsc));
+	}
+}
+
+static int
+pci_xhci_dev_intr(struct usb_hci *hci, int epctx)
+{
+	struct pci_xhci_dev_emu *dev;
+	struct xhci_dev_ctx	*dev_ctx;
+	struct xhci_trb		evtrb;
+	struct pci_xhci_softc	*sc;
+	struct pci_xhci_portregs *p;
+	struct xhci_endp_ctx	*ep_ctx;
+	int	error;
+	int	dir_in;
+	int	epid;
+
+	dir_in = epctx & 0x80;
+	epid = epctx & ~0x80;
+
+	/* HW endpoint contexts are 0-15; convert to epid based on dir */
+	epid = (epid * 2) + (dir_in ? 1 : 0);
+
+	assert(epid >= 1 && epid <= 31);
+
+	dev = hci->hci_sc;
+	sc = dev->xsc;
+
+	/* check if device is ready; OS has to initialise it */
+	if (sc->rtsregs.erstba_p == NULL ||
+	    (sc->opregs.usbcmd & XHCI_CMD_RS) == 0 ||
+	    dev->dev_ctx == NULL)
+		return (0);
+
+	p = XHCI_PORTREG_PTR(sc, hci->hci_port);
+
+	/* raise event if link U3 (suspended) state */
+	if (XHCI_PS_PLS_GET(p->portsc) == 3) {
+		p->portsc &= ~XHCI_PS_PLS_MASK;
+		p->portsc |= XHCI_PS_PLS_SET(UPS_PORT_LS_RESUME);
+		if ((p->portsc & XHCI_PS_PLC) != 0)
+			return (0);
+
+		p->portsc |= XHCI_PS_PLC;
+
+		pci_xhci_set_evtrb(&evtrb, hci->hci_port,
+		      XHCI_TRB_ERROR_SUCCESS, XHCI_TRB_EVENT_PORT_STS_CHANGE);
+		error = pci_xhci_insert_event(sc, &evtrb, 0);
+		if (error != XHCI_TRB_ERROR_SUCCESS)
+			goto done;
+	}
+
+	dev_ctx = dev->dev_ctx;
+	ep_ctx = &dev_ctx->ctx_ep[epid];
+	if ((ep_ctx->dwEpCtx0 & 0x7) == XHCI_ST_EPCTX_DISABLED) {
+		DPRINTF(("xhci device interrupt on disabled endpoint %d\r\n",
+		         epid));
+		return (0);
+	}
+
+	DPRINTF(("xhci device interrupt on endpoint %d\r\n", epid));
+
+	pci_xhci_device_doorbell(sc, hci->hci_port, epid, 0);
+
+done:
+	return (error);
+}
+
+static int
+pci_xhci_dev_event(struct usb_hci *hci, enum hci_usbev evid, void *param)
+{
+
+	DPRINTF(("xhci device event port %d\r\n", hci->hci_port));
+	return (0);
+}
+
+
+
+static void
+pci_xhci_device_usage(char *opt)
+{
+
+	fprintf(stderr, "Invalid USB emulation \"%s\"\r\n", opt);
+}
+
+static int
+pci_xhci_parse_opts(struct pci_xhci_softc *sc, char *opts)
+{
+	struct pci_xhci_dev_emu	**devices;
+	struct pci_xhci_dev_emu	*dev;
+	struct usb_devemu	*ue;
+	void	*devsc;
+	char	*uopt, *xopts, *config;
+	int	usb3_port, usb2_port, i;
+
+	usb3_port = sc->usb3_port_start - 1;
+	usb2_port = sc->usb2_port_start - 1;
+	devices = NULL;
+
+	if (opts == NULL)
+		goto portsfinal;
+
+	devices = calloc(XHCI_MAX_DEVS, sizeof(struct pci_xhci_dev_emu *));
+
+	sc->slots = calloc(XHCI_MAX_SLOTS, sizeof(struct pci_xhci_dev_emu *));
+	sc->devices = devices;
+	sc->ndevices = 0;
+
+	uopt = strdup(opts);
+	for (xopts = strtok(uopt, ",");
+	     xopts != NULL;
+	     xopts = strtok(NULL, ",")) {
+		if (usb2_port == ((sc->usb2_port_start-1) + XHCI_MAX_DEVS/2) ||
+		    usb3_port == ((sc->usb3_port_start-1) + XHCI_MAX_DEVS/2)) {
+			WPRINTF(("pci_xhci max number of USB 2 or 3 "
+			     "devices reached, max %d\r\n", XHCI_MAX_DEVS/2));
+			usb2_port = usb3_port = -1;
+			goto done;
+		}
+
+		/* device[=<config>] */
+		if ((config = strchr(xopts, '=')) == NULL)
+			config = "";		/* no config */
+		else
+			*config++ = '\0';
+
+		ue = usb_emu_finddev(xopts);
+		if (ue == NULL) {
+			pci_xhci_device_usage(xopts);
+			DPRINTF(("pci_xhci device not found %s\r\n", xopts));
+			usb2_port = usb3_port = -1;
+			goto done;
+		}
+
+		DPRINTF(("pci_xhci adding device %s, opts \"%s\"\r\n",
+		        xopts, config));
+
+		dev = calloc(1, sizeof(struct pci_xhci_dev_emu));
+		dev->xsc = sc;
+		dev->hci.hci_sc = dev;
+		dev->hci.hci_intr = pci_xhci_dev_intr;
+		dev->hci.hci_event = pci_xhci_dev_event;
+
+		if (ue->ue_usbver == 2) {
+			dev->hci.hci_port = usb2_port + 1;
+			devices[usb2_port] = dev;
+			usb2_port++;
+		} else {
+			dev->hci.hci_port = usb3_port + 1;
+			devices[usb3_port] = dev;
+			usb3_port++;
+		}
+
+		dev->hci.hci_address = 0;
+		devsc = ue->ue_init(&dev->hci, config);
+		if (devsc == NULL) {
+			pci_xhci_device_usage(xopts);
+			usb2_port = usb3_port = -1;
+			goto done;
+		}
+
+		dev->dev_ue = ue;
+		dev->dev_sc = devsc;
+
+		/* assign slot number to device */
+		sc->slots[sc->ndevices] = dev;
+
+		sc->ndevices++;
+	}
+
+portsfinal:
+	sc->portregs = calloc(XHCI_MAX_DEVS, sizeof(struct pci_xhci_portregs));
+
+	if (sc->ndevices > 0) {
+		/* port and slot numbering start from 1 */
+		sc->devices--;
+		sc->portregs--;
+		sc->slots--;
+
+		for (i = 1; i <= XHCI_MAX_DEVS; i++) {
+			pci_xhci_init_port(sc, i);
+		}
+	} else {
+		WPRINTF(("pci_xhci no USB devices configured\r\n"));
+		sc->ndevices = 1;
+	}
+
+done:
+	if (devices != NULL) {
+		if (usb2_port <= 0 && usb3_port <= 0) {
+			sc->devices = NULL;
+			for (i = 0; devices[i] != NULL; i++)
+				free(devices[i]);
+			sc->ndevices = -1;
+
+			free(devices);
+		}
+	}
+	return (sc->ndevices);
+}
+
+static int
+pci_xhci_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
+{
+	struct pci_xhci_softc *sc;
+	int	error;
+
+	if (xhci_in_use) {
+		WPRINTF(("pci_xhci controller already defined\r\n"));
+		return (-1);
+	}
+	xhci_in_use = 1;
+
+	sc = calloc(1, sizeof(struct pci_xhci_softc));
+	pi->pi_arg = sc;
+	sc->xsc_pi = pi;
+
+	sc->usb2_port_start = (XHCI_MAX_DEVS/2) + 1;
+	sc->usb3_port_start = 1;
+
+	/* discover devices */
+	error = pci_xhci_parse_opts(sc, opts);
+	if (error < 0)
+		goto done;
+	else
+		error = 0;
+
+	sc->caplength = XHCI_SET_CAPLEN(XHCI_CAPLEN) |
+	                XHCI_SET_HCIVERSION(0x0100);
+	sc->hcsparams1 = XHCI_SET_HCSP1_MAXPORTS(XHCI_MAX_DEVS) |
+	                 XHCI_SET_HCSP1_MAXINTR(1) |	/* interrupters */
+	                 XHCI_SET_HCSP1_MAXSLOTS(XHCI_MAX_SLOTS);
+	sc->hcsparams2 = XHCI_SET_HCSP2_ERSTMAX(XHCI_ERST_MAX) |
+	                 XHCI_SET_HCSP2_IST(0x04);
+	sc->hcsparams3 = 0;				/* no latency */
+	sc->hccparams1 = XHCI_SET_HCCP1_NSS(1) |	/* no 2nd-streams */
+	                 XHCI_SET_HCCP1_SPC(1) |	/* short packet */
+	                 XHCI_SET_HCCP1_MAXPSA(XHCI_STREAMS_MAX);
+	sc->hccparams2 = XHCI_SET_HCCP2_LEC(1) |
+	                 XHCI_SET_HCCP2_U3C(1);
+	sc->dboff = XHCI_SET_DOORBELL(XHCI_CAPLEN + XHCI_PORTREGS_START +
+	            XHCI_MAX_DEVS * sizeof(struct pci_xhci_portregs));
+
+	/* dboff must be 32-bit aligned */
+	if (sc->dboff & 0x3)
+		sc->dboff = (sc->dboff + 0x3) & ~0x3;
+
+	/* rtsoff must be 32-bytes aligned */
+	sc->rtsoff = XHCI_SET_RTSOFFSET(sc->dboff + (XHCI_MAX_SLOTS+1) * 32);
+	if (sc->rtsoff & 0x1F)
+		sc->rtsoff = (sc->rtsoff + 0x1F) & ~0x1F;
+
+	DPRINTF(("pci_xhci dboff: 0x%x, rtsoff: 0x%x\r\n", sc->dboff,
+	        sc->rtsoff));
+
+	sc->opregs.usbsts = XHCI_STS_HCH;
+	sc->opregs.pgsz = XHCI_PAGESIZE_4K;
+
+	pci_xhci_reset(sc);
+
+	sc->regsend = sc->rtsoff + 0x20 + 32;		/* only 1 intrpter */
+
+	/*
+	 * Set extended capabilities pointer to be after regsend;
+	 * value of xecp field is 32-bit offset.
+	 */
+	sc->hccparams1 |= XHCI_SET_HCCP1_XECP(sc->regsend/4);
+
+	pci_set_cfgdata16(pi, PCIR_DEVICE, 0x1E31);
+	pci_set_cfgdata16(pi, PCIR_VENDOR, 0x8086);
+	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_SERIALBUS);
+	pci_set_cfgdata8(pi, PCIR_SUBCLASS, PCIS_SERIALBUS_USB);
+	pci_set_cfgdata8(pi, PCIR_PROGIF,PCIP_SERIALBUS_USB_XHCI);
+	pci_set_cfgdata8(pi, PCI_USBREV, PCI_USB_REV_3_0);
+
+	pci_emul_add_msicap(pi, 1);
+
+	/* regsend + xecp registers */
+	pci_emul_alloc_bar(pi, 0, PCIBAR_MEM32, sc->regsend + 4*32);
+	DPRINTF(("pci_xhci pci_emu_alloc: %d\r\n", sc->regsend + 4*32));
+
+
+	pci_lintr_request(pi);
+
+	pthread_mutex_init(&sc->mtx, NULL);
+
+done:
+	if (error) {
+		free(sc);
+	}
+
+	return (error);
+}
+
+
+
+struct pci_devemu pci_de_xhci = {
+	.pe_emu =	"xhci",
+	.pe_init =	pci_xhci_init,
+	.pe_barwrite =	pci_xhci_write,
+	.pe_barread =	pci_xhci_read
+};
+PCI_EMUL_SET(pci_de_xhci);
diff --git a/usr/src/cmd/bhyve/pci_xhci.h b/usr/src/cmd/bhyve/pci_xhci.h
new file mode 100644
index 0000000000..d5f05af5d0
--- /dev/null
+++ b/usr/src/cmd/bhyve/pci_xhci.h
@@ -0,0 +1,353 @@
+/*-
+ * Copyright (c) 2014 Leon Dang <ldang@nahannisys.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_PCI_XHCI_H_
+#define	_PCI_XHCI_H_
+
+#define	PCI_USBREV		0x60	/* USB protocol revision */
+
+
+enum {					/* dsc_slotstate */
+	XHCI_ST_DISABLED,
+	XHCI_ST_ENABLED,
+	XHCI_ST_DEFAULT,
+	XHCI_ST_ADDRESSED,
+	XHCI_ST_CONFIGURED,
+	XHCI_ST_MAX
+};
+
+enum {
+	XHCI_ST_SLCTX_DISABLED,
+	XHCI_ST_SLCTX_DEFAULT,
+	XHCI_ST_SLCTX_ADDRESSED,
+	XHCI_ST_SLCTX_CONFIGURED
+};
+
+enum {
+	XHCI_ST_EPCTX_DISABLED,
+	XHCI_ST_EPCTX_RUNNING,
+	XHCI_ST_EPCTX_HALTED,
+	XHCI_ST_EPCTX_STOPPED,
+	XHCI_ST_EPCTX_ERROR
+};
+
+#define	XHCI_MAX_DEVICES	MIN(USB_MAX_DEVICES, 128)
+#define	XHCI_MAX_ENDPOINTS	32	/* hardcoded - do not change */
+#define	XHCI_MAX_SCRATCHPADS	32
+#define	XHCI_MAX_EVENTS		(16 * 13)
+#define	XHCI_MAX_COMMANDS	(16 * 1)
+#define	XHCI_MAX_RSEG		1
+#define	XHCI_MAX_TRANSFERS	4
+#if USB_MAX_EP_STREAMS == 8
+#define	XHCI_MAX_STREAMS	8
+#define	XHCI_MAX_STREAMS_LOG	3
+#elif USB_MAX_EP_STREAMS == 1
+#define	XHCI_MAX_STREAMS	1
+#define	XHCI_MAX_STREAMS_LOG	0
+#else
+#error "The USB_MAX_EP_STREAMS value is not supported."
+#endif
+#define	XHCI_DEV_CTX_ADDR_ALIGN		64	/* bytes */
+#define	XHCI_DEV_CTX_ALIGN		64	/* bytes */
+#define	XHCI_INPUT_CTX_ALIGN		64	/* bytes */
+#define	XHCI_SLOT_CTX_ALIGN		32	/* bytes */
+#define	XHCI_ENDP_CTX_ALIGN		32	/* bytes */
+#define	XHCI_STREAM_CTX_ALIGN		16	/* bytes */
+#define	XHCI_TRANS_RING_SEG_ALIGN	16	/* bytes */
+#define	XHCI_CMD_RING_SEG_ALIGN		64	/* bytes */
+#define	XHCI_EVENT_RING_SEG_ALIGN	64	/* bytes */
+#define	XHCI_SCRATCH_BUF_ARRAY_ALIGN	64	/* bytes */
+#define	XHCI_SCRATCH_BUFFER_ALIGN	USB_PAGE_SIZE
+#define	XHCI_TRB_ALIGN			16	/* bytes */
+#define	XHCI_TD_ALIGN			64	/* bytes */
+#define	XHCI_PAGE_SIZE			4096	/* bytes */
+
+struct xhci_slot_ctx {
+	volatile uint32_t	dwSctx0;
+#define	XHCI_SCTX_0_ROUTE_SET(x)		((x) & 0xFFFFF)
+#define	XHCI_SCTX_0_ROUTE_GET(x)		((x) & 0xFFFFF)
+#define	XHCI_SCTX_0_SPEED_SET(x)		(((x) & 0xF) << 20)
+#define	XHCI_SCTX_0_SPEED_GET(x)		(((x) >> 20) & 0xF)
+#define	XHCI_SCTX_0_MTT_SET(x)			(((x) & 0x1) << 25)
+#define	XHCI_SCTX_0_MTT_GET(x)			(((x) >> 25) & 0x1)
+#define	XHCI_SCTX_0_HUB_SET(x)			(((x) & 0x1) << 26)
+#define	XHCI_SCTX_0_HUB_GET(x)			(((x) >> 26) & 0x1)
+#define	XHCI_SCTX_0_CTX_NUM_SET(x)		(((x) & 0x1F) << 27)
+#define	XHCI_SCTX_0_CTX_NUM_GET(x)		(((x) >> 27) & 0x1F)
+	volatile uint32_t	dwSctx1;
+#define	XHCI_SCTX_1_MAX_EL_SET(x)		((x) & 0xFFFF)
+#define	XHCI_SCTX_1_MAX_EL_GET(x)		((x) & 0xFFFF)
+#define	XHCI_SCTX_1_RH_PORT_SET(x)		(((x) & 0xFF) << 16)
+#define	XHCI_SCTX_1_RH_PORT_GET(x)		(((x) >> 16) & 0xFF)
+#define	XHCI_SCTX_1_NUM_PORTS_SET(x)		(((x) & 0xFF) << 24)
+#define	XHCI_SCTX_1_NUM_PORTS_GET(x)		(((x) >> 24) & 0xFF)
+	volatile uint32_t	dwSctx2;
+#define	XHCI_SCTX_2_TT_HUB_SID_SET(x)		((x) & 0xFF)
+#define	XHCI_SCTX_2_TT_HUB_SID_GET(x)		((x) & 0xFF)
+#define	XHCI_SCTX_2_TT_PORT_NUM_SET(x)		(((x) & 0xFF) << 8)
+#define	XHCI_SCTX_2_TT_PORT_NUM_GET(x)		(((x) >> 8) & 0xFF)
+#define	XHCI_SCTX_2_TT_THINK_TIME_SET(x)	(((x) & 0x3) << 16)
+#define	XHCI_SCTX_2_TT_THINK_TIME_GET(x)	(((x) >> 16) & 0x3)
+#define	XHCI_SCTX_2_IRQ_TARGET_SET(x)		(((x) & 0x3FF) << 22)
+#define	XHCI_SCTX_2_IRQ_TARGET_GET(x)		(((x) >> 22) & 0x3FF)
+	volatile uint32_t	dwSctx3;
+#define	XHCI_SCTX_3_DEV_ADDR_SET(x)		((x) & 0xFF)
+#define	XHCI_SCTX_3_DEV_ADDR_GET(x)		((x) & 0xFF)
+#define	XHCI_SCTX_3_SLOT_STATE_SET(x)		(((x) & 0x1F) << 27)
+#define	XHCI_SCTX_3_SLOT_STATE_GET(x)		(((x) >> 27) & 0x1F)
+	volatile uint32_t	dwSctx4;
+	volatile uint32_t	dwSctx5;
+	volatile uint32_t	dwSctx6;
+	volatile uint32_t	dwSctx7;
+};
+
+struct xhci_endp_ctx {
+	volatile uint32_t	dwEpCtx0;
+#define	XHCI_EPCTX_0_EPSTATE_SET(x)		((x) & 0x7)
+#define	XHCI_EPCTX_0_EPSTATE_GET(x)		((x) & 0x7)
+#define	XHCI_EPCTX_0_MULT_SET(x)		(((x) & 0x3) << 8)
+#define	XHCI_EPCTX_0_MULT_GET(x)		(((x) >> 8) & 0x3)
+#define	XHCI_EPCTX_0_MAXP_STREAMS_SET(x)	(((x) & 0x1F) << 10)
+#define	XHCI_EPCTX_0_MAXP_STREAMS_GET(x)	(((x) >> 10) & 0x1F)
+#define	XHCI_EPCTX_0_LSA_SET(x)			(((x) & 0x1) << 15)
+#define	XHCI_EPCTX_0_LSA_GET(x)			(((x) >> 15) & 0x1)
+#define	XHCI_EPCTX_0_IVAL_SET(x)		(((x) & 0xFF) << 16)
+#define	XHCI_EPCTX_0_IVAL_GET(x)		(((x) >> 16) & 0xFF)
+	volatile uint32_t	dwEpCtx1;
+#define	XHCI_EPCTX_1_CERR_SET(x)		(((x) & 0x3) << 1)
+#define	XHCI_EPCTX_1_CERR_GET(x)		(((x) >> 1) & 0x3)
+#define	XHCI_EPCTX_1_EPTYPE_SET(x)		(((x) & 0x7) << 3)
+#define	XHCI_EPCTX_1_EPTYPE_GET(x)		(((x) >> 3) & 0x7)
+#define	XHCI_EPCTX_1_HID_SET(x)			(((x) & 0x1) << 7)
+#define	XHCI_EPCTX_1_HID_GET(x)			(((x) >> 7) & 0x1)
+#define	XHCI_EPCTX_1_MAXB_SET(x)		(((x) & 0xFF) << 8)
+#define	XHCI_EPCTX_1_MAXB_GET(x)		(((x) >> 8) & 0xFF)
+#define	XHCI_EPCTX_1_MAXP_SIZE_SET(x)		(((x) & 0xFFFF) << 16)
+#define	XHCI_EPCTX_1_MAXP_SIZE_GET(x)		(((x) >> 16) & 0xFFFF)
+	volatile uint64_t	qwEpCtx2;
+#define	XHCI_EPCTX_2_DCS_SET(x)			((x) & 0x1)
+#define	XHCI_EPCTX_2_DCS_GET(x)			((x) & 0x1)
+#define	XHCI_EPCTX_2_TR_DQ_PTR_MASK		0xFFFFFFFFFFFFFFF0U
+	volatile uint32_t	dwEpCtx4;
+#define	XHCI_EPCTX_4_AVG_TRB_LEN_SET(x)		((x) & 0xFFFF)
+#define	XHCI_EPCTX_4_AVG_TRB_LEN_GET(x)		((x) & 0xFFFF)
+#define	XHCI_EPCTX_4_MAX_ESIT_PAYLOAD_SET(x)	(((x) & 0xFFFF) << 16)
+#define	XHCI_EPCTX_4_MAX_ESIT_PAYLOAD_GET(x)	(((x) >> 16) & 0xFFFF)
+	volatile uint32_t	dwEpCtx5;
+	volatile uint32_t	dwEpCtx6;
+	volatile uint32_t	dwEpCtx7;
+};
+
+struct xhci_input_ctx {
+#define	XHCI_INCTX_NON_CTRL_MASK	0xFFFFFFFCU
+	volatile uint32_t	dwInCtx0;
+#define	XHCI_INCTX_0_DROP_MASK(n)	(1U << (n))
+	volatile uint32_t	dwInCtx1;
+#define	XHCI_INCTX_1_ADD_MASK(n)	(1U << (n))
+	volatile uint32_t	dwInCtx2;
+	volatile uint32_t	dwInCtx3;
+	volatile uint32_t	dwInCtx4;
+	volatile uint32_t	dwInCtx5;
+	volatile uint32_t	dwInCtx6;
+	volatile uint32_t	dwInCtx7;
+};
+
+struct xhci_input_dev_ctx {
+	struct xhci_input_ctx	ctx_input;
+	union {
+		struct xhci_slot_ctx	u_slot;
+		struct xhci_endp_ctx	u_ep[XHCI_MAX_ENDPOINTS];
+	} ctx_dev_slep;
+};
+
+struct xhci_dev_ctx {
+	union {
+		struct xhci_slot_ctx	u_slot;
+		struct xhci_endp_ctx	u_ep[XHCI_MAX_ENDPOINTS];
+	} ctx_dev_slep;
+} __aligned(XHCI_DEV_CTX_ALIGN);
+#define	ctx_slot	ctx_dev_slep.u_slot
+#define	ctx_ep		ctx_dev_slep.u_ep
+
+struct xhci_stream_ctx {
+	volatile uint64_t	qwSctx0;
+#define	XHCI_SCTX_0_DCS_GET(x)		((x) & 0x1)
+#define	XHCI_SCTX_0_DCS_SET(x)		((x) & 0x1)
+#define	XHCI_SCTX_0_SCT_SET(x)		(((x) & 0x7) << 1)
+#define	XHCI_SCTX_0_SCT_GET(x)		(((x) >> 1) & 0x7)
+#define	XHCI_SCTX_0_SCT_SEC_TR_RING	0x0
+#define	XHCI_SCTX_0_SCT_PRIM_TR_RING	0x1
+#define	XHCI_SCTX_0_SCT_PRIM_SSA_8	0x2
+#define	XHCI_SCTX_0_SCT_PRIM_SSA_16	0x3
+#define	XHCI_SCTX_0_SCT_PRIM_SSA_32	0x4
+#define	XHCI_SCTX_0_SCT_PRIM_SSA_64	0x5
+#define	XHCI_SCTX_0_SCT_PRIM_SSA_128	0x6
+#define	XHCI_SCTX_0_SCT_PRIM_SSA_256	0x7
+#define	XHCI_SCTX_0_TR_DQ_PTR_MASK	0xFFFFFFFFFFFFFFF0U
+	volatile uint32_t	dwSctx2;
+	volatile uint32_t	dwSctx3;
+};
+
+struct xhci_trb {
+	volatile uint64_t	qwTrb0;
+#define	XHCI_TRB_0_DIR_IN_MASK		(0x80ULL << 0)
+#define	XHCI_TRB_0_WLENGTH_MASK		(0xFFFFULL << 48)
+	volatile uint32_t	dwTrb2;
+#define	XHCI_TRB_2_ERROR_GET(x)		(((x) >> 24) & 0xFF)
+#define	XHCI_TRB_2_ERROR_SET(x)		(((x) & 0xFF) << 24)
+#define	XHCI_TRB_2_TDSZ_GET(x)		(((x) >> 17) & 0x1F)
+#define	XHCI_TRB_2_TDSZ_SET(x)		(((x) & 0x1F) << 17)
+#define	XHCI_TRB_2_REM_GET(x)		((x) & 0xFFFFFF)
+#define	XHCI_TRB_2_REM_SET(x)		((x) & 0xFFFFFF)
+#define	XHCI_TRB_2_BYTES_GET(x)		((x) & 0x1FFFF)
+#define	XHCI_TRB_2_BYTES_SET(x)		((x) & 0x1FFFF)
+#define	XHCI_TRB_2_IRQ_GET(x)		(((x) >> 22) & 0x3FF)
+#define	XHCI_TRB_2_IRQ_SET(x)		(((x) & 0x3FF) << 22)
+#define	XHCI_TRB_2_STREAM_GET(x)	(((x) >> 16) & 0xFFFF)
+#define	XHCI_TRB_2_STREAM_SET(x)	(((x) & 0xFFFF) << 16)
+
+	volatile uint32_t	dwTrb3;
+#define	XHCI_TRB_3_TYPE_GET(x)		(((x) >> 10) & 0x3F)
+#define	XHCI_TRB_3_TYPE_SET(x)		(((x) & 0x3F) << 10)
+#define	XHCI_TRB_3_CYCLE_BIT		(1U << 0)
+#define	XHCI_TRB_3_TC_BIT		(1U << 1)	/* command ring only */
+#define	XHCI_TRB_3_ENT_BIT		(1U << 1)	/* transfer ring only */
+#define	XHCI_TRB_3_ISP_BIT		(1U << 2)
+#define	XHCI_TRB_3_ED_BIT		(1U << 2)
+#define	XHCI_TRB_3_NSNOOP_BIT		(1U << 3)
+#define	XHCI_TRB_3_CHAIN_BIT		(1U << 4)
+#define	XHCI_TRB_3_IOC_BIT		(1U << 5)
+#define	XHCI_TRB_3_IDT_BIT		(1U << 6)
+#define	XHCI_TRB_3_TBC_GET(x)		(((x) >> 7) & 3)
+#define	XHCI_TRB_3_TBC_SET(x)		(((x) & 3) << 7)
+#define	XHCI_TRB_3_BEI_BIT		(1U << 9)
+#define	XHCI_TRB_3_DCEP_BIT		(1U << 9)
+#define	XHCI_TRB_3_PRSV_BIT		(1U << 9)
+#define	XHCI_TRB_3_BSR_BIT		(1U << 9)
+#define	XHCI_TRB_3_TRT_MASK		(3U << 16)
+#define	XHCI_TRB_3_TRT_NONE		(0U << 16)
+#define	XHCI_TRB_3_TRT_OUT		(2U << 16)
+#define	XHCI_TRB_3_TRT_IN		(3U << 16)
+#define	XHCI_TRB_3_DIR_IN		(1U << 16)
+#define	XHCI_TRB_3_TLBPC_GET(x)		(((x) >> 16) & 0xF)
+#define	XHCI_TRB_3_TLBPC_SET(x)		(((x) & 0xF) << 16)
+#define	XHCI_TRB_3_EP_GET(x)		(((x) >> 16) & 0x1F)
+#define	XHCI_TRB_3_EP_SET(x)		(((x) & 0x1F) << 16)
+#define	XHCI_TRB_3_FRID_GET(x)		(((x) >> 20) & 0x7FF)
+#define	XHCI_TRB_3_FRID_SET(x)		(((x) & 0x7FF) << 20)
+#define	XHCI_TRB_3_ISO_SIA_BIT		(1U << 31)
+#define	XHCI_TRB_3_SUSP_EP_BIT		(1U << 23)
+#define	XHCI_TRB_3_SLOT_GET(x)		(((x) >> 24) & 0xFF)
+#define	XHCI_TRB_3_SLOT_SET(x)		(((x) & 0xFF) << 24)
+
+/* Commands */
+#define	XHCI_TRB_TYPE_RESERVED		0x00
+#define	XHCI_TRB_TYPE_NORMAL		0x01
+#define	XHCI_TRB_TYPE_SETUP_STAGE	0x02
+#define	XHCI_TRB_TYPE_DATA_STAGE	0x03
+#define	XHCI_TRB_TYPE_STATUS_STAGE	0x04
+#define	XHCI_TRB_TYPE_ISOCH		0x05
+#define	XHCI_TRB_TYPE_LINK		0x06
+#define	XHCI_TRB_TYPE_EVENT_DATA	0x07
+#define	XHCI_TRB_TYPE_NOOP		0x08
+#define	XHCI_TRB_TYPE_ENABLE_SLOT	0x09
+#define	XHCI_TRB_TYPE_DISABLE_SLOT	0x0A
+#define	XHCI_TRB_TYPE_ADDRESS_DEVICE	0x0B
+#define	XHCI_TRB_TYPE_CONFIGURE_EP	0x0C
+#define	XHCI_TRB_TYPE_EVALUATE_CTX	0x0D
+#define	XHCI_TRB_TYPE_RESET_EP		0x0E
+#define	XHCI_TRB_TYPE_STOP_EP		0x0F
+#define	XHCI_TRB_TYPE_SET_TR_DEQUEUE	0x10
+#define	XHCI_TRB_TYPE_RESET_DEVICE	0x11
+#define	XHCI_TRB_TYPE_FORCE_EVENT	0x12
+#define	XHCI_TRB_TYPE_NEGOTIATE_BW	0x13
+#define	XHCI_TRB_TYPE_SET_LATENCY_TOL  	0x14
+#define	XHCI_TRB_TYPE_GET_PORT_BW	0x15
+#define	XHCI_TRB_TYPE_FORCE_HEADER	0x16
+#define	XHCI_TRB_TYPE_NOOP_CMD		0x17
+
+/* Events */
+#define	XHCI_TRB_EVENT_TRANSFER		0x20
+#define	XHCI_TRB_EVENT_CMD_COMPLETE	0x21
+#define	XHCI_TRB_EVENT_PORT_STS_CHANGE  0x22
+#define	XHCI_TRB_EVENT_BW_REQUEST      	0x23
+#define	XHCI_TRB_EVENT_DOORBELL		0x24
+#define	XHCI_TRB_EVENT_HOST_CTRL	0x25
+#define	XHCI_TRB_EVENT_DEVICE_NOTIFY	0x26
+#define	XHCI_TRB_EVENT_MFINDEX_WRAP	0x27
+
+/* Error codes */
+#define	XHCI_TRB_ERROR_INVALID		0x00
+#define	XHCI_TRB_ERROR_SUCCESS		0x01
+#define	XHCI_TRB_ERROR_DATA_BUF		0x02
+#define	XHCI_TRB_ERROR_BABBLE		0x03
+#define	XHCI_TRB_ERROR_XACT		0x04
+#define	XHCI_TRB_ERROR_TRB		0x05
+#define	XHCI_TRB_ERROR_STALL		0x06
+#define	XHCI_TRB_ERROR_RESOURCE		0x07
+#define	XHCI_TRB_ERROR_BANDWIDTH	0x08
+#define	XHCI_TRB_ERROR_NO_SLOTS		0x09
+#define	XHCI_TRB_ERROR_STREAM_TYPE	0x0A
+#define	XHCI_TRB_ERROR_SLOT_NOT_ON	0x0B
+#define	XHCI_TRB_ERROR_ENDP_NOT_ON	0x0C
+#define	XHCI_TRB_ERROR_SHORT_PKT	0x0D
+#define	XHCI_TRB_ERROR_RING_UNDERRUN	0x0E
+#define	XHCI_TRB_ERROR_RING_OVERRUN	0x0F
+#define	XHCI_TRB_ERROR_VF_RING_FULL	0x10
+#define	XHCI_TRB_ERROR_PARAMETER	0x11
+#define	XHCI_TRB_ERROR_BW_OVERRUN	0x12
+#define	XHCI_TRB_ERROR_CONTEXT_STATE	0x13
+#define	XHCI_TRB_ERROR_NO_PING_RESP	0x14
+#define	XHCI_TRB_ERROR_EV_RING_FULL	0x15
+#define	XHCI_TRB_ERROR_INCOMPAT_DEV	0x16
+#define	XHCI_TRB_ERROR_MISSED_SERVICE	0x17
+#define	XHCI_TRB_ERROR_CMD_RING_STOP	0x18
+#define	XHCI_TRB_ERROR_CMD_ABORTED	0x19
+#define	XHCI_TRB_ERROR_STOPPED		0x1A
+#define	XHCI_TRB_ERROR_LENGTH		0x1B
+#define	XHCI_TRB_ERROR_BAD_MELAT	0x1D
+#define	XHCI_TRB_ERROR_ISOC_OVERRUN	0x1F
+#define	XHCI_TRB_ERROR_EVENT_LOST	0x20
+#define	XHCI_TRB_ERROR_UNDEFINED	0x21
+#define	XHCI_TRB_ERROR_INVALID_SID	0x22
+#define	XHCI_TRB_ERROR_SEC_BW		0x23
+#define	XHCI_TRB_ERROR_SPLIT_XACT	0x24
+} __aligned(4);
+
+struct xhci_dev_endpoint_trbs {
+	struct xhci_trb		trb[(XHCI_MAX_STREAMS *
+	    XHCI_MAX_TRANSFERS) + XHCI_MAX_STREAMS];
+};
+
+struct xhci_event_ring_seg {
+	volatile uint64_t	qwEvrsTablePtr;
+	volatile uint32_t	dwEvrsTableSize;
+	volatile uint32_t	dwEvrsReserved;
+};
+
+#endif /* _PCI_XHCI_H_ */
diff --git a/usr/src/cmd/bhyve/pm.c b/usr/src/cmd/bhyve/pm.c
new file mode 100644
index 0000000000..be188b79f2
--- /dev/null
+++ b/usr/src/cmd/bhyve/pm.c
@@ -0,0 +1,378 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Hudson River Trading LLC
+ * Written by: John H. Baldwin <jhb@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <machine/vmm.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <pthread.h>
+#ifndef	__FreeBSD__
+#include <stdlib.h>
+#endif
+#include <signal.h>
+#include <vmmapi.h>
+
+#include "acpi.h"
+#include "inout.h"
+#ifdef	__FreeBSD__
+#include "mevent.h"
+#endif
+#include "pci_irq.h"
+#include "pci_lpc.h"
+
+static pthread_mutex_t pm_lock = PTHREAD_MUTEX_INITIALIZER;
+#ifdef	__FreeBSD__
+static struct mevent *power_button;
+static sig_t old_power_handler;
+#else
+struct vmctx *pwr_ctx;
+#endif
+
+/*
+ * Reset Control register at I/O port 0xcf9.  Bit 2 forces a system
+ * reset when it transitions from 0 to 1.  Bit 1 selects the type of
+ * reset to attempt: 0 selects a "soft" reset, and 1 selects a "hard"
+ * reset.
+ */
+static int
+reset_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+    uint32_t *eax, void *arg)
+{
+	int error;
+
+	static uint8_t reset_control;
+
+	if (bytes != 1)
+		return (-1);
+	if (in)
+		*eax = reset_control;
+	else {
+		reset_control = *eax;
+
+		/* Treat hard and soft resets the same. */
+		if (reset_control & 0x4) {
+			error = vm_suspend(ctx, VM_SUSPEND_RESET);
+			assert(error == 0 || errno == EALREADY);
+		}
+	}
+	return (0);
+}
+INOUT_PORT(reset_reg, 0xCF9, IOPORT_F_INOUT, reset_handler);
+
+/*
+ * ACPI's SCI is a level-triggered interrupt.
+ */
+static int sci_active;
+
+static void
+sci_assert(struct vmctx *ctx)
+{
+
+	if (sci_active)
+		return;
+	vm_isa_assert_irq(ctx, SCI_INT, SCI_INT);
+	sci_active = 1;
+}
+
+static void
+sci_deassert(struct vmctx *ctx)
+{
+
+	if (!sci_active)
+		return;
+	vm_isa_deassert_irq(ctx, SCI_INT, SCI_INT);
+	sci_active = 0;
+}
+
+/*
+ * Power Management 1 Event Registers
+ *
+ * The only power management event supported is a power button upon
+ * receiving SIGTERM.
+ */
+static uint16_t pm1_enable, pm1_status;
+
+#define	PM1_TMR_STS		0x0001
+#define	PM1_BM_STS		0x0010
+#define	PM1_GBL_STS		0x0020
+#define	PM1_PWRBTN_STS		0x0100
+#define	PM1_SLPBTN_STS		0x0200
+#define	PM1_RTC_STS		0x0400
+#define	PM1_WAK_STS		0x8000
+
+#define	PM1_TMR_EN		0x0001
+#define	PM1_GBL_EN		0x0020
+#define	PM1_PWRBTN_EN		0x0100
+#define	PM1_SLPBTN_EN		0x0200
+#define	PM1_RTC_EN		0x0400
+
+static void
+sci_update(struct vmctx *ctx)
+{
+	int need_sci;
+
+	/* See if the SCI should be active or not. */
+	need_sci = 0;
+	if ((pm1_enable & PM1_TMR_EN) && (pm1_status & PM1_TMR_STS))
+		need_sci = 1;
+	if ((pm1_enable & PM1_GBL_EN) && (pm1_status & PM1_GBL_STS))
+		need_sci = 1;
+	if ((pm1_enable & PM1_PWRBTN_EN) && (pm1_status & PM1_PWRBTN_STS))
+		need_sci = 1;
+	if ((pm1_enable & PM1_SLPBTN_EN) && (pm1_status & PM1_SLPBTN_STS))
+		need_sci = 1;
+	if ((pm1_enable & PM1_RTC_EN) && (pm1_status & PM1_RTC_STS))
+		need_sci = 1;
+	if (need_sci)
+		sci_assert(ctx);
+	else
+		sci_deassert(ctx);
+}
+
+static int
+pm1_status_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+    uint32_t *eax, void *arg)
+{
+
+	if (bytes != 2)
+		return (-1);
+
+	pthread_mutex_lock(&pm_lock);
+	if (in)
+		*eax = pm1_status;
+	else {
+		/*
+		 * Writes are only permitted to clear certain bits by
+		 * writing 1 to those flags.
+		 */
+		pm1_status &= ~(*eax & (PM1_WAK_STS | PM1_RTC_STS |
+		    PM1_SLPBTN_STS | PM1_PWRBTN_STS | PM1_BM_STS));
+		sci_update(ctx);
+	}
+	pthread_mutex_unlock(&pm_lock);
+	return (0);
+}
+
+static int
+pm1_enable_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+    uint32_t *eax, void *arg)
+{
+
+	if (bytes != 2)
+		return (-1);
+
+	pthread_mutex_lock(&pm_lock);
+	if (in)
+		*eax = pm1_enable;
+	else {
+		/*
+		 * Only permit certain bits to be set.  We never use
+		 * the global lock, but ACPI-CA whines profusely if it
+		 * can't set GBL_EN.
+		 */
+		pm1_enable = *eax & (PM1_PWRBTN_EN | PM1_GBL_EN);
+		sci_update(ctx);
+	}
+	pthread_mutex_unlock(&pm_lock);
+	return (0);
+}
+INOUT_PORT(pm1_status, PM1A_EVT_ADDR, IOPORT_F_INOUT, pm1_status_handler);
+INOUT_PORT(pm1_enable, PM1A_EVT_ADDR + 2, IOPORT_F_INOUT, pm1_enable_handler);
+
+#ifdef	__FreeBSD__
+static void
+power_button_handler(int signal, enum ev_type type, void *arg)
+{
+	struct vmctx *ctx;
+
+	ctx = arg;
+	pthread_mutex_lock(&pm_lock);
+	if (!(pm1_status & PM1_PWRBTN_STS)) {
+		pm1_status |= PM1_PWRBTN_STS;
+		sci_update(ctx);
+	}
+	pthread_mutex_unlock(&pm_lock);
+}
+
+#else
+/*
+ * Initiate graceful power off.
+ */
+/*ARGSUSED*/
+static void
+power_button_handler(int signal, siginfo_t *type, void *cp)
+{
+	/*
+	 * In theory, taking the 'pm_lock' mutex from within this signal
+	 * handler could lead to deadlock if the main thread already held this
+	 * mutex. In reality, this mutex is local to this file and all of the
+	 * other usage in this file only occurs in functions which are FreeBSD
+	 * specific (and thus currently not used). Thus, for consistency with
+	 * the other code in this file, we take the mutex, but in the future,
+	 * if these other functions are ever enabled for use on non-FreeBSD
+	 * systems and these functions could be called directly by a thread
+	 * (which would then hold the mutex), then we need to revisit the use
+	 * of this mutex in this signal handler.
+	 */
+	pthread_mutex_lock(&pm_lock);
+	if (!(pm1_status & PM1_PWRBTN_STS)) {
+		pm1_status |= PM1_PWRBTN_STS;
+		sci_update(pwr_ctx);
+	}
+	pthread_mutex_unlock(&pm_lock);
+}
+#endif
+
+/*
+ * Power Management 1 Control Register
+ *
+ * This is mostly unimplemented except that we wish to handle writes that
+ * set SPL_EN to handle S5 (soft power off).
+ */
+static uint16_t pm1_control;
+
+#define	PM1_SCI_EN	0x0001
+#define	PM1_SLP_TYP	0x1c00
+#define	PM1_SLP_EN	0x2000
+#define	PM1_ALWAYS_ZERO	0xc003
+
+static int
+pm1_control_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+    uint32_t *eax, void *arg)
+{
+	int error;
+
+	if (bytes != 2)
+		return (-1);
+	if (in)
+		*eax = pm1_control;
+	else {
+		/*
+		 * Various bits are write-only or reserved, so force them
+		 * to zero in pm1_control.  Always preserve SCI_EN as OSPM
+		 * can never change it.
+		 */
+		pm1_control = (pm1_control & PM1_SCI_EN) |
+		    (*eax & ~(PM1_SLP_EN | PM1_ALWAYS_ZERO));
+
+		/*
+		 * If SLP_EN is set, check for S5.  Bhyve's _S5_ method
+		 * says that '5' should be stored in SLP_TYP for S5.
+		 */
+		if (*eax & PM1_SLP_EN) {
+			if ((pm1_control & PM1_SLP_TYP) >> 10 == 5) {
+				error = vm_suspend(ctx, VM_SUSPEND_POWEROFF);
+				assert(error == 0 || errno == EALREADY);
+			}
+		}
+	}
+	return (0);
+}
+INOUT_PORT(pm1_control, PM1A_CNT_ADDR, IOPORT_F_INOUT, pm1_control_handler);
+#ifdef	__FreeBSD__
+SYSRES_IO(PM1A_EVT_ADDR, 8);
+#endif
+
+/*
+ * ACPI SMI Command Register
+ *
+ * This write-only register is used to enable and disable ACPI.
+ */
+static int
+smi_cmd_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+    uint32_t *eax, void *arg)
+{
+
+	assert(!in);
+	if (bytes != 1)
+		return (-1);
+
+	pthread_mutex_lock(&pm_lock);
+	switch (*eax) {
+	case BHYVE_ACPI_ENABLE:
+		pm1_control |= PM1_SCI_EN;
+#ifdef	__FreeBSD__
+		if (power_button == NULL) {
+			power_button = mevent_add(SIGTERM, EVF_SIGNAL,
+			    power_button_handler, ctx);
+			old_power_handler = signal(SIGTERM, SIG_IGN);
+		}
+#endif
+		break;
+	case BHYVE_ACPI_DISABLE:
+		pm1_control &= ~PM1_SCI_EN;
+#ifdef	__FreeBSD__
+		if (power_button != NULL) {
+			mevent_delete(power_button);
+			power_button = NULL;
+			signal(SIGTERM, old_power_handler);
+		}
+#endif
+		break;
+	}
+	pthread_mutex_unlock(&pm_lock);
+	return (0);
+}
+INOUT_PORT(smi_cmd, SMI_CMD, IOPORT_F_OUT, smi_cmd_handler);
+#ifdef	__FreeBSD__
+SYSRES_IO(SMI_CMD, 1);
+#endif
+
+void
+sci_init(struct vmctx *ctx)
+{
+
+	/*
+	 * Mark ACPI's SCI as level trigger and bump its use count
+	 * in the PIRQ router.
+	 */
+	pci_irq_use(SCI_INT);
+	vm_isa_set_irq_trigger(ctx, SCI_INT, LEVEL_TRIGGER);
+
+#ifndef	__FreeBSD__
+	{
+		/*
+		 * Install SIGTERM signal handler for graceful power off.
+		 */
+		struct sigaction act;
+
+		pwr_ctx = ctx;
+		act.sa_flags = 0;
+		act.sa_sigaction = power_button_handler;
+		(void) sigaction(SIGTERM, &act, NULL);
+	}
+#endif
+}
diff --git a/usr/src/cmd/bhyve/post.c b/usr/src/cmd/bhyve/post.c
new file mode 100644
index 0000000000..d3040a8df7
--- /dev/null
+++ b/usr/src/cmd/bhyve/post.c
@@ -0,0 +1,55 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <assert.h>
+
+#include "inout.h"
+#include "pci_lpc.h"
+
+static int
+post_data_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+		  uint32_t *eax, void *arg)
+{
+	assert(in == 1);
+
+	if (bytes != 1)
+		return (-1);
+
+	*eax = 0xff;		/* return some garbage */
+	return (0);
+}
+
+INOUT_PORT(post, 0x84, IOPORT_F_IN, post_data_handler);
+SYSRES_IO(0x84, 1);
diff --git a/usr/src/cmd/bhyve/ps2kbd.c b/usr/src/cmd/bhyve/ps2kbd.c
new file mode 100644
index 0000000000..ec3bb9814c
--- /dev/null
+++ b/usr/src/cmd/bhyve/ps2kbd.c
@@ -0,0 +1,478 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2015 Nahanni Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <assert.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <pthread.h>
+#include <pthread_np.h>
+
+#include "atkbdc.h"
+#include "console.h"
+
+/* keyboard device commands */
+#define	PS2KC_RESET_DEV		0xff
+#define	PS2KC_DISABLE		0xf5
+#define	PS2KC_ENABLE		0xf4
+#define	PS2KC_SET_TYPEMATIC	0xf3
+#define	PS2KC_SEND_DEV_ID	0xf2
+#define	PS2KC_SET_SCANCODE_SET	0xf0
+#define	PS2KC_ECHO		0xee
+#define	PS2KC_SET_LEDS		0xed
+
+#define	PS2KC_BAT_SUCCESS	0xaa
+#define	PS2KC_ACK		0xfa
+
+#define	PS2KBD_FIFOSZ		16
+
+struct fifo {
+	uint8_t	buf[PS2KBD_FIFOSZ];
+	int	rindex;		/* index to read from */
+	int	windex;		/* index to write to */
+	int	num;		/* number of bytes in the fifo */
+	int	size;		/* size of the fifo */
+};
+
+struct ps2kbd_softc {
+	struct atkbdc_softc	*atkbdc_sc;
+	pthread_mutex_t		mtx;
+
+	bool			enabled;
+	struct fifo		fifo;
+
+	uint8_t			curcmd;	/* current command for next byte */
+};
+
+static void
+fifo_init(struct ps2kbd_softc *sc)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	fifo->size = sizeof(((struct fifo *)0)->buf);
+}
+
+static void
+fifo_reset(struct ps2kbd_softc *sc)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	bzero(fifo, sizeof(struct fifo));
+	fifo->size = sizeof(((struct fifo *)0)->buf);
+}
+
+static void
+fifo_put(struct ps2kbd_softc *sc, uint8_t val)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	if (fifo->num < fifo->size) {
+		fifo->buf[fifo->windex] = val;
+		fifo->windex = (fifo->windex + 1) % fifo->size;
+		fifo->num++;
+	}
+}
+
+static int
+fifo_get(struct ps2kbd_softc *sc, uint8_t *val)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	if (fifo->num > 0) {
+		*val = fifo->buf[fifo->rindex];
+		fifo->rindex = (fifo->rindex + 1) % fifo->size;
+		fifo->num--;
+		return (0);
+	}
+
+	return (-1);
+}
+
+int
+ps2kbd_read(struct ps2kbd_softc *sc, uint8_t *val)
+{
+	int retval;
+
+	pthread_mutex_lock(&sc->mtx);
+	retval = fifo_get(sc, val);
+	pthread_mutex_unlock(&sc->mtx);
+
+	return (retval);
+}
+
+void
+ps2kbd_write(struct ps2kbd_softc *sc, uint8_t val)
+{
+	pthread_mutex_lock(&sc->mtx);
+	if (sc->curcmd) {
+		switch (sc->curcmd) {
+		case PS2KC_SET_TYPEMATIC:
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		case PS2KC_SET_SCANCODE_SET:
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		case PS2KC_SET_LEDS:
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		default:
+			fprintf(stderr, "Unhandled ps2 keyboard current "
+			    "command byte 0x%02x\n", val);
+			break;
+		}
+		sc->curcmd = 0;
+	} else {
+		switch (val) {
+		case 0x00:
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		case PS2KC_RESET_DEV:
+			fifo_reset(sc);
+			fifo_put(sc, PS2KC_ACK);
+			fifo_put(sc, PS2KC_BAT_SUCCESS);
+			break;
+		case PS2KC_DISABLE:
+			sc->enabled = false;
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		case PS2KC_ENABLE:
+			sc->enabled = true;
+			fifo_reset(sc);
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		case PS2KC_SET_TYPEMATIC:
+			sc->curcmd = val;
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		case PS2KC_SEND_DEV_ID:
+			fifo_put(sc, PS2KC_ACK);
+			fifo_put(sc, 0xab);
+			fifo_put(sc, 0x83);
+			break;
+		case PS2KC_SET_SCANCODE_SET:
+			sc->curcmd = val;
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		case PS2KC_ECHO:
+			fifo_put(sc, PS2KC_ECHO);
+			break;
+		case PS2KC_SET_LEDS:
+			sc->curcmd = val;
+			fifo_put(sc, PS2KC_ACK);
+			break;
+		default:
+			fprintf(stderr, "Unhandled ps2 keyboard command "
+			    "0x%02x\n", val);
+			break;
+		}
+	}
+	pthread_mutex_unlock(&sc->mtx);
+}
+
+/*
+ * Translate keysym to type 2 scancode and insert into keyboard buffer.
+ */
+static void
+ps2kbd_keysym_queue(struct ps2kbd_softc *sc,
+    int down, uint32_t keysym)
+{
+	/* ASCII to type 2 scancode lookup table */
+	const uint8_t translation[128] = {
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x29, 0x16, 0x52, 0x26, 0x25, 0x2e, 0x3d, 0x52,
+		0x46, 0x45, 0x3e, 0x55, 0x41, 0x4e, 0x49, 0x4a,
+		0x45, 0x16, 0x1e, 0x26, 0x25, 0x2e, 0x36, 0x3d,
+		0x3e, 0x46, 0x4c, 0x4c, 0x41, 0x55, 0x49, 0x4a,
+		0x1e, 0x1c, 0x32, 0x21, 0x23, 0x24, 0x2b, 0x34,
+		0x33, 0x43, 0x3b, 0x42, 0x4b, 0x3a, 0x31, 0x44,
+		0x4d, 0x15, 0x2d, 0x1b, 0x2c, 0x3c, 0x2a, 0x1d,
+		0x22, 0x35, 0x1a, 0x54, 0x5d, 0x5b, 0x36, 0x4e,
+		0x0e, 0x1c, 0x32, 0x21, 0x23, 0x24, 0x2b, 0x34,
+		0x33, 0x43, 0x3b, 0x42, 0x4b, 0x3a, 0x31, 0x44,
+		0x4d, 0x15, 0x2d, 0x1b, 0x2c, 0x3c, 0x2a, 0x1d,
+		0x22, 0x35, 0x1a, 0x54, 0x5d, 0x5b, 0x0e, 0x00,
+	};
+
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+
+	switch (keysym) {
+	case 0x0 ... 0x7f:
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, translation[keysym]);
+		break;
+	case 0xff08:	/* Back space */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x66);
+		break;
+	case 0xff09:	/* Tab */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x0d);
+		break;
+	case 0xff0d:	/* Return  */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x5a);
+		break;
+	case 0xff1b:	/* Escape */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x76);
+		break;
+	case 0xff50:	/* Home */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x6c);
+		break;
+	case 0xff51:	/* Left arrow */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x6b);
+		break;
+	case 0xff52:	/* Up arrow */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x75);
+		break;
+	case 0xff53:	/* Right arrow */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x74);
+		break;
+	case 0xff54:	/* Down arrow */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x72);
+		break;
+	case 0xff55:	/* PgUp */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);	
+		fifo_put(sc, 0x7d);
+		break;
+	case 0xff56:	/* PgDwn */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);	
+		fifo_put(sc, 0x7a);
+		break;
+	case 0xff57:	/* End */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);	
+		fifo_put(sc, 0x69);
+		break;
+	case 0xff63:	/* Ins */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);	
+		fifo_put(sc, 0x70);
+		break;
+	case 0xff8d:	/* Keypad Enter */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x5a);
+		break;
+	case 0xffe1:	/* Left shift */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x12);
+		break;
+	case 0xffe2:	/* Right shift */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x59);
+		break;
+	case 0xffe3:	/* Left control */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x14);
+		break;
+	case 0xffe4:	/* Right control */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x14);
+		break;
+	case 0xffe7:	/* Left meta */
+		/* XXX */
+		break;
+	case 0xffe8:	/* Right meta */
+		/* XXX */
+		break;
+	case 0xffe9:	/* Left alt */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x11);
+		break;
+	case 0xfe03:	/* AltGr */
+	case 0xffea:	/* Right alt */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x11);
+		break;
+	case 0xffeb:	/* Left Windows */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x1f);
+		break;
+	case 0xffec:	/* Right Windows */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x27);
+		break;
+	case 0xffbe:    /* F1 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x05);
+		break;
+	case 0xffbf:    /* F2 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x06);
+		break;
+	case 0xffc0:    /* F3 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x04);
+		break;
+	case 0xffc1:    /* F4 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x0C);
+		break;
+	case 0xffc2:    /* F5 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x03);
+		break;
+	case 0xffc3:    /* F6 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x0B);
+		break;
+	case 0xffc4:    /* F7 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x83);
+		break;
+	case 0xffc5:    /* F8 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x0A);
+		break;
+	case 0xffc6:    /* F9 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x01);
+		break;
+	case 0xffc7:    /* F10 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x09);
+		break;
+	case 0xffc8:    /* F11 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x78);
+		break;
+	case 0xffc9:    /* F12 */
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x07);
+		break;
+	case 0xffff:    /* Del */
+		fifo_put(sc, 0xe0);
+		if (!down)
+			fifo_put(sc, 0xf0);
+		fifo_put(sc, 0x71);
+		break;
+	default:
+		fprintf(stderr, "Unhandled ps2 keyboard keysym 0x%x\n",
+		     keysym);
+		break;
+	}
+}
+
+static void
+ps2kbd_event(int down, uint32_t keysym, void *arg)
+{
+	struct ps2kbd_softc *sc = arg;
+	int fifo_full;
+
+	pthread_mutex_lock(&sc->mtx);
+	if (!sc->enabled) {
+		pthread_mutex_unlock(&sc->mtx);
+		return;
+	}
+	fifo_full = sc->fifo.num == PS2KBD_FIFOSZ;
+	ps2kbd_keysym_queue(sc, down, keysym);
+	pthread_mutex_unlock(&sc->mtx);
+
+	if (!fifo_full)
+		atkbdc_event(sc->atkbdc_sc, 1);
+}
+
+struct ps2kbd_softc *
+ps2kbd_init(struct atkbdc_softc *atkbdc_sc)
+{
+	struct ps2kbd_softc *sc;
+
+	sc = calloc(1, sizeof (struct ps2kbd_softc));
+	pthread_mutex_init(&sc->mtx, NULL);
+	fifo_init(sc);
+	sc->atkbdc_sc = atkbdc_sc;
+
+	console_kbd_register(ps2kbd_event, sc, 1);
+
+	return (sc);
+}
+
diff --git a/usr/src/cmd/bhyve/ps2kbd.h b/usr/src/cmd/bhyve/ps2kbd.h
new file mode 100644
index 0000000000..34c31b1ea8
--- /dev/null
+++ b/usr/src/cmd/bhyve/ps2kbd.h
@@ -0,0 +1,39 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _PS2KBD_H_
+#define	_PS2KBD_H_
+
+struct atkbdc_softc;
+
+struct ps2kbd_softc *ps2kbd_init(struct atkbdc_softc *sc);
+
+int ps2kbd_read(struct ps2kbd_softc *sc, uint8_t *val);
+void ps2kbd_write(struct ps2kbd_softc *sc, uint8_t val);
+
+#endif /* _PS2KBD_H_ */
diff --git a/usr/src/cmd/bhyve/ps2mouse.c b/usr/src/cmd/bhyve/ps2mouse.c
new file mode 100644
index 0000000000..cea7210e2a
--- /dev/null
+++ b/usr/src/cmd/bhyve/ps2mouse.c
@@ -0,0 +1,416 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2015 Nahanni Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <assert.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <pthread.h>
+#include <pthread_np.h>
+
+#include "atkbdc.h"
+#include "console.h"
+
+/* mouse device commands */
+#define	PS2MC_RESET_DEV		0xff
+#define	PS2MC_SET_DEFAULTS	0xf6
+#define	PS2MC_DISABLE		0xf5
+#define	PS2MC_ENABLE		0xf4
+#define	PS2MC_SET_SAMPLING_RATE	0xf3
+#define	PS2MC_SEND_DEV_ID	0xf2
+#define	PS2MC_SET_REMOTE_MODE	0xf0
+#define	PS2MC_SEND_DEV_DATA	0xeb
+#define	PS2MC_SET_STREAM_MODE	0xea
+#define	PS2MC_SEND_DEV_STATUS	0xe9
+#define	PS2MC_SET_RESOLUTION	0xe8
+#define	PS2MC_SET_SCALING1	0xe7
+#define	PS2MC_SET_SCALING2	0xe6
+
+#define	PS2MC_BAT_SUCCESS	0xaa
+#define	PS2MC_ACK		0xfa
+
+/* mouse device id */
+#define	PS2MOUSE_DEV_ID		0x0
+
+/* mouse data bits */
+#define	PS2M_DATA_Y_OFLOW	0x80
+#define	PS2M_DATA_X_OFLOW	0x40
+#define	PS2M_DATA_Y_SIGN	0x20
+#define	PS2M_DATA_X_SIGN	0x10
+#define	PS2M_DATA_AONE		0x08
+#define	PS2M_DATA_MID_BUTTON	0x04
+#define	PS2M_DATA_RIGHT_BUTTON	0x02
+#define	PS2M_DATA_LEFT_BUTTON	0x01
+
+/* mouse status bits */
+#define	PS2M_STS_REMOTE_MODE	0x40
+#define	PS2M_STS_ENABLE_DEV	0x20
+#define	PS2M_STS_SCALING_21	0x10
+#define	PS2M_STS_MID_BUTTON	0x04
+#define	PS2M_STS_RIGHT_BUTTON	0x02
+#define	PS2M_STS_LEFT_BUTTON	0x01
+
+#define	PS2MOUSE_FIFOSZ		16
+
+struct fifo {
+	uint8_t	buf[PS2MOUSE_FIFOSZ];
+	int	rindex;		/* index to read from */
+	int	windex;		/* index to write to */
+	int	num;		/* number of bytes in the fifo */
+	int	size;		/* size of the fifo */
+};
+
+struct ps2mouse_softc {
+	struct atkbdc_softc	*atkbdc_sc;
+	pthread_mutex_t		mtx;
+
+	uint8_t		status;
+	uint8_t		resolution;
+	uint8_t		sampling_rate;
+	int		ctrlenable;
+	struct fifo	fifo;
+
+	uint8_t		curcmd;	/* current command for next byte */
+
+	int		cur_x, cur_y;
+	int		delta_x, delta_y;
+};
+
+static void
+fifo_init(struct ps2mouse_softc *sc)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	fifo->size = sizeof(((struct fifo *)0)->buf);
+}
+
+static void
+fifo_reset(struct ps2mouse_softc *sc)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	bzero(fifo, sizeof(struct fifo));
+	fifo->size = sizeof(((struct fifo *)0)->buf);
+}
+
+static void
+fifo_put(struct ps2mouse_softc *sc, uint8_t val)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	if (fifo->num < fifo->size) {
+		fifo->buf[fifo->windex] = val;
+		fifo->windex = (fifo->windex + 1) % fifo->size;
+		fifo->num++;
+	}
+}
+
+static int
+fifo_get(struct ps2mouse_softc *sc, uint8_t *val)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->fifo;
+	if (fifo->num > 0) {
+		*val = fifo->buf[fifo->rindex];
+		fifo->rindex = (fifo->rindex + 1) % fifo->size;
+		fifo->num--;
+		return (0);
+	}
+
+	return (-1);
+}
+
+static void
+movement_reset(struct ps2mouse_softc *sc)
+{
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+
+	sc->delta_x = 0;
+	sc->delta_y = 0;
+}
+
+static void
+movement_update(struct ps2mouse_softc *sc, int x, int y)
+{
+	sc->delta_x += x - sc->cur_x;
+	sc->delta_y += sc->cur_y - y;
+	sc->cur_x = x;
+	sc->cur_y = y;
+}
+
+static void
+movement_get(struct ps2mouse_softc *sc)
+{
+	uint8_t val0, val1, val2;
+
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+
+	val0 = PS2M_DATA_AONE;
+	val0 |= sc->status & (PS2M_DATA_LEFT_BUTTON |
+	    PS2M_DATA_RIGHT_BUTTON | PS2M_DATA_MID_BUTTON);
+
+	if (sc->delta_x >= 0) {
+		if (sc->delta_x > 255) {
+			val0 |= PS2M_DATA_X_OFLOW;
+			val1 = 255;
+		} else
+			val1 = sc->delta_x;
+	} else {
+		val0 |= PS2M_DATA_X_SIGN;
+		if (sc->delta_x < -255) {
+			val0 |= PS2M_DATA_X_OFLOW;
+			val1 = 255;
+		} else
+			val1 = sc->delta_x;
+	}
+	sc->delta_x = 0;
+
+	if (sc->delta_y >= 0) {
+		if (sc->delta_y > 255) {
+			val0 |= PS2M_DATA_Y_OFLOW;
+			val2 = 255;
+		} else
+			val2 = sc->delta_y;
+	} else {
+		val0 |= PS2M_DATA_Y_SIGN;
+		if (sc->delta_y < -255) {
+			val0 |= PS2M_DATA_Y_OFLOW;
+			val2 = 255;
+		} else
+			val2 = sc->delta_y;
+	}
+	sc->delta_y = 0;
+
+	if (sc->fifo.num < (sc->fifo.size - 3)) {
+		fifo_put(sc, val0);
+		fifo_put(sc, val1);
+		fifo_put(sc, val2);
+	}
+}
+
+static void
+ps2mouse_reset(struct ps2mouse_softc *sc)
+{
+	assert(pthread_mutex_isowned_np(&sc->mtx));
+	fifo_reset(sc);
+	movement_reset(sc);
+	sc->status = PS2M_STS_ENABLE_DEV;
+	sc->resolution = 4;
+	sc->sampling_rate = 100;
+
+	sc->cur_x = 0;
+	sc->cur_y = 0;
+	sc->delta_x = 0;
+	sc->delta_y = 0;
+}
+
+int
+ps2mouse_read(struct ps2mouse_softc *sc, uint8_t *val)
+{
+	int retval;
+
+	pthread_mutex_lock(&sc->mtx);
+	retval = fifo_get(sc, val);
+	pthread_mutex_unlock(&sc->mtx);
+
+	return (retval);
+}
+
+int
+ps2mouse_fifocnt(struct ps2mouse_softc *sc)
+{
+	return (sc->fifo.num);
+}
+
+void
+ps2mouse_toggle(struct ps2mouse_softc *sc, int enable)
+{
+	pthread_mutex_lock(&sc->mtx);
+	if (enable)
+		sc->ctrlenable = 1;
+	else {
+		sc->ctrlenable = 0;
+		sc->fifo.rindex = 0;
+		sc->fifo.windex = 0;
+		sc->fifo.num = 0;
+	}
+	pthread_mutex_unlock(&sc->mtx);
+}
+
+void
+ps2mouse_write(struct ps2mouse_softc *sc, uint8_t val, int insert)
+{
+	pthread_mutex_lock(&sc->mtx);
+	fifo_reset(sc);
+	if (sc->curcmd) {
+		switch (sc->curcmd) {
+		case PS2MC_SET_SAMPLING_RATE:
+			sc->sampling_rate = val;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_SET_RESOLUTION:
+			sc->resolution = val;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		default:
+			fprintf(stderr, "Unhandled ps2 mouse current "
+			    "command byte 0x%02x\n", val);
+			break;
+		}
+		sc->curcmd = 0;
+
+	} else if (insert) {
+		fifo_put(sc, val);
+	} else {
+		switch (val) {
+		case 0x00:
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_RESET_DEV:
+			ps2mouse_reset(sc);
+			fifo_put(sc, PS2MC_ACK);
+			fifo_put(sc, PS2MC_BAT_SUCCESS);
+			fifo_put(sc, PS2MOUSE_DEV_ID);
+			break;
+		case PS2MC_SET_DEFAULTS:
+			ps2mouse_reset(sc);
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_DISABLE:
+			fifo_reset(sc);
+			sc->status &= ~PS2M_STS_ENABLE_DEV;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_ENABLE:
+			fifo_reset(sc);
+			sc->status |= PS2M_STS_ENABLE_DEV;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_SET_SAMPLING_RATE:
+			sc->curcmd = val;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_SEND_DEV_ID:
+			fifo_put(sc, PS2MC_ACK);
+			fifo_put(sc, PS2MOUSE_DEV_ID);
+			break;
+		case PS2MC_SET_REMOTE_MODE:
+			sc->status |= PS2M_STS_REMOTE_MODE;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_SEND_DEV_DATA:
+			fifo_put(sc, PS2MC_ACK);
+			movement_get(sc);
+			break;
+		case PS2MC_SET_STREAM_MODE:
+			sc->status &= ~PS2M_STS_REMOTE_MODE;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_SEND_DEV_STATUS:
+			fifo_put(sc, PS2MC_ACK);
+			fifo_put(sc, sc->status);
+			fifo_put(sc, sc->resolution);
+			fifo_put(sc, sc->sampling_rate);
+			break;
+		case PS2MC_SET_RESOLUTION:
+			sc->curcmd = val;
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		case PS2MC_SET_SCALING1:
+		case PS2MC_SET_SCALING2:
+			fifo_put(sc, PS2MC_ACK);
+			break;
+		default:
+			fifo_put(sc, PS2MC_ACK);
+			fprintf(stderr, "Unhandled ps2 mouse command "
+			    "0x%02x\n", val);
+			break;
+		}
+	}
+	pthread_mutex_unlock(&sc->mtx);
+}
+
+static void
+ps2mouse_event(uint8_t button, int x, int y, void *arg)
+{
+	struct ps2mouse_softc *sc = arg;
+
+	pthread_mutex_lock(&sc->mtx);
+	movement_update(sc, x, y);
+
+	sc->status &= ~(PS2M_STS_LEFT_BUTTON |
+	    PS2M_STS_RIGHT_BUTTON | PS2M_STS_MID_BUTTON);
+	if (button & (1 << 0))
+		sc->status |= PS2M_STS_LEFT_BUTTON;
+	if (button & (1 << 1))
+		sc->status |= PS2M_STS_MID_BUTTON;
+	if (button & (1 << 2))
+		sc->status |= PS2M_STS_RIGHT_BUTTON;
+
+	if ((sc->status & PS2M_STS_ENABLE_DEV) == 0 || !sc->ctrlenable) {
+		/* no data reporting */
+		pthread_mutex_unlock(&sc->mtx);
+		return;
+	}
+
+	movement_get(sc);
+	pthread_mutex_unlock(&sc->mtx);
+
+	if (sc->fifo.num > 0)
+		atkbdc_event(sc->atkbdc_sc, 0);
+}
+
+struct ps2mouse_softc *
+ps2mouse_init(struct atkbdc_softc *atkbdc_sc)
+{
+	struct ps2mouse_softc *sc;
+
+	sc = calloc(1, sizeof (struct ps2mouse_softc));
+	pthread_mutex_init(&sc->mtx, NULL);
+	fifo_init(sc);
+	sc->atkbdc_sc = atkbdc_sc;
+
+	pthread_mutex_lock(&sc->mtx);
+	ps2mouse_reset(sc);
+	pthread_mutex_unlock(&sc->mtx);
+
+	console_ptr_register(ps2mouse_event, sc, 1);
+
+	return (sc);
+}
+
+
diff --git a/usr/src/cmd/bhyve/ps2mouse.h b/usr/src/cmd/bhyve/ps2mouse.h
new file mode 100644
index 0000000000..10d5698a30
--- /dev/null
+++ b/usr/src/cmd/bhyve/ps2mouse.h
@@ -0,0 +1,41 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _PS2MOUSE_H_
+#define	_PS2MOUSE_H_
+
+struct atkbdc_softc;
+
+struct ps2mouse_softc *ps2mouse_init(struct atkbdc_softc *sc);
+
+int ps2mouse_read(struct ps2mouse_softc *sc, uint8_t *val);
+void ps2mouse_write(struct ps2mouse_softc *sc, uint8_t val, int insert);
+void ps2mouse_toggle(struct ps2mouse_softc *sc, int enable);
+int ps2mouse_fifocnt(struct ps2mouse_softc *sc);
+
+#endif /* _PS2MOUSE_H_ */
diff --git a/usr/src/cmd/bhyve/rfb.c b/usr/src/cmd/bhyve/rfb.c
new file mode 100644
index 0000000000..d96b45c5da
--- /dev/null
+++ b/usr/src/cmd/bhyve/rfb.c
@@ -0,0 +1,1133 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2015 Leon Dang
+ * Copyright 2018 Joyent, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#endif
+#include <sys/endian.h>
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <sys/time.h>
+#include <arpa/inet.h>
+#include <machine/cpufunc.h>
+#include <machine/specialreg.h>
+#include <netinet/in.h>
+
+#include <assert.h>
+#include <err.h>
+#include <errno.h>
+#include <pthread.h>
+#include <pthread_np.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include <zlib.h>
+
+#ifndef __FreeBSD__
+#include <sys/debug.h>
+#endif
+
+#include "bhyvegc.h"
+#include "console.h"
+#include "rfb.h"
+#include "sockstream.h"
+
+#ifndef NO_OPENSSL
+#include <openssl/des.h>
+#endif
+
+static int rfb_debug = 0;
+#define	DPRINTF(params) if (rfb_debug) printf params
+#define	WPRINTF(params) printf params
+
+#define AUTH_LENGTH	16
+#define PASSWD_LENGTH	8
+
+#define SECURITY_TYPE_NONE 1
+#define SECURITY_TYPE_VNC_AUTH 2
+
+#define AUTH_FAILED_UNAUTH 1
+#define AUTH_FAILED_ERROR 2
+
+struct rfb_softc {
+	int		sfd;
+	pthread_t	tid;
+
+	int		cfd;
+
+	int		width, height;
+
+	char		*password;
+
+	bool	enc_raw_ok;
+	bool	enc_zlib_ok;
+	bool	enc_resize_ok;
+
+	z_stream	zstream;
+	uint8_t		*zbuf;
+	int		zbuflen;
+
+	int		conn_wait;
+	int		sending;
+	pthread_mutex_t mtx;
+	pthread_cond_t  cond;
+
+	int		hw_crc;
+	uint32_t	*crc;		/* WxH crc cells */
+	uint32_t	*crc_tmp;	/* buffer to store single crc row */
+	int		crc_width, crc_height;
+};
+
+struct rfb_pixfmt {
+	uint8_t		bpp;
+	uint8_t		depth;
+	uint8_t		bigendian;
+	uint8_t		truecolor;
+	uint16_t	red_max;
+	uint16_t	green_max;
+	uint16_t	blue_max;
+	uint8_t		red_shift;
+	uint8_t		green_shift;
+	uint8_t		blue_shift;
+	uint8_t		pad[3];
+};
+
+struct rfb_srvr_info {
+	uint16_t		width;
+	uint16_t		height;
+	struct rfb_pixfmt	pixfmt;
+	uint32_t		namelen;
+};
+
+struct rfb_pixfmt_msg {
+	uint8_t			type;
+	uint8_t			pad[3];
+	struct rfb_pixfmt	pixfmt;
+};
+
+#define	RFB_ENCODING_RAW		0
+#define	RFB_ENCODING_ZLIB		6
+#define	RFB_ENCODING_RESIZE		-223
+
+#define RFB_MAX_WIDTH			2000
+#define RFB_MAX_HEIGHT			1200
+#define	RFB_ZLIB_BUFSZ			RFB_MAX_WIDTH*RFB_MAX_HEIGHT*4
+
+/* percentage changes to screen before sending the entire screen */
+#define RFB_SEND_ALL_THRESH             25
+
+struct rfb_enc_msg {
+	uint8_t		type;
+	uint8_t		pad;
+	uint16_t	numencs;
+};
+
+struct rfb_updt_msg {
+	uint8_t		type;
+	uint8_t		incremental;
+	uint16_t	x;
+	uint16_t	y;
+	uint16_t	width;
+	uint16_t	height;
+};
+
+struct rfb_key_msg {
+	uint8_t		type;
+	uint8_t		down;
+	uint16_t	pad;
+	uint32_t	code;
+};
+
+struct rfb_ptr_msg {
+	uint8_t		type;
+	uint8_t		button;
+	uint16_t	x;
+	uint16_t	y;
+};
+
+struct rfb_srvr_updt_msg {
+	uint8_t		type;
+	uint8_t		pad;
+	uint16_t	numrects;
+};
+
+struct rfb_srvr_rect_hdr {
+	uint16_t	x;
+	uint16_t	y;
+	uint16_t	width;
+	uint16_t	height;
+	uint32_t	encoding;
+};
+
+struct rfb_cuttext_msg {
+	uint8_t		type;
+	uint8_t		padding[3];
+	uint32_t	length;
+};
+
+
+static void
+rfb_send_server_init_msg(int cfd)
+{
+	struct bhyvegc_image *gc_image;
+	struct rfb_srvr_info sinfo;
+
+	gc_image = console_get_image();
+
+	sinfo.width = htons(gc_image->width);
+	sinfo.height = htons(gc_image->height);
+	sinfo.pixfmt.bpp = 32;
+	sinfo.pixfmt.depth = 32;
+	sinfo.pixfmt.bigendian = 0;
+	sinfo.pixfmt.truecolor = 1;
+	sinfo.pixfmt.red_max = htons(255);
+	sinfo.pixfmt.green_max = htons(255);
+	sinfo.pixfmt.blue_max = htons(255);
+	sinfo.pixfmt.red_shift = 16;
+	sinfo.pixfmt.green_shift = 8;
+	sinfo.pixfmt.blue_shift = 0;
+	sinfo.namelen = htonl(strlen("bhyve"));
+	(void)stream_write(cfd, &sinfo, sizeof(sinfo));
+	(void)stream_write(cfd, "bhyve", strlen("bhyve"));
+}
+
+static void
+rfb_send_resize_update_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_srvr_updt_msg supdt_msg;
+	struct rfb_srvr_rect_hdr srect_hdr;
+
+	/* Number of rectangles: 1 */
+	supdt_msg.type = 0;
+	supdt_msg.pad = 0;
+	supdt_msg.numrects = htons(1);
+	stream_write(cfd, &supdt_msg, sizeof(struct rfb_srvr_updt_msg));
+
+	/* Rectangle header */
+	srect_hdr.x = htons(0);
+	srect_hdr.y = htons(0);
+	srect_hdr.width = htons(rc->width);
+	srect_hdr.height = htons(rc->height);
+	srect_hdr.encoding = htonl(RFB_ENCODING_RESIZE);
+	stream_write(cfd, &srect_hdr, sizeof(struct rfb_srvr_rect_hdr));
+}
+
+static void
+rfb_recv_set_pixfmt_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_pixfmt_msg pixfmt_msg;
+
+	(void)stream_read(cfd, ((void *)&pixfmt_msg)+1, sizeof(pixfmt_msg)-1);
+}
+
+
+static void
+rfb_recv_set_encodings_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_enc_msg enc_msg;
+	int i;
+	uint32_t encoding;
+
+	assert((sizeof(enc_msg) - 1) == 3);
+	(void)stream_read(cfd, ((void *)&enc_msg)+1, sizeof(enc_msg)-1);
+
+	for (i = 0; i < htons(enc_msg.numencs); i++) {
+		(void)stream_read(cfd, &encoding, sizeof(encoding));
+		switch (htonl(encoding)) {
+		case RFB_ENCODING_RAW:
+			rc->enc_raw_ok = true;
+			break;
+		case RFB_ENCODING_ZLIB:
+			rc->enc_zlib_ok = true;
+			deflateInit(&rc->zstream, Z_BEST_SPEED);
+			break;
+		case RFB_ENCODING_RESIZE:
+			rc->enc_resize_ok = true;
+			break;
+		}
+	}
+}
+
+/*
+ * Calculate CRC32 using SSE4.2; Intel or AMD Bulldozer+ CPUs only
+ */
+static __inline uint32_t
+fast_crc32(void *buf, int len, uint32_t crcval)
+{
+	uint32_t q = len / sizeof(uint32_t);
+	uint32_t *p = (uint32_t *)buf;
+
+	while (q--) {
+		asm volatile (
+			".byte 0xf2, 0xf, 0x38, 0xf1, 0xf1;"
+			:"=S" (crcval)
+			:"0" (crcval), "c" (*p)
+		);
+		p++;
+	}
+
+	return (crcval);
+}
+
+
+static int
+rfb_send_rect(struct rfb_softc *rc, int cfd, struct bhyvegc_image *gc,
+              int x, int y, int w, int h)
+{
+	struct rfb_srvr_updt_msg supdt_msg;
+        struct rfb_srvr_rect_hdr srect_hdr;
+	unsigned long zlen;
+	ssize_t nwrite, total;
+	int err;
+	uint32_t *p;
+	uint8_t *zbufp;
+
+	/*
+	 * Send a single rectangle of the given x, y, w h dimensions.
+	 */
+
+	/* Number of rectangles: 1 */
+	supdt_msg.type = 0;
+	supdt_msg.pad = 0;
+	supdt_msg.numrects = htons(1);
+	nwrite = stream_write(cfd, &supdt_msg,
+	                      sizeof(struct rfb_srvr_updt_msg));
+	if (nwrite <= 0)
+		return (nwrite);
+
+
+	/* Rectangle header */
+	srect_hdr.x = htons(x);
+	srect_hdr.y = htons(y);
+	srect_hdr.width = htons(w);
+	srect_hdr.height = htons(h);
+
+	h = y + h;
+	w *= sizeof(uint32_t);
+	if (rc->enc_zlib_ok) {
+		zbufp = rc->zbuf;
+		rc->zstream.total_in = 0;
+		rc->zstream.total_out = 0;
+		for (p = &gc->data[y * gc->width + x]; y < h; y++) {
+			rc->zstream.next_in = (Bytef *)p;
+			rc->zstream.avail_in = w;
+			rc->zstream.next_out = (Bytef *)zbufp;
+			rc->zstream.avail_out = RFB_ZLIB_BUFSZ + 16 -
+			                        rc->zstream.total_out;
+			rc->zstream.data_type = Z_BINARY;
+
+			/* Compress with zlib */
+			err = deflate(&rc->zstream, Z_SYNC_FLUSH);
+			if (err != Z_OK) {
+				WPRINTF(("zlib[rect] deflate err: %d\n", err));
+				rc->enc_zlib_ok = false;
+				deflateEnd(&rc->zstream);
+				goto doraw;
+			}
+			zbufp = rc->zbuf + rc->zstream.total_out;
+			p += gc->width;
+		}
+		srect_hdr.encoding = htonl(RFB_ENCODING_ZLIB);
+		nwrite = stream_write(cfd, &srect_hdr,
+		                      sizeof(struct rfb_srvr_rect_hdr));
+		if (nwrite <= 0)
+			return (nwrite);
+
+		zlen = htonl(rc->zstream.total_out);
+		nwrite = stream_write(cfd, &zlen, sizeof(uint32_t));
+		if (nwrite <= 0)
+			return (nwrite);
+		return (stream_write(cfd, rc->zbuf, rc->zstream.total_out));
+	}
+
+doraw:
+
+	total = 0;
+	zbufp = rc->zbuf;
+	for (p = &gc->data[y * gc->width + x]; y < h; y++) {
+		memcpy(zbufp, p, w);
+		zbufp += w;
+		total += w;
+		p += gc->width;
+	}
+
+	srect_hdr.encoding = htonl(RFB_ENCODING_RAW);
+	nwrite = stream_write(cfd, &srect_hdr,
+	                      sizeof(struct rfb_srvr_rect_hdr));
+	if (nwrite <= 0)
+		return (nwrite);
+
+	total = stream_write(cfd, rc->zbuf, total);
+
+	return (total);
+}
+
+static int
+rfb_send_all(struct rfb_softc *rc, int cfd, struct bhyvegc_image *gc)
+{
+	struct rfb_srvr_updt_msg supdt_msg;
+        struct rfb_srvr_rect_hdr srect_hdr;
+	ssize_t nwrite;
+	unsigned long zlen;
+	int err;
+
+	/*
+	 * Send the whole thing
+	 */
+
+	/* Number of rectangles: 1 */
+	supdt_msg.type = 0;
+	supdt_msg.pad = 0;
+	supdt_msg.numrects = htons(1);
+	nwrite = stream_write(cfd, &supdt_msg,
+	                      sizeof(struct rfb_srvr_updt_msg));
+	if (nwrite <= 0)
+		return (nwrite);
+
+	/* Rectangle header */
+	srect_hdr.x = 0;
+	srect_hdr.y = 0;
+	srect_hdr.width = htons(gc->width);
+	srect_hdr.height = htons(gc->height);
+	if (rc->enc_zlib_ok) {
+		rc->zstream.next_in = (Bytef *)gc->data;
+		rc->zstream.avail_in = gc->width * gc->height *
+		                   sizeof(uint32_t);
+		rc->zstream.next_out = (Bytef *)rc->zbuf;
+		rc->zstream.avail_out = RFB_ZLIB_BUFSZ + 16;
+		rc->zstream.data_type = Z_BINARY;
+
+		rc->zstream.total_in = 0;
+		rc->zstream.total_out = 0;
+
+		/* Compress with zlib */
+		err = deflate(&rc->zstream, Z_SYNC_FLUSH);
+		if (err != Z_OK) {
+			WPRINTF(("zlib deflate err: %d\n", err));
+			rc->enc_zlib_ok = false;
+			deflateEnd(&rc->zstream);
+			goto doraw;
+		}
+
+		srect_hdr.encoding = htonl(RFB_ENCODING_ZLIB);
+		nwrite = stream_write(cfd, &srect_hdr,
+		                      sizeof(struct rfb_srvr_rect_hdr));
+		if (nwrite <= 0)
+			return (nwrite);
+
+		zlen = htonl(rc->zstream.total_out);
+		nwrite = stream_write(cfd, &zlen, sizeof(uint32_t));
+		if (nwrite <= 0)
+			return (nwrite);
+		return (stream_write(cfd, rc->zbuf, rc->zstream.total_out));
+	}
+
+doraw:
+	srect_hdr.encoding = htonl(RFB_ENCODING_RAW);
+	nwrite = stream_write(cfd, &srect_hdr,
+	                      sizeof(struct rfb_srvr_rect_hdr));
+	if (nwrite <= 0)
+		return (nwrite);
+
+	nwrite = stream_write(cfd, gc->data,
+	               gc->width * gc->height * sizeof(uint32_t));
+
+	return (nwrite);
+}
+
+#define PIX_PER_CELL	32
+#define	PIXCELL_SHIFT	5
+#define PIXCELL_MASK	0x1F
+
+static int
+rfb_send_screen(struct rfb_softc *rc, int cfd, int all)
+{
+	struct bhyvegc_image *gc_image;
+	ssize_t nwrite;
+	int x, y;
+	int celly, cellwidth;
+	int xcells, ycells;
+	int w, h;
+	uint32_t *p;
+	int rem_x, rem_y;   /* remainder for resolutions not x32 pixels ratio */
+	int retval;
+	uint32_t *crc_p, *orig_crc;
+	int changes;
+
+	console_refresh();
+	gc_image = console_get_image();
+
+	pthread_mutex_lock(&rc->mtx);
+	if (rc->sending) {
+		pthread_mutex_unlock(&rc->mtx);
+		return (1);
+	}
+	rc->sending = 1;
+	pthread_mutex_unlock(&rc->mtx);
+
+	retval = 0;
+
+	if (all) {
+		retval = rfb_send_all(rc, cfd, gc_image);
+		goto done;
+	}
+
+	/*
+	 * Calculate the checksum for each 32x32 cell. Send each that
+	 * has changed since the last scan.
+	 */
+
+	/* Resolution changed */
+
+	rc->crc_width = gc_image->width;
+	rc->crc_height = gc_image->height;
+
+	w = rc->crc_width;
+	h = rc->crc_height;
+	xcells = howmany(rc->crc_width, PIX_PER_CELL);
+	ycells = howmany(rc->crc_height, PIX_PER_CELL);
+
+	rem_x = w & PIXCELL_MASK;
+
+	rem_y = h & PIXCELL_MASK;
+	if (!rem_y)
+		rem_y = PIX_PER_CELL;
+
+	p = gc_image->data;
+
+	/*
+	 * Go through all cells and calculate crc. If significant number
+	 * of changes, then send entire screen.
+	 * crc_tmp is dual purpose: to store the new crc and to flag as
+	 * a cell that has changed.
+	 */
+	crc_p = rc->crc_tmp - xcells;
+	orig_crc = rc->crc - xcells;
+	changes = 0;
+	memset(rc->crc_tmp, 0, sizeof(uint32_t) * xcells * ycells);
+	for (y = 0; y < h; y++) {
+		if ((y & PIXCELL_MASK) == 0) {
+			crc_p += xcells;
+			orig_crc += xcells;
+		}
+
+		for (x = 0; x < xcells; x++) {
+			if (x == (xcells - 1) && rem_x > 0)
+				cellwidth = rem_x;
+			else
+				cellwidth = PIX_PER_CELL;
+
+			if (rc->hw_crc)
+				crc_p[x] = fast_crc32(p,
+				             cellwidth * sizeof(uint32_t),
+				             crc_p[x]);
+			else
+				crc_p[x] = (uint32_t)crc32(crc_p[x],
+				             (Bytef *)p,
+				             cellwidth * sizeof(uint32_t));
+
+			p += cellwidth;
+
+			/* check for crc delta if last row in cell */
+			if ((y & PIXCELL_MASK) == PIXCELL_MASK || y == (h-1)) {
+				if (orig_crc[x] != crc_p[x]) {
+					orig_crc[x] = crc_p[x];
+					crc_p[x] = 1;
+					changes++;
+				} else {
+					crc_p[x] = 0;
+				}
+			}
+		}
+	}
+
+	/* If number of changes is > THRESH percent, send the whole screen */
+	if (((changes * 100) / (xcells * ycells)) >= RFB_SEND_ALL_THRESH) {
+		retval = rfb_send_all(rc, cfd, gc_image);
+		goto done;
+	}
+	
+	/* Go through all cells, and send only changed ones */
+	crc_p = rc->crc_tmp;
+	for (y = 0; y < h; y += PIX_PER_CELL) {
+		/* previous cell's row */
+		celly = (y >> PIXCELL_SHIFT);
+
+		/* Delta check crc to previous set */
+		for (x = 0; x < xcells; x++) {
+			if (*crc_p++ == 0)
+				continue;
+
+			if (x == (xcells - 1) && rem_x > 0)
+				cellwidth = rem_x;
+			else
+				cellwidth = PIX_PER_CELL;
+			nwrite = rfb_send_rect(rc, cfd,
+				gc_image,
+				x * PIX_PER_CELL,
+				celly * PIX_PER_CELL,
+			        cellwidth,
+				y + PIX_PER_CELL >= h ? rem_y : PIX_PER_CELL);
+			if (nwrite <= 0) {
+				retval = nwrite;
+				goto done;
+			}
+		}
+	}
+	retval = 1;
+
+done:
+	pthread_mutex_lock(&rc->mtx);
+	rc->sending = 0;
+	pthread_mutex_unlock(&rc->mtx);
+	
+	return (retval);
+}
+
+
+static void
+rfb_recv_update_msg(struct rfb_softc *rc, int cfd, int discardonly)
+{
+	struct rfb_updt_msg updt_msg;
+	struct bhyvegc_image *gc_image;
+
+	(void)stream_read(cfd, ((void *)&updt_msg) + 1 , sizeof(updt_msg) - 1);
+
+	console_refresh();
+	gc_image = console_get_image();
+
+	updt_msg.x = htons(updt_msg.x);
+	updt_msg.y = htons(updt_msg.y);
+	updt_msg.width = htons(updt_msg.width);
+	updt_msg.height = htons(updt_msg.height);
+
+	if (updt_msg.width != gc_image->width ||
+	    updt_msg.height != gc_image->height) {
+		rc->width = gc_image->width;
+		rc->height = gc_image->height;
+		if (rc->enc_resize_ok)
+			rfb_send_resize_update_msg(rc, cfd);
+	}
+
+	if (discardonly)
+		return;
+
+	rfb_send_screen(rc, cfd, 1);
+}
+
+static void
+rfb_recv_key_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_key_msg key_msg;
+
+	(void)stream_read(cfd, ((void *)&key_msg) + 1, sizeof(key_msg) - 1);
+
+	console_key_event(key_msg.down, htonl(key_msg.code));
+}
+
+static void
+rfb_recv_ptr_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_ptr_msg ptr_msg;
+
+	(void)stream_read(cfd, ((void *)&ptr_msg) + 1, sizeof(ptr_msg) - 1);
+
+	console_ptr_event(ptr_msg.button, htons(ptr_msg.x), htons(ptr_msg.y));
+}
+
+static void
+rfb_recv_cuttext_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_cuttext_msg ct_msg;
+	unsigned char buf[32];
+	int len;
+
+	len = stream_read(cfd, ((void *)&ct_msg) + 1, sizeof(ct_msg) - 1);
+	ct_msg.length = htonl(ct_msg.length);
+	while (ct_msg.length > 0) {
+		len = stream_read(cfd, buf, ct_msg.length > sizeof(buf) ?
+			sizeof(buf) : ct_msg.length);
+		ct_msg.length -= len;
+	}
+}
+
+static int64_t
+timeval_delta(struct timeval *prev, struct timeval *now)
+{
+	int64_t n1, n2;
+	n1 = now->tv_sec * 1000000 + now->tv_usec;
+	n2 = prev->tv_sec * 1000000 + prev->tv_usec;
+	return (n1 - n2);
+}
+
+static void *
+rfb_wr_thr(void *arg)
+{
+	struct rfb_softc *rc;
+	fd_set rfds;
+	struct timeval tv;
+	struct timeval prev_tv;
+	int64_t tdiff;
+	int cfd;
+	int err;
+
+	rc = arg;
+	cfd = rc->cfd;
+
+	prev_tv.tv_sec = 0;
+	prev_tv.tv_usec = 0;
+	while (rc->cfd >= 0) {
+		FD_ZERO(&rfds);
+		FD_SET(cfd, &rfds);
+		tv.tv_sec = 0;
+		tv.tv_usec = 10000;
+
+		err = select(cfd+1, &rfds, NULL, NULL, &tv);
+                if (err < 0)
+			return (NULL);
+
+		/* Determine if its time to push screen; ~24hz */
+		gettimeofday(&tv, NULL);
+		tdiff = timeval_delta(&prev_tv, &tv);
+		if (tdiff > 40000) {
+			prev_tv.tv_sec = tv.tv_sec;
+			prev_tv.tv_usec = tv.tv_usec;
+			if (rfb_send_screen(rc, cfd, 0) <= 0) {
+				return (NULL);
+			}
+		} else {
+			/* sleep */
+			usleep(40000 - tdiff);
+		}
+	}
+
+	return (NULL);
+}
+
+void
+rfb_handle(struct rfb_softc *rc, int cfd)
+{
+	const char *vbuf = "RFB 003.008\n";
+	unsigned char buf[80];
+	unsigned char *message = NULL;
+
+#ifndef NO_OPENSSL
+	unsigned char challenge[AUTH_LENGTH];
+	unsigned char keystr[PASSWD_LENGTH];
+	unsigned char crypt_expected[AUTH_LENGTH];
+
+	DES_key_schedule ks;
+	int i;
+#endif
+
+	pthread_t tid;
+	uint32_t sres = 0;
+	int len;
+	int perror = 1;
+
+	rc->cfd = cfd;
+
+	/* 1a. Send server version */
+	stream_write(cfd, vbuf, strlen(vbuf));
+
+	/* 1b. Read client version */
+	len = read(cfd, buf, sizeof(buf));
+
+	/* 2a. Send security type */
+	buf[0] = 1;
+#ifndef NO_OPENSSL
+	if (rc->password) 
+		buf[1] = SECURITY_TYPE_VNC_AUTH;
+	else
+		buf[1] = SECURITY_TYPE_NONE;
+#else
+	buf[1] = SECURITY_TYPE_NONE;
+#endif
+
+	stream_write(cfd, buf, 2);
+
+	/* 2b. Read agreed security type */
+	len = stream_read(cfd, buf, 1);
+
+	/* 2c. Do VNC authentication */
+	switch (buf[0]) {
+	case SECURITY_TYPE_NONE:
+		sres = 0;
+		break;
+	case SECURITY_TYPE_VNC_AUTH:
+		/*
+		 * The client encrypts the challenge with DES, using a password
+		 * supplied by the user as the key.
+		 * To form the key, the password is truncated to
+		 * eight characters, or padded with null bytes on the right.
+		 * The client then sends the resulting 16-bytes response.
+		 */
+#ifndef NO_OPENSSL
+		strncpy(keystr, rc->password, PASSWD_LENGTH);
+
+		/* VNC clients encrypts the challenge with all the bit fields
+		 * in each byte of the password mirrored.
+		 * Here we flip each byte of the keystr.
+		 */
+		for (i = 0; i < PASSWD_LENGTH; i++) {
+			keystr[i] = (keystr[i] & 0xF0) >> 4
+				  | (keystr[i] & 0x0F) << 4;
+			keystr[i] = (keystr[i] & 0xCC) >> 2
+				  | (keystr[i] & 0x33) << 2;
+			keystr[i] = (keystr[i] & 0xAA) >> 1
+				  | (keystr[i] & 0x55) << 1;
+		}
+
+		/* Initialize a 16-byte random challenge */
+		arc4random_buf(challenge, sizeof(challenge));
+		stream_write(cfd, challenge, AUTH_LENGTH);
+
+		/* Receive the 16-byte challenge response */
+		stream_read(cfd, buf, AUTH_LENGTH);
+
+		memcpy(crypt_expected, challenge, AUTH_LENGTH);
+
+		/* Encrypt the Challenge with DES */
+		DES_set_key((const_DES_cblock *)keystr, &ks);
+		DES_ecb_encrypt((const_DES_cblock *)challenge,
+				(const_DES_cblock *)crypt_expected,
+				&ks, DES_ENCRYPT);
+		DES_ecb_encrypt((const_DES_cblock *)(challenge + PASSWD_LENGTH),
+				(const_DES_cblock *)(crypt_expected +
+				PASSWD_LENGTH),
+				&ks, DES_ENCRYPT);
+
+		if (memcmp(crypt_expected, buf, AUTH_LENGTH) != 0) {
+			message = "Auth Failed: Invalid Password.";
+			sres = htonl(1);
+		} else
+			sres = 0;
+#else
+		sres = 0;
+		WPRINTF(("Auth not supported, no OpenSSL in your system"));
+#endif
+
+		break;
+	}
+
+	/* 2d. Write back a status */
+	stream_write(cfd, &sres, 4);
+
+	if (sres) {
+#ifdef __FreeBSD__
+		be32enc(buf, strlen(message));
+		stream_write(cfd, buf, 4);
+		stream_write(cfd, message, strlen(message));
+#else
+		be32enc(buf, strlen((char *)message));
+		stream_write(cfd, buf, 4);
+		stream_write(cfd, message, strlen((char *)message));
+#endif
+		goto done;
+	}
+
+	/* 3a. Read client shared-flag byte */
+	len = stream_read(cfd, buf, 1);
+
+	/* 4a. Write server-init info */
+	rfb_send_server_init_msg(cfd);
+
+	if (!rc->zbuf) {
+		rc->zbuf = malloc(RFB_ZLIB_BUFSZ + 16);
+		assert(rc->zbuf != NULL);
+	}
+
+	rfb_send_screen(rc, cfd, 1);
+
+	perror = pthread_create(&tid, NULL, rfb_wr_thr, rc);
+#ifdef __FreeBSD__
+	if (perror == 0)
+		pthread_set_name_np(tid, "rfbout");
+#else
+	/*
+	 * While pthread_set_name_np() remains a no-op, skip this to avoid
+	 * compiler warnings about an empty if-statement.
+	 */
+#endif
+
+        /* Now read in client requests. 1st byte identifies type */
+	for (;;) {
+		len = read(cfd, buf, 1);
+		if (len <= 0) {
+			DPRINTF(("rfb client exiting\r\n"));
+			break;
+		}
+
+		switch (buf[0]) {
+		case 0:
+			rfb_recv_set_pixfmt_msg(rc, cfd);
+			break;
+		case 2:
+			rfb_recv_set_encodings_msg(rc, cfd);
+			break;
+		case 3:
+			rfb_recv_update_msg(rc, cfd, 1);
+			break;
+		case 4:
+			rfb_recv_key_msg(rc, cfd);
+			break;
+		case 5:
+			rfb_recv_ptr_msg(rc, cfd);
+			break;
+		case 6:
+			rfb_recv_cuttext_msg(rc, cfd);
+			break;
+		default:
+			WPRINTF(("rfb unknown cli-code %d!\n", buf[0] & 0xff));
+			goto done;
+		}
+	}
+done:
+	rc->cfd = -1;
+	if (perror == 0)
+		pthread_join(tid, NULL);
+	if (rc->enc_zlib_ok)
+		deflateEnd(&rc->zstream);
+}
+
+static void *
+rfb_thr(void *arg)
+{
+	struct rfb_softc *rc;
+	sigset_t set;
+
+	int cfd;
+
+	rc = arg;
+
+	sigemptyset(&set);
+	sigaddset(&set, SIGPIPE);
+	if (pthread_sigmask(SIG_BLOCK, &set, NULL) != 0) {
+		perror("pthread_sigmask");
+		return (NULL);
+	}
+
+	for (;;) {
+		rc->enc_raw_ok = false;
+		rc->enc_zlib_ok = false;
+		rc->enc_resize_ok = false;
+
+		cfd = accept(rc->sfd, NULL, NULL);
+		if (rc->conn_wait) {
+			pthread_mutex_lock(&rc->mtx);
+			pthread_cond_signal(&rc->cond);
+			pthread_mutex_unlock(&rc->mtx);
+			rc->conn_wait = 0;
+		}
+		rfb_handle(rc, cfd);
+		close(cfd);
+	}
+
+	/* NOTREACHED */
+	return (NULL);
+}
+
+static int
+sse42_supported(void)
+{
+	u_int cpu_registers[4], ecx;
+
+	do_cpuid(1, cpu_registers);
+
+	ecx = cpu_registers[2];
+
+	return ((ecx & CPUID2_SSE42) != 0);
+}
+
+int
+rfb_init(char *hostname, int port, int wait, char *password)
+{
+	struct rfb_softc *rc;
+	struct sockaddr_in sin;
+	int on = 1;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+#endif
+
+	rc = calloc(1, sizeof(struct rfb_softc));
+
+	rc->crc = calloc(howmany(RFB_MAX_WIDTH * RFB_MAX_HEIGHT, 32),
+	                 sizeof(uint32_t));
+	rc->crc_tmp = calloc(howmany(RFB_MAX_WIDTH * RFB_MAX_HEIGHT, 32),
+	                     sizeof(uint32_t));
+	rc->crc_width = RFB_MAX_WIDTH;
+	rc->crc_height = RFB_MAX_HEIGHT;
+
+	rc->password = password;
+
+	rc->sfd = socket(AF_INET, SOCK_STREAM, 0);
+	if (rc->sfd < 0) {
+		perror("socket");
+		return (-1);
+	}
+
+	setsockopt(rc->sfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+
+#ifdef	__FreeBSD__
+	sin.sin_len = sizeof(sin);
+#endif
+	sin.sin_family = AF_INET;
+	sin.sin_port = port ? htons(port) : htons(5900);
+	if (hostname && strlen(hostname) > 0)
+		inet_pton(AF_INET, hostname, &(sin.sin_addr));
+	else
+		sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+
+	if (bind(rc->sfd, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
+		perror("bind");
+		return (-1);
+	}
+
+	if (listen(rc->sfd, 1) < 0) {
+		perror("listen");
+		return (-1);
+	}
+
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE);
+	if (cap_rights_limit(rc->sfd, &rights) == -1 && errno != ENOSYS)
+		errx(EX_OSERR, "Unable to apply rights for sandbox");
+#endif
+
+	rc->hw_crc = sse42_supported();
+
+	rc->conn_wait = wait;
+	if (wait) {
+		pthread_mutex_init(&rc->mtx, NULL);
+		pthread_cond_init(&rc->cond, NULL);
+	}
+
+	pthread_create(&rc->tid, NULL, rfb_thr, rc);
+	pthread_set_name_np(rc->tid, "rfb");
+
+	if (wait) {
+		DPRINTF(("Waiting for rfb client...\n"));
+		pthread_mutex_lock(&rc->mtx);
+		pthread_cond_wait(&rc->cond, &rc->mtx);
+		pthread_mutex_unlock(&rc->mtx);
+	}
+
+	return (0);
+}
+
+#ifndef __FreeBSD__
+int
+rfb_init_unix(char *path, int wait, char *password)
+{
+	struct rfb_softc *rc;
+	struct sockaddr_un sock;
+
+	if ((rc = calloc(1, sizeof (struct rfb_softc))) == NULL) {
+		perror("calloc");
+		return (-1);
+	}
+	rc->sfd = -1;
+
+	if ((rc->crc = calloc(howmany(RFB_MAX_WIDTH * RFB_MAX_HEIGHT, 32),
+	    sizeof (uint32_t))) == NULL) {
+		perror("calloc");
+		goto fail;
+	}
+	if ((rc->crc_tmp = calloc(howmany(RFB_MAX_WIDTH * RFB_MAX_HEIGHT, 32),
+	    sizeof (uint32_t))) == NULL) {
+		perror("calloc");
+		goto fail;
+	}
+	rc->crc_width = RFB_MAX_WIDTH;
+	rc->crc_height = RFB_MAX_HEIGHT;
+
+	rc->password = password;
+
+	rc->sfd = socket(PF_UNIX, SOCK_STREAM, 0);
+	if (rc->sfd < 0) {
+		perror("socket");
+		goto fail;
+	}
+
+	sock.sun_family = AF_UNIX;
+	if (strlcpy(sock.sun_path, path, sizeof (sock.sun_path)) >=
+	    sizeof (sock.sun_path)) {
+		(void) fprintf(stderr, "socket path '%s' too long\n", path);
+		goto fail;
+	}
+
+	(void) unlink(path);
+	if (bind(rc->sfd, (struct sockaddr *)&sock, sizeof (sock)) < 0) {
+		perror("bind");
+		goto fail;
+	}
+
+	if (listen(rc->sfd, 1) < 0) {
+		perror("listen");
+		goto fail;
+	}
+
+	rc->hw_crc = sse42_supported();
+
+	rc->conn_wait = wait;
+	if (wait) {
+		VERIFY3S(pthread_mutex_init(&rc->mtx, NULL), ==, 0);
+		VERIFY3S(pthread_cond_init(&rc->cond, NULL), ==, 0);
+	}
+
+	VERIFY3S(pthread_create(&rc->tid, NULL, rfb_thr, rc), ==, 0);
+	pthread_set_name_np(rc->tid, "rfb");
+
+	if (wait) {
+		DPRINTF(("Waiting for rfb client...\n"));
+		VERIFY3S(pthread_mutex_lock(&rc->mtx), ==, 0);
+		VERIFY3S(pthread_cond_wait(&rc->cond, &rc->mtx), ==, 0);
+		VERIFY3S(pthread_mutex_unlock(&rc->mtx), ==, 0);
+	}
+
+	return (0);
+
+fail:
+	if (rc->sfd != -1) {
+		VERIFY3S(close(rc->sfd), ==, 0);
+	}
+	free(rc->crc);
+	free(rc->crc_tmp);
+	free(rc);
+	return (-1);
+}
+#endif
diff --git a/usr/src/cmd/bhyve/rfb.h b/usr/src/cmd/bhyve/rfb.h
new file mode 100644
index 0000000000..94d937e5b8
--- /dev/null
+++ b/usr/src/cmd/bhyve/rfb.h
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright 2018 Joyent, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _RFB_H_
+#define	_RFB_H_
+
+#define	RFB_PORT	5900
+
+int	rfb_init(char *hostname, int port, int wait, char *password);
+#ifndef __FreeBSD__
+int	rfb_init_unix(char *path, int wait, char *password);
+#endif
+
+#endif /* _RFB_H_ */
diff --git a/usr/src/cmd/bhyve/rtc.c b/usr/src/cmd/bhyve/rtc.c
new file mode 100644
index 0000000000..73b5610771
--- /dev/null
+++ b/usr/src/cmd/bhyve/rtc.c
@@ -0,0 +1,131 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <time.h>
+#include <assert.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include "acpi.h"
+#include "pci_lpc.h"
+#include "rtc.h"
+
+#define	IO_RTC		0x70
+
+#define	RTC_LMEM_LSB	0x34
+#define	RTC_LMEM_MSB	0x35
+#define	RTC_HMEM_LSB	0x5b
+#define	RTC_HMEM_SB	0x5c
+#define	RTC_HMEM_MSB	0x5d
+
+#define m_64KB		(64*1024)
+#define	m_16MB		(16*1024*1024)
+#define	m_4GB		(4ULL*1024*1024*1024)
+
+/*
+ * Returns the current RTC time as number of seconds since 00:00:00 Jan 1, 1970
+ */
+static time_t
+rtc_time(struct vmctx *ctx, int use_localtime)
+{
+	struct tm tm;
+	time_t t;
+
+	time(&t);
+	if (use_localtime) {
+		localtime_r(&t, &tm);
+		t = timegm(&tm);
+	}
+	return (t);
+}
+
+void
+rtc_init(struct vmctx *ctx, int use_localtime)
+{	
+	size_t himem;
+	size_t lomem;
+	int err;
+
+	/* XXX init diag/reset code/equipment/checksum ? */
+
+	/*
+	 * Report guest memory size in nvram cells as required by UEFI.
+	 * Little-endian encoding.
+	 * 0x34/0x35 - 64KB chunks above 16MB, below 4GB
+	 * 0x5b/0x5c/0x5d - 64KB chunks above 4GB
+	 */
+	lomem = (vm_get_lowmem_size(ctx) - m_16MB) / m_64KB;
+	err = vm_rtc_write(ctx, RTC_LMEM_LSB, lomem);
+	assert(err == 0);
+	err = vm_rtc_write(ctx, RTC_LMEM_MSB, lomem >> 8);
+	assert(err == 0);
+
+	himem = vm_get_highmem_size(ctx) / m_64KB;
+	err = vm_rtc_write(ctx, RTC_HMEM_LSB, himem);
+	assert(err == 0);
+	err = vm_rtc_write(ctx, RTC_HMEM_SB, himem >> 8);
+	assert(err == 0);
+	err = vm_rtc_write(ctx, RTC_HMEM_MSB, himem >> 16);
+	assert(err == 0);
+
+	err = vm_rtc_settime(ctx, rtc_time(ctx, use_localtime));
+	assert(err == 0);
+}
+
+static void
+rtc_dsdt(void)
+{
+
+	dsdt_line("");
+	dsdt_line("Device (RTC)");
+	dsdt_line("{");
+	dsdt_line("  Name (_HID, EisaId (\"PNP0B00\"))");
+	dsdt_line("  Name (_CRS, ResourceTemplate ()");
+	dsdt_line("  {");
+	dsdt_indent(2);
+	dsdt_fixed_ioport(IO_RTC, 2);
+	dsdt_fixed_irq(8);
+	dsdt_unindent(2);
+	dsdt_line("  })");
+	dsdt_line("}");
+}
+LPC_DSDT(rtc_dsdt);
+
+/*
+ * Reserve the extended RTC I/O ports although they are not emulated at this
+ * time.
+ */
+SYSRES_IO(0x72, 6);
diff --git a/usr/src/cmd/bhyve/rtc.h b/usr/src/cmd/bhyve/rtc.h
new file mode 100644
index 0000000000..1c108eed99
--- /dev/null
+++ b/usr/src/cmd/bhyve/rtc.h
@@ -0,0 +1,36 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013  Peter Grehan <grehan@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _RTC_H_
+#define _RTC_H_
+
+void	rtc_init(struct vmctx *ctx, int use_localtime);
+
+#endif /* _RTC_H_ */
diff --git a/usr/src/cmd/bhyve/smbiostbl.c b/usr/src/cmd/bhyve/smbiostbl.c
new file mode 100644
index 0000000000..35a41a0855
--- /dev/null
+++ b/usr/src/cmd/bhyve/smbiostbl.c
@@ -0,0 +1,907 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <md5.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <uuid.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include "bhyverun.h"
+#include "smbiostbl.h"
+
+#define	MB			(1024*1024)
+#define	GB			(1024ULL*1024*1024)
+
+#define SMBIOS_BASE		0xF1000
+
+/* BHYVE_ACPI_BASE - SMBIOS_BASE) */
+#define	SMBIOS_MAX_LENGTH	(0xF2400 - 0xF1000)
+
+#define	SMBIOS_TYPE_BIOS	0
+#define	SMBIOS_TYPE_SYSTEM	1
+#define	SMBIOS_TYPE_CHASSIS	3
+#define	SMBIOS_TYPE_PROCESSOR	4
+#define	SMBIOS_TYPE_MEMARRAY	16
+#define	SMBIOS_TYPE_MEMDEVICE	17
+#define	SMBIOS_TYPE_MEMARRAYMAP	19
+#define	SMBIOS_TYPE_BOOT	32
+#define	SMBIOS_TYPE_EOT		127
+
+struct smbios_structure {
+	uint8_t		type;
+	uint8_t		length;
+	uint16_t	handle;
+} __packed;
+
+typedef int (*initializer_func_t)(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size);
+
+struct smbios_template_entry {
+	struct smbios_structure	*entry;
+	const char		**strings;
+	initializer_func_t	initializer;
+};
+
+/*
+ * SMBIOS Structure Table Entry Point
+ */
+#define	SMBIOS_ENTRY_EANCHOR	"_SM_"
+#define	SMBIOS_ENTRY_EANCHORLEN	4
+#define	SMBIOS_ENTRY_IANCHOR	"_DMI_"
+#define	SMBIOS_ENTRY_IANCHORLEN	5
+
+struct smbios_entry_point {
+	char		eanchor[4];	/* anchor tag */
+	uint8_t		echecksum;	/* checksum of entry point structure */
+	uint8_t		eplen;		/* length in bytes of entry point */
+	uint8_t		major;		/* major version of the SMBIOS spec */
+	uint8_t		minor;		/* minor version of the SMBIOS spec */
+	uint16_t	maxssize;	/* maximum size in bytes of a struct */
+	uint8_t		revision;	/* entry point structure revision */
+	uint8_t		format[5];	/* entry point rev-specific data */
+	char		ianchor[5];	/* intermediate anchor tag */
+	uint8_t		ichecksum;	/* intermediate checksum */
+	uint16_t	stlen;		/* len in bytes of structure table */
+	uint32_t	staddr;		/* physical addr of structure table */
+	uint16_t	stnum;		/* number of structure table entries */
+	uint8_t		bcdrev;		/* BCD value representing DMI ver */
+} __packed;
+
+/*
+ * BIOS Information
+ */
+#define	SMBIOS_FL_ISA		0x00000010	/* ISA is supported */
+#define	SMBIOS_FL_PCI		0x00000080	/* PCI is supported */
+#define	SMBIOS_FL_SHADOW	0x00001000	/* BIOS shadowing is allowed */
+#define	SMBIOS_FL_CDBOOT	0x00008000	/* Boot from CD is supported */
+#define	SMBIOS_FL_SELBOOT	0x00010000	/* Selectable Boot supported */
+#define	SMBIOS_FL_EDD		0x00080000	/* EDD Spec is supported */
+
+#define	SMBIOS_XB1_FL_ACPI	0x00000001	/* ACPI is supported */
+
+#define	SMBIOS_XB2_FL_BBS	0x00000001	/* BIOS Boot Specification */
+#define	SMBIOS_XB2_FL_VM	0x00000010	/* Virtual Machine */
+
+struct smbios_table_type0 {
+	struct smbios_structure	header;
+	uint8_t			vendor;		/* vendor string */
+	uint8_t			version;	/* version string */
+	uint16_t		segment;	/* address segment location */
+	uint8_t			rel_date;	/* release date */
+	uint8_t			size;		/* rom size */
+	uint64_t		cflags;		/* characteristics */
+	uint8_t			xc_bytes[2];	/* characteristics ext bytes */
+	uint8_t			sb_major_rel;	/* system bios version */
+	uint8_t			sb_minor_rele;
+	uint8_t			ecfw_major_rel;	/* embedded ctrl fw version */
+	uint8_t			ecfw_minor_rel;
+} __packed;
+
+/*
+ * System Information
+ */
+#define	SMBIOS_WAKEUP_SWITCH	0x06	/* power switch */
+
+struct smbios_table_type1 {
+	struct smbios_structure	header;
+	uint8_t			manufacturer;	/* manufacturer string */
+	uint8_t			product;	/* product name string */
+	uint8_t			version;	/* version string */
+	uint8_t			serial;		/* serial number string */
+	uint8_t			uuid[16];	/* uuid byte array */
+	uint8_t			wakeup;		/* wake-up event */
+	uint8_t			sku;		/* sku number string */
+	uint8_t			family;		/* family name string */
+} __packed;
+
+/*
+ * System Enclosure or Chassis
+ */
+#define	SMBIOS_CHT_UNKNOWN	0x02	/* unknown */
+
+#define	SMBIOS_CHST_SAFE	0x03	/* safe */
+
+#define	SMBIOS_CHSC_NONE	0x03	/* none */
+
+struct smbios_table_type3 {
+	struct smbios_structure	header;
+	uint8_t			manufacturer;	/* manufacturer string */
+	uint8_t			type;		/* type */
+	uint8_t			version;	/* version string */
+	uint8_t			serial;		/* serial number string */
+	uint8_t			asset;		/* asset tag string */
+	uint8_t			bustate;	/* boot-up state */
+	uint8_t			psstate;	/* power supply state */
+	uint8_t			tstate;		/* thermal state */
+	uint8_t			security;	/* security status */
+	uint8_t			uheight;	/* height in 'u's */
+	uint8_t			cords;		/* number of power cords */
+	uint8_t			elems;		/* number of element records */
+	uint8_t			elemlen;	/* length of records */
+	uint8_t			sku;		/* sku number string */
+} __packed;
+
+/*
+ * Processor Information
+ */
+#define	SMBIOS_PRT_CENTRAL	0x03	/* central processor */
+
+#define	SMBIOS_PRF_OTHER	0x01	/* other */
+
+#define	SMBIOS_PRS_PRESENT	0x40	/* socket is populated */
+#define	SMBIOS_PRS_ENABLED	0x1	/* enabled */
+
+#define	SMBIOS_PRU_NONE		0x06	/* none */
+
+#define	SMBIOS_PFL_64B	0x04	/* 64-bit capable */
+
+struct smbios_table_type4 {
+	struct smbios_structure	header;
+	uint8_t			socket;		/* socket designation string */
+	uint8_t			type;		/* processor type */
+	uint8_t			family;		/* processor family */
+	uint8_t			manufacturer;	/* manufacturer string */
+	uint64_t		cpuid;		/* processor cpuid */
+	uint8_t			version;	/* version string */
+	uint8_t			voltage;	/* voltage */
+	uint16_t		clkspeed;	/* ext clock speed in mhz */
+	uint16_t		maxspeed;	/* maximum speed in mhz */
+	uint16_t		curspeed;	/* current speed in mhz */
+	uint8_t			status;		/* status */
+	uint8_t			upgrade;	/* upgrade */
+	uint16_t		l1handle;	/* l1 cache handle */
+	uint16_t		l2handle;	/* l2 cache handle */
+	uint16_t		l3handle;	/* l3 cache handle */
+	uint8_t			serial;		/* serial number string */
+	uint8_t			asset;		/* asset tag string */
+	uint8_t			part;		/* part number string */
+	uint8_t			cores;		/* cores per socket */
+	uint8_t			ecores;		/* enabled cores */
+	uint8_t			threads;	/* threads per socket */
+	uint16_t		cflags;		/* processor characteristics */
+	uint16_t		family2;	/* processor family 2 */
+} __packed;
+
+/*
+ * Physical Memory Array
+ */
+#define	SMBIOS_MAL_SYSMB	0x03	/* system board or motherboard */
+
+#define	SMBIOS_MAU_SYSTEM	0x03	/* system memory */
+
+#define	SMBIOS_MAE_NONE		0x03	/* none */
+
+struct smbios_table_type16 {
+	struct smbios_structure	header;
+	uint8_t			location;	/* physical device location */
+	uint8_t			use;		/* device functional purpose */
+	uint8_t			ecc;		/* err detect/correct method */
+	uint32_t		size;		/* max mem capacity in kb */
+	uint16_t		errhand;	/* handle of error (if any) */
+	uint16_t		ndevs;		/* num of slots or sockets */
+	uint64_t		xsize;		/* max mem capacity in bytes */
+} __packed;
+
+/*
+ * Memory Device
+ */
+#define	SMBIOS_MDFF_UNKNOWN	0x02	/* unknown */
+
+#define	SMBIOS_MDT_UNKNOWN	0x02	/* unknown */
+
+#define	SMBIOS_MDF_UNKNOWN	0x0004	/* unknown */
+
+struct smbios_table_type17 {
+	struct smbios_structure	header;
+	uint16_t		arrayhand;	/* handle of physl mem array */
+	uint16_t		errhand;	/* handle of mem error data */
+	uint16_t		twidth;		/* total width in bits */
+	uint16_t		dwidth;		/* data width in bits */
+	uint16_t		size;		/* size in bytes */
+	uint8_t			form;		/* form factor */
+	uint8_t			set;		/* set */
+	uint8_t			dloc;		/* device locator string */
+	uint8_t			bloc;		/* phys bank locator string */
+	uint8_t			type;		/* memory type */
+	uint16_t		flags;		/* memory characteristics */
+	uint16_t		maxspeed;	/* maximum speed in mhz */
+	uint8_t			manufacturer;	/* manufacturer string */
+	uint8_t			serial;		/* serial number string */
+	uint8_t			asset;		/* asset tag string */
+	uint8_t			part;		/* part number string */
+	uint8_t			attributes;	/* attributes */
+	uint32_t		xsize;		/* extended size in mbs */
+	uint16_t		curspeed;	/* current speed in mhz */
+	uint16_t		minvoltage;	/* minimum voltage */
+	uint16_t		maxvoltage;	/* maximum voltage */
+	uint16_t		curvoltage;	/* configured voltage */
+} __packed;
+
+/*
+ * Memory Array Mapped Address
+ */
+struct smbios_table_type19 {
+	struct smbios_structure	header;
+	uint32_t		saddr;		/* start phys addr in kb */
+	uint32_t		eaddr;		/* end phys addr in kb */
+	uint16_t		arrayhand;	/* physical mem array handle */
+	uint8_t			width;		/* num of dev in row */
+	uint64_t		xsaddr;		/* start phys addr in bytes */
+	uint64_t		xeaddr;		/* end phys addr in bytes */
+} __packed;
+
+/*
+ * System Boot Information
+ */
+#define	SMBIOS_BOOT_NORMAL	0	/* no errors detected */
+
+struct smbios_table_type32 {
+	struct smbios_structure	header;
+	uint8_t			reserved[6];
+	uint8_t			status;		/* boot status */
+} __packed;
+
+/*
+ * End-of-Table
+ */
+struct smbios_table_type127 {
+	struct smbios_structure	header;
+} __packed;
+
+struct smbios_table_type0 smbios_type0_template = {
+	{ SMBIOS_TYPE_BIOS, sizeof (struct smbios_table_type0), 0 },
+	1,	/* bios vendor string */
+	2,	/* bios version string */
+	0xF000,	/* bios address segment location */
+	3,	/* bios release date */
+	0x0,	/* bios size (64k * (n + 1) is the size in bytes) */
+	SMBIOS_FL_ISA | SMBIOS_FL_PCI | SMBIOS_FL_SHADOW |
+	    SMBIOS_FL_CDBOOT | SMBIOS_FL_EDD,
+	{ SMBIOS_XB1_FL_ACPI, SMBIOS_XB2_FL_BBS | SMBIOS_XB2_FL_VM },
+	0x0,	/* bios major release */
+	0x0,	/* bios minor release */
+	0xff,	/* embedded controller firmware major release */
+	0xff	/* embedded controller firmware minor release */
+};
+
+const char *smbios_type0_strings[] = {
+	"BHYVE",	/* vendor string */
+	"1.00",		/* bios version string */
+	"03/14/2014",	/* bios release date string */
+	NULL
+};
+
+struct smbios_table_type1 smbios_type1_template = {
+	{ SMBIOS_TYPE_SYSTEM, sizeof (struct smbios_table_type1), 0 },
+	1,		/* manufacturer string */
+	2,		/* product string */
+	3,		/* version string */
+	4,		/* serial number string */
+	{ 0 },
+	SMBIOS_WAKEUP_SWITCH,
+	5,		/* sku string */
+	6		/* family string */
+};
+
+static int smbios_type1_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size);
+
+const char *smbios_type1_strings[] = {
+	" ",		/* manufacturer string */
+	"BHYVE",	/* product name string */
+	"1.0",		/* version string */
+	"None",		/* serial number string */
+	"None",		/* sku string */
+	" ",		/* family name string */
+	NULL
+};
+
+struct smbios_table_type3 smbios_type3_template = {
+	{ SMBIOS_TYPE_CHASSIS, sizeof (struct smbios_table_type3), 0 },
+	1,		/* manufacturer string */
+	SMBIOS_CHT_UNKNOWN,
+	2,		/* version string */
+	3,		/* serial number string */
+	4,		/* asset tag string */
+	SMBIOS_CHST_SAFE,
+	SMBIOS_CHST_SAFE,
+	SMBIOS_CHST_SAFE,
+	SMBIOS_CHSC_NONE,
+	0,		/* height in 'u's (0=enclosure height unspecified) */
+	0,		/* number of power cords (0=number unspecified) */
+	0,		/* number of contained element records */
+	0,		/* length of records */
+	5		/* sku number string */
+};
+
+const char *smbios_type3_strings[] = {
+	" ",		/* manufacturer string */
+	"1.0",		/* version string */
+	"None",		/* serial number string */
+	"None",		/* asset tag string */
+	"None",		/* sku number string */
+	NULL
+};
+
+struct smbios_table_type4 smbios_type4_template = {
+	{ SMBIOS_TYPE_PROCESSOR, sizeof (struct smbios_table_type4), 0 },
+	1,		/* socket designation string */
+	SMBIOS_PRT_CENTRAL,
+	SMBIOS_PRF_OTHER,
+	2,		/* manufacturer string */
+	0,		/* cpuid */
+	3,		/* version string */
+	0,		/* voltage */
+	0,		/* external clock frequency in mhz (0=unknown) */
+	0,		/* maximum frequency in mhz (0=unknown) */
+	0,		/* current frequency in mhz (0=unknown) */
+	SMBIOS_PRS_PRESENT | SMBIOS_PRS_ENABLED,
+	SMBIOS_PRU_NONE,
+	-1,		/* l1 cache handle */
+	-1,		/* l2 cache handle */
+	-1,		/* l3 cache handle */
+	4,		/* serial number string */
+	5,		/* asset tag string */
+	6,		/* part number string */
+	0,		/* cores per socket (0=unknown) */
+	0,		/* enabled cores per socket (0=unknown) */
+	0,		/* threads per socket (0=unknown) */
+	SMBIOS_PFL_64B,
+	SMBIOS_PRF_OTHER
+};
+
+const char *smbios_type4_strings[] = {
+	" ",		/* socket designation string */
+	" ",		/* manufacturer string */
+	" ",		/* version string */
+	"None",		/* serial number string */
+	"None",		/* asset tag string */
+	"None",		/* part number string */
+	NULL
+};
+
+static int smbios_type4_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size);
+
+struct smbios_table_type16 smbios_type16_template = {
+	{ SMBIOS_TYPE_MEMARRAY, sizeof (struct smbios_table_type16),  0 },
+	SMBIOS_MAL_SYSMB,
+	SMBIOS_MAU_SYSTEM,
+	SMBIOS_MAE_NONE,
+	0x80000000,	/* max mem capacity in kb (0x80000000=use extended) */
+	-1,		/* handle of error (if any) */
+	0,		/* number of slots or sockets (TBD) */
+	0		/* extended maximum memory capacity in bytes (TBD) */
+};
+
+static int smbios_type16_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size);
+
+struct smbios_table_type17 smbios_type17_template = {
+	{ SMBIOS_TYPE_MEMDEVICE, sizeof (struct smbios_table_type17),  0 },
+	-1,		/* handle of physical memory array */
+	-1,		/* handle of memory error data */
+	64,		/* total width in bits including ecc */
+	64,		/* data width in bits */
+	0x7fff,		/* size in bytes (0x7fff=use extended)*/
+	SMBIOS_MDFF_UNKNOWN,
+	0,		/* set (0x00=none, 0xff=unknown) */
+	1,		/* device locator string */
+	2,		/* physical bank locator string */
+	SMBIOS_MDT_UNKNOWN,
+	SMBIOS_MDF_UNKNOWN,
+	0,		/* maximum memory speed in mhz (0=unknown) */
+	3,		/* manufacturer string */
+	4,		/* serial number string */
+	5,		/* asset tag string */
+	6,		/* part number string */
+	0,		/* attributes (0=unknown rank information) */
+	0,		/* extended size in mb (TBD) */
+	0,		/* current speed in mhz (0=unknown) */
+	0,		/* minimum voltage in mv (0=unknown) */
+	0,		/* maximum voltage in mv (0=unknown) */
+	0		/* configured voltage in mv (0=unknown) */
+};
+
+const char *smbios_type17_strings[] = {
+	" ",		/* device locator string */
+	" ",		/* physical bank locator string */
+	" ",		/* manufacturer string */
+	"None",		/* serial number string */
+	"None",		/* asset tag string */
+	"None",		/* part number string */
+	NULL
+};
+
+static int smbios_type17_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size);
+
+struct smbios_table_type19 smbios_type19_template = {
+	{ SMBIOS_TYPE_MEMARRAYMAP, sizeof (struct smbios_table_type19),  0 },
+	0xffffffff,	/* starting phys addr in kb (0xffffffff=use ext) */
+	0xffffffff,	/* ending phys addr in kb (0xffffffff=use ext) */
+	-1,		/* physical memory array handle */
+	1,		/* number of devices that form a row */
+	0,		/* extended starting phys addr in bytes (TDB) */
+	0		/* extended ending phys addr in bytes (TDB) */
+};
+
+static int smbios_type19_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size);
+
+struct smbios_table_type32 smbios_type32_template = {
+	{ SMBIOS_TYPE_BOOT, sizeof (struct smbios_table_type32),  0 },
+	{ 0, 0, 0, 0, 0, 0 },
+	SMBIOS_BOOT_NORMAL
+};
+
+struct smbios_table_type127 smbios_type127_template = {
+	{ SMBIOS_TYPE_EOT, sizeof (struct smbios_table_type127),  0 }
+};
+
+static int smbios_generic_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size);
+
+static struct smbios_template_entry smbios_template[] = {
+	{ (struct smbios_structure *)&smbios_type0_template,
+	  smbios_type0_strings,
+	  smbios_generic_initializer },
+	{ (struct smbios_structure *)&smbios_type1_template,
+	  smbios_type1_strings,
+	  smbios_type1_initializer },
+	{ (struct smbios_structure *)&smbios_type3_template,
+	  smbios_type3_strings,
+	  smbios_generic_initializer },
+	{ (struct smbios_structure *)&smbios_type4_template,
+	  smbios_type4_strings,
+	  smbios_type4_initializer },
+	{ (struct smbios_structure *)&smbios_type16_template,
+	  NULL,
+	  smbios_type16_initializer },
+	{ (struct smbios_structure *)&smbios_type17_template,
+	  smbios_type17_strings,
+	  smbios_type17_initializer },
+	{ (struct smbios_structure *)&smbios_type19_template,
+	  NULL,
+	  smbios_type19_initializer },
+	{ (struct smbios_structure *)&smbios_type32_template,
+	  NULL,
+	  smbios_generic_initializer },
+	{ (struct smbios_structure *)&smbios_type127_template,
+	  NULL,
+	  smbios_generic_initializer },
+	{ NULL,NULL, NULL }
+};
+
+static uint64_t guest_lomem, guest_himem;
+static uint16_t type16_handle;
+
+static int
+smbios_generic_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size)
+{
+	struct smbios_structure *entry;
+
+	memcpy(curaddr, template_entry, template_entry->length);
+	entry = (struct smbios_structure *)curaddr;
+	entry->handle = *n + 1;
+	curaddr += entry->length;
+	if (template_strings != NULL) {
+		int	i;
+
+		for (i = 0; template_strings[i] != NULL; i++) {
+			const char *string;
+			int len;
+
+			string = template_strings[i];
+			len = strlen(string) + 1;
+			memcpy(curaddr, string, len);
+			curaddr += len;
+		}
+		*curaddr = '\0';
+		curaddr++;
+	} else {
+		/* Minimum string section is double nul */
+		*curaddr = '\0';
+		curaddr++;
+		*curaddr = '\0';
+		curaddr++;
+	}
+	(*n)++;
+	*endaddr = curaddr;
+
+	return (0);
+}
+
+static int
+smbios_type1_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size)
+{
+	struct smbios_table_type1 *type1;
+
+	smbios_generic_initializer(template_entry, template_strings,
+	    curaddr, endaddr, n, size);
+	type1 = (struct smbios_table_type1 *)curaddr;
+
+	if (guest_uuid_str != NULL) {
+		uuid_t		uuid;
+		uint32_t	status;
+
+		uuid_from_string(guest_uuid_str, &uuid, &status);
+		if (status != uuid_s_ok)
+			return (-1);
+
+		uuid_enc_le(&type1->uuid, &uuid);
+	} else {
+		MD5_CTX		mdctx;
+		u_char		digest[16];
+		char		hostname[MAXHOSTNAMELEN];
+
+		/*
+		 * Universally unique and yet reproducible are an
+		 * oxymoron, however reproducible is desirable in
+		 * this case.
+		 */
+		if (gethostname(hostname, sizeof(hostname)))
+			return (-1);
+
+		MD5Init(&mdctx);
+		MD5Update(&mdctx, vmname, strlen(vmname));
+		MD5Update(&mdctx, hostname, sizeof(hostname));
+		MD5Final(digest, &mdctx);
+
+		/*
+		 * Set the variant and version number.
+		 */
+		digest[6] &= 0x0F;
+		digest[6] |= 0x30;	/* version 3 */
+		digest[8] &= 0x3F;
+		digest[8] |= 0x80;
+
+		memcpy(&type1->uuid, digest, sizeof (digest));
+	}
+
+	return (0);
+}
+
+static int
+smbios_type4_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size)
+{
+	int i;
+
+	for (i = 0; i < guest_ncpus; i++) {
+		struct smbios_table_type4 *type4;
+		char *p;
+		int nstrings, len;
+
+		smbios_generic_initializer(template_entry, template_strings,
+		    curaddr, endaddr, n, size);
+		type4 = (struct smbios_table_type4 *)curaddr;
+		p = curaddr + sizeof (struct smbios_table_type4);
+		nstrings = 0;
+		while (p < *endaddr - 1) {
+			if (*p++ == '\0')
+				nstrings++;
+		}
+		len = sprintf(*endaddr - 1, "CPU #%d", i) + 1;
+		*endaddr += len - 1;
+		*(*endaddr) = '\0';
+		(*endaddr)++;
+		type4->socket = nstrings + 1;
+		curaddr = *endaddr;
+	}
+
+	return (0);
+}
+
+static int
+smbios_type16_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size)
+{
+	struct smbios_table_type16 *type16;
+
+	type16_handle = *n;
+	smbios_generic_initializer(template_entry, template_strings,
+	    curaddr, endaddr, n, size);
+	type16 = (struct smbios_table_type16 *)curaddr;
+	type16->xsize = guest_lomem + guest_himem;
+	type16->ndevs = guest_himem > 0 ? 2 : 1;
+
+	return (0);
+}
+
+static int
+smbios_type17_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size)
+{
+	struct smbios_table_type17 *type17;
+
+	smbios_generic_initializer(template_entry, template_strings,
+	    curaddr, endaddr, n, size);
+	type17 = (struct smbios_table_type17 *)curaddr;
+	type17->arrayhand = type16_handle;
+	type17->xsize = guest_lomem;
+
+	if (guest_himem > 0) {
+		curaddr = *endaddr;
+		smbios_generic_initializer(template_entry, template_strings,
+		    curaddr, endaddr, n, size);
+		type17 = (struct smbios_table_type17 *)curaddr;
+		type17->arrayhand = type16_handle;
+		type17->xsize = guest_himem;
+	}
+
+	return (0);
+}
+
+static int
+smbios_type19_initializer(struct smbios_structure *template_entry,
+    const char **template_strings, char *curaddr, char **endaddr,
+    uint16_t *n, uint16_t *size)
+{
+	struct smbios_table_type19 *type19;
+
+	smbios_generic_initializer(template_entry, template_strings,
+	    curaddr, endaddr, n, size);
+	type19 = (struct smbios_table_type19 *)curaddr;
+	type19->arrayhand = type16_handle;
+	type19->xsaddr = 0;
+	type19->xeaddr = guest_lomem;
+
+	if (guest_himem > 0) {
+		curaddr = *endaddr;
+		smbios_generic_initializer(template_entry, template_strings,
+		    curaddr, endaddr, n, size);
+		type19 = (struct smbios_table_type19 *)curaddr;
+		type19->arrayhand = type16_handle;
+		type19->xsaddr = 4*GB;
+		type19->xeaddr = guest_himem;
+	}
+
+	return (0);
+}
+
+static void
+smbios_ep_initializer(struct smbios_entry_point *smbios_ep, uint32_t staddr)
+{
+	memset(smbios_ep, 0, sizeof(*smbios_ep));
+	memcpy(smbios_ep->eanchor, SMBIOS_ENTRY_EANCHOR,
+	    SMBIOS_ENTRY_EANCHORLEN);
+	smbios_ep->eplen = 0x1F;
+	assert(sizeof (struct smbios_entry_point) == smbios_ep->eplen);
+	smbios_ep->major = 2;
+	smbios_ep->minor = 6;
+	smbios_ep->revision = 0;
+	memcpy(smbios_ep->ianchor, SMBIOS_ENTRY_IANCHOR,
+	    SMBIOS_ENTRY_IANCHORLEN);
+	smbios_ep->staddr = staddr;
+	smbios_ep->bcdrev = 0x24;
+}
+
+static void
+smbios_ep_finalizer(struct smbios_entry_point *smbios_ep, uint16_t len,
+    uint16_t num, uint16_t maxssize)
+{
+	uint8_t	checksum;
+	int	i;
+
+	smbios_ep->maxssize = maxssize;
+	smbios_ep->stlen = len;
+	smbios_ep->stnum = num;
+
+	checksum = 0;
+	for (i = 0x10; i < 0x1f; i++) {
+		checksum -= ((uint8_t *)smbios_ep)[i];
+	}
+	smbios_ep->ichecksum = checksum;
+
+	checksum = 0;
+	for (i = 0; i < 0x1f; i++) {
+		checksum -= ((uint8_t *)smbios_ep)[i];
+	}
+	smbios_ep->echecksum = checksum;
+}
+
+int
+smbios_build(struct vmctx *ctx)
+{
+	struct smbios_entry_point	*smbios_ep;
+	uint16_t			n;
+	uint16_t			maxssize;
+	char				*curaddr, *startaddr, *ststartaddr;
+	int				i;
+	int				err;
+
+	guest_lomem = vm_get_lowmem_size(ctx);
+	guest_himem = vm_get_highmem_size(ctx);
+
+	startaddr = paddr_guest2host(ctx, SMBIOS_BASE, SMBIOS_MAX_LENGTH);
+	if (startaddr == NULL) {
+		fprintf(stderr, "smbios table requires mapped mem\n");
+		return (ENOMEM);
+	}
+
+	curaddr = startaddr;
+
+	smbios_ep = (struct smbios_entry_point *)curaddr;
+	smbios_ep_initializer(smbios_ep, SMBIOS_BASE +
+	    sizeof(struct smbios_entry_point));
+	curaddr += sizeof(struct smbios_entry_point);
+	ststartaddr = curaddr;
+
+	n = 0;
+	maxssize = 0;
+	for (i = 0; smbios_template[i].entry != NULL; i++) {
+		struct smbios_structure	*entry;
+		const char		**strings;
+		initializer_func_t      initializer;
+		char			*endaddr;
+		uint16_t		size;
+
+		entry = smbios_template[i].entry;
+		strings = smbios_template[i].strings;
+		initializer = smbios_template[i].initializer;
+
+		err = (*initializer)(entry, strings, curaddr, &endaddr,
+		    &n, &size);
+		if (err != 0)
+			return (err);
+
+		if (size > maxssize)
+			maxssize = size;
+
+		curaddr = endaddr;
+	}
+
+	assert(curaddr - startaddr < SMBIOS_MAX_LENGTH);
+	smbios_ep_finalizer(smbios_ep, curaddr - ststartaddr, n, maxssize);
+
+	return (0);
+}
+
+int
+smbios_parse(const char *opts)
+{
+	char *buf;
+	char *lasts;
+	char *token;
+	char *end;
+	long type;
+	struct {
+		const char *key;
+		const char **targetp;
+	} type1_map[] = {
+		{ "manufacturer", &smbios_type1_strings[0] },
+		{ "product", &smbios_type1_strings[1] },
+		{ "version", &smbios_type1_strings[2] },
+		{ "serial", &smbios_type1_strings[3] },
+		{ "sku", &smbios_type1_strings[4] },
+		{ "family", &smbios_type1_strings[5] },
+		{ "uuid", (const char **)&guest_uuid_str },
+		{ 0 }
+	};
+
+	if ((buf = strdup(opts)) == NULL) {
+		(void) fprintf(stderr, "out of memory\n");
+		return (-1);
+	}
+
+	if ((token = strtok_r(buf, ",", &lasts)) == NULL) {
+		(void) fprintf(stderr, "too few fields\n");
+		goto fail;
+	}
+
+	errno = 0;
+	type = strtol(token, &end, 10);
+	if (errno != 0 || *end != '\0') {
+		(void) fprintf(stderr, "first token '%s' is not an integer\n",
+		    token);
+		goto fail;
+	}
+
+	/* For now, only type 1 is supported. */
+	if (type != 1) {
+		(void) fprintf(stderr, "unsupported type %d\n", type);
+		goto fail;
+	}
+
+	while ((token = strtok_r(NULL, ",", &lasts)) != NULL) {
+		char *val;
+		int i;
+
+		if ((val = strchr(token, '=')) == NULL) {
+			(void) fprintf(stderr, "invalid key=value: '%s'\n",
+			    token);
+			goto fail;
+		}
+		*val = '\0';
+		val++;
+
+		for (i = 0; type1_map[i].key != NULL; i++) {
+			if (strcmp(token, type1_map[i].key) == 0) {
+				break;
+			}
+		}
+		if (type1_map[i].key == NULL) {
+			(void) fprintf(stderr, "invalid key '%s'\n", token);
+			goto fail;
+		}
+		*type1_map[i].targetp = val;
+	}
+
+	return (0);
+
+fail:
+	free(buf);
+	return (-1);
+}
diff --git a/usr/src/cmd/bhyve/smbiostbl.h b/usr/src/cmd/bhyve/smbiostbl.h
new file mode 100644
index 0000000000..81e26309e5
--- /dev/null
+++ b/usr/src/cmd/bhyve/smbiostbl.h
@@ -0,0 +1,43 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _SMBIOSTBL_H_
+#define _SMBIOSTBL_H_
+
+struct vmctx;
+
+int	smbios_build(struct vmctx *ctx);
+int	smbios_parse(const char *opts);
+
+#endif /* _SMBIOSTBL_H_ */
diff --git a/usr/src/cmd/bhyve/sockstream.c b/usr/src/cmd/bhyve/sockstream.c
new file mode 100644
index 0000000000..1789206ff3
--- /dev/null
+++ b/usr/src/cmd/bhyve/sockstream.c
@@ -0,0 +1,86 @@
+/*-
+ * Copyright (c) 2015 Nahanni Systems, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <errno.h>
+
+#include "sockstream.h"
+
+ssize_t
+stream_read(int fd, void *buf, ssize_t nbytes)
+{
+	uint8_t *p;
+	ssize_t len = 0;
+	ssize_t n;
+
+	p = buf;
+
+	while (len < nbytes) {
+		n = read(fd, p + len, nbytes - len);
+		if (n == 0)
+			break;
+
+		if (n < 0) {
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+			return (n);
+		}
+		len += n;
+	}
+	return (len);
+}
+
+ssize_t
+stream_write(int fd, const void *buf, ssize_t nbytes)
+{
+	const uint8_t *p;
+	ssize_t len = 0;
+	ssize_t n;
+
+	p = buf;
+
+	while (len < nbytes) {
+		n = write(fd, p + len, nbytes - len);
+		if (n == 0)
+			break;
+		if (n < 0) {
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+			return (n);
+		}
+		len += n;
+	}
+	return (len);
+}
+
+
diff --git a/usr/src/cmd/bhyve/sockstream.h b/usr/src/cmd/bhyve/sockstream.h
new file mode 100644
index 0000000000..bb0b3b06eb
--- /dev/null
+++ b/usr/src/cmd/bhyve/sockstream.h
@@ -0,0 +1,33 @@
+/*-
+ * Copyright (c) 2015 Nahanni Systems, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <unistd.h>
+
+ssize_t stream_read(int fd, void *buf, ssize_t nbytes);
+ssize_t stream_write(int fd, const void *buf, ssize_t nbytes);
diff --git a/usr/src/cmd/bhyve/spinup_ap.c b/usr/src/cmd/bhyve/spinup_ap.c
new file mode 100644
index 0000000000..7c4186f5ed
--- /dev/null
+++ b/usr/src/cmd/bhyve/spinup_ap.c
@@ -0,0 +1,106 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/types.h>
+
+#include <machine/vmm.h>
+#include <vmmapi.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+
+#include "bhyverun.h"
+#include "spinup_ap.h"
+
+static void
+spinup_ap_realmode(struct vmctx *ctx, int newcpu, uint64_t *rip)
+{
+	int vector, error;
+	uint16_t cs;
+	uint64_t desc_base;
+	uint32_t desc_limit, desc_access;
+
+	vector = *rip >> PAGE_SHIFT;
+	*rip = 0;
+
+	/*
+	 * Update the %cs and %rip of the guest so that it starts
+	 * executing real mode code at at 'vector << 12'.
+	 */
+	error = vm_set_register(ctx, newcpu, VM_REG_GUEST_RIP, *rip);
+	assert(error == 0);
+
+	error = vm_get_desc(ctx, newcpu, VM_REG_GUEST_CS, &desc_base,
+			    &desc_limit, &desc_access);
+	assert(error == 0);
+
+	desc_base = vector << PAGE_SHIFT;
+	error = vm_set_desc(ctx, newcpu, VM_REG_GUEST_CS,
+			    desc_base, desc_limit, desc_access);
+	assert(error == 0);
+
+	cs = (vector << PAGE_SHIFT) >> 4;
+	error = vm_set_register(ctx, newcpu, VM_REG_GUEST_CS, cs);
+	assert(error == 0);
+}
+
+int
+spinup_ap(struct vmctx *ctx, int vcpu, int newcpu, uint64_t rip)
+{
+	int error;
+
+	assert(newcpu != 0);
+	assert(newcpu < guest_ncpus);
+
+	error = vcpu_reset(ctx, newcpu);
+	assert(error == 0);
+
+	fbsdrun_set_capabilities(ctx, newcpu);
+
+	/*
+	 * Enable the 'unrestricted guest' mode for 'newcpu'.
+	 *
+	 * Set up the processor state in power-on 16-bit mode, with the CS:IP
+	 * init'd to the specified low-mem 4K page.
+	 */
+	error = vm_set_capability(ctx, newcpu, VM_CAP_UNRESTRICTED_GUEST, 1);
+	assert(error == 0);
+
+	spinup_ap_realmode(ctx, newcpu, &rip);
+
+	fbsdrun_addcpu(ctx, vcpu, newcpu, rip);
+
+	return (newcpu);
+}
diff --git a/usr/src/cmd/bhyve/spinup_ap.h b/usr/src/cmd/bhyve/spinup_ap.h
new file mode 100644
index 0000000000..226542f6c3
--- /dev/null
+++ b/usr/src/cmd/bhyve/spinup_ap.h
@@ -0,0 +1,36 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_SPINUP_AP_H_
+#define	_SPINUP_AP_H_
+
+int spinup_ap(struct vmctx *ctx, int vcpu, int newcpu, uint64_t rip);
+
+#endif
diff --git a/usr/src/cmd/bhyve/task_switch.c b/usr/src/cmd/bhyve/task_switch.c
new file mode 100644
index 0000000000..6138bcdef8
--- /dev/null
+++ b/usr/src/cmd/bhyve/task_switch.c
@@ -0,0 +1,939 @@
+/*-
+ * Copyright (c) 2014 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/_iovec.h>
+#include <sys/mman.h>
+
+#include <x86/psl.h>
+#include <x86/segments.h>
+#include <x86/specialreg.h>
+#include <machine/vmm.h>
+#include <machine/vmm_instruction_emul.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <vmmapi.h>
+
+#include "bhyverun.h"
+
+/*
+ * Using 'struct i386tss' is tempting but causes myriad sign extension
+ * issues because all of its fields are defined as signed integers.
+ */
+struct tss32 {
+	uint16_t	tss_link;
+	uint16_t	rsvd1;
+	uint32_t	tss_esp0;
+	uint16_t	tss_ss0;
+	uint16_t	rsvd2;
+	uint32_t	tss_esp1;
+	uint16_t	tss_ss1;
+	uint16_t	rsvd3;
+	uint32_t	tss_esp2;
+	uint16_t	tss_ss2;
+	uint16_t	rsvd4;
+	uint32_t	tss_cr3;
+	uint32_t	tss_eip;
+	uint32_t	tss_eflags;
+	uint32_t	tss_eax;
+	uint32_t	tss_ecx;
+	uint32_t	tss_edx;
+	uint32_t	tss_ebx;
+	uint32_t	tss_esp;
+	uint32_t	tss_ebp;
+	uint32_t	tss_esi;
+	uint32_t	tss_edi;
+	uint16_t	tss_es;
+	uint16_t	rsvd5;
+	uint16_t	tss_cs;
+	uint16_t	rsvd6;
+	uint16_t	tss_ss;
+	uint16_t	rsvd7;
+	uint16_t	tss_ds;
+	uint16_t	rsvd8;
+	uint16_t	tss_fs;
+	uint16_t	rsvd9;
+	uint16_t	tss_gs;
+	uint16_t	rsvd10;
+	uint16_t	tss_ldt;
+	uint16_t	rsvd11;
+	uint16_t	tss_trap;
+	uint16_t	tss_iomap;
+};
+static_assert(sizeof(struct tss32) == 104, "compile-time assertion failed");
+
+#define	SEL_START(sel)	(((sel) & ~0x7))
+#define	SEL_LIMIT(sel)	(((sel) | 0x7))
+#define	TSS_BUSY(type)	(((type) & 0x2) != 0)
+
+static uint64_t
+GETREG(struct vmctx *ctx, int vcpu, int reg)
+{
+	uint64_t val;
+	int error;
+
+	error = vm_get_register(ctx, vcpu, reg, &val);
+	assert(error == 0);
+	return (val);
+}
+
+static void
+SETREG(struct vmctx *ctx, int vcpu, int reg, uint64_t val)
+{
+	int error;
+
+	error = vm_set_register(ctx, vcpu, reg, val);
+	assert(error == 0);
+}
+
+static struct seg_desc
+usd_to_seg_desc(struct user_segment_descriptor *usd)
+{
+	struct seg_desc seg_desc;
+
+	seg_desc.base = (u_int)USD_GETBASE(usd);
+	if (usd->sd_gran)
+		seg_desc.limit = (u_int)(USD_GETLIMIT(usd) << 12) | 0xfff;
+	else
+		seg_desc.limit = (u_int)USD_GETLIMIT(usd);
+	seg_desc.access = usd->sd_type | usd->sd_dpl << 5 | usd->sd_p << 7;
+	seg_desc.access |= usd->sd_xx << 12;
+	seg_desc.access |= usd->sd_def32 << 14;
+	seg_desc.access |= usd->sd_gran << 15;
+
+	return (seg_desc);
+}
+
+/*
+ * Inject an exception with an error code that is a segment selector.
+ * The format of the error code is described in section 6.13, "Error Code",
+ * Intel SDM volume 3.
+ *
+ * Bit 0 (EXT) denotes whether the exception occurred during delivery
+ * of an external event like an interrupt.
+ *
+ * Bit 1 (IDT) indicates whether the selector points to a gate descriptor
+ * in the IDT.
+ *
+ * Bit 2(GDT/LDT) has the usual interpretation of Table Indicator (TI).
+ */
+static void
+sel_exception(struct vmctx *ctx, int vcpu, int vector, uint16_t sel, int ext)
+{
+	/*
+	 * Bit 2 from the selector is retained as-is in the error code.
+	 *
+	 * Bit 1 can be safely cleared because none of the selectors
+	 * encountered during task switch emulation refer to a task
+	 * gate in the IDT.
+	 *
+	 * Bit 0 is set depending on the value of 'ext'.
+	 */
+	sel &= ~0x3;
+	if (ext)
+		sel |= 0x1;
+	vm_inject_fault(ctx, vcpu, vector, 1, sel);
+}
+
+/*
+ * Return 0 if the selector 'sel' in within the limits of the GDT/LDT
+ * and non-zero otherwise.
+ */
+static int
+desc_table_limit_check(struct vmctx *ctx, int vcpu, uint16_t sel)
+{
+	uint64_t base;
+	uint32_t limit, access;
+	int error, reg;
+
+	reg = ISLDT(sel) ? VM_REG_GUEST_LDTR : VM_REG_GUEST_GDTR;
+	error = vm_get_desc(ctx, vcpu, reg, &base, &limit, &access);
+	assert(error == 0);
+
+	if (reg == VM_REG_GUEST_LDTR) {
+		if (SEG_DESC_UNUSABLE(access) || !SEG_DESC_PRESENT(access))
+			return (-1);
+	}
+
+	if (limit < SEL_LIMIT(sel))
+		return (-1);
+	else
+		return (0);
+}
+
+/*
+ * Read/write the segment descriptor 'desc' into the GDT/LDT slot referenced
+ * by the selector 'sel'.
+ *
+ * Returns 0 on success.
+ * Returns 1 if an exception was injected into the guest.
+ * Returns -1 otherwise.
+ */
+static int
+desc_table_rw(struct vmctx *ctx, int vcpu, struct vm_guest_paging *paging,
+    uint16_t sel, struct user_segment_descriptor *desc, bool doread,
+    int *faultptr)
+{
+	struct iovec iov[2];
+	uint64_t base;
+	uint32_t limit, access;
+	int error, reg;
+
+	reg = ISLDT(sel) ? VM_REG_GUEST_LDTR : VM_REG_GUEST_GDTR;
+	error = vm_get_desc(ctx, vcpu, reg, &base, &limit, &access);
+	assert(error == 0);
+	assert(limit >= SEL_LIMIT(sel));
+
+	error = vm_copy_setup(ctx, vcpu, paging, base + SEL_START(sel),
+	    sizeof(*desc), doread ? PROT_READ : PROT_WRITE, iov, nitems(iov),
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+
+	if (doread)
+		vm_copyin(ctx, vcpu, iov, desc, sizeof(*desc));
+	else
+		vm_copyout(ctx, vcpu, desc, iov, sizeof(*desc));
+	return (0);
+}
+
+static int
+desc_table_read(struct vmctx *ctx, int vcpu, struct vm_guest_paging *paging,
+    uint16_t sel, struct user_segment_descriptor *desc, int *faultptr)
+{
+	return (desc_table_rw(ctx, vcpu, paging, sel, desc, true, faultptr));
+}
+
+static int
+desc_table_write(struct vmctx *ctx, int vcpu, struct vm_guest_paging *paging,
+    uint16_t sel, struct user_segment_descriptor *desc, int *faultptr)
+{
+	return (desc_table_rw(ctx, vcpu, paging, sel, desc, false, faultptr));
+}
+
+/*
+ * Read the TSS descriptor referenced by 'sel' into 'desc'.
+ *
+ * Returns 0 on success.
+ * Returns 1 if an exception was injected into the guest.
+ * Returns -1 otherwise.
+ */
+static int
+read_tss_descriptor(struct vmctx *ctx, int vcpu, struct vm_task_switch *ts,
+    uint16_t sel, struct user_segment_descriptor *desc, int *faultptr)
+{
+	struct vm_guest_paging sup_paging;
+	int error;
+
+	assert(!ISLDT(sel));
+	assert(IDXSEL(sel) != 0);
+
+	/* Fetch the new TSS descriptor */
+	if (desc_table_limit_check(ctx, vcpu, sel)) {
+		if (ts->reason == TSR_IRET)
+			sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+		else
+			sel_exception(ctx, vcpu, IDT_GP, sel, ts->ext);
+		return (1);
+	}
+
+	sup_paging = ts->paging;
+	sup_paging.cpl = 0;		/* implicit supervisor mode */
+	error = desc_table_read(ctx, vcpu, &sup_paging, sel, desc, faultptr);
+	return (error);
+}
+
+static bool
+code_desc(int sd_type)
+{
+	/* code descriptor */
+	return ((sd_type & 0x18) == 0x18);
+}
+
+static bool
+stack_desc(int sd_type)
+{
+	/* writable data descriptor */
+	return ((sd_type & 0x1A) == 0x12);
+}
+
+static bool
+data_desc(int sd_type)
+{
+	/* data descriptor or a readable code descriptor */
+	return ((sd_type & 0x18) == 0x10 || (sd_type & 0x1A) == 0x1A);
+}
+
+static bool
+ldt_desc(int sd_type)
+{
+
+	return (sd_type == SDT_SYSLDT);
+}
+
+/*
+ * Validate the descriptor 'seg_desc' associated with 'segment'.
+ */
+static int
+validate_seg_desc(struct vmctx *ctx, int vcpu, struct vm_task_switch *ts,
+    int segment, struct seg_desc *seg_desc, int *faultptr)
+{
+	struct vm_guest_paging sup_paging;
+	struct user_segment_descriptor usd;
+	int error, idtvec;
+	int cpl, dpl, rpl;
+	uint16_t sel, cs;
+	bool ldtseg, codeseg, stackseg, dataseg, conforming;
+
+	ldtseg = codeseg = stackseg = dataseg = false;
+	switch (segment) {
+	case VM_REG_GUEST_LDTR:
+		ldtseg = true;
+		break;
+	case VM_REG_GUEST_CS:
+		codeseg = true;
+		break;
+	case VM_REG_GUEST_SS:
+		stackseg = true;
+		break;
+	case VM_REG_GUEST_DS:
+	case VM_REG_GUEST_ES:
+	case VM_REG_GUEST_FS:
+	case VM_REG_GUEST_GS:
+		dataseg = true;
+		break;
+	default:
+		assert(0);
+	}
+
+	/* Get the segment selector */
+	sel = GETREG(ctx, vcpu, segment);
+
+	/* LDT selector must point into the GDT */
+	if (ldtseg && ISLDT(sel)) {
+		sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+		return (1);
+	}
+
+	/* Descriptor table limit check */
+	if (desc_table_limit_check(ctx, vcpu, sel)) {
+		sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+		return (1);
+	}
+
+	/* NULL selector */
+	if (IDXSEL(sel) == 0) {
+		/* Code and stack segment selectors cannot be NULL */
+		if (codeseg || stackseg) {
+			sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+			return (1);
+		}
+		seg_desc->base = 0;
+		seg_desc->limit = 0;
+		seg_desc->access = 0x10000;	/* unusable */
+		return (0);
+	}
+
+	/* Read the descriptor from the GDT/LDT */
+	sup_paging = ts->paging;
+	sup_paging.cpl = 0;	/* implicit supervisor mode */
+	error = desc_table_read(ctx, vcpu, &sup_paging, sel, &usd, faultptr);
+	if (error || *faultptr)
+		return (error);
+
+	/* Verify that the descriptor type is compatible with the segment */
+	if ((ldtseg && !ldt_desc(usd.sd_type)) ||
+	    (codeseg && !code_desc(usd.sd_type)) ||
+	    (dataseg && !data_desc(usd.sd_type)) ||
+	    (stackseg && !stack_desc(usd.sd_type))) {
+		sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+		return (1);
+	}
+
+	/* Segment must be marked present */
+	if (!usd.sd_p) {
+		if (ldtseg)
+			idtvec = IDT_TS;
+		else if (stackseg)
+			idtvec = IDT_SS;
+		else
+			idtvec = IDT_NP;
+		sel_exception(ctx, vcpu, idtvec, sel, ts->ext);
+		return (1);
+	}
+
+	cs = GETREG(ctx, vcpu, VM_REG_GUEST_CS);
+	cpl = cs & SEL_RPL_MASK;
+	rpl = sel & SEL_RPL_MASK;
+	dpl = usd.sd_dpl;
+
+	if (stackseg && (rpl != cpl || dpl != cpl)) {
+		sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+		return (1);
+	}
+
+	if (codeseg) {
+		conforming = (usd.sd_type & 0x4) ? true : false;
+		if ((conforming && (cpl < dpl)) ||
+		    (!conforming && (cpl != dpl))) {
+			sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+			return (1);
+		}
+	}
+
+	if (dataseg) {
+		/*
+		 * A data segment is always non-conforming except when it's
+		 * descriptor is a readable, conforming code segment.
+		 */
+		if (code_desc(usd.sd_type) && (usd.sd_type & 0x4) != 0)
+			conforming = true;
+		else
+			conforming = false;
+
+		if (!conforming && (rpl > dpl || cpl > dpl)) {
+			sel_exception(ctx, vcpu, IDT_TS, sel, ts->ext);
+			return (1);
+		}
+	}
+	*seg_desc = usd_to_seg_desc(&usd);
+	return (0);
+}
+
+static void
+tss32_save(struct vmctx *ctx, int vcpu, struct vm_task_switch *task_switch,
+    uint32_t eip, struct tss32 *tss, struct iovec *iov)
+{
+
+	/* General purpose registers */
+	tss->tss_eax = GETREG(ctx, vcpu, VM_REG_GUEST_RAX);
+	tss->tss_ecx = GETREG(ctx, vcpu, VM_REG_GUEST_RCX);
+	tss->tss_edx = GETREG(ctx, vcpu, VM_REG_GUEST_RDX);
+	tss->tss_ebx = GETREG(ctx, vcpu, VM_REG_GUEST_RBX);
+	tss->tss_esp = GETREG(ctx, vcpu, VM_REG_GUEST_RSP);
+	tss->tss_ebp = GETREG(ctx, vcpu, VM_REG_GUEST_RBP);
+	tss->tss_esi = GETREG(ctx, vcpu, VM_REG_GUEST_RSI);
+	tss->tss_edi = GETREG(ctx, vcpu, VM_REG_GUEST_RDI);
+
+	/* Segment selectors */
+	tss->tss_es = GETREG(ctx, vcpu, VM_REG_GUEST_ES);
+	tss->tss_cs = GETREG(ctx, vcpu, VM_REG_GUEST_CS);
+	tss->tss_ss = GETREG(ctx, vcpu, VM_REG_GUEST_SS);
+	tss->tss_ds = GETREG(ctx, vcpu, VM_REG_GUEST_DS);
+	tss->tss_fs = GETREG(ctx, vcpu, VM_REG_GUEST_FS);
+	tss->tss_gs = GETREG(ctx, vcpu, VM_REG_GUEST_GS);
+
+	/* eflags and eip */
+	tss->tss_eflags = GETREG(ctx, vcpu, VM_REG_GUEST_RFLAGS);
+	if (task_switch->reason == TSR_IRET)
+		tss->tss_eflags &= ~PSL_NT;
+	tss->tss_eip = eip;
+
+	/* Copy updated old TSS into guest memory */
+	vm_copyout(ctx, vcpu, tss, iov, sizeof(struct tss32));
+}
+
+static void
+update_seg_desc(struct vmctx *ctx, int vcpu, int reg, struct seg_desc *sd)
+{
+	int error;
+
+	error = vm_set_desc(ctx, vcpu, reg, sd->base, sd->limit, sd->access);
+	assert(error == 0);
+}
+
+/*
+ * Update the vcpu registers to reflect the state of the new task.
+ */
+static int
+tss32_restore(struct vmctx *ctx, int vcpu, struct vm_task_switch *ts,
+    uint16_t ot_sel, struct tss32 *tss, struct iovec *iov, int *faultptr)
+{
+	struct seg_desc seg_desc, seg_desc2;
+	uint64_t *pdpte, maxphyaddr, reserved;
+	uint32_t eflags;
+	int error, i;
+	bool nested;
+
+	nested = false;
+	if (ts->reason != TSR_IRET && ts->reason != TSR_JMP) {
+		tss->tss_link = ot_sel;
+		nested = true;
+	}
+
+	eflags = tss->tss_eflags;
+	if (nested)
+		eflags |= PSL_NT;
+
+	/* LDTR */
+	SETREG(ctx, vcpu, VM_REG_GUEST_LDTR, tss->tss_ldt);
+
+	/* PBDR */
+	if (ts->paging.paging_mode != PAGING_MODE_FLAT) {
+		if (ts->paging.paging_mode == PAGING_MODE_PAE) {
+			/*
+			 * XXX Assuming 36-bit MAXPHYADDR.
+			 */
+			maxphyaddr = (1UL << 36) - 1;
+			pdpte = paddr_guest2host(ctx, tss->tss_cr3 & ~0x1f, 32);
+			for (i = 0; i < 4; i++) {
+				/* Check reserved bits if the PDPTE is valid */
+				if (!(pdpte[i] & 0x1))
+					continue;
+				/*
+				 * Bits 2:1, 8:5 and bits above the processor's
+				 * maximum physical address are reserved.
+				 */
+				reserved = ~maxphyaddr | 0x1E6;
+				if (pdpte[i] & reserved) {
+					vm_inject_gp(ctx, vcpu);
+					return (1);
+				}
+			}
+			SETREG(ctx, vcpu, VM_REG_GUEST_PDPTE0, pdpte[0]);
+			SETREG(ctx, vcpu, VM_REG_GUEST_PDPTE1, pdpte[1]);
+			SETREG(ctx, vcpu, VM_REG_GUEST_PDPTE2, pdpte[2]);
+			SETREG(ctx, vcpu, VM_REG_GUEST_PDPTE3, pdpte[3]);
+		}
+		SETREG(ctx, vcpu, VM_REG_GUEST_CR3, tss->tss_cr3);
+		ts->paging.cr3 = tss->tss_cr3;
+	}
+
+	/* eflags and eip */
+	SETREG(ctx, vcpu, VM_REG_GUEST_RFLAGS, eflags);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RIP, tss->tss_eip);
+
+	/* General purpose registers */
+	SETREG(ctx, vcpu, VM_REG_GUEST_RAX, tss->tss_eax);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RCX, tss->tss_ecx);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RDX, tss->tss_edx);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RBX, tss->tss_ebx);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RSP, tss->tss_esp);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RBP, tss->tss_ebp);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RSI, tss->tss_esi);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RDI, tss->tss_edi);
+
+	/* Segment selectors */
+	SETREG(ctx, vcpu, VM_REG_GUEST_ES, tss->tss_es);
+	SETREG(ctx, vcpu, VM_REG_GUEST_CS, tss->tss_cs);
+	SETREG(ctx, vcpu, VM_REG_GUEST_SS, tss->tss_ss);
+	SETREG(ctx, vcpu, VM_REG_GUEST_DS, tss->tss_ds);
+	SETREG(ctx, vcpu, VM_REG_GUEST_FS, tss->tss_fs);
+	SETREG(ctx, vcpu, VM_REG_GUEST_GS, tss->tss_gs);
+
+	/*
+	 * If this is a nested task then write out the new TSS to update
+	 * the previous link field.
+	 */
+	if (nested)
+		vm_copyout(ctx, vcpu, tss, iov, sizeof(*tss));
+
+	/* Validate segment descriptors */
+	error = validate_seg_desc(ctx, vcpu, ts, VM_REG_GUEST_LDTR, &seg_desc,
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_LDTR, &seg_desc);
+
+	/*
+	 * Section "Checks on Guest Segment Registers", Intel SDM, Vol 3.
+	 *
+	 * The SS and CS attribute checks on VM-entry are inter-dependent so
+	 * we need to make sure that both segments are valid before updating
+	 * either of them. This ensures that the VMCS state can pass the
+	 * VM-entry checks so the guest can handle any exception injected
+	 * during task switch emulation.
+	 */
+	error = validate_seg_desc(ctx, vcpu, ts, VM_REG_GUEST_CS, &seg_desc,
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+
+	error = validate_seg_desc(ctx, vcpu, ts, VM_REG_GUEST_SS, &seg_desc2,
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_CS, &seg_desc);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_SS, &seg_desc2);
+	ts->paging.cpl = tss->tss_cs & SEL_RPL_MASK;
+
+	error = validate_seg_desc(ctx, vcpu, ts, VM_REG_GUEST_DS, &seg_desc,
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_DS, &seg_desc);
+
+	error = validate_seg_desc(ctx, vcpu, ts, VM_REG_GUEST_ES, &seg_desc,
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_ES, &seg_desc);
+
+	error = validate_seg_desc(ctx, vcpu, ts, VM_REG_GUEST_FS, &seg_desc,
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_FS, &seg_desc);
+
+	error = validate_seg_desc(ctx, vcpu, ts, VM_REG_GUEST_GS, &seg_desc,
+	    faultptr);
+	if (error || *faultptr)
+		return (error);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_GS, &seg_desc);
+
+	return (0);
+}
+
+/*
+ * Push an error code on the stack of the new task. This is needed if the
+ * task switch was triggered by a hardware exception that causes an error
+ * code to be saved (e.g. #PF).
+ */
+static int
+push_errcode(struct vmctx *ctx, int vcpu, struct vm_guest_paging *paging,
+    int task_type, uint32_t errcode, int *faultptr)
+{
+	struct iovec iov[2];
+	struct seg_desc seg_desc;
+	int stacksize, bytes, error;
+	uint64_t gla, cr0, rflags;
+	uint32_t esp;
+	uint16_t stacksel;
+
+	*faultptr = 0;
+
+	cr0 = GETREG(ctx, vcpu, VM_REG_GUEST_CR0);
+	rflags = GETREG(ctx, vcpu, VM_REG_GUEST_RFLAGS);
+	stacksel = GETREG(ctx, vcpu, VM_REG_GUEST_SS);
+
+	error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_SS, &seg_desc.base,
+	    &seg_desc.limit, &seg_desc.access);
+	assert(error == 0);
+
+	/*
+	 * Section "Error Code" in the Intel SDM vol 3: the error code is
+	 * pushed on the stack as a doubleword or word (depending on the
+	 * default interrupt, trap or task gate size).
+	 */
+	if (task_type == SDT_SYS386BSY || task_type == SDT_SYS386TSS)
+		bytes = 4;
+	else
+		bytes = 2;
+
+	/*
+	 * PUSH instruction from Intel SDM vol 2: the 'B' flag in the
+	 * stack-segment descriptor determines the size of the stack
+	 * pointer outside of 64-bit mode.
+	 */
+	if (SEG_DESC_DEF32(seg_desc.access))
+		stacksize = 4;
+	else
+		stacksize = 2;
+
+	esp = GETREG(ctx, vcpu, VM_REG_GUEST_RSP);
+	esp -= bytes;
+
+	if (vie_calculate_gla(paging->cpu_mode, VM_REG_GUEST_SS,
+	    &seg_desc, esp, bytes, stacksize, PROT_WRITE, &gla)) {
+		sel_exception(ctx, vcpu, IDT_SS, stacksel, 1);
+		*faultptr = 1;
+		return (0);
+	}
+
+	if (vie_alignment_check(paging->cpl, bytes, cr0, rflags, gla)) {
+		vm_inject_ac(ctx, vcpu, 1);
+		*faultptr = 1;
+		return (0);
+	}
+
+	error = vm_copy_setup(ctx, vcpu, paging, gla, bytes, PROT_WRITE,
+	    iov, nitems(iov), faultptr);
+	if (error || *faultptr)
+		return (error);
+
+	vm_copyout(ctx, vcpu, &errcode, iov, bytes);
+	SETREG(ctx, vcpu, VM_REG_GUEST_RSP, esp);
+	return (0);
+}
+
+/*
+ * Evaluate return value from helper functions and potentially return to
+ * the VM run loop.
+ */
+#define	CHKERR(error,fault)						\
+	do {								\
+		assert((error == 0) || (error == EFAULT));		\
+		if (error)						\
+			return (VMEXIT_ABORT);				\
+		else if (fault)						\
+			return (VMEXIT_CONTINUE);			\
+	} while (0)
+
+int
+vmexit_task_switch(struct vmctx *ctx, struct vm_exit *vmexit, int *pvcpu)
+{
+	struct seg_desc nt;
+	struct tss32 oldtss, newtss;
+	struct vm_task_switch *task_switch;
+	struct vm_guest_paging *paging, sup_paging;
+	struct user_segment_descriptor nt_desc, ot_desc;
+	struct iovec nt_iov[2], ot_iov[2];
+	uint64_t cr0, ot_base;
+	uint32_t eip, ot_lim, access;
+	int error, ext, fault, minlimit, nt_type, ot_type, vcpu;
+	enum task_switch_reason reason;
+	uint16_t nt_sel, ot_sel;
+
+	task_switch = &vmexit->u.task_switch;
+	nt_sel = task_switch->tsssel;
+	ext = vmexit->u.task_switch.ext;
+	reason = vmexit->u.task_switch.reason;
+	paging = &vmexit->u.task_switch.paging;
+	vcpu = *pvcpu;
+
+	assert(paging->cpu_mode == CPU_MODE_PROTECTED);
+
+	/*
+	 * Calculate the instruction pointer to store in the old TSS.
+	 */
+	eip = vmexit->rip + vmexit->inst_length;
+
+	/*
+	 * Section 4.6, "Access Rights" in Intel SDM Vol 3.
+	 * The following page table accesses are implicitly supervisor mode:
+	 * - accesses to GDT or LDT to load segment descriptors
+	 * - accesses to the task state segment during task switch
+	 */
+	sup_paging = *paging;
+	sup_paging.cpl = 0;	/* implicit supervisor mode */
+
+	/* Fetch the new TSS descriptor */
+	error = read_tss_descriptor(ctx, vcpu, task_switch, nt_sel, &nt_desc,
+	    &fault);
+	CHKERR(error, fault);
+
+	nt = usd_to_seg_desc(&nt_desc);
+
+	/* Verify the type of the new TSS */
+	nt_type = SEG_DESC_TYPE(nt.access);
+	if (nt_type != SDT_SYS386BSY && nt_type != SDT_SYS386TSS &&
+	    nt_type != SDT_SYS286BSY && nt_type != SDT_SYS286TSS) {
+		sel_exception(ctx, vcpu, IDT_TS, nt_sel, ext);
+		goto done;
+	}
+
+	/* TSS descriptor must have present bit set */
+	if (!SEG_DESC_PRESENT(nt.access)) {
+		sel_exception(ctx, vcpu, IDT_NP, nt_sel, ext);
+		goto done;
+	}
+
+	/*
+	 * TSS must have a minimum length of 104 bytes for a 32-bit TSS and
+	 * 44 bytes for a 16-bit TSS.
+	 */
+	if (nt_type == SDT_SYS386BSY || nt_type == SDT_SYS386TSS)
+		minlimit = 104 - 1;
+	else if (nt_type == SDT_SYS286BSY || nt_type == SDT_SYS286TSS)
+		minlimit = 44 - 1;
+	else
+		minlimit = 0;
+
+	assert(minlimit > 0);
+	if (nt.limit < minlimit) {
+		sel_exception(ctx, vcpu, IDT_TS, nt_sel, ext);
+		goto done;
+	}
+
+	/* TSS must be busy if task switch is due to IRET */
+	if (reason == TSR_IRET && !TSS_BUSY(nt_type)) {
+		sel_exception(ctx, vcpu, IDT_TS, nt_sel, ext);
+		goto done;
+	}
+
+	/*
+	 * TSS must be available (not busy) if task switch reason is
+	 * CALL, JMP, exception or interrupt.
+	 */
+	if (reason != TSR_IRET && TSS_BUSY(nt_type)) {
+		sel_exception(ctx, vcpu, IDT_GP, nt_sel, ext);
+		goto done;
+	}
+
+	/* Fetch the new TSS */
+	error = vm_copy_setup(ctx, vcpu, &sup_paging, nt.base, minlimit + 1,
+	    PROT_READ | PROT_WRITE, nt_iov, nitems(nt_iov), &fault);
+	CHKERR(error, fault);
+	vm_copyin(ctx, vcpu, nt_iov, &newtss, minlimit + 1);
+
+	/* Get the old TSS selector from the guest's task register */
+	ot_sel = GETREG(ctx, vcpu, VM_REG_GUEST_TR);
+	if (ISLDT(ot_sel) || IDXSEL(ot_sel) == 0) {
+		/*
+		 * This might happen if a task switch was attempted without
+		 * ever loading the task register with LTR. In this case the
+		 * TR would contain the values from power-on:
+		 * (sel = 0, base = 0, limit = 0xffff).
+		 */
+		sel_exception(ctx, vcpu, IDT_TS, ot_sel, task_switch->ext);
+		goto done;
+	}
+
+	/* Get the old TSS base and limit from the guest's task register */
+	error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_TR, &ot_base, &ot_lim,
+	    &access);
+	assert(error == 0);
+	assert(!SEG_DESC_UNUSABLE(access) && SEG_DESC_PRESENT(access));
+	ot_type = SEG_DESC_TYPE(access);
+	assert(ot_type == SDT_SYS386BSY || ot_type == SDT_SYS286BSY);
+
+	/* Fetch the old TSS descriptor */
+	error = read_tss_descriptor(ctx, vcpu, task_switch, ot_sel, &ot_desc,
+	    &fault);
+	CHKERR(error, fault);
+
+	/* Get the old TSS */
+	error = vm_copy_setup(ctx, vcpu, &sup_paging, ot_base, minlimit + 1,
+	    PROT_READ | PROT_WRITE, ot_iov, nitems(ot_iov), &fault);
+	CHKERR(error, fault);
+	vm_copyin(ctx, vcpu, ot_iov, &oldtss, minlimit + 1);
+
+	/*
+	 * Clear the busy bit in the old TSS descriptor if the task switch
+	 * due to an IRET or JMP instruction.
+	 */
+	if (reason == TSR_IRET || reason == TSR_JMP) {
+		ot_desc.sd_type &= ~0x2;
+		error = desc_table_write(ctx, vcpu, &sup_paging, ot_sel,
+		    &ot_desc, &fault);
+		CHKERR(error, fault);
+	}
+
+	if (nt_type == SDT_SYS286BSY || nt_type == SDT_SYS286TSS) {
+		fprintf(stderr, "Task switch to 16-bit TSS not supported\n");
+		return (VMEXIT_ABORT);
+	}
+
+	/* Save processor state in old TSS */
+	tss32_save(ctx, vcpu, task_switch, eip, &oldtss, ot_iov);
+
+	/*
+	 * If the task switch was triggered for any reason other than IRET
+	 * then set the busy bit in the new TSS descriptor.
+	 */
+	if (reason != TSR_IRET) {
+		nt_desc.sd_type |= 0x2;
+		error = desc_table_write(ctx, vcpu, &sup_paging, nt_sel,
+		    &nt_desc, &fault);
+		CHKERR(error, fault);
+	}
+
+	/* Update task register to point at the new TSS */
+	SETREG(ctx, vcpu, VM_REG_GUEST_TR, nt_sel);
+
+	/* Update the hidden descriptor state of the task register */
+	nt = usd_to_seg_desc(&nt_desc);
+	update_seg_desc(ctx, vcpu, VM_REG_GUEST_TR, &nt);
+
+	/* Set CR0.TS */
+	cr0 = GETREG(ctx, vcpu, VM_REG_GUEST_CR0);
+	SETREG(ctx, vcpu, VM_REG_GUEST_CR0, cr0 | CR0_TS);
+
+	/*
+	 * We are now committed to the task switch. Any exceptions encountered
+	 * after this point will be handled in the context of the new task and
+	 * the saved instruction pointer will belong to the new task.
+	 */
+	error = vm_set_register(ctx, vcpu, VM_REG_GUEST_RIP, newtss.tss_eip);
+	assert(error == 0);
+
+	/* Load processor state from new TSS */
+	error = tss32_restore(ctx, vcpu, task_switch, ot_sel, &newtss, nt_iov,
+	    &fault);
+	CHKERR(error, fault);
+
+	/*
+	 * Section "Interrupt Tasks" in Intel SDM, Vol 3: if an exception
+	 * caused an error code to be generated, this error code is copied
+	 * to the stack of the new task.
+	 */
+	if (task_switch->errcode_valid) {
+		assert(task_switch->ext);
+		assert(task_switch->reason == TSR_IDT_GATE);
+		error = push_errcode(ctx, vcpu, &task_switch->paging, nt_type,
+		    task_switch->errcode, &fault);
+		CHKERR(error, fault);
+	}
+
+	/*
+	 * Treatment of virtual-NMI blocking if NMI is delivered through
+	 * a task gate.
+	 *
+	 * Section "Architectural State Before A VM Exit", Intel SDM, Vol3:
+	 * If the virtual NMIs VM-execution control is 1, VM entry injects
+	 * an NMI, and delivery of the NMI causes a task switch that causes
+	 * a VM exit, virtual-NMI blocking is in effect before the VM exit
+	 * commences.
+	 *
+	 * Thus, virtual-NMI blocking is in effect at the time of the task
+	 * switch VM exit.
+	 */
+
+	/*
+	 * Treatment of virtual-NMI unblocking on IRET from NMI handler task.
+	 *
+	 * Section "Changes to Instruction Behavior in VMX Non-Root Operation"
+	 * If "virtual NMIs" control is 1 IRET removes any virtual-NMI blocking.
+	 * This unblocking of virtual-NMI occurs even if IRET causes a fault.
+	 *
+	 * Thus, virtual-NMI blocking is cleared at the time of the task switch
+	 * VM exit.
+	 */
+
+	/*
+	 * If the task switch was triggered by an event delivered through
+	 * the IDT then extinguish the pending event from the vcpu's
+	 * exitintinfo.
+	 */
+	if (task_switch->reason == TSR_IDT_GATE) {
+		error = vm_set_intinfo(ctx, vcpu, 0);
+		assert(error == 0);
+	}
+
+	/*
+	 * XXX should inject debug exception if 'T' bit is 1
+	 */
+done:
+	return (VMEXIT_CONTINUE);
+}
diff --git a/usr/src/cmd/bhyve/test/Makefile b/usr/src/cmd/bhyve/test/Makefile
new file mode 100644
index 0000000000..7dbee0c5f3
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+SUBDIRS = scripts tst
+
+include Makefile.subdirs
diff --git a/usr/src/cmd/bhyve/test/Makefile.com b/usr/src/cmd/bhyve/test/Makefile.com
new file mode 100644
index 0000000000..3c719bcea7
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/Makefile.com
@@ -0,0 +1,60 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include $(SRC)/Makefile.master
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/cmd/Makefile.cmd.64
+
+#
+# Force c99 for everything
+#
+CSTD=		$(CSTD_GNU99)
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+CFLAGS +=	$(CCVERBOSE) -_gcc=-Wimplicit-function-declaration \
+		-_gcc=-Wno-parentheses
+CFLAGS64 +=	$(CCVERBOSE) -_gcc=-Wimplicit-function-declaration \
+		-_gcc=-Wno-parentheses
+CPPFLAGS =	-I$(SRC)/cmd/bhyve \
+		-I$(COMPAT)/freebsd -I$(CONTRIB)/freebsd \
+		-I$(CONTRIB)/freebsd/dev/usb/controller \
+		-I$(CONTRIB)/freebsd/dev/mii \
+		$(CPPFLAGS.master) \
+		-I$(ROOT)/usr/platform/i86pc/include \
+		-I$(SRC)/uts/i86pc/io/vmm \
+		-I$(SRC)/uts/common \
+		-I$(SRC)/uts/i86pc \
+		-I$(SRC)/lib/libdladm/common \
+		-DWITHOUT_CAPSICUM
+CPPFLAGS +=	-I$(COMPAT)/freebsd/amd64 -I$(CONTRIB)/freebsd/amd64
+
+CLEANFILES +=	$(EXETESTS)
+CLOBBERFILES +=	$(ROOTTESTS)
+
+#
+# Install related definitions
+#
+ROOTOPTPKG =	$(ROOT)/opt/bhyvetest
+ROOTBIN =	$(ROOTOPTPKG)/bin
+ROOTTST =	$(ROOTOPTPKG)/tst
+ROOTTSTDIR =	$(ROOTTST)/$(TSTDIR)
+ROOTTSTEXES =	$(EXETESTS:%=$(ROOTTSTDIR)/%)
+ROOTTSTSH =	$(SHTESTS:%=$(ROOTTSTDIR)/%)
+ROOTOUT =	$(OUTFILES:%=$(ROOTTSTDIR)/%)
+ROOTTESTS =	$(ROOTTSTEXES) $(ROOTTSTSH) $(ROOTOUT)
+FILEMODE =	0555
+LDLIBS =	$(LDLIBS.cmd)
+LINTEXE =	$(EXETESTS:%.exe=%.exe.ln)
diff --git a/usr/src/cmd/bhyve/test/Makefile.subdirs b/usr/src/cmd/bhyve/test/Makefile.subdirs
new file mode 100644
index 0000000000..45f0aa67fa
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/Makefile.subdirs
@@ -0,0 +1,29 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+.KEEP_STATE:
+
+all	:= TARGET += all
+clean	:= TARGET += clean
+clobber	:= TARGET += clobber
+install	:= TARGET += install
+lint	:= TARGET += lint
+
+all clean clobber install lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/cmd/bhyve/test/Makefile.targ b/usr/src/cmd/bhyve/test/Makefile.targ
new file mode 100644
index 0000000000..e3ec55cfdb
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/Makefile.targ
@@ -0,0 +1,55 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+$(ROOTOPTPKG):
+	$(INS.dir)
+
+$(ROOTBIN): $(ROOTOPTPKG)
+	$(INS.dir)
+
+$(ROOTBIN)/%: %.ksh $(ROOTBIN)
+	$(INS.rename)
+
+$(ROOTTST): $(ROOTOPTPKG)
+	$(INS.dir)
+
+$(ROOTTSTDIR): $(ROOTTST)
+	$(INS.dir)
+
+$(ROOTTSTDIR)/%.ksh: %.ksh $(ROOTTSTDIR)
+	$(INS.file)
+
+$(ROOTTSTDIR)/%.out: %.out $(ROOTTSTDIR)
+	$(INS.file)
+
+%.exe: %.o $(SUPOBJS)
+	$(LINK.c) -o $@ $< $(SUPOBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+$(ROOTTSTDIR)/%.exe: %.exe $(ROOTTSTDIR)
+	$(INS.file)
+
+all: install
+
+%.exe.ln: %.c $(SUPOBJS)
+	$(LINT.c) $< $(LDLIBS)
+
+lint: $(LINTEXE)
+
+clean:
+	-$(RM) *.o $(CLEANFILES)
+
+clobber: clean
+	-$(RM) $(CLOBBERFILES)
diff --git a/usr/src/cmd/bhyve/test/scripts/Makefile b/usr/src/cmd/bhyve/test/scripts/Makefile
new file mode 100644
index 0000000000..d28a5edb8f
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/scripts/Makefile
@@ -0,0 +1,28 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+SRCS =		bhyvetest
+SCRIPTS =	$(SRCS:%=$(ROOTBIN)/%)
+
+SCRIPTS :=	FILEMODE = 0555
+CLOBBERFILES =	$(SCRIPTS)
+
+install: $(SCRIPTS)
+
+lint:
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/bhyve/test/scripts/bhyvetest.ksh b/usr/src/cmd/bhyve/test/scripts/bhyvetest.ksh
new file mode 100644
index 0000000000..95b7743417
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/scripts/bhyvetest.ksh
@@ -0,0 +1,231 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+#
+# bhyve test suite driver
+#
+unalias -a
+
+bt_arg0=$(basename $0)
+bt_root="$(cd $(dirname $0)/..; pwd -P)"
+bt_ksh="/usr/bin/ksh"
+bt_outdir=
+bt_keep=
+bt_all=
+bt_tnum=0
+bt_tfail=0
+bt_tsuc=0
+
+function usage
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] || echo "$msg" 2>&1
+	cat <<USAGE >&2
+Usage: $bt_arg0  [ -o dir ] [ -k ] [ -a | test ... ]
+
+	-o dir		Sets 'dir' as the output directory
+	-a		Runs all tests, ignores tests passed in
+	-k		Keep output from all tests, not just failures
+	-m		mdb binary to test
+USAGE
+	exit 2
+}
+
+function fatal
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "$bt_arg0: $msg" >&2
+	exit 1
+}
+
+function setup_outdir
+{
+	bt_outdir="$bt_outdir/$bt_arg0.$$"
+	mkdir -p $bt_outdir || fatal "failed to make output dir $bt_outdir"
+}
+
+function run_single
+{
+	typeset name=$1
+	typeset expect base ext exe command odir res reason
+	typeset iserr
+
+	[[ -z "$name" ]] && fail "missing test to run"
+	base=${name##*/}
+	ext=${base##*.}
+	expect=${base%%.*}
+	odir="$bt_outdir/current"
+	[[ -z "$ext" ]] && fatal "found test without ext: $name"
+	[[ -z "$expect" ]] && fatal "found test without prefix: $name"
+
+	if [[ "$expect" == "err" || "$expect" == "ecreate" ]]; then
+		iserr="yup"
+	else
+		iserr=""
+	fi
+
+	case "$ext" in
+	"ksh")
+		command="$bt_ksh ./$base"
+		;;
+	"exe")
+		command="./$base"
+		;;
+	"out")
+		#
+		# This is the file format for checking output against.
+		#
+		return 0
+		;;
+	*)
+		echo "skipping test $name (unknown extensino)"
+		return 0
+		;;
+	esac
+
+	echo "Executing test $name ... \c"
+	mkdir -p "$odir" >/dev/null || fatal "can't make output directory"
+	cd $(dirname $name) || fatal "failed to enter test directory"
+	$command > "$odir/stdout" 2>"$odir/stderr"
+	res=$?
+	cd - > /dev/null || fatal "failed to leave test directory"
+
+	if [[ -f "$name.out" ]] && \
+	    ! diff "$name.out" "$odir/stdout" >/dev/null; then
+		cp $name.out $odir/$base.out
+		reason="stdout mismatch"
+	elif [[ -n "$iserr" && $res -eq 0 ]]; then
+		reason="test exited $res, not non-zero"
+	elif [[ -z "$iserr" && $res -ne 0 ]]; then
+		reason="test exited $res, not zero"
+	fi
+
+	if [[ -n "$reason" ]]; then
+		echo "$reason"
+		((bt_tfail++))
+		mv "$odir" "$bt_outdir/failure.$bt_tfail" || fatal \
+		    "failed to move test output directory"
+		cp "$name" "$bt_outdir/failure.$bt_tfail/$(basename $name)" || \
+		    fatal "failed to copy test into output directory"
+	else
+		echo "passed"
+		((bt_tsuc++))
+		mv "$odir" "$bt_outdir/success.$bt_tsuc" || fatal \
+		    "failed to move test directory"
+	fi
+
+	((bt_tnum++))
+}
+
+function run_all
+{
+	typeset tests t dir
+
+	tests=$(ls -1 $bt_root/tst/*/*.@(ksh|exe))
+	for t in $tests; do
+		run_single $t
+	done
+}
+
+function welcome
+{
+	cat <<WELCOME
+Starting tests...
+output directory: $bt_outdir
+WELCOME
+}
+
+function cleanup
+{
+	[[ -n "$bt_keep" ]] && return
+	rm -rf "$bt_outdir"/success.* || fatal \
+	     "failed to remove successful test cases"
+	if [[ $bt_tfail -eq 0 ]]; then
+		rmdir "$bt_outdir" || fatal \
+		    "failed to remove test output directory"
+	fi
+}
+
+function goodbye
+{
+	cat <<EOF
+
+-------------
+Results
+-------------
+
+Tests passed: $bt_tsuc
+Tests failed: $bt_tfail
+Tests ran:    $bt_tnum
+
+EOF
+	if [[ $bt_tfail  -eq 0 ]]; then
+		echo "Congrats, some tiny parts of bhyve aren't completely" \
+		    "broken, the tests pass".
+	else
+		echo "Some tests failed, you have some work to do."
+	fi
+}
+
+while getopts ":ahko:m:" c $@; do
+	case "$c" in
+	a)
+		bt_all="y"
+		;;
+	k)
+		bt_keep="y"
+		;;
+	o)
+		bt_outdir="$OPTARG"
+		;;
+	h)
+		usage
+		;;
+	:)
+		usage "option requires an argument -- $OPTARG"
+		;;
+	*)
+		usage "invalid option -- $OPTARG"
+		;;
+	esac
+done
+
+shift $((OPTIND-1))
+
+[[ -z "$bt_all" && $# == 0 ]] && usage "no tests to run"
+
+[[ -z "$bt_outdir" ]] && bt_outdir="$PWD"
+
+setup_outdir
+welcome
+
+if [[ ! -z "$bt_all" ]]; then
+	run_all
+else
+	for t in $@; do
+		[[ -f $t ]] || fatal "cannot find test $t"
+		run_single $t
+	done
+fi
+
+goodbye
+cleanup
+
+#
+# Exit 1 if we have tests that return non-zero
+#
+[[ $bt_tfai -eq 0 ]]
diff --git a/usr/src/cmd/bhyve/test/tst/Makefile b/usr/src/cmd/bhyve/test/tst/Makefile
new file mode 100644
index 0000000000..f6a6ec96fc
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+SUBDIRS = mevent
+
+include ../Makefile.subdirs
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/Makefile b/usr/src/cmd/bhyve/test/tst/mevent/Makefile
new file mode 100644
index 0000000000..047886bc6a
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/Makefile
@@ -0,0 +1,30 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+TSTDIR =	mevent
+EXETESTS = \
+		lists.delete.exe \
+		read.disable.exe \
+		read.pause.exe \
+		read.requeue.exe \
+
+SHTESTS =
+SUPOBJS =	mevent.o testlib.o
+
+include ../../Makefile.com
+
+install: $(ROOTTESTS)
+
+include ../../Makefile.targ
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/lists.delete.c b/usr/src/cmd/bhyve/test/tst/mevent/lists.delete.c
new file mode 100644
index 0000000000..d09ac133a3
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/lists.delete.c
@@ -0,0 +1,172 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ *        Test:	lists.delete
+ *   Assertion: mevent_delete() causes the total number of events to decrease
+ *
+ *    Strategy: 1. Create a pipe.
+ *		2. Call mevent_add() to be notified of writes to the pipe.  The
+ *		   callback will do nothing other than generate an error if it
+ *		   is called.
+ *		3. Create another pipe and add a read event watcher to it.  The
+ *		   callback will signal a cv when called.  A write to the pipe
+ *		   followed by a wait on the cv will ensure that async
+ *		   operations in mevent.c are complete.  See flush_and_wait().
+ *		4. Call flush_and_wait(), then get event count.
+ *		5. Delete the event created in step 2.
+ *		6. Call flush_and_wait(), then get event count.
+ *		7. Verify result in step 6 is one less than result in step 4.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <unistd.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "testlib.h"
+#include "mevent.h"
+
+static pthread_mutex_t mtx = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t cv = PTHREAD_COND_INITIALIZER;
+
+static int
+get_count(void)
+{
+	int global = -1, change = -1, del_pending = -1;
+	int total;
+
+	test_mevent_count_lists(&global, &change, &del_pending);
+	ASSERT_INT_NEQ(("count not set"), global, -1);
+	ASSERT_INT_NEQ(("count not set"), change, -1);
+	ASSERT_INT_NEQ(("count not set"), change, -1);
+	ASSERT_INT_EQ(("pending delete not processed"), del_pending, 0);
+
+	total = global + change + del_pending;
+
+	VERBOSE(("count = %d (%d + %d + %d)", total, global, change,
+	    del_pending));
+
+	return (total);
+}
+
+static void
+not_called_cb(int fd, enum ev_type ev, void *arg)
+{
+	FAIL(("this callback should never be called"));
+}
+
+static void
+flush_cb(int fd, enum ev_type ev, void *arg)
+{
+	char buf[32];
+
+	/* Drain the pipe */
+	while (read(fd, buf, sizeof (buf)) > 0)
+		;
+
+	pthread_mutex_lock(&mtx);
+	pthread_cond_signal(&cv);
+	pthread_mutex_unlock(&mtx);
+}
+
+void
+flush_and_wait(int fd)
+{
+	uint8_t msg = 42;
+
+	/*
+	 * Lock taken ahead of waking flush_cb so this thread doesn't race
+	 * with the event thread.
+	 */
+	pthread_mutex_lock(&mtx);
+	if (write(fd, &msg, sizeof (msg)) != sizeof (msg)) {
+		FAIL(("bad write"));
+	}
+
+	/* Wait for it to be read */
+	pthread_cond_wait(&cv, &mtx);
+	pthread_mutex_unlock(&mtx);
+}
+
+int
+main(int argc, const char *argv[])
+{
+	int unused_pipe[2];
+	int flush_pipe[2];
+	struct mevent *unused_evp, *flush_evp;
+	int count1, count2;
+
+	start_test(argv[0], 5);
+	start_event_thread();
+
+	/*
+	 * Create first pipe and related event
+	 */
+	if (pipe(unused_pipe) != 0) {
+		FAIL_ERRNO("pipe");
+	}
+	VERBOSE(("unused_pipe[] = { %d, %d }", unused_pipe[0], unused_pipe[1]));
+	if (fcntl(unused_pipe[0], F_SETFL, O_NONBLOCK) != 0) {
+		FAIL_ERRNO("set pipe nonblocking");
+	}
+	unused_evp = mevent_add(unused_pipe[0], EVF_READ, not_called_cb, NULL);
+	ASSERT_PTR_NEQ(("mevent_add"), unused_evp, NULL);
+
+	/*
+	 * Create flush pipe and related event
+	 */
+	if (pipe(flush_pipe) != 0) {
+		FAIL_ERRNO("pipe");
+	}
+	VERBOSE(("flush_pipe[] = { %d, %d }", flush_pipe[0],
+	    flush_pipe[1]));
+	if (fcntl(flush_pipe[0], F_SETFL, O_NONBLOCK) != 0) {
+		FAIL_ERRNO("set pipe nonblocking");
+	}
+	flush_evp = mevent_add(flush_pipe[0], EVF_READ, flush_cb, NULL);
+	ASSERT_PTR_NEQ(("mevent_add"), flush_evp, NULL);
+
+	/* Get count before delete. */
+	flush_and_wait(flush_pipe[1]);
+	count1 = get_count();
+
+	/*
+	 * Delete the first event and flush a read after the delete is
+	 * complete.
+	 */
+	if (mevent_delete(unused_evp) != 0) {
+		FAIL_ERRNO("mevent_delete");
+	}
+
+	/*
+	 * Verify count decreased.
+	 */
+	flush_and_wait(flush_pipe[1]);
+	count2 = get_count();
+	if (count1 - 1 != count2 ) {
+		FAIL(("mevent_delete() did not decrease count by 1: "
+		    "was %d, now %d", count1, count2));
+	}
+
+	PASS();
+}
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/mevent.c b/usr/src/cmd/bhyve/test/tst/mevent/mevent.c
new file mode 100644
index 0000000000..17b6546847
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/mevent.c
@@ -0,0 +1,57 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include "../../../mevent.c"
+#include "testlib.h"
+
+/*
+ * Returns by reference the number of events on the global and change lists.
+ *
+ * Used by tests that wish to ensure that the event count changes as suggested
+ * by mevent_add() and mevent_delete().  Note that a delete does not immediately
+ * delete an event.  Events that are pending delete are included in the change
+ * list until the next pass through the change list to process pending changes.
+ */
+void
+test_mevent_count_lists(int *ret_global, int *ret_change, int *ret_del_pending)
+{
+	struct mevent *mevp;
+	int global = 0;
+	int change = 0;
+	int del_pending = 0;
+
+	mevent_qlock();
+
+	LIST_FOREACH(mevp, &global_head, me_list) {
+		global++;
+		VERBOSE(("on global: type %d fd %d state %d", mevp->me_type,
+		    mevp->me_fd, mevp->me_state));
+	}
+
+	LIST_FOREACH(mevp, &change_head, me_list) {
+		change++;
+		if (mevp->me_state == MEV_DEL_PENDING) {
+			del_pending++;
+		}
+		VERBOSE(("on change: type %d fd %d state %d", mevp->me_type,
+		    mevp->me_fd, mevp->me_state));
+	}
+
+	mevent_qunlock();
+
+	*ret_global = global;
+	*ret_change = change;
+	*ret_del_pending = del_pending;
+}
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/read.disable.c b/usr/src/cmd/bhyve/test/tst/mevent/read.disable.c
new file mode 100644
index 0000000000..d23b1af96c
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/read.disable.c
@@ -0,0 +1,163 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ *        Test:	read.cancel
+ *   Assertion: A read is not requeued if mevent_disable() is called while it is
+ *		being handled.
+ *
+ *    Strategy: 1. Create a pipe
+ *		2. Call mevent_add() to be notified of writes to the pipe.  The
+ *		   callback will signal a cv.
+ *		3. Write to the pipe then wait for a wakeup.
+ *		4. From the read event callback, disable the event then awaken
+ *		   the main thread.
+ *		5. In the main thread, add a timer event that will awaken the
+ *		   main thread after a short delay.
+ *		5. Write to the pipe and wait to be awoken.  The wakeup should
+ *		   come from the timer event, not the read event.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <unistd.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "testlib.h"
+#include "mevent.h"
+
+typedef enum {
+	CB_NONE,
+	CB_READ,
+	CB_TIMER,
+} lastwake_t;
+
+static lastwake_t lastwake = CB_NONE;
+
+static pthread_mutex_t mtx = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t cv = PTHREAD_COND_INITIALIZER;
+
+static struct mevent *read_event;
+
+static void
+munch(int fd, enum ev_type ev, void *arg)
+{
+	ssize_t nbytes;
+	char buf[32] = { 0 };
+	int err;
+
+	if ((nbytes = read(fd, buf, sizeof (buf))) < 0) {
+		FAIL_ERRNO("bad read");
+	}
+	VERBOSE(("read %ld bytes '%s'", nbytes, buf));
+
+	err = mevent_disable(read_event);
+	ASSERT_INT_EQ(("mevent_disable: ", strerror(err)), err, 0);
+
+	pthread_mutex_lock(&mtx);
+
+	ASSERT_INT_EQ(("wrong lastwake"), lastwake, CB_NONE);
+	lastwake = CB_READ;
+
+	pthread_cond_signal(&cv);
+	VERBOSE(("wakeup"));
+
+	pthread_mutex_unlock(&mtx);
+}
+
+static void
+tick(int ms, enum ev_type ev, void *arg)
+{
+	pthread_mutex_lock(&mtx);
+
+	ASSERT_INT_EQ(("wrong lastwake"), lastwake, CB_READ);
+	lastwake = CB_TIMER;
+
+	pthread_cond_signal(&cv);
+	VERBOSE(("wakeup"));
+
+	pthread_mutex_unlock(&mtx);
+}
+
+int
+main(int argc, const char *argv[])
+{
+	int pipefds[2];
+	struct mevent *timer;
+	ssize_t written;
+	char *msgs[] = { "first", "second" };
+	char *msg;
+
+	start_test(argv[0], 5);
+	start_event_thread();
+
+	if (pipe(pipefds) != 0) {
+		FAIL_ERRNO("pipe");
+	}
+	if (fcntl(pipefds[0], F_SETFL, O_NONBLOCK) != 0) {
+		FAIL_ERRNO("set pipe nonblocking");
+	}
+
+	/*
+	 * First write
+	 */
+	msg = msgs[0];
+	read_event = mevent_add(pipefds[0], EVF_READ, munch, msg);
+	ASSERT_PTR_NEQ(("mevent_add pipefd"), read_event, NULL);
+
+	pthread_mutex_lock(&mtx);
+	written = write(pipefds[1], msg, strlen(msg));
+	if (written < 0) {
+		FAIL_ERRNO("bad write");
+	}
+	ASSERT_INT64_EQ(("write '%s' failed", msg), written, strlen(msg));
+
+	/*
+	 * Wait for it to be read
+	 */
+	pthread_cond_wait(&cv, &mtx);
+	ASSERT_INT_EQ(("wrong lastwake"), lastwake, CB_READ);
+	pthread_mutex_unlock(&mtx);
+
+	/*
+	 * Add timer, second write.
+	 */
+	msg = msgs[1];
+	timer = mevent_add(50, EVF_TIMER, tick, msg);
+	ASSERT_PTR_NEQ(("mevent_add timer"), timer, NULL);
+
+	pthread_mutex_lock(&mtx);
+	written = write(pipefds[1], msg, strlen(msg));
+	if (written < 0) {
+		FAIL_ERRNO("bad write");
+	}
+	ASSERT_INT64_EQ(("write '%s' failed", msg), written, strlen(msg));
+
+	/*
+	 * Wait for timer to expire
+	 */
+	pthread_cond_wait(&cv, &mtx);
+	ASSERT_INT_EQ(("wrong lastwake"), lastwake, CB_TIMER);
+	pthread_mutex_unlock(&mtx);
+
+	PASS();
+}
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/read.pause.c b/usr/src/cmd/bhyve/test/tst/mevent/read.pause.c
new file mode 100644
index 0000000000..c877f014f6
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/read.pause.c
@@ -0,0 +1,152 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ *        Test:	read.pause
+ *   Assertion: mevent_disable() can be used to pause reads.
+ *
+ *    Strategy: 1. Create a pipe
+ *		2. Call mevent_add() to be notified of writes to the pipe.  The
+ *		   callback will signal a cv.
+ *		3. In a loop, write to the pipe then wait on the cv.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <unistd.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "testlib.h"
+#include "mevent.h"
+
+static pthread_mutex_t mtx = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t cv = PTHREAD_COND_INITIALIZER;
+
+static char cookie[] = "Chocolate chip with fudge stripes";
+
+/*
+ * After this many bytes are sent, writes will get batched up, progress will be
+ * made on the write side via an interval timer
+ */
+const int pauseat = 8;
+
+static void
+munch(int fd, enum ev_type ev, void *arg)
+{
+	static int i = 0;
+	char buf[sizeof (cookie)] = { 0 };
+	ssize_t nbytes;
+	ssize_t expected;
+
+	ASSERT_INT_EQ(("bad event"), ev, EVF_READ);
+	ASSERT_PTR_EQ(("bad cookie"), arg, cookie);
+
+	/*
+	 * For the first while, expect data to come a byte at a time.  After the
+	 * pause, we should get a burst with the rest of the data.
+	 */
+	if (i > pauseat) {
+		expected = strlen(cookie) - pauseat - 1;
+	} else {
+		expected = 1;
+	}
+
+	if ((nbytes = read(fd, buf, sizeof (buf))) < 0) {
+		FAIL_ERRNO("bad read");
+	}
+	VERBOSE(("read %ld bytes '%s'", nbytes, buf));
+
+	ASSERT_INT64_EQ(("wanted a byte of cookie"), nbytes, expected);
+
+	if (expected == 1) {
+		ASSERT_CHAR_EQ(("bad byte %d of cookie", i), buf[0], cookie[i]);
+	} else {
+		ASSERT_STR_EQ(("bad last half of cookie"), buf, &cookie[i]);
+	}
+
+	pthread_mutex_lock(&mtx);
+	pthread_cond_signal(&cv);
+	VERBOSE(("wakeup"));
+	pthread_mutex_unlock(&mtx);
+
+	i++;
+}
+
+static void
+tick(int ms, enum ev_type ev, void *arg)
+{
+	pthread_mutex_lock(&mtx);
+	pthread_cond_signal(&cv);
+	VERBOSE(("wakeup"));
+	pthread_mutex_unlock(&mtx);
+}
+
+int
+main(int argc, const char *argv[])
+{
+	int pipefds[2];
+	struct mevent *evp, *timer;
+	ssize_t written;
+
+	start_test(argv[0], 5);
+	start_event_thread();
+
+	if (pipe(pipefds) != 0) {
+		FAIL_ERRNO("pipe");
+	}
+	if (fcntl(pipefds[0], F_SETFL, O_NONBLOCK) != 0) {
+		FAIL_ERRNO("set pipe nonblocking");
+	}
+
+	evp = mevent_add(pipefds[0], EVF_READ, munch, cookie);
+	ASSERT_PTR_NEQ(("mevent_add pipefd"), evp, NULL);
+
+	for (int i = 0; cookie[i] != 0; i++) {
+		pthread_mutex_lock(&mtx);
+		written = write(pipefds[1], cookie + i, 1);
+		if (written < 0) {
+			FAIL_ERRNO("bad write");
+		}
+		ASSERT_INT64_EQ(("write byte %d of cookie", i), written, 1);
+
+		/* Wait for it to be read */
+		pthread_cond_wait(&cv, &mtx);
+		pthread_mutex_unlock(&mtx);
+
+		if (i == pauseat) {
+			timer = mevent_add(10, EVF_TIMER, tick,
+			    &cookie[pauseat]);
+			ASSERT_PTR_NEQ(("mevent_add timer"), timer, NULL);
+			VERBOSE(("disable munch"));
+			mevent_disable(evp);
+		}
+	}
+
+	pthread_mutex_lock(&mtx);
+
+	mevent_enable(evp);
+
+	pthread_cond_wait(&cv, &mtx);
+	pthread_mutex_unlock(&mtx);
+
+	PASS();
+}
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/read.requeue.c b/usr/src/cmd/bhyve/test/tst/mevent/read.requeue.c
new file mode 100644
index 0000000000..ddc3e27235
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/read.requeue.c
@@ -0,0 +1,108 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ *        Test:	read.requeue
+ *   Assertion: A sequence of writes turns into a sequence of events.
+ *
+ *    Strategy: 1. Create a pipe
+ *		2. Call mevent_add() to be notified of writes to the pipe.  The
+ *		   callback will signal a cv.
+ *		3. In a loop, write to the pipe then wait on the cv.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <unistd.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "testlib.h"
+#include "mevent.h"
+
+static pthread_mutex_t mtx = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t cv = PTHREAD_COND_INITIALIZER;
+
+static char *cookie = "Chocolate chip with fudge stripes";
+
+static void
+munch(int fd, enum ev_type ev, void *arg)
+{
+	static int i = 0;
+	char buf[8] = { 0 };
+	ssize_t nbytes;
+
+	ASSERT_INT_EQ(("bad event"), ev, EVF_READ);
+	ASSERT_PTR_EQ(("bad cookie"), arg, cookie);
+
+	if ((nbytes = read(fd, buf, sizeof (buf))) < 0) {
+		ASSERT_INT64_EQ(("bad read: %s", strerror(errno)), nbytes, 1);
+	}
+	VERBOSE(("read %ld bytes '%s'", nbytes, buf));
+
+	ASSERT_INT64_EQ(("wanted a byte of cookie"), nbytes, 1);
+
+	ASSERT_CHAR_EQ(("bad byte %d of cookie", i), buf[0], cookie[i]);
+
+	pthread_mutex_lock(&mtx);
+	pthread_cond_signal(&cv);
+	VERBOSE(("wakeup"));
+	pthread_mutex_unlock(&mtx);
+
+	i++;
+}
+
+int
+main(int argc, const char *argv[])
+{
+	int pipefds[2];
+	struct mevent *evp;
+
+	start_test(argv[0], 5);
+	start_event_thread();
+
+	if (pipe(pipefds) != 0) {
+		FAIL_ERRNO("pipe");
+	}
+	if (fcntl(pipefds[0], F_SETFL, O_NONBLOCK) != 0) {
+		FAIL_ERRNO("set pipe nonblocking");
+	}
+
+	evp = mevent_add(pipefds[0], EVF_READ, munch, cookie);
+	ASSERT_PTR_NEQ(("mevent_add"), evp, NULL);
+
+	for (int i = 0; cookie[i] != '\0'; i++) {
+		ssize_t written;
+
+		pthread_mutex_lock(&mtx);
+		written = write(pipefds[1], cookie + i, 1);
+		if (written < 0) {
+			FAIL_ERRNO("bad write");
+		}
+		ASSERT_INT64_EQ(("write byte %d of cookie", i), written, 1);
+
+		/* Wait for it to be read */
+		pthread_cond_wait(&cv, &mtx);
+		pthread_mutex_unlock(&mtx);
+	}
+
+	PASS();
+}
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/testlib.c b/usr/src/cmd/bhyve/test/tst/mevent/testlib.c
new file mode 100644
index 0000000000..af756d1509
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/testlib.c
@@ -0,0 +1,69 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <pthread.h>
+#include <signal.h>
+#include <strings.h>
+#include <unistd.h>
+
+#include "testlib.h"
+#include "mevent.h"
+
+const char *testlib_prog;
+boolean_t testlib_verbose;
+
+static void
+timed_out(int signo) {
+	ASSERT_INT_EQ(("timeout signal"), signo, SIGALRM);
+
+	FAIL(("Timed out"));
+}
+
+void
+start_test(const char *argv0, uint32_t timeout)
+{
+	char *val;
+
+	testlib_prog = strrchr(argv0, '/');
+	if (testlib_prog == NULL) {
+		testlib_prog = argv0;
+	} else {
+		testlib_prog++;
+	}
+
+	testlib_verbose = ((val = getenv("TEST_VERBOSE")) != NULL) &&
+	    val[0] != '\0';
+
+	signal(SIGALRM, timed_out);
+	alarm(timeout);
+}
+
+/* ARGSUSED */
+static void *
+event_thread(void *arg)
+{
+	mevent_dispatch();
+	return (NULL);
+}
+
+void
+start_event_thread(void)
+{
+	pthread_t tid;
+
+	if (pthread_create(&tid, NULL, event_thread, NULL) != 0) {
+		FAIL_ERRNO("pthread_create");
+	}
+}
diff --git a/usr/src/cmd/bhyve/test/tst/mevent/testlib.h b/usr/src/cmd/bhyve/test/tst/mevent/testlib.h
new file mode 100644
index 0000000000..80949f3cc7
--- /dev/null
+++ b/usr/src/cmd/bhyve/test/tst/mevent/testlib.h
@@ -0,0 +1,88 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "mevent.h"
+
+#define	EXIT_PASS 0
+#define	EXIT_FAIL 1
+
+#define VERBOSE(msg)							\
+	if (testlib_verbose) {						\
+		(void) printf("VERBOSE %s: %s:%d %s: ", testlib_prog,	\
+		    __FILE__, __LINE__, __func__);			\
+		(void) printf msg;					\
+		(void) printf("\n");					\
+	}
+
+#define FAIL_PROLOGUE() \
+	(void) printf("FAIL %s: %s:%d: ", testlib_prog, __FILE__, __LINE__)
+
+#define	FAIL(msg)							\
+	{								\
+		FAIL_PROLOGUE();					\
+		(void) printf msg;					\
+		(void) printf("\n");					\
+		exit(EXIT_FAIL);					\
+	}
+
+#define FAIL_ERRNO(msg) FAIL((msg ": %s", strerror(errno)))
+
+#define	PASS()								\
+	{								\
+		(void) printf("PASS %s\n", testlib_prog);		\
+		exit(EXIT_PASS);					\
+	}
+
+#define	ASSERT_CMP(msg, got, cmp, exp, nfmt)				\
+	if (!(got cmp exp)) {						\
+		FAIL_PROLOGUE();					\
+		(void) printf msg;					\
+		(void) printf(": %s=" nfmt " %s %s=" nfmt "\n",		\
+		    #got, got, #cmp, #exp, exp);			\
+		exit(EXIT_FAIL);					\
+	}
+
+#define	ASSERT_CHAR_EQ(msg, got, exp)	ASSERT_CMP(msg, got, ==, exp, "%c")
+#define	ASSERT_INT_EQ(msg, got, exp)	ASSERT_CMP(msg, got, ==, exp, "%d")
+#define	ASSERT_INT_NEQ(msg, got, exp)	ASSERT_CMP(msg, got, !=, exp, "%d")
+#define	ASSERT_INT64_EQ(msg, got, exp)	ASSERT_CMP(msg, got, ==, exp, "%ld")
+#define	ASSERT_PTR_EQ(msg, got, exp)	ASSERT_CMP(msg, got, ==, exp, "%p")
+#define	ASSERT_PTR_NEQ(msg, got, exp)	ASSERT_CMP(msg, got, !=, exp, "%p")
+
+#define	ASSERT_STR_EQ(msg, got, exp)					\
+	if (strcmp(got, exp) != 0) {					\
+		FAIL_PROLOGUE();					\
+		(void) printf msg;					\
+		(void) printf(": %s='%s' != %s='%s'\n",			\
+		    #got, got, #exp, exp);				\
+		exit(EXIT_FAIL);					\
+	}
+
+extern const char	*testlib_prog;
+extern boolean_t	testlib_verbose;
+
+extern void start_test(const char *, uint32_t);
+extern void start_event_thread(void);
+extern void test_mevent_count_lists(int *, int *, int *);
diff --git a/usr/src/cmd/bhyve/uart_emul.c b/usr/src/cmd/bhyve/uart_emul.c
new file mode 100644
index 0000000000..5a47e2e9ef
--- /dev/null
+++ b/usr/src/cmd/bhyve/uart_emul.c
@@ -0,0 +1,1012 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ *
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <dev/ic/ns16550.h>
+#ifndef WITHOUT_CAPSICUM
+#include <sys/capsicum.h>
+#include <capsicum_helpers.h>
+#endif
+
+#ifndef	__FreeBSD__
+#include <sys/socket.h>
+#include <sys/stat.h>
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <termios.h>
+#include <unistd.h>
+#include <stdbool.h>
+#include <string.h>
+#include <pthread.h>
+#include <sysexits.h>
+#ifndef	__FreeBSD__
+#include <errno.h>
+#include <fcntl.h>
+#include <poll.h>
+#endif
+
+#include "mevent.h"
+#include "uart_emul.h"
+
+#define	COM1_BASE	0x3F8
+#define	COM1_IRQ	4
+#define	COM2_BASE	0x2F8
+#define COM2_IRQ	3
+
+#define	DEFAULT_RCLK	1843200
+#define	DEFAULT_BAUD	9600
+
+#define	FCR_RX_MASK	0xC0
+
+#define	MCR_OUT1	0x04
+#define	MCR_OUT2	0x08
+
+#define	MSR_DELTA_MASK	0x0f
+
+#ifndef REG_SCR
+#define REG_SCR		com_scr
+#endif
+
+#define	FIFOSZ	16
+
+static bool uart_stdio;		/* stdio in use for i/o */
+static struct termios tio_stdio_orig;
+
+static struct {
+	int	baseaddr;
+	int	irq;
+	bool	inuse;
+} uart_lres[] = {
+	{ COM1_BASE, COM1_IRQ, false},
+	{ COM2_BASE, COM2_IRQ, false},
+};
+
+#define	UART_NLDEVS	(sizeof(uart_lres) / sizeof(uart_lres[0]))
+
+struct fifo {
+	uint8_t	buf[FIFOSZ];
+	int	rindex;		/* index to read from */
+	int	windex;		/* index to write to */
+	int	num;		/* number of characters in the fifo */
+	int	size;		/* size of the fifo */
+};
+
+struct ttyfd {
+	bool	opened;
+	int	fd;		/* tty device file descriptor */
+	struct termios tio_orig, tio_new;    /* I/O Terminals */
+};
+
+struct uart_softc {
+	pthread_mutex_t mtx;	/* protects all softc elements */
+	uint8_t	data;		/* Data register (R/W) */
+	uint8_t ier;		/* Interrupt enable register (R/W) */
+	uint8_t lcr;		/* Line control register (R/W) */
+	uint8_t mcr;		/* Modem control register (R/W) */
+	uint8_t lsr;		/* Line status register (R/W) */
+	uint8_t msr;		/* Modem status register (R/W) */
+	uint8_t fcr;		/* FIFO control register (W) */
+	uint8_t scr;		/* Scratch register (R/W) */
+
+	uint8_t dll;		/* Baudrate divisor latch LSB */
+	uint8_t dlh;		/* Baudrate divisor latch MSB */
+
+	struct fifo rxfifo;
+	struct mevent *mev;
+
+	struct ttyfd tty;
+#ifndef	__FreeBSD__
+	bool	sock;
+	struct {
+		int	clifd;		/* console client unix domain socket */
+		int	servfd;		/* console server unix domain socket */
+	} usc_sock;
+#endif
+
+	bool	thre_int_pending;	/* THRE interrupt pending */
+
+	void	*arg;
+	uart_intr_func_t intr_assert;
+	uart_intr_func_t intr_deassert;
+};
+
+static void uart_drain(int fd, enum ev_type ev, void *arg);
+static int uart_sock_drain(struct uart_softc *sc);
+
+static void
+ttyclose(void)
+{
+
+	tcsetattr(STDIN_FILENO, TCSANOW, &tio_stdio_orig);
+}
+
+static void
+ttyopen(struct ttyfd *tf)
+{
+
+	tcgetattr(tf->fd, &tf->tio_orig);
+
+	tf->tio_new = tf->tio_orig;
+	cfmakeraw(&tf->tio_new);
+	tf->tio_new.c_cflag |= CLOCAL;
+	tcsetattr(tf->fd, TCSANOW, &tf->tio_new);
+
+	if (tf->fd == STDIN_FILENO) {
+		tio_stdio_orig = tf->tio_orig;
+		atexit(ttyclose);
+	}
+}
+
+static int
+ttyread(struct ttyfd *tf)
+{
+	unsigned char rb;
+
+	if (read(tf->fd, &rb, 1) == 1)
+		return (rb);
+	else
+		return (-1);
+}
+
+static void
+ttywrite(struct ttyfd *tf, unsigned char wb)
+{
+
+	(void)write(tf->fd, &wb, 1);
+}
+
+#ifndef	__FreeBSD__
+static void
+sockwrite(struct uart_softc *sc, unsigned char wb)
+{
+	(void) write(sc->usc_sock.clifd, &wb, 1);
+}
+#endif
+
+static void
+rxfifo_reset(struct uart_softc *sc, int size)
+{
+	char flushbuf[32];
+	struct fifo *fifo;
+	ssize_t nread;
+	int error;
+ 
+	fifo = &sc->rxfifo;
+	bzero(fifo, sizeof(struct fifo));
+	fifo->size = size;
+
+	if (sc->tty.opened) {
+		/*
+		 * Flush any unread input from the tty buffer.
+		 */
+		while (1) {
+			nread = read(sc->tty.fd, flushbuf, sizeof(flushbuf));
+			if (nread != sizeof(flushbuf))
+				break;
+		}
+
+		/*
+		 * Enable mevent to trigger when new characters are available
+		 * on the tty fd.
+		 */
+		error = mevent_enable(sc->mev);
+		assert(error == 0);
+	}
+}
+
+static int
+rxfifo_available(struct uart_softc *sc)
+{
+	struct fifo *fifo;
+
+	fifo = &sc->rxfifo;
+	return (fifo->num < fifo->size);
+}
+
+static int
+rxfifo_putchar(struct uart_softc *sc, uint8_t ch)
+{
+	struct fifo *fifo;
+	int error;
+
+	fifo = &sc->rxfifo;
+
+	if (fifo->num < fifo->size) {
+		fifo->buf[fifo->windex] = ch;
+		fifo->windex = (fifo->windex + 1) % fifo->size;
+		fifo->num++;
+		if (!rxfifo_available(sc)) {
+			if (sc->tty.opened) {
+				/*
+				 * Disable mevent callback if the FIFO is full.
+				 */
+				error = mevent_disable(sc->mev);
+				assert(error == 0);
+			}
+		}
+		return (0);
+	} else
+		return (-1);
+}
+
+static int
+rxfifo_getchar(struct uart_softc *sc)
+{
+	struct fifo *fifo;
+	int c, error, wasfull;
+
+	wasfull = 0;
+	fifo = &sc->rxfifo;
+	if (fifo->num > 0) {
+		if (!rxfifo_available(sc))
+			wasfull = 1;
+		c = fifo->buf[fifo->rindex];
+		fifo->rindex = (fifo->rindex + 1) % fifo->size;
+		fifo->num--;
+		if (wasfull) {
+			if (sc->tty.opened) {
+				error = mevent_enable(sc->mev);
+				assert(error == 0);
+			}
+		}
+		return (c);
+	} else
+		return (-1);
+}
+
+static int
+rxfifo_numchars(struct uart_softc *sc)
+{
+	struct fifo *fifo = &sc->rxfifo;
+
+	return (fifo->num);
+}
+
+static void
+uart_opentty(struct uart_softc *sc)
+{
+	ttyopen(&sc->tty);
+	sc->mev = mevent_add(sc->tty.fd, EVF_READ, uart_drain, sc);
+	assert(sc->mev != NULL);
+}
+
+static uint8_t
+modem_status(uint8_t mcr)
+{
+	uint8_t msr;
+
+	if (mcr & MCR_LOOPBACK) {
+		/*
+		 * In the loopback mode certain bits from the MCR are
+		 * reflected back into MSR.
+		 */
+		msr = 0;
+		if (mcr & MCR_RTS)
+			msr |= MSR_CTS;
+		if (mcr & MCR_DTR)
+			msr |= MSR_DSR;
+		if (mcr & MCR_OUT1)
+			msr |= MSR_RI;
+		if (mcr & MCR_OUT2)
+			msr |= MSR_DCD;
+	} else {
+		/*
+		 * Always assert DCD and DSR so tty open doesn't block
+		 * even if CLOCAL is turned off.
+		 */
+		msr = MSR_DCD | MSR_DSR;
+	}
+	assert((msr & MSR_DELTA_MASK) == 0);
+
+	return (msr);
+}
+
+/*
+ * The IIR returns a prioritized interrupt reason:
+ * - receive data available
+ * - transmit holding register empty
+ * - modem status change
+ *
+ * Return an interrupt reason if one is available.
+ */
+static int
+uart_intr_reason(struct uart_softc *sc)
+{
+
+	if ((sc->lsr & LSR_OE) != 0 && (sc->ier & IER_ERLS) != 0)
+		return (IIR_RLS);
+	else if (rxfifo_numchars(sc) > 0 && (sc->ier & IER_ERXRDY) != 0)
+		return (IIR_RXTOUT);
+	else if (sc->thre_int_pending && (sc->ier & IER_ETXRDY) != 0)
+		return (IIR_TXRDY);
+	else if ((sc->msr & MSR_DELTA_MASK) != 0 && (sc->ier & IER_EMSC) != 0)
+		return (IIR_MLSC);
+	else
+		return (IIR_NOPEND);
+}
+
+static void
+uart_reset(struct uart_softc *sc)
+{
+	uint16_t divisor;
+
+	divisor = DEFAULT_RCLK / DEFAULT_BAUD / 16;
+	sc->dll = divisor;
+	sc->dlh = divisor >> 16;
+	sc->msr = modem_status(sc->mcr);
+
+	rxfifo_reset(sc, 1);	/* no fifo until enabled by software */
+}
+
+/*
+ * Toggle the COM port's intr pin depending on whether or not we have an
+ * interrupt condition to report to the processor.
+ */
+static void
+uart_toggle_intr(struct uart_softc *sc)
+{
+	uint8_t intr_reason;
+
+	intr_reason = uart_intr_reason(sc);
+
+	if (intr_reason == IIR_NOPEND)
+		(*sc->intr_deassert)(sc->arg);
+	else
+		(*sc->intr_assert)(sc->arg);
+}
+
+static void
+uart_drain(int fd, enum ev_type ev, void *arg)
+{
+	struct uart_softc *sc;
+	int ch;
+
+	sc = arg;
+
+	assert(fd == sc->tty.fd);
+	assert(ev == EVF_READ);
+
+	/*
+	 * This routine is called in the context of the mevent thread
+	 * to take out the softc lock to protect against concurrent
+	 * access from a vCPU i/o exit
+	 */
+	pthread_mutex_lock(&sc->mtx);
+
+	if ((sc->mcr & MCR_LOOPBACK) != 0) {
+		(void) ttyread(&sc->tty);
+	} else {
+		while (rxfifo_available(sc) &&
+		       ((ch = ttyread(&sc->tty)) != -1)) {
+			rxfifo_putchar(sc, ch);
+		}
+		uart_toggle_intr(sc);
+	}
+
+	pthread_mutex_unlock(&sc->mtx);
+}
+
+static int
+uart_sock_drain(struct uart_softc *sc)
+{
+	char ch;
+	int nbytes;
+	int ret = 0;
+
+	/*
+	 * Take the softc lock to protect against concurrent
+	 * access from a vCPU i/o exit
+	 */
+	pthread_mutex_lock(&sc->mtx);
+
+	if ((sc->mcr & MCR_LOOPBACK) != 0) {
+		(void) read(sc->usc_sock.clifd, &ch, 1);
+	} else {
+		while (rxfifo_available(sc)) {
+			nbytes = read(sc->usc_sock.clifd, &ch, 1);
+			if (nbytes == 0) {
+				ret = 1;
+				break;
+			}
+			if (nbytes == -1 &&
+			    errno != EINTR && errno != EAGAIN) {
+				ret = -1;
+				break;
+			}
+			if (nbytes == -1) {
+				break;
+			}
+
+			rxfifo_putchar(sc, ch);
+		}
+		uart_toggle_intr(sc);
+	}
+
+	pthread_mutex_unlock(&sc->mtx);
+
+	return (ret);
+}
+
+void
+uart_write(struct uart_softc *sc, int offset, uint8_t value)
+{
+	int fifosz;
+	uint8_t msr;
+
+	pthread_mutex_lock(&sc->mtx);
+
+	/*
+	 * Take care of the special case DLAB accesses first
+	 */
+	if ((sc->lcr & LCR_DLAB) != 0) {
+		if (offset == REG_DLL) {
+			sc->dll = value;
+			goto done;
+		}
+
+		if (offset == REG_DLH) {
+			sc->dlh = value;
+			goto done;
+		}
+	}
+
+        switch (offset) {
+	case REG_DATA:
+		if (sc->mcr & MCR_LOOPBACK) {
+			if (rxfifo_putchar(sc, value) != 0)
+				sc->lsr |= LSR_OE;
+		} else if (sc->tty.opened) {
+			ttywrite(&sc->tty, value);
+#ifndef	__FreeBSD__
+		} else if (sc->sock) {
+			sockwrite(sc, value);
+#endif
+		} /* else drop on floor */
+		sc->thre_int_pending = true;
+		break;
+	case REG_IER:
+		/*
+		 * Apply mask so that bits 4-7 are 0
+		 * Also enables bits 0-3 only if they're 1
+		 */
+		sc->ier = value & 0x0F;
+		break;
+		case REG_FCR:
+			/*
+			 * When moving from FIFO and 16450 mode and vice versa,
+			 * the FIFO contents are reset.
+			 */
+			if ((sc->fcr & FCR_ENABLE) ^ (value & FCR_ENABLE)) {
+				fifosz = (value & FCR_ENABLE) ? FIFOSZ : 1;
+				rxfifo_reset(sc, fifosz);
+			}
+
+			/*
+			 * The FCR_ENABLE bit must be '1' for the programming
+			 * of other FCR bits to be effective.
+			 */
+			if ((value & FCR_ENABLE) == 0) {
+				sc->fcr = 0;
+			} else {
+				if ((value & FCR_RCV_RST) != 0)
+					rxfifo_reset(sc, FIFOSZ);
+
+				sc->fcr = value &
+					 (FCR_ENABLE | FCR_DMA | FCR_RX_MASK);
+			}
+			break;
+		case REG_LCR:
+			sc->lcr = value;
+			break;
+		case REG_MCR:
+			/* Apply mask so that bits 5-7 are 0 */
+			sc->mcr = value & 0x1F;
+			msr = modem_status(sc->mcr);
+
+			/*
+			 * Detect if there has been any change between the
+			 * previous and the new value of MSR. If there is
+			 * then assert the appropriate MSR delta bit.
+			 */
+			if ((msr & MSR_CTS) ^ (sc->msr & MSR_CTS))
+				sc->msr |= MSR_DCTS;
+			if ((msr & MSR_DSR) ^ (sc->msr & MSR_DSR))
+				sc->msr |= MSR_DDSR;
+			if ((msr & MSR_DCD) ^ (sc->msr & MSR_DCD))
+				sc->msr |= MSR_DDCD;
+			if ((sc->msr & MSR_RI) != 0 && (msr & MSR_RI) == 0)
+				sc->msr |= MSR_TERI;
+
+			/*
+			 * Update the value of MSR while retaining the delta
+			 * bits.
+			 */
+			sc->msr &= MSR_DELTA_MASK;
+			sc->msr |= msr;
+			break;
+		case REG_LSR:
+			/*
+			 * Line status register is not meant to be written to
+			 * during normal operation.
+			 */
+			break;
+		case REG_MSR:
+			/*
+			 * As far as I can tell MSR is a read-only register.
+			 */
+			break;
+		case REG_SCR:
+			sc->scr = value;
+			break;
+		default:
+			break;
+	}
+
+done:
+	uart_toggle_intr(sc);
+	pthread_mutex_unlock(&sc->mtx);
+}
+
+uint8_t
+uart_read(struct uart_softc *sc, int offset)
+{
+	uint8_t iir, intr_reason, reg;
+
+	pthread_mutex_lock(&sc->mtx);
+
+	/*
+	 * Take care of the special case DLAB accesses first
+	 */
+	if ((sc->lcr & LCR_DLAB) != 0) {
+		if (offset == REG_DLL) {
+			reg = sc->dll;
+			goto done;
+		}
+
+		if (offset == REG_DLH) {
+			reg = sc->dlh;
+			goto done;
+		}
+	}
+
+	switch (offset) {
+	case REG_DATA:
+		reg = rxfifo_getchar(sc);
+		break;
+	case REG_IER:
+		reg = sc->ier;
+		break;
+	case REG_IIR:
+		iir = (sc->fcr & FCR_ENABLE) ? IIR_FIFO_MASK : 0;
+
+		intr_reason = uart_intr_reason(sc);
+
+		/*
+		 * Deal with side effects of reading the IIR register
+		 */
+		if (intr_reason == IIR_TXRDY)
+			sc->thre_int_pending = false;
+
+		iir |= intr_reason;
+
+		reg = iir;
+		break;
+	case REG_LCR:
+		reg = sc->lcr;
+		break;
+	case REG_MCR:
+		reg = sc->mcr;
+		break;
+	case REG_LSR:
+		/* Transmitter is always ready for more data */
+		sc->lsr |= LSR_TEMT | LSR_THRE;
+
+		/* Check for new receive data */
+		if (rxfifo_numchars(sc) > 0)
+			sc->lsr |= LSR_RXRDY;
+		else
+			sc->lsr &= ~LSR_RXRDY;
+
+		reg = sc->lsr;
+
+		/* The LSR_OE bit is cleared on LSR read */
+		sc->lsr &= ~LSR_OE;
+		break;
+	case REG_MSR:
+		/*
+		 * MSR delta bits are cleared on read
+		 */
+		reg = sc->msr;
+		sc->msr &= ~MSR_DELTA_MASK;
+		break;
+	case REG_SCR:
+		reg = sc->scr;
+		break;
+	default:
+		reg = 0xFF;
+		break;
+	}
+
+done:
+	uart_toggle_intr(sc);
+	pthread_mutex_unlock(&sc->mtx);
+
+	return (reg);
+}
+
+#ifndef	__FreeBSD__
+static int
+uart_sock_accept_client(struct uart_softc *sc)
+{
+	int connfd;
+	struct sockaddr_un cliaddr;
+	socklen_t clilen;
+
+	clilen = sizeof (cliaddr);
+	connfd = accept(sc->usc_sock.servfd, (struct sockaddr *)&cliaddr,
+	    &clilen);
+	if (connfd == -1) {
+		return (-1);
+	}
+	if (fcntl(connfd, F_SETFL, O_NONBLOCK) < 0) {
+		(void) shutdown(connfd, SHUT_RDWR);
+		(void) close(connfd);
+		return (-1);
+	}
+
+	sc->usc_sock.clifd = connfd;
+
+	return (0);
+}
+
+static void
+uart_sock_reject_client(struct uart_softc *sc)
+{
+	int connfd;
+	struct sockaddr_un cliaddr;
+	socklen_t clilen;
+
+	clilen = sizeof (cliaddr);
+	connfd = accept(sc->usc_sock.servfd,
+			(struct sockaddr *)&cliaddr, &clilen);
+
+	(void) fprintf(stderr, "Shutting down unexpected client connection\n");
+	(void) shutdown(connfd, SHUT_RDWR);
+	(void) close(connfd);
+}
+
+static void
+uart_sock_client_event(struct uart_softc *sc)
+{
+	int res;
+
+	res = uart_sock_drain(sc);
+	if (res < 0)
+		return;
+
+	if (res > 0) {
+		fprintf(stderr, "Closing connection with bhyve socket\n");
+		(void) shutdown(sc->usc_sock.clifd, SHUT_RDWR);
+		(void) close(sc->usc_sock.clifd);
+		sc->usc_sock.clifd = -1;
+	}
+}
+
+static void
+uart_sock_server_event(struct uart_softc *sc)
+{
+	if (sc->usc_sock.clifd != -1) {
+		/* we're already handling a client */
+		uart_sock_reject_client(sc);
+		return;
+	}
+
+	uart_sock_accept_client(sc);
+}
+
+static void *
+uart_sock_thread(void *param)
+{
+	struct uart_softc *sc = param;
+	struct pollfd pollfds[2];
+	int res;
+
+	/* read from client and write to vm */
+	pollfds[0].events = POLLIN | POLLRDNORM | POLLRDBAND |
+	    POLLPRI | POLLERR | POLLHUP;
+
+	/* the server socket; watch for events (new connections) */
+	pollfds[1].events = pollfds[0].events;
+
+	for (;;) {
+		pollfds[0].fd = sc->usc_sock.clifd;
+		pollfds[1].fd = sc->usc_sock.servfd;
+		pollfds[0].revents = pollfds[1].revents = 0;
+
+		res = poll(pollfds,
+		    sizeof (pollfds) / sizeof (struct pollfd), -1);
+
+		if (res == -1 && errno != EINTR) {
+			perror("poll failed");
+			/* we are hosed, close connection */
+			break;
+		}
+
+		/* event from client side */
+		if (pollfds[0].revents) {
+			if (pollfds[0].revents &
+			    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
+				uart_sock_client_event(sc);
+			} else {
+				break;
+			}
+		}
+
+		/* event from server socket */
+		if (pollfds[1].revents) {
+			if (pollfds[1].revents & (POLLIN | POLLRDNORM)) {
+				uart_sock_server_event(sc);
+			} else {
+				break;
+			}
+		}
+	}
+
+	if (sc->usc_sock.clifd != -1) {
+		fprintf(stderr, "Closing connection with bhyve console\n");
+		(void) shutdown(sc->usc_sock.clifd, SHUT_RDWR);
+		(void) close(sc->usc_sock.clifd);
+		sc->usc_sock.clifd = -1;
+	}
+
+	return (NULL);
+}
+
+static int
+init_sock(const char *path)
+{
+	int servfd;
+	struct sockaddr_un servaddr;
+
+	bzero(&servaddr, sizeof (servaddr));
+	servaddr.sun_family = AF_UNIX;
+
+	if (strlcpy(servaddr.sun_path, path, sizeof (servaddr.sun_path)) >=
+	    sizeof (servaddr.sun_path)) {
+		(void) fprintf(stderr, "bhyve socket setup: path '%s' "
+		    "too long\n", path);
+		return (-1);
+	}
+
+	if ((servfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
+		(void) fprintf(stderr, "bhyve socket setup: "
+		    "could not create socket: %s\n", strerror(errno));
+		return (-1);
+	}
+	(void) unlink(servaddr.sun_path);
+
+	if (bind(servfd, (struct sockaddr *)&servaddr,
+	    sizeof (servaddr)) == -1) {
+		fprintf(stderr, "bhyve socket setup: "
+		    "could not bind to socket: %s\n", strerror(errno));
+		goto out;
+        }
+
+        if (listen(servfd, 1) == -1) {
+		fprintf(stderr, "bhyve console setup: "
+		    "could not listen on socket: %s\n", strerror(errno));
+		goto out;
+        }
+        return (servfd);
+
+out:
+	(void) unlink(servaddr.sun_path);
+        (void) close(servfd);
+        return (-1);
+}
+#endif /* not __FreeBSD__ */
+
+int
+uart_legacy_alloc(int which, int *baseaddr, int *irq)
+{
+
+	if (which < 0 || which >= UART_NLDEVS || uart_lres[which].inuse)
+		return (-1);
+
+	uart_lres[which].inuse = true;
+	*baseaddr = uart_lres[which].baseaddr;
+	*irq = uart_lres[which].irq;
+
+	return (0);
+}
+
+struct uart_softc *
+uart_init(uart_intr_func_t intr_assert, uart_intr_func_t intr_deassert,
+    void *arg)
+{
+	struct uart_softc *sc;
+
+	sc = calloc(1, sizeof(struct uart_softc));
+
+	sc->arg = arg;
+	sc->intr_assert = intr_assert;
+	sc->intr_deassert = intr_deassert;
+
+	pthread_mutex_init(&sc->mtx, NULL);
+
+	uart_reset(sc);
+
+	return (sc);
+}
+
+static int
+uart_tty_backend(struct uart_softc *sc, const char *opts)
+{
+	int fd;
+	int retval;
+
+	retval = -1;
+
+	fd = open(opts, O_RDWR | O_NONBLOCK);
+	if (fd > 0 && isatty(fd)) {
+		sc->tty.fd = fd;
+		sc->tty.opened = true;
+		retval = 0;
+	}
+
+	return (retval);
+}
+
+#ifndef __FreeBSD__
+static int
+uart_sock_backend(struct uart_softc *sc, const char *inopts)
+{
+	char *opts;
+	char *opt;
+	char *nextopt;
+	char *path = NULL;
+	int error;
+
+	if (strncmp(inopts, "socket,", 7) != 0) {
+		return (-1);
+	}
+	if ((opts = strdup(inopts + 7)) == NULL) {
+		return (-1);
+	}
+
+	nextopt = opts;
+	for (opt = strsep(&nextopt, ","); opt != NULL;
+	    opt = strsep(&nextopt, ",")) {
+		if (path == NULL && *opt == '/') {
+			path = opt;
+			continue;
+		}
+		/*
+		 * XXX check for server and client options here.  For now,
+		 * everything is a server
+		 */
+		free(opts);
+		return (-1);
+	}
+
+	sc->usc_sock.clifd = -1;
+	if ((sc->usc_sock.servfd = init_sock(path)) == -1) {
+		fprintf(stderr, "bhyve serial setup: socket initialization "
+		    "of '%s' failed\n", path);
+		free(opts);
+		return (-1);
+	}
+	error = pthread_create(NULL, NULL, uart_sock_thread, sc);
+	assert(error == 0);
+
+	sc->sock = true;
+	sc->tty.fd = -1;
+
+	return (0);
+}
+#endif /* not __FreeBSD__ */
+
+int
+uart_set_backend(struct uart_softc *sc, const char *opts)
+{
+	int retval;
+#ifndef WITHOUT_CAPSICUM
+	cap_rights_t rights;
+	cap_ioctl_t cmds[] = { TIOCGETA, TIOCSETA, TIOCGWINSZ };
+#endif
+
+	retval = -1;
+
+	if (opts == NULL)
+		return (0);
+
+	if (strcmp("stdio", opts) == 0) {
+		if (!uart_stdio) {
+			sc->tty.fd = STDIN_FILENO;
+			sc->tty.opened = true;
+			uart_stdio = true;
+			retval = 0;
+		}
+#ifndef __FreeBSD__
+	} else if (strncmp("socket,", opts, 7) == 0) {
+		return (uart_sock_backend(sc, opts));
+#endif
+	} else if (uart_tty_backend(sc, opts) == 0) {
+		retval = 0;
+	}
+
+	/* Make the backend file descriptor non-blocking */
+	if (retval == 0 && sc->tty.fd != -1)
+		retval = fcntl(sc->tty.fd, F_SETFL, O_NONBLOCK);
+
+	if (retval == 0) {
+#ifndef WITHOUT_CAPSICUM
+		cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ,
+		    CAP_WRITE);
+		if (cap_rights_limit(sc->tty.fd, &rights) == -1 &&
+		    errno != ENOSYS)
+			errx(EX_OSERR, "Unable to apply rights for sandbox");
+		if (cap_ioctls_limit(sc->tty.fd, cmds, nitems(cmds)) == -1 &&
+		    errno != ENOSYS)
+			errx(EX_OSERR, "Unable to apply rights for sandbox");
+		if (!uart_stdio) {
+			if (caph_limit_stdin() == -1 && errno != ENOSYS)
+				errx(EX_OSERR,
+				    "Unable to apply rights for sandbox");
+		}
+#endif
+		uart_opentty(sc);
+	}
+
+	return (retval);
+}
diff --git a/usr/src/cmd/bhyve/uart_emul.h b/usr/src/cmd/bhyve/uart_emul.h
new file mode 100644
index 0000000000..a87202df1f
--- /dev/null
+++ b/usr/src/cmd/bhyve/uart_emul.h
@@ -0,0 +1,47 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _UART_EMUL_H_
+#define	_UART_EMUL_H_
+
+
+#define	UART_IO_BAR_SIZE	8
+
+struct uart_softc;
+
+typedef void (*uart_intr_func_t)(void *arg);
+struct uart_softc *uart_init(uart_intr_func_t intr_assert,
+		uart_intr_func_t intr_deassert, void *arg);
+
+int	uart_legacy_alloc(int unit, int *ioaddr, int *irq);
+uint8_t	uart_read(struct uart_softc *sc, int offset);
+void	uart_write(struct uart_softc *sc, int offset, uint8_t value);
+int	uart_set_backend(struct uart_softc *sc, const char *opt);
+#endif
diff --git a/usr/src/cmd/bhyve/usb_emul.c b/usr/src/cmd/bhyve/usb_emul.c
new file mode 100644
index 0000000000..3dc12a5c3c
--- /dev/null
+++ b/usr/src/cmd/bhyve/usb_emul.c
@@ -0,0 +1,76 @@
+/*-
+ * Copyright (c) 2014 Nahanni Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/queue.h>
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <pthread.h>
+
+#include "usb_emul.h"
+
+SET_DECLARE(usb_emu_set, struct usb_devemu);
+
+struct usb_devemu *
+usb_emu_finddev(char *name)
+{
+	struct usb_devemu **udpp, *udp;
+
+	SET_FOREACH(udpp, usb_emu_set) {
+		udp = *udpp;
+		if (!strcmp(udp->ue_emu, name))
+			return (udp);
+	}
+
+	return (NULL);
+}
+
+struct usb_data_xfer_block *
+usb_data_xfer_append(struct usb_data_xfer *xfer, void *buf, int blen,
+                     void *hci_data, int ccs)
+{
+	struct usb_data_xfer_block *xb;
+
+	if (xfer->ndata >= USB_MAX_XFER_BLOCKS)
+		return (NULL);
+
+	xb = &xfer->data[xfer->tail];
+	xb->buf = buf;
+	xb->blen = blen;
+	xb->hci_data = hci_data;
+	xb->ccs = ccs;
+	xb->processed = 0;
+	xb->bdone = 0;
+	xfer->ndata++;
+	xfer->tail = (xfer->tail + 1) % USB_MAX_XFER_BLOCKS;
+	return (xb);
+}
diff --git a/usr/src/cmd/bhyve/usb_emul.h b/usr/src/cmd/bhyve/usb_emul.h
new file mode 100644
index 0000000000..083557f64f
--- /dev/null
+++ b/usr/src/cmd/bhyve/usb_emul.h
@@ -0,0 +1,162 @@
+/*-
+ * Copyright (c) 2014 Leon Dang <ldang@nahannisys.com>
+ * Copyright 2018 Joyent, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _USB_EMUL_H_
+#define _USB_EMUL_H_
+
+#include <stdlib.h>
+#include <sys/linker_set.h>
+#include <pthread.h>
+#ifndef __FreeBSD__
+#include <synch.h>
+#endif
+
+#define	USB_MAX_XFER_BLOCKS	8
+
+#define	USB_XFER_OUT		0
+#define	USB_XFER_IN		1
+
+
+
+struct usb_hci;
+struct usb_device_request;
+struct usb_data_xfer;
+
+/* Device emulation handlers */
+struct usb_devemu {
+	char	*ue_emu;	/* name of device emulation */
+	int	ue_usbver;	/* usb version: 2 or 3 */
+	int	ue_usbspeed;	/* usb device speed */
+
+	/* instance creation */
+	void	*(*ue_init)(struct usb_hci *hci, char *opt);
+
+	/* handlers */
+	int	(*ue_request)(void *sc, struct usb_data_xfer *xfer);
+	int	(*ue_data)(void *sc, struct usb_data_xfer *xfer, int dir,
+	                   int epctx);
+	int	(*ue_reset)(void *sc);
+	int	(*ue_remove)(void *sc);
+	int	(*ue_stop)(void *sc);
+};
+#define	USB_EMUL_SET(x)		DATA_SET(usb_emu_set, x);
+
+/*
+ * USB device events to notify HCI when state changes
+ */
+enum hci_usbev {
+	USBDEV_ATTACH,
+	USBDEV_RESET,
+	USBDEV_STOP,
+	USBDEV_REMOVE,
+};
+
+/* usb controller, ie xhci, ehci */
+struct usb_hci {
+	int	(*hci_intr)(struct usb_hci *hci, int epctx);
+	int	(*hci_event)(struct usb_hci *hci, enum hci_usbev evid,
+		             void *param);
+	void	*hci_sc;			/* private softc for hci */
+
+	/* controller managed fields */
+	int	hci_address;
+	int	hci_port;
+};
+
+/*
+ * Each xfer block is mapped to the hci transfer block.
+ * On input into the device handler, blen is set to the lenght of buf.
+ * The device handler is to update blen to reflect on the residual size
+ * of the buffer, i.e. len(buf) - len(consumed).
+ */
+struct usb_data_xfer_block {
+	void	*buf;			/* IN or OUT pointer */
+	int	blen;			/* in:len(buf), out:len(remaining) */
+	int	bdone;			/* bytes transferred */
+	uint32_t processed;		/* device processed this + errcode */
+	void	*hci_data;		/* HCI private reference */
+	int	ccs;
+	uint32_t streamid;
+	uint64_t trbnext;		/* next TRB guest address */
+};
+
+struct usb_data_xfer {
+	struct usb_data_xfer_block data[USB_MAX_XFER_BLOCKS];
+	struct usb_device_request *ureq; 	/* setup ctl request */
+	int	ndata;				/* # of data items */
+	int	head;
+	int	tail;
+	pthread_mutex_t mtx;
+};
+
+enum USB_ERRCODE {
+	USB_ACK,
+	USB_NAK,
+	USB_STALL,
+	USB_NYET,
+	USB_ERR,
+	USB_SHORT
+};
+
+#define	USB_DATA_GET_ERRCODE(x)		(x)->processed >> 8
+#define	USB_DATA_SET_ERRCODE(x,e)	do {				\
+			(x)->processed = ((x)->processed & 0xFF) | (e << 8); \
+		} while (0)
+
+#define	USB_DATA_OK(x,i)	((x)->data[(i)].buf != NULL)
+
+#define	USB_DATA_XFER_INIT(x)	do {					\
+			memset((x), 0, sizeof(*(x)));			\
+			pthread_mutex_init(&((x)->mtx), NULL);		\
+		} while (0)
+
+#define	USB_DATA_XFER_RESET(x)	do {					\
+			memset((x)->data, 0, sizeof((x)->data));	\
+			(x)->ndata = 0;					\
+			(x)->head = (x)->tail = 0;			\
+		} while (0)
+
+#define	USB_DATA_XFER_LOCK(x)	do {					\
+			pthread_mutex_lock(&((x)->mtx));		\
+		} while (0)
+
+#define	USB_DATA_XFER_UNLOCK(x)	do {					\
+			pthread_mutex_unlock(&((x)->mtx));		\
+		} while (0)
+#ifndef __FreeBSD__
+#define	USB_DATA_XFER_LOCK_HELD(x) MUTEX_HELD(&((x)->mtx))
+#endif
+
+struct usb_devemu *usb_emu_finddev(char *name);
+
+struct usb_data_xfer_block *usb_data_xfer_append(struct usb_data_xfer *xfer,
+                          void *buf, int blen, void *hci_data, int ccs);
+
+
+#endif /* _USB_EMUL_H_ */
diff --git a/usr/src/cmd/bhyve/usb_mouse.c b/usr/src/cmd/bhyve/usb_mouse.c
new file mode 100644
index 0000000000..e9fc77ed8a
--- /dev/null
+++ b/usr/src/cmd/bhyve/usb_mouse.c
@@ -0,0 +1,800 @@
+/*-
+ * Copyright (c) 2014 Leon Dang <ldang@nahannisys.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/time.h>
+
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <dev/usb/usb.h>
+#include <dev/usb/usbdi.h>
+
+#include "usb_emul.h"
+#include "console.h"
+#include "bhyvegc.h"
+
+static int umouse_debug = 0;
+#define	DPRINTF(params) if (umouse_debug) printf params
+#define	WPRINTF(params) printf params
+
+/* USB endpoint context (1-15) for reporting mouse data events*/
+#define	UMOUSE_INTR_ENDPT	1
+
+#define UMOUSE_REPORT_DESC_TYPE	0x22
+
+#define	UMOUSE_GET_REPORT	0x01
+#define	UMOUSE_GET_IDLE		0x02
+#define	UMOUSE_GET_PROTOCOL	0x03
+#define	UMOUSE_SET_REPORT	0x09
+#define	UMOUSE_SET_IDLE		0x0A
+#define	UMOUSE_SET_PROTOCOL	0x0B
+
+#define HSETW(ptr, val)   ptr = { (uint8_t)(val), (uint8_t)((val) >> 8) }
+
+enum {
+	UMSTR_LANG,
+	UMSTR_MANUFACTURER,
+	UMSTR_PRODUCT,
+	UMSTR_SERIAL,
+	UMSTR_CONFIG,
+	UMSTR_MAX
+};
+
+static const char *umouse_desc_strings[] = {
+	"\x04\x09",
+	"BHYVE",
+	"HID Tablet",
+	"01",
+	"HID Tablet Device",
+};
+
+struct umouse_hid_descriptor {
+	uint8_t	bLength;
+	uint8_t	bDescriptorType;
+	uint8_t	bcdHID[2];
+	uint8_t	bCountryCode;
+	uint8_t	bNumDescriptors;
+	uint8_t	bReportDescriptorType;
+	uint8_t	wItemLength[2];
+} __packed;
+
+struct umouse_config_desc {
+	struct usb_config_descriptor		confd;
+	struct usb_interface_descriptor		ifcd;
+	struct umouse_hid_descriptor		hidd;
+	struct usb_endpoint_descriptor		endpd;
+	struct usb_endpoint_ss_comp_descriptor	sscompd;
+} __packed;
+
+#define MOUSE_MAX_X	0x8000
+#define MOUSE_MAX_Y	0x8000
+
+static const uint8_t umouse_report_desc[] = {
+	0x05, 0x01,		/* USAGE_PAGE (Generic Desktop)		*/
+	0x09, 0x02,		/* USAGE (Mouse)			*/
+	0xa1, 0x01,		/* COLLECTION (Application) 		*/
+	0x09, 0x01,		/*   USAGE (Pointer)			*/
+	0xa1, 0x00,		/*   COLLECTION (Physical)		*/
+	0x05, 0x09,		/*     USAGE_PAGE (Button)		*/
+	0x19, 0x01,		/*     USAGE_MINIMUM (Button 1)		*/
+	0x29, 0x03,		/*     USAGE_MAXIMUM (Button 3)		*/
+	0x15, 0x00,		/*     LOGICAL_MINIMUM (0)		*/
+	0x25, 0x01,		/*     LOGICAL_MAXIMUM (1)		*/
+	0x75, 0x01,		/*     REPORT_SIZE (1)			*/
+	0x95, 0x03,		/*     REPORT_COUNT (3)			*/
+	0x81, 0x02,		/*     INPUT (Data,Var,Abs); 3 buttons	*/
+	0x75, 0x05,		/*     REPORT_SIZE (5)			*/
+	0x95, 0x01,		/*     REPORT_COUNT (1)			*/
+	0x81, 0x03,		/*     INPUT (Cnst,Var,Abs); padding	*/
+	0x05, 0x01,		/*     USAGE_PAGE (Generic Desktop)	*/
+	0x09, 0x30,		/*     USAGE (X)			*/
+	0x09, 0x31,		/*     USAGE (Y)			*/
+	0x35, 0x00,		/*     PHYSICAL_MINIMUM (0)		*/
+	0x46, 0xff, 0x7f,	/*     PHYSICAL_MAXIMUM (0x7fff)	*/
+	0x15, 0x00,		/*     LOGICAL_MINIMUM (0)		*/
+	0x26, 0xff, 0x7f,	/*     LOGICAL_MAXIMUM (0x7fff)		*/
+	0x75, 0x10,		/*     REPORT_SIZE (16)			*/
+	0x95, 0x02,		/*     REPORT_COUNT (2)			*/
+	0x81, 0x02,		/*     INPUT (Data,Var,Abs)		*/
+	0x05, 0x01,		/*     USAGE Page (Generic Desktop)	*/
+	0x09, 0x38,		/*     USAGE (Wheel)			*/
+	0x35, 0x00,		/*     PHYSICAL_MINIMUM (0)		*/
+	0x45, 0x00,		/*     PHYSICAL_MAXIMUM (0)		*/
+	0x15, 0x81,		/*     LOGICAL_MINIMUM (-127)		*/
+	0x25, 0x7f,		/*     LOGICAL_MAXIMUM (127)		*/
+	0x75, 0x08,		/*     REPORT_SIZE (8)			*/
+	0x95, 0x01,		/*     REPORT_COUNT (1)			*/
+	0x81, 0x06,		/*     INPUT (Data,Var,Rel)		*/
+	0xc0,			/*   END_COLLECTION			*/
+	0xc0			/* END_COLLECTION			*/
+};
+
+struct umouse_report {
+	uint8_t	buttons;	/* bits: 0 left, 1 right, 2 middle */
+	int16_t	x;		/* x position */
+	int16_t	y;		/* y position */
+	int8_t	z;		/* z wheel position */
+} __packed;
+
+
+#define	MSETW(ptr, val)	ptr = { (uint8_t)(val), (uint8_t)((val) >> 8) }
+
+static struct usb_device_descriptor umouse_dev_desc = {
+	.bLength = sizeof(umouse_dev_desc),
+	.bDescriptorType = UDESC_DEVICE,
+	MSETW(.bcdUSB, UD_USB_3_0),
+	.bMaxPacketSize = 8,			/* max packet size */
+	MSETW(.idVendor, 0xFB5D),		/* vendor */
+	MSETW(.idProduct, 0x0001),		/* product */
+	MSETW(.bcdDevice, 0),			/* device version */
+	.iManufacturer = UMSTR_MANUFACTURER,
+	.iProduct = UMSTR_PRODUCT,
+	.iSerialNumber = UMSTR_SERIAL,
+	.bNumConfigurations = 1,
+};
+
+static struct umouse_config_desc umouse_confd = {
+	.confd = {
+		.bLength = sizeof(umouse_confd.confd),
+		.bDescriptorType = UDESC_CONFIG,
+		.wTotalLength[0] = sizeof(umouse_confd),
+		.bNumInterface = 1,
+		.bConfigurationValue = 1,
+		.iConfiguration = UMSTR_CONFIG,
+		.bmAttributes = UC_BUS_POWERED | UC_REMOTE_WAKEUP,
+		.bMaxPower = 0,
+	},
+	.ifcd = {
+		.bLength = sizeof(umouse_confd.ifcd),
+		.bDescriptorType = UDESC_INTERFACE,
+		.bNumEndpoints = 1,
+		.bInterfaceClass = UICLASS_HID,
+		.bInterfaceSubClass = UISUBCLASS_BOOT,
+		.bInterfaceProtocol = UIPROTO_MOUSE,
+	},
+	.hidd = {
+		.bLength = sizeof(umouse_confd.hidd),
+		.bDescriptorType = 0x21,
+		.bcdHID = { 0x01, 0x10 },
+		.bCountryCode = 0,
+		.bNumDescriptors = 1,
+		.bReportDescriptorType = UMOUSE_REPORT_DESC_TYPE,
+		.wItemLength = { sizeof(umouse_report_desc), 0 },
+	},
+	.endpd = {
+		.bLength = sizeof(umouse_confd.endpd),
+		.bDescriptorType = UDESC_ENDPOINT,
+		.bEndpointAddress = UE_DIR_IN | UMOUSE_INTR_ENDPT,
+		.bmAttributes = UE_INTERRUPT,
+		.wMaxPacketSize[0] = 8,
+		.bInterval = 0xA,
+	},
+	.sscompd = {
+		.bLength = sizeof(umouse_confd.sscompd),
+		.bDescriptorType = UDESC_ENDPOINT_SS_COMP,
+		.bMaxBurst = 0,
+		.bmAttributes = 0,
+		MSETW(.wBytesPerInterval, 0),
+	},
+};
+
+
+struct umouse_bos_desc {
+	struct usb_bos_descriptor		bosd;
+	struct usb_devcap_ss_descriptor		usbssd;
+} __packed;
+
+
+struct umouse_bos_desc umouse_bosd = {
+	.bosd = {
+		.bLength = sizeof(umouse_bosd.bosd),
+		.bDescriptorType = UDESC_BOS,
+		HSETW(.wTotalLength, sizeof(umouse_bosd)),
+		.bNumDeviceCaps = 1,
+	},
+        .usbssd = {
+                .bLength = sizeof(umouse_bosd.usbssd),
+                .bDescriptorType = UDESC_DEVICE_CAPABILITY,
+                .bDevCapabilityType = 3,
+                .bmAttributes = 0,
+                HSETW(.wSpeedsSupported, 0x08),
+                .bFunctionalitySupport = 3,
+                .bU1DevExitLat = 0xa,   /* dummy - not used */
+                .wU2DevExitLat = { 0x20, 0x00 },
+        }
+};
+
+
+struct umouse_softc {
+	struct usb_hci *hci;
+
+	char	*opt;
+
+	struct umouse_report um_report;
+	int	newdata;
+	struct {
+		uint8_t	idle;
+		uint8_t	protocol;
+		uint8_t	feature;
+	} hid;
+
+	pthread_mutex_t	mtx;
+	pthread_mutex_t	ev_mtx;
+	int		polling;
+	struct timeval	prev_evt;
+};
+
+static void
+umouse_event(uint8_t button, int x, int y, void *arg)
+{
+	struct umouse_softc *sc;
+	struct bhyvegc_image *gc;
+
+	gc = console_get_image();
+	if (gc == NULL) {
+		/* not ready */
+		return;
+	}
+
+	sc = arg;
+
+	pthread_mutex_lock(&sc->mtx);
+
+	sc->um_report.buttons = 0;
+	sc->um_report.z = 0;
+
+	if (button & 0x01)
+		sc->um_report.buttons |= 0x01;	/* left */
+	if (button & 0x02)
+		sc->um_report.buttons |= 0x04;	/* middle */
+	if (button & 0x04)
+		sc->um_report.buttons |= 0x02;	/* right */
+	if (button & 0x8)
+		sc->um_report.z = 1;
+	if (button & 0x10)
+		sc->um_report.z = -1;
+
+	/* scale coords to mouse resolution */
+	sc->um_report.x = MOUSE_MAX_X * x / gc->width;
+	sc->um_report.y = MOUSE_MAX_Y * y / gc->height;
+	sc->newdata = 1;
+	pthread_mutex_unlock(&sc->mtx);
+
+	pthread_mutex_lock(&sc->ev_mtx);
+	sc->hci->hci_intr(sc->hci, UE_DIR_IN | UMOUSE_INTR_ENDPT);
+	pthread_mutex_unlock(&sc->ev_mtx);
+}
+
+static void *
+umouse_init(struct usb_hci *hci, char *opt)
+{
+	struct umouse_softc *sc;
+
+	sc = calloc(1, sizeof(struct umouse_softc));
+	sc->hci = hci;
+
+	sc->hid.protocol = 1;	/* REPORT protocol */
+	sc->opt = strdup(opt);
+	pthread_mutex_init(&sc->mtx, NULL);
+	pthread_mutex_init(&sc->ev_mtx, NULL);
+
+	console_ptr_register(umouse_event, sc, 10);
+
+	return (sc);
+}
+
+#define	UREQ(x,y)	((x) | ((y) << 8))
+
+static int
+umouse_request(void *scarg, struct usb_data_xfer *xfer)
+{
+	struct umouse_softc *sc;
+	struct usb_data_xfer_block *data;
+	const char *str;
+	uint16_t value;
+	uint16_t index;
+	uint16_t len;
+	uint16_t slen;
+	uint8_t *udata;
+	int	err;
+	int	i, idx;
+	int	eshort;
+
+	sc = scarg;
+
+	data = NULL;
+	udata = NULL;
+	idx = xfer->head;
+	for (i = 0; i < xfer->ndata; i++) {
+		xfer->data[idx].bdone = 0;
+		if (data == NULL && USB_DATA_OK(xfer,i)) {
+			data = &xfer->data[idx];
+			udata = data->buf;
+		}
+
+		xfer->data[idx].processed = 1;
+		idx = (idx + 1) % USB_MAX_XFER_BLOCKS;
+	}
+
+	err = USB_ERR_NORMAL_COMPLETION;
+	eshort = 0;
+
+	if (!xfer->ureq) {
+		DPRINTF(("umouse_request: port %d\r\n", sc->hci->hci_port));
+		goto done;
+	}
+
+	value = UGETW(xfer->ureq->wValue);
+	index = UGETW(xfer->ureq->wIndex);
+	len = UGETW(xfer->ureq->wLength);
+
+	DPRINTF(("umouse_request: port %d, type 0x%x, req 0x%x, val 0x%x, "
+	         "idx 0x%x, len %u\r\n",
+	         sc->hci->hci_port, xfer->ureq->bmRequestType,
+	         xfer->ureq->bRequest, value, index, len));
+
+	switch (UREQ(xfer->ureq->bRequest, xfer->ureq->bmRequestType)) {
+	case UREQ(UR_GET_CONFIG, UT_READ_DEVICE):
+		DPRINTF(("umouse: (UR_GET_CONFIG, UT_READ_DEVICE)\r\n"));
+		if (!data)
+			break;
+
+		*udata = umouse_confd.confd.bConfigurationValue;
+		data->blen = len > 0 ? len - 1 : 0;
+		eshort = data->blen > 0;
+		data->bdone += 1;
+		break;
+
+	case UREQ(UR_GET_DESCRIPTOR, UT_READ_DEVICE):
+		DPRINTF(("umouse: (UR_GET_DESCRIPTOR, UT_READ_DEVICE) val %x\r\n",
+		        value >> 8));
+		if (!data)
+			break;
+
+		switch (value >> 8) {
+		case UDESC_DEVICE:
+			DPRINTF(("umouse: (->UDESC_DEVICE) len %u ?= "
+			         "sizeof(umouse_dev_desc) %lu\r\n",
+			         len, sizeof(umouse_dev_desc)));
+			if ((value & 0xFF) != 0) {
+				err = USB_ERR_IOERROR;
+				goto done;
+			}
+			if (len > sizeof(umouse_dev_desc)) {
+				data->blen = len - sizeof(umouse_dev_desc);
+				len = sizeof(umouse_dev_desc);
+			} else
+				data->blen = 0;
+			memcpy(data->buf, &umouse_dev_desc, len);
+			data->bdone += len;
+			break;
+
+		case UDESC_CONFIG:
+			DPRINTF(("umouse: (->UDESC_CONFIG)\r\n"));
+			if ((value & 0xFF) != 0) {
+				err = USB_ERR_IOERROR;
+				goto done;
+			}
+			if (len > sizeof(umouse_confd)) {
+				data->blen = len - sizeof(umouse_confd);
+				len = sizeof(umouse_confd);
+			} else
+				data->blen = 0;
+
+			memcpy(data->buf, &umouse_confd, len);
+			data->bdone += len;
+			break;
+
+		case UDESC_STRING:
+			DPRINTF(("umouse: (->UDESC_STRING)\r\n"));
+			str = NULL;
+			if ((value & 0xFF) < UMSTR_MAX)
+				str = umouse_desc_strings[value & 0xFF];
+			else
+				goto done;
+
+			if ((value & 0xFF) == UMSTR_LANG) {
+				udata[0] = 4;
+				udata[1] = UDESC_STRING;
+				data->blen = len - 2;
+				len -= 2;
+				data->bdone += 2;
+
+				if (len >= 2) {
+					udata[2] = str[0];
+					udata[3] = str[1];
+					data->blen -= 2;
+					data->bdone += 2;
+				} else
+					data->blen = 0;
+
+				goto done;
+			}
+
+			slen = 2 + strlen(str) * 2;
+			udata[0] = slen;
+			udata[1] = UDESC_STRING;
+
+			if (len > slen) {
+				data->blen = len - slen;
+				len = slen;
+			} else
+				data->blen = 0;
+			for (i = 2; i < len; i += 2) {
+				udata[i] = *str++;
+				udata[i+1] = '\0';
+			}
+			data->bdone += slen;
+
+			break;
+
+		case UDESC_BOS:
+			DPRINTF(("umouse: USB3 BOS\r\n"));
+			if (len > sizeof(umouse_bosd)) {
+				data->blen = len - sizeof(umouse_bosd);
+				len = sizeof(umouse_bosd);
+			} else
+				data->blen = 0;
+			memcpy(udata, &umouse_bosd, len);
+			data->bdone += len;
+			break;
+
+		default:
+			DPRINTF(("umouse: unknown(%d)->ERROR\r\n", value >> 8));
+			err = USB_ERR_IOERROR;
+			goto done;
+		}
+		eshort = data->blen > 0;
+		break;
+
+	case UREQ(UR_GET_DESCRIPTOR, UT_READ_INTERFACE):
+		DPRINTF(("umouse: (UR_GET_DESCRIPTOR, UT_READ_INTERFACE) "
+		         "0x%x\r\n", (value >> 8)));
+		if (!data)
+			break;
+
+		switch (value >> 8) {
+		case UMOUSE_REPORT_DESC_TYPE:
+			if (len > sizeof(umouse_report_desc)) {
+				data->blen = len - sizeof(umouse_report_desc);
+				len = sizeof(umouse_report_desc);
+			} else
+				data->blen = 0;
+			memcpy(data->buf, umouse_report_desc, len);
+			data->bdone += len;
+			break;
+		default:
+			DPRINTF(("umouse: IO ERROR\r\n"));
+			err = USB_ERR_IOERROR;
+			goto done;
+		}
+		eshort = data->blen > 0;
+		break;
+
+	case UREQ(UR_GET_INTERFACE, UT_READ_INTERFACE):
+		DPRINTF(("umouse: (UR_GET_INTERFACE, UT_READ_INTERFACE)\r\n"));
+		if (index != 0) {
+			DPRINTF(("umouse get_interface, invalid index %d\r\n",
+			        index));
+			err = USB_ERR_IOERROR;
+			goto done;
+		}
+
+		if (!data)
+			break;
+
+		if (len > 0) {
+			*udata = 0;
+			data->blen = len - 1;
+		}
+		eshort = data->blen > 0;
+		data->bdone += 1;
+		break;
+
+	case UREQ(UR_GET_STATUS, UT_READ_DEVICE):
+		DPRINTF(("umouse: (UR_GET_STATUS, UT_READ_DEVICE)\r\n"));
+		if (data != NULL && len > 1) {
+			if (sc->hid.feature == UF_DEVICE_REMOTE_WAKEUP)
+				USETW(udata, UDS_REMOTE_WAKEUP);
+			else
+				USETW(udata, 0);
+			data->blen = len - 2;
+			data->bdone += 2;
+		}
+
+		eshort = data->blen > 0;
+		break;
+
+	case UREQ(UR_GET_STATUS, UT_READ_INTERFACE): 
+	case UREQ(UR_GET_STATUS, UT_READ_ENDPOINT): 
+		DPRINTF(("umouse: (UR_GET_STATUS, UT_READ_INTERFACE)\r\n"));
+		if (data != NULL && len > 1) {
+			USETW(udata, 0);
+			data->blen = len - 2;
+			data->bdone += 2;
+		}
+		eshort = data->blen > 0;
+		break;
+
+	case UREQ(UR_SET_ADDRESS, UT_WRITE_DEVICE):
+		/* XXX Controller should've handled this */
+		DPRINTF(("umouse set address %u\r\n", value));
+		break;
+
+	case UREQ(UR_SET_CONFIG, UT_WRITE_DEVICE):
+		DPRINTF(("umouse set config %u\r\n", value));
+		break;
+
+	case UREQ(UR_SET_DESCRIPTOR, UT_WRITE_DEVICE):
+		DPRINTF(("umouse set descriptor %u\r\n", value));
+		break;
+
+
+	case UREQ(UR_CLEAR_FEATURE, UT_WRITE_DEVICE):
+		DPRINTF(("umouse: (UR_SET_FEATURE, UT_WRITE_DEVICE) %x\r\n", value));
+		if (value == UF_DEVICE_REMOTE_WAKEUP)
+			sc->hid.feature = 0;
+		break;
+
+	case UREQ(UR_SET_FEATURE, UT_WRITE_DEVICE):
+		DPRINTF(("umouse: (UR_SET_FEATURE, UT_WRITE_DEVICE) %x\r\n", value));
+		if (value == UF_DEVICE_REMOTE_WAKEUP)
+			sc->hid.feature = UF_DEVICE_REMOTE_WAKEUP;
+		break;
+
+	case UREQ(UR_CLEAR_FEATURE, UT_WRITE_INTERFACE):
+	case UREQ(UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT):
+	case UREQ(UR_SET_FEATURE, UT_WRITE_INTERFACE):
+	case UREQ(UR_SET_FEATURE, UT_WRITE_ENDPOINT):
+		DPRINTF(("umouse: (UR_CLEAR_FEATURE, UT_WRITE_INTERFACE)\r\n"));
+		err = USB_ERR_IOERROR;
+		goto done;
+
+	case UREQ(UR_SET_INTERFACE, UT_WRITE_INTERFACE):
+		DPRINTF(("umouse set interface %u\r\n", value));
+		break;
+
+	case UREQ(UR_ISOCH_DELAY, UT_WRITE_DEVICE):
+		DPRINTF(("umouse set isoch delay %u\r\n", value));
+		break;
+
+	case UREQ(UR_SET_SEL, 0):
+		DPRINTF(("umouse set sel\r\n"));
+		break;
+
+	case UREQ(UR_SYNCH_FRAME, UT_WRITE_ENDPOINT):
+		DPRINTF(("umouse synch frame\r\n"));
+		break;
+
+	/* HID device requests */
+
+	case UREQ(UMOUSE_GET_REPORT, UT_READ_CLASS_INTERFACE):
+		DPRINTF(("umouse: (UMOUSE_GET_REPORT, UT_READ_CLASS_INTERFACE) "
+		         "0x%x\r\n", (value >> 8)));
+		if (!data)
+			break;
+
+		if ((value >> 8) == 0x01 && len >= sizeof(sc->um_report)) {
+			/* TODO read from backend */
+
+			if (len > sizeof(sc->um_report)) {
+				data->blen = len - sizeof(sc->um_report);
+				len = sizeof(sc->um_report);
+			} else
+				data->blen = 0;
+
+			memcpy(data->buf, &sc->um_report, len);
+			data->bdone += len;
+		} else {
+			err = USB_ERR_IOERROR;
+			goto done;
+		}
+		eshort = data->blen > 0;
+		break;
+
+	case UREQ(UMOUSE_GET_IDLE, UT_READ_CLASS_INTERFACE):
+		if (data != NULL && len > 0) {
+			*udata = sc->hid.idle;
+			data->blen = len - 1;
+			data->bdone += 1;
+		}
+		eshort = data->blen > 0;
+		break;
+
+	case UREQ(UMOUSE_GET_PROTOCOL, UT_READ_CLASS_INTERFACE):
+		if (data != NULL && len > 0) {
+			*udata = sc->hid.protocol;
+			data->blen = len - 1;
+			data->bdone += 1;
+		}
+		eshort = data->blen > 0;
+		break;
+
+	case UREQ(UMOUSE_SET_REPORT, UT_WRITE_CLASS_INTERFACE):
+		DPRINTF(("umouse: (UMOUSE_SET_REPORT, UT_WRITE_CLASS_INTERFACE) ignored\r\n"));
+		break;
+
+	case UREQ(UMOUSE_SET_IDLE, UT_WRITE_CLASS_INTERFACE):
+		sc->hid.idle = UGETW(xfer->ureq->wValue) >> 8;
+		DPRINTF(("umouse: (UMOUSE_SET_IDLE, UT_WRITE_CLASS_INTERFACE) %x\r\n",
+		        sc->hid.idle));
+		break;
+
+	case UREQ(UMOUSE_SET_PROTOCOL, UT_WRITE_CLASS_INTERFACE):
+		sc->hid.protocol = UGETW(xfer->ureq->wValue) >> 8;
+		DPRINTF(("umouse: (UR_CLEAR_FEATURE, UT_WRITE_CLASS_INTERFACE) %x\r\n",
+		        sc->hid.protocol));
+		break;
+
+	default:
+		DPRINTF(("**** umouse request unhandled\r\n"));
+		err = USB_ERR_IOERROR;
+		break;
+	}
+
+done:
+	if (xfer->ureq && (xfer->ureq->bmRequestType & UT_WRITE) &&
+	    (err == USB_ERR_NORMAL_COMPLETION) && (data != NULL))
+		data->blen = 0;
+	else if (eshort)
+		err = USB_ERR_SHORT_XFER;
+
+	DPRINTF(("umouse request error code %d (0=ok), blen %u txlen %u\r\n",
+	        err, (data ? data->blen : 0), (data ? data->bdone : 0)));
+
+	return (err);
+}
+
+static int
+umouse_data_handler(void *scarg, struct usb_data_xfer *xfer, int dir,
+     int epctx)
+{
+	struct umouse_softc *sc;
+	struct usb_data_xfer_block *data;
+	uint8_t *udata;
+	int len, i, idx;
+	int err;
+
+	DPRINTF(("umouse handle data - DIR=%s|EP=%d, blen %d\r\n",
+	        dir ? "IN" : "OUT", epctx, xfer->data[0].blen));
+
+
+	/* find buffer to add data */
+	udata = NULL;
+	err = USB_ERR_NORMAL_COMPLETION;
+
+	/* handle xfer at first unprocessed item with buffer */
+	data = NULL;
+	idx = xfer->head;
+	for (i = 0; i < xfer->ndata; i++) {
+		data = &xfer->data[idx];
+		if (data->buf != NULL && data->blen != 0) {
+			break;
+		} else {
+			data->processed = 1;
+			data = NULL;
+		}
+		idx = (idx + 1) % USB_MAX_XFER_BLOCKS;
+	}
+	if (!data)
+		goto done;
+
+	udata = data->buf;
+	len = data->blen;
+
+	if (udata == NULL) {
+		DPRINTF(("umouse no buffer provided for input\r\n"));
+		err = USB_ERR_NOMEM;
+		goto done;
+	}
+
+	sc = scarg;
+
+	if (dir) {
+
+		pthread_mutex_lock(&sc->mtx);
+
+		if (!sc->newdata) {
+			err = USB_ERR_CANCELLED;
+			USB_DATA_SET_ERRCODE(&xfer->data[xfer->head], USB_NAK);
+			pthread_mutex_unlock(&sc->mtx);
+			goto done;
+		}
+
+		if (sc->polling) {
+			err = USB_ERR_STALLED;
+			USB_DATA_SET_ERRCODE(data, USB_STALL);
+			pthread_mutex_unlock(&sc->mtx);
+			goto done;
+		}
+		sc->polling = 1;
+
+		if (len > 0) {
+			sc->newdata = 0;
+
+			data->processed = 1;
+			data->bdone += 6;
+			memcpy(udata, &sc->um_report, 6);
+			data->blen = len - 6;
+			if (data->blen > 0)
+				err = USB_ERR_SHORT_XFER;
+		}
+
+		sc->polling = 0;
+		pthread_mutex_unlock(&sc->mtx);
+	} else { 
+		USB_DATA_SET_ERRCODE(data, USB_STALL);
+		err = USB_ERR_STALLED;
+	}
+
+done:
+	return (err);
+}
+
+static int
+umouse_reset(void *scarg)
+{
+	struct umouse_softc *sc;
+
+	sc = scarg;
+
+	sc->newdata = 0;
+
+	return (0);
+}
+
+static int
+umouse_remove(void *scarg)
+{
+
+	return (0);
+}
+
+static int
+umouse_stop(void *scarg)
+{
+
+	return (0);
+}
+
+
+struct usb_devemu ue_mouse = {
+	.ue_emu =	"tablet",
+	.ue_usbver =	3,
+	.ue_usbspeed =	USB_SPEED_HIGH,
+	.ue_init =	umouse_init,
+	.ue_request =	umouse_request,
+	.ue_data =	umouse_data_handler,
+	.ue_reset =	umouse_reset,
+	.ue_remove =	umouse_remove,
+	.ue_stop =	umouse_stop
+};
+USB_EMUL_SET(ue_mouse);
diff --git a/usr/src/cmd/bhyve/vga.c b/usr/src/cmd/bhyve/vga.c
new file mode 100644
index 0000000000..26526c40b6
--- /dev/null
+++ b/usr/src/cmd/bhyve/vga.c
@@ -0,0 +1,1347 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+
+#include <assert.h>
+#include <pthread.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <machine/vmm.h>
+
+#include "bhyvegc.h"
+#include "console.h"
+#include "inout.h"
+#include "mem.h"
+#include "vga.h"
+
+#define	KB	(1024UL)
+#define	MB	(1024 * 1024UL)
+
+struct vga_softc {
+	struct mem_range	mr;
+
+	struct bhyvegc		*gc;
+	int			gc_width;
+	int			gc_height;
+	struct bhyvegc_image	*gc_image;
+
+	uint8_t			*vga_ram;
+
+	/*
+	 * General registers
+	 */
+	uint8_t			vga_misc;
+	uint8_t			vga_sts1;
+
+	/*
+	 * Sequencer
+	 */
+	struct {
+		int		seq_index;
+		uint8_t		seq_reset;
+		uint8_t		seq_clock_mode;
+		int		seq_cm_dots;
+		uint8_t		seq_map_mask;
+		uint8_t		seq_cmap_sel;
+		int		seq_cmap_pri_off;
+		int		seq_cmap_sec_off;
+		uint8_t		seq_mm;
+	} vga_seq;
+
+	/*
+	 * CRT Controller
+	 */
+	struct {
+		int		crtc_index;
+		uint8_t		crtc_mode_ctrl;
+		uint8_t		crtc_horiz_total;
+		uint8_t		crtc_horiz_disp_end;
+		uint8_t		crtc_start_horiz_blank;
+		uint8_t		crtc_end_horiz_blank;
+		uint8_t		crtc_start_horiz_retrace;
+		uint8_t		crtc_end_horiz_retrace;
+		uint8_t		crtc_vert_total;
+		uint8_t		crtc_overflow;
+		uint8_t		crtc_present_row_scan;
+		uint8_t		crtc_max_scan_line;
+		uint8_t		crtc_cursor_start;
+		uint8_t		crtc_cursor_on;
+		uint8_t		crtc_cursor_end;
+		uint8_t		crtc_start_addr_high;
+		uint8_t		crtc_start_addr_low;
+		uint16_t	crtc_start_addr;
+		uint8_t		crtc_cursor_loc_low;
+		uint8_t		crtc_cursor_loc_high;
+		uint16_t	crtc_cursor_loc;
+		uint8_t		crtc_vert_retrace_start;
+		uint8_t		crtc_vert_retrace_end;
+		uint8_t		crtc_vert_disp_end;
+		uint8_t		crtc_offset;
+		uint8_t		crtc_underline_loc;
+		uint8_t		crtc_start_vert_blank;
+		uint8_t		crtc_end_vert_blank;
+		uint8_t		crtc_line_compare;
+	} vga_crtc;
+
+	/*
+	 * Graphics Controller
+	 */
+	struct {
+		int		gc_index;
+		uint8_t		gc_set_reset;
+		uint8_t		gc_enb_set_reset;
+		uint8_t		gc_color_compare;
+		uint8_t		gc_rotate;
+		uint8_t		gc_op;
+		uint8_t		gc_read_map_sel;
+		uint8_t		gc_mode;
+		bool		gc_mode_c4;		/* chain 4 */
+		bool		gc_mode_oe;		/* odd/even */
+		uint8_t		gc_mode_rm;		/* read mode */
+		uint8_t		gc_mode_wm;		/* write mode */
+		uint8_t		gc_misc;
+		uint8_t		gc_misc_gm;		/* graphics mode */
+		uint8_t		gc_misc_mm;		/* memory map */
+		uint8_t		gc_color_dont_care;
+		uint8_t		gc_bit_mask;
+		uint8_t		gc_latch0;
+		uint8_t		gc_latch1;
+		uint8_t		gc_latch2;
+		uint8_t		gc_latch3;
+	} vga_gc;
+
+	/*
+	 * Attribute Controller
+	 */
+	struct {
+		int		atc_flipflop;
+		int		atc_index;
+		uint8_t		atc_palette[16];
+		uint8_t		atc_mode;
+		uint8_t		atc_overscan_color;
+		uint8_t		atc_color_plane_enb;
+		uint8_t		atc_horiz_pixel_panning;
+		uint8_t		atc_color_select;
+		uint8_t		atc_color_select_45;
+		uint8_t		atc_color_select_67;
+	} vga_atc;
+
+	/*
+	 * DAC
+	 */
+	struct {
+		uint8_t		dac_state;
+		uint8_t		dac_rd_index;
+		uint8_t		dac_rd_subindex;
+		uint8_t		dac_wr_index;
+		uint8_t		dac_wr_subindex;
+		uint8_t		dac_palette[3 * 256];
+		uint32_t	dac_palette_rgb[256];
+	} vga_dac;
+};
+
+static bool
+vga_in_reset(struct vga_softc *sc)
+{
+	return (((sc->vga_seq.seq_clock_mode & SEQ_CM_SO) != 0) ||
+	    ((sc->vga_seq.seq_reset & SEQ_RESET_ASYNC) == 0) ||
+	    ((sc->vga_seq.seq_reset & SEQ_RESET_SYNC) == 0) ||
+	    ((sc->vga_crtc.crtc_mode_ctrl & CRTC_MC_TE) == 0));
+}
+
+static void
+vga_check_size(struct bhyvegc *gc, struct vga_softc *sc)
+{
+	int old_width, old_height;
+
+	if (vga_in_reset(sc))
+		return;
+
+	//old_width = sc->gc_width;
+	//old_height = sc->gc_height;
+	old_width = sc->gc_image->width;
+	old_height = sc->gc_image->height;
+
+	/*
+	 * Horizontal Display End: For text modes this is the number
+	 * of characters.  For graphics modes this is the number of
+	 * pixels per scanlines divided by the number of pixels per
+	 * character clock.
+	 */
+	sc->gc_width = (sc->vga_crtc.crtc_horiz_disp_end + 1) *
+	    sc->vga_seq.seq_cm_dots;
+
+	sc->gc_height = (sc->vga_crtc.crtc_vert_disp_end |
+	    (((sc->vga_crtc.crtc_overflow & CRTC_OF_VDE8) >> CRTC_OF_VDE8_SHIFT) << 8) |
+	    (((sc->vga_crtc.crtc_overflow & CRTC_OF_VDE9) >> CRTC_OF_VDE9_SHIFT) << 9)) + 1;
+
+	if (old_width != sc->gc_width || old_height != sc->gc_height)
+		bhyvegc_resize(gc, sc->gc_width, sc->gc_height);
+}
+
+static uint32_t
+vga_get_pixel(struct vga_softc *sc, int x, int y)
+{
+	int offset;
+	int bit;
+	uint8_t data;
+	uint8_t idx;
+
+	offset = (y * sc->gc_width / 8) + (x / 8);
+	bit = 7 - (x % 8);
+
+	data = (((sc->vga_ram[offset + 0 * 64*KB] >> bit) & 0x1) << 0) |
+		(((sc->vga_ram[offset + 1 * 64*KB] >> bit) & 0x1) << 1) |
+		(((sc->vga_ram[offset + 2 * 64*KB] >> bit) & 0x1) << 2) |
+		(((sc->vga_ram[offset + 3 * 64*KB] >> bit) & 0x1) << 3);
+
+	data &= sc->vga_atc.atc_color_plane_enb;
+
+	if (sc->vga_atc.atc_mode & ATC_MC_IPS) {
+		idx = sc->vga_atc.atc_palette[data] & 0x0f;
+		idx |= sc->vga_atc.atc_color_select_45;
+	} else {
+		idx = sc->vga_atc.atc_palette[data];
+	}
+	idx |= sc->vga_atc.atc_color_select_67;
+
+	return (sc->vga_dac.dac_palette_rgb[idx]);
+}
+
+static void
+vga_render_graphics(struct vga_softc *sc)
+{
+	int x, y;
+
+	for (y = 0; y < sc->gc_height; y++) {
+		for (x = 0; x < sc->gc_width; x++) {
+			int offset;
+
+			offset = y * sc->gc_width + x;
+			sc->gc_image->data[offset] = vga_get_pixel(sc, x, y);
+		}
+	}
+}
+
+static uint32_t
+vga_get_text_pixel(struct vga_softc *sc, int x, int y)
+{
+	int dots, offset, bit, font_offset;
+	uint8_t ch, attr, font;
+	uint8_t idx;
+
+	dots = sc->vga_seq.seq_cm_dots;
+
+	offset = 2 * sc->vga_crtc.crtc_start_addr;
+	offset += (y / 16 * sc->gc_width / dots) * 2 + (x / dots) * 2;
+
+	bit = 7 - (x % dots > 7 ? 7 : x % dots);
+
+	ch = sc->vga_ram[offset + 0 * 64*KB];
+	attr = sc->vga_ram[offset + 1 * 64*KB];
+
+	if (sc->vga_crtc.crtc_cursor_on &&
+	    (offset == (sc->vga_crtc.crtc_cursor_loc * 2)) &&
+	    ((y % 16) >= (sc->vga_crtc.crtc_cursor_start & CRTC_CS_CS)) &&
+	    ((y % 16) <= (sc->vga_crtc.crtc_cursor_end & CRTC_CE_CE))) {
+		idx = sc->vga_atc.atc_palette[attr & 0xf];
+		return (sc->vga_dac.dac_palette_rgb[idx]);
+	}
+
+	if ((sc->vga_seq.seq_mm & SEQ_MM_EM) &&
+	    sc->vga_seq.seq_cmap_pri_off != sc->vga_seq.seq_cmap_sec_off) {
+		if (attr & 0x8)
+			font_offset = sc->vga_seq.seq_cmap_pri_off +
+				(ch << 5) + y % 16;
+		else
+			font_offset = sc->vga_seq.seq_cmap_sec_off +
+				(ch << 5) + y % 16;
+		attr &= ~0x8;
+	} else {
+		font_offset = (ch << 5) + y % 16;
+	}
+
+	font = sc->vga_ram[font_offset + 2 * 64*KB];
+
+	if (font & (1 << bit))
+		idx = sc->vga_atc.atc_palette[attr & 0xf];
+	else
+		idx = sc->vga_atc.atc_palette[attr >> 4];
+
+	return (sc->vga_dac.dac_palette_rgb[idx]);
+}
+
+static void
+vga_render_text(struct vga_softc *sc)
+{
+	int x, y;
+
+	for (y = 0; y < sc->gc_height; y++) {
+		for (x = 0; x < sc->gc_width; x++) {
+			int offset;
+
+			offset = y * sc->gc_width + x;
+			sc->gc_image->data[offset] = vga_get_text_pixel(sc, x, y);
+		}
+	}
+}
+
+void
+vga_render(struct bhyvegc *gc, void *arg)
+{
+	struct vga_softc *sc = arg;
+
+	vga_check_size(gc, sc);
+
+	if (vga_in_reset(sc)) {
+		memset(sc->gc_image->data, 0,
+		    sc->gc_image->width * sc->gc_image->height *
+		     sizeof (uint32_t));
+		return;
+	}
+
+	if (sc->vga_gc.gc_misc_gm && (sc->vga_atc.atc_mode & ATC_MC_GA))
+		vga_render_graphics(sc);
+	else
+		vga_render_text(sc);
+}
+
+static uint64_t
+vga_mem_rd_handler(struct vmctx *ctx, uint64_t addr, void *arg1)
+{
+	struct vga_softc *sc = arg1;
+	uint8_t map_sel;
+	int offset;
+
+	offset = addr;
+	switch (sc->vga_gc.gc_misc_mm) {
+	case 0x0:
+		/*
+		 * extended mode: base 0xa0000 size 128k
+		 */
+		offset -=0xa0000;
+		offset &= (128 * KB - 1);
+		break;
+	case 0x1:
+		/*
+		 * EGA/VGA mode: base 0xa0000 size 64k
+		 */
+		offset -=0xa0000;
+		offset &= (64 * KB - 1);
+		break;
+	case 0x2:
+		/*
+		 * monochrome text mode: base 0xb0000 size 32kb
+		 */
+		assert(0);
+	case 0x3:
+		/*
+		 * color text mode and CGA: base 0xb8000 size 32kb
+		 */
+		offset -=0xb8000;
+		offset &= (32 * KB - 1);
+		break;
+	}
+
+	/* Fill latches. */
+	sc->vga_gc.gc_latch0 = sc->vga_ram[offset + 0*64*KB];
+	sc->vga_gc.gc_latch1 = sc->vga_ram[offset + 1*64*KB];
+	sc->vga_gc.gc_latch2 = sc->vga_ram[offset + 2*64*KB];
+	sc->vga_gc.gc_latch3 = sc->vga_ram[offset + 3*64*KB];
+
+	if (sc->vga_gc.gc_mode_rm) {
+		/* read mode 1 */
+		assert(0);
+	}
+
+	map_sel = sc->vga_gc.gc_read_map_sel;
+	if (sc->vga_gc.gc_mode_oe) {
+		map_sel |= (offset & 1);
+		offset &= ~1;
+	}
+
+	/* read mode 0: return the byte from the selected plane. */
+	offset += map_sel * 64*KB;
+
+	return (sc->vga_ram[offset]);
+}
+
+static void
+vga_mem_wr_handler(struct vmctx *ctx, uint64_t addr, uint8_t val, void *arg1)
+{
+	struct vga_softc *sc = arg1;
+	uint8_t c0, c1, c2, c3;
+	uint8_t m0, m1, m2, m3;
+	uint8_t set_reset;
+	uint8_t enb_set_reset;
+	uint8_t	mask;
+	int offset;
+
+	offset = addr;
+	switch (sc->vga_gc.gc_misc_mm) {
+	case 0x0:
+		/*
+		 * extended mode: base 0xa0000 size 128kb
+		 */
+		offset -=0xa0000;
+		offset &= (128 * KB - 1);
+		break;
+	case 0x1:
+		/*
+		 * EGA/VGA mode: base 0xa0000 size 64kb
+		 */
+		offset -=0xa0000;
+		offset &= (64 * KB - 1);
+		break;
+	case 0x2:
+		/*
+		 * monochrome text mode: base 0xb0000 size 32kb
+		 */
+		assert(0);
+	case 0x3:
+		/*
+		 * color text mode and CGA: base 0xb8000 size 32kb
+		 */
+		offset -=0xb8000;
+		offset &= (32 * KB - 1);
+		break;
+	}
+
+	set_reset = sc->vga_gc.gc_set_reset;
+	enb_set_reset = sc->vga_gc.gc_enb_set_reset;
+
+	c0 = sc->vga_gc.gc_latch0;
+	c1 = sc->vga_gc.gc_latch1;
+	c2 = sc->vga_gc.gc_latch2;
+	c3 = sc->vga_gc.gc_latch3;
+
+	switch (sc->vga_gc.gc_mode_wm) {
+	case 0:
+		/* write mode 0 */
+		mask = sc->vga_gc.gc_bit_mask;
+
+		val = (val >> sc->vga_gc.gc_rotate) |
+		    (val << (8 - sc->vga_gc.gc_rotate));
+
+		switch (sc->vga_gc.gc_op) {
+		case 0x00:		/* replace */
+			m0 = (set_reset & 1) ? mask : 0x00;
+			m1 = (set_reset & 2) ? mask : 0x00;
+			m2 = (set_reset & 4) ? mask : 0x00;
+			m3 = (set_reset & 8) ? mask : 0x00;
+
+			c0 = (enb_set_reset & 1) ? (c0 & ~mask) : (val & mask);
+			c1 = (enb_set_reset & 2) ? (c1 & ~mask) : (val & mask);
+			c2 = (enb_set_reset & 4) ? (c2 & ~mask) : (val & mask);
+			c3 = (enb_set_reset & 8) ? (c3 & ~mask) : (val & mask);
+
+			c0 |= m0;
+			c1 |= m1;
+			c2 |= m2;
+			c3 |= m3;
+			break;
+		case 0x08:		/* AND */
+			m0 = set_reset & 1 ? 0xff : ~mask;
+			m1 = set_reset & 2 ? 0xff : ~mask;
+			m2 = set_reset & 4 ? 0xff : ~mask;
+			m3 = set_reset & 8 ? 0xff : ~mask;
+
+			c0 = enb_set_reset & 1 ? c0 & m0 : val & m0;
+			c1 = enb_set_reset & 2 ? c1 & m1 : val & m1;
+			c2 = enb_set_reset & 4 ? c2 & m2 : val & m2;
+			c3 = enb_set_reset & 8 ? c3 & m3 : val & m3;
+			break;
+		case 0x10:		/* OR */
+			m0 = set_reset & 1 ? mask : 0x00;
+			m1 = set_reset & 2 ? mask : 0x00;
+			m2 = set_reset & 4 ? mask : 0x00;
+			m3 = set_reset & 8 ? mask : 0x00;
+
+			c0 = enb_set_reset & 1 ? c0 | m0 : val | m0;
+			c1 = enb_set_reset & 2 ? c1 | m1 : val | m1;
+			c2 = enb_set_reset & 4 ? c2 | m2 : val | m2;
+			c3 = enb_set_reset & 8 ? c3 | m3 : val | m3;
+			break;
+		case 0x18:		/* XOR */
+			m0 = set_reset & 1 ? mask : 0x00;
+			m1 = set_reset & 2 ? mask : 0x00;
+			m2 = set_reset & 4 ? mask : 0x00;
+			m3 = set_reset & 8 ? mask : 0x00;
+
+			c0 = enb_set_reset & 1 ? c0 ^ m0 : val ^ m0;
+			c1 = enb_set_reset & 2 ? c1 ^ m1 : val ^ m1;
+			c2 = enb_set_reset & 4 ? c2 ^ m2 : val ^ m2;
+			c3 = enb_set_reset & 8 ? c3 ^ m3 : val ^ m3;
+			break;
+		}
+		break;
+	case 1:
+		/* write mode 1 */
+		break;
+	case 2:
+		/* write mode 2 */
+		mask = sc->vga_gc.gc_bit_mask;
+
+		switch (sc->vga_gc.gc_op) {
+		case 0x00:		/* replace */
+			m0 = (val & 1 ? 0xff : 0x00) & mask;
+			m1 = (val & 2 ? 0xff : 0x00) & mask;
+			m2 = (val & 4 ? 0xff : 0x00) & mask;
+			m3 = (val & 8 ? 0xff : 0x00) & mask;
+
+			c0 &= ~mask;
+			c1 &= ~mask;
+			c2 &= ~mask;
+			c3 &= ~mask;
+
+			c0 |= m0;
+			c1 |= m1;
+			c2 |= m2;
+			c3 |= m3;
+			break;
+		case 0x08:		/* AND */
+			m0 = (val & 1 ? 0xff : 0x00) | ~mask;
+			m1 = (val & 2 ? 0xff : 0x00) | ~mask;
+			m2 = (val & 4 ? 0xff : 0x00) | ~mask;
+			m3 = (val & 8 ? 0xff : 0x00) | ~mask;
+
+			c0 &= m0;
+			c1 &= m1;
+			c2 &= m2;
+			c3 &= m3;
+			break;
+		case 0x10:		/* OR */
+			m0 = (val & 1 ? 0xff : 0x00) & mask;
+			m1 = (val & 2 ? 0xff : 0x00) & mask;
+			m2 = (val & 4 ? 0xff : 0x00) & mask;
+			m3 = (val & 8 ? 0xff : 0x00) & mask;
+
+			c0 |= m0;
+			c1 |= m1;
+			c2 |= m2;
+			c3 |= m3;
+			break;
+		case 0x18:		/* XOR */
+			m0 = (val & 1 ? 0xff : 0x00) & mask;
+			m1 = (val & 2 ? 0xff : 0x00) & mask;
+			m2 = (val & 4 ? 0xff : 0x00) & mask;
+			m3 = (val & 8 ? 0xff : 0x00) & mask;
+
+			c0 ^= m0;
+			c1 ^= m1;
+			c2 ^= m2;
+			c3 ^= m3;
+			break;
+		}
+		break;
+	case 3:
+		/* write mode 3 */
+		mask = sc->vga_gc.gc_bit_mask & val;
+
+		val = (val >> sc->vga_gc.gc_rotate) |
+		    (val << (8 - sc->vga_gc.gc_rotate));
+
+		switch (sc->vga_gc.gc_op) {
+		case 0x00:		/* replace */
+			m0 = (set_reset & 1 ? 0xff : 0x00) & mask;
+			m1 = (set_reset & 2 ? 0xff : 0x00) & mask;
+			m2 = (set_reset & 4 ? 0xff : 0x00) & mask;
+			m3 = (set_reset & 8 ? 0xff : 0x00) & mask;
+
+			c0 &= ~mask;
+			c1 &= ~mask;
+			c2 &= ~mask;
+			c3 &= ~mask;
+
+			c0 |= m0;
+			c1 |= m1;
+			c2 |= m2;
+			c3 |= m3;
+			break;
+		case 0x08:		/* AND */
+			m0 = (set_reset & 1 ? 0xff : 0x00) | ~mask;
+			m1 = (set_reset & 2 ? 0xff : 0x00) | ~mask;
+			m2 = (set_reset & 4 ? 0xff : 0x00) | ~mask;
+			m3 = (set_reset & 8 ? 0xff : 0x00) | ~mask;
+
+			c0 &= m0;
+			c1 &= m1;
+			c2 &= m2;
+			c3 &= m3;
+			break;
+		case 0x10:		/* OR */
+			m0 = (set_reset & 1 ? 0xff : 0x00) & mask;
+			m1 = (set_reset & 2 ? 0xff : 0x00) & mask;
+			m2 = (set_reset & 4 ? 0xff : 0x00) & mask;
+			m3 = (set_reset & 8 ? 0xff : 0x00) & mask;
+
+			c0 |= m0;
+			c1 |= m1;
+			c2 |= m2;
+			c3 |= m3;
+			break;
+		case 0x18:		/* XOR */
+			m0 = (set_reset & 1 ? 0xff : 0x00) & mask;
+			m1 = (set_reset & 2 ? 0xff : 0x00) & mask;
+			m2 = (set_reset & 4 ? 0xff : 0x00) & mask;
+			m3 = (set_reset & 8 ? 0xff : 0x00) & mask;
+
+			c0 ^= m0;
+			c1 ^= m1;
+			c2 ^= m2;
+			c3 ^= m3;
+			break;
+		}
+		break;
+	}
+
+	if (sc->vga_gc.gc_mode_oe) {
+		if (offset & 1) {
+			offset &= ~1;
+			if (sc->vga_seq.seq_map_mask & 2)
+				sc->vga_ram[offset + 1*64*KB] = c1;
+			if (sc->vga_seq.seq_map_mask & 8)
+				sc->vga_ram[offset + 3*64*KB] = c3;
+		} else {
+			if (sc->vga_seq.seq_map_mask & 1)
+				sc->vga_ram[offset + 0*64*KB] = c0;
+			if (sc->vga_seq.seq_map_mask & 4)
+				sc->vga_ram[offset + 2*64*KB] = c2;
+		}
+	} else {
+		if (sc->vga_seq.seq_map_mask & 1)
+			sc->vga_ram[offset + 0*64*KB] = c0;
+		if (sc->vga_seq.seq_map_mask & 2)
+			sc->vga_ram[offset + 1*64*KB] = c1;
+		if (sc->vga_seq.seq_map_mask & 4)
+			sc->vga_ram[offset + 2*64*KB] = c2;
+		if (sc->vga_seq.seq_map_mask & 8)
+			sc->vga_ram[offset + 3*64*KB] = c3;
+	}
+}
+
+static int
+vga_mem_handler(struct vmctx *ctx, int vcpu, int dir, uint64_t addr,
+		int size, uint64_t *val, void *arg1, long arg2)
+{
+	if (dir == MEM_F_WRITE) {
+		switch (size) {
+		case 1:
+			vga_mem_wr_handler(ctx, addr, *val, arg1);
+			break;
+		case 2:
+			vga_mem_wr_handler(ctx, addr, *val, arg1);
+			vga_mem_wr_handler(ctx, addr + 1, *val >> 8, arg1);
+			break;
+		case 4:
+			vga_mem_wr_handler(ctx, addr, *val, arg1);
+			vga_mem_wr_handler(ctx, addr + 1, *val >> 8, arg1);
+			vga_mem_wr_handler(ctx, addr + 2, *val >> 16, arg1);
+			vga_mem_wr_handler(ctx, addr + 3, *val >> 24, arg1);
+			break;
+		case 8:
+			vga_mem_wr_handler(ctx, addr, *val, arg1);
+			vga_mem_wr_handler(ctx, addr + 1, *val >> 8, arg1);
+			vga_mem_wr_handler(ctx, addr + 2, *val >> 16, arg1);
+			vga_mem_wr_handler(ctx, addr + 3, *val >> 24, arg1);
+			vga_mem_wr_handler(ctx, addr + 4, *val >> 32, arg1);
+			vga_mem_wr_handler(ctx, addr + 5, *val >> 40, arg1);
+			vga_mem_wr_handler(ctx, addr + 6, *val >> 48, arg1);
+			vga_mem_wr_handler(ctx, addr + 7, *val >> 56, arg1);
+			break;
+		}
+	} else {
+		switch (size) {
+		case 1:
+			*val = vga_mem_rd_handler(ctx, addr, arg1);
+			break;
+		case 2:
+			*val = vga_mem_rd_handler(ctx, addr, arg1);
+			*val |= vga_mem_rd_handler(ctx, addr + 1, arg1) << 8;
+			break;
+		case 4:
+			*val = vga_mem_rd_handler(ctx, addr, arg1);
+			*val |= vga_mem_rd_handler(ctx, addr + 1, arg1) << 8;
+			*val |= vga_mem_rd_handler(ctx, addr + 2, arg1) << 16;
+			*val |= vga_mem_rd_handler(ctx, addr + 3, arg1) << 24;
+			break;
+		case 8:
+			*val = vga_mem_rd_handler(ctx, addr, arg1);
+			*val |= vga_mem_rd_handler(ctx, addr + 1, arg1) << 8;
+			*val |= vga_mem_rd_handler(ctx, addr + 2, arg1) << 16;
+			*val |= vga_mem_rd_handler(ctx, addr + 3, arg1) << 24;
+			*val |= vga_mem_rd_handler(ctx, addr + 4, arg1) << 32;
+			*val |= vga_mem_rd_handler(ctx, addr + 5, arg1) << 40;
+			*val |= vga_mem_rd_handler(ctx, addr + 6, arg1) << 48;
+			*val |= vga_mem_rd_handler(ctx, addr + 7, arg1) << 56;
+			break;
+		}
+	}
+
+	return (0);
+}
+
+static int
+vga_port_in_handler(struct vmctx *ctx, int in, int port, int bytes,
+		    uint8_t *val, void *arg)
+{
+	struct vga_softc *sc = arg;
+
+	switch (port) {
+	case CRTC_IDX_MONO_PORT:
+	case CRTC_IDX_COLOR_PORT:
+		*val = sc->vga_crtc.crtc_index;
+		break;
+	case CRTC_DATA_MONO_PORT:
+	case CRTC_DATA_COLOR_PORT:
+		switch (sc->vga_crtc.crtc_index) {
+		case CRTC_HORIZ_TOTAL:
+			*val = sc->vga_crtc.crtc_horiz_total;
+			break;
+		case CRTC_HORIZ_DISP_END:
+			*val = sc->vga_crtc.crtc_horiz_disp_end;
+			break;
+		case CRTC_START_HORIZ_BLANK:
+			*val = sc->vga_crtc.crtc_start_horiz_blank;
+			break;
+		case CRTC_END_HORIZ_BLANK:
+			*val = sc->vga_crtc.crtc_end_horiz_blank;
+			break;
+		case CRTC_START_HORIZ_RETRACE:
+			*val = sc->vga_crtc.crtc_start_horiz_retrace;
+			break;
+		case CRTC_END_HORIZ_RETRACE:
+			*val = sc->vga_crtc.crtc_end_horiz_retrace;
+			break;
+		case CRTC_VERT_TOTAL:
+			*val = sc->vga_crtc.crtc_vert_total;
+			break;
+		case CRTC_OVERFLOW:
+			*val = sc->vga_crtc.crtc_overflow;
+			break;
+		case CRTC_PRESET_ROW_SCAN:
+			*val = sc->vga_crtc.crtc_present_row_scan;
+			break;
+		case CRTC_MAX_SCAN_LINE:
+			*val = sc->vga_crtc.crtc_max_scan_line;
+			break;
+		case CRTC_CURSOR_START:
+			*val = sc->vga_crtc.crtc_cursor_start;
+			break;
+		case CRTC_CURSOR_END:
+			*val = sc->vga_crtc.crtc_cursor_end;
+			break;
+		case CRTC_START_ADDR_HIGH:
+			*val = sc->vga_crtc.crtc_start_addr_high;
+			break;
+		case CRTC_START_ADDR_LOW:
+			*val = sc->vga_crtc.crtc_start_addr_low;
+			break;
+		case CRTC_CURSOR_LOC_HIGH:
+			*val = sc->vga_crtc.crtc_cursor_loc_high;
+			break;
+		case CRTC_CURSOR_LOC_LOW:
+			*val = sc->vga_crtc.crtc_cursor_loc_low;
+			break;
+		case CRTC_VERT_RETRACE_START:
+			*val = sc->vga_crtc.crtc_vert_retrace_start;
+			break;
+		case CRTC_VERT_RETRACE_END:
+			*val = sc->vga_crtc.crtc_vert_retrace_end;
+			break;
+		case CRTC_VERT_DISP_END:
+			*val = sc->vga_crtc.crtc_vert_disp_end;
+			break;
+		case CRTC_OFFSET:
+			*val = sc->vga_crtc.crtc_offset;
+			break;
+		case CRTC_UNDERLINE_LOC:
+			*val = sc->vga_crtc.crtc_underline_loc;
+			break;
+		case CRTC_START_VERT_BLANK:
+			*val = sc->vga_crtc.crtc_start_vert_blank;
+			break;
+		case CRTC_END_VERT_BLANK:
+			*val = sc->vga_crtc.crtc_end_vert_blank;
+			break;
+		case CRTC_MODE_CONTROL:
+			*val = sc->vga_crtc.crtc_mode_ctrl;
+			break;
+		case CRTC_LINE_COMPARE:
+			*val = sc->vga_crtc.crtc_line_compare;
+			break;
+		default:
+			//printf("XXX VGA CRTC: inb 0x%04x at index %d\n", port, sc->vga_crtc.crtc_index);
+			assert(0);
+			break;
+		}
+		break;
+	case ATC_IDX_PORT:
+		*val = sc->vga_atc.atc_index;
+		break;
+	case ATC_DATA_PORT:
+		switch (sc->vga_atc.atc_index) {
+		case ATC_PALETTE0 ... ATC_PALETTE15:
+			*val = sc->vga_atc.atc_palette[sc->vga_atc.atc_index];
+			break;
+		case ATC_MODE_CONTROL:
+			*val = sc->vga_atc.atc_mode;
+			break;
+		case ATC_OVERSCAN_COLOR:
+			*val = sc->vga_atc.atc_overscan_color;
+			break;
+		case ATC_COLOR_PLANE_ENABLE:
+			*val = sc->vga_atc.atc_color_plane_enb;
+			break;
+		case ATC_HORIZ_PIXEL_PANNING:
+			*val = sc->vga_atc.atc_horiz_pixel_panning;
+			break;
+		case ATC_COLOR_SELECT:
+			*val = sc->vga_atc.atc_color_select;
+			break;
+		default:
+			//printf("XXX VGA ATC inb 0x%04x at index %d\n", port , sc->vga_atc.atc_index);
+			assert(0);
+			break;
+		}
+		break;
+	case SEQ_IDX_PORT:
+		*val = sc->vga_seq.seq_index;
+		break;
+	case SEQ_DATA_PORT:
+		switch (sc->vga_seq.seq_index) {
+		case SEQ_RESET:
+			*val = sc->vga_seq.seq_reset;
+			break;
+		case SEQ_CLOCKING_MODE:
+			*val = sc->vga_seq.seq_clock_mode;
+			break;
+		case SEQ_MAP_MASK:
+			*val = sc->vga_seq.seq_map_mask;
+			break;
+		case SEQ_CHAR_MAP_SELECT:
+			*val = sc->vga_seq.seq_cmap_sel;
+			break;
+		case SEQ_MEMORY_MODE:
+			*val = sc->vga_seq.seq_mm;
+			break;
+		default:
+			//printf("XXX VGA SEQ: inb 0x%04x at index %d\n", port, sc->vga_seq.seq_index);
+			assert(0);
+			break;
+		}
+		break;
+	case DAC_DATA_PORT:
+		*val = sc->vga_dac.dac_palette[3 * sc->vga_dac.dac_rd_index +
+					       sc->vga_dac.dac_rd_subindex];
+		sc->vga_dac.dac_rd_subindex++;
+		if (sc->vga_dac.dac_rd_subindex == 3) {
+			sc->vga_dac.dac_rd_index++;
+			sc->vga_dac.dac_rd_subindex = 0;
+		}
+		break;
+	case GC_IDX_PORT:
+		*val = sc->vga_gc.gc_index;
+		break;
+	case GC_DATA_PORT:
+		switch (sc->vga_gc.gc_index) {
+		case GC_SET_RESET:
+			*val = sc->vga_gc.gc_set_reset;
+			break;
+		case GC_ENABLE_SET_RESET:
+			*val = sc->vga_gc.gc_enb_set_reset;
+			break;
+		case GC_COLOR_COMPARE:
+			*val = sc->vga_gc.gc_color_compare;
+			break;
+		case GC_DATA_ROTATE:
+			*val = sc->vga_gc.gc_rotate;
+			break;
+		case GC_READ_MAP_SELECT:
+			*val = sc->vga_gc.gc_read_map_sel;
+			break;
+		case GC_MODE:
+			*val = sc->vga_gc.gc_mode;
+			break;
+		case GC_MISCELLANEOUS:
+			*val = sc->vga_gc.gc_misc;
+			break;
+		case GC_COLOR_DONT_CARE:
+			*val = sc->vga_gc.gc_color_dont_care;
+			break;
+		case GC_BIT_MASK:
+			*val = sc->vga_gc.gc_bit_mask;
+			break;
+		default:
+			//printf("XXX VGA GC: inb 0x%04x at index %d\n", port, sc->vga_crtc.crtc_index);
+			assert(0);
+			break;
+		}
+		break;
+	case GEN_MISC_OUTPUT_PORT:
+		*val = sc->vga_misc;
+		break;
+	case GEN_INPUT_STS0_PORT:
+		assert(0);
+		break;
+	case GEN_INPUT_STS1_MONO_PORT:
+	case GEN_INPUT_STS1_COLOR_PORT:
+		sc->vga_atc.atc_flipflop = 0;
+#ifdef __FreeBSD__
+		sc->vga_sts1 = GEN_IS1_VR | GEN_IS1_DE;
+		//sc->vga_sts1 ^= (GEN_IS1_VR | GEN_IS1_DE);
+#else
+		/*
+		 * During the bhyve bring-up process, a guest image was failing
+		 * to successfully boot.  It appeared to be spinning, waiting
+		 * for this value to be toggled.  Until it can be ruled out
+		 * that this is unnecessary (and documentation seems to
+		 * indicate that it should be present),  the toggle should
+		 * remain.
+		 */
+		sc->vga_sts1 ^= (GEN_IS1_VR | GEN_IS1_DE);
+#endif
+		*val = sc->vga_sts1;
+		break;
+	case GEN_FEATURE_CTRL_PORT:
+		// OpenBSD calls this with bytes = 1
+		//assert(0);
+		*val = 0;
+		break;
+	case 0x3c3:
+		*val = 0;
+		break;
+	default:
+		printf("XXX vga_port_in_handler() unhandled port 0x%x\n", port);
+		//assert(0);
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+vga_port_out_handler(struct vmctx *ctx, int in, int port, int bytes,
+		     uint8_t val, void *arg)
+{
+	struct vga_softc *sc = arg;
+
+	switch (port) {
+	case CRTC_IDX_MONO_PORT:
+	case CRTC_IDX_COLOR_PORT:
+		sc->vga_crtc.crtc_index = val;
+		break;
+	case CRTC_DATA_MONO_PORT:
+	case CRTC_DATA_COLOR_PORT:
+		switch (sc->vga_crtc.crtc_index) {
+		case CRTC_HORIZ_TOTAL:
+			sc->vga_crtc.crtc_horiz_total = val;
+			break;
+		case CRTC_HORIZ_DISP_END:
+			sc->vga_crtc.crtc_horiz_disp_end = val;
+			break;
+		case CRTC_START_HORIZ_BLANK:
+			sc->vga_crtc.crtc_start_horiz_blank = val;
+			break;
+		case CRTC_END_HORIZ_BLANK:
+			sc->vga_crtc.crtc_end_horiz_blank = val;
+			break;
+		case CRTC_START_HORIZ_RETRACE:
+			sc->vga_crtc.crtc_start_horiz_retrace = val;
+			break;
+		case CRTC_END_HORIZ_RETRACE:
+			sc->vga_crtc.crtc_end_horiz_retrace = val;
+			break;
+		case CRTC_VERT_TOTAL:
+			sc->vga_crtc.crtc_vert_total = val;
+			break;
+		case CRTC_OVERFLOW:
+			sc->vga_crtc.crtc_overflow = val;
+			break;
+		case CRTC_PRESET_ROW_SCAN:
+			sc->vga_crtc.crtc_present_row_scan = val;
+			break;
+		case CRTC_MAX_SCAN_LINE:
+			sc->vga_crtc.crtc_max_scan_line = val;
+			break;
+		case CRTC_CURSOR_START:
+			sc->vga_crtc.crtc_cursor_start = val;
+			sc->vga_crtc.crtc_cursor_on = (val & CRTC_CS_CO) == 0;
+			break;
+		case CRTC_CURSOR_END:
+			sc->vga_crtc.crtc_cursor_end = val;
+			break;
+		case CRTC_START_ADDR_HIGH:
+			sc->vga_crtc.crtc_start_addr_high = val;
+			sc->vga_crtc.crtc_start_addr &= 0x00ff;
+			sc->vga_crtc.crtc_start_addr |= (val << 8);
+			break;
+		case CRTC_START_ADDR_LOW:
+			sc->vga_crtc.crtc_start_addr_low = val;
+			sc->vga_crtc.crtc_start_addr &= 0xff00;
+			sc->vga_crtc.crtc_start_addr |= (val & 0xff);
+			break;
+		case CRTC_CURSOR_LOC_HIGH:
+			sc->vga_crtc.crtc_cursor_loc_high = val;
+			sc->vga_crtc.crtc_cursor_loc &= 0x00ff;
+			sc->vga_crtc.crtc_cursor_loc |= (val << 8);
+			break;
+		case CRTC_CURSOR_LOC_LOW:
+			sc->vga_crtc.crtc_cursor_loc_low = val;
+			sc->vga_crtc.crtc_cursor_loc &= 0xff00;
+			sc->vga_crtc.crtc_cursor_loc |= (val & 0xff);
+			break;
+		case CRTC_VERT_RETRACE_START:
+			sc->vga_crtc.crtc_vert_retrace_start = val;
+			break;
+		case CRTC_VERT_RETRACE_END:
+			sc->vga_crtc.crtc_vert_retrace_end = val;
+			break;
+		case CRTC_VERT_DISP_END:
+			sc->vga_crtc.crtc_vert_disp_end = val;
+			break;
+		case CRTC_OFFSET:
+			sc->vga_crtc.crtc_offset = val;
+			break;
+		case CRTC_UNDERLINE_LOC:
+			sc->vga_crtc.crtc_underline_loc = val;
+			break;
+		case CRTC_START_VERT_BLANK:
+			sc->vga_crtc.crtc_start_vert_blank = val;
+			break;
+		case CRTC_END_VERT_BLANK:
+			sc->vga_crtc.crtc_end_vert_blank = val;
+			break;
+		case CRTC_MODE_CONTROL:
+			sc->vga_crtc.crtc_mode_ctrl = val;
+			break;
+		case CRTC_LINE_COMPARE:
+			sc->vga_crtc.crtc_line_compare = val;
+			break;
+		default:
+			//printf("XXX VGA CRTC: outb 0x%04x, 0x%02x at index %d\n", port, val, sc->vga_crtc.crtc_index);
+			assert(0);
+			break;
+		}
+		break;
+	case ATC_IDX_PORT:
+		if (sc->vga_atc.atc_flipflop == 0) {
+			if (sc->vga_atc.atc_index & 0x20)
+				assert(0);
+			sc->vga_atc.atc_index = val & ATC_IDX_MASK;
+		} else {
+			switch (sc->vga_atc.atc_index) {
+			case ATC_PALETTE0 ... ATC_PALETTE15:
+				sc->vga_atc.atc_palette[sc->vga_atc.atc_index] = val & 0x3f;
+				break;
+			case ATC_MODE_CONTROL:
+				sc->vga_atc.atc_mode = val;
+				break;
+			case ATC_OVERSCAN_COLOR:
+				sc->vga_atc.atc_overscan_color = val;
+				break;
+			case ATC_COLOR_PLANE_ENABLE:
+				sc->vga_atc.atc_color_plane_enb = val;
+				break;
+			case ATC_HORIZ_PIXEL_PANNING:
+				sc->vga_atc.atc_horiz_pixel_panning = val;
+				break;
+			case ATC_COLOR_SELECT:
+				sc->vga_atc.atc_color_select = val;
+				sc->vga_atc.atc_color_select_45 =
+					(val & ATC_CS_C45) << 4;
+				sc->vga_atc.atc_color_select_67 =
+					((val & ATC_CS_C67) >> 2) << 6;
+				break;
+			default:
+				//printf("XXX VGA ATC: outb 0x%04x, 0x%02x at index %d\n", port, val, sc->vga_atc.atc_index);
+				assert(0);
+				break;
+			}
+		}
+		sc->vga_atc.atc_flipflop ^= 1;
+		break;
+	case ATC_DATA_PORT:
+		break;
+	case SEQ_IDX_PORT:
+		sc->vga_seq.seq_index = val & 0x1f;
+		break;
+	case SEQ_DATA_PORT:
+		switch (sc->vga_seq.seq_index) {
+		case SEQ_RESET:
+			sc->vga_seq.seq_reset = val;
+			break;
+		case SEQ_CLOCKING_MODE:
+			sc->vga_seq.seq_clock_mode = val;
+			sc->vga_seq.seq_cm_dots = (val & SEQ_CM_89) ? 8 : 9;
+			break;
+		case SEQ_MAP_MASK:
+			sc->vga_seq.seq_map_mask = val;
+			break;
+		case SEQ_CHAR_MAP_SELECT:
+			sc->vga_seq.seq_cmap_sel = val;
+
+			sc->vga_seq.seq_cmap_pri_off = ((((val & SEQ_CMS_SA) >> SEQ_CMS_SA_SHIFT) * 2) + ((val & SEQ_CMS_SAH) >> SEQ_CMS_SAH_SHIFT)) * 8 * KB;
+			sc->vga_seq.seq_cmap_sec_off = ((((val & SEQ_CMS_SB) >> SEQ_CMS_SB_SHIFT) * 2) + ((val & SEQ_CMS_SBH) >> SEQ_CMS_SBH_SHIFT)) * 8 * KB;
+			break;
+		case SEQ_MEMORY_MODE:
+			sc->vga_seq.seq_mm = val;
+			/* Windows queries Chain4 */
+			//assert((sc->vga_seq.seq_mm & SEQ_MM_C4) == 0);
+			break;
+		default:
+			//printf("XXX VGA SEQ: outb 0x%04x, 0x%02x at index %d\n", port, val, sc->vga_seq.seq_index);
+			assert(0);
+			break;
+		}
+		break;
+	case DAC_MASK:
+		break;
+	case DAC_IDX_RD_PORT:
+		sc->vga_dac.dac_rd_index = val;
+		sc->vga_dac.dac_rd_subindex = 0;
+		break;
+	case DAC_IDX_WR_PORT:
+		sc->vga_dac.dac_wr_index = val;
+		sc->vga_dac.dac_wr_subindex = 0;
+		break;
+	case DAC_DATA_PORT:
+		sc->vga_dac.dac_palette[3 * sc->vga_dac.dac_wr_index +
+					sc->vga_dac.dac_wr_subindex] = val;
+		sc->vga_dac.dac_wr_subindex++;
+		if (sc->vga_dac.dac_wr_subindex == 3) {
+			sc->vga_dac.dac_palette_rgb[sc->vga_dac.dac_wr_index] =
+				((((sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 0] << 2) |
+				   ((sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 0] & 0x1) << 1) |
+				   (sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 0] & 0x1)) << 16) |
+				 (((sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 1] << 2) |
+				   ((sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 1] & 0x1) << 1) |
+				   (sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 1] & 0x1)) << 8) |
+				 (((sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 2] << 2) |
+				   ((sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 2] & 0x1) << 1) |
+				   (sc->vga_dac.dac_palette[3*sc->vga_dac.dac_wr_index + 2] & 0x1)) << 0));
+
+			sc->vga_dac.dac_wr_index++;
+			sc->vga_dac.dac_wr_subindex = 0;
+		}
+		break;
+	case GC_IDX_PORT:
+		sc->vga_gc.gc_index = val;
+		break;
+	case GC_DATA_PORT:
+		switch (sc->vga_gc.gc_index) {
+		case GC_SET_RESET:
+			sc->vga_gc.gc_set_reset = val;
+			break;
+		case GC_ENABLE_SET_RESET:
+			sc->vga_gc.gc_enb_set_reset = val;
+			break;
+		case GC_COLOR_COMPARE:
+			sc->vga_gc.gc_color_compare = val;
+			break;
+		case GC_DATA_ROTATE:
+			sc->vga_gc.gc_rotate = val;
+			sc->vga_gc.gc_op = (val >> 3) & 0x3;
+			break;
+		case GC_READ_MAP_SELECT:
+			sc->vga_gc.gc_read_map_sel = val;
+			break;
+		case GC_MODE:
+			sc->vga_gc.gc_mode = val;
+			sc->vga_gc.gc_mode_c4 = (val & GC_MODE_C4) != 0;
+			assert(!sc->vga_gc.gc_mode_c4);
+			sc->vga_gc.gc_mode_oe = (val & GC_MODE_OE) != 0;
+			sc->vga_gc.gc_mode_rm = (val >> 3) & 0x1;
+			sc->vga_gc.gc_mode_wm = val & 0x3;
+
+			if (sc->gc_image)
+				sc->gc_image->vgamode = 1;
+			break;
+		case GC_MISCELLANEOUS:
+			sc->vga_gc.gc_misc = val;
+			sc->vga_gc.gc_misc_gm = val & GC_MISC_GM;
+			sc->vga_gc.gc_misc_mm = (val & GC_MISC_MM) >>
+			    GC_MISC_MM_SHIFT;
+			break;
+		case GC_COLOR_DONT_CARE:
+			sc->vga_gc.gc_color_dont_care = val;
+			break;
+		case GC_BIT_MASK:
+			sc->vga_gc.gc_bit_mask = val;
+			break;
+		default:
+			//printf("XXX VGA GC: outb 0x%04x, 0x%02x at index %d\n", port, val, sc->vga_gc.gc_index);
+			assert(0);
+			break;
+		}
+		break;
+	case GEN_INPUT_STS0_PORT:
+		/* write to Miscellaneous Output Register */
+		sc->vga_misc = val;
+		break;
+	case GEN_INPUT_STS1_MONO_PORT:
+	case GEN_INPUT_STS1_COLOR_PORT:
+		/* write to Feature Control Register */
+		break;
+//	case 0x3c3:
+//		break;
+	default:
+		printf("XXX vga_port_out_handler() unhandled port 0x%x, val 0x%x\n", port, val);
+		//assert(0);
+		return (-1);
+	}
+	return (0);
+}
+
+static int
+vga_port_handler(struct vmctx *ctx, int vcpu, int in, int port, int bytes,
+		 uint32_t *eax, void *arg)
+{
+	uint8_t val;
+	int error;
+
+	switch (bytes) {
+	case 1:
+		if (in) {
+			*eax &= ~0xff;
+			error = vga_port_in_handler(ctx, in, port, 1,
+						    &val, arg);
+			if (!error) {
+				*eax |= val & 0xff;
+			}
+		} else {
+			val = *eax & 0xff;
+			error = vga_port_out_handler(ctx, in, port, 1,
+						     val, arg);
+		}
+		break;
+	case 2:
+		if (in) {
+			*eax &= ~0xffff;
+			error = vga_port_in_handler(ctx, in, port, 1,
+						    &val, arg);
+			if (!error) {
+				*eax |= val & 0xff;
+			}
+			error = vga_port_in_handler(ctx, in, port + 1, 1,
+						    &val, arg);
+			if (!error) {
+				*eax |= (val & 0xff) << 8;
+			}
+		} else {
+			val = *eax & 0xff;
+			error = vga_port_out_handler(ctx, in, port, 1,
+						     val, arg);
+			val = (*eax >> 8) & 0xff;
+			error =vga_port_out_handler(ctx, in, port + 1, 1,
+						    val, arg);
+		}
+		break;
+	default:
+		assert(0);
+		return (-1);
+	}
+
+	return (error);
+}
+
+void *
+vga_init(int io_only)
+{
+	struct inout_port iop;
+	struct vga_softc *sc;
+	int port, error;
+
+	sc = calloc(1, sizeof(struct vga_softc));
+
+	bzero(&iop, sizeof(struct inout_port));
+	iop.name = "VGA";
+	for (port = VGA_IOPORT_START; port <= VGA_IOPORT_END; port++) {
+		iop.port = port;
+		iop.size = 1;
+		iop.flags = IOPORT_F_INOUT;
+		iop.handler = vga_port_handler;
+		iop.arg = sc;
+
+		error = register_inout(&iop);
+		assert(error == 0);
+	}
+
+	sc->gc_image = console_get_image();
+
+	/* only handle io ports; vga graphics is disabled */
+	if (io_only)
+		return(sc);
+
+	sc->mr.name = "VGA memory";
+	sc->mr.flags = MEM_F_RW;
+	sc->mr.base = 640 * KB;
+	sc->mr.size = 128 * KB;
+	sc->mr.handler = vga_mem_handler;
+	sc->mr.arg1 = sc;
+	error = register_mem_fallback(&sc->mr);
+	assert(error == 0);
+
+	sc->vga_ram = malloc(256 * KB);
+	memset(sc->vga_ram, 0, 256 * KB);
+
+	{
+		static uint8_t palette[] = {
+			0x00,0x00,0x00, 0x00,0x00,0x2a, 0x00,0x2a,0x00, 0x00,0x2a,0x2a,
+			0x2a,0x00,0x00, 0x2a,0x00,0x2a, 0x2a,0x2a,0x00, 0x2a,0x2a,0x2a,
+			0x00,0x00,0x15, 0x00,0x00,0x3f, 0x00,0x2a,0x15, 0x00,0x2a,0x3f,
+			0x2a,0x00,0x15, 0x2a,0x00,0x3f, 0x2a,0x2a,0x15, 0x2a,0x2a,0x3f,
+		};
+		int i;
+
+		memcpy(sc->vga_dac.dac_palette, palette, 16 * 3 * sizeof (uint8_t));
+		for (i = 0; i < 16; i++) {
+			sc->vga_dac.dac_palette_rgb[i] =
+				((((sc->vga_dac.dac_palette[3*i + 0] << 2) |
+				   ((sc->vga_dac.dac_palette[3*i + 0] & 0x1) << 1) |
+				   (sc->vga_dac.dac_palette[3*i + 0] & 0x1)) << 16) |
+				 (((sc->vga_dac.dac_palette[3*i + 1] << 2) |
+				   ((sc->vga_dac.dac_palette[3*i + 1] & 0x1) << 1) |
+				   (sc->vga_dac.dac_palette[3*i + 1] & 0x1)) << 8) |
+				 (((sc->vga_dac.dac_palette[3*i + 2] << 2) |
+				   ((sc->vga_dac.dac_palette[3*i + 2] & 0x1) << 1) |
+				   (sc->vga_dac.dac_palette[3*i + 2] & 0x1)) << 0));
+		}
+	}
+
+	return (sc);
+}
diff --git a/usr/src/cmd/bhyve/vga.h b/usr/src/cmd/bhyve/vga.h
new file mode 100644
index 0000000000..4364f1b17a
--- /dev/null
+++ b/usr/src/cmd/bhyve/vga.h
@@ -0,0 +1,160 @@
+/*-
+ * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VGA_H_
+#define	_VGA_H_
+
+#define	VGA_IOPORT_START		0x3c0
+#define	VGA_IOPORT_END			0x3df
+
+/* General registers */
+#define	GEN_INPUT_STS0_PORT		0x3c2
+#define	GEN_FEATURE_CTRL_PORT		0x3ca
+#define	GEN_MISC_OUTPUT_PORT		0x3cc
+#define	GEN_INPUT_STS1_MONO_PORT	0x3ba
+#define	GEN_INPUT_STS1_COLOR_PORT	0x3da
+#define	 GEN_IS1_VR			0x08	/* Vertical retrace */
+#define	 GEN_IS1_DE			0x01	/* Display enable not */
+
+/* Attribute controller registers. */
+#define	ATC_IDX_PORT			0x3c0
+#define	ATC_DATA_PORT			0x3c1
+
+#define	ATC_IDX_MASK			0x1f
+#define	ATC_PALETTE0			0
+#define	ATC_PALETTE15			15
+#define	ATC_MODE_CONTROL		16
+#define	 ATC_MC_IPS			0x80	/* Internal palette size */
+#define	 ATC_MC_GA			0x01	/* Graphics/alphanumeric */
+#define	ATC_OVERSCAN_COLOR		17
+#define	ATC_COLOR_PLANE_ENABLE		18
+#define	ATC_HORIZ_PIXEL_PANNING		19
+#define	ATC_COLOR_SELECT		20
+#define	 ATC_CS_C67			0x0c	/* Color select bits 6+7 */
+#define	 ATC_CS_C45			0x03	/* Color select bits 4+5 */
+
+/* Sequencer registers. */
+#define	SEQ_IDX_PORT			0x3c4
+#define	SEQ_DATA_PORT			0x3c5
+
+#define	SEQ_RESET			0
+#define	SEQ_RESET_ASYNC			0x1
+#define	SEQ_RESET_SYNC			0x2
+#define	SEQ_CLOCKING_MODE		1
+#define	 SEQ_CM_SO			0x20	/* Screen off */
+#define	 SEQ_CM_89			0x01	/* 8/9 dot clock */
+#define	SEQ_MAP_MASK			2
+#define	SEQ_CHAR_MAP_SELECT		3
+#define	 SEQ_CMS_SAH			0x20	/* Char map A bit 2 */
+#define	 SEQ_CMS_SAH_SHIFT		5
+#define	 SEQ_CMS_SA			0x0c	/* Char map A bits 0+1 */
+#define	 SEQ_CMS_SA_SHIFT		2
+#define	 SEQ_CMS_SBH			0x10	/* Char map B bit 2 */
+#define	 SEQ_CMS_SBH_SHIFT		4
+#define	 SEQ_CMS_SB			0x03	/* Char map B bits 0+1 */
+#define	 SEQ_CMS_SB_SHIFT		0
+#define	SEQ_MEMORY_MODE			4
+#define	 SEQ_MM_C4			0x08	/* Chain 4 */
+#define	 SEQ_MM_OE			0x04	/* Odd/even */
+#define	 SEQ_MM_EM			0x02	/* Extended memory */
+
+/* Graphics controller registers. */
+#define	GC_IDX_PORT			0x3ce
+#define	GC_DATA_PORT			0x3cf
+
+#define	GC_SET_RESET			0
+#define	GC_ENABLE_SET_RESET		1
+#define	GC_COLOR_COMPARE		2
+#define	GC_DATA_ROTATE			3
+#define	GC_READ_MAP_SELECT		4
+#define	GC_MODE				5
+#define	 GC_MODE_OE			0x10	/* Odd/even */
+#define	 GC_MODE_C4			0x04	/* Chain 4 */
+
+#define	GC_MISCELLANEOUS		6
+#define	 GC_MISC_GM			0x01	/* Graphics/alphanumeric */
+#define	 GC_MISC_MM			0x0c	/* memory map */
+#define	 GC_MISC_MM_SHIFT	2
+#define	GC_COLOR_DONT_CARE		7
+#define	GC_BIT_MASK			8
+
+/* CRT controller registers. */
+#define	CRTC_IDX_MONO_PORT		0x3b4
+#define	CRTC_DATA_MONO_PORT		0x3b5
+#define	CRTC_IDX_COLOR_PORT		0x3d4
+#define	CRTC_DATA_COLOR_PORT		0x3d5
+
+#define	CRTC_HORIZ_TOTAL		0
+#define	CRTC_HORIZ_DISP_END		1
+#define	CRTC_START_HORIZ_BLANK		2
+#define	CRTC_END_HORIZ_BLANK		3
+#define	CRTC_START_HORIZ_RETRACE	4
+#define	CRTC_END_HORIZ_RETRACE		5
+#define	CRTC_VERT_TOTAL			6
+#define	CRTC_OVERFLOW			7
+#define	 CRTC_OF_VRS9			0x80	/* VRS bit 9 */
+#define	 CRTC_OF_VRS9_SHIFT		7
+#define	 CRTC_OF_VDE9			0x40	/* VDE bit 9 */
+#define	 CRTC_OF_VDE9_SHIFT		6
+#define	 CRTC_OF_VRS8			0x04	/* VRS bit 8 */
+#define	 CRTC_OF_VRS8_SHIFT		2
+#define	 CRTC_OF_VDE8			0x02	/* VDE bit 8 */
+#define	 CRTC_OF_VDE8_SHIFT		1
+#define	CRTC_PRESET_ROW_SCAN		8
+#define	CRTC_MAX_SCAN_LINE		9
+#define	 CRTC_MSL_MSL			0x1f
+#define	CRTC_CURSOR_START		10
+#define	 CRTC_CS_CO			0x20	/* Cursor off */
+#define	 CRTC_CS_CS			0x1f	/* Cursor start */
+#define	CRTC_CURSOR_END			11
+#define	 CRTC_CE_CE			0x1f	/* Cursor end */
+#define	CRTC_START_ADDR_HIGH		12
+#define	CRTC_START_ADDR_LOW		13
+#define	CRTC_CURSOR_LOC_HIGH		14
+#define	CRTC_CURSOR_LOC_LOW		15
+#define	CRTC_VERT_RETRACE_START		16
+#define	CRTC_VERT_RETRACE_END		17
+#define	 CRTC_VRE_MASK			0xf
+#define	CRTC_VERT_DISP_END		18
+#define	CRTC_OFFSET			19
+#define	CRTC_UNDERLINE_LOC		20
+#define	CRTC_START_VERT_BLANK		21
+#define	CRTC_END_VERT_BLANK		22
+#define	CRTC_MODE_CONTROL		23
+#define	 CRTC_MC_TE			0x80	/* Timing enable */
+#define	CRTC_LINE_COMPARE		24
+
+/* DAC registers */
+#define	DAC_MASK			0x3c6
+#define	DAC_IDX_RD_PORT			0x3c7
+#define	DAC_IDX_WR_PORT			0x3c8
+#define	DAC_DATA_PORT			0x3c9
+
+void	*vga_init(int io_only);
+
+#endif /* _VGA_H_ */
diff --git a/usr/src/cmd/bhyve/virtio.c b/usr/src/cmd/bhyve/virtio.c
new file mode 100644
index 0000000000..fc0525c9ee
--- /dev/null
+++ b/usr/src/cmd/bhyve/virtio.c
@@ -0,0 +1,779 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013  Chris Torek <torek @ torek net>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/uio.h>
+
+#include <stdio.h>
+#include <stdint.h>
+#include <pthread.h>
+#include <pthread_np.h>
+
+#include "bhyverun.h"
+#include "pci_emul.h"
+#include "virtio.h"
+
+/*
+ * Functions for dealing with generalized "virtual devices" as
+ * defined by <https://www.google.com/#output=search&q=virtio+spec>
+ */
+
+/*
+ * In case we decide to relax the "virtio softc comes at the
+ * front of virtio-based device softc" constraint, let's use
+ * this to convert.
+ */
+#define DEV_SOFTC(vs) ((void *)(vs))
+
+/*
+ * Link a virtio_softc to its constants, the device softc, and
+ * the PCI emulation.
+ */
+void
+vi_softc_linkup(struct virtio_softc *vs, struct virtio_consts *vc,
+		void *dev_softc, struct pci_devinst *pi,
+		struct vqueue_info *queues)
+{
+	int i;
+
+	/* vs and dev_softc addresses must match */
+	assert((void *)vs == dev_softc);
+	vs->vs_vc = vc;
+	vs->vs_pi = pi;
+	pi->pi_arg = vs;
+
+	vs->vs_queues = queues;
+	for (i = 0; i < vc->vc_nvq; i++) {
+		queues[i].vq_vs = vs;
+		queues[i].vq_num = i;
+	}
+}
+
+/*
+ * Reset device (device-wide).  This erases all queues, i.e.,
+ * all the queues become invalid (though we don't wipe out the
+ * internal pointers, we just clear the VQ_ALLOC flag).
+ *
+ * It resets negotiated features to "none".
+ *
+ * If MSI-X is enabled, this also resets all the vectors to NO_VECTOR.
+ */
+void
+vi_reset_dev(struct virtio_softc *vs)
+{
+	struct vqueue_info *vq;
+	int i, nvq;
+
+	if (vs->vs_mtx)
+		assert(pthread_mutex_isowned_np(vs->vs_mtx));
+
+	nvq = vs->vs_vc->vc_nvq;
+	for (vq = vs->vs_queues, i = 0; i < nvq; vq++, i++) {
+		vq->vq_flags = 0;
+		vq->vq_last_avail = 0;
+		vq->vq_save_used = 0;
+		vq->vq_pfn = 0;
+		vq->vq_msix_idx = VIRTIO_MSI_NO_VECTOR;
+	}
+	vs->vs_negotiated_caps = 0;
+	vs->vs_curq = 0;
+	/* vs->vs_status = 0; -- redundant */
+	if (vs->vs_isr)
+		pci_lintr_deassert(vs->vs_pi);
+	vs->vs_isr = 0;
+	vs->vs_msix_cfg_idx = VIRTIO_MSI_NO_VECTOR;
+}
+
+/*
+ * Set I/O BAR (usually 0) to map PCI config registers.
+ */
+void
+vi_set_io_bar(struct virtio_softc *vs, int barnum)
+{
+	size_t size;
+
+	/*
+	 * ??? should we use CFG0 if MSI-X is disabled?
+	 * Existing code did not...
+	 */
+	size = VTCFG_R_CFG1 + vs->vs_vc->vc_cfgsize;
+	pci_emul_alloc_bar(vs->vs_pi, barnum, PCIBAR_IO, size);
+}
+
+/*
+ * Initialize MSI-X vector capabilities if we're to use MSI-X,
+ * or MSI capabilities if not.
+ *
+ * We assume we want one MSI-X vector per queue, here, plus one
+ * for the config vec.
+ */
+int
+vi_intr_init(struct virtio_softc *vs, int barnum, int use_msix)
+{
+	int nvec;
+
+	if (use_msix) {
+		vs->vs_flags |= VIRTIO_USE_MSIX;
+		VS_LOCK(vs);
+		vi_reset_dev(vs); /* set all vectors to NO_VECTOR */
+		VS_UNLOCK(vs);
+		nvec = vs->vs_vc->vc_nvq + 1;
+		if (pci_emul_add_msixcap(vs->vs_pi, nvec, barnum))
+			return (1);
+	} else
+		vs->vs_flags &= ~VIRTIO_USE_MSIX;
+
+	/* Only 1 MSI vector for bhyve */
+	pci_emul_add_msicap(vs->vs_pi, 1);
+
+	/* Legacy interrupts are mandatory for virtio devices */
+	pci_lintr_request(vs->vs_pi);
+
+	return (0);
+}
+
+/*
+ * Initialize the currently-selected virtio queue (vs->vs_curq).
+ * The guest just gave us a page frame number, from which we can
+ * calculate the addresses of the queue.
+ */
+void
+vi_vq_init(struct virtio_softc *vs, uint32_t pfn)
+{
+	struct vqueue_info *vq;
+	uint64_t phys;
+	size_t size;
+	char *base;
+
+	vq = &vs->vs_queues[vs->vs_curq];
+	vq->vq_pfn = pfn;
+	phys = (uint64_t)pfn << VRING_PFN;
+	size = vring_size(vq->vq_qsize);
+	base = paddr_guest2host(vs->vs_pi->pi_vmctx, phys, size);
+
+	/* First page(s) are descriptors... */
+	vq->vq_desc = (struct virtio_desc *)base;
+	base += vq->vq_qsize * sizeof(struct virtio_desc);
+
+	/* ... immediately followed by "avail" ring (entirely uint16_t's) */
+	vq->vq_avail = (struct vring_avail *)base;
+	base += (2 + vq->vq_qsize + 1) * sizeof(uint16_t);
+
+	/* Then it's rounded up to the next page... */
+	base = (char *)roundup2((uintptr_t)base, VRING_ALIGN);
+
+	/* ... and the last page(s) are the used ring. */
+	vq->vq_used = (struct vring_used *)base;
+
+	/* Mark queue as allocated, and start at 0 when we use it. */
+	vq->vq_flags = VQ_ALLOC;
+	vq->vq_last_avail = 0;
+	vq->vq_save_used = 0;
+}
+
+/*
+ * Helper inline for vq_getchain(): record the i'th "real"
+ * descriptor.
+ */
+static inline void
+_vq_record(int i, volatile struct virtio_desc *vd, struct vmctx *ctx,
+	   struct iovec *iov, int n_iov, uint16_t *flags) {
+
+	if (i >= n_iov)
+		return;
+	iov[i].iov_base = paddr_guest2host(ctx, vd->vd_addr, vd->vd_len);
+	iov[i].iov_len = vd->vd_len;
+	if (flags != NULL)
+		flags[i] = vd->vd_flags;
+}
+#define	VQ_MAX_DESCRIPTORS	512	/* see below */
+
+/*
+ * Examine the chain of descriptors starting at the "next one" to
+ * make sure that they describe a sensible request.  If so, return
+ * the number of "real" descriptors that would be needed/used in
+ * acting on this request.  This may be smaller than the number of
+ * available descriptors, e.g., if there are two available but
+ * they are two separate requests, this just returns 1.  Or, it
+ * may be larger: if there are indirect descriptors involved,
+ * there may only be one descriptor available but it may be an
+ * indirect pointing to eight more.  We return 8 in this case,
+ * i.e., we do not count the indirect descriptors, only the "real"
+ * ones.
+ *
+ * Basically, this vets the vd_flags and vd_next field of each
+ * descriptor and tells you how many are involved.  Since some may
+ * be indirect, this also needs the vmctx (in the pci_devinst
+ * at vs->vs_pi) so that it can find indirect descriptors.
+ *
+ * As we process each descriptor, we copy and adjust it (guest to
+ * host address wise, also using the vmtctx) into the given iov[]
+ * array (of the given size).  If the array overflows, we stop
+ * placing values into the array but keep processing descriptors,
+ * up to VQ_MAX_DESCRIPTORS, before giving up and returning -1.
+ * So you, the caller, must not assume that iov[] is as big as the
+ * return value (you can process the same thing twice to allocate
+ * a larger iov array if needed, or supply a zero length to find
+ * out how much space is needed).
+ *
+ * If you want to verify the WRITE flag on each descriptor, pass a
+ * non-NULL "flags" pointer to an array of "uint16_t" of the same size
+ * as n_iov and we'll copy each vd_flags field after unwinding any
+ * indirects.
+ *
+ * If some descriptor(s) are invalid, this prints a diagnostic message
+ * and returns -1.  If no descriptors are ready now it simply returns 0.
+ *
+ * You are assumed to have done a vq_ring_ready() if needed (note
+ * that vq_has_descs() does one).
+ */
+int
+vq_getchain(struct vqueue_info *vq, uint16_t *pidx,
+	    struct iovec *iov, int n_iov, uint16_t *flags)
+{
+	int i;
+	u_int ndesc, n_indir;
+	u_int idx, next;
+	volatile struct virtio_desc *vdir, *vindir, *vp;
+	struct vmctx *ctx;
+	struct virtio_softc *vs;
+	const char *name;
+
+	vs = vq->vq_vs;
+	name = vs->vs_vc->vc_name;
+
+	/*
+	 * Note: it's the responsibility of the guest not to
+	 * update vq->vq_avail->va_idx until all of the descriptors
+         * the guest has written are valid (including all their
+         * vd_next fields and vd_flags).
+	 *
+	 * Compute (last_avail - va_idx) in integers mod 2**16.  This is
+	 * the number of descriptors the device has made available
+	 * since the last time we updated vq->vq_last_avail.
+	 *
+	 * We just need to do the subtraction as an unsigned int,
+	 * then trim off excess bits.
+	 */
+	idx = vq->vq_last_avail;
+	ndesc = (uint16_t)((u_int)vq->vq_avail->va_idx - idx);
+	if (ndesc == 0)
+		return (0);
+	if (ndesc > vq->vq_qsize) {
+		/* XXX need better way to diagnose issues */
+		fprintf(stderr,
+		    "%s: ndesc (%u) out of range, driver confused?\r\n",
+		    name, (u_int)ndesc);
+		return (-1);
+	}
+
+	/*
+	 * Now count/parse "involved" descriptors starting from
+	 * the head of the chain.
+	 *
+	 * To prevent loops, we could be more complicated and
+	 * check whether we're re-visiting a previously visited
+	 * index, but we just abort if the count gets excessive.
+	 */
+	ctx = vs->vs_pi->pi_vmctx;
+	*pidx = next = vq->vq_avail->va_ring[idx & (vq->vq_qsize - 1)];
+	vq->vq_last_avail++;
+	for (i = 0; i < VQ_MAX_DESCRIPTORS; next = vdir->vd_next) {
+		if (next >= vq->vq_qsize) {
+			fprintf(stderr,
+			    "%s: descriptor index %u out of range, "
+			    "driver confused?\r\n",
+			    name, next);
+			return (-1);
+		}
+		vdir = &vq->vq_desc[next];
+		if ((vdir->vd_flags & VRING_DESC_F_INDIRECT) == 0) {
+			_vq_record(i, vdir, ctx, iov, n_iov, flags);
+			i++;
+		} else if ((vs->vs_vc->vc_hv_caps &
+		    VIRTIO_RING_F_INDIRECT_DESC) == 0) {
+			fprintf(stderr,
+			    "%s: descriptor has forbidden INDIRECT flag, "
+			    "driver confused?\r\n",
+			    name);
+			return (-1);
+		} else {
+			n_indir = vdir->vd_len / 16;
+			if ((vdir->vd_len & 0xf) || n_indir == 0) {
+				fprintf(stderr,
+				    "%s: invalid indir len 0x%x, "
+				    "driver confused?\r\n",
+				    name, (u_int)vdir->vd_len);
+				return (-1);
+			}
+			vindir = paddr_guest2host(ctx,
+			    vdir->vd_addr, vdir->vd_len);
+			/*
+			 * Indirects start at the 0th, then follow
+			 * their own embedded "next"s until those run
+			 * out.  Each one's indirect flag must be off
+			 * (we don't really have to check, could just
+			 * ignore errors...).
+			 */
+			next = 0;
+			for (;;) {
+				vp = &vindir[next];
+				if (vp->vd_flags & VRING_DESC_F_INDIRECT) {
+					fprintf(stderr,
+					    "%s: indirect desc has INDIR flag,"
+					    " driver confused?\r\n",
+					    name);
+					return (-1);
+				}
+				_vq_record(i, vp, ctx, iov, n_iov, flags);
+				if (++i > VQ_MAX_DESCRIPTORS)
+					goto loopy;
+				if ((vp->vd_flags & VRING_DESC_F_NEXT) == 0)
+					break;
+				next = vp->vd_next;
+				if (next >= n_indir) {
+					fprintf(stderr,
+					    "%s: invalid next %u > %u, "
+					    "driver confused?\r\n",
+					    name, (u_int)next, n_indir);
+					return (-1);
+				}
+			}
+		}
+		if ((vdir->vd_flags & VRING_DESC_F_NEXT) == 0)
+			return (i);
+	}
+loopy:
+	fprintf(stderr,
+	    "%s: descriptor loop? count > %d - driver confused?\r\n",
+	    name, i);
+	return (-1);
+}
+
+/*
+ * Return the currently-first request chain back to the available queue.
+ *
+ * (This chain is the one you handled when you called vq_getchain()
+ * and used its positive return value.)
+ */
+void
+vq_retchain(struct vqueue_info *vq)
+{
+
+	vq->vq_last_avail--;
+}
+
+/*
+ * Return specified request chain to the guest, setting its I/O length
+ * to the provided value.
+ *
+ * (This chain is the one you handled when you called vq_getchain()
+ * and used its positive return value.)
+ */
+void
+vq_relchain(struct vqueue_info *vq, uint16_t idx, uint32_t iolen)
+{
+	uint16_t uidx, mask;
+	volatile struct vring_used *vuh;
+	volatile struct virtio_used *vue;
+
+	/*
+	 * Notes:
+	 *  - mask is N-1 where N is a power of 2 so computes x % N
+	 *  - vuh points to the "used" data shared with guest
+	 *  - vue points to the "used" ring entry we want to update
+	 *  - head is the same value we compute in vq_iovecs().
+	 *
+	 * (I apologize for the two fields named vu_idx; the
+	 * virtio spec calls the one that vue points to, "id"...)
+	 */
+	mask = vq->vq_qsize - 1;
+	vuh = vq->vq_used;
+
+	uidx = vuh->vu_idx;
+	vue = &vuh->vu_ring[uidx++ & mask];
+	vue->vu_idx = idx;
+	vue->vu_tlen = iolen;
+	vuh->vu_idx = uidx;
+}
+
+/*
+ * Driver has finished processing "available" chains and calling
+ * vq_relchain on each one.  If driver used all the available
+ * chains, used_all should be set.
+ *
+ * If the "used" index moved we may need to inform the guest, i.e.,
+ * deliver an interrupt.  Even if the used index did NOT move we
+ * may need to deliver an interrupt, if the avail ring is empty and
+ * we are supposed to interrupt on empty.
+ *
+ * Note that used_all_avail is provided by the caller because it's
+ * a snapshot of the ring state when he decided to finish interrupt
+ * processing -- it's possible that descriptors became available after
+ * that point.  (It's also typically a constant 1/True as well.)
+ */
+void
+vq_endchains(struct vqueue_info *vq, int used_all_avail)
+{
+	struct virtio_softc *vs;
+	uint16_t event_idx, new_idx, old_idx;
+	int intr;
+
+	/*
+	 * Interrupt generation: if we're using EVENT_IDX,
+	 * interrupt if we've crossed the event threshold.
+	 * Otherwise interrupt is generated if we added "used" entries,
+	 * but suppressed by VRING_AVAIL_F_NO_INTERRUPT.
+	 *
+	 * In any case, though, if NOTIFY_ON_EMPTY is set and the
+	 * entire avail was processed, we need to interrupt always.
+	 */
+	vs = vq->vq_vs;
+	old_idx = vq->vq_save_used;
+	vq->vq_save_used = new_idx = vq->vq_used->vu_idx;
+	if (used_all_avail &&
+	    (vs->vs_negotiated_caps & VIRTIO_F_NOTIFY_ON_EMPTY))
+		intr = 1;
+	else if (vs->vs_negotiated_caps & VIRTIO_RING_F_EVENT_IDX) {
+		event_idx = VQ_USED_EVENT_IDX(vq);
+		/*
+		 * This calculation is per docs and the kernel
+		 * (see src/sys/dev/virtio/virtio_ring.h).
+		 */
+		intr = (uint16_t)(new_idx - event_idx - 1) <
+			(uint16_t)(new_idx - old_idx);
+	} else {
+		intr = new_idx != old_idx &&
+		    !(vq->vq_avail->va_flags & VRING_AVAIL_F_NO_INTERRUPT);
+	}
+	if (intr)
+		vq_interrupt(vs, vq);
+}
+
+/* Note: these are in sorted order to make for a fast search */
+static struct config_reg {
+	uint16_t	cr_offset;	/* register offset */
+	uint8_t		cr_size;	/* size (bytes) */
+	uint8_t		cr_ro;		/* true => reg is read only */
+	const char	*cr_name;	/* name of reg */
+} config_regs[] = {
+	{ VTCFG_R_HOSTCAP,	4, 1, "HOSTCAP" },
+	{ VTCFG_R_GUESTCAP,	4, 0, "GUESTCAP" },
+	{ VTCFG_R_PFN,		4, 0, "PFN" },
+	{ VTCFG_R_QNUM,		2, 1, "QNUM" },
+	{ VTCFG_R_QSEL,		2, 0, "QSEL" },
+	{ VTCFG_R_QNOTIFY,	2, 0, "QNOTIFY" },
+	{ VTCFG_R_STATUS,	1, 0, "STATUS" },
+	{ VTCFG_R_ISR,		1, 0, "ISR" },
+	{ VTCFG_R_CFGVEC,	2, 0, "CFGVEC" },
+	{ VTCFG_R_QVEC,		2, 0, "QVEC" },
+};
+
+static inline struct config_reg *
+vi_find_cr(int offset) {
+	u_int hi, lo, mid;
+	struct config_reg *cr;
+
+	lo = 0;
+	hi = sizeof(config_regs) / sizeof(*config_regs) - 1;
+	while (hi >= lo) {
+		mid = (hi + lo) >> 1;
+		cr = &config_regs[mid];
+		if (cr->cr_offset == offset)
+			return (cr);
+		if (cr->cr_offset < offset)
+			lo = mid + 1;
+		else
+			hi = mid - 1;
+	}
+	return (NULL);
+}
+
+/*
+ * Handle pci config space reads.
+ * If it's to the MSI-X info, do that.
+ * If it's part of the virtio standard stuff, do that.
+ * Otherwise dispatch to the actual driver.
+ */
+uint64_t
+vi_pci_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	    int baridx, uint64_t offset, int size)
+{
+	struct virtio_softc *vs = pi->pi_arg;
+	struct virtio_consts *vc;
+	struct config_reg *cr;
+	uint64_t virtio_config_size, max;
+	const char *name;
+	uint32_t newoff;
+	uint32_t value;
+	int error;
+
+	if (vs->vs_flags & VIRTIO_USE_MSIX) {
+		if (baridx == pci_msix_table_bar(pi) ||
+		    baridx == pci_msix_pba_bar(pi)) {
+			return (pci_emul_msix_tread(pi, offset, size));
+		}
+	}
+
+	/* XXX probably should do something better than just assert() */
+	assert(baridx == 0);
+
+	if (vs->vs_mtx)
+		pthread_mutex_lock(vs->vs_mtx);
+
+	vc = vs->vs_vc;
+	name = vc->vc_name;
+	value = size == 1 ? 0xff : size == 2 ? 0xffff : 0xffffffff;
+
+	if (size != 1 && size != 2 && size != 4)
+		goto bad;
+
+	if (pci_msix_enabled(pi))
+		virtio_config_size = VTCFG_R_CFG1;
+	else
+		virtio_config_size = VTCFG_R_CFG0;
+
+	if (offset >= virtio_config_size) {
+		/*
+		 * Subtract off the standard size (including MSI-X
+		 * registers if enabled) and dispatch to underlying driver.
+		 * If that fails, fall into general code.
+		 */
+		newoff = offset - virtio_config_size;
+		max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
+		if (newoff + size > max)
+			goto bad;
+		error = (*vc->vc_cfgread)(DEV_SOFTC(vs), newoff, size, &value);
+		if (!error)
+			goto done;
+	}
+
+bad:
+	cr = vi_find_cr(offset);
+	if (cr == NULL || cr->cr_size != size) {
+		if (cr != NULL) {
+			/* offset must be OK, so size must be bad */
+			fprintf(stderr,
+			    "%s: read from %s: bad size %d\r\n",
+			    name, cr->cr_name, size);
+		} else {
+			fprintf(stderr,
+			    "%s: read from bad offset/size %jd/%d\r\n",
+			    name, (uintmax_t)offset, size);
+		}
+		goto done;
+	}
+
+	switch (offset) {
+	case VTCFG_R_HOSTCAP:
+		value = vc->vc_hv_caps;
+		break;
+	case VTCFG_R_GUESTCAP:
+		value = vs->vs_negotiated_caps;
+		break;
+	case VTCFG_R_PFN:
+		if (vs->vs_curq < vc->vc_nvq)
+			value = vs->vs_queues[vs->vs_curq].vq_pfn;
+		break;
+	case VTCFG_R_QNUM:
+		value = vs->vs_curq < vc->vc_nvq ?
+		    vs->vs_queues[vs->vs_curq].vq_qsize : 0;
+		break;
+	case VTCFG_R_QSEL:
+		value = vs->vs_curq;
+		break;
+	case VTCFG_R_QNOTIFY:
+		value = 0;	/* XXX */
+		break;
+	case VTCFG_R_STATUS:
+		value = vs->vs_status;
+		break;
+	case VTCFG_R_ISR:
+		value = vs->vs_isr;
+		vs->vs_isr = 0;		/* a read clears this flag */
+		if (value)
+			pci_lintr_deassert(pi);
+		break;
+	case VTCFG_R_CFGVEC:
+		value = vs->vs_msix_cfg_idx;
+		break;
+	case VTCFG_R_QVEC:
+		value = vs->vs_curq < vc->vc_nvq ?
+		    vs->vs_queues[vs->vs_curq].vq_msix_idx :
+		    VIRTIO_MSI_NO_VECTOR;
+		break;
+	}
+done:
+	if (vs->vs_mtx)
+		pthread_mutex_unlock(vs->vs_mtx);
+	return (value);
+}
+
+/*
+ * Handle pci config space writes.
+ * If it's to the MSI-X info, do that.
+ * If it's part of the virtio standard stuff, do that.
+ * Otherwise dispatch to the actual driver.
+ */
+void
+vi_pci_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+	     int baridx, uint64_t offset, int size, uint64_t value)
+{
+	struct virtio_softc *vs = pi->pi_arg;
+	struct vqueue_info *vq;
+	struct virtio_consts *vc;
+	struct config_reg *cr;
+	uint64_t virtio_config_size, max;
+	const char *name;
+	uint32_t newoff;
+	int error;
+
+	if (vs->vs_flags & VIRTIO_USE_MSIX) {
+		if (baridx == pci_msix_table_bar(pi) ||
+		    baridx == pci_msix_pba_bar(pi)) {
+			pci_emul_msix_twrite(pi, offset, size, value);
+			return;
+		}
+	}
+
+	/* XXX probably should do something better than just assert() */
+	assert(baridx == 0);
+
+	if (vs->vs_mtx)
+		pthread_mutex_lock(vs->vs_mtx);
+
+	vc = vs->vs_vc;
+	name = vc->vc_name;
+
+	if (size != 1 && size != 2 && size != 4)
+		goto bad;
+
+	if (pci_msix_enabled(pi))
+		virtio_config_size = VTCFG_R_CFG1;
+	else
+		virtio_config_size = VTCFG_R_CFG0;
+
+	if (offset >= virtio_config_size) {
+		/*
+		 * Subtract off the standard size (including MSI-X
+		 * registers if enabled) and dispatch to underlying driver.
+		 */
+		newoff = offset - virtio_config_size;
+		max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
+		if (newoff + size > max)
+			goto bad;
+		error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), newoff, size, value);
+		if (!error)
+			goto done;
+	}
+
+bad:
+	cr = vi_find_cr(offset);
+	if (cr == NULL || cr->cr_size != size || cr->cr_ro) {
+		if (cr != NULL) {
+			/* offset must be OK, wrong size and/or reg is R/O */
+			if (cr->cr_size != size)
+				fprintf(stderr,
+				    "%s: write to %s: bad size %d\r\n",
+				    name, cr->cr_name, size);
+			if (cr->cr_ro)
+				fprintf(stderr,
+				    "%s: write to read-only reg %s\r\n",
+				    name, cr->cr_name);
+		} else {
+			fprintf(stderr,
+			    "%s: write to bad offset/size %jd/%d\r\n",
+			    name, (uintmax_t)offset, size);
+		}
+		goto done;
+	}
+
+	switch (offset) {
+	case VTCFG_R_GUESTCAP:
+		vs->vs_negotiated_caps = value & vc->vc_hv_caps;
+		if (vc->vc_apply_features)
+			(*vc->vc_apply_features)(DEV_SOFTC(vs),
+			    vs->vs_negotiated_caps);
+		break;
+	case VTCFG_R_PFN:
+		if (vs->vs_curq >= vc->vc_nvq)
+			goto bad_qindex;
+		vi_vq_init(vs, value);
+		break;
+	case VTCFG_R_QSEL:
+		/*
+		 * Note that the guest is allowed to select an
+		 * invalid queue; we just need to return a QNUM
+		 * of 0 while the bad queue is selected.
+		 */
+		vs->vs_curq = value;
+		break;
+	case VTCFG_R_QNOTIFY:
+		if (value >= vc->vc_nvq) {
+			fprintf(stderr, "%s: queue %d notify out of range\r\n",
+				name, (int)value);
+			goto done;
+		}
+		vq = &vs->vs_queues[value];
+		if (vq->vq_notify)
+			(*vq->vq_notify)(DEV_SOFTC(vs), vq);
+		else if (vc->vc_qnotify)
+			(*vc->vc_qnotify)(DEV_SOFTC(vs), vq);
+		else
+			fprintf(stderr,
+			    "%s: qnotify queue %d: missing vq/vc notify\r\n",
+				name, (int)value);
+		break;
+	case VTCFG_R_STATUS:
+		vs->vs_status = value;
+		if (value == 0)
+			(*vc->vc_reset)(DEV_SOFTC(vs));
+		break;
+	case VTCFG_R_CFGVEC:
+		vs->vs_msix_cfg_idx = value;
+		break;
+	case VTCFG_R_QVEC:
+		if (vs->vs_curq >= vc->vc_nvq)
+			goto bad_qindex;
+		vq = &vs->vs_queues[vs->vs_curq];
+		vq->vq_msix_idx = value;
+		break;
+	}
+	goto done;
+
+bad_qindex:
+	fprintf(stderr,
+	    "%s: write config reg %s: curq %d >= max %d\r\n",
+	    name, cr->cr_name, vs->vs_curq, vc->vc_nvq);
+done:
+	if (vs->vs_mtx)
+		pthread_mutex_unlock(vs->vs_mtx);
+}
diff --git a/usr/src/cmd/bhyve/virtio.h b/usr/src/cmd/bhyve/virtio.h
new file mode 100644
index 0000000000..f59d823448
--- /dev/null
+++ b/usr/src/cmd/bhyve/virtio.h
@@ -0,0 +1,483 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013  Chris Torek <torek @ torek net>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_VIRTIO_H_
+#define	_VIRTIO_H_
+
+#include <pthread_np.h>
+
+/*
+ * These are derived from several virtio specifications.
+ *
+ * Some useful links:
+ *    https://github.com/rustyrussell/virtio-spec
+ *    http://people.redhat.com/pbonzini/virtio-spec.pdf
+ */
+
+/*
+ * A virtual device has zero or more "virtual queues" (virtqueue).
+ * Each virtqueue uses at least two 4096-byte pages, laid out thus:
+ *
+ *      +-----------------------------------------------+
+ *      |    "desc":  <N> descriptors, 16 bytes each    |
+ *      |   -----------------------------------------   |
+ *      |   "avail":   2 uint16; <N> uint16; 1 uint16   |
+ *      |   -----------------------------------------   |
+ *      |              pad to 4k boundary               |
+ *      +-----------------------------------------------+
+ *      |   "used": 2 x uint16; <N> elems; 1 uint16     |
+ *      |   -----------------------------------------   |
+ *      |              pad to 4k boundary               |
+ *      +-----------------------------------------------+
+ *
+ * The number <N> that appears here is always a power of two and is
+ * limited to no more than 32768 (as it must fit in a 16-bit field).
+ * If <N> is sufficiently large, the above will occupy more than
+ * two pages.  In any case, all pages must be physically contiguous
+ * within the guest's physical address space.
+ *
+ * The <N> 16-byte "desc" descriptors consist of a 64-bit guest
+ * physical address <addr>, a 32-bit length <len>, a 16-bit
+ * <flags>, and a 16-bit <next> field (all in guest byte order).
+ *
+ * There are three flags that may be set :
+ *	NEXT    descriptor is chained, so use its "next" field
+ *	WRITE   descriptor is for host to write into guest RAM
+ *		(else host is to read from guest RAM)
+ *	INDIRECT   descriptor address field is (guest physical)
+ *		address of a linear array of descriptors
+ *
+ * Unless INDIRECT is set, <len> is the number of bytes that may
+ * be read/written from guest physical address <addr>.  If
+ * INDIRECT is set, WRITE is ignored and <len> provides the length
+ * of the indirect descriptors (and <len> must be a multiple of
+ * 16).  Note that NEXT may still be set in the main descriptor
+ * pointing to the indirect, and should be set in each indirect
+ * descriptor that uses the next descriptor (these should generally
+ * be numbered sequentially).  However, INDIRECT must not be set
+ * in the indirect descriptors.  Upon reaching an indirect descriptor
+ * without a NEXT bit, control returns to the direct descriptors.
+ *
+ * Except inside an indirect, each <next> value must be in the
+ * range [0 .. N) (i.e., the half-open interval).  (Inside an
+ * indirect, each <next> must be in the range [0 .. <len>/16).)
+ *
+ * The "avail" data structures reside in the same pages as the
+ * "desc" structures since both together are used by the device to
+ * pass information to the hypervisor's virtual driver.  These
+ * begin with a 16-bit <flags> field and 16-bit index <idx>, then
+ * have <N> 16-bit <ring> values, followed by one final 16-bit
+ * field <used_event>.  The <N> <ring> entries are simply indices
+ * indices into the descriptor ring (and thus must meet the same
+ * constraints as each <next> value).  However, <idx> is counted
+ * up from 0 (initially) and simply wraps around after 65535; it
+ * is taken mod <N> to find the next available entry.
+ *
+ * The "used" ring occupies a separate page or pages, and contains
+ * values written from the virtual driver back to the guest OS.
+ * This begins with a 16-bit <flags> and 16-bit <idx>, then there
+ * are <N> "vring_used" elements, followed by a 16-bit <avail_event>.
+ * The <N> "vring_used" elements consist of a 32-bit <id> and a
+ * 32-bit <len> (vu_tlen below).  The <id> is simply the index of
+ * the head of a descriptor chain the guest made available
+ * earlier, and the <len> is the number of bytes actually written,
+ * e.g., in the case of a network driver that provided a large
+ * receive buffer but received only a small amount of data.
+ *
+ * The two event fields, <used_event> and <avail_event>, in the
+ * avail and used rings (respectively -- note the reversal!), are
+ * always provided, but are used only if the virtual device
+ * negotiates the VIRTIO_RING_F_EVENT_IDX feature during feature
+ * negotiation.  Similarly, both rings provide a flag --
+ * VRING_AVAIL_F_NO_INTERRUPT and VRING_USED_F_NO_NOTIFY -- in
+ * their <flags> field, indicating that the guest does not need an
+ * interrupt, or that the hypervisor driver does not need a
+ * notify, when descriptors are added to the corresponding ring.
+ * (These are provided only for interrupt optimization and need
+ * not be implemented.)
+ */
+#define VRING_ALIGN	4096
+
+#define VRING_DESC_F_NEXT	(1 << 0)
+#define VRING_DESC_F_WRITE	(1 << 1)
+#define VRING_DESC_F_INDIRECT	(1 << 2)
+
+struct virtio_desc {			/* AKA vring_desc */
+	uint64_t	vd_addr;	/* guest physical address */
+	uint32_t	vd_len;		/* length of scatter/gather seg */
+	uint16_t	vd_flags;	/* VRING_F_DESC_* */
+	uint16_t	vd_next;	/* next desc if F_NEXT */
+} __packed;
+
+struct virtio_used {			/* AKA vring_used_elem */
+	uint32_t	vu_idx;		/* head of used descriptor chain */
+	uint32_t	vu_tlen;	/* length written-to */
+} __packed;
+
+#define VRING_AVAIL_F_NO_INTERRUPT   1
+
+struct vring_avail {
+	uint16_t	va_flags;	/* VRING_AVAIL_F_* */
+	uint16_t	va_idx;		/* counts to 65535, then cycles */
+	uint16_t	va_ring[];	/* size N, reported in QNUM value */
+/*	uint16_t	va_used_event;	-- after N ring entries */
+} __packed;
+
+#define	VRING_USED_F_NO_NOTIFY		1
+struct vring_used {
+	uint16_t	vu_flags;	/* VRING_USED_F_* */
+	uint16_t	vu_idx;		/* counts to 65535, then cycles */
+	struct virtio_used vu_ring[];	/* size N */
+/*	uint16_t	vu_avail_event;	-- after N ring entries */
+} __packed;
+
+/*
+ * The address of any given virtual queue is determined by a single
+ * Page Frame Number register.  The guest writes the PFN into the
+ * PCI config space.  However, a device that has two or more
+ * virtqueues can have a different PFN, and size, for each queue.
+ * The number of queues is determinable via the PCI config space
+ * VTCFG_R_QSEL register.  Writes to QSEL select the queue: 0 means
+ * queue #0, 1 means queue#1, etc.  Once a queue is selected, the
+ * remaining PFN and QNUM registers refer to that queue.
+ *
+ * QNUM is a read-only register containing a nonzero power of two
+ * that indicates the (hypervisor's) queue size.  Or, if reading it
+ * produces zero, the hypervisor does not have a corresponding
+ * queue.  (The number of possible queues depends on the virtual
+ * device.  The block device has just one; the network device
+ * provides either two -- 0 = receive, 1 = transmit -- or three,
+ * with 2 = control.)
+ *
+ * PFN is a read/write register giving the physical page address of
+ * the virtqueue in guest memory (the guest must allocate enough space
+ * based on the hypervisor's provided QNUM).
+ *
+ * QNOTIFY is effectively write-only: when the guest writes a queue
+ * number to the register, the hypervisor should scan the specified
+ * virtqueue. (Reading QNOTIFY currently always gets 0).
+ */
+
+/*
+ * PFN register shift amount
+ */
+#define VRING_PFN               12
+
+/*
+ * Virtio device types
+ *
+ * XXX Should really be merged with <dev/virtio/virtio.h> defines
+ */
+#define	VIRTIO_TYPE_NET		1
+#define	VIRTIO_TYPE_BLOCK	2
+#define	VIRTIO_TYPE_CONSOLE	3
+#define	VIRTIO_TYPE_ENTROPY	4
+#define	VIRTIO_TYPE_BALLOON	5
+#define	VIRTIO_TYPE_IOMEMORY	6
+#define	VIRTIO_TYPE_RPMSG	7
+#define	VIRTIO_TYPE_SCSI	8
+#define	VIRTIO_TYPE_9P		9
+
+/* experimental IDs start at 65535 and work down */
+
+/*
+ * PCI vendor/device IDs
+ */
+#define	VIRTIO_VENDOR		0x1AF4
+#define	VIRTIO_DEV_NET		0x1000
+#define	VIRTIO_DEV_BLOCK	0x1001
+#define	VIRTIO_DEV_CONSOLE	0x1003
+#define	VIRTIO_DEV_RANDOM	0x1005
+
+/*
+ * PCI config space constants.
+ *
+ * If MSI-X is enabled, the ISR register is generally not used,
+ * and the configuration vector and queue vector appear at offsets
+ * 20 and 22 with the remaining configuration registers at 24.
+ * If MSI-X is not enabled, those two registers disappear and
+ * the remaining configuration registers start at offset 20.
+ */
+#define VTCFG_R_HOSTCAP		0
+#define VTCFG_R_GUESTCAP	4
+#define VTCFG_R_PFN		8
+#define VTCFG_R_QNUM		12
+#define VTCFG_R_QSEL		14
+#define VTCFG_R_QNOTIFY		16
+#define VTCFG_R_STATUS		18
+#define VTCFG_R_ISR		19
+#define VTCFG_R_CFGVEC		20
+#define VTCFG_R_QVEC		22
+#define VTCFG_R_CFG0		20	/* No MSI-X */
+#define VTCFG_R_CFG1		24	/* With MSI-X */
+#define VTCFG_R_MSIX		20
+
+/*
+ * Bits in VTCFG_R_STATUS.  Guests need not actually set any of these,
+ * but a guest writing 0 to this register means "please reset".
+ */
+#define	VTCFG_STATUS_ACK	0x01	/* guest OS has acknowledged dev */
+#define	VTCFG_STATUS_DRIVER	0x02	/* guest OS driver is loaded */
+#define	VTCFG_STATUS_DRIVER_OK	0x04	/* guest OS driver ready */
+#define	VTCFG_STATUS_FAILED	0x80	/* guest has given up on this dev */
+
+/*
+ * Bits in VTCFG_R_ISR.  These apply only if not using MSI-X.
+ *
+ * (We don't [yet?] ever use CONF_CHANGED.)
+ */
+#define	VTCFG_ISR_QUEUES	0x01	/* re-scan queues */
+#define	VTCFG_ISR_CONF_CHANGED	0x80	/* configuration changed */
+
+#define VIRTIO_MSI_NO_VECTOR	0xFFFF
+
+/*
+ * Feature flags.
+ * Note: bits 0 through 23 are reserved to each device type.
+ */
+#define	VIRTIO_F_NOTIFY_ON_EMPTY	(1 << 24)
+#define	VIRTIO_RING_F_INDIRECT_DESC	(1 << 28)
+#define	VIRTIO_RING_F_EVENT_IDX		(1 << 29)
+
+/* From section 2.3, "Virtqueue Configuration", of the virtio specification */
+static inline size_t
+vring_size(u_int qsz)
+{
+	size_t size;
+
+	/* constant 3 below = va_flags, va_idx, va_used_event */
+	size = sizeof(struct virtio_desc) * qsz + sizeof(uint16_t) * (3 + qsz);
+	size = roundup2(size, VRING_ALIGN);
+
+	/* constant 3 below = vu_flags, vu_idx, vu_avail_event */
+	size += sizeof(uint16_t) * 3 + sizeof(struct virtio_used) * qsz;
+	size = roundup2(size, VRING_ALIGN);
+
+	return (size);
+}
+
+struct vmctx;
+struct pci_devinst;
+struct vqueue_info;
+
+/*
+ * A virtual device, with some number (possibly 0) of virtual
+ * queues and some size (possibly 0) of configuration-space
+ * registers private to the device.  The virtio_softc should come
+ * at the front of each "derived class", so that a pointer to the
+ * virtio_softc is also a pointer to the more specific, derived-
+ * from-virtio driver's softc.
+ *
+ * Note: inside each hypervisor virtio driver, changes to these
+ * data structures must be locked against other threads, if any.
+ * Except for PCI config space register read/write, we assume each
+ * driver does the required locking, but we need a pointer to the
+ * lock (if there is one) for PCI config space read/write ops.
+ *
+ * When the guest reads or writes the device's config space, the
+ * generic layer checks for operations on the special registers
+ * described above.  If the offset of the register(s) being read
+ * or written is past the CFG area (CFG0 or CFG1), the request is
+ * passed on to the virtual device, after subtracting off the
+ * generic-layer size.  (So, drivers can just use the offset as
+ * an offset into "struct config", for instance.)
+ *
+ * (The virtio layer also makes sure that the read or write is to/
+ * from a "good" config offset, hence vc_cfgsize, and on BAR #0.
+ * However, the driver must verify the read or write size and offset
+ * and that no one is writing a readonly register.)
+ *
+ * The BROKED flag ("this thing done gone and broked") is for future
+ * use.
+ */
+#define	VIRTIO_USE_MSIX		0x01
+#define	VIRTIO_EVENT_IDX	0x02	/* use the event-index values */
+#define	VIRTIO_BROKED		0x08	/* ??? */
+
+struct virtio_softc {
+	struct virtio_consts *vs_vc;	/* constants (see below) */
+	int	vs_flags;		/* VIRTIO_* flags from above */
+	pthread_mutex_t *vs_mtx;	/* POSIX mutex, if any */
+	struct pci_devinst *vs_pi;	/* PCI device instance */
+	uint32_t vs_negotiated_caps;	/* negotiated capabilities */
+	struct vqueue_info *vs_queues;	/* one per vc_nvq */
+	int	vs_curq;		/* current queue */
+	uint8_t	vs_status;		/* value from last status write */
+	uint8_t	vs_isr;			/* ISR flags, if not MSI-X */
+	uint16_t vs_msix_cfg_idx;	/* MSI-X vector for config event */
+};
+
+#define	VS_LOCK(vs)							\
+do {									\
+	if (vs->vs_mtx)							\
+		pthread_mutex_lock(vs->vs_mtx);				\
+} while (0)
+
+#define	VS_UNLOCK(vs)							\
+do {									\
+	if (vs->vs_mtx)							\
+		pthread_mutex_unlock(vs->vs_mtx);			\
+} while (0)
+
+struct virtio_consts {
+	const char *vc_name;		/* name of driver (for diagnostics) */
+	int	vc_nvq;			/* number of virtual queues */
+	size_t	vc_cfgsize;		/* size of dev-specific config regs */
+	void	(*vc_reset)(void *);	/* called on virtual device reset */
+	void	(*vc_qnotify)(void *, struct vqueue_info *);
+					/* called on QNOTIFY if no VQ notify */
+	int	(*vc_cfgread)(void *, int, int, uint32_t *);
+					/* called to read config regs */
+	int	(*vc_cfgwrite)(void *, int, int, uint32_t);
+					/* called to write config regs */
+	void    (*vc_apply_features)(void *, uint64_t);
+				/* called to apply negotiated features */
+	uint64_t vc_hv_caps;		/* hypervisor-provided capabilities */
+};
+
+/*
+ * Data structure allocated (statically) per virtual queue.
+ *
+ * Drivers may change vq_qsize after a reset.  When the guest OS
+ * requests a device reset, the hypervisor first calls
+ * vs->vs_vc->vc_reset(); then the data structure below is
+ * reinitialized (for each virtqueue: vs->vs_vc->vc_nvq).
+ *
+ * The remaining fields should only be fussed-with by the generic
+ * code.
+ *
+ * Note: the addresses of vq_desc, vq_avail, and vq_used are all
+ * computable from each other, but it's a lot simpler if we just
+ * keep a pointer to each one.  The event indices are similarly
+ * (but more easily) computable, and this time we'll compute them:
+ * they're just XX_ring[N].
+ */
+#define	VQ_ALLOC	0x01	/* set once we have a pfn */
+#define	VQ_BROKED	0x02	/* ??? */
+struct vqueue_info {
+	uint16_t vq_qsize;	/* size of this queue (a power of 2) */
+	void	(*vq_notify)(void *, struct vqueue_info *);
+				/* called instead of vc_notify, if not NULL */
+
+	struct virtio_softc *vq_vs;	/* backpointer to softc */
+	uint16_t vq_num;	/* we're the num'th queue in the softc */
+
+	uint16_t vq_flags;	/* flags (see above) */
+	uint16_t vq_last_avail;	/* a recent value of vq_avail->va_idx */
+	uint16_t vq_save_used;	/* saved vq_used->vu_idx; see vq_endchains */
+	uint16_t vq_msix_idx;	/* MSI-X index, or VIRTIO_MSI_NO_VECTOR */
+
+	uint32_t vq_pfn;	/* PFN of virt queue (not shifted!) */
+
+	volatile struct virtio_desc *vq_desc;	/* descriptor array */
+	volatile struct vring_avail *vq_avail;	/* the "avail" ring */
+	volatile struct vring_used *vq_used;	/* the "used" ring */
+
+};
+/* as noted above, these are sort of backwards, name-wise */
+#define VQ_AVAIL_EVENT_IDX(vq) \
+	(*(volatile uint16_t *)&(vq)->vq_used->vu_ring[(vq)->vq_qsize])
+#define VQ_USED_EVENT_IDX(vq) \
+	((vq)->vq_avail->va_ring[(vq)->vq_qsize])
+
+/*
+ * Is this ring ready for I/O?
+ */
+static inline int
+vq_ring_ready(struct vqueue_info *vq)
+{
+
+	return (vq->vq_flags & VQ_ALLOC);
+}
+
+/*
+ * Are there "available" descriptors?  (This does not count
+ * how many, just returns True if there are some.)
+ */
+static inline int
+vq_has_descs(struct vqueue_info *vq)
+{
+
+	return (vq_ring_ready(vq) && vq->vq_last_avail !=
+	    vq->vq_avail->va_idx);
+}
+
+/*
+ * Deliver an interrupt to guest on the given virtual queue
+ * (if possible, or a generic MSI interrupt if not using MSI-X).
+ */
+static inline void
+vq_interrupt(struct virtio_softc *vs, struct vqueue_info *vq)
+{
+
+	if (pci_msix_enabled(vs->vs_pi))
+		pci_generate_msix(vs->vs_pi, vq->vq_msix_idx);
+	else {
+#ifndef __FreeBSD__
+		boolean_t unlock = B_FALSE;
+
+		if (vs->vs_mtx && !pthread_mutex_isowned_np(vs->vs_mtx)) {
+			unlock = B_TRUE;
+			pthread_mutex_lock(vs->vs_mtx);
+		}
+#else
+		VS_LOCK(vs);
+#endif
+		vs->vs_isr |= VTCFG_ISR_QUEUES;
+		pci_generate_msi(vs->vs_pi, 0);
+		pci_lintr_assert(vs->vs_pi);
+#ifndef __FreeBSD__
+		if (unlock)
+			pthread_mutex_unlock(vs->vs_mtx);
+#else
+		VS_UNLOCK(vs);
+#endif
+	}
+}
+
+struct iovec;
+void	vi_softc_linkup(struct virtio_softc *vs, struct virtio_consts *vc,
+			void *dev_softc, struct pci_devinst *pi,
+			struct vqueue_info *queues);
+int	vi_intr_init(struct virtio_softc *vs, int barnum, int use_msix);
+void	vi_reset_dev(struct virtio_softc *);
+void	vi_set_io_bar(struct virtio_softc *, int);
+
+int	vq_getchain(struct vqueue_info *vq, uint16_t *pidx,
+		    struct iovec *iov, int n_iov, uint16_t *flags);
+void	vq_retchain(struct vqueue_info *vq);
+void	vq_relchain(struct vqueue_info *vq, uint16_t idx, uint32_t iolen);
+void	vq_endchains(struct vqueue_info *vq, int used_all_avail);
+
+uint64_t vi_pci_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+		     int baridx, uint64_t offset, int size);
+void	vi_pci_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
+		     int baridx, uint64_t offset, int size, uint64_t value);
+#endif	/* _VIRTIO_H_ */
diff --git a/usr/src/cmd/bhyve/xmsr.c b/usr/src/cmd/bhyve/xmsr.c
new file mode 100644
index 0000000000..3278ea591c
--- /dev/null
+++ b/usr/src/cmd/bhyve/xmsr.c
@@ -0,0 +1,239 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+
+#include <machine/cpufunc.h>
+#include <machine/vmm.h>
+#include <machine/specialreg.h>
+
+#include <vmmapi.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "xmsr.h"
+
+static int cpu_vendor_intel, cpu_vendor_amd;
+
+int
+emulate_wrmsr(struct vmctx *ctx, int vcpu, uint32_t num, uint64_t val)
+{
+
+	if (cpu_vendor_intel) {
+		switch (num) {
+#ifndef	__FreeBSD__
+		case MSR_PERFCTR0:
+		case MSR_PERFCTR1:
+		case MSR_EVNTSEL0:
+		case MSR_EVNTSEL1:
+			return (0);
+#endif
+		case 0xd04:		/* Sandy Bridge uncore PMCs */
+		case 0xc24:
+			return (0);
+		case MSR_BIOS_UPDT_TRIG:
+			return (0);
+		case MSR_BIOS_SIGN:
+			return (0);
+		default:
+			break;
+		}
+	} else if (cpu_vendor_amd) {
+		switch (num) {
+		case MSR_HWCR:
+			/*
+			 * Ignore writes to hardware configuration MSR.
+			 */
+			return (0);
+
+		case MSR_NB_CFG1:
+		case MSR_IC_CFG:
+			return (0);	/* Ignore writes */
+
+		case MSR_PERFEVSEL0:
+		case MSR_PERFEVSEL1:
+		case MSR_PERFEVSEL2:
+		case MSR_PERFEVSEL3:
+			/* Ignore writes to the PerfEvtSel MSRs */
+			return (0);
+
+		case MSR_K7_PERFCTR0:
+		case MSR_K7_PERFCTR1:
+		case MSR_K7_PERFCTR2:
+		case MSR_K7_PERFCTR3:
+			/* Ignore writes to the PerfCtr MSRs */
+			return (0);
+
+		case MSR_P_STATE_CONTROL:
+			/* Ignore write to change the P-state */
+			return (0);
+
+		default:
+			break;
+		}
+	}
+	return (-1);
+}
+
+int
+emulate_rdmsr(struct vmctx *ctx, int vcpu, uint32_t num, uint64_t *val)
+{
+	int error = 0;
+
+	if (cpu_vendor_intel) {
+		switch (num) {
+		case MSR_BIOS_SIGN:
+		case MSR_IA32_PLATFORM_ID:
+		case MSR_PKG_ENERGY_STATUS:
+		case MSR_PP0_ENERGY_STATUS:
+		case MSR_PP1_ENERGY_STATUS:
+		case MSR_DRAM_ENERGY_STATUS:
+			*val = 0;
+			break;
+		case MSR_RAPL_POWER_UNIT:
+			/*
+			 * Use the default value documented in section
+			 * "RAPL Interfaces" in Intel SDM vol3.
+			 */
+			*val = 0x000a1003;
+			break;
+		default:
+			error = -1;
+			break;
+		}
+	} else if (cpu_vendor_amd) {
+		switch (num) {
+		case MSR_BIOS_SIGN:
+			*val = 0;
+			break;
+		case MSR_HWCR:
+			/*
+			 * Bios and Kernel Developer's Guides for AMD Families
+			 * 12H, 14H, 15H and 16H.
+			 */
+			*val = 0x01000010;	/* Reset value */
+			*val |= 1 << 9;		/* MONITOR/MWAIT disable */
+			break;
+
+		case MSR_NB_CFG1:
+		case MSR_IC_CFG:
+			/*
+			 * The reset value is processor family dependent so
+			 * just return 0.
+			 */
+			*val = 0;
+			break;
+
+		case MSR_PERFEVSEL0:
+		case MSR_PERFEVSEL1:
+		case MSR_PERFEVSEL2:
+		case MSR_PERFEVSEL3:
+			/*
+			 * PerfEvtSel MSRs are not properly virtualized so just
+			 * return zero.
+			 */
+			*val = 0;
+			break;
+
+		case MSR_K7_PERFCTR0:
+		case MSR_K7_PERFCTR1:
+		case MSR_K7_PERFCTR2:
+		case MSR_K7_PERFCTR3:
+			/*
+			 * PerfCtr MSRs are not properly virtualized so just
+			 * return zero.
+			 */
+			*val = 0;
+			break;
+
+		case MSR_SMM_ADDR:
+		case MSR_SMM_MASK:
+			/*
+			 * Return the reset value defined in the AMD Bios and
+			 * Kernel Developer's Guide.
+			 */
+			*val = 0;
+			break;
+
+		case MSR_P_STATE_LIMIT:
+		case MSR_P_STATE_CONTROL:
+		case MSR_P_STATE_STATUS:
+		case MSR_P_STATE_CONFIG(0):	/* P0 configuration */
+			*val = 0;
+			break;
+
+		/*
+		 * OpenBSD guests test bit 0 of this MSR to detect if the
+		 * workaround for erratum 721 is already applied.
+		 * https://support.amd.com/TechDocs/41322_10h_Rev_Gd.pdf
+		 */
+		case 0xC0011029:
+			*val = 1;
+			break;
+
+		default:
+			error = -1;
+			break;
+		}
+	} else {
+		error = -1;
+	}
+	return (error);
+}
+
+int
+init_msr(void)
+{
+	int error;
+	u_int regs[4];
+	char cpu_vendor[13];
+
+	do_cpuid(0, regs);
+	((u_int *)&cpu_vendor)[0] = regs[1];
+	((u_int *)&cpu_vendor)[1] = regs[3];
+	((u_int *)&cpu_vendor)[2] = regs[2];
+	cpu_vendor[12] = '\0';
+
+	error = 0;
+	if (strcmp(cpu_vendor, "AuthenticAMD") == 0) {
+		cpu_vendor_amd = 1;
+	} else if (strcmp(cpu_vendor, "GenuineIntel") == 0) {
+		cpu_vendor_intel = 1;
+	} else {
+		fprintf(stderr, "Unknown cpu vendor \"%s\"\n", cpu_vendor);
+		error = -1;
+	}
+	return (error);
+}
diff --git a/usr/src/cmd/bhyve/xmsr.h b/usr/src/cmd/bhyve/xmsr.h
new file mode 100644
index 0000000000..1fb47c3ae2
--- /dev/null
+++ b/usr/src/cmd/bhyve/xmsr.h
@@ -0,0 +1,38 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_XMSR_H_
+#define	_XMSR_H_
+
+int init_msr(void);
+int emulate_wrmsr(struct vmctx *ctx, int vcpu, uint32_t code, uint64_t val);
+int emulate_rdmsr(struct vmctx *ctx, int vcpu, uint32_t code, uint64_t *val);
+
+#endif
diff --git a/usr/src/cmd/bhyve/zhyve.c b/usr/src/cmd/bhyve/zhyve.c
new file mode 100644
index 0000000000..d3e764b14d
--- /dev/null
+++ b/usr/src/cmd/bhyve/zhyve.c
@@ -0,0 +1,167 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+/*
+ * This small 'zhyve' stub is init for the zone: we therefore need to pick up
+ * our command-line arguments placed in ZHYVE_CMD_FILE by the boot stub, do a
+ * little administration, and exec the real bhyve binary.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <libnvpair.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/corectl.h>
+
+#define	ZHYVE_CMD_FILE	"/var/run/bhyve/zhyve.cmd"
+
+/*
+ * Do a read of the specified size or return an error.  Returns 0 on success
+ * and -1 on error.  Sets errno to EINVAL if EOF is encountered.  For other
+ * errors, see read(2).
+ */
+static int
+full_read(int fd, char *buf, size_t len)
+{
+	ssize_t nread = 0;
+	size_t totread = 0;
+
+	while (totread < len) {
+		nread = read(fd, buf + totread, len - totread);
+		if (nread == 0) {
+			errno = EINVAL;
+			return (-1);
+		}
+		if (nread < 0) {
+			if (errno == EINTR || errno == EAGAIN) {
+				continue;
+			}
+			return (-1);
+		}
+		totread += nread;
+	}
+	assert(totread == len);
+
+	return (0);
+}
+
+/*
+ * Reads the command line options from the packed nvlist in the file referenced
+ * by path.  On success, 0 is returned and the members of *argv reference memory
+ * allocated from an nvlist.  On failure, -1 is returned.
+ */
+
+static int
+parse_options_file(const char *path, uint_t *argcp, char ***argvp)
+{
+	int fd = -1;
+	struct stat stbuf;
+	char *buf = NULL;
+	nvlist_t *nvl = NULL;
+	int ret;
+
+	if ((fd = open(path, O_RDONLY)) < 0 ||
+	    fstat(fd, &stbuf) != 0 ||
+	    (buf = malloc(stbuf.st_size)) == NULL ||
+	    full_read(fd, buf, stbuf.st_size) != 0 ||
+	    nvlist_unpack(buf, stbuf.st_size, &nvl, 0) != 0 ||
+	    nvlist_lookup_string_array(nvl, "bhyve_args", argvp, argcp) != 0) {
+		nvlist_free(nvl);
+		ret = -1;
+	} else {
+		ret = 0;
+	}
+
+	free(buf);
+	(void) close(fd);
+
+	(void) printf("Configuration from %s:\n", path);
+	nvlist_print(stdout, nvl);
+
+	return (ret);
+}
+
+/*
+ * Setup to suppress core dumps within the zone.
+ */
+static void
+config_core_dumps()
+{
+	(void) core_set_options(0x0);
+}
+
+int
+main(int argc, char **argv)
+{
+	char **tmpargs;
+	uint_t zargc;
+	char **zargv;
+	int fd;
+
+	config_core_dumps();
+
+	fd = open("/dev/null", O_WRONLY);
+	assert(fd >= 0);
+	if (fd != STDIN_FILENO) {
+		(void) dup2(fd, STDIN_FILENO);
+		(void) close(fd);
+	}
+
+	fd = open("/dev/zfd/1", O_WRONLY);
+	assert(fd >= 0);
+	if (fd != STDOUT_FILENO) {
+		(void) dup2(fd, STDOUT_FILENO);
+		(void) close(fd);
+	}
+	setvbuf(stdout, NULL, _IONBF, 0);
+
+	fd = open("/dev/zfd/2", O_WRONLY);
+	assert(fd >= 0);
+	if (fd != STDERR_FILENO) {
+		(void) dup2(fd, STDERR_FILENO);
+		(void) close(fd);
+	}
+	setvbuf(stderr, NULL, _IONBF, 0);
+
+	if (parse_options_file(ZHYVE_CMD_FILE, &zargc, &zargv) != 0) {
+		(void) fprintf(stderr, "%s: failed to parse %s: %s\n",
+		    argv[0], ZHYVE_CMD_FILE, strerror(errno));
+		return (EXIT_FAILURE);
+	}
+
+	/*
+	 * Annoyingly, we need a NULL at the end.
+	 */
+
+	if ((tmpargs = malloc(sizeof (*zargv) * (zargc + 1))) == NULL) {
+		perror("malloc failed");
+		return (EXIT_FAILURE);
+	}
+
+	memcpy(tmpargs, zargv, sizeof (*zargv) * zargc);
+	tmpargs[zargc] = NULL;
+
+	(void) execv("/usr/sbin/bhyve", tmpargs);
+
+	perror("execv failed");
+	return (EXIT_FAILURE);
+}
diff --git a/usr/src/cmd/bhyvectl/Makefile b/usr/src/cmd/bhyvectl/Makefile
new file mode 100644
index 0000000000..11b16ca4df
--- /dev/null
+++ b/usr/src/cmd/bhyvectl/Makefile
@@ -0,0 +1,57 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+# Copyright 2018 Joyent, Inc.
+#
+
+PROG =		bhyvectl
+
+include ../Makefile.cmd
+include ../Makefile.cmd.64
+
+SRCS =		bhyvectl.c
+OBJS =		$(SRCS:.c=.o) humanize_number.o
+
+CLEANFILES =	$(PROG)
+CLOBBERFILES +=	$(ROOTUSRSBINPROG)
+
+.KEEP_STATE:
+
+CFLAGS +=	$(CCVERBOSE)
+CPPFLAGS =	-I$(COMPAT)/freebsd -I$(CONTRIB)/freebsd \
+		-I$(COMPAT)/freebsd/amd64 -I$(CONTRIB)/freebsd/amd64 \
+		$(CPPFLAGS.master) \
+		-I$(ROOT)/usr/platform/i86pc/include \
+		-I$(SRC)/uts/i86pc/io/vmm
+LDLIBS +=	-lvmmapi
+
+CERRWARN +=	-_gcc=-Wno-uninitialized
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDFLAGS) $(LDLIBS)
+	$(POST_PROCESS)
+
+install: all $(ROOTUSRSBINPROG)
+
+clean:
+	$(RM) $(OBJS) $(CLEANFILES)
+
+lint:	lint_SRCS
+
+include ../Makefile.targ
+
+%.o: $(CONTRIB)/freebsd/lib/libutil/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
diff --git a/usr/src/cmd/bhyvectl/bhyvectl.c b/usr/src/cmd/bhyvectl/bhyvectl.c
new file mode 100644
index 0000000000..5f8932efa8
--- /dev/null
+++ b/usr/src/cmd/bhyvectl/bhyvectl.c
@@ -0,0 +1,2372 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/sysctl.h>
+#include <sys/errno.h>
+#include <sys/mman.h>
+#include <sys/cpuset.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+#include <unistd.h>
+#include <libgen.h>
+#include <libutil.h>
+#include <fcntl.h>
+#include <getopt.h>
+#include <time.h>
+#include <assert.h>
+#include <libutil.h>
+
+#include <machine/cpufunc.h>
+#include <machine/specialreg.h>
+#include <machine/vmm.h>
+#include <machine/vmm_dev.h>
+#include <vmmapi.h>
+
+#include "amd/vmcb.h"
+#include "intel/vmcs.h"
+
+#define	MB	(1UL << 20)
+#define	GB	(1UL << 30)
+
+#define	REQ_ARG		required_argument
+#define	NO_ARG		no_argument
+#define	OPT_ARG		optional_argument
+
+static const char *progname;
+
+static void
+usage(bool cpu_intel)
+{
+
+	(void)fprintf(stderr,
+	"Usage: %s --vm=<vmname>\n"
+	"       [--cpu=<vcpu_number>]\n"
+	"       [--create]\n"
+	"       [--destroy]\n"
+	"       [--get-all]\n"
+	"       [--get-stats]\n"
+	"       [--set-desc-ds]\n"
+	"       [--get-desc-ds]\n"
+	"       [--set-desc-es]\n"
+	"       [--get-desc-es]\n"
+	"       [--set-desc-gs]\n"
+	"       [--get-desc-gs]\n"
+	"       [--set-desc-fs]\n"
+	"       [--get-desc-fs]\n"
+	"       [--set-desc-cs]\n"
+	"       [--get-desc-cs]\n"
+	"       [--set-desc-ss]\n"
+	"       [--get-desc-ss]\n"
+	"       [--set-desc-tr]\n"
+	"       [--get-desc-tr]\n"
+	"       [--set-desc-ldtr]\n"
+	"       [--get-desc-ldtr]\n"
+	"       [--set-desc-gdtr]\n"
+	"       [--get-desc-gdtr]\n"
+	"       [--set-desc-idtr]\n"
+	"       [--get-desc-idtr]\n"
+	"       [--run]\n"
+	"       [--capname=<capname>]\n"
+	"       [--getcap]\n"
+	"       [--setcap=<0|1>]\n"
+	"       [--desc-base=<BASE>]\n"
+	"       [--desc-limit=<LIMIT>]\n"
+	"       [--desc-access=<ACCESS>]\n"
+	"       [--set-cr0=<CR0>]\n"
+	"       [--get-cr0]\n"
+	"       [--set-cr2=<CR2>]\n"
+	"       [--get-cr2]\n"
+	"       [--set-cr3=<CR3>]\n"
+	"       [--get-cr3]\n"
+	"       [--set-cr4=<CR4>]\n"
+	"       [--get-cr4]\n"
+	"       [--set-dr0=<DR0>]\n"
+	"       [--get-dr0]\n"
+	"       [--set-dr1=<DR1>]\n"
+	"       [--get-dr1]\n"
+	"       [--set-dr2=<DR2>]\n"
+	"       [--get-dr2]\n"
+	"       [--set-dr3=<DR3>]\n"
+	"       [--get-dr3]\n"
+	"       [--set-dr6=<DR6>]\n"
+	"       [--get-dr6]\n"
+	"       [--set-dr7=<DR7>]\n"
+	"       [--get-dr7]\n"
+	"       [--set-rsp=<RSP>]\n"
+	"       [--get-rsp]\n"
+	"       [--set-rip=<RIP>]\n"
+	"       [--get-rip]\n"
+	"       [--get-rax]\n"
+	"       [--set-rax=<RAX>]\n"
+	"       [--get-rbx]\n"
+	"       [--get-rcx]\n"
+	"       [--get-rdx]\n"
+	"       [--get-rsi]\n"
+	"       [--get-rdi]\n"
+	"       [--get-rbp]\n"
+	"       [--get-r8]\n"
+	"       [--get-r9]\n"
+	"       [--get-r10]\n"
+	"       [--get-r11]\n"
+	"       [--get-r12]\n"
+	"       [--get-r13]\n"
+	"       [--get-r14]\n"
+	"       [--get-r15]\n"
+	"       [--set-rflags=<RFLAGS>]\n"
+	"       [--get-rflags]\n"
+	"       [--set-cs]\n"
+	"       [--get-cs]\n"
+	"       [--set-ds]\n"
+	"       [--get-ds]\n"
+	"       [--set-es]\n"
+	"       [--get-es]\n"
+	"       [--set-fs]\n"
+	"       [--get-fs]\n"
+	"       [--set-gs]\n"
+	"       [--get-gs]\n"
+	"       [--set-ss]\n"
+	"       [--get-ss]\n"
+	"       [--get-tr]\n"
+	"       [--get-ldtr]\n"
+	"       [--set-x2apic-state=<state>]\n"
+	"       [--get-x2apic-state]\n"
+#ifdef __FreeBSD__
+	"       [--unassign-pptdev=<bus/slot/func>]\n"
+#endif
+	"       [--set-mem=<memory in units of MB>]\n"
+	"       [--get-lowmem]\n"
+	"       [--get-highmem]\n"
+	"       [--get-gpa-pmap]\n"
+	"       [--assert-lapic-lvt=<pin>]\n"
+	"       [--inject-nmi]\n"
+	"       [--force-reset]\n"
+	"       [--force-poweroff]\n"
+	"       [--get-rtc-time]\n"
+	"       [--set-rtc-time=<secs>]\n"
+	"       [--get-rtc-nvram]\n"
+	"       [--set-rtc-nvram=<val>]\n"
+	"       [--rtc-nvram-offset=<offset>]\n"
+	"       [--get-active-cpus]\n"
+	"       [--get-suspended-cpus]\n"
+	"       [--get-intinfo]\n"
+	"       [--get-eptp]\n"
+	"       [--set-exception-bitmap]\n"
+	"       [--get-exception-bitmap]\n"
+	"       [--get-tsc-offset]\n"
+	"       [--get-guest-pat]\n"
+	"       [--get-io-bitmap-address]\n"
+	"       [--get-msr-bitmap]\n"
+	"       [--get-msr-bitmap-address]\n"
+	"       [--get-guest-sysenter]\n"
+	"       [--get-exit-reason]\n"
+	"       [--get-cpu-topology]\n",
+	progname);
+
+	if (cpu_intel) {
+		(void)fprintf(stderr,
+		"       [--get-vmcs-pinbased-ctls]\n"
+		"       [--get-vmcs-procbased-ctls]\n"
+		"       [--get-vmcs-procbased-ctls2]\n"
+		"       [--get-vmcs-entry-interruption-info]\n"
+		"       [--set-vmcs-entry-interruption-info=<info>]\n"
+		"       [--get-vmcs-guest-physical-address\n"
+		"       [--get-vmcs-guest-linear-address\n"
+		"       [--get-vmcs-host-pat]\n"
+		"       [--get-vmcs-host-cr0]\n"
+		"       [--get-vmcs-host-cr3]\n"
+		"       [--get-vmcs-host-cr4]\n"
+		"       [--get-vmcs-host-rip]\n"
+		"       [--get-vmcs-host-rsp]\n"
+		"       [--get-vmcs-cr0-mask]\n"
+		"       [--get-vmcs-cr0-shadow]\n"
+		"       [--get-vmcs-cr4-mask]\n"
+		"       [--get-vmcs-cr4-shadow]\n"
+		"       [--get-vmcs-cr3-targets]\n"
+		"       [--get-vmcs-apic-access-address]\n"
+		"       [--get-vmcs-virtual-apic-address]\n"
+		"       [--get-vmcs-tpr-threshold]\n"
+		"       [--get-vmcs-vpid]\n"
+		"       [--get-vmcs-instruction-error]\n"
+		"       [--get-vmcs-exit-ctls]\n"
+		"       [--get-vmcs-entry-ctls]\n"
+		"       [--get-vmcs-link]\n"
+		"       [--get-vmcs-exit-qualification]\n"
+		"       [--get-vmcs-exit-interruption-info]\n"
+		"       [--get-vmcs-exit-interruption-error]\n"
+		"       [--get-vmcs-interruptibility]\n"
+		);
+	} else {
+		(void)fprintf(stderr,
+		"       [--get-vmcb-intercepts]\n"
+		"       [--get-vmcb-asid]\n"
+		"       [--get-vmcb-exit-details]\n"
+		"       [--get-vmcb-tlb-ctrl]\n"
+		"       [--get-vmcb-virq]\n"
+		"       [--get-avic-apic-bar]\n"
+		"       [--get-avic-backing-page]\n"
+		"       [--get-avic-table]\n"
+		);
+	}
+	exit(1);
+}
+
+static int get_rtc_time, set_rtc_time;
+static int get_rtc_nvram, set_rtc_nvram;
+static int rtc_nvram_offset;
+static uint8_t rtc_nvram_value;
+static time_t rtc_secs;
+
+static int get_stats, getcap, setcap, capval, get_gpa_pmap;
+static int inject_nmi, assert_lapic_lvt;
+static int force_reset, force_poweroff;
+static const char *capname;
+static int create, destroy, get_memmap, get_memseg;
+static int get_intinfo;
+static int get_active_cpus, get_suspended_cpus;
+static uint64_t memsize;
+static int set_cr0, get_cr0, set_cr2, get_cr2, set_cr3, get_cr3;
+static int set_cr4, get_cr4;
+static int set_efer, get_efer;
+static int set_dr0, get_dr0;
+static int set_dr1, get_dr1;
+static int set_dr2, get_dr2;
+static int set_dr3, get_dr3;
+static int set_dr6, get_dr6;
+static int set_dr7, get_dr7;
+static int set_rsp, get_rsp, set_rip, get_rip, set_rflags, get_rflags;
+static int set_rax, get_rax;
+static int get_rbx, get_rcx, get_rdx, get_rsi, get_rdi, get_rbp;
+static int get_r8, get_r9, get_r10, get_r11, get_r12, get_r13, get_r14, get_r15;
+static int set_desc_ds, get_desc_ds;
+static int set_desc_es, get_desc_es;
+static int set_desc_fs, get_desc_fs;
+static int set_desc_gs, get_desc_gs;
+static int set_desc_cs, get_desc_cs;
+static int set_desc_ss, get_desc_ss;
+static int set_desc_gdtr, get_desc_gdtr;
+static int set_desc_idtr, get_desc_idtr;
+static int set_desc_tr, get_desc_tr;
+static int set_desc_ldtr, get_desc_ldtr;
+static int set_cs, set_ds, set_es, set_fs, set_gs, set_ss, set_tr, set_ldtr;
+static int get_cs, get_ds, get_es, get_fs, get_gs, get_ss, get_tr, get_ldtr;
+static int set_x2apic_state, get_x2apic_state;
+enum x2apic_state x2apic_state;
+#ifdef __FreeBSD__
+static int unassign_pptdev, bus, slot, func;
+#endif
+static int run;
+static int get_cpu_topology;
+
+/*
+ * VMCB specific.
+ */
+static int get_vmcb_intercept, get_vmcb_exit_details, get_vmcb_tlb_ctrl;
+static int get_vmcb_virq, get_avic_table;
+
+/*
+ * VMCS-specific fields
+ */
+static int get_pinbased_ctls, get_procbased_ctls, get_procbased_ctls2;
+static int get_eptp, get_io_bitmap, get_tsc_offset;
+static int get_vmcs_entry_interruption_info, set_vmcs_entry_interruption_info;
+static int get_vmcs_interruptibility;
+uint32_t vmcs_entry_interruption_info;
+static int get_vmcs_gpa, get_vmcs_gla;
+static int get_exception_bitmap, set_exception_bitmap, exception_bitmap;
+static int get_cr0_mask, get_cr0_shadow;
+static int get_cr4_mask, get_cr4_shadow;
+static int get_cr3_targets;
+static int get_apic_access_addr, get_virtual_apic_addr, get_tpr_threshold;
+static int get_msr_bitmap, get_msr_bitmap_address;
+static int get_vpid_asid;
+static int get_inst_err, get_exit_ctls, get_entry_ctls;
+static int get_host_cr0, get_host_cr3, get_host_cr4;
+static int get_host_rip, get_host_rsp;
+static int get_guest_pat, get_host_pat;
+static int get_guest_sysenter, get_vmcs_link;
+static int get_exit_reason, get_vmcs_exit_qualification;
+static int get_vmcs_exit_interruption_info, get_vmcs_exit_interruption_error;
+static int get_vmcs_exit_inst_length;
+
+static uint64_t desc_base;
+static uint32_t desc_limit, desc_access;
+
+static int get_all;
+
+static void
+dump_vm_run_exitcode(struct vm_exit *vmexit, int vcpu)
+{
+	printf("vm exit[%d]\n", vcpu);
+	printf("\trip\t\t0x%016lx\n", vmexit->rip);
+	printf("\tinst_length\t%d\n", vmexit->inst_length);
+	switch (vmexit->exitcode) {
+	case VM_EXITCODE_INOUT:
+		printf("\treason\t\tINOUT\n");
+		printf("\tdirection\t%s\n", vmexit->u.inout.in ? "IN" : "OUT");
+		printf("\tbytes\t\t%d\n", vmexit->u.inout.bytes);
+		printf("\tflags\t\t%s%s\n",
+			vmexit->u.inout.string ? "STRING " : "",
+			vmexit->u.inout.rep ? "REP " : "");
+		printf("\tport\t\t0x%04x\n", vmexit->u.inout.port);
+		printf("\teax\t\t0x%08x\n", vmexit->u.inout.eax);
+		break;
+	case VM_EXITCODE_VMX:
+		printf("\treason\t\tVMX\n");
+		printf("\tstatus\t\t%d\n", vmexit->u.vmx.status);
+		printf("\texit_reason\t0x%08x (%u)\n",
+		    vmexit->u.vmx.exit_reason, vmexit->u.vmx.exit_reason);
+		printf("\tqualification\t0x%016lx\n",
+			vmexit->u.vmx.exit_qualification);
+		printf("\tinst_type\t\t%d\n", vmexit->u.vmx.inst_type);
+		printf("\tinst_error\t\t%d\n", vmexit->u.vmx.inst_error);
+		break;
+	case VM_EXITCODE_SVM:
+		printf("\treason\t\tSVM\n");
+		printf("\texit_reason\t\t%#lx\n", vmexit->u.svm.exitcode);
+		printf("\texitinfo1\t\t%#lx\n", vmexit->u.svm.exitinfo1);
+		printf("\texitinfo2\t\t%#lx\n", vmexit->u.svm.exitinfo2);
+		break;
+	default:
+		printf("*** unknown vm run exitcode %d\n", vmexit->exitcode);
+		break;
+	}
+}
+
+/* AMD 6th generation and Intel compatible MSRs */
+#define MSR_AMD6TH_START	0xC0000000
+#define MSR_AMD6TH_END		0xC0001FFF
+/* AMD 7th and 8th generation compatible MSRs */
+#define MSR_AMD7TH_START	0xC0010000
+#define MSR_AMD7TH_END		0xC0011FFF
+
+static const char *
+msr_name(uint32_t msr)
+{
+	static char buf[32];
+
+	switch(msr) {
+	case MSR_TSC:
+		return ("MSR_TSC");
+	case MSR_EFER:
+		return ("MSR_EFER");
+	case MSR_STAR:
+		return ("MSR_STAR");
+	case MSR_LSTAR:	
+		return ("MSR_LSTAR");
+	case MSR_CSTAR:
+		return ("MSR_CSTAR");
+	case MSR_SF_MASK:
+		return ("MSR_SF_MASK");
+	case MSR_FSBASE:
+		return ("MSR_FSBASE");
+	case MSR_GSBASE:
+		return ("MSR_GSBASE");
+	case MSR_KGSBASE:
+		return ("MSR_KGSBASE");
+	case MSR_SYSENTER_CS_MSR:
+		return ("MSR_SYSENTER_CS_MSR");
+	case MSR_SYSENTER_ESP_MSR:
+		return ("MSR_SYSENTER_ESP_MSR");
+	case MSR_SYSENTER_EIP_MSR:
+		return ("MSR_SYSENTER_EIP_MSR");
+	case MSR_PAT:
+		return ("MSR_PAT");
+	}
+	snprintf(buf, sizeof(buf), "MSR       %#08x", msr);
+
+	return (buf);
+}
+
+static inline void
+print_msr_pm(uint64_t msr, int vcpu, int readable, int writeable)
+{
+
+	if (readable || writeable) {
+		printf("%-20s[%d]\t\t%c%c\n", msr_name(msr), vcpu,
+			readable ? 'R' : '-', writeable ? 'W' : '-');
+	}
+}
+
+/*
+ * Reference APM vol2, section 15.11 MSR Intercepts.
+ */
+static void
+dump_amd_msr_pm(const char *bitmap, int vcpu)
+{
+	int byte, bit, readable, writeable;
+	uint32_t msr;
+
+	for (msr = 0; msr < 0x2000; msr++) {
+		byte = msr / 4;
+		bit = (msr % 4) * 2;
+
+		/* Look at MSRs in the range 0x00000000 to 0x00001FFF */
+		readable = (bitmap[byte] & (1 << bit)) ? 0 : 1;
+		writeable = (bitmap[byte] & (2 << bit)) ?  0 : 1;
+		print_msr_pm(msr, vcpu, readable, writeable);
+
+		/* Look at MSRs in the range 0xC0000000 to 0xC0001FFF */
+		byte += 2048;
+		readable = (bitmap[byte] & (1 << bit)) ? 0 : 1;
+		writeable = (bitmap[byte] & (2 << bit)) ?  0 : 1;
+		print_msr_pm(msr + MSR_AMD6TH_START, vcpu, readable,
+				writeable);
+		
+		/* MSR 0xC0010000 to 0xC0011FF is only for AMD */
+		byte += 4096;
+		readable = (bitmap[byte] & (1 << bit)) ? 0 : 1;
+		writeable = (bitmap[byte] & (2 << bit)) ?  0 : 1;
+		print_msr_pm(msr + MSR_AMD7TH_START, vcpu, readable,
+				writeable);
+	}
+}
+
+/*
+ * Reference Intel SDM Vol3 Section 24.6.9 MSR-Bitmap Address
+ */
+static void
+dump_intel_msr_pm(const char *bitmap, int vcpu)
+{
+	int byte, bit, readable, writeable;
+	uint32_t msr;
+
+	for (msr = 0; msr < 0x2000; msr++) {
+		byte = msr / 8;
+		bit = msr & 0x7;
+
+		/* Look at MSRs in the range 0x00000000 to 0x00001FFF */
+		readable = (bitmap[byte] & (1 << bit)) ? 0 : 1;
+		writeable = (bitmap[2048 + byte] & (1 << bit)) ?  0 : 1;
+		print_msr_pm(msr, vcpu, readable, writeable);
+
+		/* Look at MSRs in the range 0xC0000000 to 0xC0001FFF */
+		byte += 1024;
+		readable = (bitmap[byte] & (1 << bit)) ? 0 : 1;
+		writeable = (bitmap[2048 + byte] & (1 << bit)) ?  0 : 1;
+		print_msr_pm(msr + MSR_AMD6TH_START, vcpu, readable,
+				writeable);
+	}
+}
+
+static int
+dump_msr_bitmap(int vcpu, uint64_t addr, bool cpu_intel)
+{
+	int error, fd, map_size;
+	const char *bitmap;
+
+	error = -1;
+	bitmap = MAP_FAILED;
+
+	fd = open("/dev/mem", O_RDONLY, 0);
+	if (fd < 0) {
+		perror("Couldn't open /dev/mem");
+		goto done;
+	}
+
+	if (cpu_intel)
+		map_size = PAGE_SIZE;
+	else
+		map_size = 2 * PAGE_SIZE;
+
+	bitmap = mmap(NULL, map_size, PROT_READ, MAP_SHARED, fd, addr);
+	if (bitmap == MAP_FAILED) {
+		perror("mmap failed");
+		goto done;
+	}
+	
+	if (cpu_intel)
+		dump_intel_msr_pm(bitmap, vcpu);
+	else	
+		dump_amd_msr_pm(bitmap, vcpu);
+
+	error = 0;
+done:
+	if (bitmap != MAP_FAILED)
+		munmap((void *)bitmap, map_size);
+	if (fd >= 0)
+		close(fd);
+
+	return (error);
+}
+
+static int
+vm_get_vmcs_field(struct vmctx *ctx, int vcpu, int field, uint64_t *ret_val)
+{
+
+	return (vm_get_register(ctx, vcpu, VMCS_IDENT(field), ret_val));
+}
+
+static int
+vm_set_vmcs_field(struct vmctx *ctx, int vcpu, int field, uint64_t val)
+{
+
+	return (vm_set_register(ctx, vcpu, VMCS_IDENT(field), val));
+}
+
+static int
+vm_get_vmcb_field(struct vmctx *ctx, int vcpu, int off, int bytes,
+	uint64_t *ret_val)
+{
+
+	return (vm_get_register(ctx, vcpu, VMCB_ACCESS(off, bytes), ret_val));
+}
+
+static int
+vm_set_vmcb_field(struct vmctx *ctx, int vcpu, int off, int bytes,
+	uint64_t val)
+{
+	
+	return (vm_set_register(ctx, vcpu, VMCB_ACCESS(off, bytes), val));
+}
+
+enum {
+	VMNAME = 1000,	/* avoid collision with return values from getopt */
+	VCPU,
+	SET_MEM,
+	SET_EFER,
+	SET_CR0,
+	SET_CR2,
+	SET_CR3,
+	SET_CR4,
+	SET_DR0,
+	SET_DR1,
+	SET_DR2,
+	SET_DR3,
+	SET_DR6,
+	SET_DR7,
+	SET_RSP,
+	SET_RIP,
+	SET_RAX,
+	SET_RFLAGS,
+	DESC_BASE,
+	DESC_LIMIT,
+	DESC_ACCESS,
+	SET_CS,
+	SET_DS,
+	SET_ES,
+	SET_FS,
+	SET_GS,
+	SET_SS,
+	SET_TR,
+	SET_LDTR,
+	SET_X2APIC_STATE,
+	SET_EXCEPTION_BITMAP,
+	SET_VMCS_ENTRY_INTERRUPTION_INFO,
+	SET_CAP,
+	CAPNAME,
+	UNASSIGN_PPTDEV,
+	GET_GPA_PMAP,
+	ASSERT_LAPIC_LVT,
+	SET_RTC_TIME,
+	SET_RTC_NVRAM,
+	RTC_NVRAM_OFFSET,
+};
+
+static void
+print_cpus(const char *banner, const cpuset_t *cpus)
+{
+	int i;
+	int first;
+
+	first = 1;
+	printf("%s:\t", banner);
+	if (!CPU_EMPTY(cpus)) {
+		for (i = 0; i < CPU_SETSIZE; i++) {
+			if (CPU_ISSET(i, cpus)) {
+				printf("%s%d", first ? " " : ", ", i);
+				first = 0;
+			}
+		}
+	} else
+		printf(" (none)");
+	printf("\n");
+}
+
+static void
+print_intinfo(const char *banner, uint64_t info)
+{
+	int type;
+
+	printf("%s:\t", banner);
+	if (info & VM_INTINFO_VALID) {
+		type = info & VM_INTINFO_TYPE;
+		switch (type) {
+		case VM_INTINFO_HWINTR:
+			printf("extint");
+			break;
+		case VM_INTINFO_NMI:
+			printf("nmi");
+			break;
+		case VM_INTINFO_SWINTR:
+			printf("swint");
+			break;
+		default:
+			printf("exception");
+			break;
+		}
+		printf(" vector %d", (int)VM_INTINFO_VECTOR(info));
+		if (info & VM_INTINFO_DEL_ERRCODE)
+			printf(" errcode %#x", (u_int)(info >> 32));
+	} else {
+		printf("n/a");
+	}
+	printf("\n");
+}
+
+static bool
+cpu_vendor_intel(void)
+{
+	u_int regs[4];
+	char cpu_vendor[13];
+
+	do_cpuid(0, regs);
+	((u_int *)&cpu_vendor)[0] = regs[1];
+	((u_int *)&cpu_vendor)[1] = regs[3];
+	((u_int *)&cpu_vendor)[2] = regs[2];
+	cpu_vendor[12] = '\0';
+
+	if (strcmp(cpu_vendor, "AuthenticAMD") == 0) {
+		return (false);
+	} else if (strcmp(cpu_vendor, "GenuineIntel") == 0) {
+		return (true);
+	} else {
+		fprintf(stderr, "Unknown cpu vendor \"%s\"\n", cpu_vendor);
+		exit(1);
+	}
+}
+
+static int
+get_all_registers(struct vmctx *ctx, int vcpu)
+{
+	uint64_t cr0, cr2, cr3, cr4, dr0, dr1, dr2, dr3, dr6, dr7;
+	uint64_t rsp, rip, rflags, efer;
+	uint64_t rax, rbx, rcx, rdx, rsi, rdi, rbp;
+	uint64_t r8, r9, r10, r11, r12, r13, r14, r15;
+	int error = 0;
+
+	if (!error && (get_efer || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_EFER, &efer);
+		if (error == 0)
+			printf("efer[%d]\t\t0x%016lx\n", vcpu, efer);
+	}
+
+	if (!error && (get_cr0 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_CR0, &cr0);
+		if (error == 0)
+			printf("cr0[%d]\t\t0x%016lx\n", vcpu, cr0);
+	}
+
+	if (!error && (get_cr2 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_CR2, &cr2);
+		if (error == 0)
+			printf("cr2[%d]\t\t0x%016lx\n", vcpu, cr2);
+	}
+
+	if (!error && (get_cr3 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_CR3, &cr3);
+		if (error == 0)
+			printf("cr3[%d]\t\t0x%016lx\n", vcpu, cr3);
+	}
+
+	if (!error && (get_cr4 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_CR4, &cr4);
+		if (error == 0)
+			printf("cr4[%d]\t\t0x%016lx\n", vcpu, cr4);
+	}
+
+	if (!error && (get_dr0 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_DR0, &dr0);
+		if (error == 0)
+			printf("dr0[%d]\t\t0x%016lx\n", vcpu, dr0);
+	}
+
+	if (!error && (get_dr1 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_DR1, &dr1);
+		if (error == 0)
+			printf("dr1[%d]\t\t0x%016lx\n", vcpu, dr1);
+	}
+
+	if (!error && (get_dr2 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_DR2, &dr2);
+		if (error == 0)
+			printf("dr2[%d]\t\t0x%016lx\n", vcpu, dr2);
+	}
+
+	if (!error && (get_dr3 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_DR3, &dr3);
+		if (error == 0)
+			printf("dr3[%d]\t\t0x%016lx\n", vcpu, dr3);
+	}
+
+	if (!error && (get_dr6 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_DR6, &dr6);
+		if (error == 0)
+			printf("dr6[%d]\t\t0x%016lx\n", vcpu, dr6);
+	}
+
+	if (!error && (get_dr7 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_DR7, &dr7);
+		if (error == 0)
+			printf("dr7[%d]\t\t0x%016lx\n", vcpu, dr7);
+	}
+
+	if (!error && (get_rsp || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RSP, &rsp);
+		if (error == 0)
+			printf("rsp[%d]\t\t0x%016lx\n", vcpu, rsp);
+	}
+
+	if (!error && (get_rip || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RIP, &rip);
+		if (error == 0)
+			printf("rip[%d]\t\t0x%016lx\n", vcpu, rip);
+	}
+
+	if (!error && (get_rax || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RAX, &rax);
+		if (error == 0)
+			printf("rax[%d]\t\t0x%016lx\n", vcpu, rax);
+	}
+
+	if (!error && (get_rbx || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RBX, &rbx);
+		if (error == 0)
+			printf("rbx[%d]\t\t0x%016lx\n", vcpu, rbx);
+	}
+
+	if (!error && (get_rcx || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RCX, &rcx);
+		if (error == 0)
+			printf("rcx[%d]\t\t0x%016lx\n", vcpu, rcx);
+	}
+
+	if (!error && (get_rdx || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RDX, &rdx);
+		if (error == 0)
+			printf("rdx[%d]\t\t0x%016lx\n", vcpu, rdx);
+	}
+
+	if (!error && (get_rsi || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RSI, &rsi);
+		if (error == 0)
+			printf("rsi[%d]\t\t0x%016lx\n", vcpu, rsi);
+	}
+
+	if (!error && (get_rdi || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RDI, &rdi);
+		if (error == 0)
+			printf("rdi[%d]\t\t0x%016lx\n", vcpu, rdi);
+	}
+
+	if (!error && (get_rbp || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RBP, &rbp);
+		if (error == 0)
+			printf("rbp[%d]\t\t0x%016lx\n", vcpu, rbp);
+	}
+
+	if (!error && (get_r8 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R8, &r8);
+		if (error == 0)
+			printf("r8[%d]\t\t0x%016lx\n", vcpu, r8);
+	}
+
+	if (!error && (get_r9 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R9, &r9);
+		if (error == 0)
+			printf("r9[%d]\t\t0x%016lx\n", vcpu, r9);
+	}
+
+	if (!error && (get_r10 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R10, &r10);
+		if (error == 0)
+			printf("r10[%d]\t\t0x%016lx\n", vcpu, r10);
+	}
+
+	if (!error && (get_r11 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R11, &r11);
+		if (error == 0)
+			printf("r11[%d]\t\t0x%016lx\n", vcpu, r11);
+	}
+
+	if (!error && (get_r12 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R12, &r12);
+		if (error == 0)
+			printf("r12[%d]\t\t0x%016lx\n", vcpu, r12);
+	}
+
+	if (!error && (get_r13 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R13, &r13);
+		if (error == 0)
+			printf("r13[%d]\t\t0x%016lx\n", vcpu, r13);
+	}
+
+	if (!error && (get_r14 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R14, &r14);
+		if (error == 0)
+			printf("r14[%d]\t\t0x%016lx\n", vcpu, r14);
+	}
+
+	if (!error && (get_r15 || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_R15, &r15);
+		if (error == 0)
+			printf("r15[%d]\t\t0x%016lx\n", vcpu, r15);
+	}
+
+	if (!error && (get_rflags || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_RFLAGS,
+					&rflags);
+		if (error == 0)
+			printf("rflags[%d]\t0x%016lx\n", vcpu, rflags);
+	}
+	
+	return (error);
+}
+
+static int
+get_all_segments(struct vmctx *ctx, int vcpu)
+{
+	uint64_t cs, ds, es, fs, gs, ss, tr, ldtr;
+	int error = 0;
+
+	if (!error && (get_desc_ds || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_DS,
+				   &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("ds desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			      vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_es || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_ES,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("es desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			       vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_fs || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_FS,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("fs desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			       vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_gs || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_GS,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("gs desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			       vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_ss || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_SS,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("ss desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			       vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_cs || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_CS,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("cs desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			       vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_tr || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_TR,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("tr desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			       vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_ldtr || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_LDTR,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("ldtr desc[%d]\t0x%016lx/0x%08x/0x%08x\n",
+			       vcpu, desc_base, desc_limit, desc_access);
+		}
+	}
+
+	if (!error && (get_desc_gdtr || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_GDTR,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("gdtr[%d]\t\t0x%016lx/0x%08x\n",
+			       vcpu, desc_base, desc_limit);
+		}
+	}
+
+	if (!error && (get_desc_idtr || get_all)) {
+		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_IDTR,
+				    &desc_base, &desc_limit, &desc_access);
+		if (error == 0) {
+			printf("idtr[%d]\t\t0x%016lx/0x%08x\n",
+			       vcpu, desc_base, desc_limit);
+		}
+	}
+
+	if (!error && (get_cs || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_CS, &cs);
+		if (error == 0)
+			printf("cs[%d]\t\t0x%04lx\n", vcpu, cs);
+	}
+
+	if (!error && (get_ds || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_DS, &ds);
+		if (error == 0)
+			printf("ds[%d]\t\t0x%04lx\n", vcpu, ds);
+	}
+
+	if (!error && (get_es || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_ES, &es);
+		if (error == 0)
+			printf("es[%d]\t\t0x%04lx\n", vcpu, es);
+	}
+
+	if (!error && (get_fs || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_FS, &fs);
+		if (error == 0)
+			printf("fs[%d]\t\t0x%04lx\n", vcpu, fs);
+	}
+
+	if (!error && (get_gs || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_GS, &gs);
+		if (error == 0)
+			printf("gs[%d]\t\t0x%04lx\n", vcpu, gs);
+	}
+
+	if (!error && (get_ss || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_SS, &ss);
+		if (error == 0)
+			printf("ss[%d]\t\t0x%04lx\n", vcpu, ss);
+	}
+
+	if (!error && (get_tr || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_TR, &tr);
+		if (error == 0)
+			printf("tr[%d]\t\t0x%04lx\n", vcpu, tr);
+	}
+
+	if (!error && (get_ldtr || get_all)) {
+		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_LDTR, &ldtr);
+		if (error == 0)
+			printf("ldtr[%d]\t\t0x%04lx\n", vcpu, ldtr);
+	}
+
+	return (error);
+}
+
+static int
+get_misc_vmcs(struct vmctx *ctx, int vcpu)
+{
+	uint64_t ctl, cr0, cr3, cr4, rsp, rip, pat, addr, u64;
+	int error = 0;
+
+	if (!error && (get_cr0_mask || get_all)) {
+		uint64_t cr0mask;
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR0_MASK, &cr0mask);
+		if (error == 0)
+			printf("cr0_mask[%d]\t\t0x%016lx\n", vcpu, cr0mask);
+	}
+
+	if (!error && (get_cr0_shadow || get_all)) {
+		uint64_t cr0shadow;
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR0_SHADOW,
+					  &cr0shadow);
+		if (error == 0)
+			printf("cr0_shadow[%d]\t\t0x%016lx\n", vcpu, cr0shadow);
+	}
+
+	if (!error && (get_cr4_mask || get_all)) {
+		uint64_t cr4mask;
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR4_MASK, &cr4mask);
+		if (error == 0)
+			printf("cr4_mask[%d]\t\t0x%016lx\n", vcpu, cr4mask);
+	}
+
+	if (!error && (get_cr4_shadow || get_all)) {
+		uint64_t cr4shadow;
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR4_SHADOW,
+					  &cr4shadow);
+		if (error == 0)
+			printf("cr4_shadow[%d]\t\t0x%016lx\n", vcpu, cr4shadow);
+	}
+	
+	if (!error && (get_cr3_targets || get_all)) {
+		uint64_t target_count, target_addr;
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR3_TARGET_COUNT,
+					  &target_count);
+		if (error == 0) {
+			printf("cr3_target_count[%d]\t0x%016lx\n",
+				vcpu, target_count);
+		}
+
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR3_TARGET0,
+					  &target_addr);
+		if (error == 0) {
+			printf("cr3_target0[%d]\t\t0x%016lx\n",
+				vcpu, target_addr);
+		}
+
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR3_TARGET1,
+					  &target_addr);
+		if (error == 0) {
+			printf("cr3_target1[%d]\t\t0x%016lx\n",
+				vcpu, target_addr);
+		}
+
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR3_TARGET2,
+					  &target_addr);
+		if (error == 0) {
+			printf("cr3_target2[%d]\t\t0x%016lx\n",
+				vcpu, target_addr);
+		}
+
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR3_TARGET3,
+					  &target_addr);
+		if (error == 0) {
+			printf("cr3_target3[%d]\t\t0x%016lx\n",
+				vcpu, target_addr);
+		}
+	}
+
+	if (!error && (get_pinbased_ctls || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_PIN_BASED_CTLS, &ctl);
+		if (error == 0)
+			printf("pinbased_ctls[%d]\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_procbased_ctls || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu,
+					  VMCS_PRI_PROC_BASED_CTLS, &ctl);
+		if (error == 0)
+			printf("procbased_ctls[%d]\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_procbased_ctls2 || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu,
+					  VMCS_SEC_PROC_BASED_CTLS, &ctl);
+		if (error == 0)
+			printf("procbased_ctls2[%d]\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_vmcs_gla || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu,
+					  VMCS_GUEST_LINEAR_ADDRESS, &u64);
+		if (error == 0)
+			printf("gla[%d]\t\t0x%016lx\n", vcpu, u64);
+	}
+
+	if (!error && (get_vmcs_gpa || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu,
+					  VMCS_GUEST_PHYSICAL_ADDRESS, &u64);
+		if (error == 0)
+			printf("gpa[%d]\t\t0x%016lx\n", vcpu, u64);
+	}
+
+	if (!error && (get_vmcs_entry_interruption_info || 
+		get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_ENTRY_INTR_INFO,&u64);
+		if (error == 0) {
+			printf("entry_interruption_info[%d]\t0x%016lx\n",
+				vcpu, u64);
+		}
+	}
+	
+	if (!error && (get_tpr_threshold || get_all)) {
+		uint64_t threshold;
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_TPR_THRESHOLD,
+					  &threshold);
+		if (error == 0)
+			printf("tpr_threshold[%d]\t0x%016lx\n", vcpu, threshold);
+	}
+
+	if (!error && (get_inst_err || get_all)) {
+		uint64_t insterr;
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_INSTRUCTION_ERROR,
+					  &insterr);
+		if (error == 0) {
+			printf("instruction_error[%d]\t0x%016lx\n",
+				vcpu, insterr);
+		}
+	}
+	
+	if (!error && (get_exit_ctls || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_EXIT_CTLS, &ctl);
+		if (error == 0)
+			printf("exit_ctls[%d]\t\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_entry_ctls || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_ENTRY_CTLS, &ctl);
+		if (error == 0)
+			printf("entry_ctls[%d]\t\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_host_pat || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_HOST_IA32_PAT, &pat);
+		if (error == 0)
+			printf("host_pat[%d]\t\t0x%016lx\n", vcpu, pat);
+	}
+
+	if (!error && (get_host_cr0 || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_HOST_CR0, &cr0);
+		if (error == 0)
+			printf("host_cr0[%d]\t\t0x%016lx\n", vcpu, cr0);
+	}
+
+	if (!error && (get_host_cr3 || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_HOST_CR3, &cr3);
+		if (error == 0)
+			printf("host_cr3[%d]\t\t0x%016lx\n", vcpu, cr3);
+	}
+
+	if (!error && (get_host_cr4 || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_HOST_CR4, &cr4);
+		if (error == 0)
+			printf("host_cr4[%d]\t\t0x%016lx\n", vcpu, cr4);
+	}
+
+	if (!error && (get_host_rip || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_HOST_RIP, &rip);
+		if (error == 0)
+			printf("host_rip[%d]\t\t0x%016lx\n", vcpu, rip);
+	}
+
+	if (!error && (get_host_rsp || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_HOST_RSP, &rsp);
+		if (error == 0)
+			printf("host_rsp[%d]\t\t0x%016lx\n", vcpu, rsp);
+	}
+	
+	if (!error && (get_vmcs_link || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_LINK_POINTER, &addr);
+		if (error == 0)
+			printf("vmcs_pointer[%d]\t0x%016lx\n", vcpu, addr);
+	}
+
+	if (!error && (get_vmcs_exit_interruption_info || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_EXIT_INTR_INFO, &u64);
+		if (error == 0) {
+			printf("vmcs_exit_interruption_info[%d]\t0x%016lx\n",
+				vcpu, u64);
+		}
+	}
+
+	if (!error && (get_vmcs_exit_interruption_error || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_EXIT_INTR_ERRCODE,
+		    			  &u64);
+		if (error == 0) {
+			printf("vmcs_exit_interruption_error[%d]\t0x%016lx\n",
+				vcpu, u64);
+		}
+	}
+
+	if (!error && (get_vmcs_interruptibility || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu,
+					  VMCS_GUEST_INTERRUPTIBILITY, &u64);
+		if (error == 0) {
+			printf("vmcs_guest_interruptibility[%d]\t0x%016lx\n",
+				vcpu, u64);
+		}
+	}
+
+	if (!error && (get_vmcs_exit_inst_length || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu,
+		    VMCS_EXIT_INSTRUCTION_LENGTH, &u64);
+		if (error == 0)
+			printf("vmcs_exit_inst_length[%d]\t0x%08x\n", vcpu,
+			    (uint32_t)u64);
+	}
+
+	if (!error && (get_vmcs_exit_qualification || get_all)) {
+		error = vm_get_vmcs_field(ctx, vcpu, VMCS_EXIT_QUALIFICATION,
+					  &u64);
+		if (error == 0)
+			printf("vmcs_exit_qualification[%d]\t0x%016lx\n",
+				vcpu, u64);
+	}
+	
+	return (error);
+}
+
+static int
+get_misc_vmcb(struct vmctx *ctx, int vcpu)
+{
+	uint64_t ctl, addr;
+	int error = 0;
+
+	if (!error && (get_vmcb_intercept || get_all)) {
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_CR_INTERCEPT, 4,
+		    &ctl);
+		if (error == 0)
+			printf("cr_intercept[%d]\t0x%08x\n", vcpu, (int)ctl);
+
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_DR_INTERCEPT, 4,
+		    &ctl);
+		if (error == 0)
+			printf("dr_intercept[%d]\t0x%08x\n", vcpu, (int)ctl);
+
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_EXC_INTERCEPT, 4,
+		    &ctl);
+		if (error == 0)
+			printf("exc_intercept[%d]\t0x%08x\n", vcpu, (int)ctl);
+
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_INST1_INTERCEPT,
+		    4, &ctl);
+		if (error == 0)
+			printf("inst1_intercept[%d]\t0x%08x\n", vcpu, (int)ctl);
+
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_INST2_INTERCEPT,
+		    4, &ctl);
+		if (error == 0)
+			printf("inst2_intercept[%d]\t0x%08x\n", vcpu, (int)ctl);
+	}
+
+	if (!error && (get_vmcb_tlb_ctrl || get_all)) {
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_TLB_CTRL,
+					  4, &ctl);
+		if (error == 0)
+			printf("TLB ctrl[%d]\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_vmcb_exit_details || get_all)) {
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_EXITINFO1,
+					  8, &ctl);
+		if (error == 0)
+			printf("exitinfo1[%d]\t0x%016lx\n", vcpu, ctl);
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_EXITINFO2,
+					  8, &ctl);
+		if (error == 0)
+			printf("exitinfo2[%d]\t0x%016lx\n", vcpu, ctl);
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_EXITINTINFO,
+					  8, &ctl);
+		if (error == 0)
+			printf("exitintinfo[%d]\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_vmcb_virq || get_all)) {
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_VIRQ,
+					  8, &ctl);
+		if (error == 0)
+			printf("v_irq/tpr[%d]\t0x%016lx\n", vcpu, ctl);
+	}
+
+	if (!error && (get_apic_access_addr || get_all)) {
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_AVIC_BAR, 8,
+					  &addr);
+		if (error == 0)
+			printf("AVIC apic_bar[%d]\t0x%016lx\n", vcpu, addr);
+	}
+
+	if (!error && (get_virtual_apic_addr || get_all)) {
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_AVIC_PAGE, 8,
+					  &addr);
+		if (error == 0)
+			printf("AVIC backing page[%d]\t0x%016lx\n", vcpu, addr);
+	}
+
+	if (!error && (get_avic_table || get_all)) {
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_AVIC_LT, 8,
+					  &addr);
+		if (error == 0)
+			printf("AVIC logical table[%d]\t0x%016lx\n",
+				vcpu, addr);
+		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_AVIC_PT, 8,
+					  &addr);
+		if (error == 0)
+			printf("AVIC physical table[%d]\t0x%016lx\n",
+				vcpu, addr);
+	}
+
+	return (error);
+}
+
+static struct option *
+setup_options(bool cpu_intel)
+{
+	const struct option common_opts[] = {
+		{ "vm",		REQ_ARG,	0,	VMNAME },
+		{ "cpu",	REQ_ARG,	0,	VCPU },
+		{ "set-mem",	REQ_ARG,	0,	SET_MEM },
+		{ "set-efer",	REQ_ARG,	0,	SET_EFER },
+		{ "set-cr0",	REQ_ARG,	0,	SET_CR0 },
+		{ "set-cr2",	REQ_ARG,	0,	SET_CR2 },
+		{ "set-cr3",	REQ_ARG,	0,	SET_CR3 },
+		{ "set-cr4",	REQ_ARG,	0,	SET_CR4 },
+		{ "set-dr0",	REQ_ARG,	0,	SET_DR0 },
+		{ "set-dr1",	REQ_ARG,	0,	SET_DR1 },
+		{ "set-dr2",	REQ_ARG,	0,	SET_DR2 },
+		{ "set-dr3",	REQ_ARG,	0,	SET_DR3 },
+		{ "set-dr6",	REQ_ARG,	0,	SET_DR6 },
+		{ "set-dr7",	REQ_ARG,	0,	SET_DR7 },
+		{ "set-rsp",	REQ_ARG,	0,	SET_RSP },
+		{ "set-rip",	REQ_ARG,	0,	SET_RIP },
+		{ "set-rax",	REQ_ARG,	0,	SET_RAX },
+		{ "set-rflags",	REQ_ARG,	0,	SET_RFLAGS },
+		{ "desc-base",	REQ_ARG,	0,	DESC_BASE },
+		{ "desc-limit",	REQ_ARG,	0,	DESC_LIMIT },
+		{ "desc-access",REQ_ARG,	0,	DESC_ACCESS },
+		{ "set-cs",	REQ_ARG,	0,	SET_CS },
+		{ "set-ds",	REQ_ARG,	0,	SET_DS },
+		{ "set-es",	REQ_ARG,	0,	SET_ES },
+		{ "set-fs",	REQ_ARG,	0,	SET_FS },
+		{ "set-gs",	REQ_ARG,	0,	SET_GS },
+		{ "set-ss",	REQ_ARG,	0,	SET_SS },
+		{ "set-tr",	REQ_ARG,	0,	SET_TR },
+		{ "set-ldtr",	REQ_ARG,	0,	SET_LDTR },
+		{ "set-x2apic-state",REQ_ARG,	0,	SET_X2APIC_STATE },
+		{ "set-exception-bitmap",
+				REQ_ARG,	0, SET_EXCEPTION_BITMAP },
+		{ "capname",	REQ_ARG,	0,	CAPNAME },
+		{ "unassign-pptdev", REQ_ARG,	0,	UNASSIGN_PPTDEV },
+		{ "setcap",	REQ_ARG,	0,	SET_CAP },
+		{ "get-gpa-pmap", REQ_ARG,	0,	GET_GPA_PMAP },
+		{ "assert-lapic-lvt", REQ_ARG,	0,	ASSERT_LAPIC_LVT },
+		{ "get-rtc-time", NO_ARG,	&get_rtc_time,	1 },
+		{ "set-rtc-time", REQ_ARG,	0,	SET_RTC_TIME },
+		{ "rtc-nvram-offset", REQ_ARG,	0,	RTC_NVRAM_OFFSET },
+		{ "get-rtc-nvram", NO_ARG,	&get_rtc_nvram,	1 },
+		{ "set-rtc-nvram", REQ_ARG,	0,	SET_RTC_NVRAM },
+		{ "getcap",	NO_ARG,		&getcap,	1 },
+		{ "get-stats",	NO_ARG,		&get_stats,	1 },
+		{ "get-desc-ds",NO_ARG,		&get_desc_ds,	1 },
+		{ "set-desc-ds",NO_ARG,		&set_desc_ds,	1 },
+		{ "get-desc-es",NO_ARG,		&get_desc_es,	1 },
+		{ "set-desc-es",NO_ARG,		&set_desc_es,	1 },
+		{ "get-desc-ss",NO_ARG,		&get_desc_ss,	1 },
+		{ "set-desc-ss",NO_ARG,		&set_desc_ss,	1 },
+		{ "get-desc-cs",NO_ARG,		&get_desc_cs,	1 },
+		{ "set-desc-cs",NO_ARG,		&set_desc_cs,	1 },
+		{ "get-desc-fs",NO_ARG,		&get_desc_fs,	1 },
+		{ "set-desc-fs",NO_ARG,		&set_desc_fs,	1 },
+		{ "get-desc-gs",NO_ARG,		&get_desc_gs,	1 },
+		{ "set-desc-gs",NO_ARG,		&set_desc_gs,	1 },
+		{ "get-desc-tr",NO_ARG,		&get_desc_tr,	1 },
+		{ "set-desc-tr",NO_ARG,		&set_desc_tr,	1 },
+		{ "set-desc-ldtr", NO_ARG,	&set_desc_ldtr,	1 },
+		{ "get-desc-ldtr", NO_ARG,	&get_desc_ldtr,	1 },
+		{ "set-desc-gdtr", NO_ARG,	&set_desc_gdtr, 1 },
+		{ "get-desc-gdtr", NO_ARG,	&get_desc_gdtr, 1 },
+		{ "set-desc-idtr", NO_ARG,	&set_desc_idtr, 1 },
+		{ "get-desc-idtr", NO_ARG,	&get_desc_idtr, 1 },
+		{ "get-memmap",	NO_ARG,		&get_memmap,	1 },
+		{ "get-memseg", NO_ARG,		&get_memseg,	1 },
+		{ "get-efer",	NO_ARG,		&get_efer,	1 },
+		{ "get-cr0",	NO_ARG,		&get_cr0,	1 },
+		{ "get-cr2",	NO_ARG,		&get_cr2,	1 },
+		{ "get-cr3",	NO_ARG,		&get_cr3,	1 },
+		{ "get-cr4",	NO_ARG,		&get_cr4,	1 },
+		{ "get-dr0",	NO_ARG,		&get_dr0,	1 },
+		{ "get-dr1",	NO_ARG,		&get_dr1,	1 },
+		{ "get-dr2",	NO_ARG,		&get_dr2,	1 },
+		{ "get-dr3",	NO_ARG,		&get_dr3,	1 },
+		{ "get-dr6",	NO_ARG,		&get_dr6,	1 },
+		{ "get-dr7",	NO_ARG,		&get_dr7,	1 },
+		{ "get-rsp",	NO_ARG,		&get_rsp,	1 },
+		{ "get-rip",	NO_ARG,		&get_rip,	1 },
+		{ "get-rax",	NO_ARG,		&get_rax,	1 },
+		{ "get-rbx",	NO_ARG,		&get_rbx,	1 },
+		{ "get-rcx",	NO_ARG,		&get_rcx,	1 },
+		{ "get-rdx",	NO_ARG,		&get_rdx,	1 },
+		{ "get-rsi",	NO_ARG,		&get_rsi,	1 },
+		{ "get-rdi",	NO_ARG,		&get_rdi,	1 },
+		{ "get-rbp",	NO_ARG,		&get_rbp,	1 },
+		{ "get-r8",	NO_ARG,		&get_r8,	1 },
+		{ "get-r9",	NO_ARG,		&get_r9,	1 },
+		{ "get-r10",	NO_ARG,		&get_r10,	1 },
+		{ "get-r11",	NO_ARG,		&get_r11,	1 },
+		{ "get-r12",	NO_ARG,		&get_r12,	1 },
+		{ "get-r13",	NO_ARG,		&get_r13,	1 },
+		{ "get-r14",	NO_ARG,		&get_r14,	1 },
+		{ "get-r15",	NO_ARG,		&get_r15,	1 },
+		{ "get-rflags",	NO_ARG,		&get_rflags,	1 },
+		{ "get-cs",	NO_ARG,		&get_cs,	1 },
+		{ "get-ds",	NO_ARG,		&get_ds,	1 },
+		{ "get-es",	NO_ARG,		&get_es,	1 },
+		{ "get-fs",	NO_ARG,		&get_fs,	1 },
+		{ "get-gs",	NO_ARG,		&get_gs,	1 },
+		{ "get-ss",	NO_ARG,		&get_ss,	1 },
+		{ "get-tr",	NO_ARG,		&get_tr,	1 },
+		{ "get-ldtr",	NO_ARG,		&get_ldtr,	1 },
+		{ "get-eptp", 	NO_ARG,		&get_eptp,	1 },
+		{ "get-exception-bitmap",
+					NO_ARG,	&get_exception_bitmap,  1 },
+		{ "get-io-bitmap-address",
+					NO_ARG,	&get_io_bitmap,		1 },
+		{ "get-tsc-offset", 	NO_ARG, &get_tsc_offset, 	1 },
+		{ "get-msr-bitmap",
+					NO_ARG,	&get_msr_bitmap, 	1 },
+		{ "get-msr-bitmap-address",
+					NO_ARG,	&get_msr_bitmap_address, 1 },
+		{ "get-guest-pat",	NO_ARG,	&get_guest_pat,		1 },
+		{ "get-guest-sysenter",
+					NO_ARG,	&get_guest_sysenter, 	1 },
+		{ "get-exit-reason",
+					NO_ARG,	&get_exit_reason, 	1 },
+		{ "get-x2apic-state",	NO_ARG,	&get_x2apic_state, 	1 },
+		{ "get-all",		NO_ARG,	&get_all,		1 },
+		{ "run",		NO_ARG,	&run,			1 },
+		{ "create",		NO_ARG,	&create,		1 },
+		{ "destroy",		NO_ARG,	&destroy,		1 },
+		{ "inject-nmi",		NO_ARG,	&inject_nmi,		1 },
+		{ "force-reset",	NO_ARG,	&force_reset,		1 },
+		{ "force-poweroff", 	NO_ARG,	&force_poweroff, 	1 },
+		{ "get-active-cpus", 	NO_ARG,	&get_active_cpus, 	1 },
+		{ "get-suspended-cpus", NO_ARG,	&get_suspended_cpus, 	1 },
+		{ "get-intinfo", 	NO_ARG,	&get_intinfo,		1 },
+		{ "get-cpu-topology",	NO_ARG, &get_cpu_topology,	1 },
+	};
+
+	const struct option intel_opts[] = {
+		{ "get-vmcs-pinbased-ctls",
+				NO_ARG,		&get_pinbased_ctls, 1 },
+		{ "get-vmcs-procbased-ctls",
+				NO_ARG,		&get_procbased_ctls, 1 },
+		{ "get-vmcs-procbased-ctls2",
+				NO_ARG,		&get_procbased_ctls2, 1 },
+		{ "get-vmcs-guest-linear-address",
+				NO_ARG,		&get_vmcs_gla,	1 },
+		{ "get-vmcs-guest-physical-address",
+				NO_ARG,		&get_vmcs_gpa,	1 },
+		{ "get-vmcs-entry-interruption-info",
+				NO_ARG, &get_vmcs_entry_interruption_info, 1},
+		{ "get-vmcs-cr0-mask", NO_ARG,	&get_cr0_mask,	1 },
+		{ "get-vmcs-cr0-shadow", NO_ARG,&get_cr0_shadow, 1 },
+		{ "get-vmcs-cr4-mask", 		NO_ARG,	&get_cr4_mask,	  1 },
+		{ "get-vmcs-cr4-shadow", 	NO_ARG, &get_cr4_shadow,  1 },
+		{ "get-vmcs-cr3-targets", 	NO_ARG, &get_cr3_targets, 1 },
+		{ "get-vmcs-tpr-threshold",
+					NO_ARG,	&get_tpr_threshold, 1 },
+		{ "get-vmcs-vpid", 	NO_ARG,	&get_vpid_asid,	    1 },
+		{ "get-vmcs-exit-ctls", NO_ARG,	&get_exit_ctls,	    1 },
+		{ "get-vmcs-entry-ctls",
+					NO_ARG,	&get_entry_ctls, 1 },
+		{ "get-vmcs-instruction-error",
+					NO_ARG,	&get_inst_err,	1 },
+		{ "get-vmcs-host-pat",	NO_ARG,	&get_host_pat,	1 },
+		{ "get-vmcs-host-cr0",
+					NO_ARG,	&get_host_cr0,	1 },
+		{ "set-vmcs-entry-interruption-info",
+				REQ_ARG, 0, SET_VMCS_ENTRY_INTERRUPTION_INFO },
+		{ "get-vmcs-exit-qualification",
+				NO_ARG,	&get_vmcs_exit_qualification, 1 },
+		{ "get-vmcs-exit-inst-length",
+				NO_ARG,	&get_vmcs_exit_inst_length, 1 },
+		{ "get-vmcs-interruptibility",
+				NO_ARG, &get_vmcs_interruptibility, 1 },
+		{ "get-vmcs-exit-interruption-error",
+				NO_ARG,	&get_vmcs_exit_interruption_error, 1 },
+		{ "get-vmcs-exit-interruption-info",
+				NO_ARG,	&get_vmcs_exit_interruption_info, 1 },
+		{ "get-vmcs-link", 	NO_ARG,		&get_vmcs_link, 1 },
+		{ "get-vmcs-host-cr3",
+					NO_ARG,		&get_host_cr3,	1 },
+		{ "get-vmcs-host-cr4",
+				NO_ARG,		&get_host_cr4,	1 },
+		{ "get-vmcs-host-rip",
+				NO_ARG,		&get_host_rip,	1 },
+		{ "get-vmcs-host-rsp",
+				NO_ARG,		&get_host_rsp,	1 },
+		{ "get-apic-access-address",
+				NO_ARG,		&get_apic_access_addr, 1},
+		{ "get-virtual-apic-address",
+				NO_ARG,		&get_virtual_apic_addr, 1}
+	};
+
+	const struct option amd_opts[] = {
+		{ "get-vmcb-intercepts",
+				NO_ARG,	&get_vmcb_intercept, 	1 },
+		{ "get-vmcb-asid", 
+				NO_ARG,	&get_vpid_asid,	     	1 },
+		{ "get-vmcb-exit-details",
+				NO_ARG, &get_vmcb_exit_details,	1 },
+		{ "get-vmcb-tlb-ctrl",
+				NO_ARG, &get_vmcb_tlb_ctrl, 	1 },
+		{ "get-vmcb-virq",
+				NO_ARG, &get_vmcb_virq, 	1 },
+		{ "get-avic-apic-bar",
+				NO_ARG,	&get_apic_access_addr, 	1 },
+		{ "get-avic-backing-page",
+				NO_ARG,	&get_virtual_apic_addr, 1 },
+		{ "get-avic-table",
+				NO_ARG,	&get_avic_table, 	1 }
+	};
+
+	const struct option null_opt = {
+		NULL, 0, NULL, 0
+	};
+
+	struct option *all_opts;
+	char *cp;
+	int optlen;
+
+	optlen = sizeof(common_opts);
+
+	if (cpu_intel)
+		optlen += sizeof(intel_opts);
+	else
+		optlen += sizeof(amd_opts);
+
+	optlen += sizeof(null_opt);
+
+	all_opts = malloc(optlen);
+
+	cp = (char *)all_opts;
+	memcpy(cp, common_opts, sizeof(common_opts));
+	cp += sizeof(common_opts);
+
+	if (cpu_intel) {
+		memcpy(cp, intel_opts, sizeof(intel_opts));
+		cp += sizeof(intel_opts);
+	} else {
+		memcpy(cp, amd_opts, sizeof(amd_opts));
+		cp += sizeof(amd_opts);
+	}
+
+	memcpy(cp, &null_opt, sizeof(null_opt));
+	cp += sizeof(null_opt);
+
+	return (all_opts);
+}
+
+static const char *
+wday_str(int idx)
+{
+	static const char *weekdays[] = {
+		"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
+	};
+
+	if (idx >= 0 && idx < 7)
+		return (weekdays[idx]);
+	else
+		return ("UNK");
+}
+
+static const char *
+mon_str(int idx)
+{
+	static const char *months[] = {
+		"Jan", "Feb", "Mar", "Apr", "May", "Jun",
+		"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
+	};
+
+	if (idx >= 0 && idx < 12)
+		return (months[idx]);
+	else
+		return ("UNK");
+}
+
+static int
+show_memmap(struct vmctx *ctx)
+{
+	char name[SPECNAMELEN + 1], numbuf[8];
+	vm_ooffset_t segoff;
+	vm_paddr_t gpa;
+	size_t maplen, seglen;
+	int error, flags, prot, segid, delim;
+
+	printf("Address     Length      Segment     Offset      ");
+	printf("Prot  Flags\n");
+
+	gpa = 0;
+	while (1) {
+		error = vm_mmap_getnext(ctx, &gpa, &segid, &segoff, &maplen,
+		    &prot, &flags);
+		if (error)
+			return (errno == ENOENT ? 0 : error);
+
+		error = vm_get_memseg(ctx, segid, &seglen, name, sizeof(name));
+		if (error)
+			return (error);
+
+		printf("%-12lX", gpa);
+		humanize_number(numbuf, sizeof(numbuf), maplen, "B",
+		    HN_AUTOSCALE, HN_NOSPACE);
+		printf("%-12s", numbuf);
+
+		printf("%-12s", name[0] ? name : "sysmem");
+		printf("%-12lX", segoff);
+		printf("%c%c%c   ", prot & PROT_READ ? 'R' : '-',
+		    prot & PROT_WRITE ? 'W' : '-',
+		    prot & PROT_EXEC ? 'X' : '-');
+
+		delim = '\0';
+		if (flags & VM_MEMMAP_F_WIRED) {
+			printf("%cwired", delim);
+			delim = '/';
+		}
+		if (flags & VM_MEMMAP_F_IOMMU) {
+			printf("%ciommu", delim);
+			delim = '/';
+		}
+		printf("\n");
+
+		gpa += maplen;
+	}
+}
+
+static int
+show_memseg(struct vmctx *ctx)
+{
+	char name[SPECNAMELEN + 1], numbuf[8];
+	size_t seglen;
+	int error, segid;
+
+	printf("ID  Length      Name\n");
+
+	segid = 0;
+	while (1) {
+		error = vm_get_memseg(ctx, segid, &seglen, name, sizeof(name));
+		if (error)
+			return (errno == EINVAL ? 0 : error);
+
+		if (seglen) {
+			printf("%-4d", segid);
+			humanize_number(numbuf, sizeof(numbuf), seglen, "B",
+			    HN_AUTOSCALE, HN_NOSPACE);
+			printf("%-12s", numbuf);
+			printf("%s", name[0] ? name : "sysmem");
+			printf("\n");
+		}
+		segid++;
+	}
+}
+
+int
+main(int argc, char *argv[])
+{
+	char *vmname;
+	int error, ch, vcpu, ptenum;
+	vm_paddr_t gpa_pmap;
+	struct vm_exit vmexit;
+	uint64_t rax, cr0, cr2, cr3, cr4, dr0, dr1, dr2, dr3, dr6, dr7;
+	uint64_t rsp, rip, rflags, efer, pat;
+	uint64_t eptp, bm, addr, u64, pteval[4], *pte, info[2];
+	struct vmctx *ctx;
+	cpuset_t cpus;
+	bool cpu_intel;
+	uint64_t cs, ds, es, fs, gs, ss, tr, ldtr;
+	struct tm tm;
+	struct option *opts;
+
+	cpu_intel = cpu_vendor_intel();
+	opts = setup_options(cpu_intel);
+
+	vcpu = 0;
+	vmname = NULL;
+	assert_lapic_lvt = -1;
+	progname = basename(argv[0]);
+
+	while ((ch = getopt_long(argc, argv, "", opts, NULL)) != -1) {
+		switch (ch) {
+		case 0:
+			break;
+		case VMNAME:
+			vmname = optarg;
+			break;
+		case VCPU:
+			vcpu = atoi(optarg);
+			break;
+		case SET_MEM:
+			memsize = atoi(optarg) * MB;
+			memsize = roundup(memsize, 2 * MB);
+			break;
+		case SET_EFER:
+			efer = strtoul(optarg, NULL, 0);
+			set_efer = 1;
+			break;
+		case SET_CR0:
+			cr0 = strtoul(optarg, NULL, 0);
+			set_cr0 = 1;
+			break;
+		case SET_CR2:
+			cr2 = strtoul(optarg, NULL, 0);
+			set_cr2 = 1;
+			break;
+		case SET_CR3:
+			cr3 = strtoul(optarg, NULL, 0);
+			set_cr3 = 1;
+			break;
+		case SET_CR4:
+			cr4 = strtoul(optarg, NULL, 0);
+			set_cr4 = 1;
+			break;
+		case SET_DR0:
+			dr0 = strtoul(optarg, NULL, 0);
+			set_dr0 = 1;
+			break;
+		case SET_DR1:
+			dr1 = strtoul(optarg, NULL, 0);
+			set_dr1 = 1;
+			break;
+		case SET_DR2:
+			dr2 = strtoul(optarg, NULL, 0);
+			set_dr2 = 1;
+			break;
+		case SET_DR3:
+			dr3 = strtoul(optarg, NULL, 0);
+			set_dr3 = 1;
+			break;
+		case SET_DR6:
+			dr6 = strtoul(optarg, NULL, 0);
+			set_dr6 = 1;
+			break;
+		case SET_DR7:
+			dr7 = strtoul(optarg, NULL, 0);
+			set_dr7 = 1;
+			break;
+		case SET_RSP:
+			rsp = strtoul(optarg, NULL, 0);
+			set_rsp = 1;
+			break;
+		case SET_RIP:
+			rip = strtoul(optarg, NULL, 0);
+			set_rip = 1;
+			break;
+		case SET_RAX:
+			rax = strtoul(optarg, NULL, 0);
+			set_rax = 1;
+			break;
+		case SET_RFLAGS:
+			rflags = strtoul(optarg, NULL, 0);
+			set_rflags = 1;
+			break;
+		case DESC_BASE:
+			desc_base = strtoul(optarg, NULL, 0);
+			break;
+		case DESC_LIMIT:
+			desc_limit = strtoul(optarg, NULL, 0);
+			break;
+		case DESC_ACCESS:
+			desc_access = strtoul(optarg, NULL, 0);
+			break;
+		case SET_CS:
+			cs = strtoul(optarg, NULL, 0);
+			set_cs = 1;
+			break;
+		case SET_DS:
+			ds = strtoul(optarg, NULL, 0);
+			set_ds = 1;
+			break;
+		case SET_ES:
+			es = strtoul(optarg, NULL, 0);
+			set_es = 1;
+			break;
+		case SET_FS:
+			fs = strtoul(optarg, NULL, 0);
+			set_fs = 1;
+			break;
+		case SET_GS:
+			gs = strtoul(optarg, NULL, 0);
+			set_gs = 1;
+			break;
+		case SET_SS:
+			ss = strtoul(optarg, NULL, 0);
+			set_ss = 1;
+			break;
+		case SET_TR:
+			tr = strtoul(optarg, NULL, 0);
+			set_tr = 1;
+			break;
+		case SET_LDTR:
+			ldtr = strtoul(optarg, NULL, 0);
+			set_ldtr = 1;
+			break;
+		case SET_X2APIC_STATE:
+			x2apic_state = strtol(optarg, NULL, 0);
+			set_x2apic_state = 1;
+			break;
+		case SET_EXCEPTION_BITMAP:
+			exception_bitmap = strtoul(optarg, NULL, 0);
+			set_exception_bitmap = 1;
+			break;
+		case SET_VMCS_ENTRY_INTERRUPTION_INFO:
+			vmcs_entry_interruption_info = strtoul(optarg, NULL, 0);
+			set_vmcs_entry_interruption_info = 1;
+			break;
+		case SET_CAP:
+			capval = strtoul(optarg, NULL, 0);
+			setcap = 1;
+			break;
+		case SET_RTC_TIME:
+			rtc_secs = strtoul(optarg, NULL, 0);
+			set_rtc_time = 1;
+			break;
+		case SET_RTC_NVRAM:
+			rtc_nvram_value = (uint8_t)strtoul(optarg, NULL, 0);
+			set_rtc_nvram = 1;
+			break;
+		case RTC_NVRAM_OFFSET:
+			rtc_nvram_offset = strtoul(optarg, NULL, 0);
+			break;
+		case GET_GPA_PMAP:
+			gpa_pmap = strtoul(optarg, NULL, 0);
+			get_gpa_pmap = 1;
+			break;
+		case CAPNAME:
+			capname = optarg;
+			break;
+#ifdef __FreeBSD__
+		case UNASSIGN_PPTDEV:
+			unassign_pptdev = 1;
+			if (sscanf(optarg, "%d/%d/%d", &bus, &slot, &func) != 3)
+				usage(cpu_intel);
+			break;
+#endif
+		case ASSERT_LAPIC_LVT:
+			assert_lapic_lvt = atoi(optarg);
+			break;
+		default:
+			usage(cpu_intel);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if (vmname == NULL)
+		usage(cpu_intel);
+
+	error = 0;
+
+	if (!error && create)
+		error = vm_create(vmname);
+
+	if (!error) {
+		ctx = vm_open(vmname);
+		if (ctx == NULL) {
+			printf("VM:%s is not created.\n", vmname);
+			exit (1);
+		}
+	}
+
+	if (!error && memsize)
+		error = vm_setup_memory(ctx, memsize, VM_MMAP_ALL);
+
+	if (!error && set_efer)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_EFER, efer);
+
+	if (!error && set_cr0)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_CR0, cr0);
+
+	if (!error && set_cr2)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_CR2, cr2);
+
+	if (!error && set_cr3)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_CR3, cr3);
+
+	if (!error && set_cr4)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_CR4, cr4);
+
+	if (!error && set_dr0)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_DR0, dr0);
+
+	if (!error && set_dr1)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_DR1, dr1);
+
+	if (!error && set_dr2)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_DR2, dr2);
+
+	if (!error && set_dr3)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_DR3, dr3);
+
+	if (!error && set_dr6)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_DR6, dr6);
+
+	if (!error && set_dr7)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_DR7, dr7);
+
+	if (!error && set_rsp)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_RSP, rsp);
+
+	if (!error && set_rip)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_RIP, rip);
+
+	if (!error && set_rax)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_RAX, rax);
+
+	if (!error && set_rflags) {
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_RFLAGS,
+					rflags);
+	}
+
+	if (!error && set_desc_ds) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_DS,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_es) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_ES,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_ss) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_SS,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_cs) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_CS,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_fs) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_FS,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_gs) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_GS,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_tr) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_TR,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_ldtr) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_LDTR,
+				    desc_base, desc_limit, desc_access);
+	}
+
+	if (!error && set_desc_gdtr) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_GDTR,
+				    desc_base, desc_limit, 0);
+	}
+
+	if (!error && set_desc_idtr) {
+		error = vm_set_desc(ctx, vcpu, VM_REG_GUEST_IDTR,
+				    desc_base, desc_limit, 0);
+	}
+
+	if (!error && set_cs)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_CS, cs);
+
+	if (!error && set_ds)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_DS, ds);
+
+	if (!error && set_es)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_ES, es);
+
+	if (!error && set_fs)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_FS, fs);
+
+	if (!error && set_gs)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_GS, gs);
+
+	if (!error && set_ss)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_SS, ss);
+
+	if (!error && set_tr)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_TR, tr);
+
+	if (!error && set_ldtr)
+		error = vm_set_register(ctx, vcpu, VM_REG_GUEST_LDTR, ldtr);
+
+	if (!error && set_x2apic_state)
+		error = vm_set_x2apic_state(ctx, vcpu, x2apic_state);
+
+#ifdef __FreeBSD__
+	if (!error && unassign_pptdev)
+		error = vm_unassign_pptdev(ctx, bus, slot, func);
+#endif /* __FreeBSD__ */
+
+	if (!error && set_exception_bitmap) {
+		if (cpu_intel)
+			error = vm_set_vmcs_field(ctx, vcpu,
+						  VMCS_EXCEPTION_BITMAP,
+						  exception_bitmap);
+		else
+			error = vm_set_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_EXC_INTERCEPT,
+						  4, exception_bitmap);
+	}
+
+	if (!error && cpu_intel && set_vmcs_entry_interruption_info) {
+		error = vm_set_vmcs_field(ctx, vcpu, VMCS_ENTRY_INTR_INFO,
+					  vmcs_entry_interruption_info);
+	}
+
+	if (!error && inject_nmi) {
+		error = vm_inject_nmi(ctx, vcpu);
+	}
+
+	if (!error && assert_lapic_lvt != -1) {
+		error = vm_lapic_local_irq(ctx, vcpu, assert_lapic_lvt);
+	}
+
+	if (!error && (get_memseg || get_all))
+		error = show_memseg(ctx);
+
+	if (!error && (get_memmap || get_all))
+		error = show_memmap(ctx);
+
+	if (!error)
+		error = get_all_registers(ctx, vcpu);
+
+	if (!error)
+		error = get_all_segments(ctx, vcpu);
+
+	if (!error) {
+		if (cpu_intel)
+			error = get_misc_vmcs(ctx, vcpu);
+		else
+			error = get_misc_vmcb(ctx, vcpu);
+	}
+	
+	if (!error && (get_x2apic_state || get_all)) {
+		error = vm_get_x2apic_state(ctx, vcpu, &x2apic_state);
+		if (error == 0)
+			printf("x2apic_state[%d]\t%d\n", vcpu, x2apic_state);
+	}
+
+	if (!error && (get_eptp || get_all)) {
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu, VMCS_EPTP, &eptp);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_NPT_BASE,
+						   8, &eptp);
+		if (error == 0)
+			printf("%s[%d]\t\t0x%016lx\n",
+				cpu_intel ? "eptp" : "rvi/npt", vcpu, eptp);
+	}
+
+	if (!error && (get_exception_bitmap || get_all)) {
+		if(cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu,
+						VMCS_EXCEPTION_BITMAP, &bm);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_EXC_INTERCEPT,
+						  4, &bm);
+		if (error == 0)
+			printf("exception_bitmap[%d]\t%#lx\n", vcpu, bm);
+	}
+
+	if (!error && (get_io_bitmap || get_all)) {
+		if (cpu_intel) {
+			error = vm_get_vmcs_field(ctx, vcpu, VMCS_IO_BITMAP_A,
+						  &bm);
+			if (error == 0)
+				printf("io_bitmap_a[%d]\t%#lx\n", vcpu, bm);
+			error = vm_get_vmcs_field(ctx, vcpu, VMCS_IO_BITMAP_B,
+						  &bm);
+			if (error == 0)
+				printf("io_bitmap_b[%d]\t%#lx\n", vcpu, bm);
+		} else {
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_IO_PERM, 8, &bm);
+			if (error == 0)
+				printf("io_bitmap[%d]\t%#lx\n", vcpu, bm);
+		}
+	}
+
+	if (!error && (get_tsc_offset || get_all)) {
+		uint64_t tscoff;
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu, VMCS_TSC_OFFSET,
+						  &tscoff);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_TSC_OFFSET, 
+						  8, &tscoff);
+		if (error == 0)
+			printf("tsc_offset[%d]\t0x%016lx\n", vcpu, tscoff);
+	}
+
+	if (!error && (get_msr_bitmap_address || get_all)) {
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu, VMCS_MSR_BITMAP, 
+						  &addr);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_MSR_PERM, 8, &addr);
+		if (error == 0)
+			printf("msr_bitmap[%d]\t\t%#lx\n", vcpu, addr);
+	}
+
+	if (!error && (get_msr_bitmap || get_all)) {
+		if (cpu_intel) {
+			error = vm_get_vmcs_field(ctx, vcpu, 
+						  VMCS_MSR_BITMAP, &addr);
+		} else {
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_MSR_PERM, 8,
+						  &addr);
+		}
+
+		if (error == 0)
+			error = dump_msr_bitmap(vcpu, addr, cpu_intel);
+	}
+
+	if (!error && (get_vpid_asid || get_all)) {
+		uint64_t vpid;
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu, VMCS_VPID, &vpid);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_ASID, 
+						  4, &vpid);
+		if (error == 0)
+			printf("%s[%d]\t\t0x%04lx\n", 
+				cpu_intel ? "vpid" : "asid", vcpu, vpid);
+	}
+
+	if (!error && (get_guest_pat || get_all)) {
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu,
+						  VMCS_GUEST_IA32_PAT, &pat);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_GUEST_PAT, 8, &pat);
+		if (error == 0)
+			printf("guest_pat[%d]\t\t0x%016lx\n", vcpu, pat);
+	}
+
+	if (!error && (get_guest_sysenter || get_all)) {
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu,
+						  VMCS_GUEST_IA32_SYSENTER_CS,
+						  &cs);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_SYSENTER_CS, 8,
+						  &cs);
+
+		if (error == 0)
+			printf("guest_sysenter_cs[%d]\t%#lx\n", vcpu, cs);
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu,
+						  VMCS_GUEST_IA32_SYSENTER_ESP,
+						  &rsp);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_SYSENTER_ESP, 8,
+						  &rsp);
+
+		if (error == 0)
+			printf("guest_sysenter_sp[%d]\t%#lx\n", vcpu, rsp);
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu,
+						  VMCS_GUEST_IA32_SYSENTER_EIP,
+						  &rip);
+		else
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_SYSENTER_EIP, 8, 
+						  &rip);
+		if (error == 0)
+			printf("guest_sysenter_ip[%d]\t%#lx\n", vcpu, rip);
+	}
+
+	if (!error && (get_exit_reason || get_all)) {
+		if (cpu_intel)
+			error = vm_get_vmcs_field(ctx, vcpu, VMCS_EXIT_REASON,
+						  &u64);
+		else	
+			error = vm_get_vmcb_field(ctx, vcpu,
+						  VMCB_OFF_EXIT_REASON, 8,
+						  &u64);
+		if (error == 0)
+			printf("exit_reason[%d]\t%#lx\n", vcpu, u64);
+	}
+
+	if (!error && setcap) {
+		int captype;
+		captype = vm_capability_name2type(capname);
+		error = vm_set_capability(ctx, vcpu, captype, capval);
+		if (error != 0 && errno == ENOENT)
+			printf("Capability \"%s\" is not available\n", capname);
+	}
+
+	if (!error && get_gpa_pmap) {
+		error = vm_get_gpa_pmap(ctx, gpa_pmap, pteval, &ptenum);
+		if (error == 0) {
+			printf("gpa %#lx:", gpa_pmap);
+			pte = &pteval[0];
+			while (ptenum-- > 0)
+				printf(" %#lx", *pte++);
+			printf("\n");
+		}
+	}
+
+	if (!error && set_rtc_nvram)
+		error = vm_rtc_write(ctx, rtc_nvram_offset, rtc_nvram_value);
+
+	if (!error && (get_rtc_nvram || get_all)) {
+		error = vm_rtc_read(ctx, rtc_nvram_offset, &rtc_nvram_value);
+		if (error == 0) {
+			printf("rtc nvram[%03d]: 0x%02x\n", rtc_nvram_offset,
+			    rtc_nvram_value);
+		}
+	}
+
+	if (!error && set_rtc_time)
+		error = vm_rtc_settime(ctx, rtc_secs);
+
+	if (!error && (get_rtc_time || get_all)) {
+		error = vm_rtc_gettime(ctx, &rtc_secs);
+		if (error == 0) {
+			gmtime_r(&rtc_secs, &tm);
+			printf("rtc time %#lx: %s %s %02d %02d:%02d:%02d %d\n",
+			    rtc_secs, wday_str(tm.tm_wday), mon_str(tm.tm_mon),
+			    tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec,
+			    1900 + tm.tm_year);
+		}
+	}
+
+	if (!error && (getcap || get_all)) {
+		int captype, val, getcaptype;
+
+		if (getcap && capname)
+			getcaptype = vm_capability_name2type(capname);
+		else
+			getcaptype = -1;
+
+		for (captype = 0; captype < VM_CAP_MAX; captype++) {
+			if (getcaptype >= 0 && captype != getcaptype)
+				continue;
+			error = vm_get_capability(ctx, vcpu, captype, &val);
+			if (error == 0) {
+				printf("Capability \"%s\" is %s on vcpu %d\n",
+					vm_capability_type2name(captype),
+					val ? "set" : "not set", vcpu);
+			} else if (errno == ENOENT) {
+				error = 0;
+				printf("Capability \"%s\" is not available\n",
+					vm_capability_type2name(captype));
+			} else {
+				break;
+			}
+		}
+	}
+
+	if (!error && (get_active_cpus || get_all)) {
+		error = vm_active_cpus(ctx, &cpus);
+		if (!error)
+			print_cpus("active cpus", &cpus);
+	}
+
+	if (!error && (get_suspended_cpus || get_all)) {
+		error = vm_suspended_cpus(ctx, &cpus);
+		if (!error)
+			print_cpus("suspended cpus", &cpus);
+	}
+
+	if (!error && (get_intinfo || get_all)) {
+		error = vm_get_intinfo(ctx, vcpu, &info[0], &info[1]);
+		if (!error) {
+			print_intinfo("pending", info[0]);
+			print_intinfo("current", info[1]);
+		}
+	}
+
+	if (!error && (get_stats || get_all)) {
+		int i, num_stats;
+		uint64_t *stats;
+		struct timeval tv;
+		const char *desc;
+
+		stats = vm_get_stats(ctx, vcpu, &tv, &num_stats);
+		if (stats != NULL) {
+			printf("vcpu%d stats:\n", vcpu);
+			for (i = 0; i < num_stats; i++) {
+				desc = vm_get_stat_desc(ctx, i);
+				printf("%-40s\t%ld\n", desc, stats[i]);
+			}
+		}
+	}
+
+	if (!error && (get_cpu_topology || get_all)) {
+		uint16_t sockets, cores, threads, maxcpus;
+
+		vm_get_topology(ctx, &sockets, &cores, &threads, &maxcpus);
+		printf("cpu_topology:\tsockets=%hu, cores=%hu, threads=%hu, "
+		    "maxcpus=%hu\n", sockets, cores, threads, maxcpus);
+	}
+
+	if (!error && run) {
+		error = vm_run(ctx, vcpu, &vmexit);
+		if (error == 0)
+			dump_vm_run_exitcode(&vmexit, vcpu);
+		else
+			printf("vm_run error %d\n", error);
+	}
+
+	if (!error && force_reset)
+		error = vm_suspend(ctx, VM_SUSPEND_RESET);
+
+	if (!error && force_poweroff)
+		error = vm_suspend(ctx, VM_SUSPEND_POWEROFF);
+
+	if (error)
+		printf("errno = %d\n", errno);
+
+	if (!error && destroy)
+		vm_destroy(ctx);
+
+	free (opts);
+	exit(error);
+}
diff --git a/usr/src/cmd/cmd-inet/etc/services b/usr/src/cmd/cmd-inet/etc/services
index 37514ac0a7..25ccc7cc43 100644
--- a/usr/src/cmd/cmd-inet/etc/services
+++ b/usr/src/cmd/cmd-inet/etc/services
@@ -1,6 +1,7 @@
 #
 # Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2015 Joyent, Inc.
 #
 # CDDL HEADER START
 #
@@ -215,6 +216,8 @@ krb5_prop	754/tcp				# Kerberos V5 KDC propogation
 swat		901/tcp				# Samba Web Adm.Tool
 ufsd		1008/tcp	ufsd		# UFS-aware server
 ufsd		1008/udp	ufsd
+portolan	1296/tcp			# Portolan
+svp-underlay	1339/tcp			# SDC VXLAN underlay invalidation
 cvc		1495/tcp			# Network Console
 ingreslock	1524/tcp
 www-ldap-gw	1760/tcp			# HTTP to LDAP gateway
diff --git a/usr/src/cmd/cmd-inet/etc/sock2path.d/system%2Fkernel b/usr/src/cmd/cmd-inet/etc/sock2path.d/system%2Fkernel
index c62e339953..49151907eb 100644
--- a/usr/src/cmd/cmd-inet/etc/sock2path.d/system%2Fkernel
+++ b/usr/src/cmd/cmd-inet/etc/sock2path.d/system%2Fkernel
@@ -18,6 +18,7 @@
 # CDDL HEADER END
 #
 # Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2014, Joyent, Inc. All rights reserved.
 #
 # socket configuration information
 #
@@ -52,3 +53,6 @@
 	29	4	1	/dev/spdsock
 
 	31	1	0	trill
+
+	33	1	0	lx_netlink
+	33	4	0	lx_netlink
diff --git a/usr/src/cmd/cmd-inet/lib/ipmgmtd/Makefile b/usr/src/cmd/cmd-inet/lib/ipmgmtd/Makefile
index 199f92807a..f150602cc9 100644
--- a/usr/src/cmd/cmd-inet/lib/ipmgmtd/Makefile
+++ b/usr/src/cmd/cmd-inet/lib/ipmgmtd/Makefile
@@ -19,13 +19,15 @@
 # CDDL HEADER END
 #
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015 Joyent, Inc.
 #
 
 # Needed for ROOTFS_LIBDIR definition
 include		../../../../lib/Makefile.lib
 
 PROG=		ipmgmtd
-OBJS=		ipmgmt_main.o ipmgmt_door.o ipmgmt_persist.o ipmgmt_util.o
+OBJS=		ipmgmt_main.o ipmgmt_door.o ipmgmt_persist.o ipmgmt_util.o \
+		ipmgmt_path.o
 SRCS=		$(OBJS:.o=.c)
 SVCMETHOD=	net-ipmgmt
 MANIFEST=	network-ipmgmt.xml
diff --git a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c
index c83c7627ad..bb4ffcbf0e 100644
--- a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c
+++ b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2014, Joyent, Inc. All rights reserved.
  * Copyright (c) 2016-2017, Chris Fraire <cfraire@me.com>.
  */
 
@@ -113,7 +114,9 @@ ipmgmt_handler(void *cookie, char *argp, size_t argsz, door_desc_t *dp,
 		goto fail;
 	}
 
-	/* check for solaris.network.interface.config authorization */
+	/*
+	 * if not root, check for solaris.network.interface.config authorization
+	 */
 	if (infop->idi_set) {
 		uid_t		uid;
 		struct passwd	pwd;
@@ -125,24 +128,32 @@ ipmgmt_handler(void *cookie, char *argp, size_t argsz, door_desc_t *dp,
 			goto fail;
 		}
 		uid = ucred_getruid(cred);
+		ucred_free(cred);
 		if ((int)uid < 0) {
 			err = errno;
 			ipmgmt_log(LOG_ERR, "Could not get user id.");
 			goto fail;
 		}
-		if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) ==
-		    NULL) {
-			err = errno;
-			ipmgmt_log(LOG_ERR, "Could not get password entry.");
-			goto fail;
-		}
-		if (chkauthattr(NETWORK_INTERFACE_CONFIG_AUTH,
-		    pwd.pw_name) != 1) {
-			err = EPERM;
-			ipmgmt_log(LOG_ERR, "Not authorized for operation.");
-			goto fail;
+
+		/*
+		 * Branded zones may have different auth, but root always
+		 * allowed.
+		 */
+		if (uid != 0) {
+			if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) {
+				err = errno;
+				ipmgmt_log(LOG_ERR,
+				    "Could not get password entry.");
+				goto fail;
+			}
+			if (chkauthattr(NETWORK_INTERFACE_CONFIG_AUTH,
+			    pwd.pw_name) != 1) {
+				err = EPERM;
+				ipmgmt_log(LOG_ERR,
+				    "Not authorized for operation.");
+				goto fail;
+			}
 		}
-		ucred_free(cred);
 	}
 
 	/* individual handlers take care of calling door_return */
diff --git a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_impl.h b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_impl.h
index e95e5c7e00..f4d6d30645 100644
--- a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_impl.h
+++ b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_impl.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  * Copyright (c) 2016, Chris Fraire <cfraire@me.com>.
  */
 
@@ -144,8 +145,6 @@ extern ipmgmt_aobjmap_list_t aobjmap;
 #define	ADDROBJ_LOOKUPADD	0x00000004
 #define	ADDROBJ_SETLIFNUM	0x00000008
 
-/* Permanent data store for ipadm */
-#define	IPADM_DB_FILE		"/etc/ipadm/ipadm.conf"
 #define	IPADM_FILE_MODE		(S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)
 
 /*
@@ -155,20 +154,12 @@ extern ipmgmt_aobjmap_list_t aobjmap;
  */
 #define	IPADM_DB_VERSION	1
 
-/*
- * A temporary file created in SMF volatile filesystem. This file captures the
- * in-memory copy of list `aobjmap' on disk. This is done to recover from
- * daemon reboot (using svcadm) or crashes.
- */
-#define	IPADM_TMPFS_DIR		"/etc/svc/volatile/ipadm"
-#define	ADDROBJ_MAPPING_DB_FILE	IPADM_TMPFS_DIR"/aobjmap.conf"
-
-/*
- * A temporary copy of the ipadm configuration file might need
- * to be created if write requests are encountered during boottime
- * and the root filesystem is mounted read-only.
- */
-#define	IPADM_VOL_DB_FILE	IPADM_TMPFS_DIR"/ipadm.conf"
+typedef enum ipadm_path {
+	IPADM_PATH_TMPFS_DIR = 1,
+	IPADM_PATH_ADDROBJ_MAP_DB,
+	IPADM_PATH_DB,
+	IPADM_PATH_VOL_DB
+} ipadm_path_t;
 
 /* SCF resources required to interact with svc.configd */
 typedef struct scf_resources {
@@ -198,6 +189,8 @@ extern void		ipmgmt_release_scf_resources(scf_resources_t *);
 extern boolean_t	ipmgmt_needs_upgrade(scf_resources_t *);
 extern void		ipmgmt_update_dbver(scf_resources_t *);
 
+extern void		ipmgmt_path(ipadm_path_t, char *, size_t);
+
 #ifdef  __cplusplus
 }
 #endif
diff --git a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_main.c b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_main.c
index 5cdc0f5697..994d1b0125 100644
--- a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_main.c
+++ b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_main.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*
@@ -105,6 +106,7 @@ ipmgmt_db_init()
 	int		fd, err, scferr;
 	scf_resources_t	res;
 	boolean_t	upgrade = B_TRUE;
+	char		aobjpath[MAXPATHLEN];
 
 	/*
 	 * Check to see if we need to upgrade the data-store. We need to
@@ -134,11 +136,11 @@ ipmgmt_db_init()
 		ipmgmt_release_scf_resources(&res);
 
 	/* creates the address object data store, if it doesn't exist */
-	if ((fd = open(ADDROBJ_MAPPING_DB_FILE, O_CREAT|O_RDONLY,
-	    IPADM_FILE_MODE)) == -1) {
+	ipmgmt_path(IPADM_PATH_ADDROBJ_MAP_DB, aobjpath, sizeof (aobjpath));
+	if ((fd = open(aobjpath, O_CREAT|O_RDONLY, IPADM_FILE_MODE)) == -1) {
 		err = errno;
-		ipmgmt_log(LOG_ERR, "could not open %s: %s",
-		    ADDROBJ_MAPPING_DB_FILE, strerror(err));
+		ipmgmt_log(LOG_ERR, "could not open %s: %s", aobjpath,
+		    strerror(err));
 		return (err);
 	}
 	(void) close(fd);
@@ -152,8 +154,8 @@ ipmgmt_db_init()
 	 * representation of the mapping. That is, build `aobjmap' structure
 	 * from address object data store.
 	 */
-	if ((err = ipadm_rw_db(ipmgmt_aobjmap_init, NULL,
-	    ADDROBJ_MAPPING_DB_FILE, 0, IPADM_DB_READ)) != 0) {
+	if ((err = ipadm_rw_db(ipmgmt_aobjmap_init, NULL, aobjpath, 0,
+	    IPADM_DB_READ)) != 0) {
 		/* if there was nothing to initialize, it's fine */
 		if (err != ENOENT)
 			return (err);
@@ -165,17 +167,42 @@ ipmgmt_db_init()
 	return (err);
 }
 
+static const char *
+ipmgmt_door_path()
+{
+	static char door[MAXPATHLEN];
+	static boolean_t init_done = B_FALSE;
+
+	if (!init_done) {
+		const char *zroot = zone_get_nroot();
+
+		/*
+		 * If this is a branded zone, make sure we use the "/native"
+		 * prefix for the door path:
+		 */
+		(void) snprintf(door, sizeof (door), "%s%s", zroot != NULL ?
+		    zroot : "", IPMGMT_DOOR);
+
+		init_done = B_TRUE;
+	}
+
+	return (door);
+}
+
 static int
 ipmgmt_door_init()
 {
 	int fd;
 	int err;
+	const char *door = ipmgmt_door_path();
 
-	/* create the door file for ipmgmtd */
-	if ((fd = open(IPMGMT_DOOR, O_CREAT|O_RDONLY, IPADM_FILE_MODE)) == -1) {
+	/*
+	 * Create the door file for ipmgmtd.
+	 */
+	if ((fd = open(door, O_CREAT | O_RDONLY, IPADM_FILE_MODE)) == -1) {
 		err = errno;
-		ipmgmt_log(LOG_ERR, "could not open %s: %s",
-		    IPMGMT_DOOR, strerror(err));
+		ipmgmt_log(LOG_ERR, "could not open %s: %s", door,
+		    strerror(err));
 		return (err);
 	}
 	(void) close(fd);
@@ -186,15 +213,16 @@ ipmgmt_door_init()
 		ipmgmt_log(LOG_ERR, "failed to create door: %s", strerror(err));
 		return (err);
 	}
+
 	/*
 	 * fdetach first in case a previous daemon instance exited
 	 * ungracefully.
 	 */
-	(void) fdetach(IPMGMT_DOOR);
-	if (fattach(ipmgmt_door_fd, IPMGMT_DOOR) != 0) {
+	(void) fdetach(door);
+	if (fattach(ipmgmt_door_fd, door) != 0) {
 		err = errno;
-		ipmgmt_log(LOG_ERR, "failed to attach door to %s: %s",
-		    IPMGMT_DOOR, strerror(err));
+		ipmgmt_log(LOG_ERR, "failed to attach door to %s: %s", door,
+		    strerror(err));
 		goto fail;
 	}
 	return (0);
@@ -207,13 +235,15 @@ fail:
 static void
 ipmgmt_door_fini()
 {
+	const char *door = ipmgmt_door_path();
+
 	if (ipmgmt_door_fd == -1)
 		return;
 
-	(void) fdetach(IPMGMT_DOOR);
+	(void) fdetach(door);
 	if (door_revoke(ipmgmt_door_fd) == -1) {
 		ipmgmt_log(LOG_ERR, "failed to revoke access to door %s: %s",
-		    IPMGMT_DOOR, strerror(errno));
+		    door, strerror(errno));
 	}
 }
 
@@ -350,10 +380,14 @@ ipmgmt_init_privileges()
 {
 	struct stat	statbuf;
 	int		err;
+	char		tmpfsdir[MAXPATHLEN];
 
-	/* create the IPADM_TMPFS_DIR directory */
-	if (stat(IPADM_TMPFS_DIR, &statbuf) < 0) {
-		if (mkdir(IPADM_TMPFS_DIR, (mode_t)0755) < 0) {
+	/*
+	 * Create the volatile storage directory:
+	 */
+	ipmgmt_path(IPADM_PATH_TMPFS_DIR, tmpfsdir, sizeof (tmpfsdir));
+	if (stat(tmpfsdir, &statbuf) < 0) {
+		if (mkdir(tmpfsdir, (mode_t)0755) < 0) {
 			err = errno;
 			goto fail;
 		}
@@ -364,8 +398,8 @@ ipmgmt_init_privileges()
 		}
 	}
 
-	if ((chmod(IPADM_TMPFS_DIR, 0755) < 0) ||
-	    (chown(IPADM_TMPFS_DIR, UID_NETADM, GID_NETADM) < 0)) {
+	if ((chmod(tmpfsdir, 0755) < 0) ||
+	    (chown(tmpfsdir, UID_NETADM, GID_NETADM) < 0)) {
 		err = errno;
 		goto fail;
 	}
diff --git a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_path.c b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_path.c
new file mode 100644
index 0000000000..0219ac1522
--- /dev/null
+++ b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_path.c
@@ -0,0 +1,84 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Lookup functions for various file paths used by ipmgmtd.  This mechanism
+ * primarily exists to account for a native root prefix when run within a
+ * branded zone (e.g. "/native").
+ */
+
+#include <stdio.h>
+#include <zone.h>
+#include "ipmgmt_impl.h"
+
+#define	IPADM_PERM_DIR		"/etc/ipadm"
+#define	IPADM_TMPFS_DIR		"/etc/svc/volatile/ipadm"
+
+typedef struct ipadm_path_ent {
+	ipadm_path_t ipe_id;
+	const char *ipe_path;
+} ipadm_path_ent_t;
+
+static ipadm_path_ent_t ipadm_paths[] = {
+	/*
+	 * A temporary directory created in the SMF volatile filesystem.
+	 */
+	{ IPADM_PATH_TMPFS_DIR,		IPADM_TMPFS_DIR },
+
+	/*
+	 * This file captures the in-memory copy of list `aobjmap' on disk.
+	 * This allows the system to recover in the event that the daemon
+	 * crashes or is restarted.
+	 */
+	{ IPADM_PATH_ADDROBJ_MAP_DB,	IPADM_TMPFS_DIR "/aobjmap.conf" },
+
+	/*
+	 * The permanent data store for ipadm.
+	 */
+	{ IPADM_PATH_DB,		IPADM_PERM_DIR "/ipadm.conf" },
+
+	/*
+	 * A temporary copy of the ipadm configuration created, if needed, to
+	 * service write requests early in boot.  This file is merged with the
+	 * permanent data store once it is available for writes.
+	 */
+	{ IPADM_PATH_VOL_DB,		IPADM_TMPFS_DIR "/ipadm.conf" },
+
+	{ 0,				NULL }
+};
+
+/*
+ * Load one of the paths used by ipadm into the provided string buffer.
+ * Prepends the native system prefix (e.g. "/native") if one is in effect,
+ * such as when running within a branded zone.
+ */
+void
+ipmgmt_path(ipadm_path_t ip, char *buf, size_t bufsz)
+{
+	int i;
+
+	for (i = 0; ipadm_paths[i].ipe_path != NULL; i++) {
+		if (ipadm_paths[i].ipe_id == ip) {
+			const char *zroot = zone_get_nroot();
+
+			(void) snprintf(buf, bufsz, "%s%s", zroot != NULL ?
+			    zroot : "", ipadm_paths[i].ipe_path);
+
+			return;
+		}
+	}
+
+	abort();
+}
diff --git a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_persist.c b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_persist.c
index a5031e9950..5950562fd6 100644
--- a/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_persist.c
+++ b/usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_persist.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  * Copyright 2016 Argo Technologie SA.
  * Copyright (c) 2016-2017, Chris Fraire <cfraire@me.com>.
  */
@@ -385,13 +386,18 @@ static void *
 ipmgmt_db_restore_thread(void *arg)
 {
 	int err;
+	char confpath[MAXPATHLEN];
+	char tmpconfpath[MAXPATHLEN];
+
+	ipmgmt_path(IPADM_PATH_DB, confpath, sizeof (confpath));
+	ipmgmt_path(IPADM_PATH_VOL_DB, tmpconfpath, sizeof (tmpconfpath));
 
 	for (;;) {
 		(void) sleep(5);
 		(void) pthread_rwlock_wrlock(&ipmgmt_dbconf_lock);
 		if (!ipmgmt_rdonly_root)
 			break;
-		err = ipmgmt_cpfile(IPADM_VOL_DB_FILE, IPADM_DB_FILE, B_FALSE);
+		err = ipmgmt_cpfile(tmpconfpath, confpath, B_FALSE);
 		if (err == 0) {
 			ipmgmt_rdonly_root = B_FALSE;
 			break;
@@ -423,6 +429,11 @@ ipmgmt_db_walk(db_wfunc_t *db_walk_func, void *db_warg, ipadm_db_op_t db_op)
 	mode_t		mode;
 	pthread_t	tid;
 	pthread_attr_t	attr;
+	char		confpath[MAXPATHLEN];
+	char		tmpconfpath[MAXPATHLEN];
+
+	ipmgmt_path(IPADM_PATH_DB, confpath, sizeof (confpath));
+	ipmgmt_path(IPADM_PATH_VOL_DB, tmpconfpath, sizeof (tmpconfpath));
 
 	writeop = (db_op != IPADM_DB_READ);
 	if (writeop) {
@@ -435,11 +446,10 @@ ipmgmt_db_walk(db_wfunc_t *db_walk_func, void *db_warg, ipadm_db_op_t db_op)
 
 	/*
 	 * Did a previous write attempt fail? If so, don't even try to
-	 * read/write to IPADM_DB_FILE.
+	 * read/write to the permanent configuration file.
 	 */
 	if (!ipmgmt_rdonly_root) {
-		err = ipadm_rw_db(db_walk_func, db_warg, IPADM_DB_FILE,
-		    mode, db_op);
+		err = ipadm_rw_db(db_walk_func, db_warg, confpath, mode, db_op);
 		if (err != EROFS)
 			goto done;
 	}
@@ -447,11 +457,11 @@ ipmgmt_db_walk(db_wfunc_t *db_walk_func, void *db_warg, ipadm_db_op_t db_op)
 	/*
 	 * If we haven't already copied the file to the volatile
 	 * file system, do so. This should only happen on a failed
-	 * writeop(i.e., we have acquired the write lock above).
+	 * writeop (i.e., we have acquired the write lock above).
 	 */
-	if (access(IPADM_VOL_DB_FILE, F_OK) != 0) {
+	if (access(tmpconfpath, F_OK) != 0) {
 		assert(writeop);
-		err = ipmgmt_cpfile(IPADM_DB_FILE, IPADM_VOL_DB_FILE, B_TRUE);
+		err = ipmgmt_cpfile(confpath, tmpconfpath, B_TRUE);
 		if (err != 0)
 			goto done;
 		(void) pthread_attr_init(&attr);
@@ -461,7 +471,7 @@ ipmgmt_db_walk(db_wfunc_t *db_walk_func, void *db_warg, ipadm_db_op_t db_op)
 		    NULL);
 		(void) pthread_attr_destroy(&attr);
 		if (err != 0) {
-			(void) unlink(IPADM_VOL_DB_FILE);
+			(void) unlink(tmpconfpath);
 			goto done;
 		}
 		ipmgmt_rdonly_root = B_TRUE;
@@ -470,7 +480,7 @@ ipmgmt_db_walk(db_wfunc_t *db_walk_func, void *db_warg, ipadm_db_op_t db_op)
 	/*
 	 * Read/write from the volatile copy.
 	 */
-	err = ipadm_rw_db(db_walk_func, db_warg, IPADM_VOL_DB_FILE,
+	err = ipadm_rw_db(db_walk_func, db_warg, tmpconfpath,
 	    mode, db_op);
 done:
 	(void) pthread_rwlock_unlock(&ipmgmt_dbconf_lock);
@@ -1252,6 +1262,9 @@ ipmgmt_persist_aobjmap(ipmgmt_aobjmap_t *nodep, ipadm_db_op_t op)
 	int			err;
 	ipadm_dbwrite_cbarg_t	cb;
 	nvlist_t		*nvl = NULL;
+	char			aobjpath[MAXPATHLEN];
+
+	ipmgmt_path(IPADM_PATH_ADDROBJ_MAP_DB, aobjpath, sizeof (aobjpath));
 
 	if (op == IPADM_DB_WRITE) {
 		if ((err = i_ipmgmt_node2nvl(&nvl, nodep)) != 0)
@@ -1262,14 +1275,14 @@ ipmgmt_persist_aobjmap(ipmgmt_aobjmap_t *nodep, ipadm_db_op_t op)
 		else
 			cb.dbw_flags = 0;
 
-		err = ipadm_rw_db(ipmgmt_update_aobjmap, &cb,
-		    ADDROBJ_MAPPING_DB_FILE, IPADM_FILE_MODE, IPADM_DB_WRITE);
+		err = ipadm_rw_db(ipmgmt_update_aobjmap, &cb, aobjpath,
+		    IPADM_FILE_MODE, IPADM_DB_WRITE);
 		nvlist_free(nvl);
 	} else {
 		assert(op == IPADM_DB_DELETE);
 
-		err = ipadm_rw_db(ipmgmt_delete_aobjmap, nodep,
-		    ADDROBJ_MAPPING_DB_FILE, IPADM_FILE_MODE, IPADM_DB_DELETE);
+		err = ipadm_rw_db(ipmgmt_delete_aobjmap, nodep, aobjpath,
+		    IPADM_FILE_MODE, IPADM_DB_DELETE);
 	}
 	return (err);
 }
diff --git a/usr/src/cmd/cmd-inet/lib/ipmgmtd/net-ipmgmt b/usr/src/cmd/cmd-inet/lib/ipmgmtd/net-ipmgmt
index 77b6be9f54..d5812793d4 100644
--- a/usr/src/cmd/cmd-inet/lib/ipmgmtd/net-ipmgmt
+++ b/usr/src/cmd/cmd-inet/lib/ipmgmtd/net-ipmgmt
@@ -21,6 +21,7 @@
 #
 #
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2012, Joyent, Inc. All rights reserved.
 #
 # This daemon stores address object to logical interface number mappings
 # (among other things) and reads/writes from/to ipmgmtd data store.
@@ -38,14 +39,16 @@ fi
 # When the non-global shared-IP stack zone boots, it tries to bring up this
 # service as well. If we don't start a background process and simply exit the
 # service, the service will go into maintenance mode and so will all it's
-# dependents.
+# dependents.  Ideally we would simply exit with SMF_EXIT_NODAEMON, but since
+# this method is also used in an S10C zone, where support for SMF_EXIT_NODAEMON
+# does not exist, we have to stick around.
 #
 # In S10C zone (where this script is also used) smf_isnonglobalzone
 # function is unavailable in smf_include.sh
 #
 if [ `/sbin/zonename` != global ]; then
 	if [ `/sbin/zonename -t` = shared ]; then
-		(while true ; do sleep 3600 ; done) & 
+		(while true ; do sleep 3600 ; done) &
 		exit $SMF_EXIT_OK
 	fi
 fi
diff --git a/usr/src/cmd/cmd-inet/sbin/dhcpagent/defaults.c b/usr/src/cmd/cmd-inet/sbin/dhcpagent/defaults.c
index 133254be4a..e6a88304a7 100644
--- a/usr/src/cmd/cmd-inet/sbin/dhcpagent/defaults.c
+++ b/usr/src/cmd/cmd-inet/sbin/dhcpagent/defaults.c
@@ -32,6 +32,7 @@
 #include <stdio.h>
 #include <sys/stat.h>
 #include <libnvpair.h>
+#include <zone.h>
 
 #include "common.h"
 #include "defaults.h"
@@ -67,6 +68,32 @@ static struct dhcp_default defaults[] = {
 	{ "ADOPT_DOMAINNAME",	 "0",	 0,   0	  },
 };
 
+
+/*
+ * df_find_defaults(): builds the path to the default configuration file
+ *
+ *   input: void
+ *  output: void
+ */
+
+static const char *
+df_find_defaults(void)
+{
+	static char agent_defaults_path[MAXPATHLEN] = { 0 };
+	const char	*zroot = NULL;
+
+	if (agent_defaults_path[0] != '\0') {
+		return agent_defaults_path;
+	}
+
+	zroot = zone_get_nroot();
+
+	(void) snprintf(agent_defaults_path, MAXPATHLEN, "%s%s",
+	    zroot != NULL ?  zroot : "", DHCP_AGENT_DEFAULTS);
+
+	return agent_defaults_path;
+}
+
 /*
  * df_build_cache(): builds the defaults nvlist cache
  *
@@ -77,6 +104,7 @@ static struct dhcp_default defaults[] = {
 static nvlist_t *
 df_build_cache(void)
 {
+	const char	*agent_defaults_path = df_find_defaults();
 	char		entry[1024];
 	int		i;
 	char		*param, *pastv6, *value, *end;
@@ -84,7 +112,7 @@ df_build_cache(void)
 	nvlist_t 	*nvlist;
 	struct dhcp_default *defp;
 
-	if ((fp = fopen(DHCP_AGENT_DEFAULTS, "r")) == NULL)
+	if ((fp = fopen(agent_defaults_path, "r")) == NULL)
 		return (NULL);
 
 	if (nvlist_alloc(&nvlist, NV_UNIQUE_NAME, 0) != 0) {
@@ -164,6 +192,7 @@ df_build_cache(void)
 const char *
 df_get_string(const char *if_name, boolean_t isv6, uint_t param)
 {
+	const char		*agent_defaults_path = df_find_defaults();
 	char			*value;
 	char			paramstr[256];
 	char			name[256];
@@ -175,10 +204,11 @@ df_get_string(const char *if_name, boolean_t isv6, uint_t param)
 	if (param >= (sizeof (defaults) / sizeof (*defaults)))
 		return (NULL);
 
-	if (stat(DHCP_AGENT_DEFAULTS, &statbuf) != 0) {
+
+	if (stat(agent_defaults_path, &statbuf) != 0) {
 		if (!df_unavail_msg) {
 			dhcpmsg(MSG_WARNING, "cannot access %s; using "
-			    "built-in defaults", DHCP_AGENT_DEFAULTS);
+			    "built-in defaults", agent_defaults_path);
 			df_unavail_msg = B_TRUE;
 		}
 		return (defaults[param].df_default);
diff --git a/usr/src/cmd/cmd-inet/sbin/dhcpagent/request.c b/usr/src/cmd/cmd-inet/sbin/dhcpagent/request.c
index 6b5a08a51a..7517f2c094 100644
--- a/usr/src/cmd/cmd-inet/sbin/dhcpagent/request.c
+++ b/usr/src/cmd/cmd-inet/sbin/dhcpagent/request.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
  * Copyright (c) 2016-2017, Chris Fraire <cfraire@me.com>.
  *
  * REQUESTING state of the client state machine.
@@ -39,6 +40,7 @@
 #include <dhcp_hostconf.h>
 #include <dhcpagent_util.h>
 #include <dhcpmsg.h>
+#include <strings.h>
 
 #include "states.h"
 #include "util.h"
@@ -645,8 +647,24 @@ accept_v4_acknak(dhcp_smach_t *dsmp, PKT_LIST *plp)
 	stop_pkt_retransmission(dsmp);
 
 	if (*plp->opts[CD_DHCP_TYPE]->value == NAK) {
-		dhcpmsg(MSG_WARNING, "accept_v4_acknak: NAK on interface %s",
-		    dsmp->dsm_name);
+		char saddr[18];
+
+		saddr[0] = '\0';
+		if (plp->opts[CD_SERVER_ID] != NULL &&
+		    plp->opts[CD_SERVER_ID]->len == sizeof (struct in_addr)) {
+			struct in_addr	t_server;
+
+			bcopy(plp->opts[CD_SERVER_ID]->value, &t_server,
+			    plp->opts[CD_SERVER_ID]->len);
+			(void) strlcpy(saddr, inet_ntoa(t_server),
+			    sizeof (saddr));
+		}
+
+		dhcpmsg(MSG_WARNING, "accept_v4_acknak: NAK on interface %s "
+		    "from %s %s",
+		    dsmp->dsm_name,
+		    inet_ntoa(plp->pktfrom.v4.sin_addr), saddr);
+
 		dsmp->dsm_bad_offers++;
 		free_pkt_entry(plp);
 		dhcp_restart(dsmp);
diff --git a/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile b/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile
index 1b82adef80..a743bed065 100644
--- a/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile
+++ b/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile
@@ -33,7 +33,7 @@ include	../../../Makefile.cmd
 ROOTMANIFESTDIR = $(ROOTSVCNETWORK)
 
 LDLIBS    += 	-ldladm -ldlpi
-all install := LDLIBS += -lcrypto
+all install := LDLIBS += -lsunw_crypto
 
 LINTFLAGS += 	-u
 
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/Makefile b/usr/src/cmd/cmd-inet/usr.sbin/Makefile
index 7a72f274b8..5b2d0b1af2 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/Makefile
+++ b/usr/src/cmd/cmd-inet/usr.sbin/Makefile
@@ -22,6 +22,7 @@
 #
 # Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
+# Copyright 2018, Joyent, Inc.
 #
 
 SYNCPROG=	syncinit syncloop syncstat
@@ -161,6 +162,7 @@ if_mpadm.po		:=	XGETFLAGS += -a
 route			:=	CPPFLAGS += -DNDEBUG
 ndd			:=	LDLIBS += -ldladm -lipadm
 in.comsat		:=	LDFLAGS += $(MAPFILE.NGB:%=-M%)
+route			:=	LDLIBS += -lzonecfg -lcontract
 
 .KEEP_STATE:
 
@@ -263,7 +265,7 @@ lint: $(LINTSUBDIRS)
 		in.telnetd.c $(LDLIBS) -lbsm -lpam -lsocket -lnsl
 	$(LINT.c) if_mpadm.c $(LDLIBS) -lsocket -lnsl -lipmp -linetutil
 	$(LINT.c) ipaddrsel.c $(LDLIBS) -lsocket -lnsl
-	$(LINT.c) route.c $(LDLIBS) -lsocket -lnsl -ltsnet
+	$(LINT.c) route.c $(LDLIBS) -lsocket -lnsl -ltsnet -lcontract -lzonecfg
 	$(LINT.c) syncinit.c $(LDLIBS) -ldlpi
 	$(LINT.c) syncloop.c $(LDLIBS) -ldlpi
 	$(LINT.c) syncstat.c $(LDLIBS) -ldlpi
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/arp.c b/usr/src/cmd/cmd-inet/usr.sbin/arp.c
index 19ab13fd47..aa9adac6ce 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/arp.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/arp.c
@@ -58,6 +58,7 @@
 #include <arpa/inet.h>
 #include <net/if_types.h>
 #include <net/if_dl.h>
+#include <zone.h>
 
 static int file(char *);
 static int set(int, char *[]);
@@ -118,7 +119,11 @@ main(int argc, char *argv[])
 		 * is to let netstat, which prints it as part of
 		 * the MIB statistics, do it.
 		 */
-		(void) execl("/usr/bin/netstat", "netstat",
+		char netstat_path[MAXPATHLEN];
+		const char *zroot = zone_get_nroot();
+		(void) snprintf(netstat_path, sizeof (netstat_path), "%s%s", zroot != NULL ?
+		    zroot : "", "/usr/bin/netstat");
+		(void) execl(netstat_path, "netstat",
 		    (n_flag ? "-np" : "-p"),
 		    "-f", "inet", (char *)0);
 		(void) fprintf(stderr, "failed to exec netstat: %s\n",
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/ndp.c b/usr/src/cmd/cmd-inet/usr.sbin/ndp.c
index 23b940c686..2fc19775ad 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/ndp.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/ndp.c
@@ -40,6 +40,7 @@
 #include <inet/ip.h>
 #include <net/if_dl.h>
 #include <net/route.h>
+#include <zone.h>
 
 typedef	struct	sockaddr_in6	sin6_t;
 
@@ -95,7 +96,6 @@ static	int	ndp_set_nce(char *, char *, char *[], int);
 static	int	ndp_set_file(char *);
 
 static	char		*ndp_iface = NULL;
-static	char		*netstat_path = "/usr/bin/netstat";
 static	pid_t		ndp_pid;
 static	boolean_t	ndp_noresolve = B_FALSE; /* Don't lookup addresses */
 static	boolean_t	ndp_run = B_TRUE;
@@ -103,6 +103,7 @@ static	boolean_t	ndp_run = B_TRUE;
 #define	MAX_ATTEMPTS 5
 #define	MAX_OPTS 5
 #define	WORDSEPS " \t\r\n"
+#define	NETSTAT_PATH	"/usr/bin/netstat"
 
 /*
  * Macros borrowed from route(1M) for working with PF_ROUTE messages
@@ -767,6 +768,12 @@ ndp_get(int fd, struct lifreq *lifrp, void *unused)
 static void
 ndp_get_all(void)
 {
+	char netstat_path[MAXPATHLEN];
+	const char *zroot = zone_get_nroot();
+
+	(void) snprintf(netstat_path, sizeof (netstat_path), "%s%s", zroot != NULL ?
+	    zroot : "", NETSTAT_PATH);
+
 	(void) execl(netstat_path, "netstat",
 	    (ndp_noresolve ? "-np" : "-p"),
 	    "-f", "inet6", (char *)0);
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/route.c b/usr/src/cmd/cmd-inet/usr.sbin/route.c
index a2fd0d2d17..29ccf97bb1 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/route.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/route.c
@@ -6,6 +6,7 @@
 /* All Rights Reserved	*/
 
 /* Copyright (c) 1990  Mentat Inc. */
+/* Copyright 2018, Joyent, Inc. */
 
 /*
  *
@@ -79,6 +80,13 @@
 #include <assert.h>
 #include <strings.h>
 
+#include <libcontract.h>
+#include <sys/ctfs.h>
+#include <sys/contract/process.h>
+#include <sys/wait.h>
+#include <libzonecfg.h>
+#include <zone.h>
+
 #include <libtsnet.h>
 #include <tsol/label.h>
 
@@ -292,6 +300,7 @@ static void		syntax_error(char *err, ...);
 static void		usage(char *cp);
 static void		write_to_rtfile(FILE *fp, int argc, char **argv);
 static void		pmsg_secattr(const char *, size_t, const char *);
+static void		do_zone(char *);
 
 static pid_t		pid;
 static int		s;
@@ -308,6 +317,7 @@ static char		perm_file_sfx[] = "/etc/inet/static_routes";
 static char		*perm_file;
 static char		temp_file_sfx[] = "/etc/inet/static_routes.tmp";
 static char		*temp_file;
+static char		*zonename;
 static struct in6_addr	in6_host_mask = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 /*
@@ -354,7 +364,7 @@ usage(char *cp)
 		    cp);
 	}
 	(void) fprintf(stderr, gettext("usage: route [ -fnpqv ] "
-	    "[ -R <root-dir> ] cmd [[ -<qualifers> ] args ]\n"));
+	    "[-z <zone> ] [ -R <root-dir> ] cmd [[ -<qualifers> ] args ]\n"));
 	exit(1);
 	/* NOTREACHED */
 }
@@ -418,7 +428,7 @@ main(int argc, char **argv)
 	if (argc < 2)
 		usage(NULL);
 
-	while ((ch = getopt(argc, argv, "R:nqdtvfp")) != EOF) {
+	while ((ch = getopt(argc, argv, "R:nqdtvfpz:")) != EOF) {
 		switch (ch) {
 		case 'n':
 			nflag = B_TRUE;
@@ -444,6 +454,9 @@ main(int argc, char **argv)
 		case 'R':
 			root_dir = optarg;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		case '?':
 		default:
 			usage(NULL);
@@ -453,6 +466,8 @@ main(int argc, char **argv)
 	argc -= optind;
 	argv += optind;
 
+	do_zone(zonename);
+
 	pid = getpid();
 	if (tflag)
 		s = open("/dev/null", O_WRONLY);
@@ -3252,3 +3267,74 @@ pmsg_secattr(const char *sptr, size_t msglen, const char *labelstr)
 		    sizeof (buf)));
 	}
 }
+
+static void
+do_zone(char *name)
+{
+	zoneid_t zoneid;
+	zone_state_t st;
+	int fd, status, rc = 0;
+	pid_t pid;
+
+	if (name == NULL)
+		return;
+
+	if (getzoneid() != GLOBAL_ZONEID) {
+		(void) fprintf(stderr,
+		    "route: -z can only be specified from the global zone\n");
+		exit(EXIT_FAILURE);
+	}
+
+	if (strcmp(name, GLOBAL_ZONENAME) == 0)
+		return;
+
+	if (zone_get_state(name, &st) != Z_OK)
+		quit("unable to get zone state", errno);
+
+	if (st != ZONE_STATE_RUNNING) {
+		(void) fprintf(stderr, "route: zone must be running\n");
+		exit(EXIT_FAILURE);
+	}
+
+	if ((zoneid = getzoneidbyname(name)) == -1)
+		quit("cannot determine zone id", errno);
+
+	if ((fd = open64(CTFS_ROOT "/process/template", O_RDWR)) == -1)
+		quit("cannot open ctfs template", errno);
+
+	/*
+	 * zone_enter() does not allow contracts to straddle zones, so we must
+	 * create a new, though largely unused contract.  Once we fork, the
+	 * child is the only member of the new contract, so it can perform a
+	 * zone_enter().
+	 */
+	rc |= ct_tmpl_set_critical(fd, 0);
+	rc |= ct_tmpl_set_informative(fd, 0);
+	rc |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR);
+	rc |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT);
+	if (rc || ct_tmpl_activate(fd)) {
+		(void) close(fd);
+		quit("could not create contract", errno);
+	}
+
+	switch (pid = fork1()) {
+	case 0:
+		(void) ct_tmpl_clear(fd);
+		(void) close(fd);
+		if (zone_enter(zoneid) == -1)
+			quit("could not enter zone", errno);
+		return;
+
+	case -1:
+		quit("fork1 failed", errno);
+
+	default:
+		(void) ct_tmpl_clear(fd);
+		(void) close(fd);
+		if (waitpid(pid, &status, 0) < 0)
+			quit("waitpid failed", errno);
+
+		exit(WEXITSTATUS(status));
+	}
+
+}
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/routeadm/routeadm.c b/usr/src/cmd/cmd-inet/usr.sbin/routeadm/routeadm.c
index 71a2fc9853..be826baba2 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/routeadm/routeadm.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/routeadm/routeadm.c
@@ -21,10 +21,9 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012 Joyent, Inc.  All rights reserved.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -46,6 +45,7 @@
 #include <libscf.h>
 #include <libscf_priv.h>
 #include <libuutil.h>
+#include <ifaddrs.h>
 
 /*
  * This program moves routing management under SMF.  We do this by giving
@@ -2335,8 +2335,8 @@ out:
 
 /*
  *
- * Return the number of IPv6 addresses configured.  This answers the
- * generic question, "is IPv6 configured?".  We only start in.ndpd if IPv6
+ * Return the number of non-loopback IPv6 addresses configured.  This answers
+ * the generic question, "is IPv6 configured?".  We only start in.ndpd if IPv6
  * is configured, and we also only enable IPv6 routing daemons if IPv6 is
  * enabled.
  */
@@ -2344,28 +2344,24 @@ static int
 ra_numv6intfs(void)
 {
 	static int	num = -1;
-	int		ipsock;
-	struct lifnum	lifn;
+	int		cnt;
+	struct ifaddrs *ifp_head, *ifp;
 
 	if (num != -1)
 		return (num);
 
-	if ((ipsock = socket(PF_INET6, SOCK_DGRAM, 0)) == -1) {
-		(void) fprintf(stderr,
-		    gettext("%1$s: unable to open %2$s: %3$s\n"),
-		    myname, IP_DEV_NAME, strerror(errno));
+	if (getifaddrs(&ifp_head) < 0)
 		return (0);
-	}
-	lifn.lifn_family = AF_INET6;
-	lifn.lifn_flags = 0;
 
-	if (ioctl(ipsock, SIOCGLIFNUM, &lifn) == -1) {
-		(void) close(ipsock);
-		return (0);
+	cnt = 0;
+	for (ifp = ifp_head; ifp; ifp = ifp->ifa_next) {
+		if (!(ifp->ifa_flags & IFF_LOOPBACK) &&
+		    (ifp->ifa_flags & IFF_IPV6))
+			cnt++;
 	}
-	(void) close(ipsock);
 
-	return (num = lifn.lifn_count);
+	freeifaddrs(ifp_head);
+	return (num = cnt);
 }
 
 /*
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/Makefile b/usr/src/cmd/cmd-inet/usr.sbin/snoop/Makefile
index 1d408bccba..5d9ef9e64d 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/Makefile
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/Makefile
@@ -22,6 +22,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2015 Joyent, Inc.
 #
 
 PROG=	snoop
@@ -39,12 +40,14 @@ OBJS=	nfs4_xdr.o snoop.o snoop_aarp.o snoop_adsp.o snoop_aecho.o \
 	snoop_pppoe.o snoop_rip.o snoop_rip6.o snoop_rpc.o snoop_rpcprint.o \
 	snoop_rpcsec.o snoop_rport.o snoop_rquota.o snoop_rstat.o snoop_rtmp.o \
 	snoop_sctp.o snoop_slp.o snoop_smb.o snoop_socks.o snoop_solarnet.o \
-	snoop_tcp.o snoop_tftp.o snoop_trill.o snoop_udp.o snoop_zip.o
+	snoop_tcp.o snoop_tftp.o snoop_trill.o snoop_udp.o snoop_vxlan.o \
+	snoop_zip.o
 
 SRCS=	$(OBJS:.o=.c)
 HDRS=	snoop.h snoop_mip.h at.h snoop_ospf.h snoop_ospf6.h
 
 include	../../../Makefile.cmd
+include ../../../Makefile.ctf
 
 CPPFLAGS += -I. -I$(SRC)/common/net/dhcp \
 	-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.c
index e6a71ea602..6ee99a06c6 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.c
@@ -121,6 +121,7 @@ main(int argc, char **argv)
 	char *output_area;
 	int nbytes;
 	char *datalink = NULL;
+	char *zonename = NULL;
 	dlpi_handle_t dh;
 
 	names[0] = '\0';
@@ -227,7 +228,7 @@ main(int argc, char **argv)
 	}
 	(void) setvbuf(stdout, NULL, _IOLBF, BUFSIZ);
 
-	while ((c = getopt(argc, argv, "at:CPDSi:o:Nn:s:d:I:vVp:f:c:x:U?rqz"))
+	while ((c = getopt(argc, argv, "at:CPDSi:o:Nn:s:d:I:vVp:f:c:x:U?rqz:Z"))
 	    != EOF) {
 		switch (c) {
 		case 'a':
@@ -348,8 +349,11 @@ main(int argc, char **argv)
 		case 'U':
 			Uflg = B_TRUE;
 			break;
-#ifdef	DEBUG
 		case 'z':
+			zonename = optarg;
+			break;
+#ifdef	DEBUG
+		case 'Z':
 			zflg = B_TRUE;
 			break;
 #endif	/* DEBUG */
@@ -371,7 +375,7 @@ main(int argc, char **argv)
 	 * requested was chosen, but that's too hard.
 	 */
 	if (!icapfile) {
-		use_kern_pf = open_datalink(&dh, datalink);
+		use_kern_pf = open_datalink(&dh, datalink, zonename);
 	} else {
 		use_kern_pf = B_FALSE;
 		cap_open_read(icapfile);
@@ -812,6 +816,8 @@ usage(void)
 	(void) fprintf(stderr,
 	"\t[ -r ]			# Do not resolve address to name\n");
 	(void) fprintf(stderr,
+	"\t[ -z zone ]		# Open links from named zone\n");
+	(void) fprintf(stderr,
 	"\n\t[ filter expression ]\n");
 	(void) fprintf(stderr, "\nExample:\n");
 	(void) fprintf(stderr, "\tsnoop -o saved  host fred\n\n");
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h
index e4f182572b..42095bcd34 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h
@@ -24,6 +24,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SNOOP_H
@@ -182,7 +183,7 @@ extern void cap_open_read(const char *);
 extern void cap_open_write(const char *);
 extern void cap_read(int, int, int, void (*)(), int);
 extern void cap_close(void);
-extern boolean_t open_datalink(dlpi_handle_t *, const char *);
+extern boolean_t open_datalink(dlpi_handle_t *, const char *, const char *);
 extern void init_datalink(dlpi_handle_t, ulong_t, ulong_t, struct timeval *,
     struct Pf_ext_packetfilt *);
 extern void net_read(dlpi_handle_t, size_t, int, void (*)(), int);
@@ -260,6 +261,7 @@ extern int interpret_socks_reply(int, char *, int);
 extern int interpret_trill(int, struct ether_header **, char *, int *);
 extern int interpret_isis(int, char *, int, boolean_t);
 extern int interpret_bpdu(int, char *, int);
+extern int interpret_vxlan(int, char *, int);
 extern void init_ldap(void);
 extern boolean_t arp_for_ether(char *, struct ether_addr *);
 extern char *ether_ouiname(uint32_t);
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_capture.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_capture.c
index ab6bc292ac..8fbf3fc15f 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_capture.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_capture.c
@@ -29,6 +29,7 @@
 #include <strings.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <limits.h>
 #include <setjmp.h>
 #include <sys/types.h>
 #include <sys/signal.h>
@@ -114,7 +115,7 @@ select_datalink(const char *linkname, void *arg)
  * about the datalink useful for building the proper packet filters.
  */
 boolean_t
-open_datalink(dlpi_handle_t *dhp, const char *linkname)
+open_datalink(dlpi_handle_t *dhp, const char *linkname, const char *zonename)
 {
 	int retval;
 	int flags = DLPI_PASSIVE | DLPI_RAW;
@@ -122,6 +123,9 @@ open_datalink(dlpi_handle_t *dhp, const char *linkname)
 	dlpi_info_t dlinfo;
 
 	if (linkname == NULL) {
+		if (zonename != NULL)
+			pr_err("a datalink must be specified with a zone name");
+
 		/*
 		 * Select a datalink to use by default.  Prefer datalinks that
 		 * are plumbed by IP.
@@ -145,7 +149,8 @@ open_datalink(dlpi_handle_t *dhp, const char *linkname)
 		flags |= DLPI_DEVIPNET;
 	if (Iflg || strcmp(linkname, "lo0") == 0)
 		flags |= DLPI_IPNETINFO;
-	if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
+	if ((retval = dlpi_open_zone(linkname, zonename, dhp,
+	    flags)) != DLPI_SUCCESS) {
 		pr_err("cannot open \"%s\": %s", linkname,
 		    dlpi_strerror(retval));
 	}
@@ -614,6 +619,10 @@ cap_open_read(const char *name)
 
 	if (fstat(capfile_in, &st) < 0)
 		pr_err("couldn't stat %s: %m", name);
+	if (st.st_size > INT_MAX)
+		pr_err("input file size (%llu bytes) exceeds maximum "
+		    "supported size (%d bytes)",
+		    (unsigned long long)st.st_size, INT_MAX);
 	cap_len = st.st_size;
 
 	cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_ether.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_ether.c
index 5c6bde0cd6..029ed66116 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_ether.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_ether.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #include <stdio.h>
@@ -54,8 +55,9 @@
 
 static headerlen_fn_t ether_header_len, fddi_header_len, tr_header_len,
     ib_header_len, ipnet_header_len, ipv4_header_len, ipv6_header_len;
-static interpreter_fn_t interpret_ether, interpret_fddi, interpret_tr,
+static interpreter_fn_t interpret_fddi, interpret_tr,
     interpret_ib, interpret_ipnet, interpret_iptun;
+interpreter_fn_t interpret_ether;
 static void addr_copy_swap(struct ether_addr *, struct ether_addr *);
 static int tr_machdr_len(char *, int *, int *);
 
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rport.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rport.c
index b84ee3c1b4..c2fcfd7c72 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rport.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rport.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #include <stdio.h>
@@ -76,6 +77,7 @@ static const struct porttable pt_udp[] = {
 	{ 560,			"RMONITOR" },
 	{ 561,			"MONITOR" },
 	{ IPPORT_SOCKS,		"SOCKS" },
+	{ IPPORT_VXLAN,		"VXLAN" },
 	{ 0,			NULL }
 };
 
@@ -428,6 +430,9 @@ interpret_reserved(int flags, int proto, in_port_t src, in_port_t dst,
 				(void) interpret_socks_reply(flags, data,
 				    dlen);
 			return (1);
+		case IPPORT_VXLAN:
+			(void) interpret_vxlan(flags, data, dlen);
+			return (1);
 		}
 	}
 
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_vxlan.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_vxlan.c
new file mode 100644
index 0000000000..36025ca8f3
--- /dev/null
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_vxlan.c
@@ -0,0 +1,68 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Decode VXLAN encapsulated packets.
+ */
+
+#include <sys/vxlan.h>
+#include "snoop.h"
+
+int
+interpret_vxlan(int flags, char *data, int fraglen)
+{
+	vxlan_hdr_t *vxlan = (vxlan_hdr_t *)data;
+	uint32_t id, vxf;
+
+	if (fraglen < sizeof (vxlan_hdr_t)) {
+		if (flags & F_SUM)
+			(void) snprintf(get_sum_line(), MAXLINE,
+			    "VXLAN RUNT");
+		if (flags & F_DTAIL)
+			show_header("VXLAN RUNT:  ", "Short packet", fraglen);
+
+		return (fraglen);
+	}
+
+	id = ntohl(vxlan->vxlan_id) >> VXLAN_ID_SHIFT;
+	vxf = ntohl(vxlan->vxlan_flags);
+
+	if (flags & F_SUM) {
+		(void) snprintf(get_sum_line(), MAXLINE,
+		    "VXLAN VNI=%d", id);
+	}
+
+	if (flags & F_DTAIL) {
+		show_header("VXLAN:  ", "VXLAN Header", sizeof (vxlan_hdr_t));
+		show_space();
+		(void) snprintf(get_line(0, 0), get_line_remain(),
+		    "Flags = 0x%08x", vxf);
+		(void) snprintf(get_line(0, 0), get_line_remain(), "      %s",
+		    getflag(vxf >> 24, VXLAN_F_VDI >> 24, "vni present",
+		    "vni missing"));
+		(void) snprintf(get_line(0, 0), get_line_remain(),
+		    "VXLAN network id (VNI) = %d", id);
+		show_space();
+	}
+
+	if (flags & (F_DTAIL | F_ALLSUM)) {
+		fraglen -= sizeof (vxlan_hdr_t);
+		data += sizeof (vxlan_hdr_t);
+
+		return (interpret_ether(flags, data, fraglen, fraglen));
+	}
+
+	return (0);
+}
diff --git a/usr/src/cmd/column/Makefile b/usr/src/cmd/column/Makefile
new file mode 100644
index 0000000000..ab4cf3390e
--- /dev/null
+++ b/usr/src/cmd/column/Makefile
@@ -0,0 +1,43 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2013 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+PROG=column
+
+include ../Makefile.cmd
+
+CFLAGS += $(CCVERBOSE)
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all $(ROOTPROG)
+
+clean:
+
+lint:	lint_PROG
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/column/THIRDPARTYLICENSE b/usr/src/cmd/column/THIRDPARTYLICENSE
new file mode 100644
index 0000000000..a80f56cb43
--- /dev/null
+++ b/usr/src/cmd/column/THIRDPARTYLICENSE
@@ -0,0 +1,26 @@
+Copyright (c) 1989, 1993, 1994
+     The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+4. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+ *
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
diff --git a/usr/src/cmd/column/THIRDPARTYLICENSE.descrip b/usr/src/cmd/column/THIRDPARTYLICENSE.descrip
new file mode 100644
index 0000000000..42051a2982
--- /dev/null
+++ b/usr/src/cmd/column/THIRDPARTYLICENSE.descrip
@@ -0,0 +1 @@
+PORTIONS OF COLUMN COMMAND FUNCTIONALITY
diff --git a/usr/src/cmd/column/column.c b/usr/src/cmd/column/column.c
new file mode 100644
index 0000000000..4f9a3c81a6
--- /dev/null
+++ b/usr/src/cmd/column/column.c
@@ -0,0 +1,335 @@
+/*
+ * Copyright (c) 1989, 1993, 1994
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * Portions Copyright (c) 2013  Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef lint
+static const char copyright[] =
+"@(#) Copyright (c) 1989, 1993, 1994\n\
+	The Regents of the University of California.  All rights reserved.\n";
+#endif
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/param.h>
+#include <sys/termios.h>
+
+#include <err.h>
+#include <limits.h>
+#include <locale.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <wchar.h>
+#include <wctype.h>
+
+#define	TAB	8
+#define	roundup(x, y)   ((((x)+((y)-1))/(y))*(y))  /* to any y */
+
+static void	c_columnate(void);
+static void	input(FILE *);
+static void	maketbl(void);
+static void	print(void);
+static void	r_columnate(void);
+static void	usage(void);
+static int	width(const wchar_t *);
+
+static int	termwidth = 80;		/* default terminal width */
+
+static int	entries;		/* number of records */
+static int	eval;			/* exit value */
+static int	maxlength;		/* longest record */
+static wchar_t	**list;			/* array of pointers to records */
+static const wchar_t *separator = L"\t "; /* field separator for table option */
+
+int
+main(int argc, char **argv)
+{
+	struct winsize win;
+	FILE *fp;
+	int ch, tflag, xflag;
+	char *p;
+	const char *src;
+	wchar_t *newsep;
+	size_t seplen;
+
+	(void) setlocale(LC_ALL, "");
+
+	if (ioctl(1, TIOCGWINSZ, &win) == -1 || !win.ws_col) {
+		if ((p = getenv("COLUMNS")))
+			termwidth = atoi(p);
+	} else
+		termwidth = win.ws_col;
+
+	tflag = xflag = 0;
+	while ((ch = getopt(argc, argv, "c:s:tx")) != -1)
+		switch (ch) {
+		case 'c':
+			termwidth = atoi(optarg);
+			break;
+		case 's':
+			src = optarg;
+			seplen = mbsrtowcs(NULL, &src, 0, NULL);
+			if (seplen == (size_t)-1)
+				err(1, "bad separator");
+			newsep = malloc((seplen + 1) * sizeof (wchar_t));
+			if (newsep == NULL)
+				err(1, NULL);
+			(void) mbsrtowcs(newsep, &src, seplen + 1, NULL);
+			separator = newsep;
+			break;
+		case 't':
+			tflag = 1;
+			break;
+		case 'x':
+			xflag = 1;
+			break;
+		case '?':
+		default:
+			usage();
+		}
+	argc -= optind;
+	argv += optind;
+
+	if (!*argv)
+		input(stdin);
+	else for (; *argv; ++argv)
+		if ((fp = fopen(*argv, "rF"))) {
+			input(fp);
+			(void) fclose(fp);
+		} else {
+			warn("%s", *argv);
+			eval = 1;
+		}
+
+	if (!entries)
+		exit(eval);
+
+	maxlength = roundup(maxlength + 1, TAB);
+	if (tflag)
+		maketbl();
+	else if (maxlength >= termwidth)
+		print();
+	else if (xflag)
+		c_columnate();
+	else
+		r_columnate();
+	exit(eval);
+
+	/*NOTREACHED*/
+	return (eval);
+}
+
+static void
+c_columnate(void)
+{
+	int chcnt, col, cnt, endcol, numcols;
+	wchar_t **lp;
+
+	numcols = termwidth / maxlength;
+	endcol = maxlength;
+	for (chcnt = col = 0, lp = list; ; ++lp) {
+		(void) wprintf(L"%ls", *lp);
+		chcnt += width(*lp);
+		if (!--entries)
+			break;
+		if (++col == numcols) {
+			chcnt = col = 0;
+			endcol = maxlength;
+			(void) putwchar('\n');
+		} else {
+			while ((cnt = roundup(chcnt + 1, TAB)) <= endcol) {
+				(void) putwchar('\t');
+				chcnt = cnt;
+			}
+			endcol += maxlength;
+		}
+	}
+	if (chcnt)
+		(void) putwchar('\n');
+}
+
+static void
+r_columnate(void)
+{
+	int base, chcnt, cnt, col, endcol, numcols, numrows, row;
+
+	numcols = termwidth / maxlength;
+	numrows = entries / numcols;
+	if (entries % numcols)
+		++numrows;
+
+	for (row = 0; row < numrows; ++row) {
+		endcol = maxlength;
+		for (base = row, chcnt = col = 0; col < numcols; ++col) {
+			(void) wprintf(L"%ls", list[base]);
+			chcnt += width(list[base]);
+			if ((base += numrows) >= entries)
+				break;
+			while ((cnt = roundup(chcnt + 1, TAB)) <= endcol) {
+				(void) putwchar('\t');
+				chcnt = cnt;
+			}
+			endcol += maxlength;
+		}
+		(void) putwchar('\n');
+	}
+}
+
+static void
+print(void)
+{
+	int cnt;
+	wchar_t **lp;
+
+	for (cnt = entries, lp = list; cnt--; ++lp)
+		(void) wprintf(L"%ls\n", *lp);
+}
+
+typedef struct _tbl {
+	wchar_t **list;
+	int cols, *len;
+} TBL;
+#define	DEFCOLS	25
+
+static void
+maketbl(void)
+{
+	TBL *t;
+	int coloff, cnt;
+	wchar_t *p, **lp;
+	int *lens, maxcols;
+	TBL *tbl;
+	wchar_t **cols;
+	wchar_t *last;
+
+	if ((t = tbl = calloc(entries, sizeof (TBL))) == NULL)
+		err(1, (char *)NULL);
+	if ((cols = calloc((maxcols = DEFCOLS), sizeof (*cols))) == NULL)
+		err(1, (char *)NULL);
+	if ((lens = calloc(maxcols, sizeof (int))) == NULL)
+		err(1, (char *)NULL);
+	for (cnt = 0, lp = list; cnt < entries; ++cnt, ++lp, ++t) {
+		for (coloff = 0, p = *lp;
+		    (cols[coloff] = wcstok(p, separator, &last));
+		    p = NULL)
+			if (++coloff == maxcols) {
+				if (!(cols = realloc(cols, ((uint_t)maxcols +
+				    DEFCOLS) * sizeof (char *))) ||
+				    !(lens = realloc(lens,
+				    ((uint_t)maxcols + DEFCOLS) *
+				    sizeof (int))))
+					err(1, NULL);
+				(void) memset((char *)lens + maxcols *
+				    sizeof (int), 0, DEFCOLS * sizeof (int));
+				maxcols += DEFCOLS;
+			}
+		if ((t->list = calloc(coloff, sizeof (*t->list))) == NULL)
+			err(1, (char *)NULL);
+		if ((t->len = calloc(coloff, sizeof (int))) == NULL)
+			err(1, (char *)NULL);
+		for (t->cols = coloff; --coloff >= 0; ) {
+			t->list[coloff] = cols[coloff];
+			t->len[coloff] = width(cols[coloff]);
+			if (t->len[coloff] > lens[coloff])
+				lens[coloff] = t->len[coloff];
+		}
+	}
+	for (cnt = 0, t = tbl; cnt < entries; ++cnt, ++t) {
+		for (coloff = 0; coloff < t->cols  - 1; ++coloff)
+			(void) wprintf(L"%ls%*ls", t->list[coloff],
+			    lens[coloff] - t->len[coloff] + 2, L" ");
+		(void) wprintf(L"%ls\n", t->list[coloff]);
+	}
+}
+
+#define	DEFNUM		1000
+#define	MAXLINELEN	(LINE_MAX + 1)
+
+static void
+input(FILE *fp)
+{
+	static int maxentry;
+	int len;
+	wchar_t *p, buf[MAXLINELEN];
+
+	if (!list)
+		if ((list = calloc((maxentry = DEFNUM), sizeof (*list))) ==
+		    NULL)
+			err(1, (char *)NULL);
+	while (fgetws(buf, MAXLINELEN, fp)) {
+		for (p = buf; *p && iswspace(*p); ++p)
+			;
+		if (!*p)
+			continue;
+		if (!(p = wcschr(p, L'\n'))) {
+			warnx("line too long");
+			eval = 1;
+			continue;
+		}
+		*p = L'\0';
+		len = width(buf);
+		if (maxlength < len)
+			maxlength = len;
+		if (entries == maxentry) {
+			maxentry += DEFNUM;
+			if (!(list = realloc(list,
+			    (uint_t)maxentry * sizeof (*list))))
+				err(1, NULL);
+		}
+		list[entries] = malloc((wcslen(buf) + 1) * sizeof (wchar_t));
+		if (list[entries] == NULL)
+			err(1, NULL);
+		(void) wcscpy(list[entries], buf);
+		entries++;
+	}
+}
+
+/* Like wcswidth(), but ignores non-printing characters. */
+static int
+width(const wchar_t *wcs)
+{
+	int w, cw;
+
+	for (w = 0; *wcs != L'\0'; wcs++)
+		if ((cw = wcwidth(*wcs)) > 0)
+			w += cw;
+	return (w);
+}
+
+static void
+usage(void)
+{
+
+	(void) fprintf(stderr,
+	    "usage: column [-tx] [-c columns] [-s sep] [file ...]\n");
+	exit(1);
+}
diff --git a/usr/src/cmd/coreadm/coreadm.c b/usr/src/cmd/coreadm/coreadm.c
index 9ce0f27651..f47f595ca3 100644
--- a/usr/src/cmd/coreadm/coreadm.c
+++ b/usr/src/cmd/coreadm/coreadm.c
@@ -21,6 +21,8 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 #include <stdio.h>
@@ -243,6 +245,12 @@ main(int argc, char **argv)
 		    command);
 		usage();
 	}
+	if (glob_pattern != NULL && glob_pattern[0] != '/') {
+		(void) fprintf(stderr, gettext(
+		    "%s: The -g option must specify an absolute path\n"),
+		    command);
+		usage();
+	}
 	if ((proc_pattern != NULL || proc_content != CC_CONTENT_INVALID) &&
 	    npids == 0) {
 		(void) sprintf(curpid, "%u", (uint_t)getppid());
diff --git a/usr/src/cmd/coreadm/coreadm.xml b/usr/src/cmd/coreadm/coreadm.xml
index 46a4cda17a..28f1e27240 100644
--- a/usr/src/cmd/coreadm/coreadm.xml
+++ b/usr/src/cmd/coreadm/coreadm.xml
@@ -48,14 +48,6 @@
 		<service_fmri value='svc:/system/filesystem/minimal' />
 	</dependency>
 
-	<dependency
-		name='coreadm_manifest-import'
-		type='service'
-		grouping='require_all'
-		restart_on='none'>
-		<service_fmri value='svc:/system/manifest-import:default' />
-	</dependency>
-
 	<instance name='default' enabled='false'>
 		<exec_method
 			type='method'
diff --git a/usr/src/cmd/cron/Makefile b/usr/src/cmd/cron/Makefile
index 2875e0dece..13f825bd7a 100644
--- a/usr/src/cmd/cron/Makefile
+++ b/usr/src/cmd/cron/Makefile
@@ -26,6 +26,7 @@
 DEFAULTFILES =	cron.dfl
 
 include		../Makefile.cmd
+include		../Makefile.ctf
 
 MANIFEST =	cron.xml
 
@@ -96,20 +97,20 @@ XPG4ATOBJS=	$(ATOBJS:%=objs.xpg4/%) $(XPG4OBJS:%=objs.xpg4/%)
 XPG6COMMONOBJS=	$(COMMONOBJS:%=objs.xpg6/%)
 XPG6CTOBJS=	$(CRONTABOBJS:%=objs.xpg6/%)
 
-cron :=		POBJS = $(CRONOBJS) $(COMMONOBJ2)
-at :=		POBJS = $(ATOBJS) $(COMMONOBJS)
-at.xpg4 :=	POBJS = $(XPG4ATOBJS) $(XPG4COMMONOBJS)
-atrm :=		POBJS = $(ATRMOBJS) $(COMMONOBJS)
-atq :=		POBJS = $(ATQOBJS) $(COMMONOBJS)
-crontab :=	POBJS = $(CRONTABOBJS) $(COMMONOBJS)
-crontab.xpg4 :=	POBJS = $(XPG4CTOBJS) $(XPG4COMMONOBJS)
-crontab.xpg6 :=	POBJS = $(XPG6CTOBJS) $(XPG6COMMONOBJS)
+cron :=		OBJS = $(CRONOBJS) $(COMMONOBJ2)
+at :=		OBJS = $(ATOBJS) $(COMMONOBJS)
+at.xpg4 :=	OBJS = $(XPG4ATOBJS) $(XPG4COMMONOBJS)
+atrm :=		OBJS = $(ATRMOBJS) $(COMMONOBJS)
+atq :=		OBJS = $(ATQOBJS) $(COMMONOBJS)
+crontab :=	OBJS = $(CRONTABOBJS) $(COMMONOBJS)
+crontab.xpg4 :=	OBJS = $(XPG4CTOBJS) $(XPG4COMMONOBJS)
+crontab.xpg6 :=	OBJS = $(XPG6CTOBJS) $(XPG6COMMONOBJS)
 
 CFLAGS += $(CCVERBOSE)
 
 NOBJS=		$(CRONOBJS) $(ATOBJS) $(ATRMOBJS1) $(ATQOBJS) $(CRONTABOBJS1) \
 		$(COMMONOBJS)
-OBJS =		$(NOBJS) $(XPG4COMMONOBJS) $(XPG4ATOBJS) $(XPG4CTOBJS) \
+COBJS =		$(NOBJS) $(XPG4COMMONOBJS) $(XPG4ATOBJS) $(XPG4CTOBJS) \
 		$(XPG6COMMONOBJS) $(XPG6CTOBJS) $(GETRESPOBJ)
 
 SRCS =		$(NOBJS:%.o=%.c) $(GETRESPSRC)
@@ -157,32 +158,35 @@ all :		$(PROG) $(XPG4) $(XPG6) $(SCRIPT) $(XPG4SCRIPT) $(FILES)
 install :	all $(ROOTPROG) $(ROOTETCDEFAULTFILES) $(ROOTSYMLINK) \
 		$(ROOTMANIFEST) $(ROOTMETHOD)
 
-$(PROG) :	$$(POBJS)
-		$(LINK.c) $(POBJS) -o $@ $(LDLIBS)
+$(PROG) :	$$(OBJS)
+		$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
 		$(POST_PROCESS)
 
-$(XPG4) :	objs.xpg4 $$(POBJS)
-		$(LINK.c) $(POBJS) -o $@ $(LDLIBS)
+$(XPG4) :	objs.xpg4 $$(OBJS)
+		$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
 		$(POST_PROCESS)
 
-$(XPG6) :	objs.xpg6 $$(POBJS)
-		$(LINK.c) $(POBJS) -o $@ $(LDLIBS)
+$(XPG6) :	objs.xpg6 $$(OBJS)
+		$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
 		$(POST_PROCESS)
 
 objs.xpg6/%.o:		%.c
 	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
 
 objs.xpg6:
 	-@mkdir -p $@
 
 objs.xpg4/%.o:		%.c
 	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
 
 objs.xpg4:
 	-@mkdir -p $@
 
 objs.xpg4/values-xpg4.o:	../../lib/crt/common/values-xpg4.c
 	$(COMPILE.c) -o $@ ../../lib/crt/common/values-xpg4.c
+	$(POST_PROCESS_O)
 
 %.o:			$(SRC)/common/util/%.c
 	$(COMPILE.c) $(OUTPUT_OPTION) $<
@@ -219,7 +223,7 @@ $(POFILE):	$(POFILES)
 	$(RM) $@; cat $(POFILES) > $@
 
 clean :
-		$(RM) $(OBJS) att1.h att1.c att2.c
+		$(RM) $(COBJS) att1.h att1.c att2.c
 
 lint :		lint_SRCS
 
diff --git a/usr/src/cmd/cron/cron.c b/usr/src/cmd/cron/cron.c
index 55df389cd7..e2c9086536 100644
--- a/usr/src/cmd/cron/cron.c
+++ b/usr/src/cmd/cron/cron.c
@@ -23,7 +23,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2013 Joshua M. Clulow <josh@sysmgr.org>
- *
+ * Copyright 2013 Joyent, Inc.  All rights reserved.
  * Copyright (c) 2014 Gary Mills
  * Copyright (c) 2016 by Delphix. All rights reserved.
  */
@@ -316,7 +316,8 @@ static int ex(struct event *e);
 static void read_dirs(int);
 static void mail(char *, char *, int);
 static char *next_field(int, int);
-static void readcron(struct usr *, time_t);
+static void readcron(char *, struct usr *, time_t);
+static void readcronfile(FILE *, struct usr *, time_t);
 static int next_ge(int, char *);
 static void free_if_unused(struct usr *);
 static void del_atjob(char *, char *);
@@ -421,7 +422,7 @@ extern void el_delete(void);
 
 static int valid_entry(char *, int);
 static struct usr *create_ulist(char *, int);
-static void init_cronevent(char *, int);
+static void init_cronevent(char *, char *);
 static void init_atevent(char *, time_t, int, int);
 static void update_atevent(struct usr *, char *, time_t, int);
 
@@ -760,6 +761,18 @@ read_dirs(int first)
 	time_t		tim;
 
 
+	if (chdir(SYSCRONDIR) != -1) {
+		cwd = CRON;
+		if ((dir = opendir(".")) != NULL) {
+			while ((dp = readdir(dir)) != NULL) {
+				if (!valid_entry(dp->d_name, CRONEVENT))
+					continue;
+				init_cronevent(SYSCRONDIR, dp->d_name);
+			}
+			(void) closedir(dir);
+		}
+	}
+
 	if (chdir(CRONDIR) == -1)
 		crabort(BADCD, REMOVE_FIFO|CONSOLE_MSG);
 	cwd = CRON;
@@ -768,7 +781,7 @@ read_dirs(int first)
 	while ((dp = readdir(dir)) != NULL) {
 		if (!valid_entry(dp->d_name, CRONEVENT))
 			continue;
-		init_cronevent(dp->d_name, first);
+		init_cronevent(CRONDIR, dp->d_name);
 	}
 	(void) closedir(dir);
 
@@ -854,23 +867,18 @@ create_ulist(char *name, int type)
 }
 
 void
-init_cronevent(char *name, int first)
+init_cronevent(char *basedir, char *name)
 {
 	struct usr	*u;
 
-	if (first) {
+	if ((u = find_usr(name)) == NULL) {
 		u = create_ulist(name, CRONEVENT);
-		readcron(u, 0);
+		readcron(basedir, u, 0);
 	} else {
-		if ((u = find_usr(name)) == NULL) {
-			u = create_ulist(name, CRONEVENT);
-			readcron(u, 0);
-		} else {
-			u->ctexists = TRUE;
-			rm_ctevents(u);
-			el_remove(u->ctid, 0);
-			readcron(u, 0);
-		}
+		u->ctexists = TRUE;
+		rm_ctevents(u);
+		el_remove(u->ctid, 0);
+		readcron(basedir, u, 0);
 	}
 }
 
@@ -951,7 +959,7 @@ mod_ctab(char *name, time_t reftime)
 		(void) strcpy(u->home, pw->pw_dir);
 		u->uid = pw->pw_uid;
 		u->gid = pw->pw_gid;
-		readcron(u, reftime);
+		readcron(CRONDIR, u, reftime);
 	} else {
 		u->uid = pw->pw_uid;
 		u->gid = pw->pw_gid;
@@ -974,7 +982,7 @@ mod_ctab(char *name, time_t reftime)
 			/* user didnt have a crontab last time */
 			u->ctid = ecid++;
 			u->ctevents = NULL;
-			readcron(u, reftime);
+			readcron(CRONDIR, u, reftime);
 			return;
 		}
 #ifdef DEBUG
@@ -982,7 +990,7 @@ mod_ctab(char *name, time_t reftime)
 #endif
 		rm_ctevents(u);
 		el_remove(u->ctid, 0);
-		readcron(u, reftime);
+		readcron(CRONDIR, u, reftime);
 	}
 }
 
@@ -1117,8 +1125,94 @@ update_atevent(struct usr *u, char *name, time_t tim, int jobtype)
 static char line[CTLINESIZE];	/* holds a line from a crontab file */
 static int cursor;		/* cursor for the above line */
 
+static int
+copyfile(char *name, FILE *dp)
+{
+	FILE *tf;
+
+	if ((tf = fopen(name, "r")) == NULL) {
+		(void) fclose(dp);
+		return (1);
+	}
+
+	while (fgets(line, CTLINESIZE, tf) != NULL) {
+		if (fputs(line, dp) == EOF) {
+			(void) fclose(tf);
+			(void) fclose(dp);
+			return (1);
+		}
+	}
+	(void) fclose(tf);
+
+	return (0);
+}
+
+static void
+readcron(char *basedir, struct usr *u, time_t reftime)
+{
+	char *altpath;
+	struct stat sb;
+	FILE *cf;	/* cf will be a user's crontab file */
+	char altnamebuf[PATH_MAX];
+	char namebuf[PATH_MAX];
+
+	if (strcmp(basedir, SYSCRONDIR) == 0)
+		altpath = CRONDIR;
+	else
+		altpath = SYSCRONDIR;
+
+	if (snprintf(altnamebuf, sizeof (altnamebuf), "%s/%s", altpath,
+	    u->name) >= sizeof (altnamebuf))
+		return;
+
+	if (snprintf(namebuf, sizeof (namebuf), "%s/%s", basedir, u->name) >=
+	    sizeof (namebuf))
+		return;
+
+	if (stat(altnamebuf, &sb) != -1) {
+		/*
+		 * There is a secondary crontab for this user.  We need to
+		 * merge the two crontabs into a temporary file for loading.
+		 */
+		int fd;
+		char tmpfile[PATH_MAX];
+
+		(void) strlcpy(tmpfile, "/tmp/cronXXXXXX", sizeof (tmpfile));
+		if ((fd = mkstemp(tmpfile)) == -1)
+			return;
+
+		unlink(tmpfile);
+		if ((cf = fdopen(fd, "w+")) == NULL) {
+			close(fd);
+			return;
+		}
+
+		if (copyfile(namebuf, cf) != 0)
+			return;
+
+		if (copyfile(altnamebuf, cf) != 0)
+			return;
+
+		(void) fflush(cf);
+		rewind(cf);
+
+	} else {
+		/*
+		 * Only one crontab, open it directly.
+		 */
+		if ((cf = fopen(namebuf, "r")) == NULL) {
+			mail(u->name, NOREAD, ERR_UNIXERR);
+			return;
+		}
+	}
+
+	readcronfile(cf, u, reftime);
+
+	(void) fclose(cf);
+}
+
 static void
-readcron(struct usr *u, time_t reftime)
+readcronfile(FILE *cf, struct usr *u, time_t reftime)
 {
 	/*
 	 * readcron reads in a crontab file for a user (u). The list of
@@ -1126,12 +1220,9 @@ readcron(struct usr *u, time_t reftime)
 	 * this list. Each event is also entered into the main event
 	 * list.
 	 */
-	FILE *cf;	/* cf will be a user's crontab file */
 	struct event *e;
 	int start;
 	unsigned int i;
-	char namebuf[PATH_MAX];
-	char *pname;
 	struct shared *tz = NULL;
 	struct shared *home = NULL;
 	struct shared *shell = NULL;
@@ -1139,19 +1230,6 @@ readcron(struct usr *u, time_t reftime)
 
 	/* read the crontab file */
 	cte_init();		/* Init error handling */
-	if (cwd != CRON) {
-		if (snprintf(namebuf, sizeof (namebuf), "%s/%s",
-		    CRONDIR, u->name) >= sizeof (namebuf)) {
-			return;
-		}
-		pname = namebuf;
-	} else {
-		pname = u->name;
-	}
-	if ((cf = fopen(pname, "r")) == NULL) {
-		mail(u->name, NOREAD, ERR_UNIXERR);
-		return;
-	}
 	while (fgets(line, CTLINESIZE, cf) != NULL) {
 		char *tmp;
 		/* process a line of a crontab file */
@@ -1280,7 +1358,6 @@ again:
 #endif
 	}
 	cte_sendmail(u->name);	/* mail errors if any to user */
-	(void) fclose(cf);
 	rel_shared(tz);
 	rel_shared(shell);
 	rel_shared(home);
@@ -2443,6 +2520,9 @@ ex(struct event *e)
 	} else {
 		r = audit_cron_session(e->u->name, CRONDIR,
 		    e->u->uid, e->u->gid, NULL);
+		if (r != 0)
+			r = audit_cron_session(e->u->name, SYSCRONDIR,
+			    e->u->uid, e->u->gid, NULL);
 	}
 	if (r != 0) {
 		msg("cron audit problem. job failed (%s) for user %s",
diff --git a/usr/src/cmd/cron/cron.h b/usr/src/cmd/cron/cron.h
index a76016299c..93e21e7b41 100644
--- a/usr/src/cmd/cron/cron.h
+++ b/usr/src/cmd/cron/cron.h
@@ -71,6 +71,9 @@ struct	message {
 	char	logname[LLEN];
 };
 
+/* anything below here can be changed */
+
+#define	SYSCRONDIR	"/etc/cron.d/crontabs"
 #define	CRONDIR		"/var/spool/cron/crontabs"
 #define	ATDIR		"/var/spool/cron/atjobs"
 #define	ACCTFILE	"/var/cron/log"
diff --git a/usr/src/cmd/cron/crontab.c b/usr/src/cmd/cron/crontab.c
index 327a71388b..cdb4e1e394 100644
--- a/usr/src/cmd/cron/crontab.c
+++ b/usr/src/cmd/cron/crontab.c
@@ -71,7 +71,7 @@
 	"usage:\n"			\
 	"\tcrontab [file]\n"		\
 	"\tcrontab -e [username]\n"	\
-	"\tcrontab -l [username]\n"	\
+	"\tcrontab -l [-g] [username]\n"	\
 	"\tcrontab -r [username]"
 #define	INVALIDUSER	"you are not a valid user (no entry in /etc/passwd)."
 #define	NOTALLOWED	"you are not authorized to use cron.  Sorry."
@@ -120,6 +120,7 @@ main(int argc, char **argv)
 	int	c, r;
 	int	rflag	= 0;
 	int	lflag	= 0;
+	int	gflag	= 0;
 	int	eflag	= 0;
 	int	errflg	= 0;
 	char *pp;
@@ -151,11 +152,14 @@ main(int argc, char **argv)
 		exit(1);
 	}
 
-	while ((c = getopt(argc, argv, "elr")) != EOF)
+	while ((c = getopt(argc, argv, "eglr")) != EOF)
 		switch (c) {
 			case 'e':
 				eflag++;
 				break;
+			case 'g':
+				gflag++;
+				break;
 			case 'l':
 				lflag++;
 				break;
@@ -170,6 +174,9 @@ main(int argc, char **argv)
 	if (eflag + lflag + rflag > 1)
 		errflg++;
 
+	if (gflag && !lflag)
+		errflg++;
+
 	argc -= optind;
 	argv += optind;
 	if (errflg || argc > 1)
@@ -236,12 +243,27 @@ main(int argc, char **argv)
 		exit(0);
 	}
 	if (lflag) {
-		if ((fp = fopen(cf, "r")) == NULL)
-			crabort(BADOPEN);
-		while (fgets(line, CTLINESIZE, fp) != NULL)
-			fputs(line, stdout);
-		fclose(fp);
-		exit(0);
+		char sysconf[PATH_MAX];
+
+		if (gflag) {
+			if (snprintf(sysconf, sizeof (sysconf), "%s/%s",
+			    SYSCRONDIR, login) < sizeof (sysconf) &&
+			    (fp = fopen(sysconf, "r")) != NULL) {
+				while (fgets(line, CTLINESIZE, fp) != NULL)
+					fputs(line, stdout);
+				fclose(fp);
+				exit(0);
+			} else {
+				crabort(BADOPEN);
+			}
+		} else {
+			if ((fp = fopen(cf, "r")) == NULL)
+				crabort(BADOPEN);
+			while (fgets(line, CTLINESIZE, fp) != NULL)
+				fputs(line, stdout);
+			fclose(fp);
+			exit(0);
+		}
 	}
 	if (eflag) {
 		if ((fp = fopen(cf, "r")) == NULL) {
diff --git a/usr/src/cmd/ctfconvert/Makefile b/usr/src/cmd/ctfconvert/Makefile
new file mode 100644
index 0000000000..688addd9d1
--- /dev/null
+++ b/usr/src/cmd/ctfconvert/Makefile
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc.
+#
+
+PROG= ctfconvert
+
+include ../Makefile.cmd
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf -lelf
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all $(ROOTPROG)
+
+clean:
+
+lint:	lint_PROG
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/ctfconvert/ctfconvert.c b/usr/src/cmd/ctfconvert/ctfconvert.c
new file mode 100644
index 0000000000..a4394c3ec8
--- /dev/null
+++ b/usr/src/cmd/ctfconvert/ctfconvert.c
@@ -0,0 +1,389 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
+
+/*
+ * Create CTF from extant debugging information
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <libelf.h>
+#include <libctf.h>
+#include <string.h>
+#include <libgen.h>
+#include <limits.h>
+#include <strings.h>
+#include <sys/debug.h>
+
+#define	CTFCONVERT_OK		0
+#define	CTFCONVERT_FATAL	1
+#define	CTFCONVERT_USAGE	2
+
+#define	CTFCONVERT_DEFAULT_NTHREADS	4
+
+#define	CTFCONVERT_ALTEXEC	"CTFCONVERT_ALTEXEC"
+
+static char *ctfconvert_progname;
+
+static void
+ctfconvert_fatal(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void) fprintf(stderr, "%s: ", ctfconvert_progname);
+	va_start(ap, fmt);
+	(void) vfprintf(stderr, fmt, ap);
+	va_end(ap);
+
+	exit(CTFCONVERT_FATAL);
+}
+
+
+static void
+ctfconvert_usage(const char *fmt, ...)
+{
+	if (fmt != NULL) {
+		va_list ap;
+
+		(void) fprintf(stderr, "%s: ", ctfconvert_progname);
+		va_start(ap, fmt);
+		(void) vfprintf(stderr, fmt, ap);
+		va_end(ap);
+	}
+
+	(void) fprintf(stderr, "Usage: %s [-is] [-j nthrs] [-l label | "
+	    "-L labelenv] [-o outfile] input\n"
+	    "\n"
+	    "\t-i  ignore files not built partially from C sources\n"
+	    "\t-j  use nthrs threads to perform the merge\n"
+	    "\t-k  keep around original input file on failure\n"
+	    "\t-o  copy input to outfile and add CTF\n"
+	    "\t-l  set output container's label to specified value\n"
+	    "\t-L  set output container's label to value from environment\n",
+	    ctfconvert_progname);
+}
+
+/*
+ * This is a bit unfortunate. Traditionally we do type uniquification across all
+ * modules in the kernel, including ip and unix against genunix. However, when
+ * _MACHDEP is defined, then the cpu_t ends up having an additional member
+ * (cpu_m), thus changing the ability for us to uniquify against it. This in
+ * turn causes a lot of type sprawl, as there's a lot of things that end up
+ * referring to the cpu_t and it chains out from there.
+ *
+ * So, if we find that a cpu_t has been defined and it has a couple of useful
+ * sentinel members and it does *not* have the cpu_m member, then we will try
+ * and lookup or create a forward declaration to the machcpu, append it to the
+ * end, and update the file.
+ *
+ * This currently is only invoked if an undocumented option -X is passed. This
+ * value is private to illumos and it can be changed at any time inside of it,
+ * so if -X wants to be used for something, it should be. The ability to rely on
+ * -X for others is strictly not an interface in any way, shape, or form.
+ *
+ * The following struct contains most of the information that we care about and
+ * that we want to validate exists before we decide what to do.
+ */
+
+typedef struct ctfconvert_fixup {
+	boolean_t	cf_cyclic;	/* Do we have a cpu_cyclic member */
+	boolean_t	cf_mcpu;	/* We have a cpu_m member */
+	boolean_t	cf_lastpad;	/* Is the pad member the last entry */
+	ulong_t		cf_padoff;	/* offset of the pad */
+} ctfconvert_fixup_t;
+
+/* ARGSUSED */
+static int
+ctfconvert_fixup_genunix_cb(const char *name, ctf_id_t tid, ulong_t off,
+    void *arg)
+{
+	ctfconvert_fixup_t *cfp = arg;
+
+	cfp->cf_lastpad = B_FALSE;
+	if (strcmp(name, "cpu_cyclic") == 0) {
+		cfp->cf_cyclic = B_TRUE;
+		return (0);
+	}
+
+	if (strcmp(name, "cpu_m") == 0) {
+		cfp->cf_mcpu = B_TRUE;
+		return (0);
+	}
+
+	if (strcmp(name, "cpu_m_pad") == 0) {
+		cfp->cf_lastpad = B_TRUE;
+		cfp->cf_padoff = off;
+		return (0);
+	}
+
+	return (0);
+}
+
+static void
+ctfconvert_fixup_genunix(ctf_file_t *fp)
+{
+	ctf_id_t cpuid, mcpu;
+	ssize_t sz;
+	ctfconvert_fixup_t cf;
+	int model, ptrsz;
+
+	cpuid = ctf_lookup_by_name(fp, "struct cpu");
+	if (cpuid == CTF_ERR)
+		return;
+
+	if (ctf_type_kind(fp, cpuid) != CTF_K_STRUCT)
+		return;
+
+	if ((sz = ctf_type_size(fp, cpuid)) == CTF_ERR)
+		return;
+
+	model = ctf_getmodel(fp);
+	VERIFY(model == CTF_MODEL_ILP32 || model == CTF_MODEL_LP64);
+	ptrsz = model == CTF_MODEL_ILP32 ? 4 : 8;
+
+	bzero(&cf, sizeof (ctfconvert_fixup_t));
+	if (ctf_member_iter(fp, cpuid, ctfconvert_fixup_genunix_cb, &cf) ==
+	    CTF_ERR)
+		return;
+
+	/*
+	 * Finally, we want to verify that the cpu_m is actually the last member
+	 * that we have here.
+	 */
+	if (cf.cf_cyclic == B_FALSE || cf.cf_mcpu == B_TRUE ||
+	    cf.cf_lastpad == B_FALSE) {
+		return;
+	}
+
+	if (cf.cf_padoff + ptrsz * NBBY != sz * NBBY) {
+		return;
+	}
+
+	/*
+	 * Okay, we're going to do this, try to find a struct machcpu. We either
+	 * want a forward or a struct. If we find something else, error. If we
+	 * find nothing, add a forward and then add the member.
+	 */
+	mcpu = ctf_lookup_by_name(fp, "struct machcpu");
+	if (mcpu == CTF_ERR) {
+		mcpu = ctf_add_forward(fp, CTF_ADD_NONROOT, "machcpu",
+		    CTF_K_STRUCT);
+		if (mcpu == CTF_ERR) {
+			ctfconvert_fatal("failed to add 'struct machcpu' "
+			    "forward: %s", ctf_errmsg(ctf_errno(fp)));
+		}
+	} else {
+		int kind;
+		if ((kind = ctf_type_kind(fp, mcpu)) == CTF_ERR) {
+			ctfconvert_fatal("failed to get the type kind for "
+			    "the struct machcpu: %s",
+			    ctf_errmsg(ctf_errno(fp)));
+		}
+
+		if (kind != CTF_K_STRUCT && kind != CTF_K_FORWARD)
+			ctfconvert_fatal("encountered a struct machcpu of the "
+			    "wrong type, found type kind %d\n", kind);
+	}
+
+	if (ctf_update(fp) == CTF_ERR) {
+		ctfconvert_fatal("failed to update output file: %s\n",
+		    ctf_errmsg(ctf_errno(fp)));
+	}
+
+	if (ctf_add_member(fp, cpuid, "cpu_m", mcpu, sz * NBBY) == CTF_ERR) {
+		ctfconvert_fatal("failed to add the m_cpu member: %s\n",
+		    ctf_errmsg(ctf_errno(fp)));
+	}
+
+	if (ctf_update(fp) == CTF_ERR) {
+		ctfconvert_fatal("failed to update output file: %s\n",
+		    ctf_errmsg(ctf_errno(fp)));
+	}
+
+	VERIFY(ctf_type_size(fp, cpuid) == sz);
+}
+
+static void
+ctfconvert_altexec(char **argv)
+{
+	const char *alt;
+	char *altexec;
+
+	alt = getenv(CTFCONVERT_ALTEXEC);
+	if (alt == NULL || *alt == '\0')
+		return;
+
+	altexec = strdup(alt);
+	if (altexec == NULL)
+		ctfconvert_fatal("failed to allocate memory for altexec\n");
+	if (unsetenv(CTFCONVERT_ALTEXEC) != 0)
+		ctfconvert_fatal("failed to unset %s from environment: %s\n",
+		    CTFCONVERT_ALTEXEC, strerror(errno));
+
+	(void) execv(altexec, argv);
+	ctfconvert_fatal("failed to execute alternate program %s: %s",
+	    altexec, strerror(errno));
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c, ifd, err;
+	boolean_t keep = B_FALSE;
+	uint_t flags = 0;
+	uint_t nthreads = CTFCONVERT_DEFAULT_NTHREADS;
+	const char *outfile = NULL;
+	const char *label = NULL;
+	const char *infile = NULL;
+	char *tmpfile;
+	ctf_file_t *ofp;
+	long argj;
+	char *eptr;
+	char buf[4096];
+	boolean_t optx = B_FALSE;
+
+	ctfconvert_progname = basename(argv[0]);
+
+	ctfconvert_altexec(argv);
+
+	while ((c = getopt(argc, argv, ":j:kl:L:o:iX")) != -1) {
+		switch (c) {
+		case 'k':
+			keep = B_TRUE;
+			break;
+		case 'l':
+			label = optarg;
+			break;
+		case 'L':
+			label = getenv(optarg);
+			break;
+		case 'j':
+			errno = 0;
+			argj = strtol(optarg, &eptr, 10);
+			if (errno != 0 || argj == LONG_MAX ||
+			    argj == LONG_MIN || argj <= 0 ||
+			    argj > UINT_MAX || *eptr != '\0') {
+				ctfconvert_fatal("invalid argument for -j: "
+				    "%s\n", optarg);
+			}
+			nthreads = (uint_t)argj;
+			break;
+		case 'o':
+			outfile = optarg;
+			break;
+		case 'i':
+			flags |= CTF_CONVERT_F_IGNNONC;
+			break;
+		case 'X':
+			optx = B_TRUE;
+			break;
+		case ':':
+			ctfconvert_usage("Option -%c requires an operand\n",
+			    optopt);
+			return (CTFCONVERT_USAGE);
+		case '?':
+			ctfconvert_usage("Unknown option: -%c\n", optopt);
+			return (CTFCONVERT_USAGE);
+		}
+	}
+
+	argv += optind;
+	argc -= optind;
+
+	if (argc < 1) {
+		ctfconvert_usage("Missing required input file\n");
+		return (CTFCONVERT_USAGE);
+	}
+	infile = argv[0];
+
+	if (elf_version(EV_CURRENT) == EV_NONE)
+		ctfconvert_fatal("failed to initialize libelf: library is "
+		    "out of date\n");
+
+	ifd = open(infile, O_RDONLY);
+	if (ifd < 0) {
+		ctfconvert_fatal("failed to open input file %s: %s\n", infile,
+		    strerror(errno));
+	}
+
+	/*
+	 * By default we remove the input file on failure unless we've been
+	 * given an output file or -k has been specified.
+	 */
+	if (outfile != NULL && strcmp(infile, outfile) != 0)
+		keep = B_TRUE;
+
+	ofp = ctf_fdconvert(ifd, label, nthreads, flags, &err, buf,
+	    sizeof (buf));
+	if (ofp == NULL) {
+		/*
+		 * -i says that we shouldn't concern ourselves with source files
+		 * that weren't built from C source code in part. Because this
+		 * has been traditionally used across all of illumos, we still
+		 * honor it.
+		 */
+		if ((flags & CTF_CONVERT_F_IGNNONC) != 0 &&
+		    err == ECTF_CONVNOCSRC) {
+			exit(CTFCONVERT_OK);
+		}
+		if (keep == B_FALSE)
+			(void) unlink(infile);
+		ctfconvert_fatal("CTF conversion failed: %s\n",
+		    err == ECTF_CONVBKERR ? buf : ctf_errmsg(err));
+	}
+
+	if (optx == B_TRUE)
+		ctfconvert_fixup_genunix(ofp);
+
+	tmpfile = NULL;
+	if (outfile == NULL || strcmp(infile, outfile) == 0) {
+		if (asprintf(&tmpfile, "%s.ctf", infile) == -1) {
+			if (keep == B_FALSE)
+				(void) unlink(infile);
+			ctfconvert_fatal("failed to allocate memory for "
+			    "temporary file: %s\n", strerror(errno));
+		}
+		outfile = tmpfile;
+	}
+	err = ctf_elfwrite(ofp, infile, outfile, CTF_ELFWRITE_F_COMPRESS);
+	if (err == CTF_ERR) {
+		(void) unlink(outfile);
+		if (keep == B_FALSE)
+			(void) unlink(infile);
+		ctfconvert_fatal("failed to write CTF section to output file: "
+		    "%s", ctf_errmsg(ctf_errno(ofp)));
+	}
+	ctf_close(ofp);
+
+	if (tmpfile != NULL) {
+		if (rename(tmpfile, infile) != 0) {
+			int e = errno;
+			(void) unlink(outfile);
+			if (keep == B_FALSE)
+				(void) unlink(infile);
+			ctfconvert_fatal("failed to rename temporary file: "
+			    "%s\n", strerror(e));
+		}
+	}
+	free(tmpfile);
+
+	return (CTFCONVERT_OK);
+}
diff --git a/usr/src/cmd/ctfdiff/Makefile b/usr/src/cmd/ctfdiff/Makefile
new file mode 100644
index 0000000000..268bf9f3ed
--- /dev/null
+++ b/usr/src/cmd/ctfdiff/Makefile
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015, Joyent, Inc.
+#
+
+PROG= ctfdiff
+
+include ../Makefile.cmd
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all $(ROOTPROG)
+
+clean:
+
+lint:	lint_PROG
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/ctfdiff/ctfdiff.c b/usr/src/cmd/ctfdiff/ctfdiff.c
new file mode 100644
index 0000000000..8018761257
--- /dev/null
+++ b/usr/src/cmd/ctfdiff/ctfdiff.c
@@ -0,0 +1,518 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
+
+/*
+ * diff two CTF containers
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <strings.h>
+#include <libctf.h>
+#include <libgen.h>
+#include <stdarg.h>
+
+#define	CTFDIFF_NAMELEN	256
+
+#define	CTFDIFF_EXIT_SIMILAR	0
+#define	CTFDIFF_EXIT_DIFFERENT	1
+#define	CTFDIFF_EXIT_USAGE	2
+#define	CTFDIFF_EXIT_ERROR	3
+
+typedef enum ctf_diff_cmd {
+	CTF_DIFF_TYPES =	0x01,
+	CTF_DIFF_FUNCS =	0x02,
+	CTF_DIFF_OBJS =		0x04,
+	CTF_DIFF_DEFAULT =	0x07,
+	CTF_DIFF_LABEL =	0x08,
+	CTF_DIFF_ALL =		0x0f
+} ctf_diff_cmd_t;
+
+typedef struct {
+	int		dil_next;
+	const char	**dil_labels;
+} ctfdiff_label_t;
+
+static char *g_progname;
+static const char *g_iname;
+static ctf_file_t *g_ifp;
+static const char *g_oname;
+static ctf_file_t *g_ofp;
+static char **g_typelist = NULL;
+static int g_nexttype = 0;
+static int g_ntypes = 0;
+static char **g_objlist = NULL;
+static int g_nextfunc = 0;
+static int g_nfuncs = 0;
+static char **g_funclist = NULL;
+static int g_nextobj = 0;
+static int g_nobjs = 0;
+static boolean_t g_onlydiff = B_FALSE;
+static boolean_t g_different = B_FALSE;
+static ctf_diff_cmd_t g_flag = 0;
+
+static void
+ctfdiff_fatal(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void) fprintf(stderr, "%s: ", g_progname);
+	va_start(ap, fmt);
+	(void) vfprintf(stderr, fmt, ap);
+	va_end(ap);
+
+	exit(CTFDIFF_EXIT_ERROR);
+}
+
+static const char *
+ctfdiff_fp_to_name(ctf_file_t *fp)
+{
+	if (fp == g_ifp)
+		return (g_iname);
+	if (fp == g_ofp)
+		return (g_oname);
+	return (NULL);
+}
+
+/* ARGSUSED */
+static void
+ctfdiff_func_cb(ctf_file_t *ifp, ulong_t iidx, boolean_t similar,
+    ctf_file_t *ofp, ulong_t oidx, void *arg)
+{
+	char namebuf[CTFDIFF_NAMELEN];
+
+	if (similar == B_TRUE)
+		return;
+
+	if (ctf_symbol_name(ifp, iidx, namebuf, sizeof (namebuf)) == NULL) {
+		if (g_nextfunc != 0)
+			return;
+		(void) printf("ctf container %s function %ld is different\n",
+		    ctfdiff_fp_to_name(ifp), iidx);
+	} else {
+		if (g_nextfunc != 0) {
+			int i;
+			for (i = 0; i < g_nextfunc; i++) {
+				if (strcmp(g_funclist[i], namebuf) == 0)
+					break;
+			}
+			if (i == g_nextfunc)
+				return;
+		}
+		(void) printf("ctf container %s function %s (%ld) is "
+		    "different\n", ctfdiff_fp_to_name(ifp), namebuf, iidx);
+	}
+
+	g_different = B_TRUE;
+}
+
+/* ARGSUSED */
+static void
+ctfdiff_obj_cb(ctf_file_t *ifp, ulong_t iidx, ctf_id_t iid, boolean_t similar,
+    ctf_file_t *ofp, ulong_t oidx, ctf_id_t oid, void *arg)
+{
+	char namebuf[CTFDIFF_NAMELEN];
+
+	if (similar == B_TRUE)
+		return;
+
+	if (ctf_symbol_name(ifp, iidx, namebuf, sizeof (namebuf)) == NULL) {
+		if (g_nextobj != 0)
+			return;
+		(void) printf("ctf container %s object %ld is different\n",
+		    ctfdiff_fp_to_name(ifp), iidx);
+	} else {
+		if (g_nextobj != 0) {
+			int i;
+			for (i = 0; i < g_nextobj; i++) {
+				if (strcmp(g_objlist[i], namebuf) == 0)
+					break;
+			}
+			if (i == g_nextobj)
+				return;
+		}
+		(void) printf("ctf container %s object %s (%ld) is different\n",
+		    ctfdiff_fp_to_name(ifp), namebuf, iidx);
+	}
+
+	g_different = B_TRUE;
+}
+
+/* ARGSUSED */
+static void
+ctfdiff_cb(ctf_file_t *ifp, ctf_id_t iid, boolean_t similar, ctf_file_t *ofp,
+    ctf_id_t oid, void *arg)
+{
+	if (similar == B_TRUE)
+		return;
+
+	if (ctf_type_kind(ifp, iid) == CTF_K_UNKNOWN)
+		return;
+
+	/*
+	 * Check if it's the type the user cares about.
+	 */
+	if (g_nexttype != 0) {
+		int i;
+		char namebuf[CTFDIFF_NAMELEN];
+
+		if (ctf_type_name(ifp, iid, namebuf, sizeof (namebuf)) ==
+		    NULL) {
+			ctfdiff_fatal("failed to obtain the name "
+			    "of type %ld from %s: %s\n",
+			    iid, ctfdiff_fp_to_name(ifp),
+			    ctf_errmsg(ctf_errno(ifp)));
+		}
+
+		for (i = 0; i < g_nexttype; i++) {
+			if (strcmp(g_typelist[i], namebuf) == 0)
+				break;
+		}
+
+		if (i == g_nexttype)
+			return;
+	}
+
+	g_different = B_TRUE;
+
+	if (g_onlydiff == B_TRUE)
+		return;
+
+	(void) printf("ctf container %s type %ld is different\n",
+	    ctfdiff_fp_to_name(ifp), iid);
+}
+
+/* ARGSUSED */
+static int
+ctfdiff_labels_count(const char *name, const ctf_lblinfo_t *li, void *arg)
+{
+	uint32_t *count = arg;
+	*count = *count + 1;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ctfdiff_labels_fill(const char *name, const ctf_lblinfo_t *li, void *arg)
+{
+	ctfdiff_label_t *dil = arg;
+
+	dil->dil_labels[dil->dil_next] = name;
+	dil->dil_next++;
+
+	return (0);
+}
+
+static int
+ctfdiff_labels(ctf_file_t *ifp, ctf_file_t *ofp)
+{
+	int ret;
+	uint32_t nilabel, nolabel, i, j;
+	ctfdiff_label_t idl, odl;
+	const char **ilptr, **olptr;
+
+	nilabel = nolabel = 0;
+	ret = ctf_label_iter(ifp, ctfdiff_labels_count, &nilabel);
+	if (ret == CTF_ERR)
+		return (ret);
+	ret = ctf_label_iter(ofp, ctfdiff_labels_count, &nolabel);
+	if (ret == CTF_ERR)
+		return (ret);
+
+	if (nilabel != nolabel) {
+		(void) printf("ctf container %s labels differ from ctf "
+		    "container %s\n", ctfdiff_fp_to_name(ifp),
+		    ctfdiff_fp_to_name(ofp));
+		g_different = B_TRUE;
+		return (0);
+	}
+
+	if (nilabel == 0)
+		return (0);
+
+	ilptr = malloc(sizeof (char *) * nilabel);
+	olptr = malloc(sizeof (char *) * nolabel);
+	if (ilptr == NULL || olptr == NULL) {
+		ctfdiff_fatal("failed to allocate memory for label "
+		    "comparison\n");
+	}
+
+	idl.dil_next = 0;
+	idl.dil_labels = ilptr;
+	odl.dil_next = 0;
+	odl.dil_labels = olptr;
+
+	if ((ret = ctf_label_iter(ifp, ctfdiff_labels_fill, &idl)) != 0)
+		goto out;
+	if ((ret = ctf_label_iter(ofp, ctfdiff_labels_fill, &odl)) != 0)
+		goto out;
+
+	for (i = 0; i < nilabel; i++) {
+		for (j = 0; j < nolabel; j++) {
+			if (strcmp(ilptr[i], olptr[j]) == 0)
+				break;
+		}
+
+		if (j == nolabel) {
+			(void) printf("ctf container %s labels differ from ctf "
+			    "container %s\n", ctfdiff_fp_to_name(ifp),
+			    ctfdiff_fp_to_name(ofp));
+			g_different = B_TRUE;
+			break;
+		}
+	}
+
+	ret = 0;
+out:
+	free(ilptr);
+	free(olptr);
+	return (ret);
+}
+
+static void
+ctfdiff_usage(const char *fmt, ...)
+{
+	if (fmt != NULL) {
+		va_list ap;
+
+		(void) fprintf(stderr, "%s: ", g_progname);
+		va_start(ap, fmt);
+		(void) vfprintf(stderr, fmt, ap);
+		va_end(ap);
+	}
+
+	(void) fprintf(stderr, "Usage: %s [-afIloqt] [-F function] [-O object]"
+	    "[-p parent] [-P parent]\n"
+	    "\t[-T type] file1 file2\n"
+	    "\n"
+	    "\t-a diff label, types, objects, and functions\n"
+	    "\t-f diff function type information\n"
+	    "\t-F when diffing functions, only consider those named\n"
+	    "\t-I ignore the names of integral types\n"
+	    "\t-l diff CTF labels\n"
+	    "\t-o diff global object type information\n"
+	    "\t-O when diffing objects, only consider those named\n"
+	    "\t-p set the CTF parent for file1\n"
+	    "\t-P set the CTF parent for file2\n"
+	    "\t-q set quiet mode (no diff information sent to stdout)\n"
+	    "\t-t diff CTF type information\n"
+	    "\t-T when diffing types, only consider those named\n",
+	    g_progname);
+}
+
+int
+main(int argc, char *argv[])
+{
+	ctf_diff_flag_t flags = 0;
+	int err, c;
+	ctf_file_t *ifp, *ofp;
+	ctf_diff_t *cdp;
+	ctf_file_t *pifp = NULL;
+	ctf_file_t *pofp = NULL;
+
+	g_progname = basename(argv[0]);
+
+	while ((c = getopt(argc, argv, ":aqtfolIp:F:O:P:T:")) != -1) {
+		switch (c) {
+		case 'a':
+			g_flag |= CTF_DIFF_ALL;
+			break;
+		case 't':
+			g_flag |= CTF_DIFF_TYPES;
+			break;
+		case 'f':
+			g_flag |= CTF_DIFF_FUNCS;
+			break;
+		case 'o':
+			g_flag |= CTF_DIFF_OBJS;
+			break;
+		case 'l':
+			g_flag |= CTF_DIFF_LABEL;
+			break;
+		case 'q':
+			g_onlydiff = B_TRUE;
+			break;
+		case 'p':
+			pifp = ctf_open(optarg, &err);
+			if (pifp == NULL) {
+				ctfdiff_fatal("failed to open parent input "
+				    "container %s: %s\n", optarg,
+				    ctf_errmsg(err));
+			}
+			break;
+		case 'F':
+			if (g_nextfunc == g_nfuncs) {
+				if (g_nfuncs == 0)
+					g_nfuncs = 16;
+				else
+					g_nfuncs *= 2;
+				g_funclist = realloc(g_funclist,
+				    sizeof (char *) * g_nfuncs);
+				if (g_funclist == NULL) {
+					ctfdiff_fatal("failed to allocate "
+					    "memory for the %dth -F option: "
+					    "%s\n", g_nexttype + 1,
+					    strerror(errno));
+				}
+			}
+			g_funclist[g_nextfunc] = optarg;
+			g_nextfunc++;
+			break;
+		case 'O':
+			if (g_nextobj == g_nobjs) {
+				if (g_nobjs == 0)
+					g_nobjs = 16;
+				else
+					g_nobjs *= 2;
+				g_objlist = realloc(g_objlist,
+				    sizeof (char *) * g_nobjs);
+				if (g_objlist == NULL) {
+					ctfdiff_fatal("failed to allocate "
+					    "memory for the %dth -F option: "
+					    "%s\n", g_nexttype + 1,
+					    strerror(errno));
+					return (CTFDIFF_EXIT_ERROR);
+				}
+			}
+			g_objlist[g_nextobj] = optarg;
+			g_nextobj++;
+			break;
+		case 'I':
+			flags |= CTF_DIFF_F_IGNORE_INTNAMES;
+			break;
+		case 'P':
+			pofp = ctf_open(optarg, &err);
+			if (pofp == NULL) {
+				ctfdiff_fatal("failed to open parent output "
+				    "container %s: %s\n", optarg,
+				    ctf_errmsg(err));
+			}
+			break;
+		case 'T':
+			if (g_nexttype == g_ntypes) {
+				if (g_ntypes == 0)
+					g_ntypes = 16;
+				else
+					g_ntypes *= 2;
+				g_typelist = realloc(g_typelist,
+				    sizeof (char *) * g_ntypes);
+				if (g_typelist == NULL) {
+					ctfdiff_fatal("failed to allocate "
+					    "memory for the %dth -T option: "
+					    "%s\n", g_nexttype + 1,
+					    strerror(errno));
+				}
+			}
+			g_typelist[g_nexttype] = optarg;
+			g_nexttype++;
+			break;
+		case ':':
+			ctfdiff_usage("Option -%c requires an operand\n",
+			    optopt);
+			return (CTFDIFF_EXIT_USAGE);
+		case '?':
+			ctfdiff_usage("Unknown option: -%c\n", optopt);
+			return (CTFDIFF_EXIT_USAGE);
+		}
+	}
+
+	argc -= optind - 1;
+	argv += optind - 1;
+
+	if (g_flag == 0)
+		g_flag = CTF_DIFF_DEFAULT;
+
+	if (argc != 3) {
+		ctfdiff_usage(NULL);
+		return (CTFDIFF_EXIT_USAGE);
+	}
+
+	if (g_nexttype != 0 && !(g_flag & CTF_DIFF_TYPES)) {
+		ctfdiff_usage("-T cannot be used if not diffing types\n");
+		return (CTFDIFF_EXIT_USAGE);
+	}
+
+	if (g_nextfunc != 0 && !(g_flag & CTF_DIFF_FUNCS)) {
+		ctfdiff_usage("-F cannot be used if not diffing functions\n");
+		return (CTFDIFF_EXIT_USAGE);
+	}
+
+	if (g_nextobj != 0 && !(g_flag & CTF_DIFF_OBJS)) {
+		ctfdiff_usage("-O cannot be used if not diffing objects\n");
+		return (CTFDIFF_EXIT_USAGE);
+	}
+
+	ifp = ctf_open(argv[1], &err);
+	if (ifp == NULL) {
+		ctfdiff_fatal("failed to open %s: %s\n", argv[1],
+		    ctf_errmsg(err));
+	}
+	if (pifp != NULL) {
+		err = ctf_import(ifp, pifp);
+		if (err != 0) {
+			ctfdiff_fatal("failed to set parent container: %s\n",
+			    ctf_errmsg(ctf_errno(pifp)));
+		}
+	}
+	g_iname = argv[1];
+	g_ifp = ifp;
+
+	ofp = ctf_open(argv[2], &err);
+	if (ofp == NULL) {
+		ctfdiff_fatal("failed to open %s: %s\n", argv[2],
+		    ctf_errmsg(err));
+	}
+
+	if (pofp != NULL) {
+		err = ctf_import(ofp, pofp);
+		if (err != 0) {
+			ctfdiff_fatal("failed to set parent container: %s\n",
+			    ctf_errmsg(ctf_errno(pofp)));
+		}
+	}
+	g_oname = argv[2];
+	g_ofp = ofp;
+
+	if (ctf_diff_init(ifp, ofp, &cdp) != 0) {
+		ctfdiff_fatal("failed to initialize libctf diff engine: %s\n",
+		    ctf_errmsg(ctf_errno(ifp)));
+	}
+
+	if (ctf_diff_setflags(cdp, flags) != 0) {
+		ctfdiff_fatal("failed to set ctfdiff flags: %s\n",
+		    ctf_errmsg(ctf_errno(ifp)));
+	}
+
+	err = 0;
+	if ((g_flag & CTF_DIFF_TYPES) && err != CTF_ERR)
+		err = ctf_diff_types(cdp, ctfdiff_cb, NULL);
+	if ((g_flag & CTF_DIFF_FUNCS) && err != CTF_ERR)
+		err = ctf_diff_functions(cdp, ctfdiff_func_cb, NULL);
+	if ((g_flag & CTF_DIFF_OBJS) && err != CTF_ERR)
+		err = ctf_diff_objects(cdp, ctfdiff_obj_cb, NULL);
+	if ((g_flag & CTF_DIFF_LABEL) && err != CTF_ERR)
+		err = ctfdiff_labels(ifp, ofp);
+
+	ctf_diff_fini(cdp);
+	if (err == CTF_ERR) {
+		ctfdiff_fatal("encountered a libctf error: %s!\n",
+		    ctf_errmsg(ctf_errno(ifp)));
+	}
+
+	return (g_different == B_TRUE ? CTFDIFF_EXIT_DIFFERENT :
+	    CTFDIFF_EXIT_SIMILAR);
+}
diff --git a/usr/src/cmd/ctfdump/Makefile b/usr/src/cmd/ctfdump/Makefile
new file mode 100644
index 0000000000..962ca43a8f
--- /dev/null
+++ b/usr/src/cmd/ctfdump/Makefile
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc.
+#
+
+PROG= ctfdump
+
+include ../Makefile.cmd
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all $(ROOTPROG)
+
+clean:
+
+lint:	lint_PROG
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/ctfdump/ctfdump.c b/usr/src/cmd/ctfdump/ctfdump.c
new file mode 100644
index 0000000000..d0ff63a02a
--- /dev/null
+++ b/usr/src/cmd/ctfdump/ctfdump.c
@@ -0,0 +1,815 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
+
+/*
+ * Dump information about CTF containers. This was inspired by the original
+ * ctfdump written in tools/ctf, but this has been reimplemented in terms of
+ * libctf.
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <libctf.h>
+#include <libgen.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stddef.h>
+#include <sys/sysmacros.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <string.h>
+
+typedef enum ctfdump_arg {
+	CTFDUMP_OBJECTS =	0x01,
+	CTFDUMP_FUNCTIONS =	0x02,
+	CTFDUMP_HEADER =	0x04,
+	CTFDUMP_LABELS = 	0x08,
+	CTFDUMP_STRINGS =	0x10,
+	CTFDUMP_STATS = 	0x20,
+	CTFDUMP_TYPES =		0x40,
+	CTFDUMP_DEFAULT =	0x7f,
+	CTFDUMP_OUTPUT =	0x80,
+	CTFDUMP_ALL =		0xff
+} ctfdump_arg_t;
+
+typedef struct ctfdump_stat {
+	ulong_t		cs_ndata;		/* number of data objects */
+	ulong_t		cs_nfuncs;		/* number of functions */
+	ulong_t		cs_nfuncargs;		/* number of function args */
+	ulong_t		cs_nfuncmax;		/* largest number of args */
+	ulong_t		cs_ntypes[CTF_K_MAX];	/* number of types */
+	ulong_t		cs_nsmembs;		/* number of struct members */
+	ulong_t		cs_nsmax;		/* largest number of members */
+	ulong_t		cs_structsz;		/* sum of structures sizes */
+	ulong_t		cs_sszmax;		/* largest structure */
+	ulong_t		cs_numembs;		/* number of union members */
+	ulong_t		cs_numax;		/* largest number of members */
+	ulong_t		cs_unionsz;		/* sum of unions sizes */
+	ulong_t		cs_uszmax;		/* largest union */
+	ulong_t		cs_nemembs;		/* number of enum members */
+	ulong_t		cs_nemax;		/* largest number of members */
+	ulong_t		cs_nstrings;		/* number of strings */
+	ulong_t		cs_strsz;		/* string size */
+	ulong_t		cs_strmax;		/* longest string */
+} ctfdump_stat_t;
+
+static const char *g_progname;
+static ctfdump_arg_t g_dump;
+static ctf_file_t *g_fp;
+static ctfdump_stat_t g_stats;
+static ctf_id_t *g_fargc;
+static int g_nfargc;
+
+static int g_exit = 0;
+
+static const char *ctfdump_fpenc[] = {
+	NULL,
+	"SINGLE",
+	"DOUBLE",
+	"COMPLEX",
+	"DCOMPLEX",
+	"LDCOMPLEX",
+	"LDOUBLE",
+	"INTERVAL",
+	"DINTERVAL",
+	"LDINTERVAL",
+	"IMAGINARY",
+	"DIMAGINARY",
+	"LDIMAGINARY"
+};
+
+/*
+ * When stats are requested, we have to go through everything. To make our lives
+ * easier, we'll just always allow the code to print everything out, but only
+ * output it if we have actually enabled that section.
+ */
+static void
+ctfdump_printf(ctfdump_arg_t arg, const char *fmt, ...)
+{
+	va_list ap;
+
+	if ((arg & g_dump) == 0)
+		return;
+
+	va_start(ap, fmt);
+	vfprintf(stdout, fmt, ap);
+	va_end(ap);
+}
+
+static void
+ctfdump_warn(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void) fprintf(stderr, "%s: ", g_progname);
+	va_start(ap, fmt);
+	vfprintf(stderr, fmt, ap);
+	va_end(ap);
+}
+
+static void
+ctfdump_fatal(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void) fprintf(stderr, "%s: ", g_progname);
+	va_start(ap, fmt);
+	vfprintf(stderr, fmt, ap);
+	va_end(ap);
+
+	exit(1);
+}
+
+static void
+ctfdump_usage(const char *fmt, ...)
+{
+	if (fmt != NULL) {
+		va_list ap;
+		(void) fprintf(stderr, "%s: ", g_progname);
+		va_start(ap, fmt);
+		(void) vfprintf(stderr, fmt, ap);
+		va_end(ap);
+	}
+
+	(void) fprintf(stderr, "Usage: %s [-dfhlsSt] [-p parent] [-u outfile] "
+	    "file\n"
+	    "\n"
+	    "\t-d  dump object data\n"
+	    "\t-f  dump function data\n"
+	    "\t-h  dump the CTF header\n"
+	    "\t-l  dump the label table\n"
+	    "\t-p  use parent to supply additional information\n"
+	    "\t-s  dump the string table\n"
+	    "\t-S  dump statistics about the CTF container\n"
+	    "\t-t  dump type information\n"
+	    "\t-u  dump uncompressed CTF data to outfile\n",
+	    g_progname);
+}
+
+static void
+ctfdump_title(ctfdump_arg_t arg, const char *header)
+{
+	static const char line[] = "----------------------------------------"
+	    "----------------------------------------";
+	ctfdump_printf(arg, "\n- %s %.*s\n\n", header, (int)78 - strlen(header),
+	    line);
+}
+
+static int
+ctfdump_objects_cb(const char *name, ctf_id_t id, ulong_t symidx, void *arg)
+{
+	int len;
+
+	len = snprintf(NULL, 0, "  [%u] %u", g_stats.cs_ndata, id);
+	ctfdump_printf(CTFDUMP_OBJECTS, "  [%u] %u %*s%s (%u)\n",
+	    g_stats.cs_ndata, id, MAX(15 - len, 0), "", name, symidx);
+	g_stats.cs_ndata++;
+	return (0);
+}
+
+static void
+ctfdump_objects(void)
+{
+	ctfdump_title(CTFDUMP_OBJECTS, "Data Objects");
+	if (ctf_object_iter(g_fp, ctfdump_objects_cb, NULL) == CTF_ERR) {
+		ctfdump_warn("failed to dump objects: %s\n",
+		    ctf_errmsg(ctf_errno(g_fp)));
+		g_exit = 1;
+	}
+}
+
+static void
+ctfdump_fargs_grow(int nargs)
+{
+	if (g_nfargc < nargs) {
+		g_fargc = realloc(g_fargc, sizeof (ctf_id_t) * nargs);
+		if (g_fargc == NULL)
+			ctfdump_fatal("failed to get memory for %d "
+			    "ctf_id_t's\n", nargs);
+		g_nfargc = nargs;
+	}
+}
+
+static int
+ctfdump_functions_cb(const char *name, ulong_t symidx, ctf_funcinfo_t *ctc,
+    void *arg)
+{
+	int i;
+
+	if (ctc->ctc_argc != 0) {
+		ctfdump_fargs_grow(ctc->ctc_argc);
+		if (ctf_func_args(g_fp, symidx, g_nfargc, g_fargc) == CTF_ERR)
+			ctfdump_fatal("failed to get arguments for function "
+			    "%s: %s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+	}
+
+	ctfdump_printf(CTFDUMP_FUNCTIONS,
+	    "  [%lu] %s (%lu) returns: %u args: (", g_stats.cs_nfuncs, name,
+	    symidx, ctc->ctc_return);
+	for (i = 0; i < ctc->ctc_argc; i++)
+		ctfdump_printf(CTFDUMP_FUNCTIONS, "%lu%s", g_fargc[i],
+		    i + 1 == ctc->ctc_argc ? "" : ", ");
+	if (ctc->ctc_flags & CTF_FUNC_VARARG)
+		ctfdump_printf(CTFDUMP_FUNCTIONS, "%s...",
+		    ctc->ctc_argc == 0 ? "" : ", ");
+	ctfdump_printf(CTFDUMP_FUNCTIONS, ")\n");
+
+	g_stats.cs_nfuncs++;
+	g_stats.cs_nfuncargs += ctc->ctc_argc;
+	g_stats.cs_nfuncmax = MAX(ctc->ctc_argc, g_stats.cs_nfuncmax);
+
+	return (0);
+}
+
+static void
+ctfdump_functions(void)
+{
+	ctfdump_title(CTFDUMP_FUNCTIONS, "Functions");
+
+	if (ctf_function_iter(g_fp, ctfdump_functions_cb, NULL) == CTF_ERR) {
+		ctfdump_warn("failed to dump functions: %s\n",
+		    ctf_errmsg(ctf_errno(g_fp)));
+		g_exit = 1;
+	}
+}
+
+static void
+ctfdump_header(void)
+{
+	const ctf_header_t *hp;
+	const char *parname, *parlabel;
+
+	ctfdump_title(CTFDUMP_HEADER, "CTF Header");
+	ctf_dataptr(g_fp, (const void **)&hp, NULL);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_magic    = 0x%04x\n",
+	    hp->cth_magic);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_version  = %u\n",
+	    hp->cth_version);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_flags    = 0x%02x\n",
+	    ctf_flags(g_fp));
+	parname = ctf_parent_name(g_fp);
+	parlabel = ctf_parent_label(g_fp);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_parlabel = %s\n",
+	    parlabel == NULL ? "(anon)" : parlabel);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_parname  = %s\n",
+	    parname == NULL ? "(anon)" : parname);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_lbloff   = %u\n",
+	    hp->cth_lbloff);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_objtoff  = %u\n",
+	    hp->cth_objtoff);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_funcoff  = %u\n",
+	    hp->cth_funcoff);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_typeoff  = %u\n",
+	    hp->cth_typeoff);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_stroff   = %u\n",
+	    hp->cth_stroff);
+	ctfdump_printf(CTFDUMP_HEADER, "  cth_strlen   = %u\n",
+	    hp->cth_strlen);
+}
+
+static int
+ctfdump_labels_cb(const char *name, const ctf_lblinfo_t *li, void *arg)
+{
+	ctfdump_printf(CTFDUMP_LABELS, "  %5lu %s\n", li->ctb_typeidx, name);
+	return (0);
+}
+
+static void
+ctfdump_labels(void)
+{
+	ctfdump_title(CTFDUMP_LABELS, "Label Table");
+	if (ctf_label_iter(g_fp, ctfdump_labels_cb, NULL) == CTF_ERR) {
+		ctfdump_warn("failed to dump labels: %s\n",
+		    ctf_errmsg(ctf_errno(g_fp)));
+		g_exit = 1;
+	}
+}
+
+static int
+ctfdump_strings_cb(const char *s, void *arg)
+{
+	size_t len = strlen(s) + 1;
+	ulong_t *stroff = arg;
+	ctfdump_printf(CTFDUMP_STRINGS, "  [%lu] %s\n", *stroff,
+	    *s == '\0' ? "\\0" : s);
+	*stroff = *stroff + len;
+	g_stats.cs_nstrings++;
+	g_stats.cs_strsz += len;
+	g_stats.cs_strmax = MAX(g_stats.cs_strmax, len);
+	return (0);
+}
+
+static void
+ctfdump_strings(void)
+{
+	ulong_t stroff = 0;
+
+	ctfdump_title(CTFDUMP_STRINGS, "String Table");
+	if (ctf_string_iter(g_fp, ctfdump_strings_cb, &stroff) == CTF_ERR) {
+		ctfdump_warn("failed to dump strings: %s\n",
+		    ctf_errmsg(ctf_errno(g_fp)));
+		g_exit = 1;
+	}
+}
+
+static void
+ctfdump_stat_int(const char *name, ulong_t value)
+{
+	ctfdump_printf(CTFDUMP_STATS, "  %-36s= %lu\n", name, value);
+}
+
+static void
+ctfdump_stat_fp(const char *name, float value)
+{
+	ctfdump_printf(CTFDUMP_STATS, "  %-36s= %.2f\n", name, value);
+}
+
+static void
+ctfdump_stats(void)
+{
+	int i;
+	ulong_t sum;
+
+	ctfdump_title(CTFDUMP_STATS, "CTF Statistics");
+
+	ctfdump_stat_int("total number of data objects", g_stats.cs_ndata);
+	ctfdump_printf(CTFDUMP_STATS, "\n");
+	ctfdump_stat_int("total number of functions", g_stats.cs_nfuncs);
+	ctfdump_stat_int("total number of function arguments",
+	    g_stats.cs_nfuncargs);
+	ctfdump_stat_int("maximum argument list length", g_stats.cs_nfuncmax);
+	if (g_stats.cs_nfuncs != 0)
+		ctfdump_stat_fp("average argument list length",
+		    (float)g_stats.cs_nfuncargs / (float)g_stats.cs_nfuncs);
+	ctfdump_printf(CTFDUMP_STATS, "\n");
+
+	sum = 0;
+	for (i = 0; i < CTF_K_MAX; i++)
+		sum += g_stats.cs_ntypes[i];
+	ctfdump_stat_int("total number of types", sum);
+	ctfdump_stat_int("total number of integers",
+	    g_stats.cs_ntypes[CTF_K_INTEGER]);
+	ctfdump_stat_int("total number of floats",
+	    g_stats.cs_ntypes[CTF_K_FLOAT]);
+	ctfdump_stat_int("total number of pointers",
+	    g_stats.cs_ntypes[CTF_K_POINTER]);
+	ctfdump_stat_int("total number of arrays",
+	    g_stats.cs_ntypes[CTF_K_ARRAY]);
+	ctfdump_stat_int("total number of func types",
+	    g_stats.cs_ntypes[CTF_K_FUNCTION]);
+	ctfdump_stat_int("total number of structs",
+	    g_stats.cs_ntypes[CTF_K_STRUCT]);
+	ctfdump_stat_int("total number of unions",
+	    g_stats.cs_ntypes[CTF_K_UNION]);
+	ctfdump_stat_int("total number of enums",
+	    g_stats.cs_ntypes[CTF_K_ENUM]);
+	ctfdump_stat_int("total number of forward tags",
+	    g_stats.cs_ntypes[CTF_K_FORWARD]);
+	ctfdump_stat_int("total number of typedefs",
+	    g_stats.cs_ntypes[CTF_K_TYPEDEF]);
+	ctfdump_stat_int("total number of volatile types",
+	    g_stats.cs_ntypes[CTF_K_VOLATILE]);
+	ctfdump_stat_int("total number of const types",
+	    g_stats.cs_ntypes[CTF_K_CONST]);
+	ctfdump_stat_int("total number of restrict types",
+	    g_stats.cs_ntypes[CTF_K_RESTRICT]);
+	ctfdump_stat_int("total number of unknowns (holes)",
+	    g_stats.cs_ntypes[CTF_K_UNKNOWN]);
+
+	ctfdump_printf(CTFDUMP_STATS, "\n");
+	ctfdump_stat_int("total number of struct members", g_stats.cs_nsmembs);
+	ctfdump_stat_int("maximum number of struct members", g_stats.cs_nsmax);
+	ctfdump_stat_int("total size of all structs", g_stats.cs_structsz);
+	ctfdump_stat_int("maximum size of a struct", g_stats.cs_sszmax);
+	if (g_stats.cs_ntypes[CTF_K_STRUCT] != 0) {
+		ctfdump_stat_fp("average number of struct members",
+		    (float)g_stats.cs_nsmembs /
+		    (float)g_stats.cs_ntypes[CTF_K_STRUCT]);
+		ctfdump_stat_fp("average size of a struct",
+		    (float)g_stats.cs_structsz /
+		    (float)g_stats.cs_ntypes[CTF_K_STRUCT]);
+	}
+	ctfdump_printf(CTFDUMP_STATS, "\n");
+	ctfdump_stat_int("total number of union members", g_stats.cs_numembs);
+	ctfdump_stat_int("maximum number of union members", g_stats.cs_numax);
+	ctfdump_stat_int("total size of all unions", g_stats.cs_unionsz);
+	ctfdump_stat_int("maximum size of a union", g_stats.cs_uszmax);
+	if (g_stats.cs_ntypes[CTF_K_UNION] != 0) {
+		ctfdump_stat_fp("average number of union members",
+		    (float)g_stats.cs_numembs /
+		    (float)g_stats.cs_ntypes[CTF_K_UNION]);
+		ctfdump_stat_fp("average size of a union",
+		    (float)g_stats.cs_unionsz /
+		    (float)g_stats.cs_ntypes[CTF_K_UNION]);
+	}
+	ctfdump_printf(CTFDUMP_STATS, "\n");
+
+	ctfdump_stat_int("total number of enum members", g_stats.cs_nemembs);
+	ctfdump_stat_int("maximum number of enum members", g_stats.cs_nemax);
+	if (g_stats.cs_ntypes[CTF_K_ENUM] != 0) {
+		ctfdump_stat_fp("average number of enum members",
+		    (float)g_stats.cs_nemembs /
+		    (float)g_stats.cs_ntypes[CTF_K_ENUM]);
+	}
+	ctfdump_printf(CTFDUMP_STATS, "\n");
+
+	ctfdump_stat_int("total number of strings", g_stats.cs_nstrings);
+	ctfdump_stat_int("bytes of string data", g_stats.cs_strsz);
+	ctfdump_stat_int("maximum string length", g_stats.cs_strmax);
+	if (g_stats.cs_nstrings != 0)
+		ctfdump_stat_fp("average string length",
+		    (float)g_stats.cs_strsz / (float)g_stats.cs_nstrings);
+	ctfdump_printf(CTFDUMP_STATS, "\n");
+}
+
+static void
+ctfdump_intenc_name(ctf_encoding_t *cte, char *buf, int len)
+{
+	int off = 0;
+	boolean_t space = B_FALSE;
+
+	if (cte->cte_format == 0 || (cte->cte_format &
+	    ~(CTF_INT_SIGNED | CTF_INT_CHAR | CTF_INT_BOOL |
+	    CTF_INT_VARARGS)) != 0) {
+		(void) snprintf(buf, len, "0x%x", cte->cte_format);
+		return;
+	}
+
+	if (cte->cte_format & CTF_INT_SIGNED) {
+		off += snprintf(buf + off, MAX(len - off, 0), "%sSIGNED",
+		    space == B_TRUE ? " " : "");
+		space = B_TRUE;
+	}
+
+	if (cte->cte_format & CTF_INT_CHAR) {
+		off += snprintf(buf + off, MAX(len - off, 0), "%sCHAR",
+		    space == B_TRUE ? " " : "");
+		space = B_TRUE;
+	}
+
+	if (cte->cte_format & CTF_INT_BOOL) {
+		off += snprintf(buf + off, MAX(len - off, 0), "%sBOOL",
+		    space == B_TRUE ? " " : "");
+		space = B_TRUE;
+	}
+
+	if (cte->cte_format & CTF_INT_VARARGS) {
+		off += snprintf(buf + off, MAX(len - off, 0), "%sVARARGS",
+		    space == B_TRUE ? " " : "");
+		space = B_TRUE;
+	}
+}
+
+static int
+ctfdump_member_cb(const char *member, ctf_id_t type, ulong_t off, void *arg)
+{
+	int *count = arg;
+	ctfdump_printf(CTFDUMP_TYPES, "\t%s type=%lu off=%lu\n", member, type,
+	    off);
+	*count = *count + 1;
+	return (0);
+}
+
+static int
+ctfdump_enum_cb(const char *name, int value, void *arg)
+{
+	int *count = arg;
+	ctfdump_printf(CTFDUMP_TYPES, "\t%s = %d\n", name, value);
+	*count = *count + 1;
+	return (0);
+}
+
+static int
+ctfdump_types_cb(ctf_id_t id, boolean_t root, void *arg)
+{
+	int kind, i, count;
+	ctf_id_t ref;
+	char name[512], ienc[128];
+	const char *encn;
+	ctf_funcinfo_t ctc;
+	ctf_arinfo_t ar;
+	ctf_encoding_t cte;
+	ssize_t size;
+
+	if ((kind = ctf_type_kind(g_fp, id)) == CTF_ERR)
+		ctfdump_fatal("encountered malformed ctf, type %s does not "
+		    "have a kind: %s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+
+	if (ctf_type_name(g_fp, id, name, sizeof (name)) == NULL) {
+		if (ctf_errno(g_fp) != ECTF_NOPARENT)
+			ctfdump_fatal("type %lu missing name: %s\n", id,
+			    ctf_errmsg(ctf_errno(g_fp)));
+		(void) snprintf(name, sizeof (name), "(unknown %s)",
+		    ctf_kind_name(g_fp, kind));
+	}
+
+	g_stats.cs_ntypes[kind]++;
+	if (root == B_TRUE)
+		ctfdump_printf(CTFDUMP_TYPES, "  <%lu> ", id);
+	else
+		ctfdump_printf(CTFDUMP_TYPES, "  [%lu] ", id);
+
+	switch (kind) {
+	case CTF_K_UNKNOWN:
+		break;
+	case CTF_K_INTEGER:
+		if (ctf_type_encoding(g_fp, id, &cte) == CTF_ERR)
+			ctfdump_fatal("failed to get encoding information "
+			    "for %s: %s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_intenc_name(&cte, ienc, sizeof (ienc));
+		ctfdump_printf(CTFDUMP_TYPES,
+		    "%s encoding=%s offset=%u bits=%u",
+		    name, ienc, cte.cte_offset, cte.cte_bits);
+		break;
+	case CTF_K_FLOAT:
+		if (ctf_type_encoding(g_fp, id, &cte) == CTF_ERR)
+			ctfdump_fatal("failed to get encoding information "
+			    "for %s: %s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		if (cte.cte_format < 1 || cte.cte_format > 12)
+			encn = "unknown";
+		else
+			encn = ctfdump_fpenc[cte.cte_format];
+		ctfdump_printf(CTFDUMP_TYPES, "%s encoding=%s offset=%u "
+		    "bits=%u", name, encn, cte.cte_offset, cte.cte_bits);
+		break;
+	case CTF_K_POINTER:
+		if ((ref = ctf_type_reference(g_fp, id)) == CTF_ERR)
+			ctfdump_fatal("failed to get reference type for %s: "
+			    "%s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_printf(CTFDUMP_TYPES, "%s refers to %lu", name,
+		    ref);
+		break;
+	case CTF_K_ARRAY:
+		if (ctf_array_info(g_fp, id, &ar) == CTF_ERR)
+			ctfdump_fatal("failed to get array information for "
+			    "%s: %s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_printf(CTFDUMP_TYPES, "%s contents: %lu, index: %lu",
+		    name, ar.ctr_contents, ar.ctr_index);
+		break;
+	case CTF_K_FUNCTION:
+		if (ctf_func_info_by_id(g_fp, id, &ctc) == CTF_ERR)
+			ctfdump_fatal("failed to get function info for %s: "
+			    "%s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		if (ctc.ctc_argc > 0) {
+			ctfdump_fargs_grow(ctc.ctc_argc);
+			if (ctf_func_args_by_id(g_fp, id, g_nfargc, g_fargc) ==
+			    CTF_ERR)
+				ctfdump_fatal("failed to get function "
+				    "arguments for %s: %s\n", name,
+				    ctf_errmsg(ctf_errno(g_fp)));
+		}
+		ctfdump_printf(CTFDUMP_TYPES,
+		    "%s returns: %lu args: (", name, ctc.ctc_return);
+		for (i = 0; i < ctc.ctc_argc; i++) {
+			ctfdump_printf(CTFDUMP_TYPES, "%lu%s", g_fargc[i],
+			    i + 1 == ctc.ctc_argc ? "" : ", ");
+		}
+		if (ctc.ctc_flags & CTF_FUNC_VARARG)
+			ctfdump_printf(CTFDUMP_TYPES, "%s...",
+			    ctc.ctc_argc == 0 ? "" : ", ");
+		ctfdump_printf(CTFDUMP_TYPES, ")");
+		break;
+	case CTF_K_STRUCT:
+	case CTF_K_UNION:
+		size = ctf_type_size(g_fp, id);
+		if (size == CTF_ERR)
+			ctfdump_fatal("failed to get size of %s: %s\n", name,
+			    ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_printf(CTFDUMP_TYPES, "%s (%d bytes)\n", name, size);
+		count = 0;
+		if (ctf_member_iter(g_fp, id, ctfdump_member_cb, &count) != 0)
+			ctfdump_fatal("failed to iterate members of %s: %s\n",
+			    name, ctf_errmsg(ctf_errno(g_fp)));
+		if (kind == CTF_K_STRUCT) {
+			g_stats.cs_nsmembs += count;
+			g_stats.cs_nsmax = MAX(count, g_stats.cs_nsmax);
+			g_stats.cs_structsz += size;
+			g_stats.cs_sszmax = MAX(size, g_stats.cs_sszmax);
+		} else {
+			g_stats.cs_numembs += count;
+			g_stats.cs_numax = MAX(count, g_stats.cs_numax);
+			g_stats.cs_unionsz += size;
+			g_stats.cs_uszmax = MAX(count, g_stats.cs_uszmax);
+		}
+		break;
+	case CTF_K_ENUM:
+		ctfdump_printf(CTFDUMP_TYPES, "%s\n", name);
+		count = 0;
+		if (ctf_enum_iter(g_fp, id, ctfdump_enum_cb, &count) != 0)
+			ctfdump_fatal("failed to iterate enumerators of %s: "
+			    "%s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		g_stats.cs_nemembs += count;
+		g_stats.cs_nemax = MAX(g_stats.cs_nemax, count);
+		break;
+	case CTF_K_FORWARD:
+		ctfdump_printf(CTFDUMP_TYPES, "forward %s\n", name);
+		break;
+	case CTF_K_TYPEDEF:
+		if ((ref = ctf_type_reference(g_fp, id)) == CTF_ERR)
+			ctfdump_fatal("failed to get reference type for %s: "
+			    "%s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_printf(CTFDUMP_TYPES, "typedef %s refers to %lu", name,
+		    ref);
+		break;
+	case CTF_K_VOLATILE:
+		if ((ref = ctf_type_reference(g_fp, id)) == CTF_ERR)
+			ctfdump_fatal("failed to get reference type for %s: "
+			    "%s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_printf(CTFDUMP_TYPES, "%s refers to %lu", name,
+		    ref);
+		break;
+	case CTF_K_CONST:
+		if ((ref = ctf_type_reference(g_fp, id)) == CTF_ERR)
+			ctfdump_fatal("failed to get reference type for %s: "
+			    "%s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_printf(CTFDUMP_TYPES, "%s refers to %lu", name,
+		    ref);
+		break;
+	case CTF_K_RESTRICT:
+		if ((ref = ctf_type_reference(g_fp, id)) == CTF_ERR)
+			ctfdump_fatal("failed to get reference type for %s: "
+			    "%s\n", name, ctf_errmsg(ctf_errno(g_fp)));
+		ctfdump_printf(CTFDUMP_TYPES, "%s refers to %lu", name,
+		    ref);
+		break;
+	default:
+		ctfdump_fatal("encountered unknown kind for type %s: %d\n",
+		    name, kind);
+	}
+
+	ctfdump_printf(CTFDUMP_TYPES, "\n");
+
+	return (0);
+}
+
+static void
+ctfdump_types(void)
+{
+	ctfdump_title(CTFDUMP_TYPES, "Types");
+
+	if (ctf_type_iter(g_fp, B_TRUE, ctfdump_types_cb, NULL) == CTF_ERR) {
+		ctfdump_warn("failed to dump labels: %s\n",
+		    ctf_errmsg(ctf_errno(g_fp)));
+		g_exit = 1;
+	}
+}
+
+static void
+ctfdump_output(const char *out)
+{
+	int fd, ret;
+	const void *data;
+	size_t len;
+
+	ctf_dataptr(g_fp, &data, &len);
+	if ((fd = open(out, O_WRONLY | O_CREAT | O_TRUNC, 0666)) < 0)
+		ctfdump_fatal("failed to open output file %s: %s\n", out,
+		    strerror(errno));
+
+	while (len > 0) {
+		ret = write(fd, data, len);
+		if (ret == -1 && errno == EINTR)
+			continue;
+		else if (ret == -1 && (errno == EFAULT || errno == EBADF))
+			abort();
+		else if (ret == -1)
+			ctfdump_fatal("failed to write to %s: %s\n", out,
+			    strerror(errno));
+		data += ret;
+		len -= ret;
+	}
+
+	do {
+		ret = close(fd);
+	} while (ret == -1 && errno == EINTR);
+	if (ret != 0 && errno == EBADF)
+		abort();
+	if (ret != 0)
+		ctfdump_fatal("failed to close %s: %s\n", out, strerror(errno));
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c, fd, err;
+	const char *ufile = NULL, *parent = NULL;
+
+	g_progname = basename(argv[0]);
+	while ((c = getopt(argc, argv, ":dfhlp:sStu:")) != -1) {
+		switch (c) {
+		case 'd':
+			g_dump |= CTFDUMP_OBJECTS;
+			break;
+		case 'f':
+			g_dump |= CTFDUMP_FUNCTIONS;
+			break;
+		case 'h':
+			g_dump |= CTFDUMP_HEADER;
+			break;
+		case 'l':
+			g_dump |= CTFDUMP_LABELS;
+			break;
+		case 'p':
+			parent = optarg;
+			break;
+		case 's':
+			g_dump |= CTFDUMP_STRINGS;
+			break;
+		case 'S':
+			g_dump |= CTFDUMP_STATS;
+			break;
+		case 't':
+			g_dump |= CTFDUMP_TYPES;
+			break;
+		case 'u':
+			g_dump |= CTFDUMP_OUTPUT;
+			ufile = optarg;
+			break;
+		case '?':
+			ctfdump_usage("Unknown option: -%c\n", optopt);
+			return (2);
+		case ':':
+			ctfdump_usage("Option -%c requires an operand\n",
+			    optopt);
+			return (2);
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	/*
+	 * Dump all information by default.
+	 */
+	if (g_dump == 0)
+		g_dump = CTFDUMP_DEFAULT;
+
+	if (argc != 1) {
+		ctfdump_usage("no file to dump\n");
+		return (2);
+	}
+
+	if ((fd = open(argv[0], O_RDONLY)) < 0)
+		ctfdump_fatal("failed to open file %s: %s\n", argv[0],
+		    strerror(errno));
+
+	g_fp = ctf_fdopen(fd, &err);
+	if (g_fp == NULL)
+		ctfdump_fatal("failed to open file %s: %s\n", argv[0],
+		    ctf_errmsg(err));
+
+	if (parent != NULL) {
+		ctf_file_t *pfp = ctf_open(parent, &err);
+
+		if (pfp == NULL)
+			ctfdump_fatal("failed to open parent file %s: %s\n",
+			    parent, ctf_errmsg(err));
+		if (ctf_import(g_fp, pfp) != 0)
+			ctfdump_fatal("failed to import parent %s: %s\n",
+			    parent, ctf_errmsg(ctf_errno(g_fp)));
+	}
+
+	/*
+	 * If stats is set, we must run through everything exect CTFDUMP_OUTPUT.
+	 * We also do CTFDUMP_STATS last as a result.
+	 */
+	if (g_dump & CTFDUMP_HEADER)
+		ctfdump_header();
+
+	if (g_dump & (CTFDUMP_LABELS | CTFDUMP_STATS))
+		ctfdump_labels();
+
+	if (g_dump & (CTFDUMP_OBJECTS | CTFDUMP_STATS))
+		ctfdump_objects();
+
+	if (g_dump & (CTFDUMP_FUNCTIONS | CTFDUMP_STATS))
+		ctfdump_functions();
+
+	if (g_dump & (CTFDUMP_TYPES | CTFDUMP_STATS))
+		ctfdump_types();
+
+	if (g_dump & (CTFDUMP_STRINGS | CTFDUMP_STATS))
+		ctfdump_strings();
+
+	if (g_dump & CTFDUMP_STATS)
+		ctfdump_stats();
+
+	if (g_dump & CTFDUMP_OUTPUT)
+		ctfdump_output(ufile);
+
+	return (g_exit);
+}
diff --git a/usr/src/cmd/ctfmerge/Makefile b/usr/src/cmd/ctfmerge/Makefile
new file mode 100644
index 0000000000..02ead98687
--- /dev/null
+++ b/usr/src/cmd/ctfmerge/Makefile
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc.
+#
+
+PROG= ctfmerge 
+
+include ../Makefile.cmd
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf -lelf
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all $(ROOTPROG)
+
+clean:
+
+lint:	lint_PROG
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/ctfmerge/ctfmerge.c b/usr/src/cmd/ctfmerge/ctfmerge.c
new file mode 100644
index 0000000000..a05d6aab9b
--- /dev/null
+++ b/usr/src/cmd/ctfmerge/ctfmerge.c
@@ -0,0 +1,538 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+/*
+ * merge CTF containers
+ */
+
+#include <stdio.h>
+#include <libctf.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <unistd.h>
+#include <sys/fcntl.h>
+#include <stdlib.h>
+#include <libelf.h>
+#include <gelf.h>
+#include <sys/mman.h>
+#include <libgen.h>
+#include <stdarg.h>
+#include <limits.h>
+
+static char *g_progname;
+static char *g_unique;
+static char *g_outfile;
+static boolean_t g_req;
+static uint_t g_nctf;
+
+#define	CTFMERGE_OK	0
+#define	CTFMERGE_FATAL	1
+#define	CTFMERGE_USAGE	2
+
+#define	CTFMERGE_DEFAULT_NTHREADS	8
+#define	CTFMERGE_ALTEXEC	"CTFMERGE_ALTEXEC"
+
+static void
+ctfmerge_fatal(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void) fprintf(stderr, "%s: ", g_progname);
+	va_start(ap, fmt);
+	(void) vfprintf(stderr, fmt, ap);
+	va_end(ap);
+
+	if (g_outfile != NULL)
+		(void) unlink(g_outfile);
+
+	exit(CTFMERGE_FATAL);
+}
+
+static boolean_t
+ctfmerge_expect_ctf(const char *name, Elf *elf)
+{
+	Elf_Scn *scn, *strscn;
+	Elf_Data *data, *strdata;
+	GElf_Shdr shdr;
+	ulong_t i;
+
+	if (g_req == B_FALSE)
+		return (B_FALSE);
+
+	scn = NULL;
+	while ((scn = elf_nextscn(elf, scn)) != NULL) {
+		if (gelf_getshdr(scn, &shdr) == NULL) {
+			ctfmerge_fatal("failed to get section header for file "
+			    "%s: %s\n", name, elf_errmsg(elf_errno()));
+		}
+
+		if (shdr.sh_type == SHT_SYMTAB)
+			break;
+	}
+
+	if (scn == NULL)
+		return (B_FALSE);
+
+	if ((strscn = elf_getscn(elf, shdr.sh_link)) == NULL)
+		ctfmerge_fatal("failed to get section header for file %s: %s\n",
+		    name, elf_errmsg(elf_errno()));
+
+	if ((data = elf_getdata(scn, NULL)) == NULL)
+		ctfmerge_fatal("failed to read symbol table for %s: %s\n",
+		    name, elf_errmsg(elf_errno()));
+
+	if ((strdata = elf_getdata(strscn, NULL)) == NULL)
+		ctfmerge_fatal("failed to read string table for %s: %s\n",
+		    name, elf_errmsg(elf_errno()));
+
+	for (i = 0; i < shdr.sh_size / shdr.sh_entsize; i++) {
+		GElf_Sym sym;
+		const char *file;
+		size_t len;
+
+		if (gelf_getsym(data, i, &sym) == NULL)
+			ctfmerge_fatal("failed to read symbol table entry %d "
+			    "for %s: %s\n", i, name, elf_errmsg(elf_errno()));
+
+		if (GELF_ST_TYPE(sym.st_info) != STT_FILE)
+			continue;
+
+		file = (const char *)((uintptr_t)strdata->d_buf + sym.st_name);
+		len = strlen(file);
+		if (len < 2 || name[len - 2] != '.')
+			continue;
+
+		if (name[len - 1] == 'c')
+			return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * Go through and construct enough information for this Elf Object to try and do
+ * a ctf_bufopen().
+ */
+static void
+ctfmerge_elfopen(const char *name, Elf *elf, ctf_merge_t *cmh)
+{
+	GElf_Ehdr ehdr;
+	GElf_Shdr shdr;
+	Elf_Scn *scn;
+	Elf_Data *ctf_data, *str_data, *sym_data;
+	ctf_sect_t ctfsect, symsect, strsect;
+	ctf_file_t *fp;
+	int err;
+
+	if (gelf_getehdr(elf, &ehdr) == NULL)
+		ctfmerge_fatal("failed to get ELF header for %s: %s\n",
+		    name, elf_errmsg(elf_errno()));
+
+	bzero(&ctfsect, sizeof (ctf_sect_t));
+	bzero(&symsect, sizeof (ctf_sect_t));
+	bzero(&strsect, sizeof (ctf_sect_t));
+
+	scn = NULL;
+	while ((scn = elf_nextscn(elf, scn)) != NULL) {
+		const char *sname;
+
+		if (gelf_getshdr(scn, &shdr) == NULL)
+			ctfmerge_fatal("failed to get section header for "
+			    "file %s: %s\n", name, elf_errmsg(elf_errno()));
+
+		sname = elf_strptr(elf, ehdr.e_shstrndx, shdr.sh_name);
+		if (shdr.sh_type == SHT_PROGBITS &&
+		    strcmp(sname, ".SUNW_ctf") == 0) {
+			ctfsect.cts_name = sname;
+			ctfsect.cts_type = shdr.sh_type;
+			ctfsect.cts_flags = shdr.sh_flags;
+			ctfsect.cts_size = shdr.sh_size;
+			ctfsect.cts_entsize = shdr.sh_entsize;
+			ctfsect.cts_offset = (off64_t)shdr.sh_offset;
+
+			ctf_data = elf_getdata(scn, NULL);
+			if (ctf_data == NULL)
+				ctfmerge_fatal("failed to get ELF CTF "
+				    "data section for %s: %s\n", name,
+				    elf_errmsg(elf_errno()));
+			ctfsect.cts_data = ctf_data->d_buf;
+		} else if (shdr.sh_type == SHT_SYMTAB) {
+			Elf_Scn *strscn;
+			GElf_Shdr strhdr;
+
+			symsect.cts_name = sname;
+			symsect.cts_type = shdr.sh_type;
+			symsect.cts_flags = shdr.sh_flags;
+			symsect.cts_size = shdr.sh_size;
+			symsect.cts_entsize = shdr.sh_entsize;
+			symsect.cts_offset = (off64_t)shdr.sh_offset;
+
+			if ((strscn = elf_getscn(elf, shdr.sh_link)) == NULL ||
+			    gelf_getshdr(strscn, &strhdr) == NULL)
+				ctfmerge_fatal("failed to get "
+				    "string table for file %s: %s\n", name,
+				    elf_errmsg(elf_errno()));
+
+			strsect.cts_name = elf_strptr(elf, ehdr.e_shstrndx,
+			    strhdr.sh_name);
+			strsect.cts_type = strhdr.sh_type;
+			strsect.cts_flags = strhdr.sh_flags;
+			strsect.cts_size = strhdr.sh_size;
+			strsect.cts_entsize = strhdr.sh_entsize;
+			strsect.cts_offset = (off64_t)strhdr.sh_offset;
+
+			sym_data = elf_getdata(scn, NULL);
+			if (sym_data == NULL)
+				ctfmerge_fatal("failed to get ELF CTF "
+				    "data section for %s: %s\n", name,
+				    elf_errmsg(elf_errno()));
+			symsect.cts_data = sym_data->d_buf;
+
+			str_data = elf_getdata(strscn, NULL);
+			if (str_data == NULL)
+				ctfmerge_fatal("failed to get ELF CTF "
+				    "data section for %s: %s\n", name,
+				    elf_errmsg(elf_errno()));
+			strsect.cts_data = str_data->d_buf;
+		}
+	}
+
+	if (ctfsect.cts_type == SHT_NULL) {
+		if (ctfmerge_expect_ctf(name, elf) == B_FALSE)
+			return;
+		ctfmerge_fatal("failed to open %s: %s\n", name,
+		    ctf_errmsg(ECTF_NOCTFDATA));
+	}
+
+	if (symsect.cts_type != SHT_NULL && strsect.cts_type != SHT_NULL) {
+		fp = ctf_bufopen(&ctfsect, &symsect, &strsect, &err);
+	} else {
+		fp = ctf_bufopen(&ctfsect, NULL, NULL, &err);
+	}
+
+	if (fp == NULL) {
+		if (ctfmerge_expect_ctf(name, elf) == B_TRUE) {
+			ctfmerge_fatal("failed to open file %s: %s\n",
+			    name, ctf_errmsg(err));
+		}
+	} else {
+		if ((err = ctf_merge_add(cmh, fp)) != 0) {
+			ctfmerge_fatal("failed to add input %s: %s\n",
+			    name, ctf_errmsg(err));
+		}
+		g_nctf++;
+	}
+}
+
+static void
+ctfmerge_read_archive(const char *name, int fd, Elf *elf,
+    ctf_merge_t *cmh)
+{
+	Elf *aelf;
+	Elf_Cmd cmd = ELF_C_READ;
+	int cursec = 1;
+	char *nname;
+
+	while ((aelf = elf_begin(fd, cmd, elf)) != NULL) {
+		Elf_Arhdr *arhdr;
+		boolean_t leakelf = B_FALSE;
+
+		if ((arhdr = elf_getarhdr(aelf)) == NULL)
+			ctfmerge_fatal("failed to get archive header %d for "
+			    "%s: %s\n", cursec, name, elf_errmsg(elf_errno()));
+
+		if (*(arhdr->ar_name) == '/')
+			goto next;
+
+		if (asprintf(&nname, "%s.%s.%d", name, arhdr->ar_name,
+		    cursec) < 0)
+			ctfmerge_fatal("failed to allocate memory for archive "
+			    "%d of file %s\n", cursec, name);
+
+		switch (elf_kind(aelf)) {
+		case ELF_K_AR:
+			ctfmerge_read_archive(nname, fd, aelf, cmh);
+			free(nname);
+			break;
+		case ELF_K_ELF:
+			ctfmerge_elfopen(nname, aelf, cmh);
+			free(nname);
+			leakelf = B_TRUE;
+			break;
+		default:
+			ctfmerge_fatal("unknown elf kind (%d) in archive %d "
+			    "for %s\n", elf_kind(aelf), cursec, name);
+		}
+
+next:
+		cmd = elf_next(aelf);
+		if (leakelf == B_FALSE)
+			(void) elf_end(aelf);
+		cursec++;
+	}
+}
+
+static void
+ctfmerge_usage(const char *fmt, ...)
+{
+	if (fmt != NULL) {
+		va_list ap;
+
+		(void) fprintf(stderr, "%s: ", g_progname);
+		va_start(ap, fmt);
+		(void) vfprintf(stderr, fmt, ap);
+		va_end(ap);
+	}
+
+	(void) fprintf(stderr, "Usage: %s [-gt] [-d uniqfile] [-l label] "
+	    "[-L labelenv] [-j nthrs] -o outfile file ...\n"
+	    "\n"
+	    "\t-d  uniquify merged output against uniqfile\n"
+	    "\t-g  do not remove source debug information (STABS, DWARF)\n"
+	    "\t-j  use nthrs threads to perform the merge\n"
+	    "\t-l  set output container's label to specified value\n"
+	    "\t-L  set output container's label to value from environment\n"
+	    "\t-o  file to add CTF data to\n"
+	    "\t-t  require CTF data from all inputs built from C sources\n",
+	    g_progname);
+}
+
+static void
+ctfmerge_altexec(char **argv)
+{
+	const char *alt;
+	char *altexec;
+
+	alt = getenv(CTFMERGE_ALTEXEC);
+	if (alt == NULL || *alt == '\0')
+		return;
+
+	altexec = strdup(alt);
+	if (altexec == NULL)
+		ctfmerge_fatal("failed to allocate memory for altexec\n");
+	if (unsetenv(CTFMERGE_ALTEXEC) != 0)
+		ctfmerge_fatal("failed to unset %s from environment: %s\n",
+		    CTFMERGE_ALTEXEC, strerror(errno));
+
+	(void) execv(altexec, argv);
+	ctfmerge_fatal("failed to execute alternate program %s: %s",
+	    altexec, strerror(errno));
+}
+
+int
+main(int argc, char *argv[])
+{
+	int err, i, c, ofd;
+	uint_t nthreads = CTFMERGE_DEFAULT_NTHREADS;
+	char *tmpfile = NULL, *label = NULL;
+	int wflags = CTF_ELFWRITE_F_COMPRESS;
+	ctf_file_t *ofp;
+	ctf_merge_t *cmh;
+	long argj;
+	char *eptr;
+
+	g_progname = basename(argv[0]);
+
+	ctfmerge_altexec(argv);
+
+	/*
+	 * We support a subset of the old CTF merge flags, mostly for
+	 * compatability.
+	 */
+	while ((c = getopt(argc, argv, ":d:fgj:l:L:o:t")) != -1) {
+		switch (c) {
+		case 'd':
+			g_unique = optarg;
+			break;
+		case 'f':
+			/* Silently ignored for compatibility */
+			break;
+		case 'g':
+			/* Silently ignored for compatibility */
+			break;
+		case 'j':
+			errno = 0;
+			argj = strtol(optarg, &eptr, 10);
+			if (errno != 0 || argj == LONG_MAX ||
+			    argj == LONG_MIN || argj <= 0 ||
+			    argj > UINT_MAX || *eptr != '\0') {
+				ctfmerge_fatal("invalid argument for -j: %s\n",
+				    optarg);
+			}
+			nthreads = (uint_t)argj;
+			break;
+		case 'l':
+			label = optarg;
+			break;
+		case 'L':
+			label = getenv(optarg);
+			break;
+		case 'o':
+			g_outfile = optarg;
+			break;
+		case 't':
+			g_req = B_TRUE;
+			break;
+		case ':':
+			ctfmerge_usage("Option -%c requires an operand\n",
+			    optopt);
+			return (CTFMERGE_USAGE);
+		case '?':
+			ctfmerge_usage("Unknown option: -%c\n", optopt);
+			return (CTFMERGE_USAGE);
+		}
+	}
+
+	if (g_outfile == NULL) {
+		ctfmerge_usage("missing required -o output file\n");
+		return (CTFMERGE_USAGE);
+	}
+
+	(void) elf_version(EV_CURRENT);
+
+	/*
+	 * Obviously this isn't atomic, but at least gives us a good starting
+	 * point.
+	 */
+	if ((ofd = open(g_outfile, O_RDWR)) < 0)
+		ctfmerge_fatal("cannot open output file %s: %s\n", g_outfile,
+		    strerror(errno));
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc < 1) {
+		ctfmerge_usage("no input files specified");
+		return (CTFMERGE_USAGE);
+	}
+
+	cmh = ctf_merge_init(ofd, &err);
+	if (cmh == NULL)
+		ctfmerge_fatal("failed to create merge handle: %s\n",
+		    ctf_errmsg(err));
+
+	if ((err = ctf_merge_set_nthreads(cmh, nthreads)) != 0)
+		ctfmerge_fatal("failed to set parallelism to %d: %s\n",
+		    nthreads, ctf_errmsg(err));
+
+	for (i = 0; i < argc; i++) {
+		ctf_file_t *ifp;
+		int fd;
+
+		if ((fd = open(argv[i], O_RDONLY)) < 0)
+			ctfmerge_fatal("failed to open file %s: %s\n",
+			    argv[i], strerror(errno));
+		ifp = ctf_fdopen(fd, &err);
+		if (ifp == NULL) {
+			Elf *e;
+
+			if ((e = elf_begin(fd, ELF_C_READ, NULL)) == NULL) {
+				(void) close(fd);
+				ctfmerge_fatal("failed to open %s: %s\n",
+				    argv[i], ctf_errmsg(err));
+			}
+
+			/*
+			 * It's an ELF file, check if we have an archive or if
+			 * we're expecting CTF here.
+			 */
+			switch (elf_kind(e)) {
+			case ELF_K_AR:
+				break;
+			case ELF_K_ELF:
+				if (ctfmerge_expect_ctf(argv[i], e) == B_TRUE) {
+					(void) elf_end(e);
+					(void) close(fd);
+					ctfmerge_fatal("failed to "
+					    "open %s: file was built from C "
+					    "sources, but missing CTF\n",
+					    argv[i]);
+				}
+				(void) elf_end(e);
+				(void) close(fd);
+				continue;
+			default:
+				(void) elf_end(e);
+				(void) close(fd);
+				ctfmerge_fatal("failed to open %s: "
+				    "unsupported ELF file type", argv[i]);
+			}
+
+			ctfmerge_read_archive(argv[i], fd, e, cmh);
+			(void) elf_end(e);
+			(void) close(fd);
+			continue;
+		}
+		(void) close(fd);
+		if ((err = ctf_merge_add(cmh, ifp)) != 0)
+			ctfmerge_fatal("failed to add input %s: %s\n",
+			    argv[i], ctf_errmsg(err));
+		g_nctf++;
+	}
+
+	if (g_nctf == 0) {
+		ctf_merge_fini(cmh);
+		return (0);
+	}
+
+	if (g_unique != NULL) {
+		ctf_file_t *ufp;
+		char *base;
+
+		ufp = ctf_open(g_unique, &err);
+		if (ufp == NULL) {
+			ctfmerge_fatal("failed to open uniquify file %s: %s\n",
+			    g_unique, ctf_errmsg(err));
+		}
+
+		base = basename(g_unique);
+		(void) ctf_merge_uniquify(cmh, ufp, base);
+	}
+
+	if (label != NULL) {
+		if ((err = ctf_merge_label(cmh, label)) != 0)
+			ctfmerge_fatal("failed to add label %s: %s\n", label,
+			    ctf_errmsg(err));
+	}
+
+	err = ctf_merge_merge(cmh, &ofp);
+	if (err != 0)
+		ctfmerge_fatal("failed to merge types: %s\n", ctf_errmsg(err));
+	ctf_merge_fini(cmh);
+
+	if (asprintf(&tmpfile, "%s.ctf", g_outfile) == -1)
+		ctfmerge_fatal("ran out of memory for temporary file name\n");
+	err = ctf_elfwrite(ofp, g_outfile, tmpfile, wflags);
+	if (err == CTF_ERR) {
+		(void) unlink(tmpfile);
+		free(tmpfile);
+		ctfmerge_fatal("encountered a libctf error: %s!\n",
+		    ctf_errmsg(ctf_errno(ofp)));
+	}
+
+	if (rename(tmpfile, g_outfile) != 0) {
+		(void) unlink(tmpfile);
+		free(tmpfile);
+		ctfmerge_fatal("failed to rename temporary file: %s\n",
+		    strerror(errno));
+	}
+	free(tmpfile);
+
+	return (CTFMERGE_OK);
+}
diff --git a/usr/src/cmd/devfsadm/devlink.tab.sh b/usr/src/cmd/devfsadm/devlink.tab.sh
index 6724fcb573..0267efeb9f 100644
--- a/usr/src/cmd/devfsadm/devlink.tab.sh
+++ b/usr/src/cmd/devfsadm/devlink.tab.sh
@@ -22,8 +22,7 @@
 #
 # Copyright (c) 1998, 2000 by Sun Microsystems, Inc.
 # All rights reserved.
-#
-#ident	"%Z%%M%	%I%	%E% SMI"
+# Copyright (c) 2012 Joyent, Inc. All rights reserved.
 #
 # This is the script that generates the devlink.tab file. It is
 # architecture-aware, and dumps different stuff for x86 and sparc.
@@ -34,8 +33,6 @@
 #
 
 cat <<EOM
-#ident   "%Z%%M% %I%     %E% SMI"
-#
 # Copyright (c) 1998 by Sun Microsystems, Inc.
 #
 #
diff --git a/usr/src/cmd/devfsadm/i386/Makefile b/usr/src/cmd/devfsadm/i386/Makefile
index 179db79979..8bd5a45401 100644
--- a/usr/src/cmd/devfsadm/i386/Makefile
+++ b/usr/src/cmd/devfsadm/i386/Makefile
@@ -25,8 +25,11 @@
 LINK_OBJS_i386 = \
 	drm_link_i386.o \
 	misc_link_i386.o \
+	lx_link_i386.o \
 	xen_link.o
 
+lx_link_i386.o lx_link_i386.po lx_link_i386.ln := CPPFLAGS += -I$(UTSBASE)/common/brand/lx
+
 xen_link.o xen_link.ln xen_link.po := CPPFLAGS += -I$(UTSBASE)/i86xpv
 
 include ../Makefile.com
diff --git a/usr/src/cmd/devfsadm/i386/lx_link_i386.c b/usr/src/cmd/devfsadm/i386/lx_link_i386.c
new file mode 100644
index 0000000000..b99a8361a0
--- /dev/null
+++ b/usr/src/cmd/devfsadm/i386/lx_link_i386.c
@@ -0,0 +1,81 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <devfsadm.h>
+#include <strings.h>
+#include <stdio.h>
+#include <sys/lx_ptm.h>
+#include <sys/lx_autofs.h>
+
+static int lx_ptm(di_minor_t minor, di_node_t node);
+static int lx_autofs(di_minor_t minor, di_node_t node);
+static int lx_systrace(di_minor_t minor, di_node_t node);
+
+static devfsadm_create_t lx_create_cbt[] = {
+	{ "pseudo", "ddi_pseudo", LX_PTM_DRV,
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, lx_ptm },
+	{ "pseudo", "ddi_pseudo", LX_AUTOFS_NAME,
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, lx_autofs },
+	{ "pseudo", "ddi_pseudo", "lx_systrace",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, lx_systrace },
+};
+
+DEVFSADM_CREATE_INIT_V0(lx_create_cbt);
+
+static int
+lx_ptm(di_minor_t minor, di_node_t node)
+{
+	char *mname = di_minor_name(minor);
+
+	if (strcmp(LX_PTM_MINOR_NODE, mname) == 0)
+		(void) devfsadm_mklink("brand/lx/ptmx", node, minor, 0);
+
+	return (DEVFSADM_CONTINUE);
+}
+
+static int
+lx_autofs(di_minor_t minor, di_node_t node)
+{
+	char *mname = di_minor_name(minor);
+
+	if (strcmp(LX_AUTOFS_MINORNAME, mname) == 0)
+		(void) devfsadm_mklink("brand/lx/autofs", node, minor, 0);
+
+	return (DEVFSADM_CONTINUE);
+}
+
+static int
+lx_systrace(di_minor_t minor, di_node_t node)
+{
+	char *mname = di_minor_name(minor);
+	char path[MAXPATHLEN];
+
+	(void) snprintf(path, sizeof (path), "dtrace/provider/%s", mname);
+	(void) devfsadm_mklink(path, node, minor, 0);
+
+	return (DEVFSADM_CONTINUE);
+}
diff --git a/usr/src/cmd/devfsadm/i386/misc_link_i386.c b/usr/src/cmd/devfsadm/i386/misc_link_i386.c
index 67d06ee101..6b21eabe3b 100644
--- a/usr/src/cmd/devfsadm/i386/misc_link_i386.c
+++ b/usr/src/cmd/devfsadm/i386/misc_link_i386.c
@@ -21,7 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2012 Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.  All rights reserved.
  */
 
 #include <regex.h>
@@ -36,6 +36,7 @@
 
 extern int system_labeled;
 
+static int ln_minor_name(di_minor_t minor, di_node_t node);
 static int lp(di_minor_t minor, di_node_t node);
 static int serial_dialout(di_minor_t minor, di_node_t node);
 static int serial(di_minor_t minor, di_node_t node);
@@ -43,12 +44,9 @@ static int diskette(di_minor_t minor, di_node_t node);
 static int vt00(di_minor_t minor, di_node_t node);
 static int kdmouse(di_minor_t minor, di_node_t node);
 static int ipmi(di_minor_t minor, di_node_t node);
-static int smbios(di_minor_t minor, di_node_t node);
 static int mc_node(di_minor_t minor, di_node_t node);
-static int xsvc(di_minor_t minor, di_node_t node);
-static int srn(di_minor_t minor, di_node_t node);
-static int ucode(di_minor_t minor, di_node_t node);
-
+static int vmmctl(di_minor_t minor, di_node_t node);
+static int ppt(di_minor_t minor, di_node_t node);
 
 static devfsadm_create_t misc_cbt[] = {
 	{ "vt00", "ddi_display", NULL,
@@ -61,7 +59,7 @@ static devfsadm_create_t misc_cbt[] = {
 	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, ipmi,
 	},
 	{ "pseudo", "ddi_pseudo", "smbios",
-	    TYPE_EXACT | DRV_EXACT, ILEVEL_1, smbios,
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_1, ln_minor_name,
 	},
 	/* floppies share the same class, but not link regex, as hard disks */
 	{ "disk",  "ddi_block:diskette", NULL,
@@ -76,18 +74,27 @@ static devfsadm_create_t misc_cbt[] = {
 	{ "serial",  "ddi_serial:dialout,mb", NULL,
 	    TYPE_EXACT, ILEVEL_1, serial_dialout
 	},
-	{ "pseudo", "ddi_pseudo", NULL,
-	    TYPE_EXACT, ILEVEL_0, xsvc
+	{ "pseudo", "ddi_pseudo", "xsvc",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, ln_minor_name,
 	},
-	{ "pseudo", "ddi_pseudo", NULL,
-	    TYPE_EXACT, ILEVEL_0, srn
+	{ "pseudo", "ddi_pseudo", "srn",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, ln_minor_name,
 	},
 	{ "memory-controller", "ddi_mem_ctrl", NULL,
 	    TYPE_EXACT, ILEVEL_0, mc_node
 	},
 	{ "pseudo", "ddi_pseudo", "ucode",
-	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, ucode,
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, ln_minor_name,
+	},
+	{ "pseudo", "ddi_pseudo", "viona",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, ln_minor_name,
+	},
+	{ "pseudo", "ddi_pseudo", "vmm",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, vmmctl,
 	},
+	{ "pseudo", "ddi_pseudo", "ppt",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, ppt,
+	}
 };
 
 DEVFSADM_CREATE_INIT_V0(misc_cbt);
@@ -113,12 +120,32 @@ static devfsadm_remove_t misc_remove_cbt[] = {
 	},
 	{ "serial", "^tty[a-z]$", RM_ALWAYS | RM_PRE,
 		ILEVEL_1, devfsadm_rm_all
+	},
+	{ "pseudo", "^viona$", RM_ALWAYS | RM_PRE | RM_HOT,
+		ILEVEL_0, devfsadm_rm_all
+	},
+	{ "pseudo", "^vmmctl$", RM_ALWAYS | RM_PRE | RM_HOT,
+		ILEVEL_0, devfsadm_rm_all
+	},
+	{ "pseudo", "^ppt$", RM_ALWAYS | RM_PRE | RM_HOT,
+		ILEVEL_0, devfsadm_rm_all
 	}
 };
 
 DEVFSADM_REMOVE_INIT_V0(misc_remove_cbt);
 
 /*
+ * Any /dev/foo named named after the minor name such as
+ * /devices/.../driver@0:foo
+ */
+static int
+ln_minor_name(di_minor_t minor, di_node_t node)
+{
+	(void) devfsadm_mklink(di_minor_name(minor), node, minor, 0);
+	return (DEVFSADM_CONTINUE);
+}
+
+/*
  * Handles minor node type "ddi_display", in addition to generic processing
  * done by display().
  *
@@ -305,13 +332,6 @@ ipmi(di_minor_t minor, di_node_t node)
 	return (DEVFSADM_CONTINUE);
 }
 
-static int
-smbios(di_minor_t minor, di_node_t node)
-{
-	(void) devfsadm_mklink("smbios", node, minor, 0);
-	return (DEVFSADM_CONTINUE);
-}
-
 /*
  * /dev/mc/mc<chipid> -> /devices/.../pci1022,1102@<chipid+24>,2:mc-amd
  */
@@ -347,49 +367,24 @@ mc_node(di_minor_t minor, di_node_t node)
 }
 
 /*
- * Creates \M0 devlink for xsvc node
+ *	/dev/vmmctl	->	/devices/pseudo/vmm@0:ctl
  */
 static int
-xsvc(di_minor_t minor, di_node_t node)
+vmmctl(di_minor_t minor, di_node_t node)
 {
-	char *mn;
-
-	if (strcmp(di_node_name(node), "xsvc") != 0)
-		return (DEVFSADM_CONTINUE);
-
-	mn = di_minor_name(minor);
-	if (mn == NULL)
-		return (DEVFSADM_CONTINUE);
-
-	(void) devfsadm_mklink(mn, node, minor, 0);
+	if (strcmp(di_minor_name(minor), "ctl") == 0)
+		(void) devfsadm_mklink("vmmctl", node, minor, 0);
 	return (DEVFSADM_CONTINUE);
 }
 
-/*
- * Creates \M0 devlink for srn device
- */
 static int
-srn(di_minor_t minor, di_node_t node)
+ppt(di_minor_t minor, di_node_t node)
 {
-	char *mn;
-
-	if (strcmp(di_node_name(node), "srn") != 0)
-		return (DEVFSADM_CONTINUE);
-
-	mn = di_minor_name(minor);
-	if (mn == NULL)
-		return (DEVFSADM_CONTINUE);
+	char linkpath[PATH_MAX];
 
-	(void) devfsadm_mklink(mn, node, minor, 0);
-	return (DEVFSADM_CONTINUE);
-}
+	(void) snprintf(linkpath, sizeof (linkpath), "ppt%d",
+	    di_instance(node));
 
-/*
- *	/dev/ucode	->	/devices/pseudo/ucode@0:ucode
- */
-static int
-ucode(di_minor_t minor, di_node_t node)
-{
-	(void) devfsadm_mklink("ucode", node, minor, 0);
+	(void) devfsadm_mklink(linkpath, node, minor, 0);
 	return (DEVFSADM_CONTINUE);
 }
diff --git a/usr/src/cmd/devfsadm/misc_link.c b/usr/src/cmd/devfsadm/misc_link.c
index 5f241df296..55aff1e4f7 100644
--- a/usr/src/cmd/devfsadm/misc_link.c
+++ b/usr/src/cmd/devfsadm/misc_link.c
@@ -32,6 +32,7 @@
 #include <limits.h>
 #include <sys/zone.h>
 #include <sys/zcons.h>
+#include <sys/zfd.h>
 #include <sys/cpuid_drv.h>
 
 static int display(di_minor_t minor, di_node_t node);
@@ -53,6 +54,7 @@ static int av_create(di_minor_t minor, di_node_t node);
 static int tsalarm_create(di_minor_t minor, di_node_t node);
 static int ntwdt_create(di_minor_t minor, di_node_t node);
 static int zcons_create(di_minor_t minor, di_node_t node);
+static int zfd_create(di_minor_t minor, di_node_t node);
 static int cpuid(di_minor_t minor, di_node_t node);
 static int glvc(di_minor_t minor, di_node_t node);
 static int ses_callback(di_minor_t minor, di_node_t node);
@@ -114,6 +116,9 @@ static devfsadm_create_t misc_cbt[] = {
 	    "(^nca$)|(^rds$)|(^sdp$)|(^ipnet$)|(^dlpistub$)|(^bpf$)",
 	    TYPE_EXACT | DRV_RE, ILEVEL_1, minor_name
 	},
+	{ "pseudo", "ddi_pseudo", "inotify",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, minor_name
+	},
 	{ "pseudo", "ddi_pseudo", "ipd",
 	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, minor_name
 	},
@@ -180,6 +185,9 @@ static devfsadm_create_t misc_cbt[] = {
 	{ "pseudo", "ddi_pseudo", "zcons",
 	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, zcons_create,
 	},
+	{ "pseudo", "ddi_pseudo", "zfd",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, zfd_create,
+	},
 	{ "pseudo", "ddi_pseudo", CPUID_DRIVER_NAME,
 	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, cpuid,
 	},
@@ -204,6 +212,9 @@ static devfsadm_create_t misc_cbt[] = {
 	{ "pseudo", "ddi_pseudo", "tpm",
 	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, minor_name
 	},
+	{ "pseudo", "ddi_pseudo", "overlay",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, minor_name
+	}
 };
 
 DEVFSADM_CREATE_INIT_V0(misc_cbt);
@@ -228,6 +239,9 @@ static devfsadm_remove_t misc_remove_cbt[] = {
 		ZCONS_SLAVE_NAME ")$",
 	    RM_PRE | RM_HOT | RM_ALWAYS, ILEVEL_0, devfsadm_rm_all
 	},
+	{ "pseudo", "^zfd/" ZONENAME_REGEXP "/(master|slave)/[0-9]+$",
+	    RM_PRE | RM_HOT | RM_ALWAYS, ILEVEL_0, devfsadm_rm_all
+	},
 	{ "pseudo", "^" CPUID_SELF_NAME "$", RM_ALWAYS | RM_PRE | RM_HOT,
 	    ILEVEL_0, devfsadm_rm_all
 	},
@@ -675,6 +689,35 @@ zcons_create(di_minor_t minor, di_node_t node)
 	return (DEVFSADM_CONTINUE);
 }
 
+static int
+zfd_create(di_minor_t minor, di_node_t node)
+{
+	char	*minor_str;
+	char	*zonename;
+	int	*id;
+	char	path[MAXPATHLEN];
+
+	minor_str = di_minor_name(minor);
+
+	if (di_prop_lookup_strings(DDI_DEV_T_ANY, node, "zfd_zname",
+	    &zonename) == -1)
+		return (DEVFSADM_CONTINUE);
+
+	if (di_prop_lookup_ints(DDI_DEV_T_ANY, node, "zfd_id", &id) == -1)
+		return (DEVFSADM_CONTINUE);
+
+	if (strncmp(minor_str, "slave", 5) == 0) {
+		(void) snprintf(path, sizeof (path), "zfd/%s/slave/%d",
+		    zonename, id[0]);
+	} else {
+		(void) snprintf(path, sizeof (path), "zfd/%s/master/%d",
+		    zonename, id[0]);
+	}
+	(void) devfsadm_mklink(path, node, minor, 0);
+
+	return (DEVFSADM_CONTINUE);
+}
+
 /*
  *	/dev/cpu/self/cpuid 	->	/devices/pseudo/cpuid@0:self
  */
diff --git a/usr/src/cmd/dladm/Makefile b/usr/src/cmd/dladm/Makefile
index 1eeede7152..e68f441519 100644
--- a/usr/src/cmd/dladm/Makefile
+++ b/usr/src/cmd/dladm/Makefile
@@ -22,6 +22,7 @@
 #
 # Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 
 PROG=		dladm
@@ -39,7 +40,7 @@ XGETFLAGS +=	-a -x $(PROG).xcl
 
 LDLIBS +=	-L$(ROOT)/lib -lsocket
 LDLIBS +=	-ldladm -ldlpi -lkstat -lsecdb -lbsm -lofmt -linetutil -ldevinfo
-LDLIBS +=	$(ZLAZYLOAD) -lrstp $(ZNOLAZYLOAD)
+LDLIBS +=	$(ZLAZYLOAD) -lrstp $(ZNOLAZYLOAD) -lnsl -lumem -lcustr
 
 CERRWARN +=	-_gcc=-Wno-switch
 CERRWARN +=	-_gcc=-Wno-unused-label
diff --git a/usr/src/cmd/dladm/dladm.c b/usr/src/cmd/dladm/dladm.c
index c2ad993494..d80e68f165 100644
--- a/usr/src/cmd/dladm/dladm.c
+++ b/usr/src/cmd/dladm/dladm.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  * Copyright 2016 Nexenta Systems, Inc.
  */
 
@@ -61,6 +62,7 @@
 #include <libdliptun.h>
 #include <libdlsim.h>
 #include <libdlbridge.h>
+#include <libdloverlay.h>
 #include <libinetutil.h>
 #include <libvrrpadm.h>
 #include <bsm/adt.h>
@@ -76,6 +78,7 @@
 #include <stddef.h>
 #include <stp_in.h>
 #include <ofmt.h>
+#include <libcustr.h>
 
 #define	MAXPORT			256
 #define	MAXVNIC			256
@@ -156,6 +159,7 @@ typedef struct show_vnic_state {
 	dladm_status_t	vs_status;
 	uint32_t	vs_flags;
 	ofmt_handle_t	vs_ofmt;
+	char		*vs_zonename;
 } show_vnic_state_t;
 
 typedef struct show_part_state {
@@ -186,6 +190,11 @@ typedef struct show_usage_state_s {
 	ofmt_handle_t	us_ofmt;
 } show_usage_state_t;
 
+typedef struct show_overlay_request_s {
+	boolean_t	sor_failed;
+	ofmt_handle_t	sor_ofmt;
+} show_overlay_request_t;
+
 /*
  * callback functions for printing output and error diagnostics.
  */
@@ -194,6 +203,7 @@ static ofmt_cb_t print_lacp_cb, print_phys_one_mac_cb;
 static ofmt_cb_t print_xaggr_cb, print_aggr_stats_cb;
 static ofmt_cb_t print_phys_one_hwgrp_cb, print_wlan_attr_cb;
 static ofmt_cb_t print_wifi_status_cb, print_link_attr_cb;
+static ofmt_cb_t print_overlay_cb, print_overlay_fma_cb, print_overlay_targ_cb;
 
 typedef void cmdfunc_t(int, char **, const char *);
 
@@ -220,6 +230,8 @@ static cmdfunc_t do_create_bridge, do_modify_bridge, do_delete_bridge;
 static cmdfunc_t do_add_bridge, do_remove_bridge, do_show_bridge;
 static cmdfunc_t do_create_iptun, do_modify_iptun, do_delete_iptun;
 static cmdfunc_t do_show_iptun, do_up_iptun, do_down_iptun;
+static cmdfunc_t do_create_overlay, do_delete_overlay, do_modify_overlay;
+static cmdfunc_t do_show_overlay;
 
 static void 	do_up_vnic_common(int, char **, const char *, boolean_t);
 
@@ -255,8 +267,11 @@ static void	die(const char *, ...);
 static void	die_optdup(int);
 static void	die_opterr(int, int, const char *);
 static void	die_dlerr(dladm_status_t, const char *, ...);
+static void	die_dlerrlist(dladm_status_t, dladm_errlist_t *,
+    const char *, ...);
 static void	warn(const char *, ...);
 static void	warn_dlerr(dladm_status_t, const char *, ...);
+static void	warn_dlerrlist(dladm_errlist_t *);
 
 typedef struct	cmd {
 	char		*c_name;
@@ -266,7 +281,7 @@ typedef struct	cmd {
 
 static cmd_t	cmds[] = {
 	{ "rename-link",	do_rename_link,
-	    "    rename-link      <oldlink> <newlink>"			},
+	    "    rename-link      [-z zonename] <oldlink> <newlink>"	},
 	{ "show-link",		do_show_link,
 	    "    show-link        [-pP] [-o <field>,..] [-s [-i <interval>]] "
 	    "[<link>]\n"						},
@@ -301,12 +316,13 @@ static cmd_t	cmds[] = {
 	{ "show-wifi",		do_show_wifi,
 	    "    show-wifi        [-p] [-o <field>,...] [<link>]\n"	},
 	{ "set-linkprop",	do_set_linkprop,
-	    "    set-linkprop     [-t] -p <prop>=<value>[,...] <name>"	},
+	    "    set-linkprop     [-t] [-z zonename] -p <prop>=<value>[,...] "
+	    "<name>"							},
 	{ "reset-linkprop",	do_reset_linkprop,
-	    "    reset-linkprop   [-t] [-p <prop>,...] <name>"		},
+	    "    reset-linkprop   [-t] [-z zonename] [-p <prop>,...] <name>"},
 	{ "show-linkprop",	do_show_linkprop,
-	    "    show-linkprop    [-cP] [-o <field>,...] [-p <prop>,...] "
-	    "<name>\n"							},
+	    "    show-linkprop    [-cP] [-o <field>,...] [-z zonename] "
+	    "[-p <prop>,...] <name>\n"					},
 	{ "show-ether",		do_show_ether,
 	    "    show-ether       [-px][-o <field>,...] <link>\n"	},
 	{ "create-secobj",	do_create_secobj,
@@ -348,10 +364,10 @@ static cmd_t	cmds[] = {
 	    "\t\t     {vrrp -V <vrid> -A {inet | inet6}} [-v <vid> [-f]]\n"
 	    "\t\t     [-p <prop>=<value>[,...]] <vnic-link>"	},
 	{ "delete-vnic",	do_delete_vnic,
-	    "    delete-vnic      [-t] <vnic-link>"			},
+	    "    delete-vnic      [-t] [-z zonename] <vnic-link>"	},
 	{ "show-vnic",		do_show_vnic,
-	    "    show-vnic        [-pP] [-l <link>] [-s [-i <interval>]] "
-	    "[<link>]\n"						},
+	    "    show-vnic        [-pP] [-l <link>] [-z zonename] "
+	    "[-s [-i <interval>]] [<link>]\n"				},
 	{ "up-vnic",		do_up_vnic,		NULL		},
 	{ "create-part",	do_create_part,
 	    "    create-part      [-t] [-f] -l <link> [-P <pkey>]\n"
@@ -402,6 +418,17 @@ static cmd_t	cmds[] = {
 	    " <bridge>\n"
 	    "    show-bridge      -t [-p] [-o <field>,...] [-s [-i <interval>]]"
 	    " <bridge>\n"						},
+	{ "create-overlay",	do_create_overlay,
+	    "    create-overlay   [-t] -e <encap> -s <search> -v <vnetid>\n"
+	    "\t\t     [ -p <prop>=<value>[,...]] <overlay>"	},
+	{ "delete-overlay",	do_delete_overlay,
+	    "    delete-overlay   <overlay>"			},
+	{ "modify-overlay",	do_modify_overlay,
+	    "    modify-overlay   -d mac | -f | -s mac=ip:port "
+	    "<overlay>"						},
+	{ "show-overlay",	do_show_overlay,
+	    "    show-overlay     [-f | -t] [[-p] -o <field>,...] "
+	    "[<overlay>]\n"						},
 	{ "show-usage",		do_show_usage,
 	    "    show-usage       [-a] [-d | -F <format>] "
 	    "[-s <DD/MM/YYYY,HH:MM:SS>]\n"
@@ -960,6 +987,7 @@ typedef struct show_linkprop_state {
 	char			ls_link[MAXLINKNAMELEN];
 	char			*ls_line;
 	char			**ls_propvals;
+	char			*ls_zonename;
 	dladm_arg_list_t	*ls_proplist;
 	boolean_t		ls_parsable;
 	boolean_t		ls_persist;
@@ -1012,21 +1040,24 @@ typedef struct vnic_fields_buf_s
 	char vnic_macaddr[18];
 	char vnic_macaddrtype[19];
 	char vnic_vid[6];
+	char vnic_zone[ZONENAME_MAX];
 } vnic_fields_buf_t;
 
 static const ofmt_field_t vnic_fields[] = {
 { "LINK",		13,
 	offsetof(vnic_fields_buf_t, vnic_link),	print_default_cb},
-{ "OVER",		13,
+{ "OVER",		11,
 	offsetof(vnic_fields_buf_t, vnic_over),	print_default_cb},
-{ "SPEED",		7,
+{ "SPEED",		6,
 	offsetof(vnic_fields_buf_t, vnic_speed), print_default_cb},
 { "MACADDRESS",		18,
 	offsetof(vnic_fields_buf_t, vnic_macaddr), print_default_cb},
-{ "MACADDRTYPE",	20,
+{ "MACADDRTYPE",	12,
 	offsetof(vnic_fields_buf_t, vnic_macaddrtype), print_default_cb},
-{ "VID",		7,
+{ "VID",		5,
 	offsetof(vnic_fields_buf_t, vnic_vid), print_default_cb},
+{ "ZONE",		20,
+	offsetof(vnic_fields_buf_t, vnic_zone), print_default_cb},
 { NULL,			0, 0, NULL}}
 ;
 
@@ -1426,6 +1457,82 @@ static ofmt_field_t bridge_trill_fields[] = {
     offsetof(bridge_trill_fields_buf_t, bridget_nexthop), print_default_cb },
 { NULL,		0, 0, NULL}};
 
+static const struct option overlay_create_lopts[] = {
+	{ "encap",	required_argument,	NULL,	'e' },
+	{ "prop",	required_argument,	NULL,	'p' },
+	{ "search",	required_argument,	NULL,	's' },
+	{ "temporary", 	no_argument,		NULL,	't' },
+	{ "vnetid",	required_argument,	NULL,	'v' },
+	{ NULL,		0,			NULL,	0 }
+};
+
+static const struct option overlay_modify_lopts[] = {
+	{ "delete-entry",	required_argument,	NULL,	'd' },
+	{ "flush-table",	no_argument,		NULL,	'f' },
+	{ "set-entry",		required_argument,	NULL,	's' },
+	{ NULL,			0,			NULL,	0 }
+};
+
+static const struct option overlay_show_lopts[] = {
+	{ "fma",	no_argument,		NULL,	'f' },
+	{ "target",	no_argument,		NULL,	't' },
+	{ "parsable",	no_argument,		NULL,	'p' },
+	{ "parseable",	no_argument,		NULL,	'p' },
+	{ "output",	required_argument,	NULL,	'o' },
+	{ NULL,		0,			NULL,	0 }
+};
+
+/*
+ * Structures for dladm show-overlay
+ */
+typedef enum {
+	OVERLAY_LINK,
+	OVERLAY_PROPERTY,
+	OVERLAY_PERM,
+	OVERLAY_REQ,
+	OVERLAY_VALUE,
+	OVERLAY_DEFAULT,
+	OVERLAY_POSSIBLE
+} overlay_field_index_t;
+
+static const ofmt_field_t overlay_fields[] = {
+/* name,	field width,  index */
+{ "LINK",	19,	OVERLAY_LINK,		print_overlay_cb },
+{ "PROPERTY",	19,	OVERLAY_PROPERTY,	print_overlay_cb },
+{ "PERM",	5,	OVERLAY_PERM,		print_overlay_cb },
+{ "REQ",	4,	OVERLAY_REQ,		print_overlay_cb },
+{ "VALUE",	11,	OVERLAY_VALUE,		print_overlay_cb },
+{ "DEFAULT",	10,	OVERLAY_DEFAULT,	print_overlay_cb },
+{ "POSSIBLE",	10,	OVERLAY_POSSIBLE,	print_overlay_cb },
+{ NULL,		0,	0,	NULL }
+};
+
+typedef enum {
+	OVERLAY_FMA_LINK,
+	OVERLAY_FMA_STATUS,
+	OVERLAY_FMA_DETAILS
+} overlay_fma_field_index_t;
+
+static const ofmt_field_t overlay_fma_fields[] = {
+{ "LINK",	20,	OVERLAY_FMA_LINK,	print_overlay_fma_cb },
+{ "STATUS",	8,	OVERLAY_FMA_STATUS,	print_overlay_fma_cb },
+{ "DETAILS",	52,	OVERLAY_FMA_DETAILS,	print_overlay_fma_cb },
+{ NULL,		0,	0,			NULL }
+};
+
+typedef enum {
+	OVERLAY_TARG_LINK,
+	OVERLAY_TARG_TARGET,
+	OVERLAY_TARG_DEST
+} overlay_targ_field_index_t;
+
+static const ofmt_field_t overlay_targ_fields[] = {
+{ "LINK",		20,	OVERLAY_TARG_LINK,	print_overlay_targ_cb },
+{ "TARGET",		18,	OVERLAY_TARG_TARGET,	print_overlay_targ_cb },
+{ "DESTINATION",	42,	OVERLAY_TARG_DEST,	print_overlay_targ_cb },
+{ NULL,			0,	0,			NULL }
+};
+
 static char *progname;
 static sig_atomic_t signalled;
 
@@ -1435,6 +1542,12 @@ static sig_atomic_t signalled;
  */
 static dladm_handle_t handle = NULL;
 
+/*
+ * Global error list that all routines can use. It's initialized by the main
+ * code.
+ */
+static dladm_errlist_t errlist;
+
 #define	DLADM_ETHERSTUB_NAME	"etherstub"
 #define	DLADM_IS_ETHERSTUB(id)	(id == DATALINK_INVALID_LINKID)
 
@@ -1485,6 +1598,8 @@ main(int argc, char *argv[])
 				    "could not open /dev/dld");
 			}
 
+			dladm_errlist_init(&errlist);
+
 			cmdp->c_fn(argc - 1, &argv[1], cmdp->c_usage);
 
 			dladm_close(handle);
@@ -2496,13 +2611,17 @@ do_rename_link(int argc, char *argv[], const char *use)
 	char		*link1, *link2;
 	char		*altroot = NULL;
 	dladm_status_t	status;
+	char		*zonename = NULL;
 
 	opterr = 0;
-	while ((option = getopt_long(argc, argv, ":R:", lopts, NULL)) != -1) {
+	while ((option = getopt_long(argc, argv, ":R:z:", lopts, NULL)) != -1) {
 		switch (option) {
 		case 'R':
 			altroot = optarg;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option, use);
 			break;
@@ -2518,7 +2637,7 @@ do_rename_link(int argc, char *argv[], const char *use)
 
 	link1 = argv[optind++];
 	link2 = argv[optind];
-	if ((status = dladm_rename_link(handle, link1, link2)) !=
+	if ((status = dladm_rename_link(handle, zonename, link1, link2)) !=
 	    DLADM_STATUS_OK)
 		die_dlerr(status, "rename operation failed");
 }
@@ -3407,11 +3526,12 @@ do_show_link(int argc, char *argv[], const char *use)
 	ofmt_handle_t	ofmt;
 	ofmt_status_t	oferr;
 	uint_t		ofmtflags = 0;
+	char		*zonename = NULL;
 
 	bzero(&state, sizeof (state));
 
 	opterr = 0;
-	while ((option = getopt_long(argc, argv, ":pPsi:o:",
+	while ((option = getopt_long(argc, argv, ":pPsi:o:z:",
 	    show_lopts, NULL)) != -1) {
 		switch (option) {
 		case 'p':
@@ -3444,6 +3564,9 @@ do_show_link(int argc, char *argv[], const char *use)
 			if (!dladm_str2interval(optarg, &interval))
 				die("invalid interval value '%s'", optarg);
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option, use);
 			break;
@@ -3463,8 +3586,8 @@ do_show_link(int argc, char *argv[], const char *use)
 		if (strlcpy(linkname, argv[optind], MAXLINKNAMELEN) >=
 		    MAXLINKNAMELEN)
 			die("link name too long");
-		if ((status = dladm_name2info(handle, linkname, &linkid, &f,
-		    NULL, NULL)) != DLADM_STATUS_OK) {
+		if ((status = dladm_zname2info(handle, zonename, linkname,
+		    &linkid, &f, NULL, NULL)) != DLADM_STATUS_OK) {
 			die_dlerr(status, "link %s is not valid", linkname);
 		}
 
@@ -4733,6 +4856,12 @@ do_create_vnic(int argc, char *argv[], const char *use)
 	if ((flags & DLADM_OPT_FORCE) != 0 && vid == 0)
 		die("-f option can only be used with -v");
 
+	/*
+	 * If creating a transient VNIC for a zone, mark it in the kernel.
+	 */
+	if (strstr(propstr, "zone=") != NULL && !(flags & DLADM_OPT_PERSIST))
+		flags |= DLADM_OPT_TRANSIENT;
+
 	if (mac_prefix_len != 0 && mac_addr_type != VNIC_MAC_ADDR_TYPE_RANDOM &&
 	    mac_addr_type != VNIC_MAC_ADDR_TYPE_FIXED)
 		usage();
@@ -4777,7 +4906,7 @@ do_create_vnic(int argc, char *argv[], const char *use)
 
 	status = dladm_vnic_create(handle, name, dev_linkid, mac_addr_type,
 	    mac_addr, maclen, &mac_slot, mac_prefix_len, vid, vrid, af,
-	    &linkid, proplist, flags);
+	    &linkid, proplist, &errlist, flags);
 	switch (status) {
 	case DLADM_STATUS_OK:
 		break;
@@ -4788,7 +4917,8 @@ do_create_vnic(int argc, char *argv[], const char *use)
 		break;
 
 	default:
-		die_dlerr(status, "vnic creation over %s failed", devname);
+		die_dlerrlist(status, &errlist, "vnic creation over %s failed",
+		    devname);
 	}
 
 	dladm_free_props(proplist);
@@ -4824,9 +4954,10 @@ do_delete_vnic_common(int argc, char *argv[], const char *use,
 	datalink_id_t linkid;
 	char *altroot = NULL;
 	dladm_status_t status;
+	char	*zonename = NULL;
 
 	opterr = 0;
-	while ((option = getopt_long(argc, argv, ":R:t", lopts,
+	while ((option = getopt_long(argc, argv, ":R:tz:", lopts,
 	    NULL)) != -1) {
 		switch (option) {
 		case 't':
@@ -4835,6 +4966,9 @@ do_delete_vnic_common(int argc, char *argv[], const char *use,
 		case 'R':
 			altroot = optarg;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option, use);
 		}
@@ -4847,8 +4981,8 @@ do_delete_vnic_common(int argc, char *argv[], const char *use,
 	if (altroot != NULL)
 		altroot_cmd(altroot, argc, argv);
 
-	status = dladm_name2info(handle, argv[optind], &linkid, NULL, NULL,
-	    NULL);
+	status = dladm_zname2info(handle, zonename, argv[optind], &linkid, NULL,
+	    NULL, NULL);
 	if (status != DLADM_STATUS_OK)
 		die("invalid link name '%s'", argv[optind]);
 
@@ -4980,6 +5114,9 @@ print_vnic(show_vnic_state_t *state, datalink_id_t linkid)
 	char			vnic_name[MAXLINKNAMELEN];
 	char			mstr[MAXMACADDRLEN * 3];
 	vnic_fields_buf_t	vbuf;
+	uint_t			valcnt = 1;
+	char			zonename[DLADM_PROP_VAL_MAX + 1];
+	char			*valptr[1];
 
 	if ((status = dladm_vnic_info(handle, linkid, vnic, state->vs_flags)) !=
 	    DLADM_STATUS_OK)
@@ -5009,6 +5146,18 @@ print_vnic(show_vnic_state_t *state, datalink_id_t linkid)
 	    NULL, devname, sizeof (devname)) != DLADM_STATUS_OK)
 		(void) sprintf(devname, "?");
 
+
+	zonename[0] = '\0';
+	if (!is_etherstub) {
+		valptr[0] = zonename;
+		(void) dladm_get_linkprop(handle, linkid,
+		    DLADM_PROP_VAL_CURRENT, "zone", (char **)valptr, &valcnt);
+	}
+
+	if (state->vs_zonename != NULL &&
+	    strcmp(state->vs_zonename, zonename) != 0)
+		return (DLADM_STATUS_OK);
+
 	state->vs_found = B_TRUE;
 	if (state->vs_stats) {
 		/* print vnic statistics */
@@ -5084,6 +5233,13 @@ print_vnic(show_vnic_state_t *state, datalink_id_t linkid)
 
 			(void) snprintf(vbuf.vnic_vid, sizeof (vbuf.vnic_vid),
 			    "%d", vnic->va_vid);
+
+			if (zonename[0] != '\0')
+				(void) snprintf(vbuf.vnic_zone,
+				    sizeof (vbuf.vnic_zone), "%s", zonename);
+			else
+				(void) strlcpy(vbuf.vnic_zone, "--",
+				    sizeof (vbuf.vnic_zone));
 		}
 
 		ofmt_print(state->vs_ofmt, &vbuf);
@@ -5122,10 +5278,11 @@ do_show_vnic_common(int argc, char *argv[], const char *use,
 	ofmt_handle_t		ofmt;
 	ofmt_status_t		oferr;
 	uint_t			ofmtflags = 0;
+	char			*zonename = NULL;
 
 	bzero(&state, sizeof (state));
 	opterr = 0;
-	while ((option = getopt_long(argc, argv, ":pPl:si:o:", lopts,
+	while ((option = getopt_long(argc, argv, ":pPl:si:o:z:", lopts,
 	    NULL)) != -1) {
 		switch (option) {
 		case 'p':
@@ -5164,6 +5321,9 @@ do_show_vnic_common(int argc, char *argv[], const char *use,
 			o_arg = B_TRUE;
 			fields_str = optarg;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option, use);
 		}
@@ -5174,8 +5334,8 @@ do_show_vnic_common(int argc, char *argv[], const char *use,
 
 	/* get vnic ID (optional last argument) */
 	if (optind == (argc - 1)) {
-		status = dladm_name2info(handle, argv[optind], &linkid, NULL,
-		    NULL, NULL);
+		status = dladm_zname2info(handle, zonename, argv[optind],
+		    &linkid, NULL, NULL, NULL);
 		if (status != DLADM_STATUS_OK) {
 			die_dlerr(status, "invalid vnic name '%s'",
 			    argv[optind]);
@@ -5186,8 +5346,8 @@ do_show_vnic_common(int argc, char *argv[], const char *use,
 	}
 
 	if (l_arg) {
-		status = dladm_name2info(handle, state.vs_link, &dev_linkid,
-		    NULL, NULL, NULL);
+		status = dladm_zname2info(handle, zonename, state.vs_link,
+		    &dev_linkid, NULL, NULL, NULL);
 		if (status != DLADM_STATUS_OK) {
 			die_dlerr(status, "invalid link name '%s'",
 			    state.vs_link);
@@ -5199,6 +5359,7 @@ do_show_vnic_common(int argc, char *argv[], const char *use,
 	state.vs_etherstub = etherstub;
 	state.vs_found = B_FALSE;
 	state.vs_flags = flags;
+	state.vs_zonename = zonename;
 
 	if (!o_arg || (o_arg && strcasecmp(fields_str, "all") == 0)) {
 		if (etherstub)
@@ -5287,7 +5448,7 @@ do_create_etherstub(int argc, char *argv[], const char *use)
 
 	status = dladm_vnic_create(handle, name, DATALINK_INVALID_LINKID,
 	    VNIC_MAC_ADDR_TYPE_AUTO, mac_addr, ETHERADDRL, NULL, 0, 0,
-	    VRRP_VRID_NONE, AF_UNSPEC, NULL, NULL, flags);
+	    VRRP_VRID_NONE, AF_UNSPEC, NULL, NULL, &errlist, flags);
 	if (status != DLADM_STATUS_OK)
 		die_dlerr(status, "etherstub creation failed");
 }
@@ -6687,6 +6848,7 @@ do_show_linkprop(int argc, char **argv, const char *use)
 	ofmt_handle_t		ofmt;
 	ofmt_status_t		oferr;
 	uint_t			ofmtflags = 0;
+	char			*zonename = NULL;
 
 	bzero(propstr, DLADM_STRSIZE);
 	opterr = 0;
@@ -6697,7 +6859,7 @@ do_show_linkprop(int argc, char **argv, const char *use)
 	state.ls_header = B_TRUE;
 	state.ls_retstatus = DLADM_STATUS_OK;
 
-	while ((option = getopt_long(argc, argv, ":p:cPo:",
+	while ((option = getopt_long(argc, argv, ":p:cPo:z:",
 	    prop_longopts, NULL)) != -1) {
 		switch (option) {
 		case 'p':
@@ -6716,6 +6878,9 @@ do_show_linkprop(int argc, char **argv, const char *use)
 		case 'o':
 			fields_str = optarg;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option, use);
 			break;
@@ -6723,8 +6888,8 @@ do_show_linkprop(int argc, char **argv, const char *use)
 	}
 
 	if (optind == (argc - 1)) {
-		if ((status = dladm_name2info(handle, argv[optind], &linkid,
-		    NULL, NULL, NULL)) != DLADM_STATUS_OK) {
+		if ((status = dladm_zname2info(handle, zonename, argv[optind],
+		    &linkid, NULL, NULL, NULL)) != DLADM_STATUS_OK) {
 			die_dlerr(status, "link %s is not valid", argv[optind]);
 		}
 	} else if (optind != argc) {
@@ -6735,6 +6900,7 @@ do_show_linkprop(int argc, char **argv, const char *use)
 	    != DLADM_STATUS_OK)
 		die("invalid link properties specified");
 	state.ls_proplist = proplist;
+	state.ls_zonename = zonename;
 	state.ls_status = DLADM_STATUS_OK;
 
 	if (state.ls_parsable)
@@ -6779,6 +6945,17 @@ show_linkprop_onelink(dladm_handle_t hdl, datalink_id_t linkid, void *arg)
 		return (DLADM_WALK_CONTINUE);
 	}
 
+	if (statep->ls_zonename != NULL) {
+		datalink_id_t	tlinkid;
+
+		if (dladm_zname2info(hdl, statep->ls_zonename, statep->ls_link,
+		    &tlinkid, NULL, NULL, NULL) != DLADM_STATUS_OK ||
+		    linkid != tlinkid) {
+			statep->ls_status = DLADM_STATUS_NOTFOUND;
+			return (DLADM_WALK_CONTINUE);
+		}
+	}
+
 	if ((statep->ls_persist && !(flags & DLADM_OPT_PERSIST)) ||
 	    (!statep->ls_persist && !(flags & DLADM_OPT_ACTIVE))) {
 		statep->ls_status = DLADM_STATUS_BADARG;
@@ -6861,11 +7038,12 @@ set_linkprop(int argc, char **argv, boolean_t reset, const char *use)
 	dladm_status_t		status = DLADM_STATUS_OK;
 	char			propstr[DLADM_STRSIZE];
 	dladm_arg_list_t	*proplist = NULL;
+	char			*zonename = NULL;
 
 	opterr = 0;
 	bzero(propstr, DLADM_STRSIZE);
 
-	while ((option = getopt_long(argc, argv, ":p:R:t",
+	while ((option = getopt_long(argc, argv, ":p:R:tz:",
 	    prop_longopts, NULL)) != -1) {
 		switch (option) {
 		case 'p':
@@ -6880,6 +7058,9 @@ set_linkprop(int argc, char **argv, boolean_t reset, const char *use)
 		case 'R':
 			altroot = optarg;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option, use);
 
@@ -6902,8 +7083,8 @@ set_linkprop(int argc, char **argv, boolean_t reset, const char *use)
 		altroot_cmd(altroot, argc, argv);
 	}
 
-	status = dladm_name2info(handle, argv[optind], &linkid, NULL, NULL,
-	    NULL);
+	status = dladm_zname2info(handle, zonename, argv[optind], &linkid,
+	    NULL, NULL, NULL);
 	if (status != DLADM_STATUS_OK)
 		die_dlerr(status, "link %s is not valid", argv[optind]);
 
@@ -8926,6 +9107,21 @@ warn_dlerr(dladm_status_t err, const char *format, ...)
 	(void) fprintf(stderr, ": %s\n", dladm_status2str(err, errmsg));
 }
 
+static void
+warn_dlerrlist(dladm_errlist_t *errlist)
+{
+	if (errlist != NULL && errlist->el_count > 0) {
+		int i;
+		for (i = 0; i < errlist->el_count; i++) {
+			(void) fprintf(stderr, gettext("%s: warning: "),
+			    progname);
+
+			(void) fprintf(stderr, "%s\n",
+			    gettext(errlist->el_errs[i]));
+		}
+	}
+}
+
 /*
  * Also closes the dladm handle if it is not NULL.
  */
@@ -8951,6 +9147,34 @@ die_dlerr(dladm_status_t err, const char *format, ...)
 	exit(EXIT_FAILURE);
 }
 
+/*
+ * Like die_dlerr, but uses the errlist for additional information.
+ */
+/* PRINTFLIKE3 */
+static void
+die_dlerrlist(dladm_status_t err, dladm_errlist_t *errlist,
+    const char *format, ...)
+{
+	va_list	alist;
+	char	errmsg[DLADM_STRSIZE];
+
+	warn_dlerrlist(errlist);
+	format = gettext(format);
+	(void) fprintf(stderr, "%s: ", progname);
+
+	va_start(alist, format);
+	(void) vfprintf(stderr, format, alist);
+	va_end(alist);
+	(void) fprintf(stderr, ": %s\n", dladm_status2str(err, errmsg));
+
+	/* close dladm handle if it was opened */
+	if (handle != NULL)
+		dladm_close(handle);
+
+	exit(EXIT_FAILURE);
+
+}
+
 /* PRINTFLIKE1 */
 static void
 die(const char *format, ...)
@@ -9658,3 +9882,702 @@ do_up_part(int argc, char *argv[], const char *use)
 
 	(void) dladm_part_up(handle, partid, 0);
 }
+
+static void
+do_create_overlay(int argc, char *argv[], const char *use)
+{
+	int			opt;
+	char			*encap = NULL, *endp, *search = NULL;
+	char			name[MAXLINKNAMELEN];
+	dladm_status_t		status;
+	uint32_t		flags = DLADM_OPT_ACTIVE | DLADM_OPT_PERSIST;
+	uint64_t		vid;
+	boolean_t		havevid = B_FALSE;
+	char			propstr[DLADM_STRSIZE];
+	dladm_arg_list_t	*proplist = NULL;
+
+	bzero(propstr, sizeof (propstr));
+	while ((opt = getopt_long(argc, argv, ":te:v:p:s:",
+	    overlay_create_lopts, NULL)) != -1) {
+		switch (opt) {
+		case 'e':
+			encap = optarg;
+			break;
+		case 's':
+			search = optarg;
+			break;
+		case 't':
+			flags &= ~DLADM_OPT_PERSIST;
+			break;
+		case 'p':
+			(void) strlcat(propstr, optarg, DLADM_STRSIZE);
+			if (strlcat(propstr, ",", DLADM_STRSIZE) >=
+			    DLADM_STRSIZE)
+				die("property list too long '%s'", propstr);
+			break;
+		case 'v':
+			vid = strtoul(optarg, &endp, 10);
+			if (*endp != '\0' || (vid == 0 && errno == EINVAL))
+				die("couldn't parse virtual networkd id: %s",
+				    optarg);
+			if (vid == ULONG_MAX && errno == ERANGE)
+				die("virtual networkd id too large: %s",
+				    optarg);
+			havevid = B_TRUE;
+			break;
+		default:
+			die_opterr(optopt, opt, use);
+		}
+	}
+
+	if (havevid == B_FALSE)
+		die("missing required virtual network id");
+
+	if (encap == NULL)
+		die("missing required encapsulation plugin");
+
+	if (encap == NULL)
+		die("missing required search plugin");
+
+	if (optind != (argc - 1))
+		die("missing device name");
+
+	if (strlcpy(name, argv[optind], MAXLINKNAMELEN) >= MAXLINKNAMELEN)
+		die("link name too long '%s'", argv[optind]);
+
+	if (!dladm_valid_linkname(name))
+		die("invalid link name '%s'", argv[optind]);
+
+	if (strlen(encap) + 1 > MAXLINKNAMELEN)
+		die("encapsulation plugin name too long '%s'", encap);
+
+	if (strlen(search) + 1 > MAXLINKNAMELEN)
+		die("search plugin name too long '%s'", encap);
+
+	if (dladm_parse_link_props(propstr, &proplist, B_FALSE)
+	    != DLADM_STATUS_OK)
+		die("invalid overlay property");
+
+	status = dladm_overlay_create(handle, name, encap, search, vid,
+	    proplist, &errlist, flags);
+	dladm_free_props(proplist);
+	if (status != DLADM_STATUS_OK) {
+		die_dlerrlist(status, &errlist, "overlay creation failed");
+	}
+}
+
+/* ARGSUSED */
+static void
+do_delete_overlay(int argc, char *argv[], const char *use)
+{
+	datalink_id_t	linkid = DATALINK_ALL_LINKID;
+	dladm_status_t	status;
+
+	if (argc != 2) {
+		usage();
+	}
+
+	status = dladm_name2info(handle, argv[1], &linkid, NULL, NULL, NULL);
+	if (status != DLADM_STATUS_OK)
+		die_dlerr(status, "failed to delete %s", argv[1]);
+
+	status = dladm_overlay_delete(handle, linkid);
+	if (status != DLADM_STATUS_OK)
+		die_dlerr(status, "failed to delete %s", argv[1]);
+}
+
+typedef struct showoverlay_state {
+	ofmt_handle_t		sho_ofmt;
+	const char 		*sho_linkname;
+	dladm_overlay_propinfo_handle_t sho_info;
+	uint8_t			sho_value[DLADM_OVERLAY_PROP_SIZEMAX];
+	uint32_t		sho_size;
+} showoverlay_state_t;
+
+typedef struct showoverlay_fma_state {
+	ofmt_handle_t		shof_ofmt;
+	const char		*shof_linkname;
+	dladm_overlay_status_t	*shof_status;
+} showoverlay_fma_state_t;
+
+typedef struct showoverlay_targ_state {
+	ofmt_handle_t			shot_ofmt;
+	const char			*shot_linkname;
+	const struct ether_addr		*shot_key;
+	const dladm_overlay_point_t	*shot_point;
+} showoverlay_targ_state_t;
+
+static void
+print_overlay_value(char *outbuf, uint_t bufsize, uint_t type, const void *pbuf,
+    const size_t psize)
+{
+	const struct in6_addr *ipv6;
+	struct in_addr ip;
+
+	switch (type) {
+	case OVERLAY_PROP_T_INT:
+		if (psize != 1 && psize != 2 && psize != 4 && psize != 8) {
+			(void) snprintf(outbuf, bufsize, "?");
+			break;
+		}
+		if (psize == 1)
+			(void) snprintf(outbuf, bufsize, "%d", *(int8_t *)pbuf);
+		if (psize == 2)
+			(void) snprintf(outbuf, bufsize, "%d",
+			    *(int16_t *)pbuf);
+		if (psize == 4)
+			(void) snprintf(outbuf, bufsize, "%d",
+			    *(int32_t *)pbuf);
+		if (psize == 8)
+			(void) snprintf(outbuf, bufsize, "%d",
+			    *(int64_t *)pbuf);
+		break;
+	case OVERLAY_PROP_T_UINT:
+		if (psize != 1 && psize != 2 && psize != 4 && psize != 8) {
+			(void) snprintf(outbuf, bufsize, "?");
+			break;
+		}
+		if (psize == 1)
+			(void) snprintf(outbuf, bufsize, "%d",
+			    *(uint8_t *)pbuf);
+		if (psize == 2)
+			(void) snprintf(outbuf, bufsize, "%d",
+			    *(uint16_t *)pbuf);
+		if (psize == 4)
+			(void) snprintf(outbuf, bufsize, "%d",
+			    *(uint32_t *)pbuf);
+		if (psize == 8)
+			(void) snprintf(outbuf, bufsize, "%d",
+			    *(uint64_t *)pbuf);
+		break;
+	case OVERLAY_PROP_T_IP:
+		if (psize != sizeof (struct in6_addr)) {
+			warn("malformed overlay IP property: %d bytes\n",
+			    psize);
+			(void) snprintf(outbuf, bufsize, "--");
+			break;
+		}
+
+		ipv6 = pbuf;
+		if (IN6_IS_ADDR_V4MAPPED(ipv6)) {
+			IN6_V4MAPPED_TO_INADDR(ipv6, &ip);
+			if (inet_ntop(AF_INET, &ip, outbuf, bufsize) == NULL) {
+				warn("malformed overlay IP property\n");
+				(void) snprintf(outbuf, bufsize, "--");
+				break;
+			}
+		} else {
+			if (inet_ntop(AF_INET6, ipv6, outbuf, bufsize) ==
+			    NULL) {
+				warn("malformed overlay IP property\n");
+				(void) snprintf(outbuf, bufsize, "--");
+				break;
+			}
+		}
+
+		break;
+	case OVERLAY_PROP_T_STRING:
+		(void) snprintf(outbuf, bufsize, "%s", pbuf);
+		break;
+	default:
+		abort();
+	}
+
+	return;
+
+}
+
+static boolean_t
+print_overlay_cb(ofmt_arg_t *ofarg, char *buf, uint_t bufsize)
+{
+	dladm_status_t 			status;
+	showoverlay_state_t		*sp = ofarg->ofmt_cbarg;
+	dladm_overlay_propinfo_handle_t	infop = sp->sho_info;
+	const char 			*pname;
+	uint_t				type, prot;
+	const void			*def;
+	uint32_t			defsize;
+	const mac_propval_range_t	*rangep;
+
+	if ((status = dladm_overlay_prop_info(infop, &pname, &type, &prot, &def,
+	    &defsize, &rangep)) != DLADM_STATUS_OK) {
+		warn_dlerr(status, "failed to get get property info");
+		return (B_TRUE);
+	}
+
+	switch (ofarg->ofmt_id) {
+	case OVERLAY_LINK:
+		(void) snprintf(buf, bufsize, "%s", sp->sho_linkname);
+		break;
+	case OVERLAY_PROPERTY:
+		(void) snprintf(buf, bufsize, "%s", pname);
+		break;
+	case OVERLAY_PERM:
+		if ((prot & OVERLAY_PROP_PERM_RW) == OVERLAY_PROP_PERM_RW) {
+			(void) snprintf(buf, bufsize, "%s", "rw");
+		} else if ((prot & OVERLAY_PROP_PERM_RW) ==
+		    OVERLAY_PROP_PERM_READ) {
+			(void) snprintf(buf, bufsize, "%s", "r-");
+		} else {
+			(void) snprintf(buf, bufsize, "%s", "--");
+		}
+		break;
+	case OVERLAY_REQ:
+		(void) snprintf(buf, bufsize, "%s",
+		    prot & OVERLAY_PROP_PERM_REQ ? "y" : "-");
+		break;
+	case OVERLAY_VALUE:
+		if (sp->sho_size == 0) {
+			(void) snprintf(buf, bufsize, "%s", "--");
+		} else {
+			print_overlay_value(buf, bufsize, type, sp->sho_value,
+			    sp->sho_size);
+		}
+		break;
+	case OVERLAY_DEFAULT:
+		if (defsize == 0) {
+			(void) snprintf(buf, bufsize, "%s", "--");
+		} else {
+			print_overlay_value(buf, bufsize, type, def, defsize);
+		}
+		break;
+	case OVERLAY_POSSIBLE: {
+		int i;
+		char **vals, *ptr, *lim;
+		if (rangep->mpr_count == 0) {
+			(void) snprintf(buf, bufsize, "%s", "--");
+			break;
+		}
+
+		vals = malloc((sizeof (char *) + DLADM_PROP_VAL_MAX) *
+		    rangep->mpr_count);
+		if (vals == NULL)
+			die("insufficient memory");
+		for (i = 0; i < rangep->mpr_count; i++) {
+			vals[i] = (char *)vals + sizeof (char *) *
+			    rangep->mpr_count + i * DLADM_MAX_PROP_VALCNT;
+		}
+
+		if (dladm_range2strs(rangep, vals) != 0) {
+			free(vals);
+			(void) snprintf(buf, bufsize, "%s", "?");
+			break;
+		}
+
+		ptr = buf;
+		lim = buf + bufsize;
+		for (i = 0; i < rangep->mpr_count; i++) {
+			ptr += snprintf(ptr, lim - ptr, "%s,", vals[i]);
+			if (ptr >= lim)
+				break;
+		}
+		if (rangep->mpr_count > 0)
+			buf[strlen(buf) - 1] = '\0';
+		free(vals);
+		break;
+	}
+	default:
+		abort();
+	}
+	return (B_TRUE);
+}
+
+static int
+dladm_overlay_show_one(dladm_handle_t handle, datalink_id_t linkid,
+    dladm_overlay_propinfo_handle_t phdl, void *arg)
+{
+	showoverlay_state_t *sp = arg;
+	sp->sho_info = phdl;
+
+	sp->sho_size = sizeof (sp->sho_value);
+	if (dladm_overlay_get_prop(handle, linkid, phdl, &sp->sho_value,
+	    &sp->sho_size) != DLADM_STATUS_OK)
+		return (DLADM_WALK_CONTINUE);
+
+	ofmt_print(sp->sho_ofmt, sp);
+	return (DLADM_WALK_CONTINUE);
+}
+
+static int
+show_one_overlay(dladm_handle_t hdl, datalink_id_t linkid, void *arg)
+{
+	char			buf[MAXLINKNAMELEN];
+	dladm_status_t		info_status;
+	showoverlay_state_t	state;
+	datalink_class_t	class;
+	show_overlay_request_t	*req = arg;
+
+	if ((info_status = dladm_datalink_id2info(hdl, linkid, NULL, &class,
+	    NULL, buf, MAXLINKNAMELEN)) != DLADM_STATUS_OK) {
+		warn_dlerr(info_status, "failed to get info for "
+		    "datalink id %u", linkid);
+		req->sor_failed = B_TRUE;
+		return (DLADM_WALK_CONTINUE);
+	}
+
+	if (class != DATALINK_CLASS_OVERLAY) {
+		warn("%s is not an overlay", buf);
+		req->sor_failed = B_TRUE;
+		return (DLADM_WALK_CONTINUE);
+	}
+
+	state.sho_linkname = buf;
+	state.sho_ofmt = req->sor_ofmt;
+
+	dladm_errlist_reset(&errlist);
+	(void) dladm_overlay_walk_prop(handle, linkid, dladm_overlay_show_one,
+	    &state, &errlist);
+	warn_dlerrlist(&errlist);
+	if (errlist.el_count) {
+		req->sor_failed = B_TRUE;
+	}
+
+	return (DLADM_WALK_CONTINUE);
+}
+
+static boolean_t
+print_overlay_targ_cb(ofmt_arg_t *ofarg, char *buf, uint_t bufsize)
+{
+	char				keybuf[ETHERADDRSTRL];
+	const showoverlay_targ_state_t	*shot = ofarg->ofmt_cbarg;
+	const dladm_overlay_point_t	*point = shot->shot_point;
+	char				macbuf[ETHERADDRSTRL];
+	char				ipbuf[INET6_ADDRSTRLEN];
+	custr_t				*cus;
+
+	switch (ofarg->ofmt_id) {
+	case OVERLAY_TARG_LINK:
+		(void) snprintf(buf, bufsize, shot->shot_linkname);
+		break;
+	case OVERLAY_TARG_TARGET:
+		if ((point->dop_flags & DLADM_OVERLAY_F_DEFAULT) != 0) {
+			(void) snprintf(buf, bufsize, "*:*:*:*:*:*");
+		} else {
+			if (ether_ntoa_r(shot->shot_key, keybuf) == NULL) {
+				warn("encountered malformed mac address key\n");
+				return (B_FALSE);
+			}
+			(void) snprintf(buf, bufsize, "%s", keybuf);
+		}
+		break;
+	case OVERLAY_TARG_DEST:
+		if (custr_alloc_buf(&cus, buf, bufsize) != 0) {
+			die("ran out of memory for printing the overlay "
+			    "target destination");
+		}
+
+		if (point->dop_dest & OVERLAY_PLUGIN_D_ETHERNET) {
+			if (ether_ntoa_r(&point->dop_mac, macbuf) == NULL) {
+				warn("encountered malformed mac address target "
+				    "for key %s\n", keybuf);
+				return (B_FALSE);
+			}
+			(void) custr_append(cus, macbuf);
+		}
+
+		if (point->dop_dest & OVERLAY_PLUGIN_D_IP) {
+			if (IN6_IS_ADDR_V4MAPPED(&point->dop_ip)) {
+				struct in_addr v4;
+				IN6_V4MAPPED_TO_INADDR(&point->dop_ip, &v4);
+				if (inet_ntop(AF_INET, &v4, ipbuf,
+				    sizeof (ipbuf)) == NULL)
+					abort();
+			} else if (inet_ntop(AF_INET6, &point->dop_ip, ipbuf,
+			    sizeof (ipbuf)) == NULL) {
+				/*
+				 * The only failrues we should get are
+				 * EAFNOSUPPORT and ENOSPC because of buffer
+				 * exhaustion. In either of these cases, that
+				 * means something has gone horribly wrong.
+				 */
+				abort();
+			}
+			if (point->dop_dest & OVERLAY_PLUGIN_D_ETHERNET)
+				(void) custr_appendc(cus, ',');
+			(void) custr_append(cus, ipbuf);
+		}
+
+		if (point->dop_dest & OVERLAY_PLUGIN_D_PORT) {
+			if (point->dop_dest & OVERLAY_PLUGIN_D_IP)
+				(void) custr_appendc(cus, ':');
+			else if (point->dop_dest & OVERLAY_PLUGIN_D_ETHERNET)
+				(void) custr_appendc(cus, ',');
+			(void) custr_append_printf(cus, "%u", point->dop_port);
+		}
+
+		custr_free(cus);
+
+		break;
+	}
+	return (B_TRUE);
+}
+
+/* ARGSUSED */
+static int
+show_one_overlay_table_entry(dladm_handle_t handle, datalink_id_t linkid,
+    const struct ether_addr *key, const dladm_overlay_point_t *point, void *arg)
+{
+	showoverlay_targ_state_t	*shot = arg;
+
+	shot->shot_key = key;
+	shot->shot_point = point;
+	ofmt_print(shot->shot_ofmt, shot);
+
+	return (DLADM_WALK_CONTINUE);
+}
+
+/* ARGSUSED */
+static int
+show_one_overlay_table(dladm_handle_t handle, datalink_id_t linkid, void *arg)
+{
+	char				linkbuf[MAXLINKNAMELEN];
+	dladm_status_t			info_status;
+	showoverlay_targ_state_t	shot;
+	datalink_class_t		class;
+	show_overlay_request_t		*req = arg;
+
+	if ((info_status = dladm_datalink_id2info(handle, linkid, NULL, &class,
+	    NULL, linkbuf, MAXLINKNAMELEN)) != DLADM_STATUS_OK) {
+		warn_dlerr(info_status, "failed to get info for "
+		    "datalink id %u", linkid);
+		req->sor_failed = B_TRUE;
+		return (DLADM_WALK_CONTINUE);
+	}
+
+	if (class != DATALINK_CLASS_OVERLAY) {
+		warn("%s is not an overlay", linkbuf);
+		req->sor_failed = B_TRUE;
+		return (DLADM_WALK_CONTINUE);
+	}
+
+	shot.shot_ofmt = req->sor_ofmt;
+	shot.shot_linkname = linkbuf;
+
+	(void) dladm_overlay_walk_cache(handle, linkid,
+	    show_one_overlay_table_entry, &shot);
+
+	return (DLADM_WALK_CONTINUE);
+}
+
+static boolean_t
+print_overlay_fma_cb(ofmt_arg_t *ofarg, char *buf, uint_t bufsize)
+{
+	showoverlay_fma_state_t	*shof = ofarg->ofmt_cbarg;
+	dladm_overlay_status_t	*st = shof->shof_status;
+
+	switch (ofarg->ofmt_id) {
+	case OVERLAY_FMA_LINK:
+		(void) snprintf(buf, bufsize, "%s", shof->shof_linkname);
+		break;
+	case OVERLAY_FMA_STATUS:
+		(void) snprintf(buf, bufsize, st->dos_degraded == B_TRUE ?
+		    "DEGRADED": "ONLINE");
+		break;
+	case OVERLAY_FMA_DETAILS:
+		(void) snprintf(buf, bufsize, "%s", st->dos_degraded == B_TRUE ?
+		    st->dos_fmamsg : "-");
+		break;
+	default:
+		abort();
+	}
+	return (B_TRUE);
+}
+
+/* ARGSUSED */
+static void
+show_one_overlay_fma_cb(dladm_handle_t handle, datalink_id_t linkid,
+    dladm_overlay_status_t *stat, void *arg)
+{
+	showoverlay_fma_state_t	*shof = arg;
+	shof->shof_status = stat;
+	ofmt_print(shof->shof_ofmt, shof);
+}
+
+
+static int
+show_one_overlay_fma(dladm_handle_t handle, datalink_id_t linkid, void *arg)
+{
+	dladm_status_t		status;
+	char			linkbuf[MAXLINKNAMELEN];
+	datalink_class_t	class;
+	showoverlay_fma_state_t	shof;
+	show_overlay_request_t	*req = arg;
+
+	if (dladm_datalink_id2info(handle, linkid, NULL, &class, NULL, linkbuf,
+	    MAXLINKNAMELEN) != DLADM_STATUS_OK ||
+	    class != DATALINK_CLASS_OVERLAY) {
+		die("datalink %s is not an overlay device\n", linkbuf);
+	}
+
+	shof.shof_ofmt = req->sor_ofmt;
+	shof.shof_linkname = linkbuf;
+
+	status = dladm_overlay_status(handle, linkid,
+	    show_one_overlay_fma_cb, &shof);
+	if (status != DLADM_STATUS_OK)
+		die_dlerr(status, "failed to obtain device status for %s",
+		    linkbuf);
+
+	return (DLADM_WALK_CONTINUE);
+}
+
+static void
+do_show_overlay(int argc, char *argv[], const char *use)
+{
+	int			i, opt;
+	datalink_id_t		linkid = DATALINK_ALL_LINKID;
+	dladm_status_t		status;
+	int 			(*funcp)(dladm_handle_t, datalink_id_t, void *);
+	char			*fields_str = NULL;
+	const ofmt_field_t	*fieldsp;
+	ofmt_status_t		oferr;
+	boolean_t		parse;
+	show_overlay_request_t	req;
+	uint_t			ofmtflags;
+	int			err;
+
+	funcp = show_one_overlay;
+	fieldsp = overlay_fields;
+	parse = B_FALSE;
+	req.sor_failed = B_FALSE;
+	ofmtflags = OFMT_WRAP;
+	while ((opt = getopt_long(argc, argv, ":o:pft", overlay_show_lopts,
+	    NULL)) != -1) {
+		switch (opt) {
+		case 'f':
+			funcp = show_one_overlay_fma;
+			fieldsp = overlay_fma_fields;
+			break;
+		case 'o':
+			fields_str = optarg;
+			break;
+		case 'p':
+			parse = B_TRUE;
+			ofmtflags = OFMT_PARSABLE;
+			break;
+		case 't':
+			funcp = show_one_overlay_table;
+			fieldsp = overlay_targ_fields;
+			break;
+		default:
+			die_opterr(optopt, opt, use);
+		}
+	}
+
+	if (fields_str != NULL && strcasecmp(fields_str, "all") == 0)
+		fields_str = NULL;
+
+	oferr = ofmt_open(fields_str, fieldsp, ofmtflags, 0, &req.sor_ofmt);
+	ofmt_check(oferr, parse, req.sor_ofmt, die, warn);
+
+	err = 0;
+	if (argc > optind) {
+		for (i = optind; i < argc; i++) {
+			status = dladm_name2info(handle, argv[i], &linkid,
+			    NULL, NULL, NULL);
+			if (status != DLADM_STATUS_OK) {
+				warn_dlerr(status, "failed to find %s",
+				    argv[i]);
+				err = 1;
+				continue;
+			}
+			(void) funcp(handle, linkid, &req);
+		}
+	} else {
+		(void) dladm_walk_datalink_id(funcp, handle, &req,
+		    DATALINK_CLASS_OVERLAY, DATALINK_ANY_MEDIATYPE,
+		    DLADM_OPT_ACTIVE);
+	}
+	if (req.sor_failed) {
+		err = 1;
+	}
+	ofmt_close(req.sor_ofmt);
+
+	exit(err);
+}
+
+static void
+do_modify_overlay(int argc, char *argv[], const char *use)
+{
+	int			opt, ocnt = 0;
+	boolean_t		flush, set, delete;
+	struct ether_addr	e;
+	char			*dest;
+	datalink_id_t		linkid = DATALINK_ALL_LINKID;
+	dladm_status_t		status;
+
+	flush = set = delete = B_FALSE;
+	while ((opt = getopt_long(argc, argv, ":fd:s:", overlay_modify_lopts,
+	    NULL)) != -1) {
+		switch (opt) {
+		case 'd':
+			if (delete == B_TRUE)
+				die_optdup('d');
+			delete = B_TRUE;
+			ocnt++;
+			if (ether_aton_r(optarg, &e) == NULL)
+				die("invalid mac address: %s\n", optarg);
+			break;
+		case 'f':
+			if (flush == B_TRUE)
+				die_optdup('f');
+			flush = B_TRUE;
+			ocnt++;
+			break;
+		case 's':
+			if (set == B_TRUE)
+				die_optdup('s');
+			set = B_TRUE;
+			ocnt++;
+			dest = strchr(optarg, '=');
+			*dest = '\0';
+			dest++;
+			if (dest == NULL)
+				die("malformed value, expected mac=dest, "
+				    "got: %s\n", optarg);
+			if (ether_aton_r(optarg, &e) == NULL)
+				die("invalid mac address: %s\n", optarg);
+			break;
+		default:
+			die_opterr(optopt, opt, use);
+		}
+	}
+
+	if (ocnt == 0)
+		die("need to specify one of -d, -f, or -s");
+	if (ocnt > 1)
+		die("only one of -d, -f, or -s may be used");
+
+	if (argv[optind] == NULL)
+		die("missing required overlay device\n");
+	if (argc > optind + 1)
+		die("only one overlay device may be specified\n");
+
+	status = dladm_name2info(handle, argv[optind], &linkid, NULL, NULL,
+	    NULL);
+	if (status != DLADM_STATUS_OK) {
+		die_dlerr(status, "failed to find overlay %s", argv[optind]);
+	}
+
+	if (flush == B_TRUE) {
+		status = dladm_overlay_cache_flush(handle, linkid);
+		if (status != DLADM_STATUS_OK)
+			die_dlerr(status, "failed to flush target cache for "
+			    "overlay %s", argv[optind]);
+	}
+
+	if (delete == B_TRUE) {
+		status = dladm_overlay_cache_delete(handle, linkid, &e);
+		if (status != DLADM_STATUS_OK)
+			die_dlerr(status, "failed to flush target %s from "
+			    "overlay target cache %s", optarg, argv[optind]);
+	}
+
+	if (set == B_TRUE) {
+		status = dladm_overlay_cache_set(handle, linkid, &e, dest);
+		if (status != DLADM_STATUS_OK)
+			die_dlerr(status, "failed to set target %s for overlay "
+			    "target cache %s", optarg, argv[optind]);
+	}
+
+}
diff --git a/usr/src/cmd/dlmgmtd/dlmgmt_db.c b/usr/src/cmd/dlmgmtd/dlmgmt_db.c
index 99307dbc03..6ccd9d97b8 100644
--- a/usr/src/cmd/dlmgmtd/dlmgmt_db.c
+++ b/usr/src/cmd/dlmgmtd/dlmgmt_db.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <assert.h>
@@ -43,6 +44,7 @@
 #include <libcontract.h>
 #include <libcontract_priv.h>
 #include <sys/contract/process.h>
+#include <zone.h>
 #include "dlmgmt_impl.h"
 
 typedef enum dlmgmt_db_op {
@@ -552,6 +554,10 @@ dlmgmt_db_update(dlmgmt_db_op_t op, const char *entryname, dlmgmt_link_t *linkp,
 	    linkp->ll_zoneid, flags, &err)) == NULL)
 		return (err);
 
+	/* If transient op and onloan, use the global zone cache file. */
+	if (flags == DLMGMT_ACTIVE && linkp->ll_onloan)
+		req->ls_zoneid = GLOBAL_ZONEID;
+
 	/*
 	 * If the return error is EINPROGRESS, this request is handled
 	 * asynchronously; return success.
@@ -714,11 +720,13 @@ parse_linkprops(char *buf, dlmgmt_link_t *linkp)
 	char			attr_name[MAXLINKATTRLEN];
 	size_t			attr_buf_len = 0;
 	void			*attr_buf = NULL;
+	boolean_t		rename;
 
 	curr = buf;
 	len = strlen(buf);
 	attr_name[0] = '\0';
 	for (i = 0; i < len; i++) {
+		rename = B_FALSE;
 		char		c = buf[i];
 		boolean_t	match = (c == '=' ||
 		    (c == ',' && !found_type) || c == ';');
@@ -768,6 +776,21 @@ parse_linkprops(char *buf, dlmgmt_link_t *linkp)
 					goto parse_fail;
 				linkp->ll_media =
 				    (uint32_t)*(int64_t *)attr_buf;
+			} else if (strcmp(attr_name, "zone") == 0) {
+				if (read_str(curr, &attr_buf) == 0)
+					goto parse_fail;
+				linkp->ll_zoneid = getzoneidbyname(attr_buf);
+				if (linkp->ll_zoneid == -1) {
+					if (errno == EFAULT)
+						abort();
+					/*
+					 * If we can't find the zone, assign the
+					 * link to the GZ and mark it for being
+					 * renamed.
+					 */
+					linkp->ll_zoneid = 0;
+					rename = B_TRUE;
+				}
 			} else {
 				attr_buf_len = translators[type].read_func(curr,
 				    &attr_buf);
@@ -811,6 +834,16 @@ parse_linkprops(char *buf, dlmgmt_link_t *linkp)
 
 			(void) snprintf(attr_name, MAXLINKATTRLEN, "%s", curr);
 		}
+
+		/*
+		 * The zone that this link belongs to has died, we are
+		 * reparenting it to the GZ and renaming it to avoid name
+		 * collisions.
+		 */
+		if (rename == B_TRUE) {
+			(void) snprintf(linkp->ll_link, MAXLINKNAMELEN,
+			    "SUNWorphan%u", (uint16_t)(gethrtime() / 1000));
+		}
 		curr = buf + i + 1;
 	}
 
@@ -1222,12 +1255,19 @@ generate_link_line(dlmgmt_link_t *linkp, boolean_t persist, char *buf)
 
 	ptr += snprintf(ptr, BUFLEN(lim, ptr), "%s\t", linkp->ll_link);
 	if (!persist) {
+		char zname[ZONENAME_MAX];
 		/*
-		 * We store the linkid in the active database so that dlmgmtd
-		 * can recover in the event that it is restarted.
+		 * We store the linkid and the zone name in the active database
+		 * so that dlmgmtd can recover in the event that it is
+		 * restarted.
 		 */
 		u64 = linkp->ll_linkid;
 		ptr += write_uint64(ptr, BUFLEN(lim, ptr), "linkid", &u64);
+
+		if (getzonenamebyid(linkp->ll_zoneid, zname,
+		    sizeof (zname)) != -1) {
+			ptr += write_str(ptr, BUFLEN(lim, ptr), "zone", zname);
+		}
 	}
 	u64 = linkp->ll_class;
 	ptr += write_uint64(ptr, BUFLEN(lim, ptr), "class", &u64);
@@ -1382,38 +1422,88 @@ dlmgmt_db_walk(zoneid_t zoneid, datalink_class_t class, db_walk_func_t *func)
 }
 
 /*
+ * Attempt to mitigate one of the deadlocks in the dlmgmtd architecture.
+ *
+ * dlmgmt_db_init() calls dlmgmt_process_db_req() which eventually gets to
+ * dlmgmt_zfop() which tries to fork, enter the zone and read the file.
+ * Because of the upcall architecture of dlmgmtd this can lead to deadlock
+ * with the following scenario:
+ *    a) the thread preparing to fork will have acquired the malloc locks
+ *       then attempt to suspend every thread in preparation to fork.
+ *    b) all of the upcalls will be blocked in door_ucred() trying to malloc()
+ *       and get the credentials of their caller.
+ *    c) we can't suspend the in-kernel thread making the upcall.
+ *
+ * Thus, we cannot serve door requests because we're blocked in malloc()
+ * which fork() owns, but fork() is in turn blocked on the in-kernel thread
+ * making the door upcall.  This is a fundamental architectural problem with
+ * any server handling upcalls and also trying to fork().
+ *
+ * To minimize the chance of this deadlock occuring, we check ahead of time to
+ * see if the file we want to read actually exists in the zone (which it almost
+ * never does), so we don't need fork in that case (i.e. rarely to never).
+ */
+static boolean_t
+zone_file_exists(char *zoneroot, char *filename)
+{
+	struct stat	sb;
+	char		fname[MAXPATHLEN];
+
+	(void) snprintf(fname, sizeof (fname), "%s/%s", zoneroot, filename);
+
+	if (stat(fname, &sb) == -1)
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
+
+/*
  * Initialize the datalink <link name, linkid> mapping and the link's
  * attributes list based on the configuration file /etc/dladm/datalink.conf
  * and the active configuration cache file
  * /etc/svc/volatile/dladm/datalink-management:default.cache.
  */
 int
-dlmgmt_db_init(zoneid_t zoneid)
+dlmgmt_db_init(zoneid_t zoneid, char *zoneroot)
 {
 	dlmgmt_db_req_t	*req;
 	int		err;
 	boolean_t	boot = B_FALSE;
+	char 		tdir[MAXPATHLEN];
+	char		*path = cachefile;
 
 	if ((req = dlmgmt_db_req_alloc(DLMGMT_DB_OP_READ, NULL,
 	    DATALINK_INVALID_LINKID, zoneid, DLMGMT_ACTIVE, &err)) == NULL)
 		return (err);
 
-	if ((err = dlmgmt_process_db_req(req)) != 0) {
-		/*
-		 * If we get back ENOENT, that means that the active
-		 * configuration file doesn't exist yet, and is not an error.
-		 * We'll create it down below after we've loaded the
-		 * persistent configuration.
-		 */
-		if (err != ENOENT)
-			goto done;
+	/* Handle running in a non-native branded zone (i.e. has /native) */
+	if (zone_file_exists(zoneroot, "/native" DLMGMT_TMPFS_DIR)) {
+		(void) snprintf(tdir, sizeof (tdir), "/native%s", cachefile);
+		path = tdir;
+	}
+
+	if (zone_file_exists(zoneroot, path)) {
+		if ((err = dlmgmt_process_db_req(req)) != 0) {
+			/*
+			 * If we get back ENOENT, that means that the active
+			 * configuration file doesn't exist yet, and is not an
+			 * error.  We'll create it down below after we've
+			 * loaded the persistent configuration.
+			 */
+			if (err != ENOENT)
+				goto done;
+			boot = B_TRUE;
+		}
+	} else {
 		boot = B_TRUE;
 	}
 
-	req->ls_flags = DLMGMT_PERSIST;
-	err = dlmgmt_process_db_req(req);
-	if (err != 0 && err != ENOENT)
-		goto done;
+	if (zone_file_exists(zoneroot, DLMGMT_PERSISTENT_DB_PATH)) {
+		req->ls_flags = DLMGMT_PERSIST;
+		err = dlmgmt_process_db_req(req);
+		if (err != 0 && err != ENOENT)
+			goto done;
+	}
 	err = 0;
 	if (rewrite_needed) {
 		/*
diff --git a/usr/src/cmd/dlmgmtd/dlmgmt_door.c b/usr/src/cmd/dlmgmtd/dlmgmt_door.c
index 11e4329669..2bebaa24c3 100644
--- a/usr/src/cmd/dlmgmtd/dlmgmt_door.c
+++ b/usr/src/cmd/dlmgmtd/dlmgmt_door.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -58,6 +59,7 @@
 #include <libsysevent.h>
 #include <libdlmgmt.h>
 #include <librcm.h>
+#include <unistd.h>
 #include "dlmgmt_impl.h"
 
 typedef void dlmgmt_door_handler_t(void *, void *, size_t *, zoneid_t,
@@ -423,8 +425,11 @@ dlmgmt_getname(void *argp, void *retp, size_t *sz, zoneid_t zoneid,
 		retvalp->lr_flags = linkp->ll_flags;
 		retvalp->lr_class = linkp->ll_class;
 		retvalp->lr_media = linkp->ll_media;
+		retvalp->lr_flags |= (linkp->ll_trans == B_TRUE) ?
+		    DLMGMT_TRANSIENT : 0;
 	}
 
+
 	dlmgmt_table_unlock();
 	retvalp->lr_err = err;
 }
@@ -439,6 +444,10 @@ dlmgmt_getlinkid(void *argp, void *retp, size_t *sz, zoneid_t zoneid,
 	dlmgmt_link_t		*linkp;
 	int			err = 0;
 
+	/* Enable the global zone to lookup links it has given away. */
+	if (zoneid == GLOBAL_ZONEID && getlinkid->ld_zoneid != -1)
+		zoneid = getlinkid->ld_zoneid;
+
 	/*
 	 * Hold the reader lock to access the link
 	 */
@@ -648,6 +657,7 @@ dlmgmt_remapid(void *argp, void *retp, size_t *sz, zoneid_t zoneid,
 	if ((err = dlmgmt_checkprivs(linkp->ll_class, cred)) != 0)
 		goto done;
 
+
 	if (link_by_name(remapid->ld_link, linkp->ll_zoneid) != NULL) {
 		err = EEXIST;
 		goto done;
@@ -1232,20 +1242,34 @@ dlmgmt_setzoneid(void *argp, void *retp, size_t *sz, zoneid_t zoneid,
 	 * Before we remove the link from its current zone, make sure that
 	 * there isn't a link with the same name in the destination zone.
 	 */
-	if (zoneid != GLOBAL_ZONEID &&
-	    link_by_name(linkp->ll_link, newzoneid) != NULL) {
+	if (link_by_name(linkp->ll_link, newzoneid) != NULL) {
 		err = EEXIST;
 		goto done;
 	}
 
 	if (oldzoneid != GLOBAL_ZONEID) {
+		if (newzoneid == GLOBAL_ZONEID && linkp->ll_onloan) {
+			/*
+			 * In this case we are attempting to assign a
+			 * loaned datalink from an NGZ to the GZ. We
+			 * can only reassign a loaned VNIC back to the
+			 * GZ when the zone is shutting down --
+			 * because otherwise the VNIC is in use by the
+			 * zone and will be busy. Leave the VNIC
+			 * loaned to the zone and return EBUSY to the
+			 * caller.
+			 */
+			err = EBUSY;
+			goto done;
+		}
+
 		if (zone_remove_datalink(oldzoneid, linkid) != 0) {
 			err = errno;
 			dlmgmt_log(LOG_WARNING, "unable to remove link %d from "
 			    "zone %d: %s", linkid, oldzoneid, strerror(err));
 			goto done;
 		}
-		avl_remove(&dlmgmt_loan_avl, linkp);
+
 		linkp->ll_onloan = B_FALSE;
 	}
 	if (newzoneid != GLOBAL_ZONEID) {
@@ -1256,7 +1280,6 @@ dlmgmt_setzoneid(void *argp, void *retp, size_t *sz, zoneid_t zoneid,
 			(void) zone_add_datalink(oldzoneid, linkid);
 			goto done;
 		}
-		avl_add(&dlmgmt_loan_avl, linkp);
 		linkp->ll_onloan = B_TRUE;
 	}
 
@@ -1309,6 +1332,10 @@ dlmgmt_zonehalt(void *argp, void *retp, size_t *sz, zoneid_t zoneid,
 	int			err = 0;
 	dlmgmt_door_zonehalt_t	*zonehalt = argp;
 	dlmgmt_zonehalt_retval_t *retvalp = retp;
+	static char my_pid[10];
+
+	if (my_pid[0] == NULL)
+		(void) snprintf(my_pid, sizeof (my_pid), "%d\n", getpid());
 
 	if ((err = dlmgmt_checkprivs(0, cred)) == 0) {
 		if (zoneid != GLOBAL_ZONEID) {
diff --git a/usr/src/cmd/dlmgmtd/dlmgmt_impl.h b/usr/src/cmd/dlmgmtd/dlmgmt_impl.h
index cdfd0d8a4d..c65a0438d6 100644
--- a/usr/src/cmd/dlmgmtd/dlmgmt_impl.h
+++ b/usr/src/cmd/dlmgmtd/dlmgmt_impl.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -60,13 +61,24 @@ typedef struct dlmgmt_link_s {
 	datalink_class_t	ll_class;
 	uint32_t		ll_media;
 	datalink_id_t		ll_linkid;
+
+	/*
+	 * The zone that owns the link. If this is set to the id of
+	 * an NGZ and ll_onloan is set then the link was created and
+	 * is owned by the GZ but is currently being loaned out to an
+	 * NGZ. E.g., when the GZ admin creates a VNIC for exclusive
+	 * use by an NGZ. If ll_onloan is set then ll_zoneid cannot be 0.
+	 *
+	 * If ll_zoneid is set to the id of an NGZ but ll_onloan is
+	 * not set then the link was created and is owned by the NGZ.
+	 */
 	zoneid_t		ll_zoneid;
 	boolean_t		ll_onloan;
 	avl_node_t		ll_name_node;
 	avl_node_t		ll_id_node;
-	avl_node_t		ll_loan_node;
 	uint32_t		ll_flags;
 	uint32_t		ll_gen;		/* generation number */
+	boolean_t		ll_trans;	/* transient link */
 } dlmgmt_link_t;
 
 /*
@@ -91,7 +103,6 @@ extern dladm_handle_t	dld_handle;
 extern datalink_id_t	dlmgmt_nextlinkid;
 extern avl_tree_t	dlmgmt_name_avl;
 extern avl_tree_t	dlmgmt_id_avl;
-extern avl_tree_t	dlmgmt_loan_avl;
 extern avl_tree_t	dlmgmt_dlconf_avl;
 
 boolean_t	linkattr_equal(dlmgmt_linkattr_t **, const char *, void *,
@@ -138,7 +149,7 @@ void		dlmgmt_handler(void *, char *, size_t, door_desc_t *, uint_t);
 void		dlmgmt_log(int, const char *, ...);
 int		dlmgmt_write_db_entry(const char *, dlmgmt_link_t *, uint32_t);
 int		dlmgmt_delete_db_entry(dlmgmt_link_t *, uint32_t);
-int 		dlmgmt_db_init(zoneid_t);
+int 		dlmgmt_db_init(zoneid_t, char *);
 void		dlmgmt_db_fini(zoneid_t);
 
 #ifdef  __cplusplus
diff --git a/usr/src/cmd/dlmgmtd/dlmgmt_main.c b/usr/src/cmd/dlmgmtd/dlmgmt_main.c
index c02610bb5f..60466fd773 100644
--- a/usr/src/cmd/dlmgmtd/dlmgmt_main.c
+++ b/usr/src/cmd/dlmgmtd/dlmgmt_main.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
@@ -125,15 +126,24 @@ dlmgmt_door_fini(void)
 	dlmgmt_door_fd = -1;
 }
 
-int
+static int
 dlmgmt_door_attach(zoneid_t zoneid, char *rootdir)
 {
 	int	fd;
 	int	err = 0;
 	char	doorpath[MAXPATHLEN];
+	struct stat statbuf;
 
-	(void) snprintf(doorpath, sizeof (doorpath), "%s%s", rootdir,
-	    DLMGMT_DOOR);
+	/* Handle running in a non-native branded zone (i.e. has /native) */
+	(void) snprintf(doorpath, sizeof (doorpath), "%s/native%s",
+	    rootdir, DLMGMT_TMPFS_DIR);
+	if (stat(doorpath, &statbuf) == 0) {
+		(void) snprintf(doorpath, sizeof (doorpath), "%s/native%s",
+		    rootdir, DLMGMT_DOOR);
+	} else {
+		(void) snprintf(doorpath, sizeof (doorpath), "%s%s",
+		    rootdir, DLMGMT_DOOR);
+	}
 
 	/*
 	 * Create the door file for dlmgmtd.
@@ -192,8 +202,16 @@ dlmgmt_zone_init(zoneid_t zoneid)
 	(void) snprintf(tmpfsdir, sizeof (tmpfsdir), "%s%s", rootdir,
 	    DLMGMT_TMPFS_DIR);
 	if (stat(tmpfsdir, &statbuf) < 0) {
-		if (mkdir(tmpfsdir, (mode_t)0755) < 0)
-			return (errno);
+		if (mkdir(tmpfsdir, (mode_t)0755) < 0) {
+			/*
+			 * Handle running in a non-native branded zone
+			 * (i.e. has /native)
+			 */
+			(void) snprintf(tmpfsdir, sizeof (tmpfsdir),
+			    "%s/native%s", rootdir, DLMGMT_TMPFS_DIR);
+			if (mkdir(tmpfsdir, (mode_t)0755) < 0)
+				return (errno);
+		}
 	} else if ((statbuf.st_mode & S_IFMT) != S_IFDIR) {
 		return (ENOTDIR);
 	}
@@ -203,7 +221,7 @@ dlmgmt_zone_init(zoneid_t zoneid)
 		return (EPERM);
 	}
 
-	if ((err = dlmgmt_db_init(zoneid)) != 0)
+	if ((err = dlmgmt_db_init(zoneid, rootdir)) != 0)
 		return (err);
 	return (dlmgmt_door_attach(zoneid, rootdir));
 }
@@ -214,7 +232,7 @@ dlmgmt_zone_init(zoneid_t zoneid)
 static int
 dlmgmt_allzones_init(void)
 {
-	int		err, i;
+	int		i;
 	zoneid_t	*zids = NULL;
 	uint_t		nzids, nzids_saved;
 
@@ -235,11 +253,37 @@ again:
 	}
 
 	for (i = 0; i < nzids; i++) {
-		if ((err = dlmgmt_zone_init(zids[i])) != 0)
-			break;
+		int res;
+		zone_status_t status;
+
+		/*
+		 * Skip over zones that have gone away or are going down
+		 * since we got the list.  Process all zones in the list,
+		 * logging errors for any that failed.
+		 */
+		if (zone_getattr(zids[i], ZONE_ATTR_STATUS, &status,
+		    sizeof (status)) < 0)
+			continue;
+		switch (status) {
+			case ZONE_IS_SHUTTING_DOWN:
+			case ZONE_IS_EMPTY:
+			case ZONE_IS_DOWN:
+			case ZONE_IS_DYING:
+			case ZONE_IS_DEAD:
+				/* FALLTHRU */
+				continue;
+			default:
+				break;
+		}
+		if ((res = dlmgmt_zone_init(zids[i])) != 0) {
+			(void) fprintf(stderr, "zone (%ld) init error %s",
+			    zids[i], strerror(res));
+			dlmgmt_log(LOG_ERR, "zone (%d) init error %s",
+			    zids[i], strerror(res));
+		}
 	}
 	free(zids);
-	return (err);
+	return (0);
 }
 
 static int
diff --git a/usr/src/cmd/dlmgmtd/dlmgmt_util.c b/usr/src/cmd/dlmgmtd/dlmgmt_util.c
index afcfbed37b..c8ba0009a0 100644
--- a/usr/src/cmd/dlmgmtd/dlmgmt_util.c
+++ b/usr/src/cmd/dlmgmtd/dlmgmt_util.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -45,13 +46,10 @@
 /*
  * There are three datalink AVL tables.  The dlmgmt_name_avl tree contains all
  * datalinks and is keyed by zoneid and link name.  The dlmgmt_id_avl also
- * contains all datalinks, and it is keyed by link ID.  The dlmgmt_loan_avl is
- * keyed by link name, and contains the set of global-zone links that are
- * currently on loan to non-global zones.
+ * contains all datalinks, and it is keyed by link ID.
  */
 avl_tree_t	dlmgmt_name_avl;
 avl_tree_t	dlmgmt_id_avl;
-avl_tree_t	dlmgmt_loan_avl;
 
 avl_tree_t	dlmgmt_dlconf_avl;
 
@@ -162,8 +160,6 @@ dlmgmt_linktable_init(void)
 	    offsetof(dlmgmt_link_t, ll_name_node));
 	avl_create(&dlmgmt_id_avl, cmp_link_by_id, sizeof (dlmgmt_link_t),
 	    offsetof(dlmgmt_link_t, ll_id_node));
-	avl_create(&dlmgmt_loan_avl, cmp_link_by_name, sizeof (dlmgmt_link_t),
-	    offsetof(dlmgmt_link_t, ll_loan_node));
 	avl_create(&dlmgmt_dlconf_avl, cmp_dlconf_by_id,
 	    sizeof (dlmgmt_dlconf_t), offsetof(dlmgmt_dlconf_t, ld_node));
 	dlmgmt_nextlinkid = 1;
@@ -181,7 +177,6 @@ dlmgmt_linktable_fini(void)
 
 	avl_destroy(&dlmgmt_dlconf_avl);
 	avl_destroy(&dlmgmt_name_avl);
-	avl_destroy(&dlmgmt_loan_avl);
 	avl_destroy(&dlmgmt_id_avl);
 }
 
@@ -359,9 +354,9 @@ link_destroy(dlmgmt_link_t *linkp)
 }
 
 /*
- * Set the DLMGMT_ACTIVE flag on the link to note that it is active.  When a
- * link becomes active and it belongs to a non-global zone, it is also added
- * to that zone.
+ * Set the DLMGMT_ACTIVE flag on the link to note that it is active.
+ * When a link is active and is owned by an NGZ then it is added to
+ * that zone's datalink list.
  */
 int
 link_activate(dlmgmt_link_t *linkp)
@@ -369,27 +364,75 @@ link_activate(dlmgmt_link_t *linkp)
 	int		err = 0;
 	zoneid_t	zoneid = ALL_ZONES;
 
+	/*
+	 * If zone_check_datalink() returns 0 it means we found the
+	 * link in one of the NGZ's datalink lists. Otherwise the link
+	 * is under the GZ.
+	 */
 	if (zone_check_datalink(&zoneid, linkp->ll_linkid) == 0) {
 		/*
-		 * This link was already added to a non-global zone.  This can
-		 * happen if dlmgmtd is restarted.
+		 * This is a bit subtle. If the following expression
+		 * is true then the link was found in one of the NGZ's
+		 * datalink lists but the link structure has it under
+		 * the GZ. This means that the link is supposed to be
+		 * loaned out to an NGZ but the dlmgmtd state is out
+		 * of sync -- possibly due to the process restarting.
+		 * In this case we need to sync the dlmgmtd state by
+		 * marking it as on-loan to the NGZ it's currently
+		 * under.
 		 */
 		if (zoneid != linkp->ll_zoneid) {
+			assert(linkp->ll_zoneid == 0);
+			assert(linkp->ll_onloan == B_FALSE);
+
+			/*
+			 * If dlmgmtd already has a link with this
+			 * name under the NGZ then we have a problem.
+			 */
 			if (link_by_name(linkp->ll_link, zoneid) != NULL) {
 				err = EEXIST;
 				goto done;
 			}
 
+			/*
+			 * Remove the current linkp entry from the
+			 * list because it's under the wrong zoneid.
+			 * We don't have to update the dlmgmt_id_avl
+			 * because it compares entries by ll_linkid
+			 * only.
+			 */
 			if (avl_find(&dlmgmt_name_avl, linkp, NULL) != NULL)
 				avl_remove(&dlmgmt_name_avl, linkp);
 
+			/*
+			 * Update the link to reflect the fact that
+			 * it's on-loan to an NGZ and re-add it to the
+			 * list.
+			 */
 			linkp->ll_zoneid = zoneid;
 			avl_add(&dlmgmt_name_avl, linkp);
-			avl_add(&dlmgmt_loan_avl, linkp);
 			linkp->ll_onloan = B_TRUE;
+
+			/*
+			 * When a VNIC is not persistent and loaned to
+			 * a zone it is considered transient. This is
+			 * the same logic found in do_create_vnic()
+			 * and is needed here in the event of a
+			 * dlmgmtd restart.
+			 */
+			if (linkp->ll_class == DATALINK_CLASS_VNIC &&
+			    !(linkp->ll_flags & DLMGMT_PERSIST))
+				linkp->ll_trans = B_TRUE;
 		}
 	} else if (linkp->ll_zoneid != GLOBAL_ZONEID) {
+		/*
+		 * In this case the link was not found under any NGZs
+		 * but according to its ll_zoneid member it is owned
+		 * by an NGZ. Add the datalink to the appropriate zone
+		 * datalink list.
+		 */
 		err = zone_add_datalink(linkp->ll_zoneid, linkp->ll_linkid);
+		assert(linkp->ll_onloan == B_FALSE);
 	}
 done:
 	if (err == 0)
@@ -430,10 +473,6 @@ link_by_name(const char *name, zoneid_t zoneid)
 	(void) strlcpy(link.ll_link, name, MAXLINKNAMELEN);
 	link.ll_zoneid = zoneid;
 	linkp = avl_find(&dlmgmt_name_avl, &link, NULL);
-	if (linkp == NULL && zoneid == GLOBAL_ZONEID) {
-		/* The link could be on loan to a non-global zone? */
-		linkp = avl_find(&dlmgmt_loan_avl, &link, NULL);
-	}
 	return (linkp);
 }
 
@@ -449,6 +488,10 @@ dlmgmt_create_common(const char *name, datalink_class_t class, uint32_t media,
 		return (EINVAL);
 	if (dlmgmt_nextlinkid == DATALINK_INVALID_LINKID)
 		return (ENOSPC);
+	if (flags & ~(DLMGMT_ACTIVE | DLMGMT_PERSIST | DLMGMT_TRANSIENT) ||
+	    ((flags & DLMGMT_PERSIST) && (flags & DLMGMT_TRANSIENT)) ||
+	    flags == 0)
+		return (EINVAL);
 
 	if ((linkp = calloc(1, sizeof (dlmgmt_link_t))) == NULL) {
 		err = ENOMEM;
@@ -462,6 +505,15 @@ dlmgmt_create_common(const char *name, datalink_class_t class, uint32_t media,
 	linkp->ll_zoneid = zoneid;
 	linkp->ll_gen = 0;
 
+	/*
+	 * While DLMGMT_TRANSIENT starts off as a flag it is converted
+	 * into a link field since it is really a substate of
+	 * DLMGMT_ACTIVE -- it should not survive as a flag beyond
+	 * this point.
+	 */
+	linkp->ll_trans = (flags & DLMGMT_TRANSIENT) ? B_TRUE : B_FALSE;
+	flags &= ~DLMGMT_TRANSIENT;
+
 	if (avl_find(&dlmgmt_name_avl, linkp, &name_where) != NULL ||
 	    avl_find(&dlmgmt_id_avl, linkp, &id_where) != NULL) {
 		err = EEXIST;
@@ -490,6 +542,12 @@ done:
 int
 dlmgmt_destroy_common(dlmgmt_link_t *linkp, uint32_t flags)
 {
+	/*
+	 * After dlmgmt_create_common() the link flags should only
+	 * ever include ACTIVE or PERSIST.
+	 */
+	assert((linkp->ll_flags & ~(DLMGMT_ACTIVE | DLMGMT_PERSIST)) == 0);
+
 	if ((linkp->ll_flags & flags) == 0) {
 		/*
 		 * The link does not exist in the specified space.
@@ -511,8 +569,6 @@ dlmgmt_destroy_common(dlmgmt_link_t *linkp, uint32_t flags)
 
 	if ((flags & DLMGMT_ACTIVE) && linkp->ll_zoneid != GLOBAL_ZONEID) {
 		(void) zone_remove_datalink(linkp->ll_zoneid, linkp->ll_linkid);
-		if (linkp->ll_onloan)
-			avl_remove(&dlmgmt_loan_avl, linkp);
 	}
 
 	if (linkp->ll_flags == 0) {
diff --git a/usr/src/cmd/dlmgmtd/svc-dlmgmtd b/usr/src/cmd/dlmgmtd/svc-dlmgmtd
index 7559207535..a75e71f9b3 100644
--- a/usr/src/cmd/dlmgmtd/svc-dlmgmtd
+++ b/usr/src/cmd/dlmgmtd/svc-dlmgmtd
@@ -23,17 +23,16 @@
 #
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2012 Joyent, Inc.  All rights reserved.
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
 
 . /lib/svc/share/smf_include.sh
 
-# The real daemon is not started in a non-global zone. But we need to
-# create a dummy background process to preserve contract lifetime.
+# The real daemon is not started in a non-global zone. Exit to leave
+# an empty contract.
 
 if smf_is_nonglobalzone; then
-	(while true ; do sleep 3600 ; done) & 
-	exit $SMF_EXIT_OK
+	exit $SMF_EXIT_NODAEMON
 fi
 
 # Start the dlmgmtd daemon.
diff --git a/usr/src/cmd/dlstat/dlstat.c b/usr/src/cmd/dlstat/dlstat.c
index 63e844a895..8c1749475b 100644
--- a/usr/src/cmd/dlstat/dlstat.c
+++ b/usr/src/cmd/dlstat/dlstat.c
@@ -66,7 +66,7 @@ typedef struct link_chain_s {
 	struct link_chain_s	*lc_next;
 } link_chain_t;
 
-typedef void *	(*stats2str_t)(const char *, void *,
+typedef void *	(*stats2str_t)(const char *, const char *, void *,
 		    char, boolean_t);
 
 typedef struct show_state {
@@ -143,6 +143,7 @@ typedef struct total_fields_buf_s {
 	char t_rbytes[MAXSTATLEN];
 	char t_opackets[MAXSTATLEN];
 	char t_obytes[MAXSTATLEN];
+	char t_zone[ZONENAME_MAX];
 } total_fields_buf_t;
 
 static ofmt_field_t total_s_fields[] = {
@@ -156,6 +157,8 @@ static ofmt_field_t total_s_fields[] = {
     offsetof(total_fields_buf_t, t_opackets),	print_default_cb},
 { "OBYTES",	8,
     offsetof(total_fields_buf_t, t_obytes),	print_default_cb},
+{ "ZONE",	20,
+    offsetof(total_fields_buf_t, t_zone),	print_default_cb},
 { NULL,		0,	0,		NULL}};
 
 /*
@@ -959,8 +962,8 @@ cleanup_removed_links(show_state_t *state)
 }
 
 void *
-print_total_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_total_stats(const char *linkname, const char *zonename, void *statentry,
+    char unit, boolean_t parsable)
 {
 	total_stat_entry_t	*sentry = statentry;
 	total_stat_t		*link_stats = &sentry->tse_stats;
@@ -972,6 +975,7 @@ print_total_stats(const char *linkname, void *statentry, char unit,
 
 	(void) snprintf(buf->t_linkname, sizeof (buf->t_linkname), "%s",
 	    linkname);
+	(void) snprintf(buf->t_zone, sizeof (buf->t_zone), "%s", zonename);
 
 	map_to_units(buf->t_ipackets, sizeof (buf->t_ipackets),
 	    link_stats->ts_ipackets, unit, parsable);
@@ -990,8 +994,8 @@ done:
 }
 
 void *
-print_rx_generic_ring_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_rx_generic_ring_stats(const char *linkname, const char *zonename,
+    void *statentry, char unit, boolean_t parsable)
 {
 	ring_stat_entry_t	*sentry = statentry;
 	ring_stat_t		*link_stats = &sentry->re_stats;
@@ -1024,8 +1028,8 @@ done:
 }
 
 void *
-print_tx_generic_ring_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_tx_generic_ring_stats(const char *linkname, const char *zonename,
+    void *statentry, char unit, boolean_t parsable)
 {
 	ring_stat_entry_t	*sentry = statentry;
 	ring_stat_t		*link_stats = &sentry->re_stats;
@@ -1058,8 +1062,8 @@ done:
 }
 
 void *
-print_rx_ring_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_rx_ring_stats(const char *linkname, const char *zonename, void *statentry,
+    char unit, boolean_t parsable)
 {
 	ring_stat_entry_t	*sentry = statentry;
 	ring_stat_t		*link_stats = &sentry->re_stats;
@@ -1092,8 +1096,8 @@ done:
 }
 
 void *
-print_tx_ring_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_tx_ring_stats(const char *linkname, const char *zonename, void *statentry,
+    char unit, boolean_t parsable)
 {
 	ring_stat_entry_t	*sentry = statentry;
 	ring_stat_t		*link_stats = &sentry->re_stats;
@@ -1126,8 +1130,8 @@ done:
 }
 
 void *
-print_rx_generic_lane_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_rx_generic_lane_stats(const char *linkname, const char *zonename,
+    void *statentry, char unit, boolean_t parsable)
 {
 	rx_lane_stat_entry_t	*sentry = statentry;
 	rx_lane_stat_t		*link_stats = &sentry->rle_stats;
@@ -1174,8 +1178,8 @@ done:
 }
 
 void *
-print_tx_generic_lane_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_tx_generic_lane_stats(const char *linkname, const char *zonename,
+    void *statentry, char unit, boolean_t parsable)
 {
 	tx_lane_stat_entry_t	*sentry = statentry;
 	tx_lane_stat_t		*link_stats = &sentry->tle_stats;
@@ -1219,8 +1223,8 @@ done:
 }
 
 void *
-print_rx_lane_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_rx_lane_stats(const char *linkname, const char *zonename, void *statentry,
+    char unit, boolean_t parsable)
 {
 	rx_lane_stat_entry_t	*sentry = statentry;
 	rx_lane_stat_t		*link_stats = &sentry->rle_stats;
@@ -1285,8 +1289,8 @@ done:
 }
 
 void *
-print_tx_lane_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_tx_lane_stats(const char *linkname, const char *zonename, void *statentry,
+    char unit, boolean_t parsable)
 {
 	tx_lane_stat_entry_t	*sentry = statentry;
 	tx_lane_stat_t		*link_stats = &sentry->tle_stats;
@@ -1340,8 +1344,8 @@ done:
 }
 
 void *
-print_fanout_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_fanout_stats(const char *linkname, const char *zonename, void *statentry,
+    char unit, boolean_t parsable)
 {
 	fanout_stat_entry_t		*sentry = statentry;
 	fanout_stat_t			*link_stats = &sentry->fe_stats;
@@ -1394,8 +1398,8 @@ done:
 }
 
 void *
-print_aggr_port_stats(const char *linkname, void *statentry, char unit,
-    boolean_t parsable)
+print_aggr_port_stats(const char *linkname, const char *zonename,
+    void *statentry, char unit, boolean_t parsable)
 {
 	aggr_port_stat_entry_t	*sentry = statentry;
 	aggr_port_stat_t	*link_stats = &sentry->ape_stats;
@@ -1472,7 +1476,8 @@ done:
 
 void
 walk_dlstat_stats(show_state_t *state, const char *linkname,
-    dladm_stat_type_t stattype, dladm_stat_chain_t *diff_stat)
+    const char *zonename, dladm_stat_type_t stattype,
+    dladm_stat_chain_t *diff_stat)
 {
 	dladm_stat_chain_t  *curr;
 
@@ -1482,7 +1487,8 @@ walk_dlstat_stats(show_state_t *state, const char *linkname,
 
 		/* Format the raw numbers for printing */
 		fields_buf = state->ls_stats2str[stattype](linkname,
-		    curr->dc_statentry, state->ls_unit, state->ls_parsable);
+		    zonename, curr->dc_statentry, state->ls_unit,
+		    state->ls_parsable);
 		/* Print the stats */
 		if (fields_buf != NULL)
 			ofmt_print(state->ls_ofmt, fields_buf);
@@ -1497,12 +1503,20 @@ show_queried_stats(dladm_handle_t dh, datalink_id_t linkid, void *arg)
 	int 			i;
 	dladm_stat_chain_t	*diff_stat;
 	char			linkname[DLPI_LINKNAME_MAX];
+	char			zonename[DLADM_PROP_VAL_MAX + 1];
+	char			*valptr[1];
+	uint_t			valcnt = 1;
 
 	if (dladm_datalink_id2info(dh, linkid, NULL, NULL, NULL, linkname,
 	    DLPI_LINKNAME_MAX) != DLADM_STATUS_OK) {
 		goto done;
 	}
 
+	valptr[0] = zonename;
+	if (dladm_get_linkprop(handle, linkid, DLADM_PROP_VAL_CURRENT, "zone",
+	    (char **)valptr, &valcnt) != 0)
+		zonename[0] = '\0';
+
 	for (i = 0; i < DLADM_STAT_NUM_STATS; i++) {
 		if (state->ls_stattype[i]) {
 			/*
@@ -1510,7 +1524,8 @@ show_queried_stats(dladm_handle_t dh, datalink_id_t linkid, void *arg)
 			 * Stats are returned as chain of raw numbers
 			 */
 			diff_stat = query_link_stats(handle, linkid, arg, i);
-			walk_dlstat_stats(state, linkname, i, diff_stat);
+			walk_dlstat_stats(state, linkname, zonename, i,
+			    diff_stat);
 			dladm_link_stat_free(diff_stat);
 		}
 	}
@@ -1630,7 +1645,7 @@ do_show(int argc, char *argv[], const char *use)
 	char			*o_fields_str = NULL;
 
 	char			*total_stat_fields =
-	    "link,ipkts,rbytes,opkts,obytes";
+	    "link,ipkts,rbytes,opkts,obytes,zone";
 	char			*rx_total_stat_fields =
 	    "link,ipkts,rbytes,intrs,polls,ch<10,ch10-50,ch>50";
 	char			*tx_total_stat_fields =
diff --git a/usr/src/cmd/dlutil/Makefile b/usr/src/cmd/dlutil/Makefile
index afbaf3a40d..4c7738ec3a 100644
--- a/usr/src/cmd/dlutil/Makefile
+++ b/usr/src/cmd/dlutil/Makefile
@@ -13,7 +13,7 @@
 # Copyright (c) 2017, Joyent, Inc.
 #
 
-PROG= dltraninfo dlled
+PROG= dltraninfo dlsend dlrecv dlled
 LINTPROGS= $(PROG:%=%.ln)
 
 include ../Makefile.cmd
@@ -25,6 +25,8 @@ dltraninfo :=   LDLIBS += -ldladm -lsff -lnvpair
 dlled :=	LDLIBS += -ldladm
 dltraninfo.ln :=   LDLIBS += -ldladm -lsff -lnvpair
 dlled.ln :=	LDLIBS += -ldladm
+dlsend :=	LDLIBS += -ldlpi -lsocket -lmd
+dlrecv :=	LDLIBS += -ldlpi
 
 ROOTLIBDLFILES = $(PROG:%=$(ROOTLIB)/dl/%)
 
diff --git a/usr/src/cmd/dlutil/dlrecv.c b/usr/src/cmd/dlutil/dlrecv.c
new file mode 100644
index 0000000000..4464baced9
--- /dev/null
+++ b/usr/src/cmd/dlutil/dlrecv.c
@@ -0,0 +1,237 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+/*
+ * Receive a raw Ethernet frame from dlsend.
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stdarg.h>
+#include <libgen.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <netdb.h>
+#include <libdlpi.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <endian.h>
+#include <ctype.h>
+
+#include "dlsend.h"
+
+
+static uint_t dlrecv_sap = DLSEND_SAP;
+static const char *dlrecv_prog;
+
+static void
+dlrecv_warn(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void) fprintf(stderr, "%s: ", dlrecv_prog);
+	va_start(ap, fmt);
+	(void) vfprintf(stderr, fmt, ap);
+	va_end(ap);
+}
+
+static void
+dlrecv_usage(const char *fmt, ...)
+{
+	if (fmt != NULL) {
+		va_list ap;
+
+		(void) fprintf(stderr, "%s: ", dlrecv_prog);
+		va_start(ap, fmt);
+		(void) vfprintf(stderr, fmt, ap);
+		va_end(ap);
+	}
+
+	(void) fprintf(stderr, "Usage: %s [-s sap] device\n"
+	    "\t-s sap\tspecify SAP to send on\n",
+	    dlrecv_prog);
+}
+
+static boolean_t
+dlrecv_isvalid(dlsend_msg_t *msg)
+{
+	uint_t i;
+	boolean_t nul;
+
+	nul = B_FALSE;
+	for (i = 0; i < sizeof (msg->dm_host); i++) {
+		if (!isprint(msg->dm_host[i]) &&
+		    msg->dm_host[i] != '\0') {
+			dlrecv_warn("Encountered bad byte in dm_host[%d]\n",
+			    i);
+			return (B_FALSE);
+		}
+
+		if (msg->dm_host[i] == '\0')
+			nul = B_TRUE;
+	}
+
+	if (!nul) {
+		dlrecv_warn("Missing NUL in dm_host\n");
+		return (B_FALSE);
+	}
+
+	nul = B_FALSE;
+	for (i = 0; i < sizeof (msg->dm_mesg); i++) {
+		if (!isprint(msg->dm_mesg[i]) &&
+		    msg->dm_mesg[i] != '\0') {
+			dlrecv_warn("Encountered bad byte in dm_mesg[%d]\n",
+			    i);
+			return (B_FALSE);
+		}
+
+		if (msg->dm_mesg[i] == '\0')
+			nul = B_TRUE;
+	}
+
+	if (!nul) {
+		dlrecv_warn("Missing NUL in dm_mesg\n");
+		return (B_FALSE);
+	}
+
+	if (strcmp(msg->dm_mesg, DLSEND_MSG) != 0) {
+		dlrecv_warn("Missing expected message (%s)\n", DLSEND_MSG);
+		return (B_FALSE);
+	}
+
+	return (B_TRUE);
+}
+
+static void
+dlrecv_print(dlsend_msg_t *msg, dlpi_recvinfo_t *rinfo, boolean_t invalid)
+{
+	uint_t i;
+
+	printf("Received %s from ", invalid ? "invalid message" : "Elbereth");
+
+	for (i = 0; i < rinfo->dri_destaddrlen; i++) {
+		(void) printf("%02x", rinfo->dri_destaddr[i]);
+		if (i + 1 != rinfo->dri_destaddrlen)
+			(void) putchar(':');
+	}
+
+	if (invalid) {
+		return;
+	}
+
+	printf(" seq=%" PRIu64 " host=%s\n", betoh64(msg->dm_count),
+	    msg->dm_host);
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c, ret;
+	char *eptr;
+	unsigned long sap;
+	uint_t bind_sap;
+	dlpi_handle_t dh;
+
+	dlrecv_prog = basename(argv[0]);
+
+	while ((c = getopt(argc, argv, ":s:")) != -1) {
+		switch (c) {
+		case 's':
+			errno = 0;
+			sap = strtoul(optarg, &eptr, 10);
+			if (errno != 0 || sap == 0 || sap >= UINT16_MAX ||
+			    *eptr != '\0') {
+				dlrecv_usage("Invalid value for sap (-s): %s\n",
+				    optarg);
+				return (2);
+			}
+			dlrecv_sap = sap;
+			break;
+		case ':':
+			dlrecv_usage("Option -%c requires an operand\n",
+			    optopt);
+			return (2);
+		case '?':
+			dlrecv_usage("Unknown option: -%c\n", optopt);
+			return (2);
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc != 1) {
+		dlrecv_usage("missing required operands\n");
+		return (2);
+	}
+
+	if ((ret = dlpi_open(argv[0], &dh, 0)) != DLPI_SUCCESS) {
+		dlrecv_warn("failed to open %s: %s\n", argv[0],
+		    dlpi_strerror(ret));
+		exit(1);
+	}
+
+	if ((ret = dlpi_bind(dh, dlrecv_sap, &bind_sap)) != DLPI_SUCCESS) {
+		dlrecv_warn("failed to bind to sap 0x%x: %s\n", dlrecv_sap,
+		    dlpi_strerror(ret));
+		exit(1);
+	}
+
+	if (bind_sap != dlrecv_sap) {
+		dlrecv_warn("failed to bind to requested sap 0x%x, bound to "
+		    "0x%x\n", dlrecv_sap, bind_sap);
+		exit(1);
+	}
+
+	for (;;) {
+		dlpi_recvinfo_t rinfo;
+		dlsend_msg_t msg;
+		size_t msglen;
+		boolean_t invalid = B_FALSE;
+
+		msglen = sizeof (msg);
+		ret = dlpi_recv(dh, NULL, NULL, &msg, &msglen, -1, &rinfo);
+		if (ret != DLPI_SUCCESS) {
+			dlrecv_warn("failed to receive data: %s\n",
+			    dlpi_strerror(ret));
+			continue;
+		}
+
+		if (msglen != rinfo.dri_totmsglen) {
+			dlrecv_warn("message truncated: expected %ld bytes, "
+			    "got %ld\n", sizeof (dlsend_msg_t),
+			    rinfo.dri_totmsglen);
+			invalid = B_TRUE;
+		}
+
+		if (msglen != sizeof (msg)) {
+			dlrecv_warn("message too short: expected %ld bytes, "
+			    "got %ld\n", sizeof (dlsend_msg_t),
+			    msglen);
+			invalid = B_TRUE;
+		}
+
+		if (!invalid) {
+			invalid = !dlrecv_isvalid(&msg);
+		}
+
+		dlrecv_print(&msg, &rinfo, invalid);
+	}
+
+	return (0);
+}
diff --git a/usr/src/cmd/dlutil/dlsend.c b/usr/src/cmd/dlutil/dlsend.c
new file mode 100644
index 0000000000..e77d157f53
--- /dev/null
+++ b/usr/src/cmd/dlutil/dlsend.c
@@ -0,0 +1,163 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+/*
+ * Send a raw Ethernet frame once a second to a specified MAC address.
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stdarg.h>
+#include <libgen.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <netdb.h>
+#include <libdlpi.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <endian.h>
+
+#include "dlsend.h"
+
+static uint_t dlsend_sap = DLSEND_SAP;
+static const char *dlsend_msg = DLSEND_MSG;
+static const char *dlsend_prog;
+
+static void
+dlsend_warn(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void) fprintf(stderr, "%s: ", dlsend_prog);
+	va_start(ap, fmt);
+	(void) vfprintf(stderr, fmt, ap);
+	va_end(ap);
+}
+
+static void
+dlsend_usage(const char *fmt, ...)
+{
+	if (fmt != NULL) {
+		va_list ap;
+
+		(void) fprintf(stderr, "%s: ", dlsend_prog);
+		va_start(ap, fmt);
+		(void) vfprintf(stderr, fmt, ap);
+		va_end(ap);
+	}
+
+	(void) fprintf(stderr, "Usage: %s [-s sap] device target-mac\n"
+	    "\t-s sap\tspecify SAP to send on\n",
+	    dlsend_prog);
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c, maclen, ret;
+	unsigned long sap;
+	char *eptr;
+	uchar_t *mac;
+	char host[MAXHOSTNAMELEN];
+	uint_t bind_sap;
+	dlpi_handle_t dh;
+	uint64_t count;
+
+	dlsend_prog = basename(argv[0]);
+
+	while ((c = getopt(argc, argv, ":s:")) != -1) {
+		switch (c) {
+		case 's':
+			errno = 0;
+			sap = strtoul(optarg, &eptr, 10);
+			if (errno != 0 || sap == 0 || sap >= UINT16_MAX ||
+			    *eptr != '\0') {
+				dlsend_usage("Invalid value for sap (-s): %s\n",
+				    optarg);
+				return (2);
+			}
+			dlsend_sap = sap;
+			break;
+		case ':':
+			dlsend_usage("Option -%c requires an operand\n",
+			    optopt);
+			return (2);
+		case '?':
+			dlsend_usage("Unknown option: -%c\n", optopt);
+			return (2);
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc != 2) {
+		dlsend_usage("missing required operands\n");
+		return (2);
+	}
+
+	if ((mac = _link_aton(argv[1], &maclen)) == NULL) {
+		dlsend_warn("failed to convert target address %s\n", argv[1]);
+		return (1);
+	}
+
+	if (gethostname(host, sizeof (host)) != 0) {
+		dlsend_warn("failed to obtain the system hostname: %s\n",
+		    strerror(errno));
+		(void) strlcpy(host, "<unknown host>", sizeof (host));
+	}
+
+	if ((ret = dlpi_open(argv[0], &dh, 0)) != DLPI_SUCCESS) {
+		dlsend_warn("failed to open %s: %s\n", argv[0],
+		    dlpi_strerror(ret));
+		exit(1);
+	}
+
+	if ((ret = dlpi_bind(dh, dlsend_sap, &bind_sap)) != DLPI_SUCCESS) {
+		dlsend_warn("failed to bind to sap 0x%x: %s\n", dlsend_sap,
+		    dlpi_strerror(ret));
+		exit(1);
+	}
+
+	if (bind_sap != dlsend_sap) {
+		dlsend_warn("failed to bind to requested sap 0x%x, bound to "
+		    "0x%x\n", dlsend_sap, bind_sap);
+		exit(1);
+	}
+
+	count = 0;
+	for (;;) {
+		dlsend_msg_t msg;
+
+		count++;
+		bzero(&msg, sizeof (msg));
+		msg.dm_count = htobe64(count);
+		(void) strlcpy(msg.dm_host, host, sizeof (msg.dm_host));
+		(void) strlcpy(msg.dm_mesg, dlsend_msg, sizeof (msg.dm_mesg));
+		ret = dlpi_send(dh, mac, maclen, &msg, sizeof (msg), NULL);
+		if (ret != DLPI_SUCCESS) {
+			dlsend_warn("failed to send message: %s\n",
+			    dlpi_strerror(ret));
+			exit(1);
+		}
+
+		sleep(1);
+	}
+
+	return (0);
+}
diff --git a/usr/src/cmd/dlutil/dlsend.h b/usr/src/cmd/dlutil/dlsend.h
new file mode 100644
index 0000000000..5674ff0b78
--- /dev/null
+++ b/usr/src/cmd/dlutil/dlsend.h
@@ -0,0 +1,45 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#ifndef _DLSEND_H
+#define	_DLSEND_H
+
+/*
+ * A common header file for things that dlsend and dlrecv need.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * We need to pick an arbitrary Ethertype to squat on for the purposes of this
+ * testing program. As such we use one with a recongizable string. If someone
+ * comes along and uses this, then we should get off of it.
+ */
+#define	DLSEND_SAP	0xdeed
+#define	DLSEND_MSG	"A Elbereth Gilthoniel"
+
+typedef struct dlsend_msg {
+	uint64_t	dm_count;
+	char		dm_host[MAXHOSTNAMELEN];
+	char		dm_mesg[32];
+} dlsend_msg_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DLSEND_H */
diff --git a/usr/src/cmd/dtrace/test/README b/usr/src/cmd/dtrace/test/README
index 51ab650fd7..094f70e7da 100644
--- a/usr/src/cmd/dtrace/test/README
+++ b/usr/src/cmd/dtrace/test/README
@@ -20,13 +20,10 @@ CDDL HEADER END
 
 Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 Use is subject to license terms.
-
-ident	"%Z%%M%	%I%	%E% SMI"
+Copyright 2017 Joyent, Inc.
 
 DTrace Testing Suite
 
 The SUNWdtrt package delivers a set of test programs and D source
-files into the directory /opt/SUNWdtrt.  For more information see
-the following web site:
-
-	http://www.opensolaris.org/os/community/dtrace/dtest
+files into the directory /opt/SUNWdtrt. To run the tests:
+	/opt/SUNWdtrt/bin/dtest
diff --git a/usr/src/cmd/dtrace/test/cmd/jdtrace/Makefile b/usr/src/cmd/dtrace/test/cmd/jdtrace/Makefile
index 66479e77bc..ee93b7a258 100644
--- a/usr/src/cmd/dtrace/test/cmd/jdtrace/Makefile
+++ b/usr/src/cmd/dtrace/test/cmd/jdtrace/Makefile
@@ -75,7 +75,7 @@ $(PROG): $(SRCS)
 	$(POST_PROCESS) ; $(STRIP_STABS)
 
 JFLAGS= -g -cp $(CLASSPATH) -d $(CLASSDIR)
-JFLAGS += -source 1.5 -target 1.6 -Xlint:all,-options
+JFLAGS += -source 1.5 -target 1.6 -Xlint:all,-options,-path
 COMPILE.java=$(JAVAC) $(JFLAGS)
 JAVASRC= JDTrace.java Getopt.java
 
diff --git a/usr/src/cmd/dtrace/test/cmd/scripts/dtest.pl b/usr/src/cmd/dtrace/test/cmd/scripts/dtest.pl
index d6f1c8c277..e7f9189822 100644
--- a/usr/src/cmd/dtrace/test/cmd/scripts/dtest.pl
+++ b/usr/src/cmd/dtrace/test/cmd/scripts/dtest.pl
@@ -566,7 +566,7 @@ $defdir = -d $dt_tst ? $dt_tst : '.';
 $bindir = -d $dt_bin ? $dt_bin : '.';
 
 if (!$opt_F) {
-	my @dependencies = ("gcc", "make", "java", "perl");
+	my @dependencies = ("gcc", "cc", "make", "java", "perl", "printenv");
 	
 	for my $dep (@dependencies) {
 		if (!inpath($dep)) {
diff --git a/usr/src/cmd/dtrace/test/tst/common/Makefile b/usr/src/cmd/dtrace/test/tst/common/Makefile
index d7ed139203..32d6a1db05 100644
--- a/usr/src/cmd/dtrace/test/tst/common/Makefile
+++ b/usr/src/cmd/dtrace/test/tst/common/Makefile
@@ -153,6 +153,14 @@ usdt/tst.forker.o: usdt/forker.h
 usdt/forker.h: usdt/forker.d
 	$(DTRACE) -h -s usdt/forker.d -o usdt/forker.h
 
+ustack/tst.unpriv.exe: ustack/tst.unpriv.o ustack/unpriv_helper.o
+	$(LINK.c) -o ustack/tst.unpriv.exe \
+	    ustack/tst.unpriv.o ustack/unpriv_helper.o $(LDLIBS)
+	$(POST_PROCESS) ; $(STRIP_STABS)
+
+ustack/unpriv_helper.o: ustack/unpriv_helper.d
+	$(COMPILE.d) -o ustack/unpriv_helper.o -s ustack/unpriv_helper.d
+
 usdt/tst.lazyprobe.exe: usdt/tst.lazyprobe.o usdt/lazyprobe.o
 	$(LINK.c) -o usdt/tst.lazyprobe.exe \
 	    usdt/tst.lazyprobe.o usdt/lazyprobe.o $(LDLIBS)
diff --git a/usr/src/cmd/dtrace/test/tst/common/java_api/Makefile b/usr/src/cmd/dtrace/test/tst/common/java_api/Makefile
index 43daede8e8..04e6cca7b4 100644
--- a/usr/src/cmd/dtrace/test/tst/common/java_api/Makefile
+++ b/usr/src/cmd/dtrace/test/tst/common/java_api/Makefile
@@ -60,7 +60,7 @@ lint:
 install: all $(PROTO_TEST_JAR)
 
 JFLAGS= -g -cp $(CLASSPATH) -d $(CLASSDIR)
-JFLAGS += -source 1.5 -target 1.6 -Xlint:all,-options,-rawtypes
+JFLAGS += -source 1.5 -target 1.6 -Xlint:all,-options,-rawtypes,-path
 COMPILE.java=$(JAVAC) $(JFLAGS)
 
 $(TEST_JAR): $(SRCDIR)/*.java
diff --git a/usr/src/cmd/dtrace/test/tst/common/llquantize/tst.range.d b/usr/src/cmd/dtrace/test/tst/common/llquantize/tst.range.d
index e2882b3f8e..a9138d2f54 100644
--- a/usr/src/cmd/dtrace/test/tst/common/llquantize/tst.range.d
+++ b/usr/src/cmd/dtrace/test/tst/common/llquantize/tst.range.d
@@ -19,10 +19,6 @@
  * CDDL HEADER END
  */
 
-/*
- * Copyright (c) 2011, Joyent, Inc. All rights reserved.
- */
-
 #pragma D option quiet
 
 BEGIN
diff --git a/usr/src/cmd/dtrace/test/tst/common/mdb/tst.postmort.ksh b/usr/src/cmd/dtrace/test/tst/common/mdb/tst.postmort.ksh
new file mode 100644
index 0000000000..c5921b8d28
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/common/mdb/tst.postmort.ksh
@@ -0,0 +1,69 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
+#
+
+if [ $# != 1 ]; then
+	echo expected one argument: '<'dtrace-path'>'
+	exit 2
+fi
+
+dtrace=$1
+DIR=/var/tmp/dtest.$$
+
+mkdir $DIR
+cd $DIR
+
+expected=`od -t u8 -N 8 /dev/urandom | head -1 | cut -d ' ' -f2`
+
+$dtrace -x bufpolicy=ring -x bufsize=10k -qs /dev/stdin > /dev/null 2>&1 <<EOF &
+	tick-1ms
+	/i < 10000/
+	{
+		printf("%d: expected is $expected!\n", i++);
+	}
+
+	tick-1ms
+	/i >= 10000/
+	{
+		exit(0);
+	}
+EOF
+
+background=$!
+
+#
+# Give some time for the enabling to get there...
+#
+sleep 2
+
+echo "::walk dtrace_state | ::dtrace" | mdb -k | tee test.out
+grep "expected is $expected" test.out 2> /dev/null 1>&2
+status=$?
+
+kill $background
+
+cd /
+/usr/bin/rm -rf $DIR
+
+exit $status
diff --git a/usr/src/cmd/dtrace/test/tst/common/ustack/tst.unpriv.c b/usr/src/cmd/dtrace/test/tst/common/ustack/tst.unpriv.c
new file mode 100644
index 0000000000..43ba244444
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/common/ustack/tst.unpriv.c
@@ -0,0 +1,7 @@
+int
+main(int argc, char *argv[])
+{
+	for (;;)
+		;
+	return (0);
+}
diff --git a/usr/src/cmd/dtrace/test/tst/common/ustack/tst.unpriv.ksh b/usr/src/cmd/dtrace/test/tst/common/ustack/tst.unpriv.ksh
new file mode 100644
index 0000000000..26c430bff7
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/common/ustack/tst.unpriv.ksh
@@ -0,0 +1,68 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
+#
+
+ppriv -s A=basic,dtrace_user,dtrace_proc $$
+
+if [ $# != 1 ]; then
+	echo expected one argument: '<'dtrace-path'>'
+	exit 2
+fi
+
+file=out.$$
+dtrace=$1
+
+rm -f $file
+
+dir=`/bin/dirname $tst`
+
+$dtrace -o $file -c $dir/tst.unpriv.exe -ws /dev/stdin <<EOF
+	profile-1234hz
+	/pid == \$target/
+	{
+		@[ustack(20, 8192)] = count();
+	}
+
+	tick-1s
+	{
+		secs++;
+	}
+
+	tick-1s
+	/secs > 10/
+	{
+		trace("test timed out");
+		exit(1);
+	}
+
+	profile-1234hz
+	/pid == \$target && secs > 5/
+	{
+		raise(SIGINT);
+		exit(0);
+	}
+EOF
+
+status=$?
+exit $status
diff --git a/usr/src/cmd/dtrace/test/tst/common/ustack/unpriv_helper.d b/usr/src/cmd/dtrace/test/tst/common/ustack/unpriv_helper.d
new file mode 100644
index 0000000000..eb7b0e9e9d
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/common/ustack/unpriv_helper.d
@@ -0,0 +1,4 @@
+dtrace:helper:ustack:
+{
+	this->otherstr = "doogle";
+}
diff --git a/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite1.c b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite1.c
new file mode 100644
index 0000000000..fba70fb709
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite1.c
@@ -0,0 +1,42 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <unistd.h>
+
+int
+startup_wait(int *val)
+{
+	return (*val);
+}
+
+int
+baz(void)
+{
+	return (0);
+}
+
+int
+main(int argc, char **argv)
+{
+	int wait = 1;
+
+	while (startup_wait(&wait)) {
+		usleep(1000);
+	}
+
+	(void) baz();
+
+	return (0);
+}
diff --git a/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite1.d b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite1.d
new file mode 100644
index 0000000000..238fefcdc2
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite1.d
@@ -0,0 +1,38 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+
+#pragma D option quiet
+#pragma D option destructive
+
+pid$1:a.out:startup_wait:entry
+{
+	this->val = (int *)alloca(sizeof (int));
+	*this->val = 0;
+	copyout(this->val, arg0, sizeof (int));
+}
+
+pid$1:a.out:baz:return
+{
+	uregs[R_PC] += 1;
+	/* should not be reached due to error */
+	exit(0);
+}
+
+syscall::rexit:entry
+/pid == $1/
+{
+	exit(1);
+}
diff --git a/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite2.c b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite2.c
new file mode 100644
index 0000000000..24d3b61966
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite2.c
@@ -0,0 +1,22 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <unistd.h>
+
+int
+main(int argc, char **argv)
+{
+	return (0);
+}
diff --git a/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite2.d b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite2.d
new file mode 100644
index 0000000000..9be786b4ba
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/i386/pid/err.uregswrite2.d
@@ -0,0 +1,22 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#pragma D option quiet
+
+pid$1:a.out:main:entry
+{
+	/* should cause an error due to lack of destructive option */
+	uregs[R_EAX] = 0;
+}
diff --git a/usr/src/cmd/dtrace/test/tst/i386/pid/tst.uregswrite.c b/usr/src/cmd/dtrace/test/tst/i386/pid/tst.uregswrite.c
new file mode 100644
index 0000000000..642cd40f8d
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/i386/pid/tst.uregswrite.c
@@ -0,0 +1,60 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <unistd.h>
+
+int
+startup_wait(int *val)
+{
+	return (*val);
+}
+
+int
+baz(void)
+{
+	return (0);
+}
+
+int bar_val = 0;
+
+int
+bar(void)
+{
+	return (bar_val++);
+}
+
+int
+main(int argc, char **argv)
+{
+	int wait = 1;
+
+	while (startup_wait(&wait)) {
+		usleep(1000);
+	}
+
+	if (baz() != 1)
+		return (1);
+
+	if (bar() != 0)
+		return (1);
+
+	if (bar() != 2)
+		return (1);
+
+	if (bar() != 2)
+		return (1);
+
+	return (0);
+}
diff --git a/usr/src/cmd/dtrace/test/tst/i386/pid/tst.uregswrite.d b/usr/src/cmd/dtrace/test/tst/i386/pid/tst.uregswrite.d
new file mode 100644
index 0000000000..0185614f59
--- /dev/null
+++ b/usr/src/cmd/dtrace/test/tst/i386/pid/tst.uregswrite.d
@@ -0,0 +1,42 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+
+#pragma D option quiet
+#pragma D option destructive
+
+pid$1:a.out:startup_wait:entry
+{
+	this->val = (int *)alloca(sizeof (int));
+	*this->val = 0;
+	copyout(this->val, arg0, sizeof (int));
+}
+
+pid$1:a.out:baz:return
+{
+	uregs[R_EAX] = 1;
+}
+
+pid$1:a.out:bar:return
+/(uregs[R_EAX] % 2) != 0/
+{
+	uregs[R_EAX] += 1;
+}
+
+syscall::rexit:entry
+/pid == $1/
+{
+	exit(arg0);
+}
diff --git a/usr/src/cmd/file/file.c b/usr/src/cmd/file/file.c
index 6c7989d735..64379f3919 100644
--- a/usr/src/cmd/file/file.c
+++ b/usr/src/cmd/file/file.c
@@ -28,6 +28,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #define	_LARGEFILE64_SOURCE
@@ -980,104 +981,188 @@ print_elf_machine(int machine)
 	 * in /usr/include/sys/elf.h.
 	 */
 	static const char *mach_str[EM_NUM] = {
-		"unknown machine",		/* 0 - EM_NONE */
-		"WE32100",			/* 1 - EM_M32 */
-		"SPARC",			/* 2 - EM_SPARC */
-		"80386",			/* 3 - EM_386 */
-		"M68000",			/* 4 - EM_68K */
-		"M88000",			/* 5 - EM_88K */
-		"80486",			/* 6 - EM_486 */
-		"i860",				/* 7 - EM_860 */
-		"MIPS RS3000 Big-Endian",	/* 8 - EM_MIPS */
-		"S/370",			/* 9 - EM_S370 */
-		"MIPS RS3000 Little-Endian",	/* 10 - EM_MIPS_RS3_LE */
-		"MIPS RS6000",			/* 11 - EM_RS6000 */
-		NULL,				/* 12 - EM_UNKNOWN12 */
-		NULL,				/* 13 - EM_UNKNOWN13 */
-		NULL,				/* 14 - EM_UNKNOWN14 */
-		"PA-RISC",			/* 15 - EM_PA_RISC */
-		"nCUBE",			/* 16 - EM_nCUBE */
-		"VPP500",			/* 17 - EM_VPP500 */
-		"SPARC32PLUS",			/* 18 - EM_SPARC32PLUS */
-		"i960",				/* 19 - EM_960 */
-		"PowerPC",			/* 20 - EM_PPC */
-		"PowerPC64",			/* 21 - EM_PPC64 */
-		"S/390",			/* 22 - EM_S390 */
-		NULL,				/* 23 - EM_UNKNOWN23 */
-		NULL,				/* 24 - EM_UNKNOWN24 */
-		NULL,				/* 25 - EM_UNKNOWN25 */
-		NULL,				/* 26 - EM_UNKNOWN26 */
-		NULL,				/* 27 - EM_UNKNOWN27 */
-		NULL,				/* 28 - EM_UNKNOWN28 */
-		NULL,				/* 29 - EM_UNKNOWN29 */
-		NULL,				/* 30 - EM_UNKNOWN30 */
-		NULL,				/* 31 - EM_UNKNOWN31 */
-		NULL,				/* 32 - EM_UNKNOWN32 */
-		NULL,				/* 33 - EM_UNKNOWN33 */
-		NULL,				/* 34 - EM_UNKNOWN34 */
-		NULL,				/* 35 - EM_UNKNOWN35 */
-		"V800",				/* 36 - EM_V800 */
-		"FR20",				/* 37 - EM_FR20 */
-		"RH32",				/* 38 - EM_RH32 */
-		"RCE",				/* 39 - EM_RCE */
-		"ARM",				/* 40 - EM_ARM */
-		"Alpha",			/* 41 - EM_ALPHA */
-		"S/390",			/* 42 - EM_SH */
-		"SPARCV9",			/* 43 - EM_SPARCV9 */
-		"Tricore",			/* 44 - EM_TRICORE */
-		"ARC",				/* 45 - EM_ARC */
-		"H8/300",			/* 46 - EM_H8_300 */
-		"H8/300H",			/* 47 - EM_H8_300H */
-		"H8S",				/* 48 - EM_H8S */
-		"H8/500",			/* 49 - EM_H8_500 */
-		"IA64",				/* 50 - EM_IA_64 */
-		"MIPS-X",			/* 51 - EM_MIPS_X */
-		"Coldfire",			/* 52 - EM_COLDFIRE */
-		"M68HC12",			/* 53 - EM_68HC12 */
-		"MMA",				/* 54 - EM_MMA */
-		"PCP",				/* 55 - EM_PCP */
-		"nCPU",				/* 56 - EM_NCPU */
-		"NDR1",				/* 57 - EM_NDR1 */
-		"Starcore",			/* 58 - EM_STARCORE */
-		"ME16",				/* 59 - EM_ME16 */
-		"ST100",			/* 60 - EM_ST100 */
-		"TINYJ",			/* 61 - EM_TINYJ */
-		"AMD64",			/* 62 - EM_AMD64 */
-		"PDSP",				/* 63 - EM_PDSP */
-		NULL,				/* 64 - EM_UNKNOWN64 */
-		NULL,				/* 65 - EM_UNKNOWN65 */
-		"FX66",				/* 66 - EM_FX66 */
-		"ST9 PLUS",			/* 67 - EM_ST9PLUS */
-		"ST7",				/* 68 - EM_ST7 */
-		"68HC16",			/* 69 - EM_68HC16 */
-		"68HC11",			/* 70 - EM_68HC11 */
-		"68H08",			/* 71 - EM_68HC08 */
-		"68HC05",			/* 72 - EM_68HC05 */
-		"SVX",				/* 73 - EM_SVX */
-		"ST19",				/* 74 - EM_ST19 */
-		"VAX",				/* 75 - EM_VAX */
-		"CRIS",				/* 76 - EM_CRIS */
-		"Javelin",			/* 77 - EM_JAVELIN */
-		"Firepath",			/* 78 - EM_FIREPATH */
-		"ZSP",				/* 79 - EM_ZSP */
-		"MMIX",				/* 80 - EM_MMIX */
-		"HUANY",			/* 81 - EM_HUANY */
-		"Prism",			/* 82 - EM_PRISM */
-		"AVR",				/* 83 - EM_AVR */
-		"FR30",				/* 84 - EM_FR30 */
-		"D10V",				/* 85 - EM_D10V */
-		"D30V",				/* 86 - EM_D30V */
-		"V850",				/* 87 - EM_V850 */
-		"M32R",				/* 88 - EM_M32R */
-		"MN10300",			/* 89 - EM_MN10300 */
-		"MN10200",			/* 90 - EM_MN10200 */
-		"picoJava",			/* 91 - EM_PJ */
-		"OpenRISC",			/* 92 - EM_OPENRISC */
-		"Tangent-A5",			/* 93 - EM_ARC_A5 */
-		"Xtensa"			/* 94 - EM_XTENSA */
+		[EM_NONE] = "unknown machine",
+		[EM_M32] = "WE32100",
+		[EM_SPARC] = "SPARC",
+		[EM_386] = "80386",
+		[EM_68K] = "M68000",
+		[EM_88K] = "M88000",
+		[EM_486] = "80486",
+		[EM_860] = "i860",
+		[EM_MIPS] = "MIPS RS3000 Big-Endian",
+		[EM_S370] = "S/370",
+		[EM_MIPS_RS3_LE] = "MIPS RS3000 Little-Endian",
+		[EM_RS6000] = "MIPS RS6000",
+		[EM_PA_RISC] = "PA-RISC",
+		[EM_nCUBE] = "nCUBE",
+		[EM_VPP500] = "VPP500",
+		[EM_SPARC32PLUS] = "SPARC32PLUS",
+		[EM_960] = "i960",
+		[EM_PPC] = "PowerPC",
+		[EM_PPC64] = "PowerPC64",
+		[EM_S390] = "S/390",
+		[EM_V800] = "V800",
+		[EM_FR20] = "FR20",
+		[EM_RH32] = "RH32",
+		[EM_RCE] = "RCE",
+		[EM_ARM] = "ARM",
+		[EM_ALPHA] = "Alpha",
+		[EM_SH] = "S/390",
+		[EM_SPARCV9] = "SPARCV9",
+		[EM_TRICORE] = "Tricore",
+		[EM_ARC] = "ARC",
+		[EM_H8_300] = "H8/300",
+		[EM_H8_300H] = "H8/300H",
+		[EM_H8S] = "H8S",
+		[EM_H8_500] = "H8/500",
+		[EM_IA_64] = "IA64",
+		[EM_MIPS_X] = "MIPS-X",
+		[EM_COLDFIRE] = "Coldfire",
+		[EM_68HC12] = "M68HC12",
+		[EM_MMA] = "MMA",
+		[EM_PCP] = "PCP",
+		[EM_NCPU] = "nCPU",
+		[EM_NDR1] = "NDR1",
+		[EM_STARCORE] = "Starcore",
+		[EM_ME16] = "ME16",
+		[EM_ST100] = "ST100",
+		[EM_TINYJ] = "TINYJ",
+		[EM_AMD64] = "AMD64",
+		[EM_PDSP] = "PDSP",
+		[EM_FX66] = "FX66",
+		[EM_ST9PLUS] = "ST9 PLUS",
+		[EM_ST7] = "ST7",
+		[EM_68HC16] = "68HC16",
+		[EM_68HC11] = "68HC11",
+		[EM_68HC08] = "68H08",
+		[EM_68HC05] = "68HC05",
+		[EM_SVX] = "SVX",
+		[EM_ST19] = "ST19",
+		[EM_VAX] = "VAX",
+		[EM_CRIS] = "CRIS",
+		[EM_JAVELIN] = "Javelin",
+		[EM_FIREPATH] = "Firepath",
+		[EM_ZSP] = "ZSP",
+		[EM_MMIX] = "MMIX",
+		[EM_HUANY] = "HUANY",
+		[EM_PRISM] = "Prism",
+		[EM_AVR] = "AVR",
+		[EM_FR30] = "FR30",
+		[EM_D10V] = "D10V",
+		[EM_D30V] = "D30V",
+		[EM_V850] = "V850",
+		[EM_M32R] = "M32R",
+		[EM_MN10300] = "MN10300",
+		[EM_MN10200] = "MN10200",
+		[EM_PJ] = "picoJava",
+		[EM_OPENRISC] = "OpenRISC",
+		[EM_ARC_A5] = "Tangent-A5",
+		[EM_XTENSA] = "Xtensa",
+
+		[EM_VIDEOCORE] = "Videocore",
+		[EM_TMM_GPP] = "TMM_GPP",
+		[EM_NS32K] = "NS32K",
+		[EM_TPC] = "TPC",
+		[EM_SNP1K] = "SNP1K",
+		[EM_ST200] = "ST200",
+		[EM_IP2K] = "IP2K",
+		[EM_MAX] = "MAX",
+		[EM_CR] = "CompactRISC",
+		[EM_F2MC16] = "F2MC16",
+		[EM_MSP430] = "MSP430",
+		[EM_BLACKFIN] = "Blackfin",
+		[EM_SE_C33] = "S1C33",
+		[EM_SEP] = "SEP",
+		[EM_ARCA] = "Arca",
+		[EM_UNICORE] = "Unicore",
+		[EM_EXCESS] = "eXcess",
+		[EM_DXP] = "DXP",
+		[EM_ALTERA_NIOS2] = "Nios 2",
+		[EM_CRX] = "CompactRISC CRX",
+		[EM_XGATE] = "XGATE",
+		[EM_C166] = "C16x/XC16x",
+		[EM_M16C] = "M16C",
+		[EM_DSPIC30F] = "dsPIC30F",
+		[EM_CE] = "CE RISC",
+		[EM_M32C] = "M32C",
+		[EM_TSK3000] = "TSK3000",
+		[EM_RS08] = "RS08",
+		[EM_SHARC] = "SHARC",
+		[EM_ECOG2] = "eCOG2",
+		[EM_SCORE7] = "SCORE7",
+		[EM_DSP24] = "DSP24",
+		[EM_VIDEOCORE3] = "Videocore III",
+		[EM_LATTICEMICO32] = "LATTICEMICO32",
+		[EM_SE_C17] = "SE_C17",
+		[EM_TI_C6000] = "TMS320C6000",
+		[EM_TI_C2000] = "TMS320C2000",
+		[EM_TI_C5500] = "TMS320C55x",
+		[EM_TI_ARP32] = "ASRP32",
+		[EM_TI_PRU] = "TI_PRU",
+		[EM_MMDSP_PLUS] = "MMDSP_PLUS",
+		[EM_CYPRESS_M8C] = "M8C",
+		[EM_R32C] = "R32C",
+		[EM_TRIMEDIA] = "TriMedia",
+		[EM_QDSP6] = "QDSP6",
+		[EM_8051] = "8051",
+		[EM_STXP7X] = "STxP7x",
+		[EM_NDS32] = "NDS32",
+		[EM_ECOG1] = "eCOG1X",
+		[EM_MAXQ30] = "MAXQ30",
+		[EM_XIMO16] = "XIMO16",
+		[EM_MANIK] = "M2000",
+		[EM_CRAYNV2] = "CRAYNV2",
+		[EM_RX] = "RX",
+		[EM_METAG] = "METAG",
+		[EM_MCST_ELBRUS] = "Elbrus",
+		[EM_ECOG16] = "eCOG16",
+		[EM_CR16] = "CR16",
+		[EM_ETPU] = "ETPU",
+		[EM_SLE9X] = "SLE9X",
+		[EM_L10M] = "L10M",
+		[EM_K10M] = "K10M",
+
+		[EM_AARCH64] = "aarch64",
+
+		[EM_AVR32] = "AVR32",
+		[EM_STM8] = "STM8",
+		[EM_TILE64] = "TILE64",
+		[EM_TILEPRO] = "TILEPRO",
+		[EM_MICROBLAZE] = "MicroBlaze",
+		[EM_CUDA] = "CUDA",
+		[EM_TILEGX] = "TILE-Gx",
+		[EM_CLOUDSHIELD] = "CloudShield",
+		[EM_COREA_1ST] = "CORE-A 1st",
+		[EM_COREA_2ND] = "CORE-A 2nd",
+		[EM_ARC_COMPACT2] = "ARCompact V2",
+		[EM_OPEN8] = "Open8",
+		[EM_RL78] = "RL78",
+		[EM_VIDEOCORE5] = "VideoCore V",
+		[EM_78KOR] = "78KOR",
+		[EM_56800EX] = "56800EX",
+		[EM_BA1] = "BA1",
+		[EM_BA2] = "BA2",
+		[EM_XCORE] = "xCORE",
+		[EM_MCHP_PIC] = "MCHP_PIC",
+		[EM_KM32] = "KM32",
+		[EM_KMX32] = "KMX32",
+		[EM_KMX16] = "KMX16",
+		[EM_KMX8] = "KMX8",
+		[EM_KVARC] = "KVARC",
+		[EM_CDP] = "CDP",
+		[EM_COGE] = "COGE",
+		[EM_COOL] = "CoolEngine",
+		[EM_NORC] = "NORC",
+		[EM_CSR_KALIMBA] = "Kalimba",
+		[EM_Z80] = "Zilog Z80",
+		[EM_VISIUM] = "VISIUMcore",
+		[EM_FT32] = "FT32",
+		[EM_MOXIE] = "Moxie",
+		[EM_AMDGPU] = "AMD GPU",
+		[EM_RISCV] = "RISC-V"
 	};
 	/* If new machine is added, refuse to compile until we're updated */
-#if EM_NUM != 95
+#if EM_NUM != 244
 #error "Number of known ELF machine constants has changed"
 #endif
 
diff --git a/usr/src/cmd/flowadm/flowadm.c b/usr/src/cmd/flowadm/flowadm.c
index 058c1e03d8..a1f1c7387e 100644
--- a/usr/src/cmd/flowadm/flowadm.c
+++ b/usr/src/cmd/flowadm/flowadm.c
@@ -236,9 +236,9 @@ usage(void)
 	(void) fprintf(stderr, gettext("usage: flowadm <subcommand>"
 	    " <args>...\n"
 	    "    add-flow       [-t] -l <link> -a <attr>=<value>[,...]\n"
-	    "\t\t   [-p <prop>=<value>,...] <flow>\n"
-	    "    remove-flow    [-t] {-l <link> | <flow>}\n"
-	    "    show-flow      [-p] [-l <link>] "
+	    "\t\t   [-p <prop>=<value>,...] [-z zonename] <flow>\n"
+	    "    remove-flow    [-t] [-z zonename] {-l <link> | <flow>}\n"
+	    "    show-flow      [-p] [-l <link>] [-z zonename] "
 	    "[<flow>]\n\n"
 	    "    set-flowprop   [-t] -p <prop>=<value>[,...] <flow>\n"
 	    "    reset-flowprop [-t] [-p <prop>,...] <flow>\n"
@@ -336,11 +336,12 @@ do_add_flow(int argc, char *argv[])
 	dladm_arg_list_t	*proplist = NULL;
 	dladm_arg_list_t	*attrlist = NULL;
 	dladm_status_t		status;
+	char			*zonename = NULL;
 
 	bzero(propstr, DLADM_STRSIZE);
 	bzero(attrstr, DLADM_STRSIZE);
 
-	while ((option = getopt_long(argc, argv, "tR:l:a:p:",
+	while ((option = getopt_long(argc, argv, "tR:l:a:p:z:",
 	    prop_longopts, NULL)) != -1) {
 		switch (option) {
 		case 't':
@@ -354,9 +355,6 @@ do_add_flow(int argc, char *argv[])
 			    MAXLINKNAMELEN) >= MAXLINKNAMELEN) {
 				die("link name too long");
 			}
-			if (dladm_name2info(handle, devname, &linkid, NULL,
-			    NULL, NULL) != DLADM_STATUS_OK)
-				die("invalid link '%s'", devname);
 			l_arg = B_TRUE;
 			break;
 		case 'a':
@@ -371,6 +369,9 @@ do_add_flow(int argc, char *argv[])
 			    DLADM_STRSIZE)
 				die("property list too long '%s'", propstr);
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option);
 		}
@@ -379,6 +380,10 @@ do_add_flow(int argc, char *argv[])
 		die("link is required");
 	}
 
+	if (dladm_zname2info(handle, zonename, devname, &linkid, NULL,
+	    NULL, NULL) != DLADM_STATUS_OK)
+		die("invalid link '%s'", devname);
+
 	opterr = 0;
 	index = optind;
 
@@ -417,11 +422,12 @@ do_remove_flow(int argc, char *argv[])
 	boolean_t		l_arg = B_FALSE;
 	remove_flow_state_t	state;
 	dladm_status_t		status;
+	char			*zonename = NULL;
 
 	bzero(&state, sizeof (state));
 
 	opterr = 0;
-	while ((option = getopt_long(argc, argv, ":tR:l:",
+	while ((option = getopt_long(argc, argv, ":tR:l:z:",
 	    longopts, NULL)) != -1) {
 		switch (option) {
 		case 't':
@@ -435,12 +441,11 @@ do_remove_flow(int argc, char *argv[])
 			    MAXLINKNAMELEN) >= MAXLINKNAMELEN) {
 				die("link name too long");
 			}
-			if (dladm_name2info(handle, linkname, &linkid, NULL,
-			    NULL, NULL) != DLADM_STATUS_OK) {
-				die("invalid link '%s'", linkname);
-			}
 			l_arg = B_TRUE;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option);
 			break;
@@ -461,6 +466,12 @@ do_remove_flow(int argc, char *argv[])
 		/* if link is specified then flow name should not be there */
 		if (optind == argc-1)
 			usage();
+
+		if (dladm_zname2info(handle, zonename, linkname, &linkid, NULL,
+		    NULL, NULL) != DLADM_STATUS_OK) {
+			die("invalid link '%s'", linkname);
+		}
+
 		/* walk the link to find flows and remove them */
 		state.fs_tempop = t_arg;
 		state.fs_altroot = altroot;
@@ -600,11 +611,12 @@ do_show_flow(int argc, char *argv[])
 	ofmt_handle_t		ofmt;
 	ofmt_status_t		oferr;
 	uint_t			ofmtflags = 0;
+	char			*zonename = NULL;
 
 	bzero(&state, sizeof (state));
 
 	opterr = 0;
-	while ((option = getopt_long(argc, argv, ":pPl:o:",
+	while ((option = getopt_long(argc, argv, ":pPl:o:z:",
 	    longopts, NULL)) != -1) {
 		switch (option) {
 		case 'p':
@@ -625,17 +637,23 @@ do_show_flow(int argc, char *argv[])
 			if (strlcpy(linkname, optarg, MAXLINKNAMELEN)
 			    >= MAXLINKNAMELEN)
 				die("link name too long\n");
-			if (dladm_name2info(handle, linkname, &linkid, NULL,
-			    NULL, NULL) != DLADM_STATUS_OK)
-				die("invalid link '%s'", linkname);
 			l_arg = B_TRUE;
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option);
 			break;
 		}
 	}
 
+	if (l_arg) {
+		if (dladm_zname2info(handle, zonename, linkname, &linkid, NULL,
+		    NULL, NULL) != DLADM_STATUS_OK)
+			die("invalid link '%s'", linkname);
+	}
+
 	/* get flow name (optional last argument */
 	if (optind == (argc-1)) {
 		if (strlcpy(flowname, argv[optind], MAXFLOWNAMELEN)
diff --git a/usr/src/cmd/flowstat/flowstat.c b/usr/src/cmd/flowstat/flowstat.c
index 757fcb5149..ab1797922c 100644
--- a/usr/src/cmd/flowstat/flowstat.c
+++ b/usr/src/cmd/flowstat/flowstat.c
@@ -193,9 +193,9 @@ static char *progname;
 static dladm_handle_t handle = NULL;
 
 const char *usage_ermsg = "flowstat [-r | -t] [-i interval] "
-	    "[-l link] [flow]\n"
+	    "[-l link] [-z zonename] [flow]\n"
 	    "       flowstat [-A] [-i interval] [-p] [ -o field[,...]]\n"
-	    "                [-u R|K|M|G|T|P] [-l link] [flow]\n"
+	    "                [-u R|K|M|G|T|P] [-l link] [-z zonename] [flow]\n"
 	    "       flowstat -h [-a] [-d] [-F format]"
 	    " [-s <DD/MM/YYYY,HH:MM:SS>]\n"
 	    "                [-e <DD/MM/YYYY,HH:MM:SS>] -f <logfile> "
@@ -558,6 +558,7 @@ main(int argc, char *argv[])
 	show_flow_state_t	state;
 	char			*fields_str = NULL;
 	char			*o_fields_str = NULL;
+	char			*zonename = NULL;
 
 	char			*total_stat_fields =
 	    "flow,ipkts,rbytes,ierrs,opkts,obytes,oerrs";
@@ -584,10 +585,11 @@ main(int argc, char *argv[])
 	if ((status = dladm_open(&handle)) != DLADM_STATUS_OK)
 		die_dlerr(status, "could not open /dev/dld");
 
+	linkname[0] = '\0';
 	bzero(&state, sizeof (state));
 
 	opterr = 0;
-	while ((option = getopt_long(argc, argv, ":rtApi:o:u:l:h",
+	while ((option = getopt_long(argc, argv, ":rtApi:o:u:l:hz:",
 	    NULL, NULL)) != -1) {
 		switch (option) {
 		case 'r':
@@ -639,9 +641,6 @@ main(int argc, char *argv[])
 			if (strlcpy(linkname, optarg, MAXLINKNAMELEN)
 			    >= MAXLINKNAMELEN)
 				die("link name too long\n");
-			if (dladm_name2info(handle, linkname, &linkid, NULL,
-			    NULL, NULL) != DLADM_STATUS_OK)
-				die("invalid link '%s'", linkname);
 			break;
 		case 'h':
 			if (r_arg || t_arg || p_arg || o_arg || u_arg ||
@@ -652,6 +651,9 @@ main(int argc, char *argv[])
 			do_show_history(argc, argv);
 			return (0);
 			break;
+		case 'z':
+			zonename = optarg;
+			break;
 		default:
 			die_opterr(optopt, option, usage_ermsg);
 			break;
@@ -675,6 +677,12 @@ main(int argc, char *argv[])
 		die("the option -A is not compatible with "
 		    "-r, -t, -p, -o, -u, -i");
 
+	if (linkname[0] != '\0') {
+		if (dladm_zname2info(handle, zonename, linkname, &linkid, NULL,
+		    NULL, NULL) != DLADM_STATUS_OK)
+			die("invalid link '%s'", linkname);
+	}
+
 	/* get flow name (optional last argument) */
 	if (optind == (argc-1)) {
 		if (strlcpy(flowname, argv[optind], MAXFLOWNAMELEN)
diff --git a/usr/src/cmd/fm/fmdump/common/nvlrender.c b/usr/src/cmd/fm/fmdump/common/nvlrender.c
index 2c2f5ca662..99f027a77d 100644
--- a/usr/src/cmd/fm/fmdump/common/nvlrender.c
+++ b/usr/src/cmd/fm/fmdump/common/nvlrender.c
@@ -83,7 +83,7 @@ fmdump_render_nvlist(nvlist_prtctl_t pctl, void *private, nvlist_t *nvl,
 int
 fmdump_print_json(fmd_log_t *lp, const fmd_log_record_t *rp, FILE *fp)
 {
-	if (nvlist_print_json(fp, rp->rec_nvl) != 0 || fprintf(fp, "\n") < 0 ||
+	if (nvlist_print_json(fp, rp->rec_nvl) < 0 || fprintf(fp, "\n") < 0 ||
 	    fflush(fp) != 0)
 		return (-1);
 
diff --git a/usr/src/cmd/fs.d/Makefile b/usr/src/cmd/fs.d/Makefile
index 2f5bd31ec7..8f8d752a94 100644
--- a/usr/src/cmd/fs.d/Makefile
+++ b/usr/src/cmd/fs.d/Makefile
@@ -19,6 +19,7 @@
 # CDDL HEADER END
 #
 # Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2012, Joyent, Inc. All rights reserved.
 # Copyright 2015 Nexenta Systems, Inc. All rights reserved.
 #
 
@@ -39,8 +40,8 @@ DEFAULTFILES=	fs.dfl
 
 include ../Makefile.cmd
 
-SUBDIR1= bootfs lofs zfs
-SUBDIR2= dev fd pcfs nfs hsfs proc ctfs udfs ufs tmpfs \
+SUBDIR1= bootfs hyprlofs lofs zfs
+SUBDIR2= dev fd pcfs nfs hsfs lxproc proc ctfs udfs ufs tmpfs \
 		autofs mntfs objfs sharefs smbclnt reparsed
 SUBDIRS= $(SUBDIR1) $(SUBDIR2)
 I18NDIRS= $(SUBDIR2)
diff --git a/usr/src/cmd/fs.d/hyprlofs/Makefile b/usr/src/cmd/fs.d/hyprlofs/Makefile
new file mode 100644
index 0000000000..1a3aaf18d3
--- /dev/null
+++ b/usr/src/cmd/fs.d/hyprlofs/Makefile
@@ -0,0 +1,42 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2012, Joyent, Inc. All rights reserved
+#
+
+SUBDIRS=	hlcfg mount
+
+all:=		TARGET= all
+install:=	TARGET= install
+clean:=		TARGET= clean
+clobber:=	TARGET= clobber
+lint:=		TARGET= lint
+
+.KEEP_STATE:
+
+.PARALLEL:	$(SUBDIRS)
+
+all install clean clobber lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/cmd/fs.d/hyprlofs/hlcfg/Makefile b/usr/src/cmd/fs.d/hyprlofs/hlcfg/Makefile
new file mode 100644
index 0000000000..d2ae22e9fd
--- /dev/null
+++ b/usr/src/cmd/fs.d/hyprlofs/hlcfg/Makefile
@@ -0,0 +1,30 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright 2012, Joyent, Inc.  All rights reserved.
+#
+
+FSTYPE=		hyprlofs
+LIBPROG=	hlcfg
+
+include		../../Makefile.fstype
+include		../../Makefile.mount
+include		../../Makefile.mount.targ
diff --git a/usr/src/cmd/fs.d/hyprlofs/hlcfg/hlcfg.c b/usr/src/cmd/fs.d/hyprlofs/hlcfg/hlcfg.c
new file mode 100644
index 0000000000..16e8e32b1c
--- /dev/null
+++ b/usr/src/cmd/fs.d/hyprlofs/hlcfg/hlcfg.c
@@ -0,0 +1,244 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2012, Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * This is a simple test program to exercise the hyprlofs ioctls.  This is
+ * not designed as a full featured CLI and only does minimal error checking
+ * and reporting.
+ */
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <strings.h>
+#include <sys/errno.h>
+#include <sys/fs/hyprlofs.h>
+
+extern int errno;
+
+char *usage =	"usage: <fs path> add [<file name> <alias>]+\n"
+		"       <fs path> addl [<file name>]+\n"
+		"       <fs path> rm [<alias>]+\n"
+		"       <fs path> clear"
+		"       <fs path> get";
+
+typedef enum {
+	CMD_ADD,
+	CMD_RM,
+	CMD_CLR,
+	CMD_ADDL,
+	CMD_GET
+} cmd_t;
+
+static int
+get_entries(int fd)
+{
+	int err;
+	int i;
+	hyprlofs_curr_entries_t e;
+	hyprlofs_curr_entry_t *ep;
+
+	e.hce_cnt = 0;
+	e.hce_entries = NULL;
+
+	err = ioctl(fd, HYPRLOFS_GET_ENTRIES, &e);
+	if (err != 0 && errno != E2BIG) {
+		perror("ioctl");
+		return (1);
+	}
+
+	if (err == 0) {
+		(void) printf("success, but no entries\n");
+		return (0);
+	}
+
+	/*
+	 * E2BIG is what we expect when there are existing mappings
+	 * since the current cnt is still returned in that case.
+	 */
+	(void) printf("cnt: %d\n", e.hce_cnt);
+
+	/* alloc array and call again, then print array */
+	if ((ep = (hyprlofs_curr_entry_t *)
+	    malloc(sizeof (hyprlofs_curr_entry_t) * e.hce_cnt)) == NULL) {
+		(void) fprintf(stderr, "out of memory\n");
+		exit(1);
+	}
+
+	e.hce_entries = ep;
+	errno = 0;
+	if (ioctl(fd, HYPRLOFS_GET_ENTRIES, &e) != 0) {
+		/*
+		 * Not handling an increase here. We would need to free and
+		 * start over to do that, but ok for a test program.
+		 */
+		perror("ioctl");
+		free(ep);
+		return (1);
+	}
+	for (i = 0; i < e.hce_cnt; i++)
+		(void) printf("%s %s\n", ep[i].hce_path, ep[i].hce_name);
+
+	free(ep);
+	return (0);
+}
+
+int
+main(int argc, char **argv)
+{
+	int i, ap;
+	cmd_t cmd;
+	int cnt = 0;
+	int fd;
+	int rv = 0;
+	hyprlofs_entry_t *e = NULL;
+	hyprlofs_entries_t ents;
+
+	if (argc < 3) {
+		(void) fprintf(stderr, "%s\n", usage);
+		exit(1);
+	}
+
+	if ((fd = open(argv[1], O_RDONLY)) < 0) {
+		perror("can't open hyprlofs mount");
+		exit(1);
+	}
+
+	if (strcmp(argv[2], "add") == 0) {
+		cmd = CMD_ADD;
+	} else if (strcmp(argv[2], "rm") == 0) {
+		cmd = CMD_RM;
+	} else if (strcmp(argv[2], "clear") == 0) {
+		cmd = CMD_CLR;
+	} else if (strcmp(argv[2], "addl") == 0) {
+		cmd = CMD_ADDL;
+	} else if (strcmp(argv[2], "get") == 0) {
+		cmd = CMD_GET;
+	} else {
+		(void) fprintf(stderr, "%s\n", usage);
+		exit(1);
+	}
+
+	/* Count up the number of parameters. The arg format varies w/ cmd */
+	switch (cmd) {
+	case CMD_ADD:
+		for (i = 3; i < argc; i++) {
+			/* argv[i] is the file path */
+
+			/* The next arg is the alias */
+			if (++i >= argc) {
+				(void) fprintf(stderr, "missing alias for %s\n",
+				    argv[i - 1]);
+				exit(1);
+			}
+
+			cnt++;
+		}
+		break;
+	case CMD_ADDL:
+		cnt = argc - 3;
+		break;
+	case CMD_RM:
+		cnt = argc - 3;
+		break;
+	case CMD_CLR:	/*FALLTHRU*/
+	case CMD_GET:
+		if (argc > 3) {
+			(void) fprintf(stderr, "%s\n", usage);
+			exit(1);
+		}
+		break;
+	}
+
+	if (cnt > 0) {
+		if ((e = (hyprlofs_entry_t *)malloc(sizeof (hyprlofs_entry_t) *
+		    cnt)) == NULL) {
+			(void) fprintf(stderr, "out of memory\n");
+			exit(1);
+		}
+	}
+
+	/*
+	 * Format up the args.
+	 * We only setup the path member for the add cmd.
+	 * We won't run this loop for the clear cmd.
+	 * The addl command is special since we use basename to get the alias.
+	 */
+	for (i = 0, ap = 3; i < cnt; i++, ap++) {
+		if (cmd == CMD_ADDL) {
+			e[i].hle_path = argv[ap];
+			e[i].hle_plen = strlen(e[i].hle_path);
+
+			e[i].hle_name = basename(argv[ap]);
+			e[i].hle_nlen = strlen(e[i].hle_name);
+
+			continue;
+		}
+
+		if (cmd == CMD_ADD) {
+			e[i].hle_path = argv[ap++];
+			e[i].hle_plen = strlen(e[i].hle_path);
+		}
+
+		e[i].hle_name = argv[ap];
+		e[i].hle_nlen = strlen(e[i].hle_name);
+	}
+
+	ents.hle_entries = e;
+	ents.hle_len = cnt;
+
+	switch (cmd) {
+	case CMD_ADD:	/*FALLTHRU*/
+	case CMD_ADDL:
+		if (ioctl(fd, HYPRLOFS_ADD_ENTRIES, &ents) < 0)  {
+			perror("ioctl");
+			rv = 1;
+		}
+		break;
+	case CMD_RM:
+		if (ioctl(fd, HYPRLOFS_RM_ENTRIES, &ents) < 0)  {
+			perror("ioctl");
+			rv = 1;
+		}
+		break;
+	case CMD_CLR:
+		if (ioctl(fd, HYPRLOFS_RM_ALL) < 0)  {
+			perror("ioctl");
+			rv = 1;
+		}
+		break;
+	case CMD_GET:
+		rv = get_entries(fd);
+		break;
+	}
+
+	(void) close(fd);
+	if (cnt > 0)
+		free(e);
+	return (rv);
+}
diff --git a/usr/src/cmd/fs.d/hyprlofs/mount/Makefile b/usr/src/cmd/fs.d/hyprlofs/mount/Makefile
new file mode 100644
index 0000000000..a0b63d211c
--- /dev/null
+++ b/usr/src/cmd/fs.d/hyprlofs/mount/Makefile
@@ -0,0 +1,31 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2012 Joyent, Inc.  All rights reserved.
+#
+
+FSTYPE=		hyprlofs
+LIBPROG=	mount
+
+include		../../Makefile.fstype
+include		../../Makefile.mount
+include		../../Makefile.mount.targ
diff --git a/usr/src/cmd/fs.d/hyprlofs/mount/mount.c b/usr/src/cmd/fs.d/hyprlofs/mount/mount.c
new file mode 100644
index 0000000000..a95c9ca3c2
--- /dev/null
+++ b/usr/src/cmd/fs.d/hyprlofs/mount/mount.c
@@ -0,0 +1,148 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2012 Joyent, Inc.  All rights reserved.
+ */
+
+#define	HLFS
+#define	MNTTYPE_HYFS "hyprlofs"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <libintl.h>
+#include <errno.h>
+#include <sys/fstyp.h>
+#include <sys/fsid.h>
+#include <sys/mntent.h>
+#include <sys/mnttab.h>
+#include <sys/mount.h>
+#include <sys/signal.h>
+#include <sys/stat.h>
+#include <fslib.h>
+
+#define	RET_OK		0
+/*
+ * /sbin/mount and the fs-local method understand this exit code to
+ * mean that all the mount failures were related to hyprlofs mounts. Since
+ * this program only attempts to mount hyfs file systems, when it fails
+ * it returns this exit status.
+ */
+#define	RET_ERR		111
+
+static void usage(void);
+
+static char  optbuf[MAX_MNTOPT_STR] = { '\0', };
+static int   optsize = 0;
+
+static char fstype[] = MNTTYPE_HYFS;
+
+/*
+ * usage: mount [-Ormq] [-o options] special mountp
+ *
+ * This mount program is exec'ed by /usr/sbin/mount if '-F hyprlofs' is
+ * specified.
+ */
+int
+main(int argc, char *argv[])
+{
+	int c;
+	char *special;		/* Entity being mounted */
+	char *mountp;		/* Entity being mounted on */
+	char *savedoptbuf;
+	char *myname;
+	char typename[64];
+	int flags = 0;
+	int errflag = 0;
+	int qflg = 0;
+
+	myname = strrchr(argv[0], '/');
+	myname = myname ? myname+1 : argv[0];
+	(void) snprintf(typename, sizeof (typename), "%s %s", fstype, myname);
+	argv[0] = typename;
+
+	while ((c = getopt(argc, argv, "o:rmOq")) != EOF) {
+		switch (c) {
+		case '?':
+			errflag++;
+			break;
+
+		case 'o':
+			if (strlcpy(optbuf, optarg, sizeof (optbuf)) >=
+			    sizeof (optbuf)) {
+				(void) fprintf(stderr,
+				    gettext("%s: Invalid argument: %s\n"),
+				    myname, optarg);
+				return (2);
+			}
+			optsize = strlen(optbuf);
+			break;
+		case 'O':
+			flags |= MS_OVERLAY;
+			break;
+		case 'r':
+			flags |= MS_RDONLY;
+			break;
+
+		case 'm':
+			flags |= MS_NOMNTTAB;
+			break;
+
+		case 'q':
+			qflg = 1;
+			break;
+
+		default:
+			usage();
+		}
+	}
+	if ((argc - optind != 2) || errflag) {
+		usage();
+	}
+	special = argv[argc - 2];
+	mountp = argv[argc - 1];
+
+	if ((savedoptbuf = strdup(optbuf)) == NULL) {
+		(void) fprintf(stderr, gettext("%s: out of memory\n"),
+		    myname);
+		exit(2);
+	}
+	if (mount(special, mountp, flags | MS_OPTIONSTR, fstype, NULL, 0,
+	    optbuf, MAX_MNTOPT_STR)) {
+		(void) fprintf(stderr, "mount: ");
+		perror(special);
+		exit(RET_ERR);
+	}
+	if (optsize && !qflg)
+		cmp_requested_to_actual_options(savedoptbuf, optbuf,
+		    special, mountp);
+	return (0);
+}
+
+void
+usage(void)
+{
+	(void) fprintf(stderr,
+	    "Usage: mount [-Ormq] [-o options] special mountpoint\n");
+	exit(RET_ERR);
+}
diff --git a/usr/src/cmd/fs.d/lxproc/Makefile b/usr/src/cmd/fs.d/lxproc/Makefile
new file mode 100644
index 0000000000..77075ef1dd
--- /dev/null
+++ b/usr/src/cmd/fs.d/lxproc/Makefile
@@ -0,0 +1,32 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+FSTYPE=		lxproc
+LIBPROG=	mount
+
+include		../Makefile.fstype
+include		../Makefile.mount
+include		../Makefile.mount.targ
diff --git a/usr/src/cmd/fs.d/lxproc/mount.c b/usr/src/cmd/fs.d/lxproc/mount.c
new file mode 100644
index 0000000000..5a000997bd
--- /dev/null
+++ b/usr/src/cmd/fs.d/lxproc/mount.c
@@ -0,0 +1,140 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2012 Joyent, Inc.  All rights reserved.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <libintl.h>
+#include <errno.h>
+#include <sys/fstyp.h>
+#include <sys/fsid.h>
+#include <sys/mntent.h>
+#include <sys/mnttab.h>
+#include <sys/mount.h>
+#include <sys/signal.h>
+#include <sys/stat.h>
+#include <fslib.h>
+
+#define	RET_OK		0
+#define	RET_ERR		33
+
+static void usage(void);
+
+static char  optbuf[MAX_MNTOPT_STR] = { '\0', };
+static int   optsize = 0;
+
+static char fstype[] = "lxproc";
+
+/*
+ * usage: mount [-Ormq] [-o options] special mountp
+ *
+ * This mount program is exec'ed by /usr/sbin/mount if '-F lxproc' is
+ * specified.
+ */
+int
+main(int argc, char *argv[])
+{
+	int c;
+	char *special;		/* Entity being mounted */
+	char *mountp;		/* Entity being mounted on */
+	char *savedoptbuf;
+	char *myname;
+	char typename[64];
+	int flags = 0;
+	int errflag = 0;
+	int qflg = 0;
+
+	myname = strrchr(argv[0], '/');
+	myname = myname ? myname+1 : argv[0];
+	(void) snprintf(typename, sizeof (typename), "%s %s", fstype, myname);
+	argv[0] = typename;
+
+	while ((c = getopt(argc, argv, "o:rmOq")) != EOF) {
+		switch (c) {
+		case '?':
+			errflag++;
+			break;
+
+		case 'o':
+			if (strlcpy(optbuf, optarg, sizeof (optbuf)) >=
+			    sizeof (optbuf)) {
+				(void) fprintf(stderr,
+				    gettext("%s: Invalid argument: %s\n"),
+				    myname, optarg);
+				return (2);
+			}
+			optsize = strlen(optbuf);
+			break;
+		case 'O':
+			flags |= MS_OVERLAY;
+			break;
+		case 'r':
+			flags |= MS_RDONLY;
+			break;
+
+		case 'm':
+			flags |= MS_NOMNTTAB;
+			break;
+
+		case 'q':
+			qflg = 1;
+			break;
+
+		default:
+			usage();
+		}
+	}
+	if ((argc - optind != 2) || errflag) {
+		usage();
+	}
+	special = argv[argc - 2];
+	mountp = argv[argc - 1];
+
+	if ((savedoptbuf = strdup(optbuf)) == NULL) {
+		(void) fprintf(stderr, gettext("%s: out of memory\n"),
+		    myname);
+		exit(2);
+	}
+	if (mount(special, mountp, flags | MS_OPTIONSTR, fstype, NULL, 0,
+	    optbuf, MAX_MNTOPT_STR)) {
+		(void) fprintf(stderr, "mount: ");
+		perror(special);
+		exit(RET_ERR);
+	}
+	if (optsize && !qflg)
+		cmp_requested_to_actual_options(savedoptbuf, optbuf,
+		    special, mountp);
+	return (0);
+}
+
+void
+usage(void)
+{
+	(void) fprintf(stderr,
+	    "Usage: mount [-Ormq] [-o options] special mountpoint\n");
+	exit(RET_ERR);
+}
diff --git a/usr/src/cmd/fs.d/mount.c b/usr/src/cmd/fs.d/mount.c
index 947767f5db..c048d0f2fd 100644
--- a/usr/src/cmd/fs.d/mount.c
+++ b/usr/src/cmd/fs.d/mount.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -55,6 +56,7 @@
 #include	<stropts.h>
 #include	<sys/conf.h>
 #include	<locale.h>
+#include	<zone.h>
 #include	"fslib.h"
 
 #define	VFS_PATH	"/usr/lib/fs"
@@ -801,6 +803,7 @@ mnterror(int flag)
 void
 doexec(char *fstype, char *newargv[])
 {
+	const char *zroot = zone_get_nroot();
 	char	full_path[PATH_MAX];
 	char	alter_path[PATH_MAX];
 	char	*vfs_path = VFS_PATH;
@@ -808,7 +811,8 @@ doexec(char *fstype, char *newargv[])
 	int	i;
 
 	/* build the full pathname of the fstype dependent command. */
-	sprintf(full_path, "%s/%s/%s", vfs_path, fstype, myname);
+	(void) snprintf(full_path, sizeof (full_path), "%s/%s/%s/%s",
+	    (zroot != NULL ? zroot : ""), vfs_path, fstype, myname);
 	sprintf(alter_path, "%s/%s/%s", alt_path, fstype, myname);
 	newargv[1] = myname;
 
diff --git a/usr/src/cmd/fs.d/nfs/lib/nfs_sec.c b/usr/src/cmd/fs.d/nfs/lib/nfs_sec.c
index 06dc44a12c..af83923825 100644
--- a/usr/src/cmd/fs.d/nfs/lib/nfs_sec.c
+++ b/usr/src/cmd/fs.d/nfs/lib/nfs_sec.c
@@ -45,6 +45,7 @@
 #include <stdlib.h>
 #include <syslog.h>
 #include <synch.h>
+#include <zone.h>
 #include <rpc/rpc.h>
 #include <nfs/nfs_sec.h>
 #include <rpc/rpcsec_gss.h>
@@ -707,12 +708,17 @@ get_seconfig(int whichway, char *name, int num,
 {
 	char	line[BUFSIZ];	/* holds each line of NFSSEC_CONF */
 	FILE	*fp;		/* file stream for NFSSEC_CONF */
+	char	nfssec_conf[MAXPATHLEN];
+	const char *zroot = zone_get_nroot();
 
 	if ((whichway == GETBYNAME) && (name == NULL))
 		return (SC_NOTFOUND);
 
+	(void) snprintf(nfssec_conf, sizeof (nfssec_conf), "%s%s", zroot != NULL ?
+	    zroot : "", NFSSEC_CONF);
+
 	(void) mutex_lock(&matching_lock);
-	if ((fp = fopen(NFSSEC_CONF, "r")) == NULL) {
+	if ((fp = fopen(nfssec_conf, "r")) == NULL) {
 		(void) mutex_unlock(&matching_lock);
 		return (SC_OPENFAIL);
 	}
diff --git a/usr/src/cmd/fs.d/nfs/lib/smfcfg.c b/usr/src/cmd/fs.d/nfs/lib/smfcfg.c
index 892f0cd052..4f9399143c 100644
--- a/usr/src/cmd/fs.d/nfs/lib/smfcfg.c
+++ b/usr/src/cmd/fs.d/nfs/lib/smfcfg.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  */
 
 #include <stdio.h>
@@ -344,8 +345,23 @@ fs_smf_get_prop(smf_fstype_t fstype, char *prop_name, char *cbuf,
 	} else {
 		ret = scf_error();
 	}
-	if ((ret != 0) && scf_error() != SCF_ERROR_NONE)
-		fprintf(stdout, gettext("%s\n"), scf_strerror(ret));
+	if ((ret != 0) && scf_error() != SCF_ERROR_NONE) {
+		/*
+		 * This is a workaround for the NFS service manifests not
+		 * containing the proper properties in local zones.
+		 *
+		 * When in a local zone and the property doesn't exist on an NFS
+		 * service (most likely nfs/server or nfs/client), don't print
+		 * the error.  The caller will still see the correct error code,
+		 * but a user creating a delegated dataset or mounting an NFS
+		 * share won't see this spurious error.
+		 */
+		if (getzoneid() == GLOBAL_ZONEID ||
+		    scf_error() != SCF_ERROR_NOT_FOUND) {
+			fprintf(stdout, gettext("%s\n"), scf_strerror(ret));
+		}
+	}
+
 out:
 	fs_smf_fini(phandle);
 	return (ret);
diff --git a/usr/src/cmd/fs.d/nfs/lib/smfcfg.h b/usr/src/cmd/fs.d/nfs/lib/smfcfg.h
index c06327d801..f0b70907aa 100644
--- a/usr/src/cmd/fs.d/nfs/lib/smfcfg.h
+++ b/usr/src/cmd/fs.d/nfs/lib/smfcfg.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  */
 
 #ifndef	_SMFCFG_H
@@ -42,6 +43,7 @@
 #include <locale.h>
 #include <errno.h>
 #include <sys/types.h>
+#include <zone.h>
 
 #ifdef	__cplusplus
 extern	"C" {
diff --git a/usr/src/cmd/fs.d/nfs/lockd/lockd.c b/usr/src/cmd/fs.d/nfs/lockd/lockd.c
index 3541ee13d0..6ea338b01a 100644
--- a/usr/src/cmd/fs.d/nfs/lockd/lockd.c
+++ b/usr/src/cmd/fs.d/nfs/lockd/lockd.c
@@ -23,6 +23,7 @@
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T		*/
@@ -88,7 +89,7 @@
 struct lm_svc_args lmargs = {
 	.version = LM_SVC_CUR_VERS,
 	/* fd, n_fmly, n_proto, n_rdev (below) */
-	.debug = 0,
+	.n_v4_only = 0,
 	.timout = 5 * 60,
 	.grace = 90,
 	.retransmittimeout = 5
@@ -137,6 +138,8 @@ int	(*Mysvc)(int, struct netbuf, struct netconfig *) = nlmsvc;
 				/* used by cots_listen_event() */
 int	max_conns_allowed = -1;	/* used by cots_listen_event() */
 
+int	debug = 0;
+
 int
 main(int ac, char *av[])
 {
@@ -238,7 +241,7 @@ main(int ac, char *av[])
 			break;
 
 		case 'd': /* debug */
-			lmargs.debug = atoi(optarg);
+			debug = atoi(optarg);
 			break;
 
 		case 'g': /* grace_period */
@@ -288,12 +291,12 @@ main(int ac, char *av[])
 	if (optind != ac)
 		usage();
 
-	if (lmargs.debug) {
+	if (debug != 0) {
 		printf("%s: debug= %d, conn_idle_timout= %d,"
 		    " grace_period= %d, listen_backlog= %d,"
 		    " max_connections= %d, max_servers= %d,"
 		    " retrans_timeout= %d\n",
-		    MyName, lmargs.debug, lmargs.timout,
+		    MyName, debug, lmargs.timout,
 		    lmargs.grace, listen_backlog,
 		    max_conns_allowed, max_servers,
 		    lmargs.retransmittimeout);
@@ -309,7 +312,7 @@ main(int ac, char *av[])
 	}
 
 	/* Daemonize, if not debug. */
-	if (lmargs.debug == 0)
+	if (debug == 0)
 		pipe_fd = daemonize_init();
 
 	openlog(MyName, LOG_PID | LOG_NDELAY, LOG_DAEMON);
@@ -405,7 +408,7 @@ main(int ac, char *av[])
 	/*
 	 * lockd is up and running as far as we are concerned.
 	 */
-	if (lmargs.debug == 0)
+	if (debug == 0)
 		daemonize_fini(pipe_fd);
 
 	/*
diff --git a/usr/src/cmd/fs.d/nfs/mount/Makefile b/usr/src/cmd/fs.d/nfs/mount/Makefile
index 05cdc4f6da..e9e55aac78 100644
--- a/usr/src/cmd/fs.d/nfs/mount/Makefile
+++ b/usr/src/cmd/fs.d/nfs/mount/Makefile
@@ -25,13 +25,6 @@
 
 FSTYPE=		nfs
 LIBPROG=	mount
-ROOTFS_PROG=	$(LIBPROG)
-
-# duplicate ROOTLIBFSTYPE value needed for installation rule
-# we must define this before including Makefile.fstype
-ROOTLIBFSTYPE = $(ROOT)/usr/lib/fs/$(FSTYPE)
-$(ROOTLIBFSTYPE)/%:	$(ROOTLIBFSTYPE) %
-	$(RM) $@; $(SYMLINK) ../../../../etc/fs/$(FSTYPE)/$(LIBPROG) $@
 
 include		../../Makefile.fstype
 
@@ -66,7 +59,7 @@ CLOBBERFILES	+= $(LIBPROG)
 
 .KEEP_STATE:
 
-all:	$(ROOTFS_PROG)
+all:	$(LIBPROG)
 
 $(LIBPROG):	webnfs.h $(OBJS)
 		$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
@@ -115,7 +108,9 @@ $(POFILE): $(SRCS) webnfs.h
 	sed "/^domain/d"        messages.po     > $@
 	$(RM) $(POFILE).i messages.po
 
-install:	$(ROOTETCPROG)
+install: all $(FSTYPEPROG)
+	$(RM) $(ROOTETCPROG)
+	$(SYMLINK) ../../../usr/lib/fs/$(FSTYPE)/$(LIBPROG) $(ROOTETCPROG)
 
 lint:	webnfs.h webnfs_xdr.c webnfs_client.c lint_SRCS
 
diff --git a/usr/src/cmd/fs.d/nfs/mount/mount.c b/usr/src/cmd/fs.d/nfs/mount/mount.c
index efb1f998f3..e1206e186a 100644
--- a/usr/src/cmd/fs.d/nfs/mount/mount.c
+++ b/usr/src/cmd/fs.d/nfs/mount/mount.c
@@ -2104,7 +2104,7 @@ get_fh(struct nfs_args *args, char *fshost, char *fspath, int *versp,
 	}
 
 	while ((cl = clnt_create_vers(fshost, MOUNTPROG, &outvers,
-	    vers_min, vers_to_try, "datagram_v")) == NULL) {
+	    vers_min, vers_to_try, NULL)) == NULL) {
 		if (rpc_createerr.cf_stat == RPC_UNKNOWNHOST) {
 			pr_err(gettext("%s: %s\n"), fshost,
 			    clnt_spcreateerror(""));
diff --git a/usr/src/cmd/fs.d/nfs/mountd/mountd.c b/usr/src/cmd/fs.d/nfs/mountd/mountd.c
index 4ccc82f4a0..ed69c98daf 100644
--- a/usr/src/cmd/fs.d/nfs/mountd/mountd.c
+++ b/usr/src/cmd/fs.d/nfs/mountd/mountd.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2012 Joyent, Inc. All rights reserved.
  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
  */
@@ -487,6 +488,13 @@ main(int argc, char *argv[])
 		exit(1);
 	}
 
+	/* Mountd cannot run in a non-global zone. */
+	if (getzoneid() != GLOBAL_ZONEID) {
+		(void) fprintf(stderr, "%s: can only run in the global zone\n",
+		    argv[0]);
+		exit(1);
+	}
+
 	if (getrlimit(RLIMIT_NOFILE, &rl) != 0) {
 		syslog(LOG_ERR, "getrlimit failed");
 	} else {
diff --git a/usr/src/cmd/fs.d/nfs/nfsd/nfsd.c b/usr/src/cmd/fs.d/nfs/nfsd/nfsd.c
index 5c953fa833..2177b86eca 100644
--- a/usr/src/cmd/fs.d/nfs/nfsd/nfsd.c
+++ b/usr/src/cmd/fs.d/nfs/nfsd/nfsd.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T		*/
@@ -176,6 +177,13 @@ main(int ac, char *av[])
 		exit(1);
 	}
 
+	/* Nfsd cannot run in a non-global zone. */
+	if (getzoneid() != GLOBAL_ZONEID) {
+		(void) fprintf(stderr, "%s: can only run in the global zone\n",
+		    av[0]);
+		exit(1);
+	}
+
 	(void) enable_extended_FILE_stdio(-1, -1);
 
 	/*
diff --git a/usr/src/cmd/fs.d/nfs/svc/nfs-server b/usr/src/cmd/fs.d/nfs/svc/nfs-server
index 11a54fea8a..5c8c1a67dd 100644
--- a/usr/src/cmd/fs.d/nfs/svc/nfs-server
+++ b/usr/src/cmd/fs.d/nfs/svc/nfs-server
@@ -53,13 +53,13 @@ configure_ipfilter()
 
         #
 	# Nothing to do if:
+	# - service's policy is 'use_global'
         # - ipfilter isn't online 
 	# - global policy is 'custom'
-	# - service's policy is 'use_global'
         #
+	[ "`get_policy $SMF_FMRI`" = "use_global" ] && return 0
         service_check_state $IPF_FMRI $SMF_ONLINE || return 0
         [ "`get_global_def_policy`" = "custom" ] && return 0
-	[ "`get_policy $SMF_FMRI`" = "use_global" ] && return 0
 
 	svcadm restart $IPF_FMRI
 }
diff --git a/usr/src/cmd/fs.d/nfs/umount/umount.c b/usr/src/cmd/fs.d/nfs/umount/umount.c
index aabdc8a592..66d280bcdb 100644
--- a/usr/src/cmd/fs.d/nfs/umount/umount.c
+++ b/usr/src/cmd/fs.d/nfs/umount/umount.c
@@ -297,7 +297,7 @@ retry:
 		 */
 		timep = (quick ? &create_timeout : NULL);
 		cl = clnt_create_timed(list[i].host, MOUNTPROG, vers,
-		    "datagram_n", timep);
+		    NULL, timep);
 		/*
 		 * Do not print any error messages in case of forced
 		 * unmount.
diff --git a/usr/src/cmd/fwflash/Makefile.com b/usr/src/cmd/fwflash/Makefile.com
index 5f0873b244..59e2bcdb36 100644
--- a/usr/src/cmd/fwflash/Makefile.com
+++ b/usr/src/cmd/fwflash/Makefile.com
@@ -26,8 +26,6 @@
 #
 # common rules for $SRC/cmd/fwflash
 
-CLOSED=			$(SRC)/../closed
-
 CERRWARN +=		-_gcc=-Wno-parentheses
 CERRWARN +=		-_gcc=-Wno-uninitialized
 CERRWARN +=		-_gcc=-Wno-address
diff --git a/usr/src/cmd/fwflash/Makefile.targ b/usr/src/cmd/fwflash/Makefile.targ
index b0da734aff..57efebf6ac 100644
--- a/usr/src/cmd/fwflash/Makefile.targ
+++ b/usr/src/cmd/fwflash/Makefile.targ
@@ -28,6 +28,7 @@
 
 include $(SRC)/Makefile.master
 include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/cmd/Makefile.ctf
 
 SRCS=		fwflash.c
 HDRS=		fwflash.h
@@ -56,7 +57,7 @@ CFLAGS += -D_POSIX_PTHREAD_SEMANTICS
 LDLIBS += -ldevinfo -lumem -lscf
 
 
-$(ROOTUSRINCLDFWFLASH)/%:  $(HDRDIR)/% 
+$(ROOTUSRINCLDFWFLASH)/%:  $(HDRDIR)/%
 	$(INS.file)
 
 
@@ -66,11 +67,12 @@ $(PROG): install_h $(OBJS)
 
 %.o: $(SRCDIR)/%.c
 	$(COMPILE.c) $(CFLAGS) -o $@ $<
+	$(CTFCONVERT_O)
 
 
 all:	$(PROG)
 
-clean: 
+clean:
 	$(RM) $(POFILE) $(POFILES) $(LINTFILE) $(PROG)
 
 clobber: clean
diff --git a/usr/src/cmd/fwflash/plugins/Makefile.targ b/usr/src/cmd/fwflash/plugins/Makefile.targ
index 8650ee545b..8edeaccd66 100644
--- a/usr/src/cmd/fwflash/plugins/Makefile.targ
+++ b/usr/src/cmd/fwflash/plugins/Makefile.targ
@@ -61,6 +61,9 @@ $(SD-GENERIC_LIB):= SONAME = $(SD-GENERIC_LIB)
 $(HERMON-MELLANOX_LIB):= DYNFLAGS += -R/usr/lib/fwflash/identify 
 $(HERMON-MELLANOX_LIB):= LDLIBS += -L. $(ROOT)/usr/lib/fwflash/identify/hermon.so
 
+$(SD-GENERIC_LIB):= LDLIBS += -L$(ROOT)/usr/lib/scsi -lscsi
+$(SD-GENERIC_LIB):= DYNFLAGS += -R/usr/lib/scsi
+
 
 .KEEP STATE:
 
diff --git a/usr/src/cmd/fwflash/plugins/transport/common/sd.c b/usr/src/cmd/fwflash/plugins/transport/common/sd.c
index 46faad0877..6dcff9d0f1 100644
--- a/usr/src/cmd/fwflash/plugins/transport/common/sd.c
+++ b/usr/src/cmd/fwflash/plugins/transport/common/sd.c
@@ -18,14 +18,18 @@
  *
  * CDDL HEADER END
  */
+
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
  * sd / ssd (SCSI Direct-attached Device) specific functions.
  */
+
 #include <libnvpair.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -33,16 +37,20 @@
 #include <sys/types.h>
 #include <sys/sysmacros.h>
 #include <sys/queue.h>
+#include <sys/stat.h>
 #include <fcntl.h>
 #include <string.h>
 #include <errno.h>
 #include <scsi/libscsi.h>
+#include <sys/scsi/scsi_types.h>
 #include <libintl.h> /* for gettext(3c) */
 #include <fwflash/fwflash.h>
+#include <sys/debug.h>
+#include <umem.h>
 
 typedef struct sam4_statdesc {
-	int status;
-	char *message;
+	int sam_status;
+	char *sam_message;
 } sam4_statdesc_t;
 
 static sam4_statdesc_t sam4_status[] = {
@@ -53,12 +61,10 @@ static sam4_statdesc_t sam4_status[] = {
 	{ SAM4_STATUS_RESERVATION_CONFLICT, "Status: Device is RESERVED" },
 	{ SAM4_STATUS_TASK_SET_FULL,
 	    "Status: TASK SET FULL (insufficient resources in command queue" },
-	{ SAM4_STATUS_TASK_ABORTED, "Status: TASK ABORTED" },
-	{ NULL, NULL }
+	{ SAM4_STATUS_TASK_ABORTED, "Status: TASK ABORTED" }
 };
 
-#define	NSAM4_STATUS	\
-	(sizeof (sam4_status) / sizeof (sam4_status[0]))
+#define	NSAM4_STATUS	(sizeof (sam4_status) / sizeof (sam4_status[0]))
 
 #define	FW_SD_FREE_DEVPATH(devpath)	{	\
 		di_devfs_path_free((devpath));	\
@@ -100,27 +106,35 @@ static sam4_statdesc_t sam4_status[] = {
 		FW_SD_FREE_IDENT_PID((thisdev), (devpath))	\
 	}
 
-int errno;
+/*
+ * This is our default partial write size when we encounter a situation where we
+ * need to upgrade disks whose firmware image cannot be done in a single write.
+ * While in theory we should just use the maximum transfer size and make sure
+ * it's aligned, that's proven to be problematic for some Seagate disks. Hence
+ * we just make sure that if partial writes are required that this value fits in
+ * the required alignment and in the actual maximum transfer size.
+ */
+#define	FW_SD_PARTIAL_WRITE_SIZE	(64 * 1024)
+
+/*
+ * Declarations required for fwflash
+ */
 char drivername[] = "sd\0";
 int plugin_version = FWPLUGIN_VERSION_2;
 
-static char *devprefix = "/devices";
+/*
+ * Data provided by fwflash
+ */
 extern di_node_t rootnode;
 extern struct fw_plugin *self;
 extern struct vrfyplugin *verifier;
 extern int fwflash_debug;
 
-/* required functions for this plugin */
-int fw_readfw(struct devicelist *device, char *filename);
-int fw_writefw(struct devicelist *device);
-int fw_identify(int start);
-int fw_devinfo(struct devicelist *thisdev);
-void fw_cleanup(struct devicelist *thisdev);
+static char *sdfw_devprefix = "/devices";
 
-/* helper functions */
-static char *find_link(di_node_t bnode, char *acc_devname);
-static int link_cb(di_devlink_t devlink, void *arg);
-static int sd_idtfy_custmz(struct devicelist *device, char *sp);
+static char *sdfw_find_link(di_node_t bnode, char *acc_devname);
+static int sdfw_link_cb(di_devlink_t devlink, void *arg);
+static int sdfw_idtfy_custmz(struct devicelist *device, char *sp);
 
 /*
  * We don't currently support reading firmware from a disk. If we do eventually
@@ -141,17 +155,215 @@ fw_readfw(struct devicelist *flashdev, char *filename)
 	return (FWFLASH_SUCCESS);
 }
 
+
+static int
+sdfw_read_descriptor(struct devicelist *flashdev, libscsi_hdl_t *hdl,
+    libscsi_target_t *targ, uint8_t *align)
+{
+	spc3_read_buffer_cdb_t *rb_cdb;
+	size_t nwritten;
+	libscsi_action_t *action = NULL;
+	uint8_t descbuf[4];
+	sam4_status_t samstatus;
+
+	VERIFY3P(hdl, !=, NULL);
+	VERIFY3P(targ, !=, NULL);
+	VERIFY3P(align, !=, NULL);
+
+	if ((action = libscsi_action_alloc(hdl, SPC3_CMD_READ_BUFFER,
+	    LIBSCSI_AF_READ, descbuf, sizeof (descbuf))) == NULL) {
+		logmsg(MSG_ERROR, gettext("%s: failed to alloc scsi action: "
+		    "%s\n"),
+		    flashdev->drvname, libscsi_errmsg(hdl));
+		return (FWFLASH_FAILURE);
+	}
+
+	rb_cdb = (spc3_read_buffer_cdb_t *)libscsi_action_get_cdb(action);
+
+	rb_cdb->rbc_mode = SPC3_RB_MODE_DESCRIPTOR;
+
+	/*
+	 * Microcode upgrade usually only uses the first buffer ID which is
+	 * sequentially indexed from zero. Strictly speaking these are all
+	 * vendor defined, but so far most vendors we've seen use index zero
+	 * for this.
+	 */
+	rb_cdb->rbc_bufferid = 0;
+
+	rb_cdb->rbc_allocation_len[0] = 0;
+	rb_cdb->rbc_allocation_len[1] = 0;
+	rb_cdb->rbc_allocation_len[2] = sizeof (descbuf);
+
+	if (libscsi_exec(action, targ) != 0) {
+		logmsg(MSG_ERROR, gettext("%s: failed to execute SCSI buffer "
+		    "data read: %s\n"),
+		    flashdev->drvname, libscsi_errmsg(hdl));
+		libscsi_action_free(action);
+		return (FWFLASH_FAILURE);
+	}
+
+	if ((samstatus = libscsi_action_get_status(action)) !=
+	    SAM4_STATUS_GOOD) {
+		int i;
+		for (i = 0; i < NSAM4_STATUS; i++) {
+			if (samstatus == sam4_status[i].sam_status) {
+				logmsg(MSG_ERROR, gettext("%s: SCSI buffer "
+				    "data read failed: %s\n"),
+				    flashdev->drvname,
+				    sam4_status[i].sam_message);
+				libscsi_action_free(action);
+				return (FWFLASH_FAILURE);
+			}
+		}
+		logmsg(MSG_ERROR, gettext("%s: SCSI buffer data read failed: "
+		    "unknown error: %d\n"), flashdev->drvname, samstatus);
+		libscsi_action_free(action);
+		return (FWFLASH_FAILURE);
+	}
+
+	if (libscsi_action_get_buffer(action, NULL, NULL, &nwritten) != 0) {
+		logmsg(MSG_ERROR, gettext("%s: failed to get actual data "
+		    "size: %s\n"),
+		    flashdev->drvname, libscsi_errmsg(hdl));
+		libscsi_action_free(action);
+		return (FWFLASH_FAILURE);
+	}
+	libscsi_action_free(action);
+
+	if (nwritten != sizeof (descbuf)) {
+		logmsg(MSG_ERROR, gettext("%s: received a short read from the "
+		    "SCSI READ BUFFER command, expected %u bytes, read %u\n"),
+		    flashdev->drvname, sizeof (descbuf), nwritten);
+		return (FWFLASH_FAILURE);
+	}
+
+	if (descbuf[0] == 0 && descbuf[1] == 0 && descbuf[2] == 0 &&
+	    descbuf[3] == 0) {
+		logmsg(MSG_ERROR, gettext("%s: devices %s does not support "
+		    "firmware upgrade\n"), verifier->vendor,
+		    flashdev->access_devname);
+		return (FWFLASH_FAILURE);
+	}
+
+	*align = descbuf[0];
+
+	return (FWFLASH_SUCCESS);
+}
+
+static int
+sdfw_write(struct devicelist *flashdev, libscsi_hdl_t *handle,
+    libscsi_target_t *target, size_t len, size_t off, void *buf)
+{
+	sam4_status_t samstatus;
+	libscsi_action_t *action = NULL;
+	spc3_write_buffer_cdb_t *wb_cdb;
+
+	logmsg(MSG_INFO, "%s: writing %u bytes of image %s at offset %u from "
+	    "address %p\n", flashdev->drvname, len, verifier->imgfile, off,
+	    buf);
+	logmsg(MSG_INFO, "%s: writing to buffer id %u\n",
+	    flashdev->drvname, verifier->flashbuf);
+
+	VERIFY3P(flashdev, !=, NULL);
+	VERIFY3P(handle, !=, NULL);
+	VERIFY3P(target, !=, NULL);
+	VERIFY3P(buf, !=, NULL);
+	VERIFY3U(len, >, 0);
+	VERIFY3U(off + len, <=, verifier->imgsize);
+
+	action = libscsi_action_alloc(handle, SPC3_CMD_WRITE_BUFFER,
+	    LIBSCSI_AF_WRITE | LIBSCSI_AF_RQSENSE | LIBSCSI_AF_ISOLATE, buf,
+	    len);
+	if (action == NULL) {
+		logmsg(MSG_ERROR, gettext("%s: failed to alloc scsi action: "
+		    "%s\n"), flashdev->drvname, libscsi_errmsg(handle));
+		goto err;
+	}
+
+	wb_cdb = (spc3_write_buffer_cdb_t *)libscsi_action_get_cdb(action);
+
+	wb_cdb->wbc_mode = SPC3_WB_MODE_DL_UCODE_OFFS_SAVE;
+
+	wb_cdb->wbc_buffer_offset[0] = (off >> 16) & 0xff;
+	wb_cdb->wbc_buffer_offset[1] = (off >> 8) & 0xff;
+	wb_cdb->wbc_buffer_offset[2] = off & 0xff;
+
+	wb_cdb->wbc_bufferid = verifier->flashbuf;
+
+	wb_cdb->wbc_parameter_list_len[0] = (len >> 16) & 0xff;
+	wb_cdb->wbc_parameter_list_len[1] = (len >> 8) & 0xff;
+	wb_cdb->wbc_parameter_list_len[2] = len & 0xff;
+
+	logmsg(MSG_INFO, "%s: spc3_write_buffer_cdb_t opcode: %u\n",
+	    flashdev->drvname, wb_cdb->wbc_opcode);
+
+	if (libscsi_exec(action, target) != 0) {
+		logmsg(MSG_ERROR, gettext("%s: failed to execute SCSI WRITE "
+		    "BUFFER: %s\n"),
+		    flashdev->drvname, libscsi_errmsg(handle));
+		goto err;
+	}
+
+	if ((samstatus = libscsi_action_get_status(action)) ==
+	    SAM4_STATUS_CHECK_CONDITION) {
+		uint64_t asc = 0, ascq = 0, key = 0;
+		const char *code, *keystr;
+
+		if (libscsi_action_parse_sense(action, &key, &asc, &ascq,
+		    NULL) != 0) {
+			logmsg(MSG_ERROR, gettext("%s: failed to write "
+			    "firmware. Received CHECK_CONDITION that cannot be "
+			    "parsed.\n"),
+			    flashdev->drvname);
+			goto err;
+		}
+
+		code = libscsi_sense_code_name(asc, ascq);
+		keystr = libscsi_sense_key_name(key);
+
+		logmsg(MSG_ERROR, gettext("%s: failed to write firmware: "
+		    "received sense key %llu (%s) additional sense code "
+		    "0x%llx/0x%llx (%s)\n"), flashdev->drvname, key,
+		    keystr != NULL ? keystr : "<unknown>",
+		    asc, ascq, code != NULL ? code : "<unknown>");
+		goto err;
+	} else if (samstatus != SAM4_STATUS_GOOD) {
+		int i;
+
+		logmsg(MSG_ERROR, gettext("%s: SCSI buffer data write failed:"),
+		    flashdev->drvname);
+		for (i = 0; i < NSAM4_STATUS; i++) {
+			if (samstatus == sam4_status[i].sam_status) {
+				logmsg(MSG_ERROR, gettext("%s\n"),
+				    sam4_status[i].sam_message);
+				goto err;
+			}
+		}
+		logmsg(MSG_ERROR, gettext("unknown error: %d\n"), samstatus);
+		goto err;
+	} else {
+		logmsg(MSG_INFO, "%s: received STATUS GOOD\n",
+		    flashdev->drvname);
+	}
+
+	libscsi_action_free(action);
+	return (FWFLASH_SUCCESS);
+
+err:
+	if (action != NULL)
+		libscsi_action_free(action);
+	return (FWFLASH_FAILURE);
+}
+
 int
 fw_writefw(struct devicelist *flashdev)
 {
-	int rv;
-	int i = 0;
 	libscsi_hdl_t	*handle;
 	libscsi_target_t *target;
-	libscsi_action_t *action;
 	libscsi_errno_t serr;
-	spc3_write_buffer_cdb_t *wb_cdb;
-	sam4_status_t samstatus;
+	size_t maxxfer, nwrite;
+	uint8_t align;
+	int ret = FWFLASH_FAILURE;
 
 	if ((verifier == NULL) || (verifier->imgsize == 0) ||
 	    (verifier->fwimage == NULL)) {
@@ -168,8 +380,8 @@ fw_writefw(struct devicelist *flashdev)
 		return (FWFLASH_FAILURE);
 	}
 
-	if ((target = libscsi_open(handle, NULL, flashdev->access_devname))
-	    == NULL) {
+	if ((target = libscsi_open(handle, NULL, flashdev->access_devname)) ==
+	    NULL) {
 		logmsg(MSG_ERROR,
 		    gettext("%s: unable to open device %s\n"),
 		    flashdev->drvname, flashdev->access_devname);
@@ -177,55 +389,90 @@ fw_writefw(struct devicelist *flashdev)
 		return (FWFLASH_FAILURE);
 	}
 
-	action = libscsi_action_alloc(handle, SPC3_CMD_WRITE_BUFFER,
-	    LIBSCSI_AF_WRITE|LIBSCSI_AF_RQSENSE,
-	    (void *)verifier->fwimage, (size_t)verifier->imgsize);
-
-	wb_cdb = (spc3_write_buffer_cdb_t *)libscsi_action_get_cdb(action);
+	if (libscsi_max_transfer(target, &maxxfer) != 0) {
+		logmsg(MSG_ERROR, gettext("%s: failed to determine device "
+		    "maximum transfer size: %s\n"), flashdev->drvname,
+		    libscsi_errmsg(handle));
+		goto err;
+	}
 
-	wb_cdb->wbc_mode = SPC3_WB_MODE_DL_UCODE_SAVE;
-	wb_cdb->wbc_bufferid = verifier->flashbuf;
+	if (sdfw_read_descriptor(flashdev, handle, target, &align) !=
+	    FWFLASH_SUCCESS) {
+		goto err;
+	}
 
-	wb_cdb->wbc_buffer_offset[0] = 0;
-	wb_cdb->wbc_buffer_offset[1] = 0;
-	wb_cdb->wbc_buffer_offset[2] = 0;
+	/*
+	 * If the maximum transfer size is less than the maximum image size then
+	 * we have to do some additional work. We need to read the descriptor
+	 * via a READ BUFFER command and make sure that we support the required
+	 * offset alignment. Note that an alignment of 0xff indicates that the
+	 * device does not support partial writes and must receive the firmware
+	 * in a single WRITE BUFFER.  Otherwise a value in align represents a
+	 * required offset alignment of 2^off. From there, we make sure that
+	 * this works for our partial write size and that our partial write size
+	 * fits in the maximum transfer size.
+	 */
+	if (maxxfer < verifier->imgsize) {
+		logmsg(MSG_INFO, "%s: Maximum transfer is %u, required "
+		    "alignment is 2^%d\n", flashdev->drvname, maxxfer, align);
+		if (FW_SD_PARTIAL_WRITE_SIZE > maxxfer) {
+			logmsg(MSG_ERROR, gettext("%s: cannot write firmware "
+			    "image: HBA enforces a maximum transfer size of "
+			    "%u bytes, but the default partial transfer size "
+			    "is %u bytes\n"), flashdev->drvname, maxxfer,
+			    FW_SD_PARTIAL_WRITE_SIZE);
+			goto err;
+		}
+		maxxfer = FW_SD_PARTIAL_WRITE_SIZE;
 
-	wb_cdb->wbc_parameter_list_len[0] =
-	    (verifier->imgsize & 0xff0000) >> 16;
-	wb_cdb->wbc_parameter_list_len[1] = (verifier->imgsize & 0xff00) >> 8;
-	wb_cdb->wbc_parameter_list_len[2] = (verifier->imgsize & 0xff);
+		if (ffsll(maxxfer) < align || align == 0xff) {
+			logmsg(MSG_ERROR, gettext("%s: cannot write firmware "
+			    "image: device requires partial writes aligned "
+			    "to an unsupported value\n"), flashdev->drvname);
+			goto err;
+		}
 
-	rv = libscsi_exec(action, target);
-	samstatus = libscsi_action_get_status(action);
+		logmsg(MSG_INFO, "%s: final transfer block size is %u\n",
+		    flashdev->drvname, maxxfer);
+	}
 
-	logmsg(MSG_INFO, "\nscsi_writebuffer: ret 0x%0x, samstatus 0x%0x\n",
-	    rv, samstatus);
+	logmsg(MSG_INFO, "%s: Writing out %u bytes to %s\n", flashdev->drvname,
+	    verifier->imgsize, flashdev->access_devname);
+	nwrite = 0;
+	for (;;) {
+		uintptr_t buf;
+		size_t towrite = MIN(maxxfer, verifier->imgsize - nwrite);
 
-	libscsi_action_free(action);
-	libscsi_close(handle, target);
-	libscsi_fini(handle);
+		if (towrite == 0)
+			break;
 
-	if (rv != FWFLASH_SUCCESS)
-		return (FWFLASH_FAILURE);
+		buf = (uintptr_t)verifier->fwimage;
+		buf += nwrite;
 
-	for (i = 0; i < NSAM4_STATUS; i++) {
-		if (sam4_status[i].status == samstatus) {
-			logmsg(MSG_ERROR, gettext("RETURN STATUS: %s\n"),
-			    (sam4_status[i].message));
-			break;
+		if (sdfw_write(flashdev, handle, target, towrite, nwrite,
+		    (void *)buf) != FWFLASH_SUCCESS) {
+			logmsg(MSG_ERROR, gettext("%s: failed to write to %s "
+			    "successfully: %s\n"), flashdev->drvname,
+			    flashdev->access_devname, libscsi_errmsg(handle));
+			goto err;
 		}
-	}
-	if (i == NSAM4_STATUS)
-		logmsg(MSG_ERROR, gettext("Status UNKNOWN\n"));
 
-	if (samstatus == SAM4_STATUS_GOOD) {
-		logmsg(MSG_ERROR, gettext("Note: For flash based disks "
-		    "(SSD, etc). You may need power off the system to wait a "
-		    "few minutes for supercap to fully discharge, then power "
-		    "on the system again to activate the new firmware\n"));
-		return (FWFLASH_SUCCESS);
+		nwrite += towrite;
 	}
-	return (FWFLASH_FAILURE);
+
+	logmsg(MSG_ERROR, gettext("Note: For flash based disks "
+	    "(SSD, etc). You may need power off the system to wait a "
+	    "few minutes for supercap to fully discharge, then power "
+	    "on the system again to activate the new firmware\n"));
+	ret = FWFLASH_SUCCESS;
+
+err:
+	if (target != NULL)
+		libscsi_close(handle, target);
+	if (handle != NULL)
+		libscsi_fini(handle);
+
+	return (ret);
 }
 
 /*
@@ -300,8 +547,8 @@ fw_identify(int start)
 			continue;
 		}
 
-		if ((newdev = calloc(1, sizeof (struct devicelist)))
-		    == NULL) {
+		if ((newdev = calloc(1, sizeof (struct devicelist))) ==
+		    NULL) {
 			logmsg(MSG_ERROR,
 			    gettext("%s: identification function unable "
 			    "to allocate space for device entry\n"),
@@ -311,8 +558,8 @@ fw_identify(int start)
 			return (FWFLASH_FAILURE);
 		}
 
-		if ((newdev->drvname = calloc(1, strlen(driver) + 1))
-		    == NULL) {
+		if ((newdev->drvname = calloc(1, strlen(driver) + 1)) ==
+		    NULL) {
 			logmsg(MSG_ERROR,
 			    gettext("%s: Unable to allocate space to store a "
 			    "driver name\n"), driver);
@@ -322,8 +569,8 @@ fw_identify(int start)
 		}
 		(void) strlcpy(newdev->drvname, driver, strlen(driver) + 1);
 
-		if ((newdev->classname = calloc(1, strlen(driver) + 1))
-		    == NULL) {
+		if ((newdev->classname = calloc(1, strlen(driver) + 1)) ==
+		    NULL) {
 			logmsg(MSG_ERROR,
 			    gettext("%s: Unable to allocate space for a class "
 			    "name\n"), drivername);
@@ -345,12 +592,12 @@ fw_identify(int start)
 
 		/* The slice number may be 2 or 0, we will try 2 first */
 		(void) snprintf(newdev->access_devname, MAXPATHLEN,
-		    "%s%s:c,raw", devprefix, devpath);
+		    "%s%s:c,raw", sdfw_devprefix, devpath);
 		if ((target = libscsi_open(handle, NULL,
 		    newdev->access_devname)) == NULL) {
 			/* try 0 for EFI label */
 			(void) snprintf(newdev->access_devname, MAXPATHLEN,
-			    "%s%s:a,raw", devprefix, devpath);
+			    "%s%s:a,raw", sdfw_devprefix, devpath);
 			if ((target = libscsi_open(handle, NULL,
 			    newdev->access_devname)) == NULL) {
 				logmsg(MSG_INFO,
@@ -362,7 +609,7 @@ fw_identify(int start)
 		}
 
 		/* and the /dev/rdsk/ name */
-		if ((newdev->addresses[0] = find_link(thisnode,
+		if ((newdev->addresses[0] = sdfw_find_link(thisnode,
 		    newdev->access_devname)) == NULL) {
 			libscsi_fini(handle);
 			FW_SD_FREE_ACC_NAME(newdev, devpath)
@@ -423,7 +670,7 @@ fw_identify(int start)
 				 * There is no SPACE character in the PID field
 				 * Customize strings for special SATA disks
 				 */
-				if (sd_idtfy_custmz(newdev, sp_temp)
+				if (sdfw_idtfy_custmz(newdev, sp_temp)
 				    != FWFLASH_SUCCESS) {
 					libscsi_close(handle, target);
 					libscsi_fini(handle);
@@ -483,8 +730,8 @@ fw_identify(int start)
 
 		/* Revision ID */
 		sp_temp = (char *)libscsi_revision(target);
-		if ((newdev->ident->revid = calloc(1, strlen(sp_temp) + 1))
-		    == NULL || sp_temp == NULL) {
+		if ((newdev->ident->revid = calloc(1, strlen(sp_temp) + 1)) ==
+		    NULL || sp_temp == NULL) {
 			logmsg(MSG_ERROR, gettext("%s: unable to get revision "
 			    "id of %s\n"), newdev->drvname,
 			    newdev->access_devname);
@@ -634,7 +881,7 @@ fw_cleanup(struct devicelist *thisdev)
  * Helper functions
  */
 static int
-link_cb(di_devlink_t devlink, void *arg)
+sdfw_link_cb(di_devlink_t devlink, void *arg)
 {
 	const char *result;
 
@@ -645,14 +892,14 @@ link_cb(di_devlink_t devlink, void *arg)
 		(void) strlcpy(arg, result, strlen(result) + 1);
 	}
 
-	logmsg(MSG_INFO, "\nlink_cb::linkdata->resultstr = %s\n",
+	logmsg(MSG_INFO, "\nsdfw_link_cb::linkdata->resultstr = %s\n",
 	    ((result != NULL) ? result : "(null)"));
 
 	return (DI_WALK_CONTINUE);
 }
 
 static char *
-find_link(di_node_t bnode, char *acc_devname)
+sdfw_find_link(di_node_t bnode, char *acc_devname)
 {
 	di_minor_t devminor = DI_MINOR_NIL;
 	di_devlink_handle_t hdl;
@@ -661,7 +908,7 @@ find_link(di_node_t bnode, char *acc_devname)
 
 	if (bnode == DI_NODE_NIL) {
 		logmsg(MSG_ERROR,
-		    gettext("find_link must be called with non-null "
+		    gettext("sdfw_find_link must be called with non-null "
 		    "di_node_t\n"));
 		return (NULL);
 	}
@@ -690,8 +937,8 @@ find_link(di_node_t bnode, char *acc_devname)
 	}
 
 	errno = 0;
-	if (di_devlink_walk(hdl, linkname, acc_devname + strlen(devprefix),
-	    DI_PRIMARY_LINK, (void *)cbresult, link_cb) < 0) {
+	if (di_devlink_walk(hdl, linkname, acc_devname + strlen(sdfw_devprefix),
+	    DI_PRIMARY_LINK, (void *)cbresult, sdfw_link_cb) < 0) {
 		logmsg(MSG_ERROR,
 		    gettext("Unable to walk devlink snapshot for %s: %s\n"),
 		    acc_devname, strerror(errno));
@@ -710,7 +957,7 @@ find_link(di_node_t bnode, char *acc_devname)
 }
 
 static int
-sd_idtfy_custmz(struct devicelist *device, char *sp)
+sdfw_idtfy_custmz(struct devicelist *device, char *sp)
 {
 	/* vid customization */
 	if (strncmp(sp, "ST", 2) == 0) {
@@ -724,7 +971,7 @@ sd_idtfy_custmz(struct devicelist *device, char *sp)
 			return (FWFLASH_FAILURE);
 		}
 	} else {
-		/* disks to do in the furture, fill 'ATA' first */
+		/* disks to do in the future, fill 'ATA' first */
 		if ((device->ident->vid = strdup("ATA")) == NULL) {
 			return (FWFLASH_FAILURE);
 		}
diff --git a/usr/src/cmd/fwflash/plugins/vendor/sd-GENERIC.c b/usr/src/cmd/fwflash/plugins/vendor/sd-GENERIC.c
index d66339226f..e99655d3e5 100644
--- a/usr/src/cmd/fwflash/plugins/vendor/sd-GENERIC.c
+++ b/usr/src/cmd/fwflash/plugins/vendor/sd-GENERIC.c
@@ -1,89 +1,150 @@
 /*
- * CDDL HEADER START
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
  *
- * The contents of this file are subject to the terms of the
- * Common Development and Distribution License (the "License").
- * You may not use this file except in compliance with the License.
- *
- * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- *
- * When distributing Covered Code, include this CDDL HEADER in each
- * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- * If applicable, add the following below this CDDL HEADER, with the
- * fields enclosed by brackets "[]" replaced with your own identifying
- * information: Portions Copyright [yyyy] [name of copyright owner]
- *
- * CDDL HEADER END
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
  */
+
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
+/*
+ * This is a general firmware flash plugin that does basic verification for
+ * devices backed by sd(7D).
+ *
+ * The sd(7D) target for firmware flashing uses the general SCSI WRITE BUFFER
+ * options with various modes to instruct the drive to download and install
+ * microcode (what SPC-3 calls firmware). To verify that something fits, we can
+ * use the READ BUFFER command with mode 03h to indicate that we want to
+ * buffer's descriptor. This gives us both the buffer's total size and the
+ * required alignment for writes.
+ *
+ * Unfortunately, it's impossible to know for certain if that size is supposed
+ * to be equivalent to the microcode's. While a READ BUFFER is supposed to
+ * return the same data as with a WRITE BUFFER command, experimental evidence
+ * has shown that this isn't always the case. Especially as the firmware buffer
+ * usually leverages buffer zero, but has custom modes to access it.
+ */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/sysmacros.h>
-#include <fcntl.h>
-#include <sys/condvar.h>
-#include <string.h>
-#include <strings.h>
-
-#include <sys/byteorder.h>
-
-#include <libintl.h> /* for gettext(3c) */
+#include <libintl.h>
 #include <fwflash/fwflash.h>
+#include <scsi/libscsi.h>
 
-char vendor[] = "GENERIC \0";
-
-/* MAXIMGSIZE = 1.4 * 1024 * 1024 bytes */
-/* Currently the largest firmware image size is 1.4 MB */
-/* 1468006 = 1.4 * 1024 * 1024 */
-#define	MAXIMGSIZE	((unsigned int)(1468006))
-
+/*
+ * The fwflash plugin interface is a bit odd for a modern committed interface
+ * and requires us to refer to data objects in the parent explicitly to get
+ * access to and set various information. It also doesn't allow us a means of
+ * setting data for our transport layer.
+ */
 extern struct vrfyplugin *verifier;
 
-/* required functions for this plugin */
-int vendorvrfy(struct devicelist *devicenode);
-
 /*
- * Important information about how this verification plugin works
- *
- * Direct-attached disks (sd instances) which support firmware
- * download accept image files up to 1.4 * 1024 * 1024 bytes in
- * size, and do their own verification of the image, rejecting the
- * file if it is not appropriate for them.
- *
- * All that we need to do here is set the various verifier fields
- * correctly, and check that the filesize as read from the filesystem
- * is less than 1.4 * 1024 * 1024 bytes.
+ * Declare the name of our vendor. This is required by the fwflash
+ * plugin interface. Note it must be a character array. Using a pointer may
+ * confuse the framework and its use of dlsym.
  */
+char vendor[] = "GENERIC";
 
 int
-vendorvrfy(struct devicelist *devicenode)
+vendorvrfy(struct devicelist *dvp)
 {
-	if (verifier->imgsize > MAXIMGSIZE) {
-		logmsg(MSG_ERROR,
-		    gettext("\nsd-GENERIC firmware image verifier: "
-		    "supplied filename %s exceeds maximum allowable "
-		    "size of %d bytes\n"),
-		    verifier->imgfile, MAXIMGSIZE);
+	libscsi_hdl_t *hdl = NULL;
+	libscsi_target_t *targ = NULL;
+	libscsi_action_t *act = NULL;
+	libscsi_errno_t serr;
+	spc3_read_buffer_cdb_t *rb_cdb;
+	uint8_t descbuf[4];
+	uint32_t size;
+
+	int ret = FWFLASH_FAILURE;
+
+	if ((hdl = libscsi_init(LIBSCSI_VERSION, &serr)) == NULL) {
+		logmsg(MSG_ERROR, gettext("%s: failed to initialize "
+		    "libscsi: %s\n"),
+		    verifier->vendor, libscsi_strerror(serr));
 		return (FWFLASH_FAILURE);
 	}
 
-	logmsg(MSG_INFO,
-	    "sd-GENERIC verifier for device\n"
-	    "vid %s, pid %s, rev %s\npath %s\n",
-	    devicenode->ident->vid,
-	    devicenode->ident->pid,
-	    devicenode->ident->revid,
-	    devicenode->addresses[0]);
+	if ((targ = libscsi_open(hdl, NULL, dvp->access_devname)) ==
+	    NULL) {
+		logmsg(MSG_ERROR,
+		    gettext("%s: unable to open device %s\n"),
+		    verifier->vendor, dvp->access_devname);
+		goto cleanup;
+	}
+
+	if ((act = libscsi_action_alloc(hdl, SPC3_CMD_READ_BUFFER,
+	    LIBSCSI_AF_READ, descbuf, sizeof (descbuf))) == NULL) {
+		logmsg(MSG_ERROR, "%s: failed to alloc scsi action: %s\n",
+		    verifier->vendor, libscsi_errmsg(hdl));
+		goto cleanup;
+	}
+
+	rb_cdb = (spc3_read_buffer_cdb_t *)libscsi_action_get_cdb(act);
+
+	rb_cdb->rbc_mode = SPC3_RB_MODE_DESCRIPTOR;
+
+	/*
+	 * Microcode upgrade usually only uses the first buffer ID which are
+	 * sequentially indexed from zero. Strictly speaking these are all
+	 * vendor defined, but so far most vendors we've seen use index zero
+	 * for this.
+	 */
+	rb_cdb->rbc_bufferid = 0;
+
+	rb_cdb->rbc_allocation_len[0] = 0;
+	rb_cdb->rbc_allocation_len[1] = 0;
+	rb_cdb->rbc_allocation_len[2] = sizeof (descbuf);
+
+	if (libscsi_exec(act, targ) != 0) {
+		logmsg(MSG_ERROR, gettext("%s: failed to execute SCSI buffer "
+		    "descriptor read: %s\n"), verifier->vendor,
+		    libscsi_errmsg(hdl));
+		goto cleanup;
+	}
+
+	if (libscsi_action_get_status(act) != SAM4_STATUS_GOOD) {
+		logmsg(MSG_ERROR, gettext("%s: SCSI READ BUFFER command to "
+		    "determine maximum image size failed\n"), verifier->vendor);
+		goto cleanup;
+	}
+
+	if (descbuf[0] == 0 && descbuf[1] == 0 && descbuf[2] == 0 &&
+	    descbuf[3] == 0) {
+		logmsg(MSG_ERROR, gettext("%s: devices %s does not support "
+		    "firmware upgrade\n"), verifier->vendor,
+		    dvp->access_devname);
+		goto cleanup;
+	}
+
+	size = (descbuf[1] << 16) | (descbuf[2] << 8) | descbuf[3];
+	logmsg(MSG_INFO, gettext("%s: checking maximum image size %u against "
+	    "actual image size: %u\n"), verifier->vendor, size,
+	    verifier->imgsize);
+	if (size < verifier->imgsize) {
+		logmsg(MSG_ERROR, gettext("%s: supplied firmware image %s "
+		    "exceeds maximum image size of %u\n"),
+		    verifier->vendor, verifier->imgfile, size);
+		goto cleanup;
+	}
+
+	logmsg(MSG_INFO, gettext("%s: successfully validated images %s\n"),
+	    verifier->vendor, verifier->imgfile);
+
 	verifier->flashbuf = 0;
+	ret = FWFLASH_SUCCESS;
+cleanup:
+	if (act != NULL)
+		libscsi_action_free(act);
+	if (targ != NULL)
+		libscsi_close(hdl, targ);
+	if (hdl != NULL)
+		libscsi_fini(hdl);
 
-	return (FWFLASH_SUCCESS);
+	return (ret);
 }
diff --git a/usr/src/cmd/halt/halt.c b/usr/src/cmd/halt/halt.c
index 166e5a163b..0293c5e788 100644
--- a/usr/src/cmd/halt/halt.c
+++ b/usr/src/cmd/halt/halt.c
@@ -22,6 +22,7 @@
  * Copyright 2016 Toomas Soome <tsoome@me.com>
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
  */
 /*
  * Copyright (c) 2013, Joyent, Inc. All rights reserved.
@@ -1236,6 +1237,17 @@ do_archives_update(int do_fast_reboot)
 	pid_t	pid;
 	char	*cmd_argv[MAXARGS];
 
+#if defined(__i386)
+	{
+		/*
+		 * bootadm will complain and exit if not a grub root, so
+		 * just skip running it.
+		 */
+		struct stat sb;
+		if (stat("/boot/grub/stage2", &sb) == -1)
+			return;
+	}
+#endif	/* __i386 */
 
 	cmd_argv[i++] = "/sbin/bootadm";
 	cmd_argv[i++] = "-ea";
@@ -1300,7 +1312,7 @@ main(int argc, char *argv[])
 		optstring = "dlnqfp";
 		usage = gettext("usage: %s [ -dlnq(p|f) ] [ boot args ]\n");
 #endif
-		cmd = A_SHUTDOWN;
+		cmd = A_REBOOT;
 		fcn = AD_BOOT;
 	} else {
 		(void) fprintf(stderr,
@@ -1498,7 +1510,8 @@ main(int argc, char *argv[])
 	 * check_zone_haltedness later on.
 	 */
 	if (zoneid == GLOBAL_ZONEID && cmd != A_DUMP) {
-		need_check_zones = halt_zones();
+		if (!qflag)
+			need_check_zones = halt_zones();
 	}
 
 #if defined(__x86)
@@ -1598,7 +1611,7 @@ main(int argc, char *argv[])
 
 	(void) signal(SIGINT, SIG_IGN);
 
-	if (!qflag && !nosync) {
+	if (!nosync) {
 		struct utmpx wtmpx;
 
 		bzero(&wtmpx, sizeof (struct utmpx));
diff --git a/usr/src/cmd/ibd_upgrade/ibd_delete_link.c b/usr/src/cmd/ibd_upgrade/ibd_delete_link.c
index b9d10a56cd..f63630207d 100644
--- a/usr/src/cmd/ibd_upgrade/ibd_delete_link.c
+++ b/usr/src/cmd/ibd_upgrade/ibd_delete_link.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent Inc. All rights reserved.
  */
 
 #include <stdio.h>
@@ -86,6 +87,7 @@ ibd_delete_link(dladm_handle_t dlh, char *link)
 
 	getlinkid.ld_cmd = DLMGMT_CMD_GETLINKID;
 	(void) strlcpy(getlinkid.ld_link, link, MAXLINKNAMELEN);
+	getlinkid.ld_zoneid = -1;
 
 	if ((status = ibd_dladm_door_call(dlh, &getlinkid, sizeof (getlinkid),
 	    &retval, sizeof (retval))) != DLADM_STATUS_OK) {
diff --git a/usr/src/cmd/init/Makefile b/usr/src/cmd/init/Makefile
index a867a0e780..b4b857882b 100644
--- a/usr/src/cmd/init/Makefile
+++ b/usr/src/cmd/init/Makefile
@@ -25,11 +25,13 @@
 #
 
 PROG= init 
+OBJS= init.o
 ROOTFS_PROG= $(PROG)
 
 DEFAULTFILES= init.dfl
 
 include ../Makefile.cmd
+include ../Makefile.ctf
 
 LDLIBS += -lpam -lbsm -lcontract -lscf
 CERRWARN += -_gcc=-Wno-parentheses
@@ -41,6 +43,10 @@ CLOBBERFILES= $(STATIC)
 
 all: $(ROOTFS_PROG)
 
+$(ROOTFS_PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
 install: all $(ROOTETCDEFAULTFILES) $(ROOTSBINPROG)
 	$(RM) $(ROOTETCPROG)
 	$(RM) $(ROOTUSRSBINPROG)
@@ -58,4 +64,8 @@ clean:
 
 lint:	lint_PROG
 
+%.o: %.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
 include ../Makefile.targ
diff --git a/usr/src/cmd/init/init.c b/usr/src/cmd/init/init.c
index 031a053b65..fa1b9d687c 100644
--- a/usr/src/cmd/init/init.c
+++ b/usr/src/cmd/init/init.c
@@ -23,6 +23,7 @@
  * Copyright (c) 2013 Gary Mills
  *
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -144,6 +145,8 @@
 #define	UT_USER_SZ	32	/* Size of a utmpx ut_user field */
 #define	UT_LINE_SZ	32	/* Size of a utmpx ut_line field */
 
+#define	CHECK_SVC	SCF_INSTANCE_FS_MINIMAL
+
 /*
  * SLEEPTIME	The number of seconds "init" sleeps between wakeups if
  *		nothing else requires this "init" wakeup.
@@ -548,6 +551,8 @@ static time_t	init_boot_time;		/* Substitute for kernel boot time. */
 
 #define	NSTARTD_FAILURE_TIMES	3		/* trigger after 3 failures */
 #define	STARTD_FAILURE_RATE_NS	5000000000LL	/* 1 failure/5 seconds */
+#define	STARTD_THROTTLE_RETRY	60	/* space failure retry after 60 secs */
+#define	ROOT_MIN_FREE		524288	/* 512KB min. space needed in root */
 
 static hrtime_t	startd_failure_time[NSTARTD_FAILURE_TIMES];
 static uint_t	startd_failure_index;
@@ -696,9 +701,8 @@ main(int argc, char *argv[])
 		console(B_FALSE,
 		    "\n\n%s Release %s Version %s %d-bit\r\n",
 		    un.sysname, un.release, un.version, bits);
-		console(B_FALSE,
-		    "Copyright (c) 1983, 2010, Oracle and/or its affiliates."
-		    " All rights reserved.\r\n");
+		console(B_FALSE, "Copyright (c) 2010-2012, "
+		    "Joyent Inc. All rights reserved.\r\n");
 	}
 
 	/*
@@ -3509,6 +3513,28 @@ bail:
 }
 
 /*
+ * Attempt to confirm that svc.startd is ready to accept a user-initiated
+ * run-level change. startd is not ready until it has started its
+ * _scf_notify_wait thread to watch for events from svc.configd. This is
+ * inherently racy. To workaround this, we check the status of a file that
+ * startd will create once it has started the _scf_notify_wait thread.
+ * If we don't see this file after one minute, then charge ahead.
+ */
+static void
+verify_startd_ready()
+{
+	struct stat64 buf;
+	int i;
+
+	for (i = 0; i < 60; i++) {
+		if (stat64("/etc/svc/volatile/startd.ready", &buf) == 0)
+			return;
+		sleep(1);
+	}
+	console(B_TRUE, "verify startd timeout\n");
+}
+
+/*
  * Function to handle requests from users to main init running as process 1.
  */
 static void
@@ -3596,6 +3622,12 @@ userinit(int argc, char **argv)
 	(void) audit_put_record(ADT_SUCCESS, ADT_SUCCESS, argv[1]);
 
 	/*
+	 * Before we tell init to start a run-level change, we need to be
+	 * sure svc.startd is ready to accept that.
+	 */
+	verify_startd_ready();
+
+	/*
 	 * Signal init; init will take care of telling svc.startd.
 	 */
 	if (kill(init_pid, init_signal) == FAILURE) {
@@ -4305,9 +4337,7 @@ contract_event(struct pollfd *poll)
 		if (ret == 0) {
 			if (cookie == STARTD_COOKIE &&
 			    do_restart_startd) {
-				if (smf_debug)
-					console(B_TRUE, "Restarting "
-					    "svc.startd.\n");
+				console(B_TRUE, "Restarting svc.startd.\n");
 
 				/*
 				 * Account for the failure.  If the failure rate
@@ -4438,6 +4468,28 @@ startd_run(const char *cline, int tmpl, ctid_t old_ctid)
 
 	if (pid == 0) {
 		/* child */
+		struct statvfs64 sbuf;
+
+		/*
+		 * svc.configd needs some space (a few hundred KB) in / for its
+		 * database. One common cause for startd failure is when
+		 * configd dies because / is full. We don't want to go into the
+		 * fast restart loop (startd_failure_rate_critical) and enter
+		 * maintenance so we check for this case and slow down the
+		 * failure rate so as to keep retrying in the hope space will
+		 * free up.
+		 */
+		if (statvfs64("/", &sbuf) != -1 &&
+		    (sbuf.f_bsize * sbuf.f_bfree) < ROOT_MIN_FREE) {
+			syslog(LOG_ERR, "Insufficent space (%ld) in / to "
+			    "start svc.startd.\n",
+			    (long)(sbuf.f_bsize * sbuf.f_bfree));
+			console(B_TRUE, "Insufficent space (%ld) in / to "
+			    "start svc.startd.\n",
+			    (long)(sbuf.f_bsize * sbuf.f_bfree));
+			sleep(STARTD_THROTTLE_RETRY);
+			exit(1);
+		}
 
 		/* See the comment in efork() */
 		for (i = SIGHUP; i <= SIGRTMAX; ++i) {
diff --git a/usr/src/cmd/initpkg/mountall.sh b/usr/src/cmd/initpkg/mountall.sh
index fa59a20a41..2302c7592c 100644
--- a/usr/src/cmd/initpkg/mountall.sh
+++ b/usr/src/cmd/initpkg/mountall.sh
@@ -29,6 +29,8 @@
 #	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T
 #	  All Rights Reserved
 #
+# Copyright (c) 2012, Joyent, Inc. All rights reserved.
+#
 
 usage () {
 	if [ -n "$1" ]; then
@@ -149,6 +151,9 @@ isremote() {
 # Get list of remote FS types (just once)
 RemoteFSTypes=`while read t junk; do echo $t; done < /etc/dfs/fstypes`
 
+# Ensure nfs/smbfs are remote FS types even if not delivered from fstypes
+isremote "nfs" || set -A RemoteFSTypes "nfs"
+isremote "smbfs" || set -A RemoteFSTypes "smbfs"
 
 #
 # Process command line args
diff --git a/usr/src/cmd/initpkg/shutdown.sh b/usr/src/cmd/initpkg/shutdown.sh
index a90213cd81..e93de5568c 100644
--- a/usr/src/cmd/initpkg/shutdown.sh
+++ b/usr/src/cmd/initpkg/shutdown.sh
@@ -43,7 +43,7 @@ usage() {
 }
 
 notify() {
-	/usr/sbin/wall -a <<-!
+	/usr/sbin/wall -Za <<-!
 	$*
 	!
 	# We used to do rwall here if showmounts had any output, but
diff --git a/usr/src/cmd/initpkg/umountall.sh b/usr/src/cmd/initpkg/umountall.sh
index c9a94fd8f1..4a45e19e18 100644
--- a/usr/src/cmd/initpkg/umountall.sh
+++ b/usr/src/cmd/initpkg/umountall.sh
@@ -25,6 +25,7 @@
 #	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T
 #	  All Rights Reserved
 #
+# Copyright (c) 2012, Joyent, Inc. All rights reserved.
 #
 
 usage () {
@@ -98,6 +99,9 @@ isremote() {
 # Get list of remote FS types (just once)
 RemoteFSTypes=`while read t junk; do echo $t; done < /etc/dfs/fstypes`
 
+# Ensure nfs/smbfs are remote FS types even if not delivered from fstypes
+isremote "nfs" || set -A RemoteFSTypes "nfs"
+isremote "smbfs" || set -A RemoteFSTypes "smbfs"
 
 #
 # Process command line args
diff --git a/usr/src/cmd/ipf/tools/Makefile.tools b/usr/src/cmd/ipf/tools/Makefile.tools
index 7c1e151762..ce0db79970 100644
--- a/usr/src/cmd/ipf/tools/Makefile.tools
+++ b/usr/src/cmd/ipf/tools/Makefile.tools
@@ -23,7 +23,6 @@
 # Use is subject to license terms.
 #
 # Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
-#
 # Copyright (c) 2012, Joyent Inc. All rights reserved.
 #
 
diff --git a/usr/src/cmd/ipf/tools/ipfstat.c b/usr/src/cmd/ipf/tools/ipfstat.c
index d72f6ba97a..caa9ff7468 100644
--- a/usr/src/cmd/ipf/tools/ipfstat.c
+++ b/usr/src/cmd/ipf/tools/ipfstat.c
@@ -165,6 +165,10 @@ static	int	sort_dstip __P((const void *, const void *));
 static	int	sort_dstpt __P((const void *, const void *));
 #endif
 
+#if SOLARIS
+#include "ipfzone.h"
+#endif
+
 
 static void usage(name)
 char *name;
diff --git a/usr/src/cmd/ksh/Makefile.com b/usr/src/cmd/ksh/Makefile.com
index 8716f4eb9d..e5615cb407 100644
--- a/usr/src/cmd/ksh/Makefile.com
+++ b/usr/src/cmd/ksh/Makefile.com
@@ -36,11 +36,13 @@ LIBSHELLBASE=../../../lib/libshell
 LIBSHELLSRC=$(LIBSHELLBASE)/common/sh
 
 SRCS=	$(OBJECTS:%.o=$(LIBSHELLSRC)/%.c)
+OBJS=	$(OBJECTS)
 
 LDLIBS += -lshell
 
 # Set common AST build flags (e.g., needed to support the math stuff).
 include ../../../Makefile.ast
+include ../../Makefile.ctf
 
 # 1. Make sure that the -D/-U defines in CFLAGS below are in sync
 # with usr/src/lib/libshell/Makefile.com
diff --git a/usr/src/cmd/lofiadm/main.c b/usr/src/cmd/lofiadm/main.c
index 4a4ee348c0..6ed5b49050 100644
--- a/usr/src/cmd/lofiadm/main.c
+++ b/usr/src/cmd/lofiadm/main.c
@@ -412,7 +412,8 @@ out:
  * DO NOT use this function if the filename is actually the device name.
  */
 static int
-lofi_map_file(int lfd, struct lofi_ioctl *li, const char *filename)
+lofi_map_file(int lfd, struct lofi_ioctl *li, const char *filename,
+    boolean_t no_devlink_flag)
 {
 	int	minor;
 
@@ -425,7 +426,8 @@ lofi_map_file(int lfd, struct lofi_ioctl *li, const char *filename)
 			    "unsupported"));
 		die(gettext("could not map file %s"), filename);
 	}
-	wait_until_dev_complete(li);
+	if (!no_devlink_flag)
+		wait_until_dev_complete(li);
 	return (minor);
 }
 
@@ -436,7 +438,7 @@ lofi_map_file(int lfd, struct lofi_ioctl *li, const char *filename)
 static void
 add_mapping(int lfd, const char *devicename, const char *filename,
     mech_alias_t *cipher, const char *rkey, size_t rksz, boolean_t rdonly,
-    boolean_t label)
+    boolean_t label, boolean_t no_devlink_flag)
 {
 	struct lofi_ioctl li;
 
@@ -475,7 +477,7 @@ add_mapping(int lfd, const char *devicename, const char *filename,
 		char	path[MAXPATHLEN];
 
 		/* pick one via the driver */
-		minor = lofi_map_file(lfd, &li, filename);
+		minor = lofi_map_file(lfd, &li, filename, no_devlink_flag);
 		if (minor > 0) {
 			make_blkdevname(&li, path, sizeof (path));
 
@@ -500,7 +502,8 @@ add_mapping(int lfd, const char *devicename, const char *filename,
 		die(gettext("could not map file %s to %s"), filename,
 		    devicename);
 	}
-	wait_until_dev_complete(&li);
+	if (!no_devlink_flag)
+		wait_until_dev_complete(&li);
 }
 
 /*
@@ -1393,7 +1396,7 @@ lofi_uncompress(int lfd, const char *filename)
 	if (statbuf.st_size == 0)
 		return;
 
-	minor = lofi_map_file(lfd, &li, filename);
+	minor = lofi_map_file(lfd, &li, filename, B_FALSE);
 	(void) snprintf(devicename, sizeof (devicename), "/dev/%s/%d",
 	    LOFI_BLOCK_NAME, minor);
 
@@ -1935,6 +1938,7 @@ main(int argc, char *argv[])
 	boolean_t ephflag = B_FALSE;
 	boolean_t compressflag = B_FALSE;
 	boolean_t uncompressflag = B_FALSE;
+	boolean_t no_devlink_flag = B_FALSE;
 	/* the next two work together for -c, -k, -T, -e options only */
 	boolean_t need_crypto = B_FALSE;	/* if any -c, -k, -T, -e */
 	boolean_t cipher_only = B_TRUE;		/* if -c only */
@@ -1950,7 +1954,7 @@ main(int argc, char *argv[])
 	(void) setlocale(LC_ALL, "");
 	(void) textdomain(TEXT_DOMAIN);
 
-	while ((c = getopt(argc, argv, "a:c:Cd:efk:lrs:T:U")) != EOF) {
+	while ((c = getopt(argc, argv, "a:c:Cd:efk:lrs:T:UX")) != EOF) {
 		switch (c) {
 		case 'a':
 			addflag = B_TRUE;
@@ -2031,6 +2035,13 @@ main(int argc, char *argv[])
 		case 'U':
 			uncompressflag = B_TRUE;
 			break;
+		case 'X':
+			/*
+			 * Private flag to skip the wait for the /dev links to
+			 * be created.
+			 */
+			no_devlink_flag = B_TRUE;
+			break;
 		case '?':
 		default:
 			errflag = B_TRUE;
@@ -2163,7 +2174,7 @@ main(int argc, char *argv[])
 	 */
 	if (addflag)
 		add_mapping(lfd, devicename, filename, cipher, rkey, rksz,
-		    rdflag, labelflag);
+		    rdflag, labelflag, no_devlink_flag);
 	else if (compressflag)
 		lofi_compress(&lfd, filename, compress_index, segsize);
 	else if (uncompressflag)
diff --git a/usr/src/cmd/machid/Makefile b/usr/src/cmd/machid/Makefile
new file mode 100644
index 0000000000..6a3c7138dc
--- /dev/null
+++ b/usr/src/cmd/machid/Makefile
@@ -0,0 +1,80 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+# Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+PROG=	machid
+
+include ../Makefile.cmd
+
+#
+#	List of all links present on all architectures and machines.
+#
+#	Note that this function is obsolesent and we don't generally
+#	add to this list (see psarc/1992/171).
+#
+FIRSTLINK =	i286
+LINKS =		i386 i486 i860 i86pc iAPX286 \
+		m68k mc68000 mc68010 mc68020 mc68030 mc68040 \
+		sparc sun sun2 sun3 sun3x sun4 sun4c sun4m sun4d sun4e \
+		u370 u3b u3b15 u3b2 u3b5 vax pdp11
+
+ROOTFIRSTLINK =	$(ROOTBIN)/$(FIRSTLINK)
+ROOTLINKS =	$(LINKS:%=$(ROOTBIN)/%)
+
+#
+#     Install the program as the first machine in the list.
+#
+INSTALLIT=	$(INS.link)
+$(ROOTFIRSTLINK):=	INSTALLIT = $(INS.rename)
+$(ROOTLINKS):=		INSLINKTARGET = $(ROOTFIRSTLINK)
+
+$(ROOTLINKS):	$(ROOTFIRSTLINK)
+
+#
+#	Link installation rules
+#
+$(ROOTBIN)/%:	$(PROG)
+	$(INSTALLIT)
+
+$(ROOTFIRSTLINK): $(ROOTBIN)
+
+$(ROOTBIN):
+	$(INS.dir)
+
+CFLAGS += $(CCVERBOSE)
+
+.KEEP_STATE:
+
+all: $(PROG) 
+
+install: all $(ROOTLINKS)
+
+clean:
+
+lint:	lint_PROG
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/machid/machid.c b/usr/src/cmd/machid/machid.c
new file mode 100644
index 0000000000..c3d57b91f9
--- /dev/null
+++ b/usr/src/cmd/machid/machid.c
@@ -0,0 +1,137 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License, Version 1.0 only
+ * (the "License").  You may not use this file except in compliance
+ * with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright (c) 1993-1994, by Sun Microsystems, Inc.
+ */
+
+/*
+ * This program replicates the function of the links from a machine name
+ * (such as sun4c) through /usr/kvm to true or false as appropriate.  It
+ * knows the correct special cases.
+ *
+ * IMPORTANT NOTE:
+ *
+ * Do not modify this program to know about additional special cases or
+ * reflect new platforms or instruction set architectures.  This is a
+ * deprecated interface and strictly for backwards compatibility.  This
+ * is psarc/1992/171.  Note the following excerpt from the opinion:
+ *
+ *    It is most important to note that the manual page states in
+ *    the NOTES section:  "The machid family of commands is
+ *    obsolete.  Use uname -p and uname -m instead."
+ *
+ *    The intent of Kernel Architecture Project team is to provide
+ *    only enough functionality to mimic the existing definitions
+ *    on the SPARC and Intel x86 versions of Solaris 2.x.  No new
+ *    identifiers will ever be added to the documented and
+ *    undocumented identifiers listed above.
+ */
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <limits.h>
+#include <sys/systeminfo.h>
+
+static char	static_buf[SYS_NMLN];
+static char	*progname;
+
+static void get_info_item(int command, char **buf, long *count);
+
+/* ARGSUSED */
+int
+main(int argc, char *argv[], char *envp[])
+{
+	char	*buf = &static_buf[0];
+	long	buflen = SYS_NMLN;
+
+	if ((progname = strrchr(argv[0], '/')) == NULL)
+		progname = argv[0];
+	else
+		progname++;
+
+	/*
+	 * First possible match is on the processor type.
+	 *
+	 * Special case for architectures: i386 matches i486 and visa versa.
+	 */
+	get_info_item(SI_ARCHITECTURE, &buf, &buflen);
+	if (strcmp(buf, progname) == 0)
+		return (0);
+	if ((strcmp(buf, "i386") == 0 && strcmp(progname, "i486") == 0) ||
+	    (strcmp(buf, "i486") == 0 && strcmp(progname, "i386") == 0))
+		return (0);
+
+	/*
+	 * Next possible match is the machine, or more exactly, the value
+	 * which would be returned by uname(2) in the machine field or uname(1)
+	 * with the -m option.  For historical reasons this is really is
+	 * often a class of platforms which are identical to userland processes
+	 * such as sun4c, sun4m, etc.
+	 */
+	get_info_item(SI_MACHINE, &buf, &buflen);
+	if (strcmp(buf, progname) == 0)
+		return (0);
+
+	/*
+	 * Finally, match the vendor.  We hardwire in one historical match.
+	 */
+	get_info_item(SI_HW_PROVIDER, &buf, &buflen);
+	if (strcmp(buf, progname) == 0)
+		return (0);
+	if (strcasecmp(buf, "Sun_Microsystems") == 0 &&
+	    strcmp("sun", progname) == 0)
+		return (0);
+
+	return (255);
+}
+
+/*
+ * get_info_item is a wrapper around the sysinfo system call. It makes sure
+ * the buffer is large enough, returning a larger buffer if needed.  On
+ * unrecoverable error, it exits.  An error message doesn't help and makes
+ * this tiny program link stdio and maybe deal with internationalization,
+ * so the best thing is to die silently.  Note that the larger buffer is
+ * retained for later use.  Reality is that the buffer will always be big
+ * enough, but this is coded to the spec rather than implementation.
+ */
+static void
+get_info_item(int command, char **buf, long *count)
+{
+	long	error;
+
+	error = sysinfo(command, *buf, *count);
+	if (error > *count) {
+		*count = error;
+		if (*buf != static_buf) {
+			free(*buf);
+		}
+		*buf = (char *) malloc(*count);
+		error = sysinfo(command, *buf, *count);
+	}
+
+	if (error == -1)
+		exit(-1);
+}
diff --git a/usr/src/cmd/mailx/Makefile b/usr/src/cmd/mailx/Makefile
index 4fb19334f2..a690b95815 100644
--- a/usr/src/cmd/mailx/Makefile
+++ b/usr/src/cmd/mailx/Makefile
@@ -22,7 +22,7 @@
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# Copyright 2014 Joyent, Inc.
+# Copyright 2018 Joyent, Inc.
 #
 # cmd/mailx/Makefile
 
@@ -69,7 +69,7 @@ CERRWARN +=	-_gcc=-Wno-uninitialized
 CERRWARN +=	-_gcc=-Wno-unused-variable
 CERRWARN +=	-_gcc=-Wno-clobbered
 LINTFLAGS= 	-hb
-LDLIBS +=	-lmail -lcmdutils
+LDLIBS +=	-lmail -lcustr
 LDFLAGS +=	$(MAPFILE.NGB:%=-M%)
 
 CLOBBERFILES += $(MAILXHELP)
diff --git a/usr/src/cmd/mailx/hdr/def.h b/usr/src/cmd/mailx/hdr/def.h
index 2480cb84da..a343afab38 100644
--- a/usr/src/cmd/mailx/hdr/def.h
+++ b/usr/src/cmd/mailx/hdr/def.h
@@ -20,7 +20,7 @@
  */
 
 /*
- * Copyright 2014 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -65,7 +65,7 @@ extern "C" {
 #include <stdlib.h>
 #include <ulimit.h>
 #include <wait.h>
-#include <libcmdutils.h>
+#include <libcustr.h>
 #endif
 #ifdef VMUNIX
 #include <sys/wait.h>
diff --git a/usr/src/cmd/man/Makefile b/usr/src/cmd/man/Makefile
index 911bae6340..7c7afebb10 100644
--- a/usr/src/cmd/man/Makefile
+++ b/usr/src/cmd/man/Makefile
@@ -14,12 +14,7 @@
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
 #
 
-PROG=		man
-LINKS=		apropos whatis catman
-LIBLINKS =	makewhatis
-OBJS=		makewhatis.o man.o stringlist.o
-SRCS=		$(OBJS:%.o=%.c)
-
+include 	Makefile.com
 include		$(SRC)/cmd/Makefile.cmd
 
 CFLAGS +=	$(CCVERBOSE)
diff --git a/usr/src/cmd/man/Makefile.com b/usr/src/cmd/man/Makefile.com
new file mode 100644
index 0000000000..8f1b3adf7d
--- /dev/null
+++ b/usr/src/cmd/man/Makefile.com
@@ -0,0 +1,23 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2012 Nexenta Systems, Inc. All rights reserved.
+# Copyright 2014 Garrett D'Amore <garrett@damore.org>
+#
+
+PROG=		man
+LINKS=		apropos whatis catman
+LIBLINKS =	makewhatis
+OBJS=		makewhatis.o man.o stringlist.o
+SRCS=		$(OBJS:%.o=%.c)
+
+
diff --git a/usr/src/cmd/mdb/Makefile.common b/usr/src/cmd/mdb/Makefile.common
index 41de4dfdc2..b1f8835acd 100644
--- a/usr/src/cmd/mdb/Makefile.common
+++ b/usr/src/cmd/mdb/Makefile.common
@@ -100,6 +100,7 @@ COMMON_MODULES_KVM = \
 	stmf_sbd \
 	ufs \
 	usba \
+	xhci \
 	zfs
 
 CLOSED_COMMON_MODULES_KVM = \
diff --git a/usr/src/cmd/mdb/Makefile.module b/usr/src/cmd/mdb/Makefile.module
index 2c8da775da..b93681d85e 100644
--- a/usr/src/cmd/mdb/Makefile.module
+++ b/usr/src/cmd/mdb/Makefile.module
@@ -102,7 +102,7 @@ LINTFILES_raw		= $(LINTOBJS)
 LINTFILES		= $(LINTFILES_$(MDBTGT))
 
 #
-# Python specific flags. To try and make life easier for folks how are
+# Python specific flags. To try and make life easier for folks who are
 # building with an LFS python, we attempt to use -isystem when it's
 # available.
 #
@@ -110,6 +110,12 @@ PYCPPFLAGS		= -_gcc=-isystem -_gcc=$(ADJUNCT_PROTO)/usr/include/python$(PYTHON_V
 PYCPPFLAGS		+= -_cc=-I$(ADJUNCT_PROTO)/usr/include/python$(PYTHON_VERSION)
 PYLNFLAGS		= -I$(ADJUNCT_PROTO)/usr/include/python$(PYTHON_VERSION)
 
+#
+# At this time, we do not have python27 in the adjunct proto area, only
+# python26. As such, we explicitly override the python version dmod here.
+#
+PYTHON_VERSION		= 2.6
+
 kvm_TGTFLAGS		= -D_KERNEL
 proc_TGTFLAGS		= -D_USER
 
diff --git a/usr/src/cmd/mdb/common/kmdb/kaif_start.c b/usr/src/cmd/mdb/common/kmdb/kaif_start.c
index 6c0fc810bb..c6ecd84b70 100644
--- a/usr/src/cmd/mdb/common/kmdb/kaif_start.c
+++ b/usr/src/cmd/mdb/common/kmdb/kaif_start.c
@@ -21,10 +21,9 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * The main CPU-control loops, used to control masters and slaves.
  */
@@ -248,7 +247,7 @@ kaif_slave_loop(kaif_cpusave_t *cpusave)
 		} else if (slavecmd == KAIF_SLAVE_CMD_ACK) {
 			cpusave->krs_cpu_acked = 1;
 		} else if (cpusave->krs_cpu_acked &&
-			slavecmd == KAIF_SLAVE_CMD_SPIN) {
+		    slavecmd == KAIF_SLAVE_CMD_SPIN) {
 			cpusave->krs_cpu_acked = 0;
 #endif
 		}
@@ -292,13 +291,31 @@ kaif_main_loop(kaif_cpusave_t *cpusave)
 	int cmd;
 
 	if (kaif_master_cpuid == KAIF_MASTER_CPUID_UNSET) {
+
+		/*
+		 * Special case: Unload requested before first debugger entry.
+		 * Don't stop the world, as there's nothing to clean up that
+		 * can't be handled by the running kernel.
+		 */
 		if (!kmdb_dpi_resume_requested &&
 		    kmdb_kdi_get_unload_request()) {
-			/*
-			 * Special case: Unload requested before first debugger
-			 * entry.  Don't stop the world, as there's nothing to
-			 * clean up that can't be handled by the running kernel.
-			 */
+			cpusave->krs_cpu_state = KAIF_CPU_STATE_NONE;
+			return (KAIF_CPU_CMD_RESUME);
+		}
+
+		/*
+		 * We're a slave with no master, so just resume.  This can
+		 * happen if, prior to this, two CPUs both raced through
+		 * kdi_cmnint() - for example, a breakpoint on a frequently
+		 * called function.  The loser will be redirected to the slave
+		 * loop; note that the event itself is lost at this point.
+		 *
+		 * The winner will then cross-call that slave, but it won't
+		 * actually be received until the slave returns to the kernel
+		 * and enables interrupts.  We'll then come back in via
+		 * kdi_slave_entry() and hit this path.
+		 */
+		if (cpusave->krs_cpu_state == KAIF_CPU_STATE_SLAVE) {
 			cpusave->krs_cpu_state = KAIF_CPU_STATE_NONE;
 			return (KAIF_CPU_CMD_RESUME);
 		}
diff --git a/usr/src/cmd/mdb/common/kmdb/kmdb_promif.c b/usr/src/cmd/mdb/common/kmdb/kmdb_promif.c
index 81ac1eacfc..f39fb83c9b 100644
--- a/usr/src/cmd/mdb/common/kmdb/kmdb_promif.c
+++ b/usr/src/cmd/mdb/common/kmdb/kmdb_promif.c
@@ -742,10 +742,10 @@ kmdb_prom_debugger_exit(void)
 	mdb.m_pio = NULL;
 }
 
-#ifdef DEBUG
 /*
- * The prom_* files use ASSERT, which is #defined as assfail().
- * We need to redirect that to our assert function.
+ * The prom_* files use ASSERT, which is #defined as assfail().  We need to
+ * redirect that to our assert function. This is also used by the various STAND
+ * libraries.
  */
 int
 kmdb_prom_assfail(const char *assertion, const char *file, int line)
@@ -754,7 +754,6 @@ kmdb_prom_assfail(const char *assertion, const char *file, int line)
 	/*NOTREACHED*/
 	return (0);
 }
-#endif
 
 /*
  * Begin the initialization of the debugger/PROM interface.  Initialization is
diff --git a/usr/src/cmd/mdb/common/libstandctf/ctf_subr.c b/usr/src/cmd/mdb/common/libstandctf/ctf_subr.c
index 0a211fcd22..e8c703e754 100644
--- a/usr/src/cmd/mdb/common/libstandctf/ctf_subr.c
+++ b/usr/src/cmd/mdb/common/libstandctf/ctf_subr.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <mdb/mdb_debug.h>
 #include <mdb/mdb.h>
 
@@ -67,6 +65,13 @@ ctf_fdopen(int fd, int *errp)
 
 /*ARGSUSED*/
 ctf_file_t *
+ctf_fdcreate_int(int fd, int *errp, ctf_sect_t *ctfp)
+{
+	return (ctf_set_open_errno(errp, ENOTSUP));
+}
+
+/*ARGSUSED*/
+ctf_file_t *
 ctf_open(const char *filename, int *errp)
 {
 	return (ctf_set_open_errno(errp, ENOTSUP));
diff --git a/usr/src/cmd/mdb/common/mdb/mdb.h b/usr/src/cmd/mdb/common/mdb/mdb.h
index 7f712ad340..cb43f4828d 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb.h
+++ b/usr/src/cmd/mdb/common/mdb/mdb.h
@@ -25,7 +25,7 @@
 
 /*
  * Copyright (c) 2012 by Delphix. All rights reserved.
- * Copyright (c) 2012 Joyent, Inc. All rights reserved.
+ * Copyright (c) 2017 Joyent, Inc. All rights reserved.
  */
 
 #ifndef	_MDB_H
@@ -76,28 +76,29 @@ extern "C" {
 
 #define	MDB_ARR_NOLIMIT	-1UL	/* No limit on number of array elements */
 
-#define	MDB_FL_PSYM	0x00001	/* Print dot as symbol + offset when possible */
-#define	MDB_FL_LOG	0x00002	/* Logging is enabled */
-#define	MDB_FL_NOMODS	0x00004	/* Skip automatic mdb module loading */
-#define	MDB_FL_USECUP	0x00008	/* Use terminal cup initialization sequences */
-#define	MDB_FL_ADB	0x00010	/* Enable stricter adb(1) compatibility */
-#define	MDB_FL_SHOWLMID	0x00020	/* Always show link map id with symbol names */
-#define	MDB_FL_IGNEOF	0x00040	/* Ignore EOF as a synonym for ::quit */
-#define	MDB_FL_REPLAST	0x00080	/* Naked newline repeats previous command */
-#define	MDB_FL_PAGER	0x00100	/* Enable pager by default */
-#define	MDB_FL_LATEST	0x00200	/* Replace version string with "latest" */
-#define	MDB_FL_VCREATE	0x00400	/* Victim process was created by debugger */
-#define	MDB_FL_JOBCTL	0x00800	/* Victim process jobctl stopped on same tty */
-#define	MDB_FL_DEMANGLE	0x01000	/* Demangle symbols as part of %a processing */
-#define	MDB_FL_EXEC	0x02000	/* Debugger exec'd by a previous instance */
-#define	MDB_FL_NOCTF	0x04000	/* Skip automatic CTF data loading */
-#define	MDB_FL_BPTNOSYMSTOP 0x08000 /* Stop on deferred bkpts for unk symbols */
-#define	MDB_FL_TERMGUESS 0x10000 /* m_termtype derived from userland */
-#define	MDB_FL_READBACK	0x20000	/* Read value back after write */
+#define	MDB_FL_PSYM	0x000001	/* Print dot as symbol + offset */
+#define	MDB_FL_LOG	0x000002	/* Logging is enabled */
+#define	MDB_FL_NOMODS	0x000004	/* Skip automatic mdb module loading */
+#define	MDB_FL_USECUP	0x000008	/* Use term cup init sequences */
+#define	MDB_FL_ADB	0x000010	/* Enable stricter adb(1) compat */
+#define	MDB_FL_SHOWLMID	0x000020	/* Show link map id with symbol names */
+#define	MDB_FL_IGNEOF	0x000040	/* Ignore EOF as a synonym for ::quit */
+#define	MDB_FL_REPLAST	0x000080	/* Naked newline repeats prev command */
+#define	MDB_FL_PAGER	0x000100	/* Enable pager by default */
+#define	MDB_FL_LATEST	0x000200	/* Replace verstring with "latest" */
+#define	MDB_FL_VCREATE	0x000400	/* Victim process created by debugger */
+#define	MDB_FL_JOBCTL	0x000800	/* Victim process jobctl on same tty */
+#define	MDB_FL_DEMANGLE	0x001000	/* Demangle symbols as part of %a */
+#define	MDB_FL_EXEC	0x002000	/* Debugger exec'd by a prev instance */
+#define	MDB_FL_NOCTF	0x004000	/* Skip automatic CTF data loading */
+#define	MDB_FL_BPTNOSYMSTOP 0x008000	/* Stop on def bkpts for unk symbols */
+#define	MDB_FL_TERMGUESS 0x010000	/* m_termtype derived from userland */
+#define	MDB_FL_READBACK	0x020000	/* Read value back after write */
 #ifdef _KMDB
-#define	MDB_FL_NOUNLOAD	0x40000	/* Don't allow debugger unload */
+#define	MDB_FL_NOUNLOAD	0x040000	/* Don't allow debugger unload */
 #endif
-#define	MDB_FL_LMRAW	0x80000	/* Show unresolved link map object names */
+#define	MDB_FL_LMRAW	0x080000	/* Show unres link map object names */
+#define	MDB_FL_AUTOWRAP	0x100000	/* Autowrap lines at term width */
 
 #define	MDB_FL_VOLATILE	0x0001	/* Mask of all volatile flags to save/restore */
 
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_ctf.c b/usr/src/cmd/mdb/common/mdb/mdb_ctf.c
index dde087206c..af8fc7b0fd 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_ctf.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_ctf.c
@@ -23,8 +23,8 @@
  * Use is subject to license terms.
  */
 /*
+ * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
  * Copyright (c) 2013, 2016 by Delphix. All rights reserved.
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
  */
 
 #include <mdb/mdb_ctf.h>
@@ -37,6 +37,7 @@
 
 #include <libctf.h>
 #include <string.h>
+#include <limits.h>
 
 typedef struct tnarg {
 	mdb_tgt_t *tn_tgt;		/* target to use for lookup */
@@ -781,8 +782,9 @@ mdb_ctf_enum_iter(mdb_ctf_id_t id, mdb_ctf_enum_f *cb, void *data)
 /*
  * callback proxy for mdb_ctf_type_iter
  */
+/* ARGSUSED */
 static int
-type_iter_cb(ctf_id_t type, void *data)
+type_iter_cb(ctf_id_t type, boolean_t root, void *data)
 {
 	type_iter_t *tip = data;
 	mdb_ctf_id_t id;
@@ -812,7 +814,7 @@ mdb_ctf_type_iter(const char *object, mdb_ctf_type_f *cb, void *data)
 	ti.ti_arg = data;
 	ti.ti_fp = fp;
 
-	if ((ret = ctf_type_iter(fp, type_iter_cb, &ti)) == CTF_ERR)
+	if ((ret = ctf_type_iter(fp, B_FALSE, type_iter_cb, &ti)) == CTF_ERR)
 		return (set_errno(ctf_to_errno(ctf_errno(fp))));
 
 	return (ret);
@@ -1821,7 +1823,6 @@ mdb_ctf_synthetics_create_base(int kind)
 	return (0);
 
 discard:
-	err = set_errno(ctf_to_errno(ctf_errno(cp)));
 	(void) ctf_discard(cp);
 	return (err);
 }
@@ -1980,7 +1981,7 @@ mdb_ctf_add_member(const mdb_ctf_id_t *p, const char *name,
 		return (set_errno(ctf_to_errno(ctf_errno(mdb.m_synth))));
 	}
 
-	id = ctf_add_member(mdb.m_synth, mcip->mci_id, name, mtid);
+	id = ctf_add_member(mdb.m_synth, mcip->mci_id, name, mtid, ULONG_MAX);
 	if (id == CTF_ERR) {
 		mdb_dprintf(MDB_DBG_CTF, "failed to add member %s: %s\n",
 		    name, ctf_errmsg(ctf_errno(mdb.m_synth)));
@@ -2081,7 +2082,7 @@ mdb_ctf_add_pointer(const mdb_ctf_id_t *p, mdb_ctf_id_t *rid)
 	}
 
 
-	id = ctf_add_pointer(mdb.m_synth, CTF_ADD_ROOT, id);
+	id = ctf_add_pointer(mdb.m_synth, CTF_ADD_ROOT, NULL, id);
 	if (id == CTF_ERR) {
 		mdb_dprintf(MDB_DBG_CTF, "failed to add pointer: %s\n",
 		    ctf_errmsg(ctf_errno(mdb.m_synth)));
@@ -2129,6 +2130,7 @@ mdb_ctf_type_delete(const mdb_ctf_id_t *id)
 	return (0);
 }
 
+/* ARGSUSED */
 static int
 mdb_ctf_synthetics_file_cb(mdb_ctf_id_t id, void *arg)
 {
@@ -2166,7 +2168,7 @@ mdb_ctf_synthetics_from_file(const char *file)
 	ti.ti_fp = fp;
 	ti.ti_arg = syn;
 	ti.ti_cb = mdb_ctf_synthetics_file_cb;
-	if (ctf_type_iter(fp, type_iter_cb, &ti) == CTF_ERR) {
+	if (ctf_type_iter(fp, B_FALSE, type_iter_cb, &ti) == CTF_ERR) {
 		ret = set_errno(ctf_to_errno(ctf_errno(fp)));
 		mdb_warn("failed to add types");
 		goto cleanup;
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_debug.c b/usr/src/cmd/mdb/common/mdb/mdb_debug.c
index d373d3726e..a158864a28 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_debug.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_debug.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <mdb/mdb_debug.h>
 #include <mdb/mdb_err.h>
 #include <mdb/mdb_io.h>
@@ -157,7 +155,6 @@ mdb_dmode(uint_t bits)
 	mdb.m_debug = bits;
 }
 
-#ifdef DEBUG
 int
 mdb_dassert(const char *expr, const char *file, int line)
 {
@@ -165,7 +162,6 @@ mdb_dassert(const char *expr, const char *file, int line)
 	/*NOTREACHED*/
 	return (0);
 }
-#endif
 
 /*
  * Function to convert mdb longjmp codes (see <mdb/mdb.h>) into a string for
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_debug.h b/usr/src/cmd/mdb/common/mdb/mdb_debug.h
index cf3b97b499..f889238e4f 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_debug.h
+++ b/usr/src/cmd/mdb/common/mdb/mdb_debug.h
@@ -27,8 +27,6 @@
 #ifndef	_MDB_DEBUG_H
 #define	_MDB_DEBUG_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #ifdef	__cplusplus
 extern "C" {
 #endif
@@ -66,8 +64,8 @@ extern void mdb_dmode(uint_t);
 
 extern const char *mdb_err2str(int);
 
-#ifdef DEBUG
 extern int mdb_dassert(const char *, const char *, int);
+#ifdef DEBUG
 #define	ASSERT(x)	((void)((x) || mdb_dassert(#x, __FILE__, __LINE__)))
 #else
 #define	ASSERT(x)
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_demangle.c b/usr/src/cmd/mdb/common/mdb/mdb_demangle.c
index 7ab7d19716..27c8a1d21d 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_demangle.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_demangle.c
@@ -24,7 +24,9 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ */
 
 #include <mdb/mdb_modapi.h>
 #include <mdb/mdb_demangle.h>
@@ -263,7 +265,8 @@ int
 cmd_demangle(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 {
 	mdb_demangler_t *dmp = mdb.m_demangler;
-	const char *path = LIB_DEMANGLE;
+	const char *path;
+	char buf[MAXPATHLEN];
 
 	if (argc > 1 || (argc > 0 && argv->a_type != MDB_TYPE_STRING))
 		return (DCMD_USAGE);
@@ -272,6 +275,10 @@ cmd_demangle(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 		if (dmp != NULL)
 			mdb_dem_unload(mdb.m_demangler);
 		path = argv->a_un.a_str;
+	} else {
+		(void) snprintf(buf, MAXPATHLEN,
+		    "%s/%s", mdb.m_root, LIB_DEMANGLE);
+		path = buf;
 	}
 
 	if (dmp != NULL && argc == 0 && !(mdb.m_flags & MDB_FL_DEMANGLE)) {
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_io.c b/usr/src/cmd/mdb/common/mdb/mdb_io.c
index a1ebc1ebc2..b8c04bcd06 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_io.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_io.c
@@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc. All rights reserved.
  * Copyright (c) 2016 by Delphix. All rights reserved.
  */
 
@@ -155,13 +155,17 @@ typedef struct {
 #define	CTRL(c)	((c) & 0x01f)
 #endif
 
+#define	IOB_AUTOWRAP(iob)	\
+	((mdb.m_flags & MDB_FL_AUTOWRAP) && \
+	((iob)->iob_flags & MDB_IOB_AUTOWRAP))
+
 /*
  * Define macro for determining if we should automatically wrap to the next
  * line of output, based on the amount of consumed buffer space and the
  * specified size of the next thing to be inserted (n).
  */
 #define	IOB_WRAPNOW(iob, n)	\
-	(((iob)->iob_flags & MDB_IOB_AUTOWRAP) && ((iob)->iob_nbytes != 0) && \
+	(IOB_AUTOWRAP(iob) && (iob)->iob_nbytes != 0 && \
 	((n) + (iob)->iob_nbytes > (iob)->iob_cols))
 
 /*
@@ -414,7 +418,7 @@ void
 mdb_iob_destroy(mdb_iob_t *iob)
 {
 	/*
-	 * Don't flush a pipe, since it may cause a context swith when the
+	 * Don't flush a pipe, since it may cause a context switch when the
 	 * other side has already been destroyed.
 	 */
 	if (!mdb_iob_isapipe(iob))
@@ -1809,7 +1813,7 @@ mdb_iob_nputs(mdb_iob_t *iob, const char *s, size_t nbytes)
 	 * flush the buffer if we reach the end of a line.
 	 */
 	while (nleft != 0) {
-		if (iob->iob_flags & MDB_IOB_AUTOWRAP) {
+		if (IOB_AUTOWRAP(iob)) {
 			ASSERT(iob->iob_cols >= iob->iob_nbytes);
 			n = iob->iob_cols - iob->iob_nbytes;
 		} else {
@@ -1827,10 +1831,11 @@ mdb_iob_nputs(mdb_iob_t *iob, const char *s, size_t nbytes)
 		iob->iob_nbytes += m;
 
 		if (m == n && nleft != 0) {
-			if (iob->iob_flags & MDB_IOB_AUTOWRAP)
+			if (IOB_AUTOWRAP(iob)) {
 				mdb_iob_nl(iob);
-			else
+			} else {
 				mdb_iob_flush(iob);
+			}
 		}
 	}
 }
@@ -1876,7 +1881,7 @@ mdb_iob_fill(mdb_iob_t *iob, int c, size_t nfill)
 	ASSERT(iob->iob_flags & MDB_IOB_WRONLY);
 
 	while (nfill != 0) {
-		if (iob->iob_flags & MDB_IOB_AUTOWRAP) {
+		if (IOB_AUTOWRAP(iob)) {
 			ASSERT(iob->iob_cols >= iob->iob_nbytes);
 			n = iob->iob_cols - iob->iob_nbytes;
 		} else {
@@ -1893,10 +1898,11 @@ mdb_iob_fill(mdb_iob_t *iob, int c, size_t nfill)
 		nfill -= m;
 
 		if (m == n && nfill != 0) {
-			if (iob->iob_flags & MDB_IOB_AUTOWRAP)
+			if (IOB_AUTOWRAP(iob)) {
 				mdb_iob_nl(iob);
-			else
+			} else {
 				mdb_iob_flush(iob);
+			}
 		}
 	}
 }
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_main.c b/usr/src/cmd/mdb/common/mdb/mdb_main.c
index 7feec28a40..ab8ffb80cd 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_main.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_main.c
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
 #include <sys/types.h>
@@ -51,6 +51,7 @@
 #include <libctf.h>
 #include <errno.h>
 #include <kvm.h>
+#include <zone.h>
 
 #include <mdb/mdb_lex.h>
 #include <mdb/mdb_debug.h>
@@ -797,9 +798,15 @@ main(int argc, char *argv[], char *envp[])
 		if (strchr(pidarg, '/') != NULL)
 			(void) mdb_iob_snprintf(object, MAXPATHLEN,
 			    "%s/object/a.out", pidarg);
-		else
+		else {
+			const char *root;
+
 			(void) mdb_iob_snprintf(object, MAXPATHLEN,
-			    "/proc/%s/object/a.out", pidarg);
+			    "%s/proc/%s/object/a.out",
+			    (root = zone_get_nroot()) != NULL ? root : "",
+			    pidarg);
+		}
+
 		tgt_argv[tgt_argc++] = object;
 		tgt_argv[tgt_argc++] = pidarg;
 	}
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_modapi.h b/usr/src/cmd/mdb/common/mdb/mdb_modapi.h
index 4e5d54d7d1..f9a2baa323 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_modapi.h
+++ b/usr/src/cmd/mdb/common/mdb/mdb_modapi.h
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2013 by Delphix. All rights reserved.
- * Copyright (c) 2012 Joyent, Inc. All rights reserved.
+ * Copyright (c) 2013 Joyent, Inc. All rights reserved.
  */
 
 #ifndef	_MDB_MODAPI_H
@@ -66,7 +66,13 @@ extern "C" {
 #define	MAX(x, y) ((x) > (y) ? (x) : (y))
 #endif
 
+#ifdef MDB_API_VERSION
+#if (MDB_API_VERSION != 3 && MDB_API_VERSION != 4)
+#error "Only modapi versions three and four are supported."
+#endif
+#else /* !MDB_API_VERISON */
 #define	MDB_API_VERSION	4	/* Current API version number */
+#endif /* MDB_API_VERISON */
 
 /*
  * Debugger command function flags:
@@ -80,11 +86,6 @@ extern "C" {
 #define	DCMD_HDRSPEC(fl)	(((fl) & DCMD_LOOPFIRST) || !((fl) & DCMD_LOOP))
 
 /*
- * Debugger tab command function flags
- */
-#define	DCMD_TAB_SPACE	0x01	/* Tab cb invoked with trailing space */
-
-/*
  * Debugger command function return values:
  */
 #define	DCMD_OK		0	/* Dcmd completed successfully */
@@ -113,10 +114,18 @@ typedef struct mdb_arg {
 	} a_un;
 } mdb_arg_t;
 
+#if (MDB_API_VERSION >= 4)
+/*
+ * Debugger tab command function flags
+ */
+#define	DCMD_TAB_SPACE	0x01	/* Tab cb invoked with trailing space */
+
 typedef struct mdb_tab_cookie mdb_tab_cookie_t;
-typedef int mdb_dcmd_f(uintptr_t, uint_t, int, const mdb_arg_t *);
 typedef int mdb_dcmd_tab_f(mdb_tab_cookie_t *, uint_t, int,
     const mdb_arg_t *);
+#endif /* MDB_API_VERSION >= 4 */
+
+typedef int mdb_dcmd_f(uintptr_t, uint_t, int, const mdb_arg_t *);
 
 typedef struct mdb_dcmd {
 	const char *dc_name;		/* Command name */
@@ -124,7 +133,9 @@ typedef struct mdb_dcmd {
 	const char *dc_descr;		/* Description */
 	mdb_dcmd_f *dc_funcp;		/* Command function */
 	void (*dc_help)(void);		/* Command help function (or NULL) */
+#if (MDB_API_VERSION >= 4)
 	mdb_dcmd_tab_f *dc_tabp;	/* Tab completion function */
+#endif
 } mdb_dcmd_t;
 
 #define	WALK_ERR	-1		/* Walk fatal error (terminate walk) */
@@ -341,6 +352,7 @@ typedef void (*mdb_callback_f)(void *);
 extern void *mdb_callback_add(int, mdb_callback_f, void *);
 extern void mdb_callback_remove(void *);
 
+#if (MDB_API_VERSION >= 4)
 #define	MDB_TABC_ALL_TYPES	0x1	/* Include array types in type output */
 #define	MDB_TABC_MEMBERS	0x2	/* Tab comp. types with members */
 #define	MDB_TABC_NOPOINT	0x4	/* Tab comp. everything but pointers */
@@ -365,6 +377,7 @@ extern int mdb_tab_typename(int *, const mdb_arg_t **, char *buf, size_t len);
  */
 extern int mdb_tab_complete_mt(mdb_tab_cookie_t *, uint_t, int,
     const mdb_arg_t *);
+#endif /* MDB_API_VERSION >= 4 */
 
 extern size_t strlcat(char *, const char *, size_t);
 extern char *strcat(char *, const char *);
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_print.c b/usr/src/cmd/mdb/common/mdb/mdb_print.c
index 3a083d4ac0..fe74265b68 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_print.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_print.c
@@ -2106,10 +2106,10 @@ cmd_print_tab_common(mdb_tab_cookie_t *mcp, uint_t flags, int argc,
 
 	/*
 	 * This is the reason that tab completion was created. We're going to go
-	 * along and walk the delimiters until we find something a member that
-	 * we don't recognize, at which point we'll try and tab complete it.
-	 * Note that ::print takes multiple args, so this is going to operate on
-	 * whatever the last arg that we have is.
+	 * along and walk the delimiters until we find something in a member
+	 * that we don't recognize, at which point we'll try and tab complete
+	 * it.  Note that ::print takes multiple args, so this is going to
+	 * operate on whatever the last arg that we have is.
 	 */
 	if (mdb_ctf_lookup_by_name(tn, &id) != 0)
 		return (1);
@@ -2119,11 +2119,11 @@ cmd_print_tab_common(mdb_tab_cookie_t *mcp, uint_t flags, int argc,
 	delim = parse_delimiter(&start);
 
 	/*
-	 * If we hit the case where we actually have no delimiters, than we need
+	 * If we hit the case where we actually have no delimiters, then we need
 	 * to make sure that we properly set up the fields the loops would.
 	 */
 	if (delim == MEMBER_DELIM_DONE)
-		(void) mdb_snprintf(member, sizeof (member), "%s", start);
+		(void) mdb_snprintf(member, sizeof (member), start);
 
 	while (delim != MEMBER_DELIM_DONE) {
 		switch (delim) {
@@ -2180,7 +2180,7 @@ cmd_print_tab_common(mdb_tab_cookie_t *mcp, uint_t flags, int argc,
 
 		/*
 		 * We are going to try to resolve this name as a member. There
-		 * are a few two different questions that we need to answer. The
+		 * are a two different questions that we need to answer. The
 		 * first is do we recognize this member. The second is are we at
 		 * the end of the string. If we encounter a member that we don't
 		 * recognize before the end, then we have to error out and can't
@@ -2210,6 +2210,7 @@ cmd_print_tab_common(mdb_tab_cookie_t *mcp, uint_t flags, int argc,
 	 * already have in rid.
 	 */
 	return (mdb_tab_complete_member_by_id(mcp, rid, member));
+
 }
 
 int
@@ -2539,8 +2540,7 @@ print_help(void)
 }
 
 static int
-printf_signed(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt,
-    boolean_t sign)
+printf_signed(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt, int sign)
 {
 	ssize_t size;
 	mdb_ctf_id_t base;
@@ -2558,7 +2558,7 @@ printf_signed(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt,
 	} u;
 
 	if (mdb_ctf_type_resolve(id, &base) == -1) {
-		mdb_warn("could not resolve type");
+		mdb_warn("could not resolve type\n");
 		return (DCMD_ABORT);
 	}
 
@@ -2796,7 +2796,6 @@ printf_string(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt)
 	if (size != 1) {
 		mdb_warn("string format specifier requires "
 		    "an array of characters\n");
-		return (DCMD_ABORT);
 	}
 
 	bzero(buf, sizeof (buf));
@@ -2930,7 +2929,7 @@ cmd_printf(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 
 	if (argc == 0 || argv[0].a_type != MDB_TYPE_STRING) {
 		mdb_warn("expected a format string\n");
-		return (DCMD_USAGE);
+		return (DCMD_ABORT);
 	}
 
 	/*
@@ -2939,12 +2938,6 @@ cmd_printf(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	 * subset of mdb_printf() format strings that we allow.
 	 */
 	fmt = argv[0].a_un.a_str;
-	/*
-	 * 'dest' must be large enough to hold a copy of the format string,
-	 * plus a NUL and up to 2 additional characters for each conversion
-	 * in the format string.  This gives us a bloat factor of 5/2 ~= 3.
-	 *   e.g. "%d" (strlen of 2) --> "%lld\0" (need 5 bytes)
-	 */
 	dest = mdb_zalloc(strlen(fmt) * 3, UM_SLEEP | UM_GC);
 	fmts = mdb_zalloc(strlen(fmt) * sizeof (char *), UM_SLEEP | UM_GC);
 	funcs = mdb_zalloc(strlen(fmt) * sizeof (void *), UM_SLEEP | UM_GC);
@@ -3128,22 +3121,22 @@ static char _mdb_printf_help[] =
 "\n"
 "  %%    Prints the '%' symbol.\n"
 "  %a    Prints the member in symbolic form.\n"
-"  %d    Prints the member as a decimal integer.  If the member is a signed\n"
+"  %d    Prints the member as a decimal integer. If the member is a signed\n"
 "        integer type, the output will be signed.\n"
 "  %H    Prints the member as a human-readable size.\n"
 "  %I    Prints the member as an IPv4 address (must be 32-bit integer type).\n"
 "  %N    Prints the member as an IPv6 address (must be of type in6_addr_t).\n"
 "  %o    Prints the member as an unsigned octal integer.\n"
 "  %p    Prints the member as a pointer, in hexadecimal.\n"
-"  %q    Prints the member in signed octal.  Honk if you ever use this!\n"
-"  %r    Prints the member as an unsigned value in the current output radix.\n"
-"  %R    Prints the member as a signed value in the current output radix.\n"
+"  %q    Prints the member in signed octal. Honk if you ever use this!\n"
+"  %r    Prints the member as an unsigned value in the current output radix. \n"
+"  %R    Prints the member as a signed value in the current output radix. \n"
 "  %s    Prints the member as a string (requires a pointer or an array of\n"
 "        characters).\n"
 "  %u    Prints the member as an unsigned decimal integer.\n"
 "  %x    Prints the member in hexadecimal.\n"
 "  %X    Prints the member in hexadecimal, using the characters A-F as the\n"
-"        digits for the values 10-15.\n"
+"        digits for the values 10-15. \n"
 "  %Y    Prints the member as a time_t as the string "
 	    "'year month day HH:MM:SS'.\n"
 "\n"
@@ -3156,13 +3149,13 @@ static char _mdb_printf_help[] =
 "\n"
 "The following flag specifers are recognized by ::printf:\n"
 "\n"
-"  %-    Left-justify the output within the specified field width.  If the\n"
+"  %-    Left-justify the output within the specified field width. If the\n"
 "        width of the output is less than the specified field width, the\n"
-"        output will be padded with blanks on the right-hand side.  Without\n"
+"        output will be padded with blanks on the right-hand side. Without\n"
 "        %-, values are right-justified by default.\n"
 "\n"
 "  %0    Zero-fill the output field if the output is right-justified and the\n"
-"        width of the output is less than the specified field width.  Without\n"
+"        width of the output is less than the specified field width. Without\n"
 "        %0, right-justified values are prepended with blanks in order to\n"
 "        fill the field.\n"
 "\n"
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_set.c b/usr/src/cmd/mdb/common/mdb/mdb_set.c
index c1c8538219..cd8926fbcc 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_set.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_set.c
@@ -24,6 +24,10 @@
  */
 
 /*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
  * Support for ::set dcmd.  The +/-o option processing code is provided in a
  * stand-alone function so it can be used by the command-line option processing
  * code in mdb_main.c.  This facility provides an easy way for us to add more
@@ -165,6 +169,7 @@ mdb_set_options(const char *s, int enable)
 		{ "pager", opt_pager, MDB_FL_PAGER },
 		{ "term", opt_set_term, 0 },
 
+		{ "autowrap", opt_set_mflags, MDB_FL_AUTOWRAP },
 		{ "ignoreeof", opt_set_mflags, MDB_FL_IGNEOF },
 		{ "repeatlast", opt_set_mflags, MDB_FL_REPLAST },
 		{ "latest", opt_set_mflags, MDB_FL_LATEST },
@@ -265,6 +270,13 @@ print_properties(void)
 	mdb_printf("%*s ", LABEL_INDENT, "debugger options:");
 	(void) mdb_inc_indent(LABEL_INDENT + 1);
 
+	/*
+	 * The ::set output implicitly relies on "autowrap" being enabled, so
+	 * we enable it for the duration of the command.
+	 */
+	oflags = mdb.m_flags;
+	mdb.m_flags |= MDB_FL_AUTOWRAP;
+
 	mdb_printf("follow_exec_mode=");
 	switch (mdb.m_execmode) {
 	case MDB_EM_ASK:
@@ -295,6 +307,8 @@ print_properties(void)
 
 	if (mdb.m_flags & MDB_FL_ADB)
 		COMMAFLAG("adb");
+	if (oflags & MDB_FL_AUTOWRAP)
+		COMMAFLAG("autowrap");
 	if (mdb.m_flags & MDB_FL_IGNEOF)
 		COMMAFLAG("ignoreeof");
 	if (mdb.m_flags & MDB_FL_LMRAW)
@@ -331,6 +345,8 @@ print_properties(void)
 		COMMAFLAG("no-stop");
 	mdb_printf("\n");
 	(void) mdb_dec_indent(LABEL_INDENT + 1);
+
+	mdb.m_flags = oflags;
 }
 
 /*ARGSUSED*/
diff --git a/usr/src/cmd/mdb/common/mdb/mdb_tab.c b/usr/src/cmd/mdb/common/mdb/mdb_tab.c
index af32623470..66bd18586e 100644
--- a/usr/src/cmd/mdb/common/mdb/mdb_tab.c
+++ b/usr/src/cmd/mdb/common/mdb/mdb_tab.c
@@ -388,11 +388,6 @@ mdb_tab_size(mdb_tab_cookie_t *mcp)
 	return (mdb_nv_size(&mcp->mtc_nv));
 }
 
-/*
- * Determine whether the specified name is a valid tab completion for
- * the given command. If the name is a valid tab completion then
- * it will be saved in the mdb_tab_cookie_t.
- */
 void
 mdb_tab_insert(mdb_tab_cookie_t *mcp, const char *name)
 {
@@ -508,31 +503,18 @@ tab_complete_type(mdb_ctf_id_t id, void *arg)
 	mdb_tab_cookie_t *mcp = arg;
 	uint_t flags = (uint_t)(uintptr_t)mcp->mtc_cba;
 
-	/*
-	 * CTF data includes types that mdb commands don't understand. Before
-	 * we resolve the actual type prune any entry that is a type we
-	 * don't care about.
-	 */
-	switch (mdb_ctf_type_kind(id)) {
-	case CTF_K_CONST:
-	case CTF_K_RESTRICT:
-	case CTF_K_VOLATILE:
-		return (0);
-	}
-
 	if (mdb_ctf_type_resolve(id, &rid) != 0)
 		return (1);
 
 	rkind = mdb_ctf_type_kind(rid);
-
-	if ((flags & MDB_TABC_MEMBERS) && rkind != CTF_K_STRUCT &&
+	if (flags & MDB_TABC_MEMBERS && rkind != CTF_K_STRUCT &&
 	    rkind != CTF_K_UNION)
 		return (0);
 
-	if ((flags & MDB_TABC_NOPOINT) && rkind == CTF_K_POINTER)
+	if (flags & MDB_TABC_NOPOINT && rkind == CTF_K_POINTER)
 		return (0);
 
-	if ((flags & MDB_TABC_NOARRAY) && rkind == CTF_K_ARRAY)
+	if (flags & MDB_TABC_NOARRAY && rkind == CTF_K_ARRAY)
 		return (0);
 
 	(void) mdb_ctf_type_name(id, buf, sizeof (buf));
diff --git a/usr/src/cmd/mdb/common/modules/dtrace/dtrace.c b/usr/src/cmd/mdb/common/modules/dtrace/dtrace.c
index b2ff5d9671..d2885c75a7 100644
--- a/usr/src/cmd/mdb/common/modules/dtrace/dtrace.c
+++ b/usr/src/cmd/mdb/common/modules/dtrace/dtrace.c
@@ -433,6 +433,7 @@ dtracemdb_bufsnap(dtrace_buffer_t *which, dtrace_bufdesc_t *desc)
 	desc->dtbd_size = bufsize;
 	desc->dtbd_drops = buf.dtb_drops;
 	desc->dtbd_errors = buf.dtb_errors;
+	desc->dtbd_timestamp = gethrtime();
 
 	return (0);
 }
diff --git a/usr/src/cmd/mdb/common/modules/genunix/ctxop.c b/usr/src/cmd/mdb/common/modules/genunix/ctxop.c
index 302ffa03c9..bf2815dfdb 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/ctxop.c
+++ b/usr/src/cmd/mdb/common/modules/genunix/ctxop.c
@@ -23,56 +23,97 @@
  * Copyright (c) 2000 by Sun Microsystems, Inc.
  * All rights reserved.
  */
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
-#include <sys/mdb_modapi.h>
-#include <sys/thread.h>
+#include <mdb/mdb_modapi.h>
+#include <mdb/mdb_ctf.h>
 #include "ctxop.h"
 
+struct ctxop_walk_state {
+	uintptr_t	cws_head;
+	uint_t		cws_next_offset;
+};
+
 int
 ctxop_walk_init(mdb_walk_state_t *wsp)
 {
-	kthread_t thread, *tp = &thread;
+	struct ctxop_walk_state *priv;
+	int offset;
+	uintptr_t addr;
 
 	if (wsp->walk_addr == NULL) {
 		mdb_warn("must specify thread for ctxop walk\n");
 		return (WALK_ERR);
 	}
-	if (mdb_vread(tp, sizeof (*tp), wsp->walk_addr) == -1) {
-		mdb_warn("failed to read thread at %p", wsp->walk_addr);
+
+	offset = mdb_ctf_offsetof_by_name("kthread_t", "t_ctx");
+	if (offset == -1)
 		return (WALK_ERR);
+
+	if (mdb_vread(&addr, sizeof (addr),
+	    wsp->walk_addr + offset) != sizeof (addr)) {
+		mdb_warn("failed to read thread %p", wsp->walk_addr);
+		return (WALK_ERR);
+	}
+
+	/* No further work for threads with a NULL t_ctx */
+	if (addr == 0) {
+		wsp->walk_data = NULL;
+		return (WALK_DONE);
 	}
 
-	wsp->walk_data = mdb_alloc(sizeof (ctxop_t), UM_SLEEP);
-	wsp->walk_addr = (uintptr_t)tp->t_ctx;
+	/* rely on CTF for the offset of the 'next' pointer */
+	offset = mdb_ctf_offsetof_by_name("struct ctxop", "next");
+	if (offset == -1)
+		return (WALK_ERR);
+
+	priv = mdb_alloc(sizeof (*priv), UM_SLEEP);
+	priv->cws_head = addr;
+	priv->cws_next_offset = (uint_t)offset;
 
+	wsp->walk_data = priv;
+	wsp->walk_addr = addr;
 	return (WALK_NEXT);
 }
 
 int
 ctxop_walk_step(mdb_walk_state_t *wsp)
 {
+	struct ctxop_walk_state *priv = wsp->walk_data;
+	uintptr_t next;
 	int status;
 
-	if (wsp->walk_addr == NULL)
-		return (WALK_DONE);
-
-	if (mdb_vread(wsp->walk_data,
-	    sizeof (ctxop_t), wsp->walk_addr) == -1) {
-		mdb_warn("failed to read ctxop at %p", wsp->walk_addr);
+	if (mdb_vread(&next, sizeof (next),
+	    wsp->walk_addr + priv->cws_next_offset) == -1) {
+		mdb_warn("failed to read ctxop`next at %p",
+		    wsp->walk_addr + priv->cws_next_offset);
 		return (WALK_DONE);
 	}
 
-	status = wsp->walk_callback(wsp->walk_addr, wsp->walk_data,
-	    wsp->walk_cbdata);
+	status = wsp->walk_callback(wsp->walk_addr, NULL, wsp->walk_cbdata);
 
-	wsp->walk_addr = (uintptr_t)(((ctxop_t *)wsp->walk_data)->next);
+	if (status == WALK_NEXT) {
+		/*
+		 * If a NULL terminator or a loop back to the head element is
+		 * encountered, the walk is done.
+		 */
+		if (next == 0 || next == priv->cws_head) {
+			status = WALK_DONE;
+		}
+	}
+
+	wsp->walk_addr = next;
 	return (status);
 }
 
 void
 ctxop_walk_fini(mdb_walk_state_t *wsp)
 {
-	mdb_free(wsp->walk_data, sizeof (ctxop_t));
+	struct ctxop_walk_state *priv = wsp->walk_data;
+
+	if (priv != NULL) {
+		mdb_free(priv, sizeof (*priv));
+	}
 }
diff --git a/usr/src/cmd/mdb/common/modules/genunix/ctxop.h b/usr/src/cmd/mdb/common/modules/genunix/ctxop.h
index 529db3844c..0d0af0b931 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/ctxop.h
+++ b/usr/src/cmd/mdb/common/modules/genunix/ctxop.h
@@ -27,8 +27,6 @@
 #ifndef	_MDB_CTXOP_H
 #define	_MDB_CTXOP_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <mdb/mdb_modapi.h>
 
 #ifdef	__cplusplus
diff --git a/usr/src/cmd/mdb/common/modules/genunix/genunix.c b/usr/src/cmd/mdb/common/modules/genunix/genunix.c
index 425911d112..9da3c5eba0 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/genunix.c
+++ b/usr/src/cmd/mdb/common/modules/genunix/genunix.c
@@ -21,7 +21,7 @@
 /*
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright (c) 2017, Joyent, Inc.
  * Copyright (c) 2013 by Delphix. All rights reserved.
  */
 
@@ -114,10 +114,6 @@
  */
 #define	NINTR		16
 
-#define	KILOS		10
-#define	MEGS		20
-#define	GIGS		30
-
 #ifndef STACK_BIAS
 #define	STACK_BIAS	0
 #endif
@@ -164,8 +160,15 @@ ps_threadprint(uintptr_t addr, const void *data, void *private)
 	if (prt_flags & PS_PRTTHREADS)
 		mdb_printf("\tT  %?a <%b>\n", addr, t->t_state, t_state_bits);
 
-	if (prt_flags & PS_PRTLWPS)
-		mdb_printf("\tL  %?a ID: %u\n", t->t_lwp, t->t_tid);
+	if (prt_flags & PS_PRTLWPS) {
+		char name[THREAD_NAME_MAX];
+
+		mdb_printf("\tL  %?a ID: %u", t->t_lwp, t->t_tid);
+		if (thread_getname(addr, name, sizeof (name))) {
+			mdb_printf(" NAME: %s", name);
+		}
+		mdb_printf("\n");
+	}
 
 	return (WALK_NEXT);
 }
@@ -2033,24 +2036,24 @@ typedef struct datafmt {
 } datafmt_t;
 
 static datafmt_t kmemfmt[] = {
-	{ "cache                    ", "name                     ",
-	"-------------------------", "%-25s "				},
-	{ "   buf",	"  size",	"------",	"%6u "		},
-	{ "   buf",	"in use",	"------",	"%6u "		},
-	{ "   buf",	" total",	"------",	"%6u "		},
-	{ "   memory",	"   in use",	"----------",	"%10lu%c "	},
-	{ "    alloc",	"  succeed",	"---------",	"%9u "		},
-	{ "alloc",	" fail",	"-----",	"%5u "		},
+	{ "cache                         ", "name                          ",
+	"------------------------------", "%-30s "			},
+	{ "  buf",	" size",	"-----",	"%5H "		},
+	{ "      buf",	"   in use",	"---------",	"%9u "		},
+	{ "      buf",	"    total",	"---------",	"%9u "		},
+	{ "memory",	"in use",	"------",	"%6lH "		},
+	{ "     alloc",	"   succeed",	"----------",	"%10u "		},
+	{ "alloc",	" fail",	"-----",	"%5u"		},
 	{ NULL,		NULL,		NULL,		NULL		}
 };
 
 static datafmt_t vmemfmt[] = {
-	{ "vmem                     ", "name                     ",
-	"-------------------------", "%-*s "				},
-	{ "   memory",	"   in use",	"----------",	"%9llu%c "	},
-	{ "    memory",	"     total",	"-----------",	"%10llu%c "	},
-	{ "   memory",	"   import",	"----------",	"%9llu%c "	},
-	{ "    alloc",	"  succeed",	"---------",	"%9llu "	},
+	{ "vmem                          ", "name                          ",
+	"------------------------------", "%-*s "			},
+	{ "   memory",	"   in use",	"---------",	"%9llH "	},
+	{ "    memory",	"     total",	"----------",	"%10llH "	},
+	{ "   memory",	"   import",	"---------",	"%9llH "	},
+	{ "     alloc",	"   succeed",	"----------",	"%10llu "	},
 	{ "alloc",	" fail",	"-----",	"%5llu "	},
 	{ NULL,		NULL,		NULL,		NULL		}
 };
@@ -2102,15 +2105,9 @@ typedef struct kmastat_vmem {
 	int kv_fail;
 } kmastat_vmem_t;
 
-typedef struct kmastat_args {
-	kmastat_vmem_t **ka_kvpp;
-	uint_t ka_shift;
-} kmastat_args_t;
-
 static int
-kmastat_cache(uintptr_t addr, const kmem_cache_t *cp, kmastat_args_t *kap)
+kmastat_cache(uintptr_t addr, const kmem_cache_t *cp, kmastat_vmem_t **kvpp)
 {
-	kmastat_vmem_t **kvpp = kap->ka_kvpp;
 	kmastat_vmem_t *kv;
 	datafmt_t *dfp = kmemfmt;
 	int magsize;
@@ -2151,9 +2148,7 @@ out:
 	mdb_printf((dfp++)->fmt, cp->cache_bufsize);
 	mdb_printf((dfp++)->fmt, total - avail);
 	mdb_printf((dfp++)->fmt, total);
-	mdb_printf((dfp++)->fmt, meminuse >> kap->ka_shift,
-	    kap->ka_shift == GIGS ? 'G' : kap->ka_shift == MEGS ? 'M' :
-	    kap->ka_shift == KILOS ? 'K' : 'B');
+	mdb_printf((dfp++)->fmt, meminuse);
 	mdb_printf((dfp++)->fmt, alloc);
 	mdb_printf((dfp++)->fmt, cp->cache_alloc_fail);
 	mdb_printf("\n");
@@ -2162,9 +2157,8 @@ out:
 }
 
 static int
-kmastat_vmem_totals(uintptr_t addr, const vmem_t *v, kmastat_args_t *kap)
+kmastat_vmem_totals(uintptr_t addr, const vmem_t *v, kmastat_vmem_t *kv)
 {
-	kmastat_vmem_t *kv = *kap->ka_kvpp;
 	size_t len;
 
 	while (kv != NULL && kv->kv_addr != addr)
@@ -2173,20 +2167,18 @@ kmastat_vmem_totals(uintptr_t addr, const vmem_t *v, kmastat_args_t *kap)
 	if (kv == NULL || kv->kv_alloc == 0)
 		return (WALK_NEXT);
 
-	len = MIN(17, strlen(v->vm_name));
+	len = MIN(22, strlen(v->vm_name));
 
-	mdb_printf("Total [%s]%*s %6s %6s %6s %10lu%c %9u %5u\n", v->vm_name,
-	    17 - len, "", "", "", "",
-	    kv->kv_meminuse >> kap->ka_shift,
-	    kap->ka_shift == GIGS ? 'G' : kap->ka_shift == MEGS ? 'M' :
-	    kap->ka_shift == KILOS ? 'K' : 'B', kv->kv_alloc, kv->kv_fail);
+	mdb_printf("Total [%s]%*s %5s %9s %9s %6lH %10u %5u\n", v->vm_name,
+	    22 - len, "", "", "", "",
+	    kv->kv_meminuse, kv->kv_alloc, kv->kv_fail);
 
 	return (WALK_NEXT);
 }
 
 /*ARGSUSED*/
 static int
-kmastat_vmem(uintptr_t addr, const vmem_t *v, const uint_t *shiftp)
+kmastat_vmem(uintptr_t addr, const vmem_t *v, const void *ignored)
 {
 	datafmt_t *dfp = vmemfmt;
 	const vmem_kstat_t *vkp = &v->vm_kstat;
@@ -2204,16 +2196,10 @@ kmastat_vmem(uintptr_t addr, const vmem_t *v, const uint_t *shiftp)
 	}
 
 	mdb_printf("%*s", ident, "");
-	mdb_printf((dfp++)->fmt, 25 - ident, v->vm_name);
-	mdb_printf((dfp++)->fmt, vkp->vk_mem_inuse.value.ui64 >> *shiftp,
-	    *shiftp == GIGS ? 'G' : *shiftp == MEGS ? 'M' :
-	    *shiftp == KILOS ? 'K' : 'B');
-	mdb_printf((dfp++)->fmt, vkp->vk_mem_total.value.ui64 >> *shiftp,
-	    *shiftp == GIGS ? 'G' : *shiftp == MEGS ? 'M' :
-	    *shiftp == KILOS ? 'K' : 'B');
-	mdb_printf((dfp++)->fmt, vkp->vk_mem_import.value.ui64 >> *shiftp,
-	    *shiftp == GIGS ? 'G' : *shiftp == MEGS ? 'M' :
-	    *shiftp == KILOS ? 'K' : 'B');
+	mdb_printf((dfp++)->fmt, 30 - ident, v->vm_name);
+	mdb_printf((dfp++)->fmt, vkp->vk_mem_inuse.value.ui64);
+	mdb_printf((dfp++)->fmt, vkp->vk_mem_total.value.ui64);
+	mdb_printf((dfp++)->fmt, vkp->vk_mem_import.value.ui64);
 	mdb_printf((dfp++)->fmt, vkp->vk_alloc.value.ui64);
 	mdb_printf((dfp++)->fmt, vkp->vk_fail.value.ui64);
 
@@ -2228,44 +2214,35 @@ kmastat(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 {
 	kmastat_vmem_t *kv = NULL;
 	datafmt_t *dfp;
-	kmastat_args_t ka;
-
-	ka.ka_shift = 0;
-	if (mdb_getopts(argc, argv,
-	    'k', MDB_OPT_SETBITS, KILOS, &ka.ka_shift,
-	    'm', MDB_OPT_SETBITS, MEGS, &ka.ka_shift,
-	    'g', MDB_OPT_SETBITS, GIGS, &ka.ka_shift, NULL) != argc)
-		return (DCMD_USAGE);
 
 	for (dfp = kmemfmt; dfp->hdr1 != NULL; dfp++)
-		mdb_printf("%s ", dfp->hdr1);
+		mdb_printf("%s%s", dfp == kmemfmt ? "" : " ", dfp->hdr1);
 	mdb_printf("\n");
 
 	for (dfp = kmemfmt; dfp->hdr1 != NULL; dfp++)
-		mdb_printf("%s ", dfp->hdr2);
+		mdb_printf("%s%s", dfp == kmemfmt ? "" : " ", dfp->hdr2);
 	mdb_printf("\n");
 
 	for (dfp = kmemfmt; dfp->hdr1 != NULL; dfp++)
-		mdb_printf("%s ", dfp->dashes);
+		mdb_printf("%s%s", dfp == kmemfmt ? "" : " ", dfp->dashes);
 	mdb_printf("\n");
 
-	ka.ka_kvpp = &kv;
-	if (mdb_walk("kmem_cache", (mdb_walk_cb_t)kmastat_cache, &ka) == -1) {
+	if (mdb_walk("kmem_cache", (mdb_walk_cb_t)kmastat_cache, &kv) == -1) {
 		mdb_warn("can't walk 'kmem_cache'");
 		return (DCMD_ERR);
 	}
 
 	for (dfp = kmemfmt; dfp->hdr1 != NULL; dfp++)
-		mdb_printf("%s ", dfp->dashes);
+		mdb_printf("%s%s", dfp == kmemfmt ? "" : " ", dfp->dashes);
 	mdb_printf("\n");
 
-	if (mdb_walk("vmem", (mdb_walk_cb_t)kmastat_vmem_totals, &ka) == -1) {
+	if (mdb_walk("vmem", (mdb_walk_cb_t)kmastat_vmem_totals, kv) == -1) {
 		mdb_warn("can't walk 'vmem'");
 		return (DCMD_ERR);
 	}
 
 	for (dfp = kmemfmt; dfp->hdr1 != NULL; dfp++)
-		mdb_printf("%s ", dfp->dashes);
+		mdb_printf("%s%s", dfp == kmemfmt ? "" : " ", dfp->dashes);
 	mdb_printf("\n");
 
 	mdb_printf("\n");
@@ -2282,7 +2259,7 @@ kmastat(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 		mdb_printf("%s ", dfp->dashes);
 	mdb_printf("\n");
 
-	if (mdb_walk("vmem", (mdb_walk_cb_t)kmastat_vmem, &ka.ka_shift) == -1) {
+	if (mdb_walk("vmem", (mdb_walk_cb_t)kmastat_vmem, NULL) == -1) {
 		mdb_warn("can't walk 'vmem'");
 		return (DCMD_ERR);
 	}
@@ -4188,8 +4165,7 @@ static const mdb_dcmd_t dcmds[] = {
 	{ "freedby", ":", "given a thread, print its freed buffers", freedby },
 	{ "kmalog", "?[ fail | slab ]",
 	    "display kmem transaction log and stack traces", kmalog },
-	{ "kmastat", "[-kmg]", "kernel memory allocator stats",
-	    kmastat },
+	{ "kmastat", NULL, "kernel memory allocator stats", kmastat },
 	{ "kmausers", "?[-ef] [cache ...]", "current medium and large users "
 		"of the kmem allocator", kmausers, kmausers_help },
 	{ "kmem_cache", "?[-n name]",
@@ -4386,6 +4362,8 @@ static const mdb_dcmd_t dcmds[] = {
 	/* from zone.c */
 	{ "zid2zone", ":", "find the zone_t with the given zone id",
 		zid2zone },
+	{ "zdid2zone", ":", "find the zone_t with the given zone debug id",
+		zdid2zone },
 	{ "zone", "?[-r [-v]]", "display kernel zone(s)", zoneprt },
 	{ "zsd", ":[-v] [zsd_key]", "display zone-specific-data entries for "
 	    "selected zones", zsd },
diff --git a/usr/src/cmd/mdb/common/modules/genunix/kmem.c b/usr/src/cmd/mdb/common/modules/genunix/kmem.c
index 2cf0a10a3f..1878046337 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/kmem.c
+++ b/usr/src/cmd/mdb/common/modules/genunix/kmem.c
@@ -3918,6 +3918,8 @@ kmalog(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 			logname = "kmem_failure_log";
 		else if (strcmp(argv->a_un.a_str, "slab") == 0)
 			logname = "kmem_slab_log";
+		else if (strcmp(argv->a_un.a_str, "zerosized") == 0)
+			logname = "kmem_zerosized_log";
 		else
 			return (DCMD_USAGE);
 	}
diff --git a/usr/src/cmd/mdb/common/modules/genunix/memory.c b/usr/src/cmd/mdb/common/modules/genunix/memory.c
index fa4918b9b8..f127adb850 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/memory.c
+++ b/usr/src/cmd/mdb/common/modules/genunix/memory.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <mdb/mdb_param.h>
@@ -443,11 +443,11 @@ vn_get(vn_htable_t *hp, struct vnode *vp, uintptr_t ptr)
 
 /* Summary statistics of pages */
 typedef struct memstat {
-	struct vnode    *ms_kvp;	/* Cached address of kernel vnode */
 	struct vnode    *ms_unused_vp;	/* Unused pages vnode pointer	  */
-	struct vnode    *ms_zvp;	/* Cached address of zio vnode    */
+	struct vnode    *ms_kvps;	/* Cached address of vnode array  */
 	uint64_t	ms_kmem;	/* Pages of kernel memory	  */
 	uint64_t	ms_zfs_data;	/* Pages of zfs data		  */
+	uint64_t	ms_vmm_mem;	/* Pages of VMM mem		  */
 	uint64_t	ms_anon;	/* Pages of anonymous memory	  */
 	uint64_t	ms_vnode;	/* Pages of named (vnode) memory  */
 	uint64_t	ms_exec;	/* Pages of exec/library memory	  */
@@ -458,11 +458,8 @@ typedef struct memstat {
 	struct vnode	ms_vn;		/* vnode buffer			  */
 } memstat_t;
 
-#define	MS_PP_ISKAS(pp, stats)				\
-	((pp)->p_vnode == (stats)->ms_kvp)
-
-#define	MS_PP_ISZFS_DATA(pp, stats)			\
-	(((stats)->ms_zvp != NULL) && ((pp)->p_vnode == (stats)->ms_zvp))
+#define	MS_PP_ISTYPE(pp, stats, index) \
+	((pp)->p_vnode == &(stats->ms_kvps[index]))
 
 /*
  * Summarize pages by type and update stat information
@@ -478,10 +475,12 @@ memstat_callback(page_t *page, page_t *pp, memstat_t *stats)
 		stats->ms_bootpages++;
 	else if (pp->p_vnode == NULL || pp->p_vnode == stats->ms_unused_vp)
 		return (WALK_NEXT);
-	else if (MS_PP_ISKAS(pp, stats))
+	else if (MS_PP_ISTYPE(pp, stats, KV_KVP))
 		stats->ms_kmem++;
-	else if (MS_PP_ISZFS_DATA(pp, stats))
+	else if (MS_PP_ISTYPE(pp, stats, KV_ZVP))
 		stats->ms_zfs_data++;
+	else if (MS_PP_ISTYPE(pp, stats, KV_VVP))
+		stats->ms_vmm_mem++;
 	else if (PP_ISFREE(pp))
 		stats->ms_cachelist++;
 	else if (vn_get(stats->ms_vn_htable, vp, (uintptr_t)pp->p_vnode))
@@ -507,7 +506,6 @@ memstat(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	memstat_t stats;
 	GElf_Sym sym;
 	vn_htable_t ht;
-	struct vnode *kvps;
 	uintptr_t vn_size = 0;
 #if defined(__i386) || defined(__amd64)
 	bln_stats_t bln_stats;
@@ -548,16 +546,10 @@ memstat(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	/* read kernel vnode array pointer */
 	if (mdb_lookup_by_obj(MDB_OBJ_EXEC, "kvps",
 	    (GElf_Sym *)&sym) == -1) {
-		mdb_warn("unable to read kvps");
+		mdb_warn("unable to look up kvps");
 		return (DCMD_ERR);
 	}
-	kvps = (struct vnode *)(uintptr_t)sym.st_value;
-	stats.ms_kvp =  &kvps[KV_KVP];
-
-	/*
-	 * Read the zio vnode pointer.
-	 */
-	stats.ms_zvp = &kvps[KV_ZVP];
+	stats.ms_kvps = (struct vnode *)(uintptr_t)sym.st_value;
 
 	/*
 	 * If physmem != total_pages, then the administrator has limited the
@@ -605,6 +597,13 @@ memstat(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 		    MS_PCT_TOTAL(stats.ms_zfs_data));
 	}
 
+	if (stats.ms_vmm_mem != 0) {
+		mdb_printf("VMM Memory       %16llu  %16llu  %3lu%%\n",
+		    stats.ms_vmm_mem,
+		    (uint64_t)stats.ms_vmm_mem * PAGESIZE / (1024 * 1024),
+		    MS_PCT_TOTAL(stats.ms_vmm_mem));
+	}
+
 	mdb_printf("Anon             %16llu  %16llu  %3lu%%\n",
 	    stats.ms_anon,
 	    (uint64_t)stats.ms_anon * PAGESIZE / (1024 * 1024),
diff --git a/usr/src/cmd/mdb/common/modules/genunix/thread.c b/usr/src/cmd/mdb/common/modules/genunix/thread.c
index 652e5af2d6..811f29ec66 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/thread.c
+++ b/usr/src/cmd/mdb/common/modules/genunix/thread.c
@@ -24,11 +24,13 @@
  */
 /*
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 
 #include <mdb/mdb_modapi.h>
 #include <mdb/mdb_ks.h>
+#include <mdb/mdb_ctf.h>
 #include <sys/types.h>
 #include <sys/thread.h>
 #include <sys/lwp.h>
@@ -38,6 +40,7 @@
 #include <sys/disp.h>
 #include <sys/taskq_impl.h>
 #include <sys/stack.h>
+#include "thread.h"
 
 #ifndef	STACK_BIAS
 #define	STACK_BIAS	0
@@ -659,7 +662,12 @@ threadlist(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 			else
 				mdb_printf(" %a()\n", t.t_startpc);
 		} else {
-			mdb_printf(" %s/%u\n", p.p_user.u_comm, t.t_tid);
+			char name[THREAD_NAME_MAX];
+
+			mdb_printf(" %s/%u", p.p_user.u_comm, t.t_tid);
+			if (thread_getname(addr, name, sizeof (name)))
+				mdb_printf(" [%s]", name);
+			mdb_printf("\n");
 		}
 	}
 
@@ -1002,6 +1010,49 @@ stackinfo_help(void)
 	    "-h shows history, dead kthreads that used their "
 	    "kernel stack the most\n");
 	mdb_printf(
-	    "\nSee Solaris Modular Debugger Guide for detailed usage.\n");
+	    "\nSee illumos Modular Debugger Guide for detailed usage.\n");
 	mdb_flush();
 }
+
+/* If the field is not present in the target, return an empty (0 length) name */
+boolean_t
+thread_getname(uintptr_t addr, char *namep, size_t namelen)
+{
+	mdb_ctf_id_t id;
+	ulong_t offset;
+	uintptr_t nameaddr;
+
+	bzero(namep, namelen);
+
+	if (mdb_ctf_lookup_by_name("kthread_t", &id) == -1)
+		return (B_FALSE);
+
+	if (mdb_ctf_offsetof(id, "t_name", &offset) == -1)
+		return (B_FALSE);
+
+	if (offset % 8 != 0) {
+		mdb_warn("kthread_t.t_name is not on a byte boundary");
+		return (B_FALSE);
+	}
+	offset /= 8;
+
+	if (mdb_vread(&nameaddr, sizeof (nameaddr), addr + offset) !=
+	    sizeof (nameaddr)) {
+		mdb_warn("could not read address of thread name buffer");
+		return (B_FALSE);
+	}
+
+	if (nameaddr != 0 && mdb_readstr(namep, namelen, addr + offset) == -1) {
+		mdb_warn("error reading thread name");
+		/*
+		 * Just to be safe -- if mdb_readstr() succeeds, it always
+		 * NUL terminates the output, but is unclear what it does
+		 * on failure.  In that case we attempt to show any partial
+		 * content w/ the warning in case it's useful, but explicity
+		 * NUL terminate to be safe.
+		 */
+		namep[namelen - 1] = '\0';
+	}
+
+	return (strlen(namep) > 0 ? B_TRUE : B_FALSE);
+}
diff --git a/usr/src/cmd/mdb/common/modules/genunix/thread.h b/usr/src/cmd/mdb/common/modules/genunix/thread.h
index 18952fdc0a..9763781008 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/thread.h
+++ b/usr/src/cmd/mdb/common/modules/genunix/thread.h
@@ -21,6 +21,8 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 #ifndef	_THREAD_H
@@ -58,6 +60,8 @@ void thread_state_to_text(uint_t, char *, size_t);
 int thread_text_to_state(const char *, uint_t *);
 void thread_walk_states(void (*)(uint_t, const char *, void *), void *);
 
+boolean_t thread_getname(uintptr_t, char *, size_t);
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/cmd/mdb/common/modules/genunix/zone.c b/usr/src/cmd/mdb/common/modules/genunix/zone.c
index a332cdfc01..77ed2cbc48 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/zone.c
+++ b/usr/src/cmd/mdb/common/modules/genunix/zone.c
@@ -34,9 +34,9 @@
 
 #define	ZONE_NAMELEN	20
 #ifdef _LP64
-#define	ZONE_PATHLEN	32
+#define	ZONE_PATHLEN	25
 #else
-#define	ZONE_PATHLEN	40
+#define	ZONE_PATHLEN	33
 #endif
 
 /*
@@ -80,6 +80,31 @@ zid2zone(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	return (DCMD_OK);
 }
 
+static int
+zdid_lookup_cb(uintptr_t addr, const zone_t *zone, void *arg)
+{
+	zoneid_t zdid = *(uintptr_t *)arg;
+	if (zone->zone_did == zdid)
+		mdb_printf("%p\n", addr);
+
+	return (WALK_NEXT);
+}
+
+/*ARGSUSED*/
+int
+zdid2zone(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
+{
+	if (!(flags & DCMD_ADDRSPEC) || argc != 0)
+		return (DCMD_USAGE);
+
+	if (mdb_walk("zone", (mdb_walk_cb_t)zdid_lookup_cb, &addr) == -1) {
+		mdb_warn("failed to walk zone");
+		return (DCMD_ERR);
+	}
+
+	return (DCMD_OK);
+}
+
 int
 zoneprt(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 {
@@ -122,10 +147,10 @@ zoneprt(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	 */
 	if (DCMD_HDRSPEC(flags)) {
 		if (ropt_given == FALSE)
-			mdb_printf("%<u>%?s %6s %-13s %-20s %-s%</u>\n",
+			mdb_printf("%<u>%?s %4s %-13s %-19s %-s%</u>\n",
 			    "ADDR", "ID", "STATUS", "NAME", "PATH");
 		else
-			mdb_printf("%<u>%?s %6s %10s %10s %-20s%</u>\n",
+			mdb_printf("%<u>%?s %6s %10s %10s %-19s%</u>\n",
 			    "ADDR", "ID", "REFS", "CREFS", "NAME");
 	}
 
@@ -164,7 +189,7 @@ zoneprt(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 			statusp = zone_status_names[zn.zone_status];
 		else
 			statusp = "???";
-		mdb_printf("%0?p %6d %-13s %-20s %s\n", addr, zn.zone_id,
+		mdb_printf("%0?p %4d %-13s %-19s %s\n", addr, zn.zone_id,
 		    statusp, name, path);
 	} else {
 		/*
@@ -172,7 +197,7 @@ zoneprt(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 		 * Display the zone's subsystem-specific reference counts if
 		 * the user specified the '-v' option.
 		 */
-		mdb_printf("%0?p %6d %10u %10u %-20s\n", addr, zn.zone_id,
+		mdb_printf("%0?p %6d %10u %10u %-19s\n", addr, zn.zone_id,
 		    zn.zone_ref, zn.zone_cred_ref, name);
 		if (vopt_given == TRUE) {
 			GElf_Sym subsys_names_sym;
@@ -410,7 +435,7 @@ zsd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	 * Prepare to output the specified zone's ZSD information.
 	 */
 	if (DCMD_HDRSPEC(flags))
-		mdb_printf("%<u>%-20s %?s %?s %8s%</u>\n", "ZONE", "KEY",
+		mdb_printf("%<u>%-19s %?s %?s %8s%</u>\n", "ZONE", "KEY",
 		    "VALUE", "FLAGS");
 	len = mdb_readstr(name, ZONE_NAMELEN, (uintptr_t)zone.zone_name);
 	if (len > 0) {
@@ -419,7 +444,7 @@ zsd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	} else {
 		(void) strcpy(name, "??");
 	}
-	mdb_printf("%-20s ", name);
+	mdb_printf("%-19s ", name);
 
 	/*
 	 * Display the requested ZSD entries.
diff --git a/usr/src/cmd/mdb/common/modules/genunix/zone.h b/usr/src/cmd/mdb/common/modules/genunix/zone.h
index 0881f9bbae..94a383e41c 100644
--- a/usr/src/cmd/mdb/common/modules/genunix/zone.h
+++ b/usr/src/cmd/mdb/common/modules/genunix/zone.h
@@ -34,6 +34,7 @@ extern "C" {
 #endif
 
 extern int zid2zone(uintptr_t, uint_t, int argc, const mdb_arg_t *);
+extern int zdid2zone(uintptr_t, uint_t, int argc, const mdb_arg_t *);
 extern int zoneprt(uintptr_t, uint_t, int argc, const mdb_arg_t *);
 
 extern int zone_walk_init(mdb_walk_state_t *);
diff --git a/usr/src/cmd/mdb/common/modules/ipc/ipc.c b/usr/src/cmd/mdb/common/modules/ipc/ipc.c
index 5871e45dd9..7054f59477 100644
--- a/usr/src/cmd/mdb/common/modules/ipc/ipc.c
+++ b/usr/src/cmd/mdb/common/modules/ipc/ipc.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <mdb/mdb_modapi.h>
@@ -229,7 +230,9 @@ shm_print(kshmid_t *shmid, uintptr_t addr)
 	printtime_nice("ctime: ", shmid->shm_ctime);
 	mdb_printf("sptinfo: %-?p    sptseg: %-?p\n",
 	    shmid->shm_sptinfo, shmid->shm_sptseg);
-	mdb_printf("sptprot: <%lb>\n", shmid->shm_sptprot, prot_flag_bits);
+	mdb_printf("opts: rmpend: %d prot: <%b>\n",
+	    ((shmid->shm_opts & SHM_RM_PENDING) != 0),
+	    (shmid->shm_opts & SHM_PROT_MASK), prot_flag_bits);
 }
 
 
diff --git a/usr/src/cmd/mdb/common/modules/libc/libc.c b/usr/src/cmd/mdb/common/modules/libc/libc.c
index c296aa9d04..efd268ad55 100644
--- a/usr/src/cmd/mdb/common/modules/libc/libc.c
+++ b/usr/src/cmd/mdb/common/modules/libc/libc.c
@@ -135,6 +135,8 @@ d_ucontext(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	    uc.uc_stack.ss_sp, uc.uc_stack.ss_size, stack_flags(&uc.uc_stack));
 	mdb_printf("  mcontext = 0x%p\n",
 	    addr + OFFSETOF(ucontext_t, uc_mcontext));
+	mdb_printf("  brand    = 0x%p 0x%p 0x%p\n",
+	    uc.uc_brand_data[0], uc.uc_brand_data[1], uc.uc_brand_data[2]);
 
 	return (DCMD_OK);
 }
@@ -846,14 +848,19 @@ d_uberdata(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	    prt_addr(uberdata.all_lwps, 1),
 	    prt_addr(uberdata.all_zombies, 0));
 
-	HD("nthreads   nzombies   ndaemons   pid        sigacthandler");
-	mdb_printf(OFFSTR "%-10d %-10d %-10d %-10d %s\n",
+	HD("nthreads   nzombies   ndaemons   pid");
+	mdb_printf(OFFSTR "%-10d %-10d %-10d %-10d\n",
 	    OFFSET(nthreads),
 	    uberdata.nthreads,
 	    uberdata.nzombies,
 	    uberdata.ndaemons,
-	    (int)uberdata.pid,
-	    prt_addr((void *)uberdata.sigacthandler, 0));
+	    (int)uberdata.pid);
+
+	HD("sigacthandler         setctxt");
+	mdb_printf(OFFSTR "%s %s\n",
+	    OFFSET(sigacthandler),
+	    prt_addr((void *)uberdata.sigacthandler, 1),
+	    prt_addr((void *)uberdata.setctxt, 1));
 
 	HD("lwp_stacks            lwp_laststack         nfreestack stk_cache");
 	mdb_printf(OFFSTR "%s %s %-10d %d\n",
@@ -876,12 +883,17 @@ d_uberdata(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 	    prt_addr(uberdata.ulwp_replace_last, 1),
 	    prt_addr(uberdata.atforklist, 0));
 
-	HD("robustlocks           robustlist            progname");
-	mdb_printf(OFFSTR "%s %s %s\n",
+	HD("robustlocks           robustlist");
+	mdb_printf(OFFSTR "%s %s\n",
 	    OFFSET(robustlocks),
 	    prt_addr(uberdata.robustlocks, 1),
-	    prt_addr(uberdata.robustlist, 1),
-	    prt_addr(uberdata.progname, 0));
+	    prt_addr(uberdata.robustlist, 1));
+
+	HD("progname              ub_broot");
+	mdb_printf(OFFSTR "%s %s\n",
+	    OFFSET(progname),
+	    prt_addr(uberdata.progname, 1),
+	    prt_addr(uberdata.ub_broot, 1));
 
 	HD("tdb_bootstrap         tdb_sync_addr_hash    tdb_'count tdb_'fail");
 	mdb_printf(OFFSTR "%s %s %-10d %d\n",
diff --git a/usr/src/cmd/mdb/common/modules/mac/mac.c b/usr/src/cmd/mdb/common/modules/mac/mac.c
index 66ba2e9f3c..0e54efadae 100644
--- a/usr/src/cmd/mdb/common/modules/mac/mac.c
+++ b/usr/src/cmd/mdb/common/modules/mac/mac.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/mdb_modapi.h>
@@ -967,6 +968,8 @@ mac_ring_classify2str(mac_classify_type_t classify)
 		return ("sw");
 	case MAC_HW_CLASSIFIER:
 		return ("hw");
+	case MAC_PASSTHRU_CLASSIFIER:
+		return ("pass");
 	}
 	return ("--");
 }
diff --git a/usr/src/cmd/mdb/common/modules/mpt_sas/mpt_sas.c b/usr/src/cmd/mdb/common/modules/mpt_sas/mpt_sas.c
index fe63ea02e2..c5c6433d0b 100644
--- a/usr/src/cmd/mdb/common/modules/mpt_sas/mpt_sas.c
+++ b/usr/src/cmd/mdb/common/modules/mpt_sas/mpt_sas.c
@@ -34,6 +34,7 @@
 #include <sys/sunmdi.h>
 #include <sys/list.h>
 #include <sys/scsi/scsi.h>
+#include <sys/refhash.h>
 
 #pragma pack(1)
 #include <sys/scsi/adapters/mpt_sas/mpi/mpi2_type.h>
@@ -47,7 +48,6 @@
 #pragma pack()
 
 #include <sys/scsi/adapters/mpt_sas/mptsas_var.h>
-#include <sys/scsi/adapters/mpt_sas/mptsas_hash.h>
 
 struct {
 	int	value;
diff --git a/usr/src/cmd/mdb/common/modules/xhci/xhci.c b/usr/src/cmd/mdb/common/modules/xhci/xhci.c
new file mode 100644
index 0000000000..fbf3c42417
--- /dev/null
+++ b/usr/src/cmd/mdb/common/modules/xhci/xhci.c
@@ -0,0 +1,893 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/mdb_modapi.h>
+#include <sys/usb/hcd/xhci/xhci.h>
+
+#define	XHCI_MDB_TRB_INDENT	4
+
+static const char *xhci_mdb_epctx_eptypes[] = {
+	"Not Valid",
+	"ISOCH OUT",
+	"BULK OUT",
+	"INTR OUT",
+	"CONTROL",
+	"ISOCH IN",
+	"BULK IN",
+	"INTR IN"
+};
+
+static const char *xhci_mdb_epctx_states[] = {
+	"Disabled",
+	"Running",
+	"Halted",
+	"Stopped",
+	"Error",
+	"<Unknown>",
+	"<Unknown>",
+	"<Unknown>"
+};
+
+static const mdb_bitmask_t xhci_mdb_trb_flags[] = {
+	{ "C", XHCI_TRB_CYCLE, XHCI_TRB_CYCLE },
+	{ "ENT", XHCI_TRB_ENT, XHCI_TRB_ENT },
+	{ "ISP", XHCI_TRB_ISP, XHCI_TRB_ISP },
+	{ "NS", XHCI_TRB_NOSNOOP, XHCI_TRB_NOSNOOP },
+	{ "CH", XHCI_TRB_CHAIN, XHCI_TRB_CHAIN },
+	{ "IOC", XHCI_TRB_IOC, XHCI_TRB_IOC },
+	{ "IDT", XHCI_TRB_IDT, XHCI_TRB_IDT },
+	{ "BEI", XHCI_TRB_BEI, XHCI_TRB_BEI },
+	{ NULL, 0, 0 }
+};
+
+typedef struct xhci_mdb_walk_endpoint {
+	xhci_device_t	xmwe_device;
+	uint_t		xmwe_ep;
+} xhci_mdb_walk_endpoint_t;
+
+static const char *
+xhci_mdb_trb_code_to_str(int code)
+{
+	switch (code) {
+	case XHCI_CODE_INVALID:
+		return ("Invalid");
+	case XHCI_CODE_SUCCESS:
+		return ("Success");
+	case XHCI_CODE_DATA_BUF:
+		return ("Data Overrun or Underrun");
+	case XHCI_CODE_BABBLE:
+		return ("Babble");
+	case XHCI_CODE_TXERR:
+		return ("Transaction Error");
+	case XHCI_CODE_TRB:
+		return ("Invalid TRB");
+	case XHCI_CODE_STALL:
+		return ("Stall");
+	case XHCI_CODE_RESOURCE:
+		return ("No Resources Available");
+	case XHCI_CODE_BANDWIDTH:
+		return ("No Bandwidth Available");
+	case XHCI_CODE_NO_SLOTS:
+		return ("No Slots Available");
+	case XHCI_CODE_STREAM_TYPE:
+		return ("Stream Context Type Detected");
+	case XHCI_CODE_SLOT_NOT_ON:
+		return ("Slot disabled");
+	case XHCI_CODE_ENDP_NOT_ON:
+		return ("Endpoint disabled");
+	case XHCI_CODE_SHORT_XFER:
+		return ("Short Transfer");
+	case XHCI_CODE_RING_UNDERRUN:
+		return ("Isoch. Ring Underrun");
+	case XHCI_CODE_RING_OVERRUN:
+		return ("Isoch. Ring Overrun");
+	case XHCI_CODE_VF_RING_FULL:
+		return ("VF Ring Full");
+	case XHCI_CODE_PARAMETER:
+		return ("Invalid Context Paramenter");
+	case XHCI_CODE_BW_OVERRUN:
+		return ("Bandwidth Overrun");
+	case XHCI_CODE_CONTEXT_STATE:
+		return ("Illegal Context Transition");
+	case XHCI_CODE_NO_PING_RESP:
+		return ("Failed to Complete Periodic Transfer");
+	case XHCI_CODE_EV_RING_FULL:
+		return ("Event Ring Full");
+	case XHCI_CODE_INCOMPAT_DEV:
+		return ("Incompatible Device");
+	case XHCI_CODE_MISSED_SRV:
+		return ("Missed Isoch. Service Window");
+	case XHCI_CODE_CMD_RING_STOP:
+		return ("Command Ring Stop");
+	case XHCI_CODE_CMD_ABORTED:
+		return ("Command Aborted");
+	case XHCI_CODE_XFER_STOPPED:
+		return ("Transfer Stopped");
+	case XHCI_CODE_XFER_STOPINV:
+		return ("Invalid Transfer Length");
+	case XHCI_CODE_XFER_STOPSHORT:
+		return ("Stopped before End of Transfer Descriptor");
+	case XHCI_CODE_MELAT:
+		return ("Max Exit Latency too large");
+	case XHCI_CODE_RESERVED:
+		return ("Reserved");
+	case XHCI_CODE_ISOC_OVERRUN:
+		return ("Isochronus Overrun");
+	case XHCI_CODE_EVENT_LOST:
+		return ("Event Lost");
+	case XHCI_CODE_UNDEFINED:
+		return ("Undefined Fatal Error");
+	case XHCI_CODE_INVALID_SID:
+		return ("Invalid Stream ID");
+	case XHCI_CODE_SEC_BW:
+		return ("Secondary Bandwith Allocation Failure");
+	case XHCI_CODE_SPLITERR:
+		return ("USB2 SPlit Transaction Error");
+	default:
+		break;
+	}
+
+	if (code >= 192 && code <= 223)
+		return ("Vendor Defined Error");
+	if (code >= 224 && code <= 255)
+		return ("Vendor Defined Info");
+
+	return ("Reserved");
+}
+
+static const char *
+xhci_mdb_trb_type_to_str(int code)
+{
+	/*
+	 * The macros for the types are all already shifted over based on their
+	 * place in the TRB, so shift there again ourselves.
+	 */
+	switch (code << 10) {
+	case XHCI_TRB_TYPE_NORMAL:
+		return ("Normal");
+	case XHCI_TRB_TYPE_SETUP:
+		return ("Setup");
+	case XHCI_TRB_TYPE_DATA:
+		return ("Data");
+	case XHCI_TRB_TYPE_STATUS:
+		return ("Status");
+	case XHCI_TRB_TYPE_LINK:
+		return ("Link");
+	case XHCI_TRB_TYPE_EVENT:
+		return ("Event");
+	case XHCI_TRB_TYPE_NOOP:
+		return ("No-Op");
+	case XHCI_CMD_ENABLE_SLOT:
+		return ("Enable Slot");
+	case XHCI_CMD_DISABLE_SLOT:
+		return ("Disable Slot");
+	case XHCI_CMD_ADDRESS_DEVICE:
+		return ("Address Device");
+	case XHCI_CMD_CONFIG_EP:
+		return ("Configure Endpoint");
+	case XHCI_CMD_EVAL_CTX:
+		return ("Evaluate Context");
+	case XHCI_CMD_RESET_EP:
+		return ("Reset Endpoint");
+	case XHCI_CMD_STOP_EP:
+		return ("Stop Endpoint");
+	case XHCI_CMD_SET_TR_DEQ:
+		return ("Set Transfer Ring Dequeue Pointer");
+	case XHCI_CMD_RESET_DEV:
+		return ("Reset Device");
+	case XHCI_CMD_FEVENT:
+		return ("Force Event");
+	case XHCI_CMD_NEG_BW:
+		return ("Negotiate Bandwidth");
+	case XHCI_CMD_SET_LT:
+		return ("Set Latency Tolerance");
+	case XHCI_CMD_GET_BW:
+		return ("Get Bandwidth");
+	case XHCI_CMD_FHEADER:
+		return ("Force Header");
+	case XHCI_CMD_NOOP:
+		return ("No-Op Command");
+	case XHCI_EVT_XFER:
+		return ("Transfer Event");
+	case XHCI_EVT_CMD_COMPLETE:
+		return ("Command Completion Event");
+	case XHCI_EVT_PORT_CHANGE:
+		return ("Port Status Change Event");
+	case XHCI_EVT_BW_REQUEST:
+		return ("Bandwidth Request Event");
+	case XHCI_EVT_DOORBELL:
+		return ("Doorbell Event");
+	case XHCI_EVT_HOST_CTRL:
+		return ("Host Controller Event");
+	case XHCI_EVT_DEVICE_NOTIFY:
+		return ("Device Notification Event");
+	case XHCI_EVT_MFINDEX_WRAP:
+		return ("MFINDEX Wrap Event");
+	default:
+		break;
+	}
+
+	if (code >= 43 && code <= 63)
+		return ("Vendor Defiend");
+	return ("Reserved");
+}
+
+/* ARGSUSED */
+static int
+xhci_mdb_print_epctx(uintptr_t addr, uint_t flags, int argc,
+    const mdb_arg_t *argv)
+{
+	uint32_t info, info2, txinfo;
+	xhci_endpoint_context_t epctx;
+
+	if (!(flags & DCMD_ADDRSPEC)) {
+		mdb_warn("::xhci_epctx requires an address\n");
+		return (DCMD_USAGE);
+	}
+
+	if (mdb_vread(&epctx, sizeof (epctx), addr) != sizeof (epctx)) {
+		mdb_warn("failed to read xhci_endpoint_context_t at %p", addr);
+		return (DCMD_ERR);
+	}
+
+	info = LE_32(epctx.xec_info);
+	info2 = LE_32(epctx.xec_info2);
+	txinfo = LE_32(epctx.xec_txinfo);
+
+	mdb_printf("Endpoint State: %s (%d)\n",
+	    xhci_mdb_epctx_states[XHCI_EPCTX_STATE(info)],
+	    XHCI_EPCTX_STATE(info));
+
+	mdb_printf("Mult: %d\n", XHCI_EPCTX_GET_MULT(info));
+	mdb_printf("Max Streams: %d\n", XHCI_EPCTX_GET_MAXP_STREAMS(info));
+	mdb_printf("LSA: %d\n", XHCI_EPCTX_GET_LSA(info));
+	mdb_printf("Interval: %d\n", XHCI_EPCTX_GET_IVAL(info));
+	mdb_printf("Max ESIT Hi: %d\n", XHCI_EPCTX_GET_MAX_ESIT_HI(info));
+
+	mdb_printf("CErr: %d\n", XHCI_EPCTX_GET_CERR(info2));
+	mdb_printf("EP Type: %s (%d)\n",
+	    xhci_mdb_epctx_eptypes[XHCI_EPCTX_GET_EPTYPE(info2)],
+	    XHCI_EPCTX_GET_EPTYPE(info2));
+	mdb_printf("Host Initiate Disable: %d\n", XHCI_EPCTX_GET_HID(info2));
+	mdb_printf("Max Burst: %d\n", XHCI_EPCTX_GET_MAXB(info2));
+	mdb_printf("Max Packet Size: %d\n", XHCI_EPCTX_GET_MPS(info2));
+
+	mdb_printf("Ring DCS: %d\n", LE_64(epctx.xec_dequeue) & 0x1);
+	mdb_printf("Ring PA: 0x%lx\n", LE_64(epctx.xec_dequeue) & ~0xf);
+
+	mdb_printf("Average TRB Length: %d\n", XHCI_EPCTX_AVG_TRB_LEN(txinfo));
+	mdb_printf("Max ESIT: %d\n", XHCI_EPCTX_GET_MAX_ESIT_PAYLOAD(txinfo));
+
+	return (DCMD_OK);
+}
+
+/* ARGSUSED */
+static int
+xhci_mdb_print_slotctx(uintptr_t addr, uint_t flags, int argc,
+    const mdb_arg_t *argv)
+{
+	uint32_t info, info2, tt, state;
+	xhci_slot_context_t sctx;
+
+	if (!(flags & DCMD_ADDRSPEC)) {
+		mdb_warn("::xhci_slotctx requires an address\n");
+		return (DCMD_USAGE);
+	}
+
+	if (mdb_vread(&sctx, sizeof (sctx), addr) != sizeof (sctx)) {
+		mdb_warn("failed to read xhci_slot_context_t at %p", addr);
+		return (DCMD_ERR);
+	}
+
+	info = LE_32(sctx.xsc_info);
+	info2 = LE_32(sctx.xsc_info2);
+	tt = LE_32(sctx.xsc_tt);
+	state = LE_32(sctx.xsc_state);
+
+	mdb_printf("Route: 0x%x\n", XHCI_SCTX_GET_ROUTE(info));
+
+	mdb_printf("Slot Speed: ");
+	switch (XHCI_SCTX_GET_SPEED(info)) {
+	case XHCI_SPEED_FULL:
+		mdb_printf("Full");
+		break;
+	case XHCI_SPEED_LOW:
+		mdb_printf("Low");
+		break;
+	case XHCI_SPEED_HIGH:
+		mdb_printf("High");
+		break;
+	case XHCI_SPEED_SUPER:
+		mdb_printf("Super");
+		break;
+	default:
+		mdb_printf("Unknown");
+		break;
+	}
+	mdb_printf(" (%d)\n", XHCI_SCTX_GET_SPEED(info));
+
+
+	mdb_printf("MTT: %d\n", XHCI_SCTX_GET_MTT(info));
+	mdb_printf("HUB: %d\n", XHCI_SCTX_GET_HUB(info));
+	mdb_printf("DCI: %d\n", XHCI_SCTX_GET_DCI(info));
+
+	mdb_printf("Max Exit Latency: %d\n", XHCI_SCTX_GET_MAX_EL(info2));
+	mdb_printf("Root Hub Port: %d\n", XHCI_SCTX_GET_RHPORT(info2));
+	mdb_printf("Hub Number of Ports: %d\n", XHCI_SCTX_GET_NPORTS(info2));
+
+	mdb_printf("TT Hub Slot id: %d\n", XHCI_SCTX_GET_TT_HUB_SID(tt));
+	mdb_printf("TT Port Number: %d\n", XHCI_SCTX_GET_TT_PORT_NUM(tt));
+	mdb_printf("TT Think Time: %d\n", XHCI_SCTX_GET_TT_THINK_TIME(tt));
+	mdb_printf("IRQ Target: %d\n", XHCI_SCTX_GET_IRQ_TARGET(tt));
+
+	mdb_printf("Device Address: 0x%x\n", XHCI_SCTX_GET_DEV_ADDR(state));
+	mdb_printf("Slot State: ");
+	switch (XHCI_SCTX_GET_SLOT_STATE(state)) {
+	case XHCI_SLOT_DIS_ENAB:
+		mdb_printf("Disabled/Enabled");
+		break;
+	case XHCI_SLOT_DEFAULT:
+		mdb_printf("Default");
+		break;
+	case XHCI_SLOT_ADDRESSED:
+		mdb_printf("Addressed");
+		break;
+	case XHCI_SLOT_CONFIGURED:
+		mdb_printf("Configured");
+		break;
+	default:
+		mdb_printf("Unknown");
+		break;
+	}
+	mdb_printf(" (%d)\n", XHCI_SCTX_GET_SLOT_STATE(state));
+
+	return (DCMD_OK);
+}
+
+static int
+xhci_mdb_print_transfer_event(uint64_t pa, uint32_t status, uint32_t flags)
+{
+	mdb_printf("TRB Address: 0x%lx\n", pa);
+	mdb_printf("Transfer Length (Remain): %d\n", XHCI_TRB_REMAIN(status));
+	mdb_printf("Completion Code: %s (%d)\n",
+	    xhci_mdb_trb_code_to_str(XHCI_TRB_GET_CODE(status)),
+	    XHCI_TRB_GET_CODE(status));
+
+	mdb_printf("Cycle: %d\n", XHCI_TRB_GET_CYCLE(flags));
+	mdb_printf("Event Data: %d\n", XHCI_TRB_GET_ED(flags));
+	mdb_printf("Endpoint ID: %d\n", XHCI_TRB_GET_EP(flags));
+	mdb_printf("Slot ID: %d\n", XHCI_TRB_GET_SLOT(flags));
+	mdb_dec_indent(XHCI_MDB_TRB_INDENT);
+
+	return (DCMD_OK);
+}
+
+static int
+xhci_mdb_print_command_event(uint64_t pa, uint32_t status, uint32_t flags)
+{
+	mdb_printf("TRB Address: 0x%lx\n", pa);
+	mdb_printf("Command Param: 0x%x\n", XHCI_TRB_REMAIN(status));
+	mdb_printf("Completion Code: %s (%d)\n",
+	    xhci_mdb_trb_code_to_str(XHCI_TRB_GET_CODE(status)),
+	    XHCI_TRB_GET_CODE(status));
+
+	mdb_printf("Cycle: %d\n", XHCI_TRB_GET_CYCLE(flags));
+	/* Skip VF ID as we don't support VFs */
+	mdb_printf("Slot ID: %d\n", XHCI_TRB_GET_SLOT(flags));
+	mdb_dec_indent(XHCI_MDB_TRB_INDENT);
+
+	return (DCMD_OK);
+}
+
+/* ARGSUSED */
+static int
+xhci_mdb_print_psc(uint64_t pa, uint32_t status, uint32_t flags)
+{
+	mdb_printf("Port: %d\n", XHCI_TRB_PORTID(pa));
+	mdb_printf("Completion Code: %s (%d)\n",
+	    xhci_mdb_trb_code_to_str(XHCI_TRB_GET_CODE(status)),
+	    XHCI_TRB_GET_CODE(status));
+	mdb_dec_indent(XHCI_MDB_TRB_INDENT);
+	return (DCMD_OK);
+}
+
+static int
+xhci_mdb_print_normal_trb(uint64_t pa, uint32_t status, uint32_t flags)
+{
+	mdb_printf("TRB Address: 0x%lx\n", pa);
+	mdb_printf("TRB Length: %d bytes\n", XHCI_TRB_LEN(status));
+	mdb_printf("TRB TD Size: %d packets\n", XHCI_TRB_GET_TDREM(status));
+	mdb_printf("TRB Interrupt: %d\n", XHCI_TRB_GET_INTR(status));
+	mdb_printf("TRB Flags: %b (0x%x)\n", flags, xhci_mdb_trb_flags,
+	    XHCI_TRB_GET_FLAGS(flags));
+	mdb_dec_indent(XHCI_MDB_TRB_INDENT);
+
+	return (DCMD_OK);
+}
+
+/* ARGSUSED */
+static int
+xhci_mdb_print_trb(uintptr_t addr, uint_t flags, int argc,
+    const mdb_arg_t *argv)
+{
+	xhci_trb_t trb;
+	uint64_t pa;
+	uint32_t status, trbflags, type;
+
+	if (!(flags & DCMD_ADDRSPEC)) {
+		mdb_warn("::xhci_trb expects an address\n");
+		return (DCMD_USAGE);
+	}
+
+	if (mdb_vread(&trb, sizeof (trb), addr) != sizeof (trb)) {
+		mdb_warn("failed to read xhci_trb_t at 0x%x", addr);
+		return (DCMD_ERR);
+	}
+
+	pa = LE_64(trb.trb_addr);
+	status = LE_32(trb.trb_status);
+	trbflags = LE_32(trb.trb_flags);
+
+	type = XHCI_TRB_GET_TYPE(trbflags);
+
+	if ((flags & DCMD_LOOP) && !(flags & DCMD_LOOPFIRST))
+		mdb_printf("\n");
+
+	mdb_set_dot(addr + sizeof (xhci_trb_t));
+	mdb_printf("%s TRB (%d)\n", xhci_mdb_trb_type_to_str(type), type);
+	mdb_inc_indent(XHCI_MDB_TRB_INDENT);
+
+	switch (XHCI_RING_TYPE_SHIFT(type)) {
+	case XHCI_EVT_XFER:
+		return (xhci_mdb_print_transfer_event(pa, status, trbflags));
+	case XHCI_EVT_CMD_COMPLETE:
+		return (xhci_mdb_print_command_event(pa, status, trbflags));
+	case XHCI_EVT_PORT_CHANGE:
+		return (xhci_mdb_print_psc(pa, status, trbflags));
+	case XHCI_TRB_TYPE_NORMAL:
+		return (xhci_mdb_print_normal_trb(pa, status, trbflags));
+	}
+
+	/*
+	 * Just print generic information if we don't have a specific printer
+	 * for that TRB type.
+	 */
+	mdb_printf("TRB Address: 0x%lx\n", pa);
+	mdb_printf("TRB Status: 0x%x\n", status);
+	mdb_printf("TRB Flags: 0x%x\n", trbflags);
+	mdb_dec_indent(XHCI_MDB_TRB_INDENT);
+
+	return (DCMD_OK);
+}
+
+static int
+xhci_mdb_walk_xhci_init(mdb_walk_state_t *wsp)
+{
+	GElf_Sym sym;
+	uintptr_t addr;
+
+	if (wsp->walk_addr != 0) {
+		mdb_warn("::walk xhci only supports global walks\n");
+		return (WALK_ERR);
+	}
+
+	if (mdb_lookup_by_obj("xhci", "xhci_soft_state", &sym) != 0) {
+		mdb_warn("failed to find xhci_soft_state symbol");
+		return (WALK_ERR);
+	}
+
+	if (mdb_vread(&addr, sizeof (addr), sym.st_value) != sizeof (addr)) {
+		mdb_warn("failed to read xhci_soft_state at %p", addr);
+		return (WALK_ERR);
+	}
+
+	wsp->walk_addr = addr;
+	if (mdb_layered_walk("softstate", wsp) != 0) {
+		mdb_warn("failed to walk softstate");
+		return (WALK_ERR);
+	}
+
+	return (WALK_NEXT);
+}
+
+static int
+xhci_mdb_walk_xhci_step(mdb_walk_state_t *wsp)
+{
+	xhci_t xhci;
+
+	if (mdb_vread(&xhci, sizeof (xhci), wsp->walk_addr) != sizeof (xhci)) {
+		mdb_warn("failed to read xhci_t at %p", wsp->walk_addr);
+		return (WALK_ERR);
+	}
+
+	return (wsp->walk_callback(wsp->walk_addr, &xhci, wsp->walk_cbdata));
+}
+
+static int
+xhci_mdb_walk_xhci_device_init(mdb_walk_state_t *wsp)
+{
+	uintptr_t addr;
+
+	if (wsp->walk_addr == 0) {
+		mdb_warn("::walk xhci_device requires an xhci_t\n");
+		return (WALK_ERR);
+	}
+
+	addr = wsp->walk_addr;
+	addr += offsetof(xhci_t, xhci_usba);
+	addr += offsetof(xhci_usba_t, xa_devices);
+	wsp->walk_addr = (uintptr_t)addr;
+	if (mdb_layered_walk("list", wsp) != 0) {
+		mdb_warn("failed to walk list");
+		return (WALK_ERR);
+	}
+
+	return (WALK_NEXT);
+}
+
+static int
+xhci_mdb_walk_xhci_device_step(mdb_walk_state_t *wsp)
+{
+	xhci_device_t xd;
+
+	if (mdb_vread(&xd, sizeof (xd), wsp->walk_addr) != sizeof (xd)) {
+		mdb_warn("failed to read xhci_device_t at %p", wsp->walk_addr);
+		return (WALK_ERR);
+	}
+
+	return (wsp->walk_callback(wsp->walk_addr, &xd, wsp->walk_cbdata));
+}
+
+static int
+xhci_mdb_walk_xhci_endpoint_init(mdb_walk_state_t *wsp)
+{
+	xhci_mdb_walk_endpoint_t *xm;
+	xhci_device_t *xd;
+
+	if (wsp->walk_addr == 0) {
+		mdb_warn("::walk xhci_endpoint requires an xhci_device_t\n");
+		return (WALK_ERR);
+	}
+
+	xm = mdb_alloc(sizeof (xhci_mdb_walk_endpoint_t), UM_SLEEP | UM_GC);
+	xm->xmwe_ep = 0;
+	xd = &xm->xmwe_device;
+	if (mdb_vread(xd, sizeof (*xd), wsp->walk_addr) != sizeof (*xd)) {
+		mdb_warn("failed to read xhci_endpoint_t at %p",
+		    wsp->walk_addr);
+		return (WALK_ERR);
+	}
+	wsp->walk_data = xm;
+
+	return (WALK_NEXT);
+}
+
+static int
+xhci_mdb_walk_xhci_endpoint_step(mdb_walk_state_t *wsp)
+{
+	int ret;
+	uintptr_t addr;
+	xhci_mdb_walk_endpoint_t *xm = wsp->walk_data;
+
+	if (xm->xmwe_ep >= XHCI_NUM_ENDPOINTS)
+		return (WALK_DONE);
+
+	addr = (uintptr_t)xm->xmwe_device.xd_endpoints[xm->xmwe_ep];
+	if (addr != NULL) {
+		xhci_endpoint_t xe;
+
+		if (mdb_vread(&xe, sizeof (xe), addr) != sizeof (xe)) {
+			mdb_warn("failed to read xhci_endpoint_t at %p",
+			    xm->xmwe_device.xd_endpoints[xm->xmwe_ep]);
+			return (WALK_ERR);
+		}
+
+		ret = wsp->walk_callback(addr, &xe, wsp->walk_cbdata);
+	} else {
+		ret = WALK_NEXT;
+	}
+	xm->xmwe_ep++;
+
+	return (ret);
+}
+
+typedef struct xhci_mdb_find {
+	int		xmf_slot;
+	int		xmf_ep;
+	uintptr_t	xmf_addr;
+} xhci_mdb_find_t;
+
+static int
+xhci_mdb_find_endpoint_cb(uintptr_t addr, const void *data, void *arg)
+{
+	const xhci_endpoint_t *xep = data;
+	xhci_mdb_find_t *xmf = arg;
+
+	/*
+	 * The endpoints that are presented here are off by one from the actual
+	 * endpoint ID in the xhci_endpoint_t, as we're really displaying the
+	 * index into the device input context.
+	 */
+	if (xep->xep_num + 1 == xmf->xmf_ep) {
+		xmf->xmf_addr = addr;
+		return (WALK_DONE);
+	}
+
+	return (WALK_NEXT);
+}
+
+static int
+xhci_mdb_find_device_cb(uintptr_t addr, const void *data, void *arg)
+{
+	const xhci_device_t *xd = data;
+	xhci_mdb_find_t *xmf = arg;
+
+	if (xd->xd_slot == xmf->xmf_slot) {
+		if (xmf->xmf_ep == -1) {
+			xmf->xmf_addr = addr;
+			return (WALK_DONE);
+		}
+
+		if (mdb_pwalk("xhci`xhci_endpoint", xhci_mdb_find_endpoint_cb,
+		    xmf, addr) == -1) {
+			mdb_warn("failed to walk xhci_endpoint at %p", addr);
+			return (WALK_ERR);
+		}
+
+		return (WALK_DONE);
+	}
+
+	return (WALK_NEXT);
+}
+
+static int
+xhci_mdb_find(uintptr_t addr, uint_t flags, int argc,
+    const mdb_arg_t *argv)
+{
+	uintptr_t ep, slot;
+	boolean_t ep_set, slot_set;
+	xhci_mdb_find_t xmf;
+
+	if ((flags & DCMD_ADDRSPEC) == 0)
+		return (DCMD_USAGE);
+
+	ep_set = slot_set = B_FALSE;
+	if (mdb_getopts(argc, argv, 'e', MDB_OPT_UINTPTR_SET, &ep_set, &ep,
+	    's', MDB_OPT_UINTPTR_SET, &slot_set, &slot) != argc)
+		return (DCMD_USAGE);
+
+	if (!slot_set) {
+		mdb_warn("-s is required\n");
+		return (DCMD_USAGE);
+	}
+
+	xmf.xmf_slot = (int)slot;
+	if (ep_set)
+		xmf.xmf_ep = (int)ep;
+	else
+		xmf.xmf_ep = -1;
+	xmf.xmf_addr = 0;
+
+	if (mdb_pwalk("xhci`xhci_device", xhci_mdb_find_device_cb,
+	    &xmf, addr) == -1) {
+		mdb_warn("failed to walk xhci_device at %p", addr);
+		return (DCMD_ERR);
+	}
+
+	if (xmf.xmf_addr == 0) {
+		if (ep_set) {
+			mdb_warn("failed to find xhci_endpoint_t for slot %d "
+			    "and endpoint %d\n", slot, ep);
+		} else {
+			mdb_warn("failed to find xhci_device_t for slot %d\n",
+			    slot);
+		}
+		return (DCMD_ERR);
+	}
+
+	mdb_printf("%p\n", xmf.xmf_addr);
+	return (DCMD_OK);
+}
+
+/* ARGSUSED */
+static int
+xhci_mdb_endpoint_count(uintptr_t addr, const void *ep, void *arg)
+{
+	int *countp = arg;
+
+	*countp += 1;
+	return (WALK_NEXT);
+}
+
+/* ARGSUSED */
+static int
+xhci_mdb_print_endpoint_summary(uintptr_t addr, const void *ep, void *arg)
+{
+	const xhci_device_t *xd = arg;
+	const xhci_endpoint_t *xep = ep;
+	const char *type;
+	const char *state;
+	xhci_endpoint_context_t epctx;
+	int eptype;
+
+	if (mdb_vread(&epctx, sizeof (epctx),
+	    (uintptr_t)xd->xd_endout[xep->xep_num]) != sizeof (epctx)) {
+		mdb_warn("failed to read endpoint context at %p",
+		    xd->xd_endout[xep->xep_num]);
+		return (WALK_ERR);
+	}
+
+	eptype = XHCI_EPCTX_GET_EPTYPE(LE_32(epctx.xec_info2));
+	type = xhci_mdb_epctx_eptypes[eptype];
+	state = xhci_mdb_epctx_states[XHCI_EPCTX_STATE(LE_32(epctx.xec_info))];
+
+	mdb_printf("%-4d %-10s %-10s 0x%-04x 0x%-04x\n", xep->xep_num, type,
+	    state, xep->xep_ring.xr_head, xep->xep_ring.xr_tail);
+
+	return (WALK_NEXT);
+}
+
+/* ARGSUSED */
+static int
+xhci_mdb_print_device(uintptr_t addr, uint_t flags, int argc,
+    const mdb_arg_t *argv)
+{
+	int count;
+	xhci_device_t xd;
+	usba_device_t ud;
+	char product[256], mfg[256];
+
+	if (!(flags & DCMD_ADDRSPEC)) {
+		return (mdb_eval("::walk xhci`xhci | ::walk xhci`xhci_device | "
+		    "::xhci_device"));
+	}
+
+	if (mdb_vread(&xd, sizeof (xd), addr) != sizeof (xd)) {
+		mdb_warn("failed to read xhci_device_t at 0x%x", addr);
+		return (DCMD_ERR);
+	}
+
+	if (mdb_vread(&ud, sizeof (ud), (uintptr_t)xd.xd_usbdev) !=
+	    sizeof (ud)) {
+		mdb_warn("failed to read usba_device_t at %p\n", xd.xd_usbdev);
+		return (DCMD_ERR);
+	}
+
+	if (ud.usb_mfg_str == NULL || mdb_readstr(mfg, sizeof (mfg),
+	    (uintptr_t)ud.usb_mfg_str) <= 0) {
+		(void) strlcpy(mfg, "Unknown Manufacturer", sizeof (mfg));
+	}
+
+	if (ud.usb_product_str == NULL || mdb_readstr(product, sizeof (product),
+	    (uintptr_t)ud.usb_product_str) <= 0) {
+		(void) strlcpy(product, "Unknown Product", sizeof (product));
+	}
+
+	mdb_printf("%<b>%s - %s%</b>\n", mfg, product);
+
+	count = 0;
+	if (mdb_pwalk("xhci`xhci_endpoint", xhci_mdb_endpoint_count, &count,
+	    addr) == -1) {
+		mdb_warn("failed to walk xhci_endpoint rooted at 0x%x", addr);
+		return (DCMD_ERR);
+	}
+
+	mdb_printf("Port %02d | Slot %02d | # Endpoints %02d\n", xd.xd_port,
+	    xd.xd_slot, count);
+	mdb_printf("%<u>%-4s %-10s %-10s %-6s %-6s%</u>\n", "EP", "Type",
+	    "State", "Head", "Tail");
+
+	if (mdb_pwalk("xhci`xhci_endpoint", xhci_mdb_print_endpoint_summary,
+	    &xd, addr) == -1) {
+		mdb_warn("failed to walk xhci_endpoint rooted at 0x%x", addr);
+		return (DCMD_ERR);
+	}
+
+
+	mdb_printf("\n");
+
+	return (DCMD_OK);
+}
+
+static int
+xhci_mdb_find_trb(uintptr_t addr, uint_t flags, int argc,
+    const mdb_arg_t *argv)
+{
+	xhci_ring_t xr;
+	uint64_t base, max, target;
+
+	if (!(flags & DCMD_ADDRSPEC)) {
+		mdb_warn("missing required xhci_ring_t\n");
+		return (DCMD_USAGE);
+	}
+
+	if (argc == 0) {
+		mdb_warn("missing required PA of ring\n");
+		return (DCMD_USAGE);
+	}
+
+	if (argc > 1) {
+		mdb_warn("too many arguments\n");
+		return (DCMD_USAGE);
+	}
+
+	if (mdb_vread(&xr, sizeof (xr), addr) != sizeof (xr)) {
+		mdb_warn("failed to read xhci_ring_t at %p", addr);
+		return (DCMD_USAGE);
+	}
+
+	if (argv[0].a_type == MDB_TYPE_IMMEDIATE) {
+		target = argv[0].a_un.a_val;
+	} else if (argv[0].a_type == MDB_TYPE_STRING) {
+		target = mdb_strtoull(argv[0].a_un.a_str);
+	} else {
+		mdb_warn("argument is an unknown supported type: %d\n",
+		    argv[0].a_type);
+		return (DCMD_USAGE);
+	}
+	target = roundup(target, sizeof (xhci_trb_t));
+
+	base = xr.xr_dma.xdb_cookies[0].dmac_laddress;
+	max = base + xr.xr_ntrb * sizeof (xhci_trb_t);
+
+	if (target < base || target > max) {
+		mdb_warn("target address %p is outside the range of PAs for "
+		    "TRBs in the ring [%p, %p)", target, base, max);
+		return (DCMD_ERR);
+	}
+	target -= base;
+	mdb_printf("0x%" PRIx64 "\n", target + (uintptr_t)xr.xr_trb);
+
+	return (DCMD_OK);
+}
+
+static const mdb_dcmd_t xhci_dcmds[] = {
+	{ "xhci_epctx", ":", "print endpoint context",
+	    xhci_mdb_print_epctx, NULL },
+	{ "xhci_slotctx", ":", "print slot context",
+	    xhci_mdb_print_slotctx, NULL },
+	{ "xhci_trb", ":", "print TRB",
+	    xhci_mdb_print_trb, NULL },
+	{ "xhci_find", ": -s slot [-e endpiont]",
+	    "find given xhci slot or endpoint",
+	    xhci_mdb_find, NULL },
+	{ "xhci_device", ":", "device summary",
+	    xhci_mdb_print_device, NULL },
+	{ "xhci_find_trb", ": pa", "find trb with PA in ring",
+	    xhci_mdb_find_trb, NULL },
+	{ NULL }
+};
+
+static const mdb_walker_t xhci_walkers[] = {
+	{ "xhci", "walk list of xhci_t structures",
+	    xhci_mdb_walk_xhci_init, xhci_mdb_walk_xhci_step, NULL },
+	{ "xhci_device", "walk list of xhci_device_t structures",
+	    xhci_mdb_walk_xhci_device_init, xhci_mdb_walk_xhci_device_step,
+	    NULL },
+	{ "xhci_endpoint", "walk list of xhci_endpoint_t structures",
+	    xhci_mdb_walk_xhci_endpoint_init, xhci_mdb_walk_xhci_endpoint_step,
+	    NULL },
+	{ NULL }
+};
+
+static const mdb_modinfo_t xhci_modinfo = {
+	MDB_API_VERSION, xhci_dcmds, xhci_walkers
+};
+
+const mdb_modinfo_t *
+_mdb_init(void)
+{
+	return (&xhci_modinfo);
+}
diff --git a/usr/src/cmd/mdb/i86pc/modules/apix/apix.c b/usr/src/cmd/mdb/i86pc/modules/apix/apix.c
index 62ede1fd26..ca168f2cdb 100644
--- a/usr/src/cmd/mdb/i86pc/modules/apix/apix.c
+++ b/usr/src/cmd/mdb/i86pc/modules/apix/apix.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include "intr_common.h"
@@ -170,5 +171,9 @@ _mdb_init(void)
 		if (GELF_ST_TYPE(sym.st_info) == STT_FUNC)
 			gld_intr_addr = (uintptr_t)sym.st_value;
 
+	if (mdb_readvar(&apic_pir_vect, "apic_pir_vect") == -1) {
+		apic_pir_vect = -1;
+	}
+
 	return (&modinfo);
 }
diff --git a/usr/src/cmd/mdb/i86pc/modules/common/intr_common.c b/usr/src/cmd/mdb/i86pc/modules/common/intr_common.c
index 00f6afcbf8..86c24040fa 100644
--- a/usr/src/cmd/mdb/i86pc/modules/common/intr_common.c
+++ b/usr/src/cmd/mdb/i86pc/modules/common/intr_common.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include "intr_common.h"
@@ -29,6 +30,7 @@
 
 int		option_flags;
 uintptr_t	gld_intr_addr;
+int		apic_pir_vect;
 static struct av_head softvec_tbl[LOCK_LEVEL + 1];
 
 static char *businfo_array[] = {
@@ -302,11 +304,16 @@ apic_interrupt_dump(apic_irq_t *irqp, struct av_head *avp,
 
 	} else {
 		if (irqp->airq_mps_intr_index == RESERVE_INDEX &&
-		    !irqp->airq_share)
-			mdb_printf("poke_cpu");
-		else if (mdb_vread(&avhp, sizeof (struct autovec),
-		    (uintptr_t)avp->avh_link) != -1)
+		    !irqp->airq_share) {
+			if (irqp->airq_vector == apic_pir_vect) {
+				mdb_printf("pir_ipi");
+			} else {
+				mdb_printf("poke_cpu");
+			}
+		} else if (mdb_vread(&avhp, sizeof (struct autovec),
+		    (uintptr_t)avp->avh_link) != -1) {
 			mdb_printf("%a", avhp.av_vector);
+		}
 	}
 	mdb_printf("\n");
 }
@@ -446,10 +453,15 @@ apix_interrupt_ipi_dump(apix_vector_t *vectp, struct autovec *avp,
 		mdb_printf("%-9s %-3s %s%-3s %-6s %-3s %-6s %-3d   %-9s ",
 		    cpu_vector, "-  ", evtchn, ipl, "-   ", "Edg",
 		    intr_type, vectp->v_share, ioapic_iline);
-	if (!vectp->v_share)
-		mdb_printf("poke_cpu");
-	else
+	if (!vectp->v_share) {
+		if (vectp->v_vector == apic_pir_vect) {
+			mdb_printf("pir_ipi");
+		} else {
+			mdb_printf("poke_cpu");
+		}
+	} else {
 		mdb_printf("%a", avp->av_vector);
+	}
 
 	mdb_printf("\n");
 }
diff --git a/usr/src/cmd/mdb/i86pc/modules/common/intr_common.h b/usr/src/cmd/mdb/i86pc/modules/common/intr_common.h
index d2d92594ba..531cca5f2a 100644
--- a/usr/src/cmd/mdb/i86pc/modules/common/intr_common.h
+++ b/usr/src/cmd/mdb/i86pc/modules/common/intr_common.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef _MDB_INTR_COMMON_H
@@ -73,6 +74,9 @@ extern int	option_flags;
  */
 extern uintptr_t	gld_intr_addr;
 
+/* cached the PIR ipi vector to differentiate it from poke_cpu */
+extern int	apic_pir_vect;
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/usr/src/cmd/mdb/i86pc/modules/pcplusmp/pcplusmp.c b/usr/src/cmd/mdb/i86pc/modules/pcplusmp/pcplusmp.c
index a682707337..bb24b0ae70 100644
--- a/usr/src/cmd/mdb/i86pc/modules/pcplusmp/pcplusmp.c
+++ b/usr/src/cmd/mdb/i86pc/modules/pcplusmp/pcplusmp.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include "intr_common.h"
@@ -116,5 +117,9 @@ _mdb_init(void)
 		if (GELF_ST_TYPE(sym.st_info) == STT_FUNC)
 			gld_intr_addr = (uintptr_t)sym.st_value;
 
+	if (mdb_readvar(&apic_pir_vect, "apic_pir_vect") == -1) {
+		apic_pir_vect = -1;
+	}
+
 	return (&modinfo);
 }
diff --git a/usr/src/cmd/mdb/i86pc/modules/unix/unix.c b/usr/src/cmd/mdb/i86pc/modules/unix/unix.c
index 92ac3f83ca..a66ecbe8a3 100644
--- a/usr/src/cmd/mdb/i86pc/modules/unix/unix.c
+++ b/usr/src/cmd/mdb/i86pc/modules/unix/unix.c
@@ -770,6 +770,26 @@ ptmap_help(void)
 	    "-w run ::whatis on mapping start addresses\n");
 }
 
+static const char *const scalehrtime_desc =
+	"Scales a timestamp from ticks to nanoseconds. Unscaled timestamps\n"
+	"are used as both a quick way of accumulating relative time (as for\n"
+	"usage) and as a quick way of getting the absolute current time.\n"
+	"These uses require slightly different scaling algorithms. By\n"
+	"default, if a specified time is greater than half of the unscaled\n"
+	"time at the last tick (that is, if the unscaled time represents\n"
+	"more than half the time since boot), the timestamp is assumed to\n"
+	"be absolute, and the scaling algorithm used mimics that which the\n"
+	"kernel uses in gethrtime(). Otherwise, the timestamp is assumed to\n"
+	"be relative, and the algorithm mimics scalehrtime(). This behavior\n"
+	"can be overridden by forcing the unscaled time to be interpreted\n"
+	"as relative (via -r) or absolute (via -a).\n";
+
+static void
+scalehrtime_help(void)
+{
+	mdb_printf("%s", scalehrtime_desc);
+}
+
 /*
  * NSEC_SHIFT is replicated here (it is not defined in a header file),
  * but for amusement, the reader is directed to the comment that explains
@@ -785,22 +805,31 @@ static int
 scalehrtime_cmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 {
 	uint32_t nsec_scale;
-	hrtime_t tsc = addr, hrt;
+	hrtime_t tsc = addr, hrt, tsc_last, base, mult = 1;
 	unsigned int *tscp = (unsigned int *)&tsc;
 	uintptr_t scalehrtimef;
 	uint64_t scale;
 	GElf_Sym sym;
+	int expected = !(flags & DCMD_ADDRSPEC);
+	uint_t absolute = FALSE, relative = FALSE;
 
-	if (!(flags & DCMD_ADDRSPEC)) {
-		if (argc != 1)
-			return (DCMD_USAGE);
+	if (mdb_getopts(argc, argv,
+	    'a', MDB_OPT_SETBITS, TRUE, &absolute,
+	    'r', MDB_OPT_SETBITS, TRUE, &relative, NULL) != argc - expected)
+		return (DCMD_USAGE);
+
+	if (absolute && relative) {
+		mdb_warn("can't specify both -a and -r\n");
+		return (DCMD_USAGE);
+	}
 
-		switch (argv[0].a_type) {
+	if (expected == 1) {
+		switch (argv[argc - 1].a_type) {
 		case MDB_TYPE_STRING:
-			tsc = mdb_strtoull(argv[0].a_un.a_str);
+			tsc = mdb_strtoull(argv[argc - 1].a_un.a_str);
 			break;
 		case MDB_TYPE_IMMEDIATE:
-			tsc = argv[0].a_un.a_val;
+			tsc = argv[argc - 1].a_un.a_val;
 			break;
 		default:
 			return (DCMD_USAGE);
@@ -829,12 +858,40 @@ scalehrtime_cmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 		return (DCMD_ERR);
 	}
 
+	if (mdb_readsym(&tsc_last, sizeof (tsc_last), "tsc_last") == -1) {
+		mdb_warn("couldn't read 'tsc_last'");
+		return (DCMD_ERR);
+	}
+
+	if (mdb_readsym(&base, sizeof (base), "tsc_hrtime_base") == -1) {
+		mdb_warn("couldn't read 'tsc_hrtime_base'");
+		return (DCMD_ERR);
+	}
+
+	/*
+	 * If our time is greater than half of tsc_last, we will take our
+	 * delta against tsc_last, convert it, and add that to (or subtract it
+	 * from) tsc_hrtime_base.  This mimics what the kernel actually does
+	 * in gethrtime() (modulo the tsc_sync_tick_delta) and gets us a much
+	 * higher precision result than trying to convert a large tsc value.
+	 */
+	if (absolute || (tsc > (tsc_last >> 1) && !relative)) {
+		if (tsc > tsc_last) {
+			tsc = tsc - tsc_last;
+		} else {
+			tsc = tsc_last - tsc;
+			mult = -1;
+		}
+	} else {
+		base = 0;
+	}
+
 	scale = (uint64_t)nsec_scale;
 
 	hrt = ((uint64_t)tscp[1] * scale) << NSEC_SHIFT;
 	hrt += ((uint64_t)tscp[0] * scale) >> (32 - NSEC_SHIFT);
 
-	mdb_printf("0x%llx\n", hrt);
+	mdb_printf("0x%llx\n", base + (hrt * mult));
 
 	return (DCMD_OK);
 }
@@ -1000,8 +1057,8 @@ static const mdb_dcmd_t dcmds[] = {
 	{ "mfntopfn", ":", "convert hypervisor machine page to physical page",
 	    mfntopfn_dcmd },
 	{ "memseg_list", ":", "show memseg list", memseg_list },
-	{ "scalehrtime", ":",
-	    "scale an unscaled high-res time", scalehrtime_cmd },
+	{ "scalehrtime", ":[-a|-r]", "scale an unscaled high-res time",
+	    scalehrtime_cmd, scalehrtime_help },
 	{ "x86_featureset", NULL, "dump the x86_featureset vector",
 		x86_featureset_cmd },
 #ifdef _KMDB
diff --git a/usr/src/cmd/mdb/intel/amd64/Makefile b/usr/src/cmd/mdb/intel/amd64/Makefile
index e51c3c5a69..f7bc890fb5 100644
--- a/usr/src/cmd/mdb/intel/amd64/Makefile
+++ b/usr/src/cmd/mdb/intel/amd64/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 
 include ../../Makefile.common
diff --git a/usr/src/cmd/mdb/intel/amd64/libpython/Makefile b/usr/src/cmd/mdb/intel/amd64/libpython/Makefile
index f454b29658..d78b5e0fc2 100644
--- a/usr/src/cmd/mdb/intel/amd64/libpython/Makefile
+++ b/usr/src/cmd/mdb/intel/amd64/libpython/Makefile
@@ -42,7 +42,6 @@ include ../../../Makefile.module
 %.ln := CPPFLAGS += $(PYLNFLAGS)
 LINTFLAGS += -erroff=E_MACRO_REDEFINED
 
-
 dmod/$(MODULE) := LDLIBS += -lproc
 
 %.o: $(MODSRCS_DIR)/%.c
diff --git a/usr/src/cmd/mdb/intel/amd64/libumem/Makefile b/usr/src/cmd/mdb/intel/amd64/libumem/Makefile
index 704ff65873..ae22217a1b 100644
--- a/usr/src/cmd/mdb/intel/amd64/libumem/Makefile
+++ b/usr/src/cmd/mdb/intel/amd64/libumem/Makefile
@@ -22,6 +22,7 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright (c) 2012 Joyent, Inc. All rights reserved.
 
 MODULE = libumem.so
 MDBTGT = proc
diff --git a/usr/src/cmd/mdb/intel/amd64/xhci/Makefile b/usr/src/cmd/mdb/intel/amd64/xhci/Makefile
new file mode 100644
index 0000000000..0de7a701a7
--- /dev/null
+++ b/usr/src/cmd/mdb/intel/amd64/xhci/Makefile
@@ -0,0 +1,27 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+
+MODULE = xhci.so
+MDBTGT = kvm
+
+MODSRCS = xhci.c
+
+include ../../../../Makefile.cmd
+include ../../../../Makefile.cmd.64
+include ../../Makefile.amd64
+include ../../../Makefile.module
+
+CPPFLAGS += -I$(SRC)/uts/common
diff --git a/usr/src/cmd/mdb/intel/ia32/libumem/Makefile b/usr/src/cmd/mdb/intel/ia32/libumem/Makefile
index a1ab338f40..bde1be90ac 100644
--- a/usr/src/cmd/mdb/intel/ia32/libumem/Makefile
+++ b/usr/src/cmd/mdb/intel/ia32/libumem/Makefile
@@ -22,6 +22,7 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright (c) 2012 Joyent, Inc. All rights reserved.
 
 MODULE = libumem.so
 MDBTGT = proc
diff --git a/usr/src/cmd/mdb/intel/ia32/xhci/Makefile b/usr/src/cmd/mdb/intel/ia32/xhci/Makefile
new file mode 100644
index 0000000000..6fb72a3b2d
--- /dev/null
+++ b/usr/src/cmd/mdb/intel/ia32/xhci/Makefile
@@ -0,0 +1,25 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+MODULE = xhci.so
+MDBTGT = kvm
+
+MODSRCS = xhci.c
+
+include ../../../../Makefile.cmd
+include ../../Makefile.ia32
+include ../../../Makefile.module
+
+CPPFLAGS += -I$(SRC)/uts/common
diff --git a/usr/src/cmd/mdb/intel/mdb/proc_amd64dep.c b/usr/src/cmd/mdb/intel/mdb/proc_amd64dep.c
index c11e08ba0d..d86c1b79f8 100644
--- a/usr/src/cmd/mdb/intel/mdb/proc_amd64dep.c
+++ b/usr/src/cmd/mdb/intel/mdb/proc_amd64dep.c
@@ -24,7 +24,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright 2015 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -74,9 +74,9 @@ const mdb_tgt_regdesc_t pt_regdesc[] = {
 	{ "r10w",	REG_R10,	MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
 	{ "r10l",	REG_R10,	MDB_TGT_R_EXPORT | MDB_TGT_R_8L },
 	{ "r9",		REG_R9,		MDB_TGT_R_EXPORT },
-	{ "r9d",	REG_R8,		MDB_TGT_R_EXPORT | MDB_TGT_R_32 },
-	{ "r9w",	REG_R8,		MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
-	{ "r9l",	REG_R8,		MDB_TGT_R_EXPORT | MDB_TGT_R_8L },
+	{ "r9d",	REG_R9,		MDB_TGT_R_EXPORT | MDB_TGT_R_32 },
+	{ "r9w",	REG_R9,		MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
+	{ "r9l",	REG_R9,		MDB_TGT_R_EXPORT | MDB_TGT_R_8L },
 	{ "r8",		REG_R8,		MDB_TGT_R_EXPORT },
 	{ "r8d",	REG_R8,		MDB_TGT_R_EXPORT | MDB_TGT_R_32 },
 	{ "r8w",	REG_R8,		MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
diff --git a/usr/src/cmd/mdb/intel/modules/i40e/amd64/Makefile b/usr/src/cmd/mdb/intel/modules/i40e/amd64/Makefile
index 66f97451b6..f1632172f5 100644
--- a/usr/src/cmd/mdb/intel/modules/i40e/amd64/Makefile
+++ b/usr/src/cmd/mdb/intel/modules/i40e/amd64/Makefile
@@ -10,7 +10,7 @@
 #
 
 #
-# Copyright 2017 Joyent, Inc.
+# Copyright 2018 Joyent, Inc.
 #
 
 MODULE = i40e.so
@@ -23,6 +23,7 @@ include ../../../../../Makefile.cmd.64
 include ../../../Makefile.amd64
 include ../../../../Makefile.module
 
+CPPFLAGS += -I$(SRC)/cmd/mdb/common
 CPPFLAGS += -I$(SRC)/uts/common/io/i40e
 CPPFLAGS += -I$(SRC)/uts/common/io/i40e/core
 CPPFLAGS += -I$(SRC)/uts/common
diff --git a/usr/src/cmd/mdb/intel/modules/i40e/i40e.c b/usr/src/cmd/mdb/intel/modules/i40e/i40e.c
index 6d1f900b43..3f42d24d1f 100644
--- a/usr/src/cmd/mdb/intel/modules/i40e/i40e.c
+++ b/usr/src/cmd/mdb/intel/modules/i40e/i40e.c
@@ -10,9 +10,10 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
+#include <mdb/mdb_ctf.h>
 #include <sys/mdb_modapi.h>
 #include "i40e_sw.h"
 
@@ -97,9 +98,181 @@ i40e_switch_rsrcs_dcmd(uintptr_t addr, uint_t flags, int argc,
 	return (DCMD_OK);
 }
 
+typedef struct mdb_i40e_trqpair {
+	uint32_t		itrq_tx_ring_size;
+	uint32_t		itrq_desc_free;
+	uint32_t 		*itrq_desc_wbhead;
+	uint32_t		itrq_desc_head;
+	uint32_t		itrq_desc_tail;
+	i40e_tx_desc_t		*itrq_desc_ring;
+	i40e_tx_control_block_t	**itrq_tcb_work_list;
+} mdb_i40e_trqpair_t;
+
+static void
+i40e_tx_ring_help()
+{
+	mdb_printf(
+	    "\t -a dump all ring entries\n"
+	    "\t or\n"
+	    "\t combine -b [start index] with -e [end index] to specify a \n"
+	    "\t range of ring entries to print\n");
+}
+
+static int
+i40e_tx_ring_dcmd(uintptr_t addr, uint_t flags, int argc,
+    const mdb_arg_t *argv)
+{
+	mdb_i40e_trqpair_t trq;
+	i40e_tx_desc_t *descring;
+	i40e_tx_control_block_t **wklist;
+	uint32_t wbhead;
+	size_t ringsz, wklistsz;
+	boolean_t opt_a = B_FALSE;
+	char *opt_b = NULL, *opt_e = NULL;
+	uint64_t begin = UINT64_MAX, end = UINT64_MAX;
+
+	if (!(flags & DCMD_ADDRSPEC)) {
+		mdb_warn("::i40e_tx_ring does not operate globally\n");
+		return (DCMD_USAGE);
+	}
+
+	if (mdb_getopts(argc, argv,
+	    'a', MDB_OPT_SETBITS, B_TRUE, &opt_a,
+	    'b', MDB_OPT_STR, &opt_b,
+	    'e', MDB_OPT_STR, &opt_e, NULL) != argc)
+		return (DCMD_USAGE);
+
+	/*
+	 * Verify that a legal combination of -a/-b/-e were used.
+	 */
+	if (opt_a && (opt_b != NULL || opt_e != NULL)) {
+		mdb_warn("-a and -b/-e are mutually exclusive\n");
+		return (DCMD_USAGE);
+	}
+	if (argc > 0 && ! opt_a && (opt_b == NULL || opt_e == NULL)) {
+		mdb_warn("-b/-e must both be specified\n");
+		return (DCMD_USAGE);
+	}
+
+	if (mdb_ctf_vread(&trq, "i40e_trqpair_t", "mdb_i40e_trqpair_t", addr,
+	    0) == -1) {
+		mdb_warn("failed to read i40e_trqpair_t at %p", addr);
+		return (DCMD_ERR);
+	}
+
+	if (opt_b != NULL)
+		begin = mdb_strtoull(opt_b);
+	if (opt_e != NULL)
+		end = mdb_strtoull(opt_e);
+	if (opt_a) {
+		begin = 0;
+		end = trq.itrq_tx_ring_size - 1;
+	}
+
+	/*
+	 * Verify that the requested range of ring entries makes sense.
+	 */
+	if (argc > 0 && (end < begin || begin >= trq.itrq_tx_ring_size ||
+	    end >= trq.itrq_tx_ring_size)) {
+		mdb_warn("invalid range specified\n");
+		return (DCMD_USAGE);
+	}
+
+	if (mdb_vread(&wbhead, sizeof (uint32_t),
+	    (uintptr_t)trq.itrq_desc_wbhead) != sizeof (uint32_t)) {
+		mdb_warn("failed to read trq.itrq_desc_wbhead");
+		return (DCMD_ERR);
+	}
+	mdb_printf("%-20s%d\n", "Ring Size:", trq.itrq_tx_ring_size);
+	mdb_printf("%-20s%d\n", "Free Descriptors:", trq.itrq_desc_free);
+	mdb_printf("%-20s%d\n", "Writeback Head:", wbhead);
+	mdb_printf("%-20s%d\n", "Head:", trq.itrq_desc_head);
+	mdb_printf("%-20s%d\n", "Tail:", trq.itrq_desc_tail);
+
+	/*
+	 * No arguments were specified, so we're done.
+	 */
+	if (argc == 0)
+		return (DCMD_OK);
+
+	/*
+	 * Allocate memory and read in the entire TX descriptor ring and
+	 * TCB work list.
+	 */
+	ringsz = sizeof (i40e_tx_desc_t) * trq.itrq_tx_ring_size;
+	descring = mdb_alloc(ringsz, UM_SLEEP);
+	if (mdb_vread(descring, ringsz, (uintptr_t)trq.itrq_desc_ring) !=
+	    ringsz) {
+		mdb_warn("Failed to read in TX decriptor ring\n");
+		mdb_free(descring, ringsz);
+		return (DCMD_ERR);
+	}
+	wklistsz = sizeof (i40e_tx_control_block_t *) * trq.itrq_tx_ring_size;
+	wklist = mdb_alloc(wklistsz, UM_SLEEP);
+	if (mdb_vread(wklist, wklistsz, (uintptr_t)trq.itrq_tcb_work_list) !=
+	    wklistsz) {
+		mdb_warn("Failed to read in TX TCB work list\n");
+		mdb_free(descring, ringsz);
+		mdb_free(wklist, wklistsz);
+		return (DCMD_ERR);
+	}
+
+	mdb_printf("\n%-10s %-10s %-16s %-16s %-10s\n", "Index", "Desc Type",
+	    "Desc Ptr", "TCB Ptr", "Other");
+	for (uint64_t i = begin; i <= end; i++) {
+		const char *dtype;
+		char dother[17];
+		i40e_tx_desc_t *dptr;
+		i40e_tx_control_block_t *tcbptr;
+		uint64_t ctob;
+
+		dptr = &descring[i];
+		tcbptr = wklist[i];
+		ctob = LE_64(dptr->cmd_type_offset_bsz);
+		if (ctob == 0) {
+			dtype = "FREE";
+		} else {
+			switch (ctob & I40E_TXD_QW1_DTYPE_MASK) {
+			case (I40E_TX_DESC_DTYPE_CONTEXT):
+				dtype = "CONTEXT";
+				break;
+			case (I40E_TX_DESC_DTYPE_DATA):
+				dtype = "DATA";
+				break;
+			case (I40E_TX_DESC_DTYPE_FILTER_PROG):
+				dtype = "FILTER";
+				break;
+			default:
+				dtype = "UNKNOWN";
+			}
+		}
+		dother[0] = '\0';
+		if (i == wbhead)
+			(void) strcat(dother, "WBHEAD");
+
+		if (i == trq.itrq_desc_head)
+			(void) strcat(dother,
+			    strlen(dother) > 0 ? " HEAD" : "HEAD");
+
+		if (i == trq.itrq_desc_tail)
+			(void) strcat(dother,
+			    strlen(dother) > 0 ? " TAIL" : "TAIL");
+
+		mdb_printf("%-10d %-10s %-16p %-16p %-10s\n", i, dtype, dptr,
+		    tcbptr, dother);
+	}
+
+	mdb_free(descring, ringsz);
+	mdb_free(wklist, wklistsz);
+	return (DCMD_OK);
+}
+
 static const mdb_dcmd_t i40e_dcmds[] = {
 	{ "i40e_switch_rsrcs", NULL, "print switch resources",
 	    i40e_switch_rsrcs_dcmd, NULL },
+	{ "i40e_tx_ring", "[-a] -b [start index] -e [end index]\n",
+	    "dump TX descriptor ring state", i40e_tx_ring_dcmd,
+	    i40e_tx_ring_help },
 	{ NULL }
 };
 
diff --git a/usr/src/cmd/mdb/sparc/v7/libumem/Makefile b/usr/src/cmd/mdb/sparc/v7/libumem/Makefile
index 906d05d5ea..0488e6739a 100644
--- a/usr/src/cmd/mdb/sparc/v7/libumem/Makefile
+++ b/usr/src/cmd/mdb/sparc/v7/libumem/Makefile
@@ -22,6 +22,7 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright (c) 2012 Joyent, Inc. All rights reserved.
 
 MODULE = libumem.so
 MDBTGT = proc
diff --git a/usr/src/cmd/mdb/sparc/v9/libumem/Makefile b/usr/src/cmd/mdb/sparc/v9/libumem/Makefile
index 09ea0473c6..87ce977423 100644
--- a/usr/src/cmd/mdb/sparc/v9/libumem/Makefile
+++ b/usr/src/cmd/mdb/sparc/v9/libumem/Makefile
@@ -22,6 +22,7 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright (c) 2012 Joyent, Inc. All rights reserved.
 
 MODULE = libumem.so
 MDBTGT = proc
diff --git a/usr/src/cmd/mdb/test/mtest.sh b/usr/src/cmd/mdb/test/mtest.sh
index f21d0faa21..f21d0faa21 100644..100755
--- a/usr/src/cmd/mdb/test/mtest.sh
+++ b/usr/src/cmd/mdb/test/mtest.sh
diff --git a/usr/src/cmd/mdb/test/options/tst.autowrap.mdb b/usr/src/cmd/mdb/test/options/tst.autowrap.mdb
new file mode 100644
index 0000000000..5c62e288d3
--- /dev/null
+++ b/usr/src/cmd/mdb/test/options/tst.autowrap.mdb
@@ -0,0 +1,8 @@
+::set +o autowrap
+::typedef -c lp32
+0::printf "Pack my box with five dozen liquor jugs. How razorback-jumping frogs can level six piqued gymnasts! Amazingly few discotheques provide jukeboxes.%d" int .
+
+::set -o autowrap
+0::printf "Pack my box with five dozen liquor jugs. How razorback-jumping frogs can level six piqued gymnasts! Amazingly few discotheques provide jukeboxes.%d" int .
+
+
diff --git a/usr/src/cmd/mdb/test/typedef/tst.cleanupstruct.ksh b/usr/src/cmd/mdb/test/typedef/tst.cleanupstruct.ksh
index 1abf7540ce..fabc7dfb57 100644
--- a/usr/src/cmd/mdb/test/typedef/tst.cleanupstruct.ksh
+++ b/usr/src/cmd/mdb/test/typedef/tst.cleanupstruct.ksh
@@ -5,7 +5,7 @@
 # will fail validation. So here we go!
 #
 
-TMPFILE="/tmp/$(mktemp mtest.XXXXXX)"
+TMPFILE="$(mktemp -p /tmp mtest.XXXXXX)"
 if [[ -z "$TMPFILE" ]]; then
 	echo "Failed to get a temp file" 2>&1
 	exit 1
diff --git a/usr/src/cmd/mdb/test/typedef/tst.dellist.mdb.out b/usr/src/cmd/mdb/test/typedef/tst.dellist.mdb.out
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/usr/src/cmd/mdb/test/typedef/tst.dellist.mdb.out
diff --git a/usr/src/cmd/mdb/test/typedef/tst.emptylist.mdb.out b/usr/src/cmd/mdb/test/typedef/tst.emptylist.mdb.out
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/usr/src/cmd/mdb/test/typedef/tst.emptylist.mdb.out
diff --git a/usr/src/cmd/nicstat/Makefile b/usr/src/cmd/nicstat/Makefile
new file mode 100644
index 0000000000..935011119a
--- /dev/null
+++ b/usr/src/cmd/nicstat/Makefile
@@ -0,0 +1,31 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2013 Joyent, Inc.  All rights reserved.
+#
+
+PROG =	nicstat
+
+include ../Makefile.cmd
+
+all: $(PROG)
+
+install: all .WAIT $(ROOTPROG)
+
+clean:
+
+$(ROOTBINPROG): $(PROG)
+	$(INS.file)
+
+lint:
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/nicstat/nicstat.pl b/usr/src/cmd/nicstat/nicstat.pl
new file mode 100644
index 0000000000..fae4c797df
--- /dev/null
+++ b/usr/src/cmd/nicstat/nicstat.pl
@@ -0,0 +1,424 @@
+#!/usr/perl5/bin/perl -w
+#
+# nicstat - print network traffic, Kbyte/s read and written. 
+#           Solaris 8+, Perl (Sun::Solaris::Kstat).
+#
+# "netstat -i" only gives a packet count, this program gives Kbytes.
+#
+# 04-Apr-2011, ver 1.00J
+#
+# USAGE:    nicstat [-hsz] [-i int[,int...]] | [interval [count]]
+#
+#           -h              # help
+#           -s              # print summary output
+#           -z              # skip zero lines
+#           -i int[,int...] # print these instances only
+#   eg,
+#           nicstat         # print summary since boot
+#           nicstat 1       # print continually, every 1 second
+#           nicstat 1 5     # print 5 times, every 1 second
+#           nicstat -i hme0 # only examine hme0
+#
+# This prints out the KB/s transferred for all the network cards (NICs),
+# including packet counts and average sizes. The first line is the summary
+# data since boot.
+#
+# FIELDS:
+#           Int         Interface
+#           rKB/s       read Kbytes/s
+#           wKB/s       write Kbytes/s
+#           rPk/s       read Packets/s
+#           wPk/s       write Packets/s
+#           rAvs        read Average size, bytes
+#           wAvs        write Average size, bytes
+#           %Util       %Utilisation (r or w/ifspeed)
+#           Sat         Saturation (defer, nocanput, norecvbuf, noxmtbuf)
+#
+# NOTES:
+#
+# - Some unusual network cards may not provide all the details to Kstat,
+#   (or provide different symbols). Check for newer versions of this program,
+#   and the @Network array in the code below.
+# - Utilisation is based on bytes transferred divided by speed of the interface
+#   (if the speed is known). It should be impossible to reach 100% as there
+#   are overheads due to bus negotiation and timing.
+# - Loopback interfaces may only provide packet counts (if anything), and so
+#   bytes and %util will always be zero. Newer versions of Solaris (newer than
+#   Solaris 10 6/06) may provide loopback byte stats.
+# - Saturation is determined by counting read and write errors caused by the 
+#   interface running at saturation. This approach is not ideal, and the value
+#   reported is often lower than it should be (eg, 0.0). Reading the rKB/s and
+#   wKB/s fields may be more useful.
+#
+# SEE ALSO:
+#           nicstat.c       # the C version, also on my website
+#           kstat -n hme0 [interval [count]]       # or qfe0, ...
+#           netstat -iI hme0 [interval [count]]
+#           se netstat.se [interval]               # SE Toolkit
+#           se nx.se [interval]                    # SE Toolkit
+#
+# COPYRIGHT: Copyright (c) 2013 Brendan Gregg.
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at docs/cddl1.txt or
+# http://opensource.org/licenses/CDDL-1.0.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at docs/cddl1.txt.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright 2015 Joyent, Inc. All rights reserved.
+#
+# Author: Brendan Gregg  [Sydney, Australia]
+#
+# 18-Jul-2004   Brendan Gregg   Created this.
+# 07-Jan-2005       "      "    added saturation value.
+# 07-Jan-2005       "      "    added summary style (from Peter Tribble).
+# 23-Jan-2006       "      "    Tweaked style.
+# 11-Aug-2006       "      "    Improved output neatness.
+# 30-Sep-2006       "      "    Added loopback, tweaked output.
+# 04-Apr-2011	brendan@joyent.com	Updated for smartmachines.
+
+use strict;
+use Getopt::Std;
+use Sun::Solaris::Kstat;
+my $Kstat = Sun::Solaris::Kstat->new();
+
+
+#
+#  Process command line args
+#
+usage() if defined $ARGV[0] and $ARGV[0] eq "--help";
+getopts('hi:sz') or usage();
+usage() if defined $main::opt_h;
+my $STYLE  = defined $main::opt_s ? $main::opt_s : 0;
+my $SKIPZERO  = defined $main::opt_z ? $main::opt_z : 0;
+
+# process [interval [count]],
+my ($interval, $loop_max);
+if (defined $ARGV[0]) {
+    $interval = $ARGV[0];
+    $loop_max = defined $ARGV[1] ? $ARGV[1] : 2**32;
+    usage() if $interval == 0;
+}
+else {
+    $interval = 1;
+    $loop_max = 1; 
+}
+
+# check for -i,
+my %NetworkOnly;             # network interfaces to print
+my $NETWORKONLY = 0;         # match on network interfaces
+if (defined $main::opt_i) {
+    foreach my $net (split /,/, $main::opt_i) {
+        $NetworkOnly{$net} = 1;
+    }
+    $NETWORKONLY = 1;
+}
+
+# globals,
+my $loop = 0;                # current loop number
+my $PAGESIZE = 20;           # max lines per header
+my $line = $PAGESIZE;        # counter for lines printed
+my %NetworkNames;            # Kstat network interfaces
+my %NetworkData;             # network interface data
+my %NetworkDataOld;          # network interface data
+$main::opt_h = 0;
+$| = 1;                      # autoflush
+
+# kstat "link" module includes:
+my @Network = qw(dmfe bge be bnx ce eri eth external ge hme igb ige internal ixgbe le net ppp qfe rtls);
+my %Network;
+$Network{$_} = 1 foreach (@Network);
+my $ZONENAME = `/usr/bin/zonename`;
+chomp $ZONENAME;
+
+### Determine network interfaces
+unless (find_nets()) {
+    if ($NETWORKONLY) {
+        print STDERR "ERROR1: $main::opt_i matched no network interfaces.\n";
+    }
+    else {
+        print STDERR "ERROR1: No network interfaces found!\n";
+    }
+    exit 1;
+}
+
+
+#
+#  Main
+#
+while (1) {
+
+    ### Print Header
+    if ($line >= $PAGESIZE) {
+        if ($STYLE == 0) {
+            printf "%8s %12s %7s %7s %7s %7s %7s %7s %6s %5s\n",
+                   "Time", "Int", "rKB/s", "wKB/s", "rPk/s", "wPk/s", "rAvs",
+                   "wAvs", "%Util", "Sat";
+        }
+        elsif ($STYLE == 1) {
+            printf "%8s %12s %14s %14s\n", "Time", "Int", "rKB/s", "wKB/s";
+        }
+
+        $line = 0;
+    }
+
+    ### Get new data
+    my (@NetworkData) = fetch_net_data();
+
+    foreach my $network_data (@NetworkData) {
+
+        ### Extract values
+        my ($int, $rbytes, $wbytes, $rpackets, $wpackets, $speed, $sat, $time)
+            = split /:/, $network_data;
+
+        ### Retrieve old values
+        my ($old_rbytes, $old_wbytes, $old_rpackets, $old_wpackets, $old_sat,
+            $old_time);
+        if (defined $NetworkDataOld{$int}) {
+            ($old_rbytes, $old_wbytes, $old_rpackets, $old_wpackets,
+             $old_sat, $old_time) = split /:/, $NetworkDataOld{$int};
+        }
+        else {
+            $old_rbytes = $old_wbytes = $old_rpackets = $old_wpackets
+                = $old_sat = $old_time = 0;
+        }
+
+        #
+        #  Calculate statistics
+        #
+
+        # delta time
+        my $tdiff = $time - $old_time;
+
+        # per second values
+        my $rbps = ($rbytes - $old_rbytes) / $tdiff;
+        my $wbps = ($wbytes - $old_wbytes) / $tdiff;
+        my $rkps = $rbps / 1024;
+        my $wkps = $wbps / 1024;
+        my $rpps = ($rpackets - $old_rpackets) / $tdiff;
+        my $wpps = ($wpackets - $old_wpackets) / $tdiff;
+        my $ravs = $rpps > 0 ? $rbps / $rpps : 0;
+        my $wavs = $wpps > 0 ? $wbps / $wpps : 0;
+
+        # skip zero lines if asked
+        next if $SKIPZERO and ($rbps + $wbps) == 0;
+        
+        # % utilisation
+        my $util;
+        if ($speed > 0) {
+            # the following has a mysterious "800", it is 100 
+            # for the % conversion, and 8 for bytes2bits.
+            my $rutil = $rbps * 800 / $speed;
+            my $wutil = $wbps * 800 / $speed;
+            $util = $rutil > $wutil ? $rutil : $wutil;
+            $util = 100 if $util > 100;
+        }
+        else {
+            $util = 0;
+        }
+
+        # saturation per sec
+        my $sats = ($sat - $old_sat) / $tdiff;
+
+        #
+        #  Print statistics
+        #
+        if ($rbps ne "") {
+            my @Time = localtime();
+
+            if ($STYLE == 0) {
+                printf "%02d:%02d:%02d %12s ",
+                       $Time[2], $Time[1], $Time[0], $int;
+                print_neat($rkps);
+                print_neat($wkps);
+                print_neat($rpps);
+                print_neat($wpps);
+                print_neat($ravs);
+                print_neat($wavs);
+                printf "%6.2f %5.2f\n", $util, $sats;
+            }
+            elsif ($STYLE == 1) {
+                printf "%02d:%02d:%02d %12s %14.3f %14.3f\n",
+                       $Time[2], $Time[1], $Time[0], $int, $rkps, $wkps;
+            }
+
+            $line++;
+
+            # for multiple interfaces, always print the header
+            $line += $PAGESIZE if @NetworkData > 1;
+        }
+
+        ### Store old values
+        $NetworkDataOld{$int}
+            = "$rbytes:$wbytes:$rpackets:$wpackets:$sat:$time";
+    }
+
+    ### Check for end
+    last if ++$loop == $loop_max;
+
+    ### Interval
+    sleep $interval;
+}
+
+
+# find_nets - walk Kstat to discover network interfaces.
+#
+# This walks %Kstat and populates a %NetworkNames with discovered
+# network interfaces.
+#
+sub find_nets {
+    my $found = 0;
+
+    ### Loop over all Kstat modules
+    foreach my $module (keys %$Kstat) {
+        my $Modules = $Kstat->{$module};
+
+        foreach my $instance (keys %$Modules) {
+            my $Instances = $Modules->{$instance};
+
+            foreach my $name (keys %$Instances) {
+
+                ### Skip interface if asked
+                if ($NETWORKONLY) {
+                    next unless $NetworkOnly{$name};
+                }
+
+                my $Names = $Instances->{$name};
+
+                # Check this is a network device.
+                # Matching on ifspeed has been more reliable than "class"
+                # we also match loopback and "link" interfaces.
+                if (defined $$Names{ifspeed} || $module eq "lo"
+                    || $module eq "link") {
+                    next if $name eq "mac";
+                    if ($module eq "link") {
+                        my $nname = $name;
+                        $nname =~ s/\d+$//;
+                        next unless defined $Network{$nname}
+                                    or $ZONENAME eq $nname
+                                    or $ZONENAME eq "global";
+                    }
+                    ### Save network interface
+                    $NetworkNames{$name} = $Names;
+                    $found++;
+                }
+            }
+        }
+    }
+
+    return $found;
+}
+
+# fetch - fetch Kstat data for the network interfaces.
+#
+# This uses the interfaces in %NetworkNames and returns useful Kstat data.
+# The Kstat values used are rbytes64, obytes64, ipackets64, opackets64
+# (or the 32 bit versions if the 64 bit values are not there).
+#
+sub fetch_net_data {
+    my ($rbytes, $wbytes, $rpackets, $wpackets, $speed, $time);
+    my @NetworkData = ();
+
+    $Kstat->update();
+
+    ### Loop over previously found network interfaces
+    foreach my $name (sort keys %NetworkNames) {
+        my $Names = $NetworkNames{$name};
+
+        if (defined $$Names{opackets}) {
+
+            ### Fetch write bytes
+            if (defined $$Names{obytes64}) {
+                $rbytes = $$Names{rbytes64};
+                $wbytes = $$Names{obytes64};
+            }
+            elsif (defined $$Names{obytes}) {
+                $rbytes = $$Names{rbytes};
+                $wbytes = $$Names{obytes};
+            } else {
+                $rbytes = $wbytes = 0;
+            }
+
+            ### Fetch read bytes
+            if (defined $$Names{opackets64}) {
+                $rpackets = $$Names{ipackets64};
+                $wpackets = $$Names{opackets64};
+            }
+            else {
+                $rpackets = $$Names{ipackets};
+                $wpackets = $$Names{opackets};
+            }
+
+            ### Fetch interface speed
+            if (defined $$Names{ifspeed}) {
+                $speed = $$Names{ifspeed};
+            }
+            else {
+                # if we can't fetch the speed, print the
+                # %Util as 0.0 . To do this we,
+                $speed = 2 ** 48; 
+            }
+
+            ### Determine saturation value
+            my $sat = 0;
+            if (defined $$Names{nocanput} or defined $$Names{norcvbuf}) {
+                $sat += defined $$Names{defer} ? $$Names{defer} : 0;
+                $sat += defined $$Names{nocanput} ? $$Names{nocanput} : 0;
+                $sat += defined $$Names{norcvbuf} ? $$Names{norcvbuf} : 0;
+                $sat += defined $$Names{noxmtbuf} ? $$Names{noxmtbuf} : 0;
+            }
+
+            ### use the last snaptime value,
+            $time = $$Names{snaptime};
+
+            ### store data
+            push @NetworkData, "$name:$rbytes:$wbytes:" . 
+             "$rpackets:$wpackets:$speed:$sat:$time";
+        }
+    }
+
+    return @NetworkData;
+}
+
+# print_neat - print a float with decimal places if appropriate.
+#
+# This specifically keeps the width to 7 characters, if possible, plus
+# a trailing space.
+#
+sub print_neat {
+    my $num = shift;
+    if ($num >= 100000) {
+        printf "%7d ", $num;
+    } elsif ($num >= 100) {
+        printf "%7.1f ", $num;
+    } else {
+        printf "%7.2f ", $num;
+    }
+}
+
+# usage - print usage and exit.
+#
+sub usage {
+        print STDERR <<END;
+USAGE: nicstat [-hsz] [-i int[,int...]] | [interval [count]]
+   eg, nicstat               # print summary since boot
+       nicstat 1             # print continually every 1 second
+       nicstat 1 5           # print 5 times, every 1 second
+       nicstat -s            # summary output
+       nicstat -i hme0       # print hme0 only
+END
+        exit 1;
+}
diff --git a/usr/src/cmd/nscd/Makefile b/usr/src/cmd/nscd/Makefile
index aa478fa3b0..1e51819bb2 100644
--- a/usr/src/cmd/nscd/Makefile
+++ b/usr/src/cmd/nscd/Makefile
@@ -29,6 +29,7 @@ MANIFEST=	name-service-cache.xml
 SVCMETHOD=	svc-nscd
 
 include ../Makefile.cmd
+include ../Makefile.ctf
 
 ROOTMANIFESTDIR=	$(ROOTSVCSYSTEM)
 
diff --git a/usr/src/cmd/nscd/svc-nscd b/usr/src/cmd/nscd/svc-nscd
index 0c6aa1bc4b..78b318bf87 100644
--- a/usr/src/cmd/nscd/svc-nscd
+++ b/usr/src/cmd/nscd/svc-nscd
@@ -23,8 +23,8 @@
 #
 # Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2012 Joyent, Inc.  All rights reserved.
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
 
 . /lib/svc/share/smf_include.sh
 
@@ -51,7 +51,7 @@ if (smf_is_system_labeled); then
 					$SMF_FMRI`
         		fi
         		if [ "$duration" != "transient" ]; then
-                		( while true ; do sleep 3600 ; done ) &
+				exit $SMF_EXIT_NODAEMON
         		fi
 
         		# The real daemon is not started in non-global zones,
diff --git a/usr/src/cmd/passwd/Makefile b/usr/src/cmd/passwd/Makefile
index 561357a16c..079e8b6050 100644
--- a/usr/src/cmd/passwd/Makefile
+++ b/usr/src/cmd/passwd/Makefile
@@ -33,6 +33,8 @@ lint := LDLIBS += -lpasswdutil
 LDFLAGS += $(ZIGNORE)
 LDLIBS += -lbsm -lpam -lnsl
 
+CPPFLAGS += -D__EXTENSIONS__
+
 FILEMODE = 06555
 XGETFLAGS += -a -x $(PROG).xcl
 
diff --git a/usr/src/cmd/pgrep/pgrep.c b/usr/src/cmd/pgrep/pgrep.c
index 4531f11267..857f6ef818 100644
--- a/usr/src/cmd/pgrep/pgrep.c
+++ b/usr/src/cmd/pgrep/pgrep.c
@@ -597,6 +597,8 @@ main(int argc, char *argv[])
 	const char *optstr;
 	optdesc_t *optd;
 	int nmatches, c;
+	const char *zroot;
+	char buf[PATH_MAX];
 
 	DIR *dirp;
 
@@ -626,6 +628,12 @@ main(int argc, char *argv[])
 
 	opterr = 0;
 
+	zroot = zone_get_nroot();
+	if (zroot != NULL) {
+		(void) snprintf(buf, sizeof (buf), "%s/%s", zroot, g_procdir);
+		g_procdir = buf;
+	}
+
 	while (optind < argc) {
 		while ((c = getopt(argc, argv, optstr)) != (int)EOF) {
 
diff --git a/usr/src/cmd/pptadm/Makefile b/usr/src/cmd/pptadm/Makefile
new file mode 100644
index 0000000000..3be558a7a0
--- /dev/null
+++ b/usr/src/cmd/pptadm/Makefile
@@ -0,0 +1,43 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+PROG = pptadm
+OBJS = pptadm.o
+SRCS = $(OBJS:%.o=%.c)
+
+include ../Makefile.cmd
+include ../Makefile.ctf
+
+LDLIBS += -lofmt -lppt -lnvpair
+
+CSTD = $(CSTD_GNU99)
+C99LMODE = -Xc99=%all
+
+CLEANFILES += $(OBJS)
+
+.KEEP_STATE:
+
+all: $(OBJS) $(PROG)
+
+install: all $(ROOTUSRSBINPROG)
+
+clean:
+	-$(RM) $(CLEANFILES)
+
+lint: lint_SRCS
+
+%.o: ../%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/pptadm/pptadm.c b/usr/src/cmd/pptadm/pptadm.c
new file mode 100644
index 0000000000..c6b9094408
--- /dev/null
+++ b/usr/src/cmd/pptadm/pptadm.c
@@ -0,0 +1,205 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <stdlib.h>
+#include <stdarg.h>
+#include <getopt.h>
+#include <string.h>
+#include <ofmt.h>
+#include <err.h>
+
+#include <libppt.h>
+
+typedef enum field {
+	PPT_DEV,
+	PPT_VENDOR,
+	PPT_DEVICE,
+	PPT_SUBVENDOR,
+	PPT_SUBDEVICE,
+	PPT_REV,
+	PPT_PATH,
+	PPT_LABEL
+} field_t;
+
+const char *valname[] = {
+	"dev",
+	"vendor-id",
+	"device-id",
+	"subsystem-vendor-id",
+	"subsystem-id",
+	"revision-id",
+	"path",
+	"label"
+};
+
+static ofmt_cb_t print_field;
+
+static ofmt_field_t fields[] = {
+/* name,	field width, index, callback */
+{ "DEV",	sizeof ("/dev/pptXX"), PPT_DEV, print_field },
+{ "VENDOR",	sizeof ("VENDOR"), PPT_VENDOR, print_field },
+{ "DEVICE",	sizeof ("DEVICE"), PPT_DEVICE, print_field },
+{ "SUBVENDOR",	sizeof ("SUBVENDOR"), PPT_SUBVENDOR, print_field },
+{ "SUBDEVICE",	sizeof ("SUBDEVICE"), PPT_SUBDEVICE, print_field },
+{ "REV",	sizeof ("REV"), PPT_REV, print_field },
+{ "PATH",	50, PPT_PATH, print_field },
+{ "LABEL",	60, PPT_LABEL, print_field },
+{ NULL,		0, 0, NULL },
+};
+
+static void
+usage(const char *errmsg)
+{
+	if (errmsg != NULL)
+		(void) fprintf(stderr, "pptadm: %s\n", errmsg);
+	(void) fprintf(errmsg != NULL ? stderr : stdout,
+	    "Usage:\n"
+	    "pptadm list [ -j ]\n"
+	    "pptadm list [-ap] [-o fields]\n");
+	exit(errmsg != NULL ? EXIT_FAILURE : EXIT_SUCCESS);
+}
+
+/* PRINTFLIKE1 */
+static void
+die(const char *fmt, ...)
+{
+	va_list ap;
+	va_start(ap, fmt);
+	verrx(EXIT_FAILURE, fmt, ap);
+	va_end(ap);
+}
+
+static boolean_t
+print_field(ofmt_arg_t *arg, char *buf, uint_t bufsize)
+{
+	nvlist_t *nvl = arg->ofmt_cbarg;
+	nvpair_t *nvp = NULL;
+
+	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
+		const char *name = nvpair_name(nvp);
+		char *val = NULL;
+
+		(void) nvpair_value_string(nvp, &val);
+
+		if (strcmp(name, valname[arg->ofmt_id]) != 0)
+			continue;
+
+		(void) snprintf(buf, bufsize, "%s", val);
+		return (B_TRUE);
+	}
+
+	(void) snprintf(buf, bufsize, "--");
+	return (B_TRUE);
+}
+
+static int
+list(int argc, char *argv[])
+{
+	const char *fields_str = NULL;
+	boolean_t parsable = B_FALSE;
+	boolean_t json = B_FALSE;
+	boolean_t all = B_FALSE;
+	uint_t ofmtflags = 0;
+	ofmt_status_t oferr;
+	ofmt_handle_t ofmt;
+	int opt;
+
+	while ((opt = getopt(argc, argv, "ahjo:p")) != -1) {
+		switch (opt) {
+		case 'a':
+			all = B_TRUE;
+			break;
+		case 'h':
+			usage(NULL);
+			break;
+		case 'j':
+			json = B_TRUE;
+			break;
+		case 'o':
+			fields_str = optarg;
+			break;
+		case 'p':
+			ofmtflags |= OFMT_PARSABLE;
+			parsable = B_TRUE;
+			break;
+		default:
+			usage("unrecognized option");
+			break;
+		}
+	}
+
+	if (optind == (argc - 1))
+		usage("unused arguments");
+
+	if (json && (parsable || fields_str != NULL))
+		usage("-j option cannot be used with -p or -o options");
+
+	if (fields_str == NULL) {
+		if (parsable)
+			usage("-o must be provided when using -p option");
+		fields_str = "dev,vendor,device,path";
+	}
+
+	oferr = ofmt_open(fields_str, fields, ofmtflags, 0, &ofmt);
+
+	ofmt_check(oferr, parsable, ofmt, die, warn);
+
+	nvlist_t *nvl = all ? ppt_list() : ppt_list_assigned();
+	nvpair_t *nvp = NULL;
+
+	if (json) {
+		if (printf("{\n\t\"devices\": [\n") < 0)
+			err(EXIT_FAILURE, "failed to write JSON");
+	}
+
+	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
+		nvlist_t *props;
+
+		(void) nvpair_value_nvlist(nvp, &props);
+
+		if (json) {
+			if (printf("\t\t") < 0)
+				err(EXIT_FAILURE, "failed to write JSON");
+			if (nvlist_print_json(stdout, props) < 0)
+				err(EXIT_FAILURE, "failed to write JSON");
+			if (nvlist_next_nvpair(nvl, nvp) != NULL)
+				(void) printf(",\n");
+		} else {
+			ofmt_print(ofmt, props);
+		}
+	}
+
+	if (json) {
+		if (printf("\n\t]\n}\n") < 0)
+			err(EXIT_FAILURE, "failed to write JSON");
+	}
+
+	nvlist_free(nvl);
+	ofmt_close(ofmt);
+	return (EXIT_SUCCESS);
+}
+
+int
+main(int argc, char *argv[])
+{
+	if (argc == 1)
+		return (list(argc - 1, argv));
+
+	if (strcmp(argv[1], "list") == 0) {
+		return (list(argc - 1, &argv[1]));
+	} else {
+		usage("unknown sub-command");
+	}
+
+	return (EXIT_SUCCESS);
+}
diff --git a/usr/src/cmd/prstat/prstat.c b/usr/src/cmd/prstat/prstat.c
index fc16e435f6..99fc9ecb28 100644
--- a/usr/src/cmd/prstat/prstat.c
+++ b/usr/src/cmd/prstat/prstat.c
@@ -26,6 +26,7 @@
  * Use is subject to license terms.
  *
  * Portions Copyright 2009 Chad Mynhier
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 #include <sys/types.h>
@@ -181,6 +182,33 @@ static optdesc_t opts = {
 	-1			/* sort in decreasing order */
 };
 
+
+static int
+proc_snprintf(char *_RESTRICT_KYWD s, size_t n,
+    const char *_RESTRICT_KYWD fmt, ...)
+{
+	static boolean_t ptools_zroot_valid = B_FALSE;
+	static const char *ptools_zroot = NULL;
+	va_list args;
+	int ret, nret = 0;
+
+	if (ptools_zroot_valid == B_FALSE) {
+		ptools_zroot_valid = B_TRUE;
+		ptools_zroot = zone_get_nroot();
+	}
+
+	if (ptools_zroot != NULL) {
+		nret = snprintf(s, n, "%s", ptools_zroot);
+		if (nret > n)
+			return (nret);
+	}
+	va_start(args, fmt);
+	ret = vsnprintf(s + nret, n - nret, fmt, args);
+	va_end(args);
+
+	return (ret + nret);
+}
+
 /*
  * Print timestamp as decimal reprentation of time_t value (-d u was specified)
  * or the standard date format (-d d was specified).
@@ -848,9 +876,9 @@ lwp_update(lwp_info_t *lwp, pid_t pid, id_t lwpid, struct prusage *usage)
 static int
 read_procfile(fd_t **fd, char *pidstr, char *file, void *buf, size_t bufsize)
 {
-	char procfile[MAX_PROCFS_PATH];
+	char procfile[PATH_MAX];
 
-	(void) snprintf(procfile, MAX_PROCFS_PATH,
+	(void) proc_snprintf(procfile, PATH_MAX,
 	    "/proc/%s/%s", pidstr, file);
 	if ((*fd = fd_open(procfile, O_RDONLY, *fd)) == NULL)
 		return (1);
@@ -1376,6 +1404,7 @@ main(int argc, char **argv)
 	int timeout;
 	struct pollfd pollset;
 	char key;
+	char procpath[PATH_MAX];
 
 	(void) setlocale(LC_ALL, "");
 	(void) textdomain(TEXT_DOMAIN);
@@ -1386,7 +1415,7 @@ main(int argc, char **argv)
 	pagesize = sysconf(_SC_PAGESIZE);
 
 	while ((opt = getopt(argc, argv,
-	    "vcd:HmarRLtu:U:n:p:C:P:h:s:S:j:k:TJWz:Z")) != (int)EOF) {
+	    "vVcd:HmarRLtu:U:n:p:C:P:h:s:S:j:k:TJWz:Z")) != (int)EOF) {
 		switch (opt) {
 		case 'r':
 			opts.o_outpmode |= OPT_NORESOLVE;
@@ -1466,6 +1495,9 @@ main(int argc, char **argv)
 			while (p = strtok(NULL, ", "))
 				add_uid(&ruid_tbl, p);
 			break;
+		case 'V':
+			/* obsolete argument - accepted for compatability */
+			break;
 		case 'p':
 			fill_table(&pid_tbl, optarg, 'p');
 			break;
@@ -1575,7 +1607,8 @@ main(int argc, char **argv)
 	list_setkeyfunc(NULL, &opts, &lgroups, LT_LGRPS);
 	if (opts.o_outpmode & OPT_TERMCAP)
 		curses_on();
-	if ((procdir = opendir("/proc")) == NULL)
+	(void) proc_snprintf(procpath, sizeof (procpath), "/proc");
+	if ((procdir = opendir(procpath)) == NULL)
 		Die(gettext("cannot open /proc directory\n"));
 	if (opts.o_outpmode & OPT_TTY) {
 		(void) printf(gettext("Please wait...\r"));
diff --git a/usr/src/cmd/prstat/prstat.h b/usr/src/cmd/prstat/prstat.h
index 293123c5b9..ddb7416213 100644
--- a/usr/src/cmd/prstat/prstat.h
+++ b/usr/src/cmd/prstat/prstat.h
@@ -26,6 +26,7 @@
  * Use is subject to license terms.
  *
  * Portions Copyright 2009 Chad Mynhier
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 #ifndef	_PRSTAT_H
@@ -72,6 +73,7 @@ extern "C" {
 #define	OPT_ZONES	0x2000		/* report about zones */
 #define	OPT_PSETS	0x4000		/* report for specified psets */
 #define	OPT_LGRP	0x8000		/* report home lgroups */
+					/* 0x10000 available for re-use */
 #define	OPT_UDATE	0x20000		/* print unix timestamp */
 #define	OPT_DDATE	0x40000		/* print timestamp in date(1) format */
 #define	OPT_NORESOLVE	0x80000		/* no nsswitch lookups */
diff --git a/usr/src/cmd/prstat/prutil.c b/usr/src/cmd/prstat/prutil.c
index 0f9cbd6c4d..8c90cb2e15 100644
--- a/usr/src/cmd/prstat/prutil.c
+++ b/usr/src/cmd/prstat/prutil.c
@@ -25,6 +25,7 @@
  * Use is subject to license terms.
  *
  * Portions Copyright 2009 Chad Mynhier
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 #include <sys/types.h>
diff --git a/usr/src/cmd/prtconf/prtconf.c b/usr/src/cmd/prtconf/prtconf.c
index b7551166cf..0837948936 100644
--- a/usr/src/cmd/prtconf/prtconf.c
+++ b/usr/src/cmd/prtconf/prtconf.c
@@ -347,10 +347,11 @@ main(int argc, char *argv[])
 		    sizeof (hw_provider));
 		/*
 		 * If 0 bytes are returned (the system returns '1', for the \0),
-		 * we're probably on x86, default to "Unknown Hardware Vendor".
+		 * we're probably on x86, and there has been no si-hw-provider
+		 * set in /etc/bootrc, default to Joyent.
 		 */
 		if (ret <= 1) {
-			(void) strncpy(hw_provider, "Unknown Hardware Vendor",
+			(void) strncpy(hw_provider, "Joyent",
 			    sizeof (hw_provider));
 		}
 		(void) printf("System Configuration:  %s  %s\n", hw_provider,
diff --git a/usr/src/cmd/ps/ps.c b/usr/src/cmd/ps/ps.c
index 78dabbccfe..2773444803 100644
--- a/usr/src/cmd/ps/ps.c
+++ b/usr/src/cmd/ps/ps.c
@@ -27,7 +27,7 @@
  */
 
 /*
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -286,7 +286,7 @@ static	int	nzoneid = 0;
 static	int	kbytes_per_page;
 static	int	pidwidth;
 
-static	char	*procdir = "/proc";	/* standard /proc directory */
+static	char	procdir[MAXPATHLEN];	/* standard /proc directory */
 
 static struct ughead	euid_tbl;	/* table to store selected euid's */
 static struct ughead	ruid_tbl;	/* table to store selected real uid's */
@@ -339,6 +339,14 @@ int
 main(int argc, char **argv)
 {
 	const char *me;
+	const char *zroot = zone_get_nroot();
+
+	/*
+	 * If this is a branded zone, the native procfs may mounted in a
+	 * non-standard location.  Apply such a path prefix if it exists.
+	 */
+	(void) snprintf(procdir, sizeof (procdir), "%s/proc", zroot != NULL ?
+	    zroot : "");
 
 	/*
 	 * The original two ps'es are linked in a single binary;
@@ -2077,7 +2085,7 @@ print_zombie_field(psinfo_t *psinfo, struct field *f, const char *ttyp)
 
 static void
 pr_fields(psinfo_t *psinfo, const char *ttyp,
-	void (*print_fld)(psinfo_t *, struct field *, const char *))
+    void (*print_fld)(psinfo_t *, struct field *, const char *))
 {
 	struct field *f;
 
diff --git a/usr/src/cmd/ptools/Makefile.amd64 b/usr/src/cmd/ptools/Makefile.amd64
index fb0b2d07f8..5e9b4111b6 100644
--- a/usr/src/cmd/ptools/Makefile.amd64
+++ b/usr/src/cmd/ptools/Makefile.amd64
@@ -23,8 +23,6 @@
 # Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
-#
 
 include ../../../Makefile.cmd
 include ../../../Makefile.cmd.64
@@ -33,6 +31,7 @@ CPPFLAGS += -D_SYSCALL32
 CFLAGS64 += $(CCVERBOSE)
 
 ROOTISAPROG=$(ROOTBIN64)/$(PROG)
+ROOTISALN=$(LN_$(PROG):%=$(ROOTBIN64)/%)
 
 include ../../Makefile.bld
 
diff --git a/usr/src/cmd/ptools/Makefile.bld b/usr/src/cmd/ptools/Makefile.bld
index c34bf5dc8d..da679b3f20 100644
--- a/usr/src/cmd/ptools/Makefile.bld
+++ b/usr/src/cmd/ptools/Makefile.bld
@@ -22,10 +22,13 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2015 Joyent, Inc.
 #
 
 PROG:sh = basename `cd ..; pwd`
 
+include ../../../Makefile.ctf
+
 OBJS = $(PROG).o
 
 SRCS = ../$(PROG).c
@@ -70,6 +73,12 @@ CERRWARN_pargs	+= -_gcc=-Wno-type-limits
 
 CERRWARN += $(CERRWARN_$(PROG))
 
+#
+# Common code definitions
+#
+COBJS =	ptools_common.o
+CINC = -I../../common
+
 # pargs depends on ../../common/elfcap components
 # pmadvise depends on pmap components
 
@@ -80,14 +89,34 @@ CPPFLAGS_pargs =	-I$(ELFCAP)
 OBJS_pargs =		elfcap.o
 SRCS_pargs =		$(ELFCAP)/elfcap.c
 
-CPPFLAGS_pmap =		-I$(PMAP)
-OBJS_pmap =		pmap_common.o
+CPPFLAGS_pmap =		-I$(PMAP) $(CINC)
+OBJS_pmap =		pmap_common.o $(COBJS)
 SRCS_pmap =		$(PMAP)/pmap_common.c
 
-CPPFLAGS_pmadvise =	-I$(PMAP)
-OBJS_pmadvise =		pmap_common.o
+CPPFLAGS_pmadvise =	-I$(PMAP) $(CINC)
+OBJS_pmadvise =		pmap_common.o $(COBJS)
 SRCS_pmadvise =		$(PMAP)/pmap_common.c
 
+CPPFLAGS_preap =	$(CINC)
+OBJS_preap =		$(COBJS)
+
+CPPFLAGS_psig =		$(CINC)
+OBJS_psig =		$(COBJS)
+
+CPPFLAGS_ptime =	$(CINC)
+OBJS_ptime =		$(COBJS)
+
+CPPFLAGS_ptree =	$(CINC)
+OBJS_ptree =		$(COBJS)
+
+CPPFLAGS_pwait =	$(CINC)
+OBJS_pwait =		$(COBJS)
+
+CPPFLAGS_pwdx =		$(CINC)
+OBJS_pwdx =		$(COBJS)
+
+LN_pargs =		penv pauxv
+
 CPPFLAGS +=	$(CPPFLAGS_$(PROG))
 OBJS +=		$(OBJS_$(PROG))
 SRCS +=		$(SRCS_$(PROG))
@@ -100,15 +129,23 @@ INSTALL_LEGACY=$(RM) $(ROOTPROCBINSYMLINK) ; \
 
 elfcap.o:	$(ELFCAP)/elfcap.c
 		$(COMPILE.c) -o $@ $(ELFCAP)/elfcap.c
+		$(POST_PROCESS_O)
 
 pmap_common.o:	$(PMAP)/pmap_common.c
 		$(COMPILE.c) -o $@ $(PMAP)/pmap_common.c
+		$(POST_PROCESS_O)
 
 %.o:	../%.c
 	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+%.o:	../../common/%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
 
-all:	$(PROG)
+all:	$(PROG) $(LN_$(PROG))
 
+ROOTBINLN=$(LN_$(PROG):%=$(ROOTBIN)/%)
 ROOTBINPROG=$(ROOTBIN)/$(PROG)
 ROOTPROCBINSYMLINK=$(ROOT)/usr/proc/bin/$(PROG)
 
@@ -120,11 +157,23 @@ $(PROG): $$(OBJS)
 # Install the ptool, symlinking it into /usr/proc/bin if PTOOL_TYPE is set
 # to LEGACY.
 #
-install: all $(ROOTISAPROG)
+install: all $(ROOTISAPROG) $(ROOTISALN)
 	-$(RM) $(ROOTBINPROG)
 	-$(LN) $(ISAEXEC) $(ROOTBINPROG)
 	-$(INSTALL_$(PTOOL_TYPE))
 
+$(ROOTBINLN):
+	-$(RM) $@
+	-$(LN) $(ISAEXEC) $@
+
+$(ROOTISALN): $(ROOTISAPROG)
+	-$(RM) $@
+	-$(LN) $(ROOTISAPROG) $@
+
+$(LN_$(PROG)): $(PROG)
+	-$(RM) $@
+	-$(LN) $(PROG) $@
+
 clean:
 	$(RM) $(OBJS)
 
diff --git a/usr/src/cmd/ptools/Makefile.i386 b/usr/src/cmd/ptools/Makefile.i386
index 59f42e19a0..9f4ea86151 100644
--- a/usr/src/cmd/ptools/Makefile.i386
+++ b/usr/src/cmd/ptools/Makefile.i386
@@ -20,8 +20,6 @@
 # CDDL HEADER END
 #
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
-#
 # Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
@@ -31,6 +29,7 @@ include ../../../Makefile.cmd
 CFLAGS += $(CCVERBOSE)
 
 ROOTISAPROG=$(ROOTBIN32)/$(PROG)
+ROOTISALN=$(LN_$(PROG):%=$(ROOTBIN32)/%)
 
 include ../../Makefile.bld
 
diff --git a/usr/src/cmd/ptools/Makefile.ptool b/usr/src/cmd/ptools/Makefile.ptool
index c010eee64f..6a4cdcaa8e 100644
--- a/usr/src/cmd/ptools/Makefile.ptool
+++ b/usr/src/cmd/ptools/Makefile.ptool
@@ -20,8 +20,6 @@
 # CDDL HEADER END
 #
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
-#
 # Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
diff --git a/usr/src/cmd/ptools/Makefile.sparcv9 b/usr/src/cmd/ptools/Makefile.sparcv9
index fb0b2d07f8..5e9b4111b6 100644
--- a/usr/src/cmd/ptools/Makefile.sparcv9
+++ b/usr/src/cmd/ptools/Makefile.sparcv9
@@ -23,8 +23,6 @@
 # Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
-#
 
 include ../../../Makefile.cmd
 include ../../../Makefile.cmd.64
@@ -33,6 +31,7 @@ CPPFLAGS += -D_SYSCALL32
 CFLAGS64 += $(CCVERBOSE)
 
 ROOTISAPROG=$(ROOTBIN64)/$(PROG)
+ROOTISALN=$(LN_$(PROG):%=$(ROOTBIN64)/%)
 
 include ../../Makefile.bld
 
diff --git a/usr/src/cmd/ptools/common/ptools_common.c b/usr/src/cmd/ptools/common/ptools_common.c
new file mode 100644
index 0000000000..a747ab213e
--- /dev/null
+++ b/usr/src/cmd/ptools/common/ptools_common.c
@@ -0,0 +1,50 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#include <sys/feature_tests.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <sys/types.h>
+#include <zone.h>
+
+/*
+ * Common routines for ptools.
+ */
+
+int
+proc_snprintf(char *_RESTRICT_KYWD s, size_t n,
+    const char *_RESTRICT_KYWD fmt, ...)
+{
+	static boolean_t ptools_zroot_valid = B_FALSE;
+	static const char *ptools_zroot = NULL;
+	va_list args;
+	int ret, nret = 0;
+
+	if (ptools_zroot_valid == B_FALSE) {
+		ptools_zroot_valid = B_TRUE;
+		ptools_zroot = zone_get_nroot();
+	}
+
+	if (ptools_zroot != NULL) {
+		nret = snprintf(s, n, "%s", ptools_zroot);
+		if (nret > n)
+			return (nret);
+	}
+	va_start(args, fmt);
+	ret = vsnprintf(s + nret, n - nret, fmt, args);
+	va_end(args);
+
+	return (ret + nret);
+}
diff --git a/usr/src/cmd/ptools/common/ptools_common.h b/usr/src/cmd/ptools/common/ptools_common.h
new file mode 100644
index 0000000000..52bcae9e51
--- /dev/null
+++ b/usr/src/cmd/ptools/common/ptools_common.h
@@ -0,0 +1,36 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _PTOOLS_COMMON_H
+#define	_PTOOLS_COMMON_H
+
+#include <sys/feature_tests.h>
+
+/*
+ * Common functions for the ptools.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern int proc_snprintf(char *_RESTRICT_KYWD, size_t,
+    const char *_RESTRICT_KYWD, ...);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _PTOOLS_COMMON_H */
diff --git a/usr/src/cmd/ptools/pargs/pargs.c b/usr/src/cmd/ptools/pargs/pargs.c
index aa7b74dce9..a96018c031 100644
--- a/usr/src/cmd/ptools/pargs/pargs.c
+++ b/usr/src/cmd/ptools/pargs/pargs.c
@@ -73,6 +73,13 @@
 #include <wctype.h>
 #include <widec.h>
 #include <elfcap.h>
+#include <libgen.h>
+
+typedef enum pargs_cmd {
+	PARGS_ARGV,
+	PARGS_ENV,
+	PARGS_AUXV
+} pargs_cmd_t;
 
 typedef struct pargs_data {
 	struct ps_prochandle *pd_proc;	/* target proc handle */
@@ -815,6 +822,7 @@ static struct aux_id aux_arr[] = {
 	{ AT_BASE,		"AT_BASE",		at_null	},
 	{ AT_FLAGS,		"AT_FLAGS",		at_null	},
 	{ AT_ENTRY,		"AT_ENTRY",		at_null	},
+	{ AT_RANDOM,		"AT_RANDOM",		at_null	},
 	{ AT_SUN_UID,		"AT_SUN_UID",		at_uid	},
 	{ AT_SUN_RUID,		"AT_SUN_RUID",		at_uid	},
 	{ AT_SUN_GID,		"AT_SUN_GID",		at_gid	},
@@ -834,9 +842,11 @@ static struct aux_id aux_arr[] = {
 	{ AT_SUN_AUXFLAGS,	"AT_SUN_AUXFLAGS",	at_flags },
 	{ AT_SUN_EMULATOR,	"AT_SUN_EMULATOR",	at_str	},
 	{ AT_SUN_BRANDNAME,	"AT_SUN_BRANDNAME",	at_str	},
+	{ AT_SUN_BRAND_NROOT,	"AT_SUN_BRAND_NROOT",	at_str	},
 	{ AT_SUN_BRAND_AUX1,	"AT_SUN_BRAND_AUX1",	at_null	},
 	{ AT_SUN_BRAND_AUX2,	"AT_SUN_BRAND_AUX2",	at_null	},
 	{ AT_SUN_BRAND_AUX3,	"AT_SUN_BRAND_AUX3",	at_null	},
+	{ AT_SUN_BRAND_AUX4,	"AT_SUN_BRAND_AUX4",	at_null	},
 	{ AT_SUN_COMMPAGE,	"AT_SUN_COMMPAGE",	at_null	},
 	{ AT_SUN_FPTYPE,	"AT_SUN_FPTYPE",	at_null },
 	{ AT_SUN_FPSIZE,	"AT_SUN_FPSIZE",	at_null }
@@ -1288,19 +1298,24 @@ main(int argc, char *argv[])
 	int opt;
 	int error = 1;
 	core_content_t content = 0;
+	pargs_cmd_t cmd = PARGS_ARGV;
 
 	(void) setlocale(LC_ALL, "");
 
-	if ((command = strrchr(argv[0], '/')) != NULL)
-		command++;
-	else
-		command = argv[0];
+	command = basename(argv[0]);
+
+	if (strcmp(command, "penv") == 0)
+		cmd = PARGS_ENV;
+	else if (strcmp(command, "pauxv") == 0)
+		cmd = PARGS_AUXV;
 
 	while ((opt = getopt(argc, argv, "acelxF")) != EOF) {
 		switch (opt) {
 		case 'a':		/* show process arguments */
 			content |= CC_CONTENT_STACK;
 			aflag++;
+			if (cmd != PARGS_ARGV)
+				errflg++;
 			break;
 		case 'c':		/* force 7-bit ascii */
 			cflag++;
@@ -1308,13 +1323,19 @@ main(int argc, char *argv[])
 		case 'e':		/* show environment variables */
 			content |= CC_CONTENT_STACK;
 			eflag++;
+			if (cmd != PARGS_ARGV)
+				errflg++;
 			break;
 		case 'l':
 			lflag++;
 			aflag++;	/* -l implies -a */
+			if (cmd != PARGS_ARGV)
+				errflg++;
 			break;
 		case 'x':		/* show aux vector entries */
 			xflag++;
+			if (cmd != PARGS_ARGV)
+				errflg++;
 			break;
 		case 'F':
 			/*
@@ -1331,8 +1352,19 @@ main(int argc, char *argv[])
 
 	/* -a is the default if no options are specified */
 	if ((aflag + eflag + xflag + lflag) == 0) {
-		aflag++;
-		content |= CC_CONTENT_STACK;
+		switch (cmd) {
+		case PARGS_ARGV:
+			aflag++;
+			content |= CC_CONTENT_STACK;
+			break;
+		case PARGS_ENV:
+			content |= CC_CONTENT_STACK;
+			eflag++;
+			break;
+		case PARGS_AUXV:
+			xflag++;
+			break;
+		}
 	}
 
 	/* -l cannot be used with the -x or -e flags */
diff --git a/usr/src/cmd/ptools/pfiles/pfiles.c b/usr/src/cmd/ptools/pfiles/pfiles.c
index d7142809f7..9f53ca4799 100644
--- a/usr/src/cmd/ptools/pfiles/pfiles.c
+++ b/usr/src/cmd/ptools/pfiles/pfiles.c
@@ -559,6 +559,7 @@ show_sockaddr(const char *str, struct sockaddr *sa, socklen_t len)
 	case AF_KEY:		p = "AF_KEY";		break;
 	case AF_POLICY:		p = "AF_POLICY";	break;
 	case AF_LINK:		p = "AF_LINK";		break;
+	case AF_LX_NETLINK:	p = "AF_LX_NETLINK";	break;
 	}
 
 	(void) printf("\t%s: %s\n", str, p);
diff --git a/usr/src/cmd/ptools/pflags/pflags.c b/usr/src/cmd/ptools/pflags/pflags.c
index 8054a80d3c..f19a945d95 100644
--- a/usr/src/cmd/ptools/pflags/pflags.c
+++ b/usr/src/cmd/ptools/pflags/pflags.c
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #include <stdio.h>
@@ -469,6 +469,9 @@ prwhy(int why)
 	case PR_SUSPENDED:
 		str = "PR_SUSPENDED";
 		break;
+	case PR_BRAND:
+		str = "PR_BRAND";
+		break;
 	default:
 		str = buf;
 		(void) sprintf(str, "%d", why);
diff --git a/usr/src/cmd/ptools/pmap/pmap.c b/usr/src/cmd/ptools/pmap/pmap.c
index 78bfa6b596..03f8bde791 100644
--- a/usr/src/cmd/ptools/pmap/pmap.c
+++ b/usr/src/cmd/ptools/pmap/pmap.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
 #include <stdio.h>
@@ -42,6 +43,7 @@
 #include <sys/mman.h>
 #include <sys/lgrp_user.h>
 #include <libproc.h>
+#include "ptools_common.h"
 
 #include "pmap_common.h"
 
@@ -199,7 +201,7 @@ main(int argc, char **argv)
 	const char *bar;
 	struct rlimit rlim;
 	struct stat64 statbuf;
-	char buf[128];
+	char buf[PATH_MAX];
 	int mapfd;
 	int prg_gflags = PGRAB_RDONLY;
 	int prr_flags = 0;
@@ -358,7 +360,7 @@ main(int argc, char **argv)
 		proc_unctrl_psinfo(&psinfo);
 
 		if (Pstate(Pr) != PS_DEAD) {
-			(void) snprintf(buf, sizeof (buf),
+			(void) proc_snprintf(buf, sizeof (buf),
 			    "/proc/%d/map", (int)psinfo.pr_pid);
 			if ((mapfd = open(buf, O_RDONLY)) < 0) {
 				(void) fprintf(stderr, "%s: cannot "
@@ -590,7 +592,7 @@ rmapping_iter(struct ps_prochandle *Pr, proc_map_f *func, void *cd)
 	prmap_t *prmapp, *pmp;
 	ssize_t n;
 
-	(void) snprintf(mapname, sizeof (mapname),
+	(void) proc_snprintf(mapname, sizeof (mapname),
 	    "/proc/%d/rmap", (int)Pstatus(Pr)->pr_pid);
 
 	if ((mapfd = open(mapname, O_RDONLY)) < 0 || fstat(mapfd, &st) != 0) {
@@ -631,7 +633,7 @@ xmapping_iter(struct ps_prochandle *Pr, proc_xmap_f *func, void *cd, int doswap)
 	prxmap_t *prmapp, *pmp;
 	ssize_t n;
 
-	(void) snprintf(mapname, sizeof (mapname),
+	(void) proc_snprintf(mapname, sizeof (mapname),
 	    "/proc/%d/xmap", (int)Pstatus(Pr)->pr_pid);
 
 	if ((mapfd = open(mapname, O_RDONLY)) < 0 || fstat(mapfd, &st) != 0) {
diff --git a/usr/src/cmd/ptools/pmap/pmap_common.c b/usr/src/cmd/ptools/pmap/pmap_common.c
index fff55ffdbc..81f42d67f7 100644
--- a/usr/src/cmd/ptools/pmap/pmap_common.c
+++ b/usr/src/cmd/ptools/pmap/pmap_common.c
@@ -37,6 +37,7 @@
 #include <sys/types.h>
 
 #include "pmap_common.h"
+#include "ptools_common.h"
 
 /*
  * We compare the high memory addresses since stacks are faulted in from
@@ -88,7 +89,7 @@ make_name(struct ps_prochandle *Pr, int lflag, uintptr_t addr,
 		return (NULL);
 
 	/* first see if we can find a path via /proc */
-	(void) snprintf(path, sizeof (path), "/proc/%d/path/%s",
+	(void) proc_snprintf(path, sizeof (path), "/proc/%d/path/%s",
 	    (int)Psp->pr_pid, mapname);
 	len = readlink(path, buf, bufsz - 1);
 	if (len >= 0) {
@@ -97,7 +98,7 @@ make_name(struct ps_prochandle *Pr, int lflag, uintptr_t addr,
 	}
 
 	/* fall back to object information reported by /proc */
-	(void) snprintf(path, sizeof (path),
+	(void) proc_snprintf(path, sizeof (path),
 	    "/proc/%d/object/%s", (int)Psp->pr_pid, mapname);
 	if (stat(path, &statb) == 0) {
 		dev_t dev = statb.st_dev;
diff --git a/usr/src/cmd/ptools/preap/preap.c b/usr/src/cmd/ptools/preap/preap.c
index 8d30b8027c..6d8eb75611 100644
--- a/usr/src/cmd/ptools/preap/preap.c
+++ b/usr/src/cmd/ptools/preap/preap.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -37,6 +35,8 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <libproc.h>
+#include <limits.h>
+#include "ptools_common.h"
 
 #define	NOREAP_TIME 60		/* wait 60 seconds before allow a reap */
 
@@ -53,11 +53,11 @@ intr(int sig)
 static int
 open_usage(pid_t pid, int *perr)
 {
-	char path[64];
+	char path[PATH_MAX];
 	struct stat64 st;
 	int fd;
 
-	(void) snprintf(path, sizeof (path), "/proc/%d/usage", (int)pid);
+	(void) proc_snprintf(path, sizeof (path), "/proc/%d/usage", (int)pid);
 
 	/*
 	 * Attempt to open the usage file, and return the fd if we can
diff --git a/usr/src/cmd/ptools/psig/psig.c b/usr/src/cmd/ptools/psig/psig.c
index 70af35cb5e..848fda834c 100644
--- a/usr/src/cmd/ptools/psig/psig.c
+++ b/usr/src/cmd/ptools/psig/psig.c
@@ -21,10 +21,9 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdio.h>
 #include <stdio_ext.h>
 #include <stdlib.h>
@@ -37,6 +36,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <libproc.h>
+#include "ptools_common.h"
 
 /* evil knowledge of libc internals */
 #include "../../../lib/libc/inc/thr_uberdata.h"
@@ -172,7 +172,7 @@ lwp_iter(void *cd, const lwpstatus_t *lwpstatus)
 static int
 look(char *arg)
 {
-	char pathname[100];
+	char pathname[PATH_MAX];
 	struct stat statb;
 	int fd = -1;
 	int sig, gcode;
@@ -199,7 +199,8 @@ look(char *arg)
 	(void) memcpy(&psinfo, psinfop, sizeof (psinfo_t));
 	proc_unctrl_psinfo(&psinfo);
 
-	(void) sprintf(pathname, "/proc/%d/sigact", (int)psinfo.pr_pid);
+	(void) proc_snprintf(pathname, sizeof (pathname), "/proc/%d/sigact",
+	    (int)psinfo.pr_pid);
 	if ((fd = open(pathname, O_RDONLY)) < 0) {
 		perr("open sigact");
 		goto look_error;
@@ -213,8 +214,8 @@ look(char *arg)
 	action = malloc(maxsig * sizeof (struct sigaction));
 	if (action == NULL) {
 		(void) fprintf(stderr,
-		"%s: cannot malloc() space for %d sigaction structures\n",
-			command, maxsig);
+		    "%s: cannot malloc() space for %d sigaction structures\n",
+		    command, maxsig);
 		goto look_error;
 	}
 	if (read(fd, (char *)action, maxsig * sizeof (struct sigaction)) !=
@@ -239,7 +240,7 @@ look(char *arg)
 		if (psinfo.pr_dmodel != PR_MODEL_NATIVE) {
 			caddr32_t addr;
 			aharraddr = uberaddr +
-				offsetof(uberdata32_t, siguaction);
+			    offsetof(uberdata32_t, siguaction);
 			aharrlen = sizeof (siguaction32_t) * NSIG;
 			(void) Pread(Pr, &addr, sizeof (addr),
 			    uberaddr + offsetof(uberdata32_t, sigacthandler));
@@ -248,7 +249,7 @@ look(char *arg)
 #endif
 		{
 			aharraddr = uberaddr +
-				offsetof(uberdata_t, siguaction);
+			    offsetof(uberdata_t, siguaction);
 			aharrlen = sizeof (siguaction_t) * NSIG;
 			(void) Pread(Pr, &intfnaddr, sizeof (intfnaddr),
 			    uberaddr + offsetof(uberdata_t, sigacthandler));
@@ -323,7 +324,7 @@ look(char *arg)
 					(void) printf("\t%-8s", hname);
 				else
 					(void) printf("\t0x%-8lx",
-						(ulong_t)haddr);
+					    (ulong_t)haddr);
 
 				s = sigflags(sig, sp->sa_flags);
 				(void) printf("%s", (*s != '\0')? s : "\t0");
@@ -334,7 +335,7 @@ look(char *arg)
 			}
 		} else if (sig == SIGCLD) {
 			s = sigflags(sig,
-				sp->sa_flags & (SA_NOCLDWAIT|SA_NOCLDSTOP));
+			    sp->sa_flags & (SA_NOCLDWAIT|SA_NOCLDSTOP));
 			if (*s != '\0')
 				(void) printf("\t\t%s", s);
 		}
@@ -371,7 +372,7 @@ sigflags(int sig, int flags)
 	static char code_buf[100];
 	char *str = code_buf;
 	int flagmask =
-		(SA_ONSTACK|SA_RESETHAND|SA_RESTART|SA_SIGINFO|SA_NODEFER);
+	    (SA_ONSTACK|SA_RESETHAND|SA_RESTART|SA_SIGINFO|SA_NODEFER);
 
 	if (sig == SIGCLD)
 		flagmask |= (SA_NOCLDSTOP|SA_NOCLDWAIT);
@@ -414,19 +415,19 @@ deinterpose(int sig, void *aharr, psinfo_t *psinfo, struct sigaction *sp)
 #ifdef _LP64
 	if (psinfo->pr_dmodel != PR_MODEL_NATIVE) {
 		struct sigaction32 *sa32 = (struct sigaction32 *)
-			((uintptr_t)aharr + sig * sizeof (siguaction32_t) +
-			offsetof(siguaction32_t, sig_uaction));
+		    ((uintptr_t)aharr + sig * sizeof (siguaction32_t) +
+		    offsetof(siguaction32_t, sig_uaction));
 
 		sp->sa_flags = sa32->sa_flags;
 		sp->sa_handler = (void (*)())(uintptr_t)sa32->sa_handler;
 		(void) memcpy(&sp->sa_mask, &sa32->sa_mask,
-			sizeof (sp->sa_mask));
+		    sizeof (sp->sa_mask));
 	} else
 #endif
 	{
 		struct sigaction *sa = (struct sigaction *)
-			((uintptr_t)aharr + sig * sizeof (siguaction_t) +
-			offsetof(siguaction_t, sig_uaction));
+		    ((uintptr_t)aharr + sig * sizeof (siguaction_t) +
+		    offsetof(siguaction_t, sig_uaction));
 
 		sp->sa_flags = sa->sa_flags;
 		sp->sa_handler = sa->sa_handler;
diff --git a/usr/src/cmd/ptools/ptime/ptime.c b/usr/src/cmd/ptools/ptime/ptime.c
index 2da2f8d281..b1f53593c2 100644
--- a/usr/src/cmd/ptools/ptime/ptime.c
+++ b/usr/src/cmd/ptools/ptime/ptime.c
@@ -41,6 +41,8 @@
 #include <sys/time.h>
 #include <signal.h>
 #include <libproc.h>
+#include <limits.h>
+#include "ptools_common.h"
 
 static	int	look(pid_t);
 static	void	hr_min_sec(char *, long);
@@ -189,7 +191,7 @@ main(int argc, char **argv)
 static int
 look(pid_t pid)
 {
-	char pathname[100];
+	char pathname[PATH_MAX];
 	int rval = 0;
 	int fd;
 	psinfo_t psinfo;
@@ -203,7 +205,8 @@ look(pid_t pid)
 	if (proc_get_psinfo(pid, &psinfo) < 0)
 		return (perr("read psinfo"));
 
-	(void) sprintf(pathname, "/proc/%d/usage", (int)pid);
+	(void) proc_snprintf(pathname, sizeof (pathname), "/proc/%d/usage",
+	    (int)pid);
 	if ((fd = open(pathname, O_RDONLY)) < 0)
 		return (perr("open usage"));
 
diff --git a/usr/src/cmd/ptools/ptree/ptree.c b/usr/src/cmd/ptools/ptree/ptree.c
index 27fef9b7f0..92a65e2f44 100644
--- a/usr/src/cmd/ptools/ptree/ptree.c
+++ b/usr/src/cmd/ptools/ptree/ptree.c
@@ -21,14 +21,13 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
 /*
  * ptree -- print family tree of processes
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <assert.h>
 #include <stdio.h>
 #include <string.h>
@@ -48,6 +47,7 @@
 #include <sys/ctfs.h>
 #include <libcontract_priv.h>
 #include <sys/stat.h>
+#include "ptools_common.h"
 
 #define	FAKEDPID0(p)	(p->pid == 0 && p->psargs[0] == '\0')
 
@@ -103,10 +103,11 @@ main(int argc, char **argv)
 	char *s;
 	int n;
 	int retc = 0;
+	char ppath[PATH_MAX];
 
 	DIR *dirp;
 	struct dirent *dentp;
-	char	pname[100];
+	char	pname[PATH_MAX];
 	int	pdlen;
 
 	ps_t *p;
@@ -169,16 +170,18 @@ main(int argc, char **argv)
 	psize = 0;
 	ps = NULL;
 
+	(void) proc_snprintf(ppath, sizeof (ppath), "/proc");
+
 	/*
 	 * Search the /proc directory for all processes.
 	 */
-	if ((dirp = opendir("/proc")) == NULL) {
-		(void) fprintf(stderr, "%s: cannot open /proc directory\n",
-		    command);
+	if ((dirp = opendir(ppath)) == NULL) {
+		(void) fprintf(stderr, "%s: cannot open %s directory\n",
+		    command, ppath);
 		return (1);
 	}
 
-	(void) strcpy(pname, "/proc");
+	(void) strcpy(pname, ppath);
 	pdlen = strlen(pname);
 	pname[pdlen++] = '/';
 
diff --git a/usr/src/cmd/ptools/pwait/pwait.c b/usr/src/cmd/ptools/pwait/pwait.c
index 0733c355cf..ec11573477 100644
--- a/usr/src/cmd/ptools/pwait/pwait.c
+++ b/usr/src/cmd/ptools/pwait/pwait.c
@@ -23,8 +23,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdio.h>
 #include <stdio_ext.h>
 #include <ctype.h>
@@ -39,6 +37,8 @@
 #include <poll.h>
 #include <procfs.h>
 #include <sys/resource.h>
+#include <limits.h>
+#include "ptools_common.h"
 
 static int count_my_files();
 static char *command;
@@ -49,6 +49,7 @@ static char *command;
 int
 main(int argc, char **argv)
 {
+	char buf[PATH_MAX];
 	unsigned long remain = 0;
 	struct pollfd *pollfd;
 	struct pollfd *pfd;
@@ -75,10 +76,12 @@ main(int argc, char **argv)
 		(void) fprintf(stderr, "usage:\t%s [-v] pid ...\n", command);
 		(void) fprintf(stderr, "  (wait for processes to terminate)\n");
 		(void) fprintf(stderr,
-			"  -v: verbose; report terminations to standard out\n");
+		    "  -v: verbose; report terminations to standard out\n");
 		return (2);
 	}
 
+	(void) proc_snprintf(buf, sizeof (buf), "/proc/");
+
 	/* make sure we have enough file descriptors */
 	if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) {
 		int nfiles = count_my_files();
@@ -87,8 +90,8 @@ main(int argc, char **argv)
 			rlim.rlim_cur = argc + nfiles + SLOP;
 			if (setrlimit(RLIMIT_NOFILE, &rlim) != 0) {
 				(void) fprintf(stderr,
-					"%s: insufficient file descriptors\n",
-					command);
+				    "%s: insufficient file descriptors\n",
+				    command);
 				return (2);
 			}
 		}
@@ -108,11 +111,11 @@ main(int argc, char **argv)
 		if (strchr(arg, '/') != NULL)
 			(void) strncpy(psinfofile, arg, sizeof (psinfofile));
 		else {
-			(void) strcpy(psinfofile, "/proc/");
+			(void) strcpy(psinfofile, buf);
 			(void) strncat(psinfofile, arg, sizeof (psinfofile)-6);
 		}
 		(void) strncat(psinfofile, "/psinfo",
-			sizeof (psinfofile)-strlen(psinfofile));
+		    sizeof (psinfofile)-strlen(psinfofile));
 
 		pfd = &pollfd[i];
 		if ((pfd->fd = open(psinfofile, O_RDONLY)) >= 0) {
@@ -126,7 +129,7 @@ main(int argc, char **argv)
 			pfd->revents = 0;
 		} else if (errno == ENOENT) {
 			(void) fprintf(stderr, "%s: no such process: %s\n",
-				command, arg);
+			    command, arg);
 		} else {
 			perror(arg);
 		}
@@ -160,9 +163,9 @@ main(int argc, char **argv)
 					if (pread(pfd->fd, &psinfo,
 					    sizeof (psinfo), (off_t)0)
 					    == sizeof (psinfo)) {
-						(void) printf(
-					"%s: terminated, wait status 0x%.4x\n",
-							arg, psinfo.pr_wstat);
+						(void) printf("%s: terminated, "
+						    "wait status 0x%.4x\n",
+						    arg, psinfo.pr_wstat);
 					} else {
 						(void) printf(
 						    "%s: terminated\n", arg);
@@ -170,10 +173,10 @@ main(int argc, char **argv)
 				}
 				if (pfd->revents & POLLNVAL)
 					(void) printf("%s: system process\n",
-						arg);
+					    arg);
 				if (pfd->revents & ~(POLLPRI|POLLHUP|POLLNVAL))
 					(void) printf("%s: unknown error\n",
-						arg);
+					    arg);
 			}
 
 			(void) close(pfd->fd);
diff --git a/usr/src/cmd/ptools/pwdx/pwdx.c b/usr/src/cmd/ptools/pwdx/pwdx.c
index adf42c0877..4a2c6f0c3f 100644
--- a/usr/src/cmd/ptools/pwdx/pwdx.c
+++ b/usr/src/cmd/ptools/pwdx/pwdx.c
@@ -22,10 +22,9 @@
 /*
  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdio.h>
 #include <unistd.h>
 #include <string.h>
@@ -33,6 +32,8 @@
 #include <libproc.h>
 #include <sys/param.h>
 
+#include "ptools_common.h"
+
 static char *command;
 
 static int
@@ -49,7 +50,7 @@ show_cwd(const char *arg)
 		return (1);
 	}
 
-	(void) snprintf(proc, sizeof (proc), "/proc/%d/path/cwd",
+	(void) proc_snprintf(proc, sizeof (proc), "/proc/%d/path/cwd",
 	    (int)p.pr_pid);
 
 	if ((ret = readlink(proc, cwd, sizeof (cwd) - 1)) <= 0) {
diff --git a/usr/src/cmd/rcap/common/utils.c b/usr/src/cmd/rcap/common/utils.c
index 799fdcef23..dd511c7c50 100644
--- a/usr/src/cmd/rcap/common/utils.c
+++ b/usr/src/cmd/rcap/common/utils.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/param.h>
@@ -257,77 +258,3 @@ xatoi(char *p)
 		return (i);
 	}
 }
-
-/*
- * get_running_zones() calls zone_list(2) to find out how many zones are
- * running.  It then calls zone_list(2) again to fetch the list of running
- * zones (stored in *zents).
- */
-int
-get_running_zones(uint_t *nzents, zone_entry_t **zents)
-{
-	zoneid_t *zids;
-	uint_t nzents_saved;
-	int i;
-	zone_entry_t *zentp;
-	zone_state_t zstate;
-
-	*zents = NULL;
-	if (zone_list(NULL, nzents) != 0) {
-		warn(gettext("could not get zoneid list\n"));
-		return (E_ERROR);
-	}
-
-again:
-	if (*nzents == 0)
-		return (E_SUCCESS);
-
-	if ((zids = (zoneid_t *)calloc(*nzents, sizeof (zoneid_t))) == NULL) {
-		warn(gettext("out of memory: zones will not be capped\n"));
-		return (E_ERROR);
-	}
-
-	nzents_saved = *nzents;
-
-	if (zone_list(zids, nzents) != 0) {
-		warn(gettext("could not get zone list\n"));
-		free(zids);
-		return (E_ERROR);
-	}
-	if (*nzents != nzents_saved) {
-		/* list changed, try again */
-		free(zids);
-		goto again;
-	}
-
-	*zents = calloc(*nzents, sizeof (zone_entry_t));
-	if (*zents == NULL) {
-		warn(gettext("out of memory: zones will not be capped\n"));
-		free(zids);
-		return (E_ERROR);
-	}
-
-	zentp = *zents;
-	for (i = 0; i < *nzents; i++) {
-		char name[ZONENAME_MAX];
-
-		if (getzonenamebyid(zids[i], name, sizeof (name)) < 0) {
-			warn(gettext("could not get name for "
-			    "zoneid %d\n"), zids[i]);
-			continue;
-		}
-
-		(void) strlcpy(zentp->zname, name, sizeof (zentp->zname));
-		zentp->zid = zids[i];
-		if (zone_get_state(name, &zstate) != Z_OK ||
-		    zstate != ZONE_STATE_RUNNING)
-			continue;
-
-
-		zentp++;
-	}
-	*nzents = zentp - *zents;
-
-	free(zids);
-	return (E_SUCCESS);
-}
diff --git a/usr/src/cmd/rcap/common/utils.h b/usr/src/cmd/rcap/common/utils.h
index 7196cfb4ce..cf2e17c080 100644
--- a/usr/src/cmd/rcap/common/utils.h
+++ b/usr/src/cmd/rcap/common/utils.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent, Inc. All rights reserved.
  */
 
 #ifndef	_UTILS_H
@@ -98,7 +99,6 @@ extern void vdprintfe(int, const char *, va_list);
 extern void dprintfe(int, char *, ...);
 extern void hrt2ts(hrtime_t, timestruc_t *);
 extern int xatoi(char *);
-extern int get_running_zones(uint_t *, zone_entry_t **);
 
 #ifdef	__cplusplus
 }
diff --git a/usr/src/cmd/rcap/rcapadm/rcapadm.c b/usr/src/cmd/rcap/rcapadm/rcapadm.c
index 92888b2071..b92115469a 100644
--- a/usr/src/cmd/rcap/rcapadm/rcapadm.c
+++ b/usr/src/cmd/rcap/rcapadm/rcapadm.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/types.h>
@@ -145,20 +146,29 @@ out:
 	scf_handle_destroy(h);
 }
 
+static int
+set_zone_cap(char *zonename, uint64_t mcap)
+{
+	char cmd[128 + ZONENAME_MAX];
+
+	(void) snprintf(cmd, sizeof (cmd), "/usr/bin/prctl -r "
+	    "-n zone.max-physical-memory -v %llu -i zone %s", mcap, zonename);
+	return (system(cmd));
+}
+
 /*
  * Update the in-kernel memory cap for the specified zone.
  */
 static int
 update_zone_mcap(char *zonename, char *maxrss)
 {
-	zoneid_t zone_id;
 	uint64_t num;
 
 	if (getzoneid() != GLOBAL_ZONEID || zonecfg_in_alt_root())
 		return (E_SUCCESS);
 
 	/* get the running zone from the kernel */
-	if ((zone_id = getzoneidbyname(zonename)) == -1) {
+	if (getzoneidbyname(zonename) == -1) {
 		(void) fprintf(stderr, gettext("zone '%s' must be running\n"),
 		    zonename);
 		return (E_ERROR);
@@ -169,7 +179,7 @@ update_zone_mcap(char *zonename, char *maxrss)
 		return (E_ERROR);
 	}
 
-	if (zone_setattr(zone_id, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
+	if (set_zone_cap(zonename, num) == -1) {
 		(void) fprintf(stderr, gettext("could not set memory "
 		    "cap for zone '%s'\n"), zonename);
 		return (E_ERROR);
diff --git a/usr/src/cmd/rcap/rcapd/rcapd_collection_zone.c b/usr/src/cmd/rcap/rcapd/rcapd_collection_zone.c
index db86aa6276..88403dda37 100644
--- a/usr/src/cmd/rcap/rcapd/rcapd_collection_zone.c
+++ b/usr/src/cmd/rcap/rcapd/rcapd_collection_zone.c
@@ -21,16 +21,17 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <procfs.h>
 #include <project.h>
 #include <stdlib.h>
 #include <strings.h>
 #include <zone.h>
 #include <libzonecfg.h>
+#include <dirent.h>
+#include <libproc.h>
 #include "rcapd.h"
 #include "utils.h"
 
@@ -39,61 +40,117 @@ extern boolean_t gz_capped;
 				/* round up to next y = 2^n */
 #define	ROUNDUP(x, y)		(((x) + ((y) - 1)) & ~((y) - 1))
 
-static void
-update_zone(zone_entry_t *zent, void *walk_data)
+static struct ps_prochandle *
+grab_zone_proc(zoneid_t zid)
 {
-	void(*update_notification_cb)(char *, char *, int, uint64_t, int) =
-	    (void(*)(char *, char *, int, uint64_t, int))walk_data;
-	int changes;
-	int64_t max_rss;
+	DIR *dirp;
+	struct dirent *dentp;
+	int pid, pid_self, tmp;
+	psinfo_t psinfo;
+	struct ps_prochandle *pr = NULL;
+
+	pid_self = getpid();
+
+	if ((dirp = opendir("/proc")) == NULL)
+		return (NULL);
+
+	while (dentp = readdir(dirp)) {
+		pid = atoi(dentp->d_name);
+
+		/* Skip self */
+		if (pid == pid_self)
+			continue;
+
+		if (proc_get_psinfo(pid, &psinfo) != 0)
+			continue;
+
+		if (psinfo.pr_zoneid != zid)
+			continue;
+
+		/* attempt to grab process */
+		if ((pr = Pgrab(pid, 0, &tmp)) != NULL) {
+			if (Psetflags(pr, PR_RLC) != 0) {
+				Prelease(pr, 0);
+			}
+			if (Pcreate_agent(pr) == 0) {
+				if (pr_getzoneid(pr) != zid) {
+					Prelease(pr, 0);
+					continue;
+				}
+
+				(void) closedir(dirp);
+				return (pr);
+			} else {
+				Prelease(pr, 0);
+			}
+		}
+	}
+
+	(void) closedir(dirp);
+	return (NULL);
+}
+
+static uint64_t
+get_zone_cap(zoneid_t zid)
+{
+	rctlblk_t *rblk;
 	uint64_t mcap;
-	lcollection_t *lcol;
-	rcid_t colid;
+	struct ps_prochandle *pr;
 
-	if (zone_getattr(zent->zid, ZONE_ATTR_PHYS_MCAP, &mcap,
-	    sizeof (mcap)) != -1 && mcap != 0)
-		max_rss = ROUNDUP(mcap, 1024) / 1024;
-	else
-		max_rss = 0;
-
-	if (zent->zid == GLOBAL_ZONEID) {
-		if (max_rss > 0)
-			gz_capped = B_TRUE;
-		else
-			gz_capped = B_FALSE;
+	if ((rblk = (rctlblk_t *)malloc(rctlblk_size())) == NULL)
+		return (UINT64_MAX);
+
+	if ((pr = grab_zone_proc(zid)) == NULL) {
+		free(rblk);
+		return (UINT64_MAX);
 	}
 
+	if (pr_getrctl(pr, "zone.max-physical-memory", NULL, rblk,
+	    RCTL_FIRST)) {
+		Pdestroy_agent(pr);
+		Prelease(pr, 0);
+		free(rblk);
+		return (UINT64_MAX);
+	}
 
-	colid.rcid_type = RCIDT_ZONE;
-	colid.rcid_val = zent->zid;
+	Pdestroy_agent(pr);
+	Prelease(pr, 0);
 
-	lcol = lcollection_insert_update(&colid, max_rss, zent->zname,
-	    &changes);
-	if (update_notification_cb != NULL)
-		update_notification_cb("zone", zent->zname, changes, max_rss,
-		    (lcol != NULL) ? lcol->lcol_mark : 0);
+	mcap = rctlblk_get_value(rblk);
+	free(rblk);
+	return (mcap);
 }
 
-
+/*
+ * For zones, rcapd only caps the global zone, since each non-global zone
+ * caps itself.
+ */
 /* ARGSUSED */
 void
 lcollection_update_zone(lcollection_update_type_t ut,
     void(*update_notification_cb)(char *, char *, int, uint64_t, int))
 {
-	int i;
-	uint_t nzents;
-	zone_entry_t *zents;
-
-	/*
-	 * Enumerate running zones.
-	 */
-	if (get_running_zones(&nzents, &zents) != 0)
-		return;
-
-	for (i = 0; i < nzents; i++) {
-		update_zone(&zents[i], (void *)update_notification_cb);
+	int changes;
+	int64_t max_rss;
+	uint64_t mcap;
+	lcollection_t *lcol;
+	rcid_t colid;
 
+	mcap = get_zone_cap(GLOBAL_ZONEID);
+	if (mcap != 0 && mcap != UINT64_MAX) {
+		max_rss = ROUNDUP(mcap, 1024) / 1024;
+		gz_capped = B_TRUE;
+	} else {
+		max_rss = UINT64_MAX / 1024;
+		gz_capped = B_FALSE;
 	}
 
-	free(zents);
+	colid.rcid_type = RCIDT_ZONE;
+	colid.rcid_val = GLOBAL_ZONEID;
+
+	lcol = lcollection_insert_update(&colid, max_rss, GLOBAL_ZONENAME,
+	    &changes);
+	if (update_notification_cb != NULL)
+		update_notification_cb("zone", GLOBAL_ZONENAME, changes,
+		    max_rss, (lcol != NULL) ? lcol->lcol_mark : 0);
 }
diff --git a/usr/src/cmd/rcap/rcapd/rcapd_scanner.c b/usr/src/cmd/rcap/rcapd/rcapd_scanner.c
index b39811b552..254bb9e922 100644
--- a/usr/src/cmd/rcap/rcapd/rcapd_scanner.c
+++ b/usr/src/cmd/rcap/rcapd/rcapd_scanner.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012 Joyent, Inc.  All rights reserved.
  */
 
 #pragma ident	"%Z%%M%	%I%	%E% SMI"
@@ -551,7 +552,7 @@ pageout(pid_t pid, struct ps_prochandle *Pr, caddr_t start, caddr_t end)
 
 	errno = 0;
 	res = pr_memcntl(Pr, start, (end - start), MC_SYNC,
-	    (caddr_t)(MS_ASYNC | MS_INVALIDATE), 0, 0);
+	    (caddr_t)(MS_ASYNC | MS_INVALCURPROC), 0, 0);
 	debug_high("pr_memcntl [%p-%p): %d", (void *)start, (void *)end, res);
 
 	/*
diff --git a/usr/src/cmd/rcap/rcapstat/rcapstat.c b/usr/src/cmd/rcap/rcapstat/rcapstat.c
index 0632250fed..2838c6e5d5 100644
--- a/usr/src/cmd/rcap/rcapstat/rcapstat.c
+++ b/usr/src/cmd/rcap/rcapstat/rcapstat.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/types.h>
@@ -72,6 +73,8 @@ typedef struct col {
 static col_t *col_head;
 static int ncol;
 
+#define	RCAPD_NA	"rcapd is not active (try zonememstat)\n"
+
 static col_t *
 col_find(rcid_t id)
 {
@@ -152,7 +155,7 @@ read_stats(rcid_type_t stat_type)
 	struct stat st;
 
 	if ((fd = open(STAT_FILE_DEFAULT, O_RDONLY)) < 0) {
-		warn(gettext("rcapd is not active\n"));
+		warn(gettext(RCAPD_NA));
 		return (E_ERROR);
 	}
 
@@ -173,7 +176,7 @@ read_stats(rcid_type_t stat_type)
 	pid = hdr.rs_pid;
 	(void) snprintf(procfile, 20, "/proc/%lld/psinfo", pid);
 	if ((proc_fd = open(procfile, O_RDONLY)) < 0) {
-		warn(gettext("rcapd is not active\n"));
+		warn(gettext(RCAPD_NA));
 		(void) close(fd);
 		return (E_ERROR);
 	}
diff --git a/usr/src/cmd/sed/main.c b/usr/src/cmd/sed/main.c
index 204583b877..dc3ef02619 100644
--- a/usr/src/cmd/sed/main.c
+++ b/usr/src/cmd/sed/main.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2013 Johann 'Myrkraverk' Oskarsson <johann@myrkraverk.com>
  * Copyright (c) 2011 Gary Mills
- * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 1992 Diomidis Spinellis.
  * Copyright (c) 1992, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -42,9 +42,7 @@
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <getopt.h>
 #include <libgen.h>
-#include <libintl.h>
 #include <limits.h>
 #include <locale.h>
 #include <regex.h>
@@ -53,6 +51,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <libintl.h>
 
 #include "defs.h"
 #include "extern.h"
@@ -107,11 +106,6 @@ static char tmpfname[PATH_MAX];	/* Temporary file name (for in-place editing) */
 static const char *inplace;	/* Inplace edit file extension. */
 ulong_t linenum;
 
-static const struct option lopts[] = {
-	{"in-place",	optional_argument,	NULL,	'i'},
-	{NULL,		0,			NULL,	0}
-};
-
 static void add_compunit(enum e_cut, char *);
 static void add_file(char *);
 static void usage(void);
@@ -133,18 +127,14 @@ main(int argc, char *argv[])
 	fflag = 0;
 	inplace = NULL;
 
-	while ((c = getopt_long(argc, argv, "EI::ae:f:i::lnr", lopts, NULL)) !=
-	    -1)
+	while ((c = getopt(argc, argv, "EI:ae:f:i:lnr")) != -1)
 		switch (c) {
 		case 'r':		/* Gnu sed compat */
 		case 'E':
 			rflags = REG_EXTENDED;
 			break;
 		case 'I':
-			if (optarg != NULL)
-				inplace = optarg;
-			else
-				inplace = "";
+			inplace = optarg;
 			ispan = 1;	/* span across input files */
 			break;
 		case 'a':
@@ -161,10 +151,7 @@ main(int argc, char *argv[])
 			add_compunit(CU_FILE, optarg);
 			break;
 		case 'i':
-			if (optarg != NULL)
-				inplace = optarg;
-			else
-				inplace = "";
+			inplace = optarg;
 			ispan = 0;	/* don't span across input files */
 			break;
 		case 'l':
@@ -205,8 +192,8 @@ main(int argc, char *argv[])
 static void
 usage(void)
 {
-	(void) fputs(_("usage: sed script [-Ealn] [-i[extension]] [file...]\n"
-	    "       sed [-Ealn] [-i[extension]] [-e script]... "
+	(void) fputs(_("usage: sed script [-Ealn] [-i extension] [file...]\n"
+	    "       sed [-Ealn] [-i extension] [-e script]... "
 	    "[-f script_file]... [file...]\n"),
 	    stderr);
 	exit(1);
diff --git a/usr/src/cmd/sendmail/src/Makefile b/usr/src/cmd/sendmail/src/Makefile
index 14793754fd..9512a7d976 100644
--- a/usr/src/cmd/sendmail/src/Makefile
+++ b/usr/src/cmd/sendmail/src/Makefile
@@ -46,7 +46,7 @@ LDFLAGS +=	$(MAPFILES:%=-M%)
 
 LDLIBS += 	../libsmutil/libsmutil.a ../libsm/libsm.a -lresolv -lsocket \
 		-lnsl ../db/libdb.a -lldap -lsldap -lwrap -lumem \
-		-lssl -lcrypto -lsasl
+		-lsunw_ssl -lsunw_crypto -lsasl
 
 INCPATH=	-I. -I../include -I../db
 
diff --git a/usr/src/cmd/sgs/elfdump/Makefile.targ b/usr/src/cmd/sgs/elfdump/Makefile.targ
index 5cb4d96437..a0125d8a3d 100644
--- a/usr/src/cmd/sgs/elfdump/Makefile.targ
+++ b/usr/src/cmd/sgs/elfdump/Makefile.targ
@@ -78,6 +78,8 @@ delete:
 
 package \
 install:        all $(VAR_SGSBINPROG) $(VAR_SGSCCSLINK)
+		-$(RM) $(ROOTPROG)
+		-$(LN) $(ISAEXEC) $(ROOTPROG)
 
 .PARALLEL:	$(LINTOUT32) $(LINTOUT64)
 
diff --git a/usr/src/cmd/sgs/elfdump/amd64/Makefile b/usr/src/cmd/sgs/elfdump/amd64/Makefile
index be0f2c33f6..039edb65b6 100644
--- a/usr/src/cmd/sgs/elfdump/amd64/Makefile
+++ b/usr/src/cmd/sgs/elfdump/amd64/Makefile
@@ -38,6 +38,8 @@ LINTFLAGS64 +=	$(VAR_LINTFLAGS64)
 VAR_SGSBINPROG= $(VAR_SGSBINPROG64)
 VAR_SGSCCSLINK= $(VAR_SGSCCSLINK64)
 
+install:	all $(ROOTPROG64)
+
 include		../Makefile.targ
 include		../../Makefile.sub.64
 
diff --git a/usr/src/cmd/sgs/elfdump/i386/Makefile b/usr/src/cmd/sgs/elfdump/i386/Makefile
index d3cb302ac1..95390a2899 100644
--- a/usr/src/cmd/sgs/elfdump/i386/Makefile
+++ b/usr/src/cmd/sgs/elfdump/i386/Makefile
@@ -30,4 +30,6 @@ include		../Makefile.com
 
 ARCH =		i386
 
+install:	all $(ROOTPROG32)
+
 include		../Makefile.targ
diff --git a/usr/src/cmd/sgs/include/conv.h b/usr/src/cmd/sgs/include/conv.h
index 547e0697cf..7fc4c026d5 100644
--- a/usr/src/cmd/sgs/include/conv.h
+++ b/usr/src/cmd/sgs/include/conv.h
@@ -25,6 +25,7 @@
  *
  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright 2016 RackTop Systems.
  */
 
@@ -170,7 +171,7 @@ typedef union {
 	char				buf[CONV_CAP_VAL_HW1_BUFSIZE];
 } Conv_cap_val_hw1_buf_t;
 
-#define	CONV_CAP_VAL_HW2_BUFSIZE	CONV_INV_BUFSIZE	/* for now */
+#define	CONV_CAP_VAL_HW2_BUFSIZE	350
 typedef union {
 	Conv_inv_buf_t			inv_buf;
 	char				buf[CONV_CAP_VAL_HW2_BUFSIZE];
@@ -282,7 +283,7 @@ typedef union {
 } Conv_bnd_obj_buf_t;
 
 /* conv_phdr_flags() */
-#define	CONV_PHDR_FLAGS_BUFSIZE		88
+#define	CONV_PHDR_FLAGS_BUFSIZE		244
 typedef union {
 	Conv_inv_buf_t			inv_buf;
 	char				buf[CONV_PHDR_FLAGS_BUFSIZE];
diff --git a/usr/src/cmd/sgs/lex/Makefile.targ b/usr/src/cmd/sgs/lex/Makefile.targ
index fcf853208f..8d9ee4f7b7 100644
--- a/usr/src/cmd/sgs/lex/Makefile.targ
+++ b/usr/src/cmd/sgs/lex/Makefile.targ
@@ -94,4 +94,3 @@ $(LINTLIB): $$(SRCS)
 
 lintcheck: $$(SRCS)
 	$(LINT.c) $(LINTCHECKFLAGS) $(SRCS) $(LDLIBS)
-
diff --git a/usr/src/cmd/sgs/lex/common/main.c b/usr/src/cmd/sgs/lex/common/main.c
index 17ba4808a4..a1fd526cf9 100644
--- a/usr/src/cmd/sgs/lex/common/main.c
+++ b/usr/src/cmd/sgs/lex/common/main.c
@@ -30,11 +30,15 @@
 
 /* Copyright 1976, Bell Telephone Laboratories, Inc. */
 
+/* Copyright (c) 2013, joyent, Inc.  All rights reserved. */
+
 #include <string.h>
 #include "once.h"
 #include "sgs.h"
 #include <locale.h>
 #include <limits.h>
+#include <unistd.h>
+#include <libgen.h>
 
 static wchar_t  L_INITIAL[] = {'I', 'N', 'I', 'T', 'I', 'A', 'L', 0};
 static void get1core(void);
@@ -46,6 +50,25 @@ static void get3core(void);
 static void free3core(void);
 #endif
 
+static int
+lex_construct_path(char *buf, size_t size, const char *file, int type)
+{
+	int ret;
+	char origin[PATH_MAX];
+
+	if (type != 0) {
+		ret = readlink("/proc/self/path/a.out", origin, PATH_MAX - 1);
+		if (ret < 0)
+			error(
+			    "lex: failed to read origin from /proc\n");
+		origin[ret] = '\0';
+		return (snprintf(buf, size, "%s/../%s/%s", dirname(origin),
+		    NBASE, file));
+	}
+
+	return (snprintf(buf, size, "%s/%s/%s", NPREFIX, NBASE, file));
+}
+
 int
 main(int argc, char **argv)
 {
@@ -53,6 +76,7 @@ main(int argc, char **argv)
 	int c;
 	char *apath = NULL;
 	char *ypath;
+	char pathbuf[PATH_MAX];
 	Boolean eoption = 0, woption = 0;
 
 	sargv = argv;
@@ -224,6 +248,11 @@ main(int argc, char **argv)
 	free3core();
 #endif
 
+	/*
+	 * Try to find the file relative to $ORIGIN. Note that we don't touch
+	 * antyhing related to -Y. In fact, unfortunately it's always been
+	 * ignored it seems.
+	 */
 	if (handleeuc) {
 		if (ratfor)
 			error("Ratfor is not supported by -w or -e option.");
@@ -232,9 +261,19 @@ main(int argc, char **argv)
 	else
 		ypath = ratfor ? RATNAME : CNAME;
 
-	if (apath != NULL)
-		ypath = strcat(apath, strrchr(ypath, '/'));
-	fother = fopen(ypath, "r");
+	if (apath == NULL) {
+		(void) lex_construct_path(pathbuf, sizeof (pathbuf), ypath, 1);
+		fother = fopen(pathbuf, "r");
+		if (fother == NULL) {
+			(void) lex_construct_path(pathbuf, sizeof (pathbuf),
+			    ypath, 0);
+			fother = fopen(pathbuf, "r");
+		}
+	} else {
+		apath = strcat(apath, "/");
+		ypath = strcat(apath, ypath);
+		fother = fopen(ypath, "r");
+	}
 	if (fother == NULL)
 		error("Lex driver missing, file %s", ypath);
 	while ((i = getc(fother)) != EOF)
diff --git a/usr/src/cmd/sgs/lex/common/once.h b/usr/src/cmd/sgs/lex/common/once.h
index 014ca00b17..9e4b0e5e00 100644
--- a/usr/src/cmd/sgs/lex/common/once.h
+++ b/usr/src/cmd/sgs/lex/common/once.h
@@ -26,11 +26,11 @@
 /*	Copyright (c) 1988 AT&T	*/
 /*	All Rights Reserved	*/
 
+/* Copyright (c) 2013, joyent, Inc.  All rights reserved. */
+
 #ifndef	_ONCE_H
 #define	_ONCE_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include "ldefs.h"
 
 /* once.c */
@@ -73,9 +73,11 @@ int	peek = '\n';	/* next input character */
 CHR	*pushptr = pushc;
 CHR	*slptr = slist;
 
-#define	CNAME "/usr/share/lib/ccs/ncform"
-#define	RATNAME "/usr/share/lib/ccs/nrform"
-#define	EUCNAME "/usr/share/lib/ccs/nceucform"
+#define	NPREFIX	"/usr"
+#define	NBASE "/share/lib/ccs/"
+#define	CNAME "ncform"
+#define	RATNAME "nrform"
+#define	EUCNAME "nceucform"
 
 int ccount = 1;
 int casecount = 1;
diff --git a/usr/src/cmd/sgs/libconv/common/corenote.c b/usr/src/cmd/sgs/libconv/common/corenote.c
index 02b3e5d59b..3515e9b59c 100644
--- a/usr/src/cmd/sgs/libconv/common/corenote.c
+++ b/usr/src/cmd/sgs/libconv/common/corenote.c
@@ -77,7 +77,7 @@ const char *
 conv_cnote_auxv_type(Word type, Conv_fmt_flags_t fmt_flags,
     Conv_inv_buf_t *inv_buf)
 {
-	static const Msg	types_0_22[] = {
+	static const Msg	types_0_25[] = {
 		MSG_AUXV_AT_NULL,		MSG_AUXV_AT_IGNORE,
 		MSG_AUXV_AT_EXECFD,		MSG_AUXV_AT_PHDR,
 		MSG_AUXV_AT_PHENT,		MSG_AUXV_AT_PHNUM,
@@ -89,10 +89,11 @@ conv_cnote_auxv_type(Word type, Conv_fmt_flags_t fmt_flags,
 		MSG_AUXV_AT_HWCAP,		MSG_AUXV_AT_CLKTCK,
 		MSG_AUXV_AT_FPUCW,		MSG_AUXV_AT_DCACHEBSIZE,
 		MSG_AUXV_AT_ICACHEBSIZE,	MSG_AUXV_AT_UCACHEBSIZE,
-		MSG_AUXV_AT_IGNOREPPC
+		MSG_AUXV_AT_IGNOREPPC,		MSG_AUXV_AT_SECURE,
+		MSG_AUXV_AT_BASE_PLATFORM,	MSG_AUXV_AT_RANDOM
 	};
-	static const conv_ds_msg_t ds_types_0_22 = {
-	    CONV_DS_MSG_INIT(0, types_0_22) };
+	static const conv_ds_msg_t ds_types_0_25 = {
+	    CONV_DS_MSG_INIT(0, types_0_25) };
 
 	static const Msg	types_2000_2011[] = {
 		MSG_AUXV_AT_SUN_UID,		MSG_AUXV_AT_SUN_RUID,
@@ -111,7 +112,7 @@ conv_cnote_auxv_type(Word type, Conv_fmt_flags_t fmt_flags,
 		MSG_AUXV_AT_SUN_EMULATOR,	MSG_AUXV_AT_SUN_BRANDNAME,
 		MSG_AUXV_AT_SUN_BRAND_AUX1,	MSG_AUXV_AT_SUN_BRAND_AUX2,
 		MSG_AUXV_AT_SUN_BRAND_AUX3,	MSG_AUXV_AT_SUN_HWCAP2,
-		NULL,				NULL,
+		MSG_AUXV_AT_SUN_BRAND_NROOT,	MSG_AUXV_AT_SUN_BRAND_AUX4,
 		MSG_AUXV_AT_SUN_COMMPAGE,	MSG_AUXV_AT_SUN_FPTYPE,
 		MSG_AUXV_AT_SUN_FPSIZE
 	};
@@ -119,7 +120,7 @@ conv_cnote_auxv_type(Word type, Conv_fmt_flags_t fmt_flags,
 	    CONV_DS_MSG_INIT(2014, types_2014_2028) };
 
 	static const conv_ds_t	*ds[] = {
-		CONV_DS_ADDR(ds_types_0_22), CONV_DS_ADDR(ds_types_2000_2011),
+		CONV_DS_ADDR(ds_types_0_25), CONV_DS_ADDR(ds_types_2000_2011),
 		CONV_DS_ADDR(ds_types_2014_2028), NULL };
 
 	return (conv_map_ds(ELFOSABI_NONE, EM_NONE, type, ds, fmt_flags,
diff --git a/usr/src/cmd/sgs/libconv/common/corenote.msg b/usr/src/cmd/sgs/libconv/common/corenote.msg
index b55e67ec07..1613f4947a 100644
--- a/usr/src/cmd/sgs/libconv/common/corenote.msg
+++ b/usr/src/cmd/sgs/libconv/common/corenote.msg
@@ -79,6 +79,9 @@
 @ MSG_AUXV_AT_ICACHEBSIZE		"ICACHEBSIZE"
 @ MSG_AUXV_AT_UCACHEBSIZE		"UCACHEBSIZE"
 @ MSG_AUXV_AT_IGNOREPPC			"IGNOREPPC"
+@ MSG_AUXV_AT_SECURE			"SECURE"
+@ MSG_AUXV_AT_BASE_PLATFORM		"BASE_PLATFORM"
+@ MSG_AUXV_AT_RANDOM			"RANDOM"
 @ MSG_AUXV_AT_SUN_UID			"SUN_UID"
 @ MSG_AUXV_AT_SUN_RUID			"SUN_RUID"
 @ MSG_AUXV_AT_SUN_GID			"SUN_GID"
@@ -101,6 +104,8 @@
 @ MSG_AUXV_AT_SUN_BRAND_AUX2		"SUN_BRAND_AUX2"
 @ MSG_AUXV_AT_SUN_BRAND_AUX3		"SUN_BRAND_AUX3"
 @ MSG_AUXV_AT_SUN_HWCAP2		"SUN_HWCAP2"
+@ MSG_AUXV_AT_SUN_BRAND_NROOT		"SUN_BRAND_NROOT"
+@ MSG_AUXV_AT_SUN_BRAND_AUX4		"SUN_BRAND_AUX4"
 @ MSG_AUXV_AT_SUN_COMMPAGE		"SUN_COMMPAGE"
 @ MSG_AUXV_AT_SUN_FPTYPE		"SUN_FPTYPE"
 @ MSG_AUXV_AT_SUN_FPSIZE		"SUN_FPSIZE"
diff --git a/usr/src/cmd/sgs/libconv/common/elf.c b/usr/src/cmd/sgs/libconv/common/elf.c
index 73469c3506..4808b887b2 100644
--- a/usr/src/cmd/sgs/libconv/common/elf.c
+++ b/usr/src/cmd/sgs/libconv/common/elf.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -265,7 +266,7 @@ ehdr_mach_strings(Conv_fmt_flags_t fmt_flags)
 	    CONV_DS_MSG_INIT(EM_V800, mach_36_63_dmp) };
 
 
-	static const Msg mach_66_94_cf[] = {
+	static const Msg mach_66_120_cf[] = {
 		MSG_EM_FX66_CF,		MSG_EM_ST9PLUS_CF,
 		MSG_EM_ST7_CF,		MSG_EM_68HC16_CF,
 		MSG_EM_68HC11_CF,	MSG_EM_68HC08_CF,
@@ -280,9 +281,22 @@ ehdr_mach_strings(Conv_fmt_flags_t fmt_flags)
 		MSG_EM_M32R_CF,		MSG_EM_MN10300_CF,
 		MSG_EM_MN10200_CF,	MSG_EM_PJ_CF,
 		MSG_EM_OPENRISC_CF,	MSG_EM_ARC_A5_CF,
-		MSG_EM_XTENSA_CF
+		MSG_EM_XTENSA_CF,	MSG_EM_VIDEOCORE_CF,
+		MSG_EM_TMM_GPP_CF,	MSG_EM_NS32K_CF,
+		MSG_EM_TPC_CF,		MSG_EM_SNP1K_CF,
+		MSG_EM_ST200_CF,	MSG_EM_IP2K_CF,
+		MSG_EM_MAX_CF,		MSG_EM_CR_CF,
+		MSG_EM_F2MC16_CF,	MSG_EM_MSP430_CF,
+		MSG_EM_BLACKFIN_CF,	MSG_EM_SE_C33_CF,
+		MSG_EM_SEP_CF,		MSG_EM_ARCA_CF,
+		MSG_EM_UNICORE_CF,	MSG_EM_EXCESS_CF,
+		MSG_EM_DXP_CF,		MSG_EM_ALTERA_NIOS2_CF,
+		MSG_EM_CRX_CF,		MSG_EM_XGATE_CF,
+		MSG_EM_C166_CF,		MSG_EM_M16C_CF,
+		MSG_EM_DSPIC30F_CF,	MSG_EM_CE_CF,
+		MSG_EM_M32C_CF
 	};
-	static const Msg mach_66_94_nf[] = {
+	static const Msg mach_66_120_nf[] = {
 		MSG_EM_FX66_NF,		MSG_EM_ST9PLUS_NF,
 		MSG_EM_ST7_NF,		MSG_EM_68HC16_NF,
 		MSG_EM_68HC11_NF,	MSG_EM_68HC08_NF,
@@ -297,9 +311,28 @@ ehdr_mach_strings(Conv_fmt_flags_t fmt_flags)
 		MSG_EM_M32R_NF,		MSG_EM_MN10300_NF,
 		MSG_EM_MN10200_NF,	MSG_EM_PJ_NF,
 		MSG_EM_OPENRISC_NF,	MSG_EM_ARC_A5_NF,
-		MSG_EM_XTENSA_NF
+		MSG_EM_XTENSA_NF,	MSG_EM_VIDEOCORE_NF,
+		MSG_EM_TMM_GPP_NF,	MSG_EM_NS32K_NF,
+		MSG_EM_TPC_NF,		MSG_EM_SNP1K_NF,
+		MSG_EM_ST200_NF,	MSG_EM_IP2K_NF,
+		MSG_EM_MAX_NF,		MSG_EM_CR_NF,
+		MSG_EM_F2MC16_NF,	MSG_EM_MSP430_NF,
+		MSG_EM_BLACKFIN_NF,	MSG_EM_SE_C33_NF,
+		MSG_EM_SEP_NF,		MSG_EM_ARCA_NF,
+		MSG_EM_UNICORE_NF,	MSG_EM_EXCESS_NF,
+		MSG_EM_DXP_NF,		MSG_EM_ALTERA_NIOS2_NF,
+		MSG_EM_CRX_NF,		MSG_EM_XGATE_NF,
+		MSG_EM_C166_NF,		MSG_EM_M16C_NF,
+		MSG_EM_DSPIC30F_NF,	MSG_EM_CE_NF,
+		MSG_EM_TSK3000_NF,	MSG_EM_RS08_NF,
+		MSG_EM_SHARC_NF,	MSG_EM_ECOG2_NF,
+		MSG_EM_SCORE7_NF,	MSG_EM_DSP24_NF,
+		MSG_EM_VIDEOCORE3_NF,	MSG_EM_LATTICEMICO32_NF,
+		MSG_EM_SE_C17_NF,	MSG_EM_TI_C6000_NF,
+		MSG_EM_TI_C2000_NF,	MSG_EM_TI_C5500_NF,
+		MSG_EM_TI_ARP32_NF,	MSG_EM_TI_PRU_NF
 	};
-	static const Msg mach_66_94_dmp[] = {
+	static const Msg mach_66_120_dmp[] = {
 		MSG_EM_FX66_CF,		MSG_EM_ST9PLUS_CF,
 		MSG_EM_ST7_CF,		MSG_EM_68HC16_CF,
 		MSG_EM_68HC11_CF,	MSG_EM_68HC08_CF,
@@ -314,34 +347,256 @@ ehdr_mach_strings(Conv_fmt_flags_t fmt_flags)
 		MSG_EM_M32R_CF,		MSG_EM_MN10300_CF,
 		MSG_EM_MN10200_CF,	MSG_EM_PJ_CF,
 		MSG_EM_OPENRISC_CF,	MSG_EM_ARC_A5_CF,
-		MSG_EM_XTENSA_CF
+		MSG_EM_XTENSA_CF,	MSG_EM_VIDEOCORE_CF,
+		MSG_EM_TMM_GPP_CF,	MSG_EM_NS32K_CF,
+		MSG_EM_TPC_CF,		MSG_EM_SNP1K_CF,
+		MSG_EM_ST200_CF,	MSG_EM_IP2K_CF,
+		MSG_EM_MAX_CF,		MSG_EM_CR_CF,
+		MSG_EM_F2MC16_CF,	MSG_EM_MSP430_CF,
+		MSG_EM_BLACKFIN_CF,	MSG_EM_SE_C33_CF,
+		MSG_EM_SEP_CF,		MSG_EM_ARCA_CF,
+		MSG_EM_UNICORE_CF,	MSG_EM_EXCESS_CF,
+		MSG_EM_DXP_CF,		MSG_EM_ALTERA_NIOS2_CF,
+		MSG_EM_CRX_CF,		MSG_EM_XGATE_CF,
+		MSG_EM_C166_CF,		MSG_EM_M16C_CF,
+		MSG_EM_DSPIC30F_CF,	MSG_EM_CE_CF,
+		MSG_EM_M32C_CF
+	};
+
+	static const conv_ds_msg_t ds_mach_66_120_cf = {
+	    CONV_DS_MSG_INIT(EM_FX66, mach_66_120_cf) };
+	static const conv_ds_msg_t ds_mach_66_120_nf = {
+	    CONV_DS_MSG_INIT(EM_FX66, mach_66_120_nf) };
+	static const conv_ds_msg_t ds_mach_66_120_dmp = {
+	    CONV_DS_MSG_INIT(EM_FX66, mach_66_120_dmp) };
+
+	static const Msg mach_131_144_cf[] = {
+		MSG_EM_TSK3000_CF,	MSG_EM_RS08_CF,
+		MSG_EM_SHARC_CF,	MSG_EM_ECOG2_CF,
+		MSG_EM_SCORE7_CF,	MSG_EM_DSP24_CF,
+		MSG_EM_VIDEOCORE3_CF,	MSG_EM_LATTICEMICO32_CF,
+		MSG_EM_SE_C17_CF,	MSG_EM_TI_C6000_CF,
+		MSG_EM_TI_C2000_CF,	MSG_EM_TI_C5500_CF,
+		MSG_EM_TI_ARP32_CF,	MSG_EM_TI_PRU_CF
+	};
+	static const Msg mach_131_144_nf[] = {
+		MSG_EM_TSK3000_NF,	MSG_EM_RS08_NF,
+		MSG_EM_SHARC_NF,	MSG_EM_ECOG2_NF,
+		MSG_EM_SCORE7_NF,	MSG_EM_DSP24_NF,
+		MSG_EM_VIDEOCORE3_NF,	MSG_EM_LATTICEMICO32_NF,
+		MSG_EM_SE_C17_NF,	MSG_EM_TI_C6000_NF,
+		MSG_EM_TI_C2000_NF,	MSG_EM_TI_C5500_NF,
+		MSG_EM_TI_ARP32_NF,	MSG_EM_TI_PRU_NF
+	};
+	static const Msg mach_131_144_dmp[] = {
+		MSG_EM_TSK3000_CF,	MSG_EM_RS08_CF,
+		MSG_EM_SHARC_CF,	MSG_EM_ECOG2_CF,
+		MSG_EM_SCORE7_CF,	MSG_EM_DSP24_CF,
+		MSG_EM_VIDEOCORE3_CF,	MSG_EM_LATTICEMICO32_CF,
+		MSG_EM_SE_C17_CF,	MSG_EM_TI_C6000_CF,
+		MSG_EM_TI_C2000_CF,	MSG_EM_TI_C5500_CF,
+		MSG_EM_TI_ARP32_CF,	MSG_EM_TI_PRU_CF
+	};
+	static const conv_ds_msg_t ds_mach_131_144_cf = {
+	    CONV_DS_MSG_INIT(EM_TSK3000, mach_131_144_cf) };
+	static const conv_ds_msg_t ds_mach_131_144_nf = {
+	    CONV_DS_MSG_INIT(EM_TSK3000, mach_131_144_nf) };
+	static const conv_ds_msg_t ds_mach_131_144_dmp = {
+	    CONV_DS_MSG_INIT(EM_TSK3000, mach_131_144_dmp) };
+
+	static const Msg mach_160_181_cf[] = {
+		MSG_EM_MMDSP_PLUS_CF,	MSG_EM_CYPRESS_M8C_CF,
+		MSG_EM_R32C_CF,		MSG_EM_TRIMEDIA_CF,
+		MSG_EM_QDSP6_CF,	MSG_EM_8051_CF,
+		MSG_EM_STXP7X_CF,	MSG_EM_NDS32_CF,
+		MSG_EM_ECOG1_CF,	MSG_EM_MAXQ30_CF,
+		MSG_EM_XIMO16_CF,	MSG_EM_MANIK_CF,
+		MSG_EM_CRAYNV2_CF,	MSG_EM_RX_CF,
+		MSG_EM_METAG_CF,	MSG_EM_MCST_ELBRUS_CF,
+		MSG_EM_ECOG16_CF,	MSG_EM_CR16_CF,
+		MSG_EM_ETPU_CF,		MSG_EM_SLE9X_CF,
+		MSG_EM_L10M_CF,		MSG_EM_K10M_CF,
+	};
+	static const Msg mach_160_181_nf[] = {
+		MSG_EM_MMDSP_PLUS_NF,	MSG_EM_CYPRESS_M8C_NF,
+		MSG_EM_R32C_NF,		MSG_EM_TRIMEDIA_NF,
+		MSG_EM_QDSP6_NF,	MSG_EM_8051_NF,
+		MSG_EM_STXP7X_NF,	MSG_EM_NDS32_NF,
+		MSG_EM_ECOG1_NF,	MSG_EM_MAXQ30_NF,
+		MSG_EM_XIMO16_NF,	MSG_EM_MANIK_NF,
+		MSG_EM_CRAYNV2_NF,	MSG_EM_RX_NF,
+		MSG_EM_METAG_NF,	MSG_EM_MCST_ELBRUS_NF,
+		MSG_EM_ECOG16_NF,	MSG_EM_CR16_NF,
+		MSG_EM_ETPU_NF,		MSG_EM_SLE9X_NF,
+		MSG_EM_L10M_NF,		MSG_EM_K10M_NF,
+	};
+	static const Msg mach_160_181_dmp[] = {
+		MSG_EM_MMDSP_PLUS_CF,	MSG_EM_CYPRESS_M8C_CF,
+		MSG_EM_R32C_CF,		MSG_EM_TRIMEDIA_CF,
+		MSG_EM_QDSP6_CF,	MSG_EM_8051_CF,
+		MSG_EM_STXP7X_CF,	MSG_EM_NDS32_CF,
+		MSG_EM_ECOG1_CF,	MSG_EM_MAXQ30_CF,
+		MSG_EM_XIMO16_CF,	MSG_EM_MANIK_CF,
+		MSG_EM_CRAYNV2_CF,	MSG_EM_RX_CF,
+		MSG_EM_METAG_CF,	MSG_EM_MCST_ELBRUS_CF,
+		MSG_EM_ECOG16_CF,	MSG_EM_CR16_CF,
+		MSG_EM_ETPU_CF,		MSG_EM_SLE9X_CF,
+		MSG_EM_L10M_CF,		MSG_EM_K10M_CF,
+	};
+	static const conv_ds_msg_t ds_mach_160_181_cf = {
+	    CONV_DS_MSG_INIT(EM_MMDSP_PLUS, mach_160_181_cf) };
+	static const conv_ds_msg_t ds_mach_160_181_nf = {
+	    CONV_DS_MSG_INIT(EM_MMDSP_PLUS, mach_160_181_nf) };
+	static const conv_ds_msg_t ds_mach_160_181_dmp = {
+	    CONV_DS_MSG_INIT(EM_MMDSP_PLUS, mach_160_181_dmp) };
+
+	static const Msg mach_183_cf[] = {
+		MSG_EM_AARCH64_CF
+	};
+	static const Msg mach_183_nf[] = {
+		MSG_EM_AARCH64_NF
+	};
+	static const Msg mach_183_dmp[] = {
+		MSG_EM_AARCH64_CF
+	};
+	static const conv_ds_msg_t ds_mach_183_cf = {
+	    CONV_DS_MSG_INIT(EM_AARCH64, mach_183_cf) };
+	static const conv_ds_msg_t ds_mach_183_nf = {
+	    CONV_DS_MSG_INIT(EM_AARCH64, mach_183_nf) };
+	static const conv_ds_msg_t ds_mach_183_dmp = {
+	    CONV_DS_MSG_INIT(EM_AARCH64, mach_183_dmp) };
+
+	static const Msg mach_185_224_cf[] = {
+		MSG_EM_AVR32_CF,	MSG_EM_STM8_CF,
+		MSG_EM_TILE64_CF,	MSG_EM_TILEPRO_CF,
+		MSG_EM_MICROBLAZE_CF,	MSG_EM_CUDA_CF,
+		MSG_EM_TILEGX_CF,	MSG_EM_CLOUDSHIELD_CF,
+		MSG_EM_COREA_1ST_CF,	MSG_EM_COREA_2ND_CF,
+		MSG_EM_ARC_COMPACT2_CF,	MSG_EM_OPEN8_CF,
+		MSG_EM_RL78_CF,		MSG_EM_VIDEOCORE5_CF,
+		MSG_EM_78KOR_CF,	MSG_EM_56800EX_CF,
+		MSG_EM_BA1_CF,		MSG_EM_BA2_CF,
+		MSG_EM_XCORE_CF,	MSG_EM_MCHP_PIC_CF,
+		MSG_EM_INTEL205_CF,	MSG_EM_INTEL206_CF,
+		MSG_EM_INTEL207_CF,	MSG_EM_INTEL208_CF,
+		MSG_EM_INTEL209_CF,	MSG_EM_KM32_CF,
+		MSG_EM_KMX32_CF,	MSG_EM_KMX16_CF,
+		MSG_EM_KMX8_CF,		MSG_EM_KVARC_CF,
+		MSG_EM_CDP_CF,		MSG_EM_COGE_CF,
+		MSG_EM_COOL_CF,		MSG_EM_NORC_CF,
+		MSG_EM_CSR_KALIMBA_CF,	MSG_EM_Z80_CF,
+		MSG_EM_VISIUM_CF,	MSG_EM_FT32_CF,
+		MSG_EM_MOXIE_CF,	MSG_EM_AMDGPU_CF
+	};
+	static const Msg mach_185_224_nf[] = {
+		MSG_EM_AVR32_NF,	MSG_EM_STM8_NF,
+		MSG_EM_TILE64_NF,	MSG_EM_TILEPRO_NF,
+		MSG_EM_MICROBLAZE_NF,	MSG_EM_CUDA_NF,
+		MSG_EM_TILEGX_NF,	MSG_EM_CLOUDSHIELD_NF,
+		MSG_EM_COREA_1ST_NF,	MSG_EM_COREA_2ND_NF,
+		MSG_EM_ARC_COMPACT2_NF,	MSG_EM_OPEN8_NF,
+		MSG_EM_RL78_NF,		MSG_EM_VIDEOCORE5_NF,
+		MSG_EM_78KOR_NF,	MSG_EM_56800EX_NF,
+		MSG_EM_BA1_NF,		MSG_EM_BA2_NF,
+		MSG_EM_XCORE_NF,	MSG_EM_MCHP_PIC_NF,
+		MSG_EM_INTEL205_NF,	MSG_EM_INTEL206_NF,
+		MSG_EM_INTEL207_NF,	MSG_EM_INTEL208_NF,
+		MSG_EM_INTEL209_NF,	MSG_EM_KM32_NF,
+		MSG_EM_KMX32_NF,	MSG_EM_KMX16_NF,
+		MSG_EM_KMX8_NF,		MSG_EM_KVARC_NF,
+		MSG_EM_CDP_NF,		MSG_EM_COGE_NF,
+		MSG_EM_COOL_NF,		MSG_EM_NORC_NF,
+		MSG_EM_CSR_KALIMBA_NF,	MSG_EM_Z80_NF,
+		MSG_EM_VISIUM_NF,	MSG_EM_FT32_NF,
+		MSG_EM_MOXIE_NF,	MSG_EM_AMDGPU_NF
+	};
+	static const Msg mach_185_224_dmp[] = {
+		MSG_EM_AVR32_CF,	MSG_EM_STM8_CF,
+		MSG_EM_TILE64_CF,	MSG_EM_TILEPRO_CF,
+		MSG_EM_MICROBLAZE_CF,	MSG_EM_CUDA_CF,
+		MSG_EM_TILEGX_CF,	MSG_EM_CLOUDSHIELD_CF,
+		MSG_EM_COREA_1ST_CF,	MSG_EM_COREA_2ND_CF,
+		MSG_EM_ARC_COMPACT2_CF,	MSG_EM_OPEN8_CF,
+		MSG_EM_RL78_CF,		MSG_EM_VIDEOCORE5_CF,
+		MSG_EM_78KOR_CF,	MSG_EM_56800EX_CF,
+		MSG_EM_BA1_CF,		MSG_EM_BA2_CF,
+		MSG_EM_XCORE_CF,	MSG_EM_MCHP_PIC_CF,
+		MSG_EM_INTEL205_CF,	MSG_EM_INTEL206_CF,
+		MSG_EM_INTEL207_CF,	MSG_EM_INTEL208_CF,
+		MSG_EM_INTEL209_CF,	MSG_EM_KM32_CF,
+		MSG_EM_KMX32_CF,	MSG_EM_KMX16_CF,
+		MSG_EM_KMX8_CF,		MSG_EM_KVARC_CF,
+		MSG_EM_CDP_CF,		MSG_EM_COGE_CF,
+		MSG_EM_COOL_CF,		MSG_EM_NORC_CF,
+		MSG_EM_CSR_KALIMBA_CF,	MSG_EM_Z80_CF,
+		MSG_EM_VISIUM_CF,	MSG_EM_FT32_CF,
+		MSG_EM_MOXIE_CF,	MSG_EM_AMDGPU_CF
+	};
+
+	static const conv_ds_msg_t ds_mach_185_224_cf = {
+	    CONV_DS_MSG_INIT(EM_AVR32, mach_185_224_cf) };
+	static const conv_ds_msg_t ds_mach_185_224_nf = {
+	    CONV_DS_MSG_INIT(EM_AVR32, mach_185_224_nf) };
+	static const conv_ds_msg_t ds_mach_185_224_dmp = {
+	    CONV_DS_MSG_INIT(EM_AVR32, mach_185_224_dmp) };
+
+
+	static const Msg mach_243_cf[] = {
+		MSG_EM_RISCV_CF
+	};
+	static const Msg mach_243_nf[] = {
+		MSG_EM_RISCV_NF
+	};
+	static const Msg mach_243_dmp[] = {
+		MSG_EM_RISCV_CF
 	};
-#if	(EM_NUM != (EM_XTENSA + 1))
-#error	"EM_NUM has grown"
-#endif
-	static const conv_ds_msg_t ds_mach_66_94_cf = {
-	    CONV_DS_MSG_INIT(EM_FX66, mach_66_94_cf) };
-	static const conv_ds_msg_t ds_mach_66_94_nf = {
-	    CONV_DS_MSG_INIT(EM_FX66, mach_66_94_nf) };
-	static const conv_ds_msg_t ds_mach_66_94_dmp = {
-	    CONV_DS_MSG_INIT(EM_FX66, mach_66_94_dmp) };
 
+	static const conv_ds_msg_t ds_mach_243_cf = {
+	    CONV_DS_MSG_INIT(EM_RISCV, mach_243_cf) };
+	static const conv_ds_msg_t ds_mach_243_nf = {
+	    CONV_DS_MSG_INIT(EM_RISCV, mach_243_nf) };
+	static const conv_ds_msg_t ds_mach_243_dmp = {
+	    CONV_DS_MSG_INIT(EM_RISCV, mach_243_dmp) };
 
+#if	(EM_NUM != (EM_RISCV + 1))
+#error	"EM_NUM has grown"
+#endif
 	/* Build NULL terminated return arrays for each string style */
 	static const conv_ds_t	*ds_cf[] = {
-		CONV_DS_ADDR(ds_mach_0_11_cf), CONV_DS_ADDR(ds_mach_15_22_cf),
-		CONV_DS_ADDR(ds_mach_36_63_cf), CONV_DS_ADDR(ds_mach_66_94_cf),
+		CONV_DS_ADDR(ds_mach_0_11_cf),
+		CONV_DS_ADDR(ds_mach_15_22_cf),
+		CONV_DS_ADDR(ds_mach_36_63_cf),
+		CONV_DS_ADDR(ds_mach_66_120_cf),
+		CONV_DS_ADDR(ds_mach_131_144_cf),
+		CONV_DS_ADDR(ds_mach_160_181_cf),
+		CONV_DS_ADDR(ds_mach_183_cf),
+		CONV_DS_ADDR(ds_mach_185_224_cf),
+		CONV_DS_ADDR(ds_mach_243_cf),
 		NULL
 	};
 	static const conv_ds_t	*ds_nf[] = {
-		CONV_DS_ADDR(ds_mach_0_11_nf), CONV_DS_ADDR(ds_mach_15_22_nf),
-		CONV_DS_ADDR(ds_mach_36_63_nf), CONV_DS_ADDR(ds_mach_66_94_nf),
+		CONV_DS_ADDR(ds_mach_0_11_nf),
+		CONV_DS_ADDR(ds_mach_15_22_nf),
+		CONV_DS_ADDR(ds_mach_36_63_nf),
+		CONV_DS_ADDR(ds_mach_66_120_nf),
+		CONV_DS_ADDR(ds_mach_131_144_nf),
+		CONV_DS_ADDR(ds_mach_160_181_nf),
+		CONV_DS_ADDR(ds_mach_183_nf),
+		CONV_DS_ADDR(ds_mach_185_224_nf),
+		CONV_DS_ADDR(ds_mach_243_nf),
 		NULL
 	};
 	static const conv_ds_t	*ds_dmp[] = {
-		CONV_DS_ADDR(ds_mach_0_11_dmp), CONV_DS_ADDR(ds_mach_15_22_dmp),
+		CONV_DS_ADDR(ds_mach_0_11_dmp),
+		CONV_DS_ADDR(ds_mach_15_22_dmp),
 		CONV_DS_ADDR(ds_mach_36_63_dmp),
-		CONV_DS_ADDR(ds_mach_66_94_dmp), NULL
+		CONV_DS_ADDR(ds_mach_66_120_dmp),
+		CONV_DS_ADDR(ds_mach_131_144_dmp),
+		CONV_DS_ADDR(ds_mach_160_181_dmp),
+		CONV_DS_ADDR(ds_mach_183_dmp),
+		CONV_DS_ADDR(ds_mach_185_224_dmp),
+		CONV_DS_ADDR(ds_mach_243_dmp),
+		NULL
 	};
 
 
@@ -753,33 +1008,39 @@ ehdr_osabi_strings(Conv_fmt_flags_t fmt_flags)
 	    CONV_DS_MSG_INIT(ELFOSABI_NONE, osabi_0_3_dmp) };
 
 
-	static const Msg osabi_6_15_cf[] = {
+	static const Msg osabi_6_18_cf[] = {
 		MSG_OSABI_SOLARIS_CF,	MSG_OSABI_AIX_CF,
 		MSG_OSABI_IRIX_CF,	MSG_OSABI_FREEBSD_CF,
 		MSG_OSABI_TRU64_CF,	MSG_OSABI_MODESTO_CF,
 		MSG_OSABI_OPENBSD_CF,	MSG_OSABI_OPENVMS_CF,
-		MSG_OSABI_NSK_CF,	MSG_OSABI_AROS_CF
+		MSG_OSABI_NSK_CF,	MSG_OSABI_AROS_CF,
+		MSG_OSABI_FENIXOS_CF,	MSG_OSABI_CLOUDABI_CF,
+		MSG_OSABI_OPENVOS_CF
 	};
-	static const Msg osabi_6_15_nf[] = {
+	static const Msg osabi_6_18_nf[] = {
 		MSG_OSABI_SOLARIS_NF,	MSG_OSABI_AIX_NF,
 		MSG_OSABI_IRIX_NF,	MSG_OSABI_FREEBSD_NF,
 		MSG_OSABI_TRU64_NF,	MSG_OSABI_MODESTO_NF,
 		MSG_OSABI_OPENBSD_NF,	MSG_OSABI_OPENVMS_NF,
-		MSG_OSABI_NSK_NF,	MSG_OSABI_AROS_NF
+		MSG_OSABI_NSK_NF,	MSG_OSABI_AROS_NF,
+		MSG_OSABI_FENIXOS_NF,	MSG_OSABI_CLOUDABI_NF,
+		MSG_OSABI_OPENVOS_NF
 	};
-	static const Msg osabi_6_15_dmp[] = {
+	static const Msg osabi_6_18_dmp[] = {
 		MSG_OSABI_SOLARIS_DMP,	MSG_OSABI_AIX_DMP,
 		MSG_OSABI_IRIX_DMP,	MSG_OSABI_FREEBSD_DMP,
 		MSG_OSABI_TRU64_DMP,	MSG_OSABI_MODESTO_DMP,
 		MSG_OSABI_OPENBSD_DMP,	MSG_OSABI_OPENVMS_DMP,
-		MSG_OSABI_NSK_DMP,	MSG_OSABI_AROS_DMP
+		MSG_OSABI_NSK_DMP,	MSG_OSABI_AROS_DMP,
+		MSG_OSABI_FENIXOS_DMP,	MSG_OSABI_CLOUDABI_DMP,
+		MSG_OSABI_OPENVOS_DMP
 	};
-	static const conv_ds_msg_t ds_osabi_6_15_cf = {
-	    CONV_DS_MSG_INIT(ELFOSABI_SOLARIS, osabi_6_15_cf) };
-	static const conv_ds_msg_t ds_osabi_6_15_nf = {
-	    CONV_DS_MSG_INIT(ELFOSABI_SOLARIS, osabi_6_15_nf) };
-	static const conv_ds_msg_t ds_osabi_6_15_dmp = {
-	    CONV_DS_MSG_INIT(ELFOSABI_SOLARIS, osabi_6_15_dmp) };
+	static const conv_ds_msg_t ds_osabi_6_18_cf = {
+	    CONV_DS_MSG_INIT(ELFOSABI_SOLARIS, osabi_6_18_cf) };
+	static const conv_ds_msg_t ds_osabi_6_18_nf = {
+	    CONV_DS_MSG_INIT(ELFOSABI_SOLARIS, osabi_6_18_nf) };
+	static const conv_ds_msg_t ds_osabi_6_18_dmp = {
+	    CONV_DS_MSG_INIT(ELFOSABI_SOLARIS, osabi_6_18_dmp) };
 
 
 	static const Val_desc osabi_misc_cf[] = {
@@ -806,13 +1067,13 @@ ehdr_osabi_strings(Conv_fmt_flags_t fmt_flags)
 
 	/* Build NULL terminated return arrays for each string style */
 	static const conv_ds_t	*ds_cf[] = {
-		CONV_DS_ADDR(ds_osabi_0_3_cf), CONV_DS_ADDR(ds_osabi_6_15_cf),
+		CONV_DS_ADDR(ds_osabi_0_3_cf), CONV_DS_ADDR(ds_osabi_6_18_cf),
 		CONV_DS_ADDR(ds_osabi_misc_cf), NULL };
 	static const conv_ds_t	*ds_nf[] = {
-		CONV_DS_ADDR(ds_osabi_0_3_nf), CONV_DS_ADDR(ds_osabi_6_15_nf),
+		CONV_DS_ADDR(ds_osabi_0_3_nf), CONV_DS_ADDR(ds_osabi_6_18_nf),
 		CONV_DS_ADDR(ds_osabi_misc_nf), NULL };
 	static const conv_ds_t	*ds_dmp[] = {
-		CONV_DS_ADDR(ds_osabi_0_3_dmp), CONV_DS_ADDR(ds_osabi_6_15_dmp),
+		CONV_DS_ADDR(ds_osabi_0_3_dmp), CONV_DS_ADDR(ds_osabi_6_18_dmp),
 		CONV_DS_ADDR(ds_osabi_misc_dmp), NULL };
 
 	/* Select the strings to use */
diff --git a/usr/src/cmd/sgs/libconv/common/elf.msg b/usr/src/cmd/sgs/libconv/common/elf.msg
index 24325f05cd..95a36a09f4 100644
--- a/usr/src/cmd/sgs/libconv/common/elf.msg
+++ b/usr/src/cmd/sgs/libconv/common/elf.msg
@@ -22,6 +22,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 @ MSG_ELFCLASSNONE_CF		"ELFCLASSNONE"			# 0
@@ -224,6 +225,216 @@
 @ MSG_EM_XTENSA_CF		"EM_XTENSA"			# 94
 @ MSG_EM_XTENSA_NF			"xtensa"
 
+@ MSG_EM_VIDEOCORE_CF 		"EM_VIDEOCORE"			# 95
+@ MSG_EM_VIDEOCORE_NF			"videocore"
+@ MSG_EM_TMM_GPP_CF 		"EM_TMM_GPP"			# 96
+@ MSG_EM_TMM_GPP_NF			"tmm_gpp"
+@ MSG_EM_NS32K_CF 		"EM_NS32K"			# 97
+@ MSG_EM_NS32K_NF			"ns32k"
+@ MSG_EM_TPC_CF 		"EM_TPC"			# 98
+@ MSG_EM_TPC_NF				"tpc"
+@ MSG_EM_SNP1K_CF 		"EM_SNP1K"			# 99
+@ MSG_EM_SNP1K_NF			"snp1k"
+@ MSG_EM_ST200_CF 		"EM_ST200"			# 100
+@ MSG_EM_ST200_NF			"st200"
+@ MSG_EM_IP2K_CF 		"EM_IP2K"			# 101
+@ MSG_EM_IP2K_NF			"ip2k"
+@ MSG_EM_MAX_CF 		"EM_MAX"			# 102
+@ MSG_EM_MAX_NF				"max"
+@ MSG_EM_CR_CF 			"EM_CR"				# 103
+@ MSG_EM_CR_NF				"CR"
+@ MSG_EM_F2MC16_CF 		"EM_F2MC16"			# 104
+@ MSG_EM_F2MC16_NF			"f2mc16"
+@ MSG_EM_MSP430_CF 		"EM_MSP430"			# 105
+@ MSG_EM_MSP430_NF			"msp430"
+@ MSG_EM_BLACKFIN_CF 		"EM_BLACKFIN"			# 106
+@ MSG_EM_BLACKFIN_NF			"blackfin"
+@ MSG_EM_SE_C33_CF 		"EM_SE_C33"			# 107
+@ MSG_EM_SE_C33_NF			"se_c33"
+@ MSG_EM_SEP_CF 		"EM_SEP"			# 108
+@ MSG_EM_SEP_NF				"sep"
+@ MSG_EM_ARCA_CF 		"EM_ARCA"			# 109
+@ MSG_EM_ARCA_NF			"arca"
+@ MSG_EM_UNICORE_CF 		"EM_UNICORE"			# 110
+@ MSG_EM_UNICORE_NF			"unicore"
+@ MSG_EM_EXCESS_CF 		"EM_EXCESS"			# 111
+@ MSG_EM_EXCESS_NF			"excess"
+@ MSG_EM_DXP_CF 		"EM_DXP"			# 112
+@ MSG_EM_DXP_NF				"dxp"
+@ MSG_EM_ALTERA_NIOS2_CF 	"EM_ALTERA_NIOS2"		# 113
+@ MSG_EM_ALTERA_NIOS2_NF		"altera_nios2"
+@ MSG_EM_CRX_CF 		"EM_CRX"			# 114
+@ MSG_EM_CRX_NF				"crx"
+@ MSG_EM_XGATE_CF 		"EM_XGATE"			# 115
+@ MSG_EM_XGATE_NF			"xgate"
+@ MSG_EM_C166_CF 		"EM_C166"			# 116
+@ MSG_EM_C166_NF			"c166"
+@ MSG_EM_M16C_CF 		"EM_M16C"			# 117
+@ MSG_EM_M16C_NF			"m16c"
+@ MSG_EM_DSPIC30F_CF 		"EM_DSPIC30F"			# 118
+@ MSG_EM_DSPIC30F_NF			"dspic30f"
+@ MSG_EM_CE_CF 			"EM_CE"				# 119
+@ MSG_EM_CE_NF				"ce"
+@ MSG_EM_M32C_CF		"EM_M32C"			# 120
+@ MSG_EM_M32C_NF			"m32c"
+@ MSG_EM_TSK3000_CF 		"EM_TSK3000"			# 131
+@ MSG_EM_TSK3000_NF			"tsk3000"
+@ MSG_EM_RS08_CF 		"EM_RS08"			# 132
+@ MSG_EM_RS08_NF			"rs08"
+@ MSG_EM_SHARC_CF 		"EM_SHARC"			# 133
+@ MSG_EM_SHARC_NF			"sharc"
+@ MSG_EM_ECOG2_CF 		"EM_ECOG2"			# 134
+@ MSG_EM_ECOG2_NF			"ecog2"
+@ MSG_EM_SCORE7_CF 		"EM_SCORE7"			# 135
+@ MSG_EM_SCORE7_NF			"score7"
+@ MSG_EM_DSP24_CF 		"EM_DSP24"			# 136
+@ MSG_EM_DSP24_NF			"dsp24"
+@ MSG_EM_VIDEOCORE3_CF 		"EM_VIDEOCORE3"			# 137
+@ MSG_EM_VIDEOCORE3_NF			"videocore3"
+@ MSG_EM_LATTICEMICO32_CF 	"EM_LATTICEMICO32"		# 138
+@ MSG_EM_LATTICEMICO32_NF		"latticemico32"
+@ MSG_EM_SE_C17_CF 		"EM_SE_C17"			# 139
+@ MSG_EM_SE_C17_NF			"se_c17"
+@ MSG_EM_TI_C6000_CF 		"EM_TI_C6000"			# 140
+@ MSG_EM_TI_C6000_NF			"ti_c6000"
+@ MSG_EM_TI_C2000_CF 		"EM_TI_C2000"			# 141
+@ MSG_EM_TI_C2000_NF			"ti_c2000"
+@ MSG_EM_TI_C5500_CF 		"EM_TI_C5500"			# 142
+@ MSG_EM_TI_C5500_NF			"ti_c5500"
+@ MSG_EM_TI_ARP32_CF 		"EM_TI_ARP32"			# 143
+@ MSG_EM_TI_ARP32_NF			"ti_arp32"
+@ MSG_EM_TI_PRU_CF 		"EM_TI_PRU"			# 144
+@ MSG_EM_TI_PRU_NF			"ti_pru"
+
+@ MSG_EM_MMDSP_PLUS_CF 		"EM_MMDSP_PLUS"			# 160
+@ MSG_EM_MMDSP_PLUS_NF			"mmdsp_plus"
+@ MSG_EM_CYPRESS_M8C_CF 	"EM_CYPRESS_M8C"		# 161
+@ MSG_EM_CYPRESS_M8C_NF			"cypress_m8c"
+@ MSG_EM_R32C_CF 		"EM_R32C"			# 162
+@ MSG_EM_R32C_NF			"r32c"
+@ MSG_EM_TRIMEDIA_CF 		"EM_TRIMEDIA"			# 163
+@ MSG_EM_TRIMEDIA_NF			"trimedia"
+@ MSG_EM_QDSP6_CF 		"EM_QDSP6"			# 164
+@ MSG_EM_QDSP6_NF			"qdsp6"
+@ MSG_EM_8051_CF 		"EM_8051"			# 165
+@ MSG_EM_8051_NF			"8051"
+@ MSG_EM_STXP7X_CF 		"EM_STXP7X"			# 166
+@ MSG_EM_STXP7X_NF			"stxp7x"
+@ MSG_EM_NDS32_CF 		"EM_NDS32"			# 167
+@ MSG_EM_NDS32_NF			"nds32"
+@ MSG_EM_ECOG1_CF 		"EM_ECOG1"			# 168
+@ MSG_EM_ECOG1_NF			"ecog1"
+@ MSG_EM_MAXQ30_CF 		"EM_MAXQ30"			# 169
+@ MSG_EM_MAXQ30_NF			"maxq30"
+@ MSG_EM_XIMO16_CF 		"EM_XIMO16"			# 170
+@ MSG_EM_XIMO16_NF			"ximo16"
+@ MSG_EM_MANIK_CF 		"EM_MANIK"			# 171
+@ MSG_EM_MANIK_NF			"manik"
+@ MSG_EM_CRAYNV2_CF 		"EM_CRAYNV2"			# 172
+@ MSG_EM_CRAYNV2_NF			"craynv2"
+@ MSG_EM_RX_CF 			"EM_RX"				# 173
+@ MSG_EM_RX_NF				"rx"
+@ MSG_EM_METAG_CF 		"EM_METAG"			# 174
+@ MSG_EM_METAG_NF			"metag"
+@ MSG_EM_MCST_ELBRUS_CF 	"EM_MCST_ELBRUS"		# 175
+@ MSG_EM_MCST_ELBRUS_NF			"mcst_elbrus"
+@ MSG_EM_ECOG16_CF 		"EM_ECOG16"			# 176
+@ MSG_EM_ECOG16_NF			"ecog16"
+@ MSG_EM_CR16_CF 		"EM_CR16"			# 177
+@ MSG_EM_CR16_NF			"cr16"
+@ MSG_EM_ETPU_CF 		"EM_ETPU"			# 178
+@ MSG_EM_ETPU_NF			"etpu"
+@ MSG_EM_SLE9X_CF 		"EM_SLE9X"			# 179
+@ MSG_EM_SLE9X_NF			"sle9x"
+@ MSG_EM_L10M_CF 		"EM_L10M"			# 180
+@ MSG_EM_L10M_NF			"l10m"
+@ MSG_EM_K10M_CF 		"EM_K10M"			# 181
+@ MSG_EM_K10M_NF			"k10m"
+@ MSG_EM_AARCH64_CF 		"EM_AARCH64"			# 183
+@ MSG_EM_AARCH64_NF			"aarch64"
+@ MSG_EM_AVR32_CF 		"EM_AVR32"			# 185
+@ MSG_EM_AVR32_NF			"avr32"
+@ MSG_EM_STM8_CF 		"EM_STM8"			# 186
+@ MSG_EM_STM8_NF			"stm8"
+@ MSG_EM_TILE64_CF 		"EM_TILE64"			# 187
+@ MSG_EM_TILE64_NF			"tile64"
+@ MSG_EM_TILEPRO_CF 		"EM_TILEPRO"			# 188
+@ MSG_EM_TILEPRO_NF			"tilepro"
+@ MSG_EM_MICROBLAZE_CF 		"EM_MICROBLAZE"			# 189
+@ MSG_EM_MICROBLAZE_NF			"microblaze"
+@ MSG_EM_CUDA_CF 		"EM_CUDA"			# 190
+@ MSG_EM_CUDA_NF			"cuda"
+@ MSG_EM_TILEGX_CF 		"EM_TILEGX"			# 191
+@ MSG_EM_TILEGX_NF			"tilegx"
+@ MSG_EM_CLOUDSHIELD_CF 	"EM_CLOUDSHIELD"		# 192
+@ MSG_EM_CLOUDSHIELD_NF			"cloudshield"
+@ MSG_EM_COREA_1ST_CF 		"EM_COREA_1ST"			# 193
+@ MSG_EM_COREA_1ST_NF			"corea_1st"
+@ MSG_EM_COREA_2ND_CF 		"EM_COREA_2ND"			# 194
+@ MSG_EM_COREA_2ND_NF			"corea_2nd"
+@ MSG_EM_ARC_COMPACT2_CF 	"EM_ARC_COMPACT2"		# 195
+@ MSG_EM_ARC_COMPACT2_NF		"arc_compact2"
+@ MSG_EM_OPEN8_CF 		"EM_OPEN8"			# 196
+@ MSG_EM_OPEN8_NF			"open8"
+@ MSG_EM_RL78_CF 		"EM_RL78"			# 197
+@ MSG_EM_RL78_NF			"rl78"
+@ MSG_EM_VIDEOCORE5_CF 		"EM_VIDEOCORE5"			# 198
+@ MSG_EM_VIDEOCORE5_NF			"videocore5"
+@ MSG_EM_78KOR_CF 		"EM_78KOR"			# 199
+@ MSG_EM_78KOR_NF			"78kor"
+@ MSG_EM_56800EX_CF 		"EM_56800EX"			# 200
+@ MSG_EM_56800EX_NF			"56800ex"
+@ MSG_EM_BA1_CF 		"EM_BA1"			# 201
+@ MSG_EM_BA1_NF				"ba1"
+@ MSG_EM_BA2_CF 		"EM_BA2"			# 202
+@ MSG_EM_BA2_NF				"ba2"
+@ MSG_EM_XCORE_CF 		"EM_XCORE"			# 203
+@ MSG_EM_XCORE_NF			"xcore"
+@ MSG_EM_MCHP_PIC_CF 		"EM_MCHP_PIC"			# 204
+@ MSG_EM_MCHP_PIC_NF			"mchp_pic"
+@ MSG_EM_INTEL205_CF 		"EM_INTEL205"			# 205
+@ MSG_EM_INTEL205_NF			"intel205"
+@ MSG_EM_INTEL206_CF 		"EM_INTEL206"			# 206
+@ MSG_EM_INTEL206_NF			"intel206"
+@ MSG_EM_INTEL207_CF 		"EM_INTEL207"			# 207
+@ MSG_EM_INTEL207_NF			"intel207"
+@ MSG_EM_INTEL208_CF 		"EM_INTEL208"			# 208
+@ MSG_EM_INTEL208_NF			"intel208"
+@ MSG_EM_INTEL209_CF 		"EM_INTEL209"			# 209
+@ MSG_EM_INTEL209_NF			"intel209"
+@ MSG_EM_KM32_CF 		"EM_KM32"			# 210
+@ MSG_EM_KM32_NF			"km32"
+@ MSG_EM_KMX32_CF 		"EM_KMX32"			# 211
+@ MSG_EM_KMX32_NF			"kmx32"
+@ MSG_EM_KMX16_CF 		"EM_KMX16"			# 212
+@ MSG_EM_KMX16_NF			"kmx16"
+@ MSG_EM_KMX8_CF 		"EM_KMX8"			# 213
+@ MSG_EM_KMX8_NF			"kmx8"
+@ MSG_EM_KVARC_CF 		"EM_KVARC"			# 214
+@ MSG_EM_KVARC_NF			"kvarc"
+@ MSG_EM_CDP_CF 		"EM_CDP"			# 215
+@ MSG_EM_CDP_NF				"cdp"
+@ MSG_EM_COGE_CF 		"EM_COGE"			# 216
+@ MSG_EM_COGE_NF			"coge"
+@ MSG_EM_COOL_CF 		"EM_COOL"			# 217
+@ MSG_EM_COOL_NF			"cool"
+@ MSG_EM_NORC_CF 		"EM_NORC"			# 218
+@ MSG_EM_NORC_NF			"norc"
+@ MSG_EM_CSR_KALIMBA_CF 	"EM_CSR_KALIMBA"		# 219
+@ MSG_EM_CSR_KALIMBA_NF			"csr_kalimba"
+@ MSG_EM_Z80_CF 		"EM_Z80"			# 220
+@ MSG_EM_Z80_NF				"z80"
+@ MSG_EM_VISIUM_CF 		"EM_VISIUM"			# 221
+@ MSG_EM_VISIUM_NF			"visium"
+@ MSG_EM_FT32_CF 		"EM_FT32"			# 222
+@ MSG_EM_FT32_NF			"ft32"
+@ MSG_EM_MOXIE_CF 		"EM_MOXIE"			# 223
+@ MSG_EM_MOXIE_NF			"moxie"
+@ MSG_EM_AMDGPU_CF 		"EM_AMDGPU"			# 224
+@ MSG_EM_AMDGPU_NF			"amdgpu"
+
+@ MSG_EM_RISCV_CF 		"EM_RISCV"			# 243
+@ MSG_EM_RISCV_NF			"riscv"
 
 @ MSG_EI_MAG0_CF		"EI_MAG0"			# 0
 @ MSG_EI_MAG0_NF			"mag0"
@@ -331,6 +542,15 @@
 @ MSG_OSABI_AROS_CF		"ELFOSABI_AROS"			#15
 @ MSG_OSABI_AROS_NF			"aros"
 @ MSG_OSABI_AROS_DMP			"Amiga Research OS"
+@ MSG_OSABI_FENIXOS_CF		"ELFOSABI_FENIXOS"		#16
+@ MSG_OSABI_FENIXOS_NF			"fenixos"
+@ MSG_OSABI_FENIXOS_DMP			"FenixOS"
+@ MSG_OSABI_CLOUDABI_CF		"ELFOSABI_CLOUDABI"		#17
+@ MSG_OSABI_CLOUDABI_NF			"cloudabi"
+@ MSG_OSABI_CLOUDABI_DMP		"CloudABI"
+@ MSG_OSABI_OPENVOS_CF		"ELFOASBI_OPENVOS"		#18
+@ MSG_OSABI_OPENVOS_NF			"openvos"
+@ MSG_OSABI_OPENVOS_DMP			"OpenVOS"
 @ MSG_OSABI_ARM_CF		"ELFOSABI_ARM"			#97
 @ MSG_OSABI_ARM_NF			"arm"
 @ MSG_OSABI_ARM_DMP			"ARM"
diff --git a/usr/src/cmd/sgs/libconv/common/phdr.c b/usr/src/cmd/sgs/libconv/common/phdr.c
index d2b29a201f..382a1bf9f1 100644
--- a/usr/src/cmd/sgs/libconv/common/phdr.c
+++ b/usr/src/cmd/sgs/libconv/common/phdr.c
@@ -25,6 +25,10 @@
  */
 
 /*
+ * Copyright (c) 2015, Joyent, Inc. All rights reserved.
+ */
+
+/*
  * String conversion routines for program header attributes.
  */
 #include	<stdio.h>
@@ -95,6 +99,7 @@ error "PT_NUM has grown. Update phdrs[]"
 		{ PT_GNU_EH_FRAME,	LIN,	MSG_PT_GNU_EH_FRAME },
 		{ PT_GNU_STACK,		LIN,	MSG_PT_GNU_STACK },
 		{ PT_GNU_RELRO,		LIN,	MSG_PT_GNU_RELRO },
+		{ PT_PAX_FLAGS,		LIN,	MSG_PT_PAX_FLAGS },
 
 		{ 0 }
 	};
@@ -109,6 +114,7 @@ error "PT_NUM has grown. Update phdrs[]"
 		{ PT_GNU_EH_FRAME,	LIN,	MSG_PT_GNU_EH_FRAME_CF },
 		{ PT_GNU_STACK,		LIN,	MSG_PT_GNU_STACK_CF },
 		{ PT_GNU_RELRO,		LIN,	MSG_PT_GNU_RELRO_CF },
+		{ PT_PAX_FLAGS,		LIN,	MSG_PT_PAX_FLAGS_CF },
 
 		{ 0 }
 	};
@@ -123,6 +129,7 @@ error "PT_NUM has grown. Update phdrs[]"
 		{ PT_GNU_EH_FRAME,	LIN,	MSG_PT_GNU_EH_FRAME_CFNP },
 		{ PT_GNU_STACK,		LIN,	MSG_PT_GNU_STACK_CFNP },
 		{ PT_GNU_RELRO,		LIN,	MSG_PT_GNU_RELRO_CFNP },
+		{ PT_PAX_FLAGS,		LIN,	MSG_PT_PAX_FLAGS_CFNP },
 
 		{ 0 }
 	};
@@ -137,6 +144,7 @@ error "PT_NUM has grown. Update phdrs[]"
 		{ PT_GNU_EH_FRAME,	LIN,	MSG_PT_GNU_EH_FRAME_NF },
 		{ PT_GNU_STACK,		LIN,	MSG_PT_GNU_STACK_NF },
 		{ PT_GNU_RELRO,		LIN,	MSG_PT_GNU_RELRO_NF },
+		{ PT_PAX_FLAGS,		LIN,	MSG_PT_PAX_FLAGS_NF },
 
 		{ 0 }
 	};
@@ -214,6 +222,18 @@ conv_phdr_flags_strings(Conv_fmt_flags_t fmt_flags)
 		MSG_PF_X_CF_SIZE	+ CONV_EXPN_FIELD_DEF_SEP_SIZE + \
 		MSG_PF_W_CF_SIZE	+ CONV_EXPN_FIELD_DEF_SEP_SIZE + \
 		MSG_PF_R_CF_SIZE	+ CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_PAGEEXEC_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_NOPAGEEXEC_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_SEGMEXEC_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_NOSEGMEXEC_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_MPROTECT_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_NOMPROTECT_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_RANDEXEC_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_NORANDEXEC_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_EMUTRAMP_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_NOEMUTRAMP_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_RANDMMAP_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
+		MSG_PF_NORANDMMAP_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
 		MSG_PF_SUNW_FAILURE_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
 		MSG_PF_SUNW_KILLED_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
 		MSG_PF_SUNW_SIGINFO_CF_SIZE + CONV_EXPN_FIELD_DEF_SEP_SIZE + \
@@ -237,11 +257,24 @@ conv_phdr_flags_strings(Conv_fmt_flags_t fmt_flags)
 
 #define	ALL	ELFOSABI_NONE, EM_NONE
 #define	SOL	ELFOSABI_SOLARIS, EM_NONE
+#define	LIN	ELFOSABI_LINUX, EM_NONE
 
 	static const Val_desc2 vda_cf[] = {
 		{ PF_X,			ALL,	MSG_PF_X_CF },
 		{ PF_W,			ALL,	MSG_PF_W_CF },
 		{ PF_R,			ALL,	MSG_PF_R_CF },
+		{ PF_PAGEEXEC,		LIN,	MSG_PF_PAGEEXEC_CF },
+		{ PF_NOPAGEEXEC,	LIN,	MSG_PF_NOPAGEEXEC_CF },
+		{ PF_SEGMEXEC,		LIN,	MSG_PF_SEGMEXEC_CF },
+		{ PF_NOSEGMEXEC,	LIN,	MSG_PF_NOSEGMEXEC_CF },
+		{ PF_MPROTECT,		LIN,	MSG_PF_MPROTECT_CF },
+		{ PF_NOMPROTECT,	LIN,	MSG_PF_NOMPROTECT_CF },
+		{ PF_RANDEXEC,		LIN,	MSG_PF_RANDEXEC_CF },
+		{ PF_NORANDEXEC,	LIN,	MSG_PF_NORANDEXEC_CF },
+		{ PF_EMUTRAMP,		LIN,	MSG_PF_EMUTRAMP_CF },
+		{ PF_NOEMUTRAMP,	LIN,	MSG_PF_NOEMUTRAMP_CF },
+		{ PF_RANDMMAP,		LIN,	MSG_PF_RANDMMAP_CF },
+		{ PF_NORANDMMAP,	LIN,	MSG_PF_NORANDMMAP_CF },
 		{ PF_SUNW_FAILURE,	SOL,	MSG_PF_SUNW_FAILURE_CF },
 		{ PF_SUNW_KILLED,	SOL,	MSG_PF_SUNW_KILLED_CF },
 		{ PF_SUNW_SIGINFO,	SOL,	MSG_PF_SUNW_SIGINFO_CF },
@@ -251,6 +284,18 @@ conv_phdr_flags_strings(Conv_fmt_flags_t fmt_flags)
 		{ PF_X,			ALL,	MSG_PF_X_NF },
 		{ PF_W,			ALL,	MSG_PF_W_NF },
 		{ PF_R,			ALL,	MSG_PF_R_NF },
+		{ PF_PAGEEXEC,		LIN,	MSG_PF_PAGEEXEC_NF },
+		{ PF_NOPAGEEXEC,	LIN,	MSG_PF_NOPAGEEXEC_NF },
+		{ PF_SEGMEXEC,		LIN,	MSG_PF_SEGMEXEC_NF },
+		{ PF_NOSEGMEXEC,	LIN,	MSG_PF_NOSEGMEXEC_NF },
+		{ PF_MPROTECT,		LIN,	MSG_PF_MPROTECT_NF },
+		{ PF_NOMPROTECT,	LIN,	MSG_PF_NOMPROTECT_NF },
+		{ PF_RANDEXEC,		LIN,	MSG_PF_RANDEXEC_NF },
+		{ PF_NORANDEXEC,	LIN,	MSG_PF_NORANDEXEC_NF },
+		{ PF_EMUTRAMP,		LIN,	MSG_PF_EMUTRAMP_NF },
+		{ PF_NOEMUTRAMP,	LIN,	MSG_PF_NOEMUTRAMP_NF },
+		{ PF_RANDMMAP,		LIN,	MSG_PF_RANDMMAP_NF },
+		{ PF_NORANDMMAP,	LIN,	MSG_PF_NORANDMMAP_NF },
 		{ PF_SUNW_FAILURE,	SOL,	MSG_PF_SUNW_FAILURE_NF },
 		{ PF_SUNW_KILLED,	SOL,	MSG_PF_SUNW_KILLED_NF },
 		{ PF_SUNW_SIGINFO,	SOL,	MSG_PF_SUNW_SIGINFO_NF },
@@ -262,6 +307,7 @@ conv_phdr_flags_strings(Conv_fmt_flags_t fmt_flags)
 
 #undef ALL
 #undef SOL
+#undef LIN
 }
 
 const char *
diff --git a/usr/src/cmd/sgs/libconv/common/phdr.msg b/usr/src/cmd/sgs/libconv/common/phdr.msg
index 789832a16a..e84182277b 100644
--- a/usr/src/cmd/sgs/libconv/common/phdr.msg
+++ b/usr/src/cmd/sgs/libconv/common/phdr.msg
@@ -24,6 +24,8 @@
 # Use is subject to license terms.
 #
 
+# Copyright (c) 2015, Joyent, Inc. All rights reserved.
+
 @ MSG_PT_NULL			"[ PT_NULL ]"			# 0
 @ MSG_PT_NULL_CF			"PT_NULL"
 @ MSG_PT_NULL_CFNP			"NULL"
@@ -79,6 +81,10 @@
 @ MSG_PT_GNU_RELRO_CF			"PT_GNU_RELRO"
 @ MSG_PT_GNU_RELRO_CFNP			"GNU_RELRO"
 @ MSG_PT_GNU_RELRO_NF			"gnu_relro"
+@ MSG_PT_PAX_FLAGS		"[ PT_PAX_FLAGS ]"		# 0x65041580
+@ MSG_PT_PAX_FLAGS_CF			"PT_PAX_FLAGS"
+@ MSG_PT_PAX_FLAGS_CFNP			"PAX_FLAGS"
+@ MSG_PT_PAX_FLAGS_NF			"pax_flags"
 
 @ MSG_PT_SUNWBSS		"[ PT_SUNWBSS ]"		# 0x6ffffffa
 @ MSG_PT_SUNWBSS_CF			"PT_SUNWBSS"
@@ -103,6 +109,30 @@
 @ MSG_PF_W_NF				 "w"
 @ MSG_PF_R_CF			 "PF_R"				# 0x4
 @ MSG_PF_R_NF				 "r"
+@ MSG_PF_PAGEEXEC_CF		 "PF_PAGEEXEC"		# 0x00000010
+@ MSG_PF_PAGEEXEC_NF			 "pageexec"
+@ MSG_PF_NOPAGEEXEC_CF		 "PF_NOPAGEEXEC"	# 0x00000020
+@ MSG_PF_NOPAGEEXEC_NF			 "nopageexec"
+@ MSG_PF_SEGMEXEC_CF		 "PF_SEGMEXEC"		# 0x00000040
+@ MSG_PF_SEGMEXEC_NF			 "segmexec"
+@ MSG_PF_NOSEGMEXEC_CF		 "PF_NOSEGMEXEC"	# 0x00000080
+@ MSG_PF_NOSEGMEXEC_NF			 "nosegmexec"
+@ MSG_PF_MPROTECT_CF		 "PF_MPROTECT"		# 0x00000100
+@ MSG_PF_MPROTECT_NF			 "mprotect"
+@ MSG_PF_NOMPROTECT_CF		 "PF_NOMPROTECT"	# 0x00000200
+@ MSG_PF_NOMPROTECT_NF			 "nomprotect"
+@ MSG_PF_RANDEXEC_CF		 "PF_RANDEXEC"		# 0x00000400
+@ MSG_PF_RANDEXEC_NF			 "randexec"
+@ MSG_PF_NORANDEXEC_CF		 "PF_NORANDEXEC"	# 0x00000800
+@ MSG_PF_NORANDEXEC_NF			 "norandexec"
+@ MSG_PF_EMUTRAMP_CF		 "PF_EMUTRAMP"		# 0x00001000
+@ MSG_PF_EMUTRAMP_NF			 "emutramp"
+@ MSG_PF_NOEMUTRAMP_CF		 "PF_NOEMUTRAMP"	# 0x00002000
+@ MSG_PF_NOEMUTRAMP_NF			 "noemutramp"
+@ MSG_PF_RANDMMAP_CF		 "PF_RANDMMAP"		# 0x00004000
+@ MSG_PF_RANDMMAP_NF			 "randmmap"
+@ MSG_PF_NORANDMMAP_CF		 "PF_NORANDMMAP"	# 0x00008000
+@ MSG_PF_NORANDMMAP_NF			 "norandmmap"
 @ MSG_PF_SUNW_FAILURE_CF	 "PF_SUNW_FAILURE"		# 0x00100000
 @ MSG_PF_SUNW_FAILURE_NF		 "sunw_failure"
 @ MSG_PF_SUNW_KILLED_CF		 "PF_SUNW_KILLED"		# 0x00200000
diff --git a/usr/src/cmd/sgs/librtld_db/common/librtld_db.msg b/usr/src/cmd/sgs/librtld_db/common/librtld_db.msg
index fbc595f5f4..5b0ad9533a 100644
--- a/usr/src/cmd/sgs/librtld_db/common/librtld_db.msg
+++ b/usr/src/cmd/sgs/librtld_db/common/librtld_db.msg
@@ -24,6 +24,10 @@
 # Use is subject to license terms.
 #
 
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
 # Message file for cmd/sgs/librtld_db.
 
 @ MSG_ID_LIBRTLD_DB
@@ -104,7 +108,7 @@
 @ MSG_DB_RDOBJPADE	"rtld_db: rd_objpad_enable(padsize=0x%llx)"
 @ MSG_DB_64BIT_PREFIX	"64/"
 @ MSG_DB_BRAND_HELPERPATH_PREFIX "%s/%s/%s/%s%s_librtld_db.so.1"
-@ MSG_DB_BRAND_HELPERPATH "%s/%s/%s%s_librtld_db.so.1"
+@ MSG_DB_BRAND_HELPERPATH "%s/%s/%s/%s%s_librtld_db.so.1"
 @ MSG_DB_HELPERNOOPS	"rtld_db: helper lib loaded but ops not preset"
 @ MSG_DB_HELPERLOADED	"rtld_db: helper library loaded for brand \"%s\""
 @ MSG_DB_HELPERLOADFAILED "rtld_db: couldn't load brand helper library %s"
diff --git a/usr/src/cmd/sgs/librtld_db/common/rd_elf.c b/usr/src/cmd/sgs/librtld_db/common/rd_elf.c
index 410b819b30..b3de685b81 100644
--- a/usr/src/cmd/sgs/librtld_db/common/rd_elf.c
+++ b/usr/src/cmd/sgs/librtld_db/common/rd_elf.c
@@ -23,6 +23,10 @@
  * Use is subject to license terms.
  */
 
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
 #include	<stdlib.h>
 #include	<stdio.h>
 #include	<proc_service.h>
@@ -38,6 +42,14 @@
 #include	<sys/param.h>
 
 /*
+ * We want to include zone.h to pull in the prototype for zone_get_nroot(),
+ * but we need to avoid pulling in <sys/stream.h>, which has a definition
+ * of M_DATA that conflicts with the ELF-related definition in machdep_*.h.
+ */
+#define		_SYS_STREAM_H
+#include	<zone.h>
+
+/*
  * 64-bit builds are going to compile this module twice, the
  * second time with _ELF64 defined.  These defines should make
  * all the necessary adjustments to the code.
@@ -283,7 +295,9 @@ _rd_reset32(struct rd_agent *rap)
 	 * If we are debugging a branded executable, load the appropriate
 	 * helper library, and call its initialization routine.  Being unable
 	 * to load the helper library is not a critical error.  (Hopefully
-	 * we'll still be able to access some objects in the target.)
+	 * we'll still be able to access some objects in the target.)  Note
+	 * that we pull in the native root here to allow for helper libraries
+	 * to be properly found from within the branded zone.
 	 */
 	ps_pbrandname = (ps_pbrandname_fp_t)dlsym(RTLD_PROBE, "ps_pbrandname");
 	while ((ps_pbrandname != NULL) &&
@@ -294,17 +308,23 @@ _rd_reset32(struct rd_agent *rap)
 		isa = MSG_ORIG(MSG_DB_64BIT_PREFIX);
 #endif /* _LP64 */
 
-		if (rtld_db_helper_path[0] != '\0')
+		if (rtld_db_helper_path[0] != '\0') {
 			(void) snprintf(brandlib, MAXPATHLEN,
 			    MSG_ORIG(MSG_DB_BRAND_HELPERPATH_PREFIX),
 			    rtld_db_helper_path,
 			    MSG_ORIG(MSG_DB_HELPER_PREFIX), brandname, isa,
 			    brandname);
-		else
+		} else {
+			const char *nroot = zone_get_nroot();
+
+			if (nroot == NULL)
+				nroot = "";
+
 			(void) snprintf(brandlib, MAXPATHLEN,
-			    MSG_ORIG(MSG_DB_BRAND_HELPERPATH),
+			    MSG_ORIG(MSG_DB_BRAND_HELPERPATH), nroot,
 			    MSG_ORIG(MSG_DB_HELPER_PREFIX), brandname, isa,
 			    brandname);
+		}
 
 		rap->rd_helper.rh_dlhandle = dlopen(brandlib,
 		    RTLD_LAZY | RTLD_LOCAL);
diff --git a/usr/src/cmd/sgs/rtld/common/_rtld.h b/usr/src/cmd/sgs/rtld/common/_rtld.h
index ece14a855e..83b7071471 100644
--- a/usr/src/cmd/sgs/rtld/common/_rtld.h
+++ b/usr/src/cmd/sgs/rtld/common/_rtld.h
@@ -26,7 +26,7 @@
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 /*
- * Copyright (c) 2012, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 #ifndef	__RTLD_H
 #define	__RTLD_H
@@ -589,6 +589,8 @@ extern const char	*rpl_ldflags;	/* replaceable LD_FLAGS string */
 extern const char	*rpl_libpath;	/* replaceable LD_LIBRARY string */
 extern Alist		*rpl_libdirs;	/*	and its associated Pdesc list */
 extern const char	*rpl_preload;	/* replaceable LD_PRELOAD string */
+extern const char	*rpl_ldtoxic;	/* replaceable LD_TOXIC_PATH string */
+extern Alist		*rpl_toxdirs;	/*    and associated Pdesc list */
 
 extern const char	*prm_audit;	/* permanent LD_AUDIT string */
 extern const char	*prm_debug;	/* permanent LD_DEBUG string */
diff --git a/usr/src/cmd/sgs/rtld/common/analyze.c b/usr/src/cmd/sgs/rtld/common/analyze.c
index e14c121f07..3cae1036ae 100644
--- a/usr/src/cmd/sgs/rtld/common/analyze.c
+++ b/usr/src/cmd/sgs/rtld/common/analyze.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*
@@ -834,6 +835,57 @@ is_so_loaded(Lm_list *lml, const char *name, int *in_nfavl)
 }
 
 /*
+ * Walk the toxic path list and determine if the object in question has violated
+ * the toxic path. When evaluating the toxic path we need to ensure that we
+ * match any path that's a subdirectory of a listed entry. In other words if
+ * /foo/bar is toxic, something in /foo/bar/baz/ is no good. However, we need to
+ * ensure that we don't mark /foo/barbaz/ as bad.
+ */
+static int
+is_load_toxic(Lm_list *lml, Rt_map *nlmp)
+{
+	const char	*fpath;
+	size_t		flen;
+	Pdesc 		*pdp;
+	Aliste 		idx;
+
+	fpath = PATHNAME(nlmp);
+
+	/*
+	 * If we have a NULL path name, that indicates that rtld is processing
+	 * an in-memory shared object. For example, trying to run ldd or doing
+	 * an LD_PRELOAD on an object file. In those cases, we'll always allow
+	 * it.
+	 */
+	if (fpath == NULL)
+		return (0);
+
+	flen = strlen(fpath);
+
+	for (ALIST_TRAVERSE(rpl_toxdirs, idx, pdp)) {
+		if (pdp->pd_plen == 0)
+			continue;
+
+		if (strncmp(pdp->pd_pname, fpath, pdp->pd_plen) == 0) {
+			if (pdp->pd_pname[pdp->pd_plen-1] != '/') {
+				/*
+				 * Path didn't end in a /, make sure
+				 * we're at a directory boundary
+				 * nonetheless.
+				 */
+				if (flen > pdp->pd_plen &&
+				    fpath[pdp->pd_plen] == '/')
+					return (1);
+				continue;
+			}
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+/*
  * Tracing is enabled by the LD_TRACE_LOADED_OPTIONS environment variable which
  * is normally set from ldd(1).  For each link map we load, print the load name
  * and the full pathname of the associated object.
@@ -2169,6 +2221,17 @@ load_finish(Lm_list *lml, const char *name, Rt_map *clmp, int nmode,
 	uint_t		rdflags;
 
 	/*
+	 * If this dependency is associated with a toxic path, then we must
+	 * honor the user's request to die.
+	 */
+	if (is_load_toxic(lml, nlmp) != 0) {
+		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_TOXIC_FILE),
+		    PATHNAME(nlmp));
+		rtldexit(lml, 1);
+
+	}
+
+	/*
 	 * If this dependency is associated with a required version ensure that
 	 * the version is present in the loaded file.
 	 */
diff --git a/usr/src/cmd/sgs/rtld/common/external.c b/usr/src/cmd/sgs/rtld/common/external.c
index cd7365c524..c0bde0fd57 100644
--- a/usr/src/cmd/sgs/rtld/common/external.c
+++ b/usr/src/cmd/sgs/rtld/common/external.c
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
- * Copyright 2016 Joyent, Inc.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 /*
@@ -723,9 +723,9 @@ isalnum(int c)
 
 #if defined(__i386) || defined(__amd64)
 /*
- * Instead of utilizing the comm page for clock_gettime, rtld uses the raw
- * syscall instead.  Doing so decreases the surface of symbols needed from libc
- * for a modest performance cost.
+ * Instead of utilizing the comm page for clock_gettime and gettimeofday, rtld
+ * uses the raw syscall instead.  Doing so decreases the surface of symbols
+ * needed from libc for a modest performance cost.
  */
 extern int __clock_gettime_sys(clockid_t, struct timespec *);
 
@@ -734,6 +734,22 @@ __clock_gettime(clockid_t clock_id, struct timespec *tp)
 {
 	return (__clock_gettime_sys(clock_id, tp));
 }
+
+int
+gettimeofday(struct timeval *tv, void *tz)
+{
+	if (tv != NULL) {
+		/*
+		 * Perform the same logic as the libc gettimeofday() when it
+		 * lacks comm page support: Make the clock_gettime syscall and
+		 * divide out the tv_usec field as required.
+		 */
+		__clock_gettime_sys(CLOCK_REALTIME, (timespec_t *)tv);
+		tv->tv_usec /= 1000;
+	}
+
+	return (0);
+}
 #endif /* defined(__i386) || defined(__amd64) */
 
 /*
diff --git a/usr/src/cmd/sgs/rtld/common/globals.c b/usr/src/cmd/sgs/rtld/common/globals.c
index 5f48fafc5f..2e98768551 100644
--- a/usr/src/cmd/sgs/rtld/common/globals.c
+++ b/usr/src/cmd/sgs/rtld/common/globals.c
@@ -24,6 +24,7 @@
  *	  All Rights Reserved
  *
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
 #include	<sys/types.h>
@@ -132,6 +133,8 @@ const char	*rpl_ldflags = NULL;	/* replaceable LD_FLAGS string */
 const char	*rpl_libpath = NULL;	/* replaceable LD_LIBRARY_PATH string */
 Alist		*rpl_libdirs = NULL;	/*    and associated Pdesc list */
 const char	*rpl_preload = NULL;	/* replaceable LD_PRELOAD string */
+const char	*rpl_ldtoxic = NULL;	/* replaceable LD_TOXIC string */
+Alist		*rpl_toxdirs = NULL;	/*    and associated Pdesc list */
 
 const char	*prm_audit = NULL;	/* permanent LD_AUDIT string */
 const char	*prm_debug = NULL;	/* permanent LD_DEBUG string */
diff --git a/usr/src/cmd/sgs/rtld/common/rtld.msg b/usr/src/cmd/sgs/rtld/common/rtld.msg
index 97e2841b8f..9309d0c62e 100644
--- a/usr/src/cmd/sgs/rtld/common/rtld.msg
+++ b/usr/src/cmd/sgs/rtld/common/rtld.msg
@@ -21,6 +21,7 @@
 
 #
 # Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2014, Joyent, Inc.  All rights reserved.
 #
 
 @ _START_
@@ -99,9 +100,14 @@
 @ MSG_SYS_MPROT		"%s: mprotect failed: %s"
 @ MSG_SYS_MMAPANON	"mmap anon failed: %s"
 
+# Secure path failures
+
 @ MSG_SEC_OPEN		"%s: open failed: No such file in secure directories"
 @ MSG_SEC_ILLEGAL	"%s: open failed: illegal insecure pathname"
 
+# Toxic failures
+
+@ MSG_TOXIC_FILE	"%s: dependency marked as toxic"
 
 # Configuration failures
 
@@ -395,6 +401,7 @@
 @ MSG_LD_PROFILE_OUTPUT	"PROFILE_OUTPUT"
 @ MSG_LD_SFCAP		"SFCAP"
 @ MSG_LD_SIGNAL		"SIGNAL"
+@ MSG_LD_TOXICPATH	"TOXIC_PATH"
 @ MSG_LD_TRACE_OBJS	"TRACE_LOADED_OBJECTS"
 @ MSG_LD_TRACE_OBJS_E	"TRACE_LOADED_OBJECTS_E"
 @ MSG_LD_TRACE_OBJS_A	"TRACE_LOADED_OBJECTS_A"
diff --git a/usr/src/cmd/sgs/rtld/common/setup.c b/usr/src/cmd/sgs/rtld/common/setup.c
index 862bb7d61f..98e3ba5d33 100644
--- a/usr/src/cmd/sgs/rtld/common/setup.c
+++ b/usr/src/cmd/sgs/rtld/common/setup.c
@@ -28,7 +28,7 @@
  *	  All Rights Reserved
  */
 /*
- * Copyright (c) 2012, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -819,6 +819,14 @@ setup(char **envp, auxv_t *auxv, Word _flags, char *_platform, int _syspagsz,
 			return (0);
 	}
 
+	/*
+	 * Initialize our toxic paths
+	 */
+	if (rpl_ldtoxic != NULL) {
+		(void) expand_paths(mlmp, rpl_ldtoxic, &rpl_toxdirs,
+		    AL_CNT_SEARCH, 0, PD_TKN_CAP);
+	}
+
 #if	defined(_ELF64)
 	/*
 	 * If this is a 64-bit process, determine whether this process has
diff --git a/usr/src/cmd/sgs/rtld/common/util.c b/usr/src/cmd/sgs/rtld/common/util.c
index 046c8297a0..f10f7a4aed 100644
--- a/usr/src/cmd/sgs/rtld/common/util.c
+++ b/usr/src/cmd/sgs/rtld/common/util.c
@@ -24,6 +24,7 @@
  *	  All Rights Reserved
  *
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -1428,6 +1429,7 @@ static	u_longlong_t		cmdisa = 0;	/* command line (-e) ISA */
 #define	ENV_FLG_CAP_FILES	0x0080000000000ULL
 #define	ENV_FLG_DEFERRED	0x0100000000000ULL
 #define	ENV_FLG_NOENVIRON	0x0200000000000ULL
+#define	ENV_FLG_TOXICPATH	0x0400000000000ULL
 
 #define	SEL_REPLACE		0x0001
 #define	SEL_PERMANT		0x0002
@@ -1601,8 +1603,7 @@ ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
 		if ((len == MSG_LD_FLAGS_SIZE) && (strncmp(s1,
 		    MSG_ORIG(MSG_LD_FLAGS), MSG_LD_FLAGS_SIZE) == 0)) {
 			select |= SEL_ACT_SPEC_1;
-			str = (select & SEL_REPLACE) ? &rpl_ldflags :
-			    &prm_ldflags;
+			str = &rpl_ldflags;
 			variable = ENV_FLG_FLAGS;
 		}
 	}
@@ -1813,6 +1814,8 @@ ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
 	 * In case an auditor is called, which in turn might exec(2) a
 	 * subprocess, this variable is disabled, so that any subprocess
 	 * escapes ldd(1) processing.
+	 *
+	 * Also, look for LD_TOXIC_PATH
 	 */
 	else if (*s1 == 'T') {
 		if (((len == MSG_LD_TRACE_OBJS_SIZE) &&
@@ -1850,7 +1853,13 @@ ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
 			select |= SEL_ACT_LML;
 			val = LML_FLG_TRC_SEARCH;
 			variable = ENV_FLG_TRACE_PTHS;
+		} else if ((len == MSG_LD_TOXICPATH_SIZE) && (strncmp(s1,
+		    MSG_ORIG(MSG_LD_TOXICPATH), MSG_LD_TOXICPATH_SIZE) == 0)) {
+			select |= SEL_ACT_SPEC_1;
+			str = &rpl_ldtoxic;
+			variable = ENV_FLG_TOXICPATH;
 		}
+
 	}
 	/*
 	 * LD_UNREF and LD_UNUSED (internal, used by ldd(1)).
@@ -1974,7 +1983,8 @@ ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
 			*lmtflags &= ~val;
 	} else if (select & SEL_ACT_SPEC_1) {
 		/*
-		 * variable is either ENV_FLG_FLAGS or ENV_FLG_LIBPATH
+		 * variable is either ENV_FLG_FLAGS, ENV_FLG_LIBPATH, or
+		 * ENV_FLG_TOXICPATH
 		 */
 		if (env_flags & ENV_TYP_NULL)
 			*str = NULL;
diff --git a/usr/src/cmd/sgs/yacc/Makefile.targ b/usr/src/cmd/sgs/yacc/Makefile.targ
index 9cbf1c440f..59a89218d7 100644
--- a/usr/src/cmd/sgs/yacc/Makefile.targ
+++ b/usr/src/cmd/sgs/yacc/Makefile.targ
@@ -90,4 +90,3 @@ $(LINTLIB): $$(SRCS)
 
 lintcheck: $$(SRCS)
 	$(LINT.c) $(LINTCHECKFLAGS) $(SRCS) $(LDLIBS)
-
diff --git a/usr/src/cmd/sgs/yacc/common/dextern.h b/usr/src/cmd/sgs/yacc/common/dextern.h
index e90aa60468..54b441cac4 100644
--- a/usr/src/cmd/sgs/yacc/common/dextern.h
+++ b/usr/src/cmd/sgs/yacc/common/dextern.h
@@ -26,11 +26,13 @@
 /* Copyright (c) 1988 AT&T */
 /* All Rights Reserved */
 
+/*
+ * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ */
+
 #ifndef _DEXTERN_H
 #define	_DEXTERN_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdio.h>
 #include <inttypes.h>
 #include <ctype.h>
@@ -42,6 +44,7 @@
 #include <unistd.h>
 #include <stdlib.h>
 #include <wctype.h>
+#include <limits.h>
 
 #ifdef	__cplusplus
 extern "C" {
@@ -301,6 +304,12 @@ extern int wscmp(const wchar_t *, const wchar_t *);
 
 extern char *parser;
 
+#ifndef	PBUFSIZE
+#define	PBUFSIZE PATH_MAX
+#endif
+
+extern char pbuf[PBUFSIZE];
+
 	/* default settings for a number of macros */
 
 	/* name of yacc tempfiles */
@@ -324,7 +333,11 @@ extern char *parser;
 #endif
 
 #ifndef PARSER
-#define	PARSER "/usr/share/lib/ccs/yaccpar"
+#define	PARSER "/share/lib/ccs/yaccpar"
+#endif
+
+#ifndef	PARSERPREFIX
+#define	PARSERPREFIX "/usr"
 #endif
 
 /*
diff --git a/usr/src/cmd/sgs/yacc/common/y1.c b/usr/src/cmd/sgs/yacc/common/y1.c
index 845f82d367..0e67d9047b 100644
--- a/usr/src/cmd/sgs/yacc/common/y1.c
+++ b/usr/src/cmd/sgs/yacc/common/y1.c
@@ -26,7 +26,9 @@
 /* Copyright (c) 1988 AT&T */
 /* All Rights Reserved */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ */
 
 #include "dextern.h"
 #include <sys/param.h>
@@ -34,6 +36,7 @@
 #include <unistd.h>
 #include <locale.h>
 #include <stdarg.h>	/* For error() */
+#include <libgen.h>
 
 static void mktbls(void);
 static void others(void);
@@ -236,6 +239,25 @@ mktbls()
 	lsetsize = INIT_LSIZE + 1;
 }
 
+static int
+yacc_assemble_path(char *buf, size_t size, const char *file, int type)
+{
+	int ret;
+	char origin[PATH_MAX];
+
+	if (type != 0) {
+		ret = readlink("/proc/self/path/a.out", origin, PATH_MAX - 1);
+		if (ret < 0)
+			error(gettext(
+			    "yacc: failed to read origin from /proc\n"));
+		origin[ret] = '\0';
+		return (snprintf(buf, size, "%s/../%s", dirname(origin),
+		    file));
+	}
+
+	return (snprintf(buf, size, "%s/%s", PARSERPREFIX, file));
+}
+
 /* put out other arrays, copy the parsers */
 static void
 others()
@@ -244,7 +266,17 @@ others()
 	int c, i, j;
 	int tmpline;
 
-	finput = fopen(parser, "r");
+	if (parser == NULL) {
+		parser = pbuf;
+		(void) yacc_assemble_path(pbuf, PBUFSIZE, PARSER, 1);
+		finput = fopen(parser, "r");
+		if (finput == NULL) {
+			(void) yacc_assemble_path(pbuf, PBUFSIZE, PARSER, 0);
+			finput = fopen(parser, "r");
+		}
+	} else {
+		finput = fopen(parser, "r");
+	}
 	if (finput == NULL)
 /*
  * TRANSLATION_NOTE  -- This is a message from yacc.
diff --git a/usr/src/cmd/sgs/yacc/common/y2.c b/usr/src/cmd/sgs/yacc/common/y2.c
index fbdaf19445..0d97f4260f 100644
--- a/usr/src/cmd/sgs/yacc/common/y2.c
+++ b/usr/src/cmd/sgs/yacc/common/y2.c
@@ -26,6 +26,10 @@
 /* Copyright (c) 1988 AT&T */
 /* All Rights Reserved */
 
+/*
+ * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ */
+
 #include "dextern.h"
 #include "sgs.h"
 #include <stdio.h>
@@ -58,7 +62,8 @@ char *infile;				/* input file name 		*/
 static int numbval;			/* value of an input number 	*/
 static int toksize = NAMESIZE;
 static wchar_t *tokname;	/* input token name		*/
-char *parser = PARSER;		/* location of common parser 	*/
+char *parser = NULL;		/* location of common parser 	*/
+char pbuf[PBUFSIZE];
 
 static void finact(void);
 static wchar_t *cstash(wchar_t *);
diff --git a/usr/src/cmd/smbios/Makefile b/usr/src/cmd/smbios/Makefile
index f3d7803a78..eec224f524 100644
--- a/usr/src/cmd/smbios/Makefile
+++ b/usr/src/cmd/smbios/Makefile
@@ -22,6 +22,8 @@
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright 2018 Joyent, Inc.
+#
 
 PROG = smbios
 OBJS = smbios.o
@@ -35,6 +37,8 @@ LDLIBS += -lsmbios
 FILEMODE = 0555
 STRIPFLAG =
 
+LINTFLAGS += -erroff=E_BAD_PTR_CAST_ALIGN
+
 .KEEP_STATE:
 
 all: $(PROG)
diff --git a/usr/src/cmd/smbios/smbios.c b/usr/src/cmd/smbios/smbios.c
index a40e393a91..658d512b55 100644
--- a/usr/src/cmd/smbios/smbios.c
+++ b/usr/src/cmd/smbios/smbios.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright 2015 OmniTI Computer Consulting, Inc.  All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
@@ -334,10 +334,30 @@ print_system(smbios_hdl_t *shp, FILE *fp)
 
 	(void) smbios_info_system(shp, &s);
 
+	/*
+	 * SMBIOS definition section 3.3.2.1 is clear that the first three
+	 * fields are little-endian, but this utility traditionally got this
+	 * wrong, and followed RFC 4122.  We keep this old behavior, but also
+	 * provide a corrected UUID.
+	 */
 	oprintf(fp, "  UUID: ");
-	for (i = 0; i < s.smbs_uuidlen; i++) {
+	oprintf(fp, "%02x%02x%02x%02x-%02x%02x-%02x%02x-",
+	    s.smbs_uuid[0], s.smbs_uuid[1], s.smbs_uuid[2], s.smbs_uuid[3],
+	    s.smbs_uuid[4], s.smbs_uuid[5], s.smbs_uuid[6], s.smbs_uuid[7]);
+	for (i = 8; i < s.smbs_uuidlen; i++) {
+		oprintf(fp, "%02x", s.smbs_uuid[i]);
+		if (i == 9)
+			oprintf(fp, "-");
+	}
+	oprintf(fp, "\n");
+
+	oprintf(fp, "  UUID (Endian-corrected): ");
+	oprintf(fp, "%08x-%04hx-%04hx-", *((uint_t *)&s.smbs_uuid[0]),
+	    *((ushort_t *)&s.smbs_uuid[4]),
+	    *((ushort_t *)&s.smbs_uuid[6]));
+	for (i = 8; i < s.smbs_uuidlen; i++) {
 		oprintf(fp, "%02x", s.smbs_uuid[i]);
-		if (i == 3 || i == 5 || i == 7 || i == 9)
+		if (i == 9)
 			oprintf(fp, "-");
 	}
 	oprintf(fp, "\n");
diff --git a/usr/src/cmd/ssh/THIRDPARTYLICENSE.descrip b/usr/src/cmd/ssh/THIRDPARTYLICENSE.descrip
deleted file mode 100644
index 7e936fffc7..0000000000
--- a/usr/src/cmd/ssh/THIRDPARTYLICENSE.descrip
+++ /dev/null
@@ -1 +0,0 @@
-OPENSSH SOFTWARE
diff --git a/usr/src/cmd/ssh/doc/LICENCE b/usr/src/cmd/ssh/doc/LICENCE
deleted file mode 100644
index 04d6fe18e3..0000000000
--- a/usr/src/cmd/ssh/doc/LICENCE
+++ /dev/null
@@ -1,194 +0,0 @@
-This file is part of the ssh software.
-
-The licences which components of this software falls under are as
-follows.  First, we will summarize and say that that all components
-are under a BSD licence, or a licence more free than that.
-
-OpenSSH contains no GPL code.
-
-1)
-     * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-     *                    All rights reserved
-     *
-     * As far as I am concerned, the code I have written for this software
-     * can be used freely for any purpose.  Any derived versions of this
-     * software must be clearly marked as such, and if the derived work is
-     * incompatible with the protocol description in the RFC file, it must be
-     * called by a name other than "ssh" or "Secure Shell".
-
-    [Tatu continues]
-     *  However, I am not implying to give any licenses to any patents or
-     * copyrights held by third parties, and the software includes parts that
-     * are not under my direct control.  As far as I know, all included
-     * source code is used in accordance with the relevant license agreements
-     * and can be used freely for any purpose (the GNU license being the most
-     * restrictive); see below for details.
-
-    [However, none of that term is relevant at this point in time.  All of
-    these restrictively licenced software components which he talks about
-    have been removed from OpenSSH, ie.
-
-     - RSA is no longer included, found in the OpenSSL library
-     - IDEA is no longer included, it's use is depricated
-     - DES is now external, in the OpenSSL library
-     - GMP is no longer used, and instead we call BN code from OpenSSL
-     - Zlib is now external, in a library
-     - The make-ssh-known-hosts script is no longer included
-     - TSS has been removed
-     - MD5 is now external, in the OpenSSL library
-     - RC4 support has been replaced with ARC4 support from OpenSSL
-     - Blowfish is now external, in the OpenSSL library
-
-    [The licence continues]
-
-    Note that any information and cryptographic algorithms used in this
-    software are publicly available on the Internet and at any major
-    bookstore, scientific library, and patent office worldwide.  More
-    information can be found e.g. at "http://www.cs.hut.fi/crypto".
-    
-    The legal status of this program is some combination of all these
-    permissions and restrictions.  Use only at your own responsibility.
-    You will be responsible for any legal consequences yourself; I am not
-    making any claims whether possessing or using this is legal or not in
-    your country, and I am not taking any responsibility on your behalf.
-    
-    
-    			    NO WARRANTY
-    
-    BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-    FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-    OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-    PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-    OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-    TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-    PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-    REPAIR OR CORRECTION.
-    
-    IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-    WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-    REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-    INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-    OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-    TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-    YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-    PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-    POSSIBILITY OF SUCH DAMAGES.
-
-2)
-    The 32-bit CRC implementation in crc32.c is due to Gary S. Brown.
-    Comments in the file indicate it may be used for any purpose without
-    restrictions:
-
-     * COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or
-     * code or tables extracted from it, as desired without restriction.
-
-3)
-    The 32-bit CRC compensation attack detector in deattack.c was
-    contributed by CORE SDI S.A. under a BSD-style license. See
-    http://www.core-sdi.com/english/ssh/ for details.
-
-     * Cryptographic attack detector for ssh - source code
-     *
-     * Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
-     *
-     * All rights reserved. Redistribution and use in source and binary
-     * forms, with or without modification, are permitted provided that
-     * this copyright notice is retained.
-     *
-     * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
-     * WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE
-     * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
-     * CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS
-     * SOFTWARE.
-     *
-     * Ariel Futoransky <futo@core-sdi.com>
-     * <http://www.core-sdi.com>
-    
-3a)
-    Various parts are from the University of California.
-
-     * Copyright (c) 1983, 1987, 1989-1995
-     *	The Regents of the University of California.  All rights reserved.
-     *
-     * Redistribution and use in source and binary forms, with or without
-     * modification, are permitted provided that the following conditions
-     * are met:
-     * 1. Redistributions of source code must retain the above copyright
-     *    notice, this list of conditions and the following disclaimer.
-     * 2. Redistributions in binary form must reproduce the above copyright
-     *    notice, this list of conditions and the following disclaimer in the
-     *    documentation and/or other materials provided with the distribution.
-     * 3. All advertising materials mentioning features or use of this software
-     *    must display the following acknowledgement:
-     *	This product includes software developed by the University of
-     *	California, Berkeley and its contributors.
-     * 4. Neither the name of the University nor the names of its contributors
-     *    may be used to endorse or promote products derived from this software
-     *    without specific prior written permission.
-     *
-     * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-     * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-     * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-     * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-     * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-     * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-     * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-     * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-     * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-     * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-     * SUCH DAMAGE.
-    
-     * Copyright (c) 1989, 1991, 1993, 1994
-     *	The Regents of the University of California.  All rights reserved.
-     *
-     * Redistribution and use in source and binary forms, with or without
-     * modification, are permitted provided that the following conditions
-     * are met:
-     * 1. Redistributions of source code must retain the above copyright
-     *    notice, this list of conditions and the following disclaimer.
-     * 2. Redistributions in binary form must reproduce the above copyright
-     *    notice, this list of conditions and the following disclaimer in the
-     *    documentation and/or other materials provided with the distribution.
-     *
-     * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-     * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-     * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-     * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-     * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-     * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-     * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-     * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-     * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-     * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-     * SUCH DAMAGE.
-
-4)
-    Remaining components of the software are provided under a standard
-    2-term BSD licence with the following names as copyright holders:
-
-	Markus Friedl
-	Theo de Raadt
-	Niels Provos
-	Dug Song
-	Aaron Campbell
-
-     * Redistribution and use in source and binary forms, with or without
-     * modification, are permitted provided that the following conditions
-     * are met:
-     * 1. Redistributions of source code must retain the above copyright
-     *    notice, this list of conditions and the following disclaimer.
-     * 2. Redistributions in binary form must reproduce the above copyright
-     *    notice, this list of conditions and the following disclaimer in the
-     *    documentation and/or other materials provided with the distribution.
-     *
-     * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-     * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-     * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-     * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-     * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-     * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-     * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-     * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-     * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-     * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/usr/src/cmd/ssh/etc/ssh.xml b/usr/src/cmd/ssh/etc/ssh.xml
deleted file mode 100644
index f5fb471669..0000000000
--- a/usr/src/cmd/ssh/etc/ssh.xml
+++ /dev/null
@@ -1,177 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
-<!--
-	CDDL HEADER START
-
-	The contents of this file are subject to the terms of the
-	Common Development and Distribution License (the "License").
-	You may not use this file except in compliance with the License.
-
-	You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
-	or http://www.opensolaris.org/os/licensing.
-	See the License for the specific language governing permissions
-	and limitations under the License.
-
-	When distributing Covered Code, include this CDDL HEADER in each
-	file and include the License file at usr/src/OPENSOLARIS.LICENSE.
-	If applicable, add the following below this CDDL HEADER, with the
-	fields enclosed by brackets "[]" replaced with your own identifying
-	information: Portions Copyright [yyyy] [name of copyright owner]
-
-	CDDL HEADER END
-
-	Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
-	Use is subject to license terms.
-
-	Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
-
-	NOTE:  This service manifest is not editable; its contents will
-	be overwritten by package or patch operations, including
-	operating system upgrade.  Make customizations in a different
-	file.
--->
-
-<service_bundle type='manifest' name='SUNWsshdr:ssh'>
-
-<service
-	name='network/ssh'
-	type='service'
-	version='1'>
-
-	<create_default_instance enabled='false' />
-
-	<single_instance />
-
-	<dependency name='fs-local'
-		grouping='require_all'
-		restart_on='none'
-		type='service'>
-		<service_fmri
-			value='svc:/system/filesystem/local' />
-	</dependency>
-
-	<dependency name='fs-autofs'
-		grouping='optional_all'
-		restart_on='none'
-		type='service'>
-		<service_fmri value='svc:/system/filesystem/autofs' />
-	</dependency>
-
-	<dependency name='net-loopback'
-		grouping='require_all'
-		restart_on='none'
-		type='service'>
-		<service_fmri value='svc:/network/loopback' />
-	</dependency>
-
-	<dependency name='net-physical'
-		grouping='require_all'
-		restart_on='none'
-		type='service'>
-		<service_fmri value='svc:/network/physical' />
-	</dependency>
-
-	<dependency name='cryptosvc'
-		grouping='require_all'
-		restart_on='none'
-		type='service'>
-		<service_fmri value='svc:/system/cryptosvc' />
-	</dependency>
-
-	<dependency name='utmp'
-		grouping='require_all'
-		restart_on='none'
-		type='service'>
-		<service_fmri value='svc:/system/utmp' />
-	</dependency>
-
-	<dependency name='network_ipfilter'
-		grouping='optional_all'
-		restart_on='error'
-		type='service'>
-		<service_fmri value='svc:/network/ipfilter:default' />
-	</dependency>
-
-	<dependency name='config_data'
-		grouping='require_all'
-		restart_on='restart'
-		type='path'>
-		<service_fmri
-		    value='file://localhost/etc/ssh/sshd_config' />
-	</dependency>
-
-	<dependent
-		name='ssh_multi-user-server'
-		grouping='optional_all'
-		restart_on='none'>
-			<service_fmri
-			    value='svc:/milestone/multi-user-server' />
-	</dependent>
-
-	<exec_method
-		type='method'
-		name='start'
-		exec='/lib/svc/method/sshd start'
-		timeout_seconds='60'/>
-
-	<exec_method
-		type='method'
-		name='stop'
-		exec=':kill'
-		timeout_seconds='60' />
-
-	<exec_method
-		type='method'
-		name='refresh'
-		exec='/lib/svc/method/sshd restart'
-		timeout_seconds='60' />
-
-	<property_group name='startd'
-		type='framework'>
-		<!-- sub-process core dumps shouldn't restart session -->
-		<propval name='ignore_error'
-		    type='astring' value='core,signal' />
-	</property_group>
-
-        <property_group name='general' type='framework'>
-                <!-- to start stop sshd -->
-                <propval name='action_authorization' type='astring'
-                        value='solaris.smf.manage.ssh' />
-        </property_group>
-
-	<property_group name='firewall_context' type='com.sun,fw_definition'>
-		<propval name='name' type='astring' value='ssh' />
-		<propval name='ipf_method' type='astring'
-		    value='/lib/svc/method/sshd ipfilter' />
-	</property_group>
-
-	<property_group name='firewall_config' type='com.sun,fw_configuration'>
-		<propval name='policy' type='astring' value='use_global' />
-		<propval name='block_policy' type='astring'
-			value='use_global' />
-		<propval name='apply_to' type='astring' value='' />
-		<propval name='apply_to_6' type='astring' value='' />
-		<propval name='exceptions' type='astring' value='' />
-		<propval name='exceptions_6' type='astring' value='' />
-		<propval name='target' type='astring' value='' />
-		<propval name='target_6' type='astring' value='' />
-		<propval name='value_authorization' type='astring'
-			value='solaris.smf.value.firewall.config' />
-	</property_group>
-
-	<stability value='Unstable' />
-
-	<template>
-		<common_name>
-			<loctext xml:lang='C'>
-			SSH server
-			</loctext>
-		</common_name>
-		<documentation>
-			<manpage title='sshd' section='1M' manpath='/usr/share/man' />
-		</documentation>
-	</template>
-
-</service>
-
-</service_bundle>
diff --git a/usr/src/cmd/ssh/etc/ssh_config b/usr/src/cmd/ssh/etc/ssh_config
deleted file mode 100644
index cdb9d97d45..0000000000
--- a/usr/src/cmd/ssh/etc/ssh_config
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright (c) 2001 by Sun Microsystems, Inc.
-# All rights reserved.
-#
-# ident	"%Z%%M%	%I%	%E% SMI"
-#
-# This file provides defaults for ssh(1).
-# The values can be changed in per-user configuration files $HOME/.ssh/config
-# or on the command line of ssh(1).
-
-# Configuration data is parsed as follows:
-#  1. command line options
-#  2. user-specific file
-#  3. system-wide file /etc/ssh/ssh_config
-#
-# Any configuration value is only changed the first time it is set.
-# host-specific definitions should be at the beginning of the
-# configuration file, and defaults at the end.
-
-# Example (matches compiled in defaults):
-#
-# Host *
-#   ForwardAgent no
-#   ForwardX11 no
-#   PubkeyAuthentication yes
-#   PasswordAuthentication yes
-#   FallBackToRsh no
-#   UseRsh no
-#   BatchMode no
-#   CheckHostIP yes
-#   StrictHostKeyChecking ask
-#   EscapeChar ~
diff --git a/usr/src/cmd/ssh/etc/sshd b/usr/src/cmd/ssh/etc/sshd
deleted file mode 100644
index d52b1afd25..0000000000
--- a/usr/src/cmd/ssh/etc/sshd
+++ /dev/null
@@ -1,127 +0,0 @@
-#!/sbin/sh
-#
-# Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
-# Use is subject to license terms.
-#
-# Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
-#
-
-. /lib/svc/share/ipf_include.sh
-. /lib/svc/share/smf_include.sh
-
-SSHDIR=/etc/ssh
-KEYGEN="/usr/bin/ssh-keygen -q"
-PIDFILE=/var/run/sshd.pid
-
-# Checks to see if RSA, and DSA host keys are available
-# if any of these keys are not present, the respective keys are created.
-create_key()
-{
-	keypath=$1
-	keytype=$2
-
-	if [ ! -f $keypath ]; then
-		# 
-		# HostKey keywords in sshd_config may be preceded or
-		# followed by a mix of any number of space or tabs,
-		# and optionally have an = between keyword and
-		# argument.  We use two grep invocations such that we
-		# can match HostKey case insensitively but still have
-		# the case of the path name be significant, keeping
-		# the pattern somewhat more readable.
-		#
-		# The character classes below contain one literal
-		# space and one literal tab.
-		#
-		grep -i "^[ 	]*HostKey[ 	]*=\{0,1\}[ 	]*$keypath" \
-		    $SSHDIR/sshd_config | grep "$keypath" > /dev/null 2>&1
-
-		if [ $? -eq 0 ]; then
-			echo Creating new $keytype public/private host key pair
-			$KEYGEN -f $keypath -t $keytype -N ''
-			if [ $? -ne 0 ]; then
-				echo "Could not create $keytype key: $keypath"
-				exit $SMF_EXIT_ERR_CONFIG
-			fi
-		fi
-	fi
-}
-
-create_ipf_rules()
-{
-	FMRI=$1
-	ipf_file=`fmri_to_file ${FMRI} $IPF_SUFFIX`
-	ipf6_file=`fmri_to_file ${FMRI} $IPF6_SUFFIX`
-	policy=`get_policy ${FMRI}`
-
-	#
-	# Get port from /etc/ssh/sshd_config
-	#
-	tports=`grep "^Port" /etc/ssh/sshd_config 2>/dev/null | \
-	    awk '{print $2}'`
-
-	echo "# $FMRI" >$ipf_file
-	echo "# $FMRI" >$ipf6_file
-	for port in $tports; do
-		generate_rules $FMRI $policy "tcp" $port $ipf_file
-		generate_rules $FMRI $policy "tcp" $port $ipf6_file _6
-	done
-}
-
-# This script is being used for two purposes: as part of an SMF
-# start/stop/refresh method, and as a sysidconfig(1M)/sys-unconfig(1M)
-# application.
-#
-# Both, the SMF methods and sysidconfig/sys-unconfig use different
-# arguments..
-
-case $1 in 
-	# sysidconfig/sys-unconfig arguments (-c and -u)
-'-c')
-	/usr/bin/ssh-keygen -A
-	if [ $? -ne 0 ]; then
-		create_key $SSHDIR/ssh_host_rsa_key rsa
-		create_key $SSHDIR/ssh_host_dsa_key dsa
-	fi
-	;;
-
-'-u')
-	# sys-unconfig(1M) knows how to remove ssh host keys, so there's
-	# nothing to do here.
-	:
-	;;
-
-	# SMF arguments (start and restart [really "refresh"])
-
-'ipfilter')
-	create_ipf_rules $2
-	;;
-
-'start')
-	#
-	# If host keys don't exist when the service is started, create
-	# them; sysidconfig is not run in every situation (such as on
-	# the install media).
-	# 
-	/usr/bin/ssh-keygen -A
-	if [ $? -ne 0 ]; then
-		create_key $SSHDIR/ssh_host_rsa_key rsa
-		create_key $SSHDIR/ssh_host_dsa_key dsa
-	fi
-
-	/usr/lib/ssh/sshd
-	;;
-
-'restart')
-	if [ -f "$PIDFILE" ]; then
-		/usr/bin/kill -HUP `/usr/bin/cat $PIDFILE`
-	fi
-	;;
-
-*)
-	echo "Usage: $0 { start | restart }"
-	exit 1
-	;;
-esac	
-
-exit $?
diff --git a/usr/src/cmd/ssh/etc/sshd_config b/usr/src/cmd/ssh/etc/sshd_config
deleted file mode 100644
index fd4aa5df46..0000000000
--- a/usr/src/cmd/ssh/etc/sshd_config
+++ /dev/null
@@ -1,145 +0,0 @@
-#
-# Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
-#
-# Configuration file for sshd(1m) (see also sshd_config(4))
-#
-
-# Protocol versions supported
-#
-# The sshd shipped in this release of Solaris has support for major versions
-# 1 and 2.  It is recommended due to security weaknesses in the v1 protocol
-# that sites run only v2 if possible. Support for v1 is provided to help sites
-# with existing ssh v1 clients/servers to transition. 
-# Support for v1 may not be available in a future release of Solaris.
-#
-# To enable support for v1 an RSA1 key must be created with ssh-keygen(1).
-# RSA and DSA keys for protocol v2 are created by /etc/init.d/sshd if they
-# do not already exist, RSA1 keys for protocol v1 are not automatically created.
-
-# Uncomment ONLY ONE of the following Protocol statements.
-
-# Only v2 (recommended)
-Protocol 2
-
-# Both v1 and v2 (not recommended)
-#Protocol 2,1
-
-# Only v1 (not recommended)
-#Protocol 1
-
-# Listen port (the IANA registered port number for ssh is 22)
-Port 22
-
-# The default listen address is all interfaces, this may need to be changed
-# if you wish to restrict the interfaces sshd listens on for a multi homed host.
-# Multiple ListenAddress entries are allowed.
-
-# IPv4 only
-#ListenAddress 0.0.0.0
-# IPv4 & IPv6
-ListenAddress ::
-
-# If port forwarding is enabled (default), specify if the server can bind to
-# INADDR_ANY. 
-# This allows the local port forwarding to work when connections are received
-# from any remote host.
-GatewayPorts no
-
-# X11 tunneling options
-X11Forwarding yes
-X11DisplayOffset 10
-X11UseLocalhost yes
-
-# The maximum number of concurrent unauthenticated connections to sshd.
-# start:rate:full see sshd(1) for more information.
-# The default is 10 unauthenticated clients.
-#MaxStartups 10:30:60
-
-# Banner to be printed before authentication starts.
-#Banner /etc/issue
-
-# Should sshd print the /etc/motd file and check for mail.
-# On Solaris it is assumed that the login shell will do these (eg /etc/profile).
-PrintMotd no
-
-# KeepAlive specifies whether keep alive messages are sent to the client.
-# See sshd(1) for detailed description of what this means.
-# Note that the client may also be sending keep alive messages to the server.
-KeepAlive yes
-
-# Syslog facility and level 
-SyslogFacility auth
-LogLevel info
-
-#
-# Authentication configuration
-# 
-
-# Host private key files
-# Must be on a local disk and readable only by the root user (root:sys 600).
-HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_dsa_key
-
-# Length of the server key
-# Default 768, Minimum 512
-ServerKeyBits 768
-
-# sshd regenerates the key every KeyRegenerationInterval seconds.
-# The key is never stored anywhere except the memory of sshd.
-# The default is 1 hour (3600 seconds).
-KeyRegenerationInterval 3600
-
-# Ensure secure permissions on users .ssh directory.
-StrictModes yes
-
-# Length of time in seconds before a client that hasn't completed
-# authentication is disconnected.
-# Default is 600 seconds. 0 means no time limit.
-LoginGraceTime 600
-
-# Maximum number of retries for authentication
-# Default is 6. Default (if unset) for MaxAuthTriesLog is MaxAuthTries / 2
-MaxAuthTries	6
-MaxAuthTriesLog	3
-
-# Are logins to accounts with empty passwords allowed.
-# If PermitEmptyPasswords is no, pass PAM_DISALLOW_NULL_AUTHTOK 
-# to pam_authenticate(3PAM).
-PermitEmptyPasswords no
-
-# To disable tunneled clear text passwords, change PasswordAuthentication to no.
-PasswordAuthentication yes
-
-# Are root logins permitted using sshd.
-# Note that sshd uses pam_authenticate(3PAM) so the root (or any other) user
-# maybe denied access by a PAM module regardless of this setting.
-# Valid options are yes, without-password, no.
-PermitRootLogin no
-
-# sftp subsystem
-Subsystem	sftp	internal-sftp
-
-
-# SSH protocol v1 specific options
-#
-# The following options only apply to the v1 protocol and provide
-# some form of backwards compatibility with the very weak security
-# of /usr/bin/rsh.  Their use is not recommended and the functionality
-# will be removed when support for v1 protocol is removed.
-
-# Should sshd use .rhosts and .shosts for password less authentication.
-IgnoreRhosts yes
-RhostsAuthentication no
-
-# Rhosts RSA Authentication
-# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts.
-# If the user on the client side is not root then this won't work on
-# Solaris since /usr/bin/ssh is not installed setuid.
-RhostsRSAAuthentication no
-
-# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication.
-#IgnoreUserKnownHosts yes
-
-# Is pure RSA authentication allowed.
-# Default is yes
-RSAAuthentication yes
diff --git a/usr/src/cmd/stat/Makefile b/usr/src/cmd/stat/Makefile
index 34149b2b37..faffc6a437 100644
--- a/usr/src/cmd/stat/Makefile
+++ b/usr/src/cmd/stat/Makefile
@@ -19,7 +19,7 @@
 # CDDL HEADER END
 #
 #
-# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2011, 2012, Joyent, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 # cmd/stat/Makefile
@@ -27,7 +27,14 @@
 
 include ../Makefile.cmd
 
-SUBDIRS=	arcstat iostat mpstat vmstat fsstat kstat
+SUBDIRS=	arcstat \
+		fsstat \
+		iostat \
+		kstat \
+		mpstat \
+		vfsstat \
+		vmstat \
+		ziostat
 
 all :=		TARGET = all
 install :=	TARGET = install
diff --git a/usr/src/cmd/stat/arcstat/Makefile b/usr/src/cmd/stat/arcstat/Makefile
index 6ae60a8d3d..a98e2fee7e 100644
--- a/usr/src/cmd/stat/arcstat/Makefile
+++ b/usr/src/cmd/stat/arcstat/Makefile
@@ -11,6 +11,7 @@
 
 #
 # Copyright 2014 Adam Stevko.  All rights reserved.
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
 #
 
 include $(SRC)/cmd/Makefile.cmd
diff --git a/usr/src/cmd/stat/arcstat/arcstat.pl b/usr/src/cmd/stat/arcstat/arcstat.pl
index d4f12a9e1c..d4f12a9e1c 100755..100644
--- a/usr/src/cmd/stat/arcstat/arcstat.pl
+++ b/usr/src/cmd/stat/arcstat/arcstat.pl
diff --git a/usr/src/cmd/stat/vfsstat/Makefile b/usr/src/cmd/stat/vfsstat/Makefile
new file mode 100644
index 0000000000..04b5085243
--- /dev/null
+++ b/usr/src/cmd/stat/vfsstat/Makefile
@@ -0,0 +1,41 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
+#
+
+include $(SRC)/cmd/Makefile.cmd
+
+PROG=	vfsstat
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all .WAIT $(ROOTPROG)
+
+clean:
+
+$(ROOTBINPROG): $(PROG)
+	$(INS.file)
+
+lint:
+
+include $(SRC)/cmd/Makefile.targ
diff --git a/usr/src/cmd/stat/vfsstat/vfsstat.pl b/usr/src/cmd/stat/vfsstat/vfsstat.pl
new file mode 100644
index 0000000000..a3780b8e63
--- /dev/null
+++ b/usr/src/cmd/stat/vfsstat/vfsstat.pl
@@ -0,0 +1,227 @@
+#!/usr/perl5/bin/perl -w
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2011 Joyent, Inc.
+#
+# vfsstat - report VFS statistics per zone
+#
+# USAGE:    vfsstat [-hIMrzZ] [interval [count]]
+#           -h              # help
+#	    -I              # print results per interval (where applicable)
+#	    -M              # print results in MB/s
+#	    -r		    # print data in comma-separated format
+#           -z              # hide zones with no VFS activity
+#	    -Z		    # print data for all zones
+#
+#   eg,	    vfsstat               # print summary since zone boot
+#           vfsstat 1             # print continually every 1 second
+#           vfsstat 1 5           # print 5 times, every 1 second
+#
+# NOTES:
+#
+# - The calculations and output fields emulate those from iostat(1M) as closely
+#   as possible.  When only one zone is actively performing disk I/O, the
+#   results from iostat(1M) in the global zone and vfsstat in the local zone
+#   should be almost identical.  Note that many VFS read operations are handled
+#   by the ARC, so vfsstat and iostat(1M) will be similar only when most
+#   requests are missing in the ARC.
+#
+# - As with iostat(1M), a result of 100% for VFS read and write utilization does
+#   not mean that the syscall layer is fully saturated.  Instead, that
+#   measurement just shows that at least one operation was pending over the last
+#   quanta of time examined.  Since the VFS layer can process more than one
+#   operation concurrently, this measurement will frequently be 100% but the VFS
+#   layer can still accept additional requests.
+#
+# - This script is based on Brendan Gregg's K9Toolkit examples:
+#
+#	http://www.brendangregg.com/k9toolkit.html
+#
+
+use Getopt::Std;
+use Sun::Solaris::Kstat;
+my $Kstat = Sun::Solaris::Kstat->new();
+
+# Process command line args
+usage() if defined $ARGV[0] and $ARGV[0] eq "--help";
+getopts('hIMrzZ') or usage();
+usage() if defined $main::opt_h;
+$main::opt_h = 0;
+
+my $USE_MB = defined $main::opt_M ? $main::opt_M : 0;
+my $USE_INTERVAL = defined $main::opt_I ? $main::opt_I : 0;
+my $USE_COMMA = defined $main::opt_r ? $main::opt_r : 0;
+my $HIDE_ZEROES = defined $main::opt_z ? $main::opt_z : 0;
+my $ALL_ZONES = defined $main::opt_Z ? $main::opt_Z : 0;
+
+my ($interval, $count);
+if ( defined($ARGV[0]) ) {
+	$interval = $ARGV[0];
+	$count = defined ($ARGV[1]) ? $ARGV[1] : 2**32;
+	usage() if ($interval == 0);
+} else {
+	$interval = 1;
+	$count = 1; 
+}
+
+my $HEADER_FMT = $USE_COMMA ?
+    "r/%s,w/%s,%sr/%s,%sw/%s,ractv,wactv,read_t,writ_t,%%r,%%w," .
+    "d/%s,del_t,zone\n" :
+    "  r/%s   w/%s  %sr/%s  %sw/%s ractv wactv read_t writ_t  " .
+    "%%r  %%w   d/%s  del_t zone\n";
+my $DATA_FMT = $USE_COMMA ?
+    "%.1f,%.1f,%.1f,%.1f,%.1f,%.1f,%.1f,%.1f,%d,%d,%.1f,%.1f,%s,%d\n" :
+    "%5.1f %5.1f %5.1f %5.1f %5.1f %5.1f %6.1f %6.1f %3d %3d " .
+    "%5.1f %6.1f %s (%d)\n";
+
+my $BYTES_PREFIX = $USE_MB ? "M" : "k";
+my $BYTES_DIVISOR = $USE_MB ? 1024 * 1024 : 1024;
+my $INTERVAL_SUFFIX = $USE_INTERVAL ? "i" : "s";
+my $NANOSEC = 1000000000;
+
+my @fields = ( 'reads', 'writes', 'nread', 'nwritten', 'rtime', 'wtime',
+    'rlentime', 'wlentime', 'delay_cnt', 'delay_time', 'snaptime' );
+
+chomp(my $curzone = (`/sbin/zonename`));
+
+my %old = ();
+my $rows_printed = 0;
+
+for (my $ii = 0; $ii < $count; $ii++) {
+	# Read list of visible zones and their zone IDs
+	my @zones = ();
+	my %zoneids = ();
+	my $zoneadm = `zoneadm list -p | cut -d: -f1,2`;
+	@lines = split(/\n/, $zoneadm);
+	foreach $line (@lines) {
+		@tok = split(/:/, $line);
+		$zoneids->{$tok[1]} = $tok[0];
+		push(@zones, $tok[1]);
+	}
+
+	$Kstat->update();
+
+	# Print the column header every 20 rows
+	if ($rows_printed == 0 || $ALL_ZONES) {
+		printf($HEADER_FMT, $INTERVAL_SUFFIX, $INTERVAL_SUFFIX,
+		    $BYTES_PREFIX, $INTERVAL_SUFFIX, $BYTES_PREFIX,
+		    $INTERVAL_SUFFIX, $INTERVAL_SUFFIX);
+	}
+
+	$rows_printed = $rows_printed >= 20 ? 0 : $rows_printed + 1;
+
+	foreach $zone (@zones) {
+		if ((!$ALL_ZONES) && ($zone ne $curzone)) {
+			next;
+		}
+
+		if (! defined $old->{$zone}) {
+			$old->{$zone} = ();
+			foreach $field (@fields) { $old->{$zone}->{$field} = 0; }
+		}
+
+		#
+		# Kstats have a 30-character limit (KSTAT_STRLEN) on their
+		# names, so if the zone name exceeds that limit, use the first
+		# 30 characters.
+		#
+		my $trimmed_zone = substr($zone, 0, 30);
+		my $zoneid = $zoneids->{$zone};
+
+		print_stats($zone, $zoneid,
+		    $Kstat->{'zone_vfs'}{$zoneid}{$trimmed_zone}, $old->{$zone});
+	}
+
+	sleep ($interval);
+}
+
+exit(0);
+
+sub print_stats {
+	my $zone = $_[0];
+	my $zoneid = $_[1];
+	my $data = $_[2];
+	my $old = $_[3];
+
+	my $etime = $data->{'snaptime'} -
+	    ($old->{'snaptime'} > 0 ? $old->{'snaptime'} : $data->{'crtime'});
+
+	# Calculate basic statistics
+	my $rate_divisor = $USE_INTERVAL ? 1 : $etime;
+	my $reads = ($data->{'reads'} - $old->{'reads'}) / $rate_divisor;
+	my $writes = ($data->{'writes'} - $old->{'writes'}) / $rate_divisor;
+	my $nread = ($data->{'nread'} - $old->{'nread'}) /
+	    $rate_divisor / $BYTES_DIVISOR;
+	my $nwritten = ($data->{'nwritten'} - $old->{'nwritten'}) /
+	    $rate_divisor / $BYTES_DIVISOR;
+	
+	# Calculate transactions per second
+	my $r_tps = ($data->{'reads'} - $old->{'reads'}) / $etime;
+	my $w_tps = ($data->{'writes'} - $old->{'writes'}) / $etime;
+
+	# Calculate average length of active queue
+	my $r_actv = (($data->{'rlentime'} - $old->{'rlentime'}) / $NANOSEC) /
+	    $etime;
+	my $w_actv = (($data->{'wlentime'} - $old->{'wlentime'}) / $NANOSEC) /
+	    $etime;
+
+	# Calculate average service time
+	# multiply by 1000 to convert to usecs for conssistency with del_t
+	my $read_t = ($r_tps > 0 ? $r_actv * (1000 / $r_tps) : 0.0) * 1000;
+	my $writ_t = ($w_tps > 0 ? $w_actv * (1000 / $w_tps) : 0.0) * 1000;
+
+	# Calculate I/O throttle delay metrics
+	my $delays = $data->{'delay_cnt'} - $old->{'delay_cnt'};
+	my $d_tps = $delays / $etime;
+	my $del_t = $delays > 0 ?
+	    ($data->{'delay_time'} - $old->{'delay_time'}) / $delays : 0.0;
+
+	# Calculate the % time the VFS layer is active
+	my $r_b_pct = ((($data->{'rtime'} - $old->{'rtime'}) / $NANOSEC) /
+	    $etime) * 100;
+	my $w_b_pct = ((($data->{'wtime'} - $old->{'wtime'}) / $NANOSEC) /
+	    $etime) * 100;
+
+	if (! $HIDE_ZEROES || $reads != 0.0 || $writes != 0.0 ||
+	    $nread != 0.0 || $nwritten != 0.0) {
+		printf($DATA_FMT, $reads, $writes, $nread, $nwritten, $r_actv,
+		    $w_actv, $read_t, $writ_t, $r_b_pct, $w_b_pct,
+		    $d_tps, $del_t, substr($zone, 0, 8), $zoneid);
+	}
+
+	# Save current calculations for next loop
+	foreach (@fields) { $old->{$_} = $data->{$_}; }
+}
+
+sub usage {
+        print STDERR <<END;
+USAGE: vfsstat [-hIMrzZ] [interval [count]]
+   eg, vfsstat               # print summary since zone boot
+       vfsstat 1             # print continually every 1 second
+       vfsstat 1 5           # print 5 times, every 1 second
+       vfsstat -I            # print results per interval (where applicable)
+       vfsstat -M            # print results in MB/s
+       vfsstat -r            # print results in comma-separated format
+       vfsstat -z            # hide zones with no VFS activity
+       vfsstat -Z            # print results for all zones
+END
+        exit 1;
+}
diff --git a/usr/src/cmd/stat/ziostat/Makefile b/usr/src/cmd/stat/ziostat/Makefile
new file mode 100644
index 0000000000..c338b59678
--- /dev/null
+++ b/usr/src/cmd/stat/ziostat/Makefile
@@ -0,0 +1,41 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
+#
+
+include $(SRC)/cmd/Makefile.cmd
+
+PROG=	ziostat
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all .WAIT $(ROOTPROG)
+
+clean:
+
+$(ROOTBINPROG): $(PROG)
+	$(INS.file)
+
+lint:
+
+include $(SRC)/cmd/Makefile.targ
diff --git a/usr/src/cmd/stat/ziostat/ziostat.pl b/usr/src/cmd/stat/ziostat/ziostat.pl
new file mode 100755
index 0000000000..cf95d2f5a5
--- /dev/null
+++ b/usr/src/cmd/stat/ziostat/ziostat.pl
@@ -0,0 +1,204 @@
+#!/usr/perl5/bin/perl -w
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2011 Joyent, Inc.
+#
+# ziostat - report I/O statistics per zone
+#
+# USAGE:    ziostat [-hIMrzZ] [interval [count]]
+#           -h              # help
+#           -I              # print results per interval (where applicable)
+#	    -M              # print results in MB/s
+#	    -r		    # print data in comma-separated format
+#	    -z		    # hide zones with no ZFS I/O activity
+#	    -Z		    # print data for all zones
+#
+#   eg,	    ziostat               # print summary since zone boot
+#           ziostat 1             # print continually every 1 second
+#           ziostat 1 5           # print 5 times, every 1 second
+#
+# NOTES:
+#
+# - The calculations and output fields emulate those from iostat(1M) as closely
+#   as possible.  When only one zone is actively performing disk I/O, the
+#   results from iostat(1M) in the global zone and ziostat in the local zone
+#   should be almost identical.
+#
+# - As with iostat(1M), a result of 100% for disk utilization does not mean that
+#   the disk is fully saturated.  Instead, that measurement just shows that at
+#   least one operation was pending over the last quanta of time examined.
+#   Since disk devices can process more than one operation concurrently, this
+#   measurement will frequently be 100% but the disk can still offer higher
+#   performance.
+#
+# - This script is based on Brendan Gregg's K9Toolkit examples:
+#
+#	http://www.brendangregg.com/k9toolkit.html
+#
+
+use Getopt::Std;
+use Sun::Solaris::Kstat;
+my $Kstat = Sun::Solaris::Kstat->new();
+
+# Process command line args
+usage() if defined $ARGV[0] and $ARGV[0] eq "--help";
+getopts('hIMrzZ') or usage();
+usage() if defined $main::opt_h;
+$main::opt_h = 0;
+
+my $USE_MB = defined $main::opt_M ? $main::opt_M : 0;
+my $USE_INTERVAL = defined $main::opt_I ? $main::opt_I : 0;
+my $USE_COMMA = defined $main::opt_r ? $main::opt_r : 0;
+my $HIDE_ZEROES = defined $main::opt_z ? $main::opt_z : 0;
+my $ALL_ZONES = defined $main::opt_Z ? $main::opt_Z : 0;
+
+my ($interval, $count);
+if ( defined($ARGV[0]) ) {
+	$interval = $ARGV[0];
+	$count = defined ($ARGV[1]) ? $ARGV[1] : 2**32;
+	usage() if ($interval == 0);
+} else {
+	$interval = 1;
+	$count = 1; 
+}
+
+my $HEADER_FMT = $USE_COMMA ?
+     "r/%s,%sr/%s,actv,wsvc_t,asvc_t,%%b,zone\n" :
+     "    r/%s   %sr/%s   actv wsvc_t asvc_t  %%b zone\n";
+my $DATA_FMT = $USE_COMMA ?
+    "%.1f,%.1f,%.1f,%.1f,%.1f,%d,%s,%d\n" :
+    " %6.1f %6.1f %6.1f %6.1f %6.1f %3d %s (%d)\n";
+
+my $BYTES_PREFIX = $USE_MB ? "M" : "k";
+my $BYTES_DIVISOR = $USE_MB ? 1024 * 1024 : 1024;
+my $INTERVAL_SUFFIX = $USE_INTERVAL ? "i" : "s";
+my $NANOSEC = 1000000000;
+
+my @fields = ( 'reads', 'nread', 'waittime', 'rtime', 'rlentime', 'snaptime' );
+
+chomp(my $curzone = (`/sbin/zonename`));
+
+# Read list of visible zones and their zone IDs
+my @zones = ();
+my %zoneids = ();
+my $zoneadm = `zoneadm list -p | cut -d: -f1,2`;
+@lines = split(/\n/, $zoneadm);
+foreach $line (@lines) {
+	@tok = split(/:/, $line);
+	$zoneids->{$tok[1]} = $tok[0];
+	push(@zones, $tok[1]);
+}
+
+my %old = ();
+my $rows_printed = 0;
+
+$Kstat->update();
+
+for (my $ii = 0; $ii < $count; $ii++) {
+	# Print the column header every 20 rows
+	if ($rows_printed == 0 || $ALL_ZONES) {
+		printf($HEADER_FMT, $INTERVAL_SUFFIX, $BYTES_PREFIX,
+		    $INTERVAL_SUFFIX, $INTERVAL_SUFFIX);
+	}
+
+	$rows_printed = $rows_printed >= 20 ? 0 : $rows_printed + 1;
+
+	foreach $zone (@zones) {
+		if ((!$ALL_ZONES) && ($zone ne $curzone)) {
+			next;
+		}
+
+		if (! defined $old->{$zone}) {
+			$old->{$zone} = ();
+			foreach $field (@fields) { $old->{$zone}->{$field} = 0; }
+		}
+
+		#
+		# Kstats have a 30-character limit (KSTAT_STRLEN) on their
+		# names, so if the zone name exceeds that limit, use the first
+		# 30 characters.
+		#
+		my $trimmed_zone = substr($zone, 0, 30);
+		my $zoneid = $zoneids->{$zone};
+
+		print_stats($zone, $zoneid,
+		    $Kstat->{'zone_zfs'}{$zoneid}{$trimmed_zone}, $old->{$zone});
+	}
+
+	sleep ($interval);
+	$Kstat->update();
+}
+
+sub print_stats {
+	my $zone = $_[0];
+	my $zoneid = $_[1];
+	my $data = $_[2];
+	my $old = $_[3];
+
+	my $etime = $data->{'snaptime'} -
+	    ($old->{'snaptime'} > 0 ? $old->{'snaptime'} : $data->{'crtime'});
+
+	# Calculate basic statistics
+	my $rate_divisor = $USE_INTERVAL ? 1 : $etime;
+	my $reads = ($data->{'reads'} - $old->{'reads'}) / $rate_divisor;
+	my $nread = ($data->{'nread'} - $old->{'nread'}) /
+	    $rate_divisor / $BYTES_DIVISOR;
+
+	# Calculate overall transactions per second
+	my $ops = $data->{'reads'} - $old->{'reads'};
+	my $tps = $ops / $etime;
+
+	# Calculate average length of disk run queue
+	my $actv = (($data->{'rlentime'} - $old->{'rlentime'}) / $NANOSEC) /
+	    $etime;
+
+	# Calculate average disk wait and service times
+	my $wsvc = $ops > 0 ? (($data->{'waittime'} - $old->{'waittime'}) /
+	    1000000) / $ops : 0.0;
+	my $asvc = $tps > 0 ? $actv * (1000 / $tps) : 0.0;
+
+	# Calculate the % time the disk run queue is active
+	my $b_pct = ((($data->{'rtime'} - $old->{'rtime'}) / $NANOSEC) /
+	    $etime) * 100;
+
+	if (! $HIDE_ZEROES || $reads != 0.0 || $nread != 0.0 ) {
+		printf($DATA_FMT, $reads, $nread, $actv, $wsvc, $asvc,
+		    $b_pct, substr($zone, 0, 8), $zoneid);
+	}
+
+	# Save current calculations for next loop
+	foreach (@fields) { $old->{$_} = $data->{$_}; }
+}
+
+sub usage {
+        print STDERR <<END;
+USAGE: ziostat [-hIMrzZ] [interval [count]]
+   eg, ziostat               # print summary since zone boot
+       ziostat 1             # print continually every 1 second
+       ziostat 1 5           # print 5 times, every 1 second
+       ziostat -I            # print results per interval (where applicable)
+       ziostat -M            # print results in MB/s
+       ziostat -r            # print results in comma-separated format
+       ziostat -z            # hide zones with no ZFS I/O activity
+       ziostat -Z            # print results for all zones
+END
+        exit 1;
+}
diff --git a/usr/src/cmd/svc/configd/backend.c b/usr/src/cmd/svc/configd/backend.c
index b7ed400cfd..4c3a7d0816 100644
--- a/usr/src/cmd/svc/configd/backend.c
+++ b/usr/src/cmd/svc/configd/backend.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -2194,7 +2195,24 @@ backend_tx_begin(backend_type_t t, backend_tx_t **txp)
 	UPDATE_TOTALS((*txp)->bt_be, bt_exec, ts, vts);
 	if (r == SQLITE_FULL)
 		(*txp)->bt_full = 1;
-	r = backend_error((*txp)->bt_be, r, errmsg);
+	/*
+	 * We explicitly handle an ENOSPC error here for the beginning of the
+	 * transaction, instead of in backend_error, which calls backend_panic
+	 * for this case, resulting in the death of svc.configd. That may be
+	 * appropriate in other cases, but in this case we would rather fail so
+	 * that configd remains up and the caller gets an approprate error. The
+	 * failure mode is that there is not enough swap space to open the
+	 * non-persistent database, so there won't be enough space to restart
+	 * configd, leaving SMF in a state requiring manual intervention.
+	 */
+	if (r == SQLITE_CANTOPEN && errno == ENOSPC &&
+	    (*txp)->bt_type == BACKEND_TYPE_NONPERSIST) {
+		configd_info("Warning: no space to open %s\n",
+		    bes[BACKEND_TYPE_NONPERSIST]->be_path);
+		r = REP_PROTOCOL_FAIL_NO_RESOURCES;
+	} else {
+		r = backend_error((*txp)->bt_be, r, errmsg);
+	}
 
 	if (r != REP_PROTOCOL_SUCCESS) {
 		assert(r != REP_PROTOCOL_DONE);
diff --git a/usr/src/cmd/svc/configd/rc_node.c b/usr/src/cmd/svc/configd/rc_node.c
index a5b968c53c..33cb2be7a2 100644
--- a/usr/src/cmd/svc/configd/rc_node.c
+++ b/usr/src/cmd/svc/configd/rc_node.c
@@ -24,6 +24,9 @@
  * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
  * Copyright (c) 2016 by Delphix. All rights reserved.
  */
+/*
+ * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ */
 
 /*
  * rc_node.c - In-memory SCF object management
diff --git a/usr/src/cmd/svc/milestone/net-routing-setup b/usr/src/cmd/svc/milestone/net-routing-setup
index 6ab1a6c7f0..b4ee7d39ac 100644
--- a/usr/src/cmd/svc/milestone/net-routing-setup
+++ b/usr/src/cmd/svc/milestone/net-routing-setup
@@ -21,11 +21,15 @@
 #
 #
 # Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
+#
+# Copyright (c) 2012 Joyent, Inc.  All rights reserved.
 
 # This script configures IP routing.
 
 . /lib/svc/share/smf_include.sh
 
+set -o xtrace
+
 #
 # In a shared-IP zone we need this service to be up, but all of the work
 # it tries to do is irrelevant (and will actually lead to the service 
@@ -156,7 +160,8 @@ fi
 # however, as persistent daemon state is now controlled by SMF.
 #
 ipv4_routing_set=`/usr/bin/svcprop -p routeadm/ipv4-routing-set $SMF_FMRI`
-if [ -z "$defrouters" ]; then
+smartos_param=`/usr/bin/bootparams | grep "^smartos"`
+if [ -z "$defrouters" ] && [ "$smartos_param" != "" ]; then
 	#
 	# Set default value for ipv4-routing to enabled.  If routeadm -e/-d
 	# has not yet been run by the administrator, we apply this default.
@@ -210,5 +215,21 @@ if [ -f /etc/inet/static_routes ]; then
 	done
 fi
 
+#
+# Read /etc/inet/static_routes.vmadm and add each route.
+#
+if [ -f /etc/inet/static_routes.vmadm ]; then
+	echo "Adding vmadm persistent routes:"
+	/usr/bin/egrep -v "^(#|$)" /etc/inet/static_routes.vmadm | while read line; do
+		/usr/sbin/route add $line
+	done
+fi
+
+#
+# Log the result
+#
+echo "Routing setup complete:"
+/usr/bin/netstat -rn
+
 # Clear exit status.
 exit $SMF_EXIT_OK
diff --git a/usr/src/cmd/svc/milestone/network-location.xml b/usr/src/cmd/svc/milestone/network-location.xml
index aad337f42f..709e9df8f3 100644
--- a/usr/src/cmd/svc/milestone/network-location.xml
+++ b/usr/src/cmd/svc/milestone/network-location.xml
@@ -106,7 +106,7 @@
 	-->
 	<dependency
 		name='manifest-import'
-		grouping='require_all'
+		grouping='optional_all'
 		restart_on='none'
 		type='service'>
 		<service_fmri value='svc:/system/manifest-import:default' />
diff --git a/usr/src/cmd/svc/milestone/network-routing-setup.xml b/usr/src/cmd/svc/milestone/network-routing-setup.xml
index b34d578e2a..85a74756da 100644
--- a/usr/src/cmd/svc/milestone/network-routing-setup.xml
+++ b/usr/src/cmd/svc/milestone/network-routing-setup.xml
@@ -40,11 +40,19 @@
 
 	<!-- loopback/physical network configuration is required -->
 	<dependency
-		name='network'
-		grouping='optional_all'
+		name='loopback'
+		grouping='require_all'
+		restart_on='none'
+		type='service'>
+		<service_fmri value='svc:/network/loopback' />
+	</dependency>
+
+	<dependency
+		name='physical'
+		grouping='require_all'
 		restart_on='none'
 		type='service'>
-		<service_fmri value='svc:/milestone/network' />
+		<service_fmri value='svc:/network/physical' />
 	</dependency>
 
 	<!-- usr filesystem required to run routing-related commands -->
diff --git a/usr/src/cmd/svc/milestone/network.xml b/usr/src/cmd/svc/milestone/network.xml
index 75b5578f44..48386ebf73 100644
--- a/usr/src/cmd/svc/milestone/network.xml
+++ b/usr/src/cmd/svc/milestone/network.xml
@@ -54,6 +54,14 @@
 		<service_fmri value='svc:/network/physical' />
 	</dependency>
 
+	<dependency
+		name='routing-setup'
+		grouping='require_all'
+		restart_on='none'
+		type='service'>
+		<service_fmri value='svc:/network/routing-setup' />
+	</dependency>
+
 	<exec_method
 		type='method'
 		name='start'
diff --git a/usr/src/cmd/svc/milestone/single-user.xml b/usr/src/cmd/svc/milestone/single-user.xml
index 8797f13c47..579ecb5ddd 100644
--- a/usr/src/cmd/svc/milestone/single-user.xml
+++ b/usr/src/cmd/svc/milestone/single-user.xml
@@ -68,7 +68,7 @@
 
 	<dependency
 		name='manifests'
-		grouping='require_all'
+		grouping='optional_all'
 		restart_on='none'
 		type='service'>
 		<service_fmri value='svc:/system/manifest-import' />
diff --git a/usr/src/cmd/svc/shell/smf_include.sh b/usr/src/cmd/svc/shell/smf_include.sh
index 77a1453cbb..429e3310f4 100644
--- a/usr/src/cmd/svc/shell/smf_include.sh
+++ b/usr/src/cmd/svc/shell/smf_include.sh
@@ -22,6 +22,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2012 Joyent, Inc.  All rights reserved.
 # Copyright 2015 Nexenta Systems, Inc. All rights reserved.
 #
 
@@ -235,7 +236,12 @@ smf_kill_contract() {
 #   SMF_EXIT_ERR_OTHER, although not defined, encompasses all non-zero
 #   exit status values.
 #
+# The SMF_EXIT_NODAEMON exit status should be used when a method does not
+# need to run any persistent process. This indicates success, abandons the
+# contract, and allows dependencies to be met.
+#
 SMF_EXIT_OK=0
+SMF_EXIT_NODAEMON=94
 SMF_EXIT_ERR_FATAL=95
 SMF_EXIT_ERR_CONFIG=96
 SMF_EXIT_MON_DEGRADE=97
diff --git a/usr/src/cmd/svc/startd/graph.c b/usr/src/cmd/svc/startd/graph.c
index 62fbbf1514..30881ea34a 100644
--- a/usr/src/cmd/svc/startd/graph.c
+++ b/usr/src/cmd/svc/startd/graph.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  * Copyright (c) 2015, Syneto S.R.L. All rights reserved.
  * Copyright 2016 Toomas Soome <tsoome@me.com>
  * Copyright 2016 RackTop Systems.
@@ -144,6 +145,8 @@
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
 #include <fm/libfmevent.h>
 #include <libscf.h>
 #include <libscf_priv.h>
@@ -4841,6 +4844,20 @@ vertex_subgraph_dependencies_shutdown(scf_handle_t *h, graph_vertex_t *v,
 	was_up = up_state(old_state);
 	now_up = up_state(v->gv_state);
 
+	if (halting != -1 && old_state == RESTARTER_STATE_DISABLED &&
+	    v->gv_state != RESTARTER_STATE_DISABLED) {
+		/*
+		 * We're halting and we have a svc which is transitioning to
+		 * offline in parallel. This leads to a race condition where
+		 * gt_enter_offline might re-enable the svc after we disabled
+		 * it. Since we're halting, we want to ensure no svc ever
+		 * transitions out of the disabled state. In this case, modify
+		 * the flags to keep us on the halting path.
+		 */
+		was_up = 0;
+		now_up = 0;
+	}
+
 	if (!was_up && now_up) {
 		++non_subgraph_svcs;
 	} else if (was_up && !now_up) {
@@ -6793,6 +6810,7 @@ repository_event_thread(void *unused)
 	char *fmri = startd_alloc(max_scf_fmri_size);
 	char *pg_name = startd_alloc(max_scf_value_size);
 	int r;
+	int fd;
 
 	h = libscf_handle_create_bound_loop();
 
@@ -6815,6 +6833,14 @@ retry:
 		goto retry;
 	}
 
+	if ((fd = open("/etc/svc/volatile/startd.ready", O_RDONLY | O_CREAT,
+	    S_IRUSR)) < 0) {
+		log_error(LOG_WARNING, "Couldn't create startd.ready file\n",
+		    SCF_GROUP_FRAMEWORK, scf_strerror(scf_error()));
+	} else {
+		(void) close(fd);
+	}
+
 	/*CONSTCOND*/
 	while (1) {
 		ssize_t res;
diff --git a/usr/src/cmd/svc/startd/method.c b/usr/src/cmd/svc/startd/method.c
index cc9ce6768c..c3cd0144c1 100644
--- a/usr/src/cmd/svc/startd/method.c
+++ b/usr/src/cmd/svc/startd/method.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2011 Joyent Inc.
+ * Copyright 2012 Joyent, Inc. All rights reserved.
  */
 
 /*
@@ -100,34 +100,18 @@ static uint_t method_events[] = {
  * method_record_start(restarter_inst_t *)
  *   Record a service start for rate limiting.  Place the current time
  *   in the circular array of instance starts.
+ *
+ *   Save the critical_failure_period and critical_failure_allowed with either
+ *   the defaults or the svc properties startd/critical_failure_count and
+ *   startd/critical_failure_period.
+ *   ri_crit_fail_allowed is capped at RINST_START_TIMES.
  */
 static void
 method_record_start(restarter_inst_t *inst)
 {
-	int index = inst->ri_start_index++ % RINST_START_TIMES;
-
-	inst->ri_start_time[index] = gethrtime();
-}
-
-/*
- * method_rate_critical(restarter_inst_t *)
- *    Return true if the average start interval is less than the permitted
- *    interval.  The implicit interval defaults to RINST_FAILURE_RATE_NS and
- *    RINST_START_TIMES but may be overridden with the svc properties
- *    startd/critical_failure_count and startd/critical_failure_period
- *    which represent the number of failures to consider and the amount of
- *    time in seconds in which that number may occur, respectively. Note that
- *    this time is measured as of the transition to 'enabled' rather than wall
- *    clock time.
- *    Implicit success if insufficient measurements for an average exist.
- */
-int
-method_rate_critical(restarter_inst_t *inst)
-{
+	int index;
+	uint_t critical_failure_allowed = RINST_START_TIMES;
 	hrtime_t critical_failure_period;
-	uint_t critical_failure_count = RINST_START_TIMES;
-	uint_t n = inst->ri_start_index;
-	hrtime_t avg_ns = 0;
 	uint64_t scf_fr, scf_st;
 	scf_propvec_t *prop = NULL;
 	scf_propvec_t restart_critical[] = {
@@ -151,17 +135,48 @@ method_rate_critical(restarter_inst_t *inst)
 		 * in seconds but tracked in ns
 		 */
 		critical_failure_period = (hrtime_t)scf_fr * NANOSEC;
-		critical_failure_count = (uint_t)scf_st;
+		critical_failure_allowed = (uint_t)scf_st;
+
+		if (critical_failure_allowed > RINST_START_TIMES)
+			critical_failure_allowed = RINST_START_TIMES;
+		if (critical_failure_allowed < 1)
+			critical_failure_allowed = 1;
+
 	}
-	if (inst->ri_start_index < critical_failure_count)
+
+	inst->ri_crit_fail_allowed = critical_failure_allowed;
+	inst->ri_crit_fail_period = critical_failure_period;
+
+	index = inst->ri_start_index++ % critical_failure_allowed;
+	inst->ri_start_time[index] = gethrtime();
+}
+
+/*
+ * method_rate_critical(restarter_inst_t *)
+ *    Return true if the number of failures within the interval
+ *    ri_crit_fail_period exceeds ri_crit_fail_allowed. The allowed failure
+ *    count defaults to RINST_START_TIMES and the implicit interval defaults
+ *    to RINST_FAILURE_RATE_NS but may be overridden with the svc properties
+ *    startd/critical_failure_count and startd/critical_failure_period which
+ *    represent the acceptable number of failures and the amount of time in
+ *    seconds in which that number may occur, respectively. Note that this time
+ *    is measured as of the transition to 'enabled' rather than wall clock
+ *    time. Implicitly not critical if insufficient failures have occured.
+ */
+int
+method_rate_critical(restarter_inst_t *inst)
+{
+	uint_t n = inst->ri_start_index;
+	uint_t fail_allowed = inst->ri_crit_fail_allowed;
+	hrtime_t diff_ns;
+
+	if (n < fail_allowed)
 		return (0);
 
-	avg_ns =
-	    (inst->ri_start_time[(n - 1) % critical_failure_count] -
-	    inst->ri_start_time[n % critical_failure_count]) /
-	    (critical_failure_count - 1);
+	diff_ns = inst->ri_start_time[(n - 1) % fail_allowed] -
+	    inst->ri_start_time[n % fail_allowed];
 
-	return (avg_ns < critical_failure_period);
+	return (diff_ns < inst->ri_crit_fail_period);
 }
 
 /*
@@ -989,7 +1004,8 @@ method_run(restarter_inst_t **instp, int type, int *exit_code)
 			goto contract_out;
 		}
 
-		if (!WIFEXITED(ret_status)) {
+		if (!WIFEXITED(ret_status) &&
+		    WEXITSTATUS(ret_status) != SMF_EXIT_NODAEMON) {
 			/*
 			 * If method didn't exit itself (it was killed by an
 			 * external entity, etc.), consider the entire
@@ -1018,7 +1034,7 @@ method_run(restarter_inst_t **instp, int type, int *exit_code)
 		}
 
 		*exit_code = WEXITSTATUS(ret_status);
-		if (*exit_code != 0) {
+		if (*exit_code != 0 && *exit_code != SMF_EXIT_NODAEMON) {
 			log_error(LOG_WARNING,
 			    "%s: Method \"%s\" failed with exit status %d.\n",
 			    inst->ri_i.i_fmri, method, WEXITSTATUS(ret_status));
@@ -1027,6 +1043,7 @@ method_run(restarter_inst_t **instp, int type, int *exit_code)
 		log_instance(inst, B_TRUE, "Method \"%s\" exited with status "
 		    "%d.", mname, *exit_code);
 
+		/* Note: we will take this path for SMF_EXIT_NODAEMON */
 		if (*exit_code != 0)
 			goto contract_out;
 
@@ -1073,7 +1090,10 @@ assured_kill:
 	}
 
 contract_out:
-	/* Abandon contracts for transient methods & methods that fail. */
+	/*
+	 * Abandon contracts for transient methods, methods that exit with
+	 * SMF_EXIT_NODAEMON & methods that fail.
+	 */
 	transient = method_is_transient(inst, type);
 	if ((transient || *exit_code != 0 || result != 0) &&
 	    (restarter_is_kill_method(method) < 0))
@@ -1169,7 +1189,7 @@ retry:
 
 	r = method_run(&inst, info->sf_method_type, &exit_code);
 
-	if (r == 0 && exit_code == 0) {
+	if (r == 0 && (exit_code == 0 || exit_code == SMF_EXIT_NODAEMON)) {
 		/* Success! */
 		assert(inst->ri_i.i_next_state != RESTARTER_STATE_NONE);
 
@@ -1187,6 +1207,12 @@ retry:
 			else
 				method_remove_contract(inst, B_TRUE, B_TRUE);
 		}
+
+		/*
+		 * For methods that exit with SMF_EXIT_NODAEMON, we already
+		 * called method_remove_contract in method_run.
+		 */
+
 		/*
 		 * We don't care whether the handle was rebound because this is
 		 * the last thing we do with it.
diff --git a/usr/src/cmd/svc/startd/startd.h b/usr/src/cmd/svc/startd/startd.h
index d230ed1490..df3e98a27b 100644
--- a/usr/src/cmd/svc/startd/startd.h
+++ b/usr/src/cmd/svc/startd/startd.h
@@ -398,7 +398,7 @@ typedef enum {
 
 #define	RINST_RETAKE_MASK	0x0f000000
 
-#define	RINST_START_TIMES	5		/* failures to consider */
+#define	RINST_START_TIMES	10		/* up to 10 fails to consider */
 #define	RINST_FAILURE_RATE_NS	600000000000LL	/* 1 failure/10 minutes */
 #define	RINST_WT_SVC_FAILURE_RATE_NS	NANOSEC	/* 1 failure/second */
 
@@ -420,6 +420,8 @@ typedef struct restarter_inst {
 
 	hrtime_t		ri_start_time[RINST_START_TIMES];
 	uint_t			ri_start_index;	/* times started */
+	uint_t			ri_crit_fail_allowed;
+	hrtime_t		ri_crit_fail_period;
 
 	uu_list_node_t		ri_link;
 	pthread_mutex_t		ri_lock;
diff --git a/usr/src/cmd/svc/svcadm/Makefile b/usr/src/cmd/svc/svcadm/Makefile
index cc0cc160bf..1a6a0dd35c 100644
--- a/usr/src/cmd/svc/svcadm/Makefile
+++ b/usr/src/cmd/svc/svcadm/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2012, Joyent, Inc.  All rights reserved.
 #
 
 PROG =		svcadm
@@ -49,7 +50,11 @@ $(PROG): $(OBJS)
 $(POFILE): $(POFILES)
 	cat $(POFILES) > $(POFILE)
 
-install: all $(ROOTUSRSBINPROG)
+install: all $(ROOTSBINPROG) $(ROOTUSRSBINPROG)
+
+$(ROOTUSRSBINPROG):
+	-$(RM) $@
+	-$(SYMLINK) ../../sbin/$(PROG) $@
 
 clean:
 	$(RM) $(OBJS)
diff --git a/usr/src/cmd/svc/svcs/Makefile b/usr/src/cmd/svc/svcs/Makefile
index 0e9fc52652..2ea89818c0 100644
--- a/usr/src/cmd/svc/svcs/Makefile
+++ b/usr/src/cmd/svc/svcs/Makefile
@@ -34,7 +34,7 @@ include ../../Makefile.cmd
 include ../../Makefile.ctf
 
 POFILE =	$(PROG)_all.po
-LDLIBS +=	-lcontract -lscf -luutil -lumem -lnvpair -lzonecfg
+LDLIBS +=	-lcontract -lscf -luutil -lumem -lnvpair -lzonecfg -lsasl
 CPPFLAGS += -I ../common
 
 lint := LINTFLAGS = -mux
diff --git a/usr/src/cmd/svc/svcs/explain.c b/usr/src/cmd/svc/svcs/explain.c
index 533437cbee..41ba1b3b47 100644
--- a/usr/src/cmd/svc/svcs/explain.c
+++ b/usr/src/cmd/svc/svcs/explain.c
@@ -194,6 +194,7 @@ static char *emsg_invalid_dep;
 
 extern scf_handle_t *h;
 extern char *g_zonename;
+extern char *g_zonealias;
 
 /* ARGSUSED */
 static int
@@ -1994,6 +1995,9 @@ print_service(inst_t *svcp, int verbose)
 	if (g_zonename != NULL)
 		(void) printf(gettext("  Zone: %s\n"), g_zonename);
 
+	if (g_zonealias != NULL)
+		(void) printf(gettext(" Alias: %s\n"), g_zonealias);
+
 	stime = svcp->stime.tv_sec;
 	tmp = localtime(&stime);
 
diff --git a/usr/src/cmd/svc/svcs/svcs.c b/usr/src/cmd/svc/svcs/svcs.c
index ad88b05b37..39caabb7d5 100644
--- a/usr/src/cmd/svc/svcs/svcs.c
+++ b/usr/src/cmd/svc/svcs/svcs.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2013, Joyent, Inc. All rights reserved.
  * Copyright (c) 2015, 2016 by Delphix. All rights reserved.
  */
 
@@ -60,6 +60,7 @@
 #include <sys/ctfs.h>
 #include <sys/stat.h>
 
+#include <sasl/saslutil.h>
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -135,6 +136,9 @@ static int first_paragraph = 1;		/* For -l mode. */
 static char *common_name_buf;		/* Sized for maximal length value. */
 char *locale;				/* Current locale. */
 char *g_zonename;			/* zone being operated upon */
+char *g_zonealias;			/* alias for zone, if any */
+static char g_aliasdec[MAXPATHLEN / 4 * 3];	/* decoded zone alias buffer */
+static char g_aliasbuf[MAXPATHLEN];	/* base64 encoded zone alias buffer */
 
 /*
  * Pathname storage for path generated from the fmri.
@@ -241,7 +245,25 @@ ht_free(void)
 static void
 ht_init(void)
 {
-	assert(ht_buckets == NULL);
+	if (ht_buckets != NULL) {
+		/*
+		 * If we already have a hash table (e.g., because we are
+		 * processing multiple zones), destroy it before creating
+		 * a new one.
+		 */
+		struct ht_elem *elem, *next;
+		int i;
+
+		for (i = 0; i < ht_buckets_num; i++) {
+			for (elem = ht_buckets[i]; elem != NULL; elem = next) {
+				next = elem->next;
+				free((char *)elem->fmri);
+				free(elem);
+			}
+		}
+
+		free(ht_buckets);
+	}
 
 	ht_buckets_num = 8;
 	ht_buckets = safe_malloc(sizeof (*ht_buckets) * ht_buckets_num);
@@ -554,7 +576,7 @@ get_restarter_time_prop(scf_instance_t *inst, const char *pname,
 	int r;
 
 	r = inst_get_single_val(inst, SCF_PG_RESTARTER, pname, SCF_TYPE_TIME,
-	    tvp, NULL, ok_if_empty ? EMPTY_OK : 0, 0, 1);
+	    tvp, 0, ok_if_empty ? EMPTY_OK : 0, 0, 1);
 
 	return (r == 0 ? 0 : -1);
 }
@@ -1651,7 +1673,7 @@ sprint_stime(char **buf, scf_walkinfo_t *wip)
 		    SCF_PROPERTY_STATE_TIMESTAMP, &tv, 0);
 	} else {
 		r = pg_get_single_val(wip->pg, SCF_PROPERTY_STATE_TIMESTAMP,
-		    SCF_TYPE_TIME, &tv, NULL, 0);
+		    SCF_TYPE_TIME, &tv, 0, 0);
 	}
 
 	if (r != 0) {
@@ -1703,7 +1725,7 @@ sortkey_stime(char *buf, int reverse, scf_walkinfo_t *wip)
 		    SCF_PROPERTY_STATE_TIMESTAMP, &tv, 0);
 	else
 		r = pg_get_single_val(wip->pg, SCF_PROPERTY_STATE_TIMESTAMP,
-		    SCF_TYPE_TIME, &tv, NULL, 0);
+		    SCF_TYPE_TIME, &tv, 0, 0);
 
 	if (r == 0) {
 		int64_t sec;
@@ -2517,7 +2539,7 @@ print_detailed(void *unused, scf_walkinfo_t *wip)
 			    gettext("next_state"), buf);
 
 		if (pg_get_single_val(rpg, SCF_PROPERTY_STATE_TIMESTAMP,
-		    SCF_TYPE_TIME, &tv, NULL, 0) == 0) {
+		    SCF_TYPE_TIME, &tv, 0, 0) == 0) {
 			stime = tv.tv_sec;
 			tmp = localtime(&stime);
 			for (tbsz = 50; ; tbsz *= 2) {
@@ -3665,6 +3687,24 @@ again:
 		assert(opt_zone == NULL || zids == NULL);
 
 		if (opt_zone == NULL) {
+			zone_status_t status;
+
+			if (zone_getattr(zids[zent], ZONE_ATTR_STATUS,
+			    &status, sizeof (status)) < 0 ||
+			    status != ZONE_IS_RUNNING) {
+				/*
+				 * If this zone is not running or we cannot
+				 * get its status, we do not want to attempt
+				 * to bind an SCF handle to it, lest we
+				 * accidentally interfere with a zone that
+				 * is not yet running by looking up a door
+				 * to its svc.configd (which could potentially
+				 * block a mount with an EBUSY).
+				 */
+				zent++;
+				goto nextzone;
+			}
+
 			if (getzonenamebyid(zids[zent++],
 			    zonename, sizeof (zonename)) < 0) {
 				uu_warn(gettext("could not get name for "
@@ -3687,18 +3727,46 @@ again:
 			uu_die(gettext("invalid zone '%s'\n"), g_zonename);
 
 		scf_value_destroy(zone);
+
+		/*
+		 * On SmartOS, there may be a base64-encoded string attribute
+		 * named 'alias' associated with this zone.  This alias is
+		 * useful, so we attempt to make it available when we are
+		 * displaying -xZ output.  If it's not available or not
+		 * decodable, we just ignore it.
+		 */
+		if (g_zonename != NULL) {
+			unsigned len;
+			struct zone_attrtab zattrs;
+			zone_dochandle_t zhdl = zonecfg_init_handle();
+
+			bzero(&zattrs, sizeof (zattrs));
+			(void) strcpy(zattrs.zone_attr_name, "alias");
+
+			if (zhdl != NULL &&
+			    zonecfg_get_handle(g_zonename, zhdl) == Z_OK &&
+			    zonecfg_lookup_attr(zhdl, &zattrs) == Z_OK &&
+			    zonecfg_get_attr_string(&zattrs, g_aliasbuf,
+			    sizeof (g_aliasbuf)) == Z_OK &&
+			    sasl_decode64(g_aliasbuf, strlen(g_aliasbuf),
+			    g_aliasdec, sizeof (g_aliasdec), &len) == SASL_OK) {
+				g_aliasdec[len] = '\0';
+				g_zonealias = g_aliasdec;
+			} else {
+				g_zonealias = NULL;
+			}
+			zonecfg_fini_handle(zhdl);
+		}
 	}
 
 	if (scf_handle_bind(h) == -1) {
 		if (g_zonename != NULL) {
-			uu_warn(gettext("Could not bind to repository "
+			if (show_zones)
+				goto nextzone;
+
+			uu_die(gettext("Could not bind to repository "
 			    "server for zone %s: %s\n"), g_zonename,
 			    scf_strerror(scf_error()));
-
-			if (!show_zones)
-				return (UU_EXIT_FATAL);
-
-			goto nextzone;
 		}
 
 		uu_die(gettext("Could not bind to repository server: %s.  "
@@ -3757,7 +3825,7 @@ again:
 
 	if (opt_mode == 'L') {
 		if ((err = scf_walk_fmri(h, argc, argv, SCF_WALK_MULTIPLE,
-		    print_log, NULL, &exit_status, uu_warn)) != 0) {
+		    print_log, NULL, errarg, errfunc)) != 0) {
 			uu_warn(gettext("failed to iterate over "
 			    "instances: %s\n"), scf_strerror(err));
 			exit_status = UU_EXIT_FATAL;
diff --git a/usr/src/cmd/tail/Makefile b/usr/src/cmd/tail/Makefile
index 52e433c7be..25a5e735db 100644
--- a/usr/src/cmd/tail/Makefile
+++ b/usr/src/cmd/tail/Makefile
@@ -21,6 +21,7 @@ OBJS=		forward.o misc.o read.o reverse.o tail.o
 SRCS=	 	$(OBJS:%.o=%.c)
 
 include ../Makefile.cmd
+include ../Makefile.ctf
 
 CLOBBERFILES=	$(PROG)
 CPPFLAGS +=        -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
@@ -43,6 +44,10 @@ $(PROG):	$(OBJS)
 	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
 	$(POST_PROCESS)
 
+%.o: %.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
 install: all .WAIT $(ROOTPROG) $(ROOTXPG4PROG)
 
 $(ROOTXPG4PROG):
diff --git a/usr/src/cmd/truss/print.c b/usr/src/cmd/truss/print.c
index 14472f22c3..fad3a52ecd 100644
--- a/usr/src/cmd/truss/print.c
+++ b/usr/src/cmd/truss/print.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2015, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc. All rights reserved.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -874,7 +874,9 @@ prt_mc4(private_t *pri, int raw, long val) /* print memcntl() (4th) argument */
 			return;
 
 		case MC_SYNC:
-			if ((val & ~(MS_SYNC|MS_ASYNC|MS_INVALIDATE)) == 0) {
+			if ((val &
+			    ~(MS_SYNC|MS_ASYNC|MS_INVALIDATE|MS_INVALCURPROC))
+			    == 0) {
 				*(s = pri->code_buf) = '\0';
 				if (val & MS_SYNC)
 					(void) strlcat(s, "|MS_SYNC", CBSIZE);
@@ -883,6 +885,9 @@ prt_mc4(private_t *pri, int raw, long val) /* print memcntl() (4th) argument */
 				if (val & MS_INVALIDATE)
 					(void) strlcat(s, "|MS_INVALIDATE",
 					    CBSIZE);
+				if (val & MS_INVALCURPROC)
+					(void) strlcat(s, "|MS_INVALCURPROC",
+					    CBSIZE);
 			}
 			break;
 
@@ -2091,6 +2096,8 @@ udp_optname(private_t *pri, long val)
 	case UDP_EXCLBIND:		return ("UDP_EXCLBIND");
 	case UDP_RCVHDR:		return ("UDP_RCVHDR");
 	case UDP_NAT_T_ENDPOINT:	return ("UDP_NAT_T_ENDPOINT");
+	case UDP_SRCPORT_HASH:		return ("UDP_SRCPORT_HASH");
+	case UDP_SND_TO_CONNECTED:	return ("UDP_SND_TO_CONNECTED");
 
 	default:			(void) snprintf(pri->code_buf,
 					    sizeof (pri->code_buf), "0x%lx",
@@ -2539,7 +2546,7 @@ prt_zga(private_t *pri, int raw, long val)
 		case ZONE_ATTR_BOOTARGS:	s = "ZONE_ATTR_BOOTARGS"; break;
 		case ZONE_ATTR_BRAND:	s = "ZONE_ATTR_BRAND"; break;
 		case ZONE_ATTR_FLAGS:	s = "ZONE_ATTR_FLAGS"; break;
-		case ZONE_ATTR_PHYS_MCAP: s = "ZONE_ATTR_PHYS_MCAP"; break;
+		case ZONE_ATTR_DID:	s = "ZONE_ATTR_DID"; break;
 		}
 	}
 
diff --git a/usr/src/cmd/truss/systable.c b/usr/src/cmd/truss/systable.c
index fb1d3f7a14..b063a6e46e 100644
--- a/usr/src/cmd/truss/systable.c
+++ b/usr/src/cmd/truss/systable.c
@@ -29,6 +29,9 @@
 
 /* Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved. */
 
+/*
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
+ */
 #include <stdio.h>
 #include <stdlib.h>
 #include <fcntl.h>
@@ -1716,9 +1719,10 @@ const char * const afcodes[] = {
 	"POLICY",	/* 29 */
 	"RDS",		/* 30 */
 	"TRILL",	/* 31 */
-	"PACKET"	/* 32 */
+	"PACKET",	/* 32 */
+	"LX_NETLINK"	/* 33 */
 };
-#if MAX_AFCODES != 33
+#if MAX_AFCODES != 34
 #error Need to update address-family table
 #endif
 
diff --git a/usr/src/cmd/ucodeadm/Makefile b/usr/src/cmd/ucodeadm/Makefile
index 1abe8bb420..fe30d02a27 100644
--- a/usr/src/cmd/ucodeadm/Makefile
+++ b/usr/src/cmd/ucodeadm/Makefile
@@ -39,13 +39,6 @@ include	../Makefile.cmd
 POFILE = ucodeadm_all.po
 POFILES = $(PROG_OBJS:%.o=%.po)
 
-INTEL_UCODE_FILE = intel-ucode.txt
-AMD_UCODE_FILE = amd-ucode.bin
-
-ROOTUCODEPATH = $(ROOT)/platform/i86pc/ucode
-ROOTINTELUCODE = $(INTEL_UCODE_FILE:%=$(ROOTUCODEPATH)/%)
-ROOTAMDUCODE = $(AMD_UCODE_FILE:%=$(ROOTUCODEPATH)/%)
-
 CPPFLAGS = -I../../common -I../../uts/common
 CFLAGS	+= $(CCVERBOSE)
 CERRWARN += -_gcc=-Wno-uninitialized
@@ -57,9 +50,6 @@ LDLIBS += -lgen
 DIRMODE = 0755
 FILEMODE = 0555
 
-$(ROOTINTELUCODE) := FILEMODE = 0444
-$(ROOTAMDUCODE) := FILEMODE = 0444
-
 install := TARGET = install
 clobber := TARGET = clobber
 
@@ -69,7 +59,7 @@ CLEANFILES += $(PROG) $(OBJS) ucode_errno.c $(POFILES) $(POFILE)
 
 all: $(PROG)
 
-install: all $(ROOTUSRSBINPROG) $(ROOTUCODEPATH) $(ROOTINTELUCODE) $(ROOTAMDUCODE)
+install: all $(ROOTUSRSBINPROG)
 
 _msg: ucodeadm_all.po
 
@@ -81,12 +71,6 @@ $(PROG): $(OBJS) ucode_errno.c
 	$(LINK.c) -o $(PROG) $(OBJS) $(LDLIBS)
 	$(POST_PROCESS)
 
-$(ROOTUCODEPATH):
-	$(INS.dir)
-
-$(ROOTUCODEPATH)/%: %
-	$(INS.file)
-
 clean:
 	-$(RM) $(CLEANFILES)
 
diff --git a/usr/src/cmd/ucodeadm/intel-ucode.txt b/usr/src/cmd/ucodeadm/intel-ucode.txt
deleted file mode 100644
index 3c0d466d23..0000000000
--- a/usr/src/cmd/ucodeadm/intel-ucode.txt
+++ /dev/null
@@ -1,30272 +0,0 @@
-/+++
-/       Copyright (c) <1995-2010>, Intel Corporation.
-/	All rights reserved.
-/
-/	Redistribution. Redistribution and use in binary form, without modification, are
-/	permitted provided that the following conditions are met:
-/		.Redistributions must reproduce the above copyright notice and the following
-/	disclaimer in the documentation and/or other materials provided with the
-/	distribution.
-/		.Neither the name of Intel Corporation nor the names of its suppliers may be used
-/	to endorse or promote products derived from this software without specific prior
-/	written permission.
-/		.No reverse engineering, decompilation, or disassembly of this software is
-/	permitted.
-/		."Binary form" includes any format commonly used for electronic conveyance
-/	which is a reversible, bit-exact translation of binary representation to ASCII or
-/	ISO text, for example, "uuencode."
-/
-/	DISCLAIMER. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT
-/	HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED
-/	WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-/	WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-/	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
-/	OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-/	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-/	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-/	LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-/	CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
-/	STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-/	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
-/	ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-/
-/---
-/*  Tue Feb 9 12:54:50 CST 2010  */
-/*  727-MU168313.inc  */
-0x00000001,	0x00000013,	0x02062001,	0x00000683,
-0x2f0da1b0,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xbf5ad468,	0xc79f5237,	0xbd53889e,	0x896bfd13,
-0x7adc0c8f,	0x44e9e0bc,	0x1a331fc9,	0x00b0f479,
-0x53e9ceb3,	0xb14131a4,	0x39fc8310,	0x6993ee0d,
-0xdb0c59b4,	0x67f24fd0,	0x63e83516,	0x0a4d411d,
-0xb86a4294,	0x72c2edc5,	0xc543c5df,	0x7f3dd290,
-0x2fb772ec,	0x9a2931bb,	0xefc2e759,	0x2f5939eb,
-0xc37aa9d5,	0xd6d46fcf,	0xaf6ef51e,	0x5c3b48ed,
-0xec51da4d,	0x6c8a6d59,	0x66ecfeb7,	0x3698ead8,
-0x00ba31f3,	0x98f1a1fa,	0x2d015e7d,	0x5599cff2,
-0x3106cde9,	0xdc0160f0,	0x14b213c3,	0xbd29458f,
-0xa849c192,	0x2edfe235,	0x6dd8c4d5,	0xbd204f8c,
-0xb4abfb0b,	0x173e7eb0,	0xf9540357,	0xd5357562,
-0x680702f8,	0x7bb8d06c,	0x271009cb,	0xdbe0f120,
-0x3838ab66,	0xd6baf0c6,	0xbfe956e0,	0x1de10bf6,
-0xb89aa364,	0x75a4e75d,	0x8dbb1611,	0xe7ad829f,
-0x7f240c7b,	0x1e7a25e1,	0x2bb32a9b,	0xa4d82b67,
-0x826137cc,	0x56742108,	0xace9b137,	0x023edadb,
-0x4cbf6d68,	0xfdf37a0a,	0xc376fa28,	0xe89004db,
-0xc1eae782,	0xa4a9446c,	0x1b90d7b9,	0x2bfd32c1,
-0x329eaff3,	0x4a718a99,	0x4ca2abf3,	0x7ba47de1,
-0x18a70488,	0xf6952f0d,	0x84820198,	0x4f3c26eb,
-0x5b94c8f6,	0x41f125fb,	0x5989354f,	0x7d044bf6,
-0x184e2f6f,	0x341a42aa,	0xb45e5675,	0xcf50a3f6,
-0x278ba361,	0x8ca26a33,	0x59135ca2,	0xca8da559,
-0xfc7f5d55,	0x051e181b,	0xc625547a,	0x118fae7c,
-0x2fedef02,	0x08db6c79,	0x80e1e8cf,	0xf4381bc1,
-0x1f7950b0,	0xe696234e,	0x6b81a924,	0xf16adb3b,
-0x9ef0b2eb,	0xcefbee01,	0xc14bc102,	0x04f53303,
-0x24414c5d,	0x6de5becb,	0xfefd46a4,	0x181501d3,
-0xca96281b,	0x8a5d854a,	0xd32c4217,	0xf6465a87,
-0xedd6d554,	0x5af2e656,	0x25c927e7,	0x2b939e69,
-0x3d8a1258,	0x0d4dff51,	0x393fe7bb,	0x053ca46f,
-0xfffc4059,	0x7bad6cc0,	0x5f470b94,	0x4c3c8cc6,
-0xc3979d0d,	0x79f13dac,	0xc5541810,	0xc91f8b1b,
-0xdd622585,	0x089523bf,	0xfa92b3a9,	0x70297814,
-0xe73f7917,	0xd6a9e6ac,	0x17808b44,	0x55067c05,
-0xd624bead,	0xb1e38e74,	0x194dec06,	0xbdb4056d,
-0x776ea5b2,	0x6728235c,	0xdf8d95ee,	0xcce51e11,
-0x90bc5b43,	0x3cef9c3b,	0x6a16b438,	0x45f6d2bc,
-0xaa75e5ed,	0x4b8af156,	0xc4f7b910,	0x26d01e03,
-0x1cc57123,	0x4a944bab,	0x999a8a33,	0x2206c5c5,
-0x0e98c46c,	0x9991c412,	0xd604b138,	0xd5fb4854,
-0x8d6443a5,	0x9556ef42,	0xb0fa163f,	0x86711b0d,
-0xce8093ec,	0x6e0d0ec8,	0x25419efb,	0xd0f63d95,
-0xe6958c51,	0x2e1cf5a2,	0x2c4e7322,	0x6f85dfa9,
-0x9edcdd4e,	0x5a90e4cc,	0x3490caf7,	0x6b54688c,
-0x701149f7,	0x81252786,	0x94a7a283,	0x304852f1,
-0x5db80731,	0x4534feca,	0xad089aee,	0xb8d3ffd9,
-0x9bc94a42,	0xac307e67,	0x6990339e,	0xb2a1c6f4,
-0xdad20302,	0x5b5c4292,	0xd40c8dde,	0x61de0def,
-0xdb05e18c,	0x16d838ee,	0x90affbe4,	0x661ea875,
-0xa5b3628a,	0x4c801759,	0xd1d3635f,	0xf52ac3bc,
-0x79664739,	0xd14d049f,	0xf4417688,	0x20ac0ea5,
-0xcbf03121,	0xa9adde2c,	0xcb2ef310,	0x26a34ecb,
-0x166323e0,	0x8fdd8de7,	0x1c4a2440,	0x753bf563,
-0x37881ad6,	0x8c2d6fc3,	0x1d324831,	0x4cb83f53,
-0x07094679,	0xabb242a3,	0xb0fc5053,	0x3b4a1718,
-0xc87b62c4,	0x6f4b76a0,	0xee785187,	0xe91c9908,
-0xf738b92a,	0xbd5061b8,	0xead42904,	0x130b722b,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1637-m5cf4a04.inc  */
-0x00000001,	0x00000004,	0x12142005,	0x00000f4a,
-0x5e7996d9,	0x00000001,	0x0000005c,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x1b07bcc7,	0x229cce65,	0xe59c6d88,	0x368a8eac,
-0x265a5ea8,	0x10ccc72c,	0x87320671,	0x94a92d48,
-0xeb5af331,	0x0d008e26,	0x8df305da,	0x9dde4c6a,
-0x8c99c77d,	0xb29cce43,	0xf878b938,	0xbe6f1c58,
-0xa5642b21,	0xa235f7ed,	0x7246e088,	0x01f50007,
-0x2671ee90,	0x80a25b6b,	0x4906a87b,	0x93feb435,
-0x63376263,	0x2f56135e,	0x2fe6b7cb,	0x47b9e023,
-0x89edd593,	0xa50ea0bd,	0x88b4c598,	0xe8049dce,
-0xc3a5caef,	0x66c0c8b3,	0x23fd02d4,	0xae6b76e1,
-0x367b794e,	0xe991df14,	0x99966e37,	0x8c94d969,
-0x03bd493e,	0x9a668e1b,	0x8b03e862,	0x06b3d582,
-0xdbe3e579,	0x8d808793,	0xb8a60a2e,	0xadadc225,
-0x05005e7f,	0x29a8c4b2,	0xf88aa416,	0xa5fe8613,
-0x28399122,	0xa72292cf,	0xd1a3ac3e,	0x0c1ecf12,
-0x243e5147,	0x92d4b766,	0x1ac71ed9,	0x8bc3baca,
-0xe610d668,	0x375b6b2d,	0x2ca4f1d6,	0x399857ca,
-0xae107abb,	0x938d073d,	0x5ad00070,	0x9342bd0d,
-0x536d6790,	0x15d633f0,	0xbb32795e,	0x980ab451,
-0xb664a218,	0xb44415b7,	0xbeb0c093,	0xe5a9f22d,
-0x5879deeb,	0xa416441d,	0x38fe769e,	0x52ea4068,
-0xd5f86736,	0xc9ad814c,	0x1f41d0fe,	0xa8b13c07,
-0x5665f649,	0x50a4a2d0,	0x47e60480,	0x174058f0,
-0x5f9229eb,	0xa9b5c958,	0x8d722a78,	0x82504ca6,
-0xa4f69e86,	0x1165831e,	0x5f3a2776,	0x9da68937,
-0x5587f203,	0xa0dde401,	0xc8b18cd7,	0xd817c5be,
-0x3c64d4c4,	0xb47424b8,	0xf290272d,	0x46f4e8de,
-0xaed74fdb,	0xd6b21df6,	0xa8968c2e,	0xb9224f33,
-0x9043df16,	0x53fe2d31,	0xb51da202,	0x083b1387,
-0xdd470698,	0xb1b66ae2,	0x13cf0cdf,	0xa64ff501,
-0x36baf606,	0x15a8128b,	0x41ee5a81,	0xac05e4ff,
-0x7fd94e1c,	0xa8f227d7,	0x7c81ff00,	0xd8c234c0,
-0xc31aa196,	0x9c9345a5,	0xeff07da3,	0x4c1d9daf,
-0x5f1ce189,	0xefa826ca,	0x5123e316,	0xaad27995,
-0x1e425c1e,	0x45d05042,	0x6b77ccba,	0x66b75e9d,
-0x4b9c3b52,	0x85f95778,	0xb405df56,	0xe537f9df,
-0x404c8e01,	0x6d8dd53c,	0x7f0f05f2,	0xbec561f9,
-0x1a990e16,	0xe8b96bd5,	0x817d06e6,	0xb2001f52,
-0x90c721a9,	0x8e7c8d4e,	0xf4a4cb38,	0x2714865c,
-0x5a851aee,	0x8590dd73,	0x54bbc2c0,	0xaf164bad,
-0xb82559e4,	0x3ec52049,	0x20ab2224,	0x1f2e35a9,
-0xcd5bd10c,	0xa04c7a00,	0x42dadb32,	0x90d47c14,
-0x48e98aa0,	0x0b3faebb,	0xb0d34d9d,	0x90df0308,
-0x052df922,	0x9047a63e,	0x4a7e0ba9,	0x88217146,
-0x0b037fb5,	0x8bcdede1,	0xdb81c283,	0x2bde05fd,
-0xae2c87fb,	0xb4697173,	0x205688d7,	0x810963ae,
-0x2e06be4c,	0x1abf1c0a,	0xbda9cf06,	0x31f1c55c,
-0x52b4759c,	0x89f8da46,	0x41cee81a,	0xa1eeaec2,
-0x4af67f8a,	0x3a20e63a,	0xa2caf5c3,	0x9c3c5779,
-0x2acac8c9,	0x94409ea5,	0xead029b0,	0xb6bcd3c1,
-0x7c41d8f1,	0xbfd61625,	0xe99f0e89,	0x0279bf61,
-0x5d7a4c97,	0xb874dc31,	0x3def7321,	0x9717a1a3,
-0x74dac81c,	0x1fc5bccd,	0x4b121ffd,	0x3c905b5e,
-0x979c8f1b,	0x8db03b46,	0x088163dd,	0xbed0f9ef,
-0x9dd04f9c,	0x05d2be02,	0x464ff266,	0xad2e216a,
-0x6b8568ec,	0x86376635,	0x0e36e6b8,	0xf6cedcfb,
-0xc634e917,	0x996c8a45,	0x2a2a7204,	0x57396ea2,
-0x86e97e5c,	0xd8df2021,	0x27f1544b,	0xbee538d1,
-0x854ac66e,	0x4194e6a1,	0xedca65af,	0x6a96ae01,
-0x4b697f06,	0xa3393627,	0x6aaf7c45,	0xe4ce7b54,
-0xbaf630e7,	0x48c5685a,	0xaf578166,	0x8b4b865f,
-0x9fbe47f5,	0xe6dc5717,	0xe1e6a3f4,	0x88c713dd,
-0x5e095cd9,	0xb8579da1,	0xccb0e009,	0x30893a84,
-0xc9c01f0f,	0xa3afc2d7,	0x568816ef,	0x8e983bd3,
-0x567362ca,	0x103e7a47,	0x504ed286,	0x05e53454,
-0x160d2d34,	0xa78e0961,	0x35de2ff3,	0xb68bb128,
-0x67fe80ec,	0x33f73764,	0x0424a99e,	0xba34b730,
-0x85ba0e83,	0x8a159b32,	0xc3727283,	0x8d012edc,
-0x6ae89a83,	0xb2cc412a,	0x792eb6ca,	0x38337d83,
-0x07c1d766,	0xb5ada859,	0x17e30b6a,	0x9e634e91,
-0x929c0699,	0x026f19f4,	0xa4f8fb5d,	0x9a9d424f,
-0x79c30b93,	0xa3130a5d,	0x68e589c4,	0x027d4ec9,
-0xeef88f03,	0x8afab3b2,	0x4dab76a8,	0x9570708f,
-0xf47bf52a,	0x04d4ef9d,	0x76da08d8,	0x7dc7c531,
-0x4c2d71a9,	0x9952935f,	0x6818527d,	0xdad1c25b,
-0xb8eea89c,	0x7091b5f8,	0x5a333927,	0x865f794c,
-0x36e0a2a6,	0xde431054,	0xe55c0a8a,	0xac41dfd1,
-0x7bb905c7,	0xb19641c9,	0x10fc1be4,	0x038071f4,
-0x3ffe20f4,	0x8af0fb14,	0x87da983f,	0xb6f2dcd0,
-0x1baee9c0,	0x090773cf,	0x85e9fec0,	0x10a1216e,
-0x3ff4c6aa,	0x98916b0e,	0x7fd1d04b,	0x9e8546e2,
-0x7ed1b25b,	0x24c743a1,	0xf52610a3,	0xbe8d47fc,
-0xb40a0dcf,	0xa976fed3,	0x8d6990e7,	0xc6d999bb,
-0xc72b4218,	0xb5667e14,	0x800e6048,	0x559e81ec,
-0x8463a8da,	0xcded36c4,	0xf8214d01,	0x8c9a5bf2,
-0x04b3b511,	0x7f38337a,	0xc1ed0d56,	0x4b4fe2cb,
-0x1ece884f,	0xa9d19d5a,	0x683fee1c,	0xd221e8ad,
-0x328c416a,	0x756b18ee,	0x8481f60b,	0xa9f204cb,
-0x620b2a31,	0xd4266217,	0xf9849baa,	0xd384d524,
-0xa7c8c7a9,	0x9b7e94c3,	0xfb45e191,	0x632547ee,
-0x77feb7fd,	0xd66e5dfc,	0x8d3533fb,	0x97b1f83b,
-0x36c121cf,	0x5fed8787,	0x14bd43ea,	0x24acf846,
-0x279bcc0d,	0x9ffda402,	0xcb0451ba,	0xa671cc89,
-0x0f2ffa41,	0x2479c2f3,	0x8b99c062,	0x839a8212,
-0x814eebd5,	0x8d5ac17d,	0x28ad1e99,	0xb744ee49,
-0x5cc62a5f,	0xa6c2e876,	0xe93c507a,	0x0e838735,
-0x01797001,	0xb6b1e47b,	0x8fcb643d,	0x87274e8b,
-0xcf6ee5d2,	0x1c346645,	0xa241c408,	0x3e434b2a,
-0x5c1e969e,	0xa159f09f,	0x51c24a4e,	0x9ea980d2,
-0xb18a3126,	0x377f54f5,	0x5051635b,	0x88120bf5,
-0x5068c53d,	0x81e91c0b,	0xddbe6afc,	0xace26a65,
-0x89b39b12,	0x9203bac1,	0x30b1e081,	0x0d00f46a,
-0x8dd7bf19,	0x84880bce,	0xfbebc09a,	0xadcd1fe1,
-0xb92bf186,	0x3c0ce7e0,	0x9e1567bd,	0x08e93d8b,
-0x5f3bc65d,	0xbd3213f2,	0x35dff336,	0xb017c028,
-0xa5096cd6,	0x2ec14ded,	0x860021d3,	0x815b7994,
-0x450eec66,	0xbe0468cd,	0xf023c57e,	0xba7f0632,
-0x74ce6861,	0xa3300156,	0x12378195,	0x2902d080,
-0x43670eec,	0xb97e140b,	0x10092553,	0x9621397b,
-0xf9149286,	0x33331ea4,	0x91024d01,	0xce41fa3a,
-0x65596b8e,	0xa146b772,	0x4a65b406,	0x40200f18,
-0xf232bcbc,	0xfd86eb3d,	0xd4b83bfb,	0x8ec7b200,
-0xa9d8490e,	0x42b9b1b0,	0x480bd06a,	0x2dd8f709,
-0x762fedf8,	0xb1083b6f,	0xc7fba09a,	0xbb7a7261,
-0xf624d4eb,	0x118ef882,	0x38230014,	0x8fad6b48,
-0xf500b16a,	0x9116c2a2,	0x0e2a9245,	0x89f6f38d,
-0x9954d6b2,	0xc6db5fcf,	0xe2d103e6,	0x534024b1,
-0xf0bb00df,	0xf15ee38c,	0xa9ea9a03,	0x90597958,
-0x152bdd7b,	0xb5e145da,	0xfd6c72a5,	0x5aa1748f,
-0x86c58ac8,	0x603ad265,	0x5abfe039,	0x25f75b90,
-0x177b6e02,	0xf2dc10fc,	0xf0d32590,	0x9c361b74,
-0x54677a40,	0x5d34ad04,	0xece46599,	0x915f504c,
-0x518acffc,	0x801e0592,	0x491e9bbc,	0x9ea5402f,
-0xe943029b,	0xba9fc7e4,	0x4b6666d7,	0xb5504834,
-0x77cddd8c,	0xbf122e96,	0x665a70e3,	0xc602ba64,
-0xabedcce3,	0x56d38242,	0xeddc0b0a,	0xa8debf0b,
-/*  422-MU26530b.inc  */
-0x00000001,	0x0000000b,	0x05201999,	0x00000653,
-0xe3f50f82,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xa4f21304,	0x1d7bf7d9,	0xb5be812c,	0x1ea46237,
-0x8d811046,	0x0fe67ef6,	0x507754ff,	0x0c97d96c,
-0xdce8311d,	0xe4c2cf96,	0x362d5ea1,	0xaf113121,
-0xac3bde75,	0xbff45249,	0x0e132b97,	0x1401c5ad,
-0xbca78b32,	0x07238147,	0xf31aa8f1,	0xa514cab2,
-0x390ab9e7,	0x0019b113,	0x4d62ccc3,	0x27f077fc,
-0x2fd14c9e,	0x7512326e,	0x47f43060,	0x0d2c1b03,
-0x6c2ceaab,	0xcd57b37e,	0x4231a8d0,	0xa104c588,
-0x1d2cecae,	0x5bdbf092,	0xce711c6a,	0x81f297b9,
-0x3eb2dad7,	0xf20bda6f,	0xfb1efa44,	0xb00434be,
-0x12742e89,	0x08354c21,	0x88f6f908,	0x476c66c6,
-0x06eb9ded,	0xdcea60f0,	0xe0f48c3f,	0x3ea169fb,
-0x15a1e00c,	0xfa7ef115,	0xa9a5d23d,	0x38da8793,
-0x6b1ae52d,	0x1be30123,	0x0fb921e3,	0x87688811,
-0x45b02f33,	0xa002e5ef,	0xdcf91775,	0x29fe20bb,
-0x6d886079,	0x3b01080b,	0x2845931b,	0x56f0bdc0,
-0xe7f97853,	0xaa51555b,	0x3fdefce6,	0x9231d0d5,
-0x34695b1c,	0x7071e3c2,	0xfc1eefb6,	0x65ed91cf,
-0xa30f9193,	0xa951e706,	0xf28168de,	0xea7cca1a,
-0x00ad260c,	0x482dcab1,	0x7074f431,	0x82255d72,
-0x52225c8a,	0xfcd447ee,	0xc8430fcb,	0xed713c21,
-0xe05a800d,	0x9ffb7c19,	0x680a7a9a,	0x4ebdcfd6,
-0x8e9c8c59,	0x72cce044,	0x87289c8b,	0x691ebdc2,
-0x7dd25e97,	0x284a8c8e,	0x25248a91,	0xb73b016a,
-0xf4780147,	0x0c870606,	0x81bf5462,	0xf2b76112,
-0x896e6d44,	0xc75bf85a,	0xb1889a71,	0xe9c07ab3,
-0xdd6be9cd,	0x9481207c,	0x6df36c80,	0x019c493b,
-0x9664fa7c,	0xfe29655a,	0x8e3c380f,	0xe827afd8,
-0x14a411e5,	0xd6ecf9cc,	0x08698f98,	0x76cdac6c,
-0xca73193d,	0x3db85e3e,	0x9827cfc4,	0x7d80d459,
-0xa52c24cc,	0x1b415086,	0xf732e136,	0xf121c28c,
-0xee8a984b,	0x2ffa66b6,	0x028df8c1,	0x583c2a59,
-0x940835cc,	0x11f3141d,	0x3f3f4ec1,	0xdee86cf0,
-0xc85794d2,	0x83e377bc,	0x697d6c3a,	0x54cc8278,
-0x1d0512ce,	0xafd73aad,	0x22fbe58e,	0x586d29a0,
-0x7247bd99,	0x77eee287,	0x13584559,	0xc2fd6bf2,
-0x310bba13,	0xf9b0a166,	0xf7d32176,	0x21426813,
-0x56c2da83,	0x13e49126,	0x7a557e54,	0x4c8a8f84,
-0x838f3992,	0x0ec6d554,	0x8aa5856f,	0xcd1935bf,
-0x01614664,	0x54b01c3d,	0x17a7cdd6,	0xaec2cb3d,
-0x4bc9c3e4,	0x6645b33c,	0xfced3b87,	0x4e5dd898,
-0x45d1dbb7,	0xb60e6b5f,	0xa7e938ce,	0xe4e1bcde,
-0x4f400eb1,	0x4dbdc103,	0xf1608c91,	0x5b05c4b5,
-0xfecd782b,	0xe3106e25,	0xabbb7bb0,	0x0ba21681,
-0xcca215e2,	0xefc41853,	0x67c969eb,	0xb8cb9dc2,
-0xbd1089ed,	0x5df85c48,	0x31c7c77f,	0x3f14b936,
-0x3396d664,	0xb09b91b2,	0xd2970963,	0xc97ee590,
-0x6344c8c2,	0x3d999973,	0xb74e5d5e,	0xebd9eb93,
-0x3d536a87,	0xda39bf3d,	0x8a899c61,	0x8cfbdf63,
-0x41ee792e,	0x43a38712,	0x4851037d,	0x3ee0c77b,
-0x82062189,	0x597faf60,	0xb95e3a07,	0x2a276757,
-0xd52941c6,	0x2c1bdd08,	0xf9f47a55,	0x4508305a,
-0x9f38c11b,	0x863b657b,	0x567be75c,	0xa5f37533,
-0x05ce6cb1,	0xe29f6533,	0xaf889424,	0x8c4a9cf3,
-0x159d8b70,	0x473abecb,	0x41df09f1,	0x6bd38e85,
-0x65e45213,	0x04688358,	0x2e6e5f0c,	0x94335dd2,
-0xec7d3761,	0x0db43819,	0x4dfae8d5,	0xd061ca76,
-0x225c1d2e,	0xd5da0bd3,	0x61936693,	0xc6b7b73e,
-0x6604eb97,	0x9993f5f6,	0x44f2f4ca,	0x2236e62d,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1498-m5df4a02.inc  */
-0x00000001,	0x00000002,	0x06102005,	0x00000f4a,
-0xdfbc9997,	0x00000001,	0x0000005d,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x1b07bcc7,	0x229cce65,	0xe3946d89,	0x368a8eaa,
-0x8b8a4197,	0x2e048664,	0x48078928,	0x0aa749ae,
-0x1cee9215,	0x22910485,	0x3d030824,	0x15cb61f8,
-0x7fff14fa,	0x35c7b714,	0x1d489846,	0x5d8ff7da,
-0xe237595f,	0x35e48e39,	0x4540e8d1,	0x45c15a5c,
-0x3356fc26,	0x5d5386e8,	0x926d41b3,	0x10ca2831,
-0x904bdf7f,	0x463e806b,	0xb22aa067,	0xaff8872c,
-0xb5260171,	0x1b4bdd54,	0x6582202e,	0xaceff700,
-0x56cfda08,	0x8a39f2a7,	0xf1c0e97f,	0x05fe76a0,
-0xca6b4d0e,	0x9f33f9ea,	0x0495ba8a,	0x31380f84,
-0xda4d936b,	0x2597f34c,	0x523aedf7,	0x22df0035,
-0x15acc8e4,	0x23663293,	0xe869afdd,	0x1f23378d,
-0x71a210f8,	0x091c942e,	0x5578f30d,	0xe4be34eb,
-0xfd9927f3,	0x01200031,	0x0d76398e,	0xe46f9840,
-0x8e29a1c5,	0xcfcd5407,	0xc93c0b1d,	0x3675504a,
-0x49fec6a2,	0xf172670c,	0xc264f82e,	0x527393bd,
-0xba750da9,	0x11bb3f31,	0x386d6943,	0x7e02c181,
-0xdf1156af,	0x59bd57ca,	0x9241d631,	0x2bc328f0,
-0xd7bbc782,	0x51d62827,	0x56258a65,	0xe9f0ede9,
-0xa35ed86c,	0x1ffb6be0,	0x0395e246,	0xe7f35b66,
-0x70be025e,	0xff1171d3,	0xae761e69,	0x2af9dce5,
-0xda799a78,	0xe0bded96,	0x4d4688f0,	0xc79b0a5a,
-0xd449c23a,	0x016970ba,	0xf34363b6,	0xe6e1d420,
-0x79320e33,	0xcdd5afa7,	0xfe0fd414,	0x033a16e5,
-0x109c7655,	0xc87a1e62,	0xd78f9c37,	0x682c1113,
-0x2ae57d31,	0x09256fe2,	0x11ffc988,	0x465258dc,
-0xb2dc55ce,	0x5d61a5e4,	0xaab3d80a,	0x19c93aac,
-0x642c1dd3,	0x45999943,	0x46640bc6,	0xd7a6a658,
-0x4a1c0ae3,	0x1ce268e9,	0x83f92440,	0xdbe37cd4,
-0xf589f5a2,	0xcf8915df,	0x593f5d12,	0x3abb579a,
-0xf92f9d43,	0xd32ba114,	0xc158dd67,	0x26e44425,
-0x0c16231b,	0x0846ff42,	0x9a1c72ee,	0x3e7f9e9a,
-0x00d036f6,	0x3a37204f,	0x3ab32667,	0x39c36227,
-0x729b7436,	0x1979daac,	0x14791793,	0xe4b8d8fb,
-0xfd25a4f7,	0x1d1bb5a8,	0x69f8fd39,	0xeb75da5a,
-0x2c090ba5,	0xdcece5af,	0x98101e50,	0x3699a493,
-0x7d8b6c58,	0xc0eac9bb,	0x93b47842,	0xbaf68e38,
-0x81b9c8f5,	0x3263cddc,	0xc123e7a4,	0xaf0c43d7,
-0xe080005f,	0xb7d5b466,	0x943bfb69,	0x35f75e4e,
-0x979853ab,	0xa2602607,	0xdb30f012,	0x866a297e,
-0x76f717d3,	0x162e026b,	0x976d9c8e,	0xbf364947,
-0xc90b79fe,	0xb08b69cd,	0x8f666cd0,	0x00785cd5,
-0xae0dc87a,	0xa73192d2,	0x42290c62,	0x3dc06187,
-0x3a2270f3,	0x2f33ebc4,	0xb2afac90,	0x2550f035,
-0x2a22a7b7,	0x209b09b6,	0x9672bff5,	0x24b1305a,
-0x861a16f0,	0x24d11771,	0x58bfa270,	0xd6692269,
-0x257857a3,	0x032562fc,	0x9cf4edd6,	0xfefe9d20,
-0xf57a5c91,	0xd3d75b0e,	0x01c72ec4,	0x3fa13568,
-0xc454a4d0,	0xc90f813b,	0xd9181420,	0x494627bb,
-0x7c164810,	0x0a00ccdc,	0x3d9ab2a2,	0x4848efd3,
-0x31584e6f,	0x48a0ed58,	0x0db818fb,	0x177138e1,
-0x897d1cbb,	0x7244d929,	0xb3f4a431,	0xb6e60dfc,
-0x8645e9ea,	0x3252a53c,	0x5964ccc9,	0xad76be63,
-0x59027581,	0x83b0fa2e,	0xa5b9346c,	0x2082efd0,
-0xb1bcaf19,	0xb98dfdd9,	0x45e082ca,	0x8c200986,
-0xe193eaad,	0x39bef164,	0x99c468b8,	0x805bdaa7,
-0x22d12bfe,	0xa90be671,	0x6f6d8506,	0x010af4e2,
-0xa8759e49,	0xa3206b70,	0xe9a0be66,	0x139dfd01,
-0x2291dc47,	0x0eec7d63,	0xcbee9187,	0x193b21c2,
-0xffa47a38,	0x2fd0eba8,	0x955f4a43,	0x343b16d1,
-0xa5d61063,	0x33533ce6,	0x4c9e7f08,	0x270ef845,
-0x6252c02c,	0x04e4867c,	0xe26693b6,	0x3620ab00,
-0x04371508,	0x0c2dcd08,	0xb0052ff9,	0x1f24f775,
-0xaadf6a7f,	0x2cd5a94d,	0x2a4df4f0,	0xd98aa865,
-0x754e7b50,	0x13f68eaf,	0x9d7489c8,	0xe7199de3,
-0xda23e0e0,	0xdea52f5a,	0x2abf6046,	0x38ece5a4,
-0x73c54818,	0xd56dea08,	0x859b323e,	0x217c80b9,
-0x626c662b,	0x28cdd1e5,	0x0f0b167c,	0x1cc59430,
-0xb479422f,	0x2dcd0493,	0x332b94da,	0x00c77995,
-0x89c54496,	0x0d850c7b,	0xe053a358,	0x92f97427,
-0xf125c08c,	0x21594f5f,	0x3368cc3b,	0xa2600fbf,
-0xc881574c,	0xa39d7f58,	0x84470209,	0x18f6adb4,
-0xed0fedf8,	0xbeec6bf8,	0x798839df,	0x20581100,
-0x995ad6e6,	0x1eaaefd4,	0x004a1667,	0x2177b9ce,
-0xda36efb8,	0x0ab93b96,	0x5afb7c0a,	0x23479016,
-0xf104b17c,	0x01cfe9f8,	0x56281be4,	0xbaf663ff,
-0xfabb9f77,	0x029a7ab4,	0xef4fa0b3,	0x83621100,
-0xebbe19f9,	0xaff0c53c,	0x6595a5cd,	0x0ef6c50b,
-0xa314b2b4,	0xb18e55c2,	0x4f55d25d,	0x4f6b1c08,
-0x566ae376,	0x3fe466d9,	0x2fc3212c,	0x747b503d,
-0xd827e8e3,	0x44a650e1,	0x84efebb5,	0x0627dd27,
-0xd482b6b6,	0x7c1838e2,	0x57406963,	0x9ba188ec,
-0x6bb9a021,	0x1cac0354,	0xc5204396,	0xa904294b,
-0xd3cf32c7,	0xb9b0ddb8,	0xd95a73df,	0x0076a769,
-0x92fbd38f,	0x88565d4e,	0x7423461b,	0x5880eef2,
-0x143ec991,	0x30bd7869,	0x52b18056,	0x46dfc608,
-0xbff8d798,	0x5ac07642,	0x78638c18,	0x285a786b,
-0xe16c63b2,	0x577a5552,	0xe2964f27,	0xd16173de,
-0xe471135b,	0x16d8cb8a,	0xf2723bf2,	0xc893d60c,
-0x7479a756,	0xe2a5141d,	0xd36cf5fa,	0x3019dc20,
-0x905c02f0,	0xee801166,	0x540c1adf,	0x639cbe17,
-0x92fc96f1,	0x19fc363f,	0x319b5d51,	0x78a939b1,
-0x8f472c1e,	0x7642bddc,	0xfc32257f,	0x07850fb3,
-0xf3df106a,	0x55f29d11,	0x0f920214,	0xe2718970,
-0x72f6ec29,	0x2d54fc8f,	0x2bc67fdb,	0xf3021bcb,
-0x9d068426,	0xfdbf6707,	0xd66932bf,	0x1f66f54e,
-0x256dad97,	0xdad0f681,	0x5ef863a0,	0x06f06efc,
-0xae8c4b97,	0x20d14729,	0xd0b1cd56,	0x13847b3c,
-0xbcc3719a,	0x025dc7bc,	0x90df4cbe,	0x1b1ae1f8,
-0xad2951ed,	0x2b40ff4c,	0x759faaea,	0xef240c6b,
-0x8e876989,	0x3847bb55,	0x00ee9bbf,	0xe2fa917b,
-0x93760e59,	0xc07f19dc,	0x1671842f,	0x2b125b94,
-0x61519c4f,	0xc89f48b8,	0x140e76a7,	0x7d685a3a,
-0xe09c619a,	0x24f25b96,	0xf01b11ec,	0x621dbc3b,
-0x5344e695,	0x55bef93f,	0xe521809b,	0x0283fba4,
-0x18214b19,	0x545ede9f,	0x77c30256,	0xdef3400c,
-0x15358782,	0x135239b4,	0x8c9f4e10,	0xd3785c06,
-0xc8523088,	0xfdc3475a,	0x021c3b30,	0x23c63b6d,
-0xf85e8681,	0xd9e8aeef,	0x30671e47,	0x70d63032,
-0x9b5f73b7,	0x1073c5eb,	0x85a7cf9e,	0x61e6a62b,
-0xad00cc55,	0x4e911223,	0xd564fe80,	0x06a5ae6c,
-0x54021cbc,	0x65e3463d,	0x4d3415c8,	0x868e6ee9,
-0xe5185dda,	0x2bfac1de,	0x5620e9f7,	0xbf461c29,
-0x76cab399,	0xbec619be,	0x6dc45229,	0x1313cd52,
-0x24041989,	0xa3d3876e,	0xb470eca3,	0x3427ab15,
-0x1900f564,	0x02666a5a,	0x857b8bf6,	0x09949203,
-0x20092549,	0x0eb9167f,	0xb6d7111f,	0x2af5715c,
-0x05393ff4,	0x139a0b4a,	0xcc81065b,	0x94c4157d,
-0xca738627,	0x4ab2cda9,	0x9c822455,	0xb1d07b41,
-0x40f6d839,	0x86bcfd3e,	0xde9437b5,	0xfc9cb6c5,
-0x46065444,	0x3cae20fb,	0x6dadbf69,	0x6b53ab8e,
-0x19d8ad42,	0x100ef7f4,	0xb63eff85,	0xf916a193,
-0xd39e525d,	0xaab2c818,	0x43f7fd47,	0x6bd2575a,
-0x2bcd64ac,	0xef7cba74,	0xbbe75ea7,	0x58845dad,
-0xf4556932,	0x513b796f,	0x05aa4a60,	0x51527120,
-/*  293-mu267114.inc  */
-0x00000001,	0x00000014,	0x08111998,	0x00000671,
-0x83239dd8,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x2900aa36,	0xedef91d1,	0x980381b8,	0x990ac1a8,
-0xce6aee27,	0xcd579679,	0x93340485,	0xb4ffaf67,
-0x2a528bc7,	0x5cf526ec,	0x0ffd39bb,	0x6536a335,
-0x3996f969,	0x2976103e,	0x2bf45e9c,	0x19cce6b8,
-0xc3a599da,	0x41442e0c,	0x7d60efcf,	0xa0dd1e48,
-0xf20be1a8,	0xe92fe8ed,	0x69246640,	0xce2b3120,
-0xc5fd9aba,	0xa07b4f2e,	0xfc5ec6a8,	0xdfd7ec00,
-0x1af0b9cb,	0xf84deed3,	0x6efad68e,	0xd26c28f4,
-0x588c4713,	0x77b51ea7,	0x9ec83e5d,	0xeb5b880f,
-0xdf8da780,	0x1f1db6ba,	0x3b8b3bd6,	0x1ae4191e,
-0xb84402e0,	0x518bcdec,	0x6df4b892,	0xf447c3ab,
-0x7f5f3bab,	0x57d668c6,	0xdfe3a8e5,	0x87ebe853,
-0x53a3e449,	0x232a99d3,	0x1a5ee33c,	0xf4308ee4,
-0x508b652e,	0xf78b7ae8,	0xbd0616ef,	0xccbd906a,
-0x8cb04b06,	0xdcc54a0b,	0x97a6c4aa,	0x8b56ae1e,
-0x2c81c68c,	0x2a8599d9,	0x88e05548,	0x9ee7e04e,
-0x1df430f0,	0x44bbfa5b,	0x79b20b93,	0x417ca0e5,
-0x8a9d9bad,	0x8d799fe2,	0x8ae5b99f,	0x08d2a3c7,
-0x8fefbe33,	0x54201513,	0xcd50fdff,	0xfd26a22b,
-0xc5be2281,	0x998e58d4,	0x179dbb49,	0x2d6b85c3,
-0xa7c9c271,	0x865499d5,	0x69fe40b2,	0xe83a9703,
-0x99298f1e,	0x4f52cca5,	0x26220fc3,	0x67bcd523,
-0xd3077015,	0xaf86439f,	0x78bba2a0,	0x7e1cc676,
-0x713fec96,	0xc8869986,	0xf15f758b,	0x2b2b58e1,
-0x5b033918,	0x79713b3e,	0x4a08b144,	0x6b10e909,
-0x22401dc7,	0x23087386,	0xc3359150,	0x0a6cde95,
-0x91bd0c91,	0x99281e5a,	0x7bef0550,	0xc8f9e407,
-0xbb6b33d7,	0x6cd518f0,	0x6ef572b9,	0x5a0fbd51,
-0x7425def6,	0x0e50b4e7,	0x3623bb19,	0xfef635a6,
-0x7539c632,	0xc86d176c,	0x80c7b5c5,	0xf5a0b5cd,
-0x879cd278,	0xe26e9de4,	0xa1c6a90f,	0x65b30004,
-0x678c63bc,	0xaab85112,	0x2a9851b3,	0xce3cbdf6,
-0xa30dc116,	0x24bf66f0,	0xcd5d3611,	0x69cfebd6,
-0x0bf03477,	0xa524f5aa,	0x474e152b,	0x93f5470c,
-0xaf8332af,	0xa7162064,	0x8a1ef4a1,	0xf6c7da39,
-0xae7e26c2,	0xb60fc22a,	0x099215de,	0x6431836f,
-0xbced163e,	0x0957b3e0,	0xeaff67c5,	0x1d15d645,
-0x531fe014,	0x47e298e3,	0x4d0a7808,	0xcb9e8bf3,
-0xb0abe54f,	0x1a96651c,	0xd7b0df79,	0x79af1c18,
-0x41aa459a,	0x70628bc8,	0xb200c92b,	0x0ffd7c37,
-0xc16fa374,	0xdc479e08,	0x1181eacd,	0xdf795d60,
-0x78834704,	0xd55485da,	0xdfd68db3,	0xadcb7932,
-0x321eaf32,	0xf5447236,	0x498a525c,	0xc4e3e529,
-0xe3218446,	0x27187ac8,	0xf31ef297,	0x2d2fdd03,
-0x8286cc34,	0x3ec06e63,	0xe7ad6bcd,	0x1f64f92e,
-0x280b07f2,	0x8794d8a0,	0x6f8ad638,	0x7910e4ee,
-0x278340f6,	0xe55b228b,	0xb8dfab78,	0xdb28214b,
-0x12f22905,	0xb8fcb70c,	0xce0065a4,	0x0e0c733b,
-0xfcc20c16,	0xf2be1d02,	0x336a9467,	0xa07f5612,
-0x43b9ca1d,	0x7c6fcdac,	0x810e98b4,	0x5ca423a0,
-0x140596f6,	0xb711c0a6,	0x17b47ee7,	0x0b93143c,
-0xd04b336a,	0x8b84be4c,	0xa3e77a17,	0xb0181d8e,
-0x96d865c6,	0x41ea13b4,	0xe784b15c,	0xf807b39a,
-0xd591fb1a,	0x4700dd5c,	0xbbc1e580,	0x43ac39e8,
-0xadb3d257,	0x3157de34,	0xde366d0e,	0x9ad4248f,
-0x95986f90,	0x9c6515e6,	0x854cb90b,	0xaa416bcf,
-0x988d01aa,	0x08619fdb,	0xc428f67c,	0x440a6559,
-0x3483d569,	0xbd561d15,	0x0bdac2e4,	0x110e1a21,
-0x62bd921f,	0x7cc406e0,	0x038353b8,	0x50c165fa,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  400-MU166a0c.inc  */
-0x00000001,	0x0000000c,	0x05051999,	0x0000066a,
-0x1d9d265a,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x7ee84cf6,	0xdef59a0b,	0x2c39a0ba,	0xa83caa36,
-0xc9b1f450,	0x388df7ac,	0xd69f91c3,	0xf7861ebf,
-0x0184e389,	0xf6a6a084,	0xf4f6e81d,	0x079188a1,
-0xf8d333e7,	0xd1f2d4b1,	0x5ba1ec8d,	0xecb245c8,
-0x846469bc,	0x6c891841,	0xc8afb827,	0xadcd33d1,
-0x4275c0fd,	0xffa3860b,	0x9c0cbbc3,	0x7fdc4c98,
-0xc538b727,	0xba0f7d64,	0x48f8d69d,	0xe5da2ada,
-0x88b8af10,	0x6af3e9c7,	0xe50d84f0,	0xb8058b2a,
-0x2fd44bdd,	0xd92a9b06,	0xfecd2cde,	0x2400081e,
-0x943b6d3f,	0xbc60f43c,	0x0faea953,	0xdbe48e6a,
-0xd5817cff,	0x00da0bae,	0xd96d0612,	0xd5431cbb,
-0x4547dcb2,	0xdc693998,	0x9ddb4562,	0x6b553f57,
-0xd399b87c,	0xb8d58069,	0x69e549ab,	0xd01cc4e0,
-0xf2fa23cd,	0x60944ee4,	0x9f86103a,	0xd7f0bdd6,
-0x6a737f51,	0xbebd48fd,	0xd2d170e5,	0x651a6175,
-0xf3bc9031,	0xd111c145,	0x2b571986,	0xd3595d17,
-0xdc7ac14c,	0x0e3227b2,	0xdb4c417e,	0xd514c15c,
-0x4f6dc212,	0xd639cda4,	0x9d4f9cd7,	0x69396105,
-0xdfb2ece3,	0xbad52f1d,	0x6c5bfd60,	0xd87ed851,
-0xfab9bdc2,	0x6d12697a,	0x9f0ee2c0,	0xda658c6a,
-0x635cbebb,	0xbdcbd5c9,	0xd1bc6b04,	0x6c415204,
-0xf0d34549,	0xddca0b2e,	0x2d43a106,	0xdcc99c8e,
-0xdfdab7bc,	0x0b4a54a9,	0xd93a19b4,	0xd526d677,
-0x41446f81,	0xd94b20c0,	0x9d895736,	0x62f70de9,
-0xd200abad,	0xbd42c587,	0x6fad3a66,	0xd304e4a3,
-0xf13ede57,	0x6a939756,	0x990b77ea,	0xd54494df,
-0x6dd8f816,	0xb9271c02,	0xd7238862,	0x6c0119a4,
-0xfeb583e0,	0xdef9450e,	0x23b2d340,	0xd4df2c30,
-0xd1075deb,	0x0a9ddb8c,	0xd6f4c463,	0xdb5e2fe2,
-0x45071dcb,	0xd814e4d9,	0x96a13be8,	0x666f23ee,
-0xde297b1b,	0xb8956c64,	0x6bf48b36,	0xdfa05659,
-0xfbdcec61,	0x6cb0be5b,	0x9e78bce3,	0xde94cb88,
-0x6315b350,	0xb98e69cb,	0xdb532347,	0x694227ee,
-0xf4f14336,	0xd1a59a01,	0x28c408bb,	0xd1f9a64a,
-0xd5c00563,	0x04930cd2,	0xd0f5ccec,	0xdd4320da,
-0x485b7656,	0xddd958a6,	0x9fe639c0,	0x6fe20678,
-0xdcdcfdbf,	0xb09b15d9,	0x6df8c827,	0xd6b0ccde,
-0xf9c3d0f6,	0x6496b15c,	0x9a91694a,	0xda644682,
-0x6c1293df,	0xb2df9b38,	0xddb61da1,	0x6968a238,
-0xfc6bbbb5,	0xdf19c18a,	0x2a56c306,	0xd67e52de,
-0xd2290d0a,	0x04a145ad,	0xd49153e1,	0xde5b167b,
-0x4848312d,	0xdddec3a8,	0x90a1f1b8,	0x6b8f4446,
-0xda37eea7,	0xbbcf471c,	0x993f1cc0,	0x3f91a8af,
-0xd61f988a,	0x47b6419b,	0x95657dde,	0xb2ffa26c,
-0x44930f12,	0xf34ed623,	0xbc7f7fc3,	0x118b4f74,
-0xf12d0c9e,	0xe81231e9,	0x1110db16,	0x1d41dffb,
-0xe06619ee,	0xf32a7d08,	0x357fa00d,	0xd2e3c5eb,
-0xdc38223b,	0x062d166c,	0xd182874c,	0x3b1d6a6a,
-0x0142363d,	0x347bf43f,	0x3e818e62,	0xe5fff804,
-0x305f3377,	0x2cdca236,	0xe1afc577,	0xeae0c285,
-0x269653e8,	0xc40756ba,	0xe0d8b540,	0xc44824ab,
-0xca5d4d9b,	0x0a51f0bf,	0xc8593df7,	0x3040056b,
-0x09282276,	0xc2ba9356,	0x383d94a3,	0xf61535ef,
-0xc65ab8bc,	0x3ee5709a,	0xcbfd2b50,	0xfe5787a1,
-0x09dd6022,	0xf7ec8ee2,	0xe2b1e3b8,	0x580ec41a,
-0xeaa5a2da,	0xbd800565,	0x7946c0b2,	0x76b9828b,
-0x9bb28f85,	0xe3932a08,	0x7960d4db,	0xf3001b13,
-0xec1e8232,	0x1f4d97dd,	0x2856139b,	0xc11609a4,
-0xc69b6b22,	0x02829529,	0x0224403c,	0xcb7ee7b0,
-0xe093e6a8,	0xa6841fee,	0x60c5b601,	0x2b99dd31,
-0xae77ce16,	0xf6b997f0,	0x3eae0d83,	0x1299fe49,
-0xef836ea8,	0xfc5fd4ea,	0x404801c9,	0x1588ce31,
-0xf3136926,	0x5b2db34f,	0x2fddf729,	0x3aedff67,
-0xc1198e78,	0xdd360cae,	0x81cc641e,	0xbd23f38e,
-0x9521c3a9,	0xe5dd3bbc,	0x7f89f543,	0xad637f67,
-0xb94d65df,	0x44ea2049,	0xd2a5314f,	0xf6b52ed0,
-0xc1582e64,	0x696fa343,	0x6fc79d19,	0xc10008ce,
-0x259496a3,	0xf4e1babc,	0xe1ab5f9c,	0x33ffd383,
-0x3decbc22,	0xae09ede6,	0xf42b65f2,	0x9a49d828,
-0x9ce3c48d,	0xd4055914,	0xbf360754,	0xe44b2727,
-0xca93c1aa,	0xd14f31b5,	0x11d02919,	0x8b485bfc,
-0x5fb21565,	0x4eb9ca57,	0x3d17e2bb,	0xd45be14a,
-0x808855c4,	0xa66c16ae,	0x3f46a1d2,	0x737db4d1,
-0xb7f5b0f2,	0xb6e5af8a,	0x4ea7ce1b,	0x8e79ab73,
-0x3279d139,	0x160056e1,	0xc4a5ed68,	0x1ff6352d,
-0x592640ff,	0xa3edfbbc,	0x68be47b8,	0xba69a126,
-0xcca14ed1,	0x7e343e52,	0x1b860b23,	0xab2fe19c,
-0xc0357151,	0x52b873f0,	0xe1adefe0,	0x7d73cfef,
-0xb4b82b50,	0x12b02b0b,	0x4efc5c49,	0xdd37f0a2,
-0x939b6fb3,	0x05ac2f31,	0x514e08d9,	0xda59b756,
-0x29ee8585,	0x3c960d13,	0x5b9c2425,	0x8b904acc,
-0x03506beb,	0x64ae1683,	0xf0f5f6e6,	0x1166c8e3,
-0xa4fdbe30,	0xfa8de670,	0x8f8007f8,	0xf93f0a9d,
-0x28c817bf,	0xdd2564ee,	0xfb77c058,	0x005ae81f,
-0x3819f821,	0x40be4b2f,	0xea398f14,	0x36cbfca1,
-0x66f826fb,	0x01f82781,	0x0d2e8d71,	0x827fea8d,
-0xeefb9818,	0x58cbe155,	0x7cdfa2bd,	0x823c1f5c,
-0xca57cf62,	0xeb8bbd3a,	0x83ee2876,	0xd09e17b6,
-0x2ed8c4e2,	0x41dde0e9,	0xca0c0e36,	0xa716235a,
-0x68dc48c2,	0x97c65728,	0xdf0b7db6,	0xe0f5a926,
-0x1662e74a,	0x109a93f3,	0x25d1fecd,	0x5e5feb1f,
-0xc1fb4ce1,	0x4a0c7854,	0x1f5e1b77,	0xc74f4a67,
-0xddd32a11,	0x4f23d67f,	0x15c683c9,	0xae9e0b36,
-0x1eae9783,	0xeb4575c0,	0x273ab1fe,	0x14f498f9,
-0x36e1fa03,	0x5d26968e,	0xb1000e70,	0x4bd84a27,
-0xf1656674,	0x69d7f679,	0x1a769399,	0x38a6a468,
-0xacc185e5,	0xcfc3542f,	0x0016f20d,	0xf791207a,
-0x3619f97d,	0x19aa7383,	0xbe6a3488,	0xdeab6e3c,
-0x042a3e83,	0xd1a1a166,	0x5d1be3e5,	0xe0d338b5,
-0xd2421262,	0x1420b7eb,	0xd9e9ab1a,	0x50cc69fe,
-0x9b5056a2,	0x82e9a23d,	0xd3ab7b3e,	0x0424ef61,
-0xf4d374ee,	0x982060b4,	0x954e2f92,	0xd64bfd36,
-0xc9e9430d,	0x593e8cbc,	0x80d7b169,	0x8b87d305,
-0x764466e8,	0x6a125ce8,	0xda699c3a,	0x13f3ff6b,
-0x412e3a89,	0x7fc628e8,	0xf33761a4,	0x2e84242b,
-0x388a3019,	0x33da6d91,	0xb493ed5a,	0x6c063a26,
-0x6bd1b5e1,	0x372850cf,	0x8ae1c93d,	0x9220555a,
-0x87199a47,	0xe4dfa5b2,	0xb0a1c13c,	0x5e4be8ed,
-0xce0befd8,	0x358a7073,	0xd96a0778,	0xa8e18b1b,
-0x76ec713c,	0x1208ea58,	0x3cebd827,	0xe8093948,
-0x6592653c,	0x069405db,	0x01ea9da1,	0x12ce1bf5,
-0x467402bf,	0x55ba728a,	0x0946945f,	0xe405cac2,
-0x099a54d1,	0x6b662117,	0x18f3eeff,	0x7d6c106e,
-0xbda99e98,	0xafda474e,	0x67067a30,	0x6a882ede,
-0xcadb3f5f,	0xbaabe426,	0x849fc0d7,	0x03c0a313,
-0x8e02168e,	0xe5cfc3ac,	0xa901afe4,	0x3152692b,
-0x538a67b0,	0x408a0315,	0x5c83ba73,	0x8e51c069,
-0xb2743e6c,	0xe27e14b0,	0x83917dbf,	0xebad6f2a,
-0x475c528d,	0x9ea643ec,	0xc9b3e51c,	0x332886f7,
-0xcf756bf6,	0x1650b95d,	0x6c89ce09,	0xaa5fa869,
-0xa38a46b8,	0x2c23feb3,	0x66ca2c19,	0x95c7c745,
-0x92fbf6f8,	0xd72602be,	0xfb41ad08,	0x3bae6e6b,
-0x1ec6cd00,	0x55ae9d6e,	0x9fd7dcb2,	0x473683dc,
-0x147cb939,	0xc06b93d8,	0x488bc90d,	0x8b5d8cbb,
-0x894a3028,	0xfd651c2c,	0x1276262f,	0x25fa7147,
-/*  1346-m10f252c.inc  */
-0x00000001,	0x0000002c,	0x08262004,	0x00000f25,
-0x62d062ab,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x017464fa,	0xd2fb3494,	0xaf1850af,	0x5af88989,
-0xd3a0a9dd,	0x8e8bd3ad,	0x8c288786,	0xf15f02b0,
-0x3f3c1471,	0x6c675202,	0x5094fdb0,	0xa618dc47,
-0x7596d14e,	0x6ba07896,	0x2e4a12e7,	0x611c39f1,
-0xf6a43a1c,	0x24fa23e1,	0x01bd8d37,	0x5a21bc1c,
-0x60df739b,	0x40165459,	0x87c581fa,	0x2e850b8a,
-0xcfcb5329,	0xee4152a6,	0x404753ca,	0x64ac8738,
-0x2b8cd6bf,	0xbc5f4abd,	0xa8bb7b21,	0xf08d2f32,
-0x1c8094c5,	0x67ceb543,	0x0cd8f368,	0x8658f400,
-0x9174a58e,	0xccabf1d6,	0x899bf22e,	0x40d6d951,
-0x4838f728,	0xa1ed41e5,	0x3483bccb,	0xc1c0815b,
-0x1785082b,	0x255c0d8e,	0x91d5b4b4,	0xb1f4c7e9,
-0x2bf5ac1c,	0x368af115,	0x66ae0e90,	0x2b95e4fa,
-0xa9bf4b21,	0x9ae73e25,	0x86cecece,	0x534a6d72,
-0x8200bc65,	0x83255506,	0xf4e35c0b,	0x9dc95dd7,
-0x4464f3b9,	0x9112fc9f,	0xd62cfc95,	0xee0caf4a,
-0x7963ed30,	0x90d3ad97,	0xee95be29,	0xbf49ec04,
-0xf3287f06,	0x07d1e162,	0xd3e0755d,	0x929ea9cc,
-0x0094df0b,	0x52064130,	0xce7f504d,	0x35f46c20,
-0xb8fbeb98,	0x6b6362c5,	0xa03f5918,	0x5c427277,
-0x55a52e2a,	0xd43118bb,	0xb5bd2642,	0x3cbdebe2,
-0x2f8bd345,	0x1d7544fc,	0x4e08c4b4,	0x806aaa70,
-0x99128239,	0x9e150e46,	0x8a542475,	0xec5b5756,
-0x585c2a66,	0x73d03366,	0x3aaf1ab3,	0x35ae9846,
-0xd8c688a4,	0xd1a11333,	0x0de4e99b,	0x3b641c51,
-0x6a4e6159,	0xf84cef5a,	0xe56ab89f,	0xcd410bf9,
-0xc90b1c48,	0x0b032ac1,	0x33dec98d,	0xd06c42be,
-0x32028313,	0x5d819bf6,	0x04f60234,	0x21e4c303,
-0x1d2ad9c2,	0x7bff3ccc,	0xd89dba83,	0x5798962e,
-0xe3aba833,	0x333b4f64,	0xa7869e81,	0x68c4b245,
-0x06c21e1a,	0xa1b8bdef,	0x5af37ec7,	0x289bfece,
-0xd6cd123b,	0x9e0bcab3,	0x4c342945,	0xa9d7e1f0,
-0x4a2498b0,	0x3bc93371,	0xda7d7384,	0x91fa2049,
-0x6e1202af,	0x5cf95edc,	0x8efa1130,	0x2e7c51c1,
-0x467e44b9,	0x6259f80e,	0x3ec0ae38,	0x515e28b5,
-0xa5f3fdad,	0x26990f39,	0x132c1b43,	0x72b429ba,
-0x74d71719,	0xaee958b6,	0xd22e6611,	0x2eb5b552,
-0xe6812bb7,	0x99c839a3,	0x20e2b7d2,	0xb19cfdec,
-0x947876b4,	0x2734f7d8,	0xe26b52b6,	0x8eff31db,
-0x90a4081e,	0x76d3cabf,	0x712afede,	0x24fb06a5,
-0xb6e19dac,	0x52d3d9a1,	0x916b0c9b,	0x76584397,
-0x23d1fe57,	0x2e7badc9,	0x793b93af,	0x4bfafe0a,
-0x2693b773,	0xc35d8ced,	0xbea30ce9,	0x22f8d19a,
-0x389dae00,	0xeb826f93,	0x05f18a18,	0xd6fb6d38,
-0x821bd354,	0x268226ce,	0x2191a9e8,	0xff137868,
-0xbbb40031,	0xcac56b21,	0x64cf06f6,	0x30587346,
-0x4b289baf,	0xf699e7bb,	0xc29e78ef,	0xc3b60ce5,
-0xf82e2e0e,	0x34dee08c,	0x3c3a6eb6,	0xf7513f73,
-0xfe4e1a98,	0x07ec1fbe,	0x12b6246d,	0x219c212f,
-0x73ffba20,	0x369b69cb,	0x2671b878,	0x0d7b2c84,
-0x032e56e7,	0x3d937bdd,	0xcc823a33,	0x287122cd,
-0x6c488555,	0xa2e9aa31,	0xfd2dd62c,	0x2c1fe41e,
-0xdced02c9,	0x895f72d8,	0xcc184fc1,	0xba0ffb0f,
-0xee6589e7,	0x380773ef,	0x793bba57,	0x9314f3ad,
-0x4d79bce2,	0x116f016d,	0x7db8b6cb,	0x2ed52750,
-0x485ab29f,	0x23ae6001,	0x32854b85,	0x17ddafa2,
-0x098d4caf,	0x3d404c83,	0xbcb8331e,	0x3bcfa653,
-0x56382235,	0xc0a0c48b,	0x6f9d9f13,	0x300d782a,
-0x7cf71f46,	0xe6e4b87b,	0x0791bb50,	0xdb2c4160,
-0x6be9a315,	0x2165554b,	0xc3260d6a,	0xedfb0449,
-0xbaed3058,	0x0f98dc31,	0x390814ef,	0x23a3e34d,
-0x27d3c3a4,	0x2c19950b,	0x402871f0,	0x184dcea7,
-0xde0edc2e,	0x2f98f6e9,	0xb447540f,	0x3c9a5cb3,
-0x60c8a7cc,	0xe641f9f2,	0x3c56383a,	0x32cd115d,
-0x92777bf0,	0xd89236b6,	0x3d25460a,	0xf893e2ad,
-0xdcd5b651,	0x262c47ec,	0x872573d0,	0xc12dc29c,
-0x409a6a3a,	0x9bf80c1c,	0xa735cc4e,	0x2587cc61,
-0x7d6e93e4,	0xa0ea6f41,	0xd4ad42ae,	0x8daecee5,
-0xc31e66a8,	0x2378d207,	0xabdddd7f,	0xbe11bb1c,
-0xf38edca1,	0x513bf227,	0x5bef4b3e,	0x204feef8,
-0x7bbf43ac,	0x7768b9da,	0x9b0bed2b,	0x56202483,
-0x4695c0e6,	0x23d8d840,	0x82ecd4ce,	0x79748b5e,
-0xcca7c892,	0x8c63470a,	0x2d7518c4,	0x2fac1b7a,
-0x104c938f,	0xbf29d2f3,	0x1dffe8e0,	0x8d7ad738,
-0xc83a0640,	0x2199cec4,	0x7bc07063,	0xa70c2537,
-0x9e861394,	0x075d4c73,	0xa569faf6,	0x396bae73,
-0x334b3c91,	0x20b95fab,	0x769b98f6,	0x0a8f4cda,
-0xff9752b0,	0x309b6f0a,	0xc3071844,	0x3104c8ad,
-0xbaff693c,	0xebf312eb,	0x9e25d11b,	0x25576b18,
-0x4e70d78a,	0xc72dbd56,	0xec181ed8,	0xe9b6167c,
-0xe099c2f2,	0x27d3aa35,	0x6ddd258e,	0xcc131a0c,
-0x065dd636,	0x3cc4ff57,	0x77a63f63,	0x237c4bbf,
-0x3889c6a1,	0x176b30e9,	0xfa111c8d,	0x281d9f44,
-0xbd74ed05,	0x3ed21e58,	0x0490fdad,	0x15c697b4,
-0xa3719ed3,	0xad0bb013,	0x66b68aa8,	0x282fe7ac,
-0xfa118f06,	0x8f2a8338,	0x5c1253cc,	0xb7afeae2,
-0x630a9b9b,	0x3cae83fb,	0x216b5789,	0x9cb4b049,
-0xe9dcccb5,	0x2696572a,	0xe22011a5,	0x23b34429,
-0xf9636a42,	0x1051094a,	0xdf3f18ad,	0x26510efc,
-0xe378d21e,	0x38a6bf26,	0xace969cd,	0x1ca41996,
-0xcb528e18,	0x87c088e2,	0xfd71cd99,	0x39e736e2,
-0x9c64bc32,	0xbd8cecd2,	0x47a0629a,	0x85b3df38,
-0xc9d64ce6,	0x32bebbe9,	0x42cb74dd,	0xab5d1e1c,
-0xe55e7ac2,	0x55f8be13,	0xf430b24e,	0x2f17258b,
-0xda10ca8f,	0x6eac45dc,	0xa07672a7,	0x506f676c,
-0x1e8b526e,	0x33eb74e6,	0x7742492d,	0x61414e22,
-0xc31291a5,	0x5b2b4e8b,	0xa315ffe6,	0x989185aa,
-0x8bdf0a79,	0xc9c06f2c,	0x2f00faf8,	0xde4ef0f5,
-0xa145c5a8,	0x92dd3dee,	0x727c9f7a,	0x250ed270,
-0xcb1c44c2,	0xe1113cb5,	0x5bf4dbbe,	0xf4709150,
-0xc21c5014,	0xf930bb0c,	0xbe4f9bd9,	0xa5862c75,
-0x2230e5c9,	0x74149598,	0xe987643d,	0xa3412042,
-0xbd3eb677,	0x80a41b9a,	0xaa2dc674,	0xd192a178,
-0x8988967c,	0x8962ca42,	0x451c005e,	0xecde7737,
-0x87f85870,	0xe98908b8,	0x265c73c7,	0xec182f7f,
-0x05b3d87c,	0x1afff376,	0xf4c81a3c,	0x80f00263,
-0xee63669e,	0x1d74f997,	0x183e2b6f,	0x0629519f,
-0x6b27783d,	0x9916c2f5,	0xfecbc9d5,	0x7eb50141,
-0xad0037e0,	0xf20f60c4,	0x374a7054,	0xf0848252,
-0x19f82e03,	0x69c1f70c,	0x70961335,	0x9deb2ccf,
-0xc453c78d,	0x0871df23,	0x7f83c98b,	0x407fbe9c,
-0x10121b4f,	0x9044f904,	0x4ed3f7de,	0xb028f42b,
-0x246f17de,	0xb855abb0,	0x071a51d8,	0xd549aad9,
-0x735a39b1,	0xad2f4ab1,	0xdf90c6c4,	0xdd2761c2,
-0x62036cae,	0x3c29d30e,	0x4f7f5f84,	0xab87914f,
-0xc33f0b67,	0xde569d58,	0xb1e60d71,	0x8a817393,
-0x906e903c,	0x4e972481,	0x4fe3e46c,	0xd48eb883,
-0x6570d66c,	0x8e957776,	0x00534cbc,	0xe715ffed,
-0x2678ac5d,	0xcacc7b06,	0xd4fe6915,	0x8d09aa7b,
-0x5cfa9f8e,	0xfe2dced0,	0x7b64fbc0,	0x73940aec,
-0xae88acb2,	0x800c6287,	0x7639d6f3,	0x28ac2dba,
-0x162200b6,	0x7dcea0ee,	0xb63f1118,	0xeeb52b03,
-0xd7996177,	0x32e8dc08,	0x52529d26,	0xd3773575,
-0x0e8ffee2,	0xf7ee274d,	0xb6932b3f,	0x3a9aa201,
-0x68c94a3c,	0xc9efee21,	0x4d432eb7,	0xe3f5a59f,
-/*  965-m01f0a13.inc  */
-0x00000001,	0x00000013,	0x07162002,	0x00000f0a,
-0x2a2cc3cb,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x80e0e61a,	0x7cb2c607,	0xbe1e2fc9,
-0xacaf1526,	0x31514e28,	0x9252d426,	0xb999ebf8,
-0x8469bb8a,	0x95e72fd2,	0x5f7c5472,	0x254adcf0,
-0xf706b236,	0x21ef3efb,	0x82d05526,	0x8b10bd77,
-0x268ab8bd,	0x929739a5,	0x0f180e02,	0x3ad1cc5a,
-0x23a10814,	0xbc4257f8,	0x026ded8d,	0x84bf45be,
-0xe13e69f3,	0xbb0edf16,	0x85218fd2,	0x898af4e1,
-0xcd635f26,	0x846ab0c6,	0x85a5d5cd,	0x077b4a16,
-0x71514de0,	0xbff893a6,	0x47536ab0,	0x1fc4b546,
-0x906f4b85,	0xc1f997d5,	0x0ba4b594,	0xa823eb50,
-0x416ee239,	0x659b0dbd,	0xf240ad67,	0xe042d532,
-0xce92f455,	0x9f318d9f,	0xac11fada,	0x6fc234ab,
-0x18cddb76,	0x67e52b4f,	0xa6f01943,	0xba695e2a,
-0x245bd123,	0xce05288f,	0x6582101b,	0x5be73a23,
-0x6ab67d0e,	0x873ac6f3,	0xab4c48f2,	0xe0d64284,
-0x65f33ddb,	0xd33abb56,	0x8dd411c3,	0x86f370ea,
-0x1c3726b9,	0xd561edb5,	0xa0484b79,	0x63bdccd0,
-0x54d42183,	0x05d9b9c2,	0xd1d2e489,	0x572f0b07,
-0x6b804808,	0x9ee441c8,	0x87e1e425,	0x0d4d3c3e,
-0xbb9188fd,	0xa7f1243b,	0x807be6fb,	0x8f828057,
-0xfe37dd84,	0x104ef504,	0x5aa650b4,	0x2f1b611f,
-0xd021e808,	0x1d4ca877,	0xdefabd4d,	0xaa0cbe35,
-0xa4e89854,	0xa880cfc1,	0x08ed71f1,	0xb58e8625,
-0x2f4bee9d,	0xfef8678d,	0x2868ade1,	0xcdd1c7a4,
-0x2b823a15,	0x4788ea69,	0x7a1de61f,	0x24a51210,
-0x4373e00c,	0x7f8e55c9,	0xb2c5092b,	0x74f9e0db,
-0x2f54f62d,	0x13e3b1c8,	0x835863dc,	0x7401feb0,
-0x82d9962c,	0xc321a358,	0x8db3eec1,	0x3d70aa8a,
-0x9e8d115a,	0xd1f258ce,	0x3db0262c,	0xdedf4ecf,
-0x2b43787d,	0x01bba4ab,	0x5533bfb0,	0xf25756a2,
-0x6748ff85,	0x49a04cf9,	0x15a3fceb,	0x2b0045b1,
-0x354d82dd,	0x51baaaae,	0x9cdb8826,	0x4a5e79d5,
-0xc0b783a0,	0x244ee819,	0xc9d7ec82,	0x61b5df6b,
-0xa3b0ab47,	0xf4201580,	0x16a9bda3,	0x2ac3fb2a,
-0xf2d45287,	0xc775c470,	0xca49165e,	0xf011aa96,
-0x7cc3f776,	0x128e7d4c,	0x53a7cb48,	0xc678c16a,
-0x704d85ff,	0x5ac3438c,	0x22a4255f,	0x06f4eb73,
-0x6d2c4918,	0x7ec8d353,	0x02f64898,	0x402caba1,
-0xa2dcd74c,	0x2ec84768,	0x19aaacb3,	0x641e9f60,
-0x610245fb,	0xbcde5b34,	0x5b2ad9e6,	0x26d2e619,
-0x3c5f7fc3,	0x8a4644e1,	0x6cc1f8fb,	0xb2ec0e52,
-0x02186480,	0x1c597a86,	0xea7cb92f,	0x8484972d,
-0x90f10aef,	0x7032ba2f,	0x8d51693a,	0x075f7010,
-0xef88324e,	0x5fbf378f,	0x1416ae8a,	0x5eac1f31,
-0x70e65677,	0x0224e031,	0x1305f1ac,	0x53209b14,
-0xb5037676,	0x99e958fb,	0xecb8fe97,	0x20fb5890,
-0x568e98e9,	0x87d42ce4,	0x03de50e2,	0x89728dac,
-0xdca95447,	0x36114e7b,	0x2aab8e7a,	0xa0529d9c,
-0x9901c79d,	0x4ff191b5,	0x7500cebf,	0x210bcc07,
-0x815fd1e8,	0x4ebd3be0,	0xbce22cf0,	0xcf2df323,
-0xfffa8eb1,	0x016b1ca2,	0xf87846a6,	0xddbf1474,
-0x435c41b5,	0x56245808,	0x050eace9,	0x128491f7,
-0x48c6fdda,	0x5775ded7,	0x0b4775a1,	0x7ce11409,
-0x0d9822a0,	0x084ca742,	0x8f2c8c8b,	0x4278fdfc,
-0xe45d26c7,	0xd92793fb,	0xe963acf5,	0x346473ea,
-0x28069586,	0xcd7423ab,	0xdd07fab1,	0xf2dd3f15,
-0xf924720b,	0x0047adff,	0x3935bd42,	0xde1d799f,
-0x03a4afd9,	0x4f0ea217,	0x5f3dd4df,	0x09f611a1,
-0x8ecf894c,	0x5111dde5,	0xd79db940,	0x4e2da85d,
-0x64622e3d,	0x00ed0f85,	0x192b2af6,	0x526fcc87,
-0x3e233c92,	0xdfa9d04d,	0x5a8a7d19,	0x18205eef,
-0x3ff5734e,	0xf3ba744e,	0xac73c051,	0xc2cf8a70,
-0x3ba41433,	0x123eb210,	0xe3f05134,	0xcfd54fd8,
-0x7995e0d1,	0x1760b323,	0x310a7810,	0x2706d0c8,
-0x15cf732d,	0x3c0ee597,	0x83e36338,	0x272058a7,
-0xff3e9fda,	0x0c22fe44,	0x11a26627,	0x061a17a0,
-0xd784b930,	0xb40ed3ca,	0x014eaa98,	0x2cfd7ef7,
-0xd3f700a6,	0xa2e0e5ad,	0xf6682e43,	0xbab69f7a,
-0x185c3430,	0x10a4a66d,	0x41698b7a,	0x89666812,
-0x1cdc431a,	0x301a8774,	0x056fa032,	0x08e5b4ac,
-0xd8e66808,	0x06cb04c2,	0x086f09ef,	0x09404e44,
-0x4b166a00,	0x1f244ff1,	0x096548b7,	0x3d066268,
-0x11c22583,	0x87d98b53,	0x83c785d8,	0x0c295204,
-0xa3693e8d,	0x8ca5c952,	0xa52c8190,	0xa9ac34de,
-0xe640e56f,	0x16d5715c,	0xf40bac7c,	0x940d757e,
-0x0955d322,	0xbd3e2f65,	0x6553293f,	0x0b25fcb7,
-0x14875a5e,	0xb5efd0af,	0x79cf151f,	0xa74e5acb,
-0x4b249263,	0x14a844ff,	0x4c547880,	0xb598f6b8,
-0xe9fffbc6,	0xe983f09b,	0xa5384013,	0x36baf1e7,
-0xe3a76c06,	0xde3df31a,	0x25d38aaa,	0xc19d9fa9,
-0x2c05457a,	0x0a4fd8f6,	0x01086f65,	0xdf7e10b3,
-0xa5f16786,	0x46d77f4a,	0x08336cd2,	0x1d06cb5f,
-0xe453696c,	0x6f662a90,	0x40d33558,	0x76c640d5,
-0x4e7e4c97,	0x10cb0f79,	0xb1cfbb1c,	0x4f3f0521,
-0x8cda32ee,	0x84c3e958,	0xaac41cc9,	0x023e7572,
-0xf3266bf6,	0xb4193d39,	0x3a31f7df,	0xbd83c248,
-0xc812df3c,	0x0af7f510,	0x82bb61f9,	0x95db6415,
-0xf7b12fa8,	0x7a7f4f9c,	0x2ec8f061,	0x3fa8e99c,
-0xc19bea78,	0x470c4315,	0x0bcf3abe,	0x787b97b7,
-0x78f992b4,	0x05a7b74c,	0x93fc4db2,	0x41094fe3,
-0x3e7fe41b,	0xa367bc2d,	0x90b393db,	0x3ec58fe0,
-0xb74cc79f,	0x9ed83f74,	0x10daeeae,	0xa524f1ac,
-0xafcd0f29,	0x11423945,	0x52319e75,	0x9978031d,
-0xa78bb8be,	0x1a8a86d8,	0xf9a5c6db,	0x15d9760b,
-0x00028056,	0x2d0f7fc3,	0x7734d88a,	0x1b877e63,
-0x7b1db862,	0x25037d9d,	0x5a210d59,	0x1875f3e4,
-0x0299248c,	0x90ae4f18,	0x949d7d41,	0x713deba7,
-0xa6ff8ffe,	0x243c5296,	0x6020828d,	0xe420ae82,
-0xf02eeda6,	0x3a8090e3,	0xaef23b89,	0x40d2cb8a,
-0xaaddddad,	0x220c269f,	0x288d2d4e,	0x8689e116,
-0x42de5c86,	0x95ff5e35,	0xdcaabe42,	0x3fbb05e5,
-0x4ade7e4b,	0xd6612d65,	0x44ad598c,	0x984eeabb,
-0x218696b2,	0xf9c83206,	0x881e3b4e,	0x54844f30,
-0x1f980f2a,	0x0aec3158,	0xdd92450c,	0xb8a3906d,
-0x0ccc7c23,	0x196b48db,	0x08ffaef9,	0x2c44b86d,
-0x05fcc149,	0x079869d4,	0x5f3f5d0b,	0x1086de9f,
-0x638432c5,	0x1dbe89c0,	0x882041a8,	0x05a6756a,
-0x306e76ea,	0x49ad9a0d,	0xbc24d1af,	0x2a113e7d,
-0x8a333131,	0x775f70a6,	0x49629224,	0x8e089d24,
-0x34e60e07,	0x280eb8c9,	0xcbf3805c,	0x528c0bdf,
-0x46c79b94,	0x543c88dd,	0x2b2e55b0,	0x252bf38c,
-0x0757335c,	0x56405b4d,	0x7f0894ef,	0xa2417da9,
-0xf4f8c5d2,	0x2be63c2f,	0xcfb400fd,	0x4b9f4e99,
-0xbed450c7,	0xbc3cdea6,	0x216f9223,	0x3d2920ad,
-0x97284d1d,	0xb5b05c58,	0xa5075b63,	0x8ec8c059,
-0xf9c2f270,	0x0f79cbf3,	0x71253a77,	0x66896241,
-0x5cb14622,	0x8d439f45,	0x21d61b98,	0xddb46338,
-0x1b2fb78d,	0x78389389,	0xe3e92811,	0xd7b0a62b,
-0xeec11a6f,	0xf98e84dc,	0xe26a6dde,	0x7767cc48,
-0x04f5492f,	0xcfb9fbbf,	0x4bc7fb18,	0x86e5876a,
-0x6cec34b8,	0x44f1e0ac,	0xf60995fc,	0xd56fc8c1,
-0x3843fa32,	0xbbb021d6,	0x8269ba6e,	0xfc91d4da,
-0x092f051d,	0xcf0ecdc1,	0xec5f10a8,	0x16575ab3,
-0x3b956ded,	0xeccdcf22,	0xb68dbf1d,	0x42bf3c8c,
-0x0bbc80c3,	0x13b6dec2,	0xcc51edc6,	0x6b44ec54,
-/*  617-MU16860c.inc  */
-0x00000001,	0x0000000c,	0x05042000,	0x00000686,
-0xb8f53b16,	0x00000001,	0x00000080,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x5beabe32,	0x8f316d6f,	0xe80fa8ed,	0x6986fc34,
-0xa9af091c,	0xedef5922,	0x4d59bcce,	0x8528ec94,
-0xea891582,	0x6d651dcf,	0x8ea713bb,	0xee588508,
-0x40950b27,	0x839e687c,	0xc0950463,	0x6bb3f40b,
-0x8a0f86c0,	0xe3763843,	0x69dd3be1,	0x814c91b7,
-0xc5d81f77,	0x6e9b0217,	0xa4ba0a27,	0xe2b72aaa,
-0x6497f53e,	0x82872e97,	0xeffa4a21,	0x6e462da7,
-0xab2b6778,	0xe176f65b,	0x417dd377,	0x89bdcc75,
-0xe1003982,	0x60569826,	0x89ac3387,	0xe6285345,
-0x4782de3b,	0x826080d7,	0xc69b35f1,	0x6b185a03,
-0x837baa3f,	0xe552ede6,	0x6f2fbc28,	0x87ce0f4e,
-0xc20b6335,	0x6893000d,	0xa332a8f4,	0xef4959d8,
-0x6284f62c,	0x879c0c35,	0xe9e3ad36,	0x653ed305,
-0xac87e78a,	0xe7bde36a,	0x4345fd62,	0x8ab60171,
-0xedbff4cb,	0x66cf93b5,	0x8376cf44,	0xedd6748b,
-0x44eaf0c1,	0x88705803,	0xc6da08d9,	0x6fd543de,
-0x85592c00,	0xe79d63c4,	0x6cdc2a92,	0x89bfe1c3,
-0xcbba1423,	0x6dfa21a9,	0xa6a349e6,	0xed858baf,
-0x6331f1a8,	0x86e75775,	0xeac0a06d,	0x62d8baa2,
-0xa503d5df,	0xece1c293,	0x47c8bd55,	0x8d23e10e,
-0xee204328,	0x6fdea099,	0x89a8f4ee,	0xe80cb92f,
-0x41cd1474,	0x8f09874b,	0xcf9dbeb9,	0x62718244,
-0x8a22623e,	0xe7a870e5,	0x6a6ba570,	0x84e31910,
-0xcddede9e,	0x6e92e0ea,	0xaae489c6,	0xec82fa7f,
-0x6a9167c6,	0x8994727e,	0xe680b48f,	0x6e403e62,
-0xa24d01a8,	0xee5592fa,	0x4b74d177,	0x800d0508,
-0xe3b72b12,	0x6b8ce9b2,	0x8d0db7e3,	0xec5317a0,
-0x455d8f91,	0x82ffc429,	0xc1398d12,	0x60d0d84f,
-0x8d3b8e62,	0xe84b361d,	0x630d2673,	0x8ab49818,
-0xcd164321,	0x6b79c001,	0xacbab7c7,	0xed6ca4a5,
-0x6b4bf372,	0x85e56ab6,	0xe911f38a,	0x62059ea4,
-0xafcf2b18,	0xea0e55de,	0x46af190e,	0x8bb6cb1d,
-0xe6b2288c,	0x652d788b,	0x83de4e28,	0xea2e9172,
-0x45469080,	0x816aa607,	0xc5bd3be9,	0x6a02bdcc,
-0x827f49bf,	0xe7dc4a54,	0x6b2b615f,	0x8f7063a7,
-0xc56ef2c6,	0x69e07fcc,	0xa12bdaae,	0xe889c817,
-0x6f9c2212,	0x8a1b632f,	0xec252abe,	0x675daad1,
-0xa28aa0ce,	0xe745a6d7,	0x462d6496,	0x84c5c6cb,
-0xe967c643,	0x68dbf356,	0x86319d98,	0xeab42313,
-0x4e1f95a4,	0x81675488,	0xc7a05207,	0x6613d6d1,
-0x84596988,	0xe9b56dec,	0x68953dfb,	0x8171c92d,
-0xce5c1eca,	0x6e72e1b7,	0xaf894af5,	0xebb8db3b,
-0x69bdd2f2,	0x826e11be,	0x710f8324,	0x6cbffa61,
-0x6b2f68c7,	0x1f4b8c05,	0x74bc500e,	0xfea47e48,
-0x1078bca5,	0xea7d8317,	0xfdbfb06d,	0x75a330e4,
-0xe5fb5b4b,	0x9a5c4ba2,	0x7686e0be,	0x8daa9275,
-0x94b31595,	0x10077168,	0x8866b4a8,	0x9015bde1,
-0x18bb9900,	0x87055ab8,	0x92a07454,	0x88a11ebe,
-0x85e42368,	0x00fff1c3,	0x805b4bd9,	0xa1b8dccb,
-0x011da7f1,	0xa4b69986,	0xa7328e68,	0xfc7adf4e,
-0xa5f8b5ce,	0x5db15603,	0xf9a719bc,	0x9528274b,
-0x5368e951,	0x3e5542f9,	0x95bf32cc,	0x424f9535,
-0x3349bd57,	0x87f3a3a6,	0xc645d35f,	0xed9bab75,
-0x03cb5f04,	0xea113118,	0xe43af99c,	0x09662e06,
-0xe3e3a200,	0xe5eb2a3e,	0xe8f9b93d,	0x4125d311,
-0x06b430d0,	0x4c0c0347,	0xf75e7526,	0x883d85b2,
-0xfaa35064,	0x7f7970b7,	0xa02cd247,	0x9f6a8b6e,
-0x59b0a023,	0xc7cd794c,	0x871f98ca,	0xc3d34fbb,
-0xd0081a27,	0x1267665a,	0x011d0713,	0x2dbbfcec,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  538-MU168111.inc  */
-0x00000001,	0x00000011,	0x09211999,	0x00000681,
-0xfc16538d,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x4de0640c,	0xc8973947,	0x5f1a48c9,	0xe647f1a2,
-0xa24d2118,	0x636cab60,	0x8c470d7d,	0x916cd75f,
-0x31031bd3,	0xa3c538bd,	0x9e5e54f6,	0x206378e4,
-0x96583499,	0xd872c73c,	0x7780f2aa,	0xd03a37c5,
-0xa75749cb,	0x6813ae73,	0xddf49382,	0xb8ff72b2,
-0x59e1a409,	0xc6a4a78c,	0x90f5cfb7,	0x66ec3d57,
-0xd9914756,	0xb3138c73,	0x69c01b23,	0xcb99a6f0,
-0x96ebb2db,	0x55deaeeb,	0x97e60f3b,	0x96c1776d,
-0x08d15554,	0xaf028e0a,	0xbdc887d4,	0x377c3fc3,
-0xa73f7fce,	0x875bdb80,	0x2b2a8115,	0x855f5412,
-0xc74fe60a,	0x1153038b,	0xd156fac3,	0xd32d49d9,
-0x39362ff1,	0xc93951f6,	0xda6b6688,	0x050ded5d,
-0xec5b05b2,	0xf3cde21b,	0x135002af,	0xf28d1e45,
-0x87f8ac42,	0x1808c59b,	0xf1a9a99c,	0xa3c079b4,
-0x618398ae,	0xdafd0792,	0xa1660c5a,	0x6ce2b855,
-0xeffb8673,	0xba52b2c2,	0x6ea9eacf,	0xcd199498,
-0x8c40ee4f,	0x4d0ef108,	0xceca369b,	0x9be2fcc8,
-0x7dcf0b48,	0xc896c374,	0xa5c99fa0,	0x4e0439cd,
-0xde60ed85,	0x919b4a0f,	0x42dec524,	0xc6816f32,
-0xb55b5b78,	0x5b04fadc,	0xe76b74da,	0x8831a1a7,
-0x4da4822c,	0xcdddd7c5,	0x871d13de,	0x407b21fe,
-0xf723c517,	0x9c31f7a1,	0x6a70544c,	0xdc09b250,
-0x85543abb,	0x470e242b,	0xcdd37b16,	0x96b413d5,
-0x668d6a71,	0xccbdf00e,	0xb8a97064,	0x45c99ae4,
-0xcbb8497c,	0x85e42264,	0x4ca5f7d0,	0xc2226431,
-0xbe6e9ae3,	0x52c3942a,	0xe6d864b8,	0x95881f73,
-0x4b73573d,	0xdd99bf30,	0x9e8a7486,	0x5a189375,
-0xfe50ad4a,	0x95122b0d,	0x6f3cf161,	0xdc688639,
-0x8adf821c,	0x53bacee5,	0xdc1bbc9e,	0x8ecaaf3f,
-0x7a2e5ac3,	0xda48729f,	0xb0dfba0c,	0x4e7a9d7c,
-0xda65e096,	0x88d8bb16,	0x44e67898,	0xc650ff49,
-0xb9a43a9d,	0x58e53b4f,	0xf933b6a0,	0x9e9d335c,
-0x578869ee,	0xd2883627,	0x8bd3ab9d,	0x5e29c348,
-0xe6c5a282,	0x8e82941b,	0x7979e140,	0xdc56e429,
-0x9745fd79,	0x4b950ee6,	0xd272f837,	0x9af05970,
-0x7759d3e0,	0xc8ee8e0e,	0xbacb9ed5,	0x440d9114,
-0xd5bc1831,	0x912e2243,	0x56af00c4,	0xc23ec9db,
-0xba9e9d48,	0x5faacb65,	0xf73dbbff,	0x93836333,
-0x585bbc70,	0xc0d7e190,	0x932a74aa,	0x492cb232,
-0xfc36cf0f,	0x835177c1,	0x79d72f94,	0xccc718d1,
-0x8f042ef7,	0x598a6fb3,	0xd13abadc,	0x9f9bd37c,
-0x7dd5d78e,	0xc9dc4386,	0xbb82c5de,	0x49b3c88a,
-0xcb327a3b,	0x8079a035,	0x6ceeab9a,	0xc6c94539,
-0xd3e59ff3,	0xb6734f63,	0x6532095b,	0x95fbb24d,
-0xb8f3d958,	0x2774b965,	0x85b787c3,	0x09829f85,
-0x2dbf0048,	0x36eb1841,	0x152f6a16,	0x33fb0ebb,
-0x30da5568,	0x133b5de5,	0x250ba5db,	0x239c23c4,
-0x075baf9a,	0x3537b51b,	0x055d28de,	0xf6e7138a,
-0x1c385d65,	0xfbabee54,	0xc9a8bccd,	0xd4b82b1d,
-0xc5a641a6,	0xf1e979e5,	0xd16bc5cb,	0x3b2d7882,
-0xfe16497c,	0x38501d49,	0x23b94d60,	0x1c1599c0,
-0x34ed3dd9,	0xd2a70152,	0x0bd63ff1,	0x29d7c05d,
-0xc9994c27,	0x1d28ae35,	0xad24c6b8,	0x903cf6de,
-0x9730ee69,	0x05578fc8,	0x818ee685,	0x7dff8b27,
-0x10d2f9c4,	0x7e62c1fa,	0x74caf9cd,	0xd6431b77,
-0x78f4d042,	0xad1d90b7,	0xc9bc08fd,	0xc6485ea2,
-0xb798605a,	0x6a2b95ac,	0xd0390295,	0xd748a646,
-0x7530ded2,	0xbc2ccfff,	0xddadb60b,	0x417e02e7,
-0xa7b63c65,	0xeb5d09c8,	0x4290aa24,	0xba90e59b,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1342-m02f252a.inc  */
-0x00000001,	0x0000002a,	0x08112004,	0x00000f25,
-0xad53035d,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x017464fa,	0xd2fb3494,	0xaf1850af,	0x5af88989,
-0xd3a0a9dd,	0x8e8bd3ad,	0x8c288786,	0xf15f02b0,
-0xf51c1471,	0x6c675200,	0x9c63f3e5,	0xbeb2d710,
-0xbfb6d14e,	0x6ba07894,	0x4b08036d,	0x71a24d5a,
-0x953125c3,	0x2cee5c1f,	0x744a15b1,	0x43a6f67c,
-0x66087dce,	0x58bc5f0c,	0x09c1f187,	0x29065a8c,
-0xb46dcc30,	0x597c4675,	0x2ce2fd55,	0x7329e04a,
-0xe92adf75,	0x0a4f1f59,	0x6939b7e1,	0x586b6cb9,
-0x9e9090f2,	0x612aeaa6,	0x908cfbac,	0x381a3a1d,
-0xc0028180,	0xe7759a09,	0x9a41f6d0,	0x49004723,
-0x447b0a1e,	0x84cea1bf,	0xdb6cfd61,	0xfa3fe8a1,
-0x60569cec,	0x4ed55542,	0xc40d1fbb,	0x9766fe4a,
-0xbffcd59e,	0xc0ec45af,	0x34da2fa6,	0x57a8f38b,
-0x7cf8ab33,	0x991f0a4b,	0x83c635f3,	0xfaa6b412,
-0xd6cfe7cd,	0x7eb7773c,	0xda12abb8,	0xae7f78c6,
-0x0c82ad31,	0x28e15d48,	0x80a0cf1e,	0x6b8a9a75,
-0x1a9aa64f,	0x4a2969ee,	0x9273d48d,	0x7179df33,
-0x06fc27f8,	0x7de9a40b,	0xaaa80cac,	0x83d82561,
-0xe0646103,	0xa72284fa,	0xb39b5822,	0xed08ed9d,
-0x95760781,	0x2f84666f,	0xd1d45bed,	0x96a86c3a,
-0xe4679e8a,	0xfa71d608,	0x86baebc4,	0xf116edb0,
-0xd3a7263f,	0x237b4f06,	0x794f33e6,	0x0d783309,
-0x2df3bb25,	0x02a800b8,	0x97b8ce5a,	0x2123dc61,
-0xee1a5dbe,	0x185cf436,	0x84e325f6,	0x163e3ac3,
-0x62288e57,	0xe5901f0f,	0xef985c3e,	0x1b9291fe,
-0xb58de2b0,	0xe69eeadb,	0x42eefa7f,	0x0472359e,
-0xb1fd90dc,	0x49d374d3,	0x49684482,	0x1156a2ac,
-0xd0a6114a,	0x995f94a6,	0xbcf9ed4f,	0x51d161c3,
-0xcc68e39f,	0x3d050ca9,	0x8cd08b93,	0x6ed69d22,
-0x5fd5cc93,	0xe2783743,	0x5a1816c3,	0xda5a0ea4,
-0x9b5c7903,	0xc25d6a23,	0x25cd54ee,	0xe1ab0174,
-0x518ffebc,	0x28125044,	0x7ff130d8,	0xfbea3a8d,
-0xe093582b,	0xf60baa3d,	0xe4674a15,	0x18a6322c,
-0x21cfa3bf,	0x71a1a376,	0xdd4de139,	0xed578831,
-0x0ab06a62,	0x9cee036d,	0x11ee0350,	0x62ee22d0,
-0x83681acb,	0xef69ded4,	0x65000a40,	0x9ac7ab74,
-0xd76792db,	0xf2e662f2,	0xdcae14a5,	0xfa39ba60,
-0xf746cf70,	0x0bea4f1b,	0x9b384717,	0xf8dafd90,
-0xb2ffc2ab,	0xf3fa97e4,	0x5f22e0c3,	0x04536e9d,
-0x22c99598,	0x34631815,	0x9fc99bfa,	0xfe067ae7,
-0x03fbd87a,	0xdc73bcd2,	0xc49a0fbc,	0x3138c419,
-0x62643c63,	0xfa2597c7,	0x4c84afef,	0xdba2817e,
-0xe818ed14,	0x74a5ad6b,	0x9cf3ced5,	0xf633dd12,
-0x4ba39a46,	0x8b37b668,	0x65637f55,	0x67c7ce04,
-0xe860a2e3,	0xf264ba03,	0x47b91726,	0x887f4d41,
-0xb10685e0,	0x95958791,	0xcb835bbc,	0xf1af6594,
-0x42fb5a5b,	0x78ff5368,	0xb201a575,	0x8a6b189c,
-0xc3f6e3a0,	0xe2bb320e,	0xd75004dc,	0x735b0c3b,
-0x70ccd09f,	0x4d157775,	0xc0663e58,	0xf2170355,
-0x4d86c74b,	0xace253a3,	0x09fedbf3,	0x5288ffb6,
-0xc577a648,	0xf808ffc9,	0x6f1b81ee,	0xa56d4123,
-0x60626a1b,	0xc88b4d17,	0x280e44c5,	0xf56c8ddd,
-0x9110c257,	0x2d65519d,	0xc96c1ad5,	0xcfdea3e5,
-0xa69ea62f,	0xf3ed57ab,	0xbe725f8c,	0x2e3c86df,
-0x23635626,	0x7d2607f6,	0x67fe2874,	0xe64ade4d,
-0x5fe967da,	0x88cb5547,	0x468c3eb5,	0x73313404,
-0x36b6cc3f,	0xf352d0fc,	0xcbd702bd,	0x969a1606,
-0xead2f56d,	0xf4c93dd8,	0xd2395873,	0xe5304e3c,
-0xdbe3e804,	0x1daf81c0,	0xfd6cbdac,	0xfbb07447,
-0x1970d752,	0xff97a936,	0x1cf114a2,	0x03b678d5,
-0x6edaacf8,	0xd4a869c9,	0x6db6f5fa,	0xe48335d1,
-0x6c59f701,	0x2cd977a6,	0x02079375,	0xc573f27b,
-0xd26f8f28,	0xe637b462,	0xb9ef5a9d,	0x2483a550,
-0x8e020039,	0x01d2e9d0,	0x8e69c688,	0xfbf941b7,
-0x86dcab40,	0xe99730b6,	0x0e57bd5d,	0x11ace616,
-0x3a5c73dd,	0xe29052c6,	0x6728d6e3,	0xf5a73743,
-0x6ef89691,	0xffa40f45,	0xd1a1b739,	0xf12697be,
-0xfc849142,	0x1a6daa37,	0xc52c54a3,	0xe600bbb2,
-0x6c90e1e9,	0xf9ba4ed6,	0x118b0436,	0x0d864deb,
-0xa574b526,	0x6f2da0ae,	0x7297e467,	0xe33a4e82,
-0x6e8a340f,	0x9524f758,	0xb7d9d387,	0x67ed6069,
-0x3fcef9be,	0xf3684381,	0xb8012434,	0x86d3a9a9,
-0xdb45b646,	0x8de08c40,	0x37a91d86,	0xfd107ef4,
-0x0b1db4d3,	0x73988186,	0x74b646a5,	0x92e5a61f,
-0x72239610,	0xf9b6564d,	0xce99179a,	0x61ebb35c,
-0xfb2495bd,	0x36ab39d8,	0x7cca0da4,	0xec4b5d5c,
-0x3210c169,	0xda27c02b,	0xd80c5c8c,	0x38518cea,
-0x5daa2473,	0xf15b6134,	0x733e7412,	0xd6a5ae78,
-0x3b0d4f4d,	0xc6304bb2,	0x7f6df8e6,	0xf6b0e912,
-0x2da01433,	0x2cf7b1ce,	0x32e046e7,	0xcd50021d,
-0xe39d167d,	0xef608f10,	0x5d96e85e,	0x38a113a7,
-0x3ce761fa,	0x26a0250e,	0xa27c2468,	0xfd563262,
-0x9f6f6866,	0xda194d33,	0xa5458a6c,	0x32aa53c8,
-0x2517e3bb,	0xe5070380,	0x72d71801,	0xdee77333,
-0x63f71503,	0xe4cc9d5a,	0x1f684f79,	0xebab1828,
-0xcfdcbec2,	0x1913c83c,	0x72abfe52,	0xfcadec5a,
-0x9a32da3e,	0xf730dc13,	0x529ec685,	0x1d558dfa,
-0x3fb232f2,	0x041148b4,	0xd10bb0b7,	0xeb6821e2,
-0x070d709f,	0xf92b67a4,	0x6d6af041,	0x1724d766,
-0xf21a821d,	0xea6e49d8,	0x9d30cef2,	0xe0c055b1,
-0x67901316,	0xb37f63f9,	0x5984e1b1,	0xf83466f0,
-0x1404ac22,	0x4345d90c,	0xa14ef8b7,	0xa812e742,
-0x62593a25,	0xf08c3643,	0x3b376203,	0x5ddf0e1a,
-0x429c87d0,	0x31c7a9f9,	0x18f25314,	0xf55e9515,
-0xd26dde06,	0xd07605c7,	0x51877d68,	0x31054918,
-0x668e3ae2,	0xe273138d,	0xef9b9beb,	0xcf19359e,
-0x7ccb675b,	0xca018219,	0x1a614824,	0xa1ac60f6,
-0x512484e2,	0x249d2429,	0xa4e02fce,	0x85c52616,
-0xfc3e1b33,	0x11885bef,	0xf1729589,	0x78342f7a,
-0x3a115d84,	0x74698c2a,	0x59b804d6,	0x96598928,
-0xeafb3b9f,	0x788556ba,	0xf956a1c4,	0x5ae7d9b0,
-0xe86bc7d9,	0x7483aa3f,	0xa2126202,	0x5852027c,
-0xbb2db21b,	0xdf7dcaec,	0x3eaa745c,	0x49390086,
-0x60575f57,	0xba173f97,	0x90bd11ab,	0x0db322ea,
-0x2a57df73,	0x89157540,	0x57bdf2fb,	0x32b0919b,
-0x135b0600,	0xaaeb1076,	0x2a7b30ed,	0x73f755fe,
-0x81650eb2,	0x4640b0f0,	0x6f89926c,	0x4bd8b89b,
-0xb8233621,	0x24a33dcf,	0x1a6bbb68,	0xeb01530f,
-0xcc259353,	0xc17c16d6,	0xbb207fb0,	0x27c1ebd4,
-0xed585fe7,	0xf2edcabe,	0x859eca51,	0xc2f2d4b6,
-0x3f779a7c,	0xdbdfe2eb,	0x6e7afe41,	0x875cec34,
-0xa297ecdd,	0xc4593faf,	0x51764582,	0x2045ab44,
-0x82c1ff7a,	0x9e654d1a,	0xef96a26e,	0xf9c5a8e2,
-0x1949c1ec,	0xdb0c039e,	0x501af00f,	0x5aa5de51,
-0x3020a51a,	0xe17c9fd5,	0x422906c5,	0xb768b789,
-0xf0125395,	0xb5144500,	0x8ff2edf5,	0xdcba4acb,
-0xf5918257,	0xb202af03,	0x1e50ed84,	0x72e3fca5,
-0xf48d1811,	0x2800e62a,	0x2ed0487d,	0x4730996e,
-0x55c149a1,	0x65dd8078,	0xdf3c47f3,	0x004ce5e8,
-0x12d22a38,	0x56c81e58,	0x0093d696,	0xe362be3c,
-0xbd7908e5,	0x1448356e,	0x72673597,	0xc94a3b8e,
-0xae21f2cc,	0xf1bc2614,	0x79c1eac1,	0x16f59499,
-0x008f11a5,	0xd86396c1,	0x56781c3c,	0x718694c7,
-0xf6948d20,	0x164cfd4b,	0xbfead8fc,	0x6014c180,
-0xb17136f8,	0x6d26d710,	0xd46ca41d,	0xaea0181b,
-/*  535-MU16810e.inc  */
-0x00000001,	0x0000000e,	0x09211999,	0x00000681,
-0x02aa9e53,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xa3826712,	0x9971f6d9,	0x717628c3,	0x0fa17f01,
-0x1ec494d0,	0x76bb865d,	0xb8ee6c03,	0x4aebbf9b,
-0xf6e250e1,	0xc3e1ff78,	0xe1ca5a38,	0x01359757,
-0x9d2ab268,	0xa2f0b055,	0x7f57beda,	0xcfc1c483,
-0x25b50b8f,	0x5625931d,	0x32791755,	0xa7b271e4,
-0x8daf1c60,	0x9add85b5,	0x1faf9968,	0x3c6b2f7e,
-0xcaf36c5b,	0xd75190a5,	0x0fd8473f,	0x35a6851a,
-0x80498f48,	0x922c570d,	0xd343dd3f,	0x420d68a4,
-0xf3d3e34b,	0x9f8e3981,	0xd7fa629a,	0xb75ffb4d,
-0xefb42deb,	0x0b21ef31,	0xa2088a34,	0xa89133e2,
-0xd839caf1,	0x56be7fd9,	0xea6f3ff8,	0x97783330,
-0xc6971be0,	0x1fc6fccf,	0x331cb3a5,	0x0b51943b,
-0x60a7befe,	0x2815bc9c,	0x5b87374a,	0xa059d986,
-0xe605bc93,	0xe64ebb70,	0xae782a6e,	0xfc78e27c,
-0x6d328f53,	0x6ee07ee9,	0x3d976316,	0xa202fd83,
-0x42bc93eb,	0x6011768c,	0xc0cd685b,	0xbfa44ff0,
-0xb1a42d0e,	0xfba4071f,	0x84be8a4b,	0xda405846,
-0xc57de4e0,	0x94c2db62,	0x5ea46276,	0x68532e48,
-0x739f2061,	0xe83be5f8,	0x01512724,	0x17921d87,
-0xe14df45e,	0x0d32a208,	0x762b277b,	0x36f6b74b,
-0x07be0bf3,	0xf3b4181e,	0x95ea3ffa,	0x033df16a,
-0x67ed2ae5,	0x989531e9,	0xdfb69578,	0x6ca56d00,
-0xe2f2184b,	0x17f6a230,	0x26ec4a92,	0x9013b3e3,
-0x11b5e3b4,	0x207ef9a4,	0x0ddb53cf,	0x74a168b8,
-0x834453a1,	0xaa2e2e81,	0xa5c90f38,	0x5f5ae5b3,
-0x0f09aa1c,	0x19929274,	0x5bb6e90b,	0x66927421,
-0x952dcf70,	0x89c35f06,	0xb3050013,	0xa344a3e3,
-0x3cc76dd2,	0x525c96fd,	0xdc72d098,	0x07b05407,
-0x4ea1b6c6,	0xd8f5bcea,	0x7822ee01,	0x3f90c906,
-0x9f2e4ec7,	0x7dc5aac4,	0xfa700502,	0x90887ff6,
-0x0f8cf395,	0x9b556509,	0x183e0d1b,	0x88cc120d,
-0xdf65b198,	0x991ccf57,	0xe2626f93,	0x82c758cc,
-0xc250b731,	0xed87fac3,	0x5afced73,	0x1d37519a,
-0x785fccad,	0xffb0d0e9,	0x88a3f327,	0x705ae1ed,
-0x974e2ae9,	0xd3f8280b,	0xa13c9f52,	0xb5b9eade,
-0xc9b91cde,	0x83d6ff2b,	0xc2a61865,	0xe0de9e81,
-0xb1d2e242,	0x7ffa8e15,	0x98a1f351,	0x6075f89f,
-0xdb1139b5,	0xff53a15f,	0x59d9498e,	0x2544a92d,
-0x5e54f2a6,	0xa8dce04b,	0x80f367bd,	0xb105a1e2,
-0x0dc47778,	0x5fb0a3bc,	0xc0ffb5bb,	0xb06bc1d3,
-0x959776fa,	0x9c917553,	0x0b060078,	0xd1d9450f,
-0xe6e8ebaa,	0xf6ba895b,	0xfef15af6,	0xaca6aeed,
-0xb4eb8789,	0x76128d63,	0x9c9dc872,	0x6a4fd299,
-0xa7eb1e33,	0x571674fd,	0x6073c4f3,	0x7972804f,
-0x73f72358,	0x5f23a534,	0xa4cd9b93,	0x94371f63,
-0xe3868a0b,	0xd5e18036,	0x683ac91a,	0xc7efadc3,
-0x49530c41,	0x2dfc7378,	0xb347634c,	0x346e6cb4,
-0x0614dcdc,	0x2354afa3,	0x4d5fcf18,	0xc406909f,
-0x0fdc3a94,	0x17e804ad,	0x7e5d27b3,	0xf710a493,
-0x735dc0d2,	0x6c82225c,	0x86b80c2e,	0xc83fa3c3,
-0xddcd7f93,	0x5c7e7f80,	0xb3f739e3,	0xb027392b,
-0x4d3e6ce8,	0x526fffac,	0xa783d364,	0xf6b43a19,
-0x6ab12fe3,	0x72ffa066,	0x4990f0c7,	0x63c1c4f4,
-0xcddeb2d8,	0x806d60cb,	0x4395d31f,	0xca3930a6,
-0x1ee270b2,	0x0521e26e,	0xaad7ee7c,	0xcb5a8502,
-0x63a00a64,	0x4bb5b884,	0x56db2b2c,	0x7a6b1ff3,
-0xa56a10ee,	0xb3ba2efe,	0x4c5c0bbf,	0x96320c37,
-0x2383cf15,	0xce011b62,	0xbf2d0e37,	0xcbfbc5fd,
-0x50f83db7,	0xef633153,	0x66d62778,	0xef02ef93,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1106-m02f241f.inc  */
-0x00000001,	0x0000001f,	0x06052003,	0x00000f24,
-0x1f19b59b,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x5715f121,	0x440ce2fa,	0xd5d090eb,
-0x70b3e977,	0x92320e8c,	0x4f989906,	0x36907442,
-0xcc4b12e2,	0xb456a6ae,	0x0ad5bcf7,	0xe9f0a425,
-0x70b932d2,	0xe66202c9,	0x350f8d4b,	0xd560a828,
-0x763e8420,	0x4595b38a,	0xa66d6637,	0xe2adc7be,
-0xc5d9515e,	0x7d6d08cd,	0xc930e826,	0x528d413f,
-0xce5ac17a,	0x86b9646b,	0xe7845b29,	0x0c56e922,
-0xad8a85f2,	0x8e9d478d,	0xd6faa7f5,	0xda7ac699,
-0x10859ceb,	0x0c7c1cd8,	0xfd7bc59d,	0xb847dddd,
-0xe545057b,	0x5af340d6,	0x1e2f8c45,	0x26c9c8c6,
-0x8b6ea51c,	0x75280c65,	0xeb953366,	0x6400e75d,
-0xfe0be614,	0x4b47f2ca,	0xac119100,	0x2f973c6e,
-0xe3600377,	0xe234bd6c,	0x6010f6fb,	0x497c113b,
-0x10824bec,	0xe897a508,	0x0de50694,	0x8202b8a6,
-0x79dc657d,	0xa82cd03c,	0x6df4b693,	0xe2586379,
-0xba899b59,	0xcfdfd29e,	0x207d1458,	0xd91fc2d7,
-0x55ef9753,	0x6ea6860a,	0x69fe1ea1,	0xc8f4b482,
-0x4796d795,	0x87f1131c,	0x3a1e5b4d,	0x57d06ed0,
-0xb627f7ff,	0x0390c72b,	0x5a8794bb,	0xba43f4d0,
-0x1b13f093,	0x9fcffdce,	0xb92dcf40,	0x22d7e700,
-0x268be4ea,	0xec5f28bf,	0x8b9eceb1,	0xd47c7c9e,
-0x2d379513,	0xfd0dc66c,	0x65da5790,	0xe51abca8,
-0x3eb9df98,	0x64471d12,	0xab28627b,	0xe223a431,
-0xeaae03e8,	0xe42404dc,	0x27573c06,	0x1784daf2,
-0xdbdcc49e,	0x2797692c,	0x5220fd9a,	0x80d0ff11,
-0xd74f16e1,	0xe65046ac,	0x681585b6,	0x33c86d05,
-0xfdfb0a45,	0xc53ad831,	0x9453c37a,	0xef236977,
-0x16558437,	0x21d8f503,	0xd30f65ce,	0xa1e80048,
-0x841b0747,	0xac5a8d0a,	0x82cb186f,	0x57fa0ccd,
-0x200de1f2,	0xa3bf1cee,	0xbdad77bf,	0xfe703486,
-0x00049233,	0xef4a7506,	0xe84d309d,	0xaead661e,
-0xcc185f9e,	0x18d07342,	0x7accaa17,	0xadcdf48b,
-0x24ac2c5f,	0xe50cbf43,	0x08cf27ed,	0x6106b55c,
-0x830a0dae,	0x2435eb4d,	0x776f15d7,	0xdc0eb92f,
-0x4733331f,	0xe9a8b196,	0xfcd516fb,	0x2f17ac9a,
-0x1ae63b82,	0xadb5be5b,	0x7c650339,	0xfd2ce3cd,
-0x9dcf7535,	0xda1e0685,	0x3c41984b,	0x9001047b,
-0x39a6808a,	0x7cd929d6,	0xbbe27a05,	0xe502919d,
-0xbd0f8d68,	0x1ae3ca80,	0xa85576e2,	0x5ffd286b,
-0x89bea08a,	0x8b6ccf11,	0xd8caa1c1,	0x20bc02ad,
-0x0b0074f6,	0xf03d2e7a,	0x925a05f5,	0xfcfb6cdb,
-0x26adbe25,	0x4bbb3d3b,	0x3e79e740,	0xa26a1af1,
-0x4c81a93e,	0x1972b943,	0xa0a01b9c,	0x1da11031,
-0x0c3a95e7,	0x0d7b0835,	0x813788b9,	0x3bde2fa6,
-0x25bf03b7,	0x4f6939ac,	0x5174c8c0,	0x596a33a7,
-0x07a9f755,	0x9171ec2b,	0xa7ba9b6d,	0x4613926f,
-0xe7cf7e0f,	0xae9f8542,	0x1166b060,	0x9b742e82,
-0x1f3bbb89,	0x29e8e508,	0xe99db755,	0xa75422ca,
-0x21b59115,	0x5a8d61a5,	0xb34148bd,	0x28f52ce5,
-0xa0eb85e1,	0x4395cd32,	0xa5d2bfde,	0x408cd485,
-0x7f96b5f8,	0xd7113b26,	0xcd0df97c,	0x28af3a7b,
-0xe3299dbf,	0x74ac44c4,	0x78524806,	0xce4c00d9,
-0x4ca8c7eb,	0x196d4c86,	0x0302ba3c,	0x4092a270,
-0xd6dc06e2,	0x0c373839,	0xafcf07fa,	0x1a7e415f,
-0x18fb4cc0,	0xa99c5f02,	0x61d6d815,	0x45f219f3,
-0x3a36a838,	0xea95523d,	0xfbe05004,	0xeb5cb78c,
-0xdd141102,	0x486c0cf7,	0x2aa493e5,	0x9fd4bacc,
-0x1bc9944a,	0x225984e5,	0xfc026ee0,	0x6d2fcc70,
-0xd49bcfcc,	0x23bff82f,	0xb16855f7,	0x622e4b35,
-0xd8bb11e3,	0x5fb5ca0f,	0x07201920,	0x1e810ba3,
-0x251d4fed,	0xb4af51e6,	0x85e13f71,	0x181e4f28,
-0x64bd7d03,	0x547f675c,	0xc227f1e7,	0xbb7a79ec,
-0x02c75036,	0x8f691aa5,	0x42381ac1,	0x5e865d0d,
-0xe97bf6bb,	0x70d917df,	0x91b87cb5,	0xa2b40540,
-0x995beac8,	0xaddb86b3,	0x6505a561,	0x5000e8e6,
-0x5ccbdbf0,	0x9cadcd0d,	0xe2cfad13,	0xa40c1f02,
-0x6383e8f7,	0xd5b28b36,	0x89e279a4,	0xf62515ca,
-0x1141fead,	0x7675f500,	0xf091e74c,	0xba19befe,
-0x06a3bad2,	0x838d52df,	0x4f600866,	0x2c74de22,
-0x9d2c0209,	0x6d1447fa,	0x6a029510,	0xfc185749,
-0x2bb38280,	0xf3b753cd,	0x7e2d1c7e,	0x09b1f4cc,
-0x813c4246,	0xe7de9137,	0x2a4a5e53,	0xf7462270,
-0x22c8934b,	0x8c3068a5,	0x9475dfb0,	0xca3d63c5,
-0x049303a9,	0x4264ff48,	0x6743887b,	0x90e39264,
-0x3c283155,	0x937ab964,	0x4915ab48,	0x432e2d26,
-0xc0f232a6,	0x1e2242fc,	0x4d632b13,	0xc9f83231,
-0x617c0605,	0xe2e3611a,	0xcead2a98,	0x3487ab1e,
-0xebbd2233,	0x89fd5fab,	0xb15023b7,	0xcc6e3add,
-0x26fc7908,	0xad4eeacc,	0x32fd0f30,	0x8f2ee30d,
-0x8d80ab0a,	0x6cc4dfb1,	0xa184df64,	0xec10053f,
-0x316764d9,	0xa2de5bcf,	0x71e15024,	0x3577ef82,
-0x1e778c21,	0x7ba95277,	0xc7ca2153,	0xc1450741,
-0x1e6e0544,	0xe23afc78,	0x2c2bca85,	0x73f5e5d8,
-0x143be075,	0xc8329359,	0xa2e3e11a,	0xcdce223e,
-0x1bf0dc1c,	0xace3982b,	0x12bb4158,	0xe62eb96b,
-0x5b457af7,	0x6c93e00f,	0x01376b8f,	0xa4a6e161,
-0xfb333708,	0x9d7451c9,	0xd69ec6d4,	0x20ec9396,
-0x9c8d181e,	0x555e322d,	0x8a1cfffe,	0xfdf773af,
-0xf345058a,	0xbfd0ef18,	0x9f62c8ec,	0x444f1d96,
-0xd24d6bd5,	0xe060264a,	0x90a09309,	0x8ca7e78d,
-0xcfa08cfe,	0xe1a70200,	0xe1f46b36,	0xd2934b88,
-0x8ef5384c,	0x1f8b54f4,	0x50164c32,	0xf08c1564,
-0x8b217ebf,	0x91682eb2,	0x70699e3a,	0x091f32a3,
-0x7b9213e3,	0x505cdcbb,	0xfd171a85,	0x8f8b7203,
-0xdc2bd0cf,	0x8d9f8b1f,	0x7d66348b,	0x6d94e761,
-0xf140d4c8,	0xf8377cbf,	0xa06a1b59,	0x87b4be17,
-0xc349c49a,	0xbb546fdd,	0xd8386467,	0xce833bce,
-0x2f37d875,	0xa939f441,	0xecf6020f,	0xb2dd210c,
-0xe7234869,	0xb30a55ca,	0xd6a33c86,	0x4aa0e617,
-0x4a0fbe69,	0x01196fb8,	0xc4526ae2,	0x1ede9d7c,
-0xc1f93fa5,	0x5272f02f,	0x3a2d469a,	0x8434c542,
-0x9bdee4df,	0x47439e5a,	0x4bcbbe3a,	0x5c0afa2a,
-0x5c87d7ee,	0x3e5d40f4,	0x3ee86436,	0xac66c772,
-0x373c2e07,	0x1a688ade,	0xe7f2922d,	0x4d27b3c7,
-0x3af4e288,	0x139e43ec,	0xbf8c93c4,	0xdfb75db2,
-0x8a83e530,	0xc04410f1,	0xd2078dbb,	0x375b20a9,
-0xca4506de,	0x19bfe101,	0x676b0a36,	0xa0af8c82,
-0x47e0cd27,	0x2ea6fcac,	0xbd9fc102,	0xbeedff19,
-0xcff74bbb,	0x845b3c5c,	0x974e6e96,	0x53c9140c,
-0xd76e5b60,	0x9064f35b,	0x02555ff0,	0x21dc8658,
-0x92fa2cf6,	0xa9122e4a,	0x94de922d,	0x127f1a1d,
-0xa8b72474,	0x58e76f8c,	0x363d276e,	0x315e3464,
-0xb53354d2,	0x70e794f4,	0xd91f7f17,	0xd8d7322a,
-0x719c7c85,	0x3bb6719a,	0x7af1b4db,	0x4a6630d5,
-0xe6fc3575,	0xfbf4d5bb,	0xb4e3990a,	0x28f239ca,
-0xa27ec578,	0xf360f7a9,	0xcb1b669e,	0x39809f83,
-0x656bc617,	0x4db0e850,	0xab7f6043,	0x5225bb7a,
-0x3a69084f,	0x2821ab20,	0x624da16b,	0x3a303af2,
-0xd5c9132a,	0x1d587f13,	0x1712680a,	0x876484da,
-0x57d88391,	0x52926e6b,	0x36205838,	0x569050b8,
-0x9417d289,	0xe321e75c,	0x1a4cfaf2,	0x8fde123c,
-0xa1f24d2c,	0x005e5dd9,	0xfce4239d,	0xa401a507,
-0x556608bc,	0xbeb767c5,	0xe98daaca,	0xe8a11e58,
-0x06e79615,	0xbc4dfda6,	0x9ab20d3d,	0x6e86a15b,
-0xf1220acb,	0xc4ea8029,	0x336ed96b,	0x9f3dd547,
-/*  1355-m206d618.inc  */
-0x00000001,	0x00000018,	0x10172004,	0x000006d6,
-0xb7b66d41,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x8b98468f,	0x3766ea87,	0xb09b21d3,	0x56122294,
-0xc5ea11ed,	0x37f76e26,	0xc0f15ba1,	0xa1e74bba,
-0xf7177ffb,	0x5182564a,	0x45910773,	0x0eda2672,
-0x3657cb88,	0xdb55fdda,	0xd8318d0c,	0x3ebb142d,
-0x522ac44a,	0x83ab943b,	0x61765fa9,	0xea2a1c58,
-0xb5c6855e,	0x36f522c5,	0x679a3940,	0xd9a73e8a,
-0x4296cf82,	0x9a9da755,	0x50632ab2,	0xd20195b5,
-0x0da70fbc,	0xaa54fa84,	0x0d968f90,	0x8885f6e0,
-0x5c5be87b,	0x41b3ef59,	0xd126d9bf,	0x892a09f7,
-0xfe6aaaff,	0xf92fe218,	0x0820627b,	0xee58f87e,
-0x4cf5d03d,	0xfa96f89d,	0x67eb2bca,	0xb9f39726,
-0xffe7cbdf,	0xe306b9c6,	0x7478f683,	0xb3dba716,
-0x1cc1355d,	0xd4df036a,	0x61eaeff1,	0x6db53d06,
-0x9d8cdeb8,	0x3fe76f33,	0x499a5816,	0x767b66d2,
-0xbe7fe0e8,	0xa12b7466,	0x11b91265,	0x399ef7cb,
-0x563f2d7f,	0xb58199af,	0xbd86210c,	0x3ed97fe3,
-0x2281abfa,	0x03128e49,	0x71682563,	0x7473a011,
-0x5bd1eba3,	0x825db526,	0x47bb0d9b,	0xed4b0c1f,
-0xd4f5ef22,	0x1ac56dc7,	0x11c39136,	0x860a45f2,
-0xfa583033,	0xa4b46a27,	0x1092ddd7,	0x3b80bceb,
-0xca39816c,	0xbd71827f,	0x3ec0546b,	0xeb62fa40,
-0x3c90b1cf,	0x7a6f6561,	0x90732e6a,	0xae804456,
-0x33872789,	0x34cc11db,	0x1cf32833,	0x19e8e8a6,
-0xd8263d3e,	0x7789b962,	0x5b62a57d,	0xb82342dd,
-0x2b5109af,	0x2dbf1000,	0x143f181f,	0x9701d7e1,
-0xcf664358,	0xb7e12d61,	0x2d05020b,	0xe0a22ed3,
-0x06d12c8c,	0x001c2b91,	0xfed1cc3e,	0xeb220962,
-0x0214231b,	0xefe9d21a,	0x01c91de7,	0x442d153d,
-0x586a3f62,	0xcd135df5,	0xf5695a08,	0x0882bb15,
-0xb3d35f8c,	0x4c4a9889,	0x0e478731,	0xf48ee282,
-0x414bc1cd,	0xe228649c,	0x6ebe67bd,	0xfb72a712,
-0xf644a517,	0x657672f5,	0xdbe4f19e,	0x1a008de6,
-0x5178a6bd,	0x8c123abb,	0xe922b727,	0xd166b732,
-0x640f2583,	0xe6f2abf1,	0x4053736a,	0xab8e972f,
-0x2f137c09,	0xf04f7151,	0x2c6f72e1,	0xf6c74f8d,
-0xb8f506b3,	0x5de769ce,	0x0131cd04,	0x6cb62594,
-0x4199ecaf,	0xa45b93ae,	0x45642462,	0x63ec25d3,
-0xa793b3a1,	0x2b65326f,	0x4bb6e174,	0xa9ee5e36,
-0xb44e3800,	0x414e7d6e,	0x649210ce,	0xf247e0c7,
-0xf08379b1,	0xb1b2b5e1,	0x4f546ffb,	0xc4c3f671,
-0x41ecb2e0,	0x77178934,	0xeebefb09,	0x1fad39ff,
-0x1350b86f,	0xe140e8ca,	0x4eada8cb,	0x5209c265,
-0x695d5f95,	0x7ad173a7,	0xcd477f42,	0x02aaa026,
-0xd9d5e9c7,	0xa0935c5c,	0xc933399e,	0x33a16934,
-0x65669841,	0x4f3a35d0,	0xcab795eb,	0x34e264ea,
-0x65614bf6,	0x1d2bdc96,	0x4d591da7,	0x1c16d183,
-0xa66ed275,	0x4a954ca9,	0x40ca4e3c,	0x8993d784,
-0x67cfedcf,	0x4cd774e8,	0x81d48fdc,	0x152158f2,
-0xaf252dff,	0xf805bbc3,	0x08a2a759,	0x78888b77,
-0x8a5b7aa4,	0x37df8729,	0xf103811d,	0x6e4aa56f,
-0x7fa87e82,	0xbe5cb863,	0x9d06ede2,	0xb01a3cde,
-0x6118df90,	0xb75068cc,	0x69304bc8,	0x4c197795,
-0x11de2f62,	0x810faad7,	0xac232848,	0x06edff7b,
-0x71dec49b,	0x9f3e44c5,	0x0c4ce897,	0xf2e84f71,
-0x7c3eba7f,	0x5afda074,	0x7c82c2ed,	0x298026a8,
-0xde10e8fc,	0xdad8c483,	0xd6457f94,	0x08cb4a84,
-0xc28290fc,	0x93c335a3,	0xeaf1eeb7,	0xae42c772,
-0x89c88da3,	0x4bc6b949,	0x53bf510b,	0xbc154c2e,
-0xc064d174,	0xc8536311,	0x527a0f13,	0x8a2802a6,
-0xd71618ac,	0xc87934bd,	0xe96101d1,	0x55d1976c,
-0x471c8505,	0x7a36d839,	0x5d62a9ee,	0xf3c54a8a,
-0xa2be15d9,	0x244087c9,	0x042c8037,	0x23224689,
-0x281c5d73,	0x2139ecfc,	0xffb8bc8a,	0x834fdd11,
-0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,	0x4ae2dbda,
-0x86d90089,	0x6675dfce,	0x48876262,	0xcec72538,
-0x11dc5c80,	0x86a730f9,	0x313565c9,	0xe3e5be11,
-0x106d7cce,	0x752b8be2,	0x3d00a5bc,	0xe6f70e95,
-0x44447ac8,	0x600df30c,	0x8335ac3b,	0x8816ddee,
-0x700982fe,	0xee495741,	0x48c7e81c,	0xa3d55da2,
-0xb0172982,	0x70ab2158,	0xd4460621,	0x3a9e528b,
-0x59b18a7b,	0xf4dabc4c,	0xa8454763,	0x70877bb6,
-0x66005c97,	0xaf292c06,	0x7b843db1,	0xf343b59b,
-0x25cdc7b5,	0xa41da617,	0x9e9d895e,	0xc936f475,
-0x7270925a,	0x30024230,	0x8e72f53d,	0x2b6c1b6f,
-0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,	0xaf377cc1,
-0xbff09a78,	0x4b4e0814,	0x95a0b2c1,	0x270398de,
-0x201fca94,	0x2a032a4f,	0x131542b4,	0x0d7306da,
-0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,	0xa3b3a991,
-0x17ee60c2,	0x852c0b8d,	0x11e5853a,	0x762002a7,
-0x92c5311d,	0x0d4bf7e1,	0xfffec870,	0xe3d35e5b,
-0xff6ecfb9,	0xdedae6ff,	0x0111a772,	0x9808e780,
-0x29c336e8,	0xe9bc05df,	0x5bedde11,	0x945565af,
-0xaff808fe,	0x87e3423d,	0x4de6f98f,	0x93b4adef,
-0xbf704fa4,	0x09120e91,	0xd54f3692,	0xdf8eab1e,
-0xfabbf59c,	0xe74318be,	0xaab87ffc,	0x29fa791c,
-0xe3915552,	0xa652cb9b,	0xa1252e74,	0xb35b723b,
-0x542aa28b,	0x12fcc5b0,	0x3941f962,	0x82bcc6cc,
-0x47b11974,	0xb821611f,	0x78b34250,	0xf1be5659,
-0x561b9e61,	0x6f3bd501,	0x584e6f5c,	0xd54ed547,
-0xacebcd21,	0x7b5ff816,	0xb64ad233,	0x9f2f330d,
-0x69fb1ece,	0xac8710dd,	0x58dc6c60,	0x9bee6139,
-0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,	0xa733274f,
-0x884d9b55,	0x42b08b63,	0xafa54a74,	0x1c7ccf64,
-0x93a20191,	0xaaa3132e,	0xc69831d1,	0x54634889,
-0xfbfe3efc,	0xd3cf68d4,	0x302e3117,	0xf5693131,
-0xc3ce8c6c,	0x1f03cd89,	0x6243334c,	0xf16bc80f,
-0xdca5f130,	0xcb2cd956,	0x4c1bb421,	0xe8de533c,
-0x7f86703a,	0x29aa897e,	0xdd54acad,	0x76b2f2ae,
-0x7ef82b71,	0x2e30970b,	0xba402597,	0x9a653ab4,
-0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,	0x2363d147,
-0x5327289a,	0xe89229f3,	0xd63a535c,	0x7efe9273,
-0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,	0x1b9c7bfe,
-0x5d14b3de,	0x54d575fb,	0x6d65db4c,	0x95648b7f,
-0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,	0x8488a45f,
-0x8ebc2932,	0xd4767316,	0x3e8c4b8a,	0xbab7402c,
-0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,	0xc88528e9,
-0x4b2e4e8f,	0xdd938b86,	0x0c964f98,	0xfc88d480,
-0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,	0x4d40b3b3,
-0xcf203155,	0x0d2fa621,	0x752d2c58,	0xb12bac12,
-0x1e7e8c23,	0x94215d54,	0x9854a71c,	0x4de63c64,
-0x7a012529,	0x9c171f8d,	0x9e71def7,	0x3bd17d50,
-0x11f175d9,	0xec78abf3,	0x7b529eee,	0xd3a69fc3,
-0x5b718676,	0x58214d29,	0xa8bd2c34,	0x41ea00ab,
-0xa03f64d6,	0x4ee342b0,	0x32b1e444,	0x1c1801a4,
-0xc8424702,	0x334a7e35,	0x50cf1543,	0x3b22b495,
-0x88683776,	0x8e2e0154,	0x6155c033,	0x4e2fa6ac,
-0x42ace700,	0x8d64f97c,	0xaf9ced17,	0xb2a5cb92,
-0xa558582d,	0x88705de7,	0x9e528d59,	0x84bd45e4,
-0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,	0x10462123,
-0x30080f7d,	0xb346cd81,	0x0049c396,	0x4e24165f,
-0xa7c66809,	0x2e60bdcf,	0xaad70a08,	0xa73ea713,
-0xe28f97a7,	0x283a9eab,	0xd4366489,	0xe776f963,
-0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,	0x3bae5f6d,
-0x8d2bbef1,	0x7e9181e6,	0xf06aa121,	0xd06b2d20,
-0xa83ea826,	0xef935e4f,	0xdfd27456,	0xa3451468,
-/*  691-MU168a04.inc  */
-0x00000001,	0x00000004,	0x12072000,	0x0000068a,
-0x995ec216,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x54166188,	0xe535ae13,	0xa1a6ca6c,	0x202f9eb5,
-0xa49ee07b,	0xa4463ba3,	0x0bb8102d,	0x8751cb91,
-0xa6b73e2d,	0x24cc7f4e,	0x821b0492,	0xa67c19c7,
-0x0865af67,	0x806ab137,	0x8b7d96ba,	0x2a50d911,
-0x87d749e0,	0xaadf5ac2,	0x27176ddb,	0x8b1e4c6b,
-0x8247a52f,	0x2f199a4f,	0xab4a3695,	0xaa55f6d0,
-0x25aa931e,	0x89580d05,	0xaae2937e,	0x22df2015,
-0xa58c2053,	0xad480e1e,	0x056a3cdc,	0x8db6e960,
-0xaedb93b5,	0x29fffaa7,	0x8e12d006,	0xa50e3b22,
-0x09a99c8c,	0x8a96ad34,	0x87ac86ba,	0x2dfd44d4,
-0x86c79529,	0xa7f97bcf,	0x222fbee9,	0x838f9436,
-0x8ea6c4b6,	0x2b061994,	0xa718f6c6,	0xabeb6df9,
-0x23c3d2f8,	0x8741db0f,	0xa0f5a92f,	0x287011ae,
-0xaab46662,	0xa6501353,	0x06388553,	0x842f6b80,
-0xaa415ed1,	0x2ba08c21,	0x8bfea0bc,	0xa07dd06f,
-0x08ce70ec,	0x8b195004,	0x8f4735d8,	0x2d4cbb3d,
-0x8e2d8d1b,	0xae340145,	0x29f05708,	0x880b17bf,
-0x8d5459cf,	0x279e9251,	0xa8aa1e38,	0xae09e0ad,
-0x2b4e17bc,	0x86de5f47,	0xac89f48b,	0x2787e6bd,
-0xa2840685,	0xa991f7a3,	0x0bd79f55,	0x897d2734,
-0xa8bef187,	0x2d91e9b8,	0x84a5bd7c,	0xab0ea74f,
-0x09483b60,	0x87534077,	0x8fe56f74,	0x2bea0ee9,
-0x8035a789,	0xa707eac6,	0x233d0de3,	0x880f2a56,
-0x8b75a29f,	0x23eb9b6a,	0xa235532d,	0xa1629f77,
-0x22719b57,	0x82af8ee4,	0xa654ac8d,	0x205b3cc6,
-0xa635195c,	0xac653e14,	0x00aa4ba3,	0x89923f57,
-0xad211654,	0x27964c24,	0x8145519a,	0xae577a1e,
-0x02193c7d,	0x8371bb8f,	0x8e38144b,	0x2e2735bd,
-0x820d4360,	0xa975c934,	0x2ecd7d81,	0x8eefd6af,
-0x8760bc8d,	0x2f732336,	0xa96e2069,	0xadde039a,
-0x2e6fc380,	0x8660772e,	0xa92fa5d3,	0x23db18d7,
-0xafb1af41,	0xad12b1ae,	0x0b832d4c,	0x8c7ec7b4,
-0xa2ab9d5e,	0x2c841a0a,	0x8ef54e2a,	0xa39d1a96,
-0x03d05451,	0x83096867,	0x882ffa2c,	0x226ab470,
-0x8b197086,	0xafe23ffe,	0x24f4b9aa,	0x8bc6470e,
-0x835057b8,	0x2e9a2d6c,	0xace0be7d,	0xafd10f5a,
-0x254a6dfb,	0x80535796,	0xa99f8e3e,	0x2497ad06,
-0xa2da0657,	0xac34677a,	0x06a3cfb1,	0x8737e980,
-0xacb80ed4,	0x215275ec,	0x87bcc694,	0xaeb189c7,
-0x0e46185f,	0x8f5a6a2c,	0x8b3300ae,	0x218ad69a,
-0x808475bb,	0xaa89ecee,	0x2e63d3b2,	0x8137c967,
-0x85552646,	0x21fc5091,	0xaf8c06cd,	0xaa525c28,
-0x21680179,	0x89c7b3e8,	0xd644786f,	0x5e9b9d1d,
-0x2702fe66,	0xfda03d55,	0xd0df4c73,	0x9482b978,
-0xfade6b02,	0x688fd36d,	0x952cf501,	0xfeca27fe,
-0x66abc182,	0x996671b1,	0xf1b7cf4c,	0x232cfb6d,
-0x968efeac,	0xb30f46ec,	0x2a1e24b4,	0x6350447b,
-0xbef74dbd,	0xd1b77677,	0x6036d792,	0x94747eb8,
-0xd321f5f0,	0x4732e7af,	0x9a4a0faa,	0xe38af022,
-0x4e0f8444,	0xade43c54,	0xed08efc0,	0x63207e33,
-0xa76d15da,	0xc189c05a,	0x616b1784,	0x55b07eeb,
-0xc21f088c,	0x6cd19b19,	0x568d2424,	0x374ed20e,
-0x634b7ad1,	0x5aa8cece,	0x342338db,	0x18514c13,
-0x527faf4e,	0x4e30cc1d,	0xc12ae47f,	0x53dcc404,
-0x980e4e30,	0xcb45cda4,	0x3a2a3e9a,	0x63a58248,
-0xa25c4dc3,	0xc7f6786f,	0x6ade3de7,	0xa0b5b6e9,
-0xcfe10078,	0x648ffa56,	0x75e3ad04,	0x2fc1552f,
-0xb0f77ce6,	0x9797eba5,	0x25835592,	0x9f295669,
-0x9518b629,	0x0f6f8490,	0xe86d585e,	0xa799a942,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  398-MU166503.inc  */
-0x00000001,	0x00000003,	0x05051999,	0x00000665,
-0x2b9733f1,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x358c92da,	0xa753eb19,	0x24588215,	0xa462f72c,
-0x9ae43792,	0x393cc0d3,	0xe8f43249,	0x1bec1833,
-0xd0b7e8ea,	0x135d58f1,	0x8a2e1ff9,	0xde9451b5,
-0x82d2a3f6,	0x05a7c378,	0x75179336,	0xd7007b9b,
-0x1683d5bb,	0xd4a252e7,	0x2f40aa9f,	0x3e83129c,
-0x2c00fa9a,	0x51d02e05,	0xa1646c98,	0x87f8ac05,
-0xce1aaa32,	0x4a82d045,	0x86880792,	0xe4974edd,
-0x8061e878,	0xa1881b5f,	0x04e837b6,	0x2769c989,
-0xe74ecda4,	0x33654340,	0x61baeeb7,	0x35c98030,
-0xc8df4eec,	0x5c5bb984,	0x6e98f123,	0xf6d7dcea,
-0x10dc19f9,	0x3b01a4e3,	0xafff281e,	0x6e161f3b,
-0x17948731,	0xc65afafb,	0xabe182f2,	0x69955a64,
-0x3a12b07a,	0xe495100d,	0x554994c5,	0xbd57e186,
-0xebe0ac49,	0xe389fa05,	0xb009da9b,	0x0ff85b98,
-0x809e9a10,	0x16254c1f,	0x304faeb4,	0x5d57d991,
-0x11d772e5,	0xbef29e38,	0xd7a975e3,	0x9d097f71,
-0x6106bb0b,	0xba8cf6b9,	0x5ace7130,	0x5031e613,
-0x51a1a606,	0x9c0a1169,	0x872dcb66,	0x40f99c93,
-0x7ca932d1,	0x5a6d449d,	0xe140f2c9,	0x84860c6a,
-0x8af3229e,	0x4afaf036,	0x7e55d4f6,	0x46128b9d,
-0xf46348a0,	0x9d95bcdf,	0x31943826,	0xf88de2e6,
-0x9e44d646,	0xb3ee3161,	0xf92a68c8,	0x60f9bace,
-0x7ca722a3,	0x9990bb83,	0xafb51d20,	0x07bfb960,
-0x1df64349,	0xdcc1f002,	0x739aa18b,	0x38ea1e28,
-0xa2dae978,	0x574c14bc,	0xc1f81ca6,	0x203c604c,
-0x282967d8,	0x385855a9,	0xa1b12ee3,	0xa2109df8,
-0x86e9a39f,	0x1790c5a9,	0x64804f3a,	0x7d2752d9,
-0xa94f4f26,	0xa26c6a31,	0x5198ff0b,	0x5e94ce74,
-0xf1077560,	0x54e98c79,	0xde5d0d82,	0xf4bfad49,
-0xe7320b71,	0x856bc9a0,	0x82d0be13,	0x5ee2ba88,
-0xef5d3f1a,	0x8069358d,	0x084c6414,	0x10ec7c70,
-0x91d623a6,	0x74a78915,	0x8eb0321a,	0x3d80ac81,
-0xe512e8fa,	0x8fb07c28,	0xb328603c,	0x0ef99b7e,
-0x47ea27ec,	0x6be33ed1,	0x3f4da715,	0xabbbd675,
-0x69a18bfe,	0xb128d04d,	0x043e4ba0,	0x6915ac2d,
-0x042b7f54,	0x976ce0bc,	0x6d0c1f2a,	0x56bfb408,
-0xbfe963c2,	0x7df8d0c0,	0xb2a7ed5b,	0x897a09b9,
-0x6bd60b68,	0xcd6d9697,	0x48646873,	0xf973598e,
-0x4ab445df,	0x87f8f3c6,	0x8c7ac00c,	0x0bdde45b,
-0x7be6ecd2,	0xd0c6e842,	0xdd711cea,	0xeb22b612,
-0xe6ab1500,	0xaad6042b,	0x2e5cae33,	0x47ec8dbb,
-0xcbd123b9,	0xad6bad77,	0x0d8f347e,	0xa71a183d,
-0x66fe5476,	0xebe8a076,	0xdf99392a,	0xe8f9d3cb,
-0x14c99a25,	0xf6f36332,	0x2e4d9e17,	0x9f160e14,
-0xe113d044,	0xec57bb4f,	0x3768415a,	0x8e76bb31,
-0x1e3002c7,	0x3f34fde4,	0x63227f0c,	0x43bbe307,
-0x04076f7d,	0x0508bc78,	0x1f85f189,	0xa1cc81cf,
-0x86542205,	0xebaedc53,	0xe2c3c19b,	0x909eff45,
-0xa069f9da,	0xbc6b88b0,	0xc525d56a,	0xa17fa1ec,
-0x72ceb073,	0x79763bba,	0xd6c220b9,	0x850cd04d,
-0x036fb53f,	0xb56d501d,	0x79ce6c72,	0x6f257e0a,
-0xdf5b0c82,	0x4cfbe232,	0xfb6dc8e1,	0x70fda82a,
-0xca25fe30,	0xbec9ae31,	0x519816a5,	0x41edeeeb,
-0xd5cea131,	0xb6906cb9,	0xb8972484,	0x867b1154,
-0x666a8484,	0x3f32c15b,	0xf41e4c2b,	0x96204780,
-0x3e5bbc2f,	0x3b7ca3be,	0x06174d9d,	0xee03e984,
-0xec331aec,	0xdb3c13ce,	0x3a8ab1a3,	0x9e4b50b1,
-0xe15b5adc,	0x17470f1b,	0x208a3d17,	0xbb455669,
-0x7aad5d15,	0x78a9e932,	0x74bb450e,	0xdc2ce482,
-0x471e52d9,	0xd8b193ae,	0xb9036a57,	0x77e42d3a,
-0x27ec2977,	0x06169fe7,	0x2d2bdb69,	0x869a5b44,
-0x9f799f33,	0x3a64040f,	0xc3cfd2c0,	0x98a3a439,
-0xb3b8101c,	0x38d8bd22,	0xd12bdc7c,	0x466e5b9f,
-0x9fee2968,	0x95ce4e32,	0xdc57c7de,	0xf2fb9d1e,
-0x27bded67,	0xc1ad6483,	0x223deb45,	0x86e63082,
-0x4a203789,	0x7403fb65,	0x78a3e835,	0x8b61edb2,
-0x5463c05d,	0x766c0055,	0x9125ef4a,	0xa539a0b7,
-0x5534a196,	0xcf9f76e8,	0x9c37844d,	0x6fce6dbc,
-0xef915a04,	0x4e6a1cdf,	0x4c29c215,	0xb81bb506,
-0x8dd4519a,	0x74b38e0b,	0x381e1eab,	0x17b67703,
-0xf4abdd68,	0xc27be868,	0x9f0faf2f,	0xefc53838,
-0x3622c3a0,	0x60d7f011,	0x8ad7ebdc,	0xc40d6551,
-0x04983f91,	0x2cf8b33a,	0x531ff419,	0xf5e93714,
-0x65c885aa,	0x2320ae43,	0x806c5268,	0xdf4e166c,
-0xc5bdc782,	0x29b46f9d,	0x0f1c4065,	0x4dc28062,
-0x69e7b7c7,	0x3c26bbe8,	0x12646ad3,	0x5d6a6a1e,
-0x44048e46,	0xf60531d8,	0xb74e3592,	0xb40024ea,
-0x252a8bf9,	0x7dfc6e4a,	0xa7bf7fa9,	0x1bdac22f,
-0x50cdfee7,	0xd0c5b034,	0xcd79e72e,	0x7eddf775,
-0x6fb3c649,	0x6c3bfcaf,	0x750b8d6d,	0x41928264,
-0xe301566a,	0x5a49c2f5,	0xd0e55ac1,	0xfe0f0cc8,
-0x772e3cc0,	0x9bf80060,	0xdc49c2ac,	0x9f099089,
-0x770823d8,	0xf463e468,	0x9e5807d0,	0xdacb3baf,
-0x1eba5767,	0x13c5f4a9,	0xcd01ffec,	0x0e36d465,
-0x6ec3c83b,	0x226eb0d5,	0xd01557e5,	0x77c79cef,
-0x5efe9046,	0xabbfb6c8,	0x243a57b7,	0xd28db7bc,
-0x719bf699,	0xe93b667e,	0x1de82685,	0x51380b53,
-0xa623f364,	0x6d780611,	0x0c768e91,	0xf907a65a,
-0xcc7733f9,	0x2f2465b3,	0xbd12413a,	0x5cd5a39f,
-0x37d09ec8,	0xf40603c2,	0x5dbe9b04,	0xb8178e07,
-0xd1bb5765,	0x1bfeb0b7,	0xc059e78c,	0x69d6449c,
-0x8d28427a,	0xcbffb328,	0xfd972598,	0xcfb55e89,
-0x395009e3,	0x791e6bd2,	0x78064b04,	0x80ee0f16,
-0xb4cfa086,	0xd37b798a,	0x3f0808d7,	0xe95589aa,
-0x8098467a,	0x115a5d4f,	0xd1dc0f2a,	0x4453e5d1,
-0xb2f20cf0,	0x9a0f9e31,	0x4295d145,	0xf7ef8330,
-0x4a7bda37,	0x110a6d71,	0xb923c984,	0x4fbfed95,
-0xe12fedc2,	0xc0cfca64,	0x56483d6d,	0x97f840e6,
-0xbf5fe41e,	0x66022685,	0x76a0819c,	0x98640d2c,
-0x4eb43b01,	0x5a54896c,	0x55a1bdd7,	0x6f65ba91,
-0xed2b5538,	0x1f9834d1,	0x109a30fb,	0xccf76d5e,
-0x201ffeb9,	0x4ab1c88f,	0x09acf508,	0x8dae69fa,
-0x2744708f,	0xcea1e69e,	0xaad64322,	0xb5b1f8f2,
-0xef9bd4ee,	0xa7805716,	0x88ec378a,	0xcbc7caea,
-0x668e4b26,	0xe577ac32,	0xe69a15a2,	0x9447dcb0,
-0x2cce6bad,	0x17d2664b,	0x97660be8,	0x2c27db29,
-0xa9724c0a,	0x17ee97d7,	0x42ac77ff,	0x83f2075e,
-0x7cde02f9,	0x34420971,	0x06a2aaa7,	0x3ac69a7c,
-0x53d3ac43,	0xbb5bddd2,	0x7b542bbe,	0xd961a9ca,
-0x1a6decdb,	0xe6e1b5d4,	0x15a67e4d,	0x6d188aae,
-0x8f19f6d6,	0x26945471,	0xea55646c,	0x82d1b6b5,
-0x35a40d61,	0xcb49c2bc,	0xd0f5a364,	0x82122f86,
-0xaa2b88cb,	0x11eff3f5,	0xe6f54792,	0x67f462ec,
-0x542a5a8a,	0x8e8fe970,	0x729a6876,	0xe22b8ecc,
-0x7970112a,	0xf74356aa,	0x25fe6cb3,	0xca01a532,
-0xb1235c63,	0x4f47c539,	0xc217ce08,	0xff59b048,
-0xb6ca10fe,	0x71e838d6,	0x19b45d57,	0xa3adb657,
-0x9d37acf3,	0xfd89535e,	0x747406a5,	0xb5141dc2,
-0x61a05b4c,	0x9eaff8c4,	0x51da150b,	0x0932911b,
-0xde897842,	0xbaed7325,	0x8c35f6d0,	0xa84d6305,
-0x1eda951f,	0x7bf216b8,	0xdbb78152,	0x88427248,
-0x10c3fc59,	0x3a8465db,	0xb963b514,	0xa77f8dd3,
-0x98dbb57d,	0x4984b500,	0xa21601b6,	0x881258aa,
-0x0508093f,	0x20e84ec3,	0xb98409fa,	0x0a9eadf9,
-0xdf8b856c,	0xe8bd17dd,	0xcd37e7c0,	0xa95b8505,
-/*  402-MU166d07.inc  */
-0x00000001,	0x00000007,	0x05051999,	0x0000066d,
-0x35ba5e6e,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x5e56252c,	0x4f0fc459,	0x0dda7564,	0x89df7fe8,
-0xc1985cef,	0x196e2272,	0xf4673aca,	0xfcb4c8d7,
-0x260334ef,	0xd745755a,	0xf26f8cbc,	0x28c29161,
-0xdc0d9885,	0xd470cec7,	0x771e836a,	0xceffe4e2,
-0x8442e471,	0x4d6acd9f,	0xe0355eba,	0xac9da82d,
-0x6dd914ff,	0xd4221e41,	0x909effc1,	0x58cd3b0b,
-0xe1479a6d,	0xb5ef2a86,	0x63693ab6,	0xc2f046cc,
-0x8adbf768,	0x4c57d2e2,	0xca5aa305,	0xb3106fbc,
-0x06603d00,	0xf8c94ed8,	0xf69d93af,	0x059aca0e,
-0xbcd57674,	0xb72b359a,	0x260152ed,	0xfe40d0e0,
-0xdcfc0d55,	0x2ff005a0,	0xf509b0fd,	0xd214bccc,
-0x630bcf58,	0xf8cfbe29,	0x92002aba,	0x4ca1f743,
-0xfc65a494,	0xb9fc0c5b,	0x487580f4,	0xffcee67b,
-0xf5f92e08,	0x47e81f3c,	0xbd252485,	0xd0c23904,
-0x4000c37d,	0x9f6833f5,	0xdeca61bc,	0x404d81e7,
-0xd72db92f,	0xd58aacd4,	0x068f4951,	0xf08a13de,
-0xd053146e,	0x2fd1f26c,	0xf5c81ca1,	0xd25ae1e2,
-0x66f007f0,	0xfba6eeac,	0x99bcc45a,	0x4666a0bb,
-0xf03ff585,	0xb32bc3bd,	0x4ebd2cad,	0xf60c2303,
-0xf5644201,	0x4cbec874,	0xbd2f4b21,	0xdb73feb4,
-0x44442781,	0x9a36bb55,	0xd5ef6337,	0x41f78df4,
-0xd9045692,	0xd4fdda07,	0x03361727,	0xf031b248,
-0xde253f06,	0x270a6b41,	0xfabee114,	0xd44db762,
-0x6f6e7d0b,	0xf3aa07dc,	0x9f784b10,	0x49628bde,
-0xfee63a21,	0xba75f2f7,	0x4936344c,	0xfbf2abef,
-0xf5f80b10,	0x449ba636,	0xbb45c68c,	0xd5e90822,
-0x4411803a,	0x909026db,	0xdb9c09dd,	0x49da46d8,
-0xd0920f17,	0xd75eeeea,	0x0a481e97,	0xfa0aed77,
-0xdcb2d33c,	0x2668c527,	0xf69e1af7,	0xdb258690,
-0x6789ce72,	0xf9255b26,	0x950c1bdd,	0x4dd4d88a,
-0xffa406fc,	0xb4a02bb5,	0x46db6c15,	0xfb60e40f,
-0xf813df80,	0x4b684e51,	0xb13bc892,	0xdad679b0,
-0x44d0e6b8,	0x986dbc15,	0xdb39a619,	0x40e2dfd1,
-0xd98d6cc5,	0xd2d46188,	0x09918e75,	0xf10f8b27,
-0xd0762674,	0x238338f3,	0xfe1fde17,	0xd5322a2e,
-0x65a842bc,	0xfb313c5c,	0x9264995e,	0x4ae7a364,
-0xf82fec15,	0xb988a3c4,	0x408bf6ca,	0xf8291760,
-0xfa087dd2,	0x4fc95069,	0xbf0c517e,	0xdbdab8d2,
-0x4e0dc819,	0x955d89b9,	0xd57c93f3,	0x445c0771,
-0xd7df5deb,	0xd499e424,	0x01a24a0f,	0xf6f249fa,
-0xd790a20d,	0x2d78aa5c,	0xf2891b04,	0xdc212d68,
-0x6ea2d816,	0xf81db2c5,	0x95f9716f,	0x4b09451b,
-0xf91d11d6,	0xb01920bd,	0xfab65a11,	0x6cb5e00f,
-0xf2c998f0,	0x007116c1,	0xfdac4ae7,	0x24a2cd9b,
-0x073c27cb,	0x2cfeffbb,	0x23998e30,	0x11fbf8b6,
-0x24a3acc0,	0x352fdfbd,	0x1e4b3aac,	0x15820bb1,
-0x3f02c3e3,	0x25eb76a0,	0x3e1c9a8d,	0x00b9e149,
-0x0d8a9e7a,	0x07d85c98,	0x04bae543,	0x26b7fd43,
-0x03d5b79e,	0x2946001d,	0x2dea0cf8,	0x43b4610e,
-0x2506bb04,	0x9ac11105,	0x4edb0263,	0xfb327e1b,
-0x93448267,	0x66c4f588,	0xf48d483a,	0x113d6078,
-0x61e5eefb,	0x768e81cc,	0x12daba21,	0xfc5f39c5,
-0x731b6ba4,	0x770a963f,	0xfc148bd3,	0x6b04e3d5,
-0x735eea30,	0x1793f64a,	0xa2d6e850,	0x7cb00909,
-0xd858cbfe,	0xa3f24121,	0x4c994609,	0xdfcbff3f,
-0x9725e9fc,	0x4f3543fe,	0x59c0c1a1,	0x18cb9e57,
-0xc1c3562a,	0xdacd316b,	0x26490ed3,	0x9d8fe37a,
-0xe90e7a6a,	0x79ed9044,	0xabb894d5,	0xa0374350,
-0x47ced1f5,	0xe85f29ed,	0x0e54c3fa,	0xa0f907e9,
-0xc1755fcf,	0x4cc7bd45,	0x7f08499c,	0xc6d36e55,
-0x7e2612b4,	0xc4c9891e,	0x3b5408e7,	0x710f9c03,
-0xb4ddd9b0,	0xd2558968,	0x7a3bdb65,	0x06acc5d7,
-0x58e1c843,	0x181e5813,	0xfe930ba6,	0x82c7bb45,
-0x694bc111,	0x046ec31f,	0x7c83855b,	0xcd97a1ec,
-0x941639d2,	0xac2630bc,	0x6c8bd957,	0x476c9982,
-0x39087f73,	0x05c6832f,	0x3e85c189,	0xb3abdfde,
-0xccc779ec,	0x84597ce5,	0xeca12503,	0x83d674fc,
-0x9bd3f064,	0x1292a463,	0xee679bf6,	0x82823ef4,
-0xed7f4d18,	0x6dafa853,	0x8bba73b2,	0xde5badfe,
-0x86f9e16b,	0xe08b4380,	0x8fd032aa,	0x952be076,
-0x8e43a9dd,	0x5e9ca0d0,	0x5c3a9c6e,	0x3ed246d3,
-0xcd3d920c,	0xfee73f4e,	0x5be235af,	0x3842c7ac,
-0x549a38c1,	0xd7155622,	0xd609483d,	0x2e8c63c1,
-0x7ee633d4,	0x365cb896,	0x21486709,	0x09da59e1,
-0x5385d44f,	0x40923a13,	0x368e7227,	0x3865cb0b,
-0x49b86a4b,	0xe91d9222,	0xa4261ac2,	0x5987de57,
-0x6b90090d,	0x4e07c06b,	0xe0ade732,	0x48b064ff,
-0xd8fbcaf4,	0x72e5f0b7,	0xfe1fb6e4,	0x8865fe58,
-0xaabd9585,	0x5bebdeef,	0xbccdc668,	0x0d44bbe3,
-0x35745d5d,	0x88e5bb1f,	0xfe5d3374,	0x69064530,
-0xac93ea3e,	0xd0358d6a,	0x98d400d4,	0x55767bfe,
-0x256a1b09,	0x99d61a1e,	0x89879a7b,	0x9f7fa025,
-0xfa19a9c0,	0x7a5a45a4,	0x8827d97b,	0x721df39b,
-0x8ca26f82,	0x2debf883,	0xf9bf8802,	0x0168de7d,
-0x69d62893,	0xf34f8364,	0x43b06563,	0x958f92ff,
-0xcc61b852,	0x46de8312,	0x7eadaa11,	0xf5d7317e,
-0x7fcbed41,	0xfd8b4472,	0x89ce0b98,	0x33a26c73,
-0x2372c4fc,	0xbfe3a890,	0x7d7840ac,	0xd561ac76,
-0xcd84304e,	0xe5058896,	0x7e6c051e,	0x61a9b441,
-0x0e14570f,	0xadaf99cb,	0xf0c39de0,	0x4a1dc4ab,
-0x52045c44,	0xdf33d196,	0x0af0dd01,	0x368040ad,
-0xa611a20d,	0xbe7b4987,	0xc8b7a5b2,	0xafa1d162,
-0xd9cf8dac,	0x6b09a341,	0x3e3df047,	0x2a780a01,
-0x02b0cb81,	0x99f9ec8c,	0x4afa4e2d,	0x73048be6,
-0x5ef2130d,	0xb1000354,	0xacbbedf6,	0x7767aa87,
-0x98b36af1,	0x416479a5,	0x72b01f54,	0x72d98f7d,
-0x68e9ecef,	0xe309f9a2,	0xd051571b,	0x78a5de85,
-0x9a6409e6,	0x6f6c2998,	0x507db337,	0x5f37d973,
-0x6cc44dd8,	0x9ca00fec,	0x6865feb9,	0x0b0a0443,
-0x5786a3ea,	0xf84bf72c,	0x6a8e35d4,	0x19b6490b,
-0x2d021a57,	0x42b5d1fd,	0xd9d989da,	0xece79c06,
-0x9d622680,	0x29b81f2b,	0x1c83e53b,	0x156a1f8f,
-0x19aa68ed,	0x63c44d9a,	0x8f17ef88,	0x1e18c81c,
-0x16b9f137,	0x2ae4a05d,	0xf7839170,	0xb6e98047,
-0xb0460222,	0x17be9291,	0x5805f8c9,	0x3fedccc9,
-0xabd75591,	0x5c89bb87,	0x22361c7f,	0xb449f07c,
-0xdbd7e082,	0x601c32a5,	0xca07c0a2,	0xf53f9056,
-0xe2801718,	0xb8dd7373,	0xb8c1fa68,	0x7521d777,
-0x54e7b093,	0x87d1c19f,	0xa0043422,	0x42641b0d,
-0x3df7eb55,	0x33960ceb,	0x2ccab13c,	0x7289fe79,
-0x017a50dd,	0x83585544,	0x1a62924b,	0xed311733,
-0x9f07f9ce,	0x19e88eb3,	0xa57658fe,	0x971210d4,
-0x551651e9,	0x50a40561,	0x5f05ec29,	0xdcfb5112,
-0xa3f15c0d,	0x728a4196,	0x5f6c1bb9,	0x9ed61bc8,
-0xb0c1763d,	0x572a6bbc,	0xd957a4be,	0x7a9e36ee,
-0x08809d99,	0x5db2305d,	0x0cd2b571,	0x776a0ea1,
-0xc3023262,	0xc7e2241e,	0x9a3bf11a,	0x10685917,
-0x05f63bf9,	0x7515a7cd,	0x354df431,	0x9fe23aa6,
-0xe7dd2ce1,	0xfd3f4c4e,	0xb8175841,	0x2a33e9cd,
-0xb31a26b8,	0x2becb6ae,	0x960637fe,	0x88d5d321,
-0x88dbbe41,	0xdb3c0412,	0xaed4333a,	0xf5553d5a,
-0x64323f5a,	0x2eeaadca,	0x819df2e5,	0xf45b6d56,
-0x7d027108,	0x2f49ed39,	0xbfd62d0c,	0xa0a64a08,
-0x0b06d96b,	0xc4459fe8,	0x404028e9,	0x560a808e,
-0x68d481c2,	0x1062ab83,	0x51ffc2c7,	0xbc762820,
-/*  983-m02f0a15.inc  */
-0x00000001,	0x00000015,	0x08212002,	0x00000f0a,
-0x63e49a0c,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x80e0e61a,	0x7cb2c607,	0xbe1e2fc9,
-0xacaf1526,	0x31514e28,	0x9252d426,	0xb999ebf8,
-0x8469bb8a,	0x95e72fd2,	0x5f7c5472,	0x254adcf0,
-0xf706b236,	0x21ef3efb,	0x82d05526,	0x8b10bd77,
-0x268ab8bd,	0x929739a5,	0x0f180e02,	0x3ad1cc5a,
-0x23a10814,	0xbc4257f8,	0x026ded8d,	0x84bf45be,
-0xe13e69f3,	0xbb0edf16,	0x85218fd2,	0x898af4e1,
-0xcd635f26,	0x846ab0c6,	0x85a5d5cd,	0x077b4a16,
-0x71514de0,	0xbff893a6,	0x47536ab0,	0x1fc4b546,
-0x906f4b85,	0xc1f997d5,	0x0ba4b594,	0xa823eb50,
-0x416ee239,	0x659b0dbd,	0xf240ad67,	0xe042d532,
-0xce92f455,	0x9f318d9f,	0xac11fada,	0x6fc234ab,
-0x18cddb76,	0x67e52b4f,	0xa6f01943,	0xba695e2a,
-0x245bd123,	0xce05288f,	0x6582101b,	0x5be73a23,
-0x6ab67d0e,	0x873ac6f3,	0xab4c48f2,	0xe0d64284,
-0x65f33ddb,	0xd33abb56,	0x8dd411c3,	0x86f370ea,
-0x1c3726b9,	0xd561edb5,	0xa0484b79,	0x63bdccd0,
-0x54d42183,	0x05d9b9c2,	0xd1d2e489,	0x572f0b07,
-0x6b804808,	0x9ee441c8,	0x87e1e425,	0x0d4d3c3e,
-0xbb9188fd,	0xa7f1243b,	0x807be6fb,	0x8f828057,
-0xfe37dd84,	0x104ef504,	0x5aa650b4,	0x2f1b611f,
-0xd021e808,	0x1d4ca877,	0xdefabd4d,	0xaa0cbe35,
-0xa4e89854,	0xa880cfc1,	0x08ed71f1,	0xb58e8625,
-0x2f4bee9d,	0xfef8678d,	0x2868ade1,	0xcdd1c7a4,
-0x2b823a15,	0x4788ea69,	0x7a1de61f,	0x24a51210,
-0x4373e00c,	0x7f8e55c9,	0xb2c5092b,	0x74f9e0db,
-0x2f54f62d,	0x13e3b1c8,	0x835863dc,	0x7401feb0,
-0x82d9962c,	0xc321a358,	0x8db3eec1,	0x3d70aa8a,
-0x9e8d115a,	0xd1f258ce,	0x3db0262c,	0xdedf4ecf,
-0x2b43787d,	0x01bba4ab,	0x5533bfb0,	0xf25756a2,
-0x6748ff85,	0x49a04cf9,	0x15a3fceb,	0x2b0045b1,
-0x354d82dd,	0x51baaaae,	0x9cdb8826,	0x4a5e79d5,
-0xc0b783a0,	0x244ee819,	0xc9d7ec82,	0x61b5df6b,
-0xa3b0ab47,	0xf4201580,	0x16a9bda3,	0x2ac3fb2a,
-0xf2d45287,	0xc775c470,	0xca49165e,	0xf011aa96,
-0x7cc3f776,	0x128e7d4c,	0x53a7cb48,	0xc678c16a,
-0x704d85ff,	0x5ac3438c,	0x22a4255f,	0x06f4eb73,
-0x6d2c4918,	0x7ec8d353,	0x02f64898,	0x402caba1,
-0xa2dcd74c,	0x2ec84768,	0x19aaacb3,	0x641e9f60,
-0x610245fb,	0xbcde5b34,	0x5b2ad9e6,	0x26d2e619,
-0x3c5f7fc3,	0x8a4644e1,	0x6cc1f8fb,	0xb2ec0e52,
-0x02186480,	0x1c597a86,	0xea7cb92f,	0x8484972d,
-0x90f10aef,	0x7032ba2f,	0x8d51693a,	0x075f7010,
-0xef88324e,	0x5fbf378f,	0x1416ae8a,	0x5eac1f31,
-0x70e65677,	0x0224e031,	0x1305f1ac,	0x53209b14,
-0xb5037676,	0x99e958fb,	0xecb8fe97,	0x20fb5890,
-0x568e98e9,	0x87d42ce4,	0x03de50e2,	0x89728dac,
-0xdca95447,	0x36114e7b,	0x2aab8e7a,	0xa0529d9c,
-0x9901c79d,	0x4ff191b5,	0x7500cebf,	0x210bcc07,
-0x815fd1e8,	0x4ebd3be0,	0xbce22cf0,	0xcf2df323,
-0xfffa8eb1,	0x016b1ca2,	0xf87846a6,	0xddbf1474,
-0x435c41b5,	0x56245808,	0x050eace9,	0x128491f7,
-0x48c6fdda,	0x5775ded7,	0x0b4775a1,	0x7ce11409,
-0x0d9822a0,	0x084ca742,	0x8f2c8c8b,	0x4278fdfc,
-0xe45d26c7,	0xd92793fb,	0xe963acf5,	0x346473ea,
-0x28069586,	0xcd7423ab,	0xdd07fab1,	0xf2dd3f15,
-0xf924720b,	0x0047adff,	0x3935bd42,	0xde1d799f,
-0x03a4afd9,	0x4f0ea217,	0x5f3dd4df,	0x09f611a1,
-0x8ecf894c,	0x5111dde5,	0xd79db940,	0x4e2da85d,
-0x64622e3d,	0x00ed0f85,	0x192b2af6,	0x526fcc87,
-0x3e233c92,	0xdfa9d04d,	0x5a8a7d19,	0x18205eef,
-0x3ff5734e,	0xf3ba744e,	0xac73c051,	0xc2cf8a70,
-0x3ba41433,	0x123eb210,	0xe3f05134,	0xcfd54fd8,
-0x7995e0d1,	0x1760b323,	0x310a7810,	0x2706d0c8,
-0x15cf732d,	0x3c0ee597,	0x83e36338,	0x272058a7,
-0xff3e9fda,	0x0c22fe44,	0x11a26627,	0x061a17a0,
-0xd784b930,	0xb40ed3ca,	0x014eaa98,	0x2cfd7ef7,
-0xd3f700a6,	0xa2e0e5ad,	0xf6682e43,	0xbab69f7a,
-0x185c3430,	0x10a4a66d,	0x41698b7a,	0x89666812,
-0x1cdc431a,	0x301a8774,	0x056fa032,	0x08e5b4ac,
-0xd8e66808,	0x06cb04c2,	0x086f09ef,	0x09404e44,
-0x4b166a00,	0x1f244ff1,	0x096548b7,	0x3d066268,
-0x11c22583,	0x87d98b53,	0x83c785d8,	0x0c295204,
-0xa3693e8d,	0x8ca5c952,	0xa52c8190,	0xa9ac34de,
-0xe640e56f,	0x16d5715c,	0xf40bac7c,	0x940d757e,
-0x0955d322,	0xbd3e2f65,	0x6553293f,	0x0b25fcb7,
-0x14875a5e,	0xb5efd0af,	0x79cf151f,	0xa74e5acb,
-0x4b249263,	0x14a844ff,	0x4c547880,	0xb598f6b8,
-0xe9fffbc6,	0xe983f09b,	0xa5384013,	0x36baf1e7,
-0xe3a76c06,	0xde3df31a,	0x25d38aaa,	0xc19d9fa9,
-0x2c05457a,	0x0a4fd8f6,	0x01086f65,	0xdf7e10b3,
-0xa5f16786,	0x46d77f4a,	0x08336cd2,	0x1d06cb5f,
-0xe453696c,	0x6f662a90,	0x40d33558,	0x76c640d5,
-0x4e7e4c97,	0x10cb0f79,	0xb1cfbb1c,	0x4f3f0521,
-0x8cda32ee,	0x84c3e958,	0xaac41cc9,	0x023e7572,
-0xf3266bf6,	0xb4193d39,	0x3a31f7df,	0xbd83c248,
-0xc812df3c,	0x0af7f510,	0x82bb61f9,	0x95db6415,
-0xf7b12fa8,	0x7a7f4f9c,	0x2ec8f061,	0x3fa8e99c,
-0xc19bea78,	0x470c4315,	0x0bcf3abe,	0x787b97b7,
-0x78f992b4,	0x05a7b74c,	0x93fc4db2,	0x41094fe3,
-0x3e7fe41b,	0xa367bc2d,	0x90b393db,	0x3ec58fe0,
-0xb74cc79f,	0x9ed83f74,	0x10daeeae,	0xa524f1ac,
-0xafcd0f29,	0x11423945,	0x52319e75,	0x9978031d,
-0xa78bb8be,	0x1a8a86d8,	0xf9a5c6db,	0x15d9760b,
-0x00028056,	0x2d0f7fc3,	0x7734d88a,	0x1b877e63,
-0x7b1db862,	0x25037d9d,	0x5a210d59,	0x1875f3e4,
-0x0299248c,	0x90ae4f18,	0x949d7d41,	0x713deba7,
-0xa6ff8ffe,	0x243c5296,	0x6020828d,	0xe420ae82,
-0xf02eeda6,	0x3a8090e3,	0xaef23b89,	0x40d2cb8a,
-0xaaddddad,	0x220c269f,	0x288d2d4e,	0x8689e116,
-0x42de5c86,	0x95ff5e35,	0xdcaabe42,	0x3fbb05e5,
-0x4ade7e4b,	0xd6612d65,	0x44ad598c,	0x984eeabb,
-0x218696b2,	0xf9c83206,	0x881e3b4e,	0x54844f30,
-0x1f980f2a,	0x0aec3158,	0xdd92450c,	0xb8a3906d,
-0x0ccc7c23,	0x196b48db,	0x08ffaef9,	0x2c44b86d,
-0x05fcc149,	0x079869d4,	0x5f3f5d0b,	0x1086de9f,
-0x638432c5,	0x1dbe89c0,	0x882041a8,	0x05a6756a,
-0x306e76ea,	0x49ad9a0d,	0xbc24d1a9,	0x2a113e7d,
-0x75f3c2fd,	0x48a08a9f,	0x49629224,	0x78bc1e06,
-0x6cf37a29,	0x350cf5be,	0x44139fa4,	0x8d46fe52,
-0xab806472,	0x942992a6,	0xd17e2f91,	0xe2141f73,
-0xfa427c43,	0x8faa955f,	0x1a46e5e1,	0x3565549d,
-0x614a5a2f,	0xce97ff83,	0x11c7054c,	0x079587e3,
-0x08c226bb,	0x33d4dfc4,	0x01e29a03,	0xfe8383f7,
-0x4896c322,	0xc2b8bf34,	0xeb519cd8,	0x87a369b6,
-0x2896c199,	0xf31cda89,	0x95882efc,	0xcf69e53c,
-0x27fbdd3b,	0x8491be72,	0x866ba50e,	0xf63845c1,
-0x74862a52,	0xd27ee1ad,	0xa20b324c,	0x34481857,
-0x7d154913,	0xcdfaf533,	0x86c43d02,	0x84a53719,
-0xc686aeaa,	0x3b1c1991,	0xd2757700,	0x7c0300e5,
-0x9a79cf8b,	0xb5cf5135,	0xa515be91,	0xde62d956,
-0x15075fe1,	0x50e9c78e,	0x4b411050,	0x03e28d50,
-0xe86bf955,	0xc760da3c,	0x9c1645d7,	0x29f8de00,
-0xe2905e2f,	0x3755c59e,	0x2c2a0a58,	0xd4f48945,
-0x78f6c3c5,	0x3d7ca7ef,	0xf3bf6b34,	0x6a42e9df,
-/*  359-MU166d06.inc  */
-0x00000001,	0x00000006,	0x03121999,	0x0000066d,
-0x5a11f8b1,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x5438e02a,	0xac0baef5,	0xf9af9ee5,	0x7daa9469,
-0xc72a2473,	0xed1bc9f3,	0x0a5b4dfd,	0xf04f2cfd,
-0xd6c32dc9,	0x23309edb,	0xf3afb18c,	0xdbc53f4c,
-0x29db6ed7,	0xdff96f41,	0x8ce7acb8,	0x3d2bfd5e,
-0x8beb4597,	0xb91f261e,	0x1faef98c,	0xa1c19c06,
-0x9d0ba2f2,	0x21f025c1,	0x946df216,	0xaf4cdaeb,
-0x18548806,	0xbfc15b01,	0x95fae116,	0x3dfbd428,
-0x8843cbe6,	0xb1dc2df7,	0x36a6d1ee,	0xb5334ca4,
-0xfda770fc,	0x0cbca559,	0xf48e7cc2,	0xf54eb67e,
-0x4024db53,	0xbf714641,	0xd4975b91,	0x0e0f66da,
-0xd0b27e7f,	0xd8563c7c,	0x0758ffcc,	0xd876e9c8,
-0x9a3f0365,	0x0a6b995d,	0x980275f6,	0xb181ab45,
-0x06cb2f41,	0xb001af81,	0xbd6bcee5,	0x09bc6806,
-0xf9e3f297,	0xb352816b,	0x462611ca,	0xdc6d5552,
-0xbdb5af42,	0x6689779f,	0xd1e348f7,	0xbe74550e,
-0x2d19da39,	0xdd1f8553,	0xf3baaa2d,	0x0907706c,
-0xdc8fb8a3,	0xdba419ed,	0x0086c036,	0xd5d3ae68,
-0x93c55fcd,	0x04a1ae8d,	0x9afe94eb,	0xb96489ac,
-0x09a60b6c,	0xb3d0c99b,	0xb4e1072f,	0x0afad454,
-0xfa453558,	0xb09ee184,	0x4a31efeb,	0xdfcd940d,
-0xb13cde6c,	0x64962b75,	0xd47bd3d1,	0xbd963b9e,
-0x2219d435,	0xd244d090,	0xf21378af,	0x0faf36f8,
-0xd2794a73,	0xd5318695,	0x0ec5272a,	0xd22a3506,
-0x91a9ad03,	0x0d59901c,	0x9e57c7e7,	0xb55e7c49,
-0x0925b26d,	0xb95d2a8c,	0xbdc13885,	0x035bf2db,
-0xfead6a85,	0xbcac5c7e,	0x4fe8bf18,	0xd847f308,
-0xb4eff243,	0x6e82abea,	0xd174e54a,	0xbac0865b,
-0x28e70f71,	0xde040c76,	0xfb529490,	0x084911ed,
-0xd2f91422,	0xdaa64854,	0x0c7eaf9e,	0xdefdbaac,
-0x9132b630,	0x0a9b6342,	0x9de92427,	0xbed14ecd,
-0x090fc874,	0xbc6a926e,	0xb19d1dd0,	0x0c7c92b5,
-0xfd9a9fb9,	0xb688faf8,	0x4c848221,	0xd2c427bf,
-0xbf128678,	0x6c185794,	0xd07a1ee3,	0xb966f436,
-0x2f741a19,	0xd3de45c4,	0xf65148fe,	0x0f4e7e86,
-0xd2e39990,	0xdd7556b8,	0x04392416,	0xd47f4676,
-0x97107c76,	0x05e43678,	0x9b25ef6a,	0xb7aa1e88,
-0x0c6afeec,	0xb9255789,	0xb2b414cd,	0x0a22b967,
-0xf095af1a,	0xb854fa48,	0x42f3a9bd,	0xd0fa341c,
-0xbcf0ca66,	0x6aba8362,	0xdb58dba7,	0xba6ddb6d,
-0x23d32744,	0xd3eec90e,	0xf1c62281,	0x038fa057,
-0xd66aacd5,	0xd05d164a,	0x061ff1a1,	0xd928d8bc,
-0x96588418,	0x02c45cb6,	0x9dcb3ea1,	0xb3b9ce27,
-0x08b10dab,	0xb01dfe0e,	0xa2f4cb9e,	0x8eb386f9,
-0x0e6e8abb,	0xae9f10a1,	0xa8f3102c,	0x9b7550fc,
-0xa56f673c,	0x38f6bcb5,	0x93b14bb8,	0xe586077f,
-0x321cee2c,	0xd6aef87b,	0xe707d1d2,	0x32354de0,
-0xd0ebeabe,	0xe5c5458d,	0x1b203412,	0x8ef41355,
-0xc755edd0,	0x4546df73,	0x8c9145f4,	0x6065fcf2,
-0x491779ac,	0x26a4c7cb,	0x65ba6bc5,	0x191cef28,
-0x2f8d1fc5,	0xc259a55c,	0x19b8cd78,	0xd90b3d5b,
-0xc78d366a,	0x10ad9c8a,	0xd61a969e,	0x268b96a5,
-0x125232e3,	0x38224f2c,	0x2fa6b4fd,	0x1db52ece,
-0x3c86b9c7,	0x2048a10b,	0xe7ca7b91,	0x17f5aeb1,
-0xdd8dcc96,	0xc9c71faa,	0xefd34be3,	0xd4f4dac8,
-0x37b10389,	0xe015ce04,	0xd1db5065,	0x05418033,
-0xed8b22e1,	0xe242b352,	0x51f4d0c1,	0xac0cae18,
-0xbbb5d914,	0x1f755f53,	0x7b4c7d10,	0xefefa07a,
-0xcd461f2a,	0x2d464311,	0xe8ccc9e3,	0xf3a14b4b,
-0x2942e286,	0xd6490328,	0x46201fae,	0xa0792235,
-0xc5517483,	0x1022100d,	0x7e4a2c0c,	0x7acbd787,
-0xd0b803e2,	0xe57d5e6e,	0xf06d89f0,	0xe2cf8b74,
-0xf9738fb2,	0x724bd029,	0xfddbd156,	0x9e05f522,
-0x191feedf,	0x59b48812,	0x60f5d73f,	0x3b420bf7,
-0x0baac57d,	0x24f20b27,	0xa3f7efce,	0x78ee2b7e,
-0xa25e08ba,	0xee5f647c,	0x43f8b240,	0xa00b7761,
-0xf6da02ec,	0x6c69c94f,	0x33e43cfb,	0x3f3abf64,
-0x1e1ad77e,	0x5c99bcf1,	0xbf7ff97a,	0x45a5e379,
-0x3b6c8705,	0x4e8bb4e3,	0xce65e064,	0x7e1fb79f,
-0xf3797330,	0xcef73cbb,	0x87103d74,	0x6a066804,
-0x3f4462d3,	0xf2ab9a30,	0x51c5f393,	0x7c565cf2,
-0x9f2405da,	0x418ff11f,	0x3bae40bb,	0xb49f9ed0,
-0xadc9f958,	0x01a0e781,	0xb9c8020e,	0x9a11ba27,
-0x133e4b83,	0xe1f5c968,	0xcbe377ce,	0x966c23a2,
-0xd7e17fa4,	0x05c02d15,	0x7fb1895f,	0xb10a1c06,
-0x176e1233,	0x6f4216df,	0xd3b3893e,	0xa9de1442,
-0x13f47cbb,	0xcadd9d3c,	0xfa49790c,	0x74739159,
-0xa8d9b9f0,	0x9a0a0cc8,	0xfca5cd8c,	0x12ee9077,
-0x1de249a5,	0xbe558c3a,	0xbdd5b2a0,	0xd1056ae4,
-0x5a27b4c5,	0x6464406e,	0x5dbdcf47,	0xdf0f3a0d,
-0x77179167,	0x4ef7f05b,	0xfc1b89a0,	0x4cf5bb75,
-0xb37c06ba,	0x81e62916,	0xdb83caf0,	0x653bb4c5,
-0xc677d10e,	0x4d1de1e1,	0xe4634396,	0x67f9d7cd,
-0x927fc5d7,	0xb7a3a00e,	0x87fe2f14,	0xa5e6266e,
-0x3867d7a1,	0x4a9c1b17,	0x03729809,	0xfb49d6b4,
-0x8a559a23,	0x3c386097,	0x02b21c37,	0xab05b6cc,
-0xdecd4628,	0xfac77846,	0xa38c3080,	0x999810fa,
-0x43a83da5,	0x17b487fd,	0xd8a3e4e4,	0xe8120fa8,
-0x11120fa9,	0x927977b5,	0x2c782885,	0xef1ba162,
-0xdc97fc66,	0x83b01586,	0xe45b8da2,	0x99fddcca,
-0xcc19f92c,	0x2804b9ae,	0x837b8d9f,	0x218de4b1,
-0x48ce346f,	0x4b406a7e,	0xadde4cfa,	0x27404bfd,
-0x124a19bb,	0x13428075,	0x6b5ddf57,	0x301ff9b5,
-0xb171d5c4,	0x2afeca28,	0xcab20b74,	0x7fcf8d05,
-0x4b885a5d,	0x4d843055,	0xe4658f32,	0x538c4131,
-0xd525e274,	0x30fbd9d1,	0x3ddde395,	0x7d2451a8,
-0xa53bf61a,	0xd1a3cf94,	0x8c5780bb,	0x5e03ddf1,
-0x6811ee83,	0x1cd220bb,	0xd7e5a1e8,	0x42304db3,
-0x7249f9fb,	0xfbf5867c,	0xfe79897a,	0x1b4234b9,
-0x73db9ff7,	0xbf958830,	0x96d444f2,	0x9b6bb6ed,
-0x8b17c507,	0xea4f1f55,	0x3391f0f5,	0xb0796c55,
-0xb7aa2eda,	0x5bdddb7d,	0x06287d43,	0x5ecbc51d,
-0xad8d8847,	0xdc098664,	0xe1e5f0b6,	0xfc5fed8a,
-0x0820e537,	0x05be47e5,	0x9eee2d56,	0xcbc83208,
-0xdd11c6be,	0x91f849f4,	0xdd3d3443,	0xf72de322,
-0xaf679f11,	0x02cedcaf,	0x27a7e9bf,	0xeb55b97c,
-0xc285d57c,	0xae701a4c,	0x76dc5928,	0x1298b9e3,
-0xcd254a73,	0x2a240b27,	0x145e78ff,	0xefe9993c,
-0x0c565b83,	0x154a49b5,	0xdd896ee6,	0x99d3a097,
-0xb67d6763,	0x44562693,	0xe69353a2,	0x957a1116,
-0xce61d1e0,	0x4bda4c75,	0x7d8c770c,	0x11980805,
-0x561a87ea,	0x6b79e439,	0x8d54242a,	0x817de2cd,
-0xe2140396,	0xd8f538d7,	0x60a7e51f,	0x981a22f4,
-0x8c1bd013,	0x6b23db67,	0xc51f4727,	0xa2ebd226,
-0x46528dae,	0xa4f44720,	0x8e241ea6,	0x4510662f,
-0x8e2d75df,	0x206c055f,	0x77fe4b1c,	0x923824f2,
-0x7f805f32,	0x59ac5198,	0x6ac7fb2b,	0x89b0087a,
-0x4772415d,	0xd9e73d6b,	0x1d767093,	0xf15922f2,
-0xf783392a,	0xc2715489,	0x18d84435,	0x90af82a1,
-0xb8900c90,	0xb7adc0d2,	0x1a8e2a13,	0xcbc595f0,
-0x5dc62e9f,	0x2c1bee3b,	0xd817354d,	0x9e460f6a,
-0x57ae4385,	0x0b54aedd,	0x21cc9c23,	0xf67349b4,
-0x072a2495,	0xc501def4,	0x65d1fbf9,	0x70282b9c,
-0x7072643e,	0xb7ed88d7,	0x93341d4c,	0x6fd88c08,
-0x4e185215,	0xfcf788fc,	0x5ccc37c1,	0x9d8c1602,
-0x84017ec9,	0x9213b205,	0xdc4db616,	0xbfe9acb0,
-/*  662-MU168a01.inc  */
-0x00000001,	0x00000001,	0x11022000,	0x0000068a,
-0x80fc9e3b,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x4efad552,	0x58a399f1,	0xf144f845,	0xfdb9117d,
-0xb230677d,	0x1136f756,	0x8298a1b2,	0xb0c9cffc,
-0x1e77875e,	0x2ea286ab,	0x6943a0b5,	0x41e37874,
-0xfad4205d,	0xbc2d4993,	0xe5ac11e8,	0xa81a4aa8,
-0x977a1e24,	0xd78cb1a7,	0xea9b7600,	0x280582ee,
-0x04779e3e,	0x4af7afda,	0xeba0b976,	0x40f8ed1c,
-0x9801c81d,	0xf500eb15,	0x74eb0918,	0x9b17c81f,
-0x9d5dd38f,	0x17410757,	0xf843bed3,	0x2c401670,
-0x6a428a9d,	0x28640d65,	0x35840c58,	0xcae15773,
-0xcad83b47,	0x304765ea,	0x36da3de4,	0xaca34c0f,
-0x61950b2a,	0x13ff21a5,	0x0817c1bb,	0x7e68e7a3,
-0x89d484f7,	0xa2c84945,	0xbdd500eb,	0x0f7aaaef,
-0x43b3cc4d,	0x55aaf9b2,	0xb8e9831f,	0xf093b0b9,
-0x8266e028,	0x5242bbd4,	0xccd1f798,	0x385ee185,
-0x15b897df,	0xedcc4e3e,	0x5028068b,	0xe3fc6555,
-0x24c2ded3,	0xf9ddf6aa,	0x1256f316,	0x21829113,
-0x17bd6a35,	0x252bdbdf,	0x9d356e62,	0xe02c900a,
-0xa3f04a7d,	0xd607feeb,	0xb2938296,	0x63192310,
-0x0aa601be,	0xe75ba498,	0xe844f6cc,	0xd9016ef6,
-0x0ee53a7b,	0x4109ef16,	0x06f14b3a,	0x28185283,
-0x97abaed9,	0xb6aaf076,	0xdb485b2d,	0x64213aa4,
-0xd95491d1,	0x79495ede,	0x0f6d13d2,	0x409172b3,
-0x71ff4426,	0x39482f22,	0x7411a8a8,	0x1d33b47f,
-0xd1b42e84,	0xec7754cf,	0x89116c0f,	0x2c09c658,
-0x99c8564f,	0x6b901f71,	0x83a077bd,	0xd50ac9fe,
-0x53427f66,	0x93447a6a,	0xa72bfaf2,	0x33e743e8,
-0x240588c1,	0xd74f75fb,	0xbf90f7a5,	0x75c3c8a2,
-0x9d0c5193,	0x43b92dd1,	0x2c00a47a,	0xfffce742,
-0x5d3ac1fa,	0xcdc46584,	0x712af8c7,	0x3733fe09,
-0xbb301419,	0x2bb6a944,	0x3edd7c53,	0x31157d4a,
-0xba14f3a0,	0xa385a286,	0xa6ac6f44,	0xb09ee00a,
-0x4fb68608,	0x5eba43d6,	0xeddde198,	0x688e46eb,
-0x4f4cef08,	0xd3dd5f9d,	0x8c0d995b,	0xb1688d6d,
-0x40f050f3,	0x064f8c26,	0x2acbc04b,	0xe3be1052,
-0x81765ee9,	0x38ec4036,	0x4aebe9e4,	0x700aee4d,
-0x0ddee69f,	0x32a8240c,	0xf1aadda5,	0x79d64bf0,
-0x79bca80b,	0x42ba8186,	0x5093b355,	0xc6bc148a,
-0x60bbbcf0,	0x58843416,	0x68fe124e,	0x551551b5,
-0x2ee3310b,	0x3fe684e4,	0xd2669d2f,	0x6d32a6ec,
-0x3c038661,	0xdfce797f,	0xb44f91b9,	0x6b054e2c,
-0x6c8a55b0,	0x53d4f5cf,	0xa9ef5cc9,	0x6a1497e3,
-0xdad943af,	0x7ac80ff7,	0x0a233ada,	0xdd162f79,
-0x654e8707,	0x6e0d72dc,	0xa7f16610,	0x64af2199,
-0x43cbc05a,	0xa082d85a,	0xa0ecc319,	0xed5fb102,
-0x50e03123,	0x1e691374,	0x76cca719,	0x96a54140,
-0xe637f7ac,	0x0bdceb2c,	0x2509562e,	0xdc493727,
-0x9ae44e2b,	0xbe7c82e6,	0xdd903312,	0x16182680,
-0xab131706,	0x00753d5a,	0x4f018f8a,	0x768bbd06,
-0xda089985,	0x9ec0bf68,	0xcf0ca6d6,	0xef21a479,
-0x10f990bb,	0x976257b1,	0x448acbd0,	0xd6a49e41,
-0x146a9f84,	0x1c462ffe,	0xc1e13fc2,	0x33a89da1,
-0xefe418ba,	0x2157e31e,	0xc9dab388,	0x7a5175f7,
-0x8fca565c,	0x3badf7fa,	0xb6b3ad3c,	0xcdc7c3db,
-0x75c1db40,	0x9f93463f,	0x869e7c18,	0xe3841a98,
-0x47f4b382,	0x5b708e12,	0xb704f263,	0x0977410d,
-0x510dad8c,	0x6e6e5abb,	0x523171ed,	0x0641bebd,
-0x03f8ab45,	0xffb1561a,	0xbac7c413,	0x893143e7,
-0x78f8702e,	0xf3a1a5dc,	0x154f9e24,	0xecee7df8,
-0x887b465c,	0x31ea2f2d,	0x58e06b7f,	0x3e53c9d3,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1069-m04f122e.inc  */
-0x00000001,	0x0000002e,	0x05022003,	0x00000f12,
-0xb2548d0a,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0xe6b36263,	0x6f9eaf78,	0x632770bd,
-0xb11f8920,	0xbc42e776,	0xbd797134,	0x9768e716,
-0x1dce3da1,	0xe0dbe21b,	0x30349ee3,	0xb0aae4c6,
-0x1591358e,	0x6646707a,	0x147f6ddc,	0x639c59e3,
-0xed11c0d6,	0x2707c252,	0x8053be8a,	0xb432051c,
-0x941732da,	0x80e55dca,	0xf389d8f4,	0x738a68e3,
-0x85f7042d,	0xe1904f35,	0x1e2e7f3d,	0xf1d4b55d,
-0xf9829802,	0x0b8d6394,	0x252d74ca,	0x7b6a0be4,
-0x13ec2030,	0x7d8c3429,	0x32380fdb,	0xb595854c,
-0x6ab18d3b,	0xfe241438,	0x79ee3c90,	0xf7c80ed2,
-0x9735dffb,	0xbba18676,	0x2687be0c,	0x9fb2e5ef,
-0x28f85fb1,	0xea0b3223,	0xf1e3f263,	0xffd47414,
-0x86a09efc,	0x3b23b61f,	0x03600e24,	0x0f59519b,
-0x8868d3b5,	0x1cd3ddcd,	0x174364a6,	0xced7c4ea,
-0x637cf55d,	0xab80c838,	0xb2ccd05c,	0x968f8d6f,
-0x77f66b77,	0xdf34ebcb,	0xfece6f5e,	0xb819e030,
-0x1d73c1d0,	0xf6d86e15,	0xfed82c81,	0x4ac93249,
-0x4358711e,	0xe558a942,	0xc19f602c,	0x3d51db79,
-0xbc5b9f59,	0x1dcbf598,	0x09326724,	0xae712704,
-0x686bb2d8,	0x8cb848bf,	0xd1f00d90,	0x6cebdd80,
-0xe9827e3b,	0x7ffc9a62,	0x52851c33,	0xd9f6d8b7,
-0x89294625,	0x5cc9e522,	0x416df615,	0x7b4b8c1d,
-0xa819df83,	0x458483f8,	0x12c2a1c8,	0x3219f4be,
-0x20a99f23,	0x30c8cb2b,	0x0284107f,	0xcaf74794,
-0x3b8408e5,	0xe3915f05,	0xfe89b7f1,	0x3b30f859,
-0xf6c214a4,	0x53ea7021,	0xf1ae6ce6,	0x300771c2,
-0x7c769103,	0x59c4f9ec,	0x954321c1,	0x0010217c,
-0x60f87712,	0x9531a33c,	0x6516e8b2,	0x7e6af0e1,
-0x159c0a30,	0x5c0df59b,	0x2763d9c5,	0xc5c08122,
-0x80be5172,	0x96d9c015,	0x227f4d84,	0x104ad707,
-0x7cd7de50,	0xc58e569a,	0xd2129ffd,	0xe9afedf3,
-0x61e19908,	0xecd27e20,	0x36ef4ae8,	0xcda53aff,
-0xdfbd8a65,	0xaad6eef6,	0x3720e8cb,	0x061f85c6,
-0x60643ad4,	0x0e3cd18c,	0x9d19ec4f,	0xec94bb30,
-0x9f53ebe5,	0x3f591c58,	0xdb015450,	0xade7e0c7,
-0x305be3b2,	0x4cb29bc5,	0x7b57cbb4,	0x3aa89078,
-0xfbe6e43d,	0x0b761e6e,	0xed8b5baf,	0x3b4e756d,
-0x6a148c9f,	0x1a3a01a8,	0x1d33ac7a,	0x3e3dd3e2,
-0xbfb4392c,	0xca1ce690,	0xd1af4a34,	0xa931d9c3,
-0xa86836be,	0x34d86f8a,	0x21cb75f0,	0x37c152a4,
-0x95b9c9a4,	0xc30f3c29,	0x1b821c8e,	0x637851df,
-0x069cc4f8,	0xd88ead11,	0xf5f5728d,	0x1b0ffed7,
-0xfd846742,	0xf76f607d,	0x5d8a4740,	0xad48d963,
-0x6a9ffcc0,	0x1b320e79,	0xc49b22c3,	0xde2c0048,
-0x5fcaddfe,	0x708e63ca,	0x294d5d69,	0xa3dce328,
-0xb847b4d2,	0x611c0a2b,	0xcd4513c8,	0xfa1bfa75,
-0x45ca8ca2,	0x3681b381,	0xc27f6c94,	0xcd958d01,
-0x7b55386f,	0xa4b2c59c,	0xaa58ef1f,	0x752c6c71,
-0xdd97125c,	0xdfc2881a,	0xb9d5036e,	0x5148d9ff,
-0x24e6b06d,	0x8390116a,	0xea6d4d44,	0x7378ffef,
-0xd1833cf6,	0x3415528c,	0xcf3622fe,	0x76729d17,
-0xcd1ba4ad,	0x1885ed72,	0xde02375a,	0xa49131ff,
-0x3be6df31,	0x6cf2c534,	0x90aacc16,	0xa2eda106,
-0xa7aaecef,	0x5831a9fd,	0x5f142437,	0xaf30f7fc,
-0xc8f6cdab,	0xda69d12d,	0x5871249f,	0xc011e372,
-0x33c8e75d,	0x8087d9fb,	0xc595c587,	0x9cc36c3e,
-0x676b2c58,	0x4f242c1b,	0x6b77d07c,	0xa1c8543b,
-0x2824e9c7,	0x84be15a4,	0xc0b4a308,	0x0e41511b,
-0xfaf3dbbe,	0xc1777e7b,	0x199d042b,	0xb0b35558,
-0x9bf8cb58,	0xf68d5c43,	0xf359b550,	0x993d82d1,
-0xa8388458,	0x56d3c256,	0x11cbc33f,	0x3c28a56f,
-0xe6aa09f9,	0xd41f6c39,	0x11020cd2,	0x985c89db,
-0x3705b46f,	0xaf90c2dc,	0xf7ecfc96,	0x355eee96,
-0x078e9048,	0x2fd05bf1,	0x48eab9e0,	0xafaab712,
-0xcf0c3e12,	0x8095ae6d,	0x8364131e,	0x7221ba38,
-0xad0e42d6,	0x20741356,	0x8698ad29,	0x024d1baf,
-0xb87c4a77,	0xa4169a47,	0xa487c4c8,	0x966a2b68,
-0x9821bace,	0xe64b1014,	0x22eda535,	0x4cc48e4e,
-0xb1a80833,	0x0e9ec179,	0xf6bb1c55,	0x95489311,
-0xefe8a663,	0xc4cf14f9,	0xe3591c5d,	0x86c3c61b,
-0x9fe18d90,	0x3b75ff1b,	0x5ca3d992,	0x8c072f42,
-0xecf16b8e,	0x672b72c7,	0x4603e497,	0x45e015d4,
-0xd918406b,	0x4f25a635,	0x5feb56b4,	0xf9f94d06,
-0x7bd31a73,	0x1ab03fc0,	0xb85fdbd8,	0x4c3e81d9,
-0xefc2c666,	0x59a7afcd,	0x8a02428a,	0x73af7adb,
-0xd8ea36e0,	0x991a6fd9,	0x7f9c2019,	0x2d3a85d6,
-0x8f3295c0,	0x93809471,	0xa5d313f5,	0x8cd5ea3b,
-0x7b982971,	0x5e4f0172,	0xcedcb6e6,	0xea24e209,
-0x8a46f8b2,	0x74331527,	0xd77ed523,	0xaba69d6a,
-0xebd38b4b,	0x04c01b27,	0xcf51542c,	0x25e75d87,
-0x69f4e24a,	0xeb1c3f81,	0xdd4508da,	0x0cc85856,
-0xd006d573,	0x79a7c5cb,	0x1cc2e951,	0xd1ac0710,
-0xa78fbeba,	0x90877b5f,	0x7972ab18,	0xd866ac15,
-0xc287620f,	0x54fdeb69,	0x9c2d264f,	0x6c2e6ff9,
-0xa12c2962,	0x87f99490,	0x5a9f5f5c,	0x5fd88f09,
-0xf6b7e966,	0x02abc4f2,	0xde5eddd1,	0x6ccd06e7,
-0x7747ee88,	0x9bc9622a,	0xb807d839,	0x1d14fe6b,
-0x1c4676e8,	0xb9add7e1,	0x5a84fc84,	0xa0d232ab,
-0xf09b95a0,	0xbd7481db,	0x9f68639a,	0x4870d114,
-0x60ebc8a5,	0x42d4d24b,	0xf64d2815,	0xaab0da5f,
-0xcba7f41c,	0x44dcd89b,	0x613d50e6,	0x180e700c,
-0x18a6bdad,	0x54883f08,	0xa0a9fc4b,	0x9af3ec0b,
-0xba3f74f2,	0x9469aa23,	0xc89de01e,	0xe7963adb,
-0x8cb13661,	0xdbbd276c,	0x42e113df,	0x4947dfd7,
-0x513cc410,	0x57c6db1c,	0x8911377d,	0x01405fa9,
-0x7163e406,	0x995a0db3,	0x2e9b208b,	0x4c77dfbc,
-0x33f30f4c,	0x5aad99da,	0xcca61b32,	0x027fa2ce,
-0x2b5387aa,	0xafca9d2b,	0x7fbe4c67,	0xee92fc72,
-0xc3857c05,	0x5e425769,	0x4ae6558f,	0x499427f8,
-0x15900b70,	0x3aae1260,	0xa7bfc2a1,	0xdfa73e71,
-0x8b79b206,	0x6552c432,	0x56b81866,	0x86d6e834,
-0x91685add,	0x7c34051c,	0x4ef8db74,	0xbab855ee,
-0x083ab156,	0xc82a579d,	0xec1e3ae3,	0xdfea24a6,
-0x9554ee6e,	0xd53b8bd1,	0x9a4bda63,	0x884e86e5,
-0x9acf4763,	0x540b9ded,	0x5fde4bca,	0x541d2dd4,
-0xc5637486,	0x5fdfc527,	0x6cc50628,	0xc701a605,
-0x7fba696e,	0x053a6cd0,	0x3796571c,	0xd11ec6f6,
-0x2a653ec1,	0x69a1ade5,	0x16171235,	0x3aa406c1,
-0x825d106f,	0xb2f62dd2,	0x5aa895d9,	0xac55d308,
-0x3f01278d,	0xb6153d8a,	0x98cc1fa3,	0x65327e2d,
-0x7dd8e033,	0x9c399398,	0x94a8f0ba,	0x4336f0e7,
-0x87f425fd,	0x8f1d3e0d,	0x05ff65d4,	0xe4a1a06a,
-0xf5dd16e6,	0xc4bcdc31,	0x363f2b98,	0xcd01dfec,
-0x442c1d49,	0x3a5cb899,	0x0ea2945e,	0xa91470dd,
-0xb629ae00,	0x2a25ffd7,	0xaf24dcea,	0x4bf22512,
-0x2f4c1a13,	0x9d76a33e,	0x28a3e7b7,	0x17ea3463,
-0x0a831542,	0x1ae4a98a,	0xcc8066c9,	0x51b4e2a1,
-0xa030bf19,	0xa19596da,	0xe0e5af95,	0x86a6f7a4,
-0x6f51d56f,	0xed2d0511,	0x31a1430c,	0x6a9fd0d7,
-0x481515f9,	0x423cb82a,	0x3811455c,	0x475610cb,
-0xdecb5b82,	0x52bd1ebe,	0x3373db79,	0xdc7c458d,
-0x462cf8cc,	0xfe353c25,	0x91dc7f41,	0x60b84709,
-0xc29de95b,	0x97acf20e,	0xdba91f15,	0xbb26e2cd,
-0xbb150856,	0x5683c1cf,	0x6bc7ffbf,	0xa00deea3,
-0x5a1c103d,	0x2b0d6b33,	0x241c3306,	0xf86d7e81,
-/*  531-mu26732e.inc  */
-0x00000001,	0x0000002e,	0x09101999,	0x00000673,
-0xa5945abf,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x608ab600,	0x7653aba3,	0x90cf06df,	0x2cb405de,
-0xe4c59cfb,	0xe6c669e7,	0x3aa728ba,	0x83d3111f,
-0x892fc321,	0x2566fbdb,	0x8c37ee68,	0xbfbe902e,
-0x58c979b3,	0xe18b8acb,	0x8d0d319d,	0x4b0ed465,
-0xf4f644f7,	0x847da89c,	0x587df5fd,	0xa3aed418,
-0xb8b811cb,	0x0330bc99,	0xe8167486,	0xa00d6d3a,
-0x77bfa90d,	0xbaa76e96,	0xf9098d1c,	0x3320799a,
-0xcf8409f1,	0xe176caa8,	0x4f0319a8,	0xb4952500,
-0x967781c1,	0x63834cab,	0xc6e650d3,	0xed9dd97c,
-0x3007ef9a,	0xa4fe2c6e,	0xf45fe99e,	0x6b3e6506,
-0xf2cdd2f3,	0xb59c79c9,	0x14c6ed40,	0xa5148f5d,
-0xf5fde82e,	0x3bcfe380,	0xd4530539,	0xf29c478b,
-0x0783cd9f,	0x804ce845,	0xb9f62a6c,	0x2ae018f8,
-0xd7c42c7d,	0xe2106e84,	0x0954ef6e,	0xbdf3275f,
-0x96d8f3a3,	0x127c0bfc,	0x9b459637,	0xae1c6dbc,
-0x52986367,	0x8ce39f67,	0x9460054a,	0x012da826,
-0xe6a663f5,	0x9b7d890e,	0x7954aa8e,	0xc92ef63b,
-0xbfe64a51,	0x7ad32697,	0xa42480dc,	0xd904d833,
-0x7e8fc827,	0xeab91ad0,	0x869b7a18,	0x496c1157,
-0xd07db5d6,	0xc4befd10,	0x692303f2,	0xb7219baf,
-0xaf54123f,	0x7def51a2,	0xb284536c,	0xd67c0f8f,
-0x02b5ed18,	0xbccb127d,	0x92139fc2,	0x1e70a3fb,
-0x84fde186,	0xe3e678e4,	0x3f04793d,	0xefbfd6e5,
-0xce8eb13f,	0x60c77646,	0x966d3b7b,	0xc3e7a620,
-0x4447e93c,	0x8f604fc1,	0x91c17b22,	0x7f232650,
-0xb5efc2da,	0xb2280f8d,	0x519fcedc,	0xaec0722a,
-0xf0d35d60,	0x63c82715,	0x9cfaacb5,	0xf57e3bd3,
-0x4a7ea75d,	0xc228bac7,	0xa1e89e6c,	0x58c8a391,
-0xdaee8c6e,	0xabc21b13,	0x341e7a59,	0x9ad9d0b9,
-0x85d4e8fb,	0x25d0c528,	0xeb4a572a,	0xf95a39ac,
-0x3a409cf8,	0xde9db56f,	0x9782b8d2,	0x664b82cc,
-0xf070e3ad,	0xa4231202,	0x01c2423a,	0x9855d0bf,
-0xc2af813a,	0x4cc77c96,	0xd5d25658,	0x960a18ae,
-0x59ead120,	0xb07bb96a,	0x8a95ab68,	0x3026dafa,
-0xc4ba3959,	0x92ab62c2,	0x75b4328c,	0x9fb9fbbe,
-0x8baf8268,	0x6d18e002,	0x87fe6aa8,	0x8bbaa231,
-0x09c2001d,	0x80e8353c,	0x821a39a8,	0x08b46ff9,
-0xd6caf0ae,	0xa59e0122,	0x6493d7fc,	0xa5121d9c,
-0x9906b736,	0x361c9427,	0xb9fdc3f8,	0xad0575be,
-0x08b6f080,	0xc46399a9,	0x85013609,	0x066ecc06,
-0x878870a9,	0xc2d8b6cd,	0x529b03c3,	0xaaa98ba2,
-0xfd7d4381,	0x0651145b,	0xb3a5ef25,	0xfb2d55b5,
-0x29f7c000,	0xc6cf8717,	0x32ea5099,	0xaab306df,
-0x3657ef2c,	0x20a16efa,	0x51ac482a,	0xd6a62e1d,
-0x47742893,	0xb3b3e105,	0xbfdfc488,	0x015f4adf,
-0xbf6842aa,	0xed18f4df,	0x3c4ccaa2,	0x4923ec46,
-0xa77a5258,	0xea143daf,	0x6c2915cc,	0x87c99911,
-0xb54207f5,	0x676a7ae4,	0xf54539db,	0xba8530d9,
-0x4a92a4d0,	0xa16b254c,	0xfde1b3c5,	0x0f39e80a,
-0x8f091bc5,	0x9c3256ca,	0x32b2e9c1,	0x3e6f0d8f,
-0xc747f7e3,	0x97425a47,	0x53155de3,	0xda67575c,
-0xd918d8e1,	0x54a36761,	0xe3dd3bcb,	0x6c50eb67,
-0x6083a5f8,	0x6f23b175,	0x175539b8,	0xd1033c16,
-0x4b1cb096,	0x5e251620,	0xc9982976,	0xa5f08673,
-0x6d5cb971,	0x7c7dca0b,	0x952f1155,	0xdc82a0e3,
-0x06cd25cd,	0x3a46effd,	0x0fc83360,	0x88713e82,
-0x9ecaae82,	0x9363878d,	0xd1ab7241,	0x8444f2f6,
-0xdc440056,	0xb4ad62c5,	0x9f5f5897,	0xf1f3a779,
-0xbae6be03,	0x3086cd06,	0x9d828a06,	0x4b45af5f,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  737-MU16b11c.inc  */
-0x00000001,	0x0000001c,	0x02152001,	0x000006b1,
-0x6506e1cf,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3ff8d1ac,	0x6ad5a5d7,	0x41bc1a2f,	0xc0cfcf98,
-0xae80b685,	0x4e7fdba5,	0xee70aae6,	0x857f82df,
-0x4c12ad1c,	0xc6eab058,	0x849e97b8,	0x4b425e5a,
-0xe6819908,	0x8134a945,	0x601aea2a,	0xc633b991,
-0x8f9e395f,	0x4699cb55,	0xcbc3795e,	0x85561846,
-0x6f4f5e1f,	0xcf0cf38f,	0xac133e0c,	0x4bbe51fc,
-0xc340f285,	0x8c63f67d,	0x45160027,	0xc85a74bb,
-0xaeb95e32,	0x4f4fc61d,	0xe5033858,	0x8e4e090f,
-0x4b5acb2a,	0xc75bc00c,	0x880daabb,	0x43d6f6af,
-0xefd1d4e8,	0x87575a65,	0x6ef3afc2,	0xc8062d96,
-0x8945ca80,	0x41c583c3,	0xcbb2f0a7,	0x8661bdce,
-0x6d21f128,	0xc24acdc4,	0xaeaf43d5,	0x46dcbcd3,
-0xcf544779,	0x82ea3983,	0x4b1656e2,	0xc3a0de21,
-0xa14ded06,	0x4e779174,	0xe01de86d,	0x80c33ba8,
-0x44762085,	0xc74f0d93,	0x85ca1cfa,	0x4dc7752f,
-0xe0c2bfd0,	0x853e48b1,	0x67f42503,	0xcfed157c,
-0x8d33cb2f,	0x43eb149b,	0xc71e279a,	0x82561424,
-0x60cc4578,	0xce0d779d,	0xa6254192,	0x43e5a2cf,
-0xcaee4715,	0x857afd44,	0x45ad93fa,	0xc6043ebf,
-0xa98f3eee,	0x4f8e481c,	0xee5d3fe4,	0x84e30c80,
-0x464de23b,	0xc76af7c3,	0x8155a3cb,	0x4a425a2f,
-0xe3fd06a4,	0x8b51c2ec,	0x61bda6b9,	0xc71d76c2,
-0x8bd436d3,	0x4e4a5c77,	0xc2cffcfd,	0x833c6a3c,
-0x65d4f768,	0xcbfe0635,	0xa9bd7c0a,	0x49d3018a,
-0xca646403,	0x8776d3d2,	0x426a93f7,	0xc03b8393,
-0xa8e7690c,	0x46d7b40c,	0xe6a47d18,	0x8b927811,
-0x4febdfe3,	0xc38a9d51,	0x8f76a603,	0x49d5cc1c,
-0xe79861ed,	0x8d4c5baa,	0x6c7da6df,	0xc157063a,
-0x87dbd994,	0x472dff09,	0xcc1742f2,	0x8de8e9c7,
-0x641ab500,	0xc437013a,	0xaeaedc04,	0x492e9f4e,
-0xc3de047e,	0x8dbd801d,	0x4cfd2f32,	0xcc34102c,
-0xac06dbb4,	0x4ac3f30b,	0xe83b3458,	0x8634b95b,
-0x444079d2,	0xc807d487,	0x8da4cd9e,	0x4760f318,
-0xec62523f,	0x816240b9,	0x6cba09ce,	0xca86a264,
-0x863f14ca,	0x49b9d4a1,	0xc6bd9715,	0x87edeb98,
-0x6fa1a092,	0xcb36670f,	0xa2edb3a7,	0x43545378,
-0xc3c35ad7,	0x8e2d1255,	0x4a06377c,	0xcd1b61d4,
-0xa83a9bc7,	0x4c48d28d,	0xe8a27b8a,	0x8a47665c,
-0x49a35371,	0xc8a8fb0a,	0x830dc900,	0x4c01d1bc,
-0xee2ffff4,	0x83243d8d,	0x61ead599,	0xc82c0451,
-0x8c19b0ec,	0x465ee1d4,	0xc52df943,	0x8490687c,
-0x68474c0d,	0xcc495773,	0xa04396d5,	0x4824c02c,
-0xceb15f4d,	0x80a78140,	0x4de85a0b,	0x8945e8c5,
-0xc981ea75,	0x7ff89629,	0x4e4ce4e2,	0x6e9ceb88,
-0x7f0b4dff,	0x165e46c8,	0xcf59bf6c,	0x9c430db4,
-0xb55a941c,	0x277a73f1,	0x6dbffb22,	0xb3081fe8,
-0xdebe60c6,	0x691d8c9e,	0x330333a2,	0x0b024599,
-0xe358aa28,	0xe70334b3,	0xe48d7707,	0x16318df8,
-0x0e34f491,	0x1c0d6223,	0x54315b5f,	0x040fcc96,
-0x5557f1d2,	0x5ccf28f6,	0xc0004404,	0x2f7a5fef,
-0x95b65ddd,	0xbaa1a873,	0x077783d4,	0x3f24b63b,
-0x9ae679fe,	0xaf11d97e,	0x51391564,	0xb3247855,
-0xcd10e6dc,	0x704e147c,	0xcc15de9d,	0xa5adf161,
-0x0179c9a6,	0xa579d74c,	0x28704a4d,	0x3e7a2d92,
-0x253437c4,	0x1162b521,	0x14a9c51d,	0x2129abbe,
-0x3b2d07c4,	0x1d84f76a,	0x016cd356,	0x3fd03cad,
-0x3f82ee67,	0x0275b51e,	0x5dd38dae,	0xdd022704,
-0x6b6d2f56,	0xbdb25b55,	0xe4188d73,	0xc03a6c98,
-0x8a303586,	0x4999d605,	0x82c9e7e8,	0x8169c654,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  615-MU16860a.inc  */
-0x00000001,	0x0000000a,	0x05042000,	0x00000686,
-0xf3bb1079,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc6586232,	0x277d54d5,	0x4f7ef8fb,	0xcef7ac22,
-0xafee0e72,	0x4a9e0934,	0xe7695725,	0x8e285007,
-0x43a4a8d1,	0xca144dd9,	0x8da2b518,	0x4c6d74d3,
-0xee363815,	0x8dda7522,	0x6369e4b9,	0xc7c48080,
-0x86ecc6af,	0x44076855,	0xc9135988,	0x80b2a4a6,
-0x654cbe11,	0xc314db83,	0xa04e60d8,	0x4434829a,
-0xca630037,	0x863dba4b,	0x456b3656,	0xc81b5036,
-0xa757768c,	0x42657f3e,	0xee28655e,	0x8acb7fc2,
-0x4d3f1153,	0xc727c830,	0x8d83dadf,	0x4337ed65,
-0xea82a648,	0x8b0ed272,	0x6e1d5d2d,	0xc89ca234,
-0x88162543,	0x4509f20b,	0xc4246893,	0x897c8837,
-0x6ce85470,	0xc289a8b6,	0xa7b752d9,	0x44740264,
-0xc338d34d,	0x840cd712,	0x4d254023,	0xc9bd3b4c,
-0xaec6fe45,	0x46a93c90,	0xeba68ac4,	0x8661a9bf,
-0x4ceabe79,	0xc306abe8,	0x85063cf1,	0x4bc76d54,
-0xeae61c29,	0x8d44a15b,	0x66237e93,	0xcd3d3258,
-0x8ac002d2,	0x40ec33d2,	0xc1e9e690,	0x85ba7ab9,
-0x6dcb9946,	0xcd8e5656,	0xa4574bee,	0x4618c900,
-0xced94234,	0x8fa66dc2,	0x43674822,	0xccadd163,
-0xaee4a680,	0x473f1952,	0xee0b507b,	0x826c5327,
-0x4f1b2e4a,	0xc5545ee4,	0x81491d47,	0x4ac38596,
-0xe89e1b72,	0x81521383,	0x6b81f877,	0xcbf08fef,
-0x8b650447,	0x45f055aa,	0xc9486656,	0x85578a8b,
-0x63654c15,	0xc2af788c,	0xa233a356,	0x4c8d3793,
-0xc064bed5,	0x87ff0732,	0x4b5dc58d,	0xc0c6c854,
-0xac243f64,	0x4da1178b,	0xe7afc726,	0x83d3db2f,
-0x4ffb7e67,	0xc99377ab,	0x8c41ac2f,	0x47fe29e9,
-0xed122282,	0x838f214b,	0x6e5e72ea,	0xc1f608f0,
-0x86a943f6,	0x47145486,	0xcf3c8179,	0x81052692,
-0x635b3226,	0xcc85c969,	0xaa5ce1eb,	0x47e6fcf9,
-0xc5cc35c4,	0x89ac6258,	0x479fac3a,	0xc973764a,
-0xa016e339,	0x4c1b7a87,	0xee98daae,	0x8edc812f,
-0x412b4bee,	0xc25c289d,	0x8046a1c6,	0x488629e4,
-0xe91c1a3c,	0x8fb3f214,	0x651e4ec9,	0xc74eac7e,
-0x8524b474,	0x4030530f,	0xcb056d74,	0x8c0ac837,
-0x6a40ec66,	0xc74d14ad,	0xab9f4dd1,	0x459394be,
-0xcfa36a50,	0x8e3cbebe,	0x4c5ee2fb,	0xc98e93b1,
-0xa9931b6b,	0x4d7e4737,	0xedd1f9a0,	0x8416989d,
-0x465230dc,	0xc53d307d,	0x88081eb6,	0x450cc861,
-0xec50e8f4,	0x813ebc03,	0x60c24916,	0xc054909e,
-0x8e9a180f,	0x49733b4c,	0xcdefdaa6,	0x83d68d71,
-0x6242222e,	0xc9dba65d,	0xa3cccfc5,	0x4e4a1f40,
-0xcc900c57,	0x8ff2de70,	0x48e12407,	0x5de722dd,
-0xcce5593d,	0x808ee900,	0x418756c9,	0x47de05b7,
-0x85d9207c,	0xc21bc623,	0x44cebac0,	0xde933434,
-0xcfaa4ccb,	0x1b56dcfe,	0xd9b94c1c,	0x30ee76ed,
-0x1fc5ee45,	0x25ec6f82,	0x31faa1b4,	0x56adf5d2,
-0x2aded395,	0x7248b2d4,	0x57c8710c,	0xa08f21da,
-0x71284cb3,	0xde2154a2,	0xa2604dbf,	0x19d224f3,
-0xdf868867,	0xc7856703,	0x149f27ba,	0xe9c687c4,
-0xc1003175,	0x22d08b5a,	0xe6e67fc6,	0x357a7981,
-0x2d83592e,	0xeca25638,	0x38dfd98a,	0xf1116012,
-0xefebfd17,	0xe1fe908a,	0x7a9a518b,	0xc7174264,
-0x6dfc5c6f,	0xacbf3bcd,	0xcbcf1983,	0x8dd961dc,
-0xa1ea4015,	0x22886fed,	0x426bef9c,	0x89976657,
-0xeff39b00,	0x6403ca75,	0x27dd4d41,	0x1a7e4e6e,
-0xcd8db1cc,	0xd0534459,	0x8d784b83,	0x990e1efa,
-0x4183683a,	0xd8a1cac2,	0x1b04d7d1,	0x8a53f9ae,
-0x5af9a50e,	0xdf0f6d46,	0xc307f2ec,	0xcb272d1d,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  412-MU16530d.inc  */
-0x00000001,	0x0000000d,	0x05181999,	0x00000653,
-0xc28f9258,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xfcfae324,	0x355315ed,	0xc89ef542,	0x63841659,
-0x3c7c348e,	0x72c60a98,	0xabf29b87,	0x3bcf46b2,
-0x85c9c5fd,	0x99e2bbf8,	0xa7e7803a,	0x32ae3caf,
-0x7591a794,	0x408861ae,	0x14b31bd0,	0x06bece05,
-0x20ad4eff,	0x2e4b7bfe,	0x82c1a02a,	0x1c19b338,
-0x8c3078a2,	0x8da2bbbb,	0x395ac3fb,	0x879e34d0,
-0x61f4384e,	0x399b3f11,	0x4e27b881,	0xbed3ce7b,
-0xe385bb3d,	0x36616016,	0xb701b47c,	0x3b5e632d,
-0x31470408,	0xd0b588c1,	0x2ef42409,	0xe272ffa8,
-0xfadb8d9e,	0xa02391cb,	0x278bf424,	0x0487391f,
-0x2a1fbf75,	0xbf9e565b,	0xdc04f70f,	0x205e3b9c,
-0x26503a0c,	0x4ed040bd,	0xcb7e1985,	0x5d057e57,
-0x8e22af97,	0xf0de9058,	0x44e78e45,	0x2447cf34,
-0x8372f0f0,	0x2a52c75c,	0x6bff4c35,	0xbcffce46,
-0x07ef2734,	0xb5cee8e6,	0x4ede7dab,	0x49f5d0b5,
-0x4f25b91d,	0x51148c59,	0x6ad97fb4,	0x366d1763,
-0x7e52600a,	0xfa3ac4bf,	0x91ab7601,	0x743211ab,
-0x52196684,	0x0b2e1efd,	0xad54278d,	0x1a824f50,
-0x90c09495,	0xd9cb86d1,	0x2c4e5005,	0x0aef93f6,
-0x2ffd9ca7,	0x0a09a406,	0x1cdb4d4b,	0x4a873b20,
-0x9c85c6ab,	0x9e1220d3,	0x1fc343b6,	0xbea0c2c1,
-0xf8a24157,	0x541ff346,	0x280c3d6a,	0xe8459a8b,
-0xa9f6430b,	0x0c6e5ba1,	0xe7da7b03,	0xac7a218c,
-0x9108cb65,	0xec79380e,	0xec3bb1c7,	0xaf0c4bbb,
-0x866eb11d,	0x16d6f13b,	0xe1ee4d0e,	0x74df8063,
-0xbcbb0fc6,	0x0f6cb60c,	0xb446bdda,	0x1c129ad1,
-0xfc3b9f9c,	0xce0672f9,	0x720d1665,	0x99217438,
-0x80a6d584,	0xd07e188a,	0x64d53940,	0x5928d1fa,
-0xd5b24c6c,	0x8cb04a04,	0xac747437,	0xa7a20909,
-0x0b57768b,	0x6c4437e8,	0x72ea1c95,	0x2aea4e76,
-0x96c9f8aa,	0x8917d477,	0xab747d6e,	0xc2c12858,
-0xaec4035a,	0xb641abed,	0x89637037,	0xc4c2394b,
-0x251f679d,	0xb9d0d6f8,	0x06da24d1,	0x2ad6c123,
-0x16324a11,	0x9fb6e487,	0x67885199,	0xbf3f7eed,
-0x22847933,	0x5d2ec8f4,	0x4a08914c,	0x7ed70790,
-0x5d6709a6,	0xfd73a3a0,	0x78295ddc,	0x67a4f723,
-0xd0fc4363,	0xda50249d,	0x4c8586e8,	0x001aefe8,
-0x4ddb0a45,	0xe19ad425,	0x51eff9f3,	0xd6c3ee2d,
-0x45bd8490,	0xca34b967,	0x46e68112,	0x98e08fe7,
-0x5ead54e9,	0x1f12298e,	0x82a1e421,	0x4826f80c,
-0x2e488608,	0xe103caf6,	0xc8be1e00,	0xd69ce416,
-0xa791a5c7,	0xfccad928,	0xa15ce378,	0xd5890d56,
-0xbfe7b822,	0x8e33f92a,	0x1847193d,	0x06619365,
-0xbf12a9f9,	0x9c1dbff3,	0xf70fe13f,	0x73267ae6,
-0xbf73df95,	0x2067879b,	0x7323b730,	0x8c28f88a,
-0x49769dfb,	0xebdbd925,	0x44f1d0bd,	0x2f379983,
-0x76eac858,	0xfd6f8777,	0xed431ae3,	0xf656af10,
-0xb245e033,	0x91c45641,	0x3ceb2809,	0xefe9f9c3,
-0xae156659,	0x4e11a25e,	0xd96bceae,	0xd03e9342,
-0x966300d4,	0x2763c143,	0x6d7cb136,	0x30013a68,
-0x99c07c40,	0x7c53ba71,	0x0e034e01,	0x78974bdd,
-0x5793f65b,	0x27bde07c,	0x84ccc31e,	0x8169d813,
-0x1477c316,	0x2da18290,	0x64b686d4,	0x6bc7d9ff,
-0x73b2c749,	0xa97f8161,	0x189bc202,	0xee2ace64,
-0xadb6a179,	0x4c13950c,	0x69f7c438,	0xc1265fe7,
-0xe7b7d517,	0x48ebf4c6,	0x76528cf4,	0x18f820d6,
-0xa3eaf9da,	0x1de7d37a,	0xe27ba2c6,	0x48fe45e1,
-0xf110770d,	0x4caab774,	0xce2990ac,	0xe7878e0b,
-0x5b9764cd,	0x6706217f,	0xf2121426,	0xcb5a9df1,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  692-MU168a05.inc  */
-0x00000001,	0x00000005,	0x12072000,	0x0000068a,
-0xb82bbbc1,	0x00000001,	0x00000080,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x41347bd8,	0x911d1af5,	0xbf990226,	0x21c0248e,
-0xae9c9087,	0x8ae67595,	0x04e0310d,	0xa3e9215a,
-0xafbc70f4,	0x1042c1bc,	0x96d7567d,	0xb056e38f,
-0x12e3b314,	0x8671b0bb,	0xb8280b8e,	0x17c0582a,
-0x864bef4e,	0x898fffe2,	0x02210693,	0x93159cea,
-0xa7e2f15d,	0x3cfa0fdc,	0xa7423ecf,	0xbf0a256d,
-0x3e69431a,	0xb5fb1776,	0x99be8001,	0x05b07adc,
-0xb394b1a6,	0xa674d032,	0x07e83a6a,	0xa6ab4c4e,
-0x8af11f6e,	0x20286de7,	0xbd9bbc1f,	0x8c6a09e0,
-0x342e30a5,	0x9d4cb289,	0x908edce5,	0x39aeafa3,
-0xb34ba5ac,	0xaca163d8,	0x37588926,	0xbc5e56a7,
-0x8459e3c2,	0x0b3b9ff9,	0xae97715d,	0x88969d8c,
-0x3e75d4f3,	0x9498328f,	0xb6f537c2,	0x018c631e,
-0xae215c90,	0xbdd6b8a0,	0x09857c7d,	0xa9836d89,
-0x940c13b6,	0x25e44062,	0xbc9e2608,	0x99c96188,
-0x2eac1954,	0x85874d2a,	0x970ecbde,	0x192fc565,
-0x8abc734f,	0x80bd71ce,	0x01dc441c,	0xbf71b84a,
-0x9e736705,	0x2dadd0ef,	0x8ba9a609,	0xa00f9d9a,
-0x0abc4362,	0xb816f372,	0x8db28c8c,	0x35bcdaea,
-0xbdd153c3,	0xa42c5de5,	0x2935db78,	0x8aba1a25,
-0xaed0899b,	0x354b0560,	0xa5819406,	0xbee34a2b,
-0x1442293c,	0x89853e8d,	0x87360b9d,	0x1a965d79,
-0x8388a852,	0xaeb2903a,	0x1bb2212e,	0x89083e53,
-0xa640f91c,	0x086e68a7,	0xb15460a3,	0x83476357,
-0x1d240330,	0xb86cc2a7,	0xb76e5b61,	0x1730c3be,
-0x92b5494b,	0xb2feab3e,	0x129f6107,	0xbbf8b20c,
-0xa73c326b,	0x3aa98258,	0xae3195ac,	0x91e12887,
-0x3c06eee4,	0xa9e8c42c,	0x8c6be8e5,	0x25a315c9,
-0xa14d1cfa,	0x87bd5cb1,	0x08674a93,	0x917ed650,
-0x8f2aa2dd,	0x2f45fe2b,	0xab9480cd,	0xb4935ed1,
-0x212f60f9,	0xb8ec56b4,	0x8d0e7f5a,	0x2c3f8cea,
-0x86961452,	0x9ccdae56,	0x159818e6,	0xb96b4352,
-0xb7cd6212,	0x3f2d6c56,	0x8825661b,	0xbc9172af,
-0x2e3a93a2,	0xaeade4a7,	0x9ec4c420,	0x10c6b354,
-0x95bc6ad4,	0x8dda8b59,	0x0cf1d120,	0x9d89ec8d,
-0x8c4c5d61,	0x310352af,	0xae1a306e,	0xbdc79b88,
-0x1973679e,	0xbbfc21e4,	0x82210224,	0x1f5e405b,
-0x97947e94,	0xb050f500,	0x21e01c36,	0xacf12a75,
-0x9ddefc1b,	0x26127f57,	0xbdd5a967,	0xbad4c987,
-0x12a6f074,	0xaba8f359,	0xac21deb9,	0x10a11f38,
-0x88ed207c,	0xb9314cb9,	0x034c2c2a,	0xadf14cb5,
-0xa4d24fe3,	0x39f571fd,	0x8c3d9ec4,	0x8f7f8e7c,
-0x03381979,	0xae96a1d0,	0xc838a487,	0x851b445d,
-0x12423402,	0xc5ba17c8,	0xc6c3f5af,	0xf1d8bba3,
-0xcf9e5715,	0x2b98c03c,	0xc7d43a12,	0x04b5c31e,
-0x0f177aea,	0x0e40ed42,	0x2481d35b,	0x0c9d57fa,
-0x284d6c07,	0x14c680bb,	0x380af49d,	0xaa351008,
-0x04f24363,	0xb6382b7a,	0xad315d2b,	0x490d6a3f,
-0x8ba682dd,	0xd2cd8f95,	0x6270d114,	0x0a114a39,
-0xf0882611,	0xe1711220,	0x20921556,	0x01469a6a,
-0xe5ee16d0,	0xf3565705,	0x01786889,	0x7e5198c8,
-0xdf188aff,	0x631c25ca,	0x73d2953c,	0x56f7eb7f,
-0x6946d516,	0x1ecf52c6,	0x7080c634,	0x978d321c,
-0x0f112244,	0x90a5c4d9,	0xba85c68c,	0xda699171,
-0x9cc834d3,	0x7836026a,	0xf455ee1a,	0x5e6868c0,
-0x5ec93697,	0x0641249c,	0x1305fc1c,	0x62ff2eb5,
-0x7cd7299e,	0x1e12a8b4,	0x67ea1393,	0xeccd8544,
-0x2df22cd2,	0xf3862164,	0x40c38c62,	0x6f983460,
-0x59238962,	0x27384d47,	0xd2b26031,	0x951fb69b,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  550-MU168307.inc  */
-0x00000001,	0x00000007,	0x10151999,	0x00000683,
-0x1c5efd4b,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x1a7821a0,	0x5c7f704b,	0x8e78e37b,	0x50c22d14,
-0xd7937431,	0x51820d98,	0x5cad6308,	0xec5e3721,
-0xd41ee66d,	0xb01a24c5,	0x5ff960ce,	0x3c922ad2,
-0x709ab11a,	0xebb95fab,	0x2db73b5a,	0x20945fd3,
-0xa81b0257,	0xbf8155d0,	0x04fd273f,	0xc077c5ae,
-0x1da50ba8,	0x307bda81,	0x5923ff70,	0x103828c6,
-0xaf83cdca,	0x2f3c561c,	0xd5cb85b8,	0x1a807114,
-0xc241322b,	0x4e401582,	0xe2567b0e,	0xad093555,
-0x4c182287,	0x14ac0b2d,	0x90cf1541,	0xedce3c25,
-0x05da049b,	0x0985b6a0,	0x1f9e9be4,	0x994b2d6d,
-0x68d04ab3,	0xe2aa006a,	0xeecb3773,	0x5a7c271a,
-0x0ac949d2,	0xa3668ff0,	0x97c326c6,	0xc05d483c,
-0xbddd9812,	0x9b823a6f,	0xb3b94ebd,	0x00ba7054,
-0x7f96f49c,	0xfe29574a,	0xcc79bed8,	0xebbd89a2,
-0x6a0f4007,	0xc3ba70bd,	0x92ed4aba,	0xeb17fcd7,
-0x8c65dc38,	0x538035a3,	0x1f16c77a,	0xd816d9fe,
-0xc9054761,	0xb2867d05,	0x8a3cefa0,	0xebd91eb2,
-0xbb43e990,	0x193bc028,	0xdccdc90b,	0x5e76a8fd,
-0xa80a4aca,	0xe370a88f,	0xb4981ab9,	0x7cae2227,
-0x8e3052e1,	0x1784fe28,	0xc4007b0b,	0x4871dd0d,
-0xa606e0aa,	0x2e9e19e5,	0x770a64e0,	0x8e173235,
-0x2452fa0d,	0xd8ca8e56,	0x912ae38b,	0x713a1325,
-0xc8cee2c6,	0xc728742f,	0xc6571e00,	0x2b1b3cdb,
-0x358965d4,	0x19357f16,	0xdcd504b9,	0xfb35fadd,
-0x9d511335,	0x7642b9c1,	0x47f1226d,	0x6e5c9b37,
-0x37cf651c,	0x694bb058,	0x110004c6,	0x351dc396,
-0xca6828a8,	0xe477af88,	0x97bb399a,	0x60b23e3b,
-0x02bcde6d,	0x67f48e58,	0x09cdb6c6,	0x231ab666,
-0xc46482c8,	0x29991ee2,	0x542947c3,	0x920b2e29,
-0xa8de7681,	0xa8bafe26,	0x5ce72e46,	0x1a51784e,
-0xaaac80a4,	0xc02f7328,	0xe5743d23,	0x370720c7,
-0xb905e958,	0x69450f66,	0x1118c974,	0x905e91b6,
-0xff337157,	0x7145bec6,	0x64d2014e,	0x7240872b,
-0xbb43e990,	0x193bc028,	0xdccdc90b,	0x5e76a8fd,
-0xa80a4aca,	0xe370a88f,	0xb4981ab9,	0x7cae2227,
-0x8e3052e1,	0x1784fe28,	0xc4007b0b,	0x4871dd0d,
-0xa606e0aa,	0x2e9e19e5,	0x770a64e0,	0x8e173235,
-0x2452fa0d,	0xd8ca8e56,	0x912ae38b,	0x713a1325,
-0xc8cee2c6,	0xc728742f,	0xc6571e00,	0x2b1b3cdb,
-0x358965d4,	0x19357f16,	0xdcd504b9,	0xfb35fadd,
-0x9d511335,	0x7642b9c1,	0x47f1226d,	0x6e5c9b37,
-0x37cf651c,	0x694bb058,	0x110004c6,	0x351dc396,
-0xca6828a8,	0xe477af88,	0x69c96661,	0xd3298179,
-0xbe41ad76,	0xb3397e64,	0xede18b2f,	0xc9d46419,
-0xb1f0487c,	0xc1957106,	0x6a1544c2,	0xbd8c9352,
-0xbe63dbd6,	0x56032dab,	0x3afc824e,	0xd2b9bd8e,
-0x3cdf7aa8,	0x05a65e2b,	0xf5754a4c,	0x3686c208,
-0xaf304450,	0x6fe2b358,	0xb24b9535,	0xbc7c85bc,
-0x090fe7dc,	0x1f6f78ee,	0xf620e00c,	0x4c723c90,
-0xa68330e1,	0x3f6d625e,	0x3e70e19a,	0x1a4c4273,
-0x67658f78,	0xcf51048b,	0x41a50d62,	0x59dbd4da,
-0x50b3f115,	0x14590456,	0xbb3a3f9e,	0xb56b5947,
-0x3c774967,	0xce1de1f7,	0x6123b871,	0x317cbf4c,
-0x8730d79b,	0xa56d2631,	0xab312243,	0x29ddc7e9,
-0x9fb56d0c,	0xf58cefc9,	0xf13bd652,	0xc31b5ee5,
-0x29e957b0,	0x93152de5,	0xc44ccf17,	0xe13c8e66,
-0x882d583e,	0x44b2993a,	0x9274016f,	0x767f7670,
-0x233ae532,	0x6ef6694b,	0x89800e05,	0xc479ac7c,
-0x8f5b4d18,	0xffab875d,	0xc1e6cf41,	0x9222f8e4,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1068-m01f122d.inc  */
-0x00000001,	0x0000002d,	0x05022003,	0x00000f12,
-0x22ba6824,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0xe6b36263,	0x6f9eaf78,	0x632770bd,
-0xb11f8920,	0xbc42e776,	0xbd797134,	0x9768e716,
-0x1dce3da1,	0xe0dbe21b,	0x30349ee3,	0xb0aae4c6,
-0x1591358e,	0x6646707a,	0x147f6ddc,	0x639c59e3,
-0xed11c0d6,	0x2707c252,	0x8053be8a,	0xb432051c,
-0x941732da,	0x80e55dca,	0xf389d8f4,	0x738a68e3,
-0x85f7042d,	0xe1904f35,	0x1e2e7f3d,	0xf1d4b55d,
-0xf9829802,	0x0b8d6394,	0x252d74ca,	0x7b6a0be4,
-0x13ec2030,	0x7d8c3429,	0x32380fdb,	0xb595854c,
-0x6ab18d3b,	0xfe241438,	0x79ee3c90,	0xf7c80ed2,
-0x9735dffb,	0xbba18676,	0x2687be0c,	0x9fb2e5ef,
-0x28f85fb1,	0xea0b3223,	0xf1e3f263,	0xffd47414,
-0x86a09efc,	0x3b23b61f,	0x03600e24,	0x0f59519b,
-0x8868d3b5,	0x1cd3ddcd,	0x174364a6,	0xced7c4ea,
-0x637cf55d,	0xab80c838,	0xb2ccd05c,	0x968f8d6f,
-0x77f66b77,	0xdf34ebcb,	0xfece6f5e,	0xb819e030,
-0x1d73c1d0,	0xf6d86e15,	0xfed82c81,	0x4ac93249,
-0x4358711e,	0xe558a942,	0xc19f602c,	0x3d51db79,
-0xbc5b9f59,	0x1dcbf598,	0x09326724,	0xae712704,
-0x686bb2d8,	0x8cb848bf,	0xd1f00d90,	0x6cebdd80,
-0xe9827e3b,	0x7ffc9a62,	0x52851c33,	0xd9f6d8b7,
-0x89294625,	0x5cc9e522,	0x416df615,	0x7b4b8c1d,
-0xa819df83,	0x458483f8,	0x12c2a1c8,	0x3219f4be,
-0x20a99f23,	0x30c8cb2b,	0x0284107f,	0xcaf74794,
-0x3b8408e5,	0xe3915f05,	0xfe89b7f1,	0x3b30f859,
-0xf6c214a4,	0x53ea7021,	0xf1ae6ce6,	0x300771c2,
-0x7c769103,	0x59c4f9ec,	0x954321c1,	0x0010217c,
-0x60f87712,	0x9531a33c,	0x6516e8b2,	0x7e6af0e1,
-0x159c0a30,	0x5c0df59b,	0x2763d9c5,	0xc5c08122,
-0x80be5172,	0x96d9c015,	0x227f4d84,	0x104ad707,
-0x7cd7de50,	0xc58e569a,	0xd2129ffd,	0xe9afedf3,
-0x61e19908,	0xecd27e20,	0x36ef4ae8,	0xcda53aff,
-0xdfbd8a65,	0xaad6eef6,	0x3720e8cb,	0x061f85c6,
-0x60643ad4,	0x0e3cd18c,	0x9d19ec4f,	0xec94bb30,
-0x9f53ebe5,	0x3f591c58,	0xdb015450,	0xade7e0c7,
-0x305be3b2,	0x4cb29bc5,	0x7b57cbb4,	0x3aa89078,
-0xfbe6e43d,	0x0b761e6e,	0xed8b5baf,	0x3b4e756d,
-0x6a148c9f,	0x1a3a01a8,	0x1d33ac7a,	0x3e3dd3e2,
-0xbfb4392c,	0xca1ce690,	0xd1af4a34,	0xa931d9c3,
-0xa86836be,	0x34d86f8a,	0x21cb75f0,	0x37c152a4,
-0x95b9c9a4,	0xc30f3c29,	0x1b821c8e,	0x637851df,
-0x069cc4f8,	0xd88ead11,	0xf5f5728d,	0x1b0ffed7,
-0xfd846742,	0xf76f607d,	0x5d8a4740,	0xad48d963,
-0x6a9ffcc0,	0x1b320e79,	0xc49b22c3,	0xde2c0048,
-0x5fcaddfe,	0x708e63ca,	0x294d5d69,	0xa3dce328,
-0xb847b4d2,	0x611c0a2b,	0xcd4513c8,	0xfa1bfa75,
-0x45ca8ca2,	0x3681b381,	0xc27f6c94,	0xcd958d01,
-0x7b55386f,	0xa4b2c59c,	0xaa58ef1f,	0x752c6c71,
-0xdd97125c,	0xdfc2881a,	0xb9d5036e,	0x5148d9ff,
-0x24e6b06d,	0x8390116a,	0xea6d4d44,	0x7378ffef,
-0xd1833cf6,	0x3415528c,	0xcf3622fe,	0x76729d17,
-0xcd1ba4ad,	0x1885ed72,	0xde02375a,	0xa49131ff,
-0x3be6df31,	0x6cf2c534,	0x90aacc16,	0xa2eda106,
-0xa7aaecef,	0x5831a9fd,	0x5f142437,	0xaf30f7fc,
-0xc8f6cdab,	0xda69d12d,	0x5871249f,	0xc011e372,
-0x33c8e75d,	0x8087d9fb,	0xc595c587,	0x9cc36c3e,
-0x676b2c58,	0x4f242c1b,	0x6b77d07c,	0xa1c8543b,
-0x2824e9c7,	0x84be15a4,	0xc0b4a308,	0x0e41511b,
-0xfaf3dbbe,	0xc1777e7b,	0x199d042b,	0xb0b35558,
-0x9bf8cb58,	0xf68d5c43,	0xf359b550,	0x993d82d1,
-0xa8388458,	0x56d3c256,	0x11cbc33f,	0x3c28a56f,
-0xe6aa09f9,	0xd41f6c39,	0x11020cd2,	0x985c89db,
-0x3705b46f,	0xaf90c2dc,	0xf7ecfc96,	0x355eee96,
-0x078e9048,	0x2fd05bf1,	0x48eab9e0,	0xafaab712,
-0xcf0c3e12,	0x8095ae6d,	0x8364131e,	0x7221ba38,
-0xad0e42d6,	0x20741356,	0x8698ad29,	0x024d1baf,
-0xb87c4a77,	0xa4169a47,	0xa487c4c8,	0x966a2b68,
-0x9821bace,	0xe64b1014,	0x22eda535,	0x4cc48e4e,
-0xb1a80833,	0x0e9ec179,	0xf6bb1c55,	0x95489311,
-0xefe8a663,	0xc4cf14f9,	0xe3591c5d,	0x86c3c61b,
-0x9fe18d90,	0x3b75ff1b,	0x5ca3d992,	0x8c072f42,
-0xecf16b8e,	0x672b72c7,	0x4603e497,	0x45e015d4,
-0xd918406b,	0x4f25a635,	0x5feb56b4,	0xf9f94d06,
-0x7bd31a73,	0x1ab03fc0,	0xb85fdbd8,	0x4c3e81d9,
-0xefc2c666,	0x59a7afcd,	0x8a02428a,	0x73af7adb,
-0xd8ea36e0,	0x991a6fd9,	0x7f9c2019,	0x2d3a85d6,
-0x8f3295c0,	0x93809471,	0xa5d313f5,	0x8cd5ea3b,
-0x7b982971,	0x5e4f0172,	0xcedcb6e6,	0xea24e209,
-0x8a46f8b2,	0x74331527,	0xd77ed523,	0xaba69d6a,
-0xebd38b4b,	0x04c01b27,	0xcf51542c,	0x25e75d87,
-0x69f4e24a,	0xeb1c3f81,	0xdd4508da,	0x0cc85856,
-0xd006d573,	0x79a7c5cb,	0x1cc2e951,	0xd1ac0710,
-0xa78fbeba,	0x90877b5f,	0x7972ab18,	0xd866ac15,
-0xc287620f,	0x54fdeb69,	0x9c2d264f,	0x6c2e6ff9,
-0xa12c2962,	0x87f99490,	0x5a9f5f5c,	0x5fd88f09,
-0xf6b7e966,	0x02abc4f2,	0xde5eddd1,	0x6ccd06e7,
-0x7747ee88,	0x9bc9622a,	0xb807d839,	0x1d14fe6b,
-0x1c4676e8,	0xb9add7e1,	0x5a84fc84,	0xa0d232ab,
-0xf09b95a0,	0xbd7481db,	0x9f68639a,	0x4870d114,
-0x60ebc8a5,	0x42d4d24b,	0xf64d2815,	0xaab0da5f,
-0xcba7f41c,	0x44dcd89b,	0x613d50e6,	0x180e700c,
-0x18a6bdad,	0x54883f08,	0xa0a9fc4b,	0x9af3ec0b,
-0xba3f74f2,	0x9469aa23,	0xc89de01e,	0xe7963adb,
-0x8cb13661,	0xdbbd276c,	0x42e113df,	0x4947dfd7,
-0x513cc410,	0x57c6db1c,	0x8911377d,	0x01405fa9,
-0x7163e406,	0x995a0db3,	0x2e9b208b,	0x4c77dfbc,
-0x33f30f4c,	0x5aad99da,	0xcca61b32,	0x027fa2ce,
-0x2b5387aa,	0xafca9d2b,	0x7fbe4c67,	0xee92fc72,
-0xc3857c05,	0x5e425769,	0x4ae6558f,	0x499427f8,
-0x15900b70,	0x3aae1260,	0xa7bfc2a1,	0xdfa73e71,
-0x8b79b206,	0x6552c432,	0x56b81866,	0x86d6e834,
-0x91685add,	0x7c34051c,	0x4ef8db74,	0xbab855ee,
-0x083ab156,	0xc82a579d,	0xec1e3ae3,	0xdfea24a6,
-0x9554ee6e,	0xd53b8bd1,	0x9a4bda63,	0x884e86e5,
-0x9acf4763,	0x540b9ded,	0x5fde4bca,	0x541d2dd4,
-0xc5637486,	0x5fdfc527,	0x6cc50628,	0xc701a605,
-0x7fba696e,	0x053a6cd0,	0x3796571c,	0xd11ec6f6,
-0x2a653ec1,	0x69a1ade5,	0x16171236,	0x3aa406c1,
-0x506e343a,	0x3a0e8bf4,	0x5aa895d9,	0x0c775b47,
-0x4e28dec5,	0x1bda09ce,	0x1c9e840d,	0x6dce833a,
-0x22465428,	0xd371150f,	0x8567e8cb,	0xca82a9f1,
-0xbb870830,	0xb97bd7c3,	0x9d47f4da,	0x320a7f4a,
-0x615904da,	0x5a1afaef,	0x8db2a274,	0x25c6cc0b,
-0x77b25e1b,	0xc9b16b2a,	0x85f83b19,	0xe0ded88d,
-0x5c5fe541,	0x4701f3ef,	0x951546d9,	0x27ad1bee,
-0xfca8fb12,	0x82d4b9ed,	0xa2213f6d,	0x7d9d78f5,
-0x427f9be7,	0xbadb7c7a,	0x4d96ad1f,	0x38ab11db,
-0x39afac6a,	0x1d1f122b,	0x8809f762,	0xe4d45952,
-0x47d8e7f5,	0x454c13cb,	0x3f786535,	0x379cc67c,
-0xec8ee189,	0x1be38d4a,	0x6bd926d6,	0xf0d25114,
-0x1167e82d,	0xa54c9af1,	0xad7ba68c,	0x6f59b719,
-0x801e27bd,	0xf038f9b7,	0x3a0ab320,	0xeeb2465f,
-0xb3a99e7e,	0x6c2fc613,	0xb341b38c,	0xe7e64850,
-0xa91b0475,	0xcd46e686,	0xe8915130,	0x3d7a326f,
-0x3e9b9c26,	0x581d98c3,	0x84e6b5c3,	0x90b1d2fd,
-/*  309-MU163437.inc  */
-0x00000001,	0x00000037,	0x09231998,	0x00000634,
-0x02c55597,	0x00000001,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xb9725de0,	0x6311cc57,	0xc0c08f3a,	0x0f9579b6,
-0x91b9a5fd,	0xe7a0d5d6,	0x44afb34b,	0x88402bd9,
-0xfd14eeb1,	0x689409f6,	0xe61da9dc,	0xbd52db17,
-0x741fd636,	0xe7148292,	0xf0f6d187,	0x68553ad8,
-0xd94fec1c,	0x8a4744d6,	0x6485ed16,	0xb5577cb3,
-0xdc642e23,	0x40a00b58,	0x90182b9c,	0xedb37e03,
-0x32f4e0d1,	0xa53ad183,	0xf8d5f840,	0x354ab66d,
-0xc7923da7,	0xe97a69f6,	0x231fcbde,	0xb5979fca,
-0x90e57d0d,	0x6ff9cc93,	0x838a19e4,	0x9c96d833,
-0x440a03ad,	0xb8e2b5a3,	0xe475de70,	0x3dca60b4,
-0x93b8a77b,	0xede1a465,	0x4b5d64e7,	0xd1ed9008,
-0x872de386,	0x707baea9,	0x8f1618a8,	0xb844e46f,
-0x7bff46c7,	0xb9d7ee49,	0xc1bd24ac,	0x2e88a8ef,
-0xa8d79f00,	0xe8895a77,	0x38436327,	0xb0fa076e,
-0xafc4af33,	0x1c40e574,	0xcadd42c0,	0xf6b620c4,
-0x3c1eeb06,	0xbb228015,	0xdbc6c9fd,	0x3054c2d1,
-0xa1007ade,	0xe5999e2b,	0x1574da4f,	0x9ddd9233,
-0x8cb964b1,	0x07fa6cdd,	0xc87b8f03,	0x8a78b160,
-0x510b1db0,	0xd0062833,	0xf22d87cd,	0x00387de1,
-0xd0bea504,	0xe76bbe3e,	0x63516873,	0xf303a522,
-0x84fcc4b9,	0x63715883,	0x8a47d1e8,	0x85b5bd6c,
-0x0d2c8b4a,	0xe178a673,	0xeeac92ef,	0x23862fa9,
-0xe45e93de,	0xd5a22c96,	0x7ac26e43,	0xb69621a5,
-0xfc2d746a,	0x1b67a2d2,	0xa0d1acf4,	0xfb7dc534,
-0x69ea7ef8,	0xe0b452cf,	0xda397364,	0x05992d50,
-0xd84d1762,	0xbd2837ee,	0x2b4396c1,	0x86323aad,
-0xf2adc36b,	0x4abd4872,	0xe11f0d66,	0xebbf9666,
-0x6392b987,	0x9ad21e5a,	0xc5f7617a,	0x6d65a8d7,
-0x9407e87e,	0xcca7da78,	0x73e6bedf,	0xf497f577,
-0xcdb872e7,	0x7ec37786,	0x8ce79cc8,	0xb72e2d97,
-0x01f4898b,	0xb6f168e2,	0xa57f145b,	0x16cf215c,
-0x836d7958,	0xcea95f34,	0x02f723ff,	0xb673ff4d,
-0x9232c461,	0x160eef3e,	0x8ddbdb79,	0xa23d3e40,
-0x005fca75,	0xa64a04a4,	0xcf639c0f,	0x25a6fa5a,
-0x9c7b4656,	0xdad1c90f,	0x0941974a,	0xfe7e4a6e,
-0x92a2f906,	0x32953b90,	0xd79b4025,	0xa24837aa,
-0x7d1abad8,	0xd518ddd9,	0xaa87cd14,	0x4192f1c3,
-0xe537f5c7,	0xc9686588,	0x0166144c,	0xece72901,
-0x82646372,	0x1fdd3b34,	0xde9ed104,	0x907bc18e,
-0x046d1fb9,	0x9f0229b8,	0xb8830517,	0x3b9b8255,
-0xbdca285a,	0xce3d6258,	0x306c11b9,	0xe291c557,
-0xb5ad6e96,	0x2c26d197,	0xbf3d19a4,	0x828c6e43,
-0x124679da,	0xb94feed5,	0x0028dfd2,	0x40a7b67b,
-0x4e35e50e,	0x6c8f4415,	0x8ee725b0,	0x4941bff5,
-0x973f67bf,	0xd1b60674,	0x4fe0175a,	0x31e4430b,
-0xe007cb2c,	0xc87147fb,	0x22412543,	0x8219eb26,
-0xab2bee20,	0x3bd82f1b,	0xf6eca253,	0xf8c99394,
-0x3b1ac6cf,	0xd23cd4f3,	0x84f807db,	0x399efee6,
-0xe3d29459,	0xd09bdf45,	0x66f0fba7,	0xc7d955de,
-0xc980cf99,	0x3e6da774,	0x8805856f,	0x48b16b36,
-0x71241b9c,	0xf76eb493,	0xe04e8a5e,	0xfe44ab34,
-0x11076cc0,	0x5b1bd217,	0x8f7a6572,	0x9e1f7de0,
-0x23be7914,	0xb7fc8fc1,	0xee21eb58,	0xee55fbe7,
-0x9935288e,	0x0b42af7f,	0xc87b01b2,	0xaed052e8,
-0x6950ecc1,	0xd2d38b75,	0x1b0a9b47,	0xab934dc7,
-0x4edab76f,	0xdf67944e,	0x491037d3,	0x26a4d2fa,
-0x60ffedae,	0x2fe107e3,	0x104ea8c3,	0xb506e130,
-0x06102a1d,	0x96a7c9a1,	0xa23fd47e,	0x406eb0a9,
-0xdb151849,	0x9afb562f,	0x7d22ab67,	0xbeae4ace,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  536-MU16810f.inc  */
-0x00000001,	0x0000000f,	0x09211999,	0x00000681,
-0x73f2cca2,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x78021ec2,	0x1b1b6d8b,	0x6bb53ed4,	0xd36c5ad1,
-0xbf6f3c59,	0x4c97e2fb,	0xadbe12d3,	0xa6998d5d,
-0x327a1a64,	0x84a0f599,	0xb75eee4e,	0x2da4f396,
-0xbceafc7a,	0xce54ed0c,	0x6f4276cf,	0xec5393e7,
-0x8235b282,	0x5c60204d,	0xf44af88f,	0xab0e81d5,
-0x5c6631de,	0xd60e5d01,	0xb9a1a5b1,	0x672f570b,
-0xfe8d296d,	0xbe304563,	0x6a4ef0a3,	0xc6b22b69,
-0x92a1406c,	0x66562aea,	0x9ac8a28e,	0x95c31acf,
-0x3dfaaeb2,	0x949f1129,	0x8bd271ad,	0x1ecb6dd9,
-0xad22be72,	0x8308f8db,	0x3d3d5ab2,	0x97c412c6,
-0xd83161cb,	0x2edd3832,	0xe3a6a21b,	0xc888a0c6,
-0x16dfbcd3,	0xfcadc2fe,	0xd85d71ec,	0x358bce2c,
-0xe87d2d81,	0xf10dfb9e,	0x296c32cd,	0xfbb12b01,
-0xb521c0dc,	0x0135a8e2,	0xc014d67e,	0x82301d9d,
-0x7a506b07,	0xd627731f,	0x938e12ea,	0x60fb36ad,
-0xc2121315,	0xb3a40ef2,	0x501a4463,	0xca53a7e2,
-0x8905d202,	0x56f04dde,	0xdf6d6db2,	0x99668508,
-0x73fcc401,	0xebb098d0,	0x8ab8cf4c,	0x65495bd0,
-0xc5dc6126,	0xbfa3738f,	0x40e269b5,	0xe7c065b0,
-0xafa8f722,	0x610005e5,	0xe1efd3ea,	0x9f52c4a6,
-0x6fe5e4c4,	0xca7b2d93,	0x9a487d3d,	0x7150e2a9,
-0xd597acc8,	0xb0892a96,	0x556a0e0b,	0xc75a6dda,
-0xb1cce67d,	0x70576a5e,	0xd5d9f4cb,	0xa323dc2a,
-0x7984f913,	0xd44fbda1,	0xb6eb13bf,	0x5282b867,
-0xf7b50028,	0x8ab18c60,	0x706c63a3,	0xfdc16223,
-0xa0de6a16,	0x5be19bd6,	0xec5dfbf2,	0xa49b0124,
-0x6bf7b85e,	0xd9a2bf9c,	0xb92a235e,	0x4531115d,
-0xf449984a,	0x8ada6365,	0x454ff6ce,	0xcda5e072,
-0x966da5e9,	0x4e0ffc35,	0xef46600b,	0x9cb0d898,
-0x59652b89,	0xdb79de7b,	0x92ff99ad,	0x6aee17f4,
-0xd8f79930,	0x89b5c1fa,	0x66223270,	0xcd70ceb8,
-0x9239e6ff,	0x768f9775,	0xd301ef77,	0x9be7283d,
-0x4133ce34,	0xf64ea6a6,	0xb813aeec,	0x7356bce2,
-0xe0eba825,	0x93ba38e3,	0x4853cd1f,	0xf22774ac,
-0x8c5896e0,	0x59fb292a,	0xf3af2c19,	0xa8a3d0d6,
-0x43d676fe,	0xe1f30726,	0x9da64a3b,	0x4bd03774,
-0xf544baa7,	0xb2400406,	0x7391da22,	0xc15eb93e,
-0xa0994a39,	0x444ca24a,	0xfe8762c6,	0x90b5f5b2,
-0x5ecc0a28,	0xe81b735c,	0xba6bfdc2,	0x5165cfb1,
-0xce117215,	0xa1a3c7c3,	0x47284431,	0xc0db0ba1,
-0xb5d29293,	0x5c92a346,	0xee7f3017,	0x84299ee1,
-0x5315374a,	0xd9a9320d,	0x95e25cac,	0x53fbd980,
-0xfc075892,	0x9d160ae3,	0xfa59aa1c,	0x68a14dd3,
-0xdb68489d,	0x28b10918,	0xfc4c5c55,	0xca7ccc8d,
-0x29343574,	0xf72e46d2,	0xc4bd67fb,	0x9c860395,
-0xc615810e,	0x7ab9b008,	0xb557ceba,	0x7f40312d,
-0x7514ff0f,	0x0ccde8c3,	0x40c2f374,	0xf591f29d,
-0x39703a56,	0xd65b3aef,	0xc9d0ef94,	0x14e6df58,
-0xda4fa9f6,	0xe2a84104,	0x2c0056b5,	0x46dd13f6,
-0xeb5e2c1a,	0x65247396,	0x57daa392,	0xd2bf33ed,
-0x573252ef,	0x6ef7ce92,	0xc7567e90,	0x316102be,
-0x45d869e2,	0xaa59ec71,	0x1b8d9393,	0xd8e818ca,
-0x8fdb774e,	0x947f5af4,	0x5e52c4b1,	0xa3fb36d5,
-0x1742fa22,	0xb8e27fbc,	0xa3791a5f,	0xe38e05a6,
-0x9fb62dd5,	0x720310b5,	0xf473e100,	0x146348e0,
-0x589ca309,	0x6e64c75a,	0x3a956b4b,	0xa80c0dca,
-0x6d16fff0,	0xfab7a74c,	0x8ac8a2a8,	0x7e4b5bea,
-0xfcb2ff29,	0xa007c2a7,	0x42cb7df9,	0x2af79938,
-0x9c80c69b,	0xa66945ae,	0xe7efde80,	0xe6061c57,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  530-mu16730e.inc  */
-0x00000001,	0x0000000e,	0x09101999,	0x00000673,
-0xf64116d1,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xd008ea9a,	0x90d1fc1b,	0x08e139ca,	0x3f54f83b,
-0x6985ceca,	0xa832ab46,	0x5f54c319,	0x2a2aad6a,
-0x82af41e6,	0xb946820b,	0x273d0f0b,	0x5f2b4860,
-0x22fb8bf0,	0x09d64919,	0xe5ef5108,	0xd5be0718,
-0xc20c175c,	0x90849d77,	0x9cb5ae2c,	0x7e8a04cc,
-0x3f83be6e,	0x27f7342a,	0x54a541ac,	0x48c251fe,
-0x4e7d2cbb,	0x7cb0e179,	0x3dac5cef,	0x2f17cff1,
-0x8b9b17fb,	0x8eaa9a4f,	0x1671f162,	0xf4057322,
-0xf1dc3423,	0x5f627c7b,	0xc7f41536,	0x0471b71f,
-0x2a2662ce,	0x7627fa85,	0x30092087,	0xd6e23bab,
-0x18135f41,	0xa5a5b59b,	0xcd9a0ae0,	0xed38fda2,
-0xa7344d65,	0x89e51ba1,	0x178878f5,	0x752e82e4,
-0xa7a46885,	0xc95e6a43,	0xe6a18eaf,	0x586db392,
-0x79eb538d,	0x7ab046a8,	0xd8878ada,	0x49863242,
-0x59563f59,	0xd3530ce5,	0x62001d03,	0xeab34c28,
-0xe44590d4,	0x3bad8f1a,	0x5e0c9e1a,	0xb9c67b05,
-0x4b28ac69,	0x75070de2,	0x2f2da3fe,	0xc91e536b,
-0xe66ecbfd,	0x8d482c4c,	0x5c6d055f,	0xb538d7b8,
-0x0b9fb684,	0x30491bec,	0x08f9324f,	0xef9591c5,
-0x96922bd1,	0xb43524cb,	0x5de2d5ee,	0xecff2573,
-0xc4a14e45,	0x762b7aea,	0xabff7517,	0x25513c1c,
-0xd41ff45c,	0x97cb1887,	0x1ffee480,	0x2cbccbfd,
-0x27691474,	0xf8f07595,	0x0c724a47,	0x85550ea5,
-0x4963f521,	0x1758187d,	0x829f6ea2,	0xf0db59fb,
-0x9ce0a900,	0x714a0191,	0xc2899de0,	0x8fde5bd6,
-0x05279f03,	0x04e7d5a0,	0x19bda9aa,	0x3b530e2e,
-0x65b312c8,	0x78063dfe,	0xd0092057,	0xe9a483d3,
-0xd5eb2248,	0xc6a17a9d,	0x2c2a8112,	0x37405433,
-0x43931206,	0x6961f1cb,	0x300b0904,	0x0ddc1480,
-0xc7e0da70,	0x9ecefed6,	0x076150f7,	0x20e0194c,
-0x408a2585,	0x63999df8,	0x072378e3,	0xc8e5b1c5,
-0x06f80c0c,	0xe539a928,	0x103df509,	0x005ceda1,
-0x55193245,	0x49fc8e90,	0xfaa5be5f,	0xec2cef0c,
-0x29b21e2a,	0x81cc923e,	0x21bc19cd,	0x1edfb15e,
-0xd3fe97c1,	0x907f6e4b,	0x40a2e3be,	0x8edf9a0b,
-0xd87da422,	0xa4d6a135,	0x860a49be,	0x9d1fb3fc,
-0xe0b05e9f,	0xfb6bc8b7,	0x2cdcb076,	0x70b1cb29,
-0x6057aafe,	0x3aed90c0,	0x7aa970bf,	0x9bedf020,
-0x1d141253,	0x5de04fa1,	0x6fe5e080,	0x5ee5f311,
-0xfbc3177b,	0xcce67a85,	0xb96578ce,	0xc907c8da,
-0x8a771092,	0xffc45b16,	0xcaee0517,	0x063d07a4,
-0x7d1cd75d,	0x23c993fe,	0x1780edee,	0x7eadf2e1,
-0x085bd3ae,	0xf6da6cec,	0x288cab1a,	0xc17d3e73,
-0x41d7a752,	0x0cd66538,	0xa03db177,	0xf7f832ca,
-0x670eab04,	0x3116aecd,	0x7f8f7f84,	0x87d034d5,
-0x04033827,	0xcb63dc4e,	0xbc599cb9,	0xecf6ea45,
-0x0f65ac32,	0xafa30136,	0x8133e580,	0xac6a49f8,
-0x1d9aa390,	0x78439835,	0xb6bfe265,	0x7c47f347,
-0x2393146d,	0x40216fb5,	0xd2aaa6b0,	0xbe1274aa,
-0xbff433fe,	0xeecc4826,	0x01e245b6,	0xf766dabe,
-0x22debab9,	0xde5d70b8,	0x7fe3041f,	0x8605c41a,
-0x1d6b1a13,	0xffd9efd6,	0x37df74bc,	0xbe7045e5,
-0x751e4b1f,	0xff7b6bec,	0x4bf15bbd,	0x9eb49f9a,
-0xb17acad0,	0x40811eb5,	0x10e148e0,	0x3b8a4981,
-0x97115eb0,	0x7c2c62b8,	0xfc8258da,	0xa761cee2,
-0x25faab65,	0xf4b26c2f,	0x071c2e0f,	0xec732edc,
-0x9877857b,	0x18419321,	0x609948cb,	0xf8729755,
-0x1afc2813,	0x6e255d8e,	0x78892422,	0x085d177c,
-0xbff60f4a,	0xbb1729f1,	0x3b08f81f,	0x02e8a9c7,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  240-MU163202.inc  */
-0x00000001,	0x00000002,	0x06101998,	0x00001632,
-0x6aae5598,	0x00000001,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x5086687e,	0x183fe71b,	0xc2cef2c2,	0x35812eda,
-0x9daec1bc,	0xc8c7e9c0,	0x13b2bf9f,	0x09d2aabc,
-0x56565a53,	0x051b7f55,	0x8989821c,	0xae9e02bb,
-0x3503ffd3,	0x74b8cd0c,	0x12f922ca,	0x7d8a5113,
-0x8ffed0d3,	0x200264f0,	0xe6687b81,	0x9f5fcc5a,
-0x5e2ea862,	0x20728629,	0xd3d6e566,	0xe1d31f12,
-0x0383dcf9,	0xf7c86872,	0x47bf87e7,	0x9a2f162b,
-0xf2ea80c1,	0xf9e6be4a,	0x9f292114,	0xe765ea9e,
-0x89f6b013,	0x8e11d077,	0xab12527c,	0xdc58898a,
-0x77e6861c,	0xe6bc8da9,	0x9786f39d,	0xeae9b1e9,
-0xdc5b6348,	0xf5f10ccf,	0x5c878a54,	0x739e873f,
-0x103078b7,	0x4f192063,	0x2e2479e0,	0x77b726b6,
-0x461a8fa7,	0x28ece47c,	0x4c8e3752,	0xa52b7632,
-0x57f238de,	0xc4076eb2,	0x4cfed721,	0x446325aa,
-0x1c4a3bdc,	0x7c55c9dc,	0xe607cab6,	0x4ca18774,
-0x4d473db9,	0x935ba067,	0x8f9688dd,	0xc8e9c959,
-0x82e13cb4,	0x6c8def39,	0x2ec2326c,	0xcf86973a,
-0xfb9176f8,	0x028c8607,	0x80ba26f8,	0x0bf14a7e,
-0xbbde7e3e,	0x1da9453c,	0x41453d74,	0xda576c83,
-0xe47214d0,	0x1287d537,	0x65278ea8,	0x91cec3ad,
-0x2526c847,	0x071cf3a7,	0xf0483b3d,	0x8c1ce5bb,
-0x6655cfb4,	0xbbfe3e76,	0xe19a6999,	0x2c2b9990,
-0x7b85dc5c,	0x2a5ffde1,	0x5cc9761e,	0x2fbe2be3,
-0x15fcc7d8,	0x4054c02f,	0x4cef63f4,	0x055be9a1,
-0x01814164,	0x814f1a22,	0xc2ba59f7,	0xe0a5da65,
-0x1413e4d6,	0xbdbec99b,	0x929751d3,	0xad078350,
-0x764a1033,	0xc7296867,	0x02db88e4,	0x23f326b6,
-0x298eee24,	0x4a2d93df,	0x461bbdbe,	0x7496dc93,
-0xea0b385b,	0x085f9754,	0x837f9a48,	0xb2a2c8bc,
-0x5e9d4535,	0xdf130ddb,	0x56090512,	0x1ce18bbc,
-0xe09c38e5,	0x1ef76900,	0x837458d4,	0x2454d6b8,
-0xe2e1f9a3,	0x96db5d54,	0x5d22eb54,	0xe0e5b026,
-0x9bf9a05f,	0x780f0192,	0xb30ad5c6,	0x2a9c6e7a,
-0x5a3748b8,	0xe2b4cd09,	0xd8ab9dba,	0x18d24d71,
-0xb1852d2a,	0x0d23e380,	0x405e1144,	0x7f6df64d,
-0x7bc57e7c,	0x2343affc,	0x50e9c07c,	0x48cd5abc,
-0xf16e92ed,	0xfbb3c2c1,	0x2d2ef623,	0x4f09fa01,
-0x6fe58d54,	0xbce01e8a,	0xcdfbf33a,	0x92105d9c,
-0x1a3ca378,	0xbbac1aa1,	0xea832aa3,	0x15da2b56,
-0x7aa01fad,	0x358d0fd1,	0x11b4f750,	0xfc2707e6,
-0x2725a273,	0x312d9bca,	0xfe87333d,	0xec0bb542,
-0xbf4224cb,	0xd1eb9564,	0x0d65d477,	0xddfd1783,
-0x8ccc9b3f,	0x4e8c20c1,	0x5c8960d4,	0x2dddbb65,
-0x7a7089d3,	0x90ca6eda,	0x96b46eb9,	0xb5af69f8,
-0x2d4f6699,	0xf2244819,	0x9ae48370,	0x4b24b76f,
-0x199e29ad,	0x744eda36,	0x9347f3b0,	0x39188477,
-0x90f9c71e,	0x40617767,	0x5c331047,	0xe19896fc,
-0x6788bae4,	0xa2df7b78,	0x4a6d1887,	0x6a73a662,
-0x6798c344,	0xd02bec78,	0x240c0dea,	0xab4bb468,
-0x2654f504,	0xe93a9817,	0xc9ab8765,	0x12a60586,
-0x69694bbd,	0x9f09e92e,	0xe66445ed,	0x044e028b,
-0xa6256764,	0x1c663bf6,	0x0e7d4235,	0xaa1b5a60,
-0x662909e1,	0x1725160e,	0x8056f057,	0x9922d580,
-0xec768eb6,	0x0c7a1ceb,	0xaf111dbc,	0x22559bd8,
-0x4d7487aa,	0xa5021cd2,	0x86692aa1,	0x3c1804e7,
-0x2e4a4d85,	0xfc7d0089,	0x728f8bc8,	0xdf9b4e44,
-0xad46b9f2,	0xe97af88c,	0x52e49bc6,	0x2e8c0af9,
-0x1aa59dad,	0xe92bfea1,	0xe4dbaa3c,	0x9e2a15a0,
-0x98e52da3,	0x79ac126e,	0x8f8a61f4,	0x76da41f9,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1105-m08f2420.inc  */
-0x00000001,	0x00000020,	0x06052003,	0x00000f24,
-0x828598c7,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x5715f121,	0x440ce2fa,	0xd5d090eb,
-0x70b3e977,	0x92320e8c,	0x4f989906,	0x36907442,
-0xcc4b12e2,	0xb456a6ae,	0x0ad5bcf7,	0xe9f0a425,
-0x70b932d2,	0xe66202c9,	0x350f884b,	0xd560a828,
-0x5c4c5cb4,	0x7b142329,	0xd9e25719,	0x98b1dbb0,
-0xb11af93f,	0xe83b07eb,	0x9b6d35a1,	0x0df761c2,
-0x1a5e6da5,	0x3c978798,	0x08a7acd8,	0xd20a3b15,
-0x0aaeef40,	0xa4ed3a47,	0xb8d15785,	0x2ac39380,
-0x153a5ad7,	0xeddc8222,	0xc02510f4,	0xc7cdc21c,
-0x09adfdce,	0xf4dc290a,	0xc6e2f5bc,	0x8e60359b,
-0xf097f2fd,	0x24ac2ac0,	0x770ecf17,	0x9f80b3f0,
-0xf250a757,	0xad071b7e,	0x51d432ef,	0x3c095fc8,
-0x3574394a,	0x23e0e092,	0x8c9e2505,	0x927dc9fb,
-0x3bfcface,	0xb93be3de,	0x46c03521,	0x00192a46,
-0xc6a53c55,	0xfcdbb872,	0xb56349f6,	0xf0bf598e,
-0xe86afccc,	0xef930d0a,	0x905ada75,	0x9508c261,
-0x8a8cb340,	0x5010a4fa,	0x92437678,	0xa7799056,
-0xedd0ea8d,	0x3c25bdc8,	0x914f3f08,	0x27ff4d02,
-0xd104ca12,	0x972d1570,	0xadb4a6f9,	0x34f31516,
-0xb0aca99e,	0xd05b7382,	0x5fcaeecd,	0x83edf7c4,
-0x1b15099f,	0x14146a3c,	0x6150ae4a,	0xd8715907,
-0x6d405215,	0x307ebd9a,	0x248fcdf4,	0x1650a34e,
-0xa8070739,	0x5fde05cc,	0x1a9433c3,	0x3f5770d9,
-0xcedfa47f,	0x1f3c7660,	0xa3bdf9f6,	0x3a2d9d3b,
-0x01833189,	0xfebaa041,	0xbc4bf2c8,	0x50c5f238,
-0xb132e653,	0xd301e92a,	0x2b094386,	0xfdb557b3,
-0xd4ed60d6,	0x75da1146,	0xfedf34fe,	0xa21665bb,
-0xd6b6d496,	0x46d9c114,	0x20f26f66,	0x5ee354c2,
-0x801aba92,	0x0973251a,	0x63748328,	0x01b293f4,
-0x1a13ec73,	0xf17ea3dc,	0xcaf6a499,	0x1cd356e3,
-0xa6b450be,	0x6200d2b7,	0xc4b88872,	0xf6aa6f70,
-0xdbc917f9,	0x1cf3d760,	0x5d60d15b,	0x48c2407e,
-0x9210b35a,	0x171df657,	0xfb14733d,	0x1c837746,
-0x6df3dd50,	0xc096efa2,	0xa9202472,	0x56917067,
-0x40620e92,	0xd739c7d4,	0x89cce286,	0x8882ee44,
-0x2362cb14,	0x3e03d986,	0x6519adee,	0xd7aec296,
-0x23a91210,	0x77229af4,	0x97fd4c79,	0x422707b5,
-0xbea05034,	0x2ef3b3a4,	0xe3291146,	0x40a0cc32,
-0x96b557c6,	0x5aa836bf,	0x9dff3965,	0x31e80540,
-0xa0556e13,	0xc08b88ca,	0x3f3e1144,	0x4f093862,
-0x96bc622c,	0x497ec377,	0x992d7899,	0xf881becb,
-0xc65d3299,	0x827a9be4,	0x78b851b6,	0x8314b5d1,
-0xeda31b10,	0x471764db,	0x905d2df0,	0x19e376c0,
-0xcf6af8a5,	0x4355d3d3,	0xb2033a88,	0x00f2c0d6,
-0x537a95be,	0x6938a3c7,	0x8d85a10e,	0x19f996f8,
-0xe5334524,	0xec2cc18b,	0xc540afec,	0x14206bbe,
-0x89601729,	0xf21d5916,	0x11c39ad0,	0x93a73d2f,
-0xbd8a681e,	0x3d62394c,	0xe43d9c1a,	0xb1b85b09,
-0x48e87b21,	0x3dc66cb4,	0xad066e73,	0x745fb4b0,
-0x47f5cdd2,	0x28e9dc7c,	0x94515ceb,	0x3a94e085,
-0x0fcdb0e4,	0x55cdbb93,	0x38d990f1,	0xa8f13bff,
-0x497471f6,	0x4e74b9f0,	0x6212615b,	0xec6ed687,
-0xc984443e,	0xd3852197,	0x35ee920a,	0x690a7b44,
-0x4c2ad071,	0x8b9e3890,	0x4114aba9,	0xea796a19,
-0x0d968acc,	0x97709071,	0x20274074,	0xcecfce72,
-0xbfdde5ee,	0x4d694e1e,	0x800d6bfa,	0x969027a0,
-0x9417fe60,	0x9cadfc0e,	0x6a103bda,	0x375fc4e8,
-0xf309280c,	0x945f197b,	0x5cb77b5d,	0xdf5d5708,
-0xced4272d,	0x6b04b696,	0x78e44dc2,	0x8c41f9d4,
-0x92650f39,	0xae3d250a,	0x07c91401,	0x1ca1360b,
-0x2078a46e,	0x7e0b1a9d,	0x5a667dd3,	0xefdd072c,
-0xeee2f749,	0xc1115ebd,	0x743c2890,	0x525d7fa8,
-0x4d86d130,	0xc4470f2f,	0xcbd9dc73,	0x88230f84,
-0x7476f692,	0xbcdeb696,	0x981f3fd4,	0xba7f6c3a,
-0xe073e123,	0x1dfb3790,	0x6ab7fc48,	0xc519cc6e,
-0x5383ddda,	0x964da863,	0x1d041e19,	0x5f2288d4,
-0x5ff7c34d,	0x73a197c1,	0xd086d7c9,	0xb0314861,
-0xbc63a785,	0xe072a384,	0xf37e9d90,	0x63a7a4ac,
-0xa33622ab,	0x802471f9,	0x0841f065,	0xff4ea8fd,
-0x343caaaa,	0xcb8594f5,	0xf5756925,	0xcc946e7e,
-0x9043d824,	0x49812185,	0x1f555515,	0xb62ffebf,
-0xa27e379d,	0xa2386704,	0xaf19ccbd,	0x644130f0,
-0x29abc386,	0x7d044e0f,	0x5274c8e1,	0xc8298400,
-0xc08a2e85,	0x8f13dec2,	0x79f40342,	0x10ed42a2,
-0x75541795,	0x9c9608c5,	0x11798ba6,	0x9a7e40ff,
-0x4e44f869,	0xb0e0ac45,	0x9865be8d,	0xc361cdf1,
-0x88cf2cf2,	0x5cb47192,	0xceaeb1a6,	0xd6c4b77e,
-0x567e8aae,	0xd0eaf865,	0x30a9e8f4,	0x049e1005,
-0x96c4842e,	0x4d97f912,	0x2837581a,	0x8dd154c0,
-0xe88f85e3,	0xd5b8c4bd,	0xf6ae181c,	0x524a4d74,
-0x17e15bed,	0xa200218f,	0x241d1c1b,	0x9efc70a7,
-0x9e1adbae,	0xf115df9e,	0xda54c448,	0x8fe3ebc3,
-0x0b312745,	0x4f0075d9,	0xc2867e55,	0xa19131db,
-0xc244a076,	0xbfd954bc,	0x65a49f64,	0x3e99ece9,
-0x80940945,	0x626f0b5f,	0x683bb192,	0x9fbb14c6,
-0xe4136229,	0xd76f54e7,	0xd8b2b363,	0x049f372e,
-0x5f391828,	0xbf27f2b8,	0xc9ba89f6,	0x83047de6,
-0x6b9816c7,	0xa37232c5,	0xe86bda74,	0x8c426e07,
-0xfca755b4,	0x5d7f53d6,	0x6a123e2e,	0xbef86cef,
-0x0ff79e5c,	0xc160e69f,	0x3d9332ee,	0x14b3246c,
-0xb1ee9faa,	0x72827d5c,	0x825683a2,	0xbf3143f4,
-0x501cad6c,	0xbb872e29,	0x086f7851,	0x392df63f,
-0x0013ae33,	0xd643c1ff,	0x5dc4b349,	0xcdf75234,
-0x206f8869,	0x9cc8c8b2,	0x872c6d84,	0xc518e0a6,
-0x2bdbed94,	0x2cea60cd,	0xd4542cd2,	0xbf5f7c4a,
-0x03fd6694,	0x857030b4,	0x932ce1f7,	0x1b24d617,
-0x8342fbb9,	0x2484a61e,	0xa76945b6,	0x39c08823,
-0xcc4e48b9,	0x31b73d47,	0xe2699dfb,	0x3f43284f,
-0xce602dfb,	0x0b50541c,	0x5ecb56d1,	0xefc75a88,
-0xdba5beb3,	0xe0e80051,	0x11360a93,	0x27cc6d6a,
-0x884a2e79,	0x4c5c9256,	0xe2c4c758,	0xf2422d67,
-0x2736306d,	0x60f34846,	0xf41738eb,	0x9286cbe5,
-0x27f5c292,	0x410fae37,	0x980f0a33,	0x2522d4db,
-0x5c5b5beb,	0xdbd795c2,	0x2fcf3eb9,	0xf13709fc,
-0xc76339cc,	0xfef3cf76,	0x152585dc,	0xc321c271,
-0x2731085e,	0x676bce0a,	0x93299b87,	0x76e24635,
-0x2dad2f9f,	0x4ee82851,	0x45f18669,	0x85a46c9c,
-0x430f4c5e,	0xa95cbcc9,	0x42f64729,	0x532ec8ec,
-0x25bd2204,	0xc9c7a3fe,	0x211fa366,	0xf26d8e5c,
-0x9fa1c330,	0x5544d6f7,	0xdb8ee6c8,	0x9ea78f2d,
-0xb9d20793,	0x7e21097d,	0x9a1b224a,	0x5c04b9eb,
-0x33644b1a,	0xc87dbf35,	0xcfd8587f,	0xf14aac0e,
-0x4e3241bc,	0x07f0d75b,	0x7eb18848,	0xf369e75e,
-0x236de9b9,	0xee3eacf7,	0x1de6b3b2,	0x5b00c435,
-0x550394d6,	0xb93456ce,	0xf888d226,	0x787c955b,
-0x318dd4d6,	0xa167b3bc,	0x550dccb4,	0x95e7b95e,
-0x3a5c8801,	0x707226ff,	0x05fd98b6,	0xfabcac46,
-0x28e3aa66,	0xb336a36b,	0x77e82e0b,	0xf8756e97,
-0x84c7df37,	0xd840bc47,	0x33606de4,	0x4bdc8365,
-0x22302646,	0xcc36c496,	0x7dccdd49,	0x5ec61feb,
-0x573d0210,	0x0ff3deb6,	0x92cc42ca,	0x63660a1c,
-0x9ab6f544,	0x3436edd8,	0x3d9f21c0,	0x62aed963,
-0x4293df8a,	0x51db6516,	0x0ee30026,	0xfc0a9525,
-0x10f7988a,	0x161882c2,	0x0b3f4670,	0xbe6722db,
-0x009a440a,	0xd0141edf,	0xfc45c36e,	0xac58ab1c,
-/*  566-mu26a003.inc  */
-0x00000001,	0x00000003,	0x01102000,	0x000006a0,
-0xdff45617,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3178fc44,	0xfd2d6c5b,	0x28009450,	0x947b9751,
-0xd6a28dec,	0x5e09fb62,	0xf044b3ff,	0x843a9280,
-0x6aade48d,	0x801ae197,	0xf259ccd2,	0x771a35d1,
-0xabb20a93,	0xc7f266a6,	0x31cffc14,	0xffdf0618,
-0xbfb77be4,	0x26fd9509,	0x9ae8c81b,	0xc2635165,
-0x7ac26cc4,	0x976b8074,	0xd8d4a3a3,	0x6d4664f9,
-0xe66a36b4,	0x9741da01,	0x356eb9a9,	0xf6742e78,
-0xa88cf726,	0x74bb245e,	0x8baaf4bc,	0xf6fc71a0,
-0x5b3bb726,	0xcf9f8902,	0xb89da8f4,	0x65b345a0,
-0x938c67a6,	0xe4aae8d1,	0x7d69421f,	0xc01dd8d0,
-0x88ec622a,	0x0beca3b7,	0x9daed2d4,	0xc0609133,
-0x26706b8a,	0xb4408beb,	0xe0dceb6f,	0x2c352416,
-0xdc35aea6,	0xd69cd883,	0x0ca7500c,	0x83914075,
-0xc82b76d3,	0x155990a5,	0xff91c631,	0xd5bbbfc8,
-0x2b80f306,	0xd7b89878,	0xf2501891,	0x2a98f0d3,
-0xa86be9e0,	0xe58aab32,	0x364ffe79,	0x873fe5d0,
-0x972b765c,	0x33605773,	0xe507a817,	0x9cc1b237,
-0x730c85bc,	0x9ea45b18,	0xd2d2ba23,	0x4aa64ebb,
-0xc3c02974,	0xe2c678d3,	0x5fddc66f,	0xd392ab7b,
-0xe625b2bb,	0x6fa1bf87,	0xadb819f2,	0xbffc438d,
-0x29a75a42,	0x8273bb3d,	0xa2ebbbaf,	0x44751af3,
-0xd1336dc9,	0xb8ea2a01,	0x507c00b5,	0xbc5d1ae2,
-0xec3d52dd,	0x3b420cfa,	0xb5903c32,	0xe27e323f,
-0x635fcc3a,	0x837a737c,	0xe0a93c8b,	0x49c32b2c,
-0xa2b28a0c,	0xc4910f2d,	0x7823090f,	0xdd207b5e,
-0xace44b45,	0x6b07aebb,	0xf1de2791,	0x9b43ed2c,
-0x2a290c51,	0xd846b2a3,	0xcd082cc2,	0x593253a9,
-0xa71a8bfc,	0xe84ebaea,	0x7a1dbc25,	0xa8ed8941,
-0xbad427df,	0x24ea60d9,	0x8bb91a75,	0xaf896799,
-0x42edd33a,	0xcdda6c02,	0x855e1351,	0x2f9a8925,
-0x9de00122,	0xbfdcdd31,	0x3adaad66,	0x95b46ddd,
-0xef100e3b,	0x42c8f68a,	0xa0e8c87e,	0x964e792c,
-0x2f95bc90,	0x8c072bd7,	0xcc21c070,	0x0c266694,
-0x85c49295,	0xd120e46c,	0x1dc291d7,	0x9e857b79,
-0xd6e85535,	0x692671b1,	0xe8fc9aa5,	0xf79cdf25,
-0x3b703fbe,	0xb09ae23e,	0x948b08e9,	0x4a49df51,
-0xb903210d,	0x8fb8b6f6,	0x0e9503c5,	0x970ca0e3,
-0xc4a1d8fb,	0x772a97b3,	0xcdeeef55,	0xa9bbd8d3,
-0x4980089f,	0xbeec79a4,	0xc47571eb,	0x71c7b097,
-0xe597f149,	0xe2640676,	0x23d49990,	0xbe334a4a,
-0xd8918d52,	0x677fdbb4,	0xb83811cc,	0xe2516308,
-0x2e959c61,	0xd49eccff,	0xd362bb93,	0x734b6342,
-0x9ad68a98,	0xb645ea96,	0xda4164dc,	0xe9a108e9,
-0xfc0f2aba,	0x1771bdac,	0xd2a20f4d,	0xebc4a613,
-0x16dbc8b9,	0xb7216f3e,	0x86226957,	0x64ac2fd8,
-0x8dcf6c5d,	0xc7650467,	0x3dd5eb2a,	0xaab71dee,
-0xa84d32a9,	0x0c302583,	0xbcfe09a1,	0xab924a16,
-0x155e7a1f,	0xe7fae2f9,	0xca1b2b22,	0x56ef5e84,
-0x948dbc62,	0xd924664b,	0x40ef5230,	0xfc806b91,
-0xddc257f0,	0x13b601b6,	0xcd076bce,	0xa403b0ed,
-0x687b7197,	0x8c43494f,	0xb1656423,	0x3608cde7,
-0xb1fc13f2,	0xde76b60c,	0x2707c239,	0xf8800625,
-0x9a01f190,	0x16bad602,	0x91e499b9,	0xa66a5f6a,
-0x53ebe018,	0x2fb101ac,	0xf7375808,	0x9f389ac9,
-0x02731d5b,	0x4332c74e,	0xa88298cc,	0x0915f8ed,
-0x72cbccc0,	0xaefe2a36,	0xb9462942,	0xb96c3734,
-0x5ebc9539,	0x2233e83a,	0xbc061e53,	0xcec70013,
-0x2fdf4e90,	0xcb3922cd,	0xbb18ac4d,	0xbeacb4f9,
-0xc244558d,	0x7eaf183b,	0xa26e73b5,	0xa43ed7c5,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  537-MU268110.inc  */
-0x00000001,	0x00000010,	0x09211999,	0x00000681,
-0x04387de5,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x4be8aea8,	0xd011c071,	0x2a691f13,	0xd89f633e,
-0x14e47ca9,	0xf25e7d3e,	0x0517055c,	0xb27eb3e4,
-0xadf16268,	0x1b8191ab,	0x112ca6a0,	0x49430934,
-0x17a305b0,	0xad00ad6f,	0x00e6974a,	0x8951b04d,
-0x99dbff9c,	0x10888ff1,	0x1da8fa08,	0xf7144700,
-0xb505b499,	0x7142bd12,	0x0d1493b6,	0x2136a4fd,
-0x5899d436,	0x15828940,	0x081ef5c7,	0x75077358,
-0xa620a5e2,	0x89c640ca,	0xe3f85a5a,	0xc029fc66,
-0xf80f5032,	0x8f951f5f,	0x9fa70a3a,	0xdb254c57,
-0xc6d62e3a,	0xb50c3264,	0xdd0b50b5,	0xbe3afae4,
-0x0682077d,	0x7c60a795,	0x9916f56d,	0x68aa7525,
-0x2a9a5235,	0x490a38bf,	0x3a42c9de,	0x6e2e5b42,
-0x4878ebde,	0xce48d89d,	0x04f6688a,	0x4e1c326c,
-0x757b9b5f,	0x7752f735,	0x8b4db81c,	0x2c33a81f,
-0x13ca01ef,	0xab71cb68,	0x420caa16,	0x1ffbee7e,
-0xf3174461,	0x7508ac44,	0xf318209a,	0xc99842e7,
-0x87ccd230,	0x53d05be4,	0x29f3de9a,	0x36a65d67,
-0x2d7a9dd9,	0x88ad51ef,	0x25b7fdbb,	0x2b8ca261,
-0xf6e85e6c,	0x1ecf9ed1,	0xc63593f9,	0x8ac9d629,
-0x135d680e,	0xd200f572,	0x207623a5,	0x51b8aa3b,
-0x31b5be82,	0xf3979e00,	0x57784998,	0x7dde484b,
-0x3abccf17,	0x223285bc,	0x79f52876,	0x74c53f13,
-0xce16fe96,	0x2893f18d,	0xd0235541,	0xe7ea5aa5,
-0xb1f4a0ec,	0x7c7da02a,	0xf496b043,	0x7426394a,
-0x02654a4b,	0x32016d19,	0x80a03a11,	0x2b068325,
-0x7c8cb2ba,	0x633b0572,	0x2b850332,	0x1d74c0d6,
-0x2b2d934a,	0xb220186c,	0xb123a130,	0x04075222,
-0x25b47e62,	0xb9b2f4f6,	0xf40dd666,	0x46c90809,
-0xaacdbc09,	0x00481902,	0x124fa0c6,	0xf8b98698,
-0x56ee7359,	0xa9c82490,	0x9b650054,	0x92f037e6,
-0x77f3ea42,	0x4f9aa420,	0x3756a81e,	0x54954b2e,
-0xee31604a,	0x642d998f,	0x0163fd0b,	0x794b452b,
-0xd6819422,	0x11887658,	0xaa2b44ad,	0x484f36c2,
-0xe354ff29,	0x6393ee5e,	0x8642ab8b,	0xb83d39fa,
-0x481f04e3,	0x1ec27310,	0xb0d68b33,	0x844c0d92,
-0x758ee6e8,	0xf7db3d42,	0x9af4d118,	0x7294b5f3,
-0xbe309bfb,	0x63ee1f13,	0x9a734a9b,	0x47241805,
-0xc9b2887f,	0x76e37669,	0xa2ddf49a,	0xc605fa9e,
-0xcd6420d4,	0x46f39785,	0xa0246d51,	0xab10ad59,
-0xbcdddd37,	0x0362abf3,	0xdf85c4e2,	0xd32dfa5e,
-0x7bb483ba,	0xd22c3e77,	0x16e9f835,	0x7b228d06,
-0x22e4a405,	0xd92596df,	0x03653ee5,	0x1d982e39,
-0xb344edc6,	0x25163d17,	0x8fce2be5,	0x0a0183b3,
-0x1006e059,	0xb1cd9f3b,	0x8da1f83d,	0xbd6f26e7,
-0x1a11defb,	0x7102209f,	0x4936f369,	0x429ec072,
-0xfedb6040,	0x9f59ba31,	0x3c6aecd3,	0x38fb1c21,
-0xc93fb52b,	0xa5ab3b8a,	0xacff84b4,	0x64b36e8d,
-0x328fac01,	0x39f8ef94,	0x7999fd1f,	0xf9aa181f,
-0x9b039dcc,	0x10a01aa9,	0x437eb2ea,	0x2a2ddf7d,
-0xc6f8bebe,	0x865e2275,	0x7a987e18,	0xd3b7b1fd,
-0xd9351c1f,	0x16016358,	0xd903741c,	0xc870ebb8,
-0x3af4033b,	0x004ac482,	0xd445896d,	0xad6536af,
-0x80c333fb,	0x1b7caa83,	0x357345c3,	0x934c2630,
-0x1f9a45f6,	0x9729e354,	0x32fdaba8,	0x9cafb4b9,
-0x8e9dda39,	0xa9700b6c,	0xbea0c131,	0xe5a55806,
-0x1b0e2f71,	0x615fa421,	0xce8420ca,	0x893bac43,
-0x0b95b949,	0x9260ab02,	0x31c9a79b,	0xf2a4da18,
-0x73ca1c12,	0xb41c7210,	0xa3908679,	0x2208e3d8,
-0x3797b08e,	0xbfa6a55c,	0x5a8be539,	0xbd9e623a,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  875-MU16b401.inc  */
-0x00000001,	0x00000001,	0x01102002,	0x000006b4,
-0x58213e6a,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x1016aa4c,	0xba6d2007,	0x139b094a,	0x8d5cd4f5,
-0xece206e4,	0xfac0aa68,	0x26674533,	0x9464601b,
-0x4b3f7f76,	0x64133194,	0x37c151ed,	0x3ee0e278,
-0x7cffc9c4,	0x562be2dc,	0xd1067021,	0xaf8f1728,
-0xbad0534c,	0xf7a67cca,	0xdd34e969,	0x774bb723,
-0x5635256e,	0xd23cce15,	0x3c7c50ce,	0xa5faaecc,
-0x1c717607,	0xcc1e6f3e,	0x16a4c6a7,	0x58bd5816,
-0x0a2e73b3,	0xd65104e4,	0xb873ec1a,	0xe6cdd62e,
-0xcd278f3c,	0x2e081c41,	0xf43f4439,	0xbcdfa892,
-0xbb20c46f,	0xe0c8f8e1,	0xa619c4cc,	0x48eea22e,
-0xcfdf4bc4,	0xefaf4494,	0xa7cac511,	0x783c367e,
-0x6fc43ebc,	0x67e32786,	0xf0c1fbb1,	0xf93d5b0d,
-0x36e9b7e8,	0xc3b4dc36,	0x4beec4fb,	0x88382c9d,
-0x735dd739,	0xc5e23b67,	0x0d325dd4,	0xfe8bd98b,
-0xa0f294f9,	0x1916bcd9,	0x7b73f066,	0x26758acb,
-0xf10be125,	0x5aee77d0,	0xa005f65a,	0xd4d88c84,
-0x02340625,	0x687da1c4,	0x29906f8c,	0x20ca4e9c,
-0xcad37ebf,	0x15ae02ef,	0x06ac0241,	0x60c210b8,
-0x07bb359b,	0x970ada27,	0xd15463c5,	0xb1df482a,
-0x32c0386e,	0x72719013,	0xbe45b1da,	0xda807e08,
-0xe1340a36,	0x9bbc789b,	0x71ae0eb2,	0xa7b0e639,
-0x12948517,	0x8bd37587,	0x083273be,	0x1a73a3be,
-0x2e0cf9a6,	0x3c401aa6,	0xc74c77f8,	0xe6ee9da6,
-0x3188f408,	0xcdfe98ff,	0x71369d02,	0x032e20b7,
-0xb9083418,	0xe5ef65a8,	0x3a9317d2,	0x23117ad6,
-0x6c303cfc,	0xe6aed513,	0x97b7af1e,	0xe277f5aa,
-0xd1f788a7,	0x72305569,	0x2a241259,	0x7f786fa4,
-0xeba79f99,	0x740b14fa,	0x2a8e8a3c,	0x7824a0f2,
-0xb1b4588e,	0xc775677d,	0xbc2372a6,	0xd485e398,
-0x8a989d5d,	0x960199ba,	0xe5dca6a2,	0x818b5c9c,
-0x655f760d,	0x8a75081a,	0x86a6d67a,	0x05e74583,
-0x160d2e9b,	0xecf3f2b6,	0xb0e5f342,	0x162dcc4b,
-0x95d05b92,	0xec736eb1,	0xad367c81,	0x6b98845e,
-0xaea10969,	0x32a923cc,	0x0e20e511,	0x11f1d80d,
-0xa80bff0c,	0xdee5c142,	0x5618820b,	0x9ab1530f,
-0xeb2e5aad,	0x71986a78,	0x4b9f79ab,	0xdcb38492,
-0x5d1df5ee,	0xa6947ea5,	0x4b81b7aa,	0x4fd1194a,
-0x809256af,	0x2d7d2c85,	0xc3a3d15b,	0x4e4dde55,
-0xa275c268,	0xe584005b,	0xe7975491,	0xed9d3d06,
-0x6aaf4acf,	0xf4e3f967,	0x7c04ded2,	0x9fefbb0c,
-0xff806dc8,	0xbe36d1ce,	0xdc9e4a45,	0xe54a5b71,
-0xea53d6aa,	0xf0e13f21,	0x250f7e77,	0x09429ec2,
-0xb34360be,	0xdf249256,	0x4b6b8d57,	0x6f3b9f7d,
-0x1dd4d988,	0x6a68c719,	0x82d171e5,	0x04de6517,
-0xd2628f0d,	0xfe6fd4e1,	0x8f3cbd0b,	0xd8517c88,
-0x7993bb4f,	0x9487f25f,	0x493ad1f1,	0x781b2745,
-0xd25de9ed,	0x63fe8ffa,	0x83be8468,	0x5955efd3,
-0xd07886cb,	0x3cbbf313,	0x10255dcf,	0x4fe6e5df,
-0x2afbe5ce,	0x2731cea5,	0x3ca3a0b4,	0x9a73e5b3,
-0x7022f776,	0x43f0062b,	0xac060c7c,	0x89c88761,
-0xdf86c5be,	0x0f705bcc,	0x811d31cd,	0x56e72be7,
-0x473becc1,	0x74d511a7,	0x7f44e656,	0xc04d3763,
-0x487e15a7,	0x851f93bd,	0xc0cfdff8,	0x11b62ba1,
-0x45ebf606,	0x5ae10f89,	0xcfd063cf,	0x25b52d80,
-0x03b35a1a,	0x7e5be251,	0x643e69b1,	0xe50e0a26,
-0x73a3be25,	0x7bd17fb9,	0x72ac0b0e,	0x2f04ee8b,
-0x8e614214,	0x73fbbb40,	0x6c87f572,	0xc2cca0b1,
-0x3a575557,	0xe38b025c,	0x57d61954,	0x5a77769b,
-0x123d2893,	0xd21f163e,	0xef617597,	0xbfd67b8c,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  452-MU165310.inc  */
-0x00000001,	0x00000010,	0x06281999,	0x00000653,
-0x4b6dfc5e,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xa9f6b598,	0xec73f4eb,	0xffce329e,	0x6c5e06dd,
-0xce5188bb,	0xe94f7930,	0x15eedaa4,	0xf18757d4,
-0xd70c827d,	0x31455e24,	0xf5b4bbcb,	0x9998ca1f,
-0x2ec1d583,	0xaca650ad,	0x8df19fa7,	0x166dcc31,
-0xf4322404,	0xa03f61f8,	0x5944ee81,	0xfc83e22b,
-0xbbddfdb7,	0x58347247,	0xd2469409,	0x827198e8,
-0x3400aa4f,	0xedd3d882,	0xdc966e7d,	0x3e30b255,
-0xa9b45d4e,	0xc78f0810,	0x5fc7c407,	0xb1a289bb,
-0xfb0657ec,	0x476c2047,	0xbc5f1574,	0xa711c231,
-0x164daa0b,	0xbd96098f,	0x84d29406,	0x5b6f6564,
-0xcda8e7b0,	0x8b75723b,	0x4482d30c,	0x9f2a8e06,
-0xdacef785,	0x54313eb6,	0xaf86cbb6,	0x9821df5a,
-0x32b22218,	0xb7eec0a2,	0xb11f02be,	0x36f4df12,
-0x9dae899e,	0xa449a294,	0x49cc03ea,	0xa80e5d89,
-0xde78ee40,	0x67548fce,	0xbaf8ca83,	0xd8c19acb,
-0x78e71346,	0xb4507a69,	0xce0adbfc,	0x5aad67b1,
-0xe3132110,	0xe4f3d82d,	0x0fbd379c,	0xb2b5f05c,
-0xed0a9a6f,	0x4ad8ddb1,	0xe2cff1b0,	0xc30d2a98,
-0x4b7f0d4a,	0xd61d5eab,	0x87c986b6,	0x00a7d89f,
-0xc19a7241,	0xdeeb64a6,	0x0dd96c74,	0xf5037a54,
-0x95b1f67d,	0x206c6c4c,	0xa92d9eea,	0x94b019eb,
-0x735c9247,	0x800b3eb2,	0xb47accac,	0x4359700b,
-0xe904733a,	0xba962336,	0x4d53775a,	0xf977eb8a,
-0xe1431b72,	0x4fab02d8,	0x912c42a2,	0xd5b58a8d,
-0x7a7caa9f,	0xaf26015a,	0xc7434abc,	0x61cc5746,
-0xe7103ec9,	0xc3450e0c,	0x39e65a43,	0xc51d998d,
-0xc7d74311,	0x1bc02a8e,	0xcde79dce,	0xcdfa8a67,
-0x4fe6b49a,	0xd79c38ba,	0x9066cb70,	0x7c0835b6,
-0xca2f447f,	0xb707beb6,	0x7f6c9230,	0xc82d1275,
-0xea2546b1,	0x7424db79,	0x8cf638af,	0xdb930706,
-0x6433cd97,	0xa312fc98,	0xc4fd9859,	0x6a2f6d72,
-0xea0dc261,	0xd143ea78,	0x2e42e415,	0xdec0b3b6,
-0xc28dd5ba,	0x071bc9af,	0xd4d5d5e4,	0xda3cfdb0,
-0x58d5d6e4,	0xc182d491,	0x91201b02,	0x7aea0079,
-0xc5e32789,	0xbf9508d9,	0x616e6741,	0xcb2c8d6b,
-0xe5dafc14,	0x78d5dfb4,	0x9318c3d4,	0xcfe1f2e1,
-0x600efeca,	0xa401d5be,	0xc6d9cd4f,	0x7dfb0134,
-0xf1da7e7a,	0xd2b4dd4d,	0x2bd041fe,	0xce3aaf95,
-0xc0f5d723,	0x03c769a8,	0xd6ab8b78,	0xd3aedb57,
-0x4bca8a12,	0xdaf9939d,	0x99b55331,	0x62f7b086,
-0xdbe96aae,	0xb308ebf5,	0x7cd9c4d7,	0xd84f11bd,
-0xe47185d0,	0x67f29f82,	0x8866d29c,	0xddf9681d,
-0x6f934e37,	0xb4753e8e,	0xfe060bab,	0xbae582f3,
-0x7ecfd0f4,	0x9a894f8a,	0xe97d6672,	0x3487f699,
-0x8f8adb39,	0xb6037e80,	0x2d1fd356,	0x2f38ba4a,
-0xaf1befaf,	0x808839f3,	0x2fafe10b,	0xa1a277b7,
-0x98a496bd,	0xdcd885a7,	0xa1d07540,	0x4157997d,
-0xdd40d57e,	0x89bf057e,	0x41a32725,	0x5c7bc8f2,
-0x9ce6b8ae,	0xc83ac484,	0x51507007,	0x3c785978,
-0xd79539d5,	0xfa36aea6,	0x3f47b6ee,	0xf2ca21e6,
-0xee752fc4,	0x11cd24df,	0xf948d935,	0x0b9cf56f,
-0x1286f53a,	0x11d5fb21,	0x177308b8,	0x08f9048a,
-0x1703ba64,	0x0ce282f3,	0x10e51cce,	0x73f2895c,
-0x032c9e05,	0x85121701,	0x6c47c71d,	0xfdca9c87,
-0x8ac1cd10,	0x892b0cf3,	0xe61155f2,	0x1d127feb,
-0x90aabf12,	0x8ded9c74,	0x2d5895c4,	0xb6880c5f,
-0xaaf4ef4d,	0x1144f331,	0x7a3fd2f9,	0x9e1ca270,
-0xc538d5d6,	0x534c21fa,	0x859930c9,	0x1f486800,
-0x46c3746f,	0x4a8fb4f5,	0x06b1666d,	0x96aec81b,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  430-MU165041.inc  */
-0x00000001,	0x00000041,	0x05251999,	0x00000650,
-0xbc120ef5,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x7e76519e,	0xe3f74799,	0x3af64fe9,	0xa7d62bb9,
-0xbb89ca97,	0x3d0dbae6,	0x893aefcb,	0x87225797,
-0x360ecae7,	0x98055f79,	0xbafb6168,	0x47b4b45d,
-0xfee0e965,	0xcb1412f0,	0x30f49e5e,	0xcbd9a334,
-0x86ad899a,	0x0b77df32,	0xa6a92a8d,	0xddc09b3b,
-0x470d70e4,	0x9b7f9f70,	0xa698053a,	0x28e892a8,
-0xf0444ac1,	0x83db3cc1,	0x4f5ef1b8,	0xf7c5e1e0,
-0xe2e9d7ee,	0x1bffc291,	0x846c4754,	0x969086de,
-0x386a0c4d,	0x9d7ed4ff,	0x863f6638,	0x66bd6bb5,
-0x8b27bdd7,	0xe8b31939,	0x53badccc,	0x8a3609f0,
-0xa4abd8a5,	0x57e361f2,	0xe8a620f1,	0xaedb6c10,
-0x64cb41a3,	0xcae3f75a,	0xebd6c20d,	0x70441f38,
-0x81baa0f0,	0xda741b2b,	0x71928a31,	0xe0c2a8b1,
-0xf5ec92fd,	0x3d0106fb,	0xc9213fa1,	0xd18dfcad,
-0x745aa758,	0xd6756497,	0xb0d0edca,	0x3b82cae9,
-0xa11a3cbb,	0xef0ccae1,	0x1c3dde9d,	0x9c51b887,
-0xb492e30d,	0x08cc3fa9,	0x88540d5b,	0xd534d068,
-0x46310617,	0xb09f621d,	0xb35b272d,	0x0d6ade93,
-0xc8ea5e48,	0x9910fc17,	0x405ae2a5,	0xeabe75f6,
-0xe30d44c7,	0x54d998a7,	0x8be13a9e,	0xee749ea9,
-0x4ee14c60,	0xb97f33bf,	0xdfa4d3a1,	0x72138db2,
-0xc0e2a9de,	0xfa51201a,	0x2a66908c,	0xf00413a6,
-0xcda476c2,	0x349ef9ca,	0xd9cc5827,	0xcfd42c2b,
-0x6e43c59f,	0xe6488442,	0x8e6b5128,	0x5c342d58,
-0xcd93d18c,	0xa0338ab9,	0x50a109e2,	0xce1fdfb6,
-0xe156fd23,	0x5a8ab4f2,	0xfd877e15,	0xe27f7c42,
-0x023b791e,	0xf7a3576b,	0xf2e85a4c,	0x152c3077,
-0xbc8bf1be,	0xcb8ce737,	0x1a3ef077,	0xbe674ac0,
-0xbb58a8e8,	0x0b5efc96,	0xaa70c36a,	0xbf232d8f,
-0x4a173ad5,	0xbf2d5f44,	0xfbe55d39,	0x6d34c5c8,
-0xb5a5395a,	0xf09c85c6,	0x59fa5bfb,	0xa3a88e24,
-0x8baba56d,	0x6e7a2b4d,	0xd6dc185d,	0xa2928bcc,
-0x7ad3b0ec,	0xc10b640e,	0xbf0c3bef,	0x497506c9,
-0x8a916b56,	0xbce57d43,	0x2005fc34,	0xbceb8c26,
-0x9eed6b54,	0x1f980a86,	0x93a742b0,	0x9bb3cd72,
-0x45b04f20,	0x87f23d21,	0xce9dc199,	0x4213d168,
-0x81960d1f,	0xeadaa7e5,	0x7b6ebd42,	0x9f31ab27,
-0x9ae749c0,	0x49be575d,	0xf8afb238,	0x8bb905b4,
-0x74842213,	0xd2e5c154,	0x87054f04,	0x62ce0156,
-0xb6caab1d,	0xa693348a,	0x1057003e,	0xa3c5203b,
-0x8af21d88,	0x23619382,	0x9c065f7a,	0xb51f3d1a,
-0x7b90340f,	0x9d69951d,	0xc8f1c2f1,	0x6ba8da99,
-0x8ef51252,	0xcc36317e,	0x7aed3ce7,	0xde1b9d47,
-0x9c860b63,	0xe06cfbd4,	0x6dc6929a,	0xc75313b5,
-0xc1ef067f,	0x1b887719,	0x2e1a2dc3,	0xd01815d6,
-0xe657f6e1,	0x1f947b53,	0xdfd30cd4,	0x3cf4fd2b,
-0x01ac6ac5,	0x0cee5d2e,	0x0e4c5354,	0xb4e7e3c6,
-0x334e4bf2,	0xbd24ed1a,	0xa6240eed,	0xc1106c93,
-0xa22c3237,	0x77803217,	0xd4487c3d,	0x999f7c88,
-0x72e4cff9,	0xe15f44d2,	0x93a3e254,	0xaed5d723,
-0xff7e2b22,	0x56c82c9f,	0xbcd60726,	0x343d7d03,
-0x5d02a7ec,	0x7f3b10cb,	0x1f58a60f,	0x362ad6ab,
-0x51e4ef3f,	0x4bf657a1,	0x01046a8d,	0x3aff1983,
-0x5eaaa3d3,	0x947b35a0,	0x225ed134,	0xc91d61d2,
-0x98b7a545,	0x8310dcb5,	0xd085a7d4,	0xdd85e8c2,
-0x97a873d1,	0x7faee475,	0x4cf26f63,	0x4bd7aa27,
-0xe2664a65,	0x97e96c2f,	0xb88267f7,	0x4fb40f0d,
-0x43cd3450,	0x0e160efc,	0x9c0b4f19,	0x2c5e5fb1,
-0xdc5e7d64,	0xc3da5a8d,	0x6ffe0dbc,	0xc330555e,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  429-MU165040.inc  */
-0x00000001,	0x00000040,	0x05251999,	0x00000650,
-0xb6a8b9b9,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x601e3c82,	0xe5a7e267,	0xbac45110,	0xf789f850,
-0xba6aba81,	0x2afebde2,	0x21a7efcb,	0x2c955f52,
-0x6fc277b1,	0xcc2e99c5,	0x26ebf8e1,	0xc0b5fe1c,
-0x4e879083,	0xa9264124,	0xf468ff13,	0x0bb4db3f,
-0xf741017f,	0x59e89ef5,	0x749f5029,	0x75eae17e,
-0xb173d6fc,	0xa1aa6c88,	0x989b3c2f,	0x61acd68b,
-0xacc61f2f,	0x573d81a9,	0x48dcd515,	0x5804c273,
-0x1cac96f9,	0xf0fb741f,	0x31ffa59f,	0xa14a8b31,
-0x82ff639b,	0x5e9a7e4e,	0xa081483a,	0x234a57ec,
-0xe468eb19,	0x79b183d1,	0xbd3c1114,	0x0ad767be,
-0xe8422277,	0x893322b5,	0x16b54d35,	0x16f4baf4,
-0xdf12aa92,	0x9f1716cd,	0x6ce23144,	0x85524280,
-0x76c31610,	0xe86bdee7,	0x8cf04199,	0x98d99747,
-0x53c209d4,	0xacc2aa48,	0x342d454c,	0xe9327a0c,
-0xfc57b773,	0x055732dd,	0x279b60b3,	0xd9fc24e0,
-0x0d327b77,	0xdcdfd4c2,	0xe23250d4,	0x0a5d96a0,
-0x47b108d2,	0x0adab0b3,	0xb41f6699,	0x28a5398b,
-0xef3f4303,	0x35be207c,	0x4e6f9e76,	0x3f7834a9,
-0xb50796ab,	0x3185e1ad,	0x0a38fb5d,	0xe5464beb,
-0x751c4e5e,	0x482d4169,	0xc56047fb,	0xf616f12f,
-0x743decdc,	0xdfe401b9,	0x612c7cf4,	0xf8304c02,
-0x2885c3b6,	0x2d961bc7,	0x9f6a38f7,	0x97f6f1f4,
-0x5ca2ee99,	0x0e94f902,	0xd10a1ac9,	0xb36c2107,
-0x015fecbc,	0x02a2a183,	0x716daf36,	0x4990aa8e,
-0x06bfb540,	0xf4a407f5,	0x689fa6a8,	0xcd05353f,
-0x3c598553,	0x026cb343,	0xb85e95ca,	0xf5d1c7bd,
-0x363c740a,	0x89ef13a4,	0x3afba31d,	0xf02bc3a7,
-0x80d889df,	0x489c54f7,	0x99a2b71d,	0x88f4dd0a,
-0x6b3f6384,	0x65e14382,	0x02d40f2f,	0x2f46ef94,
-0xc5c715cb,	0x60ea1752,	0x4e238f77,	0xde0a1049,
-0xd75774bc,	0x58faacf8,	0x81ed4268,	0xe9d387d1,
-0x9d638a9e,	0xe0a27ad1,	0x6e94dca1,	0x7ee5fcc3,
-0x819a7d58,	0x85c258ac,	0x14f2b0b1,	0x65f4c7f7,
-0xe1c9aa7d,	0x714e6201,	0x990ff117,	0x5d7af3dd,
-0x41fb4988,	0x1cdfa982,	0xf1fc11b7,	0x60e7a309,
-0xb6a789c5,	0x70737ff3,	0xc2fa3fe3,	0xbd407b3f,
-0x39ad84de,	0x76b8d442,	0x2a778268,	0x5d1d390a,
-0x77ac2c16,	0xa4cec96f,	0x8c7a6045,	0x8b258bfb,
-0x5a6a3154,	0xb0d0fc87,	0xe63a160d,	0x3dc8b9ea,
-0x62c373f2,	0x0681a8fa,	0xd5eb4033,	0xdbf53e00,
-0xb6863aec,	0xb3310839,	0xd8f994f2,	0x59d656d4,
-0x02db8c87,	0xcfa1529a,	0x6c4bb4c1,	0xd6097838,
-0x60b1e0d3,	0x33afe51c,	0x8e57c238,	0xeab39da5,
-0x133b7741,	0x7b031f5e,	0x8b4ff0c8,	0xa8e779bd,
-0x8676a9de,	0x6c133026,	0x37f3ea88,	0xdf864b39,
-0x6b7e9022,	0x213ca570,	0xb9aa6a56,	0x746208cc,
-0x677d2980,	0xc7e19363,	0xb5c89ecf,	0xa513c816,
-0x5f76f49d,	0x0b250ddb,	0xefc3f81f,	0x9fd57e7a,
-0x75386d0d,	0xa78b1410,	0x64f86f55,	0x50f9c555,
-0x7cad7829,	0xd0a4e891,	0xa2df6517,	0x128751d6,
-0xb29d7543,	0x9915052e,	0x8e32a38f,	0x17b1bb9a,
-0x6fe77ff1,	0x65cc92a1,	0x5fcb90da,	0x60565207,
-0x45e5f86a,	0xada512e7,	0x9bd77ad3,	0x8203292b,
-0x24598065,	0xa8029582,	0x486b4e11,	0x7041340f,
-0x763bafa2,	0x14f408a4,	0x71b784bb,	0xa4c11a9a,
-0x9f872d6a,	0x946251ae,	0x6fcf6747,	0x1e354c9f,
-0x82316b09,	0xcc8f682e,	0xce89240c,	0xfa2057b1,
-0x4ec8ed87,	0x32ab439a,	0xbbf6f7b1,	0x0c55ebda,
-0x04590c3b,	0x94aae71c,	0x41263f82,	0xd4a0fd58,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  966-m04f0a14.inc  */
-0x00000001,	0x00000014,	0x07162002,	0x00000f0a,
-0x64731550,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x80e0e61a,	0x7cb2c607,	0xbe1e2fc9,
-0xacaf1526,	0x31514e28,	0x9252d426,	0xb999ebf8,
-0x8469bb8a,	0x95e72fd2,	0x5f7c5472,	0x254adcf0,
-0xf706b236,	0x21ef3efb,	0x82d05526,	0x8b10bd77,
-0x268ab8bd,	0x929739a5,	0x0f180e02,	0x3ad1cc5a,
-0x23a10814,	0xbc4257f8,	0x026ded8d,	0x84bf45be,
-0xe13e69f3,	0xbb0edf16,	0x85218fd2,	0x898af4e1,
-0xcd635f26,	0x846ab0c6,	0x85a5d5cd,	0x077b4a16,
-0x71514de0,	0xbff893a6,	0x47536ab0,	0x1fc4b546,
-0x906f4b85,	0xc1f997d5,	0x0ba4b594,	0xa823eb50,
-0x416ee239,	0x659b0dbd,	0xf240ad67,	0xe042d532,
-0xce92f455,	0x9f318d9f,	0xac11fada,	0x6fc234ab,
-0x18cddb76,	0x67e52b4f,	0xa6f01943,	0xba695e2a,
-0x245bd123,	0xce05288f,	0x6582101b,	0x5be73a23,
-0x6ab67d0e,	0x873ac6f3,	0xab4c48f2,	0xe0d64284,
-0x65f33ddb,	0xd33abb56,	0x8dd411c3,	0x86f370ea,
-0x1c3726b9,	0xd561edb5,	0xa0484b79,	0x63bdccd0,
-0x54d42183,	0x05d9b9c2,	0xd1d2e489,	0x572f0b07,
-0x6b804808,	0x9ee441c8,	0x87e1e425,	0x0d4d3c3e,
-0xbb9188fd,	0xa7f1243b,	0x807be6fb,	0x8f828057,
-0xfe37dd84,	0x104ef504,	0x5aa650b4,	0x2f1b611f,
-0xd021e808,	0x1d4ca877,	0xdefabd4d,	0xaa0cbe35,
-0xa4e89854,	0xa880cfc1,	0x08ed71f1,	0xb58e8625,
-0x2f4bee9d,	0xfef8678d,	0x2868ade1,	0xcdd1c7a4,
-0x2b823a15,	0x4788ea69,	0x7a1de61f,	0x24a51210,
-0x4373e00c,	0x7f8e55c9,	0xb2c5092b,	0x74f9e0db,
-0x2f54f62d,	0x13e3b1c8,	0x835863dc,	0x7401feb0,
-0x82d9962c,	0xc321a358,	0x8db3eec1,	0x3d70aa8a,
-0x9e8d115a,	0xd1f258ce,	0x3db0262c,	0xdedf4ecf,
-0x2b43787d,	0x01bba4ab,	0x5533bfb0,	0xf25756a2,
-0x6748ff85,	0x49a04cf9,	0x15a3fceb,	0x2b0045b1,
-0x354d82dd,	0x51baaaae,	0x9cdb8826,	0x4a5e79d5,
-0xc0b783a0,	0x244ee819,	0xc9d7ec82,	0x61b5df6b,
-0xa3b0ab47,	0xf4201580,	0x16a9bda3,	0x2ac3fb2a,
-0xf2d45287,	0xc775c470,	0xca49165e,	0xf011aa96,
-0x7cc3f776,	0x128e7d4c,	0x53a7cb48,	0xc678c16a,
-0x704d85ff,	0x5ac3438c,	0x22a4255f,	0x06f4eb73,
-0x6d2c4918,	0x7ec8d353,	0x02f64898,	0x402caba1,
-0xa2dcd74c,	0x2ec84768,	0x19aaacb3,	0x641e9f60,
-0x610245fb,	0xbcde5b34,	0x5b2ad9e6,	0x26d2e619,
-0x3c5f7fc3,	0x8a4644e1,	0x6cc1f8fb,	0xb2ec0e52,
-0x02186480,	0x1c597a86,	0xea7cb92f,	0x8484972d,
-0x90f10aef,	0x7032ba2f,	0x8d51693a,	0x075f7010,
-0xef88324e,	0x5fbf378f,	0x1416ae8a,	0x5eac1f31,
-0x70e65677,	0x0224e031,	0x1305f1ac,	0x53209b14,
-0xb5037676,	0x99e958fb,	0xecb8fe97,	0x20fb5890,
-0x568e98e9,	0x87d42ce4,	0x03de50e2,	0x89728dac,
-0xdca95447,	0x36114e7b,	0x2aab8e7a,	0xa0529d9c,
-0x9901c79d,	0x4ff191b5,	0x7500cebf,	0x210bcc07,
-0x815fd1e8,	0x4ebd3be0,	0xbce22cf0,	0xcf2df323,
-0xfffa8eb1,	0x016b1ca2,	0xf87846a6,	0xddbf1474,
-0x435c41b5,	0x56245808,	0x050eace9,	0x128491f7,
-0x48c6fdda,	0x5775ded7,	0x0b4775a1,	0x7ce11409,
-0x0d9822a0,	0x084ca742,	0x8f2c8c8b,	0x4278fdfc,
-0xe45d26c7,	0xd92793fb,	0xe963acf5,	0x346473ea,
-0x28069586,	0xcd7423ab,	0xdd07fab1,	0xf2dd3f15,
-0xf924720b,	0x0047adff,	0x3935bd42,	0xde1d799f,
-0x03a4afd9,	0x4f0ea217,	0x5f3dd4df,	0x09f611a1,
-0x8ecf894c,	0x5111dde5,	0xd79db940,	0x4e2da85d,
-0x64622e3d,	0x00ed0f85,	0x192b2af6,	0x526fcc87,
-0x3e233c92,	0xdfa9d04d,	0x5a8a7d19,	0x18205eef,
-0x3ff5734e,	0xf3ba744e,	0xac73c051,	0xc2cf8a70,
-0x3ba41433,	0x123eb210,	0xe3f05134,	0xcfd54fd8,
-0x7995e0d1,	0x1760b323,	0x310a7810,	0x2706d0c8,
-0x15cf732d,	0x3c0ee597,	0x83e36338,	0x272058a7,
-0xff3e9fda,	0x0c22fe44,	0x11a26627,	0x061a17a0,
-0xd784b930,	0xb40ed3ca,	0x014eaa98,	0x2cfd7ef7,
-0xd3f700a6,	0xa2e0e5ad,	0xf6682e43,	0xbab69f7a,
-0x185c3430,	0x10a4a66d,	0x41698b7a,	0x89666812,
-0x1cdc431a,	0x301a8774,	0x056fa032,	0x08e5b4ac,
-0xd8e66808,	0x06cb04c2,	0x086f09ef,	0x09404e44,
-0x4b166a00,	0x1f244ff1,	0x096548b7,	0x3d066268,
-0x11c22583,	0x87d98b53,	0x83c785d8,	0x0c295204,
-0xa3693e8d,	0x8ca5c952,	0xa52c8190,	0xa9ac34de,
-0xe640e56f,	0x16d5715c,	0xf40bac7c,	0x940d757e,
-0x0955d322,	0xbd3e2f65,	0x6553293f,	0x0b25fcb7,
-0x14875a5e,	0xb5efd0af,	0x79cf151f,	0xa74e5acb,
-0x4b249263,	0x14a844ff,	0x4c547880,	0xb598f6b8,
-0xe9fffbc6,	0xe983f09b,	0xa5384013,	0x36baf1e7,
-0xe3a76c06,	0xde3df31a,	0x25d38aaa,	0xc19d9fa9,
-0x2c05457a,	0x0a4fd8f6,	0x01086f65,	0xdf7e10b3,
-0xa5f16786,	0x46d77f4a,	0x08336cd2,	0x1d06cb5f,
-0xe453696c,	0x6f662a90,	0x40d33558,	0x76c640d5,
-0x4e7e4c97,	0x10cb0f79,	0xb1cfbb1c,	0x4f3f0521,
-0x8cda32ee,	0x84c3e958,	0xaac41cc9,	0x023e7572,
-0xf3266bf6,	0xb4193d39,	0x3a31f7df,	0xbd83c248,
-0xc812df3c,	0x0af7f510,	0x82bb61f9,	0x95db6415,
-0xf7b12fa8,	0x7a7f4f9c,	0x2ec8f061,	0x3fa8e99c,
-0xc19bea78,	0x470c4315,	0x0bcf3abe,	0x787b97b7,
-0x78f992b4,	0x05a7b74c,	0x93fc4db2,	0x41094fe3,
-0x3e7fe41b,	0xa367bc2d,	0x90b393db,	0x3ec58fe0,
-0xb74cc79f,	0x9ed83f74,	0x10daeeae,	0xa524f1ac,
-0xafcd0f29,	0x11423945,	0x52319e75,	0x9978031d,
-0xa78bb8be,	0x1a8a86d8,	0xf9a5c6db,	0x15d9760b,
-0x00028056,	0x2d0f7fc3,	0x7734d88a,	0x1b877e63,
-0x7b1db862,	0x25037d9d,	0x5a210d59,	0x1875f3e4,
-0x0299248c,	0x90ae4f18,	0x949d7d41,	0x713deba7,
-0xa6ff8ffe,	0x243c5296,	0x6020828d,	0xe420ae82,
-0xf02eeda6,	0x3a8090e3,	0xaef23b89,	0x40d2cb8a,
-0xaaddddad,	0x220c269f,	0x288d2d4e,	0x8689e116,
-0x42de5c86,	0x95ff5e35,	0xdcaabe42,	0x3fbb05e5,
-0x4ade7e4b,	0xd6612d65,	0x44ad598c,	0x984eeabb,
-0x218696b2,	0xf9c83206,	0x881e3b4e,	0x54844f30,
-0x1f980f2a,	0x0aec3158,	0xdd92450c,	0xb8a3906d,
-0x0ccc7c23,	0x196b48db,	0x08ffaef9,	0x2c44b86d,
-0x05fcc149,	0x079869d4,	0x5f3f5d0b,	0x1086de9f,
-0x638432c5,	0x1dbe89c0,	0x882041a8,	0x05a6756a,
-0x306e76ea,	0x49ad9a0d,	0xbc24d1a8,	0x2a113e7d,
-0xdf53ea5f,	0x420a2194,	0x49629224,	0xb9bb75e9,
-0x72258daf,	0x1eb90fe8,	0xf9439af0,	0x402b7c8f,
-0x4994bf4f,	0x70620662,	0x9a6981d3,	0xcd5e28e3,
-0xadd1673c,	0x4914c072,	0xc7173eaf,	0x6027e504,
-0x2398e683,	0xd095d218,	0xca775065,	0x019f8a00,
-0x4a0eea46,	0x7b31d964,	0xdf392c14,	0x8ce173c6,
-0x6395a8a4,	0xcc11282e,	0xbaca1acd,	0x810a079d,
-0x3a3d48c6,	0x8368b975,	0x35d4f800,	0x1144a108,
-0x2bce5a1b,	0x8b5fd002,	0xd9240882,	0xba73d873,
-0xdb3c7feb,	0x1d8755c3,	0x5933a76f,	0x309afa30,
-0x2b4c22e3,	0xa283f4de,	0xb1702590,	0x7e644fc1,
-0xd5510885,	0x0e14fb98,	0x91e3912d,	0x32d33a71,
-0x4665a82c,	0x5c1ff27b,	0xf44a1fbe,	0x58af67ec,
-0x1a448167,	0x2384ef77,	0xfa605bb2,	0x125db403,
-0x73ca61a9,	0x5cab2971,	0x7c8d471e,	0x0425bdd8,
-0x1f5a3268,	0x0f512485,	0x5b27cc48,	0x0e2839bd,
-0x056fda54,	0x383a2b7c,	0xa5e6f401,	0x5773b15d,
-/*  308-MU163336.inc  */
-0x00000001,	0x00000036,	0x09231998,	0x00000633,
-0xe92faa0c,	0x00000001,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x09a4d328,	0x97fd940f,	0xcb089376,	0x252ba980,
-0x0b7d25b3,	0xe14f99f5,	0x6d964b06,	0x0cde5626,
-0xae74d42d,	0x586409de,	0xe12a9af7,	0x6c4acc82,
-0x42b77be0,	0xc830f1c0,	0x7055b2cd,	0xf24f8c5d,
-0x6c66d2b6,	0x8cbbef3e,	0xa747e953,	0x0be25e1b,
-0x94c06e36,	0x28bb97f6,	0x03dfe8b8,	0x7ee89287,
-0xcac63462,	0x5bdf25ed,	0x722be3e0,	0x67ddd349,
-0xb1645d41,	0x40415ea2,	0x32db2da2,	0x81b7c244,
-0x25cbc92b,	0x2ee952da,	0x83c34607,	0x82c2fd4f,
-0x0e9c7971,	0xe248462a,	0xd255458f,	0xc2366852,
-0x329933d7,	0x5edf55d8,	0xf21e16b5,	0xbcc35b05,
-0x316b91de,	0xa0126e04,	0xd81f0292,	0x26e1d666,
-0x9fedb267,	0x91508fde,	0x45d90efb,	0xd61ce050,
-0x2fb89f2d,	0xa241bb5f,	0x7c07578b,	0xea1c04c8,
-0x68f87fee,	0x5323f4c8,	0xa222ce71,	0xf1a3e35c,
-0x3acb66fd,	0xf688cffc,	0x36e6633d,	0x9c42ffa6,
-0xdea22740,	0x4b675829,	0xe72ce874,	0x3621cff1,
-0x05be5e7a,	0x3b548b7f,	0x2f534068,	0x2aafd034,
-0xda75c851,	0x177b5662,	0xe4381e1f,	0x442a95f7,
-0xee7c105a,	0x2b884bf8,	0xc0c02083,	0x67ebe266,
-0x4d6af53d,	0x583ad957,	0xe9e914a3,	0x5a2b0711,
-0xcb2d8915,	0x8ec9c7b0,	0x0267fb78,	0xd93005d2,
-0xf12c4bb6,	0xf0c5af50,	0x782345be,	0x878e06ed,
-0x4b36d1d5,	0xb994488d,	0x607d3d37,	0xc80fc120,
-0x84c5423e,	0xede72a5b,	0x4cbc1c25,	0xf21b85a8,
-0x663a5da4,	0x9881512a,	0x6fa52c6b,	0xd514b064,
-0x6f53e439,	0x6af2890c,	0xd5bfc0be,	0x136736c2,
-0x40226505,	0xf916164d,	0xf4918f38,	0x58c6a6ed,
-0xbd79a3c8,	0xe7bf1f66,	0xa893ef78,	0x7dee2ce0,
-0x491e0b01,	0x7ec10464,	0x89b5b0ff,	0x3d9b68ec,
-0x221851fd,	0xa6fb18ca,	0x15d8ac0f,	0xac2b0b03,
-0xc01a3140,	0x5c03abfa,	0xb091d90a,	0x7e7c035b,
-0x743e5fca,	0xed4c34f2,	0x8a587a57,	0xfbaae37e,
-0x4aae42a0,	0xee0dea30,	0xa9ab383d,	0x7f209bad,
-0xf1a3a21d,	0xe488dbd0,	0x24bfc203,	0xc320c802,
-0x655b5040,	0xa28c26cc,	0x12c6550f,	0x8e23bfcc,
-0x32694573,	0x33884234,	0x4528be86,	0xb97aadb7,
-0xc6ee97b1,	0x071da830,	0x823c7c87,	0xa6ec20b1,
-0xd07ab8ab,	0x32335521,	0x8b2967c3,	0xc93d5aec,
-0x9d690021,	0xbe7787e8,	0x995071cc,	0x90eee6fe,
-0xfc088273,	0x2c606d29,	0xb75dec26,	0x2b130260,
-0x61f8656d,	0xe1e1ab2f,	0x96b048c6,	0x1a64322c,
-0x73c8ca10,	0xad4a396d,	0x97fbc79d,	0xb0550ac3,
-0xeaf60280,	0x8765b69f,	0xcd556f93,	0xb137bec4,
-0xf043f1d2,	0x6d5df75a,	0x0e37f7a4,	0xf40608a8,
-0x2f7cf255,	0x3d961072,	0xbd05316f,	0x984dd94e,
-0xf2485088,	0x20342cf5,	0xd8deb71a,	0xf294c5a9,
-0x209b0839,	0x1aacb3cd,	0x0845b8ba,	0x9b856306,
-0x06c9d03b,	0xd53913d3,	0xe0bc9db1,	0x163a2e99,
-0x429f2a27,	0x109abfcc,	0xc20cae08,	0xa9ddd207,
-0xb0fb829b,	0x0d135e5d,	0x31a689bc,	0xc1b3176d,
-0xda2e1d3c,	0x1340d866,	0xb9fa41bf,	0xabd43270,
-0x3822120f,	0x8a1c6c07,	0x458a067b,	0xea8d379e,
-0x5ed3fc7b,	0xe124189b,	0x8d4af958,	0xa668c998,
-0xb92ad776,	0x3412b9b1,	0x038fb0b6,	0xb9b1f3b3,
-0xead0cc71,	0x4414f713,	0xc479b4f5,	0x4cc0096e,
-0x3b995d59,	0x583d7a1f,	0x43f53eba,	0x7f72ffd9,
-0xd789a520,	0xfa45e8d0,	0xb54e34ac,	0x0b2d0924,
-0xae28d7b2,	0x42533c97,	0x92d21570,	0x83ce99b3,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  147-MU16502f.inc  */
-0x00000001,	0x0000002f,	0x02111998,	0x00000650,
-0xac6d02e6,	0x00000001,	0x00000080,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x0be4c352,	0xcebd6517,	0x7648a0d2,	0xf922cbc1,
-0x9feb0ef0,	0xb662770a,	0x735b1659,	0xb24ad415,
-0x63c4c03e,	0x4f6682d5,	0x9558581e,	0x535c8785,
-0xb05b3caa,	0xd84d9eca,	0x6b65b5cf,	0x9e9b31a1,
-0x5a3aa5ee,	0xd795cf0a,	0x37aa738e,	0x4f01c8e9,
-0x4a5b75df,	0x72749f7f,	0xa3b74020,	0xb48b81d8,
-0xc36fcb8e,	0x3fe2ea50,	0x88376865,	0xb499dfbd,
-0x6f28b1c5,	0xa89385aa,	0x828031f4,	0x2538470d,
-0x1d9cd637,	0x0e234565,	0x983c0144,	0x583e3c4d,
-0xb40f71d4,	0xdc29646a,	0x192f6d07,	0x44bcc784,
-0x1046a0d8,	0x7bf6bb2e,	0xcf5e24fd,	0xfcb3b5b9,
-0x1a0bba7b,	0x08012499,	0x331049a5,	0xf52f3f65,
-0x77f565d3,	0x142c5c41,	0x531afd34,	0xb43f9f86,
-0x5a1d59d7,	0xb96d46c3,	0x63369c2a,	0x33260f91,
-0x9fe551f5,	0xf7775d5b,	0x560cf1d7,	0xc4526fba,
-0x5cec0335,	0x3d262906,	0xe10d0017,	0xc318b7b9,
-0xa9c7db32,	0x7e839e12,	0x5f380130,	0xd84ee227,
-0xc193553e,	0xc4a2ca27,	0xa349dcca,	0xd2270321,
-0xbe5a660b,	0x22c5b673,	0x872e8010,	0xb72c6831,
-0xd0eab8bd,	0x17725102,	0x43150624,	0x32181119,
-0xb82502e7,	0x92d69e2e,	0x01835234,	0x12e93ead,
-0xe79dc82b,	0xd1f88e84,	0xb1d500bd,	0x699a5685,
-0x3bd89d48,	0xc49eac1d,	0xec7b8746,	0xc295bf8a,
-0xcbfe99bd,	0xaed69f4a,	0x0f9272f2,	0x0c03108a,
-0x0871bf1b,	0x72a35982,	0xe14dd2fe,	0x09994d09,
-0x092e9636,	0x591a12f8,	0x694ff32a,	0xf1290365,
-0xb48092da,	0x729a94f6,	0x94365195,	0x7bf0449c,
-0x88e52cb1,	0xa3a87212,	0x01385f6a,	0x7c4bac73,
-0xc18fde2d,	0x42ebbfba,	0x764f541d,	0x2e8a2dcb,
-0x912109c7,	0xea91f222,	0xd3832ae8,	0x8268e703,
-0xf2cfef75,	0x3b231bc1,	0x002ef2d3,	0x98a21a28,
-0xd01e6c58,	0xe3b2947e,	0xd7406ec8,	0x99fa5c05,
-0xc8b97094,	0x5aab71e5,	0xeb742ed0,	0xaa8e5efe,
-0x61c48851,	0x81e97fb6,	0xa134151a,	0xc4b620ac,
-0x96805e58,	0x710f5a3e,	0xf022918c,	0xfc9c4851,
-0x060a5d76,	0xb7d9b521,	0x6e98f5f4,	0x1779be01,
-0xed68f150,	0x81de9851,	0xdf6e24ab,	0x19152d3c,
-0xbeb8aeed,	0x1c1e01b6,	0xa6df199f,	0x26f7df0c,
-0x35bd43d7,	0x61c0ed2b,	0x73fcecc6,	0xe10e5d15,
-0x6dbc7c51,	0x7a0f92bd,	0x4970ded5,	0x8da483ca,
-0x1028044e,	0x3fe5ef17,	0xa8446bce,	0x3dcd84af,
-0xf6113ded,	0xfca45298,	0x1cc7eb22,	0x7813f13b,
-0xf8e416fd,	0x38f7f32f,	0x4ba78048,	0x08e9e40d,
-0xf70db936,	0x0355d939,	0x12c420c2,	0xc99306f4,
-0xc6c307c4,	0x8df2f76f,	0x22830fc5,	0xb88f4246,
-0xdf60e0da,	0x15e54917,	0x35d2cd82,	0x07d8dd67,
-0x38611c80,	0xf58a500e,	0xc5541ded,	0xf164d334,
-0xcca2e2ba,	0x233e2700,	0xe0926cfd,	0x9c9d7f59,
-0x42c2efcd,	0x262c5a3d,	0x838a2585,	0xa09d6a83,
-0x0fd02750,	0xfbb75e02,	0xcf81f559,	0x983ad57f,
-0x99bcb5e8,	0x0f510f38,	0x18b1be82,	0x7226b587,
-0x56ddd60c,	0xcbad3c46,	0xf18d8a77,	0xb0c35569,
-0xb2d69796,	0x1a6ea88a,	0xd085822a,	0xb395deb8,
-0x49116573,	0xfb7562bf,	0xabb58f30,	0x24c45d69,
-0x6c32c60f,	0x5c88eec1,	0xbb01ab04,	0x607ca37c,
-0x7a3397e6,	0x5f465017,	0xf2efdb91,	0x4b7f7342,
-0x16ab0839,	0x6583880c,	0x95dd3476,	0x6595e6f6,
-0xc48ded13,	0x9af53fca,	0xccd09e81,	0xd755b817,
-0xa0fd710f,	0xa7c73d39,	0xb0b55de2,	0x451e63d5,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1290-m0df320a.inc  */
-0x00000001,	0x0000000a,	0x05112004,	0x00000f32,
-0x2538ef0a,	0x00000001,	0x0000000d,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x74843747,	0x4501ebc2,	0xe5e57c08,	0x461ce659,
-0x40a6701e,	0x5582170b,	0x74b21ac7,	0x20a81192,
-0xae8f27e3,	0x62327b97,	0xc79394a9,	0x59bffa64,
-0x5cd54499,	0x661609a9,	0xf3aeb795,	0x998555be,
-0xafd3506d,	0x3af3bb2b,	0x80a7c09e,	0x88f4a103,
-0xf61cc915,	0xc1d9b375,	0xb9f62306,	0x1f60aa5f,
-0x4159c8bc,	0xedd0db19,	0x36f955b6,	0xa15d4ebd,
-0xea1d8948,	0x58acf084,	0x53fc1a4e,	0xe76de3aa,
-0xb9ce6bd6,	0xd99002d5,	0x797c8dcb,	0x7500ca7a,
-0x5e1e5da5,	0xe2637e41,	0x1f281cc4,	0x1c0a2110,
-0x9db83c8f,	0x7a256180,	0x804644c4,	0x3e1c625a,
-0xb6c356f2,	0x35ccc6ba,	0xa24b20c0,	0x00dbf282,
-0x76ca6755,	0x7831808f,	0x2075ec65,	0xea0b5fbf,
-0x3ee5b1cf,	0x5a7b9a89,	0xf9d75ffc,	0xa2c11d5d,
-0x73daaa86,	0xfa11274a,	0xfdcfb3c1,	0x051cc6c6,
-0x9c6c53de,	0x992527ca,	0xa2dce7db,	0x4f3efdd2,
-0x20d65f2a,	0x6c8eeb78,	0xcdb9e581,	0x345a2ca8,
-0xb45e9a7f,	0x1f79bcb0,	0x0e2061ba,	0x6d7a5d55,
-0x6c1e3cf5,	0x24ade036,	0x3d08860d,	0x8a3ea3a9,
-0xc30f43b9,	0x1de4237c,	0xfb3b8f85,	0xa4e44587,
-0x4ed26579,	0x92c37b5c,	0x04136287,	0x53d1c29f,
-0xca821100,	0xbc8d89f2,	0xa11646b6,	0x501b8bb6,
-0x83ed9eed,	0x1881fd4b,	0xa6014a24,	0x0330abbe,
-0x635845f6,	0x450b0067,	0x4db70e3a,	0x4d7a01eb,
-0xd498799b,	0x23741823,	0x8129458f,	0xae00e50c,
-0x5a1c5acb,	0x27b06938,	0x847ff9d0,	0xb1dc5e10,
-0x344d81f7,	0x835f0ab7,	0x0b186ccf,	0x2e2b0b0c,
-0x91bec1a7,	0xfb5bfefe,	0x0d108725,	0x791fcb89,
-0xa72d7393,	0x2e746000,	0xa9a904b1,	0x2907d414,
-0xd344c14c,	0x1dac323f,	0x3b5944f9,	0x6e384d17,
-0x9049bdb0,	0x63d46346,	0x01841ada,	0x806bd62e,
-0x81b3da6d,	0x5feb969c,	0xbc4881a4,	0xae4568d5,
-0x850bfbaf,	0xc5ec4d7e,	0x3592c8a6,	0x19debd00,
-0x70f730be,	0xe46fc21f,	0x52edbb6c,	0x1f6c59de,
-0x8e861d34,	0x1e056e10,	0x0aa4a2c0,	0x26648b05,
-0x7b1b2cba,	0x15d8530b,	0x15ac9e35,	0x63fc4785,
-0x4ee0e843,	0x749fc4f7,	0x9078d2e6,	0x922d7725,
-0x012d3350,	0x1432be40,	0x1cfb013e,	0xe1c3b425,
-0x0757f6ca,	0x96ac2827,	0xbbb1607e,	0x4d7796f1,
-0x373635d5,	0xb3995af3,	0xd282686d,	0x57846e0c,
-0xc10a1b7b,	0x0531aa26,	0x401a2d3b,	0x6293979a,
-0x3256b584,	0x7037f5bd,	0x1a55346a,	0x4d72f65f,
-0xcb831ed7,	0x78858956,	0x7534b9a9,	0x0300a497,
-0x87786fe1,	0x0038e678,	0x234a22b0,	0x3a254e87,
-0xae8e8c7c,	0x2a38cb9c,	0xf75e4df6,	0x124f6e10,
-0xc313cb74,	0x403b85c2,	0x8b282eed,	0xe4088cb4,
-0x6d3f2750,	0x44772ac5,	0xf261542e,	0xe8cf1b64,
-0x701779aa,	0xeee56421,	0xf12a99ea,	0x20e83201,
-0x5443f258,	0x9413ef4a,	0xc42546bd,	0x71446205,
-0x846f1149,	0x69ad3ce5,	0x1d0c21d7,	0x7e732b32,
-0x607080b6,	0x554fd99e,	0x0e636882,	0x516e3657,
-0x83816c0c,	0x14e8634f,	0xedf4c65b,	0xf8f8eb9b,
-0xdfe9a6cf,	0x68213b6a,	0xc3b08d7f,	0x90e95140,
-0xd534836e,	0x8978e5aa,	0x2fbebe6e,	0x46c24c92,
-0xa77f97c4,	0xfd1fc442,	0xe6e43c67,	0x4d1ba554,
-0xf9468738,	0x6bd2f2cb,	0xec33883f,	0x2bba5bc4,
-0x88e7e1a2,	0x3c4a7640,	0x2d2a4111,	0x237ceaca,
-0xb1648b8d,	0x7b32f695,	0x7d7804d0,	0xb425cfc4,
-0x167c62e1,	0x36289bf5,	0x3cdda149,	0xe499f59e,
-0x74940089,	0xe17cdd2d,	0x58ef7744,	0x4a8df6ff,
-0xf2f6f5ee,	0xf8ce1e0a,	0xa0797758,	0xa73b236c,
-0xe0fce34d,	0x0e5301a8,	0x11afd174,	0xffd409ea,
-0xc515f1ef,	0x90be8027,	0xdf7bd90f,	0x2e128305,
-0x9fe0e89d,	0xc96c4158,	0x56e4f034,	0x144f5874,
-0x34428f4a,	0x56b1b800,	0x42c1fd6b,	0x09e343bd,
-0x0c5f0cfd,	0x6b6b8b00,	0xdab284a3,	0x5a01b6aa,
-0xcdd04c97,	0x1145a1d6,	0x444c41c8,	0xb776a994,
-0x58ef29b9,	0x472c2b2b,	0x60843b9e,	0xd8b82279,
-0x2d4abd14,	0xd060acf7,	0xa0f409a8,	0x4a8e4099,
-0x17ae573d,	0x91a5522d,	0x1c551c52,	0x49848522,
-0x873bc54e,	0x1a2ec2fe,	0x5677af78,	0x1dd5d008,
-0x73c9b7a4,	0xf3457a09,	0x8fef1cc1,	0x7b845cac,
-0xb989248b,	0xf2921ec9,	0x71431fb0,	0x4697b928,
-0x2068f116,	0x4756ae0b,	0x7f2315a6,	0x3075ee51,
-0x93808fe3,	0x0a8bf0a2,	0x41ae68db,	0x7c7aea79,
-0x8a036c77,	0x3bd26e9f,	0x938760ad,	0xc16aa948,
-0x48cee353,	0x110c296a,	0xb0562141,	0xaadefff2,
-0x39107bdb,	0xf2fdcb94,	0xedaa4ef8,	0x39b68d06,
-0x66207561,	0xec544b74,	0xfd5ea699,	0x456c18ce,
-0x226a54d2,	0x07b36341,	0xc771e69c,	0x6610ea78,
-0x84cc8973,	0x0dd3cfff,	0x2deeb148,	0x6b3da83a,
-0x8b3d6854,	0x7423712a,	0x4ebcf2d0,	0xe45b0b68,
-0x20d1141f,	0x4a4ed962,	0x2cc7993e,	0xe249c851,
-0xa60dff79,	0xcd3727ba,	0x5e91d1ab,	0x3b6d4523,
-0xd2d7509e,	0xd5ea5ef6,	0x8fbf4006,	0x3c771673,
-0x6f500446,	0x6ac41dea,	0x1c9846bd,	0x65b13f62,
-0x75da9fd7,	0x6f8a5ec0,	0x19e384c2,	0x7bb6fa3c,
-0x22942d91,	0x7933fcc9,	0x0613dbe8,	0x8d806e31,
-0xd590e7d9,	0x64e55f3b,	0xc33585f8,	0xd7f69cb8,
-0xa74dd834,	0x973ce207,	0x78c53ab6,	0x1262fc4c,
-0xb210abf7,	0xd549d530,	0x9220b3ae,	0x03c5bdcb,
-0x72eeb0e4,	0x50af734b,	0xb0bc88a5,	0x6077acc9,
-0x9d51caf9,	0x63fb8670,	0x059b7f9d,	0x23c62f4a,
-0x3efb3f4d,	0x152a02ba,	0x3c9c683a,	0xed323f23,
-0x514d4bcf,	0x3b4724ea,	0x5adf550b,	0x88ff2a3a,
-0xf513dfc3,	0xbc067894,	0xb8ace8ee,	0x4ea08413,
-0x564a0211,	0xec08d000,	0x88f2d8b9,	0x633c232e,
-0xfc369c98,	0x681f6d49,	0x40478b0c,	0x257f8ccb,
-0x255710b6,	0x2d7f96fd,	0x7a0a05db,	0x3f22b6c3,
-0x747b954c,	0x0223dfd4,	0x92b82a50,	0xb64b14d9,
-0x638c2425,	0x7ecf3aa4,	0x1d6c828e,	0xe599d5ad,
-0x9c5962ef,	0x0c65309c,	0x3fe9197f,	0x6eb20295,
-0xa79c902e,	0xc09b9706,	0x30e0adf4,	0x328663c1,
-0x710582d4,	0x66c659ab,	0x8b5f4623,	0xe61ab1eb,
-0x98261cab,	0x8424f2b4,	0x87bbb44a,	0x5da9bf94,
-0x275e692d,	0x8d45c932,	0x1e385788,	0xf6dd16cb,
-0xf0098202,	0x182fb640,	0x33223503,	0xf0c2ba9a,
-0x6d14a05d,	0x7e779788,	0x3dd2d827,	0x9722eca2,
-0xb1dd3b68,	0xddc4ddab,	0x89372403,	0x0fc61fe5,
-0xe87a3daf,	0x32c80bd9,	0x10c0ee6f,	0xf5a634af,
-0x8f8206b7,	0xfc310d18,	0xc6e2bc5f,	0x55961d3c,
-0x57f95fec,	0x0aca8531,	0x3d0f1e03,	0xcb429bf0,
-0x94e83c04,	0xd22253a5,	0x6dc84e0c,	0xe413bfdf,
-0x60f01c7e,	0xa59bc63a,	0x6e1ca5de,	0x81db7447,
-0x2962a9de,	0x473a78d6,	0xc78f4b60,	0x7223f019,
-0x46a89934,	0x958b2dc0,	0x39d21b92,	0x7c41a788,
-0x1918ddf7,	0x03b03d8e,	0x1c83347d,	0x8a2c1d01,
-0xcf0e2b36,	0xe395b75c,	0x16011525,	0xc01f1c8c,
-0x28492afb,	0xdeda3005,	0x3d01c55d,	0x57c7b0bd,
-0xe7f20980,	0x9af93f48,	0x2d2ef7d8,	0x82588e29,
-0xb0249a6d,	0x21d7bbf4,	0xfc0bdceb,	0x78eda904,
-0x332d405a,	0xc13dbf8a,	0x4b146e31,	0x1f438eea,
-0x31cab96b,	0x0b5e9a77,	0x2814260d,	0x0efcebf0,
-0xa44c1bda,	0xc215fdda,	0xd5b90fa0,	0x7afb0842,
-0x9bab7428,	0x24678dfb,	0xe244616a,	0x71a8177e,
-/*  1319-m206d820.inc  */
-0x00000001,	0x00000020,	0x07222004,	0x000006d8,
-0x2f6d5732,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x62c99ff7,	0x7a6b2b26,	0x588bdafa,	0xbe02d9bd,
-0xef4646d4,	0xdfe7950f,	0x8882585b,	0x2b28e450,
-0xbc0e5103,	0xb992ad63,	0x7b7ddc4a,	0x2b4ad8df,
-0x69f9c34c,	0x254f62ac,	0x8e212d1e,	0x453cc958,
-0x3fd54660,	0xa12430df,	0x2a3c7590,	0x6bf08407,
-0x7f8ec244,	0xaab71e67,	0x372d7036,	0x2ea8f629,
-0x47d02f32,	0x71b668ba,	0x5d105058,	0xe748702c,
-0x97d18075,	0x70c92a53,	0x14f1cbbe,	0x98392132,
-0xf6e9afa4,	0x9513f52b,	0x919d4df4,	0x3a49c80a,
-0x67f781c7,	0x937423eb,	0x50955017,	0xbb95bd89,
-0xf695c995,	0x3ea2c5c0,	0x1a3fcf39,	0x0a3e0d3f,
-0xfc9680e0,	0xdf2f7f29,	0x30523ce2,	0x74781436,
-0xe92db344,	0x8894130c,	0xa63a9b3e,	0x683da47e,
-0x91e46f79,	0x54f49303,	0x8ed553ab,	0xf548c98f,
-0xb258504f,	0xbabfeaf0,	0xfc85a922,	0x029a3c04,
-0x9df03d20,	0x6d8d89f7,	0xf1be9fd2,	0x9b08c747,
-0x80bff569,	0xf6c1009e,	0x7192fd37,	0x734569ab,
-0x98a63684,	0x64e21152,	0x029862cd,	0xa1da74c4,
-0x662432e5,	0xaf970a41,	0xcd44ba9f,	0xd6209998,
-0xe7cbf9e2,	0xf1e25077,	0x7ba43611,	0x73b0ebd6,
-0xa481b44a,	0x4d2453e9,	0xae2db98b,	0xb0712835,
-0x569a277b,	0x756ced12,	0xe68d76cc,	0xe7302113,
-0x04e289df,	0x0e08c8f1,	0x47b49858,	0x962ed31b,
-0xd0ee9b92,	0xe4f96ee9,	0x09db6272,	0xacf2a059,
-0x3ef41cee,	0x51632a67,	0xdfa6b20b,	0xef87ce7d,
-0xcc146a5d,	0x5ea85cfd,	0xfdd57a79,	0x812d8333,
-0x638ca286,	0x9719378f,	0xa17655ce,	0x18cf5988,
-0xd58740e3,	0x121b472c,	0x4856a2ab,	0x5267727f,
-0x2e8af107,	0x82a7136b,	0xfcaf2e53,	0x1b1af8b0,
-0xfdb5aa1b,	0x356ad59c,	0x554b6397,	0xc693cb07,
-0x66d593bf,	0xb00c32d2,	0x7af9baea,	0xe5623f16,
-0x3c6fb0b9,	0x31269c04,	0x81371ad2,	0xc44d566a,
-0x2b727011,	0xe0a06f7f,	0x66629d50,	0x7f38e494,
-0x6a7e1f28,	0xe14673f6,	0xf68f6679,	0x84557020,
-0x987b7eaa,	0x985d9e8d,	0x7cb50310,	0xeb334e65,
-0x5d54f97d,	0xe9c0d1cb,	0xf5a084db,	0x6c199928,
-0xd4442a69,	0x2eedea5b,	0xacdfef61,	0x1e2e12b3,
-0x662fa232,	0x26d848a4,	0xeb9dc73f,	0x1b6d84e2,
-0xc34be2c3,	0xc7c35214,	0x83d8f14d,	0x8d127305,
-0x0229f7b5,	0x087ff7cf,	0x96332a09,	0x2a44bb95,
-0x81e212ca,	0x9a86a1df,	0xe596589c,	0x773980ef,
-0xbf860f3b,	0x75c2ad29,	0x4dd4e787,	0x522ca0c2,
-0x25acf966,	0x60b59fbd,	0x6bca1f29,	0x79aff232,
-0xa10c79be,	0xf07a4e76,	0x4158e659,	0x865be623,
-0xf3c104c5,	0x879fdfae,	0x93b9847f,	0x578a8459,
-0x648d9c34,	0xa7ae2bfb,	0x3f5a1985,	0x787eabfb,
-0x57d55448,	0x7d8828cb,	0x54c9d9c2,	0x061b0a93,
-0x9bbf974b,	0xb3fa4035,	0xf68f100c,	0x7bbc058e,
-0xc1ae7a06,	0xa21d06a4,	0x4f92f229,	0xf0c76b24,
-0x4e2c3781,	0x2eeab3d0,	0xf8994c49,	0x7e9d0b13,
-0x355db607,	0xbc7a3ad0,	0x12bb75f2,	0x6080de16,
-0x0b16e777,	0x32b59aa7,	0xc2f4f7f9,	0x60cb4ddd,
-0xa95e0193,	0xe310d2d7,	0xfe5587b3,	0x56936f67,
-0x01199707,	0xed8e7cd7,	0x51d6ff0b,	0xf6d9bdf3,
-0x029ea85d,	0xd97aba88,	0x76cd57e2,	0x996a18c7,
-0xa3d9e60a,	0x1404e61f,	0x40ab2be2,	0x54041917,
-0xc358788f,	0x6e46b7a4,	0xfb67915d,	0x671aa938,
-0x627f1e91,	0x31824cb5,	0x482f3e22,	0xd8c439ec,
-0x128667db,	0x8b5dcefe,	0xc810fb4c,	0x7edf847e,
-0xd71618ac,	0xc87934bd,	0xe96101d1,	0x55d1976c,
-0x471c8505,	0x7a36d839,	0x5d62a9ee,	0xf3c54a8a,
-0xa2be15d9,	0x244087c9,	0x042c8037,	0x23224689,
-0x281c5d73,	0x2139ecfc,	0xffb8bc8a,	0x834fdd11,
-0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,	0x4ae2dbda,
-0x86d90089,	0x6675dfce,	0x48876262,	0xcec72538,
-0x11dc5c80,	0x86a730f9,	0x313565c9,	0xe3e5be11,
-0x106d7cce,	0x752b8be2,	0x3d00a5bc,	0xe6f70e95,
-0x44447ac8,	0x600df30c,	0x8335ac3b,	0x8816ddee,
-0x700982fe,	0xee495741,	0x48c7e81c,	0xa3d55da2,
-0xb0172982,	0x70ab2158,	0xd4460621,	0x3a9e528b,
-0x59b18a7b,	0xf4dabc4c,	0xa8454763,	0x70877bb6,
-0x66005c97,	0xaf292c06,	0x7b843db1,	0xf343b59b,
-0x25cdc7b5,	0xa41da617,	0x9e9d895e,	0xc936f475,
-0x7270925a,	0x30024230,	0x8e72f53d,	0x2b6c1b6f,
-0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,	0xaf377cc1,
-0xbff09a78,	0x4b4e0814,	0x95a0b2c1,	0x270398de,
-0x201fca94,	0x2a032a4f,	0x131542b4,	0x0d7306da,
-0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,	0xa3b3a991,
-0x17ee60c2,	0x852c0b8d,	0x11e5853a,	0x762002a7,
-0x92c5311d,	0x0d4bf7e1,	0xfffec870,	0xe3d35e5b,
-0xff6ecfb9,	0xdedae6ff,	0x0111a772,	0x9808e780,
-0x29c336e8,	0xe9bc05df,	0x5bedde11,	0x945565af,
-0xaff808fe,	0x87e3423d,	0x4de6f98f,	0x93b4adef,
-0xbf704fa4,	0x09120e91,	0xd54f3692,	0xdf8eab1e,
-0xfabbf59c,	0xe74318be,	0xaab87ffc,	0x29fa791c,
-0xe3915552,	0xa652cb9b,	0xa1252e74,	0xb35b723b,
-0x542aa28b,	0x12fcc5b0,	0x3941f962,	0x82bcc6cc,
-0x47b11974,	0xb821611f,	0x78b34250,	0xf1be5659,
-0x561b9e61,	0x6f3bd501,	0x584e6f5c,	0xd54ed547,
-0xacebcd21,	0x7b5ff816,	0xb64ad233,	0x9f2f330d,
-0x69fb1ece,	0xac8710dd,	0x58dc6c60,	0x9bee6139,
-0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,	0xa733274f,
-0x884d9b55,	0x42b08b63,	0xafa54a74,	0x1c7ccf64,
-0x93a20191,	0xaaa3132e,	0xc69831d1,	0x54634889,
-0xfbfe3efc,	0xd3cf68d4,	0x302e3117,	0xf5693131,
-0xc3ce8c6c,	0x1f03cd89,	0x6243334c,	0xf16bc80f,
-0xdca5f130,	0xcb2cd956,	0x4c1bb421,	0xe8de533c,
-0x7f86703a,	0x29aa897e,	0xdd54acad,	0x76b2f2ae,
-0x7ef82b71,	0x2e30970b,	0xba402597,	0x9a653ab4,
-0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,	0x2363d147,
-0x5327289a,	0xe89229f3,	0xd63a535c,	0x7efe9273,
-0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,	0x1b9c7bfe,
-0x5d14b3de,	0x54d575fb,	0x6d65db4c,	0x95648b7f,
-0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,	0x8488a45f,
-0x8ebc2932,	0xd4767316,	0x3e8c4b8a,	0xbab7402c,
-0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,	0xc88528e9,
-0x4b2e4e8f,	0xdd938b86,	0x0c964f98,	0xfc88d480,
-0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,	0x4d40b3b3,
-0xcf203155,	0x0d2fa621,	0x752d2c58,	0xb12bac12,
-0x1e7e8c23,	0x94215d54,	0x9854a71c,	0x4de63c64,
-0x7a012529,	0x9c171f8d,	0x9e71def7,	0x3bd17d50,
-0x11f175d9,	0xec78abf3,	0x7b529eee,	0xd3a69fc3,
-0x5b718676,	0x58214d29,	0xa8bd2c34,	0x41ea00ab,
-0xa03f64d6,	0x4ee342b0,	0x32b1e444,	0x1c1801a4,
-0xc8424702,	0x334a7e35,	0x50cf1543,	0x3b22b495,
-0x88683776,	0x8e2e0154,	0x6155c033,	0x4e2fa6ac,
-0x42ace700,	0x8d64f97c,	0xaf9ced17,	0xb2a5cb92,
-0xa558582d,	0x88705de7,	0x9e528d59,	0x84bd45e4,
-0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,	0x10462123,
-0x30080f7d,	0xb346cd81,	0x0049c396,	0x4e24165f,
-0xa7c66809,	0x2e60bdcf,	0xaad70a08,	0xa73ea713,
-0xe28f97a7,	0x283a9eab,	0xd4366489,	0xe776f963,
-0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,	0x3bae5f6d,
-0x8d2bbef1,	0x7e9181e6,	0xf06aa121,	0xd06b2d20,
-0xa83ea826,	0xef935e4f,	0xdfd27456,	0xa3451468,
-/*  611-MU168607.inc  */
-0x00000001,	0x00000007,	0x05052000,	0x00000686,
-0x87aa303f,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x6624c5b2,	0x098bab85,	0xd7cb9fd8,	0x2ad2c3e5,
-0xb024689e,	0x030082ce,	0x87544b9b,	0x50a47302,
-0x34508a4a,	0x42eac716,	0xfb29145f,	0xa89d38cf,
-0x1595afcb,	0x7151404b,	0xd87466cb,	0xfbb7616c,
-0x912ba3ae,	0x43848a53,	0x7f5b7bd9,	0x770c3d91,
-0xd579a19a,	0xcd45be4f,	0x11f83af2,	0xec7a7162,
-0xa31769fb,	0xb872d8b0,	0xed21b052,	0xa9757f0b,
-0xd93fbb9e,	0xe4755de4,	0xde0b505f,	0xfaec9b1d,
-0x7e379d2b,	0x77cd8d54,	0xd884d9a5,	0xc856674b,
-0xd48fad7c,	0x79c380ef,	0xeac7311a,	0xf345ae9b,
-0xe6641e8a,	0xd0e02365,	0xf95219d1,	0x5ef40f4c,
-0xfb46254a,	0xa79b9c00,	0x33ff5502,	0x90a4ffc7,
-0x5b61dea5,	0xee2da1a4,	0x2d33a250,	0x970e8b65,
-0x61fa9e4a,	0xbf7a110e,	0x9cbe1302,	0x4489e932,
-0x273d2ac7,	0xbf0576ad,	0xb11796be,	0x100c4eb8,
-0x9f48c79b,	0xf43e6390,	0x07f19aa4,	0x0438d6ad,
-0xd073b3e6,	0x758caefe,	0x44695821,	0x0aa2560b,
-0x926f1676,	0x25c0d98c,	0x652b9701,	0xf1103ca1,
-0x3838b324,	0xe86c1a56,	0xcaadd270,	0xe2655064,
-0xc12e9397,	0x269a7069,	0x2c8431ef,	0xf123bff2,
-0x9d72d45d,	0xcde8c983,	0x9bd75039,	0xaaae7612,
-0x73f647ed,	0x96c2dfec,	0xf3c78dfd,	0x43386b24,
-0xa54c9fc9,	0xe5f902ea,	0xcf895610,	0xffbd67d8,
-0x88f26c51,	0x3af4baa6,	0x853803ce,	0x06a2c772,
-0x58dfbaf2,	0x854db965,	0x9d99817d,	0xb8fe256c,
-0xba4728ee,	0x0c4311b2,	0xb725f711,	0x332ec9d0,
-0xba328c24,	0xe97255e4,	0xe0fefbf2,	0xc90b8e05,
-0xdf3a9869,	0x29a5ead4,	0x8ffc234c,	0x1df04450,
-0x53ea2f3c,	0x2f27e401,	0x17267310,	0x12230316,
-0x4495bfc3,	0x6300281f,	0x6f1229ea,	0x987a8a03,
-0xfd00f044,	0xb4119ea5,	0x08921ba9,	0x512b7a0d,
-0x51baec70,	0xf456605d,	0x00d8a15c,	0x67838a1a,
-0x662ef9a3,	0xcc306d52,	0x4693878b,	0x2d0e5d8e,
-0x743cbcd2,	0xa6a7a050,	0x7a943e8f,	0x2e52c6a6,
-0x317b8d12,	0xac83eba9,	0x59a647a5,	0x158c0cc2,
-0x11af9e25,	0x6809f3ab,	0x4e59d047,	0x281ffa25,
-0xd3290e4c,	0x3f876c53,	0x58562bc3,	0x3a17709e,
-0x29e591d8,	0xc842e16c,	0x71620b18,	0x88680e85,
-0x31bb0bbf,	0xe408d90d,	0xfc2870f2,	0x40a8e770,
-0xbd7f322b,	0x00727a75,	0x12de5772,	0xca6a1790,
-0x7f3170ce,	0xb29b3c80,	0x96d58bd7,	0x197d7dcd,
-0xa793ec3b,	0x330d1496,	0x696788bf,	0x5e7895de,
-0x4548fe46,	0x9c061b57,	0x130f9b26,	0xbc11df79,
-0x1b0f6fc3,	0xa154182e,	0x568ab60a,	0x9aa45739,
-0x7ebb7352,	0xe6c82d4e,	0x2626170f,	0x6484ec37,
-0x8ade49d3,	0xe3608320,	0x43572189,	0x7b0b6733,
-0x518bb91a,	0x9da00229,	0xc1e449cb,	0x8ff922ba,
-0x7a523623,	0x615cc16d,	0x42e38cd9,	0x1253134d,
-0xa3fa6f02,	0x623b38cf,	0x86ab89cf,	0x1443acb0,
-0x8e21a201,	0xf111cfe6,	0xd02a9132,	0xb1d1a8d2,
-0xe177664e,	0x231603ff,	0x711075e7,	0x1d18d937,
-0x5b6e1cbe,	0xf6aa6105,	0x21d4847f,	0xfdf8e049,
-0x397d3ffd,	0x50142e73,	0xb3bcb17a,	0xe6d9c88a,
-0x9a757f51,	0xd8f22a49,	0x3bc7d8dc,	0xe337cd53,
-0x097fc575,	0x3e7b9ca4,	0x0f240073,	0x3746b51b,
-0x42de4d17,	0xbb2e58ab,	0x4b17f3d7,	0x8d0e06c7,
-0x4dd1c929,	0x60de42b6,	0xffdd1ce9,	0xcdee1401,
-0x9153da16,	0x74cc8c18,	0xed1d6841,	0x111a4964,
-0xbd86a589,	0xe1bf2ad4,	0x02fa8ce7,	0xcce8b286,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  399-MU166a0b.inc  */
-0x00000001,	0x0000000b,	0x05051999,	0x0000066a,
-0x5320efc2,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xf164feae,	0x70f1545b,	0xee75139a,	0xdb7fca71,
-0x48ba7994,	0x996e84b6,	0x6830ad5a,	0x38a129e1,
-0x323ac914,	0xc779a51d,	0x1d7c40fb,	0x36adafee,
-0xee2d4f67,	0x086d4fe2,	0x8f8d65d7,	0x801e7fcd,
-0xef612579,	0xf4806ed7,	0xe7617b53,	0x4c5ee9a4,
-0x967f5a46,	0x5a10ec0c,	0x12513274,	0xc71b9991,
-0xfc32bc01,	0x8f671aad,	0xb0e538eb,	0xb02838de,
-0xe999bcdf,	0x4ca0bdda,	0x4278da2c,	0x9f0a03d3,
-0xd29ae2e6,	0xb035934b,	0x3e0019da,	0xd1f07ee9,
-0x19852922,	0x38ba3efb,	0x29097d22,	0x208c367b,
-0x573ff3a4,	0x62eb70cd,	0x14ae776d,	0x300117d2,
-0x16cbcea4,	0x5e9c61ca,	0x09869e23,	0x28468eb9,
-0x66b5973a,	0xf7991cbb,	0xf9cac013,	0xbe478a7c,
-0x17a95a20,	0x9646dd8d,	0xdd0138d4,	0xf87e407f,
-0xa99cdaa6,	0x4987bfdf,	0x8e75e743,	0x9d6cfb25,
-0x2eec08a9,	0xc5e6dddf,	0x4a45c31c,	0xae85c0eb,
-0x0c875f17,	0xfcb911d0,	0x064197d2,	0x8bc57376,
-0xbcc472ec,	0xd12f07ec,	0xa868540e,	0x9a7c9efb,
-0x8d36c3df,	0x00865944,	0x7ec588af,	0x0efd17fe,
-0xbb5b2af3,	0xd7b06dc5,	0x38db16da,	0xaaff291f,
-0xcdd2f6ea,	0x9f70cd4b,	0x93ebefc3,	0x6e90b1f1,
-0x64b6b7b3,	0x89cd79e4,	0x4c62692e,	0x144e9e9f,
-0x98063595,	0x7f835929,	0xfa447038,	0xe981b269,
-0x4067c432,	0x2d2f5e5f,	0x5642fbf5,	0xe2b8f7bc,
-0x2c82dd3d,	0x8bb61d10,	0x0b0e0a20,	0xffeddd78,
-0xeff7b857,	0xe11a2323,	0x48b657d8,	0x56000020,
-0xe65844fe,	0x5231e1b9,	0x50a84875,	0x8cafb679,
-0x06cfce7c,	0xf37089a9,	0x4db86f6b,	0xa63d0376,
-0x72227dee,	0x30933db5,	0xda329301,	0x2dff90cc,
-0x43d5e2d6,	0x3e19da42,	0x220fdc3d,	0x85b47386,
-0x649e61bd,	0x5c1c72f5,	0x2fd4c456,	0x585388b4,
-0x4c12229d,	0x618fc4a8,	0x5db2f8d6,	0xd30ce359,
-0xbbb6a155,	0x807e7b29,	0x587dc9d8,	0xfda6fdc3,
-0x55bc6b34,	0xfc231424,	0x90b2ed33,	0xefdcbd79,
-0x5f82e9ff,	0x0646a8ad,	0x3cb3c86a,	0xfe19fc8a,
-0xe8c2485e,	0x0dc0f5d6,	0xb80b9c65,	0xedfb28b0,
-0x4c56c7c6,	0x2cc2fcc0,	0x223d0e54,	0x5352e027,
-0xfcc3527e,	0x2c6426ff,	0x46fb21cf,	0xb9a78245,
-0xab4b1ec5,	0xa40ac11c,	0x671db533,	0x31410024,
-0x66671b38,	0xe51ac22f,	0x39e40aa7,	0xc7e7311d,
-0x28b64fca,	0xf450fa23,	0xfa7ec04c,	0xaf43495f,
-0x0fdd7af3,	0xc9f94232,	0x9ee4f700,	0x6e669c5a,
-0xdb6d0c3c,	0xe2bee5ac,	0xab2a3699,	0x127347e3,
-0x2830b102,	0xa24bba08,	0x5e341110,	0x2f56ed4c,
-0xd0387126,	0x76b07220,	0x15829272,	0x46bebe97,
-0x64f7b851,	0x4ce007dd,	0x3a3022fd,	0xc2570ed3,
-0x9a5b66d3,	0x8abb4abe,	0x92165dae,	0x80c23f24,
-0xf8244059,	0xf240d2e2,	0x0853c211,	0x1bace652,
-0xd682f3dd,	0x8e14f139,	0x68800f29,	0x0ef3a910,
-0x2ac47b34,	0xdb4fbe5e,	0x9020e7c2,	0x036e4b1f,
-0x8d6d3b46,	0x934cd045,	0x29fc2721,	0x08f275fa,
-0x4a0320c8,	0xaf7261fa,	0x6ab8b9cb,	0x0ec88462,
-0xfbd1eefd,	0x468ab905,	0x9e1a18f6,	0x4012ffc4,
-0xe30a12bb,	0x6fca14c1,	0xb42b0ba8,	0xdbeb3652,
-0x1fbbc466,	0x0d504189,	0x7c644ce9,	0x77877afd,
-0xcea6f7c7,	0x7f5381dd,	0x905e0569,	0xd757cbac,
-0x0fd855e9,	0xbc8c2690,	0x1bdbb85b,	0x5b479eed,
-0x090e7c3b,	0x17484ec2,	0xc320e0d3,	0x969cbbe3,
-0x792f3c3a,	0x3c5fb90e,	0x1ed121be,	0x29c3abd6,
-0xd9075f20,	0xeb4806b8,	0x3cf8b650,	0x0cc4a95d,
-0x6b37d4db,	0xa4d965cf,	0x8f6ba7cf,	0xddb966de,
-0x62f431cb,	0x30048443,	0x12bc521b,	0x98682eaa,
-0xaa95dde0,	0x8eadfdf0,	0xde0f2b31,	0x56600129,
-0x86ce2e2e,	0xc0d5f0cc,	0xb0644830,	0xf8cf62dc,
-0x89a5e8e5,	0x6f9220f4,	0x138a2161,	0x8377c077,
-0xe57b4954,	0xf8119c9e,	0xdf31d61e,	0xd7b552b8,
-0x200a83f1,	0xd69be026,	0x1bdff0eb,	0xcf778290,
-0x2562ca46,	0x718e7a02,	0x45f0ab66,	0xb84bcd06,
-0xbaebcf08,	0x44622ecb,	0xf095b256,	0x2e542743,
-0x5265ca0d,	0x6aa19d3d,	0xc8df6999,	0x574be28f,
-0x3cedfc3b,	0x8af8622c,	0xf8b3b02a,	0x7d841052,
-0x3df0b3ac,	0x2222bc96,	0xe9cb2435,	0x0aea6617,
-0x7e37cf8d,	0x2df6b192,	0x68bfe6f1,	0xe3fda186,
-0xdee3c430,	0x3864b05a,	0x27f7e0c7,	0x22da6c6d,
-0xac701f04,	0xc271b644,	0xa2bd8531,	0x3234c0ac,
-0xb1a98a9f,	0x0f3ff2cd,	0x602c16d3,	0x4855cc53,
-0xaabc52ac,	0x4f01eb8b,	0x96356b71,	0x42225587,
-0x18266801,	0x2a082039,	0x2caa2fe7,	0xde119e92,
-0x71c1e48b,	0xabba2eae,	0x202cac3b,	0x5739c9df,
-0xb9c00f5c,	0x8d9576e5,	0x453c0787,	0x6043bdf5,
-0x6fa7e0a7,	0xe2333ef2,	0x6b2a0c15,	0x7e71897f,
-0xe35c05ba,	0x20405717,	0xdf236b3e,	0xc4a14743,
-0xe813650a,	0x8d823da6,	0x4f328186,	0xee43822a,
-0xe75f2227,	0x09dac319,	0x0d2c9a93,	0xda621940,
-0x542a21c1,	0x3a3c2e0d,	0xb1c9b51c,	0x669fa3af,
-0x7db40da4,	0x13badf34,	0x1f98c70a,	0xaa3a54b8,
-0xc293d8ca,	0xc677756e,	0xe5fb8158,	0x91005fce,
-0x23bcc33e,	0x08b671b1,	0x0430942f,	0xd65fdc74,
-0x3773de35,	0xc1c95b17,	0x0c4a72c9,	0x605a2a55,
-0x7c600ffa,	0x152462d7,	0xa6359789,	0xfa89d53a,
-0x0c749805,	0xcd4b8848,	0x72ba47f2,	0x7121f90b,
-0xb00412e2,	0x26dc3ceb,	0x4e73d8a1,	0x0bee25d1,
-0x50b5fe45,	0xfb8f884e,	0xf4d57158,	0x694fc3b7,
-0xcc8dbcfc,	0x4d32ac36,	0x032e50fd,	0xb941f702,
-0x28e41afb,	0x30ae4873,	0x5ba0918c,	0x58580421,
-0x25665153,	0x18fdff01,	0xe8276c28,	0xcabe3394,
-0x2f208a33,	0x823997fb,	0xbd9dfd10,	0x17323611,
-0xb36fe4ec,	0xfc93a594,	0x9ead87a5,	0x82140854,
-0xd311f9f0,	0x974da82f,	0xded93a6d,	0xa854574c,
-0x7513ded1,	0xabc9b23a,	0xa57f7303,	0xfa7b6404,
-0xb9dfaa3c,	0x087c8c57,	0x90d58229,	0x97b267a0,
-0xce357806,	0x7bf65936,	0xb8e5efc4,	0x88ad776d,
-0x1e2fed21,	0xbfdbb9ba,	0x12983ed1,	0x5ac1e8d3,
-0xe83d3b98,	0xc3ef70d3,	0x32a83173,	0x1adc355b,
-0x3028a6a2,	0x590487a0,	0x70aa8ce8,	0xb07d5eab,
-0x1210868f,	0x3c0bf159,	0x6a0a5d94,	0x98bfd28e,
-0x756dcccd,	0x8109af55,	0xe50dbaf8,	0x0156cef1,
-0x201207f1,	0x5e20750e,	0x13d20bb7,	0x438c45d9,
-0x2927e7a5,	0x5683cc1d,	0x374bc98b,	0xbf43416f,
-0xcc2b40c3,	0xc581b83c,	0xa245c55c,	0x15fac7fb,
-0x9bf99137,	0xc985db40,	0x1c67eb27,	0xc5bd3fe9,
-0x15c20413,	0x8f0a1928,	0xa52b860f,	0x243c53bf,
-0x940df584,	0xfba7bc08,	0x96ea0452,	0xb9b75629,
-0xa1bbf6e4,	0xb90c181e,	0x29cc3b57,	0xfc0b25ec,
-0xad06529c,	0x9fffafbd,	0x56d82b99,	0x69aa91f6,
-0x1a7e1041,	0x835fd763,	0x1aea44bb,	0x049e3d4f,
-0xb80b7881,	0x5b23d9a5,	0x19b6297f,	0x2d8a031b,
-0x8ff01930,	0xcf599b40,	0xa0c9f3c6,	0xdea7daa8,
-0x1bc2493f,	0x2328bf0a,	0x0a8bf88f,	0x46ca3b61,
-0xd7752cbb,	0x7fd049fe,	0x81360bfe,	0xc45e00c6,
-0x345038db,	0x9fa3c734,	0x21e04551,	0x4065ce89,
-0xebf537ea,	0xd917ebe4,	0x7f7442e8,	0xe979f46e,
-0xb35dcd5c,	0x89afbb69,	0x85b5ee4b,	0x4ecfd25f,
-0x4dd879c4,	0xe1092b39,	0xbc45c012,	0xdb2fbc66,
-0x000e1ecf,	0x0bdc46f3,	0xe9958406,	0xafff5eab,
-/*  411-MU16530c.inc  */
-0x00000001,	0x0000000c,	0x05181999,	0x00000653,
-0x810fe1ab,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x70f0e122,	0xff8bdd97,	0x3c8f6086,	0x9795839d,
-0xbcec5e8a,	0x86d79f5c,	0x8a7eba1f,	0x6ec298ea,
-0xdcbdea5a,	0x6df32e3c,	0xfe7b03a1,	0x1fb340f4,
-0xf8ccf55e,	0xcc895669,	0x61feb2c3,	0xab4b47b8,
-0xe7a4a809,	0xda5aee3a,	0xc063db2b,	0x2a3a37f9,
-0xda6620db,	0x1a9d74e6,	0x69cdf24f,	0xcf84d7e3,
-0xe1e91b0a,	0xd6b4524f,	0x11cb964a,	0x558bed59,
-0xdc6a7037,	0x82f49abc,	0x4a7b2b02,	0x08a54751,
-0x94848d50,	0x24a41d05,	0x66cd0fca,	0xdeca2bab,
-0x0fc94efb,	0x3d870e54,	0x15d83204,	0x8786e666,
-0x7cd9658d,	0x5a2a6bc7,	0x0728db3f,	0xe619d19b,
-0x8cc8cf68,	0x16da1fba,	0x1c9dcc2f,	0x4810e99c,
-0xad7b1c9e,	0x0e54555e,	0x7aaaecbc,	0xc75499d3,
-0x0918055e,	0xa9ddb6af,	0x343cffda,	0x46a2def7,
-0x3644376a,	0xa855ce79,	0xdb34da5d,	0x701039ce,
-0xc1ef8291,	0x9a3a8b14,	0x0c383a31,	0x5b6b1cd7,
-0x5a8ea284,	0x0e2b517b,	0x83fb239b,	0x12e3bbf1,
-0x99cdbda8,	0xcce3ff3b,	0xabe88eb5,	0xc9c39921,
-0x5d7e0f42,	0x6616c514,	0x461b4aba,	0x197e296e,
-0x25fe8129,	0x8dfcdccf,	0x3e32335b,	0x70429113,
-0x0a0f9efb,	0x3af19b8c,	0x9075c62e,	0x88e71557,
-0x8dd4d5de,	0x08ed7495,	0x5c8d3fad,	0xbc85f573,
-0xc73ac54c,	0x4b1ed289,	0x12e3145a,	0xcee63e6b,
-0x35e21802,	0xf7c82dd1,	0xa3bb53f2,	0x0159b02d,
-0xf9c1d59a,	0xb8ae1aa6,	0xa0f7356f,	0x25e861d2,
-0x294edcd9,	0xf56e6b70,	0xed89984e,	0x5670ade3,
-0x07c139c1,	0xc9825411,	0x96cd9e09,	0x7c00c1ce,
-0x548f761f,	0xffd1dfb3,	0x14dd9eaa,	0x9fefccba,
-0xe24e53c9,	0x90884598,	0x1c9454e2,	0x8993be4c,
-0x5257183d,	0xf7e5f329,	0x65156ca7,	0x9bd171b7,
-0x1d7a7430,	0x16d52022,	0x0144079f,	0xc0fa6a1c,
-0xefa5baf6,	0x8761237e,	0xcbb8ca36,	0x1738b2dc,
-0x9cd7f5af,	0x4dc1433c,	0xbde3ca0f,	0xe56ed03d,
-0x407d8de8,	0xf112be05,	0xdc3e12af,	0xe586e503,
-0x7d067e61,	0x4b9a3075,	0xcc5e88c4,	0xb5b719ae,
-0xc235198b,	0x82e68914,	0xc26af071,	0xa75d5123,
-0xd9c53cb0,	0xd7da2486,	0xe50307a4,	0x249f9b3b,
-0x2081a6fa,	0x8f3b0668,	0x20f90ba6,	0xa24c9cbf,
-0x314e3257,	0xee1e8ce8,	0xd17992e4,	0xeb667948,
-0x65912e6e,	0x25683578,	0x6db17325,	0xffa874a4,
-0xd417e80f,	0xe6129a2f,	0xbd0ad511,	0x87f41146,
-0x9ec4c1be,	0x2606e66e,	0xf5df093e,	0x116e20ba,
-0x0c8989a7,	0xf870d4c1,	0xf83b6ee8,	0x4dd7acbf,
-0x9a4496d4,	0xaa80f40c,	0x47f4f668,	0xcd4708de,
-0x9aee2116,	0x99f7564d,	0x6b05b918,	0x64ccb01e,
-0x505dcf82,	0x50467e3c,	0xe2e053a6,	0x8ffdcc1b,
-0xaddfc662,	0x6f9beee0,	0xccea8166,	0x745ae5ad,
-0x1a4841b4,	0x5c9c8d0d,	0x6d34804b,	0xa1a1168f,
-0x34bd6ca8,	0xc971daad,	0x57e80c5e,	0x7a67dc4d,
-0x302369c9,	0x824f478d,	0xf0b041af,	0x6b6133c2,
-0xba5afe3d,	0xa7ba18c4,	0xcf363d17,	0x90a2419c,
-0x17d1b6cb,	0xe760bf73,	0xf7e60431,	0x6820ae47,
-0x1cea1e8f,	0x349c1eaa,	0xfd35592d,	0x41263d61,
-0xefbc5ea3,	0x13b634d0,	0x7b414a1b,	0xbfedbbca,
-0x16e9afc0,	0x54262b9c,	0x659c9795,	0x0dbf38e2,
-0xf9d87667,	0x3788ead2,	0x36efcae2,	0x6f107cfd,
-0x9b4eab95,	0xcf29e1ae,	0xb65461df,	0x21e9125a,
-0x4e71d0c8,	0xedcba601,	0x8016d03c,	0x92cf5b98,
-0x6db3bfef,	0x087ee378,	0x8e52f7c8,	0x69e3ab9c,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  43-B_c6_617.inc  */
-0x00000001,	0x000000c6,	0x12101996,	0x00000617,
-0x3371797e,	0x00000001,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x10ae4204,	0x7a759c51,	0xf7cca534,	0x9d78b93c,
-0x90745514,	0x83bf4995,	0x5262b38a,	0x021369cb,
-0xc94a310d,	0x4f9cb983,	0x4b3fe4ce,	0xd80aa41f,
-0xba1f9fd2,	0xe9916766,	0x69ef0ae4,	0x0b38b9fb,
-0xa4e9c77a,	0x8a55c68c,	0x331b53b9,	0xed09d30b,
-0x06198c27,	0x997ea121,	0x6138eaa8,	0xff36326d,
-0x3d97e7d8,	0xed8d479a,	0x3997175c,	0xbc55ed5c,
-0x174afb79,	0x7424af12,	0xb7959530,	0xaa116231,
-0x995da61c,	0x06a48d64,	0x2e20a822,	0x990d8968,
-0x07dae08e,	0x15cd8dbd,	0xe5faab09,	0xc6a9e802,
-0xc71afd62,	0x095ac753,	0x633d3e2f,	0xc1d14895,
-0xa98eaea0,	0x909d2f66,	0xc8fe0fed,	0xd9e19ef6,
-0xafe41bcf,	0x0d29c0ce,	0xda036076,	0xd91e9e15,
-0x819c7382,	0x7c2b057f,	0x7d5c7099,	0x7931c9c7,
-0x05e436e5,	0x41c47269,	0xd692a355,	0xeddc7df8,
-0x990e41ab,	0x4047ce2a,	0x7b9ce684,	0x4427a413,
-0x7b8d9361,	0xec29de72,	0x7744ca39,	0xc9438681,
-0xd546020a,	0x7e14e508,	0x0cafea15,	0x885ae74b,
-0xbf07a64e,	0x9ad83612,	0x381cf376,	0x4b313629,
-0xe6b15a73,	0xab9caec8,	0xfda2bfbf,	0xb71f9935,
-0x915b31a3,	0x958db25e,	0x080cb4f3,	0xcc2280d6,
-0x977afcf1,	0x43d26f23,	0x84625ffa,	0xb26c1bf2,
-0x22adf88f,	0xf2835d29,	0xca277501,	0xc4557829,
-0xabb2a280,	0x35b6b40d,	0xec3e551b,	0x622e0c48,
-0xa9c18623,	0x6ddc2969,	0xeab9876a,	0x7c021a29,
-0xe8b48860,	0x03a893cb,	0xf9c2772e,	0x99a131c2,
-0x7fb1b9c8,	0x7588562b,	0x330c3ca1,	0xddf79e26,
-0x102871f0,	0x46b59c1b,	0x5be784b2,	0xa13472df,
-0xf77a699d,	0x1e19cf47,	0x2df8c51e,	0x3c92be60,
-0x0e4c4edd,	0x5809d864,	0x78305a32,	0x2d8d80a6,
-0x5f6693e2,	0x384ca99b,	0xbe5dca8e,	0xce7fbe66,
-0x4e64135d,	0x979ee9c9,	0x61700566,	0xff20c623,
-0x4b1ccbf9,	0x2f507b1c,	0x5c021650,	0x7844f2a9,
-0x0528f939,	0xcd9f945f,	0x7a362c85,	0x7a76da60,
-0x5738ca7b,	0x4828eecc,	0x2d9ac738,	0x0912a9b4,
-0x15775709,	0xb719ff07,	0x9578abf6,	0xf9f85ff4,
-0x30621b30,	0x1746c5be,	0xef339736,	0x641da556,
-0x54b09e20,	0x4d5785fa,	0x619656d0,	0x0d0dc731,
-0x79c63339,	0xb4396838,	0xafae5935,	0xacafa08c,
-0xfc3bae80,	0xe324c4a2,	0x6e883362,	0x72ba13ea,
-0x1baaa3c7,	0x0403a063,	0x54cc43fa,	0x70a4f3c1,
-0x93b1b519,	0x4e4be8a6,	0xf273929d,	0xe6e95077,
-0xb9354f62,	0x6026576d,	0x42eca8c0,	0xe811cb1d,
-0x88051a86,	0xaf60322f,	0x74c1234a,	0x152dcec4,
-0xc46603dc,	0x0826d833,	0x6610ba94,	0xbdb15d54,
-0xd351f73a,	0x8f665ef8,	0xd352611f,	0x57ea12fc,
-0x9e7865cc,	0x44a6afd9,	0xe7cf2546,	0x152d3a4a,
-0xa9f3227c,	0x5a6b083b,	0xe9a760ca,	0xfacd5b6c,
-0xdfead584,	0x37bdd3e1,	0xa16024a1,	0x81642637,
-0x1fceca59,	0x83a6266c,	0xe18c21ae,	0x8588db23,
-0xc857b0e7,	0x3a4cda5e,	0x2997ab21,	0x91ae1c25,
-0xf480650d,	0xc55e3b7b,	0x2fb4a5d5,	0x8a666356,
-0x49ef5393,	0x6f6a6451,	0xe4397937,	0x60ad57f8,
-0x9c85560d,	0xcbe6d3e5,	0x7ea9bfc6,	0x1913e322,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-0x278cb2c0,	0xf41d6be8,	0x839b9b57,	0xde7df900,
-0xa6d05386,	0xf79d8944,	0x24d4273d,	0x878456fe,
-0xbc0006e2,	0x4cbc49c5,	0x16684d87,	0x1f2c79a5,
-0x847dc8fb,	0xe873c43a,	0xc92223f2,	0xc9c193d4,
-0x8f43d21d,	0xc723f894,	0xa0ed9e53,	0xd0693391,
-/*  2185-m04f650b.inc  */
-0x00000001,	0x0000000b,	0x05102007,	0x00000f65,
-0x69b15bba,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x2a54c7a9,	0x18ecc912,	0x7358b4aa,	0x6c06e153,
-0xb5f59e8c,	0x5f0a4af0,	0x6d268037,	0x1e392e7e,
-0x5ca39c5c,	0x70fe95e4,	0x869d12af,	0x54556b68,
-0x4576a7b2,	0x0ea27e20,	0xe6e118cc,	0x83ecc15e,
-0x9cd84449,	0x6924f884,	0xd8bddae6,	0xfc71f620,
-0xb0c24817,	0xa10b79e5,	0x2c56fea8,	0x69758fd1,
-0x3c186b7e,	0xc566fc81,	0x48bc078a,	0x4591e6f1,
-0xc72faa8b,	0x5c9027ef,	0x223aaa59,	0x2a807097,
-0xbd6e5146,	0x633e39c7,	0xa920f5ef,	0x4cf93d3f,
-0x2a8f0489,	0x328ee7bd,	0x0a3c2e87,	0xf6b3d878,
-0x7ff62d30,	0x59f75c17,	0x50335c28,	0xa83780fc,
-0x2f13e02e,	0xdd93d262,	0xc1ff68f0,	0x5f160889,
-0x6784d2a2,	0x9974c4d9,	0x27f0989a,	0x06c3c9fb,
-0x4d442353,	0x7df6af36,	0x9cebeae0,	0x4593501d,
-0x895bece7,	0x163e3662,	0xcd0623f4,	0x73716c92,
-0x93647da3,	0x571d2da9,	0xe137e743,	0xb61c0175,
-0x655af0f9,	0x46b0ef79,	0x843e460c,	0xed0086c3,
-0x3717040a,	0x94d5c66a,	0xd87a171e,	0x71b71821,
-0xf352b38b,	0xf3204628,	0x6db9bf37,	0x27c99d15,
-0x68fd4a77,	0x54080a7a,	0xc74f52f5,	0x5758a7ec,
-0x935f34eb,	0x2f92bf2d,	0xdfc713e0,	0x6be2fa22,
-0xf211177b,	0x7e573e70,	0x47772c3b,	0xdc7e840f,
-0xd80a3068,	0x5bb261bb,	0xfe6e2ac8,	0x84c644f6,
-0xa56f20aa,	0xcc9800dc,	0xfc197391,	0x670d90ab,
-0xbb968979,	0x9b8b59e4,	0x16901654,	0x243fe5cd,
-0x8e46dd2c,	0x6d5b5e96,	0xc3b2513d,	0x52b14d01,
-0x212c5ea7,	0x2c32cb67,	0x22f5b15d,	0x7be025a8,
-0x96c87a0d,	0x57032238,	0xd9f871ba,	0xf2264613,
-0xd9a21a3d,	0x6a5a3214,	0xe8c86949,	0xb07946ea,
-0x2ff9fb1f,	0xe0954cfc,	0x0e9a9f69,	0x602d7ab1,
-0xd3cb1e2f,	0x862c7923,	0xe75590cc,	0xc27bd7da,
-0x433fd3fa,	0x753bf909,	0xb2144e9e,	0xaf30e910,
-0x535e12ce,	0xf2dbbb89,	0x707cbeac,	0x797ca200,
-0xc8c01502,	0x95990002,	0x546f641c,	0x21f3d8ed,
-0xbe76db45,	0x4cd4f49d,	0xb6d0ea56,	0x520439ae,
-0xebe279cb,	0x3f1a7c2a,	0x619235a8,	0x56405f42,
-0x501720d7,	0x4a7ef865,	0xfa717641,	0xf31ca260,
-0x91316b95,	0x54ae5249,	0x341b05b5,	0xaf7d573e,
-0x334bba10,	0xd373b388,	0xcdac2e47,	0x5ae308df,
-0x9478800a,	0x86d004b2,	0xa66c7fba,	0x37071be6,
-0xd34a6235,	0x4d9f247b,	0x783c21d0,	0x65241a87,
-0xd66775d0,	0x1cc8c436,	0x9ef955dc,	0x4dbf6d44,
-0xbea46f13,	0x682282ac,	0x5b4c6481,	0xcd17f229,
-0x61f16e29,	0x488d8b12,	0xad66f71c,	0xb40314e8,
-0xd0a5c610,	0xe260f3e1,	0x5fc8bfc4,	0x61360790,
-0xd148e5d1,	0x945bf81b,	0x762f3ed6,	0x77fcc860,
-0x7e6f7682,	0x5f72b5d0,	0x646345e7,	0x25aae6ff,
-0xbb147982,	0x49545897,	0xf6de875d,	0x518f225d,
-0x908cfe23,	0x064556a1,	0x313228b7,	0x869e9b63,
-0x1b292069,	0x7c0055c9,	0x7d6b8678,	0xcbab0381,
-0x7c215f80,	0x9189d566,	0xf848d9aa,	0x55535f2d,
-0x3958620c,	0xe6c0081a,	0x6b2bbacd,	0x0a0ad463,
-0xcc3221df,	0x783aa0d5,	0x289468fd,	0x7f813440,
-0x02a8ac44,	0x1d893476,	0x1272a61b,	0x518f3582,
-0xf85a6840,	0x6095b5bc,	0x552a43c0,	0xdb464e87,
-0xd08f74d8,	0x5ac3d2ec,	0x70996668,	0xa13872d2,
-0x431ed665,	0xce6a7742,	0x10f8b5ae,	0x4767891b,
-0xe411709b,	0x977a5301,	0xc726cca4,	0x21460e48,
-0x8165b05e,	0x60a25ecd,	0x7cd8580d,	0x5670cf27,
-0xb504c67e,	0x21f9ad8b,	0x2737c2e0,	0x60a7561d,
-0x564f20e6,	0x583e4d1e,	0x8afb7fcf,	0xd117a013,
-0x2dedeba3,	0x4c42ae87,	0x6fc8074b,	0x90a68e2a,
-0xaa4821e6,	0xd1b5f3d2,	0xba3644dc,	0x497d8f52,
-0x0625d697,	0x8dc5e978,	0x7d23526e,	0x0a476955,
-0xc476d8a6,	0x6f34a681,	0xc9e46006,	0x66970ab9,
-0x1bb0bbf2,	0x280d0090,	0xd35cf8c9,	0x439b2a9e,
-0x8ac72732,	0x674df5c2,	0x9d241d38,	0xbbc0ee7a,
-0x1ef54bc1,	0x49d92718,	0x7736f8bb,	0xf95f6a52,
-0x51d7dbf2,	0x9ba738eb,	0x948c1787,	0x65962750,
-0x1b15490c,	0xf98112d9,	0xe9a7450c,	0x49954e37,
-0x8f545c8a,	0x4c75ecfe,	0x1c81eea7,	0x11c13f67,
-0xa49b57a0,	0x56efc5d0,	0x3a93fbc5,	0x4d26f480,
-0xb05ac1e7,	0x2fcfdd88,	0x94533ae9,	0xa001c646,
-0xf4c3290e,	0x67199cf4,	0xd8b84246,	0xd1f2313a,
-0x93cf2a11,	0xb0cedd94,	0x6636e680,	0x7f28ae19,
-0xb345e7fb,	0xd1e4c561,	0x007b7886,	0x427e8738,
-0xbcd314d7,	0x6b86e787,	0x54d403c2,	0x177baa6b,
-0x3fd8cb1e,	0x6c2a7756,	0x5989fe90,	0x477f06ac,
-0x5e16aa49,	0x39b1cb69,	0x5795a5e2,	0x9f1b223c,
-0x9537e26a,	0x6bce6cb4,	0xb7b6d079,	0xd2b74b15,
-0x488e6a89,	0xbd79ca3e,	0x26be9f93,	0x4acb5561,
-0x2d88ccad,	0xe5ec5edf,	0x170f68da,	0x42c16b5c,
-0xba2cb190,	0x48243011,	0x75ab800c,	0x25728407,
-0x7b2cd7b3,	0x519bdfc1,	0xfa1eab24,	0x787a8b76,
-0xb0c85b5d,	0x1dd215a4,	0xadafdee4,	0xe1ebba23,
-0xdd5a59cf,	0x71712870,	0xeae95666,	0xa65ba058,
-0xff3f0885,	0xcbfbb4dc,	0xdfc7ac25,	0x71c07273,
-0xdbb6086e,	0x9b39fda3,	0xb27ec2f4,	0x6efa152f,
-0x76c1bd96,	0x7e4f0c12,	0x55179b81,	0x011fe1a8,
-0xcb7404cb,	0x7654df7c,	0x2a66dc3b,	0x79ea9141,
-0xbefe239f,	0x05287ade,	0xa7667a14,	0xf214cfd0,
-0x8d217994,	0x7a006397,	0x3cfa146e,	0xad719332,
-0x84b65556,	0xe1457370,	0x25fbcdbd,	0x52d3ab75,
-0x2932b5f2,	0x9a8fae3c,	0x2372ab7a,	0x5ff75c43,
-0x7c10085c,	0x476c0115,	0x5a2e4b6f,	0x0d250055,
-0xf0ffd556,	0x50da2ec7,	0x08c38028,	0x643d0953,
-0x7e773b1a,	0x0b89dc21,	0xa023d976,	0x9d6b3e83,
-0xe0148bcb,	0x6d362334,	0xdcffb904,	0xfbb85c9f,
-0x50336118,	0xae98a62e,	0x807b1eb4,	0x58bb652e,
-0xaa5ee667,	0xce20b77b,	0x342e21a0,	0x5daf250a,
-0xeccce81f,	0x48cb298c,	0x1c3c10a5,	0x3be0c1c7,
-0x6a7f3ff1,	0x421ed684,	0xc62ec582,	0x41db8062,
-0x13b32c82,	0x01fa6e17,	0xa1b5c0c2,	0x9a103563,
-0xa8a5573e,	0x739774f2,	0xd0ce41b3,	0xe45ca941,
-0xd57b5f99,	0xb1b5dbbd,	0x56fbf5f7,	0x4c8f6091,
-0xf71f2ad6,	0xe189ef6f,	0xff318027,	0x01b3a07c,
-0x3b577d20,	0x703e40d0,	0xdc943755,	0x40ceec0f,
-0x875f6f75,	0x23c689c0,	0x5edec53a,	0x68e7c50c,
-0x4aaf4a1d,	0x4081c16b,	0x4ad8409a,	0x8b813650,
-0xdd029252,	0x776b0335,	0xb61af09a,	0xc675cc28,
-0x18d32d7b,	0xa5e4d889,	0x4d9c4bf6,	0x737fa6fe,
-0x5922b3b1,	0xebd1c6b5,	0xcee18d5a,	0x06511330,
-0x8fa95e1d,	0x785789f8,	0xab4d16e4,	0x709155a0,
-0xb23ce349,	0x10946eb8,	0xf2e9a02e,	0x7e8795cc,
-0xb5777aef,	0x532e88d8,	0x775430aa,	0xf60b3548,
-0x40422cfc,	0x60401e57,	0x8f767a2a,	0x90372f3b,
-0x9c013672,	0xf469ffcf,	0xabc6d7ab,	0x7e0a1479,
-0x79058a26,	0x96f327dc,	0xc356d4f9,	0x183db73a,
-0x6b3cb70e,	0x5a63aa80,	0x442c171a,	0x6b87a7d4,
-0x1e24ac07,	0x1529e09b,	0xfb59c944,	0x6705a5af,
-0x8669338e,	0x4cfb8b4b,	0xb3997f75,	0x3a5c3716,
-0xba26316f,	0xbef4d01f,	0x35a2facf,	0xeba8e47f,
-0xb5069dd2,	0x258ecc43,	0xa5d27756,	0x272095eb,
-0x092d5fe3,	0x849da615,	0x0f2bde22,	0x688e8203,
-0xf233aaed,	0x655f7cd5,	0x4d63fc11,	0xdfbbda49,
-/*  407-MU16522a.inc  */
-0x00000001,	0x0000002a,	0x05121999,	0x00000652,
-0xc8b34cc7,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x76f00e60,	0xb9434a7f,	0x5e9ab4c2,	0xcd0a8081,
-0xcc2c6b4c,	0x481bff6c,	0xa81c6bb8,	0xef5c8363,
-0x6e44f08a,	0x9011d878,	0xed520c57,	0x22571828,
-0x939f7c98,	0xa8e6d071,	0x2accc70f,	0xb37b2c5e,
-0xff6baf05,	0x016be7a4,	0xea2623ed,	0xecc84aec,
-0x19c7c229,	0xf7f0886b,	0xc12cadb9,	0x27f0f5ea,
-0x80a157da,	0xe703242e,	0x6d0bb522,	0x9844e0d4,
-0xa58dec65,	0x7567ffe7,	0xe80c9da4,	0xa331e7d5,
-0x5a4b6453,	0xe638a61b,	0xa6cbd089,	0x1eac6267,
-0xa4f3e8ec,	0xbba4fb32,	0x317b7c6b,	0xe17fac53,
-0xc8e0673c,	0x28538606,	0xfbd44993,	0x8ec7e8af,
-0x6c462f02,	0xe72751cd,	0xb22bc0ef,	0x3ad6128e,
-0x99a6222f,	0xbf4c4e6f,	0x122354eb,	0x8fb39904,
-0x9058153a,	0x14e61acd,	0xef511b6b,	0xa9b2f095,
-0x7eaf14fc,	0xdae7a10a,	0xb1d1b2ba,	0x769b0eab,
-0xdb522452,	0xb23d5e86,	0x7de3e9a2,	0xfd2ac952,
-0xff866004,	0x45a75e71,	0xa1e060a2,	0xbfc1c2c9,
-0x424198ac,	0xf823bdcf,	0xefffc562,	0x68b8edf7,
-0xfd4e6d1a,	0xc1f23855,	0x20c0f4e3,	0xa029841b,
-0xc5bd6cfd,	0x79f2ad6b,	0xa13b03df,	0xee971307,
-0x363b0da8,	0x9c077042,	0xb30115b6,	0x3ddb5013,
-0xdfc3243f,	0x85e4159e,	0x0113acb4,	0xebb4bcdf,
-0xff244b7d,	0x12a3aaf2,	0xe19e9488,	0xeb7cefc2,
-0x566252d7,	0xe186da08,	0x93e670ad,	0x7ce6d3b7,
-0xd75bf7cc,	0xbabb15c5,	0x69295dab,	0xc5b3f71d,
-0xf08dceb8,	0x7dd96027,	0x93578a64,	0xd314e608,
-0x78264a52,	0xa08e7650,	0xcdb08bcc,	0x7107fc39,
-0xe51d6c66,	0xd52df3b8,	0x379509e2,	0xc25233d3,
-0xdd9f284d,	0x0682ad5b,	0xdf1bbe5c,	0xd2b96b14,
-0x5442e8af,	0xca921855,	0x99f35d84,	0x72b7edf9,
-0xcabccee5,	0xa477caf9,	0x6fb0014c,	0xcea152be,
-0xfb8253d1,	0x70437bb0,	0x8d9c4443,	0xd8a6177d,
-0x78023d12,	0xa64f4ff3,	0xcbedd7f8,	0x662d9a07,
-0xf45fdfb1,	0xc21ce1cd,	0x30a109e6,	0xcf4abf94,
-0xc59fff95,	0x191f3b05,	0xc36a43a4,	0xdc0bd9eb,
-0x5b2f6677,	0xc71533dd,	0x92eb59ad,	0x6ee37cc1,
-0xcc7fd822,	0xa90f9c92,	0x74860638,	0xce475653,
-0xfd8b3b2b,	0x62fcc55e,	0x907466f0,	0xc8ff579b,
-0x7a953138,	0xb7e9a3d5,	0xcce7f647,	0x72e27e2b,
-0xf37401a0,	0xd12302eb,	0x33518c48,	0xc5c94836,
-0xdd2c112d,	0x17f0aa48,	0xcaf068ab,	0xd6d75439,
-0x5d96ddf7,	0xdcf939d6,	0x9c50d0ba,	0x6b16166a,
-0xdfbdfa9f,	0xa310daa9,	0xde9c8db9,	0x2131f1d7,
-0xd445fc23,	0x0a0cc3ae,	0xd58e33b6,	0x7382cbc9,
-0x15c5b405,	0x76f11b66,	0x6f939b91,	0x1c4d4a57,
-0x65d92f91,	0x75fa89c0,	0x12f3ac58,	0xcdeb4113,
-0x6caca31a,	0x53e4ec31,	0xdbdda96d,	0x8bb3b1e1,
-0x5f325871,	0xc920019c,	0x8fd12227,	0x037dcd85,
-0xd5a992b0,	0xcd68d006,	0x02bbf3d3,	0x5c477b08,
-0xc81dfb22,	0x919d0e0a,	0x5e3dfe14,	0x8b94d4c1,
-0x8ab037d1,	0x003ffd27,	0x91fc1b17,	0xdcb63a69,
-0x0aa59da9,	0xd54442a0,	0xc832489a,	0x7499b7e4,
-0xdf8bfe4f,	0xbe5aa6c9,	0x61a559bf,	0x4d60ef8c,
-0xa8f652eb,	0x15afb0ad,	0x52a9ecf3,	0x4895b467,
-0x143a5c34,	0xbb0a916b,	0x53e69a9c,	0xf53bc838,
-0xb4b830c2,	0x53240c80,	0x536aedc6,	0x89ff32ae,
-0xe8d2e0c8,	0x718b7504,	0x8e6cfcc5,	0x9615fc2d,
-0x7405a9b4,	0xf45b4168,	0x6af78312,	0x1eea41f6,
-0x1d1b43a6,	0x1822d9d9,	0x1b987e6d,	0x13bac770,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  618-MU268602.inc  */
-0x00000001,	0x00000002,	0x05042000,	0x00000686,
-0x332c50fc,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x7cf009ee,	0xde212d8f,	0x40fc8031,	0xcc7df987,
-0xd9446c69,	0x534b5354,	0xe8a6009c,	0xb2804e1e,
-0xc923d256,	0xdcecf51c,	0xc412b4bc,	0x73396f2b,
-0xfd04f60f,	0xd0d7f4d8,	0xa8f9dfe5,	0xb8defb40,
-0x4edffe88,	0x646d5420,	0x35e2a45f,	0xd37c054d,
-0xc22954f9,	0xc1146393,	0xd245381e,	0xeae167e3,
-0x43675583,	0x60ab176c,	0x9736b9c6,	0xbff00b26,
-0x16483271,	0x9a701ed5,	0xb458a41c,	0xf5bee887,
-0xed55210f,	0x7c0370e1,	0x820c203f,	0x002add3e,
-0xea958855,	0x61fcdaea,	0x6ad4a71a,	0xb92bc614,
-0xe3a29616,	0x86b62b61,	0xa59b657f,	0xf2c3575b,
-0x5d7ac6e7,	0xddeb874d,	0x8359caa3,	0x897b7a7d,
-0xe3e5e8b7,	0xf49ecd45,	0xc28a6a45,	0xd6dbe138,
-0xb30eaeb2,	0x1eaa65da,	0xb1d64e7c,	0x89cfa875,
-0xafe14ac6,	0x33d31a40,	0x3bf217d8,	0xb5ee8cce,
-0x943e91cd,	0xead5aeab,	0x6d4545f3,	0x0207a17f,
-0x27c0e926,	0x0607325c,	0xfd73ab50,	0xf875a959,
-0x715e91c1,	0x27286747,	0xd9e8d5d7,	0x2b5f4eef,
-0x48e7507c,	0x631e9526,	0xbe652d3c,	0xf44bdee1,
-0x2f0635b5,	0x82f59aa3,	0xc952dd93,	0xdfd7664a,
-0xa6c6a511,	0x05f8a567,	0xdfbdd235,	0x93b0f7fa,
-0xf230a0e8,	0xb3daf958,	0x9cfb1179,	0x581a9a23,
-0xe90d99ec,	0xc6d45f7f,	0x00cc9419,	0xa033e134,
-0x3e0c5427,	0xc51880f8,	0xe53d3f75,	0x76e46b82,
-0x39216716,	0xc7814c59,	0x3e950f77,	0x796fb5c6,
-0xce98e498,	0x93214b85,	0xe3cc1e7c,	0x85a27ccf,
-0x3b6985e5,	0xda99f6dd,	0x2525fa5a,	0xb9597992,
-0x8771a641,	0xc233d544,	0x365b0022,	0xb6f2adb3,
-0xc0a5ae64,	0x11b94f17,	0xd3bc61d7,	0x4b3182fd,
-0x1f3cc702,	0x074b85e3,	0x3abfe94b,	0x2f6e8c3a,
-0x43a39fa5,	0xea95a0cf,	0xec6ca230,	0xeaed2195,
-0x5261d5a7,	0x1e083739,	0x24cfc756,	0x133692f3,
-0x68cb9b9b,	0x40a27089,	0x48962268,	0xca1ec286,
-0x2a5ef51f,	0x3e9aa09f,	0x9cc0581a,	0xad33b532,
-0x1d365147,	0x119e78c5,	0xf99f66bb,	0x14a97e34,
-0x26e61f8a,	0x1f80e435,	0xfec0054e,	0x8369b072,
-0x1492b201,	0x798cbe1b,	0x05f5aa9b,	0x68c5e6e1,
-0xfd3d08a3,	0xf7ce8767,	0xd446e704,	0x9595a872,
-0x1361943f,	0xea238ac6,	0x6b40e36d,	0x3239eb09,
-0x14c1a58f,	0x10a72214,	0x18716029,	0xffba4d2c,
-0xefab5b79,	0x40f2e49a,	0x64518f90,	0xf0983888,
-0x1b6f28f8,	0xb4e9bdac,	0x6617d010,	0xcdb49028,
-0x4fb8325b,	0xd51ae489,	0xc49e5b0c,	0x4ce77f09,
-0x164c5ed6,	0xea407c38,	0xcedd6d50,	0x02ca2e1a,
-0x300ecc34,	0x31f1229f,	0x35b3459c,	0x0a9971e3,
-0x647fcefa,	0xa54d30bc,	0x14e05e16,	0x459e8d66,
-0x42065188,	0x19e93008,	0xda980fa1,	0x71431597,
-0x997abb16,	0x3c39889f,	0x549de523,	0x2420d441,
-0xc87779ef,	0x475d7dbd,	0x68999988,	0x89ad4a7d,
-0xf3da0990,	0x1def1403,	0xedd8d0dd,	0x59eb7a7f,
-0x67642d29,	0xc2454f39,	0x88217cde,	0xcdefaf71,
-0x12588b55,	0xf48d0ce7,	0x88b7c3d3,	0x5c62b02e,
-0x21c05aa4,	0x98cf763b,	0xc02f860e,	0x8a1bf23f,
-0x676d2f90,	0xd73b4c08,	0x02dda911,	0x60ba8c76,
-0x3ed5df97,	0xf4ca9795,	0x9f7b6271,	0x4be6b998,
-0x69a4a139,	0x3a3240cc,	0xaa40b9a8,	0x41e08780,
-0x738f645c,	0x79170059,	0x231ff3b2,	0xe34f6b4e,
-0xa8021b05,	0x8eb72629,	0x18dbccd1,	0x88f020d7,
-0x467dc6b0,	0x72a7070c,	0x0f65f00c,	0x8150ca60,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  534-MU16810d.inc  */
-0x00000001,	0x0000000d,	0x09211999,	0x00000681,
-0x31708166,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x710e5240,	0xab8bc2df,	0x6e652d5a,	0xcc16718b,
-0xaa5c7d1a,	0x43ac1ba0,	0xbdf8684e,	0x82565fa7,
-0x1d108edc,	0x96d2d5a2,	0x85f783a0,	0x16e4cba1,
-0xbc311213,	0xc36c45a2,	0x443b8d2b,	0xfdc5e9ce,
-0xbb6f8637,	0x47011b8b,	0xf3898e4a,	0xb3e90f68,
-0x60af6e3a,	0xff9d3de4,	0x9fb2333c,	0x5a1a39ce,
-0xffd75d72,	0xa60cc2c0,	0x5729267c,	0xfc6d2da7,
-0x8a2c8ae7,	0x71aba5ba,	0xb639ff31,	0x8d1642b8,
-0x3aa67efc,	0x9f786473,	0xaedec560,	0x1acb694f,
-0x97582a6f,	0x8dc17ea5,	0x19636cfe,	0xb5032243,
-0xc46f764f,	0x3a5d3833,	0xf3d1a2b9,	0xc22e59be,
-0x15e0b2f3,	0xe58eff24,	0xc679600d,	0x21a3a845,
-0xc11cc921,	0xed2f5061,	0x2d4db0d1,	0xcc0cc78f,
-0x80197c08,	0x20739d8a,	0xc92ec866,	0xacef343b,
-0x47c0913a,	0xee8a69e4,	0xa7b0157e,	0x4c3607a9,
-0xcc7ff7ea,	0xb0a36667,	0x41d1bcf0,	0xf54c42d2,
-0x946c590e,	0x6da18fe9,	0xf20df0e6,	0x984a2160,
-0x479becd3,	0xfb11dd36,	0xbb816653,	0x60c605c2,
-0xf52efe8b,	0x90a9f863,	0x69654bfa,	0xf0f03f7c,
-0xbf0498d5,	0x68708d82,	0xdab94924,	0x92371217,
-0x603feed7,	0xf0ff8329,	0x9c8769df,	0x6d40ab73,
-0xd8fd132a,	0x9335543f,	0x40fd3abb,	0xf25665a0,
-0x93fe56a6,	0x682a3b24,	0xf3a0f14a,	0x97e92084,
-0x4e8736a3,	0xf322db48,	0xb65de2ad,	0x6af68474,
-0xfd6dae0d,	0x953afb0e,	0x6ef22a82,	0xfa7a3d7b,
-0xb5fe683f,	0x647579c3,	0xd184e7db,	0x99ec7c97,
-0x66486a26,	0xf08c8290,	0x94eb3fce,	0x6305e16e,
-0xd61dd210,	0x9b8bdbba,	0x41a4b4f5,	0xfca38a75,
-0x9c55c7a4,	0x6a4b1f02,	0xf277077a,	0x900e3d03,
-0x4f173146,	0xf6fbf7c8,	0xb2636cb2,	0x6329a9d7,
-0xf2697eb4,	0x90f80f6f,	0x65de6167,	0xfc6cd065,
-0xb4326188,	0x67507c3a,	0xdf3179ff,	0x91207c0b,
-0x6408ad58,	0xf7e7d2fe,	0x999af7c0,	0x6a994828,
-0xdaecedf4,	0x93cba457,	0x4d924b31,	0xf12b5ae1,
-0x9563d541,	0x65bd28f8,	0xfa87a363,	0x983adc3d,
-0x45c4f64d,	0xfae3e1ef,	0xb2eb287f,	0x6050f699,
-0xfb28cfb6,	0x999b1d45,	0x65027980,	0xf4e507d0,
-0xbbd059b7,	0x64cb2688,	0xd29dff15,	0x90927c2c,
-0x6d52471a,	0xf64fc745,	0x9e4050ff,	0x68b66e3f,
-0xd0a1dd96,	0x9fe8a5a3,	0x454c936b,	0xf926115d,
-0x9bfb60ff,	0x604049aa,	0xf3509e5c,	0x9d6cf26f,
-0x4d777c5a,	0xfd7cd5ff,	0xb15d4f35,	0x6b1aa6e3,
-0xfa279f20,	0x94916fae,	0x9b04dbcc,	0x600defd9,
-0xf2977cd8,	0x65fa64be,	0x968feaee,	0xc11681af,
-0x66568af6,	0xa539a4ee,	0xcfed5cb1,	0x108445de,
-0xa603dfdd,	0xbf5ada02,	0x14b868c5,	0xb2d3b8d2,
-0xbabf3637,	0x0c25bfbc,	0xb7a4c247,	0xf2837e05,
-0x062ce963,	0xfcb65c46,	0xc6d190e7,	0x4dfce123,
-0xcb0bf4c7,	0x8bff9d9d,	0x6794e002,	0x2879661e,
-0xa5e93199,	0x77be4be8,	0x22fe3324,	0xb943e4ef,
-0x73463d52,	0x31471050,	0xb68fd63f,	0x84cad24f,
-0x343d922b,	0x42b9ab31,	0x88ee1549,	0xe913e2ab,
-0x4a127048,	0x5057f79f,	0x636eb512,	0x42e02f9c,
-0xd3a8b863,	0x9bc40609,	0x4a18edb5,	0x86a4bdaa,
-0x91819a4b,	0x12a11e17,	0x8a6d7f21,	0xf42998d9,
-0x132b6bbd,	0xe3239feb,	0xf52519d7,	0xada08128,
-0xe6febacf,	0x44e15a80,	0xa977610a,	0xf56a8665,
-0x4693b6f0,	0xb8386320,	0xfcf7d071,	0xb8a1128d,
-0xb2a45d18,	0x075a2095,	0x98ebde53,	0xe8762eaf,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1072-m04f1305.inc  */
-0x00000001,	0x00000005,	0x05082003,	0x00000f13,
-0x386c53da,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x5001ae2b,	0xf153d2b4,	0xf4fe5845,
-0x7353305d,	0x2eb3bfa0,	0xc468112f,	0x82583061,
-0x233d5868,	0x9ef78991,	0x1ecdc4a1,	0xd6543acc,
-0x6700a864,	0xeec1b6d5,	0x35b67f1b,	0xaee05186,
-0x769f6bc1,	0x427908f3,	0x39b58424,	0x05c25438,
-0xa84809d5,	0xe971a10c,	0xa160654c,	0x73be48e7,
-0xe1012a12,	0xf051e0cb,	0x2bbe146a,	0xa7a78d04,
-0x2e9fa622,	0xc5109d9f,	0x15551c3a,	0xe6e2a600,
-0x1cf01aa4,	0x49c58079,	0x4c8d88ae,	0xbbf2d0a2,
-0xa95df3db,	0xe6c8c5c7,	0x4f2c1041,	0x50c70186,
-0x3b777e75,	0x8b1fe76f,	0x28579fc1,	0x3fba0373,
-0x510da380,	0xdf1ac785,	0xd1f0f390,	0x167f3702,
-0x6673bc0f,	0x3406e180,	0x02538338,	0x1cee4705,
-0xd444ebdb,	0x11d3af33,	0x9f753475,	0x2fca1eac,
-0x49441be3,	0xac80a36c,	0x9ae8ba7b,	0x5aee4d23,
-0x3fdb6203,	0xb90c24a1,	0x94b1260c,	0xc26cfdab,
-0x7f7b16cf,	0xd41bfcdd,	0x7bfc2c3f,	0xb6fda687,
-0xaad0271f,	0x683e43fe,	0x4b5a8549,	0x9a944db1,
-0x259533a8,	0xf752aa57,	0x0aaece02,	0x3e9eb6dc,
-0x01529a99,	0xa1120a61,	0x0612f4ae,	0x1c545b24,
-0xa161aefd,	0x09ee8195,	0x26d9a47d,	0x95f2fa94,
-0x41077351,	0x591759f9,	0x14ebbfb9,	0x71e1a718,
-0x504b6d8b,	0xab3b3e1e,	0xbb94fbab,	0xdc078a4f,
-0xab9c047e,	0x807e8764,	0xb28d8d69,	0x6d489143,
-0x707ea03f,	0xf819352b,	0xf46a392a,	0xc0615234,
-0x67e66559,	0xf107b9a1,	0x034b1cff,	0xcddb15e1,
-0x2ded2974,	0xbdfa2af0,	0x774955bd,	0xc85f3fce,
-0x6f219931,	0xbf4fc6a8,	0xfc6e24cd,	0x03b9c13c,
-0xa542941d,	0x91277cff,	0xc0749077,	0x735adc99,
-0x152bcc34,	0xd659d8f5,	0x425ff8f6,	0x73550a48,
-0x3e822814,	0x44a276ce,	0xeaf24451,	0xbef2fed0,
-0x03b149d1,	0x2a19ebcc,	0x942f1414,	0xeb1bafe4,
-0x609cb77c,	0x45e67b00,	0x742c98ca,	0x6b054612,
-0x1eee23a6,	0x8dc74531,	0x0040b65a,	0xeee298c8,
-0xb429988c,	0xde7b9cfa,	0xde6aec9b,	0x2d64954c,
-0xb6cd4969,	0xe4480aff,	0x6743154f,	0x3871a946,
-0x32967b52,	0xed4a5c7e,	0xe065a558,	0x2d7c288d,
-0x9cd34d1c,	0x02cab1bc,	0xef438227,	0x662ef5a7,
-0x8b25ea6e,	0xb9475283,	0xa51c79e4,	0xd9ec4746,
-0xf3d6b5c1,	0xc330446c,	0xeb3994a6,	0x87cc380e,
-0x26bc605c,	0xbb4784b4,	0xc8c6f734,	0x84804cff,
-0x29e6d498,	0xbf2f0b7b,	0xe25253a0,	0x364d64e6,
-0x6a5f37b9,	0xfb6893b5,	0x27748c57,	0xc214525e,
-0x5b4c8f32,	0x3e39d2b6,	0x6bb6092b,	0x33325280,
-0x9e97faf4,	0xec0ae39d,	0x9d9d331d,	0xe1fab17c,
-0x398b6cec,	0xf6467387,	0xb9c8d5ee,	0xbcca09ef,
-0x16be976b,	0x2ffc13f2,	0x15341d17,	0xaf7ba4eb,
-0x9cd99ea9,	0xccf923bf,	0xc1f8aefc,	0x9e58f162,
-0x449142d6,	0xa45b5c3b,	0x091f2d34,	0x3198ec74,
-0x420a2fd6,	0x4bde2efa,	0x87fb82ba,	0xf9d023bf,
-0xed5e91e6,	0xd238150b,	0x06afb204,	0x07d90c48,
-0x48b47431,	0x8e7f13b8,	0x03d96ffe,	0xcd038364,
-0x2cf59804,	0x7fb3ba35,	0xd790285c,	0x2a8e5cbe,
-0x528e9b88,	0x6926614e,	0xfa07b720,	0xf7ca68c1,
-0xebd7a28e,	0xd97d1dc6,	0xa16092d5,	0x72c1f20d,
-0x2a89581e,	0x184e1567,	0x9e3f99a2,	0x00420d9b,
-0x6ea5081b,	0x6b19d2dc,	0xcce35407,	0xd7822e92,
-0x2a20eb0b,	0xe8b5280f,	0x15b7d076,	0xfa9e8632,
-0xe29adc6f,	0x7f251fd9,	0x3e718eae,	0xd28cd498,
-0x0987778c,	0x6f5ad282,	0xb82da525,	0xbf78e58a,
-0x205a07f7,	0x480d1f4f,	0xdbf07f5b,	0x12ac2504,
-0xf6195b0e,	0x27caa6a6,	0x3125fd45,	0xc1bcb8c6,
-0xbc3da654,	0x474943d1,	0xf795db64,	0x407da287,
-0xd8b1098c,	0xe6015d4e,	0x683e0133,	0xab4b1d47,
-0xee2d9eab,	0xe688b255,	0xb68cc171,	0x01bb8385,
-0x4b409c68,	0xb138d49a,	0x7010dfcd,	0xdd2a5079,
-0xa345ba2c,	0x16b83049,	0xc644b84b,	0x463d5e22,
-0xaa016810,	0xb7d47e32,	0x6b3a159c,	0xc2cdcf79,
-0x9806acf7,	0x63aa2806,	0x9c587d84,	0x21cd996e,
-0xbaa4da3e,	0x5ed95a9a,	0xa92da1da,	0xa3256bbb,
-0x82774984,	0xfc6d902a,	0x3cd802c4,	0xea96bdb3,
-0x1bd513dc,	0x180a5def,	0xf68b2c7b,	0x1630b952,
-0x5fdfccd3,	0x86fcb1f0,	0x1db7c873,	0x426e7203,
-0x4e7653c2,	0xf015363e,	0xe1fb4d92,	0x575218c8,
-0x55463588,	0x57b9e42a,	0x56271dc7,	0x66caff00,
-0x5732c877,	0xf22cbd0d,	0xd3445e1d,	0x392497d3,
-0x2d40cfa1,	0xd47efc4a,	0x23154511,	0x79bdd22d,
-0xc44b05da,	0xe44d004a,	0x72b2283e,	0xa726ed89,
-0xf8efb7fa,	0xd8db9bd4,	0x591c1fd0,	0xb77c25c5,
-0x675a794c,	0x979a9c6a,	0x81007ee2,	0x31ad3e84,
-0xb1ff590a,	0xcb8b0d6c,	0x2c33533a,	0x2cba2b17,
-0x28034408,	0x9a6f595a,	0x10631e7c,	0x7f220b25,
-0x361c95e0,	0xa74d0fd0,	0xf6e34216,	0xfdbf26e1,
-0xaba66ba0,	0x53dfdf06,	0x51c46bb2,	0x74735bf0,
-0x5bbb13b4,	0x7d1fceb8,	0xf022c0f4,	0x172557e3,
-0xadc3eaa1,	0x437ff720,	0x74fd1b34,	0xd0a2bdd8,
-0x4b469027,	0xd8e2b398,	0x642b05a8,	0x26bcf886,
-0x580935a1,	0x19c17435,	0xea07ba9f,	0x82b6a9f3,
-0xadc470e2,	0x9f063324,	0xe2ee8f00,	0x85acea76,
-0x48ee7054,	0xca1926d9,	0x7d91b8a5,	0xf2234802,
-0x18c32e68,	0xac564fa3,	0xd9242a86,	0x314b85e6,
-0xb3c0b619,	0x67a28d4b,	0x460fca58,	0xe77f6781,
-0x4d44b6fb,	0x23b8792f,	0xa82b06a7,	0x53e761ba,
-0xe61fce34,	0xc3d32f78,	0x0a27a861,	0x2f4bbda4,
-0xd994086c,	0x9b6295ee,	0x359fe82d,	0x359ef141,
-0xc1d15957,	0x0a613caa,	0xe322762c,	0x85399553,
-0xb3a621da,	0x0ef4505e,	0xf423bf29,	0xe46011ae,
-0x666d7f63,	0x02ed1f2f,	0x8b75b4fa,	0xbc20db71,
-0x95dda900,	0x47ee785b,	0x61d702d8,	0xf6323f36,
-0xce38e245,	0xf3c2e68e,	0x7b40eeb0,	0x641169f7,
-0x2f90e7e9,	0x8a70bec0,	0xa577b168,	0x72ce4f59,
-0x2ded6007,	0xf18ef638,	0x8aa8081b,	0x42bd28a2,
-0x1ae474cb,	0x126c1d33,	0x699c5be9,	0x3c9cd070,
-0xd6fda74b,	0x42ec7826,	0xa1e4b946,	0x81590175,
-0x11aedbea,	0xf055f904,	0x6562d6d2,	0x94f802c5,
-0x11b1f94e,	0x468c9214,	0xbb481f32,	0x17e6ed48,
-0x79adcfa8,	0x128ad16d,	0x9d7a45f3,	0x914a1d48,
-0x391121da,	0xa8faa6fd,	0x733ebef5,	0x0a355e2d,
-0x196fd93a,	0x8c7a18db,	0xc87018e2,	0xfe5d8f43,
-0x6ef1d661,	0xaf4bb5d9,	0xf6848f1a,	0x2cc4b8d1,
-0xc5a82a15,	0xa9f58f89,	0xeddf2fc9,	0x3f40bedb,
-0xa091724c,	0x6321f26e,	0xeeb85002,	0xddc04d77,
-0xe5d21616,	0xb59e2731,	0x8302c19d,	0x66b6b6e3,
-0x7ddeacc2,	0xb83f69ba,	0x67546e4c,	0x4f504b47,
-0x4dc533f9,	0x5c4ffbc2,	0xff380ef6,	0x3dcadeb1,
-0x402da16e,	0xbe2f64a6,	0x9916562e,	0x0d092e1f,
-0x7f702ee1,	0xcc49c252,	0x421ca906,	0xff48292a,
-0x4fb55b6d,	0x78495c42,	0xe79ebce1,	0x1697e629,
-0xd9d6abeb,	0x8ac66ff9,	0xeb90c46c,	0x441d8afe,
-0xc830515a,	0x10955461,	0xeffd35dc,	0x5e1bbea5,
-0x2fe62b78,	0x20bb1b23,	0xf97f16b4,	0xe750c2d8,
-0xecf1821a,	0xdba57d3a,	0xb29da168,	0x568fcf42,
-0xd6f89d17,	0xe01ab3f5,	0x20265a7a,	0xf2a0a822,
-0xfed039f8,	0x56b6a887,	0xfdc5024d,	0x66d24460,
-0x86e7511e,	0x0925d922,	0x9e2e98a1,	0xf9b8024e,
-/*  1104-m04f241e.inc  */
-0x00000001,	0x0000001e,	0x06052003,	0x00000f24,
-0x9ba58d71,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x5715f121,	0x440ce2fa,	0xd5d090eb,
-0x70b3e977,	0x92320e8c,	0x4f989906,	0x36907442,
-0xcc4b12e2,	0xb456a6ae,	0x0ad5bcf7,	0xe9f0a425,
-0x70b932d2,	0xe66202c9,	0x350f884b,	0xd560a828,
-0x5c4c5cb4,	0x7b142329,	0xd9e25719,	0x98b1dbb0,
-0xb11af93f,	0xe83b07eb,	0x9b6d35a1,	0x0df761c2,
-0x1a5e6da5,	0x3c978798,	0x08a7acd8,	0xd20a3b15,
-0x0aaeef40,	0xa4ed3a47,	0xb8d15785,	0x2ac39380,
-0x153a5ad7,	0xeddc8222,	0xc02510f4,	0xc7cdc21c,
-0x09adfdce,	0xf4dc290a,	0xc6e2f5bc,	0x8e60359b,
-0xf097f2fd,	0x24ac2ac0,	0x770ecf17,	0x9f80b3f0,
-0xf250a757,	0xad071b7e,	0x51d432ef,	0x3c095fc8,
-0x3574394a,	0x23e0e092,	0x8c9e2505,	0x927dc9fb,
-0x3bfcface,	0xb93be3de,	0x46c03521,	0x00192a46,
-0xc6a53c55,	0xfcdbb872,	0xb56349f6,	0xf0bf598e,
-0xe86afccc,	0xef930d0a,	0x905ada75,	0x9508c261,
-0x8a8cb340,	0x5010a4fa,	0x92437678,	0xa7799056,
-0xedd0ea8d,	0x3c25bdc8,	0x914f3f08,	0x27ff4d02,
-0xd104ca12,	0x972d1570,	0xadb4a6f9,	0x34f31516,
-0xb0aca99e,	0xd05b7382,	0x5fcaeecd,	0x83edf7c4,
-0x1b15099f,	0x14146a3c,	0x6150ae4a,	0xd8715907,
-0x6d405215,	0x307ebd9a,	0x248fcdf4,	0x1650a34e,
-0xa8070739,	0x5fde05cc,	0x1a9433c3,	0x3f5770d9,
-0xcedfa47f,	0x1f3c7660,	0xa3bdf9f6,	0x3a2d9d3b,
-0x01833189,	0xfebaa041,	0xbc4bf2c8,	0x50c5f238,
-0xb132e653,	0xd301e92a,	0x2b094386,	0xfdb557b3,
-0xd4ed60d6,	0x75da1146,	0xfedf34fe,	0xa21665bb,
-0xd6b6d496,	0x46d9c114,	0x20f26f66,	0x5ee354c2,
-0x801aba92,	0x0973251a,	0x63748328,	0x01b293f4,
-0x1a13ec73,	0xf17ea3dc,	0xcaf6a499,	0x1cd356e3,
-0xa6b450be,	0x6200d2b7,	0xc4b88872,	0xf6aa6f70,
-0xdbc917f9,	0x1cf3d760,	0x5d60d15b,	0x48c2407e,
-0x9210b35a,	0x171df657,	0xfb14733d,	0x1c837746,
-0x6df3dd50,	0xc096efa2,	0xa9202472,	0x56917067,
-0x40620e92,	0xd739c7d4,	0x89cce286,	0x8882ee44,
-0x2362cb14,	0x3e03d986,	0x6519adee,	0xd7aec296,
-0x23a91210,	0x77229af4,	0x97fd4c79,	0x422707b5,
-0xbea05034,	0x2ef3b3a4,	0xe3291146,	0x40a0cc32,
-0x96b557c6,	0x5aa836bf,	0x9dff3965,	0x31e80540,
-0xa0556e13,	0xc08b88ca,	0x3f3e1144,	0x4f093862,
-0x96bc622c,	0x497ec377,	0x992d7899,	0xf881becb,
-0xc65d3299,	0x827a9be4,	0x78b851b6,	0x8314b5d1,
-0xeda31b10,	0x471764db,	0x905d2df0,	0x19e376c0,
-0xcf6af8a5,	0x4355d3d3,	0xb2033a88,	0x00f2c0d6,
-0x537a95be,	0x6938a3c7,	0x8d85a10e,	0x19f996f8,
-0xe5334524,	0xec2cc18b,	0xc540afec,	0x14206bbe,
-0x89601729,	0xf21d5916,	0x11c39ad0,	0x93a73d2f,
-0xbd8a681e,	0x3d62394c,	0xe43d9c1a,	0xb1b85b09,
-0x48e87b21,	0x3dc66cb4,	0xad066e73,	0x745fb4b0,
-0x47f5cdd2,	0x28e9dc7c,	0x94515ceb,	0x3a94e085,
-0x0fcdb0e4,	0x55cdbb93,	0x38d990f1,	0xa8f13bff,
-0x497471f6,	0x4e74b9f0,	0x6212615b,	0xec6ed687,
-0xc984443e,	0xd3852197,	0x35ee920a,	0x690a7b44,
-0x4c2ad071,	0x8b9e3890,	0x4114aba9,	0xea796a19,
-0x0d968acc,	0x97709071,	0x20274074,	0xcecfce72,
-0xbfdde5ee,	0x4d694e1e,	0x800d6bfa,	0x969027a0,
-0x9417fe60,	0x9cadfc0e,	0x6a103bda,	0x375fc4e8,
-0xf309280c,	0x945f197b,	0x5cb77b5d,	0xdf5d5708,
-0xced4272d,	0x6b04b696,	0x78e44dc2,	0x8c41f9d4,
-0x92650f39,	0xae3d250a,	0x07c91401,	0x1ca1360b,
-0x2078a46e,	0x7e0b1a9d,	0x5a667dd3,	0xefdd072c,
-0xeee2f749,	0xc1115ebd,	0x743c2890,	0x525d7fa8,
-0x4d86d130,	0xc4470f2f,	0xcbd9dc73,	0x88230f84,
-0x7476f692,	0xbcdeb696,	0x981f3fd4,	0xba7f6c3a,
-0xe073e123,	0x1dfb3790,	0x6ab7fc48,	0xc519cc6e,
-0x5383ddda,	0x964da863,	0x1d041e19,	0x5f2288d4,
-0x5ff7c34d,	0x73a197c1,	0xd086d7c9,	0xb0314861,
-0xbc63a785,	0xe072a384,	0xf37e9d90,	0x63a7a4ac,
-0xa33622ab,	0x802471f9,	0x0841f065,	0xff4ea8fd,
-0x343caaaa,	0xcb8594f5,	0xf5756925,	0xcc946e7e,
-0x9043d824,	0x49812185,	0x1f555515,	0xb62ffebf,
-0xa27e379d,	0xa2386704,	0xaf19ccbd,	0x644130f0,
-0x29abc386,	0x7d044e0f,	0x5274c8e1,	0xc8298400,
-0xc08a2e85,	0x8f13dec2,	0x79f40342,	0x10ed42a2,
-0x75541795,	0x9c9608c5,	0x11798ba6,	0x9a7e40ff,
-0x4e44f869,	0xb0e0ac45,	0x9865be8d,	0xc361cdf1,
-0x88cf2cf2,	0x5cb47192,	0xceaeb1a6,	0xd6c4b77e,
-0x567e8aae,	0xd0eaf865,	0x30a9e8f4,	0x049e1005,
-0x96c4842e,	0x4d97f912,	0x2837581a,	0x8dd154c0,
-0xe88f85e3,	0xd5b8c4bd,	0xf6ae181c,	0x524a4d74,
-0x17e15bed,	0xa200218f,	0x241d1c1b,	0x9efc70a7,
-0x9e1adbae,	0xf115df9e,	0xda54c448,	0x8fe3ebc3,
-0x0b312745,	0x4f0075d9,	0xc2867e55,	0xa19131db,
-0xc244a076,	0xbfd954bc,	0x65a49f64,	0x3e99ece9,
-0x80940945,	0x626f0b5f,	0x683bb192,	0x9fbb14c6,
-0xe4136229,	0xd76f54e7,	0xd8b2b363,	0x049f372e,
-0x5f391828,	0xbf27f2b8,	0xc9ba89f6,	0x83047de6,
-0x6b9816c7,	0xa37232c5,	0xe86bda74,	0x8c426e07,
-0xfca755b4,	0x5d7f53d6,	0x6a123e2e,	0xbef86cef,
-0x0ff79e5c,	0xc160e69f,	0x3d9332ee,	0x14b3246c,
-0xb1ee9faa,	0x72827d5c,	0x825683a2,	0xbf3143f4,
-0x501cad6c,	0xbb872e29,	0x086f7851,	0x392df63f,
-0x0013ae33,	0xd643c1ff,	0x5dc4b349,	0xcdf75234,
-0x206f8869,	0x9cc8c8b2,	0x872c6d84,	0xc518e0a6,
-0x2bdbed94,	0x2cea60cd,	0xd4542cd2,	0xbf5f7c4a,
-0x03fd6694,	0x857030b4,	0x932ce1f7,	0x1b24d617,
-0x8342fbb9,	0x2484a61e,	0xa76945b6,	0x39c08823,
-0xcc4e48b9,	0x31b73d47,	0xe2699dfb,	0x3f43284f,
-0xce602dfb,	0x0b50541c,	0x5ecb56d1,	0xefc75a88,
-0xdba5beb3,	0xe0e80051,	0x11360a93,	0x27cc6d6a,
-0x884a2e79,	0x4c5c9256,	0xe2c4c758,	0xf2422d67,
-0x2736306d,	0x60f34846,	0xf41738eb,	0x9286cbe5,
-0x27f5c292,	0x410fae37,	0x980f0a33,	0x2522d4db,
-0x5c5b5beb,	0xdbd795c2,	0x2fcf3eb9,	0xf13709fc,
-0xc76339cc,	0xfef3cf76,	0x152585dc,	0xc321c271,
-0x2731085e,	0x676bce0a,	0x93299b87,	0x76e24635,
-0x2dad2f9f,	0x4ee82851,	0x45f18669,	0x85a46c9c,
-0x430f4c5e,	0xa95cbcc9,	0x42f64717,	0x532ec8ec,
-0x2bb74e8e,	0xb23de16c,	0x211fa366,	0x8d3254ae,
-0xa950af8b,	0x18a677a5,	0x15efecfd,	0xdf69f07d,
-0x8452ab6c,	0x5406396d,	0x88dc53e6,	0x8a0085ac,
-0x0d99aeef,	0xcd61d2de,	0xdbef2853,	0x61666ed3,
-0x204f160d,	0x954367d9,	0xe98d05bc,	0x8dddc5e8,
-0xf67b6d6e,	0x18ce6930,	0x2547eb2b,	0x9f3a4858,
-0x8ea6adfb,	0xb1469ac9,	0x67e08b98,	0x50ccc5ad,
-0xd1ef2c5e,	0x15d5d2f7,	0x167b96b6,	0x6c7cf41b,
-0x9e4a7bba,	0x2b09511b,	0xa05187c3,	0xd6c93b77,
-0xe5d5a827,	0x7c0c4a12,	0xe20c53f3,	0x04bebe94,
-0xfad3cb34,	0xa410ba0c,	0xa0d19f1a,	0x3f802e05,
-0xc42673c4,	0x2b9414ef,	0xd17334b0,	0x21f0bc8e,
-0x4bdc73b1,	0x37dad34a,	0xba9ee740,	0x98cb9b36,
-0xb0f63a1c,	0x3cef6043,	0x9c5247e2,	0xbc165396,
-0xf5686c77,	0xb2dec708,	0x3b3e979b,	0xa1b35fb1,
-0xb41af92a,	0xf8f22ace,	0x5ebd44c1,	0x4c133891,
-0x997d6952,	0xa2fd9241,	0x1a81ea5e,	0x612d0955,
-/*  51-B_c6_616.inc  */
-0x00000001,	0x000000c6,	0x12101996,	0x00000616,
-0x2d239c7f,	0x00000001,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x0ad2517e,	0x13fb1fdf,	0x34db98de,	0x9ec12e7c,
-0xa4950c64,	0x8e2835e3,	0xff533c31,	0x64b35ca4,
-0xad6016ab,	0xeaf6c849,	0x1f20af40,	0xb2bc69b7,
-0x0581aabd,	0xe682b959,	0x4e5b1e90,	0x98dddd5e,
-0xcd7f2db2,	0xff086959,	0x01e35ea0,	0x23034a52,
-0x2845a4e7,	0xbbae5ed8,	0xb4ae016c,	0x68d7b250,
-0xec2cf14a,	0xb417582a,	0x5492fd47,	0x558f8b0d,
-0x53234b31,	0x097d79f5,	0x1f795f2e,	0x61422647,
-0x193954c5,	0xac976bdf,	0x02180700,	0x1ce3d6ab,
-0x91edd818,	0x77439994,	0x883ba7ed,	0xbb88cca1,
-0x100dc3e3,	0x40268bb9,	0x396326c2,	0xc41dac50,
-0x784a4d7b,	0x90ddeae3,	0xceaa106c,	0xea4be9d2,
-0x4316a8b1,	0xd92b850b,	0xa0ba562c,	0x65509fae,
-0xe31fdb20,	0xd8203aca,	0x9874e319,	0x4b418050,
-0xdf30cf7e,	0x09f83e18,	0x6c26eee3,	0xcd91e7ee,
-0x4529edfd,	0xc22a4c71,	0xef768431,	0x83559ba9,
-0xa114a80a,	0x7b0edc7c,	0x77887b8f,	0x79ef5503,
-0x6b2b3d70,	0x110b466a,	0x64ea7da3,	0xc565e336,
-0x88ebded9,	0x3753ee0f,	0x48e0f094,	0xfea3a6f1,
-0x2e26c738,	0xb450975d,	0x8fb76a07,	0x0eee3f74,
-0x4a530dd6,	0x090bb52e,	0xa1ede757,	0x7651f0b2,
-0xaa242d1a,	0xc80618c7,	0xe267fc22,	0xeb2c37db,
-0x26e8dec9,	0xa298171d,	0x65cd8ab4,	0x7a6d249c,
-0xfeefeb1d,	0x3244e351,	0x76c3225d,	0xca4d59f5,
-0x7e923a36,	0xf8e7a3ea,	0x2f2f70c9,	0x6c8708a5,
-0x0ad1134a,	0x05ba3fa8,	0x48cfacd8,	0x0e18b139,
-0x3639cab9,	0x96083966,	0x48e774aa,	0xbf0a1b31,
-0x0f70e293,	0x5479e1df,	0x993617ab,	0x5153c793,
-0x99d54ddc,	0xd9c797b9,	0xf18935ff,	0x4c5a1656,
-0x7aa56fac,	0x280516e9,	0x421df9e9,	0x4a748fb9,
-0x264bd4a8,	0x59933d32,	0x3e9a9758,	0x31fae11c,
-0x4e90132f,	0x6c6f2270,	0x1bf389cc,	0x1a610476,
-0x614d0117,	0x9eda7a17,	0xb9a2701d,	0xf382d575,
-0x55c71c4e,	0xa5537536,	0x50c6be25,	0x40bf4078,
-0x91754301,	0x7fb1b946,	0xfcf2890a,	0x4e834359,
-0x2610bcfd,	0xc6d5a889,	0x09f5a032,	0xd433ecaa,
-0x4e447c1f,	0xbb60afe8,	0x52c1a16e,	0x0fe5b40a,
-0xf4c0f7d0,	0x54a58147,	0x5a96247c,	0x9be3021f,
-0x1dd68883,	0x9f3eb6c9,	0x65f9ce10,	0xdb6b6604,
-0xf3c2982a,	0x798d5b5d,	0x777b7d18,	0x3ac5b364,
-0x8e05142c,	0x55168b66,	0x259d2298,	0xfc005f92,
-0x77d14dfd,	0x7e9bbb8d,	0x2b77bc0e,	0x79d7044e,
-0x8951aeb0,	0x061d463e,	0x38ea5a4b,	0xd1a71399,
-0xcda469a2,	0xa024e9bb,	0x644d9cb1,	0x849fc6f7,
-0x940fc84e,	0x961e5b3e,	0x158c8e0b,	0x75ac0566,
-0x922644a4,	0xb3d8df0d,	0x0ec2a221,	0x88cc3a1d,
-0xd6b703b9,	0x023d596b,	0xedc01c23,	0x00f9e3a8,
-0xf6d0b38f,	0xa4843449,	0x1de2029a,	0xf4421771,
-0xc6b0fb56,	0x27fa576a,	0x537f2be6,	0x0b10249d,
-0x3fa1838e,	0xdb16d838,	0x27503a5c,	0x051630ef,
-0x62be469b,	0xe780c603,	0x65035462,	0x37f17677,
-0xa99fbf46,	0xdfd14372,	0xd5188f7c,	0x9ca16a08,
-0x7d3cb59c,	0x082d8061,	0x6b22bf6d,	0xb7c2896a,
-0x88cb78ed,	0xc7e2b169,	0x16db0edf,	0xa5888ece,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-0x278cb2c0,	0xf41d6be8,	0x839b9b57,	0xde7df900,
-0xa6d05386,	0xf79d8944,	0x24d4273d,	0x878456fe,
-0xbc0006e2,	0x4cbc49c5,	0x16684d87,	0x1f2c79a5,
-0x847dc8fb,	0xe873c43a,	0xc92223f2,	0xc9c193d4,
-0x8f43d21d,	0xc723f894,	0xa0ed9e53,	0xd0693391,
-/*  1374-m2069507.inc  */
-0x00000001,	0x00000007,	0x11092004,	0x00000695,
-0xf7d0460f,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x75ed45d1,	0xa58cfbe2,	0x95b6ecce,	0x3eec60f2,
-0xa3518658,	0x986f23bf,	0x63ade481,	0xe26bbb6a,
-0x94f0ad76,	0x0da53309,	0xc920df0e,	0xe6ee5568,
-0x4a7fa577,	0x86f184bb,	0x98d09cce,	0x63a857b9,
-0xb83f63fd,	0x8a34f546,	0x00f1a9c6,	0xf09c1ba7,
-0xb2dab0ca,	0x1dd0f9f2,	0xb97219e9,	0x91489df9,
-0x0ae22c43,	0x97602252,	0x9452bf66,	0x7b2490ee,
-0x877013a0,	0x80d79558,	0x356747fc,	0xe8a4885f,
-0xf7b0cadd,	0x32e006a9,	0xfa724d13,	0xe6625057,
-0x41c66cbb,	0x9b638ac9,	0x9111e2ed,	0x686ccdc7,
-0xbee8a321,	0xa16a3ae6,	0x5b207450,	0xbaa920d6,
-0xd8887148,	0x386de110,	0x90ae1a00,	0x86f2d14d,
-0x03a0923c,	0x96edf313,	0xc296dd52,	0x7935f549,
-0xf094f7f4,	0xcacc5b02,	0x6b8cf81a,	0xd27d0293,
-0xdb27991c,	0x4f4591d8,	0x91740b1a,	0xe5658e97,
-0x22e267e6,	0xdfeef285,	0xbd99b6db,	0x0ba5a68e,
-0xa8f3ae46,	0xd4e887f0,	0x2ffcb598,	0xb5ab53b7,
-0xa34e5ed7,	0x275d2d86,	0xfb6504c5,	0xbf2ced2c,
-0x5d3adb47,	0xdd90c777,	0xc247d4de,	0x49756808,
-0xa7eccad2,	0xe463e92a,	0x08a1adc2,	0xbb1cdf22,
-0xf56620f8,	0x08f73ae2,	0xe33c259b,	0x8c34f791,
-0x5ac6f701,	0xd1a568a5,	0xb838c440,	0x1119f612,
-0x8067edbf,	0xf891c9d7,	0x792e238a,	0x94aea031,
-0xa6219da9,	0x2e657d19,	0xc0986d6b,	0x86845231,
-0x1196d0c1,	0xbce3eb01,	0xd06a1421,	0x1ef9f318,
-0x8fd9a69c,	0xdd2a5b02,	0x047d44ec,	0xb238dd54,
-0xed7cb49c,	0x3a8c80a3,	0xab9a6453,	0xd53347c2,
-0x59f19199,	0xd6c42520,	0xc6b433c7,	0x1432aff4,
-0xc66caed2,	0xd7b46878,	0x1dee38b5,	0x91a2d549,
-0xc847a196,	0x786ef929,	0xb03390ab,	0xeb92b8c3,
-0x4a81034f,	0x866b4a13,	0xc1cec9d1,	0x14d1b187,
-0xb1588c65,	0xbb04d233,	0x10754b96,	0xfbb7ae86,
-0xf40317be,	0x1f5f6fc6,	0xb09daf2d,	0xa63e4a93,
-0x224eeae8,	0x8a153313,	0xf62508eb,	0x6b3f448c,
-0xab1cc6c7,	0xd90b89a1,	0x766abffe,	0xd96407c3,
-0xde2397c5,	0x5c046b75,	0x94a3c7e9,	0x814d735f,
-0x0ce5a75c,	0x929ea8f1,	0xe4e1bed5,	0x12a32b5c,
-0x91c9e7ba,	0xdfb5f6d9,	0x07089e3f,	0xa39047ec,
-0xc48d6f94,	0x60c7b5c9,	0xe791230b,	0xfe80e488,
-0x77a83870,	0x8788bc87,	0xe8899973,	0x7a26deae,
-0x9328cd9f,	0xcff87fec,	0x704c0630,	0xcf33211f,
-0x8dfc1ede,	0x50e158ad,	0xf1bbe640,	0xeb418193,
-0x6cfd16a6,	0xdfe57412,	0xf0a85131,	0x916cefdf,
-0x68ed7eea,	0x8fd08f4c,	0xe7ad145b,	0x1b406442,
-0xe731af91,	0x8a2bc765,	0x5fb4e4f1,	0x16f46d22,
-0x8f585450,	0xae91ffb5,	0x2b1b8513,	0x3e0a7161,
-0x9e34bb9b,	0x9686df2f,	0x5bd24526,	0x0ef38175,
-0xc1c374b2,	0x953ad1e3,	0x0aebce39,	0xdba94281,
-0xe065a1d4,	0x2f2304d5,	0xe95460fb,	0x05fe2928,
-0x31f7b211,	0x4b01c6ce,	0x579271d7,	0xf10f5f7d,
-0x2a32b09e,	0x8cbae3da,	0xb5641d44,	0xcdc2d181,
-0xeeed868f,	0xe6a8bd7e,	0xf883e150,	0xe365dcf4,
-0xa068d4cb,	0x5c47b100,	0x8c6a0e2b,	0x781d645b,
-0x27c9af23,	0x7987c2e3,	0x521cbd5d,	0x5a85cdb2,
-0x077941ec,	0x76ba48fb,	0xb0b24203,	0x494f73d0,
-0xaf3d76ba,	0xe6a844d5,	0xc9d58989,	0x771cfc9b,
-0x48d3cf56,	0x163fd59b,	0xc15a5942,	0x5d217288,
-0xe0ffdc3f,	0xb298b4d9,	0x3b961d18,	0xb43b0287,
-0xafeb73c6,	0x47f7fdef,	0x0caf84f0,	0xa1fe51ad,
-0xd71618ac,	0xc87934bd,	0xe96101d1,	0x55d1976c,
-0x471c8505,	0x7a36d839,	0x5d62a9ee,	0xf3c54a8a,
-0xa2be15d9,	0x244087c9,	0x042c8037,	0x23224689,
-0x281c5d73,	0x2139ecfc,	0xffb8bc8a,	0x834fdd11,
-0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,	0x4ae2dbda,
-0x86d90089,	0x6675dfce,	0x48876262,	0xcec72538,
-0x11dc5c80,	0x86a730f9,	0x313565c9,	0xe3e5be11,
-0x106d7cce,	0x752b8be2,	0x3d00a5bc,	0xe6f70e95,
-0x44447ac8,	0x600df30c,	0x8335ac3b,	0x8816ddee,
-0x700982fe,	0xee495741,	0x48c7e81c,	0xa3d55da2,
-0xb0172982,	0x70ab2158,	0xd4460621,	0x3a9e528b,
-0x59b18a7b,	0xf4dabc4c,	0xa8454763,	0x70877bb6,
-0x66005c97,	0xaf292c06,	0x7b843db1,	0xf343b59b,
-0x25cdc7b5,	0xa41da617,	0x9e9d895e,	0xc936f475,
-0x7270925a,	0x30024230,	0x8e72f53d,	0x2b6c1b6f,
-0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,	0xaf377cc1,
-0xbff09a78,	0x4b4e0814,	0x95a0b2c1,	0x270398de,
-0x201fca94,	0x2a032a4f,	0x131542b4,	0x0d7306da,
-0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,	0xa3b3a991,
-0x17ee60c2,	0x852c0b8d,	0x11e5853a,	0x762002a7,
-0x92c5311d,	0x0d4bf7e1,	0xfffec870,	0xe3d35e5b,
-0xff6ecfb9,	0xdedae6ff,	0x0111a772,	0x9808e780,
-0x29c336e8,	0xe9bc05df,	0x5bedde11,	0x945565af,
-0xaff808fe,	0x87e3423d,	0x4de6f98f,	0x93b4adef,
-0xbf704fa4,	0x09120e91,	0xd54f3692,	0xdf8eab1e,
-0xfabbf59c,	0xe74318be,	0xaab87ffc,	0x29fa791c,
-0xe3915552,	0xa652cb9b,	0xa1252e74,	0xb35b723b,
-0x542aa28b,	0x12fcc5b0,	0x3941f962,	0x82bcc6cc,
-0x47b11974,	0xb821611f,	0x78b34250,	0xf1be5659,
-0x561b9e61,	0x6f3bd501,	0x584e6f5c,	0xd54ed547,
-0xacebcd21,	0x7b5ff816,	0xb64ad233,	0x9f2f330d,
-0x69fb1ece,	0xac8710dd,	0x58dc6c60,	0x9bee6139,
-0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,	0xa733274f,
-0x884d9b55,	0x42b08b63,	0xafa54a74,	0x1c7ccf64,
-0x93a20191,	0xaaa3132e,	0xc69831d1,	0x54634889,
-0xfbfe3efc,	0xd3cf68d4,	0x302e3117,	0xf5693131,
-0xc3ce8c6c,	0x1f03cd89,	0x6243334c,	0xf16bc80f,
-0xdca5f130,	0xcb2cd956,	0x4c1bb421,	0xe8de533c,
-0x7f86703a,	0x29aa897e,	0xdd54acad,	0x76b2f2ae,
-0x7ef82b71,	0x2e30970b,	0xba402597,	0x9a653ab4,
-0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,	0x2363d147,
-0x5327289a,	0xe89229f3,	0xd63a535c,	0x7efe9273,
-0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,	0x1b9c7bfe,
-0x5d14b3de,	0x54d575fb,	0x6d65db4c,	0x95648b7f,
-0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,	0x8488a45f,
-0x8ebc2932,	0xd4767316,	0x3e8c4b8a,	0xbab7402c,
-0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,	0xc88528e9,
-0x4b2e4e8f,	0xdd938b86,	0x0c964f98,	0xfc88d480,
-0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,	0x4d40b3b3,
-0xcf203155,	0x0d2fa621,	0x752d2c58,	0xb12bac12,
-0x1e7e8c23,	0x94215d54,	0x9854a71c,	0x4de63c64,
-0x7a012529,	0x9c171f8d,	0x9e71def7,	0x3bd17d50,
-0x11f175d9,	0xec78abf3,	0x7b529eee,	0xd3a69fc3,
-0x5b718676,	0x58214d29,	0xa8bd2c34,	0x41ea00ab,
-0xa03f64d6,	0x4ee342b0,	0x32b1e444,	0x1c1801a4,
-0xc8424702,	0x334a7e35,	0x50cf1543,	0x3b22b495,
-0x88683776,	0x8e2e0154,	0x6155c033,	0x4e2fa6ac,
-0x42ace700,	0x8d64f97c,	0xaf9ced17,	0xb2a5cb92,
-0xa558582d,	0x88705de7,	0x9e528d59,	0x84bd45e4,
-0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,	0x10462123,
-0x30080f7d,	0xb346cd81,	0x0049c396,	0x4e24165f,
-0xa7c66809,	0x2e60bdcf,	0xaad70a08,	0xa73ea713,
-0xe28f97a7,	0x283a9eab,	0xd4366489,	0xe776f963,
-0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,	0x3bae5f6d,
-0x8d2bbef1,	0x7e9181e6,	0xf06aa121,	0xd06b2d20,
-0xa83ea826,	0xef935e4f,	0xdfd27456,	0xa3451468,
-/*  1336-m02f2610.inc  */
-0x00000001,	0x00000010,	0x08052004,	0x00000f26,
-0x17ccab58,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x364630c3,	0x90d32ac3,	0xe0b20ae8,	0xd6f51dd2,
-0xab715fb0,	0x65eb6c09,	0xdbedd52a,	0x82b77a09,
-0x3de6132a,	0xdb7e70d3,	0xf0d480d5,	0xcc178c48,
-0xdfcccab8,	0x54dd452a,	0xf3cad623,	0x52223cbd,
-0x952b83c7,	0x9f19f457,	0x0ccfdeb4,	0x7db5026d,
-0x91b4355b,	0x7578f9da,	0x867c4004,	0x9dfd38ba,
-0xd917eb1d,	0x4cd599fc,	0xb02762c7,	0x6a515d1d,
-0x9ce55e63,	0xb83a89ce,	0x61770991,	0xf502a3eb,
-0xaebb7c0b,	0x48a70ecb,	0x7e70e003,	0xa0445809,
-0x61483a7c,	0xd3e42cf4,	0x73e16c21,	0xe3703903,
-0x4bb336a4,	0x2a7e6441,	0x5f7c8f18,	0x61fe955e,
-0xacad1745,	0x46610311,	0xa438f675,	0x0794bebf,
-0x9bcf7916,	0x289ed394,	0xf18602f5,	0xd15fd3ee,
-0x21d63004,	0xf8e18369,	0xbd736d58,	0x6cfa6fb2,
-0x216e824b,	0x816bb370,	0x87b6b9fc,	0x018352a0,
-0x6c7e0fb9,	0x2e73ee68,	0x42932799,	0x030a14a5,
-0x7e949147,	0x1c7b903b,	0x202a628b,	0x2b3c29db,
-0xb36cbf4b,	0xb8b682c9,	0x52edf51c,	0x21dea18a,
-0x3d45795b,	0x17a486b1,	0x0b33ee81,	0xae0e781f,
-0x6a51cda0,	0x038a0886,	0xb3803c2a,	0xd37b7663,
-0x3fdd3f29,	0x206ff7a2,	0xc4e1d566,	0x4733a703,
-0x4109f081,	0x00e13389,	0x8f6a551a,	0x876c6b0d,
-0xab5f37cf,	0xa7587856,	0xf2e40d9d,	0x8f96ff94,
-0x643ba33d,	0x0a714d2f,	0x9e4cebf5,	0x23be7659,
-0x1f1185a3,	0xb7867804,	0x43154b8a,	0x2b410278,
-0xfc50256c,	0x0fdbe07f,	0x5323861a,	0xa7743e4d,
-0x360f5bbb,	0x0b6dfc4c,	0x6bc99b1f,	0xbfc3cec8,
-0x01bae442,	0xbc865050,	0x1c47f2ea,	0xa733d377,
-0x114a8e51,	0x4d2fc034,	0x2a1f62e6,	0x295e4b45,
-0xa60fe075,	0xcec0b254,	0xd2db93f1,	0x75b76415,
-0x9fa15d8f,	0x2f6be332,	0x60969457,	0x4f09bd8d,
-0x3cb33e73,	0xe5bfbb05,	0xcaa4318d,	0x469bc154,
-0x0c88e1dd,	0x7f0efe55,	0x87caeb36,	0xa30e9e5b,
-0x4bfa16e3,	0xd8831e15,	0x859b4752,	0x5c8b8239,
-0x7a5f2b0c,	0x3666be1e,	0xf4eed737,	0x5351de66,
-0x126fc2c5,	0xfb125bb9,	0x1bf57cce,	0x9305002e,
-0xc7fcc490,	0xb5df57e9,	0x3997066b,	0xf7f80664,
-0x0f6a3e29,	0x6f8049a5,	0xd7ad0e02,	0xa5a4be93,
-0x4e18215e,	0xf431e0c7,	0xb6d9c296,	0x530772c1,
-0xa889c064,	0x72a08e3f,	0xf66c4dba,	0xe9de2ecc,
-0x3de3883a,	0x800f091d,	0xc60b5c4b,	0x5eb1f9da,
-0xedbefcbd,	0xeefd1890,	0x0094667b,	0x9931c091,
-0x5b15313f,	0xf3ea84ab,	0x589cddc7,	0xefa38e33,
-0xc7ff3dae,	0x122b6d85,	0x6cca8449,	0xddac8bae,
-0xee017de3,	0xfb2642f0,	0xb04ea8d1,	0x18a20bc1,
-0xbb1f1040,	0x68ce0f26,	0x24f8cc6f,	0xc05a61a4,
-0x53142944,	0xbb95814b,	0x0fc3cf29,	0x59dddd7e,
-0x53831c7c,	0x8c03946f,	0xa0fd5834,	0xb04b9149,
-0x39d5796f,	0xdfc3721b,	0xdb868f07,	0x8ff124ec,
-0xa53443ee,	0xc5b7b007,	0x5b9a16f0,	0xa3185b04,
-0x1befb1ad,	0x3fdbae2d,	0x924cb3b3,	0xc3954c6d,
-0x38d92964,	0x6b7ee259,	0x0fdaf976,	0x706f01f0,
-0x6c174791,	0xd6041055,	0xfe603ead,	0x78da5102,
-0xa7f1006e,	0xb4aa08ce,	0x981f3922,	0xc247e9a8,
-0x27ad39d5,	0x9f510faf,	0xf6e307eb,	0xa1f8a352,
-0xfb4943b9,	0x030440d6,	0xc9d8cd88,	0xb7e1375d,
-0x4503a334,	0x57f6cc3e,	0x897cb70b,	0x52df60cd,
-0x7f6e55b3,	0x8c56d27f,	0x4c1a5070,	0x2cb3b3a5,
-0x952934d9,	0xb95db21b,	0xd5772d64,	0x4f0ed27c,
-0x2ce5e335,	0xca2ce0ad,	0x8e617972,	0x000eb112,
-0xab28976f,	0x7a3e7a12,	0x063ea698,	0xb64f9bab,
-0xe5f6e7ee,	0xda973eeb,	0x3e75505b,	0x5b6b8806,
-0x7d7b4301,	0x8e6d0b29,	0x7e27b696,	0xf8b2678f,
-0x50ebc3f4,	0xdc9d8698,	0xb3be1dd6,	0x9f7c949e,
-0xa477da84,	0x713d613e,	0xe1434fc6,	0xe39897c6,
-0xcdfa740d,	0xa57b09e1,	0x080626d3,	0x548606b6,
-0xbe306932,	0x4e765892,	0xbb7bba2a,	0x8ac2ce69,
-0xd8c2ce64,	0xc95b1b7f,	0x1a2a003d,	0x73d5e9bf,
-0x2063ff00,	0xb3cf5ddb,	0xbb16f840,	0xefa92e9f,
-0xa2bacb3b,	0xe709c06f,	0x498304d6,	0xbb736f46,
-0x04745718,	0x56318102,	0x936001b7,	0xe2f76c7d,
-0x5ca8b5f6,	0xa609c8ef,	0xb9aa872f,	0x65029242,
-0xba28ff9b,	0x4cd3f475,	0x60701e93,	0x9f843fd8,
-0x2b89fca8,	0xc55a166d,	0xc2526f94,	0x69271a70,
-0xbc7a90f8,	0x926668f6,	0x54e72586,	0xebb05b4a,
-0x73cfe779,	0xf94f39cd,	0x70545f32,	0xa849637e,
-0x315a5607,	0x70bba510,	0x349ed3b3,	0xd6341c9f,
-0x4d6ba61b,	0x98300075,	0x629fd7d9,	0x4c413dd3,
-0x7e721ef5,	0x12fc530b,	0xbb4b01cc,	0x9324d6c1,
-0x6b2a1feb,	0x90faaf1d,	0x51055400,	0x024dc75b,
-0x693d1d5c,	0xb7a952be,	0x1398625b,	0x8ffed6e8,
-0xb5e8fa2e,	0x90c83b11,	0x7f7b9e9b,	0x8c06d718,
-0x9615a0e3,	0x3d7eda6d,	0xadd850a0,	0xbff9c56c,
-0xb9d865a4,	0x95cddce4,	0xe45e6864,	0x04c45d0c,
-0x9af72854,	0x2f4df675,	0xd9dc6b39,	0x934e8bb3,
-0x49600334,	0xb1df0a72,	0xa0de7818,	0x320e1233,
-0x06e0b01c,	0xb8b8dd15,	0x86340fbb,	0x8f338436,
-0x99fdb250,	0xe7708e28,	0x2c5de73c,	0xa940eea8,
-0xdfc66f15,	0x67d5d880,	0x2db5f20a,	0xd8237025,
-0x5224912a,	0x9d2b819a,	0x68d2ba9f,	0x4a43bf62,
-0xe01c249f,	0x4ac4e110,	0xb59c4d20,	0xbc0af1b3,
-0xec57e2c3,	0xf3dc0277,	0xfa65392a,	0x678eaa4f,
-0x757fa21f,	0x9e848a1c,	0x075804cb,	0xd6ab98a1,
-0x8e402f59,	0xf5ee99f0,	0x6d45a523,	0x92ce470e,
-0xa47332e6,	0x7a62c67b,	0x58f6c4df,	0xcf79a794,
-0xd42229ca,	0x8f0bb326,	0xb4e397d4,	0x5db56269,
-0xe47dbe8f,	0x0de0a469,	0x71bf3754,	0x51517bbb,
-0xae5fbe76,	0x3a0067d0,	0x8c3b07d3,	0xdfebc15a,
-0x87955daf,	0x0d73af50,	0x71a73c6f,	0xbc247916,
-0x63e1a157,	0x77e92d44,	0xf6193d40,	0xb4c09193,
-0xbc415098,	0xfbedcb0e,	0x2f68cbff,	0x5be3f2d5,
-0x01b49b44,	0x29bb787d,	0x0e58f10a,	0x43042b8e,
-0xd424849c,	0xfad28134,	0xefff8e12,	0x3d9bcadf,
-0x67f9aa5c,	0x34129664,	0x710c9e14,	0xdb1c0ba3,
-0xfe75b38d,	0x5a421286,	0x8bf94933,	0x7e4446e1,
-0x79d4ef3e,	0x85124855,	0x2640de62,	0xec172eac,
-0x70d6d02e,	0xe6bd1522,	0xbe71363f,	0xf88dac30,
-0x7b6c146e,	0xc979a8e3,	0x177d9714,	0xc4552929,
-0xb8de5377,	0x26262eaa,	0xa650654c,	0x363846d3,
-0x4773b4a1,	0xcfe7dd20,	0xbd29e2da,	0xfbb3811f,
-0x75bb90ce,	0xe8e6fd74,	0x209fe1d7,	0xc06fb9fc,
-0xc95cf776,	0xf73f0253,	0x81ee0e10,	0x30dababc,
-0x99c09050,	0xd9390ebe,	0x0f32124f,	0x2aaac59f,
-0xfbaac523,	0xd9d6dbd8,	0x81509734,	0x9b3a6e21,
-0xf2933052,	0x2159de94,	0xd69d47c9,	0x4c6a2a83,
-0x2b6b0832,	0x4be2739e,	0x5e19abef,	0xb8f3e429,
-0x96cb048f,	0x735638c4,	0x663b3bcc,	0x07a86d81,
-0x31de29c5,	0x90c9a217,	0x6fb5bc34,	0x4099b35d,
-0x1e000237,	0xc4b3e07e,	0x1f969255,	0xb8b58110,
-0x2df57649,	0x7f6911b6,	0x096e9f23,	0x5914dec9,
-0x5ec6efd0,	0xb236d75a,	0x03a70758,	0xd2011163,
-0x4e9603f0,	0x683d1d35,	0x4558d5d7,	0x2c77e721,
-0xe2bc28b9,	0xd2252e46,	0xdd0a1a50,	0x0dbcbadc,
-0x29435c48,	0x091e76e2,	0x8b3f2627,	0xf320f8f2,
-0xc8bcb1cd,	0x36e35ca8,	0x82a5ea04,	0xe8ebc0cd,
-/*  1341-m01f2529.inc  */
-0x00000001,	0x00000029,	0x08112004,	0x00000f25,
-0x2795ba4b,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x017464fa,	0xd2fb3494,	0xaf1850af,	0x5af88989,
-0xd3a0a9dd,	0x8e8bd3ad,	0x8c288786,	0xf15f02b0,
-0xf51c1471,	0x6c675200,	0x9c63f3e5,	0xbeb2d710,
-0xbfb6d14e,	0x6ba07894,	0x4b08036d,	0x71a24d5a,
-0x953125c3,	0x2cee5c1f,	0x744a15b1,	0x43a6f67c,
-0x66087dce,	0x58bc5f0c,	0x09c1f187,	0x29065a8c,
-0xb46dcc30,	0x597c4675,	0x2ce2fd55,	0x7329e04a,
-0xe92adf75,	0x0a4f1f59,	0x6939b7e1,	0x586b6cb9,
-0x9e9090f2,	0x612aeaa6,	0x908cfbac,	0x381a3a1d,
-0xc0028180,	0xe7759a09,	0x9a41f6d0,	0x49004723,
-0x447b0a1e,	0x84cea1bf,	0xdb6cfd61,	0xfa3fe8a1,
-0x60569cec,	0x4ed55542,	0xc40d1fbb,	0x9766fe4a,
-0xbffcd59e,	0xc0ec45af,	0x34da2fa6,	0x57a8f38b,
-0x7cf8ab33,	0x991f0a4b,	0x83c635f3,	0xfaa6b412,
-0xd6cfe7cd,	0x7eb7773c,	0xda12abb8,	0xae7f78c6,
-0x0c82ad31,	0x28e15d48,	0x80a0cf1e,	0x6b8a9a75,
-0x1a9aa64f,	0x4a2969ee,	0x9273d48d,	0x7179df33,
-0x06fc27f8,	0x7de9a40b,	0xaaa80cac,	0x83d82561,
-0xe0646103,	0xa72284fa,	0xb39b5822,	0xed08ed9d,
-0x95760781,	0x2f84666f,	0xd1d45bed,	0x96a86c3a,
-0xe4679e8a,	0xfa71d608,	0x86baebc4,	0xf116edb0,
-0xd3a7263f,	0x237b4f06,	0x794f33e6,	0x0d783309,
-0x2df3bb25,	0x02a800b8,	0x97b8ce5a,	0x2123dc61,
-0xee1a5dbe,	0x185cf436,	0x84e325f6,	0x163e3ac3,
-0x62288e57,	0xe5901f0f,	0xef985c3e,	0x1b9291fe,
-0xb58de2b0,	0xe69eeadb,	0x42eefa7f,	0x0472359e,
-0xb1fd90dc,	0x49d374d3,	0x49684482,	0x1156a2ac,
-0xd0a6114a,	0x995f94a6,	0xbcf9ed4f,	0x51d161c3,
-0xcc68e39f,	0x3d050ca9,	0x8cd08b93,	0x6ed69d22,
-0x5fd5cc93,	0xe2783743,	0x5a1816c3,	0xda5a0ea4,
-0x9b5c7903,	0xc25d6a23,	0x25cd54ee,	0xe1ab0174,
-0x518ffebc,	0x28125044,	0x7ff130d8,	0xfbea3a8d,
-0xe093582b,	0xf60baa3d,	0xe4674a15,	0x18a6322c,
-0x21cfa3bf,	0x71a1a376,	0xdd4de139,	0xed578831,
-0x0ab06a62,	0x9cee036d,	0x11ee0350,	0x62ee22d0,
-0x83681acb,	0xef69ded4,	0x65000a40,	0x9ac7ab74,
-0xd76792db,	0xf2e662f2,	0xdcae14a5,	0xfa39ba60,
-0xf746cf70,	0x0bea4f1b,	0x9b384717,	0xf8dafd90,
-0xb2ffc2ab,	0xf3fa97e4,	0x5f22e0c3,	0x04536e9d,
-0x22c99598,	0x34631815,	0x9fc99bfa,	0xfe067ae7,
-0x03fbd87a,	0xdc73bcd2,	0xc49a0fbc,	0x3138c419,
-0x62643c63,	0xfa2597c7,	0x4c84afef,	0xdba2817e,
-0xe818ed14,	0x74a5ad6b,	0x9cf3ced5,	0xf633dd12,
-0x4ba39a46,	0x8b37b668,	0x65637f55,	0x67c7ce04,
-0xe860a2e3,	0xf264ba03,	0x47b91726,	0x887f4d41,
-0xb10685e0,	0x95958791,	0xcb835bbc,	0xf1af6594,
-0x42fb5a5b,	0x78ff5368,	0xb201a575,	0x8a6b189c,
-0xc3f6e3a0,	0xe2bb320e,	0xd75004dc,	0x735b0c3b,
-0x70ccd09f,	0x4d157775,	0xc0663e58,	0xf2170355,
-0x4d86c74b,	0xace253a3,	0x09fedbf3,	0x5288ffb6,
-0xc577a648,	0xf808ffc9,	0x6f1b81ee,	0xa56d4123,
-0x60626a1b,	0xc88b4d17,	0x280e44c5,	0xf56c8ddd,
-0x9110c257,	0x2d65519d,	0xc96c1ad5,	0xcfdea3e5,
-0xa69ea62f,	0xf3ed57ab,	0xbe725f8c,	0x2e3c86df,
-0x23635626,	0x7d2607f6,	0x67fe2874,	0xe64ade4d,
-0x5fe967da,	0x88cb5547,	0x468c3eb5,	0x73313404,
-0x36b6cc3f,	0xf352d0fc,	0xcbd702bd,	0x969a1606,
-0xead2f56d,	0xf4c93dd8,	0xd2395873,	0xe5304e3c,
-0xdbe3e804,	0x1daf81c0,	0xfd6cbdac,	0xfbb07447,
-0x1970d752,	0xff97a936,	0x1cf114a2,	0x03b678d5,
-0x6edaacf8,	0xd4a869c9,	0x6db6f5fa,	0xe48335d1,
-0x6c59f701,	0x2cd977a6,	0x02079375,	0xc573f27b,
-0xd26f8f28,	0xe637b462,	0xb9ef5a9d,	0x2483a550,
-0x8e020039,	0x01d2e9d0,	0x8e69c688,	0xfbf941b7,
-0x86dcab40,	0xe99730b6,	0x0e57bd5d,	0x11ace616,
-0x3a5c73dd,	0xe29052c6,	0x6728d6e3,	0xf5a73743,
-0x6ef89691,	0xffa40f45,	0xd1a1b739,	0xf12697be,
-0xfc849142,	0x1a6daa37,	0xc52c54a3,	0xe600bbb2,
-0x6c90e1e9,	0xf9ba4ed6,	0x118b0436,	0x0d864deb,
-0xa574b526,	0x6f2da0ae,	0x7297e467,	0xe33a4e82,
-0x6e8a340f,	0x9524f758,	0xb7d9d387,	0x67ed6069,
-0x3fcef9be,	0xf3684381,	0xb8012434,	0x86d3a9a9,
-0xdb45b646,	0x8de08c40,	0x37a91d86,	0xfd107ef4,
-0x0b1db4d3,	0x73988186,	0x74b646a5,	0x92e5a61f,
-0x72239610,	0xf9b6564d,	0xce99179a,	0x61ebb35c,
-0xfb2495bd,	0x36ab39d8,	0x7cca0da4,	0xec4b5d5c,
-0x3210c169,	0xda27c02b,	0xd80c5c8c,	0x38518cea,
-0x5daa2473,	0xf15b6134,	0x733e7412,	0xd6a5ae78,
-0x3b0d4f4d,	0xc6304bb2,	0x7f6df8e6,	0xf6b0e912,
-0x2da01433,	0x2cf7b1ce,	0x32e046e7,	0xcd50021d,
-0xe39d167d,	0xef608f10,	0x5d96e85e,	0x38a113a7,
-0x3ce761fa,	0x26a0250e,	0xa27c2468,	0xfd563262,
-0x9f6f6866,	0xda194d33,	0xa5458a6c,	0x32aa53c8,
-0x2517e3bb,	0xe5070380,	0x72d71801,	0xdee77333,
-0x63f71503,	0xe4cc9d5a,	0x1f684f79,	0xebab1828,
-0xcfdcbec2,	0x1913c83c,	0x72abfe52,	0xfcadec5a,
-0x9a32da3e,	0xf730dc13,	0x529ec685,	0x1d558dfa,
-0x3fb232f2,	0x041148b4,	0xd10bb0b7,	0xeb6821e2,
-0x070d709f,	0xf92b67a4,	0x6d6af041,	0x1724d766,
-0xf21a821d,	0xea6e49d8,	0x9d30cef2,	0xe0c055b1,
-0x67901316,	0xb37f63f9,	0x5984e1b1,	0xf83466f0,
-0x1404ac22,	0x4345d90c,	0xa14ef8b7,	0xa812e742,
-0x62593a25,	0xf08c3643,	0x3b376203,	0x5ddf0e1a,
-0x429c87d0,	0x31c7a9f9,	0x18f25314,	0xf55e9515,
-0xd26dde06,	0xd07605c7,	0x51877d68,	0x31054918,
-0x668e3ae2,	0xe273138d,	0xef9b9beb,	0xcf19359e,
-0x7ccb675b,	0xca018219,	0x1a614824,	0xa1ac60f6,
-0x512484e2,	0x249d2429,	0xa4e02fce,	0x85c52616,
-0xfc3e1b33,	0x11885bef,	0xf1729589,	0x78342f7a,
-0x3a115d84,	0x74698c2a,	0x59b804d6,	0x96598928,
-0xeafb3b9f,	0x788556ba,	0xf956a1c4,	0x5ae7d9b0,
-0xe86bc7d9,	0x7483aa3f,	0xa2126202,	0x5852027c,
-0xbb2db21b,	0xdf7dcaec,	0x3eaa745c,	0x49390086,
-0x60575f57,	0xba173f97,	0x90bd11ab,	0x0db322ea,
-0x2a57df73,	0x89157540,	0x57bdf2fb,	0x32b0919b,
-0x135b0600,	0xaaeb1076,	0x2a7b30ed,	0x73f755fe,
-0x81650eb2,	0x4640b0f0,	0x6f89926c,	0x4bd8b89b,
-0xb8233621,	0x24a33dcf,	0x1a6bbb6b,	0xeb01530f,
-0xf481b825,	0xcdc1c14e,	0xbb207fb0,	0xd83e142b,
-0x95b20b94,	0xe50ac19f,	0x6d3e3ef6,	0x266e4143,
-0x27a006aa,	0x2ec25d26,	0x85235a01,	0xd049df42,
-0x1ce6650f,	0x3a1657ed,	0xe5f9ecbf,	0x6d18d58f,
-0x0da6ed67,	0x3d9f6f19,	0xeb186779,	0x0bd00e5f,
-0x21fe220d,	0x742ccb0a,	0x622e21ef,	0x96cedf92,
-0x11240fea,	0xf6b746d7,	0xff91e400,	0xecaeab21,
-0x072c35cd,	0x9ac8fc0d,	0xa263d5a6,	0x3fd105f9,
-0xb81600fd,	0x0a292f3f,	0x89b9c1ce,	0xd16a28e5,
-0xfc7f3fdf,	0x2450c2d6,	0x494e87c4,	0x1d9b4dd9,
-0x1b40fac1,	0xcee2e920,	0x7cee58ef,	0x361ab9f6,
-0x1bac7d85,	0x0bd85367,	0x2df2f60b,	0x07bbc733,
-0xd8b22847,	0x2e54d3f4,	0x76b49bfc,	0x336f0ea5,
-0xd93b81d1,	0x1eceed7b,	0x563bb551,	0x80a5f398,
-0xd9ff04c6,	0x30a4f554,	0x56c69654,	0x725b2af5,
-0x9c07b877,	0x9da21f3a,	0x730581ce,	0xf2dfc2ed,
-0x45d0c7b2,	0x748ef602,	0x7d186c9b,	0x633aaa77,
-/*  410-MU16522d.inc  */
-0x00000001,	0x0000002d,	0x05181999,	0x00000652,
-0x35182bc2,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x34dc2e66,	0xd27f9e0b,	0x6b5b66e1,	0xe349c526,
-0x75b53339,	0xceaf0faf,	0x43377bf8,	0xd3de4b79,
-0xabdcd0ae,	0xe6ece6b2,	0x323c792b,	0x4656028b,
-0xabf8fde6,	0x46f5d8e4,	0x396ca1cb,	0x7b420d12,
-0x13aa276e,	0x9c6c36ce,	0x22b1e7c9,	0x38c0ef9f,
-0x5a5b5d7b,	0x3ac00239,	0x6de2d01a,	0x0c3b8968,
-0xbf1bb741,	0x21888846,	0xd9d2dfee,	0x51a50463,
-0x6529e703,	0x1891c9bc,	0x68d19cb6,	0xc8ca396e,
-0x3fd56452,	0x3daf09c0,	0x3e9f5c65,	0xb00b2dd6,
-0x34c06009,	0x116b7fc7,	0x10f4a379,	0x56448896,
-0xeb1af49a,	0xfa469de5,	0xe6219c14,	0xa616ab2c,
-0x554a1561,	0x2962420a,	0x1dffc2fc,	0xb824c7ec,
-0x3ba550e2,	0xe784e9e7,	0xf1a0d150,	0xc96568db,
-0x1e68af03,	0xc34d1f7e,	0xb3eb5222,	0x0d86e6c6,
-0x3edc0e81,	0xbfc6c906,	0xbccbb4e5,	0x66780923,
-0x961736f4,	0x02cc763c,	0x3938655e,	0xd6ce2840,
-0xb26b29fd,	0x128a069d,	0x4d3c06ff,	0x0ba25f3f,
-0x681a85bc,	0x6de8b8e0,	0xb680e272,	0x34aa348e,
-0xb4f3607f,	0x12c2f64d,	0x9b95d9fb,	0x3e534391,
-0xde916e89,	0x81c5a6e9,	0x7a377fcf,	0xb1d53d3d,
-0x8eaacd29,	0xf70d507c,	0x1ca89cb5,	0xab250aeb,
-0x4e2cee69,	0xe0d62342,	0x37ffa79d,	0xdec3a3e0,
-0xd5e107bd,	0x44a12304,	0x12f56061,	0xe75f935a,
-0xe697e2bc,	0x72e0cfef,	0x40f37d47,	0x151df42b,
-0xe722c56f,	0x335c122b,	0xd21d1ef4,	0x40210853,
-0xbb95dcc3,	0x9398175f,	0x961ee4e8,	0xb0d00aba,
-0x95411710,	0xdc208d4a,	0xddd31d07,	0x32823f2b,
-0x82ba3b93,	0xabc82d3f,	0xc2161f81,	0xa777fe7e,
-0x22f487b3,	0xb2cd9662,	0x222527cf,	0x431adf1c,
-0x11b4e831,	0x2888bd62,	0xf993b098,	0xbaa51f92,
-0x62ca791f,	0x8fc20296,	0xbef56808,	0x8eba8023,
-0x33d74e7b,	0xa65b5e21,	0xd6bee1ff,	0x73283195,
-0x06fcd98c,	0x768f8241,	0x0a8d5b5a,	0xfb6d8e00,
-0x2eb1e108,	0x10a0a67d,	0x761727ba,	0xfc144648,
-0xa609154d,	0x8582bc2c,	0x6ba59d8b,	0xbbf80e58,
-0x4859c3d7,	0xabb7d38d,	0x52665ca0,	0x1fe477e5,
-0x65fdeeef,	0xc624a036,	0xb79e0897,	0x32233ccf,
-0xe2b91643,	0x1aec523a,	0xad9de722,	0xc00e4919,
-0xa7da623f,	0xf21094ed,	0x3aee295b,	0xdd1aa696,
-0xfdd5f1d0,	0xc07016be,	0xb2f18c64,	0x6b277832,
-0x74fcb662,	0x9010ae3f,	0xb1baa7e9,	0x40ba08b9,
-0x918c135a,	0x2958ecbb,	0x15ff3626,	0x1cc98354,
-0x3abd188a,	0x30ae97e0,	0x2a33013e,	0x8ffb66d3,
-0xd81b9918,	0x7bbfe734,	0xadd0be6c,	0x15386784,
-0x051f3d28,	0x7bbe4c68,	0x78b2d92b,	0x280efe91,
-0x5757b1eb,	0xc26d03c9,	0xbbdd374f,	0x2ae02697,
-0x68329100,	0xfd8aae6d,	0x60a3dceb,	0xc7d6af76,
-0x894dc15f,	0x11aabd09,	0x18605a69,	0x52a14016,
-0x56f5a041,	0xd2c6e6c7,	0xe6886a23,	0x14f91266,
-0xcbed2885,	0xd3d45dd7,	0x9878d751,	0x822a5baa,
-0xd8533c7b,	0xbd4338de,	0x618a9ffa,	0x4bf77e5e,
-0x65c6ab82,	0x2f69c2a7,	0x02bee5fd,	0xc0a8d2f6,
-0xc6b02d78,	0xdfc567da,	0x658c28fc,	0xcefee2b9,
-0x074f0615,	0xfa442352,	0xaf613696,	0x9c9e7f32,
-0x033d5c94,	0x9cf17096,	0x50ecb9ec,	0x2016a0a2,
-0xbc553203,	0x886642f5,	0x6aff9fe4,	0xaddb42a9,
-0x954af4d8,	0x92041ec5,	0x9eaf96bd,	0x83986d41,
-0xadab6db6,	0xedab0945,	0xfe62e5ec,	0xba043d1f,
-0xb1789301,	0xeb41a778,	0x319d17a4,	0x1f98a30d,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1100-m04f2737.inc  */
-0x00000001,	0x00000037,	0x06042003,	0x00000f27,
-0x972cd5fa,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x0000005e,	0x96f952a6,	0xaa368f02,
-0x53d271e6,	0xf8286513,	0x484b4e9a,	0x9e0c09c2,
-0x03b11314,	0xdfb67c98,	0xa2957d16,	0xf07f25de,
-0xb84a2555,	0x72ec8b35,	0x3445c734,	0x7744f543,
-0xc3da0cc0,	0xeb36172d,	0x8b2cf574,	0x29c867a2,
-0xe79dfaf0,	0x54714bb5,	0x524dfb69,	0x0df65433,
-0x0b95ec14,	0x3dc09ca2,	0x584ba068,	0x2aa558ce,
-0x8cd679c8,	0x3b2609d0,	0xa06306d1,	0x80bfa93a,
-0x482678d8,	0x0cdf1ce6,	0x5ec4e912,	0x8a19f7a6,
-0x76f215be,	0x577d92c2,	0x479cd4ba,	0x63d1f415,
-0x5af98bc5,	0x8889bb4f,	0x8e70943d,	0xb5528299,
-0xfd63e347,	0x836fcfd0,	0x4951a701,	0xf4613cdb,
-0xaa7c2f52,	0xa0e290c7,	0xf646a80b,	0xda5b5a03,
-0x93517b47,	0x553d99d1,	0xafac198e,	0x486b6c6b,
-0x4efa01d8,	0xdc6ce226,	0xdac3a149,	0x9b7cf27f,
-0x6c6246a0,	0xb6055a39,	0xb68cc841,	0x87b6adee,
-0x1c36edb4,	0x3ee76d20,	0xdbffab67,	0xed12fda6,
-0xc1aff2f2,	0xc110932f,	0x0933ccfe,	0x58fa2281,
-0x285d5ec1,	0xd05b216a,	0x76315645,	0x570c5c8f,
-0x6cc52f1c,	0xaa977e52,	0x066f4e03,	0x812bfd2c,
-0xbfbfd7a9,	0x70828199,	0x60182af7,	0x2a04e000,
-0x30f413b7,	0x327cef32,	0xac73aa51,	0x7c418d9f,
-0xf493ce0e,	0x6c14258d,	0xa5e2755e,	0xd39f994a,
-0xee638b08,	0x55d50476,	0x9b7afc5c,	0x5da2ed13,
-0xb75bf9f4,	0x2606c01d,	0x8a1d00eb,	0x0f73428f,
-0xb29c4fb4,	0xac13e554,	0xa7648fe0,	0xbe56837b,
-0xd34fa9ff,	0x59c855a2,	0x7d3cc7d7,	0xb5b0cb50,
-0xe6626c0b,	0xf07010b7,	0xd8054587,	0x01a5327a,
-0x3ceae28b,	0xa3bf737f,	0x3d1a37e7,	0x6ce48d1d,
-0xc9d91222,	0x42f28fae,	0xe8dff3e4,	0xfd6898d0,
-0xe772ab47,	0xbe452c12,	0xf188ee09,	0x08edb79c,
-0xad4d48fb,	0x5cb75d1d,	0x251f4e02,	0x6b7bb6e3,
-0xcada2f09,	0x536d74eb,	0xacfa627a,	0x51e2ffd2,
-0xe4655767,	0x311dbbec,	0x1011b68a,	0x6f6e8deb,
-0x4298665d,	0xc0522b3c,	0x2c3a19dc,	0x2c48f2ae,
-0x49bca621,	0xb6a747fe,	0xa1606c81,	0x9b2a5318,
-0x0ac114c3,	0xb5b35aa0,	0x3f4ee00d,	0x8b427e75,
-0xb539fcd3,	0xa99fba84,	0x821fc647,	0xe0ac6d6e,
-0x912f6f88,	0xf2009cd8,	0xb32330b3,	0xd0b80514,
-0x6f25f157,	0xdba2f463,	0x88ef17d1,	0x147c5f21,
-0x6e29cd75,	0xec14e5d1,	0xdcfffd24,	0xccc2c510,
-0xe5e40798,	0xb24814e1,	0xaf0cdaf2,	0x825cf5e2,
-0x12acac6b,	0x439c5f36,	0x0c533619,	0x8e776e71,
-0x319b44f5,	0x19c0b404,	0x54111b2a,	0x6a767513,
-0xb16944ef,	0x30ef18ce,	0x85df0862,	0x0737ff49,
-0x77fe06f2,	0xb2de0d2f,	0x71625e95,	0xc722c5a2,
-0x03b401a9,	0xe8b030b4,	0x7f9e62ab,	0xbff8c966,
-0x726bfeca,	0x6adf3831,	0xab85067e,	0x5167e87a,
-0xb06ad00c,	0xdd974309,	0x5704880d,	0xb7279a43,
-0x38aeda19,	0x52f5a31f,	0xd66d79e2,	0x83dad3db,
-0xa138d066,	0x0b4674d4,	0x07e7dd7a,	0x7f5c70c7,
-0x4aade5f0,	0x4fcd220f,	0x2ae8ab6f,	0x6fb11f68,
-0xbf134ecc,	0x71d3125c,	0x3cc3f6ba,	0x92809507,
-0xb4a9b236,	0x97a2ef5f,	0xe20e5f23,	0x5610bfa9,
-0xad16eba9,	0x5207dfba,	0x0caa3d20,	0xc57cccba,
-0x7983d15d,	0x09ced949,	0xec698959,	0x53a4b153,
-0x63c74107,	0xacf58270,	0xbc2982cd,	0x42bf9c41,
-0x26aff8b4,	0x9832bd6e,	0x34e98158,	0x434f0f43,
-0xcb80ccda,	0xd81471b6,	0xbd176071,	0xab13735c,
-0x4e80e2c1,	0xcf7815f0,	0xb4e6ae37,	0x1a90c457,
-0x79426d6f,	0xa4ac1e2c,	0xf76de77b,	0x1808cd61,
-0xd72ea071,	0x1f02af0e,	0x9613b531,	0xe83f2e9a,
-0x99a5262a,	0x0e8a756d,	0xbc229ac4,	0x2cb1af6b,
-0x8a8720d6,	0xc84d2c77,	0x8547ad96,	0xeb794e72,
-0xb51119ea,	0x1c0121ea,	0x9f8ae83b,	0x16459999,
-0x5c17deaf,	0x278a3e3b,	0xf2bbb704,	0x54df1a00,
-0x521ef94e,	0xd40de734,	0xca5badee,	0xa2fe3027,
-0x2ffe3ada,	0x1df00fb9,	0x5feb168c,	0x81674308,
-0x99713c0e,	0x56aae017,	0xe62e68f3,	0xaa15163a,
-0x31ac7b10,	0xe6a86d9c,	0xa006782e,	0x9baefc91,
-0x111277d5,	0x80f63a4b,	0x624044d6,	0xd91a5de5,
-0x5d0255d6,	0x92b82310,	0x08faf5e5,	0xe482ff69,
-0x0a1f1757,	0xdc010e34,	0x9cd07e48,	0x677fcfa3,
-0x0384138d,	0xa104220a,	0x5431c7ec,	0x0e8b7efb,
-0xf1ebcd61,	0x97ae7029,	0x191ff006,	0x4308b147,
-0xa11e05f7,	0x2c7cb5a4,	0x1d345971,	0x28d23638,
-0xc5a7a5bb,	0x3307c971,	0x0d3782ae,	0x2b798842,
-0x1fc27334,	0x4ff82ddb,	0x543ba685,	0x47732c7a,
-0xad094a6e,	0xb8ff60e4,	0x43f9ee2f,	0xe9a114e8,
-0xf036be6e,	0x3fb488a0,	0x280b2d46,	0xb1887c58,
-0x54ae583a,	0x454b6ce6,	0xe617a2c1,	0xb9335ac3,
-0x72361e12,	0xc856637a,	0x741b6cbe,	0xcf1f6f25,
-0x9f405fff,	0xd2525b02,	0x22d8b05a,	0x16860f11,
-0xb02983e9,	0x388b9c2c,	0x196cb2f2,	0xfca5f1a2,
-0x9e60965d,	0x5bed99ff,	0x59e361fc,	0x9361bde8,
-0xa1527365,	0x3f300237,	0xb0f5e2b8,	0x8fb00a40,
-0x71cb9744,	0x3327e8d3,	0xe89994d4,	0x3987e389,
-0x28c6d8f7,	0xb2ba9fc4,	0xdf109e0e,	0x622634b2,
-0x4904a82e,	0x576c3c2f,	0xe95eae46,	0xfb773013,
-0xf98b91de,	0x4edc30d5,	0xc6e60080,	0xebefab96,
-0xd7684df2,	0x9cd2c3e1,	0xd433902a,	0x7b9aa9eb,
-0x3c99cbaa,	0x5a0fa53d,	0x77297830,	0x869db621,
-0xaee2d56a,	0x2ce907c1,	0x0aa5097c,	0x662e7862,
-0xa5bfbc61,	0x2610f3bf,	0x3a741865,	0x99a5836d,
-0x2e533e3b,	0x812aa485,	0x0d7eb66d,	0xb325db47,
-0x6ac77937,	0xa1757eb7,	0xb7765633,	0x8845f18f,
-0xde7e37f8,	0x08a17789,	0x8af720ca,	0x1f7a530f,
-0xadcbb072,	0xd02e2dae,	0x16fbe58f,	0x0e4df085,
-0x80663766,	0xdcff020e,	0x4c242d70,	0x3d16d122,
-0x154a029b,	0x40c95a2e,	0x5f98eb6f,	0x637ffc42,
-0xcdf10a5c,	0xf2211055,	0x998ddc8b,	0xcee90fd8,
-0x1ddc7fad,	0x7034d80c,	0xf5bf0592,	0x479205bc,
-0x0900e9c9,	0x7bef8c77,	0xc128cebf,	0x9e7dd814,
-0xedca7a5e,	0xf15af942,	0x40e55228,	0x065ea7ce,
-0x9603da92,	0xa6611211,	0xea9dad76,	0x4fd9d974,
-0xea19cb68,	0xeabf508d,	0xd460f6c0,	0x3951733a,
-0x249a4453,	0x04356966,	0xac6ec71e,	0x5253e669,
-0xfca78245,	0x8ef4d888,	0x6c031fef,	0x8c49e3df,
-0xc426b290,	0xfcfd6f10,	0x3a350c13,	0x79790fb9,
-0xe9df4ade,	0xd06233f0,	0xe05f0f19,	0x5fb73288,
-0x43d01849,	0xd9eb862b,	0xb1510767,	0xcbbe3725,
-0x858ac14f,	0x01a0fd53,	0x16a566c9,	0x7d85d87c,
-0x6a29b505,	0xc6134b4c,	0x5d528018,	0xfd7f8efe,
-0x34268400,	0x98314e02,	0x97b0ed0a,	0xec85ca3f,
-0x4dcf5ffc,	0xfb122fc1,	0x04e5a370,	0x8d3040a4,
-0x5c2bcad4,	0x6feb287b,	0xe30f7860,	0x631d7a5a,
-0x766b9c79,	0x971e2fda,	0x2f7000fd,	0xbd3b9a59,
-0xa56dd367,	0xb3deef76,	0x8c2bbcfe,	0x756ec279,
-0xbfaca177,	0xb86ab4f6,	0xb3f82039,	0x93231bfe,
-0xc8409b8d,	0x16cca28f,	0x367c7562,	0x974a6ace,
-0x0101281c,	0xb61716e2,	0x85ef5a4a,	0x78807b55,
-0x009828be,	0xd92cee5c,	0xe8e675a9,	0x368ec88a,
-0xbdb4d170,	0x9f15e2f6,	0x8b53ad97,	0xeedd0bbd,
-0x38f1c5c3,	0x0bf12b39,	0x1f38b2ee,	0x1b6b39a1,
-0xa5e3b7c5,	0xd30fde23,	0x6aa07a5d,	0x2426b2bd,
-/*  1343-m04f252b.inc  */
-0x00000001,	0x0000002b,	0x08112004,	0x00000f25,
-0xe4dcce66,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x017464fa,	0xd2fb3494,	0xaf1850af,	0x5af88989,
-0xd3a0a9dd,	0x8e8bd3ad,	0x8c288786,	0xf15f02b0,
-0xf51c1471,	0x6c675200,	0x9c63f3e5,	0xbeb2d710,
-0xbfb6d14e,	0x6ba07894,	0x4b08036d,	0x71a24d5a,
-0x953125c3,	0x2cee5c1f,	0x744a15b1,	0x43a6f67c,
-0x66087dce,	0x58bc5f0c,	0x09c1f187,	0x29065a8c,
-0xb46dcc30,	0x597c4675,	0x2ce2fd55,	0x7329e04a,
-0xe92adf75,	0x0a4f1f59,	0x6939b7e1,	0x586b6cb9,
-0x9e9090f2,	0x612aeaa6,	0x908cfbac,	0x381a3a1d,
-0xc0028180,	0xe7759a09,	0x9a41f6d0,	0x49004723,
-0x447b0a1e,	0x84cea1bf,	0xdb6cfd61,	0xfa3fe8a1,
-0x60569cec,	0x4ed55542,	0xc40d1fbb,	0x9766fe4a,
-0xbffcd59e,	0xc0ec45af,	0x34da2fa6,	0x57a8f38b,
-0x7cf8ab33,	0x991f0a4b,	0x83c635f3,	0xfaa6b412,
-0xd6cfe7cd,	0x7eb7773c,	0xda12abb8,	0xae7f78c6,
-0x0c82ad31,	0x28e15d48,	0x80a0cf1e,	0x6b8a9a75,
-0x1a9aa64f,	0x4a2969ee,	0x9273d48d,	0x7179df33,
-0x06fc27f8,	0x7de9a40b,	0xaaa80cac,	0x83d82561,
-0xe0646103,	0xa72284fa,	0xb39b5822,	0xed08ed9d,
-0x95760781,	0x2f84666f,	0xd1d45bed,	0x96a86c3a,
-0xe4679e8a,	0xfa71d608,	0x86baebc4,	0xf116edb0,
-0xd3a7263f,	0x237b4f06,	0x794f33e6,	0x0d783309,
-0x2df3bb25,	0x02a800b8,	0x97b8ce5a,	0x2123dc61,
-0xee1a5dbe,	0x185cf436,	0x84e325f6,	0x163e3ac3,
-0x62288e57,	0xe5901f0f,	0xef985c3e,	0x1b9291fe,
-0xb58de2b0,	0xe69eeadb,	0x42eefa7f,	0x0472359e,
-0xb1fd90dc,	0x49d374d3,	0x49684482,	0x1156a2ac,
-0xd0a6114a,	0x995f94a6,	0xbcf9ed4f,	0x51d161c3,
-0xcc68e39f,	0x3d050ca9,	0x8cd08b93,	0x6ed69d22,
-0x5fd5cc93,	0xe2783743,	0x5a1816c3,	0xda5a0ea4,
-0x9b5c7903,	0xc25d6a23,	0x25cd54ee,	0xe1ab0174,
-0x518ffebc,	0x28125044,	0x7ff130d8,	0xfbea3a8d,
-0xe093582b,	0xf60baa3d,	0xe4674a15,	0x18a6322c,
-0x21cfa3bf,	0x71a1a376,	0xdd4de139,	0xed578831,
-0x0ab06a62,	0x9cee036d,	0x11ee0350,	0x62ee22d0,
-0x83681acb,	0xef69ded4,	0x65000a40,	0x9ac7ab74,
-0xd76792db,	0xf2e662f2,	0xdcae14a5,	0xfa39ba60,
-0xf746cf70,	0x0bea4f1b,	0x9b384717,	0xf8dafd90,
-0xb2ffc2ab,	0xf3fa97e4,	0x5f22e0c3,	0x04536e9d,
-0x22c99598,	0x34631815,	0x9fc99bfa,	0xfe067ae7,
-0x03fbd87a,	0xdc73bcd2,	0xc49a0fbc,	0x3138c419,
-0x62643c63,	0xfa2597c7,	0x4c84afef,	0xdba2817e,
-0xe818ed14,	0x74a5ad6b,	0x9cf3ced5,	0xf633dd12,
-0x4ba39a46,	0x8b37b668,	0x65637f55,	0x67c7ce04,
-0xe860a2e3,	0xf264ba03,	0x47b91726,	0x887f4d41,
-0xb10685e0,	0x95958791,	0xcb835bbc,	0xf1af6594,
-0x42fb5a5b,	0x78ff5368,	0xb201a575,	0x8a6b189c,
-0xc3f6e3a0,	0xe2bb320e,	0xd75004dc,	0x735b0c3b,
-0x70ccd09f,	0x4d157775,	0xc0663e58,	0xf2170355,
-0x4d86c74b,	0xace253a3,	0x09fedbf3,	0x5288ffb6,
-0xc577a648,	0xf808ffc9,	0x6f1b81ee,	0xa56d4123,
-0x60626a1b,	0xc88b4d17,	0x280e44c5,	0xf56c8ddd,
-0x9110c257,	0x2d65519d,	0xc96c1ad5,	0xcfdea3e5,
-0xa69ea62f,	0xf3ed57ab,	0xbe725f8c,	0x2e3c86df,
-0x23635626,	0x7d2607f6,	0x67fe2874,	0xe64ade4d,
-0x5fe967da,	0x88cb5547,	0x468c3eb5,	0x73313404,
-0x36b6cc3f,	0xf352d0fc,	0xcbd702bd,	0x969a1606,
-0xead2f56d,	0xf4c93dd8,	0xd2395873,	0xe5304e3c,
-0xdbe3e804,	0x1daf81c0,	0xfd6cbdac,	0xfbb07447,
-0x1970d752,	0xff97a936,	0x1cf114a2,	0x03b678d5,
-0x6edaacf8,	0xd4a869c9,	0x6db6f5fa,	0xe48335d1,
-0x6c59f701,	0x2cd977a6,	0x02079375,	0xc573f27b,
-0xd26f8f28,	0xe637b462,	0xb9ef5a9d,	0x2483a550,
-0x8e020039,	0x01d2e9d0,	0x8e69c688,	0xfbf941b7,
-0x86dcab40,	0xe99730b6,	0x0e57bd5d,	0x11ace616,
-0x3a5c73dd,	0xe29052c6,	0x6728d6e3,	0xf5a73743,
-0x6ef89691,	0xffa40f45,	0xd1a1b739,	0xf12697be,
-0xfc849142,	0x1a6daa37,	0xc52c54a3,	0xe600bbb2,
-0x6c90e1e9,	0xf9ba4ed6,	0x118b0436,	0x0d864deb,
-0xa574b526,	0x6f2da0ae,	0x7297e467,	0xe33a4e82,
-0x6e8a340f,	0x9524f758,	0xb7d9d387,	0x67ed6069,
-0x3fcef9be,	0xf3684381,	0xb8012434,	0x86d3a9a9,
-0xdb45b646,	0x8de08c40,	0x37a91d86,	0xfd107ef4,
-0x0b1db4d3,	0x73988186,	0x74b646a5,	0x92e5a61f,
-0x72239610,	0xf9b6564d,	0xce99179a,	0x61ebb35c,
-0xfb2495bd,	0x36ab39d8,	0x7cca0da4,	0xec4b5d5c,
-0x3210c169,	0xda27c02b,	0xd80c5c8c,	0x38518cea,
-0x5daa2473,	0xf15b6134,	0x733e7412,	0xd6a5ae78,
-0x3b0d4f4d,	0xc6304bb2,	0x7f6df8e6,	0xf6b0e912,
-0x2da01433,	0x2cf7b1ce,	0x32e046e7,	0xcd50021d,
-0xe39d167d,	0xef608f10,	0x5d96e85e,	0x38a113a7,
-0x3ce761fa,	0x26a0250e,	0xa27c2468,	0xfd563262,
-0x9f6f6866,	0xda194d33,	0xa5458a6c,	0x32aa53c8,
-0x2517e3bb,	0xe5070380,	0x72d71801,	0xdee77333,
-0x63f71503,	0xe4cc9d5a,	0x1f684f79,	0xebab1828,
-0xcfdcbec2,	0x1913c83c,	0x72abfe52,	0xfcadec5a,
-0x9a32da3e,	0xf730dc13,	0x529ec685,	0x1d558dfa,
-0x3fb232f2,	0x041148b4,	0xd10bb0b7,	0xeb6821e2,
-0x070d709f,	0xf92b67a4,	0x6d6af041,	0x1724d766,
-0xf21a821d,	0xea6e49d8,	0x9d30cef2,	0xe0c055b1,
-0x67901316,	0xb37f63f9,	0x5984e1b1,	0xf83466f0,
-0x1404ac22,	0x4345d90c,	0xa14ef8b7,	0xa812e742,
-0x62593a25,	0xf08c3643,	0x3b376203,	0x5ddf0e1a,
-0x429c87d0,	0x31c7a9f9,	0x18f25314,	0xf55e9515,
-0xd26dde06,	0xd07605c7,	0x51877d68,	0x31054918,
-0x668e3ae2,	0xe273138d,	0xef9b9beb,	0xcf19359e,
-0x7ccb675b,	0xca018219,	0x1a614824,	0xa1ac60f6,
-0x512484e2,	0x249d2429,	0xa4e02fce,	0x85c52616,
-0xfc3e1b33,	0x11885bef,	0xf1729589,	0x78342f7a,
-0x3a115d84,	0x74698c2a,	0x59b804d6,	0x96598928,
-0xeafb3b9f,	0x788556ba,	0xf956a1c4,	0x5ae7d9b0,
-0xe86bc7d9,	0x7483aa3f,	0xa2126202,	0x5852027c,
-0xbb2db21b,	0xdf7dcaec,	0x3eaa745c,	0x49390086,
-0x60575f57,	0xba173f97,	0x90bd11ab,	0x0db322ea,
-0x2a57df73,	0x89157540,	0x57bdf2fb,	0x32b0919b,
-0x135b0600,	0xaaeb1076,	0x2a7b30ed,	0x73f755fe,
-0x81650eb2,	0x4640b0f0,	0x6f89926c,	0x4bd8b89b,
-0xb8233621,	0x24a33dcf,	0x1a6bbb69,	0xeb01530f,
-0x24467581,	0xc5175ba1,	0xbb207fb0,	0xd83e142b,
-0x2572acac,	0xf7488d93,	0xddfe99cc,	0x342c0d4f,
-0xb209b00f,	0x33ebdadd,	0x35e3fd3b,	0xc26470f4,
-0x643a91c0,	0x2386187a,	0xb7048f3d,	0x4bccd894,
-0xda15e11f,	0x3b8e9fc3,	0x3f1b93fd,	0x70b9260a,
-0x46ef3c91,	0x4d1f9631,	0xe777bd31,	0x8728acdd,
-0xcd8012a2,	0x8da6d62f,	0xcaedab69,	0x52c56c21,
-0x93472485,	0x87f85990,	0x9587f5f0,	0x0b23b2a1,
-0xcd23beab,	0xad81ef05,	0xe7db963d,	0xc6687827,
-0xa7847334,	0x12a35621,	0x57c2f21b,	0xdd2bbaf9,
-0x59650ce7,	0xd7665e53,	0xedc98b5b,	0x094ae33c,
-0x4724f7cc,	0xd8be3c08,	0xd803dbbe,	0x19cbd745,
-0x74adc92a,	0x088c82b2,	0x9a6b9ed5,	0x49da3d33,
-0x0f75b8e6,	0x021dacc8,	0xdd100353,	0xf5a7226b,
-0x6141e3ca,	0x443b676d,	0xb113e9f7,	0x1141f839,
-0xa6e4e487,	0xf7a239c2,	0xad0e3019,	0xa33ef735,
-0xe9c6134d,	0x12cb0f2b,	0xd2266ee2,	0xa5bf6017,
-/*  1854-m86d821.inc  */
-0x00000001,	0x00000021,	0x08312006,	0x000006d8,
-0xdd4078dd,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x15207f25,	0xaf011e9e,	0xa4f35d2a,	0x5a04d345,
-0x0af80416,	0xadf21e32,	0x01008f51,	0x73cfa51b,
-0xb09589a5,	0x273ba8a8,	0x5c009724,	0xcc4afd63,
-0xe0ec5e49,	0x00a8582d,	0xbd2c9d2e,	0xf722d22f,
-0x18d202eb,	0x47ba1bf9,	0xb61d77fa,	0xe5590322,
-0x1da550ba,	0xf5009bc7,	0xa74a4b35,	0xeac73686,
-0x32d3dd02,	0x1624f898,	0x2ef65a27,	0x1b684b05,
-0x74a9a3c1,	0xa999fffb,	0x87704471,	0x8ae62181,
-0x0ac0d5c7,	0xffbbeb02,	0xf779f34a,	0x12db3290,
-0x4c2eb3bf,	0x015aa152,	0x957aaea1,	0x9864e5e3,
-0x33cf93ca,	0xa560730e,	0x25718d0c,	0x94688c1b,
-0xf8facf6e,	0x10f705fd,	0x660f4b52,	0xe9927132,
-0x7e96650f,	0xb757e269,	0x703d0752,	0x99ce1839,
-0x12699204,	0x7a8ffe0c,	0x46ef8ee4,	0xf84924a2,
-0x2817013c,	0x3fadf9cf,	0x785abb54,	0x773b4980,
-0xb4a5170f,	0x371e7b5d,	0xfa8e4489,	0xff69b2d1,
-0xf1c608f9,	0x2a2521aa,	0x1a61ec14,	0x2745d532,
-0xff9e36e4,	0x9a432773,	0xbaf61fcf,	0x2c708f79,
-0x6455f129,	0x18caf13b,	0xa2a983dc,	0x7d3d09bb,
-0xe4767b86,	0xe90830da,	0xa0123777,	0x127d78a9,
-0x3eaa2bad,	0x09421617,	0xc1ea9356,	0xdb407f5b,
-0x8dadb897,	0xa937c436,	0x36cdbbcf,	0xa4afeb52,
-0x9f837837,	0x04a34695,	0x27d42563,	0x8a5a39c2,
-0xc0ede8df,	0x2ab05586,	0xef352de0,	0x85332fbf,
-0xb38244ee,	0x60325886,	0xf3715b1a,	0xa14ad158,
-0x5b57ff65,	0x1e1778b7,	0x94f5c7d6,	0xe95b7b7b,
-0xe80b02b2,	0x8b4ff747,	0x5ea6074a,	0x4211651d,
-0xc5e0f8c7,	0xb31ee90d,	0x4c41160c,	0xe324dd3c,
-0xb95086f4,	0xe8382874,	0x5e00801d,	0xbadb8380,
-0x7a7652c8,	0x1b84f2ab,	0xd94eed0a,	0x415f47eb,
-0x10263257,	0xf48c707c,	0x097626ec,	0x4e032046,
-0x5363e2c8,	0xa4ba7126,	0x1b782652,	0x51aefb22,
-0xae5a5936,	0xed79d5cd,	0xa30c0b67,	0x75430551,
-0x35a09192,	0x15b67316,	0xb52be608,	0xcb795959,
-0x4faca515,	0x1fdb63d3,	0x05fd5c11,	0x297a0e76,
-0x7a5f4778,	0x69c433d7,	0xd4d98e94,	0x22e51cfd,
-0xdb32e496,	0x10c0d08c,	0x82dc5cc1,	0x0c6d3536,
-0x090521bb,	0x6bf482db,	0x41d67592,	0x7f6179d5,
-0x8dbbafca,	0xa6de222e,	0x2a5505cf,	0xf8b596f0,
-0x7545c4ee,	0x819f5403,	0x7c1f4135,	0x3ac59049,
-0x33c7c4ab,	0x15812d35,	0x2a8582ee,	0x96a0e6b2,
-0xb92c1d1e,	0x30935633,	0x2db37e90,	0x5fedcdcd,
-0x789b9222,	0x18dc64d4,	0x73832a66,	0x84bceeac,
-0x3c6653d8,	0x13869ead,	0xee3dffde,	0xb5409354,
-0x454320c1,	0x88fce3e6,	0x386a25da,	0xdd090730,
-0xa3e3c00e,	0x6d57dbe7,	0xeffe51bc,	0x0e80367b,
-0x0df8cf1b,	0x130cf967,	0x3f39302b,	0x29b6687c,
-0xa626dfc0,	0xbedd0548,	0x09def856,	0xb314f4e0,
-0x0a84facf,	0x9bf757c1,	0x02e24a97,	0x65e14f1c,
-0x8f7e6f18,	0x031a816f,	0x4e1b22b1,	0x8e783cc3,
-0x07869387,	0x9727c5b0,	0xfcc836fe,	0x487259e5,
-0x3aeb7492,	0xbd8feb56,	0x42e69035,	0xe127af9c,
-0x9b7ca032,	0xdaadcc97,	0x815fddf1,	0x62a44c71,
-0x601b50ef,	0x9e563c36,	0x2fe47b15,	0x8707cb00,
-0x6876ed29,	0x061c4c3b,	0x2529167b,	0xd37f9c49,
-0xb9b9c817,	0xcb825760,	0xcff75137,	0x575d41b9,
-0x8c7f003c,	0x333201b7,	0x0e741508,	0xc32fbf54,
-0xd87d5e5e,	0xbab462ff,	0x07a7d41e,	0xa317d6f4,
-0xf5deccf7,	0x5e84f011,	0xdd81f04d,	0x7077fdbb,
-0xd71618ac,	0xc87934bd,	0xe96101d1,	0x55d1976c,
-0x471c8505,	0x7a36d839,	0x5d62a9ee,	0xf3c54a8a,
-0xa2be15d9,	0x244087c9,	0x042c8037,	0x23224689,
-0x281c5d73,	0x2139ecfc,	0xffb8bc8a,	0x834fdd11,
-0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,	0x4ae2dbda,
-0x86d90089,	0x6675dfce,	0x48876262,	0xcec72538,
-0x11dc5c80,	0x86a730f9,	0x313565c9,	0xe3e5be11,
-0x106d7cce,	0x752b8be2,	0x3d00a5bc,	0xe6f70e95,
-0x44447ac8,	0x600df30c,	0x8335ac3b,	0x8816ddee,
-0x700982fe,	0xee495741,	0x48c7e81c,	0xa3d55da2,
-0xb0172982,	0x70ab2158,	0xd4460621,	0x3a9e528b,
-0x59b18a7b,	0xf4dabc4c,	0xa8454763,	0x70877bb6,
-0x66005c97,	0xaf292c06,	0x7b843db1,	0xf343b59b,
-0x25cdc7b5,	0xa41da617,	0x9e9d895e,	0xc936f475,
-0x7270925a,	0x30024230,	0x8e72f53d,	0x2b6c1b6f,
-0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,	0xaf377cc1,
-0xbff09a78,	0x4b4e0814,	0x95a0b2c1,	0x270398de,
-0x201fca94,	0x2a032a4f,	0x131542b4,	0x0d7306da,
-0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,	0xa3b3a991,
-0x17ee60c2,	0x852c0b8d,	0x11e5853a,	0x762002a7,
-0x92c5311d,	0x0d4bf7e1,	0xfffec870,	0xe3d35e5b,
-0xff6ecfb9,	0xdedae6ff,	0x0111a772,	0x9808e780,
-0x29c336e8,	0xe9bc05df,	0x5bedde11,	0x945565af,
-0xaff808fe,	0x87e3423d,	0x4de6f98f,	0x93b4adef,
-0xbf704fa4,	0x09120e91,	0xd54f3692,	0xdf8eab1e,
-0xfabbf59c,	0xe74318be,	0xaab87ffc,	0x29fa791c,
-0xe3915552,	0xa652cb9b,	0xa1252e74,	0xb35b723b,
-0x542aa28b,	0x12fcc5b0,	0x3941f962,	0x82bcc6cc,
-0x47b11974,	0xb821611f,	0x78b34250,	0xf1be5659,
-0x561b9e61,	0x6f3bd501,	0x584e6f5c,	0xd54ed547,
-0xacebcd21,	0x7b5ff816,	0xb64ad233,	0x9f2f330d,
-0x69fb1ece,	0xac8710dd,	0x58dc6c60,	0x9bee6139,
-0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,	0xa733274f,
-0x884d9b55,	0x42b08b63,	0xafa54a74,	0x1c7ccf64,
-0x93a20191,	0xaaa3132e,	0xc69831d1,	0x54634889,
-0xfbfe3efc,	0xd3cf68d4,	0x302e3117,	0xf5693131,
-0xc3ce8c6c,	0x1f03cd89,	0x6243334c,	0xf16bc80f,
-0xdca5f130,	0xcb2cd956,	0x4c1bb421,	0xe8de533c,
-0x7f86703a,	0x29aa897e,	0xdd54acad,	0x76b2f2ae,
-0x7ef82b71,	0x2e30970b,	0xba402597,	0x9a653ab4,
-0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,	0x2363d147,
-0x5327289a,	0xe89229f3,	0xd63a535c,	0x7efe9273,
-0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,	0x1b9c7bfe,
-0x5d14b3de,	0x54d575fb,	0x6d65db4c,	0x95648b7f,
-0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,	0x8488a45f,
-0x8ebc2932,	0xd4767316,	0x3e8c4b8a,	0xbab7402c,
-0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,	0xc88528e9,
-0x4b2e4e8f,	0xdd938b86,	0x0c964f98,	0xfc88d480,
-0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,	0x4d40b3b3,
-0xcf203155,	0x0d2fa621,	0x752d2c58,	0xb12bac12,
-0x1e7e8c23,	0x94215d54,	0x9854a71c,	0x4de63c64,
-0x7a012529,	0x9c171f8d,	0x9e71def7,	0x3bd17d50,
-0x11f175d9,	0xec78abf3,	0x7b529eee,	0xd3a69fc3,
-0x5b718676,	0x58214d29,	0xa8bd2c34,	0x41ea00ab,
-0xa03f64d6,	0x4ee342b0,	0x32b1e444,	0x1c1801a4,
-0xc8424702,	0x334a7e35,	0x50cf1543,	0x3b22b495,
-0x88683776,	0x8e2e0154,	0x6155c033,	0x4e2fa6ac,
-0x42ace700,	0x8d64f97c,	0xaf9ced17,	0xb2a5cb92,
-0xa558582d,	0x88705de7,	0x9e528d59,	0x84bd45e4,
-0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,	0x10462123,
-0x30080f7d,	0xb346cd81,	0x0049c396,	0x4e24165f,
-0xa7c66809,	0x2e60bdcf,	0xaad70a08,	0xa73ea713,
-0xe28f97a7,	0x283a9eab,	0xd4366489,	0xe776f963,
-0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,	0x3bae5f6d,
-0x8d2bbef1,	0x7e9181e6,	0xf06aa121,	0xd06b2d20,
-0xa83ea826,	0xef935e4f,	0xdfd27456,	0xa3451468,
-/*  588-mu26a101.inc  */
-0x00000001,	0x00000001,	0x03062000,	0x000006a1,
-0xdac0a4cd,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x1a925620,	0x4b81f389,	0x1f55b086,	0x3a3c0b72,
-0x97aa26c2,	0x79093d54,	0x0e67ec11,	0x5c37053d,
-0x64e4158f,	0x404d78a9,	0xba6219f9,	0x2e08686b,
-0xe5a3d552,	0x09577ec7,	0xaaaa3c45,	0x060fc36e,
-0x278c17c5,	0xe0d35e8f,	0x38bb2b7e,	0x44df5aa7,
-0xff8034bf,	0xdaf298f0,	0xf404d040,	0x8db62d81,
-0xbf0b5755,	0x37273dfd,	0xf067eddc,	0x85556d3c,
-0xe028c3fb,	0x361c0e61,	0xe1c91916,	0xf666a76e,
-0xad25dcd1,	0x6896a9b5,	0xe62a7960,	0xecdeec60,
-0xb4614eec,	0x4ef1446d,	0x8c1b5dea,	0x26dce335,
-0xb51a21dc,	0x158dfc3b,	0xac9098dc,	0x6329e4ed,
-0xee0fbfc4,	0x42e4ee1f,	0xd42c51be,	0xfbeffdd0,
-0x8eb807f7,	0x02940987,	0xb55bf142,	0x51295e5e,
-0x0c4bb416,	0x288405da,	0x4044a714,	0x25487c10,
-0xc5d42317,	0xa19a5e54,	0x6f591e6a,	0x658d900e,
-0xd3e31ed4,	0x9a1e7945,	0x1e822af9,	0xcfa745be,
-0xdb4a0bb8,	0x70c034a3,	0x97d53091,	0x0bcb1625,
-0xb9757831,	0x607a4345,	0xa8dbefe4,	0xc57d0b71,
-0x65068d6b,	0xce8b60c0,	0x13b8d077,	0xc8cdd270,
-0x5cfd60f1,	0xba1de286,	0x25fec114,	0x138531a1,
-0x98ead827,	0x342e0dc5,	0x184f447d,	0xc39c38c1,
-0xdef43d07,	0x3f112321,	0xe56bcd08,	0x21a8954e,
-0x9284b430,	0x3f6080b4,	0x26ff7c9f,	0xb87d987d,
-0x6c880fc0,	0xfbc48334,	0x896daf3d,	0x2869dce3,
-0xb049cd04,	0xacd94d1a,	0x3cd9c76d,	0xd625bf61,
-0x3fd33f6c,	0xedc9dfbd,	0x4587d43b,	0x14f024f2,
-0x4bb68abf,	0x0be6e522,	0x817cbf56,	0xcd807794,
-0x2a3776bc,	0x2d4cc675,	0xa93197cd,	0xd159ea13,
-0x4a2f31f8,	0xf9c8483e,	0x5dd3484c,	0xa5e6aa91,
-0x56b30ab4,	0x54d8ad98,	0x122cf2a9,	0x0ea32a2c,
-0x8c106052,	0xa75018ee,	0xf1ef861c,	0x8eef2c7a,
-0x54a3ac2f,	0x236634de,	0xc0b93a7b,	0x624c67ba,
-0x7ca4151f,	0x63f5d46a,	0xbf3fc81c,	0x4de97caa,
-0x96b26301,	0x53d3d263,	0x9a56b4eb,	0xe9227bd7,
-0x6349dca1,	0x1463a57a,	0xe94a8a76,	0x2c1b2f29,
-0x408fd765,	0x79c92226,	0x2cdae01e,	0xc0711ae9,
-0x6dcad071,	0xc4c848b7,	0x0ad4dc9a,	0xecae9f21,
-0xbadc192b,	0x453060e4,	0x05f774cd,	0xc659c877,
-0x304c4fa4,	0x7eda6154,	0x7b34f620,	0x14cb0180,
-0x95dd0a99,	0x7faf3248,	0x7405b38e,	0x9b83e3dc,
-0xc6c13c20,	0x75640563,	0xd138fa21,	0xed2aa41b,
-0xdd655165,	0x3604d602,	0x459c69c4,	0x21582dd4,
-0xa2609dbf,	0xfe8d29d9,	0x945c3b01,	0x4f77f55d,
-0x24ec2ec4,	0x9b88285e,	0x6758ebfe,	0x773bd171,
-0xd6c6d39f,	0xdcbbf9e5,	0xa80ba71e,	0x095e3dbb,
-0xcd99eb28,	0x4901a58f,	0x34df1c21,	0x8e586420,
-0x1cbfdf50,	0x95085823,	0xa2ae7016,	0xaaaef150,
-0x14c815f5,	0x8f7c9723,	0x1fd00fa3,	0x0390f0fe,
-0xf6e3fcf4,	0x8250779c,	0x421efd91,	0x2f6bf608,
-0xea9704ad,	0x448f975c,	0xd68cc3d1,	0xead4e5e7,
-0xc52eb1b1,	0x83cb45a7,	0xebc29c1a,	0xcdfc2b79,
-0xa6d9ea12,	0x429a8bd2,	0xaf53233b,	0x9b729f98,
-0x91e763fa,	0x839af791,	0x31a8072d,	0x78235953,
-0x36931de4,	0xdebe9744,	0x3b4d0ee1,	0xd3e19156,
-0x860b50a3,	0x5a9e107d,	0x7172d726,	0x6bcb1274,
-0xf239330c,	0x474f913e,	0x466f82cc,	0x97f831d3,
-0xc0cbc28c,	0x1a95f8b6,	0xc4799e3e,	0x3d90176d,
-0x6d8510a9,	0x248ffa74,	0xb08a8d46,	0x892fdea7,
-0x0ffadac7,	0x763e7d4d,	0xe350936d,	0x6dc3fd4c,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1462-mbdf4903.inc  */
-0x00000001,	0x00000003,	0x04212005,	0x00000f49,
-0xf85d53b8,	0x00000001,	0x000000bd,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x1d97a5ab,	0xd8d45b45,	0x89deeee4,	0xdbc956d7,
-0xfb0cd01b,	0x3bca266b,	0xd5501500,	0xdc8984df,
-0x40b6ac51,	0xf7df8e82,	0x8ec688d7,	0x1ef9fbbd,
-0xc78d51ef,	0xae0847c6,	0xdca2d2ca,	0x37e70a9b,
-0xe3787616,	0x345fcd33,	0x3cd82279,	0x1def6266,
-0x5293bcd1,	0x6fcf26e7,	0xc058fbdf,	0x4047885c,
-0xb576571c,	0x4b5cd986,	0x132708b1,	0x80f1c25a,
-0x751ba4c7,	0x48c5d0b9,	0x02af5f0a,	0x9ffc999f,
-0x30b3c7af,	0x8f53188c,	0x8ab966f6,	0x46afec6f,
-0xb781e8e1,	0x93a70da2,	0x221001a6,	0x1d8ac72e,
-0x7de05c53,	0x37c414dc,	0x2237c122,	0x2e9f4c87,
-0x6d5e59e5,	0x0fe3fc94,	0x37b5ca40,	0x148b94ba,
-0x1739ccd1,	0x6c3bc387,	0x43161ebd,	0xa6887dc4,
-0xb1578c58,	0x0e1258f2,	0x45135243,	0xcdae3ef5,
-0x65ff1746,	0xacf8ebdf,	0xa72112ca,	0x02b84a79,
-0x9a216bc4,	0xc292e932,	0x7979f591,	0x69b77fff,
-0xef165702,	0x350ea5ad,	0x22257e3b,	0x550ca838,
-0x1a1fecbb,	0x18e22ded,	0xa507dde3,	0x468d7844,
-0x42f62879,	0x2101eea3,	0xecf6295a,	0xf3ed3037,
-0x44a57038,	0x5bb44832,	0xfb0e26ec,	0xbc5fe107,
-0xb9452eee,	0xaf33a355,	0x7756a4cc,	0x77fbe8a4,
-0x033777eb,	0x9ea1a874,	0x525f582b,	0x7d239934,
-0x6793a677,	0x6e19db4b,	0xd1df2782,	0x54411a11,
-0xf78d17d0,	0x77c196bb,	0xada667da,	0x70dd255d,
-0x4f026ec3,	0x65079cc1,	0xa7c9ea02,	0xce125e00,
-0x0c7705b4,	0x1b5f5c57,	0x0bfa7df4,	0x9dec2c5e,
-0x5c75ff31,	0xcc3373a9,	0xc697b37d,	0x383e2d04,
-0x8a3a8b22,	0x973e6c95,	0x01132ed4,	0x20bf2f8d,
-0x5386383e,	0x2326168a,	0x6519809f,	0x410e4030,
-0x71535fe9,	0x41b859f9,	0x699b2c62,	0x6dd05418,
-0xb5b4621f,	0x36182db3,	0x7ade6401,	0xde4a5be0,
-0x5c41bbc0,	0x572a6343,	0x47176e3f,	0xdeef3492,
-0x02c4c789,	0xe0742989,	0x80e5e625,	0x2bb8154c,
-0x197b8266,	0x95fbc970,	0x47db060c,	0xe6eaf074,
-0xa971f29f,	0x2e44a86d,	0xa1537c89,	0xceb9497f,
-0x7588bed6,	0xe1de63fd,	0xcc878c9e,	0x3c9f54df,
-0xd96f165d,	0x87c39260,	0xa2505ebe,	0x35315b03,
-0x69b55f3e,	0x4d061ea1,	0x0a0609e5,	0x1a0e9df5,
-0x46f331aa,	0x2f78d5af,	0x15c9b735,	0x2824ec99,
-0x8a7bd6c4,	0x315d2911,	0xaaa2a4bd,	0x9bda9226,
-0xd37724a8,	0x41bdfaba,	0x4d5422ce,	0xb10d6477,
-0x2b761a1e,	0xd8fba6a5,	0xa7845dd4,	0x26f97e4c,
-0xb0943661,	0xc0ee2b73,	0x06fdb37f,	0x260d7bec,
-0x94a14ef7,	0x7531936d,	0x9ae91b65,	0x2b6b470a,
-0x68ee2bae,	0x0c08b024,	0x00ea436f,	0x0accf143,
-0x2e5adb51,	0x7a155213,	0xb088dce4,	0x1b81a181,
-0x52296f85,	0x4d29e16b,	0x9939f952,	0x1fdcd4ff,
-0xa3d75dbb,	0x2b833084,	0x2fa52024,	0x37bdb875,
-0x3f694edc,	0x65b0b599,	0xdc72cf85,	0x291ae2ba,
-0x35e24c8f,	0x7741c8a9,	0xb01ca44d,	0x6199935d,
-0xc0c89383,	0x5f05f874,	0x9292c348,	0x3586bfd8,
-0x6345458d,	0x49263bdb,	0x647c36ae,	0xf84b11a1,
-0x94827fb8,	0x5798744b,	0x858c7d49,	0xe2cba691,
-0x6ccb4f80,	0x8b20c80e,	0xb63311fe,	0x4b22af2b,
-0x2f267f69,	0x8f9a34d2,	0xd8969b2d,	0x3abf5472,
-0xb27f4eb0,	0x0e9b5f89,	0x2c4c4d99,	0x5c1e1262,
-0xdced13a1,	0x530e6b92,	0xafbee3d6,	0x65fe567e,
-0xcf9c9149,	0x42e08da6,	0xe92e2843,	0x9b3f275a,
-0x914a2744,	0x7ab4c765,	0x6965f671,	0x811f127c,
-0x23f7ce13,	0xd4f1ac3f,	0xc2d4ee69,	0x00280023,
-0x40785dda,	0xca35a92d,	0x2963b64a,	0xe5b0e712,
-0xa9b2d095,	0x4832e02e,	0xed9cea18,	0xa94761fd,
-0x57a40f75,	0xb8cd5b69,	0xd506155e,	0x551ab1ce,
-0x59c5aad2,	0x97890115,	0x2a5a9df5,	0x29d9ba4b,
-0xbdd29034,	0x5bd4952c,	0x1191c80c,	0x1997917b,
-0x55eb2b4a,	0x0e72b3e8,	0x367ece32,	0x34b76a3c,
-0xe64ad532,	0x3b59055a,	0x0f712d21,	0xf67a9ba3,
-0xaf311de6,	0x7cc35910,	0x834453b4,	0xe26aa25f,
-0xb22bb98e,	0xe57b180f,	0x8934fbea,	0x4166ccec,
-0x4da4712c,	0xc19c8f60,	0xacbfcc98,	0x30dda7a6,
-0x1dc3fbd8,	0x7d77916e,	0x180e8ba7,	0x0f992e7d,
-0xc5c22947,	0x22aeeffe,	0x0f371fa3,	0x7f7bf57c,
-0x78410151,	0x161ee85d,	0x21902fe6,	0xaefebe53,
-0xbc6b6150,	0x13d1afc3,	0x9f6ab323,	0xdfde1341,
-0xccaab924,	0xb772a93a,	0xfe3b68cd,	0x79383bba,
-0x7006023b,	0xf1f2a411,	0x392af6f0,	0x4d3f478a,
-0xe8c05af3,	0x00e25e71,	0xa091145c,	0x3aedec59,
-0xc03760a8,	0x55e3c016,	0x8da162d3,	0x7390887d,
-0x76d23ba6,	0x68e31654,	0x16b5d97f,	0xe3395e91,
-0xe6926e89,	0x63ceb3f1,	0x369b7877,	0xa11de4f2,
-0xb1fd5839,	0xe345a9fe,	0x515246ab,	0x6180fbd4,
-0xb5cff818,	0x986113c8,	0x417d707c,	0x47d843e2,
-0x200ac421,	0x1ca10192,	0x88cd37df,	0x2609dca5,
-0x8dc2af5f,	0x211c3d1b,	0x2c2b857e,	0x3557f767,
-0x9158b820,	0x10c983a9,	0x04cf4090,	0x821ea21c,
-0x3e387c5a,	0x00e590da,	0x7813e54b,	0xc17b54ff,
-0x307fa6e0,	0x8b76d147,	0xc131a653,	0x146d70de,
-0x8323ac2b,	0xf6f5a535,	0xfe86dd65,	0xb96ee8f0,
-0xcf485ed1,	0x04f132c5,	0xfcfc6409,	0xd3c2fb83,
-0xd3a2f9c0,	0xf96e77c2,	0x56767a87,	0x80fcfb64,
-0x7a71268f,	0xa8c76ceb,	0x24229c56,	0x87c44f41,
-0x57a44c7a,	0xfbb5cc5b,	0x4cc2eb71,	0x67b29a4b,
-0x3c12f5fa,	0x9d652a79,	0x784c4f80,	0x8f71277c,
-0xef82dcbe,	0x7568289d,	0xdf2c8be9,	0x17f27058,
-0xc1a68e70,	0xa16e8e80,	0x4658d2ea,	0xd9184214,
-0x6eb531e0,	0x1bc29124,	0x9c7f17f0,	0xe46d2d7f,
-0x12503c08,	0xad1954c5,	0xac3c0dc6,	0xf5daf588,
-0x432ca22b,	0xf0b1feee,	0x49a87d08,	0x46cba3b3,
-0xd4b21507,	0xe38c4e61,	0x723431ab,	0xb6a77ed9,
-0x301c1efa,	0x74ec696b,	0x68a3451e,	0x7f47d0bb,
-0x3ae520b5,	0xd12982ce,	0xb6b1a6c5,	0x6a7530ef,
-0x4aef2c63,	0x15c35a89,	0x5f4cf69b,	0x7adf5962,
-0xf447643d,	0xee650c10,	0xb129db55,	0x4fe6c24e,
-0x90d3cdb6,	0xb541e1c3,	0xb2b6ea11,	0x9a4cabc7,
-0x43e9b01c,	0xa569ec97,	0x86d846e1,	0x6ac04c33,
-0x53149baa,	0x009ce63b,	0x25a3f701,	0x1c3e0b06,
-0x7d184768,	0x283dc7d2,	0x6fdd5527,	0xadc78ad5,
-0x8e2cdee0,	0x35403b6a,	0x4643688b,	0xd204f471,
-0x7d1a21d4,	0x8c031665,	0x282384a9,	0x617c527c,
-0x73022432,	0x09698b90,	0x780842d8,	0xe9f441cb,
-0xbe83ebe2,	0x1349c504,	0x6ed09b31,	0x65d66a39,
-0x7d31d11c,	0xb321873d,	0x6c3f6320,	0xd15ca4dd,
-0xa22aaf0c,	0x911e4be2,	0x13a1b26b,	0x94bad56d,
-0xf1e386a6,	0xf881ae7a,	0xa2d80428,	0xb173e4cb,
-0x18a1dc33,	0xe5d11954,	0x47897c6e,	0xd5c21c81,
-0x1b829c73,	0x79148127,	0xb1c7156d,	0xa58fdbb5,
-0x8a487db1,	0xa2eac522,	0xfb47bc53,	0x23ea278c,
-0xa7450298,	0xeda0181f,	0xe1884691,	0x804b1f72,
-0x918aab83,	0x417c0d4a,	0x0c4fd8df,	0x7a200bac,
-0xf5a6deea,	0x5cd32457,	0xc8a677fb,	0xae8fa1c0,
-0x20b7d314,	0x7b39a1b5,	0x22f6357e,	0x1da85b16,
-0xbf0f044b,	0xe0c8869f,	0xe0d7593f,	0xd981b3b9,
-0x2deff02a,	0x73edd221,	0xdbf4b6a2,	0x49a66ed8,
-0x8ec84132,	0xc93b6577,	0x585c488e,	0x6fdb9a7e,
-0xef868706,	0xec5cb3b7,	0x3dd3f005,	0xfff75a03,
-/*  1338-m02f292d.inc  */
-0x00000001,	0x0000002d,	0x08112004,	0x00000f29,
-0x76e56915,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3329bed4,	0x074ca74b,	0x76a4c9be,	0xb3d0ac3b,
-0x59c1ebd3,	0x9d06facf,	0xa272f2b8,	0x185d2aed,
-0x1dbb2394,	0x86f96351,	0x12652c86,	0x873bf0a8,
-0x4f6956f8,	0xbc5754f1,	0xd43f9485,	0xb0484217,
-0x88993f58,	0x071366b3,	0xbb49ef1d,	0xb8ec50b3,
-0xd6dd7d67,	0xafae9594,	0xafbcf523,	0x04e3cefb,
-0xf6125942,	0x6c58f3aa,	0xa28b05f4,	0xbb31e4f0,
-0xde633bba,	0xc2cc4d76,	0x2fc95cef,	0x465474bc,
-0x6148f606,	0xa8245d1a,	0x167d68d0,	0xc38533b2,
-0xcbfb5881,	0xb912dc66,	0xbb9cc137,	0xbaa2ca73,
-0xa9cee564,	0x3edd2b89,	0x2e3ffeed,	0xa68b49eb,
-0x0b85b10b,	0xb968370f,	0xd5c4deb8,	0x2d2883d4,
-0x288e44af,	0x37b10c8a,	0xa75c2ef5,	0xa5242ad7,
-0xff96f783,	0xab3f2161,	0x3921290b,	0x1094e053,
-0x9eae586d,	0x9878a4f3,	0xa2d41b7f,	0xb29cc218,
-0x93898d3c,	0xdd152eec,	0x638ab207,	0xa7536a0f,
-0x5accf54d,	0x798a56a0,	0x8e925de6,	0xe2fec0a0,
-0x8b6100f7,	0x910d43f8,	0xb3bcb1ab,	0x3f032f10,
-0x667b024d,	0x5303ab2e,	0x50a68459,	0xdbdae9ae,
-0x61cab195,	0x8b080d7b,	0xe1c9c484,	0xc0a9cc33,
-0xf3c786cb,	0xa226e2f7,	0x4509e980,	0x2ff4bb80,
-0x943a2b9b,	0xb0e2d78c,	0xdce9f9df,	0xb9302df9,
-0x2f095be2,	0x46f9e8cf,	0x097129ec,	0x5f7ba01f,
-0x49e26e4c,	0xde9ff6ce,	0x5d194de6,	0x9114a73f,
-0x5114f3e1,	0x9832e8b3,	0xd116f967,	0xfcddf0e7,
-0x3011f78c,	0x5d84b6d5,	0xb465a082,	0x8eb129ad,
-0x5390d983,	0xdfad741a,	0xef927af0,	0xa062e4fd,
-0x94a1b0f5,	0x6c9dcff9,	0x15192e6a,	0x11a1f0b8,
-0xbc5f9758,	0x01c1070c,	0x6f5a81c6,	0x7ee5b238,
-0xdf75b957,	0x8b5cbac1,	0x5f7cd16a,	0xf7faa6dc,
-0x5b74dbb5,	0x0980f147,	0x4aa350ab,	0x7e96c732,
-0xdaeacc94,	0x29fd397d,	0xf62b5325,	0x3c519a56,
-0x5dbc6524,	0x201364ea,	0x05ee717f,	0x39c8c28c,
-0x9ab2580c,	0x95550f9c,	0xfb0eb0ac,	0x242c6155,
-0xdd52b4d4,	0xa04672cf,	0xa81f5b28,	0xac10d5f7,
-0xd6afd049,	0x323e700a,	0xb710054c,	0x88b48cc0,
-0x4c1d370d,	0xb303457b,	0xbc5bf726,	0x2dfc0600,
-0xa86d0d2e,	0x9ec95b49,	0xeec42301,	0xa0ddf041,
-0xd3697b0d,	0x1cf23cd4,	0xe511afa1,	0x99677ab6,
-0xcb82d8fe,	0x03d837ed,	0xcf59b6eb,	0x117c6438,
-0x793db420,	0x01210ef0,	0x2f16aa63,	0x092aa912,
-0x188fcfe1,	0x0cd78643,	0x4725f2b0,	0x141b4064,
-0x060cb591,	0xdb59b5b9,	0x08ca7893,	0x03b02ee2,
-0xefdabca5,	0xedc23083,	0x48d71720,	0xc44417e0,
-0xb0f5f326,	0x04e0ca58,	0x1cbc21e9,	0xc47f8d91,
-0x5465c94d,	0x6f5c300b,	0xce250158,	0x39d3ff3f,
-0xb9ba60a4,	0x7e15fc75,	0x6481b42f,	0x4a822d4c,
-0x6b251985,	0x01c3f0ff,	0xb961c2c0,	0x56233348,
-0x4322f327,	0xfaf3a4b4,	0xa5e2f209,	0x0086e35f,
-0x5665e8c8,	0xd284182d,	0x7c66dc76,	0xdead8651,
-0x3948f967,	0x29e2cdc5,	0xa85bf1c4,	0xfc81e608,
-0x95129e56,	0x39e8ccc0,	0x8a55171d,	0x0ca75f6d,
-0x76b3b76a,	0x07063184,	0x40a355b6,	0x0dc9ae64,
-0x2f0bcdc9,	0x3c98d57e,	0xbd9f6fc9,	0x0b3b70e8,
-0x6598b670,	0x98adb5b0,	0xe38efec2,	0x1b72b2a1,
-0xd7760f5b,	0xa5ff1aa2,	0x21d65a27,	0x85170ab7,
-0x4f19b28e,	0x147ab845,	0xc61a001a,	0xbf15e323,
-0xbea79403,	0x0e9fd315,	0xa5ce5dc1,	0x3dec0102,
-0xe344f20f,	0x26772148,	0xe3c335c8,	0x14698661,
-0x02045f22,	0x1b9fe294,	0x18fd4760,	0x2b0dcc84,
-0x3719068f,	0xe16a4bd5,	0x69b449a0,	0x088176ec,
-0x66231f59,	0xe4c8477f,	0x3ccfd123,	0xd67be9aa,
-0x8df1652c,	0x11f29283,	0xb13a6168,	0xd79e71f5,
-0xdf064c6c,	0x63bbaea0,	0xa32b027f,	0x17fa40de,
-0x62dad42b,	0x4a2ba3d1,	0x97566ec5,	0x7ce0870a,
-0x7c6ac399,	0x075eae21,	0x02811d28,	0x6effb228,
-0xbdffa992,	0xfc9706c7,	0xa2c158ad,	0x3a407afd,
-0x94b88ec5,	0xc9019e3e,	0x10cf018e,	0xf08b1e2d,
-0xaa09594a,	0x0d896d4a,	0xf83a743f,	0xfc82a2c3,
-0xe863355e,	0x619ef2f4,	0x2170df86,	0x34112254,
-0x615d93e1,	0x7c25d947,	0xbda74d18,	0x4188f6d8,
-0x02a61d07,	0x262bad07,	0x3939c06e,	0x76480101,
-0x26697ea6,	0xfce41af7,	0x9bece83f,	0x309c0b9e,
-0xdfc2bc12,	0xedcccfee,	0x4f095c0d,	0xd9b08cce,
-0x45da7530,	0x2f8e37c0,	0x5f273652,	0xc13511e0,
-0xcdb90088,	0x79c7d87a,	0x3df67681,	0x05a0a8d3,
-0xf2d2756a,	0x56041d39,	0x185b97c5,	0x62644b35,
-0xba24ad0c,	0x0d8ba3a3,	0x90e4793a,	0x4a04a884,
-0x05e64fdf,	0xfe710b2b,	0x85703d05,	0x1abc37e1,
-0x8db28c4e,	0xdde1b1d5,	0x03682e82,	0xf4d092fa,
-0x067f6a0d,	0x3c142430,	0xf2d8bc9a,	0xf546da72,
-0x660ec359,	0x4171e4dc,	0xa29d94b2,	0x151add4d,
-0x57f35f12,	0x7258f732,	0x9db66fba,	0x77e39897,
-0x8a8711c7,	0x1f5db10a,	0x58792090,	0x68600a9a,
-0xb2a89ac2,	0xa4a1f018,	0xc27e695f,	0x00aabd02,
-0x3f750dbe,	0x9a2e2bd2,	0x70ac647b,	0x9959d044,
-0x7669de0e,	0x2f98c181,	0x1c25a4fd,	0xbfa6a204,
-0xfb47f2d8,	0x440f46ff,	0x53a2dcfc,	0x1bf83a80,
-0x2d0b22d7,	0x4f518fde,	0xc1d17dbc,	0x7e92459e,
-0x95608150,	0x04486d5e,	0xd30e6f8a,	0x7e5a4a39,
-0xb01dee81,	0x04e7acdf,	0xf7ada4a4,	0x0795880e,
-0x26dc8256,	0x0a5aa3c3,	0x8f029565,	0x2f470e3c,
-0xa373fc51,	0x1c7e7b45,	0x267796b8,	0x1bcb4991,
-0xcec801f8,	0x6c9a6957,	0xc1ce18c5,	0x043c7ab6,
-0x3bd723ed,	0x6093b8ab,	0x2f768aa1,	0x4c6de3ce,
-0x71b2965a,	0x31ed9427,	0xbdab13e4,	0x7e9eba94,
-0x06508808,	0x5867bccf,	0xc0c8c85d,	0x846300c9,
-0x03891b7b,	0xe1150b81,	0x56116659,	0xdff07740,
-0x6eb9e465,	0x3a8a5801,	0xc54290e2,	0xeef47a33,
-0x4c71e22d,	0xd1dcc6be,	0x7075ccca,	0xa14f574c,
-0xfa205fcc,	0x71fd97f4,	0x285b90c3,	0x6f4ec636,
-0xe5fcc6ac,	0xaaa6e7b4,	0xb02d6ce1,	0x8e6fc58c,
-0x0d8c03e5,	0x5f1490ac,	0xa7c85aa5,	0x079a36a1,
-0xcf0a5098,	0x596d1e33,	0x23a0615d,	0x90b97898,
-0x7bc12833,	0x5c6b310c,	0xb72adacf,	0xff8538e0,
-0x750587e9,	0xcda7274f,	0x7e439b7e,	0x57e0932f,
-0x3fc98dff,	0x92a8077e,	0xff3c4325,	0xee308b69,
-0x72caf71c,	0xb2f163f8,	0xc024caa2,	0xa86d0b31,
-0x41e7bc48,	0x1c34e4e6,	0x8d2082c1,	0x79732888,
-0xce59daaf,	0x92755a37,	0x76394314,	0xa23c081c,
-0xd3b089f6,	0x99827d27,	0x3a4ae173,	0x2a3e8487,
-0x20bbdf78,	0x7a48f87e,	0x223e1ce6,	0x4579c5e7,
-0x03e1a14b,	0x28f640fc,	0x3bd0f8b0,	0xe005b408,
-0x8c289156,	0x83a0f027,	0xee139c51,	0x630fd758,
-0x7e7b2a23,	0xe8460ecc,	0x9ffa8bff,	0x53380048,
-0x0afa3850,	0xb1bf8f67,	0x96a14fc6,	0x44b25a59,
-0xd82b8d56,	0x4c882db3,	0x0f2fa046,	0x90bed183,
-0xbe9e1fb1,	0x5f4c0686,	0xed5cc524,	0x2650ed51,
-0x59164cc3,	0xb6af6348,	0xcb09a53c,	0x841e16d2,
-0x73bcae6c,	0x2f19b19b,	0x7c974049,	0xa8a81c25,
-0x2606dbbf,	0xbcb3a630,	0x87274992,	0x66d21787,
-0x2cb53251,	0xbb04cccd,	0xf8b53f17,	0x58751075,
-0x9264e9e6,	0x431412f5,	0x6fb4b734,	0x2361e760,
-0xd42e17d0,	0x7d9077e3,	0x3e73d73e,	0x70c66cf7,
-0x477e7d07,	0x330f4048,	0x26ba1aff,	0xb035e29e,
-/*  423-MU26522b.inc  */
-0x00000001,	0x0000002b,	0x05121999,	0x00000652,
-0xd40d4baf,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x82d4f7e4,	0x1ab144dd,	0x6c99135b,	0xf7e85000,
-0x485aa4bc,	0xdc2d54c2,	0xe972fccf,	0x3324d019,
-0xcbc6a9c4,	0xedce39b7,	0x9f1e2d7b,	0xd3bf100f,
-0x494a087f,	0xf7e7cc9d,	0x708a5137,	0xfc9cf9d3,
-0xec52ac58,	0xd50c0b24,	0xa8809cd5,	0x0afb0b11,
-0x56f58840,	0xb424542b,	0xc3316bd9,	0x78f37d95,
-0xb3f56372,	0xf5f84f86,	0x257e3792,	0xa6deb070,
-0x2553ff8b,	0xa2f30e61,	0x528f7e35,	0x239ad66d,
-0xa2675b0e,	0x43187193,	0xd99d4a9b,	0x551fcc51,
-0x43e2cc72,	0x59a00800,	0xb33363f6,	0x33b9858d,
-0xc2d4e60e,	0x626d34fe,	0x0b507f65,	0x48593c82,
-0xd493b092,	0xbf9ac3cd,	0x5cdeb0fe,	0x9f4fff34,
-0xd64ebd7c,	0xf626826f,	0x49794f5f,	0x2fc6a58c,
-0x443adef8,	0xda9e1f2b,	0x93af9ec1,	0x02032b82,
-0x90ea392e,	0x49ca677c,	0x010fa205,	0x05e86008,
-0x7a7a5faa,	0x24c23361,	0x6173974b,	0x40163e01,
-0xf6a28873,	0x4d5bb36c,	0x6284d1d2,	0x766d6605,
-0xbedaa035,	0x4cea4ed3,	0x9c56ca06,	0x02576d87,
-0xc6e33226,	0x5a623905,	0x2256948e,	0x1ba04f19,
-0xb8a0d3d2,	0x6e96125f,	0x401fed7a,	0x4240baaf,
-0x1065bacd,	0x1021dd17,	0xdcd660ef,	0xc862fed8,
-0xfeb165ce,	0xd4581a52,	0xeedd42f1,	0x804c3590,
-0x528ba359,	0xab41db70,	0xa7a2bfe3,	0xc6eb9f0e,
-0xa1e3f891,	0xb22f81e3,	0xccedb56b,	0x672e34d4,
-0xda637bc8,	0x40c785a8,	0xa0b5bfa3,	0x689078cb,
-0xb86d32ae,	0x8a08e06b,	0x56b58258,	0x64dd76ae,
-0x37f12a71,	0xd0ff69f3,	0x4648eeb1,	0xdecd4cdc,
-0xe415e394,	0x0debe186,	0x767e4c09,	0xf349c296,
-0x6a39615b,	0x418036b0,	0x919eaceb,	0xffcbfc96,
-0xa109780b,	0x39ee64f0,	0x10cc2571,	0x008d0def,
-0x73907641,	0x7d2d1b95,	0x28a09912,	0x9c9e0e7c,
-0x6cedc58b,	0xb3612e6d,	0xe522629b,	0x7fefc94a,
-0x303cd38b,	0xb50f536d,	0x27706e32,	0x43ac6e65,
-0x72c05b6f,	0x7fc617b3,	0xf035d5af,	0x875e29d9,
-0x201d23ea,	0xfd2928ed,	0x89f5ff66,	0x1acc4258,
-0xa4b045d8,	0x10bc6d1b,	0xab858bf3,	0xd4b3c407,
-0x9c708b17,	0xe61a59ab,	0x47bdf687,	0xb26d738f,
-0x4b950d31,	0x5820de87,	0x6d609b38,	0xec97b0b3,
-0x041950cf,	0xdb386054,	0x703e40b1,	0xdbe48d81,
-0x3c0d6bb5,	0xa4a5c62e,	0xc88f30b8,	0x5d952f16,
-0xc88a086f,	0x47baabc1,	0xe63a91a0,	0x6f2bc793,
-0x0c0d57c3,	0xe81a67f0,	0xf5601a47,	0x4f8843ed,
-0x199e0104,	0x3671a0cf,	0x24ae5ba7,	0x2ceb6d1f,
-0x350ae79c,	0x1aefd992,	0xb8efeccc,	0x53854cb1,
-0x58280110,	0x5680f87f,	0x4774752c,	0x00d9f67d,
-0xe380b8b4,	0xf330e9a4,	0x722be379,	0xa945dd14,
-0xb977c27d,	0x9c8ce733,	0xadaf3828,	0x6c57213f,
-0xcb348b3c,	0x863cf367,	0x58efcad1,	0xe59c47c5,
-0x97ad46aa,	0x0766206b,	0x51047339,	0xaf492a9f,
-0xf40c4e9e,	0xa5c8221f,	0x15414807,	0xf1e7dbab,
-0xf7ee703c,	0x25db6887,	0x8f0f71e0,	0x86411ed8,
-0x6381c889,	0x2005b533,	0x485e9637,	0x553d2fe0,
-0xe89e6e67,	0x6b50c659,	0x0ee55b4d,	0x32d116dc,
-0x12a199cc,	0xf0e4d72b,	0xece6292d,	0x084337af,
-0x58f73eac,	0x83252ba2,	0xbdd0f99e,	0xa92a7ada,
-0x3b670369,	0x78641928,	0x56d530cc,	0x1200f833,
-0x5327e8b7,	0x178047e5,	0x0c34522d,	0xeac40852,
-0xf62dc30e,	0x9a06d7e5,	0xb2a7f19b,	0x9ab62c5b,
-0x8ddbf6a3,	0x8d31e486,	0x38c91832,	0xe53b17d0,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  146-MU16502e.inc  */
-0x00000001,	0x0000002e,	0x02111998,	0x00000650,
-0x2f41bf64,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xe132daee,	0x34afef27,	0x99d81941,	0x392e42f3,
-0x9c561aff,	0xce39093d,	0x98049a92,	0x0b005129,
-0x2f7035c4,	0x9c0d1e11,	0x3fd1c199,	0x8745abd2,
-0x2d28de23,	0xea2421cb,	0x6bce22bf,	0xd47c54ad,
-0x28109db5,	0x805b31ed,	0x05d69044,	0x7d3aebba,
-0xf2cbe633,	0x0643b416,	0xaca8e640,	0x12fd321a,
-0xb31461af,	0x830e2bd8,	0x18d4f9b6,	0x4b09fc99,
-0xf2de9033,	0x45b3eda2,	0x63a0fe91,	0x8a55e5eb,
-0x30d6d490,	0x50826a17,	0x2faf2526,	0xa4c8b947,
-0x283e83b5,	0x8c68fbfb,	0xef432f69,	0x7e3277a6,
-0xe9f7d108,	0xfa62c5ff,	0xe870406e,	0xeb4b43ef,
-0xbb6d3f73,	0x602308dc,	0x0e8b4160,	0xcdb5ce40,
-0x2527c5df,	0x9088a9d1,	0xfeecd0c1,	0x7e5dac2a,
-0xe44cfaa3,	0x996a0fbe,	0xf2d49833,	0xefc79a2a,
-0xe3fd08ee,	0x3545571e,	0xef6271eb,	0x42eaf7de,
-0x1d5a2ee4,	0x996b7930,	0x67934d3e,	0x13680223,
-0x93631599,	0x1ac0bc0b,	0xea6eb669,	0xe50c2448,
-0x05540dd9,	0x0fe6fdc7,	0xea2bc7e9,	0x0cc96ccb,
-0x0fc0c89b,	0xf7958fd3,	0xec54fd60,	0x0ed777c1,
-0x26558cb6,	0x2678f1ba,	0x5c259d10,	0x491d9dd3,
-0xa7c8d028,	0x8ca72a7c,	0x6d55eccd,	0x985b8e81,
-0x71519c50,	0x29225284,	0xc0fbdb3d,	0x6c22afac,
-0xefba78e5,	0x9392274d,	0x3ba1e344,	0xe7f4d8d6,
-0x58761578,	0x5013e1ab,	0xe7b26a45,	0x1813f40e,
-0xb97c261b,	0xe0a8bb01,	0x6a5575b9,	0x96a3256a,
-0x1112d009,	0x3058c734,	0xbcd86a50,	0xaf40d5a7,
-0xf67dd1c9,	0xf267eb1d,	0x812a270a,	0x5f8990e2,
-0xf1376d47,	0xd482c5be,	0xd0fc1fd6,	0xcdc6f723,
-0x454880e6,	0x50715d0a,	0xd32bb4cd,	0xb1670486,
-0x77d44af5,	0x22ebd53e,	0x8328b486,	0x88c29b33,
-0xae50a13f,	0x22770bea,	0x0530a73f,	0xddde0c78,
-0x1c3ae1b1,	0x5e6f6ed5,	0x8badd022,	0x4be97a92,
-0xde2c2c15,	0xc521ee92,	0x884ae500,	0xb56c493e,
-0x03805667,	0x69192e91,	0x59b04ce5,	0x932fb0cf,
-0x8d4e65d1,	0x4ff181c5,	0xd2ba59c6,	0xc1f6f84e,
-0x1cc9922c,	0x30007b6e,	0xa8587d99,	0xdebd91be,
-0x2e1e29fa,	0x9fe4171c,	0x1315657e,	0x8ec2b106,
-0x3d11f9f7,	0xd0b200b6,	0xd65d5ddd,	0xc94f3da3,
-0xf36f413a,	0x4cb9dc97,	0xb1f55482,	0x13d60852,
-0x53906034,	0x2657258d,	0x0ff8492b,	0xe09601c1,
-0x603bc82f,	0xf2425bfd,	0xa3c92025,	0x235bd2d3,
-0x5aa25015,	0xc285e72e,	0xc29eb89b,	0xd2be4c2f,
-0x1e58a7ff,	0xd9cb5120,	0x86a9b198,	0x52c51541,
-0x7048fa24,	0x15e140cd,	0xfed0659e,	0x0b28b864,
-0xc75b6d9c,	0x6640765b,	0xf279c46e,	0x1139ca33,
-0xe6e86618,	0x6b7d1155,	0x0dc1f2ca,	0x8a70834c,
-0x4869056a,	0x69558aab,	0x9b13a871,	0x9e8f8127,
-0x5662c5dc,	0xfafd0e87,	0x43a26362,	0x63d42004,
-0x2c8a555d,	0x2ca020d3,	0x56b5504c,	0x49f4c325,
-0x68d4f5e0,	0xefa0729e,	0x2ae331cd,	0xa380c5cf,
-0x5f95fc14,	0x3b54492c,	0xd710f99b,	0x588cd680,
-0xe3de26c2,	0x48f955d5,	0x4745bec1,	0xa55f5bde,
-0x1c60c19a,	0x6ad28634,	0xaeeeb743,	0x439b8722,
-0x91447244,	0x5c767c49,	0x55242701,	0xd834ee44,
-0x2f9f4f5f,	0xd2ae99bf,	0xc61aa126,	0x64d0dab3,
-0x329c852f,	0x67280e94,	0x84c0d146,	0x4ff4d42d,
-0x41d02750,	0x470108cb,	0xf9cbb793,	0x7e30efd4,
-0x15c012b0,	0x6a0e41fe,	0x198b2bef,	0xcd724a5b,
-0x566891b4,	0x6a5d89b2,	0x3c80520b,	0x11d1d320,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  94-MU265019.inc  */
-0x00000001,	0x00000019,	0x12121997,	0x00000650,
-0x657d0d11,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x7f26c69c,	0xd965bb4f,	0x94736379,	0xfba9263f,
-0x565b87e5,	0x4a7fc60d,	0x0e854e95,	0x4a859fd1,
-0x3dac902c,	0xedefdd6c,	0xd959a4da,	0x9b88e637,
-0x45b0847e,	0xa7a1108d,	0x1a461adc,	0x0a75cb99,
-0x871d3219,	0x8ae64c92,	0xaf5b39bb,	0x59847536,
-0x256f5674,	0x191285d5,	0x6edebbd8,	0x461f63ca,
-0x4f94669e,	0xadc80ecc,	0x085a64dc,	0x7e1c0fe1,
-0xcedd8997,	0x1fb692f9,	0x3b531bbe,	0xb9b262c7,
-0x1f05d82e,	0xac688cf2,	0xfbd23704,	0x1bae2071,
-0x833361b2,	0x9b437645,	0x3dfc6095,	0x90073d04,
-0xbfa2a6d7,	0x9ef6e50f,	0xca35d786,	0xaa6c36de,
-0x0c2786de,	0x85235ffd,	0xb461106a,	0x55330169,
-0xa19f3ea1,	0x5da8f7e1,	0xc41c430b,	0xd59d2664,
-0xc2478a92,	0x2babb133,	0x9245dd44,	0xe48b26b2,
-0x7957893d,	0x773399e7,	0xa0477a07,	0x5a6b4dfb,
-0xabcb4238,	0x37d4382d,	0xf05606cb,	0x4b879199,
-0xdc6f615d,	0xf8c89c29,	0x86cde90b,	0x7b9fd190,
-0xf33d098f,	0xfe72438d,	0x17433c27,	0x7a6bf8e5,
-0x3ff2e215,	0xca257f64,	0xbec0afe5,	0x8120bb2b,
-0x46ab6eef,	0xd9c46159,	0x9d6e38d0,	0xfbcf0853,
-0x37037a00,	0x26555abc,	0x25610aab,	0xd7cfc2e6,
-0x8e2e6113,	0xf7d6ed4c,	0x8078a9be,	0xddde2955,
-0xcaf7efe9,	0x90198b78,	0x2c096951,	0x54a30f72,
-0x6ccc7782,	0x8b241075,	0x9d8514ea,	0x60f97f7c,
-0xf94aa2cc,	0x53ff3bb5,	0xfe44f65c,	0x0029f22e,
-0x64d8fa47,	0x0c452859,	0x8c589fbe,	0x179ae6be,
-0x19474570,	0x0f1b16c5,	0x16176dcf,	0xe4a7cc95,
-0x3fc74e70,	0x76310041,	0x9fcecc78,	0x9bae5410,
-0x9198248b,	0x0f454a0f,	0x6f8f8796,	0xf7305293,
-0xe1ea485f,	0x97f712c4,	0x31be336d,	0x06105410,
-0x50f441b4,	0x4887ec24,	0xd436101a,	0xa415cafd,
-0xa7130475,	0xa7ab7c64,	0x0e00a1c7,	0x0fcb5a01,
-0x3c4e5072,	0x99007058,	0xf76ce045,	0x63dec8ec,
-0xbfd6fe12,	0x71e605b8,	0x6ab06865,	0xbea0d464,
-0x293ac1f4,	0x64f4cc8c,	0x4be6e6b4,	0xfe1dc185,
-0xe91bbc6a,	0x6d1ec136,	0x48ac251d,	0x43c7ea70,
-0x9c81b91f,	0x0fa15844,	0x31961b0a,	0x1b63d430,
-0xfce78113,	0x74dd97c6,	0x3d97591e,	0x9ab5d14d,
-0xb0fb091c,	0x83b45dda,	0x9674717d,	0x7edc5dfb,
-0x0e919cbb,	0x68484280,	0x5f7f5512,	0x77365ca0,
-0xad17fe9f,	0x26ab6b49,	0x0e3e9269,	0x424aa0b3,
-0x3cc2ccf3,	0x416a77ad,	0xf56c1f9d,	0xa2f9e471,
-0x84d9426c,	0xc7cc1db8,	0xacbc04ab,	0xa42bb1c5,
-0xf2c1e51c,	0x5803c2e8,	0x6f628099,	0x5686f059,
-0x661dfd4f,	0x711dd3b5,	0xe99ccbb9,	0x49404d0e,
-0xa70447c6,	0x7e8cfd74,	0xac21ab9c,	0x8877533d,
-0xf2fb6f6d,	0x22dce806,	0xb1c4becc,	0x32a7de8b,
-0xae16c79b,	0x892a458f,	0x24f1e262,	0xfa2af121,
-0x10fe0865,	0x98e8f24a,	0x0163f658,	0x65665308,
-0x5eafa67a,	0xe36d7586,	0x8eaaf4ad,	0x8d7d2dcd,
-0x352c5043,	0xab2e3537,	0x6d0a996a,	0xcac06a13,
-0x00dda4e1,	0xc4fc8e95,	0x25a511df,	0x0c6c9e98,
-0x8a1b9e61,	0xd8260653,	0xbb5a3963,	0xc32bd0a3,
-0xee127e88,	0x43837177,	0x1b04b552,	0x181ddadc,
-0xe484add2,	0x70ca5012,	0xbf33751f,	0x09c49d74,
-0xcf4f9e20,	0x034a2983,	0x63c1e1f5,	0x5d55f43f,
-0xb20e1531,	0xb611421e,	0xc456e84f,	0x838e6577,
-0x555a4e63,	0xee7c75f5,	0x5e972e65,	0x4ebff639,
-0xa5f6aaf6,	0x04862717,	0x3f904365,	0x3de4892d,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  358-MU166d05.inc  */
-0x00000001,	0x00000005,	0x03121999,	0x0000066d,
-0x270b86cf,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3eecc08a,	0xa62586a7,	0x408e7837,	0x0dc3d177,
-0xedde0b05,	0xa3109474,	0x647d05b0,	0x082dd37a,
-0x9508f533,	0x27791251,	0xc76466c7,	0x59d04ed1,
-0x0058218c,	0x9bbc0b3c,	0x578a3165,	0x38f67e1b,
-0x9016dfd8,	0xddd13c58,	0xfcf10eba,	0xcb62d04c,
-0xd2d35472,	0x4f401811,	0x983eee95,	0x67c7e2ca,
-0x09661754,	0xf083039e,	0xbc5c8e2b,	0xd033a5f7,
-0xdd29decc,	0xb08e45c3,	0x178f020c,	0x6aedb152,
-0xb0a543e6,	0x05eb6675,	0x085278cb,	0x8638047b,
-0x0ecbe074,	0x1ec99c22,	0x06b43447,	0x58ea9289,
-0xc306e6fe,	0x0a457488,	0x3bd17bf1,	0xa7a1c60d,
-0xd4d10167,	0xd5f97ee3,	0x7e5b7118,	0xeeb9e726,
-0x25fbb795,	0x8f265c96,	0x31dfab47,	0x8e16f37f,
-0x30feea5e,	0xf7ad09f4,	0x3f183cca,	0xa093c433,
-0x087dec7a,	0x4cba9e59,	0xfcc38136,	0x709092d5,
-0x182dffa0,	0x33edcab7,	0x6dfabfa4,	0x9ce2ef89,
-0xcac4dec7,	0xcb107150,	0x7735b4f2,	0x3cd277a9,
-0x7230d8e3,	0xb2d7ce42,	0x4a40b6fb,	0x0b0a8f86,
-0xb9cb10e8,	0x42fa5d95,	0xfc2754ba,	0x92c173b2,
-0xd8d2157c,	0xfee978a5,	0x68fa268c,	0x5036fb2a,
-0x464a1736,	0xa03ca83e,	0xdc9bab6f,	0x7ddb5f53,
-0x59e8f8a9,	0x4ca42caa,	0x7ba80904,	0x7ca57b6f,
-0x4ce8bc6e,	0x7b7c4916,	0xe2254a6c,	0x278d62b4,
-0x5b421da8,	0xe4376e72,	0xb7dd55da,	0xceb0629b,
-0x498b4e10,	0xa40c2942,	0x644dd7ee,	0x81168e6e,
-0xdb1b5481,	0xe4235208,	0xf8a65d72,	0x9be1e523,
-0xde3c6046,	0x0acbd5c1,	0xb463150d,	0xca5eec67,
-0xb8aee1f1,	0x5f90ee6f,	0x5c16d75c,	0x7c7db98d,
-0x5325f5b3,	0x4935ebe9,	0xb54b36ff,	0x2903946c,
-0x683eed6b,	0xef118016,	0xe0848cd4,	0xc0d1ab12,
-0x1fa732d1,	0x832958be,	0xc46f4b10,	0x69e330d7,
-0x682c04c7,	0x4d54e3c9,	0x9a3c4e4c,	0x704f2e3a,
-0x05fde6d4,	0x2bacfe0b,	0x01feeb9e,	0xa7acd834,
-0x53900d41,	0xb7c39057,	0xf2e749b7,	0xb22892b4,
-0x02bc3b6a,	0xa9bf07ab,	0x0f21554e,	0x94051643,
-0xdfd19589,	0x1d0aa78f,	0x90d6d4c6,	0x1f44d198,
-0x41d8fd4c,	0x989126ab,	0x4b4bb83e,	0x6b7efe1e,
-0xed1a4871,	0xe14f08ae,	0xe4c9c7a4,	0x60f865a9,
-0xb4d07706,	0xc1ac0423,	0xfe52bb9f,	0xa262816b,
-0xa8e6d91f,	0x99e12111,	0x17a958f6,	0x2fa56e8b,
-0x26a3e40b,	0xb99a86b4,	0x1975e2a7,	0x12c7d158,
-0xf04c89ce,	0x1e63c5a8,	0x45fc89ca,	0x08669d2a,
-0xefc329cd,	0xcdfa4217,	0x46fdd0d4,	0x832598a5,
-0xe66c4533,	0xa082c44a,	0xd3fa6222,	0x16ee47f3,
-0x8b90b067,	0xfa7fb243,	0x107a6c75,	0x20a9caeb,
-0x32c97825,	0xae4c758c,	0xfac2c32c,	0x7b2c99e2,
-0xc67a6b3d,	0x2da13198,	0x40bfb7a1,	0xa86e1b40,
-0xdb6fc09e,	0xe9294017,	0xd327adb9,	0x11110cac,
-0xbbd27303,	0xae5d51f5,	0x7669ab98,	0xdad9463f,
-0xc749fa60,	0x7b9d09e4,	0xb306ff5d,	0x858aa60f,
-0x3310d43f,	0x39519ef8,	0xfe9932b5,	0x417fa945,
-0x8dad55b5,	0xe3e8de26,	0x35007ade,	0x3492880a,
-0xab849e4f,	0xcd774b5c,	0x28544c48,	0x8b498f40,
-0xe884eb7b,	0x20241491,	0xc6a03ed4,	0xd328186f,
-0xc591ccd9,	0x92750413,	0xc9557d4e,	0x88ef0aaf,
-0xa53b30fe,	0x4f1325f8,	0xe6f7379f,	0xd7484b44,
-0x88d273b4,	0x916e3b39,	0x4b044249,	0xa7b28fbf,
-0xfd49d863,	0x79d3dec6,	0x7dd8135d,	0x948845d1,
-0x55db29d1,	0xaf6408a7,	0x600c14a6,	0x89d463a8,
-0xb2bd82af,	0x61e04014,	0x326681f3,	0x6053a6c9,
-0x250c7a7d,	0x0a642a61,	0x2a6689fd,	0x01c6c9d1,
-0x445fc371,	0xc8c5d01e,	0x813c4130,	0xf61f837e,
-0x2f243919,	0xce51a67c,	0xb14232a6,	0x1a79eb11,
-0x8e5b7f19,	0x94a777cd,	0xd0e61396,	0xc1bb9eec,
-0x509fe53f,	0x90bde780,	0xfdabe75a,	0x97af888d,
-0xc525cb70,	0x45ea7624,	0x2736a36d,	0xe3ef2095,
-0x16b685b9,	0xb8d00570,	0x3a3a5365,	0x2cf032c7,
-0x26b4c03e,	0x4271dc33,	0xab85bcfa,	0x3afe2205,
-0xc81b634d,	0xc32a2a5a,	0x63028408,	0x7b3fac4b,
-0x5a7df74b,	0x35a60cfb,	0x06aace89,	0xc2b02ebe,
-0xc50788c0,	0xa1f41242,	0xa5976893,	0x712469a0,
-0xd17a0c5a,	0x706e3d86,	0xc2f9685f,	0xf449c450,
-0xe72f42e0,	0x1cd28b33,	0xc1155247,	0xaaa41150,
-0x261c1d3b,	0x492ff4db,	0xac49bcc4,	0x2692d23e,
-0xe1c9a072,	0x30edf533,	0x660e7470,	0xd145fbde,
-0x7c5c49b0,	0x7bcf8c05,	0x2ff02005,	0xedcd3a12,
-0xa18bf23e,	0x70ebc247,	0x96986456,	0xfc0fb3d6,
-0xe1ad3385,	0x89b3ae09,	0xbcc18862,	0x7bc64f50,
-0xacac4b0c,	0x64f1f67b,	0x06489941,	0x0f8675c1,
-0xad097e7f,	0x19c4d7f0,	0x23180e2b,	0xffbb5788,
-0x82e1ffa4,	0xeaa3a7d8,	0x7a37ec77,	0x1db0b023,
-0xdee55066,	0x5863d8c3,	0xf4c56ba0,	0x067a0a3b,
-0xfd5f26ce,	0x952b7e63,	0x28fa1941,	0xc6118388,
-0x8135d105,	0x577c5188,	0xe5217d10,	0xda4410f0,
-0xaede1954,	0x0d2c3425,	0x1aa63ce7,	0x95b44276,
-0x0770aa23,	0x6e703548,	0x2904c0be,	0xe2df8736,
-0x4393f1f9,	0x70ce1525,	0x88d256b0,	0x671bf175,
-0xae8b8785,	0x9a26490c,	0xd6bfd6f6,	0x05947a91,
-0xe1340d8a,	0xb3b37f6f,	0x3e93c7e7,	0xc24dc70c,
-0xdcff96f4,	0xdd05a3dc,	0x462c01ff,	0x05286a87,
-0x86f78acd,	0xff056306,	0xf87fd3d2,	0x3cd4abc2,
-0x82c0083a,	0x9ef42ebe,	0x709da61f,	0xe1ddc8a4,
-0x6d91ca8b,	0x116ac1f5,	0xc4ae1fb8,	0xd9adba26,
-0x79418d23,	0x0d5824bd,	0x50edc99f,	0x3980786d,
-0x673bef89,	0x9f063042,	0x62b432e5,	0x6967beb9,
-0xe37fd96a,	0x7b1592dd,	0x437094c6,	0xa7524f6a,
-0x3fa85e93,	0xb17f53f9,	0xa3a7f69a,	0xea03b804,
-0x8dea22e6,	0xc095d826,	0x65fbd1dd,	0x241a9527,
-0x1c103e6f,	0x07fe651d,	0xca1f3625,	0xe7095692,
-0x4e7ca154,	0x9bbc25a4,	0xf7e36d2e,	0x661e8328,
-0xdb27f7e2,	0x7725adb7,	0xea2f1ecd,	0xd97d7ce8,
-0x64a80e81,	0x0fedfe61,	0xba01f4fe,	0x4125c4f5,
-0x7525b5b9,	0x491e09d1,	0x4971bfd7,	0x87e7bf91,
-0xd9642634,	0xc613b75c,	0x4eac1995,	0x0676f816,
-0x5bbde4bd,	0x9d896773,	0xbef78a8e,	0x664de511,
-0xdf272637,	0x6c91f7a5,	0x99b42d3e,	0xe4d12c19,
-0xda29b3b0,	0xc99346a3,	0x135ad23b,	0xf63565f2,
-0x31e84e51,	0x17503841,	0x2074a43f,	0x4884627f,
-0x751d935f,	0xb7de396c,	0x60ac4c22,	0x26a3ecbd,
-0x771c6046,	0x9fb24436,	0x69c094e0,	0x3b500ed1,
-0x4acfb68f,	0x489263d3,	0x72878f8d,	0xb41fd5f8,
-0x9dba1fe0,	0x049eb891,	0x5df03769,	0xc47d9696,
-0x72f59209,	0xb151fbe0,	0x260095c7,	0x88adb02f,
-0x3e35d2ed,	0xca7b8454,	0xa6d56623,	0x48cfd15d,
-0x5ec65c94,	0xdd45c99e,	0xc9ab3a13,	0x1bd8bbe3,
-0xfa87c12a,	0x5b32688a,	0x0fcc1d53,	0xea8f88a4,
-0x38f68efa,	0xcd13a712,	0x7da1b9bb,	0xd29f6ba2,
-0xde23b46a,	0x6622783e,	0xe5a7fb42,	0xe981f7fc,
-0x45bc6405,	0xf6e40044,	0x93763406,	0x5f8be3f3,
-0xbe01786f,	0x40389874,	0x56bbc03f,	0x02ec4ce9,
-0x42ce5877,	0xa658533e,	0xee412a3e,	0x22a47b5d,
-0x98965b02,	0x43d40037,	0xd2e1ce86,	0xd19426f0,
-0xc763ab1a,	0x5c97b009,	0x6297ffab,	0x896e3a68,
-0xf5d7abea,	0x30e0b88a,	0x6b6faa67,	0x2dc017a1,
-0xa42fdcb8,	0x304838ab,	0x16907995,	0x6ef05b9a,
-/*  678-2f0708.inc  */
-0x00000001,	0x00000008,	0x11152000,	0x00000f07,
-0xb7b473e7,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x4dddb0e3,	0x5a70c760,	0xe3027e6a,	0x257e0d6e,
-0x1cc3bc7f,	0x58220fe4,	0x6b5f6eb7,	0x631a1665,
-0x8a7512c0,	0x06161f7e,	0x8069e964,	0x528fd53c,
-0x13223d11,	0xd432b7bc,	0x14e91b7c,	0x0a9ef7d5,
-0x0e260983,	0xffe44ab3,	0xd1feef0b,	0xc132aee8,
-0xe5ea6fc4,	0x18948b86,	0x1008c031,	0xd750f306,
-0xf362cdc5,	0xf610851a,	0x27ea5d51,	0x18849a2c,
-0x21f0c897,	0xe7bc3877,	0x9865d834,	0xdfbd8ab7,
-0xd1b7adf4,	0x1d116923,	0x46d71883,	0xe2b172f4,
-0x12065b5e,	0x23984b09,	0x86922920,	0x20ffc1a4,
-0x3d53d90c,	0x02603eda,	0x972c6c24,	0x319bb9d4,
-0x60df61b9,	0x0e86675f,	0xc4b3e000,	0x77691725,
-0x8e2cb3ae,	0xb174fafb,	0x6973c230,	0x5099b0af,
-0xeb3b208b,	0xa8629bfd,	0x4eee644e,	0xdf345074,
-0x4966d636,	0x4f84bb76,	0x58920fc9,	0xca68b22f,
-0xc3e6e2fa,	0x344c1773,	0xb38ceb98,	0x7bd94b4c,
-0xa7b02c1d,	0x6c49d324,	0xbee89d2c,	0x05e29d38,
-0x832e9907,	0x7a1b71ef,	0x707cdbae,	0x5302f267,
-0xdd3ace44,	0xe735b7e6,	0xe9801d71,	0x4fa2cf9b,
-0xecef5578,	0xa59d0bb0,	0xc7ee559a,	0x73a22e03,
-0x379f0f17,	0xdee4fa9e,	0x994460b9,	0xb789e510,
-0x9727b82b,	0x45363eeb,	0x87ffd67b,	0x725908e9,
-0x0295aee8,	0x3a70dcb1,	0xb2b6eef2,	0x7ebc23d3,
-0x3d692d9b,	0x43aa7591,	0x59713bdc,	0xc98911f7,
-0x2ca95380,	0xe577f8b3,	0x7bf4a277,	0x986a17b2,
-0xa153447d,	0x78da542f,	0x0c4c2f50,	0xc0dbc22f,
-0x2729eecc,	0x51051362,	0x79bc3129,	0x6cfd32f6,
-0xaab0a714,	0xc77a2a0d,	0x0b9bb7f6,	0x5f4ea4f0,
-0xa04ab8f2,	0x23d7c066,	0x9a3a61e8,	0xc95e854b,
-0x6c5365ee,	0xcde17650,	0x0f2f0760,	0x28c82126,
-0x00087588,	0x3678486c,	0x8746fc87,	0xd2f54238,
-0x0cc355e5,	0xf2f3ba75,	0xf80d5eb5,	0x0c091c89,
-0xbc7f9b03,	0xfbd7bea9,	0xe2197cce,	0xf23e9ce9,
-0xd2ba317e,	0xf795879d,	0xa7ddd184,	0xf320b681,
-0xa1d665b5,	0x10ac8bb4,	0x8ee3146a,	0x5b458e3c,
-0xb89da052,	0xda575cc6,	0x0d230bff,	0x9c3cadeb,
-0xcd68ee26,	0xd032b247,	0x43658df3,	0xf9f4168e,
-0x861b4409,	0x1d279790,	0x866591d7,	0xea409a91,
-0x1351048d,	0xf3067a37,	0x6861790e,	0x3b35f621,
-0x22a9af0b,	0x28a7042d,	0x890f7f0c,	0xc93dbc2c,
-0x20adb3a8,	0xcb7b5697,	0x40c73f52,	0x3f4fde23,
-0xd2eb1eed,	0xdc77e6de,	0xd1d59d5d,	0xd975315b,
-0x2d37da7e,	0x86dd3507,	0x2012e431,	0xcd197ca7,
-0x7cfabd26,	0x56ed3b6a,	0xc6c179b9,	0xb133a293,
-0xd1988106,	0xdfdcc553,	0x925f894d,	0x610915a5,
-0x9daceed2,	0x1dc3be8d,	0xd92f2d7d,	0xd8ce4067,
-0xe0fe80a3,	0xc4c5be9f,	0x4b79f5a6,	0x07f2e89c,
-0x104ff0b1,	0xf9d80a95,	0xb469af7f,	0xdeb4e632,
-0xe20e68b1,	0xb04c906f,	0xae96d5f0,	0xe8807571,
-0x69e653cd,	0x73634a9d,	0x0359cf6c,	0x895bbbdd,
-0xddc8e603,	0xd0c6ecf7,	0x55d8d699,	0x6b6c87aa,
-0xfb5fa64c,	0x280e725a,	0xf469add1,	0xc71b2676,
-0x0d3ffa86,	0xc18b8e6e,	0xe9d5c8fd,	0x388a62fa,
-0x96486eb2,	0xe343b757,	0x2d7e5b9a,	0xcdd2fdd7,
-0xf37f535f,	0xc22d20f5,	0xb56229ef,	0xf84c2873,
-0x3bb8166f,	0x3047942c,	0x0c0c34e6,	0xffb18af5,
-0xba123d95,	0xd03ca2c9,	0x492f6877,	0x11123a60,
-0x12a4ed70,	0x1359ecf1,	0x54d06dbb,	0xf46dee9f,
-0xc12b4b91,	0xed32e734,	0x365d205b,	0x3f4bac05,
-0xf9107418,	0xfa1f3314,	0xbf4b26f3,	0xfb727a4a,
-0x0491c7f7,	0xae00a8c9,	0x8ae416e6,	0xd6452a4d,
-0x37a5613a,	0x63099fa2,	0xe9e1ab5c,	0x8d522050,
-0x13df8316,	0xf83472a2,	0x25ebaa4f,	0x760db85f,
-0x75ac1227,	0x2c5a02ef,	0xfc6a75ba,	0xc73e3d4f,
-0xda41add6,	0xc0cf63a3,	0x9f8b7c51,	0x1edcc855,
-0xdafd1090,	0xeaa1f5f6,	0x9f5ab9be,	0xf519b1f9,
-0x220ada81,	0xec9b6297,	0x8661ea2c,	0xce9b083c,
-0xd9066bd8,	0x3580f9c8,	0x654096f0,	0xcd89c00a,
-0xa1cb9789,	0xd81005e0,	0xb38c9d26,	0x16fe94f6,
-0xfd7ed18a,	0x7f082e86,	0x46232eb1,	0xdca4c40c,
-0x09c2a72f,	0xa457e090,	0x9b006010,	0x6e0ef594,
-0x8c2db173,	0xee25f9b6,	0x4b5eac90,	0xa5c29e8b,
-0x38287db2,	0x9d44981f,	0x64683efb,	0xd4d7b3c1,
-0xcc04d5d9,	0x492e3520,	0x2f4c5009,	0x9166154e,
-0x0611df13,	0xe072a1a8,	0x91c621ce,	0x77075850,
-0xf167a5e5,	0x21e75939,	0xdea1ea39,	0xd92a1119,
-0x1dcf8ad4,	0xd08c8eda,	0xe448b734,	0x3aca7fec,
-0x2ac02c01,	0xd190cfc2,	0x5db28d4b,	0xd035d0d1,
-0xa3d4ea09,	0x875a7ac8,	0x01905ca5,	0xf5d11ebd,
-0x52bb11d7,	0x61d7dde8,	0x1b75b331,	0x8d7519d8,
-0x078e4250,	0xd26b936c,	0xb5782301,	0x4b31a8b7,
-0x6ec83a0f,	0xf61c0c35,	0xfffa8aa1,	0xd4dfb0c8,
-0xc6f66653,	0x118cfdcc,	0x4d21b9b7,	0xfefcad12,
-0x0966781a,	0xc924b099,	0x917c8608,	0x13ab58b4,
-0x15dd0d17,	0x5e556a71,	0xccede394,	0xfda4dcb2,
-0x21302bf2,	0x8753f833,	0x034ff898,	0x7f33ba69,
-0x198d898b,	0xf209df4e,	0xfe8c6dbd,	0x82c24300,
-0xfa8e133f,	0xe7ead557,	0x38713537,	0xe910e818,
-0x85427524,	0x20188bbe,	0x3bffd95e,	0xdf8dff60,
-0x54000988,	0xfc26f171,	0xdc175ac5,	0x33ccf2d2,
-0xc28930c4,	0x798af4bc,	0xd3038720,	0xf6194887,
-0x4d4ff6dc,	0x8ae765df,	0x861a86a3,	0x534d3360,
-0x5ef12290,	0xee55d0b0,	0x80a81e9b,	0x9f0db628,
-0xe9feb243,	0xaa83d0ba,	0x1d81638e,	0xc8d34c16,
-0x94c9c754,	0x5b036e00,	0x1d3fdd62,	0xaa5702d3,
-0x78e42d61,	0xf3b33904,	0x7a64e85a,	0x7c81119e,
-0x7c8a9214,	0x9c47cab6,	0x169fce10,	0x63714659,
-0x6503c9fb,	0xa04376ee,	0xecce86ff,	0x880b1193,
-0x52a10bc7,	0xf59865de,	0x26b855b2,	0xd74a8d70,
-0x8cfda341,	0xbd75fa8d,	0x417fd8af,	0x8899f8ae,
-0xfbccde06,	0x99bdd436,	0x27f2377f,	0x7a861733,
-0x44b70631,	0x84112f62,	0x33523bca,	0xc2dbf2c7,
-0x65747162,	0x407eb3ba,	0xd552a9a0,	0x81896a57,
-0xd2f2bff9,	0x6a8fc9d9,	0x5cde0cbc,	0x58b714be,
-0xdfc21b97,	0x00bd281f,	0x38e403e9,	0x6fb80b04,
-0x7c9ad9ac,	0x9e3e07c6,	0xa9c6ae35,	0x1c648e56,
-0x49b3aa31,	0x78c74846,	0x285f5d6b,	0x5ccb7142,
-0xabc6cc11,	0xce36f1f5,	0x093926cf,	0x88b774ab,
-0xabea55d0,	0x5d61bca4,	0x594f92a2,	0x6ae8eec6,
-0x325ea3d5,	0x8ee663a7,	0x9a00db31,	0x09787a75,
-0x13c2726a,	0xa97f00fa,	0x4794b06c,	0x38a57549,
-0x9850bc54,	0x15d84a9b,	0xd8ba56e4,	0xec52fbfa,
-0xb400471b,	0x31714eae,	0x9e60c723,	0x2d2f238b,
-0xcd154356,	0xf2395c4a,	0x07a37c04,	0xac6f6c10,
-0x32be7e7e,	0x366b17ea,	0xcaa7d96b,	0xcb3563a1,
-0xb15983b5,	0xba2af198,	0xd89900f3,	0xf9437ccf,
-0x47e26662,	0x1d5d5c22,	0x17ae16e7,	0x7e0ef361,
-0xec639aa4,	0xf46503c1,	0x9b88a712,	0xb7f2ae9b,
-0x9bfc2db9,	0x6d75e8f8,	0x896ba8a8,	0xfed54e37,
-0x3563eae0,	0xbbd0294c,	0x89b47800,	0xce87a4a4,
-0xb15ebb4a,	0xc29f09ef,	0x5830a869,	0x24ebaba5,
-0xf1504a05,	0xd58a8084,	0x87157d74,	0x182dced4,
-0x2ae81a28,	0x3397700c,	0x72ad1146,	0xbacdc632,
-0x7ea7fdd3,	0x23c147b2,	0x7203b0c0,	0x6ee52c7e,
-0xff0899af,	0xaaa7dfcd,	0x99012d4b,	0x1580a45f,
-/*  1460-m9df4305.inc  */
-0x00000001,	0x00000005,	0x04212005,	0x00000f43,
-0x77812c17,	0x00000001,	0x0000009d,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x41740bf2,	0x0fb63031,	0x74bc45b3,	0xf307c6fb,
-0xaf228a86,	0x79ea9270,	0xc00409b8,	0x7168b2c9,
-0xc69ce09c,	0x6feac351,	0x43e9da85,	0x3a90aeb0,
-0x585463dc,	0x862a2fdc,	0x940910e5,	0xb505c163,
-0xc30e56e9,	0x4e2a719b,	0x42e8bbda,	0x19147d96,
-0x7ff726d7,	0x1e0edfda,	0x87d8bc2a,	0x60653903,
-0x71774956,	0xa9471d10,	0xf1c88b74,	0xb962703b,
-0xf17437d9,	0xc0adbf90,	0x652ab30e,	0xc67fae0c,
-0x0e841997,	0x99f91985,	0x3e029b48,	0xa72bde1d,
-0x3ea0da5e,	0x96279a8d,	0x1f1ec1cd,	0xa965fa6b,
-0x35c8ccbb,	0x6a72ee72,	0x1fc43e03,	0xec7735f6,
-0x8823ff1a,	0x3e645212,	0x82a09482,	0x311bf7a3,
-0xcadf34af,	0xa6c5cecd,	0x70bf80c8,	0x0845cd4b,
-0xf060f6ab,	0x428653f0,	0x4582d8a8,	0x47e4bacf,
-0x05b49c22,	0x51443b9c,	0xce21cc4e,	0x1468359a,
-0xc3a26269,	0x497f2c70,	0x812df7aa,	0x4d4c04f7,
-0xb9a174a5,	0x0ef520b4,	0xde699847,	0x365da54e,
-0xb1187e8c,	0xca454e8f,	0x9e8f544a,	0x635a9936,
-0x291f0f10,	0xc880aad6,	0x052f194a,	0x8a07d5c9,
-0x49dbf128,	0xdf0d5289,	0xd7963495,	0xabbf6337,
-0x7b8b78d0,	0xbadf035b,	0x5ce0b492,	0x8f3505e5,
-0x4a5993c4,	0x5b5bcf84,	0x27427e04,	0xecb71d2c,
-0x19bf1e03,	0x1c0aa23a,	0x0550181a,	0x873111fb,
-0x420a4832,	0xfe59acd4,	0xa6639d43,	0xe8586050,
-0x7eeaedf9,	0xf262b624,	0xdbaf5bc7,	0xf6a1f48d,
-0xcb134184,	0xebb3b6b3,	0x4286edbe,	0x831035db,
-0xf21d33cf,	0xf0e5a942,	0x713ba616,	0x67050db1,
-0x297d8d43,	0x492ad3e8,	0x7baabecb,	0x182896ce,
-0x2dd7ca4b,	0xd9b35d23,	0x7bb66ec7,	0x61d8a014,
-0x741f2ffc,	0x9900d5bc,	0x6dca1242,	0xe7fc10f4,
-0x189d5169,	0x9dc29201,	0x91dcfc93,	0x3f897e83,
-0x5fb4bc8e,	0x90e9d74e,	0x80a59795,	0x52e200b4,
-0xb848428e,	0xe1c88c23,	0x4bdb6f55,	0xec37329d,
-0xb9319cf5,	0xafc426ad,	0x709291c3,	0xd6337f13,
-0x05787ba5,	0x1fd0c9be,	0x04c10f42,	0x8b905c03,
-0x9c8ab821,	0x39d16a2c,	0xff92a2fd,	0x03a422f6,
-0x399071b6,	0x1a71c1f6,	0x2a06aaa7,	0x5a127792,
-0xe0245f90,	0x7ac7a606,	0xca8b0026,	0xc47103e3,
-0x711ebc3a,	0x63c83ae1,	0xaf6a9a65,	0x744c86a2,
-0xbe10c4ad,	0xc2803284,	0x602b6a17,	0x10d60720,
-0x8308d938,	0x6e92a831,	0x64f30617,	0x50a13d14,
-0xa5aeb526,	0x1ecb499b,	0x5b60c9e4,	0x8dd251ef,
-0x11b16e38,	0xea410ba4,	0x74db14bd,	0x2f4d5e36,
-0xf28ea5e5,	0x231f3e77,	0xf436a5a5,	0x56bbfaf8,
-0x2ccc07eb,	0x0813c683,	0x86822d1d,	0x95b897c5,
-0x3f62fa14,	0x9f3f99f8,	0xd5f7fdbb,	0x0cbe179a,
-0x1f3a5628,	0xeca6f2b4,	0x12f7cada,	0xe37a2fdf,
-0xb675725f,	0x410037c5,	0xb808ca59,	0xa4bd5413,
-0xe32191b9,	0x3235a554,	0x62039695,	0xa0652f4f,
-0xc78028d8,	0x499fe81d,	0x316a700c,	0xb1489055,
-0x7a513a9b,	0x7f03fad5,	0xff234c2e,	0xc4b2455f,
-0xa412eff4,	0xcaa52441,	0x0923a5ae,	0xdcd7187e,
-0x758f5fd5,	0x5b1b9e7d,	0x95c7840f,	0xf965e7e5,
-0x98b65c42,	0xc61289d9,	0x7249b7a0,	0x5102c56e,
-0xfc8aa455,	0xb44da061,	0xb0a37e8b,	0x29d8c01d,
-0xbb5e79df,	0xa795eef2,	0x91d432a8,	0x5e5d736e,
-0x30f4bfc4,	0x2fe5b1ed,	0xf092e0d1,	0xdd507420,
-0x972da66c,	0xd7165069,	0x0a8e6912,	0x30f29776,
-0xbe544016,	0xc9af8108,	0x1cc1e045,	0xbf221ed5,
-0x1e7cb2ff,	0x8e9442e9,	0xaea734d7,	0xcc58775a,
-0x2c115eeb,	0xfb48535e,	0x174d0264,	0xc99a9afe,
-0x252c6e79,	0x09e05ab6,	0x0cb416c2,	0x6f0da541,
-0xa2947cd5,	0xd134edd6,	0xaa8876a4,	0x35025d69,
-0x1d95153d,	0x68392af7,	0xb428842e,	0x72950102,
-0x6718027b,	0x8e564123,	0xada1ebcf,	0xa7ee3852,
-0x86c0b296,	0xd56a51c0,	0x87bc83f9,	0x94c703fe,
-0xd43043ba,	0x7a4f6d96,	0x43cde1ec,	0xb7a7e12a,
-0x1160cd1a,	0xe98c5d2c,	0x226ac59c,	0x3561e049,
-0x92b8d432,	0x269e9e5d,	0x12a0eca9,	0x52124b1a,
-0xdabfc0a9,	0xda11ca8a,	0x59883488,	0x5f0cd8a0,
-0x08c4c231,	0xdbabee6e,	0xac686a3c,	0xd4e2b5e3,
-0x747a399e,	0xc40b5f06,	0xea298387,	0x21d07cf0,
-0x51fce4d8,	0x68044635,	0x10a5ffb3,	0x5298f28c,
-0x906a8d2f,	0xa1c8fda2,	0x543e77c7,	0xf8ece9a9,
-0x63ed3519,	0xb10c7f4d,	0x04c140ca,	0xd91343fe,
-0x9cb4229f,	0x068e8f29,	0x77ec5ea3,	0x0238ac70,
-0xd550fdd4,	0xda35bd00,	0x6ab6daf7,	0x6411bd0b,
-0x657771ef,	0xe41b9cc9,	0xd3fc46ac,	0xe3562add,
-0x6799cce2,	0x25b911e5,	0x50a1d2c8,	0x12ca2a68,
-0x136e4bf0,	0x23c049e1,	0x1910cc00,	0xdeb236de,
-0x0b9c05dd,	0x6a02b30d,	0xc6fe586b,	0x3d3e45a7,
-0x2f22a744,	0x54773926,	0xec0bbc4d,	0x48df3c56,
-0x6e3c5d21,	0xfbd2ff57,	0xea2d9bc4,	0x4f52996c,
-0xfc81629c,	0xfdc01172,	0x1d953584,	0x63dada41,
-0xb6cd3a92,	0x01c070fb,	0x73a6a71e,	0xe5c02fda,
-0xfa188df8,	0x633c1650,	0xc8db25c4,	0xaf1f9350,
-0x0c74858b,	0xd5bebe13,	0xc6c32a82,	0xbe86fba1,
-0x8bf03e83,	0x0f9e7689,	0xab4a988a,	0xd115cc46,
-0x4f0268f9,	0x36af63d7,	0x9016f26d,	0xc5abfa8d,
-0x46718964,	0x8d6f297a,	0xfb7e84de,	0x72f4563f,
-0x93ec2c9d,	0xc1dd760b,	0xd2c167a9,	0x96440c3f,
-0xfc6cb1c3,	0x1d72d321,	0x386e6cb9,	0xb173c629,
-0x1a876416,	0x388f6f6a,	0x9f45966a,	0x1f015d4c,
-0x4c033d79,	0x9fde00f0,	0x44def7c5,	0x7cd0b2a9,
-0x85c4ca89,	0x07db2622,	0x731efeba,	0xa9a66091,
-0xd4ed0fff,	0x7660ab08,	0x983d6077,	0x1a0ea34a,
-0xd4548ba0,	0x66c9b8f2,	0x35173c26,	0xeeaa588d,
-0x5c36c76d,	0xd4c88651,	0xe18303d4,	0x824d8807,
-0x7b4dd2bd,	0x71719dc5,	0x19c23f5c,	0xc06f19b8,
-0xa20fa726,	0xd701ee20,	0x62ca2add,	0x6b8d8f6c,
-0x13204a15,	0x5bc46207,	0x9b13c41b,	0x8cbf9545,
-0x72faa845,	0xa97a0e66,	0x90acd440,	0x638f02ef,
-0xaf944eeb,	0xd11c44c0,	0x7d44f7ae,	0xe2293ba0,
-0x45b04be9,	0xb8d14f4f,	0x269e26a9,	0xba24ec3e,
-0x9e905c28,	0x5705c02b,	0x8e9b485b,	0x159d2572,
-0x2fd0efc9,	0x20d0a053,	0xf9223304,	0xf3791ec6,
-0x7620b3e3,	0x871cb096,	0x03c47ccb,	0x45c1e6e4,
-0xe9459554,	0x93b06148,	0xe632e819,	0xfc0dae00,
-0xa89b13d4,	0x883d2d43,	0x8d67ef3b,	0xc7322610,
-0x622b4285,	0x46bfdaed,	0x66042c6a,	0x657249a6,
-0x7ad10b29,	0x241c4267,	0x80c7860e,	0xeb3d5887,
-0xf939d68c,	0x9ff51d77,	0x84fb0d54,	0x961e1142,
-0x8699a335,	0xafea31ac,	0x9ed69870,	0x0d9cedfd,
-0x176bfba8,	0x66a83c18,	0xf002bf7e,	0x65f89946,
-0x9d25e0f7,	0x84b9c9f2,	0x7537f464,	0xe65c15db,
-0x1c5c4435,	0xfab634da,	0x6fc6b100,	0xa2691637,
-0x104b7f83,	0x4e07905f,	0x8d024265,	0x85a32eb3,
-0xcb57a035,	0x7f4c5350,	0x30602409,	0x0ea22684,
-0x52a31ef4,	0x98b176c5,	0x88cf84eb,	0xe2735407,
-0xdbb18422,	0xbd24b47b,	0x972b7446,	0x0cffacd4,
-0xd8a24e33,	0xc97871ce,	0x2f49bde0,	0x143f6db1,
-0x32a5ccd0,	0x55b4bdeb,	0x6c9031de,	0x358c8f66,
-0x6c7d431f,	0xa6f7dbbd,	0x87b6a229,	0xd4cebd19,
-0x663ebb0c,	0x7a98d7ea,	0xbb5aa19a,	0xafc7a8d6,
-0xe514d8f9,	0x0cc34af0,	0xe86257b2,	0xbcc81965,
-/*  1376-m8069547.inc  */
-0x00000001,	0x00000047,	0x11092004,	0x00000695,
-0xa0324f3b,	0x00000001,	0x00000080,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x0c66a43e,	0x6fdc369b,	0x040ec151,	0xaabfb472,
-0xf556e326,	0x3739dbc6,	0x4a14fd4e,	0xbe510a9c,
-0xe70bf636,	0xdc6858b7,	0xf484a559,	0x24802e67,
-0x63d69186,	0x15fdd673,	0x603020db,	0x9f57bd55,
-0x8840215e,	0xcb23ca23,	0xa97dbfc7,	0x714c433f,
-0xaacc8d9a,	0x46531bfd,	0xbd635f18,	0x429f7a10,
-0xa502e1d3,	0x3ba2b6f0,	0xa4f6ca99,	0x0d708861,
-0x1b574fe7,	0x485227a4,	0x18d05856,	0x8db5dcaf,
-0xff1a7545,	0x6866a2ee,	0xc4aa8c37,	0x0080d8c6,
-0xc1cf82f0,	0x2d396ed0,	0x859c1832,	0xa2e48a7e,
-0xe71f5f78,	0x87fb8357,	0xa4322cc7,	0x846d5040,
-0xdb286962,	0x5b18ed9d,	0xf5f81e6d,	0x959e87d7,
-0x8806335e,	0x3c4762a1,	0x21ba50ff,	0x85489e1c,
-0x96128b82,	0xa9857202,	0x803eac9e,	0xea6553f6,
-0x8bd2d706,	0xeb28a554,	0xa7dfda72,	0xa4059899,
-0x88f93cb5,	0x50e1b23b,	0x8dc74029,	0xd9872ffd,
-0x4f6202ed,	0xe396c354,	0xa35b81d1,	0xf8701e2c,
-0xf33b0f6f,	0xbda6e8f3,	0x9e3d786e,	0xaf4d40fa,
-0x35859710,	0x7e460cb0,	0xfdd99345,	0x78f0a992,
-0x3794cb3e,	0x4f402d47,	0xaea20bf4,	0xa50aabd1,
-0x196885ee,	0xb2c84221,	0x14bc44a0,	0x326479c3,
-0x687b0dc6,	0xbc2151d4,	0x686c6647,	0x6ff095b9,
-0x4af5886b,	0x5a49ac48,	0xe1f7533d,	0x24924e25,
-0x5eb4d9e6,	0x7b8ac82f,	0xac929b2b,	0x7482c790,
-0x788a9491,	0x925b2591,	0xb4f3cce2,	0xb91f1662,
-0xd5fb65d4,	0x549aae06,	0x93f073b4,	0xcc26dc33,
-0x05c41dd6,	0x660c52d8,	0xcd4eeee4,	0x87939004,
-0x532c864c,	0x0e94c295,	0x0d2d2251,	0xd6d88925,
-0x9e9dc21a,	0xa6bf396b,	0x911daebd,	0x525e105e,
-0x1d352b27,	0xdcadd5e1,	0x27d95dec,	0x35726567,
-0x03836c6f,	0x4d343b99,	0xa7a18015,	0x23d37d74,
-0x632d35c7,	0x00035697,	0x07e8bab5,	0xf7cf3a02,
-0x068706f6,	0xdfa171be,	0x3aa2c1c1,	0x5a1d954e,
-0xb71b6c1f,	0xbe29fbcf,	0x8de6b15e,	0xf41460cb,
-0x18fd0cea,	0x5bedf3f9,	0xd2f177f2,	0x77518f57,
-0xe3666a03,	0xe24637e3,	0x0f38deb3,	0x293dc567,
-0xfe5e1a23,	0x5177d656,	0x2a9e259b,	0x49fb90bc,
-0x6c865d17,	0xde4c3fc1,	0x5c3cdf10,	0x2b4d5c6e,
-0xeff3d6a5,	0x8bb9bd18,	0x9ee723b1,	0xbc12ba57,
-0x8caa211f,	0xdc83bcdf,	0x208a9ba4,	0xfca21241,
-0xc6a6eefe,	0xded5aed8,	0x73d3ae48,	0xa24f5cb7,
-0xa8f2da15,	0x63cfd2e7,	0x857c975f,	0x7b0d09a4,
-0xe521f32c,	0x05cc1628,	0xb5c210e0,	0x9261386c,
-0x447fe66a,	0x4dcf4214,	0xd0be6ce9,	0x7939347f,
-0x02deebcd,	0x89a90ff9,	0x8b8c5d30,	0xf674503f,
-0xd4c93e7e,	0xfd995ed2,	0xd44dc317,	0xf43a2742,
-0xebfdeaa7,	0xa57ab877,	0x8b5feddc,	0x84fa6995,
-0xa683f7fe,	0x3f075a90,	0x904711b4,	0xe4f402e9,
-0xee714efe,	0xa751db10,	0x4f259590,	0xfebea582,
-0x3a6c0d66,	0x25a452a3,	0xd022c348,	0xdc24602a,
-0x58716977,	0xf6a70e92,	0xfc82cf6e,	0xae09cca1,
-0xa20e842d,	0x15e048d2,	0x96f8fefd,	0xd94fe184,
-0x25316b80,	0xb751593d,	0x8aa614c1,	0x4982c5e5,
-0x6d211294,	0x7b22c753,	0xc29d3f2c,	0x4bcb73f5,
-0x370b4a68,	0x385b671f,	0xc2a023c8,	0x9043117e,
-0x76c07ae3,	0x7c5968cd,	0xf2a48406,	0x5ea944d4,
-0x0e9e6382,	0x4aaedda5,	0xecb4f191,	0xd14cfab3,
-0xf43e8cd5,	0x0946e811,	0x17f743bf,	0xa6665715,
-0x586fdb03,	0xfe41799a,	0x9c5e72fa,	0x585128f4,
-0xd71618ac,	0xc87934bd,	0xe96101d1,	0x55d1976c,
-0x471c8505,	0x7a36d839,	0x5d62a9ee,	0xf3c54a8a,
-0xa2be15d9,	0x244087c9,	0x042c8037,	0x23224689,
-0x281c5d73,	0x2139ecfc,	0xffb8bc8a,	0x834fdd11,
-0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,	0x4ae2dbda,
-0x86d90089,	0x6675dfce,	0x48876262,	0xcec72538,
-0x11dc5c80,	0x86a730f9,	0x313565c9,	0xe3e5be11,
-0x106d7cce,	0x752b8be2,	0x3d00a5bc,	0xe6f70e95,
-0x44447ac8,	0x600df30c,	0x8335ac3b,	0x8816ddee,
-0x700982fe,	0xee495741,	0x48c7e81c,	0xa3d55da2,
-0xb0172982,	0x70ab2158,	0xd4460621,	0x3a9e528b,
-0x59b18a7b,	0xf4dabc4c,	0xa8454763,	0x70877bb6,
-0x66005c97,	0xaf292c06,	0x7b843db1,	0xf343b59b,
-0x25cdc7b5,	0xa41da617,	0x9e9d895e,	0xc936f475,
-0x7270925a,	0x30024230,	0x8e72f53d,	0x2b6c1b6f,
-0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,	0xaf377cc1,
-0xbff09a78,	0x4b4e0814,	0x95a0b2c1,	0x270398de,
-0x201fca94,	0x2a032a4f,	0x131542b4,	0x0d7306da,
-0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,	0xa3b3a991,
-0x17ee60c2,	0x852c0b8d,	0x11e5853a,	0x762002a7,
-0x92c5311d,	0x0d4bf7e1,	0xfffec870,	0xe3d35e5b,
-0xff6ecfb9,	0xdedae6ff,	0x0111a772,	0x9808e780,
-0x29c336e8,	0xe9bc05df,	0x5bedde11,	0x945565af,
-0xaff808fe,	0x87e3423d,	0x4de6f98f,	0x93b4adef,
-0xbf704fa4,	0x09120e91,	0xd54f3692,	0xdf8eab1e,
-0xfabbf59c,	0xe74318be,	0xaab87ffc,	0x29fa791c,
-0xe3915552,	0xa652cb9b,	0xa1252e74,	0xb35b723b,
-0x542aa28b,	0x12fcc5b0,	0x3941f962,	0x82bcc6cc,
-0x47b11974,	0xb821611f,	0x78b34250,	0xf1be5659,
-0x561b9e61,	0x6f3bd501,	0x584e6f5c,	0xd54ed547,
-0xacebcd21,	0x7b5ff816,	0xb64ad233,	0x9f2f330d,
-0x69fb1ece,	0xac8710dd,	0x58dc6c60,	0x9bee6139,
-0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,	0xa733274f,
-0x884d9b55,	0x42b08b63,	0xafa54a74,	0x1c7ccf64,
-0x93a20191,	0xaaa3132e,	0xc69831d1,	0x54634889,
-0xfbfe3efc,	0xd3cf68d4,	0x302e3117,	0xf5693131,
-0xc3ce8c6c,	0x1f03cd89,	0x6243334c,	0xf16bc80f,
-0xdca5f130,	0xcb2cd956,	0x4c1bb421,	0xe8de533c,
-0x7f86703a,	0x29aa897e,	0xdd54acad,	0x76b2f2ae,
-0x7ef82b71,	0x2e30970b,	0xba402597,	0x9a653ab4,
-0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,	0x2363d147,
-0x5327289a,	0xe89229f3,	0xd63a535c,	0x7efe9273,
-0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,	0x1b9c7bfe,
-0x5d14b3de,	0x54d575fb,	0x6d65db4c,	0x95648b7f,
-0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,	0x8488a45f,
-0x8ebc2932,	0xd4767316,	0x3e8c4b8a,	0xbab7402c,
-0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,	0xc88528e9,
-0x4b2e4e8f,	0xdd938b86,	0x0c964f98,	0xfc88d480,
-0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,	0x4d40b3b3,
-0xcf203155,	0x0d2fa621,	0x752d2c58,	0xb12bac12,
-0x1e7e8c23,	0x94215d54,	0x9854a71c,	0x4de63c64,
-0x7a012529,	0x9c171f8d,	0x9e71def7,	0x3bd17d50,
-0x11f175d9,	0xec78abf3,	0x7b529eee,	0xd3a69fc3,
-0x5b718676,	0x58214d29,	0xa8bd2c34,	0x41ea00ab,
-0xa03f64d6,	0x4ee342b0,	0x32b1e444,	0x1c1801a4,
-0xc8424702,	0x334a7e35,	0x50cf1543,	0x3b22b495,
-0x88683776,	0x8e2e0154,	0x6155c033,	0x4e2fa6ac,
-0x42ace700,	0x8d64f97c,	0xaf9ced17,	0xb2a5cb92,
-0xa558582d,	0x88705de7,	0x9e528d59,	0x84bd45e4,
-0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,	0x10462123,
-0x30080f7d,	0xb346cd81,	0x0049c396,	0x4e24165f,
-0xa7c66809,	0x2e60bdcf,	0xaad70a08,	0xa73ea713,
-0xe28f97a7,	0x283a9eab,	0xd4366489,	0xe776f963,
-0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,	0x3bae5f6d,
-0x8d2bbef1,	0x7e9181e6,	0xf06aa121,	0xd06b2d20,
-0xa83ea826,	0xef935e4f,	0xdfd27456,	0xa3451468,
-/*  386-MU16600a.inc  */
-0x00000001,	0x0000000a,	0x05051999,	0x00000660,
-0x05b795f4,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x4cce67de,	0xa5bf8c3f,	0x32a4809d,	0x834da372,
-0xebefca4e,	0x2434e86d,	0xfd5a5db8,	0x8e6b398d,
-0x55992335,	0xa4332cb1,	0xb83d2dc0,	0x5cf2827b,
-0xc60d321e,	0xb810d991,	0x10bef54b,	0xa78c0441,
-0xe4e17eac,	0x286b11d1,	0xa671919a,	0xd250d9c4,
-0x379ee265,	0xc2839bcb,	0xf856f68a,	0x2e7a8104,
-0xda21efb6,	0xccdb7c08,	0x2c02f111,	0xfa6d54f5,
-0x94ba6c6e,	0x2f1e8d3b,	0xff31de8f,	0xf0eb4e4a,
-0x5ef28f35,	0x80e05fd5,	0xd7b633ca,	0x51eb2ac5,
-0x97ed41ac,	0xc05679e5,	0x79080c9e,	0xb9d1aa9a,
-0x92ae8b93,	0x5d309b94,	0x94462097,	0xab6cc687,
-0x14d3570a,	0xf71b9f19,	0xba5782df,	0x767bb600,
-0x8ce6d620,	0xbc378afb,	0x0421dd6a,	0xfd2ce01c,
-0xea774aae,	0x7f59277e,	0xcc25d565,	0xf43bc0e0,
-0x4bad25ad,	0xf5881f9c,	0xb08fcd01,	0x2ad9861d,
-0xe6adc0dd,	0xa7a986b7,	0x475fb8ef,	0xaa145653,
-0x8c255f6a,	0x7bdc94c9,	0xb4190639,	0x9c2375e7,
-0x4339888b,	0xe3c7bae1,	0x885d7df1,	0x5e66da0d,
-0xcccb82eb,	0xeecc36ea,	0x260cfc25,	0xfec3a6f3,
-0xf090487e,	0x369a58cb,	0xc73ebd0b,	0xe53b8eeb,
-0x5cc40a0e,	0x838f0ef8,	0x8465b6c5,	0x72892bfd,
-0x84fd5959,	0xa3546de5,	0x754bd7b0,	0xc033d6ca,
-0xfe244df9,	0x64d5f3bc,	0xd85fee9a,	0x904169d0,
-0x24143452,	0xe41530fe,	0xb5ad3d6a,	0x5f17b744,
-0x8a8bd14c,	0x97e3c34d,	0x7f859df5,	0xcf5f5ee3,
-0xbea2e386,	0x19eecd45,	0x89bad6bc,	0xbbae906a,
-0x78d839f7,	0xa7b9cb2b,	0xb46b1935,	0x75181e1b,
-0xea49e613,	0xe9584bc5,	0x33c0e65a,	0xfe24a9c8,
-0x98ffa853,	0x41c32d55,	0x8e17f7fc,	0xe65d6dfb,
-0x6e39614f,	0xf9ca105c,	0xc9ce257b,	0x0c75a137,
-0xabbc7e07,	0x8857f4d5,	0x1473c95d,	0xa8666dcb,
-0xf9ef2a6a,	0x77d6e876,	0xec079135,	0xbcf41ae9,
-0x05d3a1eb,	0x9e17f380,	0xc4d7fb7a,	0x17d0a44e,
-0x84878cf6,	0xfb7de61f,	0x488930a8,	0xd84d601a,
-0xb0f12609,	0x1292c5bb,	0x9e9af007,	0xb40da879,
-0x6d28dac9,	0x87b9dfde,	0xdf0a960c,	0x520e698e,
-0xb3dedc2d,	0xd05b3e4f,	0x1ed592cb,	0x9197efc4,
-0xf62b2b8f,	0x09c440f2,	0xea8c3f00,	0xe2755129,
-0x19c1a016,	0xbbf776c4,	0xad622a16,	0x0c474162,
-0x99b8c2b5,	0x86ca4635,	0x34c1942e,	0x9989309b,
-0x9976d3a0,	0x5217db64,	0x802afec6,	0xf606b06d,
-0x30d7019f,	0xf5648b65,	0xc710830d,	0x3b24b040,
-0xa552be27,	0xf7225873,	0x4502fca7,	0xb15183a5,
-0x9ccc29df,	0x96f66773,	0x18534ce5,	0xb15d8a7e,
-0xb8a2e9ae,	0x2491fcf9,	0xf58b364b,	0x7e96b5e2,
-0x108ef9ba,	0x370c5585,	0x2000847c,	0x4738ffe6,
-0x5c88c789,	0x73657dd9,	0x406f3d28,	0x0e33ea60,
-0x369376bc,	0x39b123a8,	0x6800959b,	0x2f3dea60,
-0x7aed7374,	0x0bfdb4e1,	0x00de8ee7,	0x036c11c1,
-0x77e82217,	0xc295c17c,	0x1a255852,	0xdaabd2c7,
-0xb54a14ed,	0x34338868,	0x82c38010,	0xe221b872,
-0x519bc47a,	0x3dd7df3b,	0x82d0f932,	0xd766c9c9,
-0x566ba389,	0xa994de3d,	0xe15e1bdb,	0xc3bdb882,
-0xa542a8de,	0xf7e32a2c,	0x93be1c7e,	0xf04633d2,
-0x809ded28,	0x35361629,	0x57e56e43,	0xa47e8434,
-0x965d1c9b,	0x7c6aed87,	0x7069f4e3,	0x9734a6e2,
-0xca52becf,	0x033b7c7c,	0xf33a503d,	0x641ab77b,
-0x23bf89fc,	0x21e85f51,	0xfbdf410d,	0x5e52b172,
-0xfa6b2b47,	0xbcb4e5a8,	0x00f51032,	0x3dc21da8,
-0x55021389,	0xb5c017ea,	0x46b898ec,	0x52cdb1bf,
-0x99f5f480,	0xf303a3de,	0x84e3c67f,	0x1b46dd60,
-0x141448a3,	0xb8b977ad,	0xe7996448,	0x1fa609a1,
-0xa9a00a94,	0x1fc40ca5,	0x5685ee87,	0x061c73dd,
-0xee71c124,	0xe4599538,	0xa8700f90,	0xf5a9849a,
-0x3effe339,	0x790e00f5,	0x6e3843e0,	0xd9301376,
-0x3b54bbd8,	0x79c68090,	0x1dd1fe0f,	0x02602b35,
-0xa20dce30,	0x7ec589db,	0x9d504ad2,	0x2cc84db5,
-0x8b6bb987,	0x4fa45bc3,	0x2dd5f507,	0xe0cd37f7,
-0x043e9d49,	0x7652025b,	0xb6a429a4,	0x36ac261f,
-0x08f1fcf9,	0x3219dad1,	0x70119bc3,	0xf977976c,
-0xe0872445,	0xca99977c,	0xee8b289e,	0x2a20923f,
-0xd79e0af2,	0x42cdc3c9,	0x8d9bfb8c,	0xe265681a,
-0x5b61b8ef,	0x6c01c84b,	0x3adc3209,	0x97e9f99c,
-0x74a22a40,	0x58e46eae,	0xa107ffa8,	0xbf1d7a89,
-0xa2bfb311,	0x3071e5cb,	0xb2eb522b,	0xce4fb5be,
-0x16b6e3a8,	0x6106458a,	0x966df562,	0xa0a3d140,
-0x4e19ec71,	0x334e9307,	0xef8f374a,	0x3918922e,
-0x0e1281f3,	0xbd554469,	0x8b640c00,	0xe57f20cb,
-0xbe6440d6,	0x357e4505,	0x6b1db1b7,	0xc1874c75,
-0x246891e7,	0xa57d794b,	0x2effd4c9,	0x99b64fae,
-0x7e140e0a,	0xfd65c2ce,	0xe16b33b1,	0x2e681417,
-0xfcf1624c,	0x869f843f,	0x21d8c306,	0xd6cff670,
-0xa123b3d3,	0xb6eba56c,	0xafcf5185,	0x83fa0a9e,
-0x746483ea,	0x63641749,	0x55ffac01,	0x23cfdf9d,
-0x250613fb,	0x5377d7e5,	0x35224177,	0x6407c393,
-0x00f2498f,	0x33f07673,	0x6f1046fe,	0xd53b87bc,
-0x50b01249,	0xe9ed1741,	0x31b85bd1,	0x6dd5c47d,
-0x125647fb,	0x45e9f7c3,	0x221ead49,	0x6d1d9d53,
-0x149a1485,	0x16b67287,	0x27649add,	0x9e2c04e2,
-0x71c3d5f9,	0x9c778341,	0x95bfda26,	0xfaf580ec,
-0x6ab88278,	0x5bb3cac1,	0xb9801ade,	0xaf4b6e4f,
-0xa1f18c51,	0x504012f7,	0xc20a2ae0,	0x7bcfc50d,
-0xb68245e8,	0x805052f4,	0x0ce09a23,	0x79005c46,
-0x3f15c5cb,	0xef6732ec,	0xd095debe,	0x3a2eae3e,
-0x24ee4a9f,	0xf16d102b,	0x27d9f8ef,	0x508a1c57,
-0x5ee61f2f,	0xdd958128,	0x7c759709,	0x2e18b30a,
-0x0c6ffe63,	0x2174596f,	0x5245b98b,	0x68b46e00,
-0xf097f744,	0xb3f02db2,	0x7241d709,	0x5d13fbf7,
-0x4cfdd101,	0xe84957c4,	0x7578803c,	0x31c402cf,
-0x1ce1eed7,	0xa1197a97,	0xb00f8403,	0x3a25e38d,
-0xb011b436,	0xe3538636,	0x7c459351,	0xb97bfe4c,
-0xa5f968a9,	0xc93d3bd9,	0xe5736542,	0x05d67655,
-0x489c9bd6,	0xd57731cd,	0xb3075b0d,	0x0b247601,
-0x47960987,	0xa5fe5782,	0xd387a40a,	0x2e29f2d3,
-0xd317fda2,	0x071ff98b,	0x2791e1b9,	0x8f83f16e,
-0x16ec3837,	0x66844598,	0xacde4baa,	0xaea64994,
-0x15765169,	0xa62c4e7e,	0x093a539d,	0x6cdfea23,
-0xe2b19d80,	0x4f729028,	0x758dc967,	0x70519d1f,
-0x3f3290e8,	0x2605f3ab,	0x08d67f03,	0xe6fd4ba4,
-0x931da42d,	0x1af05337,	0x632c6c86,	0xa9b3c1fa,
-0x493db7f1,	0x9f917e1d,	0xb8bd542f,	0xbf23f37c,
-0x89e7f900,	0x58a3bccd,	0x3cd1e651,	0x3ed0beae,
-0x56104447,	0x3137d4d9,	0xecc5656a,	0x94183130,
-0x02420ac9,	0xcdb38cf2,	0xbb11ca10,	0x212e4bc5,
-0x11a0b5b3,	0x5edbb0e9,	0x1a4666ff,	0x42224649,
-0x70e68a4a,	0xd4c595ac,	0xe8040d0c,	0xafd353c3,
-0x11640dfb,	0x71e61d50,	0xb80faf34,	0x4303e651,
-0xe405ea4e,	0xbe003b08,	0x7f3d868d,	0x17467335,
-0x345050eb,	0xd939f71e,	0x9e7db651,	0x0e08b6cd,
-0x6359df9f,	0x2f07f30b,	0x4dd66fd8,	0xb18b789d,
-0x02da044b,	0x893e6d58,	0x6764969e,	0x77f1cf45,
-0x5019e0fd,	0x8303c5bb,	0x9261e436,	0x662be487,
-0x0efcafdf,	0x5bda8102,	0xce198c62,	0x13083943,
-0xc4f9a736,	0x2a9acd22,	0x5cf660f4,	0x0a2c6979,
-0x54265d72,	0x7072852a,	0x0f7475e7,	0x8f12704c,
-/*  728-MU168314.inc  */
-0x00000001,	0x00000014,	0x02062001,	0x00000683,
-0x0976fd98,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xecb2c3c0,	0x2f2f34ff,	0xf7f09bf7,	0xf73c6dec,
-0x5d5d0357,	0x35b7471f,	0xb9bb76d7,	0xca8f0786,
-0x865fde5d,	0xa0b56c34,	0x147ce4d2,	0x887513d6,
-0x341b2ea6,	0x13d1c7f9,	0x31df291b,	0xf8fa9c6a,
-0x7667e2e4,	0xb3af02ec,	0xa39a324c,	0xe5af95cc,
-0x15012f56,	0x4cead851,	0x81169c7a,	0xbabb599e,
-0x31bf0fb7,	0xba2207bf,	0x80ab0c02,	0x4e8794dc,
-0xe7e8bf7d,	0xd22029cc,	0x0e687b49,	0x2f6d8e80,
-0x57ac268f,	0xe309b495,	0x3aa2a1e1,	0xcc57e97f,
-0x8fa37b62,	0x1f735044,	0x2278d1c7,	0xe823c65b,
-0xe9dd8511,	0xf89d5743,	0x23e97687,	0x43ce8e2b,
-0x61f3e82d,	0xaa139876,	0x097eeb30,	0x6742076d,
-0x51761f35,	0x2a9edf6c,	0xbfb9178e,	0x58d479a2,
-0x8b73c7b1,	0xf208fb08,	0xef61b94e,	0x76915275,
-0xd38ea2f3,	0xa2e97430,	0x3caa8f8b,	0xe2e8d358,
-0x8b6073a9,	0x6de2d03d,	0xeb1ac52f,	0x3f6e4a64,
-0xdcd1e247,	0xadc6efd6,	0x4a3ca83c,	0xaf990f62,
-0xc1926a48,	0x71f368ae,	0x40d90f85,	0xc53f889c,
-0xb718c45b,	0x50becb4a,	0xcb3bdfcc,	0xb1f409e0,
-0xf82fcf13,	0x52d09c8a,	0xe6c32fd1,	0xecbaeb34,
-0x9f91fe0d,	0x67bb864c,	0x9008994a,	0x93bb80b4,
-0xc2ccdc09,	0x45bc872d,	0x17a59be7,	0xe1397edd,
-0x4b8d55b4,	0x5b0c3be8,	0x3d6b8743,	0xb518b764,
-0x4fa6b830,	0x831aac92,	0x7809a29e,	0x1f3d6b50,
-0x391a4d09,	0x95546b86,	0xf862139d,	0x99905866,
-0xe502c92b,	0x3baedc13,	0x9dfb6c40,	0xf405d944,
-0xd1e5db67,	0xb457ee4a,	0xf26946c8,	0x5dcd4b24,
-0x9636e6c5,	0x516b6b8b,	0x4a53b969,	0x78a6e461,
-0x3eca65cf,	0x8a839e5a,	0x1c52d122,	0x4abef8e9,
-0xb4ade44f,	0x372d8c0a,	0xb5d03cce,	0x1f7953b2,
-0xec4d8789,	0xa7ebf47d,	0x6f541a16,	0xe32b0e17,
-0x80eec93a,	0xc9e1c98f,	0x6ec7f6c0,	0x490b7bc2,
-0xd21810b1,	0x28dbdae1,	0x56015f0d,	0x0c501a66,
-0xd32d05e6,	0x9e1ccf99,	0x51cd8bc4,	0x054b30a9,
-0xcd2719d1,	0x050317cc,	0x50843724,	0x6c4f8527,
-0x4c156bff,	0x2969c98b,	0x907ef014,	0x604b7467,
-0x0f2cc314,	0x6ce6e896,	0xf30a75ab,	0x064ad5c2,
-0x7908978c,	0xf4b13439,	0xe1597cb2,	0x201443f9,
-0x93d8b45f,	0xa6351d99,	0xd2b63a84,	0xdd754e89,
-0x600cb59c,	0x1de6b866,	0x7a616644,	0x8008893f,
-0x31f36621,	0x03622d8e,	0xb2d6aaa7,	0x9096bc8b,
-0xeee48428,	0xde1ce3d4,	0x23079f86,	0xe413e3c5,
-0xd61a1fc2,	0x2ea4693e,	0x464f8149,	0x6425ef61,
-0x86d22b4c,	0xfeec7a8f,	0x9c43a3a3,	0x8b626e93,
-0x8af6b054,	0x5e23dcd2,	0x42588e0b,	0xdc877df4,
-0x99c547c1,	0x80e6e535,	0x04d360dc,	0x6a28a33e,
-0x688eaf7b,	0x8ee2635e,	0x4a81a8c1,	0xf65afada,
-0xc6553184,	0x28324872,	0x73f78589,	0x76c000d5,
-0xdcb279fe,	0xc6463a1e,	0xeb659f7f,	0xf75311f8,
-0xeb4b55d5,	0x4edb5c0d,	0x2b43e7f3,	0x2bc0a3f0,
-0xfbe0127e,	0xf76202ab,	0x7bf2a3a7,	0xbae3f575,
-0xce6725ff,	0x51feb2ab,	0x350951a0,	0x0a399b8a,
-0x33421704,	0x1adce9d4,	0x4215d302,	0x342d8706,
-0xd15c92fd,	0x86ac2b2c,	0xfe927dd9,	0x2849d688,
-0xfc8066d4,	0xd53b8c1e,	0xad2a7308,	0x291c1ec1,
-0xad4f142f,	0x1cca5898,	0xed2c3983,	0x5eb48da7,
-0x9e32bcf9,	0xab09c7e9,	0x5c224120,	0x5b3ad2c5,
-0xe060df30,	0x9e4f59f6,	0xa5499f2f,	0x2e33f375,
-0x08bcfb76,	0x3d1c8e24,	0x1ccdae98,	0x80d27375,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  551-MU168308.inc  */
-0x00000001,	0x00000008,	0x10151999,	0x00000683,
-0x2942e387,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3838d964,	0x902da5bd,	0x291242e7,	0x8b611e36,
-0xa1f50719,	0x04db741d,	0xf20fd434,	0x81bff663,
-0x55f9d881,	0xd165ba1f,	0x8273456e,	0x5ea792cd,
-0xb180dfd7,	0x8e132720,	0x5158a07f,	0x974c8cac,
-0xe985a9c2,	0x77116988,	0x9763ed80,	0xee285274,
-0x54ef293d,	0x82e07a61,	0xe206995a,	0x6a1ea44c,
-0xa048dbac,	0xc5079ea0,	0x6e98bb25,	0xa7fe9390,
-0xab8eb8b3,	0x676d95c5,	0xa3717b10,	0x88cbb1a0,
-0x063c9bb1,	0x8ea06eb7,	0x8a413fe1,	0x06cee3b4,
-0xa81517f4,	0x95969e5d,	0x0c461076,	0x9084e3c0,
-0xb1b2d589,	0x23f4d34f,	0x9f0f3310,	0xbc405c78,
-0x0a7f579b,	0x9387e317,	0x97f3842c,	0x21484298,
-0x92fecf31,	0xb5f1b4e6,	0x28d7a97d,	0x90028586,
-0x9fe33718,	0x29cd7b3c,	0xbb71c9a8,	0xbe74ac41,
-0x28c78336,	0x93a64453,	0xb6aa1d3a,	0x2fff3d35,
-0xb8819e2d,	0xbe096062,	0x08b9d869,	0x90246df3,
-0xb147c8ca,	0x2e71130f,	0x90c3d7fa,	0xb84820d8,
-0x0cfbb1d9,	0x90f2bf7e,	0x9c47e13b,	0x2388d7c2,
-0x94ee5ce5,	0xb080b40c,	0x2326bf4d,	0x9375a9a4,
-0x9ad8380f,	0x271f5e2c,	0xb5f1de30,	0xbdffd0b8,
-0x284ffe0b,	0x9409e2a5,	0xb3a58879,	0x28818b7f,
-0xbd91db97,	0xb2abf842,	0x0d2d2b0a,	0x91ecf85d,
-0xb91b2eb0,	0x2563e378,	0x9fa7639f,	0xbe81b8c6,
-0x0fb5ea70,	0x94f85ab0,	0x97953cc1,	0x2b3a73e2,
-0x975d8522,	0xb404623b,	0x207c3245,	0x946c9cf5,
-0x967675c6,	0x27aa8f92,	0xb8205a69,	0xb28fe6a9,
-0x289b3ce6,	0x93cc869d,	0xb1972934,	0x259f9f02,
-0xbea0891d,	0xbcff6fff,	0x07eaa51d,	0x9074834d,
-0xb66c1195,	0x22bf078c,	0x995420f5,	0xb7e4e440,
-0x03b6db68,	0x9256fe33,	0x908c92da,	0x23c2742b,
-0x994aef66,	0xb282f279,	0x2e621d6a,	0x955c0d7a,
-0x9a988b30,	0x29d7a2da,	0xb64a9f05,	0xb9fb5b99,
-0x28771440,	0x92ee3a9c,	0xbf3fc296,	0x21782c1b,
-0xbc2c0593,	0xbfd4f35d,	0x04cbbe43,	0x9fa34c64,
-0xbe07f147,	0x29732e30,	0x9f67c5ac,	0xb2e4b75f,
-0x04bc34ac,	0x9c9bbff2,	0x9ce62807,	0x2d049c9f,
-0x96c1a09a,	0xb19cd8b6,	0x220b181a,	0x982f6389,
-0x9070997f,	0x2796d439,	0xb15b5d2f,	0xb8cbd480,
-0x2505dfa5,	0x9eab7bc6,	0xb8804227,	0x21c365a0,
-0xb6ea7a60,	0xb78cc479,	0x0bd7cdee,	0x93bdaf54,
-0xbf06d0c8,	0x2efc2f14,	0x9c50bc3d,	0xbe061fc9,
-0x09b1d239,	0x9d108ef5,	0x93a927e3,	0x2de79820,
-0x97ff4ab4,	0xba26921f,	0xd2747084,	0xed133b6b,
-0x9074dc4c,	0x4e87f999,	0xd8a524e5,	0x03783ce8,
-0x4ad8decf,	0x4374b184,	0x0770df64,	0x519e3279,
-0x45c979ba,	0x1e7b128a,	0x65395e10,	0xa14f443b,
-0x21a1ba1f,	0x8ea82043,	0x8f410b31,	0x4118599f,
-0xa79dc4b4,	0x1ca5a94e,	0x496c8ea0,	0x54cd1f90,
-0x1950bd4c,	0xb7e041b0,	0x528876e6,	0xe4c1bbad,
-0xb1b9bd2f,	0xabd54c9e,	0xe99ab67a,	0x44016c9c,
-0xaecbb239,	0x140e16e8,	0xc2538565,	0xa6719fd0,
-0x99e70bf0,	0x3abdddbf,	0xabc89721,	0x8e1d1eec,
-0x393b9ab4,	0xb031b8d5,	0x8da9d990,	0x79ff13ff,
-0xb6d4035f,	0xcbaadfe5,	0x7bf570c0,	0x2e26f67e,
-0xc804d983,	0xebb4f852,	0x2e94f0ae,	0xc0764840,
-0xe575c6ca,	0x2206ad7c,	0xcdec956c,	0x591a50fc,
-0x2945c2ee,	0x758abe31,	0x581d5a78,	0x2edc794a,
-0x7d2f7b02,	0x53a4f6b3,	0x2a3d7cfe,	0xa0326a10,
-0x5c229fb9,	0xfaefcdd9,	0x468143c7,	0x0e2f860c,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  434-MU165140.inc  */
-0x00000001,	0x00000040,	0x05251999,	0x00000651,
-0xf400b4ac,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x978e6872,	0x4a954835,	0x53c01813,	0xdcaa7300,
-0xd8e79e18,	0x93eacfcb,	0xb49d8293,	0x171068f6,
-0x0697234d,	0xbc011718,	0x034c178c,	0x98c3d1c3,
-0xee0ec142,	0x4e179169,	0x8a456d4c,	0x15a3f45c,
-0x8ed57f11,	0x513f0ca7,	0x500b0ed8,	0x34fc5991,
-0x58614871,	0xe03c8839,	0x66cd82e3,	0xd86d4bf4,
-0x972e0f2b,	0x151eb98f,	0xcd569727,	0xe1da8c92,
-0x65b6f7ca,	0xfbc0307b,	0x204cc2d5,	0xa8cb450d,
-0x5aa46728,	0x107c287d,	0x6e52e62d,	0xf9c149b6,
-0x3d0985dc,	0xe8fbee2b,	0x7ce7f886,	0x8afb1cb6,
-0x9015e6fe,	0xf4aa5390,	0x7516d0b2,	0xeaf9dbfc,
-0xdab704d9,	0x695a8a53,	0x7565bb58,	0x496ed34a,
-0x25c25f1e,	0xcc9b0cba,	0x660cbd00,	0x6e929aee,
-0x57f34393,	0x624ff648,	0x80228d01,	0x72843de0,
-0xb1d435a8,	0xed3668d2,	0xfd8464fd,	0x31e001c3,
-0x759930ed,	0x9603c659,	0x400cfd6a,	0x5f419e25,
-0x4006fa37,	0x2e537230,	0x21353219,	0x84cbcde5,
-0x1782e581,	0xb88b9878,	0x34323718,	0x60a9a7bc,
-0x2e014802,	0x66bf4487,	0x0801c652,	0x27361269,
-0xa5311cb9,	0x658b21a5,	0x8c09eb3f,	0xe209566d,
-0x0898b464,	0xc4a7867b,	0x275b6344,	0x0153a992,
-0x4dfd837a,	0xf94d1c68,	0x40804d7b,	0x7edd120d,
-0xdfd143f8,	0x60487686,	0xed802dfa,	0x1a5f81b2,
-0x262fad43,	0x88fcb395,	0xf5c49176,	0x35e70380,
-0x242ea915,	0xaed8703e,	0x82606b9b,	0xdf7a6064,
-0x3c8f5acb,	0x22cf8e69,	0x6aba405d,	0xaed70597,
-0x3e789182,	0xbad3f3fc,	0x61c293e0,	0xdf0fe4e9,
-0x99574cb6,	0xc80a031d,	0x886a54a2,	0xeb22d96f,
-0x08b18717,	0x32b63fce,	0x258998dc,	0xa93021e9,
-0x2044456a,	0x6265412a,	0x6e1afa4f,	0x33756610,
-0x4e87c563,	0xcfc5e188,	0xea6b47ad,	0xf4618fd5,
-0xb0f3bfa7,	0xa1f6d887,	0x3fdb56e4,	0x19a96630,
-0xb4e75181,	0x5054b634,	0xb7b6da3f,	0xd46d4142,
-0x66500245,	0xfb8dab60,	0x4b61ac96,	0xe612ef3f,
-0x75b98baf,	0x2a555089,	0xbed7cfd0,	0x71e743fb,
-0x1dbcb21d,	0xacd80174,	0x30da97db,	0xae582b25,
-0x1afb117f,	0x6ace51d5,	0xd9a0e1e5,	0xdeffbb76,
-0x7f7f1890,	0xc7eaa76e,	0x7d325c0a,	0x036d7c35,
-0xfb182347,	0xe649a621,	0x749b62bc,	0xdd9caced,
-0x64313f94,	0x20660b45,	0xa2a5afbc,	0xdebcdf26,
-0xfde5cfce,	0xffd981fc,	0x9f933d4c,	0x1ff8e311,
-0x4ae23887,	0xe5921b7e,	0x5a93ac85,	0x46bfea57,
-0x1b608a97,	0xeb9fe397,	0xd831c985,	0x40bf1cd9,
-0x4de5b32a,	0xf06d3e3e,	0x36e0b4a6,	0x1e074f65,
-0x2faa9139,	0x0d27ac70,	0xe6c0c61c,	0x361d2373,
-0x1a4e0f0c,	0xd14aaf48,	0xcc3dd712,	0xb908cda3,
-0x524be3d7,	0xd2623839,	0x2fd3346d,	0xd01f5f83,
-0xea0196b5,	0xe38b8397,	0x28692010,	0xb145aa3e,
-0x332075f5,	0x73e29850,	0x160f25e0,	0xeba33412,
-0xbc7b06cb,	0x1db2194a,	0x0c7af328,	0xe438c0ca,
-0xcbf83d1d,	0xad264b9e,	0x6d59bc34,	0x56925253,
-0x478c85ce,	0x30e9ab37,	0x8f52dd68,	0xc3749bfc,
-0xefe408cd,	0xc0690548,	0xdbeef174,	0x4faa1b0c,
-0xf6cc7694,	0xec774556,	0xae02772a,	0x8e076839,
-0xe13c8a74,	0xb82a927f,	0x578e05ca,	0x0701f5ec,
-0x2b095f0c,	0x413ac09f,	0x274d4a87,	0x22412734,
-0x6b525b89,	0x9759891e,	0x137e11ad,	0xf31f8a13,
-0x7e763847,	0x74a68800,	0xe5d01275,	0x83c39d58,
-0x2a78a748,	0x26a368ed,	0x0ddc2775,	0x20282b9f,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1102-m08f2739.inc  */
-0x00000001,	0x00000039,	0x06042003,	0x00000f27,
-0x823432ca,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x0000005e,	0x96f952a6,	0xaa368f02,
-0x53d271e6,	0xf8286513,	0x484b4e9a,	0x9e0c09c2,
-0x03b11314,	0xdfb67c98,	0xa2957d16,	0xf07f25de,
-0xb84a2555,	0x72ec8b35,	0x3445c734,	0x7744f543,
-0xc3da0cc0,	0xeb36172d,	0x8b2cf574,	0x29c867a2,
-0xe79dfaf0,	0x54714bb5,	0x524dfb69,	0x0df65433,
-0x0b95ec14,	0x3dc09ca2,	0x584ba068,	0x2aa558ce,
-0x8cd679c8,	0x3b2609d0,	0xa06306d1,	0x80bfa93a,
-0x482678d8,	0x0cdf1ce6,	0x5ec4e912,	0x8a19f7a6,
-0x76f215be,	0x577d92c2,	0x479cd4ba,	0x63d1f415,
-0x5af98bc5,	0x8889bb4f,	0x8e70943d,	0xb5528299,
-0xfd63e347,	0x836fcfd0,	0x4951a701,	0xf4613cdb,
-0xaa7c2f52,	0xa0e290c7,	0xf646a80b,	0xda5b5a03,
-0x93517b47,	0x553d99d1,	0xafac198e,	0x486b6c6b,
-0x4efa01d8,	0xdc6ce226,	0xdac3a149,	0x9b7cf27f,
-0x6c6246a0,	0xb6055a39,	0xb68cc841,	0x87b6adee,
-0x1c36edb4,	0x3ee76d20,	0xdbffab67,	0xed12fda6,
-0xc1aff2f2,	0xc110932f,	0x0933ccfe,	0x58fa2281,
-0x285d5ec1,	0xd05b216a,	0x76315645,	0x570c5c8f,
-0x6cc52f1c,	0xaa977e52,	0x066f4e03,	0x812bfd2c,
-0xbfbfd7a9,	0x70828199,	0x60182af7,	0x2a04e000,
-0x30f413b7,	0x327cef32,	0xac73aa51,	0x7c418d9f,
-0xf493ce0e,	0x6c14258d,	0xa5e2755e,	0xd39f994a,
-0xee638b08,	0x55d50476,	0x9b7afc5c,	0x5da2ed13,
-0xb75bf9f4,	0x2606c01d,	0x8a1d00eb,	0x0f73428f,
-0xb29c4fb4,	0xac13e554,	0xa7648fe0,	0xbe56837b,
-0xd34fa9ff,	0x59c855a2,	0x7d3cc7d7,	0xb5b0cb50,
-0xe6626c0b,	0xf07010b7,	0xd8054587,	0x01a5327a,
-0x3ceae28b,	0xa3bf737f,	0x3d1a37e7,	0x6ce48d1d,
-0xc9d91222,	0x42f28fae,	0xe8dff3e4,	0xfd6898d0,
-0xe772ab47,	0xbe452c12,	0xf188ee09,	0x08edb79c,
-0xad4d48fb,	0x5cb75d1d,	0x251f4e02,	0x6b7bb6e3,
-0xcada2f09,	0x536d74eb,	0xacfa627a,	0x51e2ffd2,
-0xe4655767,	0x311dbbec,	0x1011b68a,	0x6f6e8deb,
-0x4298665d,	0xc0522b3c,	0x2c3a19dc,	0x2c48f2ae,
-0x49bca621,	0xb6a747fe,	0xa1606c81,	0x9b2a5318,
-0x0ac114c3,	0xb5b35aa0,	0x3f4ee00d,	0x8b427e75,
-0xb539fcd3,	0xa99fba84,	0x821fc647,	0xe0ac6d6e,
-0x912f6f88,	0xf2009cd8,	0xb32330b3,	0xd0b80514,
-0x6f25f157,	0xdba2f463,	0x88ef17d1,	0x147c5f21,
-0x6e29cd75,	0xec14e5d1,	0xdcfffd24,	0xccc2c510,
-0xe5e40798,	0xb24814e1,	0xaf0cdaf2,	0x825cf5e2,
-0x12acac6b,	0x439c5f36,	0x0c533619,	0x8e776e71,
-0x319b44f5,	0x19c0b404,	0x54111b2a,	0x6a767513,
-0xb16944ef,	0x30ef18ce,	0x85df0862,	0x0737ff49,
-0x77fe06f2,	0xb2de0d2f,	0x71625e95,	0xc722c5a2,
-0x03b401a9,	0xe8b030b4,	0x7f9e62ab,	0xbff8c966,
-0x726bfeca,	0x6adf3831,	0xab85067e,	0x5167e87a,
-0xb06ad00c,	0xdd974309,	0x5704880d,	0xb7279a43,
-0x38aeda19,	0x52f5a31f,	0xd66d79e2,	0x83dad3db,
-0xa138d066,	0x0b4674d4,	0x07e7dd7a,	0x7f5c70c7,
-0x4aade5f0,	0x4fcd220f,	0x2ae8ab6f,	0x6fb11f68,
-0xbf134ecc,	0x71d3125c,	0x3cc3f6ba,	0x92809507,
-0xb4a9b236,	0x97a2ef5f,	0xe20e5f23,	0x5610bfa9,
-0xad16eba9,	0x5207dfba,	0x0caa3d20,	0xc57cccba,
-0x7983d15d,	0x09ced949,	0xec698959,	0x53a4b153,
-0x63c74107,	0xacf58270,	0xbc2982cd,	0x42bf9c41,
-0x26aff8b4,	0x9832bd6e,	0x34e98158,	0x434f0f43,
-0xcb80ccda,	0xd81471b6,	0xbd176071,	0xab13735c,
-0x4e80e2c1,	0xcf7815f0,	0xb4e6ae37,	0x1a90c457,
-0x79426d6f,	0xa4ac1e2c,	0xf76de77b,	0x1808cd61,
-0xd72ea071,	0x1f02af0e,	0x9613b531,	0xe83f2e9a,
-0x99a5262a,	0x0e8a756d,	0xbc229ac4,	0x2cb1af6b,
-0x8a8720d6,	0xc84d2c77,	0x8547ad96,	0xeb794e72,
-0xb51119ea,	0x1c0121ea,	0x9f8ae83b,	0x16459999,
-0x5c17deaf,	0x278a3e3b,	0xf2bbb704,	0x54df1a00,
-0x521ef94e,	0xd40de734,	0xca5badee,	0xa2fe3027,
-0x2ffe3ada,	0x1df00fb9,	0x5feb168c,	0x81674308,
-0x99713c0e,	0x56aae017,	0xe62e68f3,	0xaa15163a,
-0x31ac7b10,	0xe6a86d9c,	0xa006782e,	0x9baefc91,
-0x111277d5,	0x80f63a4b,	0x624044d6,	0xd91a5de5,
-0x5d0255d6,	0x92b82310,	0x08faf5e5,	0xe482ff69,
-0x0a1f1757,	0xdc010e34,	0x9cd07e48,	0x677fcfa3,
-0x0384138d,	0xa104220a,	0x5431c7ec,	0x0e8b7efb,
-0xf1ebcd61,	0x97ae7029,	0x191ff006,	0x4308b147,
-0xa11e05f7,	0x2c7cb5a4,	0x1d345971,	0x28d23638,
-0xc5a7a5bb,	0x3307c971,	0x0d3782ae,	0x2b798842,
-0x1fc27334,	0x4ff82ddb,	0x543ba685,	0x47732c7a,
-0xad094a6e,	0xb8ff60e4,	0x43f9ee2f,	0xe9a114e8,
-0xf036be6e,	0x3fb488a0,	0x280b2d46,	0xb1887c58,
-0x54ae583a,	0x454b6ce6,	0xe617a2c1,	0xb9335ac3,
-0x72361e12,	0xc856637a,	0x741b6cbe,	0xcf1f6f25,
-0x9f405fff,	0xd2525b02,	0x22d8b05a,	0x16860f11,
-0xb02983e9,	0x388b9c2c,	0x196cb2f2,	0xfca5f1a2,
-0x9e60965d,	0x5bed99ff,	0x59e361fc,	0x9361bde8,
-0xa1527365,	0x3f300237,	0xb0f5e2b8,	0x8fb00a40,
-0x71cb9744,	0x3327e8d3,	0xe89994d4,	0x3987e389,
-0x28c6d8f7,	0xb2ba9fc4,	0xdf109e0e,	0x622634b2,
-0x4904a82e,	0x576c3c2f,	0xe95eae46,	0xfb773013,
-0xf98b91de,	0x4edc30d5,	0xc6e60080,	0xebefab96,
-0xd7684df2,	0x9cd2c3e1,	0xd433902a,	0x7b9aa9eb,
-0x3c99cbaa,	0x5a0fa53d,	0x77297830,	0x869db621,
-0xaee2d56a,	0x2ce907c1,	0x0aa5097c,	0x662e7862,
-0xa5bfbc61,	0x2610f3bf,	0x3a741865,	0x99a5836d,
-0x2e533e3b,	0x812aa485,	0x0d7eb66d,	0xb325db47,
-0x6ac77937,	0xa1757eb7,	0xb7765633,	0x8845f18f,
-0xde7e37f8,	0x08a17789,	0x8af720ca,	0x1f7a530f,
-0xadcbb072,	0xd02e2dae,	0x16fbe58f,	0x0e4df085,
-0x80663766,	0xdcff020e,	0x4c242d70,	0x3d16d122,
-0x154a029b,	0x40c95a2e,	0x5f98eb6f,	0x637ffc42,
-0xcdf10a5c,	0xf2211055,	0x998ddc8b,	0xcee90fd8,
-0x1ddc7fad,	0x7034d80c,	0xf5bf0592,	0x479205bc,
-0x0900e9c9,	0x7bef8c77,	0xc128cebf,	0x9e7dd814,
-0xedca7a5e,	0xf15af942,	0x40e55228,	0x065ea7ce,
-0x9603da92,	0xa6611211,	0xea9dad76,	0x4fd9d974,
-0xea19cb68,	0xeabf508d,	0xd460f6c0,	0x3951733a,
-0x249a4453,	0x04356966,	0xac6ec71e,	0x5253e669,
-0xfca78245,	0x8ef4d888,	0x6c031fe1,	0x8c49e3df,
-0x181ded1f,	0xba9a2a29,	0x3a350c13,	0x5fdb2e20,
-0x071f7766,	0x831b60a8,	0xaddc46d4,	0x73fc6685,
-0xf814b86a,	0x6b888864,	0xf1253cba,	0x64093883,
-0xd1f90479,	0xd99f2676,	0x143461f8,	0xaeb7d324,
-0x5971a5d8,	0xa97ecb22,	0x5a9f28fc,	0x0e474ba4,
-0x771e7b28,	0x09219fc2,	0xbe3153d9,	0x026236d6,
-0x44a0eba2,	0xd3b94e36,	0x405b5759,	0x209cbbb2,
-0x73194d9c,	0x82af6596,	0x735d2807,	0xfbc89223,
-0x683fbfe5,	0xd7e66cee,	0x3419b4db,	0x089456f2,
-0x756b491a,	0xfc12382b,	0xfce57feb,	0x0cf9d1e7,
-0x7a9bbe55,	0xb775f2f7,	0x7a7a7612,	0x92e21a2e,
-0xf6a87d8e,	0x84356931,	0x21f480c9,	0xef3a9505,
-0xf4b0cf63,	0x5098a176,	0x607856e6,	0x5ad0357a,
-0x18581ae2,	0x7a0d77cd,	0x2840e6ed,	0x5c26e03d,
-0xf05a2704,	0xc3faed2d,	0x8d7d9a09,	0x8a75f27a,
-0x10382097,	0x02f6c32c,	0x52d8b14c,	0x0b38157f,
-0x1f20300a,	0x47bb86f4,	0x298ce7a0,	0x5d2c8478,
-/*  885-MU16b402.inc  */
-0x00000001,	0x00000002,	0x01112002,	0x000006b4,
-0xf512ec8f,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x8d14e438,	0x725bfb67,	0x2d37e08c,	0xe7b19dfb,
-0x4c8d3c95,	0xffc6f57a,	0xfccb06b2,	0xc6e24fdf,
-0x1a3c7f2b,	0xa4b0a3ca,	0x09db4042,	0x61f7da54,
-0xf3aa8795,	0x7b8f1487,	0xecd5a1b8,	0xdc8c213d,
-0xcca7e859,	0xea53a869,	0x6029671d,	0xa2aa975e,
-0x5ad10a3c,	0x61dcc9e8,	0x6949a4d4,	0x114d569b,
-0xf3373941,	0x1c1838fd,	0xb175a480,	0x4f01d669,
-0xe91ced35,	0xe1d0c798,	0xc51cb3ea,	0xb1ca685f,
-0xa6d307d8,	0x4abbe7b0,	0xd37e4089,	0x43f218ca,
-0x2c775ea9,	0x3e312577,	0x948e06b0,	0x09cc6398,
-0x0f717e24,	0xac27b46c,	0xbeb41e37,	0xb6f8bcfb,
-0xe357533b,	0xe99f4a97,	0xb20b928d,	0xa3239533,
-0xd483e1ee,	0xbe688435,	0x11ce1bc2,	0xef04a8b7,
-0x10c9a575,	0xd74f47ec,	0x7e1caa09,	0xbdf4f1b4,
-0xbf14445b,	0x21b2f2a2,	0x63f32e79,	0x49df792a,
-0xd81e7458,	0x8d1996f9,	0x0ccd33e5,	0x907d96dc,
-0xd5b4ae37,	0xd743e460,	0x8d1eeb27,	0xbefe322f,
-0x84edfa2e,	0x94a23dcb,	0x5519aa65,	0x60fb77a8,
-0xfb3b499d,	0x5accc8df,	0x7e4fa2ae,	0xee70a051,
-0xa00e5234,	0x7411fac7,	0x9e3bd4ac,	0x8870b19a,
-0x0bf8210d,	0xa13413ee,	0xb18ccc76,	0x72217b46,
-0xbac79caa,	0x3c196591,	0x975b9d8e,	0x8750facc,
-0x4f4ba92a,	0x54a1c0e8,	0x2c30a8bc,	0xcb228a22,
-0x8a1a76a9,	0x20f0b73c,	0xcbf6d97d,	0x2c3d632f,
-0x487e9718,	0xdb39229d,	0x9dec941c,	0x857c67ac,
-0x3fcb6bed,	0x24b8a438,	0x19802922,	0x6e2ef495,
-0x2363800c,	0x8ed26f96,	0xe833a8b4,	0xf0f90321,
-0xeee74569,	0x6fe1b339,	0xb571118c,	0x96faaa1f,
-0xc0a5b115,	0xe0103aa4,	0x09679bc9,	0xe6c7ecc3,
-0xddd7fab7,	0x169d9eab,	0x46de7a6b,	0x8e62dc8d,
-0x0352127f,	0x9bbec1b4,	0xb4a22510,	0x06f94e5f,
-0xd7cc03d6,	0xb2e2c178,	0x8d8a48ea,	0xa089e856,
-0x6f2e29a3,	0xa6de73c0,	0x099bb823,	0xd642a2b6,
-0xd222edee,	0x4d618164,	0x8028d02a,	0xe7462bd9,
-0x993d5b65,	0x0d76b5b0,	0x20166d1b,	0x5000520b,
-0x2d1b6fc8,	0x417d7251,	0x7c13ac74,	0x1aac7da6,
-0xe3843e3d,	0xb76299a0,	0x9fb249c1,	0x4864d56e,
-0xe12eab25,	0x38ce3d26,	0xc0d5b8a5,	0xd4910b5c,
-0xbd428d74,	0x58ff0ae3,	0x78669ee4,	0x10471ff9,
-0x534e002a,	0xe1d8feeb,	0xf4feee35,	0x76f222b0,
-0x68c0270c,	0x0030d599,	0xd4241546,	0x8cfda1d1,
-0x3852f115,	0xd7fb3466,	0x58fe4578,	0x57038162,
-0xdb6dc364,	0x88baec17,	0xaf062790,	0xb70f6e83,
-0x73fd4542,	0x010debbc,	0xdd02bcda,	0xd7b44398,
-0xb2856418,	0x76aa8ecb,	0x72043c88,	0x00ba511e,
-0x58df48d2,	0x8a10f33c,	0x684fd7a5,	0x47f15765,
-0xe38065bf,	0x584d4eed,	0xa434b261,	0xc9254576,
-0xe10ff696,	0x9882bde6,	0xb0967eda,	0x8b12dd5b,
-0x1155b6a9,	0x679e8f2d,	0xe522ca3c,	0xff4432e0,
-0xf1172213,	0x540032ff,	0xeaa78315,	0x003217dc,
-0x96a5e987,	0x02d92ea1,	0x176db865,	0xbff26fc8,
-0xa1ed85cc,	0x8d1e3673,	0xaf598c4d,	0xbb472150,
-0xa522b7dc,	0x755194c6,	0x2cdafab3,	0x8ebd657c,
-0x6197fa59,	0x2ef39c18,	0x8f63f7e8,	0xf1cf5923,
-0x55e21350,	0xd44e22d0,	0xe134e739,	0xbd670fe0,
-0xe2685063,	0x6dae2e19,	0xfbce6e8d,	0x3d4fdea6,
-0xa7f23d9c,	0x1c7fe950,	0x2a23ef65,	0xf3f3a2f6,
-0xa3c1fa25,	0xc5b98bc7,	0xc2f482b2,	0xc7745101,
-0xfcf64472,	0x3f22aecb,	0x92018d3c,	0x24818346,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  409-MU16522c.inc  */
-0x00000001,	0x0000002c,	0x05171999,	0x00000652,
-0x05073130,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x73c82980,	0xf239ca39,	0x577aa64c,	0xa0357a54,
-0xa85ca5d9,	0x5d73bd4e,	0xc12fbb13,	0x7b099edb,
-0x701f7b54,	0x90af2bdb,	0x5fcea607,	0x07db24b4,
-0xda564ef1,	0xcee80b1c,	0xdc8dcb71,	0x173f79d8,
-0xbdc6d5d9,	0x48e69ab4,	0x6753f2c9,	0x9cf9970c,
-0x0a403a42,	0xd2382e59,	0xca8ff898,	0x3d816841,
-0x7290853d,	0xc3c48307,	0xdb774d7a,	0x7fbc8d7a,
-0x06b1a6af,	0xa35c358c,	0x087fd0a1,	0xab417c72,
-0xe7da5c66,	0x240e551a,	0x042223ae,	0xb694e434,
-0x759b9b2f,	0x56ea88d4,	0xd934d341,	0xcb2dc2cf,
-0x1b08897a,	0x16707fc9,	0x7eecaceb,	0xc4903846,
-0x22ab81be,	0x31d0ec20,	0x0a4d7075,	0x7786e56f,
-0x9d5a68ba,	0x40763174,	0x8547e000,	0xe9cc6f7d,
-0x17de3806,	0x5108956d,	0x641f656f,	0x50bd839f,
-0x5c868c4f,	0x32ffd4ca,	0x49abd852,	0x8a940c98,
-0xd152285a,	0x2c4b1d15,	0xa8a5038c,	0x9e40fd0a,
-0x9f390b45,	0x8048e88c,	0x0a5aace6,	0xdf3ad69e,
-0xa8c36431,	0xfe4d3a9b,	0x71246abb,	0x985871e8,
-0x21f0fb32,	0xb12143fb,	0x0a93b00c,	0xe552b0bc,
-0x3466e546,	0x333e61f2,	0x73664ac8,	0x18e813ef,
-0x8512375c,	0x9ececcf6,	0x47ce1e13,	0xcce8549b,
-0x1658234f,	0xde3bf1f7,	0x21039e31,	0xe78f0880,
-0xd03c5c4b,	0x61232c4b,	0x9fa52e27,	0x5acfd153,
-0x65dc9e3f,	0x89b63211,	0xb5d3625d,	0x8c1b7b53,
-0x8018a5bc,	0xaf2b81c3,	0xb1b7030b,	0xcedb554e,
-0x13c03adc,	0x4abf1ab4,	0x28f1f5fe,	0x27e0ab93,
-0xc12af7fd,	0x9c11405a,	0x02000363,	0x38d621cb,
-0x77c66630,	0xd559f56c,	0x3b45cc3f,	0xd83b44cd,
-0xb1660aa9,	0xb66b1a5f,	0x4518c35b,	0xfb44b10a,
-0xc3676b79,	0x85c43391,	0xb5e5bdc9,	0x1d5fa7b9,
-0xe1e5ec8a,	0x4e8fe9c7,	0x317c50ff,	0xa3b6bc8d,
-0x6ea00f2c,	0x82c56b9f,	0xc0786dea,	0x0f4b370e,
-0x7b9c5d13,	0x911629f6,	0x6612e1bf,	0x84f8f05e,
-0xbde37cc8,	0xa0e2dcbb,	0xc8f05727,	0x596bd491,
-0xb4013d53,	0x443bb9fa,	0x958ece18,	0x10cb627e,
-0x19b67554,	0xe0ceafdf,	0x27ef6f6b,	0x6203db81,
-0xcbc9113a,	0xeae9241d,	0x672f4296,	0x63eedef3,
-0x4aa96ced,	0x44b8fb78,	0x4237594e,	0x685439a1,
-0xba6a96e0,	0xea5e0639,	0x7cafe234,	0xc1561b9d,
-0xd36c4c33,	0x8669663b,	0xaddab12f,	0xa574cae5,
-0x94d9fcbd,	0x30d54321,	0xd89777ea,	0x9e485930,
-0x75608c5e,	0xa4b93f86,	0x0fd1de45,	0x8d768bd2,
-0xf47e7ea3,	0xae270b70,	0xc578ac27,	0x1779f283,
-0xf5069a26,	0x9d28afe8,	0xd339186c,	0x71c601cb,
-0xab018df9,	0x4636ca8e,	0xd5a480c4,	0x73866df0,
-0x1da8f538,	0x2b12eead,	0x3d36bc45,	0xcfc6a165,
-0xbdddc678,	0x777f7f4e,	0x33731adb,	0xafd30037,
-0x8b18c0fd,	0x8bd955f0,	0xb9532d87,	0x171d87a4,
-0x58b8a3a1,	0xd6c974de,	0xa0c30c65,	0xb830053a,
-0xe0ee7291,	0xe0717f2e,	0x8e60d0cd,	0xa5e91c02,
-0x7d04e220,	0xeb51f97e,	0x85d428cf,	0x028ee0c3,
-0xbe41cf07,	0xc097238f,	0x55d76112,	0x50542345,
-0xcdeeb808,	0x6d651c57,	0xb4ea4f00,	0xea30ac97,
-0x37b63fa9,	0xe66458ad,	0xabacf15f,	0xa656f5b2,
-0x3dcfee29,	0x27e70a8b,	0x2f3206ed,	0x0a1186c2,
-0x8cbaabc4,	0xfebf634f,	0xddd411d3,	0xa55cf4ec,
-0x5e97a778,	0x5b5540d7,	0x3c85634a,	0x0e9f9e35,
-0xee75a230,	0xa390c0e8,	0x9d7d633f,	0xb045a66f,
-0xa60e513b,	0xb6663504,	0x15861d13,	0x33dc9917,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1816-m22f6809.inc  */
-0x00000001,	0x00000009,	0x07142006,	0x00000f68,
-0x0d8bb650,	0x00000001,	0x00000022,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xba995672,	0x28c184bc,	0xc9f4197f,	0xa78abb23,
-0x93895bca,	0x87b86a7c,	0xff2beb16,	0x06f7eefd,
-0x8aa8c8bb,	0xaa7be533,	0x72e328a3,	0xb9f168d9,
-0x5b6104db,	0x2d06c654,	0xa2396a59,	0x68cf7257,
-0x299328dd,	0x82109266,	0x2d392ebb,	0xe2a2b7e8,
-0x4c5ca66b,	0x4d279736,	0x3dc87da3,	0x8a605dbc,
-0x5b32c550,	0xcb040d12,	0x9870438e,	0x8173bd32,
-0xa0038404,	0xa66ef1ca,	0x7d123ce7,	0x11153287,
-0xfaa50f5b,	0x908b5dd3,	0xd11629eb,	0xa8487d11,
-0xee26e9a5,	0x2b13e7ed,	0x238dbfc0,	0x00025dca,
-0x16a8c744,	0xb39c52cf,	0x38810ec9,	0xadf842e8,
-0xf3f84359,	0x2808d301,	0xcc2e88e8,	0xa70bd0da,
-0x6cf33ef6,	0xb62e5138,	0xcc17b7e0,	0xf39100c2,
-0x7b114661,	0x835b8b23,	0x02d3fb37,	0x75f167a2,
-0x15104aae,	0xe4d74ff2,	0xbe9c0618,	0xaeff5024,
-0xdf0fa668,	0x6e1f950c,	0xd424ee3c,	0x530595b7,
-0x493bd296,	0x9a47bf52,	0x528e965a,	0xf1a869ea,
-0xb51d0889,	0x5c31f5c2,	0xfcf73a56,	0x8870cf28,
-0xb0d690e1,	0xe4da0d6c,	0x974de456,	0xe70db8a6,
-0xd21a0c0c,	0x82cfb296,	0x777a6dbf,	0x500a4e9f,
-0x1a6d344f,	0xd833896e,	0x8df38cf7,	0x8d147af0,
-0xc2c080d8,	0x5f3c146d,	0x9afcd9be,	0x0b3e9e29,
-0x2e80e8be,	0xb81ad07f,	0x5b9c52eb,	0x9d1c5d45,
-0x3032f580,	0x16deb069,	0xee3700b3,	0x886bcd52,
-0x4c70bdb7,	0xba2cd82b,	0x42f87777,	0xc1dc3299,
-0x82e14d37,	0x88b68a59,	0x09d88007,	0x73d4b070,
-0x0d9695cc,	0xdf074428,	0xf1fbcf25,	0x87edb8a9,
-0x0343e407,	0x56f5e38c,	0xb576f3ea,	0x59b3a3ef,
-0xa0c9445d,	0xb87d6df5,	0x254c590d,	0xd66294cb,
-0xef30dab5,	0x7a2b6e23,	0xb98c1e80,	0xa5e9ed82,
-0x381e3ec5,	0xefdb0ede,	0x1f11131c,	0x9d9426e3,
-0xad11682e,	0x8f12209d,	0xc6eb1ae9,	0x31dc4a3f,
-0x4940f824,	0x8448c795,	0x876f536f,	0x9c095325,
-0x61a09af7,	0x00f04b50,	0x204038e6,	0xbd415dc4,
-0x0ca8e4d1,	0xa6ffad51,	0x79d1769c,	0x1a9a926a,
-0x644c26be,	0x8209dca0,	0x8f245c4f,	0x9dbf787d,
-0x626cb362,	0x04f227f7,	0x194e1e42,	0x30d8256c,
-0x8fe764fb,	0x882e351e,	0x0e8defae,	0xb019031c,
-0xdda5f11d,	0x05ce1899,	0xdc2b64c3,	0xafb791f5,
-0x55996c92,	0x89bd2bdc,	0xa8746454,	0xb5e786cf,
-0xc3f2594b,	0x94faccad,	0x2c903e1e,	0x3685f959,
-0x52c8ad19,	0x9f85c5dd,	0x414d7d9e,	0xab671d46,
-0xf8740d08,	0x3aa6606c,	0x14265b88,	0x00abd868,
-0x17240344,	0xa08717ea,	0x95834a6d,	0xa54bce2b,
-0xbff0f3b7,	0x0a880367,	0x06779160,	0xbc4aa0ea,
-0x6ee405bc,	0xa3d9a3fd,	0x2163ade5,	0x646576f0,
-0xa5558035,	0x84f90b5d,	0x5a1bd90e,	0xf7dc7796,
-0x067e92fc,	0x615f7ff5,	0x08bd57d1,	0x8dfbfe95,
-0x304e120c,	0xd1839527,	0xb1b2c157,	0xdff80f0b,
-0x5f0d3da0,	0xac56eda7,	0x1c68c6c4,	0x6da38397,
-0x909f5fde,	0xcd90ec2f,	0x9a705817,	0x8f507d52,
-0x3809b4fc,	0x409ebb3a,	0xee70bd63,	0x01c5f4ca,
-0x6a940843,	0x89b2e4d4,	0x4efc5a14,	0x822d9a19,
-0xe44cc23a,	0x1cc305a1,	0x7b52fbd7,	0xa9d1129c,
-0x001a66c0,	0xbf67ed43,	0xf1972f5b,	0x9307f38e,
-0x69a18d1e,	0xa28e3863,	0xa034a002,	0x248f9da3,
-0xd82b9d7d,	0xb22f2692,	0xcfda0bf0,	0xb3eed633,
-0x23ec414c,	0x210bcbec,	0xc32edb0b,	0x7e975e0c,
-0x35461e7c,	0x8f6d135b,	0x1e10f68c,	0xeed9332a,
-0x6f00b558,	0x5dc663ae,	0x7bd84e1f,	0xa3a22a77,
-0xe149e7b1,	0xff5c7459,	0x139e6185,	0xc89f98f7,
-0x9a1fe07f,	0xbb6579d0,	0x8901c533,	0x59035aa5,
-0x2a0d9bd5,	0xef6107b5,	0xaa4ca7ff,	0xb3a7b0ae,
-0x1840527e,	0x4c242dfa,	0x6bc47a21,	0x02d29df1,
-0x0b30e397,	0xa34d2948,	0xa0eea27f,	0xa2ce0c76,
-0x8d3fe74d,	0x12dab410,	0x1ff015f7,	0xb98709c4,
-0x70312242,	0xa7bac1b1,	0x18000444,	0xa2a3a2d4,
-0xfb85ffaa,	0xa43c1b1f,	0x7ce2cc34,	0x3ea2fd86,
-0x5f2d9c32,	0xa25ccaca,	0x50546c4d,	0x9a9c61a1,
-0x54b3f653,	0x2c2ddf22,	0x436878bb,	0x5e6416ce,
-0xe5290563,	0xad5b9b97,	0x2db27a4c,	0xcf9d7e5e,
-0x4a2093f2,	0x4592666b,	0x6b69a07e,	0xaf23440b,
-0x1c714911,	0xcb8292e1,	0xe89dbb45,	0xb0fd0750,
-0xfab66e40,	0xa5b8aa2a,	0x57fc427f,	0x120d98b2,
-0x08a55b75,	0x923408fa,	0x5d3784c8,	0xaeb34b6f,
-0xe92e2918,	0x39f504d9,	0xdec51666,	0x2ecd8903,
-0x4514dca9,	0xb2935c5e,	0xb89256aa,	0xa4d77796,
-0x19f7961e,	0x2d31cc39,	0x32ad7c50,	0xabf73d8e,
-0xa26864e4,	0xa6f99d23,	0x7cf19061,	0x6c7929fa,
-0x3942644e,	0x8deec981,	0xb5ff6901,	0xd0f36021,
-0x228044fd,	0x7312cedd,	0xb841750a,	0x993cf6da,
-0x48f03def,	0xe38c45ee,	0x8c9a2a01,	0xf4d30a1b,
-0xf54afa18,	0x81eae3ab,	0xdc7bca06,	0x7fa69138,
-0x258baf33,	0xcc9dd1ed,	0xcaf1f8d2,	0x916230bb,
-0x951cc5a1,	0x75165ee5,	0x8bfbf6b9,	0x55d1ead3,
-0x65c25cf1,	0xb32090db,	0xe069be83,	0xf5f54582,
-0x83f2a9e3,	0x76f4c74a,	0xb7379e27,	0x8addb6ea,
-0x10a3a6d1,	0xf2db1921,	0xc191c6f7,	0xa750fe85,
-0xc00ba5e7,	0xb5577ae2,	0x4534f370,	0x1a785752,
-0x263c1700,	0x97b5a0be,	0x40b648ff,	0xaae49c7c,
-0x63b1139d,	0x12f00964,	0x6cfbbfec,	0x6fb1b101,
-0x75d93d31,	0xb3c17407,	0xeb0ed03a,	0xf9aa97b7,
-0x85397fbf,	0x7082ddf1,	0x6e0640df,	0xbedfc8ee,
-0x293a8d17,	0xcb43bfec,	0xfa521d52,	0x948873f7,
-0xea73c61b,	0xa7949743,	0xb110ac62,	0x07d5e084,
-0x6610a3e4,	0x8cce6ba5,	0x928a7640,	0x82eb2aa4,
-0x97a034ca,	0x1b236d9d,	0x7edc408a,	0x25afb610,
-0xc487982e,	0xa962df87,	0x15825a93,	0xbc3fa026,
-0x0164b72f,	0x16ce606a,	0x76c4968e,	0xaf1c8c2a,
-0xa9bc5acc,	0xabb11559,	0x00f7baf3,	0x897dcfe8,
-0x10996229,	0xa6f15552,	0x9fdd1eda,	0x23a28e76,
-0xbe9d5cea,	0xa08a628b,	0x66ecce13,	0xa8cc9081,
-0x83982759,	0x29fad5d9,	0x1a00ff8e,	0x284244b8,
-0x7038ff57,	0xb15f3f81,	0x180a19e5,	0x9ba3e98e,
-0x2fbab9aa,	0x39892bdd,	0xf6500c7f,	0xa17ca618,
-0x18fca0ab,	0x9d69014f,	0xf0f1c3a6,	0x984904fc,
-0xe9c30749,	0xb3b5bff7,	0x700646f1,	0x3ce7ccff,
-0xaecf47e2,	0x98787665,	0xa8c09efc,	0xb1a0d93b,
-0xbbf3186e,	0x28343060,	0x38dbe56e,	0x58338390,
-0x67b28faf,	0xbcafa8f3,	0x409d36ff,	0xc80d85cc,
-0x74f249d8,	0x41c88488,	0x910e6b01,	0x90ed277e,
-0x2d59c63f,	0xdcae8c9c,	0x6d82a464,	0xd6d25a51,
-0x786859a3,	0xfde4761c,	0x5c57a9b8,	0xe78f7a37,
-0xadc69a95,	0x76a8f58f,	0x5ea2f59a,	0x4c0b3723,
-0x28277aeb,	0x1bea363d,	0xddcee7c6,	0x5ccc2ce6,
-0x697a2c46,	0x08073e08,	0x623c5fc7,	0xbb4942b1,
-0x498e8f68,	0x0d7c8b28,	0xd264aae8,	0x39b64ede,
-0x9584bbcc,	0x9e4f2ffe,	0xd3383045,	0x49c54b0c,
-0x577e9734,	0xedf3bbf8,	0x399f44e4,	0x4a2a9f09,
-0xc7411cfe,	0x78233a8f,	0xf93b22bb,	0xd30681ed,
-0xe8a829e2,	0x70d06f05,	0xde8fd65c,	0x05336d6f,
-0x9272d6f4,	0xf5fcc2df,	0xe1ca2877,	0xbee75be6,
-0xddc0ac3b,	0x300b45db,	0xdcfd4c06,	0x3d132a31,
-0x6a57f45c,	0x44de22a6,	0xef3d8ffd,	0x63907f2c,
-0x93d7c98e,	0x35e8ebaa,	0x17c3e52e,	0x7241ea30,
-/*  612-MU168608.inc  */
-0x00000001,	0x00000008,	0x05052000,	0x00000686,
-0xea2b7b61,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x38709a5e,	0x7cbb9fcd,	0x46f2975c,	0xdf0a611a,
-0x454f553d,	0x4dd783fc,	0x38b72f92,	0xe6cd7f96,
-0xf57804bd,	0xf12c0d73,	0xafa105a2,	0x74073ece,
-0xfa02d788,	0xd8a7bdd3,	0x2471c214,	0xcdcf7014,
-0x0e6e693c,	0xbafbc7c1,	0xd765a8ca,	0x65b6cc40,
-0x2ed8a24a,	0x2c1fcf0d,	0x7d73ba93,	0xcf0a98db,
-0x3caea0c2,	0x49e601d9,	0x936c2fef,	0xc87dc94d,
-0x1fef698e,	0xda05fa7b,	0x204f5b4e,	0x441cedfd,
-0x09f63dcc,	0xf7cc7654,	0x2b69ecf9,	0x495d0ef9,
-0x7679dac3,	0x7a4c0547,	0xb7adeed9,	0x29053d15,
-0xcf0b21bd,	0x77204452,	0x99ba650b,	0x3d19d146,
-0x150b0f41,	0xd7b5238f,	0xd02a8165,	0xd1270d1d,
-0xf6d102bc,	0x198ab690,	0xed878dbf,	0x34c2ec98,
-0x4c9bee07,	0x66ec11f1,	0xaa5202db,	0x4d2f2fc8,
-0x4ba8194b,	0x569fbee6,	0x9016ef51,	0x8fe4062c,
-0x90148cec,	0x5be3ddc4,	0xf04ff2c4,	0x5de8d897,
-0x09b1d0b4,	0x9f83a4f7,	0x0cf74fdf,	0x3c02a388,
-0xa2045a65,	0xbe469468,	0x03e4c532,	0x5f14280e,
-0xb384e96b,	0xfdce24fc,	0x2458e3ea,	0x169dbd24,
-0x71c8b3f3,	0x67e019af,	0xcda860c1,	0xe279acc0,
-0x6bc10e92,	0xe51258ec,	0x4630c6d5,	0xfc260a15,
-0xca8197db,	0x30aefd93,	0x789a7c9f,	0x1dbd5410,
-0xd4e1c7a1,	0x309e8843,	0xd47f27ab,	0xf0c4a0d6,
-0xe30a1e06,	0x3056c766,	0xb45c4d62,	0x3b8a2d43,
-0x0b013cdc,	0x8b2163e8,	0x3027cc1b,	0xe4c4db4e,
-0x89a26935,	0xaeab01f3,	0x46406071,	0xfe9ca870,
-0x73c6b8e0,	0xd55517a0,	0x40672814,	0x28d9e205,
-0xfd23b70b,	0x885e72ed,	0x41861524,	0xeb7f77b2,
-0xea826a61,	0x06a47055,	0x83d71cfc,	0xb6b5cbb6,
-0xeea709e3,	0x25b910bf,	0x64ef9e5a,	0xd048a5a3,
-0x0ecae00e,	0x216700b2,	0xf51cc285,	0x107f4916,
-0xb390e89e,	0x07efee47,	0x8eb3d423,	0x151e4c0c,
-0xab7ebbdc,	0xe471757b,	0x717f586b,	0xaacd6c2a,
-0xa0c63ad6,	0xde1feca6,	0x234e73d8,	0xfc302a04,
-0x4119848a,	0xbc8c78d5,	0xf3bb6d22,	0x2adc091b,
-0x3d6a50a6,	0x80d0806c,	0xe775d1b9,	0xa398ace3,
-0x47a09e7d,	0x82e43ac0,	0xb3ae0953,	0x9e953074,
-0x4964b471,	0x4a8bb0fd,	0x9e6a6e8e,	0xee971884,
-0xc7f2e4cc,	0xdc1b7ff4,	0x0ba3d273,	0x7d37c53c,
-0x27554173,	0x7865dc77,	0xb24f15c5,	0x90c00d9b,
-0x0ddd4024,	0x65050eb7,	0xf833936d,	0xe93cd40a,
-0xe31dd31f,	0xc990cca6,	0xaad5564a,	0xcb6c45b9,
-0xb1a6ef0b,	0xbac07112,	0xddbe22b2,	0xa01f1135,
-0x0562493a,	0xb3f2f526,	0xd414512f,	0x5d945ebe,
-0x0a8c95f1,	0xc214aa4d,	0x5006a179,	0xdd57b9bf,
-0x92cc0d68,	0x29556e76,	0xbe68e6a4,	0x5dd7cedc,
-0x2606954f,	0xb1168ed2,	0xbc7f4b32,	0x1cd43eee,
-0x7f7e1f59,	0xdacd550e,	0x8e7c4adb,	0xd1b6af9e,
-0x4abc5f32,	0x81181214,	0xc364896c,	0xc56c4a08,
-0xd56aa244,	0x936f0be3,	0x3d0c967b,	0x1578d76a,
-0x7cb10003,	0xdf0e8bad,	0x24bc9534,	0x4fbf3524,
-0x7052039c,	0x6edb0691,	0x2f10c885,	0xd5adb704,
-0x11ff9b52,	0xd6614cf1,	0x1ab2b79f,	0x9c4e93f2,
-0x49e3431c,	0x6b80635f,	0x233912ad,	0x05168de1,
-0x79e18bd7,	0x4d9d0ce4,	0x1e1d93f7,	0x041c93ca,
-0x7109b31c,	0x98af2848,	0x012fd82e,	0xc134e4b1,
-0x73cbf75a,	0xbc2ac259,	0xeb5f1138,	0xed0038a1,
-0xa75bbad0,	0x9698ef09,	0x37b21e97,	0xe7d971e9,
-0x3184de0a,	0x1d64395d,	0x005a6d27,	0xf26dfc59,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  401-MU166a0d.inc  */
-0x00000001,	0x0000000d,	0x05051999,	0x0000066a,
-0xbb94bae6,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xf98cb58c,	0xf8e34c9b,	0x9a83585c,	0x17590b99,
-0xcfc53493,	0x836f4a96,	0x67f4ce01,	0xf4c650a5,
-0xbe7e43ed,	0x4fd5a804,	0xf214c3ca,	0xbdc6d158,
-0x4e6a28c6,	0xd9efd75b,	0xefcb715b,	0x5596eee6,
-0x8138ddf8,	0xd04c7f6f,	0x72f449c1,	0xa11e07b1,
-0xf0219ce4,	0x44120d45,	0x9d8bb862,	0xca6839ef,
-0x785b4174,	0xb1771be4,	0xf3b2f061,	0x5f013a5d,
-0x8975168d,	0xd3ceeee2,	0x5917e02f,	0xb577c84f,
-0x96f5525f,	0x64384565,	0xf9a4f42f,	0x99450ef7,
-0x255e1f35,	0xb96bade5,	0xbf46da06,	0x6ebe8d43,
-0xdfce4d6c,	0xb43849bc,	0x63fc13d0,	0xd12e4a9c,
-0xff549463,	0x6261160d,	0x9e6aec4c,	0xd78c76a0,
-0x60894bad,	0xb7d60ed4,	0xd851d683,	0x6f36e6a4,
-0xf2dfa83a,	0xda86c5a7,	0x20466088,	0xd9584bb9,
-0xddb2f004,	0x03ffa24b,	0xdc7d5080,	0xda1b66ca,
-0x44bd49b9,	0xd887e55d,	0x98230b4e,	0x643f54b1,
-0xd75b6f46,	0xbbb7afe7,	0x659761e5,	0xd841dd93,
-0xfa74ad9c,	0x63d43828,	0x9d12781f,	0xd88c6120,
-0x64311175,	0xbc633234,	0xd1a2de89,	0x6646226f,
-0xf9a69f9c,	0xd122c0b2,	0x21059d21,	0xd84d2aab,
-0xd1020ed2,	0x03550e7a,	0xdc8d15fe,	0xd1302d28,
-0x48d1cdbe,	0xda8a600e,	0x977918d2,	0x6a8923e6,
-0xd29281a5,	0xbe794a67,	0x6e08c98b,	0xdba8ba3d,
-0xfe5676d7,	0x6a5edef2,	0x9ecd0698,	0xdd1f5c8a,
-0x6804847e,	0xbc7a64d5,	0xd098bb85,	0x6c0184f2,
-0xfe734948,	0xd67dc462,	0x27156111,	0xdd05dabd,
-0xd860b2a2,	0x0a9269e4,	0xd76fce34,	0xd4dcfefd,
-0x4f8377b2,	0xddc2e081,	0x9f6f47d0,	0x6b90d56f,
-0xd175a856,	0xb2699bae,	0x63339eed,	0xd44f87f8,
-0xf967c3e2,	0x60ca74e0,	0x9f414eb4,	0xd81dd3fc,
-0x6a74ea09,	0xb116cbe0,	0xda00af62,	0x69b5f577,
-0xf281002f,	0xd3f01bdf,	0x23fdddfd,	0xd8502b48,
-0xdb19dfb8,	0x049ea37d,	0xd4feaca5,	0xd4d899db,
-0x49089ace,	0xd043ba71,	0x9ea0664f,	0x66e79d5c,
-0xdb834bdd,	0xb03f29b3,	0x65678c33,	0xd72c89d3,
-0xffa17c2b,	0x6e3563b9,	0x9f5a3fc8,	0xd6451f32,
-0x6d4808dd,	0xb4eab099,	0xda846cbb,	0x67e8563d,
-0xf081a73c,	0xd102f387,	0x2ae35611,	0xd6911a2e,
-0xd65ede54,	0x0ab85a57,	0xdea46bac,	0xdb39c874,
-0x4a61ffee,	0xd4405144,	0x9134e1ef,	0x638bb72d,
-0xdf219a3e,	0xb54a59e2,	0x6f24712a,	0xdc311585,
-0xfc33d659,	0x6bc88815,	0x970ba24f,	0xd46e58a2,
-0x685e4b19,	0xb71c790b,	0xbdd49fef,	0x9331b0bd,
-0x6aaf8043,	0xd27dda73,	0xb5bcfd6b,	0x6f021da1,
-0xd6797be5,	0xb049884c,	0x651d75d9,	0xd3b8e79b,
-0xbde67aa8,	0x6898134e,	0xd1ef428d,	0x43f0276e,
-0x6b1ccad8,	0x2f5d0470,	0x6ea98b5b,	0x816f7a52,
-0x0a8117d2,	0x885b127f,	0x89ef8b1e,	0xeae19c5b,
-0x8d3424b1,	0x6a847189,	0xe8cfdd5e,	0x65edb529,
-0x6afbd40c,	0xfccb5463,	0x65fe313f,	0x99b34252,
-0xf58115ed,	0x6a7188cb,	0x95600f1f,	0xaeb80763,
-0x6d16d13f,	0xc44bb6b8,	0xa2aab691,	0xc9d57050,
-0xcc63b3f5,	0xfb61657b,	0xc97b26f6,	0x36a6e2b7,
-0xf846a502,	0xc29b6e00,	0x7e21dd94,	0xf65cf6d5,
-0x8e6e9290,	0x77fb8077,	0x10e3d5af,	0xd6e64ac6,
-0x906e156c,	0x4d3b0efa,	0x0839de96,	0xfda92900,
-0x92df7861,	0x66182851,	0xfdd34871,	0xe0263245,
-0x6f3e8b65,	0x838dcb4f,	0x8715c68a,	0x9927f441,
-0xe0db9e74,	0x7bcda352,	0x9399462b,	0xe41bbedf,
-0xe17beed2,	0x1910e614,	0x4b547390,	0x8f9d9f91,
-0xb525c77e,	0xc3bb9156,	0x322bfbff,	0x20488d87,
-0xec17a2bc,	0x5ef1b557,	0xd12b8fc4,	0x6016582c,
-0x0bda9d9b,	0xa819a4c1,	0x5bce9374,	0x5a3c4c40,
-0xe88f4d3e,	0x08f4376b,	0xa59c45cc,	0x33c46dab,
-0xdff3a2f4,	0xca974e43,	0x0d40e3a7,	0x8e963b66,
-0x745c501e,	0xa877d75c,	0xc7774bf9,	0x4c6bf397,
-0x47aeaa4c,	0xc35d51e5,	0x8a1a23dc,	0xb1db577d,
-0x76700f27,	0xf469d22e,	0x97157a8b,	0xe953ef78,
-0x52bbc871,	0x801185ad,	0x2771ed5f,	0xe617cf0a,
-0x7f44701a,	0x292ab6ee,	0x364e4bcd,	0xa741d8d8,
-0x6a53d427,	0xa3da51a2,	0xabddbb74,	0xdacb829a,
-0x28cc5ac5,	0x68a1e69f,	0xe8715c0a,	0xe07e193a,
-0xb12be636,	0xe75b2fd1,	0xaf716b67,	0x2cfe84b5,
-0x768038ec,	0x1a38144b,	0x725be985,	0x0cca8c2d,
-0x6377d96b,	0x78be2c3e,	0xfbc7bc7c,	0xc73599e0,
-0x3556765b,	0x4acfc4fb,	0x7a625486,	0x216fff33,
-0x36f1ca89,	0x5ba664f2,	0xebf1cffe,	0x417ab8a4,
-0x5bc200d9,	0x0cd0cfb7,	0xe8579f5a,	0xf133b1d4,
-0xbacd9856,	0xc93789f6,	0xcc87a934,	0x41508988,
-0x69bbc82b,	0xd81fdd84,	0x4591ee49,	0x8c5bd59d,
-0xb7c1639f,	0x901e5d50,	0x3ba0ad68,	0xd9bbe716,
-0xc8b73e1b,	0xea23e96e,	0x1cec0793,	0xa0ae0e12,
-0x90040f2a,	0x747c330a,	0x88ce23de,	0xeb455dd4,
-0x2badd673,	0xa5c3c07a,	0x5ab5d387,	0xd971f0bc,
-0x9f4bbfbf,	0x8ff5712d,	0x152cb5e1,	0x83f3ac4d,
-0xef1186f6,	0xf36381b0,	0xacc9dc6a,	0x3f6a8524,
-0x9acc5c26,	0xb1b40fbc,	0xb34beeb8,	0x3f4a4307,
-0x78dc4772,	0xa0ea1e1c,	0xe27bce86,	0x98dfc4d1,
-0xf13c0d26,	0xbe5e18c2,	0x0746bbad,	0xa64fc488,
-0x987f91ad,	0xc1bdd8c2,	0x4ca3f823,	0xc9981b4a,
-0x2ad2bd8a,	0x1016284b,	0xe6adec04,	0x8f8b855b,
-0xe6f5e16c,	0x0ec6c6ab,	0x1d96c986,	0x32d7e61b,
-0x49449a1a,	0xd683ec58,	0xb89db106,	0x7f020c08,
-0x26b2347b,	0x46644ee1,	0xc92754fb,	0x1367f4c5,
-0x27ca9199,	0x76cda4f5,	0xd5a81dfe,	0x063a9117,
-0xa3ab8a9f,	0x8c81aa67,	0x64afcec9,	0xe78a08d6,
-0xdb15d4d2,	0xeb99a428,	0xe7e3a832,	0x243a7f0d,
-0x935a659e,	0xca856449,	0x07060d35,	0xc90755d5,
-0x1162568f,	0x250ecdfa,	0x4ae8a6ea,	0xa585f274,
-0x74b04948,	0x0f54d98f,	0x287e0889,	0xcf260148,
-0x72604b94,	0x68d01875,	0x6bc9d36f,	0x842839d4,
-0x70263b5c,	0xef51b93e,	0x02ee5b0f,	0x6ea9a2b9,
-0xff49aaac,	0xb2060b9c,	0x2920c904,	0x47a055b7,
-0xb7b043aa,	0xe4678462,	0xf1abc10c,	0xd9d9c3ae,
-0x72d1aca1,	0x1154417f,	0x32fe84fb,	0x64fa78a0,
-0xe6c5ebf4,	0xadfc0e00,	0xd18f98ca,	0x607c5fb2,
-0xa1324c34,	0x0ce4e61d,	0x6afbe693,	0x9eb7871f,
-0x625bc005,	0xb0effb22,	0x60ee628e,	0xcfd76448,
-0xd81dc632,	0x005a3783,	0x44302f17,	0x64e097b4,
-0xb8e9cda2,	0x57ae42d1,	0x9f9e40a4,	0xd2af30ff,
-0x3eca1965,	0x7cda05b9,	0x233081cf,	0x34fc72eb,
-0x02642499,	0x721bae11,	0x2ef47751,	0x514e1759,
-0x35f0868f,	0xa90c32c6,	0xbe0f6405,	0xfa0d134a,
-0x404256ad,	0x959e57ea,	0xb1c5ecde,	0xd175dae0,
-0xb7c4107a,	0xa11832b0,	0x7c683cfe,	0x6c9e255b,
-0xbd77f7a6,	0x7d1a2d6a,	0x2c6aa994,	0xd66d311d,
-0xb7fbfbf2,	0xd69f8b84,	0xd74fd600,	0x72b087a4,
-0x6e7e1d4d,	0x68f86d92,	0x64b857ba,	0x40fe4197,
-0x83ce4fba,	0x70cc5546,	0xb957da5c,	0x7fcbcab1,
-0x5149df69,	0x7f1c2970,	0x4201c39b,	0xaf6825d4,
-0x21f0549f,	0xac41ba00,	0xde9b5750,	0xf4f7b104,
-0xcd4fd7c4,	0x2aeec406,	0x2d245b77,	0xdd756960,
-0xb2981564,	0x3b2875b9,	0x34b03c29,	0x80b7af2b,
-0x1388a227,	0x7d527262,	0x706daf9f,	0x046c89c1,
-0xcf7bded4,	0xa5245678,	0x3aa7da2f,	0x7f146ba8,
-/*  738-MU16b11d.inc  */
-0x00000001,	0x0000001d,	0x02202001,	0x000006b1,
-0x6d9b5661,	0x00000001,	0x00000020,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x965e94ce,	0xea6ba8df,	0xbfae08d4,	0x3ec50299,
-0xbf2b31ed,	0xbd80d71d,	0x19bfb06d,	0x95e56995,
-0xa52265a7,	0x247242bb,	0x90900442,	0xa4d69328,
-0x15fb69e8,	0x940daeb6,	0x8d930183,	0x2ad6a75d,
-0x970bcd0c,	0xbfc335a6,	0x382df453,	0x8dfa472a,
-0x95f0eda4,	0x2feaf1e8,	0xb6e292dc,	0xb7c32497,
-0x2daa2a09,	0x83b58903,	0xaf122f90,	0x3730c2af,
-0xa8f684d3,	0xa7f33a97,	0x11b46600,	0x8f8af52b,
-0xab23714a,	0x2a87cf3b,	0x9ae73e3e,	0xa032cf57,
-0x0adc600d,	0x96117940,	0x9ac65c28,	0x3a23596e,
-0x94800c0f,	0xbf793392,	0x2c503bb1,	0x8dc252ce,
-0x9b7de53f,	0x2af3d7b4,	0xb7bd4575,	0xbc71e798,
-0x23d62362,	0x8393e39e,	0xafb59604,	0x290633b6,
-0xac09d0f8,	0xbaced873,	0x1fbd177c,	0x9b51acfe,
-0xa4d82134,	0x2dff3e84,	0x86d59af1,	0xa4789758,
-0x0469ae88,	0x9a3f986b,	0x8f18edcb,	0x3a200e44,
-0x8138b3f9,	0xb9aaf81c,	0x25af1d92,	0x8313e883,
-0x9a7ff75e,	0x20a6b69d,	0xa1bb0bbb,	0xbb78f982,
-0x27c1974a,	0x8dafbb13,	0xbc2ac530,	0x2c84f9a8,
-0xa1d686a1,	0xbd6b3d97,	0x07419bad,	0x99535e65,
-0xa1ee3deb,	0x3aca5a6d,	0x9c60ad82,	0xa9ac0d86,
-0x14ba77c2,	0x80b20413,	0x93be9f5f,	0x34c56863,
-0x87e25909,	0xbaaf9373,	0x2e9396d7,	0x836c3f99,
-0x8c81e59b,	0x24c4123f,	0xbc3b2921,	0xa2744f80,
-0x37dec6c6,	0x9e6b0ec7,	0xa6d652e6,	0x349f2dec,
-0xafcf34e5,	0xa81bf9cf,	0x046ce7f0,	0x973ce507,
-0xbd2386a9,	0x336dbfa6,	0x8de954fe,	0xb823c3bd,
-0x13088720,	0x86bec81c,	0x9265d562,	0x24574333,
-0x92f871dc,	0xa34ef2fd,	0x366b59f0,	0x84a9a050,
-0x81e55751,	0x3f326f2a,	0xbbf66ec3,	0xa784062a,
-0x2c9bc339,	0x889b495a,	0xa44822fe,	0x2e9b5fbd,
-0xa69f6830,	0xa446b369,	0x1da26dbb,	0x820f296a,
-0xbe2c600f,	0x27b90904,	0x88f003c9,	0xa9191c49,
-0x024286cb,	0x9fe1354e,	0x91a7670e,	0x38236d32,
-0x9c70820d,	0xbad8c44e,	0x2f9b35eb,	0x8fb157de,
-0x82ea988a,	0x32f204c5,	0xb6a7fd19,	0xbe64276b,
-0x2ad2ea1d,	0x95449132,	0xa7e07868,	0x3ae7a323,
-0xbd4b67ba,	0xa1a1914f,	0x1f964ad2,	0x85f986d7,
-0xa84bc3cc,	0x2739696c,	0x81196fea,	0xa90cd44b,
-0x05728610,	0x8873057c,	0x83035ccc,	0x24e56003,
-0x863ee7bf,	0xb4b92f27,	0x328f2941,	0x8ace163b,
-0x94f39234,	0x39f2eb7f,	0xa10f03e2,	0xbd9ae083,
-0x325e4950,	0x99241d8d,	0xa07f585f,	0xf2ed61ff,
-0x3341f541,	0x68372f11,	0xa01b5b7f,	0xcc5d571c,
-0x7ac343af,	0xa4a1568a,	0x142d7f47,	0x8f0b9477,
-0x720e7fff,	0xf9214071,	0x84fa4a07,	0x5463cfab,
-0xffa780fc,	0xb8fbd2fb,	0x84a2fdb4,	0xef1c1b2e,
-0x7e4ce78b,	0x8a5e9464,	0x60bbad48,	0x463ffc56,
-0x0d9ac7e7,	0x545e8378,	0x595db59f,	0x04edbae3,
-0x5e4540e3,	0x489aaeb4,	0x94b5b57c,	0xbe693e7a,
-0xcc870854,	0x7f6caa27,	0x0a85aa9d,	0xf678f31c,
-0xc0a00529,	0x350ee2b8,	0x163fd3f5,	0x13fc2e76,
-0xd92bb224,	0xdf829dcb,	0x07db061e,	0x2c99066b,
-0xcb0327e8,	0xe3d4e5e8,	0xd7d7da31,	0x643aed9f,
-0x1994a531,	0x73f84914,	0x5f296334,	0x874490b7,
-0x517b63f6,	0xc04b51ef,	0x34d7de4d,	0x478cb112,
-0x66642af0,	0x2f392ef9,	0x1811ec70,	0x943bc492,
-0x70c61209,	0xeec40884,	0x47bb5b01,	0x255afce3,
-0x393fcd34,	0x1cca4e00,	0x3d2ac97e,	0x314450fa,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  729-MU268310.inc  */
-0x00000001,	0x00000010,	0x02062001,	0x00000683,
-0x30bf0a72,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x51a89c70,	0x1411e023,	0x9fad9ce4,	0x67b1bb96,
-0xc5793940,	0xdbb14bde,	0x9ebdae45,	0x1d678dd3,
-0xdd2c6a0d,	0x231560fd,	0xead2a7a4,	0xca2dfa77,
-0xe39fa4f1,	0x29fff4b7,	0x8c743aaf,	0x4c9629a5,
-0x9c58f6c0,	0xde8beb3a,	0x38e7687f,	0x8588fd16,
-0xc9f9f81b,	0xea2442ac,	0x335faeac,	0x3e37bfd1,
-0x295504e5,	0x483d31dc,	0x77a5cb3d,	0x885e8e20,
-0xe7850c7b,	0x7804bc39,	0x0e62293b,	0xadb6f55b,
-0x9500642e,	0x84cf5c1b,	0xc3cf5d03,	0xf8fca898,
-0x43c2b0d3,	0x738b8cf1,	0x452da61c,	0x90b2c9bb,
-0x5f6ebd12,	0xdc5287cb,	0xe32d809f,	0xcaa55a03,
-0xb6ad3f45,	0x2e858e8b,	0xf81ee98c,	0x858abe24,
-0xe2840fc6,	0x4fecaa75,	0x9ed1d6dc,	0x0f8fd8a2,
-0x821137cc,	0x34804fb8,	0xb3d0046b,	0x2d94dc78,
-0xcc6e5dd8,	0x44bca1b0,	0xee4f69d3,	0x9614cbec,
-0xc0eec8d9,	0x9d40be62,	0xcbfcd3ea,	0x3505d921,
-0x384b90ef,	0xe55c57cd,	0x1b9db24a,	0xf4fc1864,
-0x344f3e05,	0x30a91f38,	0xe4de8bf5,	0xd8a00f67,
-0x5d0d08e9,	0xbc62235b,	0x45e91420,	0x168c25be,
-0x78a0eaa9,	0xe2b44c13,	0x80b6ee0a,	0x1b92d7a7,
-0x2a3f0fd0,	0x1c0076db,	0x2b7247e7,	0x2c3b76f6,
-0x1f9304d1,	0x910a7c9c,	0x9deccc0c,	0x600ca6eb,
-0xa6c20c05,	0xd1fa730f,	0xa5b85f29,	0x741b4c21,
-0x6dc22fa7,	0x9257c832,	0xfc7fc189,	0x46a16122,
-0x2d6d8fd4,	0xb262ee0a,	0xd0f4b609,	0x85dbebe2,
-0x17b3da24,	0x94d92bcd,	0xaec41c85,	0xdcd01c5b,
-0x891397f8,	0x8fbd01ef,	0xc1534f1d,	0x712a5fda,
-0x47920862,	0xb03518a2,	0x70dd49d9,	0x7c163dec,
-0xc128752c,	0x2cbc6d0b,	0xc5797987,	0x2d43c51f,
-0x07c0e8ed,	0xe1b308f8,	0x013b9655,	0xc6f52847,
-0x60042e4c,	0xb19e647c,	0x3b61ebbb,	0x6e0036e0,
-0xc1c38e2d,	0xb35bb2ce,	0x12cb009e,	0xa5994dca,
-0x8c9f6615,	0x11d39ed7,	0x9a3f14dd,	0xfd3f83a2,
-0xcd02cd3d,	0xc6911f87,	0xb12638b9,	0xa3b05d6b,
-0xea454066,	0xa4e67fb2,	0xd669c44f,	0x0980133f,
-0xe324a146,	0xa387ad1f,	0xf1c8aace,	0x8fd30d25,
-0x05313805,	0xcadd0388,	0x80b4d986,	0xca62856c,
-0x6c3cf3fa,	0xb5cbb43f,	0xf10c6e0b,	0xc5df28ef,
-0x912959c2,	0x9411fcba,	0x736906ad,	0x97c2bdaf,
-0x1eb1b293,	0xf59b1d4c,	0xcc45755f,	0x0476a5d8,
-0xf5970a77,	0xe0bb3bc8,	0xbea59fec,	0x6b71b180,
-0x0420e767,	0x30b9c4a4,	0x020c50aa,	0x80ca424c,
-0x45263b45,	0x34debf8d,	0x14cbca6a,	0xcf0b27d9,
-0xdab6a3bc,	0xc002010f,	0x6e5089b7,	0x0fa16af9,
-0xbfb3d03d,	0x86e5e67e,	0x6c764f07,	0x5455c2da,
-0x29f70050,	0xdbbdc2d1,	0xaa8a831d,	0xc9b45187,
-0x627f1928,	0x8978fd2e,	0xaee4d563,	0x4c96922c,
-0x612fe1a4,	0x1abf2c4e,	0xc7d0b1e4,	0xd196ca3f,
-0x54d79d88,	0x65cf52c9,	0xe5fcddfa,	0xb4b316aa,
-0xccea4d78,	0xa8af6004,	0x990d8765,	0x85f38e66,
-0x91bbe471,	0x4dec18df,	0x3954a133,	0xb61627b7,
-0xea927cb0,	0xdcbf700e,	0xcab665f1,	0x750d645b,
-0x9346130c,	0xd9a8b458,	0x757368ba,	0x92bacf7b,
-0x693b022f,	0x4905d26e,	0x237d8707,	0x8b15029a,
-0x272a8b8f,	0x6f442555,	0x54b834aa,	0xa9d878bd,
-0xf7a55f5d,	0x6041d15c,	0x54883481,	0x320b5fab,
-0x07c53edd,	0x3fe2ffe6,	0x2be545ab,	0xcbf7aa86,
-0xf97eb865,	0x38dfe927,	0x06c587fe,	0x98565813,
-0xab235859,	0x06bd7edd,	0x7229d888,	0xbc4d9cb3,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1373-m1069507.inc  */
-0x00000001,	0x00000007,	0x11092004,	0x00000695,
-0xf7d0461f,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x75ed45d1,	0xa58cfbe2,	0x95b6ecce,	0x3eec60f2,
-0xa3518658,	0x986f23bf,	0x63ade481,	0xe26bbb6a,
-0x94f0ad76,	0x0da53309,	0xc920df0e,	0xe6ee5568,
-0x4a7fa577,	0x86f184bb,	0x98d09cce,	0x63a857b9,
-0xb83f63fd,	0x8a34f546,	0x00f1a9c6,	0xf09c1ba7,
-0xb2dab0ca,	0x1dd0f9f2,	0xb97219e9,	0x91489df9,
-0x0ae22c43,	0x97602252,	0x9452bf66,	0x7b2490ee,
-0x877013a0,	0x80d79558,	0x356747fc,	0xe8a4885f,
-0xf7b0cadd,	0x32e006a9,	0xfa724d13,	0xe6625057,
-0x41c66cbb,	0x9b638ac9,	0x9111e2ed,	0x686ccdc7,
-0xbee8a321,	0xa16a3ae6,	0x5b207450,	0xbaa920d6,
-0xd8887148,	0x386de110,	0x90ae1a00,	0x86f2d14d,
-0x03a0923c,	0x96edf313,	0xc296dd52,	0x7935f549,
-0xf094f7f4,	0xcacc5b02,	0x6b8cf81a,	0xd27d0293,
-0xdb27991c,	0x4f4591d8,	0x91740b1a,	0xe5658e97,
-0x22e267e6,	0xdfeef285,	0xbd99b6db,	0x0ba5a68e,
-0xa8f3ae46,	0xd4e887f0,	0x2ffcb598,	0xb5ab53b7,
-0xa34e5ed7,	0x275d2d86,	0xfb6504c5,	0xbf2ced2c,
-0x5d3adb47,	0xdd90c777,	0xc247d4de,	0x49756808,
-0xa7eccad2,	0xe463e92a,	0x08a1adc2,	0xbb1cdf22,
-0xf56620f8,	0x08f73ae2,	0xe33c259b,	0x8c34f791,
-0x5ac6f701,	0xd1a568a5,	0xb838c440,	0x1119f612,
-0x8067edbf,	0xf891c9d7,	0x792e238a,	0x94aea031,
-0xa6219da9,	0x2e657d19,	0xc0986d6b,	0x86845231,
-0x1196d0c1,	0xbce3eb01,	0xd06a1421,	0x1ef9f318,
-0x8fd9a69c,	0xdd2a5b02,	0x047d44ec,	0xb238dd54,
-0xed7cb49c,	0x3a8c80a3,	0xab9a6453,	0xd53347c2,
-0x59f19199,	0xd6c42520,	0xc6b433c7,	0x1432aff4,
-0xc66caed2,	0xd7b46878,	0x1dee38b5,	0x91a2d549,
-0xc847a196,	0x786ef929,	0xb03390ab,	0xeb92b8c3,
-0x4a81034f,	0x866b4a13,	0xc1cec9d1,	0x14d1b187,
-0xb1588c65,	0xbb04d233,	0x10754b96,	0xfbb7ae86,
-0xf40317be,	0x1f5f6fc6,	0xb09daf2d,	0xa63e4a93,
-0x224eeae8,	0x8a153313,	0xf62508eb,	0x6b3f448c,
-0xab1cc6c7,	0xd90b89a1,	0x766abffe,	0xd96407c3,
-0xde2397c5,	0x5c046b75,	0x94a3c7e9,	0x814d735f,
-0x0ce5a75c,	0x929ea8f1,	0xe4e1bed5,	0x12a32b5c,
-0x91c9e7ba,	0xdfb5f6d9,	0x07089e3f,	0xa39047ec,
-0xc48d6f94,	0x60c7b5c9,	0xe791230b,	0xfe80e488,
-0x77a83870,	0x8788bc87,	0xe8899973,	0x7a26deae,
-0x9328cd9f,	0xcff87fec,	0x704c0630,	0xcf33211f,
-0x8dfc1ede,	0x50e158ad,	0xf1bbe640,	0xeb418193,
-0x6cfd16a6,	0xdfe57412,	0xf0a85131,	0x916cefdf,
-0x68ed7eea,	0x8fd08f4c,	0xe7ad145b,	0x1b406442,
-0xe731af91,	0x8a2bc765,	0x5fb4e4f1,	0x16f46d22,
-0x8f585450,	0xae91ffb5,	0x2b1b8513,	0x3e0a7161,
-0x9e34bb9b,	0x9686df2f,	0x5bd24526,	0x0ef38175,
-0xc1c374b2,	0x953ad1e3,	0x0aebce39,	0xdba94281,
-0xe065a1d4,	0x2f2304d5,	0xe95460fb,	0x05fe2928,
-0x31f7b211,	0x4b01c6ce,	0x579271d7,	0xf10f5f7d,
-0x2a32b09e,	0x8cbae3da,	0xb5641d44,	0xcdc2d181,
-0xeeed868f,	0xe6a8bd7e,	0xf883e150,	0xe365dcf4,
-0xa068d4cb,	0x5c47b100,	0x8c6a0e2b,	0x781d645b,
-0x27c9af23,	0x7987c2e3,	0x521cbd5d,	0x5a85cdb2,
-0x077941ec,	0x76ba48fb,	0xb0b24203,	0x494f73d0,
-0xaf3d76ba,	0xe6a844d5,	0xc9d58989,	0x771cfc9b,
-0x48d3cf56,	0x163fd59b,	0xc15a5942,	0x5d217288,
-0xe0ffdc3f,	0xb298b4d9,	0x3b961d18,	0xb43b0287,
-0xafeb73c6,	0x47f7fdef,	0x0caf84f0,	0xa1fe51ad,
-0xd71618ac,	0xc87934bd,	0xe96101d1,	0x55d1976c,
-0x471c8505,	0x7a36d839,	0x5d62a9ee,	0xf3c54a8a,
-0xa2be15d9,	0x244087c9,	0x042c8037,	0x23224689,
-0x281c5d73,	0x2139ecfc,	0xffb8bc8a,	0x834fdd11,
-0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,	0x4ae2dbda,
-0x86d90089,	0x6675dfce,	0x48876262,	0xcec72538,
-0x11dc5c80,	0x86a730f9,	0x313565c9,	0xe3e5be11,
-0x106d7cce,	0x752b8be2,	0x3d00a5bc,	0xe6f70e95,
-0x44447ac8,	0x600df30c,	0x8335ac3b,	0x8816ddee,
-0x700982fe,	0xee495741,	0x48c7e81c,	0xa3d55da2,
-0xb0172982,	0x70ab2158,	0xd4460621,	0x3a9e528b,
-0x59b18a7b,	0xf4dabc4c,	0xa8454763,	0x70877bb6,
-0x66005c97,	0xaf292c06,	0x7b843db1,	0xf343b59b,
-0x25cdc7b5,	0xa41da617,	0x9e9d895e,	0xc936f475,
-0x7270925a,	0x30024230,	0x8e72f53d,	0x2b6c1b6f,
-0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,	0xaf377cc1,
-0xbff09a78,	0x4b4e0814,	0x95a0b2c1,	0x270398de,
-0x201fca94,	0x2a032a4f,	0x131542b4,	0x0d7306da,
-0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,	0xa3b3a991,
-0x17ee60c2,	0x852c0b8d,	0x11e5853a,	0x762002a7,
-0x92c5311d,	0x0d4bf7e1,	0xfffec870,	0xe3d35e5b,
-0xff6ecfb9,	0xdedae6ff,	0x0111a772,	0x9808e780,
-0x29c336e8,	0xe9bc05df,	0x5bedde11,	0x945565af,
-0xaff808fe,	0x87e3423d,	0x4de6f98f,	0x93b4adef,
-0xbf704fa4,	0x09120e91,	0xd54f3692,	0xdf8eab1e,
-0xfabbf59c,	0xe74318be,	0xaab87ffc,	0x29fa791c,
-0xe3915552,	0xa652cb9b,	0xa1252e74,	0xb35b723b,
-0x542aa28b,	0x12fcc5b0,	0x3941f962,	0x82bcc6cc,
-0x47b11974,	0xb821611f,	0x78b34250,	0xf1be5659,
-0x561b9e61,	0x6f3bd501,	0x584e6f5c,	0xd54ed547,
-0xacebcd21,	0x7b5ff816,	0xb64ad233,	0x9f2f330d,
-0x69fb1ece,	0xac8710dd,	0x58dc6c60,	0x9bee6139,
-0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,	0xa733274f,
-0x884d9b55,	0x42b08b63,	0xafa54a74,	0x1c7ccf64,
-0x93a20191,	0xaaa3132e,	0xc69831d1,	0x54634889,
-0xfbfe3efc,	0xd3cf68d4,	0x302e3117,	0xf5693131,
-0xc3ce8c6c,	0x1f03cd89,	0x6243334c,	0xf16bc80f,
-0xdca5f130,	0xcb2cd956,	0x4c1bb421,	0xe8de533c,
-0x7f86703a,	0x29aa897e,	0xdd54acad,	0x76b2f2ae,
-0x7ef82b71,	0x2e30970b,	0xba402597,	0x9a653ab4,
-0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,	0x2363d147,
-0x5327289a,	0xe89229f3,	0xd63a535c,	0x7efe9273,
-0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,	0x1b9c7bfe,
-0x5d14b3de,	0x54d575fb,	0x6d65db4c,	0x95648b7f,
-0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,	0x8488a45f,
-0x8ebc2932,	0xd4767316,	0x3e8c4b8a,	0xbab7402c,
-0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,	0xc88528e9,
-0x4b2e4e8f,	0xdd938b86,	0x0c964f98,	0xfc88d480,
-0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,	0x4d40b3b3,
-0xcf203155,	0x0d2fa621,	0x752d2c58,	0xb12bac12,
-0x1e7e8c23,	0x94215d54,	0x9854a71c,	0x4de63c64,
-0x7a012529,	0x9c171f8d,	0x9e71def7,	0x3bd17d50,
-0x11f175d9,	0xec78abf3,	0x7b529eee,	0xd3a69fc3,
-0x5b718676,	0x58214d29,	0xa8bd2c34,	0x41ea00ab,
-0xa03f64d6,	0x4ee342b0,	0x32b1e444,	0x1c1801a4,
-0xc8424702,	0x334a7e35,	0x50cf1543,	0x3b22b495,
-0x88683776,	0x8e2e0154,	0x6155c033,	0x4e2fa6ac,
-0x42ace700,	0x8d64f97c,	0xaf9ced17,	0xb2a5cb92,
-0xa558582d,	0x88705de7,	0x9e528d59,	0x84bd45e4,
-0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,	0x10462123,
-0x30080f7d,	0xb346cd81,	0x0049c396,	0x4e24165f,
-0xa7c66809,	0x2e60bdcf,	0xaad70a08,	0xa73ea713,
-0xe28f97a7,	0x283a9eab,	0xd4366489,	0xe776f963,
-0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,	0x3bae5f6d,
-0x8d2bbef1,	0x7e9181e6,	0xf06aa121,	0xd06b2d20,
-0xa83ea826,	0xef935e4f,	0xdfd27456,	0xa3451468,
-/*  153-d2_619.inc  */
-0x00000001,	0x000000d2,	0x02181998,	0x00000619,
-0xc5c556c1,	0x00000001,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xdff49ecc,	0xc5d1e527,	0x3a8e7c6e,	0xe9d01207,
-0x1e44f786,	0x58e4f3d7,	0xa7499f1f,	0xbc313f6e,
-0xe4a24a94,	0x443d60aa,	0x4d3df7cc,	0x2cd064c6,
-0xacc5f6da,	0xd958c0fb,	0xdaaa4a12,	0x737184ff,
-0x91e00455,	0x467a0dd2,	0xaeab14c1,	0x1e73444d,
-0x288bc1fd,	0x6dfaa156,	0xb1024d75,	0x7c0d631f,
-0x602d9310,	0x7ed54bf9,	0xcc2819a6,	0x8c2600c3,
-0x82eed3ad,	0xf0890270,	0x3d8a5679,	0xea0a9722,
-0xff2b13d3,	0xb7011201,	0x2b1a69b1,	0x35e2af2c,
-0x653177c6,	0x03168ff8,	0x6d061b4c,	0x16d81f8f,
-0xd382f127,	0xce0f26ec,	0xb4d64cf1,	0x89c2aa51,
-0xe648b062,	0xec4daa3a,	0x0988f13f,	0x62e0651f,
-0x67c95b34,	0x6fb57c53,	0xfe3fb014,	0xc892a9f5,
-0x451638d5,	0x4ffb5107,	0x796dbebe,	0x8f0f843e,
-0xc1fbcf86,	0x0c8125d8,	0xffea12db,	0x712ad923,
-0x2b49a751,	0xa8814975,	0xfd41f3a0,	0xeb18e50e,
-0xf6281a79,	0xb4f44390,	0x2b5071c3,	0xc8ddba66,
-0xcabf96e0,	0x34574ff2,	0x7c5f897c,	0x4827b909,
-0x7026e86b,	0xcf16fa48,	0xe96da218,	0x8c37090b,
-0xbadde7fa,	0x58740e35,	0xe0bf1ef0,	0xf3d71e9a,
-0x1056b85e,	0x45a15688,	0xb923d493,	0x9e20fa03,
-0xa839e632,	0xdedc0090,	0xff92aabe,	0x366986fc,
-0x9e5c7f61,	0x4a648912,	0x91265913,	0x2d6d04d1,
-0xb7ab8173,	0xbaeb7624,	0xa23f1606,	0xe6f08e1a,
-0x479bc72e,	0xda2ee924,	0xf32033d7,	0x53154433,
-0x8caf7ca8,	0xe12654a4,	0xc514d572,	0xeac8737d,
-0x0a5170ba,	0xf16aded9,	0x565b6bb7,	0xfe452dac,
-0xaec903e6,	0xb377e831,	0x3507046f,	0x0fb401d6,
-0x25896c75,	0xd6c10589,	0xab3e97bd,	0xe5018b02,
-0x9e8ae5c6,	0x8472d65a,	0x7b9a538a,	0xd402c4aa,
-0x3e08fee3,	0x1b8441cc,	0x0d39c739,	0x6078d9c1,
-0x398f9f6b,	0x85c92e75,	0x32da8bd3,	0xad017f9f,
-0x2527e23f,	0xf9bbed0d,	0x352aff03,	0x4ed81a59,
-0xebcd6b45,	0xbd57ffd9,	0x67971c0d,	0x6b4965e2,
-0xe9d474a8,	0x7cb46bf0,	0x3379efd7,	0x94106bda,
-0xf3dcb06b,	0x9a11f63b,	0xdbdbc795,	0x0d5582c3,
-0xb1e07809,	0xc53dfc21,	0x3e34d1e9,	0x20ebb843,
-0xc25871a6,	0xe2782ed7,	0x9ff3208e,	0x5637b911,
-0xfeaae151,	0xc5d6eb76,	0x86f11d36,	0xe8636d97,
-0x42cbc64b,	0x7b2ff820,	0x736543a5,	0x6e675dfd,
-0xbeb65b45,	0x974e08d9,	0xe020ef1e,	0xca600463,
-0xe9c6e29f,	0x6c9ff7be,	0xe50172c8,	0x04d54a42,
-0x85d85cd2,	0x4d69dffa,	0x3e682ba4,	0x7707d35c,
-0x1741fde4,	0x823ba54d,	0x07d89f59,	0x776e69e1,
-0x4ea164f9,	0x3b45af6f,	0xadb026a8,	0x9b11bfe3,
-0x2d79d863,	0x6a443d71,	0x75a92bb2,	0xd967d078,
-0x531aefda,	0x96273cb8,	0xd3146702,	0x8caf3022,
-0xfe5214b7,	0xff2ac722,	0xbab3ec0d,	0x1703c957,
-0x29acc59b,	0x2065dfe5,	0x633f8029,	0xd492a296,
-0x05615fd2,	0x0b8f02e4,	0xeba4d3fc,	0x6be653fd,
-0x3ab070a6,	0xa98357b1,	0x4fc658b3,	0x98b576d7,
-0x3f4e7495,	0xd057438f,	0x285b0074,	0xaf5f68eb,
-0x098b56d2,	0x5088220c,	0x4c9c8e25,	0x6d6d348f,
-0x4f368afe,	0x44f09ba9,	0x0c10ef81,	0x9d044f91,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-0x278cb2c0,	0xf41d6be8,	0x839b9b57,	0xde7df900,
-0xa6d05386,	0xf79d8944,	0x24d4273d,	0x878456fe,
-0xbc0006e2,	0x4cbc49c5,	0x16684d87,	0x1f2c79a5,
-0x847dc8fb,	0xe873c43a,	0xc92223f2,	0xc9c193d4,
-0x8f43d21d,	0xc723f894,	0xa0ed9e53,	0xd0693391,
-/*  435-MU165141.inc  */
-0x00000001,	0x00000041,	0x05251999,	0x00000651,
-0xa6218306,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3d0c5cac,	0x11ff7829,	0x2fa10010,	0xc0ecadaa,
-0xcbae2857,	0x6b9584c8,	0xe72d47bf,	0x94415461,
-0x2dd34f7a,	0xa2680f76,	0x2f06a3bd,	0x2efb5eac,
-0x124ca162,	0xc9c9b1ac,	0xad51979c,	0x860cec07,
-0xbcae95e0,	0xb179fc28,	0x380bfe6c,	0x29e36d1d,
-0xb6de4a07,	0x43d2f7c0,	0x50d15062,	0xece84109,
-0x5ad8ceda,	0x2e6edec4,	0x464d3c8d,	0xa8b047c9,
-0xa3c54ec2,	0xf5d1d938,	0xe2c66824,	0x08b51d37,
-0x4e914499,	0x0358535f,	0xbcbf6825,	0xd0ab53fc,
-0xa4e1cbe2,	0x09414a2f,	0xfcc78650,	0x05b2e8dc,
-0x1ecda664,	0x87fece35,	0xadc3aabf,	0x12669a90,
-0x62f32415,	0xe4752476,	0x2c4099e9,	0x766ea598,
-0xe1f0f9b5,	0x7949f610,	0x40d97a7e,	0x171f2391,
-0x334adcbf,	0x8bf26d43,	0x7965630f,	0x28046837,
-0x1f71d8b5,	0xa73e586e,	0x2fb7a8fa,	0xe7a2a760,
-0x57003172,	0x6a28be58,	0xf2ba6741,	0xf6860c60,
-0xf7cc3ef7,	0xf31e69cb,	0xdbc0894b,	0x205e4975,
-0x42452229,	0x65ca0ea2,	0x65e34129,	0x4a618e0e,
-0xcbbeb9a4,	0x881ebec5,	0x4b0bd791,	0x893c6e16,
-0x756523de,	0xe2122ab1,	0x23f26f00,	0xf834a2a8,
-0x9e17cf68,	0xe1b0a14d,	0x2f5edd0f,	0x2a8af994,
-0xaf09e233,	0x7696ee93,	0x4864b409,	0xff4e530a,
-0x4ae54fb9,	0x3801e4a8,	0xe2b391b1,	0x31ecedee,
-0x0984604a,	0x783aaf44,	0x88e0efdb,	0x8b3e6649,
-0x0bd1fdff,	0x46fa5711,	0x491e7907,	0x2eecc397,
-0xdfe3df03,	0x2d821dfe,	0x897468cc,	0x37c4abf3,
-0xbfc4e2f7,	0xa2d7394d,	0x13c001cf,	0xf27ef2e9,
-0x3fd3c915,	0x0789f599,	0x2723c650,	0xeff3b161,
-0x5ebabfd6,	0x6f13571d,	0xb5137ea4,	0x678ed454,
-0x3cb93110,	0xae7278f9,	0x96ed6789,	0xefb4b7ed,
-0x5d53b1a6,	0x65cd4d1b,	0x37750abb,	0x828b76e8,
-0xbbd2da92,	0xe90fc24e,	0x3acf9d50,	0x8700265e,
-0x9a44e932,	0x5a65886f,	0x6d883e7a,	0xabfa9ef3,
-0x62d5619c,	0xbb915137,	0xf1037b6b,	0xed173ca1,
-0x26f275ed,	0x002dd0a9,	0x2c1d7d15,	0x7a848373,
-0x9e592b23,	0xa851699c,	0xb0de7ba5,	0x6dce1c73,
-0xec7e2b9e,	0xce703232,	0x5057e031,	0x8651bfab,
-0xebb69e32,	0x28438085,	0x273f8e74,	0x7f91a931,
-0x8e3b6606,	0x2c18a084,	0x85c0acf4,	0xc245296c,
-0xc10a0400,	0xf0abff57,	0x09bfbd33,	0x10bfa0c3,
-0xa7cac5ad,	0x683e0e91,	0x5e951085,	0xa42cc4f8,
-0xbc2dd1e4,	0xbade67f4,	0x31ee0a40,	0xd7ad09c9,
-0x6f7d1b54,	0x644e9220,	0xd0aa82f7,	0x323164fd,
-0x5202a165,	0xc87d20a7,	0xa1fd6640,	0xa6baa2c5,
-0x35449bc2,	0x3b05a7c9,	0xac827721,	0xefa2ff03,
-0xa27eba79,	0x6fc394d1,	0x6baefac2,	0xbcdba3fb,
-0x02c9238f,	0x299d0700,	0x8ad8cb1a,	0x74dc90cf,
-0x5258694c,	0xa9ce8103,	0xa8c79e86,	0xe54d8add,
-0x67ec09d8,	0x135e99ac,	0x6084dfde,	0xac44fcc2,
-0x53af5b9b,	0x1899f5bd,	0xe5f270ab,	0xe0375b50,
-0x5e342404,	0x620baa1c,	0xad99d908,	0x29db18a6,
-0xdec25da0,	0xd1b208f8,	0x8f777eea,	0x4e3e94dc,
-0x67a40626,	0x8110a1ff,	0x7a53a3ac,	0x91f94f64,
-0xc221fe22,	0xde9ee71f,	0xda8d5547,	0x4e9b215c,
-0xd5025e9d,	0x4aa0cdd7,	0x1f3163bc,	0xc64716e5,
-0x47583201,	0xaaa25f7d,	0x6d9dadd6,	0x56343814,
-0xba90ef7a,	0x759ec8fc,	0xac9f5e3a,	0xc9c6d0a5,
-0xe18d43da,	0x118bbb21,	0x25df06dd,	0xc53e0218,
-0x12c84615,	0xe5e37b46,	0x74ec6542,	0x251cb041,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1340-m08f292f.inc  */
-0x00000001,	0x0000002f,	0x08112004,	0x00000f29,
-0xfdb52a5d,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3329bed4,	0x074ca74b,	0x76a4c9be,	0xb3d0ac3b,
-0x59c1ebd3,	0x9d06facf,	0xa272f2b8,	0x185d2aed,
-0x1dbb2394,	0x86f96351,	0x12652c86,	0x873bf0a8,
-0x4f6956f8,	0xbc5754f1,	0xd43f9485,	0xb0484217,
-0x88993f58,	0x071366b3,	0xbb49ef1d,	0xb8ec50b3,
-0xd6dd7d67,	0xafae9594,	0xafbcf523,	0x04e3cefb,
-0xf6125942,	0x6c58f3aa,	0xa28b05f4,	0xbb31e4f0,
-0xde633bba,	0xc2cc4d76,	0x2fc95cef,	0x465474bc,
-0x6148f606,	0xa8245d1a,	0x167d68d0,	0xc38533b2,
-0xcbfb5881,	0xb912dc66,	0xbb9cc137,	0xbaa2ca73,
-0xa9cee564,	0x3edd2b89,	0x2e3ffeed,	0xa68b49eb,
-0x0b85b10b,	0xb968370f,	0xd5c4deb8,	0x2d2883d4,
-0x288e44af,	0x37b10c8a,	0xa75c2ef5,	0xa5242ad7,
-0xff96f783,	0xab3f2161,	0x3921290b,	0x1094e053,
-0x9eae586d,	0x9878a4f3,	0xa2d41b7f,	0xb29cc218,
-0x93898d3c,	0xdd152eec,	0x638ab207,	0xa7536a0f,
-0x5accf54d,	0x798a56a0,	0x8e925de6,	0xe2fec0a0,
-0x8b6100f7,	0x910d43f8,	0xb3bcb1ab,	0x3f032f10,
-0x667b024d,	0x5303ab2e,	0x50a68459,	0xdbdae9ae,
-0x61cab195,	0x8b080d7b,	0xe1c9c484,	0xc0a9cc33,
-0xf3c786cb,	0xa226e2f7,	0x4509e980,	0x2ff4bb80,
-0x943a2b9b,	0xb0e2d78c,	0xdce9f9df,	0xb9302df9,
-0x2f095be2,	0x46f9e8cf,	0x097129ec,	0x5f7ba01f,
-0x49e26e4c,	0xde9ff6ce,	0x5d194de6,	0x9114a73f,
-0x5114f3e1,	0x9832e8b3,	0xd116f967,	0xfcddf0e7,
-0x3011f78c,	0x5d84b6d5,	0xb465a082,	0x8eb129ad,
-0x5390d983,	0xdfad741a,	0xef927af0,	0xa062e4fd,
-0x94a1b0f5,	0x6c9dcff9,	0x15192e6a,	0x11a1f0b8,
-0xbc5f9758,	0x01c1070c,	0x6f5a81c6,	0x7ee5b238,
-0xdf75b957,	0x8b5cbac1,	0x5f7cd16a,	0xf7faa6dc,
-0x5b74dbb5,	0x0980f147,	0x4aa3b0ab,	0x7e96c732,
-0xc72ad094,	0x29e6397d,	0xf62bb325,	0x3c519a56,
-0x9601dfdd,	0x23f189bc,	0x0109b7a2,	0x13f597b0,
-0xc35ff634,	0xa4f9ef96,	0xc430369d,	0x1ed355b9,
-0x15f9b440,	0x2aad9fb1,	0x6af73cfb,	0xb602ee0a,
-0x06611130,	0x8d08db9e,	0x6351cafb,	0x2be65e02,
-0x1d9ed057,	0x34b31503,	0x74692a5b,	0xb56177c6,
-0x3ebaded8,	0xa7db0ad3,	0x542be7aa,	0x0ba46019,
-0xb820af02,	0x8f55fcfe,	0xcff707bd,	0xa1af5708,
-0x41a1232b,	0xb4c897c0,	0xa1dd591b,	0xaf3db2a6,
-0xe4687b08,	0x015862ef,	0x15a83ad1,	0xaeca0275,
-0x0706cfc4,	0xbe03a5bd,	0x169d5c10,	0x280ab19d,
-0x9b99fc66,	0x00345af8,	0x5de2f1a7,	0xb7fc86df,
-0x8b00e3cd,	0x8d2711e9,	0x12eed4b0,	0x209bce06,
-0x8cf97886,	0x9bf52a0e,	0xed9428f8,	0x9f728b1f,
-0xde5fc471,	0xd1f01cdc,	0x69aa4865,	0x878ab1b9,
-0xdabbcbe5,	0x550e7f55,	0xeffd94c0,	0xf0cdf203,
-0xd7ff2d19,	0x9899bb83,	0x678e80dc,	0x49e5b9c6,
-0xcaef9954,	0x7eb67af5,	0x419eeb94,	0xb1602068,
-0x97e28a55,	0xe069a36d,	0x6dfcc106,	0x47f9d914,
-0x7383e86d,	0xb27b7376,	0x6c2ee630,	0xf85f633b,
-0x7c59d82f,	0xafb33c27,	0xca101b90,	0xb3b3bbf9,
-0xf02389c6,	0x2ae5f253,	0x95676086,	0x88ff4ac5,
-0x2d162899,	0xa222fffc,	0xd159e83b,	0x16b66dd8,
-0xdf00350b,	0x3bdd9067,	0xc70ac2b3,	0xa539a829,
-0x152a5d8b,	0xb481aa0f,	0xddf95ee7,	0x03e704e2,
-0x0aa80b47,	0x8de64970,	0xc24430ce,	0x816af6f5,
-0xea7abfc8,	0xd79e1d14,	0x12ad96a3,	0xaed48013,
-0x882da4aa,	0x7f7725e2,	0x490b7fd8,	0xdb5124ac,
-0x341b99f7,	0xba4d8f7e,	0x3674ad3f,	0x534b0569,
-0x2902e14f,	0x58824d7f,	0x77356546,	0x9c95fca1,
-0x9c0dc894,	0xedaa0d60,	0x81bfe7a0,	0x425cbcb5,
-0xd5e7779b,	0xb9378330,	0x609f2e86,	0xdc7fbbb8,
-0xcb72543a,	0xccb64908,	0xe58b6de3,	0xab1b8aa1,
-0x3f967b56,	0x5efa057a,	0x07205290,	0xf717088f,
-0x150e8090,	0x86edd874,	0x43222360,	0x58b3d233,
-0x44ff6d7e,	0x284b195a,	0x5f601ec6,	0xaa541775,
-0x5e1b16da,	0xaa198043,	0xd0169c6f,	0x28a71e70,
-0xa928321f,	0xa44e4c54,	0xc7be5a61,	0xab93508c,
-0x7ab40436,	0xa02182c3,	0x249b39db,	0xad612d6f,
-0x899e0a48,	0x0f7d11d3,	0x7eb4ca9f,	0x8aadc9f1,
-0xe4e20173,	0xbb07eeb9,	0xe4d773b1,	0x0963bc22,
-0x5efe60b7,	0x6b442c1e,	0x6b127791,	0xb5f46698,
-0x03bf49f4,	0xe4545f96,	0x4044e40c,	0x489f21ef,
-0x1d4eac1c,	0xb0f1a1ca,	0x0345a5fc,	0xc430b5e4,
-0x2168a536,	0x9b9d9aed,	0x5a8a9758,	0xbafd2c68,
-0x4a83fff8,	0x2bf1095f,	0x20c2bffd,	0xbca3a173,
-0x8401dfbc,	0x83105353,	0x972193bc,	0x2993f67a,
-0x8c35d677,	0x0c252c66,	0x5f1e71aa,	0xb98fd757,
-0x3643fcf4,	0xb3765fe2,	0x8600233a,	0x06fc4590,
-0x5ad345ad,	0xb3278dd3,	0xd44b139b,	0xbaf74e42,
-0xe5aa65ee,	0xcd805957,	0x09febfe1,	0x8f10ce02,
-0x81cb3fa6,	0x5626278b,	0x72fa21ea,	0xd8ff7cb0,
-0xa630b63e,	0x9980b352,	0x46ecef9b,	0x6d03626c,
-0x1964ae30,	0x3e6bbe08,	0xe608703d,	0x83f86201,
-0x610fe575,	0xa25d9faf,	0xce02357c,	0x209ef877,
-0x0d04b5cf,	0xa0fd2120,	0x3192020e,	0xa17bd895,
-0x1f10032e,	0xf9a15cfc,	0x0c643c71,	0xbe729757,
-0xb62b24a4,	0x7dd41f4f,	0x88b583a8,	0xf16d921e,
-0x0fe396b9,	0x9d9d9a77,	0x20000241,	0x61c85db4,
-0x638521be,	0x1d951e88,	0xa284b337,	0xaabe5c9e,
-0x97a40559,	0xb2f20d59,	0x885a02d6,	0x165e152e,
-0x2796f0da,	0x9b5b57d4,	0x07b9090c,	0xb9a8bc39,
-0xba844c15,	0xbd9bd74b,	0xff355da8,	0xb385ca2d,
-0xec5f4117,	0x3d4af9b8,	0xdfac828f,	0x92e2080e,
-0x65696e35,	0xb44f5e41,	0xc2734dec,	0x36a677b8,
-0x65982d86,	0x04e84c6d,	0x238aaaaf,	0xfae7e9a8,
-0xa03bb61b,	0xc16e0305,	0x4a0764be,	0x2e56a853,
-0x81216092,	0x63e342f2,	0x4a1cd397,	0x4bc4285f,
-0x4110213e,	0x18b58083,	0xd11d5a5f,	0x82a0e6f5,
-0x10436c53,	0x6564b86b,	0xcae1a418,	0xc2c38a41,
-0x686e097e,	0xc67f4bda,	0x674e6ff8,	0x34e18245,
-0xf5d7e68b,	0xc829c2ab,	0xdc22eacc,	0xf862a244,
-0xb4057d4a,	0x9fb00332,	0xd50b0eaf,	0xa8a0bfbc,
-0xf63d6db2,	0xfa3e4c0b,	0x60b2494b,	0x3c6ebfef,
-0x044ef356,	0x082e54d3,	0x7e57f91e,	0x8d4acaa4,
-0x31684817,	0xb4731f17,	0xacd44c79,	0x23c1e0d5,
-0xe01156d6,	0x539d11b5,	0x7e606458,	0x82a5769f,
-0xc54b7362,	0xf9ebadd6,	0x269bcf3b,	0x4bea7201,
-0xb1de3e7e,	0x8e095996,	0x1ae2e7af,	0x2e49f015,
-0xd8f34325,	0xbbd34107,	0xf42d8640,	0x24765cef,
-0x5cf949de,	0xc314ee1a,	0xef5d3635,	0x14030991,
-0x4ce7f704,	0x08690d06,	0xcd3360b3,	0x305ab52d,
-0x627a7be5,	0xe8556b25,	0x7556d670,	0x7cd14455,
-0x1a41f12a,	0x159465d8,	0x5fb182e6,	0xcd67faff,
-0x3e898764,	0xaede02c6,	0x54a1098e,	0xa46fcfcf,
-0xcf7ce909,	0xe5abe97f,	0x427651a3,	0x9d6cf5d5,
-0x25bb56e8,	0xa2a1f9b0,	0xfed4d48a,	0xb4187602,
-0xcf6fc3b2,	0xac1aadb4,	0xe5c8152c,	0x59440305,
-0x0d83b110,	0x85f16574,	0x97eb47d1,	0xe1b7755e,
-0x3fe387b2,	0x730d856f,	0x1b3bc656,	0x21882a28,
-0x46e1d427,	0xcfec7d37,	0x7bf0682d,	0xff0030bb,
-0xd7777805,	0x2962d76a,	0x8ccef0ae,	0xc80cf897,
-0x2d6b7578,	0xe4d439a1,	0x5294cfbc,	0x4070933b,
-0x006ee9ef,	0xf2a81dc0,	0x94329cc1,	0x18bc1e34,
-/*  620-MU26a401.inc  */
-0x00000001,	0x00000001,	0x06162000,	0x000006a4,
-0x144a06e8,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x94a2ee8a,	0xbdf9b67b,	0x12e65ed0,	0x09038b3e,
-0x792b3c3c,	0x46cb86a2,	0xbc00807e,	0x17aec02d,
-0x18a58dae,	0x9f04ff03,	0x76e4b9ab,	0x0248e1fe,
-0xcfcc1f1e,	0x33203083,	0x320735f5,	0x10da16f0,
-0xf64d147d,	0xd590a640,	0x690873bd,	0xfebe5923,
-0xf715c48d,	0x9587ed21,	0x28b5354c,	0xc5dcffc7,
-0x36d0d3e1,	0x13c536f1,	0xd1397d6a,	0xa5449667,
-0xd3d7c747,	0x20375d46,	0xbaf824a3,	0x408c10e8,
-0x8446f0eb,	0x5212cbcf,	0x7e3633fa,	0x5d071088,
-0xbb7c4569,	0xc5f08a77,	0xfc085388,	0xf2f9cb6f,
-0x2504a442,	0x9fa5c6df,	0x9277f171,	0x4db738f5,
-0xbc6d658c,	0x06aca6db,	0x57e5a2e3,	0x5d58f006,
-0x068ac2db,	0x37268b87,	0x5c73db56,	0xa7d8be99,
-0xff1305db,	0x2cc71495,	0x007ecbc5,	0x1979d587,
-0x1a547151,	0xdadd1154,	0x4b437b61,	0xa91d1cf3,
-0x87df0a53,	0x9dabe192,	0xa933645a,	0x562d8100,
-0xbc11cf6c,	0x74855a93,	0x6ed06c84,	0x8cfaa6e1,
-0x8c673650,	0x3c766bf5,	0x4e2f9e35,	0x12c9fc4f,
-0xb1890a56,	0x75ee5152,	0x19b4ccd9,	0xef5d0abb,
-0x796e9870,	0x9ffa1631,	0xd752c918,	0x99e69e79,
-0xf7df0ff5,	0x7d7a963d,	0x6f0e1b7c,	0x74c97cc4,
-0x8c025a65,	0x2188487c,	0xd84a0afb,	0xd7e28f22,
-0x120b3835,	0x81cee0f0,	0x82ce7884,	0x1a4d0572,
-0x41ad1fb7,	0x7d9ac754,	0xca35f0f7,	0x4a07ec7f,
-0xb42e4a38,	0x5c9967a1,	0x86be58b3,	0xae823a5b,
-0x38fa40b4,	0x6e869ed7,	0xf5e2e363,	0x22337781,
-0x00cb640e,	0x509ef4ef,	0x8cd8669c,	0xda4635b6,
-0xe42d2ab0,	0x49e70e9e,	0x8d39a0bf,	0x5f2a120e,
-0x511969ed,	0x2d8fe6ad,	0xcee3f6fc,	0x4bd6ff61,
-0xb17e0477,	0xac603627,	0x4326ed12,	0x4b923741,
-0x8fc4bd46,	0xfee4e542,	0x84cdfc91,	0x2be0c360,
-0x8e8192ea,	0x1379b18b,	0x02fe7545,	0x18bad614,
-0x0eabe9f8,	0x98f9aa1e,	0xe58be654,	0xdfedb4a5,
-0xb746598d,	0xfd89af05,	0xe9f0b493,	0x85abfc78,
-0x3332898c,	0x168f4bab,	0x0a39229a,	0xb344881f,
-0x805e0c63,	0x6b2f1943,	0xeb0d46dd,	0xc7ccb7ad,
-0x9b2433b8,	0x03e5cd29,	0x5100773c,	0x4e5a507c,
-0x5c43d05a,	0x99be68a6,	0x92557ce0,	0xc7bc15db,
-0x785a9b2e,	0xd82b4aca,	0xffc8110d,	0x61a8c353,
-0x7bdc211e,	0x84dc14ae,	0x7a08baa7,	0x541b9af9,
-0x253b4ee6,	0x8a470dcb,	0x902d9885,	0xdbbf5fcf,
-0xfad85625,	0x1217bab9,	0x99fb5020,	0x928c92a4,
-0x7a9ad6c9,	0x53afb816,	0x58694a97,	0xb1394297,
-0xd005898f,	0xc382c648,	0x3547eb3e,	0xde6213b5,
-0x255b6be0,	0x6465df4d,	0xb4dcb4f8,	0x78b2da95,
-0x63881ecc,	0x6e9cb6e1,	0x168e0b43,	0x132030f9,
-0x07b0b217,	0xd78367b8,	0x6eb45755,	0x561539d6,
-0xab95467d,	0x79e25e41,	0x521a8557,	0x0b9988d2,
-0xd2aae0e3,	0x9e2de68b,	0x8be791f3,	0x9adbe8c9,
-0x76952511,	0x610e5d5b,	0x7eb7fa10,	0xbe8d959b,
-0x1e41821c,	0x65f9853c,	0x8ae8a4ad,	0x30446566,
-0x9489b295,	0xaa108405,	0x9dbca7c1,	0x8551c3fc,
-0xe253a71f,	0x8cacf235,	0xb7dd1794,	0x875638ef,
-0x363e9a55,	0x3b059e9d,	0xfb545a0c,	0xa3e1d66d,
-0x6cacb56f,	0xf0557939,	0xe64432ce,	0x36134c15,
-0xc98489e1,	0x4033844b,	0x8653e914,	0x69781219,
-0x4cb5a206,	0xbc1b463d,	0xc4b0a4c0,	0x0db7a044,
-0x5031a9d0,	0x480c8be2,	0x64ea2531,	0x891b0ec5,
-0x464245a8,	0x63587a97,	0xe6039cdd,	0x8e79b9a5,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  99-B_c6_612.inc  */
-0x00000001,	0x000000c6,	0x12101996,	0x00000612,
-0x374569e7,	0x00000001,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x600e7f07,	0x34a50449,	0xfe3b9fa3,	0x255f83ab,
-0xe6f4e55b,	0x882b9a25,	0x43e8e8b8,	0xf6f90f25,
-0xf3683883,	0x544f4e68,	0x92c02e03,	0xf7ee75f8,
-0x2325cd70,	0xf1d82ad7,	0xfc5c0799,	0x4545c978,
-0x99535b46,	0xc8a2703c,	0x28898193,	0x8d9eb4e7,
-0x9239de7c,	0x4c7c4135,	0xd0e5f120,	0xb7423567,
-0x79fed144,	0xad1503d1,	0xe7f89b9e,	0x51c26ce8,
-0xd35a11f4,	0xbc22f731,	0x571efa4a,	0x8d97c169,
-0xb572cb4d,	0x1e694663,	0xb0b180b4,	0x99b03f0d,
-0x14275fda,	0xd3c4ea94,	0xbe8d3ec7,	0x6e56592b,
-0xd3981563,	0xaefe540a,	0x51d675a2,	0xdd9895a5,
-0xc6d8a40f,	0x7b0d4b23,	0xa3f32010,	0xc02780df,
-0x42ab6773,	0xea512768,	0x9d0123ce,	0x453529f7,
-0x91b3fb17,	0x91b305e9,	0x78a7614c,	0xa3bac298,
-0xdea9c1b8,	0x4d0d8a84,	0xa186bd69,	0x8abc794f,
-0x4c65b6a2,	0x8345eae2,	0xa2bf2ebf,	0x20503568,
-0xa6fb8d32,	0xfb5a9606,	0x354f7358,	0xeb1e94c8,
-0x91026281,	0x3e6e4afb,	0xbb03a8bf,	0xce8f070a,
-0x0d6fe013,	0xe6a52091,	0x903e3b0c,	0x705cf281,
-0x91ca2d06,	0xe5c5f3c4,	0x420171ef,	0xeaf55757,
-0xe7a73ebc,	0x486bc315,	0xd25e9d4d,	0xe118afeb,
-0x2227b996,	0xa893777a,	0xb23ed386,	0x08924fea,
-0x9610c4cb,	0xb3c9bac3,	0x0d9e201c,	0x82bc5fd5,
-0xf57cb5c5,	0x0e41e967,	0xe4260c86,	0xe04e6f45,
-0x56815cf7,	0x9910831d,	0x955414aa,	0x4193b3c3,
-0xb75d195c,	0xa571a238,	0x16c4cde3,	0xa838f3b3,
-0xf3cd0b58,	0x736eb039,	0xf2f30a3e,	0x8bf2982e,
-0x0001c8b0,	0xdbd68459,	0xabaf0fa6,	0x0f0e0d33,
-0xe27f092f,	0xf46e569f,	0x5293f361,	0xecca67de,
-0x94600d79,	0x4b30a042,	0xee439c71,	0x8b71724c,
-0x1d3f7c10,	0xf24d3e96,	0xcde53f89,	0x6b807ace,
-0x86f6e522,	0xb1095929,	0x16ff4902,	0x87905b40,
-0xb2797fb2,	0x55431fe9,	0xa80a5524,	0xca21bd87,
-0x2d8fce84,	0xba3dc49a,	0xc774bd4d,	0x06d6bdfa,
-0xbaf33ea6,	0xd754408a,	0x0329049a,	0xa6400a5d,
-0xcde7331c,	0x4e06a769,	0xa61d2cdb,	0xdd5288db,
-0x0155560d,	0x9d7bf35b,	0x8ff6ebe9,	0x62aa9d79,
-0x8ac240e1,	0xc5599827,	0x10311f4c,	0x20832e69,
-0x8823b4e8,	0xac7a47fc,	0xc30a0bb7,	0x1599d765,
-0x48a8f706,	0x395813b4,	0x244ebbe6,	0x5ad00326,
-0x38d70889,	0x282bf21e,	0x470725e0,	0x77d5573b,
-0x5242eb42,	0x5454d767,	0x57086bf8,	0xb37a0e71,
-0x1c58e22f,	0xac3dc2d3,	0xd9720857,	0x65748bc2,
-0xa98e8103,	0x83d0179c,	0x69dddabf,	0xcba6623f,
-0xabfb85de,	0x65150a2d,	0xd3e751cf,	0xb9855add,
-0x600f83bf,	0xd0398ae8,	0xee5334b6,	0x5e97b937,
-0xac94baeb,	0xb420804f,	0x04ecb7bb,	0xe9ba8428,
-0xa4eb1abc,	0x6e721296,	0x806c3a12,	0xb5d9d984,
-0x0b5a5b5c,	0xab942e26,	0x69d5eb61,	0xfe1558c6,
-0x1d7d357d,	0xccf926d5,	0xc8cb8d85,	0x66e124ac,
-0xc757e3af,	0xe680d3de,	0xc9ab585e,	0xd71707c6,
-0x18078df2,	0xb8184b56,	0xdbce6fb1,	0xf730feb4,
-0xac121b92,	0x2d4a8fa4,	0x243598f7,	0xdb4662a7,
-0xf0b64a74,	0x79ebd5f3,	0xb4c4c898,	0x3b0bea3c,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-0x278cb2c0,	0xf41d6be8,	0x839b9b57,	0xde7df900,
-0xa6d05386,	0xf79d8944,	0x24d4273d,	0x878456fe,
-0xbc0006e2,	0x4cbc49c5,	0x16684d87,	0x1f2c79a5,
-0x847dc8fb,	0xe873c43a,	0xc92223f2,	0xc9c193d4,
-0x8f43d21d,	0xc723f894,	0xa0ed9e53,	0xd0693391,
-/*  1339-m04f292e.inc  */
-0x00000001,	0x0000002e,	0x08112004,	0x00000f29,
-0x7695d4dc,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x3329bed4,	0x074ca74b,	0x76a4c9be,	0xb3d0ac3b,
-0x59c1ebd3,	0x9d06facf,	0xa272f2b8,	0x185d2aed,
-0x1dbb2394,	0x86f96351,	0x12652c86,	0x873bf0a8,
-0x4f6956f8,	0xbc5754f1,	0xd43f9485,	0xb0484217,
-0x88993f58,	0x071366b3,	0xbb49ef1d,	0xb8ec50b3,
-0xd6dd7d67,	0xafae9594,	0xafbcf523,	0x04e3cefb,
-0xf6125942,	0x6c58f3aa,	0xa28b05f4,	0xbb31e4f0,
-0xde633bba,	0xc2cc4d76,	0x2fc95cef,	0x465474bc,
-0x6148f606,	0xa8245d1a,	0x167d68d0,	0xc38533b2,
-0xcbfb5881,	0xb912dc66,	0xbb9cc137,	0xbaa2ca73,
-0xa9cee564,	0x3edd2b89,	0x2e3ffeed,	0xa68b49eb,
-0x0b85b10b,	0xb968370f,	0xd5c4deb8,	0x2d2883d4,
-0x288e44af,	0x37b10c8a,	0xa75c2ef5,	0xa5242ad7,
-0xff96f783,	0xab3f2161,	0x3921290b,	0x1094e053,
-0x9eae586d,	0x9878a4f3,	0xa2d41b7f,	0xb29cc218,
-0x93898d3c,	0xdd152eec,	0x638ab207,	0xa7536a0f,
-0x5accf54d,	0x798a56a0,	0x8e925de6,	0xe2fec0a0,
-0x8b6100f7,	0x910d43f8,	0xb3bcb1ab,	0x3f032f10,
-0x667b024d,	0x5303ab2e,	0x50a68459,	0xdbdae9ae,
-0x61cab195,	0x8b080d7b,	0xe1c9c484,	0xc0a9cc33,
-0xf3c786cb,	0xa226e2f7,	0x4509e980,	0x2ff4bb80,
-0x943a2b9b,	0xb0e2d78c,	0xdce9f9df,	0xb9302df9,
-0x2f095be2,	0x46f9e8cf,	0x097129ec,	0x5f7ba01f,
-0x49e26e4c,	0xde9ff6ce,	0x5d194de6,	0x9114a73f,
-0x5114f3e1,	0x9832e8b3,	0xd116f967,	0xfcddf0e7,
-0x3011f78c,	0x5d84b6d5,	0xb465a082,	0x8eb129ad,
-0x5390d983,	0xdfad741a,	0xef927af0,	0xa062e4fd,
-0x94a1b0f5,	0x6c9dcff9,	0x15192e6a,	0x11a1f0b8,
-0xbc5f9758,	0x01c1070c,	0x6f5a81c6,	0x7ee5b238,
-0xdf75b957,	0x8b5cbac1,	0x5f7cd16a,	0xf7faa6dc,
-0x5b74dbb5,	0x0980f147,	0x4aa350ab,	0x7e96c732,
-0xdaeacc94,	0x29fd397d,	0xf62b5325,	0x3c519a56,
-0x5dbc6524,	0x201364ea,	0x05ee717f,	0x39c8c28c,
-0x9ab2580c,	0x95550f9c,	0xfb0eb0ac,	0x242c6155,
-0xdd52b4d4,	0xa04672cf,	0xa81f5b28,	0xac10d5f7,
-0xd6afd049,	0x323e700a,	0xb710054c,	0x88b48cc0,
-0x4c1d370d,	0xb303457b,	0xbc5bf726,	0x2dfc0600,
-0xa86d0d2e,	0x9ec95b49,	0xeec42301,	0xa0ddf041,
-0xd3697b0d,	0x1cf23cd4,	0xe511afa1,	0x99677ab6,
-0xcb82d8fe,	0x03d837ed,	0xcf59b6eb,	0x117c6438,
-0x793db420,	0x01210ef0,	0x2f16aa63,	0x092aa912,
-0x188fcfe1,	0x0cd78643,	0x4725f2b0,	0x141b4064,
-0x060cb591,	0xdb59b5b9,	0x08ca7893,	0x03b02ee2,
-0xefdabca5,	0xedc23083,	0x48d71720,	0xc44417e0,
-0xb0f5f326,	0x04e0ca58,	0x1cbc21e9,	0xc47f8d91,
-0x5465c94d,	0x6f5c300b,	0xce250158,	0x39d3ff3f,
-0xb9ba60a4,	0x7e15fc75,	0x6481b42f,	0x4a822d4c,
-0x6b251985,	0x01c3f0ff,	0xb961c2c0,	0x56233348,
-0x4322f327,	0xfaf3a4b4,	0xa5e2f209,	0x0086e35f,
-0x5665e8c8,	0xd284182d,	0x7c66dc76,	0xdead8651,
-0x3948f967,	0x29e2cdc5,	0xa85bf1c4,	0xfc81e608,
-0x95129e56,	0x39e8ccc0,	0x8a55171d,	0x0ca75f6d,
-0x76b3b76a,	0x07063184,	0x40a355b6,	0x0dc9ae64,
-0x2f0bcdc9,	0x3c98d57e,	0xbd9f6fc9,	0x0b3b70e8,
-0x6598b670,	0x98adb5b0,	0xe38efec2,	0x1b72b2a1,
-0xd7760f5b,	0xa5ff1aa2,	0x21d65a27,	0x85170ab7,
-0x4f19b28e,	0x147ab845,	0xc61a001a,	0xbf15e323,
-0xbea79403,	0x0e9fd315,	0xa5ce5dc1,	0x3dec0102,
-0xe344f20f,	0x26772148,	0xe3c335c8,	0x14698661,
-0x02045f22,	0x1b9fe294,	0x18fd4760,	0x2b0dcc84,
-0x3719068f,	0xe16a4bd5,	0x69b449a0,	0x088176ec,
-0x66231f59,	0xe4c8477f,	0x3ccfd123,	0xd67be9aa,
-0x8df1652c,	0x11f29283,	0xb13a6168,	0xd79e71f5,
-0xdf064c6c,	0x63bbaea0,	0xa32b027f,	0x17fa40de,
-0x62dad42b,	0x4a2ba3d1,	0x97566ec5,	0x7ce0870a,
-0x7c6ac399,	0x075eae21,	0x02811d28,	0x6effb228,
-0xbdffa992,	0xfc9706c7,	0xa2c158ad,	0x3a407afd,
-0x94b88ec5,	0xc9019e3e,	0x10cf018e,	0xf08b1e2d,
-0xaa09594a,	0x0d896d4a,	0xf83a743f,	0xfc82a2c3,
-0xe863355e,	0x619ef2f4,	0x2170df86,	0x34112254,
-0x615d93e1,	0x7c25d947,	0xbda74d18,	0x4188f6d8,
-0x02a61d07,	0x262bad07,	0x3939c06e,	0x76480101,
-0x26697ea6,	0xfce41af7,	0x9bece83f,	0x309c0b9e,
-0xdfc2bc12,	0xedcccfee,	0x4f095c0d,	0xd9b08cce,
-0x45da7530,	0x2f8e37c0,	0x5f273652,	0xc13511e0,
-0xcdb90088,	0x79c7d87a,	0x3df67681,	0x05a0a8d3,
-0xf2d2756a,	0x56041d39,	0x185b97c5,	0x62644b35,
-0xba24ad0c,	0x0d8ba3a3,	0x90e4793a,	0x4a04a884,
-0x05e64fdf,	0xfe710b2b,	0x85703d05,	0x1abc37e1,
-0x8db28c4e,	0xdde1b1d5,	0x03682e82,	0xf4d092fa,
-0x067f6a0d,	0x3c142430,	0xf2d8bc9a,	0xf546da72,
-0x660ec359,	0x4171e4dc,	0xa29d94b2,	0x151add4d,
-0x57f35f12,	0x7258f732,	0x9db66fba,	0x77e39897,
-0x8a8711c7,	0x1f5db10a,	0x58792090,	0x68600a9a,
-0xb2a89ac2,	0xa4a1f018,	0xc27e695f,	0x00aabd02,
-0x3f750dbe,	0x9a2e2bd2,	0x70ac647b,	0x9959d044,
-0x7669de0e,	0x2f98c181,	0x1c25a4fd,	0xbfa6a204,
-0xfb47f2d8,	0x440f46ff,	0x53a2dcfc,	0x1bf83a80,
-0x2d0b22d7,	0x4f518fde,	0xc1d17dbc,	0x7e92459e,
-0x95608150,	0x04486d5e,	0xd30e6f8a,	0x7e5a4a39,
-0xb01dee81,	0x04e7acdf,	0xf7ada4a4,	0x0795880e,
-0x26dc8256,	0x0a5aa3c3,	0x8f029565,	0x2f470e3c,
-0xa373fc51,	0x1c7e7b45,	0x267796b8,	0x1bcb4991,
-0xcec801f8,	0x6c9a6957,	0xc1ce18c5,	0x043c7ab6,
-0x3bd723ed,	0x6093b8ab,	0x2f768aa1,	0x4c6de3ce,
-0x71b2965a,	0x31ed9427,	0xbdab13e4,	0x7e9eba94,
-0x06508808,	0x5867bccf,	0xc0c8c85d,	0x846300c9,
-0x03891b7b,	0xe1150b81,	0x56116659,	0xdff07740,
-0x6eb9e465,	0x3a8a5801,	0xc54290e2,	0xeef47a33,
-0x4c71e22d,	0xd1dcc6be,	0x7075ccca,	0xa14f574c,
-0xfa205fcc,	0x71fd97f4,	0x285b90c3,	0x6f4ec636,
-0xe5fcc6ac,	0xaaa6e7b4,	0xb02d6ce1,	0x8e6fc58c,
-0x0d8c03e5,	0x5f1490ac,	0xa7c85aa5,	0x079a36a1,
-0xcf0a5098,	0x596d1e33,	0x23a0615d,	0x90b97898,
-0x7bc12833,	0x5c6b310c,	0xb72adacf,	0xff8538e0,
-0x750587e9,	0xcda7274f,	0x7e439b7e,	0x57e0932f,
-0x3fc98dff,	0x92a8077e,	0xff3c4325,	0xee308b69,
-0x72caf71c,	0xb2f163f8,	0xc024caa1,	0xa86d0b31,
-0x14b28f1d,	0x2961b1f3,	0x8d2082c1,	0xad0918fb,
-0x8ec25b94,	0x84f5ec2a,	0x7a354fd4,	0x7a49c860,
-0x1402776b,	0x420b3355,	0xdb1de128,	0xe172496b,
-0x85a89831,	0x648abaab,	0xcdc11dd7,	0xfb2f1711,
-0x8c426c31,	0x00bd97e2,	0x9a91f509,	0xab959673,
-0xc0d4e1a3,	0xf4fe6c5f,	0xdf597cb8,	0x59fd4c80,
-0xbf0b9c60,	0x650d7e3c,	0x5cd34a1f,	0xc16ae184,
-0x8b7dbd72,	0x6640b6a1,	0x8a8ee15a,	0xb0c36bac,
-0x6c489ecf,	0x2a15e446,	0xc8546da0,	0xf83856e8,
-0xa825a813,	0xb6d8332d,	0xceec0377,	0xf19cbecf,
-0x069c28e8,	0xd889195f,	0xd2dbf4d4,	0x28934dc5,
-0xcc113de4,	0xdcdd0feb,	0xa04df5f3,	0xc443666f,
-0x4f8c2b41,	0x3384a41a,	0x72890c0b,	0x728e69fe,
-0xc039391c,	0xf63d92a5,	0x91d700bd,	0x9007116a,
-0x5c6eaeb8,	0x4d65fcf1,	0x13551d94,	0x203a4079,
-0x1e65fad6,	0x89538401,	0xcff93078,	0x02bc1716,
-0x096c8d48,	0x0b4ab7d8,	0x236945c8,	0x894ef357,
-/*  1101-m02f2738.inc  */
-0x00000001,	0x00000038,	0x06042003,	0x00000f27,
-0x6d330d4a,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x0000005e,	0x96f952a6,	0xaa368f02,
-0x53d271e6,	0xf8286513,	0x484b4e9a,	0x9e0c09c2,
-0x03b11314,	0xdfb67c98,	0xa2957d16,	0xf07f25de,
-0xb84a2555,	0x72ec8b35,	0x3445c734,	0x7744f543,
-0xc3da0cc0,	0xeb36172d,	0x8b2cf574,	0x29c867a2,
-0xe79dfaf0,	0x54714bb5,	0x524dfb69,	0x0df65433,
-0x0b95ec14,	0x3dc09ca2,	0x584ba068,	0x2aa558ce,
-0x8cd679c8,	0x3b2609d0,	0xa06306d1,	0x80bfa93a,
-0x482678d8,	0x0cdf1ce6,	0x5ec4e912,	0x8a19f7a6,
-0x76f215be,	0x577d92c2,	0x479cd4ba,	0x63d1f415,
-0x5af98bc5,	0x8889bb4f,	0x8e70943d,	0xb5528299,
-0xfd63e347,	0x836fcfd0,	0x4951a701,	0xf4613cdb,
-0xaa7c2f52,	0xa0e290c7,	0xf646a80b,	0xda5b5a03,
-0x93517b47,	0x553d99d1,	0xafac198e,	0x486b6c6b,
-0x4efa01d8,	0xdc6ce226,	0xdac3a149,	0x9b7cf27f,
-0x6c6246a0,	0xb6055a39,	0xb68cc841,	0x87b6adee,
-0x1c36edb4,	0x3ee76d20,	0xdbffab67,	0xed12fda6,
-0xc1aff2f2,	0xc110932f,	0x0933ccfe,	0x58fa2281,
-0x285d5ec1,	0xd05b216a,	0x76315645,	0x570c5c8f,
-0x6cc52f1c,	0xaa977e52,	0x066f4e03,	0x812bfd2c,
-0xbfbfd7a9,	0x70828199,	0x60182af7,	0x2a04e000,
-0x30f413b7,	0x327cef32,	0xac73aa51,	0x7c418d9f,
-0xf493ce0e,	0x6c14258d,	0xa5e2755e,	0xd39f994a,
-0xee638b08,	0x55d50476,	0x9b7afc5c,	0x5da2ed13,
-0xb75bf9f4,	0x2606c01d,	0x8a1d00eb,	0x0f73428f,
-0xb29c4fb4,	0xac13e554,	0xa7648fe0,	0xbe56837b,
-0xd34fa9ff,	0x59c855a2,	0x7d3cc7d7,	0xb5b0cb50,
-0xe6626c0b,	0xf07010b7,	0xd8054587,	0x01a5327a,
-0x3ceae28b,	0xa3bf737f,	0x3d1a37e7,	0x6ce48d1d,
-0xc9d91222,	0x42f28fae,	0xe8dff3e4,	0xfd6898d0,
-0xe772ab47,	0xbe452c12,	0xf188ee09,	0x08edb79c,
-0xad4d48fb,	0x5cb75d1d,	0x251f4e02,	0x6b7bb6e3,
-0xcada2f09,	0x536d74eb,	0xacfa627a,	0x51e2ffd2,
-0xe4655767,	0x311dbbec,	0x1011b68a,	0x6f6e8deb,
-0x4298665d,	0xc0522b3c,	0x2c3a19dc,	0x2c48f2ae,
-0x49bca621,	0xb6a747fe,	0xa1606c81,	0x9b2a5318,
-0x0ac114c3,	0xb5b35aa0,	0x3f4ee00d,	0x8b427e75,
-0xb539fcd3,	0xa99fba84,	0x821fc647,	0xe0ac6d6e,
-0x912f6f88,	0xf2009cd8,	0xb32330b3,	0xd0b80514,
-0x6f25f157,	0xdba2f463,	0x88ef17d1,	0x147c5f21,
-0x6e29cd75,	0xec14e5d1,	0xdcfffd24,	0xccc2c510,
-0xe5e40798,	0xb24814e1,	0xaf0cdaf2,	0x825cf5e2,
-0x12acac6b,	0x439c5f36,	0x0c533619,	0x8e776e71,
-0x319b44f5,	0x19c0b404,	0x54111b2a,	0x6a767513,
-0xb16944ef,	0x30ef18ce,	0x85df0862,	0x0737ff49,
-0x77fe06f2,	0xb2de0d2f,	0x71625e95,	0xc722c5a2,
-0x03b401a9,	0xe8b030b4,	0x7f9e62ab,	0xbff8c966,
-0x726bfeca,	0x6adf3831,	0xab85067e,	0x5167e87a,
-0xb06ad00c,	0xdd974309,	0x5704880d,	0xb7279a43,
-0x38aeda19,	0x52f5a31f,	0xd66d79e2,	0x83dad3db,
-0xa138d066,	0x0b4674d4,	0x07e7dd7a,	0x7f5c70c7,
-0x4aade5f0,	0x4fcd220f,	0x2ae8ab6f,	0x6fb11f68,
-0xbf134ecc,	0x71d3125c,	0x3cc3f6ba,	0x92809507,
-0xb4a9b236,	0x97a2ef5f,	0xe20e5f23,	0x5610bfa9,
-0xad16eba9,	0x5207dfba,	0x0caa3d20,	0xc57cccba,
-0x7983d15d,	0x09ced949,	0xec698959,	0x53a4b153,
-0x63c74107,	0xacf58270,	0xbc2982cd,	0x42bf9c41,
-0x26aff8b4,	0x9832bd6e,	0x34e98158,	0x434f0f43,
-0xcb80ccda,	0xd81471b6,	0xbd176071,	0xab13735c,
-0x4e80e2c1,	0xcf7815f0,	0xb4e6ae37,	0x1a90c457,
-0x79426d6f,	0xa4ac1e2c,	0xf76de77b,	0x1808cd61,
-0xd72ea071,	0x1f02af0e,	0x9613b531,	0xe83f2e9a,
-0x99a5262a,	0x0e8a756d,	0xbc229ac4,	0x2cb1af6b,
-0x8a8720d6,	0xc84d2c77,	0x8547ad96,	0xeb794e72,
-0xb51119ea,	0x1c0121ea,	0x9f8ae83b,	0x16459999,
-0x5c17deaf,	0x278a3e3b,	0xf2bbb704,	0x54df1a00,
-0x521ef94e,	0xd40de734,	0xca5badee,	0xa2fe3027,
-0x2ffe3ada,	0x1df00fb9,	0x5feb168c,	0x81674308,
-0x99713c0e,	0x56aae017,	0xe62e68f3,	0xaa15163a,
-0x31ac7b10,	0xe6a86d9c,	0xa006782e,	0x9baefc91,
-0x111277d5,	0x80f63a4b,	0x624044d6,	0xd91a5de5,
-0x5d0255d6,	0x92b82310,	0x08faf5e5,	0xe482ff69,
-0x0a1f1757,	0xdc010e34,	0x9cd07e48,	0x677fcfa3,
-0x0384138d,	0xa104220a,	0x5431c7ec,	0x0e8b7efb,
-0xf1ebcd61,	0x97ae7029,	0x191ff006,	0x4308b147,
-0xa11e05f7,	0x2c7cb5a4,	0x1d345971,	0x28d23638,
-0xc5a7a5bb,	0x3307c971,	0x0d3782ae,	0x2b798842,
-0x1fc27334,	0x4ff82ddb,	0x543ba685,	0x47732c7a,
-0xad094a6e,	0xb8ff60e4,	0x43f9ee2f,	0xe9a114e8,
-0xf036be6e,	0x3fb488a0,	0x280b2d46,	0xb1887c58,
-0x54ae583a,	0x454b6ce6,	0xe617a2c1,	0xb9335ac3,
-0x72361e12,	0xc856637a,	0x741b6cbe,	0xcf1f6f25,
-0x9f405fff,	0xd2525b02,	0x22d8b05a,	0x16860f11,
-0xb02983e9,	0x388b9c2c,	0x196cb2f2,	0xfca5f1a2,
-0x9e60965d,	0x5bed99ff,	0x59e361fc,	0x9361bde8,
-0xa1527365,	0x3f300237,	0xb0f5e2b8,	0x8fb00a40,
-0x71cb9744,	0x3327e8d3,	0xe89994d4,	0x3987e389,
-0x28c6d8f7,	0xb2ba9fc4,	0xdf109e0e,	0x622634b2,
-0x4904a82e,	0x576c3c2f,	0xe95eae46,	0xfb773013,
-0xf98b91de,	0x4edc30d5,	0xc6e60080,	0xebefab96,
-0xd7684df2,	0x9cd2c3e1,	0xd433902a,	0x7b9aa9eb,
-0x3c99cbaa,	0x5a0fa53d,	0x77297830,	0x869db621,
-0xaee2d56a,	0x2ce907c1,	0x0aa5097c,	0x662e7862,
-0xa5bfbc61,	0x2610f3bf,	0x3a741865,	0x99a5836d,
-0x2e533e3b,	0x812aa485,	0x0d7eb66d,	0xb325db47,
-0x6ac77937,	0xa1757eb7,	0xb7765633,	0x8845f18f,
-0xde7e37f8,	0x08a17789,	0x8af720ca,	0x1f7a530f,
-0xadcbb072,	0xd02e2dae,	0x16fbe58f,	0x0e4df085,
-0x80663766,	0xdcff020e,	0x4c242d70,	0x3d16d122,
-0x154a029b,	0x40c95a2e,	0x5f98eb6f,	0x637ffc42,
-0xcdf10a5c,	0xf2211055,	0x998ddc8b,	0xcee90fd8,
-0x1ddc7fad,	0x7034d80c,	0xf5bf0592,	0x479205bc,
-0x0900e9c9,	0x7bef8c77,	0xc128cebf,	0x9e7dd814,
-0xedca7a5e,	0xf15af942,	0x40e55228,	0x065ea7ce,
-0x9603da92,	0xa6611211,	0xea9dad76,	0x4fd9d974,
-0xea19cb68,	0xeabf508d,	0xd460f6c0,	0x3951733a,
-0x249a4453,	0x04356966,	0xac6ec71e,	0x5253e669,
-0xfca78245,	0x8ef4d888,	0x6c031fe0,	0x8c49e3df,
-0x67cd07b8,	0xc916f082,	0x3a350c13,	0x17a9b757,
-0x5681f1c3,	0x0e656ece,	0x2ae1d3df,	0xb9cd5476,
-0xd425f4e0,	0x8b45dee8,	0x8f02eb98,	0x6f00c0fb,
-0x1b90977a,	0x521e8094,	0x9b5b08ec,	0x5b504450,
-0x449f84f6,	0xb63e6384,	0xf389e505,	0x0b2aab9f,
-0x945ecdbf,	0x721a5b10,	0x6a2c6884,	0xd74f9926,
-0x9c178148,	0x1f44fd1b,	0xf63a6ffa,	0x4506529a,
-0x797d01b4,	0x442147f8,	0xc90a759b,	0x44f0a0fb,
-0xdd26e42c,	0x55fcf1d5,	0xaeeee197,	0xbee8c900,
-0xf8c70f2f,	0xc32d2eee,	0x5857e821,	0x5ac38d25,
-0x873b3c45,	0xa1db703a,	0xf1b7a2a6,	0xc2c7829d,
-0xeecb2edb,	0x19f0fe3c,	0xd6f35737,	0x5000b318,
-0xcd217d92,	0xc72ec374,	0x321b9e86,	0xfd256b8a,
-0x7e9331c9,	0x8a7edd90,	0x8af83898,	0x222c1f2b,
-0xb722eb67,	0xdc087998,	0xa512fefc,	0xa5c1bafe,
-0x642b8b83,	0x3a617c41,	0x2d081db3,	0xda5ef119,
-0xde847082,	0x83d113c3,	0x273dcb52,	0xafbf83b8,
-/*  539-mu167210.inc  */
-0x00000001,	0x00000010,	0x09221999,	0x00000672,
-0x0fc53099,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x5880aae8,	0xfaf512a7,	0x94957b73,	0xde532d8d,
-0x63486cc5,	0x03c40bc2,	0xfc37b015,	0xa2bb44db,
-0x4cee0355,	0x0caf4096,	0x6a27b5f2,	0xa35d5645,
-0xd215451c,	0xc44bbcfd,	0x3af5a7ab,	0xdc73f7a9,
-0x6c7fd419,	0x730ed02f,	0x0a17f0ac,	0x0ff2cb01,
-0x3568e8f9,	0xb66ffb52,	0x5a491384,	0x951e8f0d,
-0xbdef7d13,	0x05bf66c7,	0x2eebe2ed,	0x8b3e282d,
-0x6d4d2a7e,	0xa90e5a1a,	0x8da2cf30,	0x27a1e9c1,
-0x4c213e6e,	0xe706acdd,	0x107f29d4,	0x8dab4326,
-0x0c25a3c6,	0x6614b954,	0xd2da266b,	0x2492aec5,
-0x23b67a43,	0x1ad8ec74,	0xc626d333,	0xa84fc0af,
-0x1fe014b1,	0x7c571487,	0x0bd8f4fd,	0xb40b50f4,
-0x96024e3a,	0xb7fb756d,	0x7b178f2e,	0x63f2f5eb,
-0x6c4f0df0,	0x4082d795,	0xddc4c133,	0xdd61b9a0,
-0x3b771dd0,	0x2ccb5aa9,	0x0ab1540d,	0x27277645,
-0xf669cdca,	0x96dc652c,	0xe9b40689,	0x1c6977d7,
-0x3668f5e0,	0x44c48a36,	0x5f86dcc4,	0xdd930f89,
-0xf518d808,	0xf3bcc771,	0x3b146ab2,	0x6ab0215a,
-0x7f8376df,	0x919dd4e5,	0x72af3e92,	0xcd238191,
-0x9de0ba0d,	0xc7d99731,	0x3ffdb94a,	0x70a4c322,
-0x3263d10b,	0xc9ab0976,	0x42674ccd,	0x291c4988,
-0x178e5728,	0x325854d7,	0x1266fed3,	0x68cfa797,
-0xb042263c,	0x83fbf8a2,	0xa1e42d77,	0x06f01879,
-0xd4ba01b1,	0x43e18410,	0xad7c57c2,	0x929c65d9,
-0xb52b0c58,	0x7bfbdfc0,	0x200e489d,	0xa805d3f3,
-0x41c7d2a8,	0x8c7e1072,	0x5ad805c1,	0xf337886f,
-0x256a5f75,	0x4292408c,	0x62b1aeea,	0xe0155a3e,
-0xe9356b4f,	0x92b8123a,	0x69d788f6,	0x147c9899,
-0x94ade173,	0xf1639fb9,	0xd27a0263,	0x55c7b9fd,
-0xfbf3d168,	0x8b493de9,	0x5b3e6b02,	0xeb7e1730,
-0x9a0e99c7,	0x9bb77bbf,	0x44b82682,	0xbea818e3,
-0x0aac061a,	0xdfde0f65,	0x1219fe0c,	0x08db086e,
-0x984f8dba,	0x64d669a2,	0xcb4a6056,	0xc335ec63,
-0x003db584,	0xa2e85d9a,	0x62b5109c,	0x8979f26d,
-0x25f87439,	0xda7b4ff9,	0x9b41ceef,	0xb166f52d,
-0x3e12f451,	0xe6bc67aa,	0x105e378a,	0x56aa2225,
-0x04ee1756,	0x0bf598ec,	0xfd0d75f4,	0xcc87d91d,
-0xf3ab70be,	0x5719b2a6,	0x9c1212a7,	0x5bcfd4a7,
-0xba07238f,	0x1e4571f4,	0x9e872e9c,	0x74ab36da,
-0xc00d1a89,	0x2190f089,	0x12ee646d,	0x2895d335,
-0xc3f4c779,	0x0294df2b,	0x6fe754f8,	0xcee161c7,
-0x971aa78a,	0x8d067af4,	0x77626aa5,	0xb97bd5f0,
-0x71f09e7f,	0x69cd562c,	0xa0893f41,	0x507b7309,
-0x3cd26b46,	0x36ce6092,	0x0ae56616,	0x962c4698,
-0x0aad0d3d,	0x1b7bfd33,	0x5e3712bb,	0xc66987e7,
-0x42428867,	0x614a8b9d,	0xb1d127cb,	0xe5a965c9,
-0x56a5a213,	0x240790c8,	0x745c0950,	0x897da696,
-0xf65d24bd,	0x2617eea5,	0xd2349c52,	0x39b4fdd7,
-0x5dfdfe3f,	0x0c3e4c1a,	0x10db9fc0,	0xf81bbcba,
-0x4b5b0e28,	0x767511bd,	0x2b15bb50,	0x0349ec8a,
-0x63481733,	0xbb899174,	0xd1065e6a,	0xbfa14024,
-0xfaa727db,	0x0021f11b,	0x0a24c0c1,	0x9b55db09,
-0x15ba31c5,	0xa972be16,	0x515e3cda,	0xd3d33e51,
-0x5d372c14,	0xdd9160e4,	0x7c877e1b,	0x796cdcba,
-0xf6faf1bd,	0x77048424,	0xb4ecd723,	0xb672c546,
-0xfc152a26,	0x76423bce,	0x8a7a30fc,	0x005b181a,
-0x79fc967a,	0x253e1b6c,	0xa947e4c2,	0x1d21ce72,
-0x4e1dab59,	0x938eb0f8,	0xb4b0b387,	0x5fb04592,
-0x2ee4a528,	0xe2d10729,	0x2f4c5f42,	0x873563ee,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  436-MU165142.inc  */
-0x00000001,	0x00000042,	0x05251999,	0x00000651,
-0x48947659,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x80627220,	0xd85bd855,	0x47639013,	0xd3cf398c,
-0xe0a1aca1,	0x75782688,	0xbcbd0e4a,	0xd08d2101,
-0x6cdce304,	0xa5cb0810,	0xde41a357,	0x430f1d76,
-0xd77f20c4,	0xdc427548,	0x03599409,	0xd179d15a,
-0xc05179c8,	0x06dcd88e,	0xe3f80686,	0x9d0068ce,
-0x7cbe2fd6,	0xd12c8c55,	0xaac4bbeb,	0x23de94f7,
-0x9b782d19,	0x9048d664,	0x3a742b9e,	0x806b6df8,
-0xcabdd14c,	0x4809ed47,	0xf21ce6ca,	0xa7734c74,
-0x5a2d1322,	0xeeb58f7a,	0x970d128b,	0x3dd69a0c,
-0xe778f32b,	0xe9e401fc,	0x1894bfb4,	0xc7a36d10,
-0x873ec296,	0x35639275,	0xb5689dcb,	0xb6cd13f2,
-0x19c16f65,	0x8c82c105,	0xd09b0575,	0x1d027f32,
-0xe96523fb,	0xecf75287,	0x16aa137a,	0x9bddca88,
-0xd79586e8,	0x6959a6d9,	0xac21f8e4,	0xdb23fcbb,
-0x101cb728,	0xb8f20d81,	0xb536da71,	0x773d69f1,
-0xc838aaa3,	0xe88f671c,	0x45662670,	0xf5706933,
-0xa820ca40,	0x792c651f,	0xca1a0b31,	0xd87f50df,
-0x388a16ec,	0xf0d10ce8,	0xaa7cf7e2,	0x71ec5a12,
-0xa1af36bb,	0xb1c61da9,	0x0ce8909c,	0xae710f96,
-0xdeccbdb1,	0x21fd3a5f,	0xfb049d57,	0xfca6763e,
-0x2e17f3aa,	0xf30e173e,	0xf1181dbf,	0x392eb4e9,
-0xa85313fa,	0xe1bfaa6a,	0x4b9f3fd3,	0xb73ead33,
-0xe8bd6226,	0x4f3f577c,	0x82331156,	0xf795e927,
-0x030a2044,	0xa85b1d47,	0x9f8bb50e,	0x10195003,
-0xb791ea84,	0xb2344044,	0x30be7898,	0xbc6fcda3,
-0xf102dbcb,	0x334d5a52,	0xcdf9ef39,	0xd92e680b,
-0x08586800,	0xea2d4023,	0xca4dca39,	0x0bc9e5cd,
-0x884f9b74,	0xccd1cb1a,	0x575f266d,	0x91a39fdf,
-0xcfe31993,	0x43f8f402,	0x9eff273c,	0xf7293b38,
-0x27f1cc5c,	0x9dfaa3ac,	0xa6f75ba9,	0x3685a542,
-0xb487f2a6,	0xa8f3a936,	0x1dc0966f,	0xb1419ffb,
-0xeb409ca7,	0x28d16bcb,	0xc2eb7670,	0xeddf4746,
-0x1a7b5205,	0xc31a4bd3,	0xf2ae9fce,	0x2e68169a,
-0x97c91dfc,	0xd11b93b6,	0x44f728b3,	0xb9036dcd,
-0xc00dda04,	0x40d309ec,	0xa4dc6048,	0xd6969a3f,
-0x1e9f0770,	0x8192f034,	0xb89e5794,	0x2ead7a74,
-0xa5eb3ca9,	0x9937ce11,	0x0e901448,	0xba247b0b,
-0xdf15ae0c,	0x2644e567,	0xd9c3e518,	0xd73579d8,
-0x1282fc61,	0xff4649cd,	0xf0a00348,	0x378ec04b,
-0xbae77095,	0xc8a14f7c,	0x4d107cfb,	0x814803f6,
-0xe6123a8f,	0x46ffff04,	0x9621a3a4,	0xc6f5bf57,
-0x1e2661e5,	0x9910270a,	0xa39c9a88,	0x0aaef1a2,
-0x9bbfc380,	0x8690a192,	0x15c72f1b,	0x93f95f79,
-0xaf395ee6,	0x8dc8a8c0,	0xe9e73a0b,	0x4c582200,
-0x47edf993,	0x01c5aff8,	0x47c2e0f5,	0x597930f7,
-0x0650f3b6,	0x7d7a2aa2,	0x71779fad,	0x176ae4b7,
-0x43b5c040,	0x71ba7f89,	0x1de736cd,	0x6daf5622,
-0x6ae978d2,	0x00c89e34,	0x72a85f6d,	0x7ae4dc59,
-0x3c29d6e8,	0x61136bd6,	0x4f53aba8,	0xb5509bf4,
-0x7bcd1665,	0xc68f5fb5,	0xa68a76eb,	0x27c80573,
-0xfa351d71,	0xe5a65631,	0x3cce28ef,	0xe1229b86,
-0xfe48a500,	0x1c567d21,	0xc3087364,	0xd2e8837c,
-0x09186b8f,	0x34c9f25d,	0xe652122e,	0xfbdece8b,
-0x372ac80a,	0x258b860d,	0xec221231,	0xa9007152,
-0x004ebd30,	0x9b5011ba,	0x9e0518f4,	0x199ee23a,
-0xa8d84817,	0x9d097dc5,	0x3704212e,	0x6ffa175e,
-0xa75f603d,	0xdab10d1e,	0xd0c1cebd,	0x613dfa46,
-0x501017d6,	0x390293fd,	0x0d78eb6d,	0xb70f26b3,
-0x7d6bf9ca,	0xf4318b61,	0x1fd450bf,	0xb4264709,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1107-m10f2421.inc  */
-0x00000001,	0x00000021,	0x06102003,	0x00000f24,
-0x83ed02e7,	0x00000001,	0x00000010,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x5715f121,	0x440ce2fa,	0xd5d090eb,
-0x70b3e977,	0x92320e8c,	0x4f989906,	0x36907442,
-0xcc4b12e2,	0xb456a6ae,	0x0ad5bcf7,	0xe9f0a425,
-0x70b932d2,	0xe66202c9,	0x350fd81b,	0xd560a828,
-0x15332f71,	0x3c1a2e5b,	0xa661b83d,	0x6528dcc7,
-0x76c5c944,	0xa065f688,	0x3cc01463,	0x49f31a7b,
-0x79cac706,	0xc9fae8bc,	0xc4b5fbf8,	0x2451d954,
-0x232d756e,	0xf1b52f47,	0x89368878,	0x8742b987,
-0x8a0108a4,	0x44b8605a,	0xc2dbd287,	0xb44ecbb9,
-0x7396c41e,	0x470b8062,	0xd23b7917,	0x6c20092d,
-0x0bcba2d7,	0x575d2d99,	0x38295434,	0x69be061c,
-0x18942ed5,	0x46e42cba,	0xa2964393,	0x0e74f74b,
-0x3637dc23,	0xd1784fba,	0xfc3dfe26,	0x6aabb127,
-0x59a37a17,	0xaf5326b0,	0x744189b7,	0xe4c3a8fd,
-0x9b9cd170,	0x260d7270,	0xd3da3bf6,	0x94c74a56,
-0x7c598514,	0x27e5c754,	0x19f54591,	0x469329bd,
-0x0a3e0073,	0x4d93b74e,	0xabd1073e,	0x4cc88fb1,
-0x60db113e,	0x710fb8aa,	0x900642dc,	0x79a1de06,
-0xa61ec6f9,	0x85d1f05e,	0x4267267c,	0x04299516,
-0x1a4a7833,	0xb9e90c17,	0x002d82dd,	0xc16d8583,
-0xe32036ca,	0x147f51f1,	0xa5918b9e,	0xaf5c5324,
-0x05e6cd0b,	0x45b4ae8d,	0x730c40f3,	0x216e677c,
-0x3da1b00b,	0x7b7f4318,	0x8bc68c6a,	0x7a8a63a2,
-0x90bb9d83,	0x49adf5fc,	0xf34ae404,	0x1b214f93,
-0xd455db1b,	0xffeec367,	0x6bc1edd6,	0x5c288f68,
-0xe44b9377,	0xd0e314e7,	0x29d04ba6,	0xb5805ceb,
-0xf4c3e44c,	0x085bc99d,	0xf8ffa80a,	0x990defd9,
-0x080028d4,	0x388b7cdd,	0x593984a3,	0x4c0a6b9e,
-0xadd4d26e,	0x712ed499,	0x4020b0ca,	0x4942fdf9,
-0x237c6de5,	0x56be0c27,	0x561043bd,	0x228f73c9,
-0x2e7548fe,	0xec510be0,	0xb7740c07,	0x78851cf8,
-0xae205a08,	0xa66dd681,	0x7330b0f1,	0x9c4037b7,
-0xe3e5acaa,	0x1b2716bf,	0x6c6d1eab,	0xfbe2ed01,
-0x81303e33,	0x33422c0e,	0x6027b0eb,	0x7e4fdcf6,
-0x004e2184,	0x1653f8df,	0x8505f26c,	0x71041c13,
-0xcaf4e533,	0x4d868fa0,	0xec642902,	0x059e5139,
-0xe53bf189,	0xa0cf56a7,	0x2cd6dbf4,	0x41007b03,
-0xa1835c02,	0xac53e4c5,	0x07d9756a,	0x05ddd6df,
-0x8539010d,	0x3b7780b9,	0xff516326,	0x0c60e6c2,
-0x3f3d9e04,	0xd5cac62e,	0xc14da162,	0x06627e4f,
-0x2ff1bca2,	0x8c302c93,	0x2b7f616e,	0xd080c36d,
-0xc5104698,	0x5c45c644,	0xac4c41d1,	0xb0b15b5e,
-0xcc10fb90,	0x19d92084,	0x0ad5bb51,	0x1c678ab5,
-0x5e2afed1,	0x6634a6bf,	0x54b22cb5,	0x48686646,
-0xa57273c2,	0x17cf3f49,	0xe5ce1ebc,	0x19d39091,
-0x8791973b,	0xb5f44407,	0x5a8f5060,	0x3634832a,
-0x0a750b7c,	0x9b2cdbfd,	0xd7c1184a,	0x118731f0,
-0x8190434e,	0x19a1b4ff,	0x047dad90,	0x1bb0d53a,
-0x572f018b,	0xbe68c306,	0x73848798,	0x35c531a1,
-0x7550e5c9,	0x97b8d4d5,	0xaa50f56e,	0xa3cee83b,
-0x1a4023a0,	0x5e0fc940,	0x983194f7,	0xc7604dbe,
-0xf25a04cf,	0x02bbf427,	0xcb0fbffb,	0x558e0ebc,
-0xfa52e8c5,	0x37eaa143,	0xd33c1060,	0x55c4335c,
-0xce995499,	0x1c8b68a9,	0x7c269639,	0x4022b150,
-0x4250c7f4,	0xd5e4d3db,	0x2ff4ed03,	0x36b668e0,
-0xc26704ff,	0xe62cbc14,	0xa0a4ebfc,	0x8b53c451,
-0x8272406f,	0x68ab2da3,	0x9ca241bd,	0x83d9e495,
-0x61954000,	0x843a57e3,	0x10f1897b,	0x7f8867e0,
-0xe504cbe9,	0x8754366d,	0x8ade70bf,	0xac2dd3a9,
-0x41df4d81,	0x5b670297,	0x5c07bdd4,	0xf00e6717,
-0x7360fb7f,	0x3743c5d5,	0xb8adda7d,	0x1bc9de27,
-0x08649bed,	0x5181dd68,	0xcf05ea0c,	0x7a67cd39,
-0xd8110301,	0x65465cbe,	0xd77d1041,	0x64b1771a,
-0x784fd182,	0xca9d00b9,	0x39695291,	0x2b3d4de1,
-0xd9380b3a,	0xfc5666d9,	0x5f820e27,	0xc6be32ce,
-0xf055521f,	0x0354c95d,	0x8fbe1b6e,	0x8bf13c00,
-0xa38bfb82,	0x0655ad0e,	0x41030301,	0x3379ae69,
-0xb3032933,	0x099f9283,	0xb590385f,	0x67cade03,
-0x53a5feba,	0x422e401a,	0x02ff1f2f,	0x03866975,
-0x70f1f572,	0xd4c05101,	0x26b66844,	0x1a93f0f6,
-0x94593d97,	0x887b722d,	0x57ad233b,	0xd3c7977f,
-0xa1b02024,	0x523cf697,	0x2dd20cb5,	0xab49e9f0,
-0x0aa2dfaa,	0x60cc0d0f,	0xb8f83218,	0x6d62392f,
-0xe9826fd2,	0x44048284,	0x639eb528,	0x060c7cff,
-0x7ea2c3dd,	0x3d1c7acf,	0x4137f9fb,	0x0096f96d,
-0xb63634b1,	0xc1483db3,	0x17f501da,	0x02088c3f,
-0xdf5dc11f,	0xb0f0dfc9,	0x44139c6e,	0xd7a15ba8,
-0xf3d5b372,	0x6b5a08b7,	0x7e43b4b2,	0xd38e1449,
-0xfff28de0,	0xe392bcc5,	0x48ae5910,	0x0da38cb0,
-0xfcbf9742,	0xe06a5487,	0x5e61019c,	0x8dafb3b9,
-0x57344d2b,	0x11b79fa5,	0x4c7fb144,	0xe103f809,
-0x0fb905c2,	0x660671a7,	0xd846266d,	0x7b283110,
-0xd3c62086,	0x37bca79f,	0x75656523,	0x0adb0487,
-0x6c3af254,	0x77b82881,	0xcde94898,	0x6a665aff,
-0x5608599f,	0x333d31c6,	0xe65847e0,	0x2288ede2,
-0xda129233,	0x659210bb,	0x377fb789,	0x5201d054,
-0x38b277e6,	0x3acfa257,	0xc058e53f,	0x1da43574,
-0x40e1f496,	0xfb94affd,	0x7d438871,	0x3d6b550c,
-0xcd63e737,	0x8a422ba2,	0x89b1ba80,	0xdc5b1133,
-0x9e79e4a4,	0x4b96300d,	0xc22f9cd6,	0xee4d4bcc,
-0x9fe0fcab,	0x576761d6,	0xb6e873ff,	0x21edd45a,
-0xaae4b067,	0x3ae52f5e,	0x910e2365,	0x7da9d04d,
-0xaf71b07b,	0x45ef40c7,	0xd4ba6224,	0x6bacaa75,
-0xefa4db2e,	0xb4c31b79,	0x54f43ea9,	0x04f8e83f,
-0x53e2c9f7,	0x8db44cd7,	0x0ea25b66,	0xd87f5c2c,
-0xe96c9d87,	0x2ebca750,	0xaea8c953,	0x98c79dd7,
-0xb0403778,	0x1e952d41,	0x85982c1e,	0x1af566a4,
-0x7b6fe713,	0x46b462d4,	0x2cd47bfa,	0x1c6a68aa,
-0x6eaa133f,	0xbfd22f3f,	0x12174dcc,	0x47a2f741,
-0x8bcbbbdb,	0xc9ef98cb,	0xe29ab9c0,	0x47b4987d,
-0x20d1f9fd,	0x373a5205,	0x436e1733,	0xb11f73e2,
-0xae1044db,	0x37c58139,	0x24ab40f8,	0x6d289f8d,
-0x5f62ca41,	0x6a9517fc,	0x7fe844a4,	0x33df706f,
-0x8ee15ee3,	0x2bd979a8,	0xeb214552,	0x302da2ff,
-0x70ab6453,	0x14c9daea,	0x965870c5,	0xd83ed7aa,
-0x2afae19f,	0x9b1e0a42,	0xc782ac32,	0xd58e5e96,
-0xff59dea5,	0x2deefefb,	0x844e3fc4,	0x2b5da19e,
-0x25165c3e,	0xbd0c1726,	0xdcce9175,	0x7bbded39,
-0x0e7f9a66,	0xcc31d985,	0xe41a40b5,	0x536267a2,
-0xc1c50b09,	0x29119ea9,	0x9bc328ab,	0x3246f0ae,
-0xea534459,	0xa24c3cdf,	0x15685876,	0xe0fa8c37,
-0xd769ec85,	0x20c2df4c,	0xdc83b5aa,	0x9585dfa9,
-0x1e01ce77,	0xb79d5f70,	0x3563d017,	0xaa205ca6,
-0x52a0510d,	0xaabaddce,	0xe33bf64b,	0x80e3936e,
-0x16057435,	0x87a4a9d1,	0xb4c006b8,	0x4a54633b,
-0xed7038ad,	0x040dcf11,	0x85cced44,	0xed4251ac,
-0xd7313899,	0x31dbcb9c,	0x4748e453,	0x2cbeb93d,
-0xd658e2b5,	0xfdca6e33,	0x0b6bcaf3,	0x112b5d91,
-0xcba2e2ce,	0x0be84dca,	0xcd890825,	0x8f488963,
-0xbed55a87,	0x723bab52,	0x1863e24f,	0xa2df4790,
-0x59838ef7,	0x93270607,	0xb987d2c0,	0x1ea917ad,
-0x872b1a14,	0xeb026a8b,	0x4d3c60b0,	0x234ceb88,
-0x85054bcb,	0x3999fe14,	0x233c2b38,	0xa46aea96,
-0xd6f654a6,	0x412fe4e3,	0x8d371386,	0xb776a912,
-0xe54f0cf3,	0xf846023d,	0xc1d21956,	0xcad10e9d,
-/*  1467-m0df330c.inc  */
-0x00000001,	0x0000000c,	0x04212005,	0x00000f33,
-0x58c41efd,	0x00000001,	0x0000000d,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x45fda71c,	0xc5c83cb3,	0x7adca7a3,	0xe906ce8f,
-0xc4c9223c,	0x21cfd56b,	0x12cb5b2c,	0xcc5ea32f,
-0xfa3ebaf7,	0xf33760bc,	0x9ad2f278,	0x388b2cac,
-0x6695b80d,	0xdbba67b7,	0x2f309750,	0x2e02d473,
-0xdb6c4476,	0x3128b0de,	0x21122278,	0x1e096794,
-0x2a1e624f,	0x29a9baab,	0x992e0e3d,	0x2f99bba9,
-0x3cb04252,	0x16c6b72e,	0x53330dc6,	0xc5222b17,
-0x394eaa75,	0x37c4d00a,	0xbd40f740,	0xe51c925d,
-0x725c9151,	0xd3a53ca3,	0xc839312f,	0x2d55e8dc,
-0xc85d99d8,	0xf9928fe6,	0x589b2dfc,	0xd4293d1b,
-0xe14a7bb8,	0x3a0880c0,	0xeb13e903,	0xf23eb00a,
-0xe293b540,	0xc4b12573,	0x85dbd1f8,	0x0d5cfb5e,
-0x3df68fbe,	0xe7f30fe4,	0x469bf086,	0x52a3528d,
-0x1425c7a1,	0x08994fdd,	0x6ac3b0c0,	0x6d19c1a1,
-0x56e653ef,	0x5867036b,	0x69a115f7,	0x30c35b67,
-0x75030427,	0x7c034a2e,	0x0cd2e889,	0xd4bbda8a,
-0x516552fa,	0x2b9463c5,	0x62202b82,	0xe9b0403b,
-0xc8615504,	0xde514686,	0x94fe6f37,	0x26e95233,
-0xd098d60e,	0xfb098be2,	0xcb8ae3d5,	0x6252bc84,
-0x79a468b5,	0x2568dec6,	0x2c60ab5f,	0x50d78f40,
-0x381796e0,	0x751e28ca,	0x6b1003b5,	0x365f1bd2,
-0xadbdc178,	0x54c18945,	0xfd6056ce,	0x8d959eda,
-0xe299e5f8,	0x359f24e8,	0x363e35bb,	0xa3deda38,
-0x61773547,	0x8bcc3b8d,	0xa16b34a4,	0x39cdc595,
-0x7137c122,	0xbe9813c2,	0xac72a9fe,	0x7571c3f4,
-0x001b0510,	0x26400b66,	0xc5c872ff,	0x4cc2caa0,
-0x38ba9384,	0x7cccf10e,	0xb69e8dba,	0x25765305,
-0xd79eee64,	0x40cff2bb,	0x6c25208e,	0xdc1f4211,
-0x948b3990,	0x340a1e25,	0xa61c7ad8,	0xe968250c,
-0xb77e48ff,	0xc214c91d,	0xdfb4e78f,	0x3a710e38,
-0x11d6d920,	0xe2735793,	0x8c7d592f,	0x12b6fff7,
-0xe2662cb1,	0x30e7024e,	0xa2ef683f,	0x382a182c,
-0x6f6b8682,	0x002617e1,	0xa1d8df0b,	0x371b31d2,
-0x4b8b0873,	0x2ad87046,	0xaccce0d5,	0xa64cab61,
-0x2b26eee6,	0x2a432eea,	0xc856bdac,	0x83061d84,
-0x3489d061,	0xa5fa0d92,	0x3b3361fe,	0x204c5f95,
-0x491ee713,	0x8f632e53,	0xe3a93e14,	0x417b7baa,
-0x2dceaf08,	0x2dc9f9fa,	0xa875a995,	0x7cf71bd0,
-0x882a84c1,	0x47d31cbc,	0x3222b96e,	0x39f889ea,
-0x224487e5,	0x77bf22a4,	0x9aae5363,	0xb43b278b,
-0x6dd117a8,	0x2b3cc820,	0xbb6ce2fb,	0x885d19d0,
-0xe056cd29,	0xb544d68a,	0x888c83dd,	0x20345f2b,
-0x24bf175c,	0x9c84eddf,	0x6b092d09,	0x14e60529,
-0xe2100950,	0x368a7f49,	0x21cd820d,	0x2ae4e6cf,
-0xa354d480,	0x0178af0e,	0x0352ef88,	0x31d0776c,
-0x9773994a,	0x31a38a0b,	0xd080e826,	0x800f5ae0,
-0x179f0072,	0x21ef6514,	0x9ffcafa9,	0xabedbb31,
-0x9d231bc7,	0x8cf5d8b0,	0x923427d1,	0x372fa035,
-0xbbd9d44b,	0xb45dbf72,	0x2ed1bde3,	0x1dad7c6a,
-0x80819026,	0x20f63235,	0x2fe73bf1,	0x3029768e,
-0x49dd331a,	0x0ee94c90,	0x03ff1030,	0x321f8793,
-0xae32ae76,	0x30a103d4,	0x70c6f474,	0xc4e3ecc3,
-0x66b6962f,	0x22ad66db,	0x5f4596d6,	0xe21f30d4,
-0x54a7d44f,	0xd1b45997,	0x4c9a601a,	0x34cd9146,
-0xb7c14fa2,	0xfb191a9a,	0x46286984,	0x457130f6,
-0xbb0faf3c,	0x3921327b,	0xc07d62bd,	0x6f7f9b8b,
-0xa335aff0,	0x44e50b59,	0x90d4fde5,	0x23e1eeb9,
-0xfa01f05d,	0x653b053d,	0x82879bb5,	0xa519e9c3,
-0x37bc6704,	0x2f31e7be,	0x9f331be3,	0x806b1685,
-0xd1b9c361,	0xa9d0aa28,	0x55f282d9,	0x2d8766cd,
-0x22c50d1d,	0x89fc9dcc,	0xb68c0a7d,	0x72c3968b,
-0x07dc7a7b,	0x3704b5d7,	0xf83f7fbf,	0x74d4e514,
-0x3c7d2a14,	0x66930982,	0x1e74a2c3,	0x264e70f5,
-0x8eedef74,	0x798245d0,	0x3e7f5cc4,	0xde7bc37f,
-0x66fcb4ff,	0x2863b856,	0xcdfaf436,	0xea705543,
-0xfc5b5d03,	0xd7a9307e,	0x00701136,	0x3f3e3d8f,
-0xca2c8fd7,	0xe07c339c,	0x1463729b,	0x5e649a88,
-0x64df56a2,	0x3a5284de,	0xb9176e26,	0x6b596309,
-0xf9cce67b,	0x5ee20140,	0xab5ffa99,	0x343001ed,
-0xebdb5e56,	0x684a34c3,	0xbbba8603,	0xcb21e7cf,
-0xd558b806,	0x23ceb69a,	0xe9647235,	0xfa21c5e5,
-0x9a3e151f,	0xcaaad78e,	0x5f4e2f62,	0x2794a25f,
-0x22d4e4b9,	0xffd3d734,	0x15e963bb,	0x6498242f,
-0x817b67f1,	0x297f1b8a,	0xdeea3945,	0x4ed1afb0,
-0xa48f6168,	0xf20aba65,	0x202216ba,	0x347858b2,
-0x7b77dae3,	0xdcfed474,	0x2318cd45,	0x2f43d675,
-0x8c97a56b,	0x35622d1e,	0x5c9e8507,	0x05b23bc6,
-0xe0e064fc,	0x3f6b1e29,	0x22d31146,	0x293c5aec,
-0xe4305363,	0x06bd5d59,	0xa26f3833,	0xf2f577d3,
-0x1fc2e51a,	0x229f45f3,	0x04c969dc,	0xc2c138de,
-0x1073ede1,	0xfff23304,	0x76c6cd54,	0x37972029,
-0x6a028240,	0xcb766a6c,	0xe45edcba,	0xe0fc0ab2,
-0x75434354,	0x3f1081a6,	0x73d47441,	0xd1c37cf3,
-0x84b2cd76,	0xe2ff45e1,	0x84a70fdc,	0x2c2e8df1,
-0x897bfd22,	0xcbd9af5b,	0xba0d3a3c,	0x1b09665c,
-0x10f7f7d2,	0x204de839,	0x49430f96,	0x2d2ebead,
-0xa26a5c8f,	0x15f6ecd1,	0xb5ca1ff5,	0x22d965f3,
-0x44751954,	0x266dc552,	0x7d43e5bb,	0xdf4b1f5a,
-0x3c0f2a1a,	0x359c9c3f,	0xf096bf30,	0xe15553aa,
-0x2bda0831,	0xd42d6010,	0x304e53cb,	0x2191dfc9,
-0xbee94875,	0xf7b0ec83,	0x2207174e,	0x4bc7535a,
-0x8555bd49,	0x32052583,	0x6cfd21fa,	0x688fab55,
-0x33aee02a,	0x45e8cbc5,	0x663f8256,	0x27f194d7,
-0x1357258a,	0x65ec6bcb,	0x494ec91b,	0xd9294640,
-0xbe66c1c7,	0x20e330c4,	0xbc881b29,	0xe3598be3,
-0xda3ea3a1,	0xcf9a928a,	0xdc4a80e4,	0x26cdafd3,
-0xbb69f7a0,	0xeb8ea752,	0x7178ba6b,	0x2897330c,
-0xd1b55818,	0x3dcb45fa,	0xd247ae1f,	0x0c321066,
-0x1cb5d0e6,	0x3a26571a,	0xc2f7f883,	0x35078a50,
-0x0e7076ba,	0x0f6f56cd,	0x244427d3,	0xd6f772de,
-0x945a89ea,	0x959fe859,	0x32a12387,	0x0f9e28a6,
-0x5765abe0,	0x705e0055,	0x77479ad1,	0x465a656c,
-0x5ae66df6,	0xc8003c87,	0x8a01f279,	0xee339935,
-0x092f7107,	0xb0343860,	0xd8cbfee7,	0x7e395a60,
-0xfee92cef,	0x86467a1f,	0x919a0cd2,	0xd1839c64,
-0x08f45639,	0xd01ebabc,	0x8423c84f,	0x13a46247,
-0x21919c77,	0x5246336b,	0x419c3250,	0xe7ceaf92,
-0x053c8e88,	0x7f32dfe4,	0x7546be6f,	0x952afc0e,
-0xb3ff1bd4,	0x07209560,	0xbf7e6f17,	0x586ed9c3,
-0xb19c766c,	0x362b7a90,	0xd346922a,	0xae4bb663,
-0x31253c02,	0xd765c9fa,	0x4b3eba52,	0x654f4989,
-0x9bebe752,	0x816c8ed5,	0x61cb366a,	0x9d569d53,
-0x69f80992,	0x83feda54,	0x2f597721,	0xd5dcc0b8,
-0x33d8a392,	0x767f04c0,	0xf951e755,	0xe6fd02e2,
-0x2287d6fd,	0xc1a67938,	0x3bd4bd5b,	0xd1b2275c,
-0x900ac73a,	0x1146ff57,	0x6fbc1e0e,	0x35190704,
-0x0ac32212,	0xd063f20c,	0x32ba4a23,	0x47ee4127,
-0x572104b1,	0x3616b8f8,	0xcc2d0057,	0x0f6874d7,
-0x86cfb62a,	0xb4dd6bdb,	0x55088d4d,	0xfca14905,
-0x653f8e17,	0x1416212a,	0x0f4c4924,	0x3b7e8a5d,
-0xee246bef,	0xf561936f,	0x6a418d5c,	0x82a552e3,
-0x351523e0,	0x2d760fa4,	0x7ca18f4a,	0x6c9d411b,
-0xea4a38bc,	0x6675850f,	0x6d4384ea,	0x9d6bac13,
-0x1d8bc278,	0x790289d8,	0x1c1cbe8f,	0xe89cb07c,
-0xb62823fc,	0x75fedf6a,	0x7d4cbaf5,	0x71d501d5,
-/*  540-mu267238.inc  */
-0x00000001,	0x00000038,	0x09221999,	0x00000672,
-0xffd6aa2a,	0x00000001,	0x00000004,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xa2560856,	0x779b0125,	0x1443265a,	0x0a535feb,
-0x70e89c38,	0xd71286b0,	0xa0ec5939,	0x525bccb1,
-0x6fdfa495,	0xe99aac23,	0x73d359ac,	0x4104d3af,
-0xc8a1849d,	0xd8dd20b9,	0x591df59a,	0xb23c9ce8,
-0x5720703d,	0x28791338,	0x37b7440c,	0x3f4152d3,
-0x946e068c,	0xbd4cbca7,	0x02e2980c,	0x78902676,
-0x7c66c91b,	0x55e1a9ca,	0x55cca14b,	0xd0a82082,
-0xbe66f162,	0xa499f342,	0xee344972,	0x0b4f8aa4,
-0x3c26d31f,	0xa2492061,	0xd845fee0,	0xb253d108,
-0x6ccc9b4b,	0x92ce1712,	0x11fcbc36,	0xe384d472,
-0x8447afa4,	0x599b1a33,	0x78535766,	0xeb4f2543,
-0x91629f05,	0x6af162d5,	0x949517b9,	0xc38e49a6,
-0x5805826e,	0xd03155dd,	0xcc8800bb,	0xb98e9a71,
-0xb75fd98a,	0x96c79e9a,	0xdf7478d3,	0x29a43071,
-0xbf2a5470,	0xd5be473a,	0xf66c074d,	0x7ee133f5,
-0xfaa5823b,	0x9fce08e1,	0x43bffec1,	0x12644f98,
-0x26fe9f43,	0x096f8940,	0x703a390c,	0x598abb8a,
-0x8b79f053,	0x5c294000,	0x6221fba4,	0xeb226211,
-0x6b1e7e6e,	0xc5233cc8,	0xae9ab65d,	0x3aa0a89f,
-0x0e422a22,	0x0f1886ef,	0x3379e3a6,	0x12f12284,
-0x409f4e06,	0x41efac41,	0x07693087,	0x7a9f1916,
-0x31269e69,	0x9caf7cbb,	0x3ff0bee6,	0x3ef2a057,
-0x1de737d2,	0x8df81860,	0xc41ba7d0,	0x39584115,
-0x1321abd7,	0x97dbe297,	0xa376ca1e,	0xaaf6b25b,
-0x0c9b1d13,	0x363e1074,	0xc75e2a58,	0x79774604,
-0x8ebe27aa,	0x95443c05,	0xb716ee48,	0x77a05fb7,
-0x482eaeef,	0xeac5e94f,	0x79e3ef59,	0x2cd191db,
-0x2b71c633,	0x95c675c5,	0xbf1e639b,	0xbac226f3,
-0xfb2fac20,	0xa9e72a20,	0x5a46b3ee,	0x1743bec9,
-0xb89df094,	0x15af2d36,	0x45944344,	0xb41d5a97,
-0x2216d4b7,	0x98ba1092,	0xc97d4982,	0x336f6c35,
-0xc43df462,	0x9fa0dc3a,	0x7a240c30,	0x7d248a85,
-0x0995bbcf,	0xe9929521,	0x5d828729,	0xc8f41f11,
-0x2d0f0e4e,	0x8e67c634,	0x68567623,	0xc237ba69,
-0x78a6b1d9,	0x6f6c2ba8,	0xa8908a4f,	0x909b771c,
-0x0428bb10,	0x7c1b33cf,	0x76af41c8,	0x6037d37c,
-0x5ded7bbb,	0x534c6d21,	0xd9a6343b,	0x74482250,
-0xb961501d,	0x0988d71b,	0x073dedea,	0x5d0a4702,
-0xca22ce05,	0xf14f6f72,	0x8f7f744c,	0x1a78507e,
-0x4b0b3b33,	0xe5a62813,	0xb76e4b43,	0xbee09325,
-0x21a02fe8,	0x513abf7a,	0xe780fc18,	0x25b7ae25,
-0xec70dec0,	0x25d1fc14,	0x47fc868f,	0xd348e013,
-0xab83414a,	0x48e8afaa,	0xae9e7eb5,	0x4591f771,
-0x8209dd0c,	0x84929f07,	0x7fb35bc9,	0x9ce719af,
-0x339470a1,	0x85f7be9e,	0x2ea78a4b,	0x7cf3e760,
-0xe0cf2ee2,	0xc8c60ee0,	0x06843417,	0x9ccb4cce,
-0x117cde32,	0xe6b68d75,	0xfaedfa5f,	0x6407e9f8,
-0x6db65a34,	0x07717a0c,	0x3578a834,	0xcf9f70e0,
-0xbb0c1401,	0xc7624cd2,	0xe8102ce4,	0x2c342121,
-0x353c2bc0,	0xa08d06e7,	0xee40ca20,	0x069f1b72,
-0x1da2d573,	0x766565dd,	0xf684f183,	0x1a9a4c6f,
-0x9566f043,	0xe083be7b,	0x1d9c5ed6,	0x85c01b1e,
-0x1481bde2,	0x5e3d1b22,	0x0a47aeb2,	0x36c29f21,
-0x9b5604ca,	0x8519256a,	0x5bf0e38d,	0xf061f342,
-0xf3cc6aff,	0x3e928f99,	0x6c65bca7,	0x950fb3cd,
-0x7bc6cc53,	0x5c3bb72a,	0x177eee6e,	0x4f1f0363,
-0x7e2d8e88,	0x3ab83f54,	0x062f818a,	0x2b53143c,
-0x6127e61f,	0x95cf1f48,	0x04798f41,	0x61ba5878,
-0xb0fd99d2,	0x71c835e4,	0x3c4a814a,	0xe07eaa41,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  433-MU165045.inc  */
-0x00000001,	0x00000045,	0x05251999,	0x00000650,
-0x429c2f70,	0x00000001,	0x00000008,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x77567ca2,	0xdfef9b71,	0x3f95a175,	0xbb90abf9,
-0x8207c844,	0x2e319608,	0x84aac65e,	0x97aa48bf,
-0x19162ecb,	0x8e8992b4,	0x96080bb2,	0x53c01831,
-0xc29ef4af,	0xf967b0ab,	0x1b842ce8,	0xcd848c67,
-0x904a21dd,	0x3b072641,	0x801b9ca3,	0xc96a0995,
-0x5f083b53,	0x9f008055,	0x80da3025,	0x119500bb,
-0xd2c61199,	0x892c8e81,	0x51eed326,	0xd205a6f6,
-0xc1967209,	0x1f39e8c7,	0x9d4d2e7d,	0x80f4c001,
-0x13660fb4,	0x9dd8c7bc,	0x81f8d10d,	0x44160784,
-0x9430ba2d,	0xd242a7ab,	0x49262fc4,	0xa5662a95,
-0x9f908eca,	0x763b7ac2,	0xefcf36d6,	0x8f42d959,
-0x7f927c4c,	0xfa380ebb,	0xe8d5ccde,	0x51386ee4,
-0x9fb76469,	0xc0c896b7,	0x5afa6156,	0xc1c61ab6,
-0xcbb860b8,	0x0e7758a1,	0xc3209fde,	0xf676d946,
-0x43468b8d,	0xf83b6ba7,	0xb56e1439,	0x1222a434,
-0xb956c9a1,	0xe9deb385,	0x178da51a,	0xa62b724c,
-0xa3229fdf,	0x082ff04f,	0x8417980a,	0xf1528736,
-0x6415599a,	0x97a65c19,	0xb50eb28e,	0x333b4cbf,
-0xdcca5404,	0xa09f560d,	0x755c054e,	0xdc1a6982,
-0xe4d4bc36,	0x6c55c9ca,	0xbf786948,	0xd109ed91,
-0x47825bca,	0x9d75c244,	0xda540f0a,	0x58b6257e,
-0xdca5de08,	0xc16a0599,	0x10253e7c,	0xc3ffcd71,
-0xce2cacfe,	0x08cc52bf,	0xcc7984bb,	0xc51015f5,
-0x4f5c63e4,	0xd90579b1,	0xa3c29d6e,	0x73223879,
-0xf28aa49f,	0x8738c565,	0x7ef3a081,	0xfadd4de5,
-0xc249b462,	0x781b54c3,	0xdbf9068a,	0xe5db043b,
-0x1e3e4b5d,	0xfc0341d7,	0xe9d68d5b,	0x194ddef0,
-0xbe3ab885,	0xcee97f92,	0x26e94d85,	0xb089a6b3,
-0x99aab45d,	0x0ef69511,	0x97164174,	0x9aaa723f,
-0x44079aaa,	0xbf0b8301,	0xd1c6a2ab,	0x49ba4615,
-0x970a58ff,	0xf0ddafb7,	0x6039c5a8,	0x9e8acf82,
-0xb0b751bf,	0x6b6b70e2,	0xd6f67974,	0x9e7a2da7,
-0x679fba31,	0xf6629688,	0x92f55661,	0x6097934b,
-0xb6a5725d,	0x907eb122,	0x2db0e80a,	0x995b25c3,
-0x93c5af5a,	0x09b5fb9c,	0x993368d4,	0x960d6435,
-0x47f945ed,	0x96c93de4,	0xd7554230,	0x6cba9648,
-0x9b1dd64a,	0xfd17d8f6,	0x65014cb4,	0x9d012e62,
-0xb3825899,	0x69090810,	0xd85586b2,	0x9ea90f07,
-0x619e2e88,	0xf7b8dc3f,	0x9aa3e382,	0x640a250c,
-0xb8f526aa,	0x9bc79c25,	0x2439ef0d,	0x9b0c2b78,
-0x951c0ffa,	0x08dcd2bf,	0x90419137,	0x98a998ae,
-0x4092c96c,	0x95092d4e,	0xda47daf1,	0x6a1220ea,
-0x9b6c5952,	0xf1f84308,	0x6c505131,	0xac214e2b,
-0x95f2eca7,	0xfe7fead7,	0x6a9cf8aa,	0x622c88a9,
-0xf4d7256a,	0x90f1ea74,	0x91a952c5,	0xf5b5053a,
-0x63156e90,	0x9077a768,	0xfabf56e0,	0x674c82fa,
-0x9593925c,	0xf35daf0c,	0x6d0741a2,	0xb0ec7e7a,
-0xfac81dd7,	0x45759cce,	0x9d839eaa,	0xdd8ff52a,
-0x697da918,	0xbbcda9c1,	0xd4cf0e4c,	0x93c25ecd,
-0xb402595d,	0x22a34122,	0xb502962c,	0xbdc66ed7,
-0x0d0d84cf,	0xb4b33d9a,	0xbd26b700,	0xf5b50344,
-0xb27038f8,	0x46395131,	0xf0821443,	0xba488f6d,
-0x4b2873ad,	0xf972fb86,	0xb6e6cb92,	0xbb1e0b12,
-0xf12e1951,	0xb516f5fc,	0xb03c3d64,	0x035368a4,
-0xb2cbc2ad,	0x4f9e3586,	0x07d591b6,	0xb8d4e609,
-0x46adb34a,	0xf861d111,	0x2469e74b,	0x675faad9,
-0x66925df7,	0x0be0f3ef,	0x1af7414a,	0x5717dff4,
-0x776645dc,	0x2d6bb333,	0x2c75b8d6,	0xce922072,
-0x5d1495df,	0x98454968,	0x308b2e62,	0x605b0727,
-0x838ba96f,	0x4f0239d3,	0xf295395e,	0xb3c38631,
-0x7ea7a143,	0x157a4e43,	0x46f8173f,	0xfbc18d4a,
-0xc401e17a,	0xc4620358,	0xd2ab5437,	0xa01db06f,
-0x58ce91fc,	0x850de1a3,	0x9b542dba,	0xee77f038,
-0xddd3ced6,	0xc225d2ce,	0x63a3f765,	0x3342a06c,
-0x6a780c2f,	0xfaa925b2,	0x366ebeec,	0xbcc9abea,
-0xc7b3fa4e,	0xf4f1123d,	0x5198702c,	0x3e3458b7,
-0x0b1ce9a1,	0x51b1bd7f,	0x711e791e,	0x927d8bed,
-0x91dbaea9,	0x7eefbda9,	0x7a19edd9,	0xdf7b8dce,
-0x5bb40613,	0x0b0c1e0f,	0x85b82c98,	0x18da4dc1,
-0xc5fd78ac,	0x57c1e31d,	0x4c4001b5,	0xe31d2643,
-0xa6afbf58,	0xad200e68,	0xf0114ba4,	0xd6a620f2,
-0xc753a720,	0xac9022a0,	0x28a41f01,	0x22a4ba95,
-0xc00b7531,	0x23d42795,	0xcd836a86,	0x90262708,
-0x3292cad0,	0x40022e39,	0xc1581b0a,	0xe5101550,
-0x6538096b,	0x208c549d,	0x3ce2bf88,	0xa71df38e,
-0x3dec3685,	0xca3949f1,	0x79f3ad1b,	0x3ee8b300,
-0x9d305fc6,	0x7a2e5288,	0xbe81a2f2,	0x7ada0c06,
-0x191c7f01,	0x58dfcbd1,	0xc78dee72,	0x72364226,
-0x1866de12,	0x8d22305c,	0x943a0f0e,	0xc81967ff,
-0x4d55fb0f,	0xaf199be1,	0x90bbda61,	0x4e7c234f,
-0x90cfec16,	0x9b4bcf26,	0x21622023,	0x0926f0fa,
-0x1d504377,	0xa58db427,	0x8d93ce2b,	0x90bfe900,
-0x29e67397,	0x2c1261ed,	0x4ace9474,	0xd5c60282,
-0xe53fb300,	0x8a61a0ab,	0xa7aa0918,	0x4389d7c5,
-0xd09d605c,	0x6c5bedb5,	0xd6d54c51,	0x433dea21,
-0x7ad9e677,	0x813bff76,	0x5a162c75,	0x1ee0661f,
-0x9b6c2030,	0x8e8dc989,	0xcd4bc9fc,	0x4454675b,
-0x8d583c9c,	0xe3400094,	0x116ebb83,	0xe847bc9a,
-0x2a4622dd,	0x2a901e6f,	0xd789b1c0,	0x094e2bbb,
-0x056e563f,	0x9f17e606,	0x8bc79b8d,	0xd2c535c1,
-0x06a45a27,	0x9dc56771,	0xa06649e2,	0x5ff25ac8,
-0x6554961e,	0x98e583d9,	0x38ba93da,	0xdee1de18,
-0x037cb9d5,	0x6b17f195,	0x3431faaf,	0x13860a0d,
-0x28bca10d,	0x0a54c011,	0x9957cdb6,	0x3aa1f429,
-0x9d41b7b3,	0x9aea5be2,	0x60c7ce6b,	0x4cd1c10b,
-0x24ddddcd,	0xe28412ba,	0xa03a5466,	0xa1896879,
-0x59edcb87,	0x1b241765,	0x157bf161,	0xf219f950,
-0xe86ff526,	0x262005d9,	0x11769531,	0xbca15d95,
-0x28f5ef17,	0x1f27e725,	0xc32631d2,	0x07249e61,
-0x1ba851e3,	0x4f49b577,	0xe2a1df5e,	0x826fa7ff,
-0xc34e1e2e,	0x7fe26024,	0xbc19800f,	0x0d368dc9,
-0xe03da0c6,	0xadaa4f9c,	0x9ad1e43c,	0x96f84e44,
-0x0b6cd695,	0x1bb46971,	0x942d6e5b,	0x6316170d,
-0x3164509f,	0xc6659450,	0xb2a0370a,	0xabc208e8,
-0x6d479811,	0x3684bc0e,	0x80b7b101,	0xa50b7bb5,
-0x43d21233,	0xb423559d,	0xf41dcd16,	0xdfd3c276,
-0x3e586469,	0xd9b7630a,	0xb88f9e44,	0x0cda6f4d,
-0xe5bf5844,	0x8709f788,	0xdae37da6,	0x1fb41777,
-0x1d903f69,	0x34383b69,	0xd409ae70,	0xd1c99758,
-0xdedfd7a4,	0xa4bdf018,	0xf4058202,	0x8565d66f,
-0x5365aed9,	0xfa69742e,	0x2cfbfbcf,	0x88a00b60,
-0x506c0713,	0x2866475b,	0x3e1df573,	0xb86f7feb,
-0x31d23a7f,	0xc6320e6a,	0x3ebbc2a5,	0x83a1d4ef,
-0x15169f5f,	0x42a61753,	0x893e553e,	0x4ddbc66d,
-0x7449ec1f,	0x76f65d22,	0x0622e13b,	0x32986f89,
-0x21181b4b,	0x99a80c0a,	0xd6fe00b0,	0x282c0e81,
-0x9fc1cf88,	0x919b855d,	0x618257d8,	0x82c448b8,
-0xe22537a1,	0xa90de388,	0xba73b90c,	0xd765eeb0,
-0x62b2727e,	0xa08dfe20,	0x70b3c8c5,	0x3ef04007,
-0x9f73732b,	0x2201edd7,	0xb836219c,	0xf913af7c,
-0xf50f64ca,	0x93ac107a,	0xf509f84a,	0x6f6026f6,
-0xd9bb8eac,	0x4b268cfa,	0xa65a3fa6,	0x9837cb75,
-0x784fb835,	0x2060576d,	0xb1604cae,	0xb9da4116,
-0xab320cf2,	0x60a1b501,	0x0c73fa79,	0x8d5a6f1e,
-0x57688086,	0x218e4005,	0xca054e3d,	0xc1a3c3ec,
-/*  1070-m02f122f.inc  */
-0x00000001,	0x0000002f,	0x05022003,	0x00000f12,
-0x44847acc,	0x00000001,	0x00000002,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0xe6b36263,	0x6f9eaf78,	0x632770bd,
-0xb11f8920,	0xbc42e776,	0xbd797134,	0x9768e716,
-0x1dce3da1,	0xe0dbe21b,	0x30349ee3,	0xb0aae4c6,
-0x1591358e,	0x6646707a,	0x147f6ddc,	0x639c59e3,
-0xed11c0d6,	0x2707c252,	0x8053be8a,	0xb432051c,
-0x941732da,	0x80e55dca,	0xf389d8f4,	0x738a68e3,
-0x85f7042d,	0xe1904f35,	0x1e2e7f3d,	0xf1d4b55d,
-0xf9829802,	0x0b8d6394,	0x252d74ca,	0x7b6a0be4,
-0x13ec2030,	0x7d8c3429,	0x32380fdb,	0xb595854c,
-0x6ab18d3b,	0xfe241438,	0x79ee3c90,	0xf7c80ed2,
-0x9735dffb,	0xbba18676,	0x2687be0c,	0x9fb2e5ef,
-0x28f85fb1,	0xea0b3223,	0xf1e3f263,	0xffd47414,
-0x86a09efc,	0x3b23b61f,	0x03600e24,	0x0f59519b,
-0x8868d3b5,	0x1cd3ddcd,	0x174364a6,	0xced7c4ea,
-0x637cf55d,	0xab80c838,	0xb2ccd05c,	0x968f8d6f,
-0x77f66b77,	0xdf34ebcb,	0xfece6f5e,	0xb819e030,
-0x1d73c1d0,	0xf6d86e15,	0xfed82c81,	0x4ac93249,
-0x4358711e,	0xe558a942,	0xc19f602c,	0x3d51db79,
-0xbc5b9f59,	0x1dcbf598,	0x09326724,	0xae712704,
-0x686bb2d8,	0x8cb848bf,	0xd1f00d90,	0x6cebdd80,
-0xe9827e3b,	0x7ffc9a62,	0x52851c33,	0xd9f6d8b7,
-0x89294625,	0x5cc9e522,	0x416df615,	0x7b4b8c1d,
-0xa819df83,	0x458483f8,	0x12c2a1c8,	0x3219f4be,
-0x20a99f23,	0x30c8cb2b,	0x0284107f,	0xcaf74794,
-0x3b8408e5,	0xe3915f05,	0xfe89b7f1,	0x3b30f859,
-0xf6c214a4,	0x53ea7021,	0xf1ae6ce6,	0x300771c2,
-0x7c769103,	0x59c4f9ec,	0x954321c1,	0x0010217c,
-0x60f87712,	0x9531a33c,	0x6516e8b2,	0x7e6af0e1,
-0x159c0a30,	0x5c0df59b,	0x2763d9c5,	0xc5c08122,
-0x80be5172,	0x96d9c015,	0x227f4d84,	0x104ad707,
-0x7cd7de50,	0xc58e569a,	0xd2129ffd,	0xe9afedf3,
-0x61e19908,	0xecd27e20,	0x36ef4ae8,	0xcda53aff,
-0xdfbd8a65,	0xaad6eef6,	0x3720e8cb,	0x061f85c6,
-0x60643ad4,	0x0e3cd18c,	0x9d19ec4f,	0xec94bb30,
-0x9f53ebe5,	0x3f591c58,	0xdb015450,	0xade7e0c7,
-0x305be3b2,	0x4cb29bc5,	0x7b57cbb4,	0x3aa89078,
-0xfbe6e43d,	0x0b761e6e,	0xed8b5baf,	0x3b4e756d,
-0x6a148c9f,	0x1a3a01a8,	0x1d33ac7a,	0x3e3dd3e2,
-0xbfb4392c,	0xca1ce690,	0xd1af4a34,	0xa931d9c3,
-0xa86836be,	0x34d86f8a,	0x21cb75f0,	0x37c152a4,
-0x95b9c9a4,	0xc30f3c29,	0x1b821c8e,	0x637851df,
-0x069cc4f8,	0xd88ead11,	0xf5f5728d,	0x1b0ffed7,
-0xfd846742,	0xf76f607d,	0x5d8a4740,	0xad48d963,
-0x6a9ffcc0,	0x1b320e79,	0xc49b22c3,	0xde2c0048,
-0x5fcaddfe,	0x708e63ca,	0x294d5d69,	0xa3dce328,
-0xb847b4d2,	0x611c0a2b,	0xcd4513c8,	0xfa1bfa75,
-0x45ca8ca2,	0x3681b381,	0xc27f6c94,	0xcd958d01,
-0x7b55386f,	0xa4b2c59c,	0xaa58ef1f,	0x752c6c71,
-0xdd97125c,	0xdfc2881a,	0xb9d5036e,	0x5148d9ff,
-0x24e6b06d,	0x8390116a,	0xea6d4d44,	0x7378ffef,
-0xd1833cf6,	0x3415528c,	0xcf3622fe,	0x76729d17,
-0xcd1ba4ad,	0x1885ed72,	0xde02375a,	0xa49131ff,
-0x3be6df31,	0x6cf2c534,	0x90aacc16,	0xa2eda106,
-0xa7aaecef,	0x5831a9fd,	0x5f142437,	0xaf30f7fc,
-0xc8f6cdab,	0xda69d12d,	0x5871249f,	0xc011e372,
-0x33c8e75d,	0x8087d9fb,	0xc595c587,	0x9cc36c3e,
-0x676b2c58,	0x4f242c1b,	0x6b77d07c,	0xa1c8543b,
-0x2824e9c7,	0x84be15a4,	0xc0b4a308,	0x0e41511b,
-0xfaf3dbbe,	0xc1777e7b,	0x199d042b,	0xb0b35558,
-0x9bf8cb58,	0xf68d5c43,	0xf359b550,	0x993d82d1,
-0xa8388458,	0x56d3c256,	0x11cbc33f,	0x3c28a56f,
-0xe6aa09f9,	0xd41f6c39,	0x11020cd2,	0x985c89db,
-0x3705b46f,	0xaf90c2dc,	0xf7ecfc96,	0x355eee96,
-0x078e9048,	0x2fd05bf1,	0x48eab9e0,	0xafaab712,
-0xcf0c3e12,	0x8095ae6d,	0x8364131e,	0x7221ba38,
-0xad0e42d6,	0x20741356,	0x8698ad29,	0x024d1baf,
-0xb87c4a77,	0xa4169a47,	0xa487c4c8,	0x966a2b68,
-0x9821bace,	0xe64b1014,	0x22eda535,	0x4cc48e4e,
-0xb1a80833,	0x0e9ec179,	0xf6bb1c55,	0x95489311,
-0xefe8a663,	0xc4cf14f9,	0xe3591c5d,	0x86c3c61b,
-0x9fe18d90,	0x3b75ff1b,	0x5ca3d992,	0x8c072f42,
-0xecf16b8e,	0x672b72c7,	0x4603e497,	0x45e015d4,
-0xd918406b,	0x4f25a635,	0x5feb56b4,	0xf9f94d06,
-0x7bd31a73,	0x1ab03fc0,	0xb85fdbd8,	0x4c3e81d9,
-0xefc2c666,	0x59a7afcd,	0x8a02428a,	0x73af7adb,
-0xd8ea36e0,	0x991a6fd9,	0x7f9c2019,	0x2d3a85d6,
-0x8f3295c0,	0x93809471,	0xa5d313f5,	0x8cd5ea3b,
-0x7b982971,	0x5e4f0172,	0xcedcb6e6,	0xea24e209,
-0x8a46f8b2,	0x74331527,	0xd77ed523,	0xaba69d6a,
-0xebd38b4b,	0x04c01b27,	0xcf51542c,	0x25e75d87,
-0x69f4e24a,	0xeb1c3f81,	0xdd4508da,	0x0cc85856,
-0xd006d573,	0x79a7c5cb,	0x1cc2e951,	0xd1ac0710,
-0xa78fbeba,	0x90877b5f,	0x7972ab18,	0xd866ac15,
-0xc287620f,	0x54fdeb69,	0x9c2d264f,	0x6c2e6ff9,
-0xa12c2962,	0x87f99490,	0x5a9f5f5c,	0x5fd88f09,
-0xf6b7e966,	0x02abc4f2,	0xde5eddd1,	0x6ccd06e7,
-0x7747ee88,	0x9bc9622a,	0xb807d839,	0x1d14fe6b,
-0x1c4676e8,	0xb9add7e1,	0x5a84fc84,	0xa0d232ab,
-0xf09b95a0,	0xbd7481db,	0x9f68639a,	0x4870d114,
-0x60ebc8a5,	0x42d4d24b,	0xf64d2815,	0xaab0da5f,
-0xcba7f41c,	0x44dcd89b,	0x613d50e6,	0x180e700c,
-0x18a6bdad,	0x54883f08,	0xa0a9fc4b,	0x9af3ec0b,
-0xba3f74f2,	0x9469aa23,	0xc89de01e,	0xe7963adb,
-0x8cb13661,	0xdbbd276c,	0x42e113df,	0x4947dfd7,
-0x513cc410,	0x57c6db1c,	0x8911377d,	0x01405fa9,
-0x7163e406,	0x995a0db3,	0x2e9b208b,	0x4c77dfbc,
-0x33f30f4c,	0x5aad99da,	0xcca61b32,	0x027fa2ce,
-0x2b5387aa,	0xafca9d2b,	0x7fbe4c67,	0xee92fc72,
-0xc3857c05,	0x5e425769,	0x4ae6558f,	0x499427f8,
-0x15900b70,	0x3aae1260,	0xa7bfc2a1,	0xdfa73e71,
-0x8b79b206,	0x6552c432,	0x56b81866,	0x86d6e834,
-0x91685add,	0x7c34051c,	0x4ef8db74,	0xbab855ee,
-0x083ab156,	0xc82a579d,	0xec1e3ae3,	0xdfea24a6,
-0x9554ee6e,	0xd53b8bd1,	0x9a4bda63,	0x884e86e5,
-0x9acf4763,	0x540b9ded,	0x5fde4bca,	0x541d2dd4,
-0xc5637486,	0x5fdfc527,	0x6cc50628,	0xc701a605,
-0x7fba696e,	0x053a6cd0,	0x3796571c,	0xd11ec6f6,
-0x2a653ec1,	0x69a1ade5,	0x16171234,	0x3aa406c1,
-0xcc4c0c5c,	0xcaa1b030,	0x5aa895d9,	0xcda3b272,
-0xe6d47066,	0x998c147c,	0x1b026939,	0x6371cc60,
-0x9ec4d2d9,	0x3b49c98d,	0xbb49a6a5,	0xcb1ed1f9,
-0x30b9688a,	0x2db1402d,	0x5665effd,	0x0d9a0e51,
-0x25b22259,	0xb0bfbee3,	0x111f4513,	0xa18acb44,
-0x382c08fb,	0xd865ca2f,	0x260cb54c,	0xffa0dbb4,
-0x9aad6b4a,	0x578ade98,	0xb9f09030,	0xbafe415f,
-0xf7235cf8,	0xd19f0413,	0xedc73cef,	0x80d5d335,
-0x214f990b,	0x8478604f,	0x944b72e5,	0x131c9537,
-0xcb692f67,	0x4a5cbd6b,	0x03133594,	0x80b99f44,
-0x371cb369,	0x256baf31,	0x7ceb93d3,	0xf2a3f4b8,
-0x422db93a,	0x19729ad5,	0x59847c4a,	0x398f8e81,
-0x7be54e1d,	0xe1e41995,	0x1029b034,	0xfc8999a6,
-0x7419c8cb,	0xa9b0ccca,	0x2ef57bd5,	0x9fe322f2,
-0x18af184d,	0xad51f8dd,	0xe513345b,	0xfaf81d66,
-0xca6d45a3,	0x3907407a,	0x3a5b8ac3,	0xa61325ef,
-0xdcd94ec0,	0xe88fe5af,	0xa978771d,	0x5570ba47,
-/*  964-m01f0712.inc  */
-0x00000001,	0x00000012,	0x07162002,	0x00000f07,
-0x39e69ff0,	0x00000001,	0x00000001,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xffffffe9,	0x8bb66866,	0x1d79ea57,	0xeae74f1b,
-0x361e4a7a,	0x55e2826d,	0x5f734071,	0xb2843de5,
-0xae7971bb,	0xe25004de,	0x405dafe0,	0x7d53f66f,
-0x4df56461,	0x7b57d0ce,	0xea17af39,	0xedbb1ebc,
-0xe9e38d20,	0x8b12c950,	0x4a0b7e87,	0x52c078c1,
-0x726e683c,	0xca3f7181,	0xc20dded4,	0x923fe6f8,
-0xfc2c31f4,	0xfc1dbb1d,	0xe4d7cd63,	0xe2fbcd17,
-0xa8ad72e0,	0x33fea0d3,	0x71d5d527,	0xc456c0fb,
-0x4ca199ba,	0xeb863e4b,	0x43210553,	0x05454fcc,
-0xdedf6095,	0x5ac66851,	0xc5b84d9d,	0xf1775630,
-0xa50e817b,	0x8393f563,	0x4d6a58a4,	0x641c876e,
-0x4598072d,	0xfb1875c5,	0x0efb05e9,	0xa5a840dd,
-0x54e9190a,	0xe9ebafdb,	0x7bfaa19d,	0xdae03c5e,
-0x141069e3,	0x178fbeef,	0xbdf33f79,	0xcdbdd066,
-0x07ae0fc7,	0xf45750a0,	0x6f3810e9,	0x6415e0bf,
-0x2b46112e,	0x21be86cd,	0x29245980,	0xbb58f310,
-0xfb665f23,	0xfeeb9aad,	0xcea2257c,	0x5175328e,
-0x0d3d2bd7,	0x81ce7ea2,	0x9a6de78a,	0x9850b5e3,
-0xbbee4402,	0xb6319fb0,	0xc010158c,	0xbbb913ff,
-0x395f312a,	0x24579055,	0x2ae58ef0,	0x9cc2b14a,
-0xc76a13bd,	0x88def903,	0xa9b67b9e,	0x3feb492d,
-0x707975d5,	0x5c9559b9,	0xf52a12ac,	0x87d2efe2,
-0x2b2e52a8,	0xd0d7df0f,	0x4f1c6f19,	0xebb81a13,
-0x80210238,	0x1b3c07f0,	0x7a499318,	0xde7c5eb3,
-0x9f875ea6,	0xad68ad52,	0xdf0ad02f,	0x88665580,
-0xc1e124bc,	0x2078c537,	0x31428f38,	0x91ab5aa2,
-0xc1a64ad2,	0x87cc2159,	0x718ebfd5,	0xc2c3532e,
-0x7e7ec93c,	0x1cdda579,	0xcffccb9b,	0x583c8d7e,
-0xdd8a3faf,	0x60aa9835,	0x61aba793,	0x3e57affa,
-0xa681cda5,	0xb225323f,	0x4b3f7fd0,	0x4d30f709,
-0x6d206bbf,	0x51689b07,	0x3040283d,	0x95d95684,
-0x53d4f28d,	0x4c5372c8,	0x0e2e293f,	0x7c660707,
-0x06a15ae1,	0x1452111f,	0x3c5a0df0,	0x61fef67e,
-0x8c9f26e8,	0x879dd434,	0x84937130,	0x28a9c507,
-0x9d05cdc4,	0xa58e51f9,	0x78250d1a,	0xb4aa4867,
-0x2f277408,	0x1d4281e2,	0x03f7a5c9,	0xb90aa91b,
-0x09ddba69,	0x219ff884,	0x63c7aa86,	0x3ac8cae8,
-0x3217bb61,	0x166844cd,	0x45518869,	0xb23d4145,
-0x444a751c,	0x2c4ea3cf,	0x574cd48f,	0x859e01ae,
-0x79901e63,	0x28701f07,	0xf31897aa,	0x0bfbabff,
-0x18148ee5,	0x3aa01696,	0x08b8c6e8,	0x073ef026,
-0x4bbd2163,	0x278a5b5d,	0xca4f43fe,	0x1581b955,
-0xdd310608,	0x4c47f8aa,	0xc4748e35,	0x0938dd48,
-0xa7dbd247,	0x4f9c9284,	0x4fd12ae0,	0x4122817e,
-0x57af6bb7,	0x1b1cbf56,	0x01713ae5,	0x4693a2a4,
-0xd361471c,	0xfb5e5fb9,	0xd57ecb2e,	0x1396b134,
-0x6c1ef975,	0xf0ba5604,	0x2bc5fc46,	0xe8e75240,
-0xdc5a04ef,	0x0c7fec2b,	0xff44a7d1,	0xf1752a97,
-0x4c64f1a6,	0x5f5b6971,	0xf80425d4,	0x26a2d408,
-0xdc3661d1,	0x641f52d4,	0xc14d1641,	0x6db4a92b,
-0x7ab7b4f4,	0x15c03f01,	0x120456f8,	0x434b9b0b,
-0xecd8fd05,	0xe791871f,	0xf115d632,	0x362e7192,
-0xb2f6d067,	0xc38caf36,	0x38916496,	0xdb0b52f0,
-0x4435b1b4,	0x1e33bc83,	0xdbec3c07,	0xc8a80185,
-0x7f5c6ad1,	0x0759aede,	0xfb9afeeb,	0x3da4804e,
-0x02b98265,	0x1fdc99d3,	0xe3238746,	0x0b485f0d,
-0xc8452172,	0x21f980ed,	0x115b5f9f,	0x2fdb1ab6,
-0x51f0b309,	0x07ec0a64,	0x1371f802,	0x1af7b884,
-0x2b63d9be,	0x064d5257,	0x9247a258,	0x2e7d9ef4,
-0xebc76e82,	0x3744e142,	0x327498ed,	0x1efe2eaa,
-0xf4b47f03,	0xd56b8a80,	0xd9df7063,	0x38b6093e,
-0xe8952237,	0xd4c3cb00,	0x427aaa2f,	0xde11b0dc,
-0xc6389e16,	0x2775052a,	0xb53c88c3,	0xdcc0d91f,
-0xa372dba9,	0x56082310,	0xd5eb095a,	0x06bf07de,
-0xab0cfa42,	0x450af2c0,	0xb64ae4fb,	0x4b29950c,
-0xf66c4395,	0x0878b9c7,	0xbcd15704,	0x634b7b14,
-0xdb3de5f4,	0xb08f50bb,	0x831e6abb,	0x010abe5c,
-0x4d081d89,	0xb522a1b5,	0xfaf4f82a,	0x8932dcd1,
-0x439fdb05,	0x0cacc3de,	0x56e8393b,	0xaaa12d2b,
-0xb3c38358,	0x304b273e,	0xd2a231fe,	0x2211e77c,
-0x70f73dee,	0x2e5b056e,	0x01df2fde,	0x0d39db76,
-0x2c2137b2,	0x11638742,	0x2c160d57,	0x1e29cf1d,
-0x62157d15,	0xd71cf60c,	0xcc2012e5,	0x1ef8e889,
-0x7438d083,	0xfab2d9e9,	0xcd1e6cfb,	0xe37d919e,
-0x738e3e70,	0x2f511109,	0xc88b544a,	0xcb5231cc,
-0xb4aabced,	0x20f74006,	0xdf5b722b,	0x0f299cd5,
-0x324f3630,	0x139a0348,	0xd45349ea,	0x208af30b,
-0x8f2b48fc,	0x38a7e62a,	0xe5eb7bef,	0x18028e8f,
-0x365eeece,	0xde32aa2b,	0xb7c86e79,	0x22b3a1a3,
-0x3a66b2db,	0xd628c336,	0x2d3a3be9,	0xd82f8a9f,
-0x049bc319,	0x3973ea2f,	0x66ef9dec,	0xfd5ed712,
-0x8945b138,	0x5a3f99ff,	0xecd0b3b8,	0x29471ee6,
-0x6b2a42e5,	0x45c3cc05,	0x2301d9d8,	0x702b2528,
-0x1d75be7a,	0x3324b767,	0xe3add8b4,	0x7c0a4bae,
-0x791010e8,	0xda59d2bc,	0x612eac2f,	0x235021b0,
-0xc18567dc,	0xd15f9148,	0xca5d86fb,	0xc10bc63f,
-0x2b8f4c36,	0x2d891b63,	0xa7977c9f,	0xdadb398f,
-0x083f6a6a,	0x230e398e,	0x19420c4f,	0x1cc52b2a,
-0xae8d117d,	0x2c32000d,	0xad13069e,	0x3a113635,
-0xc6522f49,	0x074a7ddc,	0xea16a043,	0x35662b0a,
-0xb3bd25b8,	0x18b45214,	0x9f142cbe,	0x1b7c6938,
-0xe5f764de,	0x3b252a68,	0xd0c84dde,	0x1d74a684,
-0x0b394830,	0x18d2add6,	0x0e14d7e3,	0x2812c01a,
-0xb1426e75,	0x97c7426c,	0xca2425ce,	0x3b07c144,
-0x92c538a2,	0xb50a1bc5,	0x6b7867a8,	0xb147634f,
-0x39d1a5b6,	0x38dd638b,	0x84102bc9,	0xaeaf04e9,
-0x75d6755a,	0x359fdcd9,	0x9859936d,	0x801f6834,
-0xbba00552,	0xd8c96732,	0x9769642a,	0x92ab9c4d,
-0x4b44a4ea,	0x6f3f380d,	0xf112e9a3,	0x8768532a,
-0x958c163d,	0xa4a7c80f,	0x6873ae6b,	0x9b0e78b2,
-0xd7ab7060,	0x4d9f8791,	0x370f29eb,	0x16e6a4df,
-0x2eaa46b8,	0xcc64bf8b,	0x423c788c,	0xeef8371a,
-0x497e76e3,	0xe49e1ed6,	0xb6890ea8,	0x7562648f,
-0xd30c433a,	0xb967a3d2,	0x17b665fd,	0x0499210d,
-0x0df41a8b,	0x60261315,	0x61d25715,	0xf7dfc43e,
-0x1567841c,	0xac38e452,	0xb76be7a9,	0xfabea796,
-0x017a95c6,	0xd7d2b0da,	0xa24fb7a3,	0x14ec0a12,
-0xd3446440,	0xaa70e820,	0x81620b96,	0x466c02e6,
-0x9f67c135,	0xee4ff616,	0x509161ad,	0x263587d2,
-0x11169e0f,	0x5c46175a,	0xeed237e5,	0xefe242bd,
-0x2aed7440,	0xde3f737f,	0xd6ba63eb,	0xe8d8304e,
-0x8a1ad7a7,	0xff53828a,	0x0d2c073b,	0x6dc5dbfa,
-0xcb76174a,	0xfa1b2c30,	0x384ac449,	0x1f5ea4be,
-0xde50549d,	0x5f6e5977,	0x6d5c33e5,	0x2b9b8ab4,
-0x8be0c16c,	0x021db150,	0xf3a99a6e,	0x9a4dcfc5,
-0x7bc75f76,	0x243be7b0,	0xe53d1b04,	0x38fd5ab9,
-0x4d26ca07,	0x90ef6dff,	0x4c8c02db,	0xdf986343,
-0xc84edd73,	0x2a46005c,	0x6ebe028e,	0x1d68a9dc,
-0x97f23c83,	0x2dda5fde,	0xaf56b1e9,	0xc4f04b0a,
-0x97a355a9,	0x3f5b604b,	0x8a4c5c33,	0x4fb3c292,
-0x5be0edd7,	0xd05af070,	0x1623da74,	0xb55ff7af,
-0x40929043,	0x62e96e20,	0xde5afdec,	0x5bbe38bb,
-0x47918b57,	0xba53cfb7,	0xa613b0cb,	0x3c794832,
-0x69c9f5b2,	0x62ad3086,	0x2afc0271,	0xdb900632,
-0x65d6c7ea,	0x0dd8b907,	0x52f3cabd,	0xf77a8c51,
-/*  2337-m806fbB6.inc  */
-0x00000001,	0x000000b6,	0x07132007,	0x000006fb,
-0x2831cee4,	0x00000001,	0x00000080,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x000000b6,
-0x00000035,	0x2a000000,	0x20070712,	0x000002f1,
-0x00000001,	0x000006fb,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc67566b4,	0x105501ed,	0x8a79141f,	0xd976d998,
-0x39025e8d,	0xc8d4def9,	0x136f7e41,	0xd876436e,
-0x58d10d9f,	0xb7f2421d,	0xe4d5fcf1,	0x02889a15,
-0xad9bed07,	0xa32ab3e6,	0x3491afcc,	0x9c991c37,
-0x2a1c2071,	0xf066191a,	0x3bd898e7,	0x2648d958,
-0xc05f7908,	0x05864b9b,	0xbe4c1eee,	0x1e6c7ef4,
-0x0e7a539e,	0x100b2ab3,	0x1273dceb,	0xfec8847d,
-0x8f37946f,	0x634e3b5c,	0x691dbd61,	0xd89e3cb9,
-0x094639d4,	0x7d972e1a,	0xd6dbd94d,	0x2001c3ec,
-0x34f791f0,	0xeee0d794,	0x88b7459d,	0xc2c73aa3,
-0x607a174d,	0x4f0f8304,	0x65790b35,	0x00532bfe,
-0x1fd1e0cc,	0x7b91f873,	0x154ed42b,	0x7a7108e9,
-0x81637c95,	0x192cb173,	0x28ccd94e,	0xb9bcc372,
-0xac05171b,	0x867f47da,	0xf8e8c47d,	0x1edcdb4a,
-0xd2ca6c2d,	0xe9ee9169,	0x5a6efedc,	0xb6825038,
-0x09277eaa,	0x2a34e580,	0x0f794366,	0x86c99402,
-0x211b98bf,	0xdf8eb0e3,	0xda11d7bd,	0xd440363e,
-0xa7d49f1a,	0x16dd7395,	0x5b23c2fc,	0xab93ea3c,
-0x00000011,	0x8d12ea76,	0xc5c9c349,	0x92308263,
-0xf78e4c9d,	0x72c29f88,	0xd19a18ac,	0x1c90e94d,
-0xeb8c5d92,	0xf7bb5a98,	0xa62ae1bb,	0x1d37396a,
-0x191737e5,	0xe423c9c2,	0x1c16fae4,	0xb95f9692,
-0xaeae4fbf,	0xbed4707f,	0x70f70fa6,	0x3e80ad8a,
-0x668f54d9,	0xff968f7e,	0xc4e24190,	0x0872ccf0,
-0x4fa39955,	0x55a1a6f5,	0xc36d7848,	0xe82e7047,
-0x3ea79a72,	0x27411065,	0x55930d6f,	0x8e94ddfa,
-0x6008c698,	0xb315b1d6,	0xedee441f,	0xd3875916,
-0xd0a76bae,	0x14ef297d,	0x6393320d,	0x69d787dd,
-0x7973bdd6,	0x7e5c4c27,	0xdfe61741,	0xc631b12d,
-0xcc99b991,	0xbeed1d1b,	0x9b3c5535,	0x78a48b4a,
-0xe278d8a2,	0xf1c80ebe,	0x70f3ed4f,	0x4744194c,
-0x53503244,	0xf94ab448,	0x04f48675,	0xa91912e6,
-0x0fbe4a37,	0x22dd31d7,	0xc7b0cb0d,	0x752eebc1,
-0x83141b0c,	0xb59e8702,	0x5efa7721,	0xc8440cd4,
-0x94a00db5,	0xfafd13f4,	0x878cc0a0,	0x735a935a,
-0x456ae71e,	0x405aa5f4,	0xcb272526,	0xeb85d034,
-0x91f58175,	0xbab6094c,	0x48426d3c,	0x18bb5eea,
-0xe9ee4304,	0x0868f031,	0x29413b52,	0x29ab13c3,
-0x575646eb,	0xb24f2668,	0x142b91b2,	0xfa969908,
-0x12b79a91,	0x38bc2ba2,	0x525e5da2,	0xabc63db2,
-0x9bce15d9,	0xa2d2a006,	0xa1744c42,	0xf64f876a,
-0x4121f17a,	0x0e24d1b5,	0xb27a09dd,	0x2741ca03,
-0xd83fe2bc,	0x59a0aeee,	0xe861ab21,	0xb304ca71,
-0xb8bc5b2b,	0x1553f2c5,	0x5d078685,	0x3de43e77,
-0x8e1f2eb1,	0xa9eb40bc,	0x3bcb1973,	0x4721b5b6,
-0x73e23954,	0xa9464b92,	0x82ad836e,	0x56b8a136,
-0x4bb95ff6,	0xa538c8aa,	0xe2bf3da3,	0x1347a40a,
-0x34f844c2,	0x596ab878,	0xa9f94b32,	0xdad18fd1,
-0x6f2fda04,	0x09c10ec7,	0xed4a2d3f,	0x375add96,
-0x0ae45688,	0xa594039e,	0x8fdae080,	0x7f3f4a68,
-0xef496e17,	0xab450c5e,	0x9a43c59c,	0xf5394c3a,
-0xf09dd852,	0xb9b41813,	0x45ed7124,	0xcfe1955c,
-0x7e3eedcc,	0xf4603b14,	0x1907131c,	0x5b45ade1,
-0x154c8205,	0xcf98affa,	0xfaf58903,	0xa071e600,
-0x0814f47e,	0xacd29fff,	0xa9246964,	0x7a638372,
-0x3d1061b1,	0xba47647e,	0xd1fbee16,	0x896dd880,
-0x1c100f37,	0x99cb8778,	0x48062c08,	0xd0366a79,
-0xa6d7ddb8,	0x86c68a9f,	0x02ac6f34,	0x0e144676,
-0x20d43c65,	0xcb6a9b99,	0x0e1c9291,	0x9cfd5b8f,
-0xac43cbcf,	0x34a7974d,	0xce017104,	0x975c2efc,
-0xd55c5dbb,	0x0e16766d,	0x890dfd62,	0x2934622d,
-0x709fa149,	0x21a94f12,	0x43113498,	0xb146aa2f,
-0xfbbca7ff,	0x1782cec2,	0x9ff3b595,	0xfe4b2b95,
-0x0fd2fbd8,	0x1651f923,	0xa74fe4cc,	0xd07a49c0,
-0x0d0adba2,	0x9c70bce9,	0x08e8b8d7,	0x32dbe104,
-0x6168b74f,	0x7a24fdbe,	0x5e3b2564,	0x6ffe5439,
-0x1e7721c4,	0x94af4976,	0x1391cec8,	0xafa04102,
-0x79d64355,	0xd88737af,	0xa2f2298f,	0xc980628f,
-0x465e2d9b,	0x8b2bfcf2,	0xc46fb4fd,	0xc352c65c,
-0xa3064ff7,	0x3b9264da,	0x7427ca4b,	0x41c01632,
-0xa2d1ed33,	0x6cca9f3f,	0xf8b67421,	0x305e1584,
-0xc9732051,	0x89a0091d,	0xc374e441,	0x587ab4e7,
-0x958dd99b,	0x286d9f81,	0x10c67cdd,	0xb85d1783,
-0x67b38f42,	0x30b90891,	0x45894054,	0xd050199d,
-0x130063b6,	0x7b5e0863,	0x8a61c4d6,	0x2c44fe2e,
-0x148428aa,	0xaa587921,	0xf542fe2b,	0x7b7da7e5,
-0xed3bd14f,	0xb2616902,	0xc840e668,	0xb2623ee3,
-0xbfc63cca,	0xed8b82dd,	0xf7d3cb2e,	0x41eab7ed,
-0x8c3bfe0a,	0xd24a3c82,	0xd6d3d9be,	0x3aedf032,
-0x957a863f,	0x04d80868,	0x1a59e52b,	0x52ee31fb,
-0x8aa7dfa0,	0x2dfb638d,	0x2967e9cd,	0x0aa67bda,
-0xd87b2b96,	0xea23ba62,	0xd6c97957,	0xa6f1cc56,
-0xac8c9465,	0x3408348f,	0xc82fc701,	0xdf1d0e14,
-0x11f617a5,	0x93f4964c,	0xebfae6fb,	0x07f0a028,
-0xb40c5b7c,	0x6c0f33f6,	0x854abf0a,	0x89e518d1,
-0xfcb70776,	0x1cf65ddc,	0x1dc0ae2e,	0x418ff41d,
-0xafbc49f4,	0x064e2e27,	0x35ce2cc0,	0xece5ac9a,
-0x7c245d5d,	0xf22af2a7,	0x5a5df3a5,	0xf991e2f4,
-0xcd0b15fd,	0x68bd046a,	0xd29d50c6,	0x1e691c01,
-0x7a4d3cd5,	0x2f6275da,	0xf1cee3f3,	0x84261101,
-0xd32ecfdc,	0xe75fdec2,	0xc02846a8,	0x13f19aa6,
-0x3dafe115,	0x2c2b0488,	0xbb9da407,	0x196198eb,
-0x897db3b0,	0x58813217,	0x917af6ba,	0xf7fa30ff,
-0x277c26a1,	0xde9ffb6a,	0x85eb946a,	0xb9a6295b,
-0x3f7f687a,	0x17fef8a5,	0x3af23085,	0x457a11a3,
-0x2a73b9a7,	0xedbfd16a,	0xd2e88242,	0x1e3c02e5,
-0x0ea74671,	0x1fc9e250,	0x5a313d7d,	0xd5a49528,
-0xe749e126,	0xdf0de086,	0x35b60d77,	0x07fb5491,
-0xdedda50a,	0x51325ec5,	0x8cef16c0,	0x5dbc5f47,
-0x0c02a13e,	0x76604b7c,	0xbfef93fb,	0x3e7f0bf0,
-0xd1add7e3,	0xdd6c3a85,	0x6e1e119e,	0x38278895,
-0xa8df00b8,	0x19f99ab9,	0x368b3ea6,	0xcde20a8b,
-0xf7acd01f,	0xc59c84f9,	0x0a0b6d38,	0x18cb2d96,
-0x37544234,	0xc2c89561,	0x603d7483,	0x8049a647,
-0x86cee8e1,	0xfab3b928,	0xbf53d180,	0x548aaaef,
-0xd0840b5d,	0x56475635,	0xa29f7fea,	0x1db9078e,
-0xc29beac4,	0xe34189e0,	0xae65a95a,	0x5ba92288,
-0x50152e52,	0x9ce2d6cc,	0x1a602dca,	0x72671a71,
-0xde59b037,	0x7adb5fe0,	0xcadf39c4,	0x7110db44,
-0x00200eee,	0xf2a574d0,	0x7cc14a56,	0x9b01c7c7,
-0x363a0d5b,	0xff8a60e8,	0x34e900dc,	0x567b5d4e,
-0x6b52d659,	0x82e22016,	0xd2e6cb9f,	0x611391c9,
-0xe99bad01,	0xc6e46ebb,	0x14e29144,	0xb8e85f81,
-0xea508116,	0xae7aa3b1,	0x6d535779,	0x673ec856,
-0x285dfb55,	0x4671b198,	0x21491515,	0x1fd77e2b,
-0x1dfbfa06,	0x442161e9,	0x0dfa5161,	0x9ba818fe,
-0x708a8e17,	0xc9754986,	0xeef3ab77,	0x8caa3151,
-0xfe6d3b59,	0xcfba71e2,	0x780b6c3f,	0x0fedcdbe,
-0xb3dfbdf4,	0xbb0d7953,	0x1d9450d3,	0x58d71d72,
-0x09d71b70,	0x679bd3ed,	0xd68bfb24,	0xe93470ed,
-0x36b2a64a,	0x6ddb8077,	0xd6968654,	0x29868706,
-0x30af7610,	0x0fc9eb07,	0x10690e76,	0xfe62ee78,
-0x9ffb3fc6,	0x0c34f0e5,	0xbc01db4f,	0xd4fbb08f,
-0x4420b704,	0xa4af88c9,	0x0a3ae196,	0x6af40c74,
-0x08d58801,	0x886ba013,	0xd70a4f3e,	0x924c5830,
-0x494ee315,	0x90f62676,	0x727c427b,	0x78e0fb4b,
-0xf9b4508b,	0xac37411e,	0x8e1f7b36,	0x54778002,
-0x00080c22,	0xd55e89e6,	0xef8b0961,	0x43eab9ab,
-0x98e8e142,	0x9ef7eb71,	0xb1b0a6f8,	0xb259fec7,
-0xd04d9f7f,	0x873a79fc,	0x6dff58bb,	0x7747a1ef,
-0xef25d604,	0x21eb7b76,	0xee7cf400,	0x11056351,
-0x57ecdffe,	0xfe939145,	0xf52794bb,	0x55917634,
-0x9fb4d599,	0x5bf73f5e,	0x11382735,	0xc6cba6b8,
-0x3ce059fe,	0x88f1bfbf,	0x4ed5941f,	0x9009764a,
-0xf9c7f463,	0x0f28df41,	0x8cad66cf,	0x3ea7591c,
-0x6707c286,	0xd47cb952,	0xf53392e2,	0x94e1a29e,
-0xd4fb88f4,	0xa5fcaf93,	0xf5ba3444,	0x91249b70,
-0x0bbeb5c9,	0xf943bfe9,	0x92629f51,	0xbc10d3f6,
-0x9564f091,	0xad4bb29e,	0x0a50af33,	0xe8f79296,
-0x8bf25c64,	0x81bdf02b,	0xec22d493,	0x0d2efea1,
-0x52e2a6cf,	0xd412701d,	0xa17df71c,	0xb9f62247,
-0x4d7b517a,	0xa9bd93a0,	0x94fb1eaa,	0x2d4bc7fb,
-0xcd857966,	0xaf4953b6,	0xf664d4a2,	0xf1e12279,
-0x1827aa2d,	0x6db71721,	0x28159f88,	0x9df25ab6,
-0xa97443a9,	0x378b6644,	0x6ceebaef,	0x0e01e9fa,
-0x048cf8b0,	0x962c3d48,	0x2d375c33,	0x407593a6,
-0x693e2d8a,	0x9d5a557c,	0x44863ad9,	0x6ab3e26e,
-0x3ec52d9f,	0x0933fed7,	0xa7b06032,	0x266f3a2f,
-0x02575fdc,	0x2224ba45,	0x71c02d29,	0x1b08c7d1,
-0x8b2200cb,	0xfc1c9a92,	0xbddc0508,	0xf3220cb2,
-0xcf373ecb,	0x0dce00e9,	0x59e970e7,	0x0bd36624,
-0xbbd1ce75,	0xa8641ec8,	0x06937187,	0xc3f2d380,
-0x8a7adc67,	0x79f67552,	0x7fdf88a5,	0xb6941a6e,
-0x0aafe9d5,	0x1d86eab7,	0x9240d112,	0xca6c7aac,
-0x6ebaa150,	0xbba6c64f,	0xf20ec41c,	0x14a3c3fd,
-0x8e3db21b,	0x66ad6654,	0xd339f5e1,	0x749714f2,
-0xb22ba620,	0x9f4f0119,	0x3745aaec,	0x5ba03b86,
-0x10bb4d86,	0x96309fe1,	0xf93c8620,	0x901c3170,
-0x3224e497,	0x453639b7,	0xc8cb8101,	0x860a60c7,
-0x10a69fae,	0x5cd0cf62,	0xf0c9fe79,	0x49b7f0b5,
-0x89c719bf,	0x8caf497a,	0xca747cd6,	0x4a0cfabc,
-0xb2f2cc33,	0x2768703f,	0x89e7e499,	0x44dd965b,
-0xf7a772d7,	0xdd508108,	0x8a43b845,	0xba5a74e5,
-0x6ca47c79,	0x72b9e0bc,	0x9479ce84,	0x3342f0b1,
-0x9a39e2c0,	0x57808b69,	0x288ff4b6,	0xe5fab877,
-0xed07f654,	0x0ee79da9,	0x02e7b183,	0x456fdb53,
-0x11aeeb6c,	0x8c2fadb9,	0x67f79309,	0x2f97a264,
-0x02af0d27,	0xf07f9608,	0xb66fd12c,	0x25e6bbc7,
-0x92001908,	0xc52170a0,	0xc9fa7f41,	0xbf361c71,
-0x33cd7f76,	0x776f9b61,	0x459cdfe1,	0x065dbdb5,
-0x67a6f1d1,	0xcbbee73d,	0x2f7b516c,	0x1fda5e43,
-0xeba7d6ab,	0x337c3557,	0x1f2477f5,	0xeec7d493,
-0x749fa13a,	0x3c37e01d,	0xa78babcf,	0x9ee438d4,
-0xaa57066a,	0x9efe96c5,	0x8d45bd8b,	0xbc36930b,
-0xfbf60974,	0xdbb7844b,	0x44001279,	0x14e036b9,
-0xb524f4a6,	0xad1cee3d,	0x351aca37,	0x22861da8,
-0x0648f10b,	0x394078f1,	0x4287ef8c,	0x5c52b8a2,
-0xaa345739,	0x959a7de2,	0xb1cd8059,	0x29b3e4f9,
-0x3ee210dd,	0x7a4e3104,	0x7e6ccae0,	0xb6d003d5,
-0xfda934b3,	0x0e0a48d0,	0xd4109873,	0x2812c616,
-0x635c5c94,	0xe3f9d4ac,	0xf0a6aaca,	0x7541e3f6,
-0x3fc3b0c4,	0x49fb84e3,	0x710f44de,	0x7557e168,
-0xa524128c,	0x5c7a1cab,	0xd94da26d,	0x635e0b6b,
-0x21229736,	0xa4accca9,	0x27ee9ae8,	0x1a5416d1,
-0x989833aa,	0x7eebb36a,	0x74ad3b3c,	0x76a2ee47,
-0x1424b74a,	0x495bb4ef,	0x95f7352e,	0x0591577f,
-0x7c2bc9cb,	0x4fe50735,	0x496ba74f,	0x827dab44,
-0x3a4e6eb1,	0xf3089b11,	0xed78dc22,	0x79d5e577,
-0x2421bad0,	0x89f97e71,	0x7d069592,	0x53da02fe,
-0x6e47d868,	0xb99cfcc6,	0xca203836,	0xacd9ad61,
-0x2139c875,	0x9bc56e41,	0xb001c73c,	0xd531ae4b,
-0x456e9177,	0x4c8d3f89,	0xd597fb45,	0xb8fa7d69,
-0xbf24bde7,	0x9286ac26,	0x43906899,	0xcd57a058,
-0x83966715,	0xb6164ea0,	0x4623f16a,	0x9402a156,
-0x5fafb09b,	0xd20029a8,	0x4e0c2923,	0xfa02adc7,
-0x6f6d2158,	0xc661283a,	0x0cf41257,	0x3ebed2b7,
-0xc24fa184,	0x084523bc,	0xb7a62e05,	0xb7b64b28,
-0x5c926138,	0x88f3346f,	0xd0bd95ce,	0x0a130c87,
-0x4cbee562,	0x4020be46,	0x83460e2a,	0x2e44c926,
-0x80b45964,	0x37b94c25,	0x74019708,	0x59c03c00,
-0x47bc9dc0,	0x3c3142b2,	0x37a323d3,	0x3a9f60e6,
-0x61b527a8,	0x36ead7b3,	0xe0876b20,	0x62e103e4,
-0x1d121a6d,	0xc8105f0d,	0xdd252e3d,	0x930b581e,
-0xeafa1998,	0xeb7ff364,	0x413bc324,	0x954ce936,
-0xa7468f25,	0x885b2cae,	0xc564b9c7,	0x731d380b,
-0x868c22f1,	0x598c9eea,	0xeb05f3fa,	0x9459de9a,
-0x5f6f64fe,	0xa86f3703,	0x52bf65e3,	0x9a6d1ae3,
-0x06403369,	0x9cb53025,	0xcb2e3db2,	0xd0735776,
-0x03804548,	0x515e7fd5,	0x1bc911c0,	0xeffde082,
-0x6e83c7a2,	0x0968c2c7,	0x05f9223f,	0x61a1ca0b,
-0xfa2cdf10,	0xa1fc1a7d,	0x458c9036,	0x8aa6c474,
-0xc25743af,	0x9347ba31,	0x595f0df7,	0xfffb4e3d,
-0xbc8995d2,	0x25c45251,	0x15d585fa,	0x7aa6dc47,
-0x5f4cb245,	0xdde3093c,	0x21d24076,	0xcaac5bc8,
-0x4996d45c,	0x68ed647d,	0xa913abad,	0xdaef2834,
-0x1af11d90,	0xf8f170c2,	0xd1f2f415,	0xd12e7eca,
-0x4a488d17,	0x66cf3181,	0x0cb503f6,	0xe47660b0,
-0x6585acdb,	0xd1458ac8,	0x01e03d3a,	0xa3570cdc,
-0x089c5cdc,	0xda99762a,	0xffd89a50,	0x1d1af7ea,
-0x23c080cc,	0x8f19e36c,	0x0efb27b0,	0x842ffecf,
-0x573b335b,	0xb95fc7dd,	0xcc753e1c,	0xcfeeed94,
-0x60319281,	0xb951d84f,	0x3d285ef2,	0xad86e154,
-0x68ee568b,	0xf773c45b,	0x3da9f5e2,	0x8390a8c0,
-0x2a9c24f7,	0x571deb94,	0x72f2ee6c,	0x92da0173,
-0xc64d1ab7,	0x2e1c591e,	0xea10f1e4,	0xc4bd43d3,
-0x9f40bf13,	0xac535424,	0xdab90153,	0x222dd9d9,
-0xe1fa8cfb,	0xac6e48bf,	0x2e315a7d,	0x810ff992,
-0x42aa7db5,	0x9264cc20,	0xb37bcf8f,	0x7fc98ded,
-0x717896ec,	0x0c8d431f,	0xabf12dc2,	0xa5cb0d3d,
-0x4f5aa31b,	0x279b0ae2,	0xabf896e0,	0x6dbbfc53,
-0x636a82f3,	0xad99a6c1,	0x4a2a3699,	0xea695ce9,
-0x06d8857d,	0x42712072,	0xa20cf6a4,	0x341e3f58,
-0x701f9570,	0x6f0e1667,	0x11f6096f,	0x6742b00f,
-0x66f8850e,	0x8b6450fb,	0xd8a69fb0,	0xa0e53fd0,
-0x134b9267,	0xcdad001b,	0x7d2986e8,	0xea497d52,
-0x34e58614,	0x3e566177,	0xeef44c29,	0xea770a4b,
-0xb31f234b,	0x7b25a4d0,	0x6e60445e,	0x2666d947,
-0x71460fd8,	0xe848e55f,	0xaaeb7796,	0x85fdd232,
-0xd7ae0bc7,	0x1bacd300,	0x0bc22f58,	0xd8d89f1d,
-0x32b0ee1d,	0x179a3227,	0x89a2a16a,	0x80ba1be5,
-0x5b985d2a,	0x01d8f172,	0xde47159b,	0x9f4f6afa,
-0xda08f4fe,	0x9979d501,	0x10c87592,	0x432c7695,
-0x73227987,	0x3d4f140f,	0x64ce99ee,	0xbf8c5e4c,
-0x2d57b3c6,	0xb925c254,	0xd937cce8,	0xf3bc19e8,
-0x35c09ef5,	0xfec6cba2,	0x1dd3d617,	0x6395da09,
-0x25b186ff,	0x7cd137b0,	0x1c875643,	0x1ef07dee,
-0x1ed5f7e2,	0x0e8e78ac,	0x7267452e,	0x1b2519e0,
-/*  2334-m016fbB6.inc  */
-0x00000001,	0x000000b6,	0x07132007,	0x000006fb,
-0xb3176c40,	0x00000001,	0x00000001,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x000000b6,
-0x00000035,	0x2a000000,	0x20070712,	0x000002f1,
-0x00000001,	0x000006fb,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc67566b4,	0x105501ed,	0x8a79141f,	0xd976d998,
-0x39025e8d,	0xc8d4def9,	0x136f7e41,	0xd876436e,
-0x58d10d9f,	0xb7f2421d,	0xe4d5fcf1,	0x02889a15,
-0xad9bed07,	0xa32ab3e6,	0x3491afcc,	0x9c991c37,
-0x2a1c2071,	0xf066191a,	0x3bd898e7,	0x2648d958,
-0xc05f7908,	0x05864b9b,	0xbe4c1eee,	0x1e6c7ef4,
-0x0e7a539e,	0x100b2ab3,	0x1273dceb,	0xfec8847d,
-0x8f37946f,	0x634e3b5c,	0x691dbd61,	0xd89e3cb9,
-0x094639d4,	0x7d972e1a,	0xd6dbd94d,	0x2001c3ec,
-0x34f791f0,	0xeee0d794,	0x88b7459d,	0xc2c73aa3,
-0x607a174d,	0x4f0f8304,	0x65790b35,	0x00532bfe,
-0x1fd1e0cc,	0x7b91f873,	0x154ed42b,	0x7a7108e9,
-0x81637c95,	0x192cb173,	0x28ccd94e,	0xb9bcc372,
-0xac05171b,	0x867f47da,	0xf8e8c47d,	0x1edcdb4a,
-0xd2ca6c2d,	0xe9ee9169,	0x5a6efedc,	0xb6825038,
-0x09277eaa,	0x2a34e580,	0x0f794366,	0x86c99402,
-0x211b98bf,	0xdf8eb0e3,	0xda11d7bd,	0xd440363e,
-0xa7d49f1a,	0x16dd7395,	0x5b23c2fc,	0xab93ea3c,
-0x00000011,	0x8d12ea76,	0xc5c9c349,	0x92308263,
-0xf78e4c9d,	0x72c29f88,	0xd19a18ac,	0x1c90e94d,
-0xeb8c5d92,	0xf7bb5a98,	0xa62ae1bb,	0x1d37396a,
-0x191737e5,	0xe423c9c2,	0x1c16fae4,	0xb95f9692,
-0xaeae4fbf,	0xbed4707f,	0x70f70fa6,	0x3e80ad8a,
-0x668f54d9,	0xff968f7e,	0xc4e24190,	0x0872ccf0,
-0x4fa39955,	0x55a1a6f5,	0xc36d7848,	0xe82e7047,
-0x3ea79a72,	0x27411065,	0x55930d6f,	0x8e94ddfa,
-0x6008c698,	0xb315b1d6,	0xedee441f,	0xd3875916,
-0xd0a76bae,	0x14ef297d,	0x6393320d,	0x69d787dd,
-0x7973bdd6,	0x7e5c4c27,	0xdfe61741,	0xc631b12d,
-0xcc99b991,	0xbeed1d1b,	0x9b3c5535,	0x78a48b4a,
-0xe278d8a2,	0xf1c80ebe,	0x70f3ed4f,	0x4744194c,
-0x53503244,	0xf94ab448,	0x04f48675,	0xa91912e6,
-0x0fbe4a37,	0x22dd31d7,	0xc7b0cb0d,	0x752eebc1,
-0x83141b0c,	0xb59e8702,	0x5efa7721,	0xc8440cd4,
-0x94a00db5,	0xfafd13f4,	0x878cc0a0,	0x735a935a,
-0x456ae71e,	0x405aa5f4,	0xcb272526,	0xeb85d034,
-0x91f58175,	0xbab6094c,	0x48426d3c,	0x18bb5eea,
-0xe9ee4304,	0x0868f031,	0x29413b52,	0x29ab13c3,
-0x575646eb,	0xb24f2668,	0x142b91b2,	0xfa969908,
-0x12b79a91,	0x38bc2ba2,	0x525e5da2,	0xabc63db2,
-0x9bce15d9,	0xa2d2a006,	0xa1744c42,	0xf64f876a,
-0x4121f17a,	0x0e24d1b5,	0xb27a09dd,	0x2741ca03,
-0xd83fe2bc,	0x59a0aeee,	0xe861ab21,	0xb304ca71,
-0xb8bc5b2b,	0x1553f2c5,	0x5d078685,	0x3de43e77,
-0x8e1f2eb1,	0xa9eb40bc,	0x3bcb1973,	0x4721b5b6,
-0x73e23954,	0xa9464b92,	0x82ad836e,	0x56b8a136,
-0x4bb95ff6,	0xa538c8aa,	0xe2bf3da3,	0x1347a40a,
-0x34f844c2,	0x596ab878,	0xa9f94b32,	0xdad18fd1,
-0x6f2fda04,	0x09c10ec7,	0xed4a2d3f,	0x375add96,
-0x0ae45688,	0xa594039e,	0x8fdae080,	0x7f3f4a68,
-0xef496e17,	0xab450c5e,	0x9a43c59c,	0xf5394c3a,
-0xf09dd852,	0xb9b41813,	0x45ed7124,	0xcfe1955c,
-0x7e3eedcc,	0xf4603b14,	0x1907131c,	0x5b45ade1,
-0x154c8205,	0xcf98affa,	0xfaf58903,	0xa071e600,
-0x0814f47e,	0xacd29fff,	0xa9246964,	0x7a638372,
-0x3d1061b1,	0xba47647e,	0xd1fbee16,	0x896dd880,
-0x1c100f37,	0x99cb8778,	0x48062c08,	0xd0366a79,
-0xa6d7ddb8,	0x86c68a9f,	0x02ac6f34,	0x0e144676,
-0x20d43c65,	0xcb6a9b99,	0x0e1c9291,	0x9cfd5b8f,
-0xac43cbcf,	0x34a7974d,	0xce017104,	0x975c2efc,
-0xd55c5dbb,	0x0e16766d,	0x890dfd62,	0x2934622d,
-0x709fa149,	0x21a94f12,	0x43113498,	0xb146aa2f,
-0xfbbca7ff,	0x1782cec2,	0x9ff3b595,	0xfe4b2b95,
-0x0fd2fbd8,	0x1651f923,	0xa74fe4cc,	0xd07a49c0,
-0x0d0adba2,	0x9c70bce9,	0x08e8b8d7,	0x32dbe104,
-0x6168b74f,	0x7a24fdbe,	0x5e3b2564,	0x6ffe5439,
-0x1e7721c4,	0x94af4976,	0x1391cec8,	0xafa04102,
-0x79d64355,	0xd88737af,	0xa2f2298f,	0xc980628f,
-0x465e2d9b,	0x8b2bfcf2,	0xc46fb4fd,	0xc352c65c,
-0xa3064ff7,	0x3b9264da,	0x7427ca4b,	0x41c01632,
-0xa2d1ed33,	0x6cca9f3f,	0xf8b67421,	0x305e1584,
-0xc9732051,	0x89a0091d,	0xc374e441,	0x587ab4e7,
-0x958dd99b,	0x286d9f81,	0x10c67cdd,	0xb85d1783,
-0x67b38f42,	0x30b90891,	0x45894054,	0xd050199d,
-0x130063b6,	0x7b5e0863,	0x8a61c4d6,	0x2c44fe2e,
-0x148428aa,	0xaa587921,	0xf542fe2b,	0x7b7da7e5,
-0xed3bd14f,	0xb2616902,	0xc840e668,	0xb2623ee3,
-0xbfc63cca,	0xed8b82dd,	0xf7d3cb2e,	0x41eab7ed,
-0x8c3bfe0a,	0xd24a3c82,	0xd6d3d9be,	0x3aedf032,
-0x957a863f,	0x04d80868,	0x1a59e52b,	0x52ee31fb,
-0x8aa7dfa0,	0x2dfb638d,	0x2967e9cd,	0x0aa67bda,
-0xd87b2b96,	0xea23ba62,	0xd6c97957,	0xa6f1cc56,
-0xac8c9465,	0x3408348f,	0xc82fc701,	0xdf1d0e14,
-0x11f617a5,	0x93f4964c,	0xebfae6fb,	0x07f0a028,
-0xb40c5b7c,	0x6c0f33f6,	0x854abf0a,	0x89e518d1,
-0xfcb70776,	0x1cf65ddc,	0x1dc0ae2e,	0x418ff41d,
-0xafbc49f4,	0x064e2e27,	0x35ce2cc0,	0xece5ac9a,
-0x7c245d5d,	0xf22af2a7,	0x5a5df3a5,	0xf991e2f4,
-0xcd0b15fd,	0x68bd046a,	0xd29d50c6,	0x1e691c01,
-0x7a4d3cd5,	0x2f6275da,	0xf1cee3f3,	0x84261101,
-0xd32ecfdc,	0xe75fdec2,	0xc02846a8,	0x13f19aa6,
-0x3dafe115,	0x2c2b0488,	0xbb9da407,	0x196198eb,
-0x897db3b0,	0x58813217,	0x917af6ba,	0xf7fa30ff,
-0x277c26a1,	0xde9ffb6a,	0x85eb946a,	0xb9a6295b,
-0x3f7f687a,	0x17fef8a5,	0x3af23085,	0x457a11a3,
-0x2a73b9a7,	0xedbfd16a,	0xd2e88242,	0x1e3c02e5,
-0x0ea74671,	0x1fc9e250,	0x5a313d7d,	0xd5a49528,
-0xe749e126,	0xdf0de086,	0x35b60d77,	0x07fb5491,
-0xdedda50a,	0x51325ec5,	0x8cef16c0,	0x5dbc5f47,
-0x0c02a13e,	0x76604b7c,	0xbfef93fb,	0x3e7f0bf0,
-0xd1add7e3,	0xdd6c3a85,	0x6e1e119e,	0x38278895,
-0xa8df00b8,	0x19f99ab9,	0x368b3ea6,	0xcde20a8b,
-0xf7acd01f,	0xc59c84f9,	0x0a0b6d38,	0x18cb2d96,
-0x37544234,	0xc2c89561,	0x603d7483,	0x8049a647,
-0x86cee8e1,	0xfab3b928,	0xbf53d180,	0x548aaaef,
-0xd0840b5d,	0x56475635,	0xa29f7fea,	0x1db9078e,
-0xc29beac4,	0xe34189e0,	0xae65a95a,	0x5ba92288,
-0x50152e52,	0x9ce2d6cc,	0x1a602dca,	0x72671a71,
-0xde59b037,	0x7adb5fe0,	0xcadf39c4,	0x7110db44,
-0x00200eee,	0xf2a574d0,	0x7cc14a56,	0x9b01c7c7,
-0x363a0d5b,	0xff8a60e8,	0x34e900dc,	0x567b5d4e,
-0x6b52d659,	0x82e22016,	0xd2e6cb9f,	0x611391c9,
-0xe99bad01,	0xc6e46ebb,	0x14e29144,	0xb8e85f81,
-0xea508116,	0xae7aa3b1,	0x6d535779,	0x673ec856,
-0x285dfb55,	0x4671b198,	0x21491515,	0x1fd77e2b,
-0x1dfbfa06,	0x442161e9,	0x0dfa5161,	0x9ba818fe,
-0x708a8e17,	0xc9754986,	0xeef3ab77,	0x8caa3151,
-0xfe6d3b59,	0xcfba71e2,	0x780b6c3f,	0x0fedcdbe,
-0xb3dfbdf4,	0xbb0d7953,	0x1d9450d3,	0x58d71d72,
-0x09d71b70,	0x679bd3ed,	0xd68bfb24,	0xe93470ed,
-0x36b2a64a,	0x6ddb8077,	0xd6968654,	0x29868706,
-0x30af7610,	0x0fc9eb07,	0x10690e76,	0xfe62ee78,
-0x9ffb3fc6,	0x0c34f0e5,	0xbc01db4f,	0xd4fbb08f,
-0x4420b704,	0xa4af88c9,	0x0a3ae196,	0x6af40c74,
-0x08d58801,	0x886ba013,	0xd70a4f3e,	0x924c5830,
-0x494ee315,	0x90f62676,	0x727c427b,	0x78e0fb4b,
-0xf9b4508b,	0xac37411e,	0x8e1f7b36,	0x54778002,
-0x00080c22,	0xd55e89e6,	0xef8b0961,	0x43eab9ab,
-0x98e8e142,	0x9ef7eb71,	0xb1b0a6f8,	0xb259fec7,
-0xd04d9f7f,	0x873a79fc,	0x6dff58bb,	0x7747a1ef,
-0xef25d604,	0x21eb7b76,	0xee7cf400,	0x11056351,
-0x57ecdffe,	0xfe939145,	0xf52794bb,	0x55917634,
-0x9fb4d599,	0x5bf73f5e,	0x11382735,	0xc6cba6b8,
-0x3ce059fe,	0x88f1bfbf,	0x4ed5941f,	0x9009764a,
-0xf9c7f463,	0x0f28df41,	0x8cad66cf,	0x3ea7591c,
-0x6707c286,	0xd47cb952,	0xf53392e2,	0x94e1a29e,
-0xd4fb88f4,	0xa5fcaf93,	0xf5ba3444,	0x91249b70,
-0x0bbeb5c9,	0xf943bfe9,	0x92629f51,	0xbc10d3f6,
-0x9564f091,	0xad4bb29e,	0x0a50af33,	0xe8f79296,
-0x8bf25c64,	0x81bdf02b,	0xec22d493,	0x0d2efea1,
-0x52e2a6cf,	0xd412701d,	0xa17df71c,	0xb9f62247,
-0x4d7b517a,	0xa9bd93a0,	0x94fb1eaa,	0x2d4bc7fb,
-0xcd857966,	0xaf4953b6,	0xf664d4a2,	0xf1e12279,
-0x1827aa2d,	0x6db71721,	0x28159f88,	0x9df25ab6,
-0xa97443a9,	0x378b6644,	0x6ceebaef,	0x0e01e9fa,
-0x048cf8b0,	0x962c3d48,	0x2d375c33,	0x407593a6,
-0x693e2d8a,	0x9d5a557c,	0x44863ad9,	0x6ab3e26e,
-0x3ec52d9f,	0x0933fed7,	0xa7b06032,	0x266f3a2f,
-0x02575fdc,	0x2224ba45,	0x71c02d29,	0x1b08c7d1,
-0x8b2200cb,	0xfc1c9a92,	0xbddc0508,	0xf3220cb2,
-0xcf373ecb,	0x0dce00e9,	0x59e970e7,	0x0bd36624,
-0xbbd1ce75,	0xa8641ec8,	0x06937187,	0xc3f2d380,
-0x8a7adc67,	0x79f67552,	0x7fdf88a5,	0xb6941a6e,
-0x0aafe9d5,	0x1d86eab7,	0x9240d112,	0xca6c7aac,
-0x6ebaa150,	0xbba6c64f,	0xf20ec41c,	0x14a3c3fd,
-0x8e3db21b,	0x66ad6654,	0xd339f5e1,	0x749714f2,
-0xb22ba620,	0x9f4f0119,	0x3745aaec,	0x5ba03b86,
-0x10bb4d86,	0x96309fe1,	0xf93c8620,	0x901c3170,
-0x3224e497,	0x453639b7,	0xc8cb8101,	0x860a60c7,
-0x10a69fae,	0x5cd0cf62,	0xf0c9fe79,	0x49b7f0b5,
-0x89c719bf,	0x8caf497a,	0xca747cd6,	0x4a0cfabc,
-0xb2f2cc33,	0x2768703f,	0x89e7e499,	0x44dd965b,
-0xf7a772d7,	0xdd508108,	0x8a43b845,	0xba5a74e5,
-0x6ca47c79,	0x72b9e0bc,	0x9479ce84,	0x3342f0b1,
-0x9a39e2c0,	0x57808b69,	0x288ff4b6,	0xe5fab877,
-0xed07f654,	0x0ee79da9,	0x02e7b183,	0x456fdb53,
-0x11aeeb6c,	0x8c2fadb9,	0x67f79309,	0x2f97a264,
-0x02af0d27,	0xf07f9608,	0xb66fd12c,	0x25e6bbc7,
-0x92001908,	0xc52170a0,	0xc9fa7f41,	0xbf361c71,
-0x33cd7f76,	0x776f9b61,	0x459cdfe1,	0x065dbdb5,
-0x67a6f1d1,	0xcbbee73d,	0x2f7b516c,	0x1fda5e43,
-0xeba7d6ab,	0x337c3557,	0x1f2477f5,	0xeec7d493,
-0x749fa13a,	0x3c37e01d,	0xa78babcf,	0x9ee438d4,
-0xaa57066a,	0x9efe96c5,	0x8d45bd8b,	0xbc36930b,
-0xfbf60974,	0xdbb7844b,	0x44001279,	0x14e036b9,
-0xb524f4a6,	0xad1cee3d,	0x351aca37,	0x22861da8,
-0x0648f10b,	0x394078f1,	0x4287ef8c,	0x5c52b8a2,
-0xaa345739,	0x959a7de2,	0xb1cd8059,	0x29b3e4f9,
-0x3ee210dd,	0x7a4e3104,	0x7e6ccae0,	0xb6d003d5,
-0xfda934b3,	0x0e0a48d0,	0xd4109873,	0x2812c616,
-0x635c5c94,	0xe3f9d4ac,	0xf0a6aaca,	0x7541e3f6,
-0x3fc3b0c4,	0x49fb84e3,	0x710f44de,	0x7557e168,
-0xa524128c,	0xdac666c4,	0x0231bd62,	0x0f8d71da,
-0xefc53932,	0xff6f8f71,	0xe28502da,	0x033e463d,
-0xcd4e9499,	0x32702fe4,	0x51e3dedc,	0x9923eb00,
-0x0d4391d5,	0x55abc4a1,	0xc487b606,	0x67a99b08,
-0xf8f3b29a,	0xe21b51bc,	0x3cf54c4c,	0x5ce361fd,
-0xa1bbcd20,	0x842530fd,	0xb916ed90,	0x6c0fc501,
-0x0306ef82,	0x01f9412c,	0x1f418a83,	0xe1a87a00,
-0xe3170dad,	0xee8e482f,	0x9a3c5c02,	0xb3be7f4b,
-0x98a8e507,	0x8e567e9d,	0x878294a2,	0x0257b6d8,
-0x478dd212,	0xad7f31c2,	0x0ddf5f18,	0x870a41d2,
-0xb80eebad,	0x65d01cfd,	0x2420af2d,	0x03d4928d,
-0x7ecdd5a2,	0xaed78097,	0x489bbdf8,	0xac3b4047,
-0xf86fd0ed,	0xb6e1d459,	0x25cb9f89,	0xa930c756,
-0x3fb6730b,	0x6dfd3141,	0x7040efde,	0x5e7b20c1,
-0x7e0bf614,	0xff9f51c0,	0x0bc3d4c0,	0xa9646223,
-0xf5d6bf0d,	0xa39adc0c,	0xbad2e29f,	0x1fb82009,
-0x8a67db42,	0x33371921,	0x8fd37f99,	0x1d8bec6b,
-0x3318d993,	0x1d1fc4cc,	0x809090c5,	0xcba8a502,
-0x3fe6234f,	0xa0c82c20,	0xcebbdb15,	0xd63aa273,
-0xa2697101,	0x0307172d,	0xc9ab9add,	0x10810732,
-0xf9572b9e,	0x0446f0f0,	0x201f00ce,	0x58b49de0,
-0xad59fb0a,	0xf68fa3d7,	0xf16e483c,	0x2c8712ae,
-0x8d813fa1,	0x7cfd639f,	0x177ccd17,	0x20d1b4de,
-0xcd0d849a,	0x172391be,	0x46960345,	0xeacd959a,
-0x6b5bb948,	0xc918da1d,	0x10e663e9,	0xdeb1947b,
-0x97a1daaf,	0xec2aeac7,	0x977a8130,	0xba638e7e,
-0xe6013c46,	0x8139db8b,	0x8a99f837,	0xb764477a,
-0xc5e25c77,	0xee619c4c,	0xf62b722b,	0x4c668ea5,
-0xc844b875,	0xed00e58e,	0x374de0c6,	0x976c7b53,
-0xa0f4b261,	0x57fede6a,	0x9c496394,	0x5d6bf467,
-0x49c55f0b,	0x7fcaa93d,	0x80af6060,	0x2c06d418,
-0x05b6c9f4,	0x530b1c98,	0xf399a24f,	0x5d696799,
-0xb4f01406,	0x950b7725,	0x161cc738,	0xbb2cb047,
-0xb00e5899,	0xef80ad2e,	0x258efb9f,	0xcea45c0f,
-0x2b92718c,	0x43b2b1f2,	0x859df60a,	0xf2d38ec7,
-0x8a21f675,	0x8736fc22,	0xe54f56a2,	0x399bf38f,
-0x2f0ab0e9,	0x867d5f7c,	0xfb1d5d33,	0xfc37f1bf,
-0x54d69e7a,	0xf7857201,	0x38a74088,	0xe9b7f4c7,
-0x1499d362,	0x107b8406,	0x9d232cca,	0x258c896f,
-0x492dbe35,	0xa501bc07,	0x9163e950,	0xc8bc7f87,
-0xad441a50,	0x05951263,	0x90e3eecb,	0x53902d55,
-0xed85a316,	0x601f2763,	0x11406d6d,	0x8a6595bb,
-0x7742c2e9,	0xc0110a3f,	0x9e302c92,	0x3bad12f5,
-0x92621943,	0x15d9ffa7,	0xbf4c7e98,	0xe4329cd4,
-0x2dd15e35,	0x14f41072,	0xeb93b35f,	0xa46fda4b,
-0xb397dd25,	0xff473a19,	0x4e671ddd,	0xeab28b65,
-0x248ee99b,	0xda0fd07e,	0x90622959,	0xaa1b00fc,
-0xf66ab278,	0x468a4536,	0x9e8b7fd4,	0x2248ca01,
-0x14849148,	0x8b112b0e,	0x9fbe1840,	0xd9329b20,
-0x3411070d,	0x18303ffc,	0x6227a516,	0x482105b6,
-0xada6610c,	0x4974a4e4,	0x37edb9b2,	0x60cdcd07,
-0xb385a684,	0xe40e9d41,	0xd213f44d,	0x1e6f0465,
-0x3d9341ba,	0xe6b1ca3f,	0xd90134d2,	0x30a84f64,
-0x985f3aa1,	0x8f8960cd,	0x4bbb5ac7,	0x813e6e6c,
-0xf9da3cc0,	0x376b463f,	0xbe42b933,	0x601f62a2,
-0x3f912588,	0xc3d98614,	0x4a86672b,	0xf83e9f6e,
-0x8bc8b9f3,	0x656a02e4,	0x9ed5cf15,	0x71db2aa9,
-0xdee9e1ae,	0x31bce974,	0xd90df1ff,	0x2407f850,
-0x7dad6b36,	0x04b02538,	0xf3ab51da,	0xadb88427,
-0xa8fd87c2,	0x44e3913d,	0x53db94bb,	0x7b9c97d6,
-0x1c139a60,	0x446e3d77,	0x7718ed0b,	0xf21d7332,
-0xb7acf39c,	0x80a90b35,	0xd6d5b48a,	0x63a41462,
-0x00234218,	0x90744431,	0xcd22c178,	0x270c0b5c,
-0xafbfd299,	0x69a4382c,	0xa910cd4a,	0xe33fb607,
-0xc6466ac3,	0x800bd126,	0xddf65ba6,	0x9363268e,
-/*  3104-M08106CA107.inc  */
-0x00000001,	0x00000107,	0x08252009,	0x000106ca,
-0xbe667ca5,	0x00000001,	0x00000008,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000107,
-0x00000010,	0x000500b0,	0x20090820,	0x00000401,
-0x00000001,	0x000106ca,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x2beaa92c,	0xfc3395b7,	0x10be81a0,	0xb318e067,
-0x723923f0,	0xb297dc63,	0x7d52bc4b,	0xc6ef362f,
-0x0882023d,	0x953684cb,	0x0abe06ee,	0xa7ef1798,
-0x160d6cb8,	0x930cf745,	0xafc3fd79,	0xa70df3d5,
-0xb0620f46,	0x70048a23,	0xbf95ecf0,	0x76c1b997,
-0x5128616d,	0xb6b4b969,	0xcc69f71d,	0xdf7416e1,
-0xdf9a571b,	0x50c0bcc8,	0x85e2b3cd,	0xc1927532,
-0x7a04b6be,	0xe56b7f97,	0x524085c4,	0x668bf327,
-0xb3eaa54c,	0xccde06f8,	0x09b4e42b,	0x033b0a46,
-0x0f6e2fde,	0xb308ce53,	0x93eff03e,	0x8830014e,
-0x5c8a6f22,	0x91d2f757,	0xf70b648d,	0x0789998a,
-0xd84d4640,	0xe5f34e80,	0xf3357e64,	0xd1e2beea,
-0xc7e95c3a,	0x30e57e4d,	0xec214356,	0x7e10859e,
-0x1d5895d5,	0xdeeff6cb,	0xed1030ed,	0x827e603d,
-0x6b4b2de3,	0x83ec6fd0,	0xa64092f3,	0x8d9887e4,
-0xbefcbedd,	0x2111afef,	0xcb9abf96,	0x5c79ceac,
-0x9bf8a57f,	0x5d0e44be,	0xdca3d3b6,	0x9072d1ca,
-0x48e73a50,	0x8d0bc804,	0x6aea94d3,	0xc372403e,
-0x00000011,	0x3b994153,	0x23faa5e1,	0xc3feae68,
-0x76d5e67d,	0xbd696479,	0x138a05ef,	0xf2b5de22,
-0x4ccba0ed,	0x333cc95c,	0x8d98a2ae,	0x0bf1fa24,
-0x239f1fbf,	0x44701d3b,	0xb176783f,	0x20eff2cc,
-0x0cf93bf9,	0x4e6ace41,	0xe346d231,	0x11d560af,
-0xae8874a2,	0xe344fa92,	0x0056d268,	0xd8068d91,
-0xf336cf97,	0x45c54f6d,	0xc0650992,	0xa3f86cb2,
-0xc73d3aac,	0xc7654f1f,	0x385777ad,	0x20928850,
-0x47509cab,	0xf40f9ba6,	0x34efbe6c,	0x1fe3b873,
-0xfb39bd58,	0xa50b6367,	0x66c20e63,	0x49a4e1ee,
-0xe490ed5a,	0x98c340fa,	0x30bfe19d,	0x4c17d142,
-0xea54c4e2,	0x8c00e086,	0x219dee1b,	0x739a2fc1,
-0x1e07b80f,	0xea6f4799,	0xb4684fc2,	0x42fc725a,
-0x1d3c7413,	0x188b6f3c,	0x2c0e440f,	0xc6ad011d,
-0x2048625b,	0x3be9d940,	0x0a932622,	0x1fafce30,
-0x1cfa4c90,	0xd0e9f989,	0x31c0c399,	0xad0c597d,
-0x48a94bb5,	0x109da683,	0xcdc197aa,	0x7bf7ef14,
-0xebf3afa0,	0xde4ff7d3,	0x02a79e3f,	0x4d77f0e5,
-0xd0c1fd98,	0xdb342a5b,	0x7f753eca,	0xb710c135,
-0xacb3b9c0,	0x5e89ece7,	0x2ca4fe84,	0x4f22e461,
-0xa6a633fb,	0x508fb453,	0xfe1f342d,	0x79bcff1f,
-0x0c776771,	0xd6c5db47,	0xfe4d8cc5,	0x68b9f655,
-0x447b7366,	0xddde31ad,	0x8e3496df,	0xe091f8dd,
-0x78eb0fe2,	0x9e08c72d,	0x6909c46b,	0x92ca6b4a,
-0xfb7a0efb,	0x55f65148,	0x9fcc90e1,	0x254f5f40,
-0x0690dcd5,	0xc6a67013,	0xda2e35a9,	0x9171cb50,
-0xe477a087,	0xc0f89e14,	0xc1221ebf,	0xf032e99f,
-0xc8883a7e,	0xba4b17c9,	0xb0ef0962,	0x6ea751f6,
-0xfc8c336c,	0xd1966bf1,	0x26d57e1d,	0x952e847d,
-0xccdaf0c9,	0xd0aaee65,	0xb2f22a59,	0xc74bc035,
-0x900ef42a,	0xeb1e7bfe,	0xfc465b3a,	0x0cd002ce,
-0x560f5d4b,	0xecbc2658,	0x9f38856a,	0xa3f77ba1,
-0x3ee18273,	0x7ab97b2c,	0x0f5843cc,	0xdb648b0a,
-0x8e450381,	0x80176891,	0x05e3e6d2,	0x36593afe,
-0xebe78fce,	0x53d7f64c,	0x2dde1104,	0x293cd7e2,
-0x4f430fa6,	0xf3a8cdb0,	0xd28f6535,	0x9159d53b,
-0xac66a916,	0x8f77be38,	0xa16b9dad,	0x1a4699d0,
-0xe278df12,	0x2c336789,	0xb668fe15,	0x099fa98c,
-0x4fe5ef10,	0xf4692cda,	0xb86d4040,	0xb6dce0eb,
-0x6c5ef896,	0xdef35c52,	0xc02a04a4,	0xed99c619,
-0xd91721b2,	0xa2fac92a,	0x5ab9c724,	0x0ee25329,
-0xc2029fce,	0xc847bfbd,	0x3b97ddcb,	0x4aaaa55a,
-0xa16e313a,	0x06e4b6cc,	0xc0e56598,	0x60ebfadb,
-0x88841f3a,	0x7c6b65ef,	0x15542ce1,	0x70b88b78,
-0x382d1155,	0xe73c900c,	0xd8b6409e,	0xf1cc5406,
-0x64fc3223,	0x43cb616c,	0x17e3a1ac,	0xa9aba529,
-0x8dd83b32,	0xb625cd1d,	0xbcb4b0ed,	0x685cc4b2,
-0x803e35f8,	0x4e679481,	0xc7dd7591,	0xf8676b62,
-0xac25b6c8,	0xb0211931,	0x5c5df337,	0x3bde6fb6,
-0xbc433992,	0xf7315d49,	0x028e112f,	0xe3d59076,
-0x7757e95b,	0xe5c5a193,	0x59b243a0,	0x341f33d2,
-0x7c0d591d,	0x5f96d138,	0x5116c490,	0x747caf2f,
-0x6da223f1,	0xcbe30d11,	0xe10b6b28,	0xa09328e1,
-0xdf1b94ee,	0x163b48b9,	0x72e7a36a,	0x78eda572,
-0x393f0ad2,	0xf85561ea,	0x6e7ca7c8,	0x352cb3b4,
-0xb75bf9f3,	0x97ebcf76,	0x932b8b91,	0x937f1fab,
-0x6ef1e868,	0xce84fc3a,	0x9dd09a21,	0xa8f3be36,
-0x244834e9,	0xd871f223,	0xdef842f3,	0x787eaf73,
-0xf2326bca,	0xd2c3ae20,	0x48dc7621,	0x91419afe,
-0x23a44b12,	0xce0443d7,	0x4a6f1d9f,	0x1ea8cf7a,
-0xb6b7694d,	0xf29e3e25,	0x51665303,	0x33581b86,
-0xc762d72f,	0xaa658158,	0xcddb7354,	0xdacfd75f,
-0x9ec31b1c,	0xf8aa3154,	0xfdeeb2e0,	0x9cb52f84,
-0x16ce9fa4,	0x25050178,	0x2ef25d50,	0xcf4b4d41,
-0xf27d5684,	0x7bae3f36,	0x05b50e59,	0x91d23add,
-0xdbdee4ac,	0xe16994b5,	0x0a5481c3,	0x3deb8a17,
-0xb8844d77,	0xcbce6140,	0xbd748572,	0x6531627f,
-0x2137be68,	0xf46f8aa9,	0x6d2526a0,	0xe72aa307,
-0xb361a2c8,	0xed9c2987,	0x75ddeb95,	0x637d3cad,
-0x2c4dfd37,	0x01f0e2bd,	0xa521a1a4,	0x1194ab8a,
-0x96d7b9c2,	0x94cee6e5,	0x454cc836,	0xa5c0fac3,
-0xf6e9fe9b,	0x3107c251,	0x14c8c6a6,	0xd727c1e1,
-0x339f2742,	0xb0a033de,	0x56fc9280,	0x36a907cd,
-0xb74acdde,	0xe8122571,	0xd0116007,	0x238b3d4f,
-0x34532ebe,	0x1c534370,	0xd1eb258d,	0x354b2289,
-0x6007a18c,	0x58dcee7f,	0xa033ee94,	0xa5e1145f,
-0xe345c315,	0x58510592,	0x33d9db2b,	0x7ea86edf,
-0xce60a8ad,	0x2d9a8919,	0xb5e2840e,	0x020e6e15,
-0xaff8660e,	0x402c12da,	0xfaea95a5,	0x6ffb0748,
-0xc4c730a4,	0x1f57ead7,	0x2cc6d295,	0x0ef4bdb6,
-0x01a7368a,	0x52e88f43,	0xf1b14c65,	0x38018686,
-0x0c70ee45,	0x271b1fe2,	0x0eea950e,	0x61a6f56a,
-0x842497a5,	0xfbcf0f4a,	0x35132cbb,	0x4f2eb1ce,
-0x24fb1bc7,	0x343ec960,	0xda94e0a2,	0xf1206e0b,
-0x80bf8007,	0x7e09d8d8,	0xba6bc1ff,	0x892c956c,
-0x4ceaa5e8,	0x871f3358,	0xe802a1a4,	0x7fa29ced,
-0xea8616cb,	0xc1999088,	0xc5baf089,	0xd1490754,
-0x091f6f21,	0x9a3e3c4f,	0x1eb11650,	0x13fd05fc,
-0x5e9d5b0e,	0xd1485d34,	0x474feaae,	0xc211a60f,
-0xa609643e,	0x07052bb2,	0xa7bfb285,	0x30bbc170,
-0x9ebe8d27,	0x5207a9ee,	0xfc12bd0e,	0x7fa428af,
-0x2d1c8a2d,	0x6f15c0d6,	0xdaf0ee75,	0xd32bb1d1,
-0x694463f5,	0xa1ebdae4,	0xeaa3d0b2,	0x954077de,
-0x181da0bb,	0x4556808d,	0x46e80a64,	0x0c017172,
-0xd8ef8702,	0xa0e6d100,	0x90b0a9f0,	0x4a13a407,
-0xf1675dde,	0x5110d8c8,	0x1c028526,	0x7774581f,
-0x9d3d8c23,	0xcaf8b632,	0xf401a52f,	0xa5d14a5c,
-0xebed6c1b,	0x2ec618ad,	0x5b63935e,	0x89508732,
-0x43a48b2e,	0x87535b2b,	0x0ffb28c2,	0x1fd1becd,
-0xd2b2a18d,	0x45dccb4c,	0xad41a54b,	0x7ffa2fed,
-0xddd18aa1,	0x1db06a98,	0x860d6b58,	0x2997109e,
-0x80a2300e,	0x0cc52e7a,	0x15b24c31,	0x8f717016,
-0xa425cac3,	0x8153e1bf,	0x5e91fd89,	0x04b17f35,
-0x150fd30c,	0xc7309d31,	0x63dce1b0,	0x162eb854,
-0x8093904e,	0xf7b4399d,	0xb23fa735,	0x67509c6c,
-0x5380dec9,	0xb79172a8,	0xb6c249d1,	0xcd040b42,
-0x4efe12f8,	0x63ce3363,	0x406d1666,	0xf8e9bc95,
-0x99cbff2c,	0xaf0cac38,	0xe6556ddf,	0x9bb2a399,
-0x43387c9e,	0x4951f5ac,	0xfa4ddb69,	0x562ec852,
-0xa2e3e441,	0x32a80b75,	0xd88361c5,	0xf04b7ac9,
-0xb0ea18bb,	0xf5035c94,	0x520c9c12,	0xb4c7e15c,
-0x6f72c4bc,	0x80f2112a,	0x4e4bbb87,	0x7bb5ee1f,
-0x54eb313e,	0x18cb6cb9,	0xca5ff580,	0x2538d798,
-0x2b813681,	0x58c11a6c,	0x68ae4070,	0x40799341,
-0xa740f86a,	0x722ca7ef,	0x815c71c7,	0xe663c6f7,
-0x5e249b96,	0xe97e3b71,	0xb7ee5a12,	0xd5f065bd,
-0xaa642191,	0x9864e095,	0x0c087780,	0x0fc0d969,
-0xf6b82791,	0x04aa55f8,	0x872c7cd1,	0x43bc93b0,
-0x12fe4c05,	0x16f15229,	0x06161603,	0x6e76239d,
-0x90ea9c62,	0xecf642df,	0xb52a8db6,	0x2e0c5d58,
-0x10f09bbc,	0x1bb1b2a3,	0x7132167b,	0x291d5f16,
-0xd7814a9e,	0x79e52dbf,	0xef6b61e8,	0x585b920a,
-0x18ea4e61,	0x72ce62fc,	0x59ed8e9f,	0x610564d3,
-0x40f4f145,	0x0a2f60c1,	0xec64ebc3,	0x8ad5b251,
-0xb471e120,	0xb899cffd,	0x2b81118a,	0xa3b591a8,
-0xdeced3ab,	0xcb9aacb8,	0xba53fbdd,	0x6e49e298,
-0x75fa6c19,	0xd11cfe98,	0xd29ce7fc,	0x7471df09,
-0xb59b2474,	0xdff0b07d,	0xae92c4b7,	0x6414ee6b,
-0x6acba1a5,	0xed9c0b5b,	0x728f7644,	0xf6d20c7a,
-0xf03ad03e,	0x6612b0c3,	0xe156c417,	0x9aec4a8d,
-0x02be86ff,	0xe11d1660,	0xefeba14a,	0x7d275f33,
-0x16acabb2,	0x7ac99cd7,	0xd18566e4,	0x3bce4ca1,
-0xb0312f16,	0x5700f72c,	0x345864bd,	0x917a4db2,
-0xaa22b7f0,	0xc66eb69c,	0x62f8a99e,	0x6364a44f,
-0x956d2cd2,	0xfa64b7df,	0x47238b18,	0xddebaeff,
-0x39c9d16b,	0xaa1487cb,	0xc6f91d13,	0x8191316d,
-0xbf5d7ddd,	0xc907cbb1,	0x7a283ba3,	0x0365e6a3,
-0x2fbb3185,	0x159d0436,	0xb55b6990,	0xf0935005,
-0x441e4fc8,	0xd1dfdc91,	0xdd9ff8bc,	0x95c88203,
-0xa8029310,	0x62501ff4,	0xf838a813,	0xfb66d5ce,
-0xe6bb8354,	0xe2afb832,	0x55dcf796,	0x315f28cf,
-0x400de577,	0x3ad89b1b,	0xeee943aa,	0xbd5d9001,
-0x8dd4771b,	0x21ad481c,	0x504d6222,	0xfc0e6728,
-0x7abe5d62,	0x332f8309,	0x50d8c688,	0x4b686808,
-0xbe6395ec,	0x5153b67c,	0x04144a35,	0xa85077ca,
-0xa3775cda,	0x838556dc,	0x973c2222,	0xf5037c9f,
-0xd02b0c87,	0xa3e69f8f,	0xdf68cce7,	0x9490d31f,
-0x3d9c5cf2,	0x939e7823,	0xc51b9a2d,	0x2e802e27,
-0x65079a36,	0x3b6e3d79,	0x5fafbac6,	0x9973bc64,
-0xfc4e7124,	0x56e1fad3,	0x10ec049f,	0xefa79c0b,
-0xcde48353,	0x3fa7f449,	0x07cb1a31,	0xf6ba0053,
-0xe5af7b10,	0x9e2dc089,	0x290f3fa4,	0x116da472,
-0x7a006f5b,	0x727205bf,	0x7c59870d,	0x968c6000,
-0x3ed4fd57,	0xe423effe,	0xc352ef7a,	0xd23d00e5,
-0xbded3a50,	0xedcdc3d0,	0x3a517a74,	0xbdfc58cc,
-0x24b2371f,	0xf967f533,	0x26069547,	0x2114e85e,
-0xa1953f56,	0xf0c52ebf,	0x235320ae,	0x35600f33,
-0x5c1ca2b7,	0xe89db0da,	0x08ce35aa,	0xc66cef79,
-0xacd41ce4,	0x865f4c69,	0x15a3376b,	0xdee5d7a1,
-0x6fdd6362,	0xa4125977,	0xcb61bae2,	0x5e3da819,
-0xc6d2e56a,	0xde1807f2,	0xb30c3473,	0x1c4038c5,
-0xbf8afac6,	0x37423d2d,	0x72d9da33,	0x39e95bf5,
-0xd6a91cc8,	0xbbf4c2d8,	0x7c9d4b21,	0x13c514d5,
-0xcae41aac,	0x07b97f18,	0x0cdfbdee,	0xe7a9020b,
-0x1839f082,	0x7c414530,	0x43ba1070,	0x95945971,
-0x82e31721,	0x2fb159e5,	0x225c2158,	0xfadf74f6,
-0x788387d6,	0xb40c98fe,	0x0c75ba9d,	0x0487eb2f,
-0x7e9a1b0e,	0x5c442185,	0xcf1dffde,	0x39f9bc44,
-0x46b961d3,	0x9a14b19a,	0xe284d2ac,	0x52151caa,
-0x67f34f5e,	0xf4042d4f,	0xa28a223d,	0x3deb23f1,
-0x12d14b6f,	0x18901f31,	0xb3c7950a,	0xfb7d3557,
-0xb83e457f,	0xb6e13f07,	0xd26f5435,	0x83f05e15,
-0xf549a030,	0x6d1122d0,	0x540b3ef9,	0x8ecdac22,
-0xdabe1b2d,	0xf4913cc0,	0x579f9d77,	0xd4725d33,
-0x76b7abb0,	0x03452691,	0x4d52fff6,	0x12e95a96,
-0x42131074,	0xbb3eaa95,	0xb775618e,	0x6325764e,
-0xeb847c5a,	0xeb7b9c6d,	0xd01dd328,	0x547269e1,
-0x2cebecd3,	0xcbb0ed0f,	0xcc87e62c,	0x8e6b0ce0,
-0x8a8f9f06,	0x689e0c4f,	0xb3a1fe5a,	0xed84a0a2,
-0x66187741,	0x62a4475b,	0x5c4c31bb,	0xea000d76,
-0x8676c757,	0xd59cc6bd,	0x52f107ff,	0x1f4a0c66,
-0x7af566ef,	0x4af3586c,	0x11d5cd6f,	0x6b8bc81a,
-0x480eed48,	0x2ec7c65e,	0x6c0f3253,	0x100f2794,
-0x18d6c62a,	0x338f59f6,	0x8e6e2f9e,	0x75fccfd7,
-0xbc80ea7a,	0xa90f1473,	0xfa9d22c4,	0x3ccdaa53,
-0xe568fef6,	0x6a761fd4,	0x61c26b23,	0xabc31163,
-0x3b840e9e,	0xee864319,	0x84f93208,	0x743a780e,
-0x1507a3bf,	0x147dad13,	0x8952177f,	0xbeb40da7,
-0x699af39e,	0x6d22bdfb,	0x5fe8112c,	0xdb3f8dbb,
-0x026f8ff2,	0x6bf9658d,	0x9faabf0d,	0x6a2f3989,
-0x5be4a617,	0x9e55f0c3,	0x70510d75,	0x0fd92413,
-0x63d1d3c7,	0x68cf84bd,	0xbbff5901,	0xb0434b77,
-0x8564b88f,	0x06eddac5,	0xde2a66b6,	0xc1835355,
-0x5566bb1e,	0xbaa890cd,	0x108c6f70,	0x7e80dfcc,
-0xb8c03bb3,	0x14bdcbe0,	0x5037daf9,	0xee02697a,
-0x3326280f,	0x4f04c814,	0x4f640444,	0xbfa9229e,
-0x131c7ba0,	0x5fbcf1ba,	0xebe01998,	0x2a813a9b,
-0x3f27c028,	0xf77a6d00,	0xac0ddee5,	0x1b6e52d9,
-0xdac4bb99,	0x54a32f86,	0x26bfd80f,	0xf5debd9c,
-0x06536e13,	0x9498a87e,	0x3f9e8812,	0x53e0fdee,
-0xc08c3c8a,	0x2148b33c,	0x3932e37b,	0xad084cc7,
-0xe77a0048,	0x89addf10,	0xb2542186,	0xc4c0be6c,
-0xfbc626ce,	0x20a28446,	0x0f29f8f1,	0xbbef5d50,
-0x288b8070,	0x31aa2900,	0x4a538fbe,	0xcd344ca3,
-0x05170c9d,	0x06c51082,	0xc414194a,	0x6689a2cb,
-0x7618c884,	0x412ac324,	0xb0d952d0,	0xfb88757c,
-0xaacbb987,	0x92218ac5,	0x032a3895,	0x2e3a7dfd,
-0x4bb37e4e,	0x52342695,	0xa699f5b9,	0x45748066,
-0x7822f59e,	0x68a55092,	0xf049444b,	0xf274d694,
-0x0524ed76,	0x884c3732,	0x22fa43bb,	0x3b97d921,
-0x210b8c99,	0xc4ffdf26,	0x17ba16ed,	0xfcdfc437,
-0x0b8e2d8a,	0x7b019bb2,	0xd525e662,	0x03346249,
-0x7af3c1cd,	0xbf42dbac,	0xb6197a31,	0xebff8e32,
-0x84f9980c,	0xa225a4b0,	0xa9f3d94d,	0x8a3da052,
-0xc17241e7,	0xf133ce7f,	0x4d4542f0,	0xd884f2f8,
-0xa1633ebe,	0xd5c5e6e5,	0x7fce2fca,	0x8ad84a55,
-0xfdd96c9f,	0xa60d6f4f,	0xe025d2f2,	0x8be1b787,
-0x87a036a7,	0x23819cb9,	0x5967650e,	0x5d549108,
-0x57167175,	0x2f94c450,	0xbb536b04,	0xfb381d15,
-0x405bd359,	0x3ef9491b,	0xa9834cb1,	0x2cc5151c,
-0x148cd3cd,	0x0565ecb0,	0x8e596741,	0xf6d7f089,
-0x9e3524fe,	0xf4224e20,	0x583302fa,	0xebe46409,
-0x7bfe793a,	0x7d511902,	0x1e4a80dd,	0x53a280cb,
-0xa2d81d96,	0xe29b8f4e,	0x877789e5,	0x838ee539,
-0x35f9feb5,	0xa5bb1d43,	0xb24d7510,	0x67cd14d7,
-0x7cfac97e,	0xf6c72b9b,	0x302f9115,	0x1932060c,
-0x0a786f90,	0x85a88dd1,	0x322ef274,	0xb0f8af47,
-0xbb5e6bfb,	0x3f1505c5,	0x33b28086,	0x18025326,
-0x73293fb1,	0xbd813762,	0xad751414,	0xd533bccc,
-0x393b81fe,	0x5b3b79e3,	0x2221dc65,	0x4bf8124d,
-0x26df557e,	0xcb9320a3,	0x9e6e762f,	0x2a800bbf,
-0xbd30558c,	0xc6b2ebe7,	0x204b2c78,	0x3e55767c,
-0xe8dca1c3,	0x1b115140,	0x144da104,	0xad17dbe3,
-0x47640bdd,	0xef84b8c5,	0xf2edc388,	0xb051b0f2,
-0xb67f4713,	0xdcd7d116,	0xb98d5bcb,	0x8b52a03d,
-0x58ae1c24,	0x9404bc9d,	0x01a49407,	0x5cab2a00,
-0x5e747e7e,	0x9aea8823,	0x71d4bdfe,	0x1663aaf3,
-0x8b80d3d2,	0x6675c138,	0x70d05b5b,	0x6bbadfc8,
-0xe05fc1ea,	0xcef15db9,	0xcdee6b25,	0x27f55999,
-0xa1496ac5,	0xf494d5e1,	0x271d267a,	0x29ca643d,
-0x303facb7,	0xaf6f0968,	0x7ae465be,	0x584c068c,
-0x0bd8fb4c,	0x132e1f25,	0xa488d69e,	0xe768cb78,
-0x476c4498,	0x648a05a0,	0x779cf9df,	0x2b56ea07,
-0xfc8b15b4,	0x1b3f922a,	0xcf818f70,	0x0b89290d,
-0x88e3d01f,	0x30da72c3,	0x2eaea5d2,	0xdf0e82b7,
-0xe6ff40ba,	0x09c53e7e,	0x78b3f112,	0x1d6812d3,
-0x13904820,	0xbb5be6a8,	0xe9635ca0,	0xd83241be,
-0x3c2382f4,	0x4f03a252,	0xaa83fa23,	0x6350651d,
-0x67770010,	0xe7662496,	0x50f87e8d,	0xea4c361c,
-0x62cb111d,	0x5a748529,	0x194b6db1,	0xf3328462,
-0x02e7215c,	0xe7beb99f,	0xf304e37a,	0xf8167391,
-0x32b23d69,	0x3041d4eb,	0x4938991b,	0x52095853,
-0xdc929597,	0x79c1797a,	0xfe235349,	0xa927f0f2,
-0x76f3c3af,	0x9552017a,	0x3eef55e4,	0xff153c64,
-0xdfa3fbb8,	0x7598d7bf,	0xabc4c81d,	0x31ff99df,
-0x3cf58e98,	0x9ef252a8,	0xcfdb2371,	0x87f621c3,
-0xcec0442c,	0x208c19a5,	0x0c38d69c,	0x6b5b4ffd,
-0xf4c411ac,	0xb309b4a5,	0xe72f34c0,	0x02841ec0,
-0x33008fec,	0xee5f5c1d,	0x29ef9810,	0xb5eb9790,
-0xa7ef545d,	0x45e476de,	0x54a24e04,	0x0990a7a6,
-0x3be1ee6e,	0x9ecd6a6e,	0xb8ec728a,	0x6752ab8a,
-0xcbc5c9fc,	0xe297793d,	0xf9d64e3a,	0x9970acff,
-0xb52196a6,	0xe40d612f,	0xc7691ae6,	0xbd7cb50d,
-0x741712a0,	0x4af143f7,	0x6b8140ac,	0x695edb52,
-0x779b36d3,	0xff7319c3,	0x24b22cc8,	0x9549e25d,
-0xeb61c0f5,	0xbc0285a6,	0x5b34d260,	0x9ead3844,
-0xfa05f755,	0x01205a39,	0x7332b47f,	0x618d193a,
-0xf577410e,	0xa43a73f0,	0x5ef40779,	0xf6d05937,
-0xe6bdcc69,	0x97c7c59e,	0x1abd06e9,	0x1f6100b4,
-0x4193fc0f,	0x58158a8f,	0xeb660c8e,	0xc53c6f4a,
-0xdb6cb2d4,	0x9d8c88c7,	0x8ff74335,	0x44cc1e67,
-0xd0e4d4d5,	0x926224cc,	0x95cbffe6,	0x621764d4,
-0xb7b37387,	0xceecbf7c,	0xa60fda9e,	0xe6bbc331,
-0x56911995,	0xcd196d6b,	0xf2a18ead,	0xe6b5484f,
-0x1fc18a27,	0x58c18e28,	0xdf947a19,	0x9355834f,
-0xd6200656,	0xbfc8210b,	0xa5f74216,	0x550140aa,
-0x17e2ca8c,	0x2a56ebde,	0xf387b1ea,	0x9d97f5e6,
-0x056ef46f,	0x90909eeb,	0x7a7f5867,	0x86974716,
-0xde02612f,	0x389718e6,	0xfba5b72e,	0xd74f780d,
-0x370152e3,	0x84bec429,	0x944c0604,	0x80d2e23d,
-0x661eca8e,	0x1f45bdb2,	0x00e19b5a,	0xf666af38,
-0xd1d383c3,	0x3def0d6f,	0x1444fa5b,	0x0aa11ee2,
-0x1eb25d6c,	0xcd51ae3a,	0xdb0c559c,	0x22818716,
-0x9ba1ba6f,	0xd0c97b0c,	0xc14f04c5,	0xa1240202,
-0xe2110419,	0x293f4dd9,	0x98c2fa3f,	0x67ec66e4,
-0x5a9af6c5,	0x4254b385,	0x8c2bb55c,	0x2834b05d,
-0x39bac0a4,	0xda998f86,	0xe4797beb,	0x0cec5a2d,
-0x938b3950,	0x38d4e088,	0x0305d5b8,	0xf3b28762,
-0x589f97e9,	0xa5898e96,	0x1bcd52e7,	0x0652e8f3,
-0x69800c5b,	0xed46c25e,	0x09b395a4,	0x06a963a6,
-0x71597fad,	0x0570bbd2,	0x0dfd6639,	0x086b5b5d,
-0xe3d87df1,	0xaa6e75c9,	0x6bb447c1,	0xa54550ab,
-0x4d59eb97,	0xf3a29b0f,	0x969e92cc,	0xf14624b3,
-/*  3163-M0120661104.inc  */
-0x00000001,	0x00000104,	0x10232009,	0x00020661,
-0x38cb12b9,	0x00000001,	0x00000001,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000104,
-0x00000017,	0x000500e0,	0x20091019,	0x00000401,
-0x00000001,	0x00020661,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x09eccda1,	0x1adbcb9c,	0xc2c1c2d3,	0x052a20d7,
-0x37c6c23b,	0xc9a271c8,	0x169f18e1,	0x8ca95050,
-0x0882023d,	0x953684cb,	0x0abe06ee,	0xa7ef1798,
-0x160d6cb8,	0x930cf745,	0xafc3fd79,	0xa70df3d5,
-0xb0620f46,	0x70048a23,	0xbf95ecf0,	0x76c1b997,
-0x5128616d,	0xb6b4b969,	0xcc69f71d,	0xdf7416e1,
-0xdf9a571b,	0x50c0bcc8,	0x85e2b3cd,	0xc1927532,
-0x7a04b6be,	0xe56b7f97,	0x524085c4,	0x668bf327,
-0xb3eaa54c,	0xccde06f8,	0x09b4e42b,	0x033b0a46,
-0x0f6e2fde,	0xb308ce53,	0x93eff03e,	0x8830014e,
-0x5c8a6f22,	0x91d2f757,	0xf70b648d,	0x0789998a,
-0xd84d4640,	0xe5f34e80,	0xf3357e64,	0xd1e2beea,
-0xc7e95c3a,	0x30e57e4d,	0xec214356,	0x7e10859e,
-0x1d5895d5,	0xdeeff6cb,	0xed1030ed,	0x827e603d,
-0x6b4b2de3,	0x83ec6fd0,	0xa64092f3,	0x8d9887e4,
-0xbefcbedd,	0x2111afef,	0xcb9abf96,	0x5c79ceac,
-0x9bf8a57f,	0x5d0e44be,	0xdca3d3b6,	0x9072d1ca,
-0x48e73a50,	0x8d0bc804,	0x6aea94d3,	0xc372403e,
-0x00000011,	0x7d61ca09,	0x31f73022,	0x072dcedd,
-0x935818f7,	0x9edef5c3,	0xa37a44c7,	0x6753a39f,
-0x07a3f8a3,	0x29e66ce6,	0x32b334e4,	0xfee3e6dc,
-0x97902bbc,	0xb99aba25,	0x9d54e519,	0x69254f0a,
-0xb9b7621a,	0x71f115bc,	0x7ebc2520,	0x71c9ffe8,
-0x078bcbcb,	0x37042cf2,	0x3d7c3d89,	0x386b656d,
-0xb3e39f6a,	0xbd27c008,	0x1d24a30d,	0xbab73f64,
-0xa8757048,	0xda99d30b,	0x970d7a4d,	0xd0825dc8,
-0xf95bcfe8,	0x1211aa07,	0xd038be1c,	0xc38ba912,
-0x2f654a0f,	0x7bdfd541,	0x7af6c93a,	0xb1e3bc1b,
-0x6a43b3cd,	0x37797707,	0x29188706,	0xcb2edfcc,
-0xc90e2d35,	0x5b05961f,	0x47bbce1f,	0x369a81d6,
-0xf5dded77,	0xde27bfbd,	0x2c22af3f,	0x3a1a5290,
-0x3989782d,	0xff4f723e,	0x431542e5,	0x90686229,
-0x8bb3357f,	0xd317ab6d,	0x3f552399,	0x0166b0ca,
-0x98d987b3,	0x071de61b,	0x97b06d99,	0x68aaec88,
-0x22047fe5,	0x82077c14,	0xda7e9c45,	0xfcc09973,
-0x3dd45fe1,	0xc6723244,	0x02a3c93a,	0x7336c7d5,
-0x252aa0d9,	0x6ea83874,	0xf74357d0,	0x21232a94,
-0x1ea7ba93,	0x19fa2088,	0x7988f064,	0xa7088cd9,
-0x06f9fbb2,	0xe22e9503,	0x441aa57c,	0xb10ff11f,
-0x37a36a23,	0x2e4274c8,	0x2018eb1f,	0x4f405084,
-0xb178f9f8,	0xf0380878,	0x3334a5e5,	0xa282e950,
-0x3a98e7ef,	0xbdb4a8d7,	0xe7ba9dd3,	0xf7672495,
-0xa5c21278,	0xc09769c7,	0xc151c549,	0x78059e80,
-0xe1ec9e1d,	0xeb729cbb,	0x32cddfbd,	0x04e949a7,
-0x5c944ca9,	0x385230c7,	0x7113a400,	0x99ea1700,
-0x5c1329aa,	0xe4dea11e,	0x302cf77d,	0x173e69f1,
-0x3668f586,	0x0e1324eb,	0x59bb59ff,	0xe23374f3,
-0xd4d8414c,	0xd8e8b1af,	0x52005b2a,	0xe3d569ca,
-0x93b32b87,	0xdd5aa02b,	0xf8aa2a3e,	0x726446dc,
-0x981d0b99,	0x61fa5fd8,	0x4914b799,	0x1e548f8c,
-0x61ead44a,	0xfca5a62b,	0x04213c77,	0xef7dc06d,
-0xb4ec8c96,	0x4db099f1,	0x8faf5452,	0xa01937e5,
-0xa250560e,	0xd36e04db,	0x873e9fe5,	0x7c3a83e6,
-0x68cc3ed3,	0x008ebf08,	0xcbaadca4,	0x4bd65401,
-0xa9e3c4aa,	0xb3d364b2,	0xd3059746,	0x024984fa,
-0xcdea0600,	0x9e0a05dd,	0x5c9010a2,	0x419de94d,
-0xd552d4b4,	0xd639999c,	0xe21a5411,	0x67225aeb,
-0x3969f21f,	0x71b18631,	0xa9238cca,	0x43eb89be,
-0x1df93119,	0x63f976f7,	0x095d59de,	0xb8717d14,
-0x815fc874,	0x7e076b5f,	0xb5f00ae5,	0x6458d539,
-0x6dc88ada,	0x8c1cd801,	0xd0150eb3,	0x34a00d18,
-0xf542d1eb,	0x49bf0834,	0x12263a0c,	0x5150edb3,
-0x407b4219,	0xd3a0e4b2,	0x8f2c53fb,	0x8f0bbd94,
-0x2e6e1f3d,	0x9e04971a,	0x4f1c1e24,	0xad597a91,
-0x4f97bc6c,	0x10e7abd8,	0xb1fda778,	0xb43e636c,
-0xd4a097c6,	0x6e89fbc4,	0xe7b14774,	0x439d06fb,
-0x00aa6517,	0xaae49fce,	0x911315dc,	0x07276afc,
-0x280c56bf,	0x1359f177,	0x6ad2db10,	0xe8b68788,
-0x734d6b53,	0x9579a46d,	0x8f84df58,	0x6eb3e6a1,
-0x4fc3a5be,	0xf3b02c20,	0x1131dfc9,	0x04e4cc97,
-0x2d1fead8,	0x06a332db,	0xf2dbb652,	0x80fee0fc,
-0xd85f7a23,	0x428ccb0f,	0x15cbabe8,	0x19518941,
-0x74dd3421,	0x953306c9,	0xb484130e,	0xbd586100,
-0xb054fe86,	0x1924de13,	0x13eb8bdf,	0x82515d58,
-0x96aa7c85,	0x29f69abb,	0x51d9af18,	0xa888d214,
-0x3060657a,	0x5f71b582,	0x4f708181,	0xc5644402,
-0xb58e041c,	0xb0f94784,	0xfe2b7cbb,	0x45af15ed,
-0x2ecf84c0,	0x987ee925,	0xc7228d62,	0x90333ca6,
-0x021642cd,	0x1e2dfad3,	0xb5639c98,	0x5b908ef7,
-0xec64b383,	0xf7ce0d9e,	0xdd606d70,	0xe7912bf9,
-0x53b0f840,	0xd0a86e86,	0x007d7e38,	0x80d4f5ea,
-0xf29bc3dc,	0x575e3860,	0x8ba76d1d,	0x76cc7650,
-0x049da6a8,	0xfd416631,	0xf9da20db,	0x098fb993,
-0x426cf8e8,	0xb3ccbf56,	0xba9fdb7a,	0xe354957c,
-0x48e4789c,	0xaef62572,	0x2f5cf1fb,	0xe7a6d946,
-0x7b849a95,	0x732b6c1f,	0xe3abd991,	0x9eb235a2,
-0x8ebe442c,	0x5e129d04,	0x5bb55f96,	0x3766a553,
-0x0edf853e,	0xb9226767,	0x60ff14b2,	0x0ee0d1b6,
-0x5e9a9aee,	0xc8ef744a,	0xde27e5a0,	0x352377fd,
-0x493f12b4,	0x0d5a34c0,	0xaa64972a,	0xb4bc4c3c,
-0x964012cf,	0x3d5baaaa,	0x1df4ab07,	0xc03c8ce2,
-0xaf618dee,	0xc84f58a1,	0xdc57eb15,	0x045ad08c,
-0x5570f4e0,	0x08ddd264,	0xbb5820fc,	0x7106fa23,
-0xf1510c32,	0x5d064af0,	0xb1b2809f,	0x8ebcbe08,
-0x69ac1fcf,	0x5e9a9d56,	0x0f42ceea,	0x58ffe164,
-0xb0d6d0c8,	0xc64255f2,	0xb281380f,	0xa3d49ec0,
-0x9f19ebfe,	0xf826410a,	0x14729256,	0xcdbe6238,
-0xba8ef29c,	0xdae66aad,	0xaf025ac7,	0x906f6486,
-0x9211983e,	0x9c4c218d,	0xce336e9e,	0x7a8e0236,
-0x30449839,	0x0099b8df,	0x2d66cea0,	0x7eb12083,
-0x8b1bf8e9,	0xf2a1804f,	0xee28de85,	0x03f739e3,
-0x1d0cdde6,	0xa9fdda74,	0x93166d7f,	0xe26c02d5,
-0x7dfaa665,	0x0120ed11,	0xc1264694,	0x16963113,
-0xef497ce5,	0xf6e22268,	0xdbf63b1d,	0xd61d95aa,
-0x03d1a2c1,	0x9158daac,	0x4a47782a,	0x3ff5df3b,
-0xe3c31825,	0x74992ec4,	0x11423b65,	0xaf976543,
-0x59d3e1fe,	0x26c961f3,	0xe803c69f,	0xcf35f089,
-0x01e0e058,	0xf04939a7,	0xb1540a05,	0xaa2e4101,
-0xf779b9bd,	0xf59bde35,	0x63df12bf,	0x556e084a,
-0xb164bea4,	0x208359c4,	0xd76ad441,	0x46ff3c1d,
-0x833c2aa7,	0x5d72e561,	0x5b9facfe,	0xaa8d71f7,
-0x82d7aa3c,	0x375724bd,	0x1b3aa15f,	0xe9fbcbfd,
-0xb1f759a9,	0x6293146a,	0x230eeb2a,	0xe9a09014,
-0x2640ac37,	0x5674f6a5,	0x61d12dcb,	0x072520af,
-0x7850d98f,	0x77a562bc,	0x0e920abf,	0xab574cd3,
-0x652249cc,	0x4c26a183,	0xe18441a0,	0x6199e869,
-0x9e20991c,	0xf1238bcc,	0x094f7979,	0xc64e1ac7,
-0x90b8dc7e,	0xdd290230,	0x86a86ad5,	0xb97b9c89,
-0xa9d616ea,	0xe807765f,	0x7e7b8baa,	0xa2dcbeb6,
-0x66bc1f73,	0xe4b3d5e6,	0x7764247c,	0xb5719986,
-0x78ee22a4,	0xe3445d6b,	0xab333b58,	0x00b19be3,
-0x1220d5b6,	0x3b222fdf,	0x98f6166c,	0xf7771bcd,
-0x0a017231,	0xb140c1b2,	0x6dcc7889,	0x8e84be0e,
-0x74710aaf,	0x1dfde198,	0x5c1763ea,	0x378574c8,
-0x40506214,	0x7890d495,	0x1caeea7c,	0x124242e8,
-0x0d2d1659,	0x3f632058,	0x3c948895,	0xf05a7b07,
-0xa0ae5a68,	0x9c3882cb,	0xda70168b,	0x644edf01,
-0x1ed86205,	0xbe4571f4,	0x60a05e6d,	0xd880f52a,
-0x7e9fccb7,	0xa170228c,	0x5bb4c3c0,	0xb502c3c8,
-0x3836fd89,	0xbfb7ea87,	0x0b2e37d1,	0x73f27ac3,
-0x1559bee7,	0x30512c5b,	0xe70ceec0,	0x2a7e651a,
-0x0a0413b8,	0x5df2c436,	0x9f8542fe,	0xc9e602b7,
-0xd4622d8d,	0x4200d89d,	0x348f4871,	0x1be6a6b4,
-0xabb0549f,	0xddb20150,	0xf0ba0e1f,	0x1d8855c4,
-0x2dd38376,	0xee8f2d82,	0xadbc10a6,	0xe91e5519,
-0x0f13f842,	0x53db0df7,	0xf751701f,	0x0f31a7a8,
-0xeaa01aa3,	0xa1ef5209,	0xece5ef7d,	0xac0f769b,
-0xd1e4a05f,	0xb0fe376c,	0xd3343845,	0xdd10d122,
-0xf9f9f315,	0x996edf75,	0xcdb63031,	0x3412a583,
-0x500502f3,	0x9e837736,	0xa4e3551d,	0x8e3a1115,
-0x55374f41,	0x038fa5e7,	0xc1e03295,	0xd20ee68e,
-0xf9add7eb,	0x52f05765,	0xef6fde6d,	0x6b0f3c63,
-0xa85dcfa0,	0xc73e3916,	0x6ee12d69,	0x6d60ce09,
-0xfaa6a21f,	0xd5f75658,	0xfd9376ea,	0x6efe1c49,
-0xb4e8cf4b,	0x2c76b2fc,	0x12a2201c,	0x617eb6db,
-0xa79f3bea,	0xbf14f2dd,	0x1d2a7341,	0x1234eff9,
-0x5520f778,	0x91a73b06,	0xa60125cf,	0x54c26f5e,
-0x6fb9adc3,	0x99728dde,	0x84367e1e,	0x540532a3,
-0x20a6be33,	0x8a0999ab,	0x652d3997,	0xd6648136,
-0x45b2b27e,	0xf9e024a0,	0x9577257e,	0x3112b0c4,
-0xedab0e70,	0x0402efb3,	0x3420df5d,	0x2f2f0c8e,
-0x5d33b666,	0x2963d87f,	0xc12bfde8,	0x5a672b5d,
-0xe153b99a,	0xba8bc958,	0x38198ccd,	0x60dcfca3,
-0x53e2a2d8,	0x547046f2,	0x1b62e6af,	0xd957edc8,
-0x50485902,	0xee89bde5,	0xb9337b9b,	0x2a4c67a5,
-0x489780f8,	0x55b7fa51,	0xb752488c,	0x5180343e,
-0xaca850d2,	0x6562c04d,	0xdadb0df3,	0x4c41ab1d,
-0x9042f0e6,	0xc9a6e24e,	0xeaeb5b13,	0x94497bfb,
-0x8c66669e,	0x3c36991a,	0xbb77d8cd,	0x13a18643,
-0x4f37a9a6,	0x64130ca5,	0xe0d0523e,	0x3088857c,
-0x75d7b6b3,	0x954d1200,	0x8cc8b751,	0x1c735711,
-0xa7139327,	0x1414e332,	0x43c5cfc2,	0xa0bac637,
-0x092d9bde,	0x7b48f481,	0xbc85744b,	0x4329b471,
-0x2736395b,	0x645b68e3,	0x00051777,	0x299678a7,
-0x7e2410a5,	0xf70ad7e5,	0x072db60d,	0x338ff2ec,
-0x803d495b,	0x0766fbbd,	0x7f8c28e7,	0x2628ea6d,
-0x82ae362e,	0x2bcc94b1,	0xd6f1389e,	0x171051eb,
-0x4b35d341,	0x21aacdc8,	0x8f312e67,	0xae9f9802,
-0xf024b14b,	0xc3ef3800,	0x847f8652,	0x2105eb06,
-0xc186f047,	0xbb8983fe,	0x0ba80ab8,	0xb124aad9,
-0x776bcf6b,	0xc8b5f288,	0x5efb4775,	0xb0d89882,
-0xa6002c35,	0xb1347ce8,	0x42e28393,	0xb9d2b908,
-0x087dcf68,	0xdf2f69fe,	0xbd468dab,	0x66c7bdaa,
-0x92d64079,	0x8bb3dc42,	0x75547044,	0x2b49d657,
-0xf69698d8,	0x1c0cdaac,	0xaa4ff692,	0x855a848a,
-0x39637035,	0x7226b2b4,	0x0622d9ab,	0xd5ffba4d,
-0x69c1885e,	0x5ab21654,	0x6a322924,	0x0013f5f9,
-0xf449ca24,	0x3e529a61,	0xcd720cc1,	0x3d136d69,
-0x80f94ece,	0xb97e5734,	0x3bd3f9cf,	0xc90d918d,
-0x3bd375de,	0x4b4005ae,	0x4377ba61,	0x3e203bd3,
-0x2859dd53,	0x1ec891b8,	0x304d644c,	0x72e76e2f,
-0x1aa490f4,	0x544f1e44,	0x2dfaf13c,	0x0a1a57f5,
-0x4614ae5b,	0x86d994a7,	0xcd5e21dc,	0x25431c18,
-0x1bd8a027,	0x192f7a3a,	0xc9452665,	0x424bbbc9,
-0x3c1fdf3d,	0x1eb011ce,	0x56dd422d,	0x10a583df,
-0xdc833ac5,	0x1740d1f4,	0xec22ccef,	0x342de440,
-0x32cd5698,	0x898348a3,	0x04729722,	0xb5c04ca5,
-0x5d10afab,	0x7520e420,	0x944f23c0,	0x0eaebf30,
-0xb049858f,	0xee8b2a31,	0x28f3f6c6,	0x183139d6,
-0x69c77811,	0xf000979b,	0x380af897,	0x8db863bc,
-0x401a59e9,	0x8bf677c2,	0xe1e407c1,	0x981f5307,
-0x96170b41,	0xad4e659f,	0x95aaf0da,	0xde07972e,
-0x54adc504,	0x7ab335a6,	0x694e02f0,	0xfdbf697e,
-0x2869bfe6,	0x898820bb,	0x871b4dd7,	0x844d0aea,
-0x7c82715a,	0xffd382c3,	0x6ef81f04,	0x4b99ca24,
-0xc1a03d0c,	0x255630a1,	0x31d72f33,	0xdc881d50,
-0xc4bb2bf5,	0x19c77fb0,	0x82916267,	0xe4f829a5,
-0xa5fb06ab,	0x1c00eceb,	0xb5681578,	0xb0102538,
-0x53e27946,	0x1a713c01,	0xd045e629,	0xfc6f72e0,
-0x8c75631a,	0xedee54a5,	0x5ae6db96,	0x60e114cd,
-0x8d386f10,	0xd0ac0559,	0x8c9e9ad2,	0x82efd55c,
-0x248e141c,	0xf03153b9,	0x172dcc7f,	0xd9e911e3,
-0x3e2aab72,	0x19bf1260,	0x1a018b44,	0x69785695,
-0x9dbd5d01,	0x01e4c0c6,	0xf65b35ef,	0x05c9af36,
-0xb8845f18,	0xc91a2ffe,	0xa353508b,	0x297b5e57,
-0x9ede5250,	0xa79f06bd,	0x8691f1ff,	0x833265f0,
-0xcad9c2e2,	0xa0bfdf97,	0x6df7994f,	0xc6ffec58,
-0xfd3b9080,	0xad1eeab4,	0x95ce3e78,	0xcaa92283,
-0xd9c1f34b,	0xb92b46e7,	0x0ced810a,	0x5cb5524a,
-0xe2101184,	0x5d964d71,	0xe1ffa4a9,	0x9ef79635,
-0x461b7b3c,	0xd16f144c,	0xb29b29f4,	0xfa5575f3,
-0x30ed99cc,	0x2c732f21,	0xe74d99f9,	0xe4d96ae7,
-0xa363a343,	0x50dd809c,	0x87d08e2d,	0x84be8539,
-0xfe7a8d42,	0x088c8aba,	0x38f0b2a8,	0x53f5ba6c,
-0x0bb96259,	0xbb54db8b,	0xdb6519b4,	0xc4b96c3e,
-0x3b9c6f4e,	0x457ec3f9,	0x2d0aa736,	0x5a9aa11a,
-0xfba5ad21,	0xf3e73e9b,	0x28fac9c7,	0x3043fa2e,
-0x4bdeb494,	0x9fceb866,	0x259313fd,	0xad10db5f,
-0x41c90297,	0x3adec81e,	0x45a72730,	0x82bbdf24,
-0x6257ecd9,	0x0f0c000e,	0x92c485eb,	0xef7b1b57,
-0x7f6c87c5,	0x6c686ade,	0xaa0d35ff,	0x5fb026f1,
-0xcbae0fd2,	0x0d955aba,	0xb5e40d4d,	0x7b17e99d,
-0x188894de,	0xe1256a11,	0xddc7ad71,	0x31d5ad6d,
-0x2d3fdebe,	0xcc384b5a,	0x88251dcd,	0xb47edd23,
-0x7171e827,	0x8c94eb92,	0xc9cece99,	0xf724ed1d,
-0xefc40f22,	0x64640818,	0xe984b477,	0xb36d2246,
-0xbd8a8fa3,	0x0d127830,	0xcb947316,	0xccc46186,
-0xdc00a748,	0x4885c7c5,	0x83f84ca7,	0xe47289d0,
-0x7bb66db7,	0xfb186ff1,	0x36eac763,	0xff60f259,
-0x104a8bb2,	0x619cc6ef,	0xf28345a7,	0xde8febdf,
-0xb0cc0782,	0x22d3398f,	0x0c755146,	0x34f2f67d,
-0xcd955d13,	0x6f5182bf,	0x67aecfda,	0x1397387f,
-0x28648298,	0xd2aef962,	0x1b19874c,	0xe1af5081,
-0x6222d2f3,	0xebfeacf4,	0x3fa5e0ca,	0xb3ecc863,
-0x85f8aa99,	0x40d245c6,	0x9e9e9d48,	0xc5d6a612,
-0x243034b5,	0x2449b452,	0xfeb39478,	0xce95c40f,
-0x1a7778c1,	0xb7f5779d,	0x63caba0c,	0x888e9a4a,
-0xa8c03d83,	0xf776f730,	0x63fe4983,	0x7f7fa72f,
-0xbeb8eb4f,	0x5b879f48,	0x390f90d6,	0xea4c5e86,
-0x9f3f26ea,	0x90138766,	0x11a445ba,	0x53b82cb1,
-0xc06c1eb0,	0x010b176e,	0x42fac1c3,	0x9d2b3b6c,
-0xc993513a,	0x85c05db1,	0xf7f46de9,	0xfc028b83,
-0x6a8d5e4d,	0xc79e97ee,	0x1588b0a4,	0xc48d1947,
-0xc9fee867,	0xed9080e8,	0x3bbaa41a,	0x4ee77d1b,
-0x57cd0414,	0x3be088ea,	0xd966d067,	0xa86218b6,
-0x67360391,	0xdafaca11,	0x70778929,	0x0d357ab2,
-0x9ecfe3e9,	0x4123c823,	0x89dde9b2,	0x23f94f3e,
-0x11d921c3,	0x511927a0,	0x5631c8d2,	0x3f6093a6,
-0xe01a4ff6,	0xa2a308e2,	0x501a6cc0,	0x15f11b02,
-0x0121e2ef,	0xc5c51722,	0xf5a61a53,	0xf1fcab3a,
-0x65fcb566,	0x9b13ff9a,	0xabf94b6f,	0xd20f0ae0,
-0x0244925d,	0x8b496c04,	0xee554ad3,	0xa73c9bb6,
-0xbfa187f8,	0xf57c6180,	0xa58b4389,	0x22a509be,
-0x6e979df9,	0x0cf0b5a6,	0xa5658006,	0x921a50fa,
-0x1bb771a6,	0x0b3ca3a6,	0x75cc7f88,	0xef52392f,
-0x8caab3c9,	0x08718abb,	0xf3a26670,	0x6bad815c,
-0xb7e8de89,	0xed74fdaa,	0xa763b3c4,	0x24fdfc21,
-0x5987597b,	0x968604db,	0x991165d6,	0x3efb1e1f,
-0x1b50a1d1,	0x41282b70,	0x1037c78b,	0xb627a637,
-0xa1980b2e,	0xcdf286e6,	0xfe0d0e43,	0x42510ea9,
-0xd1608d03,	0x33f65fb5,	0xc709bfc1,	0x87fa5d03,
-0xcfd8cf00,	0xc0b57852,	0xc061862f,	0xa959ade2,
-0x8e364680,	0x64f5272c,	0xfd4ca784,	0x00ad807f,
-0x3080b57f,	0x5bc48efd,	0xf712c48c,	0x6f114cef,
-0x40d4baec,	0xee9b37fd,	0x3228d2ad,	0x3438571c,
-0x6c1b630b,	0xf6612367,	0x41e672c9,	0xb47ef772,
-0x785ec58e,	0xfebb29bf,	0x73b2d64c,	0xec62b92b,
-0x4018be37,	0x9e010b63,	0xf98d52c3,	0x914db535,
-0xc13dab9f,	0xa99a11d2,	0xa3619315,	0x092477bd,
-0xb9d0df00,	0x6bc8772a,	0x159504ad,	0x73338536,
-0xdf420687,	0xe50c003e,	0xf2a8adba,	0xf64c3af4,
-0x78fa5b14,	0x709d4ceb,	0x9cfb08d6,	0x692f4e3b,
-0x09b2b909,	0xd8b958ec,	0x0cd7d12d,	0x339993c5,
-0xbe960ae6,	0x04c67ecc,	0xb688d974,	0xf79a00bf,
-0x8e4c8b64,	0xf0650562,	0xa31916e1,	0x2c03fd22,
-0x4d5063d0,	0x8824d74c,	0xadccf855,	0x520a2667,
-0x80490a5d,	0x5d507ae3,	0x4fb9f0f7,	0xd977889e,
-0x604f8316,	0xe003b824,	0x81d9cc7d,	0x180c1aca,
-0x583e4541,	0xf3af9101,	0x0597f24c,	0xf1d3f27d,
-0x3d8105d7,	0x3f754795,	0xd2ae2bb7,	0xf1b029c4,
-0xaa0906cd,	0x913724aa,	0x80c9d08b,	0x9a40d932,
-0x2850c9f8,	0x0740881e,	0x425a6c1f,	0xa8eecf2b,
-0x559c2516,	0x79b7838b,	0x6d76fc2a,	0xddd9d44d,
-0xb9d8b3f9,	0xca72d6ac,	0x9eccd98b,	0x9cd453f5,
-0xd7ce8448,	0x56cc9c05,	0x39e92a48,	0x64b026e0,
-0xe38795ba,	0xc4794b34,	0x69666aec,	0xab9204d3,
-0xa0176871,	0xc7a7ed75,	0xc8cc2c8f,	0x2816c94c,
-0x21335231,	0x4dcc77c0,	0x912793ac,	0xf0593e32,
-0x903bb227,	0xade63501,	0x78a47304,	0x2152867d,
-0x9fa75a0a,	0x1c3501e9,	0x74af0cdf,	0xf20889be,
-0x0af8a22a,	0xa482d2c1,	0x357993b0,	0x2f8ce8a0,
-0x5ca39d4b,	0x5ba792c5,	0x80d47282,	0x1fb6093d,
-0x3698bfef,	0x4dd1e36e,	0x89b73456,	0xb225b141,
-0x854f0dca,	0xecad993f,	0x01039099,	0xb8016aef,
-0x58867f1e,	0x659c0a6d,	0xe33ab20a,	0x945898d7,
-0x9820cead,	0x55675aea,	0xf64a3c37,	0x7847a357,
-0x6ec74002,	0xc447e854,	0x819de2bd,	0xc72f11c9,
-0x0f392cca,	0x321acf32,	0x0a189496,	0xb09fa869,
-0x6c7646e5,	0xc01439e7,	0xc2ac4caf,	0x66cecad9,
-0x98307c00,	0x3260c110,	0xf1af87ed,	0x99b06a3f,
-0xbe28465c,	0x996d9b6e,	0xc2192fe1,	0x0815ad08,
-0x1e5ef57f,	0xefdcb325,	0xd753786a,	0x095a4526,
-0xfb4f1889,	0xdf50ec92,	0x8157bd6e,	0xeb8f10e1,
-0x2c8eb2f5,	0x2b930245,	0x9e1fdcf4,	0xe3302927,
-0xe9854348,	0xf8c8509d,	0x0cbbd8cd,	0x12bbe742,
-0x6b28e2bd,	0x3ec1c26f,	0x1599b9f6,	0xe1cfb308,
-0x36d8e348,	0x4077c732,	0x52bbbf12,	0x74a7917a,
-0x3fd750f2,	0xcc63d23b,	0x71f5ce09,	0x95ff72a9,
-0x8ffc9a1b,	0x5f3d5968,	0xa272f01a,	0xcedb2501,
-0xd393616f,	0x0037a0bc,	0x9e104e9d,	0xb8a79ae0,
-0xf7801b39,	0xd2e7d768,	0x0655b59d,	0xcfa2d671,
-/*  2174-m041066136.inc  */
-0x00000001,	0x00000036,	0x05012007,	0x00010661,
-0x007ab882,	0x00000001,	0x00000004,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0xc6abcb1f,	0xb00adb19,	0x06cf0bfc,	0x8a7087be,
-0x82f00bf8,	0x338c857a,	0xf8b9bc24,	0xfa192601,
-0x84d5bb77,	0x8fdc9321,	0xb2becf58,	0x3e374ae8,
-0xf75cd1a9,	0x16a7a2cf,	0xa3f26ee4,	0x214512e9,
-0x29d231c0,	0x11e8cd27,	0xbf9e07b1,	0x7f803296,
-0xb9f9fb12,	0x55a14a7a,	0x570a6594,	0xc7e949cd,
-0xb5dd0739,	0xa46a74a8,	0x03d69674,	0xbd75ce58,
-0xe4a1e74a,	0x38a5d0d9,	0x68c56828,	0x2a88b833,
-0xd99e16e4,	0x085b2409,	0xd952511d,	0x8381d712,
-0x1b99c686,	0x965a7243,	0x36305bf6,	0xbd41cea9,
-0x59d03e08,	0xfb2cca65,	0x9695cabb,	0x6be9102d,
-0x788edef1,	0xd746f3e3,	0xa14f477f,	0x6eb56408,
-0xae141130,	0xa7635dc2,	0xecf6f721,	0xeb30f9b5,
-0x85212db0,	0x98121e34,	0x295b8d3e,	0x9a862d71,
-0x379171b2,	0x986a0771,	0x04b45d77,	0xe99390eb,
-0x612a2ed1,	0xf7319d57,	0xb730f677,	0x2ed63dfa,
-0x67e9df58,	0xb20dc282,	0x4c2b0edb,	0x8b1a7a6a,
-0xa87779bb,	0xe220d133,	0x3bfbf9d0,	0xe76b1cb6,
-0x8f543b5f,	0x689210db,	0x0fbe41c3,	0x9fd2a821,
-0xbfde6e19,	0x9a40209e,	0x008b339b,	0x690b779f,
-0xf46f54d0,	0x63389138,	0x919546db,	0x843b651d,
-0x8942a49e,	0x4a68ac5c,	0xd4a7add2,	0xf6e60e94,
-0x6dfeebad,	0x4c760a59,	0xeb2e04f9,	0xf5c2781c,
-0x6b9a919c,	0x8e2eaa8c,	0x58770ca1,	0x76bbd4e4,
-0x46ce1fe5,	0x16bf1e38,	0xe6e1b525,	0x66b177c3,
-0xebdad6bd,	0xc5bfcab0,	0x3bd3cbd6,	0x7d879201,
-0x9f03cdbb,	0xebaeeb34,	0x93296cce,	0x55ad46f2,
-0x1573d61a,	0xdcd2e2fc,	0x1320b9cb,	0x18ea7fa9,
-0xa53b8710,	0xe4bf6eef,	0x91610b85,	0x017d8742,
-0x2fe45976,	0xf0ac6cb7,	0xdbe8d962,	0x5d4b57a4,
-0x4aa89970,	0xc814a41a,	0x087928ed,	0x4a96e34c,
-0xf79ab8b9,	0x45abd2e2,	0x918f98fa,	0x19aa3631,
-0x6bb3ad98,	0xd60a4234,	0x326429ac,	0xc88641ce,
-0x00ba6f1d,	0xf477194e,	0x7d780085,	0xb74dd9ec,
-0x0ca754e4,	0x6c179f61,	0xa97d7971,	0x6c361c9a,
-0x451896f5,	0x258ceb76,	0xdb143afb,	0x1ec79b33,
-0xfdacf563,	0x29d0bb61,	0x9b25bdeb,	0x122bdf21,
-0x6bd65e78,	0xdd89483b,	0x22540b64,	0xf24db092,
-0xe2355d36,	0x4738fbda,	0x5182b9f0,	0x9370e7e4,
-0x25b53d1c,	0xd190ff54,	0xdff9a4f3,	0xddf54748,
-0xfdd6b8af,	0x590ca4d0,	0x5c365831,	0x78bcafdc,
-0x28d8bdb3,	0x09b6bc4a,	0xa963889f,	0x7a1733bf,
-0xf9e6f050,	0x89ed8b13,	0xec82ad5a,	0x7929831d,
-0x15f290cf,	0x5acb5256,	0xfb253d78,	0xda18987b,
-0xbc4bea51,	0xa7876e2a,	0x9797ed9a,	0x8446a558,
-0xf92499af,	0x78593d67,	0x5595886c,	0xf2d283dc,
-0xaf63d5b4,	0x952f18c3,	0xa7ceb0b0,	0x6c32f956,
-0x1c5aa1ee,	0x9d004776,	0xae10be37,	0x429ad061,
-0x08f50134,	0xdef7fc54,	0x43f2f1d3,	0x50b9110f,
-0x01631928,	0x020d9ea0,	0xcc7eef44,	0xced62583,
-0x1bd9b506,	0xe9830223,	0xf81ca148,	0x09f0f34c,
-0xf2569a85,	0x1eacbba6,	0xdd4b7eba,	0x5fc11003,
-0x048c027d,	0xf30a32ad,	0x606eb024,	0x463297d7,
-0x5c173e31,	0xf82c929f,	0x89c21a4b,	0xd537bbf4,
-0x9d01b46b,	0x745e97d5,	0xb7a676a9,	0xc1a84b37,
-0xb09acd84,	0xab6306e8,	0xd4c7eaa5,	0xbecc5400,
-0x571089fe,	0xc8341773,	0x114e0220,	0x868891ed,
-0xccc42472,	0x411d6345,	0x12523237,	0xdb9658f7,
-0x96f92f7e,	0xffdf781a,	0xdc78f459,	0xc87f53fd,
-0xd1a0c0bb,	0xec5dcd39,	0x496884d6,	0x01336220,
-0xfb49b634,	0xbbc7440e,	0x1c8815c8,	0xb8f89052,
-0x958b5858,	0x9d10772e,	0x4a693846,	0x0f0a9686,
-0x1290982e,	0x0e13e625,	0x8b093a5b,	0xf54613a0,
-0x3b46a140,	0xdb99edba,	0x79381c8b,	0x49402ece,
-0x7083aeca,	0x885db471,	0xf28d986e,	0x7a46c1ce,
-0x10d2c8a3,	0x571e1a63,	0x13a7c0eb,	0x02704358,
-0xe66f813c,	0xf541c81f,	0x906095b0,	0xe7edc0a6,
-0x4976578d,	0xe6d47f48,	0x817565f0,	0xe0321fbd,
-0x14abe8cf,	0xc310e4dc,	0xafd6e3c2,	0x5f8c242e,
-0xd2cd4918,	0xf17000c6,	0xc52ae235,	0xdd73e4bf,
-0x7e2a72f1,	0x515e1ee7,	0xff27b9c2,	0xc280aab7,
-0x4837fabe,	0x913a1c96,	0x17e0c110,	0x68ab31e1,
-0x0a1b75d8,	0xd6009c30,	0xc0af295d,	0x92eb932d,
-0xba288766,	0xe7e1a637,	0x3cc91199,	0x714bca64,
-0x3871e0b9,	0x42d5e440,	0x4719172c,	0xe7652c40,
-0xa5ec682a,	0xd060486c,	0x10fae5a5,	0x0f49a4cc,
-0xedc92f80,	0xc0cf7616,	0x88c3b1d9,	0x6bf5421e,
-0x6e3aabc6,	0xb88271fa,	0xdeb61fbc,	0x755cbba4,
-0x53ea8b19,	0x8f64027f,	0x5cd064ac,	0x151548ca,
-0x450e8c1e,	0x14246e1c,	0x35a66d40,	0x39875b36,
-0x4cdac82c,	0x4feb4480,	0xb693dbe7,	0x471176ff,
-0xd7040ae4,	0x4e6b302c,	0xe5b7a33c,	0x8bbea098,
-0xb3ed3f64,	0xdcddb271,	0x267ca8f1,	0x28cac2c7,
-0x09626eea,	0xbf02498e,	0x7f6b5fc4,	0x502e091a,
-0xcddcb743,	0x352047c9,	0x90c5dbd0,	0xf453c523,
-0x5587854d,	0xe8674056,	0x30e4d0ef,	0x13b395a9,
-0x86f79009,	0x43638968,	0x6207f7e5,	0xce2c9b65,
-0x9c12ea07,	0xb4595117,	0x76341c1f,	0xcef0faaa,
-0x3642d3eb,	0xa7309093,	0xc6d539c3,	0x938121f8,
-0xfc6ba288,	0xcaee582a,	0xbef0cc72,	0xc8ba3fa9,
-0xc08a7c00,	0x7fffa363,	0x3f788297,	0x1cc199d2,
-0x9a2ad3a4,	0x058a7cb6,	0x23507932,	0x44d5f8c5,
-0x9c9b53eb,	0x7ed2d9ef,	0xab2d770e,	0x1ba567c1,
-0x2d9e3b1e,	0xeaa289f8,	0xcf6ea0d7,	0x49ce1ac3,
-0x26fb7f6a,	0x3065f08e,	0x413b50c5,	0xf58a6b43,
-0xc5df6d9b,	0x5d0c243e,	0x203d24d5,	0x1a4965b5,
-0xada68b69,	0x1c8951db,	0xf7ec6194,	0x251dd237,
-0x1333c6ab,	0x9a9b26ff,	0x5b411385,	0xc2a86b67,
-0x975c51fb,	0x36231971,	0x9890ce01,	0x45b7034c,
-0xb72a448a,	0x782a1785,	0xb4dccdc3,	0x59ef3395,
-0x7479669d,	0x2ddb557e,	0xddd4c482,	0x3c4196d1,
-0x21d7f2c1,	0x8bab7533,	0xe371cdd1,	0x4cbc4d82,
-0x4f837ff4,	0x281e963f,	0x7c0cf6b5,	0x2ede52f5,
-0x7bf6ff37,	0x866aba12,	0x42a88b40,	0x21b9b5e8,
-0x02e3c941,	0x39292d47,	0x128d245f,	0xf3c7f48b,
-0xa07661c0,	0x7f95f989,	0x398d799a,	0x60f6af7a,
-0xc5241071,	0x0d4011db,	0x557143f3,	0x465338cc,
-0xf38528c9,	0xd42e73e6,	0xb8511584,	0x07aab66f,
-0x83c0d8db,	0xe045a176,	0xe5a87665,	0x189bb5a4,
-0x8d40f5ae,	0x283a45a4,	0xc816f56c,	0xc05b2562,
-0xdb4f5264,	0x7065894c,	0x73334852,	0xa5f33316,
-0x83fe2bf8,	0xc8b7c4f5,	0xbc650d6a,	0x0f2f948e,
-0x45ae5409,	0x1f36e8b1,	0x39aa1aa7,	0xa9c093ae,
-0x061972b1,	0xc52e4f5a,	0x4720bdea,	0x45ffed75,
-0x51117574,	0xde18f60d,	0xaef27830,	0xa5011c04,
-0x49b69861,	0x6d035a2c,	0x5853e858,	0xfa7c457a,
-0x031631ff,	0xbb7820a3,	0x497110a7,	0xcd7fceb8,
-0x0d05c95f,	0x1d51bfa0,	0x4ee87fbb,	0x22d0d182,
-0x1af9deb2,	0x49f95c63,	0x3492f7ba,	0x09d07509,
-0x2aea37b6,	0x3890dbec,	0x2b75adf5,	0x0f0dd2dc,
-0x885bfee0,	0x8e262e15,	0x54117704,	0x8054211c,
-0xb1a8f6cb,	0xbf2afbfc,	0x559cdee5,	0x3152b9b0,
-0x187e8ad5,	0xfcaf41d7,	0x24f02eaf,	0x798d6537,
-0x0313670c,	0x76c9f206,	0x6815fcf5,	0x26a2577c,
-0xb3c41d3d,	0x361c8809,	0x05b11eaa,	0x486e1509,
-0x0c6e2c73,	0x2bb9fbdd,	0x667eef0e,	0x31999f89,
-0x823ec3b6,	0xa0abfb52,	0x86d62ad2,	0xcbe3fb6b,
-0xdbc3b8db,	0x8882ed5b,	0x3d18011d,	0xb786ce7e,
-0xb163e9ba,	0xd51c74e7,	0xcb1d93f5,	0xf06c8d5c,
-0x0f4575f7,	0xb85c9c61,	0xeebd89f8,	0xae0b1ddd,
-0xc5d86461,	0x08b9778a,	0x099bc349,	0xc3a97bcb,
-0x270610a1,	0xbf41bafc,	0x2d4178dc,	0x6ae7c0c5,
-0x58df15d9,	0x7ad2f187,	0x4ede37de,	0xa8724d66,
-0xee5b7777,	0x8f282c44,	0x782367e9,	0x2a1c812d,
-0xcac724e4,	0xc7db0da8,	0xfacb2832,	0x0d5febba,
-0x179f4a3b,	0xbbc2b693,	0x1798f694,	0x93b9d966,
-0x0e034a01,	0xeef9f502,	0x6fdc6397,	0x206affba,
-0xc028af2b,	0x68f95f2d,	0x7482ad04,	0x2d904ac0,
-0xe53ec3a8,	0x146de389,	0x084e05b4,	0xa72ad313,
-0xa07b8a4f,	0xbe6c0e42,	0x8005755b,	0x85d99ef3,
-0x213713b1,	0xeec1bc60,	0xb0e739b1,	0x400cfc9a,
-0x44fd1bcf,	0xd500c58c,	0xdfa59e14,	0xb6356e38,
-0xcfc9c716,	0x86e8809a,	0x1a44b054,	0xa69ea7ba,
-0x616655bf,	0x3ea8093d,	0x3de4f119,	0x45039af6,
-0x1255da1c,	0xf337862a,	0x26f71c0a,	0x718d60db,
-0xa3cc6ddc,	0xff0773d2,	0xaa52c7bb,	0x74cb97ac,
-0xef37dfa1,	0xf873b4fa,	0xcf243c8d,	0xafaf2a83,
-0x0ba04a12,	0xd88c8680,	0x2016032c,	0x71a7b92f,
-0x43b4916e,	0x3c5be59f,	0xb98737e2,	0x9448d923,
-0x7c020e4c,	0x995ca16b,	0x7f81170f,	0x6cacd779,
-0x05fe0f02,	0xf61b46ac,	0xa53ad4f6,	0x49847599,
-0x5b5bfdb3,	0x349d37be,	0xdefd2302,	0x6e0affb2,
-0x860cacb5,	0xff0a9fc4,	0x2d1fb7f8,	0xf3222464,
-0x99e5c92e,	0xaa58b392,	0x5262d8ea,	0x4bd7a622,
-0x0751f66e,	0x6ffea9ba,	0x94428ee7,	0x5e0e36f9,
-0x4e62ee71,	0xc3a88917,	0x25cfd106,	0x4b7bcfcb,
-0x49e049ea,	0x11a9ca42,	0x3d8984f6,	0x0f2d55a4,
-0x0659d306,	0xfec80d3c,	0x07778fc5,	0xc14d274b,
-0x702e8f6b,	0x56890490,	0xf8e9ef29,	0x45c0c7c7,
-0x800437b2,	0xed53e7b5,	0xa82b48d8,	0xe2046cfc,
-0xd4474b71,	0x4577b76d,	0xb1a71474,	0x8b6600c0,
-0x59e2af91,	0x16bd23f4,	0x8d76cfe6,	0x621320c8,
-0xb67c6d2f,	0x9e99b02b,	0x394ba142,	0x53b3ff23,
-0x69522fa6,	0x41b90cb2,	0x565bc299,	0x1106e9db,
-0x32f64255,	0x5a1e17d2,	0x77bc7581,	0x6345764e,
-0x31fb54cc,	0x95f4728d,	0x2f579221,	0xc8cc9359,
-0x3dc41abd,	0xf1b5deae,	0x4ff43adc,	0xde1f7cf6,
-0x0a365307,	0x5431af2b,	0x088dddad,	0x88de3b1e,
-0xa66ad5ba,	0x4df61b5f,	0xc3d31e46,	0xaa21d66e,
-0x053c0faa,	0x8992a6ee,	0xdcb1836b,	0xc85d4974,
-0xcc6457c3,	0xd2f2293e,	0xfdd901b2,	0x184f750e,
-0x0f2e54a3,	0xd0d9becc,	0x4fcde77d,	0x2935c5c2,
-0xc714b17e,	0x76567883,	0x80127e1b,	0xb72a44cf,
-0xef89daa9,	0x79a70e45,	0x2ba15e3b,	0x8a023a9f,
-0x346578c1,	0x628ee70d,	0xd12a0dee,	0x40630577,
-0x362fc11f,	0xbcd17e2d,	0x4de44598,	0xecd24c04,
-0x2e240014,	0x9961c95d,	0x8a93bbc8,	0xf1367096,
-0xe88a72b3,	0x39cf42b5,	0xd8ff0f1a,	0xeb0f8f17,
-0xe8b731e0,	0xf0c4e53d,	0x8076d545,	0x1a51f4d8,
-0x10a577da,	0x24decfc0,	0xde230104,	0x5763c2e5,
-0x681d8364,	0xdfc0b231,	0x3dece0d3,	0x306d2934,
-0x69226af3,	0x5a7036d2,	0x78059c83,	0xf7bde2dd,
-0xf95c7d46,	0x67d3a7e5,	0x7a4373d6,	0x4b3a73cb,
-0xf2fecaab,	0xd0f8271f,	0x6b2b8fd3,	0xe7d12276,
-0x268e1c3c,	0xd153177c,	0x86f0bd57,	0x6e070d11,
-0xc4848668,	0xdc5f5330,	0xe100de6e,	0x283da5f1,
-0xb21dff23,	0x05f349a1,	0xea258eca,	0xb7f45c97,
-0x666928b1,	0x5198a3ef,	0x2b69a6e7,	0x2884cab4,
-0xbf445fc0,	0x63570280,	0x6bc309e2,	0x3caab884,
-0x07e59d04,	0x95d880d4,	0x90847bb2,	0x0272af68,
-0x4f371911,	0x6ee590bd,	0x18bcce77,	0xf2446c3f,
-0xfb20be2d,	0x6d8f16c9,	0x307d076d,	0x2403f194,
-0xe473560f,	0x73813ba1,	0x4c29079f,	0xff17ef1c,
-0x5fd1272c,	0xc4986190,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2497-m041067660C.inc  */
-0x00000001,	0x0000060c,	0x01192008,	0x00010676,
-0xfbac0f69,	0x00000001,	0x00000004,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x0000060c,
-0x00000035,	0x2e000000,	0x20080119,	0x00000301,
-0x00000001,	0x00010676,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc8f5cd92,	0x30bd1beb,	0x77c4fb8b,	0xe899c960,
-0xc729b4cd,	0x1d9b8923,	0xfcdfc554,	0x580d39f9,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x4872f26c,	0x88971c10,	0x66db1385,
-0x1e532ab2,	0x7ccd2d72,	0x38dd766c,	0x131f4505,
-0x7d5e1e0a,	0x1932938b,	0x79c1db9a,	0x9fe5b8bd,
-0x07037c1a,	0x698cd351,	0xbadb5300,	0x063f17d9,
-0x8558ada3,	0x224c2288,	0x26fa35b3,	0xe64efb19,
-0x0e1b52db,	0x696d5461,	0x3a0f765c,	0x4b853dfe,
-0x05147b28,	0xbe146518,	0xb61e1de2,	0xc342998e,
-0x083d5f41,	0x737fdbb5,	0xdd812ce1,	0xa7b9549c,
-0x164b5fbf,	0xaffd6139,	0x44154437,	0x23d44899,
-0xbe41eae1,	0xeecc8d45,	0x31fc971a,	0x44475238,
-0x5d4ab69c,	0x67f342a0,	0x118cb268,	0x513fb847,
-0x0a86fce3,	0x23f22535,	0x5fa15360,	0x929aa833,
-0x3cbd4138,	0xc1dead1e,	0x3efa210b,	0x9781a61d,
-0x00b53f73,	0x07df4d30,	0xffe97322,	0xf7b12998,
-0xba4d7316,	0x4b746898,	0x45ece500,	0x78cf31d5,
-0x0208c1c6,	0xc3999e15,	0xce2f90f4,	0x7e130a0b,
-0x3c74ce12,	0x37612fd2,	0x7ce3ae15,	0x99a26321,
-0x52ac391f,	0xcb32f7e1,	0x0e50140d,	0x3a6bfc41,
-0x497f7f9f,	0x334b7e17,	0xbcf4e41d,	0x3311b0db,
-0x0dc65367,	0x44847807,	0x991c439a,	0xd2965df2,
-0xfd72e4fd,	0x44b01f14,	0x5a0cf5c5,	0x70029e37,
-0x92af3f34,	0x47949bdf,	0x771a3c07,	0x0874f372,
-0x7a54670b,	0x7430b00b,	0x356234f3,	0x74edf1e6,
-0xaaf60a4c,	0x2bb5eee4,	0xc2c1d43f,	0xc4ee788b,
-0x4198fd90,	0x0aba19a3,	0xc251f028,	0xe42404df,
-0xccbd25f2,	0xdb13eb69,	0x888f89a5,	0x5a6c8cd3,
-0x1e3b469b,	0xe07e48c6,	0x87f25228,	0x64324c03,
-0xe0426f9f,	0x148f828b,	0x4a3c82ab,	0x7d46539d,
-0x0b5079ea,	0x2c675b3e,	0x83134717,	0xbe775c77,
-0x74841ec3,	0x4470addb,	0xfabfa06d,	0x548757fb,
-0x184ea712,	0x502765b5,	0xd7067ce2,	0x15afee11,
-0x8a95590d,	0x3a1734cd,	0x212c7f7d,	0xe5aa3e5b,
-0x9c7e75c3,	0x07486966,	0x5827bbea,	0x391e46fe,
-0xc6acbc9e,	0x9761b6a9,	0x37bef8c4,	0x733eb81f,
-0x7ac9a87a,	0xceacd157,	0xd931072a,	0x9383c10d,
-0x5eae74ef,	0x5f82f6a0,	0xcf89077d,	0xbc641bd8,
-0x1b7d1213,	0x980a4ed3,	0x410fa7e8,	0xaaa1a011,
-0xa5e94ef2,	0x74937d5f,	0x3c109f67,	0x8e58bdcc,
-0x2b43ad95,	0xaa516349,	0x6fa9cca2,	0x48a18062,
-0x663c7fd7,	0xf3822d87,	0xbaaf1f97,	0x8da372b2,
-0xa416831b,	0x6a645364,	0x9c7ac6fb,	0x3f5a9cab,
-0x8cf6f4b4,	0x514fd1dc,	0x7e9d0918,	0x2075f774,
-0xfda8677b,	0x3b5c16ac,	0xe887694b,	0x7d622e9f,
-0x5427472d,	0x540e5c99,	0x2196e138,	0x5d5e9c58,
-0x84a5fc17,	0xb17d6d41,	0x63273bdf,	0xfbb912b5,
-0xaf16b7c1,	0xeb1914d7,	0x5d654b8f,	0xf4a594f6,
-0x554a6311,	0xb391f519,	0xa5ad4acf,	0x9c052bb7,
-0xea68faa7,	0x37399a25,	0x8f6f6d36,	0x47c20f2b,
-0xf241ab98,	0x66da024d,	0xee90a06a,	0x33718b17,
-0xaa89087e,	0x6dcca7f5,	0x43a59f0e,	0xcb2e3ab8,
-0xb19126bb,	0xc56bccb3,	0x04f6fd9a,	0x0f63850e,
-0xa2b6c85e,	0x309f9817,	0x7252b154,	0xcba20ff3,
-0x143156b8,	0xcfcdc8ae,	0x13c2a75b,	0xea4bf1b8,
-0x6e474959,	0xa9c376f5,	0x40d252b8,	0xb6209e70,
-0x993efa22,	0x3d7e8007,	0x1857ba0d,	0x72f25310,
-0x233a8f68,	0xeb4ca923,	0xb17917d1,	0x9ca3f4f6,
-0xdecf1498,	0x99f5ddae,	0x8b6ba2b7,	0x54f41fb0,
-0x1ec9ffa2,	0x74ad3bd6,	0x84fee3e6,	0x5294820d,
-0x147e8b14,	0xd2dc15f4,	0x152fc744,	0x306bc043,
-0xfdbb74d8,	0xf4ea207c,	0x53edfac5,	0x1b609795,
-0xe990ee73,	0x749dbed4,	0xd1cefc95,	0x5c7b37f6,
-0xc6b39045,	0x7281e3f7,	0xed0e6aa4,	0x590a246a,
-0xe6e6a81d,	0x604491ac,	0x6cd14e8a,	0x7a19f5da,
-0xf7c7326a,	0x0ef8029e,	0x0e741b48,	0xc962a062,
-0x6f4ad86e,	0xa2729726,	0x93bcaf1f,	0x1bb56970,
-0x12495cdc,	0x180512e7,	0xa1d68081,	0xb924c24b,
-0x5a1461ca,	0x21438ca9,	0x5449ae48,	0x0f564503,
-0xcec8df3c,	0x789f9b80,	0x5a708df1,	0x28735bfc,
-0xcf11d2fc,	0xa5d01625,	0x80b0b533,	0xa09f026d,
-0x1d22fdf2,	0x01928228,	0x8b6779ed,	0x04f7cc95,
-0x581fe0b2,	0xcc9a66a4,	0x55b3f130,	0x0f22abed,
-0x05b7e95d,	0xd8cc9c30,	0x0850ca8a,	0x34d729dd,
-0x973300a7,	0x80ffedb1,	0xbf5b28e7,	0x135c8cc6,
-0x4337b017,	0x31d8dd09,	0x35ed75a1,	0xb8f990b9,
-0x4384dc18,	0x29d72b56,	0x021aa2b2,	0xa3248b3f,
-0x5f4e7301,	0x29991927,	0x1cc50c18,	0x79fcc545,
-0x56e2e683,	0xe5127777,	0x4b727957,	0x94d1bc22,
-0xacd0da9e,	0xd24771fd,	0x5997ff0a,	0xb9947cb8,
-0x8cb9bb5c,	0x16a4c5e0,	0x00d6995f,	0x1e05edff,
-0x3a7f1af3,	0x445fd70d,	0x24a602c7,	0x6b50001a,
-0x6c99f5e5,	0xad2c00c5,	0xbd16a90d,	0x3b7b6032,
-0xa8dd4f8b,	0x437145f1,	0x5a593d5f,	0x749ee409,
-0x9c6d8223,	0x40c1dad0,	0x578e7e1f,	0x89072e7b,
-0x0ccf47c1,	0x427606d8,	0x4a7bb48c,	0xf85cc4e9,
-0xca5ca3b6,	0x9b989f23,	0x6496403f,	0xdf8ef891,
-0xf4458e90,	0x28eed125,	0xef91afe9,	0x97a8d65b,
-0xe022b3dd,	0xc93c2adf,	0x520cbe7c,	0x58995018,
-0x719a724a,	0x9258733f,	0x8df05767,	0x879b9ba1,
-0x84684054,	0x71a62082,	0x5be959cd,	0x12c937ec,
-0xc21fb3b8,	0x6738aa89,	0xb01d872b,	0x0ff6ec3c,
-0x50fc63ea,	0x715b7c5d,	0x4e5d50c3,	0x086c862e,
-0x34ec9201,	0xd41176ef,	0xd0238088,	0x53518100,
-0x8e1500dd,	0xc6ea9594,	0x0359517e,	0x58d81a35,
-0x48c40983,	0x2d562dc6,	0xecf5be9e,	0x4cd82ead,
-0x45faeb2b,	0x1a66ec1c,	0x6b692a76,	0x6cb326b0,
-0x3a6c362c,	0xf0174da3,	0x5e4549d9,	0xc12c5972,
-0x73716059,	0xdd54591d,	0x32ee704b,	0x5a55c22d,
-0x56bd1e7e,	0x2bd34024,	0xa42c85d2,	0xb1ce248a,
-0x604a7570,	0xbbf4b3fb,	0xe0eeb866,	0x130b7dd4,
-0xdb39dc1d,	0xd873b0c4,	0x3aedb6ef,	0x5efb2481,
-0xbfaff9bc,	0xb94930d6,	0xa3fe71cc,	0x75867e01,
-0x7c8ee191,	0xf38f4963,	0x8d077957,	0x658e7c2b,
-0xc1bd58ed,	0xb86a20b2,	0xc624489c,	0x4624732d,
-0xc11f1ee3,	0xf1874ed7,	0x173684cf,	0x0e5851d4,
-0xc2662118,	0x13dbb926,	0x1668df5e,	0x00749d03,
-0xab9530d2,	0x5758e602,	0x6db90ff1,	0x87270f9d,
-0x774a52f5,	0xcd1b4b5a,	0xd706025e,	0xe3a51fc4,
-0x31c5d55b,	0xbd0278a1,	0x16dce1bf,	0x75a3446f,
-0xe030c121,	0xa6f6b3c8,	0x504e3b3b,	0x4c1428b1,
-0x74229a60,	0x25d5b7b7,	0xea284c21,	0xf5f1c7cd,
-0x0025e9fc,	0xa7db9e56,	0x4e3aeb90,	0x8bad0f3b,
-0xc19e88eb,	0x8ea86b83,	0x25cf5d26,	0xca78504e,
-0x94109c06,	0x60ad3975,	0x138b8038,	0x4c9d8fdd,
-0x28a91526,	0x5d3d6c3a,	0xf81ab861,	0x8db34426,
-0x35a3b398,	0xf3b40170,	0xb7e6994b,	0xea72c1f5,
-0x63201cd4,	0x1c5749dc,	0x420ada27,	0x419f4847,
-0x49244543,	0xb915645f,	0x3a00b3e2,	0x0122000b,
-0x296b6bad,	0x7b45d76b,	0x5be8f025,	0x2a04919f,
-0x8291fea4,	0xaae644f9,	0x7af3fb96,	0x77d9878c,
-0xa8996848,	0xa9a0c1c3,	0xb47ae6d2,	0xc5b6cf90,
-0xb04b4863,	0x43fa113b,	0x66ef4993,	0x03a5b4e9,
-0x94b661dd,	0x145a5909,	0xd42f70cc,	0x6b816775,
-0xfbc0cb04,	0x5e890eb1,	0xb6900305,	0xcd19304b,
-0x85c67d21,	0x19e91907,	0x27b3898c,	0xe0ce6ba2,
-0x4110d80d,	0x85953740,	0xba7a4225,	0x51db6dd9,
-0x04c21ffe,	0xd34ef7cd,	0xeb13f075,	0xc1f8eb04,
-0x19a1227a,	0x3e99efae,	0x318346e2,	0x3d4c73bb,
-0x402dacc7,	0x5a9e892d,	0x01304401,	0xb3950c6f,
-0x9254bea1,	0x5cc8f025,	0x53cb9416,	0x52d716c5,
-0x3ff575a5,	0xede2046b,	0x2cbd6b85,	0x7e8feb25,
-0xc2d35482,	0xa49b8495,	0x214fed4b,	0xc93ae54f,
-0xde3d8a18,	0xe4456b47,	0x505555c1,	0x6418926d,
-0x4b6ac1e7,	0x7ac213ea,	0xc081eea5,	0x467ff1c3,
-0x1ed5d79d,	0x746dbb24,	0x38b1dbde,	0x4d495fc0,
-0x7ddabfe1,	0xfbac0ba1,	0xd17cfc3b,	0x32c819f3,
-0x1f4c39cd,	0x6fa5c3ed,	0x0d2e7f50,	0x1f5cb318,
-0x1e1770d1,	0xef12c293,	0xb149ace5,	0x93df9bdf,
-0x14a98319,	0x3374906f,	0x746d603f,	0x5a368e6d,
-0x8dbaef76,	0xb7923f42,	0x607655cc,	0xd144703c,
-0xa01fa0f6,	0xa83f4e65,	0x224bba03,	0x6e082d15,
-0x11ef27eb,	0xad91427e,	0xd8f0e3bd,	0xba7bc3df,
-0xdb031557,	0xf33052d0,	0x2bc3df37,	0xf55d25c2,
-0x99af998a,	0x5819eb07,	0xe4b9ebc5,	0xbc3da46e,
-0xde1abe71,	0xb8c66434,	0xe811e29d,	0xa48ee5e6,
-0x7f961c60,	0x5500769f,	0x9c8e0d00,	0x94680cea,
-0x2f7a0c5f,	0x9a058310,	0xd3ddca08,	0x74276c4c,
-0x855ebef2,	0x61979f79,	0x09684303,	0x3ea777dd,
-0xf700db1f,	0xdf7bcae0,	0x0fa7db2b,	0xd0115231,
-0xc0015882,	0xe4af6f72,	0xb4388c7d,	0xfb5656bc,
-0xbe1d38b3,	0xf59ae9d3,	0xddc692bf,	0x3aaef998,
-0x561f993f,	0x4d191a40,	0x4492df05,	0x7eb17670,
-0x0770001b,	0x9b320a87,	0xbc8a559a,	0x19781e02,
-0x13c995b1,	0xcb8c1e47,	0x462019e3,	0x7ee6bcc1,
-0x9da2afce,	0xee1dbf76,	0x3a72ad3f,	0x711f786a,
-0x0c72d639,	0xa3455dc9,	0xef155308,	0x82f3e1c9,
-0xc9540414,	0xcec2cde1,	0x748005bb,	0x24197d5d,
-0x4b8b7f7b,	0x3dde3129,	0x9ac952c9,	0x6f7932a7,
-0xa99005e4,	0x4261280d,	0xfad329af,	0x90bcacb3,
-0xe1c4a202,	0x9200d928,	0xffe55142,	0xf69b2a40,
-0x227783a3,	0xe4b0c9c4,	0xeca97ce9,	0x9245597d,
-0xa922db08,	0x94bff912,	0xdbebd937,	0x5c658f30,
-0xb3f4a726,	0x24e2ca27,	0x9ca037d7,	0x745d3d5e,
-0x3e8c437e,	0xb807af86,	0xee5fa977,	0xfe335297,
-0x5c0a6707,	0x8ab801af,	0x05d02766,	0xcd0906b4,
-0x791b47d3,	0xff5a0291,	0x09465b16,	0xa7fff3a1,
-0xe2e6d825,	0x7f4f2b9a,	0xc1f2e668,	0xa5cfe1d6,
-0x95fd7bde,	0x38681314,	0xc3c7dce1,	0x7b82e044,
-0x2c883c77,	0xe8aa72be,	0xd53867d7,	0x7022fdc3,
-0x3b697ccd,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-/*  2991-m406fbB9.inc  */
-0x00000001,	0x000000b9,	0x05112009,	0x000006fb,
-0x70fed5b1,	0x00000001,	0x00000040,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x000000b9,
-0x0000003f,	0x2a000000,	0x20090510,	0x00000341,
-0x00000001,	0x000006fb,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x15341951,	0xd9f92c58,	0xd61aff76,	0xe96873ee,
-0xdec6dd45,	0x3dfa2e4e,	0x61661b88,	0xcf5c5841,
-0x58d10d9f,	0xb7f2421d,	0xe4d5fcf1,	0x02889a15,
-0xad9bed07,	0xa32ab3e6,	0x3491afcc,	0x9c991c37,
-0x2a1c2071,	0xf066191a,	0x3bd898e7,	0x2648d958,
-0xc05f7908,	0x05864b9b,	0xbe4c1eee,	0x1e6c7ef4,
-0x0e7a539e,	0x100b2ab3,	0x1273dceb,	0xfec8847d,
-0x8f37946f,	0x634e3b5c,	0x691dbd61,	0xd89e3cb9,
-0x094639d4,	0x7d972e1a,	0xd6dbd94d,	0x2001c3ec,
-0x34f791f0,	0xeee0d794,	0x88b7459d,	0xc2c73aa3,
-0x607a174d,	0x4f0f8304,	0x65790b35,	0x00532bfe,
-0x1fd1e0cc,	0x7b91f873,	0x154ed42b,	0x7a7108e9,
-0x81637c95,	0x192cb173,	0x28ccd94e,	0xb9bcc372,
-0xac05171b,	0x867f47da,	0xf8e8c47d,	0x1edcdb4a,
-0xd2ca6c2d,	0xe9ee9169,	0x5a6efedc,	0xb6825038,
-0x09277eaa,	0x2a34e580,	0x0f794366,	0x86c99402,
-0x211b98bf,	0xdf8eb0e3,	0xda11d7bd,	0xd440363e,
-0xa7d49f1a,	0x16dd7395,	0x5b23c2fc,	0xab93ea3c,
-0x00000011,	0x0741cbc1,	0xcb879f12,	0xb53a6cbd,
-0x8d26a6ca,	0x2aca7c7a,	0x1e952ea5,	0x07da17e7,
-0x52d164d9,	0x62c68a73,	0x2d489e03,	0x45a07f1b,
-0x0f0cc8cf,	0x4fa8fa70,	0x2315d683,	0x33e36418,
-0xdda877f3,	0x8e1bfc6c,	0x7f636e46,	0xbb114fab,
-0x69c0e244,	0xf261040f,	0xeeeea4a8,	0xc88fbfac,
-0x507ac028,	0x4932bf5f,	0xb40db20e,	0x8d18c03e,
-0x44b1f658,	0x2f0527f9,	0xe6d65979,	0xfd881db7,
-0x770be7a8,	0x459b7a4b,	0xfc00c5d2,	0x1bdee510,
-0x94bf752f,	0x68a06b2c,	0x4fdf4668,	0xdd08536a,
-0x19438a29,	0xdfa14148,	0x266ccbb8,	0xd7ab60f2,
-0xceaf893a,	0xb00858da,	0xd204d03b,	0xea8d3784,
-0x4f3a4d8b,	0x323f53e4,	0x3180af2e,	0xd06428fc,
-0x932bfc3d,	0x8d701652,	0xacd6f494,	0xebd48f9e,
-0x2b1248b0,	0x63f4d854,	0xbedc0412,	0x505e1f49,
-0xad20cee5,	0xc95a2a56,	0x49b90a51,	0xb3de9036,
-0x1f4c88df,	0xb7460c4f,	0xad3a53b4,	0x3d3e83cd,
-0xde1ea2d5,	0x5d3b0237,	0xda3c8637,	0x0aeeeead,
-0xae2b5959,	0x35624290,	0xbabab8d5,	0xa4899633,
-0x7d6e607d,	0x410383ae,	0x10916b70,	0xb2adf0c0,
-0x52d8faac,	0xe6937b79,	0xb959bc66,	0x14d8d06b,
-0x0ec3c602,	0xb6c71f26,	0xbbd8c4dd,	0x63d23706,
-0x6bee321d,	0xc8a1ec7d,	0x8de3941e,	0xd549d1c4,
-0xe33588e8,	0x681cff2d,	0x66dddada,	0x807040e6,
-0x006c83b0,	0xba10f7c8,	0x38eafe62,	0x0777e74d,
-0xfa39a198,	0x05720466,	0xec377dbb,	0x23d46da7,
-0x3a387dc8,	0xe005ab95,	0x5d92190b,	0xb811b9d9,
-0x9b09dddc,	0x62a64be5,	0x0c9014bb,	0xcc871ef9,
-0x4846edba,	0xc60305e2,	0x91b831aa,	0x8f7d5aa7,
-0x6712012e,	0xbae578bd,	0xc5bb2872,	0xb635139f,
-0x41444279,	0xc51f819a,	0x92fe6768,	0x96c480e6,
-0x6a958394,	0xb4b7a6e5,	0x007c0429,	0x43af55b5,
-0x33697de5,	0xcb6b363e,	0xf527556a,	0xd4a79f83,
-0x9c628ccb,	0xef72182a,	0x8406cbce,	0x6035ff55,
-0xd6325e79,	0x111ea438,	0x962b7e5c,	0xecc816e1,
-0x39a8f348,	0x8f5bb065,	0xa2419dd2,	0xc036db13,
-0x5360daa6,	0x82d2ffb8,	0x15681502,	0x6d5497d6,
-0xe9028ce5,	0x2e05c16a,	0xee8711ae,	0xac5b11e4,
-0xabba0581,	0x1ef11c35,	0x54ecf615,	0xcf45b599,
-0xd8ee7594,	0xecda2c12,	0xa6b2b120,	0x32edc139,
-0x7734c724,	0xbb88978b,	0x12092d6b,	0x133fb4f4,
-0xa6fa233d,	0xa059395e,	0xb86920df,	0x60b25bff,
-0x1fe831ef,	0x2b5cb3aa,	0x27ef4afe,	0x02f3ad21,
-0xea597773,	0x2caaf33c,	0x03b30480,	0x7d8e32e5,
-0xad9a917e,	0x1bd0695c,	0x68d8ca07,	0xeef84400,
-0x928ff8b4,	0xecea6a3c,	0x9bbedbd8,	0x5c2654bf,
-0x2d1644d5,	0x961ddc1e,	0xcb216e0c,	0x55fcff3b,
-0x6054f145,	0xad2d4159,	0xdcbe8ed7,	0x3b2e7495,
-0x7a33fdb5,	0xa92fdfde,	0x65ad1aa7,	0xf6866ab0,
-0x53388681,	0x0a369d17,	0xf087441f,	0x44007109,
-0xd1d8b88d,	0xdc94549b,	0xa11f14d2,	0x72864a34,
-0xd7f71dd9,	0x6f948c77,	0xd3e89fc0,	0x11b097a8,
-0xfd2cd3fc,	0x774f951d,	0xe1170076,	0x2bde8936,
-0xa3ea656e,	0xabbe230e,	0x2fe6e1d2,	0x53b331e2,
-0x7b392823,	0x48c2aa80,	0xb7824981,	0x275bac51,
-0xd3b3eb48,	0xa3541a00,	0x4375b1fe,	0x086302fb,
-0xd744a440,	0x0323a890,	0xcebc28fc,	0x9921427c,
-0x7a4b5465,	0xf4db5f26,	0x6461f88c,	0x2dbe6ea3,
-0xeb6dd03c,	0x8257fcce,	0xf44dadd6,	0x7d367355,
-0xda56024d,	0x750430f5,	0x5e4151d9,	0xd90a0db6,
-0xdc29eff5,	0x6acb146c,	0x97ef9139,	0x4992e11e,
-0x87833d75,	0x897f9beb,	0x33aa151c,	0x28a717fa,
-0x5c5bb59f,	0x45617198,	0xfc791809,	0xef17a7b2,
-0x10931956,	0xdd697c3a,	0xd8a2f728,	0xd4171ff8,
-0xd507ad63,	0x40c2a2b8,	0x519fe54e,	0x6ddbf5e2,
-0x215f916e,	0x99694eca,	0xeb87cf67,	0x69691e42,
-0x76d17fa0,	0x0edb5d25,	0x82303164,	0xa6ff4797,
-0x8a19ce37,	0x71005b4d,	0x41930843,	0x0251a3cc,
-0x594886d3,	0xe2e463e0,	0x812ab47f,	0x477b2ba6,
-0x17c544a2,	0x802b8757,	0x1692cc60,	0xb86bf34f,
-0x1f8a5fc2,	0x0693dda6,	0x5da932c7,	0xfd216376,
-0x25002074,	0xad6987f9,	0x93bde120,	0x2ae45842,
-0x092941c2,	0x0bc4878d,	0x30507588,	0xe9351bb4,
-0x81dda9a2,	0x6b89e825,	0x948482ef,	0xaeb22085,
-0xace5a27e,	0xa20c3f4a,	0xd768a0da,	0x919d2d26,
-0xded8effd,	0x01812972,	0x9ba923be,	0xb69023a5,
-0xe7defcfe,	0x865e123e,	0x02107238,	0x92c688cf,
-0x30b0a462,	0xb56e62e5,	0x009e60fb,	0x02db37ca,
-0x19a5c9d0,	0x9b879be1,	0x16ec478f,	0xa983dd56,
-0x2776b4bd,	0xb858a7c4,	0xdf340c19,	0x137d7e01,
-0x4467564d,	0x855bcac8,	0x9cf1cd0e,	0x54a19437,
-0x2e4ed636,	0x7b693cfa,	0xddba25a3,	0xef65d915,
-0xaccd377f,	0xcdc2f092,	0x74704385,	0xda63baf4,
-0x1ac4bc8a,	0xb4ea4309,	0xa73ad61f,	0x6293ce83,
-0xdde1e829,	0xf88514aa,	0xcc488bcc,	0x6e4c9d36,
-0x78b7e22e,	0x5a7d29e2,	0x42f40246,	0xdf4a9afb,
-0x82ca32e0,	0xc7118b4e,	0x25165db0,	0x7770aecf,
-0xdf7582f0,	0x35b55887,	0x33a47c37,	0x08c158f6,
-0x7a21b06c,	0xcb6a9bbb,	0xdabcfc6f,	0x486b55b8,
-0x6187d764,	0xe5c70327,	0x492a7da7,	0x24264c3e,
-0x8e5c09d7,	0x3836c445,	0x9fa2d9cb,	0x6bc2b196,
-0x1ef155ed,	0xb949f5e8,	0x00846e44,	0x2b79a60a,
-0x9e40d440,	0xe8b97836,	0x90a14cef,	0x786cae97,
-0xe39447a6,	0xccf6d399,	0x0accbac1,	0x54250900,
-0xc0351c81,	0x00b88195,	0x5beb4553,	0x682e6920,
-0x9379d47f,	0x69cd76f7,	0x097b55db,	0xa9ead305,
-0xbcbf9b4e,	0x8d627c2a,	0x380a2367,	0x14790660,
-0x9c95ebed,	0x76e551eb,	0x645370f3,	0x497634cf,
-0xeffa7029,	0xf66aa141,	0xfe718fc6,	0x094c6914,
-0xbd00207c,	0x77e3154e,	0xabc1749e,	0xb8c40c07,
-0xaac4f806,	0x89d5f6eb,	0x2d89377c,	0x65caeecc,
-0x1c21568c,	0x901ddb9d,	0x915df7d7,	0x4f9cb664,
-0xf62c432c,	0xeeecadaf,	0x0ccb4f75,	0x14186099,
-0x68245f8f,	0xd981ff3b,	0x722de32c,	0x2b55e9ef,
-0xb918ac26,	0x94fdb9bc,	0x02b7ad08,	0x7592dd6d,
-0x470f9624,	0x9d403aeb,	0x5e7b4f3d,	0xb5e11056,
-0xa97be649,	0xe9826083,	0xeec24fba,	0xe731ac9b,
-0x5b339d05,	0x97af9713,	0x86390c44,	0xed541028,
-0xeaf9969b,	0x3c72446f,	0x0b654ab2,	0x281b99a0,
-0xa31e8b79,	0x86175d4a,	0x96fa99f3,	0xabd90de1,
-0x642bc82c,	0xdcc81442,	0x16719e3c,	0x0cc60e15,
-0xc276faaf,	0x9d0e7759,	0xe8594cd3,	0xbfa376e0,
-0x4daabe5f,	0xcbe3009e,	0xd1812e8c,	0x744b1fc0,
-0xcf3728a2,	0x34442fb9,	0x1c28619a,	0x35844d65,
-0x115306a6,	0xa3c936d2,	0xf781af3e,	0xef7bb760,
-0x0264321d,	0xf52bb605,	0x3a83684d,	0xdd21a5ff,
-0x777115f2,	0x69b8e872,	0x64517548,	0x70267f4f,
-0xbe3b1dcd,	0x5a2bc602,	0x222c7241,	0x424864ae,
-0xa735c475,	0xcc44d6f0,	0x27d8d5db,	0x67bc23f8,
-0x3391d751,	0x197aa11b,	0xf16a2a9c,	0xe4d58566,
-0x9dae5211,	0x1601c94b,	0x491bd296,	0x48dac3f6,
-0x8c6ddb0c,	0x734bc4ed,	0x83d4015c,	0x29ff784b,
-0x3707b6dc,	0x6c14e801,	0xc76aa725,	0x70740fc1,
-0x6aba6f3e,	0xf122dfd2,	0xffddda9d,	0x516c60ff,
-0x396bf3b6,	0x2d3406b4,	0x4355cfb9,	0x126d6dbf,
-0xd0d55fcb,	0x6f23a648,	0xe2f286dc,	0x8af42ef8,
-0x497f9446,	0x7285afdf,	0x3ff58008,	0x583df7d2,
-0x3aa49b76,	0x9281e837,	0x6196b8d5,	0x5ee4428a,
-0xf4f92c37,	0x6c6376d2,	0x6afb2760,	0x3f355e4a,
-0x1ea450bb,	0x5e9da7c6,	0x2b4b1e72,	0x74d5e29e,
-0x07de0aea,	0x77544e2c,	0x66c19ac3,	0xbe86aaa4,
-0xe5233e14,	0x7d4e763e,	0x31ca0aef,	0x0527e563,
-0x149b4d2a,	0x5f5ad61f,	0x65f1161b,	0x86c7633b,
-0x2877e065,	0xf5592a41,	0x60e67df5,	0x555aafdd,
-0xe3caffab,	0x501e6b00,	0x11ac37c4,	0xf84c8688,
-0xbad031ee,	0x6c10e5f9,	0xc7087e4b,	0x86d0bcf2,
-0xdcec3d4a,	0x999fb6a6,	0x7de512a3,	0x25a4304b,
-0x775003fe,	0xc3da9a99,	0xdb02be9c,	0x8c8bae98,
-0xd95e979d,	0x6094a6f2,	0xf69c4d09,	0x51fa8ab0,
-0x9e31adf5,	0xed2c1ddf,	0x0bdc379d,	0xe0c24b81,
-0x021511d9,	0x6aab3cd8,	0xbdb35278,	0x5e253639,
-0xdc51e798,	0xb7969a75,	0xb448b42a,	0x4db2c7bd,
-0x92ab4fd1,	0x99a0c92c,	0x5b59394e,	0x5e06cd33,
-0x76d0636b,	0x01c826fb,	0x66d62ad4,	0x2177e49d,
-0xbfdf80c4,	0x0687e341,	0x2cb66974,	0x0765697e,
-0x33a9d5c8,	0x790deacd,	0xb528b72a,	0xad4f0332,
-0x9efb2065,	0xa1621eda,	0x6da51c10,	0x891eb234,
-0x66015c9d,	0x8551be17,	0x34ddbe4a,	0xafc5de23,
-0x9ee441d8,	0x92153585,	0xd4ee376d,	0x7f267079,
-0xdffe357f,	0x0e0cd672,	0x8d914a79,	0x55c6242b,
-0xba984937,	0x6d4e5c6e,	0xdbbf9de8,	0x7b07ffb1,
-0x4c60f396,	0x81780d39,	0x1158e09f,	0xa7b04aa5,
-0x29e4e907,	0x321756e8,	0x938df05f,	0x3d2e2a2f,
-0xa0218157,	0x3b43bb2b,	0x90aed14c,	0x99e51a0f,
-0x94ed8b33,	0x230c8dc4,	0x49a1aaca,	0x38552316,
-0xd2b4d683,	0x402572f2,	0x6b35d2ab,	0x8f54d64e,
-0xbf6713fd,	0xb1baab41,	0xea513b9d,	0xee1fabdb,
-0x96965270,	0xb9c73510,	0x307504f6,	0x66e6efb6,
-0xe5edf87e,	0x0dfc0dda,	0xce9b9f4b,	0xc495c0dc,
-0x8eb4ae2e,	0x15d4ffaa,	0x3f72c117,	0x9066433b,
-0x1e326a9a,	0x87e472b4,	0xe8e9924e,	0x2d34ddd6,
-0x9f045dc5,	0x4e517bf9,	0xd4215701,	0x997945f2,
-0xda577384,	0xc26b9a43,	0x72cc0d2c,	0x1a6f0feb,
-0xb0deaa5f,	0x085e3c1c,	0xe84cd89d,	0x0c0b72ea,
-0xb6ba866b,	0x5495bf3c,	0x322cead1,	0xc15fa497,
-0x90813acd,	0xabdc90af,	0x25f8bca2,	0xef81a57d,
-0xa3f95491,	0x257d3c3d,	0x2ac7aa7b,	0xd713ee46,
-0x11a2cb99,	0x516713f4,	0x3c2e6d1f,	0x8dfc69e6,
-0xb2aa11c3,	0x4735befc,	0xccc1c2e9,	0xedd47dc8,
-0xfea0a020,	0x7477af3e,	0x59c5a8c3,	0x22546f44,
-0xfed2ffc9,	0x3b1dc4f3,	0x6d4fd900,	0x0df8a070,
-0x1bdbd385,	0x1b028b64,	0xd2c7b639,	0xaf26374b,
-0x48a6a1bf,	0x4f7896de,	0x0356256a,	0xb0bf4df2,
-0x3d0f3382,	0x28f1a73f,	0xadf4ed6b,	0xced36065,
-0x1c807f0b,	0xcd33028c,	0x62da94be,	0x79a2b539,
-0x3b81dc8b,	0xda9094c2,	0xdf52d610,	0x47d10d38,
-0xed9cd5c0,	0x482e26a0,	0x1459e4f0,	0x6cf0b6cb,
-0x4e29d1ef,	0xe67e1cb9,	0xd2ddca3f,	0x6e67ef3d,
-0x299c296c,	0x1e39f62d,	0xe77ee72f,	0xfc3c6f35,
-0x1317aa16,	0x5b9b266f,	0x292eca31,	0x39a8d234,
-0xd667205f,	0x4a2d3bf6,	0x70ed41af,	0x4e5d9985,
-0xa7ed1e30,	0x4a5ef783,	0xa9b51db1,	0x6fa70d0f,
-0xe7414e10,	0xc310129c,	0x2a486151,	0x2a0c9bee,
-0xa45f38f7,	0x0be89a12,	0xcb4ba82c,	0xb80cc7ee,
-0xb59b6377,	0x89a46c16,	0x8c6a2053,	0x55d4ac40,
-0x8b0103b8,	0xee2b7231,	0x2a8bd3b6,	0x567f5aa9,
-0x118de9bd,	0x23dd7c43,	0x76b854f4,	0xdc870cc7,
-0x475066e2,	0x98643269,	0x003da392,	0x7fcb79c0,
-0x6a19745f,	0x4cb11f54,	0x7550a953,	0x9e00fd82,
-0x7ba3d396,	0x70fbddb6,	0xb0086afc,	0x8c630c63,
-0x8c7a72dc,	0xab309532,	0x12d57a02,	0xfc45f3e5,
-0x26123a10,	0x25ddff38,	0x1135398d,	0x239017fc,
-0xaf185ed4,	0x71d242a1,	0x12c502e9,	0x24bab537,
-0x9c01afdb,	0x34987dd1,	0x5d30cb55,	0x0da06f96,
-0x713b12e0,	0xecdd0606,	0x4089a6c9,	0xde346dca,
-0x7dce2041,	0x8ce9be80,	0xa9bbe5fe,	0x0a5207c0,
-0x20ba0dd1,	0x7d3d4cfe,	0x8bf88a8a,	0xc1e6e73d,
-0x37ae952a,	0x74045543,	0xb77aef47,	0x7e889eb6,
-0x3a74c9a7,	0xacc58f0e,	0x548a9eaf,	0xe198514e,
-0x8f0d69df,	0x615c18c2,	0x1efbe64f,	0x919d94b6,
-0xe7d16ae8,	0x733404df,	0xb0d2e3f1,	0x9bc52fda,
-0x2b9b5131,	0x7d5fd99f,	0x916d49fb,	0x0bcd42a6,
-0x674f1d18,	0x46df8419,	0x438cce94,	0x8e327aba,
-0x96f9e53b,	0x0b648858,	0x5b3cb404,	0xf5a9bfb1,
-0xabdcfec8,	0xb6d91462,	0x9df9b0b1,	0x45325bd8,
-0x6267c960,	0xacac4260,	0xbe79add3,	0xbfb52703,
-0x710a56c1,	0xe1a186b6,	0x2f0c8089,	0x87325dce,
-0x5f6294f2,	0x7bfb3154,	0x2f980339,	0xfdad67e5,
-0xda83b599,	0x3825e4bf,	0x0725c08b,	0x42136832,
-0x3fe97615,	0x5d619d4c,	0xa7372fa0,	0x242aeed9,
-0x23ab6f72,	0xccd9abba,	0x75a07704,	0x18be55c4,
-0xe6a1efb2,	0x8fa154f3,	0x065e7822,	0xf1aef4f2,
-0x41d63927,	0x595f940b,	0xa72c1a4f,	0xb28883a1,
-0x8a31a6d6,	0xe576b453,	0x2cffe544,	0x49ac5cdc,
-0x0f6f18c1,	0xa36344b3,	0x6a931225,	0x5a129bc3,
-0x50da2193,	0x676ef4c9,	0x7703ad95,	0x3819c775,
-0x82f2c375,	0x01d5e074,	0x2cec57c5,	0x11346e2f,
-0xc4478508,	0xe887d515,	0x004dc5b6,	0x41f2bf05,
-0x48bb3a8c,	0x94cc6e3f,	0xa1779e34,	0x04834e8f,
-0xd892fabe,	0x49885984,	0xc50f2d1a,	0x08718f16,
-0x131a7c82,	0x7220ce58,	0xbea4d3a6,	0xf723d2e4,
-0x7a005f10,	0x7433c300,	0x11e0d9f1,	0x8a0a033f,
-0x9b7c85c2,	0x0de86135,	0x0db57b88,	0x2f45e3c6,
-0x7e5bf322,	0x35e01ea0,	0xfa6e5e49,	0x8b6d10d1,
-0x48991d44,	0x4d8faf15,	0x80e31bb6,	0x8a2a499f,
-0x246129fa,	0x75309f90,	0xb4848ea9,	0x90db1871,
-0x1e121457,	0x8cf5386a,	0xb12e296f,	0x1210062b,
-0x3508597f,	0x72f53cd3,	0x8641d284,	0x3d019297,
-0xfbf12ccf,	0xd616e0ba,	0xcf44c3ac,	0x77b8c351,
-/*  1468-m1df3417.inc  */
-0x00000001,	0x00000017,	0x04212005,	0x00000f34,
-0x2cbd6146,	0x00000001,	0x0000001d,	0x00001bd0,
-0x00001c00,	0x00000000,	0x00000000,	0x00000000,
-0x9fbf327a,	0x2b41b451,	0x9faf9c59,	0x6b62b8e4,
-0x28a4bf1b,	0x68a90200,	0x76d16a17,	0xb90dfc19,
-0x3ca53521,	0xa04666fc,	0x045ad035,	0x26fb2e1b,
-0xa4fb1229,	0x07e4f3e8,	0xc94461ea,	0x7c1a3eab,
-0x7a43994c,	0xc7bb8bc4,	0x7e35699a,	0xf76ff2a0,
-0x3113ad2a,	0xdf89abbb,	0xa846dac9,	0x8878dd67,
-0x4f2fbf68,	0x8a2629f3,	0x19cdde5c,	0x33f5d3ac,
-0x89cc0510,	0x6939b57c,	0x1d0ce21f,	0xcbd8c975,
-0x8399bc7a,	0x3340bc9c,	0x2ae5b33c,	0x483f6d55,
-0xa5c23575,	0x0cd85b6e,	0xc46e5a9c,	0xb31204bc,
-0xcb5a96a5,	0x6a24d1fa,	0xc1b09daf,	0x65976bd8,
-0x627382c5,	0x31d99884,	0xcd760418,	0xab85819f,
-0xcd4e400a,	0xe754b7db,	0xbfdca0b2,	0x6fb4bace,
-0x7cbaafdc,	0xdedbe28c,	0x0ff4856b,	0xd2007e27,
-0x34fdfd0c,	0x7d4b8aed,	0xc725c407,	0x559f7b96,
-0xcd9944ec,	0x04d189a0,	0x05f53e1e,	0x4d17446c,
-0x0086f6ce,	0xa59a413e,	0x0699a7a9,	0xcb8771ea,
-0x8dc80f22,	0x7d755b17,	0x124d5c52,	0xf30007ef,
-0xbdbcf840,	0xc33d1110,	0xa921cc9d,	0x3bc9349a,
-0x482c8e1f,	0x447545a2,	0xa83e956f,	0x7ec240ae,
-0xb0232daf,	0x1eb4493f,	0x74fae03a,	0x2255247a,
-0x14988d81,	0xcf53b699,	0xbcdb4ffc,	0xc96b0d2e,
-0x77ab6ea5,	0xc4248a9c,	0x171b4742,	0x321b4876,
-0x6e075f51,	0xd09770b6,	0x44f74bce,	0x1b3237c0,
-0x81abc949,	0x8e7ba040,	0x3f452974,	0xc7a1e70e,
-0x2c8a7ea3,	0x75de2024,	0x21530e34,	0x95cd09eb,
-0x6e7e331d,	0x8490c8a8,	0x3a3e2583,	0xeae1701f,
-0x3a3ae0c1,	0xb9c43ac9,	0x0847b7b3,	0x2240cbca,
-0x66e7dde3,	0xbd4b056e,	0xe17baf88,	0xc48cb80d,
-0xcaadad18,	0x9f632517,	0xa6851399,	0x482f1e16,
-0xbdb7390e,	0xb866ab63,	0x3a6eeda9,	0x9b39fddd,
-0x9308b31b,	0x6a77de17,	0x1511896e,	0xbb4432ca,
-0x64c81fad,	0x5031f2f6,	0x48e5dc67,	0x925b469d,
-0xf73f3940,	0xa06e860c,	0xd074345b,	0xe45d7a19,
-0xf67b6e78,	0xa169f2e0,	0xb5696203,	0x8e9c54be,
-0xbabad9f8,	0xdfa25abb,	0xe7b16383,	0x1377744e,
-0x0c3ae192,	0xcc7e10d9,	0x4dc5dbba,	0x88660539,
-0x0da822f2,	0x11ae62f4,	0xf19acd3f,	0xab62f4c1,
-0x6ed9a55f,	0xec3e0236,	0x049fd614,	0xbc5c4ee9,
-0x3ef5b063,	0x346ca46f,	0x51785dfc,	0x711692d0,
-0xe5a0878e,	0x48163770,	0x6846a808,	0x6548dc1b,
-0xe176a619,	0x6ab36fde,	0xbc8af42c,	0xc43e6ffe,
-0x5bf49353,	0x1986adbc,	0x3989e6db,	0x6e0f3f71,
-0x63991ff9,	0x421dbc52,	0x0a172c1d,	0xf9201b49,
-0xc864df42,	0xa717211e,	0xbd7b027c,	0xc37b488a,
-0x1b40159f,	0x82b56e29,	0x7045a923,	0xa9635f95,
-0x6e442902,	0xd05d3946,	0x18ef6c8a,	0x53301361,
-0x98093b21,	0x6987e008,	0xbd759198,	0x8335a7a3,
-0xe4a07e31,	0x829b3256,	0x86d14f5d,	0x373236b0,
-0xee1603a2,	0x8cab0af8,	0x5bbc822f,	0xa5f50977,
-0xadf829a4,	0xc6a7a5c8,	0x4f9a770a,	0x68f5f5b9,
-0x1811fc08,	0x49aaa013,	0xc40a9793,	0x45b7e720,
-0x11f95952,	0xa58fc5dd,	0x4bd441a4,	0x31dff79d,
-0x6d4bc050,	0xe50e6b2f,	0xb5986885,	0xe7ba87b7,
-0x003f5f10,	0xb8f38176,	0xfa8298c3,	0xf1438f7b,
-0xabe50c0a,	0xaebcb389,	0xba1cf4cc,	0x5f69924b,
-0xcad57af2,	0x033f0a88,	0x76612fd4,	0x8b6d7e6c,
-0xe505f26c,	0x63b3fcc1,	0x0ac99a9e,	0x032af319,
-0x0b085c33,	0x38d40f09,	0xd79d97c6,	0xc928bfbb,
-0x7a8aa8a4,	0x09a15c0b,	0xfd64b3f9,	0x79a2749b,
-0x94b17267,	0x5a940a3f,	0xa808ec13,	0xd5c2fdc8,
-0xd76c2cca,	0x18bb8f2f,	0xec3cbe35,	0x0149c406,
-0xeec40085,	0xa4174252,	0x24d308e1,	0x7a07c657,
-0x993c6a29,	0xc4877c78,	0x20f7588b,	0x8ab0ce57,
-0x44958e90,	0x0ccfa678,	0x177749a3,	0x9925fca5,
-0x98a51a3e,	0x51f7e7df,	0x2efcb727,	0x34fdc710,
-0x1df07336,	0xa5403783,	0x68a088f8,	0x7ccbde02,
-0x0fad4485,	0xe644d152,	0x81ac8f42,	0x16b72c24,
-0xb02b9675,	0x23a8c950,	0x951e2abe,	0xb1eb3c0e,
-0x0ebdcedd,	0x72cee426,	0xb3697ccb,	0x408e1ca6,
-0x10e66a49,	0x425d427f,	0xae915e79,	0xc36737b2,
-0xe4ca6c88,	0x25513a8f,	0x1e11aabd,	0xcb787d7d,
-0x3fbe9a7e,	0xca7d6195,	0xf10e27a5,	0xd263b030,
-0xdf8e8f6e,	0xa2ed8fa9,	0x2d0586e8,	0xe0e9ebe8,
-0xe4487a72,	0xb541b1ab,	0x9b6f7dbd,	0xe78208b6,
-0xb34470f0,	0x43462a39,	0xa3612161,	0x39b82e49,
-0xbfff3022,	0x05a7b499,	0xb4039476,	0x5ed1c3db,
-0x29bc6edd,	0x07815f50,	0x94debedd,	0x5f4d27a2,
-0x0b192aff,	0x34d6381f,	0xefa1db27,	0x1f5e12f8,
-0x3486ff01,	0xe8855253,	0x928a0aca,	0x672ac1b4,
-0xb89e4a1b,	0x27f4c297,	0x5af71582,	0x5011f9d1,
-0x6272394d,	0xcc0a8a11,	0xc05f332a,	0x78b6c2af,
-0xefb583df,	0x6b682e78,	0x4be2b005,	0x78d67f2c,
-0xf8fa6493,	0x5980ef20,	0x242a33a2,	0xd9670ba1,
-0xc95cc1b6,	0x42a88ba2,	0x2a59f02d,	0x16bef734,
-0x883967d3,	0xa23c3ac3,	0xd24d0aec,	0xc97dc00f,
-0x4a348e69,	0x3727a38d,	0xe6bcc557,	0xc0100195,
-0xab209095,	0x95906360,	0x8ba59b4d,	0x03658604,
-0x761e0b60,	0x40de9b58,	0x75a7ac7e,	0x5d64f18a,
-0x8d15ace2,	0x3451a20e,	0xc84fa43b,	0xd80206db,
-0xd6a9abbe,	0x2f213d06,	0x43b503e4,	0xd43272e8,
-0x2551c40d,	0x5eca9263,	0xb5164cc0,	0x0a8b6849,
-0x2be92588,	0xb324cf51,	0x9ac0bf91,	0xae2d3af1,
-0xdeccb499,	0x867a6379,	0x5a9dd70a,	0x86e2ff85,
-0xa394c8b9,	0xf1733ddc,	0xd627dcd2,	0xcce1c8cc,
-0xe4ed2ac3,	0x0c9e942b,	0xce847fb7,	0x86410f94,
-0xe4dea9ee,	0xbb6c0455,	0x3bf1323e,	0x9ef37011,
-0x66482b56,	0x7e426c99,	0xfa834c08,	0x396d97dc,
-0x39fa76e1,	0xc5dc6086,	0x643eec7c,	0x505d6257,
-0xb88cb057,	0xed8e1582,	0xebc58cc6,	0x12bc0eec,
-0x5d4c6dce,	0xe15e513e,	0x1b615938,	0x03f37a1e,
-0xb2d47c1a,	0xe4898548,	0xd9db0f73,	0x3116ed30,
-0xf37a985c,	0x984f292f,	0xb95c3bb8,	0x5983471b,
-0xd32606a9,	0xd262306c,	0x27022229,	0x835a2cf1,
-0x32412a68,	0xe34f9512,	0x87b3fe20,	0x8921143c,
-0xffc72ac2,	0xe68110a3,	0x8f03c326,	0x94204988,
-0x4dec33c6,	0xdc32ba80,	0x9b6c0fdd,	0x1dd023bc,
-0x41f6a622,	0xe5148ca4,	0xcad8f563,	0xb60a0491,
-0x3bb8ac3a,	0x5319fd1f,	0x150fd957,	0x2b0e5084,
-0x459f73db,	0xb8565124,	0x3c12d214,	0x37163859,
-0xdfa7bf0b,	0x21e500ec,	0x89e7a004,	0x9f97ce69,
-0xe6c3d033,	0xbf7f818d,	0x2285f31c,	0x474d96c6,
-0x2f377d76,	0x73ad1ee6,	0x1f7247ce,	0x95adc53a,
-0x4c62d951,	0xfe732dc0,	0xef0fbbe3,	0x51bf9d4f,
-0x3254179d,	0x394f146c,	0x62cc6315,	0xf00bc3be,
-0xcecad864,	0xbfb9b53e,	0x7a65501e,	0xe427e75b,
-0xeabe0e6a,	0x25d1e01f,	0x1788e58b,	0x39c913bf,
-0xf37b1195,	0x7c4f1ce6,	0x1e5768b0,	0xbb8a8561,
-0x78c498a2,	0xff89a1d2,	0x3afa4408,	0xabfb7f98,
-0xa03a3dc9,	0xabcfaeab,	0x7bbc277c,	0x11cbbd49,
-0x369e55f1,	0x472dac75,	0x3b52f318,	0xef5d8a5b,
-0x5048b3bf,	0xca6f5686,	0xacdbb5f4,	0x27f8d0ef,
-0x0bd0bac1,	0xbdacf44f,	0x692e1c21,	0x003ed188,
-0x906cb52e,	0xbb08bb91,	0xca89a92d,	0x51794247,
-0x68b875d0,	0x064699bc,	0x8fe578fe,	0x9eccb2c1,
-0x94f4c3e9,	0x33cbfe22,	0x56a6b1c2,	0x9edc591a,
-0x1b6adf0d,	0x8ef4e2ab,	0x627ab711,	0x1f85c4e3,
-0x4353abb4,	0xbcf76e01,	0x0a6c7528,	0x9483a0d6,
-0xf3da4fc9,	0x42187754,	0x68de6664,	0xbc0ff8d5,
-0xd026c5dc,	0x6eada9c2,	0xe7e3e431,	0x6e22fc23,
-0x61719184,	0x416554a7,	0x8e918580,	0xa7b1829a,
-0xab055dad,	0x8fd67f87,	0x8551783b,	0xa9e8a4e6,
-0x420e4767,	0x8a282bdb,	0x627c7474,	0x94391f49,
-0x0587364f,	0x0e05dee5,	0x3c200cfa,	0x37ad7941,
-0x9e064ec9,	0xa08a79f1,	0xded3e03d,	0x52ddca95,
-0xe7f248f1,	0xadc21d4e,	0xe8f609bb,	0xa7d00e2f,
-0xcee52be6,	0xce59a13c,	0x77a22385,	0xe907de8f,
-0xdd1becd1,	0x4f62b855,	0xf809431b,	0x9051abe1,
-0x1b97f1c1,	0x3956b8a1,	0x9b67349b,	0xe7172623,
-0x0c587452,	0xce3e5760,	0x02528d3b,	0x4a3e386a,
-0xa23b7545,	0xa5c8d0c1,	0x7dbc3772,	0x865ef72b,
-0xa1636170,	0x59086e5d,	0x5118d371,	0xc5a2e317,
-0x5495a3b7,	0x328ab06f,	0xbd5173bb,	0x49bf468a,
-0xbe3a6251,	0xa1f2400a,	0xf07cddbe,	0x3db625f5,
-0xa506cc25,	0x195dae27,	0x701937de,	0x21844e06,
-0x8d58481c,	0xf73c095a,	0x3b9be321,	0x05e12f42,
-0x55739f6f,	0x21df4a8f,	0x5d5000e6,	0xd8fefc8d,
-0x88ca172b,	0x620a50d8,	0x1e215ff2,	0x0fd1f2a9,
-0x84312202,	0xf721e46f,	0x9e5614ef,	0x4cc9bdd6,
-0x345a9f13,	0xcb1b458f,	0x8ffc6a39,	0x36d7cc81,
-0x821c0b49,	0xdfb4a6d4,	0xcf060d96,	0xe12f48b2,
-0xdda3960f,	0x6923305d,	0xa44e3d32,	0x3b050c55,
-0x53fc8cf7,	0x074c49f1,	0x8fc60933,	0x68a81bea,
-0x938a8e74,	0x1db192f3,	0xb8c90a66,	0x9010ba15,
-0x07b0a534,	0x08f1ac18,	0x2e1ad868,	0xa030c62a,
-0x4a87b72e,	0x2bbb71b1,	0xd9511feb,	0xe69e471e,
-0x643dcc65,	0xaae14581,	0xbb525c1f,	0xfb2c9a36,
-0x6b981977,	0xa90c1274,	0xbad2a083,	0xe0623243,
-0xb64e5036,	0xf02da84c,	0xa6036fa9,	0x4a7937f1,
-0x0628b829,	0x14c65dfe,	0x66f0f18a,	0x3d8450c9,
-0xdc46f5a9,	0x2b760960,	0x9bd27d34,	0xf1a4e1a0,
-0x2fce1f0e,	0xa6ff5ae7,	0x36ca01bf,	0xb2040647,
-0x206ce76a,	0x96e6011b,	0x3c887208,	0x310b07be,
-0xb746778c,	0x4b87cad7,	0x54a237d1,	0x066b00cb,
-0x28538149,	0x3940fdec,	0x2543dd19,	0x0d61da95,
-0x9f0ec2a8,	0x54732ac2,	0x1053c31c,	0x56c337c3,
-0xe6d95ed6,	0x01e73c64,	0xa4d59927,	0x30a2e3f7,
-0xe59ba358,	0xa92ab193,	0x85241ff4,	0x638a128e,
-0xdf4eab89,	0x9e65421e,	0x28084665,	0x5f832ff0,
-0xfe73bbca,	0xeb5751a2,	0x7e3a974a,	0x5a687c0e,
-0x109846bd,	0xbb3b0fc2,	0xdfbb1d09,	0xc4163632,
-0x0ae7d72c,	0xd743ccdd,	0x3d519ca5,	0xfc0fbc3f,
-0x96b03f38,	0x7225eed6,	0x30d46019,	0xae6771be,
-0xf3b67aca,	0xfd44fc17,	0x6692ee88,	0xf6e42543,
-0x98a0c348,	0x0d80c75c,	0x52dffcc2,	0x9fc3e94c,
-0x427e10dc,	0x718ce01c,	0x73c84733,	0x04486fab,
-0x03bab408,	0x5f71e7ee,	0xa07afa0a,	0xb2a69b10,
-0x1bd1cf67,	0xda5db20a,	0xebbd96a2,	0x3cd78b00,
-0x62c8b708,	0xbef8048e,	0xc7ca75ad,	0x8bfeeb77,
-0x331dfad9,	0x2ff4ad59,	0x95b01d87,	0x18409706,
-0xb55e8dba,	0x12132190,	0x8e0700d2,	0xba0565df,
-0xd2dddc9c,	0x2766fdaa,	0xcd18d6fa,	0x0741e268,
-0xd7fb16a1,	0xe33101c5,	0x439a2d80,	0x3b6224bf,
-0xc6a2fc64,	0xbcf4db84,	0x645332b2,	0x79df445e,
-0x989de295,	0xa08eba68,	0x413e59d9,	0x63408606,
-0xa4eeb5c0,	0xb7f4445c,	0x16ca78c5,	0xc60f1ee0,
-0x997bfad1,	0x17837123,	0xb51d95e0,	0x95e64fb5,
-0x8fb882cb,	0x2bbd1f6c,	0x366c6e1a,	0xdc6dbe79,
-0x42f570b7,	0xe676de45,	0xf7e2bb40,	0xba4bbf81,
-0xd3e23715,	0x71bee5c6,	0x5a309f9a,	0x90a51750,
-0x1019b74f,	0xc14c3b92,	0xda315332,	0xe73ba69f,
-0xe22e3c09,	0x6be8c884,	0x5b28f280,	0x617dd51a,
-0x0d5fe9ae,	0x378b4af5,	0x59176371,	0x319e1b1d,
-0x614b5f56,	0xba04e514,	0xf3185a28,	0x7db83997,
-0x788058ff,	0x8ea09117,	0xeb391588,	0x3930cd79,
-0x4079de1d,	0x7335d3e4,	0x40b92e55,	0xd81bfe8c,
-0x8d2dfff8,	0xb20d1b95,	0x54fdd754,	0xccc79905,
-0xb61264f3,	0xd3b56698,	0x292bbff0,	0x73f84171,
-0x8e21d0c0,	0xd17a647f,	0x3ac23c3e,	0x5f087a6d,
-0xe2c7ad20,	0x78da8742,	0x357d9ced,	0xfda05f27,
-0x05790cb5,	0x0c3fa95d,	0x0f4b67ab,	0x939fc831,
-0x555768d7,	0xefa7389d,	0xb2a5c860,	0x06fde838,
-0x6dda0cc5,	0xcf642c58,	0xdac9a0c2,	0x5f78ce35,
-0xd8c90c33,	0xb552d66e,	0x2b6d8254,	0xe5d46f62,
-0xf530a048,	0xa890cd85,	0x0883b0f3,	0xcbbed658,
-0xb7162101,	0x1388d3e7,	0xffd23960,	0xb2d05515,
-0x1494a0f0,	0x70ff6dcc,	0x435f7ac7,	0x6452171b,
-0x4f44b408,	0xe789e7c2,	0x6b1d6ef7,	0x290a0422,
-0x17a804c2,	0x0f7eaa93,	0x45141c7b,	0x7dad39b7,
-0xcfa376fe,	0x9f014db9,	0x4def7f13,	0xf05ed84d,
-0xe68d6581,	0x87f57999,	0xa8dacc2d,	0x0a4d0884,
-0x1cd652bf,	0x6666af57,	0xe11d3fa7,	0x7ca677c9,
-0x4a406958,	0xfe4d9538,	0xc81f3bd1,	0xb8c5480f,
-0x8018080e,	0xd98e1260,	0x0930bbbf,	0x7a3e1963,
-0xfcfdbbab,	0xd5543f96,	0xa7412547,	0xc4f4e480,
-0xe8833b7b,	0xb27f7407,	0x9ee703fa,	0x6cdda5fa,
-0xf06a77e9,	0xc6fa88d2,	0xbed346f2,	0x82a0caeb,
-0x69dfe65e,	0xbed71b5d,	0x34e8b801,	0xdfe35ba2,
-0x0d1e9238,	0x5d21972e,	0xde0736e8,	0x238f99df,
-0x5ab87993,	0x9571c1a2,	0xa1d8702a,	0x1ad317cc,
-0x321feea6,	0xcb8c996b,	0x122666a1,	0xfb6c4458,
-0x2ae14a6d,	0xabead237,	0x3fd75442,	0x9a766d96,
-0x9ca52b16,	0xf354464e,	0xae3eb3e7,	0x389aa4d5,
-0x41a7517c,	0x9d6c4d92,	0x711b1352,	0x887252e6,
-0xe3509f42,	0xf1b54f84,	0x72be7fd1,	0x72237a99,
-0x6b2c892c,	0x875b2b94,	0xf41c080e,	0x22092eeb,
-0xad82168e,	0x3301eca8,	0x4e35d8c7,	0xc8a2273e,
-0x3c0de91a,	0xba407dd1,	0xa499bb50,	0x0f110c3d,
-0x73db5778,	0x3e1b9a0e,	0xcea88ecd,	0x7bfcbe0b,
-0xf32142fa,	0x506c2fd1,	0xe6046028,	0xd1134c2c,
-0x05e5d53d,	0xe7d1a97b,	0xb85d3858,	0x034ca401,
-0x92092cbd,	0x9faf593b,	0x13d97d0a,	0x8e1eed08,
-0x1782d1a7,	0x304b8b83,	0xdb0a2ccd,	0x1d753e9c,
-0x56ac52f5,	0x6e2a00c2,	0xd3031671,	0x29a4fcf4,
-0xee6554ed,	0x5f3364c3,	0x41e7d73d,	0x5f16e26a,
-0x6fab74fc,	0x1115781e,	0x196e0126,	0x780a2f44,
-0x64d7a035,	0x26a23228,	0x74c8e6b6,	0xbdae8e61,
-0xd344cb25,	0xba579233,	0x0980842d,	0x05e7e7bc,
-0xa77b76af,	0x31991c19,	0xedcc0b24,	0xc9e90421,
-0x67a0b19e,	0x3b72ec88,	0x684a30a8,	0x5778b6e8,
-0x35a53472,	0x2bd2408e,	0xabb6bfc4,	0x19688e2b,
-0xe255d126,	0x40572791,	0x113dfda8,	0x897a52e8,
-0xfde9c38d,	0xd1228692,	0xc70f9851,	0xf9d9d4a2,
-0xc29cf646,	0x755a4cca,	0x7012d742,	0xeedd7a2f,
-0x39e99f02,	0xca3518c4,	0x6c62db3c,	0xae8347d1,
-0xb4a4ca4e,	0xc64a512f,	0x16fcfaaa,	0xcdde8bbc,
-0x1271ba73,	0x471ec9c3,	0x3e3c087f,	0xe69344af,
-0xf4810b4d,	0xa08afc1a,	0x170ed396,	0xe445eca8,
-0xc44a6c42,	0x98877999,	0xc66b286c,	0x56589be4,
-0x17150017,	0xe828efb8,	0x1fcba998,	0xcfa43243,
-0x03af5042,	0x965f0685,	0xd9a74dd5,	0xd6a7b24f,
-0x956e21b2,	0xe47d404a,	0x3f835460,	0xfb8b7f59,
-0x66b0e63c,	0xea9af33c,	0xfa7dbc2c,	0xf1b2a493,
-0x13ae6d5a,	0x630afed6,	0xa436c758,	0x87f8e0ba,
-0x09494e7a,	0x33c84f04,	0x0d422a6e,	0x410d3f9f,
-0xbb70026c,	0x2d98a96f,	0xe371c5e2,	0x0ee60c30,
-0xed54db46,	0x081050a1,	0x8b0738ae,	0x5b8b5a7d,
-0x3dc04f7f,	0x6d246b6c,	0x985f9f21,	0xdd0b2c2c,
-0x5f21e42f,	0xb5b6f539,	0x980cc53a,	0x1e8e2249,
-0x3546e403,	0xec013902,	0x560a843f,	0x2944ea5d,
-0x74c0c422,	0x3ce517c7,	0x4b58a57e,	0x266442bf,
-0x917ec876,	0x48feb4ce,	0xb8ac9d05,	0x838eb40e,
-0xeb71e51f,	0x07ac1e72,	0x8df85d9e,	0x9d9420e0,
-0x0a8caf4d,	0xb051f8bd,	0x20958e68,	0x65ca9d09,
-0xab69979d,	0x9eef4746,	0xebfd4c40,	0xa5910cce,
-0x94856ce5,	0xef0bd3fb,	0xdd37398e,	0xd6a0ae48,
-0x3616a256,	0x3b826be9,	0x0ae2d65e,	0x747de7aa,
-0x679cb2cf,	0x97b745bb,	0xa2c39fb9,	0xa370ba17,
-0x6a44fd63,	0xd6e6dbaf,	0xe2b88ee2,	0x81b2ccc4,
-0x3ed6f411,	0xb8c1f747,	0x1a26b61d,	0xb7bb5d8d,
-0x4961a071,	0xa5b94fa7,	0x9a5db498,	0x4884c393,
-0xc27ca65e,	0x5e6c85a0,	0x0284af73,	0x551de245,
-0xc4248aac,	0x81a40900,	0xb582bc63,	0xaf1d91b9,
-0x50d35db3,	0xdecf399c,	0x8e0138b6,	0x035ce3e9,
-0xd57de4e1,	0x2cfaa915,	0x6e6b430a,	0xa23746b3,
-0x9dd7a07a,	0x520d22a3,	0x57179e2b,	0xa61bb7c2,
-0x4dc42f94,	0x1ad54708,	0x60f177c7,	0xcd26283c,
-0x1f714776,	0x5cdb418b,	0x50ed5640,	0xe2f1338a,
-0x0766d64f,	0xdf3f47d5,	0x48b35f6c,	0xeeb5bfa2,
-0xdd0625e1,	0x1205cb01,	0x5459f09a,	0xdf37ef0b,
-0x33efd549,	0x48022dcc,	0xe3beeec4,	0x7bb7ef93,
-0x1aa865c1,	0x06298bfa,	0xe2df193c,	0xfbee059c,
-0x8014cf05,	0x6ac5eeba,	0x0b374d48,	0x5c100a93,
-0x37b094f9,	0xf7cac5b7,	0xd90e250c,	0xf344df92,
-0xcb48416c,	0x767dc2c3,	0x137c636f,	0xe70892a7,
-0x88bf9a5e,	0x33e3fa91,	0x1ba350bc,	0xd4c66de5,
-0xccd785be,	0xefdd83d0,	0x985708c6,	0xd86c3fe8,
-0xf48cfbcf,	0x822d6eee,	0xf1bdc5e2,	0x234b0ca7,
-0x34c2a8df,	0x859e10a4,	0xa4f36c33,	0xc7ca9d2f,
-0x7a33c391,	0xd6f873ad,	0x5db45802,	0x8703ecd9,
-0xa241618d,	0x6ef5f30d,	0x9cac4d72,	0x9ab8ff48,
-0x3b674718,	0x114649d6,	0x051a2751,	0x6e8c115b,
-0x4abfa95d,	0xec794b4f,	0xc0d29913,	0xd61a3edc,
-0x298298a3,	0xb8df31bc,	0x80d75b2d,	0xcb876b0a,
-0xd68d9ae5,	0x0350cb1e,	0x55999dcc,	0x9612ea6c,
-0x43e60e71,	0xdc765e82,	0xabea79af,	0x9eee03f3,
-0x9bf69324,	0xb925c5e9,	0xe24118d2,	0x1861379e,
-0x12e30e7d,	0xe6b416b5,	0xff3b80fa,	0xff42a94a,
-0x50e10205,	0x54994cea,	0xf3eaf211,	0xe2fbf32f,
-0x84b7ff4f,	0x916a7521,	0xa455a313,	0xe6d92df1,
-0xc91d41bf,	0x114dfc74,	0x1d6999b2,	0x5c26f97a,
-0xbab725e8,	0xb32a2d3c,	0x0307a40c,	0xe4271093,
-0x92045936,	0x8ca2b515,	0x18d794ef,	0x47939914,
-0xbf51a197,	0x91a22541,	0x1f68b311,	0xedb8eede,
-0x37176b99,	0x14faedf3,	0x0d94ba34,	0x9417b5e7,
-0x6f35a1f5,	0x40ebf845,	0xc573cc1c,	0xe918784d,
-0x7e309151,	0x028f245b,	0xea57316a,	0x83e9fe65,
-0x430ec7b7,	0x8edffd5d,	0x1b9285d6,	0x775483f5,
-0xbf25de79,	0xea3e5597,	0x125e03f4,	0x1b35c0d0,
-0x099c498f,	0x3f195b7c,	0xd4158c2e,	0x8afe62a7,
-0x5d6885ac,	0x662e5f6f,	0x4095b7f3,	0xd6138da2,
-0xd8039283,	0x29cca378,	0x6aeb8217,	0xe65c2353,
-0x1a4f395e,	0xff2f8da8,	0x9884a2e5,	0xc8653607,
-0x98f1cd10,	0x15a3f16c,	0xa5b504bb,	0xa69244d2,
-0x30b515ff,	0x48c5fc15,	0xc79ca57f,	0xdccfb9fe,
-0x67f9f819,	0x4a861cfe,	0x21e26124,	0x87078ac5,
-0x174faa76,	0x821e9163,	0xacf019b6,	0x82507748,
-0x32cc7372,	0xc8df14e4,	0xb4464e14,	0x09f3827d,
-0x82cd1cd5,	0xa976a2f1,	0x64d8af28,	0x6bf7253e,
-0xc7d83b28,	0x912f3d4a,	0x663f78c6,	0xdf414623,
-0x5662a151,	0x94150dfd,	0x933823e0,	0xcfd57e46,
-0x479efd9d,	0x7ab83b7b,	0x0211fd1b,	0x7fff5a38,
-0xa6dd0fdf,	0x7f748fad,	0x882790ad,	0xd5a31c76,
-0x40365964,	0xf9216396,	0x79fae1d5,	0x06f09d29,
-0xc5d09113,	0x4731531e,	0x1e021de4,	0x35f3e2ae,
-0x04417c8b,	0xd02a61a9,	0xb59eafd1,	0xcf596b80,
-0xba8bb39d,	0xde20fd7d,	0xd5ca803a,	0x23e4afb4,
-0xd7e150b3,	0x061a3f5e,	0x5ee4a633,	0x86f0e4cc,
-0x9c4c275f,	0xbf9fff79,	0xe7ecb719,	0x50b8e55f,
-0x7f1a0d9e,	0x5c5ae773,	0x34c1dd58,	0x39f756d0,
-0x8a9cad37,	0x62f861b7,	0xe7ecf601,	0x9d802c76,
-0x160e4b3a,	0x4c1d8c5f,	0xb632d845,	0x04db2756,
-0xe1019198,	0x355ae148,	0x4e4921c0,	0x9868bada,
-0x28a7bf1f,	0x8a26b181,	0x83aaf7b5,	0x07491ab3,
-0xc00d9549,	0x5d6dfa4a,	0x8208a16b,	0x82e39247,
-0xb0aca7b6,	0xacbd026a,	0xaac580f1,	0x0d6d3554,
-0x8438be16,	0x47a774b5,	0x766ebffe,	0x5a4b46ea,
-0xc3d7eaf7,	0x160b7149,	0xc3af7c90,	0x46fe9142,
-0xb77b1c46,	0xdbe37777,	0xdaa9cc0b,	0x9389a49a,
-0x99301a7a,	0x6a26bffc,	0xb4277408,	0x0650b2d9,
-0x6eb0c00f,	0x9052ab67,	0xf5120b06,	0x28573a30,
-0xf406f285,	0x89e5c29e,	0xe5cff0f6,	0x250cc621,
-0x70d8a5cb,	0x8416bf7c,	0x83106b12,	0xeb3b526d,
-0xf432a698,	0x36867ad0,	0x10de104a,	0xa07f3e5f,
-0x3e7d3d8d,	0x86b8a759,	0xf0702b67,	0x470ab94e,
-0x580bfb22,	0xc374c7b1,	0x75246adf,	0x5bd51f02,
-0xc5d95b18,	0x743fb51c,	0x6aab07b3,	0xceffc70c,
-0xddbe97de,	0xf6f99884,	0x0e0729e9,	0xd286ec31,
-0xb0febd7c,	0x4ecfe0a5,	0x9a37d2bc,	0x1cf834dc,
-0x37c33c53,	0xe7d2e3dd,	0xbfbd9d85,	0x626988c7,
-0xa1213c3c,	0xdc0fb69d,	0xc2e9dd0d,	0x33f31739,
-0x3deee07e,	0x87efb388,	0xa93b1d91,	0x9e50f839,
-0x0dc63833,	0x783a7872,	0x8c741d4c,	0xa818de9a,
-0x3d205673,	0x475cca13,	0x7fbbdb05,	0x7ecb965b,
-0x7f950d80,	0x71a25912,	0x5004a2f1,	0x4179231e,
-0xdf36eab1,	0xe4807629,	0xa0d07548,	0xa3e0b8d0,
-0x5fcc1ccc,	0xb81b4545,	0x23ab93a9,	0x4564a9ca,
-0x0f1dd8ac,	0xdc45fe55,	0x0d2e65b3,	0x955d6e7a,
-0xe84cbe9f,	0x9e964088,	0x304bd3e1,	0x1cc3cfc5,
-0xc55c632c,	0x5f8ef3e1,	0xd4203369,	0xca958ebc,
-0xc93614bb,	0x66cb0764,	0x94214462,	0xa48d8cdb,
-0xba5f4132,	0xe07cf8ec,	0xd850eeb4,	0x6baf5fe1,
-0x7e5d604e,	0x6efc24c5,	0x6e6b53c7,	0xa2420aa1,
-0xb2a8c5de,	0xc15dbdd6,	0x926f24e1,	0x525998cc,
-0x86aa4552,	0xb5e59180,	0x841d5940,	0x491b8755,
-0x31f77349,	0x29549877,	0x93bc87cb,	0xbd2f199a,
-0xe0f4abfb,	0xe6b44ee8,	0xc5ddf892,	0xf59971e6,
-0xa689f786,	0xb7002970,	0xdda6966e,	0x5cdca2bc,
-0x9423a700,	0x4abca2f8,	0x8c013997,	0x7123371f,
-0x5b91ab55,	0xc8f4c72a,	0x9ffb4cd6,	0x89cbe6f3,
-0xa7dc084e,	0x983ab14d,	0x02d32d43,	0xa85d985b,
-0xc20a229b,	0x11c58a2c,	0x369f3ee8,	0xff9ecce5,
-0xff36c522,	0xc579cff7,	0x96711403,	0x5af1b9de,
-0x5b673779,	0x41171d9a,	0x9e47fb55,	0x97e0d27a,
-0x5e7914e3,	0x7bec8474,	0xa8cbc15b,	0x1c851225,
-0xf35c299f,	0xcb34a523,	0x2bb0055c,	0x8250f873,
-0xe1a3814f,	0x6fc60d80,	0x65500773,	0xeb32580f,
-0x5c14dde0,	0x79bdd179,	0xe0865f38,	0x1c3742f4,
-0x0666429e,	0xb107467d,	0x8d518cbc,	0x1f87d3ce,
-0x375d54ba,	0x8b70ecbd,	0x781b798c,	0x27aafa61,
-0xd27f5647,	0xf6334c28,	0x10e1006b,	0x60ae630c,
-0xbfaba98c,	0x256c506c,	0x7f0fae28,	0x39a1f225,
-0x550b4b2f,	0x04450602,	0xb8271ea6,	0x2f6c4168,
-0x90349e62,	0xa968e792,	0xdb9bf413,	0x0f891508,
-0x8ee3e00b,	0x50d18fdf,	0x97678d3e,	0xf81b9cd4,
-0xdf6e787f,	0x06d2a920,	0x77bb6190,	0x813ebbc2,
-0xe4183218,	0x4763265c,	0xdb1524ff,	0xdba8109f,
-0x03a1a01e,	0xd76c06c7,	0xc36bafc4,	0x4a8d8ab6,
-0x74f49113,	0xdc62d212,	0x92e6fd15,	0xb0946ff4,
-0x9267d824,	0x6fb2bcbb,	0xe15924ee,	0xecb075a4,
-0x43107e19,	0x2ad5ded7,	0xc274cb96,	0xa3950d41,
-0x3a6a4a22,	0x6aabb6a3,	0xae799be7,	0xa7745a87,
-0xbb35408b,	0xa5745578,	0xbe6c4ecf,	0x1be0ddcc,
-0x625ebb5a,	0x889927a4,	0x2bc46ea9,	0x90bd15a8,
-0x1f9eb4fc,	0xcfa6f6a0,	0x2ec1f672,	0x00ea93af,
-0x369a0159,	0x359c8317,	0xae3d5e1a,	0xf3ca8b63,
-0x36b0094b,	0x5a1b9ed0,	0x8b572549,	0x9bc8d7c6,
-0x1fa667b7,	0x90694630,	0x9ece90a2,	0xe2dbef5e,
-0xba9c5f09,	0x05398d19,	0x8bc517ea,	0x33228fa7,
-0xfb926fea,	0xff843ae3,	0x6a186bb0,	0xde7afe08,
-0x0221660b,	0x6fee7be9,	0x675ba672,	0x78ef21f2,
-0x0482a952,	0x813df7d4,	0x4fa7c108,	0x5e54168c,
-0x4f97dd3c,	0x9c0b7d0b,	0xda04a908,	0xe85a4393,
-0x7359f445,	0x402b6bbc,	0xd853f0d6,	0xcfb91e74,
-0xc6fcfb94,	0xdc4e476a,	0xbbabebf9,	0x62ec1404,
-0x26254939,	0x75ce5938,	0x7b667825,	0x87b0aeaf,
-0x21894081,	0x462db33b,	0x3ea8db39,	0x42870f70,
-0x401237f3,	0xbdaee906,	0x25cd3525,	0x2c4d94e1,
-0xf170325c,	0x90d64888,	0x51d3566c,	0x51e7e4b2,
-0x23dd58d6,	0x59fca5b4,	0xedcd4758,	0x7dae77db,
-0x9a717550,	0x701e2a13,	0x67c5f008,	0xd8e340bb,
-0xbedd8f25,	0x8be12630,	0x7864cc2e,	0x840fae86,
-0x38edad09,	0x73ab1799,	0xc93b52fd,	0xdd2f6ccf,
-0x4c93c974,	0x1ac6d3d5,	0x03c42a8d,	0x511abc1d,
-0x5a1fea3c,	0x4a64bd7a,	0x61f142f9,	0x6ab9f75e,
-0xe5bde580,	0x569e6c54,	0xeeedac7d,	0x7b52ef6a,
-0x8d27e251,	0xebc6ac95,	0x76258ae4,	0x8f0c5893,
-0xa8eface8,	0x7f40945a,	0x2f66d6ee,	0x81679109,
-0x1be8dd40,	0xbc24dd34,	0xa5119200,	0xd9ab7621,
-0xdcb3dade,	0xa9471d19,	0x4b68b544,	0xf696af65,
-0xeea60322,	0x1232eafe,	0x1249e8fd,	0x8f3a1f01,
-0x25579529,	0x0d785d6f,	0x15564167,	0x9c5e03f4,
-0xdf9fbfe4,	0x1e5487be,	0x688b944f,	0x8ce19bcb,
-0xaf35dc5b,	0x10b64b81,	0x68ab2f39,	0x60dbaec1,
-0xeac41162,	0x1ebaa56f,	0xbb69933d,	0x3326e091,
-0x074746b4,	0x73661a93,	0xf9ec6abe,	0xcc848bef,
-0x9a77158e,	0x9a3bd329,	0xa1a62cdf,	0x475a1801,
-0xb33a91fd,	0x77ed9632,	0xbd39bb9c,	0x2ddfafac,
-0xda5465e8,	0xb59c9d9b,	0xe52e287f,	0x3b6faeaa,
-0x5a527d34,	0x58c776dc,	0xb6d24203,	0x8e917c76,
-0x55dd9ce7,	0xa8d1b4e0,	0x5c86a5ed,	0x01d0905e,
-0xd294b1a7,	0x5f3a2b77,	0x41bd36de,	0x1ed8e337,
-0x318c7641,	0xc70bac54,	0x2069d024,	0xa1d95b6d,
-0x3355c816,	0x31492af8,	0xa431c8a7,	0xdb2e1784,
-0x25439c76,	0x6b35c542,	0x38d7ac8f,	0x34a0077b,
-0xb56518aa,	0xc192f3ce,	0xecd37e8e,	0x235978ac,
-0x060d1426,	0xe0122b3f,	0x0529a1e6,	0xabce9fac,
-0xf9fe9079,	0x50ca70fc,	0x10bd9da2,	0xb11069f0,
-0xa270dc6e,	0x4a855044,	0x282c8e4a,	0xa1cbebfc,
-0x9c366915,	0xe69c5621,	0x4117ad9d,	0x92000f68,
-0x62d06d71,	0xd57e92d6,	0x27658db3,	0xffc1d7f2,
-0x2e758447,	0xcd3ccc8f,	0x351bf00d,	0x9c6946c2,
-0x0a69924c,	0x426cc7b4,	0x0e6a41e3,	0xb10e9ab6,
-0xc81eaee4,	0x822cad1e,	0x9ad6099b,	0x91deef2e,
-0x23e3dccb,	0xadd9191f,	0x0b239f95,	0x59ca7f29,
-/*  2626-m1010677705.inc  */
-0x00000001,	0x00000705,	0x04282008,	0x00010677,
-0xa6db99dd,	0x00000001,	0x00000010,	0x00001fd0,
-0x00002000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000705,
-0x00000037,	0x2e000000,	0x20080428,	0x00000311,
-0x00000001,	0x00010677,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x2465f77f,	0x29566fcb,	0x8b1efedb,	0x7e3c309b,
-0x04acb445,	0xaf8ec2b8,	0xff49b4de,	0x7bfa19c4,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x01322c69,	0xec40eef0,	0x26d2b395,
-0xf847320d,	0x67cadb2d,	0x59b4b1f6,	0x9db9b1ad,
-0x9768f4f3,	0x25bc8e45,	0x94aa7457,	0x0f4ccab5,
-0x6d3fae4e,	0x3d84bd47,	0xa239c777,	0x020dc4a7,
-0xe452a8d8,	0x93877636,	0xd73fbc5f,	0xdfb022de,
-0x57225cd9,	0x7f44abb0,	0x6d2c1ad2,	0x27a1277d,
-0xf5a06c32,	0xd20e7585,	0xdf96854d,	0xca36255c,
-0x7e4e54f6,	0x45969264,	0x674f09f8,	0x0d3d80de,
-0xc651ffc0,	0x630fd091,	0xde1b80b3,	0xb2d65941,
-0x0316ed1b,	0x046c73b5,	0x2e509d5f,	0x03a5fddf,
-0xe9ee87a1,	0xaf03d755,	0xa567aefd,	0xc5138599,
-0x36bec572,	0x7d8e28ff,	0x52bb013a,	0x396a6ed5,
-0x61ce6789,	0xbe8a1d4b,	0x986cbacc,	0xcf627b91,
-0xa7fa17fb,	0xc91c5325,	0xccd6384b,	0x4b1e857f,
-0xd1f7def9,	0x47594c88,	0x2a48e8b5,	0x0f3b1568,
-0x1ad57438,	0xcd5c1a85,	0xb3f9c463,	0x70ac9f16,
-0x39691227,	0xb4a6c7b9,	0x8196ec8c,	0x4c7c2906,
-0x2480cd88,	0x00b7a245,	0xb6caef0a,	0x4424e38d,
-0x59dfc329,	0x2161a44e,	0xdf66dab6,	0x19e6388e,
-0xcf95df31,	0xe8da3ae6,	0xd26e8296,	0xd057b888,
-0x7f726055,	0x3ef45cec,	0x047fff63,	0x312b17d3,
-0x9f802a7c,	0x2b703a1a,	0x761f42c8,	0x0c236bd0,
-0x8681c353,	0x997bf86a,	0xf2ffc240,	0x9b7020e4,
-0xf4c45ef6,	0xc0df789a,	0xb111ebde,	0x0ccee80e,
-0xa56b4c45,	0x7155193c,	0xcc82d657,	0xa630484c,
-0x7f06b736,	0xf74fd515,	0xc0a87b1e,	0x1553e4b4,
-0xcabad873,	0xd29c7d3f,	0xa08928d8,	0x75f9a195,
-0xb904cb46,	0x44429cc9,	0xf88612f5,	0x14587413,
-0x88d57872,	0xecf707c6,	0xe28d18b2,	0x5270c776,
-0x9c1e144c,	0xc9649bbc,	0x9ff69bb9,	0x20b49543,
-0xc43c0a9c,	0x2a1e3030,	0x8ae5113f,	0x06cb0653,
-0xa9629173,	0xd582fdf3,	0xc88b7c00,	0x96060dcc,
-0x6632ef6b,	0x76f26ff9,	0xac076055,	0xa8b50beb,
-0xf8cffffd,	0x745e1003,	0xae8036ee,	0xef7a05c4,
-0x5a376dd1,	0xda640a45,	0x9e09e92d,	0x686931f1,
-0x39cdc780,	0x7e3e2020,	0x56701e4a,	0xf8678562,
-0xd4156342,	0xbc06f43c,	0x4e1f1a67,	0x5466ebb4,
-0x503bd187,	0x0b6e259e,	0x74dcaca7,	0x35819bd4,
-0x117e597b,	0x3ac65452,	0xcc0730bb,	0xc6f5d655,
-0x7d2a15d5,	0x3867c7da,	0xc8b083e6,	0x16224fdb,
-0x47fa9de5,	0x00fde300,	0x4e01645a,	0x5dc9ff99,
-0x86e3b1a6,	0x1a3bc3e1,	0xf70f532f,	0x4de7d113,
-0x5a0d2d6b,	0x9afe6d2d,	0xdb3f4265,	0x505bcec7,
-0xa53ab0e7,	0x1507db85,	0x3d0d32bf,	0xc0ceed74,
-0x4db126e9,	0xb4f2e270,	0x68930871,	0x05d3b3d3,
-0x66ccdb4c,	0xb57fb38a,	0x008233a3,	0x3fd5c019,
-0x9a179689,	0x42c05ac7,	0xb87889af,	0x2913bb83,
-0x477cdd20,	0x0d83544c,	0xaf0263c1,	0xb48935a5,
-0x234208b2,	0x5b4a0f3e,	0x8f8cc13d,	0x9607f2de,
-0x0c9cee16,	0x21d899c4,	0x09916e4b,	0xf306ddf1,
-0x0c6b8280,	0xd181c117,	0x448c6ff8,	0xb72208b8,
-0x0de93462,	0x377f99c6,	0x2221b8c7,	0x3c6ffb65,
-0x3c6c2519,	0xa6d07e90,	0x7f94d907,	0x30479885,
-0x21a8a9b8,	0x571a4b6a,	0x5f0797c9,	0x2dc87140,
-0x71e4112c,	0xa8de9117,	0xe28b1e94,	0xfa674e2c,
-0x02058bfa,	0xb7e95418,	0x3fd8210a,	0xd723d74c,
-0x4239b510,	0xcfcc1628,	0xfd293123,	0x7e336796,
-0xf17fa73a,	0x98345638,	0x388df464,	0xab7c90c7,
-0xe2ee9b4c,	0xe5613767,	0x30d4426c,	0xb48aca9a,
-0xffb90a1e,	0xa1661c42,	0x5abc5c98,	0x1abf514a,
-0xaeff9c98,	0xa818b964,	0x536cc51e,	0xf6acce64,
-0xe647d960,	0x7100da97,	0x341e8028,	0xa30bf79a,
-0xeb1a84b1,	0xb134f78e,	0xfd95978a,	0xe27d0550,
-0x1c84a059,	0xd0014ddc,	0xe74bf809,	0xa022e7ec,
-0x64eab1fd,	0xff663e65,	0x0de0838f,	0x108d2e48,
-0x9466817b,	0x3ed53d00,	0x8a4c5e3e,	0xab20c038,
-0x7656a7b9,	0xa7dc8e0e,	0x045d34f2,	0xf845748b,
-0x76d4778a,	0x28ffba14,	0xcadc3664,	0xc0285e31,
-0xa6cb86a1,	0x5844494f,	0xbde9d164,	0x7d4dee77,
-0xebf0b41c,	0x820faa44,	0xe26d0f5f,	0xa1b179a9,
-0xcbfdf2ec,	0x6d161586,	0x1cefd06b,	0x7fefb5fe,
-0x6d09d3f0,	0x99814fac,	0x17246f44,	0xa7399914,
-0x5d56f5a8,	0x37f57549,	0x054d5499,	0xc1c6493c,
-0x3b82f5b4,	0xb7aeeec8,	0x77b54215,	0xdf885a04,
-0xc75877c2,	0xa5c69e72,	0x6e2488cc,	0xc20194d4,
-0x124e6076,	0x07a413c5,	0x984a98bc,	0xcfe981af,
-0xadc2db3f,	0x580d7229,	0x8901dfa9,	0x085c0c44,
-0x9ce13381,	0xf21e780b,	0x72c0f22c,	0x4e181c4b,
-0xc9cab0c8,	0x719bdec1,	0xe2ba4736,	0xf66ae16b,
-0x9e255710,	0xbad58642,	0xd1db2722,	0xb77c5c28,
-0x3ec638c2,	0x84bf6d4e,	0x8d3a5255,	0xde373b6a,
-0xbaf80fd5,	0x8953d507,	0xc841de16,	0xea26e027,
-0x173cf827,	0xaaebdb63,	0x0d7ebc10,	0xa72dc50e,
-0x5006d59e,	0xe6fe0177,	0x498be8f1,	0xae15c231,
-0xa3701dd7,	0x7a7f91fc,	0x4833aa91,	0xd79e9593,
-0x77837ff2,	0x7eb31fc6,	0x7910b466,	0x142effc8,
-0xabb9a498,	0x4d85e178,	0x55714305,	0x60855af9,
-0xc1b1061f,	0x6feae06a,	0x33e0ab49,	0x8be46d25,
-0x89230425,	0x81b5c821,	0x18231b42,	0xc17cc189,
-0x6ae95bdd,	0x6f58e000,	0xe5990aa4,	0x86185e44,
-0x84ad9646,	0xe49cd98f,	0x2919c95a,	0xfc9aead4,
-0xea6c7985,	0x1d62c3d8,	0xf4d829f2,	0x805ba72e,
-0x1400c3bd,	0xab6663f8,	0xeaf75f2d,	0x79d49590,
-0x85c88dc7,	0xa9deba56,	0xc5eede1c,	0x91dd6229,
-0xdfdde150,	0x61153322,	0x402dd8d3,	0x77505945,
-0x723678b8,	0x5de1f01c,	0x815d5fa0,	0xe2102c9d,
-0xf047b06f,	0xae404730,	0xb14ba807,	0x3dbc31c2,
-0x2998e426,	0x497e04d9,	0x914afe55,	0xd14b4653,
-0x0301cf11,	0x9ba705e9,	0x957fb189,	0x57b9be97,
-0xa33b1429,	0x02e12332,	0x8cb58a43,	0x9c246884,
-0xc07dd0bc,	0x42356d52,	0x2b51b5f0,	0x4d4805be,
-0x0f815bf2,	0xdd7902da,	0x4f56f997,	0xfac6ef48,
-0xdac3367e,	0xe5850b3f,	0x5d9c554b,	0x1b2f6756,
-0x61842357,	0xfd336fe8,	0xa58ad4d6,	0x88f7bddb,
-0x9ec7f8a2,	0x50bc3268,	0x942b0aba,	0xfb66a91c,
-0xe3a73708,	0xe69e62fc,	0x69596c62,	0xf4be8c82,
-0x621ca80c,	0x7a333295,	0x46254b04,	0x2f1555b2,
-0xaabba398,	0x0c1108e7,	0x36a205ef,	0x9a4db339,
-0x43a6840e,	0x10a209c6,	0xfb67b1c2,	0x4de09447,
-0x9cb8be5d,	0xa188a137,	0xe9f2ad46,	0x2b1cab4d,
-0x6220f654,	0xa4ac7969,	0xe339a780,	0x76a9ae54,
-0xa8b7951f,	0x5748eb73,	0x3b46f69c,	0xc895b0b4,
-0x358501a9,	0x99e8d1f2,	0x86bb9dbf,	0x02852e8e,
-0x73d4d32e,	0xe6536877,	0xc2b8e7d7,	0x2088bc41,
-0x5b9406e8,	0xdd47135f,	0xb217f649,	0x4dbc6f9f,
-0xddf107c7,	0x97afdeda,	0x28623a0f,	0x343158a2,
-0xc9c68f39,	0xaebd29be,	0x4ff115ff,	0xe4091f35,
-0x669f615d,	0xfb6ced81,	0x93b7a705,	0x9e4433c1,
-0xc5236c31,	0x686100a9,	0x6146d370,	0xbaba0da5,
-0x87da0ffa,	0xae30f311,	0xfb3b87f4,	0x98488326,
-0x7ebb06f2,	0x1c347bb6,	0x42671c9e,	0x999f0ad6,
-0x0f7e2bc7,	0x2bbd7ab9,	0x8a831574,	0x9d730046,
-0x118c8a3f,	0xc9e06b0e,	0xa62cf9a8,	0x9c448779,
-0x04a03675,	0x3e400fed,	0xb2f2fa96,	0x2c359ef5,
-0x8064b88a,	0xa0f57dac,	0xb69023c8,	0x75546772,
-0x5f1054f7,	0x00298870,	0x99f91288,	0xc0868491,
-0x31803de8,	0xaf510062,	0x4117fe12,	0x5dbce9be,
-0x5e4051ed,	0xb1c91832,	0xea3e2894,	0x4b97dde0,
-0xf4ff8774,	0x987bc043,	0x46a2a625,	0xd4041870,
-0x78acfb0f,	0x15604cc3,	0x5e1aad14,	0x712d445d,
-0x209bba33,	0xf6069eff,	0x749f8423,	0x112d4830,
-0x9c0e6674,	0x913f83ba,	0xd2014e4f,	0x0f23e981,
-0xa930f6da,	0x0cef6e1a,	0xb872b6ff,	0x4f69948d,
-0x75e837bd,	0xbb24bea1,	0xb651b4fc,	0x10016b79,
-0x2e60e398,	0x5b15f8f7,	0x7af24a35,	0xeb5dd61d,
-0xdc15082a,	0xb0371fe1,	0x6585dbc1,	0xf625d84c,
-0x97d410cb,	0x0a839640,	0x9b77d939,	0x2775e81f,
-0xc8dea7b2,	0xadb662ed,	0xb8150bc6,	0x54f54b55,
-0xe33cfb10,	0x65527001,	0xd581b314,	0xc2c44608,
-0x1b382606,	0x500a36d3,	0xd00a5d2a,	0x8234308e,
-0xdf8bca1f,	0xf14163df,	0x00fa7604,	0xe184defe,
-0x2199ca1d,	0x2bf47708,	0x98c18fbd,	0x72506146,
-0x45626a02,	0xb2dae16c,	0x958bdaad,	0x171f8643,
-0x036ed338,	0x559f59e9,	0x7be8f130,	0x540df4c2,
-0xe30f6819,	0x788f6bae,	0xf6352699,	0x91700d3a,
-0x920c5eb1,	0x87725829,	0x085c56aa,	0xeaec2fcc,
-0xf08594bd,	0x27ef4925,	0x41661c89,	0x3389ef83,
-0x7da12071,	0x69112014,	0x9d29768a,	0x12ce3aed,
-0x18db18d0,	0x501d13d8,	0x56cdebca,	0x8e8b683e,
-0x4fcba747,	0xe7e1805b,	0x6addae9a,	0x540a90de,
-0x47f2ee6c,	0xab3fabc6,	0xcb4f23f4,	0xd84e65ff,
-0xbebfccc3,	0x1354b1cd,	0xd56ef86c,	0x4b6125f7,
-0x8b5789c3,	0x4e97a781,	0xaa024674,	0x724cc993,
-0x51cdf63e,	0xa9868189,	0xd27de1e5,	0xe1deebeb,
-0x14a819d6,	0x7eac8bd4,	0x3f662ce9,	0x4c6ecca7,
-0xff8e8bd9,	0x92f9399a,	0x9564f658,	0xccd7334b,
-0x25ca62eb,	0x0d031f55,	0x391642f5,	0x4e593b4d,
-0xfb988d6c,	0x1fe69f2c,	0x5b68b5d9,	0x839d5670,
-0x872879f6,	0x5eaa8c8d,	0x8917a87f,	0x0bf61613,
-0x34b5a8e2,	0x57d4fae3,	0xeac815d9,	0xf5eb0d2f,
-0x59cd2cc5,	0xbaf5245b,	0x8c685639,	0x836c82e5,
-0xd467b96f,	0x62e057cc,	0xcfe1839d,	0xa3b4a985,
-0x1dbb0683,	0x8ef38d53,	0x34797901,	0x6ce5e28c,
-0x54c1f3b8,	0x9061fdb0,	0x8309801c,	0x16af80bf,
-0x6385a38c,	0x80f7f501,	0x454fd913,	0xc2c63349,
-0x4275913f,	0xda274f1f,	0xd0eb541e,	0x6702d849,
-0x52aaa032,	0x9ae95292,	0x6aab14aa,	0x26327c9f,
-0xd18fabec,	0x2dcc9edb,	0xa17fd708,	0x7d74d975,
-0x68f39951,	0x50c3cb45,	0x051c7f5d,	0xc2da8476,
-0xb0289147,	0xa9908724,	0x06761e86,	0xa51a75d4,
-0xfc693786,	0x008e9d6d,	0xa1cdf3d3,	0xa1c77e5a,
-0x9f223352,	0x74e648e7,	0x3082f1d0,	0x6a89017b,
-0x5dd2afc4,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-0x4e24165f,	0xa7c66809,	0x2e60bdcf,	0xaad70a08,
-0xa73ea713,	0xe28f97a7,	0x283a9eab,	0xd4366489,
-0xe776f963,	0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,
-0x3bae5f6d,	0x8d2bbef1,	0x7e9181e6,	0xf06aa121,
-0xd06b2d20,	0xa83ea826,	0xef935e4f,	0xdfd27456,
-0xa3451468,	0xc6820a63,	0x43463105,	0x787697aa,
-0xcba5543d,	0xdf7e1e2d,	0x6998a8af,	0x98ce6c08,
-0x89de731a,	0x943a3510,	0xb36ead85,	0xd5258d4b,
-0x1cd6df61,	0x82a5c59d,	0xd078e7a4,	0xa33d4317,
-0x24dc45f8,	0x3f3daf27,	0x0478bc6f,	0x92dfa16c,
-0x952a872e,	0x7a34e03f,	0x0f088084,	0xa40937fe,
-0x38fc7749,	0xa157e8a4,	0xbce94344,	0x7045ff7b,
-0xf3e1ab66,	0xe62a6058,	0x5564ff10,	0x38198f1e,
-0xf326f0f1,	0xe262bc0c,	0x2f0b851a,	0xc7bcbe11,
-0xe79f1d1a,	0xc2f93c29,	0x54f3ea9f,	0x8f8f9141,
-0x9f45e13c,	0x7a5b86bd,	0xa764efd8,	0x35f04729,
-0xdd8c4b54,	0x5fa12e51,	0xa5824af9,	0xad328f71,
-0x0f11fbb9,	0x9048e950,	0x04d7a900,	0x02538d1f,
-0x99f745b7,	0xe31f63bb,	0x2c4e3d78,	0x7cdb9245,
-0xa3966ee7,	0x27c4433a,	0xe1d79f3e,	0xe640fa06,
-0x79ce31eb,	0xf25634fa,	0xdd9ce5cb,	0xb7fab8d2,
-0x2f1f0ff2,	0x2acb625c,	0xa0494989,	0x206d7f11,
-0xf268b8ca,	0x292bbf9f,	0x763bd7d0,	0xea4b14fc,
-0x9d3d6aeb,	0x64cca57e,	0x6fc3e29e,	0x3e7bf4bf,
-0x90efc7e3,	0x08e39173,	0xd05bee2c,	0x5b3c8f37,
-0x0921ec6f,	0x3371b715,	0xb324e114,	0xe3abc53f,
-0x576b18f8,	0xc4469024,	0xb2ded6c6,	0xe7783782,
-0xc0a1fd5d,	0xcf324bde,	0x97527c8e,	0x19f8f48c,
-0x3e806a5d,	0x96cff225,	0xe3b9d04a,	0x0e5856ae,
-0x781372f6,	0x9645f2b7,	0x95a743ed,	0xd0c7eded,
-0x86ca3cd9,	0xbab94db0,	0x43a1233a,	0x89c55554,
-0xee776239,	0x34aa0098,	0x66a6e1d4,	0xae0e233e,
-0x717e7b29,	0xb403a4c1,	0x36eb96c5,	0x42140832,
-0x04250936,	0xda375dca,	0x524cb2e6,	0x86deaa0c,
-0x400dc9d1,	0x12c00364,	0xe3ca7cf5,	0x87f20da7,
-0xf57df9ef,	0x580dbdfc,	0x0b3e0369,	0x014d27fd,
-0x4afaf6a1,	0xd1f4ca09,	0x77abc831,	0x30e49729,
-0xec61cd2c,	0x159c1e92,	0xb61b40b1,	0x17c66fd6,
-0xde11c061,	0x79d7f792,	0xc709cbfa,	0x94201c89,
-0xbe65137d,	0x18aea1b4,	0xf248bbc3,	0x465f957d,
-0xcf4a9672,	0xbf293fd2,	0x2c5e31c9,	0xc2c73011,
-0xfb29cbf2,	0x576f7f0b,	0x74de1745,	0xa76e172b,
-0x99b96223,	0x14ce1502,	0x231013fb,	0x1d4df40a,
-0x951b0c16,	0xab173e66,	0x4ff65f74,	0xc4a87a47,
-0x09cc3370,	0x66385490,	0x73e09118,	0x4ee96432,
-0x0164d347,	0x205069b5,	0x158dd226,	0xc932c238,
-0xe9048fa2,	0x100b626a,	0x86ee08cd,	0xed87cb1c,
-0x6353ec37,	0xa36edcc3,	0x8a16dd6b,	0xd28a4198,
-0xebea1127,	0xca0b761a,	0x61c31acf,	0xced5ff4f,
-0xbf4dbd8f,	0xd969d8a7,	0xb6e4e9e8,	0x8421c402,
-0x809d7222,	0xabfd1d2f,	0xc1857ce5,	0x23958fd7,
-0x3226f1d3,	0xd822b4cc,	0x2f1cc3aa,	0x501fe01e,
-0xe36f8c94,	0x7ad27716,	0x3321308b,	0xa85b957b,
-0x38cfdf6e,	0xc7497dd5,	0x2462090c,	0x8f9e42e7,
-0xdf97684a,	0xac8af621,	0xd5224866,	0xc5f64e50,
-0x9724f297,	0xc386097b,	0x48c6f98a,	0xe1478b1a,
-0x2dd23fd8,	0x716b2d85,	0xa5c3789b,	0x53625e80,
-0x9b8b312c,	0xce482165,	0x66161e35,	0x64ecb56a,
-0x9981c46a,	0xe6cb6bb3,	0xe1983186,	0x75ed470f,
-0x4adcbd27,	0x3efeda68,	0x4d193a2a,	0xbfdb3cd4,
-0x7c6167b6,	0xdbddea68,	0x4b0d2d62,	0x00ba3860,
-0x49ec2544,	0xa68698c9,	0x2ce7be1b,	0xf5afc9fc,
-0x1cebf9c3,	0x350f8f5b,	0x893eefb8,	0x77414f6f,
-0xe46f26fa,	0x67bf6398,	0xd6858f5d,	0xac73db2a,
-0x58e20acc,	0x750dd76a,	0xb7930e80,	0x8a8796c0,
-0x44c86997,	0xb1807742,	0x3c827dc1,	0x381aaa3c,
-0x83ac76f3,	0x57f0a2d6,	0x18261009,	0xe107138f,
-0x85711c22,	0x2e1d982f,	0x7062179a,	0xaedfa298,
-0x62e438f2,	0x6d325a9a,	0x99b489d3,	0x1bf77b3a,
-0x28ca20e8,	0x502d1b21,	0x74a833c0,	0xbeb91634,
-0xf56ffef9,	0x05401164,	0xe5dbab51,	0x0a2b460d,
-0x2f0d9c22,	0xc74472f9,	0x12da5199,	0x68b2d628,
-0x9a118f9a,	0x9035d200,	0xcda0221f,	0x12430cde,
-0x79a43fbb,	0x5bb5e1b7,	0xeab5ed62,	0xe6a11e32,
-0x3118b0fa,	0xedbcfb64,	0xd2285490,	0x824023c6,
-0x30311fb1,	0xa0a4a475,	0xbfa8ac55,	0xb8c8fbda,
-0xdf3cab63,	0x8d805566,	0xf52c1b1a,	0xa3471090,
-0x02328a4a,	0x5d1dce57,	0x196aea39,	0xcd0f640b,
-0x2fa01c27,	0x6175f783,	0xb2b6a0e4,	0x02fe6171,
-0x2d3cb20b,	0x25f331e6,	0xacfa8085,	0x46a09a58,
-0x27bbfb9e,	0x3914f970,	0x73e35206,	0x8bb87194,
-0xdb58fc4b,	0x62fd53ff,	0x2c942c7c,	0x3f4681ba,
-0xeada1780,	0x5dfbb960,	0x8473948a,	0x80787902,
-0x049c20ba,	0x9e95a4fc,	0x8526d8ac,	0x3dcdcd2d,
-0xb9562f16,	0xc9c8eb08,	0x533ed0a2,	0xa34d5d73,
-0x3e579c8e,	0x235bb378,	0x36576983,	0xc71f11b2,
-0x035eae76,	0xbec23972,	0x8613e5e9,	0x3982899a,
-0xe5a55d62,	0x3c45a7e9,	0xbd4d6def,	0x17ae0a5f,
-0xf0f53bb8,	0xa3dd1e29,	0x36f9520b,	0x72cbd950,
-0x4d762d12,	0xe03cb7a8,	0xf8c8c1fe,	0xa4ff17a1,
-0xcc779472,	0x83f9b379,	0xa2fc038c,	0xdd3b8104,
-0x95936bb0,	0xf36c9705,	0x93939e08,	0xc98576ac,
-0xec9196d1,	0xc8bce622,	0xb48e1075,	0x98dbd77d,
-0xd1b04c3d,	0x85d1d422,	0x20765885,	0xc6a17eb5,
-0x8e913cdc,	0x3f7a6758,	0x08176f48,	0xba2ea15f,
-0x3638114d,	0xf08cb49b,	0xb8b6d9ce,	0x4e55891a,
-0x2775c022,	0xc8d45982,	0x529c2eb3,	0xde080e24,
-0xdac9c028,	0xeec68934,	0x8eaace11,	0xe82e05aa,
-0x00033a20,	0x4ec94b5e,	0x445f5562,	0xa5c58462,
-0xb6942526,	0x44631607,	0x5065644c,	0x14946f9c,
-0xa9cb0e63,	0x53dff50a,	0x3f18fa24,	0x20b3b811,
-0x95c1e57b,	0x1523d301,	0xc4e24932,	0x41a9be80,
-0x24fc45b0,	0xccff2cbc,	0x996af6a1,	0xe3f201c3,
-0x0917ea23,	0xbf4a1ac3,	0xbb0db6f1,	0xd15772df,
-0xb1465383,	0x61400275,	0x571f6b1d,	0x0a4407f7,
-0x916cfbce,	0x114f042a,	0x1cb9b3a6,	0x1b34c85a,
-0xe36acc8d,	0xab109469,	0x5af9a63a,	0xccd4defc,
-0xb758adfd,	0xbd8ddecf,	0x5ffe8424,	0xd73e2a4b,
-0xb41cb99e,	0x01a52553,	0xba70e749,	0xf81d7557,
-0x2b4f0847,	0xa22e281f,	0x5c653c31,	0x89bdb546,
-0xa596e592,	0xbca4cbf4,	0xc3d1dfe3,	0x64a21c2e,
-0x159aa4b7,	0xed90f2d6,	0xb1164cb0,	0x86de0088,
-0xfd4e49e6,	0x70702b0d,	0x946b532b,	0x03a0144e,
-0x71fb19ed,	0x07c41763,	0x63312ce9,	0x0e2f5ee4,
-0xc6501661,	0x09599e4e,	0x544fd5cc,	0x054d842c,
-0x902bb57d,	0xdf82a365,	0xb7ae9427,	0xa6750881,
-0xeee3c9cd,	0x6cbe0f45,	0x7f72d3f9,	0x430b786f,
-0x162b6004,	0xbfcd440b,	0xdc4f5c81,	0x82249f6b,
-0x98d1cdca,	0x2cc2692e,	0xf977f83a,	0x570c1e1f,
-0x24ed6461,	0xcae5afea,	0x9cf06576,	0x9199d69c,
-0x883febfe,	0x0f254c42,	0x6eb50978,	0xf91fade4,
-0x9cfe5488,	0xfe3bf66b,	0x86ea94e3,	0x1bed23f5,
-0x0bded397,	0x0cde064b,	0x7abd7a81,	0x8efb798e,
-0x9a78e5f2,	0x7c46d76f,	0xcb3ae1ea,	0xc33e7ab1,
-0x0c3993f0,	0x5b2d8de7,	0x24948ba8,	0xffce06e6,
-0x0d3c2dc2,	0x3ae09142,	0x7e6b932e,	0xb3e22558,
-0x9f7c425e,	0x8fa1329b,	0x24aa5012,	0xb9e49bc7,
-0x787dd5a6,	0xf68c8171,	0x440d2146,	0x9734857f,
-0x8c30c31a,	0xcb3352a1,	0x46b04f38,	0x72572ef8,
-0xc90c56df,	0xe8103fa8,	0x04057577,	0xd1c250d9,
-0x5cb390a9,	0xbdba74b9,	0x80012fa3,	0x408216c2,
-0xadca83bc,	0x3c39bcdf,	0xf0da9459,	0x421d5a3d,
-0xc5cf55c9,	0x2dcfa63d,	0xd852066b,	0x606b2204,
-0x4d5e9576,	0xe8d6475f,	0xe46ec6b0,	0xf4e3c2c6,
-0x1bfe1bb0,	0xc2803818,	0x2a3e4809,	0x947e50a1,
-0x3a10e713,	0xc9e070cc,	0xa4244fe4,	0xa7f5d2e7,
-0x194f77ee,	0x76754ab4,	0x75ed4e5f,	0x92ffdbaa,
-0x1f5bce6a,	0x14aeeec7,	0x366fbb47,	0x44ecec7b,
-0xbc31e911,	0xee6c224f,	0x0a6f7376,	0xbe79fce3,
-0x53a18077,	0x6f6ad5fe,	0x945938bd,	0x61bb760c,
-0xed26220f,	0x9f492f0a,	0xaf0f2d80,	0x265f5449,
-0xae1f2dc3,	0xd235910c,	0x44a0f4a0,	0x36fcc004,
-0x1e8fa223,	0xe7440ed0,	0xa8535548,	0x6d7e7029,
-0x2e1b7968,	0xf3baa61d,	0xf447ef12,	0x701d62d6,
-0x2da5dcf4,	0x44828196,	0x41af9c9a,	0xab210662,
-0xa5ee18f2,	0xd45eb369,	0x947814fe,	0xeb62eb49,
-0x30c555c6,	0xdc06ccbd,	0x786705d2,	0xd50c80d3,
-0x266d8313,	0x68f63164,	0x1e3e4322,	0xfc23834e,
-0xe879261f,	0x28992a8f,	0xab86dac9,	0x19f88d1a,
-0x5110c867,	0x3c050155,	0xf9b1b3f5,	0x98909489,
-0xfa0ee6bc,	0x038fb4ce,	0xbe1c9e33,	0x18f96bcd,
-0xa1635c9a,	0xff3e9374,	0x5b033171,	0x0b84bfd9,
-0x3c091bae,	0x6da61a4e,	0x07d81b5d,	0x3904ea3c,
-0x75f4e7f1,	0x3e70c12e,	0x9c70d835,	0x9a1ea5a6,
-0x4b99b705,	0x08f6ab89,	0x7649901c,	0xee3e7687,
-0xa3deb48c,	0xd74e8c78,	0xe8e120c3,	0x425d3d96,
-0x16f136bd,	0x0c7a32ef,	0x37a0ff53,	0x77b035e4,
-0xba8808c1,	0x1d3d8330,	0x8d224cce,	0xed789fed,
-0x550a8352,	0xe2715912,	0x185f62d1,	0xe301002a,
-0xbe2ed99b,	0xbb1dfd60,	0x9d22d8f9,	0xcbfa36d5,
-0xad7e92e0,	0xd2db61d4,	0x1df386f5,	0x92b5797c,
-0x00ac8ed1,	0x2f7470b1,	0x674e258b,	0x6689df79,
-0x135c5c1a,	0x87abbc50,	0x19ac082b,	0xe7f7d64c,
-0x24fd4922,	0x7eeadc29,	0xa0910eaa,	0x763231d6,
-0x23597ccb,	0x332f33c3,	0x93992b6a,	0x19c8937c,
-0x75d6a9f4,	0x221395e1,	0x662914d0,	0x997d7860,
-0xd196adeb,	0xa5402fd9,	0x8bd6f12f,	0xc31d97e0,
-0x304dd9dc,	0x72f35c72,	0x8ced870e,	0x1eef8a14,
-0x323321fa,	0xf193079f,	0x18026b1c,	0x5a1107a5,
-0x54979f4b,	0x6afee492,	0x04c012e6,	0x3446250c,
-0x25a691a8,	0xc19a76ea,	0x66bd5b14,	0x6250bd2d,
-0xc6c082d9,	0x67ea1d78,	0xbe68a7ef,	0x03f50dc8,
-0xd8f76566,	0xb6681752,	0x00e2b087,	0x7ed2e598,
-0x8c9cbc83,	0x103b03f5,	0xee4d2723,	0x67b3903f,
-0x1e057dec,	0xc5703ba6,	0xae0615f9,	0x1bce0df2,
-0xfd041279,	0xc874a2c3,	0x0a91d2fa,	0xac098457,
-0xc1efc5f9,	0xd48208eb,	0x72e9baa8,	0x184dc658,
-0x3d26b8b4,	0x90e2469d,	0x6d07f351,	0x3f6898a7,
-0x21e4de0b,	0x0fd04a43,	0x2c99cd2b,	0x44b28cdd,
-0xaf5483a5,	0xe50b9a12,	0xd98fe031,	0x9d6e8f08,
-0xf385ba19,	0x5e531cb0,	0xc545867a,	0x65f5ebf5,
-0x9f27ad5a,	0x2de11f0d,	0xef6f0970,	0x973b11f2,
-0x72228c07,	0xe13fdb84,	0xd2a7b46f,	0xc85a38db,
-0x331a9807,	0x3be38ebc,	0x3e7bf15d,	0xa82a1e68,
-0x4b42b5bc,	0x9871203e,	0x7d1e1e24,	0x12f57b6b,
-0xf5403ec8,	0x28746c33,	0xae20522f,	0xf6042fba,
-0x66bada5d,	0xbefe376f,	0xfd3773a5,	0xbb5fc6e8,
-0x34c0433d,	0x3cfc83e9,	0xd096736a,	0xa53be016,
-0xeba3dd6c,	0x2c626561,	0x3c160c8d,	0x8506c719,
-0x802e7b47,	0x16079396,	0x6d29b175,	0x4e91abb4,
-0xe350ce95,	0x0d481aa5,	0x94e95371,	0x10dc4dec,
-0xbfeb3735,	0x3ce3cb4d,	0x32ff742a,	0xac5ad3cb,
-0x1fceabbc,	0x87654d2d,	0x181519ff,	0x8d3b03a5,
-0xb9e74795,	0xc69162c2,	0xaf4e5a8f,	0xfaf584e3,
-0x22b2f19d,	0x732a6b62,	0xd0e4811b,	0x8144dbc0,
-0xd1dd8b27,	0x215262f7,	0xa0485274,	0x238050ed,
-0xa66b6ff2,	0x1bfab681,	0xb751b265,	0x56c41f3c,
-0x4c775166,	0x984af30c,	0x32799078,	0x8e66d51e,
-0x9b7d177c,	0x0cc8c727,	0x8596f9d5,	0xfd3250ee,
-0x4c3549f9,	0x5c518453,	0xec32eaa9,	0xac939aa3,
-0x2ab6735e,	0x511fe493,	0x71c30b4f,	0x53411fc6,
-0xc53985d0,	0xba0108ae,	0x7ecb8ac7,	0x4cde9862,
-0x49f91e51,	0x86ac3ae0,	0xe7b40273,	0x27049d28,
-0xa2643fb7,	0x2067e8df,	0x0326f6c0,	0x21368505,
-0x9588d4ad,	0x0fe38fea,	0x1a396d6c,	0xc5863cb6,
-0x4eafc286,	0xd725098a,	0xc7ee2336,	0xe7c3ef94,
-0x7dab017a,	0xe17759b2,	0xf24eb647,	0x9949505f,
-0x8bd21859,	0x234c2067,	0x86abbcc7,	0xbcd3793c,
-0xb6d80f08,	0x23817175,	0x2fdcb8d7,	0xb0836fb8,
-0x688df395,	0x4c06c8af,	0xabac1b36,	0x42645858,
-0xa23be2bd,	0x8eb720a5,	0x2c58a8e9,	0x29408f09,
-0xe1b0aa49,	0x4722d05f,	0x910d54e2,	0x8491f888,
-0xd0ae52c5,	0x18f6e065,	0x911a182f,	0x7f168700,
-0x5123c966,	0x2a252296,	0xfee807f6,	0x26280152,
-0x90652cfc,	0x35b183bf,	0xdcde9302,	0x74e8972a,
-0xab7cc23e,	0x26eda460,	0xc001b128,	0x84707b0e,
-0x539306e9,	0x913b0f90,	0x66e1ab96,	0xde542ae3,
-0xdb6ce644,	0xb4d5599d,	0x7501c86c,	0x7b7ad8f6,
-0x8fdb7ced,	0xc223cb51,	0x101d6f82,	0x2b4b4d40,
-0xf316ca09,	0xf82448e4,	0xfdb78e8b,	0x43c97f26,
-0x19fd1f6e,	0x35f7b494,	0xe554254b,	0x38e44005,
-0x1cc52cf5,	0x9b18f9cf,	0xc8b4f497,	0x972beacd,
-0xc7c02f7e,	0xc54b8178,	0x905d189d,	0x9377d0c7,
-0x42cec05d,	0x368d5dde,	0x0831dda8,	0x91d0e463,
-0x4f5b6bbe,	0xa30bc81e,	0xdc147871,	0xf5729c9e,
-0xc9a8a1cb,	0x8a9e9acc,	0xa71f693a,	0xeaef07ed,
-0x7b1b3bbc,	0x46be37be,	0xa0d15825,	0x8eec3706,
-0x65d32239,	0x24266771,	0x3fd071ee,	0x9031fcfb,
-0x7dbfe4cf,	0xc3da6ebc,	0x0f2ecd44,	0x52ae02ac,
-0x49d9a1cd,	0x6b360578,	0xff162316,	0x5fd9a3c5,
-0x066096d5,	0x85a9b332,	0x80cde40e,	0x8ad10782,
-0xda0e7f22,	0x54a5062c,	0x64eebacd,	0xa909cec1,
-0x1815c848,	0x3c82fce4,	0x263248dd,	0x001b049f,
-0x6c7c9d0e,	0x6103f5b8,	0xc1751784,	0xe5c51efe,
-0x67757506,	0x6f069d58,	0x8004bc6f,	0xcee45f60,
-0xa8cd13d7,	0x73f12ca7,	0x086168bb,	0xf0696e47,
-0x89df38ed,	0x47bac692,	0xbc1d6ac2,	0x201c6c7d,
-0xb324d54e,	0x942dc7fb,	0x41fdfbb8,	0x3c6f9b31,
-0xe561b931,	0x91b6c9d6,	0xa54bdd6c,	0xbf78b139,
-0x84258eca,	0x5bd5bfec,	0x5065d94f,	0xacfe2889,
-0x792d9965,	0x8a56940d,	0x3c8dba51,	0x5de60bfb,
-0x2b9462c2,	0x644c7c78,	0x6c06baf8,	0x1704cf3d,
-0x4c315039,	0xb6cee9ce,	0x0957c24f,	0x3f971eed,
-0xa9b278ee,	0x1a0548a0,	0xe7ac0d12,	0xd45d647e,
-0xbbba604a,	0x9624aaa4,	0x0928f918,	0xe7f9aa42,
-0xe61c8a9e,	0xa24cba5b,	0xed023e67,	0xa38bb9c4,
-0x620d22b2,	0x2ab0bc4b,	0xd0a23ea1,	0xf8e13620,
-0x05b3ba18,	0x746e09d0,	0xd9e7eff1,	0x4e396da9,
-0xa78066df,	0x8deb6add,	0xd866cef3,	0xe563bbda,
-0xc22c3bdf,	0x10a89f2c,	0x4102ffd4,	0xe86208ed,
-0x0e8efc89,	0x0e75078e,	0x7d59a077,	0x5986f2be,
-0x1a3cbc73,	0x706e21bb,	0x16c06ae4,	0x89c7fca6,
-/*  2623-m011067660C.inc  */
-0x00000001,	0x0000060c,	0x01192008,	0x00010676,
-0xfbac0f6c,	0x00000001,	0x00000001,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x0000060c,
-0x00000035,	0x2e000000,	0x20080119,	0x00000301,
-0x00000001,	0x00010676,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc8f5cd92,	0x30bd1beb,	0x77c4fb8b,	0xe899c960,
-0xc729b4cd,	0x1d9b8923,	0xfcdfc554,	0x580d39f9,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x4872f26c,	0x88971c10,	0x66db1385,
-0x1e532ab2,	0x7ccd2d72,	0x38dd766c,	0x131f4505,
-0x7d5e1e0a,	0x1932938b,	0x79c1db9a,	0x9fe5b8bd,
-0x07037c1a,	0x698cd351,	0xbadb5300,	0x063f17d9,
-0x8558ada3,	0x224c2288,	0x26fa35b3,	0xe64efb19,
-0x0e1b52db,	0x696d5461,	0x3a0f765c,	0x4b853dfe,
-0x05147b28,	0xbe146518,	0xb61e1de2,	0xc342998e,
-0x083d5f41,	0x737fdbb5,	0xdd812ce1,	0xa7b9549c,
-0x164b5fbf,	0xaffd6139,	0x44154437,	0x23d44899,
-0xbe41eae1,	0xeecc8d45,	0x31fc971a,	0x44475238,
-0x5d4ab69c,	0x67f342a0,	0x118cb268,	0x513fb847,
-0x0a86fce3,	0x23f22535,	0x5fa15360,	0x929aa833,
-0x3cbd4138,	0xc1dead1e,	0x3efa210b,	0x9781a61d,
-0x00b53f73,	0x07df4d30,	0xffe97322,	0xf7b12998,
-0xba4d7316,	0x4b746898,	0x45ece500,	0x78cf31d5,
-0x0208c1c6,	0xc3999e15,	0xce2f90f4,	0x7e130a0b,
-0x3c74ce12,	0x37612fd2,	0x7ce3ae15,	0x99a26321,
-0x52ac391f,	0xcb32f7e1,	0x0e50140d,	0x3a6bfc41,
-0x497f7f9f,	0x334b7e17,	0xbcf4e41d,	0x3311b0db,
-0x0dc65367,	0x44847807,	0x991c439a,	0xd2965df2,
-0xfd72e4fd,	0x44b01f14,	0x5a0cf5c5,	0x70029e37,
-0x92af3f34,	0x47949bdf,	0x771a3c07,	0x0874f372,
-0x7a54670b,	0x7430b00b,	0x356234f3,	0x74edf1e6,
-0xaaf60a4c,	0x2bb5eee4,	0xc2c1d43f,	0xc4ee788b,
-0x4198fd90,	0x0aba19a3,	0xc251f028,	0xe42404df,
-0xccbd25f2,	0xdb13eb69,	0x888f89a5,	0x5a6c8cd3,
-0x1e3b469b,	0xe07e48c6,	0x87f25228,	0x64324c03,
-0xe0426f9f,	0x148f828b,	0x4a3c82ab,	0x7d46539d,
-0x0b5079ea,	0x2c675b3e,	0x83134717,	0xbe775c77,
-0x74841ec3,	0x4470addb,	0xfabfa06d,	0x548757fb,
-0x184ea712,	0x502765b5,	0xd7067ce2,	0x15afee11,
-0x8a95590d,	0x3a1734cd,	0x212c7f7d,	0xe5aa3e5b,
-0x9c7e75c3,	0x07486966,	0x5827bbea,	0x391e46fe,
-0xc6acbc9e,	0x9761b6a9,	0x37bef8c4,	0x733eb81f,
-0x7ac9a87a,	0xceacd157,	0xd931072a,	0x9383c10d,
-0x5eae74ef,	0x5f82f6a0,	0xcf89077d,	0xbc641bd8,
-0x1b7d1213,	0x980a4ed3,	0x410fa7e8,	0xaaa1a011,
-0xa5e94ef2,	0x74937d5f,	0x3c109f67,	0x8e58bdcc,
-0x2b43ad95,	0xaa516349,	0x6fa9cca2,	0x48a18062,
-0x663c7fd7,	0xf3822d87,	0xbaaf1f97,	0x8da372b2,
-0xa416831b,	0x6a645364,	0x9c7ac6fb,	0x3f5a9cab,
-0x8cf6f4b4,	0x514fd1dc,	0x7e9d0918,	0x2075f774,
-0xfda8677b,	0x3b5c16ac,	0xe887694b,	0x7d622e9f,
-0x5427472d,	0x540e5c99,	0x2196e138,	0x5d5e9c58,
-0x84a5fc17,	0xb17d6d41,	0x63273bdf,	0xfbb912b5,
-0xaf16b7c1,	0xeb1914d7,	0x5d654b8f,	0xf4a594f6,
-0x554a6311,	0xb391f519,	0xa5ad4acf,	0x9c052bb7,
-0xea68faa7,	0x37399a25,	0x8f6f6d36,	0x47c20f2b,
-0xf241ab98,	0x66da024d,	0xee90a06a,	0x33718b17,
-0xaa89087e,	0x6dcca7f5,	0x43a59f0e,	0xcb2e3ab8,
-0xb19126bb,	0xc56bccb3,	0x04f6fd9a,	0x0f63850e,
-0xa2b6c85e,	0x309f9817,	0x7252b154,	0xcba20ff3,
-0x143156b8,	0xcfcdc8ae,	0x13c2a75b,	0xea4bf1b8,
-0x6e474959,	0xa9c376f5,	0x40d252b8,	0xb6209e70,
-0x993efa22,	0x3d7e8007,	0x1857ba0d,	0x72f25310,
-0x233a8f68,	0xeb4ca923,	0xb17917d1,	0x9ca3f4f6,
-0xdecf1498,	0x99f5ddae,	0x8b6ba2b7,	0x54f41fb0,
-0x1ec9ffa2,	0x74ad3bd6,	0x84fee3e6,	0x5294820d,
-0x147e8b14,	0xd2dc15f4,	0x152fc744,	0x306bc043,
-0xfdbb74d8,	0xf4ea207c,	0x53edfac5,	0x1b609795,
-0xe990ee73,	0x749dbed4,	0xd1cefc95,	0x5c7b37f6,
-0xc6b39045,	0x7281e3f7,	0xed0e6aa4,	0x590a246a,
-0xe6e6a81d,	0x604491ac,	0x6cd14e8a,	0x7a19f5da,
-0xf7c7326a,	0x0ef8029e,	0x0e741b48,	0xc962a062,
-0x6f4ad86e,	0xa2729726,	0x93bcaf1f,	0x1bb56970,
-0x12495cdc,	0x180512e7,	0xa1d68081,	0xb924c24b,
-0x5a1461ca,	0x21438ca9,	0x5449ae48,	0x0f564503,
-0xcec8df3c,	0x789f9b80,	0x5a708df1,	0x28735bfc,
-0xcf11d2fc,	0xa5d01625,	0x80b0b533,	0xa09f026d,
-0x1d22fdf2,	0x01928228,	0x8b6779ed,	0x04f7cc95,
-0x581fe0b2,	0xcc9a66a4,	0x55b3f130,	0x0f22abed,
-0x05b7e95d,	0xd8cc9c30,	0x0850ca8a,	0x34d729dd,
-0x973300a7,	0x80ffedb1,	0xbf5b28e7,	0x135c8cc6,
-0x4337b017,	0x31d8dd09,	0x35ed75a1,	0xb8f990b9,
-0x4384dc18,	0x29d72b56,	0x021aa2b2,	0xa3248b3f,
-0x5f4e7301,	0x29991927,	0x1cc50c18,	0x79fcc545,
-0x56e2e683,	0xe5127777,	0x4b727957,	0x94d1bc22,
-0xacd0da9e,	0xd24771fd,	0x5997ff0a,	0xb9947cb8,
-0x8cb9bb5c,	0x16a4c5e0,	0x00d6995f,	0x1e05edff,
-0x3a7f1af3,	0x445fd70d,	0x24a602c7,	0x6b50001a,
-0x6c99f5e5,	0xad2c00c5,	0xbd16a90d,	0x3b7b6032,
-0xa8dd4f8b,	0x437145f1,	0x5a593d5f,	0x749ee409,
-0x9c6d8223,	0x40c1dad0,	0x578e7e1f,	0x89072e7b,
-0x0ccf47c1,	0x427606d8,	0x4a7bb48c,	0xf85cc4e9,
-0xca5ca3b6,	0x9b989f23,	0x6496403f,	0xdf8ef891,
-0xf4458e90,	0x28eed125,	0xef91afe9,	0x97a8d65b,
-0xe022b3dd,	0xc93c2adf,	0x520cbe7c,	0x58995018,
-0x719a724a,	0x9258733f,	0x8df05767,	0x879b9ba1,
-0x84684054,	0x71a62082,	0x5be959cd,	0x12c937ec,
-0xc21fb3b8,	0x6738aa89,	0xb01d872b,	0x0ff6ec3c,
-0x50fc63ea,	0x715b7c5d,	0x4e5d50c3,	0x086c862e,
-0x34ec9201,	0xd41176ef,	0xd0238088,	0x53518100,
-0x8e1500dd,	0xc6ea9594,	0x0359517e,	0x58d81a35,
-0x48c40983,	0x2d562dc6,	0xecf5be9e,	0x4cd82ead,
-0x45faeb2b,	0x1a66ec1c,	0x6b692a76,	0x6cb326b0,
-0x3a6c362c,	0xf0174da3,	0x5e4549d9,	0xc12c5972,
-0x73716059,	0xdd54591d,	0x32ee704b,	0x5a55c22d,
-0x56bd1e7e,	0x2bd34024,	0xa42c85d2,	0xb1ce248a,
-0x604a7570,	0xbbf4b3fb,	0xe0eeb866,	0x130b7dd4,
-0xdb39dc1d,	0xd873b0c4,	0x3aedb6ef,	0x5efb2481,
-0xbfaff9bc,	0xb94930d6,	0xa3fe71cc,	0x75867e01,
-0x7c8ee191,	0xf38f4963,	0x8d077957,	0x658e7c2b,
-0xc1bd58ed,	0xb86a20b2,	0xc624489c,	0x4624732d,
-0xc11f1ee3,	0xf1874ed7,	0x173684cf,	0x0e5851d4,
-0xc2662118,	0x13dbb926,	0x1668df5e,	0x00749d03,
-0xab9530d2,	0x5758e602,	0x6db90ff1,	0x87270f9d,
-0x774a52f5,	0xcd1b4b5a,	0xd706025e,	0xe3a51fc4,
-0x31c5d55b,	0xbd0278a1,	0x16dce1bf,	0x75a3446f,
-0xe030c121,	0xa6f6b3c8,	0x504e3b3b,	0x4c1428b1,
-0x74229a60,	0x25d5b7b7,	0xea284c21,	0xf5f1c7cd,
-0x0025e9fc,	0xa7db9e56,	0x4e3aeb90,	0x8bad0f3b,
-0xc19e88eb,	0x8ea86b83,	0x25cf5d26,	0xca78504e,
-0x94109c06,	0x60ad3975,	0x138b8038,	0x4c9d8fdd,
-0x28a91526,	0x5d3d6c3a,	0xf81ab861,	0x8db34426,
-0x35a3b398,	0xf3b40170,	0xb7e6994b,	0xea72c1f5,
-0x63201cd4,	0x1c5749dc,	0x420ada27,	0x419f4847,
-0x49244543,	0xb915645f,	0x3a00b3e2,	0x0122000b,
-0x296b6bad,	0x7b45d76b,	0x5be8f025,	0x2a04919f,
-0x8291fea4,	0xaae644f9,	0x7af3fb96,	0x77d9878c,
-0xa8996848,	0xa9a0c1c3,	0xb47ae6d2,	0xc5b6cf90,
-0xb04b4863,	0x43fa113b,	0x66ef4993,	0x03a5b4e9,
-0x94b661dd,	0x145a5909,	0xd42f70cc,	0x6b816775,
-0xfbc0cb04,	0x5e890eb1,	0xb6900305,	0xcd19304b,
-0x85c67d21,	0x19e91907,	0x27b3898c,	0xe0ce6ba2,
-0x4110d80d,	0x85953740,	0xba7a4225,	0x51db6dd9,
-0x04c21ffe,	0xd34ef7cd,	0xeb13f075,	0xc1f8eb04,
-0x19a1227a,	0x3e99efae,	0x318346e2,	0x3d4c73bb,
-0x402dacc7,	0x5a9e892d,	0x01304401,	0xb3950c6f,
-0x9254bea1,	0x5cc8f025,	0x53cb9416,	0x52d716c5,
-0x3ff575a5,	0xede2046b,	0x2cbd6b85,	0x7e8feb25,
-0xc2d35482,	0xa49b8495,	0x214fed4b,	0xc93ae54f,
-0xde3d8a18,	0xe4456b47,	0x505555c1,	0x6418926d,
-0x4b6ac1e7,	0x7ac213ea,	0xc081eea5,	0x467ff1c3,
-0x1ed5d79d,	0x746dbb24,	0x38b1dbde,	0x4d495fc0,
-0x7ddabfe1,	0xfbac0ba1,	0xd17cfc3b,	0x32c819f3,
-0x1f4c39cd,	0x6fa5c3ed,	0x0d2e7f50,	0x1f5cb318,
-0x1e1770d1,	0xef12c293,	0xb149ace5,	0x93df9bdf,
-0x14a98319,	0x3374906f,	0x746d603f,	0x5a368e6d,
-0x8dbaef76,	0xb7923f42,	0x607655cc,	0xd144703c,
-0xa01fa0f6,	0xa83f4e65,	0x224bba03,	0x6e082d15,
-0x11ef27eb,	0xad91427e,	0xd8f0e3bd,	0xba7bc3df,
-0xdb031557,	0xf33052d0,	0x2bc3df37,	0xf55d25c2,
-0x99af998a,	0x5819eb07,	0xe4b9ebc5,	0xbc3da46e,
-0xde1abe71,	0xb8c66434,	0xe811e29d,	0xa48ee5e6,
-0x7f961c60,	0x5500769f,	0x9c8e0d00,	0x94680cea,
-0x2f7a0c5f,	0x9a058310,	0xd3ddca08,	0x74276c4c,
-0x855ebef2,	0x61979f79,	0x09684303,	0x3ea777dd,
-0xf700db1f,	0xdf7bcae0,	0x0fa7db2b,	0xd0115231,
-0xc0015882,	0xe4af6f72,	0xb4388c7d,	0xfb5656bc,
-0xbe1d38b3,	0xf59ae9d3,	0xddc692bf,	0x3aaef998,
-0x561f993f,	0x4d191a40,	0x4492df05,	0x7eb17670,
-0x0770001b,	0x9b320a87,	0xbc8a559a,	0x19781e02,
-0x13c995b1,	0xcb8c1e47,	0x462019e3,	0x7ee6bcc1,
-0x9da2afce,	0xee1dbf76,	0x3a72ad3f,	0x711f786a,
-0x0c72d639,	0xa3455dc9,	0xef155308,	0x82f3e1c9,
-0xc9540414,	0xcec2cde1,	0x748005bb,	0x24197d5d,
-0x4b8b7f7b,	0x3dde3129,	0x9ac952c9,	0x6f7932a7,
-0xa99005e4,	0x4261280d,	0xfad329af,	0x90bcacb3,
-0xe1c4a202,	0x9200d928,	0xffe55142,	0xf69b2a40,
-0x227783a3,	0xe4b0c9c4,	0xeca97ce9,	0x9245597d,
-0xa922db08,	0x94bff912,	0xdbebd937,	0x5c658f30,
-0xb3f4a726,	0x24e2ca27,	0x9ca037d7,	0x745d3d5e,
-0x3e8c437e,	0xb807af86,	0xee5fa977,	0xfe335297,
-0x5c0a6707,	0x8ab801af,	0x05d02766,	0xcd0906b4,
-0x791b47d3,	0xff5a0291,	0x09465b16,	0xa7fff3a1,
-0xe2e6d825,	0x7f4f2b9a,	0xc1f2e668,	0xa5cfe1d6,
-0x95fd7bde,	0x38681314,	0xc3c7dce1,	0x7b82e044,
-0x2c883c77,	0xe8aa72be,	0xd53867d7,	0x7022fdc3,
-0x3b697ccd,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-/*  1638-m01f6402.inc  */
-0x00000001,	0x00000002,	0x12152005,	0x00000f64,
-0x680b0995,	0x00000001,	0x00000001,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0x2aa0fbf9,	0x0920514d,	0x0f5f4463,	0x49035ded,
-0x6522b40c,	0x0a3de93c,	0x28b44f2a,	0xa2a1b504,
-0x685e4587,	0x991d06f2,	0x31beab6c,	0x3d1deeef,
-0x2c1eba51,	0x7a1b9963,	0x291de54b,	0xbc3e2586,
-0x0dcb034d,	0x28d224ee,	0x29e99d05,	0xe1a45aa4,
-0xde6898fb,	0x805f3396,	0xbf00384e,	0xe23a9d63,
-0x9d41b622,	0x70ae7613,	0x831bd461,	0xaad0d965,
-0xbf2ae85a,	0xfa137a91,	0x85df55c1,	0xc1aea248,
-0x8a813fe2,	0xe4185e04,	0xc27ca165,	0x89fa4907,
-0x779e9d32,	0x73b04b9b,	0x6f5f3f42,	0xc0b7e114,
-0x60321122,	0x55eae809,	0x9e3ce356,	0xb7de5c44,
-0x27f03183,	0x883bab30,	0x72fdada5,	0xe08c88d5,
-0xbfb70e47,	0x38135179,	0x97511d61,	0x7e96ebe6,
-0x7336a70c,	0x9c23d4b6,	0xb45d2d9d,	0xc22ddf82,
-0x149692a3,	0x71c4a8a1,	0x5895e53b,	0x219ed674,
-0x68dcdd5a,	0xeda85f71,	0x90f7bc99,	0x52ae6b46,
-0xedc55856,	0x8e1a9cd4,	0x77cf2d86,	0x0d412073,
-0xe0068d6d,	0xe35ac61d,	0x5cfa5431,	0xad966a57,
-0xe251e7dd,	0xccb4624a,	0xb5cba1db,	0xdc151b9d,
-0xb1de5d60,	0xb8411488,	0xf02cf584,	0x1f5dab6b,
-0x3d27af78,	0x31c58e8a,	0x5f19bbb0,	0x1d89667e,
-0x26066d77,	0x7598664a,	0x71b427db,	0xf3331025,
-0x20d589ce,	0xfe80da85,	0x2d471abb,	0xcc2cbf7c,
-0x1c69cebf,	0xd91ee715,	0x86dba558,	0xed6dec4d,
-0x9e05a3cf,	0x343028f4,	0x4b672fe4,	0x9b9a3d02,
-0xbd8a9fdb,	0xe6d6bcda,	0x652e09c6,	0x7815a3da,
-0xfc8ddfa6,	0x179f4178,	0x2b081ce5,	0xf62f9c48,
-0x891144db,	0xf52ce311,	0x20d4bb33,	0x02264e2b,
-0xacda3a1e,	0xc32c2309,	0x4d5f375a,	0x67778588,
-0x23fd318a,	0xb186b35f,	0xb03dfd87,	0x96ce2b56,
-0xc298c4ed,	0x5b2c00a9,	0x23e876cf,	0x87cc079f,
-0xf73b41ce,	0x82848a82,	0x344587ca,	0xecef8ea4,
-0xc4bd9118,	0x831dca57,	0x1de86e11,	0xba5aebbe,
-0x5ed0eb16,	0x9d939161,	0xee43130b,	0xd67a1c2a,
-0x6abd7cc8,	0x47f5540d,	0xeb7d000c,	0x1c3a6a85,
-0xe84074ce,	0x3ad84c1a,	0xa1b1fa49,	0xff605725,
-0x81fbe321,	0x3286160e,	0xcfef091f,	0x3526dbbc,
-0xd3b2e8f3,	0xf4475cb8,	0xf0cd8d6e,	0xcd998bc8,
-0x4a70fff8,	0xc8771b66,	0xe75e6cf2,	0x7bcd3c8c,
-0xcf19fbf9,	0xb2c69de1,	0xfe572f00,	0x19c37ba5,
-0xf482275a,	0x097442ba,	0xcff47908,	0x206214c1,
-0xd53de8ab,	0x2e1fdc6f,	0xcd626594,	0x91b03f12,
-0x442489fe,	0xfba5fb8e,	0x4b56f219,	0xc3857762,
-0x4dc3f4d1,	0x9c824a53,	0x12f1288e,	0xb58d61fb,
-0x77335b01,	0xf867712b,	0xfe3608fc,	0xd589039d,
-0xee7efebd,	0xa533b187,	0x945ba37d,	0xe5e97e1b,
-0xd039c7a1,	0xa62994bc,	0xf8d381da,	0x68a2aa06,
-0xdd86907a,	0x56bc796c,	0xf22ba84f,	0xe1d1e168,
-0x46fb8d21,	0x8d7042f4,	0x92092de4,	0xbe5325e1,
-0xeecce748,	0x93b3dbbd,	0xa5d7de6a,	0xb4947424,
-0xec1dd912,	0x9728193e,	0x7251c760,	0x4b58fc0e,
-0x4bec8722,	0x194af36a,	0xa46a6dff,	0xfd37580d,
-0xf3ea1f9a,	0xdeb7756d,	0x0f94c7cb,	0x4eaf5c3e,
-0xe47b4cd6,	0x346c597e,	0x10f80e17,	0x79facd91,
-0x40e8619d,	0xe8ae8d3e,	0x6376a64f,	0x372112fa,
-0x0a5b03fc,	0x7e9dad8c,	0xb5a059b2,	0xc31ea7c0,
-0xc0ec4256,	0x7848cdf0,	0xea5b6e70,	0xa6e2c4f3,
-0xf42895e6,	0xbb2d8017,	0x53fa34c7,	0x872491ec,
-0xd926211c,	0xad7a1784,	0x02a3eb5a,	0x7a631dd2,
-0x7747a504,	0xfd6b8d11,	0x88cfdaf2,	0x0483946c,
-0xe51ddc78,	0xe7c9ac65,	0xbeae254f,	0xccb8cc74,
-0xe1d0cf5e,	0x1637fc82,	0xcefd605b,	0xba5c6bf2,
-0x021670a4,	0xca0c87dc,	0xa998a05c,	0x371cfe63,
-0x653595ab,	0x9b977d0a,	0xa2fe7aa7,	0xf299c041,
-0x2cb80494,	0x4a2c724a,	0x5d91a463,	0x8ba91806,
-0x1df92cc8,	0x05646e0b,	0x84c992de,	0x6583aa3b,
-0xfef41b16,	0xe715b32d,	0xa82eb0a8,	0xd7b75129,
-0xca4773ab,	0x711293b5,	0x9c8367c6,	0x0f23fdc2,
-0x8e0468a8,	0x0ef8e40a,	0xdcc97a23,	0x216b9e7e,
-0xde894a7a,	0x3b00e797,	0x39865b8e,	0xb9eab71d,
-0x18651f98,	0x729584e1,	0xc4d2351a,	0x6be95b57,
-0x2a4eb069,	0xff2eb911,	0xe701af65,	0x8fd6b486,
-0xe68b3390,	0xde465144,	0xc33eaade,	0x0c5187ac,
-0xf748bfbd,	0x17a7b2d2,	0x58e7dc21,	0x033a6699,
-0xc54edd45,	0xb7aba6d1,	0xa5ae6431,	0xdeddedf0,
-0x44bbd637,	0x3659c9e8,	0x70030194,	0x1083d96a,
-0x2a232c89,	0x8e94b9b1,	0xa7fdb315,	0x0d48c881,
-0x5100c635,	0x0c6b69b0,	0x75dad240,	0xf19f27ce,
-0xd35b1f9a,	0x9de9ebd2,	0x77fa6c9c,	0x44fd5d62,
-0x979af1da,	0xc650c06f,	0xc7e065ed,	0x3f2d1c33,
-0x293d510f,	0xc64ec98a,	0x54f1c830,	0x293de2f6,
-0x250de0d4,	0xb1dc4746,	0xa2935d05,	0x58736739,
-0xbc555a89,	0x8b887d7a,	0xdff42f30,	0x0859eb5e,
-0xbca8e48c,	0xf035f4e8,	0x43367c2a,	0xade42a6d,
-0x086136fa,	0x2f33b875,	0x3b0929f1,	0x1ba4ca5c,
-0xc1ca6291,	0xbf3b1b5b,	0x4f3dd6fe,	0x7e735ec4,
-0x3c7c0df0,	0x971f7d71,	0x4e437259,	0x8a46664e,
-0x9f954b5f,	0xadac3dfc,	0x32539e93,	0x4e1dc466,
-0x1f7addbc,	0x2af6fbfc,	0x633dae60,	0x67e6fc87,
-0x757a1372,	0xf6de0e7b,	0x946c644f,	0xe8e70544,
-0x5ed94705,	0x27687c6d,	0x16275ba0,	0xc854565c,
-0x08990758,	0x93853a95,	0x0d02f5be,	0xe1d83a60,
-0xdf5b711b,	0xc54eba7c,	0xa854ebe4,	0xcf59362c,
-0xcef1ef1e,	0xe95efd66,	0x41b2f303,	0x554c80c3,
-0x24d9df54,	0x015a145e,	0x8b432368,	0x9a52ec77,
-0xc5dc324b,	0x737a9b86,	0x8042868d,	0x6bc7a20d,
-0xe0458277,	0x8fe3fe64,	0x0135a93c,	0x70c523ef,
-0x0584da30,	0x30cf1d1f,	0x9a449c5c,	0xc2ac5466,
-0x977092c2,	0x5b3d4e24,	0x6b0a8a7b,	0x422fd868,
-0x303bf9b1,	0x481b7e10,	0xc7521b73,	0x22836ea0,
-0xc2610907,	0x9d8d643f,	0x1a8fc938,	0xe89ee885,
-0x014d696f,	0x280afeb3,	0x45a6abfe,	0xf006f2b2,
-0x80cc5307,	0xd589a95d,	0x4cca87f9,	0x8d6644e9,
-0x105a4fa2,	0xee41331a,	0x0bb7fafe,	0xd1fcaa5c,
-0xb9bf50e9,	0x1407d551,	0xffca0924,	0xb08150de,
-0xc8b0b4c1,	0xe3fa725b,	0x69d0c9e4,	0x9b8e168b,
-0xaae29701,	0x0615c226,	0x107336c5,	0x90577f89,
-0xa3c5bb82,	0xe445834d,	0xe18e8c0b,	0xd1bb9842,
-0x150048e6,	0x07596bd5,	0x85e8eda5,	0xbbfbf266,
-0xd7be05d8,	0x1322fe19,	0xe31e041e,	0x2812cbf1,
-0x65feffa1,	0x1eb2adc2,	0xf7a3e79b,	0x2a25420f,
-0x3a902032,	0x09c7ccb4,	0xe184546e,	0xc1ae299c,
-0x7b0f9198,	0xa2abca00,	0x4583143e,	0xa11832e8,
-0xee7437f1,	0x8f819a25,	0xf19b7816,	0xe0c05905,
-0x74f40d3e,	0x5e7f4863,	0xfd5654c6,	0xbd2f35d4,
-0x60db4685,	0x7c36155d,	0x6092824d,	0x18918ded,
-0x5ce2e316,	0x91e3ec9f,	0xbfb36d5a,	0x717688af,
-0xfa576502,	0x4c7b3248,	0xea419722,	0xd767e76f,
-0xc7272aa0,	0xa38d67f7,	0xd20aecf0,	0x2f7fbd22,
-0xa7df9b1b,	0xe097f950,	0x79df27eb,	0x5f39778e,
-0x3ad5752a,	0x27aea5a4,	0x3a82e739,	0x25acf07e,
-0xb3289d97,	0x8c4e174f,	0x7a65c0f5,	0x0371df23,
-0xe25e8bd3,	0xee3eb9c4,	0x3c6fd5a1,	0x6e8d042d,
-0x30fec942,	0x6ab2e45c,	0xfe066a50,	0xde0f38a8,
-0x13a3af8f,	0x6a3361c0,	0x60ca1d2b,	0x07ad00fc,
-0x50fe83ad,	0xa9396ff5,	0x50710edd,	0xbc27524a,
-0x27d564c5,	0x0435f0fa,	0x3eb3dd20,	0xe8f1f061,
-0x56d320e1,	0xdfaf3f32,	0xcb109961,	0xbb7350c4,
-0x76f35f33,	0xf1db6cbb,	0x5f316bc6,	0xfc0ee2e2,
-0xcc7cf565,	0xb6048c11,	0x09827822,	0x5cd98dd1,
-0xe44a295b,	0x14955177,	0x1b77cbc6,	0x55a3a1ba,
-0x166371fb,	0x7bb42477,	0x7b25d45f,	0x3489c70b,
-0xfa02e8e6,	0x5809782f,	0x354432f9,	0x08a90382,
-0x635638cb,	0x2f0ee04a,	0x8ae68f6c,	0xc4d31358,
-0x13b8901c,	0x00c662c1,	0x2c631f55,	0xe455f4fa,
-0x9ae3aa89,	0xe8b86e2c,	0xdb1306bb,	0x545bf955,
-0x95e6a296,	0xc42d0046,	0xa530a448,	0x324a510c,
-0xfc9c7421,	0x64d87b31,	0xb0593335,	0xfbea778b,
-0x5099360c,	0xb25943b6,	0xcf0782fb,	0x16a23d00,
-0x3afd30d2,	0x4fb1f531,	0xc79bca40,	0xe4b00f11,
-0x0c3dcfc6,	0x7c6854ad,	0xf2a76964,	0x3a84cd59,
-0x77a1e58c,	0x876465fe,	0x3d35c698,	0xb20e0e79,
-0x6b12dc23,	0x3160ab74,	0x66cac826,	0x33a3fe97,
-0xf89a265b,	0xc5d02b52,	0x861a3ee7,	0x2871ddb3,
-0x2c078ca3,	0x0c1c252e,	0xafb33ab9,	0xb34d57c5,
-0x8c1a4366,	0x943ffbf7,	0x165dbdf4,	0xdf640f5c,
-0x5c8e5c82,	0xdda5428d,	0xa6a1e13c,	0xd38d2506,
-0x3c202eb1,	0x1a919c94,	0x28b88521,	0x0406f03e,
-0x805e913d,	0x2cc0ddca,	0x9aa888ff,	0xc08a34d6,
-0x5c594f64,	0xc09b6e6e,	0x118a80d9,	0x362b8fca,
-0x904207f3,	0xde0a40ad,	0x6704f390,	0x590ed66c,
-0xca9bf353,	0x9ac7db3a,	0x662ce8a5,	0x01afb889,
-0xa907c282,	0x3b0944d0,	0x574a26a3,	0x618fed95,
-0xa3b49dda,	0x63c8cc70,	0x5e9c3d8f,	0x5ad8da59,
-0x5774014c,	0x42be9ae3,	0x35d9ae0a,	0xce68e46d,
-0x631ac0d7,	0xe5860908,	0xf710f514,	0x1a77a922,
-0x2e003a2f,	0x798dc39a,	0x087c5233,	0x9d3af931,
-0x97d3681c,	0x8ddd2762,	0xbeec6447,	0x63634eb7,
-0x59c45121,	0xb8ff5a98,	0x0fb972c8,	0xff4f383f,
-0xda9ff9da,	0xb5708dcd,	0x3f15cc70,	0xb09ad02e,
-0x25bc07b9,	0xd0a8de39,	0x4e3d3172,	0xc6c92539,
-0x954e86a4,	0x3cd5fe1b,	0xf7d174b4,	0xda209a60,
-0x37f469f4,	0xbe461bd2,	0x102e07b3,	0x18fd0fe7,
-0x5604a127,	0x9420586e,	0xb474ba16,	0x36b3fed0,
-0x67d0bb5e,	0xfe037ee8,	0x79a250ab,	0xac848520,
-0x3a2fd96f,	0xe660f9ab,	0x1d22d8f3,	0x18bd314d,
-0xc1b69db4,	0x95f72d07,	0xa1fbe25b,	0xd139a56e,
-0x3fe3ee80,	0xdaf8bca6,	0x3955a21e,	0x239d46c5,
-0x5582946a,	0x89bae301,	0x907b5203,	0xca60d0d9,
-0x9ca7262c,	0x06082c6c,	0x4db76a99,	0xb755c4c2,
-0x50eaee11,	0x46cfda14,	0x083cda65,	0x985bbcc8,
-0xef68ee29,	0xd7b067fa,	0xcb57af1d,	0x7b1b3146,
-0x5546f9fc,	0xa1d6b862,	0x406bc5e2,	0x81ea8a9a,
-0xcddece0b,	0x08663a0b,	0xaedaa192,	0x1c881ace,
-0x8dbd163b,	0x9359b3e8,	0x7d962932,	0x9e604483,
-0xbe3d3e56,	0xc2039fcd,	0x0bf135fa,	0xf408ca28,
-0x3f73999d,	0x6c84009b,	0x16954d25,	0x4f879dc7,
-0x84b652fc,	0x270ba149,	0x44395c75,	0x4a49e3b9,
-0x45a51176,	0x316b10c9,	0xcb56a90b,	0xc830f743,
-0x97865821,	0x882cd1b5,	0x834ee6e2,	0x5f2a7ed5,
-0x9452d2d7,	0x0470a980,	0xbb4721e7,	0xa5cea044,
-0xedce47e2,	0x2640b2c6,	0x44fd0fd5,	0xd6fa1c8d,
-0x530dee05,	0xea4ead53,	0x60657d65,	0xb978aebe,
-0x2b942957,	0x89d92de3,	0xab727498,	0xf5b21321,
-0x4bb5677e,	0x85fac0eb,	0xfac033ae,	0xb87b4430,
-0x3e76b019,	0x1c34a88a,	0xf88fb935,	0x38a90f7c,
-0x1fad929d,	0x5bbe3de5,	0x9e2b1977,	0xe6817b9f,
-0xf0377aa3,	0x9723c691,	0x2a96f63d,	0x5ea61072,
-0xf3a2e3de,	0x5789aa3f,	0x4c2ed476,	0xfc943c4d,
-/*  1466-m02f4116.inc  */
-0x00000001,	0x00000016,	0x04212005,	0x00000f41,
-0x0a12a70a,	0x00000001,	0x00000002,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x23869663,	0x00e8d132,	0xded7a33f,	0x20662973,
-0x949096f1,	0x63bc560b,	0x1649cf52,	0xda1410b5,
-0xe2faf749,	0xb4913859,	0x679bebfd,	0x6ab2a769,
-0x90c4108f,	0x80637ebc,	0xa09c95c7,	0x1244197f,
-0xad414513,	0xb377c694,	0xf6515ef3,	0xd978899c,
-0xec6e2ba7,	0x631b699a,	0xd91aaf84,	0xded4c08f,
-0x99beedb9,	0x73701268,	0x0ddb3eb0,	0xa7f150ca,
-0xcbba1f50,	0xbe41ed77,	0x3f67082c,	0x7444a7f8,
-0x328ccea2,	0x8a4d432e,	0x20141112,	0x6e8ea818,
-0xcc779408,	0xcb05521e,	0xce4cab4b,	0x7fc11e0c,
-0xb8bcf352,	0x2116cfcf,	0x4a5f6828,	0x7bf277e2,
-0xe8f61e84,	0x5494f402,	0x16818fdf,	0xb0f0094c,
-0x5ef5b9ab,	0x44e58a4d,	0xcaeaf06e,	0xffbe13f1,
-0xa272b4db,	0x2f2e1460,	0xf5c2353a,	0xfe3825af,
-0x1db68bcf,	0x0cc12b45,	0x20ab67aa,	0x91ab4e08,
-0xfaa46cbd,	0xcf5e6006,	0x06980e34,	0x18489795,
-0xe4217f69,	0x6f7c566d,	0xf734be2a,	0x0d062834,
-0xc23f2bdd,	0x9de5085d,	0xdfe30cb5,	0x40cab81c,
-0x82cbd09e,	0x28846197,	0xd55b1faa,	0xb6800b2c,
-0xa14b7d45,	0x7fae0619,	0x8f3d9a9f,	0xc023a5ae,
-0x098c3336,	0x5dd86a06,	0x84259cb3,	0x4fd2c3da,
-0x9a786bee,	0x2d883dd2,	0xbc819908,	0x64d9166e,
-0x48ad8649,	0x748b022f,	0x072dbca3,	0xf0f98463,
-0xf3887d52,	0x97f72615,	0x0ba8b369,	0xfa857e01,
-0x06e45380,	0x6bb600b1,	0x3a6714a4,	0xec8cc32a,
-0x7328645b,	0xe2da69fb,	0x9f935d2f,	0x8d5b0b67,
-0xd7f889f3,	0x79d70f33,	0x11e17dd5,	0xffb3f194,
-0x2c8dc263,	0x1d949384,	0x653bca90,	0x22dfc421,
-0xb97d62ba,	0x23601fd7,	0xa411d616,	0xdd485975,
-0x31525379,	0x860c97d2,	0xc8614c54,	0x93f25dfa,
-0x6ca1c728,	0xf4bf089e,	0xa0fe052d,	0x781bfa09,
-0xe8c27184,	0xd28fb8a2,	0x68ef03c5,	0x08f0d934,
-0x71515534,	0xf8931da7,	0x09aec0cd,	0x2ce58a35,
-0xc16fda14,	0x381844a5,	0x432c0e4f,	0x2b05676f,
-0x76e4b1cb,	0xc5eafb96,	0xe57699c0,	0x2a6d6016,
-0xfc536faa,	0xba6cd314,	0x74ef7abb,	0xfe27f9a2,
-0x3efe7a09,	0x4ad2a897,	0x8afe50f6,	0x00dee9bf,
-0x297ef8df,	0xb689118c,	0x48045b27,	0xccd4636b,
-0xec098c3b,	0x3b3c2848,	0xb3ea4215,	0x9fd74b09,
-0x521bcd18,	0xbabaf053,	0xab0e34a7,	0x97396e12,
-0x0f145e91,	0x3b249de3,	0xd66367f3,	0x41f4c1e7,
-0xa2cb58f5,	0x9710bcaf,	0x90a91bf7,	0xb09d0b34,
-0x07fd9ad6,	0x0f3f0911,	0xe461eb38,	0x69031f51,
-0x8188502d,	0x6c601820,	0xdcf5950c,	0x97ea6b0a,
-0x0207b79e,	0xef5a8cf4,	0x6ab62c95,	0x462e7eb9,
-0x75c7b30d,	0xc54d35b2,	0xe1bca821,	0xd242e982,
-0x09f3d0a6,	0xc543ffc6,	0x0e685a9f,	0xa5b1b71b,
-0xe5701af4,	0x2dc040a3,	0x53044929,	0x3e6f6e14,
-0x6fbbf23e,	0xcac3733c,	0x3ba95030,	0x6e81be2e,
-0xbc3834c9,	0xf2c28b28,	0xa9dfad41,	0x2635e8ee,
-0x7078dc99,	0x1f7b87cd,	0x766422b0,	0x68209ce5,
-0x72306bbc,	0x9cc6bf23,	0x26efd23a,	0x6fe8e3d9,
-0x1062cfab,	0xd7e01157,	0xeb31e682,	0xa26d7555,
-0xcc5e3d21,	0xdfa0225d,	0x5f5648ad,	0x2b509558,
-0xcef77076,	0x859b7053,	0x3e98ad41,	0x21284f95,
-0x8643f3ec,	0xf65a5913,	0x6885e3ba,	0x484a7388,
-0xeee4f31e,	0x83b11f7d,	0x605fa7f0,	0xa3f75e1e,
-0x1b543449,	0x65b1dfa0,	0xca68cae4,	0x95c2dcbf,
-0x7040fdd4,	0xe9e1abc9,	0xd8b79e83,	0x80e0fc10,
-0xe0978162,	0x791ae4f2,	0x6bdf0188,	0x889cda75,
-0x6da66a3c,	0x1dfcc559,	0xdd6218e3,	0xe0aaf9d0,
-0xf738daf5,	0x5201b42a,	0x64eb2511,	0x481bf645,
-0x78d6a92b,	0x2773f693,	0x48523ff7,	0x30123068,
-0x80e851ab,	0xdb56ba81,	0xc1f1e6af,	0x0b2d5ec5,
-0x742ac78a,	0x95d62c16,	0x049b1344,	0x99df793f,
-0x3faa4853,	0xc9f7beca,	0x6aafe81a,	0x4a5eba54,
-0x46040095,	0xdc6db22c,	0x89809af6,	0xb7a2b1bc,
-0x7e99aa22,	0x5b04008b,	0x7e301be5,	0xaa1b0d47,
-0x97366416,	0x42dd637e,	0xeca9e894,	0x69d91e91,
-0x5d2c0bce,	0x0c8d1af2,	0x730797d2,	0xf6323369,
-0x8f1fb1a9,	0xbe6777ec,	0x0336f4b2,	0xbe63fa7e,
-0x6a9f7f06,	0x80d12d3e,	0x1a31610d,	0x4da3a7b1,
-0x8851d440,	0xb60d2846,	0x71a4b4b9,	0xcd750cca,
-0x853a741a,	0x9376cac9,	0x85d1d64d,	0x840a6618,
-0xf7a23082,	0x684a5321,	0xee7c1e76,	0x93c98ee7,
-0x049ccc19,	0x0a874574,	0x660d1f0b,	0x6d5ee968,
-0xc3b0a737,	0xe21294d6,	0x1f14b156,	0x60f3b43d,
-0x0339d140,	0xa0d63dbc,	0x6c61e063,	0x38faeba2,
-0x01e5639e,	0x2ceab905,	0xd8b02114,	0xa184b62f,
-0x88e57cff,	0x23bc995b,	0x8ced5758,	0xfbb44f87,
-0xb3bb6632,	0x3c0dee12,	0x334d1a59,	0xc09a90fd,
-0x83f5a440,	0x1fc911bd,	0xf90e5fc6,	0xa7cb56f5,
-0x4bfb8c77,	0xecb3dd24,	0xf5d7ea2f,	0x5640f72b,
-0x8d9d7997,	0xb5157040,	0x49da93cb,	0x2ab58c5f,
-0x2c09e41c,	0xbff9517f,	0x1fc15998,	0xfa2670c8,
-0xfe8ce73e,	0xf1c5369e,	0x42d664fa,	0x4571e8ae,
-0xdc91510a,	0xee671482,	0xf6880beb,	0x78f67258,
-0xe4abd31c,	0x32973206,	0x5550afc7,	0x715de237,
-0xd32593eb,	0x8471e4bf,	0x795a50c7,	0xe341eabd,
-0x426741b5,	0xc6113c61,	0xaaaa8252,	0x9383558e,
-0xe9feaa2e,	0x4212e709,	0x51bacee2,	0x4e592b93,
-0xe93bf72c,	0x21b5e560,	0x7145b02f,	0x269362f4,
-0xbd93b284,	0x2ee8c779,	0x75ae90b1,	0x45465f2f,
-0x82ad3224,	0x9075c0b7,	0x5758c3df,	0x38f58b2e,
-0x95a275dc,	0x19d3b3a1,	0xac225a5f,	0x6685a489,
-0xbdae4b45,	0x4087b284,	0xd46de961,	0xc07859fb,
-0x0d858371,	0xad60ea18,	0x63d5d2d9,	0xf3adb667,
-0x2c0e5cf1,	0x2f41b7d4,	0x71f7be20,	0xf2959b52,
-0x54dc88a6,	0x9b05e98a,	0xd4312afa,	0x8fa7b512,
-0x6f3b2388,	0x56a31c8a,	0xddeb7a74,	0x674370b3,
-0x1131841a,	0xa8cdf336,	0x30e43eb5,	0x1b3278b4,
-0x33370b0f,	0xdbd64214,	0x4063ffe4,	0xa399a981,
-0x3a49c034,	0x196e0ef9,	0x4b88a395,	0xb7c577bd,
-0x0ddb86f5,	0x9a7bf933,	0x8e7c7a10,	0x70dc92f2,
-0xd81f477e,	0x0ea89ab4,	0xf25df4dc,	0x82f3b135,
-0x4fd628aa,	0xcd9a9138,	0x186f5e54,	0x50b713a5,
-0xa43ce3b6,	0x85e91b7d,	0x8cfbf38a,	0x75ce54ab,
-0xeec542c1,	0x6617c07f,	0x00cfbe4a,	0xe69a599f,
-0x600e6b0c,	0x1a75ee91,	0xec0522a7,	0xb077743e,
-0xa0b6a9f9,	0x345cc429,	0xce7f2f32,	0x440b3610,
-0x8a9b0833,	0x00138162,	0xc846fc4b,	0x13e3782b,
-0x5f83cacf,	0x87c13da0,	0xd0683250,	0x83c8b50d,
-0xd68b0e65,	0xbd69f3f4,	0x700194d2,	0x6e508ab7,
-0x3a4ac1b5,	0x387ada08,	0x2ee35fc3,	0x34f57311,
-0x8fbe2ad1,	0x50f90bc9,	0xb809c7df,	0x32472ed3,
-0x93ed3691,	0xfc348312,	0xf236338c,	0xe0be9f84,
-0x52e72d2d,	0x76d771b2,	0x1c29999d,	0x7aef6bd6,
-0x5d080f40,	0x5e1a76d4,	0x0a2ef953,	0xd8e6716a,
-0x64d634d9,	0xd13bb501,	0x284be6e1,	0x214973af,
-0xc21397f1,	0x7ed45554,	0x0cde11a3,	0xff0fbd85,
-0xff0a75a7,	0xcbbdd6a2,	0x68fe6b57,	0x38127f96,
-0xe4cef774,	0x08d367aa,	0x7956829f,	0xd4383253,
-0xd80326be,	0x8df65472,	0x76f1b887,	0x0cb47fb6,
-0xbf41b3b4,	0x682eb861,	0x1dcf062d,	0x47a7f587,
-0x6214381c,	0xfa6d6e91,	0xf115be91,	0x12acb2d5,
-0xac22fd35,	0x4818110e,	0xf5f96874,	0x2f12c993,
-0xfe2b299c,	0x3d417ad4,	0xf5f71299,	0xb9e0a1f6,
-0xd3c15c00,	0xe6fc81e5,	0x41b26e82,	0x14ee1db7,
-0x2eff6b48,	0x4b59c2f3,	0x27650b49,	0xb70eac1f,
-0x3c77f28e,	0x924b1c9c,	0xdb698759,	0x8386ec5f,
-0x11c87ced,	0xec67257c,	0x8d71ca6e,	0xf9e85d88,
-0x929b844f,	0xf4758869,	0x272e9997,	0xd9990b29,
-0x271d98c2,	0xa7c555c2,	0x54883e20,	0x7bbda0b1,
-0x0546ecba,	0x59894e06,	0x0d96ceed,	0xab7a199b,
-0xc3203445,	0x89c2e098,	0xc1c5045b,	0x343a0c93,
-0x629e64e7,	0xa789a25a,	0xa28e41c9,	0x47fe7e25,
-0x90e0b0d1,	0xb7c30217,	0x3cb2d95a,	0xca27bc44,
-0x72f064cc,	0xcdbadcb8,	0xc99b62a5,	0x149bfe49,
-0x5fbf5a8b,	0x31eb5629,	0x6bf3668a,	0x0996e92b,
-0x8c9fb29b,	0x8856800e,	0x40adad9e,	0x9a1834a6,
-0xe7ef61f5,	0xc6d32680,	0xb6033994,	0x3aacc031,
-0x4e84825e,	0xa7447e79,	0xdd79b632,	0xfda899f8,
-0x28b5528b,	0x33de1f7e,	0xab492880,	0x02ebe69e,
-0x8dcbbb58,	0x833e334e,	0x744a2149,	0x85547b7e,
-0x034c1f38,	0x01adf1f3,	0x353beaea,	0x51dc9f09,
-0xc4edc9f8,	0xa0df23b6,	0x1f05af3f,	0x97452b82,
-0x392515bc,	0x2a733c59,	0xa11e6767,	0xdeeac3b1,
-0xcb638c4d,	0xd5d52243,	0x1032c6f3,	0x0ed80e12,
-0x4afcafe4,	0x52c5573e,	0xc5795e1a,	0x4e400d50,
-0xf0133614,	0xc61aa3c3,	0xd1a60000,	0x94e59ade,
-0xc5560cd3,	0x79f4f8e2,	0x0e7781bd,	0x150244da,
-0x428cd2e1,	0x222c39f4,	0x475a02f9,	0xbf9dce73,
-0xff3a14b0,	0x38e29835,	0xb72c499c,	0xcdf499bf,
-0xcf98eb0b,	0x1803509b,	0x4c8ced2c,	0xc923b39c,
-0x0ace36dd,	0xaa37d087,	0x30ad2238,	0x7d051b19,
-0x43e8b4c7,	0xad468a93,	0xe999c950,	0xca9b9e93,
-0x6f04e6b1,	0xea6583ea,	0xee0df515,	0x904405ea,
-0xa45b3af8,	0x279e8ac8,	0x0763c001,	0x66bb3f63,
-0x7fe0f14a,	0x32efe1ef,	0x68bf4ba6,	0x81ba9ab9,
-0x3f5288ed,	0xcffcdc6a,	0x8ff7ca08,	0x701757e6,
-0x16e1ef11,	0x3717fffc,	0xe1b1281a,	0x5946cf76,
-0xdbdb0209,	0xc41f8ae9,	0xcf1c4b73,	0x69e0417b,
-0xe8f17325,	0xeeacb3f4,	0xeb01b99e,	0xf4eba208,
-0x145e1622,	0x2e9fd616,	0xaa5d32dd,	0x7feaee03,
-0x505b67cc,	0xeb94e5e1,	0x177ab300,	0x2ebc3c4c,
-0x05aa6bbf,	0xbf70a611,	0xbbe79e80,	0xe112be99,
-0x54a7379f,	0x18132c4b,	0xf37cc097,	0xb17f1792,
-0x83859454,	0xd49687fa,	0x21372bca,	0xdc6cdec7,
-0x4ef72d47,	0x90539a91,	0x8b5964d9,	0xe9eb0a32,
-0x7985783e,	0x168359d9,	0x66204173,	0x3507843e,
-0xa29d8c80,	0x47a03287,	0x32a18cc0,	0xf455f3c2,
-0xae0c363e,	0xaa1d07a0,	0xa1fde859,	0x0d30d7bf,
-0x2ad9ceca,	0xb553e4cc,	0xc23ab889,	0x2cb4d9de,
-0x5441e14f,	0xe7d4f715,	0xc0a5cc18,	0xca0bd221,
-0x1215d5b6,	0x4b2f3a99,	0x9a660387,	0x9e87f59a,
-0x5758957a,	0xd2dcac46,	0x991ca100,	0xc7b4baa9,
-0xd1f02624,	0x94686298,	0xd33d55ef,	0x7c94ae91,
-0x36df5431,	0x1bc27bf1,	0xd8b56d55,	0x8db4ccce,
-0xa49330eb,	0xf644a0c6,	0xd14fb0c8,	0x69613044,
-0x9bb35ae8,	0x9b645568,	0x21744066,	0xc123cd1d,
-0x0a37ad93,	0x986f9c6c,	0x1eb569b8,	0xe0912ebc,
-0x93862fea,	0xa59cf4a1,	0x83930f0f,	0x82831a00,
-0x368f64ad,	0xb38fe25e,	0xd703a8d9,	0xea4dec67,
-0x3ca5e491,	0x6a1a1ede,	0x71bfd651,	0x585f0430,
-0x8b97c5ed,	0x3f954af6,	0x04ff33d6,	0xef43835b,
-0x45b152b5,	0xa983eb83,	0xe8ca9e17,	0xa9011967,
-0xacd4613a,	0x13329f8c,	0x7155f130,	0xa5fbcaa3,
-0xe12ccc1c,	0x3f20509c,	0x0548cfeb,	0x1b2bb90b,
-0x41991ead,	0xb9566731,	0xf279263b,	0x8da5e1a6,
-0x5e45322d,	0x8f47e377,	0xaedb482a,	0x87e9f8e6,
-0x00947524,	0xa7e0dcc8,	0xabb34885,	0xd1dcd303,
-0x70e251f5,	0x408cb9ec,	0x17d64076,	0x4df80c9d,
-0x2f735ff7,	0x437b2475,	0xbe40e517,	0xcf0826d9,
-0x12adc075,	0x1f90f1c8,	0x9a33610c,	0x3135ac98,
-0xc1f611bf,	0x461e90a1,	0x50d01fb0,	0xe8de5f49,
-0xd70d74f3,	0x66cad8db,	0x461f3063,	0x1ccf8ca8,
-0x5b647b9c,	0x9174cfbb,	0xc54b60ef,	0x641ad89d,
-0x18c40de4,	0x82fd1342,	0xd0e9dd40,	0x97c0a8ae,
-0x8f19cdae,	0x94fbbcb0,	0xf7cc523a,	0xe4056f6d,
-0xd11a9886,	0x4dcd0af0,	0x3eba0d24,	0xbc35f7a6,
-0x5e1e9b55,	0xd9a6a9ad,	0xe826e5ac,	0xcf41712e,
-0xda14027f,	0xed4eb59d,	0xd194e410,	0x596ed5c0,
-0x97fe12e3,	0x7d5c7ea6,	0xf104c5fc,	0x7e3a4fc0,
-0xf50f46f1,	0x5b1a4dc4,	0x678b2de0,	0x4b4728c6,
-0x4941792d,	0xd57a58e2,	0xfa51b95c,	0xd8333311,
-0xf22f80d8,	0x0758ce33,	0xc9e66016,	0x4dd71068,
-0xf3cfdf8d,	0x47aa22ce,	0x06c5bd1b,	0xf42f910a,
-0x5663bc94,	0x02338eab,	0x558e36f3,	0xae1b97d8,
-0x5b4d1db8,	0xf46500d4,	0xf211d2a9,	0x71bd292d,
-0x61bbb9b6,	0xfbd2f77f,	0xd8910476,	0x12fd4201,
-0x047eb58a,	0x9b1b5088,	0x69d12d58,	0x68acd33a,
-0x0e8121a4,	0x05b682d6,	0x7c8c64fd,	0xbe7d5d91,
-0x20d12b3f,	0x0f63c6f7,	0xf3a8b2cf,	0x92719835,
-0x988fef61,	0x1d2e8383,	0xb6b2015e,	0x4b728ef2,
-0x276e0063,	0x0c651aed,	0x5b87ce8d,	0x01b4c408,
-0x2cbec2a6,	0x136cdf72,	0x575d2521,	0x8f188fd8,
-0x172f1f30,	0x80b70377,	0x239b2a97,	0xc75f231a,
-0xcb6ba1fb,	0xb15c58fe,	0x3d182903,	0xdecdec5a,
-0x38a99106,	0xe5dbc841,	0x50d31735,	0xac230e84,
-0x7a3e1dcc,	0xf03824eb,	0xd46166d9,	0x1711fa6c,
-0xb8987575,	0xc0c63018,	0x21e70a2b,	0xd1d9865a,
-0x0351a011,	0xd9ae70b3,	0x9da6dbc9,	0x64002142,
-0x9a143ba2,	0xafec813e,	0xb385eec2,	0xe762b70c,
-0xa3f7cb58,	0x6da88afd,	0xeb86918a,	0xcfa33f23,
-0xeb3445d7,	0x95766c9b,	0x1d172a05,	0xea66e3b6,
-0x089fbf2f,	0xa768c4aa,	0x9a8b5bfa,	0x30c69619,
-0x6641a76d,	0x827b31d4,	0xff2bee87,	0xb1274106,
-0x9a6bad7b,	0xf8093d03,	0xc7e7de22,	0x23e5c273,
-0x11d92327,	0x014e2384,	0xd3f36ef3,	0xa03b2ab6,
-0x469ea5be,	0x1965c8c8,	0xffd41409,	0x22d2edcb,
-0x2cf4de92,	0x68f85640,	0x0d837b76,	0xd10345cc,
-0x27eabb18,	0x4de85487,	0xf951a832,	0xaad7476b,
-0x74f2dd14,	0x30bc2621,	0xbfbc3fef,	0x96c18c9a,
-0xf8e45c8b,	0x2c0ca343,	0x676e3829,	0x933f4b30,
-0x88671fee,	0x1fe89c5a,	0x6b856326,	0x1abe0ca9,
-0xb162a5c9,	0x7983735e,	0x5fa0e048,	0x4a69d1b9,
-0x56011d2b,	0x4f56cff3,	0x62b1b768,	0x4d690e24,
-0xacd72d64,	0xf5578e63,	0xa31958b1,	0x43efff71,
-0x6cb5ce8b,	0xbd5e9b14,	0xa522c571,	0x692412b3,
-0xc1e0c058,	0x786473cc,	0xdfc9e3c9,	0xc5e1501a,
-0xd484d0bb,	0x7d8979e1,	0xd273044e,	0xa73633d0,
-0xfa9f1944,	0x639ad1d4,	0x9877fc4e,	0x7ddba96d,
-0xc4c0616e,	0xde1a6e5e,	0x71cdd617,	0x6b99ee85,
-0x27cc019f,	0x88371a20,	0x1be02a72,	0x80bd7747,
-0x73ae67d3,	0x6c82f4cb,	0x0a10dfb3,	0x1276326e,
-0x3fb8b0ad,	0x9aefa740,	0xbbd55ecd,	0x144146b8,
-0xa113bcb2,	0xab221fbf,	0x546b07e1,	0x04cc6e34,
-0xc5881158,	0x706b98de,	0x15fe7a47,	0xb37fa40c,
-0xae60402d,	0xe883bc80,	0x7d75a155,	0x1c704783,
-0xa2b9b905,	0x788ffafa,	0xe5c6d2e0,	0x6ed326a5,
-0x2e671513,	0x2738d902,	0x48834b77,	0x515ae5d0,
-0xfe196599,	0x8eac0ed8,	0x493de188,	0x4ced0f10,
-0xef495d50,	0x1c8c11c9,	0xd72b7ad0,	0x6538db01,
-0x28ab44b1,	0xf9027d82,	0x1bd0577c,	0x11cb527c,
-0x3b27596a,	0xd661d021,	0x65e68d72,	0xa362b46e,
-0xee0971af,	0x951f95dc,	0x61fa39af,	0xab0cc9b9,
-0x1b3bfaee,	0xd0a60a2f,	0x528e0c41,	0x8ab00ea1,
-0xfd0f286b,	0xc632b071,	0xc30294a7,	0x1e26a083,
-0x5a54078e,	0xe654c188,	0xc8ee1653,	0x3010c906,
-0x39dc7054,	0x4f0c1261,	0x449fe785,	0xecab6a6b,
-0x213bfe2e,	0xe4c6f00c,	0x8eb07821,	0xe8ff2e93,
-0xbe567ba2,	0xf4160cac,	0xc98728a6,	0x045ae96a,
-0x83fbe2f7,	0xecfa20e9,	0x1f6fce35,	0x4bed73ad,
-0xd51a6875,	0x6662b906,	0x5bfaec0c,	0x03db85a6,
-0x56692fda,	0xedc67ad2,	0xd0fe4baa,	0xdaf2507b,
-0xde7c400f,	0xc18897cf,	0x47c04fd9,	0x1ffc9b24,
-0x5a35be70,	0x12f845ad,	0x2ebc0dd2,	0x6fecbbd2,
-0x53fc663e,	0xc957a130,	0x9c194624,	0x9a500a78,
-0x217f895c,	0x99da1f18,	0x804614e6,	0x839274d6,
-0xe70a25b0,	0x3a61b3ae,	0xf4caf190,	0xfdb5166f,
-0xccf9e73f,	0x6a24a966,	0x1a53d75d,	0x19e68fa1,
-0x205c583f,	0xde045830,	0xf01d917e,	0xbffd767e,
-0x2024d57a,	0x47163d6e,	0x86b38732,	0x282c8f9c,
-0x7378559a,	0x45dc6404,	0xa9a5ee57,	0x24919062,
-0x3f8069f0,	0xbbebed07,	0xaea56958,	0x9664d2d3,
-0x9a48aff1,	0x04e9fa40,	0x9ffc45e6,	0x4c14d117,
-0xc3077e50,	0x016f73f3,	0x165a64be,	0x4440bbbe,
-0x7840fcd0,	0xc1f4a2d6,	0x56729873,	0x08ddb438,
-0x6d13b48c,	0x0f40f626,	0x06807ab9,	0x7a575f43,
-0xef5d43a9,	0x620a9fe5,	0x3419dfba,	0x86fafb2f,
-0x999a7b40,	0x2f923040,	0x5b80d46b,	0x3a002116,
-0x49829ffc,	0x2239340c,	0xb9b063cb,	0x46922d44,
-0x86e5d048,	0xae719338,	0xfe7e7936,	0x8c94bf6d,
-0x587f5cc6,	0xbf6ff0a1,	0x14d0f12b,	0xd7bdfcba,
-0xe8908def,	0x32d08043,	0x708194bb,	0x4b9a9dfa,
-0xeff352da,	0xf3088842,	0xbd617295,	0xf90e0a98,
-0xa579a690,	0x939dfc23,	0xd896560f,	0x8e0454ed,
-0x2bf14e16,	0xf86bec1b,	0xca5e6724,	0x27b44d2c,
-0x36efe253,	0x5a40e0d0,	0x891d2354,	0x66794b58,
-0xd19b490e,	0x7adfd7f4,	0x81bd700b,	0x1b7b1c39,
-0xc8c27a49,	0xe55957af,	0xa200f22e,	0x1513e630,
-0x5c22274f,	0xdfcf1977,	0xc25efc43,	0x97d8c849,
-0x085fc28a,	0x8bd99f79,	0xacf9b6d6,	0x2c8e5105,
-0xa853d807,	0xc5cc2ab3,	0x770cad5d,	0x341655e7,
-0x73af0472,	0x47189361,	0x666002e9,	0xad0c8d0d,
-0xca1daff1,	0x466863d1,	0x0e03fcba,	0x0540c799,
-0x32263d84,	0x49207fb8,	0x69fa2acc,	0x6fb943c2,
-0x2f7cec7e,	0xf0eee345,	0x8cd6167c,	0xfedc8ba9,
-0x4c0c81f0,	0xe2465dbf,	0x196fdbc3,	0x4179df4c,
-0xfe3a0bff,	0x105bce11,	0xcecae839,	0xefbf4abd,
-0x7340ac0b,	0xf20928d9,	0x9afd8882,	0x8713b311,
-0x4f6dd3c0,	0xad921e2e,	0x717434f7,	0xb8463091,
-0x0ce295e7,	0xc38c6a55,	0x16e48e28,	0x27444bdc,
-0x47370754,	0x622f18d0,	0xd1210799,	0x67de0531,
-0xa6e5c785,	0x86a801b5,	0x405d33c4,	0x59dfdf7a,
-0x4ec49bd3,	0x18068d3a,	0xcbf720aa,	0xe3b37191,
-0x11b6f7e4,	0x8c015526,	0xf75dce7b,	0xb0fe290b,
-0xe5cae19c,	0xfde92be1,	0x78155b31,	0x9257619f,
-0x0da18a09,	0xea98832f,	0x34eb0ebc,	0x7bbffed4,
-0x8bb52f6a,	0x752e26c7,	0x0c268fe0,	0xd0512fd5,
-0xdaaa16df,	0x8b567986,	0x33f0a7c1,	0x5479080e,
-0x347b8d2e,	0xdb56fd9f,	0x0b0bd7cc,	0x83a0bb77,
-0x9dfd7320,	0x19f9ed59,	0xed13b232,	0x434494c7,
-0x92d6daf1,	0xe03bc1c2,	0xe2099636,	0x7b3d5261,
-0xd11c7151,	0xaa197ffb,	0xd978054b,	0xcf825914,
-0x8e23bfa9,	0x9148a70d,	0xa4d164e5,	0x301f6dcc,
-0x2f715b1c,	0xb300c085,	0xfceb2559,	0x1f084e6b,
-/*  2381-m406f769.inc  */
-0x00000001,	0x00000069,	0x09172007,	0x000006f7,
-0x4e779cf4,	0x00000001,	0x00000040,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0xc8c262f4,	0xaf3e2b58,	0xffb85691,	0x37176b6a,
-0xda8214a9,	0xc589d723,	0x955d8adc,	0xebf6dde6,
-0x603ea97b,	0x9aaf8ddf,	0x1a4f99ba,	0x2bb46213,
-0x457c0e43,	0x52b12095,	0xbea57bba,	0x539215e6,
-0x87761b6f,	0xbe123f4d,	0x2eebcfd8,	0x508374db,
-0x4b379fa7,	0x27b0b1df,	0x16a3d4a9,	0xd7cd9ae5,
-0xbd40b857,	0xb8d6dfd5,	0x6e3e5f22,	0xd9e99573,
-0x9feeac99,	0xcb522725,	0x39167848,	0x7cfdaddd,
-0x8c45ccb0,	0xd3f11c87,	0x64fd55f4,	0xe53bd280,
-0x97440a2f,	0x19b7b8f7,	0x78fbee9b,	0x806616a4,
-0xa4e7267b,	0x8ccbd157,	0x13d4b457,	0x859a6169,
-0x05cd40b6,	0x7157c954,	0x44857455,	0xcf2a8c25,
-0xc6fb5f83,	0x97820f5f,	0xc6fa3e62,	0xf52fda3b,
-0x00eec237,	0xa34d0f5e,	0x63b31adb,	0xb4922d9d,
-0xa826fe4a,	0xcdae9df2,	0xc7fb4011,	0x6fa41ef3,
-0x65de08e4,	0xf405be1b,	0xfea32384,	0xbefaecbb,
-0x56ec5b78,	0xd29e4663,	0x64e0702d,	0x9cadc43a,
-0xfee8e4e9,	0x6e776cfb,	0x28f86258,	0x3ec87236,
-0xeba58f3c,	0xd4966f6c,	0xcaabc6c4,	0x25782c7d,
-0x17007930,	0x8a9f3c13,	0x1e9842dc,	0x31f6a225,
-0xc0b20b8d,	0xef8e129e,	0xb537896b,	0xdc62f098,
-0xfa19e05b,	0x4b85ebaa,	0x71c05717,	0xa211e54b,
-0x9ad57b82,	0x275c77e2,	0x3c2d3207,	0x41a4735f,
-0x4ae5448e,	0x1a984ee2,	0x8f9dcff7,	0xa2f7b4fc,
-0x8d807156,	0x8c7299c6,	0xe8f29d33,	0x60f5f7dd,
-0xe21ee1e2,	0x36d3eea7,	0x89413378,	0x0711067f,
-0x6980d2d7,	0x699020f3,	0x5cacc477,	0x9dd66dd7,
-0xd657ff2a,	0xa04eaeb5,	0x3478cac0,	0x487fd6cd,
-0x398dfce4,	0x89bf90bc,	0x22d8c1d2,	0x02acc684,
-0x8ff16f07,	0x1dbe7919,	0xed8ee206,	0x3d6d6a36,
-0x987cf1f5,	0xed743a25,	0x905f11af,	0xac5f3185,
-0x392bbe45,	0x32e59314,	0xbde9f0e5,	0xbdda44b0,
-0x6dd078cd,	0x3b5c4d4e,	0x47b48733,	0x4e3a8ca2,
-0xb7f6df78,	0x94e8d403,	0xc737dfde,	0xdb90d991,
-0x09a1976b,	0x4c8c9115,	0xb591d94e,	0x63e76efe,
-0x356271e1,	0xe0747963,	0x78b2dc3d,	0x05469e8b,
-0x30c92050,	0xae7dfab2,	0x3942e785,	0x99d36dd9,
-0x2e033e50,	0xc3fae7bb,	0xc1334065,	0x8a1e7b14,
-0xc97e6879,	0x3a620fb9,	0xac1e7c18,	0x5b5a6c58,
-0x89312764,	0x08f41565,	0x800ae942,	0x12d47b83,
-0x55600299,	0x50a3e02f,	0xf02db208,	0x779255f9,
-0x5ce13e50,	0x40e62354,	0x7c8eb083,	0x1063ece2,
-0x30421ddc,	0x3f2a76cd,	0xa9bb3c7c,	0x7dadc236,
-0x6a57f6d0,	0x433eeb9d,	0xb495e0d0,	0x31a6b14b,
-0x78196982,	0x6f6764a6,	0x2b2404a3,	0x0643cfe9,
-0x566cf4d4,	0x2b47c9e7,	0xca6da375,	0xcb396117,
-0x5045973b,	0xe10bdcd4,	0x7a484949,	0x9828c2d7,
-0x25a89305,	0x260cce74,	0xf61f5b26,	0x3cc150e5,
-0xc48f0bb2,	0x0e066d67,	0xf1865a1c,	0xc7b94ee1,
-0xe23d20bb,	0x5642d1b3,	0xaac24ac9,	0x581218c1,
-0xc09394a0,	0x544a38fe,	0x1737c1f8,	0xaf28fd90,
-0xd05bc62c,	0x0cea3cd2,	0xe808ece5,	0xaebc9448,
-0xd35c4afb,	0xd987fb71,	0xa7669b86,	0x5d24edc6,
-0x44b630e5,	0xb8e9724d,	0xd13ef44b,	0xb0deb768,
-0x6b8c7b57,	0xe83f5a88,	0xf5847bde,	0x837b62c6,
-0x2291ea62,	0xb1ed5172,	0xd58984cd,	0x6127142a,
-0x1fd80fdf,	0x3174500c,	0x3c337bef,	0x23ddc5af,
-0x40c0faa8,	0x02bdd1fd,	0x14cc4d7c,	0xeca7e237,
-0xcef074c2,	0x4359eced,	0xac4bf265,	0xd09c002f,
-0xabd8ef91,	0x890b1e7c,	0x95639eba,	0xa0dad747,
-0x060f7739,	0x0a7f675d,	0x044459c5,	0xb1d2ea6c,
-0xfcf7a75b,	0xa2560237,	0xae4c9acd,	0x930e40ea,
-0xa8b2c2dd,	0x657a0c99,	0xc3a721bd,	0xefecae8e,
-0xde5d1b90,	0x64230532,	0xf5b37ad3,	0xb34f1d88,
-0x7dbfb263,	0x6d8486b0,	0x703f5c9d,	0x36eb2571,
-0xc2940ef4,	0xb24bd011,	0x0827bfe8,	0xe7dd58a4,
-0x79fdb76c,	0xfaeff06c,	0xcb5e3de4,	0x54de184f,
-0x83ce6b32,	0x243c665a,	0x6c785c26,	0x28f88347,
-0x1b14e52b,	0xc489f983,	0x0ee1daa2,	0xa1e1c6bd,
-0x19d47eca,	0x39827cc7,	0x1d36dcdc,	0xcb741131,
-0xdaf56577,	0xd3ee6290,	0x259695ca,	0x2769ae6d,
-0x63109c94,	0xe68e77fa,	0xa147f000,	0x457af6f5,
-0xea812632,	0x23adac03,	0x8c0ec893,	0x89307048,
-0x4e237a5c,	0x3ee6f784,	0xfb51c8cf,	0xa8f62ec5,
-0xcef53a16,	0x62f4f325,	0x0007d164,	0xbc8c92b6,
-0xc7debef4,	0xa46d2d21,	0x22232f4f,	0x7b064901,
-0x5b69f49d,	0x1cf5cfd1,	0x395184d1,	0x7748d1e1,
-0xe843ae68,	0x5e4feb6a,	0xd6f91e9a,	0x5976450a,
-0x72befef9,	0x6bb0ba92,	0xd41d8e98,	0x91f2428a,
-0x74102a90,	0x97c45f3f,	0x65a94ea6,	0xa21c4f15,
-0xae89417b,	0x53443878,	0x681b766f,	0x2538df36,
-0xa76f327e,	0x91d19797,	0x37ae54d0,	0x5cee2a7e,
-0xa6019d14,	0xc0e21a17,	0x955af21e,	0x3cacd721,
-0x2b381505,	0x2a49584c,	0xac2af949,	0x092e6946,
-0xcb24706f,	0x60f5ed1f,	0x20bf6f0e,	0xbef94bbe,
-0xf12c1bc4,	0xa6092fa8,	0x09534dce,	0x45d869ea,
-0xfdb0b147,	0xa5f7568c,	0xc4b9820f,	0x236efcae,
-0x06e1144f,	0x36498c2a,	0xd41cd998,	0x0624a018,
-0xa536aebb,	0xcaa6dea0,	0x0fdf7c60,	0x46e185c4,
-0xa764400f,	0x0271805b,	0x6e9fa85e,	0x5e6e4c76,
-0xc1fd4fc9,	0x17597b33,	0xd8396e3e,	0x8edceb6f,
-0x480da81d,	0xecf5ec45,	0xe813da33,	0x4d5b6ba1,
-0x891460b6,	0x01093db7,	0xb7665f0a,	0xc6d99863,
-0x6ca28f96,	0x1a74bc38,	0x043a8b7e,	0x4301146b,
-0x04deb40e,	0x8c3a86de,	0x0185f532,	0x2f3ea326,
-0xd3613a71,	0x5a353367,	0x37ec76f5,	0x11672cf8,
-0x649ef06c,	0xd2a92c6f,	0x3bdb5372,	0x6debe631,
-0xd4c3fb21,	0x159c1239,	0x47bfd8e9,	0xa00f6eb7,
-0x59862e6a,	0x6d5a4902,	0x346cec3d,	0xda23310b,
-0xbf7d5f70,	0x57d716eb,	0x1e6c229a,	0xcb51fb67,
-0x40f0bf3b,	0x8759cb94,	0xe2e4727b,	0xa087e1d9,
-0xf62bbbb3,	0x08e91708,	0x142bc6c6,	0xf010109c,
-0xe861cac7,	0xadabb0b7,	0x0b550bfb,	0xb6e79d0a,
-0xa6f20b8e,	0x8680ab31,	0xbb130ef2,	0xe6ea8723,
-0xbab6ebe2,	0xa11975de,	0x28c5b0c0,	0x5f28330c,
-0xe1a4a2b6,	0xb387cc95,	0xf368e7ba,	0xde0d3d88,
-0xd62d48fe,	0xf7715ebd,	0x31e432df,	0x639f1f2a,
-0x06b8de5b,	0x0aa3d9e7,	0x1e813f0f,	0x112212ac,
-0x136f2701,	0x13d58f31,	0xb4d22d07,	0x012576f3,
-0x795c943a,	0x6f6b419a,	0xf54e26a8,	0xbc94605d,
-0x889bbea2,	0xc2bb5d4c,	0x896573a9,	0xf0862d97,
-0x67b1ed18,	0x0dc64dfb,	0x3ccfc9ea,	0x987bd7bf,
-0xe9aafb49,	0x760c693f,	0x331721cb,	0x3cf4473d,
-0x0493cdbb,	0xa319be13,	0x0e280d97,	0xafc31837,
-0xa3246067,	0x0fbeb037,	0x48a32b43,	0x3843b479,
-0xc6a17c13,	0xe37707aa,	0x9779713f,	0x1b3e9a3f,
-0x80f54ef6,	0xbc28fead,	0x7aad3334,	0x690e6843,
-0x3e6953c7,	0x667bc8c3,	0x8c75819c,	0xa4752261,
-0xd045b4e0,	0x420f7ea3,	0x78f9c7d9,	0xb26af8f0,
-0xa758de96,	0x52344fec,	0x276b48fe,	0x9824567c,
-0x98c56888,	0x85d9692d,	0x079e2ca4,	0x0e421ec9,
-0x2e0634ba,	0xf5d84dd7,	0xc31e7500,	0x4c29cb36,
-0x37bf0924,	0x00e8eecb,	0x4231ccab,	0x092e515d,
-0x70215cf2,	0xf50f4e93,	0x4c57d581,	0x077458e1,
-0xb4db8e49,	0x6e23ffeb,	0x59ed0cad,	0x47b580a0,
-0x1cff6770,	0x223f5630,	0x0a5293c6,	0x2c95a85b,
-0x88ed30cf,	0xc3b94d6d,	0x77397476,	0xba74703a,
-0x1d32b740,	0x32ebcdfe,	0xc042c44b,	0x25ef75b5,
-0xaa6c94e0,	0x17711e94,	0x053f729d,	0x193ac3ad,
-0x1b849012,	0x7bd66e5e,	0xb012f683,	0x20f07ddd,
-0x3078cb97,	0xa257bfc9,	0xaa18ad84,	0x29db62f1,
-0x40fde5e7,	0x70f68dab,	0xaf0e6afc,	0x92c4fb07,
-0x45be88eb,	0xe5502287,	0xf9fb6286,	0xb38524c1,
-0x42f587db,	0x9120bac4,	0x4648b401,	0x46a6dd56,
-0x6fe59481,	0xbe0bf594,	0x97fc271f,	0x24847776,
-0x4b2c1cab,	0x512ccca5,	0x52b32399,	0x6a45b81d,
-0x377a21d2,	0x89f876a8,	0xa0bc9ea4,	0x4ae10052,
-0x46a452e9,	0x5a8513a3,	0x3eb3cfe6,	0x3b29d2d6,
-0x913c030f,	0x0a8fb4af,	0x5f1d9ec0,	0x1b80eec7,
-0xe2d47560,	0x4741a0f1,	0x1a8329b9,	0xd0d6d7dd,
-0xe6dcb11f,	0x3884af15,	0x80125d63,	0xde9e0b52,
-0xa488a326,	0x7ffeb1dc,	0x0d80179a,	0x2162b0c4,
-0x5df6e6ca,	0x4c5acaf2,	0x63253910,	0x6926afeb,
-0x70e91519,	0xf172affe,	0xb58059d5,	0x83a9c9bc,
-0x80d339c8,	0x79d961c3,	0x709ccbab,	0x9f5f32c0,
-0xdd816af3,	0x842fc048,	0x46fbf129,	0x7a2f0495,
-0x104e5f40,	0x19efba34,	0x64982e8f,	0x76bca689,
-0x0f2717b1,	0x56643869,	0x48e42c54,	0x5aa00ac4,
-0xddb45c48,	0xd7b5c02a,	0xdc3ec963,	0x2608949b,
-0xf4c77d4b,	0x6d5ba22d,	0x670ffe14,	0x9f999188,
-0x7a25ff7e,	0xb2da6285,	0x75513c5c,	0x8b27c275,
-0xfd721e86,	0xda8e2c90,	0xc39e8c9a,	0xad8f47e7,
-0x39529e14,	0x4f196808,	0xb3b3b14b,	0x2cca6974,
-0xb7c84fe1,	0x0b98cd21,	0x71c2dedc,	0xacd1d92e,
-0x3dd3b6dd,	0xb93a0031,	0xd5fbd8a5,	0x9e1ef6ad,
-0xd406500d,	0xf1abe592,	0xeda8d1a6,	0xdd25ee95,
-0x6bb072e5,	0x5c0ac5d0,	0x42dbee39,	0xcca76d1b,
-0x18ee78fc,	0x5fd26f99,	0x366ab232,	0xe2f511bd,
-0x41835cd3,	0x9976967e,	0x1731ed57,	0x5b175f03,
-0xca96195a,	0x302e8c64,	0x5e8805e4,	0x3eb5bcca,
-0x1eeb6d77,	0x9467eecb,	0x2fb2fd5b,	0x53d01637,
-0x684795d2,	0x8c1eb085,	0xa81e175c,	0xd6e97ab1,
-0x079eba05,	0x320a8414,	0x9c4dc2c1,	0xd45247e3,
-0xc528c31f,	0x8bd981e2,	0x69800473,	0x8f8e46c9,
-0xc6b90d21,	0x0a5081b4,	0x2cff7dfb,	0xaafd8bb3,
-0xf9172eb2,	0xdddaf3a9,	0x7e20392f,	0xaec06fa0,
-0x301657ff,	0xb2204a88,	0x796d46d2,	0x24b39297,
-0x7b5013c0,	0xa858aa4e,	0xeca0b835,	0xba9a55ba,
-0xaab680ea,	0x702e24ea,	0xfec03648,	0x4f63c3ac,
-0x4981c3d9,	0x7cbbc936,	0x70f159ef,	0x23cc02f2,
-0x23e0a0e9,	0x28ea4632,	0x92cf78e7,	0xfdf45b4d,
-0xa0d0171d,	0xe811909f,	0x3be83784,	0x932c14bd,
-0xb3bc895b,	0xa1ee1399,	0xde0ce7d0,	0xaa4a8606,
-0x2f93c916,	0x17e8004a,	0x95e34d47,	0xd7e039ee,
-0x9397fbb4,	0x57023723,	0x66d5b72f,	0xf58e8181,
-0x958082e1,	0x82ee9723,	0x995b1577,	0xb519154d,
-0xb8bf7dd2,	0xf9311c7f,	0x1b1bbc78,	0x4f352ffc,
-0xaab3b8a8,	0x7aecbb63,	0x8accee57,	0x66db792b,
-0xe211b7a2,	0xc8f3f756,	0x4c18e95e,	0xe7a78e26,
-0xe9a98c86,	0xeb6f152a,	0x16b5f4a7,	0x5a6e37f4,
-0x4a20435a,	0x80efa08f,	0x7048030b,	0x372abe74,
-0x7ef0b427,	0x4f9aec1b,	0xff5d2148,	0x33970d2d,
-0xfa009f9a,	0xfd0437ce,	0x01d30808,	0xd38ed908,
-0xb4837dc3,	0xe1bbe7d2,	0x049632a5,	0x702f1f6c,
-0x8eca33a9,	0x8b691c43,	0x1a5f5681,	0x980cce54,
-0xfdc3aa8f,	0x9d103356,	0xcc2e6bee,	0x2d81ba6e,
-0x493f266b,	0x7f78b2e8,	0x45bad0a9,	0xdee465a8,
-0xc7519329,	0x827b2df3,	0x6c432be0,	0x6a0248be,
-0x9dafc378,	0x21744a65,	0x002e2c2f,	0x3cb353c3,
-0x7350ea72,	0x5d255da5,	0xaf3f51cd,	0x9dde24aa,
-0xfae42395,	0x2feff6ee,	0xafd18dee,	0x87fe0cf5,
-0xa7927da5,	0x49f11c98,	0x0b58497a,	0xa66e42fc,
-0x94947302,	0xd442d522,	0xe340db02,	0xfe4b3d12,
-0xd7f8ce19,	0x31ef991d,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  1470-m9df4703.inc  */
-0x00000001,	0x00000003,	0x04212005,	0x00000f47,
-0xaf2cef0d,	0x00000001,	0x0000009d,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0xc2f82df4,	0xcc1f8c6e,	0x0e8a805d,	0x8e748392,
-0x61d74f4e,	0x45c7e2e6,	0x2a47a317,	0xcc8680ea,
-0x6afb5d2f,	0xe61b30de,	0xccf8ce6c,	0x063cd5a3,
-0x992e1a8e,	0x917e2495,	0x0ec78d26,	0x3b11a087,
-0x5cfd497e,	0x712e7a69,	0x19023605,	0x7e2d5382,
-0x86f0ea44,	0x34c2dfe0,	0x111466d3,	0x1ca2dea9,
-0x2db035cc,	0x0d756649,	0x5d817ad0,	0x8260bfd2,
-0x8af6da2b,	0x6b6e56ed,	0x416d4cec,	0xd46eed66,
-0x46895ede,	0xec4fa389,	0xfb2e5b37,	0x31191653,
-0x899d2459,	0x969ba9a6,	0x2fdbd429,	0x00f926cf,
-0x1763affd,	0x74ea8cf2,	0x52f9e657,	0x4a7b2371,
-0xf5bca7c1,	0x6bcf1744,	0x5d3cb914,	0x5a2c0b69,
-0xd4d6711b,	0x6379e8b7,	0xf7def9d8,	0x88fbde4f,
-0x25c24564,	0x74fad07d,	0x68b6d12d,	0xd81b2962,
-0x5f8114bd,	0x8b8c7590,	0x123f0889,	0x7c350756,
-0x29440cf1,	0xa88333c8,	0x28c0b737,	0x7ea33d12,
-0x9878f652,	0x4f41e6a9,	0x3e109379,	0x5f6af51b,
-0xa3efee81,	0x18934e5c,	0x3bea09c4,	0x04b1f649,
-0x51e21d0b,	0x2cdc6b67,	0xa93ae5f2,	0xc809a230,
-0x93886909,	0x6bf788b9,	0x537391b5,	0xf0d7ef26,
-0x71032e3d,	0xb1ab4d8a,	0x364c1a73,	0x333faac0,
-0xe9ddc147,	0xec43d38a,	0xd69e9a38,	0x77dd0b85,
-0x63798cd3,	0x6ffd694d,	0xbe947f6d,	0x0bd2df58,
-0x3f4be601,	0x29753e63,	0x3f1db162,	0x1fa0bffd,
-0xbd085ff4,	0x1627b890,	0x1f82c7c5,	0xabe18ae5,
-0x6babcabc,	0x046aa047,	0x860ac96e,	0xd957718a,
-0xf6a01a82,	0x827a81e1,	0xa4ffb338,	0x257e2b69,
-0xa2ceba96,	0x91103b49,	0x87a44f56,	0x1cf230a5,
-0x030467ae,	0x2b9476f0,	0x86a60c79,	0x45dca4ba,
-0x8eb41f62,	0x6d006ab5,	0x79274a6a,	0x6de0d4ab,
-0x3310417f,	0x7b8206fa,	0x35e20f1f,	0x0e41b2db,
-0xb877daa8,	0x36be9c48,	0x70e7a9ca,	0x58911f5a,
-0xabd853cb,	0x631286bd,	0x35714af4,	0x3d7eb1d8,
-0x220dea6e,	0x21ed48f8,	0x917d52ab,	0x9cc0abf3,
-0x4a7efd32,	0x7be24674,	0x9132e702,	0xc2b3e4fc,
-0xae649b47,	0xd2caa94d,	0x2cda267e,	0x6e6b04c5,
-0x9a440677,	0xd891c1b4,	0xecd4c280,	0x38b4e552,
-0xd9b5a94b,	0x2a8cd551,	0xdef56497,	0x2a4be3d4,
-0x9595e71f,	0x568721a8,	0x95d7a9fa,	0x51ae4f9f,
-0xd42cda31,	0x2057ce0a,	0xf12c4ad2,	0xd131172f,
-0x799d557e,	0x1f85fb72,	0x1a30f80b,	0xa81945dc,
-0xdcfd4ea8,	0xe501109a,	0x8164abc7,	0x42bc7828,
-0x0514889a,	0xcc4f3d70,	0x8fef5410,	0x01d78e74,
-0xa5563afe,	0x3add8b75,	0xdfd82e52,	0x2022a5fc,
-0xf56d7378,	0x37731dca,	0x4c60bcb6,	0x29170df7,
-0x56c20033,	0x75b62940,	0x7ad58af9,	0xde25154c,
-0x27dfd9ae,	0x208a894c,	0x51e81496,	0xc69d1dfa,
-0x81d27b5c,	0xca12f782,	0xefd7d0b3,	0x3beab01c,
-0xbc0eef39,	0xa5d7f2cf,	0x7dc4d451,	0x7069fb06,
-0x45cb04f0,	0x1b5fc96c,	0x3cfb526c,	0x22495be6,
-0xb0db5a44,	0x6aa6e09e,	0x63cf88c3,	0x44c49559,
-0x2ea01cc0,	0x158d1203,	0xe0c8163a,	0xa076e84e,
-0x873ea544,	0x51013068,	0x90d921df,	0xafb9ec15,
-0x632a74d8,	0x8e870b20,	0x46a34395,	0x74534f55,
-0x4002ac22,	0xbe7dd5b4,	0x913d7ba7,	0x77a0f6e7,
-0xa3776b10,	0x00d73ac2,	0x72ec8ccb,	0x5c65d930,
-0xceabd7df,	0x4586999d,	0xdf9c7e24,	0x1ffb96ff,
-0xa945e189,	0x6f879555,	0x32aba213,	0x5e5f0ee5,
-0x70e43350,	0x647279b7,	0xd4612221,	0x2c266f6c,
-0x8576cd5b,	0x07047e7e,	0x10c377a0,	0x619d63b5,
-0x21577c07,	0x617f97d7,	0xd95ee11f,	0xaf3eaf45,
-0x2ac47d03,	0x5cf0d549,	0xf88a5dc6,	0xde12658e,
-0x3e0fe2b7,	0xa5c883a0,	0x2c7670f8,	0x1ae5adb7,
-0x0f7088ac,	0xeb5d1237,	0x17a2083a,	0x5de19b6e,
-0xdf26bdab,	0x74176916,	0xe05319f2,	0x3d505666,
-0xf7450820,	0x639bbc84,	0xc578452a,	0x4bac0414,
-0x27e5d857,	0x4a7e7aa5,	0x2ece3ca9,	0xddd01d5c,
-0x72909add,	0x32221600,	0x5bc02aa4,	0xe138a34e,
-0xf375796b,	0xe28b23d2,	0xdb427098,	0x5a1f4e73,
-0x33a5905c,	0xcb2b57bb,	0x4c480095,	0x2cd64244,
-0xe924481b,	0x68fa0d30,	0x0a295560,	0x4cadc133,
-0x02ab2b81,	0x493ff0e8,	0x8a905491,	0x5ffabb8c,
-0x3894736b,	0x35ec4d84,	0x0835a1b1,	0x8b02df2c,
-0xab53d500,	0x7582c169,	0x6ae766e1,	0xd75da68c,
-0x14f541de,	0xf74512d5,	0x6e722764,	0x3e9c3d92,
-0xabde8a97,	0x957ab2d8,	0xc6f26229,	0x75fa317f,
-0xb14c870b,	0x7911fe5e,	0x3025fd3b,	0x65bb7420,
-0xb4e1a2cd,	0x0ddc8170,	0xd68102c5,	0x560c25bf,
-0xe54e94b9,	0x1cb3f345,	0x5e0bf4a2,	0x8774fe3e,
-0x392a77de,	0x1ccc14e5,	0xb53b4fdc,	0x8536f959,
-0x72a7db1d,	0x822b6030,	0x17604ab3,	0x6dd9537d,
-0xafe21a4f,	0x93a65eb9,	0x55173802,	0x559cf7a1,
-0xc13c20c1,	0x2909dfe8,	0xbd67d285,	0x2345c952,
-0x62c9eaed,	0x7ad7d3cf,	0x1203b5c0,	0x706ff9f5,
-0xb2e709f5,	0x0176239d,	0x0d1fdb60,	0x86d85cc0,
-0x2000141a,	0x2ae2cda8,	0x668864df,	0x802503c4,
-0xcda13b39,	0xe2a90e69,	0xf7a857de,	0x70cd90f7,
-0x76dfd0bb,	0xef748228,	0x05a80fb5,	0x6c916906,
-0xa186faf5,	0x09b3f6df,	0x07ac9a86,	0x0bc02765,
-0x6ac940c6,	0x6dbe2bdd,	0xd173be7e,	0x5262b01a,
-0x63394c1c,	0x5e9fa5b8,	0x047d32b3,	0xc145798f,
-0x9baf5b51,	0x0611666d,	0x8ef11917,	0xb080c5b5,
-0xa296c219,	0x9d380d47,	0xc8c15757,	0x5d2854a5,
-0x664bea43,	0x9380ae2b,	0x5dbd12fe,	0x75cb9799,
-0x476b278d,	0x051c6fcf,	0x0069c985,	0x4550dc3f,
-0x05917659,	0x1ca91e59,	0x3f9a7668,	0x5e32f534,
-0xf8189e65,	0x49eac6b6,	0x9f05bd02,	0xb4808883,
-0xba55bc74,	0x6da7ad18,	0x5cb8e1be,	0xbd451bf7,
-0x488cb3a6,	0xbc90c9cd,	0x264679a2,	0x59dd789f,
-0x12811426,	0x81c3cd79,	0xf39e8dca,	0x33b6fc1c,
-0x200eb4e5,	0x1b0dc455,	0xa5cd6307,	0x469cb2b9,
-0x5918074d,	0x53202e4a,	0x271c8b79,	0x5c05a629,
-0x645c0d01,	0x056c2d2f,	0x91850195,	0x9b95d3f2,
-0xfe760e19,	0x131ea846,	0x5f02fda1,	0xbee758d8,
-0xea1b1a1c,	0x9c0847d1,	0xfe534f41,	0x34a6bc3f,
-0x782a53ba,	0xeb118177,	0x0231026f,	0x7c181da4,
-0xba99d566,	0x63b3e9e7,	0x47d37a5d,	0x0a3dffd8,
-0x479e6773,	0x5e6da4f4,	0x1d354ecd,	0x742eb5b2,
-0x33027d7d,	0x078f2b38,	0x56bbae65,	0xcae0a598,
-0x303ffa02,	0x665b0971,	0x6d32d6ff,	0xe5581657,
-0xc003279b,	0xfc4e6ba9,	0xe3567dde,	0x37afd1c9,
-0x8e928c52,	0x8db2e4b7,	0xad0eb068,	0x19258691,
-0xae5c03a2,	0x468a97cf,	0x8cda06d3,	0x2263dcff,
-0xaed65f19,	0x05b00086,	0x5a9e6281,	0x43b65e6c,
-0x7eaa6443,	0x31bab45c,	0x51a9c54c,	0xde8ae47b,
-0xd60a95cc,	0x1ba74a4c,	0x330827b2,	0x9b8df9ef,
-0x0e74dd2f,	0xd6c9e271,	0xd0b77195,	0x10f6ff80,
-0xf5b229c6,	0xc0fbf468,	0xdd616994,	0x35730277,
-0x838da982,	0x28349728,	0x7b3a8b72,	0x2a4e3942,
-0x04e3d703,	0x18684df3,	0x66ada9af,	0x52caad42,
-0x3fab8e47,	0x7bfce626,	0xe231de2b,	0x8d48cca0,
-0xa33962ca,	0x22261b94,	0xc9521872,	0xa7119363,
-0x547d93b0,	0x916d5807,	0x1b28e860,	0x1bedc9d8,
-0x50eb8ae2,	0xa1f78b7d,	0x93ec5d30,	0x99d0907a,
-0x5d4eb7e9,	0x5bff668f,	0xbed1cddd,	0xd6855c2f,
-0x080d4077,	0x9380ed95,	0x44fa1c58,	0x5bc86778,
-0xe4043eb3,	0xdf55407e,	0x1a2ccc36,	0x0c237745,
-0x951f59f9,	0x4c7c0e1d,	0x194bc507,	0x30047f1f,
-0x4be6bdfe,	0x3cb966b2,	0x4c4a97e8,	0x3e2feeab,
-0x5307c0ab,	0x6ce6928b,	0x2ef9433a,	0x889f8123,
-0xd1714dde,	0x0ee72b88,	0xfa057aa1,	0xb464b160,
-0xa01557ea,	0xbad0c31d,	0x86525519,	0x2626f1f7,
-0x4562675a,	0x925acdfe,	0xd4056b9c,	0x7832aab9,
-0xe15d9036,	0x70a863f9,	0xb5c05434,	0x56f0cb29,
-0x97bf53c5,	0x59d22ae8,	0x8ecf3e47,	0x0ea14042,
-0x4e9d7953,	0x6c3ac3af,	0x6b977cd4,	0xb4dc2fed,
-0xe3b10fef,	0x01f5954b,	0x53ca7180,	0xe42e8969,
-0xc150f227,	0xddf3c2f5,	0x5717f20e,	0x4ce5c5bc,
-0xaf864cae,	0xf9707380,	0x91d63485,	0x41bcc1a2,
-0x8abc0fff,	0x47f402e2,	0x3453acaf,	0x1a597f26,
-0xa4f77d5b,	0x48c64ce0,	0xb57fe88b,	0x4a3388b1,
-0x1de5a08d,	0x698f102c,	0x3d623ff7,	0xcfb6d7a6,
-0x36fd6bc1,	0x55aaeef4,	0x7f080d25,	0xfd60d0e3,
-0x460e89e4,	0xe149cd04,	0xd0f2e68e,	0x5b11fd91,
-0xfb4754ee,	0x8251d89a,	0xe653ecb7,	0x1a1169e0,
-0x1f6bc908,	0x17776d46,	0x4d6fa5ff,	0x5185c78a,
-0xbcd18053,	0x79f86716,	0x77147b1d,	0x303ca9be,
-0xd93aaff0,	0x6d9ffa8d,	0x6abeb7e8,	0xa6bce101,
-0x5a80c655,	0x2ad2b1ac,	0x1c082a07,	0xf0e16482,
-0xb4281f26,	0xbb1705e5,	0x0fee4e39,	0x0c17e5d0,
-0x001cb676,	0x8e3a01d9,	0xc4f29c4e,	0x05c73985,
-0x577acdfd,	0x2cb58a4f,	0x05d90b10,	0x0283e303,
-0xc2037211,	0x15d23cb9,	0x7379a799,	0x10475d7d,
-0x3dc893c3,	0x69964151,	0x52640806,	0xcdae2c07,
-0xa6af8fb6,	0x3db5db62,	0xd1a330b8,	0x9be6acf7,
-0x1b5692a9,	0x91effac3,	0x688e31ad,	0x4b9fafd6,
-0x483f04b9,	0xad090032,	0x2756e97d,	0x7e23afd7,
-0x34c133a7,	0x164e116f,	0xcdddeb7b,	0x28d7274d,
-0x1aeb0c24,	0x76de689c,	0x88bc316b,	0x0ee3443f,
-0x893a815b,	0x4e29f2f7,	0x191cb965,	0x7470aec7,
-0x9d224d59,	0x22ebab10,	0xc313cad4,	0x1b82cf6b,
-0xb490c745,	0x1f0a25a8,	0x2f89f1da,	0x1c763d3f,
-0xad474ebb,	0x7e4deb59,	0xbf7b9fd2,	0xd47046c0,
-0x30455625,	0x3a6c1a46,	0xdea1acb8,	0xe6430489,
-0x6646ba4c,	0xb7da15cb,	0x37037c35,	0x7864c5f0,
-0x82728ed2,	0xc9c68066,	0x8fa79986,	0x2ac1c078,
-0xaa1796d9,	0xb2808f42,	0xdcaf399a,	0xf0785363,
-0xa239879a,	0x64a16b18,	0x5729e475,	0x32051219,
-0x7065be03,	0x3a312c5d,	0xf88668bd,	0x9dd1cde3,
-0x92553032,	0x499e54a6,	0x039d24ea,	0xbedcdc89,
-0x655f04e7,	0x3ff657e3,	0x2315ff30,	0xbb4f4ca1,
-0xd8904f24,	0xf2640f41,	0xda3b34a5,	0x0039fca2,
-0xc4a898ff,	0x1ed56af7,	0x3b457066,	0xaaad566b,
-0xc4eb0098,	0x0e9f91a6,	0x4ab60ce9,	0xe0482f06,
-0xee8b5568,	0x33aa937d,	0x379c5095,	0x250e0ec2,
-0xd8123a70,	0x1c3671e7,	0xb2cb87b1,	0x3600b645,
-0xd86442ba,	0x885fae6e,	0x02ab043b,	0xf5e2f4d2,
-0xbd49b714,	0x9124831e,	0x5ff321bc,	0x650b8a2f,
-0x38e50349,	0xd050c275,	0xe41b375c,	0x529db8e8,
-0xdd18dc07,	0xbf9738ab,	0x8a4666d0,	0x649ef5f7,
-0x22ace388,	0x062d548c,	0xcf5e83d1,	0x84384bcf,
-0xfcdb8f55,	0xe2c8ca9c,	0xa31e2bc3,	0x25c542a6,
-0xbd118909,	0xc4d68602,	0x1a34f2fa,	0xde180728,
-0xf068bc08,	0x631e3f3e,	0x4b0cbcab,	0xfdfa5fe5,
-0x0b3b6fe4,	0xe70ba1a3,	0xaeb907c2,	0xeabde1c8,
-0x79d9861f,	0xef5c84e7,	0x9ca6e94a,	0x557f9027,
-0x57766a22,	0x2a9c23fa,	0x92a922de,	0xdda1883b,
-0xba13c759,	0x9a138b55,	0x8f06e35e,	0xc64618ee,
-0xd35f1d08,	0xaa95b6f1,	0x947084cd,	0x4a5ac647,
-/*  2499-m401067660C.inc  */
-0x00000001,	0x0000060c,	0x01192008,	0x00010676,
-0xfbac0f2d,	0x00000001,	0x00000040,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x0000060c,
-0x00000035,	0x2e000000,	0x20080119,	0x00000301,
-0x00000001,	0x00010676,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc8f5cd92,	0x30bd1beb,	0x77c4fb8b,	0xe899c960,
-0xc729b4cd,	0x1d9b8923,	0xfcdfc554,	0x580d39f9,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x4872f26c,	0x88971c10,	0x66db1385,
-0x1e532ab2,	0x7ccd2d72,	0x38dd766c,	0x131f4505,
-0x7d5e1e0a,	0x1932938b,	0x79c1db9a,	0x9fe5b8bd,
-0x07037c1a,	0x698cd351,	0xbadb5300,	0x063f17d9,
-0x8558ada3,	0x224c2288,	0x26fa35b3,	0xe64efb19,
-0x0e1b52db,	0x696d5461,	0x3a0f765c,	0x4b853dfe,
-0x05147b28,	0xbe146518,	0xb61e1de2,	0xc342998e,
-0x083d5f41,	0x737fdbb5,	0xdd812ce1,	0xa7b9549c,
-0x164b5fbf,	0xaffd6139,	0x44154437,	0x23d44899,
-0xbe41eae1,	0xeecc8d45,	0x31fc971a,	0x44475238,
-0x5d4ab69c,	0x67f342a0,	0x118cb268,	0x513fb847,
-0x0a86fce3,	0x23f22535,	0x5fa15360,	0x929aa833,
-0x3cbd4138,	0xc1dead1e,	0x3efa210b,	0x9781a61d,
-0x00b53f73,	0x07df4d30,	0xffe97322,	0xf7b12998,
-0xba4d7316,	0x4b746898,	0x45ece500,	0x78cf31d5,
-0x0208c1c6,	0xc3999e15,	0xce2f90f4,	0x7e130a0b,
-0x3c74ce12,	0x37612fd2,	0x7ce3ae15,	0x99a26321,
-0x52ac391f,	0xcb32f7e1,	0x0e50140d,	0x3a6bfc41,
-0x497f7f9f,	0x334b7e17,	0xbcf4e41d,	0x3311b0db,
-0x0dc65367,	0x44847807,	0x991c439a,	0xd2965df2,
-0xfd72e4fd,	0x44b01f14,	0x5a0cf5c5,	0x70029e37,
-0x92af3f34,	0x47949bdf,	0x771a3c07,	0x0874f372,
-0x7a54670b,	0x7430b00b,	0x356234f3,	0x74edf1e6,
-0xaaf60a4c,	0x2bb5eee4,	0xc2c1d43f,	0xc4ee788b,
-0x4198fd90,	0x0aba19a3,	0xc251f028,	0xe42404df,
-0xccbd25f2,	0xdb13eb69,	0x888f89a5,	0x5a6c8cd3,
-0x1e3b469b,	0xe07e48c6,	0x87f25228,	0x64324c03,
-0xe0426f9f,	0x148f828b,	0x4a3c82ab,	0x7d46539d,
-0x0b5079ea,	0x2c675b3e,	0x83134717,	0xbe775c77,
-0x74841ec3,	0x4470addb,	0xfabfa06d,	0x548757fb,
-0x184ea712,	0x502765b5,	0xd7067ce2,	0x15afee11,
-0x8a95590d,	0x3a1734cd,	0x212c7f7d,	0xe5aa3e5b,
-0x9c7e75c3,	0x07486966,	0x5827bbea,	0x391e46fe,
-0xc6acbc9e,	0x9761b6a9,	0x37bef8c4,	0x733eb81f,
-0x7ac9a87a,	0xceacd157,	0xd931072a,	0x9383c10d,
-0x5eae74ef,	0x5f82f6a0,	0xcf89077d,	0xbc641bd8,
-0x1b7d1213,	0x980a4ed3,	0x410fa7e8,	0xaaa1a011,
-0xa5e94ef2,	0x74937d5f,	0x3c109f67,	0x8e58bdcc,
-0x2b43ad95,	0xaa516349,	0x6fa9cca2,	0x48a18062,
-0x663c7fd7,	0xf3822d87,	0xbaaf1f97,	0x8da372b2,
-0xa416831b,	0x6a645364,	0x9c7ac6fb,	0x3f5a9cab,
-0x8cf6f4b4,	0x514fd1dc,	0x7e9d0918,	0x2075f774,
-0xfda8677b,	0x3b5c16ac,	0xe887694b,	0x7d622e9f,
-0x5427472d,	0x540e5c99,	0x2196e138,	0x5d5e9c58,
-0x84a5fc17,	0xb17d6d41,	0x63273bdf,	0xfbb912b5,
-0xaf16b7c1,	0xeb1914d7,	0x5d654b8f,	0xf4a594f6,
-0x554a6311,	0xb391f519,	0xa5ad4acf,	0x9c052bb7,
-0xea68faa7,	0x37399a25,	0x8f6f6d36,	0x47c20f2b,
-0xf241ab98,	0x66da024d,	0xee90a06a,	0x33718b17,
-0xaa89087e,	0x6dcca7f5,	0x43a59f0e,	0xcb2e3ab8,
-0xb19126bb,	0xc56bccb3,	0x04f6fd9a,	0x0f63850e,
-0xa2b6c85e,	0x309f9817,	0x7252b154,	0xcba20ff3,
-0x143156b8,	0xcfcdc8ae,	0x13c2a75b,	0xea4bf1b8,
-0x6e474959,	0xa9c376f5,	0x40d252b8,	0xb6209e70,
-0x993efa22,	0x3d7e8007,	0x1857ba0d,	0x72f25310,
-0x233a8f68,	0xeb4ca923,	0xb17917d1,	0x9ca3f4f6,
-0xdecf1498,	0x99f5ddae,	0x8b6ba2b7,	0x54f41fb0,
-0x1ec9ffa2,	0x74ad3bd6,	0x84fee3e6,	0x5294820d,
-0x147e8b14,	0xd2dc15f4,	0x152fc744,	0x306bc043,
-0xfdbb74d8,	0xf4ea207c,	0x53edfac5,	0x1b609795,
-0xe990ee73,	0x749dbed4,	0xd1cefc95,	0x5c7b37f6,
-0xc6b39045,	0x7281e3f7,	0xed0e6aa4,	0x590a246a,
-0xe6e6a81d,	0x604491ac,	0x6cd14e8a,	0x7a19f5da,
-0xf7c7326a,	0x0ef8029e,	0x0e741b48,	0xc962a062,
-0x6f4ad86e,	0xa2729726,	0x93bcaf1f,	0x1bb56970,
-0x12495cdc,	0x180512e7,	0xa1d68081,	0xb924c24b,
-0x5a1461ca,	0x21438ca9,	0x5449ae48,	0x0f564503,
-0xcec8df3c,	0x789f9b80,	0x5a708df1,	0x28735bfc,
-0xcf11d2fc,	0xa5d01625,	0x80b0b533,	0xa09f026d,
-0x1d22fdf2,	0x01928228,	0x8b6779ed,	0x04f7cc95,
-0x581fe0b2,	0xcc9a66a4,	0x55b3f130,	0x0f22abed,
-0x05b7e95d,	0xd8cc9c30,	0x0850ca8a,	0x34d729dd,
-0x973300a7,	0x80ffedb1,	0xbf5b28e7,	0x135c8cc6,
-0x4337b017,	0x31d8dd09,	0x35ed75a1,	0xb8f990b9,
-0x4384dc18,	0x29d72b56,	0x021aa2b2,	0xa3248b3f,
-0x5f4e7301,	0x29991927,	0x1cc50c18,	0x79fcc545,
-0x56e2e683,	0xe5127777,	0x4b727957,	0x94d1bc22,
-0xacd0da9e,	0xd24771fd,	0x5997ff0a,	0xb9947cb8,
-0x8cb9bb5c,	0x16a4c5e0,	0x00d6995f,	0x1e05edff,
-0x3a7f1af3,	0x445fd70d,	0x24a602c7,	0x6b50001a,
-0x6c99f5e5,	0xad2c00c5,	0xbd16a90d,	0x3b7b6032,
-0xa8dd4f8b,	0x437145f1,	0x5a593d5f,	0x749ee409,
-0x9c6d8223,	0x40c1dad0,	0x578e7e1f,	0x89072e7b,
-0x0ccf47c1,	0x427606d8,	0x4a7bb48c,	0xf85cc4e9,
-0xca5ca3b6,	0x9b989f23,	0x6496403f,	0xdf8ef891,
-0xf4458e90,	0x28eed125,	0xef91afe9,	0x97a8d65b,
-0xe022b3dd,	0xc93c2adf,	0x520cbe7c,	0x58995018,
-0x719a724a,	0x9258733f,	0x8df05767,	0x879b9ba1,
-0x84684054,	0x71a62082,	0x5be959cd,	0x12c937ec,
-0xc21fb3b8,	0x6738aa89,	0xb01d872b,	0x0ff6ec3c,
-0x50fc63ea,	0x715b7c5d,	0x4e5d50c3,	0x086c862e,
-0x34ec9201,	0xd41176ef,	0xd0238088,	0x53518100,
-0x8e1500dd,	0xc6ea9594,	0x0359517e,	0x58d81a35,
-0x48c40983,	0x2d562dc6,	0xecf5be9e,	0x4cd82ead,
-0x45faeb2b,	0x1a66ec1c,	0x6b692a76,	0x6cb326b0,
-0x3a6c362c,	0xf0174da3,	0x5e4549d9,	0xc12c5972,
-0x73716059,	0xdd54591d,	0x32ee704b,	0x5a55c22d,
-0x56bd1e7e,	0x2bd34024,	0xa42c85d2,	0xb1ce248a,
-0x604a7570,	0xbbf4b3fb,	0xe0eeb866,	0x130b7dd4,
-0xdb39dc1d,	0xd873b0c4,	0x3aedb6ef,	0x5efb2481,
-0xbfaff9bc,	0xb94930d6,	0xa3fe71cc,	0x75867e01,
-0x7c8ee191,	0xf38f4963,	0x8d077957,	0x658e7c2b,
-0xc1bd58ed,	0xb86a20b2,	0xc624489c,	0x4624732d,
-0xc11f1ee3,	0xf1874ed7,	0x173684cf,	0x0e5851d4,
-0xc2662118,	0x13dbb926,	0x1668df5e,	0x00749d03,
-0xab9530d2,	0x5758e602,	0x6db90ff1,	0x87270f9d,
-0x774a52f5,	0xcd1b4b5a,	0xd706025e,	0xe3a51fc4,
-0x31c5d55b,	0xbd0278a1,	0x16dce1bf,	0x75a3446f,
-0xe030c121,	0xa6f6b3c8,	0x504e3b3b,	0x4c1428b1,
-0x74229a60,	0x25d5b7b7,	0xea284c21,	0xf5f1c7cd,
-0x0025e9fc,	0xa7db9e56,	0x4e3aeb90,	0x8bad0f3b,
-0xc19e88eb,	0x8ea86b83,	0x25cf5d26,	0xca78504e,
-0x94109c06,	0x60ad3975,	0x138b8038,	0x4c9d8fdd,
-0x28a91526,	0x5d3d6c3a,	0xf81ab861,	0x8db34426,
-0x35a3b398,	0xf3b40170,	0xb7e6994b,	0xea72c1f5,
-0x63201cd4,	0x1c5749dc,	0x420ada27,	0x419f4847,
-0x49244543,	0xb915645f,	0x3a00b3e2,	0x0122000b,
-0x296b6bad,	0x7b45d76b,	0x5be8f025,	0x2a04919f,
-0x8291fea4,	0xaae644f9,	0x7af3fb96,	0x77d9878c,
-0xa8996848,	0xa9a0c1c3,	0xb47ae6d2,	0xc5b6cf90,
-0xb04b4863,	0x43fa113b,	0x66ef4993,	0x03a5b4e9,
-0x94b661dd,	0x145a5909,	0xd42f70cc,	0x6b816775,
-0xfbc0cb04,	0x5e890eb1,	0xb6900305,	0xcd19304b,
-0x85c67d21,	0x19e91907,	0x27b3898c,	0xe0ce6ba2,
-0x4110d80d,	0x85953740,	0xba7a4225,	0x51db6dd9,
-0x04c21ffe,	0xd34ef7cd,	0xeb13f075,	0xc1f8eb04,
-0x19a1227a,	0x3e99efae,	0x318346e2,	0x3d4c73bb,
-0x402dacc7,	0x5a9e892d,	0x01304401,	0xb3950c6f,
-0x9254bea1,	0x5cc8f025,	0x53cb9416,	0x52d716c5,
-0x3ff575a5,	0xede2046b,	0x2cbd6b85,	0x7e8feb25,
-0xc2d35482,	0xa49b8495,	0x214fed4b,	0xc93ae54f,
-0xde3d8a18,	0xe4456b47,	0x505555c1,	0x6418926d,
-0x4b6ac1e7,	0x7ac213ea,	0xc081eea5,	0x467ff1c3,
-0x1ed5d79d,	0x746dbb24,	0x38b1dbde,	0x4d495fc0,
-0x7ddabfe1,	0xfbac0ba1,	0xd17cfc3b,	0x32c819f3,
-0x1f4c39cd,	0x6fa5c3ed,	0x0d2e7f50,	0x1f5cb318,
-0x1e1770d1,	0xef12c293,	0xb149ace5,	0x93df9bdf,
-0x14a98319,	0x3374906f,	0x746d603f,	0x5a368e6d,
-0x8dbaef76,	0xb7923f42,	0x607655cc,	0xd144703c,
-0xa01fa0f6,	0xa83f4e65,	0x224bba03,	0x6e082d15,
-0x11ef27eb,	0xad91427e,	0xd8f0e3bd,	0xba7bc3df,
-0xdb031557,	0xf33052d0,	0x2bc3df37,	0xf55d25c2,
-0x99af998a,	0x5819eb07,	0xe4b9ebc5,	0xbc3da46e,
-0xde1abe71,	0xb8c66434,	0xe811e29d,	0xa48ee5e6,
-0x7f961c60,	0x5500769f,	0x9c8e0d00,	0x94680cea,
-0x2f7a0c5f,	0x9a058310,	0xd3ddca08,	0x74276c4c,
-0x855ebef2,	0x61979f79,	0x09684303,	0x3ea777dd,
-0xf700db1f,	0xdf7bcae0,	0x0fa7db2b,	0xd0115231,
-0xc0015882,	0xe4af6f72,	0xb4388c7d,	0xfb5656bc,
-0xbe1d38b3,	0xf59ae9d3,	0xddc692bf,	0x3aaef998,
-0x561f993f,	0x4d191a40,	0x4492df05,	0x7eb17670,
-0x0770001b,	0x9b320a87,	0xbc8a559a,	0x19781e02,
-0x13c995b1,	0xcb8c1e47,	0x462019e3,	0x7ee6bcc1,
-0x9da2afce,	0xee1dbf76,	0x3a72ad3f,	0x711f786a,
-0x0c72d639,	0xa3455dc9,	0xef155308,	0x82f3e1c9,
-0xc9540414,	0xcec2cde1,	0x748005bb,	0x24197d5d,
-0x4b8b7f7b,	0x3dde3129,	0x9ac952c9,	0x6f7932a7,
-0xa99005e4,	0x4261280d,	0xfad329af,	0x90bcacb3,
-0xe1c4a202,	0x9200d928,	0xffe55142,	0xf69b2a40,
-0x227783a3,	0xe4b0c9c4,	0xeca97ce9,	0x9245597d,
-0xa922db08,	0x94bff912,	0xdbebd937,	0x5c658f30,
-0xb3f4a726,	0x24e2ca27,	0x9ca037d7,	0x745d3d5e,
-0x3e8c437e,	0xb807af86,	0xee5fa977,	0xfe335297,
-0x5c0a6707,	0x8ab801af,	0x05d02766,	0xcd0906b4,
-0x791b47d3,	0xff5a0291,	0x09465b16,	0xa7fff3a1,
-0xe2e6d825,	0x7f4f2b9a,	0xc1f2e668,	0xa5cfe1d6,
-0x95fd7bde,	0x38681314,	0xc3c7dce1,	0x7b82e044,
-0x2c883c77,	0xe8aa72be,	0xd53867d7,	0x7022fdc3,
-0x3b697ccd,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-/*  2347-m206fda3.inc  */
-0x00000001,	0x000000a3,	0x08132007,	0x000006fd,
-0x89c0d07f,	0x00000001,	0x00000020,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x72cbc5d0,	0xa24e89bc,	0x074028ef,	0x2ad07a06,
-0xdeb7acf5,	0x98912a6d,	0x295d17a5,	0xa3b8708f,
-0x95c69839,	0xb2f655e2,	0xdce0fc75,	0xf92f04fd,
-0x51b6b38e,	0xe7884365,	0x69dcc34e,	0xcfe67a6b,
-0x5e421f0e,	0x51527923,	0xb63fceab,	0xae39d6c2,
-0x5dc6865a,	0x5819082a,	0xcfcfc6eb,	0xc4ed71a8,
-0x06e83b7b,	0x7cc5025b,	0x5fefb2c9,	0x3c02abbe,
-0x42dba8cc,	0xfc966b64,	0x2acaa07e,	0x61d32476,
-0x72fed3f8,	0x7ef26af7,	0x8086deb1,	0xd11fe511,
-0x3dcc3e92,	0x202bf190,	0x17fbf18b,	0x4cd17950,
-0x81299fb5,	0xac3d96a2,	0x389ff313,	0x85dd4b22,
-0x4eaef9da,	0x623b133b,	0xe3d02b2c,	0x2290a31d,
-0xc6f8c543,	0xf6c18f11,	0x8070c5d4,	0xc756e5c4,
-0xf4a40060,	0xbf169c70,	0x62dd14d4,	0x729fefe0,
-0x6594d275,	0xa5abc2e8,	0x720904e3,	0x5a5b42ad,
-0x5e970808,	0x5a6ec767,	0x502a6d38,	0x88d24740,
-0xb4739506,	0xe3f497a2,	0x2618e78d,	0xfb602c6c,
-0x323fc08b,	0xf9cb3dfa,	0xc90130e6,	0xe373da35,
-0xde024249,	0x490b1796,	0x93f157ee,	0x10f73761,
-0x6dd5c0e4,	0x4a9fb1fd,	0xadc2ead7,	0xd13e442c,
-0xbfbd007d,	0xc8de8a68,	0x09c630bc,	0x69e78a87,
-0x4d64bab9,	0x81c58c9b,	0x0b693158,	0x2a40ee8f,
-0x47153744,	0x2a32e243,	0xdde6b849,	0xa2c35ddb,
-0xf8c10a60,	0xaf5796f6,	0x8a95da67,	0x013f80a1,
-0x7f332110,	0x345e3e0f,	0xba8ca1f8,	0x373a3380,
-0x97f10a50,	0x3e1e78a8,	0x097496d4,	0x60ef2ffb,
-0x9421fb84,	0x03131ba9,	0x535e0247,	0xeda34f42,
-0x7f34ebb7,	0xbcfd1c2d,	0x19b2c696,	0x7107aed5,
-0xd5877fe2,	0x404186ae,	0xbc41a831,	0x1cd49fd3,
-0x92ff4c85,	0x3f65b35e,	0x701ce1cd,	0xe3839c91,
-0xab53cf2d,	0xdb124ec0,	0x7c012c6c,	0x432b628b,
-0xac351ee6,	0x9da287ad,	0x0adc2580,	0x66f945ca,
-0x36bd8108,	0xbce986ee,	0x8fc2d524,	0x06dbf665,
-0xb4124dd5,	0xf15c2853,	0x4aaa9b46,	0x753c207d,
-0xd7805517,	0xaa6f6dfe,	0xf6eb1ced,	0xe6a4f89c,
-0x5cbf2b1f,	0x6889832b,	0xf121bc8e,	0x2d7e02e9,
-0xedbc10d5,	0xf3974ab6,	0xf977d65d,	0x40ef2640,
-0x9c5f3410,	0x7ce2bca8,	0xac2d2c23,	0x204d560f,
-0x2dffb3b3,	0xb051fdc4,	0x76ef18ad,	0x1b13190f,
-0xa08cd1d4,	0x1aa202b8,	0x1a5040f4,	0x23a24420,
-0x22622bd2,	0x6e543121,	0xfe68651f,	0x4e0d3fd6,
-0xda661e0b,	0xfb41bbdc,	0x5a6e0df0,	0x8c27383a,
-0x91e24f94,	0xa5db6d2d,	0xc7684280,	0xfddaf106,
-0x0ada8514,	0x5cb76df8,	0xea1242ce,	0xc5aca25f,
-0x0821a5f3,	0x71e4de37,	0x89c9a2a8,	0x4d2231b4,
-0xc3edc81c,	0x56f516f9,	0x7e95a590,	0xe00ea616,
-0x827fd358,	0x4511b62d,	0x6cac7958,	0x8259e262,
-0x9ee67b13,	0xe73bdab2,	0x811f51d7,	0x88e6196f,
-0x642a4db5,	0x1ca77047,	0x5a095f6c,	0xa42ddb9a,
-0x66321e3c,	0xeeed0f13,	0x72e48195,	0x988f23df,
-0x3d058cd3,	0x45fed77a,	0xa20f4f80,	0xca873db9,
-0xcfd4a890,	0xcb406f47,	0x56bd45eb,	0x8ca14876,
-0x411da96d,	0xaabe66e1,	0x26ce3950,	0x40ceb4ab,
-0xbbb2b914,	0xfd90126b,	0x74c60165,	0xcd2e00ff,
-0xe0607bd7,	0x3dc3818d,	0x4102205b,	0x72cca471,
-0x0864151a,	0x65c92538,	0x5bc44cfc,	0x406a9b62,
-0x10e5aab2,	0x751f6321,	0x533ca54a,	0x335961a9,
-0xa386abb2,	0x24f90a2b,	0x3d13ff7c,	0x35d454ef,
-0xc236b524,	0x8cf68189,	0x6ba29c87,	0x3925aaae,
-0xa12de178,	0x4610a2d1,	0xfe330eca,	0x8d657af3,
-0x7f2f81f3,	0x46cd664c,	0x676003c0,	0xdf786970,
-0xb240a066,	0x41f852f2,	0xb85e5eac,	0x8ba83def,
-0xc12c498e,	0x02c5d742,	0x4b9df557,	0xd9f2ed28,
-0x5f7cec4f,	0xf9ff3a0c,	0x457ac549,	0x133f5bd1,
-0x951b6947,	0xf835f2df,	0xee51efd0,	0xe90b1bdc,
-0xb76c1a80,	0xc3f209a0,	0xb175f774,	0xd8963aff,
-0x3d458f2a,	0x9ba9ca53,	0x91561069,	0x444ac140,
-0x87f53cb5,	0xc835bec0,	0x2b6906e1,	0x1f2201e6,
-0x443bfce4,	0xd0e25486,	0x71ba244a,	0xa85e4fad,
-0xb0a9df78,	0xbef803cb,	0x710cbd53,	0xd7ce50b3,
-0x38f69e53,	0x5175759f,	0x987de9f5,	0xfc5f9332,
-0x090ba2ef,	0xa059c8e0,	0x9efc20ca,	0xaead8853,
-0x22cd4804,	0xb30dca16,	0xadbbdf33,	0x246cb36c,
-0xec99405d,	0xfef7e46e,	0x454bf0a3,	0xa75d4072,
-0x6859ad38,	0x3c6a15e8,	0x37bb8ecb,	0x05747a82,
-0x97edcb0b,	0x5bff5a7d,	0x20cd1e91,	0x1e37277b,
-0x4c0149e1,	0xc7d5e490,	0x253bcac9,	0xdffe64ac,
-0xf7ce2179,	0xada80d94,	0x3653f166,	0x7271d8a4,
-0x994f269f,	0x0841e81a,	0x709401cc,	0x0c9fefbb,
-0x30fa89fd,	0x1fea8b70,	0xffc68c98,	0x2030e064,
-0x8e28b2c7,	0x2750f01e,	0xceb4d955,	0xb86ee560,
-0x7ca55701,	0x3a942ffe,	0xd6ad0e17,	0xe8cec9d1,
-0x5a6954e8,	0xb14fe7c6,	0x6e7d5c90,	0x8481626b,
-0x7c798699,	0xdb0b344a,	0xa721cdc5,	0x861db07a,
-0x1844fca7,	0xde861a71,	0x770735c1,	0x3ab64f3e,
-0xb352aeb8,	0x046529cf,	0x2fd753f9,	0xbb3cad72,
-0x27b44c84,	0x58e77f53,	0x08840b3c,	0x75ceaa6a,
-0xcfb8ec2f,	0x8877c4a8,	0xee6bf89f,	0xc6256203,
-0x0bb3f6bc,	0x696fa2f3,	0xf04e8efb,	0x3fd0099b,
-0x27a473cf,	0x87fe81c8,	0x35cface5,	0x8afad818,
-0xb47534e9,	0x90b406aa,	0x7d7c2d15,	0xc9caf1ad,
-0x9692ac7f,	0xa3bc5fc9,	0xfd41d0f4,	0xc47f86df,
-0x60cbdd17,	0xc1fc9bb1,	0x518ec6f8,	0x45c7e024,
-0x7db1e277,	0xd4d30cd3,	0x35bc1c5a,	0x60b61287,
-0xfcecbc8b,	0xc6cb70e9,	0xc6280061,	0x9d0ac8ce,
-0xfaf12df8,	0x9b3f092c,	0x979a43f8,	0xbbdbe0cc,
-0x6274f1d9,	0x7322b577,	0x50589a1b,	0xbd0dca66,
-0x2160d66b,	0x4ea6b9f3,	0xd942aa7a,	0x0c8e1c82,
-0xc0a07833,	0x0fdb7b24,	0x012a56a1,	0x9d2b019b,
-0xba7c66ee,	0xe6af3a73,	0x823e0207,	0xd9913462,
-0x8896001b,	0x142af0f2,	0x52539dd9,	0x864a53f0,
-0x6e85c62b,	0x66139be6,	0xadd260aa,	0x2a7a579a,
-0xd0fe929c,	0x67052a99,	0x1bcb98e0,	0x8c58f5fa,
-0xb32d4733,	0xb4e4e4c8,	0xb536ab23,	0xd00ef025,
-0x05c4cb84,	0xbbc9b7d8,	0x175d6254,	0x5d8ebdb4,
-0xe3f3e65a,	0x52177f95,	0xe85d812b,	0x87fb19ac,
-0x88b80b16,	0xc570083b,	0x124da09f,	0xc8522543,
-0x5f73aab0,	0x6c25b49f,	0xc8a03cb2,	0xd857bb2b,
-0x16378b5d,	0x242f0e79,	0x02d5d491,	0x7fc8b85f,
-0x48177825,	0xc70d4bce,	0xa23f5d56,	0xc7ebcb58,
-0xaf3b143a,	0xc33e9d65,	0xc043e61d,	0xf05a3d2a,
-0xd162c7d0,	0xdad944f7,	0x3226cdeb,	0xd0d044e3,
-0x8012c5e8,	0x18524401,	0x2a4d751d,	0x95592574,
-0x8e03592e,	0x68a72ded,	0x7d65ba50,	0xfa66bb37,
-0x81250634,	0xe92c784a,	0xb585ae7c,	0xc6e350f1,
-0x8d40d62d,	0x5b2ad4bc,	0xc87b65d1,	0x700191fb,
-0x06015556,	0xaf94c477,	0xa63b5aa1,	0x28a7ab7a,
-0x7cdb448e,	0x3819d9d0,	0xcb0dfe9b,	0x715dc992,
-0x88f5e070,	0xa1f5ecb5,	0x8c9876ad,	0x44be717b,
-0xda7487fe,	0xecc57fab,	0xfb6cd21e,	0x6de34108,
-0xa98b84ed,	0xd755144c,	0xb24c242b,	0xa29eab2d,
-0xb909c928,	0x077da28d,	0x549454df,	0x173b4e96,
-0x5353fdfd,	0xcf06a087,	0x33acdb4a,	0x166b41a1,
-0x45219876,	0x96eb46b1,	0xee5f18ad,	0x6a962b7a,
-0x9914a217,	0xca72359c,	0x28f5a8f8,	0x9d0b43ac,
-0x5fb6964f,	0x0b2685e0,	0xbda83a60,	0x464fbf9c,
-0xfd8f4ec5,	0x9d16acdf,	0x1192191f,	0x119c43e0,
-0xd0a2df66,	0x8c2cf306,	0x3da0f9f4,	0xf409a043,
-0xcfc563b0,	0xf0be102c,	0x3252b4b7,	0x07076cbb,
-0x355888f0,	0x4e4bc8d0,	0x1fd64ff5,	0x245147db,
-0x9d757b6f,	0xfbaeee9f,	0x43d68df0,	0x2709be60,
-0xd333fd6b,	0x79af3f65,	0xb52de3ea,	0x04d94eb8,
-0x43865e4f,	0xc736c027,	0xfd180b96,	0x78caa82a,
-0xd0021810,	0x9e514f99,	0x72f5067b,	0x7de6487f,
-0x6cb34382,	0x0e01763a,	0x89976ae4,	0x7a8bbfa2,
-0xa50291f9,	0x6407b33f,	0xf7ce016c,	0x2d586dd3,
-0xac0a7612,	0x32fa7be1,	0x3ee474d4,	0xc795f431,
-0xd6d0a977,	0xdc859d13,	0x446f01b1,	0xafc13014,
-0x67bad636,	0xda3c5946,	0xe169c32f,	0xfe5c93b7,
-0xac1b3104,	0x42a5c9ab,	0xc906dad0,	0xe4b213db,
-0x6fefea5a,	0x35528fb5,	0x59cadba2,	0x5cbb0ea0,
-0x2b01c14c,	0xaa438c3b,	0x6bbad300,	0x3d6d3409,
-0xcc87ec95,	0x6f167576,	0x623c3b26,	0xab438ac1,
-0x469b5486,	0xb7992347,	0x0418dd1e,	0x54e6ad5f,
-0x44bff273,	0xbc97e1d7,	0x7c5c88da,	0xf7bbb29a,
-0x48d01e8c,	0xaa4d4376,	0x9a99c998,	0x24d09e2f,
-0x24480693,	0x84b6b905,	0xd0ff443b,	0x76605be6,
-0x5c6af5bd,	0x5dd0c084,	0x4d162432,	0xed939cf2,
-0x2d333e06,	0xd2144645,	0xb06a3583,	0xc1d6e232,
-0x03883c1c,	0x6a3a1491,	0xe6b619d9,	0xfee3f413,
-0x5e59c26c,	0x28684bc1,	0xca68c55b,	0xca395734,
-0x95d8afd7,	0x8a94d5ce,	0x6d780b0d,	0x6ab50934,
-0xf5121314,	0xb9ec2632,	0x1beb9a14,	0xcd950304,
-0x6fd91394,	0x33f84e25,	0x546d4a4b,	0xc303eb86,
-0xcfb7b409,	0xf852adeb,	0x65c4960a,	0x01878815,
-0x4a6501d8,	0x5bb3a40f,	0x9414a799,	0xbbae4dea,
-0xae9d7b0e,	0x761dcb06,	0x9581c2ff,	0x06edcb74,
-0x0c06177d,	0xdc36931a,	0x751d52ea,	0x699dd531,
-0x5285df50,	0x81990800,	0xa81d52e4,	0xf305b98e,
-0x260f304c,	0xa9f5a19d,	0x702bf4d9,	0xc4e322c4,
-0x05e38fbd,	0xf6997433,	0x938443b8,	0x33fe4ff4,
-0xc0da5ba1,	0x1701d20f,	0x4f631fda,	0xd966d058,
-0x847b08a0,	0x7719b2ac,	0xea7e817e,	0x3cc266f9,
-0x39b94930,	0xd5a7c643,	0x831d614c,	0x486c87ea,
-0xeb32ec07,	0x27ccfb31,	0x3618615c,	0x01c5284f,
-0x138ba020,	0x7f316b7d,	0xf7049fff,	0x2acb57be,
-0x156b6bb0,	0x03df196b,	0x72bfb285,	0x0d1fd58d,
-0xcb86fb0c,	0x938e1a8d,	0xd387a3ab,	0x5fa1b627,
-0x2c4d3f80,	0x0b4a7121,	0xbab5d24c,	0x4e14e39c,
-0x19d839a3,	0x0b730800,	0xaabb2b8a,	0xa58aa531,
-0xa82260bc,	0x21be659d,	0x714b34d8,	0xa89d111d,
-0x02828552,	0xae10e3c9,	0xdd9ecd12,	0xe13beb47,
-0x96818a52,	0xb5fcd9b2,	0xa8d0964f,	0xfcc0e896,
-0x7ab323da,	0xb1bf60de,	0xdb70c0ac,	0x83373de9,
-0x3513e4d5,	0x0634af3e,	0xc3052a5f,	0x3acb8ac9,
-0xcf03743f,	0x15555b96,	0x929b04ff,	0xdb2a9428,
-0xdce90ae4,	0xe414e73b,	0x5b6b19ff,	0x1a708067,
-0x61329d15,	0xc4eb8336,	0x2d861d5e,	0xca108403,
-0x0e9ab2d4,	0x04d3b3c4,	0x36ef280d,	0xfea6cee9,
-0x80c30cad,	0x399d1c6d,	0x2b654d22,	0x204032fc,
-0xee60e1c1,	0xb20fd9db,	0x087a91fd,	0x6a4e368b,
-0xad3ca7e5,	0x5355a689,	0xd220e928,	0x925cb754,
-0x677991e5,	0xb3941d98,	0xa3eb379a,	0xf0237d52,
-0xe96b9e08,	0xb7ae3c7f,	0x7a84124d,	0x9cc15b58,
-0x2ddafebf,	0x93a8990b,	0x1555212e,	0x7fe44a1c,
-0x90851979,	0x62a143a7,	0x5ba95724,	0x4d8762c9,
-0xee3a6f84,	0x0af45b74,	0xcfabce5c,	0x73ff8f3e,
-0xa872ef47,	0xe97e60bb,	0x805c1800,	0x8d3b978f,
-0xaf71cdb9,	0x4d8da1ec,	0xae5f2f19,	0xe57566f8,
-0xa2003cdd,	0xe65293ce,	0x6970388a,	0x979c68dc,
-0x2fcf8d5c,	0x61a603d3,	0x92158c18,	0xd2f53c34,
-0x842dc4b1,	0x32f3df78,	0xc696ab26,	0x2be86b54,
-0xd98bca91,	0x0415fca1,	0x5afc9076,	0x796a5ef4,
-0x87a225b1,	0x6b5784b3,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2964-M04106C2218.inc  */
-0x00000001,	0x00000218,	0x04102009,	0x000106c2,
-0x8fb7c1ba,	0x00000001,	0x00000004,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000218,
-0x00000035,	0x000b01c0,	0x20090410,	0x00000401,
-0x00000001,	0x000106c2,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xa6db561d,	0x55b01a3e,	0x529538dd,	0x7ce8ffd8,
-0xecba7acf,	0x5d5aa633,	0x74dffacf,	0x9659ea50,
-0x0882023d,	0x953684cb,	0x0abe06ee,	0xa7ef1798,
-0x160d6cb8,	0x930cf745,	0xafc3fd79,	0xa70df3d5,
-0xb0620f46,	0x70048a23,	0xbf95ecf0,	0x76c1b997,
-0x5128616d,	0xb6b4b969,	0xcc69f71d,	0xdf7416e1,
-0xdf9a571b,	0x50c0bcc8,	0x85e2b3cd,	0xc1927532,
-0x7a04b6be,	0xe56b7f97,	0x524085c4,	0x668bf327,
-0xb3eaa54c,	0xccde06f8,	0x09b4e42b,	0x033b0a46,
-0x0f6e2fde,	0xb308ce53,	0x93eff03e,	0x8830014e,
-0x5c8a6f22,	0x91d2f757,	0xf70b648d,	0x0789998a,
-0xd84d4640,	0xe5f34e80,	0xf3357e64,	0xd1e2beea,
-0xc7e95c3a,	0x30e57e4d,	0xec214356,	0x7e10859e,
-0x1d5895d5,	0xdeeff6cb,	0xed1030ed,	0x827e603d,
-0x6b4b2de3,	0x83ec6fd0,	0xa64092f3,	0x8d9887e4,
-0xbefcbedd,	0x2111afef,	0xcb9abf96,	0x5c79ceac,
-0x9bf8a57f,	0x5d0e44be,	0xdca3d3b6,	0x9072d1ca,
-0x48e73a50,	0x8d0bc804,	0x6aea94d3,	0xc372403e,
-0x00000011,	0x39ca895f,	0x93bb36ed,	0xc7115d19,
-0x51306d80,	0xd428d120,	0x7a46a942,	0x14d5038a,
-0x282d38f1,	0x11a99a17,	0x55957f14,	0x316eb5de,
-0x92127b40,	0xe8d48b9d,	0xe4afdd47,	0x05767c4d,
-0x0d8b0fe0,	0x58166187,	0x254aced0,	0xe583cfce,
-0x8bb8b390,	0x9ff4d234,	0xa92c79b1,	0x88bd3e77,
-0x5a6d726a,	0xc6d9d333,	0x27ff83dc,	0x5abee1c4,
-0x7fbe2fcd,	0xcd7bd6ac,	0x5de3ee47,	0x9a0ca90e,
-0xc18cc94f,	0xb69c5689,	0xad1cd0c2,	0x99d9bda8,
-0x99c08dc9,	0xa5bb8cb4,	0x69be45d6,	0x66f262f4,
-0xe64fb256,	0x2bd7ec3e,	0x6a0ec5e0,	0xcd8db34c,
-0xd4449d54,	0x22359101,	0x47233556,	0xb251a6c5,
-0x1b3285a3,	0xc9395aec,	0xd3e35f52,	0xda8fe59c,
-0xa7fca4b1,	0xa5c83030,	0x1cc5573f,	0x0427645b,
-0x81d54e96,	0x9048b253,	0x44dc83a0,	0xed189dc9,
-0x75125d2c,	0x58a922bd,	0x899313ed,	0x8cf7f569,
-0x384c4ec5,	0x9029ca75,	0x55e95f72,	0xd02062e5,
-0x2e78d4ab,	0xed323243,	0xc433467d,	0xf9bb4b2c,
-0xde6a1a94,	0x89a58012,	0x84e1d244,	0xdabf2e13,
-0x6c47c470,	0xea2e2b7e,	0xec9eb0b0,	0x6765b902,
-0x0c435289,	0xf61b95eb,	0x1a250eca,	0x4ce92ea2,
-0x6e7142d6,	0x2ab22c57,	0xc8f57439,	0x59112122,
-0x5884b3cf,	0x2deaa963,	0xc267e8a8,	0xfc7cb9d2,
-0x7a7a5869,	0x75460f34,	0x1e114eba,	0x6af15809,
-0xbae1a8ba,	0x28e84fbd,	0x85e41b2b,	0xac55bc22,
-0xc55defa7,	0x2a97a719,	0x49215621,	0xd38639ea,
-0xd57a918d,	0x368d9f19,	0xaaf3ef52,	0x69cc2858,
-0x17b3adda,	0xbaee0227,	0x9820207d,	0xc522f5d4,
-0xc27c4e18,	0x03f72fe0,	0xdc3cc908,	0xd6620755,
-0xb2ed9a1a,	0x11023f9c,	0x73987f0e,	0x95317140,
-0x2a38064f,	0x04e90339,	0x2be7e65e,	0x7ab82b38,
-0x2e9941dd,	0xb5ff2903,	0x7abca5d9,	0x79544128,
-0x39f13caa,	0x250f104b,	0xb3d608ab,	0xa7c203e8,
-0xe46a126c,	0x1f0da2f4,	0xb6f10aab,	0x2a9dc6be,
-0x85b72c86,	0xca0082a6,	0x023c7574,	0xc313e95d,
-0x70f8b023,	0xf8c61769,	0x7c400ecb,	0x03d0c567,
-0x3b95f0ca,	0x15b27b08,	0xf3c65508,	0xdc644fd1,
-0x75811053,	0xe67c7ad2,	0x7d85c0b0,	0x0c9ff7d0,
-0x2e685183,	0x095684fd,	0x6df37cfd,	0xa270f064,
-0xf5569b4b,	0x06a86604,	0xdf4b2e38,	0xf20bf008,
-0x6e251617,	0x9226f9f0,	0x51a0cccf,	0xdd4b8357,
-0x9a0e19f2,	0x7ffbddef,	0xe8002b19,	0x405d642f,
-0xd33d5090,	0xcb321356,	0x7fad1948,	0xb51c4994,
-0x77c7a084,	0x846b88e3,	0xfa19afa5,	0x4c4fc587,
-0xae1fe064,	0x7de11dc5,	0x83cd780a,	0x58c33432,
-0xd294c3f0,	0x3a3de34d,	0x874e4202,	0x34bb7449,
-0x397ce3eb,	0xdcd7c545,	0xf6ed2d79,	0xaf6713b4,
-0xcaf9f286,	0x93f42d09,	0xfbbb0fc3,	0x959c402c,
-0x2c062ee3,	0x051bf973,	0x74f08ab0,	0x2a0f9d85,
-0x68403fa1,	0x767319f0,	0xe8586f1f,	0xfb547280,
-0x129c8c94,	0x30ac6b95,	0xad044183,	0x8de52a1b,
-0x42ac6ccb,	0xa2eb5eb7,	0xe086d12d,	0xb723b9c0,
-0xf7b95359,	0x55e156e8,	0x01fd9084,	0xeeafe28f,
-0x3c110061,	0x8a9d668e,	0xa1833a70,	0x0b301724,
-0x3765fc04,	0xf43aae92,	0x0aa2793f,	0x208cf158,
-0x8bb13e43,	0xd1231448,	0xba11c8f8,	0x6f779857,
-0x7136f774,	0xd4c8e9e8,	0x7be08185,	0xecd7cca1,
-0x4994bf33,	0xaa8886c2,	0xb76568df,	0x93271af1,
-0x0df50828,	0x059d3379,	0x40a60ea0,	0x6bccdbb4,
-0x776badf0,	0xaf2ccf83,	0xf81c05f3,	0x0732e9cf,
-0xfa57202a,	0x1d9cf14a,	0x74b91f23,	0x94f991b2,
-0xe844de4f,	0xf24aadee,	0x19ed94bf,	0x5508edc7,
-0xe63f71a3,	0x36e88397,	0x231e9e3a,	0xf48327b0,
-0xf0624859,	0x8f740e3c,	0x1cf3a3cd,	0xd115c768,
-0x8fb3e37a,	0x0f3524a9,	0x7d23a03e,	0xfcf1e790,
-0xd8b51c4b,	0x3b12793f,	0x3691a0a0,	0x0f2bfdfa,
-0x985ce377,	0x7d4914ed,	0xbe3dbd98,	0xc197bd8e,
-0xe54e329c,	0xf8188bc0,	0xd8e72a28,	0x3ba3f848,
-0xbf1d7200,	0x3bf294cb,	0xa0b6e8b3,	0x95927dab,
-0x12703692,	0xbf852302,	0x088454c3,	0xae6ce6fe,
-0xa837368d,	0x369448e9,	0xa8e05701,	0x9a714b61,
-0x3fd5d6b8,	0x51372f10,	0x77b0f2dc,	0xf946df23,
-0xd0d5feb9,	0xe846fbc1,	0x989ee82a,	0x31eb985b,
-0xf2025935,	0x36daa3fa,	0x73dc049a,	0x9a899e5d,
-0x33187670,	0xe8cc693f,	0xb0415660,	0xb0919235,
-0x252fd6a2,	0x02d472c7,	0xecd9f1c8,	0xdd2a87f0,
-0x33ff1cd2,	0x1648f3fa,	0xb6d72128,	0xf9a2eb89,
-0x17ece9b1,	0xa42fd9c7,	0x301afcda,	0x0ecf222c,
-0x52625ca0,	0xac16aa96,	0x4d3be9d2,	0x8186b4e2,
-0x99975b51,	0x328d10ff,	0x8424f1a1,	0x31e8162f,
-0x3e9834b6,	0xbe9a18cd,	0xcaf7599a,	0x8b8530b5,
-0xaa825750,	0xe22369dd,	0x447509c7,	0xec4d3e04,
-0xa5bdc12e,	0xde7a3edb,	0x0d98de14,	0x9eb54881,
-0x1924a171,	0x3bbc7362,	0x84714cf8,	0x96f82374,
-0xd74108ee,	0xc7205a00,	0x38f9d0c3,	0x78f8f8ef,
-0xdce3b41e,	0x026bd0db,	0x57a384c5,	0xd35b1158,
-0x36655a61,	0x6f822cc5,	0xb6324298,	0x83bf6575,
-0x15adf975,	0x6ce429dc,	0xa864560e,	0xc4da018d,
-0xdc8de183,	0x74d85fb4,	0xf3c15cc9,	0x79c83077,
-0x2e9c1446,	0x5e5b0871,	0x767a15f2,	0x5d3b47aa,
-0x5c09d151,	0x123ad6b8,	0xa21a53a6,	0x0b0d8034,
-0xc47f2d36,	0xc8389191,	0x209684e2,	0x05370aee,
-0xc9644803,	0x920ac415,	0xbd925b8c,	0x3c9f0f78,
-0xfab0acc6,	0xf2cfa403,	0xd2ac3d27,	0x25593cd8,
-0x0beed015,	0x5ddf5503,	0x2239be7b,	0xd03011b9,
-0xbe3b0df1,	0x95ab9bae,	0x27ac4734,	0x15742fb3,
-0x9a921ca7,	0x67a9d933,	0xbcccf85f,	0x60914713,
-0x12cdc887,	0x26c56b9b,	0x5fc7ee87,	0xc37272eb,
-0x7826389e,	0x781d8805,	0xca082c0f,	0xbf33b0ed,
-0x3c1010d2,	0x7513e78a,	0x02d1b14b,	0x68378b40,
-0x80dae0ba,	0xc3c15022,	0x8e1e34ee,	0x8345f599,
-0xa51b8941,	0xda9cc023,	0x61579c1d,	0x68e851cd,
-0xbfafc3b7,	0x022d3734,	0x135f8d36,	0xcdc3cb1a,
-0xc779738b,	0x7593033a,	0x8b4610f3,	0xf0158863,
-0x16d784a3,	0xc0551682,	0x9622697b,	0x88db3bdf,
-0x764b9d9d,	0x226c3e59,	0xf85f7fee,	0xd021a06b,
-0x9a9ba15c,	0x6bc761c6,	0x8cbc8b23,	0xba4d5545,
-0x693b8b99,	0x8d214381,	0xa32509a5,	0x7cac34bd,
-0x9a4b6905,	0x352c232f,	0x3d82dda0,	0x34d2dd17,
-0xefa03c83,	0x3ed1eee5,	0xbe2e5cb4,	0xfbc1f13f,
-0x0950a15a,	0xed410662,	0xee3ef306,	0x1be6f7ce,
-0xc27ffe48,	0x1afcab76,	0xcd1e0f8e,	0xa9f09079,
-0x0eca2d93,	0xff550565,	0xfc7c1a3a,	0xa7d74f14,
-0x73c655fb,	0x1719fb91,	0x8595fca5,	0x936ddfdd,
-0xfa176b9f,	0x9b0d5133,	0xe451cc28,	0x382aa742,
-0x9bfbe2d6,	0xad14a4d3,	0x6211ad39,	0xb5fae645,
-0x3e93763c,	0xd7b4d001,	0x045443e6,	0xc9fffbfd,
-0x10667b62,	0x98eff9e4,	0x7ceee6c2,	0x69086a1a,
-0x4aa03683,	0x5cf254fd,	0xac81bcc7,	0x649d5af1,
-0xa004c935,	0x421933f3,	0x0f5a412f,	0x945ccb31,
-0xc87b4948,	0x9f7ee55e,	0xbd78b91d,	0x590ef798,
-0x73001efc,	0x4c14b377,	0x1a45de15,	0xc8dda7e3,
-0xde57e6d7,	0x47e65d31,	0x01b560f1,	0xa502f06f,
-0xb6c5c16e,	0x7cb166dd,	0x7636c3c9,	0x4c108d98,
-0x73904c23,	0x1f5f3761,	0xe52b2ae2,	0x78b5952b,
-0x7fd50bb3,	0xae3bd1f2,	0x58ca3508,	0x0788523a,
-0xfbb55497,	0xc2179fd7,	0x25fa5930,	0xf5aeec4b,
-0x6082eb97,	0x1d9b4acd,	0x143b24b6,	0x34d507c6,
-0xcacc92f2,	0xc17c3be3,	0x19cfcbac,	0x33dba256,
-0x11825477,	0xdd6744ee,	0xf0b629b8,	0x57912940,
-0x15733ef5,	0xe634d0d1,	0x2dfeba27,	0xc6319803,
-0x7d15fc9d,	0x5c0b6eba,	0x0ecdde39,	0x32533d3b,
-0xbcd7848f,	0x06d09630,	0x1d3412d0,	0xacb97d0d,
-0xf54f8a7c,	0x3d3a85a3,	0x0e3fe0bd,	0x2e32d571,
-0xcf361a7e,	0x4983831f,	0x9cb8aa09,	0x98bca187,
-0x069db1a9,	0xe8134a79,	0xa7dd0172,	0xfe5fab97,
-0x3423dab8,	0x1f936b9e,	0xbfcbb3d5,	0xb6d131f6,
-0xd6aa2295,	0x63759bd3,	0x7bf69653,	0x07f4fd56,
-0x725b3288,	0x27682bac,	0x8ac30a22,	0x5a7d0cb5,
-0x9d3a0919,	0xe98f45a9,	0x62d8d92d,	0x641b53dc,
-0xd4cdcfad,	0xfcf5f997,	0x8dbc5668,	0x9b4b2a80,
-0xac909831,	0x44b9476f,	0xbb81e58b,	0x31a7c9e8,
-0x3bb674e5,	0xbde06fc7,	0xa6be53a2,	0xa2a30c2a,
-0x424aca03,	0xa408414e,	0x57cb60ef,	0xce46ef67,
-0xd6b97b89,	0xb885648e,	0x3f24d054,	0x1617dfbf,
-0x0650d6e3,	0x403e13d1,	0x4c18d9c5,	0xe64f77c2,
-0x6957ebbf,	0x76f77d78,	0x4651ac3a,	0x746888a1,
-0x86bdf428,	0xa7b61fa4,	0x69ec5eff,	0xebebde48,
-0x7aaa695a,	0x2f462098,	0x94d27b1a,	0x6ea584d1,
-0x0d9a3ace,	0x9cc23297,	0xc955b249,	0x131aaa99,
-0xa0d752b7,	0xa5bea5e9,	0xccc20d9c,	0xff448a18,
-0xecd6c82e,	0xc5ff74bd,	0x3b698564,	0x082f7980,
-0x61a9409f,	0x145b5ec2,	0xa8d65bb3,	0xfb6dbde8,
-0x404ed75f,	0xb32418af,	0x7df9ac58,	0x188aed62,
-0x82b41c35,	0x1fcb7d6d,	0x221023ad,	0x33e759f4,
-0xf4f7873d,	0x4874a5bf,	0xcebeec18,	0x16435619,
-0xd660d5dc,	0xfdd40b0b,	0x3332ba2d,	0xb843d48f,
-0x44a0390d,	0xc87ad47a,	0xbeb03e24,	0xb5cddd29,
-0x978e0836,	0x8d0f976d,	0x65358bb2,	0xdab3c7db,
-0xc1c1c421,	0xfbfcc560,	0xdcb21c05,	0x5db79c04,
-0xd57ae181,	0xd3e12139,	0xf6804667,	0x1e22f5ef,
-0xfa4e7bb8,	0xc734f8fe,	0xabc4eefd,	0x3e3edeef,
-0xa7504f27,	0x7dd07de3,	0x049ecb0f,	0x4faa2e25,
-0x0657d955,	0x3501f79b,	0xba88eb2b,	0x027ea7bd,
-0xc07e1907,	0xbee45c09,	0xce5077ac,	0xc29ae2c8,
-0xa5c529a5,	0x2240bd23,	0x003baa87,	0x94b0aa6a,
-0x32838466,	0x1a1bee19,	0x9302635b,	0xee524d8f,
-0x2c2ec677,	0x11ad493c,	0xef9d192d,	0x921064eb,
-0xec46ada3,	0x8215b76c,	0x734ab486,	0x81898de9,
-0xf686b56b,	0x8414b0bb,	0xd77227d2,	0xf89b8772,
-0x0bc6741f,	0x92d33ef2,	0xdf29599d,	0x60aa30bf,
-0x5c945cf1,	0xdfc639fb,	0x41921019,	0xb305311e,
-0xed6e0141,	0x44429de2,	0x2814d5e2,	0x9f35cd5e,
-0x2f5224b1,	0xce30fd34,	0x0db89af5,	0xc955122d,
-0xd7e6914a,	0x337c95cb,	0x8e582ee8,	0xad51cc03,
-0xced7bb1b,	0xcb839d39,	0x39eb6ff0,	0xfcd5f580,
-0x011e814c,	0xb070711e,	0xf207b150,	0xa0433d3a,
-0x9f88f7d1,	0x9560e6e0,	0xc4ff1232,	0xc87629cd,
-0xae8d5db1,	0xabde125b,	0xcd6334fc,	0x31ff85cc,
-0xe2c9a08a,	0x6c9b24dc,	0x402416b6,	0x9a9dd241,
-0xefd2ba2a,	0x23525dd8,	0x894dc2c8,	0x05c0f81d,
-0x7bcf377b,	0x91c874c9,	0x0b674950,	0x5292a9c5,
-0xe3b515f1,	0x70beba49,	0xa7566083,	0x135871ea,
-0xb3d56bbf,	0x88a9cfb5,	0x07c77cad,	0x6f827852,
-0xca657453,	0xcd618db5,	0x72ad2a88,	0x458854e6,
-0xdc73961d,	0x27fbb11c,	0x7a4ab77b,	0xbf253be1,
-0x57d57ea1,	0x680716bd,	0x663fd18b,	0x82cc4443,
-0x7c6102d8,	0xcb7ead69,	0x5f58e7f9,	0xc9e246dd,
-0xf2917165,	0x9534d3a5,	0xd298fa34,	0xf089f01c,
-0x9a7f2047,	0xc2061efb,	0xa94b24eb,	0x82755d44,
-0xea8d7c42,	0x059039a9,	0xda9a3040,	0x1da6c3ba,
-0x02b1f1ef,	0x77e5215c,	0x3050281d,	0x82bac2dc,
-0xf932ad41,	0x836ff9d2,	0x34770bd8,	0x71c7cecf,
-0xbbc52ea0,	0x5e4cec9c,	0x3f933fe5,	0x3d5156f2,
-0x90321f7f,	0x8e2ee8e9,	0x6c5cc0b9,	0xf25c9ffe,
-0x248295d5,	0x1973ca29,	0xe00a2db3,	0xed5d06a5,
-0x7d5263de,	0x67fb1703,	0x5c740bee,	0xdc4c55fa,
-0x69c44982,	0x9408eaf4,	0xc10cb46c,	0x34d77b3c,
-0x80e4011d,	0x795d39cf,	0x90e77587,	0xf47e8370,
-0x6eda0fa4,	0xbbe85a24,	0xa28d6e35,	0x1dc10b76,
-0x7c1c1fe5,	0x2babdd46,	0xc81ed994,	0x1339ad2d,
-0x2a9cc0c4,	0xed31b1e0,	0x5f4dba77,	0xc819f489,
-0xe1c49619,	0x0d445dd0,	0xa7b5fcd4,	0xbd4c0d41,
-0x42fba7b5,	0xa153350a,	0xaad15ccf,	0x573ba327,
-0x2cbc5609,	0x69376a8f,	0x53653e67,	0xe20d51d9,
-0x68559292,	0x4b04e15c,	0x05a91cd6,	0xa22f93b5,
-0xf2ad015f,	0x2626efe2,	0xab47a122,	0x3d61d5f2,
-0xda7f1d3f,	0xa1b3db0f,	0xb13b7071,	0xdf98f6f3,
-0x5ad04aba,	0xcde20b06,	0x8392dd5e,	0x6bd5c0ab,
-0x0caaaf64,	0x300608ab,	0x3bd4ba6a,	0xc9d03729,
-0x4ac8132b,	0x32abcdec,	0xa445533f,	0x728d3434,
-0xb1b02c22,	0x3d0d68d4,	0x4f8cc30b,	0x13c9f40e,
-0x84e01ae1,	0x6081ee9e,	0xe194bdb1,	0x5ef8e834,
-0x4bcb9347,	0x96eedc3d,	0xf97305aa,	0x6eccd9f3,
-0x8764e599,	0x204dd0d4,	0xa5437540,	0x311c31b9,
-0x62831f07,	0x0a36cf8e,	0x0ac92987,	0x0af77a46,
-0x6fe4c62c,	0xcbab3c9c,	0xf33d62db,	0xd564aa11,
-0x96857605,	0xcf480b90,	0x1a3720de,	0xcca17331,
-0xcb2b2dea,	0x0be380a0,	0xe5dfce5d,	0x1cfd0619,
-0x87ec28ee,	0xf23777ea,	0x187b3286,	0xefcfa123,
-0x491a4c38,	0xf3c39433,	0xc6f15560,	0xe41cbc90,
-0x802d41cd,	0x68882b7c,	0x289c1a7d,	0x05614a13,
-0xa4343f16,	0xa38c2ba2,	0xafb73657,	0xa944b9df,
-0x74e55f34,	0x2f4ff21d,	0xf131eef8,	0x0ef5b6ac,
-0xa88cb8d0,	0x72bfcb9b,	0x3c50db0f,	0xfc8604f2,
-0x888be3f3,	0xd65d8aa7,	0x077f9487,	0x475f1545,
-0xfc1a7834,	0xfbb3c276,	0x29d4ae1b,	0x73ceb23b,
-0x56914e3d,	0xd3349a98,	0x597b1180,	0x77a06b7a,
-0xfc443657,	0x6ae4340f,	0xde105fdd,	0xd8e62895,
-0x6347a3d8,	0x9c164dc1,	0x6ce3771d,	0x461b9f7c,
-0x76e6af34,	0x7639d5b3,	0x7b6b4e26,	0xf2917def,
-0x16ecddc1,	0x9a4dc498,	0x7efe74bc,	0xa0dd6ad7,
-0x7da7b3bd,	0xb3fa8cc8,	0xc380b5c2,	0xfa5397d2,
-0x55603955,	0xcd3d7de8,	0x2858a7a5,	0xc0f5f668,
-0xe8be8599,	0x95a7f5d3,	0x72a1ca36,	0x5cc1803b,
-0x07524f41,	0x1adfdde2,	0xe6c32b4f,	0x591b3d51,
-0xbcf44935,	0x3a3fb989,	0xd5a2960f,	0xecadfdef,
-0x4cfbca69,	0x44fb74c9,	0xe97b9340,	0x112c961a,
-0x15ea13a2,	0x3e7b83ab,	0xa884aec7,	0x441c09f5,
-0x123f039c,	0xcae13459,	0xf4db2c5d,	0x2c462c28,
-0x6c91cf2a,	0xe8f3cc3b,	0xf88464ca,	0x78a05617,
-0x785e5218,	0xffee9f91,	0x3b96f3d3,	0x4ecbe904,
-0x64366c76,	0x9ee3ca17,	0x99beae1e,	0x88802e00,
-0x252f9f1c,	0x88ba8606,	0x6bd00538,	0xd082f1b0,
-0x6eccb905,	0x4cf85611,	0x80fc0efe,	0x6907dfd0,
-0x05bfe654,	0xbad14db6,	0x72e5d49d,	0x067f2977,
-0x5f2fd09c,	0xf13eba72,	0x76badc64,	0xb3496815,
-0x4972bf43,	0xac0d4742,	0x0cf31094,	0x21dcf61a,
-0x4e5bc5a0,	0xb3236af0,	0xd86c3480,	0x2c261d40,
-0x9a910b98,	0xfe7b889b,	0x75030819,	0x8061817e,
-0x78911c6d,	0x3681a10c,	0x5cdc0928,	0xa4a81683,
-0xd949e676,	0xb5d8ca1d,	0xcaf8707c,	0x8bdab4c6,
-0xf777b588,	0x16c6d8ec,	0x10d7982c,	0xefbc0a1f,
-0xde2cf0a5,	0xa3a2c217,	0x042d6731,	0x855f28d7,
-0x7e2dc2d7,	0xb7312a9c,	0x0103ad9e,	0xea345f2a,
-0x091315be,	0x36b87acc,	0x7bbe8b8c,	0xd960484b,
-0x7c4c63b6,	0xd51e7bbf,	0x45e40c13,	0xd2252eb5,
-0xa17ee634,	0xbb931edb,	0x77950c79,	0xd98adee7,
-0x4ce0840c,	0x896585bc,	0x671f56c9,	0x6a90f075,
-0x4d71a26f,	0x5a16b821,	0x371a861d,	0xf9865262,
-0x56599a46,	0xa5d5ac42,	0x4ae9d9bf,	0xa86e8ecb,
-0x23ae12ae,	0x5de95cfc,	0x60a58b65,	0xeb79c0ba,
-0x406be042,	0x9bb8a05d,	0x26b28bc1,	0xe5fc9e4b,
-0x1e7947f6,	0x966f480a,	0xe29db78a,	0x39743fe4,
-0xa4e3a331,	0x5877cbdf,	0x25f9a660,	0xd97174a6,
-0xf3c561e5,	0xdb4b565a,	0x9d4d2383,	0x389b7af4,
-0xe06f4662,	0xc5468145,	0xbc602fdf,	0xcbf3db0e,
-0x97d8757f,	0x02836802,	0x6a681b64,	0x7337e8bd,
-0xe85d9502,	0xd6efec0e,	0xd7e8d30b,	0xcdf11803,
-0xef5fb0d5,	0xd5251f29,	0x574aefb2,	0xe691d7cc,
-0x4a4bfec9,	0x5aa7bd81,	0x68716104,	0xe5c40c92,
-0x7600d7b8,	0xcf95798a,	0x26e8bea6,	0xb1a38beb,
-0xbacd5b95,	0xecff91d3,	0xf15958f2,	0x75b02107,
-0xde523549,	0xba5fc05a,	0x7072115a,	0x1197a903,
-0xd808d1fb,	0xc7e709de,	0x1a65d1bd,	0x562bbd0f,
-0xf0541e82,	0x68a54aa6,	0xefad28ef,	0xc9262772,
-0x053e7cc4,	0x54bc9528,	0x74c92196,	0x618a0741,
-0x2b5421a7,	0x291c8e1d,	0xdbfdd7a1,	0x4fc60ddc,
-0x844a6b5a,	0xaf7ee867,	0xe9749f8f,	0x6deda822,
-0xf049feae,	0xb6a4fa4d,	0x5b2bc1c1,	0x65a52c54,
-0x32209928,	0x88051c7e,	0x8590db07,	0xf2934c96,
-0x39a98498,	0xb56f1a53,	0x64d2e2aa,	0xe9811515,
-0x8b2e77e3,	0x0e5471d6,	0x9a23a520,	0xd571a3be,
-0x259e6fb3,	0x09b878ec,	0xab8b31aa,	0x0d558e8a,
-0xdcbda8cc,	0xd6ffb436,	0x63fc4813,	0x1e2d9446,
-0xd7cd64cc,	0x9517c30b,	0x60cb42c7,	0x46cabadf,
-0xc84080e0,	0xe4ab3b0b,	0xb0c34879,	0x8b5c6526,
-0x77782561,	0x276aa4d0,	0xe86dbf8c,	0x989630f8,
-0x7d9cf3eb,	0x43928216,	0x36490c88,	0x472395d7,
-0x4f1e18ab,	0xb03ddcf6,	0xd10293b3,	0x119742d6,
-0x515f82a4,	0xe429568f,	0x9101c537,	0x382521e8,
-0x529345a7,	0xfdea02aa,	0xa5bba9cd,	0x9ecdad6e,
-0x93ecc7a0,	0xa1da94bf,	0x1eb6f562,	0xabc2ec17,
-/*  2129-m206f257.inc  */
-0x00000001,	0x00000057,	0x03152007,	0x000006f2,
-0x07e77759,	0x00000001,	0x00000020,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0xf0aefac0,	0x7c38e188,	0xba5a013f,	0xdfb167bf,
-0x3c3fed5c,	0x9a7527d0,	0x7f3ae5a3,	0x8ab688d1,
-0x348436ab,	0xdc4756d5,	0xfc2a0a22,	0x9f11b7bf,
-0xa47e1335,	0xc1e04f7c,	0xdaaf86cf,	0xa870c161,
-0x072e2279,	0x87ee60b8,	0x3e4b0622,	0x326b4d89,
-0x0652f8e1,	0x2ea0c801,	0xbeaa5953,	0xdc1b6573,
-0x701f392e,	0xed0630f9,	0xbc9b3dfa,	0x1640fe65,
-0x571a23c1,	0x9d913021,	0x895d7d30,	0xd2d2d7d4,
-0xd605ed58,	0x254a7575,	0x0cac66a8,	0xcfe8bbe5,
-0xcdd30390,	0xbb2236d2,	0x4c5c5bee,	0x5aee0bec,
-0xc7ccb2ce,	0x02e4a983,	0xc5920bf7,	0x4ce10d1f,
-0x3fc17820,	0xda1b4e54,	0x3de20b4d,	0x5ff322d2,
-0xd6de8959,	0xe35d9fbb,	0x7b450c74,	0xcdc09449,
-0x25bb7745,	0x056e0ec0,	0x05c27088,	0xeece366b,
-0xd99a08bd,	0xbf7aa5ff,	0xb99fb54a,	0x1e620294,
-0x5498c8b6,	0x7e9feeb8,	0x0bd593db,	0x9ae9d723,
-0xaf9ef586,	0xcf6b95a7,	0x8eb34bd2,	0x378c817a,
-0xc0a0b5a8,	0xd92c8ec3,	0x756277de,	0x6c023ab6,
-0x982be06c,	0xb8a70610,	0x7f5a8718,	0xa677cfa8,
-0x2e7ade57,	0x3978eec5,	0xc34a97d1,	0x37733521,
-0x5692ce95,	0x7b9fc090,	0x0d111e36,	0x6d9fb551,
-0xc48f3b9e,	0x6a1b2dfc,	0x8ba4b179,	0xb00f6962,
-0xfa149366,	0xbb1dc1b3,	0x23a921c0,	0xb96d73b7,
-0xcd4dc6da,	0xfc5e8abb,	0xdb5fe0f2,	0xcb33f9dc,
-0xaf75f866,	0x3dfd2478,	0xe7a5b475,	0x54a611b2,
-0x73994c7d,	0x161b27bc,	0x7f810ba5,	0x8dd5733c,
-0x72fe4c72,	0x2e76dbe3,	0x9f9f0c64,	0x0e21bdbd,
-0x4331bf86,	0x879b1ddc,	0x40c84fce,	0x7c5d11c0,
-0x3faf10ab,	0x3550eae6,	0x26996e67,	0x00ef27d2,
-0xccda83ed,	0x11030e92,	0x757074d7,	0xc5a517dd,
-0xfc3e7fd4,	0xc16d81ed,	0x9044cd87,	0x2d099580,
-0xb25b9d47,	0x5b610359,	0x0e59eeb5,	0x7d19f029,
-0x4cf9706f,	0x0f5c8597,	0xecf7aedb,	0x86d1ee8b,
-0x2c85f041,	0x3015ac75,	0xa0db24d8,	0xa9f07271,
-0xb78ec67e,	0xeca00670,	0xf7d05fe5,	0xdff30312,
-0x6ae19969,	0x63375a04,	0x466a01f5,	0xc171c0da,
-0x93ce8528,	0x703c1aed,	0xcd42cced,	0x32819c8d,
-0xeb642286,	0x72723b25,	0x86c46d68,	0xb64d3c67,
-0x3d3bb64c,	0x60eaf2be,	0x924b7f3d,	0x0bb38768,
-0xaf2deef9,	0x2fa43b64,	0xdb0823ee,	0x7ddb339c,
-0xea1cbf8a,	0xb19895d0,	0x1d6fd197,	0xb9a9343e,
-0x31ce5f2e,	0x9399fc36,	0x14d6f1dd,	0xdd6ed0ac,
-0xd9e8f45a,	0x56dba12c,	0xf5ef138a,	0x981a6eaf,
-0x74fe5839,	0x370aab6a,	0x717df9f6,	0xa4dbc8d1,
-0x3c665e8a,	0x07711522,	0x58911dfd,	0x9276384e,
-0x70dd2327,	0x2613f4ad,	0x67043d57,	0x085bc73e,
-0x13399b60,	0x28b0d7e3,	0xc7101b20,	0xa29550aa,
-0x8177a1dc,	0x5bcc83b2,	0x1cf50fbc,	0x448c109a,
-0x09288db1,	0x1700bdcf,	0xa119bf8e,	0xdaeb3c27,
-0xf21a1004,	0x3490c7e4,	0x6562906d,	0x732225be,
-0x4ca41b48,	0x9807ec37,	0x82c2c81a,	0x182ae052,
-0x337f2a6c,	0x177a866f,	0xb0397a1e,	0x8aa9e3d2,
-0xb596cae5,	0x52630925,	0x069e969f,	0xb8a6cf5d,
-0xe206c823,	0x95768639,	0xeb9ef6c1,	0xdc879822,
-0x805b7540,	0xdbdca41e,	0x92daf8aa,	0x2855131d,
-0x98537e07,	0xf9f437ff,	0x4fd88be0,	0x07cadd26,
-0x61c5f34a,	0xbb6a19cd,	0xc113d97e,	0xc2097fa8,
-0x93df4c5c,	0x71f49496,	0xeeb280b9,	0xd8b31a12,
-0x8c68fe2a,	0x6c85e6c5,	0x665d8833,	0xbf7ca2d8,
-0x8ec9d5fb,	0x2d8ada4b,	0x1112da86,	0x1eadb344,
-0x72bb72b4,	0x1146c42e,	0x9c4a1796,	0x103a8aa2,
-0x4e22694d,	0xdabb9fb9,	0xa643d98b,	0xa1e82adb,
-0x5e1f20ec,	0xc1179fc2,	0xdf5791d1,	0x1071ced5,
-0x940a595b,	0x9d575c0c,	0x572a6eb6,	0x68866e0b,
-0x2cc54642,	0xa0b47fe9,	0xd53f7591,	0x40c57980,
-0x7e927dfc,	0xad644a5e,	0x2f6b3a0a,	0xb4c788d4,
-0x59131505,	0xdf982aa7,	0x7eed9890,	0xc7a79316,
-0xa390c1e8,	0xb6a81315,	0x8b6ecc2f,	0xa18d162e,
-0xa96a54a1,	0xf9801a9e,	0x763aa20d,	0xfcba9e42,
-0x1d8f9e51,	0xb63608fe,	0xd0bca8d5,	0xc05b6fc3,
-0x1dabad44,	0x864011c5,	0x92a94ac3,	0x7e2bdb44,
-0xf1e0e0a4,	0x4e988af4,	0x51934b03,	0xc2eb8a5d,
-0xf58b0dfe,	0x88c9c264,	0xe81e0809,	0xb3087c8c,
-0x1f0cdd31,	0xcab43925,	0x02120053,	0xd4d308cb,
-0x5727a77a,	0xc0a58a07,	0x45b8004e,	0x4b887559,
-0xd5a6cfbd,	0x096d6b43,	0x8f7c3cf9,	0x10a9f009,
-0x8b55e8c8,	0x286cd461,	0x5d340d0f,	0x2e071f42,
-0x3c156062,	0x4a2ba5ed,	0x466f979d,	0x36ad6534,
-0x432a28d6,	0x23dd3681,	0xb782ecfd,	0x4ac65284,
-0x190c3fe3,	0x32371293,	0x1b4a968c,	0x4d140c3b,
-0xe9602892,	0xaa61bb7f,	0x87d82028,	0x833b076d,
-0xf5dfc16a,	0xe7e7e8cc,	0x9b9b123d,	0xe55f7f06,
-0x019ca425,	0x8c2ad978,	0x6e53312e,	0x4c68cc59,
-0x1505573b,	0xe50246c3,	0xe13f8925,	0xb40d8c6a,
-0x6df7688e,	0x64ddc299,	0xfa2de5ee,	0x8e22c09b,
-0xfc43e080,	0x27bdf731,	0xbd811f19,	0x50eb4114,
-0x33aefa80,	0x0dd5a922,	0xcb087d89,	0xf594aaaf,
-0x469590d5,	0xc2610f7e,	0x357f27f1,	0xe30b5697,
-0x744a47d4,	0x18703bcc,	0xbd00cbb4,	0x859b13b1,
-0x83259929,	0x71700966,	0xa6586c05,	0x70a61cb9,
-0x67af2d49,	0xbc1a3e58,	0xf6f3b5c7,	0x916983f3,
-0x3b99438f,	0x993ea084,	0xd2e842ab,	0xaae24c93,
-0x38902c9c,	0xcdcaa742,	0x1407900f,	0x4fa9a83f,
-0x0d87845e,	0x3dab31dc,	0xd1f773ee,	0x0b5181b9,
-0x0dd327f1,	0x9de29e99,	0x11d78ea2,	0xc66b0639,
-0xc97fae80,	0xd352bbe1,	0xfc19afbc,	0x713381a9,
-0x51b9502a,	0x355de567,	0x040ee678,	0xf4085bdf,
-0xc8b52da4,	0x7b851dfd,	0x94f53879,	0x936c3596,
-0x005b0eda,	0xb17d6d52,	0xf576900a,	0x99234c3d,
-0xdd2388f3,	0x3920a2eb,	0xce320776,	0xbaa6bb20,
-0x82ccef09,	0x15f3fa80,	0x30e218d5,	0x9f7c35f6,
-0xfc422ad6,	0x697ba237,	0xe9bd989a,	0x20573da5,
-0x526140be,	0x54023897,	0xd9ff4fbe,	0xee0c4495,
-0xe62410a3,	0x5150c878,	0x9a2c671c,	0xf76de5ad,
-0xd3eb74b4,	0x0688ec67,	0x7d4f12b3,	0x4fcbeb96,
-0x81b9489b,	0x257b67a2,	0x0538b984,	0x4aeb1a19,
-0xb3632b9f,	0x42148957,	0x71801f3e,	0x3ed494f4,
-0xe1591118,	0xa4542eeb,	0xca3d0445,	0x03b948a9,
-0x767a31b4,	0x090f62e1,	0x701890e7,	0x1cdf23f4,
-0xaba00984,	0x1b42b0e0,	0xb5369d19,	0x0e582a3d,
-0x079fc09d,	0x0a6b1256,	0x166e21c0,	0x4dfbf861,
-0x68d90df7,	0x1392544f,	0x52e420f2,	0xaa437eb1,
-0x355fe827,	0x5e5a497f,	0xb06b9003,	0x118c85ed,
-0x7c8b1f9b,	0x710f30bf,	0xf42ad4e0,	0x70a17971,
-0x3321840d,	0xebf2f3ca,	0x6820d080,	0xe5987997,
-0xf1bcc9b5,	0x9357765e,	0x317884cf,	0x3449efff,
-0x641d249c,	0x8dae0eec,	0xa5db1774,	0x1c06f4c6,
-0x0dbd7c38,	0x18dd265a,	0x206eed23,	0x1b1f3780,
-0x4e6b063c,	0x07169a13,	0x1b16ed6e,	0x87de6f65,
-0xfe05eeca,	0xd3e6958f,	0xef53638e,	0xb8fa5b3a,
-0xed4aa69c,	0xf229c96b,	0x922efea9,	0xf2e9f8d6,
-0x7626207d,	0xac94bddd,	0xa055f4d1,	0x7cf49e93,
-0xb68191fd,	0x5d1e0522,	0xb778bc1a,	0x667773ab,
-0x0547d582,	0xb990ca6f,	0xae44199e,	0x090f8cbb,
-0x66909346,	0x990b0a60,	0x866f804e,	0xafb29f1d,
-0x85635204,	0x5531bc16,	0x766099af,	0x3128bdc5,
-0x564838ac,	0x0f6a5d39,	0xc560f67b,	0xc7820c23,
-0x05bb1328,	0x6f9484ee,	0x319809ab,	0xc0dead11,
-0x30928a58,	0xcea6f365,	0xae4c63e2,	0x375bb2f5,
-0x0d7b1cdb,	0x6777d042,	0x70d56f28,	0xa67ebccb,
-0x1f02a61b,	0x148f5044,	0xa2ff3cd5,	0xdacfcf0e,
-0xcec94c27,	0xee4af516,	0x0cddc248,	0x018cda30,
-0x9d70143d,	0x197a6a8e,	0x6f651d33,	0x6faa4e8e,
-0x8ebf8215,	0xead609df,	0xfd2f388b,	0xccb70ecc,
-0x4a670925,	0xdd621f46,	0xb9e0bae9,	0xc9937471,
-0x0a4232eb,	0xc7ba26cb,	0x8c3a7e17,	0xcef032c2,
-0x73b75440,	0xcca87896,	0xb544c0d8,	0xcadfa89e,
-0x3392961d,	0x5d99f95a,	0x00974612,	0xc5b871c6,
-0x9336a0b2,	0x9dc01d28,	0xcf6f39e6,	0x847c7351,
-0x0b990971,	0x70184dd8,	0xe5257c82,	0x721e7ef4,
-0x8922a618,	0xacc61d52,	0xa31cb090,	0xec6e46bf,
-0x0e22d152,	0x88c3a2f8,	0xd4cb10f6,	0x1e2bd43f,
-0x67d26f37,	0xf6a2b4d3,	0xd4229cef,	0x89626856,
-0x81400377,	0xa80b84d0,	0x1f5b6e64,	0xb5def54f,
-0x8db7711e,	0x69b7f916,	0x1d3dda64,	0xe5c6d920,
-0x6b3459ab,	0x5dc96ae2,	0x083308d7,	0xfa84b8a6,
-0xb8f0a688,	0xa806c32f,	0x04d3a1a8,	0x58f5f04c,
-0xf0233835,	0x7f5cb42f,	0x5eceef54,	0x577374c5,
-0x51aa783b,	0x8ffe6da8,	0xc118f745,	0xe881675f,
-0xb1e02bf3,	0x63db76ef,	0x8b0848ac,	0x0e0573ec,
-0x1d4fc251,	0xf430354c,	0x38b5b60e,	0x0c942f9c,
-0x67f1905c,	0x7428f8b0,	0x79297d7e,	0xa93f388c,
-0x051e8616,	0x48e03984,	0x04d97406,	0x7413b6d4,
-0x6a3f6f8d,	0xfaed5a44,	0xdc89c0a1,	0x1b2611d1,
-0x21ca7dd6,	0x9c9d1448,	0xab3687c2,	0xc275130d,
-0xbeec53d3,	0x93e05b62,	0xd164a9d6,	0x1418ada5,
-0xcbb235da,	0x01cde834,	0x16d895fb,	0x5d916eeb,
-0x2f8a4045,	0x671dd425,	0xab40ec3b,	0xed3eefda,
-0xc1a93fd2,	0x348066fe,	0x538e9697,	0x3a73512a,
-0x0eded14d,	0x7cc7085a,	0x1a769924,	0x8e11533c,
-0xb961df1e,	0x73db50a8,	0xfe625496,	0x79b0bef6,
-0x712f024b,	0x997a8bd8,	0x3009ce33,	0x38a922fa,
-0x2f1b74d9,	0x70342c80,	0x587b1639,	0x9f02fd01,
-0x5c8c4977,	0x6b0d1be1,	0xed9fb8fe,	0x0d1c9fa4,
-0x3e51d08a,	0x2ecdd796,	0x71768e1b,	0x803c8b2d,
-0xc009ac20,	0x242dc6ee,	0x6c9cfe25,	0x8cd3dbc4,
-0xb35832db,	0x4613ba88,	0xab1274dd,	0xda19e833,
-0x49c0fb40,	0xeb37ba33,	0xdf06e975,	0x90ad6d1b,
-0x8aef380d,	0xa4cfb894,	0x107819ab,	0x01f89df1,
-0x1ea242cc,	0x17626b76,	0x9568d1a8,	0x3e584238,
-0x9c0ba10f,	0x3de6d8b8,	0xbcff277e,	0x94ba4d60,
-0x24f88a80,	0x7d336afe,	0x04f4af38,	0xa435ae27,
-0x82c5de40,	0x28b78b43,	0x5f4f3836,	0x809d1a13,
-0xdb95ee3a,	0xacc8e9b4,	0xd0d6cf98,	0x9ba813cc,
-0x6e89a462,	0x2afbe3c3,	0x5d662eef,	0x5365d477,
-0x98bd0b86,	0x81c1601f,	0x15cd7693,	0x8b3d7ef9,
-0xaf25331e,	0x49c24e40,	0xe6e8a26c,	0x0f083b65,
-0xdcaa15a9,	0x26101687,	0x9dd1cad9,	0x80a9b15b,
-0xac16e5e1,	0xb85861bd,	0x78c59bbe,	0x284648f0,
-0x1f1af2cf,	0xbb834fbf,	0xd7d71460,	0xcf44c671,
-0x573bd611,	0x76e94cde,	0x17c03286,	0x02621543,
-0x705d0c85,	0x2b6d6b0f,	0xa8f17a22,	0xbde3ed1e,
-0x09afd9cc,	0xf84955f8,	0xa7d1dabb,	0x82343b59,
-0xa3fbc5f1,	0xfcdce701,	0xd600158c,	0x71262e33,
-0xcb257268,	0xf3f17de9,	0x257ec37e,	0x366552f6,
-0xd39c706d,	0x1372a7ef,	0x84fb48ea,	0xf1c4776a,
-0x182f548f,	0xa5499971,	0x488e7904,	0x4167ba8d,
-0x796aa238,	0x41eedf0e,	0xe65e7ffc,	0x7352ab66,
-0x7ea8d981,	0x93c717f5,	0xc8124404,	0xa7447a65,
-0x231dd863,	0x17581b25,	0xd10a9250,	0x5807994a,
-0x12b18ae5,	0x80d03bbb,	0x7595c1b1,	0x6e878a42,
-0xbc2db045,	0xde5c7e5d,	0x8f096855,	0x82dc150c,
-0x7afd3dca,	0xf274e65a,	0x2abbe67f,	0x0145568c,
-0x014dba37,	0x9a182028,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2492-m02f480e.inc  */
-0x00000001,	0x0000000e,	0x01152008,	0x00000f48,
-0x0e158e10,	0x00000001,	0x00000002,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0x26d329c9,	0x2a31e166,	0x64caf9e8,	0x20f1b670,
-0xfdbf281b,	0x2af51e01,	0x72756a40,	0x3e4d0c5b,
-0xcaeee752,	0x238030a7,	0xe2ce4e5a,	0x1fcfa6d3,
-0x212a11eb,	0x27942a56,	0xfc6a38cd,	0xe34d32a3,
-0x0135b4db,	0x1c3ea42e,	0x8c954d65,	0xe6bf8037,
-0x5f2605e0,	0xe501cde9,	0xeab0c8b6,	0x10b3a2ce,
-0xb7eea79e,	0xd44f406f,	0xa5594234,	0x42ab402a,
-0xa1bfb70b,	0x3bb73da9,	0xde650246,	0x57bf4792,
-0xb87196fe,	0x7d1ba897,	0xb9ef2ec5,	0x0947fe70,
-0x26ac2342,	0x6b027d85,	0x49182232,	0xa216850a,
-0xde95e8db,	0x2ba8a7a6,	0xd7766e2f,	0xad019a11,
-0x086098c2,	0xb97ce7f3,	0x15b8e4be,	0x2bd14f31,
-0x8651d72b,	0xa6baf5b0,	0xe91cbdbb,	0x3e4b99dc,
-0x225f51de,	0x192dd4e3,	0xf3bc372d,	0x18fa15aa,
-0xf3e31f51,	0x3b14d857,	0xe7fa8fa3,	0x0da2529e,
-0x8e0ec6c4,	0x2a9f8fe5,	0xd4a45e9e,	0xd3e5ea7f,
-0x579e5fc1,	0x0ee7b49a,	0xc3e1a74c,	0xfb79ea09,
-0x880ba650,	0xe1f6d05e,	0xcfc8c022,	0x37c66627,
-0xd75964b9,	0xf8aa3544,	0x36f59197,	0xfd60ee29,
-0x7333fd01,	0x06e588e0,	0x7070e0f9,	0xd8a52405,
-0x4552f44c,	0xd2b8ff77,	0x04f7ff67,	0x34a28a85,
-0xa90ca13b,	0xda9da5d1,	0x6537651b,	0x6689fe66,
-0x780b74d2,	0x29dcda62,	0xd752595c,	0x58fffec9,
-0x29bc82d2,	0x580c129a,	0xe73ebb85,	0x14d7ca3c,
-0xcd3d8678,	0x7ab2b0f3,	0x156b319d,	0xfbe3d5cf,
-0x2238d540,	0x3a11150f,	0xb3e2a0ed,	0xc8574d79,
-0xfca2b05b,	0xc00997f0,	0xace0c378,	0x1f44d4f4,
-0x0b8b7c33,	0xe13b230a,	0xc2490427,	0x031bee7e,
-0x2d612498,	0x3f0171d4,	0xe8072f7a,	0x397143f2,
-0x84953dd9,	0x0b9dc83f,	0x300595d9,	0x389ceeed,
-0x23d176ad,	0x051fab35,	0xab27ec76,	0xb98e9c4b,
-0xdf2dfda2,	0x198d7e32,	0x1690c93f,	0x939444ca,
-0xd2a58ee9,	0x80d9fca7,	0x972197c3,	0x3cb3902e,
-0xe26ed52b,	0x93a6a765,	0x97f4845c,	0x2b2a56ed,
-0xd47788f9,	0x29723637,	0x34f7675b,	0x19c38cc4,
-0xab093705,	0x2d3e1fdf,	0xcffb6671,	0x3b6c43ed,
-0x168b0f4e,	0x36798907,	0x0750d02a,	0xd47ac88e,
-0x7c417cb4,	0x255aaf00,	0xa457d84b,	0xd6102100,
-0x21b7eecb,	0xe91e4a6d,	0x689db121,	0x2f53b34c,
-0xf49968de,	0xc3129683,	0xc775fb99,	0xc893db52,
-0xfe7ffbc7,	0x300ea6eb,	0xc18686d0,	0xc32fa6c1,
-0xd06c2a32,	0xee5b2e2c,	0xbaf7fe09,	0x007876f8,
-0xfece2039,	0xcd363d13,	0x4c78a4c4,	0x6d35b3de,
-0x6f6e97f6,	0x27cc312c,	0x13aa914f,	0x6b1ebd26,
-0xd1cf582c,	0x70d65a3e,	0x418b9938,	0x3f45056f,
-0x12a4936a,	0x7ff921c9,	0xc14f627d,	0xc95e29f7,
-0x591a88f9,	0x28098309,	0xac37ccba,	0x430201a3,
-0x91d4ccfd,	0xcb3c735a,	0x6245ebbf,	0x88b4fb5f,
-0x18cfedb5,	0x5bab7c90,	0x246ea4fc,	0x4ac1a532,
-0x2601517e,	0xae32740b,	0x56a159ff,	0xf324850a,
-0xedc8802f,	0x5847b188,	0xf8ef6ac1,	0xa00d1e66,
-0x678a4044,	0xda1aecff,	0x44bd1f23,	0xeb235eb2,
-0xe00f1b18,	0xac4c0fca,	0xecaf8fd6,	0x7036dc67,
-0xd5f37dc1,	0xf72976da,	0x4d6456cd,	0xad279354,
-0xc1c5fddd,	0x56f9ce6e,	0x086448da,	0x1133cd3b,
-0xba098b6d,	0x9acb3d7e,	0x253a1c15,	0x801f316d,
-0x82ddd5a5,	0x1dbbe457,	0xc6f6e988,	0x902e4e3d,
-0x9919be4d,	0xb7ed04ed,	0xfc5c9307,	0xf0242aee,
-0x56fc8d05,	0x80cd70f8,	0x3813442a,	0x6c6dbf5e,
-0x3216843c,	0xd4900c7d,	0x6545f49b,	0x928a68a3,
-0x524a4f32,	0x7b3905b9,	0xa66a83ac,	0x2a9df94f,
-0xb21baac5,	0x86a90f8f,	0xd9444a1a,	0x9aa56218,
-0x10a058ef,	0x39bcf149,	0x96bc6beb,	0xb13c2c89,
-0x08524f97,	0xab471f45,	0x3809188a,	0xf48e0587,
-0x2815e009,	0xafd9eddb,	0xddc23417,	0x4afd35a9,
-0xa97117f8,	0xd57a04a5,	0xbd112ff3,	0x869f93ee,
-0xdc41bfaa,	0x53a50f37,	0xc4560207,	0x750c1513,
-0x318ba469,	0x9bc9113d,	0x7566de7e,	0xe9342ec5,
-0xc521eae8,	0x66fc9347,	0x6b9c5469,	0xb097ee33,
-0xfb0ebe09,	0xdb230dfe,	0x7236dcb1,	0xa13bd311,
-0xd090f61e,	0xb30a630a,	0x7e469844,	0x1574c338,
-0x6637aafb,	0xa923111b,	0x8a3b735b,	0xa9ef6b12,
-0xbd54b8f4,	0x31743069,	0xc51e14fe,	0x3cce36cf,
-0xbbfe8925,	0x8348d42f,	0xa3582761,	0xb0d695a1,
-0x041c41ae,	0x0ced43bd,	0x7894160d,	0x88dcae84,
-0x705c8bf0,	0x9df891e5,	0x2e0b5b29,	0xd4d02b62,
-0xef42b7b8,	0xab7fb5e0,	0xdf91d193,	0x44ae8a6e,
-0x7db530e6,	0xd54e99cd,	0x814b796f,	0x80a57ccb,
-0x613de203,	0x53d285ce,	0x2ba54805,	0xced4eaad,
-0xaecdf197,	0xb619023e,	0x2cbb224f,	0x7e3361f0,
-0xbfb38295,	0xfb8dc293,	0x21be50ff,	0x9b796fb4,
-0xca0fab54,	0x649e7d59,	0x3b6119a5,	0x4751bf87,
-0xfad7c36f,	0xb51a9528,	0xfca25ca7,	0xf1730857,
-0x5072c2c8,	0x4236343a,	0x0fb02c81,	0x84ab3bce,
-0x8ca08cbf,	0xd28234c1,	0x1a8a8e91,	0xb8108393,
-0x5052d682,	0xa85bc44b,	0x8d422806,	0x2c9323a9,
-0xdf62b41d,	0x9eb8bdce,	0x816a8338,	0xa7655082,
-0x9d59bac0,	0x1efeb4f6,	0xc02dfa19,	0x7184335b,
-0x769c612b,	0xbba63013,	0xcb8c503b,	0xcd535067,
-0xcd5b29c5,	0x600f9b97,	0xe312a5b3,	0x882260ac,
-0xd16df980,	0xc07031f7,	0x46844f67,	0xb667c308,
-0x38a195da,	0xaf7cc01f,	0xedb0af82,	0x146868de,
-0xef745dfb,	0xa3bb9477,	0x111f96dc,	0xadcf97c9,
-0xa48abf8d,	0x1e6c5e79,	0x981b20d3,	0x607ed92d,
-0x88dce122,	0x81b35fd8,	0x2a5bb215,	0xe4c557bb,
-0x01b9f5ec,	0x6f31c367,	0xebd7a3a5,	0x87bcd4b2,
-0x0e04acdb,	0xefd29047,	0xa19c4bb9,	0xd1de82e3,
-0xe7170238,	0x950c1ea1,	0x6dce3702,	0x5e30c2da,
-0xf786a74b,	0xf6fe2687,	0xbac9b605,	0xa26947a5,
-0x0b395022,	0x604f5ae4,	0x7d2847fd,	0x432eeeb3,
-0x1c09cf16,	0xa60b6e98,	0xee527eeb,	0xcecd3d22,
-0xde22d726,	0x75624129,	0xe6f47f23,	0xa386fb10,
-0xf95e758d,	0xf8a1f18d,	0x38f8ba6d,	0xff037cdc,
-0xccb5ea45,	0x9ddc0def,	0x2c38a7fb,	0x4b1a63f3,
-0xbe91dfa0,	0xf26ee0eb,	0xe525faa6,	0xba5015ed,
-0xe9c34553,	0x4f02da17,	0x6da6c9c0,	0x4ab2989d,
-0xd48c6d4f,	0xa20e07c1,	0x31025c39,	0xc24effd9,
-0xd472d1a6,	0x70015259,	0xc9d61f68,	0x8f6bda07,
-0xbf07f2ed,	0xf94e2538,	0x59cca88e,	0x7d31044f,
-0x72bb31ae,	0xa97a9f31,	0x4684ae46,	0xe6a968c2,
-0xa37ce630,	0x47cb0d2c,	0x57487010,	0xad79a0ad,
-0xbefba442,	0xecd50f6f,	0x09ff40ab,	0xf00c2385,
-0xad02800b,	0xa96538b1,	0x094d47f7,	0x55fca4c2,
-0xdbe82bc8,	0xe05d82c2,	0x3684f7bc,	0xa1576624,
-0xa33c406a,	0x4ddf61d6,	0x83bfb554,	0x463b70f7,
-0xf73bce0d,	0xa9b08421,	0xd620965f,	0xd8c2edbb,
-0xcf5db224,	0x78174e0e,	0x49f680bc,	0xbab62686,
-0x5b6eac65,	0xf3a6efce,	0x35eff0b7,	0xc6b03da9,
-0x77684b20,	0xb48cdb78,	0x4020f7e4,	0x659a3023,
-0xe96aa5d2,	0xec28f986,	0xa92392e1,	0xaf6aedd8,
-0x9261c6f5,	0x51e7ee22,	0x1cbbe21b,	0x12dfbf72,
-0xe87ec370,	0xa53bedbd,	0xd87ba8e8,	0xa5362ee2,
-0x01aebef0,	0x13c6a152,	0xf80c3a0f,	0xb6c35e7c,
-0x8b2a8d15,	0x828d549a,	0xc0e5536e,	0xcd1426a8,
-0xb220bba0,	0xb2bcdd47,	0x3cb67cf1,	0x5984accd,
-0xff3c2260,	0xd69c2315,	0xf34b7ec0,	0xaa2ee403,
-0x633e4f08,	0x4943378f,	0xf60dc7df,	0x6af330f0,
-0x6fa7d05d,	0x99d2865b,	0xe0da1dcb,	0xebe60192,
-0x7576458d,	0x74be16a3,	0xdfddcf36,	0xa949e0a5,
-0x1f72671d,	0xccd794bf,	0x803405d3,	0x8c8c6eb6,
-0xd1900d4c,	0xa2ac908f,	0xb5b7e8f0,	0x06763fcf,
-0xe025fabc,	0xbd099c25,	0xe30e17ea,	0x930efe48,
-0x39fc45a4,	0x2c78dacc,	0x1d41cbb3,	0x7ffcc8ef,
-0x072cfa44,	0xacb0f715,	0x121a513c,	0xe83ff719,
-0xc3565191,	0x7f44232d,	0x941b33f9,	0xa1e5f1fb,
-0xaac18ea4,	0xe83de443,	0x5904f7aa,	0x9b193c83,
-0xafeb41c0,	0xb0d4db80,	0x403544c3,	0x1e208572,
-0x75914e29,	0xbb86975e,	0xe66fa54c,	0xa9165618,
-0x635e2b4d,	0x2dc3456c,	0x64fb7834,	0xbae07479,
-0x283a0bc7,	0xa2211209,	0xcda39444,	0x00502dde,
-0xad8b539b,	0xb8a18c01,	0xd727d11d,	0xab35221f,
-0x09a7dd1c,	0x3904551e,	0x26c7a4d4,	0x11c234a4,
-0xf0560dc5,	0xb2af70b8,	0x4b7f6422,	0xabf74fd1,
-0x2e32ea94,	0x136f4dca,	0x531e2580,	0xac64c2d3,
-0x37f72d03,	0xa27d543a,	0x975dfbc1,	0xe32a2320,
-0xcecad332,	0xb334e990,	0xec6e5e82,	0x7b39ad67,
-0x9132dbed,	0xe74eb37f,	0x63f471c2,	0xad41d537,
-0x6652a551,	0x50a379da,	0x4fd9e74a,	0x66d0fbe6,
-0x784ce5ff,	0xbe5563f9,	0x4b284764,	0xe82b834a,
-0x77cf145c,	0x4ef3a9c0,	0xfc55142c,	0xa6731995,
-0xe486a03e,	0xc5ac0d3b,	0x96bd7e44,	0xfcf5ac60,
-0x32bac91f,	0xa6330551,	0x2c3bce42,	0x6d227527,
-0x4a7f47d2,	0xc9f95de3,	0x2e7f69c3,	0x977a83ef,
-0xe8d20c95,	0x5b37f1dc,	0xd24cd253,	0x5695e75b,
-0xc59d1bbb,	0x9e0c8899,	0xaf99fff8,	0xed06d8a3,
-0x124cda7a,	0x61e14106,	0xb8eeace4,	0xbaaae21d,
-0xa3edeaa3,	0xf025cfe8,	0x4f2d7c14,	0xa53fcbf2,
-0x5cb87002,	0x88d1a87a,	0x9823105c,	0x0b5f2f3f,
-0x3b4b6622,	0x8abe9d68,	0xb7b1a872,	0xb6a23ca5,
-0x2f8af0aa,	0x01544728,	0x718ddea8,	0x852a466c,
-0xcc32c43b,	0xa6ae2bf0,	0x60a276cd,	0x03cf1680,
-0x090c769f,	0x97023bbb,	0x28dbc21b,	0xaee326da,
-0xa17aea81,	0x3be0c263,	0x480c7990,	0x79eba014,
-0x55fe3d34,	0xbdf26e31,	0x3262f1f3,	0xe6b1c5e9,
-0x2e3ecf14,	0x4d358a4b,	0x5c53574e,	0xa5394bc6,
-0x733d8452,	0xc09b4dd2,	0xe91efd31,	0x46ab9076,
-0x0ee5a689,	0x9ce07e53,	0x2778e5c8,	0xeb2eb6db,
-0xf258b653,	0x4ca89510,	0x3d169c4c,	0xa5dcee98,
-0xe4f1cc45,	0xeaa1f475,	0x6aaf5b9c,	0x40e58956,
-0xda8c24e8,	0xc88ad138,	0xd66fc509,	0x03580145,
-0x778d829d,	0x0e2da91f,	0xea3dba0a,	0xacfd2069,
-0x8b2168d7,	0x8d372293,	0xbba81d9d,	0xd810cf7c,
-0x2449fc84,	0xb05c099a,	0xf1ee1a85,	0xe2c79e38,
-0x3eb91494,	0xf54b159e,	0x0fd4eac2,	0x260a4242,
-0x7c57334a,	0x7fd9b0c1,	0x0d687a4f,	0x72bc613d,
-0xfa006dac,	0xb9457cd2,	0xfc4874ad,	0xe5242d02,
-0x38794801,	0xf8e9f59b,	0xcb0a1361,	0xb42ec54f,
-0x9cdd85bc,	0x27eabc2b,	0x84aff296,	0x8d245ebe,
-0x301fe4fe,	0x6f4aa07c,	0x4a9f5c6f,	0xfe264902,
-0x90212b27,	0xe8b57c59,	0x9557ef6d,	0x4c53ecc4,
-0x5d1fe0ea,	0x7b94651a,	0x84d10139,	0xa5ac3520,
-0x1eda05b3,	0xd98f2126,	0x4b82d50f,	0x39e35e82,
-0x2347f4c4,	0x311a3e10,	0x3cb12406,	0x64820669,
-0xc6be20ab,	0x37cf99fd,	0xe97426a0,	0x79ac1365,
-0x522d9d9c,	0x4f3bfd0a,	0xdeb80b27,	0x66e2ebdb,
-0xcae86c80,	0x65986163,	0xc341461b,	0xe7da47eb,
-0x80882978,	0x4cf5eafc,	0x527d1664,	0x7225ff2d,
-0x4872fa8e,	0x099cc50f,	0x21ca02b4,	0x42212ea1,
-0xdacc30f1,	0x6c19271c,	0x7fa45b1e,	0xb9548b7c,
-/*  1639-m04f620f.inc  */
-0x00000001,	0x0000000f,	0x12152005,	0x00000f62,
-0x0976d137,	0x00000001,	0x00000004,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0x079c01a3,	0x0353307f,	0x9f2d61e9,	0xc9bc7bb6,
-0x4c3f5514,	0xddcdf1bf,	0x796bdaa9,	0x6885f272,
-0xcf82d5a6,	0xe6e11751,	0x2dcbd45c,	0x92d5b5cf,
-0x14c8eff0,	0x5a2ebb8e,	0x699b3315,	0x31cda045,
-0xaf39358e,	0xfb88852f,	0x84d9cbde,	0xd008420a,
-0x9e14933c,	0x5005b587,	0x265b560d,	0x88b45401,
-0x3db4376c,	0xf3f79b35,	0x2e880d76,	0xf60af783,
-0xc950aae0,	0xce74e979,	0xf88d288f,	0x334463f6,
-0xa391b222,	0xb3cfef4b,	0x4387ef52,	0xf1fd64f5,
-0x98f2e242,	0x6c195d07,	0xa103b386,	0xb21c18f8,
-0xed98390a,	0xd8719982,	0xe2800fb5,	0x17fc134e,
-0x14f46f1b,	0xe8f9eacc,	0x1cde3d76,	0x9100aa0d,
-0x257befff,	0x38217d57,	0xf31d4bd1,	0x49bcc233,
-0xe5393634,	0x8fc329bd,	0xb35ba88e,	0x99b8fd15,
-0x9a01df11,	0x2a76b86f,	0xa682cd02,	0x935ddfd4,
-0xfa72fb2d,	0x80db3c42,	0x36e47622,	0xb3a6f36a,
-0x4671849c,	0x91d16781,	0xbba06637,	0x7e37edfb,
-0x2ccd2524,	0xf4443b1c,	0x06830ded,	0x904b4e32,
-0x4ee11f48,	0x4daa5dfd,	0x11bc492a,	0x1922fd17,
-0xcc75e432,	0xed116cf0,	0xa0e0113e,	0xf8acf6d9,
-0x6ad73c09,	0x4af6e3c7,	0xbecbc42c,	0xfb0711e8,
-0x84a65d47,	0xcce2f84f,	0x0a5a4e42,	0xf476ba11,
-0x1ac1fbfa,	0xd1e94c4e,	0xdae73ff5,	0x1b7deaa9,
-0x96802f95,	0x8cf02beb,	0x06bc77a3,	0x83042fdb,
-0xd7ee25f2,	0x3f08a260,	0x349a0189,	0x5c24f6af,
-0x1b193357,	0xf019c6b8,	0xa17f893b,	0xa44689cf,
-0x34d24660,	0x01dacfe3,	0x3a5ac728,	0xdff3ab65,
-0x7fbc327d,	0xdc31170a,	0x8f15f039,	0x70295888,
-0xa07831f6,	0xae028e16,	0x4334d1d0,	0xab0d8997,
-0x13edff8f,	0x31670671,	0x4ac37665,	0x95470a96,
-0x84f9fa5c,	0xbe9b64e4,	0xdb5e8716,	0x459502a2,
-0x23e3d532,	0xfe3148e3,	0x1d926a12,	0xc95a0e79,
-0x4b15cd06,	0x632ccf12,	0x64fd574c,	0x8632ac6f,
-0xe868cfce,	0x978aa19f,	0xce09dce3,	0x0a1a6114,
-0x2edef69c,	0xc2546701,	0xc6c4b109,	0xf12cf971,
-0x46e87058,	0x743ee6c7,	0x7bf6da59,	0xb18caa8a,
-0xdc2197b9,	0xcc19f69c,	0xa951720a,	0xb32f3161,
-0x9b586bf4,	0x9ff5cf93,	0x04021381,	0x606dfe1d,
-0x8ebc4d43,	0xbd1cebaa,	0x72eedf93,	0xd03db0a9,
-0x59b4da5c,	0x59d43c83,	0xb4ac5556,	0x055dc173,
-0x838adbe0,	0xa12316e2,	0xbc60700c,	0xfded2a3d,
-0xd9df157d,	0x6fdbf9b9,	0xfbffc545,	0xf22dfcbd,
-0x3c77564a,	0xf1fb1b1e,	0x401ed79e,	0xa36609fd,
-0xf39d8dcb,	0xfa2cb380,	0x66811682,	0x3cdfc05b,
-0xafcccab5,	0xce2c98d0,	0xc8d0e851,	0xdb81968b,
-0x134685d6,	0x3c6c45e7,	0x5fcbd17b,	0x30d08f18,
-0xcb9e1446,	0xc7adb350,	0x65a79ad0,	0xcda41490,
-0xaee792fb,	0x5241f445,	0x71c48675,	0xa78cd129,
-0xe541ad27,	0xd6bc1ca1,	0x480fc0df,	0xcb9cf305,
-0x4996f7cc,	0xff9e3f01,	0x05ccac41,	0x161934a5,
-0xd0b03bd3,	0xd58a3a02,	0x126724ce,	0xadb20a85,
-0x02752804,	0x02712acb,	0x8434c339,	0x78844df7,
-0xb27f4ee4,	0xc5d58849,	0x184eb918,	0xb16a1dbf,
-0x684a4dd6,	0x03c5ac04,	0xc4180c07,	0xefbaf11f,
-0x04d3f7b3,	0xc5752583,	0xc590d505,	0x28eda7b3,
-0xc9aedc42,	0xfba64706,	0xef2fd235,	0xc6e4a9e5,
-0x2aa9d982,	0x3929d684,	0xedc5b51e,	0xd39a3265,
-0x5234f55b,	0xdbb0194e,	0x2e592cc1,	0x9796ac96,
-0x5c7b7f18,	0xe7220322,	0x5fec91c5,	0x7808be2e,
-0xcbf84e17,	0xcb206709,	0x0a33410e,	0x9154529b,
-0xc791cfad,	0x2bba4ba8,	0x047d3038,	0x669fe057,
-0xce47ceba,	0xae313cdc,	0xadcb0822,	0xc2f4cce3,
-0x64aad3cb,	0x23395f39,	0xc2d5855f,	0xc6abd99f,
-0x8bd7b406,	0xdf6fa78d,	0x7a68d1ad,	0xb9848827,
-0x98879f1e,	0xa2a228fb,	0x8864c4cc,	0x403f134e,
-0x6b2a3c2f,	0x8189b731,	0x4aa211b0,	0xd5ab46d2,
-0x016aaae5,	0x38412302,	0x21735864,	0x76990d2e,
-0x7ad5c38e,	0xf1de119f,	0x7fb97adb,	0xc03f14bf,
-0x1ec325ff,	0x5c6399b3,	0x1c34ff30,	0xdc9e1126,
-0x58f27c73,	0xa42a637a,	0xce737308,	0xa622084c,
-0xbdc9fd1f,	0xad338020,	0x7ac184b6,	0x26c25827,
-0xec60bc8b,	0x9c252076,	0xa551ab40,	0x9813c123,
-0xeeab98c3,	0x28ad53b6,	0x4eac1aa4,	0x220105b0,
-0xc2f74506,	0xb4f7f998,	0xba1358c3,	0xcf4c6634,
-0x5adff246,	0x50cf6389,	0x84ee828b,	0x95e0a1c7,
-0x5fd638d5,	0xbf6e3564,	0x5939772d,	0x9453c904,
-0xaf0b58e3,	0x8811c17c,	0x38aa6f27,	0x01aae9cd,
-0xa9764575,	0x93b305ee,	0xd1ac2711,	0xb61384b4,
-0xc3abcfee,	0x70e4968e,	0x8a3249e3,	0x00c1a972,
-0x35d4c7b4,	0x9f202a7e,	0xfe289f0b,	0xef2ae587,
-0x51c84c23,	0x060e0ab4,	0xb56a1f30,	0xcd529163,
-0x2806e4d0,	0x8f19ef5d,	0xa2dabe85,	0x8460d851,
-0x4f3dea07,	0x8988188c,	0x5dc55461,	0x135b4d98,
-0x84fad778,	0x8c8578cd,	0x16521e39,	0xa555d07f,
-0x2b19b4b2,	0x04591254,	0x9716390a,	0x1ab2775d,
-0x31feb476,	0xa37eaa9e,	0x0f0f895c,	0xc904bfca,
-0xb4443314,	0x620baec2,	0x8095cc33,	0x8359e18e,
-0xfeefedf3,	0xbedb5cda,	0xe48c8e42,	0xd801b5bb,
-0x6ae5652c,	0xada71e49,	0x1002ee61,	0x6837f4a7,
-0xaec9e878,	0xe0a113f1,	0x6eb50c7f,	0xc73298ad,
-0xdc65074a,	0x5324f157,	0xa3481903,	0x30b42b6e,
-0xc9dbbe10,	0xf57e0521,	0xba6979c0,	0xa7cb1280,
-0x0cb958f0,	0x54a1b9aa,	0xde550bdd,	0xaad13cbf,
-0xce8bb569,	0x96b320c7,	0x8bb06f0f,	0xabf15707,
-0xc6b5a4b7,	0xa6a757cc,	0xbfb15928,	0x21544a2b,
-0x652ab0a3,	0xd5f078a0,	0xb01ff0d9,	0xd65872a0,
-0xcf01c4c9,	0x114a21db,	0x650011bb,	0x2ad5c391,
-0x11f518cb,	0xf83502d8,	0x5a305fd7,	0xf0394012,
-0xf6f98bbc,	0x4edacf2f,	0xa9c64510,	0xaa227c7e,
-0xdb2f65ab,	0xfe26050b,	0x7b5c8fcb,	0xa29881f4,
-0xd6543f4b,	0xc0f698ac,	0x51c24c0d,	0x0b735fdb,
-0x8f2daaae,	0xc4052284,	0xba78f9cd,	0xa2865212,
-0xb71856c0,	0x2762980f,	0x97702bab,	0x3a688b17,
-0x927270bb,	0xe3d0f5b6,	0xc315ff30,	0xeeb7ef2b,
-0xd462d9d3,	0x385ebc07,	0xfcb62579,	0xf490bf8a,
-0x76c3283c,	0xbdb05430,	0x75e8213f,	0xc5e13e0c,
-0x96dc3a85,	0x880cb544,	0xf4a4f709,	0x39fd8052,
-0xa88a29dd,	0x8dc11af9,	0xbb7826f0,	0xaebaa4fb,
-0x5e6dafb9,	0x7a8b599c,	0xa01ba407,	0x1a56cfc0,
-0x02899491,	0xbb02370c,	0x99238411,	0x827db739,
-0x770c261b,	0x1bfc807c,	0x50e2ab68,	0xb6401646,
-0x1582959d,	0xc444763c,	0x3e04d247,	0xaf129243,
-0x82cdac0b,	0x808c980a,	0x5212d28d,	0x6da57e19,
-0xec269840,	0xdc305225,	0x9aa9d9e9,	0xf3697b4d,
-0xed3a5774,	0x5ae44236,	0x435def9f,	0x797b1306,
-0xc2b851c0,	0xf77be6ee,	0x481340ee,	0xde96a3ed,
-0x50e6007b,	0x120d6071,	0x023b8bba,	0xfa34be6e,
-0x3f7ba882,	0xd701296f,	0x5b13815d,	0xcfec237e,
-0xd5064859,	0xadf39484,	0x2a0d30ae,	0x5b288451,
-0xf8bddad1,	0xa9f56808,	0x194329e3,	0x8d530d3f,
-0x2a9d9ffd,	0x2b209802,	0xc174a89e,	0x1b5ecb66,
-0x0a6b4c4a,	0x87e205e5,	0x68e3a54f,	0xd8b48307,
-0x8b682b3d,	0x7319d4cc,	0x548583cd,	0xa6aa0f42,
-0x84ff4719,	0xf2e6a5fc,	0x579f5df8,	0x82d20e49,
-0x31949672,	0x8d4de34e,	0x03d66490,	0xf40da9f6,
-0x57af91d2,	0xa19f8331,	0xea3db1e9,	0x26db27ec,
-0xaebf9256,	0xef61a064,	0xdb729ae0,	0x79b351d8,
-0x2a513920,	0x2509a12e,	0x3ec0bbcc,	0x46907b1c,
-0x1b61d3e5,	0x6b5590f8,	0x005db70c,	0x7e9da806,
-0x8daaba05,	0x1502afa3,	0xf41b7a25,	0xc9d6e25e,
-0x2c5744b7,	0x5449e3a7,	0x57fd0466,	0xa67a8da3,
-0x77e1efcf,	0xcc98aa81,	0x574403a9,	0x63d08091,
-0xbe195afa,	0xb5be6b6b,	0x25a7caf7,	0x7343e73b,
-0x2e374ae0,	0x64d5991f,	0xedd0c342,	0x43c7aab7,
-0xb3212e30,	0x245ffde8,	0x3e5150b4,	0x534e55af,
-0xbd2e469e,	0x7544eb37,	0xcab94de1,	0xd7eb1fb0,
-0x697b1db8,	0x74038a9a,	0xdaeda845,	0xa38486b4,
-0x2acbbf12,	0xecf97abe,	0x627cdfd9,	0x59e00bf8,
-0xbfb5e5a9,	0x8a3a4430,	0xfc9b09ae,	0x30327c7c,
-0x076567dc,	0x270bb072,	0xba5c30f1,	0x36727013,
-0x8046b121,	0x67e490d6,	0xc4198ba7,	0x2e01a391,
-0x540d7742,	0x634a8354,	0x528fb00f,	0xaea64e1b,
-0xc093c800,	0x29380444,	0x5662143e,	0xaadf7595,
-0x6a91bf03,	0xa955d46e,	0x906efbe3,	0x22cf54b1,
-0x9e232d46,	0xb8986bac,	0xc778c74b,	0x3455d7df,
-0xbf7896cd,	0x299adc29,	0x2499f881,	0x1f1f5c71,
-0xcda05901,	0x6bd96c81,	0xa66c34af,	0x20562f55,
-0x518b08a2,	0x4675f3b6,	0xa09ab736,	0x99a60e21,
-0x081af44c,	0x10b6ac26,	0xf1c5bde1,	0xc0557aef,
-0x40474b3f,	0x9a6d6a41,	0x1cb43960,	0x25c8ad47,
-0x5ec31be3,	0xa8d333f8,	0x7dd97516,	0xfde24ca8,
-0xb05f764a,	0x21fe8a04,	0x68e327fb,	0xa1340a6d,
-0x5279353d,	0xd915cabc,	0xcc1caa72,	0x38ab6a0a,
-0x514323f8,	0xa6c488ec,	0xdb9b34e5,	0xaa657176,
-0xb8c021db,	0x7f320113,	0x1b17e33b,	0xc816156b,
-0x390de864,	0x94a84ac4,	0xa2707d4e,	0x4a78abea,
-0xfca81af4,	0x869dc73f,	0xfc63ffb7,	0xd3857b8b,
-0x0010604b,	0x0d0effdc,	0xd582767f,	0xb3bf6ead,
-0xa34cb0c7,	0xbbab800d,	0xf840adf5,	0x5cf3c030,
-0x53025198,	0xfbfaa341,	0xe974fb1d,	0x243c33a0,
-0xe510c751,	0x3236022c,	0xd82b92e5,	0x6285176c,
-0x037eb1b3,	0x20802435,	0xc250407e,	0x324410de,
-0x722fb8f7,	0x4543923c,	0xe968953b,	0xbcdd7e38,
-0x9b627167,	0x0910ccb2,	0xf4c4af8d,	0xa31a2eb4,
-0x3f4d441b,	0xee2e9aff,	0xf312c850,	0x61fdc34e,
-0xc52406e7,	0xd5351cd8,	0x92596e87,	0xcb933833,
-0x321e5e2a,	0x4840b034,	0x22aecfb5,	0xab5a1ea0,
-0x6923b7c6,	0xcd242b95,	0x12e95d8c,	0x2892a638,
-0x8d8ae7b8,	0xe73c2e44,	0x4bf4561a,	0x251ef7d0,
-0xbd3bb469,	0x2e930b87,	0xfeb4148b,	0x7bd702ff,
-0xbc4ca00b,	0x2cc32008,	0xa3e89154,	0x5a5d94df,
-0x44ed5070,	0x3044b36f,	0x6304c927,	0x1f434e68,
-0x9a23729a,	0x1f986343,	0x7f0e81d6,	0xc5f2e305,
-0x12a3eff1,	0xcc07bbb6,	0xa88d5da6,	0x744859b0,
-0xb288563f,	0x4182b155,	0x91bef572,	0xacd49e0a,
-0x48707490,	0x9630395e,	0xb09bfb7e,	0x7c113da7,
-0x11e5d433,	0x113c6ab6,	0x9fdb7464,	0xc074a781,
-0x39db10e7,	0xac094b44,	0x6935b70f,	0x047e142c,
-0xe934cc8b,	0xd9786ef8,	0xde746266,	0xa8a5143e,
-0xa560e079,	0x059d6083,	0x876cf517,	0x565bc532,
-0x652a6519,	0x8ecd2aa0,	0x9ba76f50,	0x20a3ece8,
-0xaa485db8,	0xe52b31b4,	0x7ba94c54,	0xb4ea4e85,
-0xf01eb4c4,	0xed092e23,	0x78839d0b,	0xf82161b6,
-0x8bcbdcb1,	0xc2c4ddd5,	0x35bc5c1a,	0x42b763d8,
-0x9ae64844,	0xc2059773,	0xffdfd33a,	0x1093cdcc,
-0xe17166cd,	0x74742ff0,	0xf901bd03,	0xe7dffad2,
-0x90597170,	0x69beff0b,	0x084027a4,	0x67497019,
-0x7009b4ef,	0x75fd24f4,	0x914f8430,	0x58770935,
-0x11409cba,	0x3bd2f3a6,	0x563ed273,	0x88569092,
-/*  2376-m46f6cd.inc  */
-0x00000001,	0x000000cd,	0x09162007,	0x000006f6,
-0xa77fc94b,	0x00000001,	0x00000004,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x069de10f,	0x231acfec,	0xb14d18de,	0xfff6e27c,
-0x47f9f050,	0x93e4ab75,	0xc5b027f8,	0x5d0af696,
-0xae8c0180,	0xd2bd00de,	0x54589c4c,	0x8a304494,
-0xf62f1f4c,	0x54951068,	0xae698c80,	0xd0495a6f,
-0x41252806,	0x8a3929ce,	0xf5da0a40,	0x7b37235a,
-0xd3e66940,	0xee4bd80e,	0x2c8c9cef,	0xdbbc8c44,
-0xd93c981c,	0x3653aa83,	0xf38ac2b8,	0xeb772793,
-0xb02e5b5b,	0xca076ad4,	0x2f72e48c,	0xa8598c92,
-0x86235029,	0x06136faa,	0x847ba9e0,	0xa12b22bd,
-0x8675ac47,	0x9c88b30e,	0x5f6bf4bc,	0xb4490e67,
-0xe14615a3,	0x47914f9a,	0xa906d616,	0xd926d1c3,
-0xe3c475ec,	0x805ece3b,	0x03e32c4c,	0xd0d49809,
-0xf80587bc,	0x0d147769,	0xf754e7af,	0xd8f9e4e3,
-0x0652985b,	0xc47d60fa,	0xf7ee4161,	0x208f5cce,
-0xc0207b34,	0xcfc0b155,	0x131344a3,	0xc8151215,
-0xfd64a827,	0x0b46e3a9,	0xf13b69d6,	0xe3f034f3,
-0x214a31ca,	0xd6ddb66c,	0xdc325966,	0x3cb35d51,
-0xef9c208b,	0xc74e3d36,	0x2cf09e5d,	0xdb2a20dd,
-0xe75f3cbf,	0x094301ea,	0xd215ea97,	0xeb9907d8,
-0x3d69506e,	0xe6ea09ed,	0xfb868e50,	0x33d62866,
-0xef755902,	0xee6079a1,	0x193e9133,	0xf849f9dd,
-0xec089a93,	0x3919d90d,	0xcdcb2ca9,	0xdc6d5ad9,
-0x0eb6f22a,	0xdb9e6033,	0xc91db934,	0x39eeb1b1,
-0x7ff82cb6,	0xf23be65f,	0xbedbbf55,	0x7cf22a24,
-0xf7bb7f92,	0x93b08ce3,	0x4aadb8fc,	0xd7e8fb49,
-0x52b41550,	0x6a6deddc,	0x1cf9fcae,	0x50e7dd5f,
-0x40a3c0e3,	0x1e990ebb,	0x67789222,	0x660180f9,
-0x6d283a27,	0x6b59f4fd,	0x2681057c,	0x7fd28ba6,
-0x7b29c3f8,	0x06f3cabf,	0x753070b1,	0x6f35b09a,
-0xcd1bcf2b,	0x5558faa9,	0xde88dc0f,	0xd5a96254,
-0x2a437c53,	0xed8e7708,	0xc671efc3,	0x23634321,
-0xade99512,	0xd6c582f0,	0x63f9e461,	0xa076a3f7,
-0xc7bd36d2,	0x4b4d9413,	0x9304492f,	0xf13d3b94,
-0x9412f88b,	0xa2fe563a,	0x58d4f309,	0x8bb4ff69,
-0xf1b8f459,	0x5c1bc95e,	0x94923096,	0xc42f1043,
-0x4e558014,	0x927525c7,	0xb1b01a10,	0x6b6e236c,
-0xcbfae624,	0x90165fc5,	0x4ab743df,	0xf01aa3d5,
-0x8407f56b,	0x5a6f41ea,	0x8db4e144,	0x938fd696,
-0x1b05c5ac,	0x891c3318,	0x883d70e0,	0x034ef879,
-0x9f364d96,	0x9ac1d849,	0x52935d76,	0x92b1d7f7,
-0xb241d6c6,	0x7a466608,	0xf5971834,	0xa5b88250,
-0x475d7738,	0xdc4285cc,	0x953d3f20,	0x73dd0ab7,
-0xd7c07f38,	0xba153744,	0x5662025d,	0xffcac9ab,
-0xb5f14ff8,	0x788ae76c,	0xa3add19c,	0xb9f4e614,
-0x2684d144,	0x9954d047,	0xa5fa8658,	0x2e98742f,
-0xbd93d843,	0x9004abe1,	0x5dce2625,	0xb07ce2cd,
-0xe45a23de,	0x5fc7d4f1,	0x9f6cd823,	0xca45faac,
-0x77ed9a41,	0x863eb485,	0xbe5ee6d9,	0x7163f443,
-0xf0f13fd0,	0x803146bc,	0x5a8a5234,	0xc6f23b27,
-0xa4be8f1a,	0x7f543252,	0xf48c1088,	0x88f0f42c,
-0x508dcc60,	0xdce3dd19,	0x9621736d,	0x61e9f832,
-0xe49ad73e,	0x839ddc15,	0x0320088d,	0xe4e07850,
-0xe6081f95,	0x212f40ee,	0xe5ec02fc,	0xeb3ec560,
-0x21c799fd,	0xf616092e,	0x8c246959,	0x369e4e78,
-0x95b8b0d7,	0xb2ac56e4,	0x11533370,	0xaa6d732f,
-0x96da9f5d,	0x2c15d26c,	0xefc38a7d,	0xb411422b,
-0x5ed512a2,	0xd0f6bdc7,	0x848402f5,	0x557a9d6b,
-0xf6d6bfb4,	0xbae8326c,	0x44d2711e,	0xca0b1c1e,
-0x818d6489,	0x674fdf62,	0xeba712c9,	0x8600fc72,
-0x46c4091e,	0xc0dd6afa,	0x86d0ce6d,	0x73db482a,
-0xf422ed0e,	0x814f50d3,	0x6a8f5f4b,	0xf8839c31,
-0xb2f9ba8f,	0x63f77f84,	0xf2feb43c,	0x8267b66a,
-0x4c1e25a6,	0xf5d369e0,	0xbfffcfbb,	0x72a2342f,
-0xd2138eb0,	0x94f439ed,	0x75cf2660,	0xf4e13865,
-0x99cc2799,	0x601f4b94,	0xef7da960,	0x9cbd1464,
-0xbb1eecaf,	0xd505e594,	0x634b8c91,	0xbf437ddc,
-0xe84a6b03,	0x647c259b,	0xaeef8ebc,	0xc2f8231b,
-0x1ec35135,	0x82a90e21,	0x92abcc48,	0x11339939,
-0xb38a8e03,	0xb3173d16,	0x1d456a2f,	0x884647c1,
-0xa0796e8e,	0x2dbe5e87,	0xd724eb78,	0x850f2323,
-0x67d0dabf,	0xffbefce9,	0x94ba824e,	0x4dad31d7,
-0x41866002,	0xbc02ef63,	0xc714a08a,	0x4cbbf0a0,
-0xb0711591,	0xd356135f,	0x66c868a7,	0xef093288,
-0xc0f20e6d,	0x08d1e5b6,	0xf57c95b6,	0xda4abe4e,
-0x53e01eb9,	0xdb1fc9a1,	0x914a0d4d,	0x72835fd2,
-0xc48c91da,	0x90179816,	0x58e935cb,	0xc9ffcc97,
-0x81a20a84,	0x4873eaa5,	0xeb2e34df,	0x9eaee870,
-0x473a53b0,	0xe896b132,	0xa1da6125,	0x53907d39,
-0xf2c0101a,	0xb400f023,	0x5c8405fc,	0xe56b9ff9,
-0xafe70304,	0x61efed87,	0xfe2c1d6f,	0xa137799b,
-0x6099842e,	0xc535ce7c,	0x813b7a56,	0x4fbfa56e,
-0xd00b6167,	0x94047c4a,	0x7f2d2caf,	0xe779ed1e,
-0x91f8ad3d,	0x4819be3c,	0xeb7c3f7f,	0xafde58c8,
-0x416ba349,	0xe54b1a61,	0x84bf1cee,	0x6a49a45a,
-0xcb279f1e,	0x94a64ea8,	0x50c52323,	0xf2bb1e1d,
-0xb3369a76,	0x6b7bd4ba,	0xa5a883c5,	0x9920d82b,
-0x1ad509e3,	0xb6603840,	0x9cf6fa7b,	0x37f38611,
-0x8ac50d7c,	0xa00722bb,	0x1c530a5c,	0xaaaf42ea,
-0xab934993,	0x3a763beb,	0x85920bf8,	0xba2f9222,
-0x0803ab8f,	0xb65644be,	0xc1468e02,	0x0fcc5ad3,
-0xca511fb9,	0xdecc45dc,	0x164ebc01,	0xda810b73,
-0xe514c39a,	0x2d65d0c4,	0x92620d3a,	0xe52f6c2d,
-0x6660cd07,	0x9e3f024b,	0xe75f21f2,	0x4b369f5f,
-0x552e761f,	0xe3245f99,	0xc4a8d36d,	0x79150e9e,
-0xafd6be8b,	0xd3079f1c,	0x741da83e,	0xbeb8bade,
-0xef56cdec,	0x797d768d,	0xb812e70e,	0xda2b8b18,
-0x60b40484,	0xb86adad7,	0xeec53ea7,	0x57d642cc,
-0x917691fc,	0xe1d2bc90,	0x4f47b3a2,	0x98510bfa,
-0xc38f58f3,	0x749b0440,	0xb5399e12,	0xfa8f3814,
-0x45577b99,	0x8911964b,	0xce5b480e,	0x7bb71f83,
-0xbaf64cd2,	0xd708ad19,	0x6ab5affa,	0x9958f2bb,
-0xd0ca7465,	0x78bef153,	0x9aa7e50d,	0xd59589f5,
-0x27a84f81,	0xb4e5ca62,	0xb11e75fb,	0x2f959347,
-0xb6908b81,	0xa0dc5495,	0x15d063b8,	0xbac68fb2,
-0xa842417d,	0x0e679113,	0x858d3a24,	0xb28c6d81,
-0xa63ff7c4,	0xb6162705,	0x3d418eed,	0xb35998f0,
-0x982bd927,	0x18e15412,	0xa6191a2b,	0x88059de0,
-0x37b687e0,	0x99a0d2e3,	0xc2270bb3,	0x1c2efde7,
-0xef4e85dc,	0xdd5cdd23,	0x2b93f297,	0xe69f6615,
-0xdc707a03,	0x0b424b20,	0xd24bada3,	0xec108aca,
-0x1eee4859,	0xfc337cb4,	0xf677d3be,	0x3bc9fcf3,
-0xf0bf3560,	0xd76e5902,	0x07249f10,	0xcd0c1aed,
-0xe68d1f68,	0x3bf09532,	0xc7dff675,	0xf627f8b2,
-0x27925559,	0xf735c609,	0xf0bf366c,	0x340b0650,
-0xfdddfeea,	0xfed89dc1,	0x0704611b,	0xd4a4353b,
-0xf81a7fa3,	0x04f46a9d,	0xc8b9ebe2,	0xfc13091a,
-0x071d6bf6,	0xd07f4f4c,	0xd4620b62,	0x0b0ae427,
-0xae03a28c,	0xd7dc1e3a,	0x22c2eaad,	0xa5c8e3f1,
-0xa2834902,	0x19faf326,	0x8ae4ddda,	0x8a732cb9,
-0x240bc2f2,	0xbaea93a2,	0xd8049b07,	0x3f38948e,
-0xc0e9c772,	0xc8b6c1b2,	0x082490d3,	0xfce9f20c,
-0x10722c35,	0x28b52bc3,	0x272477f7,	0x31dbb406,
-0x220e8872,	0x099fbaf0,	0x39a10e00,	0x1960c5d9,
-0x3f5bfba6,	0x0123b1ff,	0x3a7b0cdc,	0x3f29d8f4,
-0x021e948e,	0x15367a71,	0x1d660894,	0x01060e64,
-0x0a47a953,	0x3d7f7646,	0x5c2e3326,	0x2f0b52c7,
-0x5c4ce5a0,	0x6b4d4526,	0x24cdcc9e,	0x4b9b5edf,
-0x6a80a105,	0x013180e9,	0x4269c090,	0x4b9eda81,
-0x1f586fd8,	0x5329bfcc,	0x6cef8d7b,	0x3450dab5,
-0x7e54bdb0,	0x342ae8b2,	0x77459bb2,	0x1bbbed96,
-0x1d31aaea,	0x57be8663,	0x7fcb476d,	0x2af95451,
-0x10b5fe50,	0x723b1d0b,	0x68e8fdb6,	0x1ba86347,
-0x28197557,	0xfe83bafd,	0x71da9ee4,	0xb290db8e,
-0xc3e3329e,	0x2d7999c1,	0x9e5078ab,	0xb03ce933,
-0x44964e69,	0x85c9a1e3,	0xdb0b04de,	0x7705bff8,
-0xcc509f50,	0xe1baa519,	0x33a76486,	0xd20807da,
-0xff31a538,	0x2824987a,	0xfd55dca9,	0xc6c75eed,
-0x6e09a934,	0xc28e5766,	0xa51425cf,	0x44ed113d,
-0xd8a7e6d2,	0x1a93ea5c,	0x5d13c219,	0x420713e1,
-0x08dd1ad5,	0x5f4a4e98,	0x4854b87f,	0x3d8ffc1d,
-0x780ec676,	0xe5f156e4,	0x11b5a68b,	0xec86f0d9,
-0xd08d6490,	0xc73546d5,	0xc9cc9af4,	0x2a179fdd,
-0xc9fa7139,	0xed1e1f85,	0x358bedf7,	0xf85d053d,
-0xc40d6cab,	0x1be9e76a,	0xf65d3c04,	0xf8e2cf43,
-0x7e7d8de2,	0x8ce53551,	0xb9c28202,	0x1e3dd0a2,
-0xeb7e16c3,	0x7d2332aa,	0x7c310b4e,	0x06cf6714,
-0x736cd20f,	0x87197a64,	0x30fecd51,	0xa2171877,
-0xffbd4e01,	0xe7bdcfe3,	0xfaf63afb,	0x103dc98c,
-0x8df92486,	0x9f18a46b,	0x62e21409,	0xff9bd459,
-0xea06dbb2,	0xa4aed423,	0xbb907994,	0x015b7beb,
-0xe7b5d965,	0x3c7baa4d,	0x6e639c70,	0x6a63e04c,
-0x4737f3f7,	0xb3b30f63,	0x2bea37d8,	0x84a8b29b,
-0xfef6dfd7,	0x1cd52427,	0xcb3b7267,	0xe40c2eb0,
-0x68b8b070,	0xc123305d,	0x89843b7b,	0x470534d6,
-0xf81d8b07,	0x26d4b20d,	0x5a234265,	0x6ad94a6e,
-0x11c357f9,	0x854a4eea,	0x7d2a7644,	0x05d3f0ee,
-0xb074a203,	0x8b9e2e78,	0x181f15f5,	0x68d76981,
-0xa7496454,	0xd6b494c3,	0x4b9586d3,	0x7cf5f67d,
-0xfdd40e83,	0x203ed59f,	0x4f79e5d2,	0xbe585702,
-0x27c5a87e,	0x7c8904cb,	0xad3bd485,	0x03c2c4d5,
-0x5fc5ca27,	0x3d9bc4ff,	0x2ab90d3e,	0xfeae7801,
-0x30f86b75,	0xe16eff78,	0xe2a35865,	0xe4f1632b,
-0xfa4c9f3e,	0x39995cc5,	0xd413439c,	0x26409cb0,
-0x2c0a191e,	0x3ddb38f1,	0x13844831,	0xe491b98e,
-0x3502853b,	0x7ce54372,	0xeb146bc9,	0x0528ced7,
-0x3706e43f,	0x6407efbd,	0x6d0fdd4b,	0xc5ad8378,
-0x7f68d6c2,	0x2c776f23,	0xd84159e4,	0x1136149d,
-0x1850c335,	0xed7200c8,	0x38862fc1,	0x31144436,
-0xd55f3539,	0x7095ced0,	0x28d6c71e,	0x9a7e1c59,
-0x738f287b,	0xcfc36dbc,	0xa352b20a,	0x94b46685,
-0xff21c397,	0x45a639e7,	0x97dce079,	0x0339e07d,
-0x6c63181e,	0xd1695983,	0x0f3f9949,	0xe79cbc93,
-0x2ba92b63,	0x07aec366,	0x069d04f2,	0x1cd9921d,
-0xe1552bb3,	0x274ff779,	0xf129e10f,	0xc676d005,
-0xd94949c2,	0x4b05e853,	0x16a2b4f8,	0x7c8607d4,
-0xc0c7225b,	0x8bb48a31,	0xffe935aa,	0x4e4d2f9c,
-0x74472edf,	0x27fd27d3,	0xb0edb970,	0xae7aad7d,
-0x7ed3c3e5,	0x51544c0b,	0xe1160c3c,	0x8898d872,
-0xa49ec27b,	0x4b8b71ad,	0x7c011baf,	0x0136cb03,
-0x89f0c23e,	0xb09b12aa,	0xf54e7879,	0x7b159d26,
-0xd0274c76,	0x06a11c54,	0x32417ff5,	0x22f9ac87,
-0xd04c7f93,	0xb4d64581,	0xda8e836b,	0x727833ae,
-0xe10f52ad,	0xd5d9b8ca,	0x137439d1,	0xe6480fd4,
-0x5920d3a3,	0x224e70cd,	0x6a9f8b40,	0x523313cb,
-0xd933079c,	0xeb1ce420,	0x932c88d8,	0x621ba7c4,
-0x398699e1,	0x91790ab0,	0xb72e91fd,	0x0c717172,
-0xfd51b6b1,	0x103361c5,	0x6b81ca06,	0x54ab7ce7,
-0x1a676e96,	0x7b064711,	0x40fbe8a1,	0x13b58a47,
-0x654dada0,	0x1497f23f,	0x17853e67,	0x34793aad,
-0x9a35153d,	0x2757793b,	0x86dd1d1f,	0xb5830eb5,
-0x8624a4e4,	0xf8827b80,	0x1bbe08b1,	0xfa388a75,
-0xa12f653b,	0x0cc7d6e2,	0x8e34dadc,	0xaf97070e,
-0x027ee8d8,	0x94b956a5,	0xbb256a5a,	0x3bef3e55,
-0xa2ba9e38,	0x4b1d8640,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2965-M08106C2219.inc  */
-0x00000001,	0x00000219,	0x04102009,	0x000106c2,
-0x556338c1,	0x00000001,	0x00000008,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000219,
-0x00000040,	0x000e0190,	0x20090410,	0x00000401,
-0x00000001,	0x000106c2,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc90b16b3,	0x43609e61,	0xa4e6bb06,	0x8d22d7db,
-0x375d7808,	0x02531ddb,	0x5f66ebad,	0x3f73276c,
-0x0882023d,	0x953684cb,	0x0abe06ee,	0xa7ef1798,
-0x160d6cb8,	0x930cf745,	0xafc3fd79,	0xa70df3d5,
-0xb0620f46,	0x70048a23,	0xbf95ecf0,	0x76c1b997,
-0x5128616d,	0xb6b4b969,	0xcc69f71d,	0xdf7416e1,
-0xdf9a571b,	0x50c0bcc8,	0x85e2b3cd,	0xc1927532,
-0x7a04b6be,	0xe56b7f97,	0x524085c4,	0x668bf327,
-0xb3eaa54c,	0xccde06f8,	0x09b4e42b,	0x033b0a46,
-0x0f6e2fde,	0xb308ce53,	0x93eff03e,	0x8830014e,
-0x5c8a6f22,	0x91d2f757,	0xf70b648d,	0x0789998a,
-0xd84d4640,	0xe5f34e80,	0xf3357e64,	0xd1e2beea,
-0xc7e95c3a,	0x30e57e4d,	0xec214356,	0x7e10859e,
-0x1d5895d5,	0xdeeff6cb,	0xed1030ed,	0x827e603d,
-0x6b4b2de3,	0x83ec6fd0,	0xa64092f3,	0x8d9887e4,
-0xbefcbedd,	0x2111afef,	0xcb9abf96,	0x5c79ceac,
-0x9bf8a57f,	0x5d0e44be,	0xdca3d3b6,	0x9072d1ca,
-0x48e73a50,	0x8d0bc804,	0x6aea94d3,	0xc372403e,
-0x00000011,	0xfc992688,	0x23e600a8,	0x14f6cd28,
-0x93bc5dc5,	0xa5495696,	0x6c07abae,	0x67d10a74,
-0x945ac057,	0xb8473344,	0x472f30fb,	0x5b9c2ee7,
-0x221b770d,	0x112eb268,	0x3724b0bd,	0x58ba84c3,
-0x00e42136,	0x81477cb7,	0x85f5e1ee,	0x84d4a044,
-0x79c3d88b,	0xfd5e4dbb,	0xffb5ec86,	0x622f59f0,
-0x7bfe0e7f,	0xc355acac,	0xa4fb3619,	0x7339556b,
-0xeabc4d3d,	0x6ab08a75,	0x7b59ae8b,	0x8aec0425,
-0xd939122e,	0x8c0de100,	0xb6a824b8,	0x4fe6b900,
-0xc4c994be,	0x8efffe65,	0x59c6b401,	0x7cd816b6,
-0x7731727b,	0xc8612d27,	0xe889c3d7,	0x37bb7222,
-0x184d0b87,	0x5228bc87,	0x222623d4,	0x6b7c86ff,
-0x2ef75b0a,	0x0c2a56a3,	0x343d7ca0,	0xb4a609bc,
-0xad047dc1,	0x402baa40,	0xeb1ddca1,	0x54466185,
-0x40de7012,	0x33382ce6,	0x1c410b88,	0x77a4b6b6,
-0x24dca2fa,	0x6553c356,	0x387d1121,	0x342ef68d,
-0xbe569906,	0xb2ac2d4d,	0x781e3db3,	0xf1e39ef2,
-0xcfe8ce3e,	0x3007b67b,	0x66f1673b,	0x1cad08f6,
-0x3a455aac,	0x83a00fb2,	0xb3b6cc3e,	0x38172e9a,
-0x99bf9d0e,	0x65be725d,	0x51f39d60,	0x29e48dc7,
-0x68e1ea47,	0x05002e5c,	0xe2d9338f,	0x209f4e82,
-0xa77b3188,	0x78c30d8a,	0xf5ca40c0,	0x5c3ea07d,
-0xd4141b88,	0x05e2522e,	0x31c4d8d8,	0xcfd4b204,
-0xa449934f,	0x4a88b5c0,	0xb474e3ee,	0x8e5b7950,
-0xf7db2f3d,	0x1f0a8f3a,	0x0ba8557d,	0x7d47154e,
-0xbc3c9775,	0xb52a9e82,	0x7c4f2d6f,	0xfeca6bcc,
-0x16ef5c58,	0xedd2d873,	0xf9197095,	0x72bed70d,
-0x0548445b,	0x12f3f734,	0x88d07e72,	0x0febabce,
-0x2572952b,	0x3cdf2a42,	0x4193b60e,	0x4d812f9e,
-0xffe96805,	0x978273e5,	0x6da0ec06,	0xe15d94d9,
-0xb2b1c0d0,	0x940b6110,	0x89c7df3d,	0x70114c8f,
-0x4bf8f46a,	0xd5f7bb83,	0xab457d17,	0x1e06b3b7,
-0x36e7913c,	0x7fb0fa65,	0xa674d689,	0x1869ef0a,
-0x5dc7b15a,	0x5da35a26,	0xe920832e,	0xc4de494a,
-0x5e5d2ed5,	0x6c4737e0,	0xdf5ec30c,	0x8091f7a3,
-0xb8c97091,	0x2b3aeab2,	0x7423a605,	0xa2ba859c,
-0x485b398e,	0x9ab35881,	0x523441eb,	0x0385484d,
-0x2a044c2a,	0xe306184e,	0xd1b28d17,	0xb8170bc8,
-0x94aac536,	0xb5394448,	0x07262f8c,	0x637568b8,
-0x494294a6,	0xfb1db2a0,	0x443f53fe,	0xd92d404a,
-0xb5297cac,	0x5dedc37a,	0x0daac347,	0x7ac1ae2d,
-0xea83ec15,	0xd322d35f,	0xc73d2bff,	0x0d431332,
-0x07c14d37,	0x1ad1aa51,	0x9929b721,	0x97482314,
-0x83340e21,	0xed080218,	0x4258da61,	0x439ea85f,
-0xc71172a1,	0x0d22feba,	0x3a6de23a,	0x83b8fe9f,
-0x876eeabc,	0xf775ba44,	0xa80def3a,	0x3fdc0d52,
-0x2614ec7d,	0x6b4cf2a8,	0x9fb7a74e,	0x1757d1a9,
-0x20d4010b,	0x151de99d,	0x4bd6bdaa,	0x0f7547df,
-0xacc9570e,	0x8416d2ea,	0x988f578e,	0xa287907c,
-0x863378bd,	0x78396f5a,	0xed570e5f,	0xa6845d46,
-0xa513f5a6,	0x8283abf1,	0x25396b2c,	0x6347886a,
-0x17fead7f,	0xdb650cfe,	0xcb24f93f,	0x368cac11,
-0xfce10cc6,	0xf285252c,	0x981a327f,	0x3d4019ef,
-0x99ceb802,	0x570a0285,	0x5f2a4ed3,	0x5f9b1600,
-0x001841f8,	0x959b0805,	0xb3bbc0ab,	0x7101f85e,
-0x0db99182,	0xf96d3262,	0xbf8b4f1e,	0xe2ec5696,
-0xe80c0fe5,	0x98eda3c8,	0xbc4e96f1,	0xb011a977,
-0x069f4fde,	0x79837aa8,	0x03543201,	0x77041b22,
-0xcd556d8d,	0x001955be,	0xc9f1aeab,	0x73dacc9b,
-0x2a0d9a46,	0xc9f740b3,	0x12c74546,	0x7a77b5cb,
-0x46cd0c07,	0x33c49919,	0xb720c3f0,	0x1cf9f386,
-0xa333685a,	0xd57eba74,	0x9a739818,	0x5349c0a8,
-0x9f03edb5,	0x3ec21311,	0x49afc855,	0x70da0455,
-0xa5298dad,	0xc2c3ed06,	0x83b2f5b7,	0xa9c3a934,
-0xd9bad4fe,	0xb3529d95,	0xf7935ce1,	0xac181422,
-0x6e67b6ca,	0xb053f52c,	0xc835c485,	0x1e4f3f3a,
-0xd922de6c,	0xcca7947a,	0x7a689229,	0xe647fe13,
-0x3aca8264,	0xf866ff46,	0xf999c6cf,	0xed01e84e,
-0xf7b0199e,	0xec3e3356,	0x0f420d30,	0xc327971b,
-0x4d7aed1d,	0x4baba227,	0x752a3764,	0x75d94365,
-0x52416050,	0xbe1050db,	0x9ec1196d,	0x4b5e25e6,
-0x34dc29b2,	0xaac206da,	0x2c87595f,	0x02e7e586,
-0xf87e1f28,	0x90264c1d,	0xb86c314d,	0xb69cfaba,
-0x19c4f9b3,	0xbb0caa02,	0xaa1e2461,	0x19ddc16f,
-0x6df5f184,	0xf8bb463f,	0x5fd25e64,	0x86d7c76b,
-0x5f6914b0,	0x57e88828,	0xc98df09b,	0x37138009,
-0xb369b31f,	0xe7045bee,	0x29a8f874,	0x4b650bbf,
-0x2f6287b4,	0xa549a544,	0x9265e74b,	0x8b37f6bf,
-0xcd56bfa9,	0xfa258838,	0xd610488c,	0xa5cdc5dd,
-0x9d845e17,	0x3aa87384,	0x24560eb4,	0x3544672d,
-0xaa83f643,	0x4e689a3f,	0x72b5d70c,	0x86d3fd5d,
-0xe67bf049,	0xaceadfac,	0x04ee56b4,	0x194a0835,
-0x6dbf07fa,	0xdb51992f,	0xa2956de0,	0x331cf4c9,
-0xc3d8c10f,	0x5ef580dc,	0x0fcf0f7f,	0x83702f3d,
-0xcdcfcb70,	0x2475e23b,	0x95701afb,	0x725bfd6b,
-0x4d47f669,	0xf3596431,	0xaee46e06,	0x5a4ab3b0,
-0xb3c7c69b,	0x2f0a1bf2,	0xdc6de955,	0x254d56ad,
-0xc0683c95,	0x7c3d0e31,	0x2bc97c44,	0xe3e6db29,
-0xc2a8d98c,	0x357c97ce,	0x397db584,	0x2bd797c8,
-0x8825efb6,	0x5d35cf51,	0xe80b2df6,	0xe67f6e97,
-0x1c3401d3,	0xdab40712,	0xdd6d0cfd,	0xd8790e1b,
-0xb0cf68d9,	0x986671f6,	0xf3cb7b14,	0x407e81e4,
-0xeba6f4cc,	0x3774a142,	0x54e698a5,	0xb0203303,
-0xd51b3f85,	0x697020d3,	0x3810c326,	0xe85cb4ec,
-0xc472098c,	0x7368a46f,	0xabc51178,	0xce0ccf5e,
-0xc8fac25b,	0x2a4be3aa,	0x0de1fd65,	0x795c2e54,
-0x882244b7,	0x9576e013,	0x6e670e35,	0x58e4f198,
-0x39b34336,	0x7646f12b,	0xb5c5bf0a,	0x16b37b1a,
-0x21270db0,	0xb8214968,	0x29e314c8,	0xbcfb2f86,
-0x1605b1b0,	0x4476decf,	0x827449f0,	0x77520628,
-0x69b16de7,	0xcf8c24b8,	0x4f8ac7c4,	0x5906e5f3,
-0x18fbe3da,	0x1efa44fc,	0x27cd16b6,	0x2e5b9451,
-0xb8b47a15,	0x5e0275d9,	0x98ba61bf,	0x276fcd7e,
-0xc45d474c,	0x3a6ec43d,	0x247b0578,	0x39023efd,
-0xf4c1b8b0,	0x93118f01,	0x7d0bd14d,	0x5b2ccf75,
-0xcc9caf6f,	0x8fcc1dbc,	0xc2a182ea,	0xa9d5ea77,
-0xb67fb193,	0xc8afeb62,	0x979f4e4e,	0x23ddc2c0,
-0x229b8670,	0xc2e45d21,	0x2f402e32,	0x44e37134,
-0x0d97b5f4,	0xb451fbe9,	0xa6f8b847,	0x1242f580,
-0x4ab7acc6,	0x46d21bb2,	0x73834518,	0x834624d5,
-0xd16b2272,	0xc706f4b5,	0x499e3397,	0x2b8f3113,
-0x2973cccb,	0x67c79188,	0x7603acfb,	0x492b6c55,
-0xfb00c5e7,	0x53cfe2f7,	0x5b8c503b,	0x2a8551bd,
-0x5933fa39,	0xd007c1cc,	0x134460bd,	0x4ebb4795,
-0x4e6e56c7,	0x1249ec55,	0xf9d8474b,	0x03d33b72,
-0x67370679,	0xc5816cbf,	0xb7e40ace,	0x2f3fd6cd,
-0xafa9ff3d,	0x783c3ce8,	0x918f2c76,	0x95356478,
-0x0fe91058,	0xab48087f,	0x59ece9da,	0x7db981fc,
-0xe70556e7,	0x58ed65f6,	0x97e45645,	0xc6857a6d,
-0xaec1bf29,	0x7bf82ad1,	0xee35e6fb,	0xd534ad65,
-0x932dd280,	0xe0c2af09,	0x2338de06,	0x5e5b88c8,
-0x46f4ea36,	0x58fbd024,	0xfdd2c4d1,	0xb61624ce,
-0x772d74b1,	0x4f10fd11,	0x6b803a7d,	0xd2866afe,
-0xcc943b2e,	0x35a9d42a,	0x483ef574,	0x04ed18ca,
-0xc543ead9,	0xdb2ad8cb,	0xef6830d4,	0x60d7b29a,
-0xb47c1e1e,	0x31ca0a9a,	0x1688576c,	0x5a282e51,
-0x66400faa,	0xefc36a93,	0x96667b2a,	0xa659d1c0,
-0xf810ece8,	0xcd731027,	0x3b19c944,	0x525b9a96,
-0xa1155ff4,	0xe9377579,	0xd05e954f,	0xbc344ce0,
-0xf2a435af,	0x69314efc,	0x0a7d7457,	0x29ba1cf8,
-0xa01c70f3,	0x03f0f2eb,	0x4ea9fe78,	0x1463b4cc,
-0x53026868,	0x5f6a2d02,	0x58efb550,	0xa4a0e3f4,
-0xc9bb5cd7,	0x3c1fc3cb,	0xa3d0503f,	0xd7e7ecfd,
-0xbe128e38,	0x5ff74ff0,	0xfe74923a,	0x0e03446c,
-0x5cba99f5,	0x3b892c32,	0xf5155e4a,	0x5e3efa2b,
-0x9119f586,	0x59604588,	0x6d7423ce,	0x8cda5b72,
-0x267a0a74,	0x9b70a177,	0xc6834dde,	0x6ab9755b,
-0x1488d548,	0x0d8df88c,	0xd237aa90,	0x473df401,
-0x0fdd9dfc,	0x1d2cf3f0,	0x174cec53,	0x6be5058e,
-0xd4901408,	0x6c05259a,	0x11cca689,	0x2806cc29,
-0x7489990a,	0x43198c42,	0xe591f7ac,	0x572495d1,
-0x59fea9a1,	0x3fb91523,	0xd197ad93,	0x771a4b14,
-0xdd87d853,	0x52b0384d,	0xea4c7fbf,	0xbabef627,
-0x1b1edfc1,	0x4affe39a,	0x3a337568,	0xf3a8077d,
-0x567c9e5c,	0xe2f44db1,	0x4cfcc36e,	0x28884ef0,
-0x57dbdbb2,	0x11aed7f5,	0x8ba4eb36,	0xde120de5,
-0x49b381aa,	0x32fa79bc,	0x5aebcc3d,	0xf647e76c,
-0xb99ff536,	0xc8f6b229,	0xfb6eb426,	0x5b756b63,
-0xa6bea77e,	0x6d1479e6,	0xdef68b02,	0xb9951a00,
-0x4240cb0f,	0x094b7ca3,	0x2262064b,	0x6f604f98,
-0x0f06c41d,	0x1bef6e8c,	0xed8a279e,	0xdc559fbc,
-0xb0bfe389,	0x0442de4c,	0x4d9f5d73,	0x6a93f15a,
-0xb289c316,	0x3515ff17,	0x9681572c,	0x3680c1e2,
-0xa96b2dac,	0x9a06d703,	0xa94a17cf,	0x11535aae,
-0x01654322,	0xe4f831ea,	0x6d686f3a,	0x76c75680,
-0xa3e98a65,	0xd59aec33,	0x7130033d,	0x6196781a,
-0xcc28635a,	0xbee752b6,	0xb2946205,	0xae7c3c44,
-0x809b350c,	0xa5ff2e45,	0x742f4b4f,	0x75910861,
-0x0f9a7372,	0x4e24b6f5,	0xd968a8db,	0xe22c5ba9,
-0x54f08a31,	0x6cc17c5b,	0x08f940fd,	0x6cdfa456,
-0x29a4c0d8,	0x4246cac7,	0xe398f00e,	0x52d0654c,
-0x3610b2d1,	0xf84cd3f7,	0x00293b7c,	0xabb4b35b,
-0x58a7e82e,	0x1fc3c6c9,	0xc886dd9d,	0xbc25d985,
-0x4c5cd2fc,	0x3141f73a,	0x633ddaa9,	0x576f5fdf,
-0x7cc3a440,	0x14ddef25,	0x59d7d213,	0x29c80bca,
-0x0df80f67,	0x60711264,	0x050b3db3,	0x7b4d0800,
-0xd7350b2b,	0x507ccfbf,	0xc5a91aae,	0x7efed8c8,
-0xbb4bf7dd,	0x617ac182,	0xeee14407,	0xe5c634dd,
-0xcd0664cd,	0x1829ff02,	0x2e2073d2,	0x2ddcd5a2,
-0xcb1afbf1,	0x096866b5,	0x26ff945e,	0xc4a2172e,
-0xb4089d08,	0x4acf74ce,	0x169986c5,	0x61a28165,
-0xd26cc027,	0x78c799d6,	0xd800ddc9,	0x53754eff,
-0xf1141877,	0x48728ad0,	0x8a22c851,	0x858e70a7,
-0xab80b4ca,	0xfc0e733c,	0xcae85996,	0xe07f723b,
-0x4b81ce69,	0xc0ab303c,	0xb0eed408,	0xb89bc5ae,
-0x6711353e,	0x87d4675c,	0x89d7df88,	0x37206487,
-0x95e90c88,	0x63d48b34,	0xe7ba4599,	0x68a67592,
-0xfe0341de,	0x7fec0b1d,	0xb8f33820,	0x767319e3,
-0xd2044f54,	0xa4d341a9,	0xa45a2c9d,	0x098393da,
-0xd0654e51,	0xa737aa45,	0x9d2900e7,	0xfe7eb80c,
-0xceb9f445,	0x6c2c8690,	0xf8f98f3d,	0xa2d2bf07,
-0x927b1a93,	0x920852f7,	0xcb403552,	0x183882a6,
-0x92ead8e0,	0xb40b930f,	0x74c2c0a2,	0xa7b1c6cf,
-0x57e3535a,	0xe565ddec,	0x7332c331,	0x1872fd33,
-0x3e324a99,	0x17c9765e,	0xb0822c49,	0xff6abe65,
-0x6997ce5c,	0x73ed562e,	0x4efd661c,	0x10d8b025,
-0x2fd1eaf4,	0xb349f0c8,	0xe60fdd8e,	0x23fffbd0,
-0xa15bf609,	0xddd9e32f,	0x057abc03,	0x22802461,
-0xb279326b,	0x22ff69f2,	0xa0c580b1,	0xd991829b,
-0x0943eb85,	0x53cb5a35,	0x979217e3,	0xf7197b81,
-0x7a923206,	0x64bcece1,	0x404c97a7,	0x8c011352,
-0x8e84ac4d,	0x16bb918b,	0x05fdddb5,	0x227fb22b,
-0xb095fb07,	0x6b556afc,	0x9745a80a,	0x5f190072,
-0xc95b78d6,	0x76464295,	0x1e526ddc,	0x2bc7432f,
-0x52b3672c,	0xe5e477e7,	0xdade2243,	0x25ad56f1,
-0x5b75b5e8,	0x37865e3c,	0x286d27ea,	0x08c7d60f,
-0x0db0520c,	0xecad5b5f,	0x26d21fbc,	0x5f18707c,
-0xb2084911,	0x6b616c35,	0xd86e229d,	0xe8ed9694,
-0xd9872d8f,	0x13dd2a30,	0x67ffc707,	0x15c88108,
-0xcfba534d,	0x268bc3af,	0xdf10f336,	0xe3242124,
-0x3c83e736,	0x8a4ddf60,	0x9c8b418a,	0x9cfb165e,
-0x700d43a5,	0x9a974722,	0x55c8cd11,	0xb23ee685,
-0xb09c7f07,	0x75d6b52d,	0xd844b6dc,	0xfdb7d587,
-0x86500091,	0x752adf1f,	0x9d4e4d80,	0x180235a0,
-0x80951d7d,	0xf1d957ce,	0xfa9508f5,	0xcc891c1a,
-0xeb51f76d,	0x8b0e0f09,	0x93049970,	0x661542f7,
-0x07be174b,	0xed8c35fc,	0x85c13234,	0x0a72b1f6,
-0x8466dd86,	0x69fe80ec,	0x48e71a37,	0x40b32073,
-0xc06e1e53,	0x89b98205,	0xc69b2371,	0x5e75a364,
-0x07f7fff4,	0xcab47414,	0x85d5ccc5,	0x2cfbbe74,
-0xfe0f282e,	0xd20eec1c,	0x3b6d0540,	0x033ac156,
-0x91a56f71,	0xd7296dd4,	0x804871dc,	0x67d827cf,
-0xba1396b9,	0x9bb94134,	0xeffe0534,	0x2cbd5727,
-0x0b948509,	0x20a97dd4,	0x0605e6fe,	0xee7d930e,
-0xf1892f40,	0xd10a4b44,	0x87690a5d,	0x413019cb,
-0x4b4a4321,	0xfd1ad47d,	0xfb4b0fae,	0x6247d99f,
-0xf9e55be9,	0x74b94b74,	0xd13002fa,	0x031fd808,
-0x7f558bca,	0xafd37ef2,	0xdac30332,	0x4b8ec189,
-0x22864b78,	0xa294c296,	0x4e300c94,	0x351586a4,
-0x64b3c126,	0xe14af07c,	0xbcf3fd2b,	0xec9f8ba2,
-0xacaae0c5,	0xfd8416f1,	0xf86aec61,	0x827af51c,
-0x1db95b54,	0xd5b44400,	0x3189f284,	0x51ee744d,
-0x6b8e0ec5,	0x7c8fce74,	0x4bda1d3a,	0x4cb4bb40,
-0x94a80692,	0xe5d5cff6,	0xeee460bf,	0x5103d4ce,
-0x9ef7a762,	0xe1cdfa53,	0xe66c40e6,	0x9a4d5fb7,
-0x24190f5d,	0x0a8a1133,	0x244d0192,	0x1e27f111,
-0x2e7cfe2e,	0x437c86a0,	0xd5601c01,	0x95b9ea18,
-0x594baa9a,	0xa1beb6e4,	0xfc10208b,	0xd629fe46,
-0xc7a73322,	0x344cf9dd,	0x3b2025ed,	0x01b7e289,
-0xd4172aa0,	0x7fa0edb0,	0xa2bad69c,	0x32ce7645,
-0x2eb25170,	0x599b7e7d,	0xc0405765,	0x26292f80,
-0x796ccce7,	0xa0954fca,	0x4ee053d9,	0x13fda549,
-0xf8d89b3e,	0xf2468c6c,	0x96a61f8d,	0x33db3a7a,
-0xe69d7666,	0xa35e6d42,	0xe2b0346f,	0xaa0ba4db,
-0x67f642c9,	0x990654c7,	0x7598e386,	0x126ecb72,
-0xac24bf48,	0x6b12cbbd,	0x0ca2ac55,	0x3776e42c,
-0x27c182fa,	0x58cc7a01,	0x6f4f58a0,	0x229bc239,
-0xa0a025f4,	0x251594fb,	0xb4399cdd,	0xec1bb182,
-0x89832726,	0x8cc29f1d,	0xbbb6fd97,	0x33cf4317,
-0xfae44075,	0x6d2559f8,	0xa7c3242f,	0x7e8a8b83,
-0xbf1bbedc,	0xb5f1835b,	0xbfffdc15,	0xcd127b15,
-0xc322734e,	0xaf108cf0,	0x7fe1e0b6,	0xc294fef6,
-0x40c7b005,	0xf002f4d9,	0x84347361,	0x9a178122,
-0x221f84fc,	0xa3de3cba,	0xaca75f4a,	0xfb702420,
-0x716b0d5b,	0x5a14b3ac,	0x0d0da0f6,	0x799dbe99,
-0x23da1e6a,	0xb18a5e94,	0x3964553c,	0x259f218a,
-0x30d107e7,	0xa0a4415b,	0x0efae30e,	0x2a259b4b,
-0xb2a3545d,	0xfa5e2261,	0x5c22825a,	0xd5b0f032,
-0xc0e4974d,	0x158e98db,	0xaf5a511a,	0xd1fe28e7,
-0xcfb755c3,	0x28dacd50,	0x25dc16e6,	0x88d89d44,
-0xa2d7f529,	0x031ccaee,	0x48eaa62f,	0xdfa589e0,
-0x4e335b00,	0x452896fb,	0xe865796b,	0x8455451d,
-0x51438741,	0x272e7afa,	0x6868b95b,	0xff76cfb8,
-0x9596f219,	0x213704f3,	0x270848a0,	0xa0ad03e2,
-0xfc32d4b7,	0x8372384b,	0x7668bff4,	0x23b50cc4,
-0x30abc3e8,	0x285440bb,	0x26d17518,	0x9dc01773,
-0xac30222d,	0xefb1afc5,	0xc360b5cc,	0xdbe15554,
-0x2de4ee23,	0x9f6ae434,	0x73984eff,	0xdcad6ece,
-0x713950c7,	0x1b39b20d,	0xeae34762,	0x78716c5e,
-0x96300e70,	0xa2cdb877,	0xeeb863b8,	0x9c8ae2ef,
-0x82ad9c30,	0xea440a13,	0xc31799f6,	0xb7c9d784,
-0x7f451a4d,	0x6e93e324,	0x3c790775,	0x16f05511,
-0x7530d389,	0x5c8f2024,	0x4d5d4d91,	0xf99d1697,
-0x7e552001,	0xbe8ffe1a,	0xa52f66ac,	0x195bee69,
-0xeb7ea942,	0x69f1654f,	0x5d211509,	0x358dba8d,
-0x80450c6a,	0x52d895a7,	0xbf16fb92,	0xf862bd4e,
-0x6737b5eb,	0x820f8354,	0xe9f63fdc,	0x323317d3,
-0x4c4891c9,	0xe5dd8920,	0x75d3437f,	0xf9c0ebce,
-0x1e96c9f0,	0x9c224cf3,	0x41d0921a,	0xb96a502b,
-0x36004b70,	0x2122c9ef,	0x44b19035,	0x922ccbbc,
-0xfc2c2a46,	0x03d16aad,	0x907bc61f,	0xc7006fe2,
-0xc3fc3a73,	0x5d78f50c,	0xb894d12c,	0x140ef41f,
-0x2d7c5412,	0x501abfff,	0x7148145b,	0xeea55a86,
-0x4fc8b732,	0x3bdd42ec,	0x8e9e30c2,	0xac01ac1e,
-0xe599e322,	0x315f84fd,	0x7fe91ced,	0x76444300,
-0xe451f3e3,	0x63e049dd,	0x04826158,	0xc830df5b,
-0x38b83783,	0x036f106e,	0x1d858f4c,	0xe19c6b28,
-0xdfd72c0f,	0xf4a80ece,	0x2f967664,	0x4780d7b6,
-0x35a375df,	0x50b64e4b,	0xdefaebc6,	0xec40e6c7,
-0x1e419ceb,	0x7585e090,	0x6f90257c,	0x0d8ff886,
-0xa23d7ede,	0xb37cdeb4,	0x5961bafe,	0x2ee11dfd,
-0xb0f162b4,	0x5319797a,	0x51fd4b3c,	0xd88bb741,
-0xffe57978,	0xc237d953,	0x41b29753,	0xece0cb2a,
-0x690656fc,	0x360ee38c,	0x7b65902e,	0x75de0d97,
-0xbcd48c2e,	0xf3ed312f,	0x14a96440,	0xc755303d,
-0xb9120bd0,	0xc06e9afa,	0x6b2f099b,	0xb2a1a0f3,
-0xb76d613a,	0xa9acb4f6,	0xbbe10f9b,	0x52443f6f,
-0xb345ffed,	0x7e846b24,	0x2f25b24e,	0xa4fcdb76,
-0x788511ac,	0xca23a7a6,	0xe51838dd,	0xc9437374,
-0x291627cb,	0x18518202,	0x5bc7973f,	0x2b3b3265,
-0xc9981377,	0x9c36edbb,	0x00b51a3f,	0x60661320,
-0x3140e7a9,	0x109a3604,	0xde37943d,	0xbdd0d5f1,
-0x8bfdc673,	0xcdbfcaba,	0x1c700fd6,	0xee7b9c6e,
-/*  2501-m801067660C.inc  */
-0x00000001,	0x0000060c,	0x01192008,	0x00010676,
-0xfbac0eed,	0x00000001,	0x00000080,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x0000060c,
-0x00000035,	0x2e000000,	0x20080119,	0x00000301,
-0x00000001,	0x00010676,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc8f5cd92,	0x30bd1beb,	0x77c4fb8b,	0xe899c960,
-0xc729b4cd,	0x1d9b8923,	0xfcdfc554,	0x580d39f9,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x4872f26c,	0x88971c10,	0x66db1385,
-0x1e532ab2,	0x7ccd2d72,	0x38dd766c,	0x131f4505,
-0x7d5e1e0a,	0x1932938b,	0x79c1db9a,	0x9fe5b8bd,
-0x07037c1a,	0x698cd351,	0xbadb5300,	0x063f17d9,
-0x8558ada3,	0x224c2288,	0x26fa35b3,	0xe64efb19,
-0x0e1b52db,	0x696d5461,	0x3a0f765c,	0x4b853dfe,
-0x05147b28,	0xbe146518,	0xb61e1de2,	0xc342998e,
-0x083d5f41,	0x737fdbb5,	0xdd812ce1,	0xa7b9549c,
-0x164b5fbf,	0xaffd6139,	0x44154437,	0x23d44899,
-0xbe41eae1,	0xeecc8d45,	0x31fc971a,	0x44475238,
-0x5d4ab69c,	0x67f342a0,	0x118cb268,	0x513fb847,
-0x0a86fce3,	0x23f22535,	0x5fa15360,	0x929aa833,
-0x3cbd4138,	0xc1dead1e,	0x3efa210b,	0x9781a61d,
-0x00b53f73,	0x07df4d30,	0xffe97322,	0xf7b12998,
-0xba4d7316,	0x4b746898,	0x45ece500,	0x78cf31d5,
-0x0208c1c6,	0xc3999e15,	0xce2f90f4,	0x7e130a0b,
-0x3c74ce12,	0x37612fd2,	0x7ce3ae15,	0x99a26321,
-0x52ac391f,	0xcb32f7e1,	0x0e50140d,	0x3a6bfc41,
-0x497f7f9f,	0x334b7e17,	0xbcf4e41d,	0x3311b0db,
-0x0dc65367,	0x44847807,	0x991c439a,	0xd2965df2,
-0xfd72e4fd,	0x44b01f14,	0x5a0cf5c5,	0x70029e37,
-0x92af3f34,	0x47949bdf,	0x771a3c07,	0x0874f372,
-0x7a54670b,	0x7430b00b,	0x356234f3,	0x74edf1e6,
-0xaaf60a4c,	0x2bb5eee4,	0xc2c1d43f,	0xc4ee788b,
-0x4198fd90,	0x0aba19a3,	0xc251f028,	0xe42404df,
-0xccbd25f2,	0xdb13eb69,	0x888f89a5,	0x5a6c8cd3,
-0x1e3b469b,	0xe07e48c6,	0x87f25228,	0x64324c03,
-0xe0426f9f,	0x148f828b,	0x4a3c82ab,	0x7d46539d,
-0x0b5079ea,	0x2c675b3e,	0x83134717,	0xbe775c77,
-0x74841ec3,	0x4470addb,	0xfabfa06d,	0x548757fb,
-0x184ea712,	0x502765b5,	0xd7067ce2,	0x15afee11,
-0x8a95590d,	0x3a1734cd,	0x212c7f7d,	0xe5aa3e5b,
-0x9c7e75c3,	0x07486966,	0x5827bbea,	0x391e46fe,
-0xc6acbc9e,	0x9761b6a9,	0x37bef8c4,	0x733eb81f,
-0x7ac9a87a,	0xceacd157,	0xd931072a,	0x9383c10d,
-0x5eae74ef,	0x5f82f6a0,	0xcf89077d,	0xbc641bd8,
-0x1b7d1213,	0x980a4ed3,	0x410fa7e8,	0xaaa1a011,
-0xa5e94ef2,	0x74937d5f,	0x3c109f67,	0x8e58bdcc,
-0x2b43ad95,	0xaa516349,	0x6fa9cca2,	0x48a18062,
-0x663c7fd7,	0xf3822d87,	0xbaaf1f97,	0x8da372b2,
-0xa416831b,	0x6a645364,	0x9c7ac6fb,	0x3f5a9cab,
-0x8cf6f4b4,	0x514fd1dc,	0x7e9d0918,	0x2075f774,
-0xfda8677b,	0x3b5c16ac,	0xe887694b,	0x7d622e9f,
-0x5427472d,	0x540e5c99,	0x2196e138,	0x5d5e9c58,
-0x84a5fc17,	0xb17d6d41,	0x63273bdf,	0xfbb912b5,
-0xaf16b7c1,	0xeb1914d7,	0x5d654b8f,	0xf4a594f6,
-0x554a6311,	0xb391f519,	0xa5ad4acf,	0x9c052bb7,
-0xea68faa7,	0x37399a25,	0x8f6f6d36,	0x47c20f2b,
-0xf241ab98,	0x66da024d,	0xee90a06a,	0x33718b17,
-0xaa89087e,	0x6dcca7f5,	0x43a59f0e,	0xcb2e3ab8,
-0xb19126bb,	0xc56bccb3,	0x04f6fd9a,	0x0f63850e,
-0xa2b6c85e,	0x309f9817,	0x7252b154,	0xcba20ff3,
-0x143156b8,	0xcfcdc8ae,	0x13c2a75b,	0xea4bf1b8,
-0x6e474959,	0xa9c376f5,	0x40d252b8,	0xb6209e70,
-0x993efa22,	0x3d7e8007,	0x1857ba0d,	0x72f25310,
-0x233a8f68,	0xeb4ca923,	0xb17917d1,	0x9ca3f4f6,
-0xdecf1498,	0x99f5ddae,	0x8b6ba2b7,	0x54f41fb0,
-0x1ec9ffa2,	0x74ad3bd6,	0x84fee3e6,	0x5294820d,
-0x147e8b14,	0xd2dc15f4,	0x152fc744,	0x306bc043,
-0xfdbb74d8,	0xf4ea207c,	0x53edfac5,	0x1b609795,
-0xe990ee73,	0x749dbed4,	0xd1cefc95,	0x5c7b37f6,
-0xc6b39045,	0x7281e3f7,	0xed0e6aa4,	0x590a246a,
-0xe6e6a81d,	0x604491ac,	0x6cd14e8a,	0x7a19f5da,
-0xf7c7326a,	0x0ef8029e,	0x0e741b48,	0xc962a062,
-0x6f4ad86e,	0xa2729726,	0x93bcaf1f,	0x1bb56970,
-0x12495cdc,	0x180512e7,	0xa1d68081,	0xb924c24b,
-0x5a1461ca,	0x21438ca9,	0x5449ae48,	0x0f564503,
-0xcec8df3c,	0x789f9b80,	0x5a708df1,	0x28735bfc,
-0xcf11d2fc,	0xa5d01625,	0x80b0b533,	0xa09f026d,
-0x1d22fdf2,	0x01928228,	0x8b6779ed,	0x04f7cc95,
-0x581fe0b2,	0xcc9a66a4,	0x55b3f130,	0x0f22abed,
-0x05b7e95d,	0xd8cc9c30,	0x0850ca8a,	0x34d729dd,
-0x973300a7,	0x80ffedb1,	0xbf5b28e7,	0x135c8cc6,
-0x4337b017,	0x31d8dd09,	0x35ed75a1,	0xb8f990b9,
-0x4384dc18,	0x29d72b56,	0x021aa2b2,	0xa3248b3f,
-0x5f4e7301,	0x29991927,	0x1cc50c18,	0x79fcc545,
-0x56e2e683,	0xe5127777,	0x4b727957,	0x94d1bc22,
-0xacd0da9e,	0xd24771fd,	0x5997ff0a,	0xb9947cb8,
-0x8cb9bb5c,	0x16a4c5e0,	0x00d6995f,	0x1e05edff,
-0x3a7f1af3,	0x445fd70d,	0x24a602c7,	0x6b50001a,
-0x6c99f5e5,	0xad2c00c5,	0xbd16a90d,	0x3b7b6032,
-0xa8dd4f8b,	0x437145f1,	0x5a593d5f,	0x749ee409,
-0x9c6d8223,	0x40c1dad0,	0x578e7e1f,	0x89072e7b,
-0x0ccf47c1,	0x427606d8,	0x4a7bb48c,	0xf85cc4e9,
-0xca5ca3b6,	0x9b989f23,	0x6496403f,	0xdf8ef891,
-0xf4458e90,	0x28eed125,	0xef91afe9,	0x97a8d65b,
-0xe022b3dd,	0xc93c2adf,	0x520cbe7c,	0x58995018,
-0x719a724a,	0x9258733f,	0x8df05767,	0x879b9ba1,
-0x84684054,	0x71a62082,	0x5be959cd,	0x12c937ec,
-0xc21fb3b8,	0x6738aa89,	0xb01d872b,	0x0ff6ec3c,
-0x50fc63ea,	0x715b7c5d,	0x4e5d50c3,	0x086c862e,
-0x34ec9201,	0xd41176ef,	0xd0238088,	0x53518100,
-0x8e1500dd,	0xc6ea9594,	0x0359517e,	0x58d81a35,
-0x48c40983,	0x2d562dc6,	0xecf5be9e,	0x4cd82ead,
-0x45faeb2b,	0x1a66ec1c,	0x6b692a76,	0x6cb326b0,
-0x3a6c362c,	0xf0174da3,	0x5e4549d9,	0xc12c5972,
-0x73716059,	0xdd54591d,	0x32ee704b,	0x5a55c22d,
-0x56bd1e7e,	0x2bd34024,	0xa42c85d2,	0xb1ce248a,
-0x604a7570,	0xbbf4b3fb,	0xe0eeb866,	0x130b7dd4,
-0xdb39dc1d,	0xd873b0c4,	0x3aedb6ef,	0x5efb2481,
-0xbfaff9bc,	0xb94930d6,	0xa3fe71cc,	0x75867e01,
-0x7c8ee191,	0xf38f4963,	0x8d077957,	0x658e7c2b,
-0xc1bd58ed,	0xb86a20b2,	0xc624489c,	0x4624732d,
-0xc11f1ee3,	0xf1874ed7,	0x173684cf,	0x0e5851d4,
-0xc2662118,	0x13dbb926,	0x1668df5e,	0x00749d03,
-0xab9530d2,	0x5758e602,	0x6db90ff1,	0x87270f9d,
-0x774a52f5,	0xcd1b4b5a,	0xd706025e,	0xe3a51fc4,
-0x31c5d55b,	0xbd0278a1,	0x16dce1bf,	0x75a3446f,
-0xe030c121,	0xa6f6b3c8,	0x504e3b3b,	0x4c1428b1,
-0x74229a60,	0x25d5b7b7,	0xea284c21,	0xf5f1c7cd,
-0x0025e9fc,	0xa7db9e56,	0x4e3aeb90,	0x8bad0f3b,
-0xc19e88eb,	0x8ea86b83,	0x25cf5d26,	0xca78504e,
-0x94109c06,	0x60ad3975,	0x138b8038,	0x4c9d8fdd,
-0x28a91526,	0x5d3d6c3a,	0xf81ab861,	0x8db34426,
-0x35a3b398,	0xf3b40170,	0xb7e6994b,	0xea72c1f5,
-0x63201cd4,	0x1c5749dc,	0x420ada27,	0x419f4847,
-0x49244543,	0xb915645f,	0x3a00b3e2,	0x0122000b,
-0x296b6bad,	0x7b45d76b,	0x5be8f025,	0x2a04919f,
-0x8291fea4,	0xaae644f9,	0x7af3fb96,	0x77d9878c,
-0xa8996848,	0xa9a0c1c3,	0xb47ae6d2,	0xc5b6cf90,
-0xb04b4863,	0x43fa113b,	0x66ef4993,	0x03a5b4e9,
-0x94b661dd,	0x145a5909,	0xd42f70cc,	0x6b816775,
-0xfbc0cb04,	0x5e890eb1,	0xb6900305,	0xcd19304b,
-0x85c67d21,	0x19e91907,	0x27b3898c,	0xe0ce6ba2,
-0x4110d80d,	0x85953740,	0xba7a4225,	0x51db6dd9,
-0x04c21ffe,	0xd34ef7cd,	0xeb13f075,	0xc1f8eb04,
-0x19a1227a,	0x3e99efae,	0x318346e2,	0x3d4c73bb,
-0x402dacc7,	0x5a9e892d,	0x01304401,	0xb3950c6f,
-0x9254bea1,	0x5cc8f025,	0x53cb9416,	0x52d716c5,
-0x3ff575a5,	0xede2046b,	0x2cbd6b85,	0x7e8feb25,
-0xc2d35482,	0xa49b8495,	0x214fed4b,	0xc93ae54f,
-0xde3d8a18,	0xe4456b47,	0x505555c1,	0x6418926d,
-0x4b6ac1e7,	0x7ac213ea,	0xc081eea5,	0x467ff1c3,
-0x1ed5d79d,	0x746dbb24,	0x38b1dbde,	0x4d495fc0,
-0x7ddabfe1,	0xfbac0ba1,	0xd17cfc3b,	0x32c819f3,
-0x1f4c39cd,	0x6fa5c3ed,	0x0d2e7f50,	0x1f5cb318,
-0x1e1770d1,	0xef12c293,	0xb149ace5,	0x93df9bdf,
-0x14a98319,	0x3374906f,	0x746d603f,	0x5a368e6d,
-0x8dbaef76,	0xb7923f42,	0x607655cc,	0xd144703c,
-0xa01fa0f6,	0xa83f4e65,	0x224bba03,	0x6e082d15,
-0x11ef27eb,	0xad91427e,	0xd8f0e3bd,	0xba7bc3df,
-0xdb031557,	0xf33052d0,	0x2bc3df37,	0xf55d25c2,
-0x99af998a,	0x5819eb07,	0xe4b9ebc5,	0xbc3da46e,
-0xde1abe71,	0xb8c66434,	0xe811e29d,	0xa48ee5e6,
-0x7f961c60,	0x5500769f,	0x9c8e0d00,	0x94680cea,
-0x2f7a0c5f,	0x9a058310,	0xd3ddca08,	0x74276c4c,
-0x855ebef2,	0x61979f79,	0x09684303,	0x3ea777dd,
-0xf700db1f,	0xdf7bcae0,	0x0fa7db2b,	0xd0115231,
-0xc0015882,	0xe4af6f72,	0xb4388c7d,	0xfb5656bc,
-0xbe1d38b3,	0xf59ae9d3,	0xddc692bf,	0x3aaef998,
-0x561f993f,	0x4d191a40,	0x4492df05,	0x7eb17670,
-0x0770001b,	0x9b320a87,	0xbc8a559a,	0x19781e02,
-0x13c995b1,	0xcb8c1e47,	0x462019e3,	0x7ee6bcc1,
-0x9da2afce,	0xee1dbf76,	0x3a72ad3f,	0x711f786a,
-0x0c72d639,	0xa3455dc9,	0xef155308,	0x82f3e1c9,
-0xc9540414,	0xcec2cde1,	0x748005bb,	0x24197d5d,
-0x4b8b7f7b,	0x3dde3129,	0x9ac952c9,	0x6f7932a7,
-0xa99005e4,	0x4261280d,	0xfad329af,	0x90bcacb3,
-0xe1c4a202,	0x9200d928,	0xffe55142,	0xf69b2a40,
-0x227783a3,	0xe4b0c9c4,	0xeca97ce9,	0x9245597d,
-0xa922db08,	0x94bff912,	0xdbebd937,	0x5c658f30,
-0xb3f4a726,	0x24e2ca27,	0x9ca037d7,	0x745d3d5e,
-0x3e8c437e,	0xb807af86,	0xee5fa977,	0xfe335297,
-0x5c0a6707,	0x8ab801af,	0x05d02766,	0xcd0906b4,
-0x791b47d3,	0xff5a0291,	0x09465b16,	0xa7fff3a1,
-0xe2e6d825,	0x7f4f2b9a,	0xc1f2e668,	0xa5cfe1d6,
-0x95fd7bde,	0x38681314,	0xc3c7dce1,	0x7b82e044,
-0x2c883c77,	0xe8aa72be,	0xd53867d7,	0x7022fdc3,
-0x3b697ccd,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-/*  2374-m16f6cb.inc  */
-0x00000001,	0x000000cb,	0x09162007,	0x000006f6,
-0x6f5dfa09,	0x00000001,	0x00000001,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x8cc99628,	0xdd93d064,	0xeacbe655,	0x0f2e237f,
-0xed4e652a,	0x1a3f2706,	0xc4ac514f,	0x9aa90c36,
-0xb808bbc5,	0x43bb567b,	0xbfea430d,	0xaceacc6f,
-0xa03a6fc5,	0xce471ef1,	0x3b414283,	0x2e6afbf0,
-0x26b83316,	0xd2200e5a,	0x4baba0ee,	0x4e928f40,
-0xbcd3d907,	0x2dcdd606,	0xabf25452,	0x0752ed4f,
-0x671b3afb,	0xc8d02d3f,	0xd4261c4c,	0xe3999096,
-0xf030cd34,	0x00959162,	0xe1fcad06,	0xaa39436e,
-0x1967eeed,	0x3c36361b,	0xb03c7119,	0xed21d6ab,
-0x64e77067,	0xf8251213,	0x92b71464,	0x9627993c,
-0xd0f6329e,	0xfb756405,	0x64bd21d7,	0xc58c9e01,
-0x64c5c82f,	0x0a4ea25c,	0x023df5e1,	0xe53b65df,
-0x103c6d92,	0x85806ef2,	0x53174db3,	0x86eb50d5,
-0x6e472e0b,	0xae1b1232,	0x70c8ef6f,	0xbd53d673,
-0xe36a3752,	0x57b967a0,	0x1ef229e0,	0xb5205fa0,
-0x8a1b8605,	0xd5e0f464,	0x950ae36b,	0x98d0a673,
-0x8f0daad5,	0xac17892e,	0xaf25b16f,	0x4656a1af,
-0xe86de91f,	0x3eac43d0,	0xf3158fe4,	0x4475650a,
-0x1028fd42,	0xf75508a9,	0xacafbb7e,	0x95c83a04,
-0x47b7f70f,	0x3c4078f0,	0x8455af31,	0x7664ceda,
-0x689b2778,	0xfb4057c0,	0x5bf83a36,	0xf3560a91,
-0x6e5155a7,	0x27dae434,	0x0e583b31,	0x73ea435b,
-0xfd4d2097,	0x84d77cba,	0x1cc336eb,	0x5d924138,
-0x474fac1b,	0x496736b7,	0x8166361d,	0x724a2336,
-0x57372e63,	0xc72e0f0b,	0x0e442bbd,	0x0d3fdee8,
-0xf5c61af3,	0xe15d745f,	0x8b3646bd,	0x6aeeb4bf,
-0xa5d8fc0d,	0x1371ed89,	0xc0d4de01,	0x201c36c2,
-0x055a8591,	0x57690227,	0x357c8aa1,	0xa7f7dc08,
-0x4e7abcf8,	0x7f1d9554,	0x1ca865d6,	0x94bc649b,
-0x261df890,	0x229e0361,	0x8dc3c9a6,	0xe9849f75,
-0x7f3e006a,	0xbf0eadb3,	0x31209c06,	0x20d8ce6b,
-0x9e9f9876,	0xe45461a0,	0x0577d8aa,	0xc7b34c81,
-0x5f34b5b7,	0x4921ca3f,	0x8024451d,	0x77957caa,
-0x50224c71,	0x2dc6d58d,	0x1dcc39f3,	0xe4f6072d,
-0x96c5ebfe,	0x9bfa46de,	0x693c63b0,	0x36d3d7d4,
-0xa8cd7320,	0x1fbbbac1,	0x299f98dd,	0x30c11f3f,
-0xc2f3768c,	0x206af5b6,	0x2957b013,	0xfe45cdee,
-0x1b0ed424,	0xb292ed29,	0xd75c4e75,	0xdb829ddb,
-0x4f1408d9,	0x10c912c5,	0x3f1412d7,	0x172bc236,
-0x6714ce89,	0x5e788c51,	0xa9185b5b,	0x1e559cae,
-0x3e5e1e03,	0x42b069ab,	0x3ed34c33,	0x27fa8f53,
-0xa1d4d045,	0x7f3a55e8,	0xe4dc36f6,	0x25bcdc0e,
-0x8b370262,	0xace3a7ca,	0xc93cb529,	0x57377a07,
-0xe94c4b8c,	0x84c19a43,	0xfe87ecde,	0x10ecd4cb,
-0x85ab4702,	0xbbcdfacf,	0xfd12ef31,	0x330d5a61,
-0xeb57c1cb,	0xd1ca61f1,	0xa7e32012,	0xc5273d7a,
-0x8ce6f8ec,	0xb6f02288,	0x8b38ed67,	0xfad9cc58,
-0x39e7fa49,	0xfb3d9704,	0xd7dd5146,	0xfe61fac2,
-0xc456e412,	0x51899aa6,	0x7c1e63fa,	0x37179d80,
-0xecb61178,	0x8f44f5c9,	0xa9b952b6,	0xce36ea2c,
-0x899ebbef,	0x08c13867,	0x285a7693,	0x30d16f3e,
-0xa0c38351,	0x61b6771e,	0x10232f08,	0x260aa3c1,
-0x46289838,	0x11c7a747,	0x442bbb7a,	0x4566010e,
-0x0d911958,	0x905492fc,	0xe277fc99,	0xc3f49fa7,
-0x116f2325,	0xe804886d,	0xefeaec69,	0x48aa6147,
-0x36c224ba,	0xbbf0f900,	0xb60f663d,	0xf7dfe70a,
-0x539f05f9,	0x08817226,	0x05221b62,	0x48b61680,
-0x29ea4964,	0x633bff58,	0x7eeab12a,	0x74623b22,
-0xf3d5752b,	0xc5c19a97,	0xa87f85d2,	0xf3943291,
-0xbaff1f30,	0x6c7f3697,	0x1376d156,	0x3b95e18a,
-0x678779a9,	0x094ea73d,	0xb15571cb,	0x2500d79a,
-0x1722f328,	0xb67d6753,	0xf492d6bf,	0x8a090f83,
-0x2b95e523,	0xec19679b,	0x1f25ec56,	0xf3a79e0e,
-0x7d795c32,	0xf961eec4,	0x57d2781f,	0xdc2dccf8,
-0x71412727,	0x3a5840ff,	0xe433fa73,	0xad17f321,
-0xc8c8c87e,	0xeebbb101,	0xa00bc7f5,	0x49fc605c,
-0x6e8de8ef,	0x6140052d,	0x7abfdebf,	0x8e8205c2,
-0x6ef7b48c,	0x7c89a48b,	0x0b70c768,	0xc924a889,
-0xf62ddb12,	0xb0a31334,	0xda0ad64b,	0xce05fd6a,
-0xc14ab235,	0x793c3c5c,	0xe097f8cd,	0x557d7ab4,
-0x0f774f23,	0xaba657ea,	0x68445529,	0xda624520,
-0x87b5ac57,	0xfe0fefdc,	0xd68fb057,	0xbef6bade,
-0x0c93027b,	0x91c4aff9,	0xe59b7798,	0xfdf29517,
-0x6ffc358c,	0x19b1ad64,	0xbe6ae4f3,	0x83809cf5,
-0x57971a97,	0x3b2d4a05,	0xb2385257,	0xb168d28e,
-0xbfc2c743,	0xf0a26979,	0x75a599db,	0x9e0fbd84,
-0x984219a7,	0x9fd76c11,	0xe9543726,	0x04a3aa88,
-0x0464f668,	0x00ce157c,	0x54867a61,	0xf189c8ab,
-0xefb98743,	0xee120915,	0x64412b15,	0x15e592c4,
-0x512e1b2b,	0x9b89ca4e,	0xc31f2572,	0xc04856d8,
-0x18f7c195,	0x20e9138f,	0x5060c183,	0xc6b3504e,
-0x8564aa44,	0xde498682,	0xe0c8b0a1,	0x2817ba17,
-0x67948b99,	0xda17b086,	0xd49e7e8a,	0xf76cacfb,
-0xfef3e62b,	0x49d844ac,	0x00779390,	0xd64f6467,
-0x5c7919fe,	0xc655db71,	0xf96627db,	0x2b69cdfa,
-0x04f0e69a,	0x403cd655,	0x94daf134,	0x61b19de3,
-0x2659bf25,	0x70b55cbf,	0x2795450e,	0xbd2d93d8,
-0x9fdf44af,	0xd26cf2d8,	0x767dcc5a,	0x349e0083,
-0x8713f27b,	0xd9785b33,	0x33761b40,	0xeea10521,
-0x4ffd5554,	0x8bde0d09,	0xabda65c2,	0xcb313439,
-0x5e38f460,	0xcea63946,	0xcd454c65,	0x61ea3130,
-0xd6bf676f,	0x9fe33190,	0x805599a0,	0x2b4d71bb,
-0xd6ef6d75,	0xa1dc7b50,	0x532dae93,	0xe5b3bcba,
-0x67bfd0fb,	0xe657b81a,	0x941df750,	0xfe355d3a,
-0x83be456d,	0x70c7f3b9,	0x16d7c736,	0xe1677e4e,
-0x66050649,	0xa5130662,	0xfc7b1f88,	0x936e7a2a,
-0x5b83c459,	0x66459c28,	0xe95c7a78,	0x5e4b4012,
-0x6163b0b9,	0xdc59f22f,	0x43554c8c,	0x1e600eed,
-0xeaa25fdb,	0xc6b0f2a2,	0xa91cd5e8,	0x78118159,
-0x1fd3b9b0,	0x33ec8d9c,	0x98b5f83c,	0x4bea93ce,
-0x8f1508ab,	0x3b8ebf4f,	0xa6f58dd5,	0xf527f240,
-0xba863b2e,	0x6cdefb2d,	0xc0bc3710,	0xc405d374,
-0xe20e18c2,	0x98aeb97c,	0xb7e7334d,	0xaed99f08,
-0x5db6a85a,	0x29f49035,	0x6aa56f8b,	0x42119bd5,
-0xddfb18cc,	0xbbc497db,	0x6b1bdeb8,	0x87a7effa,
-0x26cc2ef6,	0xebb44d0e,	0x86d98ee9,	0xe5ed8a54,
-0xd89e77b0,	0x3d70edaa,	0x397122c8,	0x01373cdc,
-0xd20990ac,	0x8dd8f0cf,	0xc0b85880,	0x98d34d2b,
-0xea9c54fa,	0x01154926,	0xf97b07b5,	0xf8acc1fb,
-0xe2772a2f,	0x0b72e223,	0x0d5a5bf0,	0xbd5a79fc,
-0x164a0de1,	0xba318e96,	0xf181613f,	0x4e415e2a,
-0x3c0e50c0,	0x203a9454,	0xebfd74f5,	0xb4eab52e,
-0x077fb33b,	0x82875c19,	0x710fa091,	0x9f90e318,
-0x1e85d567,	0x0d87c6d0,	0xd4aac2e3,	0x08f33bd2,
-0x912b7cd1,	0xc0221fef,	0x0b1ac4ff,	0xa4b5e363,
-0x76fe31bb,	0xda70ad1c,	0x35391da6,	0xfc7e096d,
-0x1b92bd89,	0x06a15c01,	0x71bea62b,	0x7e02d846,
-0xcad0b5a3,	0x85314e36,	0xff7c3e21,	0x05a26a1a,
-0x4991d458,	0xc31312de,	0x7f3d5ba6,	0x482af963,
-0xa64eabfb,	0xa156004e,	0xf7bd66a0,	0x596ed6aa,
-0x299c5948,	0x83e3090c,	0xc7ff0db5,	0xf7f04b07,
-0xea6f26c2,	0x2202ff95,	0xdb1be869,	0x570d2bc8,
-0xb6b2d6b6,	0x06a93efb,	0x6e21fcc6,	0x8873a3c1,
-0x4e83b301,	0x9fee4803,	0xeec62f43,	0x48527fc0,
-0x423cf782,	0x5d619cfb,	0x62af27a8,	0x907ccbe1,
-0x90ccdc3c,	0x596e345f,	0xff6777f1,	0x734506db,
-0xf2251e7b,	0x8c1d119c,	0xde4a8d7a,	0x3491f6c9,
-0x1d236690,	0xca9ea54d,	0x0b041fb4,	0x5e0952e9,
-0x3a2a9fd6,	0xa9f9b1f7,	0xa6a2ef4e,	0x9a10b33f,
-0x68874a04,	0xea79b7c9,	0xc9b880be,	0x5d840cee,
-0xe271c855,	0x115ebc21,	0x4413b163,	0x2092ae0c,
-0xabf457b1,	0xa4e624d7,	0x6162c7b8,	0x48a3d1b0,
-0xf5576ae2,	0xd2c50b2a,	0x8d280a22,	0x317b2aa9,
-0x86081f3e,	0x5b16558b,	0xe929c9a3,	0x024d87d9,
-0x4e028055,	0x8a4f2cdf,	0x0074cf1f,	0x94c333fa,
-0x5ce57075,	0xc7f96cfa,	0x9cae5fb3,	0x883dae8e,
-0x366856b7,	0x9caf63c4,	0xb9dede87,	0xf33e6f03,
-0x12043886,	0x7c491aa0,	0xa893dec8,	0x48c770b1,
-0x53b5b08a,	0x305c2fc3,	0x8acf8a9b,	0x34eeb82b,
-0xb8788ec1,	0xc94bab28,	0x01ba344d,	0x01443e32,
-0x7a02a450,	0x7c753958,	0x1538ac60,	0x780495a8,
-0x6100c375,	0x087b32cc,	0xdc1a012f,	0x6177bccf,
-0x1a73ed83,	0x70c1673b,	0x4a611622,	0xc38cd364,
-0xec01a740,	0x9d8b70ba,	0x4167b81f,	0x32aa3a67,
-0x01f53fa1,	0x2970f763,	0x96d632f2,	0x6bb81493,
-0xf0271789,	0x8d50a57e,	0x6844d683,	0x4e810ac2,
-0xecb47ada,	0x4aae5190,	0x597fe8c9,	0x932e6295,
-0xb7bb5fa1,	0x3bf834e9,	0xe67989ad,	0x245e7f0a,
-0xe754455a,	0x157e56bd,	0x57d18987,	0xedfbd198,
-0xdfac9f5d,	0xd8ae6b4e,	0x34ff0f87,	0x5a941474,
-0x829936da,	0x3a64c085,	0xee7114ac,	0x9f6c5b61,
-0x966e4768,	0x42e63da2,	0x2ac3cdbf,	0x009868bf,
-0xacf2c492,	0x71825064,	0xd9a18aa8,	0xf9056101,
-0x4cc3cd56,	0x38ce86e4,	0xe7622a3c,	0x3cc073c4,
-0xc366b756,	0xb4ea6da6,	0x0797eefb,	0xa4701b26,
-0x2e8e7cff,	0xb5168bff,	0xc524e609,	0x959ed99a,
-0x696cc74d,	0xba540d34,	0x56ed1fe2,	0x243ee688,
-0x9f9b6e64,	0xafd12b43,	0x14b69f11,	0xdb4c6915,
-0x2a0a17ab,	0x7800111b,	0xbb45464d,	0x322ffe3b,
-0x81e5c756,	0xbf97c084,	0x6e603423,	0x040aaa9c,
-0x244c254b,	0x792f2cb9,	0xc2697b28,	0x6cd584cb,
-0xa8dd616f,	0x13e0b67d,	0x6344c177,	0x456e2291,
-0xf79a69b0,	0x287b0c41,	0xf129f53a,	0x5ab58b96,
-0xd6b5ebaf,	0x3e869e34,	0x1ed31326,	0x99a139c0,
-0xead1e32b,	0x9ae80270,	0x6d50908a,	0xfe3a8682,
-0xc300928c,	0x07a9d067,	0xf95fb96a,	0x9124d845,
-0x950bb64e,	0xd759b736,	0x63af09bb,	0x77992644,
-0x6585fd18,	0x90c8a962,	0x58280f9a,	0x3b33b693,
-0xe69fac20,	0x40e9da52,	0x58af61c7,	0xd0fb5fd2,
-0xe7c4904e,	0x89a89562,	0xcfeddf61,	0x78a6a53b,
-0x46cbcb5e,	0x98830a71,	0x45476951,	0x29007807,
-0x1892d5e3,	0xec8f4748,	0x6eae03dc,	0x68106a0b,
-0xc7b79f3c,	0xcf67dfaa,	0x76d01d92,	0xe83302ca,
-0xbe89cb53,	0x8e99b9c6,	0x1b329e36,	0xa6201431,
-0xcb5e3ca1,	0xabfa3732,	0xc6d861c7,	0xff827943,
-0x8baa8d8d,	0x44124268,	0xb52d38f6,	0xe1b543d7,
-0x350eb505,	0x8aaad0ab,	0x64d2d1f7,	0x1f78037c,
-0x15e4d29a,	0x8de0fde2,	0x0c67bd7d,	0x9217b97f,
-0xa51ff353,	0x7e6e317c,	0xf912efc7,	0x6370513f,
-0xf3c39d12,	0x9f72b794,	0x04d0c86e,	0x6df3411c,
-0x3886f1ca,	0x1bc7617f,	0x1828cc69,	0xa99b3d47,
-0x639eb77c,	0x1e8ddb3c,	0x24a52535,	0xdd236edf,
-0xf982fbac,	0xc1888b0f,	0xb346e7ff,	0x0b3dd6a7,
-0x136a9ca9,	0x929ad1d6,	0x0c8a0974,	0x2d7bf023,
-0x0c5e5a30,	0x903dd14c,	0x528c952f,	0xa1cf54e6,
-0xf12b6408,	0xf12e92d5,	0xeaf353fd,	0xe6fe1ee4,
-0xae452344,	0xff0439cc,	0x10e66738,	0x8fe58135,
-0xc4da00c1,	0x652e5e2c,	0xed3da3b1,	0x466fdbc9,
-0xafb0be28,	0x096e3c7d,	0xae36530e,	0x48ece09f,
-0xeea64c15,	0x2fbdb9af,	0xd3aec625,	0x283bc6e2,
-0xdb9fb831,	0xd9a2a76d,	0xbed7481c,	0x5b125110,
-0x9727c61a,	0xd0b68c17,	0x63308054,	0x0afc462c,
-0xdcf6fbf6,	0x6bd99600,	0x5d2cafba,	0x32540b05,
-0x71a05d58,	0x57c91984,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2348-m806fda3.inc  */
-0x00000001,	0x000000a3,	0x08132007,	0x000006fd,
-0x89c0d01f,	0x00000001,	0x00000080,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x72cbc5d0,	0xa24e89bc,	0x074028ef,	0x2ad07a06,
-0xdeb7acf5,	0x98912a6d,	0x295d17a5,	0xa3b8708f,
-0x95c69839,	0xb2f655e2,	0xdce0fc75,	0xf92f04fd,
-0x51b6b38e,	0xe7884365,	0x69dcc34e,	0xcfe67a6b,
-0x5e421f0e,	0x51527923,	0xb63fceab,	0xae39d6c2,
-0x5dc6865a,	0x5819082a,	0xcfcfc6eb,	0xc4ed71a8,
-0x06e83b7b,	0x7cc5025b,	0x5fefb2c9,	0x3c02abbe,
-0x42dba8cc,	0xfc966b64,	0x2acaa07e,	0x61d32476,
-0x72fed3f8,	0x7ef26af7,	0x8086deb1,	0xd11fe511,
-0x3dcc3e92,	0x202bf190,	0x17fbf18b,	0x4cd17950,
-0x81299fb5,	0xac3d96a2,	0x389ff313,	0x85dd4b22,
-0x4eaef9da,	0x623b133b,	0xe3d02b2c,	0x2290a31d,
-0xc6f8c543,	0xf6c18f11,	0x8070c5d4,	0xc756e5c4,
-0xf4a40060,	0xbf169c70,	0x62dd14d4,	0x729fefe0,
-0x6594d275,	0xa5abc2e8,	0x720904e3,	0x5a5b42ad,
-0x5e970808,	0x5a6ec767,	0x502a6d38,	0x88d24740,
-0xb4739506,	0xe3f497a2,	0x2618e78d,	0xfb602c6c,
-0x323fc08b,	0xf9cb3dfa,	0xc90130e6,	0xe373da35,
-0xde024249,	0x490b1796,	0x93f157ee,	0x10f73761,
-0x6dd5c0e4,	0x4a9fb1fd,	0xadc2ead7,	0xd13e442c,
-0xbfbd007d,	0xc8de8a68,	0x09c630bc,	0x69e78a87,
-0x4d64bab9,	0x81c58c9b,	0x0b693158,	0x2a40ee8f,
-0x47153744,	0x2a32e243,	0xdde6b849,	0xa2c35ddb,
-0xf8c10a60,	0xaf5796f6,	0x8a95da67,	0x013f80a1,
-0x7f332110,	0x345e3e0f,	0xba8ca1f8,	0x373a3380,
-0x97f10a50,	0x3e1e78a8,	0x097496d4,	0x60ef2ffb,
-0x9421fb84,	0x03131ba9,	0x535e0247,	0xeda34f42,
-0x7f34ebb7,	0xbcfd1c2d,	0x19b2c696,	0x7107aed5,
-0xd5877fe2,	0x404186ae,	0xbc41a831,	0x1cd49fd3,
-0x92ff4c85,	0x3f65b35e,	0x701ce1cd,	0xe3839c91,
-0xab53cf2d,	0xdb124ec0,	0x7c012c6c,	0x432b628b,
-0xac351ee6,	0x9da287ad,	0x0adc2580,	0x66f945ca,
-0x36bd8108,	0xbce986ee,	0x8fc2d524,	0x06dbf665,
-0xb4124dd5,	0xf15c2853,	0x4aaa9b46,	0x753c207d,
-0xd7805517,	0xaa6f6dfe,	0xf6eb1ced,	0xe6a4f89c,
-0x5cbf2b1f,	0x6889832b,	0xf121bc8e,	0x2d7e02e9,
-0xedbc10d5,	0xf3974ab6,	0xf977d65d,	0x40ef2640,
-0x9c5f3410,	0x7ce2bca8,	0xac2d2c23,	0x204d560f,
-0x2dffb3b3,	0xb051fdc4,	0x76ef18ad,	0x1b13190f,
-0xa08cd1d4,	0x1aa202b8,	0x1a5040f4,	0x23a24420,
-0x22622bd2,	0x6e543121,	0xfe68651f,	0x4e0d3fd6,
-0xda661e0b,	0xfb41bbdc,	0x5a6e0df0,	0x8c27383a,
-0x91e24f94,	0xa5db6d2d,	0xc7684280,	0xfddaf106,
-0x0ada8514,	0x5cb76df8,	0xea1242ce,	0xc5aca25f,
-0x0821a5f3,	0x71e4de37,	0x89c9a2a8,	0x4d2231b4,
-0xc3edc81c,	0x56f516f9,	0x7e95a590,	0xe00ea616,
-0x827fd358,	0x4511b62d,	0x6cac7958,	0x8259e262,
-0x9ee67b13,	0xe73bdab2,	0x811f51d7,	0x88e6196f,
-0x642a4db5,	0x1ca77047,	0x5a095f6c,	0xa42ddb9a,
-0x66321e3c,	0xeeed0f13,	0x72e48195,	0x988f23df,
-0x3d058cd3,	0x45fed77a,	0xa20f4f80,	0xca873db9,
-0xcfd4a890,	0xcb406f47,	0x56bd45eb,	0x8ca14876,
-0x411da96d,	0xaabe66e1,	0x26ce3950,	0x40ceb4ab,
-0xbbb2b914,	0xfd90126b,	0x74c60165,	0xcd2e00ff,
-0xe0607bd7,	0x3dc3818d,	0x4102205b,	0x72cca471,
-0x0864151a,	0x65c92538,	0x5bc44cfc,	0x406a9b62,
-0x10e5aab2,	0x751f6321,	0x533ca54a,	0x335961a9,
-0xa386abb2,	0x24f90a2b,	0x3d13ff7c,	0x35d454ef,
-0xc236b524,	0x8cf68189,	0x6ba29c87,	0x3925aaae,
-0xa12de178,	0x4610a2d1,	0xfe330eca,	0x8d657af3,
-0x7f2f81f3,	0x46cd664c,	0x676003c0,	0xdf786970,
-0xb240a066,	0x41f852f2,	0xb85e5eac,	0x8ba83def,
-0xc12c498e,	0x02c5d742,	0x4b9df557,	0xd9f2ed28,
-0x5f7cec4f,	0xf9ff3a0c,	0x457ac549,	0x133f5bd1,
-0x951b6947,	0xf835f2df,	0xee51efd0,	0xe90b1bdc,
-0xb76c1a80,	0xc3f209a0,	0xb175f774,	0xd8963aff,
-0x3d458f2a,	0x9ba9ca53,	0x91561069,	0x444ac140,
-0x87f53cb5,	0xc835bec0,	0x2b6906e1,	0x1f2201e6,
-0x443bfce4,	0xd0e25486,	0x71ba244a,	0xa85e4fad,
-0xb0a9df78,	0xbef803cb,	0x710cbd53,	0xd7ce50b3,
-0x38f69e53,	0x5175759f,	0x987de9f5,	0xfc5f9332,
-0x090ba2ef,	0xa059c8e0,	0x9efc20ca,	0xaead8853,
-0x22cd4804,	0xb30dca16,	0xadbbdf33,	0x246cb36c,
-0xec99405d,	0xfef7e46e,	0x454bf0a3,	0xa75d4072,
-0x6859ad38,	0x3c6a15e8,	0x37bb8ecb,	0x05747a82,
-0x97edcb0b,	0x5bff5a7d,	0x20cd1e91,	0x1e37277b,
-0x4c0149e1,	0xc7d5e490,	0x253bcac9,	0xdffe64ac,
-0xf7ce2179,	0xada80d94,	0x3653f166,	0x7271d8a4,
-0x994f269f,	0x0841e81a,	0x709401cc,	0x0c9fefbb,
-0x30fa89fd,	0x1fea8b70,	0xffc68c98,	0x2030e064,
-0x8e28b2c7,	0x2750f01e,	0xceb4d955,	0xb86ee560,
-0x7ca55701,	0x3a942ffe,	0xd6ad0e17,	0xe8cec9d1,
-0x5a6954e8,	0xb14fe7c6,	0x6e7d5c90,	0x8481626b,
-0x7c798699,	0xdb0b344a,	0xa721cdc5,	0x861db07a,
-0x1844fca7,	0xde861a71,	0x770735c1,	0x3ab64f3e,
-0xb352aeb8,	0x046529cf,	0x2fd753f9,	0xbb3cad72,
-0x27b44c84,	0x58e77f53,	0x08840b3c,	0x75ceaa6a,
-0xcfb8ec2f,	0x8877c4a8,	0xee6bf89f,	0xc6256203,
-0x0bb3f6bc,	0x696fa2f3,	0xf04e8efb,	0x3fd0099b,
-0x27a473cf,	0x87fe81c8,	0x35cface5,	0x8afad818,
-0xb47534e9,	0x90b406aa,	0x7d7c2d15,	0xc9caf1ad,
-0x9692ac7f,	0xa3bc5fc9,	0xfd41d0f4,	0xc47f86df,
-0x60cbdd17,	0xc1fc9bb1,	0x518ec6f8,	0x45c7e024,
-0x7db1e277,	0xd4d30cd3,	0x35bc1c5a,	0x60b61287,
-0xfcecbc8b,	0xc6cb70e9,	0xc6280061,	0x9d0ac8ce,
-0xfaf12df8,	0x9b3f092c,	0x979a43f8,	0xbbdbe0cc,
-0x6274f1d9,	0x7322b577,	0x50589a1b,	0xbd0dca66,
-0x2160d66b,	0x4ea6b9f3,	0xd942aa7a,	0x0c8e1c82,
-0xc0a07833,	0x0fdb7b24,	0x012a56a1,	0x9d2b019b,
-0xba7c66ee,	0xe6af3a73,	0x823e0207,	0xd9913462,
-0x8896001b,	0x142af0f2,	0x52539dd9,	0x864a53f0,
-0x6e85c62b,	0x66139be6,	0xadd260aa,	0x2a7a579a,
-0xd0fe929c,	0x67052a99,	0x1bcb98e0,	0x8c58f5fa,
-0xb32d4733,	0xb4e4e4c8,	0xb536ab23,	0xd00ef025,
-0x05c4cb84,	0xbbc9b7d8,	0x175d6254,	0x5d8ebdb4,
-0xe3f3e65a,	0x52177f95,	0xe85d812b,	0x87fb19ac,
-0x88b80b16,	0xc570083b,	0x124da09f,	0xc8522543,
-0x5f73aab0,	0x6c25b49f,	0xc8a03cb2,	0xd857bb2b,
-0x16378b5d,	0x242f0e79,	0x02d5d491,	0x7fc8b85f,
-0x48177825,	0xc70d4bce,	0xa23f5d56,	0xc7ebcb58,
-0xaf3b143a,	0xc33e9d65,	0xc043e61d,	0xf05a3d2a,
-0xd162c7d0,	0xdad944f7,	0x3226cdeb,	0xd0d044e3,
-0x8012c5e8,	0x18524401,	0x2a4d751d,	0x95592574,
-0x8e03592e,	0x68a72ded,	0x7d65ba50,	0xfa66bb37,
-0x81250634,	0xe92c784a,	0xb585ae7c,	0xc6e350f1,
-0x8d40d62d,	0x5b2ad4bc,	0xc87b65d1,	0x700191fb,
-0x06015556,	0xaf94c477,	0xa63b5aa1,	0x28a7ab7a,
-0x7cdb448e,	0x3819d9d0,	0xcb0dfe9b,	0x715dc992,
-0x88f5e070,	0xa1f5ecb5,	0x8c9876ad,	0x44be717b,
-0xda7487fe,	0xecc57fab,	0xfb6cd21e,	0x6de34108,
-0xa98b84ed,	0xd755144c,	0xb24c242b,	0xa29eab2d,
-0xb909c928,	0x077da28d,	0x549454df,	0x173b4e96,
-0x5353fdfd,	0xcf06a087,	0x33acdb4a,	0x166b41a1,
-0x45219876,	0x96eb46b1,	0xee5f18ad,	0x6a962b7a,
-0x9914a217,	0xca72359c,	0x28f5a8f8,	0x9d0b43ac,
-0x5fb6964f,	0x0b2685e0,	0xbda83a60,	0x464fbf9c,
-0xfd8f4ec5,	0x9d16acdf,	0x1192191f,	0x119c43e0,
-0xd0a2df66,	0x8c2cf306,	0x3da0f9f4,	0xf409a043,
-0xcfc563b0,	0xf0be102c,	0x3252b4b7,	0x07076cbb,
-0x355888f0,	0x4e4bc8d0,	0x1fd64ff5,	0x245147db,
-0x9d757b6f,	0xfbaeee9f,	0x43d68df0,	0x2709be60,
-0xd333fd6b,	0x79af3f65,	0xb52de3ea,	0x04d94eb8,
-0x43865e4f,	0xc736c027,	0xfd180b96,	0x78caa82a,
-0xd0021810,	0x9e514f99,	0x72f5067b,	0x7de6487f,
-0x6cb34382,	0x0e01763a,	0x89976ae4,	0x7a8bbfa2,
-0xa50291f9,	0x6407b33f,	0xf7ce016c,	0x2d586dd3,
-0xac0a7612,	0x32fa7be1,	0x3ee474d4,	0xc795f431,
-0xd6d0a977,	0xdc859d13,	0x446f01b1,	0xafc13014,
-0x67bad636,	0xda3c5946,	0xe169c32f,	0xfe5c93b7,
-0xac1b3104,	0x42a5c9ab,	0xc906dad0,	0xe4b213db,
-0x6fefea5a,	0x35528fb5,	0x59cadba2,	0x5cbb0ea0,
-0x2b01c14c,	0xaa438c3b,	0x6bbad300,	0x3d6d3409,
-0xcc87ec95,	0x6f167576,	0x623c3b26,	0xab438ac1,
-0x469b5486,	0xb7992347,	0x0418dd1e,	0x54e6ad5f,
-0x44bff273,	0xbc97e1d7,	0x7c5c88da,	0xf7bbb29a,
-0x48d01e8c,	0xaa4d4376,	0x9a99c998,	0x24d09e2f,
-0x24480693,	0x84b6b905,	0xd0ff443b,	0x76605be6,
-0x5c6af5bd,	0x5dd0c084,	0x4d162432,	0xed939cf2,
-0x2d333e06,	0xd2144645,	0xb06a3583,	0xc1d6e232,
-0x03883c1c,	0x6a3a1491,	0xe6b619d9,	0xfee3f413,
-0x5e59c26c,	0x28684bc1,	0xca68c55b,	0xca395734,
-0x95d8afd7,	0x8a94d5ce,	0x6d780b0d,	0x6ab50934,
-0xf5121314,	0xb9ec2632,	0x1beb9a14,	0xcd950304,
-0x6fd91394,	0x33f84e25,	0x546d4a4b,	0xc303eb86,
-0xcfb7b409,	0xf852adeb,	0x65c4960a,	0x01878815,
-0x4a6501d8,	0x5bb3a40f,	0x9414a799,	0xbbae4dea,
-0xae9d7b0e,	0x761dcb06,	0x9581c2ff,	0x06edcb74,
-0x0c06177d,	0xdc36931a,	0x751d52ea,	0x699dd531,
-0x5285df50,	0x81990800,	0xa81d52e4,	0xf305b98e,
-0x260f304c,	0xa9f5a19d,	0x702bf4d9,	0xc4e322c4,
-0x05e38fbd,	0xf6997433,	0x938443b8,	0x33fe4ff4,
-0xc0da5ba1,	0x1701d20f,	0x4f631fda,	0xd966d058,
-0x847b08a0,	0x7719b2ac,	0xea7e817e,	0x3cc266f9,
-0x39b94930,	0xd5a7c643,	0x831d614c,	0x486c87ea,
-0xeb32ec07,	0x27ccfb31,	0x3618615c,	0x01c5284f,
-0x138ba020,	0x7f316b7d,	0xf7049fff,	0x2acb57be,
-0x156b6bb0,	0x03df196b,	0x72bfb285,	0x0d1fd58d,
-0xcb86fb0c,	0x938e1a8d,	0xd387a3ab,	0x5fa1b627,
-0x2c4d3f80,	0x0b4a7121,	0xbab5d24c,	0x4e14e39c,
-0x19d839a3,	0x0b730800,	0xaabb2b8a,	0xa58aa531,
-0xa82260bc,	0x21be659d,	0x714b34d8,	0xa89d111d,
-0x02828552,	0xae10e3c9,	0xdd9ecd12,	0xe13beb47,
-0x96818a52,	0xb5fcd9b2,	0xa8d0964f,	0xfcc0e896,
-0x7ab323da,	0xb1bf60de,	0xdb70c0ac,	0x83373de9,
-0x3513e4d5,	0x0634af3e,	0xc3052a5f,	0x3acb8ac9,
-0xcf03743f,	0x15555b96,	0x929b04ff,	0xdb2a9428,
-0xdce90ae4,	0xe414e73b,	0x5b6b19ff,	0x1a708067,
-0x61329d15,	0xc4eb8336,	0x2d861d5e,	0xca108403,
-0x0e9ab2d4,	0x04d3b3c4,	0x36ef280d,	0xfea6cee9,
-0x80c30cad,	0x399d1c6d,	0x2b654d22,	0x204032fc,
-0xee60e1c1,	0xb20fd9db,	0x087a91fd,	0x6a4e368b,
-0xad3ca7e5,	0x5355a689,	0xd220e928,	0x925cb754,
-0x677991e5,	0xb3941d98,	0xa3eb379a,	0xf0237d52,
-0xe96b9e08,	0xb7ae3c7f,	0x7a84124d,	0x9cc15b58,
-0x2ddafebf,	0x93a8990b,	0x1555212e,	0x7fe44a1c,
-0x90851979,	0x62a143a7,	0x5ba95724,	0x4d8762c9,
-0xee3a6f84,	0x0af45b74,	0xcfabce5c,	0x73ff8f3e,
-0xa872ef47,	0xe97e60bb,	0x805c1800,	0x8d3b978f,
-0xaf71cdb9,	0x4d8da1ec,	0xae5f2f19,	0xe57566f8,
-0xa2003cdd,	0xe65293ce,	0x6970388a,	0x979c68dc,
-0x2fcf8d5c,	0x61a603d3,	0x92158c18,	0xd2f53c34,
-0x842dc4b1,	0x32f3df78,	0xc696ab26,	0x2be86b54,
-0xd98bca91,	0x0415fca1,	0x5afc9076,	0x796a5ef4,
-0x87a225b1,	0x6b5784b3,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  1735-m01f480c.inc  */
-0x00000001,	0x0000000c,	0x05082006,	0x00000f48,
-0x5b9afec7,	0x00000001,	0x00000001,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0x26d329c9,	0x2a31e166,	0x66c2f9e9,	0x20f1b672,
-0x8d3c77ed,	0x239833ff,	0x707d6a41,	0x3e4d0c59,
-0x5d47bea3,	0x37368a7c,	0x07ec485c,	0x021431f4,
-0x740853ab,	0x0e1e664e,	0xb37508b0,	0xa10916e3,
-0x061f9f93,	0x1fe2bbdf,	0x7f1d60ab,	0x9a7b706b,
-0x195bde13,	0xac2bcbb5,	0x2612228d,	0x2a9ee1c9,
-0xe468d9f0,	0xbb43af00,	0x8f3f1a7f,	0x712ff1b5,
-0x1212e591,	0x3b849a2d,	0xcf6d6b66,	0x6090be89,
-0xbedd5cf4,	0x741d373d,	0x1b0a5595,	0x14dcc781,
-0x39894c95,	0x64ce0417,	0x0fe0bac6,	0xd86b6406,
-0x569f7a4d,	0x0f2a7353,	0x713d3c12,	0xf5de289d,
-0x4309ec38,	0xd4093f8c,	0x9e920c0b,	0x0c7c318f,
-0xe233bedf,	0xc183eed4,	0x58f9a71b,	0x4a999e3f,
-0x793e1ed7,	0x04570728,	0x6491ebbb,	0x6d4766be,
-0x5c406a38,	0x59f9d68e,	0x2da064be,	0x2fb6525e,
-0xff5f4104,	0x7b627201,	0xc9cc0ca8,	0xbe19b83a,
-0xddcd290c,	0x2bf63b7b,	0x0169516b,	0x9104527d,
-0x18dfd2e8,	0xa1d57e4f,	0x743c1688,	0x33ce65ad,
-0xb934f7b1,	0xa6364928,	0x43e5c1a5,	0x0ebe786f,
-0x02877d68,	0x0be7ed3c,	0x9ee46654,	0x061b14b9,
-0xa9d75799,	0x3461aeb1,	0x13824d89,	0x1ea4144e,
-0x9cc9f188,	0x2e4b9cf1,	0x3dc01855,	0xe6c641a8,
-0xe2bb2feb,	0x3dbf0b40,	0xb9ad30c6,	0xc2dfee01,
-0x7b8a7f33,	0xd543428a,	0x6135b343,	0x048d4466,
-0x9c35512c,	0xfef7544b,	0x6c41c9c8,	0xd0441cdb,
-0xf46d7ab0,	0x0420c0c6,	0x92406962,	0xc827fc36,
-0xa2d92446,	0xe4b07159,	0x379e3932,	0x212d21be,
-0xf3579f1a,	0xf056d68a,	0xa2e901c8,	0x5105a222,
-0xd505865e,	0x1d09a0dc,	0x3a246045,	0x7f8eefba,
-0x707bca5d,	0x5cbe01cb,	0xfd10124a,	0x00f5a0d7,
-0xe3c0171c,	0x524fa175,	0xdb3853d5,	0xfeb3df4c,
-0x11bdefaf,	0x2ab213a9,	0x968d5e50,	0xeb0f1584,
-0x24257428,	0xf6b43949,	0x5b69a8e8,	0x146f3475,
-0x36afc131,	0xdfc35141,	0x992054a6,	0x13cfd4e7,
-0xabfe12ac,	0x0519d8cb,	0x1b40cdb2,	0x306887d1,
-0x1f8b8c5a,	0x09a1c1b6,	0x8d10622a,	0x3437e5cd,
-0x60f65684,	0x3127a82d,	0x1a7b07a8,	0xdcb853e7,
-0xe9ad88f4,	0x3ae8e45b,	0xde20b069,	0xc2dd9993,
-0x9d4d818d,	0xff289e3b,	0xcf3a6f51,	0x3048973c,
-0xd9329452,	0xe2b8f7c4,	0xb9c420ed,	0x2ce4f2e8,
-0x32d24483,	0x0b75bdd5,	0xdae9c61d,	0x192caaf6,
-0x3d70d1ee,	0x0cf75f99,	0x2a3ab102,	0x0d3e68db,
-0x2f1ddeab,	0x2dc88c1b,	0xa8ab7528,	0xe443fd87,
-0x6116afaf,	0x33247d35,	0x4282e07c,	0xcb56f01e,
-0xf474f2ba,	0xc2795388,	0x56708a34,	0x1ebb090e,
-0x1fe0267a,	0xc44dd6bd,	0x5567c1f0,	0x1a1bde80,
-0x815164b4,	0x28a703eb,	0xa7ea0d67,	0x059d987a,
-0xff0bd083,	0x2000f293,	0xf0fc10cd,	0x2297d629,
-0x8f66ca3c,	0x2b5c9fa7,	0x8f548249,	0xd2f1f177,
-0xb01b3a1c,	0x18790f23,	0x948bce5e,	0xe809fe28,
-0x77c1333f,	0xe465a83c,	0x7e833fff,	0x0279feb7,
-0xb0ad01a6,	0xd1b7acf5,	0x8207232f,	0x6abab29c,
-0x65423460,	0x05e6d63a,	0xb6bb2cbe,	0x7a980894,
-0xd105ef23,	0x733aa9a2,	0xe49afa4f,	0x030cf958,
-0xd6923461,	0x6f5189ec,	0x3ab12460,	0xdc667d63,
-0xb15adba4,	0x29c6b05c,	0x75c8a9db,	0xd42d58d3,
-0x660ed0a6,	0xc3b45804,	0x7a62b809,	0x2ddb74b6,
-0xc907dc4a,	0xd221dfb4,	0x8c3b5f72,	0x00d214e0,
-0x8e454034,	0x1fe6b683,	0xfbb425a0,	0x1ff24e08,
-0x31fdc388,	0x090e492b,	0xbe7a1211,	0x1bdcc839,
-0x6f1289b1,	0x37552a7a,	0xe9fe3c7e,	0xc59c4a56,
-0x2e9e8cb2,	0x3dbe475d,	0x38b2009b,	0xf68b548f,
-0x650360b6,	0xe279109f,	0x08f585c0,	0x13137c4f,
-0x9dbb8035,	0xe0559d22,	0x27ba1ef2,	0x7115bcbc,
-0xeab32d06,	0x3ba5a83b,	0xf4b26c6f,	0x4af2299b,
-0x53ff1a47,	0x7bea180f,	0x9a1f17c5,	0x3e73bb67,
-0x1de5a33a,	0x4f8236d4,	0xcc0375a3,	0x9308a031,
-0x729b2a82,	0x3b6e7bc3,	0x29622d7c,	0xa12e5e81,
-0x5ed9b4db,	0xa252bc45,	0x36b4cfc6,	0x0785005a,
-0x153c81ea,	0x97f9ff5e,	0xa1f2ddfe,	0x005a5f2a,
-0x8d7f98d4,	0x008fda90,	0xe98725da,	0x351c9240,
-0xebc7d996,	0x3ab05185,	0x7a1670ea,	0x21f7d7d4,
-0xbd2ff954,	0x21885949,	0x6740e0d1,	0xde024a2e,
-0xf1eaaa3b,	0x016d3215,	0xd03643c5,	0xdc3d4493,
-0xf3aa90cd,	0xf9e0f628,	0xb1a08f8a,	0x10b128d4,
-0xa47437de,	0xfb9d9cdf,	0x03db607d,	0x5c01ee58,
-0x1b653dba,	0x161e084a,	0xb3bc1b7f,	0x5f465cf6,
-0xc7a4de33,	0x4b4a5fe0,	0x993d4a03,	0x1f6f7caa,
-0x7254c72b,	0x4a8273b8,	0x13451fa8,	0xbeb71239,
-0x4aead099,	0x20cca393,	0x9c20f5fc,	0xb0e800e1,
-0x42f6eebf,	0x9dd9f9ad,	0x2fcd338a,	0x1c8f542f,
-0x2a70cec8,	0xa8323157,	0xdd4f014b,	0x4811806a,
-0xe29ee9d1,	0x10fd4851,	0xa1856fe7,	0x74c54af3,
-0x0b1f4fc1,	0x62e0bfbc,	0x2a34ac31,	0x37ceeba7,
-0x0bc88ba4,	0x6a0da39c,	0xb8f20401,	0xda103375,
-0x5ad37148,	0x3d48670f,	0x10dd360a,	0xc430ca3b,
-0xb5d84eb5,	0xdff3efed,	0x0d366e3f,	0x0fcc7479,
-0x144ea51c,	0xd1c15a95,	0xf33083e6,	0x47de9a48,
-0x36b1735d,	0x1fc429af,	0x06063db1,	0x52502b06,
-0x4dce576f,	0x55935a74,	0x05bb9df1,	0x35672ace,
-0x54672062,	0x6fc72283,	0x11bb39b2,	0xba7a8765,
-0x8adcfb49,	0x1e77de0a,	0x23121a6e,	0x9622be4a,
-0x645e970f,	0x8c338693,	0xc7d4d53d,	0x0fbbf9e3,
-0x012c640f,	0x942e04e6,	0x7b954afc,	0x03fe7cc1,
-0x41bf63d5,	0x2cb4e87b,	0x9b22a6c2,	0x268b8300,
-0x4a60d8eb,	0x1d85d604,	0x542a63a3,	0x176dbbc7,
-0xaf4a47ff,	0x3f413e8e,	0x4a6e58fa,	0xfb53830d,
-0x013882df,	0x0cb45d80,	0x7d8251c3,	0xd015f916,
-0x97a2c17e,	0xe72bc8dd,	0x6dd76e80,	0x3d567dc7,
-0xf34ada7c,	0xef2d13a3,	0x7f43c2fb,	0x5ebfa522,
-0xedff273a,	0x0f9661ca,	0x8620d029,	0x7e753aee,
-0xd084fe4d,	0x788bf5f0,	0x486306b5,	0x3f7f7267,
-0xf1379628,	0x7e582e54,	0x7129c293,	0x8a2e2c72,
-0xfccaad76,	0x296e76a4,	0x86c00f66,	0xa07d9b46,
-0x3d86ea2d,	0xa08b7461,	0xad433700,	0x15c5d238,
-0x47589fa7,	0x87cc4eeb,	0x95a5592c,	0x30963e85,
-0x24718ecb,	0x02788155,	0xb0450b0b,	0x1bea2d69,
-0x8bfb61b0,	0x2cbd4982,	0xb4e202e8,	0x0b210f6a,
-0x1f5f8a14,	0x34764f12,	0x867e7ae5,	0xd849c20a,
-0xae17e666,	0x230ffd00,	0x530835f9,	0xcf165d20,
-0x4c8de748,	0xe70efe14,	0x57defefc,	0x0a89c95d,
-0x2d652e79,	0xf6693116,	0x22fbb58f,	0x27f9276c,
-0x420b3b12,	0x0dd2a030,	0xcade871e,	0x2de4379b,
-0x0dd79b21,	0x237405c8,	0xcf569f57,	0x1089c7f7,
-0x0b7a0f86,	0x35a38012,	0x14336c03,	0x9abb16fc,
-0xa2bae61b,	0x011259a5,	0x06255f6e,	0x89146af4,
-0x57177372,	0x99f5bdca,	0x3756e46c,	0x208c3294,
-0xd57654ee,	0x936046e1,	0x703d3f59,	0xbb4d8e7e,
-0x19322623,	0x3e939f15,	0x130c9156,	0xbe3ba4b3,
-0x4fea9380,	0xbf169ed9,	0x977e90e1,	0x0e5a602b,
-0x8854d38d,	0xb809f172,	0x4c0e3de4,	0x4c553817,
-0x85b25de2,	0x0bf1bd3a,	0xb8b1e414,	0x573925d0,
-0x155f0b56,	0x7d3e8581,	0xa3109199,	0x14a3e01d,
-0x326c8cb8,	0x6aca28f5,	0xd242ac23,	0xd776334f,
-0xf1e8093d,	0x3755e677,	0x03b1091c,	0xc8f8294f,
-0x813570ee,	0xdc565678,	0x0e3f1356,	0x2840bbe8,
-0x532d033e,	0xe4a47224,	0x51281b88,	0x57e43e10,
-0xf84157ec,	0x39586b89,	0xbfd62b1c,	0x5dac030b,
-0xd5656981,	0x64fa0e98,	0xbceebbc8,	0x1803f2aa,
-0x5a121ca0,	0x40167138,	0xb90acc0a,	0xc35a9707,
-0xf9d848a3,	0x20ddfd6b,	0x0228d345,	0xdb0fdc3a,
-0xb61a8dc4,	0xc3b9327b,	0x059ab851,	0x0bb9a025,
-0x6d3ef669,	0xf50fbfeb,	0xc1bb3994,	0x8292cf89,
-0x3e3759be,	0x1073081a,	0x4f8921eb,	0xa46ff9b8,
-0x968d5993,	0xae888650,	0xaa61d0ea,	0x337deff7,
-0xe1821ca2,	0x8c80546d,	0x0d1ed478,	0x76b7aed8,
-0xcea89eb0,	0x09d3f378,	0x97c96536,	0x64b48cf4,
-0xc2ec8718,	0x65fa7e73,	0xdc925cf1,	0x01b8467f,
-0xea923bb9,	0x7ce164bc,	0xe1a337df,	0x9f59fd44,
-0x1ab74283,	0x10ad4e3d,	0x05e77e77,	0x961b3cdd,
-0xc980d676,	0x9df98056,	0x72f10fc9,	0x23d418db,
-0x35dc8c9d,	0xa57d8025,	0xfcd53d46,	0x022b7914,
-0x9908dd5a,	0x2b2f00dc,	0x400f20e0,	0x04263507,
-0x8538056b,	0x39498c7e,	0xbf7bd527,	0x18a632a7,
-0x75556a46,	0x1f4f6ff1,	0x7d2b11df,	0xe39303d5,
-0x5dce0fb3,	0x34d1a951,	0xa70757ef,	0xf791d144,
-0x8955e59d,	0xf7cbd790,	0x6e4e638a,	0x24304133,
-0xf691ceb1,	0xd8c6b687,	0x40ebd347,	0x68f3bd1c,
-0x94dd90d0,	0x3d00c8ff,	0x62eee056,	0x5218066f,
-0x15381e95,	0x655c1766,	0x3435acaa,	0x0b600634,
-0xe3596a35,	0x5584d1fe,	0x6807aa2b,	0xd4d9fde7,
-0x719b309c,	0x24c658b4,	0x5af9bc14,	0xc805d68d,
-0x8a80494c,	0xdaf4c624,	0x77abf58f,	0x363931e8,
-0x56cb9c63,	0xc6b111fd,	0x06f44fb4,	0x1d1a309f,
-0x9379fd1a,	0x15c5881f,	0x2c585ee6,	0x143b8e4f,
-0x9a041aed,	0x1e6ea9b2,	0x9db0dedd,	0x094cb86d,
-0x705b5c51,	0x293e4cea,	0xfca2567f,	0xe72104dd,
-0x379974d2,	0x0b966e93,	0x9edfa253,	0xccb8d8d5,
-0x89c4aabd,	0xec3fc740,	0xb558b061,	0x1ef4c43c,
-0xa4c0a068,	0xfa1a4c45,	0x88cc3639,	0xca0dcb62,
-0x1135a02b,	0x12996aa4,	0x4a95ee56,	0xc2124ef6,
-0xec2f887f,	0xec365501,	0x3b13bae7,	0x32fb1069,
-0x23fb5000,	0xdb047f70,	0x1f6b72b7,	0x484c331a,
-0x1b52bba2,	0x3468046b,	0xbdcd005a,	0x5dce1386,
-0x62cba2fd,	0x7d058cd9,	0x6cd00bd0,	0x032a1fcf,
-0xde6d05fd,	0x50729978,	0xbf94d156,	0xde54e24e,
-0xe4f44caa,	0x2fcd84c4,	0x34e2d48b,	0xe89f3a2f,
-0xe1ef6ac2,	0xe2ddb72c,	0xbf0a7360,	0x0ff92181,
-0x1dae30ef,	0xce13c949,	0xa6a47e72,	0xb3c94f45,
-0x3c763829,	0x1abdc257,	0xd17fcdc2,	0xb7424765,
-0xf7a5f541,	0x97061a67,	0x370849e2,	0x019a0284,
-0x30f0d0ca,	0x94ee0ea1,	0xcb25cc50,	0x78d3ede6,
-0x821a9f30,	0x034c5444,	0xe84cb902,	0x1d010bec,
-0x83b3a984,	0xdf19de18,	0x33c92c5d,	0xee64a937,
-0xe4629381,	0x2567d2ac,	0x99b3f403,	0x5ce0f594,
-0x15c70152,	0x9e3aa859,	0xf24186a2,	0xbfbf96cb,
-0xaa23ff50,	0x7e4c6845,	0xa6af9a2b,	0x06987623,
-0xc4242a47,	0x74598d03,	0x5b14ca3d,	0xd37d1846,
-0x28911f3e,	0xd0432281,	0xcf43549c,	0xf2a2479a,
-0x29aa5cff,	0xa32c596e,	0x12c61119,	0x75055eda,
-0x8bfdb594,	0x1b32dde0,	0x041ebdea,	0x0c9f43b5,
-0x692789e1,	0x06b14551,	0xae1bcdc0,	0x01ccd8ed,
-0x2669ee97,	0xa006c95a,	0x343da055,	0x6db53327,
-0x69dd21b1,	0x9a056e86,	0x3bc8035b,	0xdf4890c3,
-0x772b96c5,	0xbe21b193,	0x0bc89355,	0x825ade87,
-0x24b1e95c,	0xf63e33f4,	0x5bc8933f,	0x8346f42f,
-0x2b1aa1b3,	0x9662f4f3,	0x9d61d442,	0x499f314f,
-0x6a801dee,	0x91c70d52,	0xd207bec1,	0xd79961a8,
-0x1a0489dd,	0xb0fae274,	0x4aae84f8,	0xdc465d50,
-/*  3101-M04106CA107.inc  */
-0x00000001,	0x00000107,	0x08252009,	0x000106ca,
-0x7deb58b2,	0x00000001,	0x00000004,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000107,
-0x00000010,	0x000500b0,	0x20090820,	0x00000401,
-0x00000001,	0x000106ca,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x2beaa92c,	0xfc3395b7,	0x10be81a0,	0xb318e067,
-0x723923f0,	0xb297dc63,	0x7d52bc4b,	0xc6ef362f,
-0x0882023d,	0x953684cb,	0x0abe06ee,	0xa7ef1798,
-0x160d6cb8,	0x930cf745,	0xafc3fd79,	0xa70df3d5,
-0xb0620f46,	0x70048a23,	0xbf95ecf0,	0x76c1b997,
-0x5128616d,	0xb6b4b969,	0xcc69f71d,	0xdf7416e1,
-0xdf9a571b,	0x50c0bcc8,	0x85e2b3cd,	0xc1927532,
-0x7a04b6be,	0xe56b7f97,	0x524085c4,	0x668bf327,
-0xb3eaa54c,	0xccde06f8,	0x09b4e42b,	0x033b0a46,
-0x0f6e2fde,	0xb308ce53,	0x93eff03e,	0x8830014e,
-0x5c8a6f22,	0x91d2f757,	0xf70b648d,	0x0789998a,
-0xd84d4640,	0xe5f34e80,	0xf3357e64,	0xd1e2beea,
-0xc7e95c3a,	0x30e57e4d,	0xec214356,	0x7e10859e,
-0x1d5895d5,	0xdeeff6cb,	0xed1030ed,	0x827e603d,
-0x6b4b2de3,	0x83ec6fd0,	0xa64092f3,	0x8d9887e4,
-0xbefcbedd,	0x2111afef,	0xcb9abf96,	0x5c79ceac,
-0x9bf8a57f,	0x5d0e44be,	0xdca3d3b6,	0x9072d1ca,
-0x48e73a50,	0x8d0bc804,	0x6aea94d3,	0xc372403e,
-0x00000011,	0x3b994153,	0x23faa5e1,	0xc3feae68,
-0x76d5e67d,	0xbd696479,	0x138a05ef,	0xf2b5de22,
-0x4ccba0ed,	0x333cc95c,	0x8d98a2ae,	0x0bf1fa24,
-0x239f1fbf,	0x44701d3b,	0xb176783f,	0x20eff2cc,
-0x0cf93bf9,	0x4e6ace41,	0xe346d231,	0x11d560af,
-0xae8874a2,	0xe344fa92,	0x0056d268,	0xd8068d91,
-0xf336cf97,	0x45c54f6d,	0xc0650992,	0xa3f86cb2,
-0xc73d3aac,	0xc7654f1f,	0x385777ad,	0x20928850,
-0x47509cab,	0xf40f9ba6,	0x34efbe6c,	0x1fe3b873,
-0xfb39bd58,	0xa50b6367,	0x66c20e63,	0x49a4e1ee,
-0xe490ed5a,	0x98c340fa,	0x30bfe19d,	0x4c17d142,
-0xea54c4e2,	0x8c00e086,	0x219dee1b,	0x739a2fc1,
-0x1e07b80f,	0xea6f4799,	0xb4684fc2,	0x42fc725a,
-0x1d3c7413,	0x188b6f3c,	0x2c0e440f,	0xc6ad011d,
-0x2048625b,	0x3be9d940,	0x0a932622,	0x1fafce30,
-0x1cfa4c90,	0xd0e9f989,	0x31c0c399,	0xad0c597d,
-0x48a94bb5,	0x109da683,	0xcdc197aa,	0x7bf7ef14,
-0xebf3afa0,	0xde4ff7d3,	0x02a79e3f,	0x4d77f0e5,
-0xd0c1fd98,	0xdb342a5b,	0x7f753eca,	0xb710c135,
-0xacb3b9c0,	0x5e89ece7,	0x2ca4fe84,	0x4f22e461,
-0xa6a633fb,	0x508fb453,	0xfe1f342d,	0x79bcff1f,
-0x0c776771,	0xd6c5db47,	0xfe4d8cc5,	0x68b9f655,
-0x447b7366,	0xddde31ad,	0x8e3496df,	0xe091f8dd,
-0x78eb0fe2,	0x9e08c72d,	0x6909c46b,	0x92ca6b4a,
-0xfb7a0efb,	0x55f65148,	0x9fcc90e1,	0x254f5f40,
-0x0690dcd5,	0xc6a67013,	0xda2e35a9,	0x9171cb50,
-0xe477a087,	0xc0f89e14,	0xc1221ebf,	0xf032e99f,
-0xc8883a7e,	0xba4b17c9,	0xb0ef0962,	0x6ea751f6,
-0xfc8c336c,	0xd1966bf1,	0x26d57e1d,	0x952e847d,
-0xccdaf0c9,	0xd0aaee65,	0xb2f22a59,	0xc74bc035,
-0x900ef42a,	0xeb1e7bfe,	0xfc465b3a,	0x0cd002ce,
-0x560f5d4b,	0xecbc2658,	0x9f38856a,	0xa3f77ba1,
-0x3ee18273,	0x7ab97b2c,	0x0f5843cc,	0xdb648b0a,
-0x8e450381,	0x80176891,	0x05e3e6d2,	0x36593afe,
-0xebe78fce,	0x53d7f64c,	0x2dde1104,	0x293cd7e2,
-0x4f430fa6,	0xf3a8cdb0,	0xd28f6535,	0x9159d53b,
-0xac66a916,	0x8f77be38,	0xa16b9dad,	0x1a4699d0,
-0xe278df12,	0x2c336789,	0xb668fe15,	0x099fa98c,
-0x4fe5ef10,	0xf4692cda,	0xb86d4040,	0xb6dce0eb,
-0x6c5ef896,	0xdef35c52,	0xc02a04a4,	0xed99c619,
-0xd91721b2,	0xa2fac92a,	0x5ab9c724,	0x0ee25329,
-0xc2029fce,	0xc847bfbd,	0x3b97ddcb,	0x4aaaa55a,
-0xa16e313a,	0x06e4b6cc,	0xc0e56598,	0x60ebfadb,
-0x88841f3a,	0x7c6b65ef,	0x15542ce1,	0x70b88b78,
-0x382d1155,	0xe73c900c,	0xd8b6409e,	0xf1cc5406,
-0x64fc3223,	0x43cb616c,	0x17e3a1ac,	0xa9aba529,
-0x8dd83b32,	0xb625cd1d,	0xbcb4b0ed,	0x685cc4b2,
-0x803e35f8,	0x4e679481,	0xc7dd7591,	0xf8676b62,
-0xac25b6c8,	0xb0211931,	0x5c5df337,	0x3bde6fb6,
-0xbc433992,	0xf7315d49,	0x028e112f,	0xe3d59076,
-0x7757e95b,	0xe5c5a193,	0x59b243a0,	0x341f33d2,
-0x7c0d591d,	0x5f96d138,	0x5116c490,	0x747caf2f,
-0x6da223f1,	0xcbe30d11,	0xe10b6b28,	0xa09328e1,
-0xdf1b94ee,	0x163b48b9,	0x72e7a36a,	0x78eda572,
-0x393f0ad2,	0xf85561ea,	0x6e7ca7c8,	0x352cb3b4,
-0xb75bf9f3,	0x97ebcf76,	0x932b8b91,	0x937f1fab,
-0x6ef1e868,	0xce84fc3a,	0x9dd09a21,	0xa8f3be36,
-0x244834e9,	0xd871f223,	0xdef842f3,	0x787eaf73,
-0xf2326bca,	0xd2c3ae20,	0x48dc7621,	0x91419afe,
-0x23a44b12,	0xce0443d7,	0x4a6f1d9f,	0x1ea8cf7a,
-0xb6b7694d,	0xf29e3e25,	0x51665303,	0x33581b86,
-0xc762d72f,	0xaa658158,	0xcddb7354,	0xdacfd75f,
-0x9ec31b1c,	0xf8aa3154,	0xfdeeb2e0,	0x9cb52f84,
-0x16ce9fa4,	0x25050178,	0x2ef25d50,	0xcf4b4d41,
-0xf27d5684,	0x7bae3f36,	0x05b50e59,	0x91d23add,
-0xdbdee4ac,	0xe16994b5,	0x0a5481c3,	0x3deb8a17,
-0xb8844d77,	0xcbce6140,	0xbd748572,	0x6531627f,
-0x2137be68,	0xf46f8aa9,	0x6d2526a0,	0xe72aa307,
-0xb361a2c8,	0xed9c2987,	0x75ddeb95,	0x637d3cad,
-0x2c4dfd37,	0x01f0e2bd,	0xa521a1a4,	0x1194ab8a,
-0x96d7b9c2,	0x94cee6e5,	0x454cc836,	0xa5c0fac3,
-0xf6e9fe9b,	0x3107c251,	0x14c8c6a6,	0xd727c1e1,
-0x339f2742,	0xb0a033de,	0x56fc9280,	0x36a907cd,
-0xb74acdde,	0xe8122571,	0xd0116007,	0x238b3d4f,
-0x34532ebe,	0x1c534370,	0xd1eb258d,	0x354b2289,
-0x6007a18c,	0x58dcee7f,	0xa033ee94,	0xa5e1145f,
-0xe345c315,	0x58510592,	0x33d9db2b,	0x7ea86edf,
-0xce60a8ad,	0x2d9a8919,	0xb5e2840e,	0x020e6e15,
-0xaff8660e,	0x402c12da,	0xfaea95a5,	0x6ffb0748,
-0xc4c730a4,	0x1f57ead7,	0x2cc6d295,	0x0ef4bdb6,
-0x01a7368a,	0x52e88f43,	0xf1b14c65,	0x38018686,
-0x0c70ee45,	0x271b1fe2,	0x0eea950e,	0x61a6f56a,
-0x842497a5,	0xfbcf0f4a,	0x35132cbb,	0x4f2eb1ce,
-0x24fb1bc7,	0x343ec960,	0xda94e0a2,	0xf1206e0b,
-0x80bf8007,	0x7e09d8d8,	0xba6bc1ff,	0x892c956c,
-0x4ceaa5e8,	0x871f3358,	0xe802a1a4,	0x7fa29ced,
-0xea8616cb,	0xc1999088,	0xc5baf089,	0xd1490754,
-0x091f6f21,	0x9a3e3c4f,	0x1eb11650,	0x13fd05fc,
-0x5e9d5b0e,	0xd1485d34,	0x474feaae,	0xc211a60f,
-0xa609643e,	0x07052bb2,	0xa7bfb285,	0x30bbc170,
-0x9ebe8d27,	0x5207a9ee,	0xfc12bd0e,	0x7fa428af,
-0x2d1c8a2d,	0x6f15c0d6,	0xdaf0ee75,	0xd32bb1d1,
-0x694463f5,	0xa1ebdae4,	0xeaa3d0b2,	0x954077de,
-0x181da0bb,	0x4556808d,	0x46e80a64,	0x0c017172,
-0xd8ef8702,	0xa0e6d100,	0x90b0a9f0,	0x4a13a407,
-0xf1675dde,	0x5110d8c8,	0x1c028526,	0x7774581f,
-0x9d3d8c23,	0xcaf8b632,	0xf401a52f,	0xa5d14a5c,
-0xebed6c1b,	0x2ec618ad,	0x5b63935e,	0x89508732,
-0x43a48b2e,	0x87535b2b,	0x0ffb28c2,	0x1fd1becd,
-0xd2b2a18d,	0x45dccb4c,	0xad41a54b,	0x7ffa2fed,
-0xddd18aa1,	0x1db06a98,	0x860d6b58,	0x2997109e,
-0x80a2300e,	0x0cc52e7a,	0x15b24c31,	0x8f717016,
-0xa425cac3,	0x8153e1bf,	0x5e91fd89,	0x04b17f35,
-0x150fd30c,	0xc7309d31,	0x63dce1b0,	0x162eb854,
-0x8093904e,	0xf7b4399d,	0xb23fa735,	0x67509c6c,
-0x5380dec9,	0xb79172a8,	0xb6c249d1,	0xcd040b42,
-0x4efe12f8,	0x63ce3363,	0x406d1666,	0xf8e9bc95,
-0x99cbff2c,	0xaf0cac38,	0xe6556ddf,	0x9bb2a399,
-0x43387c9e,	0x4951f5ac,	0xfa4ddb69,	0x562ec852,
-0xa2e3e441,	0x32a80b75,	0xd88361c5,	0xf04b7ac9,
-0xb0ea18bb,	0xf5035c94,	0x520c9c12,	0xb4c7e15c,
-0x6f72c4bc,	0x80f2112a,	0x4e4bbb87,	0x7bb5ee1f,
-0x54eb313e,	0x18cb6cb9,	0xca5ff580,	0x2538d798,
-0x2b813681,	0x58c11a6c,	0x68ae4070,	0x40799341,
-0xa740f86a,	0x722ca7ef,	0x815c71c7,	0xe663c6f7,
-0x5e249b96,	0xe97e3b71,	0xb7ee5a12,	0xd5f065bd,
-0xaa642191,	0x9864e095,	0x0c087780,	0x0fc0d969,
-0xf6b82791,	0x04aa55f8,	0x872c7cd1,	0x43bc93b0,
-0x12fe4c05,	0x16f15229,	0x06161603,	0x6e76239d,
-0x90ea9c62,	0xecf642df,	0xb52a8db6,	0x2e0c5d58,
-0x10f09bbc,	0x1bb1b2a3,	0x7132167b,	0x291d5f16,
-0xd7814a9e,	0x79e52dbf,	0xef6b61e8,	0x585b920a,
-0x18ea4e61,	0x72ce62fc,	0x59ed8e9f,	0x610564d3,
-0x40f4f145,	0x0a2f60c1,	0xec64ebc3,	0x8ad5b251,
-0xb471e120,	0xb899cffd,	0x2b81118a,	0xa3b591a8,
-0xdeced3ab,	0xcb9aacb8,	0xba53fbdd,	0x6e49e298,
-0x75fa6c19,	0xd11cfe98,	0xd29ce7fc,	0x7471df09,
-0xb59b2474,	0xdff0b07d,	0xae92c4b7,	0x6414ee6b,
-0x6acba1a5,	0xed9c0b5b,	0x728f7644,	0xf6d20c7a,
-0xf03ad03e,	0x6612b0c3,	0xe156c417,	0x9aec4a8d,
-0x02be86ff,	0xe11d1660,	0xefeba14a,	0x7d275f33,
-0x16acabb2,	0x7ac99cd7,	0xd18566e4,	0x3bce4ca1,
-0xb0312f16,	0x5700f72c,	0x345864bd,	0x917a4db2,
-0xaa22b7f0,	0xc66eb69c,	0x62f8a99e,	0x6364a44f,
-0x956d2cd2,	0xfa64b7df,	0x47238b18,	0xddebaeff,
-0x39c9d16b,	0xaa1487cb,	0xc6f91d13,	0x8191316d,
-0xbf5d7ddd,	0xc907cbb1,	0x7a283ba3,	0x0365e6a3,
-0x2fbb3185,	0x159d0436,	0xb55b6990,	0xf0935005,
-0x441e4fc8,	0xd1dfdc91,	0xdd9ff8bc,	0x95c88203,
-0xa8029310,	0x62501ff4,	0xf838a813,	0xfb66d5ce,
-0xe6bb8354,	0xe2afb832,	0x55dcf796,	0x315f28cf,
-0x400de577,	0x3ad89b1b,	0xeee943aa,	0xbd5d9001,
-0x8dd4771b,	0x21ad481c,	0x504d6222,	0xfc0e6728,
-0x7abe5d62,	0x332f8309,	0x50d8c688,	0x4b686808,
-0xbe6395ec,	0x5153b67c,	0x04144a35,	0xa85077ca,
-0xa3775cda,	0x838556dc,	0x973c2222,	0xf5037c9f,
-0xd02b0c87,	0xa3e69f8f,	0xdf68cce7,	0x9490d31f,
-0x3d9c5cf2,	0x939e7823,	0xc51b9a2d,	0x2e802e27,
-0x65079a36,	0x3b6e3d79,	0x5fafbac6,	0x9973bc64,
-0xfc4e7124,	0x56e1fad3,	0x10ec049f,	0xefa79c0b,
-0xcde48353,	0x3fa7f449,	0x07cb1a31,	0xf6ba0053,
-0xe5af7b10,	0x9e2dc089,	0x290f3fa4,	0x116da472,
-0x7a006f5b,	0x727205bf,	0x7c59870d,	0x968c6000,
-0x3ed4fd57,	0xe423effe,	0xc352ef7a,	0xd23d00e5,
-0xbded3a50,	0xedcdc3d0,	0x3a517a74,	0xbdfc58cc,
-0x24b2371f,	0xf967f533,	0x26069547,	0x2114e85e,
-0xa1953f56,	0xf0c52ebf,	0x235320ae,	0x35600f33,
-0x5c1ca2b7,	0xe89db0da,	0x08ce35aa,	0xc66cef79,
-0xacd41ce4,	0x865f4c69,	0x15a3376b,	0xdee5d7a1,
-0x6fdd6362,	0xa4125977,	0xcb61bae2,	0x5e3da819,
-0xc6d2e56a,	0xde1807f2,	0xb30c3473,	0x1c4038c5,
-0xbf8afac6,	0x37423d2d,	0x72d9da33,	0x39e95bf5,
-0xd6a91cc8,	0xbbf4c2d8,	0x7c9d4b21,	0x13c514d5,
-0xcae41aac,	0x07b97f18,	0x0cdfbdee,	0xe7a9020b,
-0x1839f082,	0x7c414530,	0x43ba1070,	0x95945971,
-0x82e31721,	0x2fb159e5,	0x225c2158,	0xfadf74f6,
-0x788387d6,	0xb40c98fe,	0x0c75ba9d,	0x0487eb2f,
-0x7e9a1b0e,	0x5c442185,	0xcf1dffde,	0x39f9bc44,
-0x46b961d3,	0x9a14b19a,	0xe284d2ac,	0x52151caa,
-0x67f34f5e,	0xf4042d4f,	0xa28a223d,	0x3deb23f1,
-0x12d14b6f,	0x18901f31,	0xb3c7950a,	0xfb7d3557,
-0xb83e457f,	0xb6e13f07,	0xd26f5435,	0x83f05e15,
-0xf549a030,	0x6d1122d0,	0x540b3ef9,	0x8ecdac22,
-0xdabe1b2d,	0xf4913cc0,	0x579f9d77,	0xd4725d33,
-0x76b7abb0,	0x03452691,	0x4d52fff6,	0x12e95a96,
-0x42131074,	0xbb3eaa95,	0xb775618e,	0x6325764e,
-0xeb847c5a,	0xeb7b9c6d,	0xd01dd328,	0x547269e1,
-0x2cebecd3,	0xcbb0ed0f,	0xcc87e62c,	0x8e6b0ce0,
-0x8a8f9f06,	0x689e0c4f,	0xb3a1fe5a,	0xed84a0a2,
-0x66187741,	0x62a4475b,	0x5c4c31bb,	0xea000d76,
-0x8676c757,	0xd59cc6bd,	0x52f107ff,	0x1f4a0c66,
-0x7af566ef,	0x4af3586c,	0x11d5cd6f,	0x6b8bc81a,
-0x480eed48,	0x2ec7c65e,	0x6c0f3253,	0x100f2794,
-0x18d6c62a,	0x338f59f6,	0x8e6e2f9e,	0x75fccfd7,
-0xbc80ea7a,	0xa90f1473,	0xfa9d22c4,	0x3ccdaa53,
-0xe568fef6,	0x6a761fd4,	0x61c26b23,	0xabc31163,
-0x3b840e9e,	0xee864319,	0x84f93208,	0x743a780e,
-0x1507a3bf,	0x147dad13,	0x8952177f,	0xbeb40da7,
-0x699af39e,	0x6d22bdfb,	0x5fe8112c,	0xdb3f8dbb,
-0x026f8ff2,	0x6bf9658d,	0x9faabf0d,	0x6a2f3989,
-0x5be4a617,	0x9e55f0c3,	0x70510d75,	0x0fd92413,
-0x63d1d3c7,	0x68cf84bd,	0xbbff5901,	0xb0434b77,
-0x8564b88f,	0x06eddac5,	0xde2a66b6,	0xc1835355,
-0x5566bb1e,	0xbaa890cd,	0x108c6f70,	0x7e80dfcc,
-0xb8c03bb3,	0x14bdcbe0,	0x5037daf9,	0xee02697a,
-0x3326280f,	0x4f04c814,	0x4f640444,	0xbfa9229e,
-0x131c7ba0,	0x5fbcf1ba,	0xebe01998,	0x2a813a9b,
-0x3f27c028,	0xf77a6d00,	0xac0ddee5,	0x1b6e52d9,
-0xdac4bb99,	0x54a32f86,	0x26bfd80f,	0xf5debd9c,
-0x06536e13,	0x9498a87e,	0x3f9e8812,	0x53e0fdee,
-0xc08c3c8a,	0x2148b33c,	0x3932e37b,	0xad084cc7,
-0xe77a0048,	0x89addf10,	0xb2542186,	0xc4c0be6c,
-0xfbc626ce,	0x20a28446,	0x0f29f8f1,	0xbbef5d50,
-0x288b8070,	0x31aa2900,	0x4a538fbe,	0xcd344ca3,
-0x05170c9d,	0x06c51082,	0xc414194a,	0x6689a2cb,
-0x7618c884,	0x412ac324,	0xb0d952d0,	0xfb88757c,
-0xaacbb987,	0x92218ac5,	0x032a3895,	0x2e3a7dfd,
-0x4bb37e4e,	0x52342695,	0xa699f5b9,	0x45748066,
-0x7822f59e,	0x68a55092,	0xf049444b,	0xf274d694,
-0x0524ed76,	0x884c3732,	0x22fa43bb,	0x3b97d921,
-0x210b8c99,	0xc4ffdf26,	0x17ba16ed,	0xfcdfc437,
-0x0b8e2d8a,	0x7b019bb2,	0xd525e662,	0x03346249,
-0x7af3c1cd,	0xbf42dbac,	0xb6197a31,	0xebff8e32,
-0x84f9980c,	0xa225a4b0,	0xa9f3d94d,	0x8a3da052,
-0xc17241e7,	0xf133ce7f,	0x4d4542f0,	0xd884f2f8,
-0xa1633ebe,	0xd5c5e6e5,	0x7fce2fca,	0x8ad84a55,
-0xfdd96c9f,	0xa60d6f4f,	0xe025d2f2,	0x8be1b787,
-0x87a036a7,	0x23819cb9,	0x5967650e,	0x5d549108,
-0x57167175,	0x2f94c450,	0xbb536b04,	0xfb381d15,
-0x405bd359,	0x3ef9491b,	0xa9834cb1,	0x2cc5151c,
-0x148cd3cd,	0x0565ecb0,	0x8e596741,	0xf6d7f089,
-0x9e3524fe,	0xf4224e20,	0x583302fa,	0xebe46409,
-0x7bfe793a,	0x7d511902,	0x1e4a80dd,	0x53a280cb,
-0xa2d81d96,	0xe29b8f4e,	0x877789e5,	0x838ee539,
-0x35f9feb5,	0xa5bb1d43,	0xb24d7510,	0x67cd14d7,
-0x7cfac97e,	0xf6c72b9b,	0x302f9115,	0x1932060c,
-0x0a786f90,	0x85a88dd1,	0x322ef274,	0xb0f8af47,
-0xbb5e6bfb,	0x3f1505c5,	0x33b28086,	0x18025326,
-0x73293fb1,	0xbd813762,	0xad751414,	0xd533bccc,
-0x393b81fe,	0x5b3b79e3,	0x2221dc65,	0x4bf8124d,
-0x26df557e,	0xcb9320a3,	0x9e6e762f,	0x2a800bbf,
-0xbd30558c,	0xc6b2ebe7,	0x204b2c78,	0x3e55767c,
-0xe8dca1c3,	0x74f53ec2,	0x6cf84866,	0xa81afd41,
-0x96b192bd,	0x8a4cb44b,	0x7761db77,	0x0ba97dc7,
-0x374256d8,	0x9d11f228,	0x4135e235,	0x4ebca1ed,
-0x339af391,	0xbf656129,	0xa8e362b2,	0x8ed470b3,
-0x88405f8c,	0x285b7b3e,	0x1098ef48,	0xfdf3a059,
-0x1472f471,	0x402079de,	0x531c86f5,	0xe267b1d8,
-0xa5dd94bf,	0x4659558a,	0xee6ebad7,	0x3f90fd4f,
-0xa16b3fea,	0xa89ff7e3,	0x2bb842e2,	0x6352305a,
-0xbf5caa7d,	0x247738c8,	0xb3463b13,	0xacf9e658,
-0x2c186efc,	0x3d10d5f5,	0x4aba3167,	0xe3c50980,
-0x62584b2e,	0x62bb0b9b,	0x728bfbbc,	0x5c4392df,
-0x3e9d9ca4,	0x66d7cb6b,	0x3795fbda,	0xfd57060e,
-0x1f14ee11,	0x7ca5c691,	0xd45606d2,	0xee8aacc3,
-0x5e58e64f,	0x14539605,	0xacf9940c,	0x5aea1d0e,
-0x1abd48aa,	0x531443b7,	0xc877270c,	0x3cb0fc56,
-0x06fef541,	0xc82d4e20,	0x2850164f,	0x976d3800,
-0xf49bf720,	0x4441f680,	0x47ace05d,	0xdf6613c3,
-0xe326ace7,	0x65434171,	0x99f32f60,	0x8e74748b,
-0xa345f78e,	0x7ed8882f,	0x18147a58,	0x0f88b600,
-0x87511a26,	0x0421d011,	0xcb18e24d,	0x3b9d1f91,
-0x2eaf943a,	0x7d1954a8,	0xc9ca788c,	0x9bd0b50d,
-0x345cbf85,	0x5f15c80e,	0x4e688a4b,	0x85cea5b5,
-0x6c4858c6,	0xd511c3b7,	0x60c4dccf,	0xf0e203c0,
-0x66725a5a,	0xa1cdbb6e,	0x1050f46d,	0x9349b556,
-0x21f7ae54,	0xcaec7ac3,	0x60d78f75,	0x70a1b6eb,
-0x35663cdf,	0xa995cc91,	0xdc076d61,	0x838bcdf5,
-0x351bba87,	0x525362ed,	0x30f74979,	0x95e1b1ff,
-0xcb855936,	0x031f6d10,	0x6a499f0b,	0xac0b7909,
-0xca741d8c,	0x6be27fa9,	0x0aab5c9c,	0xa167bb23,
-0x77e81960,	0x32e08b0c,	0xcebc1a19,	0xb4c16851,
-0x7c062b03,	0x0bb891c0,	0xeaaeb569,	0xcd44b2a6,
-0x21202023,	0x150ea8e2,	0x59186783,	0x318ab582,
-0x09ed39dd,	0xf60982c4,	0x37d47336,	0x437da9fd,
-0x1d710edc,	0x621c5b61,	0x3ef57dff,	0x955c7f72,
-0x2b26a727,	0x3edd94f5,	0x150d7200,	0x55089618,
-0xb56e6c4d,	0xa4deaa5d,	0xa3597762,	0x9c5320af,
-0x635127cf,	0x59cb5391,	0x93ab2255,	0xae245934,
-0xd618c84a,	0x2f35cfc2,	0xd0f061f1,	0x89853b8b,
-0x025b054d,	0xe6d93f9a,	0x3adc0b16,	0x84fae023,
-0xb7633864,	0xda51d106,	0xbbff09a4,	0xd5b9d78d,
-0xb328e13d,	0xa96a350c,	0x9950512c,	0xff9e0ef0,
-0x7c35497c,	0x9f926f22,	0x21049558,	0x2beecc60,
-0x3e2e9bf9,	0x5639847e,	0xd619a13d,	0x4e583906,
-0x10df8249,	0x56e7e8df,	0xd514d3eb,	0xd0acb620,
-0x64fcfa06,	0x2579bd35,	0x75bfd73d,	0x3749e0bd,
-0xccfe92cf,	0x27d80baf,	0x1ce9155a,	0xd137af32,
-0xfbc1a48f,	0x55f823a8,	0xc881bff9,	0x10667a5a,
-0x9ddb4cca,	0x7a130ee0,	0x1f936bb5,	0x97900b6b,
-0xa5c120be,	0x0e5bd07a,	0xb6d55095,	0x64b9ee81,
-0xbe3880f4,	0x7298b54b,	0xca023019,	0xc04350c1,
-0xd9b65a0a,	0x497773d4,	0xe114aff1,	0xc20a9812,
-0x4093dd5f,	0x4a763172,	0xb81ea793,	0x4f1aa963,
-0x133d5b74,	0xbab2b93e,	0x475c6e06,	0x6bce797b,
-0xf0dde898,	0x0c154806,	0xf8aba3ea,	0x9f900b3e,
-0x5616d3b5,	0xd77f47e3,	0xeea5452c,	0xf06a6573,
-0x52ad35dc,	0x841d2ce7,	0xc0d9fc67,	0xae2a50f2,
-0x68770060,	0x72e75b45,	0x3811c15a,	0xddd4d732,
-0xc0cdee22,	0x72f2968f,	0x6483ba86,	0x97968042,
-0x693e9be4,	0x9832f05c,	0xdf622948,	0x127f360a,
-0xf364ca2b,	0x4bb883ee,	0x282dd695,	0x6aa679e4,
-0xa71f6a9c,	0x91988331,	0xd5b30591,	0x67994077,
-/*  3194-m04206e6_00000002.inc  */
-0x00000001,	0x00000002,	0x12082009,	0x000206e6,
-0x92caf080,	0x00000001,	0x00000004,	0x000017d0,
-0x00001800,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000002,
-0x00000000,	0x00000000,	0x20091208,	0x00000531,
-0x00000001,	0x000206e6,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x554d7ed5,	0x669e080e,	0x7b6530af,	0xbd691191,
-0x414675f8,	0x71ac9d1c,	0x76196264,	0x79f54e78,
-0x6436118f,	0xe83b26fb,	0x89e2d93c,	0xebb749ab,
-0x0190d468,	0xe584e6a1,	0x28772386,	0x0d0ebcca,
-0xb4f014cd,	0xa5890101,	0x11d7d636,	0x9aad0a93,
-0x0910ce34,	0x6821000b,	0x2bd997d1,	0x29cf7e21,
-0xeb3c278f,	0x440488fb,	0xf860c513,	0xf88bf0da,
-0x3d416f98,	0xce6c8f70,	0xd7115a85,	0xf6a1b31f,
-0x33dba23d,	0xfa8b79fb,	0x26ad1822,	0x6c4e9dcf,
-0xe6371cdd,	0x783c0a50,	0xdc3504bd,	0xda13c17d,
-0x17a558ad,	0x026e352c,	0xd26213d7,	0x55e16644,
-0x4fa2de6d,	0xa8ca6c51,	0x4b21340f,	0xb94bbf0f,
-0x6872b7b5,	0x37d60b5e,	0x215002eb,	0x15392b63,
-0x29583544,	0x3058eb2f,	0x5f6c0dd6,	0x20804929,
-0x537b57e5,	0x5587c2c9,	0x48757ebb,	0xf49d77c7,
-0x20e10d60,	0xd33817d3,	0xdd042189,	0x6872f19a,
-0x206221ee,	0x32728ca3,	0x8f8cc0fd,	0x5a411550,
-0x4b9e55ff,	0x362fb7e9,	0x25942339,	0x8e8a0516,
-0x00000011,	0x6129e1cb,	0x40b107ac,	0xa182f2ae,
-0x862688b8,	0xf5d79270,	0xcc062ef3,	0x2d63e650,
-0x620c4fd9,	0x7d26788d,	0xda8856a9,	0xcd2e7f25,
-0xf028c1db,	0xc9b5b19c,	0x9cc11d1e,	0x17fc4eb3,
-0x083a55c1,	0xf95d5018,	0x0e7fc362,	0x27e4a3d0,
-0x9daf9dbd,	0x6b1c5b8c,	0x75a7157f,	0x14d0805c,
-0xd8c38e23,	0x87767f17,	0x9317961e,	0xd3d4249b,
-0x11346e7d,	0x06077b83,	0xdee3b48b,	0xac1be5aa,
-0x9481a06f,	0x69c628b0,	0xb64cc045,	0xc3887b67,
-0x7034da0f,	0x7c47df75,	0x4d8b0936,	0x5f1b0c15,
-0x41e4b6c1,	0xb5fe086c,	0xf268d26d,	0x6baa2515,
-0x553a544c,	0x7c641177,	0x9a8037e0,	0x9b92c8c2,
-0xf5e8a4d6,	0x9d692beb,	0xadb877b3,	0x4a938122,
-0xc1ddf270,	0x981e02e8,	0x50d458e0,	0xeb33ad57,
-0x9bf9bb65,	0xc4146e7d,	0xfd88b0b5,	0x3acfff82,
-0xb38d3e1b,	0x5d06af54,	0x2d2b5720,	0xa5562b09,
-0x0808e16f,	0xbd185839,	0x99487a39,	0xd2a9d6c2,
-0x5426e7f9,	0xb954a952,	0xc7a6f80c,	0xe05ad340,
-0x8a5d3200,	0xfb1615f3,	0x4ee7c429,	0xf8c81a07,
-0x86aee293,	0xa95b53a3,	0x62ec8ab9,	0x34babd11,
-0x9ed772d5,	0xa59c08eb,	0x2bdf85ad,	0xaf26bc34,
-0xc3507e71,	0x6796ca9f,	0x3b734539,	0x7299eaf9,
-0x9f25a5cf,	0xbf053f8c,	0xafbb9d66,	0x1d3ba93e,
-0xeb7ab63e,	0x51043286,	0x683c6f4e,	0xfce2aa3f,
-0x7154da69,	0x9a43da0a,	0x3fc405fc,	0x5bfc4ff9,
-0xb477fe0e,	0x1bed77d1,	0xe098924f,	0x426b1249,
-0xac8d6002,	0x730d00f4,	0x5f7104c4,	0x8ba591ba,
-0xbd52da74,	0xd36deee2,	0x8157fb13,	0x95159b55,
-0x8daa3b7c,	0x00ded644,	0x43aec14c,	0xf86eae7c,
-0xb0e168a5,	0xc20552d3,	0x29f94c9b,	0x22b69379,
-0x81eb9065,	0x4d4a793e,	0x0d95d727,	0x8f53cf6c,
-0xdb500369,	0xa5622333,	0xe8fe9beb,	0x211a7a71,
-0xc836b921,	0x14d417ea,	0x580f643c,	0x30353194,
-0x14c07baa,	0xbb453eee,	0xb6fef6c8,	0x985e35d4,
-0x653bd701,	0x6e965c2f,	0x445c2e7b,	0xbe5b8c57,
-0x79221999,	0x9c3db252,	0x02d6155e,	0x3d5482d1,
-0x4440002e,	0x60fe8ce2,	0x93c25834,	0x6f88b4e3,
-0x861fc9f5,	0xef028cab,	0x6ea4e2ca,	0x7c1ebe6a,
-0xd9e89820,	0xf2d166f4,	0xb2fdc39b,	0x75d5ac84,
-0x9a1d2ad6,	0x20d41e50,	0x83b071be,	0x11600584,
-0x1147ef9f,	0x5bcc3535,	0x0b87a0e3,	0xa3f07a2a,
-0xa598a091,	0xec9b2001,	0x8804aa4f,	0xa0fa9727,
-0x30f52dda,	0xb7252273,	0x9975c075,	0x900cc829,
-0xcdd22025,	0xb6e76468,	0xd5469557,	0xd8059a5d,
-0x3e7734dc,	0x7f896a73,	0xce0cadb1,	0xf40c932f,
-0xca215284,	0xa0c7cc46,	0x2f814498,	0x9ad8370f,
-0xfafe33f8,	0xf24c7bb7,	0x0f0fd1e9,	0xccbf403f,
-0xc5866e7e,	0x35db462e,	0x90560362,	0x06c03fc1,
-0x424aae88,	0xc7c1feb0,	0x72d95f51,	0x89ceb78e,
-0x0dcf2053,	0x99152843,	0x04f8a363,	0xd4437b86,
-0x7821687c,	0x29e970f3,	0x18fb54f2,	0x0cfcd17d,
-0x66986e2d,	0x427e4ef7,	0xc689d398,	0x24ca9ba9,
-0xf18ce741,	0x04c038ec,	0x9f4b7156,	0x98634873,
-0xe124ec04,	0x2f141657,	0x77496d39,	0x66c56fd0,
-0xf04fafc0,	0xbb597f92,	0x7879f39d,	0xa5f875f7,
-0xeb57e6cf,	0x13026c82,	0xf2e9f5d3,	0x97aa1899,
-0x9733c606,	0xa2152c29,	0x72a51621,	0x43f8728c,
-0x533c1a7a,	0xa5ace4ae,	0xcf0a1e7b,	0x2143ff28,
-0x01dde13c,	0x7715315d,	0x532781f3,	0x964244b7,
-0x776fe7ae,	0xf8bd455c,	0x415cd20c,	0x34f7d0bd,
-0x77453f4d,	0x023a9f2a,	0x22c9b5ca,	0xf8d6d4b2,
-0x06326771,	0xe030b438,	0xc4cd01b5,	0x8c80c103,
-0x25baaf97,	0xe830044f,	0x5cbdc2ad,	0xc2552072,
-0x060d9e89,	0x44a1c833,	0x09d9dd0e,	0xa967b0a5,
-0xb8e92779,	0x283e0404,	0xd31795ca,	0x9e5610bd,
-0x4669e5b9,	0x8795d86e,	0x0852fe0b,	0xd4ec32ad,
-0x68d7ea10,	0x79efd968,	0xfe7a65ed,	0x63df8546,
-0x16ee816f,	0x9e1278ec,	0x43164d5b,	0xf704c2cb,
-0x1ef62eb9,	0xf9029d24,	0x582401fd,	0x05d0ee32,
-0xa9973044,	0xceec4cd9,	0x3384282b,	0x6be257ea,
-0x3f3c0f99,	0xff758c4b,	0x620e4cd6,	0xa047e4e9,
-0xe1d7d065,	0xc282825b,	0x46ffe5b8,	0x43ec99dc,
-0x8b6d30fb,	0xe4f2b2e2,	0xdc7a9ad9,	0xb458a033,
-0xf7647c44,	0xe55dd454,	0x6f947c99,	0x07e3f13d,
-0x25aa6cc8,	0x3f34c943,	0x98f09a43,	0x35db6af1,
-0x9bb18fff,	0x060ecdc4,	0xa5c41f09,	0xfdc076c2,
-0xed849561,	0xa3aa672f,	0x113e142f,	0xac5200e6,
-0x2d261183,	0xf4364afb,	0xacdb0c01,	0x151aaf33,
-0xf365431d,	0x3f5cb13f,	0xc1b92d13,	0x32398234,
-0x35fd68b7,	0x9b5778a9,	0x450a8ab9,	0xea43da58,
-0xed69c047,	0x274bf7e0,	0xde38d8f6,	0xe1875914,
-0xdd2e172a,	0xff433cee,	0xdf918c11,	0x50c6719c,
-0x65930485,	0x86c8c097,	0xe505a0e0,	0x54726eca,
-0xc22284ed,	0xa3f0057b,	0x572a6ae7,	0xcb4cf730,
-0xb46b5de4,	0xb843a551,	0x1f6ef73f,	0xa29e4c78,
-0x5cde3614,	0x5cdfb859,	0xbdb4c913,	0x25db064e,
-0x9476624d,	0x8d4e690c,	0xc64dc8cc,	0x09e38429,
-0xc30742c6,	0x8edd132f,	0xbfef6262,	0x15c32709,
-0x040f7740,	0x753c93a1,	0xd07cc44a,	0x91cbaedf,
-0x5eff71ea,	0x92fd9336,	0x1a799220,	0xeda3b0b9,
-0xf92e0ad0,	0xe870ca9a,	0x8d594bf6,	0xb73361c5,
-0x60c59f72,	0xad9ef497,	0x589013d7,	0x760ccd31,
-0x855837f9,	0x82abce31,	0x97fd5ad7,	0x5394b26b,
-0xa26a2862,	0xcb26a88e,	0x2c7b5dab,	0x6af48382,
-0x8e42eb40,	0x3c5f0c88,	0x6f1f1e19,	0x7e495d8b,
-0x213137a9,	0x9876d828,	0xa0c66b87,	0x841e6142,
-0x7c74e962,	0xdb0b0592,	0xc5d6e8c1,	0x27dfd48a,
-0xd2e74095,	0x43fc1d4f,	0x33620fbb,	0x6b6709d4,
-0x512c6d19,	0xa438f824,	0x4349cee7,	0xebfaeec5,
-0xcd6820ea,	0x9a0672ca,	0xd2ae7771,	0xd5f5003c,
-0xe5f34699,	0x5db3e190,	0xf07f5548,	0x7327b8cc,
-0xbb4cfadb,	0xed5ee12f,	0xce8202a8,	0x784c9b43,
-0x01d74861,	0xd1615b50,	0xf3248d42,	0xef29845f,
-0xa00dc511,	0xe08c9a74,	0xf1f48129,	0x7e27dfd0,
-0xf6825199,	0xc343b2fd,	0xbff5e539,	0x8fdb0584,
-0x92553ce4,	0x0ef81132,	0x5afe55bd,	0x178b3e49,
-0x448cec17,	0x57a83b11,	0x5ec6ba98,	0xed8c111c,
-0x47c6f4af,	0x152fb172,	0x81781a4e,	0x0828d0c0,
-0x99c8087d,	0xa08b8eed,	0x93682960,	0x768290d6,
-0x58f2ffc2,	0xac099648,	0xbe4a13d2,	0xff42a909,
-0x841c509b,	0x9c51787d,	0x3f894c6f,	0x5d7e1a8d,
-0xe75f3538,	0x6364c0e0,	0xc3d1d1ac,	0x67e070f3,
-0x9d973d81,	0xa4fc560c,	0x94875219,	0xe909dc6a,
-0x9173aeb5,	0xf165b058,	0xc6c9063f,	0x2bb729f0,
-0x91f0f61a,	0x28f89c1c,	0x840acf32,	0x11aa9996,
-0x112d28ee,	0xc72d6d72,	0x523ddf29,	0x1858c7f6,
-0x0de480bd,	0x4a76a201,	0x5bf89c7d,	0x49828410,
-0x5b21f665,	0x06aa3ce1,	0x52809a7a,	0xce91b1fb,
-0x2b29572b,	0x8bead63a,	0xac80af8f,	0x18acd8a1,
-0xe8a76108,	0xdc57c4c5,	0x84f3d246,	0x90dbc01f,
-0xb6ec29c5,	0x7ddaedcb,	0xb6d8e739,	0x7a76806f,
-0xaf820198,	0xec3485dc,	0x6061e65e,	0xf7719e55,
-0x56c50ee7,	0x229f2e49,	0xbf0ea8a5,	0xebff1402,
-0xee1c1da1,	0x6fbfc351,	0x893c99ef,	0xe5d00111,
-0x772c6f14,	0x24a361b3,	0x3d16a93d,	0xa6841f4c,
-0x283c0a13,	0x22b1f80f,	0xf920a271,	0x2fc563b2,
-0xaf0ab355,	0x50f1c520,	0x378f6077,	0xa2ee2099,
-0x1f371660,	0xdc50baf9,	0x4802d882,	0x852bf860,
-0x5dd1371b,	0xc5a8e850,	0xf522d7ce,	0x30b139e1,
-0x9f34739e,	0x12bc8cc7,	0x441ee88c,	0x356874cc,
-0x10f8dd8f,	0x0c278679,	0xa239daac,	0x2838b951,
-0xd3388084,	0xf882d4f4,	0x24cb5932,	0x420d492f,
-0x52c3af03,	0x76a89c0a,	0x77128133,	0x8b868951,
-0x53a08411,	0x55abc0d0,	0x4388dd84,	0xbbc7e67c,
-0x792ded03,	0x7dfd60c0,	0x4b643e0b,	0xc748082f,
-0x5ad760e7,	0xb7289d63,	0x8bac1b49,	0xe08ecf99,
-0xca0aa34e,	0xd4cb5709,	0x8ad390fe,	0xa63a99be,
-0x0ec8e3ca,	0xc0cca548,	0x6c6db302,	0x222ff202,
-0xdd437d25,	0xeb2ef95f,	0x5d5969a3,	0x942f34dd,
-0x32177e7b,	0x6e29118d,	0x17ef7b59,	0x2f6544d0,
-0x7a9a7717,	0xb4e63681,	0xd2577ed4,	0x6f6c3359,
-0x86bd78fa,	0xaad2ae67,	0x0de6398d,	0xb825a772,
-0x5d24e0b1,	0x783c4522,	0xd1f65a6c,	0x2fc65f5f,
-0x12e1a2e8,	0x0f902638,	0x112af134,	0xaf62ac20,
-0x1ab68581,	0x4a4f5186,	0x8511adf7,	0x411fa38d,
-0x4947af72,	0xe1a88d14,	0x8a1f3ed1,	0xb48156a5,
-0xb128e8dd,	0x45bc7403,	0xe2e81675,	0xc95fc501,
-0x524a54e0,	0x6cb35b52,	0x59a94c9f,	0xf6cdb321,
-0x786e7c96,	0x23021087,	0x735a91da,	0x19f10d43,
-0xc75f9473,	0x81e7dc62,	0xf3b081e6,	0x3ad27eab,
-0x703df5ea,	0x0b7b0d5e,	0x4d0e5b59,	0x009e87b1,
-0xb7629a50,	0xfda63bac,	0x54498b72,	0xc9d5404a,
-0xf99c0c6d,	0xd49ded94,	0xcd5b2058,	0x340810ab,
-0x58c1122d,	0x63f7d98f,	0x89dee5db,	0x026555d3,
-0x6538d5f4,	0x6ecc2997,	0xc8ce8475,	0xf1a7bb56,
-0xef1a77f0,	0x8f2e5426,	0x57b3e7b8,	0x50fd3896,
-0xfd091981,	0x2a1534c2,	0x55d98072,	0x63162b57,
-0x7bb17260,	0x095a3e11,	0x6e502413,	0x6e6aafce,
-0x96f2cd21,	0x89b84c00,	0xf23b84ef,	0xa973c772,
-0xee4d301b,	0xd6d7f0e0,	0x16a57339,	0xbfea860d,
-0x9bb2ba28,	0x7acc3057,	0x4073c7c7,	0x6f4ce9be,
-0x40e112e1,	0xc0aa34b4,	0x04e630e2,	0x075eec01,
-0xf544acbd,	0x5e3d7eec,	0x86fea288,	0xcfc550f8,
-0xf29141fa,	0x91865e06,	0x3372c6fc,	0xf512123d,
-0x30b8af30,	0xd71b9d0c,	0xca8a8946,	0x56687ce6,
-0xe1ac13f7,	0x7769d6c2,	0x6a83c6f9,	0x3abd1108,
-0x633eebb0,	0xef21ae47,	0xafdb089e,	0x078b97bf,
-0x6bc92ce4,	0x84b90540,	0x1300d07a,	0x56751c23,
-0xadb3eef7,	0xce9ed354,	0x7594634e,	0x4e1d2b8e,
-0x4d29965a,	0x4069f43f,	0x3497e55d,	0x43a661ba,
-0xdc6821c6,	0x2ba52b96,	0x99af90df,	0x023d1fc5,
-0x5acf16c8,	0x7c24ee42,	0xd9c84b0e,	0xc40ff495,
-0x3b3b2225,	0xc21fc09c,	0x8185bb49,	0xd0d53dc0,
-0x7556851b,	0x3d9a554e,	0x96c933d9,	0xaa41803f,
-0x58f4f4c0,	0xcb28536e,	0x6bb68e7e,	0x9601d174,
-0x0d772e1b,	0xbff231e1,	0x81664807,	0xe11fe2cd,
-0xc8a6e467,	0xeab8bad0,	0x62062c51,	0x8807b5d7,
-0x095be2df,	0x459ad62a,	0xc5d690ca,	0xbce11e91,
-0x389239fb,	0x6f9b8958,	0xbaff8885,	0xd2e9848c,
-0xdd92a915,	0xf2926b10,	0xe1d3711c,	0x38736a72,
-0x89a0d3d3,	0xb37bad91,	0xae8efdc2,	0xcc405275,
-0xaf232a54,	0x54c0df1b,	0xce705583,	0x8c3d7558,
-0x4ded5319,	0x4ae97a02,	0xd2022787,	0xcfea8758,
-0x2ae0b9c2,	0x2b17400f,	0x8b809b27,	0xd27a84c6,
-0x78421d7e,	0xc26ed1dd,	0x1627a125,	0xd3fd4686,
-0x0a6e779c,	0x3b102092,	0x8e764307,	0xac3b1655,
-0x2ca00169,	0x9edbc814,	0xb23c3b6f,	0x8f144164,
-0x4272c023,	0x07e96f44,	0x3d3bcba4,	0xe39ad519,
-0x69aa2940,	0x1d873298,	0x66e434de,	0x4f53cfc5,
-0xae612176,	0xbf27511a,	0xbb9d76d3,	0x30cad9a0,
-0xf9059e19,	0x7d1b4bd3,	0x4660ee1e,	0x9baa20a4,
-0x44715734,	0x27f84a90,	0x1f637019,	0xcda00548,
-0x638b359d,	0x70e6d0eb,	0x9f7a3445,	0x9c58eeb9,
-0x4629dd35,	0x7d3dfd6a,	0xb63978c3,	0xc86bd38b,
-0x19cfc8b0,	0x7e452b8f,	0x641c7a94,	0x5ea38d97,
-0x481f99f2,	0x39759fe3,	0xc5ac883a,	0xf8d54fa1,
-0xc6e4a7ab,	0xe0a61ec1,	0xd5f20ca0,	0xcba1299b,
-0x6a087622,	0x50742ed1,	0x41eeebe5,	0xf765a1d4,
-0x26809efa,	0x69acc7c2,	0xb43bdbfb,	0xff9e0ea2,
-0x74190d50,	0x31b12172,	0x39c11437,	0xb2387bad,
-0x14dbb387,	0x14fa6f1e,	0xc75a8aad,	0xc5901e5d,
-0xe1f39099,	0x79a705b2,	0x7a1bc1d8,	0xb0239742,
-0xc4d61f5e,	0x4281755d,	0x6677c59e,	0x1279fe7a,
-0x8e600645,	0x742c0dad,	0x44b35ad3,	0x651acbb4,
-0x15164cfd,	0xfd639979,	0x15ed042e,	0xb598989b,
-0xed1b545b,	0x28b8f80c,	0xe2be1b03,	0x158a667e,
-0xd3609acb,	0x939282b4,	0xb077d1ad,	0x621baf5b,
-0x69897556,	0x55e35da7,	0xedef719b,	0x44d55422,
-0xc16d7193,	0xcb889bef,	0x6811d959,	0xa74e01f0,
-0x0345032a,	0x14ba60f1,	0xe9249298,	0x67b36858,
-0x0db5dba9,	0x78ed7133,	0x15e8dd54,	0xf291a062,
-0x53e5c77c,	0xc4c23721,	0x303a2eb6,	0x36929489,
-0x2151048b,	0x3cb6d287,	0xf69c52ac,	0x5387e014,
-0x96ff36b4,	0xf3b693ad,	0x7b617543,	0x765add92,
-0x9b9a48b3,	0x1d3b2626,	0xdb098502,	0x802c1654,
-0x0aa89f92,	0xb9a35605,	0x5ee8ac95,	0x26497fe9,
-0x5a415b56,	0x4fb34497,	0xaeabcb8c,	0x1ef526e5,
-0xad6a3a7f,	0xd8b5c98f,	0x9a268b0b,	0xb5138c2e,
-0x46353834,	0x4d34156d,	0xe67641a8,	0xfd8cc38b,
-0xeb341a69,	0xe9368209,	0xef2d9e05,	0x3696c73b,
-0x6c2de6d4,	0x3b34627a,	0xd37956b3,	0x4bcafa44,
-0x6145bb6f,	0x1ce34259,	0xff952128,	0x102da75a,
-0x2db2d136,	0x3f4950ad,	0x5840cdb6,	0xf770f7a8,
-0x82601fe9,	0xd99e4e01,	0x8fffda37,	0xb762da16,
-0x72de7bc6,	0xf4dd8644,	0x1d47249f,	0x930432b1,
-0x48750076,	0x67a8950d,	0x8b3bf536,	0xc0787062,
-0xb45d7136,	0x135d9e24,	0x84bfb72c,	0x6f4e458e,
-0x7950c6de,	0xbf3d2dd2,	0xd6e70a3b,	0x2b4363c3,
-0x43575d37,	0x7cd0492d,	0x23e4ec51,	0xd3a9f7ab,
-0x038c67e2,	0xf8212d2a,	0xea8b7874,	0x6e104927,
-0x74d00992,	0x14f0ef55,	0x538ffd7b,	0x7de74a3c,
-0x38d460a9,	0xa0f57d10,	0x4fbccd20,	0xe4629294,
-0xeb46e210,	0x1bcbe9a6,	0x3a7556f4,	0x32e48117,
-0x3484900e,	0xa36c2dbd,	0x26d89101,	0x3dee6046,
-0x4347a18e,	0x984dd723,	0x35608142,	0xdae1c344,
-0xa5c54cb7,	0xcd8f3d1e,	0x488c5bb6,	0x1f496718,
-0x483bd314,	0x0552b160,	0x2f6c4ccc,	0x2c445ec9,
-0xac0f34c9,	0x6ad5cab9,	0x21ca0c72,	0x4648b778,
-0xedcbf4c6,	0x54f254c6,	0x97bd05db,	0x932d5012,
-0xb33ed2a8,	0x7812a829,	0x760fa8d1,	0xe72bec38,
-0x98537d0a,	0x47d1b9d0,	0xd7a338a8,	0x61722b42,
-0x86d3a9ef,	0x7ff308fa,	0xd6748911,	0x5740487d,
-0x9aadc786,	0x2038f449,	0x8f5ce2d3,	0xce133a28,
-0x88732089,	0x0e7fa13b,	0x1fda4809,	0xdac91f7e,
-0x6f57e545,	0xe843ab02,	0xc6642aeb,	0xb906be1c,
-0xf1270fb0,	0xf8458464,	0xd9930cf9,	0xaca44c73,
-0x2a26b047,	0x4d87c6f9,	0x1ed2e7a4,	0x3b2f974d,
-0x5dbd880b,	0x89dc59d9,	0x764533ec,	0x5ce2061e,
-0x8624da81,	0xe41647d1,	0xae46402e,	0xb8dc2f94,
-0xf7868865,	0x5c2b8f31,	0x65be3883,	0x954cbec0,
-0x4175caa2,	0xec4ddefa,	0x2d9fb2bc,	0x6ed39ea1,
-0xf3b3db18,	0x5d8356b3,	0xb0dd19e3,	0xd9db0c07,
-0x8d7b23f4,	0x02a67a43,	0xed3c93ee,	0xb17fe2de,
-0x65a8bcf5,	0xd2dd7224,	0xfc65bd45,	0x17968902,
-0xf1037747,	0xe62c1b76,	0x99d7bff7,	0x69f7ac49,
-0x59166663,	0xad59efbe,	0xec1cb532,	0x20e8fde9,
-0xc62b4428,	0xc62a6531,	0x65a84a2d,	0x4ad6b3c9,
-0xdcc00d9e,	0x40e62b1b,	0xe8153099,	0x764b4179,
-0x9d0e8cdc,	0x09f4fbc3,	0xb015f775,	0xb1a27b93,
-0xf548b696,	0x5c06d72f,	0xfc5478c1,	0xf75a0005,
-0x0f695f00,	0x14029bd8,	0x03729143,	0x40a36c7f,
-0xb989a5df,	0xe563a5f0,	0xed0c18b9,	0x7fc48224,
-0x2c0fb64a,	0x4be8a77e,	0xe97dafdc,	0x86770b89,
-0x24522fa3,	0x259e9722,	0xebedb4a6,	0x8adcb9bf,
-0x9845352b,	0xaaa58937,	0xe433a033,	0x5f100b9f,
-0x2db37194,	0x5af49e8c,	0xdff0304a,	0xb558ce36,
-0x8cbb8cbd,	0x1d91e775,	0xfa1b211d,	0x7a5cf3e5,
-0x739df627,	0x3c916993,	0xfa9d3e12,	0xb2922286,
-0x76db6342,	0x01f11504,	0x65b150ff,	0x054a3238,
-0x69adf366,	0xb8b7e381,	0x980473b5,	0x5baa69f2,
-0x1a2973b1,	0x11714c6c,	0x9ae3eefe,	0xe08cd922,
-0xbbf70110,	0xdaf59e71,	0x97f57ada,	0x2fbf39b2,
-0x770fa307,	0x49bba030,	0x157432b4,	0x927d3b50,
-0x188368cd,	0x066c03d4,	0x1968917e,	0xf54a7f23,
-0x840e23de,	0x1f86e1e8,	0xfbe5423b,	0xd92e728d,
-0xf7339cc0,	0x0793bfbf,	0x1345790c,	0x78831c12,
-0xd073a632,	0xee46e12e,	0xfc6bbaca,	0x82933016,
-0xc1451b06,	0xf0ce900b,	0xecf032e5,	0x815ec68a,
-0x375fb2fe,	0x64978673,	0x689fd6ac,	0xec321655,
-0x33ca924f,	0x18501c0f,	0x4b432d1f,	0xf487650c,
-0xd40b49c6,	0xbbca0436,	0x8baeb737,	0x8c1e28de,
-0x3c2df1e9,	0x6e19d6c0,	0xc8d1ed83,	0x6bce874c,
-0x68012a7d,	0x479b4183,	0x9ec9490f,	0xa3826382,
-0xf7136b0a,	0xdc1a909b,	0x1fd937cc,	0x379da706,
-0x74aa7c07,	0x8d71937f,	0x648c7109,	0x77868eae,
-0x65112e59,	0x3d567c68,	0x510dc5b6,	0xb5639c87,
-0xf0ade679,	0xc99ec812,	0x6adf0eab,	0x8dff085c,
-0xd55360e0,	0x2bbb024d,	0x52466acb,	0x47079d06,
-0xf66957af,	0xa595a4c7,	0x78d6d666,	0xa7fe3a67,
-0xc7f07d7f,	0xeaf9b84e,	0x692764de,	0xca7e4a9d,
-0x0295376b,	0x9dfe2751,	0xeb5f886c,	0x0964c441,
-0x2bd6bd07,	0x1d6cc3a9,	0xcfc80696,	0x5df9033c,
-0x2a36b8c7,	0xc261698b,	0x2297a98e,	0x13eef5ea,
-0xc9df5f48,	0x9f667b0e,	0xe4e16bd6,	0xb50b7a21,
-0x43817fc4,	0x15ef7923,	0xebeedeb3,	0x2add983e,
-0x15a9d1b3,	0x9036490b,	0x31999dd3,	0xcc235217,
-0x2e10e5c6,	0xf6775a2e,	0x6cb46269,	0x005dedb8,
-0xd8e80e31,	0xe883698b,	0x323d5f9e,	0x9ab9f075,
-0xe2483bb0,	0xb5d4802d,	0x93861885,	0xc68f0c94,
-0x2e13c223,	0x54420300,	0x337864bf,	0x78548661,
-0xe80f4f10,	0x0bba1493,	0xc29365a3,	0x7540f33e,
-0x86e30abc,	0xb14c499f,	0x542107e9,	0x8ed29306,
-0x13b5b609,	0xc6b90c75,	0x049d1c04,	0x97c84c44,
-0x18a4f8a4,	0x55b50066,	0x4c495844,	0xcb6e4279,
-0x390f93f3,	0xc6790045,	0x28f5cc56,	0x0f61d205,
-0x44d99188,	0xf67e0b42,	0xa6b14e50,	0x1571f7da,
-0xd38ff4b0,	0x58f54f59,	0x95646ad2,	0x998040ac,
-0x92bc11e6,	0xe8834025,	0x87ea8135,	0x3acc7643,
-0x83a34847,	0xeda9c86c,	0x52e47719,	0x3b3842bc,
-0x61b2886f,	0x6638adb5,	0xca9c1f2e,	0x2cd92807,
-0xd9c4464f,	0xd91b9953,	0x3d1ecfb9,	0xa1516e4d,
-0x60b01c2c,	0x08459d5f,	0xe99a102a,	0xdfac4df2,
-0x70333609,	0xb1904964,	0x1b6d54af,	0x9968a440,
-0x04347224,	0x88dc7467,	0xbcff2ef4,	0xb83d961a,
-0x247825fc,	0x8c6f624c,	0xe05ee9ba,	0x94e73cbb,
-0xcb6edebe,	0xc9793be8,	0x053280f4,	0xd29418fd,
-0xa0512900,	0xabfd8d92,	0x8aba9e8b,	0x33d149ff,
-0xd5ed45f4,	0x62a4840a,	0x0bf481f0,	0xbf038c47,
-0x82d4965e,	0xb41eebfd,	0x5b287f0b,	0x71d6d69b,
-0xf2d06e0d,	0xe1218c89,	0x71720f49,	0x94390240,
-0xc4c3f49f,	0xd32d517d,	0xedfe45c6,	0x74b04c58,
-0x2372b2be,	0xe5a7de41,	0xb017d5d7,	0xf934a681,
-0x0ac56d3b,	0x0be48e98,	0xae47c17b,	0xf8ddbcf8,
-0x5682f9a2,	0xf43e9eba,	0x6c0b336b,	0xc40150eb,
-0x4aa0ca2b,	0x0d5a305d,	0x56fefed2,	0x99a705aa,
-0x6096092a,	0x001f26c2,	0xe364bcf4,	0x0a4f07e7,
-0x68633e62,	0x46165fd8,	0x777c8734,	0x7188064a,
-0x7728a2dc,	0x0132a4ff,	0x1411da4e,	0xc0d7cae4,
-0xb0827a24,	0x1f33ca0d,	0x301b45c3,	0xcfd76566,
-0xb3140209,	0x2020d58e,	0x6c7828aa,	0x469e3e1b,
-0x53e5cc4b,	0x8c9bb974,	0x9c0be380,	0x00d29a02,
-0x5f7e9fd6,	0x45f517a0,	0x1bc394a3,	0x78fe109a,
-0x4af25164,	0x5f56c9fd,	0x9d5dab8a,	0x64fa3425,
-0x1a365db6,	0x1c586a1f,	0x56e55cf4,	0x2d93358e,
-0x448271ba,	0x06e8e093,	0x0042488c,	0x54bd9d23,
-0x0a887744,	0xcb551856,	0x27556ed2,	0x2eee49d6,
-0x85d12f41,	0xaecc4f26,	0x2a7bec40,	0x8d7ec8b6,
-0xb384dc7c,	0x01c21f9a,	0x9876ccea,	0x1924bed5,
-0xe0600462,	0xe4f94e3a,	0xcc03b228,	0x24e98fce,
-0x26bbd55d,	0x152c96fe,	0x58baf202,	0xb32ea38f,
-0x22c554b1,	0x368334f8,	0x45e64e5e,	0x3f9dae32,
-0x9c6a0ff1,	0x4665a203,	0x23786040,	0xa21f24fe,
-0xa97cb082,	0x6f4a18c2,	0xbc51598c,	0x08309bd8,
-0xb62379b4,	0x779bb74e,	0x8870ce16,	0x932d1ebb,
-0xf49f6c68,	0x69c4bd4f,	0x08d3cb08,	0xa379bb0d,
-0xf0e18560,	0xe10c446b,	0xe60aa1cc,	0x398b54dc,
-0x67974d8f,	0x9bd2fe47,	0x01d57215,	0x1f419459,
-0x0b94be20,	0x9145f783,	0xab47acb3,	0xbd1d3022,
-0x97c64c01,	0xcdb21b65,	0xcc447f47,	0x9835192a,
-0x671fc924,	0xc6003828,	0x36625701,	0x76fb155e,
-0xcf1babce,	0xa7fd901d,	0x2c6e6f0b,	0x14392642,
-0xa4ce369b,	0x6a899816,	0xe52dad41,	0x18ccb12c,
-0xa7a3ee18,	0x05c15fc4,	0x0b16e652,	0xce0dbeea,
-0x083ac310,	0x48c34502,	0x2c190079,	0x9befd0de,
-0xe5095afc,	0x37a6ff3e,	0xa3b75262,	0xef3eb9e9,
-0x61a9ea28,	0xb9bac46b,	0xc8f809e9,	0x9580a1b9,
-0xf10a2570,	0xa5314534,	0x11045ccb,	0xf575d940,
-/*  1469-m9df4406.inc  */
-0x00000001,	0x00000006,	0x04212005,	0x00000f44,
-0x9f60db18,	0x00000001,	0x0000009d,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0xe563140a,	0x7a20a196,	0xeb1d9a96,	0x5defb059,
-0x551ef057,	0x018ee1e6,	0xdaacf6e3,	0x14105663,
-0xf1e0900a,	0x35e5b615,	0x542b082e,	0x27a12e48,
-0x6e3986f8,	0x73be0124,	0xa2d87e91,	0x3a6f0d62,
-0x749a41f5,	0x722ce5f3,	0xacf63c0c,	0x1dffb5b9,
-0xb1f377a0,	0x258e340d,	0x2826e300,	0x46ff70a4,
-0x000c7a3d,	0x5c7d517c,	0xa4ac08c4,	0xf3251d6a,
-0x97ee3046,	0x74b66de7,	0x70ddb034,	0xf1cc3728,
-0x24646e08,	0x89d1ef84,	0xf2c5d259,	0x5636ef08,
-0xbc4b18ab,	0xb77a3bf4,	0x34ed12b6,	0x3904c93e,
-0x2aabac33,	0x30a9be4b,	0x3cb32cf3,	0x0c8ec4e1,
-0x5dd3de8a,	0x6822723d,	0x1ee4a4a5,	0x76f8dff8,
-0xc114ecd8,	0x24e2b997,	0x895778d4,	0xd96893a3,
-0xc3f8b3b7,	0x0894e3d6,	0xacf5f40d,	0xb6c4805d,
-0x9e702a73,	0xd83e0f61,	0xe57efbec,	0x734287d9,
-0xad22e7ba,	0xd43369ff,	0x5c8f9702,	0x10faeede,
-0x8f7a2b16,	0x27a2f4b4,	0xb9dae4d7,	0x2e060e6c,
-0x0a565ac4,	0x56017827,	0x1d40da17,	0x302f4015,
-0x4df69cd6,	0x557f99fe,	0xe05ae859,	0xa4d26771,
-0x66668ed3,	0x1b02cbe2,	0x6402e2b9,	0xe2d45956,
-0xacdbdf95,	0xcf15e429,	0x1211a69f,	0x6527d512,
-0xd454cf93,	0xc8057a6a,	0x462abebf,	0x50f4a562,
-0xcc021bd4,	0x12e4dcf5,	0x0f643ac4,	0x64b62a5a,
-0xe31293f4,	0x69a4f441,	0xfd7c73a7,	0x3de19d86,
-0xacea1763,	0x5452e277,	0xaf998cfa,	0xd0dbd619,
-0x437a136f,	0x7d84b255,	0x0badc43d,	0xcfdb5155,
-0xe0f18baf,	0xc7e50dec,	0x12f74c21,	0x10839a4b,
-0x384c0010,	0xbb64e51b,	0x6b1f8001,	0x3a42ea68,
-0x52ba8707,	0x4840e661,	0xea8cb909,	0x71bf8fe9,
-0x301e156b,	0x1b28299f,	0xd6f83b79,	0x68b53c17,
-0x8ee827d4,	0x4d264534,	0xd831f750,	0xc0897c28,
-0x9c27edd1,	0x2c54ffcd,	0xbdd61a3c,	0xbb750d1f,
-0x92ba81b5,	0xe8b41b21,	0x92bd9214,	0x2f3bcfe1,
-0xfd7e8ee6,	0xbbf21e5b,	0x2d2f042c,	0x6c2f1c00,
-0xfa5db9eb,	0x64e9da32,	0x27ccb83a,	0x6ee2c527,
-0xe480e71f,	0x74d3726e,	0xef8a1239,	0x795cbd73,
-0xd29bc178,	0x34560391,	0x4bb7009f,	0xc150a672,
-0x68094238,	0x7b23b1b8,	0x4561db18,	0x9e9e2cde,
-0xb4b6defe,	0xe412c6ed,	0x19bdb157,	0x3431b08c,
-0x83cbf398,	0xc02744ae,	0x757b3636,	0x70cc9a6a,
-0x16644d51,	0x66ff4e2e,	0xa8f9e6c1,	0x2d36259b,
-0x54f24515,	0x47f972c0,	0xe5b96f48,	0x2e8f8866,
-0xee84deb6,	0x261022b8,	0x25e08920,	0xab692cf4,
-0x2899a0e2,	0x4fb247d8,	0x84dad90e,	0xade5b71b,
-0xf866993a,	0xdb0e8d9a,	0x855db464,	0x46c73e5b,
-0x6c4dc8ee,	0xff498c8e,	0xf5bcf485,	0x2c222e5a,
-0xea373f27,	0x4c98a5f1,	0x6d389f50,	0x24181e62,
-0x761fd60d,	0x11ff22a2,	0x9be6e06e,	0x5d6349af,
-0x743a43a9,	0x6e183bfa,	0xceb18be7,	0x87693e10,
-0xc7589a26,	0x147efde0,	0x82bb18e7,	0xe0a9b9ca,
-0x81f4f143,	0x814c966f,	0x1ae2043c,	0x2b2f4bc9,
-0x9ad21435,	0xe4ec4152,	0xb6f735d9,	0x29c6cf4a,
-0x5172795f,	0x7de9a8ce,	0xb11ab201,	0x37cc8504,
-0xc4341e1a,	0x32e7b6bd,	0x3ada1f2b,	0x5f8e8670,
-0xffd0e48e,	0x7b204a33,	0xbf8ccf79,	0xfd7a0537,
-0xbea6017c,	0x13ddc317,	0xa2b49bc1,	0x85535884,
-0x2306bc4f,	0xf7fd5f14,	0x2f25e16d,	0x7a05c70e,
-0xa734f67e,	0xed9bcbaa,	0xb4b23ae3,	0x743a2302,
-0xba46fa60,	0x44b8fcab,	0x53d89eb6,	0x75d3f3d3,
-0x3cf9ef83,	0x265b38e9,	0x99f9df3c,	0x2af44ab9,
-0x34802ecf,	0x2341609e,	0x04ad291a,	0xc2110545,
-0xec4a8447,	0x42d6132f,	0x6a729029,	0xf56a07da,
-0x9f51b3e3,	0x81e20e55,	0x48b7f7d1,	0x6ceae8e9,
-0xcf28c1cf,	0xb0459807,	0xed8c8daf,	0x572bcbdf,
-0x77c5640f,	0x4edc4215,	0x3fff4444,	0x4784c4e2,
-0x3ffb9ddf,	0x1af87147,	0x1638fa9d,	0x61771e20,
-0x621459b1,	0x021f0a08,	0x0a8336df,	0xd8c8ccc8,
-0x88b75e47,	0x18ae2461,	0xc06d45c4,	0xf814ae69,
-0x9a368b90,	0xbe063af0,	0xc8e466b1,	0x78993bfc,
-0x8d797b93,	0xcb9eeda9,	0xc2320b6c,	0x0043b902,
-0x2eccbc54,	0x48a4e5a2,	0xc218b3ba,	0x488183e7,
-0x3df27709,	0x45e0daf4,	0x6bfe1329,	0x3c518851,
-0xb53c01cd,	0x5b10b2c2,	0xc88f1150,	0x8133965f,
-0x8b16773a,	0x65de9860,	0x5cb18ae4,	0xe61105a1,
-0x4c3f0d28,	0x9189f726,	0x620106e7,	0x0ae5d1bc,
-0x46bbd58f,	0xd7b7b07c,	0x53d82958,	0x2febb95a,
-0x4ffcdd8e,	0x57a046df,	0x3b63f580,	0x463fe2c1,
-0x209a9440,	0x79882a80,	0x5cdadafe,	0x1c7a31ba,
-0x3bf5ca92,	0x76115d65,	0x731a4e07,	0x8f2198d4,
-0x19921981,	0x664f4e11,	0xe1e6022d,	0xc55ec9a3,
-0x758a56c8,	0xc35d3895,	0x7cd59bab,	0x234a3699,
-0x0b5aeeef,	0xfef8ad6f,	0xbd82b866,	0x471a70c1,
-0x7de86792,	0x12f88a2f,	0x031beb63,	0x3660e731,
-0x919853a7,	0x100a8549,	0x14e6105b,	0x3f332601,
-0xf052c2d3,	0x7d8be989,	0x87f54337,	0xbfa644c9,
-0x24dde887,	0x3d69f2f6,	0x80026b49,	0x90739ca4,
-0x3862381f,	0xbf2d9626,	0xe02bd15e,	0x55a675df,
-0xef1839d7,	0x99469915,	0x91cfaf2d,	0x7f94040e,
-0x35db5f2e,	0x1d38d47f,	0xebc93baa,	0x193f516a,
-0xe0b6a8c3,	0x73c5b0c2,	0xd56da2b9,	0x510d7b46,
-0xdab1fc17,	0x1a1c680b,	0xf73644d0,	0xf43258a3,
-0xfc729ea1,	0x17593652,	0xdc9a37b5,	0xc53b613b,
-0x71a648cb,	0xc28af23f,	0x96cde33f,	0x0acd49b6,
-0x2cc90ae2,	0xf2cbef0c,	0x300dbaf1,	0x5110904c,
-0xe0da462e,	0x541d3d34,	0x527c9afc,	0x2bcd7311,
-0xe0d8dcf3,	0x1974fc1b,	0x552345ab,	0x5ddcc35f,
-0x3699800a,	0x47a5f674,	0x7579adb9,	0x8c9ebdb9,
-0xedeaa964,	0x07bf6a14,	0x56b5fc09,	0xd6ae4f7f,
-0xa4427021,	0xdaeffdb0,	0x928631b6,	0x3d6feb97,
-0x592ab6da,	0x943bed47,	0x4e90670f,	0x6eed39af,
-0x558a3291,	0x69676209,	0xe26b1251,	0x45e748af,
-0xd7db0c17,	0x09d904af,	0x5c23eee4,	0x7dce5a88,
-0xaf448358,	0x6d2cc780,	0x94b4e6fa,	0x869a5a07,
-0x3f75da4a,	0x4981f4f0,	0xad2c1bd2,	0xd415266b,
-0x61d4c2e8,	0x9978181e,	0xa614c894,	0x51bb75b0,
-0x697f25bf,	0xbb387310,	0x901fb6bf,	0x7a5775aa,
-0xf4e54003,	0x2337ba70,	0x76dae5b2,	0x1bfe4416,
-0xbfc66700,	0x635a01e8,	0x230e0a21,	0x0647f1dc,
-0xacb82703,	0x233333f1,	0xd089d131,	0xc827d423,
-0x7ee72b61,	0x741576ed,	0x9c684f01,	0xe19af7d8,
-0x4f58f71c,	0xb717d8d2,	0xc6b831b3,	0x5528044f,
-0x96dd56f9,	0xa2a35007,	0xdd261fc4,	0x33397ed2,
-0x53d58350,	0x3b901c93,	0xd323a1c4,	0x5a2ff964,
-0xf194322e,	0x185b3a7f,	0xe0f25f21,	0x7d4e0d38,
-0x00422302,	0x72066cc5,	0x9391be09,	0xd4162cc7,
-0x8ad4051f,	0x73556df6,	0x1588929f,	0xf56e27ad,
-0x50c0350f,	0xa66ff66a,	0x0a1f67e9,	0x068eafc2,
-0x14f5c391,	0x88baa8a3,	0x13170c2a,	0x229a7ea2,
-0xca01ec98,	0x4818229c,	0x54e076db,	0x7c17e80a,
-0x8580283d,	0x6b59273b,	0x24a34b79,	0x6e25f7ad,
-0xccff2b70,	0x53efab29,	0x5d90e63a,	0x9bcd34ef,
-0x71f0da42,	0x18ed41ed,	0x695cbc37,	0x9c7f679a,
-0xc6088111,	0xd9bc46c2,	0xf5cca3d4,	0x20c04383,
-0x791793fa,	0xb7e9e066,	0xfc95fab6,	0x6dd1d554,
-0xbe778ba7,	0x7dec91e5,	0x94024a42,	0x64a1eb3a,
-0xc81a3114,	0x0babf6d6,	0xaa7d38c4,	0x5115e4a7,
-0x9ac88b93,	0x39ae62c4,	0x2acf36c5,	0xb574de96,
-0xcdbdb1a4,	0x413d5bc1,	0xae04a74f,	0xc9832330,
-0x633c6d74,	0xb1b139e8,	0xac763c36,	0x2360f00b,
-0xf30c9ecc,	0xc7ce662d,	0x4f79c584,	0x39edc122,
-0x24cc4698,	0x24e10e96,	0x1809b9c0,	0x3a3f8ac9,
-0xf2fa2e48,	0x376780b6,	0x8efd4055,	0x324d429b,
-0x3f6df8d8,	0x1a0aab7e,	0x9719292b,	0xa8e80f5d,
-0xdfd687f1,	0x1ca45455,	0x4582e3fa,	0xdc769c17,
-0xe4b4b6a6,	0xb3ef5ffe,	0x77c6080d,	0x2c5e8928,
-0xe49b00c9,	0xdb9af793,	0x83882747,	0x5c0bbb97,
-0x6d798b75,	0x3c487b6c,	0xc18aad39,	0x2b33b4f1,
-0xb77e14c8,	0x7e7f60ec,	0x31a7d15b,	0x54f7a3f5,
-0x409be002,	0x4b7d598f,	0x5a55ef80,	0xb0c26a57,
-0xd2c0054c,	0x68ec0a7f,	0x094ddebd,	0xf2cf11b5,
-0x0cdc898c,	0xae7103b7,	0xf73378e2,	0x1bb441a1,
-0xc1d156b0,	0xc3e353e8,	0x51b2d82f,	0x6b86be5e,
-0x24ddfe39,	0x7b57c5e9,	0xabacf363,	0x119b7e41,
-0xf07018c4,	0x4059c66d,	0xd0a259be,	0x436f1d41,
-0x2ad68f7b,	0x06bb476e,	0x8db8294d,	0xc50f5eb3,
-0xb71d28b5,	0x381a0df8,	0xf690b6f1,	0xcbc08020,
-0xf1e69098,	0xbb424bfa,	0x1b74bfa4,	0x2c51dd1c,
-0xb52b4195,	0xad192d71,	0xec1da669,	0x3c93966f,
-0xabab81df,	0x6f5b968e,	0xf170fdc9,	0x0755af35,
-0xc7bf6bec,	0x760ed225,	0x7b7fdedc,	0x54598081,
-0x3e537194,	0x6ecc4255,	0x773d14ba,	0xd2dfe382,
-0x34e94cff,	0x22074f61,	0x75ee7965,	0xd220de84,
-0x032c6593,	0xe375bccd,	0xdb50c167,	0x31a925cf,
-0x4dca17b8,	0xb5f4acc8,	0xb9382557,	0x74de2b3f,
-0x77ecccc1,	0x42d84094,	0xb042f4ab,	0x0b0d19d5,
-0x1d03283a,	0x1c20b9b6,	0xec2db4db,	0x1e90b7ab,
-0x7e6ef7cf,	0x193cbad0,	0x15507944,	0x96a05ff7,
-0xfc634fa6,	0x086aa071,	0x543d4a48,	0xeb25d690,
-0x1af843d0,	0xc4f62d3e,	0xdb5ae34e,	0x1e98338f,
-0xd87d258a,	0xff12601f,	0x48c19218,	0xe4db722e,
-0x218e9377,	0x258c91ec,	0x9cbd58dd,	0x93332ac2,
-0x8a15361a,	0xae807a30,	0x1875bddc,	0x212f38ad,
-0xf60c6c98,	0xce5bdbae,	0x36709283,	0x0e6f5806,
-0xe09d1733,	0x49fea86c,	0x21a34c9c,	0x2e97b2f3,
-0xfe008eb6,	0x4b18fa60,	0xe9989bfb,	0x400fc607,
-0x054d8a62,	0x348c0dd2,	0x85a16292,	0xeb6b16a7,
-0x41c698cd,	0x5fc86abd,	0x48ccdbcc,	0xa02e52a2,
-0x27e186b2,	0x88404198,	0x10fb0972,	0x1a07931d,
-0x53425b21,	0xd8dc8ccd,	0x08a3e7d5,	0xf26a467b,
-0xe24f3c9a,	0xf6eff6c4,	0xa3d0802e,	0x8617af99,
-0xa68d4981,	0x9005a2ff,	0x0999d184,	0x01369b46,
-0xd799a679,	0x64e1fa7a,	0xf0ec5c83,	0x114fd630,
-0x13a8d73a,	0x4515c0f4,	0x465abcd0,	0xdc024d64,
-0x6cc43301,	0xb497574d,	0xaed546f6,	0xef5ae94b,
-0x2fef7571,	0x70defbe0,	0x67847c5f,	0x3fd7e969,
-0x2d5b08f7,	0x0167291c,	0x3d8fbb68,	0x44d83e5a,
-0xae5ea654,	0x78e36f1c,	0x1056ea08,	0xcc791fdc,
-0x72214384,	0xe2037b43,	0xfe2cb96f,	0xaba26e63,
-0x5d9800ff,	0x397fd531,	0xaeaf8537,	0x21872429,
-0x1fae93bf,	0x3fd7906f,	0x34994338,	0x368726ae,
-0x14612ae0,	0x8562d699,	0x688ed9fd,	0x3e0dd4d0,
-0x7ea37322,	0x4da5cb8d,	0xd3ebd8fa,	0x1fbc490e,
-0xf8474471,	0x92cec355,	0xce5e6265,	0x4f099546,
-0xee269914,	0x20232907,	0x2609b2f8,	0x2ade1ead,
-0x972fe2e0,	0x5c57e86f,	0x8cb7c577,	0xfeeae944,
-0x55ca8166,	0x5980457c,	0xc7da1649,	0x11f671c4,
-0xf6fcad24,	0xbb6bedc2,	0x283b6c74,	0x17ec2f39,
-0x773013d5,	0x928c2fa9,	0xcf7b1f8c,	0x4a5d66b5,
-0x92b7cfa2,	0x90813a5d,	0xc9565359,	0x2c8fbbc7,
-/*  1471-mbdf4117.inc  */
-0x00000001,	0x00000017,	0x04222005,	0x00000f41,
-0x326135c1,	0x00000001,	0x000000bd,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x23869663,	0x00e8d132,	0xdfe7a33e,	0x20662972,
-0x6cd78e27,	0xd40cd9d0,	0x1779cf53,	0xda1410b4,
-0x3a7e01d2,	0x2610ad09,	0x466805b1,	0x4f83bde3,
-0x0089c4df,	0x414d55d6,	0xc1a55777,	0x15397290,
-0xbe73c0c1,	0xcd711d83,	0x9582e3fb,	0x4252d42b,
-0x07bc38ee,	0x57e59d01,	0x04340908,	0x0e7ff2de,
-0x73799873,	0xeebd252e,	0x26f35c02,	0x17d52208,
-0x2894111c,	0x02d6a971,	0x0dc494d1,	0xc5d1d4dd,
-0x893e98db,	0x0b2bb463,	0x209dcc8f,	0xe3a0bcb4,
-0x3987884b,	0x4e83a501,	0x10c4fccc,	0x33523a90,
-0x5e38588e,	0x741f7b18,	0x7bef6e37,	0x977ba083,
-0xcc550f6b,	0x3c7b4752,	0x69965735,	0xc2a368ff,
-0xeb8a4b75,	0xc28e6d6a,	0xc08bbd99,	0xb3188777,
-0x24132a22,	0x9a9f1f71,	0xfeab84ae,	0xc1cdb604,
-0x6f92eb4d,	0x3085955a,	0x1a7c51b4,	0x3193aedf,
-0xd0fdb9c9,	0x8f858301,	0x048559dd,	0xffebc1ed,
-0xdb71cba7,	0xa1df624b,	0x3c62de85,	0x7a086a76,
-0xa1472fba,	0xce1e2869,	0x27a2565c,	0x419dc5fc,
-0x501d9451,	0x03246b66,	0x210061b1,	0x0348d26b,
-0x2a3802bb,	0x351f903b,	0x968b209e,	0x12dbeeaa,
-0xdb1205b6,	0x5332993e,	0x280dff0f,	0x9147408e,
-0x807cf7cc,	0xd6ed0e2e,	0x4a073f0f,	0x24432e3c,
-0xf449f9b9,	0xc1ecf004,	0xa231f7fe,	0x15e6d179,
-0x44971caf,	0xdc68da09,	0x0facd5af,	0x80161743,
-0x9f675525,	0x30aa65e9,	0x7de3e032,	0x0018a0fc,
-0x7236ffda,	0x4f6d6cae,	0x5c9af30d,	0x0552799d,
-0xfa729385,	0x71947988,	0xb8aec61f,	0xba7e2e2b,
-0x7e65c8e1,	0x6016f7ee,	0xbbbfa2ea,	0x59898d30,
-0xcd0ac559,	0x8527d33c,	0xaf9a15e7,	0xae9b044b,
-0x4ce02b95,	0xe299e65e,	0xf30b8fb3,	0x4d18b4b7,
-0x6783a7d3,	0xa0c9955b,	0x52ad0b6e,	0xb78b3173,
-0x24b4b551,	0x9a291645,	0x19d57d22,	0xbae5c7ae,
-0xe82e6e2d,	0xe10be39c,	0xc2d26e7b,	0xb26b1e8d,
-0x97471f7d,	0x5f405fa3,	0x658987f9,	0x8a90f2aa,
-0x5dc6c0b5,	0xfd9b5b1a,	0x3d432314,	0x48ce4ea8,
-0x26d0097f,	0xcdcecc97,	0xd0a0eea3,	0x5f0690e5,
-0xf40dd231,	0xa3c71707,	0x00059355,	0xcb0badb2,
-0x23fb63f1,	0xa10bec29,	0x9fdb03ae,	0x1f85dc9f,
-0x3cec03e9,	0x0377e06f,	0xf256e7ad,	0x1a2db020,
-0xae97d2f4,	0xb20c0106,	0xdcb02aa6,	0x486feece,
-0x29487f07,	0x0c934081,	0x820aae29,	0x05405e2f,
-0x34a068da,	0xde1c956d,	0x931b128d,	0xbec61127,
-0xb89b8162,	0xf4adcd12,	0xdb3452e5,	0xfaf11e6e,
-0x4ef489bb,	0xb9048451,	0xa8d986ab,	0x283aa33e,
-0xb8f607d9,	0xcecc2f8f,	0x8b669cd4,	0x5de9d03a,
-0xd809a9de,	0xe6ca7747,	0x0b0c9e20,	0x04199433,
-0x4e2f4502,	0x1c68f178,	0xbbb8bc13,	0x1390c017,
-0x5dd0c688,	0x45211e3b,	0xd20bf653,	0x58e4567d,
-0x330f3b7d,	0xf4f1b03c,	0xfbdb0014,	0x95883876,
-0xf811c78f,	0x30feceba,	0x6a822ece,	0x0c1f28a6,
-0x21e86bf4,	0xa91ca6f1,	0x06a534ef,	0x4fa941d5,
-0xa1e22f33,	0xa4438b88,	0xa0313dbc,	0x38ac3733,
-0x5e772ea0,	0xb319576d,	0xeeac02b5,	0x590c55ce,
-0x963f15e1,	0x77281f33,	0xd59ce20b,	0x5319c529,
-0xa5ac445f,	0x084980f5,	0xa6476003,	0x59d085ca,
-0x08f98cae,	0x7738f971,	0x01fa8642,	0x91576241,
-0xdf826f04,	0x5b0ac434,	0xb05daac7,	0xcc4c8a31,
-0x7dffeb94,	0xcbc8da3f,	0x6b27c0bb,	0x429855d4,
-0x2fc6593e,	0x0b098e3d,	0x4b356bc8,	0x1e7122c2,
-0x0bafd085,	0x9b2e343c,	0x24259ddb,	0x27335804,
-0xa4cc06ea,	0xe7e99bb6,	0x093a860d,	0x3bb00ca0,
-0xdfbb59d3,	0xc7375b12,	0x3e1afd3d,	0x21e34603,
-0x392dabfd,	0x99caf016,	0x9c95d368,	0x117bea69,
-0x900c4a4f,	0x8a1b3c5d,	0x7220d03b,	0x1f721f5f,
-0xa31174b4,	0x32a2133c,	0xfb6e3be7,	0xe835f4a6,
-0x8e09663f,	0x45b64191,	0x852dd810,	0x494e3205,
-0xdf51bc7a,	0x35b9e273,	0xad98417b,	0x09fd7867,
-0xe2c9824a,	0xe3b21ebf,	0xc99982ac,	0xcbe639d7,
-0x7811c1ff,	0xe1db9878,	0x0fe74cfc,	0x94576c2e,
-0xb719ca45,	0xe0960f65,	0x4e421a9d,	0x9c6b061c,
-0xabde24d7,	0x0fef5a7e,	0x11544d8d,	0xed6f9b35,
-0x8a612f0f,	0x3f5bd220,	0xf8bcfcd9,	0xa8b85029,
-0x8ce1adc1,	0x8f4f2a35,	0xa4bc2c91,	0x29effaa4,
-0xe7ca6c38,	0x89687497,	0xd76c755e,	0x6abacc63,
-0x18f95328,	0x084d2732,	0x2b99c8b5,	0xa5cc679c,
-0x7b39f528,	0xf6d22d1a,	0xe282cff1,	0x4f84e4a4,
-0x44adb6e4,	0xde9b104c,	0x79df1974,	0x9c08a94b,
-0x29b676df,	0x42a9c9eb,	0x93d86764,	0xf4db50c6,
-0x3b22b62f,	0xabe76510,	0x92fc7279,	0x0e65b57e,
-0x53c0ad78,	0x77181939,	0x059de191,	0x0fe04ba5,
-0x83407676,	0x2ec98625,	0x7b16e66a,	0xe760fe12,
-0x4a5ad3dd,	0x5fe3dfe1,	0x9799dfd6,	0x2453a5d6,
-0x2b3c15e0,	0xa00b7248,	0x4caf83aa,	0xd56333f4,
-0x3b28e188,	0x5fec6905,	0x5602272c,	0x11a880a3,
-0xd863707d,	0xe13d30b9,	0x3fac9971,	0x03974a6d,
-0x16a977a8,	0xa29ab4ff,	0xbcbca489,	0xcb80d6e8,
-0xaac55951,	0x04df40a2,	0x778f6d2a,	0xfb71f60f,
-0x97cf473c,	0x6f11ce3e,	0x81657389,	0xe8393417,
-0xe9a71afc,	0x7191f0da,	0x956af1dd,	0x5f354bdf,
-0x37e3ad81,	0x633eca08,	0x612c1de6,	0x6e5f888a,
-0x42f19871,	0x4d4804d5,	0x4c3c7e51,	0x66f1c539,
-0x85917f9f,	0x6f602a12,	0xb762f892,	0xb58fde66,
-0x95698716,	0x7bd33b3a,	0x71a0136b,	0x828d78eb,
-0x1b364f9d,	0xae6ae3e9,	0xa689ef5d,	0x814c6105,
-0xd5bc7ba6,	0x57188df0,	0xe7ee2de3,	0x1070ad06,
-0xf19f135c,	0x7a1cf2f7,	0x095d27c8,	0x13adaf91,
-0x7310274a,	0x61729379,	0x40c1410e,	0x7a04fc6c,
-0x2dc6062d,	0x24454bb5,	0xd70f2135,	0xb132a185,
-0xeff2dbe2,	0x343ca212,	0x20089805,	0xbd50064d,
-0x9475a4ea,	0xb501a35a,	0x9ed4e634,	0x54e7868b,
-0x1452657b,	0xa1d55fe2,	0x5d45664c,	0x1f92f7dd,
-0xcd2ee2b2,	0x72810ade,	0xacd6981c,	0x74d97c68,
-0xc6197d01,	0xc1d7d1b5,	0x1b889832,	0x00377dc1,
-0x35dcb606,	0xbc3a6152,	0x5556fd42,	0x3b396140,
-0x069370e1,	0xf97b8f48,	0xd8561936,	0xee9aef0e,
-0xec80b07d,	0xc280b8c2,	0xc42f9d65,	0x40c3cd24,
-0x7accc51d,	0xf5e22954,	0x5bf9b798,	0x8f5b4d13,
-0x74c3977c,	0xa243da07,	0x244dcc57,	0x977fec01,
-0x12bf785c,	0x04b643f3,	0xbb211a93,	0xa0764ff7,
-0x14101e55,	0x7f3da5e2,	0xb0b46e28,	0xdb616566,
-0x70c0e0ed,	0x4565f1e2,	0x1767f652,	0x213f966f,
-0x754d4868,	0xea9172e8,	0x8ad24070,	0x9b7737f9,
-0xa57de77d,	0x6de0b195,	0x7ffa9709,	0x56255daf,
-0x85a3d4c4,	0xdc1ab1d9,	0xfbc7e65c,	0x69ea2ea0,
-0xef496f2b,	0xc8f74d6a,	0x0649b66c,	0x28d5eb58,
-0xb44d4758,	0x0e6aae11,	0xd400b41f,	0xc7273115,
-0x7e0d9a8d,	0xebfb62e1,	0x70ba546f,	0xef81f10e,
-0x807f730d,	0x9c73c748,	0x37a1c985,	0xa2b4aa04,
-0x2e932351,	0x5cd11c91,	0xc2b6535a,	0x622288f0,
-0xd6b63e54,	0x9f6d5906,	0xa4c82f56,	0x8ce3e118,
-0x26b47bbf,	0xf936e888,	0x3c4474fa,	0xb4211d0d,
-0x5c2ec780,	0x0557c1a0,	0xfb935e8d,	0x08d27a00,
-0x962e7dd0,	0x0867960e,	0xdd1e3553,	0x3b9b9682,
-0x441a234d,	0xdf94804c,	0xe97e180e,	0xad7ae7b0,
-0x4afc08e6,	0x589c6b7b,	0x82ed0c1a,	0xffa3707d,
-0xfc2b487f,	0x7a73bfcc,	0xba9f22b6,	0xae7fa5d6,
-0x1eb7c8bc,	0x10642385,	0xe8f51462,	0x09b7d40c,
-0x40d7818c,	0xe740cf46,	0x55b0c2f3,	0x5b82bfd6,
-0x8449a7d9,	0x5a1848db,	0x77c228ec,	0x7d78b419,
-0x460e05b6,	0x45077372,	0x1e134121,	0xc37451fc,
-0xcd734d9c,	0x2596fced,	0xd00922e1,	0xabaca36d,
-0x76ae1209,	0x2be64d6c,	0x2ba81270,	0xd0845d0b,
-0xa9297e7d,	0x8842f686,	0x428eb289,	0x56472cdd,
-0xe61e1789,	0x26980ff2,	0xf44f3dd6,	0x7efa0c9a,
-0x669de28c,	0xef70aa5a,	0xf841c6ec,	0x46c4bc78,
-0xf813386c,	0x75043cc9,	0xd1817d6a,	0x4788bcf6,
-0x97aee340,	0xc1ffa0ba,	0x4fbda2cd,	0xa937850a,
-0x08a6d5b6,	0xa65b0ac8,	0x85647fd1,	0x947e8577,
-0x4d348f3e,	0xfedf809f,	0xf997c620,	0xfb02f089,
-0xac7f842c,	0x7b149778,	0x119dcb7e,	0xa5906986,
-0xc87563c7,	0xa83e6971,	0x02de6124,	0xe070678f,
-0x80662c65,	0xb004287f,	0xdb531a75,	0x4b2c5dc1,
-0x5b3648e1,	0xfe64276f,	0x909e6930,	0xb3fa82ab,
-0xfc336690,	0xac665252,	0x37728038,	0xd96c32ba,
-0xa9ac3198,	0xaefbed90,	0x44742af3,	0x32a4b131,
-0x357b46bc,	0x2262bdfd,	0x4a9068c6,	0x8aa11f53,
-0xa4a86547,	0xb484cc27,	0x34779665,	0xe3655ad9,
-0xd0255644,	0xf14cb46a,	0x090b0aa4,	0xd84210ca,
-0xe59b6bf7,	0x8a80142c,	0x4df8652f,	0x1ab22298,
-0x993cdbc5,	0xd3a43828,	0x980636e6,	0x132d53cf,
-0x84477fc4,	0x95e84ad4,	0xa04cb613,	0x5bfd0eb6,
-0xd53f46b9,	0xe7b3e64a,	0xeab5fce8,	0xcf4106de,
-0x2f0464fe,	0x941887f2,	0xd7ab411d,	0xbcd268b1,
-0x6494d150,	0x54eca2b6,	0xdef87a80,	0x7bc5ad6e,
-0xde75507e,	0x10f4ee75,	0x295d3e70,	0xb021f568,
-0x5b3b7a6a,	0xa18e69c5,	0x8014d58e,	0xa1d847ba,
-0x7ea65405,	0x472469c2,	0x1d438800,	0x6a58e959,
-0x4a4343d3,	0x9bcfc24a,	0xdb4515d0,	0xc9803b9b,
-0xa0c781ba,	0x97425f38,	0x0e9fed84,	0xbddbb90c,
-0xf4242ae4,	0x039500ee,	0x99976b17,	0x714d0fb9,
-0x85181429,	0x4e22a22f,	0x4165f667,	0xb45a6de5,
-0x34967e7a,	0x9bbf9e9e,	0x28b027fd,	0x2780aeff,
-0x6ec6c288,	0xcd1d011d,	0x0c88c54f,	0xbd0bfb5c,
-0xd40b63f4,	0xb5c783da,	0xa4b39929,	0x6cbb4a21,
-0xa2c2c897,	0x86703c38,	0x15408e1c,	0x133ad235,
-0xf51d1371,	0x848bcdde,	0x9b7eecb5,	0xba2ca677,
-0x39871164,	0x7065d811,	0x5dd770e7,	0x5a732dbe,
-0x58e6461b,	0x2a2c51b9,	0x703062a9,	0x545ae881,
-0x0860f6f3,	0xc7e29228,	0x9fc59c61,	0x881ebef3,
-0xab2a061f,	0x82b3a4d5,	0xe799e152,	0xd618faba,
-0x6c2e4d18,	0xe4611bce,	0x5587717e,	0xfcc0cb92,
-0xa6207512,	0xf2ff1ffa,	0xba269d1f,	0xc1879edf,
-0x38359369,	0xcb684db0,	0xa773b9e0,	0xb57257ed,
-0x587b4b47,	0x6e151398,	0x2667424a,	0x261a6a40,
-0xffe3291c,	0xea0b7369,	0x70ac567e,	0xb39b49b1,
-0x725a77ca,	0x2507206c,	0xc8ea7a60,	0x5dd5ec2d,
-0xfb5ce938,	0x987b290e,	0xce6147b6,	0xf34a8acd,
-0x125328ac,	0x94866e32,	0x4ad59e55,	0x8a0b7aad,
-0x45658446,	0xb4f695f0,	0x189a0160,	0x38b762ce,
-0xf643a8a6,	0x657d6d88,	0x2441f0a7,	0x88653b45,
-0xa28826fb,	0x975c1e93,	0xb5aabf28,	0x53f9c1ce,
-0x36ece683,	0x0f67fbbe,	0xb4ea726c,	0x86e0f6bb,
-0xd8f360f1,	0xdb0e2f10,	0x14e46bd8,	0xd0883022,
-0x6ab0f8ca,	0xa99711d7,	0x4a9451c9,	0xef26029d,
-0x7cd5ecea,	0x593f2587,	0xa39b410f,	0xcc3632f2,
-0xd03d3ef3,	0x237eb7c5,	0x3a657ab4,	0xfc573ed6,
-0x9dfb6f5f,	0x5b710f01,	0x551566bc,	0x1eccdcfb,
-0x3d07c680,	0x438b4075,	0x4bb302d2,	0xa90659bd,
-0xe642c00f,	0xdc7e938a,	0xcc399534,	0x52f2e704,
-0x4420520c,	0x19f02d49,	0x9e2d5d8a,	0xb4c3fbaf,
-0x29ae6509,	0xae021764,	0x832077fa,	0x71d419bb,
-0xa746b3b2,	0x76362de8,	0x41bd6436,	0x08056245,
-0xc0d11c06,	0x644228e2,	0x205f55f6,	0xc40d4159,
-0xb8b2df85,	0x2d734c2c,	0x0ec55443,	0x02d288c1,
-0x927d91a0,	0x1e627cd2,	0xca3a1913,	0x8f42cfc1,
-0xedf0d71d,	0xea9fc128,	0x0db7f256,	0xf03eba20,
-0x176357e1,	0x98163efd,	0xd6031ee2,	0x4b41108e,
-0xf99f6036,	0x9ea730af,	0x82a1dd96,	0x1991bd12,
-0x1aceee34,	0x63668a06,	0x4c0ad9b4,	0x31386049,
-0x931f18d1,	0x0fe7c51e,	0xa4865238,	0xed7c8953,
-0xb5718a5c,	0x5092df33,	0x006c9d17,	0x405bf78b,
-0x522c1765,	0xd849eb2b,	0x4d50ddfb,	0x90e2514a,
-0xd7a1e43f,	0xda6ea0d4,	0xf22b2b11,	0x63b6df32,
-0x85e1f6c7,	0xd1365d03,	0x6ac62a81,	0x92693068,
-0x56ef2428,	0x49016a53,	0xf752d088,	0x128bc866,
-0xf823c05b,	0x6d8ad85a,	0x47f92649,	0x765b66db,
-0x7b14fe51,	0x01edf60a,	0x54410699,	0xc9cc530d,
-0x275fc862,	0x278f39e1,	0x3fc980a2,	0x475f079e,
-0xa53c5026,	0x3fe3b777,	0xc8f92b5c,	0xddfe54d6,
-0xdb13146f,	0xde1a74f7,	0x7e2e8043,	0x5fb7ff54,
-0xe2cbe801,	0x4c50f3af,	0x0ffaeed1,	0x025b1fce,
-0x2273faf1,	0xc8955ff7,	0xe5068c37,	0x42f6c6cc,
-0xefed1e37,	0xc4e66e60,	0xc4a6eb63,	0x59078dc6,
-0x9529dfe9,	0x81abad48,	0xa2eeee30,	0x718d1194,
-0x9023695e,	0xbfcee06c,	0xeccca3f7,	0xa051fdd5,
-0xe91f7002,	0xba818c9d,	0x7bda4201,	0x73e5a202,
-0xa9042251,	0xe4106c9c,	0x1ff5133e,	0x36d74e84,
-0x38063048,	0xa2804700,	0x27c20e05,	0x5e20cd58,
-0x1539dfa1,	0xfa08d141,	0xc2215a49,	0x74f30566,
-0xb4ff34e5,	0x99873de9,	0x7599b6a8,	0xbbd40d02,
-0xd9ab39dc,	0xa7551850,	0x37436dab,	0xed55d20c,
-0x3f4f0041,	0xf0ff7466,	0xf7e67c8d,	0xb1406f22,
-0x4e43c13d,	0xb52500e5,	0x985ad53f,	0xa4b3825c,
-0xde2b9106,	0x365dcbc1,	0x77014217,	0x169c12d3,
-0xc7bc869d,	0x922a8043,	0xa6111e23,	0xe74b2290,
-0xa3e2410c,	0x33422d46,	0xe1dacff9,	0x3c979ea7,
-0x3697c0cf,	0x96c88610,	0x1832e947,	0x7f4d65ce,
-0x2cd5ed28,	0x0c1cc240,	0xf61265fd,	0xa64afca8,
-0xe4860c99,	0xa43857cc,	0x616e9a5c,	0x9365866a,
-0xa5549228,	0x20aa24ab,	0xd7bb6e6f,	0x9dbb3e25,
-0xf01b507f,	0xe9b649de,	0xd84e3324,	0x6424df6e,
-0x77bbcd8d,	0x45d9deca,	0x281c8229,	0xe603463f,
-0xd585f541,	0xbf51f6dd,	0x3e3aa065,	0x12635f25,
-0xfe224cfe,	0x0385cf5d,	0x4efe873a,	0x18da5b1d,
-0x0bcdeb2b,	0x8a59c122,	0xf2593715,	0xdc22685c,
-0x2c38f3ca,	0xc0b46ae2,	0xf5f103ac,	0xd17462a6,
-0xb9d9ee2a,	0xb40e6d75,	0x9d355887,	0x0099c8ff,
-0x06b6f634,	0xe4dc43d0,	0x2623a7dd,	0x34b9ad51,
-0x718107ce,	0x8ad0b008,	0xe69e21da,	0xc1d47860,
-0xb444246e,	0x2abb0323,	0x43ea237b,	0x170bf5dd,
-0xeba9eead,	0x28d02fd5,	0x7b4f22d0,	0x51d4728a,
-0xa9954103,	0x04b9cd77,	0xa72da2bb,	0x74330b0f,
-0x56c741c4,	0x039c62f4,	0x3c665ea3,	0x047b5cc8,
-0x64a59471,	0xe9281c9d,	0x894b630a,	0x793e34eb,
-0x68d7df44,	0xc94404ca,	0x1856ad8b,	0x18f3f6de,
-0xdc902798,	0xc3814844,	0xa9e068f3,	0x6769998d,
-0xf12a4119,	0x909a97ff,	0x842432ec,	0x08aa7af1,
-0x8858e492,	0x4ada49fc,	0x178f173a,	0x5991554a,
-0x9c907487,	0x55b1c638,	0x72a1a06a,	0x19980cbc,
-0x65ddcaa9,	0x260703b5,	0x8c60404e,	0xdc4402c8,
-0x83977bda,	0x1031a065,	0x5d3a24a8,	0x8861eba0,
-0xc09e3951,	0xbd631bdc,	0xd7282286,	0xe32380c8,
-0x50b2f198,	0x4def47b8,	0xf94a521a,	0x8f9a8a29,
-0x1a7e6413,	0xa2302de3,	0x7348be92,	0x3857be1c,
-0xf54dd509,	0x61411ab0,	0x35b34232,	0xdac05cb4,
-0x5d9b0a8e,	0xde69a9bf,	0xbeea5edf,	0x34040ad9,
-0xa115587c,	0xbb18d1c7,	0xd07a996d,	0x80289a3b,
-0x0fd58e87,	0x4e6aff16,	0x47ae69c0,	0x87e6328a,
-0x87adc8ab,	0xaffde7c4,	0xada1fe8d,	0xf7a299d6,
-0xe69bb375,	0x36f49809,	0x66c2f884,	0x4a8aedd4,
-0xc7fd1fb9,	0x01c499c7,	0x2faa2ff4,	0xe821423c,
-0xcb6bb413,	0x90fde54d,	0xf09ee30c,	0xa72913bd,
-0x16b07378,	0xccf225f1,	0xebb20fde,	0xb0524d99,
-0x1b9faf3b,	0x10122a9c,	0x2ecdff53,	0x993fd223,
-0xe6fbdf1f,	0xaaa23e5b,	0x5629d1c7,	0x134f537a,
-0x51323cd1,	0x67f4e421,	0x8d1dd2b8,	0x6be7a601,
-0xa658f134,	0x00cb82da,	0xfbb719d2,	0xa9d91f11,
-0x3fe4a8e7,	0x71887197,	0xd77f5c3d,	0x53c80ad9,
-0x0b6045f4,	0x1d4cac3a,	0xa3c6608d,	0x47be3319,
-0x5f3aae36,	0x378b6c69,	0x89d8d004,	0xdbf1a13e,
-0xdb25ebe5,	0xa386553a,	0xe5ebc1e7,	0xd8151054,
-0xbb0b9127,	0x63685e1b,	0x9356bef2,	0x6c945f61,
-0x6cf55ba4,	0x00db0365,	0x15a63c01,	0x787dcafe,
-0x43d75560,	0xd86eed95,	0x448bc692,	0xb1d487c1,
-0x320edd3b,	0xa3510418,	0x1adee6c4,	0x6ea34c19,
-0x0bdfa30f,	0x30c0f341,	0x01ff2f2f,	0xc356cdfb,
-0x0e6ff905,	0x9b4d411f,	0xa15429f7,	0xeee0f2cd,
-0xfb6b526e,	0xdb6d9e90,	0x10226e12,	0xc5238a39,
-0xb40f0884,	0x11a91802,	0x7f1636a0,	0xba658b3a,
-0x68a9c80b,	0x3f2316c8,	0xfb8fb0a6,	0xe7c33636,
-0xcbc8d632,	0xf058c218,	0x6c2b7525,	0x3ca42916,
-0x39099c3a,	0x1321f3e5,	0x9e0e6344,	0xaa75d386,
-0xe28b580d,	0x0bdb47fd,	0xd8e31aa9,	0xd8b4b204,
-0x388f1bff,	0xb92772a8,	0x2350fe36,	0xd105108e,
-0x2d322d69,	0x9661e811,	0x46a855fe,	0xe2507c81,
-0x168b0831,	0x6bbe4600,	0xe5ab19c9,	0x6e8cb822,
-0xe6ce419a,	0x7b055119,	0xf1c9b63b,	0xca49b674,
-0x95932012,	0x3e533453,	0xb0c6cb70,	0x94d7fd13,
-0x23635019,	0xdd58d8ac,	0xaa9cf0c3,	0x455bef11,
-0xc1ef00cd,	0x7c92a95b,	0x8252da9f,	0xe63bac5c,
-0x6761159c,	0xaa67963b,	0x7c25cfd1,	0xebd59104,
-0x71967969,	0x32a90da2,	0x37d83045,	0x77041b1a,
-0x0e9e3947,	0xab904b5e,	0x6580a40e,	0xe199dd34,
-0x7f9bb7fa,	0x39aab849,	0x036ad852,	0xb7d2af89,
-0xc5ab8c67,	0xe52885df,	0x9c816e4d,	0xb4a6bb8f,
-0x2e4b0685,	0x09eeedca,	0x3d89a745,	0xc49c8e42,
-0x470628f0,	0x3845dc7f,	0x0ebbe8b4,	0xb2ca084e,
-0xafc2b33b,	0x2b29a5ac,	0x33c2057a,	0xb0aaa36e,
-0xdbaaed25,	0xb3f80759,	0x66dd388a,	0x1c05fc93,
-0x0707a813,	0xd6d8ae75,	0x86fbdceb,	0x088f91db,
-0xb802193c,	0xf983a7d9,	0x9b3b33ed,	0x2d8672e0,
-0x3b13e330,	0xe88b879a,	0xb1fcfdc6,	0xa006850e,
-0x7a2f3943,	0xff94d1bd,	0x2e41b7b4,	0x5858ff11,
-0x62910311,	0xc03124a1,	0x4c9ab497,	0x8b6cf246,
-0xc9ac4856,	0x058b1cf0,	0x094146a4,	0x21b34465,
-0x3bcb5453,	0x90d6022a,	0x28190001,	0xf18f2280,
-0x8fad8551,	0x65113513,	0xe192bd6c,	0xa2cfc9ef,
-0x21c4f033,	0xab4f34fb,	0x224eab9e,	0x899edf52,
-0xd494af2d,	0x1ce1600f,	0x7bc0e2cb,	0x4f49e6f0,
-0xb8fbe79f,	0xc9c91b53,	0x025585c9,	0xd1d81072,
-0xcbcde043,	0xc94d077b,	0xb164efee,	0x7156806b,
-0x86699184,	0x75f514cf,	0x95bee913,	0x96fbbf85,
-0xb37760b1,	0x9665d6fa,	0xb27ec974,	0xffa844d9,
-0xc2cd368f,	0xd608dd3c,	0x0144c468,	0xff855bda,
-0x38b722ab,	0xe0d03d11,	0x481f7936,	0xe333cebc,
-0xab099835,	0x4916bd84,	0x94976044,	0x7d444113,
-0xfd7138f3,	0x3aab1781,	0x353ee8c2,	0x3f3b258c,
-/*  1729-m206ec54.inc  */
-0x00000001,	0x00000054,	0x05012006,	0x000006ec,
-0x7066b518,	0x00000001,	0x00000020,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x7eb963a3,	0x81dd6ce0,	0xded19ca6,	0x9c4c547c,
-0x4ffe6333,	0x9daea9fc,	0xa99d0e45,	0x40d831fb,
-0xc34a48c9,	0xe99943f1,	0x3eb82749,	0xc27adb97,
-0xceb7ce90,	0x2b9fd70b,	0xfdd8cd48,	0xf09bfba3,
-0x0a802e3f,	0xff791e57,	0xd904a6e1,	0x019baa1b,
-0xf06cac6e,	0xc1b92ca8,	0x018a122c,	0xd022163e,
-0xf53aee44,	0x1f932932,	0xe02dd579,	0xca667ac9,
-0x097489dc,	0xe9a6a13d,	0xd55d5d8a,	0x083e1325,
-0xda6c517c,	0xdd28a452,	0x08cf5296,	0xeffe1b21,
-0xebb0eddb,	0x10a96bd1,	0xf23ee356,	0xf70db5c0,
-0x21794b89,	0xe0780e67,	0xd53c387c,	0x2764b1de,
-0xefa8b543,	0xe7c2a535,	0x109bab7f,	0xc3258ea4,
-0xf81eb5fb,	0x264b114c,	0xe8cdad74,	0xc9286033,
-0x2efca9e9,	0xddaf486c,	0xcb174b77,	0x1247cc43,
-0xfc2a5940,	0xd92e965c,	0x298b9cc6,	0xe94519ff,
-0xe9a46566,	0x122a2564,	0xe842bae5,	0xca3cecb0,
-0x0877d766,	0xfc6c5c03,	0xf3c8e775,	0x23cb6009,
-0xdf125f99,	0xf2329969,	0x006cff15,	0xee305a0b,
-0xcaf81e1c,	0x25023329,	0xf5dc3edc,	0xf9ef7bd8,
-0x3f0ba575,	0xc3436132,	0xceca9997,	0x2752a329,
-0xe23a8359,	0xca98871a,	0x18a4219e,	0xdb578317,
-0xe712b71c,	0x3f8acb1b,	0xc8e5a45a,	0xd02a30ba,
-0x246db19d,	0xf01fb657,	0xc98be2a7,	0x0492afea,
-0xd213d7c1,	0xf13b6a40,	0x080a9753,	0xdce3ee84,
-0xc6701e00,	0x3d8b83af,	0xfd65eae8,	0xd198b88f,
-0x1ea955da,	0xc17869b5,	0xdab97efd,	0x19ee3b16,
-0xdae564c1,	0xeb37f38b,	0x07e58300,	0xd1769fd8,
-0xd36e6b01,	0x1458ae64,	0xdff50ee2,	0xe7b8a0cc,
-0x10e2f1cd,	0xf65cbaec,	0xdce4985c,	0x385f8c59,
-0xe6891614,	0xe9671703,	0x13b1ec37,	0xc87574ec,
-0xfe6459a6,	0x31d69428,	0xe6be49e9,	0xfcb184d6,
-0x3c162b7c,	0xc00e5aed,	0xc7e499e5,	0x137f142d,
-0xc2fcf099,	0xd1ebe28e,	0x2b894a14,	0xe065c15c,
-0xc2d3fe1b,	0x35b6e732,	0xff0c845b,	0xf0bf2cb9,
-0x37949535,	0xfc1ba418,	0xe9c0032d,	0x20979496,
-0xeb788c37,	0xccd207ac,	0x19314352,	0xe10c8803,
-0xe15cb069,	0x1c4cc4f1,	0xe82520bb,	0xee079d0a,
-0x38f8c902,	0xd71f01ca,	0xf96c962f,	0x1d4ceefc,
-0xeb6ac91e,	0xd2edee13,	0x2b87dbda,	0xc384d473,
-0xf150d06a,	0x2c35b9ea,	0xd748c5fa,	0xf5fca164,
-0x1f12ec1c,	0xcaec1b94,	0xee804b73,	0x2473054a,
-0xd6c8f0b0,	0xf37be591,	0x03a0286b,	0xe921dcfd,
-0xe72d930f,	0x3fe6f577,	0xcf313d6e,	0xe2cd5600,
-0x19a40963,	0xe3b8bd53,	0xd12fcbc0,	0x1c524f54,
-0xfc962e75,	0xc6bf374d,	0x0d279bd4,	0xd1e9a9dc,
-0xee6df719,	0x3c1c00ba,	0xee84e9af,	0xc26bcd8d,
-0x39f9e540,	0xe1bb00cd,	0xd6bfe547,	0x39bf3cf0,
-0xede94eae,	0xfd35a58d,	0x342980f1,	0xc2f13c69,
-0xf3de750f,	0x19d4ce33,	0xe7281dd1,	0xcaa95c41,
-0x06009f38,	0xdd0701be,	0xf16eef09,	0x2057029c,
-0xfa21d9cd,	0xedef9e92,	0x11613b80,	0xc21b530c,
-0xc93e1b91,	0x040c3c7e,	0xe6a5034a,	0xc35698c1,
-0x234312bc,	0xeb973380,	0xe49f9be3,	0x30d1c4f1,
-0xed6ea0d7,	0xc3e53fe5,	0x3ae32a8a,	0xf28645eb,
-0xd25319ce,	0x0727a1e9,	0xf18a0847,	0xde33d5be,
-0x14ffc09a,	0xeb576096,	0xcebed8f7,	0x39785123,
-0xc6e0f876,	0xcccd1012,	0x083db8e8,	0xf94dfd51,
-0xca0148ee,	0x0bcd5dcd,	0xe91a2e5b,	0xe71b0114,
-0x339c7fd3,	0xdf613b74,	0xd64ea5f6,	0x00d6e01a,
-0xe808f9a8,	0xc0379384,	0x2ce3036c,	0xe2fe6128,
-0xe8a18034,	0x18629142,	0xdccee5c7,	0xe09f0032,
-0x0e56e9ef,	0xef8175b2,	0xfbbe46e3,	0x32873857,
-0xfb0ae3ee,	0xcabf9ed6,	0x263fb334,	0xecc12cd2,
-0xe0c8ca53,	0x20931272,	0xfe8cf541,	0xf7fbc330,
-0x112dce0f,	0xebaba8be,	0xdb6a70f1,	0x3bb2e1bc,
-0x05fe41e3,	0xada99f4f,	0xfeaf9273,	0xcf6d224e,
-0x6f74dd5b,	0x8efc5f0b,	0x9e3d81d6,	0x25688996,
-0xec1a4b43,	0xb887821a,	0x57dd51ce,	0xcea136d6,
-0x922b06ae,	0xe90a2e9e,	0xf0fb5663,	0x14ef903f,
-0xb82b2648,	0x473ebf75,	0x5e2881ad,	0x1eb3eb2a,
-0x22c908cb,	0x0591b48b,	0x75786d01,	0x7716ce83,
-0x6fa0c4e7,	0xeb07296f,	0x26c4cbdf,	0xe87fd440,
-0x80b5bc52,	0x3c2bbe8e,	0x88baf3eb,	0xbb75827b,
-0x6787c1f4,	0x058a1709,	0xd20fffc2,	0xefadbcb8,
-0x4e33d4f7,	0xe2dc63d1,	0x82a16652,	0x48ddd35e,
-0x83d68dc5,	0xf283487e,	0x22a4de17,	0xda737420,
-0xb511af3c,	0xc8da4db9,	0xaa66d26b,	0x6358d7e8,
-0x87edc315,	0xcaf677aa,	0x051173ff,	0xf9af3986,
-0xbaecfc1f,	0x50aaa6fe,	0x8218279b,	0xc7ccbf19,
-0x1a189bdc,	0xa59d6fe3,	0xbb6ab89a,	0x386b0f33,
-0xe65806ee,	0x77350f4e,	0x7b96347d,	0x30f884bb,
-0x2a9cf131,	0x5c51bcdf,	0x40591bb5,	0x09b1925e,
-0x324110d1,	0x342fb61f,	0x41195e06,	0x4f03e5c0,
-0x5f2ec6de,	0x95edab63,	0x3ba1cc1f,	0xaefc968b,
-0xdf3aa8cd,	0xb45a1792,	0xdd5b082e,	0x43b93457,
-0xc11483c0,	0x1aed0de6,	0x07e160ca,	0x008f124e,
-0x698658b5,	0x5fa5fd4b,	0x6519640f,	0x01e19188,
-0x3984d06e,	0x4c8f4323,	0x557c2538,	0x367304dc,
-0x37c7be20,	0x28d9b35b,	0x41a9fa8f,	0x56f9a901,
-0x67302c0d,	0xb2119a44,	0x2690f978,	0x813c38ee,
-0xb451b685,	0x275f26ba,	0xa0b50c03,	0xba392957,
-0x13b4c8c1,	0xa247af5c,	0xb934e263,	0xeda8c83e,
-0x80dbded3,	0x06d66181,	0xe5b9216d,	0x02acab4b,
-0x214e8df1,	0xe7c6d81e,	0x3d585f4d,	0x06963299,
-0xd774bcc1,	0xaa281c68,	0x396e64dc,	0x4fe01af4,
-0x8e8c27f5,	0x7c8214ab,	0x4a5ec6c2,	0xc2c1f708,
-0x6c07eabb,	0xcd812189,	0xeb80ab22,	0xdc313d19,
-0xd63d6885,	0x4309442f,	0xf1515e27,	0x40d0e43c,
-0x5010cbba,	0xd4897cdb,	0x401b053e,	0x40b5a6f4,
-0xef56d806,	0x3bdb3fbf,	0x622d59ba,	0xbec9c531,
-0x0aca059a,	0x87f11dd0,	0x9f5c1000,	0x1b0f4611,
-0xacaf4168,	0x25f158fb,	0x291c3634,	0x12d38a75,
-0xea0408b7,	0x6e0cddd2,	0xc607aed2,	0xa268312f,
-0xb5380399,	0xfdce1237,	0x43a8ebeb,	0x85ca9736,
-0xde7c9fc1,	0xa24cd3be,	0xac9c6745,	0x066bb5c5,
-0x8a5dd218,	0x3436564c,	0x2f127a67,	0x21a8b994,
-0x3da4b79d,	0x944d2912,	0x0e2bc53f,	0x9873c594,
-0xd5867184,	0xc90f4a5a,	0xc94a53fe,	0x2ccd9d5d,
-0xc8710f29,	0xe93e21b1,	0x1659b8c3,	0xd86f2578,
-0x2cff166b,	0x322dafe9,	0x10e5cd9f,	0x39ea10ab,
-0xa808c512,	0x96ac74d6,	0xa55da964,	0x1d309220,
-0x6e99a00a,	0xf478b6a3,	0xd66e848c,	0x17455ae4,
-0x62a67a2b,	0x8a6da535,	0xb8abd295,	0x37d21266,
-0x8f2d2451,	0x022c5322,	0x1c8098a5,	0x100191be,
-0xeb28deb8,	0xc3ceb459,	0xeb405728,	0x04a0aecf,
-0xff86c0ac,	0x4c5b866d,	0x18c0c2bd,	0x540c27ac,
-0x1759e0cb,	0xd839bf89,	0x143e1418,	0xfe4ac2a9,
-0x6e55a071,	0x8a553761,	0x4a654b67,	0xf2f3386f,
-0x16f533d3,	0x5c54b599,	0x63dbf2de,	0x2c7080bb,
-0xbb20bee1,	0x5703f5c6,	0xd469d09e,	0xa30cc96a,
-0xa38d2880,	0xf90d58e0,	0x653cfbf7,	0xab427588,
-0x49188c32,	0xf54e28c6,	0x2c16642d,	0xe086fe84,
-0xaad5c930,	0x15145f09,	0xb35ec83e,	0x9d331ce7,
-0x97a1ec14,	0xf84cb770,	0x2d73c086,	0xc742d95a,
-0xc6f942bb,	0xa3d11ae8,	0xc3f26cc1,	0x6a1118d8,
-0x7395e484,	0x4b3583a2,	0xb2bd4aaa,	0xf6d10bf6,
-0x68dae4ba,	0x11dda178,	0xc839b146,	0xdbeb9322,
-0xa94a639a,	0xb45b3921,	0x771ee9b3,	0xe59b2b8d,
-0x58afbb4b,	0xf1acfc7a,	0x3db7dd82,	0xce6236da,
-0x9e7a90ab,	0x8e81dc7b,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-0x2722bfa2,	0x10462123,	0x30080f7d,	0xb346cd81,
-0x0049c396,	0x4e24165f,	0xa7c66809,	0x2e60bdcf,
-0xaad70a08,	0xa73ea713,	0xe28f97a7,	0x283a9eab,
-0xd4366489,	0xe776f963,	0x64ffa8ae,	0xde717b50,
-0xbd2ca2b5,	0x3bae5f6d,	0x8d2bbef1,	0x7e9181e6,
-0xf06aa121,	0xd06b2d20,	0xa83ea826,	0xef935e4f,
-0xdfd27456,	0xa3451468,	0xc6820a63,	0x43463105,
-0x787697aa,	0xcba5543d,	0xdf7e1e2d,	0x6998a8af,
-0x98ce6c08,	0x89de731a,	0x943a3510,	0xb36ead85,
-0xd5258d4b,	0x1cd6df61,	0x82a5c59d,	0xd078e7a4,
-0xa33d4317,	0x24dc45f8,	0x3f3daf27,	0x0478bc6f,
-0x92dfa16c,	0x952a872e,	0x7a34e03f,	0x0f088084,
-0xa40937fe,	0x38fc7749,	0xa157e8a4,	0xbce94344,
-0x7045ff7b,	0xf3e1ab66,	0xe62a6058,	0x5564ff10,
-0x38198f1e,	0xf326f0f1,	0xe262bc0c,	0x2f0b851a,
-0xc7bcbe11,	0xe79f1d1a,	0xc2f93c29,	0x54f3ea9f,
-0x8f8f9141,	0x9f45e13c,	0x7a5b86bd,	0xa764efd8,
-0x35f04729,	0xdd8c4b54,	0x5fa12e51,	0xa5824af9,
-0xad328f71,	0x0f11fbb9,	0x9048e950,	0x04d7a900,
-0x02538d1f,	0x99f745b7,	0xe31f63bb,	0x2c4e3d78,
-0x7cdb9245,	0xa3966ee7,	0x27c4433a,	0xe1d79f3e,
-0xe640fa06,	0x79ce31eb,	0xf25634fa,	0xdd9ce5cb,
-0xb7fab8d2,	0x2f1f0ff2,	0x2acb625c,	0xa0494989,
-0x206d7f11,	0xf268b8ca,	0x292bbf9f,	0x763bd7d0,
-0xea4b14fc,	0x9d3d6aeb,	0x64cca57e,	0x6fc3e29e,
-0x3e7bf4bf,	0x90efc7e3,	0x08e39173,	0xd05bee2c,
-0x5b3c8f37,	0x0921ec6f,	0x3371b715,	0xb324e114,
-0xe3abc53f,	0x576b18f8,	0xc4469024,	0xb2ded6c6,
-0xe7783782,	0xc0a1fd5d,	0xcf324bde,	0x97527c8e,
-0x19f8f48c,	0x3e806a5d,	0x96cff225,	0xe3b9d04a,
-0x0e5856ae,	0x781372f6,	0x9645f2b7,	0x95a743ed,
-0xd0c7eded,	0x86ca3cd9,	0xbab94db0,	0x43a1233a,
-0x89c55554,	0xee776239,	0x34aa0098,	0x66a6e1d4,
-0xae0e233e,	0x717e7b29,	0xb403a4c1,	0x36eb96c5,
-0x42140832,	0x04250936,	0xda375dca,	0x524cb2e6,
-0x86deaa0c,	0x400dc9d1,	0x12c00364,	0xe3ca7cf5,
-0x87f20da7,	0xf57df9ef,	0x580dbdfc,	0x0b3e0369,
-0x014d27fd,	0x4afaf6a1,	0xd1f4ca09,	0x77abc831,
-0x30e49729,	0xec61cd2c,	0x159c1e92,	0xb61b40b1,
-0x17c66fd6,	0xde11c061,	0x79d7f792,	0xc709cbfa,
-0x94201c89,	0xbe65137d,	0x18aea1b4,	0xf248bbc3,
-0x465f957d,	0xcf4a9672,	0xbf293fd2,	0x2c5e31c9,
-0xc2c73011,	0xfb29cbf2,	0x576f7f0b,	0x74de1745,
-0xa76e172b,	0x99b96223,	0x14ce1502,	0x231013fb,
-0x1d4df40a,	0x951b0c16,	0xab173e66,	0x4ff65f74,
-0xc4a87a47,	0x09cc3370,	0x66385490,	0x73e09118,
-0x4ee96432,	0x0164d347,	0x205069b5,	0x158dd226,
-0xc932c238,	0xe9048fa2,	0x100b626a,	0x86ee08cd,
-0xed87cb1c,	0x6353ec37,	0xa36edcc3,	0x8a16dd6b,
-0xd28a4198,	0xebea1127,	0xca0b761a,	0x61c31acf,
-0xced5ff4f,	0xbf4dbd8f,	0xd969d8a7,	0xb6e4e9e8,
-0x8421c402,	0x809d7222,	0xabfd1d2f,	0xc1857ce5,
-0x23958fd7,	0x3226f1d3,	0xd822b4cc,	0x2f1cc3aa,
-0x501fe01e,	0xe36f8c94,	0x7ad27716,	0x3321308b,
-0xa85b957b,	0x38cfdf6e,	0xc7497dd5,	0x2462090c,
-0x8f9e42e7,	0xdf97684a,	0xac8af621,	0xd5224866,
-0xc5f64e50,	0x9724f297,	0xc386097b,	0x48c6f98a,
-0xe1478b1a,	0x2dd23fd8,	0x716b2d85,	0xa5c3789b,
-0x53625e80,	0x9b8b312c,	0xce482165,	0x66161e35,
-0x64ecb56a,	0x9981c46a,	0xe6cb6bb3,	0xe1983186,
-0x75ed470f,	0x4adcbd27,	0x3efeda68,	0x4d193a2a,
-0xbfdb3cd4,	0x7c6167b6,	0xdbddea68,	0x4b0d2d62,
-0x00ba3860,	0x49ec2544,	0xa68698c9,	0x2ce7be1b,
-0xf5afc9fc,	0x1cebf9c3,	0x350f8f5b,	0x893eefb8,
-/*  3025-m08106d126.inc  */
-0x00000001,	0x00000026,	0x04062009,	0x000106d1,
-0xdeac5852,	0x00000001,	0x00000008,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x8a62197b,	0xd41eef98,	0x9d9182ac,	0xce90899b,
-0x593b5003,	0xda6b2375,	0xaec0ef83,	0x90372d17,
-0xa88d2585,	0xfc178cc7,	0x040e8edf,	0x5f881c70,
-0x41c6e5db,	0x0a21d4ce,	0xb93f9d52,	0xdefa0b09,
-0x46b47482,	0x89e1216f,	0xa49b269e,	0x85f55632,
-0x48faf49f,	0x74d0d770,	0x191ff3d9,	0x415322bf,
-0x0e073d70,	0xef71b7ed,	0xbfdcff71,	0x9a7e696b,
-0x3ef047c1,	0xdfb0f3a7,	0xc7219105,	0xbdcb77c7,
-0x449661c1,	0x1bf3d2b4,	0xb96f62ff,	0xac2bb1dc,
-0x2c51c691,	0xa6f6f574,	0xfa216399,	0xb9a9aad7,
-0x52f9b3dd,	0xd9a09939,	0x3640ce2f,	0xd96fa8a2,
-0xe408e2a2,	0x40302c2d,	0x699c8675,	0x6a4ba9ec,
-0x4b87cb54,	0x428dafc9,	0x8ad37629,	0xd92d62c0,
-0xe401f3bb,	0x2ae527b2,	0x41b7ef6d,	0xad22d2e2,
-0xbf935eba,	0x3447667c,	0xc241ef0c,	0xb2e847d4,
-0xd28290b6,	0xd42d0b0e,	0xea8fbc1a,	0xb4b71e8e,
-0x6986710d,	0xa4cf0914,	0x235e8974,	0x2d2f4e1b,
-0xfe33393a,	0x3588135b,	0x19bb5b36,	0xe8e9e4c0,
-0xc97a62fc,	0xe09b1ea8,	0xe9f492ff,	0x92807086,
-0x04a93231,	0x6a38d271,	0xd41917a5,	0x3b2c4473,
-0x7cddcc24,	0x8b1bd7d1,	0xad9031bb,	0x3aa140da,
-0x92d23d8b,	0x8256d88c,	0x2d4f76db,	0x23b7252f,
-0x62c89fe4,	0xfeecec9a,	0xbed25f1f,	0xc81727b3,
-0xd4230bf5,	0xfd2bff4d,	0xa2d71562,	0x2a7df5e2,
-0xd3650f2e,	0x0e3138a2,	0xd6bac0eb,	0x549b1dea,
-0xd84e2c98,	0x7172b49c,	0xdb401b67,	0xc3e666ef,
-0x1817d0d1,	0xea7322c0,	0x81973c06,	0xad35520e,
-0x600844f2,	0x21f93024,	0xeddae77c,	0xdf86947c,
-0x6667c0f7,	0xdebc19d7,	0x179967d8,	0x7a0ccfed,
-0x0da5fafe,	0xb6b4eeb6,	0x01474e9e,	0x1b4272de,
-0x1968eeeb,	0xb9e8e70b,	0x3808867b,	0x12d0fe40,
-0xf7144fa3,	0xc9c57a89,	0x1ba4da9f,	0xc5aad9d3,
-0x2e934951,	0x9f67d3b1,	0xae6efdcc,	0x3014d885,
-0xb82a83de,	0x826af12f,	0x5d7816ff,	0xbea30c27,
-0x1f66425b,	0xf65372f9,	0xf92724cd,	0x9b3f9d40,
-0xf91bd54a,	0x971ac2a1,	0x55adff9b,	0x2e21e466,
-0xadbc1e3a,	0x2b5f4580,	0x9f87147c,	0x81bd5934,
-0x4dd32e16,	0x1420ab63,	0xebb98984,	0x44fb6b87,
-0x968de4f9,	0x6e3e70a2,	0x332e3769,	0xa62b6e05,
-0xc629fde4,	0xfd82ab18,	0x6e4eb7b3,	0xf8993165,
-0xef4758f5,	0xb9f5d43d,	0xeae11bb8,	0xfee0b327,
-0x821b7908,	0xd9b9eb41,	0x18524a27,	0x528d2060,
-0x0586d6db,	0x41ac7e35,	0x0f60a09e,	0x0d19e5f5,
-0xd2923f79,	0x951fb42c,	0xd9a4b075,	0x4b2f8115,
-0x468d11ab,	0x9e3689e7,	0x7d88e98d,	0xf10f246f,
-0x21776219,	0x6c9ea2d1,	0xf62090e5,	0xf4897d50,
-0xde5a1c6d,	0x128c8ea8,	0x0925a78c,	0xdb005ffb,
-0xb8e1a8ec,	0xd352c429,	0xb9fb3a81,	0x0f70d960,
-0x6bb50f30,	0x5332478c,	0x37d0c989,	0x0fea766e,
-0x63cf91ea,	0xe9333698,	0x2a9f6fc1,	0x547b4192,
-0x3d48dff9,	0xd12afce5,	0x263ea05d,	0x404b02b0,
-0x8a68c9c9,	0x5fb7a13d,	0xe8566220,	0x6b981478,
-0xdbef8f87,	0xc7045d1c,	0x71dd6f9b,	0x787dde0e,
-0xbcd1fdd4,	0x3264ebbd,	0x14586a4a,	0x116af8df,
-0x21fb08fa,	0xd5669e48,	0x2afe7082,	0xabc66801,
-0x03eb374f,	0xc146532e,	0xc68dcb3d,	0x96e4f659,
-0xd6c5816e,	0x4495ddf3,	0xdb658825,	0xa1a6179c,
-0x33da2e45,	0xc55817bc,	0x49594ef1,	0xea6f9e2b,
-0xcc4c40a6,	0x66c73c38,	0x43d968a5,	0xa6d83662,
-0xfabbf3af,	0xfc06278e,	0x468d770e,	0x48e7e8dd,
-0xd1952fbc,	0x12e75a2d,	0x03f8fbc4,	0x6e42b676,
-0xe9a634d8,	0x78cf814e,	0x8a1886b8,	0xb8fbf111,
-0x3b3631dd,	0x758f44d4,	0xb82a3c17,	0x620a3b4f,
-0xfbf24991,	0x5a9489d4,	0xbc9b4193,	0x58e7ee5b,
-0x11d3b4ea,	0x632f586f,	0x2ce4b827,	0x60f855ee,
-0xec28df5f,	0x6d7d298d,	0xb26e9174,	0xa25791b0,
-0xeb6a7de9,	0xc8ef78d2,	0x6e88eba1,	0x651ef2f0,
-0xeb197e3b,	0x07c9e926,	0x8339033a,	0x3a557e03,
-0xe216c7e6,	0x626e1995,	0xa0e4bc2a,	0x4c25388d,
-0x0f98489b,	0xeab06afd,	0x0eb99b2c,	0x621bcc53,
-0xcb306a0b,	0x3b6b22ab,	0x1059a835,	0xf452e7d5,
-0xf2ff8706,	0xf2938036,	0x01c099e6,	0xc362a251,
-0xe05443a2,	0x3da9dd70,	0xc6b0bf41,	0x312490ed,
-0x3e23d0c6,	0xd99e6d48,	0x4f2703d6,	0xf80933e1,
-0xe66f3322,	0x1efdda13,	0x0f26cf39,	0xb4bad0f1,
-0x913ef9dd,	0xd433e5a0,	0xfc44169f,	0xcd7c7499,
-0x3b6ad376,	0xb0b23611,	0x45dee41b,	0xe2ba9b59,
-0x3cb51809,	0x8e86f45c,	0x859a0d33,	0xdaa4d46b,
-0x4c063ef0,	0xf9d06d4f,	0x53501ddd,	0xeb487dd9,
-0x81d62e1e,	0x2df42871,	0x5cf8aa44,	0xc5e40bdb,
-0x7176fecc,	0x5516b195,	0x99f722bd,	0x41976195,
-0xb8e84ad3,	0xef3ccec6,	0xe3d86e9d,	0x97941d90,
-0x9e962a1b,	0x1c01e460,	0xcf0f85be,	0xab9b1c58,
-0x16bf58fe,	0x81771f94,	0xdacda319,	0xb232ad3e,
-0xb17437d4,	0xef5b512b,	0x827e8742,	0x7492f401,
-0x4f69912a,	0xb9939a88,	0x1dab019a,	0x6b2ed2d8,
-0x6df07ab9,	0x39011ad6,	0xc903fbd6,	0x1cec4fbd,
-0x5eb20046,	0x3be8c64c,	0x378d680b,	0xf6f464f0,
-0xf446fc56,	0x5783494f,	0xcbf7c271,	0xeeda7799,
-0xd801328f,	0x6c8dd64e,	0x7029f05c,	0x25b25745,
-0xca6d34b6,	0x33ce1bd8,	0xc230e50f,	0x1464b0a4,
-0xc4a7f26f,	0x3cfc85ac,	0x8beda431,	0x0817abab,
-0xc8de82b1,	0xc8877cd0,	0xa89cab22,	0x7fbce2ab,
-0xf3d97379,	0x9d9b19ad,	0x6abc1686,	0xc24926ca,
-0xdfca2347,	0xb8449300,	0x8793db9e,	0xafd44bc3,
-0x5777c00b,	0x2c8976b4,	0x7c350594,	0x05408ea2,
-0xa8e0a8c0,	0x389adf7d,	0xfbb0c0f2,	0xb96f4393,
-0xe0dd2830,	0xf439f6ad,	0x0bde70a4,	0x18653b73,
-0x1f6555d8,	0xf2dfa847,	0x4de927bf,	0x5f7fc911,
-0x866c831a,	0xc55f0438,	0xfa235014,	0x24866364,
-0xd3cd198b,	0x8eaad6e9,	0x7d0749b5,	0xd55d6584,
-0xffa1e913,	0x6e66632c,	0x99a570c1,	0x478df5ba,
-0xd06a5370,	0x5ac8ba42,	0x4c6065d4,	0x137eb693,
-0x3a5be8f1,	0xe737046d,	0xb410c4d8,	0xe5488c95,
-0x459c79ac,	0x09b95a26,	0xdb999724,	0xe3864e7b,
-0xcc3782b5,	0xfdba2842,	0x6bd86d38,	0x76040688,
-0xa7f44e6a,	0x4adc35b6,	0x5ded0032,	0xf49eaa48,
-0xf30a7330,	0xe4b721bc,	0x7db4a898,	0x6d0e5881,
-0xd78f56f6,	0xbcf27f8a,	0xae53768a,	0xbcead007,
-0x9bd889f1,	0x280a8799,	0xa79f9433,	0xc4c6580b,
-0xd0dc85c4,	0x34920875,	0x2208aa4e,	0x5adae859,
-0xcd92c560,	0xb79bd098,	0x246d6d7e,	0x2c51163b,
-0x97ab0f6a,	0xd8b63d37,	0xc7e3c538,	0x4b63da86,
-0x19d28495,	0xda662f64,	0xec1e1e32,	0x17379978,
-0x916543f4,	0xfeff6e10,	0x993010f5,	0x014a477a,
-0x55edfee6,	0x836bde93,	0x8150415d,	0xe1ad7f1a,
-0x2649babf,	0x3cde67ec,	0x4f225b60,	0xbe8e4c1a,
-0x9270bac0,	0x0337ebd7,	0xe1b679db,	0x9fed87f5,
-0x10a6f1ae,	0xeb1fb9c2,	0xfe71da61,	0x27ec4cb6,
-0x4cc95f15,	0x6ad90b47,	0x411ed72c,	0x7a514182,
-0xec451e0c,	0x48ea82a2,	0x682c56b1,	0x4f2cfbc3,
-0xb67eb0fc,	0xdc7f7c25,	0x642ee06d,	0x8cfbc122,
-0x6d51546b,	0x30c6db5a,	0x0f6f46dd,	0x1229dac1,
-0xc65a568c,	0xc3fa072d,	0x7d2d1d21,	0xfce985f5,
-0xb6232963,	0xae9b97fc,	0x55cd5726,	0xd948d2ff,
-0x1028c41e,	0xe07b79c2,	0x6a5c39b1,	0xb980d663,
-0x2660919e,	0x9a4764a1,	0x833eee84,	0xf2578407,
-0x415b77ec,	0x1b018267,	0xb1be03dc,	0x75ed845c,
-0xf35d6fc2,	0xe2780315,	0x3bb40ce2,	0xdb292934,
-0xdb95ee2f,	0x408cba8e,	0xcfe6f423,	0x2dece2a5,
-0x1f3b44cb,	0x99498157,	0xd6472d24,	0x8817d846,
-0x35b647eb,	0x974dfd9c,	0x434a2336,	0x8913f3ec,
-0x4aa531cb,	0x878f596f,	0xd7c38bbc,	0xad8d91a8,
-0xdddaca6b,	0xa3fc3f92,	0x195d813d,	0xc710786d,
-0x81d6afe3,	0x6f1d1856,	0x22492b69,	0xac284f74,
-0x773cbc77,	0x85e341ad,	0xa20dd4e4,	0xc7af888a,
-0xf0295bb2,	0xf1d5b9fc,	0x5322500b,	0xb87b6855,
-0x3d44f92a,	0x1f2879b6,	0x7a8685e0,	0x0da3e6f3,
-0xa364e557,	0xc28edafa,	0x5e0c06e3,	0x19f513f6,
-0x94cc4e2c,	0x71a5e1f0,	0xf7400157,	0x17300a53,
-0x56b690fb,	0x055a2d76,	0xf06457aa,	0xdebb8747,
-0x8ef5052f,	0x319bd715,	0x8a19dc30,	0xb067be8f,
-0x7e6ae81b,	0x7e5b6dce,	0x069274c1,	0x4b6d0e74,
-0x90362e92,	0xe899d949,	0xc43126d7,	0x0d6b0031,
-0xb1f49c44,	0x97b9c961,	0x439757be,	0x8906a5d7,
-0xb7a0e97b,	0x46ddd9d6,	0xf60356bd,	0x4087155a,
-0x9ac53b24,	0xdc979beb,	0x323fe352,	0x10c64391,
-0xb699a0e8,	0x2bd4c295,	0x0bf9dcef,	0x630adaaf,
-0xd735e4c1,	0x4417157e,	0x3a69d2a5,	0x9c385c0d,
-0x2382c14d,	0x9c33f851,	0xcb4c90ae,	0xa8c557ae,
-0xa40b05dc,	0x7e8709e0,	0x7dc96450,	0x8c6db77a,
-0x0c1e0b03,	0x203a65c0,	0x79b2d038,	0xa0c6b2d6,
-0x0aa3d0b7,	0xd36ec0b4,	0x8012cb10,	0xd99eecc6,
-0xc2072906,	0x8acee2d7,	0x50a1a17d,	0xad6f890f,
-0x123f3802,	0x73d6ca71,	0x9b531513,	0xd89c8779,
-0x2ab5349f,	0x5999084c,	0x2889cdba,	0x3d2cb55f,
-0xfb922dc2,	0xd5e64ad5,	0xd2fa69e1,	0xe4cf08e9,
-0xdb43cb05,	0xce09d796,	0x7af98dcd,	0xb3e03280,
-0x03147f3e,	0xe038a4f4,	0xb701791c,	0x77dbd759,
-0x12fcd2f7,	0xbce9c9b9,	0xa2561be6,	0x97d05bd2,
-0xda6922a5,	0xa81bae70,	0x0ddd38ea,	0x7ca70ee8,
-0x97475a5e,	0x3a68d72f,	0xb5affa34,	0xc44f235f,
-0x37ae1c8e,	0x13c055c3,	0xe4629ce2,	0xcf1910d0,
-0xb314d24b,	0x78dda8c6,	0x47b5a43c,	0xb1e71bab,
-0xfeebcaa6,	0x7761d599,	0xaadabb05,	0x9ed05d71,
-0x913cd4ba,	0xc10a5b6a,	0xb84918d0,	0x8117048f,
-0x99a56c04,	0x999d552c,	0x2b9e6bcb,	0x26608b43,
-0x7942197a,	0xa4830c85,	0x7d673bf2,	0x38ceccb0,
-0x1d10610c,	0x456b408b,	0x84a5a85a,	0x954e4282,
-0xdbb6c6b6,	0x49469986,	0x2c5cd7f7,	0x5aa92bb7,
-0x94c435f3,	0x2e9fd7ed,	0x3e3c19a6,	0x18837c97,
-0xcc8473c1,	0xf9c6c1d5,	0x8d7f5df4,	0x26bb14f2,
-0xa187704c,	0x2e0c5e63,	0x22d5426a,	0x4ea50d35,
-0xbbebd272,	0xeb27ae6d,	0xe94572bc,	0x7d9bedf0,
-0xbe9125e7,	0x9d60ef39,	0xb3e26109,	0xa257558b,
-0x5997b17a,	0x3a170aa6,	0x6a14caf8,	0xc3bf1cdc,
-0xce2f073e,	0xb3fac275,	0x80dd056d,	0xa3934fda,
-0xce48329e,	0xb4b60b86,	0x5291d4cc,	0x63fc43ab,
-0x0f17b7ec,	0xe6ed7b20,	0x2fdc0954,	0x4d0c284a,
-0xcd10a2f4,	0xcd6487f8,	0x80315834,	0x8342a75c,
-0xa16b5091,	0x18d7de86,	0x798a6d34,	0x3a9cc59c,
-0xcf94ba72,	0x041c411d,	0x694e31ed,	0x8043005b,
-0xa392fa03,	0x4b5f22df,	0xdf346533,	0x51eadb14,
-0x201b4c59,	0x4f0bdb1f,	0x7a095e77,	0x47c52c02,
-0xd7c8f5be,	0x256976f1,	0x461116b2,	0x6b505e95,
-0x75e18247,	0x73e6addd,	0x2c28b9c0,	0xd00ccbc3,
-0x608422f3,	0xc5dff95a,	0xd6a994c6,	0xa25af71e,
-0x32746665,	0xd77a153b,	0x71b165d4,	0x09c3ca4d,
-0x58b440c7,	0x914984f8,	0xf4c513e7,	0x23409995,
-0x6add5bf6,	0x56370e1b,	0x86d6e143,	0x7cf6ca8d,
-0x2f9fdfb1,	0x23e318e3,	0x292eed7a,	0x1867c5a8,
-0xdb5ecf88,	0x7d9101e7,	0x7d1d6962,	0xd5e8d91a,
-0x1c3f1e95,	0x7fcac975,	0x49f42977,	0x92a4fe3c,
-0xfa3017b5,	0x874394ba,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2111-m801066133.inc  */
-0x00000001,	0x00000033,	0x03162007,	0x00010661,
-0x9e99cc48,	0x00000001,	0x00000080,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x90ad6a7e,	0x152c72d4,	0x0ff6ebb7,	0xb9b54882,
-0x17babb3c,	0x0e24725c,	0x0f447da4,	0x09785e65,
-0x28e1be4e,	0x3461d75e,	0x29e97bea,	0x23c76a4a,
-0xddc3d190,	0x020318c5,	0xdeb8a6c1,	0xf5b73b57,
-0x2a712aee,	0xfb4309fe,	0xd3875d41,	0x04afb41d,
-0xdc57fed4,	0xf38ae786,	0x201ba0a7,	0xc87b00e4,
-0xc6aab395,	0x10aad94d,	0xc91fe860,	0xcf4e74e6,
-0x221842e7,	0xe44c7ae5,	0xdf098f72,	0x210eda92,
-0xdc8cfa35,	0xdaf80aa2,	0x272a2a06,	0xfcb6407f,
-0x542ae3e6,	0x04bfa647,	0x43972432,	0x56e7cfbe,
-0x0094ce94,	0x64018038,	0x5df36c50,	0x01e4ec15,
-0x83783560,	0x7791d607,	0xda778213,	0x8fdd82fe,
-0x505b2e3f,	0xdb260012,	0xbf72c44e,	0x7b1f3717,
-0xeaef705c,	0x9df6d9ec,	0x7e516d1f,	0xe06e4c6d,
-0xb2dbd4fb,	0x53a6a326,	0xf2ceecef,	0xb7e8cdda,
-0x3277bb22,	0xdbd989f4,	0xff63b09d,	0x32d02a05,
-0xc0b7a02d,	0xd907f153,	0x17006924,	0xcd118084,
-0xf87bd157,	0x374e65a1,	0x8512e958,	0xe14b0737,
-0x5c295c73,	0xb5192105,	0xf088eb2f,	0x5d994080,
-0x8ac98cb0,	0xd50bf122,	0x5b244766,	0x8379e108,
-0xd0f9e345,	0x76e2bc23,	0xb2fde461,	0xd6e7dd40,
-0x45453b2b,	0x979706e5,	0xda4bf76b,	0x58ebe864,
-0xb14c7577,	0xe0ac578a,	0x71df5320,	0xbdb34d75,
-0xa7f9c0e9,	0x55734a03,	0x91963507,	0xafbc3926,
-0x331edb37,	0x9db8f4c4,	0xa0485d90,	0x35444571,
-0x989b1ea9,	0xa594817b,	0x580aed7a,	0x8091a986,
-0xe6220d5d,	0x4e8d3779,	0xa7ed5b92,	0xc1177b53,
-0x423af3a6,	0x838dcb15,	0xa344ff5e,	0x5bdddcb0,
-0xcd15dfb8,	0xbdd32cf2,	0x70eb5c80,	0xc15a3762,
-0xbb8f5cd0,	0x7183110c,	0xe899a48a,	0xaab5c072,
-0x7e432dac,	0xf4fe3bfd,	0x8b6b7c9d,	0x5c460b8c,
-0xf207554b,	0xae8072f4,	0x11cd7ea5,	0xef2113f5,
-0xc28694d3,	0x08d65dc0,	0xc1b75411,	0xe378bb29,
-0x0fc9ea96,	0xe19f2428,	0xa8450da9,	0x1a4779e5,
-0x81e9245a,	0xbf17dee0,	0x34bbf4b9,	0xa5fb7a6b,
-0xba6d33cc,	0x1a5f1948,	0xe6b3f578,	0xac2aca48,
-0x7fbed4ef,	0xfdeda2ce,	0x891336ee,	0x5a10f69b,
-0xf8e499d8,	0xa3281387,	0x559b7e17,	0xf180a796,
-0xa1488b74,	0x52696f53,	0xfaee5bdc,	0x854e9269,
-0x506a47a4,	0xd78635c9,	0x861f34d4,	0x5101f844,
-0xd46828f9,	0x8c33be78,	0x5830597c,	0xfe80ecf1,
-0x808ad780,	0x7c1a8c6c,	0xfead77b0,	0x8e798cf7,
-0x7981826c,	0xf67b4565,	0x895bf820,	0x565f8be7,
-0xff7848da,	0xad5961c7,	0x5d8f9d05,	0xfdbb17db,
-0xa54308e5,	0x57aae95e,	0xf833773d,	0x81d23cf3,
-0x599f0561,	0xd8ef6185,	0x87431e1b,	0x5291f114,
-0xd56c4247,	0x89fb1636,	0x58c49868,	0xf0a35ac6,
-0x83c7579f,	0x72d674d7,	0xfcc710ad,	0x89fbcfc8,
-0x7300bef5,	0xf351bccd,	0x80ea186a,	0x5bf99c08,
-0xf5497d36,	0xaca91965,	0x56bbcbe7,	0xf70480ff,
-0xad7d58cb,	0x57164107,	0xf32f71a7,	0x8b78d376,
-0x55c77e35,	0xd77609af,	0x8b9fa59d,	0x5765b06e,
-0xdbdbb6bd,	0x8e7284fe,	0x5f6141ab,	0xfb2f5e8f,
-0x82dd238b,	0x7cea7457,	0xfbeb2952,	0x834db863,
-0x720e93f9,	0xf45c6892,	0x85d202a0,	0x5a24ee39,
-0xf237b6cc,	0xab3ea86f,	0x5befde46,	0xf1ca8ba3,
-0xa6ddd695,	0x5627b81a,	0xfe41f5ad,	0x893327fe,
-0x5d9ba05d,	0xd0e63019,	0x82ce74ac,	0x504961f4,
-0xda62fe63,	0x8344c69f,	0x5e0d0f03,	0xf4002b10,
-0x8e9b41eb,	0x7210d428,	0xf968469d,	0x8c86ed92,
-0x76ef9233,	0xfe5e8851,	0x897b961a,	0x58153abe,
-0xfa09eb76,	0xaf517a02,	0x5ec9184e,	0xf10f6c4b,
-0xa6a51764,	0x5b6c3f3c,	0xf1034726,	0x89a75974,
-0x5d037899,	0xda94e8a1,	0x83f4e6bd,	0x5b9347af,
-0xd9a39843,	0x8fc8efd1,	0x505cf34d,	0xf2235e8a,
-0xaa7e187e,	0x7091418a,	0x946d6385,	0xad3a4ffe,
-0x11b70d50,	0xbcc122d2,	0x9a283ef4,	0x1e36ad20,
-0x9ea87c24,	0xb124b8c8,	0x2c6c62fa,	0x9ceec8ae,
-0xb79a925c,	0x2f7d8e3c,	0xadba33db,	0x954a9990,
-0x3f6f9ae8,	0x8f4e8321,	0xd04525ab,	0x39d67ff1,
-0xc8ad9053,	0xfe6e7893,	0x07887339,	0xce17f6ba,
-0xda80c4e2,	0x26c001af,	0xbeca4e80,	0xde77bff8,
-0x6679538e,	0xb4119250,	0xeecc77b8,	0x4737cd26,
-0x8a3da39f,	0xc7112321,	0x69717eb5,	0x823094e5,
-0xc482b42f,	0x615af641,	0x8aab5178,	0xedbbf611,
-0x699a4244,	0xa3b521bd,	0x8d258d5a,	0x7695600c,
-0xd5c989d8,	0x98f6ddd9,	0x417d9ea0,	0xf37aacf6,
-0x90db51ca,	0x6e7028b2,	0xfbf1ee0f,	0x85ea06cf,
-0x4c55acdc,	0xc3e617dd,	0x919e8f4b,	0x4652501b,
-0x6e5981cf,	0xbff00c8a,	0xf95eb320,	0x6bede078,
-0xdc453750,	0xd016f074,	0x235a33a2,	0xd414c7f5,
-0xd0cb0fae,	0x03fe622a,	0xd184a2eb,	0xd5d564b3,
-0x0e20d8b4,	0xfaa9cb0c,	0xe1d369ef,	0x0c9edc66,
-0xcc930515,	0xc5b78823,	0x4c3c0123,	0xdebb750d,
-0xa53cd5b2,	0x7a1e6ec5,	0xed21264d,	0xaa573b5c,
-0x6a27bcc2,	0xc543751f,	0xa6177d70,	0x6de604e7,
-0xcc340754,	0x8cf3d915,	0x703ac314,	0xc87978a6,
-0xbbcb5952,	0x5791d446,	0xa4c1ddaa,	0xb9fc7c87,
-0x785840d3,	0x82934719,	0xde2a0c97,	0x726c0c28,
-0x4a9698b7,	0xfc05ae90,	0xb2a7b639,	0x4862af8a,
-0xfe32625a,	0x990fc9ec,	0x77b7cf77,	0xf04665c8,
-0x99fc1713,	0x5b472577,	0xe26a7b52,	0x9021e7cf,
-0x730c6b4a,	0xe7b5a46a,	0x951d7a87,	0x56e040f2,
-0x244ec1b2,	0xb9b2f959,	0xdcb37dfe,	0x21155f8b,
-0xfab60075,	0xf8ca5f38,	0x2671ff99,	0xfd9bd3cd,
-0xeb23d86f,	0x086bab90,	0xf9b5a57c,	0xeb66c45f,
-0x146133a2,	0xd055bab8,	0xcbd53416,	0x1753b0e5,
-0x3794726a,	0xec2440ad,	0xfa2615b4,	0x3b88f231,
-0xcb235180,	0xf098bf48,	0x0961e9e6,	0xe9e1797d,
-0xc1be41c1,	0x2cc21baa,	0xe99fab72,	0xce052e33,
-0x25591285,	0xe3df2edb,	0xcb364bbe,	0x2d756a27,
-0xeb59ea24,	0xc1d1d0f6,	0x6e362988,	0xf9cbf55e,
-0xa5b82c94,	0x50f8df4e,	0xc19a8331,	0xa530e1f9,
-0x6cb0b110,	0xe5fbb2e8,	0xead47b8c,	0x6795f5e6,
-0xe205b3d1,	0xee7a0356,	0x326cfc54,	0xcf37275d,
-0xd85fd7de,	0x1350a92f,	0xcc3aef0d,	0xd49db91a,
-0x176692ea,	0xea49bb25,	0xc3710747,	0x177197a3,
-0xfda669b4,	0xee828a6e,	0x6b4ff614,	0xef7b088f,
-0xb8886c25,	0x55218b79,	0xd594d7e5,	0xb4675cee,
-0x7b9f50d1,	0xf858829a,	0x85c08321,	0x78894360,
-0xd51dcd94,	0xafb928bc,	0x6a53ba7e,	0xd25649dd,
-0x92aafc4d,	0x4c43f1e3,	0xd2a7c8a9,	0x93b2d677,
-0x4fccab4c,	0xf5dd9c66,	0xa0d7dd4d,	0x44c4b36b,
-0xfcdd1c58,	0x8e3d3dc6,	0x7bef8a12,	0xf4b49134,
-0xc873b39c,	0x7076dc8d,	0xb4fd61d9,	0xe0f09937,
-0x72aae1f5,	0x9d96ac0c,	0xeb9cbbb0,	0x7ed1df44,
-0x95a8ed4c,	0xe7f8d850,	0x7ae7feaa,	0xbd2a491f,
-0xcd2634f4,	0x5722082b,	0x9d946dc7,	0xc6d85c71,
-0x76f5dd1b,	0xbbefd778,	0xde98d4ba,	0x79f47211,
-0xa2fd81df,	0xf566c325,	0x590fbc48,	0xa9781f35,
-0xf81bf20d,	0x7e9ace93,	0xbc1421ff,	0xf5980d9c,
-0x5717090c,	0x9362b228,	0xc047fa7c,	0x577bb947,
-0xb41fe491,	0xe9c7ed6d,	0x7e6cf882,	0xb9a819b4,
-0x47c32050,	0x591bc9e1,	0x1eeeba2c,	0x420a24c7,
-0x62e9d152,	0x17ba6435,	0x5bac2953,	0x013c0ea1,
-0x12e2cc6c,	0x3369bd1b,	0x289c1969,	0x1cc42846,
-0x7189b3d6,	0x2c8d74aa,	0x6e54e711,	0x5c46e0b2,
-0x3a0855a5,	0x5f9e093a,	0x7c928ed7,	0x28fa4c94,
-0x63f803f6,	0x7bf7900f,	0x2ebdeb25,	0x452e411f,
-0x433b17b4,	0xdb9ef1e2,	0x03898ca6,	0x4fbb0616,
-0x38de376f,	0xea90cc1c,	0x38511e4c,	0xd148b708,
-0x9d88dd59,	0x41db3efc,	0xa841a2f0,	0xed64f759,
-0x0995223a,	0xf78773e6,	0xa0c217e4,	0x588d243c,
-0xdeb8a347,	0x01541aac,	0x734c849d,	0x79bd8585,
-0x43edc648,	0xe9ec9058,	0x395f15c1,	0xd5b649e0,
-0x8ec10807,	0x78c82a85,	0xbf95a887,	0xce983ad7,
-0x1d15dede,	0x43e74349,	0xa2cd38c0,	0xe9bbfcb2,
-0x4553bed8,	0x2c99e9f8,	0xe424062b,	0xce407a08,
-0x0c30681c,	0x3f6a4ab2,	0xefd1a7c8,	0xda291ed6,
-0x2613dd9e,	0xb04a9f4c,	0xc7d9577e,	0x7d3f7e70,
-0xb983db08,	0xbd3e7f31,	0x783ce96e,	0xc5d1af05,
-0x936a945a,	0x532eb328,	0xeb70e177,	0xb2733522,
-0x7ee59c7e,	0xe60ab1a9,	0x99f53726,	0x71620b60,
-0x921ff574,	0x4d5353d7,	0x0af7ce7f,	0x4e285e88,
-0x4e0e3e6a,	0x844dbf41,	0x4205aa45,	0xc02a9018,
-0xa8434e93,	0xbcd30fbd,	0xe18623da,	0x5bfd5cd3,
-0xcb9fc587,	0x18f149ae,	0x2d649d57,	0x362da034,
-0x640fc6db,	0x74531d2b,	0x4761817a,	0x373fb65f,
-0x0e22c094,	0x2c121d8b,	0x4bebf5b1,	0x66873d79,
-0x5f69b37a,	0xb10d11db,	0x1d9233f4,	0xa64784ff,
-0xcdd9ab49,	0x9e24a855,	0xda9467d5,	0x43fa43a9,
-0xe5dffbef,	0xd3147f58,	0x342bcd32,	0xeb398ef4,
-0xa07624bd,	0x612078b9,	0x99755fcd,	0xf70d7c16,
-0x143d6fa4,	0x7de25374,	0x8912b37f,	0xf46c427e,
-0x77a37fd1,	0x1fb824c4,	0xf8630036,	0xe756857d,
-0x1663cfaf,	0xc7a6efeb,	0xe2873c1f,	0xd9ea1602,
-0xc0a398dd,	0x49d778de,	0xdf5983dd,	0x61988838,
-0x427ea458,	0xc3d2aa46,	0x6a7c07ef,	0x52713bf3,
-0xceebe9eb,	0xf1c12137,	0x5809579d,	0x543b189d,
-0xff51c01e,	0xb5837569,	0x5d6125ea,	0x1061cad1,
-0xb233b577,	0xb7b9841e,	0x1635734d,	0x6da82921,
-0x91fd15c0,	0xc3d89c6f,	0x40fe6593,	0x799bd016,
-0xcc57561e,	0x492bb6db,	0x77c8ad4b,	0xcf0420fd,
-0x4734e15e,	0x11569799,	0xc9edefcb,	0x2d67edd3,
-0x1f31ed10,	0xb4038c08,	0x22d6be2c,	0x0e81af92,
-0xd8c83eac,	0x0690805e,	0x61720ca4,	0x9b3834ff,
-0x0c697047,	0xa167618e,	0x934bf164,	0xc93cda5c,
-0xaba0f413,	0x608eebc8,	0xc28fe564,	0x55ea298c,
-0x6c749175,	0xac180e39,	0x58feac63,	0x0c770a08,
-0xae1e8681,	0xff829710,	0x0795d59f,	0x071a80bd,
-0xf6144e2d,	0xc82b2210,	0x074b6c12,	0x39f88d43,
-0xc8164ab4,	0xfc6bfdda,	0x39a971a3,	0xcf680545,
-0x722ee5da,	0x8ee9f12b,	0x450593a6,	0xc6e82f4b,
-0xbdce0f1f,	0x8bad990d,	0xfdce63e9,	0x70e03f0b,
-0x701b77e9,	0x6de3db08,	0x8f1de62b,	0xee7cf37f,
-0x4009df1f,	0xe5a934c4,	0xc4ee2353,	0x2c348eaf,
-0xdc3e4eda,	0xc0587cf4,	0x109e3678,	0xdc624b06,
-0x05699fd1,	0x429909eb,	0x15929d5a,	0x51d42287,
-0xf339094d,	0xca1a4c9f,	0xe1ca5a68,	0x22db5b03,
-0xe5323a69,	0x358de935,	0x03e3bc2b,	0x308331dd,
-0xf1806e62,	0x9bec9496,	0xfd751ed2,	0x6533efd5,
-0x2f05dd3e,	0x0f4f2784,	0xd1fb581b,	0xdf145b59,
-0xf19b57fc,	0x0c0968ae,	0x27b6a565,	0x2d42b99f,
-0x1f29a949,	0xc349a33f,	0x32d80242,	0xf4e25ae3,
-0x261ccc25,	0x64b0d5f4,	0x1a3fec73,	0x7a133579,
-0x5b480ed6,	0x1106f906,	0x48fb0ad8,	0x5cc98d13,
-0x4bc0a84b,	0x473234fe,	0x073698d7,	0x47557d3c,
-0xe48e1f44,	0x03e77cfa,	0xe798df74,	0xe158c41d,
-0x2a8ea25f,	0x192685f7,	0xcff138bf,	0xde10a3fa,
-0x94a9cd98,	0xc15aa272,	0x5c9bc223,	0x98c38649,
-0x902c9d11,	0xb947fcd5,	0xc5ab1a43,	0x774d2dbf,
-0x33031f2a,	0x45af307f,	0xf8c150b5,	0xb06ae551,
-0x8cf8bb3a,	0xc5268cd2,	0x76a1f9ab,	0xbd771767,
-0x86eec88f,	0x5dd4e191,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2986-m086fbB8.inc  */
-0x00000001,	0x000000b8,	0x04282009,	0x000006fb,
-0x7db01441,	0x00000001,	0x00000008,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x000000b8,
-0x00000036,	0x2a000000,	0x20090422,	0x00000301,
-0x00000001,	0x000006fb,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xebf1742e,	0x487dc67d,	0xd72853f8,	0x1c22d12d,
-0x0bc4c0c9,	0x9a9da3fe,	0xa65d386f,	0x6f814020,
-0x58d10d9f,	0xb7f2421d,	0xe4d5fcf1,	0x02889a15,
-0xad9bed07,	0xa32ab3e6,	0x3491afcc,	0x9c991c37,
-0x2a1c2071,	0xf066191a,	0x3bd898e7,	0x2648d958,
-0xc05f7908,	0x05864b9b,	0xbe4c1eee,	0x1e6c7ef4,
-0x0e7a539e,	0x100b2ab3,	0x1273dceb,	0xfec8847d,
-0x8f37946f,	0x634e3b5c,	0x691dbd61,	0xd89e3cb9,
-0x094639d4,	0x7d972e1a,	0xd6dbd94d,	0x2001c3ec,
-0x34f791f0,	0xeee0d794,	0x88b7459d,	0xc2c73aa3,
-0x607a174d,	0x4f0f8304,	0x65790b35,	0x00532bfe,
-0x1fd1e0cc,	0x7b91f873,	0x154ed42b,	0x7a7108e9,
-0x81637c95,	0x192cb173,	0x28ccd94e,	0xb9bcc372,
-0xac05171b,	0x867f47da,	0xf8e8c47d,	0x1edcdb4a,
-0xd2ca6c2d,	0xe9ee9169,	0x5a6efedc,	0xb6825038,
-0x09277eaa,	0x2a34e580,	0x0f794366,	0x86c99402,
-0x211b98bf,	0xdf8eb0e3,	0xda11d7bd,	0xd440363e,
-0xa7d49f1a,	0x16dd7395,	0x5b23c2fc,	0xab93ea3c,
-0x00000011,	0x2a951fa7,	0x8e2eb625,	0x872727a1,
-0x44876f3f,	0x2c0f6158,	0xd45cf5e9,	0x54607168,
-0xa0d26aed,	0xa3fd8988,	0x9cd32a0a,	0x34d31b90,
-0x2a3d3f9a,	0x13307d43,	0x00f65908,	0xa91f7029,
-0x04034196,	0xa86763dd,	0xea93a95d,	0x016c8cf9,
-0x4b9de2ff,	0x9deb18f3,	0x1277d44a,	0xe3d81fd8,
-0x6474e760,	0x8ad051a6,	0x91b46235,	0x8ad29801,
-0x3fe22fa6,	0x1ed3d8c2,	0xe66a0f5c,	0x7351a946,
-0xda8f1735,	0xf080278c,	0xd5618cff,	0x6c9a764f,
-0x712612ac,	0x3675ee64,	0x681ce4c2,	0x064fe43f,
-0x4748bc9a,	0x796f3c47,	0xb1506e5d,	0xa0a4bf1c,
-0x399480b3,	0x12d04bdd,	0x1c1ba33c,	0x80636956,
-0x09e12327,	0x844ceeec,	0x4f49dfa7,	0x5131a56b,
-0xc5f6eab4,	0x829fbcc7,	0x2222d7d1,	0xe31cca72,
-0x5f86e2f0,	0xfce2a225,	0x774dafe3,	0x245f6aeb,
-0x31efe1a4,	0x32e45fdc,	0x9441a088,	0x0a71e66d,
-0x35b665e7,	0xaf0e45d9,	0x724aaed1,	0xe71b28aa,
-0x0a85d7eb,	0xc3301564,	0xaa36f371,	0x33828715,
-0x3fefd577,	0xbc5077f6,	0xb61ecd52,	0x718463bf,
-0x0a0b4863,	0x0230c333,	0xa07b6b06,	0x71fa24cb,
-0x23736581,	0x35a24f24,	0x07aa84cc,	0xe0f703b6,
-0x2e7a4346,	0x3cfd2d41,	0x0bf1cc46,	0x80618a01,
-0x6d2e7af8,	0x87edb675,	0xbe715b2d,	0x9a099f00,
-0x7707f4e1,	0x0be26830,	0xf4fea45c,	0x1a1ff50e,
-0xac59589a,	0x5302b891,	0xcacee84d,	0x61ccba06,
-0xa8fdf364,	0x52b087a4,	0xff8c1d03,	0xb70b23c2,
-0x6d8be28e,	0xc5881603,	0xe95a0166,	0xa57da8c5,
-0x7e9ce8a7,	0x02793a14,	0x4c3a7060,	0xb9158340,
-0x8dccaa98,	0x70fe4f8a,	0xf7110d1d,	0xfe7cea61,
-0x09f64a65,	0x02cdb3ac,	0x29a800fc,	0x5b31538d,
-0x139172c8,	0x1392fdc9,	0x2b8ef74b,	0x8f814dc1,
-0x44c62437,	0xe0ff6a6e,	0x54bcc977,	0x39531e09,
-0x0ede2d37,	0x6212b87a,	0x1a4a3497,	0x18ae28e0,
-0x3e4a6824,	0x0b9074a1,	0x95cec1f1,	0x42dd89c3,
-0x5ec94f97,	0xe3d475e0,	0x53a99eaf,	0x9416d9f3,
-0x2e7dbd9c,	0x3479d85f,	0x162108fc,	0x28fea45b,
-0x88fddf76,	0xfcd3cb1c,	0xa513e438,	0xda4b54c4,
-0x0cd940e6,	0x8116782e,	0x2d099a3d,	0x093defba,
-0x66fd715d,	0xe9b1b8cc,	0xb19ea37b,	0x29eb211d,
-0x67c4abb3,	0x99c691c9,	0x2556b76e,	0x5a18250e,
-0xf83daae5,	0x68e9ea29,	0x515cfb9a,	0xe24375a7,
-0x2f3c5d33,	0xc590ef39,	0x59719ae0,	0x0f2eb3e4,
-0xd517c978,	0x8d63a3a5,	0x6696273e,	0x52c15c86,
-0x4843e160,	0xf25a0b15,	0xefa8bfc7,	0x0fd274be,
-0x344fffdf,	0x3d007a81,	0x25a093fe,	0xb6083bae,
-0x430195fc,	0x255e8002,	0x0d559ae8,	0x5ae67790,
-0x3b4c6ef1,	0xbd0defb8,	0x30e6742d,	0xd91e4f54,
-0x23a5720e,	0x9892af37,	0xb66643ac,	0x5784c7f5,
-0x5f2157fc,	0xee0bdb53,	0x053b9413,	0x12fabc27,
-0xf5159414,	0x68bdd104,	0x26bb17c3,	0x2ad63099,
-0xa4718f3b,	0x7d83a491,	0x00e206f1,	0xbbebcc2b,
-0x2e0ae307,	0xc8f53a56,	0xcefffe4e,	0x78071689,
-0xc7946727,	0x29dfdc9d,	0x5f7cc90e,	0xbd2f5655,
-0x559970c4,	0x6ea3e6bb,	0xfef812e1,	0x6893f67d,
-0xdaaa4616,	0x0158f920,	0x55e7421b,	0x397b030c,
-0xc0e353b4,	0xadbc4870,	0xd2482de1,	0x3322a09c,
-0x869852c0,	0xbfa21833,	0x22e1fbcf,	0xfc102376,
-0xd38c9b98,	0xa149444a,	0xc4f3fa32,	0x54cb5d80,
-0x9114ce21,	0x37b38f84,	0x7513d34e,	0x41d486d6,
-0x48e074fa,	0xb61d48f5,	0x334a8555,	0x49b0cd91,
-0x8a6b90f9,	0x608d74e2,	0xae96fc66,	0x0401de61,
-0x740e5e76,	0x2cae071c,	0x7d30816d,	0xed545e0c,
-0x49c19817,	0x2f86c1a3,	0x4777abc7,	0x6b4683ae,
-0xa54de530,	0x18b258a0,	0xe3cf869b,	0xbc5cfb48,
-0x344244aa,	0x8405a80f,	0xe78ca2bc,	0xc9b5c35a,
-0x525a41af,	0xe9b8c09c,	0xcef40290,	0xeec8a2b9,
-0x714dbdbc,	0x19fb6a23,	0xda52b6f2,	0x9fdf6728,
-0x5da724d3,	0x34b1b1f6,	0xae86bb71,	0xfceec4ae,
-0x90ba25c6,	0x2b4be3f8,	0xa2bf99db,	0xee319bb7,
-0x65c7cc17,	0x2afd752a,	0x3099c5d0,	0xec90902a,
-0x9c38849f,	0xbc784540,	0x497c2f5c,	0x8fe78963,
-0xe017b2da,	0x08ab0858,	0xc4e5ebb7,	0x05216c4f,
-0x8320b666,	0xe13c2e7e,	0x9ec2d543,	0xdb69f4fb,
-0x1a5ab423,	0xb0bfa001,	0x4455e40e,	0xc139f9be,
-0xf4a07f53,	0x3aa7b1f4,	0x241aaa2e,	0x32420dd5,
-0x11e54221,	0xfd2a208b,	0x33a238b9,	0x98b808ae,
-0x3bb81df0,	0xa96eaa27,	0x15733deb,	0x272c04b5,
-0x6987452c,	0x95e0b3c5,	0x92ec3d87,	0x3512a49f,
-0x99803ab8,	0x2ac63150,	0x9c95baf9,	0x1091624e,
-0xc9cb81d9,	0x2d2290c4,	0xc49ecb85,	0xdd68050f,
-0xb9168f9f,	0xcc43d1f5,	0x72913c8b,	0x7d1ce13d,
-0x19f14484,	0xee9e8372,	0x6d8499c7,	0x25f756c6,
-0xc13496c0,	0x2387e65a,	0xe5d1c2dc,	0x158c1673,
-0x96cb1178,	0x6f2d86d8,	0xfc7d7da1,	0x7e6c19f2,
-0x86667d29,	0x4212c7b1,	0xafdb4b90,	0x395386b2,
-0x4e36241f,	0x6d64dcd6,	0x100b1c2c,	0x4acc5f7c,
-0x1ca1d043,	0xc7f9e94f,	0x62679150,	0xfb1559aa,
-0xec7ba8fb,	0xee09e687,	0x46e2a4cc,	0x83feb933,
-0x7b8de254,	0xbe2c880f,	0xe21f6252,	0xad2813fd,
-0xa901caec,	0xc17f5842,	0x95ede60c,	0xf03ff028,
-0x1c1f5a79,	0x9bf2c0b5,	0xc9318e9b,	0xf89df2fb,
-0x980e50ef,	0x883d83f1,	0x05dc5ecc,	0xbecfeb3d,
-0x87cb6fd6,	0xf5194a85,	0x1b605e16,	0xa34ca7e5,
-0x48b3bbb1,	0x040f6ac7,	0xe1d824b7,	0xa9a5a681,
-0x1836da8d,	0x0e2e7fc9,	0x4e0b3365,	0x8f85678b,
-0x7ede256d,	0x743baf7f,	0x5dd32df8,	0x3988f6e7,
-0xbe5869c0,	0x417f0fbf,	0x73b7bb1b,	0xbc5436ae,
-0x7c18d05f,	0xb57c8db8,	0x7ebf5b1c,	0x8f3bb195,
-0x74583f19,	0xd394cc34,	0x1ff82349,	0x37543fe5,
-0xe4feb4f0,	0x82e16477,	0xd25aeda9,	0x8a9d2802,
-0xfb583621,	0x0b610325,	0xd04a8859,	0xb8bb9b80,
-0xc1f25ad2,	0x40549e73,	0xbe9d2d28,	0x949a1adc,
-0x85974dfa,	0xaa3dce21,	0xf644ee26,	0xf9b05d88,
-0x3bc03eef,	0x1f0e66ab,	0xe373aae0,	0x660935cb,
-0x10e02a11,	0xfc16dd50,	0xf2aab8f3,	0x0772264b,
-0xf9d5a769,	0x5bfbe792,	0x33d313c6,	0xcceddd43,
-0xc846fb0e,	0xea507ec1,	0x992c5cd0,	0xb972e66d,
-0x6ac06508,	0x5af9e004,	0x978be6cb,	0xaa8f0378,
-0xbf4c55b4,	0xd43b75a3,	0xd1633f80,	0xfaa82238,
-0xa06a4feb,	0x46cdbd49,	0x235e9f53,	0x6c225389,
-0xdddb8e37,	0x99987cbe,	0xc10b1a12,	0xb2b42512,
-0x19b00fa7,	0xc972b2aa,	0xf655511d,	0x88b62724,
-0xc736a9c4,	0xa6fd2b9f,	0xdccda959,	0xbd87d805,
-0xee02ab55,	0xfebcd4c8,	0xa23096ab,	0x94495964,
-0xd1c52cf1,	0x0ce33220,	0xbfd64f83,	0x5ab879ba,
-0xa81cd2c5,	0x77ae5475,	0x6b1577f0,	0x4dffcabf,
-0x55797d78,	0x624176e0,	0x2a675064,	0x11683e1d,
-0x1c060580,	0x93bd04c4,	0xffb2591e,	0x66a04b5a,
-0xa83447fa,	0xa4978adf,	0x213fe843,	0xb990203a,
-0x923754f8,	0xef49f48f,	0xb832edf9,	0x8e43b18d,
-0xed250344,	0xdb4838ab,	0xc0697dc7,	0xffed4e47,
-0x5de04509,	0xd1f8045f,	0x54cf320a,	0xe688d018,
-0x771b1fb8,	0xbc0dcd75,	0xcb9037cb,	0xb9043053,
-0x136059d2,	0xd8c7ab40,	0xec859b8f,	0x0a2447c8,
-0x101566c0,	0xb4fd42c0,	0x4f49a436,	0xe51071e8,
-0x443d843a,	0x32c19b4e,	0xe03631d1,	0x1c4f70bc,
-0xe97288a0,	0x5b508b54,	0xec895875,	0x76ee77f5,
-0x1831a76d,	0xfbd8b2de,	0xa20f35f4,	0x42f27cd7,
-0x89e6fe2e,	0xce560886,	0xd5366f2c,	0xbb7e6720,
-0xc8d21d23,	0x9d2635d7,	0xfc916d88,	0xe5712b50,
-0x2dd59e1e,	0x29be6f85,	0xdbdab957,	0xf8c3a60b,
-0x7bce8080,	0xc1f09449,	0x25b54e7c,	0xa3134f63,
-0x270e71c0,	0x986d79eb,	0x61efb79a,	0x41d477f0,
-0xa729b9dd,	0x90322e39,	0x8bbc69f3,	0x89e64e81,
-0xeeafcc5f,	0x0185dfdc,	0x7ecedfb7,	0x54f8ab4d,
-0xc2fd47a3,	0xfe8c9de2,	0x931cf0a8,	0x2c798b8c,
-0x278193db,	0xb3ccf34f,	0xdf25c3c3,	0xe2e55cbf,
-0x0404032a,	0x5ccfce9e,	0xba950d0d,	0xe19fc144,
-0x0450211a,	0x8b3bae1f,	0x99798b1b,	0xf9c2c3d4,
-0xaa2a7f53,	0xad7b1a39,	0x650608a7,	0x527e734f,
-0x2bf29b1b,	0x240491a9,	0x0cccc47a,	0x01caf144,
-0xf112324b,	0xf4e727ee,	0x92306225,	0xcf381fd6,
-0x60e74e29,	0x4537e483,	0xdf7afb59,	0x0ef3d2ba,
-0xfdcbd567,	0x83bd0826,	0xf262e167,	0x318f7ef4,
-0x18f79081,	0x164d96b3,	0xbd17be54,	0xc7020759,
-0x4278ce5f,	0x54147d97,	0x4a7abb9b,	0xac607d56,
-0x8e28db0e,	0xb7d9f6fd,	0xbfcbbc42,	0xf2a7399a,
-0xcf76ee6c,	0xedd0bba7,	0xa7d38835,	0x15d43d3e,
-0xd265974b,	0xdc7c8677,	0x1b1e9162,	0x8579928a,
-0xba3160bd,	0x161eeb7d,	0xfbef9fd9,	0x5e988fdc,
-0x8589563d,	0x929f3159,	0x2f3eb5f8,	0xd4046c81,
-0x3781df71,	0xf73d142f,	0x6e09a940,	0xdf11175b,
-0x4a6cd750,	0x4bd55651,	0x17ced9d0,	0x99a3ee49,
-0xe0c69ec5,	0x31d25e87,	0x274567b0,	0xa9c0efe8,
-0x305c7621,	0x8a941ddc,	0x30fe6e03,	0x4567e5e3,
-0xecabeada,	0xd2bb30c7,	0x811ee965,	0xb4b42771,
-0x60a2ef48,	0xa9d3fe26,	0x0734cbab,	0x10b215aa,
-0x16e33def,	0x2b2e745f,	0xe1bd7e00,	0xf4b3c71e,
-0x8d6d792f,	0xf0280da8,	0x0f20456f,	0xcf8af0f6,
-0x82cbcaf4,	0xab5ff49f,	0x1d42fddf,	0x894d240c,
-0x5f1ef48d,	0x8d972d3c,	0x63e94de8,	0x576154c4,
-0x82435ace,	0x1b1b0593,	0xf143526f,	0x897b4085,
-0x9f84047e,	0x514ca06e,	0x71b49f06,	0x3aee2eb3,
-0x4a00c841,	0x619d677d,	0x6e82818f,	0x116a5893,
-0x068ddb8a,	0xe0dfa2ff,	0x507a41e4,	0x48d38270,
-0x36b346eb,	0x6f41e011,	0x0d1f9dd1,	0xc5ee0692,
-0x37dee528,	0x5e79d22d,	0xde96843d,	0x2a53b60d,
-0x5d73533d,	0x697ca3f3,	0x6471b3dd,	0x489fa5ca,
-0x9e87cf68,	0x4eff4b16,	0x4566617e,	0x07e1c66b,
-0x38ee5254,	0xce91ee22,	0x397331ae,	0x1f0380b5,
-0x51f995c2,	0xca0a2e5f,	0xe718d724,	0x351a5b11,
-0x25de8a24,	0xb97cf8f1,	0x3860a587,	0xcee65fd2,
-0x02210416,	0x3b9155ce,	0x143edd29,	0x9607d935,
-0x085cbb23,	0xdceb9646,	0x9cfceca6,	0x19c1b99e,
-0x79920ada,	0x38e1421f,	0x09d14cd7,	0xf4bd0e9d,
-0x18ef46a5,	0x0b4eb9d3,	0x7f418c14,	0x0c93d6bc,
-0xf819c494,	0xc8e7f5c3,	0x8b9748ca,	0x5985d13f,
-0xc38a9653,	0xd5c2f0c3,	0x32617e88,	0x4f7e056b,
-0xd34f9261,	0x0c9e6b68,	0xf658e4c0,	0x0ccfb638,
-0xaf95819d,	0x60971797,	0xf25289b6,	0xb0399dde,
-0xb54f1ae3,	0xf6c5f00e,	0xd812629e,	0xd4da679d,
-0x86be28d8,	0xfc257bf3,	0x9a2202c6,	0x651130ca,
-0xd401c8ed,	0x4a937465,	0x730a163d,	0xd9a3d91a,
-0x6f809aae,	0x5177a58f,	0xa765df09,	0x4c4172b5,
-0x7ad2d716,	0x9d9c5d9e,	0x93542415,	0xee8332ad,
-0x1d161da3,	0xd330f455,	0x364d3004,	0x24a9b599,
-0xa9f0c156,	0xd4aaa6a4,	0xc69f54a1,	0x3f9b6f74,
-0xe88b7075,	0x97f413b9,	0x92c45875,	0xeca74971,
-0x273de936,	0x607d6947,	0xfcbb6c51,	0xd4a35a42,
-0x39ab4a99,	0xd108aa65,	0xe01773bb,	0x7a477391,
-0x64ef8a00,	0xa7030caa,	0xfd4299fa,	0x61afcdf7,
-0x77b29125,	0x75c059f6,	0xddd86824,	0x180d192f,
-0xecad4a7b,	0xbfa85eab,	0xc78b1e6d,	0x033b40ca,
-0x3c22078b,	0x712de3a8,	0xc9f74b30,	0xa640b05e,
-0x3a687177,	0x5a75b3d8,	0x33e4392c,	0x1d7a15e9,
-0xb5c86386,	0xb60bb3f2,	0xf5a3134a,	0x98b81d09,
-0x46a34f9c,	0xcbba1498,	0xecac34aa,	0x0f64d716,
-0xa33a4095,	0x4506b782,	0x6c0911fd,	0x9c1860fd,
-0x388d24ee,	0xde1b8eea,	0xb2b396aa,	0x18062871,
-0x8ed014b6,	0xfc1cc5e0,	0x9c2aa989,	0x66c485cc,
-0xed345ea6,	0xf0fc6735,	0x0174efce,	0x02afcf8d,
-0x80f3f90e,	0x11e1bc2e,	0x32fdeef4,	0x936d8e85,
-0xa4873205,	0xd7f97201,	0x6d1fc249,	0xbfb6c2e4,
-0xbe1176da,	0x8061ff07,	0x50a96bb6,	0x3d0a198f,
-0x19a51f3f,	0x17bf5db4,	0x2e67bf16,	0xbfc93f71,
-0x6224b456,	0x9c58c335,	0x7fa318d0,	0x00abb735,
-0xa1506f2f,	0x7b65138b,	0xc8a4c3ad,	0x0a5f0881,
-0xf6ef5f3b,	0xe0f25af0,	0x71e68c61,	0x85769554,
-0x4c03f549,	0xa6a5baae,	0xb7a4204d,	0x29c76c88,
-0x3819f5c5,	0xaeea77f4,	0xf5e6817b,	0xdbe7596f,
-0x883b5862,	0xa5a6222d,	0x92694372,	0xd797569b,
-0x3ac63239,	0xd0f16da5,	0xd6872613,	0x38386a3e,
-0xf39df604,	0x9cf6cfc0,	0x454e1f11,	0xc50aeafc,
-0x8cde6c0a,	0x35242370,	0x238b921f,	0x19fcde38,
-0x6858e9e3,	0xfca80695,	0x6fa82b16,	0x841ad007,
-0x8cca0ec7,	0x571a1bf1,	0xab7440aa,	0x85dd503a,
-0x6e30ab20,	0x4a554d0a,	0xe9915c46,	0x30e5df0c,
-0x83559afe,	0xf935b5db,	0x77147f64,	0x52a917a3,
-0xd2d4947e,	0xda2e96a0,	0x23907b75,	0xecea1cea,
-0xb355a45b,	0x13acbf19,	0xd356bf11,	0xfddc1bbb,
-0xbc5d2f53,	0xf5063467,	0x5791a0d3,	0x1c6153ef,
-0x8bf515f6,	0x81c868f3,	0x28c99de3,	0xe277fea4,
-0x23c29ed8,	0x3e1af1fc,	0x1af0fbf4,	0xf7aca48a,
-0x6f0947c9,	0x2d118558,	0xa4e272fa,	0x83e87111,
-0x732009e0,	0x07312dec,	0x9edab8f1,	0xa598e688,
-0x39278bac,	0x2ddb6446,	0xfbd2d018,	0x5d8e5bf6,
-0xccf9f835,	0x66e8893f,	0xc6ae5cdc,	0xb631947b,
-0x69ee9172,	0x7818ab85,	0x0e32baee,	0x7011a6bf,
-0x74f0c212,	0x4c036f87,	0x9ad3568a,	0x3e9d49f0,
-/*  1521-m5ff4807.inc  */
-0x00000001,	0x00000007,	0x06302005,	0x00000f48,
-0xd0938263,	0x00000001,	0x0000005f,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0x26d329c9,	0x2a31e166,	0x66c2f9e9,	0x20f1b679,
-0x8418e6a9,	0x116f5f00,	0x707d6a41,	0x3e4d0c52,
-0xfbf77861,	0x11d27df0,	0xa8781fda,	0x1607aa8c,
-0x9065f419,	0x16028cad,	0x0a73e487,	0x82e268e8,
-0xb25b4ffd,	0x35e5ce9b,	0xb7076c9e,	0xbc89f562,
-0x82500ee7,	0x84bbac26,	0x56a91ac9,	0x3b779797,
-0xc366ffba,	0x82c1edf0,	0x2efa4b95,	0x638fe157,
-0xf4931de2,	0x1de21ba3,	0x92860c8b,	0x605c4d0b,
-0x49c76b47,	0x698c8b80,	0x6725edb9,	0x1be37787,
-0x0513890b,	0x69e5aa1c,	0x1c109c96,	0x9276986d,
-0x8df3ba1d,	0x091851f2,	0x879b75e2,	0xaaa7fb42,
-0x867616cf,	0xbc6dce65,	0x4a6d1dd3,	0x16bed1b1,
-0x1d889d22,	0x90f4fe8d,	0x7146fe49,	0x6dc47fc0,
-0x2deeea68,	0x106c9c9a,	0x0c3236b6,	0x4ce15a87,
-0xf4e86e50,	0x62ed122b,	0x103315d0,	0x045348ad,
-0xccadafdf,	0x751df108,	0x7cd8a8f8,	0xf6094c95,
-0x6dfa8897,	0x06cb717b,	0x812e7985,	0xe2138280,
-0xfbdbbd90,	0xcd78270c,	0xd1136263,	0x1624eca4,
-0xac36fd00,	0xc6f92d02,	0x7d7cde6c,	0x7d42f8d8,
-0x1debf85c,	0x16f44a7f,	0xb108cefd,	0x6f74f0e7,
-0x2cf15966,	0x43b44ecb,	0x0c7acbb5,	0x3f811a1a,
-0x7362aad9,	0x60a38395,	0x0bea2c1d,	0xce4c32bf,
-0x73ef7173,	0x2c3e8a79,	0x57f45aa4,	0xe936c616,
-0x1e2ac943,	0xf7936b29,	0x2bc26fcd,	0x1415abeb,
-0x6b2a186e,	0xde918cc0,	0x1c260822,	0x27c38d5e,
-0x711e0ba7,	0x3954496b,	0x4a142649,	0x3044ed5c,
-0xf64e33b4,	0x1135ab77,	0xf5eb8a21,	0x1b8812ba,
-0x9ce2a81b,	0x180a3666,	0xf7ad6aa5,	0x0bcd4265,
-0x85412eed,	0x3dd0cd50,	0x47bfa46a,	0x1e1361be,
-0xdf1442e8,	0x37d16ec2,	0x9b001437,	0x1d3f0f83,
-0xd19cdda9,	0x1842234f,	0xa1816f52,	0xae04e7b0,
-0x29785274,	0x33108fa9,	0x0be625c2,	0x99c34506,
-0x5a2a3fb2,	0x899c02aa,	0x201a96bd,	0x30f06406,
-0x119a16de,	0xa9f8cde4,	0xfd3f05a8,	0x1d32e01f,
-0x7d255d7e,	0x1ab06d89,	0x82f8e458,	0x372e977a,
-0xbd4383b3,	0x35b339a8,	0xbed83b22,	0x3ca1a8e1,
-0x9acb1a79,	0x133015f1,	0xab2de80a,	0x1ffa4635,
-0x7b289ca3,	0x27d464a5,	0xbf8513aa,	0x0953f0ef,
-0x8c289cd9,	0x29bfd938,	0xb330e038,	0x2e752cbd,
-0xef07878f,	0x0abdde48,	0x23bdbeae,	0xacb2961f,
-0x256b164e,	0x18cd4b10,	0xb8710450,	0xb3473090,
-0xf93076db,	0xb3af056e,	0xd42d7443,	0x058038f3,
-0x0cb42251,	0xb59f0cac,	0x4aee1890,	0x3a3dac62,
-0x834e2b58,	0x008ce6e8,	0xb54665aa,	0x011af9ea,
-0xef75ff6e,	0x28105b21,	0x99e65e67,	0x26b786f8,
-0xc54fa94e,	0x2ca1ec0c,	0x97f5cdea,	0xc34c6a73,
-0xf84db454,	0x0ca6a53f,	0xd4439423,	0xfce0200b,
-0xfcb91cf2,	0xecd91276,	0x8410b378,	0x36d0417a,
-0xe5aba0cd,	0xf499e947,	0x5db658f2,	0x59c7b74f,
-0xfb5534b5,	0x24962122,	0x6cb4a7cb,	0x751ff89f,
-0xcaaf49ec,	0x687e084f,	0x98fb9aee,	0x194bcdc8,
-0x4a4ebb51,	0x7a7a5ecd,	0x0608ca23,	0x9c452376,
-0x37fe00df,	0x3fbae5e5,	0xa4ac30f4,	0xab34d2f2,
-0xa9809c2f,	0xacda54b5,	0x928ff76c,	0x3acd87c4,
-0x4e993e24,	0xaddd2bc3,	0xf209c792,	0x7e2da52a,
-0xce7b681a,	0x0032afeb,	0x88d3e9e0,	0x498296ba,
-0x2f6aad06,	0x55a24b33,	0x9b025513,	0x0381fe99,
-0xd55c4f51,	0x57f667a6,	0x993673b4,	0x9c9b87ab,
-0xf4f1b67b,	0x31a03ebb,	0x903390b3,	0xaddf67b5,
-0x07cd982f,	0x8140dfd2,	0x8d5d0100,	0x0fd5b620,
-0x2c77b00d,	0x923866f7,	0xe4ff8e7e,	0x1de67a57,
-0xa3bff444,	0x3e73ab15,	0x3815c6dc,	0x347067de,
-0xcfd4a9d0,	0x261517ca,	0xe65c41d4,	0x15dd1d33,
-0xa3c61112,	0x27186852,	0xd75a74a4,	0xa907a37a,
-0x450a1a48,	0x3681379c,	0x14688ef3,	0xb394ca30,
-0x6c6a7180,	0x8d92a1c4,	0x54d485ba,	0x12ce5cd8,
-0x05abf478,	0x8ab2eb67,	0xb35331ea,	0x7b0eb20e,
-0x49875e9b,	0x0f537d80,	0x793d97b5,	0x739c4919,
-0x7457e25c,	0x59bb23b8,	0x92f14d7a,	0x3aee7846,
-0x94f0d443,	0x72c7840b,	0x3c39f33e,	0xd6249267,
-0x04eaecf5,	0x01eff271,	0xff3fc968,	0xd5be480c,
-0xe98acc2d,	0xe66a8c10,	0x853553a7,	0x1814dc35,
-0x3b0b33f7,	0xff955179,	0x79be003e,	0x2e0922ce,
-0x66038e77,	0x35d7d68e,	0xe0472ea0,	0x08adc04f,
-0xc9e431f4,	0x20533f0e,	0xb0c1a69c,	0x1bdb8cde,
-0x79cd5852,	0x12bc5c95,	0xeb92a5ec,	0x87e4dec2,
-0x372a6079,	0x1a0b68b8,	0x0fff60c3,	0x975946d3,
-0x7f81f7b8,	0xbbf6f932,	0x72ae43ec,	0x09e15978,
-0x1f6c46bd,	0x9c4c535c,	0x6940e513,	0x5d67c5b2,
-0xd5d9cf00,	0x06234f8f,	0x49516da5,	0x6dd03aac,
-0xc08dfa52,	0x4f2254c3,	0x59626c09,	0x3f0e1970,
-0x81dc904d,	0x6f69377a,	0x991daff4,	0x57cff106,
-0xf749da77,	0x0c2692ed,	0x3eafef42,	0x6efb757d,
-0x873b1130,	0x418474ad,	0x1c4cf7ef,	0x2311e096,
-0xb67cf807,	0x6dd18fd1,	0xc4c68d72,	0xfaf3bfc9,
-0x89f35dfc,	0x19b07cc5,	0x27209822,	0xe2a9b0dd,
-0x2bbe3848,	0xc657b6bc,	0x3f50b3a4,	0x2a801164,
-0x11e7992b,	0xef41594f,	0x1dc7afd8,	0x4e86fc9d,
-0x3e19d225,	0x04b2fb67,	0x2530bf28,	0x4d5310ed,
-0x5e73962a,	0x582755ea,	0xf8d6afb3,	0x0c11d4fb,
-0xe1824faf,	0x490811c5,	0x3d78a250,	0xa32786d9,
-0xbd626c2a,	0x20c7898c,	0x0a740d2b,	0x95d42069,
-0x3c54f3d2,	0x802294a6,	0x91734eda,	0x360edb8d,
-0x91c193e3,	0x9c102c40,	0x6d0f3116,	0x34de39f4,
-0x98ef4001,	0x1afa00b0,	0xab57cd3e,	0x071de60b,
-0x58b9bc66,	0x12878ac8,	0xf09db7f4,	0x2d24a91f,
-0xa2146992,	0x015ca3b7,	0x851284a7,	0xf222f9c9,
-0xe170191d,	0x3a665e9d,	0x45851684,	0xe397777d,
-0x4747ae71,	0xcc99dd99,	0xc546154b,	0x189d7ca5,
-0x2c7bf0b5,	0xdf8ccd5e,	0x3f203b3e,	0x662b2c60,
-0xe734fb1b,	0x21393f9e,	0xadb29511,	0x67c90049,
-0xd5bb8b21,	0x4e69c8bd,	0x65db40f7,	0x2a69a9bd,
-0xb56edbb4,	0x6fae3038,	0x03219228,	0xdbc4af3d,
-0xa59d7a3a,	0x362d2168,	0x0d9c7c27,	0xe62be3d4,
-0xb63a6b13,	0xef7860d3,	0xa4d117f9,	0x369be422,
-0x8d27cc00,	0xc7a1bb67,	0x7836549c,	0x20ed758a,
-0x90ad7500,	0x38b929a0,	0x3229d9af,	0x154b028f,
-0x97232dda,	0x15cb4f42,	0xa58077ec,	0x276ccbbe,
-0xb0de78fb,	0x3264115f,	0x0f4b174f,	0xbe2a65a6,
-0xda506ff5,	0x0d4d559d,	0x79948872,	0x8a95fd4c,
-0x12d6335c,	0x844f497a,	0x9bb45150,	0x28bd620c,
-0x80b40b4c,	0xb4051d5e,	0x455eae91,	0xd28e3e52,
-0xac4d592d,	0x3ad6a991,	0xf074cb5f,	0xc6973256,
-0xaa71e4c3,	0xd6eb7c57,	0x581a55e7,	0x00e1b63b,
-0x255aeb5c,	0xf027ba58,	0xd9bfa4cd,	0x6d03b145,
-0x663eea00,	0x29233db7,	0x4437557b,	0x5a7c23ee,
-0x365580a1,	0x411f866d,	0x8c9bdcd3,	0x2b4a96a1,
-0xc8bf36ea,	0x51236715,	0x7132a778,	0xc73c07ca,
-0x8d289809,	0x3c974992,	0x5d770492,	0xc2908798,
-0x00a24042,	0xf4bc0a54,	0x40c0ba8d,	0x07b1258e,
-0xbc51f7c4,	0xd9ee4929,	0xbe0bfc9c,	0x334421b2,
-0x889eebe8,	0x3c03fcbc,	0xbf22d714,	0x3587a446,
-0x37ca6e3d,	0x01e338d4,	0x31bf68ff,	0x00fabf85,
-0x57494c1e,	0x17020886,	0xbc0572eb,	0xdc9600ab,
-0xeb710c7b,	0x0eddd9b2,	0x1193ed40,	0xc69f5e7a,
-0x62040a15,	0xd0e3e898,	0x0b18d0af,	0x366af56d,
-0x5b8536d6,	0xe4a65046,	0x965930f4,	0x263cb67e,
-0x09c9d4f9,	0x3bfb7a4d,	0x95bad066,	0x30133fd6,
-0x3e15f9bc,	0x0e194da9,	0xa5b2b20d,	0x2a2936dc,
-0x336f26f0,	0x3f344e86,	0xd9488143,	0x8b64dd28,
-0xbd4b145b,	0x200a19bb,	0xd21537be,	0x908c8c9f,
-0xa8221796,	0xbbb73fff,	0x07e356db,	0x38bec8d1,
-0xfa6ff6c0,	0x86835c79,	0x76428063,	0x5ee63b8c,
-0x05498359,	0x394944ec,	0x2cc16b7a,	0x40e36aec,
-0xdf71f61d,	0x5d2c7324,	0x08efba21,	0x37ac71ea,
-0xa2b2b251,	0x4b986748,	0xc28aaa7f,	0xcf84e31a,
-0xeb2fa943,	0x057e302a,	0xa2530048,	0xefe24dd4,
-0xa8fb035d,	0xfc417d87,	0x4629a3b9,	0x21775352,
-0x1a5a64b8,	0xe59b2055,	0x8e257fcd,	0x24261511,
-0xb2be3f5f,	0x1b4ef82d,	0xe131fe18,	0x337b53c9,
-0x55c11b19,	0x229e3819,	0x11a8923a,	0x0dd5168f,
-0x507dafa6,	0x1dc50a76,	0xb4aa3257,	0x8ddfca38,
-0x1c987a61,	0x20735b89,	0xa73455c1,	0x8f459b40,
-0x05007320,	0xb65bd8d8,	0x938a9956,	0x3913cd4b,
-0x37cac3a3,	0xb14cc5e4,	0x5b0372df,	0x2777e6c1,
-0x6a6259dd,	0x05f27545,	0xba159c25,	0x3adfb42f,
-0x77016837,	0x09fc1014,	0xbfe6dc10,	0x154f77ea,
-0xb6f1ce8e,	0x2aa99bab,	0x230d5ff2,	0xa3bef6f8,
-0x6db613a1,	0x39e0167d,	0x9d057421,	0x9cd0aed8,
-0x4c722d24,	0xaebe325e,	0x259dfcc5,	0x39b4b6e4,
-0xcec2edb0,	0xaeda631f,	0x646977ed,	0x41e40c9c,
-0xff8ecfd8,	0x0892af92,	0xe7d50c3b,	0x6fb106e2,
-0x63206315,	0x78070c93,	0x9d03b462,	0x163a4202,
-0x92ef3da6,	0x5f249006,	0xde090c17,	0xea9f368b,
-0xb67f6e31,	0x22c1870a,	0x23541006,	0xdcf6fab1,
-0x55150fe3,	0xc0dbd69f,	0x3d3f88e7,	0x1da20749,
-0xdb4c7249,	0xfd1e1242,	0xd15db994,	0x71104f58,
-0x078ee22e,	0x2ac24674,	0x28c84427,	0x460e4859,
-0x520980fc,	0x6222abd4,	0x362bb52e,	0x183b64f0,
-0x75d5c416,	0x7ccae489,	0xf7083301,	0x83b210d7,
-0xf391a201,	0x2c0e136d,	0x51b6872b,	0x9db440dd,
-0xa59d7875,	0xa976f5cf,	0xc705bdc2,	0x0b7fa6be,
-0x1f4c0df4,	0xa63395cd,	0x926a78a6,	0x3a3fb625,
-0x276ebcef,	0x0f1595dc,	0x1bcab7f7,	0x065744f9,
-0xb7679ba0,	0x24606525,	0xaaa30b45,	0x341f5ea4,
-0xd155c561,	0x1b4b0a65,	0x63a36a4b,	0x097d9eea,
-0x2a07c905,	0x1e2fc01c,	0x8860a3b0,	0x25eabc20,
-0xa4c20b4a,	0x353eb5d1,	0x31964504,	0x0e224464,
-0xb6cfca44,	0x32bb77ac,	0xf3e37914,	0xed46cd81,
-0xe57acbe7,	0x1d6922ea,	0x7251aac0,	0xdfc9cc46,
-0x6fa6b37d,	0xd3a99cbd,	0xad81ff1f,	0x36b291c0,
-0x91ff7f94,	0xee28fb63,	0xe5a52bb6,	0x5f1037db,
-0x88587ff9,	0x3df7d637,	0xb0b61834,	0x7884cdfa,
-0xb1732935,	0x00d0306b,	0x824c92d2,	0xd09640b8,
-0x35d5aa27,	0x1e6aef33,	0x75e5850d,	0x18ba7cab,
-0x735c8ad5,	0xd79045f3,	0x9b86ccba,	0xd5448883,
-0x68784740,	0x9dede6a6,	0x37540723,	0xdc8dfde7,
-0xbb3fce7d,	0xa8de647c,	0x5d414a14,	0x2dbc3e19,
-0x06fee8a2,	0xf9df2b49,	0xa66607bf,	0xa6793f17,
-0xace3fb23,	0xb30c40ea,	0xff798ce1,	0x8c87c2a9,
-0xcab87256,	0x730ff551,	0x9c8addc0,	0xcb52ac8b,
-0x60b47338,	0x8ff343fa,	0x18a69cac,	0x2866c9db,
-0x6c0665c6,	0xbb9d9b29,	0x3dda21c4,	0x773f8916,
-0x77c4ae2b,	0x6e1b6c6f,	0x85b98de2,	0x9fd1b7be,
-0x33917c11,	0x2be25fb1,	0x1ae146dc,	0xba0d2703,
-0x0c8310d1,	0x801d6100,	0xb7dfde3f,	0xccc72ddc,
-0x7b09d6d5,	0x921e54ae,	0xb72ee68e,	0x11e69284,
-0x0efff061,	0x07983fe0,	0x6cf3bd9a,	0x0eedd36b,
-0x1444744e,	0x37c5b1ee,	0x8f6c17c9,	0x75dbd656,
-/*  2389-m16f25a.inc  */
-0x00000001,	0x0000005a,	0x09262007,	0x000006f2,
-0x594ddba0,	0x00000001,	0x00000001,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x152fb7fd,	0x850cbe5b,	0xe75e2947,	0xf788eb54,
-0xabca24f1,	0x16fc1a71,	0x7f21cab8,	0x3d73c05c,
-0x755d87e6,	0x13a4319f,	0x557caa79,	0x18cae86c,
-0x73f505c1,	0xeae87978,	0x935e984e,	0x21e586a9,
-0x6f8dd7cf,	0xb13522c2,	0x8ac3f259,	0x22fec739,
-0x9fa75b90,	0x3a73fcc9,	0x1f3de62b,	0x9118414f,
-0x788f3e85,	0x02dd4ff6,	0x9d1ca368,	0x58bbb255,
-0xf60514cf,	0x0740be5a,	0x91c73633,	0xc9d2a381,
-0x32d6d9c8,	0x5f6763f3,	0xefbdaf07,	0x5520aff2,
-0x4ecf52bf,	0x417700ed,	0x61628b47,	0xbba700d5,
-0x65492543,	0x77d372ed,	0xcc6f7445,	0xe8e1f1fc,
-0x4f168aa8,	0xbda26bae,	0xaf4d8926,	0xb9dd2c84,
-0x2f7bf0e8,	0x01086c71,	0x673ba5a1,	0x1a4502ef,
-0xf6e77b29,	0xc2a5a476,	0xf2269ba8,	0x63d33a8e,
-0xb7e9fb2c,	0x543b2915,	0x1b457be2,	0xa1c59632,
-0x2c84e2e7,	0x9cf6439f,	0x65ed7d8f,	0x95b4267d,
-0xd7bce79c,	0x4797f834,	0x68cdd196,	0xd5f0e2ea,
-0xa3ae3170,	0x7cfe8168,	0x7afd2fdb,	0x012486da,
-0x35f1667b,	0x0973298f,	0x00091763,	0xeee07b37,
-0x90e4a608,	0xe76e89f7,	0xab4c198e,	0x49572f69,
-0xd023feb1,	0xf058f820,	0x5c07ccda,	0x606dac10,
-0x20b87c7a,	0xb527d8c9,	0xfe2c66c2,	0xcd8aae4b,
-0x4b238f67,	0x3432b883,	0xcc779cf3,	0xc79b4662,
-0xdbf4f9f6,	0x4eb4c769,	0x48c093f8,	0x601f6666,
-0x5ddd73cd,	0x6559ed49,	0x252b9fe0,	0x7fdf6ba7,
-0xd976c227,	0xb848e27a,	0x769d43bb,	0xd76c31b7,
-0x8a5fd658,	0x95a5c6b3,	0x9f1393a2,	0x25e918d1,
-0xe96a36b2,	0x1aaecb55,	0x068c18cc,	0xe6614d61,
-0xa232c14b,	0x13d513d2,	0xd9ccd4d9,	0xca99a988,
-0xd44b42cd,	0xb6abb17a,	0x07031920,	0x886f8fe1,
-0xc7756a52,	0x82ee4f9a,	0x2f356d42,	0x2044dcb7,
-0xea2da2ab,	0x7726fd32,	0xcf979e08,	0x5e0e0354,
-0x1ba120b3,	0xcc21b547,	0xbf98e8ff,	0x114a1bfe,
-0x3e41fece,	0x07b5f920,	0x88cf832b,	0xf5e98deb,
-0x34747f7a,	0x03a39064,	0x5da11460,	0xbfb41656,
-0x95a111fa,	0x1df7e7d2,	0xf0680ade,	0x071d3c53,
-0x79ba893f,	0x7791507e,	0x5a098130,	0x9a7752ab,
-0xa6a4a0a6,	0x4f45a65b,	0x3614be25,	0xd65ae806,
-0x82fafbf9,	0xcf9a932a,	0x16e39c33,	0x0eb56b4c,
-0x08c6d8d2,	0xdc73c409,	0xa0153cc0,	0x88a68745,
-0xfdd65375,	0xfaa74f1a,	0xf6e6877f,	0x1a0c85d2,
-0x479f5a10,	0x78f67d26,	0x88c910c6,	0xf36fffad,
-0x4082b994,	0xd266ac62,	0x4d739545,	0x1fc2f70b,
-0x1b7e1ac0,	0x67777d41,	0xecda77ef,	0xf32afc1d,
-0x15dee9c4,	0x60e531c8,	0xa5c54184,	0x8f22a836,
-0xaee5e044,	0xe1c0617d,	0xc00d440c,	0xc93395a2,
-0x86e7c3b7,	0x318382f8,	0xe53c45dd,	0x18b57b37,
-0x6000e01d,	0x22cc6cc4,	0xe265c1f3,	0x98012e13,
-0x038eec0a,	0xb2f6cf92,	0x89ce1fe5,	0x43de926c,
-0x5a0b8ae3,	0xb6cfc1e3,	0xa7e8a621,	0xc6bfca93,
-0x9e1b77d1,	0xb8fc54e7,	0x7560bd2f,	0x4cabd94f,
-0xc6831724,	0x178bc5e6,	0x1f9c59a0,	0x269e95c2,
-0x03c270c2,	0x8db34d1e,	0xbe92f0c1,	0xdd0445b1,
-0xd3113a3c,	0x876339a2,	0x810f39fb,	0xbebe992a,
-0x780c4d20,	0x8407ca95,	0x9ab841f0,	0x36cdd022,
-0x863f1c26,	0x4c40d415,	0x94fce6ce,	0x8388f1b0,
-0xe63d30b3,	0x8267aa21,	0xaa68b68b,	0x191bbe3e,
-0x7ea62abb,	0xb0d0c35d,	0x790d80de,	0x5dd613b8,
-0x42fde2b1,	0xddafeb79,	0xf5b58ec2,	0x3a972e04,
-0x1dfd433d,	0xc5c3c230,	0xf09997e2,	0x30e1411c,
-0xf05fcbcf,	0x6b5be86b,	0x48e480cd,	0xad260caf,
-0xb279f8d6,	0xa883729e,	0x3a143f6e,	0xe8c59008,
-0x5f5a1a05,	0xc576e1f5,	0xb22bbd82,	0xef74f199,
-0xf4d8b068,	0x7106e506,	0x8182a8cc,	0x9d794773,
-0xb1d603be,	0x3478f207,	0x85026e92,	0xe91ecc16,
-0x73294d00,	0xfe797696,	0x75c8310f,	0xe9964758,
-0xaf769bd0,	0xde532e94,	0xb7578b7c,	0x5916f8ac,
-0x6fba254b,	0x5739e288,	0xec6800c2,	0x507f69be,
-0xf442a1ea,	0x871e84f0,	0x7116a0ef,	0x576648be,
-0x4dee7717,	0xe099452d,	0xa0ade876,	0xde18e59c,
-0xaa0fb31d,	0x4e92256f,	0x5d44ca1c,	0x251b2dae,
-0x476cb2ba,	0x85237506,	0xef2b6aee,	0xd0936e7b,
-0x30f8ba52,	0xb923acda,	0xe0d0c993,	0xd3de81a4,
-0xf6cdece1,	0x27ed29b3,	0x21dabde0,	0x935ff7f5,
-0x9d855b92,	0xa52cb2f2,	0x498fa9b3,	0x49bf08bb,
-0xa36266a9,	0xde341a10,	0x885675fb,	0xd8264d75,
-0x6c2a8e9f,	0x48d4875d,	0x9aaf73e3,	0x422aa96b,
-0x15a58d18,	0x1449a939,	0x93cf44b6,	0x501896fb,
-0xd59a46eb,	0x90ddacad,	0x84fde9ad,	0xa3295550,
-0x3704c2a4,	0xb9e6c49e,	0x088237b7,	0x1772a5ab,
-0x32d7f004,	0x54c680f4,	0xcd5c7635,	0x945ec9cf,
-0x66893f71,	0x36c50881,	0xc51ea31c,	0xacbcfffb,
-0xcddc5d97,	0x56a70a0a,	0x9e64a05c,	0x50d632ee,
-0x4c2517b7,	0xe781d33b,	0x83da0d2b,	0x17cdb806,
-0x15aca814,	0x82db0921,	0x40d2c497,	0xf28459b8,
-0xaf62cfa2,	0xb6657c05,	0x96f8c0b6,	0xd3b1305e,
-0xc3dd0d08,	0x04b7e05d,	0xe95854d3,	0xefee27b9,
-0xaf33db1d,	0x920a7626,	0x66680468,	0x32348218,
-0xb627a0e2,	0xa794b5fe,	0x2cde0b39,	0xaeb66413,
-0xfec7e465,	0x1a8038ce,	0xd2b94d31,	0xd63ffead,
-0xbb03b14b,	0x1fb7384c,	0x16c47560,	0xd4920900,
-0x027470d9,	0xe4f22b45,	0x9c5d987c,	0x029e447b,
-0x7d67d952,	0xade3cd07,	0x37b7814a,	0x9db82614,
-0x4bf56cd2,	0x8d711f84,	0x9cff31fa,	0xfbfa8289,
-0x8fd9bf51,	0x8f354bcd,	0xf81e7c6e,	0x3464e90b,
-0xb7360bba,	0x050ea5d0,	0x30ab2959,	0x4d83c638,
-0x3baafa77,	0xd7b5c348,	0xde518699,	0x073dbbfc,
-0x84bf5141,	0x4f0b446f,	0x8e19fc4b,	0xca72ab4a,
-0xfef52d7a,	0x67308c55,	0xd11a79c0,	0x1cd51780,
-0xf03aceb9,	0x62a55ded,	0xa3e00544,	0xc71845c1,
-0xc2bf8165,	0x12e69ba8,	0xfcb4cd01,	0x6cb4cf9a,
-0xea6d586d,	0x7fe13e82,	0x9d54a259,	0x97ac9459,
-0x80a49396,	0xc85d02c6,	0xf0fbf19a,	0xc0860ae5,
-0x3ff44232,	0x76602448,	0x0a706a10,	0x141dd13c,
-0xe61b8b64,	0x6e4be14a,	0x4e6d87a9,	0x478d98ea,
-0x730a2273,	0xb7007acc,	0x692ec7b3,	0x1d389f7d,
-0xb793f67e,	0xd8d66265,	0xd8b993b4,	0xfc6d88bc,
-0xa9d3add0,	0x9e59435a,	0x9e7969f1,	0xd243fd73,
-0x6effdde5,	0x1dbf31a2,	0x320ca346,	0x1b73bfd8,
-0xda401aa8,	0x13cdf71d,	0xfe20d240,	0x3bdfecdb,
-0x0b123e41,	0x752ee304,	0xd9c5da00,	0xe3c01c7e,
-0x9ce03107,	0x89d8a300,	0xbede9c6d,	0x438d0958,
-0x2841ebbd,	0x7c7dfc6f,	0x1849ab1c,	0x1178a256,
-0xca4abbae,	0x2e0bb313,	0x888e8346,	0x595130bc,
-0xb21f1bf2,	0x4cb7ad8c,	0x96749830,	0x0c3516ba,
-0x2302f8c1,	0xb111f506,	0x8395f1ea,	0xfde48a3a,
-0xf3735f71,	0xc9659b54,	0x88992529,	0xeb887aca,
-0x6c0e87f6,	0xd6362d67,	0x968fd0ac,	0xcff7ea9a,
-0x7988fd1f,	0xd00271db,	0x38c22f93,	0x34badb85,
-0x9f8f2283,	0x577c6448,	0xb1bd60e1,	0xd2796580,
-0x50c829e4,	0x0605fdee,	0x748ddfc7,	0x36bd94f8,
-0x264749ba,	0x8a54e5f6,	0x3a19a84b,	0x6f584bd0,
-0x64fc0ef3,	0xe7e98d57,	0xcc4d8e0c,	0x041a0079,
-0xf5084b9d,	0x4c3b3927,	0xfa1d2e98,	0x71dcd1bc,
-0xf74491ea,	0xfd97d9f7,	0x768912d6,	0xb1d674b4,
-0x52f0716e,	0x8387ed44,	0x7a3406cc,	0xd9b25c3b,
-0x3c2856c7,	0x99f4bd12,	0x44d2e06e,	0x4056feaa,
-0xe731e402,	0x490774b3,	0xa6377412,	0x5b57bc0e,
-0xe37ee94b,	0x1aef05a3,	0x3729ca7b,	0x7f804ba9,
-0x589b5805,	0x60354265,	0x2cf4d695,	0xadb62dce,
-0x853cfcbd,	0x31cb5ebb,	0x00c80ca8,	0x51cdb21b,
-0xad6be78e,	0xa8e9ffeb,	0xb656155d,	0xafea149a,
-0x9fbcb3bc,	0xc89f6b72,	0x6d03f3bc,	0x3381da15,
-0x8a267f92,	0xdcf5bf30,	0x38496dbf,	0xc5bd6b9e,
-0xa9918af0,	0xc8fad63c,	0xe218d792,	0x83eacea6,
-0x418c76a1,	0x749d613e,	0xbe36f88c,	0xb84cd7d6,
-0xb4e7308e,	0xce6e4143,	0xd39fa6a0,	0xbe7bb3b1,
-0x9eece758,	0x8d490022,	0x9c5b92cc,	0xc57b244d,
-0x6b442bb1,	0xb19d0c26,	0x1e3e1fe4,	0xfd9e384c,
-0x642a3233,	0x4b7a4358,	0xe4b4a9b0,	0x920a89bc,
-0x67bdce9c,	0x7d96b2ac,	0x5cbe3c13,	0x4af3f4b5,
-0xa4e701d3,	0x80b4efe1,	0x841613f3,	0x64a49885,
-0x45d821ff,	0x1a7a2117,	0x93147289,	0x8ebbe7e9,
-0xcd3f04c4,	0xdb888d97,	0x0c55b583,	0x80ace4e3,
-0x11ab298e,	0x8fc499d4,	0x98ec32fe,	0x086b0642,
-0x290732f1,	0x562bb750,	0xac9b7a2c,	0x1f1b85e5,
-0x04ac16e9,	0xc9e86674,	0x5eecf0cc,	0xc276c820,
-0x5584fc0a,	0x947af43e,	0xc391c579,	0x59f0f0f3,
-0x33d729c8,	0x9250c732,	0x3b364a2b,	0xcc028b92,
-0xf6339e57,	0x67bdb10b,	0x8adc8905,	0x808475e0,
-0xfb69fcd1,	0xf7088f7e,	0xafcd6732,	0x0ffcbbfd,
-0x64058baa,	0xbaa6996f,	0x04221519,	0xe64e5801,
-0x3d1b3c28,	0xc5ab8d20,	0x5291ed0e,	0x52e8939a,
-0x79ebe0a2,	0x5e548b49,	0xf069bbc5,	0xd102a0ec,
-0xe5a7b49c,	0x0a9f6417,	0x67493489,	0xe386752a,
-0x59755c62,	0xe95ea052,	0x4d4f6403,	0xa6636625,
-0x93cf3e3d,	0xe2894a74,	0xf7f55522,	0xfeddb51e,
-0xfb5be65a,	0x8e5ef093,	0x52bce66f,	0x56937c52,
-0xb0bbc6c2,	0x03574feb,	0x0d0c94c0,	0xd160828b,
-0xccb2f851,	0xabcb3b49,	0xc3eabce5,	0x7930acd8,
-0x0076ca0e,	0x85cc9159,	0x2545f934,	0x6968716b,
-0xa01609c2,	0x592322f9,	0xac8ca99c,	0xf97b4b52,
-0x398fbd8a,	0x403d0e0b,	0xa38b4549,	0xcd89c55e,
-0xc6cfbce5,	0xb932e3dc,	0xa5242c59,	0xe391ceb8,
-0xa1efb4eb,	0x06ee07eb,	0xb4d5ddd1,	0xae38b88c,
-0x0bb94dfe,	0xf02b0125,	0x910bb8be,	0x80f9d20c,
-0xf017bc44,	0x18342c66,	0xc4495bfe,	0x14e9b1d8,
-0xd61a63f0,	0x1283c3dc,	0xb8663c79,	0x591f1fc9,
-0x0f52cab0,	0x530e9c52,	0x327f0380,	0x932c89a0,
-0xe7895303,	0xedeb046d,	0x400219af,	0x08eabb3c,
-0x824199ce,	0xbc188572,	0xe35e844a,	0x409b6afa,
-0x9d80ae8d,	0x98be78c2,	0x49049ab1,	0xfb921fed,
-0xf47c6b1c,	0x54ce9a0a,	0x9c81b083,	0x31694911,
-0xc5adaa93,	0x51f4d362,	0x45949957,	0xa1bc132d,
-0xdbc037b8,	0x510f859d,	0x4a3e70d0,	0xea91f20b,
-0xbaa64855,	0x32acc401,	0xc689dcc3,	0xac71af82,
-0x47a2c479,	0x617b1df3,	0x98968c18,	0x3f342afc,
-0x921cdd37,	0x9c515004,	0xdea8d3e3,	0x576fa5ff,
-0x719a6fae,	0x98635ce2,	0x4eae86fc,	0xc77aedff,
-0xe3076a45,	0xf672338b,	0x3e930234,	0x43301a6b,
-0xad2fe508,	0x4d307dde,	0x2e9a599d,	0xad7e4242,
-0xa62b3239,	0x14b02e24,	0x43d3fb7c,	0x31fb39c0,
-0xc1c4de0d,	0x44984242,	0x1d35462a,	0xcdb6205d,
-0xe138a574,	0x33cd0479,	0x2bf3fa56,	0xb25de4ce,
-0x99a25cc9,	0xa7859b8c,	0xc4dc3178,	0x898d8b27,
-0x47778970,	0xf4b3a46a,	0xbbba9097,	0x18824623,
-0x3941733d,	0x5028d200,	0xb4c6c63e,	0xe552da5f,
-0xd0af35d9,	0x70d99fd0,	0x5e483b30,	0x6826811d,
-0xd6f56267,	0xccbd900e,	0xbfe8e78a,	0x34f53ae9,
-0x28b554a4,	0xd0c8b157,	0x91e55d6d,	0xdec21006,
-0x74a135df,	0xd5d3d4fc,	0x24011884,	0xb2946e4f,
-0xa643a55a,	0xe2d20347,	0x67a2100a,	0x96efd06e,
-0xa870a665,	0x662e084f,	0x5ecd5092,	0x03c658c3,
-0xcb363766,	0x676bef19,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  1869-m806ec59.inc  */
-0x00000001,	0x00000059,	0x09122006,	0x000006ec,
-0x75996a3e,	0x00000001,	0x00000080,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x53b182f4,	0x30d6de9c,	0xfb30545c,	0x58852265,
-0xbf1878d3,	0xaadee666,	0x646fc5fb,	0xa45c8461,
-0xc01f708d,	0x2bcc9025,	0xe7b2edeb,	0xd18292c6,
-0x39069d18,	0xf6e3dd30,	0xfde656b6,	0x3c56e0ed,
-0xcbf70ef8,	0xc1d4f29c,	0x2b66a751,	0xf013e497,
-0xd0cdfa75,	0x36c365d9,	0xd737cae8,	0xd6a746ff,
-0x16c6ccc4,	0xec2b401a,	0xc552a1a8,	0x215f8505,
-0xe6827da1,	0xd0253fa0,	0x0715e1a2,	0xfdef30ba,
-0xe3b1193d,	0x33ed65b0,	0xff7e819e,	0xd3482ae7,
-0x20b90501,	0xe3b17981,	0xf77e9d12,	0x32d5d57b,
-0xdf45911e,	0xdf2b8f2b,	0x2efc8e9b,	0xfd783cd3,
-0xd9150e59,	0x30a56b13,	0xdc573a08,	0xc069a725,
-0x034fbd66,	0xe937436b,	0xc76367b7,	0x35742135,
-0xf4b24300,	0xd4e01c3d,	0x19e3551a,	0xe659ccc7,
-0xebfbf38d,	0x21b42a07,	0xfeaf08fa,	0xd2718636,
-0x3d9d185f,	0xee3bbebf,	0xe9f2c003,	0x3e0c4760,
-0xdc6780eb,	0xd146d676,	0x21aef1ee,	0xea35087d,
-0xc4ad71d3,	0x34637655,	0xc3bc5cab,	0xc47f955c,
-0x1fd13f04,	0xef726be5,	0xcde0dff3,	0x36793a45,
-0xe10f282e,	0xde86914b,	0x10c1bc4b,	0xecfcb0d3,
-0xeebb4405,	0x2316a5b3,	0xf56a4411,	0xc70ab977,
-0x2cd8da1e,	0xfd832a8d,	0xebc57968,	0x38eb999b,
-0xc17bfa75,	0xdd50368c,	0x204d06f7,	0xeb3f056a,
-0xc7222baf,	0x3ce3e58a,	0xca7f225d,	0xc8c07ad1,
-0x1928df0c,	0xf162e92d,	0xc535493c,	0x3087e49a,
-0xed9764f7,	0xd2c87b27,	0x17321630,	0xe1f18656,
-0xec707d61,	0x3aa898cf,	0xfd64ce5a,	0xdb428482,
-0x3a3a4fd7,	0xecc61449,	0xe66c8176,	0x3eddfc7a,
-0xded2b59e,	0xd83bfcd1,	0x2c00e600,	0xef20fe5f,
-0xdd362f16,	0x2979f8d1,	0xcd1a810e,	0xc9dd70e1,
-0x15f81b04,	0xe2320a17,	0xc18c97d9,	0x207ac4f6,
-0xf3bf84eb,	0xd44cf732,	0x010d6975,	0xfdf1e58a,
-0xf0cd3683,	0x21cfbe8b,	0xe4cc6eeb,	0xd3a7995a,
-0x3fe96a01,	0xfde77c17,	0xe28b808e,	0x250aafb0,
-0xcfd0fa1d,	0xc7eef408,	0x3e6961be,	0xeb771a95,
-0xdb0b8a71,	0x2b1af779,	0xd375fe0f,	0xcb1912e2,
-0x0790c573,	0xe39e4519,	0xdc961130,	0x35268a88,
-0xf25c4053,	0xd00d6d63,	0x1e50b357,	0xf849bed1,
-0xf3dfbf1f,	0x24664d59,	0xfbdf925a,	0xd03079ef,
-0x38bbbfd3,	0xffabbf4f,	0xf333775f,	0x32370fa2,
-0xc740822e,	0xc275d779,	0x3f1faa89,	0xf626cdd5,
-0xdc78f618,	0x3209ceb9,	0xc9d6cb0f,	0xddecaa34,
-0x185c45e9,	0xff33258d,	0xdefae69c,	0x29ca332a,
-0xf2b65db4,	0xc9df2ff5,	0x1d3ea2fe,	0xe954e244,
-0xf6287a9d,	0x38933c35,	0xfb4c27dd,	0xc43c1789,
-0x3e915738,	0xfb61d55a,	0xfd02c397,	0x3c0a8693,
-0xd0ee1d5c,	0xcc137695,	0x32e23d26,	0xf25f4c83,
-0xddee1226,	0x312f01d6,	0xd4eee429,	0xda24778a,
-0x1c95aade,	0xe175700b,	0xdb9faf2b,	0x3116bd4d,
-0xec6668b9,	0xdb9716aa,	0x03933541,	0xf69a7c1d,
-0xf4f66d3c,	0x23094b2a,	0xe22f9eac,	0xd6665e91,
-0x35d1ecfc,	0xf779ab44,	0xeaa7e8f8,	0x3de35c5f,
-0xc7812e85,	0xc548e73e,	0x2c9d0b09,	0xeea4f540,
-0xcbc4ea7a,	0x2e16a22e,	0xd655d8fe,	0xc3808b59,
-0x00fa68bd,	0xf0abeed4,	0xc14b4b22,	0x2db8a36b,
-0xfa0948e5,	0xd1b0c247,	0x08bbc94d,	0xe060fc59,
-0xf4231a34,	0x3b09fb37,	0xf31d2c2a,	0xc06d708d,
-0x3be350a6,	0xf895140b,	0xef3cf537,	0x3daafbfd,
-0xd2719d8a,	0xd060bd17,	0x316aaa0c,	0xe0c8fa47,
-0xdd0564cf,	0x2d41fc43,	0xdf854062,	0xdaafc6c7,
-0x0185d1d4,	0xf366135f,	0xcf7a191f,	0x32fe5d9a,
-0xe50a2534,	0xcba071dd,	0x07cbdb8f,	0xf9d80145,
-0xf149ac35,	0x3024ac21,	0xea13d0f1,	0xc977237c,
-0x21ba3409,	0xe6d96f93,	0xf47dc585,	0x25884a15,
-0xc82ac51f,	0xc1e5a5fb,	0x35dd4faa,	0xf76e9556,
-0x7ee314b8,	0x5778adf7,	0x290b8438,	0x4b936098,
-0x1ca31624,	0x3fcc4f34,	0x2ef19518,	0x1f318a4b,
-0x441a2edb,	0xdf2ea7f0,	0x75dd83bf,	0xa0d9970a,
-0xe1671909,	0x3a5efc43,	0x881bc862,	0xbe0d4a66,
-0x3c2bbcd2,	0x9f364688,	0xb42dc4c0,	0x3dcaedc6,
-0xfabddd74,	0x9a5dc61e,	0x58a9ae97,	0xc60ad1f0,
-0xfa32d453,	0x1f197242,	0xaaf4d475,	0xb7ed5053,
-0x7f7a7533,	0xcbc475b3,	0xc1d6847c,	0x0da87a63,
-0xaf002841,	0x9ef5bc45,	0x76287bd3,	0xf7cf9f90,
-0xf0b780c3,	0x9c081385,	0x8e362c7e,	0x0a195cce,
-0xfba79ca8,	0x816adf24,	0x754f3692,	0xe376805f,
-0xf204e0b6,	0x046cb3d1,	0x99555d03,	0x878f7728,
-0x63f11f4e,	0xa963d82e,	0xe6a3b6d5,	0x5e0c9cd7,
-0xd1f46a14,	0xb3a12623,	0x2977d7b3,	0x95c4065d,
-0xda581bf2,	0x5b8b87e4,	0xeaf439b5,	0xb3437cc7,
-0x3d70dcda,	0xe10247eb,	0xc4379e5d,	0x33898528,
-0x88b5b061,	0xf7e87209,	0x5b17ae11,	0xaa90ffb2,
-0x80d8dc2c,	0x409ddf2c,	0xdf1fbca2,	0x9558b6a7,
-0x25249090,	0xd9fec80b,	0xead71a49,	0x2d0732e4,
-0xbc742d06,	0xdb89f2c1,	0x423a13bd,	0x9184fa2a,
-0xa97d9ac7,	0x024a76bf,	0xf045cdad,	0xf6fe6992,
-0x6aae0f46,	0xe6fc887e,	0x859fd956,	0x73d2b957,
-0x9dca69ad,	0x6ae10a7c,	0x10462a8d,	0x6828acb6,
-0x1cbf5062,	0x1e0c6370,	0x1e3400c3,	0x1b72216d,
-0x7f851809,	0xa86037ec,	0x6d4e8a25,	0xd994c4b3,
-0xa422b7a4,	0xb7f4746a,	0xdec5c5e3,	0x76f65170,
-0xac7b3bee,	0x652d4055,	0x612c500b,	0xfb495fa2,
-0x68b608ba,	0xfc2b9032,	0xe88ce6bc,	0xd3b383e1,
-0xc3e1cbca,	0x77f8e4de,	0xfaf83a5e,	0x7a410d85,
-0x7822b5d2,	0x24d1e840,	0x7585a8b5,	0x8a8c683c,
-0x06cdc81b,	0x7dd4ad7c,	0xbc5f49e5,	0x3382c5cc,
-0x7747d721,	0x9643fb77,	0x3cd1a82f,	0x5c0af967,
-0x9a692973,	0x73249cba,	0x5dcee244,	0xd75a5f8c,
-0x64480f09,	0x36935849,	0xdfbfbfd9,	0x1d29c3bc,
-0x3eac276d,	0xe49df3ee,	0x0fe5695f,	0x0d7cb047,
-0xf48676b2,	0xe9df9817,	0x15122e1d,	0xfaff532c,
-0x1fdd56bd,	0x16653852,	0x15d2d1a1,	0x04da9a1f,
-0x54c10acc,	0xb08b55e3,	0x59389450,	0xed7bc040,
-0x27c807fc,	0x4b5b7ac3,	0x64c977bb,	0x3c41bf5c,
-0x7ebadc62,	0x01256f20,	0x100e5b6c,	0x0a3b947d,
-0x041fc183,	0x02043810,	0x0d446df7,	0x1578b1a1,
-0x140c585c,	0x5c9d28f1,	0x11cbd4bc,	0x417433ce,
-0x15559892,	0x143f8382,	0x1dcf3db7,	0x194eb843,
-0x728fec93,	0x13652ece,	0x727dd07c,	0x7b837548,
-0x76ed3ac9,	0x64ecff47,	0x12ab949e,	0x75f21c1a,
-0x136a64b3,	0xcd7f5a4e,	0x13b5472c,	0xc176b2e6,
-0xc3e087ea,	0x8ff78c20,	0xc6ec8424,	0x43a6a233,
-0x42fc6170,	0xb1d5fcda,	0x89c83548,	0x37cd3055,
-0x83afc495,	0x106831f3,	0x0cd1f4fe,	0x1543f6ff,
-0x3c97141e,	0x2d96e82d,	0x28220d54,	0x0e903138,
-0xc4ca1b2c,	0x3261cb0d,	0xe02fb5b7,	0xce18a517,
-0x7092e17e,	0xf3a96e18,	0x94a50092,	0x762d4b36,
-0x6b4b5243,	0xa2222363,	0xf0277678,	0x5303afe6,
-0x63c5a228,	0xf13ee85d,	0x8fa59f6d,	0x7c610767,
-0x5f034eed,	0xe12c923f,	0xcb4f5fbe,	0x30413e0e,
-0xb8e44469,	0x7e5cf715,	0x69f0d6d4,	0x07efe897,
-0x2d30c3f4,	0x6a1a7afd,	0x5ec25d03,	0x2dadd94c,
-0xd885ab27,	0x93118d7a,	0x8f1f5ab7,	0x1aed77cb,
-0x7fb524e5,	0xd983dad4,	0xe89096b1,	0x3dd93136,
-0xc368222f,	0xba5e6656,	0x380eddfc,	0x8434327a,
-0x7e1e8274,	0x4cf89dfa,	0x5da9e9c1,	0x0ae01923,
-0x7d23bcec,	0x85cbb64b,	0x2e8669f2,	0xa9614623,
-0x12da3003,	0x9ac927ae,	0x38d4c9df,	0xbb27f3fc,
-0x2f95b864,	0x73c04583,	0x1737cfa8,	0x6d5e5af8,
-0xee7f0c27,	0x0771affa,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-0x2722bfa2,	0x10462123,	0x30080f7d,	0xb346cd81,
-0x0049c396,	0x4e24165f,	0xa7c66809,	0x2e60bdcf,
-0xaad70a08,	0xa73ea713,	0xe28f97a7,	0x283a9eab,
-0xd4366489,	0xe776f963,	0x64ffa8ae,	0xde717b50,
-0xbd2ca2b5,	0x3bae5f6d,	0x8d2bbef1,	0x7e9181e6,
-0xf06aa121,	0xd06b2d20,	0xa83ea826,	0xef935e4f,
-0xdfd27456,	0xa3451468,	0xc6820a63,	0x43463105,
-0x787697aa,	0xcba5543d,	0xdf7e1e2d,	0x6998a8af,
-0x98ce6c08,	0x89de731a,	0x943a3510,	0xb36ead85,
-0xd5258d4b,	0x1cd6df61,	0x82a5c59d,	0xd078e7a4,
-0xa33d4317,	0x24dc45f8,	0x3f3daf27,	0x0478bc6f,
-0x92dfa16c,	0x952a872e,	0x7a34e03f,	0x0f088084,
-0xa40937fe,	0x38fc7749,	0xa157e8a4,	0xbce94344,
-0x7045ff7b,	0xf3e1ab66,	0xe62a6058,	0x5564ff10,
-0x38198f1e,	0xf326f0f1,	0xe262bc0c,	0x2f0b851a,
-0xc7bcbe11,	0xe79f1d1a,	0xc2f93c29,	0x54f3ea9f,
-0x8f8f9141,	0x9f45e13c,	0x7a5b86bd,	0xa764efd8,
-0x35f04729,	0xdd8c4b54,	0x5fa12e51,	0xa5824af9,
-0xad328f71,	0x0f11fbb9,	0x9048e950,	0x04d7a900,
-0x02538d1f,	0x99f745b7,	0xe31f63bb,	0x2c4e3d78,
-0x7cdb9245,	0xa3966ee7,	0x27c4433a,	0xe1d79f3e,
-0xe640fa06,	0x79ce31eb,	0xf25634fa,	0xdd9ce5cb,
-0xb7fab8d2,	0x2f1f0ff2,	0x2acb625c,	0xa0494989,
-0x206d7f11,	0xf268b8ca,	0x292bbf9f,	0x763bd7d0,
-0xea4b14fc,	0x9d3d6aeb,	0x64cca57e,	0x6fc3e29e,
-0x3e7bf4bf,	0x90efc7e3,	0x08e39173,	0xd05bee2c,
-0x5b3c8f37,	0x0921ec6f,	0x3371b715,	0xb324e114,
-0xe3abc53f,	0x576b18f8,	0xc4469024,	0xb2ded6c6,
-0xe7783782,	0xc0a1fd5d,	0xcf324bde,	0x97527c8e,
-0x19f8f48c,	0x3e806a5d,	0x96cff225,	0xe3b9d04a,
-0x0e5856ae,	0x781372f6,	0x9645f2b7,	0x95a743ed,
-0xd0c7eded,	0x86ca3cd9,	0xbab94db0,	0x43a1233a,
-0x89c55554,	0xee776239,	0x34aa0098,	0x66a6e1d4,
-0xae0e233e,	0x717e7b29,	0xb403a4c1,	0x36eb96c5,
-0x42140832,	0x04250936,	0xda375dca,	0x524cb2e6,
-0x86deaa0c,	0x400dc9d1,	0x12c00364,	0xe3ca7cf5,
-0x87f20da7,	0xf57df9ef,	0x580dbdfc,	0x0b3e0369,
-0x014d27fd,	0x4afaf6a1,	0xd1f4ca09,	0x77abc831,
-0x30e49729,	0xec61cd2c,	0x159c1e92,	0xb61b40b1,
-0x17c66fd6,	0xde11c061,	0x79d7f792,	0xc709cbfa,
-0x94201c89,	0xbe65137d,	0x18aea1b4,	0xf248bbc3,
-0x465f957d,	0xcf4a9672,	0xbf293fd2,	0x2c5e31c9,
-0xc2c73011,	0xfb29cbf2,	0x576f7f0b,	0x74de1745,
-0xa76e172b,	0x99b96223,	0x14ce1502,	0x231013fb,
-0x1d4df40a,	0x951b0c16,	0xab173e66,	0x4ff65f74,
-0xc4a87a47,	0x09cc3370,	0x66385490,	0x73e09118,
-0x4ee96432,	0x0164d347,	0x205069b5,	0x158dd226,
-0xc932c238,	0xe9048fa2,	0x100b626a,	0x86ee08cd,
-0xed87cb1c,	0x6353ec37,	0xa36edcc3,	0x8a16dd6b,
-0xd28a4198,	0xebea1127,	0xca0b761a,	0x61c31acf,
-0xced5ff4f,	0xbf4dbd8f,	0xd969d8a7,	0xb6e4e9e8,
-0x8421c402,	0x809d7222,	0xabfd1d2f,	0xc1857ce5,
-0x23958fd7,	0x3226f1d3,	0xd822b4cc,	0x2f1cc3aa,
-0x501fe01e,	0xe36f8c94,	0x7ad27716,	0x3321308b,
-0xa85b957b,	0x38cfdf6e,	0xc7497dd5,	0x2462090c,
-0x8f9e42e7,	0xdf97684a,	0xac8af621,	0xd5224866,
-0xc5f64e50,	0x9724f297,	0xc386097b,	0x48c6f98a,
-0xe1478b1a,	0x2dd23fd8,	0x716b2d85,	0xa5c3789b,
-0x53625e80,	0x9b8b312c,	0xce482165,	0x66161e35,
-0x64ecb56a,	0x9981c46a,	0xe6cb6bb3,	0xe1983186,
-0x75ed470f,	0x4adcbd27,	0x3efeda68,	0x4d193a2a,
-0xbfdb3cd4,	0x7c6167b6,	0xdbddea68,	0x4b0d2d62,
-0x00ba3860,	0x49ec2544,	0xa68698c9,	0x2ce7be1b,
-0xf5afc9fc,	0x1cebf9c3,	0x350f8f5b,	0x893eefb8,
-/*  2109-m021066131.inc  */
-0x00000001,	0x00000031,	0x03162007,	0x00010661,
-0x891e5cc8,	0x00000001,	0x00000002,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0xf7686225,	0x4ef86bbf,	0xb8d5004c,	0x937ac335,
-0xc9dc84ae,	0x1b346788,	0x4a6552eb,	0xee81afd4,
-0x2e2f5d20,	0x2ffa5e48,	0x2fbb2e62,	0xa940bc71,
-0xe5fe42ea,	0xd601240f,	0x3e24e7d6,	0xeba0d8ea,
-0x383161e7,	0x6c9e0cbc,	0xe7a99df9,	0x8ddd5157,
-0xe5499852,	0xc281b6d6,	0xed7260f2,	0xdf249a80,
-0x0782690b,	0x816a0fb0,	0x2db70d3d,	0x63af97bf,
-0xe872a8c6,	0xa94f62d0,	0x20d68039,	0xe256ab93,
-0x4d0905d9,	0x470165da,	0x76ccfe9e,	0x005c156a,
-0xa3c59adf,	0x82008a6c,	0x0851556b,	0xbde274f7,
-0x501c7009,	0xca8e7af7,	0xf1fdb812,	0xc3b36a79,
-0xb9494c00,	0x24125036,	0x4c24535f,	0xba9dda5f,
-0x2fd19617,	0xe58fd06b,	0x07d751c7,	0x2ba1ca0f,
-0x29cfeebf,	0xe818380f,	0x33d7efcc,	0x1882e27f,
-0x94eef22c,	0x5a5c251e,	0x2c20c402,	0xf6c166e8,
-0xa0f1824c,	0x93279f1c,	0xe00110b3,	0xf0dd9c91,
-0xc3ce27dd,	0x2b39da76,	0xc99d2d41,	0x5a88944e,
-0xaa56d562,	0x588d637e,	0xd59ced8d,	0xbee49abb,
-0x0ca6fcd1,	0x1bb514d2,	0xf6cd7762,	0x27f971ca,
-0x6d887ef3,	0x3a813f22,	0x3b3cf42f,	0xc0687806,
-0x05f4735e,	0xdccc2468,	0xcd527ddf,	0xd49be6fb,
-0xd3987654,	0x8ac9cf1c,	0x1bc2772c,	0x80066cb7,
-0xa619f56b,	0xecffc798,	0x392ce98e,	0x5f4f1d40,
-0x03d9a596,	0x01dc88cb,	0x2230b4f2,	0x08021966,
-0x335dfb1c,	0x8b6540f5,	0x3191e9ba,	0x88b56281,
-0xd9be97ad,	0x6f4c4741,	0xc8dbf087,	0xc92f88d2,
-0x2e9e3a03,	0x040d7039,	0x0b3fed04,	0x2664ef58,
-0x09e6f783,	0x6e2243b3,	0x01caaa6c,	0x90da36eb,
-0x4a60630f,	0x041d8871,	0xc5deeda9,	0x511029fb,
-0xd3fe3692,	0x702290de,	0xb65d7559,	0x5cbc0be0,
-0x9c16a723,	0xfaec18c6,	0xa380fc1f,	0x764549ad,
-0x16de8ace,	0x1b6c49ff,	0xab58919c,	0xcf342ba0,
-0x1a8649a3,	0xaf73e902,	0xf3a5cf81,	0xfc69d766,
-0xca088b88,	0xa03430de,	0xac0333dc,	0x3bb2213f,
-0x175e826a,	0xba0ccccc,	0x64402ad5,	0x8be20ad1,
-0x63c79695,	0x07c6c798,	0x22742137,	0x14085f11,
-0xe9420a12,	0x73284057,	0x8e434c09,	0xba0d69bd,
-0x917782c0,	0xef31b647,	0xbeced97a,	0x4fc96f21,
-0x61a0d256,	0xb968388b,	0xe50854bf,	0xb9200ee3,
-0x004021d7,	0x244681b1,	0x7f96dfc1,	0x7086f893,
-0x57ca8cb0,	0x17f58c56,	0xd732ca6d,	0x40f9b31b,
-0x209ede64,	0x541019f9,	0x0e992dd4,	0xb98788aa,
-0x57a85562,	0xfceb96f1,	0xca68f9df,	0x0c8a1283,
-0x90f70e9b,	0x2dea2e8d,	0x91ad91a5,	0x4b7664f2,
-0x594a5bd5,	0x01ae6e99,	0x1edefb6b,	0x6afa213c,
-0x371fad96,	0xd4cd1c1a,	0x0b72658e,	0xd2e148dc,
-0x08c1234d,	0xd7bccb6b,	0x7c6584cd,	0xecb0661b,
-0xa7c71897,	0x00f43041,	0x62617348,	0xf22b602d,
-0x334b08a5,	0x0ec9440c,	0xdf302f24,	0xba968b20,
-0xab1283b9,	0xbf8fa58a,	0x0e101d1a,	0xadf6cb1c,
-0xf5ae6b43,	0x027308c3,	0x7c594b25,	0x6b28e2fb,
-0x7076d5f6,	0xa941e49d,	0xa2404185,	0x6de0b678,
-0x72f43ce2,	0x665bb3e5,	0xab9042df,	0xacb1866e,
-0xdabfa640,	0xddcdedfa,	0x6f0cfd7b,	0x162ef758,
-0x994e436c,	0xd907a714,	0xf24e5788,	0x5ee0f29b,
-0x199b0796,	0x2a35ecf8,	0x241edc05,	0x7aa71aaa,
-0x58790326,	0x7ae33c8a,	0xd1ccb8ac,	0xb18c2c36,
-0x9d1e230b,	0x057fea5d,	0x01e49aed,	0x8883f770,
-0xfee63499,	0x9d8156ff,	0x0204c154,	0x5244680c,
-0x33692fb4,	0xe08a42a2,	0xf0e53457,	0x46348cf6,
-0xe6903bbc,	0x82d74e02,	0xe0fa12bc,	0xe6d03c3f,
-0x65383df2,	0x268bc988,	0xc7690ca3,	0x050c3724,
-0x32e3d584,	0x9dffc7a7,	0x360b877f,	0xb248dbd1,
-0x5e154b49,	0x2baba816,	0x7cda3d56,	0xd1d37f4f,
-0x514ee6b3,	0x491129e0,	0xb3447b54,	0x14ec6daf,
-0x3a522988,	0xef339e51,	0x2237b08a,	0xcd3ceb66,
-0x6b0a51b3,	0xd9f5648b,	0xe69d2694,	0xe543690c,
-0x89b65c85,	0x16fc9d01,	0x4103cc5a,	0x7955f351,
-0xa24082e3,	0xd9534951,	0x1c2c8ef5,	0xb683917e,
-0xbbd0416e,	0x9f52a739,	0x77392ea6,	0xb2d43e71,
-0x954db293,	0x5cf5b436,	0xb891130a,	0x0c8496f5,
-0xdd64eea3,	0x70be1972,	0x985b6a54,	0x5ccb1431,
-0xedd8d183,	0xf55e689b,	0x933dca7c,	0x9542f67f,
-0x86517d1e,	0x83db24dc,	0x6b9a0936,	0x20518976,
-0xb6413205,	0x37931beb,	0x265236cb,	0xfcb77aa8,
-0xa5fbbaa6,	0x9a5d80b9,	0x3ccd47bd,	0xe7cdf306,
-0x66449996,	0x471d1255,	0xf756ef4c,	0x0e9c7351,
-0xe3de1193,	0x63a02e41,	0x8f71941b,	0x06b2d8b2,
-0x99751d97,	0xc084ec30,	0x812fcd01,	0x5552559d,
-0xb79f086c,	0x7748f548,	0x56a3184a,	0x93243935,
-0xd93a819a,	0x3ab65649,	0xbf7ca9b2,	0xf2b7a1ef,
-0xea009f2d,	0x7fe804f8,	0xde6624b6,	0xec8fd349,
-0x124e297a,	0xaed271d8,	0x8abbcc3e,	0x2f112fa5,
-0x4b3af8ed,	0xc21a7522,	0x376877b3,	0xf19300b9,
-0x7a42e481,	0xd74c1d68,	0x97f853f4,	0xd2ba157d,
-0xec23322a,	0x133b093e,	0xec641e08,	0x3ba704c6,
-0xd7241dd9,	0xe16ff159,	0x538e1518,	0xca13be54,
-0xb8f4c435,	0x5b88dbf0,	0x535df391,	0x9d627ffb,
-0x27e148bc,	0x4f679502,	0x7b3525a2,	0xe4d0efc5,
-0xd10bbbd9,	0xbb0c3bed,	0xc733ef7d,	0x1cfc08af,
-0x2972537e,	0x33b5e4d8,	0xd0c6ca80,	0x2de1071c,
-0x3dbd527a,	0xaaaddeea,	0xe7330c4a,	0x43e48a03,
-0xb55ef2b2,	0x773d0e42,	0x8372fd8f,	0x73d1dfa1,
-0x1acf91c4,	0x412b14e0,	0x7a52050b,	0x7f57c573,
-0xe902de0a,	0x62ab1c8f,	0xd066190e,	0xa93e3945,
-0x22c34d1a,	0x6c360951,	0x57f65baa,	0x78cbb2b8,
-0x38a14718,	0xc05ee3d8,	0x1fc1b139,	0x26e68e3f,
-0xd10d0a3b,	0xf1953462,	0xd948b500,	0xd9570403,
-0x8cb71f35,	0xa705a242,	0x7b564cf6,	0xdc02a115,
-0x7c7735a1,	0xd6a2e6f4,	0xfe15bc15,	0x1d3b919b,
-0x45a0f640,	0x4595ca34,	0xf0e08177,	0x2b82d1d6,
-0x4c7c879d,	0x091ed8ac,	0x3fb383f6,	0x8dd729b9,
-0x2e906401,	0x03eb95d1,	0x566f5bd8,	0x7b60eea6,
-0x5325a7e4,	0x7b6eafe0,	0xe7b2f0fc,	0x0e7dd584,
-0xfc645285,	0x89c630d8,	0xcfb797fb,	0x2c2644f9,
-0xdd5586c7,	0x869d11f6,	0x13d1e37d,	0x1298d062,
-0x8a6b9e4c,	0x4333ba7a,	0x1e5ab3de,	0x7cfe5c85,
-0xf67ce235,	0xc78548c9,	0x9c56b769,	0x2a1ec829,
-0x9ecf067e,	0x628df873,	0x3b5aaf47,	0x87b66077,
-0x81646301,	0x01f01947,	0x0573b517,	0xf3f1520a,
-0xc98286f9,	0x059f2667,	0x8751a5af,	0xaa60fd06,
-0x52923f67,	0xb68b8207,	0x8ea56f41,	0x072e190e,
-0xd0e2f5e8,	0xba8ab301,	0xf6368a58,	0x60f0b1da,
-0x732d9037,	0xca6a78f0,	0x4b57f7f0,	0x510dcbaa,
-0x78a73ff6,	0xa4a091f4,	0x082ba3b8,	0xa3cd1758,
-0x483fe06b,	0xf9f395c2,	0x5aeb2af6,	0x4ce063e6,
-0x7daa69d2,	0x5db3b33a,	0xe7f20b65,	0x680619bc,
-0xbcb076df,	0x6935da52,	0x92607aaa,	0x4463efdc,
-0xe97f95e6,	0x6851f083,	0x0d9f15de,	0xfc91225d,
-0xc47bebaf,	0x32be1ae3,	0x29b47478,	0x9bb22174,
-0x71148599,	0xe7383074,	0x61e63293,	0xdd5c5960,
-0x77a2c7c1,	0x964f7326,	0x23e00af7,	0xfde072af,
-0xf11c684f,	0x68cf5efb,	0x60946a05,	0x1cfb35c2,
-0xaa77d38d,	0xb8f129cc,	0xcee0fdb9,	0xc1e98ceb,
-0x9ff7dfcb,	0x6f62c724,	0xbc47a77d,	0xe6b869ca,
-0x21f5e658,	0xd7ab5ddb,	0xfada483c,	0x738cd51b,
-0xedf10917,	0x2b3dc577,	0x8d72bba5,	0x2b0daafb,
-0x7570beba,	0xea6469d0,	0x9774e49e,	0x556de1a4,
-0x87bf5a00,	0x5ff7b62f,	0x49c3cdb5,	0xc7950334,
-0x77f38227,	0x0fbf40a1,	0xf4c2666f,	0x150a0777,
-0x246de555,	0x2dcadc6d,	0xe0914f96,	0x27cbd925,
-0x103e3cae,	0xaae83504,	0xf22b6cf1,	0x67eafaa0,
-0x3e1772d6,	0xc31685dc,	0xc518a07a,	0xb75afaad,
-0x88042921,	0xf718d779,	0xeba4dd1c,	0xc5be44d7,
-0x60feb8fb,	0x852f12fa,	0xe88debdc,	0x0f6d2b14,
-0x87ff700e,	0xc1d2859d,	0x26c4a0cf,	0x22f946c1,
-0x46132611,	0x47516d3e,	0x83048232,	0x8e6a1885,
-0x00e6c5e7,	0x98321d95,	0x6afa8e70,	0x5c004e07,
-0x5129ba0f,	0x32e69037,	0x23ef3349,	0xb9e76036,
-0xe4560af4,	0xc3eedad8,	0x7b113c89,	0x1faddd61,
-0x2924b80e,	0xd761c51c,	0xbc74ff8b,	0xecbd623e,
-0xef016e07,	0xbf69956d,	0xa7d70940,	0x1a6c9504,
-0x8c309d76,	0xbd8d6107,	0x455da83f,	0xfbd1f764,
-0x52c0173a,	0x0e809302,	0x82521cc3,	0x385172a9,
-0x071642ae,	0x423abcf5,	0x8d662467,	0x9d1e56cc,
-0x0c9931c9,	0x089a3403,	0x15485415,	0x37d14e7d,
-0xa217733b,	0x6c602a25,	0xe3fc6bbd,	0x17a8e941,
-0xf8077fd5,	0x8cb99b51,	0xaa8499d4,	0xcc20e05a,
-0xb16f4c15,	0x2ec6000b,	0x00c7c607,	0x4bde4790,
-0xe4ca6ade,	0xc748fefd,	0xaa2fc8b8,	0x78c4c1de,
-0x354b1771,	0x1eef7bbd,	0xc4091812,	0x403da3c2,
-0x7abc8a09,	0x4defe6cb,	0xfecfa44a,	0x1a4f0573,
-0x35941961,	0x63381c63,	0xd7f124f9,	0x58095d19,
-0x48bf009f,	0x9a5b8c36,	0x58517a30,	0x2292c779,
-0xfc73b3ef,	0x351ae98f,	0x370c320c,	0xe55e9d8c,
-0x1ab46ac4,	0x9a52c283,	0x4522e321,	0xbf0dbe57,
-0x7072ef53,	0x748184cf,	0xb4db3ed2,	0xbf891079,
-0xd3f42c4b,	0x17d78aa4,	0x0b80f840,	0x34084fd4,
-0xed951bea,	0xd2755ead,	0x73ff222d,	0xbd929cd4,
-0x363d1e00,	0x366a998e,	0xc0efcb38,	0x3a2680b3,
-0x67cadd34,	0x51d996e7,	0x1b7cd5b9,	0x2282a8dc,
-0xde33eb1e,	0xdd0f6699,	0xf080298e,	0x2bd236c9,
-0xfa7095d2,	0xb67c1193,	0x545974ad,	0x56a60b18,
-0x25b4ac52,	0xc64e9eef,	0x2678551e,	0x7aca1a7a,
-0xdceb7d31,	0x02408a48,	0x7e8f3c18,	0x74b41b32,
-0x707251c8,	0x939a601d,	0x0e8bcc10,	0x79f776f5,
-0x35543ab4,	0xb059b25a,	0xbc763815,	0xa9da6f93,
-0x5eb1b293,	0x2c1ba3ed,	0xbd779d8a,	0x8b96f417,
-0x4a52d310,	0x742ada5e,	0x4a3140e9,	0x69c9cd00,
-0x7c9a08aa,	0x9c41602b,	0xd37b3b56,	0x854a51cc,
-0xdaf009b0,	0xb292a496,	0x914e4323,	0xa28c15b9,
-0xf96bb247,	0x90460c31,	0x809603e4,	0x8e3e2901,
-0x207d814a,	0x7697ae44,	0x6aa47365,	0x732644f3,
-0x7044ba73,	0x8a8b54bf,	0xc2526ee0,	0x00a95261,
-0xb4467081,	0xf7ac1535,	0x0bdc46d4,	0x7a8f6e6f,
-0x020d6ec4,	0xd3c80697,	0x01160365,	0xbb67971d,
-0x0b3c1125,	0xc4f455ae,	0x20d99f8e,	0x2861ef06,
-0x0b69e237,	0x68be6d8e,	0x3c4cb68f,	0xed36339e,
-0xc5a12abb,	0x0e00ba16,	0xaa5c53de,	0x956be826,
-0x4c4e91c1,	0xea1bb00b,	0x2f5065d5,	0x05482460,
-0xe3b6c164,	0x680c3c05,	0x519cefe4,	0xe0f31fc3,
-0x95e4de55,	0xcd23c19d,	0xdf8f816b,	0xd32162a4,
-0x386fba01,	0xcccc981a,	0x45931e66,	0x43ac5399,
-0xe60126cc,	0x50df2232,	0x603a9242,	0x1efd0ab1,
-0x5efd57c9,	0x53065d3f,	0xb0ae9072,	0xbb25e18c,
-0xcf20ecb7,	0x90ac0b0e,	0xebe657a1,	0x86fb4948,
-0xc14563b0,	0x8531a293,	0xfa95fc95,	0xac859ebe,
-0x83917592,	0xff654f62,	0x7c6c66ca,	0xb31bd8ff,
-0xc1ae2096,	0xf3d6cc0d,	0xde7add56,	0xd445fbd3,
-0x2630dea3,	0x81ed5ea9,	0x648a07b6,	0xef260840,
-0xc590a8b8,	0x25d3d5e8,	0x2405cccc,	0xfc22c9dd,
-0x4ce86fa0,	0xaf6b8f1f,	0x1986e0c2,	0x2a57db87,
-0x358f388d,	0xc5a3aa33,	0x47cf13e4,	0x9ee4d133,
-0x3d7af56c,	0xd221f74e,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2360-m011066138.inc  */
-0x00000001,	0x00000038,	0x09192007,	0x00010661,
-0x8a2d6f19,	0x00000001,	0x00000001,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x04edab0c,	0x753dc28a,	0x2d998811,	0x7c34d933,
-0x0c7db493,	0x03969ead,	0x456105d8,	0x39c6aa8b,
-0xef28e0a2,	0x323ed4f4,	0xdf30a352,	0xae0fe98c,
-0x89462aff,	0x391e4fba,	0xbc4c4e34,	0x6af2de19,
-0xa52cfe25,	0x291ce41a,	0x18d3cf9d,	0x1507515d,
-0x6dbc0ef8,	0xc87eacb1,	0xe10e8d33,	0x8ccb615c,
-0x067b3412,	0xe9b8150f,	0x509d573c,	0x7da63711,
-0x48e07875,	0x2247478c,	0x239efc7d,	0x81e5940e,
-0x3dfe3729,	0xf551c52d,	0xed1b5e8b,	0xfeb15f10,
-0x99d9e2b3,	0x28b7dd4b,	0x01be41ea,	0x1c38d731,
-0xebd76aea,	0xf897168f,	0x5fc0ea48,	0xf80c9f21,
-0x99d10486,	0x692e9355,	0x28aeca24,	0x2f449adb,
-0x2f2dab6a,	0xdb99e720,	0x357c7d1a,	0xf393b5a9,
-0xbf013ce6,	0x80ff1faf,	0xd119e2fe,	0xe5e3e086,
-0x74972a90,	0x89e66251,	0xf473f261,	0x11a19e0b,
-0xad9948af,	0xb7a25e24,	0x10bd14d2,	0x4abbe586,
-0x462b658c,	0x5b659fe9,	0xc02bd04b,	0x0ce6bd03,
-0x1468bed1,	0xa7727077,	0xf03ecf36,	0x0e0ccccf,
-0x1867b524,	0xfc6e4dcb,	0xf9e807b1,	0x08d29b7a,
-0xbd9f1444,	0x124e857e,	0xbd8cdfa4,	0x153f648a,
-0xf5248986,	0xbbd3146f,	0x4e7c90ab,	0x9d5512a4,
-0xcfcb97be,	0x5e983b61,	0x56f3bcce,	0x8ab0b172,
-0x9759b343,	0xfa054335,	0x506ef847,	0x2683074b,
-0xa2859a9c,	0x315f4abe,	0x9b7b644d,	0x20db051b,
-0x9a316866,	0xf2ae2cad,	0x8289ff80,	0x6fba3aab,
-0xe6871f00,	0x44d188df,	0x5946ec70,	0xb984b93f,
-0x579ba307,	0x242cbd55,	0x3de52ee1,	0x7868d3e9,
-0x04c41aa5,	0xcfa6e738,	0x14b8f07f,	0xd6b58632,
-0xf085f5c9,	0xfd962b21,	0xc28144ab,	0x685ba162,
-0x32aaf683,	0xdb66dfa6,	0x091054de,	0x6a1dd372,
-0xe34da67d,	0xef62f799,	0x54dc33e2,	0xd1456e79,
-0xb59b81a8,	0xc889db76,	0xd65d2d17,	0x6037e59b,
-0x0220f082,	0xfd95b479,	0x85a042e7,	0x6ca93f38,
-0xec0bc5d9,	0x86f8b17c,	0xd780bc26,	0xd87742dd,
-0x76933609,	0x1af3252d,	0xa44f362e,	0xf6acb349,
-0xc11c7449,	0x2914efe8,	0x0d1e342b,	0xa354633c,
-0xb53cbbdb,	0x6e6fc594,	0x085b9f48,	0xbd1508bb,
-0x6a3a41d6,	0xd4ac2a45,	0x0c3e31dd,	0xb2f2be03,
-0xa92727a4,	0xa412a387,	0x28a69d62,	0x56280bcc,
-0x87fc5d7c,	0x2c224b74,	0x7e42dc1c,	0x3db48525,
-0x553de822,	0xad7747f8,	0xbd32113c,	0x6051cc78,
-0x02390e95,	0x8fe89849,	0x4abb954d,	0x2a374ad5,
-0x926f1d10,	0x3b06647a,	0x905a2adc,	0xab4995cf,
-0xcd63cf14,	0x8e4ccae6,	0x5db08150,	0x18608e51,
-0xd9c963c5,	0xfb73357e,	0x75c881bf,	0x4c7931d1,
-0x652389be,	0x243c0e67,	0x837601bf,	0xb3f54082,
-0x1f55331e,	0x3bfc7edf,	0xf5ad3c39,	0x21965865,
-0xe923c885,	0xcf512590,	0xcc4af4d1,	0xa718e1d5,
-0x78c38809,	0xcb41cb14,	0x2b8ba17e,	0x06bdada9,
-0x76d6e67a,	0x94f5cf9e,	0x2136f028,	0xcb2212c8,
-0xc19af1a6,	0xe35f0dbb,	0x0f0c986c,	0x43b9ae5c,
-0x479402bd,	0x9e80402f,	0x4012c2d1,	0x6cc5cbdc,
-0xaa95ba9b,	0x22a845af,	0x365f27e0,	0xfb76d28a,
-0x333ee35c,	0x4783a0a7,	0x8206a50c,	0x8e5d5196,
-0x66e9b2d3,	0xc106d483,	0x83f43616,	0x3a64b1b7,
-0x10d85809,	0x33ef60d5,	0x1c859470,	0x359bc105,
-0x7c9e705b,	0x9f52d7ae,	0xe7ccb42f,	0xbacfba02,
-0x5c0f093f,	0xfa49f315,	0x5f4d63c6,	0x21dc29d2,
-0x03f0f8ce,	0xb19a8160,	0xe3ecd54e,	0x33c86edf,
-0x1978b1d0,	0x7dce052f,	0x051c0f91,	0x8f7ee8a8,
-0x89b05a2b,	0x9aa2c144,	0xb1b8532c,	0xaacb3ea8,
-0xe52d2a9a,	0x1f329b23,	0x3985e0de,	0x1e81f62d,
-0xbdd09ea5,	0x59b94ddf,	0x17bb0f1f,	0xe49302e8,
-0x913f58f9,	0x2726a744,	0xefb2756f,	0x84044c90,
-0xfdd05bf7,	0x5d43b466,	0x2e241659,	0x53d22b40,
-0x99cc2e81,	0xdb6b9811,	0x16bd9d0a,	0xb1884040,
-0xcd339383,	0x1a1f54ba,	0x55f0c3ed,	0x2f8fed41,
-0xc79777ee,	0x981b30a4,	0x3b034b3e,	0xc2f5ec72,
-0x50eefdbc,	0xabee8706,	0xbae469ea,	0x7fb1fe93,
-0x954d760a,	0x861d0d25,	0xf2a050b2,	0x19ebc945,
-0xe8f7a8c7,	0x98cebb9f,	0xb20f95a2,	0x9e22835b,
-0x936d23a5,	0x3c713b9d,	0x2879cedc,	0x239d143f,
-0x88003fa7,	0x9092398e,	0x964b37a1,	0xf3af29c2,
-0x8e0fd87b,	0x9ad949de,	0x2aefc296,	0x50c23c9b,
-0x5a7b0489,	0x99d28b3f,	0xbc026f52,	0x2eb7b49d,
-0x5654e67a,	0x55176822,	0x74c16f48,	0x1a6edb16,
-0x34351ff2,	0x5c265627,	0xf5073ae3,	0xcbb8698f,
-0xe01e91cc,	0x7e3ae3e2,	0x36515144,	0x0cf6473b,
-0x1190d969,	0x724ad5fc,	0xef2bbcc4,	0x501597af,
-0x098db900,	0x56bbbc56,	0x03b76131,	0xa5a954ad,
-0x441bc454,	0x4f6e2070,	0xd0714447,	0x76f0c462,
-0x61999ecc,	0xd41ef37d,	0xbbc05d69,	0xb727af0d,
-0xda1e49f8,	0xc697ff57,	0x255352af,	0x1bad7abc,
-0xaafb3e57,	0xe6379086,	0x35b1fe5b,	0x8b3bad48,
-0xcd37384d,	0xea88bd36,	0xbfac317b,	0x7ee67abd,
-0xb02507c3,	0x8785cc15,	0xef76c808,	0xc4e8f064,
-0x3fb7f5f9,	0xdda44518,	0xdf46ea58,	0x9e2ab1c8,
-0x68caf7cf,	0xb3f4bf3e,	0x55522102,	0x7918189a,
-0x475f6644,	0x1a6e7ca5,	0x2cd86d9c,	0xb0e1fac2,
-0xc958329a,	0x3119bae7,	0xb32d013f,	0x5f056b98,
-0x4b6b5798,	0xce258bf3,	0xd43f34a8,	0x7e8647f3,
-0x9742cb47,	0x12bed136,	0xc0d35976,	0xe6519490,
-0x5a575d9e,	0xcb276d20,	0x58e19613,	0x6a1215fd,
-0xf7959e92,	0x93acb922,	0x68c17024,	0x33a3ddc1,
-0xf642d20a,	0x4a427216,	0x94d498e2,	0x148eee3b,
-0x7560ee24,	0xf7a779c5,	0xaa989d30,	0x1abddbea,
-0x86b614ff,	0x9778d0bf,	0x3aecd988,	0xb728a0c6,
-0x593de7d9,	0x10149838,	0xc1b14ec8,	0x4ec993b8,
-0xc2196a63,	0xd1f3f5e7,	0x045aca36,	0x5754b6c1,
-0x7dfac21c,	0x254501be,	0x29a6f9cb,	0x33d00f90,
-0xdae4ec5a,	0xa7ab019e,	0xaf882059,	0x7a3b9d6b,
-0x45e0325b,	0xb039d766,	0x9b2c1f0e,	0x3f448929,
-0xc8454a40,	0xf8c10efd,	0x94b41a37,	0x9a838b71,
-0x60ddbf3b,	0x1c15295e,	0xf994b7d3,	0xa3dfdd5d,
-0x8032e518,	0x123701be,	0x5dcebc6f,	0x80d6f4a9,
-0x6aa26e9e,	0xdcd4c88e,	0x841e83c4,	0x1851915b,
-0xfb6d1d92,	0xcc0b91e2,	0xbb541922,	0xd06b042d,
-0xaf2ec85b,	0x35d99c76,	0xc9af68ea,	0x740dbdd2,
-0xd537367f,	0xdd29ee8b,	0x286aeaa9,	0x16449221,
-0xea08c306,	0xf6902906,	0x78ba7774,	0xc77e6d58,
-0x80d6dcad,	0x7e174318,	0xa71aa539,	0x463dd61d,
-0x76fc0ed1,	0xdbf9135b,	0x7eb26556,	0x172c043c,
-0xffdbf51f,	0x03557f90,	0xaf867d85,	0x2a1f339a,
-0x12cb27e1,	0xae260f9e,	0xd201bf29,	0x8dcb3c2d,
-0x45a5771e,	0x64eeae5b,	0x9ac90e3f,	0x143fe9d0,
-0x28676f5a,	0x5b1396ae,	0xb48d6c16,	0x2445584b,
-0x8478894a,	0xe5455e63,	0x740c044e,	0x45171247,
-0x4b2a3dae,	0xd288a203,	0xaa52655e,	0x45023c06,
-0x84215eb5,	0x1991884d,	0xca6803a4,	0x96c23c34,
-0x711143bf,	0x4e5f1f02,	0xe6be3205,	0x12a4e5a8,
-0x1e54535a,	0x9874712d,	0xa8ed6aab,	0xf8e9dd8e,
-0x4ba41834,	0x938f32b6,	0x6eb45808,	0x5b7f5f24,
-0xdf5068ad,	0x2b0d6ba1,	0xc1f9618c,	0x92a831f5,
-0xeb0cd324,	0x9a784752,	0xd19a30c2,	0xe6b3e9d1,
-0x0f604748,	0xead250cd,	0x1483fd3c,	0x8dabb1f1,
-0xdd98a78f,	0x07831a92,	0xfda45704,	0x4cf3a89b,
-0x295917e6,	0xbdb8e65a,	0x050068a7,	0xdae26311,
-0x33ec1ac3,	0x5984753d,	0x65628b48,	0x82dcbdb6,
-0x542a70b6,	0x8768acd7,	0x1829de29,	0xb19f0db8,
-0xea0ca24f,	0x71b22805,	0x44fe50eb,	0x76ecca1f,
-0x50a69a79,	0xc325ee2e,	0x20dbe76d,	0x7296ba19,
-0x46e242c4,	0x1ecb1e3f,	0x1be14a8f,	0xc55ea513,
-0x7e14ce2a,	0xce50fc02,	0x1d3f95cc,	0x20bb0510,
-0x2bafed47,	0x0adf25c0,	0xb0788b94,	0x54d64296,
-0xdd4ca8f7,	0x304bc9db,	0x2fad5b53,	0x79d34c4d,
-0x9cb63708,	0x063a61fc,	0x4cb5c1bc,	0x61865d4f,
-0x05bb9c68,	0x8506ae0f,	0xef4a2e30,	0xcbd3fe9d,
-0x54b23597,	0x30ef6bb1,	0xc496c4df,	0x00f52245,
-0x32212ea0,	0x6c01394a,	0x7a0ddd84,	0x751454c0,
-0xc6976a80,	0x7181ea76,	0x437ac15e,	0x3bc420b5,
-0x49ffa13f,	0x4f994e99,	0x9b667956,	0xd83735d9,
-0x31812cb7,	0xbdb69ea6,	0xa1ba6d07,	0x06d1f20b,
-0xb22d62bf,	0x0cdcb7c9,	0xa9c74431,	0xf4f1d1e4,
-0x79d765b0,	0xab9ce36d,	0x2e984802,	0x3ed48b45,
-0x78c5d70d,	0x64637b73,	0x91e44d92,	0x2f00650e,
-0x7e7270e6,	0xb0b0e6b0,	0x09bb8565,	0xb0ded3b3,
-0x2db61a97,	0x487aeb77,	0x5db35bc0,	0x727756c2,
-0xfc716dc6,	0xfc5df1f0,	0xad6fb560,	0x09339656,
-0x7f2f74af,	0xacff607d,	0x0aafee01,	0xa3e4cf62,
-0x9899ca6f,	0x33787a19,	0x510a7d77,	0x58829e4f,
-0x2e4c3a30,	0xeaa3b201,	0x4c706de3,	0x1620fcc9,
-0x56741cf4,	0x21371491,	0xa5b6c083,	0xec88fb63,
-0xbb0399ff,	0xcf0451c0,	0xe9671bae,	0xb4191904,
-0x3b4f7775,	0x7bffb243,	0xe9d766ab,	0xeeffedca,
-0x3e8f4784,	0xa515c160,	0xc6fc2c82,	0xdf9b7ef2,
-0xb706740e,	0x712fc333,	0x3996fa72,	0x2bf509a1,
-0x74821349,	0xe136de3c,	0x871629b5,	0x0bd538a7,
-0x7d423a9d,	0x48ee44b4,	0x14b96b88,	0x6b819ca0,
-0x77674c91,	0xa2c6e96c,	0x5331e28c,	0x0f62402b,
-0x5ad65199,	0x0c3128ef,	0x6733a286,	0x7f34342d,
-0x188dcfa6,	0x28552add,	0x78d76095,	0xcf1e718f,
-0x1a30b39b,	0x2d7954cd,	0xc1b5b92d,	0x2f14c4e0,
-0x67d82644,	0x99d65979,	0xc6411fcb,	0xd99c5ff5,
-0x6c7790e4,	0xae250294,	0x1cc063af,	0x16c3a84f,
-0x74cb781a,	0x693b9281,	0x848cf3f7,	0xb7c00c17,
-0x360a695a,	0xa4366d9d,	0x9cdb154e,	0xe077ff83,
-0x4ad4dd5e,	0x7a10cf6e,	0xd35fcedb,	0x3258d838,
-0x380c9555,	0xff9397fa,	0x32c0aeaa,	0x9c48f057,
-0x8f0e1a9b,	0x15dd32e1,	0xb6f21fa3,	0x74c3be72,
-0x18a8dbf6,	0x1fccc9b9,	0x94409113,	0xa1978134,
-0xd094008e,	0x4ce19486,	0x0bb5172e,	0x7065f6cc,
-0xbd457d8a,	0xa37e2ec5,	0xeee97672,	0xca0ae634,
-0xbc8b44d1,	0xb97b7056,	0x578fee89,	0xd0222b9f,
-0xadb8b3e1,	0xa7bd9525,	0xf6aef00a,	0x3282ac4d,
-0xf97076ff,	0x7726bbba,	0x46ce9db7,	0x7016f83f,
-0xfac41994,	0x025804de,	0xb4977511,	0x2b2aaf86,
-0x732debc6,	0x072360af,	0x0b25ec36,	0x45e8a251,
-0x9cd9e5c2,	0x6367b497,	0xd5923296,	0xd574a3af,
-0xbc3dba83,	0x5eea9967,	0xa80f8577,	0x77f803ef,
-0x43fd50c0,	0x525368d2,	0xce61f844,	0x1b652c56,
-0xe9cdf56f,	0x38deafbe,	0x288043d8,	0x61c38fd1,
-0x54f519b1,	0xcdf3911f,	0x2651eeee,	0x7b097fe5,
-0xba02d544,	0xca1c8f42,	0x9e645f92,	0x50170562,
-0xdce41094,	0xa8a7ed0b,	0xd6f2f4fe,	0xcb098894,
-0x14b9861e,	0x13786769,	0x26c1dc22,	0x330e3ce1,
-0xad187ebf,	0xc8c8c267,	0xe8a6f620,	0x1cdeec54,
-0xa6e1ac03,	0x5d029ec5,	0xb1de4091,	0x2ca530ab,
-0x950969bf,	0x0721a6f7,	0x445ba622,	0x60766f96,
-0x86e0245d,	0x94866c85,	0xb4d01674,	0x67f9976f,
-0xbf220f92,	0x8585e70b,	0x4d78cd26,	0x93f369ed,
-0x0ac2a550,	0xde5114f9,	0xe7c8436f,	0x47ee726c,
-0x981c6a7c,	0xf0192ffb,	0xc1b2c383,	0xbea801a5,
-0xd3e5db10,	0x032a7acc,	0x18af5ed7,	0x88a17d27,
-0x7d3b9e5b,	0x94f1fbc6,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2380-m106f768.inc  */
-0x00000001,	0x00000068,	0x09162007,	0x000006f7,
-0x18729a7e,	0x00000001,	0x00000010,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x67615a02,	0xc5c97f5f,	0x67c6cc07,	0xc2b8af48,
-0xe6144a74,	0xeb752f3c,	0xcc641d37,	0xc85dbcbf,
-0x8aaade67,	0xc12d84d2,	0x42d1e9fc,	0x648e9b8b,
-0x7ba8726a,	0x10730fd5,	0x559ec216,	0x6ce0304e,
-0x6262dcef,	0x9bcfb566,	0xde72b180,	0xfff5e1bb,
-0x357fc3fa,	0xb433b4d0,	0xe0a5c2c4,	0x77d08032,
-0x058d1ae6,	0x501f62b9,	0xd536ee5d,	0xc42cda2e,
-0xb32833da,	0x79b0e085,	0xdd4c876b,	0x7ce16476,
-0x21a34fee,	0x4a7c9a43,	0x55fa4e5d,	0x58c491b5,
-0x9812db2e,	0xaf55d9d1,	0x6d179bf4,	0xb550b764,
-0x0eea6215,	0xb46f1eec,	0x2007d397,	0xa819e1f0,
-0x7ea88495,	0xc40cae2c,	0xc16b49ad,	0xb92c71bf,
-0x5b3fd03a,	0xa7d20283,	0x2b144d56,	0x47c6b4e0,
-0xc02c37d6,	0x07f461c4,	0x943c86f1,	0x1bf5de9f,
-0xb204aaf0,	0xa24bd8e6,	0x6a48faea,	0x3058ba2c,
-0xa8e86950,	0xb5b4379c,	0x990fe958,	0x55171689,
-0x9ff43ba5,	0xf8bf0b99,	0xca5b9d3a,	0x6293d6a1,
-0x0b7d8354,	0xdf95b72e,	0x7f2e9e77,	0xc505ee34,
-0x2edec94c,	0x188473ce,	0x26c7362c,	0x3dd5cf5d,
-0x05ad2dcf,	0x66c59f30,	0xdf1debed,	0xc93fff73,
-0x2642be44,	0x17442c17,	0x10671a4d,	0x02c54398,
-0x33f14adc,	0x020cf5f4,	0x3597dc28,	0x42e987b7,
-0xc40f9739,	0x625e6650,	0x3b60315f,	0x940e136f,
-0x3dca1103,	0x4159b10a,	0xf42a3027,	0x900c7980,
-0x61106101,	0x5aaa4c16,	0xdd95902e,	0x507c3c70,
-0x3ee2d404,	0x40498827,	0xe2a4b67a,	0x767e8e7b,
-0xa9560205,	0xf194ec13,	0x5fafff8f,	0xd53d6edd,
-0x59c614c0,	0x6a0f4494,	0x30bb87be,	0xaf1ada6b,
-0x514d7c35,	0xced06aa0,	0x3f2cd210,	0xd47ebb24,
-0x89d317da,	0xd8eb25b7,	0x418bd5b5,	0x71b8a88f,
-0x8ba4d56f,	0x6f6a2a92,	0xb5bb0923,	0x269679ee,
-0x1022ba01,	0x5961ee04,	0xffecb06a,	0xf78cf0c8,
-0x22011938,	0xf6e0027b,	0xb59d29c2,	0x3c64808f,
-0xafcb0d9e,	0x8477f881,	0x6e3aa0b6,	0x097dfc20,
-0x2fd6504b,	0x64346735,	0x13903009,	0x1dc3f335,
-0xd1c7c3ab,	0x1be49d10,	0xf31d50de,	0xa67b35b3,
-0x2aa9fbc8,	0x39d0b34b,	0x533f165f,	0xf8ec6056,
-0xdf03fcd9,	0x261527cc,	0xbc386be2,	0x89272956,
-0xca340c54,	0xa87b2959,	0x9dd445fa,	0x476a6320,
-0x5ec91ee6,	0xccd6f647,	0x4b5f2b38,	0x1c12bc75,
-0x88f20dc6,	0xb363d3eb,	0xa883466a,	0x01271996,
-0xd547f1fa,	0xcfc9637b,	0xbf3ab2d0,	0xa2c34aa6,
-0x5f1b4642,	0xa10030a2,	0x2ec1fdd9,	0xcad61c34,
-0x70243eb4,	0x8b94c510,	0x37c25834,	0x70e2558e,
-0x520ed333,	0x8aff0b4e,	0x77d86d46,	0x7b1b8bf9,
-0xdfd41082,	0xdcf4e512,	0x6fb04eb1,	0x91f536db,
-0x4ad991b1,	0x737cf5e9,	0xfe5cfa24,	0x18a20bfd,
-0x8471e184,	0x39026c6c,	0x4a2f658a,	0xcc95ea19,
-0x7f6b63e8,	0x6898846b,	0x6313970d,	0x8c05f8b5,
-0x45f5e6a3,	0xe808d5ab,	0xe427b730,	0xa67d845b,
-0x572583a5,	0x04e8e1c9,	0xe0b51899,	0xb22508a1,
-0xcfc9b3e4,	0x6af3bb0d,	0x5ddc0027,	0xd45a5bcd,
-0x72d64b56,	0x9cba2941,	0xb165f22d,	0x6f848282,
-0x0b5b94f4,	0x18eb6bcc,	0xc8ff69ca,	0x5b1aac44,
-0xbd38547a,	0xc3f5fe80,	0x8e71900e,	0xf765e42a,
-0x1be04368,	0xba6b77d1,	0x027853a1,	0x4d76fe05,
-0x30b44278,	0xca1efae7,	0x36fc3696,	0x2feb3958,
-0x560acd1e,	0x71bcdb1e,	0xff0c0f48,	0xa7ebdcc1,
-0xe874123f,	0x050e72e9,	0xaa51e4fc,	0x14e60100,
-0x42116c64,	0x58a87c0a,	0x3cc6816f,	0x6ef8022e,
-0x822b9e42,	0x76699062,	0x87c1d73a,	0xd71d85f6,
-0x2c048669,	0xe53a0f9b,	0xedefa244,	0x3112ba9f,
-0x0ddf05fb,	0x43d2a8bc,	0x8a912f27,	0x120b57d1,
-0x12d0a08c,	0x3055610a,	0x0611c5e9,	0x62ff32a1,
-0x96b856a1,	0x13c9a0cc,	0x81bdc683,	0x8d1e4af5,
-0x5dddefc9,	0x2167f11f,	0x080de923,	0xf93d81b1,
-0x89aa8364,	0x14a9218c,	0xc65494d3,	0xc955648a,
-0x9d532e77,	0xc9bafa7f,	0x30099ca5,	0x71ce1593,
-0x52b08e34,	0x2ecc93c4,	0xd2b00f8b,	0x2265551d,
-0x4b5f1fec,	0x75bcafc0,	0xb032813d,	0x60c83e46,
-0x88fc0a32,	0xc24685ee,	0x1552dd77,	0xd4d8beea,
-0xf6101d37,	0x5067e008,	0x03c0ce59,	0x49d8df07,
-0xf0f3b2a1,	0xae6a1194,	0x1b1c9a5e,	0xc0c5087b,
-0xcde2ddb0,	0x9a52499e,	0x6cc44420,	0x0a9fe620,
-0x6cb2ea9e,	0xc1c5dd9e,	0xb5c21092,	0x5d6b62a0,
-0x54420a2e,	0xa55fe6c6,	0x5be036e2,	0x00ad1a1c,
-0x49fe30d8,	0x13db6cd5,	0x1d367882,	0xfa4a08fb,
-0xb037e9cd,	0x243c4e45,	0xccf4509a,	0x6db26901,
-0x0075ab9c,	0x6ee273b3,	0x46e953bf,	0x55625aaa,
-0xfb4c043f,	0xf986c5bd,	0xc2262652,	0x28bb1b7b,
-0xcf429e66,	0xde10a292,	0x70de0224,	0xb34d3b44,
-0xba0468ac,	0xbd06f79b,	0xbcdce47a,	0xaffaaa80,
-0xb093dbec,	0x4e250f0c,	0x73639683,	0x021fe836,
-0x49439a22,	0x2e4fb04f,	0xe0b3f943,	0x3c6ee400,
-0x23316a70,	0x80235474,	0x30b98b5d,	0x94a03c53,
-0x1a314d5b,	0xa630ff3f,	0x4e19d90e,	0xfb9c77d9,
-0x98c95421,	0x065ec7c9,	0x1065516f,	0x47c897a4,
-0x704e3cef,	0xe011a1a3,	0x3a5ad35c,	0x68526d7b,
-0xb480bb26,	0x0669ccc1,	0x047cc38c,	0xd5574b18,
-0xa64909a5,	0xb5e73a87,	0x5ea071f1,	0x76df8d93,
-0x53e57d5e,	0xb2a62d6c,	0xc506e3da,	0x69385811,
-0x09d25d90,	0x54e79cc5,	0xd68a620d,	0x4c4974bd,
-0x98b55474,	0xe4b700dd,	0x3f70e16c,	0xc07ef531,
-0x9c11b7aa,	0x8bbeacce,	0x21391b4f,	0x73624bc3,
-0x5706b45e,	0x92a200d4,	0x80f2f6d0,	0xb933d8c3,
-0x179e5a40,	0xae89a6c8,	0x153eaa99,	0x10bb4e91,
-0xb50a198f,	0xe0abdcb9,	0x035f44ac,	0xf0f2998e,
-0x18cadd3a,	0x23050c59,	0xb58a65fb,	0x6c999ccc,
-0x8763005f,	0x1703af79,	0xda1d75cc,	0xa3a2f063,
-0xdde69386,	0x43039b8c,	0x25e1b4bc,	0x162f930c,
-0x70e335de,	0x59fdc4e7,	0x88c864d4,	0x77db0614,
-0x8d0d0fdb,	0x56862726,	0x83eaa90d,	0xe509b226,
-0xa4ada038,	0xe84a085c,	0xa648287b,	0x2e23bbe7,
-0x449180b2,	0x5dcc1bfe,	0xd4fa7aa3,	0x2cbe4a49,
-0xc519cdba,	0xd82cdff1,	0x2c8e00d2,	0xcfa395d7,
-0x680c8e2a,	0xb0105431,	0x49c98d09,	0xf0bc411b,
-0xdb36b018,	0xb8bf0c6b,	0x3d4793c4,	0xc2c8b854,
-0xbf759b5f,	0x69713fd2,	0xecef764c,	0x170dd67d,
-0x8ea058f7,	0x9b9f2c7e,	0xe2e50483,	0xbf377736,
-0x67a40d09,	0xdb97b029,	0x18fca161,	0xbea0cd76,
-0xa3380607,	0xb40553ad,	0xaa2ba855,	0xcfdbe241,
-0x07f78103,	0x16269f13,	0xf947b3d0,	0x7542caae,
-0x840573e7,	0x7bb4b73c,	0x18fb5bce,	0x6510a043,
-0x09816599,	0x35a3b7ab,	0xd5aa1265,	0x4ff654a0,
-0xaf919aac,	0xa45d4d56,	0xad1d53c6,	0xf8e4a825,
-0x58aadc02,	0xf925c5b2,	0x2e1f1137,	0x3bde5e6f,
-0x29237bdb,	0x93a29f52,	0x4618d46e,	0x055078ee,
-0x4672eb9b,	0x1d84e114,	0xcd3e8620,	0x5e9c11e9,
-0x3473a677,	0xa0c59414,	0xdba554a4,	0x7d570d61,
-0x7fc49885,	0x6d967357,	0x8e2c95b3,	0x599b0a3e,
-0xdeeb825b,	0xa26e7a46,	0xfa6344be,	0xe360cb75,
-0x598d3b1f,	0xa1de27d5,	0x6d582656,	0x7460caf2,
-0x9a9b0a1f,	0x6b03e47f,	0xcb773bfc,	0x8b4dbf7e,
-0xb2346a85,	0x7524eb59,	0xad850431,	0x1b7f3435,
-0xaa872445,	0x5383f435,	0x277db9e8,	0xd0885463,
-0xcd9c190c,	0x59b067ee,	0xe2a649d8,	0x0de635f8,
-0xb971eab5,	0x5251d886,	0x0fbee652,	0x20a69173,
-0xac648bc8,	0xf527bbd3,	0x5991e44a,	0xc354d183,
-0x533ebb92,	0x4e213450,	0x32da96d7,	0x1bc6eba8,
-0x9a982769,	0xc63f6a40,	0x5362ff6e,	0x31603fef,
-0x4326f4bd,	0xc69df862,	0x67015fd3,	0x2cc17450,
-0x751adb02,	0x5a959871,	0xd4744b5c,	0x02c05fe0,
-0x301d3565,	0x9a7df8bd,	0x5ea285ef,	0xd6cd559f,
-0x20ed318d,	0xcd4c0972,	0xf6fd10c6,	0x51dcbcf8,
-0x343bc9f5,	0xa7b1e1ca,	0x7072ef25,	0x25050f84,
-0x4cc19863,	0x247562bd,	0x960e87f7,	0xea2a401f,
-0x58e2451f,	0x4e59f93e,	0x9ebd55b0,	0x6c4bf8ab,
-0x6d8de270,	0xbaf9e338,	0x64a6f36a,	0xc61817a9,
-0x0cff6e4d,	0xe9d6facd,	0x9f679b31,	0xfb4e0df3,
-0x5d3601d5,	0xdb557456,	0xee907bd0,	0x97f55ad4,
-0x9be94661,	0x37d20c4d,	0x61c2e4f8,	0x1410ad12,
-0xc70e847a,	0xe7aefa4f,	0xbfedf651,	0x6d82c2b5,
-0xe72ee260,	0x7614a850,	0x810fa301,	0x24382684,
-0x8cbf769a,	0x6d200632,	0x3e5fac0d,	0xb3f721e5,
-0x191a57a0,	0x938ef2e8,	0xb9577657,	0x8c48778b,
-0xa64f1049,	0x553062a9,	0x4f0a17e4,	0xe4a7949a,
-0x6fa14161,	0x67ceae86,	0x22cc55ca,	0x8f49bdcd,
-0x8636d5c7,	0xf6db1b31,	0x5ddb0ce8,	0xfa84e29a,
-0x3b465c6e,	0x40438b22,	0x54c77f5c,	0x11260af3,
-0xfa9c31a5,	0x62574201,	0xb47b260e,	0x49bcda40,
-0x9ca8ff1d,	0x7ef6a279,	0x4b9b3701,	0xd514317d,
-0x1397305a,	0x60e37da0,	0xe883c100,	0xaeed8582,
-0xc4c984fe,	0x5b8fde0f,	0x3a1ff9ef,	0x66077a5c,
-0xe7779cbf,	0x1bec9cc4,	0x1ae72ef1,	0x13479f70,
-0x3c180bf8,	0xd948cf8c,	0xaa7de543,	0xab853b9e,
-0x5fe0a2df,	0xc91f811a,	0x08ee75ef,	0xdf912c97,
-0xc357c8f5,	0x64049a04,	0x382a1d20,	0xa34de556,
-0x8443f669,	0x85589500,	0x5bff7e15,	0xfba9d7d7,
-0x5ee9511c,	0xef6c7809,	0x32e2b93a,	0x01dc227f,
-0x42af4cbb,	0xbf89eebe,	0xee70ccc7,	0xdc8edfa2,
-0xe9fb5422,	0xe682d011,	0x2015a8a8,	0x9290e8a0,
-0x45e84ab2,	0x09e54944,	0x6498df04,	0xe1cbd37b,
-0xf0ef571a,	0x11126396,	0x194bb903,	0xe4b9a1c9,
-0xa31ea519,	0xde38d30f,	0x71bd64fb,	0x19548c4c,
-0x99f19c88,	0x2c368d17,	0x23370946,	0xc927bbee,
-0xc6b7ab96,	0x233427ea,	0xf4ba633c,	0xb05f583d,
-0x42407188,	0xf3937760,	0xb72c9a9b,	0xfe855280,
-0x076b9424,	0x13b7f5e8,	0x96223666,	0xd9e45123,
-0xbf342078,	0xd6fd02f4,	0x1d731bae,	0xec80d22c,
-0xb29df9e4,	0x667b78a2,	0x7f5642f3,	0x99e9bcbf,
-0x4f336820,	0x4b8fde3e,	0x93b01d0e,	0x7ccb245b,
-0x0014f1b4,	0xe1b1c1ca,	0xaa7ca490,	0x85d838ae,
-0xf134027a,	0xc64a16c1,	0x8b94368d,	0x85202ad5,
-0xcfaf0f31,	0x9d81d9de,	0x09e374eb,	0x7d905160,
-0xf8409a09,	0x670b3696,	0xa584a070,	0x84342454,
-0x95253da1,	0x229f2918,	0x1a702051,	0x22e81f48,
-0x766bf7fe,	0x07384f51,	0x82487bbf,	0x10c9307d,
-0x2b572e64,	0x139cef4d,	0x6ac5e564,	0x6fcbc0a3,
-0xba1bf522,	0x85eacbc3,	0x28530abf,	0x7322f6b6,
-0xbdbde559,	0x100f0c60,	0x26b64329,	0x93ea0651,
-0x52573484,	0x63f48bab,	0xa0d5ecb6,	0x23bd3d48,
-0x706634ec,	0xc52537cc,	0x2784e92e,	0xd095c0b6,
-0xf5c6a0d2,	0x1d5f041b,	0x6f86c937,	0x5403a4c6,
-0x1f354de2,	0x6f074fa7,	0x9465e5cd,	0x0b8c87fe,
-0xd4057cdf,	0xb3a60164,	0x627f39a1,	0x33020fd7,
-0x51e197ea,	0x40cb35b6,	0xdf2327b0,	0xff6aa5b5,
-0x48e196aa,	0x37077b50,	0xabc7535d,	0x089fad31,
-0xba46bca6,	0x57730eb6,	0xc039f71e,	0xa19963fa,
-0xda9c5d12,	0x7360c4b8,	0xa2fd2347,	0x3a58da4a,
-0x8ba6803c,	0x781cf017,	0xffdbfbc2,	0xe3f7cbc9,
-0x343900aa,	0x432e4ea1,	0xb9e0eb2a,	0x11ec2e64,
-0x5b205aea,	0x65cf92d1,	0x4fe48dd0,	0x72558b78,
-0xb0d9b571,	0x6ada41a3,	0x4e8180af,	0x222054ca,
-0x98556eeb,	0x145b8d08,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2990-m046fbB9.inc  */
-0x00000001,	0x000000b9,	0x05112009,	0x000006fb,
-0xb6a7f0c9,	0x00000001,	0x00000004,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x000000b9,
-0x0000003f,	0x2a000000,	0x20090510,	0x00000341,
-0x00000001,	0x000006fb,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x15341951,	0xd9f92c58,	0xd61aff76,	0xe96873ee,
-0xdec6dd45,	0x3dfa2e4e,	0x61661b88,	0xcf5c5841,
-0x58d10d9f,	0xb7f2421d,	0xe4d5fcf1,	0x02889a15,
-0xad9bed07,	0xa32ab3e6,	0x3491afcc,	0x9c991c37,
-0x2a1c2071,	0xf066191a,	0x3bd898e7,	0x2648d958,
-0xc05f7908,	0x05864b9b,	0xbe4c1eee,	0x1e6c7ef4,
-0x0e7a539e,	0x100b2ab3,	0x1273dceb,	0xfec8847d,
-0x8f37946f,	0x634e3b5c,	0x691dbd61,	0xd89e3cb9,
-0x094639d4,	0x7d972e1a,	0xd6dbd94d,	0x2001c3ec,
-0x34f791f0,	0xeee0d794,	0x88b7459d,	0xc2c73aa3,
-0x607a174d,	0x4f0f8304,	0x65790b35,	0x00532bfe,
-0x1fd1e0cc,	0x7b91f873,	0x154ed42b,	0x7a7108e9,
-0x81637c95,	0x192cb173,	0x28ccd94e,	0xb9bcc372,
-0xac05171b,	0x867f47da,	0xf8e8c47d,	0x1edcdb4a,
-0xd2ca6c2d,	0xe9ee9169,	0x5a6efedc,	0xb6825038,
-0x09277eaa,	0x2a34e580,	0x0f794366,	0x86c99402,
-0x211b98bf,	0xdf8eb0e3,	0xda11d7bd,	0xd440363e,
-0xa7d49f1a,	0x16dd7395,	0x5b23c2fc,	0xab93ea3c,
-0x00000011,	0x0741cbc1,	0xcb879f12,	0xb53a6cbd,
-0x8d26a6ca,	0x2aca7c7a,	0x1e952ea5,	0x07da17e7,
-0x52d164d9,	0x62c68a73,	0x2d489e03,	0x45a07f1b,
-0x0f0cc8cf,	0x4fa8fa70,	0x2315d683,	0x33e36418,
-0xdda877f3,	0x8e1bfc6c,	0x7f636e46,	0xbb114fab,
-0x69c0e244,	0xf261040f,	0xeeeea4a8,	0xc88fbfac,
-0x507ac028,	0x4932bf5f,	0xb40db20e,	0x8d18c03e,
-0x44b1f658,	0x2f0527f9,	0xe6d65979,	0xfd881db7,
-0x770be7a8,	0x459b7a4b,	0xfc00c5d2,	0x1bdee510,
-0x94bf752f,	0x68a06b2c,	0x4fdf4668,	0xdd08536a,
-0x19438a29,	0xdfa14148,	0x266ccbb8,	0xd7ab60f2,
-0xceaf893a,	0xb00858da,	0xd204d03b,	0xea8d3784,
-0x4f3a4d8b,	0x323f53e4,	0x3180af2e,	0xd06428fc,
-0x932bfc3d,	0x8d701652,	0xacd6f494,	0xebd48f9e,
-0x2b1248b0,	0x63f4d854,	0xbedc0412,	0x505e1f49,
-0xad20cee5,	0xc95a2a56,	0x49b90a51,	0xb3de9036,
-0x1f4c88df,	0xb7460c4f,	0xad3a53b4,	0x3d3e83cd,
-0xde1ea2d5,	0x5d3b0237,	0xda3c8637,	0x0aeeeead,
-0xae2b5959,	0x35624290,	0xbabab8d5,	0xa4899633,
-0x7d6e607d,	0x410383ae,	0x10916b70,	0xb2adf0c0,
-0x52d8faac,	0xe6937b79,	0xb959bc66,	0x14d8d06b,
-0x0ec3c602,	0xb6c71f26,	0xbbd8c4dd,	0x63d23706,
-0x6bee321d,	0xc8a1ec7d,	0x8de3941e,	0xd549d1c4,
-0xe33588e8,	0x681cff2d,	0x66dddada,	0x807040e6,
-0x006c83b0,	0xba10f7c8,	0x38eafe62,	0x0777e74d,
-0xfa39a198,	0x05720466,	0xec377dbb,	0x23d46da7,
-0x3a387dc8,	0xe005ab95,	0x5d92190b,	0xb811b9d9,
-0x9b09dddc,	0x62a64be5,	0x0c9014bb,	0xcc871ef9,
-0x4846edba,	0xc60305e2,	0x91b831aa,	0x8f7d5aa7,
-0x6712012e,	0xbae578bd,	0xc5bb2872,	0xb635139f,
-0x41444279,	0xc51f819a,	0x92fe6768,	0x96c480e6,
-0x6a958394,	0xb4b7a6e5,	0x007c0429,	0x43af55b5,
-0x33697de5,	0xcb6b363e,	0xf527556a,	0xd4a79f83,
-0x9c628ccb,	0xef72182a,	0x8406cbce,	0x6035ff55,
-0xd6325e79,	0x111ea438,	0x962b7e5c,	0xecc816e1,
-0x39a8f348,	0x8f5bb065,	0xa2419dd2,	0xc036db13,
-0x5360daa6,	0x82d2ffb8,	0x15681502,	0x6d5497d6,
-0xe9028ce5,	0x2e05c16a,	0xee8711ae,	0xac5b11e4,
-0xabba0581,	0x1ef11c35,	0x54ecf615,	0xcf45b599,
-0xd8ee7594,	0xecda2c12,	0xa6b2b120,	0x32edc139,
-0x7734c724,	0xbb88978b,	0x12092d6b,	0x133fb4f4,
-0xa6fa233d,	0xa059395e,	0xb86920df,	0x60b25bff,
-0x1fe831ef,	0x2b5cb3aa,	0x27ef4afe,	0x02f3ad21,
-0xea597773,	0x2caaf33c,	0x03b30480,	0x7d8e32e5,
-0xad9a917e,	0x1bd0695c,	0x68d8ca07,	0xeef84400,
-0x928ff8b4,	0xecea6a3c,	0x9bbedbd8,	0x5c2654bf,
-0x2d1644d5,	0x961ddc1e,	0xcb216e0c,	0x55fcff3b,
-0x6054f145,	0xad2d4159,	0xdcbe8ed7,	0x3b2e7495,
-0x7a33fdb5,	0xa92fdfde,	0x65ad1aa7,	0xf6866ab0,
-0x53388681,	0x0a369d17,	0xf087441f,	0x44007109,
-0xd1d8b88d,	0xdc94549b,	0xa11f14d2,	0x72864a34,
-0xd7f71dd9,	0x6f948c77,	0xd3e89fc0,	0x11b097a8,
-0xfd2cd3fc,	0x774f951d,	0xe1170076,	0x2bde8936,
-0xa3ea656e,	0xabbe230e,	0x2fe6e1d2,	0x53b331e2,
-0x7b392823,	0x48c2aa80,	0xb7824981,	0x275bac51,
-0xd3b3eb48,	0xa3541a00,	0x4375b1fe,	0x086302fb,
-0xd744a440,	0x0323a890,	0xcebc28fc,	0x9921427c,
-0x7a4b5465,	0xf4db5f26,	0x6461f88c,	0x2dbe6ea3,
-0xeb6dd03c,	0x8257fcce,	0xf44dadd6,	0x7d367355,
-0xda56024d,	0x750430f5,	0x5e4151d9,	0xd90a0db6,
-0xdc29eff5,	0x6acb146c,	0x97ef9139,	0x4992e11e,
-0x87833d75,	0x897f9beb,	0x33aa151c,	0x28a717fa,
-0x5c5bb59f,	0x45617198,	0xfc791809,	0xef17a7b2,
-0x10931956,	0xdd697c3a,	0xd8a2f728,	0xd4171ff8,
-0xd507ad63,	0x40c2a2b8,	0x519fe54e,	0x6ddbf5e2,
-0x215f916e,	0x99694eca,	0xeb87cf67,	0x69691e42,
-0x76d17fa0,	0x0edb5d25,	0x82303164,	0xa6ff4797,
-0x8a19ce37,	0x71005b4d,	0x41930843,	0x0251a3cc,
-0x594886d3,	0xe2e463e0,	0x812ab47f,	0x477b2ba6,
-0x17c544a2,	0x802b8757,	0x1692cc60,	0xb86bf34f,
-0x1f8a5fc2,	0x0693dda6,	0x5da932c7,	0xfd216376,
-0x25002074,	0xad6987f9,	0x93bde120,	0x2ae45842,
-0x092941c2,	0x0bc4878d,	0x30507588,	0xe9351bb4,
-0x81dda9a2,	0x6b89e825,	0x948482ef,	0xaeb22085,
-0xace5a27e,	0xa20c3f4a,	0xd768a0da,	0x919d2d26,
-0xded8effd,	0x01812972,	0x9ba923be,	0xb69023a5,
-0xe7defcfe,	0x865e123e,	0x02107238,	0x92c688cf,
-0x30b0a462,	0xb56e62e5,	0x009e60fb,	0x02db37ca,
-0x19a5c9d0,	0x9b879be1,	0x16ec478f,	0xa983dd56,
-0x2776b4bd,	0xb858a7c4,	0xdf340c19,	0x137d7e01,
-0x4467564d,	0x855bcac8,	0x9cf1cd0e,	0x54a19437,
-0x2e4ed636,	0x7b693cfa,	0xddba25a3,	0xef65d915,
-0xaccd377f,	0xcdc2f092,	0x74704385,	0xda63baf4,
-0x1ac4bc8a,	0xb4ea4309,	0xa73ad61f,	0x6293ce83,
-0xdde1e829,	0xf88514aa,	0xcc488bcc,	0x6e4c9d36,
-0x78b7e22e,	0x5a7d29e2,	0x42f40246,	0xdf4a9afb,
-0x82ca32e0,	0xc7118b4e,	0x25165db0,	0x7770aecf,
-0xdf7582f0,	0x35b55887,	0x33a47c37,	0x08c158f6,
-0x7a21b06c,	0xcb6a9bbb,	0xdabcfc6f,	0x486b55b8,
-0x6187d764,	0xe5c70327,	0x492a7da7,	0x24264c3e,
-0x8e5c09d7,	0x3836c445,	0x9fa2d9cb,	0x6bc2b196,
-0x1ef155ed,	0xb949f5e8,	0x00846e44,	0x2b79a60a,
-0x9e40d440,	0xe8b97836,	0x90a14cef,	0x786cae97,
-0xe39447a6,	0xccf6d399,	0x0accbac1,	0x54250900,
-0xc0351c81,	0x00b88195,	0x5beb4553,	0x682e6920,
-0x9379d47f,	0x69cd76f7,	0x097b55db,	0xa9ead305,
-0xbcbf9b4e,	0x8d627c2a,	0x380a2367,	0x14790660,
-0x9c95ebed,	0x76e551eb,	0x645370f3,	0x497634cf,
-0xeffa7029,	0xf66aa141,	0xfe718fc6,	0x094c6914,
-0xbd00207c,	0x77e3154e,	0xabc1749e,	0xb8c40c07,
-0xaac4f806,	0x89d5f6eb,	0x2d89377c,	0x65caeecc,
-0x1c21568c,	0x901ddb9d,	0x915df7d7,	0x4f9cb664,
-0xf62c432c,	0xeeecadaf,	0x0ccb4f75,	0x14186099,
-0x68245f8f,	0xd981ff3b,	0x722de32c,	0x2b55e9ef,
-0xb918ac26,	0x94fdb9bc,	0x02b7ad08,	0x7592dd6d,
-0x470f9624,	0x9d403aeb,	0x5e7b4f3d,	0xb5e11056,
-0xa97be649,	0xe9826083,	0xeec24fba,	0xe731ac9b,
-0x5b339d05,	0x97af9713,	0x86390c44,	0xed541028,
-0xeaf9969b,	0x3c72446f,	0x0b654ab2,	0x281b99a0,
-0xa31e8b79,	0x86175d4a,	0x96fa99f3,	0xabd90de1,
-0x642bc82c,	0xdcc81442,	0x16719e3c,	0x0cc60e15,
-0xc276faaf,	0x9d0e7759,	0xe8594cd3,	0xbfa376e0,
-0x4daabe5f,	0xcbe3009e,	0xd1812e8c,	0x744b1fc0,
-0xcf3728a2,	0x34442fb9,	0x1c28619a,	0x35844d65,
-0x115306a6,	0xa3c936d2,	0xf781af3e,	0xef7bb760,
-0x0264321d,	0xf52bb605,	0x3a83684d,	0xdd21a5ff,
-0x777115f2,	0x69b8e872,	0x64517548,	0x70267f4f,
-0xbe3b1dcd,	0x5a2bc602,	0x222c7241,	0x424864ae,
-0xa735c475,	0xcc44d6f0,	0x27d8d5db,	0x67bc23f8,
-0x3391d751,	0x197aa11b,	0xf16a2a9c,	0xe4d58566,
-0x9dae5211,	0x1601c94b,	0x491bd296,	0x48dac3f6,
-0x8c6ddb0c,	0x734bc4ed,	0x83d4015c,	0x29ff784b,
-0x3707b6dc,	0x6c14e801,	0xc76aa725,	0x70740fc1,
-0x6aba6f3e,	0xf122dfd2,	0xffddda9d,	0x516c60ff,
-0x396bf3b6,	0x2d3406b4,	0x4355cfb9,	0x126d6dbf,
-0xd0d55fcb,	0x6f23a648,	0xe2f286dc,	0x8af42ef8,
-0x497f9446,	0x7285afdf,	0x3ff58008,	0x583df7d2,
-0x3aa49b76,	0x9281e837,	0x6196b8d5,	0x5ee4428a,
-0xf4f92c37,	0x6c6376d2,	0x6afb2760,	0x3f355e4a,
-0x1ea450bb,	0x5e9da7c6,	0x2b4b1e72,	0x74d5e29e,
-0x07de0aea,	0x77544e2c,	0x66c19ac3,	0xbe86aaa4,
-0xe5233e14,	0x7d4e763e,	0x31ca0aef,	0x0527e563,
-0x149b4d2a,	0x5f5ad61f,	0x65f1161b,	0x86c7633b,
-0x2877e065,	0xf5592a41,	0x60e67df5,	0x555aafdd,
-0xe3caffab,	0x501e6b00,	0x11ac37c4,	0xf84c8688,
-0xbad031ee,	0x6c10e5f9,	0xc7087e4b,	0x86d0bcf2,
-0xdcec3d4a,	0x999fb6a6,	0x7de512a3,	0x25a4304b,
-0x775003fe,	0xc3da9a99,	0xdb02be9c,	0x8c8bae98,
-0xd95e979d,	0x6094a6f2,	0xf69c4d09,	0x51fa8ab0,
-0x9e31adf5,	0xed2c1ddf,	0x0bdc379d,	0xe0c24b81,
-0x021511d9,	0x6aab3cd8,	0xbdb35278,	0x5e253639,
-0xdc51e798,	0xb7969a75,	0xb448b42a,	0x4db2c7bd,
-0x92ab4fd1,	0x99a0c92c,	0x5b59394e,	0x5e06cd33,
-0x76d0636b,	0x01c826fb,	0x66d62ad4,	0x2177e49d,
-0xbfdf80c4,	0x0687e341,	0x2cb66974,	0x0765697e,
-0x33a9d5c8,	0x790deacd,	0xb528b72a,	0xad4f0332,
-0x9efb2065,	0xa1621eda,	0x6da51c10,	0x891eb234,
-0x66015c9d,	0x8551be17,	0x34ddbe4a,	0xafc5de23,
-0x9ee441d8,	0x92153585,	0xd4ee376d,	0x7f267079,
-0xdffe357f,	0x0e0cd672,	0x8d914a79,	0x55c6242b,
-0xba984937,	0x6d4e5c6e,	0xdbbf9de8,	0x7b07ffb1,
-0x4c60f396,	0x81780d39,	0x1158e09f,	0xa7b04aa5,
-0x29e4e907,	0x321756e8,	0x938df05f,	0x3d2e2a2f,
-0xa0218157,	0x3b43bb2b,	0x90aed14c,	0x99e51a0f,
-0x94ed8b33,	0x230c8dc4,	0x49a1aaca,	0x38552316,
-0xd2b4d683,	0x402572f2,	0x6b35d2ab,	0x8f54d64e,
-0xbf6713fd,	0xb1baab41,	0xea513b9d,	0xee1fabdb,
-0x96965270,	0xb9c73510,	0x307504f6,	0x66e6efb6,
-0xe5edf87e,	0x0dfc0dda,	0xce9b9f4b,	0xc495c0dc,
-0x8eb4ae2e,	0x15d4ffaa,	0x3f72c117,	0x9066433b,
-0x1e326a9a,	0x87e472b4,	0xe8e9924e,	0x2d34ddd6,
-0x9f045dc5,	0x4e517bf9,	0xd4215701,	0x997945f2,
-0xda577384,	0xc26b9a43,	0x72cc0d2c,	0x1a6f0feb,
-0xb0deaa5f,	0x085e3c1c,	0xe84cd89d,	0x0c0b72ea,
-0xb6ba866b,	0x5495bf3c,	0x322cead1,	0xc15fa497,
-0x90813acd,	0xabdc90af,	0x25f8bca2,	0xef81a57d,
-0xa3f95491,	0x257d3c3d,	0x2ac7aa7b,	0xd713ee46,
-0x11a2cb99,	0x516713f4,	0x3c2e6d1f,	0x8dfc69e6,
-0xb2aa11c3,	0x4735befc,	0xccc1c2e9,	0xedd47dc8,
-0xfea0a020,	0x7477af3e,	0x59c5a8c3,	0x22546f44,
-0xfed2ffc9,	0x3b1dc4f3,	0x6d4fd900,	0x0df8a070,
-0x1bdbd385,	0x1b028b64,	0xd2c7b639,	0xaf26374b,
-0x48a6a1bf,	0x4f7896de,	0x0356256a,	0xb0bf4df2,
-0x3d0f3382,	0x28f1a73f,	0xadf4ed6b,	0xced36065,
-0x1c807f0b,	0xcd33028c,	0x62da94be,	0x79a2b539,
-0x3b81dc8b,	0xda9094c2,	0xdf52d610,	0x47d10d38,
-0xed9cd5c0,	0x482e26a0,	0x1459e4f0,	0x6cf0b6cb,
-0x4e29d1ef,	0xe67e1cb9,	0xd2ddca3f,	0x6e67ef3d,
-0x299c296c,	0x1e39f62d,	0xe77ee72f,	0xfc3c6f35,
-0x1317aa16,	0x5b9b266f,	0x292eca31,	0x39a8d234,
-0xd667205f,	0x4a2d3bf6,	0x70ed41af,	0x4e5d9985,
-0xa7ed1e30,	0x4a5ef783,	0xa9b51db1,	0x6fa70d0f,
-0xe7414e10,	0xc310129c,	0x2a486151,	0x2a0c9bee,
-0xa45f38f7,	0x0be89a12,	0xcb4ba82c,	0xb80cc7ee,
-0xb59b6377,	0xa02c239d,	0x3d823ee9,	0x77e3ffc7,
-0x17af5213,	0xb303a743,	0x38f96fb1,	0x14d3bdbc,
-0xc5ca7945,	0x5dc85885,	0xe4504922,	0xe7c4733e,
-0xf0fc251d,	0x9fbb0793,	0x5ce74c74,	0xb3e89185,
-0x84c07f55,	0x250d23e7,	0x87991bc4,	0x756003de,
-0x25bd29de,	0xa4a4890a,	0x6221bc7f,	0x0e2152ef,
-0xbfa74e3c,	0xe05707d9,	0xe6173655,	0xb5f18ec8,
-0x77a9d945,	0x950a28ae,	0x9e8a89e4,	0x63f0ec5f,
-0x9d076f5d,	0xe58dc77c,	0x25ee33f9,	0xc3e7f8fb,
-0x83527683,	0xaa61f768,	0x2205c8d0,	0x0d6168cb,
-0x246cf5d2,	0x85a4ae73,	0xb5d3ebc3,	0xe19687a0,
-0x9142d39f,	0x020feac5,	0xbf936a88,	0x531966c3,
-0xeefde76e,	0x813b650c,	0x9395f9a3,	0x60977944,
-0xadb0e013,	0xfc5ca32e,	0xc37bbb0a,	0xb163bff7,
-0xf7747ca4,	0xf26bdd07,	0x729fabaa,	0xdac72d73,
-0x4aa514fc,	0x33afdcd4,	0x42d8ef5f,	0x66d3596f,
-0xbf7171da,	0x46c3f239,	0x2d341c89,	0x69f0dba9,
-0xb254dc2e,	0xaa9ba584,	0x700a8ad5,	0x5dba481a,
-0x9307d3eb,	0x14c96fe5,	0x242a89d0,	0x0989fee6,
-0xcc68b593,	0x79061e54,	0xc4031f53,	0x41197bc4,
-0xc7e93644,	0xd67bfcb1,	0x2f38d97f,	0xd0024f6c,
-0xa6b95737,	0x575f4cec,	0xd69d5a72,	0x7e43e98c,
-0x0540ba2c,	0x6f4cadfc,	0x829ef6ce,	0x9837e2cd,
-0xb60f889f,	0x5e4a515a,	0xf11878eb,	0xfd873925,
-0x27413b1f,	0xae1f0200,	0x14700e37,	0x3807ca50,
-0xf8bf4663,	0xd1ed4780,	0x4480ac46,	0x3902cf3d,
-0xe33e8a81,	0x732aaa74,	0x21262a1e,	0xb4e62db6,
-0x1ca18e6a,	0x51495ab4,	0xb2934c32,	0xc6bcb687,
-0x22d4c9b6,	0x304d9bf8,	0xf2fd09f9,	0xf26d3d60,
-0xf7bb7d89,	0xbb19f13c,	0x148cb5f2,	0x85fd9045,
-0x9c6d3db5,	0x5da8c1c9,	0x048ac803,	0x94c91a96,
-0x25bf6e95,	0x2ee75dc4,	0x34e50927,	0xb2264221,
-0x6a7fccd9,	0x8efcaad3,	0x4ac94464,	0x493a2738,
-0x45c46d1b,	0x7ec0ebc2,	0xf870d8f1,	0x521b6386,
-0xfde5b6c7,	0x52717e80,	0xc25214d5,	0x239dd53a,
-0xcd4e0e62,	0xc0623e3b,	0x4827474f,	0x59ebea6f,
-0x54fe5e77,	0x1023eb02,	0x6a527d7a,	0xe24b64ce,
-0x5db22ab3,	0x0a680da7,	0x65cacc9d,	0xeb021a50,
-0x0c469683,	0x66220235,	0x24b031ea,	0xb6a92ecb,
-0xdc420a74,	0xf43057db,	0xe994ed65,	0xd70f65f2,
-0x3705d791,	0xde59eebc,	0x40916333,	0x516f3fa5,
-0x21b2a41f,	0xf466918e,	0xb859be7e,	0xeb2df428,
-0x1cde44b5,	0x93380060,	0xdb0dcdd3,	0x338cb6ef,
-0xc0ec9c37,	0xdbba2a12,	0x75da511b,	0xe915d57d,
-0x99fde0ff,	0x4e377dbc,	0x881617ca,	0x78d1d21d,
-/*  3107-M10106CA107.inc  */
-0x00000001,	0x00000107,	0x08252009,	0x000106ca,
-0x482cae0e,	0x00000001,	0x00000010,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000107,
-0x00000010,	0x000500b0,	0x20090820,	0x00000401,
-0x00000001,	0x000106ca,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x2beaa92c,	0xfc3395b7,	0x10be81a0,	0xb318e067,
-0x723923f0,	0xb297dc63,	0x7d52bc4b,	0xc6ef362f,
-0x0882023d,	0x953684cb,	0x0abe06ee,	0xa7ef1798,
-0x160d6cb8,	0x930cf745,	0xafc3fd79,	0xa70df3d5,
-0xb0620f46,	0x70048a23,	0xbf95ecf0,	0x76c1b997,
-0x5128616d,	0xb6b4b969,	0xcc69f71d,	0xdf7416e1,
-0xdf9a571b,	0x50c0bcc8,	0x85e2b3cd,	0xc1927532,
-0x7a04b6be,	0xe56b7f97,	0x524085c4,	0x668bf327,
-0xb3eaa54c,	0xccde06f8,	0x09b4e42b,	0x033b0a46,
-0x0f6e2fde,	0xb308ce53,	0x93eff03e,	0x8830014e,
-0x5c8a6f22,	0x91d2f757,	0xf70b648d,	0x0789998a,
-0xd84d4640,	0xe5f34e80,	0xf3357e64,	0xd1e2beea,
-0xc7e95c3a,	0x30e57e4d,	0xec214356,	0x7e10859e,
-0x1d5895d5,	0xdeeff6cb,	0xed1030ed,	0x827e603d,
-0x6b4b2de3,	0x83ec6fd0,	0xa64092f3,	0x8d9887e4,
-0xbefcbedd,	0x2111afef,	0xcb9abf96,	0x5c79ceac,
-0x9bf8a57f,	0x5d0e44be,	0xdca3d3b6,	0x9072d1ca,
-0x48e73a50,	0x8d0bc804,	0x6aea94d3,	0xc372403e,
-0x00000011,	0x3b994153,	0x23faa5e1,	0xc3feae68,
-0x76d5e67d,	0xbd696479,	0x138a05ef,	0xf2b5de22,
-0x4ccba0ed,	0x333cc95c,	0x8d98a2ae,	0x0bf1fa24,
-0x239f1fbf,	0x44701d3b,	0xb176783f,	0x20eff2cc,
-0x0cf93bf9,	0x4e6ace41,	0xe346d231,	0x11d560af,
-0xae8874a2,	0xe344fa92,	0x0056d268,	0xd8068d91,
-0xf336cf97,	0x45c54f6d,	0xc0650992,	0xa3f86cb2,
-0xc73d3aac,	0xc7654f1f,	0x385777ad,	0x20928850,
-0x47509cab,	0xf40f9ba6,	0x34efbe6c,	0x1fe3b873,
-0xfb39bd58,	0xa50b6367,	0x66c20e63,	0x49a4e1ee,
-0xe490ed5a,	0x98c340fa,	0x30bfe19d,	0x4c17d142,
-0xea54c4e2,	0x8c00e086,	0x219dee1b,	0x739a2fc1,
-0x1e07b80f,	0xea6f4799,	0xb4684fc2,	0x42fc725a,
-0x1d3c7413,	0x188b6f3c,	0x2c0e440f,	0xc6ad011d,
-0x2048625b,	0x3be9d940,	0x0a932622,	0x1fafce30,
-0x1cfa4c90,	0xd0e9f989,	0x31c0c399,	0xad0c597d,
-0x48a94bb5,	0x109da683,	0xcdc197aa,	0x7bf7ef14,
-0xebf3afa0,	0xde4ff7d3,	0x02a79e3f,	0x4d77f0e5,
-0xd0c1fd98,	0xdb342a5b,	0x7f753eca,	0xb710c135,
-0xacb3b9c0,	0x5e89ece7,	0x2ca4fe84,	0x4f22e461,
-0xa6a633fb,	0x508fb453,	0xfe1f342d,	0x79bcff1f,
-0x0c776771,	0xd6c5db47,	0xfe4d8cc5,	0x68b9f655,
-0x447b7366,	0xddde31ad,	0x8e3496df,	0xe091f8dd,
-0x78eb0fe2,	0x9e08c72d,	0x6909c46b,	0x92ca6b4a,
-0xfb7a0efb,	0x55f65148,	0x9fcc90e1,	0x254f5f40,
-0x0690dcd5,	0xc6a67013,	0xda2e35a9,	0x9171cb50,
-0xe477a087,	0xc0f89e14,	0xc1221ebf,	0xf032e99f,
-0xc8883a7e,	0xba4b17c9,	0xb0ef0962,	0x6ea751f6,
-0xfc8c336c,	0xd1966bf1,	0x26d57e1d,	0x952e847d,
-0xccdaf0c9,	0xd0aaee65,	0xb2f22a59,	0xc74bc035,
-0x900ef42a,	0xeb1e7bfe,	0xfc465b3a,	0x0cd002ce,
-0x560f5d4b,	0xecbc2658,	0x9f38856a,	0xa3f77ba1,
-0x3ee18273,	0x7ab97b2c,	0x0f5843cc,	0xdb648b0a,
-0x8e450381,	0x80176891,	0x05e3e6d2,	0x36593afe,
-0xebe78fce,	0x53d7f64c,	0x2dde1104,	0x293cd7e2,
-0x4f430fa6,	0xf3a8cdb0,	0xd28f6535,	0x9159d53b,
-0xac66a916,	0x8f77be38,	0xa16b9dad,	0x1a4699d0,
-0xe278df12,	0x2c336789,	0xb668fe15,	0x099fa98c,
-0x4fe5ef10,	0xf4692cda,	0xb86d4040,	0xb6dce0eb,
-0x6c5ef896,	0xdef35c52,	0xc02a04a4,	0xed99c619,
-0xd91721b2,	0xa2fac92a,	0x5ab9c724,	0x0ee25329,
-0xc2029fce,	0xc847bfbd,	0x3b97ddcb,	0x4aaaa55a,
-0xa16e313a,	0x06e4b6cc,	0xc0e56598,	0x60ebfadb,
-0x88841f3a,	0x7c6b65ef,	0x15542ce1,	0x70b88b78,
-0x382d1155,	0xe73c900c,	0xd8b6409e,	0xf1cc5406,
-0x64fc3223,	0x43cb616c,	0x17e3a1ac,	0xa9aba529,
-0x8dd83b32,	0xb625cd1d,	0xbcb4b0ed,	0x685cc4b2,
-0x803e35f8,	0x4e679481,	0xc7dd7591,	0xf8676b62,
-0xac25b6c8,	0xb0211931,	0x5c5df337,	0x3bde6fb6,
-0xbc433992,	0xf7315d49,	0x028e112f,	0xe3d59076,
-0x7757e95b,	0xe5c5a193,	0x59b243a0,	0x341f33d2,
-0x7c0d591d,	0x5f96d138,	0x5116c490,	0x747caf2f,
-0x6da223f1,	0xcbe30d11,	0xe10b6b28,	0xa09328e1,
-0xdf1b94ee,	0x163b48b9,	0x72e7a36a,	0x78eda572,
-0x393f0ad2,	0xf85561ea,	0x6e7ca7c8,	0x352cb3b4,
-0xb75bf9f3,	0x97ebcf76,	0x932b8b91,	0x937f1fab,
-0x6ef1e868,	0xce84fc3a,	0x9dd09a21,	0xa8f3be36,
-0x244834e9,	0xd871f223,	0xdef842f3,	0x787eaf73,
-0xf2326bca,	0xd2c3ae20,	0x48dc7621,	0x91419afe,
-0x23a44b12,	0xce0443d7,	0x4a6f1d9f,	0x1ea8cf7a,
-0xb6b7694d,	0xf29e3e25,	0x51665303,	0x33581b86,
-0xc762d72f,	0xaa658158,	0xcddb7354,	0xdacfd75f,
-0x9ec31b1c,	0xf8aa3154,	0xfdeeb2e0,	0x9cb52f84,
-0x16ce9fa4,	0x25050178,	0x2ef25d50,	0xcf4b4d41,
-0xf27d5684,	0x7bae3f36,	0x05b50e59,	0x91d23add,
-0xdbdee4ac,	0xe16994b5,	0x0a5481c3,	0x3deb8a17,
-0xb8844d77,	0xcbce6140,	0xbd748572,	0x6531627f,
-0x2137be68,	0xf46f8aa9,	0x6d2526a0,	0xe72aa307,
-0xb361a2c8,	0xed9c2987,	0x75ddeb95,	0x637d3cad,
-0x2c4dfd37,	0x01f0e2bd,	0xa521a1a4,	0x1194ab8a,
-0x96d7b9c2,	0x94cee6e5,	0x454cc836,	0xa5c0fac3,
-0xf6e9fe9b,	0x3107c251,	0x14c8c6a6,	0xd727c1e1,
-0x339f2742,	0xb0a033de,	0x56fc9280,	0x36a907cd,
-0xb74acdde,	0xe8122571,	0xd0116007,	0x238b3d4f,
-0x34532ebe,	0x1c534370,	0xd1eb258d,	0x354b2289,
-0x6007a18c,	0x58dcee7f,	0xa033ee94,	0xa5e1145f,
-0xe345c315,	0x58510592,	0x33d9db2b,	0x7ea86edf,
-0xce60a8ad,	0x2d9a8919,	0xb5e2840e,	0x020e6e15,
-0xaff8660e,	0x402c12da,	0xfaea95a5,	0x6ffb0748,
-0xc4c730a4,	0x1f57ead7,	0x2cc6d295,	0x0ef4bdb6,
-0x01a7368a,	0x52e88f43,	0xf1b14c65,	0x38018686,
-0x0c70ee45,	0x271b1fe2,	0x0eea950e,	0x61a6f56a,
-0x842497a5,	0xfbcf0f4a,	0x35132cbb,	0x4f2eb1ce,
-0x24fb1bc7,	0x343ec960,	0xda94e0a2,	0xf1206e0b,
-0x80bf8007,	0x7e09d8d8,	0xba6bc1ff,	0x892c956c,
-0x4ceaa5e8,	0x871f3358,	0xe802a1a4,	0x7fa29ced,
-0xea8616cb,	0xc1999088,	0xc5baf089,	0xd1490754,
-0x091f6f21,	0x9a3e3c4f,	0x1eb11650,	0x13fd05fc,
-0x5e9d5b0e,	0xd1485d34,	0x474feaae,	0xc211a60f,
-0xa609643e,	0x07052bb2,	0xa7bfb285,	0x30bbc170,
-0x9ebe8d27,	0x5207a9ee,	0xfc12bd0e,	0x7fa428af,
-0x2d1c8a2d,	0x6f15c0d6,	0xdaf0ee75,	0xd32bb1d1,
-0x694463f5,	0xa1ebdae4,	0xeaa3d0b2,	0x954077de,
-0x181da0bb,	0x4556808d,	0x46e80a64,	0x0c017172,
-0xd8ef8702,	0xa0e6d100,	0x90b0a9f0,	0x4a13a407,
-0xf1675dde,	0x5110d8c8,	0x1c028526,	0x7774581f,
-0x9d3d8c23,	0xcaf8b632,	0xf401a52f,	0xa5d14a5c,
-0xebed6c1b,	0x2ec618ad,	0x5b63935e,	0x89508732,
-0x43a48b2e,	0x87535b2b,	0x0ffb28c2,	0x1fd1becd,
-0xd2b2a18d,	0x45dccb4c,	0xad41a54b,	0x7ffa2fed,
-0xddd18aa1,	0x1db06a98,	0x860d6b58,	0x2997109e,
-0x80a2300e,	0x0cc52e7a,	0x15b24c31,	0x8f717016,
-0xa425cac3,	0x8153e1bf,	0x5e91fd89,	0x04b17f35,
-0x150fd30c,	0xc7309d31,	0x63dce1b0,	0x162eb854,
-0x8093904e,	0xf7b4399d,	0xb23fa735,	0x67509c6c,
-0x5380dec9,	0xb79172a8,	0xb6c249d1,	0xcd040b42,
-0x4efe12f8,	0x63ce3363,	0x406d1666,	0xf8e9bc95,
-0x99cbff2c,	0xaf0cac38,	0xe6556ddf,	0x9bb2a399,
-0x43387c9e,	0x4951f5ac,	0xfa4ddb69,	0x562ec852,
-0xa2e3e441,	0x32a80b75,	0xd88361c5,	0xf04b7ac9,
-0xb0ea18bb,	0xf5035c94,	0x520c9c12,	0xb4c7e15c,
-0x6f72c4bc,	0x80f2112a,	0x4e4bbb87,	0x7bb5ee1f,
-0x54eb313e,	0x18cb6cb9,	0xca5ff580,	0x2538d798,
-0x2b813681,	0x58c11a6c,	0x68ae4070,	0x40799341,
-0xa740f86a,	0x722ca7ef,	0x815c71c7,	0xe663c6f7,
-0x5e249b96,	0xe97e3b71,	0xb7ee5a12,	0xd5f065bd,
-0xaa642191,	0x9864e095,	0x0c087780,	0x0fc0d969,
-0xf6b82791,	0x04aa55f8,	0x872c7cd1,	0x43bc93b0,
-0x12fe4c05,	0x16f15229,	0x06161603,	0x6e76239d,
-0x90ea9c62,	0xecf642df,	0xb52a8db6,	0x2e0c5d58,
-0x10f09bbc,	0x1bb1b2a3,	0x7132167b,	0x291d5f16,
-0xd7814a9e,	0x79e52dbf,	0xef6b61e8,	0x585b920a,
-0x18ea4e61,	0x72ce62fc,	0x59ed8e9f,	0x610564d3,
-0x40f4f145,	0x0a2f60c1,	0xec64ebc3,	0x8ad5b251,
-0xb471e120,	0xb899cffd,	0x2b81118a,	0xa3b591a8,
-0xdeced3ab,	0xcb9aacb8,	0xba53fbdd,	0x6e49e298,
-0x75fa6c19,	0xd11cfe98,	0xd29ce7fc,	0x7471df09,
-0xb59b2474,	0xdff0b07d,	0xae92c4b7,	0x6414ee6b,
-0x6acba1a5,	0xed9c0b5b,	0x728f7644,	0xf6d20c7a,
-0xf03ad03e,	0x6612b0c3,	0xe156c417,	0x9aec4a8d,
-0x02be86ff,	0xe11d1660,	0xefeba14a,	0x7d275f33,
-0x16acabb2,	0x7ac99cd7,	0xd18566e4,	0x3bce4ca1,
-0xb0312f16,	0x5700f72c,	0x345864bd,	0x917a4db2,
-0xaa22b7f0,	0xc66eb69c,	0x62f8a99e,	0x6364a44f,
-0x956d2cd2,	0xfa64b7df,	0x47238b18,	0xddebaeff,
-0x39c9d16b,	0xaa1487cb,	0xc6f91d13,	0x8191316d,
-0xbf5d7ddd,	0xc907cbb1,	0x7a283ba3,	0x0365e6a3,
-0x2fbb3185,	0x159d0436,	0xb55b6990,	0xf0935005,
-0x441e4fc8,	0xd1dfdc91,	0xdd9ff8bc,	0x95c88203,
-0xa8029310,	0x62501ff4,	0xf838a813,	0xfb66d5ce,
-0xe6bb8354,	0xe2afb832,	0x55dcf796,	0x315f28cf,
-0x400de577,	0x3ad89b1b,	0xeee943aa,	0xbd5d9001,
-0x8dd4771b,	0x21ad481c,	0x504d6222,	0xfc0e6728,
-0x7abe5d62,	0x332f8309,	0x50d8c688,	0x4b686808,
-0xbe6395ec,	0x5153b67c,	0x04144a35,	0xa85077ca,
-0xa3775cda,	0x838556dc,	0x973c2222,	0xf5037c9f,
-0xd02b0c87,	0xa3e69f8f,	0xdf68cce7,	0x9490d31f,
-0x3d9c5cf2,	0x939e7823,	0xc51b9a2d,	0x2e802e27,
-0x65079a36,	0x3b6e3d79,	0x5fafbac6,	0x9973bc64,
-0xfc4e7124,	0x56e1fad3,	0x10ec049f,	0xefa79c0b,
-0xcde48353,	0x3fa7f449,	0x07cb1a31,	0xf6ba0053,
-0xe5af7b10,	0x9e2dc089,	0x290f3fa4,	0x116da472,
-0x7a006f5b,	0x727205bf,	0x7c59870d,	0x968c6000,
-0x3ed4fd57,	0xe423effe,	0xc352ef7a,	0xd23d00e5,
-0xbded3a50,	0xedcdc3d0,	0x3a517a74,	0xbdfc58cc,
-0x24b2371f,	0xf967f533,	0x26069547,	0x2114e85e,
-0xa1953f56,	0xf0c52ebf,	0x235320ae,	0x35600f33,
-0x5c1ca2b7,	0xe89db0da,	0x08ce35aa,	0xc66cef79,
-0xacd41ce4,	0x865f4c69,	0x15a3376b,	0xdee5d7a1,
-0x6fdd6362,	0xa4125977,	0xcb61bae2,	0x5e3da819,
-0xc6d2e56a,	0xde1807f2,	0xb30c3473,	0x1c4038c5,
-0xbf8afac6,	0x37423d2d,	0x72d9da33,	0x39e95bf5,
-0xd6a91cc8,	0xbbf4c2d8,	0x7c9d4b21,	0x13c514d5,
-0xcae41aac,	0x07b97f18,	0x0cdfbdee,	0xe7a9020b,
-0x1839f082,	0x7c414530,	0x43ba1070,	0x95945971,
-0x82e31721,	0x2fb159e5,	0x225c2158,	0xfadf74f6,
-0x788387d6,	0xb40c98fe,	0x0c75ba9d,	0x0487eb2f,
-0x7e9a1b0e,	0x5c442185,	0xcf1dffde,	0x39f9bc44,
-0x46b961d3,	0x9a14b19a,	0xe284d2ac,	0x52151caa,
-0x67f34f5e,	0xf4042d4f,	0xa28a223d,	0x3deb23f1,
-0x12d14b6f,	0x18901f31,	0xb3c7950a,	0xfb7d3557,
-0xb83e457f,	0xb6e13f07,	0xd26f5435,	0x83f05e15,
-0xf549a030,	0x6d1122d0,	0x540b3ef9,	0x8ecdac22,
-0xdabe1b2d,	0xf4913cc0,	0x579f9d77,	0xd4725d33,
-0x76b7abb0,	0x03452691,	0x4d52fff6,	0x12e95a96,
-0x42131074,	0xbb3eaa95,	0xb775618e,	0x6325764e,
-0xeb847c5a,	0xeb7b9c6d,	0xd01dd328,	0x547269e1,
-0x2cebecd3,	0xcbb0ed0f,	0xcc87e62c,	0x8e6b0ce0,
-0x8a8f9f06,	0x689e0c4f,	0xb3a1fe5a,	0xed84a0a2,
-0x66187741,	0x62a4475b,	0x5c4c31bb,	0xea000d76,
-0x8676c757,	0xd59cc6bd,	0x52f107ff,	0x1f4a0c66,
-0x7af566ef,	0x4af3586c,	0x11d5cd6f,	0x6b8bc81a,
-0x480eed48,	0x2ec7c65e,	0x6c0f3253,	0x100f2794,
-0x18d6c62a,	0x338f59f6,	0x8e6e2f9e,	0x75fccfd7,
-0xbc80ea7a,	0xa90f1473,	0xfa9d22c4,	0x3ccdaa53,
-0xe568fef6,	0x6a761fd4,	0x61c26b23,	0xabc31163,
-0x3b840e9e,	0xee864319,	0x84f93208,	0x743a780e,
-0x1507a3bf,	0x147dad13,	0x8952177f,	0xbeb40da7,
-0x699af39e,	0x6d22bdfb,	0x5fe8112c,	0xdb3f8dbb,
-0x026f8ff2,	0x6bf9658d,	0x9faabf0d,	0x6a2f3989,
-0x5be4a617,	0x9e55f0c3,	0x70510d75,	0x0fd92413,
-0x63d1d3c7,	0x68cf84bd,	0xbbff5901,	0xb0434b77,
-0x8564b88f,	0x06eddac5,	0xde2a66b6,	0xc1835355,
-0x5566bb1e,	0xbaa890cd,	0x108c6f70,	0x7e80dfcc,
-0xb8c03bb3,	0x14bdcbe0,	0x5037daf9,	0xee02697a,
-0x3326280f,	0x4f04c814,	0x4f640444,	0xbfa9229e,
-0x131c7ba0,	0x5fbcf1ba,	0xebe01998,	0x2a813a9b,
-0x3f27c028,	0xf77a6d00,	0xac0ddee5,	0x1b6e52d9,
-0xdac4bb99,	0x54a32f86,	0x26bfd80f,	0xf5debd9c,
-0x06536e13,	0x9498a87e,	0x3f9e8812,	0x53e0fdee,
-0xc08c3c8a,	0x2148b33c,	0x3932e37b,	0xad084cc7,
-0xe77a0048,	0x89addf10,	0xb2542186,	0xc4c0be6c,
-0xfbc626ce,	0x20a28446,	0x0f29f8f1,	0xbbef5d50,
-0x288b8070,	0x31aa2900,	0x4a538fbe,	0xcd344ca3,
-0x05170c9d,	0x06c51082,	0xc414194a,	0x6689a2cb,
-0x7618c884,	0x412ac324,	0xb0d952d0,	0xfb88757c,
-0xaacbb987,	0x92218ac5,	0x032a3895,	0x2e3a7dfd,
-0x4bb37e4e,	0x52342695,	0xa699f5b9,	0x45748066,
-0x7822f59e,	0x68a55092,	0xf049444b,	0xf274d694,
-0x0524ed76,	0x884c3732,	0x22fa43bb,	0x3b97d921,
-0x210b8c99,	0xc4ffdf26,	0x17ba16ed,	0xfcdfc437,
-0x0b8e2d8a,	0x7b019bb2,	0xd525e662,	0x03346249,
-0x7af3c1cd,	0xbf42dbac,	0xb6197a31,	0xebff8e32,
-0x84f9980c,	0xa225a4b0,	0xa9f3d94d,	0x8a3da052,
-0xc17241e7,	0xf133ce7f,	0x4d4542f0,	0xd884f2f8,
-0xa1633ebe,	0xd5c5e6e5,	0x7fce2fca,	0x8ad84a55,
-0xfdd96c9f,	0xa60d6f4f,	0xe025d2f2,	0x8be1b787,
-0x87a036a7,	0x23819cb9,	0x5967650e,	0x5d549108,
-0x57167175,	0x2f94c450,	0xbb536b04,	0xfb381d15,
-0x405bd359,	0x3ef9491b,	0xa9834cb1,	0x2cc5151c,
-0x148cd3cd,	0x0565ecb0,	0x8e596741,	0xf6d7f089,
-0x9e3524fe,	0xf4224e20,	0x583302fa,	0xebe46409,
-0x7bfe793a,	0x7d511902,	0x1e4a80dd,	0x53a280cb,
-0xa2d81d96,	0xe29b8f4e,	0x877789e5,	0x838ee539,
-0x35f9feb5,	0xa5bb1d43,	0xb24d7510,	0x67cd14d7,
-0x7cfac97e,	0xf6c72b9b,	0x302f9115,	0x1932060c,
-0x0a786f90,	0x85a88dd1,	0x322ef274,	0xb0f8af47,
-0xbb5e6bfb,	0x3f1505c5,	0x33b28086,	0x18025326,
-0x73293fb1,	0xbd813762,	0xad751414,	0xd533bccc,
-0x393b81fe,	0x5b3b79e3,	0x2221dc65,	0x4bf8124d,
-0x26df557e,	0xcb9320a3,	0x9e6e762f,	0x2a800bbf,
-0xbd30558c,	0xc6b2ebe7,	0x204b2c78,	0x3e55767c,
-0xe8dca1c3,	0x446eb4c6,	0xef6f4340,	0x5cbff9c3,
-0x37b0e9b2,	0xfb10c3d7,	0xed36aaa5,	0x11615dc6,
-0xad7d716d,	0xc1d500c4,	0x5a54754c,	0x0bd36bec,
-0x7d297712,	0xb1ae2dce,	0x2a2cb835,	0x89acaba0,
-0x936cff34,	0x8f04dc53,	0xfe5f02a8,	0x4b83f193,
-0x123c3f6d,	0x25dcdb3a,	0xeba9fe98,	0xe4b73b30,
-0x2c768429,	0x4029f674,	0x74815612,	0xb43e7b02,
-0x9eb984cc,	0x4c5de913,	0x80ff07f5,	0xc20ed71a,
-0x3b7bbbd5,	0xcf4c1a66,	0xc2e66533,	0xd60d0142,
-0xdbd557b4,	0x29fe5598,	0x43cbdeb8,	0x1e875827,
-0x09b83824,	0x1114224b,	0xd29b9b51,	0xa5a2673f,
-0xe3542aa0,	0x50c3bb9f,	0xa5257bb5,	0xa6542299,
-0x0b0f37d1,	0x1da0da31,	0xc959c1e8,	0x8abbe257,
-0xf234527d,	0x3fac9c67,	0xf1580042,	0xfef8a8f9,
-0x704d17e3,	0xda6dcfa4,	0xbc8f4334,	0x0cdba65a,
-0x63c9900f,	0x7201b3d0,	0xdf71982b,	0xa604304c,
-0x0c5cfc01,	0x125b0999,	0x729d22a3,	0x5b5090f6,
-0xea4abe44,	0x2b41d30b,	0x416adfb2,	0x41aa11b5,
-0x317049c4,	0xc8aea4d1,	0x273f074a,	0x2d9790a1,
-0x49d9c17f,	0x4c98bdb2,	0x6a17a963,	0x8027b597,
-0x6b1f92f2,	0xb44b50b2,	0x8831b439,	0xb90b82da,
-0x1af3d3c7,	0xc0f28557,	0x1dc0fff2,	0xe3048416,
-0x3a778ab0,	0x0fdea888,	0x5f0b4ac4,	0xb8f045f6,
-0x596249f4,	0x4ca0df7c,	0x22753ff4,	0x13220710,
-0x3900a19c,	0x2c316538,	0x9d3fb2c0,	0xc5c8ba47,
-0xc497edbf,	0xcd8bf202,	0xc50b2595,	0x9a9c7984,
-0x47b9e4dc,	0x718e6363,	0xbf6384a8,	0x79086ec1,
-0x568708ca,	0x39081202,	0xe7ddaa3b,	0x218c006d,
-0xaf01bc1c,	0xbd3479fd,	0xbc9cd1bf,	0x1a15b508,
-0x55e13c96,	0xe429f11b,	0x70358e12,	0x8a86c907,
-0x547d227c,	0x47de1d53,	0xf74a260d,	0xd19ed8ed,
-0xc8db4368,	0xe3c6b52f,	0x27686993,	0x8c0b4888,
-0x6be7f66c,	0x8261ca74,	0xe3dc2066,	0xa04b3762,
-0x4d59b620,	0x90f37689,	0x64ae22f5,	0xa3b0d945,
-0x47dffc7c,	0x9566371e,	0x5ae2fc4e,	0x95aff0da,
-0x9b8ef2fe,	0x7f22a07e,	0x14aea38b,	0x802ff150,
-0x2fa43117,	0x71244211,	0xcb5169ce,	0x04acf312,
-0x381c4155,	0x70d3b079,	0xf3b2a91b,	0x3f422e76,
-0x5ec10535,	0x9a409fd0,	0xc1f50f47,	0xb209165a,
-0x1a934e37,	0x17dacf73,	0x0fa18f20,	0x1c4d73c0,
-0x93bd21f5,	0x20be3fd6,	0x7b201124,	0x3a7b0a3e,
-0x4d7d1e04,	0xae32c1e0,	0xe699ebee,	0x6cee5458,
-0xd2ab4f2d,	0x6df96639,	0x7381fb8a,	0x2ce7cdaa,
-0xccc88ef4,	0xb46daa0e,	0xb750ddee,	0x084f07df,
-0x40bd18e5,	0xd6c275bf,	0x2d4269ec,	0x96136e73,
-0x27b4888f,	0x62b318ed,	0xd81ae496,	0x76542431,
-0x3dc0cfc7,	0x1e896661,	0x9e41c898,	0xfa8fcc61,
-0xab27f408,	0x9951e94a,	0x29b12179,	0x839b58ab,
-0x2097807d,	0x5892e43f,	0xfc958c32,	0xfc0b1b97,
-0x198699a2,	0x5de96181,	0xfa9bdd34,	0x175666bf,
-0x3b9f7dff,	0xd4541302,	0xde363b1b,	0x26eae277,
-0x34ecfee8,	0x32271791,	0xf0682c51,	0x67e9941d,
-0x0e131acb,	0x01d3f1b5,	0xe0e2a4c9,	0xa5422eea,
-0xa0ee61eb,	0xd11413aa,	0xcb789019,	0xeb72d232,
-0xc7532d1d,	0x7b225aff,	0x4f33a319,	0xd419bf2c,
-0xe0bced66,	0x1ffaad31,	0x1a9b6f56,	0xa116d71f,
-0x8136fa06,	0x9fea9de5,	0x77e8c17d,	0xf804d9f2,
-0x76ca41d3,	0x5fdb9e1b,	0x334b4302,	0x90236425,
-0xd6392379,	0x7015aadd,	0xac662630,	0x8e16920f,
-0x6ad76f6f,	0xec7bc8da,	0x03af52ec,	0x9a09f57b,
-0xb8b2354b,	0x9278d172,	0x1b66194c,	0xf61f317f,
-/*  1624-m206e839.inc  */
-0x00000001,	0x00000039,	0x11152005,	0x000006e8,
-0x00e9d6a3,	0x00000001,	0x00000020,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0xc9226026,	0x31d04cc5,	0xeb5e9216,	0x81b9b739,
-0xb8187c4d,	0xdb2db5c8,	0xac304dd3,	0x56259185,
-0x5cee9dfc,	0xc4c708fc,	0xfbfebb15,	0x4657a346,
-0xd5fdfc56,	0x49ccc684,	0xfe2f1980,	0x23e44e95,
-0xaf7e0890,	0x0a306ae9,	0x0533035c,	0xf747f6c4,
-0xbb7a6356,	0x07415037,	0xb9cd0d46,	0x4dc69422,
-0x19ed8dba,	0x61955793,	0x2c69260d,	0x0e23b80f,
-0xce2c111e,	0x94c5acb3,	0xf2050f28,	0xc4348718,
-0x4496d9b0,	0xec1eb627,	0x8f6d3916,	0xa67909c6,
-0x37bdb9ce,	0x4d7393bc,	0x9b7027a4,	0xc1bfa4b4,
-0x671fb655,	0x447f72ea,	0xf96b0311,	0xbfa5989d,
-0xffa59b41,	0x4af95bb9,	0xeebc0d4e,	0xce0d8017,
-0xad35c182,	0x9fa068f0,	0xcdafa471,	0x5459e6da,
-0x9bb88256,	0xc593800c,	0x327a1e3f,	0x714bfb6f,
-0x8b02e7cd,	0x16020ebb,	0xb0598f84,	0xd021f373,
-0x07d55d88,	0x90774676,	0x6cd1f7ca,	0x99e1bfa7,
-0x3c67877c,	0xdbd380ab,	0x5eb38db2,	0xe0edbfd0,
-0xc5534984,	0x411b21df,	0x16771220,	0x4a8a60f1,
-0xd80ab95f,	0x93090a73,	0x12135fa7,	0xbf0fde89,
-0x50cb4bc6,	0x508ea81f,	0x8f567bbc,	0xecd02b7f,
-0x2b0ceb7b,	0x6fe0367e,	0xce928c01,	0x69589c6f,
-0x0c28f0f7,	0xd9ac3fa8,	0xd6a23e1d,	0x19613ebb,
-0xe455b950,	0xa58b7cf7,	0xeeab2947,	0x1e588aa8,
-0xbb634862,	0x5b6421b2,	0x6297ae0b,	0xbf63b1e9,
-0x530e7f14,	0x5c2c0f79,	0x9cdeebc4,	0xf6d7037e,
-0xbd4ed6d2,	0xd15f0af2,	0xace5591e,	0xa028a00d,
-0x48032c56,	0x67f890ea,	0xbb51ac52,	0x5827bad0,
-0x4b402353,	0xba6c615e,	0xfd5cec66,	0xcfb3d0f8,
-0x57c54520,	0xcfd5fc18,	0x10d35922,	0xcfd3e6c3,
-0xfe68e046,	0x3dc77d26,	0xe9f78a74,	0xa140eb55,
-0x08dd3509,	0xc6defaaa,	0x73febfe9,	0x0b79e780,
-0x73f35b7a,	0x7e9701ec,	0xeeb571a8,	0xed545d8a,
-0x1ecab16f,	0x4d2cdf06,	0x0f8d5bdd,	0xc8d515bd,
-0x2b240de4,	0xda882958,	0x6612e8e7,	0x9bea8737,
-0xf8c88eae,	0x7f6d9fa1,	0xdd249b1a,	0x07541510,
-0xaac8a29b,	0x25d07e85,	0xe9f0f581,	0x3f3c089a,
-0x90d4b3fe,	0x529d1042,	0x1e0bc5d3,	0xacbc4634,
-0xacdf6376,	0x759f6e7a,	0x614eb519,	0xf97894f9,
-0x69e18e24,	0x445adfa4,	0x6fc71d78,	0xb2bd1312,
-0x270e3a49,	0xdf22e530,	0x96d6bfab,	0x2d8153c4,
-0xe487add3,	0x0461fbe4,	0x6179e23b,	0x22bf0ad7,
-0xa527347c,	0xee772c22,	0x94c1c04b,	0x9cff8528,
-0x52f17360,	0x1a381a4f,	0xde59c8b1,	0x5ad6ddd1,
-0x01440596,	0xfb7ca9db,	0xf1b1c83b,	0xe4983438,
-0xdb246883,	0x1044db5d,	0x5e4a560e,	0x8312d13a,
-0x5db5e546,	0xfcf1485e,	0x6a95f22e,	0xebdf4063,
-0xa9e47fe7,	0xff203e14,	0x3e8c08fa,	0xbfdedef2,
-0x380c9a4b,	0xaf19c9c6,	0x75005e66,	0xff492ec9,
-0x28b8e6d0,	0x9cd69fe5,	0x839353d7,	0x8d4df3f1,
-0x38a4f7a0,	0xd5af72ad,	0x7e7ba9b6,	0x9a2c2f5a,
-0xe141e11c,	0x54101bf0,	0x6bd34fba,	0x2aeebd40,
-0xf3c6a02a,	0xfb45a6ea,	0x5f6cc3f9,	0x7d19ace6,
-0xc4e50923,	0xb77d6c3b,	0x28d21508,	0xa68dbda2,
-0x53519ded,	0x7d38215b,	0x6554c1d0,	0xceade8a5,
-0x861dbd69,	0x327694d4,	0x2284cab7,	0x79b7a4a9,
-0x2cb4e91d,	0xe91b5ee1,	0xa886aceb,	0x586f2b2d,
-0x586384c3,	0xed4a41fb,	0xe95f483c,	0x2bc37c1e,
-0xed66debc,	0xc081cc22,	0x13b62693,	0x1f739d44,
-0xb5c64b95,	0x8a6c382b,	0xe372637e,	0x4024aa2b,
-0x6d0cff83,	0x8b23bd82,	0x13251589,	0x9243024c,
-0x452e1d68,	0x22ee9797,	0xc02673e4,	0x8b9a7d37,
-0xa76d6538,	0xa92d6786,	0xa7cfc9a0,	0xa44beca4,
-0x31eb7699,	0xeb54ddc7,	0xa2fe7da1,	0x0ee15251,
-0x614235df,	0xe9cfedbe,	0x892a4e69,	0x9da98557,
-0x335b3fdf,	0x8ea201e5,	0x0946feb6,	0xb5a786df,
-0x022cc831,	0xab624815,	0xbc424527,	0x735f92de,
-0x9936cecb,	0x0e761edf,	0x0090693e,	0xc4a0499a,
-0x6b23228b,	0x1eb11bb0,	0xfa0e532f,	0xf3908bd4,
-0x6d12934f,	0xb0af2c23,	0x8ee4af5c,	0xdc901aa7,
-0x0354b0bf,	0xd130aaa9,	0xcdd548cf,	0x63c30fa9,
-0x2ce21b9d,	0xd28af5fd,	0xd0dd7223,	0xf8037eb4,
-0x475e5121,	0x4da06882,	0x5b5f6d0f,	0x2010ee60,
-0x6b70b26e,	0x34046d99,	0x60d17b52,	0x0ceb5995,
-0xfe843bb5,	0x32bd202f,	0xd253d64e,	0xafbbc103,
-0xfe550a5c,	0xadc17fca,	0xd50e62ac,	0x04aac0c1,
-0xfdc53287,	0x2ca779e0,	0x50d3509c,	0xc6642217,
-0x15a4a216,	0x792dc831,	0x28aaeb0e,	0xd90a51b1,
-0x4aafd019,	0x7120d967,	0x600cc53d,	0xcce4712a,
-0xa51c84bc,	0xa446aea8,	0x2d0434df,	0x7cc7e1bb,
-0xc58d985e,	0x975fd3b5,	0xeabd457e,	0x63019a78,
-0x07dd4acb,	0xf5d1b481,	0x271b33e9,	0x74e6b893,
-0xe1660e8d,	0x3b3857c1,	0xae2228b4,	0xe8971978,
-0xa5e9d620,	0xc42ce628,	0x8a723c90,	0xe1cbd643,
-0xd6b31dd6,	0x10ac4693,	0x30d07574,	0x2ceb736c,
-0xc4534cfb,	0xb1576d35,	0xb7452467,	0x83d90ec1,
-0x136647f4,	0xee1225f9,	0xb018b3ab,	0xe40e1466,
-0x6c39168a,	0x209e1e98,	0x467a80da,	0x39895b4d,
-0x9830701a,	0x08bb3694,	0x944d4ca5,	0x1b345056,
-0xfcd65853,	0x02dd7e3e,	0x8c3fe8ad,	0x4a250b9f,
-0x88f396e9,	0x1c7e6763,	0x8d63d571,	0x46bc5836,
-0x3495194f,	0x612a5504,	0xa3c960aa,	0x206508d5,
-0x0e742fa5,	0x962dc01a,	0xd7c6ae91,	0x7c60637a,
-0x4dd751b0,	0xe9ec6585,	0x7a6a9d8e,	0x97cc23b2,
-0x17c7cd98,	0x6bd0197e,	0x825caffd,	0x1b682617,
-0xb7a146df,	0x6cd43071,	0x46a325ef,	0x606c23cd,
-0xf391543b,	0x0c1273e7,	0xb14311ad,	0xa56c20d6,
-0x4f2b1f6b,	0x027fdd15,	0x153e5b84,	0x230ef754,
-0xddc5231c,	0x27009a47,	0x6a1af01f,	0x3eb1712f,
-0xdd5b0538,	0x1bdd1a17,	0x94a692ee,	0x6569ea36,
-0xbbed3e8c,	0x44be3a3a,	0x322e23fc,	0xb620d922,
-0xb0e4364b,	0xa6e9a5c9,	0x74ade8ba,	0xb619ba36,
-0x1ab260b7,	0x49d93617,	0xf34f51e0,	0x86c922f8,
-0x8b62ae4c,	0x4c5d191b,	0x8af345d3,	0x7dabf68a,
-0x50630f7d,	0x9367968d,	0x9dd2ec02,	0xcbbc9de9,
-0x96ff6002,	0x22557f00,	0xdcb11cef,	0x9a433696,
-0xdafd17fe,	0x4a4f2367,	0xcf03a80a,	0x07f1af6a,
-0xd17f5c02,	0x69d50343,	0x64e5f0ee,	0x1e8f8795,
-0xacb3be79,	0xec758d66,	0x972b429b,	0x70847a5e,
-0x26917ebb,	0x120198ea,	0x9fbc891b,	0x6024a8b3,
-0x21f187be,	0x5fc97d12,	0x8f40dd2b,	0xed5099af,
-0xba1c30f8,	0x42856fe4,	0x4ff70143,	0x3381128d,
-0x68074f27,	0xda4e4f40,	0x92355570,	0x87d9fc1b,
-0x79ba00f8,	0x80188b0a,	0x54d6c99e,	0x0c291886,
-0xae1ba6d8,	0xe1db6d71,	0x812eb8d5,	0xfe443861,
-0x4697dfe3,	0x07e2c123,	0xef211237,	0xe39cf56d,
-0x0dfe17fa,	0xea6030a6,	0xbaf85b2f,	0xb1fb1e75,
-0xb78b8e9d,	0x93d9d1bd,	0x6865386a,	0x85797883,
-0xa4136a38,	0x4c0ab699,	0x0647103e,	0x678defd1,
-0xf54ffe6f,	0x38042e86,	0xc936e167,	0x7e8be786,
-0x37a7a21e,	0x47af9dbd,	0xe223ff47,	0x67a5b932,
-0x8b5ec113,	0x4409c381,	0x17f02fc9,	0x4a2fc757,
-0x076c4f09,	0xafaad84b,	0x280e8dc1,	0x739ed578,
-0x49303f92,	0xe3ad06ce,	0xd6f2cc2b,	0x8c6178a7,
-0x7dd611bc,	0x3ef0622a,	0x7b5624c2,	0xc0d3ab3d,
-0x0886901c,	0xd50b755b,	0x9e5fff5b,	0x6defbd36,
-0x6eb81d52,	0xa83ed60b,	0x5a592ac7,	0xc7106e42,
-0x26c4d503,	0x01e85a02,	0xe5794f2a,	0xe59d8e11,
-0x642424e0,	0xeb729831,	0x2f7c579b,	0x9420638f,
-0x8b262c13,	0x5cbbc0a0,	0x1acd3e84,	0xf4fce699,
-0x5d87578c,	0x7e050318,	0x780e3acb,	0x8285e06a,
-0xbe10054d,	0xd1123dbf,	0x0d19268f,	0x9abdf2da,
-0xb8d42fec,	0xe7cd5df7,	0xd42255a4,	0x21cdd93d,
-0xf4613998,	0xc1f0cbb9,	0x21dac2e1,	0x8e14ad43,
-0xa89284ca,	0xf78bc18f,	0x94b84631,	0x2efa70c7,
-0xd95e5cc3,	0x6c5c9d37,	0x4955d2e5,	0x1986c823,
-0x250ad64e,	0xda87a2c3,	0x872d29e3,	0x43cc29f6,
-0xe667e664,	0xbf46632a,	0x14119b51,	0x2746bed7,
-0x37158545,	0x1e846c85,	0x1b95a555,	0xb7199a1e,
-0xa15c019c,	0xa3387c3d,	0x65ce357c,	0x4262836d,
-0x0cfe418c,	0x24ecb61e,	0x21bae0f7,	0xae0f7d05,
-0x21cb819c,	0x7c6f341c,	0xd40399ff,	0x340603e4,
-0x0c99c59f,	0xf2bfe2c8,	0x3fa6ab62,	0xfd523ff3,
-0x6729a50d,	0x748b60db,	0xd12ce998,	0xab74bee0,
-0xabd8562e,	0x486b62d0,	0xdf54ea64,	0x05706018,
-0xad5f0651,	0x03925450,	0x953c9690,	0xf671def9,
-0x12f2bc25,	0x489088ed,	0xe0821dfe,	0x86fc2ee9,
-0x5337050a,	0x73fe5693,	0xfdb68668,	0x6e3aaf10,
-0x1ff17349,	0xe0ed3f06,	0xf04c6a24,	0xc2ca002d,
-0x4413be0e,	0xf936745e,	0x2ecba010,	0x12d5d285,
-0xac3fbf57,	0x64a4bc04,	0xc8487824,	0xa98ffbcd,
-0xd09f47ed,	0xd55c8fca,	0x48f6b1ba,	0x7c91efae,
-0x996cceee,	0xe4eba045,	0x93231e6b,	0xeec78b5b,
-0x36b57bcb,	0x117e4338,	0x372b2355,	0x858d9058,
-0xcfd6a2ad,	0x0dfcf7ff,	0xb2175d06,	0xc30c0b18,
-0x082676e6,	0xa72aef65,	0x7fe69e25,	0x89e017fc,
-0x0c02475b,	0xfb6db944,	0xa22a7f67,	0x5109be81,
-0x49be8288,	0xe5912a66,	0x3e7f9c57,	0x196a17f2,
-0xc8f6d41d,	0x4a4ed74c,	0xf7068058,	0x530f85f5,
-0x5a62affb,	0x607e69cd,	0x187b3d35,	0xc0ba9105,
-0x09242e0d,	0xb9ed74d1,	0x89ee52f9,	0x304e629f,
-0xff1c5f7a,	0x541468fc,	0x889f2877,	0x009f0823,
-0x1554c91e,	0x4ede3cc6,	0xe8055158,	0x1f875bd4,
-0x7f319b05,	0xfd3b3605,	0xeede9e36,	0xfb91c6a8,
-0x13a4a1f0,	0xcfe5ea7b,	0x72e4742d,	0xfec9bfad,
-0x423111bf,	0xfc123877,	0x9d8a1696,	0xde722ee1,
-0x58581af4,	0xe6d333e3,	0x96480fd1,	0x1ec04bc8,
-0x89cd9328,	0x184a2e72,	0x61250a9a,	0x02a60896,
-0x68c4dc7f,	0x33bc2435,	0xef7ec8e4,	0xc184d4f0,
-0x2cc1046f,	0x022ddcbe,	0x44c1bdaf,	0x7a12cd23,
-0x5b378349,	0xc304a9b6,	0x3bdb987a,	0xbc33e5e1,
-0xb24473fd,	0x3e91a25e,	0xafadce24,	0x69738f5e,
-0x64410ade,	0x74dd6439,	0xe05174a6,	0xfc407a51,
-0x6330fbf3,	0xcb7c8c5a,	0x2ddded66,	0xd3165da8,
-0x023ed9e6,	0x3f2798d0,	0xe58c407c,	0x12f6c6fe,
-0x3d4e93d9,	0x1f44033b,	0x7415ece6,	0x797e18d0,
-0x1960eb38,	0x6d8802e8,	0x9aad531f,	0xacd1bea3,
-0xa437ffb9,	0xa512277d,	0x9ede1f43,	0x30b7894b,
-0x12116f70,	0xe238aa2f,	0x0bb75ff4,	0x1c5d91df,
-0x3636f6c0,	0xe0dfcfeb,	0x5389b29b,	0xa33a7562,
-0x85e4eab9,	0x09fefce5,	0x985ad1c9,	0xd93ff9ea,
-0x4c719a78,	0x4f47e619,	0x1dd726df,	0x4d6ac303,
-0x624e6340,	0x66986a42,	0xe56fa716,	0x055a5b10,
-0x2aaba4ae,	0x247363fe,	0x86dfbbca,	0xb9a66781,
-0x98e93037,	0x5d4e8c15,	0x9cc60f0f,	0x09ce687e,
-0x7948f82e,	0x329ed957,	0x413c9131,	0xd15a62c2,
-0xe19cc4d4,	0xb6435a71,	0xc891e0cb,	0x64067d28,
-0x71b59db7,	0xcd65e65b,	0x127354ee,	0x91b9d9e5,
-0x7159f111,	0x408dde9b,	0x9b50d36e,	0x93eda2f4,
-0x55429b2e,	0xa8b97a22,	0x5b625128,	0x7000e78e,
-0xbe0ffa92,	0xa3473045,	0x0990e748,	0x9f02bfd1,
-0xb4a4b632,	0xacc6e8ef,	0x83f1e4ed,	0x8c539784,
-0xedd466a9,	0x77e6ca09,	0xa453dcb5,	0x247db83a,
-0x4cd641c0,	0x4de6a12e,	0xf8599e34,	0xc825fc73,
-0x48c4ccaf,	0xfc5bba30,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2346-m16fda3.inc  */
-0x00000001,	0x000000a3,	0x08132007,	0x000006fd,
-0x89c0d09e,	0x00000001,	0x00000001,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x72cbc5d0,	0xa24e89bc,	0x074028ef,	0x2ad07a06,
-0xdeb7acf5,	0x98912a6d,	0x295d17a5,	0xa3b8708f,
-0x95c69839,	0xb2f655e2,	0xdce0fc75,	0xf92f04fd,
-0x51b6b38e,	0xe7884365,	0x69dcc34e,	0xcfe67a6b,
-0x5e421f0e,	0x51527923,	0xb63fceab,	0xae39d6c2,
-0x5dc6865a,	0x5819082a,	0xcfcfc6eb,	0xc4ed71a8,
-0x06e83b7b,	0x7cc5025b,	0x5fefb2c9,	0x3c02abbe,
-0x42dba8cc,	0xfc966b64,	0x2acaa07e,	0x61d32476,
-0x72fed3f8,	0x7ef26af7,	0x8086deb1,	0xd11fe511,
-0x3dcc3e92,	0x202bf190,	0x17fbf18b,	0x4cd17950,
-0x81299fb5,	0xac3d96a2,	0x389ff313,	0x85dd4b22,
-0x4eaef9da,	0x623b133b,	0xe3d02b2c,	0x2290a31d,
-0xc6f8c543,	0xf6c18f11,	0x8070c5d4,	0xc756e5c4,
-0xf4a40060,	0xbf169c70,	0x62dd14d4,	0x729fefe0,
-0x6594d275,	0xa5abc2e8,	0x720904e3,	0x5a5b42ad,
-0x5e970808,	0x5a6ec767,	0x502a6d38,	0x88d24740,
-0xb4739506,	0xe3f497a2,	0x2618e78d,	0xfb602c6c,
-0x323fc08b,	0xf9cb3dfa,	0xc90130e6,	0xe373da35,
-0xde024249,	0x490b1796,	0x93f157ee,	0x10f73761,
-0x6dd5c0e4,	0x4a9fb1fd,	0xadc2ead7,	0xd13e442c,
-0xbfbd007d,	0xc8de8a68,	0x09c630bc,	0x69e78a87,
-0x4d64bab9,	0x81c58c9b,	0x0b693158,	0x2a40ee8f,
-0x47153744,	0x2a32e243,	0xdde6b849,	0xa2c35ddb,
-0xf8c10a60,	0xaf5796f6,	0x8a95da67,	0x013f80a1,
-0x7f332110,	0x345e3e0f,	0xba8ca1f8,	0x373a3380,
-0x97f10a50,	0x3e1e78a8,	0x097496d4,	0x60ef2ffb,
-0x9421fb84,	0x03131ba9,	0x535e0247,	0xeda34f42,
-0x7f34ebb7,	0xbcfd1c2d,	0x19b2c696,	0x7107aed5,
-0xd5877fe2,	0x404186ae,	0xbc41a831,	0x1cd49fd3,
-0x92ff4c85,	0x3f65b35e,	0x701ce1cd,	0xe3839c91,
-0xab53cf2d,	0xdb124ec0,	0x7c012c6c,	0x432b628b,
-0xac351ee6,	0x9da287ad,	0x0adc2580,	0x66f945ca,
-0x36bd8108,	0xbce986ee,	0x8fc2d524,	0x06dbf665,
-0xb4124dd5,	0xf15c2853,	0x4aaa9b46,	0x753c207d,
-0xd7805517,	0xaa6f6dfe,	0xf6eb1ced,	0xe6a4f89c,
-0x5cbf2b1f,	0x6889832b,	0xf121bc8e,	0x2d7e02e9,
-0xedbc10d5,	0xf3974ab6,	0xf977d65d,	0x40ef2640,
-0x9c5f3410,	0x7ce2bca8,	0xac2d2c23,	0x204d560f,
-0x2dffb3b3,	0xb051fdc4,	0x76ef18ad,	0x1b13190f,
-0xa08cd1d4,	0x1aa202b8,	0x1a5040f4,	0x23a24420,
-0x22622bd2,	0x6e543121,	0xfe68651f,	0x4e0d3fd6,
-0xda661e0b,	0xfb41bbdc,	0x5a6e0df0,	0x8c27383a,
-0x91e24f94,	0xa5db6d2d,	0xc7684280,	0xfddaf106,
-0x0ada8514,	0x5cb76df8,	0xea1242ce,	0xc5aca25f,
-0x0821a5f3,	0x71e4de37,	0x89c9a2a8,	0x4d2231b4,
-0xc3edc81c,	0x56f516f9,	0x7e95a590,	0xe00ea616,
-0x827fd358,	0x4511b62d,	0x6cac7958,	0x8259e262,
-0x9ee67b13,	0xe73bdab2,	0x811f51d7,	0x88e6196f,
-0x642a4db5,	0x1ca77047,	0x5a095f6c,	0xa42ddb9a,
-0x66321e3c,	0xeeed0f13,	0x72e48195,	0x988f23df,
-0x3d058cd3,	0x45fed77a,	0xa20f4f80,	0xca873db9,
-0xcfd4a890,	0xcb406f47,	0x56bd45eb,	0x8ca14876,
-0x411da96d,	0xaabe66e1,	0x26ce3950,	0x40ceb4ab,
-0xbbb2b914,	0xfd90126b,	0x74c60165,	0xcd2e00ff,
-0xe0607bd7,	0x3dc3818d,	0x4102205b,	0x72cca471,
-0x0864151a,	0x65c92538,	0x5bc44cfc,	0x406a9b62,
-0x10e5aab2,	0x751f6321,	0x533ca54a,	0x335961a9,
-0xa386abb2,	0x24f90a2b,	0x3d13ff7c,	0x35d454ef,
-0xc236b524,	0x8cf68189,	0x6ba29c87,	0x3925aaae,
-0xa12de178,	0x4610a2d1,	0xfe330eca,	0x8d657af3,
-0x7f2f81f3,	0x46cd664c,	0x676003c0,	0xdf786970,
-0xb240a066,	0x41f852f2,	0xb85e5eac,	0x8ba83def,
-0xc12c498e,	0x02c5d742,	0x4b9df557,	0xd9f2ed28,
-0x5f7cec4f,	0xf9ff3a0c,	0x457ac549,	0x133f5bd1,
-0x951b6947,	0xf835f2df,	0xee51efd0,	0xe90b1bdc,
-0xb76c1a80,	0xc3f209a0,	0xb175f774,	0xd8963aff,
-0x3d458f2a,	0x9ba9ca53,	0x91561069,	0x444ac140,
-0x87f53cb5,	0xc835bec0,	0x2b6906e1,	0x1f2201e6,
-0x443bfce4,	0xd0e25486,	0x71ba244a,	0xa85e4fad,
-0xb0a9df78,	0xbef803cb,	0x710cbd53,	0xd7ce50b3,
-0x38f69e53,	0x5175759f,	0x987de9f5,	0xfc5f9332,
-0x090ba2ef,	0xa059c8e0,	0x9efc20ca,	0xaead8853,
-0x22cd4804,	0xb30dca16,	0xadbbdf33,	0x246cb36c,
-0xec99405d,	0xfef7e46e,	0x454bf0a3,	0xa75d4072,
-0x6859ad38,	0x3c6a15e8,	0x37bb8ecb,	0x05747a82,
-0x97edcb0b,	0x5bff5a7d,	0x20cd1e91,	0x1e37277b,
-0x4c0149e1,	0xc7d5e490,	0x253bcac9,	0xdffe64ac,
-0xf7ce2179,	0xada80d94,	0x3653f166,	0x7271d8a4,
-0x994f269f,	0x0841e81a,	0x709401cc,	0x0c9fefbb,
-0x30fa89fd,	0x1fea8b70,	0xffc68c98,	0x2030e064,
-0x8e28b2c7,	0x2750f01e,	0xceb4d955,	0xb86ee560,
-0x7ca55701,	0x3a942ffe,	0xd6ad0e17,	0xe8cec9d1,
-0x5a6954e8,	0xb14fe7c6,	0x6e7d5c90,	0x8481626b,
-0x7c798699,	0xdb0b344a,	0xa721cdc5,	0x861db07a,
-0x1844fca7,	0xde861a71,	0x770735c1,	0x3ab64f3e,
-0xb352aeb8,	0x046529cf,	0x2fd753f9,	0xbb3cad72,
-0x27b44c84,	0x58e77f53,	0x08840b3c,	0x75ceaa6a,
-0xcfb8ec2f,	0x8877c4a8,	0xee6bf89f,	0xc6256203,
-0x0bb3f6bc,	0x696fa2f3,	0xf04e8efb,	0x3fd0099b,
-0x27a473cf,	0x87fe81c8,	0x35cface5,	0x8afad818,
-0xb47534e9,	0x90b406aa,	0x7d7c2d15,	0xc9caf1ad,
-0x9692ac7f,	0xa3bc5fc9,	0xfd41d0f4,	0xc47f86df,
-0x60cbdd17,	0xc1fc9bb1,	0x518ec6f8,	0x45c7e024,
-0x7db1e277,	0xd4d30cd3,	0x35bc1c5a,	0x60b61287,
-0xfcecbc8b,	0xc6cb70e9,	0xc6280061,	0x9d0ac8ce,
-0xfaf12df8,	0x9b3f092c,	0x979a43f8,	0xbbdbe0cc,
-0x6274f1d9,	0x7322b577,	0x50589a1b,	0xbd0dca66,
-0x2160d66b,	0x4ea6b9f3,	0xd942aa7a,	0x0c8e1c82,
-0xc0a07833,	0x0fdb7b24,	0x012a56a1,	0x9d2b019b,
-0xba7c66ee,	0xe6af3a73,	0x823e0207,	0xd9913462,
-0x8896001b,	0x142af0f2,	0x52539dd9,	0x864a53f0,
-0x6e85c62b,	0x66139be6,	0xadd260aa,	0x2a7a579a,
-0xd0fe929c,	0x67052a99,	0x1bcb98e0,	0x8c58f5fa,
-0xb32d4733,	0xb4e4e4c8,	0xb536ab23,	0xd00ef025,
-0x05c4cb84,	0xbbc9b7d8,	0x175d6254,	0x5d8ebdb4,
-0xe3f3e65a,	0x52177f95,	0xe85d812b,	0x87fb19ac,
-0x88b80b16,	0xc570083b,	0x124da09f,	0xc8522543,
-0x5f73aab0,	0x6c25b49f,	0xc8a03cb2,	0xd857bb2b,
-0x16378b5d,	0x242f0e79,	0x02d5d491,	0x7fc8b85f,
-0x48177825,	0xc70d4bce,	0xa23f5d56,	0xc7ebcb58,
-0xaf3b143a,	0xc33e9d65,	0xc043e61d,	0xf05a3d2a,
-0xd162c7d0,	0xdad944f7,	0x3226cdeb,	0xd0d044e3,
-0x8012c5e8,	0x18524401,	0x2a4d751d,	0x95592574,
-0x8e03592e,	0x68a72ded,	0x7d65ba50,	0xfa66bb37,
-0x81250634,	0xe92c784a,	0xb585ae7c,	0xc6e350f1,
-0x8d40d62d,	0x5b2ad4bc,	0xc87b65d1,	0x700191fb,
-0x06015556,	0xaf94c477,	0xa63b5aa1,	0x28a7ab7a,
-0x7cdb448e,	0x3819d9d0,	0xcb0dfe9b,	0x715dc992,
-0x88f5e070,	0xa1f5ecb5,	0x8c9876ad,	0x44be717b,
-0xda7487fe,	0xecc57fab,	0xfb6cd21e,	0x6de34108,
-0xa98b84ed,	0xd755144c,	0xb24c242b,	0xa29eab2d,
-0xb909c928,	0x077da28d,	0x549454df,	0x173b4e96,
-0x5353fdfd,	0xcf06a087,	0x33acdb4a,	0x166b41a1,
-0x45219876,	0x96eb46b1,	0xee5f18ad,	0x6a962b7a,
-0x9914a217,	0xca72359c,	0x28f5a8f8,	0x9d0b43ac,
-0x5fb6964f,	0x0b2685e0,	0xbda83a60,	0x464fbf9c,
-0xfd8f4ec5,	0x9d16acdf,	0x1192191f,	0x119c43e0,
-0xd0a2df66,	0x8c2cf306,	0x3da0f9f4,	0xf409a043,
-0xcfc563b0,	0xf0be102c,	0x3252b4b7,	0x07076cbb,
-0x355888f0,	0x4e4bc8d0,	0x1fd64ff5,	0x245147db,
-0x9d757b6f,	0xfbaeee9f,	0x43d68df0,	0x2709be60,
-0xd333fd6b,	0x79af3f65,	0xb52de3ea,	0x04d94eb8,
-0x43865e4f,	0xc736c027,	0xfd180b96,	0x78caa82a,
-0xd0021810,	0x9e514f99,	0x72f5067b,	0x7de6487f,
-0x6cb34382,	0x0e01763a,	0x89976ae4,	0x7a8bbfa2,
-0xa50291f9,	0x6407b33f,	0xf7ce016c,	0x2d586dd3,
-0xac0a7612,	0x32fa7be1,	0x3ee474d4,	0xc795f431,
-0xd6d0a977,	0xdc859d13,	0x446f01b1,	0xafc13014,
-0x67bad636,	0xda3c5946,	0xe169c32f,	0xfe5c93b7,
-0xac1b3104,	0x42a5c9ab,	0xc906dad0,	0xe4b213db,
-0x6fefea5a,	0x35528fb5,	0x59cadba2,	0x5cbb0ea0,
-0x2b01c14c,	0xaa438c3b,	0x6bbad300,	0x3d6d3409,
-0xcc87ec95,	0x6f167576,	0x623c3b26,	0xab438ac1,
-0x469b5486,	0xb7992347,	0x0418dd1e,	0x54e6ad5f,
-0x44bff273,	0xbc97e1d7,	0x7c5c88da,	0xf7bbb29a,
-0x48d01e8c,	0xaa4d4376,	0x9a99c998,	0x24d09e2f,
-0x24480693,	0x84b6b905,	0xd0ff443b,	0x76605be6,
-0x5c6af5bd,	0x5dd0c084,	0x4d162432,	0xed939cf2,
-0x2d333e06,	0xd2144645,	0xb06a3583,	0xc1d6e232,
-0x03883c1c,	0x6a3a1491,	0xe6b619d9,	0xfee3f413,
-0x5e59c26c,	0x28684bc1,	0xca68c55b,	0xca395734,
-0x95d8afd7,	0x8a94d5ce,	0x6d780b0d,	0x6ab50934,
-0xf5121314,	0xb9ec2632,	0x1beb9a14,	0xcd950304,
-0x6fd91394,	0x33f84e25,	0x546d4a4b,	0xc303eb86,
-0xcfb7b409,	0xf852adeb,	0x65c4960a,	0x01878815,
-0x4a6501d8,	0x5bb3a40f,	0x9414a799,	0xbbae4dea,
-0xae9d7b0e,	0x761dcb06,	0x9581c2ff,	0x06edcb74,
-0x0c06177d,	0xdc36931a,	0x751d52ea,	0x699dd531,
-0x5285df50,	0x81990800,	0xa81d52e4,	0xf305b98e,
-0x260f304c,	0xa9f5a19d,	0x702bf4d9,	0xc4e322c4,
-0x05e38fbd,	0xf6997433,	0x938443b8,	0x33fe4ff4,
-0xc0da5ba1,	0x1701d20f,	0x4f631fda,	0xd966d058,
-0x847b08a0,	0x7719b2ac,	0xea7e817e,	0x3cc266f9,
-0x39b94930,	0xd5a7c643,	0x831d614c,	0x486c87ea,
-0xeb32ec07,	0x27ccfb31,	0x3618615c,	0x01c5284f,
-0x138ba020,	0x7f316b7d,	0xf7049fff,	0x2acb57be,
-0x156b6bb0,	0x03df196b,	0x72bfb285,	0x0d1fd58d,
-0xcb86fb0c,	0x938e1a8d,	0xd387a3ab,	0x5fa1b627,
-0x2c4d3f80,	0x0b4a7121,	0xbab5d24c,	0x4e14e39c,
-0x19d839a3,	0x0b730800,	0xaabb2b8a,	0xa58aa531,
-0xa82260bc,	0x21be659d,	0x714b34d8,	0xa89d111d,
-0x02828552,	0xae10e3c9,	0xdd9ecd12,	0xe13beb47,
-0x96818a52,	0xb5fcd9b2,	0xa8d0964f,	0xfcc0e896,
-0x7ab323da,	0xb1bf60de,	0xdb70c0ac,	0x83373de9,
-0x3513e4d5,	0x0634af3e,	0xc3052a5f,	0x3acb8ac9,
-0xcf03743f,	0x15555b96,	0x929b04ff,	0xdb2a9428,
-0xdce90ae4,	0xe414e73b,	0x5b6b19ff,	0x1a708067,
-0x61329d15,	0xc4eb8336,	0x2d861d5e,	0xca108403,
-0x0e9ab2d4,	0x04d3b3c4,	0x36ef280d,	0xfea6cee9,
-0x80c30cad,	0x399d1c6d,	0x2b654d22,	0x204032fc,
-0xee60e1c1,	0xb20fd9db,	0x087a91fd,	0x6a4e368b,
-0xad3ca7e5,	0x5355a689,	0xd220e928,	0x925cb754,
-0x677991e5,	0xb3941d98,	0xa3eb379a,	0xf0237d52,
-0xe96b9e08,	0xb7ae3c7f,	0x7a84124d,	0x9cc15b58,
-0x2ddafebf,	0x93a8990b,	0x1555212e,	0x7fe44a1c,
-0x90851979,	0x62a143a7,	0x5ba95724,	0x4d8762c9,
-0xee3a6f84,	0x0af45b74,	0xcfabce5c,	0x73ff8f3e,
-0xa872ef47,	0xe97e60bb,	0x805c1800,	0x8d3b978f,
-0xaf71cdb9,	0x4d8da1ec,	0xae5f2f19,	0xe57566f8,
-0xa2003cdd,	0xe65293ce,	0x6970388a,	0x979c68dc,
-0x2fcf8d5c,	0x61a603d3,	0x92158c18,	0xd2f53c34,
-0x842dc4b1,	0x32f3df78,	0xc696ab26,	0x2be86b54,
-0xd98bca91,	0x0415fca1,	0x5afc9076,	0x796a5ef4,
-0x87a225b1,	0x6b5784b3,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2498-m101067660C.inc  */
-0x00000001,	0x0000060c,	0x01192008,	0x00010676,
-0xfbac0f5d,	0x00000001,	0x00000010,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x0000060c,
-0x00000035,	0x2e000000,	0x20080119,	0x00000301,
-0x00000001,	0x00010676,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc8f5cd92,	0x30bd1beb,	0x77c4fb8b,	0xe899c960,
-0xc729b4cd,	0x1d9b8923,	0xfcdfc554,	0x580d39f9,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x4872f26c,	0x88971c10,	0x66db1385,
-0x1e532ab2,	0x7ccd2d72,	0x38dd766c,	0x131f4505,
-0x7d5e1e0a,	0x1932938b,	0x79c1db9a,	0x9fe5b8bd,
-0x07037c1a,	0x698cd351,	0xbadb5300,	0x063f17d9,
-0x8558ada3,	0x224c2288,	0x26fa35b3,	0xe64efb19,
-0x0e1b52db,	0x696d5461,	0x3a0f765c,	0x4b853dfe,
-0x05147b28,	0xbe146518,	0xb61e1de2,	0xc342998e,
-0x083d5f41,	0x737fdbb5,	0xdd812ce1,	0xa7b9549c,
-0x164b5fbf,	0xaffd6139,	0x44154437,	0x23d44899,
-0xbe41eae1,	0xeecc8d45,	0x31fc971a,	0x44475238,
-0x5d4ab69c,	0x67f342a0,	0x118cb268,	0x513fb847,
-0x0a86fce3,	0x23f22535,	0x5fa15360,	0x929aa833,
-0x3cbd4138,	0xc1dead1e,	0x3efa210b,	0x9781a61d,
-0x00b53f73,	0x07df4d30,	0xffe97322,	0xf7b12998,
-0xba4d7316,	0x4b746898,	0x45ece500,	0x78cf31d5,
-0x0208c1c6,	0xc3999e15,	0xce2f90f4,	0x7e130a0b,
-0x3c74ce12,	0x37612fd2,	0x7ce3ae15,	0x99a26321,
-0x52ac391f,	0xcb32f7e1,	0x0e50140d,	0x3a6bfc41,
-0x497f7f9f,	0x334b7e17,	0xbcf4e41d,	0x3311b0db,
-0x0dc65367,	0x44847807,	0x991c439a,	0xd2965df2,
-0xfd72e4fd,	0x44b01f14,	0x5a0cf5c5,	0x70029e37,
-0x92af3f34,	0x47949bdf,	0x771a3c07,	0x0874f372,
-0x7a54670b,	0x7430b00b,	0x356234f3,	0x74edf1e6,
-0xaaf60a4c,	0x2bb5eee4,	0xc2c1d43f,	0xc4ee788b,
-0x4198fd90,	0x0aba19a3,	0xc251f028,	0xe42404df,
-0xccbd25f2,	0xdb13eb69,	0x888f89a5,	0x5a6c8cd3,
-0x1e3b469b,	0xe07e48c6,	0x87f25228,	0x64324c03,
-0xe0426f9f,	0x148f828b,	0x4a3c82ab,	0x7d46539d,
-0x0b5079ea,	0x2c675b3e,	0x83134717,	0xbe775c77,
-0x74841ec3,	0x4470addb,	0xfabfa06d,	0x548757fb,
-0x184ea712,	0x502765b5,	0xd7067ce2,	0x15afee11,
-0x8a95590d,	0x3a1734cd,	0x212c7f7d,	0xe5aa3e5b,
-0x9c7e75c3,	0x07486966,	0x5827bbea,	0x391e46fe,
-0xc6acbc9e,	0x9761b6a9,	0x37bef8c4,	0x733eb81f,
-0x7ac9a87a,	0xceacd157,	0xd931072a,	0x9383c10d,
-0x5eae74ef,	0x5f82f6a0,	0xcf89077d,	0xbc641bd8,
-0x1b7d1213,	0x980a4ed3,	0x410fa7e8,	0xaaa1a011,
-0xa5e94ef2,	0x74937d5f,	0x3c109f67,	0x8e58bdcc,
-0x2b43ad95,	0xaa516349,	0x6fa9cca2,	0x48a18062,
-0x663c7fd7,	0xf3822d87,	0xbaaf1f97,	0x8da372b2,
-0xa416831b,	0x6a645364,	0x9c7ac6fb,	0x3f5a9cab,
-0x8cf6f4b4,	0x514fd1dc,	0x7e9d0918,	0x2075f774,
-0xfda8677b,	0x3b5c16ac,	0xe887694b,	0x7d622e9f,
-0x5427472d,	0x540e5c99,	0x2196e138,	0x5d5e9c58,
-0x84a5fc17,	0xb17d6d41,	0x63273bdf,	0xfbb912b5,
-0xaf16b7c1,	0xeb1914d7,	0x5d654b8f,	0xf4a594f6,
-0x554a6311,	0xb391f519,	0xa5ad4acf,	0x9c052bb7,
-0xea68faa7,	0x37399a25,	0x8f6f6d36,	0x47c20f2b,
-0xf241ab98,	0x66da024d,	0xee90a06a,	0x33718b17,
-0xaa89087e,	0x6dcca7f5,	0x43a59f0e,	0xcb2e3ab8,
-0xb19126bb,	0xc56bccb3,	0x04f6fd9a,	0x0f63850e,
-0xa2b6c85e,	0x309f9817,	0x7252b154,	0xcba20ff3,
-0x143156b8,	0xcfcdc8ae,	0x13c2a75b,	0xea4bf1b8,
-0x6e474959,	0xa9c376f5,	0x40d252b8,	0xb6209e70,
-0x993efa22,	0x3d7e8007,	0x1857ba0d,	0x72f25310,
-0x233a8f68,	0xeb4ca923,	0xb17917d1,	0x9ca3f4f6,
-0xdecf1498,	0x99f5ddae,	0x8b6ba2b7,	0x54f41fb0,
-0x1ec9ffa2,	0x74ad3bd6,	0x84fee3e6,	0x5294820d,
-0x147e8b14,	0xd2dc15f4,	0x152fc744,	0x306bc043,
-0xfdbb74d8,	0xf4ea207c,	0x53edfac5,	0x1b609795,
-0xe990ee73,	0x749dbed4,	0xd1cefc95,	0x5c7b37f6,
-0xc6b39045,	0x7281e3f7,	0xed0e6aa4,	0x590a246a,
-0xe6e6a81d,	0x604491ac,	0x6cd14e8a,	0x7a19f5da,
-0xf7c7326a,	0x0ef8029e,	0x0e741b48,	0xc962a062,
-0x6f4ad86e,	0xa2729726,	0x93bcaf1f,	0x1bb56970,
-0x12495cdc,	0x180512e7,	0xa1d68081,	0xb924c24b,
-0x5a1461ca,	0x21438ca9,	0x5449ae48,	0x0f564503,
-0xcec8df3c,	0x789f9b80,	0x5a708df1,	0x28735bfc,
-0xcf11d2fc,	0xa5d01625,	0x80b0b533,	0xa09f026d,
-0x1d22fdf2,	0x01928228,	0x8b6779ed,	0x04f7cc95,
-0x581fe0b2,	0xcc9a66a4,	0x55b3f130,	0x0f22abed,
-0x05b7e95d,	0xd8cc9c30,	0x0850ca8a,	0x34d729dd,
-0x973300a7,	0x80ffedb1,	0xbf5b28e7,	0x135c8cc6,
-0x4337b017,	0x31d8dd09,	0x35ed75a1,	0xb8f990b9,
-0x4384dc18,	0x29d72b56,	0x021aa2b2,	0xa3248b3f,
-0x5f4e7301,	0x29991927,	0x1cc50c18,	0x79fcc545,
-0x56e2e683,	0xe5127777,	0x4b727957,	0x94d1bc22,
-0xacd0da9e,	0xd24771fd,	0x5997ff0a,	0xb9947cb8,
-0x8cb9bb5c,	0x16a4c5e0,	0x00d6995f,	0x1e05edff,
-0x3a7f1af3,	0x445fd70d,	0x24a602c7,	0x6b50001a,
-0x6c99f5e5,	0xad2c00c5,	0xbd16a90d,	0x3b7b6032,
-0xa8dd4f8b,	0x437145f1,	0x5a593d5f,	0x749ee409,
-0x9c6d8223,	0x40c1dad0,	0x578e7e1f,	0x89072e7b,
-0x0ccf47c1,	0x427606d8,	0x4a7bb48c,	0xf85cc4e9,
-0xca5ca3b6,	0x9b989f23,	0x6496403f,	0xdf8ef891,
-0xf4458e90,	0x28eed125,	0xef91afe9,	0x97a8d65b,
-0xe022b3dd,	0xc93c2adf,	0x520cbe7c,	0x58995018,
-0x719a724a,	0x9258733f,	0x8df05767,	0x879b9ba1,
-0x84684054,	0x71a62082,	0x5be959cd,	0x12c937ec,
-0xc21fb3b8,	0x6738aa89,	0xb01d872b,	0x0ff6ec3c,
-0x50fc63ea,	0x715b7c5d,	0x4e5d50c3,	0x086c862e,
-0x34ec9201,	0xd41176ef,	0xd0238088,	0x53518100,
-0x8e1500dd,	0xc6ea9594,	0x0359517e,	0x58d81a35,
-0x48c40983,	0x2d562dc6,	0xecf5be9e,	0x4cd82ead,
-0x45faeb2b,	0x1a66ec1c,	0x6b692a76,	0x6cb326b0,
-0x3a6c362c,	0xf0174da3,	0x5e4549d9,	0xc12c5972,
-0x73716059,	0xdd54591d,	0x32ee704b,	0x5a55c22d,
-0x56bd1e7e,	0x2bd34024,	0xa42c85d2,	0xb1ce248a,
-0x604a7570,	0xbbf4b3fb,	0xe0eeb866,	0x130b7dd4,
-0xdb39dc1d,	0xd873b0c4,	0x3aedb6ef,	0x5efb2481,
-0xbfaff9bc,	0xb94930d6,	0xa3fe71cc,	0x75867e01,
-0x7c8ee191,	0xf38f4963,	0x8d077957,	0x658e7c2b,
-0xc1bd58ed,	0xb86a20b2,	0xc624489c,	0x4624732d,
-0xc11f1ee3,	0xf1874ed7,	0x173684cf,	0x0e5851d4,
-0xc2662118,	0x13dbb926,	0x1668df5e,	0x00749d03,
-0xab9530d2,	0x5758e602,	0x6db90ff1,	0x87270f9d,
-0x774a52f5,	0xcd1b4b5a,	0xd706025e,	0xe3a51fc4,
-0x31c5d55b,	0xbd0278a1,	0x16dce1bf,	0x75a3446f,
-0xe030c121,	0xa6f6b3c8,	0x504e3b3b,	0x4c1428b1,
-0x74229a60,	0x25d5b7b7,	0xea284c21,	0xf5f1c7cd,
-0x0025e9fc,	0xa7db9e56,	0x4e3aeb90,	0x8bad0f3b,
-0xc19e88eb,	0x8ea86b83,	0x25cf5d26,	0xca78504e,
-0x94109c06,	0x60ad3975,	0x138b8038,	0x4c9d8fdd,
-0x28a91526,	0x5d3d6c3a,	0xf81ab861,	0x8db34426,
-0x35a3b398,	0xf3b40170,	0xb7e6994b,	0xea72c1f5,
-0x63201cd4,	0x1c5749dc,	0x420ada27,	0x419f4847,
-0x49244543,	0xb915645f,	0x3a00b3e2,	0x0122000b,
-0x296b6bad,	0x7b45d76b,	0x5be8f025,	0x2a04919f,
-0x8291fea4,	0xaae644f9,	0x7af3fb96,	0x77d9878c,
-0xa8996848,	0xa9a0c1c3,	0xb47ae6d2,	0xc5b6cf90,
-0xb04b4863,	0x43fa113b,	0x66ef4993,	0x03a5b4e9,
-0x94b661dd,	0x145a5909,	0xd42f70cc,	0x6b816775,
-0xfbc0cb04,	0x5e890eb1,	0xb6900305,	0xcd19304b,
-0x85c67d21,	0x19e91907,	0x27b3898c,	0xe0ce6ba2,
-0x4110d80d,	0x85953740,	0xba7a4225,	0x51db6dd9,
-0x04c21ffe,	0xd34ef7cd,	0xeb13f075,	0xc1f8eb04,
-0x19a1227a,	0x3e99efae,	0x318346e2,	0x3d4c73bb,
-0x402dacc7,	0x5a9e892d,	0x01304401,	0xb3950c6f,
-0x9254bea1,	0x5cc8f025,	0x53cb9416,	0x52d716c5,
-0x3ff575a5,	0xede2046b,	0x2cbd6b85,	0x7e8feb25,
-0xc2d35482,	0xa49b8495,	0x214fed4b,	0xc93ae54f,
-0xde3d8a18,	0xe4456b47,	0x505555c1,	0x6418926d,
-0x4b6ac1e7,	0x7ac213ea,	0xc081eea5,	0x467ff1c3,
-0x1ed5d79d,	0x746dbb24,	0x38b1dbde,	0x4d495fc0,
-0x7ddabfe1,	0xfbac0ba1,	0xd17cfc3b,	0x32c819f3,
-0x1f4c39cd,	0x6fa5c3ed,	0x0d2e7f50,	0x1f5cb318,
-0x1e1770d1,	0xef12c293,	0xb149ace5,	0x93df9bdf,
-0x14a98319,	0x3374906f,	0x746d603f,	0x5a368e6d,
-0x8dbaef76,	0xb7923f42,	0x607655cc,	0xd144703c,
-0xa01fa0f6,	0xa83f4e65,	0x224bba03,	0x6e082d15,
-0x11ef27eb,	0xad91427e,	0xd8f0e3bd,	0xba7bc3df,
-0xdb031557,	0xf33052d0,	0x2bc3df37,	0xf55d25c2,
-0x99af998a,	0x5819eb07,	0xe4b9ebc5,	0xbc3da46e,
-0xde1abe71,	0xb8c66434,	0xe811e29d,	0xa48ee5e6,
-0x7f961c60,	0x5500769f,	0x9c8e0d00,	0x94680cea,
-0x2f7a0c5f,	0x9a058310,	0xd3ddca08,	0x74276c4c,
-0x855ebef2,	0x61979f79,	0x09684303,	0x3ea777dd,
-0xf700db1f,	0xdf7bcae0,	0x0fa7db2b,	0xd0115231,
-0xc0015882,	0xe4af6f72,	0xb4388c7d,	0xfb5656bc,
-0xbe1d38b3,	0xf59ae9d3,	0xddc692bf,	0x3aaef998,
-0x561f993f,	0x4d191a40,	0x4492df05,	0x7eb17670,
-0x0770001b,	0x9b320a87,	0xbc8a559a,	0x19781e02,
-0x13c995b1,	0xcb8c1e47,	0x462019e3,	0x7ee6bcc1,
-0x9da2afce,	0xee1dbf76,	0x3a72ad3f,	0x711f786a,
-0x0c72d639,	0xa3455dc9,	0xef155308,	0x82f3e1c9,
-0xc9540414,	0xcec2cde1,	0x748005bb,	0x24197d5d,
-0x4b8b7f7b,	0x3dde3129,	0x9ac952c9,	0x6f7932a7,
-0xa99005e4,	0x4261280d,	0xfad329af,	0x90bcacb3,
-0xe1c4a202,	0x9200d928,	0xffe55142,	0xf69b2a40,
-0x227783a3,	0xe4b0c9c4,	0xeca97ce9,	0x9245597d,
-0xa922db08,	0x94bff912,	0xdbebd937,	0x5c658f30,
-0xb3f4a726,	0x24e2ca27,	0x9ca037d7,	0x745d3d5e,
-0x3e8c437e,	0xb807af86,	0xee5fa977,	0xfe335297,
-0x5c0a6707,	0x8ab801af,	0x05d02766,	0xcd0906b4,
-0x791b47d3,	0xff5a0291,	0x09465b16,	0xa7fff3a1,
-0xe2e6d825,	0x7f4f2b9a,	0xc1f2e668,	0xa5cfe1d6,
-0x95fd7bde,	0x38681314,	0xc3c7dce1,	0x7b82e044,
-0x2c883c77,	0xe8aa72be,	0xd53867d7,	0x7022fdc3,
-0x3b697ccd,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-/*  1719-m01f6508.inc  */
-0x00000001,	0x00000008,	0x04262006,	0x00000f65,
-0x5c58f575,	0x00000001,	0x00000001,	0x000007d0,
-0x00000800,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000008,
-0x0000000b,	0x00020050,	0x20060424,	0x00000121,
-0x00000001,	0x00000f65,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x7b8b2c33,	0xa45a8391,	0xbfcfae7e,	0x13c73806,
-0x3e6fb5e7,	0x9fa2e0b7,	0xa751399f,	0x9cfd3041,
-0x1e777355,	0xd28b9f9a,	0x52366431,	0x98d07e44,
-0x4d3e73b8,	0x2451251c,	0xdb49bf93,	0xfcf022b4,
-0x71ff9e49,	0x3e2c0df6,	0x83189796,	0x5d85ff06,
-0x4b7d4925,	0xb8cff5bc,	0x2b0c003e,	0x7bff93b0,
-0xda473756,	0x603a2a5e,	0xb79b1b3f,	0x97fa09a6,
-0x58db4102,	0xf4a77bae,	0xa691c022,	0x40c80906,
-0xb6151ff7,	0xd8a81a50,	0xe696c918,	0x6fb1bcd4,
-0x91928d2a,	0x6f8481c0,	0xc146a3b0,	0xb702c6e6,
-0x01dfbe87,	0x255947e5,	0x1ee51d98,	0x5fa7bf0e,
-0xa0fc72c7,	0x90d22f4e,	0x85476060,	0xe4438e6a,
-0x68370d89,	0x998ac0dc,	0x777b9881,	0x122a7e21,
-0x7d04e408,	0xccae7942,	0x1c527cff,	0x382f75fe,
-0xd5ae8790,	0xb8ca0d48,	0x87521e7e,	0x98b8c307,
-0xb009b5ae,	0x73e60c9a,	0x32fadfd6,	0x1ec078c4,
-0x7c6c5dad,	0xf8a0d91b,	0xa84b7259,	0x9ec09997,
-0x718eb876,	0x2bc43de6,	0x24bb9540,	0xb6edbc06,
-0x00000011,	0xca79465a,	0xd4dc2f88,	0x691a8c02,
-0xdf2e397b,	0xdceea993,	0xea5f7fa4,	0xcd1d7859,
-0x521cb95d,	0x696d5112,	0x8d7e985d,	0x7729265e,
-0x5e5c94ad,	0x90bbec2d,	0xb4a392c2,	0x73e1ddd0,
-0xe3f66bd4,	0x3f3de2f4,	0x8c02ed34,	0xbda0d86d,
-0xa4bce0e1,	0x4eeccb0c,	0x004e51df,	0xe54f2b84,
-0xad7c9bbc,	0x89829a05,	0x33abad36,	0xdbba0850,
-0x419287ce,	0x943af8ba,	0xa998b1e0,	0xf29e752e,
-0x88c32d51,	0x1e001731,	0xf092cbcf,	0xb9959591,
-0x4afe8764,	0xc29db19a,	0xe614c853,	0xf6bcb656,
-0xa0f4fe52,	0x1deea1d8,	0xc695468c,	0x02bfc809,
-0xc05e99ee,	0x3fb6cee8,	0x5923c806,	0xbe280047,
-0x0d62c948,	0x38e216b7,	0x0b00b0b1,	0x9f629916,
-0xd99764b5,	0x599948fa,	0x9b76d9b9,	0x2d5b4df7,
-0xd28b355d,	0x9f928338,	0x17e6f849,	0xa98f505e,
-0x9bd2c80d,	0x1600f39b,	0xcedaa24c,	0x1448822b,
-0x8e6994bc,	0x57efb9c2,	0x7bd1cc4c,	0xb5da19bb,
-0x31525691,	0x83f4c148,	0xf639ae5f,	0x95f9dd11,
-0x26f41f38,	0x99c34dda,	0x0070eb19,	0xf634ef25,
-0xdf3a2889,	0x075fa4c5,	0x5020d60c,	0xd9bac756,
-0x06c4dd71,	0x5672914c,	0xf7b572ae,	0xc9c50c89,
-0xe407d6d2,	0xaf85e015,	0x2db1d604,	0xc2accaed,
-0x0c227173,	0x42c58997,	0x376a4040,	0x27f407b4,
-0x2c9ebf47,	0x1ebf8cab,	0xdf63df33,	0x5a05ad2e,
-0xd0e5c94d,	0x1151c004,	0xfd63ea17,	0xa795fa72,
-0x654c6a4f,	0x9461b5e2,	0x8843a2c5,	0xe5d4d329,
-0xa786980a,	0x366e2e56,	0xdbec833b,	0x7f78182a,
-0xadf23947,	0x49fc56ff,	0xa3028792,	0xb5edb092,
-0x050f6df0,	0x592cf58c,	0x0a80abbd,	0x2e70c8c9,
-0x88ecf1e8,	0x88c3f6ec,	0x2813b53e,	0x533bb90c,
-0x6844c504,	0x4b556b78,	0x97b7ab63,	0x46ee7d95,
-0x1ec79555,	0xca34db5f,	0x436b1731,	0x47289b73,
-0x4883537e,	0x57477cd1,	0xe02a04a4,	0xa8853711,
-0x62e71e2d,	0x1afa5156,	0x6c4f79b1,	0x2ee10ffa,
-0xb01f72dd,	0x9c61c63e,	0x653854d9,	0x2212a16a,
-0x097d5672,	0x05a585c6,	0x11d4ec5c,	0xfbd542cf,
-0xd0ef0830,	0xe3838f0e,	0x524cb241,	0xe7237bc8,
-0x52ff505a,	0xaa46c7f1,	0x325b0d29,	0x0696cd2e,
-0x7ed85c43,	0xb83d52e7,	0x40e9c2a0,	0xd9147b32,
-0x8c5d9d02,	0xceef05f2,	0x604792da,	0x9223967a,
-0x27eb5bcd,	0x7f78559c,	0x0d20a3b2,	0x5952cbbc,
-0xe35fe328,	0xa49cdfb3,	0x406d3e3a,	0x093d3044,
-0x3e7b8c5c,	0x530ed7a7,	0x47c449ee,	0x5fef5f55,
-0x777ce977,	0xc67b61bb,	0xaa5fb96e,	0xd73be015,
-0x6008d026,	0xe98d90b6,	0x8ef2fdff,	0xa4d0de38,
-0x9cc31aee,	0x351b5d5f,	0xdc83fa9b,	0x45b007bb,
-0x94941e0a,	0xc842cc1a,	0x13ab92fa,	0x95caa979,
-0x51ea69b3,	0xe4fefccd,	0xe21fc4f1,	0x1634548f,
-0x756b84c6,	0x9fe76b9f,	0x4e28ee1a,	0x8c8f5ceb,
-0x08e3b998,	0xc6dfa5dd,	0x948c7621,	0xbe66d285,
-0x7e050ad4,	0xf48e2561,	0xbc00201b,	0x2325ff60,
-0x161423d2,	0x2a96eb38,	0x8dad885d,	0x8a4f546d,
-0xbd640d83,	0x6aa6b616,	0x086de9b6,	0x80cc15f7,
-0x30558280,	0x383eeefa,	0x477b44a0,	0x9fdbed83,
-0xa83c7649,	0xc1c48473,	0xfec1fac3,	0xa223b679,
-0x1a8a27a8,	0x762b32fa,	0xf4759b79,	0xc356a6d1,
-0x16129e9a,	0x429e8994,	0x4fe603be,	0x1ef65832,
-0x097e2f72,	0xe47279e1,	0xdd5d2ab7,	0x87833a47,
-0xd9009f43,	0x995d4ad3,	0xaaa939a7,	0xef14c315,
-0xc3f4360d,	0x3856c208,	0x79641784,	0x81584391,
-0xa2fd781d,	0x81d2013b,	0x0224598a,	0xd352fa9d,
-0xba10f035,	0x499f9e2a,	0x732ee824,	0x624d6680,
-0x0b64229e,	0x71f0e2e8,	0x04711cfa,	0x25ee4a48,
-0xe81c15e1,	0xf8e6b875,	0xe944f119,	0xfe2eb47b,
-0x3b85420a,	0x392af4d8,	0x1d250cae,	0x4503717e,
-0x1d9d6eba,	0xfa823767,	0xcc86abc5,	0xf69e0dfd,
-0x93df823b,	0x772fe56e,	0xe5b2d115,	0x57d3b84a,
-0xaf86a775,	0x5f16e89a,	0xd92bfbdb,	0x52841f94,
-0xe0e8e9d5,	0xdb505567,	0x25d71a34,	0x9af9da0b,
-0x24eff392,	0x99060257,	0xfd47408d,	0x30541632,
-0x0af6e540,	0x01b85d88,	0x5642607a,	0xf312fb21,
-0xfa9f15fd,	0x3f875194,	0xf141af9d,	0x3624580a,
-0x78b2466c,	0x0e66bc4c,	0x7b27c988,	0x964fb527,
-0x08e8f3b4,	0x47ae754e,	0x8cedc325,	0x9cc875f1,
-0xbede5abb,	0x72a0943c,	0xf49c2e3b,	0x6e650234,
-0xd1b77cd7,	0xcdc82a19,	0xc0e921c7,	0xb2a066ad,
-0xa9187f81,	0xe6c03bfb,	0x4d9a40bc,	0xce087313,
-0x7fc63e54,	0x4ae1814a,	0xfe5c8945,	0x8abd2393,
-0x4c99ded2,	0x549ee9c0,	0x7dd01eb6,	0x4738f4d2,
-0x94263b53,	0x6f11ce54,	0x7d5d4cdc,	0x0cd881c2,
-0x7d788aa2,	0xf8851663,	0xa32836e9,	0x86617e55,
-0x40338bb2,	0x3015fa10,	0x2329f448,	0xff11e66d,
-0xa2b68e4d,	0x17c62286,	0x6d76e8a2,	0x746e0b26,
-0xe58e4c9f,	0x2e600a6c,	0x270e71d4,	0x8ea6cc21,
-0x15204668,	0x74a8b290,	0x5caf3f36,	0x94e684bd,
-0xbf8a33d9,	0x5b0bc87e,	0x1fa3a852,	0x0c2412ae,
-0xafaab23d,	0x9d73c709,	0x535d0780,	0x43d0ed94,
-0x0c85955e,	0xd0ba545b,	0x50a96f56,	0x89fe1fff,
-0xc93f6abf,	0xf3d1a63f,	0x105f9e58,	0x0972f672,
-0x23e7a050,	0x338992a0,	0x0884dce0,	0xc69e2e9d,
-0x4b4fb526,	0x75fbc584,	0x3b0c39c4,	0x30de01c6,
-0xa45bcfef,	0x621aab9a,	0xbf84cde7,	0xb97c1657,
-0xd6c35e29,	0x1c340d20,	0x4e629b16,	0x964d9205,
-0x773fd59e,	0x6e06436a,	0xa271a4b3,	0x26ea87dc,
-0x0b7a0a74,	0xf5ceac33,	0x6abb7570,	0x17ff9fd2,
-0xc689008f,	0xbb64e4c5,	0xa1fdbfd3,	0x8fc86b4f,
-0xaf368b05,	0xb25d5e2b,	0x993b61c1,	0xd31e2b57,
-0xe5e6f0cb,	0xa1c03ea1,	0x99bc59f5,	0x3136a5f4,
-0x17bc0426,	0xd4c893bb,	0x6214a7ba,	0xbc17d415,
-0x36e33f56,	0x219975a4,	0x7593ea70,	0x0da69d80,
-0x3dcd82c4,	0xc3f68585,	0xa3f42f85,	0xb50d5861,
-/*  2375-m206f6cc.inc  */
-0x00000001,	0x000000cc,	0x09162007,	0x000006f6,
-0xb5503da1,	0x00000001,	0x00000020,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x4ca2453a,	0x0c60f81c,	0xf9fb6ac3,	0x446f4eb9,
-0x68956ae9,	0x281c27ef,	0x9b6e0e89,	0xce631b52,
-0xd8c1a34d,	0x9a174e3d,	0xfd97d9e9,	0x07b641e7,
-0x3f50d275,	0x5561d772,	0xa65af9fd,	0x557870d2,
-0x12dc035c,	0x15ffbb39,	0x70fc0682,	0xae5c00ab,
-0xb597e595,	0xd64f9b42,	0xea014df7,	0x201b6bbd,
-0x5b402e36,	0xdc08dd6e,	0x045591f8,	0x63e18c03,
-0x810de70d,	0xadb08199,	0x27582ae7,	0xb674dfb0,
-0x722836d1,	0x1d64bd8f,	0x5f099a2b,	0xc9c9fc54,
-0xb4e16551,	0xf3f6d238,	0xca2a4eff,	0xe4fe8258,
-0xebb303a4,	0xaaeca96c,	0x8054b75c,	0xb3c7fdda,
-0x4cd15f13,	0xd763420b,	0xd44ada70,	0x44e676e5,
-0x6a9acad8,	0x3ce16ecb,	0xf236af13,	0xd19b31cb,
-0xa7f53497,	0x811df556,	0x8f4e3f29,	0xc89a1439,
-0x8e1585d0,	0xff71d747,	0x7565b24b,	0x284d09d4,
-0xd51f0453,	0x7451da9b,	0xf9de2227,	0xd190a59a,
-0x37c33c70,	0x22fda711,	0x5c870aab,	0x1e26fb7a,
-0x131d1b8f,	0xa1d6bde8,	0x10df2eb5,	0xa2f5413c,
-0xd42eb4dc,	0x385b5303,	0xcc7a035e,	0xcb1e1418,
-0x571574c8,	0x68ee29f8,	0x9c73546f,	0x75ed27e6,
-0x5fb8c3f8,	0xefbd3fe1,	0x232658a4,	0x44d58d4f,
-0x50ed3828,	0xcf347f31,	0xef6783a8,	0x36815423,
-0x2a86e288,	0x85d9b16e,	0x8499426e,	0x4893d524,
-0x31d97028,	0xbeb62dc4,	0xca41aeea,	0x6c006bd0,
-0x5fb3b5af,	0x00a99a87,	0x9d3403df,	0x9a636eee,
-0xbf42b42e,	0xf1bb04d1,	0x6b3f2a95,	0x8940dd97,
-0x6bf9b59e,	0xcb8a0527,	0xebee515c,	0xce1471cf,
-0x355dd1ef,	0x680bbb16,	0x64b16e4b,	0xbd88d2e8,
-0x4accba0b,	0x645782de,	0xb4e80b30,	0x8dbaff4c,
-0x69a316dd,	0xdb385e92,	0xa9d7e2c3,	0x9d528ac9,
-0x84cf62b8,	0x6fe4b05b,	0xfd9c1de2,	0x637c77e5,
-0x8246a322,	0xd8c0bb8b,	0x1630ca78,	0x02782a7c,
-0xfc98e84f,	0x189d1ad6,	0xd49b6da3,	0x38f57c03,
-0xd2184b1a,	0x29839a53,	0xb0d59c88,	0xcbb66409,
-0x86e1daa8,	0x0962c75b,	0xb2136ab6,	0x8ad8d88a,
-0xa34b2d1f,	0x187a4791,	0xd90b7191,	0x43d51a45,
-0x207d9dfc,	0xa14631df,	0x10b160be,	0x4979a4df,
-0x60b0eb14,	0x926481a3,	0xcee25829,	0xd001b43a,
-0x5a0b8d25,	0x6d4da2ef,	0x379cf299,	0x1ece08c5,
-0x585b7f60,	0xe21f15ee,	0xef64a654,	0x315f1dbf,
-0xc7b0bf4a,	0x8630be84,	0x1e2c6ac1,	0x351deaad,
-0x21e70db4,	0x9be6e520,	0x20efd8c8,	0x4fd7838d,
-0x7398c60f,	0x31450450,	0xf5bcbcb2,	0xa251b3ab,
-0x4802b7c0,	0x6ef397f7,	0x6918667d,	0x41364657,
-0x93749c16,	0x68ccc8c3,	0xa7828ada,	0xafe49351,
-0x8950e98b,	0xadd263f7,	0x03743b10,	0xe1303390,
-0x67c09f32,	0x34a53ad9,	0xea6de14c,	0x73982b98,
-0x5cc5189a,	0xc3c717e0,	0xd7482ae3,	0x528c71b4,
-0x2f1b0b0a,	0x79658ece,	0xe6939197,	0x46dc279b,
-0xd7db9210,	0x93da407d,	0x5eebeea8,	0xa3cd09e5,
-0x3861991d,	0xda6a49ee,	0xfada1c83,	0x6873706c,
-0x472a42a7,	0x25b0a0a6,	0x10533fb9,	0xfd81f855,
-0xffdcb426,	0x44fb83e2,	0x61ff93c9,	0x21c08ec8,
-0x7dede282,	0xabe78a53,	0xac7e1c5e,	0x2778c339,
-0x3a72dc6b,	0x4d8b1827,	0x097356ed,	0x95aebc13,
-0x53e90714,	0xb4449bfe,	0x7a53c105,	0xbca902af,
-0x7efa00aa,	0x3aa20bff,	0xc424389e,	0x33015d04,
-0x370474f0,	0xa7e9db06,	0x31ef08f7,	0xfffd987e,
-0xc188f973,	0xdb5e1be9,	0xc5bd9be7,	0x714c08f2,
-0xb5bc782d,	0x7c485554,	0x93f384e1,	0xdb13e1e9,
-0xf804524c,	0xd72d2135,	0x59f4b95d,	0xa42ce4ab,
-0xe949dbdb,	0xff708a44,	0x191ff0a5,	0xd5dcf1c4,
-0x5ed779d7,	0xf84a04c2,	0xb312bb9a,	0x72296289,
-0x818ac787,	0x29d3f1b0,	0xe5247de5,	0x204841a7,
-0xe343d836,	0x3455f1a5,	0x1ea06a2a,	0x6dd13104,
-0xcfcab06a,	0x59b40efc,	0x1aeda2f4,	0x228c613b,
-0x3a4aea04,	0x4ff8672a,	0xe1c2a5c0,	0x929b61de,
-0xfe04b30c,	0xeb86409f,	0x123cd80b,	0x285b55c1,
-0x9fbc657c,	0x96f08d1b,	0x811c3005,	0xf46a3a15,
-0x35ce682e,	0x7d0f00a8,	0x8f20ab16,	0xdbf70d95,
-0xf3f1fa22,	0xbd490a21,	0x5c1cb186,	0xe70d8e0a,
-0xe276e3de,	0xc44e4fd6,	0x95cb1709,	0xd637f3f3,
-0x22fccdd3,	0x73638415,	0x09cb4c2f,	0x5edd1810,
-0x7cddfcb7,	0x10504f7a,	0x052d2cdd,	0x60d7fc41,
-0xd537c338,	0x9df0ae8e,	0x998fd20c,	0xbca60e45,
-0x660df350,	0xc358e102,	0xb6a7463f,	0xf915e9d0,
-0x9dc3ddbf,	0xa3391de9,	0x821687f5,	0xc97749d6,
-0xd7142369,	0x619d3c38,	0xc145a05d,	0x08bdd065,
-0x2d07e770,	0x85b742fb,	0x868647ec,	0x42260c63,
-0x57f0f08a,	0xbe6c102a,	0x08d5bc29,	0x04ff5ecf,
-0x7064a5ec,	0x3c938764,	0x13daf31f,	0x66a431af,
-0xd7ffe591,	0x725e90bb,	0x8c7c9c89,	0xdb09effb,
-0x49a69245,	0xd86bb8e0,	0x05ccbbd3,	0x1888abaf,
-0x379bb483,	0x0da8c7ee,	0xa5f33b28,	0x17090bed,
-0xf257cf2e,	0xbca95053,	0xad55a14d,	0x7ee27bb3,
-0x86c679a8,	0xae835aa8,	0x20a21939,	0x8b373484,
-0xf3a240ee,	0x4b62413d,	0x105429b3,	0x3fc3934a,
-0x772a80c1,	0x97dafbbe,	0x6b3f45ef,	0xbc31d8bb,
-0xc406f325,	0x7ef9a44f,	0xe8de1d36,	0x89a26f22,
-0x112ff57f,	0x5c76e11f,	0x05c737ad,	0xcc2fabb8,
-0xa3922153,	0x498c6eee,	0x0f7aa81c,	0x4577417a,
-0xc494fcf8,	0xca0ea350,	0x164e10b3,	0x46d2cae9,
-0x533bc875,	0xe66514e8,	0xf3b87661,	0x9404fdce,
-0x0bb478c5,	0x731e58bc,	0x2b64c504,	0x537b200f,
-0x689f08c9,	0xf0579ddd,	0x2ba0d681,	0x2fb46df7,
-0xf68eadd9,	0x06ef245e,	0xd16df38a,	0x1bde6557,
-0x858936df,	0xe3a8b9b2,	0x71e52cc8,	0x1b1cdddd,
-0x5a7a4ddc,	0xb53d291c,	0x509b164a,	0x5d6ce1ed,
-0xe07f4d72,	0xa4056fce,	0xb1bd2265,	0x13b908cb,
-0x554e5ec2,	0x59d6c0a4,	0xf624fd6d,	0x50f7b809,
-0x9ad9d586,	0x021298af,	0xb7fdd41b,	0x636fa09f,
-0x0b476a97,	0x02161594,	0x8a441916,	0x1fbe6b3a,
-0xf4a5ba89,	0x553410d9,	0x8e878475,	0xaf97da55,
-0xcce07fbb,	0x2f6e97fd,	0x7a6bec65,	0xd741edd8,
-0x46762670,	0x23a62dd0,	0x1800a0ad,	0x8a833135,
-0xf173ed16,	0x8cfd7af3,	0x21b1fbf6,	0x008d081a,
-0x86f40203,	0x6d2ae0be,	0xd60f7b40,	0xaefbc0d4,
-0x179ee7ad,	0xfa7ecf66,	0xe3b54cd2,	0x5a935135,
-0x784eb5db,	0xadafa9b7,	0x02a61651,	0xf61ca1ee,
-0xd3034edf,	0x5d0747b2,	0x0249cb51,	0x87ac0e5f,
-0x2fbd72fe,	0x11d19421,	0x826aa7f0,	0xbecad816,
-0xea303a33,	0xe09e396b,	0xd8f4a26e,	0x83f8bee9,
-0xe17d5b57,	0x90d8aacc,	0x148bb70d,	0x70f230d5,
-0x8b9d152b,	0xb890c3e3,	0x2975fe1c,	0xfaa78f08,
-0x5d3f2402,	0x83e43665,	0xd4baddc1,	0x32fe6e2e,
-0xcec77de2,	0x8157232e,	0xc24d91fe,	0xe0c16891,
-0xc36d6afa,	0xf613aaf8,	0x6b388fc0,	0x2c4dc07f,
-0x379fb3a5,	0x6731c635,	0x6fd4eb18,	0xda60e96a,
-0xa1188bcf,	0x4221d7e0,	0x42fe4796,	0xfa9bf912,
-0x90281e11,	0xd22e3be9,	0x10133ea2,	0x1a19022e,
-0xf5bd3b53,	0x8d3b9eec,	0xa4223edb,	0x8821311a,
-0x999601ce,	0x0b016cef,	0x0eb791e3,	0x6c2d7b16,
-0x2bcc9cb4,	0x9b8ad717,	0xaf78a2dd,	0xd19cbd5e,
-0x83ccc754,	0x44ec7bb8,	0xe1564239,	0x6524d3d6,
-0x219e4912,	0xac90962a,	0x6af7074d,	0xb4de29e4,
-0x2ade0d62,	0x002975f9,	0x875add41,	0x3af7eb04,
-0x5184074d,	0xa799da86,	0x745e9870,	0x8f9b977b,
-0xa4fc2d1e,	0xfba1a758,	0xd4acd4bd,	0x46231ad0,
-0x19c96255,	0x46a28a49,	0x2747f84f,	0x92c5414a,
-0xe9ba4d71,	0xa46c972f,	0x34d99223,	0x1c511c62,
-0x90a31554,	0xd313b802,	0x51e31fd3,	0x1b7abc55,
-0x6ea77c57,	0x40f67d62,	0x85cfb2fc,	0x5d74f2c1,
-0x4102e522,	0x399d75a2,	0x37df2ef4,	0x0885218c,
-0x9b7f6495,	0x6546d3e2,	0x6ab35c52,	0x3535b3c8,
-0x3fd580c7,	0x3ec9b525,	0x7f0ceaee,	0xd29811ea,
-0x88fdd8ce,	0x16d9dc25,	0x257b4177,	0x0689554b,
-0xf1bc6a1c,	0xe25e84aa,	0x3fab190e,	0xe53b5591,
-0xf92ccba1,	0x72e849df,	0xa54bebb9,	0x7f9cfa4e,
-0x9024afff,	0x44d0bb1b,	0x6769020e,	0x75714288,
-0x5e6946fc,	0x7eb5a4db,	0xfe724b97,	0x03da7f95,
-0x86332888,	0x652baeae,	0x4ff95966,	0x8b59b653,
-0x490d78a0,	0x82db6e30,	0x57397510,	0xcbe89257,
-0xfb8e7cc6,	0xd8dc344c,	0xa3b65aec,	0xb5476370,
-0xe39f95e1,	0x7a17ef35,	0xef747c9b,	0x908a64c2,
-0x4b019837,	0xb90c56f3,	0x1427e024,	0x60c697c9,
-0x52e8c5eb,	0xe372c9b8,	0x6447ded3,	0xc50e8f41,
-0x37e037fb,	0x87ee5ccd,	0x8b120174,	0xbd7474c8,
-0x5b140ba0,	0xa753443b,	0x92fe8be8,	0x26020154,
-0x6356b4ec,	0x426f3a76,	0x7ce0259b,	0x4ba92062,
-0xad5c00c4,	0xcaf50518,	0x34fbbc39,	0xd74b9f0b,
-0xa3ba98a1,	0x078b3e78,	0x7ff3ed5b,	0x307739e7,
-0x593d4e92,	0x33d8f843,	0x9301bcd2,	0xaf289a42,
-0x5609f0b1,	0xf39134a9,	0x2f904b53,	0x62e6b3ee,
-0x6a0da57d,	0x36991211,	0xe7a6917e,	0xec3f6b43,
-0x26fd7e86,	0x846737b6,	0xa376952a,	0xf7961df8,
-0xf48f8664,	0x7d55f182,	0xa2fc9f07,	0xc7207d3e,
-0x2a0b2f92,	0xfbed2635,	0x3ecead48,	0x90f91aa1,
-0x4dd167bb,	0xe3ab46ca,	0xd4c5586f,	0xe287d92f,
-0x86497212,	0xc12bff4e,	0x2e378968,	0x19abfc38,
-0x721893d6,	0x7c0302a3,	0xa7dc2a88,	0x58e8df52,
-0xd6ae8df5,	0xb2e61807,	0x7f1446f7,	0xa6631a76,
-0x9c840dd6,	0x219a8534,	0x69798862,	0x13ecf7e3,
-0x593732f2,	0x3fab5b81,	0x9a7003e3,	0x354ecd44,
-0xfbf4c175,	0x585696f2,	0xc9bb6d06,	0x75a2d533,
-0x5eb5fb61,	0x28a2d130,	0xa3a8dbfc,	0x71fb7be8,
-0x3a2584a0,	0xba7d014c,	0x182e3105,	0xcf992d21,
-0x2b5c9202,	0xf4565d91,	0x05938b8a,	0xea1eaf79,
-0x0b738314,	0xf178f3a0,	0x9ee13d7b,	0x55d7c1e4,
-0xbf19a735,	0xe8ea533f,	0x0b915fac,	0x846af3fd,
-0x2ea919d3,	0x654cc505,	0xd4e7d3b6,	0x04f535a0,
-0x16fcd173,	0x90464576,	0xe5751104,	0x563f4d11,
-0x95b28b19,	0x2ff9fc80,	0x575864dc,	0x59b480f1,
-0xee59fddd,	0x2ad7b105,	0x92fac0fe,	0xb4d6fd14,
-0xe94415c3,	0xa23bdce5,	0xb4cddc6e,	0xf040325e,
-0xf607d4c5,	0x7e98e90b,	0x2f52bdde,	0x783eb8f8,
-0x0d735e4c,	0x435b4d46,	0x47865cfd,	0xcba84b9f,
-0x7680df71,	0x9c89e0b7,	0x52e8765b,	0xca4a4a2a,
-0xf5d6bf74,	0xffeb8da9,	0x6b22e6d9,	0x9317d0d2,
-0xd3417c8e,	0x257138ea,	0x9f6c650c,	0x2f65c281,
-0x186f88f9,	0x8a630a1f,	0xf36a3c4f,	0x3faac09e,
-0x18cc37ce,	0x5187d240,	0xadb95d8e,	0x96ef7f07,
-0x22098da0,	0xedd3b452,	0x6e827fcb,	0x4ed59ed0,
-0x984fc42e,	0xdaa3f5eb,	0xa6fcd30d,	0x150f6253,
-0x3ff37e60,	0x1dc93c3d,	0x87e89306,	0x101ab853,
-0x81579d33,	0x1d68dc7d,	0xc2dffad3,	0xcf913d2f,
-0x96c2f5ca,	0x0751685d,	0x68150a94,	0x8c4c6f94,
-0x7f8df250,	0x3868ec54,	0xa348cbf3,	0xc21d3309,
-0x508faf0b,	0x28c79e4b,	0x58b8fc81,	0xcb48bb6f,
-0xc6cd8902,	0x1d2cf518,	0xec6aaa16,	0xf1316d7c,
-0x4273eeb2,	0x5a462ecd,	0x07ebf2d3,	0xc9f5c520,
-0x19bef211,	0x53565c26,	0xd9ca82c1,	0x9ccc7fc8,
-0xed95ba5a,	0xf8d230f7,	0x252ab660,	0xd989b511,
-0xc21ad1a4,	0xf84355df,	0x36254582,	0x339144ba,
-0xc04208c8,	0x20372e18,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  2963-M01106C2217.inc  */
-0x00000001,	0x00000217,	0x04102009,	0x000106c2,
-0xd987bc76,	0x00000001,	0x00000001,	0x000013d0,
-0x00001400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000217,
-0x00000035,	0x000b01c0,	0x20090410,	0x00000401,
-0x00000001,	0x000106c2,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x09f89a9c,	0xce7faed5,	0x3c508f50,	0x462d2e35,
-0xdc20f762,	0x55ff2ae4,	0x88a57956,	0x06ff4465,
-0x0882023d,	0x953684cb,	0x0abe06ee,	0xa7ef1798,
-0x160d6cb8,	0x930cf745,	0xafc3fd79,	0xa70df3d5,
-0xb0620f46,	0x70048a23,	0xbf95ecf0,	0x76c1b997,
-0x5128616d,	0xb6b4b969,	0xcc69f71d,	0xdf7416e1,
-0xdf9a571b,	0x50c0bcc8,	0x85e2b3cd,	0xc1927532,
-0x7a04b6be,	0xe56b7f97,	0x524085c4,	0x668bf327,
-0xb3eaa54c,	0xccde06f8,	0x09b4e42b,	0x033b0a46,
-0x0f6e2fde,	0xb308ce53,	0x93eff03e,	0x8830014e,
-0x5c8a6f22,	0x91d2f757,	0xf70b648d,	0x0789998a,
-0xd84d4640,	0xe5f34e80,	0xf3357e64,	0xd1e2beea,
-0xc7e95c3a,	0x30e57e4d,	0xec214356,	0x7e10859e,
-0x1d5895d5,	0xdeeff6cb,	0xed1030ed,	0x827e603d,
-0x6b4b2de3,	0x83ec6fd0,	0xa64092f3,	0x8d9887e4,
-0xbefcbedd,	0x2111afef,	0xcb9abf96,	0x5c79ceac,
-0x9bf8a57f,	0x5d0e44be,	0xdca3d3b6,	0x9072d1ca,
-0x48e73a50,	0x8d0bc804,	0x6aea94d3,	0xc372403e,
-0x00000011,	0x14980dd1,	0xff2ade29,	0x768a5b1f,
-0x18ac6d5c,	0x455e0e87,	0x46ae1737,	0xce517cb9,
-0x020473ae,	0xa299d2a8,	0x69756da6,	0xfed24465,
-0x7e627d60,	0xd6c18c2d,	0x8409165c,	0x67d65a36,
-0x0a898865,	0x79035444,	0x8fac97be,	0xfbced0a1,
-0x5562edf6,	0xd683c850,	0x54cb0839,	0x47929e06,
-0x4d6bd42c,	0xd2cc07ef,	0xe1869b9d,	0xae55ba8a,
-0x02b186cc,	0x801d2a57,	0x23162402,	0x1c7cde17,
-0x497bb85e,	0x090606ad,	0x8d7775eb,	0x1bc5e744,
-0x11371ceb,	0x4f5a7aeb,	0x382daf5f,	0x1a3970c0,
-0x172f30b0,	0xc5ed2811,	0x603ef865,	0x1a4ff210,
-0x81287299,	0xbdf9d9ce,	0x03577eba,	0x75fa0e3a,
-0xc7778697,	0x4664ef64,	0xb30891ab,	0x27409db5,
-0xa2feff2f,	0xf7638682,	0x901e1696,	0x61625662,
-0xa9f71db5,	0x8475fef8,	0x957a55b0,	0x0507639c,
-0x3521a161,	0x57bc69ac,	0x93abc8df,	0xc7df8cff,
-0x776dc361,	0x4934e712,	0xd4581201,	0xf4b337a5,
-0x99cf4723,	0x8b2715a8,	0x487247bf,	0x6dfdb286,
-0x453a53fd,	0x88e17774,	0xe6f61002,	0xfe891e3b,
-0x0620cfee,	0x6bcc8052,	0x11207184,	0x125a5356,
-0x646c1884,	0x2601a0f1,	0x3a84e550,	0xb813fff6,
-0x2e66a034,	0xb5f968cc,	0xbf2b77bd,	0x65cb3af5,
-0x289a52ef,	0x1aff1abd,	0x503b9072,	0xc07e41ff,
-0x78087713,	0xa77e5425,	0x92e4f600,	0xf424b361,
-0x562bb01f,	0x78208ba1,	0xc0118f85,	0xb9620c7f,
-0x88aeee9d,	0x237c6911,	0x2038db7c,	0x35957f1d,
-0x451ba202,	0x4acfd66a,	0xe04da877,	0xefd37108,
-0xdbb01e2b,	0xe3ff9aa8,	0xca7860f0,	0xd95d9fa3,
-0xe8a0f1e8,	0xba2e7831,	0x9a1aa2a2,	0x5535a65d,
-0x27879bd9,	0xaa9d8570,	0x262ae91d,	0x476739cb,
-0x3b1f8d94,	0x2ce39fcd,	0xe1f64118,	0x5cc602e6,
-0x8a3c6e50,	0xe733c2e5,	0x58cf0ed4,	0x23842b39,
-0xcba6e922,	0xa88779eb,	0x5f45a57f,	0x3398ff7d,
-0x1c30ac9a,	0xb0d4a170,	0x1ba9b1ac,	0x4123dec5,
-0xe43463a2,	0xf13e7515,	0x6d8fce05,	0xcd499819,
-0xd91c60c2,	0x68086ab9,	0xdd3a01ad,	0x91336c64,
-0x3bf42ed6,	0xdef60794,	0x3506f8ad,	0x4099cac8,
-0xc4ad9796,	0x3347943f,	0x7b03e9b9,	0xcdb458e8,
-0xf50997ea,	0xddd26aee,	0x0c8434b7,	0xfa0126ad,
-0xc7902e08,	0xd6df491f,	0x168a82f3,	0xd4bcd3de,
-0x23dee535,	0x1eae8e13,	0x088fe4e1,	0x661b94c5,
-0x3551d689,	0x3d913667,	0xa2cd75bb,	0xcea61a1c,
-0xb987bdb6,	0xea1b1df2,	0x2754a729,	0xc487f029,
-0x58ba9638,	0x467f332a,	0x11336475,	0xb9b26485,
-0xdc4fd47d,	0x8c265433,	0xb862dbce,	0x6c3eac27,
-0xa7be9cd1,	0x9f0b9d29,	0x1f16f518,	0x71234b1b,
-0x728fe49a,	0x8e31bfc0,	0x4e0beeed,	0xe69e32e6,
-0xdda0bde8,	0x045910b6,	0xde786f8c,	0x496cda76,
-0x95476c8a,	0x8ada681a,	0xb94cccc9,	0xf9dffcd1,
-0x442004a4,	0xfd5d9ae4,	0xd1bb286e,	0x35471fb7,
-0xcc4aa935,	0xefa0a0e1,	0x870e142c,	0x8b836771,
-0x065a0efe,	0xc41adbe9,	0xc0d2a66f,	0x7c4a0b23,
-0xf86ca243,	0x045dc285,	0xce19da1c,	0xf6142343,
-0xb8d5f1ef,	0x038bfa44,	0x17591c11,	0x98002db2,
-0xe15409c2,	0xb4044cae,	0x4da885ce,	0xeaeb5810,
-0x62e54ee5,	0x41879946,	0x721cbd0f,	0x6edff1ad,
-0x721ae394,	0x90f7b14e,	0xe1b6ed04,	0x96460c22,
-0xc3249764,	0xb1ed84d7,	0x9d4267a4,	0x98dadb19,
-0x3671dde2,	0x33bb9671,	0x3f5de8b7,	0x5d486e43,
-0x19b2c92d,	0x5118290c,	0x18e6fd5d,	0x11e859c8,
-0x7f26e5a7,	0xacae907a,	0x157d46ad,	0xdd7e80d5,
-0xad7c15ec,	0x416c0e4e,	0xd7c8fa0f,	0xb3e61dc5,
-0xc957ecc8,	0x3ce4ce22,	0xa1716ca1,	0x32293474,
-0x71464f7c,	0xcf87342b,	0x9b991153,	0xb4cfd21a,
-0xfe1f2848,	0x25727966,	0x72b48d58,	0xe80e38f6,
-0x3a8eb709,	0xe93983d0,	0x39a98bd2,	0x955afc9b,
-0xbb4d95a2,	0x5ea1c16c,	0x2dca4b6c,	0xe1841464,
-0xf29b6834,	0x0898d1b1,	0x3cbf6824,	0x332036a9,
-0xd2045fce,	0xceb43c07,	0x7ddd72e7,	0xd8495f8e,
-0xd62595df,	0x1f48a356,	0x3c810c08,	0xa8b18be3,
-0x40aa0d34,	0xe1c6da7b,	0xa0c63ca0,	0xa3978b77,
-0x08346409,	0xc7c879d5,	0xe4533936,	0x6e469855,
-0xb5e92af7,	0xab14fcf6,	0xbb9d581e,	0x1ade2f8d,
-0xd87bafa7,	0x4f23ff92,	0x0c7b1083,	0xfdb31cd0,
-0x8668005a,	0x4a3b5d19,	0xa2615960,	0x7c1fcf3c,
-0xbc751468,	0xd959dace,	0x3ec35d36,	0x39a2254b,
-0xaa59fc84,	0xa848bcc2,	0x4573f9bb,	0xbdb60b61,
-0xe3fdaa82,	0x2b33ca86,	0x761b49e9,	0x7794b324,
-0xc000cc24,	0x1e8fb5bc,	0x103b6e35,	0x2a38365e,
-0xe0c618a0,	0x6a073c0b,	0x7e8f601e,	0x5a09e07b,
-0x7d40e359,	0xa21e6187,	0x2e78217c,	0x41a9872a,
-0x8b77e812,	0x6d5b951e,	0xa3b9e595,	0x74a50d79,
-0x316461a2,	0x62f97340,	0x3e3d072c,	0xb6254c73,
-0xdd88bcc6,	0x7037a3be,	0xd456b2d3,	0xa721fe50,
-0x43a33949,	0x3645fa38,	0x9dc6dcd3,	0x377c04b2,
-0x9b89649f,	0xdab2ca19,	0x9b4ef5bb,	0x2e2ca48f,
-0x4feb859d,	0x2c6b42fe,	0x087f84a2,	0xf17ba799,
-0xb37b0a19,	0x8ed04361,	0x188a1f73,	0x5185d421,
-0x3129ac67,	0x94116de3,	0x607820ba,	0x76a1a9ff,
-0x6808755e,	0xf2e508da,	0x6bca967b,	0xbc3a7b70,
-0x769b9d11,	0xe925e390,	0xe26e3039,	0x220a75c6,
-0x334eff5f,	0x55624cbd,	0x5c2e9f3b,	0x64cab7cf,
-0x84c65fb7,	0x5ad7a323,	0x6f3c9efd,	0xee96b7cb,
-0x6bb73a9c,	0x4604624e,	0x0e2473ae,	0x2aea52e0,
-0xf3b8abea,	0xc5aed750,	0xb7763e2e,	0x4a766d95,
-0x1d52e854,	0x22b32f4b,	0xe17119cc,	0x0608ecb3,
-0x23f3cf11,	0x12259854,	0xaf57c24c,	0x36a3eb84,
-0x9f5919a6,	0x1136d736,	0x547c8a00,	0x9915aab7,
-0x0682f3f5,	0x3cb9a6d9,	0x5696fe64,	0x7a01e206,
-0xdad7dfd5,	0x4b8478cc,	0xfffbef84,	0xafab5584,
-0x754ac2fe,	0x110f52e8,	0x1cf6a7e8,	0x80266a8b,
-0x0711c4d9,	0x66086a99,	0x42a9e502,	0x149355a8,
-0x00b487d5,	0xf7321320,	0x87b56421,	0x5f7873bb,
-0x00536403,	0xfc3d0487,	0x5d8dba88,	0x6d5dfedc,
-0xfa65f000,	0x0a5b14b8,	0x2df04874,	0x13183539,
-0x4737d8b1,	0xf4172265,	0x844ee0ad,	0xc9b413b0,
-0x9316b83c,	0xbb018c85,	0xc078bab6,	0x24fb2bf7,
-0x733611d7,	0x66a4d719,	0xb8f0426a,	0x638ac2d0,
-0xf907257c,	0x292bd026,	0xc9bd1b1e,	0x0a3934a2,
-0x0069eb7a,	0xe5fd66f6,	0x63469a35,	0x4ad4eb60,
-0x4abe9ffd,	0x1b286736,	0x113f8874,	0x3f9c821e,
-0xbce34a08,	0x1400b4e7,	0x578df00f,	0xcb530a93,
-0xe442bc4b,	0xbd819631,	0x6ebd2f56,	0xfa3948f1,
-0x75065d40,	0x755d1058,	0xa27d9259,	0x861db21f,
-0xd6d28943,	0x77522729,	0x63fa2986,	0xa509bc80,
-0x8ab9d121,	0xbec0ec56,	0x66a591aa,	0xf26a6e0f,
-0x2bcd477f,	0xd3fe7ba0,	0x5988067a,	0xcddf746f,
-0x0a4a29e9,	0xcd933731,	0x59cf2422,	0x025781b4,
-0x421cb3ab,	0x1799b8c5,	0x21e32df9,	0x4c8dc991,
-0xf198b552,	0xc8f23b9d,	0x71d1f473,	0xc8cc0d68,
-0xcfe13358,	0xf0544e3b,	0x76c15708,	0xf6373299,
-0x9c77318c,	0x500e4421,	0x17299f4f,	0x71165140,
-0x4d1e1550,	0xcfcbd28d,	0xa70f96e2,	0x6b8af010,
-0x409e14b1,	0x02269fee,	0xb0a3dd80,	0xe6c939fe,
-0x8e5b0076,	0xc40ba65d,	0x01f0b8f3,	0x3370e39c,
-0x300d639e,	0x0896c55b,	0x5a0f41a7,	0x4d0ddc60,
-0x3fa3f82d,	0xbc582569,	0x102f2e2d,	0x3c2a016d,
-0x8bb0a47f,	0x7a751edd,	0x458a7b8d,	0x6c3b70da,
-0x15900727,	0xcb97fafd,	0xdeb5d4cf,	0xa5659a09,
-0x455d6a86,	0x9ec18406,	0xcd6a72af,	0x9831993e,
-0x2f18a892,	0xdbc415aa,	0x4b8d3261,	0x57739a68,
-0x2cf8702e,	0x70977ca1,	0x80b3caab,	0x806a09e5,
-0x1d445591,	0x2ff0092d,	0x8d8fade8,	0x6e1f8806,
-0x4a9fcce4,	0x0d73397b,	0xb5b86afb,	0xc8816f25,
-0x191b7360,	0x4ac340f9,	0x82e6d123,	0x0f470975,
-0x7c304147,	0x7bbb635b,	0x28f8cab6,	0xc109b6c2,
-0xb06bbcc3,	0x4ca536ae,	0x3ae30e66,	0x483f6ab2,
-0x560ab845,	0xf5289929,	0x45843435,	0x342f826e,
-0x172c2cdc,	0x17ec9571,	0x947a4b57,	0x2b1de023,
-0xf10ac853,	0x9ffa7c2d,	0xde2ff682,	0x426caa39,
-0xcb482471,	0xc36c15ce,	0x04af08bf,	0xb80b1e08,
-0x0d01a541,	0x942354c0,	0x4251c668,	0x50ffdf5c,
-0xf19096d7,	0x5813c93c,	0x5c6b1107,	0xff86f985,
-0x71092390,	0x15aa7c73,	0xcab0715d,	0xc8d9e6cd,
-0x828aadef,	0x8fb2db36,	0x2e3d2375,	0x8eb6f9ee,
-0x52006fe7,	0x503cc554,	0x41d9c3ee,	0x34f41d9c,
-0x6d1d6d0e,	0x0ce78057,	0x091f714e,	0xa49309b0,
-0xaa1b9f14,	0x572c2871,	0x974b185c,	0x8e5b5595,
-0x61dbb6f8,	0x5ecd681c,	0x2f6d7a0d,	0xd892944e,
-0xb6927173,	0x0c0ef47e,	0x70b7396a,	0x8cbc3353,
-0x2af3e2b7,	0x53e9688c,	0xdf68696b,	0xc86dc91c,
-0x00311bf2,	0xa1760482,	0x72232938,	0x38ee8f77,
-0xd53fba4d,	0xabd9ad0a,	0x66168574,	0x017f3e34,
-0xdf327344,	0xd6eae249,	0x7b22f8c1,	0xa5b2bc42,
-0x969f4cd6,	0x95f5fc6d,	0xfdb7c7fa,	0x112d3ee6,
-0xeaf67b74,	0x0a5a6e73,	0x18df20e0,	0x38236a5a,
-0x8130a173,	0xcb3b5b7e,	0x35206d1d,	0x5e050e33,
-0x8deb6f0d,	0x60ce0dff,	0x07728a31,	0x6f3a04ae,
-0x7831b5d6,	0xa4fbd66e,	0x6bd2e736,	0x5c3443fb,
-0x7432fdf7,	0x692a74d3,	0x5dce3459,	0xb93de5d1,
-0xba81594f,	0x39a8a15b,	0x48e26bf0,	0xcb41f36d,
-0x09ddea57,	0x352b3d01,	0x0a12ff41,	0xa86206ac,
-0x478e88d2,	0xf0ee2844,	0xe206e58c,	0xbacd48a2,
-0x5260a7d0,	0x1dc5fa78,	0xec9fbc75,	0x37ef6350,
-0x94f946af,	0x64a06436,	0x5c02f667,	0x14c38a00,
-0x26c482ef,	0xef0317fc,	0x5d19eaf9,	0xff738f59,
-0x70db8622,	0x6ea24943,	0x00f30923,	0x2e348bfe,
-0x2fd943f2,	0x192450d3,	0x6aada8e6,	0xc2d84796,
-0x50c96742,	0xb7c47e4d,	0x6b7e869f,	0xffdc3ef5,
-0xe6ee5077,	0xff3704f1,	0x985c9e46,	0x1adcd42c,
-0x63331397,	0xd12eac83,	0x7795ac6e,	0x30ae7325,
-0x1caf85ed,	0x37c2cc82,	0x4f9f0c36,	0xec6ce943,
-0x1ba39119,	0x50c55c47,	0xe4ef5731,	0xc0a76ec7,
-0x8c85871e,	0xe15213ca,	0x2b1b738e,	0x0e424959,
-0xb0573335,	0x040cd859,	0x49776ee0,	0x0b2612f5,
-0xfebb32c2,	0xe8be8760,	0xa0138cb1,	0x889e9ca8,
-0x2e48ccf1,	0xb45bf39b,	0xe5412271,	0x1b6ef4d5,
-0xc282196b,	0xdd0639fa,	0x521c55ae,	0x58b95195,
-0x6857a9b9,	0x9f2bbfb9,	0x7c225192,	0x28acb34f,
-0x3d3a6f5a,	0x91abfb0c,	0xed76cf8c,	0xd323d447,
-0x65d8fe44,	0x876b3183,	0x0334168c,	0x8711195e,
-0x1aa1db76,	0xdea97171,	0x89e188d0,	0xd1425753,
-0xbdbebe5e,	0xd0fdd27b,	0xde9ba2d5,	0xf25f0953,
-0x6f7a5334,	0x239f2b0d,	0xc3249498,	0x0d97b723,
-0xef18c9a1,	0xbbc19fde,	0x628b7257,	0x5ea12b66,
-0x2bfeedf6,	0x072d6f46,	0x219421c6,	0x8904644d,
-0xa06c8bf1,	0x0c15f545,	0xfded658e,	0x7a2f4106,
-0x498a95f8,	0x53d6c015,	0x553268be,	0x31069c90,
-0xc304dcd3,	0x9c404feb,	0xe77d8958,	0x0f80a1d7,
-0xf6c38319,	0xe30bd224,	0x3a1d6495,	0x9878e6a8,
-0x4a873482,	0x038ac7d5,	0x198a11c8,	0x40e7dc31,
-0x93aba328,	0x7641c2f3,	0xe6086e71,	0xb3897f90,
-0x68639089,	0xa6c9d34f,	0x0ebd25e9,	0x8f024790,
-0xf33312cd,	0x317fe8c5,	0xf0488ef8,	0x1c5dd332,
-0x6c92abfe,	0xd62338bb,	0x74cf66b1,	0xdd56bdbe,
-0x7947870d,	0xec8d9f29,	0x06e28ec2,	0x316b1f94,
-0x766a4502,	0xd1825c99,	0xaaf9234f,	0x2ea72492,
-0xbf4749e6,	0x4e3baa89,	0xa31b81e3,	0x9de5cdf1,
-0xc032f0f7,	0xd56bc9cc,	0x52d82ac7,	0xf7138aac,
-0x9941380b,	0x8224d67f,	0x2ac8e885,	0x83edb999,
-0x58fcf382,	0xd3c8bce4,	0x53886d55,	0xadbe82fe,
-0xb21b6a4e,	0x836838aa,	0x71f632fa,	0x3e621403,
-0xb9c81a6d,	0xf4e3cfe2,	0xc3032aee,	0x2ffb4713,
-0x7ddcc17a,	0xc0349cab,	0xea36e040,	0xa5167672,
-0x0cb7499e,	0xc55eb59d,	0xb3a2333a,	0x37edbbe6,
-0x7abe8507,	0xf99505e7,	0x09b0aedf,	0xfb1e1387,
-0xc118cef6,	0xf109555e,	0xc2b9ac82,	0xe52ef3bf,
-0x2be6f4fc,	0x9f6b3390,	0x3e59aec6,	0xc6c8666e,
-0x2e016135,	0x695d5c12,	0x405afd84,	0x3f90d859,
-0xb0d11081,	0x60e0ecb8,	0x089ea644,	0x28c2c21d,
-0xc5c1b3b7,	0xfb14119b,	0x9ad20b9f,	0xae32664c,
-0xbca23d54,	0x1a47db36,	0xeec84a67,	0x515536ff,
-0x38c245f4,	0x83e0a08a,	0x2229a519,	0xe60d7871,
-0xe8ee5179,	0x341602e5,	0x453a15ff,	0x83a55bd3,
-0x5513acbb,	0x1657e8a2,	0x8284f814,	0x706684ef,
-0x13deb278,	0xbd3c9921,	0xff6a3dc7,	0xa04994a4,
-0x19f6d089,	0x7f505d1d,	0xb8b075cd,	0xeb0f3be4,
-0x6fc2d4f5,	0x37f5840d,	0x17fad37f,	0x4fe71d23,
-0x424fe1f2,	0xad86001b,	0x5645b172,	0x9aaa2d0b,
-0x28058255,	0xbe3140e4,	0x97d1e959,	0xdad9a815,
-0x2ca7014e,	0xae8a3947,	0xc07ab273,	0x9c215b25,
-0xfc9b4f63,	0x649a14a6,	0x40f20730,	0x148387f8,
-0x7706de96,	0x6c44784c,	0xdd76ce12,	0xbb421926,
-0x62e18378,	0xbfa9e559,	0xd76763fc,	0x3e24de93,
-0x20d75b75,	0xf19f0788,	0xc6f7b50e,	0x7d7a3f62,
-0x656f60f7,	0xb1068519,	0xe17d0728,	0xb56fcea6,
-0x75beee44,	0x7998c910,	0x266d3508,	0xf0a977c7,
-0x02866510,	0x21ca1fad,	0x471d3c70,	0x204ba687,
-0x9680a3d9,	0x02b818df,	0xac0374c4,	0xe6a48910,
-0x0e33d542,	0x677abf13,	0x8d83c3a1,	0x7a2eda35,
-0xd40fdebe,	0x6b0b5fbc,	0xecce7918,	0xcd68eae5,
-0xdd6a3e0a,	0x05be5f69,	0x5c3990d7,	0x60d3dbc4,
-0x3cb5923a,	0x9a8d643e,	0x1711f7b4,	0x9bab6d65,
-0x8393d3f0,	0xaadb08f2,	0x075ed3a5,	0x29c34152,
-0x935f10a6,	0xef7279a4,	0x63532e9d,	0x26afe572,
-0x6dc112e6,	0x47c97684,	0x6eccb9e1,	0x90da8c44,
-0x6e04bda3,	0x80f19b22,	0x2196273b,	0x1ee245cb,
-0xd55dcf1a,	0xc7cd14d8,	0xf244515b,	0x055aa301,
-0x0c9fce9c,	0x755faa4b,	0x96d5a956,	0x259f4a45,
-0x430868ac,	0x4b55f57d,	0x829f134a,	0xe139fdbb,
-0xe05dcf2a,	0x3bf268ee,	0x904d6baa,	0xe6d8bb7d,
-0x1bbeb22b,	0x45db4f3c,	0x960bdd27,	0x4ebba6cc,
-0x0bc84549,	0xc17d6bba,	0x9911fe90,	0x462f4ff0,
-0xb0108424,	0xbb0e397d,	0xf5285eda,	0x5a7db808,
-0xc70b87c5,	0x994cfd51,	0x13eab491,	0x2d4c1489,
-0xbec93d95,	0x5e99f60f,	0x3ed154c7,	0xfd6edd85,
-0xb2422fb4,	0x4709edce,	0xae51e4f6,	0xf89d18a7,
-0x30094d52,	0x63744563,	0x379b69cb,	0xbb8c19d9,
-0x7aa2c0cd,	0x16bc4ab3,	0xe1b2e442,	0xbf5e198f,
-0x0dd3e057,	0x07c5413a,	0x3a0e9d35,	0xb47307b8,
-0x77aa24b9,	0x2fd8fb55,	0x77d80e99,	0xf3f6e93f,
-0xff13d117,	0x2a6739bc,	0x5c8908a6,	0x42ced515,
-0x253d954f,	0xd06c3da7,	0x4788401a,	0x19b04ccc,
-0xca15f3ad,	0x76f1110d,	0x21e1e1de,	0x879233a2,
-0x9fb391c3,	0xdd50ff87,	0x9e661729,	0x8cb80e15,
-0xa36ddafd,	0xf55f913d,	0xc9b19482,	0x7e097acd,
-0x86e47ac3,	0x347f1069,	0x0cf15cac,	0x997cfd01,
-0x4e5c32d2,	0x0a4a38c0,	0x955dcfd1,	0x75be3729,
-0xed177186,	0x6e6a277e,	0x89caee2c,	0x605f9c12,
-0x539bcadc,	0x34abf93d,	0x96c9643f,	0x0f34633d,
-0x36fb15c7,	0xfb7bba4b,	0x212585fd,	0x42b1347c,
-0xd3ac6ead,	0x164c64e3,	0xddcacd07,	0x186d85d7,
-0x117cbeb6,	0xca9c9fab,	0xa568bd38,	0xd60e0da0,
-0xb98fa69c,	0x93a6c623,	0x194441b5,	0xe654f1ba,
-0xe2a3cad3,	0xe5cf7b3f,	0x1614a3c2,	0x9b078402,
-0x52f37d97,	0x187e9dda,	0x00fa2b8d,	0x07ee62d1,
-0x5a5ea2bd,	0xb1e6ed54,	0xb1c24a2a,	0xf41fbba1,
-0x92d967ec,	0x4df103ed,	0x1d1ddaf4,	0x705c34b7,
-0x08330af3,	0xbe45833b,	0xe874998d,	0x1a22a9ce,
-0x83ab6702,	0xcf2a6656,	0xc08758bf,	0x74c56ecd,
-0x1afd607a,	0x51bf6406,	0xa302d55c,	0x0ac43266,
-0xadc985f9,	0xa9ac229d,	0x4aa82f77,	0x3afce1ac,
-0xaf8d5c80,	0x217fb5c1,	0x94c92311,	0xaea31486,
-0x7788cb41,	0xb61c75c8,	0x062a0888,	0x7609920c,
-0x5344faec,	0xdf10b710,	0x8c8673e1,	0xb39462ab,
-0xc3a2bb23,	0x16b93eb6,	0x394ff960,	0x8d81ad20,
-0x9f9e1fd6,	0x8a70894b,	0xf96c2c50,	0xd8474239,
-0x53228736,	0x68540ee3,	0x3cfa5c8c,	0x8cb74254,
-0x13b497fa,	0xb537a6fa,	0x1967e5bd,	0xa638ae8a,
-0xafbc06bd,	0x72e905b0,	0xaf6b12ad,	0x76b3fe92,
-0x90b6100f,	0x23db02cc,	0x859aa5d8,	0xd702fb4d,
-0xa39e940a,	0x66c4f206,	0x17bd0770,	0xdc1224e1,
-0x1e4e9f1d,	0x79f7cafd,	0x1209e815,	0xe1f6d276,
-0x83b1eabb,	0xf3403674,	0x8f01d66f,	0xcfa6007e,
-0xdbff7fb5,	0xdec0cd24,	0x357ed4f9,	0x6f17697f,
-0xd15622f0,	0xc410ebbe,	0x442c6c05,	0x96f90c65,
-0x447b9422,	0xc675767d,	0x6e9f036f,	0xac53aa34,
-0xf889e572,	0x322bbdd4,	0xef947e08,	0xb39a0c48,
-0x27e05184,	0x4dec6c99,	0x5b351ffe,	0xc22e0ad9,
-0x2f89f4cc,	0x353dff3f,	0x8b45b885,	0x224452f9,
-0x01f9addd,	0xd535ba80,	0x76b2d5ee,	0xe4a5d1d0,
-0xbce3274b,	0xe2b86efe,	0xe4ec7a5b,	0xecd4723d,
-0x9167ad13,	0xc6588e4b,	0xb4de5667,	0xbd7780a7,
-/*  2336-m106fbB6.inc  */
-0x00000001,	0x000000b6,	0x07132007,	0x000006fb,
-0x5e5a71a7,	0x00000001,	0x00000010,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x000000b6,
-0x00000035,	0x2a000000,	0x20070712,	0x000002f1,
-0x00000001,	0x000006fb,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc67566b4,	0x105501ed,	0x8a79141f,	0xd976d998,
-0x39025e8d,	0xc8d4def9,	0x136f7e41,	0xd876436e,
-0x58d10d9f,	0xb7f2421d,	0xe4d5fcf1,	0x02889a15,
-0xad9bed07,	0xa32ab3e6,	0x3491afcc,	0x9c991c37,
-0x2a1c2071,	0xf066191a,	0x3bd898e7,	0x2648d958,
-0xc05f7908,	0x05864b9b,	0xbe4c1eee,	0x1e6c7ef4,
-0x0e7a539e,	0x100b2ab3,	0x1273dceb,	0xfec8847d,
-0x8f37946f,	0x634e3b5c,	0x691dbd61,	0xd89e3cb9,
-0x094639d4,	0x7d972e1a,	0xd6dbd94d,	0x2001c3ec,
-0x34f791f0,	0xeee0d794,	0x88b7459d,	0xc2c73aa3,
-0x607a174d,	0x4f0f8304,	0x65790b35,	0x00532bfe,
-0x1fd1e0cc,	0x7b91f873,	0x154ed42b,	0x7a7108e9,
-0x81637c95,	0x192cb173,	0x28ccd94e,	0xb9bcc372,
-0xac05171b,	0x867f47da,	0xf8e8c47d,	0x1edcdb4a,
-0xd2ca6c2d,	0xe9ee9169,	0x5a6efedc,	0xb6825038,
-0x09277eaa,	0x2a34e580,	0x0f794366,	0x86c99402,
-0x211b98bf,	0xdf8eb0e3,	0xda11d7bd,	0xd440363e,
-0xa7d49f1a,	0x16dd7395,	0x5b23c2fc,	0xab93ea3c,
-0x00000011,	0x8d12ea76,	0xc5c9c349,	0x92308263,
-0xf78e4c9d,	0x72c29f88,	0xd19a18ac,	0x1c90e94d,
-0xeb8c5d92,	0xf7bb5a98,	0xa62ae1bb,	0x1d37396a,
-0x191737e5,	0xe423c9c2,	0x1c16fae4,	0xb95f9692,
-0xaeae4fbf,	0xbed4707f,	0x70f70fa6,	0x3e80ad8a,
-0x668f54d9,	0xff968f7e,	0xc4e24190,	0x0872ccf0,
-0x4fa39955,	0x55a1a6f5,	0xc36d7848,	0xe82e7047,
-0x3ea79a72,	0x27411065,	0x55930d6f,	0x8e94ddfa,
-0x6008c698,	0xb315b1d6,	0xedee441f,	0xd3875916,
-0xd0a76bae,	0x14ef297d,	0x6393320d,	0x69d787dd,
-0x7973bdd6,	0x7e5c4c27,	0xdfe61741,	0xc631b12d,
-0xcc99b991,	0xbeed1d1b,	0x9b3c5535,	0x78a48b4a,
-0xe278d8a2,	0xf1c80ebe,	0x70f3ed4f,	0x4744194c,
-0x53503244,	0xf94ab448,	0x04f48675,	0xa91912e6,
-0x0fbe4a37,	0x22dd31d7,	0xc7b0cb0d,	0x752eebc1,
-0x83141b0c,	0xb59e8702,	0x5efa7721,	0xc8440cd4,
-0x94a00db5,	0xfafd13f4,	0x878cc0a0,	0x735a935a,
-0x456ae71e,	0x405aa5f4,	0xcb272526,	0xeb85d034,
-0x91f58175,	0xbab6094c,	0x48426d3c,	0x18bb5eea,
-0xe9ee4304,	0x0868f031,	0x29413b52,	0x29ab13c3,
-0x575646eb,	0xb24f2668,	0x142b91b2,	0xfa969908,
-0x12b79a91,	0x38bc2ba2,	0x525e5da2,	0xabc63db2,
-0x9bce15d9,	0xa2d2a006,	0xa1744c42,	0xf64f876a,
-0x4121f17a,	0x0e24d1b5,	0xb27a09dd,	0x2741ca03,
-0xd83fe2bc,	0x59a0aeee,	0xe861ab21,	0xb304ca71,
-0xb8bc5b2b,	0x1553f2c5,	0x5d078685,	0x3de43e77,
-0x8e1f2eb1,	0xa9eb40bc,	0x3bcb1973,	0x4721b5b6,
-0x73e23954,	0xa9464b92,	0x82ad836e,	0x56b8a136,
-0x4bb95ff6,	0xa538c8aa,	0xe2bf3da3,	0x1347a40a,
-0x34f844c2,	0x596ab878,	0xa9f94b32,	0xdad18fd1,
-0x6f2fda04,	0x09c10ec7,	0xed4a2d3f,	0x375add96,
-0x0ae45688,	0xa594039e,	0x8fdae080,	0x7f3f4a68,
-0xef496e17,	0xab450c5e,	0x9a43c59c,	0xf5394c3a,
-0xf09dd852,	0xb9b41813,	0x45ed7124,	0xcfe1955c,
-0x7e3eedcc,	0xf4603b14,	0x1907131c,	0x5b45ade1,
-0x154c8205,	0xcf98affa,	0xfaf58903,	0xa071e600,
-0x0814f47e,	0xacd29fff,	0xa9246964,	0x7a638372,
-0x3d1061b1,	0xba47647e,	0xd1fbee16,	0x896dd880,
-0x1c100f37,	0x99cb8778,	0x48062c08,	0xd0366a79,
-0xa6d7ddb8,	0x86c68a9f,	0x02ac6f34,	0x0e144676,
-0x20d43c65,	0xcb6a9b99,	0x0e1c9291,	0x9cfd5b8f,
-0xac43cbcf,	0x34a7974d,	0xce017104,	0x975c2efc,
-0xd55c5dbb,	0x0e16766d,	0x890dfd62,	0x2934622d,
-0x709fa149,	0x21a94f12,	0x43113498,	0xb146aa2f,
-0xfbbca7ff,	0x1782cec2,	0x9ff3b595,	0xfe4b2b95,
-0x0fd2fbd8,	0x1651f923,	0xa74fe4cc,	0xd07a49c0,
-0x0d0adba2,	0x9c70bce9,	0x08e8b8d7,	0x32dbe104,
-0x6168b74f,	0x7a24fdbe,	0x5e3b2564,	0x6ffe5439,
-0x1e7721c4,	0x94af4976,	0x1391cec8,	0xafa04102,
-0x79d64355,	0xd88737af,	0xa2f2298f,	0xc980628f,
-0x465e2d9b,	0x8b2bfcf2,	0xc46fb4fd,	0xc352c65c,
-0xa3064ff7,	0x3b9264da,	0x7427ca4b,	0x41c01632,
-0xa2d1ed33,	0x6cca9f3f,	0xf8b67421,	0x305e1584,
-0xc9732051,	0x89a0091d,	0xc374e441,	0x587ab4e7,
-0x958dd99b,	0x286d9f81,	0x10c67cdd,	0xb85d1783,
-0x67b38f42,	0x30b90891,	0x45894054,	0xd050199d,
-0x130063b6,	0x7b5e0863,	0x8a61c4d6,	0x2c44fe2e,
-0x148428aa,	0xaa587921,	0xf542fe2b,	0x7b7da7e5,
-0xed3bd14f,	0xb2616902,	0xc840e668,	0xb2623ee3,
-0xbfc63cca,	0xed8b82dd,	0xf7d3cb2e,	0x41eab7ed,
-0x8c3bfe0a,	0xd24a3c82,	0xd6d3d9be,	0x3aedf032,
-0x957a863f,	0x04d80868,	0x1a59e52b,	0x52ee31fb,
-0x8aa7dfa0,	0x2dfb638d,	0x2967e9cd,	0x0aa67bda,
-0xd87b2b96,	0xea23ba62,	0xd6c97957,	0xa6f1cc56,
-0xac8c9465,	0x3408348f,	0xc82fc701,	0xdf1d0e14,
-0x11f617a5,	0x93f4964c,	0xebfae6fb,	0x07f0a028,
-0xb40c5b7c,	0x6c0f33f6,	0x854abf0a,	0x89e518d1,
-0xfcb70776,	0x1cf65ddc,	0x1dc0ae2e,	0x418ff41d,
-0xafbc49f4,	0x064e2e27,	0x35ce2cc0,	0xece5ac9a,
-0x7c245d5d,	0xf22af2a7,	0x5a5df3a5,	0xf991e2f4,
-0xcd0b15fd,	0x68bd046a,	0xd29d50c6,	0x1e691c01,
-0x7a4d3cd5,	0x2f6275da,	0xf1cee3f3,	0x84261101,
-0xd32ecfdc,	0xe75fdec2,	0xc02846a8,	0x13f19aa6,
-0x3dafe115,	0x2c2b0488,	0xbb9da407,	0x196198eb,
-0x897db3b0,	0x58813217,	0x917af6ba,	0xf7fa30ff,
-0x277c26a1,	0xde9ffb6a,	0x85eb946a,	0xb9a6295b,
-0x3f7f687a,	0x17fef8a5,	0x3af23085,	0x457a11a3,
-0x2a73b9a7,	0xedbfd16a,	0xd2e88242,	0x1e3c02e5,
-0x0ea74671,	0x1fc9e250,	0x5a313d7d,	0xd5a49528,
-0xe749e126,	0xdf0de086,	0x35b60d77,	0x07fb5491,
-0xdedda50a,	0x51325ec5,	0x8cef16c0,	0x5dbc5f47,
-0x0c02a13e,	0x76604b7c,	0xbfef93fb,	0x3e7f0bf0,
-0xd1add7e3,	0xdd6c3a85,	0x6e1e119e,	0x38278895,
-0xa8df00b8,	0x19f99ab9,	0x368b3ea6,	0xcde20a8b,
-0xf7acd01f,	0xc59c84f9,	0x0a0b6d38,	0x18cb2d96,
-0x37544234,	0xc2c89561,	0x603d7483,	0x8049a647,
-0x86cee8e1,	0xfab3b928,	0xbf53d180,	0x548aaaef,
-0xd0840b5d,	0x56475635,	0xa29f7fea,	0x1db9078e,
-0xc29beac4,	0xe34189e0,	0xae65a95a,	0x5ba92288,
-0x50152e52,	0x9ce2d6cc,	0x1a602dca,	0x72671a71,
-0xde59b037,	0x7adb5fe0,	0xcadf39c4,	0x7110db44,
-0x00200eee,	0xf2a574d0,	0x7cc14a56,	0x9b01c7c7,
-0x363a0d5b,	0xff8a60e8,	0x34e900dc,	0x567b5d4e,
-0x6b52d659,	0x82e22016,	0xd2e6cb9f,	0x611391c9,
-0xe99bad01,	0xc6e46ebb,	0x14e29144,	0xb8e85f81,
-0xea508116,	0xae7aa3b1,	0x6d535779,	0x673ec856,
-0x285dfb55,	0x4671b198,	0x21491515,	0x1fd77e2b,
-0x1dfbfa06,	0x442161e9,	0x0dfa5161,	0x9ba818fe,
-0x708a8e17,	0xc9754986,	0xeef3ab77,	0x8caa3151,
-0xfe6d3b59,	0xcfba71e2,	0x780b6c3f,	0x0fedcdbe,
-0xb3dfbdf4,	0xbb0d7953,	0x1d9450d3,	0x58d71d72,
-0x09d71b70,	0x679bd3ed,	0xd68bfb24,	0xe93470ed,
-0x36b2a64a,	0x6ddb8077,	0xd6968654,	0x29868706,
-0x30af7610,	0x0fc9eb07,	0x10690e76,	0xfe62ee78,
-0x9ffb3fc6,	0x0c34f0e5,	0xbc01db4f,	0xd4fbb08f,
-0x4420b704,	0xa4af88c9,	0x0a3ae196,	0x6af40c74,
-0x08d58801,	0x886ba013,	0xd70a4f3e,	0x924c5830,
-0x494ee315,	0x90f62676,	0x727c427b,	0x78e0fb4b,
-0xf9b4508b,	0xac37411e,	0x8e1f7b36,	0x54778002,
-0x00080c22,	0xd55e89e6,	0xef8b0961,	0x43eab9ab,
-0x98e8e142,	0x9ef7eb71,	0xb1b0a6f8,	0xb259fec7,
-0xd04d9f7f,	0x873a79fc,	0x6dff58bb,	0x7747a1ef,
-0xef25d604,	0x21eb7b76,	0xee7cf400,	0x11056351,
-0x57ecdffe,	0xfe939145,	0xf52794bb,	0x55917634,
-0x9fb4d599,	0x5bf73f5e,	0x11382735,	0xc6cba6b8,
-0x3ce059fe,	0x88f1bfbf,	0x4ed5941f,	0x9009764a,
-0xf9c7f463,	0x0f28df41,	0x8cad66cf,	0x3ea7591c,
-0x6707c286,	0xd47cb952,	0xf53392e2,	0x94e1a29e,
-0xd4fb88f4,	0xa5fcaf93,	0xf5ba3444,	0x91249b70,
-0x0bbeb5c9,	0xf943bfe9,	0x92629f51,	0xbc10d3f6,
-0x9564f091,	0xad4bb29e,	0x0a50af33,	0xe8f79296,
-0x8bf25c64,	0x81bdf02b,	0xec22d493,	0x0d2efea1,
-0x52e2a6cf,	0xd412701d,	0xa17df71c,	0xb9f62247,
-0x4d7b517a,	0xa9bd93a0,	0x94fb1eaa,	0x2d4bc7fb,
-0xcd857966,	0xaf4953b6,	0xf664d4a2,	0xf1e12279,
-0x1827aa2d,	0x6db71721,	0x28159f88,	0x9df25ab6,
-0xa97443a9,	0x378b6644,	0x6ceebaef,	0x0e01e9fa,
-0x048cf8b0,	0x962c3d48,	0x2d375c33,	0x407593a6,
-0x693e2d8a,	0x9d5a557c,	0x44863ad9,	0x6ab3e26e,
-0x3ec52d9f,	0x0933fed7,	0xa7b06032,	0x266f3a2f,
-0x02575fdc,	0x2224ba45,	0x71c02d29,	0x1b08c7d1,
-0x8b2200cb,	0xfc1c9a92,	0xbddc0508,	0xf3220cb2,
-0xcf373ecb,	0x0dce00e9,	0x59e970e7,	0x0bd36624,
-0xbbd1ce75,	0xa8641ec8,	0x06937187,	0xc3f2d380,
-0x8a7adc67,	0x79f67552,	0x7fdf88a5,	0xb6941a6e,
-0x0aafe9d5,	0x1d86eab7,	0x9240d112,	0xca6c7aac,
-0x6ebaa150,	0xbba6c64f,	0xf20ec41c,	0x14a3c3fd,
-0x8e3db21b,	0x66ad6654,	0xd339f5e1,	0x749714f2,
-0xb22ba620,	0x9f4f0119,	0x3745aaec,	0x5ba03b86,
-0x10bb4d86,	0x96309fe1,	0xf93c8620,	0x901c3170,
-0x3224e497,	0x453639b7,	0xc8cb8101,	0x860a60c7,
-0x10a69fae,	0x5cd0cf62,	0xf0c9fe79,	0x49b7f0b5,
-0x89c719bf,	0x8caf497a,	0xca747cd6,	0x4a0cfabc,
-0xb2f2cc33,	0x2768703f,	0x89e7e499,	0x44dd965b,
-0xf7a772d7,	0xdd508108,	0x8a43b845,	0xba5a74e5,
-0x6ca47c79,	0x72b9e0bc,	0x9479ce84,	0x3342f0b1,
-0x9a39e2c0,	0x57808b69,	0x288ff4b6,	0xe5fab877,
-0xed07f654,	0x0ee79da9,	0x02e7b183,	0x456fdb53,
-0x11aeeb6c,	0x8c2fadb9,	0x67f79309,	0x2f97a264,
-0x02af0d27,	0xf07f9608,	0xb66fd12c,	0x25e6bbc7,
-0x92001908,	0xc52170a0,	0xc9fa7f41,	0xbf361c71,
-0x33cd7f76,	0x776f9b61,	0x459cdfe1,	0x065dbdb5,
-0x67a6f1d1,	0xcbbee73d,	0x2f7b516c,	0x1fda5e43,
-0xeba7d6ab,	0x337c3557,	0x1f2477f5,	0xeec7d493,
-0x749fa13a,	0x3c37e01d,	0xa78babcf,	0x9ee438d4,
-0xaa57066a,	0x9efe96c5,	0x8d45bd8b,	0xbc36930b,
-0xfbf60974,	0xdbb7844b,	0x44001279,	0x14e036b9,
-0xb524f4a6,	0xad1cee3d,	0x351aca37,	0x22861da8,
-0x0648f10b,	0x394078f1,	0x4287ef8c,	0x5c52b8a2,
-0xaa345739,	0x959a7de2,	0xb1cd8059,	0x29b3e4f9,
-0x3ee210dd,	0x7a4e3104,	0x7e6ccae0,	0xb6d003d5,
-0xfda934b3,	0x0e0a48d0,	0xd4109873,	0x2812c616,
-0x635c5c94,	0xe3f9d4ac,	0xf0a6aaca,	0x7541e3f6,
-0x3fc3b0c4,	0x49fb84e3,	0x710f44de,	0x7557e168,
-0xa524128c,	0xb4ca4c26,	0x473e043d,	0x00d2821f,
-0x39bc0871,	0xc0f825f8,	0xa22a8627,	0xe13c2de4,
-0x2fec6683,	0xfe2b7af7,	0x23eb8e5b,	0x4e0e6e44,
-0x0308ab02,	0xa228df71,	0xff5cec44,	0xacdcfbaa,
-0x92c6c3e6,	0x68e4150d,	0x11087f00,	0xabdc3bd4,
-0xb8dd26da,	0x18627343,	0x5ce82e6d,	0x11c05a6f,
-0x8a609a73,	0x3bb8d2fb,	0x5aa4eb39,	0xf89751d7,
-0xd2259651,	0x342d297f,	0xe4ab916a,	0x1c96d759,
-0x42b26d03,	0x51771d78,	0xef2f8396,	0x9e7e7379,
-0x6a28bb1f,	0x03155776,	0xb07e87e8,	0x53e37e86,
-0x24c0874f,	0xe92c4b2c,	0x196392c2,	0xdd1208c6,
-0x7c84ce52,	0xbd0babaf,	0xf2485778,	0xd8a2b514,
-0x5f1c6f73,	0x88b4b082,	0x276e2be0,	0xf6589d80,
-0xde140abb,	0x58a6d091,	0x0e42a6e1,	0xc972b503,
-0x3c26a09a,	0xb266a0be,	0x94649d3b,	0x41115c79,
-0xa0b7dbd2,	0x721acb50,	0xd7bf8b36,	0xc7f9f7cb,
-0x74d852f8,	0x8528edb8,	0x77e2cc4e,	0x2ddd65da,
-0x74ef8037,	0xe48969b2,	0x330e8588,	0xb633554d,
-0x609d1eec,	0xc4bd5986,	0xf8129f98,	0x05ec27b8,
-0x03ecbe2d,	0x2bcbaebc,	0xc2c47373,	0x12894413,
-0x44754eda,	0xd3e34546,	0x1333bd0a,	0x124ef238,
-0x8844e192,	0x0b55645f,	0xa4d57aa5,	0x2a868d45,
-0x2a23afbd,	0xfa7355bd,	0xf5119cd0,	0xbb01cac3,
-0x78667085,	0xd4aaa465,	0xda92200c,	0x72c6aa69,
-0x7ee61a47,	0xdb5e8a13,	0x486b9ad5,	0x1a3e1497,
-0xe484d83d,	0x8c01e389,	0xe71a32a6,	0x8eccec7b,
-0xa5cc579d,	0x337431be,	0x89a1bfb2,	0x93dd4f6e,
-0xd5417607,	0x3d321435,	0x4fbddc50,	0xcedb04ff,
-0xf6a2ae51,	0x60bdcdef,	0x97e70b67,	0x0fbdc596,
-0xa08d5b80,	0x05c8368b,	0x524819f2,	0x98e5708f,
-0x1dd76543,	0x92f36601,	0xbacd9ed4,	0xa97f5533,
-0x8f5aa949,	0x3fe4aaf4,	0x96a9280c,	0xadbb7c35,
-0xb8f83f0f,	0xcc5a1f8a,	0x89752caf,	0xcd4c2e1e,
-0x77d78e44,	0xb1aa165b,	0x67a987b4,	0xc23319c9,
-0x16e8293e,	0x2cf911f0,	0x7bf83540,	0x61c5dcf3,
-0xbd28d091,	0xea696427,	0xb06937e0,	0xe11eceff,
-0xa69f2a87,	0xba41c16a,	0x8991d3b0,	0x5a15df6c,
-0x5aa35438,	0xcb880a2f,	0x564f7cb7,	0x47cdc8e6,
-0xe2e1a3ca,	0x3eed6e0c,	0x4b3e4200,	0x6a2bb79a,
-0x425dd2e9,	0x5c3a0b34,	0xecbafc25,	0x5c2981c0,
-0xead1c8c3,	0xc36e7dea,	0x9dfa32b9,	0x75cdfe6f,
-0x29455323,	0xbaeb62df,	0xcf102c9f,	0xeccb75d3,
-0x777f06a3,	0x10cda97b,	0xcc6c2ee1,	0xcb235b39,
-0xcf8e7cdd,	0x01920c9a,	0x64b640a5,	0x4fa59fb4,
-0x7425d18d,	0xc3eca5e4,	0x30997afa,	0x0abf8b3d,
-0x7b10acf7,	0xd9729dfb,	0xc86419e7,	0xfc13aa07,
-0xf1f6f7b2,	0x02a16930,	0x87dab49d,	0xcd2e2863,
-0xf5222ad9,	0x13b4aa81,	0x2c7ac35e,	0xa96174ed,
-0x766e67d9,	0xb2c19936,	0xa709bf29,	0x00e6b0f5,
-0x832c1292,	0x6c3b45bf,	0xa09862c4,	0x8b734d08,
-0x7531434d,	0x50f5810f,	0x5bd87aa6,	0x5475296b,
-0xece2de76,	0xaad31105,	0xcb831e28,	0xb9fe36c6,
-0xc183a0cb,	0xe8f968da,	0x2a41f474,	0x8aa7cc1c,
-0xc43a68c3,	0xf8fc3386,	0x5f3301a6,	0xf7632604,
-0x128436cd,	0xd16f3ce5,	0x667b508e,	0xbf5756f8,
-0x8e0e3a42,	0x6cbcd0de,	0xbe5fedf4,	0x9b83de71,
-0x937bd7a4,	0xe871eeb9,	0x6e5e611e,	0x6b29d325,
-0x69fcccb7,	0x976b9570,	0xe896873e,	0x9d941355,
-0xd726628f,	0x69776f84,	0x94e7b692,	0x9100e226,
-0x92fb2e7b,	0x7c884944,	0x2479baae,	0xd13fab34,
-0x9c8a6f04,	0x75b25e71,	0x2ccc54c8,	0x3d819a0a,
-0x45043845,	0x5ff7efe1,	0x63bbeaf5,	0x28b57d96,
-0x6c8f5378,	0x788400a8,	0xbafbb398,	0x246dfae2,
-0x074495d9,	0x9f51fe8a,	0xb9026bde,	0xe3b2e2de,
-0x2a4443b1,	0x6075ab0b,	0x3a4372eb,	0xedd7b9fd,
-/*  2385-m806fa94.inc  */
-0x00000001,	0x00000094,	0x09242007,	0x000006fa,
-0x613bce61,	0x00000001,	0x00000080,	0x00000fd0,
-0x00001000,	0x00000000,	0x00000000,	0x00000000,
-0x92fd47ce,	0x10f09cd9,	0x8f9ef677,	0x6971cee1,
-0xe3760388,	0x28b9f57f,	0xcbfd3d2e,	0x36755a57,
-0x58a60a7a,	0x7284d969,	0x79a702f0,	0x66b3e382,
-0xea218360,	0x3841f678,	0x884c32db,	0x1ec43072,
-0x1e50452c,	0x6d6a79cf,	0x0607d723,	0x0a64a857,
-0x2dbdc8c6,	0xdb12f63c,	0x2b9e534e,	0x41aac030,
-0x5c4c58f5,	0xd77024bf,	0xfd24ef64,	0xe8bd51f9,
-0xbbb3f061,	0xb1f936ff,	0x8bb07ba2,	0x537b0047,
-0x199b65bd,	0xb3eca4a1,	0xcec8e142,	0xb9579b80,
-0xaba924ab,	0xb7d53ba4,	0xd7ea5293,	0x2a50d735,
-0x2452b188,	0xf03b3147,	0x7db5121e,	0xb2358d51,
-0xc805c765,	0x865df5e7,	0x6d40f06b,	0xc761c4e8,
-0x387dd0f0,	0xbc80eeb9,	0xe92c426b,	0x65cbc9b4,
-0x9538d4b4,	0x63cc487f,	0xb760f820,	0x3b86ffef,
-0xb1bd1ea5,	0xb12722fa,	0xb732adf2,	0xf421f446,
-0xb18e4b57,	0xc95fa70c,	0x4730564f,	0xa921f11a,
-0x99ab37d6,	0x4ce60951,	0xa6bd8a42,	0x61a14da7,
-0x911105b5,	0x85948731,	0xd3041116,	0x068e5f6c,
-0xa4f578ca,	0x508a653f,	0xf0c8ea8d,	0x74316838,
-0xabfd3b0c,	0xa3f920d9,	0x5db364b9,	0x27dd1bf9,
-0x06fefafa,	0x67811b14,	0x2643808b,	0x204a1032,
-0x04d612a1,	0xdf10cd23,	0x8f0120a0,	0x1d2b7701,
-0xee14f361,	0xd674c8b4,	0xc988792d,	0x74212138,
-0xe540eb5a,	0xddd1a51b,	0xaf84b94e,	0x2143f7a2,
-0x61e0f85f,	0x0633b153,	0xd5309996,	0x5533cd51,
-0x4cbab2b6,	0x17b8b40b,	0x25bac4d5,	0x1f2275d3,
-0xa1ac6d36,	0x4d92597f,	0x466f4b8b,	0xfdf126f2,
-0x531a5d7a,	0xd6d4a487,	0xdb0d238c,	0x61f18b1c,
-0x97a67f6a,	0x29924f9d,	0x27427d0d,	0x0d1eb39a,
-0x2b1103c6,	0x99685f83,	0xf4cb8fb6,	0x97bca469,
-0x20898983,	0x5bf74bb7,	0xa77c3cdd,	0x50be1e9f,
-0xab69aa20,	0x55d76e56,	0x150aff1c,	0x29e2b7c0,
-0x26aee693,	0xe744ef2d,	0xa38f0735,	0x7d4c6a8f,
-0xc65e7fb5,	0x236ba91e,	0xb8cf1be7,	0xcc8b0bfb,
-0x22da2b34,	0x3be52646,	0x73b86c2b,	0x920cc665,
-0x94b61a5b,	0x97786dc5,	0x1a8912b4,	0x38a58e22,
-0xcb5183c9,	0xdb977a8c,	0x7f122780,	0x9a657d7f,
-0x8dbaa672,	0xe712cdf2,	0xc386869b,	0xc4211433,
-0xf8a4588f,	0x39ad86bf,	0x2e50779b,	0x9a7c794c,
-0x0df1f0b9,	0xd0159ee0,	0x5992f6c2,	0x951e6022,
-0x41bd2401,	0xc961687e,	0x855326e6,	0xfccc4c2a,
-0x0087bc35,	0xce5e122f,	0xf74d48e8,	0x6675c151,
-0x8398d4a5,	0x9de7b65c,	0x9801dcd2,	0x3ce8da22,
-0xa5840674,	0x234cc202,	0x108dd897,	0x1fa992db,
-0x85d4f4cb,	0xbbd8b6f3,	0xaf2fe163,	0xb21a3d04,
-0x1490c4eb,	0xe3ef4ef9,	0xeadfc144,	0xaaac2565,
-0xce4659fd,	0x3cb70a0b,	0xc3b4b043,	0xf54129a6,
-0x8349a551,	0xd18e753a,	0x526145e0,	0xdec9f03f,
-0x73db07ea,	0x6e2c5618,	0x8989eb82,	0x9367c1c8,
-0xd84f7e3c,	0x9ee11292,	0x5bf7ff68,	0xc654ada8,
-0xbcaa8dd3,	0xb5aae79c,	0x67e00306,	0x8f76b1f1,
-0x059b6e20,	0xca613e5f,	0xadc0d38e,	0xd74aa7c9,
-0x88f51b72,	0x6fb62bc6,	0xb2c0b60e,	0x153e4ea1,
-0xebfe87db,	0x35340df5,	0x6bf5bf7e,	0x714da776,
-0x26795988,	0x214a3bce,	0x0602f74b,	0xccd2cee0,
-0x77e60679,	0x496fc72c,	0xc6c902c2,	0x1f2efe4f,
-0xb4f79c94,	0xc41afbdf,	0xb6d46516,	0xfebac219,
-0x2cc57e9e,	0xdc23d815,	0x30cfaa54,	0xb2274ada,
-0x4bc6454c,	0xe68a34e9,	0x7ec93dfa,	0xc025c478,
-0xf8325907,	0x5c675d83,	0xf470fa06,	0xa523d410,
-0x3221f28d,	0x0572f5d0,	0x70f94306,	0x8534bea9,
-0x216d7668,	0xb0eb1431,	0x82009673,	0x464a3046,
-0xf7e1e01a,	0xb5e59acb,	0x05acf463,	0xb6c1faf4,
-0xf159ece1,	0x04a8c883,	0x099cce7b,	0xdfaaf89c,
-0x454e03ad,	0x7c92c35f,	0x4b030844,	0x77d8a4c9,
-0x146aa969,	0xd268c376,	0x46c04f6e,	0xa7d3f2c2,
-0x6bee2732,	0x98b1d762,	0x9c5de9e7,	0xf4a1da1f,
-0x578d91f1,	0x1e305651,	0xd54e7356,	0xfdce2bce,
-0x07958e20,	0xc33fe30e,	0x26f4a5a7,	0x7216e316,
-0xcbdefb6a,	0x4b08e63e,	0xad7a149e,	0x8917c4a3,
-0x0366c10b,	0xd7ce39a5,	0x0a815df9,	0x16ed6b13,
-0x7d669780,	0x21b0d9e0,	0x2f79076d,	0x9e8f2ee3,
-0x654dcc28,	0x81377390,	0x22d0b924,	0x156a6296,
-0xa0fcfe27,	0x3059f827,	0x99964303,	0x8934a4dd,
-0xb4468baf,	0xba359157,	0xc0a61a90,	0xf4556666,
-0x608a8297,	0xad441862,	0xb9c1702d,	0x8145dba5,
-0x0f254115,	0x59a4b412,	0x8fc5c7a5,	0xeb4ccdaa,
-0x73e90452,	0x9972be3c,	0xefb39d2d,	0x2521bdb9,
-0xf8887014,	0x57fa05c3,	0x0730eadf,	0x5fbc0238,
-0xbe97cdf3,	0xad6e7d72,	0xd0806a54,	0xcb39a4f7,
-0xf75f9e1a,	0xa6b74bbd,	0x094051fd,	0x23ffb160,
-0xc9fd9613,	0x4a3be12c,	0x65809263,	0x101d6a29,
-0x3afc2485,	0x92ed66e5,	0x51ba582f,	0xef4f96ac,
-0x4a6d1e4d,	0x4be612f1,	0xb4081a08,	0x848faf38,
-0x0c35ca45,	0x0f9eeb04,	0xedd783ea,	0x7e1024eb,
-0xd195dc4b,	0xf7b117cf,	0x4d362f21,	0x1a6cbc8b,
-0xcb2df2f5,	0x730e6926,	0x2d2981cf,	0xf8a8bdcc,
-0x96f35d56,	0x7f8759cb,	0x058621aa,	0xdb5237d7,
-0x817f6446,	0x482202d2,	0xbc9dec06,	0xd481dda8,
-0xdf9f0d2e,	0x596a296f,	0x1e393fac,	0x145dc600,
-0xe38ccfde,	0xd80ce87d,	0x96b20bc0,	0x3350fd25,
-0xa64215f5,	0x8c0525c8,	0xb462e6f4,	0xbcacdc94,
-0x307abda3,	0xd00abb6f,	0x323859ea,	0xe331bd4e,
-0x84c0d3e2,	0x6c3d63b8,	0xe3c0eea7,	0x33d6ce95,
-0x5394e077,	0xf2050ebb,	0x9aaaf4c0,	0xc2c5d983,
-0xc18af803,	0xd23701c5,	0x360244a1,	0x440fcbae,
-0x55f25bcd,	0xff067fdc,	0xe674bc4b,	0xf5b22262,
-0x7c8d0af3,	0x54b5cdb5,	0x8c2a9bc3,	0x16566ffb,
-0x94a90e84,	0x9e1baf54,	0x4678e1a3,	0x22513f0a,
-0x29a77692,	0x770025d2,	0x82bdcb61,	0xad9a632e,
-0x59b727e4,	0xe9a02367,	0x4bdb418c,	0x3bf1edbe,
-0xd6944e95,	0x451620be,	0x5bc342e4,	0x5e2d1a55,
-0xf579eee3,	0x8e0a2861,	0x4b23da56,	0x7b9fde42,
-0x34d9b2e7,	0x215f2be9,	0x6147f427,	0x71a9dde2,
-0xaeaf26bf,	0x8679c6c1,	0x1ceeefc4,	0x5443db62,
-0x8b8e0ec2,	0xb2b1fbb2,	0x64b541a3,	0x41e134d1,
-0xfa1cda7f,	0x8f6496d7,	0x3c0d9866,	0xbb9a82cb,
-0x37196a18,	0x3e181a89,	0xf0ef7f72,	0x5a664ee6,
-0x5de26b20,	0x93fd754e,	0x5f4ae628,	0x9392b256,
-0xdf0473a1,	0x72d6f8b7,	0x3fb33bcd,	0xa02785d6,
-0xfb87096c,	0xb83dc5cd,	0x2467e913,	0x72e3c483,
-0x8d277e1e,	0x16e5aaf2,	0xa371a484,	0x3dad20ac,
-0xaa7e663f,	0x1e137ed1,	0x74a64067,	0xd538061b,
-0x8b459ac5,	0x0ac1184d,	0xa85593db,	0x41c784e6,
-0x2a31cfc0,	0x01ff3cea,	0x5c1545d2,	0x67116668,
-0xfb6873e1,	0x20270ecc,	0x54413eef,	0x8e0bdf48,
-0xc66c4bcc,	0x637840fd,	0x59deef08,	0xd1c1a3a7,
-0xd86e63c5,	0xf2e5c27d,	0x8b6b1f8d,	0xb2bc73c7,
-0x08c4aef0,	0x322ada3b,	0xf80ceb06,	0x421bc458,
-0x17f16c07,	0xcf4171e3,	0x0940f2d5,	0x2b4790e0,
-0xf0fac17e,	0xeb3000d3,	0x1e558c89,	0xa83c6fcf,
-0x9f46e782,	0x69de7aa8,	0x73994547,	0xa0f18c30,
-0x38c732b1,	0xd8cc513f,	0x7d5d1fd5,	0x00d15590,
-0xf1d9e3a6,	0x4ec06f1a,	0xb4fd51ac,	0x4a4cba99,
-0x8ac784fb,	0xa739a497,	0xc1d77735,	0x1a0bfe2b,
-0x48282cfc,	0x53a95951,	0xad1e7438,	0x86fed107,
-0x4927ca7f,	0x9e9b01f1,	0x8e1e028f,	0xad723b15,
-0x2c18e064,	0x379f9f7c,	0xa2b52daa,	0xbe4394d4,
-0x39c1b8fd,	0xcd2bce50,	0x98a3868b,	0x9d5f399c,
-0xf3d67313,	0xf4098bfa,	0x44a9cffb,	0xbed84b99,
-0x6772284a,	0x5913cd34,	0x56cdb402,	0x97c2a711,
-0x960a393f,	0x831626e9,	0xc45f7819,	0x74117fa9,
-0xb686cdeb,	0x822f5929,	0x5b2e5dbe,	0xdd6cf03a,
-0x0af92686,	0x8116f734,	0x8b6443c7,	0x7c7e5b51,
-0x8d6b25ed,	0x6f849ba4,	0xabc52549,	0x292936c9,
-0x23345631,	0x3ec1139a,	0x1f455ceb,	0x8b471929,
-0x54ba89ea,	0x447cf2ba,	0xc5199e32,	0xa90836e3,
-0x30d32619,	0xcec448b2,	0x3ce9b002,	0xaf5daee0,
-0xf9d866d3,	0xc01f9c7d,	0x0086c8a2,	0x4c41c4a2,
-0xce6070b4,	0xbc440a45,	0x932a7bd5,	0x5a3967a2,
-0xb73a4fa0,	0xac056431,	0x981f7a3a,	0x17f1fc4f,
-0x79180a8d,	0x11ff6c3b,	0x2d2974ae,	0xf02a9d0c,
-0xd519dca0,	0x985ae8a7,	0xff8cc562,	0xccd2959c,
-0xc8e1755d,	0x582ed5cc,	0x6ea71364,	0xe7418b1c,
-0x6863462f,	0x31a0afc5,	0x61e7d39e,	0xa62fd758,
-0x224ef92b,	0x200ca33e,	0x435162a7,	0x93e98c95,
-0x277c8ffb,	0xd40b6030,	0xa80231a7,	0xfc0bd44c,
-0x1bf95e3e,	0x73107b2e,	0xa1053205,	0xacc2d1e4,
-0x559ed170,	0x63855ebe,	0xbc624e8a,	0xc5d1069f,
-0x4882fabd,	0xb8f37420,	0xd5296744,	0x89c3d999,
-0x26920170,	0xd1b7dc19,	0xe39aa2fc,	0xe7d75841,
-0xad8a3e42,	0x989872ab,	0x85490dec,	0x6f1b8d7b,
-0xc27cb34e,	0xaece9777,	0x06aa95e8,	0xf0cd691a,
-0x24b2b791,	0x6a680140,	0xdc57d1b3,	0xd76e7e09,
-0x4179bf62,	0x5f9e7d46,	0xe1d17d57,	0x0de6ea3f,
-0xaab63b79,	0xb248d9f9,	0x2abe84c9,	0xa4c6303b,
-0x95d0d55b,	0x0bf485a1,	0x2349e2b1,	0xd58a673e,
-0x20a9c547,	0xda06b618,	0x6940082a,	0xb04c29f6,
-0xb8b71408,	0x749ced6c,	0x130b7f62,	0xaa9a780d,
-0x1f582e4f,	0x4e489983,	0x827b9d04,	0xe06b40ba,
-0x2897e19b,	0xed2c64a6,	0x48156465,	0x96b13665,
-0x77adec3a,	0xe8aae08e,	0x246810c1,	0x8325d23c,
-0xd8f532f4,	0xb7334bf0,	0x7c0ce51f,	0x6f6cffe8,
-0x0eda13ab,	0xde4b3416,	0x2e317daf,	0xf83396ad,
-0xf50d6031,	0x65b090ae,	0xde15edb2,	0x7036d85a,
-0x2201b5be,	0xe03b6ea6,	0xcb2c5c54,	0xdaffcd2c,
-0x2f3ce0eb,	0x1d03ee9a,	0x117c70c9,	0x0ff345b4,
-0x8efc3b59,	0x4a31d035,	0x68b25cb9,	0x6d74e514,
-0xc0c9def6,	0x64472616,	0x97b30c18,	0xdd78ca4a,
-0x36a33ae3,	0x6be6ca3b,	0xafaed757,	0x1f7a24b1,
-0xb23f1830,	0xf230c461,	0x5b099707,	0x6a968e41,
-0xe20d0246,	0x68691c52,	0x4b2fb987,	0xcd1950c6,
-0x5a0b2d14,	0x824015c8,	0x98d975aa,	0x60c87c2d,
-0xa7f1f033,	0x972107da,	0x81e14228,	0x58edab99,
-0x94307323,	0x04326fd2,	0x20660cd4,	0x02deeb94,
-0x910a4c96,	0x0c513d4a,	0x76728ab7,	0x7e445af6,
-0x9566286a,	0x31106e06,	0xc5dba959,	0x82cc4824,
-0x2ce47924,	0x0ba7b3e9,	0x981ac74f,	0x7c082ce0,
-0x2599b524,	0x654d2883,	0x1e4be10a,	0x39931fcb,
-0xf64a47c1,	0x993a5a86,	0xd416a229,	0xf269beed,
-0xf05d4c13,	0x572acaa8,	0x1d78d508,	0xcd843d85,
-0x38520a79,	0x1b1fef2c,	0xe29b511c,	0x7c1aa95f,
-0x2b6ecc4d,	0xea5908c1,	0x2b63560d,	0xc10db41a,
-0x5e2514e1,	0x3d34c58e,	0xebf1fece,	0x56507222,
-0xbe36a40b,	0x147fbf00,	0x6eb1f2df,	0xe466f1e4,
-0x63c9f169,	0xcf6bd201,	0x98933c12,	0x60e2b81e,
-0x3508f806,	0x9e67f8a5,	0x6ee1305a,	0x0f4ba23e,
-0xcd340cdf,	0x7cfc8ab9,	0x00bf2a62,	0xbf9ed3a1,
-0x9b245491,	0xae4637c9,	0xb0a0c618,	0x7facd30d,
-0xcb8fbec2,	0xf04e8980,	0xc955c18c,	0x3d5425b1,
-0x529210c7,	0x8945c8e2,	0x3db97f39,	0xed09fb5d,
-0xc0cfa504,	0xf28f6542,	0xee9e5678,	0x4d292474,
-0x57925cce,	0xb4e1c5e9,	0xfa2c00ef,	0x10f26af5,
-0x05bf6469,	0xf9e160b2,	0xd71618ac,	0xc87934bd,
-0xe96101d1,	0x55d1976c,	0x471c8505,	0x7a36d839,
-0x5d62a9ee,	0xf3c54a8a,	0xa2be15d9,	0x244087c9,
-0x042c8037,	0x23224689,	0x281c5d73,	0x2139ecfc,
-0xffb8bc8a,	0x834fdd11,	0x9cd5a5bd,	0xa3368319,
-0x7e5bef0c,	0x4ae2dbda,	0x86d90089,	0x6675dfce,
-0x48876262,	0xcec72538,	0x11dc5c80,	0x86a730f9,
-0x313565c9,	0xe3e5be11,	0x106d7cce,	0x752b8be2,
-0x3d00a5bc,	0xe6f70e95,	0x44447ac8,	0x600df30c,
-0x8335ac3b,	0x8816ddee,	0x700982fe,	0xee495741,
-0x48c7e81c,	0xa3d55da2,	0xb0172982,	0x70ab2158,
-0xd4460621,	0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,
-0xa8454763,	0x70877bb6,	0x66005c97,	0xaf292c06,
-0x7b843db1,	0xf343b59b,	0x25cdc7b5,	0xa41da617,
-0x9e9d895e,	0xc936f475,	0x7270925a,	0x30024230,
-0x8e72f53d,	0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,
-0xfc18a2a3,	0xaf377cc1,	0xbff09a78,	0x4b4e0814,
-0x95a0b2c1,	0x270398de,	0x201fca94,	0x2a032a4f,
-0x131542b4,	0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,
-0xa814ddc9,	0xa3b3a991,	0x17ee60c2,	0x852c0b8d,
-0x11e5853a,	0x762002a7,	0x92c5311d,	0x0d4bf7e1,
-0xfffec870,	0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,
-0x0111a772,	0x9808e780,	0x29c336e8,	0xe9bc05df,
-0x5bedde11,	0x945565af,	0xaff808fe,	0x87e3423d,
-0x4de6f98f,	0x93b4adef,	0xbf704fa4,	0x09120e91,
-0xd54f3692,	0xdf8eab1e,	0xfabbf59c,	0xe74318be,
-0xaab87ffc,	0x29fa791c,	0xe3915552,	0xa652cb9b,
-0xa1252e74,	0xb35b723b,	0x542aa28b,	0x12fcc5b0,
-0x3941f962,	0x82bcc6cc,	0x47b11974,	0xb821611f,
-0x78b34250,	0xf1be5659,	0x561b9e61,	0x6f3bd501,
-0x584e6f5c,	0xd54ed547,	0xacebcd21,	0x7b5ff816,
-0xb64ad233,	0x9f2f330d,	0x69fb1ece,	0xac8710dd,
-0x58dc6c60,	0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,
-0xebc0ce9d,	0xa733274f,	0x884d9b55,	0x42b08b63,
-0xafa54a74,	0x1c7ccf64,	0x93a20191,	0xaaa3132e,
-0xc69831d1,	0x54634889,	0xfbfe3efc,	0xd3cf68d4,
-0x302e3117,	0xf5693131,	0xc3ce8c6c,	0x1f03cd89,
-0x6243334c,	0xf16bc80f,	0xdca5f130,	0xcb2cd956,
-0x4c1bb421,	0xe8de533c,	0x7f86703a,	0x29aa897e,
-0xdd54acad,	0x76b2f2ae,	0x7ef82b71,	0x2e30970b,
-0xba402597,	0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,
-0x7f9efd1c,	0x2363d147,	0x5327289a,	0xe89229f3,
-0xd63a535c,	0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,
-0x26b6edfb,	0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,
-0x6d65db4c,	0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,
-0xe20e6dbb,	0x8488a45f,	0x8ebc2932,	0xd4767316,
-0x3e8c4b8a,	0xbab7402c,	0xfc1e217e,	0xe5c5bf82,
-0x6928fe2e,	0xc88528e9,	0x4b2e4e8f,	0xdd938b86,
-0x0c964f98,	0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,
-0x197d005a,	0x4d40b3b3,	0xcf203155,	0x0d2fa621,
-0x752d2c58,	0xb12bac12,	0x1e7e8c23,	0x94215d54,
-0x9854a71c,	0x4de63c64,	0x7a012529,	0x9c171f8d,
-0x9e71def7,	0x3bd17d50,	0x11f175d9,	0xec78abf3,
-0x7b529eee,	0xd3a69fc3,	0x5b718676,	0x58214d29,
-0xa8bd2c34,	0x41ea00ab,	0xa03f64d6,	0x4ee342b0,
-0x32b1e444,	0x1c1801a4,	0xc8424702,	0x334a7e35,
-0x50cf1543,	0x3b22b495,	0x88683776,	0x8e2e0154,
-0x6155c033,	0x4e2fa6ac,	0x42ace700,	0x8d64f97c,
-0xaf9ced17,	0xb2a5cb92,	0xa558582d,	0x88705de7,
-0x9e528d59,	0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,
-/*  1644-m34f6404.inc  */
-0x00000001,	0x00000004,	0x12232005,	0x00000f64,
-0xc66dbf02,	0x00000001,	0x00000034,	0x00000bd0,
-0x00000c00,	0x00000000,	0x00000000,	0x00000000,
-0x2aa0fbf9,	0x0920514d,	0x0e4f4460,	0x49035deb,
-0x383f3c80,	0x00e04783,	0x29a44f29,	0xa2a1b502,
-0x931fae3f,	0x1b9afb5e,	0x96f2c85b,	0xb547bdfa,
-0xe114d22b,	0x323b2bb1,	0x340c7daf,	0xc6998fe4,
-0x9490962a,	0xed68542f,	0x173948af,	0xb8ae3c1f,
-0x65ef9972,	0x75fb56e8,	0xa3af41cf,	0x3319cfaa,
-0xeac5094e,	0xafe4e760,	0xfd8f0287,	0xe78d700c,
-0x168afe29,	0xae1f391c,	0x43aec1d8,	0xbdf7b9a3,
-0x7ab31cd3,	0xace4f49a,	0x73939ca7,	0x5344c4d0,
-0xc8487bb6,	0x1764ce10,	0xebccd173,	0xc23fc82f,
-0x86625a94,	0x4e949245,	0x89eee135,	0x7c9004fa,
-0x8096a152,	0xea7cbf27,	0xb2c4cd70,	0xfc54cb8b,
-0xab050bff,	0xf737c757,	0xd1bb463b,	0x6d61e7ca,
-0xc1e872c4,	0x09d3b9bb,	0x63dc89a7,	0x68bf6c1b,
-0x83d5b80e,	0xc5beef02,	0x91747e89,	0x34196e62,
-0x668c6253,	0x0e9fdfb2,	0x90b52c89,	0x2e75189c,
-0x9d80daf1,	0x10159f22,	0x7706342c,	0x35e7bfd1,
-0x62cf9cf5,	0x32cda56e,	0x1acebf46,	0xad816987,
-0xebacbfb4,	0x0debbebc,	0x756d15e7,	0x24f67bc6,
-0x025903ee,	0x0970f26e,	0x96ad84ef,	0x4a5dd836,
-0x82c363ef,	0x0ffc3ec0,	0xdd3ea62a,	0xb27428a5,
-0x1dc79380,	0x7ec9f960,	0x6662aaae,	0xa01d8357,
-0xaf5db8a1,	0xff90a0ec,	0x1fe8e423,	0xbb81c9b3,
-0x6335faa9,	0xea374dad,	0x975191a4,	0x4138c587,
-0xbeb5c7e7,	0x1eb0f716,	0xd723fb49,	0x354877ca,
-0xfc334d55,	0xf9e58b90,	0x7ba2646f,	0xb84ef813,
-0xaeab7ca7,	0x00d1dd06,	0xa08655f1,	0x4bbadc51,
-0x14483285,	0xe910a771,	0x39670120,	0x0be8c920,
-0x3c95e8f8,	0x1c14ab83,	0xa4415b4a,	0x87c6b236,
-0x31c41106,	0x3ab34cce,	0x54b1875c,	0xcee69e83,
-0x33c65751,	0x5ef3a1f0,	0x5090d272,	0x5a8e6d3b,
-0x4303bdbb,	0x0b2c3159,	0xefaf2639,	0xec01fdb0,
-0xfe3fd042,	0x20c46b4b,	0xabe99171,	0x354d909d,
-0x4af6e116,	0x1b3f281d,	0x17f7d490,	0xc1b1e097,
-0x2cacaa17,	0xa3393411,	0xebc00673,	0x9d95d079,
-0x970ed0e6,	0x16950515,	0x9b178b59,	0x7fb00a9e,
-0xbfffd2ea,	0x087b061b,	0xc092d48c,	0xf32f5fa7,
-0xf90e99ab,	0xf9312dc2,	0xe4d74564,	0xa698e99f,
-0x7111bcbe,	0xec3968cd,	0x5436fa2d,	0x4e99ba9f,
-0x9f8dcd1b,	0xb465b9af,	0x15212d3a,	0xe6f6e5a0,
-0xbd4058d2,	0xb6ad2f5a,	0xa3260b5b,	0x734a3ede,
-0x0f6ea66e,	0xb223e5a6,	0xebdc5128,	0xc4233eef,
-0x09715a54,	0x3dbed193,	0x876b0277,	0x3adec15b,
-0xb700dc55,	0x10aa107c,	0xdb7dbb4f,	0x1b9fa169,
-0xcca80ecc,	0x273a03cb,	0x91afbe93,	0x7e893ced,
-0x02410cf4,	0x15a0d7fb,	0x325f6e3b,	0xd9a9ce1d,
-0x60950dd3,	0x9e291404,	0x0ea0a7d7,	0x41a346e8,
-0x3fa2bd77,	0x8d20e602,	0xc8964616,	0xd6e19ce4,
-0x563abb53,	0xdfd2769f,	0x24ccd347,	0xa322eae5,
-0xf9a54b69,	0x176ce20e,	0x0feb59ba,	0x2a8fea4d,
-0x3150bf41,	0x080a9926,	0x3f5134f7,	0x83295a7c,
-0xc46c81a3,	0x19b6eccb,	0x40428921,	0x1b810f1b,
-0xb76b6ac1,	0xb2292755,	0x79529867,	0x59f9d7af,
-0xdaf8b861,	0x7fb68662,	0xa056b25b,	0xf826a597,
-0xb7a2ceab,	0xd2612873,	0xec1f4d81,	0xb808abef,
-0x7073078e,	0x6b91402a,	0xa3fbd414,	0x02a41c67,
-0x544d48fc,	0x015dcb48,	0x11199d22,	0x1593a95e,
-0x2c79af8e,	0x3548292d,	0x4727d9e9,	0xfe8a3dd9,
-0x97f018b9,	0x0a7571f1,	0x3c00b794,	0xd3ff0072,
-0x30fe579d,	0x2546f2ab,	0x0202f6c2,	0x11c15bc0,
-0x8b4451f4,	0xf112d73b,	0xbfafaafa,	0xef369dfd,
-0x308c4f78,	0xf19c2960,	0x9c19ac8a,	0x11230a97,
-0x10f31535,	0x3bd988a6,	0x0cbbd3ec,	0x0ed616a5,
-0x3680c09b,	0x91428b6b,	0x27832f53,	0xb7c9358a,
-0x4f799c7b,	0x322999ba,	0x77229b52,	0x9a08a9be,
-0x51ed5e85,	0x4a901240,	0x3ea94c88,	0x1118c795,
-0x77452790,	0xb5ad6941,	0x3d00fdf2,	0x673b244a,
-0x05b9a17e,	0x99993324,	0x118016db,	0x75484d41,
-0xb75d23d0,	0xd34fa5da,	0xcc408938,	0x7ece1817,
-0x7ea1b29e,	0xe7c2d699,	0x0f3dfbc7,	0x0b4555b7,
-0x2cc05a7c,	0xcd23c5b9,	0x60161008,	0x4ca245c0,
-0x5a36a6ae,	0xe893e428,	0xc9b2b8b1,	0x5448fd9a,
-0x8d42d55b,	0xfa8ad719,	0x87ce3922,	0x5aecf655,
-0x13ac5a66,	0x24c562f6,	0xc46a075f,	0xf1e40a8b,
-0x941e2816,	0x15f746fd,	0x4cca60e0,	0x299b2a62,
-0x73478a0d,	0x567e8782,	0x80895e42,	0x9583cb92,
-0x32c73b01,	0xdf7781a2,	0xbfd53199,	0x565307b2,
-0xf9c03681,	0x545cd9ee,	0xdb6ef914,	0x8f3a0f60,
-0xe2599fd7,	0xbd1469a3,	0xa10bac43,	0x8ee0f53b,
-0xfb397bd3,	0x1320fd60,	0x0fae4a4b,	0x9643a2ef,
-0x542fa912,	0xf66acb30,	0x8c01a04c,	0x9a61f428,
-0x767779d3,	0x7500c159,	0x081c8e77,	0x43df3122,
-0xc8a9bc06,	0x68576d2b,	0x52ce3a2e,	0x89256fcf,
-0x9bc3175c,	0x884e9d8c,	0x840b9a09,	0x7596e0e2,
-0xabf086b6,	0x2e67e693,	0x8fd9d5d6,	0x5c33a3c1,
-0xb0db727d,	0x4a52de56,	0x38873f93,	0x369cd226,
-0x6ddeb66d,	0xe15f2459,	0xd71f9b20,	0xbcdf4d99,
-0x0121658e,	0xf9db6f89,	0xf84bbe80,	0xc2cdd90e,
-0xb80fdedb,	0xd75667b5,	0x89946de9,	0xa32fdd8d,
-0xd1b2a769,	0xa71af914,	0x52f47223,	0x7b5bbf94,
-0xc5756339,	0x765700cd,	0x1b76522b,	0x10b2a7a7,
-0xf66f0dce,	0x830e175c,	0x8ec5c90d,	0x78facdee,
-0xd79ab3bd,	0x8be528ab,	0xdb19d4ea,	0x8920768a,
-0xf1ee4c3d,	0x41ba7328,	0x3509df65,	0xa37d1a42,
-0x850b7186,	0xb1436128,	0x5a08b8f2,	0x27a84ef3,
-0x4699d660,	0xc3a647aa,	0x42ac787d,	0x5a12ad69,
-0xe3eb464e,	0x5d02ddf3,	0x166599f8,	0xfb60f496,
-0x99482b78,	0xdda70ccd,	0x328b223f,	0xc17b09f9,
-0xfe33a376,	0x5761ee07,	0x9b886028,	0x090e71c7,
-0xcb3e5f12,	0xd3eaa84a,	0x5236aca3,	0xaccdaae8,
-0xb806ffd0,	0x9da669d8,	0xa279b4b8,	0x5bc2d750,
-0xc909a6f2,	0xa0271dfb,	0x79192e10,	0x57328242,
-0xfad4b03c,	0x88e6d952,	0x4ea097f9,	0xbeed008a,
-0x8362f77b,	0x8cb35545,	0x967b7aee,	0x2a15cf5a,
-0xec39bcba,	0x555a5795,	0x93a4a7bb,	0x6ca9ff79,
-0x760ed185,	0x690c2e3d,	0x874a340d,	0x66da03f6,
-0x40a0eb9b,	0xa4635c53,	0xd54f88e9,	0x8cf960fc,
-0x9281e930,	0x4b871388,	0x93d5afc2,	0xa08ce066,
-0x7e4e3285,	0x5dfe67cf,	0xd589f83e,	0x39686ea8,
-0x309d8b6d,	0x5817b862,	0xb79e5697,	0x794fc22d,
-0x88718d7b,	0xfea9919f,	0x61b6e97b,	0xa056590c,
-0x2b7dec71,	0x6e3fe551,	0xde8fb690,	0x1e8432fc,
-0x3a582da2,	0x43156828,	0x699aa0d2,	0x8b60c7c1,
-0x42655a0d,	0xda3b2073,	0x1fcbd187,	0xb7e8ebdb,
-0x38523922,	0x6ab4c58d,	0xa57c97ad,	0xe40da53c,
-0x5ce24bf3,	0x0885391a,	0xa8d23e09,	0xb790bc3a,
-0xdbe626ce,	0x9825b7dd,	0x750fff15,	0xf59e3455,
-0x9fd77b23,	0x52056a91,	0xfe0485cd,	0x695c4d77,
-0x1c1a7d87,	0xb4a216a5,	0x476ffcb1,	0x73d4b9e5,
-0x667afb76,	0xae5123d1,	0x036b8c60,	0x6da02e1d,
-0xd8efc647,	0x1fe6dd3b,	0xb240fa2e,	0x27ad57de,
-0x71030362,	0xf032e223,	0xae0a3ce7,	0xa3986894,
-0xcc0d3503,	0x353f0815,	0x5df4a1a3,	0xfac260bb,
-0x202c7593,	0xbadafb32,	0x7bc64e14,	0x6cd4da2e,
-0xf1519aed,	0x55510d45,	0xe28d483f,	0x28221d48,
-0x01c0bd26,	0x5c301fd7,	0xa12045f5,	0x76b05ace,
-0xa2bbbb82,	0x97ab1865,	0x8d4ce459,	0x268fb1eb,
-0x5dd52280,	0x2a5967fa,	0x64a3e4bc,	0xb45e0a97,
-0xe8966ce2,	0x4e71465c,	0x964109e7,	0xabed1708,
-0x7a13e4a4,	0xfd5e1477,	0x9910d3b9,	0x9ae0a78a,
-0xd3cc1536,	0x2dfd162d,	0x3a0902ca,	0xa72dd7e3,
-0x61afb44f,	0x8b1c3a67,	0xbb3c94b9,	0xa32b02e8,
-0x47c73d33,	0x5de41852,	0xae80d1ec,	0x09f3ce22,
-0x8bf48c41,	0xc250e044,	0x7c4ea278,	0x409f5374,
-0xe5940d9d,	0xd0bf2472,	0xa1bd617f,	0xcd1fdb18,
-0x99858d2b,	0xb418d69a,	0x76bb3f87,	0x399bdc16,
-0xfe99947c,	0xa8506ae2,	0xdf04a39f,	0x64161b49,
-0x5551de8b,	0x32de95b4,	0x23b2e25a,	0xe8c0adb9,
-0x8068c813,	0x4cdd0184,	0xdba81d02,	0x0bb87f6f,
-0x0848c5a9,	0x09de62c3,	0x4c9f6c81,	0x93cfd4f0,
-0xe732145d,	0x10f0a466,	0x634f4fca,	0x3d15a895,
-0xb45b6281,	0x33141400,	0x68e1e66b,	0x9eb7fa62,
-0x00b982a5,	0xdc30d528,	0x99353212,	0xb39b39cb,
-0x9915ee79,	0x45b9019a,	0x2950a41b,	0xae7c06f9,
-0xa549f671,	0xa577ead9,	0x6460b7ea,	0xd74ba7f0,
-0xa153dfbf,	0xce43d0c8,	0x4db0cb22,	0x5fdc31a0,
-0xc6d8343f,	0xe6c71f5d,	0x544b5e49,	0xc05aa5b0,
-0xdee2e78d,	0x21a5a92c,	0xceff698b,	0xc2af2e98,
-0xd21ff919,	0x253bfcb0,	0x38bb6000,	0x3bdc0d95,
-0xf58720bd,	0x555571e2,	0x5f46c392,	0xed75a926,
-0xfb2ea273,	0xcace1efd,	0xdee40d28,	0x825b887e,
-0xb9f571d0,	0x5af0e2eb,	0x1e84e8d5,	0xe5faf18e,
-0x09e6f9c4,	0x0275418d,	0x286a78e5,	0x67ce248b,
-0x1d16cec4,	0xa7a91b4e,	0xb69073a5,	0x850c89b7,
-0xf2fbb34c,	0xc20fdf4d,	0x400790e6,	0x426e089a,
-0x33da3064,	0xecd24b1c,	0xafc86b04,	0x0741e20e,
-0x78b2aee8,	0xcbdf174c,	0xb3ae59ef,	0x3304707f,
-0xa7426892,	0x5daf5012,	0xa7cb63f5,	0x59a11f7c,
-0xc6d07905,	0xe838459f,	0xfdf02a6d,	0x6f5e4acf,
-0xe9e3226f,	0xb9725afd,	0x6241649f,	0x95988faf,
-0xa081c6c5,	0xa9eb2d11,	0xc2443b09,	0xe0311918,
-0x1ef297cb,	0xf443b6be,	0x26581e9b,	0x291fc191,
-0xc77165f8,	0xdb430c89,	0x2d3758c4,	0x6c533994,
-0x3ddc4401,	0x9a7c3ec7,	0xb51caeb7,	0x0b1af900,
-0x965bcbec,	0x159c52a2,	0x79d3971e,	0x05450934,
-0x35ec78f2,	0xf3f95c09,	0xaf428eac,	0x62cacb9f,
-0x777a0f04,	0xc84c848b,	0x590bfbc0,	0x3278cf42,
-0x80212999,	0x4b165cab,	0xfeb5061a,	0xd1edbcc4,
-0x713368d9,	0x1166ae7f,	0x624ad72f,	0x8ad9e50c,
-0x08c5a38d,	0xc69f14b5,	0xe72af0d6,	0xcaed6525,
-0x90aa248b,	0x9c518708,	0xc2b61ceb,	0x03d96759,
-0xf212ea2b,	0x5f208660,	0x86bfc04a,	0x5985bc07,
-0xaa4fca93,	0x6a20c21f,	0xac11f3a5,	0xa37e81e6,
-0x47e46f31,	0x0fbe92dd,	0xd7ced8a9,	0x7e0e9b17,
-0x75d64f73,	0x1aa88320,	0x2c207cb3,	0xf15513e4,
-0xd79bc9bd,	0x2e33fdc1,	0x605baa8c,	0x2c5a7f84,
-0x13fdd5d4,	0x526bd3cd,	0x2dedb93a,	0x915f4b74,
-0xbe8430ed,	0x1159024d,	0x42857f19,	0xc1421d60,
-0xb37e98bb,	0x7041760e,	0x404ba9e0,	0xadfcb9d2,
-0x5bb7904e,	0xb67a4814,	0x4dec413c,	0xc4aa8e09,
-0x599a8813,	0x418af309,	0x1b70b3ef,	0xbcffb6d0,
-0x32a221bb,	0x92807fd9,	0x9d71e8c5,	0x5d8e2809,
-0x9356cc7b,	0x9e775e7e,	0x0639ab21,	0xaa7403b3,
-0x878d82ee,	0x1c513739,	0xd1d56bab,	0xf72d5c2f,
-0x0ec2b242,	0x33b9ee8d,	0x0921cb76,	0x96b903c0,
-0x4b60e522,	0x651a2426,	0x678fec9b,	0xec785618,
-0xbc930977,	0x8c7e369e,	0x10c46c62,	0x6f0cf663,
-0x6b9c8438,	0xe28ff641,	0x1114ff3e,	0x58b7677f,
-0xc81fc485,	0x8741210f,	0x0800b8f4,	0x8defc914,
-/*  2972-m03106a4_00000011.inc  */
-0x00000001,	0x00000011,	0x04212009,	0x000106a4,
-0x24e504ac,	0x00000001,	0x00000003,	0x000033d0,
-0x00003400,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000011,
-0x00000000,	0x00000000,	0x20090421,	0x00000c51,
-0x00000001,	0x000106a4,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xbd172fac,	0x034086f5,	0x34810939,	0xaea3ec98,
-0x26866e06,	0x1389830d,	0x7a2a4b6a,	0x1e7fb2b1,
-0xbab165d1,	0xfeb576d4,	0xc1edb5b2,	0xa44174b8,
-0x0d1ad45a,	0x4fe5fe0f,	0x62feaf24,	0xafe7de28,
-0x8b076222,	0x881b4891,	0x8daf9241,	0x98e8cf9e,
-0x417b7869,	0xd7e266b6,	0xf07fa211,	0xd01aa170,
-0xbd0ff37d,	0x883aefa5,	0x4313c7ef,	0x97e92355,
-0x84df4fa1,	0x251a1422,	0xbffca04b,	0x80d1e0a9,
-0x2de71585,	0x74f3cc3a,	0x06355b58,	0x404b01a9,
-0x76867925,	0xd35afcf0,	0x2e220cdb,	0xb0c03e11,
-0xff163ac7,	0x796b6c3b,	0x413f51d1,	0xfb5f33e6,
-0x0d3408e5,	0x29f2fd21,	0xe5937245,	0x43a62312,
-0x22bb80da,	0x517fd4cc,	0xd3b29526,	0xace3ace8,
-0x22e26346,	0xf6fa7e9a,	0xe956d161,	0x72d9e32e,
-0x87d1c6a2,	0xe2b89eff,	0xc94b7fba,	0xe61e89b4,
-0xf2a0adaa,	0xac5edf25,	0xef730b2f,	0x64519e05,
-0x59824baa,	0xeb00b868,	0xbf1e0a65,	0x95cebd35,
-0x144fca7c,	0x6ac6e730,	0x1d86878e,	0x955b87bd,
-0x00000011,	0xeb9a3ae2,	0xba19250b,	0xb6913770,
-0x5dd1fadc,	0x7b61bda5,	0xfbe1046b,	0x62b40d10,
-0xe32f8fcb,	0x76e9f340,	0x80120c6b,	0x8d04430f,
-0x427e9ceb,	0x6c128159,	0x5de4d263,	0xfd9943da,
-0x2c499c2a,	0x168d6819,	0x8cd27a89,	0xc2b2c39b,
-0x4b40b5e9,	0xc5778358,	0x4e2716d1,	0x5329eb09,
-0xb1af099c,	0x551e74d7,	0xba61069b,	0xd0d20004,
-0x87a9b395,	0xdc791117,	0xdac97e23,	0xb29a2b31,
-0xb1300d2b,	0x24dd5664,	0x96d20a3a,	0x09a6166b,
-0xe458bd9f,	0x9914ee23,	0xbe60b4ef,	0x08881e03,
-0xe9079bf9,	0x9ae7ae18,	0x1897bde2,	0xe00ec0a2,
-0x1751088a,	0x3b204283,	0xffc815eb,	0x03e9fc77,
-0x54f7b156,	0xb4d6b92f,	0xa269c536,	0xfee06fc4,
-0x675f6d6e,	0x5268533b,	0x1e81c91a,	0x7575acf7,
-0xbccff158,	0xd409a1cc,	0xb4cec032,	0xb62f4a58,
-0x2d05e54f,	0x4093ea0f,	0x2466e0d6,	0x013b12fa,
-0x19acb0f3,	0x2d93c94a,	0x85d74d7a,	0x1a8e7de1,
-0xe8bc68c2,	0xe513c711,	0x0c2bedb1,	0x9b0c607c,
-0x24ba9e59,	0xec825171,	0x8e3f5e82,	0x83a07f57,
-0xfd85f5c4,	0x6ff83636,	0xd2080b7c,	0x8a17c257,
-0xe485607a,	0x556dd558,	0x46c0f284,	0x907ddb4a,
-0xa193cbab,	0x01c368e9,	0x20711144,	0x2738cc26,
-0x1c188f11,	0xefe83056,	0xe0196cdc,	0x2cb6dfc1,
-0xaeb2e1e7,	0xdddec8c7,	0x3b013363,	0x5407d3c1,
-0x4eebc4bd,	0xb95113bb,	0x340974b6,	0x47e5796e,
-0x4e95f12d,	0x44fd5064,	0x63ba8a31,	0x1bfbdb9f,
-0xdf166650,	0xdb9cd257,	0x3e6d00cb,	0xe7049407,
-0xc621b5e0,	0x5eb23371,	0xd003f1c1,	0x71e5b2c8,
-0x241e906c,	0xc2f105d5,	0xa700f715,	0xd457b00d,
-0x6d793928,	0x4483b5bb,	0x8eef9860,	0x85b613f5,
-0x25f78837,	0x34e41c87,	0xf7d14ca7,	0x1123081f,
-0xd1855d82,	0x7867ce93,	0x9882bb97,	0x54103ff1,
-0x1e651ade,	0xedb906f4,	0xf4dc41f0,	0x6322dc5b,
-0x099f62a1,	0x997850f8,	0x622265e7,	0xc8ff431a,
-0x8232e9f9,	0xa0a5a025,	0x8dda3467,	0x8e09e48f,
-0xa654d059,	0x415ddeec,	0x1aca17ab,	0x2d50a873,
-0x45a54f63,	0xd589cad4,	0xd588d367,	0xae7b08f6,
-0xadb29750,	0x1eb451af,	0xd47dc746,	0xe0cf7b71,
-0x9e88e337,	0xe1bcef41,	0xd8e29460,	0x7d609923,
-0x6a333eec,	0x321be9db,	0xf2398187,	0xeb1b838c,
-0x01b7c02f,	0x03ac1d27,	0xd4aea785,	0xa989e71b,
-0x84ba1913,	0x977cd99a,	0xd15853fe,	0x5018b240,
-0x6af4d728,	0x735e00b3,	0x24a0cd6c,	0x7dd4f269,
-0xede2d092,	0xe3b3039d,	0x8cf5822e,	0x1a8b92ea,
-0x066f92ba,	0x3d912396,	0x1ddb6adb,	0x2679ddea,
-0x4d0ade93,	0x710eacfd,	0x62ed9560,	0x291fd5c1,
-0xe3423996,	0x0392eb57,	0x8b4291ec,	0xa7f66bc9,
-0xde23a4da,	0x4e2ab73f,	0xbe3699c3,	0xb06331c0,
-0x65b3f723,	0xc56eb5e6,	0x91bf1361,	0x6c17db61,
-0x188ea732,	0x5a3b60f8,	0x5b6d8fe6,	0x56d77c42,
-0x3e331203,	0x509723d0,	0xbf26b1ae,	0x59a3a439,
-0x0c2cd228,	0xd96afee4,	0x8702a97a,	0x6553927d,
-0x4a0004f5,	0x64d93ed2,	0x447178ce,	0xd220d7c3,
-0xab5180a2,	0x8256f6ce,	0x20b8da64,	0xd716a140,
-0x79692a21,	0xe934bacc,	0x9f6ea2ba,	0x412adb52,
-0x1d2fac64,	0xbf0ae6b6,	0xf4c5de9a,	0x13e946db,
-0x0f3310d3,	0xbd472972,	0x44f5c6c5,	0x3e470c3b,
-0x351d0232,	0x21cf98a9,	0x4bf0ceb5,	0x0f2c7987,
-0xccfedfdc,	0x3deea1dd,	0x86266017,	0x78a1fd9b,
-0x19b5a8c0,	0x3aa5c795,	0x48132bc4,	0x7fefe965,
-0x89b3690a,	0x90313a34,	0x7a2352bc,	0x06c73845,
-0x6d6d1b65,	0x526d4e93,	0x607cc7ac,	0x89a77684,
-0xeeffd1e3,	0xa86371af,	0x1e015c36,	0xbb977ef7,
-0x185a984f,	0x1baa7128,	0xb6bc7577,	0xc185716a,
-0xbf6e586f,	0xfa266eed,	0x17d984e6,	0x8a1c9595,
-0xb32d9f4b,	0x4f44d51b,	0x4fff88b2,	0x1ed845b6,
-0x2ef58c74,	0xc5decdc5,	0x5763cb7c,	0x1de72610,
-0x3683c43f,	0x1b5a8841,	0xc845bbcf,	0x31d6a4b6,
-0xc9afcb9e,	0x4ada1ab3,	0x2dd6a920,	0x26a181d4,
-0x91ffe8b9,	0x10b7911f,	0x5ae0e496,	0xc8a1a306,
-0x007bb229,	0x03721f9f,	0x2e023ece,	0x1d078279,
-0xd159e0fe,	0x1c184355,	0x9c2812f5,	0x2fcc2063,
-0x612e7dea,	0x7d126bb8,	0x1422e3c3,	0x1425036d,
-0x28f8a945,	0x310da5de,	0xd395e6a7,	0x972ec389,
-0x0e8deb4b,	0x52fceb6a,	0x74416288,	0xca6a74e2,
-0xccdf3e5f,	0xf2ef0a8a,	0x4df24bb7,	0x1fcdb75c,
-0xe1a60d5e,	0x7d1207af,	0x4cbdb551,	0x5849d606,
-0x2f6b2c35,	0xfc033cf8,	0x21e1fc48,	0x539a19be,
-0x9b2836d2,	0x4d799d7c,	0xd26f7491,	0x6d814ba3,
-0x5d682bf9,	0x1c404f52,	0xcf845b7e,	0xfff3e64f,
-0x75454bbe,	0x7632bacb,	0xf277a7a1,	0xa0a55c12,
-0x32fa5cdc,	0x95929b55,	0x303254dd,	0x745fe3b8,
-0x686ba00a,	0x7bfc754f,	0xe6a0a2ed,	0x2921d130,
-0xfee7be58,	0x5b2a81cf,	0x663c25e2,	0xae19c4d9,
-0xf0ff2517,	0xf78241bc,	0x866ba061,	0xcd26e9b7,
-0xc0e7d263,	0xdef95515,	0xc4cd4fea,	0x7ea6c05e,
-0xd8adcfea,	0x7a8be458,	0xe248b952,	0x11b737c0,
-0x995299cf,	0xd3c45707,	0x58894624,	0xa6fd9f68,
-0x7d80e2a9,	0x7f813143,	0x5a1d3a31,	0x7ecf8e80,
-0x7dabdf8e,	0x480fec6a,	0x59ff3f4d,	0x1d993dae,
-0x2f084f9d,	0xa1d9c94e,	0xfc302461,	0x40312d9b,
-0xdbc844af,	0xe921007d,	0x84af6173,	0x6c502053,
-0x15372cc5,	0x7485bdc2,	0x12fc4abe,	0xfd7a3d03,
-0xf63d2207,	0x430a2197,	0x46ab82cc,	0x06e0568c,
-0x207ab6f6,	0x9f4fc33b,	0xefaf957f,	0x9dea7897,
-0x3e57c505,	0x2e4f2482,	0x84167744,	0x8c3320eb,
-0x417adb23,	0x1da5865e,	0xcb980246,	0x9a5e168b,
-0x8ef05027,	0x225c6c5b,	0x558a3de2,	0x8489acb1,
-0x5fe1642c,	0xa024fa25,	0xd5888a64,	0x89e26a48,
-0xe8edb76b,	0xe4da9dad,	0xf02d19a0,	0x9af5fab2,
-0xad5bcc5d,	0x1ac1b93b,	0xc5aff3ef,	0xe9c793eb,
-0x3a4ea426,	0xef4e4c81,	0x2c57d7c8,	0x0af13491,
-0x72d96850,	0xd2b0098b,	0x6b2ec0af,	0x7845345b,
-0xd9838943,	0x576e4433,	0x5bd9d0c7,	0xfacbf0f7,
-0xb78747f3,	0x4d273b51,	0x3391945c,	0xda6c4e7a,
-0x6fd26f1e,	0xaca3ca0a,	0x10a55561,	0x52a1dda5,
-0xfb4fedc0,	0x36e6be5d,	0xb23c624d,	0x8ce07b51,
-0xf45bcfb6,	0x35ccf849,	0x3b8e19e6,	0xdd4f57e1,
-0x183a9fa4,	0x53d026d6,	0x28f71104,	0x238c777b,
-0xb31ab449,	0x72e8eda9,	0xe1738dca,	0x5fa2006c,
-0x83f83104,	0x6c3259c8,	0xddf6de43,	0x94b00058,
-0x4142b380,	0x5471367e,	0xce78bc65,	0x54084381,
-0xc7996df1,	0x6a3acf67,	0xf4a58a36,	0xdbdf961c,
-0x5e8618e5,	0xfc1dcfce,	0xa961f562,	0x13371c2a,
-0x4d3d913e,	0xc57f9483,	0x543aad60,	0xf1ec24ad,
-0xe28f0d63,	0x56b9f65f,	0xba95e8f7,	0xda9a4254,
-0x1394a39c,	0xf0e2d0e7,	0x388b456f,	0x9b592ebb,
-0xc11db10d,	0xc2b7ceb0,	0x1c61bcc8,	0xa7a1dd92,
-0xea0521c1,	0x6081481b,	0xca816197,	0x2ba9d281,
-0x12b20667,	0x45598c32,	0x90529a90,	0x0a21378f,
-0x1549ca66,	0xc04c3131,	0x1534ec89,	0x35aae47a,
-0x9bc830e9,	0x7f86a355,	0x2cc79d4f,	0xb78f8d08,
-0x6b8c576d,	0x9492fba5,	0xd6706091,	0x2e8771e5,
-0xf1c8c7b1,	0x0afa15e3,	0x33ff38ba,	0x70ef6fae,
-0x41319eb4,	0xe6ac37cd,	0x897cc145,	0x51241e90,
-0xd98d6de8,	0x4f6d6294,	0x93303d3b,	0x2f4cb592,
-0x69a5df81,	0x988d1e2a,	0x07549af5,	0x7c4a7546,
-0xe1c60794,	0x8a5624ec,	0x1e3de955,	0x89481529,
-0xe36366e0,	0x6533eeee,	0xa05516dc,	0x3c101f2e,
-0x6e75bc76,	0x162ca709,	0xba6c2124,	0x5d18f071,
-0x53b0aabc,	0x53cc284c,	0x67cdf931,	0xb4019d46,
-0xdd1f8694,	0x48876d25,	0x14c833f0,	0x1facd2c2,
-0x23407af4,	0xea3d3c45,	0x2e4de842,	0x7adeba15,
-0x6aca8f3d,	0x147b22f2,	0x17a15f14,	0x5bbb0fa7,
-0xfa69afd5,	0x61d61c55,	0x942421cc,	0x9054a907,
-0x04ecd607,	0x4d21b233,	0xdfb00dfc,	0x664a2559,
-0x36e1695f,	0x8b187b9e,	0x6cf961e4,	0x6760b930,
-0x2532527d,	0xf43a4077,	0x7503e4e0,	0x4ec1cd02,
-0x2e9a2bc6,	0x0cb07702,	0xb6d2a51d,	0xd86c340d,
-0x0f51cd84,	0x9631a3d3,	0x3a0cffca,	0xca327a9c,
-0x984b0695,	0x06ba099a,	0x0096f1e0,	0x9cbec8c3,
-0x01c78c14,	0xc99fdab6,	0x3f7208ce,	0x15c16d93,
-0x2bc4a623,	0x6a129c2f,	0xbd76ee3c,	0xac0fe4bb,
-0xf80def17,	0xfb47f0b2,	0x400287dc,	0xf5c156f4,
-0x1af2b4ae,	0xfc25414c,	0x3ae947f9,	0xa0c18d6d,
-0xeda308e8,	0xc8ed5736,	0x6e08f1f5,	0x5235df3c,
-0x1d2f644c,	0xf67302e2,	0x41eb0baf,	0x85d1d5e8,
-0xdfaac749,	0x2e6f5568,	0x7637560a,	0xc3549faf,
-0xd0ab2cd1,	0x278a7cd8,	0x4ed193b3,	0x84b22b1b,
-0x2c3ecf89,	0x5a804460,	0xf74961a7,	0xdd21e0f9,
-0x891651b9,	0x0d809b55,	0xb7b384dc,	0xd98986e7,
-0xab1ca847,	0x7509c799,	0xc1f91529,	0x47540a9c,
-0xbffa13a1,	0x5e32b40a,	0x00706a0e,	0xfb14e607,
-0x9b2c4f57,	0x601bd09d,	0x12731e45,	0xb2f719ec,
-0xb80042c1,	0x0d274614,	0xc44e8f1d,	0x6f847d59,
-0xd52e86ea,	0xb198be47,	0x874c408e,	0x9796255f,
-0x3a97245d,	0xab28be61,	0x1b1ca983,	0xd30e4d4f,
-0x55402eec,	0x9992e9a1,	0xeb4d9c35,	0x11e4e399,
-0xb4c6f7af,	0x3a263ba4,	0x467847c0,	0x7f88e34c,
-0xf5d88b0d,	0xc074dd64,	0x0d7a1982,	0xfe0ba0fb,
-0x859d62f9,	0x54408bf8,	0x158cd71c,	0xdf6abf90,
-0xbc08fc31,	0x90172b35,	0xe8835c4c,	0xe9dfe2a3,
-0x31c70bde,	0xaca7eeb7,	0x22d9c89a,	0x03a09da4,
-0x1f6aaa97,	0x69875916,	0x5202feca,	0x8fb4b4da,
-0x26f2f9f2,	0xb9d454e3,	0x2ba8ba48,	0x728c78a3,
-0xae59a64c,	0xb10e3eee,	0x2363985a,	0x634ad668,
-0xcfabf3c5,	0xddae4056,	0xe678a770,	0x780627d3,
-0xdf9360c3,	0xc5da9020,	0x8da43677,	0x21cf988f,
-0x85af6686,	0x8ced5e79,	0xd87097a5,	0xb669eee9,
-0x86cf6940,	0x6333431b,	0x9057f31c,	0xfdd0a878,
-0xe205471c,	0xc57ac3fa,	0x175adf47,	0x82330a65,
-0x75ff0f7e,	0x96ba0efb,	0xa783ae1d,	0xaa30b2b8,
-0xcdfd237c,	0xb187a599,	0x2a6f32cc,	0xa6d759ce,
-0xdafa26f2,	0xef3aac74,	0xb78a7ce8,	0xe7681faf,
-0xa803cafb,	0x1932b833,	0x29954c10,	0x4c27c02a,
-0xb3390b63,	0x45a7a656,	0x15968d5d,	0x8db4d7ca,
-0x0fafef03,	0x49fa8fef,	0xe2d8e1ec,	0x29a3fd0c,
-0x1e4417fd,	0x880bea78,	0x777efb2c,	0x0ded6ca5,
-0x6d75511f,	0xf09f20e6,	0xf135cca2,	0x1748bec1,
-0xf501afe5,	0x12b13a46,	0xd32ba485,	0x3af701b4,
-0x3cce44e2,	0xd2295b64,	0x1c2b6a2b,	0x1ed53738,
-0xc35929c9,	0xfbf9a3d3,	0x1090c32e,	0x593f67bd,
-0xd72ee065,	0x4546e14d,	0x5b5eb122,	0x90595ee5,
-0x66e295f5,	0x90636ff2,	0x91495ece,	0xb8085ff9,
-0xd52e413a,	0xeebdf818,	0x7210a9a6,	0x4e69162a,
-0x1d87746b,	0x78bcdd0a,	0xe3cd0bf9,	0x8cf6fb6e,
-0x3ddb321d,	0xde64faf9,	0x85432f8d,	0x9fe898aa,
-0xabb62682,	0x648fe85a,	0x10a2b168,	0x2f4e6f40,
-0x25cf1f7d,	0xa7094727,	0xa37836c4,	0x1a500fba,
-0x996a467c,	0xdac51ba4,	0x5302884a,	0x4499a7eb,
-0xb6c37b74,	0x3033c91f,	0x00f39932,	0xc43c7ebe,
-0x28234041,	0x0008fa40,	0x02ee946f,	0x1018dfa0,
-0xbe74defa,	0xe3a90b78,	0x9765f2e0,	0x818d1ede,
-0x0483ce60,	0xcea9ea79,	0x9651556e,	0x552a27b7,
-0x138ed241,	0xcbd38e5f,	0xad15387f,	0x31d5c7d4,
-0x443af6f2,	0xc2fe7ff7,	0x29db77d0,	0x5e78a202,
-0x897b48e8,	0xd6517ae9,	0x4c82f424,	0xf541acb8,
-0x60e843fd,	0x0f9a5d41,	0x6d0d39cc,	0x5ad2ae84,
-0x4501e2be,	0x296bd4f3,	0x979fe84d,	0x2209535c,
-0x16b768a6,	0xe4ec2221,	0x8303445d,	0xf09ce428,
-0xa7974dee,	0x21df013b,	0x841ce40e,	0xc3dcb4ac,
-0x1dffbe41,	0xff9ba686,	0x76ac6f6c,	0x15a8f314,
-0x12462cd5,	0xff5420dc,	0xf42056b6,	0x50689be6,
-0x3de042b4,	0x9a8b850f,	0xba4eab79,	0x875d59c6,
-0xadd5dd45,	0xbf3001f1,	0x46e88000,	0x9509b620,
-0xd35acc8e,	0xbce596d4,	0x3e017144,	0x98686134,
-0x90220297,	0xfe0be716,	0x0c4f94dc,	0x46935424,
-0x68c6c03e,	0xa3820973,	0x052da67c,	0x0786d78f,
-0xffb71a67,	0xddfa3f0d,	0xd0bb0442,	0xf1d28e48,
-0x1ccd3624,	0x1646f541,	0x06de5e60,	0x38f0890f,
-0xc67dc1db,	0xa6084221,	0x15cef80c,	0x0cab0c97,
-0x2b5a4403,	0x5247b5df,	0x07a9727c,	0x3eda0c9a,
-0x561d9408,	0x50dbb4b4,	0xba8bc023,	0x93e9dd1a,
-0xfe2cdd03,	0x9df4be7d,	0xf67b4020,	0xbe177ffd,
-0xae58895a,	0x9533ce36,	0xd4db9bb2,	0xb0c4b820,
-0xee808e03,	0xf6aaf6c1,	0x64878887,	0x59c01683,
-0x808c2023,	0x88a8dbfd,	0xd2196b3b,	0x2638bade,
-0xf98da4df,	0x415492d9,	0x8a48c040,	0x7f237a28,
-0x048404e6,	0xb67ac6a6,	0x8612a74d,	0x419f83d7,
-0x7e25fc7a,	0x51522244,	0xa66bb57a,	0x85c49809,
-0xdb1beb59,	0x4a92f612,	0x133d41c2,	0xeba6d046,
-0xab1a1991,	0xb0b60102,	0x6fa2f6c3,	0x40a065d2,
-0x9fa7af2e,	0x541154b0,	0xd152b419,	0x8fca6da8,
-0x266ebbed,	0xc7c6fd56,	0xc6eeffe0,	0xbaf24600,
-0x53ac35e9,	0xbf96734a,	0xd824cef8,	0x2e06271f,
-0x98dc396b,	0xfd691a91,	0xb3316c04,	0x55a9556c,
-0x40460791,	0x016fae00,	0x9e80936d,	0x865c48be,
-0xbbf9e7c0,	0x8605e52a,	0xd4cf7fcb,	0xae424090,
-0x19f4919e,	0x7869306c,	0x0d975851,	0x6d6e209e,
-0xf450e97f,	0xe07b4025,	0x6768c9f5,	0x8101efa8,
-0xf267ca1e,	0x14e63f3c,	0x9e0402cb,	0x7d752938,
-0x75bf01d2,	0x0c648c71,	0xbc16ef47,	0xf25788e4,
-0xfdd4f4f8,	0xfdb9b51b,	0xce95124f,	0x79b49c17,
-0xa3ad1812,	0x69f67653,	0x3d7f0557,	0x2374c778,
-0xfb7fd252,	0x72e87895,	0x9c28c801,	0x8f3a1eb4,
-0x6cdc9fee,	0xc0eddfc8,	0xd750a1a2,	0x5c59ba95,
-0xb6800268,	0xe47d74c2,	0x6e8a5bf1,	0x237d78b6,
-0x59576285,	0x4b68a491,	0x541446e0,	0xd0f2a058,
-0xe35ceffe,	0x3a6a6f55,	0x69c7aae8,	0x60f24589,
-0x985133d2,	0x06563d24,	0x3e859aa5,	0xa9fec8e3,
-0x6638afc7,	0xcbce1aa5,	0xf7355507,	0x6928bc3d,
-0x0e9cd473,	0xcf8368da,	0xf0de4f65,	0xf9267098,
-0xcea9cb2b,	0xd4fa0821,	0xa5ce1f5f,	0xdfeaa430,
-0x31a2cd59,	0x95a9cc20,	0xfa2ae166,	0x79ae79f5,
-0xbf526a3c,	0x6650746c,	0x44cf2dda,	0x550215a0,
-0x4f0c13ce,	0x2abb8b26,	0x518fa50f,	0x6b391300,
-0x77755d34,	0x54312269,	0x3939dc93,	0x734dd8f1,
-0x6d59151f,	0x39fe6eb1,	0x3c86282e,	0x60196a41,
-0xf402d6dd,	0x98d39ef2,	0xf85ed6e8,	0xb3c715cb,
-0xa6bf790e,	0x1a000dc5,	0xbe2d812c,	0x6d312e9c,
-0x344d1abd,	0xcdfa61f6,	0x5a8ba942,	0x5d85335c,
-0x7cccb15e,	0xa51563db,	0x25a0a0b2,	0x2646c04f,
-0x70bb163e,	0xee753340,	0x1d564aaf,	0x3f8e52eb,
-0xe2f94390,	0x088692b2,	0xe98d5fbb,	0x432d6848,
-0xebcc7c07,	0xc006e435,	0xa4ed57c3,	0xd8337440,
-0xcd87eab6,	0xda5b4f74,	0xd59e9be7,	0xa03ccbdc,
-0x29116dbe,	0x66af819f,	0x08361160,	0x8afafd05,
-0xeda29b2f,	0x727fabc1,	0x9f7ebe4f,	0xa59af345,
-0x4397c33d,	0x6d638a4e,	0x5dd5c73d,	0x3830af05,
-0x04a6e070,	0x7dd7a7fe,	0xe04e8511,	0x58e722db,
-0xc0b10a49,	0x3afdfd7b,	0xe90893da,	0xb28df676,
-0x5820aedd,	0x98827732,	0x67773622,	0x9bd02312,
-0xf8b40ba3,	0x953b41e5,	0x3fdaccb8,	0xb586205c,
-0x31038d52,	0xd9750ce0,	0x1eb706a2,	0x63635238,
-0x9763fc4f,	0x0234a005,	0x88fe50b9,	0x9e0acedd,
-0x54f05d4e,	0xde4070a1,	0xe6d1ffe2,	0x20fcd772,
-0xe0c81b43,	0xb5163405,	0xa11af3ae,	0x72be6f34,
-0xf1f76254,	0xf6f7479f,	0xa96ae92d,	0x34327289,
-0x2aa5c4aa,	0xa1dfd44b,	0xb1b07289,	0x8e540bfc,
-0xec094d38,	0xafc811f3,	0xa20f2e52,	0xed09d405,
-0xb76ec720,	0x5c156f2e,	0x0ef1d38e,	0x2db4f6f8,
-0x281f9fd5,	0x46b1f2eb,	0x9be4dfbd,	0xeb315383,
-0x19c2a683,	0x908950ec,	0xb8745c73,	0x3cdb90e3,
-0x9fb7ec13,	0xc37e7a54,	0xb1217c04,	0x6ce6e918,
-0x31d4bc3d,	0x580e0706,	0x0c679bd8,	0xa5a09d65,
-0x614e2adb,	0xbb123d00,	0xd134dcf2,	0x0eb45806,
-0x94a950c6,	0x4e8ec2a4,	0x56320afb,	0x710585a2,
-0x41dc0457,	0x37c4e759,	0xe1e0a084,	0xe95fbd3e,
-0x19d70436,	0xc688c94f,	0x90255cf3,	0x2516a509,
-0x31df0804,	0x56d2da5a,	0x02fc845c,	0xc0f075ad,
-0xaff2e3ef,	0x46f4fb49,	0xbd6652d0,	0xea14d768,
-0xb76a3d39,	0xbc3b1cfc,	0xd49c2b9e,	0x5d532619,
-0x9f5d2219,	0x89eca480,	0x0bba7260,	0xd285889e,
-0xd902272a,	0xd87f6650,	0xd6d25c23,	0x6fb4fec6,
-0x196c23dc,	0x672185d9,	0xe6ae5a33,	0x7563c23d,
-0xe7afbe73,	0x76ccdf49,	0x461e3696,	0xed8b238c,
-0x216d46df,	0x88c149d6,	0xf6d4ab92,	0x30718da7,
-0xefcb6edb,	0x90fffc89,	0x34e9d2b6,	0x27139e31,
-0x3556ebc2,	0xb7d3c804,	0x86ca3b30,	0xe7a4c236,
-0xe6cee875,	0x715b374a,	0x9b15879e,	0x4cddc9a9,
-0xbc3f44f1,	0x470a0dae,	0x1afc4183,	0xca46569e,
-0x281d1b88,	0x8c82845f,	0xe70e00e2,	0xf9b8d849,
-0x84fea5f9,	0x51c93d93,	0xacfbd7d6,	0x5c79209e,
-0x3ae52088,	0xe985210e,	0xb20f972f,	0xb048ad54,
-0xcec68543,	0x9b3fce97,	0x89f9d1c6,	0xf5e98ecb,
-0x9a5ec8f7,	0x8dbfcd63,	0xda17fc16,	0xb6fcb687,
-0x12f869d8,	0xcac6e7c4,	0x678fa5bb,	0xb3e9d922,
-0xb7bfe2a8,	0x1c1eee4b,	0x7cea677e,	0x1996a42d,
-0xeba47427,	0x8993c0b1,	0x1799971d,	0x5e7064e1,
-0x0532627b,	0x7a48147b,	0x79fdafb3,	0x9d9cb3b0,
-0x4fbfaa6a,	0x21a9671a,	0x60570804,	0x8fb66807,
-0xc3a49480,	0x2805c91d,	0xd3515af6,	0x57edfe32,
-0x3ef3fb8c,	0xb9b3f95d,	0x1b022d82,	0x6ac3cdc8,
-0x93533461,	0x0cc29053,	0xb53679f9,	0x72536952,
-0x59649588,	0x174da5b2,	0xe60fcb68,	0xe283a204,
-0x2f1ddc9c,	0xdd06e047,	0x831e2c61,	0xdab727cd,
-0x3c2b5739,	0x1e3eda44,	0xbce6b352,	0x42d28a6c,
-0x1853b1bc,	0xee1e42c4,	0x12a956cb,	0x580268d0,
-0x3d38ba37,	0x116c2ffb,	0x0dfe6ab5,	0x7d5e4124,
-0x0fd87017,	0xb2c764b8,	0xb1f2d593,	0x55d0c550,
-0x3128f13f,	0xc57f355b,	0x71358d13,	0xa366b148,
-0xa5999caa,	0x0810500f,	0xde6f01ca,	0x8e804f14,
-0x1bf416c7,	0x9ed5c10a,	0xac57fdf6,	0x0adc8452,
-0x87c10dfe,	0x9e91e726,	0x5318e4ce,	0x5e5c61a2,
-0x82184d50,	0xabd125bd,	0x1099d5b0,	0x37bb1aff,
-0x922e7b9c,	0x26dcffa0,	0xc475d907,	0x605ce8bd,
-0x917dc18c,	0xb82f532c,	0x0fc4cac9,	0x7a906c10,
-0x9fc533ae,	0xaead9ae1,	0x06bd7f84,	0x5f260e51,
-0xea0a2a6b,	0xbdd6a14b,	0x8a5dc413,	0xd10c6dae,
-0x57da8c47,	0xfee24743,	0x3667543f,	0x16dbca1a,
-0xae745aa9,	0x0d0704d7,	0x6c0c7b87,	0xcaad8cf5,
-0xf4253fa7,	0x34a938e8,	0x8859c3fd,	0x873c0ef6,
-0x32231439,	0x4d10cb3e,	0x71f42b74,	0x8a1cf7f6,
-0x74a894b4,	0xde6cac18,	0x73a68234,	0xd4d39962,
-0xc9a966a3,	0x6336797c,	0x754d2166,	0xb5f6d9a9,
-0xbc3ffb62,	0xdfa78a6d,	0x36fffa5e,	0xa50eb15f,
-0x137e1dc9,	0x5e182fff,	0x5950daea,	0x6c196698,
-0x20edd7ca,	0xa8545918,	0x14ad0958,	0xcd9d41c5,
-0x6ac0641a,	0xb4433283,	0x9b3bd42a,	0xba3b53ed,
-0x0db8e3aa,	0xa625208f,	0x0b45b37b,	0x86a2c3aa,
-0x396f4971,	0xc4ff5d1f,	0x7e0bb235,	0x9fc0fa85,
-0xe2d301a7,	0x45fed48a,	0x7b6346b0,	0x32870ec4,
-0xe5e401d3,	0xc02ce749,	0x4463c76c,	0x3d433355,
-0xbdcf9d76,	0xa9807de4,	0x618dcc22,	0x0fa04ef2,
-0x3cc5f03c,	0x3efa8e43,	0xd6135458,	0x67e6b697,
-0xd7183c35,	0xc549b990,	0x9ac7c86b,	0x9faaad31,
-0x32e67f1f,	0xac089c6a,	0x740414f6,	0xb2eeffaf,
-0x5cdecb51,	0xadae2872,	0x5cbe9f47,	0x6f61f816,
-0x8ebea745,	0xda4dae33,	0xfab5beec,	0x6f918a13,
-0x80c0d157,	0x38ec316d,	0x5ac2159d,	0x183222a0,
-0xbdb1acde,	0x2818e447,	0x7c83489a,	0xd862dd8d,
-0x39a9ec81,	0x5cb4b17c,	0xa21e593e,	0x80558237,
-0x94abe977,	0xc9a7aafc,	0x9a46a332,	0xe840a903,
-0x84f138cf,	0x4df461b3,	0x8eaef0cb,	0x7dff383c,
-0x8aa5a95d,	0x1b5b18b8,	0x04649b75,	0x27ba2c97,
-0xe0c53823,	0xd367e126,	0x51cee98f,	0x7641edec,
-0x4cc92c61,	0xaad0cbf7,	0x580e6ef2,	0xc1d71b7a,
-0xaff0e069,	0x8bfc7bdd,	0xd011b5ed,	0xcef17089,
-0xd8043cc6,	0xa2928a72,	0x80c0c894,	0x7761bccf,
-0x5207a887,	0x91350033,	0x4933943e,	0xf8f966db,
-0xaa596d59,	0xdd4eee07,	0x8bc3f666,	0x5d2c317f,
-0x4f884baf,	0x9656f8ed,	0x06960b18,	0xb854c6a2,
-0xadb2111c,	0x87ec6839,	0x198d0349,	0x4bf8adea,
-0x3774599f,	0xef939fa2,	0xa679ef16,	0xa4fcd9ff,
-0x2266d9c3,	0x83bba05d,	0xf52cf76b,	0xbce694ad,
-0xe7c72760,	0x8d1ea17a,	0xace588ec,	0x807156ad,
-0xda75a2a7,	0x39aac1ff,	0x7baead56,	0x9069c021,
-0xfc8fff1a,	0x7b6dbd4c,	0x20206990,	0x07c6e33b,
-0x42399b00,	0x21c5c7b7,	0xbf63cbb9,	0x3826b73f,
-0x352bb32b,	0xb9399307,	0x175009bd,	0x9c84ebb9,
-0x10052749,	0xc688b555,	0x03e33f18,	0x6721a126,
-0x19abdae7,	0x64f09e3a,	0x2a22e801,	0xa2713b17,
-0x06a4726d,	0x6f4b5001,	0x59448714,	0x31cb2a1a,
-0xf6de12b3,	0x99b843ed,	0xebb0167f,	0x71fd1234,
-0x4c21a09f,	0x16e74415,	0x448e1a29,	0xb231f58a,
-0xf285fb09,	0x1a1fd69f,	0x8014d055,	0xe6457a61,
-0xf5fb7454,	0x84692b92,	0xc95945ce,	0x5edf180c,
-0x87b224ae,	0xe527b249,	0x70b92e8d,	0x222ffacf,
-0xfc157ef7,	0xdddecac5,	0x2835b04a,	0xbd3a47b6,
-0x4cf46a93,	0xd2e21769,	0xf17f68d7,	0xb357c4a5,
-0x2897c2f3,	0x33d36f62,	0xde21b713,	0xf31fb93a,
-0xfa426665,	0x40db2038,	0xa0a64518,	0x039a4901,
-0xa62dfcd5,	0x415eef87,	0x1b4fff92,	0xd052150a,
-0x62765368,	0x085033dd,	0xe689328b,	0x75e91e36,
-0xd84b42ac,	0xe7c5b3b0,	0x406148de,	0x292110b8,
-0xfa865732,	0x47b9bcda,	0xb60f0ecd,	0x47823acd,
-0x0ee97131,	0x82887810,	0x02ce6d38,	0x17569eb6,
-0x93d99227,	0x06b9ddae,	0x4edbff17,	0x143e9971,
-0x4b3930b6,	0x193584f2,	0xaff7ba40,	0x5e2306d1,
-0x80871fa1,	0x75dcd3a5,	0x5b41a3a2,	0x37789713,
-0x5f4a2dd8,	0xf864f01e,	0xe042a3e8,	0x4148ccba,
-0x827a61df,	0xf5dbd5ac,	0x67cd2158,	0xd4b6d338,
-0x1b1aea2f,	0x23faa332,	0x1194b5cf,	0x2f0f9f2c,
-0x7f969cff,	0x96d0fd45,	0x38d28fde,	0x60cec7a7,
-0xed38edf1,	0xbaad9030,	0x128b3b1a,	0xf4ea7a25,
-0xcdb0accc,	0x583ca262,	0xa6e1a5cf,	0xba31cb5b,
-0xde2b746a,	0x752270dd,	0xcebf4dd9,	0xef01a663,
-0xb69ec990,	0x6931f11f,	0xac096cd9,	0x73475308,
-0x84b4c642,	0x66033d8e,	0xae232f55,	0x28cb582f,
-0x34d9b8bb,	0x5edf44d4,	0xd1181d1a,	0x4ad90f85,
-0x3ff56f90,	0xdbcd8501,	0x94a1819c,	0x3271541b,
-0x27ada641,	0x2dfc9ca8,	0xe62d5a90,	0x088b3d3f,
-0xb3cf5f12,	0xaf069a37,	0x63679b19,	0xaad7d449,
-0xcc5fd5b8,	0x5a9142fc,	0x0281927c,	0x2d0ce3fe,
-0x3037817c,	0x94d06391,	0xc13fa032,	0xc636a8c4,
-0xa1a0c778,	0x65aa8b75,	0x9599c263,	0xd94cdd90,
-0x8eb558d6,	0x4f3749f7,	0x78e950e0,	0x38643ddb,
-0x65ee43c0,	0x9e363d33,	0x3b87741e,	0xde6e407f,
-0x19de335b,	0x19e8d2f6,	0x90802537,	0xe7d6d63b,
-0x1787f368,	0xcbf66cbe,	0xba3a37b3,	0xe263b083,
-0xb64aaf3e,	0x4dec8202,	0xc4f5e604,	0x27ee4210,
-0xbed9cf46,	0x358781a4,	0xaf9eab78,	0x18be9c90,
-0x6a623920,	0x7c057b86,	0xf882d402,	0x50c46ea1,
-0x803649c9,	0xcf3d7300,	0x3089fe4b,	0x9b7e1531,
-0x61f911d2,	0x4136335a,	0x69170b86,	0xc62a5260,
-0x450e0b60,	0x3c0b08b5,	0xe44c8860,	0x145726b9,
-0x97813960,	0x37b361ad,	0x6b1b616b,	0x9989ea33,
-0x01f7789f,	0x61e28cf3,	0x40e1512d,	0x8a8f9865,
-0x55124a0a,	0xaf373d35,	0xeb7fa4b3,	0x6a4add68,
-0x012b5446,	0xd3ab99bc,	0x9b6db31b,	0xd10c995e,
-0x98ccaf6a,	0x9bf82cb4,	0x54682b04,	0x2f631ee7,
-0xdd94cb6d,	0xb7f94c14,	0xec5c57d6,	0xbc65b92e,
-0x70f7668f,	0x00ee9567,	0x3ed5c805,	0x13fba1b8,
-0x5af52407,	0x1856675a,	0x365594d4,	0xc3a83e4e,
-0x6515d279,	0xc2979baa,	0xe7cc9eda,	0x61f01f53,
-0xf9411245,	0x94bec7fa,	0x50549553,	0xdc19a9c9,
-0x681f8f34,	0xcf46edda,	0xb8375cb0,	0xc70b2756,
-0xd399d9ab,	0x4dffdf90,	0xeebac705,	0x2d44101a,
-0x65964dd3,	0xbe60aed4,	0xd1b290a5,	0x290da975,
-0x62eff9db,	0x35009e42,	0xe27a522d,	0xb24ce07f,
-0xd2ca2fd6,	0x0d5a5a9f,	0xf6cff261,	0x26ec16a6,
-0xacd666ff,	0x5fee597d,	0x8467e190,	0xb8cfc7be,
-0x82fb971c,	0x441e6b0e,	0xfee1caf8,	0xf5fb071f,
-0xb056ab46,	0x75c330b1,	0xf0bc85bf,	0x69b331f3,
-0x0256e176,	0x1435996b,	0x702f75df,	0x4154cced,
-0x4b40453b,	0x3f7abb20,	0xce3b0aa1,	0x766fc3bb,
-0x81fd4c44,	0x17b8ba52,	0xd7fb0e9e,	0xff374026,
-0x0b698083,	0xe4a6c9b0,	0x18eb2f49,	0x9aae1e7a,
-0x32484742,	0x6139d119,	0x9350ea46,	0x7ed9de20,
-0x2131f58f,	0x52549b17,	0xb201f3ac,	0xeb7caf13,
-0xf4036d92,	0x9428e976,	0x89421ca7,	0xf60b6995,
-0x59bd4fa2,	0x89b86ce6,	0xa469f764,	0x48d8c8d0,
-0xe66cbf97,	0x8dc7d81d,	0xe3f905b8,	0xd7b4cb0c,
-0x9132fa6b,	0x4aaec41f,	0xabf68871,	0xef4802dc,
-0x12526fda,	0x45526faf,	0x3932bfef,	0xef6dfc38,
-0xc080d9b7,	0xc72f8598,	0x573ab055,	0xdfb72b23,
-0x9dc53edc,	0xfd3ac5ec,	0x84e50e7c,	0xbfc9eb65,
-0xb3056c3d,	0x5a396aa4,	0x6180b509,	0x219e1fd4,
-0x7e138823,	0xd2e65b21,	0x5fd36b8f,	0xe6d8abf8,
-0x56b88085,	0x66c05230,	0xe22ca851,	0xd720f405,
-0x856f9be8,	0x35a8682e,	0xf275d0d2,	0x7288a85c,
-0xb255eabf,	0x2f3e676a,	0xdd0d28bd,	0x8a8fcc09,
-0xd8428b2d,	0x22e52a0d,	0x7b483bdf,	0x14d41be6,
-0x05ae59cb,	0x063658cf,	0xb24da744,	0x48cd0f2b,
-0xbca96305,	0xa999b0d1,	0xa2c42f68,	0x2bfe1725,
-0x9ab27e6b,	0x4f79bb59,	0xa64ed14d,	0x5c46ff15,
-0x2e660ef7,	0x0e8f0bd1,	0x2bb94584,	0x190d693a,
-0x5dfe96af,	0xc5d7361c,	0xf9be47e2,	0xea6fa47f,
-0x0d8a0095,	0x272553da,	0xb2737912,	0x49ecee43,
-0x33df06fb,	0x17760780,	0x97947161,	0x1fa88e08,
-0xe88078be,	0x5f759a63,	0xc9844461,	0xce746b70,
-0x2b72adfd,	0xd19d71d3,	0x7238c74e,	0xb55d71ed,
-0x17fcdfcf,	0x1e6c0047,	0xa9bf858e,	0x5d296185,
-0xae4161d8,	0x2d56e96f,	0x7d060ca2,	0x6e799e8d,
-0x1e587bad,	0x57ea2e0b,	0x33614106,	0x2b484b37,
-0xb10269ce,	0x7c974af9,	0x75f443de,	0x9717aa1e,
-0xabc80de1,	0xfd1dbed1,	0x71621211,	0x60cc7d40,
-0x54e1ec96,	0xdc91d8f1,	0x2393f240,	0x4a3dbc49,
-0x29222229,	0x2c0c5518,	0x470aa74b,	0xcddb9fb3,
-0x61e605f3,	0x337cf31b,	0x1ba0b540,	0x398d5f76,
-0xa22b6df2,	0x8bb89ee6,	0xbbfc6357,	0xf74e79f9,
-0xefda480b,	0x30ba8b7e,	0xfe4e03b0,	0xd04fc0c7,
-0x86258634,	0x2adfdd62,	0x4e4f2674,	0x93e56b8c,
-0x2e78c5c6,	0x4e76bca5,	0x48679d44,	0x3a846da9,
-0x5d6b12e9,	0xda73232b,	0xe34251b0,	0x17572f6b,
-0x6729b544,	0x7990f599,	0x7554c71b,	0x1fb8bad4,
-0xb8f81a89,	0xdd65611a,	0xc513ff44,	0xbe474f5b,
-0x5e80d269,	0x74df7437,	0x3229f1b7,	0xad061e9f,
-0x859ded69,	0x50d5d7af,	0xb7f7694e,	0x9d6f43f4,
-0x5f9aa11d,	0x27d7765e,	0x959e33dd,	0xd1bd686e,
-0x501d92e2,	0x78713be5,	0x790e3965,	0xe500cbdf,
-0x10eb1fd0,	0x4928cfe5,	0xdf1c5a8f,	0x05b87e8f,
-0x701ed594,	0x767ffa32,	0x68856c65,	0xe2f77b4e,
-0x56e77c33,	0x29ed2f13,	0x28188b9a,	0x7571dafa,
-0x3f41e634,	0x127a9d8a,	0x995f90de,	0x629b5f7b,
-0x22b8bc77,	0xe6676784,	0x047d5585,	0x02ca1b60,
-0xcb355de1,	0x87c0874b,	0xd0397ac8,	0x2fec1fa8,
-0x1db32444,	0x19fdca51,	0x51b00b88,	0x89a639a0,
-0x6bba927a,	0xe9c450d2,	0x4fc2e197,	0x5a51e78b,
-0x05591a54,	0x37aec32d,	0x561e2be7,	0x8a32f3fa,
-0xb11b25d4,	0x29fb5a20,	0xd6ca46e4,	0xb07fa849,
-0xd9957eb8,	0xc9f1a9fa,	0x2c7d8fe8,	0xfe6a0c00,
-0x827104b5,	0x46ab8392,	0x67b92aa9,	0x7092a67c,
-0x50f21bf0,	0x1606d8a6,	0x54719270,	0x82d4396e,
-0x8a104a73,	0x4bc8d4da,	0x304c9461,	0xe1bf9cd4,
-0xa192be94,	0x785a2869,	0xbe01cbd6,	0x01f0db0a,
-0xaa8344d6,	0x86e888d6,	0x9b5a12ac,	0xe854ac02,
-0xda115ff4,	0xb51036c4,	0x22576a19,	0x485e719b,
-0x1cfa4ec0,	0x5e595cca,	0x04ba7b4d,	0x8ec44bc6,
-0x1fb7cee3,	0x7b0b14d0,	0x04e5d7d0,	0xeba53547,
-0x6bbb70a1,	0x4400a5ee,	0x9a9812a5,	0xa205ed91,
-0xf3ee9643,	0xa06c7cb3,	0x353769ef,	0xbc09cc16,
-0x416e44f2,	0x377c09ad,	0x3aea4eb9,	0xac3e0267,
-0xfddda8df,	0x7e14d6c3,	0xa9cacbc1,	0x29097dac,
-0x429a81b3,	0x7599f50f,	0x13e76171,	0xfd9decfd,
-0xea8f3e9c,	0x5d294f3f,	0x0ee430a1,	0xc1e5a5cd,
-0xe52520e7,	0x21d11ee0,	0x1737107e,	0x442337a4,
-0xf9280fb8,	0x2fb5a79b,	0xce7a2d53,	0x14726542,
-0x75442521,	0x5b857d70,	0x5e4b99ac,	0x083ee63c,
-0x0e119350,	0x645bff73,	0x79675cfd,	0x0e97488b,
-0x45324433,	0x519f148c,	0x5f633f22,	0xe7dae749,
-0x4bc5ed84,	0x41b75046,	0x4c896935,	0xbe62efed,
-0x2daaa2bd,	0x35847f0d,	0xb2c0f967,	0x93bdfe83,
-0xe727d414,	0x2ec67c2b,	0xfaab854b,	0x41f3d471,
-0x607aacb1,	0xd57e119d,	0x1b8bd447,	0xd0e142de,
-0x9f1e077a,	0x1c17468f,	0x1a280618,	0x22afd414,
-0x777f95af,	0xc826fec0,	0x94d48e76,	0xef1c2700,
-0xe244406e,	0x3de39dcc,	0x940ea18d,	0xabd1e1c4,
-0x43e86576,	0x56854524,	0xe145c15e,	0x77c8451e,
-0xd324eaca,	0xcad6624c,	0x71a3f2f0,	0xfad46198,
-0x990e97a9,	0x2c446253,	0x98fe1658,	0xf2310f28,
-0x1533c8ce,	0xc0e1b15d,	0xc7b6d88e,	0x899bf940,
-0x1ad68ce3,	0x9aa8a706,	0x99d17ba8,	0x920af51c,
-0x91a608df,	0x4464df39,	0x715838cd,	0xf6c922e0,
-0xe258422b,	0x1994f795,	0x074006b0,	0xc464ddfd,
-0x1920413d,	0x4b083da2,	0x7a1176c1,	0x992107a9,
-0xc521b43a,	0x10d41801,	0x5dd7305c,	0x6087ac71,
-0xdb685110,	0xee9362ea,	0x85ed6159,	0x53c25065,
-0x054ab00b,	0x71f7502b,	0x9c63ff30,	0x31c61d73,
-0x2252d5df,	0x2b6003c9,	0x6556a10d,	0xbc818248,
-0x6670ae3b,	0xacc67d1f,	0xabaa2c5e,	0x4d466a07,
-0xa871ee83,	0x49ba540f,	0x7c84296c,	0x7f4f595e,
-0xce6f9fe5,	0x4c519f34,	0x56f6c5ef,	0x6ab2488f,
-0xd3dc9fe0,	0xe5d3d063,	0xd553424f,	0x4e20c7b5,
-0x3b0bf2ca,	0x6be78ea2,	0x5d13cc5e,	0xd1140e2a,
-0xf06a2c44,	0xd4413646,	0x332ed443,	0xc03cbf94,
-0x7ccff645,	0x6252264f,	0xb96f108c,	0xaf3a11b9,
-0xee9f9544,	0xe851ebab,	0x5b607b84,	0xcb9c2960,
-0x1048922c,	0x44b0a0b1,	0x79d18be0,	0x26b80688,
-0xdbaa475e,	0x811bdcbd,	0x4cee3d7c,	0xc74db453,
-0x5f9ace5d,	0xd9aec19a,	0x20561be2,	0xaaf822ac,
-0xf430145f,	0xe6e3cac3,	0x48bd2a97,	0x24d72d5b,
-0x966fb875,	0x64c3d7a9,	0x5e71a697,	0xf1884978,
-0x48dcc4db,	0xad3e0810,	0xb90f4750,	0x319d0d37,
-0x7a8b8c5f,	0x9f3d53e1,	0xd87f1c6f,	0x8d9101c1,
-0x3f1b112b,	0x3bf5dc58,	0x7ad04a6a,	0x94ef3321,
-0x916e4210,	0x51c7e5d8,	0x91d4aaba,	0xa3e92a47,
-0xf56b2eec,	0xfff66c52,	0xa9e13a9c,	0x0e96167b,
-0x355497e7,	0x24338ae3,	0x45b2bb97,	0x0bc273b5,
-0xf6a51e39,	0xe7248a3f,	0x60415a1d,	0x0010160b,
-0x1dafe42b,	0x48c1e4fc,	0x02953f7a,	0x218acf1e,
-0x388cf8fa,	0x28795d41,	0x10359290,	0x501fae08,
-0x632cf79e,	0xdbe8fe58,	0x65eb9215,	0x017d15bb,
-0x931e266e,	0x314f2c88,	0x8eab618a,	0xcea54b6f,
-0xaa0a8989,	0x7da3bc7e,	0x32d0dba9,	0xf3688c01,
-0xb0bf7b1f,	0xd9da409f,	0x993d9ea8,	0x5af04221,
-0x95128910,	0xf158568f,	0xb042f372,	0x7b17439d,
-0x23e94398,	0x313dcc98,	0x5845bbfa,	0x33b01435,
-0x2bf39159,	0x9d0163d5,	0x8ed36b3b,	0x8e2cb1b3,
-0x5ad64e67,	0x0b24b30f,	0x9c423d07,	0xee38d2c2,
-0x4598587b,	0xa52a5a8b,	0x881bd68a,	0x769980fd,
-0x2214a562,	0xd702ab7c,	0x1c2b0138,	0x0c62a1e1,
-0xdc7ad108,	0x52686332,	0xfd49ba5b,	0xf647862f,
-0xf4b4c25e,	0xbecff488,	0x3d112666,	0x4151440c,
-0x8f88957e,	0xc7383393,	0xa2d5a80c,	0x83c77173,
-0xeeb5a0c7,	0xd1fbb00a,	0xffaba1b8,	0x2414d540,
-0xaf6d282b,	0xd3969374,	0x425f56be,	0x1baa5bf6,
-0x011d6396,	0xfb391bf4,	0x58302ef0,	0x7ee79065,
-0xde53c818,	0xd2e4da9c,	0x465ce80c,	0x0ceb8e12,
-0x9e66863c,	0x79906fc9,	0x4c0e2950,	0xd1956004,
-0x7cdbd82c,	0x3441c0cc,	0xcfa22192,	0x295cc89d,
-0xcc555616,	0x9b85a047,	0x2e77b8a4,	0x7b39da59,
-0xe15a873d,	0xf20cc541,	0x335c495f,	0xad4ba104,
-0xb07dd44a,	0xe7edbefa,	0x3085a397,	0x38d20199,
-0xb2cb8c58,	0xbe4f5b8e,	0x24071764,	0xeb0164ff,
-0xd9772703,	0xb4a36e97,	0xa4a7a9ca,	0x604b41c7,
-0xe532829e,	0x168229c1,	0x76af50db,	0xd54afb5f,
-0xca210b15,	0x175f6203,	0xd2fb4e6e,	0xf547b193,
-0x188452a3,	0x94b32fe9,	0x5c829304,	0x9e979e44,
-0x29130895,	0xd0f53fe6,	0x4317f4f3,	0x2017a46e,
-0xd327054c,	0xf2660046,	0x328eb545,	0xf15a68c4,
-0xd43050a1,	0x9efc1075,	0x15d55067,	0x102212a9,
-0xb7f7b5f5,	0x248c4355,	0xa637a511,	0x17b73dc9,
-0xf8d8ce75,	0xa0b93c92,	0xa4d0f2ba,	0xada786c9,
-0x9f0e1ed5,	0x81b07c6d,	0xa8c90b39,	0xa747a8c1,
-0xf1456a32,	0x54ea6ee5,	0x72ae1925,	0x95c94ac0,
-0xc4b0fa59,	0x79732e29,	0xfe575e46,	0xa0e7debe,
-0x29fb8dce,	0x83b49983,	0x46569a83,	0x5057c58e,
-0xbd8081b5,	0x92a2c2c0,	0x793fbeaa,	0x0f4c3880,
-0xa2c7638a,	0x1581b3af,	0xf67a4923,	0xeacbfaf4,
-0x7b9d4a6e,	0xeecb97d5,	0x7d0516e5,	0x9962e310,
-0xc245572d,	0x65b71f33,	0xb44b9d58,	0x3517e28d,
-0xbc16c41d,	0xd0b66301,	0xe3416d81,	0x585e029a,
-0x9aed1a96,	0xc2086505,	0xd4cf4192,	0x744f0c24,
-0x632e8411,	0xa44f1511,	0x81f59fc5,	0x8cc6c2ac,
-0xfed3beea,	0x34c110a8,	0x7cb634b2,	0x62456643,
-0xc504313a,	0x98c26f55,	0xd4ed7e11,	0x7bfeadf6,
-0x7c68d58e,	0x65e66a1b,	0x2f1d6e7c,	0x8c1c08a1,
-0xb563a4d5,	0x312f84f6,	0x8401e81d,	0xccfabe08,
-0x61fdc464,	0xffd65aba,	0xd8bd89eb,	0xce23114b,
-0x31e128aa,	0xaf95b80c,	0x84270ee9,	0xcb137f47,
-0x79410289,	0x07a93471,	0xe68ef23c,	0xe1fef2a6,
-0x6e0e8314,	0xda2cce7d,	0x894121a3,	0xfb1c20c5,
-0xd1752395,	0x5626b1dc,	0x05053336,	0x86ba92be,
-0x23370320,	0x94f8549f,	0x5f5b72d3,	0xaf78f301,
-0xaab0a8b6,	0xadace3b9,	0xdefdb66b,	0x0ce3b4e0,
-0xee9b4962,	0x5719d4d2,	0x2ff50570,	0x0702fcfb,
-0xc5e3630f,	0x8eaa58c4,	0x9ea47bb1,	0x881a17da,
-0xe6fb697b,	0xaac71f0f,	0xfa62241c,	0x2ccb5198,
-0x94cc4c46,	0x366aa148,	0xbcb59a64,	0xe1cfc0d7,
-0xa38458db,	0x51a86430,	0x66495b4c,	0x571e1a8b,
-0x2114fcae,	0x69dbaec8,	0xf3a66ba1,	0xd23994e2,
-0x57fe8cf7,	0x204a3626,	0x7f03d4a9,	0x59250a4f,
-0xb45a4c83,	0x6aa274c6,	0x31290be8,	0xeed74069,
-0x33aa8f54,	0xdd2c206b,	0x0d5ea41b,	0xf8328f3e,
-0xe6cbc951,	0xb799de80,	0x43829de5,	0x328e0b46,
-0xd6ec89e3,	0xf529db37,	0x7ea69733,	0x62de055b,
-0x2056a292,	0xce1c1a8b,	0x8e357d35,	0xd2417621,
-0x04a01591,	0xee3b5744,	0xc06f5726,	0x99a3adda,
-0x09d0feb0,	0x14cccd6f,	0xd83e76e0,	0x222e6a5f,
-0xe5632e53,	0xdeccde3f,	0x1a0c0867,	0x507df575,
-0x22ed6f2d,	0xb3ef1d47,	0xfc6063b8,	0xe60ba55e,
-0x7825ab4d,	0x2371145b,	0x5ad1fdba,	0x19d4bcd9,
-0xb722e8ba,	0xbad38438,	0x9b48640e,	0x73b84413,
-0x0e97c7df,	0x0946d2de,	0x229b14c9,	0xe86393e6,
-0x81ddc735,	0x68062add,	0x41958b5f,	0x5124eb16,
-0xd94d6103,	0x381dfb2d,	0x61aa9925,	0xa7dd0b80,
-0x9b53ab59,	0xb9d42823,	0x04dcbd9f,	0xfaeb3642,
-0x6aa38344,	0x4027c476,	0x555b44d6,	0x8eb0afeb,
-0xfe7306f1,	0xe76f488b,	0x3b7a503f,	0xb6759184,
-0xaeeaadd1,	0x2e29c3a8,	0xe24a70b4,	0xe4479032,
-0x7771f192,	0x64f84949,	0xc94fc39d,	0x373a5e00,
-0x36da2363,	0xe3041a6d,	0x4b2b99e4,	0xd78e9084,
-0xbf85da93,	0x2f205941,	0x40417315,	0x13c24a8d,
-0x1c10b3b2,	0xdbb78ee9,	0x7253a034,	0x731ecefd,
-0x6cbd8f22,	0x89d3f5f0,	0x2bfa135a,	0x333743d2,
-0xdb92aa03,	0x90b6b014,	0x63dbde46,	0xd1882651,
-0xc2bdbd5e,	0x00894dcf,	0x1b03a8f0,	0xbab43173,
-0x96aae94a,	0xfbfdc1cd,	0xafbeb8ec,	0xcb355db4,
-0x08c378bc,	0x0ba33d68,	0x85085217,	0x1ad58bbc,
-0x8dfc9a71,	0x738a1272,	0x9dca5e36,	0x449d6a9b,
-0x7b4f18b9,	0x38fb74a8,	0x8af301ff,	0x3374f77c,
-0x89f5bd81,	0x97ee33b6,	0x5b3c2abf,	0x77959b7f,
-0xe7a9e3d9,	0xfe61f610,	0xeec7aa5d,	0xde51356d,
-0x608257bf,	0xf63043d5,	0x5d7c9ed2,	0xc5840799,
-0x359a23e3,	0x55af6d85,	0x6d1f36d1,	0x5656d4fc,
-0x832d9232,	0x2d2f1b9a,	0x657acf9a,	0xba7453fe,
-0x1e4353bb,	0x032b7e1c,	0xffc9545d,	0xe7070df0,
-0x0cbe6d83,	0x17e09169,	0x424d17bf,	0x9b00a500,
-0x4eb5f38a,	0xc28b10e7,	0xbd33f464,	0x7249d152,
-0x3bfd62cd,	0x970eccb8,	0xb80363d9,	0xacd54c7a,
-0x1029a85c,	0xf0134460,	0x23fbc0c7,	0xca2239b8,
-0x56e00b18,	0x3bb4e8e6,	0x4c6e8615,	0xfe76765a,
-0xa67d48f1,	0x5a0e654d,	0x1e5074bc,	0x11458823,
-0x45be96c3,	0x72d2bbbd,	0xf9ecca30,	0x939a0c23,
-0xd8635ef9,	0x79e067e4,	0x1484f9eb,	0x7dcc8542,
-0xf4929883,	0x493ea4ca,	0xed8f3860,	0xf04ae72e,
-0x80a2053a,	0x538c4988,	0xea3362a7,	0x4fbfc698,
-0x581aa5b7,	0xdf65bc6b,	0x7d31a626,	0xf531c7bf,
-0x927f6fa8,	0x8055a9ba,	0x8dc807a6,	0xd81f09a8,
-0x68c2dc82,	0x3af8c10f,	0x73a53137,	0x08b4e64e,
-0x76304c20,	0x52c08eb2,	0x5a882a35,	0x6b67f389,
-0x4fbc83fa,	0x2ca8fa77,	0xd11668bb,	0xbad67e00,
-0x85f0a180,	0x0d8b1ae4,	0xd38a322f,	0x60da109b,
-0x593bd498,	0xe51b2bcb,	0x14648c80,	0x726800ab,
-0xa3eeb97e,	0xcaef519b,	0x1908766f,	0xe80ea4d0,
-0xbac31e8a,	0x9beb5e13,	0x6fa0eea7,	0x6bf95c26,
-0x3e6deb1e,	0x9786dce1,	0x70e9bf69,	0xfb302104,
-0xc8e16ca7,	0x519738cb,	0x37149a41,	0x381f5178,
-0x3ad0350f,	0x5ea9af95,	0xf4461908,	0xc87a9ce6,
-0x6f52e0c2,	0xd1769989,	0x0a744f5f,	0x3b8fecb5,
-0x52a949d4,	0x4babad95,	0xb0341b77,	0xd809acba,
-0x651a3f0d,	0xa9801f9f,	0x39ce6bd9,	0x54ba7ecd,
-0x696986f3,	0xed029c7b,	0x906b778d,	0xdff29490,
-0x38602541,	0xf58f4ff6,	0x86b4b9bb,	0x790607c6,
-0xc37401a6,	0x9030efee,	0x8cd44992,	0xe70c9534,
-0x3530865c,	0xc390247b,	0x13550b6c,	0x87894843,
-0x955ad8f4,	0x95440ce6,	0xd1c22858,	0xb499cf5c,
-0x5e83df19,	0x81056e1f,	0x6d5112e3,	0x75638145,
-0x39bf2dbe,	0xd72161f3,	0xde557eb6,	0xf6356398,
-0x2db46a89,	0x4557d1c8,	0x8c6a0ecc,	0x0bae6c6b,
-0xcc7f6792,	0x204b7e6c,	0x30fb0b31,	0xa9fcf48b,
-0x2663fbf2,	0xee93a15f,	0xbe4a98e4,	0x19a8385a,
-0xfbe22598,	0xb359c818,	0x95b82ff9,	0xf3a6ce4b,
-0xfa116c0c,	0x0fda53a4,	0x4a685f72,	0xdd4d1832,
-0x3755e730,	0x7aed0ba0,	0x4633fa17,	0xd7758b45,
-0xfa089372,	0xb91b36cc,	0x6a7260cf,	0xb4918d74,
-0x7eda9ce9,	0x8dd13de9,	0xcad651cd,	0xa6a338dc,
-0x8c6813ff,	0xff9c45d2,	0xacb2fcfe,	0x95ae0113,
-0xf70cd5d6,	0xd4dee57f,	0xa58c4343,	0xbe104819,
-0xff3ffdc6,	0xd7f64302,	0x4ca59221,	0x08793ce8,
-0xb9c821a6,	0xa99c55e3,	0xabcadfc8,	0x0b88f942,
-0xbd08e78a,	0xaca643dc,	0x1b30e3f9,	0x12bfac11,
-0x9796af2a,	0x9a7f3972,	0x65e221ab,	0x6d7594a3,
-0x54b82988,	0x6b278381,	0x8769e5d1,	0x965b6fe3,
-0xbebe9b21,	0xb6f36bac,	0x8f8da33c,	0xd77aedb8,
-0x1775b5a1,	0x2984fbf8,	0x3b0fbf44,	0x17773ea5,
-0x760f6088,	0x018bd34e,	0xeb774a8d,	0x567fa718,
-0x17ca8b3f,	0x8220432c,	0x0f68e4a9,	0xff117c90,
-0xd67b800a,	0x7a461e15,	0x82c188cb,	0xba47152b,
-0x13b23fea,	0x8e61dee1,	0xd9f1c761,	0x8ff89de5,
-0x62cab21a,	0x8f85728c,	0xc6408884,	0x43a2a469,
-0x8b3e8f18,	0x043f4824,	0x14659589,	0xb090d5f2,
-0x05a91efd,	0x224d84b8,	0xc79f169e,	0x1d8046c7,
-0x3d4ea750,	0x221c9d30,	0x2c5c2087,	0x7fdbac5f,
-0x91fc2da8,	0xa736e278,	0x39038cf8,	0x67b0b71e,
-0x0f250a19,	0x53087b1c,	0x9729ebe3,	0x348b2d1b,
-0xb3a24d9e,	0xd08da55c,	0x74538332,	0x5cfc072b,
-0x694e58ce,	0xb394df82,	0x91588d91,	0x02996ac4,
-0xf013b27e,	0x07f66569,	0xc1753619,	0x3ddebd53,
-0xfc2ac824,	0xff42acf6,	0x977393db,	0xf67b0e95,
-0x4fe47e2d,	0x87907f18,	0x107db3b3,	0xdb35340a,
-0x28769056,	0x80edeb2e,	0x747d2f05,	0x01f73d97,
-0x173beab9,	0x2a040ce3,	0xc129d573,	0x1251d4d2,
-0x73c76801,	0x0f878167,	0xdc036e20,	0x53e3f76d,
-0x2323c75a,	0xe340042f,	0x964a789b,	0x89a041f2,
-0xe67a8448,	0xe3671b2c,	0x710d8f54,	0x6d694024,
-0x74a7aad9,	0xfc1837e1,	0x38a71de9,	0x5006c498,
-0x641f95b7,	0x7d864289,	0xd342a49a,	0xe5010ef9,
-0x8c496b4a,	0xfb358af9,	0xf1f9368b,	0x7cca6a36,
-0x8618bc87,	0xeb3ae8bf,	0x61f48970,	0xc6e5062d,
-0xd2461f57,	0xadc1e245,	0x2dd9e925,	0xa9b2e37c,
-0x697b8bec,	0x3b451a73,	0x76e080a6,	0x7b912795,
-0x97d2e126,	0x50c2f330,	0x9bc93379,	0x9d7b0df4,
-0xd83e5fd8,	0x8c5e8721,	0xac7f7b98,	0xb3a91e35,
-0xa7cc3d9c,	0x747bea50,	0xe1678746,	0x21c5f8f0,
-0x628ae8cc,	0xcff34e1e,	0xcba82f25,	0x3bd5ec0b,
-0xd7e1372d,	0x0da6304e,	0x1d32c4a6,	0xa9d49a28,
-0x544e2e21,	0x7264fd82,	0xe7fbeda6,	0x9ba8dbc8,
-0xd24a521c,	0xc785dd05,	0x698b547c,	0x71a9c242,
-0x507586a0,	0x4dcaf039,	0x5f217691,	0x188831ae,
-0x060ed9b0,	0xde29bf1e,	0xc6b29e32,	0xa0e030dd,
-0x899343c8,	0x294cf5e9,	0xb877c367,	0xc62a6c28,
-0xef88131b,	0x702282e4,	0x6429b119,	0xdd745d70,
-0x6bdf924b,	0x8357bf5f,	0x75eed80f,	0xf16e71b5,
-0x29889692,	0x8af3075d,	0x8cd9ca44,	0xcb8845ae,
-0xbbeb0ca1,	0x9d596b21,	0x5f5a1ec5,	0x6cc0c183,
-0xc608ded5,	0xd31604e0,	0x3d85e5e8,	0x9bd4fa8e,
-0xcc34132e,	0x5940460e,	0xe268dbe4,	0x52cf9287,
-0x1b7dbb06,	0x25730036,	0xaa32d1e7,	0x5c1fdd22,
-0xec1cb109,	0x44087118,	0xe09798e5,	0xab01caa1,
-0x9bcec119,	0xd5fdd6f5,	0x27aeaea1,	0xea78729e,
-0x1f420935,	0xa1d70ee6,	0x049df2ae,	0x83c20e63,
-0x424f97ab,	0x82d47ad3,	0x1d83d1df,	0xb4161ca7,
-0x3f5e0b50,	0x958a9041,	0x857a9d99,	0x7d9d91f8,
-0xf99e7712,	0xbe771046,	0x51be59d5,	0x66ea6488,
-0xeb6650ac,	0x97c180a2,	0x21dc2bed,	0xfd8d86ad,
-0x640d9a16,	0xc41c9b74,	0xd88a707d,	0x92cb7073,
-0x85e68614,	0x139f86ad,	0x6627608d,	0xe9fba87b,
-0x5a3d3b3f,	0xea153824,	0x393feea6,	0x642338bf,
-0x48ff83a1,	0x62abc55b,	0x0454c198,	0xf8515e0f,
-0x8f0604c5,	0x4e8ddd6c,	0xc0edf728,	0xff750695,
-0x78a7776a,	0xfbbd9cb4,	0x46d78b35,	0x32c0aeb3,
-0xe45bf2f2,	0xd5c3bc58,	0x8b3e46c6,	0x24400769,
-0xc64bf282,	0xb30596e2,	0xdf516e75,	0x80527d5a,
-0x5abf0966,	0x0872d2f9,	0xde4b188f,	0xea935446,
-0x841ab5e1,	0xdc1322fc,	0x652e58b7,	0xec7bb00a,
-0xdc48b52e,	0x603f7d3d,	0x02752a69,	0x24627060,
-0xaf9745a6,	0x38f20f01,	0x5633a1b9,	0x8a1970e8,
-0x09246a35,	0x6fa51a58,	0xd2b27306,	0x74103348,
-0x7941c71c,	0x9f3e195f,	0x9ba8cef9,	0xb99d6c7d,
-0xbe43300b,	0x1ed69899,	0xd6ef4ae2,	0xbd3fe197,
-0x23cc030e,	0xd0bef932,	0x2db820c1,	0x8877612e,
-0x9128ed01,	0x0e755f8a,	0xfe2c9806,	0xa15d724f,
-0x95d18472,	0x1eedb954,	0xe744521c,	0xf7c96972,
-0x1ed14fe3,	0x53cce19f,	0xaf56d69e,	0x9cce0147,
-0xf66e30fc,	0x1d67d01d,	0xd7b7e307,	0xc4a6385a,
-0x0ab2a974,	0xefe450b5,	0x943700b8,	0x63348d22,
-0x0f9174c1,	0xcde51bdc,	0xb7f8d4e0,	0xbb7e75e4,
-0x3cb583d9,	0xd7e0dda5,	0xd0875b4a,	0x8a64f15b,
-0x4d9cabd4,	0x629cc9f5,	0x27e71c36,	0x8bf12d0f,
-0x3ef45763,	0x6f0b34d4,	0xdd8b2dff,	0x82a5095c,
-0x02bab80d,	0xe5a68cd3,	0x68995a29,	0x0df37ce7,
-0x14d44f9b,	0x90e6505f,	0x0dc08cbf,	0x56f5b89d,
-0xf4f14479,	0x4ebe183e,	0xccd9360f,	0x53879eed,
-0xcc70e90f,	0xe617267b,	0x57338015,	0x54552eec,
-0xceb90d51,	0x44a3ae6b,	0xa0f7cf7a,	0xb525e534,
-0x413f377e,	0x269d35f5,	0x4c0a3729,	0x55a81cd6,
-0xb5d498f7,	0x06e32c31,	0x6740688f,	0xaec33d8a,
-0xed352319,	0xb11b6b74,	0x59345c58,	0xb8539660,
-0x38bd4440,	0x2e1316ae,	0xc0ee6600,	0x37fc4283,
-0x3932a038,	0x203ec984,	0x13caa3fb,	0xb490d47a,
-0x70e3cff4,	0xaba8ced9,	0x677d746e,	0x6303c4d2,
-0xfa740ec4,	0x71bf15bd,	0x263bd4c7,	0x62dfa93e,
-0xb90d9d4b,	0xfeb8e8e9,	0x624358af,	0x89b70973,
-0x81cb8cf6,	0x438f014a,	0x1d65b30f,	0xce203f65,
-0x11aa98bf,	0x5ccc683d,	0x2045a241,	0x1c0330a3,
-0x1e42aa70,	0xf398c278,	0xec636e99,	0xfd81d6f7,
-0x7313adb8,	0xfbce08cc,	0xeb3e10d3,	0x0c957e90,
-0xd8385cc1,	0x6f10683f,	0x3c0c8426,	0x933e5847,
-0x72bec41f,	0xea07ff15,	0x68dbbdfd,	0x18e77edb,
-0x69f25646,	0xbe6070dd,	0xdb274397,	0xdd37d62c,
-0xe06a88d6,	0x212cd794,	0x1f245c16,	0x69a23bd0,
-0xba9c2078,	0x9aa26c67,	0xe4536bb6,	0x74555886,
-0x403a8213,	0xc1895ebc,	0x31221b33,	0x484e026d,
-0x60bf9a95,	0x99aeb46c,	0x6ea68ca5,	0xc7cc87fd,
-0x46c8309d,	0xa238ba76,	0xc8b60544,	0xe75a6c26,
-0xf132bdb5,	0xbdbf818a,	0xddf921ee,	0x31281410,
-0xbc273ef4,	0xa3701e22,	0xe2a1e259,	0x7974a770,
-0x1f74c73a,	0x75ace81e,	0x27f1953e,	0x6e33ec5c,
-0x6ae3ff52,	0x6fe7c21a,	0x71c3f609,	0x153d3813,
-0xf4802aae,	0x5ab384e1,	0xa2b29ab9,	0x9dafa630,
-0xffe7b99a,	0x9a4607bf,	0x0e8f2703,	0x2246a835,
-0xa117ebfe,	0x38d8e29a,	0x325197fa,	0x1be0a760,
-0x00638a25,	0x43b5f305,	0xa7ae61b6,	0x4c6ce339,
-0xb0794319,	0x2edae1ca,	0xe9f106ba,	0xdbf0ef5c,
-0x3a9ed279,	0xb8776285,	0xe8dc472c,	0x3a7e3354,
-0xa094a9f9,	0xf2b8ab62,	0x7597040e,	0x1b239793,
-0x56c47cd9,	0xaf9daf11,	0x4cf77900,	0x85411aed,
-0x24abb609,	0x87d3f779,	0xe1b47d57,	0x8adc640b,
-0x6c9e93c7,	0x1acd9bcf,	0x103f1378,	0xabbd82c1,
-0x97675df4,	0xf397b109,	0x9560abcd,	0x4e81fd4b,
-0xc347ee60,	0xb318bfd8,	0x77cb26c7,	0x01ebf5c7,
-0x61688cd4,	0xbdc33fac,	0x944bcfb4,	0x6a24ac82,
-0x1fcff29e,	0xafebd257,	0x23394071,	0xd6a7e3de,
-/*  3180-m1220652_00000009.inc  */
-0x00000001,	0x00000009,	0x11122009,	0x00020652,
-0xe580b1fe,	0x00000001,	0x00000012,	0x00001bd0,
-0x00001c00,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000009,
-0x00000000,	0x00000000,	0x20091112,	0x00000621,
-0x00000001,	0x00020652,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xdce14aa6,	0xd82a62d8,	0x1a50462a,	0x40f3fd31,
-0x27fc5cef,	0xd6b052d3,	0x2a1a06b3,	0x44b13284,
-0x5d5f57b5,	0x9926d84a,	0xdaaf70e7,	0x91786b18,
-0x82da740d,	0xae90be68,	0x8b6a07cf,	0xc2c37ebc,
-0xde451f9c,	0x7a1444c0,	0xce6700b1,	0x5c29e58a,
-0x12eb603f,	0xaaf6cb53,	0xd807a1c9,	0xf51ed696,
-0x90d9e2c3,	0x641bff09,	0x732ab820,	0xfef7aa2f,
-0x8f518e1d,	0xf0d8c4d9,	0x73aefe19,	0xf6d7ae12,
-0xd50a095b,	0xdf21cbb8,	0x4b81ff9a,	0xe1a6d1f8,
-0xbe78b0de,	0xda86826f,	0xc4f9c057,	0x306f1761,
-0x7aae81f0,	0xdbab0ae2,	0x789ec0ff,	0xbaacd096,
-0x68fa4733,	0x2f3fd406,	0xd287247f,	0x79eefe4c,
-0x6f674a41,	0xd6948ad8,	0x90388682,	0x5a4bf35d,
-0xadab41ff,	0x89e9dc62,	0xb2eccfee,	0xd4d52153,
-0x34301d19,	0x8a2f38a6,	0x35b05e56,	0x482f029a,
-0x296cb5a3,	0xce64f437,	0xae1dfa06,	0xb9f29132,
-0x1960a103,	0x70bb6f46,	0x152a5d83,	0x171a19d9,
-0xac9aa4b7,	0x54b719f7,	0x5b781cb1,	0xaea548bb,
-0x00000011,	0x2e969375,	0x5a0c3042,	0xdeda547d,
-0x57713817,	0x3fcb3fe2,	0x700c8b79,	0x383a2bf9,
-0x54c97193,	0xf7ed88cf,	0xa562b29f,	0xfbd73613,
-0xa4de2f32,	0x90ebe900,	0x5d6d0cd8,	0xcac0f1ca,
-0x481aa1d1,	0x4fc2712f,	0x00395dac,	0x649f1093,
-0xc424d1c3,	0x80a2aef9,	0x26d77ea4,	0x58d881aa,
-0x08ea63ca,	0x9a6cf85e,	0x608494cc,	0xefa3d439,
-0xc4348579,	0xe55614dd,	0x4af75b96,	0xdcd91562,
-0x5a43a1cf,	0x049d6889,	0x4b103037,	0x2884587c,
-0x5d95f479,	0x4909d9e3,	0xdba2b6b8,	0x7357bf99,
-0xcfc8ed25,	0xe426b749,	0xc40bfb90,	0xf7d3cab5,
-0x9f6ae2b5,	0x1e377c38,	0x1a2fc035,	0xdece9b06,
-0x13602f9f,	0x227542c0,	0xd6393283,	0xcd314e87,
-0x974f45b5,	0xd70a2f21,	0xb5c87a4b,	0x2bd1501f,
-0x74c320c2,	0x30e3402c,	0xfe7cd541,	0x4791cf6e,
-0xd1304a5f,	0x58913c1a,	0x461cc615,	0xf673f34d,
-0x46e01d21,	0x583f1f57,	0x2c6c26e0,	0x49cb29af,
-0x868f2076,	0x2ee9ac2a,	0xda6a816f,	0x1050fc42,
-0x849847d8,	0x643eca38,	0x59724cb9,	0x855093be,
-0xa407d0c4,	0xd9a0bac1,	0x1f51f95a,	0x64ca2848,
-0xcea97e49,	0x1ec83f2e,	0x3b36451b,	0x7cc376b8,
-0x502c28db,	0x412b53ef,	0x4f80d266,	0x39c2c46a,
-0xdd8696ed,	0x8b4b6a71,	0xf4a30013,	0xd4451aee,
-0x3dd4a35c,	0x08d97080,	0x5b2622f5,	0x0786a611,
-0x07b71c05,	0x98f3db3f,	0x1a1300c7,	0xaffdee91,
-0xc3006a26,	0x8faa0c86,	0xb1565ee0,	0x10a4768c,
-0x7375a1e7,	0xfbee0667,	0xe13f532a,	0x34b5f5f3,
-0x48f0650e,	0x84acedcf,	0xcc31c269,	0xee8efc60,
-0xb7620966,	0x07685c8d,	0xd079ee7e,	0x27c80660,
-0x3dffb8ca,	0xf29c773f,	0x65c5071d,	0x5a32a715,
-0x5abb9fd8,	0x4605163b,	0x6fda02bf,	0xb816bf1a,
-0xa3bd6959,	0x4330562e,	0xb8a0fc2e,	0x9808ddd5,
-0xc4da8f4e,	0xa21f9e52,	0x17d9ca40,	0xf6ca8232,
-0x747c8cab,	0x65a56a38,	0x5602e5f2,	0xe348aaab,
-0x6e0bd504,	0x825381d0,	0x092911ba,	0x990eeec6,
-0xc3122bf8,	0x8baab8cc,	0xbd4cd41c,	0xabf61bd0,
-0xec181e8a,	0x0a30d8f3,	0x7c93ee0f,	0x2f57eac5,
-0xe373f24d,	0xd75b6a50,	0x6cc186ee,	0x2d2b4869,
-0xfa4ec563,	0x54e1896c,	0x80dae8af,	0xbccbc604,
-0x24bb3fb0,	0xf1aff085,	0x37ca0dc4,	0x3b4d1cfb,
-0x95eacf56,	0x21040c81,	0xd9bf5f5a,	0x278fe036,
-0xc9e31f1d,	0x8b947e50,	0xe615bf9d,	0x29f6331c,
-0x94343090,	0x897d81fd,	0x3b936a1a,	0x79a87927,
-0x293dd101,	0x39c2a56d,	0xaf162b08,	0xdbe932a0,
-0x6d2454a3,	0xcd56ba0f,	0x63608e99,	0xef1baa23,
-0x3f1e6842,	0x31a4153a,	0x2436d3fc,	0x8188bbf4,
-0x5bedee92,	0xc64660df,	0x8de6f099,	0x7c1ae433,
-0x6badcadb,	0x088baf56,	0x5e6a6b23,	0xe0bbdc56,
-0xb5a3a7f4,	0x7397f4d6,	0x5f4b79ec,	0x4e82c2ae,
-0x55cf7d09,	0xfce4f1e2,	0x908cac9e,	0x975b0f7c,
-0xbe0c5211,	0x413b14dd,	0xb4d54868,	0x7b2b5dbd,
-0x087eb1ae,	0x8ad40fef,	0x1b6f2f1a,	0xd1b53848,
-0x4b379216,	0x2f06f2ec,	0x47b76338,	0x9a2e0a7e,
-0x02012585,	0x228272bd,	0xda90e7f9,	0x70d5e74a,
-0x3f96f251,	0xd83db7a7,	0x4a126c68,	0xb80e0dcd,
-0x9c7150ba,	0xabbc68ca,	0x41ac7528,	0x3b36474e,
-0x13408d0a,	0xb4e77850,	0xce29de79,	0xfa6b8e4e,
-0x9bae6ee4,	0x55e0234e,	0x8d1634b0,	0xcfc0894f,
-0x50e8b98f,	0x3552b58e,	0xbd46d4fa,	0x54330fdc,
-0xf8e2a7af,	0xa5fd2882,	0x5584e766,	0x8ec3c4b6,
-0x842205da,	0x949a7f9a,	0x8d1c4302,	0x3a33890f,
-0xcae35fca,	0x544117d2,	0xe5c5756e,	0xa9a67bcd,
-0x902e83ef,	0xb5e33469,	0x9f4374fc,	0xf67b198e,
-0xd80067d5,	0x99b3fe3a,	0x9161db71,	0xda72b60b,
-0x1fbb5e0d,	0xc59ef3b2,	0x9d667e4b,	0x87b032fa,
-0x88ef4c97,	0xc7a6958e,	0x4bc451d0,	0x35233b0f,
-0x707691b0,	0x91d28863,	0xbbf6b8e7,	0x501d6387,
-0x2d44838a,	0x27ab3930,	0x574e6093,	0x1b84070c,
-0x29a39e90,	0xc0d4d375,	0x3ec0241c,	0x8d5130de,
-0xd71c6ad6,	0xa9099fdb,	0x4a5dbc4b,	0x4a822124,
-0x3745b2fa,	0x3116e2d1,	0xbc1c4878,	0x49a2e870,
-0x7e798e4d,	0x755d1ea6,	0x18a29c16,	0xcaa3c6c5,
-0xa02f7331,	0xd6439679,	0xe77641a4,	0xfc06a227,
-0x7ca99576,	0xf6704e41,	0x304fd33e,	0x1be47cfa,
-0x9f341342,	0xeade8228,	0x58a2318a,	0x5666a767,
-0x70233529,	0x014e5b3a,	0x7958ebdd,	0xbfd30535,
-0xe787a3e7,	0xf1e61119,	0x221316ee,	0xbd6ffb66,
-0x5bafb598,	0xbe7adc9e,	0xd4cb2470,	0xf71cf4e4,
-0xb91117ea,	0x0aae09d0,	0xd2c575d6,	0x9fe50981,
-0xbd6f16d7,	0x0407e468,	0xfc6175b0,	0x980aaba2,
-0x2ae3f449,	0x687c7bcd,	0x1e2bef21,	0x1297950e,
-0x3c49a1c4,	0xb7931e58,	0x3700607d,	0x6ccffc16,
-0xb5f0b8df,	0xe3b454b8,	0xc78172ce,	0x38d6bc8e,
-0x2fbe9a06,	0x91bb3870,	0x4729cdd2,	0xc3991b5f,
-0x52fc90b1,	0xc1f9ebac,	0xc9dbea10,	0x08833b4e,
-0x053b0c4d,	0xce3097d1,	0x8b4773fc,	0x227b8412,
-0x7bf7205d,	0xaa36912d,	0x96176f25,	0x9e17de06,
-0x298b6697,	0x1748d7d5,	0x042cff8f,	0x57dfad2e,
-0x497a04e4,	0x0f94838e,	0x9a2f337d,	0x98db046e,
-0xf59c604c,	0x67aa30b5,	0xc7281e21,	0xf81867f3,
-0x25de2896,	0xf6d3239e,	0x1928b65d,	0x5f72fa81,
-0x3b5c7c57,	0xc51bb21c,	0xeeb51c3f,	0xbd7d077a,
-0x6f385685,	0x6775eff9,	0x1c481b0c,	0xdbc7dd36,
-0xfbe2917e,	0xa7e399fe,	0x82ae4f84,	0x6919da96,
-0x9f4cb810,	0xe9125bd9,	0xebad62bc,	0xef958fcf,
-0x41d40a4b,	0x76a44ae9,	0xef445a6b,	0x01f9a43f,
-0xb18a1508,	0xd0764dc5,	0xfd2a1517,	0x07021da7,
-0x6f8af923,	0xbab451e8,	0x112b2843,	0x9f2534f4,
-0x5835ce51,	0x43c3e61c,	0x10b6df6d,	0x55f03306,
-0x63993d96,	0xef6064ae,	0x83a10859,	0x68710064,
-0xf5c79677,	0xd3d044bd,	0xdbfaa51d,	0xc5295594,
-0x041a43c1,	0x4347bbf1,	0x04a712d7,	0xb2bf4715,
-0xdc5528f3,	0x4ea6a1ad,	0x97826d45,	0xd6dace9b,
-0xe4500ed8,	0x08705291,	0xb8f075d4,	0xa89c1468,
-0x7a4bd60d,	0x6cb1459a,	0x5feec3c0,	0x893cd43b,
-0xe8d32a19,	0xfcf64a81,	0xf1c1d329,	0x2d751696,
-0x1a05e652,	0xa0d20414,	0x6fdeeac7,	0xfdf139b0,
-0x700a92b3,	0xe29f8616,	0x8a59adb0,	0x47da12ce,
-0xe873864c,	0x0aa0c7b2,	0x1f1a3d44,	0x4530a1fe,
-0x110d987b,	0x60144ae5,	0xcd4e503d,	0xcb273839,
-0xf7467cc8,	0xea97cb96,	0x2f66a7f0,	0xea1793a6,
-0xe5694859,	0x11ee5eff,	0xea78bf84,	0xdabcb643,
-0x7dfc3865,	0x15244d6a,	0x712c4ebe,	0xd77e813c,
-0xb5d40714,	0xaa83450a,	0xc90b1071,	0x1b6562f4,
-0xa89c9740,	0xa9d7d4e8,	0xdf34d965,	0x452ddd26,
-0x5c166d10,	0xdd3d931f,	0xf2d150c6,	0xcb842852,
-0x730d442b,	0x90ca4c52,	0xb0e8cb69,	0x962dc596,
-0x7dd63013,	0xb4bda47b,	0xadd1f372,	0xa73c25c9,
-0xdc9bafda,	0xb8151a31,	0x07689397,	0x040c7849,
-0xa5751181,	0x0f5db328,	0xfcc48a27,	0xe481fda6,
-0x988b6732,	0xc2d75d03,	0x066807be,	0xe3a8401c,
-0x10e71bf3,	0xb646fc3d,	0xf17828ca,	0x1c2d65b7,
-0x5ba1f9b0,	0x9f4641f0,	0xb6868cf3,	0x2a91c83e,
-0x1d2fb15c,	0xfbb6c98f,	0x0103b7b2,	0x6c6aa67d,
-0xff3aa0d6,	0x79e36b26,	0xbc2849bc,	0x02631f2c,
-0xdbdf4d5a,	0xc2292642,	0x311ef07d,	0x582208e8,
-0x57c30f5b,	0x32f4ffb7,	0xb423daac,	0x44e28ce5,
-0xdad60ee4,	0x0f45d185,	0xee26da95,	0xde0fbdff,
-0xf3c8fead,	0x0c8a0394,	0x998a0977,	0x0e430050,
-0x6260e49e,	0x30fa15fb,	0x6d0b6161,	0x67b00c86,
-0x656a1c2a,	0xcc0cecc7,	0x00471f20,	0x4554c9ab,
-0xf852fda7,	0xb7ce8bfe,	0x8c8e8929,	0x45f578c3,
-0x1ffef096,	0x2102c22e,	0x8946ca24,	0xea2e3028,
-0x004ce35e,	0x925712a4,	0xc213544c,	0x03ae3b1b,
-0x1d01b5d6,	0xa82001ac,	0x4018f4c7,	0x070c0037,
-0xa12e0731,	0x9e34492f,	0x95cbe15f,	0x2a1c2fc7,
-0xb73d36ae,	0x7abe5853,	0xd6affbff,	0x6e7de37a,
-0x59911c0e,	0x6b0a727d,	0xa2eed2b7,	0xa0856940,
-0xcb77f34a,	0xac065ab9,	0xcd1f4163,	0x51dd137d,
-0x461ecb88,	0x5985e106,	0x99261061,	0xf6fe30bb,
-0xa8b3c696,	0x44d8af69,	0x0e24c57c,	0x476ed422,
-0x7e0d9c9a,	0x8b43021e,	0xfe8d4651,	0xae73bd30,
-0x25655851,	0x27dd08b1,	0x584dc8a3,	0x5b5856ca,
-0x2f5dadb7,	0x43cd30d3,	0xaafbef65,	0x747113c5,
-0x2be2ddbf,	0x979a2087,	0xdb16f3b8,	0x5e2f0b6a,
-0x651c7621,	0x543078c9,	0xc72a99a3,	0x85da26f3,
-0x2ab0e29e,	0x5f2fa684,	0x24e248c2,	0x08b58ba4,
-0xdca148da,	0x1a482dd2,	0xbec8c654,	0x4dcf5e0c,
-0x1e78a7bf,	0x3c224cfa,	0x386108bc,	0xe7ee136b,
-0x915502f1,	0x67427a3d,	0x9a319abd,	0xfe5dab62,
-0x197b3c5d,	0x9e58aed2,	0x36e86822,	0xd54ea06d,
-0x2a29f58b,	0x30cdb3a9,	0x67add423,	0x9d54d29d,
-0xff79d362,	0xd753f02e,	0x2773a35e,	0x4d6235a3,
-0xf6046459,	0x63cf41d2,	0xcd4e0119,	0x683133bd,
-0xf31bc973,	0x3ed90047,	0x1d87066a,	0x5f54a2ed,
-0xe3f974a9,	0x407c412c,	0xf7ece0fb,	0x4db2b354,
-0x4ad9744d,	0x2d4d828c,	0x8b9a423a,	0x904bf383,
-0xc4b6ecf6,	0x2e0ced8a,	0x7a4688a3,	0xc788c45c,
-0x1b0aae44,	0xd816b959,	0xe16e7e71,	0xd3c51d56,
-0xc4afa70e,	0x7d0d507a,	0xf061b5c0,	0xf9312d1a,
-0xc2930c2c,	0x265bcb08,	0x18e64f07,	0x1eda0e94,
-0x50f722d2,	0xef7e1734,	0x8c566799,	0x4180c2a5,
-0x4c4f43b3,	0xc721a418,	0xbb90f6ca,	0x85e9aa92,
-0xb85ab6a4,	0x23a1325b,	0x7d0b13ab,	0x1184c4f7,
-0x75004486,	0xc5b91959,	0xdb1a5c37,	0xc3c6489f,
-0x21ad43c6,	0x73dadb3a,	0xcd876613,	0xe03be70d,
-0x0ae3dfde,	0x60186345,	0xba141ddc,	0xff9cec78,
-0x1cd5ec01,	0x39648944,	0xe2d00449,	0x8bc87563,
-0x91409db5,	0x9d055050,	0xf5b050c8,	0xb5f12fec,
-0x6b9c4d69,	0xeb6d78a2,	0x38f65bd5,	0x796a77c0,
-0xabeff652,	0xaa37828c,	0xbef5f4e0,	0xf7b84c82,
-0x934f6bfa,	0xd13469f6,	0x9d165a0e,	0xdf40634e,
-0x0ffc26a4,	0x279cdb7e,	0x8b8849b5,	0x878cbd81,
-0x29c18e16,	0xb55416e2,	0xf026e93c,	0xd434e9e0,
-0x00d2a434,	0xab5335e1,	0x1621abb9,	0xda1015aa,
-0x6f085944,	0x63d9d376,	0x07067dd9,	0xc9c559e0,
-0xdb360e3e,	0xcf6f5b16,	0xf132554e,	0x130b9a57,
-0x4407ba48,	0xb8f04672,	0xc3c3d832,	0x3ca78393,
-0xa3439daf,	0xd8fb34bd,	0xc50427aa,	0xc7701afd,
-0x811410a0,	0x7207e87b,	0xcc4d7a06,	0x0c9ae6ca,
-0x809522b8,	0x9333214d,	0x1a7ddbdf,	0x32c8cd22,
-0x13690f1c,	0x366f8b2f,	0x73ef5d51,	0x7717552d,
-0x26ec3774,	0xec20392b,	0xd5e05fa2,	0x5923eaf3,
-0xdfd6f7af,	0xc1ffd7e6,	0x886be75f,	0x080a0ad2,
-0xc5b65fbd,	0x5d4cec82,	0xde7a21d1,	0xa4428d0f,
-0x79a3180c,	0xbccee103,	0xc9c94a31,	0xd6114680,
-0x7f4ad2a9,	0xa234296c,	0xded816a7,	0x88654183,
-0x4fe6e7df,	0x327182ce,	0xc91b8650,	0x48b3a89c,
-0x25fdc758,	0x22447525,	0xbcea00f7,	0x456f2628,
-0xa7cfcefa,	0xbce11441,	0x9a0a2fe1,	0x23db4f11,
-0xec1bddb5,	0xc15a7116,	0x9f51486e,	0xab9dd629,
-0x4f1b3b11,	0x6b1d8be0,	0x6afe9c76,	0x6d1ff04c,
-0xceaf08c4,	0x59d6977d,	0xb37cb7d5,	0x5b97fa12,
-0x1d5b67bd,	0x06d734ec,	0x3fd6ccca,	0x4227b960,
-0x65a83bac,	0xd01b02e6,	0xf9b10687,	0xb129d69d,
-0xcba37843,	0x8a1ca760,	0x06fa8137,	0x9434e1a7,
-0x772b1b19,	0x225c8b9d,	0x1c4e7f57,	0x15804f93,
-0x8eb0c6e4,	0x3b772073,	0x107f094c,	0x0b5bd492,
-0x61c52992,	0xeb778ba6,	0x225dc545,	0x940a49b1,
-0x4606ffc9,	0xc5396baa,	0x4c308487,	0xe49efbe0,
-0x44c591aa,	0xa3281491,	0xf6397b18,	0x6126862c,
-0x96143f38,	0xfcf129b2,	0x135e0687,	0x2126a7ce,
-0x9b013e77,	0xe4cc6632,	0x286e78c1,	0x154b6c1e,
-0xe80244ce,	0xc38ed913,	0xbe0e6df4,	0x8fd6a926,
-0x0fc49da9,	0x237f98cd,	0x119e07fa,	0x02ca66af,
-0x0ef67214,	0xadb9ebb7,	0x8f4f7a23,	0x94a6460e,
-0x1007e2e1,	0xd5cbb217,	0x68bf2c3f,	0xba337d7e,
-0x62982958,	0x49f72096,	0x54a7acf3,	0x36ff55df,
-0x1b6e9dde,	0x68869f09,	0xff0db710,	0xbd117369,
-0xd763ca6a,	0x9492b3bb,	0x4fe52ec2,	0x59b9adbd,
-0x08191156,	0x206974b4,	0xbb6882bb,	0x5677baeb,
-0x916d5267,	0x7ddd2f4a,	0x45e0c3c6,	0x471e3c32,
-0x026c5cb4,	0x5fbc7abe,	0xf77acf3c,	0x5ba1a10d,
-0xa230832d,	0x598e9168,	0x30eda9d3,	0x63866326,
-0x33b2062a,	0x29572008,	0x65ad9c72,	0xadb494e7,
-0xe6f9cb0a,	0xe077d568,	0x630ea1cb,	0x89da22ba,
-0xb7708d69,	0x2e11bdb2,	0xc530a947,	0x5feccad1,
-0x25376788,	0x4ed9b80f,	0x97a96e7f,	0x65a9d6c0,
-0x6069c8d9,	0x9b1930a8,	0x4bfb02c8,	0xc8478d77,
-0x2f0036b1,	0xf09867b4,	0x769b1453,	0x1d59e994,
-0xa364d18e,	0x91050732,	0x5abf2f30,	0x07c5101a,
-0x212c98d2,	0xf620b893,	0x45d83e05,	0x0ecb3c02,
-0x944faf4b,	0xc957602f,	0xad5bda61,	0x543059f8,
-0x16788783,	0xda83e288,	0x73d4e779,	0x07973be4,
-0xe135dcce,	0xf1fd41ec,	0x19a748f1,	0x0e28feea,
-0xa252a5b7,	0x0f11fe6d,	0x757fd157,	0x63f78e15,
-0x68827464,	0xdbd610a9,	0x02ebafd4,	0x3afe41f6,
-0xa9472f8a,	0xa384098d,	0x7094b8c3,	0xfcc7adf0,
-0x44c58ea4,	0xe65cd530,	0x7a122746,	0xdbf13003,
-0x9f57d2b9,	0xb55a5a1a,	0x6ca62cd6,	0xefc9ba15,
-0x9c9fb9ca,	0x50505660,	0xcb0059d6,	0xa648c2ca,
-0x077f5e57,	0x9224d452,	0x22eb6a38,	0xf7d25656,
-0xbeb960e6,	0x087e4968,	0xd49d00da,	0xf92513ae,
-0x97e46810,	0x2003cc49,	0x23252ab3,	0xaab56cdb,
-0x67d1d81d,	0x7275eaef,	0xdfc091e2,	0x6c8866c7,
-0x72957a15,	0x4b61a0e8,	0x199bc27d,	0xe4c3df97,
-0xabea3e53,	0x93fff185,	0xd914c77a,	0x4f67e6b3,
-0x11b6347c,	0xc2ab8c52,	0xa34cd39b,	0xe8301350,
-0xddf5105d,	0x089ce370,	0x586fc82e,	0xddb28af1,
-0x770f5f96,	0x2b803b4d,	0x0177a06b,	0xe9d7266b,
-0x5283db3a,	0x77a4738c,	0x895c64d5,	0x198840b5,
-0x44e75d8e,	0x0453c208,	0xd97f8034,	0xd124da5b,
-0x7e10dfa4,	0x5daf8481,	0x083d61f7,	0x8768f36d,
-0x1bd40103,	0x618745dd,	0x1ae3d766,	0xeedf4c5f,
-0xa943603e,	0x26fc122c,	0xafa214b9,	0xc097726f,
-0xc8d9ddbc,	0x06c94859,	0xc3094868,	0x3a10cbaa,
-0xb0b1e713,	0x8f330f14,	0x1e9e2a16,	0xe38b35f0,
-0x12b19c5b,	0x9b82d51d,	0x9c718177,	0x7b5d5a37,
-0xab440241,	0x20748d43,	0xba81c01c,	0xe8795fe1,
-0xe7e8725e,	0x1530140f,	0x0eb1d8b2,	0x23e0ce43,
-0xb57f2b06,	0xc79828eb,	0x813b7463,	0xf3554ef8,
-0x3d9806c4,	0x946014ee,	0x2e9860a8,	0xeca1f3cc,
-0x354512b8,	0x2c0ed962,	0xe5e1de89,	0x29af6549,
-0x991d845a,	0xf51e59a6,	0x55b3d9b7,	0x941ffa05,
-0xd5df180b,	0xcc7c4304,	0xa8fa4c4b,	0x878fe9f2,
-0x6d14bd98,	0x3c16e8e0,	0x047118d9,	0xa2559ee4,
-0x26c659c6,	0x64d89305,	0xd403088b,	0x633b6652,
-0xab5cd44f,	0x195540c3,	0xc7b8bd37,	0x98441da1,
-0xfdf2390e,	0x00bdfffc,	0x0ff192b2,	0xdfad3aeb,
-0xf2fa21d8,	0xd332c81f,	0xd05a0147,	0xb747bec2,
-0x4e15eb40,	0x317a8acb,	0x8bb8a62b,	0xf31c4531,
-0x038a3b77,	0xf3e0b7a1,	0x8380fb96,	0x671dce8f,
-0xb09fc642,	0xce84ac90,	0x9fd593c8,	0x9bea5f40,
-0x527ed77c,	0x0a8eb67f,	0x910480e5,	0x796540f8,
-0x97384f3a,	0x523e9fd3,	0x585531d3,	0x141934d6,
-0x5b433d8a,	0xb89d963b,	0xecb59640,	0xd86af753,
-0x509bd87e,	0x38abf89d,	0x98f46f7f,	0x7c126320,
-0x7a9d96c4,	0x20210752,	0x78f217a0,	0xf84b4fa1,
-0xa5cc10c5,	0x1cee885d,	0x9b702a2f,	0x81fc8e81,
-0x8fdaadc9,	0xb7ff012c,	0x3784225a,	0x9d6e1953,
-0x816c58fb,	0x96cc9782,	0xb76424db,	0x206d301a,
-0x673df176,	0xe3b2874d,	0xb9ad4bed,	0x5a33c3c7,
-0xccd68959,	0x1db07388,	0x30ee761c,	0x94057222,
-0xff398940,	0x093c67bc,	0xc2ec3d63,	0xc3287a78,
-0x5101c9d7,	0x1c610d3b,	0x68a2678c,	0x09a15914,
-0x37c6c2b5,	0xace48588,	0x6035efc1,	0x0fa0eb5a,
-0xf84787c1,	0x70c1aa13,	0x96f6495b,	0xc0c6ceae,
-0x2913fa1d,	0x79225531,	0xf97c39b3,	0x7d91a06d,
-0x10f478d7,	0x42ce4453,	0x96d18ff6,	0x3243572f,
-0xf0350c8d,	0xa86a07cf,	0x8f3bbbbd,	0xb1a6989e,
-0x775dc382,	0x9e856021,	0xc8a9591d,	0x69f0a204,
-0xe58586ca,	0xd486d04b,	0x60ed0e27,	0xb6ba3528,
-0x46aecbd1,	0xc6b4c011,	0x150ba6c8,	0xfab2115b,
-0x78a70d54,	0xcca240eb,	0x21100870,	0x99592b43,
-0xe6a90a5b,	0xf4c367a2,	0xd0b3d4f7,	0x8c55cd56,
-0xf913104b,	0xc39c32fb,	0xcb1459bb,	0xb672ebac,
-0x3a503f30,	0x0e803b42,	0x53b25382,	0xc7ab27b2,
-0xa2f03e2f,	0x4a184c68,	0x4a31338c,	0xdd663612,
-0x4e6b30a7,	0x4876a2b9,	0xae6b9357,	0xc2344b12,
-0x9b8802a9,	0xe874c1a2,	0xf858a226,	0x8ceecd21,
-0x95587d9f,	0x2ff1a932,	0x43176066,	0xa7ac6aba,
-0x842971f0,	0xf6c09fa5,	0x1ec27f7d,	0x552ab9e9,
-0xbd5c6612,	0x0e124f3e,	0x03080605,	0x6fa9217b,
-0x9bf2777b,	0x6d6b1d4e,	0xaa5f1867,	0x46996c41,
-0xd5a2e662,	0x488c7241,	0x8d8d4405,	0xbe1de5c4,
-0xc9dbf418,	0x0748b9b3,	0x9067568a,	0x5fe02c3c,
-0xb722f621,	0x128cef75,	0x7d9eb1bd,	0x5bedbfe3,
-0x156e114d,	0x7c11ba26,	0x3df3bc99,	0x355ed039,
-0x2a3e597e,	0x78784643,	0x6005eb6f,	0xfaba1333,
-0x29da4622,	0x9b62158d,	0x2cd32ad9,	0xe9192eb0,
-0x4ac8a46f,	0x187ae9ad,	0xb6535290,	0xca8e587e,
-0x81fd1e8e,	0x16059241,	0xcbf0caee,	0xec605f0a,
-0xf54b8d6d,	0x66c40b5c,	0x4d76e42e,	0xd7d9eecf,
-0xc38247b0,	0xe9c4db96,	0x9c879481,	0x67ab597e,
-0xc93ee33d,	0x8126ec0b,	0x4af2a217,	0x63142cea,
-0xe3361b1c,	0x9c2dcb93,	0xbd48845d,	0x4e7dc93d,
-0x4bd0c6e3,	0x821051c1,	0x059de9c1,	0xba72e10d,
-0xa281837d,	0x46934466,	0x52432bfe,	0x217a20ee,
-0x281b7c03,	0x28630962,	0xd8a78a62,	0x1b8518c2,
-0x99e1817b,	0x8af56f40,	0xa8d67b2c,	0xe0e8a47f,
-0x26f0f8b3,	0x02add88b,	0x21efb2d7,	0x15fa4312,
-0x0fc09777,	0xab6a195e,	0x13fe1fe8,	0x375bb5d0,
-0x43d62056,	0x36df85c1,	0xfe9b57f3,	0x467f2673,
-0xf12ab72c,	0x6b871beb,	0xe3373fc8,	0xcc589ede,
-0xc6604e25,	0x7fe2bb55,	0x7063f150,	0x042a5a13,
-0x39892307,	0x56f1e8b9,	0x231d8da5,	0x55deb85f,
-0x9ae239c7,	0x8245cf92,	0x70671327,	0xb9949185,
-0x17e64d51,	0x7fdb797b,	0x96a8ca43,	0x41c2eba5,
-0xd851d1ac,	0xd13c6e5a,	0xdbe937d9,	0xa63c4092,
-0xbf792848,	0xb31f40d1,	0xeab87850,	0x10df9cb3,
-0x7ffd0ef8,	0xbd0eb376,	0x18403f6b,	0x0abe8c4d,
-0x99fa87eb,	0x6d52ea5a,	0xb9696851,	0x43edc80a,
-0xc6ad48c3,	0xbebb194e,	0x853d2b4c,	0x8edeba8b,
-0x1811374f,	0x8ba7c655,	0x160fe9cd,	0x51bb93a7,
-0x092b3734,	0xe41719ff,	0x9a67f26f,	0x1047e1d4,
-0xb87c127a,	0xf502c7f4,	0xc6706269,	0x16fac08d,
-0xec04a48f,	0x42415fda,	0x14ef4a32,	0x81e58994,
-0x5e6fdaeb,	0xc89171a0,	0x15f600d7,	0xda4a12d7,
-0x877f8ffa,	0x752f4043,	0x84d3c5d6,	0xbfc0ea8d,
-0x51a8afde,	0x12202665,	0x0a9bb025,	0x2d66010b,
-0x7a7571ff,	0x9c25a6d6,	0x3ee6d794,	0x996c6c31,
-0xe8f2468e,	0x3fad8694,	0x81e23c7a,	0xbcd64732,
-0x8531f6e5,	0xb134201b,	0xc5f2514e,	0x9dadc1d5,
-0x6ad87fb4,	0x139065c3,	0x9e2e258a,	0x47b6eb20,
-0x6073f54b,	0xccb10599,	0xa560c5b8,	0x92904ff1,
-0x44586039,	0x70ffed96,	0x2b67ed00,	0x8d403b13,
-0xe9f057d2,	0x808dd996,	0xa901fcbf,	0xc1e9afd0,
-0xf009a713,	0xf8518b43,	0x14538c49,	0x7448122e,
-0xb46e690d,	0x6ae7ee20,	0xdbe680e4,	0xf5cf7d8e,
-0xb8227f90,	0xe1cd249c,	0xd92343cd,	0x50a47622,
-0x1ad28805,	0x453c76a1,	0x29a0050a,	0xe1c25523,
-0xfe6ac455,	0x5708ec26,	0x47574872,	0x7d975d41,
-0xe820d206,	0x0cf38629,	0xe0251795,	0x8ceb99c7,
-0xdf5b0b57,	0xa7464445,	0x56955520,	0x594e5b28,
-0xabbd6069,	0x11598def,	0x1db2f245,	0x36c3a49f,
-0x6094c0b5,	0xf0f31056,	0x418ac833,	0xef2b2810,
-0xb1074bbe,	0xe8806e8b,	0x19361160,	0x8f11a1f6,
-0x660c4471,	0x01b6a91a,	0xbebf128f,	0x3e7a09e6,
-0x2164379c,	0xe94c49b8,	0xd76606f7,	0x838acc87,
-0xd962ec79,	0x6f847472,	0x8eb28012,	0x99512db7,
-0x1b6c6bf0,	0xa86f6c4e,	0x30094ed8,	0xf1a2f87b,
-0x96678c29,	0xc08b0291,	0x897acb70,	0x6c0c5315,
-0x3557eb4f,	0x0d870866,	0xebd4b86e,	0x45e7dd92,
-0x4faf75e0,	0xf23f0aad,	0xdfc2ca9c,	0x0024540a,
-0x14f975ac,	0x6d7e57fc,	0xf501bf1a,	0x3830eb5d,
-0x1db8146b,	0xd45c6713,	0x78945d10,	0x119ae70c,
-0xc6b11c75,	0x8e048ea0,	0xb8d2d655,	0xafcd9dfd,
-0x3bef9054,	0xa3665dcd,	0xe5ebd611,	0x2551db2a,
-0xf9e95ded,	0xa2f7b55e,	0xd9735fab,	0x4f9d28ab,
-0xd96f5492,	0x044d797d,	0xaa49926f,	0xa71dbd71,
-0x3ca16944,	0x5556fb76,	0x2d403448,	0x18fb0041,
-0x094960fe,	0x79b5c5ec,	0x11942949,	0xffbfb4d0,
-0xab70fbed,	0x9f66a579,	0x2925b30d,	0xa6dc4162,
-0x0d97fb40,	0xd77f75fb,	0x92b8e288,	0xed8d939a,
-0x1703e83c,	0x2882ed5a,	0xb58e38ef,	0xa010c043,
-0xe8c3aeeb,	0x541f8a10,	0x52327624,	0x401e3aac,
-0x73bf9796,	0xf619f653,	0x0cfb6f6d,	0x0b003d30,
-0x94f63d3f,	0x9b682b62,	0x2a2ef47f,	0x46ba40a0,
-0x456cd98e,	0xb4b6432a,	0x17a74670,	0xc090493f,
-0xc716b923,	0xd91476c2,	0x0b4008ce,	0x5f6f5c81,
-0xe62e22a8,	0x5df3fc43,	0x2a701553,	0x07101a9d,
-0xb3411e01,	0xaadf8447,	0x8a8a058a,	0x360e5110,
-0x0ce7fda8,	0x6eb7fb89,	0x9e0075ef,	0x67e86bec,
-0xc3d30f81,	0x97d57af3,	0xf53bccac,	0xc0c49e90,
-0x328557e0,	0x666652f7,	0xb5402b2f,	0xe23fd65e,
-0xf21807f5,	0xaef029ad,	0x8b977c49,	0x24d7340b,
-0x2261bb8f,	0x683fdf5e,	0x8e5446f1,	0x8ad60840,
-0x96ba6443,	0x0d34f16a,	0xc6392bd4,	0xc2d258bb,
-0x3c30aa6c,	0x30255fd1,	0x1841ba49,	0x7917c32c,
-0x38f6769f,	0xdadfadb2,	0xe32b9759,	0x08a22b72,
-0x984c486d,	0xfb6d718e,	0xecb8c7ee,	0x557802f9,
-0xd141f9a8,	0x2b270e2c,	0x29b54d5b,	0x3b811f56,
-0x19fa8f75,	0x92cd9965,	0x831f29cd,	0x86330673,
-0x4469c4e7,	0x8b8eaa2e,	0xf9d95059,	0xd6b64ed4,
-0xd49d0cea,	0xe258c3b1,	0x71cffab9,	0x374f32d4,
-0x1c1be3b7,	0x4fc95750,	0xfc895cee,	0x5c2ebde0,
-0x68df6a29,	0xcc92e3cb,	0xb27bb547,	0xbb010b08,
-0xc1f26f8d,	0xe73d8c05,	0x099345a0,	0xb3dee476,
-0x3ece40e4,	0x25919c03,	0x1edbd8c6,	0xff5db3a6,
-0xc1e3cea2,	0xc90ed735,	0x9836154d,	0x77061a5b,
-0xc1f2fc5f,	0x033c171d,	0x9a790561,	0x165dbcbe,
-0xd92f380b,	0xc3c5b5de,	0xcf78e93d,	0xc43dbd28,
-0x044ac895,	0xcf967c55,	0x9ec4a066,	0x0d3d2a64,
-0xd6c39e25,	0xbd834fb6,	0x8b2ab3d6,	0x795a2996,
-0x6d4cd03d,	0xca20a6e0,	0x1e4751a8,	0x9027f4f8,
-0x92056077,	0x31d3e3d3,	0xea9e58fa,	0xf02ae112,
-0x59d04ab5,	0xe55009fd,	0xf420eb11,	0x173b7a3f,
-0x7d2265e8,	0xfa04ee57,	0x3e12d500,	0x9aff748a,
-0xd1f31ad3,	0x2d1aea7a,	0x54a68b4d,	0x99df9837,
-0x97c68065,	0x2d225021,	0x67d65f5b,	0x1e0d0d8d,
-0xb9e7ff98,	0x238d56cd,	0xf4410ca1,	0x05716ab0,
-0xc74c3ae4,	0x2478017d,	0x061bb9df,	0xc2a4aea2,
-0x22c497c3,	0xc08586a4,	0xd97a10e5,	0xf441e4af,
-0xd96172cb,	0xf1b318de,	0xfa7f1da6,	0x613583ed,
-0xa03fb953,	0x01758b02,	0x0f3c3b99,	0x61e3be8c,
-0xb61c5dc2,	0xd38a2e99,	0x244476a7,	0x1f2fdd12,
-0xc85fdde0,	0x363a77da,	0xac4c6b2f,	0x59da71da,
-0x8688dcdf,	0x760966a6,	0x6248dedf,	0x9db3a95b,
-0x4221a4e1,	0x780c7034,	0xe4f30264,	0xdd913c13,
-0xd4a63e3e,	0x0b63a961,	0x31a38a2e,	0x76158f28,
-0x0810acd1,	0xf7833dcf,	0x1bdb92d3,	0x7ea86106,
-0xe9ddcdfb,	0x8a62d452,	0x7e0193cd,	0x2137f79f,
-0xc3d4443d,	0x0ea65d4d,	0x27227997,	0x6a9a2608,
-0xf0e2d78a,	0x9f64ebfc,	0x78b05e6d,	0xa6b5a79e,
-0x67b5b3b1,	0x441ca7df,	0x3ea13f25,	0xe4b03eec,
-0xa016f880,	0x1cf297a8,	0x8b5e77fa,	0xb0e5bef8,
-0x6b0d218b,	0xac630377,	0x4865cb36,	0x6b51a5be,
-0x7154e5af,	0xf8e2703a,	0xbb903201,	0xe2b036ed,
-0x4eb150b4,	0x5627c27e,	0x785fbde7,	0x0599163f,
-0xac3003b7,	0x231beb0b,	0x13c75fb9,	0x8c3338ee,
-0x4e53bb38,	0xaea89c0e,	0x78467ef1,	0x7656a62b,
-/*  2618-m441067AA07.inc  */
-0x00000001,	0x00000a07,	0x04092008,	0x0001067a,
-0x83067f27,	0x00000001,	0x00000044,	0x00001fd0,
-0x00002000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000a07,
-0x0000001a,	0xa4000000,	0x20080408,	0x00000401,
-0x00000001,	0x0001067a,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc4294866,	0x3e20a114,	0x8387f19c,	0xdafb14aa,
-0x33a38309,	0x68b0f8ea,	0x2a20b200,	0xcdc7aa9e,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x9f63eb61,	0x64816577,	0x10c68141,
-0x1cc5fd18,	0x156703a6,	0xe3315c33,	0x62a1db21,
-0xb6135848,	0xa306d2fe,	0x117cb585,	0x54c3a133,
-0x722cf721,	0xa693cd57,	0xd02c0e2d,	0xf17b96ca,
-0x97d2a408,	0x2e776501,	0x667f7664,	0x1568cf83,
-0xa044dee1,	0xe6a879aa,	0x4ff23d0a,	0xd559de49,
-0x2dabb17a,	0xc6c39e38,	0xc3ae5451,	0x2d03f3dd,
-0x7ba226ed,	0x69a19529,	0xc2865715,	0x8b95e6c2,
-0x7a7ee1cf,	0x74b5e43f,	0x69aeeefb,	0x5d95aaa5,
-0x0afeb5dd,	0xdb837be6,	0xed6f9d79,	0x2ad96eb4,
-0xcd60dd82,	0xc3ff7d75,	0x7030a02b,	0xdbbe45dc,
-0x203cd7ba,	0xc3b90579,	0xa21f54f2,	0xc79853ce,
-0x5e3f74eb,	0x06c63742,	0xb1fa50ef,	0x0e8e950e,
-0x97d44b72,	0xa48dc8ad,	0xf3803fb8,	0x946e4d5e,
-0xf0f1e9f6,	0x272b9764,	0x567efb67,	0x82deebcc,
-0x614f61e8,	0x3bea41b8,	0x31a12485,	0x682e10ae,
-0x954c7b7f,	0x0e4bccf0,	0x8cb1eb25,	0xb5018c6e,
-0x50957531,	0xcc60f1c9,	0x11181c5c,	0xa4dc1468,
-0x3310423f,	0xd2550a2a,	0x3bd2ac80,	0x2be006d9,
-0xf57f3e2d,	0xb4387cc7,	0xe96c48f9,	0x722975a2,
-0x4506717f,	0xaf92aa6e,	0x7de4eb6e,	0x3600e58d,
-0x898cc58f,	0x271c467f,	0x1c5cd377,	0x5858e9bc,
-0xd3ad9408,	0x513c936c,	0x0dc54b7e,	0x0226d703,
-0x4cc95088,	0x78bbb408,	0x573d07e2,	0xa4e9cd4e,
-0x4a2930cc,	0x3082d573,	0x68c8c48e,	0x883d27f8,
-0x4e91dd95,	0x850f6d80,	0x5f7f3e37,	0x452cc29a,
-0xf2f9cc40,	0x278be406,	0x356eb275,	0xda301857,
-0xdbc49113,	0x7007d110,	0x06f49bc2,	0x74712f32,
-0x73176720,	0xcebc66e2,	0x592acf0a,	0x8818dd3f,
-0xd599d562,	0x54199a46,	0x6472129b,	0x47058cd1,
-0xac4a74f5,	0x1cac471a,	0xf1b4758a,	0xfa6f8e1d,
-0x1013e19a,	0x59252c0b,	0xa764c600,	0xfba01968,
-0xc7c11589,	0x2b4bf080,	0x0157b32c,	0xc09788fa,
-0x1be99aed,	0x19c1799c,	0xb1d03201,	0x8bfb5374,
-0x44e04a89,	0x895d3a8b,	0x5b3a53dd,	0x4704a722,
-0x0d4ac344,	0x8a3f81f2,	0x3513e05d,	0x04e89637,
-0x39f3d4a3,	0x883f2acd,	0xbc2ec5aa,	0x3a26f17e,
-0x3de2b026,	0x49cffb83,	0x9cdece0f,	0xdaaddd7f,
-0xc884a2fe,	0xe4244359,	0x493030d4,	0xb87e816a,
-0x3b2481a1,	0xa2eaa4eb,	0x33d7ad6a,	0x64947485,
-0x65f85855,	0x088388d8,	0xf6dfc3eb,	0xbceddbca,
-0xf72f47e1,	0xd1d06e25,	0x76ff3bc0,	0x9b8f2139,
-0xec7bc702,	0xfe6e6c0f,	0x42d31d20,	0x7e0397f9,
-0xb20b40ff,	0x45a5ce27,	0x31949159,	0x7013a868,
-0xdef2e0d9,	0x30c62ff4,	0x9b5a9b24,	0x0e4e4b1d,
-0xecbbbe85,	0x4cca116b,	0x341fa1fc,	0xfa64b033,
-0x43007f76,	0x710238e0,	0xa995a864,	0x5125d448,
-0xc20c49c5,	0xea370734,	0x9bb92154,	0x596f42c2,
-0x8d8919f6,	0xdd875cf4,	0x3b76b70b,	0xe96291c9,
-0x2814c6d4,	0x0baf988f,	0x9880af78,	0xcbb57ca5,
-0xf9580819,	0xebe041cb,	0x051d6dab,	0x5170746b,
-0x6f04bfec,	0xca10ec0b,	0x2a870ec1,	0x551af839,
-0xcfbbbb16,	0xef91d864,	0xe9b9dde1,	0xf1fade18,
-0xe306f50b,	0xeb5253aa,	0x30010729,	0xb4169d72,
-0x3320e4f1,	0x9c6946e1,	0xdee63588,	0x4b2967be,
-0x167720ed,	0x6f27e397,	0x83419fdc,	0xac4386f3,
-0x0ac58383,	0x55c0dd4e,	0x62b4a145,	0x91d64a01,
-0x0e8acdb5,	0x40de995a,	0xc850ada1,	0xaa95a50a,
-0x14516378,	0x294a976e,	0x544fa118,	0x904c471c,
-0x8a5896d3,	0xb1486188,	0x237498dc,	0x1a1980b3,
-0xd339968f,	0xe735a8b1,	0xc5ee31e3,	0x35c64060,
-0x79cd8f43,	0xa2bb1974,	0x00189576,	0xf7bd74be,
-0xdd52d07c,	0xa20b9c8b,	0x98dadf9d,	0xf75c05be,
-0x476ac3a5,	0x6fb2bf82,	0x914c23c7,	0xd91c35e8,
-0x709ef212,	0x3d8f3ca6,	0x14c20046,	0x7015482e,
-0xb3fa2331,	0x78933f36,	0xc73c72b5,	0x645b4476,
-0x299fa727,	0x701d7717,	0xf6c4bfed,	0x3213dc65,
-0xfe66e1b4,	0x8040904c,	0xc536845b,	0xd1764a8d,
-0xdeb49b88,	0xdaf26115,	0x8160aa13,	0x206d4929,
-0x92fdb80a,	0x4f1aaab2,	0xfbbac21f,	0x2dc479da,
-0xd2ce1eab,	0xa7da6602,	0xa9fbe019,	0xdd58fac1,
-0x747ab469,	0x946a3b93,	0xc7b9cbe7,	0xc6f74040,
-0x8a8bee87,	0x07f65d07,	0xe79eb820,	0x64ef2fc1,
-0x72b1eccf,	0xc71f601b,	0x2812ab18,	0x48415edf,
-0x45a80c6d,	0x7f616640,	0xfeaa98d0,	0x1024f1e8,
-0x37b3735c,	0xc136f513,	0x5df10182,	0x1bd2ec03,
-0x07f04b3c,	0x59beeff2,	0xea0388f8,	0x2f6addc8,
-0xe0f282e2,	0xf9772673,	0x6bd0dc01,	0x3b4d6f9b,
-0x29b81515,	0x6c553377,	0x1136b69a,	0x50e03397,
-0x9c483ccd,	0xb0a13c9d,	0xea8e6bd6,	0xb8129b95,
-0xc085a4d1,	0x52f64f7f,	0x178aad6e,	0xe5c4d92a,
-0x4c35f2de,	0x8f179df7,	0xba405091,	0xd756e10d,
-0x23bfae39,	0x74015fee,	0x15dc3e64,	0xdfc05a18,
-0xa51ac3a0,	0x0ad4595a,	0x801363f0,	0x3db1f0c5,
-0x97a8ca8f,	0x7e74b015,	0x124d1664,	0x71b26596,
-0xaf073d4e,	0xf45d87d4,	0xd73c1dd0,	0xd1ade30b,
-0x8127545f,	0x4ba0585c,	0x5bb26da4,	0xd64fb76b,
-0x5c9c8190,	0xc1603512,	0xf7a69779,	0x1529ac38,
-0x8d9422c9,	0xac132697,	0x5f9ce586,	0x8d5ca1ce,
-0xba409dbd,	0x184b0698,	0x71bc5a54,	0x294e6b1c,
-0x085c38df,	0x629e955b,	0x73f5c2b8,	0x219166e4,
-0x9805fea9,	0x7602d837,	0x0932604b,	0x06a1509c,
-0x2afe3b47,	0x61050264,	0x0fba8fc2,	0x9f648238,
-0xbf3adf84,	0xdb8d2f92,	0xba2d9b51,	0x3d4415df,
-0x32811e41,	0x176a4519,	0x1ffd7d6b,	0xffe56807,
-0xca7db7a3,	0x5c811c87,	0x6bf1fe24,	0xc3013434,
-0x4ccc937e,	0x0a04797c,	0xca7dd4b5,	0x20ba4643,
-0x2b18ed89,	0x2ccf7a54,	0xd1a9e7a8,	0x67d96e26,
-0x9dd29473,	0x0f26a8f8,	0x164fb823,	0x17c5d3fc,
-0x26361bf0,	0x02544619,	0x32bbe44e,	0x12fbec8d,
-0x0a928412,	0x23652975,	0xe67465e7,	0xd1f49edc,
-0x200ce053,	0x1276b87a,	0xf5150061,	0xf509028d,
-0x4aa27234,	0x6fbc6156,	0x89e61e73,	0x612a7618,
-0x20783c3e,	0x152fda0c,	0x9a5c7b17,	0xebd39bba,
-0x9793ab7e,	0x053f88e4,	0xef9499c7,	0xdf5efc36,
-0xa2792729,	0x068ba6d6,	0xa5c5687e,	0x3924364a,
-0xa4c6c2e4,	0x45364a92,	0xda08f6ba,	0x1551c9a5,
-0xb4787235,	0x73d99aae,	0x584e52ec,	0xd76c6379,
-0xf852e104,	0xa335ab55,	0xd2b1013a,	0xc2c591f1,
-0x91ac865d,	0xe82497be,	0x39f62b27,	0x3d6a9530,
-0xb74f7711,	0xca3f54d4,	0x466e17e8,	0xe91d700d,
-0xbe8197a7,	0x04218b87,	0x587e7832,	0x838c1a71,
-0x39d27956,	0x36ecc542,	0x36b22957,	0x5c44fe01,
-0x86ae0bfe,	0x2ffa7c08,	0x603db66a,	0x69d7eed9,
-0xd96761bf,	0x44bc3358,	0x2c04707e,	0x290a0631,
-0xac627cd8,	0x1dd90751,	0x41e91a35,	0xf5dc1260,
-0x36564120,	0x1ac71792,	0x87e0a694,	0x063d0388,
-0x4f282802,	0x026fdbfd,	0x11102f9a,	0x5932ad11,
-0xc5f266d3,	0x27587435,	0x6fecaeb7,	0x191e6dda,
-0x50daedc2,	0xa282f89d,	0x89ceb660,	0x4564adc8,
-0x0cee73af,	0xed4f399f,	0x10085cac,	0x0d9ded47,
-0xa88956dd,	0x242798ad,	0xae708815,	0xf7edf1f7,
-0xb9fa65b7,	0xe8b4fcc1,	0x00fd86c4,	0x7ad67bce,
-0x66e3f423,	0xee1b4874,	0xccbc4116,	0x04a72b4b,
-0x39a640f0,	0xef9f5c48,	0xe8d1470d,	0xee1ef5d1,
-0x90784af3,	0xbc0b3389,	0x49aac119,	0xdf65d921,
-0x1023547c,	0x486b404a,	0x834d359c,	0xf5dbbd50,
-0x68b5997b,	0x7aee9417,	0x42e48286,	0xa9d8ee77,
-0x181a3e1e,	0x607cb99f,	0x5f53c78d,	0x5a60a6a8,
-0x39cfc04c,	0xfbe6eb32,	0x84348beb,	0xa278662b,
-0x398c625d,	0x3f9859e8,	0x5517ef17,	0x15856fe2,
-0xba4d33c1,	0xc93d7652,	0xcf40a2aa,	0x2ac37060,
-0x5efc6cab,	0xced95484,	0xf39ceed8,	0x4ecc8045,
-0x13c1e742,	0xd93d87f1,	0x695cf766,	0xcb53f961,
-0x15e0fc91,	0x37178627,	0x5e832076,	0x8c72db35,
-0x2ce047e6,	0x11d9e791,	0x45e4d466,	0x8b7a7c71,
-0xa83e9738,	0x7c54e924,	0x2ff12bda,	0x6b1ca347,
-0x2957b0a8,	0x1fdb23fa,	0x91f98947,	0xe02c3f1b,
-0xc42cbb06,	0xf0421ecc,	0x1716fce4,	0x1bb34813,
-0xc67853bd,	0x3a27d8f1,	0x8e38f3be,	0x9e5dc781,
-0x245017b1,	0x8cade69f,	0x44642f90,	0x3ef4215a,
-0x879c78ad,	0x371ddad7,	0x7c629ddb,	0xe5f61d71,
-0xbb3896fd,	0xcd3067f4,	0x4cfc2e12,	0xe7d69e64,
-0xcd35c838,	0x6af17c65,	0x322fec99,	0x81221d8b,
-0xa586497b,	0xb2cecfa9,	0xebbdaef4,	0x074fef30,
-0xf825db99,	0x2f916b7b,	0xdc32f01d,	0x915eddd6,
-0x96238f76,	0xf61c60df,	0x68795cf1,	0x46f1f13f,
-0xc9654740,	0x63872bc0,	0x51e210b6,	0x17b5c27b,
-0x7adf79d9,	0x7a823cc1,	0x02011b40,	0x6434a855,
-0x56eca557,	0xa14f4132,	0x8c120524,	0x778266f4,
-0x04ad9ca3,	0xccceab50,	0xecd117cc,	0xf0defcc9,
-0x4f573e38,	0x5393033b,	0x88684c7b,	0x1a33f3a7,
-0x898f45f0,	0x355ffa68,	0x174542c3,	0xa3dcfb8d,
-0x6cd09199,	0x67339d62,	0xd29348c7,	0x37431b9f,
-0x508c487c,	0xe4668bdf,	0xcbba1b72,	0x1b1b10a1,
-0xcd4447c0,	0xf9ee7e83,	0x871a0f4f,	0xa94572d2,
-0xac77a5c1,	0x3b84dbd4,	0xd45a09b6,	0x8e73228d,
-0x59f2bb36,	0x4855a81b,	0x3fafe19b,	0x2f612920,
-0xb9d216f3,	0x937e6a7e,	0xf31a2011,	0xfb7ca7fb,
-0x1ca50eef,	0xd1d2baec,	0xa19d932b,	0x620d57d4,
-0x086b7270,	0x5fcc7905,	0xb0dbe594,	0xf16f0a1d,
-0xd47563f5,	0xe54eeb3a,	0x588766e4,	0x0280ef61,
-0x8f26923d,	0x14b892bd,	0xdd11550f,	0x3e5ec618,
-0xed825fca,	0x52a04ef9,	0xaad0c980,	0xdff1a4ea,
-0x68f8954e,	0xc0f1664d,	0x6bc36a13,	0x5d36fbca,
-0x05f7883f,	0xd2da1028,	0xe3cd0e3e,	0xa4038605,
-0xb48e7f32,	0x1f5ffb16,	0x7c4899b2,	0xb3073d46,
-0xe2acb6e2,	0xefe17316,	0xca66163c,	0x93d4b562,
-0xa86a9d63,	0x07449ca1,	0xb499c9d4,	0x6c666b70,
-0x0d8c9f9d,	0x78c926a0,	0x99e4d31f,	0xd73c49ca,
-0xfd7e352a,	0xd710b7c6,	0x18100555,	0xb4e79321,
-0x5efc693a,	0x703180ef,	0x9bbb238b,	0xa105a3e4,
-0xdaa3ce4d,	0xff7cc846,	0x2bfbd556,	0x5f5ba34d,
-0x0ef8537b,	0xb0bc4e7b,	0x224f6dbf,	0x3b9ddb96,
-0xf731880a,	0x00d8d325,	0x55e4908e,	0x63bc2811,
-0xafa6f5cd,	0x5219a8c7,	0x4609390d,	0xd68e7ae1,
-0xc2e5e5dd,	0xf232712f,	0x1c52c242,	0x5a6cb79f,
-0x26667cb4,	0x0de1b656,	0x42ca30c0,	0x4ab64de9,
-0x26b0cfa4,	0x2897b6d1,	0xefc5d75e,	0x67ca7a04,
-0x805a805d,	0xf2e454cc,	0x837877a1,	0x8ca7dc3b,
-0x40620ce0,	0x5ac019fb,	0x6ee93d19,	0xae137f12,
-0x0cedbd2f,	0xacc51979,	0xec7ae13f,	0x4537c7b6,
-0xe3491fd6,	0x8e63f870,	0x1e08f6b3,	0x219dae5b,
-0x8db5d524,	0x8de9f8ee,	0x04913730,	0x7a11db72,
-0x6e4d0088,	0xa8713aba,	0xf2e72fd0,	0x2ba5695f,
-0xe11da489,	0x6a5ecdf5,	0xc2133568,	0x994cc9f4,
-0xed6825cc,	0x3d104599,	0x4d7679b6,	0x3bfe94f0,
-0xc6a131db,	0x6dfcc31c,	0x9ec5c4f6,	0x3a386a48,
-0x5d0b6f61,	0x059b5114,	0xd4831a86,	0x37460179,
-0x02f23600,	0x1c04bd2e,	0xbf689d81,	0x2bf0be1c,
-0xd8d5974c,	0x0d9d0709,	0x5dcade38,	0x167df39e,
-0x96942861,	0xf1e6a09c,	0x16ac7082,	0x5037af19,
-0x69c40dbb,	0x10728698,	0x71d52ed0,	0xa77036b8,
-0xa050ea5f,	0xa7ca5494,	0xa25b4acd,	0x7f8ceb12,
-0x8f03bc78,	0x6b7ee0f3,	0xa97d44b3,	0xeda32377,
-0x852c4597,	0x3f81aa95,	0xf148a2da,	0x770e5cb6,
-0x90fe1806,	0x50620299,	0xd7f4042b,	0x0d356595,
-0x5596e5dd,	0x6c797c13,	0x500c0ee5,	0x7e5ae4c5,
-0xecf3ac43,	0xae09d902,	0x95b72b10,	0x7597d441,
-0x8d719da8,	0x151b5d1c,	0x1f6790f9,	0x1147be9f,
-0xee857fb4,	0x6f34c63c,	0xb5211613,	0x831687d1,
-0x80e19a47,	0x1bb032f0,	0x5341a6f2,	0xc9a32ec1,
-0xad2521c2,	0x359e67d5,	0xeb4fa538,	0x1cc294ee,
-0xab08e4ee,	0x491c2562,	0xe1e38431,	0x039787ad,
-0xa3cc1cd4,	0x3ff47385,	0x0f442100,	0xd40d9c3e,
-0xcd033c28,	0x400eaf93,	0x5017c05d,	0x98554fb3,
-0x3de23fb4,	0xaa7d549c,	0x6be71942,	0x78577be6,
-0x47aa0dd7,	0xa1226946,	0xcb703f76,	0x023e8ff2,
-0x649fd255,	0xa927f029,	0xe2cfa7b3,	0x03a6ce51,
-0xf674945b,	0x77f3c516,	0x41eb2b88,	0x5be10c42,
-0x88a250be,	0xc30b371b,	0x8711bcb0,	0xaba1efe7,
-0x0446f6d0,	0xe7ff87ba,	0x879b4aa6,	0xb033052e,
-0xa388c8ab,	0x3344d7ab,	0xa81b3a68,	0x895fb4ff,
-0xe4efddc9,	0x7c69bba5,	0xbd7226cf,	0xca2e3b74,
-0xba316a72,	0x087b68ba,	0xa0234a53,	0x51f6447a,
-0x1c6c1312,	0x52e597e7,	0xc50f49ee,	0x064ce0c7,
-0x70f67efe,	0xcaf13ee0,	0xd68fc906,	0xa5a173a8,
-0xde41697f,	0xc8b09415,	0x8a08cd8f,	0x2ac8a7ed,
-0xac323499,	0xf55a3c3e,	0xd487d5c3,	0xb8940642,
-0x73cd4073,	0xfb15c814,	0x775f4fe8,	0x2b42622c,
-0xa53339a1,	0x305c5717,	0xcdae12bf,	0x8facff91,
-0x86728c4f,	0xde5967a7,	0xaefa7393,	0x60fc32e4,
-0x4ddd7ad9,	0x020ac80d,	0xd87b74e7,	0x7ffcdc79,
-0x6e7ebe24,	0x561f95a0,	0x2523a129,	0xd40136d7,
-0xd253e4db,	0x8339b140,	0x71f6d4cf,	0x9bbfd0df,
-0xc54f7b50,	0x6c13a6fd,	0x09e9596d,	0xa71eaa48,
-0x5b8a7c0a,	0x5cf679df,	0xcab512b5,	0x61623502,
-0xe002bd96,	0x5e7b9889,	0xb029fae3,	0x85ae825e,
-0x0cb81cf4,	0x7b8d598e,	0x1b1b4c43,	0x723f793e,
-0xc2d0120d,	0xfa704e12,	0x0529301e,	0x6d7c1536,
-0xe4008061,	0x319c2fce,	0x4dbb7c85,	0x989ae3e5,
-0x877539d3,	0x9d77a472,	0x75e0ec43,	0x5243baa3,
-0x7866e10c,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-0x4e24165f,	0xa7c66809,	0x2e60bdcf,	0xaad70a08,
-0xa73ea713,	0xe28f97a7,	0x283a9eab,	0xd4366489,
-0xe776f963,	0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,
-0x3bae5f6d,	0x8d2bbef1,	0x7e9181e6,	0xf06aa121,
-0xd06b2d20,	0xa83ea826,	0xef935e4f,	0xdfd27456,
-0xa3451468,	0xc6820a63,	0x43463105,	0x787697aa,
-0xcba5543d,	0xdf7e1e2d,	0x6998a8af,	0x98ce6c08,
-0x89de731a,	0x943a3510,	0xb36ead85,	0xd5258d4b,
-0x1cd6df61,	0x82a5c59d,	0xd078e7a4,	0xa33d4317,
-0x24dc45f8,	0x3f3daf27,	0x0478bc6f,	0x92dfa16c,
-0x952a872e,	0x7a34e03f,	0x0f088084,	0xa40937fe,
-0x38fc7749,	0xa157e8a4,	0xbce94344,	0x7045ff7b,
-0xf3e1ab66,	0xe62a6058,	0x5564ff10,	0x38198f1e,
-0xf326f0f1,	0xe262bc0c,	0x2f0b851a,	0xc7bcbe11,
-0xe79f1d1a,	0xc2f93c29,	0x54f3ea9f,	0x8f8f9141,
-0x9f45e13c,	0x7a5b86bd,	0xa764efd8,	0x35f04729,
-0xdd8c4b54,	0x5fa12e51,	0xa5824af9,	0xad328f71,
-0x0f11fbb9,	0x9048e950,	0x04d7a900,	0x02538d1f,
-0x99f745b7,	0xe31f63bb,	0x2c4e3d78,	0x7cdb9245,
-0xa3966ee7,	0x27c4433a,	0xe1d79f3e,	0xe640fa06,
-0x79ce31eb,	0xf25634fa,	0xdd9ce5cb,	0xb7fab8d2,
-0x2f1f0ff2,	0x2acb625c,	0xa0494989,	0x206d7f11,
-0xf268b8ca,	0x292bbf9f,	0x763bd7d0,	0xea4b14fc,
-0x9d3d6aeb,	0x64cca57e,	0x6fc3e29e,	0x3e7bf4bf,
-0x90efc7e3,	0x08e39173,	0xd05bee2c,	0x5b3c8f37,
-0x0921ec6f,	0x3371b715,	0xb324e114,	0xe3abc53f,
-0x576b18f8,	0xc4469024,	0xb2ded6c6,	0xe7783782,
-0xc0a1fd5d,	0xcf324bde,	0x97527c8e,	0x19f8f48c,
-0x3e806a5d,	0x96cff225,	0xe3b9d04a,	0x0e5856ae,
-0x781372f6,	0x9645f2b7,	0x95a743ed,	0xd0c7eded,
-0x86ca3cd9,	0xbab94db0,	0x43a1233a,	0x89c55554,
-0xee776239,	0x34aa0098,	0x66a6e1d4,	0xae0e233e,
-0x717e7b29,	0xb403a4c1,	0x36eb96c5,	0x42140832,
-0x04250936,	0xda375dca,	0x524cb2e6,	0x86deaa0c,
-0x400dc9d1,	0x12c00364,	0xe3ca7cf5,	0x87f20da7,
-0xf57df9ef,	0x580dbdfc,	0x0b3e0369,	0x014d27fd,
-0x4afaf6a1,	0xd1f4ca09,	0x77abc831,	0x30e49729,
-0xec61cd2c,	0x159c1e92,	0xb61b40b1,	0x17c66fd6,
-0xde11c061,	0x79d7f792,	0xc709cbfa,	0x94201c89,
-0xbe65137d,	0x18aea1b4,	0xf248bbc3,	0x465f957d,
-0xcf4a9672,	0xbf293fd2,	0x2c5e31c9,	0xc2c73011,
-0xfb29cbf2,	0x576f7f0b,	0x74de1745,	0xa76e172b,
-0x99b96223,	0x14ce1502,	0x231013fb,	0x1d4df40a,
-0x951b0c16,	0xab173e66,	0x4ff65f74,	0xc4a87a47,
-0x09cc3370,	0x66385490,	0x73e09118,	0x4ee96432,
-0x0164d347,	0x205069b5,	0x158dd226,	0xc932c238,
-0xe9048fa2,	0x100b626a,	0x86ee08cd,	0xed87cb1c,
-0x6353ec37,	0xa36edcc3,	0x8a16dd6b,	0xd28a4198,
-0xebea1127,	0xca0b761a,	0x61c31acf,	0xced5ff4f,
-0xbf4dbd8f,	0xd969d8a7,	0xb6e4e9e8,	0x8421c402,
-0x809d7222,	0xabfd1d2f,	0xc1857ce5,	0x23958fd7,
-0x3226f1d3,	0xd822b4cc,	0x2f1cc3aa,	0x501fe01e,
-0xe36f8c94,	0x7ad27716,	0x3321308b,	0xa85b957b,
-0x38cfdf6e,	0xc7497dd5,	0x2462090c,	0x8f9e42e7,
-0xdf97684a,	0xac8af621,	0xd5224866,	0xc5f64e50,
-0x9724f297,	0xc386097b,	0x48c6f98a,	0xe1478b1a,
-0x2dd23fd8,	0x716b2d85,	0xa5c3789b,	0x53625e80,
-0x9b8b312c,	0xce482165,	0x66161e35,	0x64ecb56a,
-0x9981c46a,	0xe6cb6bb3,	0xe1983186,	0x75ed470f,
-0x4adcbd27,	0x3efeda68,	0x4d193a2a,	0xbfdb3cd4,
-0x7c6167b6,	0xdbddea68,	0x4b0d2d62,	0x00ba3860,
-0x49ec2544,	0xa68698c9,	0x2ce7be1b,	0xf5afc9fc,
-0x1cebf9c3,	0x350f8f5b,	0x893eefb8,	0x77414f6f,
-0xe46f26fa,	0x67bf6398,	0xd6858f5d,	0xac73db2a,
-0x58e20acc,	0x750dd76a,	0xb7930e80,	0x8a8796c0,
-0x44c86997,	0xb1807742,	0x3c827dc1,	0x381aaa3c,
-0x83ac76f3,	0x57f0a2d6,	0x18261009,	0xe107138f,
-0x85711c22,	0x2e1d982f,	0x7062179a,	0xaedfa298,
-0x62e438f2,	0x6d325a9a,	0x99b489d3,	0x1bf77b3a,
-0x28ca20e8,	0x502d1b21,	0x74a833c0,	0xbeb91634,
-0xf56ffef9,	0x05401164,	0xe5dbab51,	0x0a2b460d,
-0x2f0d9c22,	0xc74472f9,	0x12da5199,	0x68b2d628,
-0x9a118f9a,	0x9035d200,	0xcda0221f,	0x12430cde,
-0x79a43fbb,	0x5bb5e1b7,	0xeab5ed62,	0xe6a11e32,
-0x3118b0fa,	0xedbcfb64,	0xd2285490,	0x824023c6,
-0x30311fb1,	0xa0a4a475,	0xbfa8ac55,	0xb8c8fbda,
-0xdf3cab63,	0x8d805566,	0xf52c1b1a,	0xa3471090,
-0x02328a4a,	0x5d1dce57,	0x196aea39,	0xcd0f640b,
-0x2fa01c27,	0x6175f783,	0xb2b6a0e4,	0x02fe6171,
-0x2d3cb20b,	0x25f331e6,	0xacfa8085,	0x46a09a58,
-0x27bbfb9e,	0x3914f970,	0x73e35206,	0x8bb87194,
-0xdb58fc4b,	0x62fd53ff,	0x2c942c7c,	0x3f4681ba,
-0xeada1780,	0x5dfbb960,	0x8473948a,	0x80787902,
-0x049c20ba,	0x9e95a4fc,	0x8526d8ac,	0x3dcdcd2d,
-0xb9562f16,	0xc9c8eb08,	0x533ed0a2,	0xa34d5d73,
-0x3e579c8e,	0x235bb378,	0x36576983,	0xc71f11b2,
-0x035eae76,	0xbec23972,	0x8613e5e9,	0x3982899a,
-0xe5a55d62,	0x3c45a7e9,	0xbd4d6def,	0x17ae0a5f,
-0xf0f53bb8,	0xa3dd1e29,	0x36f9520b,	0x72cbd950,
-0x4d762d12,	0xe03cb7a8,	0xf8c8c1fe,	0xa4ff17a1,
-0xcc779472,	0x83f9b379,	0xa2fc038c,	0xdd3b8104,
-0x95936bb0,	0xf36c9705,	0x93939e08,	0xc98576ac,
-0xec9196d1,	0xc8bce622,	0xb48e1075,	0x98dbd77d,
-0xd1b04c3d,	0x85d1d422,	0x20765885,	0xc6a17eb5,
-0x8e913cdc,	0x3f7a6758,	0x08176f48,	0xba2ea15f,
-0x3638114d,	0xf08cb49b,	0xb8b6d9ce,	0x4e55891a,
-0x2775c022,	0xc8d45982,	0x529c2eb3,	0xde080e24,
-0xdac9c028,	0xeec68934,	0x8eaace11,	0xe82e05aa,
-0x00033a20,	0x4ec94b5e,	0x445f5562,	0xa5c58462,
-0xb6942526,	0x44631607,	0x5065644c,	0x14946f9c,
-0xa9cb0e63,	0x53dff50a,	0x3f18fa24,	0x20b3b811,
-0x95c1e57b,	0x1523d301,	0xc4e24932,	0x41a9be80,
-0x24fc45b0,	0xccff2cbc,	0x996af6a1,	0xe3f201c3,
-0x0917ea23,	0xbf4a1ac3,	0xbb0db6f1,	0xd15772df,
-0xb1465383,	0x61400275,	0x571f6b1d,	0x0a4407f7,
-0x916cfbce,	0x114f042a,	0x1cb9b3a6,	0x1b34c85a,
-0xe36acc8d,	0xab109469,	0x5af9a63a,	0xccd4defc,
-0xb758adfd,	0xbd8ddecf,	0x5ffe8424,	0xd73e2a4b,
-0xb41cb99e,	0x01a52553,	0xba70e749,	0xf81d7557,
-0x2b4f0847,	0xa22e281f,	0x5c653c31,	0x89bdb546,
-0xa596e592,	0xbca4cbf4,	0xc3d1dfe3,	0x64a21c2e,
-0x159aa4b7,	0xed90f2d6,	0xb1164cb0,	0x86de0088,
-0xfd4e49e6,	0x70702b0d,	0x946b532b,	0x03a0144e,
-0x71fb19ed,	0x07c41763,	0x63312ce9,	0x0e2f5ee4,
-0xc6501661,	0x09599e4e,	0x544fd5cc,	0x054d842c,
-0x902bb57d,	0xdf82a365,	0xb7ae9427,	0xa6750881,
-0xeee3c9cd,	0x6cbe0f45,	0x7f72d3f9,	0x430b786f,
-0x162b6004,	0xbfcd440b,	0xdc4f5c81,	0x82249f6b,
-0x98d1cdca,	0x2cc2692e,	0xf977f83a,	0x570c1e1f,
-0x24ed6461,	0xcae5afea,	0x9cf06576,	0x9199d69c,
-0x883febfe,	0x0f254c42,	0x6eb50978,	0xf91fade4,
-0x9cfe5488,	0xfe3bf66b,	0x86ea94e3,	0x1bed23f5,
-0x0bded397,	0x0cde064b,	0x7abd7a81,	0x8efb798e,
-0x9a78e5f2,	0x7c46d76f,	0xcb3ae1ea,	0xc33e7ab1,
-0x0c3993f0,	0x5b2d8de7,	0x24948ba8,	0xffce06e6,
-0x0d3c2dc2,	0x3ae09142,	0x7e6b932e,	0xb3e22558,
-0x9f7c425e,	0x8fa1329b,	0x24aa5012,	0xb9e49bc7,
-0x787dd5a6,	0xf68c8171,	0x440d2146,	0x9734857f,
-0x8c30c31a,	0xcb3352a1,	0x46b04f38,	0x72572ef8,
-0xc90c56df,	0xe8103fa8,	0x04057577,	0xd1c250d9,
-0x5cb390a9,	0xbdba74b9,	0x80012fa3,	0x408216c2,
-0xadca83bc,	0x3c39bcdf,	0xf0da9459,	0x421d5a3d,
-0xc5cf55c9,	0x2dcfa63d,	0xd852066b,	0x606b2204,
-0x4d5e9576,	0xe8d6475f,	0xe46ec6b0,	0xf4e3c2c6,
-0x1bfe1bb0,	0xc2803818,	0x2a3e4809,	0x947e50a1,
-0x3a10e713,	0xc9e070cc,	0xa4244fe4,	0xa7f5d2e7,
-0x194f77ee,	0x76754ab4,	0x75ed4e5f,	0x92ffdbaa,
-0x1f5bce6a,	0x14aeeec7,	0x366fbb47,	0x44ecec7b,
-0xbc31e911,	0xee6c224f,	0x0a6f7376,	0xbe79fce3,
-0x53a18077,	0x6f6ad5fe,	0x945938bd,	0x61bb760c,
-0xed26220f,	0x9f492f0a,	0xaf0f2d80,	0x265f5449,
-0xae1f2dc3,	0xd235910c,	0x44a0f4a0,	0x36fcc004,
-0x1e8fa223,	0xe7440ed0,	0xa8535548,	0x6d7e7029,
-0x2e1b7968,	0xf3baa61d,	0xf447ef12,	0x701d62d6,
-0x2da5dcf4,	0x44828196,	0x41af9c9a,	0xab210662,
-0xa5ee18f2,	0xd45eb369,	0x947814fe,	0xeb62eb49,
-0x30c555c6,	0xdc06ccbd,	0x786705d2,	0xd50c80d3,
-0x266d8313,	0x68f63164,	0x1e3e4322,	0xfc23834e,
-0xe879261f,	0x28992a8f,	0xab86dac9,	0x19f88d1a,
-0x5110c867,	0x3c050155,	0xf9b1b3f5,	0x98909489,
-0xfa0ee6bc,	0x038fb4ce,	0xbe1c9e33,	0x18f96bcd,
-0xa1635c9a,	0xff3e9374,	0x5b033171,	0x0b84bfd9,
-0x3c091bae,	0x6da61a4e,	0x07d81b5d,	0x3904ea3c,
-0x75f4e7f1,	0x3e70c12e,	0x9c70d835,	0x9a1ea5a6,
-0x4b99b705,	0x08f6ab89,	0x7649901c,	0xee3e7687,
-0xa3deb48c,	0xd74e8c78,	0xe8e120c3,	0x425d3d96,
-0x16f136bd,	0x0c7a32ef,	0x37a0ff53,	0x77b035e4,
-0xba8808c1,	0x1d3d8330,	0x8d224cce,	0xed789fed,
-0x550a8352,	0xe2715912,	0x185f62d1,	0xe301002a,
-0xbe2ed99b,	0xbb1dfd60,	0x9d22d8f9,	0xcbfa36d5,
-0xad7e92e0,	0xd2db61d4,	0x1df386f5,	0x92b5797c,
-0x00ac8ed1,	0x2f7470b1,	0x674e258b,	0x6689df79,
-0x135c5c1a,	0x87abbc50,	0x19ac082b,	0xe7f7d64c,
-0x24fd4922,	0x7eeadc29,	0xa0910eaa,	0x763231d6,
-0x23597ccb,	0x332f33c3,	0x93992b6a,	0x19c8937c,
-0x75d6a9f4,	0x221395e1,	0x662914d0,	0x997d7860,
-0xd196adeb,	0xa5402fd9,	0x8bd6f12f,	0xc31d97e0,
-0x304dd9dc,	0x72f35c72,	0x8ced870e,	0x1eef8a14,
-0x323321fa,	0xf193079f,	0x18026b1c,	0x5a1107a5,
-0x54979f4b,	0x6afee492,	0x04c012e6,	0x3446250c,
-0x25a691a8,	0xc19a76ea,	0x66bd5b14,	0x6250bd2d,
-0xc6c082d9,	0x67ea1d78,	0xbe68a7ef,	0x03f50dc8,
-0xd8f76566,	0xb6681752,	0x00e2b087,	0x7ed2e598,
-0x8c9cbc83,	0x103b03f5,	0xee4d2723,	0x67b3903f,
-0x1e057dec,	0xc5703ba6,	0xae0615f9,	0x1bce0df2,
-0xfd041279,	0xc874a2c3,	0x0a91d2fa,	0xac098457,
-0xc1efc5f9,	0xd48208eb,	0x72e9baa8,	0x184dc658,
-0x3d26b8b4,	0x90e2469d,	0x6d07f351,	0x3f6898a7,
-0x21e4de0b,	0x0fd04a43,	0x2c99cd2b,	0x44b28cdd,
-0xaf5483a5,	0xe50b9a12,	0xd98fe031,	0x9d6e8f08,
-0xf385ba19,	0x5e531cb0,	0xc545867a,	0x65f5ebf5,
-0x9f27ad5a,	0x2de11f0d,	0xef6f0970,	0x973b11f2,
-0x72228c07,	0xe13fdb84,	0xd2a7b46f,	0xc85a38db,
-0x331a9807,	0x3be38ebc,	0x3e7bf15d,	0xa82a1e68,
-0x4b42b5bc,	0x9871203e,	0x7d1e1e24,	0x12f57b6b,
-0xf5403ec8,	0x28746c33,	0xae20522f,	0xf6042fba,
-0x66bada5d,	0xbefe376f,	0xfd3773a5,	0xbb5fc6e8,
-0x34c0433d,	0x3cfc83e9,	0xd096736a,	0xa53be016,
-0xeba3dd6c,	0x2c626561,	0x3c160c8d,	0x8506c719,
-0x802e7b47,	0x16079396,	0x6d29b175,	0x4e91abb4,
-0xe350ce95,	0x0d481aa5,	0x94e95371,	0x10dc4dec,
-0xbfeb3735,	0x3ce3cb4d,	0x32ff742a,	0xac5ad3cb,
-/*  2617-m111067AA07.inc  */
-0x00000001,	0x00000a07,	0x04092008,	0x0001067a,
-0x83067f5a,	0x00000001,	0x00000011,	0x00001fd0,
-0x00002000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000a07,
-0x0000001a,	0xa4000000,	0x20080408,	0x00000401,
-0x00000001,	0x0001067a,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc4294866,	0x3e20a114,	0x8387f19c,	0xdafb14aa,
-0x33a38309,	0x68b0f8ea,	0x2a20b200,	0xcdc7aa9e,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x9f63eb61,	0x64816577,	0x10c68141,
-0x1cc5fd18,	0x156703a6,	0xe3315c33,	0x62a1db21,
-0xb6135848,	0xa306d2fe,	0x117cb585,	0x54c3a133,
-0x722cf721,	0xa693cd57,	0xd02c0e2d,	0xf17b96ca,
-0x97d2a408,	0x2e776501,	0x667f7664,	0x1568cf83,
-0xa044dee1,	0xe6a879aa,	0x4ff23d0a,	0xd559de49,
-0x2dabb17a,	0xc6c39e38,	0xc3ae5451,	0x2d03f3dd,
-0x7ba226ed,	0x69a19529,	0xc2865715,	0x8b95e6c2,
-0x7a7ee1cf,	0x74b5e43f,	0x69aeeefb,	0x5d95aaa5,
-0x0afeb5dd,	0xdb837be6,	0xed6f9d79,	0x2ad96eb4,
-0xcd60dd82,	0xc3ff7d75,	0x7030a02b,	0xdbbe45dc,
-0x203cd7ba,	0xc3b90579,	0xa21f54f2,	0xc79853ce,
-0x5e3f74eb,	0x06c63742,	0xb1fa50ef,	0x0e8e950e,
-0x97d44b72,	0xa48dc8ad,	0xf3803fb8,	0x946e4d5e,
-0xf0f1e9f6,	0x272b9764,	0x567efb67,	0x82deebcc,
-0x614f61e8,	0x3bea41b8,	0x31a12485,	0x682e10ae,
-0x954c7b7f,	0x0e4bccf0,	0x8cb1eb25,	0xb5018c6e,
-0x50957531,	0xcc60f1c9,	0x11181c5c,	0xa4dc1468,
-0x3310423f,	0xd2550a2a,	0x3bd2ac80,	0x2be006d9,
-0xf57f3e2d,	0xb4387cc7,	0xe96c48f9,	0x722975a2,
-0x4506717f,	0xaf92aa6e,	0x7de4eb6e,	0x3600e58d,
-0x898cc58f,	0x271c467f,	0x1c5cd377,	0x5858e9bc,
-0xd3ad9408,	0x513c936c,	0x0dc54b7e,	0x0226d703,
-0x4cc95088,	0x78bbb408,	0x573d07e2,	0xa4e9cd4e,
-0x4a2930cc,	0x3082d573,	0x68c8c48e,	0x883d27f8,
-0x4e91dd95,	0x850f6d80,	0x5f7f3e37,	0x452cc29a,
-0xf2f9cc40,	0x278be406,	0x356eb275,	0xda301857,
-0xdbc49113,	0x7007d110,	0x06f49bc2,	0x74712f32,
-0x73176720,	0xcebc66e2,	0x592acf0a,	0x8818dd3f,
-0xd599d562,	0x54199a46,	0x6472129b,	0x47058cd1,
-0xac4a74f5,	0x1cac471a,	0xf1b4758a,	0xfa6f8e1d,
-0x1013e19a,	0x59252c0b,	0xa764c600,	0xfba01968,
-0xc7c11589,	0x2b4bf080,	0x0157b32c,	0xc09788fa,
-0x1be99aed,	0x19c1799c,	0xb1d03201,	0x8bfb5374,
-0x44e04a89,	0x895d3a8b,	0x5b3a53dd,	0x4704a722,
-0x0d4ac344,	0x8a3f81f2,	0x3513e05d,	0x04e89637,
-0x39f3d4a3,	0x883f2acd,	0xbc2ec5aa,	0x3a26f17e,
-0x3de2b026,	0x49cffb83,	0x9cdece0f,	0xdaaddd7f,
-0xc884a2fe,	0xe4244359,	0x493030d4,	0xb87e816a,
-0x3b2481a1,	0xa2eaa4eb,	0x33d7ad6a,	0x64947485,
-0x65f85855,	0x088388d8,	0xf6dfc3eb,	0xbceddbca,
-0xf72f47e1,	0xd1d06e25,	0x76ff3bc0,	0x9b8f2139,
-0xec7bc702,	0xfe6e6c0f,	0x42d31d20,	0x7e0397f9,
-0xb20b40ff,	0x45a5ce27,	0x31949159,	0x7013a868,
-0xdef2e0d9,	0x30c62ff4,	0x9b5a9b24,	0x0e4e4b1d,
-0xecbbbe85,	0x4cca116b,	0x341fa1fc,	0xfa64b033,
-0x43007f76,	0x710238e0,	0xa995a864,	0x5125d448,
-0xc20c49c5,	0xea370734,	0x9bb92154,	0x596f42c2,
-0x8d8919f6,	0xdd875cf4,	0x3b76b70b,	0xe96291c9,
-0x2814c6d4,	0x0baf988f,	0x9880af78,	0xcbb57ca5,
-0xf9580819,	0xebe041cb,	0x051d6dab,	0x5170746b,
-0x6f04bfec,	0xca10ec0b,	0x2a870ec1,	0x551af839,
-0xcfbbbb16,	0xef91d864,	0xe9b9dde1,	0xf1fade18,
-0xe306f50b,	0xeb5253aa,	0x30010729,	0xb4169d72,
-0x3320e4f1,	0x9c6946e1,	0xdee63588,	0x4b2967be,
-0x167720ed,	0x6f27e397,	0x83419fdc,	0xac4386f3,
-0x0ac58383,	0x55c0dd4e,	0x62b4a145,	0x91d64a01,
-0x0e8acdb5,	0x40de995a,	0xc850ada1,	0xaa95a50a,
-0x14516378,	0x294a976e,	0x544fa118,	0x904c471c,
-0x8a5896d3,	0xb1486188,	0x237498dc,	0x1a1980b3,
-0xd339968f,	0xe735a8b1,	0xc5ee31e3,	0x35c64060,
-0x79cd8f43,	0xa2bb1974,	0x00189576,	0xf7bd74be,
-0xdd52d07c,	0xa20b9c8b,	0x98dadf9d,	0xf75c05be,
-0x476ac3a5,	0x6fb2bf82,	0x914c23c7,	0xd91c35e8,
-0x709ef212,	0x3d8f3ca6,	0x14c20046,	0x7015482e,
-0xb3fa2331,	0x78933f36,	0xc73c72b5,	0x645b4476,
-0x299fa727,	0x701d7717,	0xf6c4bfed,	0x3213dc65,
-0xfe66e1b4,	0x8040904c,	0xc536845b,	0xd1764a8d,
-0xdeb49b88,	0xdaf26115,	0x8160aa13,	0x206d4929,
-0x92fdb80a,	0x4f1aaab2,	0xfbbac21f,	0x2dc479da,
-0xd2ce1eab,	0xa7da6602,	0xa9fbe019,	0xdd58fac1,
-0x747ab469,	0x946a3b93,	0xc7b9cbe7,	0xc6f74040,
-0x8a8bee87,	0x07f65d07,	0xe79eb820,	0x64ef2fc1,
-0x72b1eccf,	0xc71f601b,	0x2812ab18,	0x48415edf,
-0x45a80c6d,	0x7f616640,	0xfeaa98d0,	0x1024f1e8,
-0x37b3735c,	0xc136f513,	0x5df10182,	0x1bd2ec03,
-0x07f04b3c,	0x59beeff2,	0xea0388f8,	0x2f6addc8,
-0xe0f282e2,	0xf9772673,	0x6bd0dc01,	0x3b4d6f9b,
-0x29b81515,	0x6c553377,	0x1136b69a,	0x50e03397,
-0x9c483ccd,	0xb0a13c9d,	0xea8e6bd6,	0xb8129b95,
-0xc085a4d1,	0x52f64f7f,	0x178aad6e,	0xe5c4d92a,
-0x4c35f2de,	0x8f179df7,	0xba405091,	0xd756e10d,
-0x23bfae39,	0x74015fee,	0x15dc3e64,	0xdfc05a18,
-0xa51ac3a0,	0x0ad4595a,	0x801363f0,	0x3db1f0c5,
-0x97a8ca8f,	0x7e74b015,	0x124d1664,	0x71b26596,
-0xaf073d4e,	0xf45d87d4,	0xd73c1dd0,	0xd1ade30b,
-0x8127545f,	0x4ba0585c,	0x5bb26da4,	0xd64fb76b,
-0x5c9c8190,	0xc1603512,	0xf7a69779,	0x1529ac38,
-0x8d9422c9,	0xac132697,	0x5f9ce586,	0x8d5ca1ce,
-0xba409dbd,	0x184b0698,	0x71bc5a54,	0x294e6b1c,
-0x085c38df,	0x629e955b,	0x73f5c2b8,	0x219166e4,
-0x9805fea9,	0x7602d837,	0x0932604b,	0x06a1509c,
-0x2afe3b47,	0x61050264,	0x0fba8fc2,	0x9f648238,
-0xbf3adf84,	0xdb8d2f92,	0xba2d9b51,	0x3d4415df,
-0x32811e41,	0x176a4519,	0x1ffd7d6b,	0xffe56807,
-0xca7db7a3,	0x5c811c87,	0x6bf1fe24,	0xc3013434,
-0x4ccc937e,	0x0a04797c,	0xca7dd4b5,	0x20ba4643,
-0x2b18ed89,	0x2ccf7a54,	0xd1a9e7a8,	0x67d96e26,
-0x9dd29473,	0x0f26a8f8,	0x164fb823,	0x17c5d3fc,
-0x26361bf0,	0x02544619,	0x32bbe44e,	0x12fbec8d,
-0x0a928412,	0x23652975,	0xe67465e7,	0xd1f49edc,
-0x200ce053,	0x1276b87a,	0xf5150061,	0xf509028d,
-0x4aa27234,	0x6fbc6156,	0x89e61e73,	0x612a7618,
-0x20783c3e,	0x152fda0c,	0x9a5c7b17,	0xebd39bba,
-0x9793ab7e,	0x053f88e4,	0xef9499c7,	0xdf5efc36,
-0xa2792729,	0x068ba6d6,	0xa5c5687e,	0x3924364a,
-0xa4c6c2e4,	0x45364a92,	0xda08f6ba,	0x1551c9a5,
-0xb4787235,	0x73d99aae,	0x584e52ec,	0xd76c6379,
-0xf852e104,	0xa335ab55,	0xd2b1013a,	0xc2c591f1,
-0x91ac865d,	0xe82497be,	0x39f62b27,	0x3d6a9530,
-0xb74f7711,	0xca3f54d4,	0x466e17e8,	0xe91d700d,
-0xbe8197a7,	0x04218b87,	0x587e7832,	0x838c1a71,
-0x39d27956,	0x36ecc542,	0x36b22957,	0x5c44fe01,
-0x86ae0bfe,	0x2ffa7c08,	0x603db66a,	0x69d7eed9,
-0xd96761bf,	0x44bc3358,	0x2c04707e,	0x290a0631,
-0xac627cd8,	0x1dd90751,	0x41e91a35,	0xf5dc1260,
-0x36564120,	0x1ac71792,	0x87e0a694,	0x063d0388,
-0x4f282802,	0x026fdbfd,	0x11102f9a,	0x5932ad11,
-0xc5f266d3,	0x27587435,	0x6fecaeb7,	0x191e6dda,
-0x50daedc2,	0xa282f89d,	0x89ceb660,	0x4564adc8,
-0x0cee73af,	0xed4f399f,	0x10085cac,	0x0d9ded47,
-0xa88956dd,	0x242798ad,	0xae708815,	0xf7edf1f7,
-0xb9fa65b7,	0xe8b4fcc1,	0x00fd86c4,	0x7ad67bce,
-0x66e3f423,	0xee1b4874,	0xccbc4116,	0x04a72b4b,
-0x39a640f0,	0xef9f5c48,	0xe8d1470d,	0xee1ef5d1,
-0x90784af3,	0xbc0b3389,	0x49aac119,	0xdf65d921,
-0x1023547c,	0x486b404a,	0x834d359c,	0xf5dbbd50,
-0x68b5997b,	0x7aee9417,	0x42e48286,	0xa9d8ee77,
-0x181a3e1e,	0x607cb99f,	0x5f53c78d,	0x5a60a6a8,
-0x39cfc04c,	0xfbe6eb32,	0x84348beb,	0xa278662b,
-0x398c625d,	0x3f9859e8,	0x5517ef17,	0x15856fe2,
-0xba4d33c1,	0xc93d7652,	0xcf40a2aa,	0x2ac37060,
-0x5efc6cab,	0xced95484,	0xf39ceed8,	0x4ecc8045,
-0x13c1e742,	0xd93d87f1,	0x695cf766,	0xcb53f961,
-0x15e0fc91,	0x37178627,	0x5e832076,	0x8c72db35,
-0x2ce047e6,	0x11d9e791,	0x45e4d466,	0x8b7a7c71,
-0xa83e9738,	0x7c54e924,	0x2ff12bda,	0x6b1ca347,
-0x2957b0a8,	0x1fdb23fa,	0x91f98947,	0xe02c3f1b,
-0xc42cbb06,	0xf0421ecc,	0x1716fce4,	0x1bb34813,
-0xc67853bd,	0x3a27d8f1,	0x8e38f3be,	0x9e5dc781,
-0x245017b1,	0x8cade69f,	0x44642f90,	0x3ef4215a,
-0x879c78ad,	0x371ddad7,	0x7c629ddb,	0xe5f61d71,
-0xbb3896fd,	0xcd3067f4,	0x4cfc2e12,	0xe7d69e64,
-0xcd35c838,	0x6af17c65,	0x322fec99,	0x81221d8b,
-0xa586497b,	0xb2cecfa9,	0xebbdaef4,	0x074fef30,
-0xf825db99,	0x2f916b7b,	0xdc32f01d,	0x915eddd6,
-0x96238f76,	0xf61c60df,	0x68795cf1,	0x46f1f13f,
-0xc9654740,	0x63872bc0,	0x51e210b6,	0x17b5c27b,
-0x7adf79d9,	0x7a823cc1,	0x02011b40,	0x6434a855,
-0x56eca557,	0xa14f4132,	0x8c120524,	0x778266f4,
-0x04ad9ca3,	0xccceab50,	0xecd117cc,	0xf0defcc9,
-0x4f573e38,	0x5393033b,	0x88684c7b,	0x1a33f3a7,
-0x898f45f0,	0x355ffa68,	0x174542c3,	0xa3dcfb8d,
-0x6cd09199,	0x67339d62,	0xd29348c7,	0x37431b9f,
-0x508c487c,	0xe4668bdf,	0xcbba1b72,	0x1b1b10a1,
-0xcd4447c0,	0xf9ee7e83,	0x871a0f4f,	0xa94572d2,
-0xac77a5c1,	0x3b84dbd4,	0xd45a09b6,	0x8e73228d,
-0x59f2bb36,	0x4855a81b,	0x3fafe19b,	0x2f612920,
-0xb9d216f3,	0x937e6a7e,	0xf31a2011,	0xfb7ca7fb,
-0x1ca50eef,	0xd1d2baec,	0xa19d932b,	0x620d57d4,
-0x086b7270,	0x5fcc7905,	0xb0dbe594,	0xf16f0a1d,
-0xd47563f5,	0xe54eeb3a,	0x588766e4,	0x0280ef61,
-0x8f26923d,	0x14b892bd,	0xdd11550f,	0x3e5ec618,
-0xed825fca,	0x52a04ef9,	0xaad0c980,	0xdff1a4ea,
-0x68f8954e,	0xc0f1664d,	0x6bc36a13,	0x5d36fbca,
-0x05f7883f,	0xd2da1028,	0xe3cd0e3e,	0xa4038605,
-0xb48e7f32,	0x1f5ffb16,	0x7c4899b2,	0xb3073d46,
-0xe2acb6e2,	0xefe17316,	0xca66163c,	0x93d4b562,
-0xa86a9d63,	0x07449ca1,	0xb499c9d4,	0x6c666b70,
-0x0d8c9f9d,	0x78c926a0,	0x99e4d31f,	0xd73c49ca,
-0xfd7e352a,	0xd710b7c6,	0x18100555,	0xb4e79321,
-0x5efc693a,	0x703180ef,	0x9bbb238b,	0xa105a3e4,
-0xdaa3ce4d,	0xff7cc846,	0x2bfbd556,	0x5f5ba34d,
-0x0ef8537b,	0xb0bc4e7b,	0x224f6dbf,	0x3b9ddb96,
-0xf731880a,	0x00d8d325,	0x55e4908e,	0x63bc2811,
-0xafa6f5cd,	0x5219a8c7,	0x4609390d,	0xd68e7ae1,
-0xc2e5e5dd,	0xf232712f,	0x1c52c242,	0x5a6cb79f,
-0x26667cb4,	0x0de1b656,	0x42ca30c0,	0x4ab64de9,
-0x26b0cfa4,	0x2897b6d1,	0xefc5d75e,	0x67ca7a04,
-0x805a805d,	0xf2e454cc,	0x837877a1,	0x8ca7dc3b,
-0x40620ce0,	0x5ac019fb,	0x6ee93d19,	0xae137f12,
-0x0cedbd2f,	0xacc51979,	0xec7ae13f,	0x4537c7b6,
-0xe3491fd6,	0x8e63f870,	0x1e08f6b3,	0x219dae5b,
-0x8db5d524,	0x8de9f8ee,	0x04913730,	0x7a11db72,
-0x6e4d0088,	0xa8713aba,	0xf2e72fd0,	0x2ba5695f,
-0xe11da489,	0x6a5ecdf5,	0xc2133568,	0x994cc9f4,
-0xed6825cc,	0x3d104599,	0x4d7679b6,	0x3bfe94f0,
-0xc6a131db,	0x6dfcc31c,	0x9ec5c4f6,	0x3a386a48,
-0x5d0b6f61,	0x059b5114,	0xd4831a86,	0x37460179,
-0x02f23600,	0x1c04bd2e,	0xbf689d81,	0x2bf0be1c,
-0xd8d5974c,	0x0d9d0709,	0x5dcade38,	0x167df39e,
-0x96942861,	0xf1e6a09c,	0x16ac7082,	0x5037af19,
-0x69c40dbb,	0x10728698,	0x71d52ed0,	0xa77036b8,
-0xa050ea5f,	0xa7ca5494,	0xa25b4acd,	0x7f8ceb12,
-0x8f03bc78,	0x6b7ee0f3,	0xa97d44b3,	0xeda32377,
-0x852c4597,	0x3f81aa95,	0xf148a2da,	0x770e5cb6,
-0x90fe1806,	0x50620299,	0xd7f4042b,	0x0d356595,
-0x5596e5dd,	0x6c797c13,	0x500c0ee5,	0x7e5ae4c5,
-0xecf3ac43,	0xae09d902,	0x95b72b10,	0x7597d441,
-0x8d719da8,	0x151b5d1c,	0x1f6790f9,	0x1147be9f,
-0xee857fb4,	0x6f34c63c,	0xb5211613,	0x831687d1,
-0x80e19a47,	0x1bb032f0,	0x5341a6f2,	0xc9a32ec1,
-0xad2521c2,	0x359e67d5,	0xeb4fa538,	0x1cc294ee,
-0xab08e4ee,	0x491c2562,	0xe1e38431,	0x039787ad,
-0xa3cc1cd4,	0x3ff47385,	0x0f442100,	0xd40d9c3e,
-0xcd033c28,	0x400eaf93,	0x5017c05d,	0x98554fb3,
-0x3de23fb4,	0xaa7d549c,	0x6be71942,	0x78577be6,
-0x47aa0dd7,	0xa1226946,	0xcb703f76,	0x023e8ff2,
-0x649fd255,	0xa927f029,	0xe2cfa7b3,	0x03a6ce51,
-0xf674945b,	0x77f3c516,	0x41eb2b88,	0x5be10c42,
-0x88a250be,	0xc30b371b,	0x8711bcb0,	0xaba1efe7,
-0x0446f6d0,	0xe7ff87ba,	0x879b4aa6,	0xb033052e,
-0xa388c8ab,	0x3344d7ab,	0xa81b3a68,	0x895fb4ff,
-0xe4efddc9,	0x7c69bba5,	0xbd7226cf,	0xca2e3b74,
-0xba316a72,	0x087b68ba,	0xa0234a53,	0x51f6447a,
-0x1c6c1312,	0x52e597e7,	0xc50f49ee,	0x064ce0c7,
-0x70f67efe,	0xcaf13ee0,	0xd68fc906,	0xa5a173a8,
-0xde41697f,	0xc8b09415,	0x8a08cd8f,	0x2ac8a7ed,
-0xac323499,	0xf55a3c3e,	0xd487d5c3,	0xb8940642,
-0x73cd4073,	0xfb15c814,	0x775f4fe8,	0x2b42622c,
-0xa53339a1,	0x305c5717,	0xcdae12bf,	0x8facff91,
-0x86728c4f,	0xde5967a7,	0xaefa7393,	0x60fc32e4,
-0x4ddd7ad9,	0x020ac80d,	0xd87b74e7,	0x7ffcdc79,
-0x6e7ebe24,	0x561f95a0,	0x2523a129,	0xd40136d7,
-0xd253e4db,	0x8339b140,	0x71f6d4cf,	0x9bbfd0df,
-0xc54f7b50,	0x6c13a6fd,	0x09e9596d,	0xa71eaa48,
-0x5b8a7c0a,	0x5cf679df,	0xcab512b5,	0x61623502,
-0xe002bd96,	0x5e7b9889,	0xb029fae3,	0x85ae825e,
-0x0cb81cf4,	0x7b8d598e,	0x1b1b4c43,	0x723f793e,
-0xc2d0120d,	0xfa704e12,	0x0529301e,	0x6d7c1536,
-0xe4008061,	0x319c2fce,	0x4dbb7c85,	0x989ae3e5,
-0x877539d3,	0x9d77a472,	0x75e0ec43,	0x5243baa3,
-0x7866e10c,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-0x4e24165f,	0xa7c66809,	0x2e60bdcf,	0xaad70a08,
-0xa73ea713,	0xe28f97a7,	0x283a9eab,	0xd4366489,
-0xe776f963,	0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,
-0x3bae5f6d,	0x8d2bbef1,	0x7e9181e6,	0xf06aa121,
-0xd06b2d20,	0xa83ea826,	0xef935e4f,	0xdfd27456,
-0xa3451468,	0xc6820a63,	0x43463105,	0x787697aa,
-0xcba5543d,	0xdf7e1e2d,	0x6998a8af,	0x98ce6c08,
-0x89de731a,	0x943a3510,	0xb36ead85,	0xd5258d4b,
-0x1cd6df61,	0x82a5c59d,	0xd078e7a4,	0xa33d4317,
-0x24dc45f8,	0x3f3daf27,	0x0478bc6f,	0x92dfa16c,
-0x952a872e,	0x7a34e03f,	0x0f088084,	0xa40937fe,
-0x38fc7749,	0xa157e8a4,	0xbce94344,	0x7045ff7b,
-0xf3e1ab66,	0xe62a6058,	0x5564ff10,	0x38198f1e,
-0xf326f0f1,	0xe262bc0c,	0x2f0b851a,	0xc7bcbe11,
-0xe79f1d1a,	0xc2f93c29,	0x54f3ea9f,	0x8f8f9141,
-0x9f45e13c,	0x7a5b86bd,	0xa764efd8,	0x35f04729,
-0xdd8c4b54,	0x5fa12e51,	0xa5824af9,	0xad328f71,
-0x0f11fbb9,	0x9048e950,	0x04d7a900,	0x02538d1f,
-0x99f745b7,	0xe31f63bb,	0x2c4e3d78,	0x7cdb9245,
-0xa3966ee7,	0x27c4433a,	0xe1d79f3e,	0xe640fa06,
-0x79ce31eb,	0xf25634fa,	0xdd9ce5cb,	0xb7fab8d2,
-0x2f1f0ff2,	0x2acb625c,	0xa0494989,	0x206d7f11,
-0xf268b8ca,	0x292bbf9f,	0x763bd7d0,	0xea4b14fc,
-0x9d3d6aeb,	0x64cca57e,	0x6fc3e29e,	0x3e7bf4bf,
-0x90efc7e3,	0x08e39173,	0xd05bee2c,	0x5b3c8f37,
-0x0921ec6f,	0x3371b715,	0xb324e114,	0xe3abc53f,
-0x576b18f8,	0xc4469024,	0xb2ded6c6,	0xe7783782,
-0xc0a1fd5d,	0xcf324bde,	0x97527c8e,	0x19f8f48c,
-0x3e806a5d,	0x96cff225,	0xe3b9d04a,	0x0e5856ae,
-0x781372f6,	0x9645f2b7,	0x95a743ed,	0xd0c7eded,
-0x86ca3cd9,	0xbab94db0,	0x43a1233a,	0x89c55554,
-0xee776239,	0x34aa0098,	0x66a6e1d4,	0xae0e233e,
-0x717e7b29,	0xb403a4c1,	0x36eb96c5,	0x42140832,
-0x04250936,	0xda375dca,	0x524cb2e6,	0x86deaa0c,
-0x400dc9d1,	0x12c00364,	0xe3ca7cf5,	0x87f20da7,
-0xf57df9ef,	0x580dbdfc,	0x0b3e0369,	0x014d27fd,
-0x4afaf6a1,	0xd1f4ca09,	0x77abc831,	0x30e49729,
-0xec61cd2c,	0x159c1e92,	0xb61b40b1,	0x17c66fd6,
-0xde11c061,	0x79d7f792,	0xc709cbfa,	0x94201c89,
-0xbe65137d,	0x18aea1b4,	0xf248bbc3,	0x465f957d,
-0xcf4a9672,	0xbf293fd2,	0x2c5e31c9,	0xc2c73011,
-0xfb29cbf2,	0x576f7f0b,	0x74de1745,	0xa76e172b,
-0x99b96223,	0x14ce1502,	0x231013fb,	0x1d4df40a,
-0x951b0c16,	0xab173e66,	0x4ff65f74,	0xc4a87a47,
-0x09cc3370,	0x66385490,	0x73e09118,	0x4ee96432,
-0x0164d347,	0x205069b5,	0x158dd226,	0xc932c238,
-0xe9048fa2,	0x100b626a,	0x86ee08cd,	0xed87cb1c,
-0x6353ec37,	0xa36edcc3,	0x8a16dd6b,	0xd28a4198,
-0xebea1127,	0xca0b761a,	0x61c31acf,	0xced5ff4f,
-0xbf4dbd8f,	0xd969d8a7,	0xb6e4e9e8,	0x8421c402,
-0x809d7222,	0xabfd1d2f,	0xc1857ce5,	0x23958fd7,
-0x3226f1d3,	0xd822b4cc,	0x2f1cc3aa,	0x501fe01e,
-0xe36f8c94,	0x7ad27716,	0x3321308b,	0xa85b957b,
-0x38cfdf6e,	0xc7497dd5,	0x2462090c,	0x8f9e42e7,
-0xdf97684a,	0xac8af621,	0xd5224866,	0xc5f64e50,
-0x9724f297,	0xc386097b,	0x48c6f98a,	0xe1478b1a,
-0x2dd23fd8,	0x716b2d85,	0xa5c3789b,	0x53625e80,
-0x9b8b312c,	0xce482165,	0x66161e35,	0x64ecb56a,
-0x9981c46a,	0xe6cb6bb3,	0xe1983186,	0x75ed470f,
-0x4adcbd27,	0x3efeda68,	0x4d193a2a,	0xbfdb3cd4,
-0x7c6167b6,	0xdbddea68,	0x4b0d2d62,	0x00ba3860,
-0x49ec2544,	0xa68698c9,	0x2ce7be1b,	0xf5afc9fc,
-0x1cebf9c3,	0x350f8f5b,	0x893eefb8,	0x77414f6f,
-0xe46f26fa,	0x67bf6398,	0xd6858f5d,	0xac73db2a,
-0x58e20acc,	0x750dd76a,	0xb7930e80,	0x8a8796c0,
-0x44c86997,	0xb1807742,	0x3c827dc1,	0x381aaa3c,
-0x83ac76f3,	0x57f0a2d6,	0x18261009,	0xe107138f,
-0x85711c22,	0x2e1d982f,	0x7062179a,	0xaedfa298,
-0x62e438f2,	0x6d325a9a,	0x99b489d3,	0x1bf77b3a,
-0x28ca20e8,	0x502d1b21,	0x74a833c0,	0xbeb91634,
-0xf56ffef9,	0x05401164,	0xe5dbab51,	0x0a2b460d,
-0x2f0d9c22,	0xc74472f9,	0x12da5199,	0x68b2d628,
-0x9a118f9a,	0x9035d200,	0xcda0221f,	0x12430cde,
-0x79a43fbb,	0x5bb5e1b7,	0xeab5ed62,	0xe6a11e32,
-0x3118b0fa,	0xedbcfb64,	0xd2285490,	0x824023c6,
-0x30311fb1,	0xa0a4a475,	0xbfa8ac55,	0xb8c8fbda,
-0xdf3cab63,	0x8d805566,	0xf52c1b1a,	0xa3471090,
-0x02328a4a,	0x5d1dce57,	0x196aea39,	0xcd0f640b,
-0x2fa01c27,	0x6175f783,	0xb2b6a0e4,	0x02fe6171,
-0x2d3cb20b,	0x25f331e6,	0xacfa8085,	0x46a09a58,
-0x27bbfb9e,	0x3914f970,	0x73e35206,	0x8bb87194,
-0xdb58fc4b,	0x62fd53ff,	0x2c942c7c,	0x3f4681ba,
-0xeada1780,	0x5dfbb960,	0x8473948a,	0x80787902,
-0x049c20ba,	0x9e95a4fc,	0x8526d8ac,	0x3dcdcd2d,
-0xb9562f16,	0xc9c8eb08,	0x533ed0a2,	0xa34d5d73,
-0x3e579c8e,	0x235bb378,	0x36576983,	0xc71f11b2,
-0x035eae76,	0xbec23972,	0x8613e5e9,	0x3982899a,
-0xe5a55d62,	0x3c45a7e9,	0xbd4d6def,	0x17ae0a5f,
-0xf0f53bb8,	0xa3dd1e29,	0x36f9520b,	0x72cbd950,
-0x4d762d12,	0xe03cb7a8,	0xf8c8c1fe,	0xa4ff17a1,
-0xcc779472,	0x83f9b379,	0xa2fc038c,	0xdd3b8104,
-0x95936bb0,	0xf36c9705,	0x93939e08,	0xc98576ac,
-0xec9196d1,	0xc8bce622,	0xb48e1075,	0x98dbd77d,
-0xd1b04c3d,	0x85d1d422,	0x20765885,	0xc6a17eb5,
-0x8e913cdc,	0x3f7a6758,	0x08176f48,	0xba2ea15f,
-0x3638114d,	0xf08cb49b,	0xb8b6d9ce,	0x4e55891a,
-0x2775c022,	0xc8d45982,	0x529c2eb3,	0xde080e24,
-0xdac9c028,	0xeec68934,	0x8eaace11,	0xe82e05aa,
-0x00033a20,	0x4ec94b5e,	0x445f5562,	0xa5c58462,
-0xb6942526,	0x44631607,	0x5065644c,	0x14946f9c,
-0xa9cb0e63,	0x53dff50a,	0x3f18fa24,	0x20b3b811,
-0x95c1e57b,	0x1523d301,	0xc4e24932,	0x41a9be80,
-0x24fc45b0,	0xccff2cbc,	0x996af6a1,	0xe3f201c3,
-0x0917ea23,	0xbf4a1ac3,	0xbb0db6f1,	0xd15772df,
-0xb1465383,	0x61400275,	0x571f6b1d,	0x0a4407f7,
-0x916cfbce,	0x114f042a,	0x1cb9b3a6,	0x1b34c85a,
-0xe36acc8d,	0xab109469,	0x5af9a63a,	0xccd4defc,
-0xb758adfd,	0xbd8ddecf,	0x5ffe8424,	0xd73e2a4b,
-0xb41cb99e,	0x01a52553,	0xba70e749,	0xf81d7557,
-0x2b4f0847,	0xa22e281f,	0x5c653c31,	0x89bdb546,
-0xa596e592,	0xbca4cbf4,	0xc3d1dfe3,	0x64a21c2e,
-0x159aa4b7,	0xed90f2d6,	0xb1164cb0,	0x86de0088,
-0xfd4e49e6,	0x70702b0d,	0x946b532b,	0x03a0144e,
-0x71fb19ed,	0x07c41763,	0x63312ce9,	0x0e2f5ee4,
-0xc6501661,	0x09599e4e,	0x544fd5cc,	0x054d842c,
-0x902bb57d,	0xdf82a365,	0xb7ae9427,	0xa6750881,
-0xeee3c9cd,	0x6cbe0f45,	0x7f72d3f9,	0x430b786f,
-0x162b6004,	0xbfcd440b,	0xdc4f5c81,	0x82249f6b,
-0x98d1cdca,	0x2cc2692e,	0xf977f83a,	0x570c1e1f,
-0x24ed6461,	0xcae5afea,	0x9cf06576,	0x9199d69c,
-0x883febfe,	0x0f254c42,	0x6eb50978,	0xf91fade4,
-0x9cfe5488,	0xfe3bf66b,	0x86ea94e3,	0x1bed23f5,
-0x0bded397,	0x0cde064b,	0x7abd7a81,	0x8efb798e,
-0x9a78e5f2,	0x7c46d76f,	0xcb3ae1ea,	0xc33e7ab1,
-0x0c3993f0,	0x5b2d8de7,	0x24948ba8,	0xffce06e6,
-0x0d3c2dc2,	0x3ae09142,	0x7e6b932e,	0xb3e22558,
-0x9f7c425e,	0x8fa1329b,	0x24aa5012,	0xb9e49bc7,
-0x787dd5a6,	0xf68c8171,	0x440d2146,	0x9734857f,
-0x8c30c31a,	0xcb3352a1,	0x46b04f38,	0x72572ef8,
-0xc90c56df,	0xe8103fa8,	0x04057577,	0xd1c250d9,
-0x5cb390a9,	0xbdba74b9,	0x80012fa3,	0x408216c2,
-0xadca83bc,	0x3c39bcdf,	0xf0da9459,	0x421d5a3d,
-0xc5cf55c9,	0x2dcfa63d,	0xd852066b,	0x606b2204,
-0x4d5e9576,	0xe8d6475f,	0xe46ec6b0,	0xf4e3c2c6,
-0x1bfe1bb0,	0xc2803818,	0x2a3e4809,	0x947e50a1,
-0x3a10e713,	0xc9e070cc,	0xa4244fe4,	0xa7f5d2e7,
-0x194f77ee,	0x76754ab4,	0x75ed4e5f,	0x92ffdbaa,
-0x1f5bce6a,	0x14aeeec7,	0x366fbb47,	0x44ecec7b,
-0xbc31e911,	0xee6c224f,	0x0a6f7376,	0xbe79fce3,
-0x53a18077,	0x6f6ad5fe,	0x945938bd,	0x61bb760c,
-0xed26220f,	0x9f492f0a,	0xaf0f2d80,	0x265f5449,
-0xae1f2dc3,	0xd235910c,	0x44a0f4a0,	0x36fcc004,
-0x1e8fa223,	0xe7440ed0,	0xa8535548,	0x6d7e7029,
-0x2e1b7968,	0xf3baa61d,	0xf447ef12,	0x701d62d6,
-0x2da5dcf4,	0x44828196,	0x41af9c9a,	0xab210662,
-0xa5ee18f2,	0xd45eb369,	0x947814fe,	0xeb62eb49,
-0x30c555c6,	0xdc06ccbd,	0x786705d2,	0xd50c80d3,
-0x266d8313,	0x68f63164,	0x1e3e4322,	0xfc23834e,
-0xe879261f,	0x28992a8f,	0xab86dac9,	0x19f88d1a,
-0x5110c867,	0x3c050155,	0xf9b1b3f5,	0x98909489,
-0xfa0ee6bc,	0x038fb4ce,	0xbe1c9e33,	0x18f96bcd,
-0xa1635c9a,	0xff3e9374,	0x5b033171,	0x0b84bfd9,
-0x3c091bae,	0x6da61a4e,	0x07d81b5d,	0x3904ea3c,
-0x75f4e7f1,	0x3e70c12e,	0x9c70d835,	0x9a1ea5a6,
-0x4b99b705,	0x08f6ab89,	0x7649901c,	0xee3e7687,
-0xa3deb48c,	0xd74e8c78,	0xe8e120c3,	0x425d3d96,
-0x16f136bd,	0x0c7a32ef,	0x37a0ff53,	0x77b035e4,
-0xba8808c1,	0x1d3d8330,	0x8d224cce,	0xed789fed,
-0x550a8352,	0xe2715912,	0x185f62d1,	0xe301002a,
-0xbe2ed99b,	0xbb1dfd60,	0x9d22d8f9,	0xcbfa36d5,
-0xad7e92e0,	0xd2db61d4,	0x1df386f5,	0x92b5797c,
-0x00ac8ed1,	0x2f7470b1,	0x674e258b,	0x6689df79,
-0x135c5c1a,	0x87abbc50,	0x19ac082b,	0xe7f7d64c,
-0x24fd4922,	0x7eeadc29,	0xa0910eaa,	0x763231d6,
-0x23597ccb,	0x332f33c3,	0x93992b6a,	0x19c8937c,
-0x75d6a9f4,	0x221395e1,	0x662914d0,	0x997d7860,
-0xd196adeb,	0xa5402fd9,	0x8bd6f12f,	0xc31d97e0,
-0x304dd9dc,	0x72f35c72,	0x8ced870e,	0x1eef8a14,
-0x323321fa,	0xf193079f,	0x18026b1c,	0x5a1107a5,
-0x54979f4b,	0x6afee492,	0x04c012e6,	0x3446250c,
-0x25a691a8,	0xc19a76ea,	0x66bd5b14,	0x6250bd2d,
-0xc6c082d9,	0x67ea1d78,	0xbe68a7ef,	0x03f50dc8,
-0xd8f76566,	0xb6681752,	0x00e2b087,	0x7ed2e598,
-0x8c9cbc83,	0x103b03f5,	0xee4d2723,	0x67b3903f,
-0x1e057dec,	0xc5703ba6,	0xae0615f9,	0x1bce0df2,
-0xfd041279,	0xc874a2c3,	0x0a91d2fa,	0xac098457,
-0xc1efc5f9,	0xd48208eb,	0x72e9baa8,	0x184dc658,
-0x3d26b8b4,	0x90e2469d,	0x6d07f351,	0x3f6898a7,
-0x21e4de0b,	0x0fd04a43,	0x2c99cd2b,	0x44b28cdd,
-0xaf5483a5,	0xe50b9a12,	0xd98fe031,	0x9d6e8f08,
-0xf385ba19,	0x5e531cb0,	0xc545867a,	0x65f5ebf5,
-0x9f27ad5a,	0x2de11f0d,	0xef6f0970,	0x973b11f2,
-0x72228c07,	0xe13fdb84,	0xd2a7b46f,	0xc85a38db,
-0x331a9807,	0x3be38ebc,	0x3e7bf15d,	0xa82a1e68,
-0x4b42b5bc,	0x9871203e,	0x7d1e1e24,	0x12f57b6b,
-0xf5403ec8,	0x28746c33,	0xae20522f,	0xf6042fba,
-0x66bada5d,	0xbefe376f,	0xfd3773a5,	0xbb5fc6e8,
-0x34c0433d,	0x3cfc83e9,	0xd096736a,	0xa53be016,
-0xeba3dd6c,	0x2c626561,	0x3c160c8d,	0x8506c719,
-0x802e7b47,	0x16079396,	0x6d29b175,	0x4e91abb4,
-0xe350ce95,	0x0d481aa5,	0x94e95371,	0x10dc4dec,
-0xbfeb3735,	0x3ce3cb4d,	0x32ff742a,	0xac5ad3cb,
-/*  3014-m13106e5_00000003.inc  */
-0x00000001,	0x00000003,	0x05292009,	0x000106e5,
-0x65b9a532,	0x00000001,	0x00000013,	0x000017d0,
-0x00001800,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000003,
-0x00000000,	0x00000000,	0x20090528,	0x00000581,
-0x00000001,	0x000106e5,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x802733c7,	0xe44c25e6,	0x5ce4df72,	0x63d3c85d,
-0xd280241a,	0xc0965849,	0x78d40625,	0xd62849fe,
-0xbab165d1,	0xfeb576d4,	0xc1edb5b2,	0xa44174b8,
-0x0d1ad45a,	0x4fe5fe0f,	0x62feaf24,	0xafe7de28,
-0x8b076222,	0x881b4891,	0x8daf9241,	0x98e8cf9e,
-0x417b7869,	0xd7e266b6,	0xf07fa211,	0xd01aa170,
-0xbd0ff37d,	0x883aefa5,	0x4313c7ef,	0x97e92355,
-0x84df4fa1,	0x251a1422,	0xbffca04b,	0x80d1e0a9,
-0x2de71585,	0x74f3cc3a,	0x06355b58,	0x404b01a9,
-0x76867925,	0xd35afcf0,	0x2e220cdb,	0xb0c03e11,
-0xff163ac7,	0x796b6c3b,	0x413f51d1,	0xfb5f33e6,
-0x0d3408e5,	0x29f2fd21,	0xe5937245,	0x43a62312,
-0x22bb80da,	0x517fd4cc,	0xd3b29526,	0xace3ace8,
-0x22e26346,	0xf6fa7e9a,	0xe956d161,	0x72d9e32e,
-0x87d1c6a2,	0xe2b89eff,	0xc94b7fba,	0xe61e89b4,
-0xf2a0adaa,	0xac5edf25,	0xef730b2f,	0x64519e05,
-0x59824baa,	0xeb00b868,	0xbf1e0a65,	0x95cebd35,
-0x144fca7c,	0x6ac6e730,	0x1d86878e,	0x955b87bd,
-0x00000011,	0x8a5d7279,	0x9c746993,	0x65f4696f,
-0x1fd6fbfd,	0x0619db81,	0x7b4f59f0,	0xf724e268,
-0x921f6df0,	0x67ea325e,	0xa916f5e6,	0x4f9bb015,
-0x53bd3a15,	0xdc37230d,	0x201b4191,	0x57683cd0,
-0x7131e23f,	0x0abbcc11,	0x6108a870,	0x11cf4c27,
-0x4ee54cb5,	0xf7aab170,	0xb11529cb,	0xced1bfd2,
-0x253eb69d,	0x29d9d2d4,	0x9ae0f219,	0x39707861,
-0x5bc96dde,	0x9ced1328,	0xf8767084,	0xfab69d32,
-0xf29a942f,	0x1bf0e5ea,	0x46be0754,	0xbdf61298,
-0x34098811,	0x99e93e06,	0xdefbecd7,	0x4d9fd90a,
-0x155485ef,	0x72bed1ed,	0xc46720a5,	0x7b4b2110,
-0x73131296,	0x1318681a,	0xcd63a97c,	0xfdce4e46,
-0x8210aafc,	0x943d8ba4,	0x286dc6e2,	0x5666bdbf,
-0x9ae5b64c,	0xbeee7ad6,	0xa9a65347,	0xe10e2a82,
-0x6d6545d3,	0x1b97c56b,	0x656a03f2,	0xe7dfdb99,
-0x0e1b1789,	0xd01eb119,	0x8aee76c4,	0xac391b9c,
-0x294621bd,	0x8394638a,	0xc08a9c08,	0xc99a7a57,
-0xbb436796,	0x03760dd1,	0xd0544a8a,	0xa396a3c1,
-0x760fed3e,	0x725e78f7,	0xed5c8256,	0xbaf43d31,
-0x808978c9,	0x397960a3,	0x16e4eec8,	0x66bd9268,
-0x2036afdd,	0xe3367296,	0x6e3f168a,	0x5070f01a,
-0xd2f9b589,	0x80af1175,	0xecae4347,	0x4225d4fd,
-0xcd104130,	0xcd45153c,	0xe97dc329,	0x1e52907f,
-0x32aeb7fe,	0xf2a8a2de,	0x852e92d2,	0x3f4cb6aa,
-0x6d077bee,	0x06ea83fb,	0x3baba8d0,	0x22576cf9,
-0x452f650e,	0x236b3c00,	0xc7a52b4d,	0xbabb66ac,
-0x4976bbc8,	0x34a142ea,	0x6149273f,	0x02c906d8,
-0x6499ec30,	0x894b05f5,	0x62ee4b82,	0x1f991da5,
-0xec219385,	0x590798f2,	0x430ceba7,	0x6af36c95,
-0x06014c6e,	0x5d9b6835,	0x04814759,	0x8e3595e4,
-0xcf7157e0,	0x9c430b29,	0xb0713963,	0x44be2501,
-0x31360c1f,	0x6ea62dbb,	0x440ce093,	0x6a9d1ae8,
-0x1427f921,	0xd6f30ff9,	0x3b9a5548,	0xba74665b,
-0x7504a05f,	0x8a846257,	0x57075ad7,	0x0792056c,
-0x1b972be1,	0x7420c1e9,	0x34c14b21,	0xd9ca92a6,
-0x74086da2,	0x5bb8b64c,	0x879132d9,	0x4664bf87,
-0x34c8cf8f,	0x8053580c,	0x4cdf0195,	0xce67526b,
-0x3785a4fd,	0x1783d9a3,	0x13057cb3,	0xfddada8b,
-0xa62b7622,	0xe4e983cd,	0x19fc1b13,	0x4670b4f5,
-0x88d9fde2,	0xe4d47232,	0x428282e1,	0x3b1eba3a,
-0x0dda9ac3,	0x976935e9,	0x17e6f394,	0x75d1e6c6,
-0x52e7ba8d,	0x6d17dc05,	0xdcf08d2e,	0xbfdd8aab,
-0x682724e5,	0xa40adacb,	0xc2250bde,	0xdf86c17f,
-0xec3f3b6c,	0x50b17482,	0x7e05a0bf,	0x113727c8,
-0xdb87ed9b,	0xe8b758bb,	0xe5a2129f,	0xec0b1711,
-0x134538ac,	0x52f40b43,	0x35fee2ed,	0x03cfac0f,
-0x74241fd6,	0x4b51a1e2,	0x31174d18,	0x35419363,
-0xe0f97a27,	0xab90db73,	0x115fafc8,	0x609e07a0,
-0xe261e748,	0xabd7c91e,	0x738e7142,	0x8518ad47,
-0x00b9b691,	0x1076eb06,	0x738cb977,	0x4fccb90b,
-0x7c2aa1b1,	0x3970280d,	0x142f7d0e,	0xf3e38308,
-0x0bbd9cf8,	0x5aefa105,	0xc2921c37,	0x631affa2,
-0xc20931d8,	0x19f17804,	0xb7e67dbc,	0x9027e886,
-0x3f2948ce,	0xc5702b47,	0xe376984b,	0x6e63130b,
-0x8a6f5871,	0x6ca5e5ab,	0x6d8ebe20,	0x060b445d,
-0x54236d34,	0x4c142f6b,	0x0cf5eb25,	0x5eda0772,
-0x67d245be,	0x5e8737f8,	0xffc42eb6,	0xd7bbfdde,
-0x48e5bac9,	0x6711bd95,	0xe128c9eb,	0xe7815f6a,
-0xf88674b6,	0x2761ed9c,	0x02c42951,	0xbb83c0e5,
-0x8e0fabc9,	0x77e53f25,	0x52cebe8b,	0x39cfb402,
-0x08482f83,	0x17d91e60,	0x9a824632,	0x0ec0afe6,
-0xea7463d3,	0x4c346028,	0xa79561c1,	0xe69d90dd,
-0x6bee4ba8,	0x2d6b4e9c,	0xa4a72d31,	0xdbf037fd,
-0xe23e2140,	0x4bf6650a,	0x1d197b40,	0xe16bbc9d,
-0x95489286,	0x5ccfec21,	0xbcd6ed2a,	0x8b51751b,
-0x99a34459,	0xc1ba3625,	0x5c6a434b,	0x9d3bdc7d,
-0xc0eb1470,	0x2cfa5d3d,	0x7a64b7e7,	0x679d7876,
-0x04cfbdad,	0xa5a7dee0,	0x9aef436e,	0xc7f35e2b,
-0xfa2a022a,	0xdacfd63c,	0x17c6eee9,	0xde2b8669,
-0x7e3172f8,	0x029b3981,	0xcfe3ff3b,	0x74221b32,
-0xae9928f2,	0xfc99f0da,	0x4b112ec3,	0x21f38a76,
-0x8731e59f,	0xa8eca24c,	0xaba78f87,	0x74d2dc54,
-0xa0e630d8,	0x73f47462,	0x6e7cb59b,	0x125e9a64,
-0x4d2a40fd,	0x3c2875ce,	0x8f1b7f6b,	0x014ab0b4,
-0xe50f73f7,	0x2be41240,	0x06a9d2c0,	0x9f39cff1,
-0x1a0d69d2,	0x4d0c5cc7,	0x69e9b767,	0x8a6b4e13,
-0x72922286,	0x65e5884e,	0x8318861f,	0xe9307a16,
-0x70fb8bd1,	0x0a645be4,	0x399806c2,	0xb413e41f,
-0xa27d9640,	0x65c43792,	0x2007a334,	0x8f087dd8,
-0x88ca6ebf,	0xf75aba41,	0xba68cfe8,	0x628d6353,
-0x1d4f3bf8,	0x46a5ebf1,	0x4345fa25,	0x59a0bc69,
-0xa2a19acf,	0x0e8d709f,	0x76298f1b,	0xee299f73,
-0xf49bf3fc,	0xd51c6717,	0xcb3fdf2f,	0x5110cf90,
-0x1a3202bc,	0x5f86ed89,	0xa6bf1bf8,	0x92eacfd5,
-0x9f4b7524,	0xb1c273cd,	0x52234f50,	0x15aeea4f,
-0xc3c17fd6,	0x321f62d1,	0xb953b64f,	0x9168aac4,
-0xc73cc63b,	0xaf5d74bc,	0xa8a11fe6,	0xc3de7a37,
-0x52b2a1bd,	0xef5e711a,	0xd093d7d5,	0x0a0866d2,
-0x1fc1a218,	0x92eb9f67,	0x1c3190d1,	0x648b25fc,
-0xe7ffa26a,	0x5678af8d,	0xba63def0,	0x6c8aea2c,
-0x1e0860ef,	0x2d0cb10c,	0x5617d52a,	0x19536ae2,
-0xa23efb12,	0x611eef26,	0x48a73e13,	0xe1ef7cd8,
-0x0d6436b1,	0x25efe9a2,	0x595ecc0c,	0x0d07efc0,
-0x414c9df3,	0x62fe0fa2,	0x1dafd029,	0x66cf2940,
-0xe3975f19,	0xb2c62aaa,	0xb45db313,	0x23dc0a9b,
-0x08edfabb,	0xcfbd6e5a,	0x68c9a9c2,	0x1eea36c6,
-0x5761f066,	0xc6dd6e62,	0x98cb5b90,	0x5a41d283,
-0xf510e920,	0x541a9ea3,	0x8fcac32b,	0xabd90d7b,
-0x5481655e,	0xbd13133d,	0xfb4cc24c,	0xa0a99cc4,
-0x04efbd1a,	0xaeb552ea,	0x75328c80,	0xdc081e71,
-0xcfa214dc,	0xc0a238fd,	0x642640d9,	0x0f083250,
-0xcbab6584,	0xde3a91e5,	0xfb879e07,	0xa00d52ee,
-0x73c03e40,	0xbf93bf6d,	0x327ab31e,	0xfea1630d,
-0x23e0f0c7,	0x94924b1c,	0xeecd2e08,	0x9dd16fbd,
-0xdae1e521,	0x586043ac,	0xa01549e8,	0x9e122423,
-0x47f3fd62,	0x71c97a95,	0xe43e4a17,	0xa43ac11a,
-0xd4d9f454,	0xa820388e,	0x2b16b6da,	0x709ac630,
-0xf70ea530,	0x48d466aa,	0x39bb38ee,	0x31cda5ba,
-0x8342db6e,	0x40740780,	0xb2e17c11,	0x132d1a01,
-0x97901286,	0x3d43e1de,	0x04605139,	0xcc7b8731,
-0x5ef56e11,	0xd34194a4,	0xaabb6829,	0x46977a26,
-0x86d9748a,	0xfe6b4014,	0xefca5796,	0x954a2586,
-0xe0f317c2,	0x18c3a130,	0x89bcfacb,	0x77fb4dcb,
-0xd6372f7e,	0x0ecde9b3,	0xea47d59b,	0x4759c2f1,
-0x30929b1c,	0x5dc4319e,	0x637a2206,	0x25a1f1b7,
-0x26b95f8a,	0x2692e94d,	0xb54dd7b8,	0x5e9ec946,
-0xd8ed8dc2,	0x5d8b52fa,	0x320ee3f0,	0x09deb80d,
-0x1fe2e77d,	0x4d93f4dd,	0x2265c462,	0x8cdbe3c9,
-0x4b1c41c6,	0xfeebbe24,	0xd9acb970,	0x4e14e1c4,
-0xeb0da317,	0x789f0ba7,	0x86a154ca,	0x862151af,
-0xe508512f,	0x5196ce0d,	0xad959006,	0x29f97fb9,
-0x2a39f335,	0x06fc939f,	0x05fd2755,	0x500f3748,
-0xcf1fc25e,	0x7abcbd2a,	0xc42181f4,	0xb4779d5e,
-0x995b0ba4,	0x7579792b,	0x13d4a1ad,	0xf8ff2015,
-0x0a2bdbac,	0x934b340e,	0x03e02ef1,	0x19290229,
-0x47fab766,	0xaa7257cd,	0xcc7063b0,	0xc11902c3,
-0x201333bb,	0x573c2f93,	0x60c1c68b,	0x1ae38fc8,
-0x585aeba3,	0x558d45c5,	0xde0c9d47,	0x7529b837,
-0xafc0a08a,	0x8d01dbc8,	0x4bc297fd,	0xc41415e0,
-0xd3047b5a,	0x8b1cf332,	0x51f3a3ce,	0x48cf1952,
-0x00771b16,	0x8dd45645,	0xaab7c228,	0x5bd8048a,
-0x9e2fa34b,	0xa36dacbe,	0xb7e33750,	0xd0a3ece9,
-0xc635e2a7,	0xb9c5d9b3,	0xfaf4095c,	0x524f39e2,
-0x0a617851,	0xaab1226c,	0x7ab1887b,	0x8dbedd52,
-0xec941fc6,	0x35a9ecc9,	0x354c0f8e,	0x61630d83,
-0x58da1b53,	0x3de4bc5f,	0x267eaba7,	0x3a009f25,
-0xba75a77c,	0xdbe3c946,	0xb082bed8,	0xe6642afd,
-0xf8085316,	0xf75a954d,	0xcc024795,	0xd83340f4,
-0xdb2afc3f,	0x24d7e9b2,	0x3518c25f,	0x622fbe69,
-0xa4db98d3,	0x1a1fae72,	0x4d6d22a1,	0x33dbe86f,
-0xf989a2fd,	0xeeb5c906,	0x9477db3a,	0x6ecaee34,
-0x053498bd,	0x73f14e38,	0xf76125ad,	0xb40de437,
-0x6b1e1da1,	0x6c877763,	0xc0b081af,	0x51b21d7f,
-0x3aa99b73,	0xdbf533d6,	0x8ae2f2dd,	0xbf83a341,
-0x2252ec55,	0x385e0a83,	0x5673e233,	0x83ff4671,
-0xe6347c52,	0x8b5494b0,	0x506bae4a,	0xdd5d1b54,
-0xc7211bf3,	0xad4c375b,	0x09fc722e,	0x836a125d,
-0xf1ce6cd1,	0x4e004732,	0x45f7e7e8,	0x189cc88e,
-0x53f11de9,	0xb014ac8f,	0xf244c0da,	0xa9b4d92e,
-0xcccbc4bb,	0x9ed8b7e2,	0xa58419a7,	0x8019e89f,
-0xb7e4efca,	0x3e233701,	0xc2023412,	0xbda94692,
-0x6f8c9da3,	0xdfb51303,	0x5586792d,	0xc19c58f6,
-0x93b66c90,	0x79c5ccfe,	0x297cfa67,	0xa50f6b8c,
-0x98a24f04,	0xdcfe16f9,	0x0e0042dc,	0x4174ac2b,
-0x4df88e79,	0x1abd907a,	0xca211f21,	0x0e473dbc,
-0x6e10908d,	0x36234bff,	0x95c845bc,	0xbafb34f9,
-0x41d54e2f,	0x4a261f72,	0x09b6e48b,	0x8a499516,
-0x1c6b6f2b,	0xddf7e08e,	0x920bedae,	0xdd7c0f33,
-0x570bcfe2,	0x1dbed4d3,	0x3887d3e4,	0xd877f68f,
-0xb5568e1f,	0xe4b01f29,	0x25539b7f,	0xf81cc5e3,
-0x2f05ce77,	0x43699f38,	0x352c2a57,	0xe0278f93,
-0x6140a9b9,	0xdda9d389,	0x91910552,	0x9b41909f,
-0x32b40b7c,	0x22399fb4,	0xfcbb1abb,	0x625b0174,
-0x30fb7fa7,	0x3389069e,	0x9a80e897,	0x3eb2c91c,
-0xc6e43be6,	0xb128a976,	0xbb8eba63,	0x7ffd7409,
-0x1d2124dd,	0x57ae9f67,	0x89091f51,	0xd8fc44b4,
-0x0889725e,	0xcce3f234,	0xc14d2983,	0x2aa24003,
-0x2a140a28,	0xca15e70c,	0x2bb1c504,	0x9011e8c8,
-0x1e2982cc,	0x63c87acc,	0x07fda6a7,	0x9b2c5655,
-0x90608d02,	0xa137f077,	0x73614efd,	0x5be6be23,
-0x582c5f4b,	0x3cdc8fde,	0xac235e80,	0x6eb67f6a,
-0x746baa4a,	0x7d318049,	0x918ae8b6,	0x9ea176eb,
-0xac37f0a3,	0x7289996c,	0xb84c86ed,	0xa7b8b637,
-0x08f9cb99,	0xa1cd352d,	0x8e196fdd,	0x52f8c399,
-0xee5bd1ad,	0x98096e4c,	0xa4515066,	0x2ce6fa29,
-0xb003db8f,	0xa2414cc6,	0x78343d47,	0xbb85d269,
-0xf2c86218,	0x16e05eee,	0xc0e55954,	0xd76030c2,
-0xddc72cb5,	0xbe700586,	0x2a4631c8,	0xc07ad787,
-0x86f0aef7,	0xf93e185e,	0x88e016e0,	0x2ea4c7b2,
-0x179e5569,	0xd47588cc,	0x5b0866e6,	0x6683d356,
-0xa454cea9,	0xcc02e868,	0x37f2a467,	0x40fde385,
-0x447e9902,	0x33bea872,	0xd70f95d0,	0x3972589f,
-0x9213edc4,	0x82a76612,	0x19413c75,	0x68d4f11d,
-0x05ff5eb2,	0xfbb940f8,	0x3a26d663,	0x5313ce18,
-0x0cf98331,	0x3d0724aa,	0x85af2d4c,	0xb998374f,
-0xb362a0da,	0x74d13212,	0x7e4d45c8,	0x7911a9ad,
-0x3adf3a73,	0x84aca215,	0x6f2a24ab,	0x9708d602,
-0x2186daee,	0x70c93f07,	0x0e74ba5a,	0x0f79ef3b,
-0xc07392ef,	0x370ec49c,	0xd1c6da49,	0x8db82e27,
-0x9ce7b81f,	0x93bd76d0,	0x3b3e72e5,	0x4edc654d,
-0x1777418c,	0xc683c115,	0xd5d37eab,	0x1cd90d99,
-0x8c57b41f,	0x5aab35f3,	0x6d545e65,	0xd4e185a6,
-0xc38b76f3,	0x5362090e,	0xf345b910,	0xc4fa539a,
-0xdf84f239,	0x81e6fef6,	0x01cbbb8b,	0x1f98ab87,
-0x262a555c,	0x81350387,	0xc3ee3650,	0xfe5bf8e7,
-0x5387759e,	0x8eef23f1,	0x14b93a7b,	0x77a39ea6,
-0x577b0141,	0x8d1503ee,	0xd8233384,	0x04bcfca1,
-0x73b4395c,	0x0d89975e,	0x346554db,	0xc05d1216,
-0x0ce4ab8d,	0x02be6474,	0xc2a37fa7,	0xc432fa35,
-0x80c4eea7,	0xa5de577d,	0x3aa62c31,	0x5c6af29c,
-0xd1e4396c,	0xf05616e1,	0x61a5a835,	0x981a5670,
-0x02cc70ec,	0x589a11bf,	0x2322abef,	0x6d4b3a28,
-0x1235d2c1,	0x970ecba1,	0x2cf9a4f1,	0xe05e02d4,
-0x6d73176a,	0x91f1b5c5,	0x530f2ea8,	0x7bc355c3,
-0x4a32c97c,	0xd8a360a7,	0x0494f0a4,	0xb848e796,
-0x7712a6f9,	0x975917cc,	0x2830f7b5,	0x6b7fcf55,
-0x70cf032b,	0x54b697ca,	0x709aa0b1,	0x82bc0190,
-0x221abed0,	0xc737b95f,	0x25f96bf0,	0x04e00c6e,
-0x5fb3d0e6,	0xfc0032f3,	0x47a19113,	0xe4842062,
-0xf8a72b5b,	0x7ce20960,	0x234005fe,	0xf284298b,
-0x33e002fd,	0xd9c5b363,	0xa66fcf42,	0x65a37469,
-0x09696c31,	0x18ddb8ec,	0x0f075890,	0x852772d9,
-0xc1ea3d00,	0x407565ca,	0x996ae302,	0x9d213a3e,
-0x15444477,	0xe40731ec,	0xa59d6d18,	0xa31bb351,
-0x1ad6a1b8,	0x2004f299,	0x753742dd,	0x7372e33e,
-0x6b294af0,	0x423534e8,	0x613c7af9,	0xd269ccf8,
-0x7a0e77f8,	0x4a5eb9dd,	0x0fdfdf8d,	0x3ab0a078,
-0x3aa3eae7,	0x4b757b52,	0x17556503,	0xbd955aad,
-0x04e445b2,	0x0038b108,	0x6d838228,	0xcd1d17a9,
-0x8d78679e,	0x0b09cb2a,	0xac4dd75b,	0xfeb39610,
-0xc6e37be9,	0xf609647e,	0xfcd96878,	0x595ce2a3,
-0x74672113,	0x5b322d40,	0xbe20b3f7,	0x4255e891,
-0xe2a471b4,	0xddd07ef4,	0xdfad4fd5,	0xf3c0d6d6,
-0x939ee2b7,	0xa74bc8a6,	0x237e40ec,	0x45e6429d,
-0x397bc731,	0xd1f63359,	0x92c76b6c,	0x4f6112f0,
-0xf2e3bfa9,	0xa449c13a,	0x1b7cf9f3,	0x30294cc5,
-0x3af1840a,	0x436bcaa4,	0x817caf6c,	0x9e68df61,
-0xadcf5eec,	0x3c63ebb8,	0x66f0cd34,	0x6e886e94,
-0xbe5593c6,	0xf21f8cd0,	0x86e5e6cb,	0xa3417e69,
-0x09179628,	0x3d476fe7,	0xe2ed9b67,	0x55218979,
-0x68342ef2,	0x06e0ddab,	0x4d871654,	0x7c168efd,
-0x80ccdd97,	0xe1739478,	0xb2c2dcb2,	0x9b974b23,
-0x65b16064,	0x06fdbf82,	0xc0dc57ad,	0xe4291150,
-0xe2f9b6b1,	0xe6ef2a27,	0x0affe770,	0x3cb97901,
-0xd9de038f,	0x5773ee10,	0xc7933848,	0x95110990,
-0xd276b467,	0x58ba3959,	0x3beb0190,	0xca1a8999,
-0xfb2b7362,	0x2f9fb1c2,	0x5e64606d,	0xc90bfc22,
-0x11bff3d5,	0x62ba296b,	0x18a85760,	0x9e91e187,
-0xb08e8384,	0x84e05e6e,	0xbd7a053d,	0x03dcb1f5,
-0xee3e835f,	0x08682331,	0x25713eba,	0x117598e0,
-0x84017c6b,	0x2fceca7d,	0xdb4910db,	0x8c56f19c,
-0x2eb47787,	0x2c272d3d,	0x1e22cfc4,	0xd8039ded,
-0x6a716406,	0x1f2d2e58,	0x73e952a9,	0x9f143020,
-0xfd5aa09c,	0xb847b863,	0x5c6a96ce,	0x74d2408a,
-0xd1adcd3a,	0x04743f2b,	0x3338049d,	0x5dca4eb5,
-0xb17c75c0,	0x04572f3d,	0x01092ab2,	0xf0e109a0,
-0x9ec2ee0c,	0x87633773,	0x62b265e3,	0x3fecd536,
-0xf8a1c1a5,	0x3a829ab4,	0x3f3b6e24,	0x10e012a5,
-0xcaed2a6e,	0x0dd09f2c,	0x2fe46e0f,	0xf7aa1f52,
-0x6b1fcb03,	0x194c5f41,	0x4f7af49b,	0x29fc1834,
-0x5e9264b6,	0xc681dc8f,	0xc4eebc41,	0xbb7a8c59,
-0x1a8e5663,	0x468eb0a1,	0xc2668a43,	0x70c727a8,
-0x75d77c09,	0xad512995,	0x20c8389d,	0xe88c856d,
-0x1854aee8,	0x19a322f0,	0x72c3e46f,	0xa4d3a350,
-0x7e770143,	0x0a7b6b4d,	0x56da15c7,	0xe8a1b24b,
-0x34ad72cb,	0xc714ba95,	0x7f26adbf,	0x2b816fa0,
-0x4f44c3f6,	0x3c36f9b2,	0xe858ec74,	0x6211f907,
-0x5ceb4ece,	0x91a09eee,	0x53614a7a,	0x19ab3615,
-0x8511ae38,	0xeed314fb,	0xf618f4b4,	0x530d125d,
-0x0e610ecd,	0x388e0b06,	0xef038ce6,	0xdf413d65,
-0x2d1702fc,	0x472e173d,	0x9c4469aa,	0x49e9e3ed,
-0x59039c67,	0x074b0e60,	0x93277121,	0x1fa8da95,
-0xaed27f11,	0x34335728,	0xcb9ee889,	0x19c59763,
-0x4e23eac8,	0xc2422812,	0x808dff75,	0x9afd8f19,
-0xfc37ed83,	0x6283bf6e,	0x19c2ec7f,	0x1ca3a1b5,
-0xfca6cd26,	0xcd1b3aef,	0x2421e54f,	0x66f6e7a7,
-0xde65ac52,	0x36fed3e9,	0x11b4c62d,	0xd1f2df58,
-0xea8c8ca1,	0xf30644d8,	0x5578cdc1,	0x0c7ff948,
-0x3c13ce37,	0xaa67ecc9,	0x117d09d4,	0xbdec7fbd,
-0x0ea632d8,	0xa47550d1,	0xe5864aaf,	0xca38606e,
-0x214184d5,	0x4e3edc08,	0x7ba82d34,	0xa523b4d7,
-0x4eeeedbf,	0x28f34f12,	0x1cb908aa,	0x8f4eb512,
-0x64dbb127,	0x863f17fb,	0x77a498d4,	0x4939ed2a,
-0xb670d49f,	0x162639e0,	0x5a6b3c5d,	0x6f9f3f05,
-0xe34f170e,	0x3b99b90a,	0xfe921edd,	0x30c4f749,
-0x26e5ef05,	0x759acaec,	0x1c854733,	0x14181551,
-0xd34d2498,	0xbde9a644,	0xd0feaabd,	0x2962a027,
-0x243a6bdc,	0xad16fef9,	0xd669e6b3,	0x8456fccc,
-0xc7a2fd9a,	0x3338f5ea,	0x79a492b7,	0x42486d39,
-0x9759f8de,	0x143915b9,	0x085b7978,	0x78b5633f,
-0x629a4ae1,	0x3ca739a2,	0x19c716ee,	0xad821ccc,
-0x36d70a54,	0x1bead519,	0x8cef2e80,	0xde9ae54f,
-0x1bc68e6a,	0x80f842b3,	0xefa3e944,	0x4420c686,
-0x6dfa3cb0,	0x613c63fe,	0x7c92e7c3,	0xecd3790b,
-0x7e9fb016,	0xb730cd81,	0x5c182417,	0x4c281fb0,
-0xf239bc43,	0x14c95eff,	0x182a357b,	0x2e16c61a,
-0x34064f9b,	0x8adf21f4,	0x38cf7ebc,	0x2be77af4,
-0x3838ceec,	0xef72fabc,	0x872acb4a,	0x355345fc,
-0x6828f170,	0x030e5880,	0xd9ce9388,	0x7887b69d,
-0x3570e157,	0x8c9d7610,	0x2b620707,	0x76893209,
-0x8b5f31fc,	0xc416df56,	0xeaabdc42,	0xcef4d6aa,
-0x5a24bbab,	0x70f89081,	0x89839cbb,	0x87d94a22,
-0x01098b5c,	0x910955bf,	0xf75ed5f9,	0x5b384307,
-0x486b50a4,	0xdc57b82b,	0xd97180b6,	0xd8302d17,
-0xd09e9743,	0xce3fdb16,	0xa19a8cbc,	0xed5de4b1,
-0x0bfb295a,	0xc1497632,	0x9b4e68ab,	0x17788368,
-0x0932ed86,	0x1c4c9b98,	0x404d5718,	0xd30c5d91,
-0xc29318d3,	0x01e38be1,	0x1e6c36f3,	0x972264ae,
-0x3b6e6579,	0xab439cb3,	0x13fc7072,	0x0a6c6259,
-0x290cd185,	0xb918c43b,	0xceddde1d,	0x8bb7f761,
-0xbed75235,	0x3f65fadb,	0xb7a1664a,	0x45538b20,
-0x5b42ea03,	0x24ed4153,	0xa9b53360,	0x5683f9d8,
-0x50adb3f8,	0xcd968773,	0x685b1b76,	0x27fd37df,
-0x6d1060cc,	0x957bbd76,	0xa56dca4d,	0x1d03ca44,
-0x06f3f5ac,	0x29c86570,	0x45b97619,	0x76678831,
-0xa7351089,	0xfd930b11,	0x178a7b5b,	0x5c020765,
-0x7b08e49b,	0x8544314d,	0x6f3a876a,	0x95b8e384,
-0x129a9694,	0x24528f7d,	0xf98f78dd,	0x35c22e3e,
-0x19185e86,	0x644076eb,	0xb6ac0b60,	0x132eb040,
-0xe616b6ab,	0x780bfb69,	0xf5b59888,	0xe3449f98,
-0x44f7ea9c,	0xcb2b9646,	0xcb745c49,	0xb8a8f7a5,
-0xc6933531,	0x15c25e1d,	0x6c156174,	0xffb7191e,
-0xfb82bcad,	0xf12abf5b,	0xdb7fcff1,	0x89c1edd7,
-0x7819218c,	0x321fa895,	0x50d6ab08,	0x07099a20,
-0x8ef3c05a,	0xc0b37b12,	0xe4a7d71f,	0x0becdac6,
-0x14f6856b,	0xca44a4f3,	0x03a4d53b,	0x28332123,
-0xfe3d66d9,	0x0f2f325d,	0xf0352398,	0xece1acfb,
-0xb2889ca2,	0xb6c9d0b2,	0xa25224cc,	0x13f71aad,
-0xbb26b8dd,	0xab78f2fb,	0x5b406304,	0x8f8e0802,
-0x4c70ac4c,	0xad684f75,	0x311758be,	0x6b010266,
-0x89f6e69e,	0x10dd266d,	0x2b85bbd9,	0xdaf1e1e6,
-0x087213b4,	0xc6da2394,	0xc35983d3,	0xf4a7a538,
-0x7e88eed9,	0x88351509,	0x4a481807,	0xeecd5537,
-0xd64435b8,	0xb4c42704,	0x3a4b8f2b,	0x8b784114,
-0x65675942,	0xac785ca7,	0xb29ae86d,	0x31d6cf5b,
-0x00c32bc2,	0xa3aaa694,	0x92cc776d,	0xabcce86b,
-0xac09f48d,	0xfbe9f2e9,	0xbc5bd96f,	0xc1ff3a57,
-0x08d37d5b,	0x3167058b,	0x60a00a2e,	0xb262305f,
-0x7850494c,	0xa4fb3ecf,	0xdac39624,	0xeec5fa15,
-0x103078e9,	0x2b0b5e48,	0xe7ac5af4,	0x409a9fc6,
-0x860d00b6,	0x71977bed,	0xcbf5474e,	0x6e60281d,
-0x9b688a52,	0x2e0ed739,	0x72413498,	0x8f4d0fd0,
-0xd9a25c27,	0xe624d9f4,	0xacc190d7,	0xdf6c1355,
-0x7da3b4bd,	0x15f59e44,	0xd40fab70,	0x795e4d9f,
-0xcd946bb7,	0x30615009,	0xdbccecb8,	0xf92ce0d9,
-0x4ba70e49,	0x8f9360fa,	0xa494ea1b,	0x43aee5ab,
-0x3c3982f3,	0x70eb432b,	0xf9f8fed9,	0xc77c9de4,
-0xd09a1aaa,	0x84cc61fc,	0xfaa94f98,	0x8d65ef96,
-0x4b40d7dc,	0x6fff5d99,	0xa004e55a,	0x57e3fdfa,
-0x9d369dde,	0xd9b7217e,	0xb995da81,	0xe20d4da2,
-0x5002edb4,	0x46504aba,	0xf85c6b00,	0x07f441e0,
-0x0a6ccf51,	0x0c6776d3,	0x94d916e4,	0x437ae95e,
-0xa1be88ab,	0x26ee808d,	0xb225ecc2,	0x7203004c,
-0x7483ce57,	0x843a63fd,	0xdfb47fca,	0x4891c6a5,
-0xbed32b73,	0xb74a7f99,	0x02710380,	0x3535c967,
-0xb3a97919,	0x9dc02c41,	0x7d56855d,	0xadd905d6,
-0x69e85fb5,	0xa2423262,	0xa8b342da,	0x15d9de06,
-0x16f106d6,	0xc03c76bc,	0x86c6a8ad,	0x74e42e59,
-0xa4074a6e,	0x53495564,	0x2b5a9e2c,	0x332073ad,
-0x66ce0694,	0x09ad8605,	0x7b815e25,	0xef8e5a5e,
-0xa8b24d30,	0x06a3108f,	0xc1af44ad,	0x4f203e5a,
-0xb3fda333,	0x5e78cdc3,	0x11c9a799,	0x540a1cec,
-0x50e6b53f,	0x9bad2b4b,	0x9fdc05b7,	0x66313909,
-0xf7e64ddd,	0xe99a6f59,	0xfbaa96fa,	0xb6cb3b29,
-0x8215b9a0,	0xd64583fa,	0x9a298e28,	0x1299e60a,
-0xcb6b2fe5,	0x5a79668a,	0x35b12ab7,	0x873a91ea,
-0x8e1248fd,	0xfc3eb405,	0x54700ff7,	0x7993800b,
-/*  2967-m03106a5_00000011.inc  */
-0x00000001,	0x00000011,	0x04142009,	0x000106a5,
-0xc2d891c3,	0x00000001,	0x00000003,	0x00001fd0,
-0x00002000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000011,
-0x00000000,	0x00000000,	0x20090414,	0x000007d1,
-0x00000001,	0x000106a5,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x6bc10bea,	0x686acd6b,	0xc80c6d31,	0xcaf132a2,
-0x25d69530,	0x7d6d7e4c,	0xf47a6ac2,	0x2a0af140,
-0xbab165d1,	0xfeb576d4,	0xc1edb5b2,	0xa44174b8,
-0x0d1ad45a,	0x4fe5fe0f,	0x62feaf24,	0xafe7de28,
-0x8b076222,	0x881b4891,	0x8daf9241,	0x98e8cf9e,
-0x417b7869,	0xd7e266b6,	0xf07fa211,	0xd01aa170,
-0xbd0ff37d,	0x883aefa5,	0x4313c7ef,	0x97e92355,
-0x84df4fa1,	0x251a1422,	0xbffca04b,	0x80d1e0a9,
-0x2de71585,	0x74f3cc3a,	0x06355b58,	0x404b01a9,
-0x76867925,	0xd35afcf0,	0x2e220cdb,	0xb0c03e11,
-0xff163ac7,	0x796b6c3b,	0x413f51d1,	0xfb5f33e6,
-0x0d3408e5,	0x29f2fd21,	0xe5937245,	0x43a62312,
-0x22bb80da,	0x517fd4cc,	0xd3b29526,	0xace3ace8,
-0x22e26346,	0xf6fa7e9a,	0xe956d161,	0x72d9e32e,
-0x87d1c6a2,	0xe2b89eff,	0xc94b7fba,	0xe61e89b4,
-0xf2a0adaa,	0xac5edf25,	0xef730b2f,	0x64519e05,
-0x59824baa,	0xeb00b868,	0xbf1e0a65,	0x95cebd35,
-0x144fca7c,	0x6ac6e730,	0x1d86878e,	0x955b87bd,
-0x00000011,	0x8a8170de,	0xd10d06ce,	0xc8c5be0f,
-0x90dd9f93,	0x33f21057,	0x49a2cb43,	0x38978e30,
-0x3e44dc99,	0xee4c00cb,	0x9b43977a,	0x55ad844c,
-0x2acb7c34,	0x4df289b5,	0xd1ee8b68,	0xad81a7cf,
-0x68890206,	0x3c0b3589,	0x4323cd0f,	0x7955ed62,
-0x8c00153b,	0x0cee1be6,	0x16c043a9,	0x6c246ddc,
-0x9ef69c06,	0x5244967e,	0xbca580c0,	0x0a9e79a8,
-0x0f45c155,	0xdbe8002d,	0x9ddc7a7f,	0xf9d7a300,
-0x0f06272f,	0xeed04a38,	0xaa2d0fd7,	0x8c876464,
-0xa4ff9f0a,	0x6076c9ea,	0x12ed412b,	0x13d4764c,
-0x22c475c3,	0x94624946,	0xe89cb40f,	0x0675f8e8,
-0x63925a71,	0x285f56f6,	0x0e0c866f,	0x10bb7c62,
-0x75ce1168,	0x5ce8d5ab,	0xabaad871,	0x4bc0fa65,
-0xadafd47b,	0x12443c0d,	0x30ee4e24,	0x2a6f37cb,
-0x27a160ab,	0x314fef8f,	0x643d1d8e,	0x3d2cca91,
-0x6f7665fd,	0xfe98926e,	0xbcb3320e,	0x69bfa9df,
-0x1037ba06,	0xeaca3762,	0x2085669c,	0x6f42a9d3,
-0x04485d9c,	0x01fd4918,	0x18a37b78,	0xeb6454df,
-0x22311b8a,	0x397b6aa2,	0xbccd4e00,	0x12c303dd,
-0x54a54c9e,	0x0e57721d,	0x799c4a7b,	0x21b9e5b7,
-0xd807d3d0,	0x422f275c,	0x047434a2,	0xc1eafe8c,
-0xf80462b7,	0xe6cc9a0e,	0x08d6022b,	0xd63cd746,
-0xcf942daf,	0xa8007a0b,	0x570f86df,	0xcfab5360,
-0x9ccd67d7,	0xc8e5e7f5,	0x05db1dd2,	0xb744c8cb,
-0x75e47f9c,	0x7be9010d,	0xeeb042ca,	0xe78d3f6d,
-0xbb80bd7a,	0xa104a2a6,	0xa0659f06,	0x33c10de0,
-0xfacde597,	0x713e29af,	0x6a5da65c,	0x300223fc,
-0x08377053,	0xf7850f61,	0x821c7b96,	0x497adc28,
-0xb0fcb15d,	0x8f2a664b,	0xd9e02595,	0x07d72584,
-0xf971dbb8,	0xe77a9b49,	0x12d39696,	0x7facbd65,
-0x4c69e1c8,	0xe5a2e138,	0x3ee12b1c,	0x11faf846,
-0xf047fdc6,	0x5174ec3b,	0x27539917,	0x75a18a77,
-0xe373dd79,	0x4d027a22,	0x79cabc1e,	0x5da13b15,
-0x733c1aea,	0xdc9339cf,	0x77954f6f,	0x317e0fdb,
-0x3d487c05,	0x772d3072,	0x3c416d33,	0xffc83a26,
-0xd21d625c,	0x35a341ad,	0xd545cf16,	0xc4933882,
-0x2bbf013c,	0xe4a32d3c,	0x5ad6b995,	0x194d8145,
-0xd80ac4a3,	0xccb99758,	0x3828ff1e,	0x5a613893,
-0x997d0199,	0xfbef864b,	0x3cffeea5,	0x2d0fad2b,
-0xbf95098c,	0xb638f1bf,	0x77301c26,	0x28a6829f,
-0x93f225ae,	0xd1436889,	0xf643195a,	0x7a44c5cb,
-0xc113bedb,	0x85b7b246,	0x2094bbea,	0xbb72cac7,
-0x869b103f,	0x29a85e3f,	0x513b6d51,	0x8c4d5fc9,
-0x6deeef8c,	0x3e8c9f71,	0xd455da6f,	0x73fb6783,
-0x73dda9b0,	0x686b81af,	0x0ceb3bc1,	0xab0fc52c,
-0x3d9cd3de,	0x38cd05c4,	0x257a9bbd,	0x8c682333,
-0x30d4e4de,	0xe43bb560,	0xcbbc7d6c,	0x2da3ecbb,
-0x6af5ae77,	0xd65e86fa,	0xf8cb6bf1,	0x46dbd901,
-0x3e04eedd,	0x522eafa9,	0x005acb72,	0x75f7adfe,
-0x18d73690,	0xd7a345de,	0x6d08c19e,	0x730043ad,
-0x43c07c0c,	0x6a029de4,	0xc6014e7e,	0x8531206d,
-0x9d4445e6,	0xf176523d,	0xacbef340,	0x1f7efeb2,
-0x9c2586a0,	0x343f3655,	0x366fdf00,	0x965612d1,
-0x12ac8030,	0xefa47a83,	0x8238463d,	0x75bce199,
-0x7905a945,	0xff7db90d,	0xa6829c03,	0x787680bb,
-0x5f7d48ac,	0x802a2e6d,	0x1fb3fa50,	0x8a32ced3,
-0xaa9ba886,	0xe4944495,	0x362b82d8,	0xe1e24b85,
-0x1e0ce3f1,	0x45a639af,	0x23b3b20b,	0xec6eb1d9,
-0xbcdfa403,	0x404c7eb0,	0xd5db0e5e,	0x94982c87,
-0xc7d46b91,	0x7d59f946,	0x475fa1f0,	0x61b33c3c,
-0x1260c066,	0xbe0ff392,	0x62af5364,	0x9ec54670,
-0x64301adf,	0x8f4e36e3,	0x6bde11cc,	0x24da8736,
-0x456e7f69,	0xf12b7fd8,	0xf97bee3d,	0xeeceaaa5,
-0x180e5386,	0x9bdd9bd3,	0x25d85bb3,	0x70c8fb56,
-0xeb5edb54,	0xb665841f,	0x17b06b72,	0xc98c14ed,
-0x691eeb46,	0xc8be93b2,	0xa7f78b00,	0xf35cfdaf,
-0xe47ad2f5,	0x11a98085,	0x93366e6a,	0xfcf3f38f,
-0x92dc5b21,	0x0ff0c5e8,	0x3031a65c,	0x1487430e,
-0x21c87cad,	0x3f64162e,	0x3105e461,	0x39eda0a4,
-0x8617ecb6,	0xe4c18423,	0x8a7c8202,	0xc7713cb6,
-0x7b226148,	0xa5f40dd9,	0xdef14be6,	0x2054ad6e,
-0x5d4e3573,	0x3051a2db,	0x8ea4b412,	0x13e5f361,
-0x933bec35,	0x636b448f,	0x01913981,	0xa7fecad8,
-0x99346761,	0x29ce840c,	0xf603fa48,	0x6e32edf7,
-0x177ebef4,	0xacf914c9,	0xcce81e3f,	0x6dd19cfc,
-0x4252ca88,	0xa6a9d279,	0x88bcb402,	0x0a2b47ea,
-0x8fa3de99,	0x9d072c8c,	0x55040f1b,	0xe14d90fe,
-0xd4b073ff,	0x6d57e946,	0x3acccdf5,	0xb43f7b8e,
-0xe8c912a0,	0x86e80218,	0xe64859a7,	0x09e623ee,
-0xa400e93a,	0xe56ae585,	0x7b6cc20e,	0x2ab7bae9,
-0xf82dea7f,	0xc23825c4,	0xb3c2235c,	0xba0080e2,
-0xa315a436,	0xd07c9b59,	0x7ef5df37,	0xbd603302,
-0xfead0343,	0x019dc025,	0x31c0c859,	0xaf5b058b,
-0x28ea5b26,	0x77ebd828,	0xf4fd39be,	0x9e1c5192,
-0x3ae6ed41,	0xc27af351,	0x991d48c2,	0x1054edd9,
-0xca18dc26,	0x065a7271,	0x74589868,	0x8f4ea5a2,
-0xe074839a,	0x7aa8cfb6,	0x9be3bac5,	0x2b4b628a,
-0xa795cbf7,	0xfa468b9e,	0x111b5661,	0x7a655b4f,
-0x32310029,	0xffab4d35,	0x5656ab7f,	0x4a0ccde7,
-0x1fd07f42,	0x4897649f,	0xa8d7be82,	0x2192ec28,
-0xa803e289,	0x057806bd,	0xfadb5fd1,	0xbd6a8a21,
-0x92e6bed6,	0xeb37ba97,	0xc10c144d,	0x4967241d,
-0x59bd2f5c,	0x0cce80ac,	0xb0ee1579,	0xa8ec7ece,
-0x2db4fd07,	0x8cde113e,	0xd51e1b01,	0x86ad5e6b,
-0x95a5e1aa,	0xc6f63d38,	0xf6f03355,	0x05ebed9c,
-0x4c04d76b,	0x55e25673,	0xd67ab038,	0xb0aa406c,
-0x29a3bbfd,	0x1192103e,	0xe456e66d,	0x70707751,
-0x2f55b620,	0xf5265133,	0x9055d2ff,	0x2449c073,
-0x1142f28a,	0x821edb92,	0x8338c648,	0xd16869eb,
-0xc4d1f3b2,	0xcf764c9b,	0x2e58865f,	0xfafb9de4,
-0x275ea4de,	0xc8af0076,	0x0b0d620f,	0x9e0322be,
-0x563fa45f,	0x9f6074d1,	0xa1514c3b,	0xb8cf3602,
-0x593e3f0d,	0x21ef09a4,	0x514125db,	0xed77b906,
-0x0832b9ce,	0xdb2c8a75,	0xe98fb2cb,	0x041bc898,
-0xc69d0047,	0x1f6278af,	0x2d6d2293,	0xcc9c2265,
-0x33f7ef50,	0xc01e571c,	0x83f40f55,	0x1ec7192d,
-0xf9dbc386,	0x55182c05,	0x21bedd94,	0x414fb160,
-0x84b5d9be,	0x7d2a8175,	0xf700c11e,	0x3f0d128f,
-0xcf584f4c,	0x6a068ae3,	0xc1b0fd6b,	0x34b702b2,
-0x62b02091,	0xf1bc4380,	0x63dc3414,	0x441394db,
-0x9c0da5aa,	0xa35952bb,	0x45bef333,	0xf2691e88,
-0x5bb426c6,	0x9b22dcf6,	0x504b9451,	0x3f796def,
-0xaa07c979,	0x7a5fb961,	0x545d6f2f,	0x49856407,
-0x2cf2f265,	0x6fadb95a,	0x4a783c0a,	0x483cf776,
-0xf9e18dfd,	0xf3c529c8,	0xd6688fb5,	0x022ad1fe,
-0x4da7ca78,	0x9f8f7dd9,	0x47544935,	0x112be48b,
-0x7d954dab,	0xc76f2f89,	0x78e42199,	0x5f687270,
-0x29f36506,	0x9592fdaa,	0xa4dc5495,	0x4c7a0062,
-0x93a5e085,	0xfec0243a,	0x77eee838,	0xcd9c5653,
-0x97de8020,	0x5758abf8,	0xa316c9a8,	0x4bad66e5,
-0xdab802ad,	0xe97b432a,	0xff3d3782,	0xd2c100d8,
-0x2ed0371b,	0x559b6e06,	0xeac577f6,	0xce55e17a,
-0x4b62041c,	0x161f5f9f,	0xa133a36e,	0xc4009e6c,
-0x8079afd1,	0xb3b75a67,	0x9e3d88b4,	0x8e0410b8,
-0x7b1d6232,	0xb789dfd2,	0x7d76b850,	0x27920218,
-0x14aa4a75,	0xac239649,	0x8f014e4e,	0x5925bcb4,
-0x785d1a7c,	0xd83798d8,	0x5126d93f,	0x1e5cf0df,
-0x328d6fb4,	0x08d47bff,	0xb210e6e3,	0xc3ae7b72,
-0xd5b648d6,	0x96fccd4e,	0xff5a8510,	0x99e7c00c,
-0x34009d9e,	0xc0fe39a0,	0x04df8b67,	0x6d3f0f19,
-0x9e0087c6,	0x7a6cc6ad,	0x5595d794,	0x1831441a,
-0xd15b1a5a,	0x6a0f2e46,	0x5b4fc836,	0xbbd04d60,
-0x26e9c7e3,	0x2b23dba3,	0xc7bdcc5d,	0xf010825f,
-0x6b87160c,	0x3b9f39f1,	0x5a7cb594,	0x5cfa9deb,
-0x0230925d,	0x66b2fe9e,	0x5a3f705d,	0x6b644dd0,
-0x92e24c5a,	0x3296477f,	0xd7e529fd,	0xc8bd6fb6,
-0x52d623b0,	0x1e2dbd10,	0x50b11ab9,	0x61630977,
-0xab39cfef,	0xf590f660,	0x195eca7a,	0xa4719978,
-0x852c409a,	0x9a893622,	0xcbe1eef7,	0x830d0835,
-0xdd64ccc1,	0xc57b9adc,	0xe4ea99ff,	0xf59dbf3c,
-0xd2ad8664,	0x9a267e80,	0xe7b5654c,	0xba079f81,
-0x10d77ca9,	0x620776cb,	0x72d30b5c,	0x3709c64f,
-0xfa8ae134,	0xa76d5de5,	0x16d0c43e,	0xb3e0eb6c,
-0xb29d6055,	0xed7f9770,	0xf59f2b52,	0xaea14f7a,
-0x55555667,	0x429613fe,	0x9192091e,	0xefc3fa0c,
-0x5b57b348,	0x784ff046,	0xf06bdf46,	0x7f772849,
-0x2f5831dd,	0xadd45015,	0x9a550a7a,	0xec516793,
-0xf852e46d,	0x339d0c26,	0xa42da41b,	0xf082bb62,
-0xdca32c44,	0x4cfa7706,	0xdcd17e16,	0x2cd3798c,
-0x6d097168,	0x1ef0b3b1,	0x50a831f9,	0x90466bda,
-0xb9a008d6,	0x60806e77,	0x01b31846,	0x48fec336,
-0xb169f54a,	0xdc7596ce,	0xea9a8f38,	0x048ca4da,
-0x79c1582d,	0xecace961,	0x84404601,	0xd5acf76b,
-0x9fc7fa4c,	0x0a39c68e,	0xd6c26cba,	0xa29e95af,
-0xc9cd9186,	0xbb5f0a57,	0x58d88a0d,	0x062908e6,
-0x32fe647b,	0x8658c809,	0xc2e0d2c7,	0x7bb9039b,
-0x7500c6f9,	0x51c201ca,	0xfbcd4ca5,	0x2836b352,
-0xd57ab38f,	0xc261f3b5,	0x91606246,	0x7fa42b46,
-0xdcb911c1,	0xd7fccb18,	0x2eec8397,	0x16eccd3f,
-0x0f0ff08f,	0xeab63455,	0x7fca5f02,	0x2aee4eda,
-0x9ce2ca9c,	0xb26b115e,	0x5eaccb32,	0xe135e2ab,
-0x15c95f3b,	0x9487d7a1,	0xe59407eb,	0x24832f87,
-0x97bacdcf,	0x68f80a70,	0x4cd0c2c2,	0x2e4e056a,
-0xc4331004,	0x8f4dffca,	0xf0a617a9,	0x05544788,
-0x4b44d10f,	0x147070c0,	0x0da56940,	0xaf190457,
-0x91e927b4,	0x51397c96,	0xc400458e,	0xca20ba1e,
-0xaa7fa86b,	0xb13caa61,	0x61da85af,	0x287c3f4c,
-0xce7c0be0,	0x72387d77,	0x3e65de67,	0xf86a18dd,
-0xf8d6540e,	0x3e681318,	0xe2989d26,	0xb9e1c745,
-0xdc71ee8e,	0x3db05e6c,	0x883a048e,	0xc5c35513,
-0xa1bbcc6f,	0x26072dac,	0x11982c78,	0xf6b0deb2,
-0xc1020189,	0x632829a3,	0xf8797582,	0x824a362b,
-0x1c24ba47,	0xb5183931,	0xbd7736d6,	0xf9d778f2,
-0xca55e789,	0xc5bef424,	0x2274c87d,	0x9d7cb0bc,
-0xde597991,	0xe085bc6a,	0x37d288e8,	0x8b222375,
-0x6ed1939a,	0x70516fab,	0x7c66d58e,	0x2912d6be,
-0xe778f97e,	0x40304808,	0xeb30652a,	0x43fa3109,
-0xcbcf8563,	0x5f324e6e,	0x375dced3,	0x9e67d97d,
-0x590c330d,	0x3adda68d,	0x7a4a32ee,	0x5db03885,
-0xacdc6149,	0x8180dc4d,	0x0022950d,	0x58ece5f7,
-0xe671d4c2,	0x84ab201e,	0xd403a7b4,	0xe674512b,
-0x49cbff07,	0x5721f935,	0x1a623898,	0x4a6b656d,
-0xb0ed7698,	0x8c0d2b98,	0xfba35247,	0x7438b0b1,
-0x1184bc22,	0xd511b6e5,	0xe1fe111e,	0x67f37c3d,
-0xddea5711,	0x8ce3f768,	0x43048733,	0x2dedd922,
-0x903e9ef4,	0x009db5a0,	0xaef6e7b6,	0xfa78c7e9,
-0xfac768c6,	0x30e9300c,	0x22a92a52,	0xd58a96ea,
-0xca86b581,	0x9e6f86b1,	0x978f3788,	0x58ed1fea,
-0xd95ee669,	0x5b7e7ae0,	0x8b6735e0,	0xc26330fa,
-0x2b6f8708,	0x18b48518,	0xb27d2a16,	0x083f68bb,
-0xb351da07,	0x1332fd21,	0x92d5227c,	0x5caa0da8,
-0xb48fd33a,	0xa98e2474,	0x8f561ed6,	0xb0572587,
-0x0c22ad2e,	0xc43c2258,	0x9d669bbc,	0x27def2aa,
-0xbc4134b1,	0x7e89bee6,	0x9537f017,	0x13706540,
-0x0b2befcc,	0x5f72ddee,	0x49d82cfd,	0x22e4f8a9,
-0x53737b54,	0xcecc2653,	0x95709612,	0x4bb49197,
-0x50678a99,	0xb945a61f,	0xa5067e19,	0x0286193c,
-0xd0c6d89a,	0xa98c9860,	0x58794310,	0x20a2519a,
-0x4fd6b897,	0x43cdfa26,	0xe98383ae,	0x46f94998,
-0xed179ecb,	0x711671e0,	0x599cd144,	0x15a123d5,
-0xf16ee833,	0xdbee4f93,	0x57933549,	0xcce5151b,
-0x8ee1704e,	0x69ec7225,	0x7ae00937,	0xcfcc0f29,
-0x502b2b62,	0x38437316,	0xe51cde5f,	0x11592292,
-0x3cea5e42,	0x07bc78db,	0x1085885e,	0xf08c5069,
-0xf07da087,	0xf81d3650,	0x03c1859b,	0xd7a0919b,
-0xd7c04104,	0xb58ce296,	0xb23e27ac,	0x74ac7318,
-0xe50fb21e,	0x0db08556,	0x72b2fadf,	0xecb96f8b,
-0x365781db,	0xf828b440,	0x39d602ad,	0x4f6369de,
-0x140092e9,	0xfd149cb5,	0xdeb1d729,	0xe9b30c03,
-0xa1f080ae,	0x135b4032,	0x7186fa21,	0xc298e242,
-0x6be8bcbd,	0xe63d5d59,	0xf9b7580e,	0x1a1b2bb3,
-0x77d6a64b,	0xca758d88,	0xb965706a,	0x6ffb7da1,
-0x771db6e1,	0xe00ee7d7,	0x7c101a40,	0xf04c5bda,
-0x3ccae916,	0x0772ac09,	0xace75764,	0x29f2837b,
-0xe5a7c3d9,	0xe7a935cc,	0x0c226bb1,	0xe6f8f848,
-0xb9c779db,	0x5715df94,	0x161d4946,	0x8fb76b7d,
-0xb86e2818,	0x1d1f3d99,	0x5bf5bdf9,	0xb785c01d,
-0x15c53680,	0xdad1fbec,	0x3846978e,	0x53a72f1b,
-0x1af27e6d,	0xe6ddea06,	0x625a7049,	0x74ad71bd,
-0x73a86cbb,	0x9b538614,	0x8535c0bb,	0x66c47d6a,
-0xb7ed47af,	0xa297c56c,	0x9dd35465,	0xffb13459,
-0x0d69f3dd,	0x7697b0e9,	0x1add55c6,	0xfa3963fa,
-0xd30d4cc1,	0x54a0b2be,	0xdd93da03,	0xb52847e7,
-0xf6d21210,	0x8a8b164a,	0xf83ddd39,	0x030a875d,
-0x3f02d2cf,	0x0238f0d6,	0xb3010c35,	0x4a98bbf3,
-0xd4920a33,	0xf5de9f63,	0xee883399,	0x20b10b06,
-0x1fa40b12,	0xf40aedb9,	0x28fede9d,	0x026a77c1,
-0xb9d96bf2,	0xd0a0f7b0,	0x1186d373,	0xdedc1045,
-0x3afb6238,	0x1f6f0af8,	0x508a05fb,	0x9a8b7022,
-0x0dc66b47,	0xf4ab674e,	0x94877e94,	0x45dfb09e,
-0xe3a411f9,	0xa8d32903,	0x9014082f,	0xc474985c,
-0xc8770185,	0xb13b2fa7,	0x056079d1,	0x35c3e399,
-0x1b87882a,	0xae9c8263,	0xcc503dd6,	0x3d24d955,
-0xe9ad61da,	0x8e43d188,	0x26b71302,	0xceec1a51,
-0x94df99f8,	0x8bb501a4,	0x50960bf7,	0x96eeb5a1,
-0x08dfb4a8,	0x9b4637a9,	0x00cb4dec,	0x440d9bd9,
-0x4c7fb6e5,	0x96dea61c,	0x03f6608a,	0xd781c730,
-0x5f289b28,	0x0f14f5f6,	0x589d83b6,	0x81d32394,
-0xe1bdcbdb,	0x92a6c463,	0x98b1072d,	0x42e20173,
-0xf654ca85,	0x972309f4,	0x8086fca6,	0x229cb98b,
-0xd35454c4,	0x73ecd871,	0x27c302c2,	0x78a8b0da,
-0x845dccd0,	0x3dd7b5a9,	0x5fcdd32e,	0x17134d76,
-0x844067b9,	0x053f4599,	0x24eb01a7,	0x73224c94,
-0x64d29109,	0xd38f2df3,	0xe3aa04e0,	0x94eade7a,
-0x84593b17,	0xf70a0417,	0x5a89f117,	0x87d837cf,
-0x27a5732d,	0x17d4bfcf,	0x7b7b358d,	0x4b7fbe93,
-0x061d7ae1,	0x708fb12e,	0x6ce88f03,	0xfa34a6bc,
-0x3d85cd39,	0x6c8880f9,	0xab8d33e3,	0x4643e6e0,
-0xf8cd5b51,	0x717eb87b,	0x26846d1f,	0xebd94ff2,
-0xe7903934,	0x472811c1,	0x0f6b0c95,	0xbf994808,
-0x287732b7,	0x66ec0fd5,	0x319dc562,	0xfcaf97e2,
-0x623e2113,	0xe34e4c58,	0xf1959bca,	0x4fd868eb,
-0x3aaa6cb1,	0xa28f2d9c,	0x94c957e6,	0x772eefa2,
-0xb61e0b69,	0x294db056,	0x8e76bed8,	0x0a33286c,
-0x25f1b73d,	0x26c0ed67,	0xd4525924,	0x4dbac1d5,
-0x06e9249b,	0xe1a7d83c,	0x8924230b,	0x669b3731,
-0xfba030e2,	0x2dcac1b6,	0x35effc51,	0x229dd16d,
-0x485fdddb,	0xf1d96a78,	0x6f09b534,	0xf8e78e0b,
-0x1f073656,	0xaf0bbff3,	0x1a913c11,	0x092be9cd,
-0x377266d1,	0xdda6ed82,	0x0d1c3894,	0x4b7ad157,
-0x74aa8d20,	0xa071dcc7,	0xb9106d7e,	0xef01236a,
-0xf6063dbc,	0x29f3c98e,	0x982caec9,	0x1cdc08c6,
-0x8dbc64ab,	0xa83a8eeb,	0x74298948,	0xabc33cfd,
-0x07d0b8b1,	0x5fedb1c4,	0x126752c1,	0xe7c3f4be,
-0xbf09f75a,	0x27199269,	0x5eb2945d,	0xc52efb9d,
-0x90428300,	0x13d5a9ca,	0x838f5cdd,	0x73e934fa,
-0x6d7cfa3d,	0x48b9f96d,	0xe3374584,	0x752ac718,
-0xc925aa16,	0xfa660428,	0xe9d1de54,	0x82f079e9,
-0x762760e6,	0xeabac4fe,	0x54436530,	0xba655050,
-0x928088fe,	0x215b593c,	0x7a07d6dc,	0xb4dab921,
-0xac8b264d,	0xcfc3324a,	0xe20f417b,	0x040838e3,
-0xdcf58c52,	0xb84daf82,	0x6541ffa9,	0x6afa707c,
-0x0d875f5e,	0xfb94c514,	0xf80ef226,	0x3a0da940,
-0x0ce66076,	0x1ed9af3b,	0x59994986,	0xa109a00f,
-0x28c7b3f6,	0xdbc50554,	0x37a97daa,	0x5572d0c0,
-0x84a25ba6,	0x29d0c7da,	0x424814b7,	0x796c3af0,
-0xea2d2a79,	0x5440915d,	0x868616da,	0x63cda2fc,
-0xdd956523,	0x2fd44435,	0x1478b7a3,	0x9a48728b,
-0xb069562d,	0x67f0378e,	0xf776d649,	0x5f682002,
-0x3d98b6d7,	0x78873d15,	0x4ddc674f,	0xc8dfdeeb,
-0xa28d4c2f,	0x0ed17b8f,	0x25752288,	0x108811ea,
-0x8727b8e1,	0xafcaeb34,	0xb08ee613,	0x21a76843,
-0xae3dc6a1,	0xb9b41ccb,	0xae40b539,	0xf6ee369b,
-0xc33256cf,	0x97e63b33,	0x281ecbca,	0x03d27cef,
-0x2cec16d2,	0x4fb0965b,	0xd619969c,	0x63d7ccc1,
-0xf39a0271,	0x0fb76532,	0x331077ec,	0xd961fe4e,
-0x42c36d59,	0x3f5a2eb1,	0x4a8c998b,	0x8db7cfff,
-0x6fb068b7,	0xaa92ee13,	0xa8a01101,	0x00e09470,
-0x99d1be9b,	0xcc38f497,	0xf070d411,	0x6de05db7,
-0x07af935d,	0x963e1dc5,	0x6e026e91,	0xbe9c79a1,
-0x020fca5f,	0x95dcaa0c,	0x855e9b6c,	0x274cb6b5,
-0x37636bb8,	0x1f5aad66,	0xc4a946c8,	0x96ced169,
-0x09889005,	0x64abe905,	0xf95fced8,	0x56f0bd7a,
-0x7ac20530,	0xc486ded3,	0x44dc1794,	0x84946e0c,
-0xd0c87c95,	0x15050fcf,	0xa7f8bf24,	0x805915a5,
-0xfa737701,	0xc8d471fa,	0x6cbc5acd,	0x740db31a,
-0xb279c813,	0x59ccc4fc,	0xf70d86bd,	0xf5f28c17,
-0xc73237f4,	0x973f206c,	0x8de25431,	0x3e2b50a7,
-0xa6d645bd,	0x5e330b16,	0x2b41120c,	0x1a942798,
-0x62ada7e5,	0x2fe8cfa9,	0x441d159e,	0x7469223a,
-0x1e13ff34,	0xc6398698,	0xe637521e,	0x55eea649,
-0xed19f31f,	0xa4c588c1,	0x165997b5,	0x6fa55b04,
-0xbd5a0881,	0xb61d7803,	0x19a98a57,	0x1006ba25,
-0x6bcf5ac7,	0x8202f782,	0x655023a4,	0xb0ddd31e,
-0x45063696,	0x5e725e3d,	0x19ce39f9,	0x1192e2cd,
-0x824b7ddd,	0x8e42bdb3,	0x58026854,	0x6fb264fc,
-0x49670166,	0x3694b535,	0x74fd3614,	0x084d98fe,
-0x986509e2,	0xd5f17199,	0xc7e39caf,	0xe572c94f,
-0x3d1761a3,	0x478c3c67,	0x5ff9ea89,	0xe471b06d,
-0x0fe32378,	0x073d67f9,	0xf20593f0,	0xf99bbfed,
-0x7b20e635,	0x35c99773,	0xda97200a,	0x3405fa29,
-0x69242039,	0x9a6ea1f8,	0x754cc661,	0xee80347a,
-0x852b4249,	0x8ee4ff7d,	0x3f970b59,	0xde832b32,
-0x336dba9e,	0xf25e1b12,	0xe126e598,	0xd54db071,
-0x1e0096f2,	0x6af7f632,	0x7f6373a3,	0x8c22258f,
-0xd2050025,	0x6054a184,	0x6ec82954,	0xd410eeaf,
-0x14185987,	0xf09150dc,	0x4d0c9e17,	0x4ccf3760,
-0x5d42a123,	0x7ce82ee5,	0x0d4921f2,	0xe4d7f1f6,
-0x6f6683b5,	0xe2c7ce05,	0x4a72ee67,	0xbafab496,
-0xafcb5088,	0x1d9291fe,	0x200d498f,	0xe555459b,
-0xb409d75c,	0xf24b40b0,	0xb3ff50b4,	0x4268510c,
-0x4554d6bd,	0xe48a0828,	0x484de584,	0x72dd9066,
-0x71f10567,	0x80315f9c,	0xab3d8cca,	0x30291f03,
-0x9f79c26c,	0x3255f780,	0x800c868e,	0xff7e95a5,
-0xf2f9ee4f,	0xdbf39bb9,	0x75c754c6,	0xccc5d8f5,
-0x6f762135,	0x384f6434,	0x8e37913b,	0x355bcbfe,
-0x3861e062,	0xf589349b,	0x00cbd441,	0x117f4fd0,
-0xf683d175,	0xf4bb0c9e,	0x01b30261,	0xd2a07292,
-0xbd6e56d5,	0xb93c9d68,	0xc0cce49f,	0x9097d4ea,
-0xfad1585b,	0xd98ea1e8,	0x9ffd376c,	0x9e9ccf1b,
-0xb2479982,	0x52ab0797,	0x9acd5ae9,	0xaa05a0c8,
-0x0981c9ce,	0x7b616203,	0xe5578586,	0xc2dda6c1,
-0x7587081c,	0x44e674bb,	0xfb42e52d,	0x3f1f5ae9,
-0xeb0a829a,	0x49fd1207,	0xb18e3649,	0x1d1dd143,
-0x5904f261,	0x9a034a08,	0x15042e98,	0x9c39694a,
-0x1c54673c,	0xa6b09ba8,	0x1a2aea4b,	0xb0912513,
-0x8719d675,	0xc68be9b1,	0xd1e52f1c,	0xdf18c798,
-0x662b0111,	0x75a13396,	0x3bc0a2ea,	0x61c8642e,
-0x04186415,	0xb5432f6a,	0x4d9f4664,	0x061b1437,
-0x762c2b5e,	0x773639b6,	0x64021a2a,	0xb7f5f7f2,
-0x46002757,	0xa1f51f41,	0x33639bbd,	0x52697994,
-0x3b8d3688,	0xbd57a937,	0xaef18b6e,	0xafd681a4,
-0x36832466,	0x1fb9d3dc,	0x03d772da,	0x9f019ef7,
-0xe63b23f2,	0x397703eb,	0x3923a7b7,	0x8e2e4907,
-0x86fe45f5,	0xb83908be,	0xf2db94e9,	0x0e6c660f,
-0xb34578ed,	0xb5f76b53,	0xf102443d,	0x04ecfa73,
-0xe11f1aaa,	0xe2801701,	0x578de538,	0xeaeca46f,
-0x2934beb8,	0x3f534e49,	0x579a8331,	0xaa31325e,
-0xd69731f0,	0xc54b03ed,	0x39f2ae81,	0x864dae23,
-0x223ea49b,	0xdeaa30fc,	0xb6ee08b2,	0xffe8ab5a,
-0xd5d29fba,	0x540dcffb,	0xe6eb53b1,	0xc1f1d24c,
-0xa4d62e2d,	0xa40ad711,	0x95fb746f,	0xca68b0bb,
-0x5e328eb2,	0xda9482c5,	0xd6e0e281,	0xcc2ca0db,
-0x3959032d,	0xb4057dbd,	0x0e588bf8,	0xbb1a002e,
-0x26273ae5,	0x9c178acc,	0xf9aa1796,	0x3aed26bf,
-0x73312ab1,	0x6ee0cd08,	0xc0de30b6,	0x71c12a7b,
-0x15abb19d,	0xf0e20a1d,	0xb3559a97,	0x5e91aa7f,
-0xcae974a7,	0x756ff00c,	0x4509aae4,	0xe4b8a22e,
-0x86f886e7,	0xe6050093,	0xb31e8471,	0xbe23dcee,
-0xe10933a7,	0x542d8936,	0x38f37c10,	0x7231170c,
-0x10a10f7b,	0xaad1b02a,	0xa986e85a,	0x461a3222,
-0x2cbf24f3,	0x4f8cef54,	0xb4e90ee7,	0xd9334d8b,
-0x9546a4fb,	0xd1c4eab1,	0x2c81a30a,	0x41d36c0e,
-0xdef84879,	0x75a7d8eb,	0x60b90423,	0x36f90dbd,
-0xb4f1c7e3,	0xadfe9980,	0x329f6088,	0xbd6475b3,
-0x810cda6b,	0x88981d17,	0x50a028ee,	0xa86313dc,
-0x780af375,	0x70aa0aed,	0xd9c5a36e,	0xe1cdae7b,
-0xc14fa6c2,	0x98b7cff5,	0xad39494b,	0x4667d47d,
-0x92b684cf,	0x85f99f8a,	0xa89f5d6f,	0xab060866,
-0x9c398638,	0xb5330912,	0x6d694560,	0x1b95d8ab,
-0x633c8e08,	0x155290a0,	0x5b0f7401,	0x36738de8,
-0xb16ee807,	0xa5cf61c8,	0x64cf4dda,	0x025eb139,
-0x3177bf83,	0x4f5f157c,	0x926d0e91,	0x5a93121a,
-0x6df97b7f,	0x44954344,	0xa2cacb2d,	0x75f1aaf8,
-0x16cc89c3,	0x8d43eaea,	0x691d93fb,	0xee923d52,
-0x712dc56d,	0x04aaa6eb,	0x414130cc,	0x7e1b5d0f,
-0x3815a3a0,	0xfdb87870,	0x3285ca3a,	0x7c5dfbdc,
-0xa7b20545,	0xd4f730d9,	0x7953112e,	0xc44342ee,
-0xdafc8bf7,	0x087d2bfb,	0xd7012598,	0xcb0859f6,
-0x6fd45f65,	0x6abaf912,	0x79ec7fbd,	0xd02c70de,
-0x3d8d9786,	0x34fbafe7,	0x0a26b4fa,	0x6d7f3bdb,
-0x4be93d5d,	0x3d7b3e71,	0xe0ef7059,	0xdb30147d,
-0xbbc4ea79,	0x7ccc8b2c,	0x3c3a70db,	0xbbb1f02e,
-0xabcc59ee,	0xf3fb098c,	0x60d7734e,	0x12c40adb,
-0xd6510acc,	0x2d488553,	0x4d774ba7,	0x4f896ccc,
-0x38e656b1,	0x23a5ab48,	0x6f8486fc,	0x2dc72806,
-0xc2f88696,	0x721807aa,	0x95ea9f15,	0x663458fe,
-0x043f4552,	0x8ce32d80,	0x227b6b35,	0x4c387d57,
-0x87413fe5,	0xcfc463d6,	0xc1e4bfe9,	0x3d8748cd,
-0x14fa25c3,	0x1267b792,	0x72d80b1f,	0x373ee917,
-0xfbceee14,	0x2fa20260,	0x5a36940c,	0xa1f86183,
-0xa5db09c9,	0xef2d937e,	0x9de1276e,	0x2ac894d5,
-0xacb1eea9,	0x7e9a8759,	0xbf41db22,	0x42841ac0,
-0xa1a7ebec,	0x0c9f99c9,	0xc71ef76f,	0x73b9c929,
-0xf861fd51,	0xb2ab25f8,	0x06feceed,	0x773b280a,
-0xbe4ddf97,	0x252d87e8,	0xd33ff702,	0x0bdaecb2,
-0x25f439d6,	0xff7f4ee8,	0xe3558956,	0xeb5fb5f6,
-0xa0611f79,	0xb2c23dd1,	0x5bd3d94f,	0xc9934f18,
-0x44a20e55,	0x0034ee18,	0xd5a2498c,	0x8c5515f8,
-0x77276a27,	0xf9f99493,	0xec172ff2,	0x3dd2dc1d,
-0x534d3493,	0x9f7e6e0b,	0xde8e2692,	0x326ffb6d,
-0xa7b6437e,	0x7048718f,	0x0f96a862,	0x19f57db9,
-0xf8b9459f,	0x45fa3067,	0x51e2a309,	0x2ae18f1b,
-0x4caa107e,	0xb420181f,	0xb1c864e3,	0x42c1ba34,
-0xc6795c27,	0x3bb910df,	0xb21ca5f9,	0x6a85e37a,
-0x57fd06e0,	0x0787ae29,	0x4dbe62ff,	0x689d444c,
-0x864fcc2a,	0x2efd0bbb,	0xa0dbe9d3,	0x6bcff644,
-0x7b20db2a,	0x88baee81,	0x7a4eb92a,	0xfcda45c5,
-0xfd71896b,	0x462289d1,	0xb5639397,	0x0dd6d058,
-0xbf8dde56,	0x2ab3dcc0,	0xda04cfdc,	0x535353c4,
-0xbf565509,	0x02b8404c,	0x43ceffbe,	0x961271d8,
-0xaa5443c7,	0x47492ae9,	0x81549370,	0x03eb958b,
-0xa8d0ecb3,	0x55d8125b,	0x96c1714f,	0x8a6bc861,
-0x1dec9236,	0x8df7fcea,	0x7c986009,	0x6542a33f,
-0xe9fea1dc,	0xe379c77b,	0xc7927ece,	0x24f700a3,
-0xcc4852f9,	0x13b986ed,	0x04280402,	0x81ab3fd7,
-0x85aba585,	0xfcc388f6,	0x9884bf12,	0x7625fe22,
-0x07831c4c,	0x7819fa5c,	0x49601768,	0xe5f1c013,
-0x4538fb8e,	0x1e902d71,	0x52fe80f0,	0xe1db0549,
-0xea38d0fb,	0x8b78a4d6,	0xb0d08524,	0x092b8dd0,
-0x1ee1bf78,	0xc7e41884,	0xb5a03a1f,	0x9380b0ad,
-0x6dc87fa0,	0x1cf24649,	0xb4da7466,	0xcaab5119,
-0x14f081c5,	0x70ae8c97,	0x56e6b35b,	0xeb1b671a,
-0x04f3f9c0,	0x99c0f5b3,	0xc96eb118,	0x935739f0,
-0xaf6cfb61,	0x23428ab0,	0x65b6acda,	0x389e5c3c,
-0xa40d4e57,	0xf3566e45,	0x10a94ee9,	0x53ba357d,
-0xe3182a64,	0x6b6bb867,	0xef0ba098,	0x3ff560a2,
-0x46773eb2,	0x23d41447,	0x89fad151,	0x71be33d3,
-0x29936e61,	0x4b3a128c,	0x5f1c4a5a,	0x3887b26f,
-0xd4300535,	0xb98f3276,	0x77cfcb4a,	0x8d174b17,
-0x4a7692b6,	0x85a93236,	0xe776350c,	0x456e835b,
-0xf3c6fc30,	0xd4fe260b,	0x4ea04774,	0x67e79f8d,
-0x51bda66d,	0x347f402d,	0xf66c87ed,	0xfe1dd07e,
-0x49a5f1d0,	0xa5c79a90,	0x09440639,	0x9665b964,
-0x3b0f061a,	0x19ac22fd,	0x2747ca11,	0xa61c4a0d,
-0x175af504,	0xfd046876,	0xa646e1f1,	0x60d2057a,
-0x327c0cff,	0x06760628,	0x36362506,	0xad21edfc,
-0x2e3503da,	0x796385b4,	0xadaa8c6b,	0x75c3d3b5,
-0x801d0551,	0x8ce308c0,	0x6211b022,	0x7392b6df,
-0xdce62588,	0xb9791841,	0xc1279996,	0x1e40896d,
-0x17732a68,	0x46e758b9,	0x9e9e6944,	0x8c4f9dd7,
-0x92bbfb4b,	0xa357ea1c,	0xe8caab82,	0x501a0596,
-0xdeeed569,	0x60f39f0a,	0x6e0c61e8,	0xae47150f,
-0xc4afe67d,	0x29a261c5,	0xbee79d7d,	0x6f12632e,
-0x341f1d75,	0xe3861acf,	0xae9bc146,	0xb355af33,
-0x011af2f2,	0xc1c45374,	0x0d855646,	0xad8cf696,
-0x24ca0fcc,	0x760d01f5,	0x84be2e7d,	0x27a5d933,
-0x120ce78a,	0x427e2c81,	0x2dd9c1f2,	0x08eed0a2,
-0xaf8d7d0c,	0x4bcd15ad,	0x2267f2fb,	0x898c1ea5,
-0xd6e55fa8,	0xc4dd0a14,	0x3069e08c,	0xec55ea22,
-0x9ec6ff40,	0x2f426be2,	0xfd312cd3,	0x451e06ce,
-0xf4a74729,	0x1a2956cc,	0x75dd0978,	0x44f7b347,
-0x585565ff,	0x83e52dca,	0xba4b52d6,	0x6ef2218a,
-0xf3fb9bdf,	0x3f186040,	0xfb99b28e,	0x5840695d,
-0x17c76b5f,	0xe9e0c488,	0xee505517,	0x48ac3c2d,
-0x8451a406,	0x6141eb0e,	0x7babb696,	0xddf06e87,
-0xbc5a48df,	0xe39aa692,	0x09ace8c0,	0x93141fc5,
-0x3be8be1f,	0x6ef6f882,	0xe273e9e4,	0x46f27023,
-0x83740547,	0x8665645e,	0xaee17f61,	0x814ca683,
-0x6dfbb1bd,	0xf2f15771,	0xbb4ff803,	0x96f0d941,
-0xa3e0aeea,	0xf9cf9021,	0x6b4e56de,	0x262c78cd,
-0xa01c7bdf,	0x1464fde1,	0x315b05f6,	0x8144a541,
-0xb41045bc,	0x435b8e51,	0x54879dd2,	0x5cb04317,
-0xfc703e05,	0xbbc1ea5c,	0xa9d17bea,	0x73941913,
-0x8a9bc3e9,	0x462b9d40,	0x41a3e549,	0xcfd40b77,
-0x847c17a4,	0x55cee3fd,	0x54c2d844,	0xd265fbcc,
-0xe25930c3,	0x7256e82e,	0x00f38bf3,	0xe6ab0ee4,
-0x896e64b5,	0xb41bb1d5,	0xaeccee3b,	0xcbf25cbe,
-0xb2a585d7,	0xe68fa39d,	0x6c935602,	0x7855ef91,
-0x28bcf8f5,	0x03ad869a,	0x11c3ca6c,	0x1f858276,
-0xaa3aabc8,	0xe787c982,	0x554342aa,	0x5b195148,
-0x680d9deb,	0x4750dd7e,	0xc656d356,	0xa3f4c6bd,
-0xf0b34039,	0x4b92db60,	0x690f8cb5,	0x2c05175c,
-0xfc6e7a59,	0xdba2c23b,	0xd1b369fc,	0xd76f4069,
-0xea804212,	0xe9d2a82a,	0xff076107,	0x0f2f9a93,
-0x1299743c,	0xfbb303d5,	0xfd0b8703,	0x28cc6ab5,
-0xb5544c0a,	0x62e33953,	0x117bb601,	0x27c3f195,
-0xa844bb03,	0x63b9f935,	0x9e8e5a86,	0x0070cc59,
-0x07b68daa,	0x56df73c4,	0x4abc039d,	0xf037f0a5,
-0x6c70d8b8,	0xdd743bee,	0x676a3d9f,	0xb844e348,
-0xa2193e77,	0x81e51abd,	0x151821da,	0xd8a661a1,
-0xf8758699,	0xf01d3f69,	0x443f5d49,	0x7c12ca61,
-0x1b149944,	0x47d88ab6,	0x6bf46227,	0x8cb5503a,
-0x06203578,	0x9f2ced0d,	0xbdd1b617,	0x2d9eb330,
-0x8e7f6ed3,	0xd0778b04,	0x45f804df,	0xeda77d3d,
-/*  2619-mA01067AA07.inc  */
-0x00000001,	0x00000a07,	0x04092008,	0x0001067a,
-0x83067ecb,	0x00000001,	0x000000a0,	0x00001fd0,
-0x00002000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x000000a1,	0x00020001,	0x00000a07,
-0x0000001a,	0xa4000000,	0x20080408,	0x00000401,
-0x00000001,	0x0001067a,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0x00000000,	0x00000000,	0x00000000,	0x00000000,
-0xc4294866,	0x3e20a114,	0x8387f19c,	0xdafb14aa,
-0x33a38309,	0x68b0f8ea,	0x2a20b200,	0xcdc7aa9e,
-0x170ce7c7,	0xd727c705,	0x019b1ba5,	0xe0414a29,
-0x57d45458,	0x26a8a411,	0x9faad966,	0x095ec8b0,
-0x083a7c2a,	0x17cfc70f,	0x3c8e78a8,	0xce18c419,
-0x5f2ddeb7,	0xc9c95d71,	0x437a5116,	0xe0253ad0,
-0xec78db42,	0x681e436f,	0x7fd028bb,	0x1149a501,
-0x0bdf0d05,	0xc2321514,	0xd6866cd8,	0x64942685,
-0x21e0276b,	0x0817a288,	0x09138669,	0x792985dc,
-0xbd60d6aa,	0xfbf902ec,	0x43fee69d,	0x5c5823c0,
-0x9dca1fe6,	0xb528b0c5,	0x22fd29ab,	0xac4fe251,
-0x77207813,	0x0637a1f9,	0x16bfcf73,	0x80497f6b,
-0xe5bca939,	0x1539fa1a,	0x66607fea,	0x2276c06f,
-0xd003229e,	0x3622fda7,	0x18d0b8af,	0x9f399760,
-0x3ac6387b,	0x6c7148fa,	0xfaf4df9f,	0x965db840,
-0x7c142542,	0x7b805f4c,	0x3f2002a3,	0x061399ce,
-0x2f1a03c4,	0x7f1c7616,	0xb2f9ab42,	0x4e6a92a2,
-0xb44b96d6,	0xe1167017,	0xec4b2fb3,	0xa15376be,
-0x00000011,	0x9f63eb61,	0x64816577,	0x10c68141,
-0x1cc5fd18,	0x156703a6,	0xe3315c33,	0x62a1db21,
-0xb6135848,	0xa306d2fe,	0x117cb585,	0x54c3a133,
-0x722cf721,	0xa693cd57,	0xd02c0e2d,	0xf17b96ca,
-0x97d2a408,	0x2e776501,	0x667f7664,	0x1568cf83,
-0xa044dee1,	0xe6a879aa,	0x4ff23d0a,	0xd559de49,
-0x2dabb17a,	0xc6c39e38,	0xc3ae5451,	0x2d03f3dd,
-0x7ba226ed,	0x69a19529,	0xc2865715,	0x8b95e6c2,
-0x7a7ee1cf,	0x74b5e43f,	0x69aeeefb,	0x5d95aaa5,
-0x0afeb5dd,	0xdb837be6,	0xed6f9d79,	0x2ad96eb4,
-0xcd60dd82,	0xc3ff7d75,	0x7030a02b,	0xdbbe45dc,
-0x203cd7ba,	0xc3b90579,	0xa21f54f2,	0xc79853ce,
-0x5e3f74eb,	0x06c63742,	0xb1fa50ef,	0x0e8e950e,
-0x97d44b72,	0xa48dc8ad,	0xf3803fb8,	0x946e4d5e,
-0xf0f1e9f6,	0x272b9764,	0x567efb67,	0x82deebcc,
-0x614f61e8,	0x3bea41b8,	0x31a12485,	0x682e10ae,
-0x954c7b7f,	0x0e4bccf0,	0x8cb1eb25,	0xb5018c6e,
-0x50957531,	0xcc60f1c9,	0x11181c5c,	0xa4dc1468,
-0x3310423f,	0xd2550a2a,	0x3bd2ac80,	0x2be006d9,
-0xf57f3e2d,	0xb4387cc7,	0xe96c48f9,	0x722975a2,
-0x4506717f,	0xaf92aa6e,	0x7de4eb6e,	0x3600e58d,
-0x898cc58f,	0x271c467f,	0x1c5cd377,	0x5858e9bc,
-0xd3ad9408,	0x513c936c,	0x0dc54b7e,	0x0226d703,
-0x4cc95088,	0x78bbb408,	0x573d07e2,	0xa4e9cd4e,
-0x4a2930cc,	0x3082d573,	0x68c8c48e,	0x883d27f8,
-0x4e91dd95,	0x850f6d80,	0x5f7f3e37,	0x452cc29a,
-0xf2f9cc40,	0x278be406,	0x356eb275,	0xda301857,
-0xdbc49113,	0x7007d110,	0x06f49bc2,	0x74712f32,
-0x73176720,	0xcebc66e2,	0x592acf0a,	0x8818dd3f,
-0xd599d562,	0x54199a46,	0x6472129b,	0x47058cd1,
-0xac4a74f5,	0x1cac471a,	0xf1b4758a,	0xfa6f8e1d,
-0x1013e19a,	0x59252c0b,	0xa764c600,	0xfba01968,
-0xc7c11589,	0x2b4bf080,	0x0157b32c,	0xc09788fa,
-0x1be99aed,	0x19c1799c,	0xb1d03201,	0x8bfb5374,
-0x44e04a89,	0x895d3a8b,	0x5b3a53dd,	0x4704a722,
-0x0d4ac344,	0x8a3f81f2,	0x3513e05d,	0x04e89637,
-0x39f3d4a3,	0x883f2acd,	0xbc2ec5aa,	0x3a26f17e,
-0x3de2b026,	0x49cffb83,	0x9cdece0f,	0xdaaddd7f,
-0xc884a2fe,	0xe4244359,	0x493030d4,	0xb87e816a,
-0x3b2481a1,	0xa2eaa4eb,	0x33d7ad6a,	0x64947485,
-0x65f85855,	0x088388d8,	0xf6dfc3eb,	0xbceddbca,
-0xf72f47e1,	0xd1d06e25,	0x76ff3bc0,	0x9b8f2139,
-0xec7bc702,	0xfe6e6c0f,	0x42d31d20,	0x7e0397f9,
-0xb20b40ff,	0x45a5ce27,	0x31949159,	0x7013a868,
-0xdef2e0d9,	0x30c62ff4,	0x9b5a9b24,	0x0e4e4b1d,
-0xecbbbe85,	0x4cca116b,	0x341fa1fc,	0xfa64b033,
-0x43007f76,	0x710238e0,	0xa995a864,	0x5125d448,
-0xc20c49c5,	0xea370734,	0x9bb92154,	0x596f42c2,
-0x8d8919f6,	0xdd875cf4,	0x3b76b70b,	0xe96291c9,
-0x2814c6d4,	0x0baf988f,	0x9880af78,	0xcbb57ca5,
-0xf9580819,	0xebe041cb,	0x051d6dab,	0x5170746b,
-0x6f04bfec,	0xca10ec0b,	0x2a870ec1,	0x551af839,
-0xcfbbbb16,	0xef91d864,	0xe9b9dde1,	0xf1fade18,
-0xe306f50b,	0xeb5253aa,	0x30010729,	0xb4169d72,
-0x3320e4f1,	0x9c6946e1,	0xdee63588,	0x4b2967be,
-0x167720ed,	0x6f27e397,	0x83419fdc,	0xac4386f3,
-0x0ac58383,	0x55c0dd4e,	0x62b4a145,	0x91d64a01,
-0x0e8acdb5,	0x40de995a,	0xc850ada1,	0xaa95a50a,
-0x14516378,	0x294a976e,	0x544fa118,	0x904c471c,
-0x8a5896d3,	0xb1486188,	0x237498dc,	0x1a1980b3,
-0xd339968f,	0xe735a8b1,	0xc5ee31e3,	0x35c64060,
-0x79cd8f43,	0xa2bb1974,	0x00189576,	0xf7bd74be,
-0xdd52d07c,	0xa20b9c8b,	0x98dadf9d,	0xf75c05be,
-0x476ac3a5,	0x6fb2bf82,	0x914c23c7,	0xd91c35e8,
-0x709ef212,	0x3d8f3ca6,	0x14c20046,	0x7015482e,
-0xb3fa2331,	0x78933f36,	0xc73c72b5,	0x645b4476,
-0x299fa727,	0x701d7717,	0xf6c4bfed,	0x3213dc65,
-0xfe66e1b4,	0x8040904c,	0xc536845b,	0xd1764a8d,
-0xdeb49b88,	0xdaf26115,	0x8160aa13,	0x206d4929,
-0x92fdb80a,	0x4f1aaab2,	0xfbbac21f,	0x2dc479da,
-0xd2ce1eab,	0xa7da6602,	0xa9fbe019,	0xdd58fac1,
-0x747ab469,	0x946a3b93,	0xc7b9cbe7,	0xc6f74040,
-0x8a8bee87,	0x07f65d07,	0xe79eb820,	0x64ef2fc1,
-0x72b1eccf,	0xc71f601b,	0x2812ab18,	0x48415edf,
-0x45a80c6d,	0x7f616640,	0xfeaa98d0,	0x1024f1e8,
-0x37b3735c,	0xc136f513,	0x5df10182,	0x1bd2ec03,
-0x07f04b3c,	0x59beeff2,	0xea0388f8,	0x2f6addc8,
-0xe0f282e2,	0xf9772673,	0x6bd0dc01,	0x3b4d6f9b,
-0x29b81515,	0x6c553377,	0x1136b69a,	0x50e03397,
-0x9c483ccd,	0xb0a13c9d,	0xea8e6bd6,	0xb8129b95,
-0xc085a4d1,	0x52f64f7f,	0x178aad6e,	0xe5c4d92a,
-0x4c35f2de,	0x8f179df7,	0xba405091,	0xd756e10d,
-0x23bfae39,	0x74015fee,	0x15dc3e64,	0xdfc05a18,
-0xa51ac3a0,	0x0ad4595a,	0x801363f0,	0x3db1f0c5,
-0x97a8ca8f,	0x7e74b015,	0x124d1664,	0x71b26596,
-0xaf073d4e,	0xf45d87d4,	0xd73c1dd0,	0xd1ade30b,
-0x8127545f,	0x4ba0585c,	0x5bb26da4,	0xd64fb76b,
-0x5c9c8190,	0xc1603512,	0xf7a69779,	0x1529ac38,
-0x8d9422c9,	0xac132697,	0x5f9ce586,	0x8d5ca1ce,
-0xba409dbd,	0x184b0698,	0x71bc5a54,	0x294e6b1c,
-0x085c38df,	0x629e955b,	0x73f5c2b8,	0x219166e4,
-0x9805fea9,	0x7602d837,	0x0932604b,	0x06a1509c,
-0x2afe3b47,	0x61050264,	0x0fba8fc2,	0x9f648238,
-0xbf3adf84,	0xdb8d2f92,	0xba2d9b51,	0x3d4415df,
-0x32811e41,	0x176a4519,	0x1ffd7d6b,	0xffe56807,
-0xca7db7a3,	0x5c811c87,	0x6bf1fe24,	0xc3013434,
-0x4ccc937e,	0x0a04797c,	0xca7dd4b5,	0x20ba4643,
-0x2b18ed89,	0x2ccf7a54,	0xd1a9e7a8,	0x67d96e26,
-0x9dd29473,	0x0f26a8f8,	0x164fb823,	0x17c5d3fc,
-0x26361bf0,	0x02544619,	0x32bbe44e,	0x12fbec8d,
-0x0a928412,	0x23652975,	0xe67465e7,	0xd1f49edc,
-0x200ce053,	0x1276b87a,	0xf5150061,	0xf509028d,
-0x4aa27234,	0x6fbc6156,	0x89e61e73,	0x612a7618,
-0x20783c3e,	0x152fda0c,	0x9a5c7b17,	0xebd39bba,
-0x9793ab7e,	0x053f88e4,	0xef9499c7,	0xdf5efc36,
-0xa2792729,	0x068ba6d6,	0xa5c5687e,	0x3924364a,
-0xa4c6c2e4,	0x45364a92,	0xda08f6ba,	0x1551c9a5,
-0xb4787235,	0x73d99aae,	0x584e52ec,	0xd76c6379,
-0xf852e104,	0xa335ab55,	0xd2b1013a,	0xc2c591f1,
-0x91ac865d,	0xe82497be,	0x39f62b27,	0x3d6a9530,
-0xb74f7711,	0xca3f54d4,	0x466e17e8,	0xe91d700d,
-0xbe8197a7,	0x04218b87,	0x587e7832,	0x838c1a71,
-0x39d27956,	0x36ecc542,	0x36b22957,	0x5c44fe01,
-0x86ae0bfe,	0x2ffa7c08,	0x603db66a,	0x69d7eed9,
-0xd96761bf,	0x44bc3358,	0x2c04707e,	0x290a0631,
-0xac627cd8,	0x1dd90751,	0x41e91a35,	0xf5dc1260,
-0x36564120,	0x1ac71792,	0x87e0a694,	0x063d0388,
-0x4f282802,	0x026fdbfd,	0x11102f9a,	0x5932ad11,
-0xc5f266d3,	0x27587435,	0x6fecaeb7,	0x191e6dda,
-0x50daedc2,	0xa282f89d,	0x89ceb660,	0x4564adc8,
-0x0cee73af,	0xed4f399f,	0x10085cac,	0x0d9ded47,
-0xa88956dd,	0x242798ad,	0xae708815,	0xf7edf1f7,
-0xb9fa65b7,	0xe8b4fcc1,	0x00fd86c4,	0x7ad67bce,
-0x66e3f423,	0xee1b4874,	0xccbc4116,	0x04a72b4b,
-0x39a640f0,	0xef9f5c48,	0xe8d1470d,	0xee1ef5d1,
-0x90784af3,	0xbc0b3389,	0x49aac119,	0xdf65d921,
-0x1023547c,	0x486b404a,	0x834d359c,	0xf5dbbd50,
-0x68b5997b,	0x7aee9417,	0x42e48286,	0xa9d8ee77,
-0x181a3e1e,	0x607cb99f,	0x5f53c78d,	0x5a60a6a8,
-0x39cfc04c,	0xfbe6eb32,	0x84348beb,	0xa278662b,
-0x398c625d,	0x3f9859e8,	0x5517ef17,	0x15856fe2,
-0xba4d33c1,	0xc93d7652,	0xcf40a2aa,	0x2ac37060,
-0x5efc6cab,	0xced95484,	0xf39ceed8,	0x4ecc8045,
-0x13c1e742,	0xd93d87f1,	0x695cf766,	0xcb53f961,
-0x15e0fc91,	0x37178627,	0x5e832076,	0x8c72db35,
-0x2ce047e6,	0x11d9e791,	0x45e4d466,	0x8b7a7c71,
-0xa83e9738,	0x7c54e924,	0x2ff12bda,	0x6b1ca347,
-0x2957b0a8,	0x1fdb23fa,	0x91f98947,	0xe02c3f1b,
-0xc42cbb06,	0xf0421ecc,	0x1716fce4,	0x1bb34813,
-0xc67853bd,	0x3a27d8f1,	0x8e38f3be,	0x9e5dc781,
-0x245017b1,	0x8cade69f,	0x44642f90,	0x3ef4215a,
-0x879c78ad,	0x371ddad7,	0x7c629ddb,	0xe5f61d71,
-0xbb3896fd,	0xcd3067f4,	0x4cfc2e12,	0xe7d69e64,
-0xcd35c838,	0x6af17c65,	0x322fec99,	0x81221d8b,
-0xa586497b,	0xb2cecfa9,	0xebbdaef4,	0x074fef30,
-0xf825db99,	0x2f916b7b,	0xdc32f01d,	0x915eddd6,
-0x96238f76,	0xf61c60df,	0x68795cf1,	0x46f1f13f,
-0xc9654740,	0x63872bc0,	0x51e210b6,	0x17b5c27b,
-0x7adf79d9,	0x7a823cc1,	0x02011b40,	0x6434a855,
-0x56eca557,	0xa14f4132,	0x8c120524,	0x778266f4,
-0x04ad9ca3,	0xccceab50,	0xecd117cc,	0xf0defcc9,
-0x4f573e38,	0x5393033b,	0x88684c7b,	0x1a33f3a7,
-0x898f45f0,	0x355ffa68,	0x174542c3,	0xa3dcfb8d,
-0x6cd09199,	0x67339d62,	0xd29348c7,	0x37431b9f,
-0x508c487c,	0xe4668bdf,	0xcbba1b72,	0x1b1b10a1,
-0xcd4447c0,	0xf9ee7e83,	0x871a0f4f,	0xa94572d2,
-0xac77a5c1,	0x3b84dbd4,	0xd45a09b6,	0x8e73228d,
-0x59f2bb36,	0x4855a81b,	0x3fafe19b,	0x2f612920,
-0xb9d216f3,	0x937e6a7e,	0xf31a2011,	0xfb7ca7fb,
-0x1ca50eef,	0xd1d2baec,	0xa19d932b,	0x620d57d4,
-0x086b7270,	0x5fcc7905,	0xb0dbe594,	0xf16f0a1d,
-0xd47563f5,	0xe54eeb3a,	0x588766e4,	0x0280ef61,
-0x8f26923d,	0x14b892bd,	0xdd11550f,	0x3e5ec618,
-0xed825fca,	0x52a04ef9,	0xaad0c980,	0xdff1a4ea,
-0x68f8954e,	0xc0f1664d,	0x6bc36a13,	0x5d36fbca,
-0x05f7883f,	0xd2da1028,	0xe3cd0e3e,	0xa4038605,
-0xb48e7f32,	0x1f5ffb16,	0x7c4899b2,	0xb3073d46,
-0xe2acb6e2,	0xefe17316,	0xca66163c,	0x93d4b562,
-0xa86a9d63,	0x07449ca1,	0xb499c9d4,	0x6c666b70,
-0x0d8c9f9d,	0x78c926a0,	0x99e4d31f,	0xd73c49ca,
-0xfd7e352a,	0xd710b7c6,	0x18100555,	0xb4e79321,
-0x5efc693a,	0x703180ef,	0x9bbb238b,	0xa105a3e4,
-0xdaa3ce4d,	0xff7cc846,	0x2bfbd556,	0x5f5ba34d,
-0x0ef8537b,	0xb0bc4e7b,	0x224f6dbf,	0x3b9ddb96,
-0xf731880a,	0x00d8d325,	0x55e4908e,	0x63bc2811,
-0xafa6f5cd,	0x5219a8c7,	0x4609390d,	0xd68e7ae1,
-0xc2e5e5dd,	0xf232712f,	0x1c52c242,	0x5a6cb79f,
-0x26667cb4,	0x0de1b656,	0x42ca30c0,	0x4ab64de9,
-0x26b0cfa4,	0x2897b6d1,	0xefc5d75e,	0x67ca7a04,
-0x805a805d,	0xf2e454cc,	0x837877a1,	0x8ca7dc3b,
-0x40620ce0,	0x5ac019fb,	0x6ee93d19,	0xae137f12,
-0x0cedbd2f,	0xacc51979,	0xec7ae13f,	0x4537c7b6,
-0xe3491fd6,	0x8e63f870,	0x1e08f6b3,	0x219dae5b,
-0x8db5d524,	0x8de9f8ee,	0x04913730,	0x7a11db72,
-0x6e4d0088,	0xa8713aba,	0xf2e72fd0,	0x2ba5695f,
-0xe11da489,	0x6a5ecdf5,	0xc2133568,	0x994cc9f4,
-0xed6825cc,	0x3d104599,	0x4d7679b6,	0x3bfe94f0,
-0xc6a131db,	0x6dfcc31c,	0x9ec5c4f6,	0x3a386a48,
-0x5d0b6f61,	0x059b5114,	0xd4831a86,	0x37460179,
-0x02f23600,	0x1c04bd2e,	0xbf689d81,	0x2bf0be1c,
-0xd8d5974c,	0x0d9d0709,	0x5dcade38,	0x167df39e,
-0x96942861,	0xf1e6a09c,	0x16ac7082,	0x5037af19,
-0x69c40dbb,	0x10728698,	0x71d52ed0,	0xa77036b8,
-0xa050ea5f,	0xa7ca5494,	0xa25b4acd,	0x7f8ceb12,
-0x8f03bc78,	0x6b7ee0f3,	0xa97d44b3,	0xeda32377,
-0x852c4597,	0x3f81aa95,	0xf148a2da,	0x770e5cb6,
-0x90fe1806,	0x50620299,	0xd7f4042b,	0x0d356595,
-0x5596e5dd,	0x6c797c13,	0x500c0ee5,	0x7e5ae4c5,
-0xecf3ac43,	0xae09d902,	0x95b72b10,	0x7597d441,
-0x8d719da8,	0x151b5d1c,	0x1f6790f9,	0x1147be9f,
-0xee857fb4,	0x6f34c63c,	0xb5211613,	0x831687d1,
-0x80e19a47,	0x1bb032f0,	0x5341a6f2,	0xc9a32ec1,
-0xad2521c2,	0x359e67d5,	0xeb4fa538,	0x1cc294ee,
-0xab08e4ee,	0x491c2562,	0xe1e38431,	0x039787ad,
-0xa3cc1cd4,	0x3ff47385,	0x0f442100,	0xd40d9c3e,
-0xcd033c28,	0x400eaf93,	0x5017c05d,	0x98554fb3,
-0x3de23fb4,	0xaa7d549c,	0x6be71942,	0x78577be6,
-0x47aa0dd7,	0xa1226946,	0xcb703f76,	0x023e8ff2,
-0x649fd255,	0xa927f029,	0xe2cfa7b3,	0x03a6ce51,
-0xf674945b,	0x77f3c516,	0x41eb2b88,	0x5be10c42,
-0x88a250be,	0xc30b371b,	0x8711bcb0,	0xaba1efe7,
-0x0446f6d0,	0xe7ff87ba,	0x879b4aa6,	0xb033052e,
-0xa388c8ab,	0x3344d7ab,	0xa81b3a68,	0x895fb4ff,
-0xe4efddc9,	0x7c69bba5,	0xbd7226cf,	0xca2e3b74,
-0xba316a72,	0x087b68ba,	0xa0234a53,	0x51f6447a,
-0x1c6c1312,	0x52e597e7,	0xc50f49ee,	0x064ce0c7,
-0x70f67efe,	0xcaf13ee0,	0xd68fc906,	0xa5a173a8,
-0xde41697f,	0xc8b09415,	0x8a08cd8f,	0x2ac8a7ed,
-0xac323499,	0xf55a3c3e,	0xd487d5c3,	0xb8940642,
-0x73cd4073,	0xfb15c814,	0x775f4fe8,	0x2b42622c,
-0xa53339a1,	0x305c5717,	0xcdae12bf,	0x8facff91,
-0x86728c4f,	0xde5967a7,	0xaefa7393,	0x60fc32e4,
-0x4ddd7ad9,	0x020ac80d,	0xd87b74e7,	0x7ffcdc79,
-0x6e7ebe24,	0x561f95a0,	0x2523a129,	0xd40136d7,
-0xd253e4db,	0x8339b140,	0x71f6d4cf,	0x9bbfd0df,
-0xc54f7b50,	0x6c13a6fd,	0x09e9596d,	0xa71eaa48,
-0x5b8a7c0a,	0x5cf679df,	0xcab512b5,	0x61623502,
-0xe002bd96,	0x5e7b9889,	0xb029fae3,	0x85ae825e,
-0x0cb81cf4,	0x7b8d598e,	0x1b1b4c43,	0x723f793e,
-0xc2d0120d,	0xfa704e12,	0x0529301e,	0x6d7c1536,
-0xe4008061,	0x319c2fce,	0x4dbb7c85,	0x989ae3e5,
-0x877539d3,	0x9d77a472,	0x75e0ec43,	0x5243baa3,
-0x7866e10c,	0xd71618ac,	0xc87934bd,	0xe96101d1,
-0x55d1976c,	0x471c8505,	0x7a36d839,	0x5d62a9ee,
-0xf3c54a8a,	0xa2be15d9,	0x244087c9,	0x042c8037,
-0x23224689,	0x281c5d73,	0x2139ecfc,	0xffb8bc8a,
-0x834fdd11,	0x9cd5a5bd,	0xa3368319,	0x7e5bef0c,
-0x4ae2dbda,	0x86d90089,	0x6675dfce,	0x48876262,
-0xcec72538,	0x11dc5c80,	0x86a730f9,	0x313565c9,
-0xe3e5be11,	0x106d7cce,	0x752b8be2,	0x3d00a5bc,
-0xe6f70e95,	0x44447ac8,	0x600df30c,	0x8335ac3b,
-0x8816ddee,	0x700982fe,	0xee495741,	0x48c7e81c,
-0xa3d55da2,	0xb0172982,	0x70ab2158,	0xd4460621,
-0x3a9e528b,	0x59b18a7b,	0xf4dabc4c,	0xa8454763,
-0x70877bb6,	0x66005c97,	0xaf292c06,	0x7b843db1,
-0xf343b59b,	0x25cdc7b5,	0xa41da617,	0x9e9d895e,
-0xc936f475,	0x7270925a,	0x30024230,	0x8e72f53d,
-0x2b6c1b6f,	0x1a69732c,	0x7ed5aff5,	0xfc18a2a3,
-0xaf377cc1,	0xbff09a78,	0x4b4e0814,	0x95a0b2c1,
-0x270398de,	0x201fca94,	0x2a032a4f,	0x131542b4,
-0x0d7306da,	0x2d1c3496,	0xcc3c6d8d,	0xa814ddc9,
-0xa3b3a991,	0x17ee60c2,	0x852c0b8d,	0x11e5853a,
-0x762002a7,	0x92c5311d,	0x0d4bf7e1,	0xfffec870,
-0xe3d35e5b,	0xff6ecfb9,	0xdedae6ff,	0x0111a772,
-0x9808e780,	0x29c336e8,	0xe9bc05df,	0x5bedde11,
-0x945565af,	0xaff808fe,	0x87e3423d,	0x4de6f98f,
-0x93b4adef,	0xbf704fa4,	0x09120e91,	0xd54f3692,
-0xdf8eab1e,	0xfabbf59c,	0xe74318be,	0xaab87ffc,
-0x29fa791c,	0xe3915552,	0xa652cb9b,	0xa1252e74,
-0xb35b723b,	0x542aa28b,	0x12fcc5b0,	0x3941f962,
-0x82bcc6cc,	0x47b11974,	0xb821611f,	0x78b34250,
-0xf1be5659,	0x561b9e61,	0x6f3bd501,	0x584e6f5c,
-0xd54ed547,	0xacebcd21,	0x7b5ff816,	0xb64ad233,
-0x9f2f330d,	0x69fb1ece,	0xac8710dd,	0x58dc6c60,
-0x9bee6139,	0xbb10ad0e,	0xbd8cd5dd,	0xebc0ce9d,
-0xa733274f,	0x884d9b55,	0x42b08b63,	0xafa54a74,
-0x1c7ccf64,	0x93a20191,	0xaaa3132e,	0xc69831d1,
-0x54634889,	0xfbfe3efc,	0xd3cf68d4,	0x302e3117,
-0xf5693131,	0xc3ce8c6c,	0x1f03cd89,	0x6243334c,
-0xf16bc80f,	0xdca5f130,	0xcb2cd956,	0x4c1bb421,
-0xe8de533c,	0x7f86703a,	0x29aa897e,	0xdd54acad,
-0x76b2f2ae,	0x7ef82b71,	0x2e30970b,	0xba402597,
-0x9a653ab4,	0xd68fcf53,	0x2d9f0d15,	0x7f9efd1c,
-0x2363d147,	0x5327289a,	0xe89229f3,	0xd63a535c,
-0x7efe9273,	0x64f2e3a3,	0x9bdf65a7,	0x26b6edfb,
-0x1b9c7bfe,	0x5d14b3de,	0x54d575fb,	0x6d65db4c,
-0x95648b7f,	0xa8a3b8f0,	0x7cc7ad46,	0xe20e6dbb,
-0x8488a45f,	0x8ebc2932,	0xd4767316,	0x3e8c4b8a,
-0xbab7402c,	0xfc1e217e,	0xe5c5bf82,	0x6928fe2e,
-0xc88528e9,	0x4b2e4e8f,	0xdd938b86,	0x0c964f98,
-0xfc88d480,	0x35fcaf9e,	0xdd7bbe9d,	0x197d005a,
-0x4d40b3b3,	0xcf203155,	0x0d2fa621,	0x752d2c58,
-0xb12bac12,	0x1e7e8c23,	0x94215d54,	0x9854a71c,
-0x4de63c64,	0x7a012529,	0x9c171f8d,	0x9e71def7,
-0x3bd17d50,	0x11f175d9,	0xec78abf3,	0x7b529eee,
-0xd3a69fc3,	0x5b718676,	0x58214d29,	0xa8bd2c34,
-0x41ea00ab,	0xa03f64d6,	0x4ee342b0,	0x32b1e444,
-0x1c1801a4,	0xc8424702,	0x334a7e35,	0x50cf1543,
-0x3b22b495,	0x88683776,	0x8e2e0154,	0x6155c033,
-0x4e2fa6ac,	0x42ace700,	0x8d64f97c,	0xaf9ced17,
-0xb2a5cb92,	0xa558582d,	0x88705de7,	0x9e528d59,
-0x84bd45e4,	0x5cb680c0,	0xcd48fa5c,	0x2722bfa2,
-0x10462123,	0x30080f7d,	0xb346cd81,	0x0049c396,
-0x4e24165f,	0xa7c66809,	0x2e60bdcf,	0xaad70a08,
-0xa73ea713,	0xe28f97a7,	0x283a9eab,	0xd4366489,
-0xe776f963,	0x64ffa8ae,	0xde717b50,	0xbd2ca2b5,
-0x3bae5f6d,	0x8d2bbef1,	0x7e9181e6,	0xf06aa121,
-0xd06b2d20,	0xa83ea826,	0xef935e4f,	0xdfd27456,
-0xa3451468,	0xc6820a63,	0x43463105,	0x787697aa,
-0xcba5543d,	0xdf7e1e2d,	0x6998a8af,	0x98ce6c08,
-0x89de731a,	0x943a3510,	0xb36ead85,	0xd5258d4b,
-0x1cd6df61,	0x82a5c59d,	0xd078e7a4,	0xa33d4317,
-0x24dc45f8,	0x3f3daf27,	0x0478bc6f,	0x92dfa16c,
-0x952a872e,	0x7a34e03f,	0x0f088084,	0xa40937fe,
-0x38fc7749,	0xa157e8a4,	0xbce94344,	0x7045ff7b,
-0xf3e1ab66,	0xe62a6058,	0x5564ff10,	0x38198f1e,
-0xf326f0f1,	0xe262bc0c,	0x2f0b851a,	0xc7bcbe11,
-0xe79f1d1a,	0xc2f93c29,	0x54f3ea9f,	0x8f8f9141,
-0x9f45e13c,	0x7a5b86bd,	0xa764efd8,	0x35f04729,
-0xdd8c4b54,	0x5fa12e51,	0xa5824af9,	0xad328f71,
-0x0f11fbb9,	0x9048e950,	0x04d7a900,	0x02538d1f,
-0x99f745b7,	0xe31f63bb,	0x2c4e3d78,	0x7cdb9245,
-0xa3966ee7,	0x27c4433a,	0xe1d79f3e,	0xe640fa06,
-0x79ce31eb,	0xf25634fa,	0xdd9ce5cb,	0xb7fab8d2,
-0x2f1f0ff2,	0x2acb625c,	0xa0494989,	0x206d7f11,
-0xf268b8ca,	0x292bbf9f,	0x763bd7d0,	0xea4b14fc,
-0x9d3d6aeb,	0x64cca57e,	0x6fc3e29e,	0x3e7bf4bf,
-0x90efc7e3,	0x08e39173,	0xd05bee2c,	0x5b3c8f37,
-0x0921ec6f,	0x3371b715,	0xb324e114,	0xe3abc53f,
-0x576b18f8,	0xc4469024,	0xb2ded6c6,	0xe7783782,
-0xc0a1fd5d,	0xcf324bde,	0x97527c8e,	0x19f8f48c,
-0x3e806a5d,	0x96cff225,	0xe3b9d04a,	0x0e5856ae,
-0x781372f6,	0x9645f2b7,	0x95a743ed,	0xd0c7eded,
-0x86ca3cd9,	0xbab94db0,	0x43a1233a,	0x89c55554,
-0xee776239,	0x34aa0098,	0x66a6e1d4,	0xae0e233e,
-0x717e7b29,	0xb403a4c1,	0x36eb96c5,	0x42140832,
-0x04250936,	0xda375dca,	0x524cb2e6,	0x86deaa0c,
-0x400dc9d1,	0x12c00364,	0xe3ca7cf5,	0x87f20da7,
-0xf57df9ef,	0x580dbdfc,	0x0b3e0369,	0x014d27fd,
-0x4afaf6a1,	0xd1f4ca09,	0x77abc831,	0x30e49729,
-0xec61cd2c,	0x159c1e92,	0xb61b40b1,	0x17c66fd6,
-0xde11c061,	0x79d7f792,	0xc709cbfa,	0x94201c89,
-0xbe65137d,	0x18aea1b4,	0xf248bbc3,	0x465f957d,
-0xcf4a9672,	0xbf293fd2,	0x2c5e31c9,	0xc2c73011,
-0xfb29cbf2,	0x576f7f0b,	0x74de1745,	0xa76e172b,
-0x99b96223,	0x14ce1502,	0x231013fb,	0x1d4df40a,
-0x951b0c16,	0xab173e66,	0x4ff65f74,	0xc4a87a47,
-0x09cc3370,	0x66385490,	0x73e09118,	0x4ee96432,
-0x0164d347,	0x205069b5,	0x158dd226,	0xc932c238,
-0xe9048fa2,	0x100b626a,	0x86ee08cd,	0xed87cb1c,
-0x6353ec37,	0xa36edcc3,	0x8a16dd6b,	0xd28a4198,
-0xebea1127,	0xca0b761a,	0x61c31acf,	0xced5ff4f,
-0xbf4dbd8f,	0xd969d8a7,	0xb6e4e9e8,	0x8421c402,
-0x809d7222,	0xabfd1d2f,	0xc1857ce5,	0x23958fd7,
-0x3226f1d3,	0xd822b4cc,	0x2f1cc3aa,	0x501fe01e,
-0xe36f8c94,	0x7ad27716,	0x3321308b,	0xa85b957b,
-0x38cfdf6e,	0xc7497dd5,	0x2462090c,	0x8f9e42e7,
-0xdf97684a,	0xac8af621,	0xd5224866,	0xc5f64e50,
-0x9724f297,	0xc386097b,	0x48c6f98a,	0xe1478b1a,
-0x2dd23fd8,	0x716b2d85,	0xa5c3789b,	0x53625e80,
-0x9b8b312c,	0xce482165,	0x66161e35,	0x64ecb56a,
-0x9981c46a,	0xe6cb6bb3,	0xe1983186,	0x75ed470f,
-0x4adcbd27,	0x3efeda68,	0x4d193a2a,	0xbfdb3cd4,
-0x7c6167b6,	0xdbddea68,	0x4b0d2d62,	0x00ba3860,
-0x49ec2544,	0xa68698c9,	0x2ce7be1b,	0xf5afc9fc,
-0x1cebf9c3,	0x350f8f5b,	0x893eefb8,	0x77414f6f,
-0xe46f26fa,	0x67bf6398,	0xd6858f5d,	0xac73db2a,
-0x58e20acc,	0x750dd76a,	0xb7930e80,	0x8a8796c0,
-0x44c86997,	0xb1807742,	0x3c827dc1,	0x381aaa3c,
-0x83ac76f3,	0x57f0a2d6,	0x18261009,	0xe107138f,
-0x85711c22,	0x2e1d982f,	0x7062179a,	0xaedfa298,
-0x62e438f2,	0x6d325a9a,	0x99b489d3,	0x1bf77b3a,
-0x28ca20e8,	0x502d1b21,	0x74a833c0,	0xbeb91634,
-0xf56ffef9,	0x05401164,	0xe5dbab51,	0x0a2b460d,
-0x2f0d9c22,	0xc74472f9,	0x12da5199,	0x68b2d628,
-0x9a118f9a,	0x9035d200,	0xcda0221f,	0x12430cde,
-0x79a43fbb,	0x5bb5e1b7,	0xeab5ed62,	0xe6a11e32,
-0x3118b0fa,	0xedbcfb64,	0xd2285490,	0x824023c6,
-0x30311fb1,	0xa0a4a475,	0xbfa8ac55,	0xb8c8fbda,
-0xdf3cab63,	0x8d805566,	0xf52c1b1a,	0xa3471090,
-0x02328a4a,	0x5d1dce57,	0x196aea39,	0xcd0f640b,
-0x2fa01c27,	0x6175f783,	0xb2b6a0e4,	0x02fe6171,
-0x2d3cb20b,	0x25f331e6,	0xacfa8085,	0x46a09a58,
-0x27bbfb9e,	0x3914f970,	0x73e35206,	0x8bb87194,
-0xdb58fc4b,	0x62fd53ff,	0x2c942c7c,	0x3f4681ba,
-0xeada1780,	0x5dfbb960,	0x8473948a,	0x80787902,
-0x049c20ba,	0x9e95a4fc,	0x8526d8ac,	0x3dcdcd2d,
-0xb9562f16,	0xc9c8eb08,	0x533ed0a2,	0xa34d5d73,
-0x3e579c8e,	0x235bb378,	0x36576983,	0xc71f11b2,
-0x035eae76,	0xbec23972,	0x8613e5e9,	0x3982899a,
-0xe5a55d62,	0x3c45a7e9,	0xbd4d6def,	0x17ae0a5f,
-0xf0f53bb8,	0xa3dd1e29,	0x36f9520b,	0x72cbd950,
-0x4d762d12,	0xe03cb7a8,	0xf8c8c1fe,	0xa4ff17a1,
-0xcc779472,	0x83f9b379,	0xa2fc038c,	0xdd3b8104,
-0x95936bb0,	0xf36c9705,	0x93939e08,	0xc98576ac,
-0xec9196d1,	0xc8bce622,	0xb48e1075,	0x98dbd77d,
-0xd1b04c3d,	0x85d1d422,	0x20765885,	0xc6a17eb5,
-0x8e913cdc,	0x3f7a6758,	0x08176f48,	0xba2ea15f,
-0x3638114d,	0xf08cb49b,	0xb8b6d9ce,	0x4e55891a,
-0x2775c022,	0xc8d45982,	0x529c2eb3,	0xde080e24,
-0xdac9c028,	0xeec68934,	0x8eaace11,	0xe82e05aa,
-0x00033a20,	0x4ec94b5e,	0x445f5562,	0xa5c58462,
-0xb6942526,	0x44631607,	0x5065644c,	0x14946f9c,
-0xa9cb0e63,	0x53dff50a,	0x3f18fa24,	0x20b3b811,
-0x95c1e57b,	0x1523d301,	0xc4e24932,	0x41a9be80,
-0x24fc45b0,	0xccff2cbc,	0x996af6a1,	0xe3f201c3,
-0x0917ea23,	0xbf4a1ac3,	0xbb0db6f1,	0xd15772df,
-0xb1465383,	0x61400275,	0x571f6b1d,	0x0a4407f7,
-0x916cfbce,	0x114f042a,	0x1cb9b3a6,	0x1b34c85a,
-0xe36acc8d,	0xab109469,	0x5af9a63a,	0xccd4defc,
-0xb758adfd,	0xbd8ddecf,	0x5ffe8424,	0xd73e2a4b,
-0xb41cb99e,	0x01a52553,	0xba70e749,	0xf81d7557,
-0x2b4f0847,	0xa22e281f,	0x5c653c31,	0x89bdb546,
-0xa596e592,	0xbca4cbf4,	0xc3d1dfe3,	0x64a21c2e,
-0x159aa4b7,	0xed90f2d6,	0xb1164cb0,	0x86de0088,
-0xfd4e49e6,	0x70702b0d,	0x946b532b,	0x03a0144e,
-0x71fb19ed,	0x07c41763,	0x63312ce9,	0x0e2f5ee4,
-0xc6501661,	0x09599e4e,	0x544fd5cc,	0x054d842c,
-0x902bb57d,	0xdf82a365,	0xb7ae9427,	0xa6750881,
-0xeee3c9cd,	0x6cbe0f45,	0x7f72d3f9,	0x430b786f,
-0x162b6004,	0xbfcd440b,	0xdc4f5c81,	0x82249f6b,
-0x98d1cdca,	0x2cc2692e,	0xf977f83a,	0x570c1e1f,
-0x24ed6461,	0xcae5afea,	0x9cf06576,	0x9199d69c,
-0x883febfe,	0x0f254c42,	0x6eb50978,	0xf91fade4,
-0x9cfe5488,	0xfe3bf66b,	0x86ea94e3,	0x1bed23f5,
-0x0bded397,	0x0cde064b,	0x7abd7a81,	0x8efb798e,
-0x9a78e5f2,	0x7c46d76f,	0xcb3ae1ea,	0xc33e7ab1,
-0x0c3993f0,	0x5b2d8de7,	0x24948ba8,	0xffce06e6,
-0x0d3c2dc2,	0x3ae09142,	0x7e6b932e,	0xb3e22558,
-0x9f7c425e,	0x8fa1329b,	0x24aa5012,	0xb9e49bc7,
-0x787dd5a6,	0xf68c8171,	0x440d2146,	0x9734857f,
-0x8c30c31a,	0xcb3352a1,	0x46b04f38,	0x72572ef8,
-0xc90c56df,	0xe8103fa8,	0x04057577,	0xd1c250d9,
-0x5cb390a9,	0xbdba74b9,	0x80012fa3,	0x408216c2,
-0xadca83bc,	0x3c39bcdf,	0xf0da9459,	0x421d5a3d,
-0xc5cf55c9,	0x2dcfa63d,	0xd852066b,	0x606b2204,
-0x4d5e9576,	0xe8d6475f,	0xe46ec6b0,	0xf4e3c2c6,
-0x1bfe1bb0,	0xc2803818,	0x2a3e4809,	0x947e50a1,
-0x3a10e713,	0xc9e070cc,	0xa4244fe4,	0xa7f5d2e7,
-0x194f77ee,	0x76754ab4,	0x75ed4e5f,	0x92ffdbaa,
-0x1f5bce6a,	0x14aeeec7,	0x366fbb47,	0x44ecec7b,
-0xbc31e911,	0xee6c224f,	0x0a6f7376,	0xbe79fce3,
-0x53a18077,	0x6f6ad5fe,	0x945938bd,	0x61bb760c,
-0xed26220f,	0x9f492f0a,	0xaf0f2d80,	0x265f5449,
-0xae1f2dc3,	0xd235910c,	0x44a0f4a0,	0x36fcc004,
-0x1e8fa223,	0xe7440ed0,	0xa8535548,	0x6d7e7029,
-0x2e1b7968,	0xf3baa61d,	0xf447ef12,	0x701d62d6,
-0x2da5dcf4,	0x44828196,	0x41af9c9a,	0xab210662,
-0xa5ee18f2,	0xd45eb369,	0x947814fe,	0xeb62eb49,
-0x30c555c6,	0xdc06ccbd,	0x786705d2,	0xd50c80d3,
-0x266d8313,	0x68f63164,	0x1e3e4322,	0xfc23834e,
-0xe879261f,	0x28992a8f,	0xab86dac9,	0x19f88d1a,
-0x5110c867,	0x3c050155,	0xf9b1b3f5,	0x98909489,
-0xfa0ee6bc,	0x038fb4ce,	0xbe1c9e33,	0x18f96bcd,
-0xa1635c9a,	0xff3e9374,	0x5b033171,	0x0b84bfd9,
-0x3c091bae,	0x6da61a4e,	0x07d81b5d,	0x3904ea3c,
-0x75f4e7f1,	0x3e70c12e,	0x9c70d835,	0x9a1ea5a6,
-0x4b99b705,	0x08f6ab89,	0x7649901c,	0xee3e7687,
-0xa3deb48c,	0xd74e8c78,	0xe8e120c3,	0x425d3d96,
-0x16f136bd,	0x0c7a32ef,	0x37a0ff53,	0x77b035e4,
-0xba8808c1,	0x1d3d8330,	0x8d224cce,	0xed789fed,
-0x550a8352,	0xe2715912,	0x185f62d1,	0xe301002a,
-0xbe2ed99b,	0xbb1dfd60,	0x9d22d8f9,	0xcbfa36d5,
-0xad7e92e0,	0xd2db61d4,	0x1df386f5,	0x92b5797c,
-0x00ac8ed1,	0x2f7470b1,	0x674e258b,	0x6689df79,
-0x135c5c1a,	0x87abbc50,	0x19ac082b,	0xe7f7d64c,
-0x24fd4922,	0x7eeadc29,	0xa0910eaa,	0x763231d6,
-0x23597ccb,	0x332f33c3,	0x93992b6a,	0x19c8937c,
-0x75d6a9f4,	0x221395e1,	0x662914d0,	0x997d7860,
-0xd196adeb,	0xa5402fd9,	0x8bd6f12f,	0xc31d97e0,
-0x304dd9dc,	0x72f35c72,	0x8ced870e,	0x1eef8a14,
-0x323321fa,	0xf193079f,	0x18026b1c,	0x5a1107a5,
-0x54979f4b,	0x6afee492,	0x04c012e6,	0x3446250c,
-0x25a691a8,	0xc19a76ea,	0x66bd5b14,	0x6250bd2d,
-0xc6c082d9,	0x67ea1d78,	0xbe68a7ef,	0x03f50dc8,
-0xd8f76566,	0xb6681752,	0x00e2b087,	0x7ed2e598,
-0x8c9cbc83,	0x103b03f5,	0xee4d2723,	0x67b3903f,
-0x1e057dec,	0xc5703ba6,	0xae0615f9,	0x1bce0df2,
-0xfd041279,	0xc874a2c3,	0x0a91d2fa,	0xac098457,
-0xc1efc5f9,	0xd48208eb,	0x72e9baa8,	0x184dc658,
-0x3d26b8b4,	0x90e2469d,	0x6d07f351,	0x3f6898a7,
-0x21e4de0b,	0x0fd04a43,	0x2c99cd2b,	0x44b28cdd,
-0xaf5483a5,	0xe50b9a12,	0xd98fe031,	0x9d6e8f08,
-0xf385ba19,	0x5e531cb0,	0xc545867a,	0x65f5ebf5,
-0x9f27ad5a,	0x2de11f0d,	0xef6f0970,	0x973b11f2,
-0x72228c07,	0xe13fdb84,	0xd2a7b46f,	0xc85a38db,
-0x331a9807,	0x3be38ebc,	0x3e7bf15d,	0xa82a1e68,
-0x4b42b5bc,	0x9871203e,	0x7d1e1e24,	0x12f57b6b,
-0xf5403ec8,	0x28746c33,	0xae20522f,	0xf6042fba,
-0x66bada5d,	0xbefe376f,	0xfd3773a5,	0xbb5fc6e8,
-0x34c0433d,	0x3cfc83e9,	0xd096736a,	0xa53be016,
-0xeba3dd6c,	0x2c626561,	0x3c160c8d,	0x8506c719,
-0x802e7b47,	0x16079396,	0x6d29b175,	0x4e91abb4,
-0xe350ce95,	0x0d481aa5,	0x94e95371,	0x10dc4dec,
-0xbfeb3735,	0x3ce3cb4d,	0x32ff742a,	0xac5ad3cb,
diff --git a/usr/src/cmd/varpd/Makefile b/usr/src/cmd/varpd/Makefile
new file mode 100644
index 0000000000..8c29829d40
--- /dev/null
+++ b/usr/src/cmd/varpd/Makefile
@@ -0,0 +1,76 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+PROG= varpd
+OBJS = varpd.o
+SRCS = $(OBJS:%.o=../%.c)
+SVCMETHOD = svc-varpd
+MANIFEST = varpd.xml
+ROOTLIBVARPD = $(ROOTLIB)/varpd
+ROOTLIBVARPDPROG=	$(PROG:%=$(ROOTLIBVARPD)/%)
+
+
+include ../Makefile.cmd
+include ../Makefile.ctf
+
+ROOTMANIFESTDIR=	$(ROOTSVCNETWORK)
+
+CLEANFILES += $(OBJS)
+CPPFLAGS += -D_REENTRANT
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lvarpd -lumem -lscf
+$(NOT_RELEASE_BUILD)CPPFLAGS += -DDEBUG
+
+#
+# Our debug only umem related functions cause lint to get confused.
+#
+LINTFLAGS += -erroff=E_NAME_DEF_NOT_USED2
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+clean:
+	-$(RM) $(CLEANFILES)
+
+lint: lint_PROG
+
+%.o: ../%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+check: $(CHKMANIFEST)
+
+clobber: clean
+	$(RM) $(PROG)
+
+install: $(PROG) $(ROOTLIBVARPDPROG) $(ROOTMANIFEST) $(ROOTSVCMETHOD)
+
+$(ROOTLIBVARPD):
+	$(INS.dir)
+
+$(ROOTLIBVARPD)/%: % $(ROOTLIBVARPD)
+	$(INS.file)
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/varpd/svc-varpd b/usr/src/cmd/varpd/svc-varpd
new file mode 100644
index 0000000000..c7483a033e
--- /dev/null
+++ b/usr/src/cmd/varpd/svc-varpd
@@ -0,0 +1,32 @@
+#!/usr/bin/sh
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+. /lib/svc/share/smf_include.sh
+
+#
+# For the time being, we're going to manually make sure that the
+# overlay driver is loaded. We probably shouldn't do that in the long
+# run, but it helps for bootstrapping
+#
+add_drv overlay 2>/dev/null
+
+/usr/lib/varpd/varpd
+if [ $? = 0 ]; then
+	exit $SMF_EXIT_OK
+else
+	exit $SMF_EXIT_ERR_FATAL
+fi
diff --git a/usr/src/cmd/varpd/varpd.c b/usr/src/cmd/varpd/varpd.c
new file mode 100644
index 0000000000..8131604537
--- /dev/null
+++ b/usr/src/cmd/varpd/varpd.c
@@ -0,0 +1,526 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015 Joyent, Inc.
+ */
+
+/*
+ * virtual arp daemon -- varpd
+ *
+ * The virtual arp daemon is the user land counterpart to the overlay driver. To
+ * truly understand its purpose and how it fits into things, you should read the
+ * overlay big theory statement in uts/common/io/overlay/overlay.c.
+ *
+ * varod's purpose it to provide a means for looking up the destination on the
+ * underlay network for a host on an overlay network and to also be a door
+ * server such that dladm(1M) via libdladm can configure and get useful status
+ * information. The heavy lifting is all done by libvarpd and the various lookup
+ * plugins.
+ *
+ * When varpd first starts up, we take of chdiring into /var/run/varpd, which is
+ * also where we create /var/run/varpd.door, our door server. After that we
+ * daemonize and only after we daemonize do we go ahead and load plugins. The
+ * reason that we don't load plugins before daemonizing is that they could very
+ * well be creating threads and thus lose them all. In general, we want to make
+ * things easier on our children and not require them to be fork safe.
+ *
+ * Once it's spun up, the main varpd thread sits in sigsuspend and really just
+ * hangs out waiting for something, libvarpd handles everything else.
+ */
+
+#include <libvarpd.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <libgen.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <paths.h>
+#include <limits.h>
+#include <sys/corectl.h>
+#include <signal.h>
+#include <strings.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <thread.h>
+#include <priv.h>
+#include <libscf.h>
+
+#define	VARPD_EXIT_REQUESTED	0
+#define	VARPD_EXIT_FATAL	1
+#define	VARPD_EXIT_USAGE	2
+
+#define	VARPD_RUNDIR	"/var/run/varpd"
+#define	VARPD_DEFAULT_DOOR	"/var/run/varpd/varpd.door"
+
+#define	VARPD_PG	"varpd"
+#define	VARPD_PROP_INC	"include_path"
+
+static varpd_handle_t *varpd_handle;
+static const char *varpd_pname;
+static volatile boolean_t varpd_exit = B_FALSE;
+
+/*
+ * Debug builds are automatically wired up for umem debugging.
+ */
+#ifdef	DEBUG
+const char *
+_umem_debug_init()
+{
+	return ("default,verbose");
+}
+
+const char *
+_umem_logging_init(void)
+{
+	return ("fail,contents");
+}
+#endif	/* DEBUG */
+
+static void
+varpd_vwarn(FILE *out, const char *fmt, va_list ap)
+{
+	int error = errno;
+
+	(void) fprintf(out, "%s: ", varpd_pname);
+	(void) vfprintf(out, fmt, ap);
+
+	if (fmt[strlen(fmt) - 1] != '\n')
+		(void) fprintf(out, ": %s\n", strerror(error));
+}
+
+static void
+varpd_fatal(const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	varpd_vwarn(stderr, fmt, ap);
+	va_end(ap);
+
+	exit(VARPD_EXIT_FATAL);
+}
+
+static void
+varpd_dfatal(int dfd, const char *fmt, ...)
+{
+	int status = VARPD_EXIT_FATAL;
+	va_list ap;
+
+	va_start(ap, fmt);
+	varpd_vwarn(stdout, fmt, ap);
+	va_end(ap);
+
+	/* Take a single shot at this */
+	(void) write(dfd, &status, sizeof (status));
+	exit(status);
+}
+
+/* ARGSUSED */
+static int
+varpd_plugin_walk_cb(varpd_handle_t *vph, const char *name, void *unused)
+{
+	(void) printf("loaded %s!\n", name);
+	return (0);
+}
+
+static int
+varpd_dir_setup(void)
+{
+	int fd;
+
+	if (mkdir(VARPD_RUNDIR, 0700) != 0) {
+		if (errno != EEXIST)
+			varpd_fatal("failed to create %s: %s", VARPD_RUNDIR,
+			    strerror(errno));
+	}
+
+	fd = open(VARPD_RUNDIR, O_RDONLY);
+	if (fd < 0)
+		varpd_fatal("failed to open %s: %s", VARPD_RUNDIR,
+		    strerror(errno));
+
+	if (fchown(fd, UID_NETADM, GID_NETADM) != 0)
+		varpd_fatal("failed to chown %s: %s\n", VARPD_RUNDIR,
+		    strerror(errno));
+
+	return (fd);
+}
+
+/*
+ * Because varpd is generally run under SMF, we opt to keep its stdout and
+ * stderr to be whatever our parent set them up to be.
+ */
+static void
+varpd_fd_setup(void)
+{
+	int dupfd;
+
+	closefrom(STDERR_FILENO + 1);
+	dupfd = open(_PATH_DEVNULL, O_RDONLY);
+	if (dupfd < 0)
+		varpd_fatal("failed to open %s: %s", _PATH_DEVNULL,
+		    strerror(errno));
+	if (dup2(dupfd, STDIN_FILENO) == -1)
+		varpd_fatal("failed to dup out stdin: %s", strerror(errno));
+}
+
+/*
+ * We borrow fmd's daemonization style. Basically, the parent waits for the
+ * child to successfully set up a door and recover all of the old configurations
+ * before we say that we're good to go.
+ */
+static int
+varpd_daemonize(int dirfd)
+{
+	char path[PATH_MAX];
+	struct rlimit rlim;
+	sigset_t set, oset;
+	int estatus, pfds[2];
+	pid_t child;
+	priv_set_t *pset;
+
+	/*
+	 * Set a per-process core path to be inside of /var/run/varpd. Make sure
+	 * that we aren't limited in our dump size.
+	 */
+	(void) snprintf(path, sizeof (path),
+	    "/var/run/varpd/core.%s.%%p", varpd_pname);
+	(void) core_set_process_path(path, strlen(path) + 1, getpid());
+
+	rlim.rlim_cur = RLIM_INFINITY;
+	rlim.rlim_max = RLIM_INFINITY;
+	(void) setrlimit(RLIMIT_CORE, &rlim);
+
+	/*
+	 * Claim as many file descriptors as the system will let us.
+	 */
+	if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) {
+		rlim.rlim_cur = rlim.rlim_max;
+		(void) setrlimit(RLIMIT_NOFILE, &rlim);
+	}
+
+	/*
+	 * chdir /var/run/varpd
+	 */
+	if (fchdir(dirfd) != 0)
+		varpd_fatal("failed to chdir to %s", VARPD_RUNDIR);
+
+
+	/*
+	 * At this point block all signals going in so we don't have the parent
+	 * mistakingly exit when the child is running, but never block SIGABRT.
+	 */
+	if (sigfillset(&set) != 0)
+		abort();
+	if (sigdelset(&set, SIGABRT) != 0)
+		abort();
+	if (sigprocmask(SIG_BLOCK, &set, &oset) != 0)
+		abort();
+
+	/*
+	 * Do the fork+setsid dance.
+	 */
+	if (pipe(pfds) != 0)
+		varpd_fatal("failed to create pipe for daemonizing");
+
+	if ((child = fork()) == -1)
+		varpd_fatal("failed to fork for daemonizing");
+
+	if (child != 0) {
+		/* We'll be exiting shortly, so allow for silent failure */
+		(void) close(pfds[1]);
+		if (read(pfds[0], &estatus, sizeof (estatus)) ==
+		    sizeof (estatus))
+			_exit(estatus);
+
+		if (waitpid(child, &estatus, 0) == child && WIFEXITED(estatus))
+			_exit(WEXITSTATUS(estatus));
+
+		_exit(VARPD_EXIT_FATAL);
+	}
+
+	/*
+	 * Drop privileges here.
+	 *
+	 * We should make sure we keep around PRIV_NET_PRIVADDR and
+	 * PRIV_SYS_DLCONFIG, but drop everything else; however, keep basic
+	 * privs and have our child drop them.
+	 *
+	 * We should also run as netadm:netadm and drop all of our groups.
+	 */
+	if (setgroups(0, NULL) != 0)
+		abort();
+	if (setgid(GID_NETADM) == -1 || seteuid(UID_NETADM) == -1)
+		abort();
+	if ((pset = priv_allocset()) == NULL)
+		abort();
+	priv_basicset(pset);
+	if (priv_delset(pset, PRIV_PROC_EXEC) == -1 ||
+	    priv_delset(pset, PRIV_PROC_INFO) == -1 ||
+	    priv_delset(pset, PRIV_PROC_FORK) == -1 ||
+	    priv_delset(pset, PRIV_PROC_SESSION) == -1 ||
+	    priv_delset(pset, PRIV_FILE_LINK_ANY) == -1 ||
+	    priv_addset(pset, PRIV_SYS_DL_CONFIG) == -1 ||
+	    priv_addset(pset, PRIV_NET_PRIVADDR) == -1) {
+		abort();
+	}
+	/*
+	 * Remove privs from the permitted set. That will cause them to be
+	 * removed from the effective set. We want to make sure that in the case
+	 * of a vulnerability, something can't get back in here and wreak more
+	 * havoc. But if we want non-basic privs in the effective set, we have
+	 * to request them explicitly.
+	 */
+	if (setppriv(PRIV_SET, PRIV_PERMITTED, pset) == -1)
+		abort();
+	if (setppriv(PRIV_SET, PRIV_EFFECTIVE, pset) == -1)
+		abort();
+
+	priv_freeset(pset);
+
+	if (close(pfds[0]) != 0)
+		abort();
+	if (setsid() == -1)
+		abort();
+	if (sigprocmask(SIG_SETMASK, &oset, NULL) != 0)
+		abort();
+	(void) umask(0022);
+
+	return (pfds[1]);
+}
+
+static int
+varpd_setup_lookup_threads(void)
+{
+	int ret;
+	long i, ncpus = sysconf(_SC_NPROCESSORS_ONLN) * 2 + 1;
+
+	if (ncpus <= 0)
+		abort();
+	for (i = 0; i < ncpus; i++) {
+		thread_t thr;
+
+		ret = thr_create(NULL, 0,
+		    (void *(*)(void *))libvarpd_overlay_lookup_run,
+		    varpd_handle, THR_DETACHED | THR_DAEMON, &thr);
+		if (ret != 0)
+			return (ret);
+	}
+
+	return (0);
+}
+
+static void
+varpd_cleanup(void)
+{
+	varpd_exit = B_TRUE;
+}
+
+/*
+ * Load default information from SMF and apply any of if necessary. We recognize
+ * the following properties:
+ *
+ * 	varpd/include_path		Treat these as a series of -i options.
+ *
+ * If we're not under SMF, just move on.
+ */
+static void
+varpd_load_smf(int dfd)
+{
+	char *fmri, *inc;
+	scf_simple_prop_t *prop;
+
+	if ((fmri = getenv("SMF_FMRI")) == NULL)
+		return;
+
+	if ((prop = scf_simple_prop_get(NULL, fmri, VARPD_PG,
+	    VARPD_PROP_INC)) == NULL)
+		return;
+
+	while ((inc = scf_simple_prop_next_astring(prop)) != NULL) {
+		int err = libvarpd_plugin_load(varpd_handle, inc);
+		if (err != 0) {
+			varpd_dfatal(dfd, "failed to load from %s: %s\n",
+			    inc, strerror(err));
+		}
+	}
+
+	scf_simple_prop_free(prop);
+}
+
+/*
+ * There are a bunch of things we need to do to be a proper daemon here.
+ *
+ *   o Ensure that /var/run/varpd exists or create it
+ *   o make stdin /dev/null (stdout?)
+ *   o Ensure any other fds that we somehow inherited are closed, eg.
+ *     closefrom()
+ *   o Properly daemonize
+ *   o Mask all signals except sigabrt before creating our first door -- all
+ *     other doors will inherit from that.
+ *   o Have the main thread sigsuspend looking for most things that are
+ *     actionable...
+ */
+int
+main(int argc, char *argv[])
+{
+	int err, c, dirfd, dfd, i;
+	const char *doorpath = VARPD_DEFAULT_DOOR;
+	sigset_t set;
+	struct sigaction act;
+	int nincpath = 0, nextincpath = 0;
+	char **incpath = NULL;
+
+	varpd_pname = basename(argv[0]);
+
+	/*
+	 * We want to clean up our file descriptors before we do anything else
+	 * as we can't assume that libvarpd won't open file descriptors, etc.
+	 */
+	varpd_fd_setup();
+
+	if ((err = libvarpd_create(&varpd_handle)) != 0) {
+		varpd_fatal("failed to open a libvarpd handle");
+		return (1);
+	}
+
+	while ((c = getopt(argc, argv, ":i:d:")) != -1) {
+		switch (c) {
+		case 'i':
+			if (nextincpath == nincpath) {
+				if (nincpath == 0)
+					nincpath = 16;
+				else
+					nincpath *= 2;
+				incpath = realloc(incpath, sizeof (char *) *
+				    nincpath);
+				if (incpath == NULL) {
+					(void) fprintf(stderr, "failed to "
+					    "allocate memory for the %dth "
+					    "-I option: %s\n", nextincpath + 1,
+					    strerror(errno));
+				}
+
+			}
+			incpath[nextincpath] = optarg;
+			nextincpath++;
+			break;
+		case 'd':
+			doorpath = optarg;
+			break;
+		default:
+			(void) fprintf(stderr, "unknown option: %c\n", c);
+			return (1);
+		}
+	}
+
+	dirfd = varpd_dir_setup();
+
+	(void) libvarpd_plugin_walk(varpd_handle, varpd_plugin_walk_cb, NULL);
+
+	dfd = varpd_daemonize(dirfd);
+
+	/*
+	 * Now that we're in the child, go ahead and load all of our plug-ins.
+	 * We do this, in part, because these plug-ins may need threads of their
+	 * own and fork won't preserve those and we'd rather the plug-ins don't
+	 * have to learn about fork-handlers.
+	 */
+	for (i = 0; i < nextincpath; i++) {
+		err = libvarpd_plugin_load(varpd_handle, incpath[i]);
+		if (err != 0) {
+			varpd_dfatal(dfd, "failed to load from %s: %s\n",
+			    incpath[i], strerror(err));
+		}
+	}
+
+	varpd_load_smf(dfd);
+
+	if ((err = libvarpd_persist_enable(varpd_handle, VARPD_RUNDIR)) != 0)
+		varpd_dfatal(dfd, "failed to enable varpd persistence: %s\n",
+		    strerror(err));
+
+	if ((err = libvarpd_persist_restore(varpd_handle)) != 0)
+		varpd_dfatal(dfd, "failed to enable varpd persistence: %s\n",
+		    strerror(err));
+
+	/*
+	 * The ur-door thread will inherit from this signal mask. So set it to
+	 * what we want before doing anything else. In addition, so will our
+	 * threads that handle varpd lookups.
+	 */
+	if (sigfillset(&set) != 0)
+		varpd_dfatal(dfd, "failed to fill a signal set...");
+
+	if (sigdelset(&set, SIGABRT) != 0)
+		varpd_dfatal(dfd, "failed to unmask SIGABRT");
+
+	if (sigprocmask(SIG_BLOCK, &set, NULL) != 0)
+		varpd_dfatal(dfd, "failed to set our door signal mask");
+
+	if ((err = varpd_setup_lookup_threads()) != 0)
+		varpd_dfatal(dfd, "failed to create lookup threads: %s\n",
+		    strerror(err));
+
+	if ((err = libvarpd_door_server_create(varpd_handle, doorpath)) != 0)
+		varpd_dfatal(dfd, "failed to create door server at %s: %s\n",
+		    doorpath, strerror(err));
+
+	/*
+	 * At this point, finish up signal intialization and finally go ahead,
+	 * notify the parent that we're okay, and enter the sigsuspend loop.
+	 */
+	bzero(&act, sizeof (struct sigaction));
+	act.sa_handler = varpd_cleanup;
+	if (sigfillset(&act.sa_mask) != 0)
+		varpd_dfatal(dfd, "failed to fill sigaction mask");
+	act.sa_flags = 0;
+	if (sigaction(SIGHUP, &act, NULL) != 0)
+		varpd_dfatal(dfd, "failed to register HUP handler");
+	if (sigdelset(&set, SIGHUP) != 0)
+		varpd_dfatal(dfd, "failed to remove HUP from mask");
+	if (sigaction(SIGQUIT, &act, NULL) != 0)
+		varpd_dfatal(dfd, "failed to register QUIT handler");
+	if (sigdelset(&set, SIGQUIT) != 0)
+		varpd_dfatal(dfd, "failed to remove QUIT from mask");
+	if (sigaction(SIGINT, &act, NULL) != 0)
+		varpd_dfatal(dfd, "failed to register INT handler");
+	if (sigdelset(&set, SIGINT) != 0)
+		varpd_dfatal(dfd, "failed to remove INT from mask");
+	if (sigaction(SIGTERM, &act, NULL) != 0)
+		varpd_dfatal(dfd, "failed to register TERM handler");
+	if (sigdelset(&set, SIGTERM) != 0)
+		varpd_dfatal(dfd, "failed to remove TERM from mask");
+
+	err = 0;
+	(void) write(dfd, &err, sizeof (err));
+	(void) close(dfd);
+
+	for (;;) {
+		if (sigsuspend(&set) == -1)
+			if (errno == EFAULT)
+				abort();
+		if (varpd_exit == B_TRUE)
+			break;
+	}
+
+	libvarpd_door_server_destroy(varpd_handle);
+	libvarpd_destroy(varpd_handle);
+
+	return (VARPD_EXIT_REQUESTED);
+}
diff --git a/usr/src/cmd/varpd/varpd.xml b/usr/src/cmd/varpd/varpd.xml
new file mode 100644
index 0000000000..0a9201e90d
--- /dev/null
+++ b/usr/src/cmd/varpd/varpd.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0"?>
+<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
+<!--
+This file and its contents are supplied under the terms of the
+Common Development and Distribution License ("CDDL"), version 1.0.
+You may only use this file in accordance with the terms of version
+1.0 of the CDDL.
+
+A full copy of the text of the CDDL should have accompanied this
+source.  A copy of the CDDL is also available via the Internet at
+http://www.illumos.org/license/CDDL.
+
+Copyright 2015, Joyent, Inc.
+-->
+
+<service_bundle type="manifest" name="illumos:varpd" >
+
+	<service name="network/varpd" type="service" version="1" >
+
+		<create_default_instance enabled="true" />
+
+		<single_instance/>
+
+		<dependency name="varpd-network-physical"
+			grouping="require_all"
+			restart_on="none"
+			type="service">
+			<service_fmri value="svc:/network/physical:default" />
+		</dependency>
+
+		<exec_method
+			type="method"
+			name="start"
+			exec="/lib/svc/method/svc-varpd"
+			timeout_seconds="60" />
+
+		<exec_method
+			type="method"
+			name="stop"
+			exec=":kill"
+			timeout_seconds="10" />
+
+		<property_group name='varpd' type='application'>
+			<property name='include_path' type='astring'>
+				<astring_list>
+					<value_node value='/usr/lib/varpd'/>
+				</astring_list>
+			</property>
+		</property_group>
+
+		<stability value='Unstable' />
+
+		<template>
+			<common_name>
+				<loctext xml:lang="C">virtual ARP daemon
+				</loctext>
+			</common_name>
+		</template>
+	</service>
+</service_bundle>
diff --git a/usr/src/cmd/vi/port/Makefile b/usr/src/cmd/vi/port/Makefile
index eb22a5e54e..8c969edbe7 100644
--- a/usr/src/cmd/vi/port/Makefile
+++ b/usr/src/cmd/vi/port/Makefile
@@ -75,6 +75,9 @@ $(XPG6) := CFLAGS += -DXPG4 -DXPG6 -I$(SRC)/lib/libc/inc
 
 CPPFLAGS +=  -DUSG -DSTDIO -DVMUNIX -DTABS=8 -DSINGLE -DTAG_STACK
 
+# vi intentionally uses foo[-1] as a sentinal value to q*column()
+$(__GNUC4)CERRWARN += -_gcc=-Wno-array-bounds
+
 # vi maintains its own versions of various routines from libc and libcurses,
 # so localize all symbols to avoid name space collisions.
 LDFLAGS +=	$(MAPFILE.NGB:%=-M%)
diff --git a/usr/src/cmd/vi/port/ex_cmdsub.c b/usr/src/cmd/vi/port/ex_cmdsub.c
index 9004ac7271..7e2cd4740d 100644
--- a/usr/src/cmd/vi/port/ex_cmdsub.c
+++ b/usr/src/cmd/vi/port/ex_cmdsub.c
@@ -1740,7 +1740,7 @@ char *prompt;
 
 	/* In ex mode, let the system hassle with setting no echo */
 	if (!inopen)
-		return (unsigned char *)getpass(prompt);
+		return (unsigned char *)getpass((const char *)prompt);
 	viprintf("%s", prompt); flush();
 	for (p=pbuf; (c = getkey())!='\n' && c!=EOF && c!='\r';) {
 		if (p < &pbuf[8])
diff --git a/usr/src/cmd/vndadm/Makefile b/usr/src/cmd/vndadm/Makefile
new file mode 100644
index 0000000000..2b9ca6c3c1
--- /dev/null
+++ b/usr/src/cmd/vndadm/Makefile
@@ -0,0 +1,67 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018 Joyent, Inc.  All rights reserved.
+#
+
+PROG= vndadm
+OBJS = vndadm.o
+SRCS = $(OBJS:%.o=../%.c)
+
+
+include ../Makefile.cmd
+include ../Makefile.ctf
+
+CLEANFILES += $(OBJS)
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lvnd
+LINTFLAGS += -xerroff=E_NAME_DEF_NOT_USED2
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+all	:= TARGET += all
+clean	:= TARGET += clean
+clobber	:= TARGET += clobber
+install	:= TARGET += install
+lint	:= TARGET += lint
+
+SUBDIRS = test
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+clean: $(SUBDIRS)
+	-$(RM) $(CLEANFILES)
+
+lint: lint_PROG $(SUBDIRS)
+
+%.o: ../%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+clobber: clean $(SUBDIRS)
+	$(RM) $(PROG)
+
+install: $(PROG) $(ROOTUSRSBINPROG) $(SUBDIRS)
+
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/vndadm/test/Makefile b/usr/src/cmd/vndadm/test/Makefile
new file mode 100644
index 0000000000..12ef2c3a3c
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+SUBDIRS = scripts tst
+
+include Makefile.subdirs
+include Makefile.com
diff --git a/usr/src/cmd/vndadm/test/Makefile.com b/usr/src/cmd/vndadm/test/Makefile.com
new file mode 100644
index 0000000000..cb096952ca
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/Makefile.com
@@ -0,0 +1,43 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include $(SRC)/Makefile.master
+include $(SRC)/cmd/Makefile.cmd
+
+#
+# Force c99 for everything
+#
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+#
+# Deal with odd lint bits.
+#
+LINTFLAGS +=	-xerroff=E_NAME_DEF_NOT_USED2
+
+#
+# Install related definitions
+#
+ROOTOPTPKG = 	$(ROOT)/opt/vndtest
+ROOTBIN =	$(ROOTOPTPKG)/bin
+ROOTTST	=	$(ROOTOPTPKG)/tst
+ROOTTSTDIR =	$(ROOTTST)/$(TSTDIR)
+ROOTTSTEXES =	$(EXETESTS:%=$(ROOTTSTDIR)/%)
+ROOTTSTSH =	$(SHTESTS:%=$(ROOTTSTDIR)/%)
+ROOTOUT =	$(OUTFILES:%=$(ROOTTSTDIR)/%)
+ROOTTESTS = 	$(ROOTTSTEXES) $(ROOTTSTSH) $(ROOTOUT)
+FILEMODE =	0555
+LDLIBS =	$(LDLIBS.cmd)
+LINTEXE =	$(EXETESTS:%.exe=%.exe.ln)
diff --git a/usr/src/cmd/vndadm/test/Makefile.subdirs b/usr/src/cmd/vndadm/test/Makefile.subdirs
new file mode 100644
index 0000000000..957448c23b
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/Makefile.subdirs
@@ -0,0 +1,29 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+.KEEP_STATE:
+
+all	:= TARGET += all
+clean	:= TARGET += clean
+clobber	:= TARGET += clobber
+install	:= TARGET += install
+lint	:= TARGET += lint
+
+all clean clobber install lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/cmd/vndadm/test/Makefile.targ b/usr/src/cmd/vndadm/test/Makefile.targ
new file mode 100644
index 0000000000..bcbd3c8f35
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/Makefile.targ
@@ -0,0 +1,59 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+$(ROOTOPTPKG):
+	$(INS.dir)
+
+$(ROOTBIN): $(ROOTOPTPKG)
+	$(INS.dir)
+
+$(ROOTBIN)/%: %.ksh $(ROOTBIN)
+	$(INS.rename)
+
+$(ROOTTST): $(ROOTOPTPKG)
+	$(INS.dir)
+
+$(ROOTTSTDIR): $(ROOTTST)
+	$(INS.dir)
+
+$(ROOTTSTDIR)/%.ksh: %.ksh $(ROOTTSTDIR)
+	$(INS.file)
+
+$(ROOTTSTDIR)/%.out: %.out $(ROOTTSTDIR)
+	$(INS.file)
+
+%.o: %.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+%.exe: %.o $(SUPOBJS)
+	$(LINK.c) -o $@ $< $(SUPOBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+$(ROOTTSTDIR)/%.exe: %.exe $(ROOTTSTDIR)
+	$(INS.file)
+
+all: install
+
+%.exe.ln: %.c $(SUPOBJS)
+	$(LINT.c) $< $(LDLIBS)
+
+lint: $(LINTEXE)
+
+clean:
+	-$(RM) *.o $(CLEANFILES)
+
+clobber: clean
+	-$(RM) $(CLOBBERFILES)
diff --git a/usr/src/cmd/vndadm/test/scripts/Makefile b/usr/src/cmd/vndadm/test/scripts/Makefile
new file mode 100644
index 0000000000..d0f58918f9
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/scripts/Makefile
@@ -0,0 +1,28 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+SRCS =		vndtest
+SCRIPTS =	$(SRCS:%=$(ROOTBIN)/%)
+
+SCRIPTS :=	FILEMODE = 0555
+CLOBBERFILES =	$(SCRIPTS)
+
+install: $(SCRIPTS)
+
+lint:
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/vndadm/test/scripts/vndtest.ksh b/usr/src/cmd/vndadm/test/scripts/vndtest.ksh
new file mode 100755
index 0000000000..1167a64802
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/scripts/vndtest.ksh
@@ -0,0 +1,300 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014, Joyent, Inc.
+#
+
+#
+# vnd test suite driver
+#
+unalias -a
+
+vt_arg0=$(basename $0)
+vt_root="$(dirname $0)/.."
+vt_ksh="/usr/bin/ksh"
+vt_outdir=
+vt_keep=
+vt_all=
+vt_tests=
+vt_stub=
+vt_vnics="vndtest1 vndtest2 vndtest3 vndtest4 vndtest5"
+vt_tnum=0
+vt_tfail=0
+vt_tsuc=0
+
+function usage
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] || echo "$msg" 2>&1
+	cat <<USAGE >&2
+Usage: $vt_arg0  [ -o dir ] [ -k ] [ -a | test ... ]
+
+	-o dir		Sets 'dir' as the output directory
+	-a		Runs all tests, ignores tests passed in
+	-k		Keep output from all tests, not just failures
+	-m 		mdb binary to test
+USAGE
+	exit 2
+}
+
+function fatal
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "$vt_arg0: $msg" >&2
+	exit 1
+}
+
+function setup_outdir
+{
+	vt_outdir="$vt_outdir/$vt_arg0.$$"
+	mkdir -p $vt_outdir || fatal "failed to make output dir $vt_outdir"
+}
+
+function setup_etherstub
+{
+	vt_ether="vndstub$$"
+
+	dladm create-etherstub -t $vt_ether || \
+	    fatal "failed to create etherstub"
+}
+
+function cleanup_vnd
+{
+	typeset over=$1
+	typeset vnddevs vn
+
+	vnddevs=$(vndadm list -p -d: -o datalink,name)
+	[[ $? -eq 0 ]] || fatal "failed to list vnics"
+	for v in $vnddevs; do
+		vn=$(echo $v | awk 'BEGIN{ FS=":"}
+		    { if ($1 == targ) { print $2 } }' targ=$over)
+		[[ -z "$vn" ]] && continue
+		vndadm destroy $vn || fatal "failed to destroy $vn"
+	done
+}
+
+function create_vnics
+{
+	for n in $vt_vnics; do
+		dladm create-vnic -t -l $vt_ether $n || fatal \
+		    "failed to create vnic $n over $vt_ether"
+	done
+}
+
+function cleanup_vnics
+{
+	typeset nics vn
+	
+	nics=$(dladm show-vnic -p -o over,link)
+	[[ $? -eq 0 ]] || fatal "failed to list vnics"
+	for n in $nics; do 
+		vn=$(echo $n | awk 'BEGIN{ FS=":"}
+		    { if ($1 == targ) { print $2 } }' targ=$vt_ether )
+		[[ -z "$vn" ]] && continue
+		cleanup_vnd $vn
+		#
+		# There may or may not be an IP device on our nics...
+		#
+		ifconfig $vn down unplumb 2>/dev/null || /bin/true
+		dladm delete-vnic $vn || fatal "failed to delete vnic $n"
+	done
+
+}
+
+function cleanup_etherstub
+{
+	cleanup_vnics
+	dladm delete-etherstub -t $vt_ether || \
+	    fatal "failed to delete etherstub"
+}
+
+function run_single
+{
+	typeset name=$1
+	typeset expect base ext exe command odir res reason
+	typeset iserr
+
+	[[ -z "$name" ]] && fail "missing test to run"
+	base=${name##*/}
+	ext=${base##*.}
+	expect=${base%%.*}
+	odir="$vt_outdir/current"
+	[[ -z "$ext" ]] && fatal "found test without ext: $name"
+	[[ -z "$expect" ]] && fatal "found test without prefix: $name"
+
+	[[ "$expect" == "create" || "$expect" == "ecreate" ]] && create_vnics
+	if [[ "$expect" == "err" || "$expect" == "ecreate" ]]; then
+		iserr="yup"
+	else
+		iserr=""
+	fi
+
+	case "$ext" in
+	"ksh")
+		command="$vt_ksh ./$base"
+		;;
+	"exe")
+		command="./$base"
+		;;
+	"out")
+		#
+		# This is the file format for checking output against.
+		#
+		return 0
+		;;
+	*)
+		echo "skipping test $name (unknown extensino)"
+		return 0
+		;;
+	esac
+
+	echo "Executing test $name ... \c"
+	mkdir -p "$odir" >/dev/null || fatal "can't make output directory"
+	cd $(dirname $name) || fatal "failed to enter test directory"
+	$command $vt_vnics > "$odir/stdout" 2>"$odir/stderr"
+	res=$?
+	cd - > /dev/null || fatal "failed to leave test directory"
+
+	if [[ -f "$name.out" ]] && \
+	    ! diff "$name.out" "$odir/stdout" >/dev/null; then
+		cp $name.out $odir/$base.out
+		reason="stdout mismatch"
+	elif [[ -n "$iserr" && $res -eq 0 ]]; then
+		reason="test exited $res, not non-zero"
+	elif [[ -z "$iserr" && $res -ne 0 ]]; then
+		reason="test exited $res, not zero"
+	fi
+
+	if [[ -n "$reason" ]]; then
+		echo "$reason"
+		((vt_tfail++))
+		mv "$odir" "$vt_outdir/failure.$vt_tfail" || fatal \
+		    "failed to move test output directory"
+		cp "$name" "$vt_outdir/failure.$vt_tfail/$(basename $name)" || \
+		    fatal "failed to copy test into output directory"
+	else
+		echo "passed"
+		((vt_tsuc++))
+		mv "$odir" "$vt_outdir/success.$vt_tsuc" || fatal \
+		    "failed to move test directory"	
+	fi
+
+	[[ "$expect" == "create" || "$expect" == "ecreate" ]] && cleanup_vnics
+
+	((vt_tnum++))
+}
+
+function run_all
+{
+	typeset tests t dir
+
+	cd $vt_root || fatal "failed to enter root test directory"
+	tests=$(ls -1 */*/@(ecreate|create|tst|err).*.@(ksh|exe))
+	cd - > /dev/null
+	for t in $tests; do
+		run_single $t
+	done
+}
+
+function welcome
+{
+	cat <<WELCOME
+Starting tests...
+output directory: $vt_outdir
+WELCOME
+}
+
+function cleanup
+{
+	[[ -n "$vt_keep" ]] && return
+	rm -rf "$vt_outdir"/success.* || fatal \
+	     "failed to remove successful test cases"
+	if [[ $vt_tfail -eq 0 ]]; then
+		rmdir "$vt_outdir" || fatal \
+		    "failed to remove test output directory"
+	fi
+}
+
+function goodbye
+{
+	cat <<EOF
+
+-------------
+Results
+-------------
+
+Tests passed: $vt_tsuc
+Tests failed: $vt_tfail
+Tests ran:    $vt_tnum
+
+EOF
+	if [[ $vt_tfail  -eq 0 ]]; then
+		echo "Congrats, vnd isn't completely broken, the tests pass".
+	else
+		echo "Some tests failed, you have some work to do."
+	fi
+}
+
+while getopts ":ahko:m:" c $@; do
+	case "$c" in
+	a)
+		vt_all="y"
+		;;
+	k)
+		vt_keep="y"
+		;;
+	o)
+		vt_outdir="$OPTARG"
+		;;
+	h)
+		usage
+		;;
+	:)
+		usage "option requires an argument -- $OPTARG"
+		;;
+	*)
+		usage "invalid option -- $OPTARG"
+		;;
+	esac
+done
+
+shift $((OPTIND-1))
+
+[[ $(zonename) != "global" ]] && fatal "vndtest only runs in the global zone"
+
+[[ -z "$vt_all" && $# == 0 ]] && usage "no tests to run"
+
+[[ -z "$vt_outdir" ]] && vt_outdir="$PWD"
+
+setup_outdir
+setup_etherstub
+welcome
+
+if [[ ! -z "$vt_all" ]]; then
+	run_all
+else
+	for t in $@; do
+		[[ -f $t ]] || fatal "cannot find test $t"
+		run_single $t		
+	done
+fi
+
+cleanup_etherstub
+goodbye
+cleanup
+
+#
+# Exit 1 if we have tests that return non-zero
+#
+[[ $vt_tfai -eq 0 ]]
diff --git a/usr/src/cmd/vndadm/test/tst/Makefile b/usr/src/cmd/vndadm/test/tst/Makefile
new file mode 100644
index 0000000000..9b1ba29429
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+SUBDIRS = cmd dld ioctl lib
+
+include ../Makefile.subdirs
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/Makefile b/usr/src/cmd/vndadm/test/tst/cmd/Makefile
new file mode 100644
index 0000000000..1ca20bf749
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/Makefile
@@ -0,0 +1,34 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+TSTDIR =	cmd
+COMMONSH =	cmd.common.ksh
+SHTESTS = 	$(COMMONSH) \
+		create.list.ksh \
+		create.sdev.ksh \
+		create.setbuf.ksh \
+		ecreate.destroy.ksh \
+		ecreate.setbadprop.ksh \
+		ecreate.setbadvalue.ksh \
+		ecreate.setbuftoobig.ksh \
+		ecreate.setrdonlyprop.ksh
+
+OUTFILES =	create.list.ksh.out
+
+include ../../Makefile.com
+
+install: $(ROOTTESTS)
+
+include ../../Makefile.targ
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/cmd.common.ksh b/usr/src/cmd/vndadm/test/tst/cmd/cmd.common.ksh
new file mode 100644
index 0000000000..31e4e8bf5c
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/cmd.common.ksh
@@ -0,0 +1,33 @@
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Common ksh-based utilities
+#
+
+vt_arg0=$(basename $0)
+
+function fatal
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "$vt_arg0: $msg" >&2
+	exit 1
+}
+
+[[ -z "$1" ]] && fatal "missing required vnic"
+[[ -z "$2" ]] && fatal "missing required vnic"
+[[ -z "$3" ]] && fatal "missing required vnic"
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/create.list.ksh b/usr/src/cmd/vndadm/test/tst/cmd/create.list.ksh
new file mode 100644
index 0000000000..fdec9a85be
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/create.list.ksh
@@ -0,0 +1,30 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Basic device listing
+#
+
+. ./cmd.common.ksh
+
+#
+# Use what we hope is a relatively unique name
+#
+cl_name="triforceofcourage0"
+vndadm create -l $1 $cl_name || fatal "failed to create vnd device"
+vndadm list -p -o name,zone $cl_name
+vndadm list -p -d: -o zone,name $cl_name
+vndadm destroy $cl_name || fatal "failed to destroy vnd device"
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/create.list.ksh.out b/usr/src/cmd/vndadm/test/tst/cmd/create.list.ksh.out
new file mode 100644
index 0000000000..d208b38aab
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/create.list.ksh.out
@@ -0,0 +1,2 @@
+triforceofcourage0 global
+global:triforceofcourage0
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/create.sdev.ksh b/usr/src/cmd/vndadm/test/tst/cmd/create.sdev.ksh
new file mode 100644
index 0000000000..b816ade1de
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/create.sdev.ksh
@@ -0,0 +1,25 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Verify that our sdev links exist
+#
+
+. ./cmd.common.ksh
+
+vndadm create $1 || fatal "failed to bring up vnd"
+[[ -c /dev/vnd/$1 ]] || fatal "missing link"
+[[ -c /dev/vnd/zone/$(zonename)/$1 ]] || fatal "missing per-zone link"
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/create.setbuf.ksh b/usr/src/cmd/vndadm/test/tst/cmd/create.setbuf.ksh
new file mode 100644
index 0000000000..d50edbead4
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/create.setbuf.ksh
@@ -0,0 +1,34 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Set and validate the buffer size properties. Valiate that we can set
+# the value using the various number analogues, eg. 1024K, etc.
+#
+set -o pipefail
+
+. ./cmd.common.ksh
+
+vndadm create $1 || fatal "failed to bring up vnd device"
+vndadm set $1 rxbuf=1M
+cur=$(vndadm get -p $1 rxbuf | nawk '{ print $4 }')
+[[ $? -eq 0 ]] || fatal "failed to get rxbuf"
+[[ $cur -eq 1048576 ]] || fatal "rxbuf is $cur, not 1M"
+
+vndadm set $1 txbuf=1024K
+cur=$(vndadm get -p $1 rxbuf | nawk '{ print $4 }')
+[[ $? -eq 0 ]] || fatal "failed to get txbuf"
+[[ $cur -eq 1048576 ]] || fatal "txbuf is $cur, not 1M"
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/ecreate.destroy.ksh b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.destroy.ksh
new file mode 100644
index 0000000000..e3c4931018
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.destroy.ksh
@@ -0,0 +1,25 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure that destroy on a previously destroyed link fails
+#
+
+. ./cmd.common.ksh
+
+vndadm create $1 || fatal "failed to bring up vnd device"
+vndadm destroy $1 || fatal "failed to destroy vnd device"
+vndadm destroy $1
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbadprop.ksh b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbadprop.ksh
new file mode 100644
index 0000000000..30c27575b1
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbadprop.ksh
@@ -0,0 +1,24 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure that we can't set a non-existant proprety
+#
+
+. ./cmd.common.ksh
+
+vndadm create $1 || fatal "failed to bring up vnd device"
+vndadm set $1 ganon=ganondorf
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbadvalue.ksh b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbadvalue.ksh
new file mode 100644
index 0000000000..056b24a817
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbadvalue.ksh
@@ -0,0 +1,24 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure that we can't set something to a garbage value
+#
+
+. ./cmd.common.ksh
+
+vndadm create $1 || fatal "failed to bring up vnd device"
+vndadm set $1 rxbuf=hello
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbuftoobig.ksh b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbuftoobig.ksh
new file mode 100644
index 0000000000..551e20461c
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setbuftoobig.ksh
@@ -0,0 +1,24 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure that we can't set a buffer value to a ridiculous size
+#
+
+. ./cmd.common.ksh
+
+vndadm create $1 || fatal "failed to bring up vnd device"
+vndadm set $1 rxsize=1T
diff --git a/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setrdonlyprop.ksh b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setrdonlyprop.ksh
new file mode 100644
index 0000000000..4beb53e227
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/cmd/ecreate.setrdonlyprop.ksh
@@ -0,0 +1,24 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure that we can't set a read only property.
+#
+
+. ./cmd.common.ksh
+
+vndadm create $1 || fatal "failed to bring up vnd device"
+vndadm set $1 mintu=100
diff --git a/usr/src/cmd/vndadm/test/tst/dld/Makefile b/usr/src/cmd/vndadm/test/tst/dld/Makefile
new file mode 100644
index 0000000000..3088812630
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/dld/Makefile
@@ -0,0 +1,27 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+TSTDIR =	dld
+COMMONSH =	dld.common.ksh
+SHTESTS = 	$(COMMONSH) \
+		ecreate.ipfirst.ksh \
+		ecreate.vndfirst.ksh \
+		create.reuse.ksh
+
+include ../../Makefile.com
+
+install: $(ROOTTESTS)
+
+include ../../Makefile.targ
diff --git a/usr/src/cmd/vndadm/test/tst/dld/create.reuse.ksh b/usr/src/cmd/vndadm/test/tst/dld/create.reuse.ksh
new file mode 100644
index 0000000000..bc2ffde7f6
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/dld/create.reuse.ksh
@@ -0,0 +1,31 @@
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure that we can reuse a data link
+#
+
+. ./dld.common.ksh
+
+dld_nic=$1
+[[ -z "$1" ]] && fatal "missing required vnic"
+
+vndadm create $dld_nic || fatal "failed to bring up vnd"
+vndadm destroy $dld_nic || fatal "failed to bring down vnd"
+ifconfig $dld_nic plumb up || fatal "failed to bring up IP"
+ifconfig $dld_nic down unplumb || fatal "failed to bring down IP"
+vndadm create $dld_nic || fatal "failed to bring up vnd"
+vndadm destroy $dld_nic || fatal "failed to bring down vnd"
diff --git a/usr/src/cmd/vndadm/test/tst/dld/dld.common.ksh b/usr/src/cmd/vndadm/test/tst/dld/dld.common.ksh
new file mode 100644
index 0000000000..7a2e0a8e2b
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/dld/dld.common.ksh
@@ -0,0 +1,29 @@
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Common ksh-based utilities
+#
+
+vt_arg0=$(basename $0)
+
+function fatal
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "$vt_arg0: $msg" >&2
+	exit 1
+}
diff --git a/usr/src/cmd/vndadm/test/tst/dld/ecreate.ipfirst.ksh b/usr/src/cmd/vndadm/test/tst/dld/ecreate.ipfirst.ksh
new file mode 100644
index 0000000000..e6409781cb
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/dld/ecreate.ipfirst.ksh
@@ -0,0 +1,27 @@
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure vnd fails to come up when IP is up
+#
+
+. ./dld.common.ksh
+
+dld_nic=$1
+[[ -z "$1" ]] && fatal "missing required vnic"
+
+ifconfig $dld_nic plumb up || fatal "failed to bring up IP"
+vndadm create $dld_nic
diff --git a/usr/src/cmd/vndadm/test/tst/dld/ecreate.vndfirst.ksh b/usr/src/cmd/vndadm/test/tst/dld/ecreate.vndfirst.ksh
new file mode 100644
index 0000000000..ee7a13c09c
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/dld/ecreate.vndfirst.ksh
@@ -0,0 +1,27 @@
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Make sure IP fails to come up when vnd is up
+#
+
+. ./dld.common.ksh
+
+dld_nic=$1
+[[ -z "$1" ]] && fatal "missing required vnic"
+
+vndadm create $dld_nic || fatal "failed to bring up vnd"
+ifconfig $dld_nic plumb up
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/Makefile b/usr/src/cmd/vndadm/test/tst/ioctl/Makefile
new file mode 100644
index 0000000000..fe074f32b0
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/Makefile
@@ -0,0 +1,49 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+TSTDIR =	ioctl
+EXETESTS = \
+	create.attach.exe \
+	create.attachnolink.exe \
+	create.badlinkname.exe \
+	create.doublelink.exe \
+	create.gioctlattach.exe \
+	create.link.exe \
+	create.linkexists.exe \
+	create.ngioctlfault.exe \
+	create.nopriv1.exe \
+	create.nopriv2.exe \
+	create.nopriv3.exe \
+	create.nopriv4.exe \
+	create.olink.exe \
+	create.olinknopriv.exe \
+	create.rmenolink.exe \
+	tst.attachrdonly.exe \
+	tst.basicopenctl.exe \
+	tst.badioctl.exe \
+	tst.gioctlfault.exe \
+	tst.gioctlnattach.exe \
+	tst.openctlbadflags.exe
+SHTESTS = \
+	tst.iocsize.ksh
+SUPBOBJS =
+
+CLOBBERFILES =	$(EXETESTS)
+
+include ../../Makefile.com
+
+install: $(ROOTTESTS)
+
+include ../../Makefile.targ
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.attach.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.attach.c
new file mode 100644
index 0000000000..d7bca5cce3
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.attach.c
@@ -0,0 +1,63 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Simply attach a nic
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	vnd_ioc_attach_t via;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.attachnolink.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.attachnolink.c
new file mode 100644
index 0000000000..43c6c99af5
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.attachnolink.c
@@ -0,0 +1,67 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Try to attach to a non-existant vnic
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	vnd_ioc_attach_t via;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	/*
+	 * All datalink names have numbers, so we can pick a datalink which
+	 * doesn't exist by not using numbers...
+	 */
+	(void) strlcpy(via.via_name, "enolink", VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == -1);
+	assert(via.via_errno == VND_E_NODATALINK);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.badlinkname.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.badlinkname.c
new file mode 100644
index 0000000000..e3a067d5ce
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.badlinkname.c
@@ -0,0 +1,119 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Test that we can't link a nic with invalid names
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+static const char *names[] = {
+	/* Reserved names */
+	"ctl",
+	"zone",
+	/* Invalid characters */
+	"The fight of the century",
+	"Link/Ganon",
+	"happens@7pm",
+	"#testing",
+	"asdf!!",
+	"power&courage&wisdom",
+	"over9000?",
+	"you're",
+	"100$",
+	"(function",
+	"x)",
+	"2^128",
+	"1++",
+	"No.",
+	"99%",
+	"*****",
+	"r|m",
+	"=0",
+	"`p0",
+	"goodbye~",
+	"however;",
+	"\"hesaid",
+	"shesaid\'",
+	/* emoji pile of poo */
+	"\xF0\x9F\x92\xA9",
+	NULL
+};
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret, i;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+	vnd_ioc_unlink_t viu;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	for (i = 0; names[i] != NULL; i++) {
+		(void) strlcpy(vil.vil_name, names[i], VND_NAMELEN);
+		(void) fprintf(stderr, "Trying to create [%s]\n", names[i]);
+		vil.vil_errno = 0;
+		ret = ioctl(fd, VND_IOC_LINK, &vil);
+		assert(ret == -1);
+		assert(vil.vil_errno == VND_E_BADNAME);
+	}
+
+	/* Finally, the missing null terminator */
+	for (i = 0; i < VND_NAMELEN; i++)
+		vil.vil_name[i] = 'a';
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == -1);
+	assert(vil.vil_errno == VND_E_BADNAME);
+
+	viu.viu_errno = 0;
+	ret = ioctl(fd, VND_IOC_UNLINK, &viu);
+	assert(ret == -1);
+	assert(viu.viu_errno == VND_E_NOTLINKED);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.doublelink.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.doublelink.c
new file mode 100644
index 0000000000..dcf4f311e9
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.doublelink.c
@@ -0,0 +1,82 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Link a nic, first should work, second will fail.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+	vnd_ioc_unlink_t viu;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	(void) strlcpy(vil.vil_name, argv[1], VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == 0);
+	assert(vil.vil_errno == 0);
+
+	(void) strlcpy(vil.vil_name, "dup", VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == -1);
+	assert(vil.vil_errno == VND_E_LINKED);
+	viu.viu_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_UNLINK, &viu);
+	assert(ret == 0);
+	assert(viu.viu_errno == 0);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.gioctlattach.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.gioctlattach.c
new file mode 100644
index 0000000000..3d6f43377b
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.gioctlattach.c
@@ -0,0 +1,69 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Ensure that we can't run global ioctls on an attached handle
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	vnd_ioc_attach_t via;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	via.via_name[0] = 'a';
+	via.via_name[1] = '\0';
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == -1);
+	assert(via.via_errno == VND_E_ATTACHED);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.link.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.link.c
new file mode 100644
index 0000000000..16569d58cd
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.link.c
@@ -0,0 +1,76 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Link a nic
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+	vnd_ioc_unlink_t viu;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	(void) strlcpy(vil.vil_name, argv[1], VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == 0);
+	assert(vil.vil_errno == 0);
+
+	viu.viu_errno = 0;
+	ret = ioctl(fd, VND_IOC_UNLINK, &viu);
+	assert(ret == 0);
+	assert(viu.viu_errno == 0);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.linkexists.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.linkexists.c
new file mode 100644
index 0000000000..4e3be0db5d
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.linkexists.c
@@ -0,0 +1,90 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Try to create two devices with the same link name.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, fd2, ret;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+	vnd_ioc_unlink_t viu;
+
+	if (argc < 3) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+	fd2 = open(VND_PATH, O_RDWR);
+	assert(fd2 > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	(void) strlcpy(via.via_name, argv[2], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+	ret = ioctl(fd2, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	(void) strlcpy(vil.vil_name, "dup", VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == 0);
+	assert(vil.vil_errno == 0);
+
+	(void) strlcpy(vil.vil_name, "dup", VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd2, VND_IOC_LINK, &vil);
+	assert(ret == -1);
+	assert(vil.vil_errno == VND_E_LINKEXISTS);
+
+	viu.viu_errno = 0;
+	ret = ioctl(fd, VND_IOC_UNLINK, &viu);
+	assert(ret == 0);
+	assert(viu.viu_errno == 0);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.ngioctlfault.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.ngioctlfault.c
new file mode 100644
index 0000000000..bf174f1a8f
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.ngioctlfault.c
@@ -0,0 +1,96 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Pass bad addresses to all of our non-global ioctls
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+static int requests[] = {
+	VND_IOC_LINK,
+	VND_IOC_UNLINK,
+	VND_IOC_GETRXBUF,
+	VND_IOC_SETRXBUF,
+	VND_IOC_GETTXBUF,
+	VND_IOC_SETTXBUF,
+	VND_IOC_GETMINTU,
+	VND_IOC_GETMAXTU,
+	VND_IOC_GETMAXBUF,
+	-1
+};
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret, i;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+	vnd_ioc_unlink_t viu;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	(void) strlcpy(vil.vil_name, argv[1], VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == 0);
+	assert(vil.vil_errno == 0);
+
+	for (i = 0; requests[i] != -1; i++) {
+		ret = ioctl(fd, requests[i], (void *)(uintptr_t)i);
+		assert(ret == -1);
+		assert(errno == EFAULT);
+	}
+
+
+	viu.viu_errno = 0;
+	ret = ioctl(fd, VND_IOC_UNLINK, &viu);
+	assert(ret == 0);
+	assert(viu.viu_errno == 0);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv1.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv1.c
new file mode 100644
index 0000000000..6d5ad0eec2
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv1.c
@@ -0,0 +1,69 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Fail to attach a device without PRIV_NET_CONFIG
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <assert.h>
+#include <priv.h>
+#include <string.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <stdio.h>
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	priv_set_t *ps;
+	vnd_ioc_attach_t via;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	ps = priv_allocset();
+	assert(ps != NULL);
+	assert(priv_addset(ps, PRIV_SYS_NET_CONFIG) == 0);
+	assert(setppriv(PRIV_OFF, PRIV_PERMITTED, ps) == 0);
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd >= 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == -1);
+	assert(errno == EPERM);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv2.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv2.c
new file mode 100644
index 0000000000..6b38f159a0
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv2.c
@@ -0,0 +1,69 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Fail to attach a device without PRIV_NET_RAWACCESS
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <assert.h>
+#include <priv.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	priv_set_t *ps;
+	vnd_ioc_attach_t via;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	ps = priv_allocset();
+	assert(ps != NULL);
+	assert(priv_addset(ps, PRIV_NET_RAWACCESS) == 0);
+	assert(setppriv(PRIV_OFF, PRIV_PERMITTED, ps) == 0);
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd >= 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == -1);
+	assert(errno == EPERM);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv3.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv3.c
new file mode 100644
index 0000000000..a8c43fc46d
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv3.c
@@ -0,0 +1,70 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Fail to attach a device without PRIV_NET_CONFIG and PRIV_NET_RAWACCESS
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <assert.h>
+#include <priv.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	priv_set_t *ps;
+	vnd_ioc_attach_t via;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	ps = priv_allocset();
+	assert(ps != NULL);
+	assert(priv_addset(ps, PRIV_SYS_NET_CONFIG) == 0);
+	assert(priv_addset(ps, PRIV_NET_RAWACCESS) == 0);
+	assert(setppriv(PRIV_OFF, PRIV_PERMITTED, ps) == 0);
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd >= 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == -1);
+	assert(errno == EPERM);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv4.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv4.c
new file mode 100644
index 0000000000..aed0204544
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv4.c
@@ -0,0 +1,75 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Fail to link a device without PRIV_NET_CONFIG
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <assert.h>
+#include <priv.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	priv_set_t *ps;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd >= 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+
+	ps = priv_allocset();
+	assert(ps != NULL);
+	assert(priv_addset(ps, PRIV_SYS_NET_CONFIG) == 0);
+	assert(setppriv(PRIV_OFF, PRIV_PERMITTED, ps) == 0);
+
+	(void) strlcpy(vil.vil_name, argv[1], VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == -1);
+	assert(errno == EPERM);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv5.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv5.c
new file mode 100644
index 0000000000..2db8ecc95f
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.nopriv5.c
@@ -0,0 +1,77 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Fail to open a device without PRIV_NET_RAWACCESS
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <assert.h>
+#include <priv.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, fd2, ret;
+	priv_set_t *ps;
+	char *path;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd >= 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+
+	ps = priv_allocset();
+	assert(ps != NULL);
+	assert(priv_addset(ps, PRIV_SYS_NET_RAWACCESS) == 0);
+	assert(setppriv(PRIV_OFF, PRIV_PERMITTED, ps) == 0);
+
+	(void) asprintf(&path, "/dev/vnd/%s", argv[1]);
+	assert(path != NULL);
+	fd2 = open(path, O_RDWR);
+	assert(fd2 == -1);
+	assert(errno == EPERM);
+
+	free(path);
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.olink.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.olink.c
new file mode 100644
index 0000000000..0f9292bbae
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.olink.c
@@ -0,0 +1,77 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Open a /dev/vnd/%s link
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	char *path;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	(void) strlcpy(vil.vil_name, argv[1], VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == 0);
+	assert(vil.vil_errno == 0);
+
+	ret = asprintf(&path, "/dev/vnd/%s", argv[1]);
+	assert(ret != -1);
+
+	ret = open(path, O_RDONLY);
+	assert(ret > 0);
+	assert(close(ret) == 0);
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.olinknopriv.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.olinknopriv.c
new file mode 100644
index 0000000000..338218e751
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.olinknopriv.c
@@ -0,0 +1,83 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Fail to open a /dev/vnd/%s without PRIV_NET_RAWACCESS
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <priv.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	char *path;
+	priv_set_t *ps;
+	vnd_ioc_attach_t via;
+	vnd_ioc_link_t vil;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	(void) strlcpy(vil.vil_name, argv[1], VND_NAMELEN);
+	vil.vil_errno = 0;
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(ret == 0);
+	assert(vil.vil_errno == 0);
+
+	ret = asprintf(&path, "/dev/vnd/%s", argv[1]);
+	assert(ret != -1);
+
+	ps = priv_allocset();
+	assert(ps != NULL);
+	assert(priv_addset(ps, PRIV_NET_RAWACCESS) == 0);
+	assert(setppriv(PRIV_OFF, PRIV_PERMITTED, ps) == 0);
+
+	ret = open(path, O_RDWR);
+	assert(ret == -1);
+	assert(errno == EPERM);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/create.rmenolink.c b/usr/src/cmd/vndadm/test/tst/ioctl/create.rmenolink.c
new file mode 100644
index 0000000000..d44e6512a7
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/create.rmenolink.c
@@ -0,0 +1,69 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Verify that unlink fails when we're not linked.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	vnd_ioc_attach_t via;
+	vnd_ioc_unlink_t viu;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == 0);
+	assert(via.via_errno == 0);
+
+	viu.viu_errno = 0;
+	ret = ioctl(fd, VND_IOC_UNLINK, &viu);
+	assert(ret == -1);
+	assert(viu.viu_errno == VND_E_NOTLINKED);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/tst.attachrdonly.c b/usr/src/cmd/vndadm/test/tst/ioctl/tst.attachrdonly.c
new file mode 100644
index 0000000000..29def6182d
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/tst.attachrdonly.c
@@ -0,0 +1,63 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Fail to attach when /dev/vnd/ctl is opened read only.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <assert.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	vnd_ioc_attach_t via;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= VND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDONLY);
+	assert(fd > 0);
+
+	(void) strlcpy(via.via_name, argv[1], VND_NAMELEN);
+	via.via_zoneid = 0;
+	via.via_errno = 0;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, &via);
+	assert(ret == -1);
+	assert(errno == EBADF);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/tst.badioctl.c b/usr/src/cmd/vndadm/test/tst/ioctl/tst.badioctl.c
new file mode 100644
index 0000000000..f26722f035
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/tst.badioctl.c
@@ -0,0 +1,79 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Throw a bunch of bad ioctls at us and make sure that we get ENOTTY.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <stdio.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <limits.h>
+#include <assert.h>
+
+/*
+ * We're including a bunch of bad header files that have ioctl numbers that we
+ * know we shouldn't.
+ */
+#include <sys/ipd.h>
+#include <sys/dtrace.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+/*
+ * A series of bad requests
+ */
+static int requests[] = {
+	0,
+	1,
+	42,
+	169,
+	4096,
+	INT_MAX,
+	IPDIOC_CORRUPT,
+	IPDIOC_REMOVE,
+	DTRACEIOC_CONF,
+	DTRACEIOC_REPLICATE,
+	-1
+};
+
+int
+main(void)
+{
+	int fd, i;
+
+	fd = open(VND_PATH, O_RDONLY);
+	if (fd < 0) {
+		(void) fprintf(stderr, "failed to open %s read only: %s\n",
+		    VND_PATH, strerror(errno));
+		return (1);
+	}
+
+	for (i = 0; requests[i] != -1; i++) {
+		int ret;
+		ret = ioctl(fd, requests[i], NULL);
+		assert(ret == -1);
+		assert(errno == ENOTTY);
+	}
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/tst.basicopenctl.c b/usr/src/cmd/vndadm/test/tst/ioctl/tst.basicopenctl.c
new file mode 100644
index 0000000000..852ad5550f
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/tst.basicopenctl.c
@@ -0,0 +1,76 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Ensure that we can do a basic open of the device for read, write, and
+ * read/write.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <stdio.h>
+#include <strings.h>
+#include <unistd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(void)
+{
+	int fd;
+
+	fd = open(VND_PATH, O_RDONLY);
+	if (fd < 0) {
+		(void) fprintf(stderr, "failed to open %s read only: %s\n",
+		    VND_PATH, strerror(errno));
+		return (1);
+	}
+
+	if (close(fd) != 0) {
+		(void) fprintf(stderr, "failed to close vnd fd: %s\n",
+		    strerror(errno));
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR);
+	if (fd < 0) {
+		(void) fprintf(stderr, "failed to open %s read/write: %s\n",
+		    VND_PATH, strerror(errno));
+		return (1);
+	}
+
+	if (close(fd) != 0) {
+		(void) fprintf(stderr, "failed to close vnd fd: %s\n",
+		    strerror(errno));
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_WRONLY);
+	if (fd < 0) {
+		(void) fprintf(stderr, "failed to open %s write only: %s\n",
+		    VND_PATH, strerror(errno));
+		return (1);
+	}
+
+	if (close(fd) != 0) {
+		(void) fprintf(stderr, "failed to close vnd fd: %s\n",
+		    strerror(errno));
+		return (1);
+	}
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/tst.gioctlfault.c b/usr/src/cmd/vndadm/test/tst/ioctl/tst.gioctlfault.c
new file mode 100644
index 0000000000..b581b5dd4c
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/tst.gioctlfault.c
@@ -0,0 +1,78 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Pass pointers to arbitrary addresses and make sure we properly get EFAULT for
+ * all the global ioctls.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <stdio.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <limits.h>
+#include <assert.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(void)
+{
+	int fd, ret;
+	vnd_ioc_attach_t *via;
+	vnd_ioc_list_t *vil;
+	vnd_ioc_buf_t *vib;
+
+	fd = open(VND_PATH, O_RDWR);
+	if (fd < 0) {
+		(void) fprintf(stderr, "failed to open %s r/w: %s\n", VND_PATH,
+		    strerror(errno));
+		return (1);
+	}
+
+	via = (vnd_ioc_attach_t *)(uintptr_t)23;
+	vil = (vnd_ioc_list_t *)(uintptr_t)42;
+	vib = (vnd_ioc_buf_t *)(uintptr_t)169;
+
+	ret = ioctl(fd, VND_IOC_ATTACH, NULL);
+	assert(ret == -1);
+	assert(errno == EFAULT);
+	ret = ioctl(fd, VND_IOC_LIST, NULL);
+	assert(ret == -1);
+	assert(errno == EFAULT);
+	ret = ioctl(fd, VND_IOC_GETMAXBUF, NULL);
+	assert(ret == -1);
+	assert(errno == EFAULT);
+
+	ret = ioctl(fd, VND_IOC_ATTACH, via);
+	assert(ret == -1);
+	assert(errno == EFAULT);
+	ret = ioctl(fd, VND_IOC_LIST, vil);
+	assert(ret == -1);
+	assert(errno == EFAULT);
+	ret = ioctl(fd, VND_IOC_GETMAXBUF, vib);
+	assert(ret == -1);
+	assert(errno == EFAULT);
+
+	assert(close(fd) == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/tst.gioctlnattach.c b/usr/src/cmd/vndadm/test/tst/ioctl/tst.gioctlnattach.c
new file mode 100644
index 0000000000..98acffa194
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/tst.gioctlnattach.c
@@ -0,0 +1,100 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Here we test that all the ioctls which require us to be on a local device
+ * fail to work. Specifically, the errno should be VND_E_NOTATTACHED
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <stdio.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <limits.h>
+#include <assert.h>
+#include <stdlib.h>
+
+#include <sys/vnd.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+static int vib_ioc[] = {
+	VND_IOC_GETRXBUF,
+	VND_IOC_SETRXBUF,
+	VND_IOC_GETTXBUF,
+	VND_IOC_SETTXBUF,
+	VND_IOC_GETMINTU,
+	VND_IOC_GETMAXTU,
+	-1
+};
+
+int
+main(void)
+{
+	int fd, ret, i;
+	vnd_ioc_link_t vil;
+	vnd_ioc_unlink_t viu;
+	vnd_ioc_buf_t vib;
+	frameio_t *fio;
+	char buf[1];
+
+	fd = open(VND_PATH, O_RDWR);
+	if (fd < 0) {
+		(void) fprintf(stderr, "failed to open %s r/w: %s\n", VND_PATH,
+		    strerror(errno));
+		return (1);
+	}
+
+	bzero(&vil, sizeof (vnd_ioc_link_t));
+	vil.vil_name[0] = 'a';
+	bzero(&viu, sizeof (vnd_ioc_unlink_t));
+	bzero(&vib, sizeof (vnd_ioc_buf_t));
+	fio = malloc(sizeof (frameio_t) + sizeof (framevec_t));
+	assert(fio != NULL);
+	fio->fio_version = FRAMEIO_CURRENT_VERSION;
+	fio->fio_nvpf = 1;
+	fio->fio_nvecs = 1;
+	fio->fio_vecs[0].fv_buf = buf;
+	fio->fio_vecs[0].fv_buflen = 1;
+
+	ret = ioctl(fd, VND_IOC_LINK, &vil);
+	assert(vil.vil_errno == VND_E_NOTATTACHED);
+	ret = ioctl(fd, VND_IOC_UNLINK, &viu);
+	assert(viu.viu_errno == VND_E_NOTLINKED);
+
+	for (i = 0; vib_ioc[i] != -1; i++) {
+		bzero(&vib, sizeof (vib));
+		ret = ioctl(fd, vib_ioc[i], &vib);
+		assert(vib.vib_errno == VND_E_NOTATTACHED);
+	}
+
+	/* The frameio ioctls only use standard errnos */
+	ret = ioctl(fd, VND_IOC_FRAMEIO_READ, fio);
+	assert(ret == -1);
+	assert(errno == ENXIO);
+	ret = ioctl(fd, VND_IOC_FRAMEIO_WRITE, fio);
+	assert(ret == -1);
+	assert(errno == ENXIO);
+
+	free(fio);
+	assert(close(fd) == 0);
+
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/tst.iocsize.ksh b/usr/src/cmd/vndadm/test/tst/ioctl/tst.iocsize.ksh
new file mode 100644
index 0000000000..9b30043d47
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/tst.iocsize.ksh
@@ -0,0 +1,54 @@
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# Ensure structure sizes for both ILP32 and LP64 are the same
+#
+
+vt_arg0=$(basename $0)
+vt_structs="vnd_ioc_attach_t vnd_ioc_link_t vnd_ioc_unlink_t"
+vt_structs="$vt_structs vnd_ioc_nonblock_t vnd_ioc_buf_t vnd_ioc_info_t"
+
+vt_t32="/tmp/vnd.iocsize.32.$$"
+vt_t64="/tmp/vnd.iocsize.64.$$"
+
+function fatal
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "$vt_arg0: $msg" >&2
+	exit 1
+}
+
+function dump_types
+{
+	typeset file=$1
+	typeset lib=$2
+	typeset t
+
+	for t in $vn_structs; do
+		mdb -e \'::print -at $t\' $lib >> $file || fatal \
+		    "failed to dump type $t from $lib"
+	done
+}
+
+rm -f $vt_t32 $vt_t64 || fatal "failed to cleanup old temp files"
+touch $vt_t32 $vt_t64 || fatal "failed to create temp files"
+
+dump_types $vt_t32 /usr/lib/libvnd.so.1
+dump_types $vt_t64 /usr/lib/64/libvnd.so.1
+
+diff $vt_t32 $vt_t64
diff --git a/usr/src/cmd/vndadm/test/tst/ioctl/tst.openctlbadflags.c b/usr/src/cmd/vndadm/test/tst/ioctl/tst.openctlbadflags.c
new file mode 100644
index 0000000000..65e48029b7
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/ioctl/tst.openctlbadflags.c
@@ -0,0 +1,88 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Make sure that we can't open the vnd control device with invalid flags.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <stdio.h>
+
+#define	VND_PATH	"/dev/vnd/ctl"
+
+int
+main(void)
+{
+	int fd;
+
+	fd = open(VND_PATH, O_RDONLY | O_EXCL);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_EXCL!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR | O_EXCL);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_EXCL!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_WRONLY | O_EXCL);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_EXCL!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDONLY | O_NDELAY);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_NDELAY!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR | O_NDELAY);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_NDELAY!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_WRONLY | O_NDELAY);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_NDELAY!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDONLY | O_NDELAY | O_EXCL);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_NDELAY | O_EXCL!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_RDWR | O_NDELAY | O_EXCL);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_NDELAY | O_EXCL!");
+		return (1);
+	}
+
+	fd = open(VND_PATH, O_WRONLY | O_NDELAY | O_EXCL);
+	if (fd != -1) {
+		(void) fprintf(stderr, "somehow opened vnd O_NDELAY | O_EXCL!");
+		return (1);
+	}
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/Makefile b/usr/src/cmd/vndadm/test/tst/lib/Makefile
new file mode 100644
index 0000000000..d7a1ed8fa5
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/Makefile
@@ -0,0 +1,44 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+TSTDIR =	lib
+EXETESTS = \
+	create.basic.exe \
+	create.badlink.exe \
+	create.badpropid.exe \
+	create.badpropsize.exe \
+	create.badzone.exe \
+	create.enomem.exe \
+	create.frameioeagain.exe \
+	create.open.exe \
+	create.propiter.exe \
+	create.proprdonly.exe \
+	err.badclose.exe \
+	tst.badopen.exe \
+	tst.strerror.exe \
+	tst.strsyserror.exe
+OUTFILES = tst.strerror.exe.out
+SHTESTS =
+SUPBOBJS =
+
+CLOBBERFILES =	$(EXETESTS)
+
+include ../../Makefile.com
+
+LDLIBS += -lvnd
+
+install: $(ROOTTESTS)
+
+include ../../Makefile.targ
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.badlink.c b/usr/src/cmd/vndadm/test/tst/lib/create.badlink.c
new file mode 100644
index 0000000000..aefec3ed44
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.badlink.c
@@ -0,0 +1,39 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Make sure that we can't create something in the context of a datalink that
+ * doesn't exist.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <libvnd.h>
+
+int
+main(void)
+{
+	int syserr;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+
+	vhp = vnd_create(NULL, "foobar", "foobar", &vnderr, &syserr);
+	(void) printf("%d, %d\n", vnderr, syserr);
+	assert(vhp == NULL);
+	assert(vnderr == VND_E_NODATALINK);
+	assert(syserr == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.badpropid.c b/usr/src/cmd/vndadm/test/tst/lib/create.badpropid.c
new file mode 100644
index 0000000000..15334fa31c
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.badpropid.c
@@ -0,0 +1,76 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Make sure that we can't get and set nonexisting properties.
+ */
+
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr, ret;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+
+	ret = vnd_prop_get(vhp, VND_PROP_MAX, NULL, 0);
+	assert(ret == -1);
+	assert(vnd_errno(vhp) == VND_E_BADPROP);
+	assert(vnd_syserrno(vhp) == 0);
+
+	ret = vnd_prop_get(vhp, VND_PROP_MAX + 5, NULL, 0);
+	assert(ret == -1);
+	assert(vnd_errno(vhp) == VND_E_BADPROP);
+	assert(vnd_syserrno(vhp) == 0);
+
+	ret = vnd_prop_set(vhp, VND_PROP_MAX, NULL, 0);
+	assert(ret == -1);
+	assert(vnd_errno(vhp) == VND_E_BADPROP);
+	assert(vnd_syserrno(vhp) == 0);
+
+	ret = vnd_prop_set(vhp, VND_PROP_MAX + 5, NULL, 0);
+	assert(ret == -1);
+	assert(vnd_errno(vhp) == VND_E_BADPROP);
+	assert(vnd_syserrno(vhp) == 0);
+
+	ret = vnd_prop_writeable(VND_PROP_MAX, NULL);
+	assert(ret == -1);
+
+	ret = vnd_prop_writeable(VND_PROP_MAX + 5, NULL);
+	assert(ret == -1);
+
+	vnd_close(vhp);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.badpropsize.c b/usr/src/cmd/vndadm/test/tst/lib/create.badpropsize.c
new file mode 100644
index 0000000000..d5fefd3764
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.badpropsize.c
@@ -0,0 +1,63 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Validate that we can't set properties with bogus sizes.
+ */
+
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <limits.h>
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr, ret, i;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+
+	for (i = 0; i < VND_PROP_MAX; i++) {
+		ret = vnd_prop_get(vhp, i, NULL, INT32_MAX);
+		assert(ret == -1);
+		assert(vnd_errno(vhp) == VND_E_BADPROPSIZE);
+		assert(vnd_syserrno(vhp) == 0);
+
+		ret = vnd_prop_set(vhp, i, NULL, INT32_MAX);
+		assert(ret == -1);
+		assert(vnd_errno(vhp) == VND_E_BADPROPSIZE);
+		assert(vnd_syserrno(vhp) == 0);
+	}
+
+	vnd_close(vhp);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.badzone.c b/usr/src/cmd/vndadm/test/tst/lib/create.badzone.c
new file mode 100644
index 0000000000..30f9612963
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.badzone.c
@@ -0,0 +1,43 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Make sure that we can't create something in the context of a zone that
+ * doesn't exist.
+ */
+
+#include <assert.h>
+#include <sys/zone.h>
+#include <string.h>
+#include <libvnd.h>
+
+int
+main(void)
+{
+	int syserr;
+	vnd_errno_t vnderr;
+	char zname[ZONENAME_MAX+4];
+	vnd_handle_t *vhp;
+
+	(void) memset(zname, 'a', sizeof (zname));
+	zname[ZONENAME_MAX+3] = '\0';
+
+	vhp = vnd_create(zname, "foobar", "foobar", &vnderr, &syserr);
+	assert(vhp == NULL);
+	assert(vnderr == VND_E_NOZONE);
+	assert(syserr == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.basic.c b/usr/src/cmd/vndadm/test/tst/lib/create.basic.c
new file mode 100644
index 0000000000..5335f8cbb4
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.basic.c
@@ -0,0 +1,49 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Simple create and destroy.
+ */
+
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+	vnd_close(vhp);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.enomem.c b/usr/src/cmd/vndadm/test/tst/lib/create.enomem.c
new file mode 100644
index 0000000000..9203e369ae
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.enomem.c
@@ -0,0 +1,91 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Verify that we can't allocate a handle when in an ENOMEM situation.
+ */
+
+#include <procfs.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <sys/sysmacros.h>
+#include <assert.h>
+#include <strings.h>
+
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int fd;
+	int syserr;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+	pstatus_t status;
+	void *addr;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	fd = open("/proc/self/status", O_RDONLY);
+	if (fd < 0)
+		exit(1);
+	if (read(fd, &status, sizeof (status)) != sizeof (status))
+		exit(1);
+
+	addr = mmap((caddr_t)P2ROUNDUP(status.pr_brkbase +
+	    status.pr_brksize, 0x1000), 0x1000,
+	    PROT_READ, MAP_ANON | MAP_FIXED | MAP_PRIVATE, -1, 0);
+	if (addr == (void *)-1) {
+		perror("mmap");
+		exit(1);
+	}
+
+	/* malloc an approximate size of the vnd_handle_t */
+	for (;;) {
+		void *buf;
+
+		buf = malloc(8);
+		if (buf == NULL)
+			break;
+	}
+
+	for (;;) {
+		void *buf;
+
+		buf = malloc(4);
+		if (buf == NULL)
+			break;
+	}
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp == NULL);
+	assert(vnderr == VND_E_NOMEM);
+	assert(syserr == 0);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.frameioeagain.c b/usr/src/cmd/vndadm/test/tst/lib/create.frameioeagain.c
new file mode 100644
index 0000000000..6cb14fb7df
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.frameioeagain.c
@@ -0,0 +1,80 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Create a datalink, set it to non-blocking mode and ensure that we get EAGAIN
+ * from frame I/O calls. Note that if this test is not plumbed up over an
+ * etherstub, then it is likely that other traffic will appear on the device and
+ * this will fail. Note that the test suite always creates these devices over an
+ * etherstub.
+ */
+
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr, ret, fd;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+	frameio_t *fio;
+	char buf[1520];
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+
+	fd = vnd_pollfd(vhp);
+	ret = fcntl(fd, F_SETFL, O_NONBLOCK);
+	assert(ret == 0);
+
+	fio = malloc(sizeof (frameio_t) +
+	    sizeof (framevec_t));
+	assert(fio != NULL);
+	fio->fio_version = FRAMEIO_CURRENT_VERSION;
+	fio->fio_nvpf = 1;
+	fio->fio_nvecs = 1;
+
+	fio->fio_vecs[0].fv_buf = buf;
+	fio->fio_vecs[0].fv_buflen = sizeof (buf);
+
+	ret = vnd_frameio_read(vhp, fio);
+	(void) printf("%d, %d\n", ret, errno);
+	assert(ret == -1);
+	assert(errno == EAGAIN);
+
+	vnd_close(vhp);
+	free(fio);
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.open.c b/usr/src/cmd/vndadm/test/tst/lib/create.open.c
new file mode 100644
index 0000000000..9cb1d7e40e
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.open.c
@@ -0,0 +1,56 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Make sure we can open a created datalink.
+ */
+
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp, *vhp2;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+
+	vhp2 = vnd_open(NULL, argv[1], &vnderr, &syserr);
+	assert(vhp2 != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+
+	vnd_close(vhp2);
+	vnd_close(vhp);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.propiter.c b/usr/src/cmd/vndadm/test/tst/lib/create.propiter.c
new file mode 100644
index 0000000000..a0b46180f7
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.propiter.c
@@ -0,0 +1,79 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Ensure that vnd_prop_iter sees all props;
+ */
+
+#include <stdio.h>
+#include <strings.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <libvnd.h>
+
+static boolean_t *g_props;
+
+/* ARGSUSED */
+static int
+prop_cb(vnd_handle_t *vhp, vnd_prop_t prop, void *unused)
+{
+	assert(prop < VND_PROP_MAX);
+	g_props[prop] = B_TRUE;
+
+	return (0);
+}
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr, i, ret;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	g_props = malloc(sizeof (boolean_t) * VND_PROP_MAX);
+	if (g_props == NULL) {
+		(void) fprintf(stderr, "failed to alloc memory for %d "
+		    "boolean_t\n", VND_PROP_MAX);
+		return (1);
+	}
+	for (i = 0; i < VND_PROP_MAX; i++)
+		g_props[i] = B_FALSE;
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+
+	ret = vnd_prop_iter(vhp, prop_cb, NULL);
+	assert(ret == 0);
+
+	for (i = 0; i < VND_PROP_MAX; i++)
+		assert(g_props[i] == B_TRUE);
+
+	free(g_props);
+	vnd_close(vhp);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/create.proprdonly.c b/usr/src/cmd/vndadm/test/tst/lib/create.proprdonly.c
new file mode 100644
index 0000000000..18b1f7d58d
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/create.proprdonly.c
@@ -0,0 +1,63 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Validate that we can't set read only properties
+ */
+
+#include <errno.h>
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <limits.h>
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr, ret;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+	vnd_prop_buf_t vpb;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	vhp = vnd_create(NULL, argv[1], argv[1], &vnderr, &syserr);
+	assert(vhp != NULL);
+	assert(vnderr == 0);
+	assert(syserr == 0);
+
+	ret = vnd_prop_get(vhp, VND_PROP_MINTU, &vpb,
+	    sizeof (vnd_prop_buf_t));
+	assert(ret == 0);
+
+	ret = vnd_prop_set(vhp, VND_PROP_MINTU, &vpb,
+	    sizeof (vnd_prop_buf_t));
+	assert(ret == -1);
+	assert(vnd_errno(vhp) == VND_E_PROPRDONLY);
+	assert(vnd_syserrno(vhp) == 0);
+
+	vnd_close(vhp);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/err.badclose.c b/usr/src/cmd/vndadm/test/tst/lib/err.badclose.c
new file mode 100644
index 0000000000..8c832506a0
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/err.badclose.c
@@ -0,0 +1,33 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * This program should segfault.
+ */
+
+#include <errno.h>
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <libvnd.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp = (void *)0x42;
+	vnd_close(vhp);
+	/* This should not be reached */
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/tst.badopen.c b/usr/src/cmd/vndadm/test/tst/lib/tst.badopen.c
new file mode 100644
index 0000000000..4f67ce79ed
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/tst.badopen.c
@@ -0,0 +1,49 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Make sure we can't open a vnd device that doesn't exist
+ */
+
+#include <errno.h>
+#include <stdio.h>
+#include <strings.h>
+#include <assert.h>
+#include <libvnd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int syserr;
+	vnd_errno_t vnderr;
+	vnd_handle_t *vhp;
+
+	if (argc < 2) {
+		(void) fprintf(stderr, "missing arguments...\n");
+		return (1);
+	}
+
+	if (strlen(argv[1]) >= LIBVND_NAMELEN) {
+		(void) fprintf(stderr, "vnic name too long...\n");
+		return (1);
+	}
+
+	vhp = vnd_open(NULL, argv[1], &vnderr, &syserr);
+	assert(vhp == NULL);
+	assert(vnderr == VND_E_SYS);
+	assert(syserr == ENOENT);
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/tst.strerror.c b/usr/src/cmd/vndadm/test/tst/lib/tst.strerror.c
new file mode 100644
index 0000000000..a99a9ecbf6
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/tst.strerror.c
@@ -0,0 +1,30 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Verify that all the error strings we care about match what we expect.
+ */
+
+#include <stdio.h>
+#include <libvnd.h>
+
+int
+main(void)
+{
+	int i;
+	for (i = 0; i <= VND_E_UNKNOWN + 1; i++)
+		(void) printf("[%s]\n", vnd_strerror(i));
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/test/tst/lib/tst.strerror.exe.out b/usr/src/cmd/vndadm/test/tst/lib/tst.strerror.exe.out
new file mode 100644
index 0000000000..83dbcdfdb4
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/tst.strerror.exe.out
@@ -0,0 +1,37 @@
+[no error]
+[not enough memory available]
+[no such datalink]
+[datalink not of type DL_ETHER]
+[unknown dlpi failure]
+[DL_ATTACH_REQ failed]
+[DL_BIND_REQ failed]
+[DL_PROMISCON_REQ failed]
+[DLD_CAPAB_DIRECT enable failed]
+[bad datalink capability]
+[bad datalink subcapability]
+[bad dld version]
+[failed to create kstats]
+[no such vnd link]
+[netstack doesn't exist]
+[device already associated]
+[device already attached]
+[device already linked]
+[invalid name]
+[permission denied]
+[no such zone]
+[failed to initialize vnd stream module]
+[device not attached]
+[device not linked]
+[another device has the same link name]
+[failed to create minor node]
+[requested buffer size is too large]
+[requested buffer size is too small]
+[unable to obtain exclusive access to dlpi link, link busy]
+[DLD direct capability not supported over data link]
+[invalid property size]
+[invalid property]
+[property is read only]
+[unexpected system error]
+[capabilities invalid, pass-through module detected]
+[unknown error]
+[unknown error]
diff --git a/usr/src/cmd/vndadm/test/tst/lib/tst.strsyserror.c b/usr/src/cmd/vndadm/test/tst/lib/tst.strsyserror.c
new file mode 100644
index 0000000000..b95e6372e4
--- /dev/null
+++ b/usr/src/cmd/vndadm/test/tst/lib/tst.strsyserror.c
@@ -0,0 +1,50 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Verify that the error message from libvnd's strsyserrno is the same as the
+ * underlying strerror function's. It should be. We'll just check an assortment
+ * of errnos.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <libvnd.h>
+
+int
+main(void)
+{
+	int i;
+	const char *vnd, *libc;
+	for (i = 0; i < 42; i++) {
+		vnd = vnd_strsyserror(i);
+		libc = strerror(i);
+		if ((vnd != NULL && libc == NULL) ||
+		    (vnd == NULL && libc != NULL)) {
+			(void) fprintf(stderr, "errno %d, vnd: %p, libc: %p",
+			    i, (void *)vnd, (void *)libc);
+			return (1);
+		}
+		if (vnd != NULL && strcmp(vnd, libc) != 0) {
+			(void) fprintf(stderr,
+			    "errno %d: libc and vnd disagree.\n", i);
+			(void) fprintf(stderr, "vnd: %s\n", vnd);
+			(void) fprintf(stderr, "libc: %s\n", libc);
+			return (1);
+		}
+	}
+
+	return (0);
+}
diff --git a/usr/src/cmd/vndadm/vndadm.c b/usr/src/cmd/vndadm/vndadm.c
new file mode 100644
index 0000000000..6811663696
--- /dev/null
+++ b/usr/src/cmd/vndadm/vndadm.c
@@ -0,0 +1,872 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#include <errno.h>
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <string.h>
+#include <assert.h>
+#include <libgen.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <zone.h>
+
+#include <libvnd.h>
+
+typedef int (*vndadm_print_t)(vnd_handle_t *, vnd_prop_t);
+typedef int (*vndadm_parse_t)(char *, void **, size_t *);
+
+typedef struct vndadm_proptbl {
+	const char *vp_name;
+	vndadm_print_t vp_print;
+	vndadm_parse_t vp_parse;
+} vndadm_proptbl_t;
+
+/*
+ * Forwards
+ */
+static int usage(const char *, ...);
+static int vndadm_print_size(vnd_handle_t *, vnd_prop_t);
+static int vndadm_print_number(vnd_handle_t *, vnd_prop_t);
+static int vndadm_parse_size(char *, void **, size_t *);
+
+/*
+ * Globals
+ */
+static char *vnd_pname;
+
+static void
+vnd_vwarn(vnd_errno_t verr, int syserr, const char *format, va_list alist)
+{
+	(void) fprintf(stderr, "%s: ", vnd_pname);
+	(void) vfprintf(stderr, format, alist);
+	if (strchr(format, '\n') == NULL) {
+		(void) fprintf(stderr, ": %s\n", verr != VND_E_SYS ?
+		    vnd_strerror(verr) : vnd_strsyserror(syserr));
+	}
+}
+
+static void
+vnd_libwarn(vnd_errno_t verr, int syserr, const char *format, ...)
+{
+	va_list alist;
+
+	va_start(alist, format);
+	vnd_vwarn(verr, syserr, format, alist);
+	va_end(alist);
+}
+
+static void
+vnd_warn(const char *format, ...)
+{
+	va_list alist;
+
+	va_start(alist, format);
+	vnd_vwarn(0, 0, format, alist);
+	va_end(alist);
+}
+
+static vndadm_proptbl_t vndadm_propname_tbl[] = {
+	{ "rxbuf", vndadm_print_size,
+		vndadm_parse_size },		/* VND_PROP_RXBUF */
+	{ "txbuf", vndadm_print_size,
+		vndadm_parse_size },		/* VND_PROP_TXBUF */
+	{ "maxsize", vndadm_print_size, NULL },	/* VND_PROP_MAXBUF */
+	{ "mintu", vndadm_print_number, NULL },	/* VND_PROP_MINTU */
+	{ "maxtu", vndadm_print_number, NULL },	/* VND_PROP_MAXTU */
+	NULL					/* VND_PROP_MAX */
+};
+
+static const char *
+vndadm_prop_to_name(vnd_prop_t prop)
+{
+	if (prop > VND_PROP_MAX)
+		return (NULL);
+
+	return (vndadm_propname_tbl[prop].vp_name);
+}
+
+static vnd_prop_t
+vndadm_name_to_prop(const char *name)
+{
+	int i;
+
+	for (i = 0; i < VND_PROP_MAX; i++) {
+		if (strcmp(name, vndadm_propname_tbl[i].vp_name) == 0)
+			return (i);
+	}
+
+	return (VND_PROP_MAX);
+}
+
+static int
+vndadm_print_size(vnd_handle_t *vhp, vnd_prop_t prop)
+{
+	vnd_prop_buf_t buf;
+
+	if (vnd_prop_get(vhp, prop, &buf, sizeof (buf)) != 0) {
+		vnd_libwarn(vnd_errno(vhp), vnd_syserrno(vhp),
+		    "failed to get property %s", vndadm_prop_to_name(prop));
+		return (1);
+	}
+
+	(void) printf("%lld", buf.vpb_size);
+	return (0);
+}
+
+static int
+vndadm_print_number(vnd_handle_t *vhp, vnd_prop_t prop)
+{
+	vnd_prop_buf_t buf;
+
+	if (vnd_prop_get(vhp, prop, &buf, sizeof (buf)) != 0) {
+		vnd_libwarn(vnd_errno(vhp), vnd_syserrno(vhp),
+		    "failed to get property %s", vndadm_prop_to_name(prop));
+		return (1);
+	}
+
+	(void) printf("%lld", buf.vpb_size);
+	return (0);
+}
+
+static int
+vndadm_parse_size(char *str, void **bufp, size_t *sizep)
+{
+	char *end;
+	unsigned long long val, orig;
+	vnd_prop_buf_t *buf;
+
+	errno = 0;
+	val = strtoull(str, &end, 10);
+	if (errno != 0) {
+		vnd_warn("%s: not a number\n", str);
+		return (1);
+	}
+
+	orig = val;
+	switch (*end) {
+	case 'g':
+	case 'G':
+		val *= 1024;
+		if (val < orig)
+			goto overflow;
+		/*FALLTHRU*/
+	case 'm':
+	case 'M':
+		val *= 1024;
+		if (val < orig)
+			goto overflow;
+		/*FALLTHRU*/
+	case 'k':
+	case 'K':
+		val *= 1024;
+		if (val < orig)
+			goto overflow;
+		end++;
+		break;
+	default:
+		break;
+	}
+
+	if (*end == 'b' || *end == 'B')
+		end++;
+	if (*end != '\0') {
+		vnd_warn("%s: not a number", str);
+		return (1);
+	}
+
+	buf = malloc(sizeof (vnd_prop_buf_t));
+	if (buf == NULL) {
+		vnd_warn("failed to allocate memory for setting a property");
+		return (1);
+	}
+
+	buf->vpb_size = val;
+	*bufp = buf;
+	*sizep = sizeof (vnd_prop_buf_t);
+
+	return (0);
+
+overflow:
+	vnd_warn("value overflowed: %s\n", str);
+	return (1);
+}
+
+static void
+vndadm_create_usage(FILE *out)
+{
+	(void) fprintf(out, "\tcreate:\t\t[-z zonename] -l datalink name\n");
+}
+
+static int
+vndadm_create(int argc, char *argv[])
+{
+	int c, syserr;
+	vnd_errno_t vnderr;
+	const char *datalink = NULL;
+	const char *linkname = NULL;
+	const char *zonename = NULL;
+	vnd_handle_t *vhp;
+
+	optind = 0;
+	while ((c = getopt(argc, argv, ":z:l:")) != -1) {
+		switch (c) {
+		case 'l':
+			datalink = optarg;
+			break;
+		case 'z':
+			zonename = optarg;
+			break;
+		case ':':
+			return (usage("-%c requires an operand\n", optopt));
+		case '?':
+			return (usage("unknown option: -%c\n", optopt));
+		default:
+			abort();
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc < 1) {
+		return (usage("missing required link name\n"));
+	} else if (argc > 1) {
+		return (usage("create: too many arguments for link name, "
+		    "pick one\n"));
+	}
+	linkname = argv[0];
+	if (datalink == NULL)
+		datalink = linkname;
+
+	vhp = vnd_create(zonename, datalink, linkname, &vnderr, &syserr);
+	if (vhp == NULL) {
+		vnd_libwarn(vnderr, syserr,
+		    "failed to create datapath link %s", linkname);
+		return (1);
+	}
+
+	vnd_close(vhp);
+	return (0);
+}
+
+static void
+vndadm_destroy_usage(FILE *out)
+{
+	(void) fprintf(out, "\tdestroy:\t[-z zonename] [link]...\n");
+}
+
+static int
+vndadm_destroy(int argc, char *argv[])
+{
+	vnd_handle_t *vhp;
+	int c, syserr;
+	vnd_errno_t vnderr;
+	const char *zonename = NULL;
+
+	optind = 0;
+	while ((c = getopt(argc, argv, ":z:")) != -1) {
+		switch (c) {
+		case 'z':
+			zonename = optarg;
+			break;
+		case ':':
+			return (usage("-%c requires an operand\n", optopt));
+		case '?':
+			return (usage("unknown option: -%c\n", optopt));
+		default:
+			abort();
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc != 1) {
+		return (usage("extraneous arguments\n"));
+	}
+
+	vhp = vnd_open(zonename, argv[0], &vnderr, &syserr);
+	if (vhp == NULL) {
+		vnd_libwarn(vnderr, syserr, "failed to open link: %s", argv[0]);
+		return (1);
+	}
+
+	if (vnd_unlink(vhp) != 0) {
+		vnd_libwarn(vnd_errno(vhp), vnd_syserrno(vhp),
+		    "failed to destroy link %s", argv[0]);
+		return (1);
+	}
+
+	vnd_close(vhp);
+	return (0);
+}
+
+static void
+vndadm_list_usage(FILE *out)
+{
+	(void) fprintf(out, "\tlist:\t\t[-p] [-d delim] [-o field,...] "
+	    "[-z zonename] [link]...\n");
+}
+
+#define	VNDADM_LIST_NFIELDS	3
+
+typedef struct vndadm_list_cb {
+	int vsc_argc;
+	char **vsc_argv;
+	int vsc_found;
+	boolean_t vsc_parse;
+	const char *vsc_delim;
+	int vsc_order[VNDADM_LIST_NFIELDS];
+	int vsc_last;
+	zoneid_t vsc_zid;
+} vndadm_list_cb_t;
+
+typedef struct vndadm_list_field {
+	const char *vlf_name;
+	const char *vlf_header;
+	int vlf_size;
+	void (*vlf_print)(struct vndadm_list_field *, vnd_info_t *, boolean_t);
+	void (*vlf_parse)(struct vndadm_list_field *, vnd_info_t *, boolean_t);
+} vndadm_list_field_t;
+
+static void
+vlf_print_link(vndadm_list_field_t *vlfp, vnd_info_t *viip,
+    boolean_t last)
+{
+	if (last == B_TRUE) {
+		(void) printf("%s", viip->vi_name);
+	} else {
+		(void) printf("%-*s", vlfp->vlf_size, viip->vi_name);
+	}
+}
+
+/* ARGSUSED */
+static void
+vlf_parse_link(vndadm_list_field_t *vlfp, vnd_info_t *viip,
+    boolean_t last)
+{
+	(void) printf("%s", viip->vi_name);
+}
+
+static void
+vlf_print_datalink(vndadm_list_field_t *vlfp, vnd_info_t *viip,
+    boolean_t last)
+{
+	if (last == B_TRUE) {
+		(void) printf("%s", viip->vi_datalink);
+	} else {
+		(void) printf("%-*s", vlfp->vlf_size, viip->vi_datalink);
+	}
+}
+
+/* ARGSUSED */
+static void
+vlf_parse_datalink(vndadm_list_field_t *vlfp, vnd_info_t *viip,
+    boolean_t last)
+{
+	(void) printf("%s", viip->vi_datalink);
+}
+
+static void
+vlf_print_zone(vndadm_list_field_t *vlfp, vnd_info_t *viip,
+    boolean_t last)
+{
+	char buf[ZONENAME_MAX];
+
+	if (getzonenamebyid(viip->vi_zone, buf, sizeof (buf)) <= 0)
+		(void) strlcpy(buf, "<unknown>", sizeof (buf));
+
+	if (last == B_TRUE) {
+		(void) printf("%s", buf);
+	} else {
+		(void) printf("%-*s", vlfp->vlf_size, buf);
+	}
+}
+
+/* ARGSUSED */
+static void
+vlf_parse_zone(vndadm_list_field_t *vlfp, vnd_info_t *viip,
+    boolean_t last)
+{
+	char buf[ZONENAME_MAX];
+
+	if (getzonenamebyid(viip->vi_zone, buf, sizeof (buf)) <= 0)
+		(void) strlcpy(buf, "<unknown>", sizeof (buf));
+
+	(void) printf("%s", buf);
+}
+
+static vndadm_list_field_t vlf_tbl[] = {
+	{ "name", "NAME", 16, vlf_print_link, vlf_parse_link },
+	{ "datalink", "DATALINK", 16, vlf_print_datalink, vlf_parse_datalink },
+	{ "zone", "ZONENAME", 32, vlf_print_zone, vlf_parse_zone },
+	{ NULL }
+};
+
+
+static int
+vndadm_list_f(vnd_info_t *viip, void *arg)
+{
+	int i;
+	boolean_t found;
+	vndadm_list_cb_t *vscp = arg;
+
+	if (vscp->vsc_zid != ALL_ZONES && vscp->vsc_zid != viip->vi_zone)
+		return (0);
+
+	if (vscp->vsc_argc != 0) {
+		found = B_FALSE;
+		for (i = 0; i < vscp->vsc_argc; i++) {
+			if (strcmp(viip->vi_name, vscp->vsc_argv[i]) == 0) {
+				found = B_TRUE;
+				break;
+			}
+		}
+		if (found == B_FALSE)
+			return (0);
+		vscp->vsc_found++;
+	}
+
+	for (i = 0; i < VNDADM_LIST_NFIELDS && vscp->vsc_order[i] != -1; i++) {
+		boolean_t last = i == vscp->vsc_last;
+		if (vscp->vsc_parse == B_TRUE)
+			vlf_tbl[vscp->vsc_order[i]].vlf_parse(
+			    &vlf_tbl[vscp->vsc_order[i]], viip, last);
+		else
+			vlf_tbl[vscp->vsc_order[i]].vlf_print(
+			    &vlf_tbl[vscp->vsc_order[i]], viip, last);
+
+		if (last == B_FALSE)
+			(void) printf("%s", vscp->vsc_delim);
+	}
+	(void) printf("\n");
+
+	return (0);
+}
+
+static int
+vndadm_list(int argc, char *argv[])
+{
+	int c, i, syserr;
+	vnd_errno_t vnderr;
+	boolean_t parse = B_FALSE;
+	const char *zonename = NULL, *delim = NULL;
+	char *fields = NULL;
+	vndadm_list_cb_t vsc;
+
+	optind = 0;
+	while ((c = getopt(argc, argv, ":pd:o:z:")) != -1) {
+		switch (c) {
+		case 'p':
+			parse = B_TRUE;
+			break;
+		case 'd':
+			delim = optarg;
+			break;
+		case 'o':
+			fields = optarg;
+			break;
+		case 'z':
+			zonename = optarg;
+			break;
+		case ':':
+			return (usage("-%c requires an operand\n", optopt));
+		case '?':
+			return (usage("unknown option: -%c\n", optopt));
+		default:
+			abort();
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	vsc.vsc_argc = argc;
+	vsc.vsc_argv = argv;
+	vsc.vsc_found = 0;
+	if (zonename != NULL) {
+		vsc.vsc_zid = getzoneidbyname(zonename);
+		if (vsc.vsc_zid == -1) {
+			vnd_warn("no such zone: %s\n", zonename);
+			return (1);
+		}
+	} else {
+		vsc.vsc_zid = ALL_ZONES;
+	}
+
+	/* Sanity check parseable related stuff */
+	if (delim != NULL && parse == B_FALSE) {
+		return (usage("-d cannot be used without -p\n"));
+	}
+
+	if (parse == B_TRUE && fields == NULL) {
+		return (usage("-p cannot be used without -o\n"));
+	}
+
+	/* validate our fields, if any */
+	if (fields != NULL) {
+		char *c, *n;
+		int floc = 0;
+
+		c = fields;
+		for (;;) {
+			if (floc >= VNDADM_LIST_NFIELDS) {
+				return (usage("too many fields specified "
+				    "for -o\n"));
+			}
+
+			n = strchr(c, ',');
+			if (n != NULL)
+				*n = '\0';
+
+			for (i = 0; i < VNDADM_LIST_NFIELDS; i++) {
+				if (strcasecmp(c, vlf_tbl[i].vlf_name) == 0)
+					break;
+			}
+			if (i == VNDADM_LIST_NFIELDS) {
+				vnd_warn("invalid field for -o: %s\nvalid "
+				    "fields are:", c);
+				for (i = 0; i < VNDADM_LIST_NFIELDS; i++)
+					vnd_warn(" %s", vlf_tbl[i].vlf_name);
+				vnd_warn("\n");
+				return (usage(NULL));
+			}
+			vsc.vsc_order[floc] = i;
+			floc++;
+
+			if (n == NULL)
+				break;
+			c = n + 1;
+		}
+
+		vsc.vsc_last = floc - 1;
+		while (floc < VNDADM_LIST_NFIELDS)
+			vsc.vsc_order[floc++] = -1;
+	} else {
+		vsc.vsc_order[0] = 0;
+		vsc.vsc_order[1] = 1;
+		vsc.vsc_order[2] = 2;
+	}
+
+	vsc.vsc_parse = parse;
+	vsc.vsc_delim = delim;
+	if (vsc.vsc_delim == NULL)
+		vsc.vsc_delim = " ";
+
+	if (vsc.vsc_parse != B_TRUE)  {
+		for (i = 0; i < VNDADM_LIST_NFIELDS && vsc.vsc_order[i] != -1;
+		    i++) {
+			if (i + 1 == VNDADM_LIST_NFIELDS) {
+				(void) printf("%s\n",
+				    vlf_tbl[vsc.vsc_order[i]].vlf_header);
+				continue;
+			}
+			(void) printf("%-*s ",
+			    vlf_tbl[vsc.vsc_order[i]].vlf_size,
+			    vlf_tbl[vsc.vsc_order[i]].vlf_header);
+		}
+	}
+
+	if (vnd_walk(vndadm_list_f, &vsc, &vnderr, &syserr) != 0) {
+		vnd_libwarn(vnderr, syserr, "failed to walk vnd links");
+		return (1);
+	}
+
+	if (argc > 0 && vsc.vsc_found == 0) {
+		vnd_warn("no links matched requested names\n");
+		return (1);
+	}
+
+	return (0);
+}
+
+typedef struct vndadm_get {
+	boolean_t vg_parse;
+	const char *vg_delim;
+	const char *vg_link;
+	int vg_argc;
+	char **vg_argv;
+} vndadm_get_t;
+
+static int
+vndadm_get_cb(vnd_handle_t *vhp, vnd_prop_t prop, void *arg)
+{
+	boolean_t writeable;
+	const char *perm;
+	vndadm_get_t *vgp = arg;
+	const char *name = vndadm_prop_to_name(prop);
+
+	/* Verify if this is a prop we're supposed to print */
+	if (vgp->vg_argc > 0) {
+		int i;
+		boolean_t found = B_FALSE;
+		for (i = 0; i < vgp->vg_argc; i++) {
+			if (strcmp(name, vgp->vg_argv[i]) == 0) {
+				found = B_TRUE;
+				break;
+			}
+		}
+		if (found == B_FALSE)
+			return (0);
+	}
+
+	if (vnd_prop_writeable(prop, &writeable) != 0)
+		abort();
+
+	perm = writeable ? "rw" : "r-";
+
+	if (vgp->vg_parse == B_TRUE) {
+		(void) printf("%s%s%s%s%s%s", vgp->vg_link, vgp->vg_delim,
+		    name, vgp->vg_delim, perm, vgp->vg_delim);
+	} else {
+		(void) printf("%-13s %-16s %-5s ", vgp->vg_link, name, perm);
+	}
+
+	if (vndadm_propname_tbl[prop].vp_print != NULL) {
+		if (vndadm_propname_tbl[prop].vp_print(vhp, prop) != 0)
+			return (1);
+	} else {
+		(void) printf("-");
+	}
+	(void) printf("\n");
+	return (0);
+}
+
+static int
+vndadm_get(int argc, char *argv[])
+{
+	vnd_handle_t *vhp;
+	boolean_t parse = B_FALSE;
+	vndadm_get_t vg;
+	int c, syserr;
+	vnd_errno_t vnderr;
+	const char *zonename = NULL, *delim = NULL;
+
+	if (argc <= 0) {
+		return (usage("get requires a link name\n"));
+	}
+
+	optind = 0;
+	while ((c = getopt(argc, argv, ":pd:z:")) != -1) {
+		switch (c) {
+		case 'p':
+			parse = B_TRUE;
+			break;
+		case 'd':
+			delim = optarg;
+			break;
+		case 'z':
+			zonename = optarg;
+			break;
+		case ':':
+			return (usage("-%c requires an operand\n", optopt));
+		case '?':
+			return (usage("unknown option: -%c\n", optopt));
+		default:
+			abort();
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc < 1) {
+		return (usage("missing required link\n"));
+	}
+
+	vhp = vnd_open(zonename, argv[0], &vnderr, &syserr);
+	if (vhp == NULL) {
+		vnd_libwarn(vnderr, syserr, "failed to open link: %s", argv[0]);
+		return (1);
+	}
+
+	vg.vg_argc = argc - 1;
+	vg.vg_argv = argv + 1;
+	vg.vg_link = argv[0];
+	vg.vg_parse = parse;
+	vg.vg_delim = delim != NULL ? delim : " ";
+	if (vg.vg_parse == B_FALSE)
+		(void) printf("%-13s %-16s %-5s %s\n", "LINK", "PROPERTY",
+		    "PERM", "VALUE");
+
+	if (vnd_prop_iter(vhp, vndadm_get_cb, &vg) != 0)
+		return (1);
+
+	return (0);
+}
+
+static void
+vndadm_get_usage(FILE *out)
+{
+	(void) fprintf(out,
+	    "\tget:\t\t[-p] [-d delim] [-z zonename] link [prop]...\n");
+}
+
+static int
+vndadm_set(int argc, char *argv[])
+{
+	vnd_handle_t *vhp;
+	int c, i, syserr;
+	vnd_errno_t vnderr;
+	const char *zonename = NULL;
+
+	optind = 0;
+	while ((c = getopt(argc, argv, ":z:")) != -1) {
+		switch (c) {
+		case 'z':
+			zonename = optarg;
+			break;
+		case ':':
+			return (usage("-%c requires an operand\n", optopt));
+		case '?':
+			return (usage("unknown option: -%c\n", optopt));
+		default:
+			abort();
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc < 2) {
+		return (usage("missing arguments to set\n"));
+	}
+
+	vhp = vnd_open(zonename, argv[0], &vnderr, &syserr);
+	if (vhp == NULL) {
+		vnd_libwarn(vnderr, syserr, "failed to open link: %s", argv[0]);
+		return (1);
+	}
+
+	for (i = 1; i < argc; i++) {
+		char *eq, *key, *value;
+		boolean_t writeable;
+		vnd_prop_t prop;
+		void *buf;
+		size_t psize;
+		int ret;
+
+		key = argv[i];
+		eq = strchr(key, '=');
+		if (eq == NULL) {
+			vnd_warn("invalid property name=value: %s\n", key);
+			return (1);
+		}
+		*eq = '\0';
+		value = eq + 1;
+		if (*value == '\0') {
+			vnd_warn("property value required for %s\n", key);
+			return (1);
+		}
+		prop = vndadm_name_to_prop(key);
+		if (prop == VND_PROP_MAX) {
+			vnd_warn("unknown property: %s\n", key);
+			return (1);
+		}
+
+		if (vnd_prop_writeable(prop, &writeable) != 0)
+			abort();
+		if (writeable != B_TRUE) {
+			vnd_warn("property %s is read-only\n", key);
+			return (1);
+		}
+		assert(vndadm_propname_tbl[prop].vp_parse != NULL);
+
+		/*
+		 * vp_parse functions should say what explicitly is invalid. We
+		 * should indicate that the property failed.
+		 */
+		ret = vndadm_propname_tbl[prop].vp_parse(value, &buf, &psize);
+		if (ret != 0) {
+			vnd_warn("failed to set property %s\n", key);
+			return (1);
+		}
+
+		ret = vnd_prop_set(vhp, prop, buf, psize);
+		free(buf);
+		if (ret != 0) {
+			vnd_libwarn(vnd_errno(vhp), vnd_syserrno(vhp),
+			    "failed to set property %s", key);
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+static void
+vndadm_set_usage(FILE *out)
+{
+	(void) fprintf(out, "\tset:\t\t[-z zonename] link prop=val...\n");
+}
+
+typedef struct vnd_cmdtab {
+	const char *vc_name;
+	int (*vc_op)(int, char *[]);
+	void (*vc_usage)(FILE *);
+} vnd_cmdtab_t;
+
+static vnd_cmdtab_t vnd_tab[] = {
+	{ "create", vndadm_create, vndadm_create_usage },
+	{ "destroy", vndadm_destroy, vndadm_destroy_usage },
+	{ "list", vndadm_list, vndadm_list_usage },
+	{ "get", vndadm_get, vndadm_get_usage },
+	{ "set", vndadm_set, vndadm_set_usage },
+	{ NULL, NULL }
+};
+
+static int
+usage(const char *format, ...)
+{
+	vnd_cmdtab_t *tab;
+	const char *help = "usage:  %s <subcommand> <args> ...\n";
+
+	if (format != NULL) {
+		va_list alist;
+
+		va_start(alist, format);
+		(void) fprintf(stderr, "%s: ", vnd_pname);
+		(void) vfprintf(stderr, format, alist);
+		va_end(alist);
+	}
+	(void) fprintf(stderr, help, vnd_pname);
+	for (tab = vnd_tab; tab->vc_name != NULL; tab++)
+		tab->vc_usage(stderr);
+
+	return (2);
+}
+
+int
+main(int argc, char *argv[])
+{
+	vnd_cmdtab_t *tab;
+
+	vnd_pname = basename(argv[0]);
+	if (argc < 2) {
+		return (usage(NULL));
+	}
+
+	for (tab = vnd_tab; tab->vc_name != NULL; tab++) {
+		if (strcmp(argv[1], tab->vc_name) == 0) {
+			argc -= 2; argv += 2;
+			assert(argc >= 0);
+			return (tab->vc_op(argc, argv));
+		}
+	}
+
+	return (usage("unknown sub-command '%s'\n", argv[1]));
+}
diff --git a/usr/src/cmd/vndstat/Makefile b/usr/src/cmd/vndstat/Makefile
new file mode 100644
index 0000000000..c77eef3887
--- /dev/null
+++ b/usr/src/cmd/vndstat/Makefile
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+PROG= vndstat
+
+include ../Makefile.cmd
+
+LDLIBS += -lkstat
+
+.KEEP_STATE:
+
+all: $(PROG) 
+
+install: all $(ROOTPROG)
+
+clean:
+	$(RM) $(PROG)
+
+lint:	lint_PROG
+
+include ../Makefile.targ
diff --git a/usr/src/cmd/vndstat/vndstat.c b/usr/src/cmd/vndstat/vndstat.c
new file mode 100644
index 0000000000..6f6c76fc12
--- /dev/null
+++ b/usr/src/cmd/vndstat/vndstat.c
@@ -0,0 +1,542 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
+ */
+
+#include <sys/kstat.h>
+#include <kstat.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <assert.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <strings.h>
+#include <alloca.h>
+#include <signal.h>
+#include <sys/varargs.h>
+#include <sys/int_limits.h>
+#include <sys/sysmacros.h>
+
+#define	KSTAT_FIELD_USEINSTANCE		0x01
+#define	KSTAT_FIELD_NODELTA		0x02
+#define	KSTAT_FIELD_FILLER		0x04
+#define	KSTAT_FIELD_STRING		0x08
+#define	KSTAT_FIELD_UNIT		0x10
+#define	KSTAT_FIELD_LJUST		0x20
+
+typedef struct kstat_field {
+	char *ksf_header;		/* header for field */
+	char *ksf_name;			/* name of stat, if any */
+	int ksf_width;			/* width for field in output line */
+	uint32_t ksf_flags;		/* flags for this field, if any */
+	char *ksf_suffix;		/* optional suffix for units */
+	int ksf_hint;			/* index hint for field in kstat */
+} kstat_field_t;
+
+typedef struct kstat_instance {
+	char ksi_name[KSTAT_STRLEN];	/* name of the underlying kstat */
+	int ksi_instance;		/* instance identifer of this kstat */
+	kstat_t *ksi_ksp;		/* pointer to the kstat */
+	uint64_t *ksi_data[2];		/* pointer to two generations of data */
+	hrtime_t ksi_snaptime[2];	/* hrtime for data generations */
+	int ksi_gen;			/* current generation */
+	struct kstat_instance *ksi_next; /* next in instance list */
+} kstat_instance_t;
+
+const char *g_cmd = "vndstat";
+
+static void
+kstat_nicenum(uint64_t num, char *buf, size_t buflen)
+{
+	uint64_t n = num;
+	int index = 0;
+	char u;
+
+	while (n >= 1024) {
+		n /= 1024;
+		index++;
+	}
+
+	u = " KMGTPE"[index];
+
+	if (index == 0) {
+		(void) snprintf(buf, buflen, "%llu", n);
+	} else if ((num & ((1ULL << 10 * index) - 1)) == 0) {
+		/*
+		 * If this is an even multiple of the base, always display
+		 * without any decimal precision.
+		 */
+		(void) snprintf(buf, buflen, "%llu%c", n, u);
+	} else {
+		/*
+		 * We want to choose a precision that reflects the best choice
+		 * for fitting in 5 characters.  This can get rather tricky when
+		 * we have numbers that are very close to an order of magnitude.
+		 * For example, when displaying 10239 (which is really 9.999K),
+		 * we want only a single place of precision for 10.0K.  We could
+		 * develop some complex heuristics for this, but it's much
+		 * easier just to try each combination in turn.
+		 */
+		int i;
+		for (i = 2; i >= 0; i--) {
+			if (snprintf(buf, buflen, "%.*f%c", i,
+			    (double)num / (1ULL << 10 * index), u) <= 5)
+				break;
+		}
+	}
+}
+
+static void
+fatal(char *fmt, ...)
+{
+	va_list ap;
+	int error = errno;
+
+	va_start(ap, fmt);
+
+	(void) fprintf(stderr, "%s: ", g_cmd);
+	/*LINTED*/
+	(void) vfprintf(stderr, fmt, ap);
+
+	if (fmt[strlen(fmt) - 1] != '\n')
+		(void) fprintf(stderr, ": %s\n", strerror(error));
+
+	exit(EXIT_FAILURE);
+}
+
+int
+kstat_field_hint(kstat_t *ksp, kstat_field_t *field)
+{
+	kstat_named_t *nm = KSTAT_NAMED_PTR(ksp);
+	int i;
+
+	assert(ksp->ks_type == KSTAT_TYPE_NAMED);
+
+	for (i = 0; i < ksp->ks_ndata; i++) {
+		if (strcmp(field->ksf_name, nm[i].name) == 0)
+			return (field->ksf_hint = i);
+	}
+
+	fatal("could not find field '%s' in %s:%d\n",
+	    field->ksf_name, ksp->ks_name, ksp->ks_instance);
+
+	return (0);
+}
+
+int
+kstat_instances_compare(const void *lhs, const void *rhs)
+{
+	kstat_instance_t *l = *((kstat_instance_t **)lhs);
+	kstat_instance_t *r = *((kstat_instance_t **)rhs);
+	int rval;
+
+	if ((rval = strcmp(l->ksi_name, r->ksi_name)) != 0)
+		return (rval);
+
+	if (l->ksi_instance < r->ksi_instance)
+		return (-1);
+
+	if (l->ksi_instance > r->ksi_instance)
+		return (1);
+
+	return (0);
+}
+
+void
+kstat_instances_update(kstat_ctl_t *kcp, kstat_instance_t **head,
+    boolean_t (*interested)(kstat_t *))
+{
+	int ninstances = 0, i;
+	kstat_instance_t **sorted, *ksi, *next;
+	kstat_t *ksp;
+	kid_t kid;
+
+	if ((kid = kstat_chain_update(kcp)) == 0 && *head != NULL)
+		return;
+
+	if (kid == -1)
+		fatal("failed to update kstat chain");
+
+	for (ksi = *head; ksi != NULL; ksi = ksi->ksi_next)
+		ksi->ksi_ksp = NULL;
+
+	for (ksp = kcp->kc_chain; ksp != NULL; ksp = ksp->ks_next) {
+		kstat_instance_t *last = NULL;
+
+		if (!interested(ksp))
+			continue;
+
+		/*
+		 * Now look to see if we have this instance and name.  (Yes,
+		 * this is a linear search; we're assuming that this list is
+		 * modest in size.)
+		 */
+		for (ksi = *head; ksi != NULL; ksi = ksi->ksi_next) {
+			last = ksi;
+
+			if (ksi->ksi_instance != ksp->ks_instance)
+				continue;
+
+			if (strcmp(ksi->ksi_name, ksp->ks_name) != 0)
+				continue;
+
+			ksi->ksi_ksp = ksp;
+			ninstances++;
+			break;
+		}
+
+		if (ksi != NULL)
+			continue;
+
+		if ((ksi = malloc(sizeof (kstat_instance_t))) == NULL)
+			fatal("could not allocate memory for stat instance");
+
+		bzero(ksi, sizeof (kstat_instance_t));
+		(void) strlcpy(ksi->ksi_name, ksp->ks_name, KSTAT_STRLEN);
+		ksi->ksi_instance = ksp->ks_instance;
+		ksi->ksi_ksp = ksp;
+		ksi->ksi_next = NULL;
+
+		if (last == NULL) {
+			assert(*head == NULL);
+			*head = ksi;
+		} else {
+			last->ksi_next = ksi;
+		}
+
+		ninstances++;
+	}
+
+	/*
+	 * Now we know how many instances we have; iterate back over them,
+	 * pruning the stale ones and adding the active ones to a holding
+	 * array in which to sort them.
+	 */
+	sorted = (void *)alloca(ninstances * sizeof (kstat_instance_t *));
+	ninstances = 0;
+
+	for (ksi = *head; ksi != NULL; ksi = next) {
+		next = ksi->ksi_next;
+
+		if (ksi->ksi_ksp == NULL) {
+			free(ksi);
+		} else {
+			sorted[ninstances++] = ksi;
+		}
+	}
+
+	if (ninstances == 0) {
+		*head = NULL;
+		return;
+	}
+
+	qsort(sorted, ninstances, sizeof (kstat_instance_t *),
+	    kstat_instances_compare);
+
+	*head = sorted[0];
+
+	for (i = 0; i < ninstances; i++) {
+		ksi = sorted[i];
+		ksi->ksi_next = i < ninstances - 1 ? sorted[i + 1] : NULL;
+	}
+}
+
+void
+kstat_instances_read(kstat_ctl_t *kcp, kstat_instance_t *instances,
+    kstat_field_t *fields)
+{
+	kstat_instance_t *ksi;
+	int i, nfields;
+
+	for (nfields = 0; fields[nfields].ksf_header != NULL; nfields++)
+		continue;
+
+	for (ksi = instances; ksi != NULL; ksi = ksi->ksi_next) {
+		kstat_t *ksp = ksi->ksi_ksp;
+
+		if (ksp == NULL)
+			continue;
+
+		if (kstat_read(kcp, ksp, NULL) == -1) {
+			if (errno == ENXIO) {
+				/*
+				 * Our kstat has been removed since the update;
+				 * NULL it out to prevent us from trying to read
+				 * it again (and to indicate that it should not
+				 * be displayed) and drive on.
+				 */
+				ksi->ksi_ksp = NULL;
+				continue;
+			}
+
+			fatal("failed to read kstat %s:%d",
+			    ksi->ksi_name, ksi->ksi_instance);
+		}
+
+		if (ksp->ks_type != KSTAT_TYPE_NAMED) {
+			fatal("%s:%d is not a named kstat", ksi->ksi_name,
+			    ksi->ksi_instance);
+		}
+
+		if (ksi->ksi_data[0] == NULL) {
+			size_t size = nfields * sizeof (uint64_t) * 2;
+			uint64_t *data;
+
+			if ((data = malloc(size)) == NULL)
+				fatal("could not allocate memory");
+
+			bzero(data, size);
+			ksi->ksi_data[0] = data;
+			ksi->ksi_data[1] = &data[nfields];
+		}
+
+		for (i = 0; i < nfields; i++) {
+			kstat_named_t *nm = KSTAT_NAMED_PTR(ksp);
+			kstat_field_t *field = &fields[i];
+			int hint = field->ksf_hint;
+
+			if (field->ksf_name == NULL)
+				continue;
+
+			if (hint < 0 || hint >= ksp->ks_ndata ||
+			    strcmp(field->ksf_name, nm[hint].name) != 0) {
+				hint = kstat_field_hint(ksp, field);
+			}
+
+			if (field->ksf_flags & KSTAT_FIELD_STRING)
+				ksi->ksi_data[ksi->ksi_gen][i] =
+				    (uint64_t)(uintptr_t)
+				    nm[hint].value.str.addr.ptr;
+			else
+				ksi->ksi_data[ksi->ksi_gen][i] =
+				    nm[hint].value.ui64;
+		}
+
+		ksi->ksi_snaptime[ksi->ksi_gen] = ksp->ks_snaptime;
+		ksi->ksi_gen ^= 1;
+	}
+}
+
+uint64_t
+kstat_instances_delta(kstat_instance_t *ksi, int i)
+{
+	int gen = ksi->ksi_gen;
+	uint64_t delta = ksi->ksi_data[gen ^ 1][i] - ksi->ksi_data[gen][i];
+	uint64_t tdelta = ksi->ksi_snaptime[gen ^ 1] - ksi->ksi_snaptime[gen];
+
+	return (((delta * (uint64_t)NANOSEC) + (tdelta / 2)) / tdelta);
+}
+
+void
+kstat_instances_print(kstat_instance_t *instances, kstat_field_t *fields,
+    boolean_t header)
+{
+	kstat_instance_t *ksi = instances;
+	int i, nfields;
+
+	for (nfields = 0; fields[nfields].ksf_header != NULL; nfields++)
+		continue;
+
+	if (header) {
+		for (i = 0; i < nfields; i++) {
+			if (fields[i].ksf_flags & KSTAT_FIELD_LJUST) {
+				(void) printf("%s%c", fields[i].ksf_header,
+				    i < nfields - 1 ? ' ' : '\n');
+				continue;
+			}
+			(void) printf("%*s%c", fields[i].ksf_width,
+			    fields[i].ksf_header, i < nfields - 1 ? ' ' : '\n');
+		}
+	}
+
+	for (ksi = instances; ksi != NULL; ksi = ksi->ksi_next) {
+		if (ksi->ksi_snaptime[1] == 0 || ksi->ksi_ksp == NULL)
+			continue;
+
+		for (i = 0; i < nfields; i++) {
+			char trailer = i < nfields - 1 ? ' ' : '\n';
+
+			if (fields[i].ksf_flags & KSTAT_FIELD_FILLER) {
+				(void) printf("%*s%c", fields[i].ksf_width,
+				    fields[i].ksf_header, trailer);
+				continue;
+			}
+
+			if (fields[i].ksf_flags & KSTAT_FIELD_STRING) {
+				(void) printf("%*s%c", fields[i].ksf_width,
+				    (char *)(uintptr_t)ksi->ksi_data[
+				    ksi->ksi_gen ^ 1][i],
+				    trailer);
+				continue;
+			}
+
+			if (fields[i].ksf_flags & KSTAT_FIELD_UNIT) {
+				char buf[128];
+				size_t flen = fields[i].ksf_width + 1;
+				const char *suffix = "";
+
+				if (fields[i].ksf_suffix != NULL) {
+					suffix = fields[i].ksf_suffix;
+					flen -= strlen(fields[i].ksf_suffix);
+				}
+
+				kstat_nicenum(fields[i].ksf_flags &
+				    KSTAT_FIELD_NODELTA ?
+				    ksi->ksi_data[ksi->ksi_gen ^ 1][i] :
+				    kstat_instances_delta(ksi, i), buf,
+				    MIN(sizeof (buf), flen));
+				(void) printf("%*s%s%c", flen - 1, buf,
+				    suffix, trailer);
+				continue;
+			}
+
+			(void) printf("%*lld%c", fields[i].ksf_width,
+			    fields[i].ksf_flags & KSTAT_FIELD_USEINSTANCE ?
+			    ksi->ksi_instance :
+			    fields[i].ksf_flags & KSTAT_FIELD_NODELTA ?
+			    ksi->ksi_data[ksi->ksi_gen ^ 1][i] :
+			    kstat_instances_delta(ksi, i), trailer);
+		}
+	}
+}
+
+static boolean_t
+interested(kstat_t *ksp)
+{
+	const char *module = "vnd";
+	const char *class = "net";
+
+	if (strcmp(ksp->ks_module, module) != 0)
+		return (B_FALSE);
+
+	if (strcmp(ksp->ks_class, class) != 0)
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
+
+/* BEGIN CSTYLED */
+char *g_usage = "Usage: vndstat [interval [count]]\n"
+    "\n"
+    "  Displays statistics for active vnd devices, with one line per device.\n"
+    "  All statistics are reported as per-second rates.\n"
+    "\n"
+    "  The columns are as follows:\n"
+    "\n"
+    "    zone   =>  name of the zone with the device\n"
+    "    name   =>  name of the vnd device\n"
+    "    rx     =>  bytes received\n"
+    "    tx     =>  bytes transmitted\n"
+    "    drops  =>  number of dropped packets\n"
+    "    txfc   =>  number of transmit flow control events\n"
+    "\n";
+/* END CSTYLED */
+
+void
+usage()
+{
+	(void) fprintf(stderr, "%s", g_usage);
+	exit(EXIT_FAILURE);
+}
+
+/*ARGSUSED*/
+void
+intr(int sig)
+{}
+
+/*ARGSUSED*/
+int
+main(int argc, char **argv)
+{
+	kstat_ctl_t *kcp;
+	kstat_instance_t *instances = NULL;
+	int i = 0;
+	int interval = 1;
+	int count = INT32_MAX;
+	struct itimerval itimer;
+	struct sigaction act;
+	sigset_t set;
+	char *endp;
+
+	kstat_field_t fields[] =  {
+		{ "name", "linkname", 6, KSTAT_FIELD_STRING },
+		{ "|", NULL, 1, KSTAT_FIELD_FILLER },
+		{ "rx B/s", "rbytes", 8, KSTAT_FIELD_UNIT, "B/s" },
+		{ "|", NULL, 1, KSTAT_FIELD_FILLER },
+		{ "tx B/s", "obytes", 8, KSTAT_FIELD_UNIT, "B/s" },
+		{ "|", NULL, 1, KSTAT_FIELD_FILLER },
+		{ "drops", "total_drops", 5 },
+		{ "txfc", "flowcontrol_events", 4 },
+		{ "|", NULL, 1, KSTAT_FIELD_FILLER },
+		{ "zone", "zonename", 36,
+			KSTAT_FIELD_STRING | KSTAT_FIELD_LJUST },
+		{ NULL }
+	};
+
+	if (argc > 1) {
+		interval = strtol(argv[1], &endp, 10);
+
+		if (*endp != '\0' || interval <= 0)
+			usage();
+	}
+
+	if (argc > 2) {
+		count = strtol(argv[2], &endp, 10);
+
+		if (*endp != '\0' || count <= 0)
+			usage();
+	}
+
+	if ((kcp = kstat_open()) == NULL)
+		fatal("could not open /dev/kstat");
+
+	(void) sigemptyset(&act.sa_mask);
+	act.sa_flags = 0;
+	act.sa_handler = intr;
+	(void) sigaction(SIGALRM, &act, NULL);
+
+	(void) sigemptyset(&set);
+	(void) sigaddset(&set, SIGALRM);
+	(void) sigprocmask(SIG_BLOCK, &set, NULL);
+
+	bzero(&itimer, sizeof (itimer));
+	itimer.it_value.tv_sec = interval;
+	itimer.it_interval.tv_sec = interval;
+
+	if (setitimer(ITIMER_REAL, &itimer, NULL) != 0) {
+		fatal("could not set timer to %d second%s", interval,
+		    interval == 1 ? "" : "s");
+	}
+
+	(void) sigemptyset(&set);
+
+	for (;;) {
+		kstat_instances_update(kcp, &instances, interested);
+		kstat_instances_read(kcp, instances, fields);
+
+		if (i++ > 0) {
+			kstat_instances_print(instances, fields,
+			    instances != NULL && instances->ksi_next == NULL ?
+			    (((i - 2) % 20) == 0) : B_TRUE);
+		}
+
+		if (i > count)
+			break;
+
+		(void) sigsuspend(&set);
+	}
+
+	/*NOTREACHED*/
+	return (0);
+}
diff --git a/usr/src/cmd/zdb/zdb.c b/usr/src/cmd/zdb/zdb.c
index 7ccd124dbe..2470545a52 100644
--- a/usr/src/cmd/zdb/zdb.c
+++ b/usr/src/cmd/zdb/zdb.c
@@ -108,7 +108,6 @@ uint64_t *zopt_object = NULL;
 static unsigned zopt_objects = 0;
 libzfs_handle_t *g_zfs;
 uint64_t max_inflight = 1000;
-static int leaked_objects = 0;
 
 static void snprintf_blkptr_compact(char *, size_t, const blkptr_t *);
 
@@ -1966,12 +1965,9 @@ dump_znode(objset_t *os, uint64_t object, void *data, size_t size)
 
 	if (dump_opt['d'] > 4) {
 		error = zfs_obj_to_path(os, object, path, sizeof (path));
-		if (error == ESTALE) {
-			(void) snprintf(path, sizeof (path), "on delete queue");
-		} else if (error != 0) {
-			leaked_objects++;
+		if (error != 0) {
 			(void) snprintf(path, sizeof (path),
-			    "path not found, possibly leaked");
+			    "\?\?\?<object#%llu>", (u_longlong_t)object);
 		}
 		(void) printf("\tpath	%s\n", path);
 	}
@@ -2301,11 +2297,6 @@ dump_dir(objset_t *os)
 		(void) fprintf(stderr, "dmu_object_next() = %d\n", error);
 		abort();
 	}
-	if (leaked_objects != 0) {
-		(void) printf("%d potentially leaked objects detected\n",
-		    leaked_objects);
-		leaked_objects = 0;
-	}
 }
 
 static void
@@ -5382,5 +5373,5 @@ main(int argc, char **argv)
 	libzfs_fini(g_zfs);
 	kernel_fini();
 
-	return (error);
+	return (0);
 }
diff --git a/usr/src/cmd/zfs/zfs_main.c b/usr/src/cmd/zfs/zfs_main.c
index 6abdaa892b..d9f253fbf8 100644
--- a/usr/src/cmd/zfs/zfs_main.c
+++ b/usr/src/cmd/zfs/zfs_main.c
@@ -238,7 +238,7 @@ get_usage(zfs_help_t idx)
 		    "<filesystem|volume>@<snap>[%<snap>][,...]\n"
 		    "\tdestroy <filesystem|volume>#<bookmark>\n"));
 	case HELP_GET:
-		return (gettext("\tget [-rHp] [-d max] "
+		return (gettext("\tget [-crHp] [-d max] "
 		    "[-o \"all\" | field[,...]]\n"
 		    "\t    [-t type[,...]] [-s source[,...]]\n"
 		    "\t    <\"all\" | property[,...]> "
@@ -624,7 +624,7 @@ should_auto_mount(zfs_handle_t *zhp)
 }
 
 /*
- * zfs clone [-p] [-o prop=value] ... <snap> <fs | vol>
+ * zfs clone [-Fp] [-o prop=value] ... <snap> <fs | vol>
  *
  * Given an existing dataset, create a writable copy whose initial contents
  * are the same as the source.  The newly created dataset maintains a
@@ -632,12 +632,18 @@ should_auto_mount(zfs_handle_t *zhp)
  * the clone exists.
  *
  * The '-p' flag creates all the non-existing ancestors of the target first.
+ *
+ * The '-F' flag retries the zfs_mount() operation as long as zfs_mount() is
+ * still returning EBUSY.  Any callers which specify -F should be careful to
+ * ensure that no other process has a persistent hold on the mountpoint's
+ * directory.
  */
 static int
 zfs_do_clone(int argc, char **argv)
 {
 	zfs_handle_t *zhp = NULL;
 	boolean_t parents = B_FALSE;
+	boolean_t keeptrying = B_FALSE;
 	nvlist_t *props;
 	int ret = 0;
 	int c;
@@ -646,8 +652,11 @@ zfs_do_clone(int argc, char **argv)
 		nomem();
 
 	/* check options */
-	while ((c = getopt(argc, argv, "o:p")) != -1) {
+	while ((c = getopt(argc, argv, "Fo:p")) != -1) {
 		switch (c) {
+		case 'F':
+			keeptrying = B_TRUE;
+			break;
 		case 'o':
 			if (parseprop(props, optarg) != 0)
 				return (1);
@@ -714,11 +723,16 @@ zfs_do_clone(int argc, char **argv)
 			 * step.
 			 */
 			if (should_auto_mount(clone)) {
-				if ((ret = zfs_mount(clone, NULL, 0)) != 0) {
-					(void) fprintf(stderr, gettext("clone "
-					    "successfully created, "
-					    "but not mounted\n"));
-				} else if ((ret = zfs_share(clone)) != 0) {
+				while ((ret = zfs_mount(clone, NULL, 0)) != 0) {
+					if (!keeptrying || errno != EBUSY) {
+						(void) fprintf(stderr,
+						    gettext("clone "
+						    "successfully created, "
+						    "but not mounted\n"));
+						break;
+					}
+				}
+				if (ret == 0 && (ret = zfs_share(clone)) != 0) {
 					(void) fprintf(stderr, gettext("clone "
 					    "successfully created, "
 					    "but not shared\n"));
@@ -944,12 +958,13 @@ badusage:
 }
 
 /*
- * zfs destroy [-rRf] <fs, vol>
+ * zfs destroy [-rRfF] <fs, vol>
  * zfs destroy [-rRd] <snap>
  *
  *	-r	Recursively destroy all children
  *	-R	Recursively destroy all dependents, including clones
  *	-f	Force unmounting of any dependents
+ *	-F	Continue retrying on seeing EBUSY
  *	-d	If we can't destroy now, mark for deferred destruction
  *
  * Destroys the given dataset.  By default, it will unmount any filesystems,
@@ -959,6 +974,7 @@ badusage:
 typedef struct destroy_cbdata {
 	boolean_t	cb_first;
 	boolean_t	cb_force;
+	boolean_t cb_wait;
 	boolean_t	cb_recurse;
 	boolean_t	cb_error;
 	boolean_t	cb_doclones;
@@ -1042,13 +1058,18 @@ out:
 static int
 destroy_callback(zfs_handle_t *zhp, void *data)
 {
-	destroy_cbdata_t *cb = data;
+	destroy_cbdata_t *cbp = data;
+	struct timespec ts;
+	int err = 0;
+
+	ts.tv_sec = 0;
+	ts.tv_nsec = 500 * (NANOSEC / MILLISEC);
 	const char *name = zfs_get_name(zhp);
 
-	if (cb->cb_verbose) {
-		if (cb->cb_parsable) {
+	if (cbp->cb_verbose) {
+		if (cbp->cb_parsable) {
 			(void) printf("destroy\t%s\n", name);
-		} else if (cb->cb_dryrun) {
+		} else if (cbp->cb_dryrun) {
 			(void) printf(gettext("would destroy %s\n"),
 			    name);
 		} else {
@@ -1063,13 +1084,10 @@ destroy_callback(zfs_handle_t *zhp, void *data)
 	 */
 	if (strchr(zfs_get_name(zhp), '/') == NULL &&
 	    zfs_get_type(zhp) == ZFS_TYPE_FILESYSTEM) {
-		zfs_close(zhp);
-		return (0);
-	}
-	if (cb->cb_dryrun) {
-		zfs_close(zhp);
-		return (0);
+		goto out;
 	}
+	if (cbp->cb_dryrun)
+		goto out;
 
 	/*
 	 * We batch up all contiguous snapshots (even of different
@@ -1078,23 +1096,66 @@ destroy_callback(zfs_handle_t *zhp, void *data)
 	 * because we must delete a clone before its origin.
 	 */
 	if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT) {
-		fnvlist_add_boolean(cb->cb_batchedsnaps, name);
-	} else {
-		int error = zfs_destroy_snaps_nvl(g_zfs,
-		    cb->cb_batchedsnaps, B_FALSE);
-		fnvlist_free(cb->cb_batchedsnaps);
-		cb->cb_batchedsnaps = fnvlist_alloc();
-
-		if (error != 0 ||
-		    zfs_unmount(zhp, NULL, cb->cb_force ? MS_FORCE : 0) != 0 ||
-		    zfs_destroy(zhp, cb->cb_defer_destroy) != 0) {
-			zfs_close(zhp);
-			return (-1);
+		fnvlist_add_boolean(cbp->cb_batchedsnaps, name);
+		goto out;
+	}
+
+	if (cbp->cb_wait)
+		libzfs_print_on_error(g_zfs, B_FALSE);
+
+	/*
+	 * Unless instructed to retry on EBUSY, bail out on the first error.
+	 * When retrying, try every 500ms until either succeeding or seeing a
+	 * non-EBUSY error code.
+	 */
+	while ((err = zfs_destroy_snaps_nvl(g_zfs,
+	    cbp->cb_batchedsnaps, B_FALSE)) != 0) {
+		if (cbp->cb_wait && libzfs_errno(g_zfs) == EZFS_BUSY) {
+			nanosleep(&ts, NULL);
+			continue;
 		}
+		(void) fprintf(stderr, "%s: %s\n",
+		    libzfs_error_action(g_zfs),
+		    libzfs_error_description(g_zfs));
+		break;
+	}
+
+	fnvlist_free(cbp->cb_batchedsnaps);
+	cbp->cb_batchedsnaps = fnvlist_alloc();
+
+	if (err != 0)
+		goto out;
+
+	while ((err = zfs_unmount(zhp, NULL,
+	    cbp->cb_force ? MS_FORCE : 0)) != 0) {
+		if (cbp->cb_wait && libzfs_errno(g_zfs) == EZFS_BUSY) {
+			(void) nanosleep(&ts, NULL);
+			continue;
+		}
+		(void) fprintf(stderr, "%s: %s\n",
+		    libzfs_error_action(g_zfs),
+		    libzfs_error_description(g_zfs));
+		break;
+	}
+
+	if (err != 0)
+		goto out;
+
+	while ((err = zfs_destroy(zhp, cbp->cb_defer_destroy)) != 0) {
+		if (cbp->cb_wait && libzfs_errno(g_zfs) == EZFS_BUSY) {
+			(void) nanosleep(&ts, NULL);
+			continue;
+		}
+		(void) fprintf(stderr, "%s: %s\n",
+		    libzfs_error_action(g_zfs),
+		    libzfs_error_description(g_zfs));
+		break;
 	}
 
+out:
+	libzfs_print_on_error(g_zfs, B_TRUE);
 	zfs_close(zhp);
-	return (0);
+	return (err);
 }
 
 static int
@@ -1250,7 +1311,7 @@ zfs_do_destroy(int argc, char **argv)
 	zfs_type_t type = ZFS_TYPE_DATASET;
 
 	/* check options */
-	while ((c = getopt(argc, argv, "vpndfrR")) != -1) {
+	while ((c = getopt(argc, argv, "vpndfFrR")) != -1) {
 		switch (c) {
 		case 'v':
 			cb.cb_verbose = B_TRUE;
@@ -1269,6 +1330,9 @@ zfs_do_destroy(int argc, char **argv)
 		case 'f':
 			cb.cb_force = B_TRUE;
 			break;
+		case 'F':
+			cb.cb_wait = B_TRUE;
+			break;
 		case 'r':
 			cb.cb_recurse = B_TRUE;
 			break;
@@ -1639,8 +1703,11 @@ zfs_do_get(int argc, char **argv)
 	cb.cb_type = ZFS_TYPE_DATASET;
 
 	/* check options */
-	while ((c = getopt(argc, argv, ":d:o:s:rt:Hp")) != -1) {
+	while ((c = getopt(argc, argv, ":d:o:s:rt:Hcp")) != -1) {
 		switch (c) {
+		case 'c':
+			libzfs_set_cachedprops(g_zfs, B_TRUE);
+			break;
 		case 'p':
 			cb.cb_literal = B_TRUE;
 			break;
@@ -3078,6 +3145,7 @@ zfs_do_list(int argc, char **argv)
 	int types = ZFS_TYPE_DATASET;
 	boolean_t types_specified = B_FALSE;
 	char *fields = NULL;
+	zprop_list_t *pl;
 	list_cbdata_t cb = { 0 };
 	char *value;
 	int limit = 0;
@@ -3196,6 +3264,18 @@ zfs_do_list(int argc, char **argv)
 	    != 0)
 		usage(B_FALSE);
 
+	/*
+	 * The default set of properties contains only properties which can be
+	 * retrieved from the set of cached properties.  If any user-specfied
+	 * properties cannot be retrieved from that set, unset the cachedprops
+	 * flags on the ZFS handle.
+	 */
+	libzfs_set_cachedprops(g_zfs, B_TRUE);
+	for (pl = cb.cb_proplist; pl != NULL; pl = pl->pl_next) {
+		if (zfs_prop_cacheable(pl->pl_prop))
+			libzfs_set_cachedprops(g_zfs, B_FALSE);
+	}
+
 	cb.cb_first = B_TRUE;
 
 	ret = zfs_for_each(argc, argv, flags, types, sortcol, &cb.cb_proplist,
diff --git a/usr/src/cmd/zlogin/zlogin.c b/usr/src/cmd/zlogin/zlogin.c
index 296c32be01..1934ba2595 100644
--- a/usr/src/cmd/zlogin/zlogin.c
+++ b/usr/src/cmd/zlogin/zlogin.c
@@ -22,11 +22,12 @@
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2013 DEY Storage Systems, Inc.
  * Copyright (c) 2014 Gary Mills
+ * Copyright 2016 Joyent, Inc.
  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
  */
 
 /*
- * zlogin provides three types of login which allow users in the global
+ * zlogin provides five types of login which allow users in the global
  * zone to access non-global zones.
  *
  * - "interactive login" is similar to rlogin(1); for example, the user could
@@ -42,12 +43,22 @@
  *   In this mode, zlogin sets up pipes as the communication channel, and
  *   'su' is used to do the login setup work.
  *
+ * - "interactive command" is a combination of the above two modes where
+ *   a command is provide like the non-interactive case, but the -i option is
+ *   also provided to make things interactive. For example, the user could
+ *   issue 'zlogin -i my-zone /bin/sh'. In this mode neither 'login -c' nor
+ *   'su root -c' is prepended to the command invocation. Because of this
+ *   there will be no wtmpx login record within the zone.
+ *
  * - "console login" is the equivalent to accessing the tip line for a
  *   zone.  For example, the user can issue 'zlogin -C my-zone'.
  *   In this mode, zlogin contacts the zoneadmd process via unix domain
  *   socket.  If zoneadmd is not running, it starts it.  This allows the
  *   console to be available anytime the zone is installed, regardless of
  *   whether it is running.
+ *
+ * - "standalone-processs interactive" is specified with -I and connects to
+ *   the zone's stdin, stdout and stderr zfd(7D) devices.
  */
 
 #include <sys/socket.h>
@@ -92,7 +103,8 @@
 #include <auth_attr.h>
 #include <secdb.h>
 
-static int masterfd;
+static int masterfd = -1;
+static int ctlfd = -1;
 static struct termios save_termios;
 static struct termios effective_termios;
 static int save_fd;
@@ -101,12 +113,13 @@ static volatile int dead;
 static volatile pid_t child_pid = -1;
 static int interactive = 0;
 static priv_set_t *dropprivs;
+static unsigned int connect_flags = 0;
 
 static int nocmdchar = 0;
 static int failsafe = 0;
-static int disconnect = 0;
 static char cmdchar = '~';
 static int quiet = 0;
+static char zonebrand[MAXNAMELEN];
 
 static int pollerr = 0;
 
@@ -123,10 +136,14 @@ static boolean_t forced_login = B_FALSE;
 #define	TEXT_DOMAIN	"SYS_TEST"	/* Use this only if it wasn't */
 #endif
 
-#define	SUPATH	"/usr/bin/su"
+#define	SUPATH1	"/usr/bin/su"
+#define	SUPATH2	"/bin/su"
 #define	FAILSAFESHELL	"/sbin/sh"
 #define	DEFAULTSHELL	"/sbin/sh"
 #define	DEF_PATH	"/usr/sbin:/usr/bin"
+#define	LX_DEF_PATH	"/bin:/usr/sbin:/usr/bin"
+
+#define	MAX_RETRY	30
 
 #define	CLUSTER_BRAND_NAME	"cluster"
 
@@ -153,7 +170,7 @@ static boolean_t forced_login = B_FALSE;
 static void
 usage(void)
 {
-	(void) fprintf(stderr, gettext("usage: %s [ -dnQCES ] [ -e cmdchar ] "
+	(void) fprintf(stderr, gettext("usage: %s [-dinCEINQS] [-e cmdchar] "
 	    "[-l user] zonename [command [args ...] ]\n"), pname);
 	exit(2);
 }
@@ -248,57 +265,60 @@ postfork_dropprivs()
 	}
 }
 
-/*
- * Create the unix domain socket and call the zoneadmd server; handshake
- * with it to determine whether it will allow us to connect.
- */
 static int
-get_console_master(const char *zname)
+connect_zone_sock(const char *zname, const char *suffix, boolean_t verbose)
 {
 	int sockfd = -1;
 	struct sockaddr_un servaddr;
-	char clientid[MAXPATHLEN];
-	char handshake[MAXPATHLEN], c;
-	int msglen;
-	int i = 0, err = 0;
 
 	if ((sockfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
-		zperror(gettext("could not create socket"));
+		if (verbose)
+			zperror(gettext("could not create socket"));
 		return (-1);
 	}
 
 	bzero(&servaddr, sizeof (servaddr));
 	servaddr.sun_family = AF_UNIX;
 	(void) snprintf(servaddr.sun_path, sizeof (servaddr.sun_path),
-	    "%s/%s.console_sock", ZONES_TMPDIR, zname);
-
+	    "%s/%s.%s", ZONES_TMPDIR, zname, suffix);
 	if (connect(sockfd, (struct sockaddr *)&servaddr,
 	    sizeof (servaddr)) == -1) {
-		zperror(gettext("Could not connect to zone console"));
-		goto bad;
+		if (verbose)
+			zperror(gettext("Could not connect to zone"));
+		close(sockfd);
+		return (-1);
 	}
-	masterfd = sockfd;
+	return (sockfd);
+}
 
-	msglen = snprintf(clientid, sizeof (clientid), "IDENT %lu %s %d\n",
-	    getpid(), setlocale(LC_MESSAGES, NULL), disconnect);
+
+static int
+handshake_zone_sock(int sockfd, unsigned int flags)
+{
+	char clientid[MAXPATHLEN];
+	char handshake[MAXPATHLEN], c;
+	int msglen;
+	int i = 0, err = 0;
+
+	msglen = snprintf(clientid, sizeof (clientid), "IDENT %s %u\n",
+	    setlocale(LC_MESSAGES, NULL), flags);
 
 	if (msglen >= sizeof (clientid) || msglen < 0) {
 		zerror("protocol error");
-		goto bad;
+		return (-1);
 	}
 
-	if (write(masterfd, clientid, msglen) != msglen) {
+	if (write(sockfd, clientid, msglen) != msglen) {
 		zerror("protocol error");
-		goto bad;
+		return (-1);
 	}
 
-	bzero(handshake, sizeof (handshake));
-
 	/*
 	 * Take care not to accumulate more than our fill, and leave room for
 	 * the NUL at the end.
 	 */
-	while ((err = read(masterfd, &c, 1)) == 1) {
+	bzero(handshake, sizeof (handshake));
+	while ((err = read(sockfd, &c, 1)) == 1) {
 		if (i >= (sizeof (handshake) - 1))
 			break;
 		if (c == '\n')
@@ -308,26 +328,48 @@ get_console_master(const char *zname)
 	}
 
 	/*
-	 * If something went wrong during the handshake we bail; perhaps
-	 * the server died off.
+	 * If something went wrong during the handshake we bail.
+	 * Perhaps the server died off.
 	 */
 	if (err == -1) {
-		zperror(gettext("Could not connect to zone console"));
-		goto bad;
+		zperror(gettext("Could not connect to zone"));
+		return (-1);
 	}
 
-	if (strncmp(handshake, "OK", sizeof (handshake)) == 0)
-		return (0);
+	if (strncmp(handshake, "OK", sizeof (handshake)) != 0) {
+		zerror(gettext("Zone is already in use by process ID %s."),
+		    handshake);
+		return (-1);
+	}
 
-	zerror(gettext("Console is already in use by process ID %s."),
-	    handshake);
-bad:
-	(void) close(sockfd);
-	masterfd = -1;
-	return (-1);
+	return (0);
 }
 
-
+static int
+send_ctl_sock(const char *buf, size_t len)
+{
+	char rbuf[BUFSIZ];
+	int i;
+	if (ctlfd == -1) {
+		return (-1);
+	}
+	if (write(ctlfd, buf, len) != len) {
+		return (-1);
+	}
+	/* read the response */
+	for (i = 0; i < (BUFSIZ - 1); i++) {
+		char c;
+		if (read(ctlfd, &c, 1) != 1 || c == '\n' || c == '\0') {
+			break;
+		}
+		rbuf[i] = c;
+	}
+	rbuf[i+1] = '\0';
+	if (strncmp("OK", rbuf, BUFSIZ) != 0) {
+		return (-1);
+	}
+	return (0);
+}
 /*
  * Routines to handle pty creation upon zone entry and to shuttle I/O back
  * and forth between the two terminals.  We also compute and store the
@@ -516,8 +558,32 @@ sigwinch(int s)
 {
 	struct winsize ws;
 
-	if (ioctl(0, TIOCGWINSZ, &ws) == 0)
-		(void) ioctl(masterfd, TIOCSWINSZ, &ws);
+	if (ioctl(0, TIOCGWINSZ, &ws) == 0) {
+		if (ctlfd != -1) {
+			char buf[BUFSIZ];
+			snprintf(buf, sizeof (buf), "TIOCSWINSZ %hu %hu\n",
+			    ws.ws_row, ws.ws_col);
+			(void) send_ctl_sock(buf, strlen(buf));
+		} else {
+			(void) ioctl(masterfd, TIOCSWINSZ, &ws);
+		}
+	}
+}
+
+/*
+ * Toggle zfd EOF mode and notify zoneadmd
+ */
+/*ARGSUSED*/
+static void
+sigusr1(int s)
+{
+	connect_flags ^= ZLOGIN_ZFD_EOF;
+	if (ctlfd != -1) {
+		char buf[BUFSIZ];
+		snprintf(buf, sizeof (buf), "SETFLAGS %u\n",
+		    connect_flags);
+		(void) send_ctl_sock(buf, strlen(buf));
+	}
 }
 
 static volatile int close_on_sig = -1;
@@ -862,28 +928,28 @@ doio(int stdin_fd, int appin_fd, int stdout_fd, int stderr_fd, int sig_fd,
 			break;
 		}
 
-		/* event from master side stdout */
-		if (pollfds[0].revents) {
-			if (pollfds[0].revents &
+		/* event from master side stderr */
+		if (pollfds[1].revents) {
+			if (pollfds[1].revents &
 			    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
-				if (process_output(stdout_fd, STDOUT_FILENO)
+				if (process_output(stderr_fd, STDERR_FILENO)
 				    != 0)
 					break;
 			} else {
-				pollerr = pollfds[0].revents;
+				pollerr = pollfds[1].revents;
 				break;
 			}
 		}
 
-		/* event from master side stderr */
-		if (pollfds[1].revents) {
-			if (pollfds[1].revents &
+		/* event from master side stdout */
+		if (pollfds[0].revents) {
+			if (pollfds[0].revents &
 			    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
-				if (process_output(stderr_fd, STDERR_FILENO)
+				if (process_output(stdout_fd, STDOUT_FILENO)
 				    != 0)
 					break;
 			} else {
-				pollerr = pollfds[1].revents;
+				pollerr = pollfds[0].revents;
 				break;
 			}
 		}
@@ -1053,7 +1119,7 @@ zone_login_cmd(brand_handle_t bh, const char *login)
 	 * but we're going to be very simplistic about it and break stuff
 	 * up based on spaces.  We're not even going to support any kind
 	 * of quoting or escape characters.  It's truly amazing that
-	 * there is no library function in OpenSolaris to do this for us.
+	 * there is no library function in Illumos to do this for us.
 	 */
 
 	/*
@@ -1092,69 +1158,155 @@ zone_login_cmd(brand_handle_t bh, const char *login)
 }
 
 /*
- * Prepare argv array for exec'd process; if we're passing commands to the
- * new process, then use su(1M) to do the invocation.  Otherwise, use
+ * Prepare argv array for exec'd process.  If commands are passed to the new
+ * process and su(1M) is avalable, use it for the invocation.  Otherwise, use
  * 'login -z <from_zonename> -f' (-z is an undocumented option which tells
  * login that we're coming from another zone, and to disregard its CONSOLE
  * checks).
  */
 static char **
-prep_args(brand_handle_t bh, const char *login, char **argv)
+prep_args(brand_handle_t bh, char *zonename, const char *login, char **argv)
 {
-	int argc = 0, a = 0, i, n = -1;
-	char **new_argv;
+	int argc = 0, i;
+	size_t subshell_len = 1;
+	char *subshell = NULL, *supath = NULL;
+	char **new_argv = NULL;
 
-	if (argv != NULL) {
-		size_t subshell_len = 1;
-		char *subshell;
+	if (argv == NULL) {
+		if (failsafe) {
+			if ((new_argv = malloc(sizeof (char *) * 2)) == NULL)
+				return (NULL);
+			new_argv[0] = FAILSAFESHELL;
+			new_argv[1] = NULL;
+		} else {
+			new_argv = zone_login_cmd(bh, login);
+		}
+		return (new_argv);
+	}
 
-		while (argv[argc] != NULL)
-			argc++;
+	/*
+	 * Attempt to locate a 'su' binary if not using the failsafe shell.
+	 */
+	if (!failsafe) {
+		struct stat sb;
+		char zonepath[MAXPATHLEN];
+		char supath_check[MAXPATHLEN];
+
+		if (zone_get_zonepath(zonename, zonepath,
+		    sizeof (zonepath)) != Z_OK) {
+			zerror(gettext("unable to determine zone "
+			    "path"));
+			return (NULL);
+		}
 
-		for (i = 0; i < argc; i++) {
-			subshell_len += strlen(argv[i]) + 1;
+		(void) snprintf(supath_check, sizeof (supath), "%s/root/%s",
+		    zonepath, SUPATH1);
+		if (stat(supath_check, &sb) == 0) {
+			supath = SUPATH1;
+		} else {
+			(void) snprintf(supath_check, sizeof (supath_check),
+			    "%s/root/%s", zonepath, SUPATH2);
+			if (stat(supath_check, &sb) == 0) {
+				supath = SUPATH2;
+			}
 		}
-		if ((subshell = calloc(1, subshell_len)) == NULL)
+	}
+
+	/*
+	 * With no failsafe shell or supath to wrap the incoming command, the
+	 * arguments are passed straight through.
+	 */
+	if (!failsafe && supath == NULL) {
+		/*
+		 * Such an outcome is not acceptable, however, if the caller
+		 * expressed a desire to switch users.
+		 */
+		if (strcmp(login, "root") != 0) {
+			zerror(gettext("unable to find 'su' command"));
 			return (NULL);
+		}
+		return (argv);
+	}
 
-		for (i = 0; i < argc; i++) {
-			(void) strcat(subshell, argv[i]);
+	/*
+	 * Inventory arguments and allocate a buffer to escape them for the
+	 * subshell.
+	 */
+	while (argv[argc] != NULL) {
+		/*
+		 * Allocate enough space for the delimiter and 2
+		 * quotes which might be needed.
+		 */
+		subshell_len += strlen(argv[argc]) + 3;
+		argc++;
+	}
+	if ((subshell = calloc(1, subshell_len)) == NULL) {
+		return (NULL);
+	}
+
+	/*
+	 * The handling of quotes in the following block may seem unusual, but
+	 * it is done this way for backward compatibility.
+	 * When running a command, zlogin is documented as:
+	 *    zlogin zonename command args
+	 * However, some code has come to depend on the following usage:
+	 *    zlogin zonename 'command args'
+	 * This relied on the fact that the single argument would be re-parsed
+	 * within the zone and excuted as a command with an argument. To remain
+	 * compatible with this (incorrect) usage, if there is only a single
+	 * argument, it is not quoted, even if it has embedded spaces.
+	 *
+	 * Here are two examples which both need to work:
+	 * 1) zlogin foo 'echo hello'
+	 *    This has a single argv member with a space in it but will not be
+	 *    quoted on the command passed into the zone.
+	 * 2) zlogin foo bash -c 'echo hello'
+	 *    This has 3 argv members. The 3rd arg has a space and must be
+	 *    quoted on the command passed into the zone.
+	 */
+	for (i = 0; i < argc; i++) {
+		if (i > 0)
 			(void) strcat(subshell, " ");
+
+		if (argc > 1 && (strchr(argv[i], ' ') != NULL ||
+		    strchr(argv[i], '\t') != NULL)) {
+			(void) strcat(subshell, "'");
+			(void) strcat(subshell, argv[i]);
+			(void) strcat(subshell, "'");
+		} else {
+			(void) strcat(subshell, argv[i]);
 		}
+	}
 
-		if (failsafe) {
-			n = 4;
-			if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
-				return (NULL);
+	if (failsafe) {
+		int a = 0, n = 4;
 
-			new_argv[a++] = FAILSAFESHELL;
-		} else {
-			n = 5;
-			if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
-				return (NULL);
+		if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
+			return (NULL);
 
-			new_argv[a++] = SUPATH;
-			if (strcmp(login, "root") != 0) {
-				new_argv[a++] = "-";
-				n++;
-			}
-			new_argv[a++] = (char *)login;
-		}
+		new_argv[a++] = FAILSAFESHELL;
 		new_argv[a++] = "-c";
 		new_argv[a++] = subshell;
 		new_argv[a++] = NULL;
 		assert(a == n);
 	} else {
-		if (failsafe) {
-			n = 2;
-			if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
-				return (NULL);
-			new_argv[a++] = FAILSAFESHELL;
-			new_argv[a++] = NULL;
-			assert(n == a);
+		int a = 0, n = 6;
+
+		assert(supath != NULL);
+		if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
+			return (NULL);
+
+		new_argv[a++] = supath;
+		if (strcmp(login, "root") != 0) {
+			new_argv[a++] = "-";
 		} else {
-			new_argv = zone_login_cmd(bh, login);
+			n--;
 		}
+		new_argv[a++] = (char *)login;
+		new_argv[a++] = "-c";
+		new_argv[a++] = subshell;
+		new_argv[a++] = NULL;
+		assert(a == n);
 	}
 
 	return (new_argv);
@@ -1185,6 +1337,7 @@ prep_env()
 	int e = 0, size = 1;
 	char **new_env, *estr;
 	char *term = getenv("TERM");
+	char *path;
 
 	size++;	/* for $PATH */
 	if (term != NULL)
@@ -1201,7 +1354,12 @@ prep_env()
 	if ((new_env = malloc(sizeof (char *) * size)) == NULL)
 		return (NULL);
 
-	if ((estr = add_env("PATH", DEF_PATH)) == NULL)
+	if (strcmp(zonebrand, "lx") == 0)
+		path = LX_DEF_PATH;
+	else
+		path = DEF_PATH;
+
+	if ((estr = add_env("PATH", path)) == NULL)
 		return (NULL);
 	new_env[e++] = estr;
 
@@ -1723,24 +1881,61 @@ get_username()
 	return (nptr->pw_name);
 }
 
+static boolean_t
+zlog_mode_logging(char *zonename, boolean_t *found)
+{
+	boolean_t lm = B_FALSE;
+	zone_dochandle_t handle;
+	struct zone_attrtab attr;
+
+	*found = B_FALSE;
+	if ((handle = zonecfg_init_handle()) == NULL)
+		return (lm);
+
+	if (zonecfg_get_handle(zonename, handle) != Z_OK)
+		goto done;
+
+	if (zonecfg_setattrent(handle) != Z_OK)
+		goto done;
+	while (zonecfg_getattrent(handle, &attr) == Z_OK) {
+		if (strcmp("zlog-mode", attr.zone_attr_name) == 0) {
+			int len = strlen(attr.zone_attr_value);
+
+			*found = B_TRUE;
+			if (strncmp("log", attr.zone_attr_value, 3) == 0 ||
+			    strncmp("nolog", attr.zone_attr_value, 5) == 0 ||
+			    (len >= 3 && attr.zone_attr_value[len - 2] == '-'))
+				lm = B_TRUE;
+			break;
+		}
+	}
+	(void) zonecfg_endattrent(handle);
+
+done:
+	zonecfg_fini_handle(handle);
+	return (lm);
+}
+
 int
 main(int argc, char **argv)
 {
-	int arg, console = 0;
+	int arg, console = 0, imode = 0;
+	int estatus = 0;
 	zoneid_t zoneid;
 	zone_state_t st;
 	char *login = "root";
+	int iflag = 0;
 	int lflag = 0;
 	int nflag = 0;
 	char *zonename = NULL;
 	char **proc_args = NULL;
 	char **new_args, **new_env;
 	sigset_t block_cld;
+	siginfo_t si;
 	char devroot[MAXPATHLEN];
 	char *slavename, slaveshortname[MAXPATHLEN];
 	priv_set_t *privset;
 	int tmpl_fd;
-	char zonebrand[MAXNAMELEN];
 	char default_brand[MAXNAMELEN];
 	struct stat sb;
 	char kernzone[ZONENAME_MAX];
@@ -1754,7 +1949,7 @@ main(int argc, char **argv)
 	(void) getpname(argv[0]);
 	username = get_username();
 
-	while ((arg = getopt(argc, argv, "dnECR:Se:l:Q")) != EOF) {
+	while ((arg = getopt(argc, argv, "diNnECIR:Se:l:Q")) != EOF) {
 		switch (arg) {
 		case 'C':
 			console = 1;
@@ -1762,6 +1957,16 @@ main(int argc, char **argv)
 		case 'E':
 			nocmdchar = 1;
 			break;
+		case 'I':
+			/*
+			 * interactive mode is just a slight variation on the
+			 * console mode.
+			 */
+			console = 1;
+			imode = 1;
+			/* The default is HUP, disconnect on EOF */
+			connect_flags ^= ZLOGIN_ZFD_EOF;
+			break;
 		case 'R':	/* undocumented */
 			if (*optarg != '/') {
 				zerror(gettext("root path must be absolute."));
@@ -1781,15 +1986,22 @@ main(int argc, char **argv)
 			failsafe = 1;
 			break;
 		case 'd':
-			disconnect = 1;
+			connect_flags |= ZLOGIN_DISCONNECT;
 			break;
 		case 'e':
 			set_cmdchar(optarg);
 			break;
+		case 'i':
+			iflag = 1;
+			break;
 		case 'l':
 			login = optarg;
 			lflag = 1;
 			break;
+		case 'N':
+			/* NOHUP - do not send EOF */
+			connect_flags ^= ZLOGIN_ZFD_EOF;
+			break;
 		case 'n':
 			nflag = 1;
 			break;
@@ -1800,6 +2012,12 @@ main(int argc, char **argv)
 
 	if (console != 0) {
 
+		/*
+		 * The only connect option in console mode is ZLOGIN_DISCONNECT
+		 */
+		if (imode == 0)
+			connect_flags &= ZLOGIN_DISCONNECT;
+
 		if (lflag != 0) {
 			zerror(gettext(
 			    "-l may not be specified for console login"));
@@ -1826,17 +2044,27 @@ main(int argc, char **argv)
 
 	}
 
+	if (iflag != 0 && nflag != 0) {
+		zerror(gettext("-i and -n flags are incompatible"));
+		usage();
+	}
+
 	if (failsafe != 0 && lflag != 0) {
 		zerror(gettext("-l may not be specified for failsafe login"));
 		usage();
 	}
 
-	if (!console && disconnect != 0) {
+	if (!console && (connect_flags & ZLOGIN_DISCONNECT) != 0) {
 		zerror(gettext(
 		    "-d may only be specified with console login"));
 		usage();
 	}
 
+	if (imode == 0 && (connect_flags & ZLOGIN_ZFD_EOF) != 0) {
+		zerror(gettext("-N may only be specified with -I"));
+		usage();
+	}
+
 	if (optind == (argc - 1)) {
 		/*
 		 * zone name, no process name; this should be an interactive
@@ -1859,7 +2087,8 @@ main(int argc, char **argv)
 		/* zone name and process name, and possibly some args */
 		zonename = argv[optind];
 		proc_args = &argv[optind + 1];
-		interactive = 0;
+		if (iflag && isatty(STDIN_FILENO))
+			interactive = 1;
 	} else {
 		usage();
 	}
@@ -1945,10 +2174,31 @@ main(int argc, char **argv)
 	}
 
 	/*
-	 * The console is a separate case from the rest of the code; handle
-	 * it first.
+	 * The console (or standalong interactive mode) is a separate case from
+	 * the rest of the code; handle it first.
 	 */
 	if (console) {
+		int gz_stderr_fd = -1;
+		int retry;
+		boolean_t set_raw = B_TRUE;
+
+		if (imode) {
+			boolean_t has_zfd_config;
+
+			if (zlog_mode_logging(zonename, &has_zfd_config))
+				set_raw = B_FALSE;
+
+			/*
+			 * Asked for standalone interactive mode but the
+			 * zlog-mode attribute is not configured on the zone.
+			 */
+			if (!has_zfd_config) {
+				zerror(gettext("'%s' is not configured on "
+				    "the zone"), "zlog-mode");
+				return (1);
+			}
+		}
+
 		/*
 		 * Ensure that zoneadmd for this zone is running.
 		 */
@@ -1957,16 +2207,56 @@ main(int argc, char **argv)
 
 		/*
 		 * Make contact with zoneadmd.
+		 *
+		 * Handshake with the control socket first. We handle retries
+		 * here since the relevant thread in zoneadmd might not have
+		 * finished setting up yet.
 		 */
-		if (get_console_master(zonename) == -1)
+		for (retry = 0; retry < MAX_RETRY; retry++) {
+			masterfd = connect_zone_sock(zonename,
+			    (imode ? "server_ctl" : "console_sock"), B_FALSE);
+			if (masterfd != -1)
+				break;
+			sleep(1);
+		}
+
+		if (retry == MAX_RETRY) {
+			zerror(gettext("unable to connect for %d seconds"),
+			    MAX_RETRY);
 			return (1);
+		}
 
-		if (!quiet)
-			(void) printf(
-			    gettext("[Connected to zone '%s' console]\n"),
-			    zonename);
+		if (handshake_zone_sock(masterfd, connect_flags) != 0) {
+			(void) close(masterfd);
+			return (1);
+		}
+
+		if (imode) {
+			ctlfd = masterfd;
+
+			/* Now open the io-related sockets */
+			masterfd = connect_zone_sock(zonename, "server_out",
+			    B_TRUE);
+			gz_stderr_fd = connect_zone_sock(zonename,
+			    "server_err", B_TRUE);
+			if (masterfd == -1 || gz_stderr_fd == -1) {
+				(void) close(ctlfd);
+				(void) close(masterfd);
+				(void) close(gz_stderr_fd);
+				return (1);
+			}
+		}
 
-		if (set_tty_rawmode(STDIN_FILENO) == -1) {
+		if (!quiet) {
+			if (imode)
+				(void) printf(gettext("[Connected to zone '%s' "
+				    "interactively]\n"), zonename);
+			else
+				(void) printf(gettext("[Connected to zone '%s' "
+				    "console]\n"), zonename);
+		}
+
+		if (set_raw && set_tty_rawmode(STDIN_FILENO) == -1) {
 			reset_tty();
 			zperror(gettext("failed to set stdin pty to raw mode"));
 			return (1);
@@ -1975,15 +2265,25 @@ main(int argc, char **argv)
 		(void) sigset(SIGWINCH, sigwinch);
 		(void) sigwinch(0);
 
+		if (imode) {
+			/* Allow EOF mode toggling via SIGUSR1 */
+			(void) sigset(SIGUSR1, sigusr1);
+		}
+
 		/*
 		 * Run the I/O loop until we get disconnected.
 		 */
-		doio(masterfd, -1, masterfd, -1, -1, B_FALSE);
+		doio(masterfd, -1, masterfd, gz_stderr_fd, -1, B_FALSE);
 		reset_tty();
-		if (!quiet)
-			(void) printf(
-			    gettext("\n[Connection to zone '%s' console "
-			    "closed]\n"), zonename);
+		if (!quiet) {
+			if (imode)
+				(void) printf(gettext("\n[Interactive "
+				    "connection to zone '%s' closed]\n"),
+				    zonename);
+			else
+				(void) printf(gettext("\n[Connection to zone "
+				    "'%s' console closed]\n"), zonename);
+		}
 
 		return (0);
 	}
@@ -2051,11 +2351,23 @@ main(int argc, char **argv)
 		return (1);
 	}
 
-	if ((new_args = prep_args(bh, login, proc_args)) == NULL) {
-		zperror(gettext("could not assemble new arguments"));
-		brand_close(bh);
-		return (1);
+	/*
+	 * The 'interactive' parameter (-i option) indicates that we're running
+	 * a command interactively. In this case we skip prep_args so that we
+	 * don't prepend the 'su root -c' preamble to the command invocation
+	 * since the 'su' command typically will execute a setpgrp which will
+	 * disassociate the actual command from the controlling terminal that
+	 * we (zlogin) setup.
+	 */
+	if (!iflag) {
+		if ((new_args = prep_args(bh, zonename, login, proc_args))
+		    == NULL) {
+			zperror(gettext("could not assemble new arguments"));
+			brand_close(bh);
+			return (1);
+		}
 	}
+
 	/*
 	 * Get the brand specific user_cmd.  This command is used to get
 	 * a passwd(4) entry for login.
@@ -2201,6 +2513,8 @@ main(int argc, char **argv)
 			return (1);
 		}
 
+		/* Note: we're now inside the zone, can't use gettext anymore */
+
 		if (slavefd != STDERR_FILENO)
 			(void) close(STDERR_FILENO);
 
@@ -2242,8 +2556,18 @@ main(int argc, char **argv)
 		/*
 		 * In failsafe mode, we don't use login(1), so don't try
 		 * setting up a utmpx entry.
+		 *
+		 * A branded zone may have very different utmpx semantics.
+		 * At the moment, we only have two brand types:
+		 * Illumos-like (native, sn1) and Linux.  In the Illumos
+		 * case, we know exactly how to do the necessary utmpx
+		 * setup.  Fortunately for us, the Linux /bin/login is
+		 * prepared to deal with a non-initialized utmpx entry, so
+		 * we can simply skip it.  If future brands don't fall into
+		 * either category, we'll have to add a per-brand utmpx
+		 * setup hook.
 		 */
-		if (!failsafe)
+		if (!failsafe && (strcmp(zonebrand, "lx") != 0))
 			if (setup_utmpx(slaveshortname) == -1)
 				return (1);
 
@@ -2252,13 +2576,17 @@ main(int argc, char **argv)
 		 * execute the brand's login program.
 		 */
 		if (setuid(0) == -1) {
-			zperror(gettext("insufficient privilege"));
+			zperror("insufficient privilege");
 			return (1);
 		}
 
-		(void) execve(new_args[0], new_args, new_env);
-		zperror(gettext("exec failure"));
-		return (1);
+		if (iflag) {
+			(void) execve(proc_args[0], proc_args, new_env);
+		} else {
+			(void) execve(new_args[0], new_args, new_env);
+		}
+		zperror("exec failure");
+		return (ENOEXEC);
 	}
 
 	(void) ct_tmpl_clear(tmpl_fd);
@@ -2283,8 +2611,19 @@ main(int argc, char **argv)
 	if (pollerr != 0) {
 		(void) fprintf(stderr, gettext("Error: connection closed due "
 		    "to unexpected pollevents=0x%x.\n"), pollerr);
-		return (1);
+		return (EPIPE);
 	}
 
-	return (0);
+	/* reap child and get its status */
+	if (waitid(P_PID, child_pid, &si, WEXITED | WNOHANG) == -1) {
+		estatus = errno;
+	} else if (si.si_pid == 0) {
+		estatus = ECHILD;
+	} else if (si.si_code == CLD_EXITED) {
+		estatus = si.si_status;
+	} else {
+		estatus = ECONNABORTED;
+	}
+
+	return (estatus);
 }
diff --git a/usr/src/cmd/zoneadm/Makefile b/usr/src/cmd/zoneadm/Makefile
index 2b01078aec..fba7809c71 100644
--- a/usr/src/cmd/zoneadm/Makefile
+++ b/usr/src/cmd/zoneadm/Makefile
@@ -21,14 +21,18 @@
 
 #
 # Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
 #
 
 PROG=		zoneadm
+SCRIPTS=
 MANIFEST=	zones.xml resource-mgmt.xml
 SVCMETHOD=	svc-zones svc-resource-mgmt
 
 include ../Makefile.cmd
+include ../Makefile.ctf
 
+ROOTUSRSBINSCRIPTS=     $(SCRIPTS:%=$(ROOTUSRSBIN)/%)
 ROOTMANIFESTDIR=        $(ROOTSVCSYSTEM)
 
 OBJS= zoneadm.o zfs.o
@@ -42,13 +46,14 @@ CERRWARN += -_gcc=-Wno-uninitialized
 
 .KEEP_STATE:
 
-all: $(PROG)
+all: $(PROG) $(SCRIPTS)
 
 $(PROG): $(OBJS)
 	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
 	$(POST_PROCESS)
 
-install: all $(ROOTUSRSBINPROG) $(ROOTMANIFEST) $(ROOTSVCMETHOD)
+install: all $(ROOTUSRSBINPROG) $(ROOTUSRSBINSCRIPTS) $(ROOTMANIFEST) \
+	$(ROOTSVCMETHOD)
 
 check:	$(PROG).c $(CHKMANIFEST)
 	$(CSTYLE) -pP $(SRCS:%=%)
@@ -58,7 +63,7 @@ $(POFILE): $(POFILES)
 	$(CAT) $(POFILES) > $@
 
 clean:
-	$(RM) $(OBJS) $(POFILES)
+	$(RM) $(OBJS) $(POFILES) $(SCRIPTS)
 
 lint:	lint_SRCS
 
diff --git a/usr/src/cmd/zoneadm/svc-zones b/usr/src/cmd/zoneadm/svc-zones
index 9d307835bd..30d54f5272 100644
--- a/usr/src/cmd/zoneadm/svc-zones
+++ b/usr/src/cmd/zoneadm/svc-zones
@@ -32,7 +32,7 @@
 shutdown_zones()
 {
 	zoneadm list -p | nawk -F: '{
-		if ($2 != "global") {
+		if (($5 != "lx") && ($2 != "global")) {
 			print $2
 		}
 	}'
diff --git a/usr/src/cmd/zoneadm/zfs.c b/usr/src/cmd/zoneadm/zfs.c
index 15be33ddab..214340d0ce 100644
--- a/usr/src/cmd/zoneadm/zfs.c
+++ b/usr/src/cmd/zoneadm/zfs.c
@@ -21,8 +21,8 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, Joyent, Inc. All rights reserved.
  * Copyright (c) 2012, 2015 by Delphix. All rights reserved.
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright (c) 2016 Martin Matuska. All rights reserved.
  */
 
@@ -968,6 +968,7 @@ create_zfs_zonepath(char *zonepath)
 	zfs_handle_t	*zhp;
 	char		zfs_name[MAXPATHLEN];
 	nvlist_t	*props = NULL;
+	int		i;
 
 	if (path2name(zonepath, zfs_name, sizeof (zfs_name)) != Z_OK)
 		return;
@@ -1003,9 +1004,20 @@ create_zfs_zonepath(char *zonepath)
 
 	nvlist_free(props);
 
-	if (zfs_mount(zhp, NULL, 0) != 0) {
+	/*
+	 * A monitoring tool might race with us and touch the mountpoint just
+	 * as we're trying to mount, blocking the mount. We wait and retry a
+	 * few times to workaround this race.
+	 */
+	for (i = 0; i < 5; i++) {
+		if (zfs_mount(zhp, NULL, 0) == 0)
+			break;
 		(void) fprintf(stderr, gettext("cannot mount ZFS dataset %s: "
 		    "%s\n"), zfs_name, libzfs_error_description(g_zfs));
+		(void) sleep(1);
+	}
+
+	if (i >= 5) {
 		(void) zfs_destroy(zhp, B_FALSE);
 	} else {
 		if (chmod(zonepath, S_IRWXU) != 0) {
diff --git a/usr/src/cmd/zoneadm/zoneadm.c b/usr/src/cmd/zoneadm/zoneadm.c
index 21bc9248f4..312159cabd 100644
--- a/usr/src/cmd/zoneadm/zoneadm.c
+++ b/usr/src/cmd/zoneadm/zoneadm.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2015, Joyent Inc. All rights reserved.
  * Copyright (c) 2015 by Delphix. All rights reserved.
  */
 
@@ -101,13 +102,11 @@ typedef struct zone_entry {
 	char		zroot[MAXPATHLEN];
 	char		zuuid[UUID_PRINTABLE_STRING_LENGTH];
 	zone_iptype_t	ziptype;
+	zoneid_t	zdid;
 } zone_entry_t;
 
 #define	CLUSTER_BRAND_NAME	"cluster"
 
-static zone_entry_t *zents;
-static size_t nzents;
-
 #define	LOOPBACK_IF	"lo0"
 #define	SOCKET_AF(af)	(((af) == AF_UNSPEC) ? AF_INET : (af))
 
@@ -406,19 +405,6 @@ zerror(const char *fmt, ...)
 	va_end(alist);
 }
 
-static void *
-safe_calloc(size_t nelem, size_t elsize)
-{
-	void *r = calloc(nelem, elsize);
-
-	if (r == NULL) {
-		zerror(gettext("failed to allocate %lu bytes: %s"),
-		    (ulong_t)nelem * elsize, strerror(errno));
-		exit(Z_ERR);
-	}
-	return (r);
-}
-
 static void
 zone_print(zone_entry_t *zent, boolean_t verbose, boolean_t parsable)
 {
@@ -443,6 +429,7 @@ zone_print(zone_entry_t *zent, boolean_t verbose, boolean_t parsable)
 	}
 	if (!verbose) {
 		char *cp, *clim;
+		char zdid[80];
 
 		if (!parsable) {
 			(void) printf("%s\n", zent->zname);
@@ -458,8 +445,12 @@ zone_print(zone_entry_t *zent, boolean_t verbose, boolean_t parsable)
 			(void) printf("%.*s\\:", clim - cp, cp);
 			cp = clim + 1;
 		}
-		(void) printf("%s:%s:%s:%s\n", cp, zent->zuuid, zent->zbrand,
-		    ip_type_str);
+		if (zent->zdid == -1)
+			zdid[0] = '\0';
+		else
+			(void) snprintf(zdid, sizeof (zdid), "%d", zent->zdid);
+		(void) printf("%s:%s:%s:%s:%s\n", cp, zent->zuuid, zent->zbrand,
+		    ip_type_str, zdid);
 		return;
 	}
 	if (zent->zstate_str != NULL) {
@@ -485,6 +476,9 @@ lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent)
 	(void) strlcpy(zent->zbrand, "???", sizeof (zent->zbrand));
 	zent->zstate_str = "???";
 
+	if (strcmp(zone_name, GLOBAL_ZONENAME) == 0)
+		zid = zent->zdid = GLOBAL_ZONEID;
+
 	zent->zid = zid;
 
 	if (zonecfg_get_uuid(zone_name, uuid) == Z_OK &&
@@ -529,8 +523,8 @@ lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent)
 	zent->zstate_str = zone_state_str(zent->zstate_num);
 
 	/*
-	 * A zone's brand is only available in the .xml file describing it,
-	 * which is only visible to the global zone.  This causes
+	 * A zone's brand might only be available in the .xml file describing
+	 * it, which is only visible to the global zone.  This causes
 	 * zone_get_brand() to fail when called from within a non-global
 	 * zone.  Fortunately we only do this on labeled systems, where we
 	 * know all zones are native.
@@ -554,6 +548,22 @@ lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent)
 		return (Z_OK);
 	}
 
+	if ((handle = zonecfg_init_handle()) == NULL) {
+		zperror2(zent->zname, gettext("could not init handle"));
+		return (Z_ERR);
+	}
+	if ((err = zonecfg_get_handle(zent->zname, handle)) != Z_OK) {
+		zperror2(zent->zname, gettext("could not get handle"));
+		zonecfg_fini_handle(handle);
+		return (Z_ERR);
+	}
+
+	if ((err = zonecfg_get_iptype(handle, &zent->ziptype)) != Z_OK) {
+		zperror2(zent->zname, gettext("could not get ip-type"));
+		zonecfg_fini_handle(handle);
+		return (Z_ERR);
+	}
+
 	/*
 	 * There is a race condition where the zone could boot while
 	 * we're walking the index file.  In this case the zone state
@@ -574,189 +584,73 @@ lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent)
 				zent->ziptype = ZS_EXCLUSIVE;
 			else
 				zent->ziptype = ZS_SHARED;
-			return (Z_OK);
 		}
 	}
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zperror2(zent->zname, gettext("could not init handle"));
-		return (Z_ERR);
-	}
-	if ((err = zonecfg_get_handle(zent->zname, handle)) != Z_OK) {
-		zperror2(zent->zname, gettext("could not get handle"));
-		zonecfg_fini_handle(handle);
-		return (Z_ERR);
-	}
+	zent->zdid = zonecfg_get_did(handle);
 
-	if ((err = zonecfg_get_iptype(handle, &zent->ziptype)) != Z_OK) {
-		zperror2(zent->zname, gettext("could not get ip-type"));
-		zonecfg_fini_handle(handle);
-		return (Z_ERR);
-	}
 	zonecfg_fini_handle(handle);
 
 	return (Z_OK);
 }
 
-/*
- * fetch_zents() calls zone_list(2) to find out how many zones are running
- * (which is stored in the global nzents), then calls zone_list(2) again
- * to fetch the list of running zones (stored in the global zents).  This
- * function may be called multiple times, so if zents is already set, we
- * return immediately to save work.
- *
- * Note that the data about running zones can change while this function
- * is running, so its possible that the list of zones will have empty slots
- * at the end.
- */
-
-static int
-fetch_zents(void)
-{
-	zoneid_t *zids = NULL;
-	uint_t nzents_saved;
-	int i, retv;
-	FILE *fp;
-	boolean_t inaltroot;
-	zone_entry_t *zentp;
-	const char *altroot;
-
-	if (nzents > 0)
-		return (Z_OK);
-
-	if (zone_list(NULL, &nzents) != 0) {
-		zperror(gettext("failed to get zoneid list"), B_FALSE);
-		return (Z_ERR);
-	}
-
-again:
-	if (nzents == 0)
-		return (Z_OK);
-
-	zids = safe_calloc(nzents, sizeof (zoneid_t));
-	nzents_saved = nzents;
-
-	if (zone_list(zids, &nzents) != 0) {
-		zperror(gettext("failed to get zone list"), B_FALSE);
-		free(zids);
-		return (Z_ERR);
-	}
-	if (nzents != nzents_saved) {
-		/* list changed, try again */
-		free(zids);
-		goto again;
-	}
-
-	zents = safe_calloc(nzents, sizeof (zone_entry_t));
-
-	inaltroot = zonecfg_in_alt_root();
-	if (inaltroot) {
-		fp = zonecfg_open_scratch("", B_FALSE);
-		altroot = zonecfg_get_root();
-	} else {
-		fp = NULL;
-	}
-	zentp = zents;
-	retv = Z_OK;
-	for (i = 0; i < nzents; i++) {
-		char name[ZONENAME_MAX];
-		char altname[ZONENAME_MAX];
-		char rev_altroot[MAXPATHLEN];
-
-		if (getzonenamebyid(zids[i], name, sizeof (name)) < 0) {
-			/*
-			 * There is a race condition where the zone may have
-			 * shutdown since we retrieved the number of running
-			 * zones above.  This is not an error, there will be
-			 * an empty slot at the end of the list.
-			 */
-			continue;
-		}
-		if (zonecfg_is_scratch(name)) {
-			/* Ignore scratch zones by default */
-			if (!inaltroot)
-				continue;
-			if (fp == NULL ||
-			    zonecfg_reverse_scratch(fp, name, altname,
-			    sizeof (altname), rev_altroot,
-			    sizeof (rev_altroot)) == -1) {
-				zerror(gettext("could not resolve scratch "
-				    "zone %s"), name);
-				retv = Z_ERR;
-				continue;
-			}
-			/* Ignore zones in other alternate roots */
-			if (strcmp(rev_altroot, altroot) != 0)
-				continue;
-			(void) strcpy(name, altname);
-		} else {
-			/* Ignore non-scratch when in an alternate root */
-			if (inaltroot && strcmp(name, GLOBAL_ZONENAME) != 0)
-				continue;
-		}
-		if (lookup_zone_info(name, zids[i], zentp) != Z_OK) {
-			/*
-			 * There is a race condition where the zone may have
-			 * shutdown since we retrieved the number of running
-			 * zones above.  This is not an error, there will be
-			 * an empty slot at the end of the list.
-			 */
-			continue;
-		}
-		zentp++;
-	}
-	nzents = zentp - zents;
-	if (fp != NULL)
-		zonecfg_close_scratch(fp);
-
-	free(zids);
-	return (retv);
-}
-
 static int
 zone_print_list(zone_state_t min_state, boolean_t verbose, boolean_t parsable)
 {
-	int i;
 	zone_entry_t zent;
 	FILE *cookie;
-	char *name;
+	struct zoneent *ze;
 
 	/*
-	 * First get the list of running zones from the kernel and print them.
-	 * If that is all we need, then return.
-	 */
-	if ((i = fetch_zents()) != Z_OK) {
-		/*
-		 * No need for error messages; fetch_zents() has already taken
-		 * care of this.
-		 */
-		return (i);
-	}
-	for (i = 0; i < nzents; i++)
-		zone_print(&zents[i], verbose, parsable);
-	if (min_state >= ZONE_STATE_RUNNING)
-		return (Z_OK);
-	/*
-	 * Next, get the full list of zones from the configuration, skipping
-	 * any we have already printed.
+	 * Get the full list of zones from the configuration.
 	 */
 	cookie = setzoneent();
-	while ((name = getzoneent(cookie)) != NULL) {
-		for (i = 0; i < nzents; i++) {
-			if (strcmp(zents[i].zname, name) == 0)
-				break;
-		}
-		if (i < nzents) {
-			free(name);
-			continue;
-		}
-		if (lookup_zone_info(name, ZONE_ID_UNDEFINED, &zent) != Z_OK) {
-			free(name);
-			continue;
+	while ((ze = getzoneent_private(cookie)) != NULL) {
+		char *name = ze->zone_name;
+		zoneid_t zid;
+
+		zid = getzoneidbyname(name);
+
+		if (ze->zone_brand[0] == '\0') {
+			/* old, incomplete index entry */
+			if (lookup_zone_info(name, zid, &zent) != Z_OK) {
+				free(ze);
+				continue;
+			}
+		} else {
+			/* new, full index entry */
+			(void) strlcpy(zent.zname, name, sizeof (zent.zname));
+			(void) strlcpy(zent.zroot, ze->zone_path,
+			    sizeof (zent.zroot));
+			uuid_unparse(ze->zone_uuid, zent.zuuid);
+			(void) strlcpy(zent.zbrand, ze->zone_brand,
+			    sizeof (zent.zbrand));
+			zent.ziptype = ze->zone_iptype;
+			zent.zdid = ze->zone_did;
+			zent.zid = zid;
+
+			if (zid != -1) {
+				int err;
+
+				err = zone_get_state(name,
+				    (zone_state_t *)&ze->zone_state);
+				if (err != Z_OK) {
+					errno = err;
+					zperror2(name, gettext("could not get "
+					    "state"));
+					free(ze);
+					continue;
+				}
+			}
+
+			zent.zstate_num = ze->zone_state;
+			zent.zstate_str = zone_state_str(zent.zstate_num);
 		}
-		free(name);
+
 		if (zent.zstate_num >= min_state)
 			zone_print(&zent, verbose, parsable);
+
+		free(ze);
 	}
 	endzoneent(cookie);
 	return (Z_OK);
@@ -766,18 +660,22 @@ zone_print_list(zone_state_t min_state, boolean_t verbose, boolean_t parsable)
  * Retrieve a zone entry by name.  Returns NULL if no such zone exists.
  */
 static zone_entry_t *
-lookup_running_zone(const char *str)
+lookup_running_zone(const char *name)
 {
-	int i;
+	zoneid_t zid;
+	zone_entry_t *zent;
+
+	if ((zid = getzoneidbyname(name)) == -1)
+		return (NULL);
 
-	if (fetch_zents() != Z_OK)
+	if ((zent = malloc(sizeof (zone_entry_t))) == NULL)
 		return (NULL);
 
-	for (i = 0; i < nzents; i++) {
-		if (strcmp(str, zents[i].zname) == 0)
-			return (&zents[i]);
+	if (lookup_zone_info(name, zid, zent) != Z_OK) {
+		free(zent);
+		return (NULL);
 	}
-	return (NULL);
+	return (zent);
 }
 
 /*
@@ -1013,8 +911,12 @@ validate_zonepath(char *path, int cmd_num)
 		(void) printf(gettext("WARNING: %s is on a temporary "
 		    "file system.\n"), rpath);
 	}
-	if (crosscheck_zonepaths(rpath) != Z_OK)
-		return (Z_ERR);
+	if (cmd_num != CMD_BOOT && cmd_num != CMD_REBOOT &&
+	    cmd_num != CMD_READY) {
+		/* we checked when we installed, no need to check each boot */
+		if (crosscheck_zonepaths(rpath) != Z_OK)
+			return (Z_ERR);
+	}
 	/*
 	 * Try to collect and report as many minor errors as possible
 	 * before returning, so the user can learn everything that needs
@@ -1201,6 +1103,7 @@ static int
 ready_func(int argc, char *argv[])
 {
 	zone_cmd_arg_t zarg;
+	boolean_t debug = B_FALSE;
 	int arg;
 
 	if (zonecfg_in_alt_root()) {
@@ -1209,11 +1112,14 @@ ready_func(int argc, char *argv[])
 	}
 
 	optind = 0;
-	if ((arg = getopt(argc, argv, "?")) != EOF) {
+	if ((arg = getopt(argc, argv, "?X")) != EOF) {
 		switch (arg) {
 		case '?':
 			sub_usage(SHELP_READY, CMD_READY);
 			return (optopt == '?' ? Z_OK : Z_USAGE);
+		case 'X':
+			debug = B_TRUE;
+			break;
 		default:
 			sub_usage(SHELP_READY, CMD_READY);
 			return (Z_USAGE);
@@ -1230,6 +1136,7 @@ ready_func(int argc, char *argv[])
 		return (Z_ERR);
 
 	zarg.cmd = Z_READY;
+	zarg.debug = debug;
 	if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) {
 		zerror(gettext("call to %s failed"), "zoneadmd");
 		return (Z_ERR);
@@ -1242,6 +1149,7 @@ boot_func(int argc, char *argv[])
 {
 	zone_cmd_arg_t zarg;
 	boolean_t force = B_FALSE;
+	boolean_t debug = B_FALSE;
 	int arg;
 
 	if (zonecfg_in_alt_root()) {
@@ -1268,7 +1176,7 @@ boot_func(int argc, char *argv[])
 	 *	zoneadm -z myzone boot -- -s -v -m verbose.
 	 */
 	optind = 0;
-	while ((arg = getopt(argc, argv, "?fs")) != EOF) {
+	while ((arg = getopt(argc, argv, "?fsX")) != EOF) {
 		switch (arg) {
 		case '?':
 			sub_usage(SHELP_BOOT, CMD_BOOT);
@@ -1280,6 +1188,9 @@ boot_func(int argc, char *argv[])
 		case 'f':
 			force = B_TRUE;
 			break;
+		case 'X':
+			debug = B_TRUE;
+			break;
 		default:
 			sub_usage(SHELP_BOOT, CMD_BOOT);
 			return (Z_USAGE);
@@ -1305,6 +1216,7 @@ boot_func(int argc, char *argv[])
 	if (verify_details(CMD_BOOT, argv) != Z_OK)
 		return (Z_ERR);
 	zarg.cmd = force ? Z_FORCEBOOT : Z_BOOT;
+	zarg.debug = debug;
 	if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) {
 		zerror(gettext("call to %s failed"), "zoneadmd");
 		return (Z_ERR);
@@ -1614,10 +1526,10 @@ auth_check(char *user, char *zone, int cmd_num)
  *     not already running (or ready).
  */
 static int
-sanity_check(char *zone, int cmd_num, boolean_t running,
+sanity_check(char *zone, int cmd_num, boolean_t need_running,
     boolean_t unsafe_when_running, boolean_t force)
 {
-	zone_entry_t *zent;
+	boolean_t is_running = B_FALSE;
 	priv_set_t *privset;
 	zone_state_t state, min_state;
 	char kernzone[ZONENAME_MAX];
@@ -1688,51 +1600,54 @@ sanity_check(char *zone, int cmd_num, boolean_t running,
 	}
 
 	if (!zonecfg_in_alt_root()) {
-		zent = lookup_running_zone(zone);
-	} else if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
-		zent = NULL;
-	} else {
-		if (zonecfg_find_scratch(fp, zone, zonecfg_get_root(),
-		    kernzone, sizeof (kernzone)) == 0)
-			zent = lookup_running_zone(kernzone);
-		else
-			zent = NULL;
+		/* Avoid the xml read overhead of lookup_running_zone */
+		if (getzoneidbyname(zone) != -1)
+			is_running = B_TRUE;
+
+	} else if ((fp = zonecfg_open_scratch("", B_FALSE)) != NULL) {
+		if (zonecfg_find_scratch(fp, zone, zonecfg_get_root(), kernzone,
+		    sizeof (kernzone)) == 0 && getzoneidbyname(kernzone) != -1)
+			is_running = B_TRUE;
+
 		zonecfg_close_scratch(fp);
 	}
 
 	/*
 	 * Look up from the kernel for 'running' zones.
 	 */
-	if (running && !force) {
-		if (zent == NULL) {
+	if (need_running && !force) {
+		if (!is_running) {
 			zerror(gettext("not running"));
 			return (Z_ERR);
 		}
 	} else {
 		int err;
 
-		if (unsafe_when_running && zent != NULL) {
+		err = zone_get_state(zone, &state);
+
+		if (unsafe_when_running && is_running) {
 			/* check whether the zone is ready or running */
-			if ((err = zone_get_state(zent->zname,
-			    &zent->zstate_num)) != Z_OK) {
+			char *zstate_str;
+
+			if (err != Z_OK) {
 				errno = err;
-				zperror2(zent->zname,
-				    gettext("could not get state"));
+				zperror2(zone, gettext("could not get state"));
 				/* can't tell, so hedge */
-				zent->zstate_str = "ready/running";
+				zstate_str = "ready/running";
 			} else {
-				zent->zstate_str =
-				    zone_state_str(zent->zstate_num);
+				zstate_str = zone_state_str(state);
 			}
 			zerror(gettext("%s operation is invalid for %s zones."),
-			    cmd_to_str(cmd_num), zent->zstate_str);
+			    cmd_to_str(cmd_num), zstate_str);
 			return (Z_ERR);
 		}
-		if ((err = zone_get_state(zone, &state)) != Z_OK) {
+
+		if (err != Z_OK) {
 			errno = err;
 			zperror2(zone, gettext("could not get state"));
 			return (Z_ERR);
 		}
+
 		switch (cmd_num) {
 		case CMD_UNINSTALL:
 			if (state == ZONE_STATE_CONFIGURED) {
@@ -1820,6 +1735,7 @@ static int
 halt_func(int argc, char *argv[])
 {
 	zone_cmd_arg_t zarg;
+	boolean_t debug = B_FALSE;
 	int arg;
 
 	if (zonecfg_in_alt_root()) {
@@ -1828,11 +1744,14 @@ halt_func(int argc, char *argv[])
 	}
 
 	optind = 0;
-	if ((arg = getopt(argc, argv, "?")) != EOF) {
+	if ((arg = getopt(argc, argv, "?X")) != EOF) {
 		switch (arg) {
 		case '?':
 			sub_usage(SHELP_HALT, CMD_HALT);
 			return (optopt == '?' ? Z_OK : Z_USAGE);
+		case 'X':
+			debug = B_TRUE;
+			break;
 		default:
 			sub_usage(SHELP_HALT, CMD_HALT);
 			return (Z_USAGE);
@@ -1858,6 +1777,7 @@ halt_func(int argc, char *argv[])
 		return (Z_ERR);
 
 	zarg.cmd = Z_HALT;
+	zarg.debug = debug;
 	return ((zonecfg_call_zoneadmd(target_zone, &zarg, locale,
 	    B_TRUE) == 0) ?  Z_OK : Z_ERR);
 }
@@ -1935,6 +1855,7 @@ static int
 reboot_func(int argc, char *argv[])
 {
 	zone_cmd_arg_t zarg;
+	boolean_t debug = B_FALSE;
 	int arg;
 
 	if (zonecfg_in_alt_root()) {
@@ -1943,11 +1864,14 @@ reboot_func(int argc, char *argv[])
 	}
 
 	optind = 0;
-	if ((arg = getopt(argc, argv, "?")) != EOF) {
+	if ((arg = getopt(argc, argv, "?X")) != EOF) {
 		switch (arg) {
 		case '?':
 			sub_usage(SHELP_REBOOT, CMD_REBOOT);
 			return (optopt == '?' ? Z_OK : Z_USAGE);
+		case 'X':
+			debug = B_TRUE;
+			break;
 		default:
 			sub_usage(SHELP_REBOOT, CMD_REBOOT);
 			return (Z_USAGE);
@@ -1982,6 +1906,7 @@ reboot_func(int argc, char *argv[])
 		return (Z_ERR);
 
 	zarg.cmd = Z_REBOOT;
+	zarg.debug = debug;
 	return ((zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) == 0)
 	    ? Z_OK : Z_ERR);
 }
@@ -2209,6 +2134,10 @@ verify_fs_special(struct zone_fstab *fstab)
 	if (strcmp(fstab->zone_fs_type, MNTTYPE_ZFS) == 0)
 		return (verify_fs_zfs(fstab));
 
+	if (strcmp(fstab->zone_fs_type, MNTTYPE_HYPRLOFS) == 0 &&
+	    strcmp(fstab->zone_fs_special, "swap") == 0)
+			return (Z_OK);
+
 	if (stat64(fstab->zone_fs_special, &st) != 0) {
 		(void) fprintf(stderr, gettext("could not verify fs "
 		    "%s: could not access %s: %s\n"), fstab->zone_fs_dir,
@@ -2612,7 +2541,6 @@ verify_handle(int cmd_num, zone_dochandle_t handle, char *argv[])
 	dladm_handle_t dh;
 	dladm_status_t status;
 	datalink_id_t linkid;
-	char errmsg[DLADM_STRSIZE];
 
 	in_alt_root = zonecfg_in_alt_root();
 	if (in_alt_root)
@@ -2695,11 +2623,6 @@ verify_handle(int cmd_num, zone_dochandle_t handle, char *argv[])
 				dladm_close(dh);
 			}
 			if (status != DLADM_STATUS_OK) {
-				(void) fprintf(stderr,
-				    gettext("WARNING: skipping network "
-				    "interface '%s': %s\n"),
-				    nwiftab.zone_nwif_physical,
-				    dladm_status2str(status, errmsg));
 				break;
 			}
 			dl_owner_zid = ALL_ZONES;
@@ -2783,6 +2706,74 @@ no_net:
 	return (return_code);
 }
 
+/*
+ * Called when readying or booting a zone.  We double check that the zone's
+ * debug ID is set and is unique.  This covers the case of pre-existing zones
+ * with no ID.  Also, its possible that a zone was migrated to this host
+ * and as a result it has a duplicate ID.  In this case we preserve the ID
+ * of the first zone we match on in the index file (since it was there before
+ * the current zone) and we assign a new unique ID to the current zone.
+ * Return true if we assigned a new ID, indicating that the zone configuration
+ * needs to be saved.
+ */
+static boolean_t
+verify_fix_did(zone_dochandle_t handle)
+{
+	zoneid_t mydid;
+	struct zoneent *ze;
+	FILE *cookie;
+	boolean_t fix = B_FALSE;
+
+	mydid = zonecfg_get_did(handle);
+	if (mydid == -1) {
+		zonecfg_set_did(handle);
+		return (B_TRUE);
+	}
+
+	/* Get the full list of zones from the configuration. */
+	cookie = setzoneent();
+	while ((ze = getzoneent_private(cookie)) != NULL) {
+		char *name;
+		zoneid_t did;
+
+		name = ze->zone_name;
+		if (strcmp(name, GLOBAL_ZONENAME) == 0 ||
+		    strcmp(name, target_zone) == 0) {
+			free(ze);
+			continue;
+		}
+
+		if (ze->zone_brand[0] == '\0') {
+			/* old, incomplete index entry */
+			zone_entry_t zent;
+
+			if (lookup_zone_info(name, ZONE_ID_UNDEFINED,
+			    &zent) != Z_OK) {
+				free(ze);
+				continue;
+			}
+			did = zent.zdid;
+		} else {
+			/* new, full index entry */
+			did = ze->zone_did;
+		}
+		free(ze);
+
+		if (did == mydid) {
+			fix = B_TRUE;
+			break;
+		}
+	}
+	endzoneent(cookie);
+
+	if (fix) {
+		zonecfg_set_did(handle);
+		return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
 static int
 verify_details(int cmd_num, char *argv[])
 {
@@ -2842,6 +2833,18 @@ verify_details(int cmd_num, char *argv[])
 	if (verify_handle(cmd_num, handle, argv) != Z_OK)
 		return_code = Z_ERR;
 
+	if (cmd_num == CMD_READY || cmd_num == CMD_BOOT) {
+		int vcommit = 0, obscommit = 0;
+
+		vcommit = verify_fix_did(handle);
+		obscommit = zonecfg_fix_obsolete(handle);
+
+		if (vcommit || obscommit)
+			if (zonecfg_save(handle) != Z_OK)
+				(void) fprintf(stderr, gettext("Could not save "
+				    "updated configuration.\n"));
+	}
+
 	zonecfg_fini_handle(handle);
 	if (return_code == Z_ERR)
 		(void) fprintf(stderr,
@@ -2927,6 +2930,7 @@ install_func(int argc, char *argv[])
 	int status;
 	boolean_t do_postinstall = B_FALSE;
 	boolean_t brand_help = B_FALSE;
+	boolean_t do_dataset = B_TRUE;
 	char opts[128];
 
 	if (target_zone == NULL) {
@@ -3002,6 +3006,12 @@ install_func(int argc, char *argv[])
 			}
 			/* Ignore unknown options - may be brand specific. */
 			break;
+		case 'x':
+			if (strcmp(optarg, "nodataset") == 0) {
+				do_dataset = B_FALSE;
+				continue; /* internal arg, don't pass thru */
+			}
+			break;
 		default:
 			/* Ignore unknown options - may be brand specific. */
 			break;
@@ -3054,7 +3064,8 @@ install_func(int argc, char *argv[])
 			goto done;
 		}
 
-		create_zfs_zonepath(zonepath);
+		if (do_dataset)
+			create_zfs_zonepath(zonepath);
 	}
 
 	status = do_subproc(cmdbuf);
@@ -3865,10 +3876,10 @@ cleanup_zonepath(char *zonepath, boolean_t all)
 			 * exist if the zone was force-attached after a
 			 * migration.
 			 */
-	char		*std_entries[] = {"dev", "lu", "root",
-			    "SUNWattached.xml", NULL};
-			/* (MAXPATHLEN * 3) is for the 3 std_entries dirs */
-	char		cmdbuf[sizeof (RMCOMMAND) + (MAXPATHLEN * 3) + 64];
+	char		*std_entries[] = {"dev", "lastexited", "logs", "lu",
+			    "root", "SUNWattached.xml", NULL};
+			/* (MAXPATHLEN * 5) is for the 5 std_entries dirs */
+	char		cmdbuf[sizeof (RMCOMMAND) + (MAXPATHLEN * 5) + 64];
 
 	/*
 	 * We shouldn't need these checks but lets be paranoid since we
@@ -5018,6 +5029,7 @@ uninstall_func(int argc, char *argv[])
 		if (zonecfg_ping_zoneadmd(target_zone) == Z_OK) {
 			zone_cmd_arg_t zarg;
 			zarg.cmd = Z_NOTE_UNINSTALLING;
+			zarg.debug = B_FALSE;
 			/* we don't care too much if this fails, just plow on */
 			(void) zonecfg_call_zoneadmd(target_zone, &zarg, locale,
 			    B_TRUE);
@@ -5133,6 +5145,7 @@ mount_func(int argc, char *argv[])
 		return (Z_ERR);
 
 	zarg.cmd = force ? Z_FORCEMOUNT : Z_MOUNT;
+	zarg.debug = B_FALSE;
 	zarg.bootbuf[0] = '\0';
 	if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) {
 		zerror(gettext("call to %s failed"), "zoneadmd");
@@ -5154,6 +5167,7 @@ unmount_func(int argc, char *argv[])
 		return (Z_ERR);
 
 	zarg.cmd = Z_UNMOUNT;
+	zarg.debug = B_FALSE;
 	if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) {
 		zerror(gettext("call to %s failed"), "zoneadmd");
 		return (Z_ERR);
@@ -5375,7 +5389,7 @@ apply_func(int argc, char *argv[])
 	priv_set_t *privset;
 	zoneid_t zoneid;
 	zone_dochandle_t handle;
-	struct zone_mcaptab mcap;
+	uint64_t mcap;
 	char pool_err[128];
 
 	zoneid = getzoneid();
@@ -5466,19 +5480,12 @@ apply_func(int argc, char *argv[])
 	}
 
 	/*
-	 * If a memory cap is configured, set the cap in the kernel using
-	 * zone_setattr() and make sure the rcapd SMF service is enabled.
+	 * If a memory cap is configured, make sure the rcapd SMF service is
+	 * enabled.
 	 */
-	if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
-		uint64_t num;
+	if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXPHYSMEM, &mcap) == Z_OK) {
 		char smf_err[128];
 
-		num = (uint64_t)strtoll(mcap.zone_physmem_cap, NULL, 10);
-		if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
-			zerror(gettext("could not set zone memory cap"));
-			res = Z_ERR;
-		}
-
 		if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
 			zerror(gettext("enabling system/rcap service failed: "
 			    "%s"), smf_err);
diff --git a/usr/src/cmd/zoneadm/zones.xml b/usr/src/cmd/zoneadm/zones.xml
index 9c8e305f89..b094bc660b 100644
--- a/usr/src/cmd/zoneadm/zones.xml
+++ b/usr/src/cmd/zoneadm/zones.xml
@@ -54,11 +54,32 @@
 		<service_fmri value='svc:/milestone/multi-user-server' />
 	</dependency>
 
+	<!--
+	    Until overlay device creation is moved out of the zone
+	    state-change script, zones must be dependent on varpd's
+	    successful launch.
+	-->
+	<dependency
+		name='varpd'
+		type='service'
+		grouping='require_all'
+		restart_on='none'>
+		<service_fmri value='svc:/network/varpd' />
+	</dependency>
+
+	<dependency
+		name='metadata'
+		type='service'
+		grouping='require_all'
+		restart_on='none'>
+		<service_fmri value='svc:/system/smartdc/metadata' />
+	</dependency>
+
 	<exec_method
 		type='method'
 		name='start'
 		exec='/lib/svc/method/svc-zones %m'
-		timeout_seconds='60'>
+		timeout_seconds='0'>
 	</exec_method>
 
 	<!--
diff --git a/usr/src/cmd/zoneadmd/Makefile b/usr/src/cmd/zoneadmd/Makefile
index 8324f7fefa..e81e4631aa 100644
--- a/usr/src/cmd/zoneadmd/Makefile
+++ b/usr/src/cmd/zoneadmd/Makefile
@@ -18,57 +18,54 @@
 #
 # CDDL HEADER END
 
-
-#
-
 #
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2014 Nexenta Systems, Inc. All rights reserved.
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
 #
 
 PROG= zoneadmd
 
 include ../Makefile.cmd
+include ../Makefile.ctf
 
-ROOTCMDDIR=	$(ROOTLIB)/zones
-
-OBJS= zoneadmd.o zcons.o vplat.o
-SRCS = $(OBJS:.o=.c)
-POFILE=zoneadmd_all.po
-POFILES= $(OBJS:%.o=%.po)
+$(64ONLY)SUBDIRS= $(MACH)
+$(BUILD64)SUBDIRS += $(MACH64)
 
-CFLAGS += $(CCVERBOSE)
-CERRWARN += -_gcc=-Wno-switch
-CERRWARN += -_gcc=-Wno-parentheses
-CERRWARN += -_gcc=-Wno-uninitialized
+all	:=	TARGET = all
+install	:=	TARGET = install
+clean	:=	TARGET = clean
+clobber	:=	TARGET = clobber
+lint	:=	TARGET = lint
 
-LDLIBS += -lsocket -lzonecfg -lnsl -ldevinfo -ldevice -lnvpair \
-	-lgen -lbsm -lcontract -lzfs -luuid -lbrand -ldladm -ltsnet -ltsol \
-	-linetutil -lscf
 XGETFLAGS += -a -x zoneadmd.xcl
 
+ROOTUSRLIBZONES			= $(ROOT)/usr/lib/zones
+
 .KEEP_STATE:
 
 .PARALLEL:
 
-all: $(PROG)
+all: $(SUBDIRS)
 
 $(PROG): $(OBJS)
 	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
 	$(POST_PROCESS)
 
-install: all $(ROOTCMD)
-
-$(POFILE): $(POFILES)
-	$(RM) $@
-	$(CAT) $(POFILES) > $@
+install: $(SUBDIRS)
+	-$(RM) $(ROOTUSRLIBZONES)/$(PROG)
+	-$(LN) $(ISAEXEC) $(ROOTUSRLIBZONES)/$(PROG)
 
-clean:
-	$(RM) $(OBJS)
+$(POFILE):
 
-lint:	lint_SRCS
+clean clobebr lint:	$(SUBDIRS)
 
 check:
-	$(CSTYLE) -p -P $(SRCS:%=%)
+	$(CSTYLE) -p -P *.c
+
+$(SUBDIRS):	FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
 
 include ../Makefile.targ
diff --git a/usr/src/cmd/zoneadmd/Makefile.com b/usr/src/cmd/zoneadmd/Makefile.com
new file mode 100644
index 0000000000..6312c00ad5
--- /dev/null
+++ b/usr/src/cmd/zoneadmd/Makefile.com
@@ -0,0 +1,72 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+
+#
+# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2018 Joyent, Inc.
+#
+
+PROG= zoneadmd
+
+include ../../Makefile.cmd
+include ../../Makefile.ctf
+
+ROOTCMDDIR=	$(ROOTLIB)/zones
+
+OBJS= zoneadmd.o zcons.o zfd.o vplat.o log.o
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lsocket -lzonecfg -lnsl -ldevinfo -ldevice -lnvpair \
+	-lgen -lbsm -lcontract -lzfs -luuid -lbrand -ldladm -ltsnet -ltsol \
+	-linetutil -lproc -lscf -lppt
+
+CSTD= $(CSTD_GNU99)
+
+.KEEP_STATE:
+
+%.o:    ../%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+ROOTUSRLIBZONES			= $(ROOT)/usr/lib/zones
+ROOTUSRLIBZONES32		= $(ROOTUSRLIBZONES)/$(MACH32)
+ROOTUSRLIBZONES64		= $(ROOTUSRLIBZONES)/$(MACH64)
+ROOTUSRLIBZONESPROG32		= $(ROOTUSRLIBZONES32)/$(PROG)
+ROOTUSRLIBZONESPROG64		= $(ROOTUSRLIBZONES64)/$(PROG)
+$(ROOTUSRLIBZONES32)/%: $(ROOTUSRLIBZONES32) %
+	$(INS.file)
+$(ROOTUSRLIBZONES64)/%: $(ROOTUSRLIBZONES64) %
+	$(INS.file)
+$(ROOTUSRLIBZONES32):
+	$(INS.dir)
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+clean:
+	$(RM) $(OBJS)
+
+lint:
+	$(LINT.c) ../*.c $(LDLIBS)
+
+include ../../Makefile.targ
diff --git a/usr/src/cmd/zoneadmd/amd64/Makefile b/usr/src/cmd/zoneadmd/amd64/Makefile
new file mode 100644
index 0000000000..75ac51db32
--- /dev/null
+++ b/usr/src/cmd/zoneadmd/amd64/Makefile
@@ -0,0 +1,31 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
+#
+
+.KEEP_STATE:
+
+include ../Makefile.com
+include ../../Makefile.cmd.64
+
+install: all $(ROOTUSRLIBZONES64) $(ROOTUSRLIBZONESPROG64)
diff --git a/usr/src/cmd/zoneadmd/i386/Makefile b/usr/src/cmd/zoneadmd/i386/Makefile
new file mode 100644
index 0000000000..a8764e0638
--- /dev/null
+++ b/usr/src/cmd/zoneadmd/i386/Makefile
@@ -0,0 +1,30 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2011, Joyent, Inc. All rights reserved.
+#
+
+.KEEP_STATE:
+
+include ../Makefile.com
+
+install: all $(ROOTUSRLIBZONES32) $(ROOTUSRLIBZONESPROG32)
diff --git a/usr/src/cmd/zoneadmd/log.c b/usr/src/cmd/zoneadmd/log.c
new file mode 100644
index 0000000000..ca531b7177
--- /dev/null
+++ b/usr/src/cmd/zoneadmd/log.c
@@ -0,0 +1,956 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * zoneadmd logging
+ *
+ * zoneadmd logs to log files under <zonepath>/logs.  Each log entry is a json
+ * structure of the form:
+ *
+ *   {
+ *     "log": "some message\n",
+ *     "stream": "stderr",
+ *     "time": "2018-03-28T13:25:02.670423000Z"
+ *   }
+ *
+ * Unlike the example above, the entries in the log file are not pretty-printed.
+ * Messages are processed so that they have the proper json escapes for
+ * problematic characters.  Excessively long messages may be truncated.
+ *
+ * To use these interfaces:
+ *
+ *	int logid;
+ *
+ *	logstream_init(zlogp);
+ *
+ *	logid = logstream_open("stdio.log", "stdout", flags);
+ *	...
+ *	logstream_write(logid, buf, len);
+ *	...
+ *	logstream_close(logid);
+ *
+ * logstream_init() needs to be called only once.
+ *
+ * logstream_open() opens a log file (if not already open) and associates the
+ * specified stream with it.
+ *
+ * The following flag is supported:
+ *
+ *   LS_LINE_BUFFERED	Buffer writes until a newline is encountered or the
+ *			buffer fills.  This should only be used with streams
+ *			that are written to by a single thread.  The timestamp
+ *			on log messages are the time that the log entry was
+ *			written to the log file.  This means the timestamp is
+ *			the time when the console user hits enter, not the time
+ *			that the prompt was printed.
+ *
+ * Line buffering is particularly useful for bhyve console logging because
+ * bhyve's UART emulation causes read() calls in zcons.c to return far fewer
+ * than 10 characters at a time.  Without line buffering, a small number of
+ * logged characters are accompanied by about 64 characters of timestamp and
+ * other overhead.  Line buffering saves quite a lot of space and makes the log
+ * much easier to read.
+ *
+ *
+ * Log rotation
+ *
+ * Two attributes, zlog-max-size and zlog-keep-rotated are used for automatic
+ * log rotation.  zlog-max-size is the approximate maximum size of a log before
+ * it is automatically rotated.  Rotated logs are renamed as
+ * <log>.<iso-8601-stamp>.  If zlog-keep-rotated is specified and is an integer
+ * greater than zero, only that number of rotated logs will be retained.
+ *
+ * If zlog-max-size is not specified, log rotation will not happen
+ * automatically.  An external log rotation program may rename the log file(s),
+ * then send SIGHUP to zoneadmd.
+ *
+ * Log rotation can be forced with SIGUSR1.  In this case, the log will be
+ * rotated as though it hit the maximum size and will be subject to retention
+ * rules described above.
+ *
+ *
+ * Locking strategy
+ *
+ * Callers need not worry about locking.  In the interest of simplicity, a
+ * single global lock is used to protect the state of the log files and the
+ * associated streams.  Locking is necessary because reboots and log rotations
+ * can cause various state changes.  Without locking, races could cause log
+ * entries to be directed to the wrong file descriptors.
+ *
+ * The simplistic global lock complicates error reporting within logging
+ * routines.  zerror() must not be called while holding logging_lock.  Rather,
+ * logstream_err() should be used to log via syslog.
+ */
+
+#include <assert.h>
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <glob.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <strings.h>
+#include <synch.h>
+#include <syslog.h>
+#include <time.h>
+#include <thread.h>
+#include <unistd.h>
+
+#include <sys/debug.h>
+#include <sys/stat.h>
+#include <sys/sysmacros.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/varargs.h>
+
+#include "zoneadmd.h"
+
+/*
+ * Currently we only expect stdout, stderr, zoneadmd, and console.  Increase
+ * MAX_ZLOG_STREAMS if more streams are added.  If the count increases
+ * significantly, logfile_t and logstream_t elements should be dynamically
+ * allocated and the algorithms associated with opening and closing them should
+ * become more efficient.
+ */
+#define	MAX_LOG_STREAMS 4
+
+#define	ZLOG_MAXSZ	"zlog-max-size"		/* zonecfg attr */
+#define	ZLOG_MAXSZ_MIN	(1024 * 1024)		/* min size for autorotate */
+#define	ZLOG_KEEP	"zlog-keep-rotated"	/* zonecfg attr */
+#define	ZLOG_KEEP_MAX	1000			/* number of log files */
+
+typedef struct logfile {
+	char	lf_path[MAXPATHLEN];	/* log file name (absolute path) */
+	char	lf_name[MAXNAMELEN];	/* tail of log file name */
+	int	lf_fd;			/* file descriptor */
+	size_t	lf_size;		/* Current size */
+	boolean_t lf_write_err;		/* Avoid spamming console via logsys */
+	boolean_t lf_closing;		/* Avoid rotation recursion */
+} logfile_t;
+
+typedef struct logstream {
+	char		ls_stream[MAXNAMELEN];	/* stdout, stderr, etc. */
+	char		ls_buf[BUFSIZ * 2];	/* Not-yet written data, json */
+	int		ls_buflen;
+	logstream_flags_t ls_flags;
+	logfile_t	*ls_logfile;		/* N streams per log file */
+} logstream_t;
+
+typedef struct jsonpair {
+	const char *jp_key;
+	const char *jp_val;
+} jsonpair_t;
+
+boolean_t logging_poisoned = B_FALSE;
+
+/*
+ * MAX_LOG_STREAMS is a small number so we allocate in the simplest way.
+ */
+static logstream_t streams[MAX_LOG_STREAMS];
+static logfile_t logfiles[MAX_LOG_STREAMS];
+
+static boolean_t logging_initialized = B_FALSE;
+static uint64_t logging_rot_size;		/* See ZLOG_MAXSZ */
+static uint64_t logging_rot_keep;		/* See ZLOG_KEEP */
+static int logging_pending_sig = 0;		/* Signal recvd while logging */
+static mutex_t logging_lock;			/* The global logging lock */
+
+static void logstream_flush_all(logfile_t *);
+static void logstream_sighandler(int);
+static void rotate_log(logfile_t *);
+static size_t make_json(jsonpair_t *, int, char *, size_t);
+static void logfile_write(logfile_t *, const char *, size_t);
+
+/*
+ * If errors are encountered while logging_lock is held, we can't use zerror().
+ */
+static void
+logstream_err(boolean_t use_strerror, const char *fmt, ...)
+{
+	va_list alist;
+	char buf[MAXPATHLEN * 2];
+	char *bp;
+	int saved_errno = errno;
+
+	(void) snprintf(buf, sizeof (buf), "[zone %s] ", zone_name);
+
+	bp = &buf[strlen(buf)];
+
+	va_start(alist, fmt);
+	(void) vsnprintf(bp, sizeof (buf) - (bp - buf), fmt, alist);
+	va_end(alist);
+
+	if (use_strerror) {
+		bp = &buf[strlen(buf)];
+		(void) snprintf(bp, sizeof (buf) - (bp - buf), ": %s",
+		    strerror(saved_errno));
+	}
+	syslog(LOG_ERR, "%s", buf);
+
+	errno = saved_errno;
+}
+
+static void
+logstream_lock(void)
+{
+	int ret;
+
+	assert(logging_initialized && !logging_poisoned);
+
+	ret = mutex_lock(&logging_lock);
+	assert(ret == 0);
+}
+
+static void
+logstream_unlock(void)
+{
+	int ret;
+	int err = errno;
+	int sig = logging_pending_sig;
+
+	logging_pending_sig = 0;
+	ret = mutex_unlock(&logging_lock);
+	assert(ret == 0);
+
+	/*
+	 * If a signal arrived while this thread was holding the lock, call the
+	 * handler.
+	 */
+	if (sig != 0) {
+		logstream_sighandler(sig);
+	}
+
+	errno = err;
+}
+
+static void
+logfile_write_event(logfile_t *lfp, const char *stream, const char *event)
+{
+	char buf[BUFSIZ];
+	size_t len;
+	jsonpair_t pairs[] = {
+		{ "event", event },
+		{ "stream", stream }
+	};
+
+	len = make_json(pairs, ARRAY_SIZE(pairs), buf, sizeof (buf));
+	if (len >= sizeof (buf)) {
+		logstream_err(B_FALSE, "%s: buffer too small. Need %llu bytes, "
+		    "have %llu bytes", __func__, len + 1, sizeof (buf));
+		return;
+	}
+
+	logfile_write(lfp, buf, len);
+}
+
+static void
+close_log(logfile_t *lfp, const char *why)
+{
+	int err;
+
+	assert(MUTEX_HELD(&logging_lock));
+
+	/*
+	 * Something may have gone wrong during log rotation, leading to a
+	 * zombie log.
+	 */
+	if (lfp->lf_fd == -1) {
+		return;
+	}
+
+	lfp->lf_closing = B_TRUE;
+
+	logstream_flush_all(lfp);
+
+	logfile_write_event(lfp, "logfile", why);
+
+	err = close(lfp->lf_fd);
+	assert(err == 0);
+
+	lfp->lf_size = 0;
+	lfp->lf_fd = -1;
+}
+
+static void
+open_log(logfile_t *lfp, const char *why)
+{
+	struct stat64 sb;
+	int err;
+
+	assert(MUTEX_HELD(&logging_lock));
+	assert(lfp->lf_fd == -1);
+
+	lfp->lf_fd = open(lfp->lf_path,
+	    O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0600);
+	if (lfp->lf_fd == -1) {
+		logstream_err(B_TRUE, "Cannot open log file %s",
+		    lfp->lf_path);
+		lfp->lf_write_err = B_TRUE;
+		return;
+	}
+
+	err = fstat64(lfp->lf_fd, &sb);
+	assert(err == 0);
+	lfp->lf_size = sb.st_size;
+	lfp->lf_write_err = B_FALSE;
+	lfp->lf_closing = B_FALSE;
+
+	logfile_write_event(lfp, "logfile", why);
+}
+
+static void
+logstream_sighandler(int sig)
+{
+	int i;
+
+	/*
+	 * Protect against recursive mutex enters when a signal comes during
+	 * logging.  This will cause this function to be called again just after
+	 * this thread drops the lock.
+	 */
+	if (MUTEX_HELD(&logging_lock)) {
+		logging_pending_sig = sig;
+		return;
+	}
+
+	logstream_lock();
+	if (logging_poisoned) {
+		logstream_unlock();
+		return;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(logfiles); i++) {
+		/* Inactive logfile slot */
+		if (logfiles[i].lf_name[0] == '\0') {
+			continue;
+		}
+
+		switch (sig) {
+		case SIGHUP:
+			close_log(&logfiles[i], "close-rotate");
+			open_log(&logfiles[i], "open-rotate");
+			break;
+		case SIGUSR1:
+			rotate_log(&logfiles[i]);
+			break;
+		default:
+			logstream_err(B_FALSE, "unhandled signal %d", sig);
+		}
+	}
+
+	logstream_unlock();
+}
+
+static void
+get_attr_uint64(zlog_t *zlogp, zone_dochandle_t handle, const char *name,
+    uint64_t max, uint64_t *valp)
+{
+	struct zone_attrtab tab = { 0 };
+	char *p;
+	uint64_t val;
+
+	ASSERT(!MUTEX_HELD(&logging_lock));
+
+	(void) strlcpy(tab.zone_attr_name, name, sizeof (tab.zone_attr_name));
+	if (zonecfg_lookup_attr(handle, &tab) != Z_OK) {
+		return;
+	}
+
+	errno = 0;
+	val = strtol(tab.zone_attr_value, &p, 10);
+	if (errno != 0 && *p == '\0') {
+		zerror(zlogp, errno != 0, "Bad value '%s' for 'attr name=%s'",
+		    tab.zone_attr_value, tab.zone_attr_name);
+		return;
+	}
+	if (val > max) {
+		zerror(zlogp, B_FALSE, "Value of attr '%s' is too large. "
+		    "Reducing to %llu", name, max);
+		val = max;
+	}
+
+	*valp = val;
+}
+
+static void
+logstream_atfork_prepare(void)
+{
+	logstream_lock();
+}
+
+static void
+logstream_atfork_parent(void)
+{
+	logstream_unlock();
+}
+
+/*
+ * logstream_*() should never be called in a child process, so we make sure this
+ * code is never called there.
+ *
+ * zerror() in a child process is still safe: it knows to check for poisoning,
+ * and in such a case will redirect its output to stderr on the presumption it
+ * is a pipe to the parent.
+ */
+static void
+logstream_atfork_child(void)
+{
+	logging_poisoned = B_TRUE;
+	logging_pending_sig = 0;
+	logstream_unlock();
+}
+
+void
+logstream_init(zlog_t *zlogp)
+{
+	zone_dochandle_t handle;
+	int err;
+	int i;
+
+	assert(!logging_initialized);
+
+	err = mutex_init(&logging_lock, USYNC_THREAD | LOCK_ERRORCHECK, 0);
+	assert(err == 0);
+
+	for (i = 0; i < ARRAY_SIZE(logfiles); i++) {
+		logfiles[i].lf_fd = -1;
+	}
+
+	err = pthread_atfork(logstream_atfork_prepare,
+	    logstream_atfork_parent, logstream_atfork_child);
+	assert(err == 0);
+
+	logging_initialized = B_TRUE;
+
+	/* Now it is safe to use zlogp */
+
+	if ((handle = zonecfg_init_handle()) == NULL ||
+	    zonecfg_get_handle(zone_name, handle) != Z_OK) {
+		zerror(zlogp, B_FALSE, "failed to open zone configuration "
+		    "while initializing logging");
+	} else {
+		get_attr_uint64(zlogp, handle, ZLOG_MAXSZ, UINT64_MAX,
+		    &logging_rot_size);
+		if (logging_rot_size != 0 &&
+		    logging_rot_size < ZLOG_MAXSZ_MIN) {
+			zerror(zlogp, B_FALSE, "%s value %llu is too small. "
+			    "Setting to %d", ZLOG_MAXSZ, logging_rot_size,
+			    ZLOG_MAXSZ_MIN);
+			logging_rot_size = ZLOG_MAXSZ_MIN;
+		}
+		get_attr_uint64(zlogp, handle, ZLOG_KEEP, ZLOG_KEEP_MAX,
+		    &logging_rot_keep);
+	}
+
+	zonecfg_fini_handle(handle);
+
+	/*
+	 * This thread should receive SIGHUP so that it can close the log
+	 * file and reopen it during log rotation.  SIGUSR1 can be used to force
+	 * a log rotation.
+	 */
+	sigset(SIGHUP, logstream_sighandler);
+	sigset(SIGUSR1, logstream_sighandler);
+}
+
+/*
+ * Rotate a single log file.  The global lock must be held while this is called.
+ */
+static void
+rotate_log(logfile_t *lfp)
+{
+	time_t t;
+	struct tm gtm;
+	char path[MAXPATHLEN];
+	int64_t i;
+	size_t len;
+	glob_t glb = { 0 };
+	int err;
+
+	assert(MUTEX_HELD(&logging_lock));
+
+	if (lfp->lf_closing) {
+		return;
+	}
+
+	if ((t = time(NULL)) == (time_t)-1 || gmtime_r(&t, &gtm) == NULL) {
+		logstream_err(B_TRUE, "failed to format time");
+		return;
+	}
+
+	(void) snprintf(path, sizeof (path), "%s.%04d%02d%02dT%02d%02d%02dZ",
+	    lfp->lf_path, gtm.tm_year + 1900, gtm.tm_mon + 1, gtm.tm_mday,
+	    gtm.tm_hour, gtm.tm_min, gtm.tm_sec);
+
+	if (rename(lfp->lf_path, path) != 0) {
+		logstream_err(B_TRUE, "failed to rotate log file "
+		    "'%s' to '%s'", lfp->lf_path, path);
+	}
+
+	close_log(lfp, "close-rotate");
+	open_log(lfp, "open-rotate");
+
+	if (logging_rot_keep == 0) {
+		return;
+	}
+
+	/*
+	 * Remove old logs.
+	 */
+	len = snprintf(path, sizeof (path),
+	    /* <lf_path>.YYYYmmdd */
+	    "%s.[12][0-9][0-9][0-9][01][0-9][0-3][0-9]"
+	    /* THHMMSSZ */
+	    "T[012][0-9][0-5][0-9][0-6][0-9]Z", lfp->lf_path);
+	if (len >= sizeof (path)) {
+		logstream_err(B_FALSE, "log rotation glob too long");
+		return;
+	}
+
+	if ((err = glob(path, GLOB_LIMIT, NULL, &glb)) != 0) {
+		if (err != GLOB_NOMATCH) {
+			logstream_err(B_TRUE, "glob terminated with error %d",
+			    err);
+		}
+		globfree(&glb);
+		return;
+	}
+
+	if (glb.gl_pathc <= logging_rot_keep) {
+		globfree(&glb);
+		return;
+	}
+
+	for (i = glb.gl_pathc - logging_rot_keep - 1; i >= 0; i--) {
+		if (unlink(glb.gl_pathv[i]) != 0) {
+			logstream_err(B_TRUE, "log rotation could not remove "
+			    "%s", glb.gl_pathv[i]);
+		}
+	}
+	globfree(&glb);
+}
+
+/*
+ * Modify the input string with json escapes. Since the destination can thus
+ * be larger than the source, multiple calls may be required to fully convert
+ * sbuf to json.
+ *
+ *   sbuf, slen		Source buffer and the number of bytes in it to process
+ *   dbuf, dlen		Destination buffer and its size.  On return, the result
+ *			is always null terminated.
+ *   scntp		On return, *scntp stores number of scnt bytes consumed
+ *   dcntp		On return, *dcntp stores number of bytes stored in dcnt,
+ *			excluding trailing nul.
+ *   flushp		If non-NULL, line-buffered mode is enabled.  Processing
+ *			will stop at the first newline or when obuf is full and
+ *			*flushp will be set to B_TRUE.
+ *
+ * This function makes no attempt to handle wide characters properly because
+ * the messages that come in may be using any character encoding.  Since
+ * characters other than 7-bit ASCII are not directly readable in the log
+ * anyway, it is better to log the raw data and leave it to specialized log
+ * readers to interpret non-ASCII data.
+ */
+static void
+escape_json(const char *sbuf, int slen, char *dbuf, int dlen, int *scntp,
+    int *dcntp, boolean_t *flushp)
+{
+	int i;
+	char c;
+	const char *save_sbuf = sbuf;
+	const char *sbuf_end = sbuf + slen - 1;
+	char append_buf[7];			/* "\\u0000\0" */
+	const char *append;
+	int len;
+
+	if (flushp != NULL) {
+		*flushp = B_FALSE;
+	}
+
+	i = 0;
+	while (i < (dlen - 1) && sbuf <= sbuf_end) {
+		c = sbuf[0];
+
+		switch (c) {
+		case '\\':
+			append = "\\\\";
+			break;
+
+		case '"':
+			append = "\\\"";
+			break;
+
+		case '\b':
+			append = "\\b";
+			break;
+
+		case '\f':
+			append = "\\f";
+			break;
+
+		case '\n':
+			append = "\\n";
+			if (flushp != NULL) {
+				*flushp = B_TRUE;
+			}
+			break;
+
+		case '\r':
+			append = "\\r";
+			break;
+
+		case '\t':
+			append = "\\t";
+			break;
+
+		default:
+			if (c >= 0x20 && c < 0x7f) {
+				append_buf[0] = c;
+				append_buf[1] = '\0';
+			} else {
+				len = snprintf(append_buf, sizeof (append_buf),
+				    "\\u%04x", (int)(0xff & c));
+				assert(len < sizeof (append_buf));
+			}
+			append = append_buf;
+			break;
+		}
+
+		len = strlcpy(&dbuf[i], append, dlen - i);
+		if (len >= dlen - i) {
+			if (flushp != NULL) {
+				*flushp = B_TRUE;
+			}
+		} else {
+			sbuf++;
+			i += len;
+		}
+		if (flushp != NULL && *flushp) {
+			break;
+		}
+	}
+
+	dbuf[i] = '\0';
+
+	*dcntp = i;
+	*scntp = sbuf - save_sbuf;
+
+	assert(*dcntp < dlen);
+	assert(*scntp <= slen);
+
+	/* Buffer is too full to append "\\n". Force a flush. */
+	if (flushp != NULL && i >= dlen - 2) {
+		*flushp = B_TRUE;
+	}
+}
+
+/*
+ * Like write(2), but to a logfile_t and with retries on short writes.
+ */
+static void
+logfile_write(logfile_t *lfp, const char *buf, size_t buflen)
+{
+	ssize_t wlen;
+	size_t wanted = buflen;
+
+	while (buflen > 0) {
+		wlen = write(lfp->lf_fd, buf, buflen);
+		if (wlen == -1) {
+			if (lfp->lf_write_err) {
+				lfp->lf_write_err = B_TRUE;
+				logstream_err(B_TRUE, "log file fd %d '%s': "
+				    "failed to write %llu of %llu bytes",
+				    lfp->lf_fd, lfp->lf_path, buflen, wanted);
+			}
+			return;
+		}
+		buf += wlen;
+		buflen -= wlen;
+		lfp->lf_size += wlen;
+
+		lfp->lf_write_err = B_FALSE;
+	}
+
+	if (logging_rot_size != 0 && lfp->lf_size > logging_rot_size) {
+		rotate_log(lfp);
+	}
+}
+
+/*
+ * Convert the json pairs into a json object.  A "time" element is added to
+ * every object.  Returns the number of bytes that would have been written to
+ * buf if bufsz had buf been sufficiently large (excluding the terminating null
+ * byte).  Like snprintf().
+ */
+static size_t
+make_json(jsonpair_t *pairs, int npairs, char *buf, size_t bufsz)
+{
+	struct tm gtm;
+	struct timeval tv;
+	char ts[32];
+	size_t len = 0;
+	int i;
+	const char *key, *val, *start, *end;
+
+	assert(npairs > 0);
+
+	if (gettimeofday(&tv, NULL) != 0 ||
+	    gmtime_r(&tv.tv_sec, &gtm) == NULL) {
+		logstream_err(B_TRUE, "failed to get time of day");
+		abort();
+	}
+
+	if (snprintf(ts, sizeof (ts), "%04d-%02d-%02dT%02d:%02d:%02d.%09ldZ",
+	    gtm.tm_year + 1900, gtm.tm_mon + 1, gtm.tm_mday,
+	    gtm.tm_hour, gtm.tm_min, gtm.tm_sec, tv.tv_usec * 1000) >=
+	    sizeof (ts)) {
+		logstream_err(B_FALSE, "timestamp buffer too small");
+		abort();
+	}
+
+	start = "{";
+	end = "";
+	for (i = 0; i <= npairs; i++) {
+		if (i < npairs) {
+			key = pairs[i].jp_key;
+			val = pairs[i].jp_val;
+		} else {
+			key = "time";
+			val = ts;
+			end = "}\n";
+		}
+
+		len += snprintf(bufsz > len ? buf + len : NULL,
+		    bufsz > len ? bufsz - len : 0, "%s\"%s\":\"%s\"%s",
+		    start, key, val, end);
+
+		start = ",";
+	}
+
+	return (len);
+}
+
+static void
+logstream_write_json(logstream_t *lsp)
+{
+	char obuf[sizeof (lsp->ls_buf) + sizeof (lsp->ls_stream) + 64];
+	size_t len;
+	jsonpair_t pairs[] = {
+		{ "log", lsp->ls_buf },
+		{ "stream", lsp->ls_stream },
+	};
+
+	if (lsp->ls_buflen == 0) {
+		return;
+	}
+
+	len = make_json(pairs, ARRAY_SIZE(pairs), obuf, sizeof (obuf));
+	lsp->ls_buflen = 0;
+	if (len >= sizeof (obuf)) {
+		logstream_err(B_FALSE, "%s: buffer too small. Need %llu bytes, "
+		    "have %llu bytes", __func__, len + 1, sizeof (obuf));
+		return;
+	}
+
+	logfile_write(lsp->ls_logfile, obuf, len);
+}
+
+/*
+ * We output to the log file as json.
+ * ex. for string 'msg\n' on the zone's stdout:
+ *    {"log":"msg\n","stream":"stdout","time":"2014-10-24T20:12:11.101973117Z"}
+ *
+ * We use ns in the last field of the timestamp for compatibility.
+ *
+ * We keep track of the size of the log file and rotate it when we exceed
+ * the log size limit (if one is set).
+ */
+void
+logstream_write(int ls, char *buf, int len)
+{
+	logstream_t *lsp;
+	int scnt, dcnt;
+	boolean_t newline;
+	boolean_t buffered;
+
+	if (ls == -1 || len == 0) {
+		return;
+	}
+	assert(ls >= 0 && ls < ARRAY_SIZE(streams));
+
+	logstream_lock();
+
+	lsp = &streams[ls];
+	if (lsp->ls_stream[0] == '\0' || lsp->ls_logfile == NULL) {
+		logstream_unlock();
+		return;
+	}
+
+	buffered = !!(lsp->ls_flags & LS_LINE_BUFFERED);
+
+	do {
+		escape_json(buf, len, lsp->ls_buf + lsp->ls_buflen,
+		    sizeof (lsp->ls_buf) - lsp->ls_buflen,
+		    &scnt, &dcnt, buffered ? &newline : NULL);
+
+		lsp->ls_buflen += dcnt;
+		buf += scnt;
+		len -= scnt;
+
+		if (!buffered || newline) {
+			logstream_write_json(lsp);
+		}
+	} while (len > 0 && (!buffered || newline));
+
+	logstream_unlock();
+}
+
+static void
+logstream_flush(int ls)
+{
+	logstream_t *lsp;
+
+	assert(MUTEX_HELD(&logging_lock));
+
+	lsp = &streams[ls];
+	if (lsp->ls_stream[0] == '\0' || lsp->ls_logfile == NULL) {
+		return;
+	}
+	logstream_write_json(lsp);
+}
+
+static void
+logstream_flush_all(logfile_t *lfp)
+{
+	int i;
+
+	assert(MUTEX_HELD(&logging_lock));
+
+	for (i = 0; i < ARRAY_SIZE(streams); i++) {
+		if (streams[i].ls_logfile == lfp) {
+			logstream_flush(i);
+		}
+	}
+}
+
+int
+logstream_open(const char *logname, const char *stream, logstream_flags_t flags)
+{
+	int ls = -1;
+	int i;
+	logstream_t *lsp;
+	logfile_t *lfp = NULL;
+
+	assert(strlen(logname) < sizeof (lfp->lf_name));
+	assert(strlen(stream) < sizeof (lsp->ls_stream));
+
+	logstream_lock();
+
+	/*
+	 * Find an empty logstream_t and verify that the stream is not already
+	 * open.
+	 */
+	for (i = 0; i < ARRAY_SIZE(streams); i++) {
+		if (ls == -1 && streams[i].ls_stream[0] == '\0') {
+			assert(streams[i].ls_logfile == NULL);
+			ls = i;
+			continue;
+		}
+		if (strcmp(stream, streams[i].ls_stream) == 0) {
+			logstream_unlock();
+			logstream_err(B_FALSE, "log stream %s already open",
+			    stream);
+			return (-1);
+		}
+	}
+	assert(ls != -1);
+
+	/* Find an existing or available logfile_t */
+	for (i = 0; i < ARRAY_SIZE(logfiles); i++) {
+		if (lfp == NULL && logfiles[i].lf_name[0] == '\0') {
+			lfp = &logfiles[i];
+		}
+		if (strcmp(logname, logfiles[i].lf_name) == 0) {
+			lfp = &logfiles[i];
+			break;
+		}
+	}
+	if (lfp->lf_name[0] == '\0') {
+		(void) strlcpy(lfp->lf_name, logname, sizeof (lfp->lf_name));
+		(void) snprintf(lfp->lf_path, sizeof (lfp->lf_path), "%s/logs",
+		    zonepath);
+		(void) mkdir(lfp->lf_path, 0700);
+
+		(void) snprintf(lfp->lf_path, sizeof (lfp->lf_path),
+		    "%s/logs/%s", zonepath, logname);
+
+		open_log(lfp, "open");
+		if (lfp->lf_fd == -1) {
+			logstream_unlock();
+			return (-1);
+		}
+	}
+
+	lsp = &streams[ls];
+	(void) strlcpy(lsp->ls_stream, stream, sizeof (lsp->ls_stream));
+
+	lsp->ls_flags = flags;
+	lsp->ls_logfile = lfp;
+
+	logstream_unlock();
+
+	return (ls);
+}
+
+void
+logstream_close(int ls)
+{
+	logstream_t *lsp;
+	logfile_t *lfp;
+	int i;
+
+	if (ls == -1) {
+		return;
+	}
+	assert(ls >= 0 && ls < ARRAY_SIZE(streams));
+
+	logstream_lock();
+	logstream_flush(ls);
+
+	lsp = &streams[ls];
+	lfp = lsp->ls_logfile;
+
+	assert(lsp->ls_stream[0] != '\0');
+	assert(lfp != NULL);
+
+	(void) memset(lsp, 0, sizeof (*lsp));
+
+	for (i = 0; i < ARRAY_SIZE(streams); i++) {
+		if (streams[i].ls_logfile == lfp) {
+			logstream_unlock();
+			return;
+		}
+	}
+
+	/* No more streams using this log file so return to initial state */
+
+	close_log(lfp, "close");
+
+	(void) memset(lfp, 0, sizeof (*lfp));
+	lfp->lf_fd = -1;
+
+	logstream_unlock();
+}
diff --git a/usr/src/cmd/zoneadmd/vplat.c b/usr/src/cmd/zoneadmd/vplat.c
index d76fbbf9f7..f466836b96 100644
--- a/usr/src/cmd/zoneadmd/vplat.c
+++ b/usr/src/cmd/zoneadmd/vplat.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2013, Joyent Inc. All rights reserved.
+ * Copyright 2018, Joyent Inc.
  * Copyright (c) 2015, 2016 by Delphix. All rights reserved.
  */
 
@@ -78,10 +78,12 @@
 #include <sys/conf.h>
 #include <sys/systeminfo.h>
 #include <sys/secflags.h>
+#include <sys/vnic.h>
 
 #include <libdlpi.h>
 #include <libdllink.h>
 #include <libdlvlan.h>
+#include <libdlvnic.h>
 
 #include <inet/tcp.h>
 #include <arpa/inet.h>
@@ -137,7 +139,8 @@
 #define	DFSTYPES	"/etc/dfs/fstypes"
 #define	MAXTNZLEN	2048
 
-#define	ALT_MOUNT(mount_cmd) 	((mount_cmd) != Z_MNT_BOOT)
+/* Number of times to retry unmounting if it fails */
+#define	UMOUNT_RETRIES	30
 
 /* a reasonable estimate for the number of lwps per process */
 #define	LWPS_PER_PROCESS	10
@@ -162,11 +165,25 @@ static priv_set_t *zprivs = NULL;
 
 static const char *DFLT_FS_ALLOWED = "hsfs,smbfs,nfs,nfs3,nfs4,nfsdyn";
 
+typedef struct zone_proj_rctl_map {
+	char *zpr_zone_rctl;
+	char *zpr_project_rctl;
+} zone_proj_rctl_map_t;
+
+static zone_proj_rctl_map_t zone_proj_rctl_map[] = {
+	{"zone.max-msg-ids",	"project.max-msg-ids"},
+	{"zone.max-sem-ids",	"project.max-sem-ids"},
+	{"zone.max-shm-ids",	"project.max-shm-ids"},
+	{"zone.max-shm-memory",	"project.max-shm-memory"},
+	{NULL,			NULL}
+};
+
 /* from libsocket, not in any header file */
 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
 
 /* from zoneadmd */
 extern char query_hook[];
+extern char post_statechg_hook[];
 
 /*
  * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
@@ -203,7 +220,7 @@ autofs_cleanup(zoneid_t zoneid)
 	/*
 	 * Ask autofs to unmount all trigger nodes in the given zone.
 	 */
-	return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
+	return (_autofssys(AUTOFS_UNMOUNTALL, (void *)((uintptr_t)zoneid)));
 }
 
 static void
@@ -594,6 +611,24 @@ root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
 }
 
 /*
+ * Perform brand-specific cleanup if we are unable to unmount a FS.
+ */
+static void
+brand_umount_cleanup(zlog_t *zlogp, char *path)
+{
+	char cmdbuf[2 * MAXPATHLEN];
+
+	if (post_statechg_hook[0] == '\0')
+		return;
+
+	if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", post_statechg_hook,
+	    ZONE_STATE_DOWN, Z_UNMOUNT, path) > sizeof (cmdbuf))
+		return;
+
+	(void) do_subproc(zlogp, cmdbuf, NULL, B_FALSE);
+}
+
+/*
  * The general strategy for unmounting filesystems is as follows:
  *
  * - Remote filesystems may be dead, and attempting to contact them as
@@ -626,6 +661,7 @@ static int
 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
 {
 	int error = 0;
+	int fail = 0;
 	FILE *mnttab;
 	struct mnttab *mnts;
 	uint_t nmnt;
@@ -713,18 +749,39 @@ unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
 				if (umount2(path, MS_FORCE) == 0) {
 					unmounted = B_TRUE;
 					stuck = B_FALSE;
+					fail = 0;
 				} else {
 					/*
-					 * The first failure indicates a
-					 * mount we won't be able to get
-					 * rid of automatically, so we
-					 * bail.
+					 * We may hit a failure here if there
+					 * is an app in the GZ with an open
+					 * pipe into the zone (commonly into
+					 * the zone's /var/run).  This type
+					 * of app will notice the closed
+					 * connection and cleanup, but it may
+					 * take a while and we have no easy
+					 * way to notice that.  To deal with
+					 * this case, we will wait and retry
+					 * a few times before we give up.
 					 */
-					error++;
-					zerror(zlogp, B_FALSE,
-					    "unable to unmount '%s'", path);
-					free_mnttable(mnts, nmnt);
-					goto out;
+					fail++;
+					if (fail < (UMOUNT_RETRIES - 1)) {
+						zerror(zlogp, B_FALSE,
+						    "unable to unmount '%s', "
+						    "retrying in 2 seconds",
+						    path);
+						(void) sleep(2);
+					} else if (fail > UMOUNT_RETRIES) {
+						error++;
+						zerror(zlogp, B_FALSE,
+						    "unmount of '%s' failed",
+						    path);
+						free_mnttable(mnts, nmnt);
+						goto out;
+					} else {
+						/* Try the hook 2 times */
+						brand_umount_cleanup(zlogp,
+						    path);
+					}
 				}
 			}
 			/*
@@ -1062,23 +1119,10 @@ mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
 int
 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
 {
-	zone_dochandle_t handle;
-
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (-1);
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (-1);
-	}
-	if (zonecfg_get_iptype(handle, iptypep) != Z_OK) {
+	if (zonecfg_get_iptype(snap_hndl, iptypep) != Z_OK) {
 		zerror(zlogp, B_FALSE, "invalid ip-type configuration");
-		zonecfg_fini_handle(handle);
 		return (-1);
 	}
-	zonecfg_fini_handle(handle);
 	return (0);
 }
 
@@ -1091,14 +1135,13 @@ static int
 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
 {
 	char			brand[MAXNAMELEN];
-	zone_dochandle_t	handle = NULL;
 	brand_handle_t		bh = NULL;
 	struct zone_devtab	ztab;
 	di_prof_t		prof = NULL;
 	int			err;
 	int			retval = -1;
 	zone_iptype_t		iptype;
-	const char 		*curr_iptype;
+	const char 		*curr_iptype = NULL;
 
 	if (di_prof_init(devpath, &prof)) {
 		zerror(zlogp, B_TRUE, "failed to initialize profile");
@@ -1133,6 +1176,8 @@ mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
 		curr_iptype = "exclusive";
 		break;
 	}
+	if (curr_iptype == NULL)
+		abort();
 
 	if (brand_platform_iter_devices(bh, zone_name,
 	    mount_one_dev_device_cb, prof, curr_iptype) != 0) {
@@ -1147,28 +1192,25 @@ mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
 	}
 
 	/* Add user-specified devices and directories */
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_FALSE, "can't initialize zone handle");
-		goto cleanup;
-	}
-	if (err = zonecfg_get_handle(zone_name, handle)) {
-		zerror(zlogp, B_FALSE, "can't get handle for zone "
-		    "%s: %s", zone_name, zonecfg_strerror(err));
-		goto cleanup;
-	}
-	if (err = zonecfg_setdevent(handle)) {
+	if ((err = zonecfg_setdevent(snap_hndl)) != 0) {
 		zerror(zlogp, B_FALSE, "%s: %s", zone_name,
 		    zonecfg_strerror(err));
 		goto cleanup;
 	}
-	while (zonecfg_getdevent(handle, &ztab) == Z_OK) {
-		if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
+	while (zonecfg_getdevent(snap_hndl, &ztab) == Z_OK) {
+		char path[MAXPATHLEN];
+
+		if ((err = resolve_device_match(zlogp, &ztab,
+		    path, sizeof (path))) != Z_OK)
+			goto cleanup;
+
+		if (di_prof_add_dev(prof, path)) {
 			zerror(zlogp, B_TRUE, "failed to add "
-			    "user-specified device");
+			    "user-specified device '%s'", path);
 			goto cleanup;
 		}
 	}
-	(void) zonecfg_enddevent(handle);
+	(void) zonecfg_enddevent(snap_hndl);
 
 	/* Send profile to kernel */
 	if (di_prof_commit(prof)) {
@@ -1181,8 +1223,6 @@ mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
 cleanup:
 	if (bh != NULL)
 		brand_close(bh);
-	if (handle != NULL)
-		zonecfg_fini_handle(handle);
 	if (prof)
 		di_prof_fini(prof);
 	return (retval);
@@ -1673,12 +1713,10 @@ static int
 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
 {
 	char rootpath[MAXPATHLEN];
-	char zonepath[MAXPATHLEN];
 	char brand[MAXNAMELEN];
 	char luroot[MAXPATHLEN];
 	int i, num_fs = 0;
 	struct zone_fstab *fs_ptr = NULL;
-	zone_dochandle_t handle = NULL;
 	zone_state_t zstate;
 	brand_handle_t bh;
 	plat_gmount_cb_data_t cb;
@@ -1692,22 +1730,12 @@ mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
 		goto bad;
 	}
 
-	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
-		zerror(zlogp, B_TRUE, "unable to determine zone path");
-		goto bad;
-	}
-
 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
 		zerror(zlogp, B_TRUE, "unable to determine zone root");
 		goto bad;
 	}
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		goto bad;
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
-	    zonecfg_setfsent(handle) != Z_OK) {
+	if (zonecfg_setfsent(snap_hndl) != Z_OK) {
 		zerror(zlogp, B_FALSE, "invalid configuration");
 		goto bad;
 	}
@@ -1725,7 +1753,6 @@ mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
 	/* Get a handle to the brand info for this zone */
 	if ((bh = brand_open(brand)) == NULL) {
 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
-		zonecfg_fini_handle(handle);
 		return (-1);
 	}
 
@@ -1740,7 +1767,6 @@ mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
 	    plat_gmount_cb, &cb) != 0) {
 		zerror(zlogp, B_FALSE, "unable to mount filesystems");
 		brand_close(bh);
-		zonecfg_fini_handle(handle);
 		return (-1);
 	}
 	brand_close(bh);
@@ -1751,13 +1777,10 @@ mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
 	 * higher level directories (e.g., /usr) get mounted before
 	 * any beneath them (e.g., /usr/local).
 	 */
-	if (mount_filesystems_fsent(handle, zlogp, &fs_ptr, &num_fs,
+	if (mount_filesystems_fsent(snap_hndl, zlogp, &fs_ptr, &num_fs,
 	    mount_cmd) != 0)
 		goto bad;
 
-	zonecfg_fini_handle(handle);
-	handle = NULL;
-
 	/*
 	 * Normally when we mount a zone all the zone filesystems
 	 * get mounted relative to rootpath, which is usually
@@ -1797,23 +1820,40 @@ mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
 	qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
 
 	for (i = 0; i < num_fs; i++) {
-		if (ALT_MOUNT(mount_cmd) &&
-		    strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
-			size_t slen = strlen(rootpath) - 2;
+		if (ALT_MOUNT(mount_cmd)) {
+			if (strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
+				size_t slen = strlen(rootpath) - 2;
 
-			/*
-			 * By default we'll try to mount /dev as /a/dev
-			 * but /dev is special and always goes at the top
-			 * so strip the trailing '/a' from the rootpath.
-			 */
-			assert(strcmp(&rootpath[slen], "/a") == 0);
-			rootpath[slen] = '\0';
-			if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd)
-			    != 0)
-				goto bad;
-			rootpath[slen] = '/';
-			continue;
+				/*
+				 * By default we'll try to mount /dev
+				 * as /a/dev but /dev is special and
+				 * always goes at the top so strip the
+				 * trailing '/a' from the rootpath.
+				 */
+				assert(strcmp(&rootpath[slen], "/a") == 0);
+				rootpath[slen] = '\0';
+				if (mount_one(zlogp, &fs_ptr[i], rootpath,
+				    mount_cmd) != 0)
+					goto bad;
+				rootpath[slen] = '/';
+				continue;
+			} else if (strcmp(brand_name, default_brand) != 0) {
+				/*
+				 * If mounting non-native brand, skip
+				 * mounting global mounts and
+				 * filesystem entries since they are
+				 * only needed for native pkg upgrade
+				 * tools.
+				 *
+				 * The only exception right now is
+				 * /dev (handled above), which is
+				 * needed in the luroot in order to
+				 * zlogin -S into the zone.
+				 */
+				continue;
+			}
 		}
+
 		if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
 			goto bad;
 	}
@@ -1836,8 +1876,6 @@ mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
 	return (0);
 
 bad:
-	if (handle != NULL)
-		zonecfg_fini_handle(handle);
 	free_fs_data(fs_ptr, num_fs);
 	return (-1);
 }
@@ -2193,13 +2231,7 @@ configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
 	if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
 		/*
 		 * Here, we know that the interface can't be brought up.
-		 * A similar warning message was already printed out to
-		 * the console by zoneadm(1M) so instead we log the
-		 * message to syslog and continue.
 		 */
-		zerror(&logsys, B_TRUE, "WARNING: skipping network interface "
-		    "'%s' which may not be present/plumbed in the "
-		    "global zone.", lifr.lifr_name);
 		(void) close(s);
 		return (Z_OK);
 	}
@@ -2412,7 +2444,6 @@ bad:
 static int
 configure_shared_network_interfaces(zlog_t *zlogp)
 {
-	zone_dochandle_t handle;
 	struct zone_nwiftab nwiftab, loopback_iftab;
 	zoneid_t zoneid;
 
@@ -2421,29 +2452,19 @@ configure_shared_network_interfaces(zlog_t *zlogp)
 		return (-1);
 	}
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (-1);
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (-1);
-	}
-	if (zonecfg_setnwifent(handle) == Z_OK) {
+	if (zonecfg_setnwifent(snap_hndl) == Z_OK) {
 		for (;;) {
-			if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
+			if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
 				break;
+			nwifent_free_attrs(&nwiftab);
 			if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
 			    Z_OK) {
-				(void) zonecfg_endnwifent(handle);
-				zonecfg_fini_handle(handle);
+				(void) zonecfg_endnwifent(snap_hndl);
 				return (-1);
 			}
 		}
-		(void) zonecfg_endnwifent(handle);
+		(void) zonecfg_endnwifent(snap_hndl);
 	}
-	zonecfg_fini_handle(handle);
 	if (is_system_labeled()) {
 		/*
 		 * Labeled zones share the loopback interface
@@ -2897,7 +2918,6 @@ free_ip_interface(zone_addr_list_t *zalist)
 static int
 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
 {
-	zone_dochandle_t handle;
 	struct zone_nwiftab nwiftab;
 	char rootpath[MAXPATHLEN];
 	char path[MAXPATHLEN];
@@ -2906,30 +2926,18 @@ configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
 	boolean_t added = B_FALSE;
 	zone_addr_list_t *zalist = NULL, *new;
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (-1);
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (-1);
-	}
-
-	if (zonecfg_setnwifent(handle) != Z_OK) {
-		zonecfg_fini_handle(handle);
+	if (zonecfg_setnwifent(snap_hndl) != Z_OK)
 		return (0);
-	}
 
 	for (;;) {
-		if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
+		if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
 			break;
 
+		nwifent_free_attrs(&nwiftab);
 		if (prof == NULL) {
 			if (zone_get_devroot(zone_name, rootpath,
 			    sizeof (rootpath)) != Z_OK) {
-				(void) zonecfg_endnwifent(handle);
-				zonecfg_fini_handle(handle);
+				(void) zonecfg_endnwifent(snap_hndl);
 				zerror(zlogp, B_TRUE,
 				    "unable to determine dev root");
 				return (-1);
@@ -2937,8 +2945,7 @@ configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
 			(void) snprintf(path, sizeof (path), "%s%s", rootpath,
 			    "/dev");
 			if (di_prof_init(path, &prof) != 0) {
-				(void) zonecfg_endnwifent(handle);
-				zonecfg_fini_handle(handle);
+				(void) zonecfg_endnwifent(snap_hndl);
 				zerror(zlogp, B_TRUE,
 				    "failed to initialize profile");
 				return (-1);
@@ -2962,17 +2969,17 @@ configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
 		    nwiftab.zone_nwif_physical) == 0) {
 			added = B_TRUE;
 		} else {
-			(void) zonecfg_endnwifent(handle);
-			zonecfg_fini_handle(handle);
-			zerror(zlogp, B_TRUE, "failed to add network device");
-			return (-1);
+			/*
+			 * Failed to add network device, but the brand hook
+			 * might be doing this for us, so keep silent.
+			 */
+			continue;
 		}
 		/* set up the new IP interface, and add them all later */
 		new = malloc(sizeof (*new));
 		if (new == NULL) {
 			zerror(zlogp, B_TRUE, "no memory for %s",
 			    nwiftab.zone_nwif_physical);
-			zonecfg_fini_handle(handle);
 			free_ip_interface(zalist);
 		}
 		bzero(new, sizeof (*new));
@@ -2982,16 +2989,14 @@ configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
 	}
 	if (zalist != NULL) {
 		if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
-			(void) zonecfg_endnwifent(handle);
-			zonecfg_fini_handle(handle);
+			(void) zonecfg_endnwifent(snap_hndl);
 			zerror(zlogp, B_TRUE, "failed to add address");
 			free_ip_interface(zalist);
 			return (-1);
 		}
 		free_ip_interface(zalist);
 	}
-	(void) zonecfg_endnwifent(handle);
-	zonecfg_fini_handle(handle);
+	(void) zonecfg_endnwifent(snap_hndl);
 
 	if (prof != NULL && added) {
 		if (di_prof_commit(prof) != 0) {
@@ -3127,48 +3132,23 @@ remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
 			/* datalink does not belong to the GZ */
 			continue;
 		}
-		if (dlstatus != DLADM_STATUS_OK) {
+		if (dlstatus != DLADM_STATUS_OK)
 			zerror(zlogp, B_FALSE,
+			    "clear 'protection' link property: %s",
 			    dladm_status2str(dlstatus, dlerr));
-			free(dllinks);
-			return (-1);
-		}
+
 		dlstatus = dladm_set_linkprop(dld_handle, *dllink,
 		    "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
-		if (dlstatus != DLADM_STATUS_OK) {
+		if (dlstatus != DLADM_STATUS_OK)
 			zerror(zlogp, B_FALSE,
+			    "clear 'allowed-ips' link property: %s",
 			    dladm_status2str(dlstatus, dlerr));
-			free(dllinks);
-			return (-1);
-		}
 	}
 	free(dllinks);
 	return (0);
 }
 
 static int
-unconfigure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
-{
-	int dlnum = 0;
-
-	/*
-	 * The kernel shutdown callback for the dls module should have removed
-	 * all datalinks from this zone.  If any remain, then there's a
-	 * problem.
-	 */
-	if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
-		zerror(zlogp, B_TRUE, "unable to list network interfaces");
-		return (-1);
-	}
-	if (dlnum != 0) {
-		zerror(zlogp, B_FALSE,
-		    "datalinks remain in zone after shutdown");
-		return (-1);
-	}
-	return (0);
-}
-
-static int
 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
 {
@@ -3250,26 +3230,14 @@ static int
 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
 {
 	int error = -1;
-	zone_dochandle_t handle;
 	char *privname = NULL;
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (-1);
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (-1);
-	}
-
 	if (ALT_MOUNT(mount_cmd)) {
 		zone_iptype_t	iptype;
-		const char	*curr_iptype;
+		const char	*curr_iptype = NULL;
 
-		if (zonecfg_get_iptype(handle, &iptype) != Z_OK) {
+		if (zonecfg_get_iptype(snap_hndl, &iptype) != Z_OK) {
 			zerror(zlogp, B_TRUE, "unable to determine ip-type");
-			zonecfg_fini_handle(handle);
 			return (-1);
 		}
 
@@ -3282,17 +3250,15 @@ get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
 			break;
 		}
 
-		if (zonecfg_default_privset(privs, curr_iptype) == Z_OK) {
-			zonecfg_fini_handle(handle);
+		if (zonecfg_default_privset(privs, curr_iptype) == Z_OK)
 			return (0);
-		}
+
 		zerror(zlogp, B_FALSE,
 		    "failed to determine the zone's default privilege set");
-		zonecfg_fini_handle(handle);
 		return (-1);
 	}
 
-	switch (zonecfg_get_privset(handle, privs, &privname)) {
+	switch (zonecfg_get_privset(snap_hndl, privs, &privname)) {
 	case Z_OK:
 		error = 0;
 		break;
@@ -3315,10 +3281,22 @@ get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
 	}
 
 	free(privname);
-	zonecfg_fini_handle(handle);
 	return (error);
 }
 
+static char *
+zone_proj_rctl(const char *name)
+{
+	int i;
+
+	for (i = 0; zone_proj_rctl_map[i].zpr_zone_rctl != NULL; i++) {
+		if (strcmp(name, zone_proj_rctl_map[i].zpr_zone_rctl) == 0) {
+			return (zone_proj_rctl_map[i].zpr_project_rctl);
+		}
+	}
+	return (NULL);
+}
+
 static int
 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 {
@@ -3328,25 +3306,15 @@ get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 	nvlist_t **nvlv = NULL;
 	int rctlcount = 0;
 	int error = -1;
-	zone_dochandle_t handle;
 	struct zone_rctltab rctltab;
 	rctlblk_t *rctlblk = NULL;
 	uint64_t maxlwps;
 	uint64_t maxprocs;
+	int rproc, rlwp;
 
 	*bufp = NULL;
 	*bufsizep = 0;
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (-1);
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (-1);
-	}
-
 	rctltab.zone_rctl_valptr = NULL;
 	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
 		zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
@@ -3355,22 +3323,31 @@ get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 
 	/*
 	 * Allow the administrator to control both the maximum number of
-	 * process table slots and the maximum number of lwps with just the
-	 * max-processes property.  If only the max-processes property is set,
-	 * we add a max-lwps property with a limit derived from max-processes.
+	 * process table slots, and the maximum number of lwps, with a single
+	 * max-processes or max-lwps property. If only the max-processes
+	 * property is set, we add a max-lwps property with a limit derived
+	 * from max-processes. If only the max-lwps property is set, we add a
+	 * max-processes property with the same limit as max-lwps.
 	 */
-	if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXPROCS, &maxprocs)
-	    == Z_OK &&
-	    zonecfg_get_aliased_rctl(handle, ALIAS_MAXLWPS, &maxlwps)
-	    == Z_NO_ENTRY) {
-		if (zonecfg_set_aliased_rctl(handle, ALIAS_MAXLWPS,
+	rproc = zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXPROCS, &maxprocs);
+	rlwp = zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXLWPS, &maxlwps);
+	if (rproc == Z_OK && rlwp == Z_NO_ENTRY) {
+		if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXLWPS,
 		    maxprocs * LWPS_PER_PROCESS) != Z_OK) {
 			zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
 			goto out;
 		}
+	} else if (rlwp == Z_OK && rproc == Z_NO_ENTRY) {
+		/* no scaling for max-proc value */
+		if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXPROCS,
+		    maxlwps) != Z_OK) {
+			zerror(zlogp, B_FALSE,
+			    "unable to set max-processes alias");
+			goto out;
+		}
 	}
 
-	if (zonecfg_setrctlent(handle) != Z_OK) {
+	if (zonecfg_setrctlent(snap_hndl) != Z_OK) {
 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
 		goto out;
 	}
@@ -3379,10 +3356,11 @@ get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 		zerror(zlogp, B_TRUE, "memory allocation failed");
 		goto out;
 	}
-	while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
+	while (zonecfg_getrctlent(snap_hndl, &rctltab) == Z_OK) {
 		struct zone_rctlvaltab *rctlval;
 		uint_t i, count;
 		const char *name = rctltab.zone_rctl_name;
+		char *proj_nm;
 
 		/* zoneadm should have already warned about unknown rctls. */
 		if (!zonecfg_is_rctl(name)) {
@@ -3449,6 +3427,26 @@ get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 		}
 		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
 		rctltab.zone_rctl_valptr = NULL;
+
+		/*
+		 * With no action on our part we will start zsched with the
+		 * project rctl values for our (zoneadmd) current project. For
+		 * brands running a variant of Illumos, that's not a problem
+		 * since they will setup their own projects, but for a
+		 * non-native brand like lx, where there are no projects, we
+		 * want to start things up with the same project rctls as the
+		 * corresponding zone rctls, since nothing within the zone will
+		 * ever change the project rctls.
+		 */
+		if ((proj_nm = zone_proj_rctl(name)) != NULL) {
+			if (nvlist_add_nvlist_array(nvl, proj_nm, nvlv, count)
+			    != 0) {
+				zerror(zlogp, B_FALSE,
+				    "nvlist_add_nvlist_arrays failed");
+				goto out;
+			}
+		}
+
 		if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
 		    != 0) {
 			zerror(zlogp, B_FALSE, "%s failed",
@@ -3461,7 +3459,7 @@ get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 		nvlv = NULL;
 		rctlcount++;
 	}
-	(void) zonecfg_endrctlent(handle);
+	(void) zonecfg_endrctlent(snap_hndl);
 
 	if (rctlcount == 0) {
 		error = 0;
@@ -3485,8 +3483,6 @@ out:
 	nvlist_free(nvl);
 	if (nvlv != NULL)
 		free(nvlv);
-	if (handle != NULL)
-		zonecfg_fini_handle(handle);
 	return (error);
 }
 
@@ -3502,7 +3498,7 @@ get_implicit_datasets(zlog_t *zlogp, char **retstr)
 	    > sizeof (cmdbuf))
 		return (-1);
 
-	if (do_subproc(zlogp, cmdbuf, retstr) != 0)
+	if (do_subproc(zlogp, cmdbuf, retstr, B_FALSE) != 0)
 		return (-1);
 
 	return (0);
@@ -3511,7 +3507,6 @@ get_implicit_datasets(zlog_t *zlogp, char **retstr)
 static int
 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 {
-	zone_dochandle_t handle;
 	struct zone_dstab dstab;
 	size_t total, offset, len;
 	int error = -1;
@@ -3522,30 +3517,20 @@ get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 	*bufp = NULL;
 	*bufsizep = 0;
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (-1);
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (-1);
-	}
-
 	if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
 		zerror(zlogp, B_FALSE, "getting implicit datasets failed");
 		goto out;
 	}
 
-	if (zonecfg_setdsent(handle) != Z_OK) {
+	if (zonecfg_setdsent(snap_hndl) != Z_OK) {
 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
 		goto out;
 	}
 
 	total = 0;
-	while (zonecfg_getdsent(handle, &dstab) == Z_OK)
+	while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK)
 		total += strlen(dstab.zone_dataset_name) + 1;
-	(void) zonecfg_enddsent(handle);
+	(void) zonecfg_enddsent(snap_hndl);
 
 	if (implicit_datasets != NULL)
 		implicit_len = strlen(implicit_datasets);
@@ -3562,12 +3547,12 @@ get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 		goto out;
 	}
 
-	if (zonecfg_setdsent(handle) != Z_OK) {
+	if (zonecfg_setdsent(snap_hndl) != Z_OK) {
 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
 		goto out;
 	}
 	offset = 0;
-	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
+	while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
 		len = strlen(dstab.zone_dataset_name);
 		(void) strlcpy(str + offset, dstab.zone_dataset_name,
 		    total - offset);
@@ -3575,7 +3560,7 @@ get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 		if (offset < total - 1)
 			str[offset++] = ',';
 	}
-	(void) zonecfg_enddsent(handle);
+	(void) zonecfg_enddsent(snap_hndl);
 
 	if (implicit_len > 0)
 		(void) strlcpy(str + offset, implicit_datasets, total - offset);
@@ -3587,8 +3572,6 @@ get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
 out:
 	if (error != 0 && str != NULL)
 		free(str);
-	if (handle != NULL)
-		zonecfg_fini_handle(handle);
 	if (implicit_datasets != NULL)
 		free(implicit_datasets);
 
@@ -3598,40 +3581,26 @@ out:
 static int
 validate_datasets(zlog_t *zlogp)
 {
-	zone_dochandle_t handle;
 	struct zone_dstab dstab;
 	zfs_handle_t *zhp;
 	libzfs_handle_t *hdl;
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (-1);
-	}
-	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
+	if (zonecfg_setdsent(snap_hndl) != Z_OK) {
 		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (-1);
-	}
-
-	if (zonecfg_setdsent(handle) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
 		return (-1);
 	}
 
 	if ((hdl = libzfs_init()) == NULL) {
 		zerror(zlogp, B_FALSE, "opening ZFS library");
-		zonecfg_fini_handle(handle);
 		return (-1);
 	}
 
-	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
+	while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
 
 		if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
 		    ZFS_TYPE_FILESYSTEM)) == NULL) {
 			zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
 			    dstab.zone_dataset_name);
-			zonecfg_fini_handle(handle);
 			libzfs_fini(hdl);
 			return (-1);
 		}
@@ -3646,7 +3615,6 @@ validate_datasets(zlog_t *zlogp)
 			zerror(zlogp, B_FALSE, "cannot set 'zoned' "
 			    "property for ZFS dataset '%s'\n",
 			    dstab.zone_dataset_name);
-			zonecfg_fini_handle(handle);
 			zfs_close(zhp);
 			libzfs_fini(hdl);
 			return (-1);
@@ -3654,9 +3622,8 @@ validate_datasets(zlog_t *zlogp)
 
 		zfs_close(zhp);
 	}
-	(void) zonecfg_enddsent(handle);
+	(void) zonecfg_enddsent(snap_hndl);
 
-	zonecfg_fini_handle(handle);
 	libzfs_fini(hdl);
 
 	return (0);
@@ -3710,17 +3677,11 @@ validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
 	zfs_handle_t	*zhp;
 	libzfs_handle_t	*hdl;
 	m_label_t	ds_sl;
-	char		zonepath[MAXPATHLEN];
 	char		ds_hexsl[MAXNAMELEN];
 
 	if (!is_system_labeled())
 		return (0);
 
-	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
-		zerror(zlogp, B_TRUE, "unable to determine zone path");
-		return (-1);
-	}
-
 	if (!is_zonepath_zfs(zonepath))
 		return (0);
 
@@ -4391,62 +4352,52 @@ duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
 }
 
 /*
- * Set memory cap and pool info for the zone's resource management
- * configuration.
+ * Set pool info for the zone's resource management configuration.
  */
 static int
 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
 {
 	int res;
 	uint64_t tmp;
-	struct zone_mcaptab mcap;
 	char sched[MAXNAMELEN];
-	zone_dochandle_t handle = NULL;
 	char pool_err[128];
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (Z_BAD_HANDLE);
-	}
-
-	if ((res = zonecfg_get_snapshot_handle(zone_name, handle)) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		zonecfg_fini_handle(handle);
-		return (res);
-	}
-
-	/*
-	 * If a memory cap is configured, set the cap in the kernel using
-	 * zone_setattr() and make sure the rcapd SMF service is enabled.
-	 */
-	if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
-		uint64_t num;
-		char smf_err[128];
-
-		num = (uint64_t)strtoull(mcap.zone_physmem_cap, NULL, 10);
-		if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
-			zerror(zlogp, B_TRUE, "could not set zone memory cap");
-			zonecfg_fini_handle(handle);
-			return (Z_INVAL);
-		}
-
-		if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
-			zerror(zlogp, B_FALSE, "enabling system/rcap service "
-			    "failed: %s", smf_err);
-			zonecfg_fini_handle(handle);
-			return (Z_INVAL);
-		}
-	}
-
 	/* Get the scheduling class set in the zone configuration. */
-	if (zonecfg_get_sched_class(handle, sched, sizeof (sched)) == Z_OK &&
+	if (zonecfg_get_sched_class(snap_hndl, sched, sizeof (sched)) == Z_OK &&
 	    strlen(sched) > 0) {
 		if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
 		    strlen(sched)) == -1)
 			zerror(zlogp, B_TRUE, "WARNING: unable to set the "
 			    "default scheduling class");
 
-	} else if (zonecfg_get_aliased_rctl(handle, ALIAS_SHARES, &tmp)
+		if (strcmp(sched, "FX") == 0) {
+			/*
+			 * When FX is specified then by default all processes
+			 * will start at the lowest priority level (0) and
+			 * stay there. We support an optional attr which
+			 * indicates that all the processes should be "high
+			 * priority". We set this on the zone so that starting
+			 * init will set the priority high.
+			 */
+			struct zone_attrtab a;
+
+			bzero(&a, sizeof (a));
+			(void) strlcpy(a.zone_attr_name, "fixed-hi-prio",
+			    sizeof (a.zone_attr_name));
+
+			if (zonecfg_lookup_attr(snap_hndl, &a) == Z_OK &&
+			    strcmp(a.zone_attr_value, "true") == 0) {
+				boolean_t hi = B_TRUE;
+
+				if (zone_setattr(zoneid,
+				    ZONE_ATTR_SCHED_FIXEDHI, (void *)hi,
+				    sizeof (hi)) == -1)
+					zerror(zlogp, B_TRUE, "WARNING: unable "
+					    "to set high priority");
+			}
+		}
+
+	} else if (zonecfg_get_aliased_rctl(snap_hndl, ALIAS_SHARES, &tmp)
 	    == Z_OK) {
 		/*
 		 * If the zone has the zone.cpu-shares rctl set then we want to
@@ -4457,7 +4408,7 @@ setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
 		 */
 		char class_name[PC_CLNMSZ];
 
-		if (zonecfg_get_dflt_sched_class(handle, class_name,
+		if (zonecfg_get_dflt_sched_class(snap_hndl, class_name,
 		    sizeof (class_name)) != Z_OK) {
 			zerror(zlogp, B_FALSE, "WARNING: unable to determine "
 			    "the zone's scheduling class");
@@ -4490,7 +4441,7 @@ setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
 	 * right thing in all cases (reuse or create) based on the current
 	 * zonecfg.
 	 */
-	if ((res = zonecfg_bind_tmp_pool(handle, zoneid, pool_err,
+	if ((res = zonecfg_bind_tmp_pool(snap_hndl, zoneid, pool_err,
 	    sizeof (pool_err))) != Z_OK) {
 		if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
 			zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
@@ -4499,14 +4450,13 @@ setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
 		else
 			zerror(zlogp, B_FALSE, "could not bind zone to "
 			    "temporary pool: %s", zonecfg_strerror(res));
-		zonecfg_fini_handle(handle);
 		return (Z_POOL_BIND);
 	}
 
 	/*
 	 * Check if we need to warn about poold not being enabled.
 	 */
-	if (zonecfg_warn_poold(handle)) {
+	if (zonecfg_warn_poold(snap_hndl)) {
 		zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
 		    "been specified\nbut the dynamic pool service is not "
 		    "enabled.\nThe system will not dynamically adjust the\n"
@@ -4516,7 +4466,7 @@ setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
 	}
 
 	/* The following is a warning, not an error. */
-	if ((res = zonecfg_bind_pool(handle, zoneid, pool_err,
+	if ((res = zonecfg_bind_pool(snap_hndl, zoneid, pool_err,
 	    sizeof (pool_err))) != Z_OK) {
 		if (res == Z_POOL_BIND)
 			zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
@@ -4530,10 +4480,9 @@ setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
 	}
 
 	/* Update saved pool name in case it has changed */
-	(void) zonecfg_get_poolname(handle, zone_name, pool_name,
+	(void) zonecfg_get_poolname(snap_hndl, zone_name, pool_name,
 	    sizeof (pool_name));
 
-	zonecfg_fini_handle(handle);
 	return (Z_OK);
 }
 
@@ -4724,36 +4673,31 @@ setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
 }
 
 static int
-setup_zone_attrs(zlog_t *zlogp, char *zone_namep, zoneid_t zoneid)
+setup_zone_attrs(zlog_t *zlogp, zoneid_t zoneid)
 {
-	zone_dochandle_t handle;
 	int res = Z_OK;
 
-	if ((handle = zonecfg_init_handle()) == NULL) {
-		zerror(zlogp, B_TRUE, "getting zone configuration handle");
-		return (Z_BAD_HANDLE);
-	}
-	if ((res = zonecfg_get_snapshot_handle(zone_namep, handle)) != Z_OK) {
-		zerror(zlogp, B_FALSE, "invalid configuration");
-		goto out;
-	}
-
-	if ((res = setup_zone_hostid(handle, zlogp, zoneid)) != Z_OK)
+	if ((res = setup_zone_hostid(snap_hndl, zlogp, zoneid)) != Z_OK)
 		goto out;
 
-	if ((res = setup_zone_fs_allowed(handle, zlogp, zoneid)) != Z_OK)
+	if ((res = setup_zone_fs_allowed(snap_hndl, zlogp, zoneid)) != Z_OK)
 		goto out;
 
-	if ((res = setup_zone_secflags(handle, zlogp, zoneid)) != Z_OK)
+	if ((res = setup_zone_secflags(snap_hndl, zlogp, zoneid)) != Z_OK)
 		goto out;
 
 out:
-	zonecfg_fini_handle(handle);
 	return (res);
 }
 
+/*
+ * The zone_did is a persistent debug ID.  Each zone should have a unique ID
+ * in the kernel.  This is used for things like DTrace which want to monitor
+ * zones across reboots.  They can't use the zoneid since that changes on
+ * each boot.
+ */
 zoneid_t
-vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
+vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zone_did)
 {
 	zoneid_t rval = -1;
 	priv_set_t *privs;
@@ -4769,7 +4713,7 @@ vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
 	tsol_zcent_t *zcent = NULL;
 	int match = 0;
 	int doi = 0;
-	int flags;
+	int flags = -1;
 	zone_iptype_t iptype;
 
 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
@@ -4791,6 +4735,8 @@ vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
 		flags = ZCF_NET_EXCL;
 		break;
 	}
+	if (flags == -1)
+		abort();
 
 	if ((privs = priv_allocset()) == NULL) {
 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
@@ -4894,7 +4840,7 @@ vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
 	xerr = 0;
 	if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
 	    rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
-	    flags)) == -1) {
+	    flags, zone_did)) == -1) {
 		if (xerr == ZE_AREMOUNTS) {
 			if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
 				zerror(zlogp, B_FALSE,
@@ -4940,7 +4886,7 @@ vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
 		struct brand_attr attr;
 		char modname[MAXPATHLEN];
 
-		if (setup_zone_attrs(zlogp, zone_name, zoneid) != Z_OK)
+		if (setup_zone_attrs(zlogp, zoneid) != Z_OK)
 			goto error;
 
 		if ((bh = brand_open(brand_name)) == NULL) {
@@ -4998,6 +4944,8 @@ error:
 	}
 	if (rctlbuf != NULL)
 		free(rctlbuf);
+	if (zfsbuf != NULL)
+		free(zfsbuf);
 	priv_freeset(privs);
 	if (fp != NULL)
 		zonecfg_close_scratch(fp);
@@ -5086,7 +5034,7 @@ write_index_file(zoneid_t zoneid)
 int
 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
 {
-	char zonepath[MAXPATHLEN];
+	char zpath[MAXPATHLEN];
 
 	if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
 		lofs_discard_mnttab();
@@ -5097,15 +5045,11 @@ vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
 	 * Before we try to mount filesystems we need to create the
 	 * attribute backing store for /dev
 	 */
-	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
-		lofs_discard_mnttab();
-		return (-1);
-	}
-	resolve_lofs(zlogp, zonepath, sizeof (zonepath));
+	(void) strlcpy(zpath, zonepath, sizeof (zpath));
+	resolve_lofs(zlogp, zpath, sizeof (zpath));
 
 	/* Make /dev directory owned by root, grouped sys */
-	if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
-	    0, 3) != 0) {
+	if (make_one_dir(zlogp, zpath, "/dev", DEFAULT_DIR_MODE, 0, 3) != 0) {
 		lofs_discard_mnttab();
 		return (-1);
 	}
@@ -5140,6 +5084,8 @@ vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
 				return (-1);
 			}
 			break;
+		default:
+			abort();
 		}
 	}
 
@@ -5214,14 +5160,88 @@ unmounted:
 	}
 }
 
+/*
+ * Delete all transient VNICs belonging to this zone. A transient VNIC
+ * is one that is created and destroyed along with the lifetime of the
+ * zone. Non-transient VNICs, ones that are assigned from the GZ to a
+ * NGZ, are reassigned to the GZ in zone_shutdown() via the
+ * zone-specific data (zsd) callbacks.
+ */
+static int
+delete_transient_vnics(zlog_t *zlogp, zoneid_t zoneid)
+{
+	dladm_status_t status;
+	int num_links = 0;
+	datalink_id_t *links, link;
+	uint32_t link_flags;
+	datalink_class_t link_class;
+	char link_name[MAXLINKNAMELEN];
+
+	if (zone_list_datalink(zoneid, &num_links, NULL) != 0) {
+		zerror(zlogp, B_TRUE, "unable to determine "
+		    "number of network interfaces");
+		return (-1);
+	}
+
+	if (num_links == 0)
+		return (0);
+
+	links = malloc(num_links * sizeof (datalink_id_t));
+
+	if (links == NULL) {
+		zerror(zlogp, B_TRUE, "failed to delete "
+		    "network interfaces because of alloc fail");
+		return (-1);
+	}
+
+	if (zone_list_datalink(zoneid, &num_links, links) != 0) {
+		zerror(zlogp, B_TRUE, "failed to delete "
+		    "network interfaces because of failure "
+		    "to list them");
+		return (-1);
+	}
+
+	for (int i = 0; i < num_links; i++) {
+		char dlerr[DLADM_STRSIZE];
+		link = links[i];
+
+		status = dladm_datalink_id2info(dld_handle, link, &link_flags,
+		    &link_class, NULL, link_name, sizeof (link_name));
+
+		if (status != DLADM_STATUS_OK) {
+			zerror(zlogp, B_FALSE, "failed to "
+			    "delete network interface (%u)"
+			    "due to failure to get link info: %s",
+			    link,
+			    dladm_status2str(status, dlerr));
+			return (-1);
+		}
+
+		if (link_flags & DLADM_OPT_TRANSIENT) {
+			assert(link_class & DATALINK_CLASS_VNIC);
+			status = dladm_vnic_delete(dld_handle, link,
+			    DLADM_OPT_ACTIVE);
+
+			if (status != DLADM_STATUS_OK) {
+				zerror(zlogp, B_TRUE, "failed to delete link "
+				    "with id %d: %s", link,
+				    dladm_status2str(status, dlerr));
+				return (-1);
+			}
+		}
+	}
+
+	return (0);
+}
+
 int
-vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
+vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting,
+    boolean_t debug)
 {
 	char *kzone;
 	zoneid_t zoneid;
 	int res;
 	char pool_err[128];
-	char zpath[MAXPATHLEN];
 	char cmdbuf[MAXPATHLEN];
 	brand_handle_t bh = NULL;
 	dladm_status_t status;
@@ -5254,16 +5274,12 @@ vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
 		goto error;
 	}
 
-	if (remove_datalink_pool(zlogp, zoneid) != 0) {
+	if (remove_datalink_pool(zlogp, zoneid) != 0)
 		zerror(zlogp, B_FALSE, "unable clear datalink pool property");
-		goto error;
-	}
 
-	if (remove_datalink_protect(zlogp, zoneid) != 0) {
+	if (remove_datalink_protect(zlogp, zoneid) != 0)
 		zerror(zlogp, B_FALSE,
 		    "unable clear datalink protect property");
-		goto error;
-	}
 
 	/*
 	 * The datalinks assigned to the zone will be removed from the NGZ as
@@ -5277,12 +5293,6 @@ vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
 		goto error;
 	}
 
-	/* Get the zonepath of this zone */
-	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
-		zerror(zlogp, B_FALSE, "unable to determine zone path");
-		goto error;
-	}
-
 	/* Get a handle to the brand info for this zone */
 	if ((bh = brand_open(brand_name)) == NULL) {
 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
@@ -5293,7 +5303,7 @@ vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
 	 * brand a chance to cleanup any custom configuration.
 	 */
 	(void) strcpy(cmdbuf, EXEC_PREFIX);
-	if (brand_get_halt(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
+	if (brand_get_halt(bh, zone_name, zonepath, cmdbuf + EXEC_LEN,
 	    sizeof (cmdbuf) - EXEC_LEN) < 0) {
 		brand_close(bh);
 		zerror(zlogp, B_FALSE, "unable to determine branded zone's "
@@ -5303,7 +5313,7 @@ vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
 	brand_close(bh);
 
 	if ((strlen(cmdbuf) > EXEC_LEN) &&
-	    (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
+	    (do_subproc(zlogp, cmdbuf, NULL, debug) != Z_OK)) {
 		zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
 		goto error;
 	}
@@ -5335,17 +5345,18 @@ vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
 			}
 			break;
 		case ZS_EXCLUSIVE:
-			if (unconfigure_exclusive_network_interfaces(zlogp,
-			    zoneid) != 0) {
-				zerror(zlogp, B_FALSE, "unable to unconfigure "
-				    "network interfaces in zone");
+			if (delete_transient_vnics(zlogp, zoneid) != 0) {
+				zerror(zlogp, B_FALSE, "unable to delete "
+				    "transient vnics in zone");
 				goto error;
 			}
+
 			status = dladm_zone_halt(dld_handle, zoneid);
 			if (status != DLADM_STATUS_OK) {
 				zerror(zlogp, B_FALSE, "unable to notify "
 				    "dlmgmtd of zone halt: %s",
 				    dladm_status2str(status, errmsg));
+				goto error;
 			}
 			break;
 		}
@@ -5377,14 +5388,9 @@ vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
 
 		if (rebooting) {
 			struct zone_psettab pset_tab;
-			zone_dochandle_t handle;
 
-			if ((handle = zonecfg_init_handle()) != NULL &&
-			    zonecfg_get_handle(zone_name, handle) == Z_OK &&
-			    zonecfg_lookup_pset(handle, &pset_tab) == Z_OK)
+			if (zonecfg_lookup_pset(snap_hndl, &pset_tab) == Z_OK)
 				destroy_tmp_pool = B_FALSE;
-
-			zonecfg_fini_handle(handle);
 		}
 
 		if (destroy_tmp_pool) {
diff --git a/usr/src/cmd/zoneadmd/zcons.c b/usr/src/cmd/zoneadmd/zcons.c
index 5f6fc4973c..ce398faf30 100644
--- a/usr/src/cmd/zoneadmd/zcons.c
+++ b/usr/src/cmd/zoneadmd/zcons.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2012 Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
  */
 
@@ -40,10 +40,10 @@
  *
  *                                      Global Zone | Non-Global Zone
  *                        .--------------.          |
- *        .-----------.   | zoneadmd -z  |          | .--------. .---------.
- *        | zlogin -C |   |     myzone   |          | | ttymon | | syslogd |
- *        `-----------'   `--------------'          | `--------' `---------'
- *                  |       |       | |             |      |       |
+ *        .-----------.   | zoneadmd -z  |--.       | .--------. .---------.
+ *        | zlogin -C |   |     myzone   |  |       | | ttymon | | syslogd |
+ *        `-----------'   `--------------'  V       | `--------' `---------'
+ *                  |       |       | | console.log |      |       |
  *  User            |       |       | |             |      V       V
  * - - - - - - - - -|- - - -|- - - -|-|- - - - - - -|- - /dev/zconsole - - -
  *  Kernel          V       V       | |                        |
@@ -81,6 +81,8 @@
  *   functions as a two-way proxy for console I/O, relaying user input
  *   to the master side of the console, and relaying output from the
  *   zone to the user.
+ *
+ * - Logging output to <zonepath>/logs/console.log.
  */
 
 #include <sys/types.h>
@@ -118,9 +120,10 @@
 
 #define	CONSOLE_SOCKPATH	ZONES_TMPDIR "/%s.console_sock"
 
+#define	ZCONS_RETRY		10
+
 static int	serverfd = -1;	/* console server unix domain socket fd */
 char boot_args[BOOTARGS_MAX];
-char bad_boot_arg[BOOTARGS_MAX];
 
 /*
  * The eventstream is a simple one-directional flow of messages from the
@@ -130,7 +133,10 @@ char bad_boot_arg[BOOTARGS_MAX];
  */
 static int eventstream[2];
 
-
+/* flag used to cope with race creating master zcons devlink */
+static boolean_t master_zcons_failed = B_FALSE;
+/* flag to track if we've seen a state change when there is no master zcons */
+static boolean_t state_changed = B_FALSE;
 
 int
 eventstream_init()
@@ -322,7 +328,7 @@ destroy_console_devs(zlog_t *zlogp)
  * interfaces to instantiate a new zone console node.  We do a lot of
  * sanity checking, and are careful to reuse a console if one exists.
  *
- * Once the device is in the device tree, we kick devfsadm via di_init_devs()
+ * Once the device is in the device tree, we kick devfsadm via di_devlink_init()
  * to ensure that the appropriate symlinks (to the master and slave console
  * devices) are placed in /dev in the global zone.
  */
@@ -408,43 +414,63 @@ devlinks:
 	 * Open the master side of the console and issue the ZC_HOLDSLAVE ioctl,
 	 * which will cause the master to retain a reference to the slave.
 	 * This prevents ttymon from blowing through the slave's STREAMS anchor.
+	 *
+	 * In very rare cases the open returns ENOENT if devfs doesn't have
+	 * everything setup yet due to heavy zone startup load. Wait for
+	 * 1 sec. and retry a few times. Even if we can't setup the zone's
+	 * console, we still go ahead and boot the zone.
 	 */
 	(void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
 	    zone_name, ZCONS_MASTER_NAME);
-	if ((masterfd = open(conspath, O_RDWR | O_NOCTTY)) == -1) {
+	for (i = 0; i < ZCONS_RETRY; i++) {
+		masterfd = open(conspath, O_RDWR | O_NOCTTY);
+		if (masterfd >= 0 || errno != ENOENT)
+			break;
+		(void) sleep(1);
+	}
+	if (masterfd == -1) {
 		zerror(zlogp, B_TRUE, "ERROR: could not open master side of "
 		    "zone console for %s to acquire slave handle", zone_name);
-		goto error;
+		master_zcons_failed = B_TRUE;
 	}
+
 	(void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
 	    zone_name, ZCONS_SLAVE_NAME);
-	if ((slavefd = open(conspath, O_RDWR | O_NOCTTY)) == -1) {
+	for (i = 0; i < ZCONS_RETRY; i++) {
+		slavefd = open(conspath, O_RDWR | O_NOCTTY);
+		if (slavefd >= 0 || errno != ENOENT)
+			break;
+		(void) sleep(1);
+	}
+	if (slavefd == -1)
 		zerror(zlogp, B_TRUE, "ERROR: could not open slave side of zone"
 		    " console for %s to acquire slave handle", zone_name);
-		(void) close(masterfd);
-		goto error;
-	}
+
 	/*
 	 * This ioctl can occasionally return ENXIO if devfs doesn't have
 	 * everything plumbed up yet due to heavy zone startup load. Wait for
 	 * 1 sec. and retry a few times before we fail to boot the zone.
 	 */
-	for (i = 0; i < 5; i++) {
-		if (ioctl(masterfd, ZC_HOLDSLAVE, (caddr_t)(intptr_t)slavefd)
-		    == 0) {
-			rv = 0;
-			break;
-		} else if (errno != ENXIO) {
-			break;
+	if (masterfd != -1 && slavefd != -1) {
+		for (i = 0; i < ZCONS_RETRY; i++) {
+			if (ioctl(masterfd, ZC_HOLDSLAVE,
+			    (caddr_t)(intptr_t)slavefd) == 0) {
+				rv = 0;
+				break;
+			} else if (errno != ENXIO) {
+				break;
+			}
+			(void) sleep(1);
 		}
-		(void) sleep(1);
+		if (rv != 0)
+			zerror(zlogp, B_TRUE, "ERROR: error while acquiring "
+			    "slave handle of zone console for %s", zone_name);
 	}
-	if (rv != 0)
-		zerror(zlogp, B_TRUE, "ERROR: error while acquiring slave "
-		    "handle of zone console for %s", zone_name);
 
-	(void) close(slavefd);
-	(void) close(masterfd);
+	if (slavefd != -1)
+		(void) close(slavefd);
+	if (masterfd != -1)
+		(void) close(masterfd);
 
 error:
 	if (ddef_hdl)
@@ -517,6 +543,7 @@ get_client_ident(int clifd, pid_t *pid, char *locale, size_t locale_len,
 	size_t buflen = sizeof (buf);
 	char c = '\0';
 	int i = 0, r;
+	ucred_t *cred = NULL;
 
 	/* "eat up the ident string" case, for simplicity */
 	if (pid == NULL) {
@@ -550,18 +577,22 @@ get_client_ident(int clifd, pid_t *pid, char *locale, size_t locale_len,
 				break;
 	}
 
+	if (getpeerucred(clifd, &cred) == 0) {
+		*pid = ucred_getpid((const ucred_t *)cred);
+		ucred_free(cred);
+	} else {
+		return (-1);
+	}
+
 	/*
 	 * Parse buffer for message of the form:
-	 * IDENT <pid> <locale> <disconnect flag>
+	 * IDENT <locale> <disconnect flag>
 	 */
 	bufp = buf;
 	if (strncmp(bufp, "IDENT ", 6) != 0)
 		return (-1);
 	bufp += 6;
 	errno = 0;
-	*pid = strtoll(bufp, &bufp, 10);
-	if (errno != 0)
-		return (-1);
 
 	while (*bufp != '\0' && isspace(*bufp))
 		bufp++;
@@ -667,14 +698,6 @@ event_message(int clifd, char *clilocale, zone_evt_t evt, int dflag)
 		else
 			str = "NOTICE: Zone boot failed";
 		break;
-	case Z_EVT_ZONE_BADARGS:
-		/*LINTED*/
-		(void) snprintf(lmsg, sizeof (lmsg),
-		    localize_msg(clilocale,
-		    "WARNING: Ignoring invalid boot arguments: %s"),
-		    bad_boot_arg);
-		lstr = lmsg;
-		break;
 	default:
 		return;
 	}
@@ -713,7 +736,7 @@ test_client(int clifd)
  * messages) can be output in the user's locale.
  */
 static void
-do_console_io(zlog_t *zlogp, int consfd, int servfd)
+do_console_io(zlog_t *zlogp, int consfd, int servfd, int conslog)
 {
 	struct pollfd pollfds[4];
 	char ibuf[BUFSIZ];
@@ -762,6 +785,9 @@ do_console_io(zlog_t *zlogp, int consfd, int servfd)
 				if (cc <= 0 && (errno != EINTR) &&
 				    (errno != EAGAIN))
 					break;
+
+				logstream_write(conslog, ibuf, cc);
+
 				/*
 				 * Lose I/O if no one is listening
 				 */
@@ -878,7 +904,6 @@ init_console(zlog_t *zlogp)
 	if (init_console_dev(zlogp) == -1) {
 		zerror(zlogp, B_FALSE,
 		    "console setup: device initialization failed");
-		return (-1);
 	}
 
 	if ((serverfd = init_console_sock(zlogp)) == -1) {
@@ -890,6 +915,17 @@ init_console(zlog_t *zlogp)
 }
 
 /*
+ * Maintain a simple flag that tracks if we have seen at least one state
+ * change. This is currently only used to handle the special case where we are
+ * running without a console device, which is what normally drives shutdown.
+ */
+void
+zcons_statechanged()
+{
+	state_changed = B_TRUE;
+}
+
+/*
  * serve_console() is the master loop for driving console I/O.  It is also the
  * routine which is ultimately responsible for "pulling the plug" on zoneadmd
  * when it realizes that the daemon should shut down.
@@ -907,6 +943,10 @@ serve_console(zlog_t *zlogp)
 	int masterfd;
 	zone_state_t zstate;
 	char conspath[MAXPATHLEN];
+	static boolean_t cons_warned = B_FALSE;
+	int conslog;
+
+	conslog = logstream_open("console.log", "console", LS_LINE_BUFFERED);
 
 	(void) snprintf(conspath, sizeof (conspath),
 	    "/dev/zcons/%s/%s", zone_name, ZCONS_MASTER_NAME);
@@ -914,6 +954,46 @@ serve_console(zlog_t *zlogp)
 	for (;;) {
 		masterfd = open(conspath, O_RDWR|O_NONBLOCK|O_NOCTTY);
 		if (masterfd == -1) {
+			if (master_zcons_failed) {
+				/*
+				 * If we don't have a console and the zone is
+				 * not shutting down, there may have been a
+				 * race/failure with devfs while creating the
+				 * console. In this case we want to leave the
+				 * zone up, even without a console, so
+				 * periodically recheck.
+				 */
+				int i;
+
+				/*
+				 * In the normal flow of this loop, we use
+				 * do_console_io to give things a chance to get
+				 * going first. However, in this case we can't
+				 * use that, so we have to wait for at least
+				 * one state change before checking the state.
+				 */
+				for (i = 0; i < 60; i++) {
+					if (state_changed)
+						break;
+					(void) sleep(1);
+				}
+
+				if (i < 60 && zone_get_state(zone_name,
+				    &zstate) == Z_OK &&
+				    (zstate == ZONE_STATE_READY ||
+				    zstate == ZONE_STATE_RUNNING)) {
+					if (!cons_warned) {
+						zerror(zlogp, B_FALSE,
+						    "WARNING: missing zone "
+						    "console for %s",
+						    zone_name);
+						cons_warned = B_TRUE;
+					}
+					(void) sleep(ZCONS_RETRY);
+					continue;
+				}
+			}
+
 			zerror(zlogp, B_TRUE, "failed to open console master");
 			(void) mutex_lock(&lock);
 			goto death;
@@ -933,7 +1013,7 @@ serve_console(zlog_t *zlogp)
 			goto death;
 		}
 
-		do_console_io(zlogp, masterfd, serverfd);
+		do_console_io(zlogp, masterfd, serverfd, conslog);
 
 		/*
 		 * We would prefer not to do this, but hostile zone processes
@@ -974,4 +1054,6 @@ death:
 
 	destroy_console_sock(serverfd);
 	(void) destroy_console_devs(zlogp);
+
+	logstream_close(conslog);
 }
diff --git a/usr/src/cmd/zoneadmd/zfd.c b/usr/src/cmd/zoneadmd/zfd.c
new file mode 100644
index 0000000000..3ccc6575da
--- /dev/null
+++ b/usr/src/cmd/zoneadmd/zfd.c
@@ -0,0 +1,1237 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * Zone file descriptor support is used as a mechanism for a process inside the
+ * zone to log messages to the GZ zoneadmd and also as a way to interact
+ * directly with the process (via zlogin -I). The zfd thread is modeled on
+ * the zcons thread so see the comment header in zcons.c for a general overview.
+ * Unlike with zcons, which has a single endpoint within the zone and a single
+ * endpoint used by zoneadmd, we setup multiple endpoints within the zone.
+ *
+ * The mode, which is controlled by the zone attribute "zlog-mode" is somewhat
+ * of a misnomer since its purpose has evolved. The attribute currently
+ * can have six values which are used to control:
+ *    - how the zfd devices are used inside the zone
+ *    - if the output on the device(s) is also teed into another stream within
+ *      the zone
+ *    - if we do logging in the GZ
+ * See the comment on get_mode_logmax() in this file, and the comment in
+ * uts/common/io/zfd.c for more details.
+ *
+ * Internally the zfd_mode_t struct holds the number of stdio devs (1 or 3),
+ * the number of additional devs corresponding to the zone attr value and the
+ * GZ logging flag.
+ *
+ * Note that although the mode indicates the number of devices needed, we always
+ * create all possible zfd devices for simplicity.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/termios.h>
+#include <sys/zfd.h>
+#include <sys/mkdev.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <stropts.h>
+#include <thread.h>
+#include <ucred.h>
+#include <unistd.h>
+#include <zone.h>
+#include <signal.h>
+#include <wchar.h>
+
+#include <libdevinfo.h>
+#include <libdevice.h>
+#include <libzonecfg.h>
+
+#include <syslog.h>
+#include <sys/modctl.h>
+
+#include "zoneadmd.h"
+
+static int	shutting_down = 0;
+static thread_t logger_tid;
+static char	log_name[MAXNAMELEN] = "stdio.log";
+
+/*
+ * The eventstream is a simple one-directional flow of messages implemented
+ * with a pipe. It is used to wake up the poller when it needs to shutdown.
+ */
+static int eventstream[2] = {-1, -1};
+
+#define	ZLOG_MODE		"zlog-mode"
+#define	ZLOG_NAME		"zlog-name"
+#define	ZFDNEX_DEVTREEPATH	"/pseudo/zfdnex@2"
+#define	ZFDNEX_FILEPATH		"/devices/pseudo/zfdnex@2"
+#define	SERVER_SOCKPATH		ZONES_TMPDIR "/%s.server_%s"
+#define	ZTTY_RETRY		5
+
+#define	NUM_ZFD_DEVS		5
+
+typedef struct zfd_mode {
+	uint_t		zmode_n_stddevs;
+	uint_t		zmode_n_addl_devs;
+	boolean_t	zmode_gzlogging;
+} zfd_mode_t;
+static zfd_mode_t mode;
+
+/*
+ * cb_data is only used by destroy_cb.
+ */
+struct cb_data {
+	zlog_t *zlogp;
+	int killed;
+};
+
+/*
+ * destroy_zfd_devs() and its helper destroy_cb() tears down any zfd instances
+ * associated with this zone. If things went very wrong, we might have an
+ * incorrect number of instances hanging around.  This routine hunts down and
+ * tries to remove all of them. Of course, if the fd is open, the instance will
+ * not detach, which is a potential issue.
+ */
+static int
+destroy_cb(di_node_t node, void *arg)
+{
+	struct cb_data *cb = (struct cb_data *)arg;
+	char *prop_data;
+	char *tmp;
+	char devpath[MAXPATHLEN];
+	devctl_hdl_t hdl;
+
+	if (di_prop_lookup_strings(DDI_DEV_T_ANY, node, "zfd_zname",
+	    &prop_data) == -1)
+		return (DI_WALK_CONTINUE);
+
+	assert(prop_data != NULL);
+	if (strcmp(prop_data, zone_name) != 0) {
+		/* this is a zfd for a different zone */
+		return (DI_WALK_CONTINUE);
+	}
+
+	tmp = di_devfs_path(node);
+	(void) snprintf(devpath, sizeof (devpath), "/devices/%s", tmp);
+	di_devfs_path_free(tmp);
+
+	if ((hdl = devctl_device_acquire(devpath, 0)) == NULL) {
+		zerror(cb->zlogp, B_TRUE, "WARNING: zfd %s found, "
+		    "but it could not be controlled.", devpath);
+		return (DI_WALK_CONTINUE);
+	}
+	if (devctl_device_remove(hdl) == 0) {
+		cb->killed++;
+	} else {
+		zerror(cb->zlogp, B_TRUE, "WARNING: zfd %s found, "
+		    "but it could not be removed.", devpath);
+	}
+	devctl_release(hdl);
+	return (DI_WALK_CONTINUE);
+}
+
+static int
+destroy_zfd_devs(zlog_t *zlogp)
+{
+	di_node_t root;
+	struct cb_data cb;
+
+	bzero(&cb, sizeof (cb));
+	cb.zlogp = zlogp;
+
+	if ((root = di_init(ZFDNEX_DEVTREEPATH, DINFOCPYALL)) == DI_NODE_NIL) {
+		zerror(zlogp, B_TRUE, "di_init failed");
+		return (-1);
+	}
+
+	(void) di_walk_node(root, DI_WALK_CLDFIRST, (void *)&cb, destroy_cb);
+
+	di_fini(root);
+	return (0);
+}
+
+static void
+make_tty(zlog_t *zlogp, int id)
+{
+	int i;
+	int fd = -1;
+	char stdpath[MAXPATHLEN];
+
+	/*
+	 * Open the master side of the dev and issue the ZFD_MAKETTY ioctl,
+	 * which will cause the the various tty-related streams modules to be
+	 * pushed when the slave opens the device.
+	 *
+	 * In very rare cases the open returns ENOENT if devfs doesn't have
+	 * everything setup yet due to heavy zone startup load. Wait for
+	 * 1 sec. and retry a few times. Even if we can't setup tty mode
+	 * we still move on.
+	 */
+	(void) snprintf(stdpath, sizeof (stdpath), "/dev/zfd/%s/master/%d",
+	    zone_name, id);
+
+	for (i = 0; !shutting_down && i < ZTTY_RETRY; i++) {
+		fd = open(stdpath, O_RDWR | O_NOCTTY);
+		if (fd >= 0 || errno != ENOENT)
+			break;
+		(void) sleep(1);
+	}
+	if (fd == -1) {
+		zerror(zlogp, B_TRUE, "ERROR: could not open zfd %d for "
+		    "zone %s to set tty mode", id, zone_name);
+	} else {
+		/*
+		 * This ioctl can occasionally return ENXIO if devfs doesn't
+		 * have everything plumbed up yet due to heavy zone startup
+		 * load. Wait for 1 sec. and retry a few times before we give
+		 * up.
+		 */
+		for (i = 0; !shutting_down && i < ZTTY_RETRY; i++) {
+			if (ioctl(fd, ZFD_MAKETTY) == 0) {
+				break;
+			} else if (errno != ENXIO) {
+				break;
+			}
+			(void) sleep(1);
+		}
+	}
+
+	if (fd != -1)
+		(void) close(fd);
+}
+
+/*
+ * init_zfd_devs() drives the device-tree configuration of the zone fd devices.
+ * The general strategy is to use the libdevice (devctl) interfaces to
+ * instantiate all of new zone fd nodes.  We do a lot of sanity checking, and
+ * are careful to reuse a dev if one exists.
+ *
+ * Once the devices are in the device tree, we kick devfsadm via
+ * di_devlink_init() to ensure that the appropriate symlinks (to the master and
+ * slave fd devices) are placed in /dev in the global zone.
+ */
+static int
+init_zfd_dev(zlog_t *zlogp, devctl_hdl_t bus_hdl, int id)
+{
+	int rv = -1;
+	devctl_ddef_t ddef_hdl = NULL;
+	devctl_hdl_t dev_hdl = NULL;
+
+	if ((ddef_hdl = devctl_ddef_alloc("zfd", 0)) == NULL) {
+		zerror(zlogp, B_TRUE, "failed to allocate ddef handle");
+		goto error;
+	}
+
+	/*
+	 * Set four properties on this node; the name of the zone, the dev name
+	 * seen inside the zone, a flag which lets pseudo know that it is OK to
+	 * automatically allocate an instance # for this device, and the last
+	 * one tells the device framework not to auto-detach this node - we
+	 * need the node to still be there when we ask devfsadmd to make links,
+	 * and when we need to open it.
+	 */
+	if (devctl_ddef_string(ddef_hdl, "zfd_zname", zone_name) == -1) {
+		zerror(zlogp, B_TRUE, "failed to create zfd_zname property");
+		goto error;
+	}
+	if (devctl_ddef_int(ddef_hdl, "zfd_id", id) == -1) {
+		zerror(zlogp, B_TRUE, "failed to create zfd_id property");
+		goto error;
+	}
+	if (devctl_ddef_int(ddef_hdl, "auto-assign-instance", 1) == -1) {
+		zerror(zlogp, B_TRUE, "failed to create auto-assign-instance "
+		    "property");
+		goto error;
+	}
+	if (devctl_ddef_int(ddef_hdl, "ddi-no-autodetach", 1) == -1) {
+		zerror(zlogp, B_TRUE, "failed to create ddi-no-auto-detach "
+		    "property");
+		goto error;
+	}
+	if (devctl_bus_dev_create(bus_hdl, ddef_hdl, 0, &dev_hdl) == -1) {
+		zerror(zlogp, B_TRUE, "failed to create zfd node");
+		goto error;
+	}
+	rv = 0;
+
+error:
+	if (ddef_hdl)
+		devctl_ddef_free(ddef_hdl);
+	if (dev_hdl)
+		devctl_release(dev_hdl);
+	return (rv);
+}
+
+static int
+init_zfd_devs(zlog_t *zlogp, zfd_mode_t *mode)
+{
+	devctl_hdl_t bus_hdl = NULL;
+	di_devlink_handle_t dl = NULL;
+	int rv = -1;
+	int i;
+
+	/*
+	 * Time to make the devices.
+	 */
+	if ((bus_hdl = devctl_bus_acquire(ZFDNEX_FILEPATH, 0)) == NULL) {
+		zerror(zlogp, B_TRUE, "devctl_bus_acquire failed");
+		goto error;
+	}
+
+	for (i = 0; i < NUM_ZFD_DEVS; i++) {
+		if (init_zfd_dev(zlogp, bus_hdl, i) != 0)
+			goto error;
+	}
+
+	if ((dl = di_devlink_init("zfd", DI_MAKE_LINK)) == NULL) {
+		zerror(zlogp, B_TRUE, "failed to create devlinks");
+		goto error;
+	}
+
+	(void) di_devlink_fini(&dl);
+	rv = 0;
+
+	if (mode->zmode_n_stddevs == 1) {
+		/* We want the primary stream to look like a tty. */
+		make_tty(zlogp, 0);
+	}
+
+error:
+	if (bus_hdl)
+		devctl_release(bus_hdl);
+	return (rv);
+}
+
+static int
+init_server_sock(int *servfd, char *nm)
+{
+	int resfd = -1;
+	struct sockaddr_un servaddr;
+
+	bzero(&servaddr, sizeof (servaddr));
+	servaddr.sun_family = AF_UNIX;
+	(void) snprintf(servaddr.sun_path, sizeof (servaddr.sun_path),
+	    SERVER_SOCKPATH, zone_name, nm);
+
+	if ((resfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
+		zerror(&logplat, B_TRUE,
+		    "server setup: could not create socket");
+		goto err;
+	}
+	(void) unlink(servaddr.sun_path);
+
+	if (bind(resfd, (struct sockaddr *)&servaddr, sizeof (servaddr))
+	    == -1) {
+		zerror(&logplat, B_TRUE,
+		    "server setup: could not bind to socket");
+		goto err;
+	}
+
+	if (listen(resfd, 4) == -1) {
+		zerror(&logplat, B_TRUE,
+		    "server setup: could not listen on socket");
+		goto err;
+	}
+
+	*servfd = resfd;
+	return (0);
+
+err:
+	(void) unlink(servaddr.sun_path);
+	if (resfd != -1)
+		(void) close(resfd);
+	return (-1);
+}
+
+static void
+destroy_server_sock(int servfd, char *nm)
+{
+	char path[MAXPATHLEN];
+
+	(void) snprintf(path, sizeof (path), SERVER_SOCKPATH, zone_name, nm);
+	(void) unlink(path);
+	(void) shutdown(servfd, SHUT_RDWR);
+	(void) close(servfd);
+}
+
+/*
+ * Read the "ident" string from the client's descriptor; this routine also
+ * tolerates being called with pid=NULL, for times when you want to "eat"
+ * the ident string from a client without saving it.
+ */
+static int
+get_client_ident(int clifd, pid_t *pid, char *locale, size_t locale_len,
+    uint_t *flagsp)
+{
+	char buf[BUFSIZ], *bufp;
+	size_t buflen = sizeof (buf);
+	char c = '\0';
+	int i = 0, r;
+	ucred_t *cred = NULL;
+
+	/* "eat up the ident string" case, for simplicity */
+	if (pid == NULL) {
+		assert(locale == NULL && locale_len == 0);
+		while (read(clifd, &c, 1) == 1) {
+			if (c == '\n')
+				return (0);
+		}
+	}
+
+	bzero(buf, sizeof (buf));
+	while ((buflen > 1) && (r = read(clifd, &c, 1)) == 1) {
+		buflen--;
+		if (c == '\n')
+			break;
+
+		buf[i] = c;
+		i++;
+	}
+	if (r == -1)
+		return (-1);
+
+	/*
+	 * We've filled the buffer, but still haven't seen \n.  Keep eating
+	 * until we find it; we don't expect this to happen, but this is
+	 * defensive.
+	 */
+	if (c != '\n') {
+		while ((r = read(clifd, &c, sizeof (c))) > 0)
+			if (c == '\n')
+				break;
+	}
+
+	/*
+	 * Parse buffer for message of the form:
+	 * IDENT <locale> <flags>
+	 */
+	bufp = buf;
+	if (strncmp(bufp, "IDENT ", 6) != 0)
+		return (-1);
+	bufp += 6;
+
+	if (getpeerucred(clifd, &cred) == 0) {
+		*pid = ucred_getpid((const ucred_t *)cred);
+		ucred_free(cred);
+	} else {
+		return (-1);
+	}
+
+	while (*bufp != '\0' && isspace(*bufp))
+		bufp++;
+	buflen = strlen(bufp) - 1;
+	bufp[buflen - 1] = '\0';
+	(void) strlcpy(locale, bufp, locale_len);
+
+	*flagsp = atoi(&bufp[buflen]);
+
+	return (0);
+}
+
+static int
+accept_client(int servfd, pid_t *pid, char *locale, size_t locale_len,
+    uint_t *flagsp)
+{
+	int connfd;
+	struct sockaddr_un cliaddr;
+	socklen_t clilen;
+	int flags;
+
+	clilen = sizeof (cliaddr);
+	connfd = accept(servfd, (struct sockaddr *)&cliaddr, &clilen);
+	if (connfd == -1)
+		return (-1);
+	if (pid != NULL) {
+		if (get_client_ident(connfd, pid, locale, locale_len, flagsp)
+		    == -1) {
+			(void) shutdown(connfd, SHUT_RDWR);
+			(void) close(connfd);
+			return (-1);
+		}
+		(void) write(connfd, "OK\n", 3);
+	}
+
+	flags = fcntl(connfd, F_GETFL, 0);
+	if (flags != -1)
+		(void) fcntl(connfd, F_SETFL, flags | O_NONBLOCK | FD_CLOEXEC);
+
+	return (connfd);
+}
+
+static void
+reject_client(int servfd, pid_t clientpid)
+{
+	int connfd;
+	struct sockaddr_un cliaddr;
+	socklen_t clilen;
+	char nak[MAXPATHLEN];
+
+	clilen = sizeof (cliaddr);
+	connfd = accept(servfd, (struct sockaddr *)&cliaddr, &clilen);
+
+	/*
+	 * After getting its ident string, tell client to get lost.
+	 */
+	if (get_client_ident(connfd, NULL, NULL, 0, NULL) == 0) {
+		(void) snprintf(nak, sizeof (nak), "%lu\n",
+		    clientpid);
+		(void) write(connfd, nak, strlen(nak));
+	}
+	(void) shutdown(connfd, SHUT_RDWR);
+	(void) close(connfd);
+}
+
+static int
+accept_socket(int servfd, pid_t verpid)
+{
+	int connfd;
+	struct sockaddr_un cliaddr;
+	socklen_t clilen = sizeof (cliaddr);
+	ucred_t *cred = NULL;
+	pid_t rpid = -1;
+	int flags;
+
+	connfd = accept(servfd, (struct sockaddr *)&cliaddr, &clilen);
+	if (connfd == -1)
+		return (-1);
+
+	/* Confirm connecting process is who we expect */
+	if (getpeerucred(connfd, &cred) == 0) {
+		rpid = ucred_getpid((const ucred_t *)cred);
+		ucred_free(cred);
+	}
+	if (rpid == -1 || rpid != verpid) {
+		(void) shutdown(connfd, SHUT_RDWR);
+		(void) close(connfd);
+		return (-1);
+	}
+
+	flags = fcntl(connfd, F_GETFL, 0);
+	if (flags != -1)
+		(void) fcntl(connfd, F_SETFL, flags | O_NONBLOCK | FD_CLOEXEC);
+
+	return (connfd);
+}
+
+static void
+ctlcmd_process(int sockfd, int stdoutfd, unsigned int *flags)
+{
+	char buf[BUFSIZ];
+	int i;
+	for (i = 0; i < BUFSIZ-1; i++) {
+		char c;
+		if (read(sockfd, &c, 1) != 1 ||
+		    c == '\n' || c == '\0') {
+			break;
+		}
+		buf[i] = c;
+	}
+	if (i == 0) {
+		goto fail;
+	}
+	buf[i+1] = '\0';
+
+	if (strncmp(buf, "TIOCSWINSZ ", 11) == 0) {
+		char *next = buf + 11;
+		struct winsize ws;
+		errno = 0;
+		ws.ws_row = strtol(next, &next, 10);
+		if (errno == EINVAL) {
+			goto fail;
+		}
+		ws.ws_col = strtol(next + 1, &next, 10);
+		if (errno == EINVAL) {
+			goto fail;
+		}
+		if (ioctl(stdoutfd, TIOCSWINSZ, &ws) == 0) {
+			(void) write(sockfd, "OK\n", 3);
+			return;
+		}
+	}
+	if (strncmp(buf, "SETFLAGS ", 9) == 0) {
+		char *next = buf + 9;
+		unsigned int result;
+		errno = 0;
+		result = strtoul(next, &next, 10);
+		if (errno == EINVAL) {
+			goto fail;
+		}
+		*flags = result;
+		(void) write(sockfd, "OK\n", 3);
+		return;
+	}
+fail:
+	(void) write(sockfd, "FAIL\n", 5);
+}
+
+/*
+ * Check to see if the client at the other end of the socket is still alive; we
+ * know it is not if it throws EPIPE at us when we try to write an otherwise
+ * harmless 0-length message to it.
+ */
+static int
+test_client(int clifd)
+{
+	if ((write(clifd, "", 0) == -1) && errno == EPIPE)
+		return (-1);
+	return (0);
+}
+
+/*
+ * We want to sleep for a little while but need to be responsive if the zone is
+ * halting. We poll/sleep on the event stream so we can notice if we're halting.
+ * Return true if halting, otherwise false.
+ */
+static boolean_t
+halt_sleep(int slptime)
+{
+	struct pollfd evfd[1];
+
+	evfd[0].fd = eventstream[1];
+	evfd[0].events = POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI;
+
+	if (poll(evfd, 1, slptime) > 0) {
+		/* zone halting */
+		return (B_TRUE);
+	}
+	return (B_FALSE);
+}
+
+/*
+ * This routine drives the logging and interactive I/O loop. It polls for
+ * input from the zone side of the fd (output to stdout/stderr), and from the
+ * client (input to the zone's stdin).  Additionally, it polls on the server
+ * fd, and disconnects any clients that might try to hook up with the zone
+ * while the fd's are in use.
+ *
+ * Data from the zone's stdout and stderr is formatted in json and written to
+ * the log file whether an interactive client is connected or not.
+ *
+ * When the client first calls us up, it is expected to send a line giving its
+ * "identity"; this consists of the string 'IDENT <pid> <locale>'. This is so
+ * that we can report that the fd's are busy, along with some diagnostics
+ * about who has them busy; the locale is ignore here but kept for compatability
+ * with the zlogin code when running on the zone's console.
+ *
+ * We need to handle the case where there is no server within the zone (or
+ * the server gets stuck) and data that we're writing to the zone server's
+ * stdin fills the pipe. Because of the way the zfd device works writes can
+ * flow into the stream and simply be dropped, if there is no server, or writes
+ * could return -1 with EAGAIN if the server is stuck. Since we ignore errors
+ * on the write to stdin, we won't get blocked in that case but we'd like to
+ * avoid dropping initial input if the server within the zone hasn't started
+ * yet. To handle this we wait to read initial input until we detect that there
+ * is a server inside the zone. We have to poll for this so that we can
+ * re-run the ioctl to notice when a server shows up. This poll/wait is handled
+ * by halt_sleep() so that we can be responsive if the zone wants to halt.
+ * We only do this check to avoid dropping initial input so it is possible for
+ * the server within the zone to go away later. At that point zfd will just
+ * drop any new input flowing into the stream.
+ */
+static void
+do_zfd_io(int gzctlfd, int gzservfd, int gzerrfd, int stdinfd, int stdoutfd,
+    int stderrfd, int logout, int logerr)
+{
+	struct pollfd pollfds[8];
+	char ibuf[BUFSIZ + 1];
+	int cc, ret;
+	int ctlfd = -1;
+	int clifd = -1;
+	int clierrfd = -1;
+	int pollerr = 0;
+	char clilocale[MAXPATHLEN];
+	pid_t clipid = 0;
+	uint_t flags = 0;
+	boolean_t stdin_ready = B_FALSE;
+	int slptime = 250;	/* initial poll sleep time in ms */
+
+	/* client control socket, watch for read events */
+	pollfds[0].fd = ctlfd;
+	pollfds[0].events = POLLIN | POLLRDNORM | POLLRDBAND |
+	    POLLPRI | POLLERR | POLLHUP | POLLNVAL;
+
+	/* client socket, watch for read events */
+	pollfds[1].fd = clifd;
+	pollfds[1].events = pollfds[0].events;
+
+	/* stdout, watch for read events */
+	pollfds[2].fd = stdoutfd;
+	pollfds[2].events = pollfds[0].events;
+
+	/* stderr, watch for read events */
+	pollfds[3].fd = stderrfd;
+	pollfds[3].events = pollfds[0].events;
+
+	/* the server control socket; watch for new connections */
+	pollfds[4].fd = gzctlfd;
+	pollfds[4].events = POLLIN | POLLRDNORM;
+
+	/* the server stdin/out socket; watch for new connections */
+	pollfds[5].fd = gzservfd;
+	pollfds[5].events = POLLIN | POLLRDNORM;
+
+	/* the server stderr socket; watch for new connections */
+	pollfds[6].fd = gzerrfd;
+	pollfds[6].events = POLLIN | POLLRDNORM;
+
+	/* the eventstream; any input means the zone is halting */
+	pollfds[7].fd = eventstream[1];
+	pollfds[7].events = pollfds[0].events;
+
+	while (!shutting_down) {
+		pollfds[0].revents = pollfds[1].revents = 0;
+		pollfds[2].revents = pollfds[3].revents = 0;
+		pollfds[4].revents = pollfds[5].revents = 0;
+		pollfds[6].revents = pollfds[7].revents = 0;
+
+		ret = poll(pollfds, 8, -1);
+		if (ret == -1 && errno != EINTR) {
+			zerror(&logplat, B_TRUE, "poll failed");
+			/* we are hosed, close connection */
+			break;
+		}
+
+		/* control events from client */
+		if (pollfds[0].revents &
+		    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
+			/* process control message */
+			ctlcmd_process(ctlfd, stdoutfd, &flags);
+		} else if (pollfds[0].revents) {
+			/* bail if any error occurs */
+			pollerr = pollfds[0].revents;
+			zerror(&logplat, B_FALSE, "closing connection "
+			    "with control channel, pollerr %d\n", pollerr);
+			break;
+		}
+
+		/* event from client side */
+		if (pollfds[1].revents) {
+			if (stdin_ready) {
+				if (pollfds[1].revents & (POLLIN |
+				    POLLRDNORM | POLLRDBAND | POLLPRI)) {
+					errno = 0;
+					cc = read(clifd, ibuf, BUFSIZ);
+					if (cc > 0) {
+						/*
+						 * See comment for this
+						 * function on what happens if
+						 * there is no reader in the
+						 * zone. EOF is handled below.
+						 */
+						(void) write(stdinfd, ibuf, cc);
+					}
+				} else if (pollfds[1].revents & (POLLERR |
+				    POLLNVAL))  {
+					pollerr = pollfds[1].revents;
+					zerror(&logplat, B_FALSE,
+					    "closing connection "
+					    "with client, pollerr %d\n",
+					    pollerr);
+					break;
+				}
+
+				if (pollfds[1].revents & POLLHUP) {
+					if (flags & ZLOGIN_ZFD_EOF) {
+						/*
+						 * Let the client know. We've
+						 * already serviced any pending
+						 * regular input. Let the
+						 * stream clear since the EOF
+						 * ioctl jumps to the head.
+						 */
+						(void) ioctl(stdinfd, I_FLUSH);
+						if (halt_sleep(250))
+							break;
+						(void) ioctl(stdinfd, ZFD_EOF);
+					}
+					break;
+				}
+			} else {
+				if (ioctl(stdinfd, ZFD_HAS_SLAVE) == 0) {
+					stdin_ready = B_TRUE;
+				} else {
+					/*
+					 * There is nothing in the zone to read
+					 * our input. Presumably the user
+					 * providing input expects something to
+					 * show up, but that is no guarantee.
+					 * Since we haven't serviced the pending
+					 * input poll yet, we don't want to
+					 * immediately loop around but we also
+					 * need to be responsive if the zone is
+					 * halting.
+					 */
+					if (halt_sleep(slptime))
+						break;
+
+					if (slptime < 5000)
+						slptime += 250;
+				}
+			}
+		}
+
+		/* event from the zone's stdout */
+		if (pollfds[2].revents) {
+			if (pollfds[2].revents &
+			    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
+				errno = 0;
+				cc = read(stdoutfd, ibuf, BUFSIZ);
+				/* zfd is a stream, so ignore 0 length read */
+				if (cc < 0 && (errno != EINTR) &&
+				    (errno != EAGAIN))
+					break;
+				if (cc > 0) {
+					logstream_write(logout, ibuf, cc);
+
+					/*
+					 * Lose output if no one is listening,
+					 * otherwise pass it on.
+					 */
+					if (clifd != -1)
+						(void) write(clifd, ibuf, cc);
+				}
+			} else {
+				pollerr = pollfds[2].revents;
+				zerror(&logplat, B_FALSE,
+				    "closing connection with stdout zfd, "
+				    "pollerr %d\n", pollerr);
+				break;
+			}
+		}
+
+		/* event from the zone's stderr */
+		if (pollfds[3].revents) {
+			if (pollfds[3].revents &
+			    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
+				errno = 0;
+				cc = read(stderrfd, ibuf, BUFSIZ);
+				/* zfd is a stream, so ignore 0 length read */
+				if (cc < 0 && (errno != EINTR) &&
+				    (errno != EAGAIN))
+					break;
+				if (cc > 0) {
+					logstream_write(logerr, ibuf, cc);
+
+					/*
+					 * Lose output if no one is listening,
+					 * otherwise pass it on.
+					 */
+					if (clierrfd != -1)
+						(void) write(clierrfd, ibuf,
+						    cc);
+				}
+			} else {
+				pollerr = pollfds[3].revents;
+				zerror(&logplat, B_FALSE,
+				    "closing connection with stderr zfd, "
+				    "pollerr %d\n", pollerr);
+				break;
+			}
+		}
+
+		/* connect event from server control socket */
+		if (pollfds[4].revents) {
+			if (ctlfd != -1) {
+				/*
+				 * Test the client to see if it is really
+				 * still alive.  If it has died but we
+				 * haven't yet detected that, we might
+				 * deny a legitimate connect attempt.  If it
+				 * is dead, we break out; once we tear down
+				 * the old connection, the new connection
+				 * will happen.
+				 */
+				if (test_client(ctlfd) == -1) {
+					break;
+				}
+				/* we're already handling a client */
+				reject_client(gzctlfd, clipid);
+			} else {
+				ctlfd = accept_client(gzctlfd, &clipid,
+				    clilocale, sizeof (clilocale), &flags);
+				if (ctlfd != -1) {
+					pollfds[0].fd = ctlfd;
+				} else {
+					break;
+				}
+			}
+		}
+
+		/* connect event from server stdin/out socket */
+		if (pollfds[5].revents) {
+			if (ctlfd == -1) {
+				/*
+				 * This shouldn't happen since the client is
+				 * expected to connect on the control socket
+				 * first. If we see this, tear everything down
+				 * and start over.
+				 */
+				zerror(&logplat, B_FALSE, "GZ zfd stdin/stdout "
+				    "connection attempt with no GZ control\n");
+				break;
+			}
+			assert(clifd == -1);
+			if ((clifd = accept_socket(gzservfd, clipid)) != -1) {
+				/* No need to watch for other new connections */
+				pollfds[5].fd = -1;
+				/* Client input is of interest, though */
+				pollfds[1].fd = clifd;
+			} else {
+				break;
+			}
+		}
+
+		/* connection event from server stderr socket */
+		if (pollfds[6].revents) {
+			if (ctlfd == -1) {
+				/*
+				 * Same conditions apply to stderr as stdin/out.
+				 */
+				zerror(&logplat, B_FALSE, "GZ zfd stderr "
+				    "connection attempt with no GZ control\n");
+				break;
+			}
+			assert(clierrfd == -1);
+			if ((clierrfd = accept_socket(gzerrfd, clipid)) != -1) {
+				/* No need to watch for other new connections */
+				pollfds[6].fd = -1;
+			} else {
+				break;
+			}
+		}
+
+		/*
+		 * Watch for events on the eventstream.  This is how we get
+		 * notified of the zone halting, etc.  It provides us a
+		 * "wakeup" from poll when important things happen, which
+		 * is good.
+		 */
+		if (pollfds[7].revents) {
+			break;
+		}
+	}
+
+	if (clifd != -1) {
+		(void) shutdown(clifd, SHUT_RDWR);
+		(void) close(clifd);
+	}
+
+	if (clierrfd != -1) {
+		(void) shutdown(clierrfd, SHUT_RDWR);
+		(void) close(clierrfd);
+	}
+}
+
+static int
+open_fd(int id, int rw)
+{
+	int fd;
+	int flag = O_NONBLOCK | O_NOCTTY | O_CLOEXEC;
+	int retried = 0;
+	char stdpath[MAXPATHLEN];
+
+	(void) snprintf(stdpath, sizeof (stdpath), "/dev/zfd/%s/master/%d",
+	    zone_name, id);
+	flag |= rw;
+
+	while (!shutting_down) {
+		if ((fd = open(stdpath, flag)) != -1) {
+			/*
+			 * Setting RPROTDIS on the stream means that the
+			 * control portion of messages received (which we don't
+			 * care about) will be discarded by the stream head. If
+			 * we allowed such messages, we wouldn't be able to use
+			 * read(2), as it fails (EBADMSG) when a message with a
+			 * control element is received.
+			 */
+			if (ioctl(fd, I_SRDOPT, RNORM|RPROTDIS) == -1) {
+				zerror(&logplat, B_TRUE,
+				    "failed to set options on zfd");
+				return (-1);
+			}
+			return (fd);
+		}
+
+		if (retried++ > 60)
+			break;
+
+		(void) sleep(1);
+	}
+
+	zerror(&logplat, B_TRUE, "failed to open zfd");
+	return (-1);
+}
+
+/*
+ * Body of the worker thread to log the zfd's stdout and stderr to a log file
+ * and to perform interactive IO to the stdin, stdout and stderr zfd's.
+ *
+ * The stdin, stdout and stderr are from the perspective of the process inside
+ * the zone, so the zoneadmd view is opposite (i.e. we write to the stdin fd
+ * and read from the stdout/stderr fds).
+ */
+static void
+srvr(void *modearg)
+{
+	zfd_mode_t *mode = (zfd_mode_t *)modearg;
+	int gzctlfd = -1;
+	int gzoutfd = -1;
+	int stdinfd = -1;
+	int stdoutfd = -1;
+	int gzerrfd = -1;
+	int stderrfd = -1;
+	int flags;
+	int len;
+	char ibuf[BUFSIZ + 1];
+	int logout = -1;
+	int logerr = -1;
+
+	if (!shutting_down && mode->zmode_gzlogging) {
+		logout = logstream_open(log_name, "stdout", 0);
+		logerr = logstream_open(log_name, "stderr", 0);
+	}
+
+	if (!shutting_down) {
+		if (pipe(eventstream) != 0) {
+			zerror(&logplat, B_TRUE, "failed to open logger "
+			    "control pipe");
+			return;
+		}
+	}
+
+	while (!shutting_down) {
+		if (init_server_sock(&gzctlfd, "ctl") == -1) {
+			zerror(&logplat, B_FALSE,
+			    "server setup: control socket init failed");
+			goto death;
+		}
+		if (init_server_sock(&gzoutfd, "out") == -1) {
+			zerror(&logplat, B_FALSE,
+			    "server setup: stdout socket init failed");
+			goto death;
+		}
+		if (init_server_sock(&gzerrfd, "err") == -1) {
+			zerror(&logplat, B_FALSE,
+			    "server setup: stderr socket init failed");
+			goto death;
+		}
+
+		if (mode->zmode_n_stddevs == 1) {
+			if ((stdinfd = open_fd(0, O_RDWR)) == -1) {
+				goto death;
+			}
+			stdoutfd = stdinfd;
+		} else {
+			if ((stdinfd = open_fd(0, O_WRONLY)) == -1 ||
+			    (stdoutfd = open_fd(1, O_RDONLY)) == -1 ||
+			    (stderrfd = open_fd(2, O_RDONLY)) == -1) {
+				goto death;
+			}
+		}
+
+		do_zfd_io(gzctlfd, gzoutfd, gzerrfd, stdinfd, stdoutfd,
+		    stderrfd, logout, logerr);
+death:
+		destroy_server_sock(gzctlfd, "ctl");
+		destroy_server_sock(gzoutfd, "out");
+		destroy_server_sock(gzerrfd, "err");
+
+		/* when shutting down, leave open until drained */
+		if (!shutting_down) {
+			(void) close(stdinfd);
+			if (mode->zmode_n_stddevs == 3) {
+				(void) close(stdoutfd);
+				(void) close(stderrfd);
+			}
+		}
+	}
+
+	/*
+	 * Attempt to drain remaining log output from the zone prior to closing
+	 * the file descriptors. This helps ensure that complete logs are
+	 * captured during shutdown.
+	 */
+	flags = fcntl(stdoutfd, F_GETFL, 0);
+	if (fcntl(stdoutfd, F_SETFL, flags | O_NONBLOCK) != -1) {
+		while ((len = read(stdoutfd, ibuf, BUFSIZ)) > 0) {
+			logstream_write(logout, ibuf, len);
+		}
+	}
+	(void) close(stdoutfd);
+
+	if (mode->zmode_n_stddevs > 1) {
+		(void) close(stdinfd);
+		flags = fcntl(stderrfd, F_GETFL, 0);
+		if (fcntl(stderrfd, F_SETFL, flags | O_NONBLOCK) != -1) {
+			while ((len = read(stderrfd, ibuf, BUFSIZ)) > 0) {
+				logstream_write(logerr, ibuf, len);
+			}
+		}
+		(void) close(stderrfd);
+	}
+
+
+	(void) close(eventstream[0]);
+	eventstream[0] = -1;
+	(void) close(eventstream[1]);
+	eventstream[1] = -1;
+	logstream_close(logout);
+	logstream_close(logerr);
+}
+
+/*
+ * The meaning of the original legacy values for the zlog-mode evolved over
+ * time, to the point where the old names no longer made sense. The current
+ * values are simply positional letters used to indicate various capabilities.
+ * The following table shows the meaning of the mode values, along with the
+ * legacy name which we continue to support for compatability. Any future
+ * capability can add a letter to the left and '-' is implied for existing
+ * strings.
+ *
+ * zlog-mode    gz log - tty - ngz log
+ * ---------    ------   ---   -------
+ * gt- (int)       y      y       n
+ * g-- (log)       y      n       n
+ * gtn (nlint)     y      y       y
+ * g-n (nolog)     y      n       y
+ * -t-             n      y       n
+ * ---             n      n       n
+ *
+ * This function also obtains any custom name for stdio.log while it is reading
+ * the zone configuration.
+ */
+static void
+get_mode_logmax(zfd_mode_t *mode)
+{
+	zone_dochandle_t handle;
+	struct zone_attrtab attr;
+
+	bzero(mode, sizeof (zfd_mode_t));
+
+	if ((handle = zonecfg_init_handle()) == NULL)
+		return;
+
+	if (zonecfg_get_handle(zone_name, handle) != Z_OK)
+		goto done;
+
+	if (zonecfg_setattrent(handle) != Z_OK)
+		goto done;
+	while (zonecfg_getattrent(handle, &attr) == Z_OK) {
+		if (strcmp(ZLOG_MODE, attr.zone_attr_name) == 0) {
+			if (strcmp("g--", attr.zone_attr_value) == 0 ||
+			    strncmp("log", attr.zone_attr_value, 3) == 0) {
+				mode->zmode_gzlogging = B_TRUE;
+				mode->zmode_n_stddevs = 3;
+				mode->zmode_n_addl_devs = 0;
+			} else if (strcmp("g-n", attr.zone_attr_value) == 0 ||
+			    strncmp("nolog", attr.zone_attr_value, 5) == 0) {
+				mode->zmode_gzlogging = B_TRUE;
+				mode->zmode_n_stddevs = 3;
+				mode->zmode_n_addl_devs = 2;
+			} else if (strcmp("gt-", attr.zone_attr_value) == 0 ||
+			    strncmp("int", attr.zone_attr_value, 3) == 0) {
+				mode->zmode_gzlogging = B_TRUE;
+				mode->zmode_n_stddevs = 1;
+				mode->zmode_n_addl_devs = 0;
+			} else if (strcmp("gtn", attr.zone_attr_value) == 0 ||
+			    strncmp("nlint", attr.zone_attr_value, 5) == 0) {
+				mode->zmode_gzlogging = B_TRUE;
+				mode->zmode_n_stddevs = 1;
+				mode->zmode_n_addl_devs = 1;
+			} else if (strcmp("-t-", attr.zone_attr_value) == 0) {
+				mode->zmode_gzlogging = B_FALSE;
+				mode->zmode_n_stddevs = 1;
+				mode->zmode_n_addl_devs = 0;
+			} else if (strcmp("---", attr.zone_attr_value) == 0) {
+				mode->zmode_gzlogging = B_FALSE;
+				mode->zmode_n_stddevs = 3;
+				mode->zmode_n_addl_devs = 0;
+			}
+			continue;
+		}
+
+		if (strcmp(ZLOG_NAME, attr.zone_attr_name) == 0) {
+			(void) strlcpy(log_name, attr.zone_attr_value,
+			    sizeof (log_name));
+			continue;
+		}
+	}
+	(void) zonecfg_endattrent(handle);
+
+done:
+	zonecfg_fini_handle(handle);
+}
+
+void
+create_log_thread(zlog_t *zlogp)
+{
+	int res;
+
+	shutting_down = 0;
+
+	get_mode_logmax(&mode);
+	if (mode.zmode_n_stddevs == 0)
+		return;
+
+	if (init_zfd_devs(zlogp, &mode) == -1) {
+		zerror(zlogp, B_FALSE,
+		    "zfd setup: device initialization failed");
+		return;
+	}
+
+	res = thr_create(NULL, 0, (void * (*)(void *))srvr, (void *)&mode, 0,
+	    &logger_tid);
+	if (res != 0) {
+		zerror(zlogp, B_FALSE, "error %d creating logger thread", res);
+		logger_tid = 0;
+	}
+}
+
+void
+destroy_log_thread(zlog_t *zlogp)
+{
+	if (logger_tid != 0) {
+		int stop = 1;
+
+		shutting_down = 1;
+		/* break out of poll to shutdown */
+		if (eventstream[0] != -1)
+			(void) write(eventstream[0], &stop, sizeof (stop));
+		(void) thr_join(logger_tid, NULL, NULL);
+		logger_tid = 0;
+	}
+
+	(void) destroy_zfd_devs(zlogp);
+}
diff --git a/usr/src/cmd/zoneadmd/zoneadmd.c b/usr/src/cmd/zoneadmd/zoneadmd.c
index 3d265063e7..71ded8ba0c 100644
--- a/usr/src/cmd/zoneadmd/zoneadmd.c
+++ b/usr/src/cmd/zoneadmd/zoneadmd.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  * Copyright (c) 2016 by Delphix. All rights reserved.
  */
 
@@ -69,6 +70,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/sysmacros.h>
+#include <sys/time.h>
 
 #include <bsm/adt.h>
 #include <bsm/adt_event.h>
@@ -102,6 +104,8 @@
 #include <libdladm.h>
 #include <sys/dls_mgmt.h>
 #include <libscf.h>
+#include <uuid/uuid.h>
+#include <libppt.h>
 
 #include <libzonecfg.h>
 #include <zonestat_impl.h>
@@ -109,6 +113,8 @@
 
 static char *progname;
 char *zone_name;	/* zone which we are managing */
+zone_dochandle_t snap_hndl;	/* handle for snapshot created when ready */
+char zonepath[MAXNAMELEN];
 char pool_name[MAXNAMELEN];
 char default_brand[MAXNAMELEN];
 char brand_name[MAXNAMELEN];
@@ -117,13 +123,15 @@ boolean_t zone_iscluster;
 boolean_t zone_islabeled;
 boolean_t shutdown_in_progress;
 static zoneid_t zone_id;
+static zoneid_t zone_did = 0;
 dladm_handle_t dld_handle = NULL;
 
-static char pre_statechg_hook[2 * MAXPATHLEN];
-static char post_statechg_hook[2 * MAXPATHLEN];
+char pre_statechg_hook[2 * MAXPATHLEN];
+char post_statechg_hook[2 * MAXPATHLEN];
 char query_hook[2 * MAXPATHLEN];
 
-zlog_t logsys;
+zlog_t logsys;			/* log to syslog */
+zlog_t logplat;			/* log to platform.log */
 
 mutex_t	lock = DEFAULTMUTEX;	/* to serialize stuff */
 mutex_t	msglock = DEFAULTMUTEX;	/* for calling setlocale() */
@@ -136,12 +144,17 @@ static int	zone_door = -1;
 boolean_t in_death_throes = B_FALSE;	/* daemon is dying */
 boolean_t bringup_failure_recovery = B_FALSE; /* ignore certain failures */
 
+static int platloghdl = -1;	/* Handle for <zonepath>/logs/platform.log */
+
 #if !defined(TEXT_DOMAIN)		/* should be defined by cc -D */
 #define	TEXT_DOMAIN	"SYS_TEST"	/* Use this only if it wasn't */
 #endif
 
 #define	DEFAULT_LOCALE	"C"
 
+#define	RSRC_NET	"net"
+#define	RSRC_DEV	"device"
+
 static const char *
 z_cmd_name(zone_cmd_t zcmd)
 {
@@ -215,17 +228,14 @@ zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...)
 {
 	va_list alist;
 	char buf[MAXPATHLEN * 2]; /* enough space for err msg with a path */
-	char *bp;
+	char *bp, *bp_nozone;
 	int saved_errno = errno;
 
-	if (zlogp == NULL)
-		return;
 	if (zlogp == &logsys)
-		(void) snprintf(buf, sizeof (buf), "[zone '%s'] ",
-		    zone_name);
+		(void) snprintf(buf, sizeof (buf), "[zone '%s'] ", zone_name);
 	else
 		buf[0] = '\0';
-	bp = &(buf[strlen(buf)]);
+	bp = bp_nozone = &(buf[strlen(buf)]);
 
 	/*
 	 * In theory, the locale pointer should be set to either "C" or a
@@ -242,15 +252,38 @@ zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...)
 	if (use_strerror)
 		(void) snprintf(bp, sizeof (buf) - (bp - buf), ": %s",
 		    strerror(saved_errno));
+
+	(void) strlcat(buf, "\n", sizeof (buf));
+
+	/*
+	 * If we don't have the platform log, we are in a child process, and
+	 * should log to stderr (which is a pipe) instead of the file.
+	 */
+	if (logging_poisoned) {
+		(void) fprintf(stderr, "%s", buf);
+
+		if (zlogp != &logsys && zlogp->logfile == stderr)
+			return;
+	} else {
+		logstream_write(platloghdl, bp_nozone, strlen(bp_nozone));
+
+		if (zlogp == &logplat)
+			return;
+	}
+
 	if (zlogp == &logsys) {
+		bp = strrchr(buf, '\n');
+		if (bp != NULL && bp[1] == '\0') {
+			*bp = '\0';
+		}
 		(void) syslog(LOG_ERR, "%s", buf);
 	} else if (zlogp->logfile != NULL) {
-		(void) fprintf(zlogp->logfile, "%s\n", buf);
+		(void) fprintf(zlogp->logfile, "%s", buf);
 	} else {
 		size_t buflen;
 		size_t copylen;
 
-		buflen = snprintf(zlogp->log, zlogp->loglen, "%s\n", buf);
+		buflen = snprintf(zlogp->log, zlogp->loglen, "%s", buf);
 		copylen = MIN(buflen, zlogp->loglen);
 		zlogp->log += copylen;
 		zlogp->loglen -= copylen;
@@ -258,34 +291,43 @@ zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...)
 }
 
 /*
- * Emit a warning for any boot arguments which are unrecognized.  Since
- * Solaris boot arguments are getopt(3c) compatible (see kernel(1m)), we
+ * Append src to dest, modifying dest in the process. Prefix src with
+ * a space character if dest is a non-empty string.
+ */
+static void
+strnappend(char *dest, size_t n, const char *src)
+{
+	(void) snprintf(dest, n, "%s%s%s", dest,
+	    dest[0] == '\0' ? "" : " ", src);
+}
+
+/*
+ * Since illumos boot arguments are getopt(3c) compatible (see kernel(1m)), we
  * put the arguments into an argv style array, use getopt to process them,
- * and put the resultant argument string back into outargs.
+ * and put the resultant argument string back into outargs. Non-native brands
+ * may support alternate forms of boot arguments so we must handle that as well.
  *
  * During the filtering, we pull out any arguments which are truly "boot"
  * arguments, leaving only those which are to be passed intact to the
  * progenitor process.  The one we support at the moment is -i, which
  * indicates to the kernel which program should be launched as 'init'.
  *
- * A return of Z_INVAL indicates specifically that the arguments are
- * not valid; this is a non-fatal error.  Except for Z_OK, all other return
- * values are treated as fatal.
+ * Except for Z_OK, all other return values are treated as fatal.
  */
 static int
 filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs,
-    char *init_file, char *badarg)
+    char *init_file)
 {
 	int argc = 0, argc_save;
 	int i;
-	int err;
+	int err = Z_OK;
 	char *arg, *lasts, **argv = NULL, **argv_save;
 	char zonecfg_args[BOOTARGS_MAX];
 	char scratchargs[BOOTARGS_MAX], *sargs;
+	char scratchopt[3];
 	char c;
 
 	bzero(outargs, BOOTARGS_MAX);
-	bzero(badarg, BOOTARGS_MAX);
 
 	/*
 	 * If the user didn't specify transient boot arguments, check
@@ -293,25 +335,10 @@ filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs,
 	 * and use them if applicable.
 	 */
 	if (inargs == NULL || inargs[0] == '\0')  {
-		zone_dochandle_t handle;
-		if ((handle = zonecfg_init_handle()) == NULL) {
-			zerror(zlogp, B_TRUE,
-			    "getting zone configuration handle");
-			return (Z_BAD_HANDLE);
-		}
-		err = zonecfg_get_snapshot_handle(zone_name, handle);
-		if (err != Z_OK) {
-			zerror(zlogp, B_FALSE,
-			    "invalid configuration snapshot");
-			zonecfg_fini_handle(handle);
-			return (Z_BAD_HANDLE);
-		}
-
 		bzero(zonecfg_args, sizeof (zonecfg_args));
-		(void) zonecfg_get_bootargs(handle, zonecfg_args,
+		(void) zonecfg_get_bootargs(snap_hndl, zonecfg_args,
 		    sizeof (zonecfg_args));
 		inargs = zonecfg_args;
-		zonecfg_fini_handle(handle);
 	}
 
 	if (strlen(inargs) >= BOOTARGS_MAX) {
@@ -348,14 +375,22 @@ filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs,
 	}
 
 	/*
-	 * We preserve compatibility with the Solaris system boot behavior,
+	 * We preserve compatibility with the illumos system boot behavior,
 	 * which allows:
 	 *
 	 * 	# reboot kernel/unix -s -m verbose
 	 *
-	 * In this example, kernel/unix tells the booter what file to
-	 * boot.  We don't want reboot in a zone to be gratuitously different,
-	 * so we silently ignore the boot file, if necessary.
+	 * In this example, kernel/unix tells the booter what file to boot. The
+	 * original intent of this was that we didn't want reboot in a zone to
+	 * be gratuitously different, so we would silently ignore the boot
+	 * file, if necessary. However, this usage is archaic and has never
+	 * been common, since it is impossible to boot a zone onto a different
+	 * kernel. Ignoring the first argument breaks for non-native brands
+	 * which pass boot arguments in a different style. e.g.
+	 *	systemd.log_level=debug
+	 * Thus, for backward compatibility we only ignore the first argument
+	 * if it appears to be in the illumos form and attempting to specify a
+	 * kernel.
 	 */
 	if (argv[0] == NULL)
 		goto done;
@@ -363,7 +398,7 @@ filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs,
 	assert(argv[0][0] != ' ');
 	assert(argv[0][0] != '\t');
 
-	if (argv[0][0] != '-' && argv[0][0] != '\0') {
+	if (strncmp(argv[0], "kernel/", 7) == 0) {
 		argv = &argv[1];
 		argc--;
 	}
@@ -386,41 +421,35 @@ filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs,
 		case 'm':
 		case 's':
 			/* These pass through unmolested */
-			(void) snprintf(outargs, BOOTARGS_MAX,
-			    "%s -%c %s ", outargs, c, optarg ? optarg : "");
+			(void) snprintf(scratchopt, sizeof (scratchopt),
+			    "-%c", c);
+			strnappend(outargs, BOOTARGS_MAX, scratchopt);
+			if (optarg != NULL)
+				strnappend(outargs, BOOTARGS_MAX, optarg);
 			break;
 		case '?':
 			/*
-			 * We warn about unknown arguments but pass them
-			 * along anyway-- if someone wants to develop their
-			 * own init replacement, they can pass it whatever
-			 * args they want.
+			 * If a brand has its own init, we need to pass along
+			 * whatever the user provides. We use the entire
+			 * unknown string here so that we correctly handle
+			 * unknown long options (e.g. --debug).
 			 */
-			err = Z_INVAL;
-			(void) snprintf(outargs, BOOTARGS_MAX,
-			    "%s -%c", outargs, optopt);
-			(void) snprintf(badarg, BOOTARGS_MAX,
-			    "%s -%c", badarg, optopt);
+			strnappend(outargs, BOOTARGS_MAX, argv[optind - 1]);
 			break;
 		}
 	}
 
 	/*
-	 * For Solaris Zones we warn about and discard non-option arguments.
-	 * Hence 'boot foo bar baz gub' --> 'boot'.  However, to be similar
-	 * to the kernel, we concat up all the other remaining boot args.
-	 * and warn on them as a group.
+	 * We need to pass along everything else since we don't know what
+	 * the brand's init is expecting. For example, an argument list like:
+	 *   --confdir /foo --debug
+	 * will cause the getopt parsing to stop at '/foo' but we need to pass
+	 * that on, along with the '--debug'. This does mean that we require
+	 * any of our known options (-ifms) to preceed the brand-specific ones.
 	 */
-	if (optind < argc) {
-		err = Z_INVAL;
-		while (optind < argc) {
-			(void) snprintf(badarg, BOOTARGS_MAX, "%s%s%s",
-			    badarg, strlen(badarg) > 0 ? " " : "",
-			    argv[optind]);
-			optind++;
-		}
-		zerror(zlogp, B_FALSE, "WARNING: Unused or invalid boot "
-		    "arguments `%s'.", badarg);
+	while (optind < argc) {
+		strnappend(outargs, BOOTARGS_MAX, argv[optind]);
+		optind++;
 	}
 
 done:
@@ -459,7 +488,7 @@ mkzonedir(zlog_t *zlogp)
  * Run the brand's pre-state change callback, if it exists.
  */
 static int
-brand_prestatechg(zlog_t *zlogp, int state, int cmd)
+brand_prestatechg(zlog_t *zlogp, int state, int cmd, boolean_t debug)
 {
 	char cmdbuf[2 * MAXPATHLEN];
 	const char *altroot;
@@ -472,7 +501,7 @@ brand_prestatechg(zlog_t *zlogp, int state, int cmd)
 	    state, cmd, altroot) > sizeof (cmdbuf))
 		return (-1);
 
-	if (do_subproc(zlogp, cmdbuf, NULL) != 0)
+	if (do_subproc(zlogp, cmdbuf, NULL, debug) != 0)
 		return (-1);
 
 	return (0);
@@ -482,7 +511,7 @@ brand_prestatechg(zlog_t *zlogp, int state, int cmd)
  * Run the brand's post-state change callback, if it exists.
  */
 static int
-brand_poststatechg(zlog_t *zlogp, int state, int cmd)
+brand_poststatechg(zlog_t *zlogp, int state, int cmd, boolean_t debug)
 {
 	char cmdbuf[2 * MAXPATHLEN];
 	const char *altroot;
@@ -495,7 +524,7 @@ brand_poststatechg(zlog_t *zlogp, int state, int cmd)
 	    state, cmd, altroot) > sizeof (cmdbuf))
 		return (-1);
 
-	if (do_subproc(zlogp, cmdbuf, NULL) != 0)
+	if (do_subproc(zlogp, cmdbuf, NULL, debug) != 0)
 		return (-1);
 
 	return (0);
@@ -532,37 +561,51 @@ notify_zonestatd(zoneid_t zoneid)
  * Bring a zone up to the pre-boot "ready" stage.  The mount_cmd argument is
  * 'true' if this is being invoked as part of the processing for the "mount"
  * subcommand.
+ *
+ * If a scratch zone mount (ALT_MOUNT) is being performed then do not
+ * call the state change hooks.
  */
 static int
-zone_ready(zlog_t *zlogp, zone_mnt_t mount_cmd, int zstate)
+zone_ready(zlog_t *zlogp, zone_mnt_t mount_cmd, int zstate, boolean_t debug)
 {
 	int err;
+	boolean_t snapped = B_FALSE;
 
-	if (brand_prestatechg(zlogp, zstate, Z_READY) != 0)
-		return (-1);
-
+	if ((snap_hndl = zonecfg_init_handle()) == NULL) {
+		zerror(zlogp, B_TRUE, "getting zone configuration handle");
+		goto bad;
+	}
 	if ((err = zonecfg_create_snapshot(zone_name)) != Z_OK) {
 		zerror(zlogp, B_FALSE, "unable to create snapshot: %s",
 		    zonecfg_strerror(err));
 		goto bad;
 	}
+	snapped = B_TRUE;
 
-	if ((zone_id = vplat_create(zlogp, mount_cmd)) == -1) {
-		if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
-			zerror(zlogp, B_FALSE, "destroying snapshot: %s",
-			    zonecfg_strerror(err));
+	if (zonecfg_get_snapshot_handle(zone_name, snap_hndl) != Z_OK) {
+		zerror(zlogp, B_FALSE, "invalid configuration snapshot");
 		goto bad;
 	}
+
+	if (zone_did == 0)
+		zone_did = zone_get_did(zone_name);
+
+	if (!ALT_MOUNT(mount_cmd) &&
+	    brand_prestatechg(zlogp, zstate, Z_READY, debug) != 0)
+		goto bad;
+
+	if ((zone_id = vplat_create(zlogp, mount_cmd, zone_did)) == -1)
+		goto bad;
+
 	if (vplat_bringup(zlogp, mount_cmd, zone_id) != 0) {
 		bringup_failure_recovery = B_TRUE;
-		(void) vplat_teardown(NULL, (mount_cmd != Z_MNT_BOOT), B_FALSE);
-		if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
-			zerror(zlogp, B_FALSE, "destroying snapshot: %s",
-			    zonecfg_strerror(err));
+		(void) vplat_teardown(NULL, (mount_cmd != Z_MNT_BOOT), B_FALSE,
+		    debug);
 		goto bad;
 	}
 
-	if (brand_poststatechg(zlogp, zstate, Z_READY) != 0)
+	if (!ALT_MOUNT(mount_cmd) &&
+	    brand_poststatechg(zlogp, zstate, Z_READY, debug) != 0)
 		goto bad;
 
 	return (0);
@@ -572,7 +615,16 @@ bad:
 	 * If something goes wrong, we up the zones's state to the target
 	 * state, READY, and then invoke the hook as if we're halting.
 	 */
-	(void) brand_poststatechg(zlogp, ZONE_STATE_READY, Z_HALT);
+	if (!ALT_MOUNT(mount_cmd))
+		(void) brand_poststatechg(zlogp, ZONE_STATE_READY, Z_HALT,
+		    debug);
+
+	if (snapped)
+		if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
+			zerror(zlogp, B_FALSE, "destroying snapshot: %s",
+			    zonecfg_strerror(err));
+	zonecfg_fini_handle(snap_hndl);
+	snap_hndl = NULL;
 	return (-1);
 }
 
@@ -624,15 +676,8 @@ mount_early_fs(void *data, const char *spec, const char *dir,
 
 	/* determine the zone rootpath */
 	if (mount_cmd) {
-		char zonepath[MAXPATHLEN];
 		char luroot[MAXPATHLEN];
 
-		if (zone_get_zonepath(zone_name,
-		    zonepath, sizeof (zonepath)) != Z_OK) {
-			zerror(zlogp, B_FALSE, "unable to determine zone path");
-			return (-1);
-		}
-
 		(void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath);
 		resolve_lofs(zlogp, luroot, sizeof (luroot));
 		(void) strlcpy(rootpath, luroot, sizeof (rootpath));
@@ -687,6 +732,8 @@ mount_early_fs(void *data, const char *spec, const char *dir,
 		char opt_buf[MAX_MNTOPT_STR];
 		int optlen = 0;
 		int mflag = MS_DATA;
+		int i;
+		int ret;
 
 		(void) ct_tmpl_clear(tmpl_fd);
 		/*
@@ -714,9 +761,26 @@ mount_early_fs(void *data, const char *spec, const char *dir,
 			optlen = MAX_MNTOPT_STR;
 			mflag = MS_OPTIONSTR;
 		}
-		if (mount(spec, dir, mflag, fstype, NULL, 0, opt, optlen) != 0)
-			_exit(errno);
-		_exit(0);
+
+		/*
+		 * There is an obscure race condition which can cause mount
+		 * to return EBUSY. This happens for example on the mount
+		 * of the zone's /etc/svc/volatile file system if there is
+		 * a GZ process running svcs -Z, which will touch the
+		 * mountpoint, just as we're trying to do the mount. To cope
+		 * with this, we retry up to 3 times to let this transient
+		 * process get out of the way.
+		 */
+		for (i = 0; i < 3; i++) {
+			ret = 0;
+			if (mount(spec, dir, mflag, fstype, NULL, 0, opt,
+			    optlen) != 0)
+				ret = errno;
+			if (ret != EBUSY)
+				break;
+			(void) sleep(1);
+		}
+		_exit(ret);
 	}
 
 	/* parent */
@@ -740,18 +804,275 @@ mount_early_fs(void *data, const char *spec, const char *dir,
 }
 
 /*
+ * Replace characters other than [A-Za-z0-9_] with '_' so that the string is a
+ * valid environment variable name.
+ */
+static void
+sanitize_env_var_name(char *var)
+{
+	for (char *p = var; *p != '\0'; p++) {
+		if (!isalnum(*p)) {
+			*p = '_';
+		}
+	}
+}
+
+/*
+ * env variable name format
+ *	_ZONECFG_{resource name}_{identifying attr. name}_{property name}
+ * Any dashes (-) in the property names are replaced with underscore (_).
+ */
+static void
+set_zonecfg_env(char *rsrc, char *attr, char *name, char *val)
+{
+	/* Enough for maximal name, rsrc + attr, & slop for ZONECFG & _'s */
+	char nm[2 * MAXNAMELEN + 32];
+
+	if (attr == NULL)
+		(void) snprintf(nm, sizeof (nm), "_ZONECFG_%s_%s", rsrc,
+		    name);
+	else
+		(void) snprintf(nm, sizeof (nm), "_ZONECFG_%s_%s_%s", rsrc,
+		    attr, name);
+
+	sanitize_env_var_name(nm);
+
+	(void) setenv(nm, val, 1);
+}
+
+/*
+ * Resolve a device:match value to a path.  This is only different for PPT
+ * devices, where we expect the match property to be a /devices/... path, and
+ * configured for PPT already.
+ */
+int
+resolve_device_match(zlog_t *zlogp, struct zone_devtab *dtab,
+    char *path, size_t len)
+{
+	struct zone_res_attrtab *rap;
+
+	for (rap = dtab->zone_dev_attrp; rap != NULL;
+	    rap = rap->zone_res_attr_next) {
+		if (strcmp(rap->zone_res_attr_name, "model") == 0 &&
+		    strcmp(rap->zone_res_attr_value, "passthru") == 0)
+			break;
+	}
+
+	if (rap == NULL) {
+		if (strlcpy(path, dtab->zone_dev_match, len) >= len)
+			return (Z_INVAL);
+		return (Z_OK);
+	}
+
+	if (strncmp(dtab->zone_dev_match, "/devices",
+	    strlen("/devices")) != 0) {
+		zerror(zlogp, B_FALSE, "invalid passthru match value '%s'",
+		    dtab->zone_dev_match);
+		return (Z_INVAL);
+	}
+
+	if (ppt_devpath_to_dev(dtab->zone_dev_match, path, len) != 0) {
+		zerror(zlogp, B_TRUE, "failed to resolve passthru device %s",
+		    dtab->zone_dev_match);
+		return (Z_INVAL);
+	}
+
+	return (Z_OK);
+}
+
+/*
+ * Export various zonecfg properties into environment for the boot and state
+ * change hooks.
+ *
+ * If debug is true, _ZONEADMD_brand_debug is set to 1, else it is set to an
+ * empty string.  Brand hooks consider any non-empty string as an indication
+ * that debug output is requested.
+ *
+ * We could export more of the config in the future, as necessary.  A better
+ * solution would be to make it so brand-specific behavior is handled by
+ * brand-specific callbacks written in C.  Then the normal libzonecfg interfaces
+ * can be used for accessing any parts of the configuration that are needed.
+ *
+ * All of the environment variables set by this function are specific to
+ * SmartOS.
+ */
+static int
+setup_subproc_env(zlog_t *zlogp, boolean_t debug)
+{
+	int res;
+	struct zone_nwiftab ntab;
+	struct zone_devtab dtab;
+	struct zone_attrtab atab;
+	char net_resources[MAXNAMELEN * 2];
+	char dev_resources[MAXNAMELEN * 2];
+	char didstr[16];
+	char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
+	uuid_t uuid;
+
+	/* snap_hndl is null when called through the set_brand_env code path */
+	if (snap_hndl == NULL)
+		return (Z_OK);
+
+	if ((res = zonecfg_get_uuid(zone_name, uuid)) != Z_OK)
+		return (res);
+
+	uuid_unparse(uuid, uuidstr);
+	(void) setenv("_ZONECFG_uuid", uuidstr, 1);
+
+	(void) snprintf(didstr, sizeof (didstr), "%d", zone_did);
+	(void) setenv("_ZONECFG_did", didstr, 1);
+
+	/*
+	 * "net" resources are exported because zoneadmd does not handle
+	 * automatic configuration of vnics and so that the bhyve boot hook
+	 * can generate the argument list for the brand's init program.  At such
+	 * a time as vnic creation is handled in zoneadmd and brand callbacks
+	 * can be executed as part of the zoneadmd process this should be
+	 * removed.
+	 */
+	net_resources[0] = '\0';
+	if ((res = zonecfg_setnwifent(snap_hndl)) != Z_OK)
+		goto done;
+
+	while (zonecfg_getnwifent(snap_hndl, &ntab) == Z_OK) {
+		struct zone_res_attrtab *rap;
+		char *phys;
+
+		phys = ntab.zone_nwif_physical;
+
+		(void) strlcat(net_resources, phys, sizeof (net_resources));
+		(void) strlcat(net_resources, " ", sizeof (net_resources));
+
+		set_zonecfg_env(RSRC_NET, phys, "physical", phys);
+
+		set_zonecfg_env(RSRC_NET, phys, "address",
+		    ntab.zone_nwif_address);
+		set_zonecfg_env(RSRC_NET, phys, "allowed-address",
+		    ntab.zone_nwif_allowed_address);
+		set_zonecfg_env(RSRC_NET, phys, "defrouter",
+		    ntab.zone_nwif_defrouter);
+		set_zonecfg_env(RSRC_NET, phys, "global-nic",
+		    ntab.zone_nwif_gnic);
+		set_zonecfg_env(RSRC_NET, phys, "mac-addr", ntab.zone_nwif_mac);
+		set_zonecfg_env(RSRC_NET, phys, "vlan-id",
+		    ntab.zone_nwif_vlan_id);
+
+		for (rap = ntab.zone_nwif_attrp; rap != NULL;
+		    rap = rap->zone_res_attr_next)
+			set_zonecfg_env(RSRC_NET, phys, rap->zone_res_attr_name,
+			    rap->zone_res_attr_value);
+		nwifent_free_attrs(&ntab);
+	}
+
+	(void) setenv("_ZONECFG_net_resources", net_resources, 1);
+
+	(void) zonecfg_endnwifent(snap_hndl);
+
+	/*
+	 * "device" resources are exported because the bhyve boot brand callback
+	 * needs them to generate the argument list for the brand's init
+	 * program.  At such a time as brand callbacks can be executed as part
+	 * of the zoneadmd process, this should be removed.
+	 *
+	 * The bhyve brand only supports disk-like and ppt devices and does not
+	 * support regular expressions.
+	 */
+	if ((res = zonecfg_setdevent(snap_hndl)) != Z_OK)
+		goto done;
+
+	dev_resources[0] = '\0';
+	while (zonecfg_getdevent(snap_hndl, &dtab) == Z_OK) {
+		char *match = dtab.zone_dev_match;
+		struct zone_res_attrtab *rap;
+		char path[MAXPATHLEN];
+
+		res = resolve_device_match(zlogp, &dtab, path, sizeof (path));
+		if (res != Z_OK)
+			goto done;
+
+		/*
+		 * Even if not modified, the match path will be mangled in the
+		 * environment variable name, so we always store the value here.
+		 */
+		set_zonecfg_env(RSRC_DEV, match, "path", path);
+
+		for (rap = dtab.zone_dev_attrp; rap != NULL;
+		    rap = rap->zone_res_attr_next) {
+			set_zonecfg_env(RSRC_DEV, match,
+			    rap->zone_res_attr_name, rap->zone_res_attr_value);
+		}
+
+		/*
+		 * _ZONECFG_device_resources will contain a space separated list
+		 * of devices that have _ZONECFG_device_<device>* environment
+		 * variables.  So that each element of the list matches up with
+		 * <device>, each list item needs to be sanitized in the same
+		 * way that environment variable names are sanitized.
+		 */
+		sanitize_env_var_name(match);
+		(void) strlcat(dev_resources, match, sizeof (dev_resources));
+		(void) strlcat(dev_resources, " ", sizeof (dev_resources));
+	}
+	(void) zonecfg_enddevent(snap_hndl);
+
+	(void) setenv("_ZONECFG_device_resources", dev_resources, 1);
+
+	/*
+	 * "attr" resources are exported because the bhyve brand's boot hook
+	 * needs access to the "ram", "cpu", "bootrom", etc. to form the
+	 * argument list for the brand's init program.  Once the bhyve brand is
+	 * configured via proper resources and properties, this should be
+	 * removed.
+	 */
+	if ((res = zonecfg_setattrent(snap_hndl)) != Z_OK)
+		goto done;
+
+	while (zonecfg_getattrent(snap_hndl, &atab) == Z_OK) {
+		set_zonecfg_env("attr", NULL, atab.zone_attr_name,
+		    atab.zone_attr_value);
+	}
+
+	(void) zonecfg_endattrent(snap_hndl);
+
+	if (debug)
+		(void) setenv("_ZONEADMD_brand_debug", "1", 1);
+	else
+		(void) setenv("_ZONEADMD_brand_debug", "", 1);
+
+	res = Z_OK;
+
+done:
+	return (res);
+}
+
+void
+nwifent_free_attrs(struct zone_nwiftab *np)
+{
+	struct zone_res_attrtab *rap;
+
+	for (rap = np->zone_nwif_attrp; rap != NULL; ) {
+		struct zone_res_attrtab *tp = rap;
+
+		rap = rap->zone_res_attr_next;
+		free(tp);
+	}
+}
+
+/*
  * If retstr is not NULL, the output of the subproc is returned in the str,
  * otherwise it is output using zerror().  Any memory allocated for retstr
  * should be freed by the caller.
  */
 int
-do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr)
+do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr, boolean_t debug)
 {
 	char buf[1024];		/* arbitrary large amount */
 	char *inbuf;
 	FILE *file;
 	int status;
 	int rd_cnt;
+	int fds[2];
+	pid_t child;
 
 	if (retstr != NULL) {
 		if ((*retstr = malloc(1024)) == NULL) {
@@ -764,31 +1085,104 @@ do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr)
 		inbuf = buf;
 	}
 
-	file = popen(cmdbuf, "r");
-	if (file == NULL) {
-		zerror(zlogp, B_TRUE, "could not launch: %s", cmdbuf);
+	if (pipe(fds) != 0) {
+		zerror(zlogp, B_TRUE, "failed to create pipe for subprocess");
+		return (-1);
+	}
+
+	if ((child = fork()) == 0) {
+		int in;
+
+		/*
+		 * SIGINT is currently ignored.  It probably shouldn't be so
+		 * hard to kill errant children, so we revert to SIG_DFL.
+		 * SIGHUP and SIGUSR1 are used to perform log rotation.  We
+		 * leave those as-is because we don't want a 'pkill -HUP
+		 * zoneadmd' to kill this child process before exec().  On
+		 * exec(), SIGHUP and SIGUSR1 will become SIG_DFL.
+		 */
+		sigset(SIGINT, SIG_DFL);
+
+		/*
+		 * Set up a pipe for the child to log to.
+		 */
+		if (dup2(fds[1], STDERR_FILENO) == -1) {
+			(void) snprintf(buf, sizeof (buf),
+			    "subprocess failed to dup2(STDERR_FILENO): %s\n",
+			    strerror(errno));
+			(void) write(fds[1], buf, strlen(buf));
+			_exit(127);
+		}
+		if (dup2(fds[1], STDOUT_FILENO) == -1) {
+			perror("subprocess failed to dup2(STDOUT_FILENO)");
+			_exit(127);
+		}
+		/*
+		 * Some naughty children may try to read from stdin.  Be sure
+		 * that the first file that a child opens doesn't get stdin's
+		 * file descriptor.
+		 */
+		if ((in = open("/dev/null", O_RDONLY)) == -1 ||
+		    dup2(in, STDIN_FILENO) == -1) {
+			zerror(zlogp, B_TRUE,
+			    "subprocess failed to set up STDIN_FILENO");
+			_exit(127);
+		}
+		closefrom(STDERR_FILENO + 1);
+
+		if (setup_subproc_env(zlogp, debug) != Z_OK) {
+			zerror(zlogp, B_FALSE, "failed to setup environment");
+			_exit(127);
+		}
+
+		(void) execl("/bin/sh", "sh", "-c", cmdbuf, NULL);
+
+		zerror(zlogp, B_TRUE, "subprocess execl failed");
+		_exit(127);
+	} else if (child == -1) {
+		zerror(zlogp, B_TRUE, "failed to create subprocess for '%s'",
+		    cmdbuf);
+		(void) close(fds[0]);
+		(void) close(fds[1]);
 		return (-1);
 	}
 
+	(void) close(fds[1]);
+
+	file = fdopen(fds[0], "r");
 	while (fgets(inbuf, 1024, file) != NULL) {
 		if (retstr == NULL) {
-			if (zlogp != &logsys)
+			if (zlogp != &logsys) {
+				int last = strlen(inbuf) - 1;
+
+				if (inbuf[last] == '\n')
+					inbuf[last] = '\0';
 				zerror(zlogp, B_FALSE, "%s", inbuf);
+			}
 		} else {
 			char *p;
 
 			rd_cnt += 1024 - 1;
 			if ((p = realloc(*retstr, rd_cnt + 1024)) == NULL) {
 				zerror(zlogp, B_FALSE, "out of memory");
-				(void) pclose(file);
-				return (-1);
+				break;
 			}
 
 			*retstr = p;
 			inbuf = *retstr + rd_cnt;
 		}
 	}
-	status = pclose(file);
+
+	while (fclose(file) != 0) {
+		assert(errno == EINTR);
+	}
+	while (waitpid(child, &status, 0) == -1) {
+		if (errno != EINTR) {
+			zerror(zlogp, B_TRUE,
+			    "failed to get exit status of '%s'", cmdbuf);
+			return (-1);
+		}
+	}
 
 	if (WIFSIGNALED(status)) {
 		zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
@@ -803,24 +1197,91 @@ do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr)
 	return (WEXITSTATUS(status));
 }
 
+/*
+ * Get the path for this zone's init(1M) (or equivalent) process. First look
+ * for a zone-specific init-name attr, then get it from the brand.
+ */
+static int
+get_initname(brand_handle_t bh, char *initname, int len)
+{
+	struct zone_attrtab a;
+
+	bzero(&a, sizeof (a));
+	(void) strlcpy(a.zone_attr_name, "init-name",
+	    sizeof (a.zone_attr_name));
+
+	if (zonecfg_lookup_attr(snap_hndl, &a) == Z_OK) {
+		(void) strlcpy(initname, a.zone_attr_value, len);
+		return (0);
+	}
+
+	return (brand_get_initname(bh, initname, len));
+}
+
+/*
+ * Get the restart-init flag for this zone's init(1M) (or equivalent) process.
+ * First look for a zone-specific restart-init attr, then get it from the brand.
+ */
+static boolean_t
+restartinit(brand_handle_t bh)
+{
+	struct zone_attrtab a;
+
+	bzero(&a, sizeof (a));
+	(void) strlcpy(a.zone_attr_name, "restart-init",
+	    sizeof (a.zone_attr_name));
+
+	if (zonecfg_lookup_attr(snap_hndl, &a) == Z_OK) {
+		if (strcmp(a.zone_attr_value, "false") == 0)
+			return (B_FALSE);
+		return (B_TRUE);
+	}
+
+	return (brand_restartinit(bh));
+}
+
+/*
+ * Get the app-svc-dependent flag for this zone's init process. This is a
+ * zone-specific attr which controls the type of contract we create for the
+ * zone's init. When true, the contract will include CT_PR_EV_EXIT in the fatal
+ * set, so that when any service which is in the same contract exits, the init
+ * application will be terminated.
+ */
+static boolean_t
+is_app_svc_dep(void)
+{
+	struct zone_attrtab a;
+
+	bzero(&a, sizeof (a));
+	(void) strlcpy(a.zone_attr_name, "app-svc-dependent",
+	    sizeof (a.zone_attr_name));
+
+	if (zonecfg_lookup_attr(snap_hndl, &a) == Z_OK &&
+	    strcmp(a.zone_attr_value, "true") == 0) {
+		return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
 static int
-zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
+zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate, boolean_t debug)
 {
 	zoneid_t zoneid;
 	struct stat st;
-	char zpath[MAXPATHLEN], initpath[MAXPATHLEN], init_file[MAXPATHLEN];
+	char rpath[MAXPATHLEN], initpath[MAXPATHLEN], init_file[MAXPATHLEN];
 	char nbootargs[BOOTARGS_MAX];
 	char cmdbuf[MAXPATHLEN];
 	fs_callback_t cb;
 	brand_handle_t bh;
 	zone_iptype_t iptype;
-	boolean_t links_loaded = B_FALSE;
 	dladm_status_t status;
 	char errmsg[DLADM_STRSIZE];
 	int err;
 	boolean_t restart_init;
+	boolean_t app_svc_dep;
 
-	if (brand_prestatechg(zlogp, zstate, Z_BOOT) != 0)
+	if (brand_prestatechg(zlogp, zstate, Z_BOOT, debug) != 0)
 		return (-1);
 
 	if ((zoneid = getzoneidbyname(zone_name)) == -1) {
@@ -853,13 +1314,8 @@ zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
 	/*
 	 * Get the brand's boot callback if it exists.
 	 */
-	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
-		zerror(zlogp, B_FALSE, "unable to determine zone path");
-		brand_close(bh);
-		goto bad;
-	}
 	(void) strcpy(cmdbuf, EXEC_PREFIX);
-	if (brand_get_boot(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
+	if (brand_get_boot(bh, zone_name, zonepath, cmdbuf + EXEC_LEN,
 	    sizeof (cmdbuf) - EXEC_LEN) != 0) {
 		zerror(zlogp, B_FALSE,
 		    "unable to determine branded zone's boot callback");
@@ -868,41 +1324,50 @@ zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
 	}
 
 	/* Get the path for this zone's init(1M) (or equivalent) process.  */
-	if (brand_get_initname(bh, init_file, MAXPATHLEN) != 0) {
+	if (get_initname(bh, init_file, MAXPATHLEN) != 0) {
 		zerror(zlogp, B_FALSE,
 		    "unable to determine zone's init(1M) location");
 		brand_close(bh);
 		goto bad;
 	}
 
-	/* See if this zone's brand should restart init if it dies. */
-	restart_init = brand_restartinit(bh);
+	/* See if we should restart init if it dies. */
+	restart_init = restartinit(bh);
+
+	/*
+	 * See if we need to setup contract dependencies between the zone's
+	 * primary application and any of its services.
+	 */
+	app_svc_dep = is_app_svc_dep();
 
 	brand_close(bh);
 
-	err = filter_bootargs(zlogp, bootargs, nbootargs, init_file,
-	    bad_boot_arg);
-	if (err == Z_INVAL)
-		eventstream_write(Z_EVT_ZONE_BADARGS);
-	else if (err != Z_OK)
+	err = filter_bootargs(zlogp, bootargs, nbootargs, init_file);
+	if (err != Z_OK)
 		goto bad;
 
 	assert(init_file[0] != '\0');
 
-	/* Try to anticipate possible problems: Make sure init is executable. */
-	if (zone_get_rootpath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
+	/*
+	 * Try to anticipate possible problems: If possible, make sure init is
+	 * executable.
+	 */
+	if (zone_get_rootpath(zone_name, rpath, sizeof (rpath)) != Z_OK) {
 		zerror(zlogp, B_FALSE, "unable to determine zone root");
 		goto bad;
 	}
 
-	(void) snprintf(initpath, sizeof (initpath), "%s%s", zpath, init_file);
+	(void) snprintf(initpath, sizeof (initpath), "%s%s", rpath, init_file);
 
-	if (stat(initpath, &st) == -1) {
+	if (lstat(initpath, &st) == -1) {
 		zerror(zlogp, B_TRUE, "could not stat %s", initpath);
 		goto bad;
 	}
 
-	if ((st.st_mode & S_IXUSR) == 0) {
+	/* LINTED: E_NOP_IF_STMT */
+	if ((st.st_mode & S_IFMT) == S_IFLNK) {
+		/* symlink, we'll have to wait and resolve when we boot */
+	} else if ((st.st_mode & S_IXUSR) == 0) {
 		zerror(zlogp, B_FALSE, "%s is not executable", initpath);
 		goto bad;
 	}
@@ -920,7 +1385,6 @@ zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
 			    " %s", dladm_status2str(status, errmsg));
 			goto bad;
 		}
-		links_loaded = B_TRUE;
 	}
 
 	/*
@@ -929,7 +1393,7 @@ zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
 	 * is booted.
 	 */
 	if ((strlen(cmdbuf) > EXEC_LEN) &&
-	    (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
+	    (do_subproc(zlogp, cmdbuf, NULL, debug) != Z_OK)) {
 		zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
 		goto bad;
 	}
@@ -950,19 +1414,31 @@ zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
 		goto bad;
 	}
 
+	if (app_svc_dep && zone_setattr(zoneid, ZONE_ATTR_APP_SVC_CT,
+	    (void *)B_TRUE, sizeof (boolean_t)) == -1) {
+		zerror(zlogp, B_TRUE, "could not set zone app-die");
+		goto bad;
+	}
+
 	/*
 	 * Inform zonestatd of a new zone so that it can install a door for
 	 * the zone to contact it.
 	 */
 	notify_zonestatd(zone_id);
 
+	/* Startup a thread to perform zfd logging/tty svc for the zone. */
+	create_log_thread(zlogp);
+
 	if (zone_boot(zoneid) == -1) {
 		zerror(zlogp, B_TRUE, "unable to boot zone");
+		destroy_log_thread(zlogp);
 		goto bad;
 	}
 
-	if (brand_poststatechg(zlogp, zstate, Z_BOOT) != 0)
+	if (brand_poststatechg(zlogp, zstate, Z_BOOT, debug) != 0) {
+		destroy_log_thread(zlogp);
 		goto bad;
+	}
 
 	return (0);
 
@@ -971,32 +1447,45 @@ bad:
 	 * If something goes wrong, we up the zones's state to the target
 	 * state, RUNNING, and then invoke the hook as if we're halting.
 	 */
-	(void) brand_poststatechg(zlogp, ZONE_STATE_RUNNING, Z_HALT);
-	if (links_loaded)
-		(void) dladm_zone_halt(dld_handle, zoneid);
+	(void) brand_poststatechg(zlogp, ZONE_STATE_RUNNING, Z_HALT, debug);
+
 	return (-1);
 }
 
 static int
-zone_halt(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting, int zstate)
+zone_halt(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting, int zstate,
+    boolean_t debug)
 {
 	int err;
 
-	if (brand_prestatechg(zlogp, zstate, Z_HALT) != 0)
+	/*
+	 * If performing a scratch zone unmount then do not call the
+	 * state change hooks.
+	 */
+	if (unmount_cmd == B_FALSE &&
+	    brand_prestatechg(zlogp, zstate, Z_HALT, debug) != 0)
 		return (-1);
 
-	if (vplat_teardown(zlogp, unmount_cmd, rebooting) != 0) {
+	if (vplat_teardown(zlogp, unmount_cmd, rebooting, debug) != 0) {
 		if (!bringup_failure_recovery)
 			zerror(zlogp, B_FALSE, "unable to destroy zone");
+		destroy_log_thread(zlogp);
 		return (-1);
 	}
 
+	/* Shut down is done, stop the log thread */
+	destroy_log_thread(zlogp);
+
+	if (unmount_cmd == B_FALSE &&
+	    brand_poststatechg(zlogp, zstate, Z_HALT, debug) != 0)
+		return (-1);
+
 	if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
 		zerror(zlogp, B_FALSE, "destroying snapshot: %s",
 		    zonecfg_strerror(err));
 
-	if (brand_poststatechg(zlogp, zstate, Z_HALT) != 0)
-		return (-1);
+	zonecfg_fini_handle(snap_hndl);
+	snap_hndl = NULL;
 
 	return (0);
 }
@@ -1008,7 +1497,6 @@ zone_graceful_shutdown(zlog_t *zlogp)
 	pid_t child;
 	char cmdbuf[MAXPATHLEN];
 	brand_handle_t bh = NULL;
-	char zpath[MAXPATHLEN];
 	ctid_t ct;
 	int tmpl_fd;
 	int child_status;
@@ -1029,18 +1517,12 @@ zone_graceful_shutdown(zlog_t *zlogp)
 		return (-1);
 	}
 
-	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
-		zerror(zlogp, B_FALSE, "unable to determine zone path");
-		brand_close(bh);
-		return (-1);
-	}
-
 	/*
 	 * If there is a brand 'shutdown' callback, execute it now to give the
 	 * brand a chance to cleanup any custom configuration.
 	 */
 	(void) strcpy(cmdbuf, EXEC_PREFIX);
-	if (brand_get_shutdown(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
+	if (brand_get_shutdown(bh, zone_name, zonepath, cmdbuf + EXEC_LEN,
 	    sizeof (cmdbuf) - EXEC_LEN) != 0 || strlen(cmdbuf) <= EXEC_LEN) {
 		(void) strcat(cmdbuf, SHUTDOWN_DEFAULT);
 	}
@@ -1178,6 +1660,36 @@ audit_put_record(zlog_t *zlogp, ucred_t *uc, int return_val,
 }
 
 /*
+ * Log the exit time and status of the zone's init process into
+ * {zonepath}/lastexited. If the zone shutdown normally, the exit status will
+ * be -1, otherwise it will be the exit status as described in wait.3c.
+ * If the zone is configured to restart init, then nothing will be logged if
+ * init exits unexpectedly (the kernel will never upcall in this case).
+ */
+static void
+log_init_exit(int status)
+{
+	char p[MAXPATHLEN];
+	char buf[128];
+	struct timeval t;
+	int fd;
+
+	if (snprintf(p, sizeof (p), "%s/lastexited", zonepath) > sizeof (p))
+		return;
+	if (gettimeofday(&t, NULL) != 0)
+		return;
+	if (snprintf(buf, sizeof (buf), "%ld.%ld %d\n", t.tv_sec, t.tv_usec,
+	    status) > sizeof (buf))
+		return;
+	if ((fd = open(p, O_WRONLY | O_CREAT | O_TRUNC, 0644)) < 0)
+		return;
+
+	(void) write(fd, buf, strlen(buf));
+
+	(void) close(fd);
+}
+
+/*
  * The main routine for the door server that deals with zone state transitions.
  */
 /* ARGSUSED */
@@ -1190,9 +1702,11 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 
 	zone_state_t zstate;
 	zone_cmd_t cmd;
+	boolean_t debug;
+	int init_status;
 	zone_cmd_arg_t *zargp;
 
-	boolean_t kernelcall;
+	boolean_t kernelcall = B_TRUE;
 
 	int rval = -1;
 	uint64_t uniqid;
@@ -1213,6 +1727,8 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 	 * it is time for us to shut down zoneadmd.
 	 */
 	if (zargp == DOOR_UNREF_DATA) {
+		logstream_close(platloghdl);
+
 		/*
 		 * See comment at end of main() for info on the last rites.
 		 */
@@ -1242,6 +1758,8 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 		goto out;
 	}
 	cmd = zargp->cmd;
+	debug = zargp->debug;
+	init_status = zargp->status;
 
 	if (door_ucred(&uc) != 0) {
 		zerror(&logsys, B_TRUE, "door_ucred");
@@ -1322,7 +1840,7 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 			rval = -1;
 			goto out;
 		}
-		zlogp = &logsys;	/* Log errors to syslog */
+		zlogp = &logplat;	/* Log errors to platform.log */
 	}
 
 	/*
@@ -1348,23 +1866,25 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 	case ZONE_STATE_INSTALLED:
 		switch (cmd) {
 		case Z_READY:
-			rval = zone_ready(zlogp, Z_MNT_BOOT, zstate);
+			rval = zone_ready(zlogp, Z_MNT_BOOT, zstate, debug);
 			if (rval == 0)
 				eventstream_write(Z_EVT_ZONE_READIED);
+			zcons_statechanged();
 			break;
 		case Z_BOOT:
 		case Z_FORCEBOOT:
 			eventstream_write(Z_EVT_ZONE_BOOTING);
-			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate))
-			    == 0) {
+			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate,
+			    debug)) == 0) {
 				rval = zone_bootup(zlogp, zargp->bootbuf,
-				    zstate);
+				    zstate, debug);
 			}
 			audit_put_record(zlogp, uc, rval, "boot");
+			zcons_statechanged();
 			if (rval != 0) {
 				bringup_failure_recovery = B_TRUE;
 				(void) zone_halt(zlogp, B_FALSE, B_FALSE,
-				    zstate);
+				    zstate, debug);
 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
 			}
 			break;
@@ -1416,7 +1936,7 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 
 			rval = zone_ready(zlogp,
 			    strcmp(zargp->bootbuf, "-U") == 0 ?
-			    Z_MNT_UPDATE : Z_MNT_SCRATCH, zstate);
+			    Z_MNT_UPDATE : Z_MNT_SCRATCH, zstate, debug);
 			if (rval != 0)
 				break;
 
@@ -1478,15 +1998,18 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 			rval = 0;
 			break;
 		case Z_BOOT:
+		case Z_FORCEBOOT:
 			(void) strlcpy(boot_args, zargp->bootbuf,
 			    sizeof (boot_args));
 			eventstream_write(Z_EVT_ZONE_BOOTING);
-			rval = zone_bootup(zlogp, zargp->bootbuf, zstate);
+			rval = zone_bootup(zlogp, zargp->bootbuf, zstate,
+			    debug);
 			audit_put_record(zlogp, uc, rval, "boot");
+			zcons_statechanged();
 			if (rval != 0) {
 				bringup_failure_recovery = B_TRUE;
 				(void) zone_halt(zlogp, B_FALSE, B_TRUE,
-				    zstate);
+				    zstate, debug);
 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
 			}
 			boot_args[0] = '\0';
@@ -1494,15 +2017,17 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 		case Z_HALT:
 			if (kernelcall)	/* Invalid; can't happen */
 				abort();
-			if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate))
-			    != 0)
+			if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate,
+			    debug)) != 0)
 				break;
+			zcons_statechanged();
 			eventstream_write(Z_EVT_ZONE_HALTED);
 			break;
 		case Z_SHUTDOWN:
 		case Z_REBOOT:
 		case Z_NOTE_UNINSTALLING:
 		case Z_MOUNT:
+		case Z_FORCEMOUNT:
 		case Z_UNMOUNT:
 			if (kernelcall)	/* Invalid; can't happen */
 				abort();
@@ -1519,7 +2044,7 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 		case Z_UNMOUNT:
 			if (kernelcall)	/* Invalid; can't happen */
 				abort();
-			rval = zone_halt(zlogp, B_TRUE, B_FALSE, zstate);
+			rval = zone_halt(zlogp, B_TRUE, B_FALSE, zstate, debug);
 			if (rval == 0) {
 				eventstream_write(Z_EVT_ZONE_HALTED);
 				(void) sema_post(&scratch_sem);
@@ -1541,15 +2066,18 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 	case ZONE_STATE_DOWN:
 		switch (cmd) {
 		case Z_READY:
-			if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate))
-			    != 0)
+			if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate,
+			    debug)) != 0)
 				break;
-			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) == 0)
+			zcons_statechanged();
+			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate,
+			    debug)) == 0)
 				eventstream_write(Z_EVT_ZONE_READIED);
 			else
 				eventstream_write(Z_EVT_ZONE_HALTED);
 			break;
 		case Z_BOOT:
+		case Z_FORCEBOOT:
 			/*
 			 * We could have two clients racing to boot this
 			 * zone; the second client loses, but its request
@@ -1560,32 +2088,40 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 			rval = 0;
 			break;
 		case Z_HALT:
-			if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate))
-			    != 0)
+			if (kernelcall) {
+				log_init_exit(init_status);
+			} else {
+				log_init_exit(-1);
+			}
+			if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate,
+			    debug)) != 0)
 				break;
 			eventstream_write(Z_EVT_ZONE_HALTED);
+			zcons_statechanged();
 			break;
 		case Z_REBOOT:
 			(void) strlcpy(boot_args, zargp->bootbuf,
 			    sizeof (boot_args));
 			eventstream_write(Z_EVT_ZONE_REBOOTING);
-			if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate))
-			    != 0) {
+			if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate,
+			    debug)) != 0) {
 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
 				boot_args[0] = '\0';
 				break;
 			}
-			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate))
-			    != 0) {
+			zcons_statechanged();
+			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate,
+			    debug)) != 0) {
 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
 				boot_args[0] = '\0';
 				break;
 			}
-			rval = zone_bootup(zlogp, zargp->bootbuf, zstate);
+			rval = zone_bootup(zlogp, zargp->bootbuf, zstate,
+			    debug);
 			audit_put_record(zlogp, uc, rval, "reboot");
 			if (rval != 0) {
 				(void) zone_halt(zlogp, B_FALSE, B_TRUE,
-				    zstate);
+				    zstate, debug);
 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
 			}
 			boot_args[0] = '\0';
@@ -1597,6 +2133,7 @@ server(void *cookie, char *args, size_t alen, door_desc_t *dp,
 			break;
 		case Z_NOTE_UNINSTALLING:
 		case Z_MOUNT:
+		case Z_FORCEMOUNT:
 		case Z_UNMOUNT:
 			zerror(zlogp, B_FALSE, "%s operation is invalid "
 			    "for zones in state '%s'", z_cmd_name(cmd),
@@ -1765,6 +2302,29 @@ top:
 			    "zoneadmd does not appear to be available; "
 			    "restarted zoneadmd to recover.",
 			    zone_name, zone_state_str(zstate));
+
+			/*
+			 * Startup a thread to perform the zfd logging/tty svc
+			 * for the zone. zlogp won't be valid for much longer
+			 * so use logplat.
+			 */
+			if (getzoneidbyname(zone_name) != -1) {
+				create_log_thread(&logplat);
+			}
+
+			/* recover the global configuration snapshot */
+			if (snap_hndl == NULL) {
+				if ((snap_hndl = zonecfg_init_handle())
+				    == NULL ||
+				    zonecfg_create_snapshot(zone_name)
+				    != Z_OK ||
+				    zonecfg_get_snapshot_handle(zone_name,
+				    snap_hndl) != Z_OK) {
+					zerror(zlogp, B_FALSE, "recovering "
+					    "zone configuration handle");
+					goto out;
+				}
+			}
 		}
 
 		(void) fdetach(zone_door_path);
@@ -1778,21 +2338,62 @@ out:
 }
 
 /*
- * Setup the brand's pre and post state change callbacks, as well as the
- * query callback, if any of these exist.
+ * Run the query hook with the 'env' parameter.  It should return a
+ * string of tab-delimited key-value pairs, each of which should be set
+ * in the environment.
+ *
+ * Because the env_vars string values become part of the environment, the
+ * string is static and we don't free it.
+ *
+ * This function is always called before zoneadmd forks and makes itself
+ * exclusive, so it is possible there could more than one instance of zoneadmd
+ * running in parallel at this point. Thus, we have no zonecfg snapshot and
+ * shouldn't take one yet (i.e. snap_hndl is NULL). Thats ok, since we don't
+ * need any zonecfg info to query for a brand-specific env value.
  */
 static int
-brand_callback_init(brand_handle_t bh, char *zone_name)
+set_brand_env(zlog_t *zlogp)
 {
-	char zpath[MAXPATHLEN];
+	int ret = 0;
+	static char *env_vars = NULL;
+	char buf[2 * MAXPATHLEN];
+
+	if (query_hook[0] == '\0' || env_vars != NULL)
+		return (0);
+
+	if (snprintf(buf, sizeof (buf), "%s env", query_hook) > sizeof (buf))
+		return (-1);
 
-	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK)
+	if (do_subproc(zlogp, buf, &env_vars, B_FALSE) != 0)
 		return (-1);
 
+	if (env_vars != NULL) {
+		char *sp;
+
+		sp = strtok(env_vars, "\t");
+		while (sp != NULL) {
+			if (putenv(sp) != 0) {
+				ret = -1;
+				break;
+			}
+			sp = strtok(NULL, "\t");
+		}
+	}
+
+	return (ret);
+}
+
+/*
+ * Setup the brand's pre and post state change callbacks, as well as the
+ * query callback, if any of these exist.
+ */
+static int
+brand_callback_init(brand_handle_t bh, char *zone_name)
+{
 	(void) strlcpy(pre_statechg_hook, EXEC_PREFIX,
 	    sizeof (pre_statechg_hook));
 
-	if (brand_get_prestatechange(bh, zone_name, zpath,
+	if (brand_get_prestatechange(bh, zone_name, zonepath,
 	    pre_statechg_hook + EXEC_LEN,
 	    sizeof (pre_statechg_hook) - EXEC_LEN) != 0)
 		return (-1);
@@ -1803,7 +2404,7 @@ brand_callback_init(brand_handle_t bh, char *zone_name)
 	(void) strlcpy(post_statechg_hook, EXEC_PREFIX,
 	    sizeof (post_statechg_hook));
 
-	if (brand_get_poststatechange(bh, zone_name, zpath,
+	if (brand_get_poststatechange(bh, zone_name, zonepath,
 	    post_statechg_hook + EXEC_LEN,
 	    sizeof (post_statechg_hook) - EXEC_LEN) != 0)
 		return (-1);
@@ -1814,7 +2415,7 @@ brand_callback_init(brand_handle_t bh, char *zone_name)
 	(void) strlcpy(query_hook, EXEC_PREFIX,
 	    sizeof (query_hook));
 
-	if (brand_get_query(bh, zone_name, zpath, query_hook + EXEC_LEN,
+	if (brand_get_query(bh, zone_name, zonepath, query_hook + EXEC_LEN,
 	    sizeof (query_hook) - EXEC_LEN) != 0)
 		return (-1);
 
@@ -1942,6 +2543,11 @@ main(int argc, char *argv[])
 		return (1);
 	}
 
+	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
+		zerror(zlogp, B_FALSE, "unable to determine zone path");
+		return (-1);
+	}
+
 	if (zonecfg_default_brand(default_brand,
 	    sizeof (default_brand)) != Z_OK) {
 		zerror(zlogp, B_FALSE, "unable to determine default brand");
@@ -2013,6 +2619,11 @@ main(int argc, char *argv[])
 	}
 	priv_freeset(privset);
 
+	if (set_brand_env(zlogp) != 0) {
+		zerror(zlogp, B_FALSE, "Unable to setup brand's environment");
+		return (1);
+	}
+
 	if (mkzonedir(zlogp) != 0)
 		return (1);
 
@@ -2139,6 +2750,15 @@ main(int argc, char *argv[])
 	openlog("zoneadmd", LOG_PID, LOG_DAEMON);
 
 	/*
+	 * Allow logging to <zonepath>/logs/<file>.
+	 */
+	logstream_init(zlogp);
+	platloghdl = logstream_open("platform.log", "zoneadmd", 0);
+
+	/* logplat looks the same as logsys, but logs to platform.log */
+	logplat = logsys;
+
+	/*
 	 * The eventstream is used to publish state changes in the zone
 	 * from the door threads to the console I/O poller.
 	 */
@@ -2157,7 +2777,6 @@ main(int argc, char *argv[])
 	if (make_daemon_exclusive(zlogp) == -1)
 		goto child_out;
 
-
 	/*
 	 * Create/join a new session; we need to be careful of what we do with
 	 * the console from now on so we don't end up being the session leader
@@ -2167,9 +2786,13 @@ main(int argc, char *argv[])
 
 	/*
 	 * This thread shouldn't be receiving any signals; in particular,
-	 * SIGCHLD should be received by the thread doing the fork().
+	 * SIGCHLD should be received by the thread doing the fork().  The
+	 * exceptions are SIGHUP and SIGUSR1 for log rotation, set up by
+	 * logstream_init().
 	 */
 	(void) sigfillset(&blockset);
+	(void) sigdelset(&blockset, SIGHUP);
+	(void) sigdelset(&blockset, SIGUSR1);
 	(void) thr_sigsetmask(SIG_BLOCK, &blockset, NULL);
 
 	/*
diff --git a/usr/src/cmd/zoneadmd/zoneadmd.h b/usr/src/cmd/zoneadmd/zoneadmd.h
index d784a303b3..471aa40a0e 100644
--- a/usr/src/cmd/zoneadmd/zoneadmd.h
+++ b/usr/src/cmd/zoneadmd/zoneadmd.h
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef	_ZONEADMD_H
@@ -32,6 +33,9 @@ extern "C" {
 #endif
 
 #include <libdladm.h>
+#include <libzonecfg.h>
+#include <thread.h>
+#include <synch.h>
 
 /*
  * Multi-threaded programs should avoid MT-unsafe library calls (i.e., any-
@@ -69,6 +73,7 @@ extern "C" {
 #define	DEFAULT_DIR_USER -1	/* user ID for chown: -1 means don't change */
 #define	DEFAULT_DIR_GROUP -1	/* grp ID for chown: -1 means don't change */
 
+#define	ALT_MOUNT(mount_cmd) 	((mount_cmd) != Z_MNT_BOOT)
 
 typedef struct zlog {
 	FILE *logfile;	/* file to log to */
@@ -83,24 +88,27 @@ typedef struct zlog {
 	char *locale;	/* locale to use for gettext() */
 } zlog_t;
 
-extern zlog_t logsys;
+extern zlog_t logsys;		/* syslog */
+extern zlog_t logplat;		/* platform.log */
 
 extern mutex_t lock;
 extern mutex_t msglock;
 extern boolean_t in_death_throes;
 extern boolean_t bringup_failure_recovery;
 extern char *zone_name;
+extern char zonepath[MAXNAMELEN];
+extern zone_dochandle_t snap_hndl;
 extern char pool_name[MAXNAMELEN];
 extern char brand_name[MAXNAMELEN];
 extern char default_brand[MAXNAMELEN];
 extern char boot_args[BOOTARGS_MAX];
-extern char bad_boot_arg[BOOTARGS_MAX];
 extern boolean_t zone_isnative;
 extern boolean_t zone_iscluster;
 extern dladm_handle_t dld_handle;
 
 extern void zerror(zlog_t *, boolean_t, const char *, ...);
 extern char *localize_msg(char *locale, const char *msg);
+extern void nwifent_free_attrs(struct zone_nwiftab *);
 
 /*
  * Eventstream interfaces.
@@ -112,8 +120,7 @@ typedef enum {
 	Z_EVT_ZONE_HALTED,
 	Z_EVT_ZONE_READIED,
 	Z_EVT_ZONE_UNINSTALLING,
-	Z_EVT_ZONE_BOOTFAILED,
-	Z_EVT_ZONE_BADARGS
+	Z_EVT_ZONE_BOOTFAILED
 } zone_evt_t;
 
 extern int eventstream_init();
@@ -135,9 +142,9 @@ typedef enum {
 /*
  * Virtual platform interfaces.
  */
-extern zoneid_t vplat_create(zlog_t *, zone_mnt_t);
+extern zoneid_t vplat_create(zlog_t *, zone_mnt_t, zoneid_t);
 extern int vplat_bringup(zlog_t *, zone_mnt_t, zoneid_t);
-extern int vplat_teardown(zlog_t *, boolean_t, boolean_t);
+extern int vplat_teardown(zlog_t *, boolean_t, boolean_t, boolean_t);
 extern int vplat_get_iptype(zlog_t *, zone_iptype_t *);
 
 /*
@@ -154,6 +161,23 @@ extern void resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen);
  */
 extern int init_console(zlog_t *);
 extern void serve_console(zlog_t *);
+extern void zcons_statechanged();
+
+/*
+ * Logging routines
+ */
+typedef enum {
+	LS_LINE_BUFFERED = 0x1		/* Write when \n found or full buffer */
+} logstream_flags_t;
+
+extern boolean_t logging_poisoned;
+
+extern void create_log_thread(zlog_t *);
+extern void destroy_log_thread(zlog_t *);
+extern void logstream_init(zlog_t *);
+extern int logstream_open(const char *, const char *, logstream_flags_t);
+extern void logstream_write(int, char *, int);
+extern void logstream_close(int);
 
 /*
  * Contract handling.
@@ -163,7 +187,13 @@ extern int init_template(void);
 /*
  * Routine to manage child processes.
  */
-extern int do_subproc(zlog_t *, char *, char **);
+extern int do_subproc(zlog_t *, char *, char **, boolean_t);
+
+/*
+ * Resource handling.
+ */
+extern int resolve_device_match(zlog_t *, struct zone_devtab *,
+    char *, size_t);
 
 #ifdef __cplusplus
 }
diff --git a/usr/src/cmd/zonecfg/Makefile b/usr/src/cmd/zonecfg/Makefile
index ae8f5c11d1..e364a59679 100644
--- a/usr/src/cmd/zonecfg/Makefile
+++ b/usr/src/cmd/zonecfg/Makefile
@@ -27,6 +27,7 @@ PROG=	zonecfg
 OBJS=	zonecfg.o zonecfg_lex.o zonecfg_grammar.tab.o
 
 include ../Makefile.cmd
+include ../Makefile.ctf
 
 # zonecfg has a name clash with main() and libl.so.1.  However, zonecfg must
 # still export a number of "yy*" (libl) interfaces.  Reduce all other symbols
@@ -36,7 +37,8 @@ MAPOPTS =	$(MAPFILES:%=-M%)
 
 LFLAGS =	-t
 YFLAGS =	-d -b zonecfg_grammar
-LDLIBS +=	-lzonecfg -ll -lnsl -ltecla -lzfs -lbrand -ldladm -linetutil
+LDLIBS +=	-lzonecfg -ll -lnsl -ltecla -lzfs -lbrand -ldladm -linetutil -luuid
+CFLAGS +=	-DYYLMAX=2048
 CPPFLAGS +=	-I.
 LDFLAGS +=	$(MAPOPTS)
 CLEANFILES +=	zonecfg_lex.c zonecfg_grammar.tab.c zonecfg_grammar.tab.h
diff --git a/usr/src/cmd/zonecfg/zonecfg.c b/usr/src/cmd/zonecfg/zonecfg.c
index f6aa8678d4..512f27d1e6 100644
--- a/usr/src/cmd/zonecfg/zonecfg.c
+++ b/usr/src/cmd/zonecfg/zonecfg.c
@@ -23,6 +23,7 @@
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2014 Gary Mills
+ * Copyright 2016, Joyent Inc.
  */
 
 /*
@@ -80,6 +81,7 @@
 #include <libinetutil.h>
 #include <pwd.h>
 #include <inet/ip.h>
+#include <uuid/uuid.h>
 
 #include <libzonecfg.h>
 #include "zonecfg.h"
@@ -127,7 +129,7 @@ extern int lex_lineno;
 #define	SHELP_REMOVE	"remove [-F] <resource-type> " \
 	"[ <property-name>=<property-value> ]*\n" \
 	"\t(global scope)\n" \
-	"remove <property-name> <property-value>\n" \
+	"remove [-F] <property-name> <property-value>\n" \
 	"\t(resource scope)"
 #define	SHELP_REVERT	"revert [-F]"
 #define	SHELP_SELECT	"select <resource-type> { <property-name>=" \
@@ -188,6 +190,8 @@ char *res_types[] = {
 	"admin",
 	"fs-allowed",
 	ALIAS_MAXPROCS,
+	ALIAS_ZFSPRI,
+	"uuid",
 	"security-flags",
 	NULL
 };
@@ -236,6 +240,12 @@ char *prop_types[] = {
 	"fs-allowed",
 	ALIAS_MAXPROCS,
 	"allowed-address",
+	ALIAS_ZFSPRI,
+	"mac-addr",
+	"vlan-id",
+	"global-nic",
+	"property",
+	"uuid",
 	"default",
 	"lower",
 	"upper",
@@ -305,6 +315,7 @@ static const char *clear_cmds[] = {
 	"clear " ALIAS_MAXSEMIDS,
 	"clear " ALIAS_SHARES,
 	"clear " ALIAS_MAXPROCS,
+	"clear " ALIAS_ZFSPRI,
 	NULL
 };
 
@@ -357,6 +368,8 @@ static const char *set_cmds[] = {
 	"set hostid=",
 	"set fs-allowed=",
 	"set " ALIAS_MAXPROCS "=",
+	"set " ALIAS_ZFSPRI "=",
+	"set uuid=",
 	NULL
 };
 
@@ -390,6 +403,7 @@ static const char *info_cmds[] = {
 	"info admin",
 	"info fs-allowed",
 	"info max-processes",
+	"info uuid",
 	NULL
 };
 
@@ -415,10 +429,20 @@ static const char *net_res_scope_cmds[] = {
 	"exit",
 	"help",
 	"info",
+	"add property ",
+	"clear allowed-address",
+	"clear defrouter",
+	"clear global-nic",
+	"clear mac-addr",
+	"clear vlan-id",
+	"remove property ",
 	"set address=",
 	"set allowed-address=",
-	"set physical=",
 	"set defrouter=",
+	"set global-nic=",
+	"set mac-addr=",
+	"set physical=",
+	"set vlan-id=",
 	NULL
 };
 
@@ -428,6 +452,7 @@ static const char *device_res_scope_cmds[] = {
 	"exit",
 	"help",
 	"info",
+	"add property ",
 	"set match=",
 	NULL
 };
@@ -545,12 +570,14 @@ static zone_dochandle_t handle;
 /* used all over the place */
 static char zone[ZONENAME_MAX];
 static char revert_zone[ZONENAME_MAX];
+static char new_uuid[UUID_PRINTABLE_STRING_LENGTH];
 
 /* global brand operations */
 static brand_handle_t brand;
 
 /* set in modifying functions, checked in read_input() */
 static boolean_t need_to_commit = B_FALSE;
+static boolean_t is_create = B_FALSE;
 boolean_t saw_error;
 
 /* set in yacc parser, checked in read_input() */
@@ -599,7 +626,6 @@ static struct zone_rctltab	old_rctltab, in_progress_rctltab;
 static struct zone_attrtab	old_attrtab, in_progress_attrtab;
 static struct zone_dstab	old_dstab, in_progress_dstab;
 static struct zone_psettab	old_psettab, in_progress_psettab;
-static struct zone_mcaptab	old_mcaptab, in_progress_mcaptab;
 static struct zone_admintab	old_admintab, in_progress_admintab;
 static struct zone_secflagstab	old_secflagstab, in_progress_secflagstab;
 
@@ -1105,11 +1131,20 @@ usage(boolean_t verbose, uint_t flags)
 			(void) fprintf(fp, gettext("Valid commands:\n"));
 			(void) fprintf(fp, "\t%s %s=%s\n", cmd_to_str(CMD_SET),
 			    pt_to_str(PT_ADDRESS), gettext("<IP-address>"));
+			(void) fprintf(fp, "\t%s %s (%s=<value>,%s=<value>)\n",
+			    cmd_to_str(CMD_ADD), pt_to_str(PT_NPROP),
+			    pt_to_str(PT_NAME), pt_to_str(PT_VALUE));
 			(void) fprintf(fp, "\t%s %s=%s\n", cmd_to_str(CMD_SET),
 			    pt_to_str(PT_ALLOWED_ADDRESS),
 			    gettext("<IP-address>"));
 			(void) fprintf(fp, "\t%s %s=%s\n", cmd_to_str(CMD_SET),
 			    pt_to_str(PT_PHYSICAL), gettext("<interface>"));
+			(void) fprintf(fp, "\t%s %s=%s\n", cmd_to_str(CMD_SET),
+			    pt_to_str(PT_MAC), gettext("<mac-address>"));
+			(void) fprintf(fp, "\t%s %s=%s\n", cmd_to_str(CMD_SET),
+			    pt_to_str(PT_GNIC), gettext("<global zone NIC>"));
+			(void) fprintf(fp, "\t%s %s=%s\n", cmd_to_str(CMD_SET),
+			    pt_to_str(PT_VLANID), gettext("<vlan ID>"));
 			(void) fprintf(fp, gettext("See ifconfig(1M) for "
 			    "details of the <interface> string.\n"));
 			(void) fprintf(fp, gettext("%s %s is valid "
@@ -1117,10 +1152,12 @@ usage(boolean_t verbose, uint_t flags)
 			    "must not be set.\n"),
 			    cmd_to_str(CMD_SET), pt_to_str(PT_ADDRESS),
 			    pt_to_str(PT_IPTYPE), gettext("shared"));
-			(void) fprintf(fp, gettext("%s %s is valid "
-			    "if the %s property is set to %s, otherwise it "
-			    "must not be set.\n"),
-			    cmd_to_str(CMD_SET), pt_to_str(PT_ALLOWED_ADDRESS),
+			(void) fprintf(fp, gettext("%s (%s, %s, %s, %s) are "
+			    "valid if the %s property is set to %s, otherwise "
+			    "they must not be set.\n"),
+			    cmd_to_str(CMD_SET),
+			    pt_to_str(PT_ALLOWED_ADDRESS), pt_to_str(PT_MAC),
+			    pt_to_str(PT_VLANID), pt_to_str(PT_GNIC),
 			    pt_to_str(PT_IPTYPE), gettext("exclusive"));
 			(void) fprintf(fp, gettext("\t%s %s=%s\n%s %s "
 			    "is valid if the %s or %s property is set, "
@@ -1136,6 +1173,9 @@ usage(boolean_t verbose, uint_t flags)
 			    "used to configure a device node.\n"),
 			    rt_to_str(resource_scope));
 			(void) fprintf(fp, gettext("Valid commands:\n"));
+			(void) fprintf(fp, "\t%s %s (%s=<value>,%s=<value>)\n",
+			    cmd_to_str(CMD_ADD), pt_to_str(PT_NPROP),
+			    pt_to_str(PT_NAME), pt_to_str(PT_VALUE));
 			(void) fprintf(fp, "\t%s %s=%s\n", cmd_to_str(CMD_SET),
 			    pt_to_str(PT_MATCH), gettext("<device-path>"));
 			break;
@@ -1282,10 +1322,12 @@ usage(boolean_t verbose, uint_t flags)
 	if (flags & HELP_USAGE) {
 		(void) fprintf(fp, "%s:\t%s %s\n", gettext("usage"),
 		    execname, cmd_to_str(CMD_HELP));
-		(void) fprintf(fp, "\t%s -z <zone>\t\t\t(%s)\n",
+		(void) fprintf(fp, "\t%s {-z <zone>|-u <uuid>}\t\t\t(%s)\n",
 		    execname, gettext("interactive"));
-		(void) fprintf(fp, "\t%s -z <zone> <command>\n", execname);
-		(void) fprintf(fp, "\t%s -z <zone> -f <command-file>\n",
+		(void) fprintf(fp, "\t%s {-z <zone>|-u <uuid>} <command>\n",
+		    execname);
+		(void) fprintf(fp,
+		    "\t%s {-z <zone>|-u <uuid>} -f <command-file>\n",
 		    execname);
 	}
 	if (flags & HELP_SUBCMDS) {
@@ -1374,15 +1416,22 @@ usage(boolean_t verbose, uint_t flags)
 		    pt_to_str(PT_MAXSEMIDS));
 		(void) fprintf(fp, "\t%s\t%s\n", gettext("(global)"),
 		    pt_to_str(PT_SHARES));
+		(void) fprintf(fp, "\t%s\t%s\n", gettext("(global)"),
+		    pt_to_str(PT_UUID));
+		(void) fprintf(fp, "\t%s\t%s\n", gettext("(global)"),
+		    pt_to_str(PT_ZFSPRI));
 		(void) fprintf(fp, "\t%s\t\t%s, %s, %s, %s, %s\n",
 		    rt_to_str(RT_FS), pt_to_str(PT_DIR),
 		    pt_to_str(PT_SPECIAL), pt_to_str(PT_RAW),
 		    pt_to_str(PT_TYPE), pt_to_str(PT_OPTIONS));
-		(void) fprintf(fp, "\t%s\t\t%s, %s, %s|%s\n", rt_to_str(RT_NET),
+		(void) fprintf(fp, "\t%s\t\t%s, %s, %s, %s, %s, %s, %s %s\n",
+		    rt_to_str(RT_NET),
 		    pt_to_str(PT_ADDRESS), pt_to_str(PT_ALLOWED_ADDRESS),
-		    pt_to_str(PT_PHYSICAL), pt_to_str(PT_DEFROUTER));
-		(void) fprintf(fp, "\t%s\t\t%s\n", rt_to_str(RT_DEVICE),
-		    pt_to_str(PT_MATCH));
+		    pt_to_str(PT_GNIC), pt_to_str(PT_MAC),
+		    pt_to_str(PT_PHYSICAL), pt_to_str(PT_NPROP),
+		    pt_to_str(PT_VLANID), pt_to_str(PT_DEFROUTER));
+		(void) fprintf(fp, "\t%s\t\t%s, %s\n", rt_to_str(RT_DEVICE),
+		    pt_to_str(PT_MATCH), pt_to_str(PT_NPROP));
 		(void) fprintf(fp, "\t%s\t\t%s, %s\n", rt_to_str(RT_RCTL),
 		    pt_to_str(PT_NAME), pt_to_str(PT_VALUE));
 		(void) fprintf(fp, "\t%s\t\t%s, %s, %s\n", rt_to_str(RT_ATTR),
@@ -1440,6 +1489,9 @@ initialize(boolean_t handle_expected)
 	if (zonecfg_check_handle(handle) != Z_OK) {
 		if ((err = zonecfg_get_handle(zone, handle)) == Z_OK) {
 			got_handle = B_TRUE;
+
+			(void) zonecfg_fix_obsolete(handle);
+
 			if (zonecfg_get_brand(handle, brandname,
 			    sizeof (brandname)) != Z_OK) {
 				zerr("Zone %s is inconsistent: missing "
@@ -1707,6 +1759,7 @@ create_func(cmd_t *cmd)
 	boolean_t force = B_FALSE;
 	boolean_t attach = B_FALSE;
 	boolean_t arg_err = B_FALSE;
+	uuid_t uuid;
 
 	assert(cmd != NULL);
 
@@ -1714,7 +1767,7 @@ create_func(cmd_t *cmd)
 	(void) strlcpy(zone_template, "SUNWdefault", sizeof (zone_template));
 
 	optind = 0;
-	while ((arg = getopt(cmd->cmd_argc, cmd->cmd_argv, "?a:bFt:"))
+	while ((arg = getopt(cmd->cmd_argc, cmd->cmd_argv, "?a:bFt:X"))
 	    != EOF) {
 		switch (arg) {
 		case '?':
@@ -1740,6 +1793,17 @@ create_func(cmd_t *cmd)
 			(void) strlcpy(zone_template, optarg,
 			    sizeof (zone_template));
 			break;
+		case 'X':
+			(void) snprintf(zone_template, sizeof (zone_template),
+			    "%s/%s.xml", ZONE_CONFIG_ROOT, zone);
+			err = zonecfg_get_xml_handle(zone_template, handle);
+			if (err != Z_OK) {
+				zone_perror(execname, err, B_TRUE);
+				exit(Z_ERR);
+			}
+			got_handle = B_TRUE;
+			need_to_commit = B_TRUE;
+			return;
 		default:
 			short_usage(CMD_CREATE);
 			arg_err = B_TRUE;
@@ -1793,9 +1857,14 @@ create_func(cmd_t *cmd)
 	}
 
 	need_to_commit = B_TRUE;
+	is_create = B_TRUE;
 	zonecfg_fini_handle(handle);
 	handle = tmphandle;
 	got_handle = B_TRUE;
+
+	/* Allocate a new uuid for this new zone */
+	uuid_generate(uuid);
+	uuid_unparse(uuid, new_uuid);
 }
 
 /*
@@ -1842,8 +1911,8 @@ export_func(cmd_t *cmd)
 	struct zone_rctltab rctltab;
 	struct zone_dstab dstab;
 	struct zone_psettab psettab;
-	struct zone_mcaptab mcaptab;
 	struct zone_rctlvaltab *valptr;
+	struct zone_res_attrtab *rap;
 	struct zone_admintab admintab;
 	struct zone_secflagstab secflagstab;
 	int err, arg;
@@ -1857,6 +1926,7 @@ export_func(cmd_t *cmd)
 	FILE *of;
 	boolean_t autoboot;
 	zone_iptype_t iptype;
+	uuid_t uuid;
 	boolean_t need_to_close = B_FALSE;
 	boolean_t arg_err = B_FALSE;
 
@@ -1967,6 +2037,14 @@ export_func(cmd_t *cmd)
 		    pt_to_str(PT_FS_ALLOWED), fsallowedp);
 	}
 
+	if (zonecfg_get_uuid(zone, uuid) == Z_OK && !uuid_is_null(uuid)) {
+		char suuid[UUID_PRINTABLE_STRING_LENGTH];
+
+		uuid_unparse(uuid, suuid);
+		(void) fprintf(of, "%s %s=%s\n", cmd_to_str(CMD_SET),
+		    pt_to_str(PT_UUID), suuid);
+	}
+
 	if ((err = zonecfg_setfsent(handle)) != Z_OK) {
 		zone_perror(zone, err, B_FALSE);
 		goto done;
@@ -2014,7 +2092,17 @@ export_func(cmd_t *cmd)
 		export_prop(of, PT_ALLOWED_ADDRESS,
 		    nwiftab.zone_nwif_allowed_address);
 		export_prop(of, PT_PHYSICAL, nwiftab.zone_nwif_physical);
+		export_prop(of, PT_MAC, nwiftab.zone_nwif_mac);
+		export_prop(of, PT_VLANID, nwiftab.zone_nwif_vlan_id);
+		export_prop(of, PT_GNIC, nwiftab.zone_nwif_gnic);
 		export_prop(of, PT_DEFROUTER, nwiftab.zone_nwif_defrouter);
+		for (rap = nwiftab.zone_nwif_attrp; rap != NULL;
+		    rap = rap->zone_res_attr_next) {
+			fprintf(of, "%s %s (%s=%s,%s=\"%s\")\n",
+			    cmd_to_str(CMD_ADD), pt_to_str(PT_NPROP),
+			    pt_to_str(PT_NAME), rap->zone_res_attr_name,
+			    pt_to_str(PT_VALUE), rap->zone_res_attr_value);
+		}
 		(void) fprintf(of, "%s\n", cmd_to_str(CMD_END));
 	}
 	(void) zonecfg_endnwifent(handle);
@@ -2027,21 +2115,17 @@ export_func(cmd_t *cmd)
 		(void) fprintf(of, "%s %s\n", cmd_to_str(CMD_ADD),
 		    rt_to_str(RT_DEVICE));
 		export_prop(of, PT_MATCH, devtab.zone_dev_match);
+		for (rap = devtab.zone_dev_attrp; rap != NULL;
+		    rap = rap->zone_res_attr_next) {
+			fprintf(of, "%s %s (%s=%s,%s=\"%s\")\n",
+			    cmd_to_str(CMD_ADD), pt_to_str(PT_NPROP),
+			    pt_to_str(PT_NAME), rap->zone_res_attr_name,
+			    pt_to_str(PT_VALUE), rap->zone_res_attr_value);
+		}
 		(void) fprintf(of, "%s\n", cmd_to_str(CMD_END));
 	}
 	(void) zonecfg_enddevent(handle);
 
-	if (zonecfg_getmcapent(handle, &mcaptab) == Z_OK) {
-		char buf[128];
-
-		(void) fprintf(of, "%s %s\n", cmd_to_str(CMD_ADD),
-		    rt_to_str(RT_MCAP));
-		bytes_to_units(mcaptab.zone_physmem_cap, buf, sizeof (buf));
-		(void) fprintf(of, "%s %s=%s\n", cmd_to_str(CMD_SET),
-		    pt_to_str(PT_PHYSICAL), buf);
-		(void) fprintf(of, "%s\n", cmd_to_str(CMD_END));
-	}
-
 	if ((err = zonecfg_setrctlent(handle)) != Z_OK) {
 		zone_perror(zone, err, B_FALSE);
 		goto done;
@@ -2205,7 +2289,6 @@ add_resource(cmd_t *cmd)
 {
 	int type;
 	struct zone_psettab tmp_psettab;
-	struct zone_mcaptab tmp_mcaptab;
 	struct zone_secflagstab tmp_secflagstab;
 	uint64_t tmp;
 	uint64_t tmp_mcap;
@@ -2298,9 +2381,10 @@ add_resource(cmd_t *cmd)
 		 * Make sure there isn't already a mem-cap entry or max-swap
 		 * or max-locked rctl.
 		 */
-		if (zonecfg_lookup_mcap(handle, &tmp_mcaptab) == Z_OK ||
-		    zonecfg_get_aliased_rctl(handle, ALIAS_MAXSWAP, &tmp_mcap)
-		    == Z_OK ||
+		if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXSWAP,
+		    &tmp_mcap) == Z_OK ||
+		    zonecfg_get_aliased_rctl(handle, ALIAS_MAXPHYSMEM,
+		    &tmp_mcap) == Z_OK ||
 		    zonecfg_get_aliased_rctl(handle, ALIAS_MAXLOCKEDMEM,
 		    &tmp_mcap) == Z_OK) {
 			zerr(gettext("The %s resource or a related resource "
@@ -2313,7 +2397,6 @@ add_resource(cmd_t *cmd)
 			    "to even the root user; "
 			    "this could render the system impossible\n"
 			    "to administer.  Please use caution."));
-		bzero(&in_progress_mcaptab, sizeof (in_progress_mcaptab));
 		return;
 	case RT_ADMIN:
 		bzero(&in_progress_admintab, sizeof (in_progress_admintab));
@@ -2424,6 +2507,79 @@ bad:
 	zonecfg_free_rctl_value_list(rctlvaltab);
 }
 
+/*
+ * Resource attribute ("property" resource embedded on net or dev resource)
+ */
+static void
+do_res_attr(struct zone_res_attrtab **headp, complex_property_ptr_t cpp)
+{
+	complex_property_ptr_t cp;
+	struct zone_res_attrtab *np;
+	int err;
+	boolean_t seen_name = B_FALSE, seen_value = B_FALSE;
+
+	if ((np = calloc(1, sizeof (struct zone_res_attrtab))) == NULL) {
+		zone_perror(zone, Z_NOMEM, B_TRUE);
+		exit(Z_ERR);
+	}
+
+	for (cp = cpp; cp != NULL; cp = cp->cp_next) {
+		switch (cp->cp_type) {
+		case PT_NAME:
+			if (seen_name) {
+				zerr(gettext("%s already specified"),
+				    pt_to_str(PT_NAME));
+				goto bad;
+			}
+			if (strlcpy(np->zone_res_attr_name, cp->cp_value,
+			    sizeof (np->zone_res_attr_name)) >=
+			    sizeof (np->zone_res_attr_name)) {
+				zerr(gettext("Input for %s is too long"),
+				    pt_to_str(PT_NAME));
+				goto bad;
+			}
+			seen_name = B_TRUE;
+			break;
+		case PT_VALUE:
+			if (seen_value) {
+				zerr(gettext("%s already specified"),
+				    pt_to_str(PT_VALUE));
+				goto bad;
+			}
+			if (strlcpy(np->zone_res_attr_value, cp->cp_value,
+			    sizeof (np->zone_res_attr_value)) >=
+			    sizeof (np->zone_res_attr_value)) {
+				zerr(gettext("Input for %s is too long"),
+				    pt_to_str(PT_VALUE));
+				goto bad;
+			}
+
+			seen_value = B_TRUE;
+			break;
+		default:
+			zone_perror(pt_to_str(PT_NPROP), Z_NO_PROPERTY_TYPE,
+			    B_TRUE);
+			long_usage(CMD_ADD, B_TRUE);
+			usage(B_FALSE, HELP_PROPS);
+			zonecfg_free_res_attr_list(np);
+			return;
+		}
+	}
+
+	if (!seen_name)
+		zerr(gettext("%s not specified"), pt_to_str(PT_NAME));
+	if (!seen_value)
+		zerr(gettext("%s not specified"), pt_to_str(PT_VALUE));
+
+	err = zonecfg_add_res_attr(headp, np);
+	if (err != Z_OK)
+		zone_perror(pt_to_str(PT_NPROP), err, B_TRUE);
+	return;
+
+bad:
+	zonecfg_free_res_attr_list(np);
+}
+
 static void
 add_property(cmd_t *cmd)
 {
@@ -2491,6 +2647,44 @@ add_property(cmd_t *cmd)
 			}
 		}
 		return;
+	case RT_NET:
+		if (prop_type != PT_NPROP) {
+			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
+			    B_TRUE);
+			long_usage(CMD_ADD, B_TRUE);
+			usage(B_FALSE, HELP_PROPS);
+			return;
+		}
+		pp = cmd->cmd_property_ptr[0];
+		if (pp->pv_type != PROP_VAL_COMPLEX) {
+			zerr(gettext("A %s value was expected here."),
+			    pvt_to_str(PROP_VAL_COMPLEX));
+			saw_error = B_TRUE;
+			return;
+		}
+
+		do_res_attr(&(in_progress_nwiftab.zone_nwif_attrp),
+		    pp->pv_complex);
+		return;
+	case RT_DEVICE:
+		if (prop_type != PT_NPROP) {
+			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
+			    B_TRUE);
+			long_usage(CMD_ADD, B_TRUE);
+			usage(B_FALSE, HELP_PROPS);
+			return;
+		}
+		pp = cmd->cmd_property_ptr[0];
+		if (pp->pv_type != PROP_VAL_COMPLEX) {
+			zerr(gettext("A %s value was expected here."),
+			    pvt_to_str(PROP_VAL_COMPLEX));
+			saw_error = B_TRUE;
+			return;
+		}
+
+		do_res_attr(&(in_progress_devtab.zone_dev_attrp),
+		    pp->pv_complex);
+		return;
 	case RT_RCTL:
 		if (prop_type != PT_VALUE) {
 			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
@@ -2535,7 +2729,7 @@ static boolean_t
 gz_invalid_rt_property(int type)
 {
 	return (global_zone && (type == RT_ZONENAME || type == RT_ZONEPATH ||
-	    type == RT_AUTOBOOT || type == RT_LIMITPRIV ||
+	    type == RT_AUTOBOOT || type == RT_LIMITPRIV || type == RT_UUID ||
 	    type == RT_BOOTARGS || type == RT_BRAND || type == RT_SCHED ||
 	    type == RT_IPTYPE || type == RT_HOSTID || type == RT_FS_ALLOWED));
 }
@@ -2544,7 +2738,7 @@ static boolean_t
 gz_invalid_property(int type)
 {
 	return (global_zone && (type == PT_ZONENAME || type == PT_ZONEPATH ||
-	    type == PT_AUTOBOOT || type == PT_LIMITPRIV ||
+	    type == PT_AUTOBOOT || type == PT_LIMITPRIV || type == PT_UUID ||
 	    type == PT_BOOTARGS || type == PT_BRAND || type == PT_SCHED ||
 	    type == PT_IPTYPE || type == PT_HOSTID || type == PT_FS_ALLOWED));
 }
@@ -2595,8 +2789,9 @@ add_func(cmd_t *cmd)
 		resource_scope = cmd->cmd_res_type;
 		end_op = CMD_ADD;
 		add_resource(cmd);
-	} else
+	} else {
 		add_property(cmd);
+	}
 }
 
 /*
@@ -2761,6 +2956,32 @@ fill_in_fstab(cmd_t *cmd, struct zone_fstab *fstab, boolean_t fill_in_only)
 	return (zonecfg_lookup_filesystem(handle, fstab));
 }
 
+/*
+ * Turn an addr that looks like f:2:0:44:5:6C into 0f:02:00:44:05:6c
+ * We're expecting a dst of at least MAXMACADDRLEN size here.
+ */
+static void
+normalize_mac_addr(char *dst, const char *src, int len)
+{
+	char *p, *e, *sep = "";
+	long n;
+	char buf[MAXMACADDRLEN], tmp[4];
+
+	*dst = '\0';
+	(void) strlcpy(buf, src, sizeof (buf));
+	p = strtok(buf, ":");
+	while (p != NULL) {
+		n = strtol(p, &e, 16);
+		if (*e != NULL || n > 0xff)
+			return;
+		(void) snprintf(tmp, sizeof (tmp), "%s%02x", sep, n);
+		(void) strlcat(dst, tmp, len);
+
+		sep = ":";
+		p = strtok(NULL, ":");
+	}
+}
+
 static int
 fill_in_nwiftab(cmd_t *cmd, struct zone_nwiftab *nwiftab,
     boolean_t fill_in_only)
@@ -2794,6 +3015,21 @@ fill_in_nwiftab(cmd_t *cmd, struct zone_nwiftab *nwiftab,
 			    pp->pv_simple,
 			    sizeof (nwiftab->zone_nwif_physical));
 			break;
+		case PT_MAC:
+			normalize_mac_addr(nwiftab->zone_nwif_mac,
+			    pp->pv_simple,
+			    sizeof (nwiftab->zone_nwif_mac));
+			break;
+		case PT_VLANID:
+			(void) strlcpy(nwiftab->zone_nwif_vlan_id,
+			    pp->pv_simple,
+			    sizeof (nwiftab->zone_nwif_vlan_id));
+			break;
+		case PT_GNIC:
+			(void) strlcpy(nwiftab->zone_nwif_gnic,
+			    pp->pv_simple,
+			    sizeof (nwiftab->zone_nwif_gnic));
+			break;
 		case PT_DEFROUTER:
 			(void) strlcpy(nwiftab->zone_nwif_defrouter,
 			    pp->pv_simple,
@@ -3092,6 +3328,8 @@ prompt_remove_resource(cmd_t *cmd, char *rsrc)
 	num = zonecfg_num_resources(handle, rsrc);
 
 	if (num == 0) {
+		if (force)
+			return (B_TRUE);
 		z_cmd_rt_perror(CMD_REMOVE, cmd->cmd_res_type, Z_NO_ENTRY,
 		    B_TRUE);
 		return (B_FALSE);
@@ -3120,7 +3358,7 @@ prompt_remove_resource(cmd_t *cmd, char *rsrc)
 }
 
 static void
-remove_fs(cmd_t *cmd)
+remove_fs(cmd_t *cmd, boolean_t force)
 {
 	int err;
 
@@ -3129,13 +3367,16 @@ remove_fs(cmd_t *cmd)
 		struct zone_fstab fstab;
 
 		if ((err = fill_in_fstab(cmd, &fstab, B_FALSE)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_FS, err, B_TRUE);
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_FS, err, B_TRUE);
 			return;
 		}
-		if ((err = zonecfg_delete_filesystem(handle, &fstab)) != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_FS, err, B_TRUE);
-		else
+		if ((err = zonecfg_delete_filesystem(handle, &fstab)) != Z_OK) {
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_FS, err, B_TRUE);
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		zonecfg_free_fs_option_list(fstab.zone_fs_options);
 		return;
 	}
@@ -3154,7 +3395,7 @@ remove_fs(cmd_t *cmd)
 }
 
 static void
-remove_net(cmd_t *cmd)
+remove_net(cmd_t *cmd, boolean_t force)
 {
 	int err;
 
@@ -3163,13 +3404,18 @@ remove_net(cmd_t *cmd)
 		struct zone_nwiftab nwiftab;
 
 		if ((err = fill_in_nwiftab(cmd, &nwiftab, B_FALSE)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_NET, err, B_TRUE);
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_NET, err,
+				    B_TRUE);
 			return;
 		}
-		if ((err = zonecfg_delete_nwif(handle, &nwiftab)) != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_NET, err, B_TRUE);
-		else
+		if ((err = zonecfg_delete_nwif(handle, &nwiftab)) != Z_OK) {
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_NET, err,
+				    B_TRUE);
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		return;
 	}
 
@@ -3187,7 +3433,7 @@ remove_net(cmd_t *cmd)
 }
 
 static void
-remove_device(cmd_t *cmd)
+remove_device(cmd_t *cmd, boolean_t force)
 {
 	int err;
 
@@ -3196,13 +3442,18 @@ remove_device(cmd_t *cmd)
 		struct zone_devtab devtab;
 
 		if ((err = fill_in_devtab(cmd, &devtab, B_FALSE)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_DEVICE, err, B_TRUE);
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_DEVICE, err,
+				    B_TRUE);
 			return;
 		}
-		if ((err = zonecfg_delete_dev(handle, &devtab)) != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_DEVICE, err, B_TRUE);
-		else
+		if ((err = zonecfg_delete_dev(handle, &devtab)) != Z_OK) {
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_DEVICE, err,
+				    B_TRUE);
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		return;
 	}
 
@@ -3220,7 +3471,7 @@ remove_device(cmd_t *cmd)
 }
 
 static void
-remove_attr(cmd_t *cmd)
+remove_attr(cmd_t *cmd, boolean_t force)
 {
 	int err;
 
@@ -3229,13 +3480,18 @@ remove_attr(cmd_t *cmd)
 		struct zone_attrtab attrtab;
 
 		if ((err = fill_in_attrtab(cmd, &attrtab, B_FALSE)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_ATTR, err, B_TRUE);
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_ATTR, err,
+				    B_TRUE);
 			return;
 		}
-		if ((err = zonecfg_delete_attr(handle, &attrtab)) != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_ATTR, err, B_TRUE);
-		else
+		if ((err = zonecfg_delete_attr(handle, &attrtab)) != Z_OK) {
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_ATTR, err,
+				    B_TRUE);
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		return;
 	}
 
@@ -3253,7 +3509,7 @@ remove_attr(cmd_t *cmd)
 }
 
 static void
-remove_dataset(cmd_t *cmd)
+remove_dataset(cmd_t *cmd, boolean_t force)
 {
 	int err;
 
@@ -3262,13 +3518,18 @@ remove_dataset(cmd_t *cmd)
 		struct zone_dstab dstab;
 
 		if ((err = fill_in_dstab(cmd, &dstab, B_FALSE)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_DATASET, err, B_TRUE);
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_DATASET, err,
+				    B_TRUE);
 			return;
 		}
-		if ((err = zonecfg_delete_ds(handle, &dstab)) != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_DATASET, err, B_TRUE);
-		else
+		if ((err = zonecfg_delete_ds(handle, &dstab)) != Z_OK) {
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_DATASET, err,
+				    B_TRUE);
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		return;
 	}
 
@@ -3286,7 +3547,7 @@ remove_dataset(cmd_t *cmd)
 }
 
 static void
-remove_rctl(cmd_t *cmd)
+remove_rctl(cmd_t *cmd, boolean_t force)
 {
 	int err;
 
@@ -3295,13 +3556,18 @@ remove_rctl(cmd_t *cmd)
 		struct zone_rctltab rctltab;
 
 		if ((err = fill_in_rctltab(cmd, &rctltab, B_FALSE)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_RCTL, err, B_TRUE);
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_RCTL, err,
+				    B_TRUE);
 			return;
 		}
-		if ((err = zonecfg_delete_rctl(handle, &rctltab)) != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_RCTL, err, B_TRUE);
-		else
+		if ((err = zonecfg_delete_rctl(handle, &rctltab)) != Z_OK) {
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_RCTL, err,
+				    B_TRUE);
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
 		return;
 	}
@@ -3320,72 +3586,90 @@ remove_rctl(cmd_t *cmd)
 }
 
 static void
-remove_pset()
+remove_pset(boolean_t force)
 {
 	int err;
 	struct zone_psettab psettab;
 
 	if ((err = zonecfg_lookup_pset(handle, &psettab)) != Z_OK) {
-		z_cmd_rt_perror(CMD_REMOVE, RT_DCPU, err, B_TRUE);
+		if (!force)
+			z_cmd_rt_perror(CMD_REMOVE, RT_DCPU, err, B_TRUE);
 		return;
 	}
-	if ((err = zonecfg_delete_pset(handle)) != Z_OK)
-		z_cmd_rt_perror(CMD_REMOVE, RT_DCPU, err, B_TRUE);
-	else
+	if ((err = zonecfg_delete_pset(handle)) != Z_OK) {
+		if (!force)
+			z_cmd_rt_perror(CMD_REMOVE, RT_DCPU, err, B_TRUE);
+	} else {
 		need_to_commit = B_TRUE;
+	}
 }
 
 static void
-remove_pcap()
+remove_pcap(boolean_t force)
 {
 	int err;
 	uint64_t tmp;
 
 	if (zonecfg_get_aliased_rctl(handle, ALIAS_CPUCAP, &tmp) != Z_OK) {
-		zerr("%s %s: %s", cmd_to_str(CMD_REMOVE), rt_to_str(RT_PCAP),
-		    zonecfg_strerror(Z_NO_RESOURCE_TYPE));
-		saw_error = B_TRUE;
+		if (!force) {
+			zerr("%s %s: %s", cmd_to_str(CMD_REMOVE),
+			    rt_to_str(RT_PCAP),
+			    zonecfg_strerror(Z_NO_RESOURCE_TYPE));
+			saw_error = B_TRUE;
+		}
 		return;
 	}
 
-	if ((err = zonecfg_rm_aliased_rctl(handle, ALIAS_CPUCAP)) != Z_OK)
-		z_cmd_rt_perror(CMD_REMOVE, RT_PCAP, err, B_TRUE);
-	else
+	if ((err = zonecfg_rm_aliased_rctl(handle, ALIAS_CPUCAP)) != Z_OK) {
+		if (!force)
+			z_cmd_rt_perror(CMD_REMOVE, RT_PCAP, err, B_TRUE);
+	} else {
 		need_to_commit = B_TRUE;
+	}
 }
 
 static void
-remove_mcap()
+remove_mcap(boolean_t force)
 {
 	int err, res1, res2, res3;
 	uint64_t tmp;
-	struct zone_mcaptab mcaptab;
 	boolean_t revert = B_FALSE;
 
-	res1 = zonecfg_lookup_mcap(handle, &mcaptab);
+	res1 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXPHYSMEM, &tmp);
 	res2 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXSWAP, &tmp);
 	res3 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXLOCKEDMEM, &tmp);
 
 	/* if none of these exist, there is no resource to remove */
 	if (res1 != Z_OK && res2 != Z_OK && res3 != Z_OK) {
-		zerr("%s %s: %s", cmd_to_str(CMD_REMOVE), rt_to_str(RT_MCAP),
-		    zonecfg_strerror(Z_NO_RESOURCE_TYPE));
-		saw_error = B_TRUE;
+		if (!force) {
+			zerr("%s %s: %s", cmd_to_str(CMD_REMOVE),
+			    rt_to_str(RT_MCAP),
+			    zonecfg_strerror(Z_NO_RESOURCE_TYPE));
+			saw_error = B_TRUE;
+		}
 		return;
 	}
 	if (res1 == Z_OK) {
-		if ((err = zonecfg_delete_mcap(handle)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_MCAP, err, B_TRUE);
-			revert = B_TRUE;
+		if ((err = zonecfg_rm_aliased_rctl(handle, ALIAS_MAXPHYSMEM))
+		    != Z_OK) {
+			if (!force) {
+				z_cmd_rt_perror(CMD_REMOVE, RT_MCAP, err,
+				    B_TRUE);
+				revert = B_TRUE;
+			}
 		} else {
 			need_to_commit = B_TRUE;
 		}
 	}
+
 	if (res2 == Z_OK) {
 		if ((err = zonecfg_rm_aliased_rctl(handle, ALIAS_MAXSWAP))
 		    != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_MCAP, err, B_TRUE);
-			revert = B_TRUE;
+			if (!force) {
+				z_cmd_rt_perror(CMD_REMOVE, RT_MCAP, err,
+				    B_TRUE);
+				revert = B_TRUE;
+			}
 		} else {
 			need_to_commit = B_TRUE;
 		}
@@ -3393,8 +3677,11 @@ remove_mcap()
 	if (res3 == Z_OK) {
 		if ((err = zonecfg_rm_aliased_rctl(handle, ALIAS_MAXLOCKEDMEM))
 		    != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_MCAP, err, B_TRUE);
-			revert = B_TRUE;
+			if (!force) {
+				z_cmd_rt_perror(CMD_REMOVE, RT_MCAP, err,
+				    B_TRUE);
+				revert = B_TRUE;
+			}
 		} else {
 			need_to_commit = B_TRUE;
 		}
@@ -3405,7 +3692,7 @@ remove_mcap()
 }
 
 static void
-remove_admin(cmd_t *cmd)
+remove_admin(cmd_t *cmd, boolean_t force)
 {
 	int err;
 
@@ -3414,34 +3701,33 @@ remove_admin(cmd_t *cmd)
 		struct zone_admintab admintab;
 
 		if ((err = fill_in_admintab(cmd, &admintab, B_FALSE)) != Z_OK) {
-			z_cmd_rt_perror(CMD_REMOVE, RT_ADMIN,
-			    err, B_TRUE);
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_ADMIN, err,
+				    B_TRUE);
 			return;
 		}
 		if ((err = zonecfg_delete_admin(handle, &admintab,
-		    zone))
-		    != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_ADMIN,
-			    err, B_TRUE);
-		else
+		    zone)) != Z_OK) {
+			if (!force)
+				z_cmd_rt_perror(CMD_REMOVE, RT_ADMIN, err,
+				    B_TRUE);
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		return;
-	} else {
-		/*
-		 * unqualified admin removal.
-		 * remove all admins but prompt if more
-		 * than one.
-		 */
-		if (!prompt_remove_resource(cmd, "admin"))
-			return;
-
-		if ((err = zonecfg_delete_admins(handle, zone))
-		    != Z_OK)
-			z_cmd_rt_perror(CMD_REMOVE, RT_ADMIN,
-			    err, B_TRUE);
-		else
-			need_to_commit = B_TRUE;
 	}
+
+	/*
+	 * unqualified admin removal.
+	 * remove all admins but prompt if more than one.
+	 */
+	if (!prompt_remove_resource(cmd, "admin"))
+		return;
+
+	if ((err = zonecfg_delete_admins(handle, zone)) != Z_OK)
+		z_cmd_rt_perror(CMD_REMOVE, RT_ADMIN, err, B_TRUE);
+	else
+		need_to_commit = B_TRUE;
 }
 
 static void
@@ -3471,6 +3757,7 @@ remove_resource(cmd_t *cmd)
 	int type;
 	int arg;
 	boolean_t arg_err = B_FALSE;
+	boolean_t force = B_FALSE;
 
 	if ((type = cmd->cmd_res_type) == RT_UNKNOWN) {
 		long_usage(CMD_REMOVE, B_TRUE);
@@ -3485,6 +3772,7 @@ remove_resource(cmd_t *cmd)
 			arg_err = B_TRUE;
 			break;
 		case 'F':
+			force = B_TRUE;
 			break;
 		default:
 			short_usage(CMD_REMOVE);
@@ -3500,34 +3788,34 @@ remove_resource(cmd_t *cmd)
 
 	switch (type) {
 	case RT_FS:
-		remove_fs(cmd);
+		remove_fs(cmd, force);
 		return;
 	case RT_NET:
-		remove_net(cmd);
+		remove_net(cmd, force);
 		return;
 	case RT_DEVICE:
-		remove_device(cmd);
+		remove_device(cmd, force);
 		return;
 	case RT_RCTL:
-		remove_rctl(cmd);
+		remove_rctl(cmd, force);
 		return;
 	case RT_ATTR:
-		remove_attr(cmd);
+		remove_attr(cmd, force);
 		return;
 	case RT_DATASET:
-		remove_dataset(cmd);
+		remove_dataset(cmd, force);
 		return;
 	case RT_DCPU:
-		remove_pset();
+		remove_pset(force);
 		return;
 	case RT_PCAP:
-		remove_pcap();
+		remove_pcap(force);
 		return;
 	case RT_MCAP:
-		remove_mcap();
+		remove_mcap(force);
 		return;
 	case RT_ADMIN:
-		remove_admin(cmd);
+		remove_admin(cmd, force);
 		return;
 	case RT_SECFLAGS:
 		remove_secflags();
@@ -3547,7 +3835,27 @@ remove_property(cmd_t *cmd)
 	int err, res_type, prop_type;
 	property_value_ptr_t pp;
 	struct zone_rctlvaltab *rctlvaltab;
+	struct zone_res_attrtab *np;
 	complex_property_ptr_t cx;
+	int arg;
+	boolean_t force = B_FALSE;
+	boolean_t arg_err = B_FALSE;
+
+	optind = 0;
+	while ((arg = getopt(cmd->cmd_argc, cmd->cmd_argv, "F")) != EOF) {
+		switch (arg) {
+		case 'F':
+			force = B_TRUE;
+			break;
+		default:
+			arg_err = B_TRUE;
+			break;
+		}
+	}
+	if (arg_err) {
+		saw_error = B_TRUE;
+		return;
+	}
 
 	res_type = resource_scope;
 	prop_type = cmd->cmd_prop_name[0];
@@ -3589,7 +3897,7 @@ remove_property(cmd_t *cmd)
 			prop_id = pp->pv_simple;
 			err = zonecfg_remove_fs_option(&in_progress_fstab,
 			    prop_id);
-			if (err != Z_OK)
+			if (err != Z_OK && !force)
 				zone_perror(pt_to_str(prop_type), err, B_TRUE);
 		} else {
 			list_property_ptr_t list;
@@ -3601,12 +3909,62 @@ remove_property(cmd_t *cmd)
 					break;
 				err = zonecfg_remove_fs_option(
 				    &in_progress_fstab, prop_id);
-				if (err != Z_OK)
+				if (err != Z_OK && !force)
 					zone_perror(pt_to_str(prop_type), err,
 					    B_TRUE);
 			}
 		}
 		return;
+	case RT_NET:		/* FALLTHRU */
+	case RT_DEVICE:
+		if (prop_type != PT_NPROP) {
+			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
+			    B_TRUE);
+			long_usage(CMD_REMOVE, B_TRUE);
+			usage(B_FALSE, HELP_PROPS);
+			return;
+		}
+		pp = cmd->cmd_property_ptr[0];
+		if (pp->pv_type != PROP_VAL_COMPLEX) {
+			zerr(gettext("A %s value was expected here."),
+			    pvt_to_str(PROP_VAL_COMPLEX));
+			saw_error = B_TRUE;
+			return;
+		}
+
+		np = alloca(sizeof (struct zone_res_attrtab));
+		for (cx = pp->pv_complex; cx != NULL; cx = cx->cp_next) {
+			switch (cx->cp_type) {
+			case PT_NAME:
+				(void) strlcpy(np->zone_res_attr_name,
+				    cx->cp_value,
+				    sizeof (np->zone_res_attr_name));
+				break;
+			case PT_VALUE:
+				(void) strlcpy(np->zone_res_attr_value,
+				    cx->cp_value,
+				    sizeof (np->zone_res_attr_value));
+				break;
+			default:
+				zone_perror(pt_to_str(prop_type),
+				    Z_NO_PROPERTY_TYPE, B_TRUE);
+				long_usage(CMD_REMOVE, B_TRUE);
+				usage(B_FALSE, HELP_PROPS);
+				return;
+			}
+		}
+		np->zone_res_attr_next = NULL;
+
+		if (res_type == RT_NET) {
+			err = zonecfg_remove_res_attr(
+			    &(in_progress_nwiftab.zone_nwif_attrp), np);
+		} else {				/* RT_DEVICE */
+			err = zonecfg_remove_res_attr(
+			    &(in_progress_devtab.zone_dev_attrp), np);
+		}
+		if (err != Z_OK && !force)
+			zone_perror(pt_to_str(prop_type), err, B_TRUE);
+		return;
 	case RT_RCTL:
 		if (prop_type != PT_VALUE) {
 			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
@@ -3655,22 +4013,10 @@ remove_property(cmd_t *cmd)
 		rctlvaltab->zone_rctlval_next = NULL;
 		err = zonecfg_remove_rctl_value(&in_progress_rctltab,
 		    rctlvaltab);
-		if (err != Z_OK)
+		if (err != Z_OK && !force)
 			zone_perror(pt_to_str(prop_type), err, B_TRUE);
 		zonecfg_free_rctl_value_list(rctlvaltab);
 		return;
-	case RT_NET:
-		if (prop_type != PT_DEFROUTER) {
-			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
-			    B_TRUE);
-			long_usage(CMD_REMOVE, B_TRUE);
-			usage(B_FALSE, HELP_PROPS);
-			return;
-		} else {
-			bzero(&in_progress_nwiftab.zone_nwif_defrouter,
-			    sizeof (in_progress_nwiftab.zone_nwif_defrouter));
-			return;
-		}
 	default:
 		zone_perror(rt_to_str(res_type), Z_NO_RESOURCE_TYPE, B_TRUE);
 		long_usage(CMD_REMOVE, B_TRUE);
@@ -3733,8 +4079,7 @@ clear_property(cmd_t *cmd)
 	case RT_MCAP:
 		switch (prop_type) {
 		case PT_PHYSICAL:
-			in_progress_mcaptab.zone_physmem_cap[0] = '\0';
-			need_to_commit = B_TRUE;
+			remove_aliased_rctl(PT_PHYSICAL, ALIAS_MAXPHYSMEM);
 			return;
 		case PT_SWAP:
 			remove_aliased_rctl(PT_SWAP, ALIAS_MAXSWAP);
@@ -3744,6 +4089,30 @@ clear_property(cmd_t *cmd)
 			return;
 		}
 		break;
+	case RT_NET:
+		switch (prop_type) {
+		case PT_ALLOWED_ADDRESS:
+			in_progress_nwiftab.zone_nwif_allowed_address[0] = '\0';
+			need_to_commit = B_TRUE;
+			return;
+		case PT_DEFROUTER:
+			in_progress_nwiftab.zone_nwif_defrouter[0] = '\0';
+			need_to_commit = B_TRUE;
+			return;
+		case PT_GNIC:
+			in_progress_nwiftab.zone_nwif_gnic[0] = '\0';
+			need_to_commit = B_TRUE;
+			return;
+		case PT_MAC:
+			in_progress_nwiftab.zone_nwif_mac[0] = '\0';
+			need_to_commit = B_TRUE;
+			return;
+		case PT_VLANID:
+			in_progress_nwiftab.zone_nwif_vlan_id[0] = '\0';
+			need_to_commit = B_TRUE;
+			return;
+		}
+		break;
 	case RT_SECFLAGS:
 		switch (prop_type) {
 		case PT_LOWER:
@@ -3785,6 +4154,8 @@ clear_global(cmd_t *cmd)
 		/* FALLTHRU */
 	case PT_ZONEPATH:
 		/* FALLTHRU */
+	case PT_UUID:
+		/* FALLTHRU */
 	case PT_BRAND:
 		zone_perror(pt_to_str(type), Z_CLEAR_DISALLOW, B_TRUE);
 		return;
@@ -3847,6 +4218,9 @@ clear_global(cmd_t *cmd)
 	case PT_SHARES:
 		remove_aliased_rctl(PT_SHARES, ALIAS_SHARES);
 		return;
+	case PT_ZFSPRI:
+		remove_aliased_rctl(PT_ZFSPRI, ALIAS_ZFSPRI);
+		return;
 	case PT_HOSTID:
 		if ((err = zonecfg_set_hostid(handle, NULL)) != Z_OK)
 			z_cmd_rt_perror(CMD_CLEAR, RT_HOSTID, err, B_TRUE);
@@ -3892,7 +4266,7 @@ clear_func(cmd_t *cmd)
 void
 select_func(cmd_t *cmd)
 {
-	int type, err, res;
+	int type, err;
 	uint64_t limit;
 	uint64_t tmp;
 
@@ -3987,7 +4361,8 @@ select_func(cmd_t *cmd)
 		return;
 	case RT_MCAP:
 		/* if none of these exist, there is no resource to select */
-		if ((res = zonecfg_lookup_mcap(handle, &old_mcaptab)) != Z_OK &&
+		if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXPHYSMEM, &limit)
+		    != Z_OK &&
 		    zonecfg_get_aliased_rctl(handle, ALIAS_MAXSWAP, &limit)
 		    != Z_OK &&
 		    zonecfg_get_aliased_rctl(handle, ALIAS_MAXLOCKEDMEM, &limit)
@@ -3996,12 +4371,6 @@ select_func(cmd_t *cmd)
 			    B_TRUE);
 			global_scope = B_TRUE;
 		}
-		if (res == Z_OK)
-			bcopy(&old_mcaptab, &in_progress_mcaptab,
-			    sizeof (struct zone_mcaptab));
-		else
-			bzero(&in_progress_mcaptab,
-			    sizeof (in_progress_mcaptab));
 		return;
 	case RT_ADMIN:
 		if ((err = fill_in_admintab(cmd, &old_admintab, B_FALSE))
@@ -4278,9 +4647,8 @@ set_func(cmd_t *cmd)
 	boolean_t autoboot;
 	zone_iptype_t iptype;
 	boolean_t force_set = B_FALSE;
-	size_t physmem_size = sizeof (in_progress_mcaptab.zone_physmem_cap);
 	uint64_t mem_cap, mem_limit;
-	float cap;
+	double cap;
 	char *unitp;
 	struct zone_psettab tmp_psettab;
 	boolean_t arg_err = B_FALSE;
@@ -4353,6 +4721,10 @@ set_func(cmd_t *cmd)
 			res_type = RT_HOSTID;
 		} else if (prop_type == PT_FS_ALLOWED) {
 			res_type = RT_FS_ALLOWED;
+		} else if (prop_type == PT_ZFSPRI) {
+			res_type = RT_ZFSPRI;
+		} else if (prop_type == PT_UUID) {
+			res_type = RT_UUID;
 		} else {
 			zerr(gettext("Cannot set a resource-specific property "
 			    "from the global scope."));
@@ -4382,10 +4754,12 @@ set_func(cmd_t *cmd)
 	 * A nasty expression but not that complicated:
 	 * 1. fs options are simple or list (tested below)
 	 * 2. rctl value's are complex or list (tested below)
+	 * 3. net attr's are complex (tested below)
 	 * Anything else should be simple.
 	 */
 	if (!(res_type == RT_FS && prop_type == PT_OPTIONS) &&
 	    !(res_type == RT_RCTL && prop_type == PT_VALUE) &&
+	    !(res_type == RT_NET && prop_type == PT_NPROP) &&
 	    (pp->pv_type != PROP_VAL_SIMPLE ||
 	    (prop_id = pp->pv_simple) == NULL)) {
 		zerr(gettext("A %s value was expected here."),
@@ -4558,6 +4932,9 @@ set_func(cmd_t *cmd)
 	case RT_SHARES:
 		set_aliased_rctl(ALIAS_SHARES, prop_type, prop_id);
 		return;
+	case RT_ZFSPRI:
+		set_aliased_rctl(ALIAS_ZFSPRI, prop_type, prop_id);
+		return;
 	case RT_HOSTID:
 		if ((err = zonecfg_set_hostid(handle, prop_id)) != Z_OK) {
 			if (err == Z_TOO_BIG) {
@@ -4571,6 +4948,15 @@ set_func(cmd_t *cmd)
 		}
 		need_to_commit = B_TRUE;
 		return;
+	case RT_UUID:
+		/*
+		 * We can't set here.  We have to wait until commit since the
+		 * uuid will be updating the index file and we may not have
+		 * created the zone yet.
+		 */
+		(void) strlcpy(new_uuid, prop_id, sizeof (new_uuid));
+		need_to_commit = B_TRUE;
+		return;
 	case RT_FS_ALLOWED:
 		if ((err = zonecfg_set_fs_allowed(handle, prop_id)) != Z_OK)
 			zone_perror(zone, err, B_TRUE);
@@ -4645,6 +5031,21 @@ set_func(cmd_t *cmd)
 			    prop_id,
 			    sizeof (in_progress_nwiftab.zone_nwif_physical));
 			break;
+		case PT_MAC:
+			normalize_mac_addr(in_progress_nwiftab.zone_nwif_mac,
+			    prop_id,
+			    sizeof (in_progress_nwiftab.zone_nwif_mac));
+			break;
+		case PT_VLANID:
+			(void) strlcpy(in_progress_nwiftab.zone_nwif_vlan_id,
+			    prop_id,
+			    sizeof (in_progress_nwiftab.zone_nwif_vlan_id));
+			break;
+		case PT_GNIC:
+			(void) strlcpy(in_progress_nwiftab.zone_nwif_gnic,
+			    prop_id,
+			    sizeof (in_progress_nwiftab.zone_nwif_gnic));
+			break;
 		case PT_DEFROUTER:
 			if (validate_net_address_syntax(prop_id, B_TRUE)
 			    != Z_OK) {
@@ -4655,6 +5056,20 @@ set_func(cmd_t *cmd)
 			    prop_id,
 			    sizeof (in_progress_nwiftab.zone_nwif_defrouter));
 			break;
+		case PT_NPROP:
+			if (pp->pv_type != PROP_VAL_COMPLEX) {
+				zerr(gettext("A %s value was expected here."),
+				    pvt_to_str(PROP_VAL_COMPLEX));
+				saw_error = B_TRUE;
+				return;
+			}
+			zonecfg_free_res_attr_list(
+			    in_progress_nwiftab.zone_nwif_attrp);
+			in_progress_nwiftab.zone_nwif_attrp = NULL;
+			if (!(pp->pv_type == PROP_VAL_LIST &&
+			    pp->pv_list == NULL))
+				add_property(cmd);
+			break;
 		default:
 			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
 			    B_TRUE);
@@ -4670,6 +5085,20 @@ set_func(cmd_t *cmd)
 			    prop_id,
 			    sizeof (in_progress_devtab.zone_dev_match));
 			break;
+		case PT_NPROP:
+			if (pp->pv_type != PROP_VAL_COMPLEX) {
+				zerr(gettext("A %s value was expected here."),
+				    pvt_to_str(PROP_VAL_COMPLEX));
+				saw_error = B_TRUE;
+				return;
+			}
+			zonecfg_free_res_attr_list(
+			    in_progress_devtab.zone_dev_attrp);
+			in_progress_devtab.zone_dev_attrp = NULL;
+			if (!(pp->pv_type == PROP_VAL_LIST &&
+			    pp->pv_list == NULL))
+				add_property(cmd);
+			break;
 		default:
 			zone_perror(pt_to_str(prop_type), Z_NO_PROPERTY_TYPE,
 			    B_TRUE);
@@ -4813,35 +5242,50 @@ set_func(cmd_t *cmd)
 		 * the add_resource() function.
 		 */
 
-		if ((cap = strtof(prop_id, &unitp)) <= 0 || *unitp != '\0' ||
-		    (int)(cap * 100) < 1) {
+		if ((cap = strtod(prop_id, &unitp)) <= 0 || *unitp != '\0' ||
+		    (cap * 100.0) < 1) {
 			zerr(gettext("%s property is out of range."),
 			    pt_to_str(PT_NCPUS));
 			saw_error = B_TRUE;
 			return;
 		}
+		cap *= 100.0;
 
+		/* To avoid rounding issues add .5 to force correct value. */
 		if ((err = zonecfg_set_aliased_rctl(handle, ALIAS_CPUCAP,
-		    (int)(cap * 100))) != Z_OK)
+		    (uint_t)(cap + 0.5))) != Z_OK) {
 			zone_perror(zone, err, B_TRUE);
-		else
+		} else {
 			need_to_commit = B_TRUE;
+		}
 		return;
 	case RT_MCAP:
 		switch (prop_type) {
 		case PT_PHYSICAL:
+			/*
+			 * We have to check if an rctl is allowed here since
+			 * there might already be a rctl defined that blocks
+			 * the alias.
+			 */
+			if (!zonecfg_aliased_rctl_ok(handle,
+			    ALIAS_MAXPHYSMEM)) {
+				zone_perror(pt_to_str(PT_LOCKED),
+				    Z_ALIAS_DISALLOW, B_FALSE);
+				saw_error = B_TRUE;
+				return;
+			}
+
 			if (!zonecfg_valid_memlimit(prop_id, &mem_cap)) {
-				zerr(gettext("A positive number with a "
+				zerr(gettext("A non-negative number with a "
 				    "required scale suffix (K, M, G or T) was "
-				    "expected here."));
-				saw_error = B_TRUE;
-			} else if (mem_cap < ONE_MB) {
-				zerr(gettext("%s value is too small.  It must "
-				    "be at least 1M."), pt_to_str(PT_PHYSICAL));
+				    "expected\nhere."));
 				saw_error = B_TRUE;
 			} else {
-				snprintf(in_progress_mcaptab.zone_physmem_cap,
-				    physmem_size, "%llu", mem_cap);
+				if ((err = zonecfg_set_aliased_rctl(handle,
+				    ALIAS_MAXPHYSMEM, mem_cap)) != Z_OK)
+					zone_perror(zone, err, B_TRUE);
+				else
+					need_to_commit = B_TRUE;
 			}
 			break;
 		case PT_SWAP:
@@ -5136,6 +5580,23 @@ info_hostid(zone_dochandle_t handle, FILE *fp)
 }
 
 static void
+info_uuid(FILE *fp)
+{
+	uuid_t uuid;
+	char suuid[UUID_PRINTABLE_STRING_LENGTH];
+
+	if (new_uuid[0] != '\0') {
+		(void) fprintf(fp, "%s: %s\n", pt_to_str(PT_UUID), new_uuid);
+	} else if (zonecfg_get_uuid(zone, uuid) == Z_OK &&
+	    !uuid_is_null(uuid)) {
+		uuid_unparse(uuid, suuid);
+		(void) fprintf(fp, "%s: %s\n", pt_to_str(PT_UUID), suuid);
+	} else {
+		(void) fprintf(fp, "%s:\n", pt_to_str(PT_UUID));
+	}
+}
+
+static void
 info_fs_allowed(zone_dochandle_t handle, FILE *fp)
 {
 	char fsallowedp[ZONE_FS_ALLOWED_MAX];
@@ -5217,12 +5678,25 @@ loopend:
 static void
 output_net(FILE *fp, struct zone_nwiftab *nwiftab)
 {
+	struct zone_res_attrtab *np;
+
 	(void) fprintf(fp, "%s:\n", rt_to_str(RT_NET));
 	output_prop(fp, PT_ADDRESS, nwiftab->zone_nwif_address, B_TRUE);
 	output_prop(fp, PT_ALLOWED_ADDRESS,
 	    nwiftab->zone_nwif_allowed_address, B_TRUE);
-	output_prop(fp, PT_PHYSICAL, nwiftab->zone_nwif_physical, B_TRUE);
 	output_prop(fp, PT_DEFROUTER, nwiftab->zone_nwif_defrouter, B_TRUE);
+	output_prop(fp, PT_GNIC, nwiftab->zone_nwif_gnic, B_TRUE);
+	output_prop(fp, PT_MAC, nwiftab->zone_nwif_mac, B_TRUE);
+	output_prop(fp, PT_PHYSICAL, nwiftab->zone_nwif_physical, B_TRUE);
+	output_prop(fp, PT_VLANID, nwiftab->zone_nwif_vlan_id, B_TRUE);
+
+	for (np = nwiftab->zone_nwif_attrp; np != NULL;
+	    np = np->zone_res_attr_next) {
+		fprintf(fp, "\t%s: (%s=%s,%s=\"%s\")\n",
+		    pt_to_str(PT_NPROP),
+		    pt_to_str(PT_NAME), np->zone_res_attr_name,
+		    pt_to_str(PT_VALUE), np->zone_res_attr_value);
+	}
 }
 
 static void
@@ -5265,8 +5739,18 @@ info_net(zone_dochandle_t handle, FILE *fp, cmd_t *cmd)
 static void
 output_dev(FILE *fp, struct zone_devtab *devtab)
 {
+	struct zone_res_attrtab *np;
+
 	(void) fprintf(fp, "%s:\n", rt_to_str(RT_DEVICE));
 	output_prop(fp, PT_MATCH, devtab->zone_dev_match, B_TRUE);
+
+	for (np = devtab->zone_dev_attrp; np != NULL;
+	    np = np->zone_res_attr_next) {
+		fprintf(fp, "\t%s: (%s=%s,%s=\"%s\")\n",
+		    pt_to_str(PT_NPROP),
+		    pt_to_str(PT_NAME), np->zone_res_attr_name,
+		    pt_to_str(PT_VALUE), np->zone_res_attr_value);
+	}
 }
 
 static void
@@ -5525,15 +6009,18 @@ bytes_to_units(char *str, char *buf, int bufsize)
 }
 
 static void
-output_mcap(FILE *fp, struct zone_mcaptab *mcaptab, int showswap,
+output_mcap(FILE *fp, int showphys, uint64_t maxphys, int showswap,
     uint64_t maxswap, int showlocked, uint64_t maxlocked)
 {
 	char buf[128];
 
 	(void) fprintf(fp, "%s:\n", rt_to_str(RT_MCAP));
-	if (mcaptab->zone_physmem_cap[0] != '\0') {
-		bytes_to_units(mcaptab->zone_physmem_cap, buf, sizeof (buf));
-		output_prop(fp, PT_PHYSICAL, buf, B_TRUE);
+
+	if (showphys == Z_OK) {
+		(void) snprintf(buf, sizeof (buf), "%llu", maxphys);
+		bytes_to_units(buf, buf, sizeof (buf));
+		/* Print directly since "physical" also is a net property. */
+		(void) fprintf(fp, "\t[%s: %s]\n", pt_to_str(PT_PHYSICAL), buf);
 	}
 
 	if (showswap == Z_OK) {
@@ -5555,16 +6042,16 @@ info_mcap(zone_dochandle_t handle, FILE *fp)
 	int res1, res2, res3;
 	uint64_t swap_limit;
 	uint64_t locked_limit;
-	struct zone_mcaptab lookup;
+	uint64_t phys_limit;
 
-	bzero(&lookup, sizeof (lookup));
-	res1 = zonecfg_getmcapent(handle, &lookup);
+	res1 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXPHYSMEM, &phys_limit);
 	res2 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXSWAP, &swap_limit);
 	res3 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXLOCKEDMEM,
 	    &locked_limit);
 
 	if (res1 == Z_OK || res2 == Z_OK || res3 == Z_OK)
-		output_mcap(fp, &lookup, res2, swap_limit, res3, locked_limit);
+		output_mcap(fp, res1, phys_limit, res2, swap_limit,
+		    res3, locked_limit);
 }
 
 static void
@@ -5634,9 +6121,11 @@ info_func(cmd_t *cmd)
 	FILE *fp = stdout;
 	boolean_t need_to_close = B_FALSE;
 	int type;
-	int res1, res2;
+	int res1, res2, res3;
 	uint64_t swap_limit;
 	uint64_t locked_limit;
+	uint64_t phys_limit;
+	struct stat statbuf;
 
 	assert(cmd != NULL);
 
@@ -5684,7 +6173,9 @@ info_func(cmd_t *cmd)
 			    &swap_limit);
 			res2 = zonecfg_get_aliased_rctl(handle,
 			    ALIAS_MAXLOCKEDMEM, &locked_limit);
-			output_mcap(fp, &in_progress_mcaptab, res1, swap_limit,
+			res3 = zonecfg_get_aliased_rctl(handle,
+			    ALIAS_MAXPHYSMEM, &phys_limit);
+			output_mcap(fp, res3, phys_limit, res1, swap_limit,
 			    res2, locked_limit);
 			break;
 		case RT_ADMIN:
@@ -5727,6 +6218,7 @@ info_func(cmd_t *cmd)
 			info_iptype(handle, fp);
 			info_hostid(handle, fp);
 			info_fs_allowed(handle, fp);
+			info_uuid(fp);
 		}
 		info_aliased_rctl(handle, fp, ALIAS_MAXLWPS);
 		info_aliased_rctl(handle, fp, ALIAS_MAXPROCS);
@@ -5735,6 +6227,7 @@ info_func(cmd_t *cmd)
 		info_aliased_rctl(handle, fp, ALIAS_MAXMSGIDS);
 		info_aliased_rctl(handle, fp, ALIAS_MAXSEMIDS);
 		info_aliased_rctl(handle, fp, ALIAS_SHARES);
+		info_aliased_rctl(handle, fp, ALIAS_ZFSPRI);
 		if (!global_zone) {
 			info_fs(handle, fp, cmd);
 			info_net(handle, fp, cmd);
@@ -5799,6 +6292,9 @@ info_func(cmd_t *cmd)
 	case RT_SHARES:
 		info_aliased_rctl(handle, fp, ALIAS_SHARES);
 		break;
+	case RT_ZFSPRI:
+		info_aliased_rctl(handle, fp, ALIAS_ZFSPRI);
+		break;
 	case RT_FS:
 		info_fs(handle, fp, cmd);
 		break;
@@ -5829,6 +6325,9 @@ info_func(cmd_t *cmd)
 	case RT_HOSTID:
 		info_hostid(handle, fp);
 		break;
+	case RT_UUID:
+		info_uuid(fp);
+		break;
 	case RT_ADMIN:
 		info_auth(handle, fp, cmd);
 		break;
@@ -6407,10 +6906,33 @@ verify_func(cmd_t *cmd)
 
 	if (save) {
 		if (ret_val == Z_OK) {
+			/*
+			 * If the zone doesn't yet have a debug ID, set one now.
+			 */
+			if (zonecfg_get_did(handle) == -1)
+				zonecfg_set_did(handle);
+
 			if ((ret_val = zonecfg_save(handle)) == Z_OK) {
 				need_to_commit = B_FALSE;
 				(void) strlcpy(revert_zone, zone,
 				    sizeof (revert_zone));
+
+				if (is_create) {
+					zonecfg_notify_create(handle);
+					is_create = B_FALSE;
+				}
+			}
+
+			/*
+			 * Commit a new uuid at this point since we now know the
+			 * zone index entry will exist.
+			 */
+			if (new_uuid[0] != '\0') {
+				if ((err = zonecfg_set_uuid(zone, zonepath,
+				    new_uuid)) != Z_OK)
+					zone_perror(zone, err, B_FALSE);
+				else
+					new_uuid[0] = '\0';
 			}
 		} else {
 			zerr(gettext("Zone %s failed to verify"), zone);
@@ -6581,6 +7103,7 @@ end_func(cmd_t *cmd)
 	int err, arg, res1, res2, res3;
 	uint64_t swap_limit;
 	uint64_t locked_limit;
+	uint64_t phys_limit;
 	uint64_t proc_cap;
 
 	assert(cmd != NULL);
@@ -6884,8 +7407,8 @@ end_func(cmd_t *cmd)
 		break;
 	case RT_MCAP:
 		/* Make sure everything was filled in. */
-		res1 = strlen(in_progress_mcaptab.zone_physmem_cap) == 0 ?
-		    Z_ERR : Z_OK;
+		res1 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXPHYSMEM,
+		    &phys_limit);
 		res2 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXSWAP,
 		    &swap_limit);
 		res3 = zonecfg_get_aliased_rctl(handle, ALIAS_MAXLOCKEDMEM,
@@ -6901,11 +7424,6 @@ end_func(cmd_t *cmd)
 
 		/* if phys & locked are both set, verify locked <= phys */
 		if (res1 == Z_OK && res3 == Z_OK) {
-			uint64_t phys_limit;
-			char *endp;
-
-			phys_limit = strtoull(
-			    in_progress_mcaptab.zone_physmem_cap, &endp, 10);
 			if (phys_limit < locked_limit) {
 				zerr(gettext("The %s cap must be less than or "
 				    "equal to the %s cap."),
@@ -6917,23 +7435,6 @@ end_func(cmd_t *cmd)
 		}
 
 		err = Z_OK;
-		if (res1 == Z_OK) {
-			/*
-			 * We could be ending from either an add operation
-			 * or a select operation.  Since all of the properties
-			 * within this resource are optional, we always use
-			 * modify on the mcap entry.  zonecfg_modify_mcap()
-			 * will handle both adding and modifying a memory cap.
-			 */
-			err = zonecfg_modify_mcap(handle, &in_progress_mcaptab);
-		} else if (end_op == CMD_SELECT) {
-			/*
-			 * If we're ending from a select and the physical
-			 * memory cap is empty then the user could have cleared
-			 * the physical cap value, so try to delete the entry.
-			 */
-			(void) zonecfg_delete_mcap(handle);
-		}
 		break;
 	case RT_ADMIN:
 		/* First make sure everything was filled in. */
@@ -7496,8 +7997,10 @@ get_execbasename(char *execfullname)
 int
 main(int argc, char *argv[])
 {
-	int err, arg;
+	int err, arg, uflag = 0, zflag = 0;
 	struct stat st;
+	uuid_t uuidin;
+	char zonename[ZONENAME_MAX + 1];
 
 	/* This must be before anything goes to stdout. */
 	setbuf(stdout, NULL);
@@ -7524,7 +8027,7 @@ main(int argc, char *argv[])
 		exit(Z_OK);
 	}
 
-	while ((arg = getopt(argc, argv, "?f:R:z:")) != EOF) {
+	while ((arg = getopt(argc, argv, "?f:R:z:u:")) != EOF) {
 		switch (arg) {
 		case '?':
 			if (optopt == '?')
@@ -7551,6 +8054,21 @@ main(int argc, char *argv[])
 			}
 			zonecfg_set_root(optarg);
 			break;
+		case 'u':
+			if (uuid_parse((char *)optarg, uuidin) == -1)
+				return (Z_INVALID_PROPERTY);
+
+			if (zonecfg_get_name_by_uuid(uuidin, zonename,
+			    ZONENAME_MAX) != Z_OK) {
+				zone_perror(optarg, Z_BOGUS_ZONE_NAME, B_TRUE);
+				usage(B_FALSE, HELP_SYNTAX);
+				exit(Z_USAGE);
+			}
+
+			(void) strlcpy(zone, zonename, sizeof (zone));
+			(void) strlcpy(revert_zone, zonename, sizeof (zone));
+			uflag = 1;
+			break;
 		case 'z':
 			if (strcmp(optarg, GLOBAL_ZONENAME) == 0) {
 				global_zone = B_TRUE;
@@ -7561,6 +8079,7 @@ main(int argc, char *argv[])
 			}
 			(void) strlcpy(zone, optarg, sizeof (zone));
 			(void) strlcpy(revert_zone, optarg, sizeof (zone));
+			zflag = 1;
 			break;
 		default:
 			usage(B_FALSE, HELP_USAGE);
@@ -7568,7 +8087,7 @@ main(int argc, char *argv[])
 		}
 	}
 
-	if (optind > argc || strcmp(zone, "") == 0) {
+	if (optind > argc || strcmp(zone, "") == 0 || (uflag && zflag)) {
 		usage(B_FALSE, HELP_USAGE);
 		exit(Z_USAGE);
 	}
diff --git a/usr/src/cmd/zonecfg/zonecfg.h b/usr/src/cmd/zonecfg/zonecfg.h
index 108d0ce507..e4ae4d4d61 100644
--- a/usr/src/cmd/zonecfg/zonecfg.h
+++ b/usr/src/cmd/zonecfg/zonecfg.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent Inc. All rights reserved.
  */
 
 #ifndef _ZONECFG_H
@@ -90,7 +91,9 @@ extern "C" {
 #define	RT_ADMIN	26
 #define	RT_FS_ALLOWED	27
 #define	RT_MAXPROCS	28	/* really a rctl alias property, but for info */
-#define	RT_SECFLAGS	29
+#define	RT_ZFSPRI	29	/* really a rctl alias property, but for info */
+#define	RT_UUID		30	/* really a property, but for info */
+#define	RT_SECFLAGS	31
 
 #define	RT_MIN		RT_UNKNOWN
 #define	RT_MAX		RT_SECFLAGS
@@ -138,9 +141,15 @@ extern "C" {
 #define	PT_FS_ALLOWED	39
 #define	PT_MAXPROCS	40
 #define	PT_ALLOWED_ADDRESS	41
-#define	PT_DEFAULT	42
-#define	PT_LOWER	43
-#define	PT_UPPER	44
+#define	PT_ZFSPRI	42
+#define	PT_MAC		43
+#define	PT_VLANID	44
+#define	PT_GNIC		45
+#define	PT_NPROP	46
+#define	PT_UUID		47
+#define	PT_DEFAULT	48
+#define	PT_LOWER	49
+#define	PT_UPPER	50
 
 #define	PT_MIN		PT_UNKNOWN
 #define	PT_MAX		PT_UPPER
diff --git a/usr/src/cmd/zonecfg/zonecfg_grammar.y b/usr/src/cmd/zonecfg/zonecfg_grammar.y
index 2e950512ec..d8b2fadb2f 100644
--- a/usr/src/cmd/zonecfg/zonecfg_grammar.y
+++ b/usr/src/cmd/zonecfg/zonecfg_grammar.y
@@ -22,6 +22,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent Inc. All rights reserved.
  */
 
 /*
@@ -135,7 +136,8 @@ complex_piece_func(int cp_type, const char *str, complex_property_ptr_t cp_next)
 %token NAME MATCH PRIV LIMIT ACTION VALUE EQUAL OPEN_SQ_BRACKET CLOSE_SQ_BRACKET
 %token OPEN_PAREN CLOSE_PAREN COMMA DATASET LIMITPRIV BOOTARGS BRAND PSET PCAP
 %token MCAP NCPUS IMPORTANCE SHARES MAXLWPS MAXSHMMEM MAXSHMIDS MAXMSGIDS
-%token MAXSEMIDS LOCKED SWAP SCHED CLEAR DEFROUTER ADMIN SECFLAGS USER AUTHS MAXPROCS
+%token MAXSEMIDS LOCKED SWAP SCHED CLEAR DEFROUTER ADMIN USER AUTHS MAXPROCS
+%token ZFSPRI MAC VLANID GNIC NPROP UUID SECFLAGS
 %token DEFAULT UPPER LOWER
 
 %type <strval> TOKEN EQUAL OPEN_SQ_BRACKET CLOSE_SQ_BRACKET
@@ -146,7 +148,7 @@ complex_piece_func(int cp_type, const char *str, complex_property_ptr_t cp_next)
 %type <ival> property_name SPECIAL RAW DIR OPTIONS TYPE ADDRESS PHYSICAL NAME
     MATCH ZONENAME ZONEPATH AUTOBOOT POOL LIMITPRIV BOOTARGS VALUE PRIV LIMIT
     ACTION BRAND SCHED IPTYPE DEFROUTER HOSTID USER AUTHS FS_ALLOWED
-    ALLOWED_ADDRESS DEFAULT UPPER LOWER
+    ALLOWED_ADDRESS MAC VLANID GNIC NPROP UUID DEFAULT UPPER LOWER
 %type <cmd> command
 %type <cmd> add_command ADD
 %type <cmd> cancel_command CANCEL
@@ -651,6 +653,24 @@ info_command:	INFO
 		$$->cmd_res_type = RT_FS_ALLOWED;
 		$$->cmd_prop_nv_pairs = 0;
 	}
+	|	INFO UUID
+	{
+		if (($$ = alloc_cmd()) == NULL)
+			YYERROR;
+		cmd = $$;
+		$$->cmd_handler = &info_func;
+		$$->cmd_res_type = RT_UUID;
+		$$->cmd_prop_nv_pairs = 0;
+	}
+	|	INFO ZFSPRI
+	{
+		if (($$ = alloc_cmd()) == NULL)
+			YYERROR;
+		cmd = $$;
+		$$->cmd_handler = &info_func;
+		$$->cmd_res_type = RT_ZFSPRI;
+		$$->cmd_prop_nv_pairs = 0;
+	}
 	|	INFO resource_type property_name EQUAL property_value
 	{
 		if (($$ = alloc_cmd()) == NULL)
@@ -735,6 +755,19 @@ remove_command: REMOVE
 		$$->cmd_prop_name[0] = $2;
 		$$->cmd_property_ptr[0] = &property[0];
 	}
+	| REMOVE TOKEN property_name property_value
+	{
+		if (($$ = alloc_cmd()) == NULL)
+			YYERROR;
+		cmd = $$;
+		$$->cmd_handler = &remove_func;
+		$$->cmd_argc = 1;
+		$$->cmd_argv[0] = claim_token($2);
+		$$->cmd_argv[1] = NULL;
+		$$->cmd_prop_nv_pairs = 1;
+		$$->cmd_prop_name[0] = $3;
+		$$->cmd_property_ptr[0] = &property[0];
+	}
 	| REMOVE resource_type property_name EQUAL property_value
 	{
 		if (($$ = alloc_cmd()) == NULL)
@@ -746,6 +779,20 @@ remove_command: REMOVE
 		$$->cmd_prop_name[0] = $3;
 		$$->cmd_property_ptr[0] = &property[0];
 	}
+	| REMOVE TOKEN resource_type property_name EQUAL property_value
+	{
+		if (($$ = alloc_cmd()) == NULL)
+			YYERROR;
+		cmd = $$;
+		$$->cmd_handler = &remove_func;
+		$$->cmd_res_type = $3;
+		$$->cmd_argc = 1;
+		$$->cmd_argv[0] = claim_token($2);
+		$$->cmd_argv[1] = NULL;
+		$$->cmd_prop_nv_pairs = 1;
+		$$->cmd_prop_name[0] = $4;
+		$$->cmd_property_ptr[0] = &property[0];
+	}
 	| REMOVE resource_type property_name EQUAL property_value property_name EQUAL property_value
 	{
 		if (($$ = alloc_cmd()) == NULL)
@@ -759,6 +806,22 @@ remove_command: REMOVE
 		$$->cmd_prop_name[1] = $6;
 		$$->cmd_property_ptr[1] = &property[1];
 	}
+	| REMOVE TOKEN resource_type property_name EQUAL property_value property_name EQUAL property_value
+	{
+		if (($$ = alloc_cmd()) == NULL)
+			YYERROR;
+		cmd = $$;
+		$$->cmd_handler = &remove_func;
+		$$->cmd_res_type = $3;
+		$$->cmd_argc = 1;
+		$$->cmd_argv[0] = claim_token($2);
+		$$->cmd_argv[1] = NULL;
+		$$->cmd_prop_nv_pairs = 2;
+		$$->cmd_prop_name[0] = $4;
+		$$->cmd_property_ptr[0] = &property[0];
+		$$->cmd_prop_name[1] = $7;
+		$$->cmd_property_ptr[1] = &property[1];
+	}
 	| REMOVE resource_type property_name EQUAL property_value property_name EQUAL property_value property_name EQUAL property_value
 	{
 		if (($$ = alloc_cmd()) == NULL)
@@ -774,6 +837,24 @@ remove_command: REMOVE
 		$$->cmd_prop_name[2] = $9;
 		$$->cmd_property_ptr[2] = &property[2];
 	}
+	| REMOVE TOKEN resource_type property_name EQUAL property_value property_name EQUAL property_value property_name EQUAL property_value
+	{
+		if (($$ = alloc_cmd()) == NULL)
+			YYERROR;
+		cmd = $$;
+		$$->cmd_handler = &remove_func;
+		$$->cmd_res_type = $3;
+		$$->cmd_argc = 1;
+		$$->cmd_argv[0] = claim_token($2);
+		$$->cmd_argv[1] = NULL;
+		$$->cmd_prop_nv_pairs = 3;
+		$$->cmd_prop_name[0] = $4;
+		$$->cmd_property_ptr[0] = &property[0];
+		$$->cmd_prop_name[1] = $7;
+		$$->cmd_property_ptr[1] = &property[1];
+		$$->cmd_prop_name[2] = $10;
+		$$->cmd_property_ptr[2] = &property[2];
+	}
 
 revert_command: REVERT
 	{
@@ -978,6 +1059,10 @@ property_name: SPECIAL	{ $$ = PT_SPECIAL; }
 	| ALLOWED_ADDRESS	{ $$ = PT_ALLOWED_ADDRESS; }
 	| PHYSICAL	{ $$ = PT_PHYSICAL; }
 	| DEFROUTER	{ $$ = PT_DEFROUTER; }
+	| MAC		{ $$ = PT_MAC; }
+	| VLANID	{ $$ = PT_VLANID; }
+	| GNIC		{ $$ = PT_GNIC; }
+	| NPROP		{ $$ = PT_NPROP; }
 	| NAME		{ $$ = PT_NAME; }
 	| VALUE		{ $$ = PT_VALUE; }
 	| MATCH		{ $$ = PT_MATCH; }
@@ -1001,6 +1086,8 @@ property_name: SPECIAL	{ $$ = PT_SPECIAL; }
 	| USER		{ $$ = PT_USER; }
 	| AUTHS 	{ $$ = PT_AUTHS; }
 	| FS_ALLOWED	{ $$ = PT_FS_ALLOWED; }
+	| UUID		{ $$ = PT_UUID; }
+	| ZFSPRI	{ $$ = PT_ZFSPRI; }
 	| DEFAULT	{ $$ = PT_DEFAULT; }
 	| UPPER		{ $$ = PT_UPPER; }
 	| LOWER		{ $$ = PT_LOWER; }
diff --git a/usr/src/cmd/zonecfg/zonecfg_lex.l b/usr/src/cmd/zonecfg/zonecfg_lex.l
index 8714c55499..05b41df48b 100644
--- a/usr/src/cmd/zonecfg/zonecfg_lex.l
+++ b/usr/src/cmd/zonecfg/zonecfg_lex.l
@@ -22,6 +22,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent Inc. All rights reserved.
  */
 
 #include <assert.h>
@@ -57,10 +58,11 @@ extern void yyerror(char *s);
 static char *create_token(char *s);
 %}
 
-%a 7000
-%p 5000
+%a 8000
+%p 5500
 %e 2000
 %n 1000
+%o 14000
 
 %{
 /*
@@ -238,6 +240,18 @@ static char *create_token(char *s);
 <TSTATE>defrouter	{ return DEFROUTER; }
 <CSTATE>defrouter	{ return DEFROUTER; }
 
+<TSTATE>mac-addr	{ return MAC; }
+<CSTATE>mac-addr	{ return MAC; }
+
+<TSTATE>vlan-id		{ return VLANID; }
+<CSTATE>vlan-id		{ return VLANID; }
+
+<TSTATE>global-nic	{ return GNIC; }
+<CSTATE>global-nic	{ return GNIC; }
+
+<TSTATE>property	{ return NPROP; }
+<CSTATE>property	{ return NPROP; }
+
 <TSTATE>dir	{ return DIR; }
 <CSTATE>dir	{ return DIR; }
 
@@ -310,6 +324,12 @@ static char *create_token(char *s);
 <TSTATE>fs-allowed	{ return FS_ALLOWED; }
 <CSTATE>fs-allowed	{ return FS_ALLOWED; }
 
+<TSTATE>uuid	{ return UUID; }
+<CSTATE>uuid	{ return UUID; }
+
+<TSTATE>zfs-io-priority	{ return ZFSPRI; }
+<CSTATE>zfs-io-priority	{ return ZFSPRI; }
+
 <TSTATE>default { return DEFAULT; }
 <CSTATE>default { return DEFAULT; }
 
@@ -368,6 +388,13 @@ static char *create_token(char *s);
 			return TOKEN;
 		}
 
+<CSTATE>\"[^\"\n]*[\"\n] {
+			yylval.strval = create_token(yytext + 1);
+			if (yylval.strval[yyleng - 2] == '"')
+				yylval.strval[yyleng - 2] = 0;
+			return TOKEN;
+		}
+
 <TSTATE>\"[^\"\n]*[\"\n] {
 			yylval.strval = create_token(yytext + 1);
 			if (yylval.strval[yyleng - 2] == '"')
diff --git a/usr/src/cmd/zonename/Makefile b/usr/src/cmd/zonename/Makefile
index 566e893a67..3a51952455 100644
--- a/usr/src/cmd/zonename/Makefile
+++ b/usr/src/cmd/zonename/Makefile
@@ -28,8 +28,10 @@
 #
 
 PROG=	zonename
+OBJS=	zonename.o
 
 include	../Makefile.cmd
+include ../Makefile.ctf
 
 LDLIBS +=	-lzonecfg
 
@@ -37,6 +39,10 @@ LDLIBS +=	-lzonecfg
 
 all: $(PROG)
 
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
 install: all $(ROOTSBINPROG)
 	$(RM) $(ROOTPROG)
 	$(SYMLINK) ../../sbin/$(PROG) $(ROOTPROG)
@@ -44,6 +50,10 @@ install: all $(ROOTSBINPROG)
 check:	$(PROG).c
 	$(CSTYLE) -pP $(PROG).c
 
+%.o: %.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
 clean:
 
 lint: lint_PROG
diff --git a/usr/src/cmd/zonestat/zonestatd/zonestatd.c b/usr/src/cmd/zonestat/zonestatd/zonestatd.c
index b764551131..6c293bcc0e 100644
--- a/usr/src/cmd/zonestat/zonestatd/zonestatd.c
+++ b/usr/src/cmd/zonestat/zonestatd/zonestatd.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent, Inc. All rights reserved.
  */
 #include <alloca.h>
 #include <assert.h>
@@ -2190,7 +2191,7 @@ zsd_get_zone_rctl_usage(char *name)
 	return (rctlblk_get_value(rblk));
 }
 
-#define	ZSD_NUM_RCTL_VALS 19
+#define	ZSD_NUM_RCTL_VALS 20
 
 /*
  * Fetch the limit information for a zone.  This uses zone_enter() as the
@@ -2237,12 +2238,6 @@ zsd_get_zone_caps(zsd_ctl_t *ctl, zsd_zone_t *zone, uint64_t *cpu_shares,
 	*msgids = 0;
 	*lofi = 0;
 
-	/* Get the ram cap first since it is a zone attr */
-	ret = zone_getattr(zone->zsz_id, ZONE_ATTR_PHYS_MCAP,
-	    ram_cap, sizeof (*ram_cap));
-	if (ret < 0 || *ram_cap == 0)
-		*ram_cap = ZS_LIMIT_NONE;
-
 	/* Get the zone's default scheduling class */
 	ret = zone_getattr(zone->zsz_id, ZONE_ATTR_SCHED_CLASS,
 	    class, sizeof (class));
@@ -2298,6 +2293,7 @@ zsd_get_zone_caps(zsd_ctl_t *ctl, zsd_zone_t *zone, uint64_t *cpu_shares,
 		vals[i++] = zsd_get_zone_rctl_usage("zone.max-msg-ids");
 		vals[i++] = zsd_get_zone_rctl_limit("zone.max-lofi");
 		vals[i++] = zsd_get_zone_rctl_usage("zone.max-lofi");
+		vals[i++] = zsd_get_zone_rctl_usage("zone.max-physical-memory");
 
 		if (write(p[1], vals, ZSD_NUM_RCTL_VALS * sizeof (uint64_t)) !=
 		    ZSD_NUM_RCTL_VALS * sizeof (uint64_t)) {
@@ -2342,6 +2338,7 @@ zsd_get_zone_caps(zsd_ctl_t *ctl, zsd_zone_t *zone, uint64_t *cpu_shares,
 	*msgids = vals[i++];
 	*lofi_cap = vals[i++];
 	*lofi = vals[i++];
+	*ram_cap = vals[i++];
 
 	/* Interpret maximum values as no cap */
 	if (*cpu_cap == UINT32_MAX || *cpu_cap == 0)
diff --git a/usr/src/cmd/zpool/zpool_main.c b/usr/src/cmd/zpool/zpool_main.c
index 31234e6207..01af9604a1 100644
--- a/usr/src/cmd/zpool/zpool_main.c
+++ b/usr/src/cmd/zpool/zpool_main.c
@@ -24,6 +24,7 @@
  * Copyright (c) 2011, 2018 by Delphix. All rights reserved.
  * Copyright (c) 2012 by Frederik Wessels. All rights reserved.
  * Copyright (c) 2013 by Prasad Joshi (sTec). All rights reserved.
+ * Copyright (c) 2013 Joyent, Inc. All rights reserved.
  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>.
  * Copyright 2016 Nexenta Systems, Inc.
  * Copyright (c) 2017 Datto Inc.
diff --git a/usr/src/common/acpica/disassembler/acpica-resync.patch b/usr/src/common/acpica/disassembler/acpica-resync.patch
new file mode 100644
index 0000000000..439905cee4
--- /dev/null
+++ b/usr/src/common/acpica/disassembler/acpica-resync.patch
@@ -0,0 +1,82 @@
+This file and its contents are supplied under the terms of the
+Common Development and Distribution License ("CDDL"), version 1.0.
+You may only use this file in accordance with the terms of version
+1.0 of the CDDL.
+
+A full copy of the text of the CDDL should have accompanied this
+source.  A copy of the CDDL is also available via the Internet at
+http://www.illumos.org/license/CDDL.
+
+Copyright (c) 2018, Joyent, Inc.
+
+---
+
+Files in this directory are used by kernel and user space code.  Things that are
+unsupported in the kernel need to be excluded for kernel builds.
+
+
+diff --git a/usr/src/common/acpica/disassembler/dmbuffer.c b/usr/src/common/acpica/disassembler/dmbuffer.c
+index 79c37e2..923a485 100644
+--- a/usr/src/common/acpica/disassembler/dmbuffer.c
++++ b/usr/src/common/acpica/disassembler/dmbuffer.c
+@@ -375,6 +375,7 @@ AcpiDmUuid (
+         Data[8], Data[9],
+         Data[10], Data[11], Data[12], Data[13], Data[14], Data[15]);
+ 
++#ifdef ACPI_APPLICATION
+     /* Dump the UUID description string if available */
+ 
+     Description = AcpiAhMatchUuid (Data);
+@@ -382,6 +383,7 @@ AcpiDmUuid (
+     {
+         AcpiOsPrintf (" /* %s */", Description);
+     }
++#endif
+ }
+ 
+ 
+diff --git a/usr/src/common/acpica/disassembler/dmresrcl2.c b/usr/src/common/acpica/disassembler/dmresrcl2.c
+index c725bec..2e32731 100644
+--- a/usr/src/common/acpica/disassembler/dmresrcl2.c
++++ b/usr/src/common/acpica/disassembler/dmresrcl2.c
+@@ -250,8 +250,10 @@ AcpiDmGpioCommon (
+     AcpiDmIndent (Level + 1);
+     AcpiOsPrintf ("}\n");
+ 
++#ifdef ACPI_APPLICATION
+     MpSaveGpioInfo (Info->MappingOp, Resource,
+         PinCount, PinList, DeviceName);
++#endif
+ }
+ 
+ 
+@@ -541,7 +543,9 @@ AcpiDmI2cSerialBusDescriptor (
+     AcpiDmDumpSerialBusVendorData (Resource, Level);
+     AcpiOsPrintf (")\n");
+ 
++#ifdef ACPI_APPLICATION
+     MpSaveSerialInfo (Info->MappingOp, Resource, DeviceName);
++#endif
+ }
+ 
+ 
+@@ -624,7 +628,9 @@ AcpiDmSpiSerialBusDescriptor (
+     AcpiDmDumpSerialBusVendorData (Resource, Level);
+     AcpiOsPrintf (")\n");
+ 
++#ifdef ACPI_APPLICATION
+     MpSaveSerialInfo (Info->MappingOp, Resource, DeviceName);
++#endif
+ }
+ 
+ 
+@@ -710,7 +716,9 @@ AcpiDmUartSerialBusDescriptor (
+     AcpiDmDumpSerialBusVendorData (Resource, Level);
+     AcpiOsPrintf (")\n");
+ 
++#ifdef ACPI_APPLICATION
+     MpSaveSerialInfo (Info->MappingOp, Resource, DeviceName);
++#endif
+ }
+ 
+ 
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmbuffer.c b/usr/src/common/acpica/disassembler/dmbuffer.c
index 923a4850d4..923a4850d4 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmbuffer.c
+++ b/usr/src/common/acpica/disassembler/dmbuffer.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmcstyle.c b/usr/src/common/acpica/disassembler/dmcstyle.c
index 2f61dea208..2f61dea208 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmcstyle.c
+++ b/usr/src/common/acpica/disassembler/dmcstyle.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmdeferred.c b/usr/src/common/acpica/disassembler/dmdeferred.c
index 387980b893..387980b893 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmdeferred.c
+++ b/usr/src/common/acpica/disassembler/dmdeferred.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmnames.c b/usr/src/common/acpica/disassembler/dmnames.c
index 89cfb2e985..89cfb2e985 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmnames.c
+++ b/usr/src/common/acpica/disassembler/dmnames.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmopcode.c b/usr/src/common/acpica/disassembler/dmopcode.c
index 7ca171cbbb..7ca171cbbb 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmopcode.c
+++ b/usr/src/common/acpica/disassembler/dmopcode.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmresrc.c b/usr/src/common/acpica/disassembler/dmresrc.c
index a486f1d892..a486f1d892 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmresrc.c
+++ b/usr/src/common/acpica/disassembler/dmresrc.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmresrcl.c b/usr/src/common/acpica/disassembler/dmresrcl.c
index 52fd3356b8..52fd3356b8 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmresrcl.c
+++ b/usr/src/common/acpica/disassembler/dmresrcl.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmresrcl2.c b/usr/src/common/acpica/disassembler/dmresrcl2.c
index 2e3273113c..2e3273113c 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmresrcl2.c
+++ b/usr/src/common/acpica/disassembler/dmresrcl2.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmresrcs.c b/usr/src/common/acpica/disassembler/dmresrcs.c
index c601f36492..c601f36492 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmresrcs.c
+++ b/usr/src/common/acpica/disassembler/dmresrcs.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmutils.c b/usr/src/common/acpica/disassembler/dmutils.c
index 02717bc6ad..02717bc6ad 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmutils.c
+++ b/usr/src/common/acpica/disassembler/dmutils.c
diff --git a/usr/src/uts/intel/io/acpica/disassembler/dmwalk.c b/usr/src/common/acpica/disassembler/dmwalk.c
index 3c953f5465..3c953f5465 100644
--- a/usr/src/uts/intel/io/acpica/disassembler/dmwalk.c
+++ b/usr/src/common/acpica/disassembler/dmwalk.c
diff --git a/usr/src/common/acpica/dispatcher/acpica-resync.patch b/usr/src/common/acpica/dispatcher/acpica-resync.patch
new file mode 100644
index 0000000000..876e68961c
--- /dev/null
+++ b/usr/src/common/acpica/dispatcher/acpica-resync.patch
@@ -0,0 +1,114 @@
+This file and its contents are supplied under the terms of the
+Common Development and Distribution License ("CDDL"), version 1.0.
+You may only use this file in accordance with the terms of version
+1.0 of the CDDL.
+
+A full copy of the text of the CDDL should have accompanied this
+source.  A copy of the CDDL is also available via the Internet at
+http://www.illumos.org/license/CDDL.
+
+Copyright (c) 2018, Joyent, Inc.
+
+---
+
+Files in this directory are used by kernel and user space code.  Things that are
+unsupported in the kernel need to be excluded for kernel builds.
+
+diff --git a/usr/src/common/acpica/dispatcher/dscontrol.c b/usr/src/common/acpica/dispatcher/dscontrol.c
+index 3509f16..d603619 100644
+--- a/usr/src/common/acpica/dispatcher/dscontrol.c
++++ b/usr/src/common/acpica/dispatcher/dscontrol.c
+@@ -360,12 +360,14 @@ AcpiDsExecEndControlOp (
+ 
+     case AML_BREAK_POINT_OP:
+ 
++#ifdef ACPI_DEBUGGER
+         AcpiDbSignalBreakPoint (WalkState);
+ 
+         /* Call to the OSL in case OS wants a piece of the action */
+ 
+         Status = AcpiOsSignal (ACPI_SIGNAL_BREAKPOINT,
+             "Executed AML Breakpoint opcode");
++#endif
+         break;
+ 
+     case AML_BREAK_OP:
+diff --git a/usr/src/common/acpica/dispatcher/dsutils.c b/usr/src/common/acpica/dispatcher/dsutils.c
+index 66eac34..e294c83 100644
+--- a/usr/src/common/acpica/dispatcher/dsutils.c
++++ b/usr/src/common/acpica/dispatcher/dsutils.c
+@@ -647,7 +647,9 @@ AcpiDsCreateOperand (
+             return_ACPI_STATUS (Status);
+         }
+ 
++#ifdef ACPI_DEBUGGER
+         AcpiDbDisplayArgumentObject (ObjDesc, WalkState);
++#endif
+     }
+     else
+     {
+@@ -686,8 +688,10 @@ AcpiDsCreateOperand (
+             ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH,
+                 "Argument previously created, already stacked\n"));
+ 
++#ifdef ACPI_DEBUGGER
+             AcpiDbDisplayArgumentObject (
+                 WalkState->Operands [WalkState->NumOperands - 1], WalkState);
++#endif
+ 
+             /*
+              * Use value that was already previously returned
+@@ -734,7 +738,9 @@ AcpiDsCreateOperand (
+             return_ACPI_STATUS (Status);
+         }
+ 
++#ifdef ACPI_DEBUGGER
+         AcpiDbDisplayArgumentObject (ObjDesc, WalkState);
++#endif
+     }
+ 
+     return_ACPI_STATUS (AE_OK);
+diff --git a/usr/src/common/acpica/dispatcher/dswexec.c b/usr/src/common/acpica/dispatcher/dswexec.c
+index 307af60..8408ebf 100644
+--- a/usr/src/common/acpica/dispatcher/dswexec.c
++++ b/usr/src/common/acpica/dispatcher/dswexec.c
+@@ -193,9 +193,11 @@ Cleanup:
+         "Completed a predicate eval=%X Op=%p\n",
+         WalkState->ControlState->Common.Value, WalkState->Op));
+ 
++#ifdef ACPI_DEBUGGER
+     /* Break to debugger to display result */
+ 
+     AcpiDbDisplayResultObject (LocalObjDesc, WalkState);
++#endif
+ 
+     /*
+      * Delete the predicate result object (we know that
+@@ -419,6 +421,7 @@ AcpiDsExecEndOp (
+     WalkState->ReturnDesc = NULL;
+     WalkState->ResultObj = NULL;
+ 
++#ifdef ACPI_DEBUGGER
+     /* Call debugger for single step support (DEBUG build only) */
+ 
+     Status = AcpiDbSingleStep (WalkState, Op, OpClass);
+@@ -426,6 +429,7 @@ AcpiDsExecEndOp (
+     {
+         return_ACPI_STATUS (Status);
+     }
++#endif
+ 
+     /* Decode the Opcode Class */
+ 
+@@ -755,9 +759,11 @@ Cleanup:
+ 
+     if (WalkState->ResultObj)
+     {
++#ifdef ACPI_DEBUGGER
+         /* Break to debugger to display result */
+ 
+         AcpiDbDisplayResultObject (WalkState->ResultObj,WalkState);
++#endif
+ 
+         /*
+          * Delete the result op if and only if:
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsargs.c b/usr/src/common/acpica/dispatcher/dsargs.c
index 5e5e93b4ec..5e5e93b4ec 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsargs.c
+++ b/usr/src/common/acpica/dispatcher/dsargs.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dscontrol.c b/usr/src/common/acpica/dispatcher/dscontrol.c
index d60361921b..d60361921b 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dscontrol.c
+++ b/usr/src/common/acpica/dispatcher/dscontrol.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsdebug.c b/usr/src/common/acpica/dispatcher/dsdebug.c
index adeb448c42..adeb448c42 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsdebug.c
+++ b/usr/src/common/acpica/dispatcher/dsdebug.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsfield.c b/usr/src/common/acpica/dispatcher/dsfield.c
index 2516c131dc..2516c131dc 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsfield.c
+++ b/usr/src/common/acpica/dispatcher/dsfield.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsinit.c b/usr/src/common/acpica/dispatcher/dsinit.c
index 74e974da03..74e974da03 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsinit.c
+++ b/usr/src/common/acpica/dispatcher/dsinit.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsmethod.c b/usr/src/common/acpica/dispatcher/dsmethod.c
index 334dadcac6..334dadcac6 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsmethod.c
+++ b/usr/src/common/acpica/dispatcher/dsmethod.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsmthdat.c b/usr/src/common/acpica/dispatcher/dsmthdat.c
index 32f9850a72..32f9850a72 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsmthdat.c
+++ b/usr/src/common/acpica/dispatcher/dsmthdat.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsobject.c b/usr/src/common/acpica/dispatcher/dsobject.c
index 3f7b540580..3f7b540580 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsobject.c
+++ b/usr/src/common/acpica/dispatcher/dsobject.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsopcode.c b/usr/src/common/acpica/dispatcher/dsopcode.c
index 1c6b342570..1c6b342570 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsopcode.c
+++ b/usr/src/common/acpica/dispatcher/dsopcode.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dsutils.c b/usr/src/common/acpica/dispatcher/dsutils.c
index e294c836e0..e294c836e0 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dsutils.c
+++ b/usr/src/common/acpica/dispatcher/dsutils.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dswexec.c b/usr/src/common/acpica/dispatcher/dswexec.c
index 8408ebf2f6..8408ebf2f6 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dswexec.c
+++ b/usr/src/common/acpica/dispatcher/dswexec.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dswload.c b/usr/src/common/acpica/dispatcher/dswload.c
index db55661208..db55661208 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dswload.c
+++ b/usr/src/common/acpica/dispatcher/dswload.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dswload2.c b/usr/src/common/acpica/dispatcher/dswload2.c
index 2c099ef0f0..2c099ef0f0 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dswload2.c
+++ b/usr/src/common/acpica/dispatcher/dswload2.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dswscope.c b/usr/src/common/acpica/dispatcher/dswscope.c
index a2497cfa33..a2497cfa33 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dswscope.c
+++ b/usr/src/common/acpica/dispatcher/dswscope.c
diff --git a/usr/src/uts/intel/io/acpica/dispatcher/dswstate.c b/usr/src/common/acpica/dispatcher/dswstate.c
index f56f393aa7..f56f393aa7 100644
--- a/usr/src/uts/intel/io/acpica/dispatcher/dswstate.c
+++ b/usr/src/common/acpica/dispatcher/dswstate.c
diff --git a/usr/src/uts/intel/io/acpica/events/evevent.c b/usr/src/common/acpica/events/evevent.c
index 98b3da506b..98b3da506b 100644
--- a/usr/src/uts/intel/io/acpica/events/evevent.c
+++ b/usr/src/common/acpica/events/evevent.c
diff --git a/usr/src/uts/intel/io/acpica/events/evglock.c b/usr/src/common/acpica/events/evglock.c
index caafa977bc..caafa977bc 100644
--- a/usr/src/uts/intel/io/acpica/events/evglock.c
+++ b/usr/src/common/acpica/events/evglock.c
diff --git a/usr/src/uts/intel/io/acpica/events/evgpe.c b/usr/src/common/acpica/events/evgpe.c
index d683bfdfaa..d683bfdfaa 100644
--- a/usr/src/uts/intel/io/acpica/events/evgpe.c
+++ b/usr/src/common/acpica/events/evgpe.c
diff --git a/usr/src/uts/intel/io/acpica/events/evgpeblk.c b/usr/src/common/acpica/events/evgpeblk.c
index 2e1d354d15..2e1d354d15 100644
--- a/usr/src/uts/intel/io/acpica/events/evgpeblk.c
+++ b/usr/src/common/acpica/events/evgpeblk.c
diff --git a/usr/src/uts/intel/io/acpica/events/evgpeinit.c b/usr/src/common/acpica/events/evgpeinit.c
index 8e2fd34023..8e2fd34023 100644
--- a/usr/src/uts/intel/io/acpica/events/evgpeinit.c
+++ b/usr/src/common/acpica/events/evgpeinit.c
diff --git a/usr/src/uts/intel/io/acpica/events/evgpeutil.c b/usr/src/common/acpica/events/evgpeutil.c
index ff4b1cddc6..ff4b1cddc6 100644
--- a/usr/src/uts/intel/io/acpica/events/evgpeutil.c
+++ b/usr/src/common/acpica/events/evgpeutil.c
diff --git a/usr/src/uts/intel/io/acpica/events/evhandler.c b/usr/src/common/acpica/events/evhandler.c
index d63cad8d2d..d63cad8d2d 100644
--- a/usr/src/uts/intel/io/acpica/events/evhandler.c
+++ b/usr/src/common/acpica/events/evhandler.c
diff --git a/usr/src/uts/intel/io/acpica/events/evmisc.c b/usr/src/common/acpica/events/evmisc.c
index 30fc6f0c28..30fc6f0c28 100644
--- a/usr/src/uts/intel/io/acpica/events/evmisc.c
+++ b/usr/src/common/acpica/events/evmisc.c
diff --git a/usr/src/uts/intel/io/acpica/events/evregion.c b/usr/src/common/acpica/events/evregion.c
index 673d44d191..673d44d191 100644
--- a/usr/src/uts/intel/io/acpica/events/evregion.c
+++ b/usr/src/common/acpica/events/evregion.c
diff --git a/usr/src/uts/intel/io/acpica/events/evrgnini.c b/usr/src/common/acpica/events/evrgnini.c
index a9e6be0391..a9e6be0391 100644
--- a/usr/src/uts/intel/io/acpica/events/evrgnini.c
+++ b/usr/src/common/acpica/events/evrgnini.c
diff --git a/usr/src/uts/intel/io/acpica/events/evsci.c b/usr/src/common/acpica/events/evsci.c
index c35cba702d..c35cba702d 100644
--- a/usr/src/uts/intel/io/acpica/events/evsci.c
+++ b/usr/src/common/acpica/events/evsci.c
diff --git a/usr/src/uts/intel/io/acpica/events/evxface.c b/usr/src/common/acpica/events/evxface.c
index edace79649..edace79649 100644
--- a/usr/src/uts/intel/io/acpica/events/evxface.c
+++ b/usr/src/common/acpica/events/evxface.c
diff --git a/usr/src/uts/intel/io/acpica/events/evxfevnt.c b/usr/src/common/acpica/events/evxfevnt.c
index 9991751c67..9991751c67 100644
--- a/usr/src/uts/intel/io/acpica/events/evxfevnt.c
+++ b/usr/src/common/acpica/events/evxfevnt.c
diff --git a/usr/src/uts/intel/io/acpica/events/evxfgpe.c b/usr/src/common/acpica/events/evxfgpe.c
index 1d467d9abc..1d467d9abc 100644
--- a/usr/src/uts/intel/io/acpica/events/evxfgpe.c
+++ b/usr/src/common/acpica/events/evxfgpe.c
diff --git a/usr/src/uts/intel/io/acpica/events/evxfregn.c b/usr/src/common/acpica/events/evxfregn.c
index 8537640d6c..8537640d6c 100644
--- a/usr/src/uts/intel/io/acpica/events/evxfregn.c
+++ b/usr/src/common/acpica/events/evxfregn.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exconcat.c b/usr/src/common/acpica/executer/exconcat.c
index 49b279ad05..49b279ad05 100644
--- a/usr/src/uts/intel/io/acpica/executer/exconcat.c
+++ b/usr/src/common/acpica/executer/exconcat.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exconfig.c b/usr/src/common/acpica/executer/exconfig.c
index bb0d2bb411..bb0d2bb411 100644
--- a/usr/src/uts/intel/io/acpica/executer/exconfig.c
+++ b/usr/src/common/acpica/executer/exconfig.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exconvrt.c b/usr/src/common/acpica/executer/exconvrt.c
index ea6f82620d..ea6f82620d 100644
--- a/usr/src/uts/intel/io/acpica/executer/exconvrt.c
+++ b/usr/src/common/acpica/executer/exconvrt.c
diff --git a/usr/src/uts/intel/io/acpica/executer/excreate.c b/usr/src/common/acpica/executer/excreate.c
index 26dd872a3c..26dd872a3c 100644
--- a/usr/src/uts/intel/io/acpica/executer/excreate.c
+++ b/usr/src/common/acpica/executer/excreate.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exdebug.c b/usr/src/common/acpica/executer/exdebug.c
index 0832337e48..0832337e48 100644
--- a/usr/src/uts/intel/io/acpica/executer/exdebug.c
+++ b/usr/src/common/acpica/executer/exdebug.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exdump.c b/usr/src/common/acpica/executer/exdump.c
index f5d5fd03a5..f5d5fd03a5 100644
--- a/usr/src/uts/intel/io/acpica/executer/exdump.c
+++ b/usr/src/common/acpica/executer/exdump.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exfield.c b/usr/src/common/acpica/executer/exfield.c
index 208af63794..208af63794 100644
--- a/usr/src/uts/intel/io/acpica/executer/exfield.c
+++ b/usr/src/common/acpica/executer/exfield.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exfldio.c b/usr/src/common/acpica/executer/exfldio.c
index fd46a0c023..fd46a0c023 100644
--- a/usr/src/uts/intel/io/acpica/executer/exfldio.c
+++ b/usr/src/common/acpica/executer/exfldio.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exmisc.c b/usr/src/common/acpica/executer/exmisc.c
index a8e5497a9d..a8e5497a9d 100644
--- a/usr/src/uts/intel/io/acpica/executer/exmisc.c
+++ b/usr/src/common/acpica/executer/exmisc.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exmutex.c b/usr/src/common/acpica/executer/exmutex.c
index 30e10af38c..30e10af38c 100644
--- a/usr/src/uts/intel/io/acpica/executer/exmutex.c
+++ b/usr/src/common/acpica/executer/exmutex.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exnames.c b/usr/src/common/acpica/executer/exnames.c
index 817a011b2c..817a011b2c 100644
--- a/usr/src/uts/intel/io/acpica/executer/exnames.c
+++ b/usr/src/common/acpica/executer/exnames.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exoparg1.c b/usr/src/common/acpica/executer/exoparg1.c
index 5a45bead06..5a45bead06 100644
--- a/usr/src/uts/intel/io/acpica/executer/exoparg1.c
+++ b/usr/src/common/acpica/executer/exoparg1.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exoparg2.c b/usr/src/common/acpica/executer/exoparg2.c
index 7fe91a8181..7fe91a8181 100644
--- a/usr/src/uts/intel/io/acpica/executer/exoparg2.c
+++ b/usr/src/common/acpica/executer/exoparg2.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exoparg3.c b/usr/src/common/acpica/executer/exoparg3.c
index de46a97c9c..de46a97c9c 100644
--- a/usr/src/uts/intel/io/acpica/executer/exoparg3.c
+++ b/usr/src/common/acpica/executer/exoparg3.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exoparg6.c b/usr/src/common/acpica/executer/exoparg6.c
index 2cc8f59bb0..2cc8f59bb0 100644
--- a/usr/src/uts/intel/io/acpica/executer/exoparg6.c
+++ b/usr/src/common/acpica/executer/exoparg6.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exprep.c b/usr/src/common/acpica/executer/exprep.c
index 51f2714ab0..51f2714ab0 100644
--- a/usr/src/uts/intel/io/acpica/executer/exprep.c
+++ b/usr/src/common/acpica/executer/exprep.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exregion.c b/usr/src/common/acpica/executer/exregion.c
index 58d3a0c24b..58d3a0c24b 100644
--- a/usr/src/uts/intel/io/acpica/executer/exregion.c
+++ b/usr/src/common/acpica/executer/exregion.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exresnte.c b/usr/src/common/acpica/executer/exresnte.c
index 9a85450de9..9a85450de9 100644
--- a/usr/src/uts/intel/io/acpica/executer/exresnte.c
+++ b/usr/src/common/acpica/executer/exresnte.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exresolv.c b/usr/src/common/acpica/executer/exresolv.c
index 4b6202f4fb..4b6202f4fb 100644
--- a/usr/src/uts/intel/io/acpica/executer/exresolv.c
+++ b/usr/src/common/acpica/executer/exresolv.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exresop.c b/usr/src/common/acpica/executer/exresop.c
index 32ceb6f021..32ceb6f021 100644
--- a/usr/src/uts/intel/io/acpica/executer/exresop.c
+++ b/usr/src/common/acpica/executer/exresop.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exstore.c b/usr/src/common/acpica/executer/exstore.c
index cb18c036c5..cb18c036c5 100644
--- a/usr/src/uts/intel/io/acpica/executer/exstore.c
+++ b/usr/src/common/acpica/executer/exstore.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exstoren.c b/usr/src/common/acpica/executer/exstoren.c
index 7a69927b12..7a69927b12 100644
--- a/usr/src/uts/intel/io/acpica/executer/exstoren.c
+++ b/usr/src/common/acpica/executer/exstoren.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exstorob.c b/usr/src/common/acpica/executer/exstorob.c
index 8418fb85a2..8418fb85a2 100644
--- a/usr/src/uts/intel/io/acpica/executer/exstorob.c
+++ b/usr/src/common/acpica/executer/exstorob.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exsystem.c b/usr/src/common/acpica/executer/exsystem.c
index a215e8012d..a215e8012d 100644
--- a/usr/src/uts/intel/io/acpica/executer/exsystem.c
+++ b/usr/src/common/acpica/executer/exsystem.c
diff --git a/usr/src/uts/intel/io/acpica/executer/extrace.c b/usr/src/common/acpica/executer/extrace.c
index 6f8a707ae4..6f8a707ae4 100644
--- a/usr/src/uts/intel/io/acpica/executer/extrace.c
+++ b/usr/src/common/acpica/executer/extrace.c
diff --git a/usr/src/uts/intel/io/acpica/executer/exutils.c b/usr/src/common/acpica/executer/exutils.c
index 4843a20891..4843a20891 100644
--- a/usr/src/uts/intel/io/acpica/executer/exutils.c
+++ b/usr/src/common/acpica/executer/exutils.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwacpi.c b/usr/src/common/acpica/hardware/hwacpi.c
index 73512128d5..73512128d5 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwacpi.c
+++ b/usr/src/common/acpica/hardware/hwacpi.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwesleep.c b/usr/src/common/acpica/hardware/hwesleep.c
index de914df853..de914df853 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwesleep.c
+++ b/usr/src/common/acpica/hardware/hwesleep.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwgpe.c b/usr/src/common/acpica/hardware/hwgpe.c
index 3dbf10ba0a..3dbf10ba0a 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwgpe.c
+++ b/usr/src/common/acpica/hardware/hwgpe.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwpci.c b/usr/src/common/acpica/hardware/hwpci.c
index c2b707122d..c2b707122d 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwpci.c
+++ b/usr/src/common/acpica/hardware/hwpci.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwregs.c b/usr/src/common/acpica/hardware/hwregs.c
index bc85c96b55..bc85c96b55 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwregs.c
+++ b/usr/src/common/acpica/hardware/hwregs.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwsleep.c b/usr/src/common/acpica/hardware/hwsleep.c
index 13cf255137..13cf255137 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwsleep.c
+++ b/usr/src/common/acpica/hardware/hwsleep.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwtimer.c b/usr/src/common/acpica/hardware/hwtimer.c
index 64b2a8aaf5..64b2a8aaf5 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwtimer.c
+++ b/usr/src/common/acpica/hardware/hwtimer.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwvalid.c b/usr/src/common/acpica/hardware/hwvalid.c
index 64507d0418..64507d0418 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwvalid.c
+++ b/usr/src/common/acpica/hardware/hwvalid.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwxface.c b/usr/src/common/acpica/hardware/hwxface.c
index f5d4fca6b9..f5d4fca6b9 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwxface.c
+++ b/usr/src/common/acpica/hardware/hwxface.c
diff --git a/usr/src/uts/intel/io/acpica/hardware/hwxfsleep.c b/usr/src/common/acpica/hardware/hwxfsleep.c
index 7a0eaf5061..7a0eaf5061 100644
--- a/usr/src/uts/intel/io/acpica/hardware/hwxfsleep.c
+++ b/usr/src/common/acpica/hardware/hwxfsleep.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsaccess.c b/usr/src/common/acpica/namespace/nsaccess.c
index eb6fed6230..eb6fed6230 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsaccess.c
+++ b/usr/src/common/acpica/namespace/nsaccess.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsalloc.c b/usr/src/common/acpica/namespace/nsalloc.c
index 72a974f5b4..72a974f5b4 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsalloc.c
+++ b/usr/src/common/acpica/namespace/nsalloc.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsarguments.c b/usr/src/common/acpica/namespace/nsarguments.c
index 1483e8121b..1483e8121b 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsarguments.c
+++ b/usr/src/common/acpica/namespace/nsarguments.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsconvert.c b/usr/src/common/acpica/namespace/nsconvert.c
index 2fa182eddc..2fa182eddc 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsconvert.c
+++ b/usr/src/common/acpica/namespace/nsconvert.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsdump.c b/usr/src/common/acpica/namespace/nsdump.c
index 32ada86001..32ada86001 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsdump.c
+++ b/usr/src/common/acpica/namespace/nsdump.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsdumpdv.c b/usr/src/common/acpica/namespace/nsdumpdv.c
index ea143fb5b4..ea143fb5b4 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsdumpdv.c
+++ b/usr/src/common/acpica/namespace/nsdumpdv.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nseval.c b/usr/src/common/acpica/namespace/nseval.c
index 63051b8a52..63051b8a52 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nseval.c
+++ b/usr/src/common/acpica/namespace/nseval.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsinit.c b/usr/src/common/acpica/namespace/nsinit.c
index dbe6c7c09f..dbe6c7c09f 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsinit.c
+++ b/usr/src/common/acpica/namespace/nsinit.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsload.c b/usr/src/common/acpica/namespace/nsload.c
index 9c899e7846..9c899e7846 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsload.c
+++ b/usr/src/common/acpica/namespace/nsload.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsnames.c b/usr/src/common/acpica/namespace/nsnames.c
index 95f8c8db97..95f8c8db97 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsnames.c
+++ b/usr/src/common/acpica/namespace/nsnames.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsobject.c b/usr/src/common/acpica/namespace/nsobject.c
index cf2436155b..cf2436155b 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsobject.c
+++ b/usr/src/common/acpica/namespace/nsobject.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsparse.c b/usr/src/common/acpica/namespace/nsparse.c
index 1ff33362ed..1ff33362ed 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsparse.c
+++ b/usr/src/common/acpica/namespace/nsparse.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nspredef.c b/usr/src/common/acpica/namespace/nspredef.c
index ccd4aba8f2..ccd4aba8f2 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nspredef.c
+++ b/usr/src/common/acpica/namespace/nspredef.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsprepkg.c b/usr/src/common/acpica/namespace/nsprepkg.c
index ae75c1a018..ae75c1a018 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsprepkg.c
+++ b/usr/src/common/acpica/namespace/nsprepkg.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsrepair.c b/usr/src/common/acpica/namespace/nsrepair.c
index 524fcf6671..524fcf6671 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsrepair.c
+++ b/usr/src/common/acpica/namespace/nsrepair.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsrepair2.c b/usr/src/common/acpica/namespace/nsrepair2.c
index d8625899a6..d8625899a6 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsrepair2.c
+++ b/usr/src/common/acpica/namespace/nsrepair2.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nssearch.c b/usr/src/common/acpica/namespace/nssearch.c
index 3a0fe90ea4..3a0fe90ea4 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nssearch.c
+++ b/usr/src/common/acpica/namespace/nssearch.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsutils.c b/usr/src/common/acpica/namespace/nsutils.c
index 72f9105ef5..72f9105ef5 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsutils.c
+++ b/usr/src/common/acpica/namespace/nsutils.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nswalk.c b/usr/src/common/acpica/namespace/nswalk.c
index 08637a6eee..08637a6eee 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nswalk.c
+++ b/usr/src/common/acpica/namespace/nswalk.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsxfeval.c b/usr/src/common/acpica/namespace/nsxfeval.c
index b88ecf507e..b88ecf507e 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsxfeval.c
+++ b/usr/src/common/acpica/namespace/nsxfeval.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsxfname.c b/usr/src/common/acpica/namespace/nsxfname.c
index cfd6937f49..cfd6937f49 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsxfname.c
+++ b/usr/src/common/acpica/namespace/nsxfname.c
diff --git a/usr/src/uts/intel/io/acpica/namespace/nsxfobj.c b/usr/src/common/acpica/namespace/nsxfobj.c
index f006047431..f006047431 100644
--- a/usr/src/uts/intel/io/acpica/namespace/nsxfobj.c
+++ b/usr/src/common/acpica/namespace/nsxfobj.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psargs.c b/usr/src/common/acpica/parser/psargs.c
index a4745c3adc..a4745c3adc 100644
--- a/usr/src/uts/intel/io/acpica/parser/psargs.c
+++ b/usr/src/common/acpica/parser/psargs.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psloop.c b/usr/src/common/acpica/parser/psloop.c
index e0839fd7d8..e0839fd7d8 100644
--- a/usr/src/uts/intel/io/acpica/parser/psloop.c
+++ b/usr/src/common/acpica/parser/psloop.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psobject.c b/usr/src/common/acpica/parser/psobject.c
index 7edc39e2b7..7edc39e2b7 100644
--- a/usr/src/uts/intel/io/acpica/parser/psobject.c
+++ b/usr/src/common/acpica/parser/psobject.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psopcode.c b/usr/src/common/acpica/parser/psopcode.c
index ec44339b76..ec44339b76 100644
--- a/usr/src/uts/intel/io/acpica/parser/psopcode.c
+++ b/usr/src/common/acpica/parser/psopcode.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psopinfo.c b/usr/src/common/acpica/parser/psopinfo.c
index 324d87a93f..324d87a93f 100644
--- a/usr/src/uts/intel/io/acpica/parser/psopinfo.c
+++ b/usr/src/common/acpica/parser/psopinfo.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psparse.c b/usr/src/common/acpica/parser/psparse.c
index 810d97e0e0..810d97e0e0 100644
--- a/usr/src/uts/intel/io/acpica/parser/psparse.c
+++ b/usr/src/common/acpica/parser/psparse.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psscope.c b/usr/src/common/acpica/parser/psscope.c
index f5b89d0f5d..f5b89d0f5d 100644
--- a/usr/src/uts/intel/io/acpica/parser/psscope.c
+++ b/usr/src/common/acpica/parser/psscope.c
diff --git a/usr/src/uts/intel/io/acpica/parser/pstree.c b/usr/src/common/acpica/parser/pstree.c
index 729856982b..729856982b 100644
--- a/usr/src/uts/intel/io/acpica/parser/pstree.c
+++ b/usr/src/common/acpica/parser/pstree.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psutils.c b/usr/src/common/acpica/parser/psutils.c
index 9b1019c711..9b1019c711 100644
--- a/usr/src/uts/intel/io/acpica/parser/psutils.c
+++ b/usr/src/common/acpica/parser/psutils.c
diff --git a/usr/src/uts/intel/io/acpica/parser/pswalk.c b/usr/src/common/acpica/parser/pswalk.c
index fb6071adef..fb6071adef 100644
--- a/usr/src/uts/intel/io/acpica/parser/pswalk.c
+++ b/usr/src/common/acpica/parser/pswalk.c
diff --git a/usr/src/uts/intel/io/acpica/parser/psxface.c b/usr/src/common/acpica/parser/psxface.c
index a6fe31648e..a6fe31648e 100644
--- a/usr/src/uts/intel/io/acpica/parser/psxface.c
+++ b/usr/src/common/acpica/parser/psxface.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsaddr.c b/usr/src/common/acpica/resources/rsaddr.c
index 4a3823c82c..4a3823c82c 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsaddr.c
+++ b/usr/src/common/acpica/resources/rsaddr.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rscalc.c b/usr/src/common/acpica/resources/rscalc.c
index 92a710c1eb..92a710c1eb 100644
--- a/usr/src/uts/intel/io/acpica/resources/rscalc.c
+++ b/usr/src/common/acpica/resources/rscalc.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rscreate.c b/usr/src/common/acpica/resources/rscreate.c
index 64bbdbe995..64bbdbe995 100644
--- a/usr/src/uts/intel/io/acpica/resources/rscreate.c
+++ b/usr/src/common/acpica/resources/rscreate.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsdump.c b/usr/src/common/acpica/resources/rsdump.c
index e7948850bc..e7948850bc 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsdump.c
+++ b/usr/src/common/acpica/resources/rsdump.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsdumpinfo.c b/usr/src/common/acpica/resources/rsdumpinfo.c
index bc779ce58c..bc779ce58c 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsdumpinfo.c
+++ b/usr/src/common/acpica/resources/rsdumpinfo.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsinfo.c b/usr/src/common/acpica/resources/rsinfo.c
index 15f6105c80..15f6105c80 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsinfo.c
+++ b/usr/src/common/acpica/resources/rsinfo.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsio.c b/usr/src/common/acpica/resources/rsio.c
index 442a7b8b3a..442a7b8b3a 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsio.c
+++ b/usr/src/common/acpica/resources/rsio.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsirq.c b/usr/src/common/acpica/resources/rsirq.c
index d094a9bfd9..d094a9bfd9 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsirq.c
+++ b/usr/src/common/acpica/resources/rsirq.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rslist.c b/usr/src/common/acpica/resources/rslist.c
index 0f7a496031..0f7a496031 100644
--- a/usr/src/uts/intel/io/acpica/resources/rslist.c
+++ b/usr/src/common/acpica/resources/rslist.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsmemory.c b/usr/src/common/acpica/resources/rsmemory.c
index 90e58fc20e..90e58fc20e 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsmemory.c
+++ b/usr/src/common/acpica/resources/rsmemory.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsmisc.c b/usr/src/common/acpica/resources/rsmisc.c
index 73019a9b6d..73019a9b6d 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsmisc.c
+++ b/usr/src/common/acpica/resources/rsmisc.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsserial.c b/usr/src/common/acpica/resources/rsserial.c
index 1eae4502f7..1eae4502f7 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsserial.c
+++ b/usr/src/common/acpica/resources/rsserial.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsutils.c b/usr/src/common/acpica/resources/rsutils.c
index cec4180bfd..cec4180bfd 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsutils.c
+++ b/usr/src/common/acpica/resources/rsutils.c
diff --git a/usr/src/uts/intel/io/acpica/resources/rsxface.c b/usr/src/common/acpica/resources/rsxface.c
index 81c9ac8b4c..81c9ac8b4c 100644
--- a/usr/src/uts/intel/io/acpica/resources/rsxface.c
+++ b/usr/src/common/acpica/resources/rsxface.c
diff --git a/usr/src/uts/intel/io/acpica/tables/tbdata.c b/usr/src/common/acpica/tables/tbdata.c
index 31fa25b92e..31fa25b92e 100644
--- a/usr/src/uts/intel/io/acpica/tables/tbdata.c
+++ b/usr/src/common/acpica/tables/tbdata.c
diff --git a/usr/src/uts/intel/io/acpica/tables/tbfadt.c b/usr/src/common/acpica/tables/tbfadt.c
index 51eb49b42a..51eb49b42a 100644
--- a/usr/src/uts/intel/io/acpica/tables/tbfadt.c
+++ b/usr/src/common/acpica/tables/tbfadt.c
diff --git a/usr/src/uts/intel/io/acpica/tables/tbfind.c b/usr/src/common/acpica/tables/tbfind.c
index 32839a3cd3..32839a3cd3 100644
--- a/usr/src/uts/intel/io/acpica/tables/tbfind.c
+++ b/usr/src/common/acpica/tables/tbfind.c
diff --git a/usr/src/uts/intel/io/acpica/tables/tbinstal.c b/usr/src/common/acpica/tables/tbinstal.c
index 78e8b4ec8b..78e8b4ec8b 100644
--- a/usr/src/uts/intel/io/acpica/tables/tbinstal.c
+++ b/usr/src/common/acpica/tables/tbinstal.c
diff --git a/usr/src/cmd/acpi/acpidump/tbprint.c b/usr/src/common/acpica/tables/tbprint.c
index 9dab6d9d4a..9dab6d9d4a 100644
--- a/usr/src/cmd/acpi/acpidump/tbprint.c
+++ b/usr/src/common/acpica/tables/tbprint.c
diff --git a/usr/src/uts/intel/io/acpica/tables/tbutils.c b/usr/src/common/acpica/tables/tbutils.c
index 5fc07b76e0..5fc07b76e0 100644
--- a/usr/src/uts/intel/io/acpica/tables/tbutils.c
+++ b/usr/src/common/acpica/tables/tbutils.c
diff --git a/usr/src/uts/intel/io/acpica/tables/tbxface.c b/usr/src/common/acpica/tables/tbxface.c
index 8c0caaee75..8c0caaee75 100644
--- a/usr/src/uts/intel/io/acpica/tables/tbxface.c
+++ b/usr/src/common/acpica/tables/tbxface.c
diff --git a/usr/src/uts/intel/io/acpica/tables/tbxfload.c b/usr/src/common/acpica/tables/tbxfload.c
index 645b9d57ac..645b9d57ac 100644
--- a/usr/src/uts/intel/io/acpica/tables/tbxfload.c
+++ b/usr/src/common/acpica/tables/tbxfload.c
diff --git a/usr/src/cmd/acpi/acpidump/tbxfroot.c b/usr/src/common/acpica/tables/tbxfroot.c
index aaa24c470f..aaa24c470f 100644
--- a/usr/src/cmd/acpi/acpidump/tbxfroot.c
+++ b/usr/src/common/acpica/tables/tbxfroot.c
diff --git a/usr/src/common/acpica/utilities/acpica-resync.patch b/usr/src/common/acpica/utilities/acpica-resync.patch
new file mode 100644
index 0000000000..c4b48acc2c
--- /dev/null
+++ b/usr/src/common/acpica/utilities/acpica-resync.patch
@@ -0,0 +1,72 @@
+
+
+This file and its contents are supplied under the terms of the
+Common Development and Distribution License ("CDDL"), version 1.0.
+You may only use this file in accordance with the terms of version
+1.0 of the CDDL.
+
+A full copy of the text of the CDDL should have accompanied this
+source.  A copy of the CDDL is also available via the Internet at
+http://www.illumos.org/license/CDDL.
+
+Copyright (c) 2018, Joyent, Inc.
+
+---
+
+There is a bug in the interaction of acpidump and acpixtract when the table
+size is greater than 1MB. The acpixtract code will stop parsing a table if
+the first character on a line is not a space (' '). The acpidump code will
+overflow the offset into the first character after 1MB. Until this is fixed
+upstream, the following patch can be used against new versions of the acpi
+source.
+
+
+diff --git a/usr/src/common/acpica/utilities/utbuffer.c b/usr/src/common/acpica/utilities/utbuffer.c
+index 2f97c64..863055f 100644
+--- a/usr/src/common/acpica/utilities/utbuffer.c
++++ b/usr/src/common/acpica/utilities/utbuffer.c
+@@ -97,7 +97,7 @@ AcpiUtDumpBuffer (
+     {
+         /* Print current offset */
+ 
+-        AcpiOsPrintf ("%6.4X: ", (BaseOffset + i));
++        AcpiOsPrintf ("%7.4X: ", (BaseOffset + i));
+ 
+         /* Print 16 hex chars */
+ 
+@@ -279,7 +279,7 @@ AcpiUtDumpBufferToFile (
+     {
+         /* Print current offset */
+ 
+-        AcpiUtFilePrintf (File, "%6.4X: ", (BaseOffset + i));
++        AcpiUtFilePrintf (File, "%7.4X: ", (BaseOffset + i));
+ 
+         /* Print 16 hex chars */
+ 
+diff --git a/usr/src/common/acpica/utilities/utosi.c b/usr/src/common/acpica/utilities/utosi.c
+index 674fe36..18656fa 100644
+--- a/usr/src/common/acpica/utilities/utosi.c
++++ b/usr/src/common/acpica/utilities/utosi.c
+@@ -103,9 +103,19 @@ static ACPI_INTERFACE_INFO    AcpiDefaultSupportedInterfaces[] =
+     {"Windows 2006 SP1",    NULL, 0, ACPI_OSI_WIN_VISTA_SP1},    /* Windows Vista SP1 - Added 09/2009 */
+     {"Windows 2006 SP2",    NULL, 0, ACPI_OSI_WIN_VISTA_SP2},    /* Windows Vista SP2 - Added 09/2010 */
+     {"Windows 2009",        NULL, 0, ACPI_OSI_WIN_7},            /* Windows 7 and Server 2008 R2 - Added 09/2009 */
+-    {"Windows 2012",        NULL, 0, ACPI_OSI_WIN_8},            /* Windows 8 and Server 2012 - Added 08/2012 */
+-    {"Windows 2013",        NULL, 0, ACPI_OSI_WIN_8},            /* Windows 8.1 and Server 2012 R2 - Added 01/2014 */
+-    {"Windows 2015",        NULL, 0, ACPI_OSI_WIN_10},           /* Windows 10 - Added 03/2015 */
++	/*
++	 * XXX
++	 * The following OSes are temporarily disabled. Windows introduced
++	 * support for xhci (USB 3.0) in Windows 8. When we advertise Windows 8
++	 * and newer support, some vendors use that as a key to automatically
++	 * transition all USB ports to the xhci controller. Until we have
++	 * support for the xhci controller, we should not advertise these
++	 * operating systems. From a brief survey, there isn't too much other
++	 * AML that this impacts at this time.
++	 */
++/*    {"Windows 2012",        NULL, 0, ACPI_OSI_WIN_8},*/            /* Windows 8 and Server 2012 - Added 08/2012 */
++/*    {"Windows 2013",        NULL, 0, ACPI_OSI_WIN_8},*/            /* Windows 8.1 and Server 2012 R2 - Added 01/2014 */
++/*    {"Windows 2015",        NULL, 0, ACPI_OSI_WIN_10},*/           /* Windows 10 - Added 03/2015 */
+ 
+     /* Feature Group Strings */
+ 
diff --git a/usr/src/uts/intel/io/acpica/utilities/utaddress.c b/usr/src/common/acpica/utilities/utaddress.c
index 4b36391e24..4b36391e24 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utaddress.c
+++ b/usr/src/common/acpica/utilities/utaddress.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utalloc.c b/usr/src/common/acpica/utilities/utalloc.c
index bb29586e89..bb29586e89 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utalloc.c
+++ b/usr/src/common/acpica/utilities/utalloc.c
diff --git a/usr/src/cmd/acpi/common/utascii.c b/usr/src/common/acpica/utilities/utascii.c
index 25c02e674e..25c02e674e 100644
--- a/usr/src/cmd/acpi/common/utascii.c
+++ b/usr/src/common/acpica/utilities/utascii.c
diff --git a/usr/src/cmd/acpi/acpidump/utbuffer.c b/usr/src/common/acpica/utilities/utbuffer.c
index 2f97c64771..2f97c64771 100644
--- a/usr/src/cmd/acpi/acpidump/utbuffer.c
+++ b/usr/src/common/acpica/utilities/utbuffer.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utcache.c b/usr/src/common/acpica/utilities/utcache.c
index 049dae8e98..049dae8e98 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utcache.c
+++ b/usr/src/common/acpica/utilities/utcache.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utclib.c b/usr/src/common/acpica/utilities/utclib.c
index 8c188d00a4..8c188d00a4 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utclib.c
+++ b/usr/src/common/acpica/utilities/utclib.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utcopy.c b/usr/src/common/acpica/utilities/utcopy.c
index 40abdfb76b..40abdfb76b 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utcopy.c
+++ b/usr/src/common/acpica/utilities/utcopy.c
diff --git a/usr/src/cmd/acpi/common/utdebug.c b/usr/src/common/acpica/utilities/utdebug.c
index 6a298d175b..6a298d175b 100644
--- a/usr/src/cmd/acpi/common/utdebug.c
+++ b/usr/src/common/acpica/utilities/utdebug.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utdecode.c b/usr/src/common/acpica/utilities/utdecode.c
index 5c8f2cec80..5c8f2cec80 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utdecode.c
+++ b/usr/src/common/acpica/utilities/utdecode.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utdelete.c b/usr/src/common/acpica/utilities/utdelete.c
index 95a98f5681..95a98f5681 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utdelete.c
+++ b/usr/src/common/acpica/utilities/utdelete.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/uterror.c b/usr/src/common/acpica/utilities/uterror.c
index 86d2368521..86d2368521 100644
--- a/usr/src/uts/intel/io/acpica/utilities/uterror.c
+++ b/usr/src/common/acpica/utilities/uterror.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/uteval.c b/usr/src/common/acpica/utilities/uteval.c
index d4864f3813..d4864f3813 100644
--- a/usr/src/uts/intel/io/acpica/utilities/uteval.c
+++ b/usr/src/common/acpica/utilities/uteval.c
diff --git a/usr/src/cmd/acpi/common/utexcep.c b/usr/src/common/acpica/utilities/utexcep.c
index 5be8efd5f2..5be8efd5f2 100644
--- a/usr/src/cmd/acpi/common/utexcep.c
+++ b/usr/src/common/acpica/utilities/utexcep.c
diff --git a/usr/src/cmd/acpi/common/utglobal.c b/usr/src/common/acpica/utilities/utglobal.c
index 0d8dff88c9..0d8dff88c9 100644
--- a/usr/src/cmd/acpi/common/utglobal.c
+++ b/usr/src/common/acpica/utilities/utglobal.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/uthex.c b/usr/src/common/acpica/utilities/uthex.c
index b93013b200..b93013b200 100644
--- a/usr/src/uts/intel/io/acpica/utilities/uthex.c
+++ b/usr/src/common/acpica/utilities/uthex.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utids.c b/usr/src/common/acpica/utilities/utids.c
index 7182a91ae8..7182a91ae8 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utids.c
+++ b/usr/src/common/acpica/utilities/utids.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utinit.c b/usr/src/common/acpica/utilities/utinit.c
index 03c3e510b8..03c3e510b8 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utinit.c
+++ b/usr/src/common/acpica/utilities/utinit.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utlock.c b/usr/src/common/acpica/utilities/utlock.c
index c62a37d9f5..c62a37d9f5 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utlock.c
+++ b/usr/src/common/acpica/utilities/utlock.c
diff --git a/usr/src/cmd/acpi/common/utmath.c b/usr/src/common/acpica/utilities/utmath.c
index aa3d762c0d..aa3d762c0d 100644
--- a/usr/src/cmd/acpi/common/utmath.c
+++ b/usr/src/common/acpica/utilities/utmath.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utmisc.c b/usr/src/common/acpica/utilities/utmisc.c
index ce8f25426d..ce8f25426d 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utmisc.c
+++ b/usr/src/common/acpica/utilities/utmisc.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utmutex.c b/usr/src/common/acpica/utilities/utmutex.c
index 83b1cee0d7..83b1cee0d7 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utmutex.c
+++ b/usr/src/common/acpica/utilities/utmutex.c
diff --git a/usr/src/cmd/acpi/common/utnonansi.c b/usr/src/common/acpica/utilities/utnonansi.c
index 70fb33e64c..70fb33e64c 100644
--- a/usr/src/cmd/acpi/common/utnonansi.c
+++ b/usr/src/common/acpica/utilities/utnonansi.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utobject.c b/usr/src/common/acpica/utilities/utobject.c
index ed3b85f1d7..ed3b85f1d7 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utobject.c
+++ b/usr/src/common/acpica/utilities/utobject.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utosi.c b/usr/src/common/acpica/utilities/utosi.c
index 18656fa017..18656fa017 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utosi.c
+++ b/usr/src/common/acpica/utilities/utosi.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utownerid.c b/usr/src/common/acpica/utilities/utownerid.c
index 8fe67bc332..8fe67bc332 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utownerid.c
+++ b/usr/src/common/acpica/utilities/utownerid.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utpredef.c b/usr/src/common/acpica/utilities/utpredef.c
index 0f6658ecf7..0f6658ecf7 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utpredef.c
+++ b/usr/src/common/acpica/utilities/utpredef.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utprint.c b/usr/src/common/acpica/utilities/utprint.c
index aedcc78be5..aedcc78be5 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utprint.c
+++ b/usr/src/common/acpica/utilities/utprint.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utresrc.c b/usr/src/common/acpica/utilities/utresrc.c
index 8efae42977..8efae42977 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utresrc.c
+++ b/usr/src/common/acpica/utilities/utresrc.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utstate.c b/usr/src/common/acpica/utilities/utstate.c
index deffd283ca..deffd283ca 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utstate.c
+++ b/usr/src/common/acpica/utilities/utstate.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utstring.c b/usr/src/common/acpica/utilities/utstring.c
index cb46193e6e..cb46193e6e 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utstring.c
+++ b/usr/src/common/acpica/utilities/utstring.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/uttrack.c b/usr/src/common/acpica/utilities/uttrack.c
index 9efa9d6ec7..9efa9d6ec7 100644
--- a/usr/src/uts/intel/io/acpica/utilities/uttrack.c
+++ b/usr/src/common/acpica/utilities/uttrack.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utuuid.c b/usr/src/common/acpica/utilities/utuuid.c
index df48912a23..df48912a23 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utuuid.c
+++ b/usr/src/common/acpica/utilities/utuuid.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utxface.c b/usr/src/common/acpica/utilities/utxface.c
index a8452c3295..a8452c3295 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utxface.c
+++ b/usr/src/common/acpica/utilities/utxface.c
diff --git a/usr/src/cmd/acpi/common/utxferror.c b/usr/src/common/acpica/utilities/utxferror.c
index e79ffc94f3..e79ffc94f3 100644
--- a/usr/src/cmd/acpi/common/utxferror.c
+++ b/usr/src/common/acpica/utilities/utxferror.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utxfinit.c b/usr/src/common/acpica/utilities/utxfinit.c
index 2a518bc82d..2a518bc82d 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utxfinit.c
+++ b/usr/src/common/acpica/utilities/utxfinit.c
diff --git a/usr/src/uts/intel/io/acpica/utilities/utxfmutex.c b/usr/src/common/acpica/utilities/utxfmutex.c
index f47fbe5546..f47fbe5546 100644
--- a/usr/src/uts/intel/io/acpica/utilities/utxfmutex.c
+++ b/usr/src/common/acpica/utilities/utxfmutex.c
diff --git a/usr/src/common/brand/lx/lx_auxv.c b/usr/src/common/brand/lx/lx_auxv.c
new file mode 100644
index 0000000000..2ed5fd0517
--- /dev/null
+++ b/usr/src/common/brand/lx/lx_auxv.c
@@ -0,0 +1,96 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/auxv.h>
+#include <sys/lx_brand.h>
+
+/*
+ * Linux does not make the distinction between 'int' and 'long' when it comes
+ * to the format of the aux vector.  In order to properly clear the struct
+ * padding present in the native auxv_t in 64-bit, we employ the Linux format.
+ */
+struct lx_auxv {
+	long la_type;
+	long la_val;
+};
+
+int
+lx_auxv_stol(const auxv_t *ap, auxv_t *oap, const lx_elf_data_t *edp)
+{
+	struct lx_auxv *loap = (struct lx_auxv *)oap;
+
+	switch (ap->a_type) {
+	case AT_BASE:
+		loap->la_val = edp->ed_base;
+		break;
+	case AT_ENTRY:
+		loap->la_val = edp->ed_entry;
+		break;
+	case AT_PHDR:
+		loap->la_val = edp->ed_phdr;
+		break;
+	case AT_PHENT:
+		loap->la_val = edp->ed_phent;
+		break;
+	case AT_PHNUM:
+		loap->la_val = edp->ed_phnum;
+		break;
+	case AT_SUN_BRAND_LX_SYSINFO_EHDR:
+		loap->la_type = AT_SYSINFO_EHDR;
+		loap->la_val = ap->a_un.a_val;
+		return (0);
+	case AT_SUN_BRAND_LX_CLKTCK:
+		loap->la_type = AT_CLKTCK;
+		loap->la_val = ap->a_un.a_val;
+		return (0);
+	case AT_SUN_AUXFLAGS:
+		if ((ap->a_un.a_val & AF_SUN_SETUGID) != 0) {
+			loap->la_type = AT_SECURE;
+			loap->la_val = 1;
+			return (0);
+		} else {
+			return (1);
+		}
+	case AT_SUN_GID:
+		loap->la_type = AT_LX_EGID;
+		loap->la_val = ap->a_un.a_val;
+		return (0);
+	case AT_SUN_RGID:
+		loap->la_type = AT_LX_GID;
+		loap->la_val = ap->a_un.a_val;
+		return (0);
+	case AT_SUN_UID:
+		loap->la_type = AT_LX_EUID;
+		loap->la_val = ap->a_un.a_val;
+		return (0);
+	case AT_SUN_RUID:
+		loap->la_type = AT_LX_UID;
+		loap->la_val = ap->a_un.a_val;
+		return (0);
+	case AT_EXECFD:
+	case AT_PAGESZ:
+	case AT_FLAGS:
+	case AT_RANDOM:
+	case AT_NULL:
+		/* No translate needed */
+		loap->la_val = ap->a_un.a_val;
+		break;
+	default:
+		/* All other unrecognized entries are ignored */
+		return (1);
+	}
+	loap->la_type = ap->a_type;
+	return (0);
+}
diff --git a/usr/src/common/brand/lx/lx_auxv.h b/usr/src/common/brand/lx/lx_auxv.h
new file mode 100644
index 0000000000..190d939f35
--- /dev/null
+++ b/usr/src/common/brand/lx/lx_auxv.h
@@ -0,0 +1,32 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef	_LX_AUXV_H
+#define	_LX_AUXV_H
+
+#include <sys/auxv.h>
+#include <sys/lx_brand.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+extern int lx_auxv_stol(const auxv_t *, auxv_t *, const lx_elf_data_t *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_AUXV_H */
diff --git a/usr/src/common/brand/lx/lx_errno.c b/usr/src/common/brand/lx/lx_errno.c
new file mode 100644
index 0000000000..269ed470dc
--- /dev/null
+++ b/usr/src/common/brand/lx/lx_errno.c
@@ -0,0 +1,206 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * This file contains a mapping table and lookup function for converting
+ * illumos native error numbers into error numbers appropriate for Linux
+ * emulation.
+ *
+ * The translation table is generated by the "gen_errno", built from and
+ * documented in "usr/src/common/brand/lx/tools".
+ */
+
+#include <sys/debug.h>
+
+const int
+lx_stol_errno[] = {
+	0,	/*   0: No Error					*/
+	1,	/*   1: EPERM		-->   1: EPERM			*/
+	2,	/*   2: ENOENT		-->   2: ENOENT			*/
+	3,	/*   3: ESRCH		-->   3: ESRCH			*/
+	4,	/*   4: EINTR		-->   4: EINTR			*/
+	5,	/*   5: EIO		-->   5: EIO			*/
+	6,	/*   6: ENXIO		-->   6: ENXIO			*/
+	7,	/*   7: E2BIG		-->   7: E2BIG			*/
+	8,	/*   8: ENOEXEC		-->   8: ENOEXEC		*/
+	9,	/*   9: EBADF		-->   9: EBADF			*/
+	10,	/*  10: ECHILD		-->  10: ECHILD			*/
+	11,	/*  11: EAGAIN		-->  11: EAGAIN			*/
+	12,	/*  12: ENOMEM		-->  12: ENOMEM			*/
+	13,	/*  13: EACCES		-->  13: EACCES			*/
+	14,	/*  14: EFAULT		-->  14: EFAULT			*/
+	15,	/*  15: ENOTBLK		-->  15: ENOTBLK		*/
+	16,	/*  16: EBUSY		-->  16: EBUSY			*/
+	17,	/*  17: EEXIST		-->  17: EEXIST			*/
+	18,	/*  18: EXDEV		-->  18: EXDEV			*/
+	19,	/*  19: ENODEV		-->  19: ENODEV			*/
+	20,	/*  20: ENOTDIR		-->  20: ENOTDIR		*/
+	21,	/*  21: EISDIR		-->  21: EISDIR			*/
+	22,	/*  22: EINVAL		-->  22: EINVAL			*/
+	23,	/*  23: ENFILE		-->  23: ENFILE			*/
+	24,	/*  24: EMFILE		-->  24: EMFILE			*/
+	25,	/*  25: ENOTTY		-->  25: ENOTTY			*/
+	26,	/*  26: ETXTBSY		-->  26: ETXTBSY		*/
+	27,	/*  27: EFBIG		-->  27: EFBIG			*/
+	28,	/*  28: ENOSPC		-->  28: ENOSPC			*/
+	29,	/*  29: ESPIPE		-->  29: ESPIPE			*/
+	30,	/*  30: EROFS		-->  30: EROFS			*/
+	31,	/*  31: EMLINK		-->  31: EMLINK			*/
+	32,	/*  32: EPIPE		-->  32: EPIPE			*/
+	33,	/*  33: EDOM		-->  33: EDOM			*/
+	34,	/*  34: ERANGE		-->  34: ERANGE			*/
+	42,	/*  35: ENOMSG		-->  42: ENOMSG			*/
+	43,	/*  36: EIDRM		-->  43: EIDRM			*/
+	44,	/*  37: ECHRNG		-->  44: ECHRNG			*/
+	45,	/*  38: EL2NSYNC	-->  45: EL2NSYNC		*/
+	46,	/*  39: EL3HLT		-->  46: EL3HLT			*/
+	47,	/*  40: EL3RST		-->  47: EL3RST			*/
+	48,	/*  41: ELNRNG		-->  48: ELNRNG			*/
+	49,	/*  42: EUNATCH		-->  49: EUNATCH		*/
+	50,	/*  43: ENOCSI		-->  50: ENOCSI			*/
+	51,	/*  44: EL2HLT		-->  51: EL2HLT			*/
+	35,	/*  45: EDEADLK		-->  35: EDEADLK		*/
+	37,	/*  46: ENOLCK		-->  37: ENOLCK			*/
+	125,	/*  47: ECANCELED	--> 125: ECANCELED		*/
+	38,	/*  48: ENOTSUP		-->  38: ENOSYS			*/
+	122,	/*  49: EDQUOT		--> 122: EDQUOT			*/
+	52,	/*  50: EBADE		-->  52: EBADE			*/
+	53,	/*  51: EBADR		-->  53: EBADR			*/
+	54,	/*  52: EXFULL		-->  54: EXFULL			*/
+	55,	/*  53: ENOANO		-->  55: ENOANO			*/
+	56,	/*  54: EBADRQC		-->  56: EBADRQC		*/
+	57,	/*  55: EBADSLT		-->  57: EBADSLT		*/
+	35,	/*  56: EDEADLOCK	-->  35: EDEADLK		*/
+	59,	/*  57: EBFONT		-->  59: EBFONT			*/
+	130,	/*  58: EOWNERDEAD	--> 130: EOWNERDEAD		*/
+	131,	/*  59: ENOTRECOVERABLE	--> 131: ENOTRECOVERABLE	*/
+	60,	/*  60: ENOSTR		-->  60: ENOSTR			*/
+	61,	/*  61: ENODATA		-->  61: ENODATA		*/
+	62,	/*  62: ETIME		-->  62: ETIME			*/
+	63,	/*  63: ENOSR		-->  63: ENOSR			*/
+	64,	/*  64: ENONET		-->  64: ENONET			*/
+	65,	/*  65: ENOPKG		-->  65: ENOPKG			*/
+	66,	/*  66: EREMOTE		-->  66: EREMOTE		*/
+	67,	/*  67: ENOLINK		-->  67: ENOLINK		*/
+	68,	/*  68: EADV		-->  68: EADV			*/
+	69,	/*  69: ESRMNT		-->  69: ESRMNT			*/
+	70,	/*  70: ECOMM		-->  70: ECOMM			*/
+	71,	/*  71: EPROTO		-->  71: EPROTO			*/
+	-2,	/*  72: ELOCKUNMAPPED	-->  -2: No Analogue		*/
+	-2,	/*  73: ENOTACTIVE	-->  -2: No Analogue		*/
+	72,	/*  74: EMULTIHOP	-->  72: EMULTIHOP		*/
+	-1,	/*  75: Unused Number					*/
+	-1,	/*  76: Unused Number					*/
+	74,	/*  77: EBADMSG		-->  74: EBADMSG		*/
+	36,	/*  78: ENAMETOOLONG	-->  36: ENAMETOOLONG		*/
+	75,	/*  79: EOVERFLOW	-->  75: EOVERFLOW		*/
+	76,	/*  80: ENOTUNIQ	-->  76: ENOTUNIQ		*/
+	77,	/*  81: EBADFD		-->  77: EBADFD			*/
+	78,	/*  82: EREMCHG		-->  78: EREMCHG		*/
+	79,	/*  83: ELIBACC		-->  79: ELIBACC		*/
+	80,	/*  84: ELIBBAD		-->  80: ELIBBAD		*/
+	81,	/*  85: ELIBSCN		-->  81: ELIBSCN		*/
+	82,	/*  86: ELIBMAX		-->  82: ELIBMAX		*/
+	83,	/*  87: ELIBEXEC	-->  83: ELIBEXEC		*/
+	84,	/*  88: EILSEQ		-->  84: EILSEQ			*/
+	38,	/*  89: ENOSYS		-->  38: ENOSYS			*/
+	40,	/*  90: ELOOP		-->  40: ELOOP			*/
+	85,	/*  91: ERESTART	-->  85: ERESTART		*/
+	86,	/*  92: ESTRPIPE	-->  86: ESTRPIPE		*/
+	39,	/*  93: ENOTEMPTY	-->  39: ENOTEMPTY		*/
+	87,	/*  94: EUSERS		-->  87: EUSERS			*/
+	88,	/*  95: ENOTSOCK	-->  88: ENOTSOCK		*/
+	89,	/*  96: EDESTADDRREQ	-->  89: EDESTADDRREQ		*/
+	90,	/*  97: EMSGSIZE	-->  90: EMSGSIZE		*/
+	91,	/*  98: EPROTOTYPE	-->  91: EPROTOTYPE		*/
+	92,	/*  99: ENOPROTOOPT	-->  92: ENOPROTOOPT		*/
+	-1,	/* 100: Unused Number					*/
+	-1,	/* 101: Unused Number					*/
+	-1,	/* 102: Unused Number					*/
+	-1,	/* 103: Unused Number					*/
+	-1,	/* 104: Unused Number					*/
+	-1,	/* 105: Unused Number					*/
+	-1,	/* 106: Unused Number					*/
+	-1,	/* 107: Unused Number					*/
+	-1,	/* 108: Unused Number					*/
+	-1,	/* 109: Unused Number					*/
+	-1,	/* 110: Unused Number					*/
+	-1,	/* 111: Unused Number					*/
+	-1,	/* 112: Unused Number					*/
+	-1,	/* 113: Unused Number					*/
+	-1,	/* 114: Unused Number					*/
+	-1,	/* 115: Unused Number					*/
+	-1,	/* 116: Unused Number					*/
+	-1,	/* 117: Unused Number					*/
+	-1,	/* 118: Unused Number					*/
+	-1,	/* 119: Unused Number					*/
+	93,	/* 120: EPROTONOSUPPORT	-->  93: EPROTONOSUPPORT	*/
+	94,	/* 121: ESOCKTNOSUPPORT	-->  94: ESOCKTNOSUPPORT	*/
+	95,	/* 122: EOPNOTSUPP	-->  95: EOPNOTSUPP		*/
+	96,	/* 123: EPFNOSUPPORT	-->  96: EPFNOSUPPORT		*/
+	97,	/* 124: EAFNOSUPPORT	-->  97: EAFNOSUPPORT		*/
+	98,	/* 125: EADDRINUSE	-->  98: EADDRINUSE		*/
+	99,	/* 126: EADDRNOTAVAIL	-->  99: EADDRNOTAVAIL		*/
+	100,	/* 127: ENETDOWN	--> 100: ENETDOWN		*/
+	101,	/* 128: ENETUNREACH	--> 101: ENETUNREACH		*/
+	102,	/* 129: ENETRESET	--> 102: ENETRESET		*/
+	103,	/* 130: ECONNABORTED	--> 103: ECONNABORTED		*/
+	104,	/* 131: ECONNRESET	--> 104: ECONNRESET		*/
+	105,	/* 132: ENOBUFS		--> 105: ENOBUFS		*/
+	106,	/* 133: EISCONN		--> 106: EISCONN		*/
+	107,	/* 134: ENOTCONN	--> 107: ENOTCONN		*/
+	-1,	/* 135: Unused Number					*/
+	-1,	/* 136: Unused Number					*/
+	-1,	/* 137: Unused Number					*/
+	-1,	/* 138: Unused Number					*/
+	-1,	/* 139: Unused Number					*/
+	-1,	/* 140: Unused Number					*/
+	-1,	/* 141: Unused Number					*/
+	-1,	/* 142: Unused Number					*/
+	108,	/* 143: ESHUTDOWN	--> 108: ESHUTDOWN		*/
+	109,	/* 144: ETOOMANYREFS	--> 109: ETOOMANYREFS		*/
+	110,	/* 145: ETIMEDOUT	--> 110: ETIMEDOUT		*/
+	111,	/* 146: ECONNREFUSED	--> 111: ECONNREFUSED		*/
+	112,	/* 147: EHOSTDOWN	--> 112: EHOSTDOWN		*/
+	113,	/* 148: EHOSTUNREACH	--> 113: EHOSTUNREACH		*/
+	114,	/* 149: EALREADY	--> 114: EALREADY		*/
+	115,	/* 150: EINPROGRESS	--> 115: EINPROGRESS		*/
+	116	/* 151: ESTALE		--> 116: ESTALE			*/
+};
+
+/*
+ * Convert an illumos native error number to a Linux error number and return
+ * it.  If no valid conversion is possible, the function fails back to the
+ * value of "defval".  In userland, passing a default error number of "-1"
+ * will abort the program if the error number could not be converted.
+ */
+int
+lx_errno(int native_errno, int defval)
+{
+#ifdef	_KERNEL
+	VERIFY3S(defval, >=, 0);
+#endif
+
+	if (native_errno < 0 || native_errno >= (sizeof (lx_stol_errno) /
+	    sizeof (lx_stol_errno[0]))) {
+#ifndef	_KERNEL
+		VERIFY3S(defval, >=, 0);
+#endif
+
+		return (defval);
+	}
+
+	return (lx_stol_errno[native_errno]);
+}
diff --git a/usr/src/common/brand/lx/lx_errno.h b/usr/src/common/brand/lx/lx_errno.h
new file mode 100644
index 0000000000..10b6b3066c
--- /dev/null
+++ b/usr/src/common/brand/lx/lx_errno.h
@@ -0,0 +1,29 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LX_ERRNO_H
+#define	_LX_ERRNO_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern int lx_errno(int, int);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LX_ERRNO_H */
diff --git a/usr/src/common/brand/lx/lx_signum.c b/usr/src/common/brand/lx/lx_signum.c
new file mode 100644
index 0000000000..9c861c282a
--- /dev/null
+++ b/usr/src/common/brand/lx/lx_signum.c
@@ -0,0 +1,339 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/signal.h>
+#include <sys/lx_siginfo.h>
+#include <lx_signum.h>
+#include <sys/debug.h>
+
+/*
+ * Delivering signals to a Linux process is complicated by differences in
+ * signal numbering, stack structure and contents, and the action taken when a
+ * signal handler exits.  In addition, many signal-related structures, such as
+ * sigset_ts, vary between Solaris and Linux.
+ *
+ * The simplest transformation that must be done when sending signals is to
+ * translate between Linux and Solaris signal numbers.
+ *
+ * These are the major signal number differences between Linux and Solaris:
+ *
+ * 	====================================
+ * 	| Number |   Linux    |  Solaris   |
+ * 	| ====== | =========  | ========== |
+ *	|    7   | SIGBUS     | SIGEMT     |
+ *	|   10   | SIGUSR1    | SIGBUS     |
+ *	|   12   | SIGUSR2    | SIGSYS     |
+ *	|   16   | SIGSTKFLT  | SIGUSR1    |
+ *	|   17   | SIGCHLD    | SIGUSR2    |
+ * 	|   18   | SIGCONT    | SIGCHLD    |
+ *	|   19   | SIGSTOP    | SIGPWR     |
+ * 	|   20   | SIGTSTP    | SIGWINCH   |
+ * 	|   21   | SIGTTIN    | SIGURG     |
+ * 	|   22   | SIGTTOU    | SIGPOLL    |
+ *	|   23   | SIGURG     | SIGSTOP    |
+ * 	|   24   | SIGXCPU    | SIGTSTP    |
+ *	|   25   | SIGXFSZ    | SIGCONT    |
+ *	|   26   | SIGVTALARM | SIGTTIN    |
+ *	|   27   | SIGPROF    | SIGTTOU    |
+ *	|   28   | SIGWINCH   | SIGVTALARM |
+ *	|   29   | SIGPOLL    | SIGPROF    |
+ *	|   30   | SIGPWR     | SIGXCPU    |
+ *	|   31   | SIGSYS     | SIGXFSZ    |
+ * 	====================================
+ *
+ * Not every Linux signal maps to a Solaris signal, nor does every Solaris
+ * signal map to a Linux counterpart. However, when signals do map, the
+ * mapping is unique.
+ *
+ * One mapping issue is that Linux supports 33 real time signals, with SIGRTMIN
+ * typically starting at or near 32 (SIGRTMIN) and proceeding to 64 (SIGRTMAX)
+ * (SIGRTMIN is "at or near" 32 because glibc usually "steals" one ore more of
+ * these signals for its own internal use, adjusting SIGRTMIN and SIGRTMAX as
+ * needed.)  Conversely, Solaris actively uses signals 32-40 for other purposes
+ * and supports exactly 32 real time signals, in the range 41 (SIGRTMIN)
+ * to 72 (SIGRTMAX).
+ *
+ * At present, attempting to translate a Linux signal equal to 63
+ * will generate an error (we allow SIGRTMAX because a program
+ * should be able to send SIGRTMAX without getting an EINVAL, though obviously
+ * anything that loops through the signals from SIGRTMIN to SIGRTMAX will
+ * fail.)
+ *
+ * Similarly, attempting to translate a native Solaris signal in the range
+ * 32-40 will also generate an error as we don't want to support the receipt of
+ * those signals from the Solaris global zone.
+ */
+
+/*
+ * Linux to Solaris signal map
+ *
+ * Usage:  solaris_signal = ltos_signum[lx_signal];
+ */
+const int
+ltos_signo[LX_NSIG + 1] = {
+	0,
+	SIGHUP,
+	SIGINT,
+	SIGQUIT,
+	SIGILL,
+	SIGTRAP,
+	SIGABRT,
+	SIGBUS,
+	SIGFPE,
+	SIGKILL,
+	SIGUSR1,
+	SIGSEGV,
+	SIGUSR2,
+	SIGPIPE,
+	SIGALRM,
+	SIGTERM,
+	SIGEMT,			/* 16:  Linux SIGSTKFLT; use Solaris SIGEMT */
+	SIGCHLD,
+	SIGCONT,
+	SIGSTOP,
+	SIGTSTP,
+	SIGTTIN,
+	SIGTTOU,
+	SIGURG,
+	SIGXCPU,
+	SIGXFSZ,
+	SIGVTALRM,
+	SIGPROF,
+	SIGWINCH,
+	SIGPOLL,
+	SIGPWR,
+	SIGSYS,
+	_SIGRTMIN,		/* 32:  Linux SIGRTMIN */
+	_SIGRTMIN + 1,
+	_SIGRTMIN + 2,
+	_SIGRTMIN + 3,
+	_SIGRTMIN + 4,
+	_SIGRTMIN + 5,
+	_SIGRTMIN + 6,
+	_SIGRTMIN + 7,
+	_SIGRTMIN + 8,
+	_SIGRTMIN + 9,
+	_SIGRTMIN + 10,
+	_SIGRTMIN + 11,
+	_SIGRTMIN + 12,
+	_SIGRTMIN + 13,
+	_SIGRTMIN + 14,
+	_SIGRTMIN + 15,
+	_SIGRTMIN + 16,
+	_SIGRTMIN + 17,
+	_SIGRTMIN + 18,
+	_SIGRTMIN + 19,
+	_SIGRTMIN + 20,
+	_SIGRTMIN + 21,
+	_SIGRTMIN + 22,
+	_SIGRTMIN + 23,
+	_SIGRTMIN + 24,
+	_SIGRTMIN + 25,
+	_SIGRTMIN + 26,
+	_SIGRTMIN + 27,
+	_SIGRTMIN + 28,
+	_SIGRTMIN + 29,
+	_SIGRTMIN + 30,
+	_SIGRTMIN + 31,
+	_SIGRTMAX,		/* 64:  Linux SIGRTMAX */
+};
+
+/*
+ * Solaris to Linux signal map
+ *
+ * Usage:  lx_signal = stol_signo[solaris_signal];
+ */
+const int
+stol_signo[NSIG] = {
+	0,
+	LX_SIGHUP,
+	LX_SIGINT,
+	LX_SIGQUIT,
+	LX_SIGILL,
+	LX_SIGTRAP,
+	LX_SIGABRT,
+	LX_SIGSTKFLT,		/* 7:  Solaris SIGEMT; use for LX_SIGSTKFLT */
+	LX_SIGFPE,
+	LX_SIGKILL,
+	LX_SIGBUS,
+	LX_SIGSEGV,
+	LX_SIGSYS,
+	LX_SIGPIPE,
+	LX_SIGALRM,
+	LX_SIGTERM,
+	LX_SIGUSR1,
+	LX_SIGUSR2,
+	LX_SIGCHLD,
+	LX_SIGPWR,
+	LX_SIGWINCH,
+	LX_SIGURG,
+	LX_SIGPOLL,
+	LX_SIGSTOP,
+	LX_SIGTSTP,
+	LX_SIGCONT,
+	LX_SIGTTIN,
+	LX_SIGTTOU,
+	LX_SIGVTALRM,
+	LX_SIGPROF,
+	LX_SIGXCPU,
+	LX_SIGXFSZ,
+	-1,			/* 32:  Solaris SIGWAITING */
+	-1,			/* 33:  Solaris SIGLWP */
+	-1,			/* 34:  Solaris SIGFREEZE */
+	-1,			/* 35:  Solaris SIGTHAW */
+	-1,			/* 36:  Solaris SIGCANCEL */
+	-1,			/* 37:  Solaris SIGLOST */
+	-1,			/* 38:  Solaris SIGXRES */
+	-1,			/* 39:  Solaris SIGJVM1 */
+	-1,			/* 40:  Solaris SIGJVM2 */
+	-1,			/* 41:  Solaris SIGINFO */
+	LX_SIGRTMIN,		/* 42:  Solaris _SIGRTMIN */
+	LX_SIGRTMIN + 1,
+	LX_SIGRTMIN + 2,
+	LX_SIGRTMIN + 3,
+	LX_SIGRTMIN + 4,
+	LX_SIGRTMIN + 5,
+	LX_SIGRTMIN + 6,
+	LX_SIGRTMIN + 7,
+	LX_SIGRTMIN + 8,
+	LX_SIGRTMIN + 9,
+	LX_SIGRTMIN + 10,
+	LX_SIGRTMIN + 11,
+	LX_SIGRTMIN + 12,
+	LX_SIGRTMIN + 13,
+	LX_SIGRTMIN + 14,
+	LX_SIGRTMIN + 15,
+	LX_SIGRTMIN + 16,
+	LX_SIGRTMIN + 17,
+	LX_SIGRTMIN + 18,
+	LX_SIGRTMIN + 19,
+	LX_SIGRTMIN + 20,
+	LX_SIGRTMIN + 21,
+	LX_SIGRTMIN + 22,
+	LX_SIGRTMIN + 23,
+	LX_SIGRTMIN + 24,
+	LX_SIGRTMIN + 25,
+	LX_SIGRTMIN + 26,
+	LX_SIGRTMIN + 27,
+	LX_SIGRTMIN + 28,
+	LX_SIGRTMIN + 29,
+	LX_SIGRTMIN + 30,
+	LX_SIGRTMIN + 31,
+	LX_SIGRTMAX,		/* 74: Solaris _SIGRTMAX */
+};
+
+/*
+ * Convert an illumos native signal number to a Linux signal number and return
+ * it.  If no valid conversion is possible, the function fails back to the
+ * value of "defsig".  In userland, passing a default signal number of "-1"
+ * will abort the program if the signal number could not be converted.
+ */
+int
+lx_stol_signo(int signo, int defsig)
+{
+	int rval;
+
+#ifdef	_KERNEL
+	VERIFY3S(defsig, >=, 0);
+#endif
+
+	if (signo < 0 || signo >= NSIG || (rval = stol_signo[signo]) < 1) {
+#ifndef	_KERNEL
+		VERIFY3S(defsig, >=, 0);
+#endif
+		return (defsig);
+	}
+
+	return (rval);
+}
+
+
+/*
+ * Convert a Linux signal number to an illumos signal number and return it.
+ * Error behavior is identical to lx_stol_signo.
+ */
+int
+lx_ltos_signo(int signo, int defsig)
+{
+#ifdef	_KERNEL
+	VERIFY3S(defsig, >=, 0);
+#endif
+
+	if (signo < 1 || signo >= NSIG) {
+#ifndef	_KERNEL
+		VERIFY3S(defsig, >=, 0);
+#endif
+		return (defsig);
+	}
+
+	return (ltos_signo[signo]);
+}
+
+/*
+ * Convert the "status" field of a SIGCLD siginfo_t.  We need to extract the
+ * illumos signal number and convert it to a Linux signal number while leaving
+ * the ptrace(2) event bits intact.  In userland, passing a default signal
+ * number of "-1" will abort the program if the signal number could not be
+ * converted, as for lx_stol_signo().
+ */
+int
+lx_stol_status(int s, int defsig)
+{
+	/*
+	 * We mask out the top bit here in case PTRACE_O_TRACESYSGOOD
+	 * is in use and 0x80 has been ORed with the signal number.
+	 */
+	int stat = lx_stol_signo(s & 0x7f, defsig);
+
+	/*
+	 * We must mix in the ptrace(2) event which may be stored in
+	 * the second byte of the status code.  We also re-include the
+	 * PTRACE_O_TRACESYSGOOD bit.
+	 */
+	return ((s & 0xff80) | stat);
+}
+
+int
+lx_stol_sigcode(int code)
+{
+	switch (code) {
+	case SI_USER:
+		return (LX_SI_USER);
+	case SI_LWP:
+		return (LX_SI_TKILL);
+	case SI_QUEUE:
+		return (LX_SI_QUEUE);
+	case SI_TIMER:
+		return (LX_SI_TIMER);
+	case SI_ASYNCIO:
+		return (LX_SI_ASYNCIO);
+	case SI_MESGQ:
+		return (LX_SI_MESGQ);
+	default:
+		return (code);
+	}
+}
diff --git a/usr/src/common/brand/lx/lx_signum.h b/usr/src/common/brand/lx/lx_signum.h
new file mode 100644
index 0000000000..b6c5f32731
--- /dev/null
+++ b/usr/src/common/brand/lx/lx_signum.h
@@ -0,0 +1,114 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LX_SIGNUM_H
+#define	_LX_SIGNUM_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	LX_SIGHUP	1
+#define	LX_SIGINT	2
+#define	LX_SIGQUIT	3
+#define	LX_SIGILL	4
+#define	LX_SIGTRAP	5
+#define	LX_SIGABRT	6
+#define	LX_SIGIOT	6
+#define	LX_SIGBUS	7
+#define	LX_SIGFPE	8
+#define	LX_SIGKILL	9
+#define	LX_SIGUSR1	10
+#define	LX_SIGSEGV	11
+#define	LX_SIGUSR2	12
+#define	LX_SIGPIPE	13
+#define	LX_SIGALRM	14
+#define	LX_SIGTERM	15
+#define	LX_SIGSTKFLT	16
+#define	LX_SIGCHLD	17
+#define	LX_SIGCONT	18
+#define	LX_SIGSTOP	19
+#define	LX_SIGTSTP	20
+#define	LX_SIGTTIN	21
+#define	LX_SIGTTOU	22
+#define	LX_SIGURG	23
+#define	LX_SIGXCPU	24
+#define	LX_SIGXFSZ	25
+#define	LX_SIGVTALRM	26
+#define	LX_SIGPROF	27
+#define	LX_SIGWINCH	28
+#define	LX_SIGIO	29
+#define	LX_SIGPOLL	LX_SIGIO
+#define	LX_SIGPWR	30
+#define	LX_SIGSYS	31
+#define	LX_SIGUNUSED	31
+
+#define	LX_NSIG		64	/* Linux _NSIG */
+
+#define	LX_SIGRTMIN	32
+#define	LX_SIGRTMAX	LX_NSIG
+
+extern const int ltos_signo[];
+extern const int stol_signo[];
+
+extern int lx_stol_signo(int, int);
+extern int lx_ltos_signo(int, int);
+extern int lx_stol_status(int, int);
+extern int lx_stol_sigcode(int);
+
+/*
+ * NOTE:  Linux uses different definitions for 'sigset_t's and 'sigaction_t's
+ *	  depending on whether the definition is for user space or the kernel.
+ *
+ *	  The definitions below MUST correspond to the Linux kernel versions,
+ *	  as glibc will do the necessary translation from the Linux user
+ *	  versions.
+ */
+#if defined(_LP64)
+#define	LX_NSIG_WORDS	1
+#define	LX_WSHIFT	6
+#elif defined(_ILP32)
+#define	LX_NSIG_WORDS	2
+#define	LX_WSHIFT	5
+#else
+#error "LX only supports LP64 and ILP32"
+#endif
+
+typedef struct {
+	ulong_t	__bits[LX_NSIG_WORDS];
+} lx_sigset_t;
+
+#define	LX_NBITS		(sizeof (ulong_t) * NBBY)
+#define	lx_sigmask(n)		(1UL << (((n) - 1) % LX_NBITS))
+#define	lx_sigword(n)		(((ulong_t)((n) - 1)) >> LX_WSHIFT)
+#define	lx_sigismember(s, n)	(lx_sigmask(n) & (s)->__bits[lx_sigword(n)])
+#define	lx_sigaddset(s, n)	((s)->__bits[lx_sigword(n)] |= lx_sigmask(n))
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_SIGNUM_H */
diff --git a/usr/src/common/brand/lx/lx_syscall.h b/usr/src/common/brand/lx/lx_syscall.h
new file mode 100644
index 0000000000..01e8b79512
--- /dev/null
+++ b/usr/src/common/brand/lx/lx_syscall.h
@@ -0,0 +1,123 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef	_LX_SYSCALL_H
+#define	_LX_SYSCALL_H
+
+#include <sys/lx_brand.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * The br_scall_args field of lx_lwp_data is going to be populated with
+ * pointers to structs. The types of these structs should be defined in this
+ * header file.  These are Linux specific arguments to system calls that don't
+ * exist in illumos. Each section should be labelled with which system call it
+ * belongs to.
+ */
+
+/* arguments for waitpid(2) */
+/* see comments in usr/src/lib/brand/lx/lx_brand/common/wait.c */
+#define	LX_WNOTHREAD	0x20000000 /* Do not wait on siblings' children */
+#define	LX_WALL		0x40000000 /* Wait on all children */
+#define	LX_WCLONE	0x80000000 /* Wait only on clone children */
+
+/* For arch_prctl(2) */
+#define	LX_ARCH_SET_GS	0x1001
+#define	LX_ARCH_SET_FS	0x1002
+#define	LX_ARCH_GET_FS	0x1003
+#define	LX_ARCH_GET_GS	0x1004
+
+/*
+ * For ptrace(2):
+ */
+#define	LX_PTRACE_TRACEME	0
+#define	LX_PTRACE_PEEKTEXT	1
+#define	LX_PTRACE_PEEKDATA	2
+#define	LX_PTRACE_PEEKUSER	3
+#define	LX_PTRACE_POKETEXT	4
+#define	LX_PTRACE_POKEDATA	5
+#define	LX_PTRACE_POKEUSER	6
+#define	LX_PTRACE_CONT		7
+#define	LX_PTRACE_KILL		8
+#define	LX_PTRACE_SINGLESTEP	9
+#define	LX_PTRACE_GETREGS	12
+#define	LX_PTRACE_SETREGS	13
+#define	LX_PTRACE_GETFPREGS	14
+#define	LX_PTRACE_SETFPREGS	15
+#define	LX_PTRACE_ATTACH	16
+#define	LX_PTRACE_DETACH	17
+#define	LX_PTRACE_GETFPXREGS	18
+#define	LX_PTRACE_SETFPXREGS	19
+#define	LX_PTRACE_SYSCALL	24
+#define	LX_PTRACE_SETOPTIONS	0x4200
+#define	LX_PTRACE_GETEVENTMSG	0x4201
+#define	LX_PTRACE_GETSIGINFO	0x4202
+
+/*
+ * For clone(2):
+ */
+#define	LX_CSIGNAL		0x000000ff
+#define	LX_CLONE_VM		0x00000100
+#define	LX_CLONE_FS		0x00000200
+#define	LX_CLONE_FILES		0x00000400
+#define	LX_CLONE_SIGHAND	0x00000800
+#define	LX_CLONE_PID		0x00001000
+#define	LX_CLONE_PTRACE		0x00002000
+#define	LX_CLONE_VFORK		0x00004000
+#define	LX_CLONE_PARENT		0x00008000
+#define	LX_CLONE_THREAD		0x00010000
+#define	LX_CLONE_NEWNS		0x00020000
+#define	LX_CLONE_SYSVSEM	0x00040000
+#define	LX_CLONE_SETTLS		0x00080000
+#define	LX_CLONE_PARENT_SETTID	0x00100000
+#define	LX_CLONE_CHILD_CLEARTID	0x00200000
+#define	LX_CLONE_DETACH		0x00400000
+#define	LX_CLONE_UNTRACED	0x00800000
+#define	LX_CLONE_CHILD_SETTID	0x01000000
+#define	LX_CLONE_NEWCGROUP	0x02000000
+#define	LX_CLONE_NEWUTS		0x04000000
+#define	LX_CLONE_NEWIPC		0x08000000
+#define	LX_CLONE_NEWUSER	0x10000000
+#define	LX_CLONE_NEWPID		0x20000000
+#define	LX_CLONE_NEWNET		0x40000000
+#define	LX_CLONE_IO		0x80000000
+
+#define	SHARED_AS \
+	(LX_CLONE_VM | LX_CLONE_FS | LX_CLONE_FILES | LX_CLONE_SIGHAND | \
+	LX_CLONE_THREAD)
+
+/*
+ * Valid clone flags when not a full process or full thread (SHARED_AS), This
+ * can be expanded as additional clone-group support is added.
+ */
+#define	LX_CLONE_GRP_SUBSET	(LX_CLONE_FS)
+
+#define	LX_IS_CLONE_GRP(X)	((X & SHARED_AS) != 0 && \
+				(X & SHARED_AS) != SHARED_AS && \
+				((X & SHARED_AS) & ~LX_CLONE_GRP_SUBSET) == 0)
+
+#define	LX_CLONE_NS_UNSUP	(LX_CLONE_NEWNS | LX_CLONE_NEWCGROUP | \
+				LX_CLONE_NEWUTS | LX_CLONE_NEWIPC | \
+				LX_CLONE_NEWUSER | LX_CLONE_NEWPID | \
+				LX_CLONE_NEWNET | LX_CLONE_IO)
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_SYSCALL_H */
diff --git a/usr/src/common/brand/lx/tools/Makefile b/usr/src/common/brand/lx/tools/Makefile
new file mode 100644
index 0000000000..2b5bb92251
--- /dev/null
+++ b/usr/src/common/brand/lx/tools/Makefile
@@ -0,0 +1,47 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+PROG =			gen_errno
+
+include ../../../../cmd/Makefile.cmd
+
+OBJS =			gen_errno.o
+
+CLOBBERFILES +=		$(PROG)
+
+NATIVECC_CFLAGS +=	$(CFLAGS) $(CCVERBOSE)
+# As evidenced by the use of the NATIVE_ variables, gen_errno is intended
+# to be able to run on the build host.  We continue to link it against
+# libcmdutils.so instead of libcustr.so in order to allow it to run on
+# older build hosts (relying on the libcmdutil filter entries if run on
+# newer hosts with libcustr.so).
+NATIVECC_LDLIBS +=	-lcmdutils -lnvpair
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all
+
+lint:	lint_PROG
+
+clean:
+	$(RM) $(OBJS)
+
+$(PROG): $(OBJS)
+	$(NATIVECC) $(NATIVECC_CFLAGS) $(NATIVECC_LDLIBS) $(OBJS) -o $@
+	$(POST_PROCESS)
+
+include ../../../../cmd/Makefile.targ
diff --git a/usr/src/common/brand/lx/tools/README.md b/usr/src/common/brand/lx/tools/README.md
new file mode 100644
index 0000000000..5e4976f200
--- /dev/null
+++ b/usr/src/common/brand/lx/tools/README.md
@@ -0,0 +1,39 @@
+# Updating Error Number Translations
+
+To create an updated error number translation table, you can use the
+`gen_errno` tool.  This tool requires, as input:
+
+* the illumos native `errno.h` file
+* a set of foreign operating system `errno.h` files
+
+The output is a set of translation table entries suitable for inclusion in a
+cstyled C array.  The index of the array is the native error number and the
+value at each index is the translated error number for use with the foreign
+operating system.
+
+## Example
+
+To generate a translation table for the LX Brand, you will require two files
+from the current Linux source:
+
+* `include/uapi/asm-generic/errno-base.h` (low-valued, or base, error numbers)
+* `include/uapi/asm-generic/errno.h` (extended error numbers)
+
+Assuming the files are in the current directory, you should run the tool as
+follows:
+
+    $ dmake
+    ...
+    $ ./gen_errno -F errno-base.h -F errno.h \
+                  -N $SRC/uts/common/sys/errno.h
+    0, /*  0: No Error                            */
+    1, /*  1: EPERM       -->   1: EPERM          */
+    2, /*  2: ENOENT      -->   2: ENOENT         */
+    3, /*  3: ESRCH       -->   3: ESRCH          */
+    4, /*  4: EINTR       -->   4: EINTR          */
+    5, /*  5: EIO         -->   5: EIO            */
+    6, /*  6: ENXIO       -->   6: ENXIO          */
+    7, /*  7: E2BIG       -->   7: E2BIG          */
+    ...
+
+The output may be used in the `$SRC/common/brand/lx/lx_errno.c` file.
diff --git a/usr/src/common/brand/lx/tools/gen_errno.c b/usr/src/common/brand/lx/tools/gen_errno.c
new file mode 100644
index 0000000000..6089fed3bd
--- /dev/null
+++ b/usr/src/common/brand/lx/tools/gen_errno.c
@@ -0,0 +1,444 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * Take the error number definitions from a foreign system and generate a
+ * translation table that converts illumos native error numbers to foreign
+ * system error numbers.
+ */
+
+#include <ctype.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <errno.h>
+#include <err.h>
+#include <sys/sysmacros.h>
+#include <libcustr.h>
+#include <libnvpair.h>
+
+nvlist_t *native_errors;
+nvlist_t *foreign_errors;
+
+struct override {
+	const char *ovr_from;
+	const char *ovr_to;
+} overrides[] = {
+	{ "ENOTSUP", "ENOSYS" },
+	{ 0 }
+};
+
+static const char *
+lookup_override(const char *from)
+{
+	int i;
+
+	for (i = 0; overrides[i].ovr_from != NULL; i++) {
+		if (strcmp(overrides[i].ovr_from, from) == 0) {
+			return (overrides[i].ovr_to);
+		}
+	}
+
+	return (NULL);
+}
+
+static int
+parse_int(const char *number, int *rval)
+{
+	long n;
+	char *endpos;
+
+	errno = 0;
+	if ((n = strtol(number, &endpos, 10)) == 0 && errno != 0) {
+		return (-1);
+	}
+
+	if (endpos != NULL && *endpos != '\0') {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (n > INT_MAX || n < INT_MIN) {
+		errno = EOVERFLOW;
+		return (-1);
+	}
+
+	*rval = (int)n;
+	return (0);
+}
+
+static int
+errnum_add(nvlist_t *nvl, const char *name, const char *number)
+{
+	int val;
+
+	if (nvlist_exists(nvl, name)) {
+		(void) fprintf(stderr, "ERROR: duplicate definition: %s -> "
+		    "%s\n", name, number);
+		errno = EEXIST;
+		return (-1);
+	}
+
+	/*
+	 * Try and parse the error number:
+	 */
+	if (parse_int(number, &val) == 0) {
+		/*
+		 * The name refers to a number.
+		 */
+		if (nvlist_add_int32(nvl, name, val) != 0) {
+			(void) fprintf(stderr, "ERROR: nvlist_add_int32: %s\n",
+			    strerror(errno));
+			return (-1);
+		}
+	} else {
+		/*
+		 * The name refers to another definition.
+		 */
+		if (nvlist_add_string(nvl, name, number) != 0) {
+			(void) fprintf(stderr, "ERROR: nvlist_add_string: %s\n",
+			    strerror(errno));
+			return (-1);
+		}
+	}
+
+	return (0);
+}
+
+static int
+errnum_max(nvlist_t *nvl)
+{
+	int max = 0;
+	nvpair_t *nvp = NULL;
+
+	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
+		if (nvpair_type(nvp) != DATA_TYPE_INT32) {
+			continue;
+		}
+
+		max = MAX(fnvpair_value_int32(nvp), max);
+	}
+
+	return (max);
+}
+
+static int
+errname_by_num(nvlist_t *nvl, int num, const char **name)
+{
+	nvpair_t *nvp = NULL;
+
+	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
+		if (nvpair_type(nvp) != DATA_TYPE_INT32) {
+			continue;
+		}
+
+		if (fnvpair_value_int32(nvp) == num) {
+			*name = nvpair_name(nvp);
+			return (0);
+		}
+	}
+
+	errno = ENOENT;
+	return (-1);
+}
+
+static int
+errno_by_name(nvlist_t *nvl, const char *name, int *rval, const char **rname)
+{
+	nvpair_t *nvp = NULL;
+
+	if (nvlist_lookup_nvpair(nvl, name, &nvp) != 0) {
+		errno = ENOENT;
+		return (-1);
+	}
+
+	if (nvpair_type(nvp) == DATA_TYPE_STRING) {
+		return (errno_by_name(nvl, fnvpair_value_string(nvp), rval,
+		    rname));
+	} else {
+		*rval = fnvpair_value_int32(nvp);
+		if (rname != NULL) {
+			*rname = name;
+		}
+		return (0);
+	}
+}
+
+static int
+process_line(const char *line, nvlist_t *nvl)
+{
+	custr_t *nam = NULL, *num = NULL;
+	const char *c = line;
+
+	if (custr_alloc(&nam) != 0 || custr_alloc(&num) != 0) {
+		int en = errno;
+
+		custr_free(nam);
+		custr_free(num);
+
+		errno = en;
+		return (-1);
+	}
+
+	/*
+	 * Valid lines begin with "#define":
+	 */
+	if (*c++ != '#' || *c++ != 'd' || *c++ != 'e' || *c++ != 'f' ||
+	    *c++ != 'i' || *c++ != 'n' || *c++ != 'e') {
+		return (0);
+	}
+
+	/*
+	 * Eat whitespace:
+	 */
+	for (;;) {
+		if (*c == '\0') {
+			return (0);
+		}
+
+		if (*c != ' ' && *c != '\t') {
+			break;
+		}
+
+		c++;
+	}
+
+	/*
+	 * Read error number token:
+	 */
+	for (;;) {
+		if (*c == '\0') {
+			return (0);
+		}
+
+		if (*c == ' ' || *c == '\t') {
+			break;
+		}
+
+		if (custr_appendc(nam, *c) != 0) {
+			return (-1);
+		}
+
+		c++;
+	}
+
+	/*
+	 * Eat whitespace:
+	 */
+	for (;;) {
+		if (*c == '\0') {
+			return (0);
+		}
+
+		if (*c != ' ' && *c != '\t') {
+			break;
+		}
+
+		c++;
+	}
+
+	/*
+	 * Read error number token:
+	 */
+	for (;;) {
+		if (*c == '\0') {
+			break;
+		}
+
+		if (*c == ' ' || *c == '\t') {
+			break;
+		}
+
+		if (custr_appendc(num, *c) != 0) {
+			return (-1);
+		}
+
+		c++;
+	}
+
+	return (errnum_add(nvl, custr_cstr(nam), custr_cstr(num)));
+}
+
+static int
+read_file_into_list(const char *path, nvlist_t *nvl)
+{
+	int rval = 0, en = 0;
+	FILE *f;
+	custr_t *cu = NULL;
+
+	if (custr_alloc(&cu) != 0) {
+		return (-1);
+	}
+
+	if ((f = fopen(path, "r")) == NULL) {
+		custr_free(cu);
+		return (-1);
+	}
+
+	for (;;) {
+		int c;
+
+		errno = 0;
+		switch (c = fgetc(f)) {
+		case '\n':
+		case EOF:
+			if (errno != 0) {
+				en = errno;
+				rval = -1;
+				goto out;
+			}
+			if (process_line(custr_cstr(cu), nvl) != 0) {
+				en = errno;
+				rval = -1;
+				goto out;
+			}
+			custr_reset(cu);
+			if (c == EOF) {
+				goto out;
+			}
+			break;
+
+		case '\r':
+		case '\0':
+			/*
+			 * Ignore these characters.
+			 */
+			break;
+
+		default:
+			if (custr_appendc(cu, c) != 0) {
+				en = errno;
+				rval = -1;
+				goto out;
+			}
+			break;
+		}
+	}
+
+out:
+	(void) fclose(f);
+	custr_free(cu);
+	errno = en;
+	return (rval);
+}
+
+int
+main(int argc, char **argv)
+{
+	int max;
+	int fval;
+	int c;
+
+	if (nvlist_alloc(&native_errors, NV_UNIQUE_NAME, 0) != 0 ||
+	    nvlist_alloc(&foreign_errors, NV_UNIQUE_NAME, 0) != 0) {
+		err(1, "could not allocate memory");
+	}
+
+	while ((c = getopt(argc, argv, ":N:F:")) != -1) {
+		switch (c) {
+		case 'N':
+			if (read_file_into_list(optarg, native_errors) != 0) {
+				err(1, "could not read file: %s", optarg);
+			}
+			break;
+
+		case 'F':
+			if (read_file_into_list(optarg, foreign_errors) != 0) {
+				err(1, "could not read file: %s", optarg);
+			}
+			break;
+
+		case ':':
+			errx(1, "option -%c requires an operand", c);
+			break;
+
+		case '?':
+			errx(1, "option -%c unrecognised", c);
+			break;
+		}
+	}
+
+	/*
+	 * Print an array entry for each error number:
+	 */
+	max = errnum_max(native_errors);
+	for (fval = 0; fval <= max; fval++) {
+		const char *fname;
+		const char *tname = NULL;
+		int32_t tval;
+		const char *msg = NULL;
+		const char *comma = (fval != max) ? "," : "";
+
+		if (errname_by_num(native_errors, fval, &fname) == -1) {
+			fname = NULL;
+		}
+
+		if (fval == 0) {
+			/*
+			 * The error number "0" is special: it means no worries.
+			 */
+			msg = "No Error";
+			tval = 0;
+		} else if (fname == NULL) {
+			/*
+			 * There is no defined name for this error number; it
+			 * is unused.
+			 */
+			msg = "Unused Number";
+			tval = -1;
+		} else {
+			/*
+			 * Check if we want to override the name of this error
+			 * in the foreign error number lookup:
+			 */
+			const char *oname = lookup_override(fname);
+
+			/*
+			 * Do the lookup:
+			 */
+			if (errno_by_name(foreign_errors, oname != NULL ?
+			    oname : fname, &tval, &tname) != 0) {
+				/*
+				 * There was no foreign error number by that
+				 * name.
+				 */
+				tname = "No Analogue";
+				tval = -2;
+			}
+		}
+
+		if (msg == NULL) {
+			size_t flen = strlen(fname);
+			size_t tlen = strlen(tname);
+			const char *t = flen > 7 ? "\t" : "\t\t";
+			const char *tt = tlen < 7 ? "\t\t\t" : tlen < 15 ?
+			    "\t\t" : "\t";
+
+			(void) fprintf(stdout, "\t%d%s\t/* %3d: %s%s--> %3d: "
+			    "%s%s*/\n", tval, comma, fval, fname, t, tval,
+			    tname, tt);
+		} else {
+			const char *t = "\t\t\t\t\t";
+
+			(void) fprintf(stdout, "\t%d%s\t/* %3d: %s%s*/\n", tval,
+			    comma, fval, msg, t);
+		}
+	}
+
+	(void) nvlist_free(native_errors);
+	(void) nvlist_free(foreign_errors);
+
+	return (0);
+}
diff --git a/usr/src/common/ctf/ctf_create.c b/usr/src/common/ctf/ctf_create.c
index 239d166f44..4857070db1 100644
--- a/usr/src/common/ctf/ctf_create.c
+++ b/usr/src/common/ctf/ctf_create.c
@@ -25,7 +25,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc.
  */
 
 #include <sys/sysmacros.h>
@@ -86,6 +86,48 @@ ctf_create(int *errp)
 	return (fp);
 }
 
+ctf_file_t *
+ctf_fdcreate(int fd, int *errp)
+{
+	ctf_file_t *fp;
+	static const ctf_header_t hdr = { { CTF_MAGIC, CTF_VERSION, 0 } };
+
+	const ulong_t hashlen = 128;
+	ctf_dtdef_t **hash;
+	ctf_sect_t cts;
+
+	if (fd == -1)
+		return (ctf_create(errp));
+
+	hash = ctf_alloc(hashlen * sizeof (ctf_dtdef_t *));
+
+	if (hash == NULL)
+		return (ctf_set_open_errno(errp, EAGAIN));
+
+	cts.cts_name = _CTF_SECTION;
+	cts.cts_type = SHT_PROGBITS;
+	cts.cts_flags = 0;
+	cts.cts_data = &hdr;
+	cts.cts_size = sizeof (hdr);
+	cts.cts_entsize = 1;
+	cts.cts_offset = 0;
+
+	if ((fp = ctf_fdcreate_int(fd, errp, &cts)) == NULL) {
+		ctf_free(hash, hashlen * sizeof (ctf_dtdef_t *));
+		return (NULL);
+	}
+
+	fp->ctf_flags |= LCTF_RDWR;
+	fp->ctf_dthashlen = hashlen;
+	bzero(hash, hashlen * sizeof (ctf_dtdef_t *));
+	fp->ctf_dthash = hash;
+	fp->ctf_dtstrlen = sizeof (_CTF_STRTAB_TEMPLATE);
+	fp->ctf_dtnextid = 1;
+	fp->ctf_dtoldid = 0;
+
+	return (fp);
+}
+
 static uchar_t *
 ctf_copy_smembers(ctf_dtdef_t *dtd, uint_t soff, uchar_t *t)
 {
@@ -236,14 +278,24 @@ int
 ctf_update(ctf_file_t *fp)
 {
 	ctf_file_t ofp, *nfp;
-	ctf_header_t hdr;
+	ctf_header_t hdr, *bhdr;
 	ctf_dtdef_t *dtd;
-	ctf_sect_t cts;
+	ctf_dsdef_t *dsd;
+	ctf_dldef_t *dld;
+	ctf_sect_t cts, *symp, *strp;
 
 	uchar_t *s, *s0, *t;
-	size_t size;
+	ctf_lblent_t *label;
+	uint16_t *obj, *func;
+	size_t size, objsize, funcsize, labelsize, plen;
 	void *buf;
 	int err;
+	ulong_t i;
+	const char *plabel;
+	const char *sname;
+
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+	uintptr_t strbase = (uintptr_t)fp->ctf_strtab.cts_data;
 
 	if (!(fp->ctf_flags & LCTF_RDWR))
 		return (ctf_set_errno(fp, ECTF_RDONLY));
@@ -261,8 +313,26 @@ ctf_update(ctf_file_t *fp)
 	hdr.cth_magic = CTF_MAGIC;
 	hdr.cth_version = CTF_VERSION;
 
-	if (fp->ctf_flags & LCTF_CHILD)
-		hdr.cth_parname = 1; /* i.e. _CTF_STRTAB_TEMPLATE[1] */
+	if (fp->ctf_flags & LCTF_CHILD) {
+		if (fp->ctf_parname == NULL) {
+			plen = 0;
+			hdr.cth_parname = 1; /* i.e. _CTF_STRTAB_TEMPLATE[1] */
+			plabel = NULL;
+		} else {
+			plen = strlen(fp->ctf_parname) + 1;
+			plabel = ctf_label_topmost(fp->ctf_parent);
+		}
+	} else {
+		plabel = NULL;
+		plen = 0;
+	}
+
+	/*
+	 * Iterate over the labels that we have.
+	 */
+	for (labelsize = 0, dld = ctf_list_next(&fp->ctf_dldefs);
+	    dld != NULL; dld = ctf_list_next(dld))
+		labelsize += sizeof (ctf_lblent_t);
 
 	/*
 	 * Iterate through the dynamic type definition list and compute the
@@ -304,25 +374,121 @@ ctf_update(ctf_file_t *fp)
 	}
 
 	/*
+	 * An entry for each object must exist in the data section. However, if
+	 * the symbol is SHN_UNDEF, then it is skipped. For objects, the storage
+	 * is just the size of the 2-byte id. For functions it's always 2 bytes,
+	 * plus 2 bytes per argument and the return type.
+	 */
+	dsd = ctf_list_next(&fp->ctf_dsdefs);
+	for (objsize = 0, funcsize = 0, i = 0; i < fp->ctf_nsyms; i++) {
+		int type;
+
+		if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+			const Elf32_Sym *symp = (Elf32_Sym *)symbase + i;
+
+			type = ELF32_ST_TYPE(symp->st_info);
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+		} else {
+			const Elf64_Sym *symp = (Elf64_Sym *)symbase + i;
+
+			type = ELF64_ST_TYPE(symp->st_info);
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+		}
+
+		while (dsd != NULL && i > dsd->dts_symidx)
+			dsd = ctf_list_next(dsd);
+		if (type == STT_OBJECT) {
+			objsize += sizeof (uint16_t);
+		} else {
+			/* Every function has a uint16_t info no matter what */
+			if (dsd == NULL || i < dsd->dts_symidx) {
+				funcsize += sizeof (uint16_t);
+			} else {
+				funcsize += sizeof (uint16_t) *
+				    (dsd->dts_nargs + 2);
+			}
+		}
+	}
+
+	/*
+	 * The objtoff and funcoffset must be 2-byte aligned. We're guaranteed
+	 * that this is always true for the objtoff because labels are always 8
+	 * bytes large. Similarly, because objects are always two bytes of data,
+	 * this will always be true for funcoff.
+	 */
+	hdr.cth_objtoff = hdr.cth_lbloff + labelsize;
+	hdr.cth_funcoff = hdr.cth_objtoff + objsize;
+
+	/*
+	 * The type offset must be 4 byte aligned.
+	 */
+	hdr.cth_typeoff = hdr.cth_funcoff + funcsize;
+	if (hdr.cth_typeoff & 3)
+		hdr.cth_typeoff += 4 - (hdr.cth_typeoff & 3);
+	ASSERT((hdr.cth_typeoff & 3) == 0);
+
+	/*
 	 * Fill in the string table offset and size, compute the size of the
 	 * entire CTF buffer we need, and then allocate a new buffer and
 	 * bcopy the finished header to the start of the buffer.
 	 */
 	hdr.cth_stroff = hdr.cth_typeoff + size;
-	hdr.cth_strlen = fp->ctf_dtstrlen;
+	hdr.cth_strlen = fp->ctf_dtstrlen + plen;
 	size = sizeof (ctf_header_t) + hdr.cth_stroff + hdr.cth_strlen;
+	ctf_dprintf("lbloff: %d\nobjtoff: %d\nfuncoff: %d\n"
+	    "typeoff: %d\nstroff: %d\nstrlen: %d\n",
+	    hdr.cth_lbloff, hdr.cth_objtoff, hdr.cth_funcoff,
+	    hdr.cth_typeoff, hdr.cth_stroff, hdr.cth_strlen);
 
 	if ((buf = ctf_data_alloc(size)) == MAP_FAILED)
 		return (ctf_set_errno(fp, EAGAIN));
 
 	bcopy(&hdr, buf, sizeof (ctf_header_t));
-	t = (uchar_t *)buf + sizeof (ctf_header_t);
+	bhdr = buf;
+	label = (ctf_lblent_t *)((uintptr_t)buf + sizeof (ctf_header_t));
+	t = (uchar_t *)buf + sizeof (ctf_header_t) + hdr.cth_typeoff;
 	s = s0 = (uchar_t *)buf + sizeof (ctf_header_t) + hdr.cth_stroff;
+	obj = (uint16_t *)((uintptr_t)buf + sizeof (ctf_header_t) +
+	    hdr.cth_objtoff);
+	func = (uint16_t *)((uintptr_t)buf + sizeof (ctf_header_t) +
+	    hdr.cth_funcoff);
 
 	bcopy(_CTF_STRTAB_TEMPLATE, s, sizeof (_CTF_STRTAB_TEMPLATE));
 	s += sizeof (_CTF_STRTAB_TEMPLATE);
 
 	/*
+	 * We have an actual parent name and we're a child container, therefore
+	 * we should make sure to note our parent's name here.
+	 */
+	if (plen != 0) {
+		VERIFY(s + plen - s0 <= hdr.cth_strlen);
+		bcopy(fp->ctf_parname, s, plen);
+		bhdr->cth_parname = s - s0;
+		s += plen;
+	}
+
+	/*
+	 * First pass over the labels and copy them out.
+	 */
+	for (dld = ctf_list_next(&fp->ctf_dldefs); dld != NULL;
+	    dld = ctf_list_next(dld), label++) {
+		size_t len = strlen(dld->dld_name) + 1;
+
+		VERIFY(s + len - s0 <= hdr.cth_strlen);
+		bcopy(dld->dld_name, s, len);
+		label->ctl_typeidx = dld->dld_type;
+		label->ctl_label = s - s0;
+		s += len;
+
+		if (plabel != NULL && strcmp(plabel, dld->dld_name) == 0)
+			bhdr->cth_parlabel = label->ctl_label;
+	}
+
+	/*
 	 * We now take a final lap through the dynamic type definition list and
 	 * copy the appropriate type records and strings to the output buffer.
 	 */
@@ -339,6 +505,7 @@ ctf_update(ctf_file_t *fp)
 		if (dtd->dtd_name != NULL) {
 			dtd->dtd_data.ctt_name = (uint_t)(s - s0);
 			len = strlen(dtd->dtd_name) + 1;
+			VERIFY(s + len - s0 <= hdr.cth_strlen);
 			bcopy(dtd->dtd_name, s, len);
 			s += len;
 		} else
@@ -411,6 +578,61 @@ ctf_update(ctf_file_t *fp)
 	}
 
 	/*
+	 * Now we fill in our dynamic data and function sections. We use the
+	 * same criteria as above, but also consult the dsd list.
+	 */
+	dsd = ctf_list_next(&fp->ctf_dsdefs);
+	for (i = 0; i < fp->ctf_nsyms; i++) {
+		int type;
+		if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+			const Elf32_Sym *symp = (Elf32_Sym *)symbase + i;
+			type = ELF32_ST_TYPE(symp->st_info);
+
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+		} else {
+			const Elf64_Sym *symp = (Elf64_Sym *)symbase + i;
+			type = ELF64_ST_TYPE(symp->st_info);
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+		}
+
+		while (dsd != NULL && i > dsd->dts_symidx) {
+			dsd = ctf_list_next(dsd);
+		}
+		if (type == STT_OBJECT) {
+			if (dsd == NULL || i < dsd->dts_symidx) {
+				*obj = 0;
+			} else {
+				*obj = dsd->dts_tid;
+			}
+			obj++;
+			VERIFY((uintptr_t)obj <= (uintptr_t)func);
+		} else {
+			if (dsd == NULL || i < dsd->dts_symidx) {
+				ushort_t data = CTF_TYPE_INFO(CTF_K_UNKNOWN,
+				    0, 0);
+				*func = data;
+				func++;
+			} else {
+				int j;
+				ushort_t data = CTF_TYPE_INFO(CTF_K_FUNCTION, 0,
+				    dsd->dts_nargs);
+
+				*func = data;
+				func++;
+				*func = dsd->dts_tid;
+				func++;
+				for (j = 0; j < dsd->dts_nargs; j++)
+					func[j] = dsd->dts_argc[j];
+				func += dsd->dts_nargs;
+			}
+		}
+	}
+
+	/*
 	 * Finally, we are ready to ctf_bufopen() the new container.  If this
 	 * is successful, we then switch nfp and fp and free the old container.
 	 */
@@ -423,7 +645,15 @@ ctf_update(ctf_file_t *fp)
 	cts.cts_entsize = 1;
 	cts.cts_offset = 0;
 
-	if ((nfp = ctf_bufopen(&cts, NULL, NULL, &err)) == NULL) {
+	if (fp->ctf_nsyms == 0) {
+		symp = NULL;
+		strp = NULL;
+	} else {
+		symp = &fp->ctf_symtab;
+		strp = &fp->ctf_strtab;
+	}
+
+	if ((nfp = ctf_bufopen(&cts, symp, strp, &err)) == NULL) {
 		ctf_data_free(buf, size);
 		return (ctf_set_errno(fp, err));
 	}
@@ -433,10 +663,11 @@ ctf_update(ctf_file_t *fp)
 
 	nfp->ctf_refcnt = fp->ctf_refcnt;
 	nfp->ctf_flags |= fp->ctf_flags & ~LCTF_DIRTY;
-	nfp->ctf_data.cts_data = NULL; /* force ctf_data_free() on close */
 	nfp->ctf_dthash = fp->ctf_dthash;
 	nfp->ctf_dthashlen = fp->ctf_dthashlen;
 	nfp->ctf_dtdefs = fp->ctf_dtdefs;
+	nfp->ctf_dsdefs = fp->ctf_dsdefs;
+	nfp->ctf_dldefs = fp->ctf_dldefs;
 	nfp->ctf_dtstrlen = fp->ctf_dtstrlen;
 	nfp->ctf_dtnextid = fp->ctf_dtnextid;
 	nfp->ctf_dtoldid = fp->ctf_dtnextid - 1;
@@ -445,6 +676,23 @@ ctf_update(ctf_file_t *fp)
 	fp->ctf_dthash = NULL;
 	fp->ctf_dthashlen = 0;
 	bzero(&fp->ctf_dtdefs, sizeof (ctf_list_t));
+	bzero(&fp->ctf_dsdefs, sizeof (ctf_list_t));
+	bzero(&fp->ctf_dldefs, sizeof (ctf_list_t));
+
+	/*
+	 * Because the various containers share the data sections, we don't want
+	 * to have ctf_close free it all. However, the name of the section is in
+	 * fact unique to the ctf_sect_t. Thus we save the names of the symbol
+	 * and string sections around the bzero() and restore them afterwards,
+	 * ensuring that we don't result in a memory leak.
+	 */
+	sname = fp->ctf_symtab.cts_name;
+	bzero(&fp->ctf_symtab, sizeof (ctf_sect_t));
+	fp->ctf_symtab.cts_name = sname;
+
+	sname = fp->ctf_strtab.cts_name;
+	bzero(&fp->ctf_strtab, sizeof (ctf_sect_t));
+	fp->ctf_strtab.cts_name = sname;
 
 	bcopy(fp, &ofp, sizeof (ctf_file_t));
 	bcopy(nfp, fp, sizeof (ctf_file_t));
@@ -563,6 +811,101 @@ ctf_dtd_lookup(ctf_file_t *fp, ctf_id_t type)
 	return (dtd);
 }
 
+ctf_dsdef_t *
+ctf_dsd_lookup(ctf_file_t *fp, ulong_t idx)
+{
+	ctf_dsdef_t *dsd;
+
+	for (dsd = ctf_list_next(&fp->ctf_dsdefs); dsd != NULL;
+	    dsd = ctf_list_next(dsd)) {
+		if (dsd->dts_symidx == idx)
+			return (dsd);
+	}
+
+	return (NULL);
+}
+
+/*
+ * We order the ctf_dsdef_t by symbol index to make things better for updates.
+ */
+void
+ctf_dsd_insert(ctf_file_t *fp, ctf_dsdef_t *dsd)
+{
+	ctf_dsdef_t *i;
+
+	for (i = ctf_list_next(&fp->ctf_dsdefs); i != NULL;
+	    i = ctf_list_next(i)) {
+		if (i->dts_symidx > dsd->dts_symidx)
+			break;
+	}
+
+	if (i == NULL) {
+		ctf_list_append(&fp->ctf_dsdefs, dsd);
+		return;
+	}
+
+	ctf_list_insert_before(&fp->ctf_dsdefs, i, dsd);
+}
+
+/* ARGSUSED */
+void
+ctf_dsd_delete(ctf_file_t *fp, ctf_dsdef_t *dsd)
+{
+	if (dsd->dts_nargs > 0)
+		ctf_free(dsd->dts_argc,
+		    sizeof (ctf_id_t) * dsd->dts_nargs);
+	ctf_list_delete(&fp->ctf_dsdefs, dsd);
+	ctf_free(dsd, sizeof (ctf_dsdef_t));
+}
+
+ctf_dldef_t *
+ctf_dld_lookup(ctf_file_t *fp, const char *name)
+{
+	ctf_dldef_t *dld;
+
+	for (dld = ctf_list_next(&fp->ctf_dldefs); dld != NULL;
+	    dld = ctf_list_next(dld)) {
+		if (strcmp(name, dld->dld_name) == 0)
+			return (dld);
+	}
+
+	return (NULL);
+}
+
+void
+ctf_dld_insert(ctf_file_t *fp, ctf_dldef_t *dld, uint_t pos)
+{
+	ctf_dldef_t *l;
+
+	if (pos == 0) {
+		ctf_list_prepend(&fp->ctf_dldefs, dld);
+		return;
+	}
+
+	for (l = ctf_list_next(&fp->ctf_dldefs); pos != 0 && dld != NULL;
+	    l = ctf_list_next(l), pos--)
+		;
+
+	if (l == NULL)
+		ctf_list_append(&fp->ctf_dldefs, dld);
+	else
+		ctf_list_insert_before(&fp->ctf_dsdefs, l, dld);
+}
+
+void
+ctf_dld_delete(ctf_file_t *fp, ctf_dldef_t *dld)
+{
+	ctf_list_delete(&fp->ctf_dldefs, dld);
+
+	if (dld->dld_name != NULL) {
+		size_t len = strlen(dld->dld_name) + 1;
+		ctf_free(dld->dld_name, len);
+		fp->ctf_dtstrlen -= len;
+	}
+
+	ctf_free(dld, sizeof (ctf_dldef_t));
+}
+
 /*
  * Discard all of the dynamic type definitions that have been added to the
  * container since the last call to ctf_update().  We locate such types by
@@ -583,10 +926,10 @@ ctf_discard(ctf_file_t *fp)
 		return (0); /* no update required */
 
 	for (dtd = ctf_list_prev(&fp->ctf_dtdefs); dtd != NULL; dtd = ntd) {
+		ntd = ctf_list_prev(dtd);
 		if (dtd->dtd_type <= fp->ctf_dtoldid)
 			continue; /* skip types that have been committed */
 
-		ntd = ctf_list_prev(dtd);
 		ctf_dtd_delete(fp, dtd);
 	}
 
@@ -637,26 +980,7 @@ ctf_add_generic(ctf_file_t *fp, uint_t flag, const char *name, ctf_dtdef_t **rp)
 	return (type);
 }
 
-/*
- * When encoding integer sizes, we want to convert a byte count in the range
- * 1-8 to the closest power of 2 (e.g. 3->4, 5->8, etc).  The clp2() function
- * is a clever implementation from "Hacker's Delight" by Henry Warren, Jr.
- */
-static size_t
-clp2(size_t x)
-{
-	x--;
-
-	x |= (x >> 1);
-	x |= (x >> 2);
-	x |= (x >> 4);
-	x |= (x >> 8);
-	x |= (x >> 16);
-
-	return (x + 1);
-}
-
-static ctf_id_t
+ctf_id_t
 ctf_add_encoded(ctf_file_t *fp, uint_t flag,
     const char *name, const ctf_encoding_t *ep, uint_t kind)
 {
@@ -670,14 +994,22 @@ ctf_add_encoded(ctf_file_t *fp, uint_t flag,
 		return (CTF_ERR); /* errno is set for us */
 
 	dtd->dtd_data.ctt_info = CTF_TYPE_INFO(kind, flag, 0);
-	dtd->dtd_data.ctt_size = clp2(P2ROUNDUP(ep->cte_bits, NBBY) / NBBY);
+
+	/*
+	 * If the type's size is not an even number of bytes, then we should
+	 * round up the type size to the nearest byte.
+	 */
+	dtd->dtd_data.ctt_size = ep->cte_bits / NBBY;
+	if ((ep->cte_bits % NBBY) != 0)
+		dtd->dtd_data.ctt_size++;
 	dtd->dtd_u.dtu_enc = *ep;
 
 	return (type);
 }
 
-static ctf_id_t
-ctf_add_reftype(ctf_file_t *fp, uint_t flag, ctf_id_t ref, uint_t kind)
+ctf_id_t
+ctf_add_reftype(ctf_file_t *fp, uint_t flag,
+    const char *name, ctf_id_t ref, uint_t kind)
 {
 	ctf_dtdef_t *dtd;
 	ctf_id_t type;
@@ -685,7 +1017,7 @@ ctf_add_reftype(ctf_file_t *fp, uint_t flag, ctf_id_t ref, uint_t kind)
 	if (ref == CTF_ERR || ref < 0 || ref > CTF_MAX_TYPE)
 		return (ctf_set_errno(fp, EINVAL));
 
-	if ((type = ctf_add_generic(fp, flag, NULL, &dtd)) == CTF_ERR)
+	if ((type = ctf_add_generic(fp, flag, name, &dtd)) == CTF_ERR)
 		return (CTF_ERR); /* errno is set for us */
 
 	ctf_ref_inc(fp, ref);
@@ -711,9 +1043,9 @@ ctf_add_float(ctf_file_t *fp, uint_t flag,
 }
 
 ctf_id_t
-ctf_add_pointer(ctf_file_t *fp, uint_t flag, ctf_id_t ref)
+ctf_add_pointer(ctf_file_t *fp, uint_t flag, const char *name, ctf_id_t ref)
 {
-	return (ctf_add_reftype(fp, flag, ref, CTF_K_POINTER));
+	return (ctf_add_reftype(fp, flag, name, ref, CTF_K_POINTER));
 }
 
 ctf_id_t
@@ -728,13 +1060,17 @@ ctf_add_array(ctf_file_t *fp, uint_t flag, const ctf_arinfo_t *arp)
 
 	fpd = fp;
 	if (ctf_lookup_by_id(&fpd, arp->ctr_contents) == NULL &&
-	    ctf_dtd_lookup(fp, arp->ctr_contents) == NULL)
+	    ctf_dtd_lookup(fp, arp->ctr_contents) == NULL) {
+		ctf_dprintf("bad contents for array: %d\n", arp->ctr_contents);
 		return (ctf_set_errno(fp, ECTF_BADID));
+	}
 
 	fpd = fp;
 	if (ctf_lookup_by_id(&fpd, arp->ctr_index) == NULL &&
-	    ctf_dtd_lookup(fp, arp->ctr_index) == NULL)
+	    ctf_dtd_lookup(fp, arp->ctr_index) == NULL) {
+		ctf_dprintf("bad index for array: %d\n", arp->ctr_index);
 		return (ctf_set_errno(fp, ECTF_BADID));
+	}
 
 	if ((type = ctf_add_generic(fp, flag, NULL, &dtd)) == CTF_ERR)
 		return (CTF_ERR); /* errno is set for us */
@@ -781,7 +1117,7 @@ ctf_set_array(ctf_file_t *fp, ctf_id_t type, const ctf_arinfo_t *arp)
 }
 
 ctf_id_t
-ctf_add_function(ctf_file_t *fp, uint_t flag,
+ctf_add_funcptr(ctf_file_t *fp, uint_t flag,
     const ctf_funcinfo_t *ctc, const ctf_id_t *argv)
 {
 	ctf_dtdef_t *dtd;
@@ -842,20 +1178,34 @@ ctf_add_struct(ctf_file_t *fp, uint_t flag, const char *name)
 {
 	ctf_hash_t *hp = &fp->ctf_structs;
 	ctf_helem_t *hep = NULL;
-	ctf_dtdef_t *dtd;
-	ctf_id_t type;
+	ctf_dtdef_t *dtd = NULL;
+	ctf_id_t type = CTF_ERR;
 
 	if (name != NULL)
 		hep = ctf_hash_lookup(hp, fp, name, strlen(name));
 
-	if (hep != NULL && ctf_type_kind(fp, hep->h_type) == CTF_K_FORWARD)
-		dtd = ctf_dtd_lookup(fp, type = hep->h_type);
-	else if ((type = ctf_add_generic(fp, flag, name, &dtd)) == CTF_ERR)
-		return (CTF_ERR); /* errno is set for us */
+	if (hep != NULL && ctf_type_kind(fp, hep->h_type) == CTF_K_FORWARD) {
+		type = hep->h_type;
+		dtd = ctf_dtd_lookup(fp, type);
+		if (CTF_INFO_KIND(dtd->dtd_data.ctt_info) != CTF_K_FORWARD)
+			dtd = NULL;
+	}
 
+	if (dtd == NULL) {
+		type = ctf_add_generic(fp, flag, name, &dtd);
+		if (type == CTF_ERR)
+			return (CTF_ERR); /* errno is set for us */
+	}
+
+	VERIFY(type != CTF_ERR);
 	dtd->dtd_data.ctt_info = CTF_TYPE_INFO(CTF_K_STRUCT, flag, 0);
 	dtd->dtd_data.ctt_size = 0;
 
+	/*
+	 * Always dirty in case we modified a forward.
+	 */
+	fp->ctf_flags |= LCTF_DIRTY;
+
 	return (type);
 }
 
@@ -864,20 +1214,34 @@ ctf_add_union(ctf_file_t *fp, uint_t flag, const char *name)
 {
 	ctf_hash_t *hp = &fp->ctf_unions;
 	ctf_helem_t *hep = NULL;
-	ctf_dtdef_t *dtd;
-	ctf_id_t type;
+	ctf_dtdef_t *dtd = NULL;
+	ctf_id_t type = CTF_ERR;
 
 	if (name != NULL)
 		hep = ctf_hash_lookup(hp, fp, name, strlen(name));
 
-	if (hep != NULL && ctf_type_kind(fp, hep->h_type) == CTF_K_FORWARD)
-		dtd = ctf_dtd_lookup(fp, type = hep->h_type);
-	else if ((type = ctf_add_generic(fp, flag, name, &dtd)) == CTF_ERR)
-		return (CTF_ERR); /* errno is set for us */
+	if (hep != NULL && ctf_type_kind(fp, hep->h_type) == CTF_K_FORWARD) {
+		type = hep->h_type;
+		dtd = ctf_dtd_lookup(fp, type);
+		if (CTF_INFO_KIND(dtd->dtd_data.ctt_info) != CTF_K_FORWARD)
+			dtd = NULL;
+	}
 
+	if (dtd == NULL) {
+		type = ctf_add_generic(fp, flag, name, &dtd);
+		if (type == CTF_ERR)
+			return (CTF_ERR); /* errno is set for us */
+	}
+
+	VERIFY(type != CTF_ERR);
 	dtd->dtd_data.ctt_info = CTF_TYPE_INFO(CTF_K_UNION, flag, 0);
 	dtd->dtd_data.ctt_size = 0;
 
+	/*
+	 * Always dirty in case we modified a forward.
+	 */
+	fp->ctf_flags |= LCTF_DIRTY;
+
 	return (type);
 }
 
@@ -886,20 +1250,34 @@ ctf_add_enum(ctf_file_t *fp, uint_t flag, const char *name)
 {
 	ctf_hash_t *hp = &fp->ctf_enums;
 	ctf_helem_t *hep = NULL;
-	ctf_dtdef_t *dtd;
-	ctf_id_t type;
+	ctf_dtdef_t *dtd = NULL;
+	ctf_id_t type = CTF_ERR;
 
 	if (name != NULL)
 		hep = ctf_hash_lookup(hp, fp, name, strlen(name));
 
-	if (hep != NULL && ctf_type_kind(fp, hep->h_type) == CTF_K_FORWARD)
-		dtd = ctf_dtd_lookup(fp, type = hep->h_type);
-	else if ((type = ctf_add_generic(fp, flag, name, &dtd)) == CTF_ERR)
-		return (CTF_ERR); /* errno is set for us */
+	if (hep != NULL && ctf_type_kind(fp, hep->h_type) == CTF_K_FORWARD) {
+		type = hep->h_type;
+		dtd = ctf_dtd_lookup(fp, type);
+		if (CTF_INFO_KIND(dtd->dtd_data.ctt_info) != CTF_K_FORWARD)
+			dtd = NULL;
+	}
 
+	if (dtd == NULL) {
+		type = ctf_add_generic(fp, flag, name, &dtd);
+		if (type == CTF_ERR)
+			return (CTF_ERR); /* errno is set for us */
+	}
+
+	VERIFY(type != CTF_ERR);
 	dtd->dtd_data.ctt_info = CTF_TYPE_INFO(CTF_K_ENUM, flag, 0);
 	dtd->dtd_data.ctt_size = fp->ctf_dmodel->ctd_int;
 
+	/*
+	 * Always dirty in case we modified a forward.
+	 */
+	fp->ctf_flags |= LCTF_DIRTY;
+
 	return (type);
 }
 
@@ -965,21 +1343,21 @@ ctf_add_typedef(ctf_file_t *fp, uint_t flag, const char *name, ctf_id_t ref)
 }
 
 ctf_id_t
-ctf_add_volatile(ctf_file_t *fp, uint_t flag, ctf_id_t ref)
+ctf_add_volatile(ctf_file_t *fp, uint_t flag, const char *name, ctf_id_t ref)
 {
-	return (ctf_add_reftype(fp, flag, ref, CTF_K_VOLATILE));
+	return (ctf_add_reftype(fp, flag, name, ref, CTF_K_VOLATILE));
 }
 
 ctf_id_t
-ctf_add_const(ctf_file_t *fp, uint_t flag, ctf_id_t ref)
+ctf_add_const(ctf_file_t *fp, uint_t flag, const char *name, ctf_id_t ref)
 {
-	return (ctf_add_reftype(fp, flag, ref, CTF_K_CONST));
+	return (ctf_add_reftype(fp, flag, name, ref, CTF_K_CONST));
 }
 
 ctf_id_t
-ctf_add_restrict(ctf_file_t *fp, uint_t flag, ctf_id_t ref)
+ctf_add_restrict(ctf_file_t *fp, uint_t flag, const char *name, ctf_id_t ref)
 {
-	return (ctf_add_reftype(fp, flag, ref, CTF_K_RESTRICT));
+	return (ctf_add_reftype(fp, flag, name, ref, CTF_K_RESTRICT));
 }
 
 int
@@ -1012,8 +1390,10 @@ ctf_add_enumerator(ctf_file_t *fp, ctf_id_t enid, const char *name, int value)
 
 	for (dmd = ctf_list_next(&dtd->dtd_u.dtu_members);
 	    dmd != NULL; dmd = ctf_list_next(dmd)) {
-		if (strcmp(dmd->dmd_name, name) == 0)
+		if (strcmp(dmd->dmd_name, name) == 0) {
+			ctf_dprintf("encountered dupliacte member %s\n", name);
 			return (ctf_set_errno(fp, ECTF_DUPMEMBER));
+		}
 	}
 
 	if ((dmd = ctf_alloc(sizeof (ctf_dmdef_t))) == NULL)
@@ -1039,13 +1419,16 @@ ctf_add_enumerator(ctf_file_t *fp, ctf_id_t enid, const char *name, int value)
 }
 
 int
-ctf_add_member(ctf_file_t *fp, ctf_id_t souid, const char *name, ctf_id_t type)
+ctf_add_member(ctf_file_t *fp, ctf_id_t souid, const char *name, ctf_id_t type,
+    ulong_t offset)
 {
 	ctf_dtdef_t *dtd = ctf_dtd_lookup(fp, souid);
 	ctf_dmdef_t *dmd;
 
+	ulong_t mbitsz;
 	ssize_t msize, malign, ssize;
 	uint_t kind, vlen, root;
+	int mkind;
 	char *s = NULL;
 
 	if (!(fp->ctf_flags & LCTF_RDWR))
@@ -1064,19 +1447,58 @@ ctf_add_member(ctf_file_t *fp, ctf_id_t souid, const char *name, ctf_id_t type)
 	if (vlen == CTF_MAX_VLEN)
 		return (ctf_set_errno(fp, ECTF_DTFULL));
 
-	if (name != NULL) {
+	/*
+	 * Structures may have members which are anonymous. If they have two of
+	 * these, then the duplicte member detection would find it due to the
+	 * string of "", so we skip it.
+	 */
+	if (name != NULL && *name != '\0') {
 		for (dmd = ctf_list_next(&dtd->dtd_u.dtu_members);
 		    dmd != NULL; dmd = ctf_list_next(dmd)) {
 			if (dmd->dmd_name != NULL &&
-			    strcmp(dmd->dmd_name, name) == 0)
+			    strcmp(dmd->dmd_name, name) == 0) {
 				return (ctf_set_errno(fp, ECTF_DUPMEMBER));
+			}
 		}
 	}
 
 	if ((msize = ctf_type_size(fp, type)) == CTF_ERR ||
-	    (malign = ctf_type_align(fp, type)) == CTF_ERR)
+	    (malign = ctf_type_align(fp, type)) == CTF_ERR ||
+	    (mkind = ctf_type_kind(fp, type)) == CTF_ERR)
 		return (CTF_ERR); /* errno is set for us */
 
+	/*
+	 * ctf_type_size returns sizes in bytes. However, for bitfields, that
+	 * means that it may misrepresent and actually rounds it up to a power
+	 * of two and store that in bytes. So instead we have to get the
+	 * Integers encoding and rely on that.
+	 */
+	if (mkind == CTF_K_INTEGER) {
+		ctf_encoding_t e;
+
+		if (ctf_type_encoding(fp, type, &e) == CTF_ERR)
+			return (CTF_ERR); /* errno is set for us */
+		mbitsz = e.cte_bits;
+	} else if (mkind == CTF_K_FORWARD) {
+		/*
+		 * This is a rather rare case. In general one cannot add a
+		 * forward to a structure. However, the CTF tools traditionally
+		 * tried to add a forward to the struct cpu as the last member.
+		 * Therefore, if we find one here, we're going to verify the
+		 * size and make sure it's zero. It's certainly odd, but that's
+		 * life.
+		 *
+		 * Further, if it's not an absolute position being specified,
+		 * then we refuse to add it.
+		 */
+		if (offset == ULONG_MAX)
+			return (ctf_set_errno(fp, EINVAL));
+		VERIFY(msize == 0);
+		mbitsz = msize;
+	} else {
+		mbitsz = msize * 8;
+	}
+
 	if ((dmd = ctf_alloc(sizeof (ctf_dmdef_t))) == NULL)
 		return (ctf_set_errno(fp, EAGAIN));
 
@@ -1092,29 +1514,36 @@ ctf_add_member(ctf_file_t *fp, ctf_id_t souid, const char *name, ctf_id_t type)
 	if (kind == CTF_K_STRUCT && vlen != 0) {
 		ctf_dmdef_t *lmd = ctf_list_prev(&dtd->dtd_u.dtu_members);
 		ctf_id_t ltype = ctf_type_resolve(fp, lmd->dmd_type);
-		size_t off = lmd->dmd_offset;
-
-		ctf_encoding_t linfo;
-		ssize_t lsize;
-
-		if (ctf_type_encoding(fp, ltype, &linfo) != CTF_ERR)
-			off += linfo.cte_bits;
-		else if ((lsize = ctf_type_size(fp, ltype)) != CTF_ERR)
-			off += lsize * NBBY;
-
-		/*
-		 * Round up the offset of the end of the last member to the
-		 * next byte boundary, convert 'off' to bytes, and then round
-		 * it up again to the next multiple of the alignment required
-		 * by the new member.  Finally, convert back to bits and store
-		 * the result in dmd_offset.  Technically we could do more
-		 * efficient packing if the new member is a bit-field, but
-		 * we're the "compiler" and ANSI says we can do as we choose.
-		 */
-		off = roundup(off, NBBY) / NBBY;
-		off = roundup(off, MAX(malign, 1));
-		dmd->dmd_offset = off * NBBY;
-		ssize = off + msize;
+		size_t off;
+
+		if (offset == ULONG_MAX) {
+			ctf_encoding_t linfo;
+			ssize_t lsize;
+
+			off = lmd->dmd_offset;
+			if (ctf_type_encoding(fp, ltype, &linfo) != CTF_ERR)
+				off += linfo.cte_bits;
+			else if ((lsize = ctf_type_size(fp, ltype)) != CTF_ERR)
+				off += lsize * NBBY;
+
+			/*
+			 * Round up the offset of the end of the last member to
+			 * the next byte boundary, convert 'off' to bytes, and
+			 * then round it up again to the next multiple of the
+			 * alignment required by the new member.  Finally,
+			 * convert back to bits and store the result in
+			 * dmd_offset.  Technically we could do more efficient
+			 * packing if the new member is a bit-field, but we're
+			 * the "compiler" and ANSI says we can do as we choose.
+			 */
+			off = roundup(off, NBBY) / NBBY;
+			off = roundup(off, MAX(malign, 1));
+			dmd->dmd_offset = off * NBBY;
+			ssize = off + msize;
+		} else {
+			dmd->dmd_offset = offset;
+			ssize = (offset + mbitsz) / NBBY;
+		}
 	} else {
 		dmd->dmd_offset = 0;
 		ssize = ctf_get_ctt_size(fp, &dtd->dtd_data, NULL, NULL);
@@ -1380,7 +1809,7 @@ ctf_add_type(ctf_file_t *dst_fp, ctf_file_t *src_fp, ctf_id_t src_type)
 		if (src_type == CTF_ERR)
 			return (CTF_ERR); /* errno is set for us */
 
-		dst_type = ctf_add_reftype(dst_fp, flag, src_type, kind);
+		dst_type = ctf_add_reftype(dst_fp, flag, NULL, src_type, kind);
 		break;
 
 	case CTF_K_ARRAY:
@@ -1415,7 +1844,7 @@ ctf_add_type(ctf_file_t *dst_fp, ctf_file_t *src_fp, ctf_id_t src_type)
 		if (ctc.ctc_return == CTF_ERR)
 			return (CTF_ERR); /* errno is set for us */
 
-		dst_type = ctf_add_function(dst_fp, flag, &ctc, NULL);
+		dst_type = ctf_add_funcptr(dst_fp, flag, &ctc, NULL);
 		break;
 
 	case CTF_K_STRUCT:
@@ -1540,3 +1969,227 @@ ctf_add_type(ctf_file_t *dst_fp, ctf_file_t *src_fp, ctf_id_t src_type)
 
 	return (dst_type);
 }
+
+int
+ctf_add_function(ctf_file_t *fp, ulong_t idx, const ctf_funcinfo_t *fip,
+    const ctf_id_t *argc)
+{
+	int i;
+	ctf_dsdef_t *dsd;
+	ctf_file_t *afp;
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+
+	if (!(fp->ctf_flags & LCTF_RDWR))
+		return (ctf_set_errno(fp, ECTF_RDONLY));
+
+	if (ctf_dsd_lookup(fp, idx) != NULL)
+		return (ctf_set_errno(fp, ECTF_CONFLICT));
+
+	if (symbase == NULL)
+		return (ctf_set_errno(fp, ECTF_STRTAB));
+
+	if (idx > fp->ctf_nsyms)
+		return (ctf_set_errno(fp, ECTF_NOTDATA));
+
+	if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+		const Elf32_Sym *symp = (Elf32_Sym *)symbase + idx;
+		if (ELF32_ST_TYPE(symp->st_info) != STT_FUNC)
+			return (ctf_set_errno(fp, ECTF_NOTFUNC));
+	} else {
+		const Elf64_Sym *symp = (Elf64_Sym *)symbase + idx;
+		if (ELF64_ST_TYPE(symp->st_info) != STT_FUNC)
+			return (ctf_set_errno(fp, ECTF_NOTFUNC));
+	}
+
+	afp = fp;
+	if (ctf_lookup_by_id(&afp, fip->ctc_return) == NULL)
+		return (CTF_ERR); /* errno is set for us */
+
+	for (i = 0; i < fip->ctc_argc; i++) {
+		afp = fp;
+		if (ctf_lookup_by_id(&afp, argc[i]) == NULL)
+			return (CTF_ERR); /* errno is set for us */
+	}
+
+	dsd = ctf_alloc(sizeof (ctf_dsdef_t));
+	if (dsd == NULL)
+		return (ctf_set_errno(fp, ENOMEM));
+	dsd->dts_nargs = fip->ctc_argc;
+	if (fip->ctc_flags & CTF_FUNC_VARARG)
+		dsd->dts_nargs++;
+	if (dsd->dts_nargs != 0) {
+		dsd->dts_argc = ctf_alloc(sizeof (ctf_id_t) * dsd->dts_nargs);
+		if (dsd->dts_argc == NULL) {
+			ctf_free(dsd, sizeof (ctf_dsdef_t));
+			return (ctf_set_errno(fp, ENOMEM));
+		}
+		bcopy(argc, dsd->dts_argc, sizeof (ctf_id_t) * fip->ctc_argc);
+		if (fip->ctc_flags & CTF_FUNC_VARARG)
+			dsd->dts_argc[fip->ctc_argc] = 0;
+	}
+	dsd->dts_symidx = idx;
+	dsd->dts_tid = fip->ctc_return;
+
+	ctf_dsd_insert(fp, dsd);
+	fp->ctf_flags |= LCTF_DIRTY;
+
+	return (0);
+}
+
+int
+ctf_add_object(ctf_file_t *fp, ulong_t idx, ctf_id_t type)
+{
+	ctf_dsdef_t *dsd;
+	ctf_file_t *afp;
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+
+	if (!(fp->ctf_flags & LCTF_RDWR))
+		return (ctf_set_errno(fp, ECTF_RDONLY));
+
+	if (!(fp->ctf_flags & LCTF_RDWR))
+		return (ctf_set_errno(fp, ECTF_RDONLY));
+
+	if (ctf_dsd_lookup(fp, idx) != NULL)
+		return (ctf_set_errno(fp, ECTF_CONFLICT));
+
+	if (symbase == NULL)
+		return (ctf_set_errno(fp, ECTF_STRTAB));
+
+	if (idx > fp->ctf_nsyms)
+		return (ctf_set_errno(fp, ECTF_NOTDATA));
+
+	if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+		const Elf32_Sym *symp = (Elf32_Sym *)symbase + idx;
+		if (ELF32_ST_TYPE(symp->st_info) != STT_OBJECT)
+			return (ctf_set_errno(fp, ECTF_NOTDATA));
+	} else {
+		const Elf64_Sym *symp = (Elf64_Sym *)symbase + idx;
+		if (ELF64_ST_TYPE(symp->st_info) != STT_OBJECT)
+			return (ctf_set_errno(fp, ECTF_NOTDATA));
+	}
+
+	afp = fp;
+	if (ctf_lookup_by_id(&afp, type) == NULL)
+		return (CTF_ERR); /* errno is set for us */
+
+	dsd = ctf_alloc(sizeof (ctf_dsdef_t));
+	if (dsd == NULL)
+		return (ctf_set_errno(fp, ENOMEM));
+	dsd->dts_symidx = idx;
+	dsd->dts_tid = type;
+	dsd->dts_argc = NULL;
+
+	ctf_dsd_insert(fp, dsd);
+	fp->ctf_flags |= LCTF_DIRTY;
+
+	return (0);
+}
+
+void
+ctf_dataptr(ctf_file_t *fp, const void **addrp, size_t *sizep)
+{
+	if (addrp != NULL)
+		*addrp = fp->ctf_base;
+	if (sizep != NULL)
+		*sizep = fp->ctf_size;
+}
+
+int
+ctf_add_label(ctf_file_t *fp, const char *name, ctf_id_t type, uint_t position)
+{
+	ctf_file_t *fpd;
+	ctf_dldef_t *dld;
+
+	if (name == NULL)
+		return (ctf_set_errno(fp, EINVAL));
+
+	if (!(fp->ctf_flags & LCTF_RDWR))
+		return (ctf_set_errno(fp, ECTF_RDONLY));
+
+	fpd = fp;
+	if (type != 0 && ctf_lookup_by_id(&fpd, type) == NULL)
+		return (CTF_ERR); /* errno is set for us */
+
+	if (type != 0 && (fp->ctf_flags & LCTF_CHILD) &&
+	    CTF_TYPE_ISPARENT(type))
+		return (ctf_set_errno(fp, ECTF_NOPARENT));
+
+	if (ctf_dld_lookup(fp, name) != NULL)
+		return (ctf_set_errno(fp, ECTF_LABELEXISTS));
+
+	if ((dld = ctf_alloc(sizeof (ctf_dldef_t))) == NULL)
+		return (ctf_set_errno(fp, EAGAIN));
+
+	if ((dld->dld_name = ctf_strdup(name)) == NULL) {
+		ctf_free(dld, sizeof (ctf_dldef_t));
+		return (ctf_set_errno(fp, EAGAIN));
+	}
+
+	dld->dld_type = type;
+	fp->ctf_dtstrlen += strlen(name) + 1;
+	ctf_dld_insert(fp, dld, position);
+	fp->ctf_flags |= LCTF_DIRTY;
+
+	return (0);
+}
+
+/*
+ * Update the size of a structure or union. Note that we don't allow this to
+ * shrink the size of a struct or union, only to increase it. This is useful for
+ * cases when you have a structure whose actual size is larger than the sum of
+ * its members due to padding for natuaral alignment.
+ */
+int
+ctf_set_size(ctf_file_t *fp, ctf_id_t id, const ulong_t newsz)
+{
+	ctf_dtdef_t *dtd = ctf_dtd_lookup(fp, id);
+	uint_t kind;
+	size_t oldsz;
+
+	if (!(fp->ctf_flags & LCTF_RDWR))
+		return (ctf_set_errno(fp, ECTF_RDONLY));
+
+	if (dtd == NULL)
+		return (ctf_set_errno(fp, ECTF_BADID));
+
+	kind = CTF_INFO_KIND(dtd->dtd_data.ctt_info);
+
+	if (kind != CTF_K_STRUCT && kind != CTF_K_UNION)
+		return (ctf_set_errno(fp, ECTF_NOTSOU));
+
+	if ((oldsz = dtd->dtd_data.ctt_size) == CTF_LSIZE_SENT)
+		oldsz = CTF_TYPE_LSIZE(&dtd->dtd_data);
+
+	if (newsz < oldsz)
+		return (ctf_set_errno(fp, EINVAL));
+
+	if (newsz > CTF_MAX_SIZE) {
+		dtd->dtd_data.ctt_size = CTF_LSIZE_SENT;
+		dtd->dtd_data.ctt_lsizehi = CTF_SIZE_TO_LSIZE_HI(newsz);
+		dtd->dtd_data.ctt_lsizelo = CTF_SIZE_TO_LSIZE_LO(newsz);
+	} else {
+		dtd->dtd_data.ctt_size = (ushort_t)newsz;
+	}
+
+	fp->ctf_flags |= LCTF_DIRTY;
+	return (0);
+}
+
+int
+ctf_set_root(ctf_file_t *fp, ctf_id_t id, const boolean_t vis)
+{
+	ctf_dtdef_t *dtd = ctf_dtd_lookup(fp, id);
+	uint_t kind, vlen;
+
+	if (!(fp->ctf_flags & LCTF_RDWR))
+		return (ctf_set_errno(fp, ECTF_RDONLY));
+
+	if (dtd == NULL)
+		return (ctf_set_errno(fp, ECTF_BADID));
+
+	kind = CTF_INFO_KIND(dtd->dtd_data.ctt_info);
+	vlen = CTF_INFO_VLEN(dtd->dtd_data.ctt_info);
+
+	dtd->dtd_data.ctt_info = CTF_TYPE_INFO(kind, vis, vlen);
+	return (0);
+}
diff --git a/usr/src/common/ctf/ctf_error.c b/usr/src/common/ctf/ctf_error.c
index fe3d0de0cb..1765b77b54 100644
--- a/usr/src/common/ctf/ctf_error.c
+++ b/usr/src/common/ctf/ctf_error.c
@@ -24,7 +24,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright (c) 2012, Joyent, Inc.
+ * Copyright (c) 2015, Joyent, Inc.
  */
 
 #include <ctf_impl.h>
@@ -75,7 +75,15 @@ static const char *const _ctf_errlist[] = {
 	"Duplicate member name definition",		 /* ECTF_DUPMEMBER */
 	"Conflicting type is already defined",		 /* ECTF_CONFLICT */
 	"Type has outstanding references",		 /* ECTF_REFERENCED */
-	"Type is not a dynamic type"			 /* ECTF_NOTDYN */
+	"Type is not a dynamic type",			 /* ECTF_NOTDYN */
+	"Elf library failure",				 /* ECTF_ELF */
+	"Cannot merge child container",			 /* ECTF_MCHILD */
+	"Label already exists",				 /* ECTF_LABEL */
+	"Merged labels conflict",			 /* ECTF_LCONFLICT */
+	"Zlib library failure",				 /* ECTF_ZLIB */
+	"CTF conversion backend error",			 /* ECTF_CONVBKERR */
+	"No C source to convert from",			 /* ECTF_CONVNOCSRC */
+	"No applicable conversion backend"		 /* ECTF_NOCONVBKEND */
 };
 
 static const int _ctf_nerr = sizeof (_ctf_errlist) / sizeof (_ctf_errlist[0]);
diff --git a/usr/src/common/ctf/ctf_hash.c b/usr/src/common/ctf/ctf_hash.c
index b10a7618f6..0c5a71a5ac 100644
--- a/usr/src/common/ctf/ctf_hash.c
+++ b/usr/src/common/ctf/ctf_hash.c
@@ -25,9 +25,8 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <ctf_impl.h>
+#include <sys/debug.h>
 
 static const ushort_t _CTF_EMPTY[1] = { 0 };
 
diff --git a/usr/src/common/ctf/ctf_impl.h b/usr/src/common/ctf/ctf_impl.h
index f56fa6a005..04b12418ae 100644
--- a/usr/src/common/ctf/ctf_impl.h
+++ b/usr/src/common/ctf/ctf_impl.h
@@ -25,7 +25,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright (c) 2012, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
  */
 
 #ifndef	_CTF_IMPL_H
@@ -41,6 +41,8 @@
 #include <sys/systm.h>
 #include <sys/cmn_err.h>
 #include <sys/varargs.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
 
 #define	isspace(c) \
 	((c) == ' ' || (c) == '\t' || (c) == '\n' || \
@@ -56,6 +58,7 @@
 #include <stdio.h>
 #include <limits.h>
 #include <ctype.h>
+#include <stddef.h>
 
 #endif	/* _KERNEL */
 
@@ -77,6 +80,10 @@ typedef struct ctf_hash {
 	uint_t h_free;		/* index of next free hash element */
 } ctf_hash_t;
 
+struct ctf_idhash_iter {
+	int cii_id;	/* Current iteration id */
+};
+
 typedef struct ctf_strs {
 	const char *cts_strs;	/* base address of string table */
 	size_t cts_len;		/* size of string table in bytes */
@@ -159,6 +166,20 @@ typedef struct ctf_dtdef {
 	} dtd_u;
 } ctf_dtdef_t;
 
+typedef struct ctf_dsdef {
+	ctf_list_t dts_list;	/* list forward/back pointers */
+	ulong_t dts_symidx;	/* symbol id */
+	ctf_id_t dts_tid;	/* type for obj, 0 if function */
+	uint_t dts_nargs;
+	ctf_id_t *dts_argc;	/* function argv */
+} ctf_dsdef_t;
+
+typedef struct ctf_dldef {
+	ctf_list_t dld_list;	/* list forward/back pointers */
+	char *dld_name;		/* name of the label */
+	ctf_id_t dld_type;	/* type ID associated with the label */
+} ctf_dldef_t;
+
 typedef struct ctf_bundle {
 	ctf_file_t *ctb_file;	/* CTF container handle */
 	ctf_id_t ctb_type;	/* CTF type identifier */
@@ -211,6 +232,9 @@ struct ctf_file {
 	ulong_t ctf_dtnextid;	/* next dynamic type id to assign */
 	ulong_t ctf_dtoldid;	/* oldest id that has been committed */
 	void *ctf_specific;	/* data for ctf_get/setspecific */
+	ctf_list_t ctf_dsdefs;	/* list of dynamic obj/func definitions */
+	ctf_list_t ctf_dldefs;	/* list of dynamic labels */
+	uint_t ctf_hflags;	/* original flags on the header */
 };
 
 #define	LCTF_INDEX_TO_TYPEPTR(fp, i) \
@@ -225,62 +249,15 @@ struct ctf_file {
 #define	LCTF_RDWR	0x0004	/* CTF container is writable */
 #define	LCTF_DIRTY	0x0008	/* CTF container has been modified */
 
-#define	ECTF_BASE	1000	/* base value for libctf errnos */
-
-enum {
-	ECTF_FMT = ECTF_BASE,	/* file is not in CTF or ELF format */
-	ECTF_ELFVERS,		/* ELF version is more recent than libctf */
-	ECTF_CTFVERS,		/* CTF version is more recent than libctf */
-	ECTF_ENDIAN,		/* data is different endian-ness than lib */
-	ECTF_SYMTAB,		/* symbol table uses invalid entry size */
-	ECTF_SYMBAD,		/* symbol table data buffer invalid */
-	ECTF_STRBAD,		/* string table data buffer invalid */
-	ECTF_CORRUPT,		/* file data corruption detected */
-	ECTF_NOCTFDATA,		/* ELF file does not contain CTF data */
-	ECTF_NOCTFBUF,		/* buffer does not contain CTF data */
-	ECTF_NOSYMTAB,		/* symbol table data is not available */
-	ECTF_NOPARENT,		/* parent CTF container is not available */
-	ECTF_DMODEL,		/* data model mismatch */
-	ECTF_MMAP,		/* failed to mmap a data section */
-	ECTF_ZMISSING,		/* decompression library not installed */
-	ECTF_ZINIT,		/* failed to initialize decompression library */
-	ECTF_ZALLOC,		/* failed to allocate decompression buffer */
-	ECTF_DECOMPRESS,	/* failed to decompress CTF data */
-	ECTF_STRTAB,		/* string table for this string is missing */
-	ECTF_BADNAME,		/* string offset is corrupt w.r.t. strtab */
-	ECTF_BADID,		/* invalid type ID number */
-	ECTF_NOTSOU,		/* type is not a struct or union */
-	ECTF_NOTENUM,		/* type is not an enum */
-	ECTF_NOTSUE,		/* type is not a struct, union, or enum */
-	ECTF_NOTINTFP,		/* type is not an integer or float */
-	ECTF_NOTARRAY,		/* type is not an array */
-	ECTF_NOTREF,		/* type does not reference another type */
-	ECTF_NAMELEN,		/* buffer is too small to hold type name */
-	ECTF_NOTYPE,		/* no type found corresponding to name */
-	ECTF_SYNTAX,		/* syntax error in type name */
-	ECTF_NOTFUNC,		/* symtab entry does not refer to a function */
-	ECTF_NOFUNCDAT,		/* no func info available for function */
-	ECTF_NOTDATA,		/* symtab entry does not refer to a data obj */
-	ECTF_NOTYPEDAT,		/* no type info available for object */
-	ECTF_NOLABEL,		/* no label found corresponding to name */
-	ECTF_NOLABELDATA,	/* file does not contain any labels */
-	ECTF_NOTSUP,		/* feature not supported */
-	ECTF_NOENUMNAM,		/* enum element name not found */
-	ECTF_NOMEMBNAM,		/* member name not found */
-	ECTF_RDONLY,		/* CTF container is read-only */
-	ECTF_DTFULL,		/* CTF type is full (no more members allowed) */
-	ECTF_FULL,		/* CTF container is full */
-	ECTF_DUPMEMBER,		/* duplicate member name definition */
-	ECTF_CONFLICT,		/* conflicting type definition present */
-	ECTF_REFERENCED,	/* type has outstanding references */
-	ECTF_NOTDYN		/* type is not a dynamic type */
-};
+#define	CTF_ELF_SCN_NAME	".SUNW_ctf"
 
 extern ssize_t ctf_get_ctt_size(const ctf_file_t *, const ctf_type_t *,
     ssize_t *, ssize_t *);
 
 extern const ctf_type_t *ctf_lookup_by_id(ctf_file_t **, ctf_id_t);
 
+extern ctf_file_t *ctf_fdcreate_int(int, int *, ctf_sect_t *);
+
 extern int ctf_hash_create(ctf_hash_t *, ulong_t);
 extern int ctf_hash_insert(ctf_hash_t *, ctf_file_t *, ushort_t, uint_t);
 extern int ctf_hash_define(ctf_hash_t *, ctf_file_t *, ushort_t, uint_t);
@@ -294,12 +271,16 @@ extern void ctf_hash_destroy(ctf_hash_t *);
 
 extern void ctf_list_append(ctf_list_t *, void *);
 extern void ctf_list_prepend(ctf_list_t *, void *);
+extern void ctf_list_insert_before(ctf_list_t *, void *, void *);
 extern void ctf_list_delete(ctf_list_t *, void *);
 
 extern void ctf_dtd_insert(ctf_file_t *, ctf_dtdef_t *);
 extern void ctf_dtd_delete(ctf_file_t *, ctf_dtdef_t *);
 extern ctf_dtdef_t *ctf_dtd_lookup(ctf_file_t *, ctf_id_t);
 
+extern void ctf_dsd_delete(ctf_file_t *, ctf_dsdef_t *);
+extern void ctf_dld_delete(ctf_file_t *, ctf_dldef_t *);
+
 extern void ctf_decl_init(ctf_decl_t *, char *, size_t);
 extern void ctf_decl_fini(ctf_decl_t *);
 extern void ctf_decl_push(ctf_decl_t *, ctf_file_t *, ctf_id_t);
@@ -327,6 +308,13 @@ extern void ctf_dprintf(const char *, ...);
 
 extern void *ctf_zopen(int *);
 
+extern ctf_id_t ctf_add_encoded(ctf_file_t *, uint_t, const char *,
+    const ctf_encoding_t *, uint_t);
+extern ctf_id_t ctf_add_reftype(ctf_file_t *, uint_t, const char *, ctf_id_t,
+    uint_t);
+extern boolean_t ctf_sym_valid(uintptr_t, int, uint16_t, uint64_t,
+    uint32_t);
+
 extern const char _CTF_SECTION[];	/* name of CTF ELF section */
 extern const char _CTF_NULLSTR[];	/* empty string */
 
diff --git a/usr/src/common/ctf/ctf_open.c b/usr/src/common/ctf/ctf_open.c
index 001cf5c591..82b396e825 100644
--- a/usr/src/common/ctf/ctf_open.c
+++ b/usr/src/common/ctf/ctf_open.c
@@ -25,7 +25,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
  */
 
 #include <ctf_impl.h>
@@ -550,6 +550,7 @@ ctf_bufopen(const ctf_sect_t *ctfsect, const ctf_sect_t *symsect,
 	void *buf, *base;
 	size_t size, hdrsz;
 	int err;
+	uint_t hflags;
 
 	if (ctfsect == NULL || ((symsect == NULL) != (strsect == NULL)))
 		return (ctf_set_open_errno(errp, EINVAL));
@@ -631,6 +632,7 @@ ctf_bufopen(const ctf_sect_t *ctfsect, const ctf_sect_t *symsect,
 	 * the CTF data buffer if it is compressed.  Otherwise we just put
 	 * the data section's buffer pointer into ctf_buf, below.
 	 */
+	hflags = hp.cth_flags;
 	if (hp.cth_flags & CTF_F_COMPRESS) {
 		size_t srclen, dstlen;
 		const void *src;
@@ -680,6 +682,7 @@ ctf_bufopen(const ctf_sect_t *ctfsect, const ctf_sect_t *symsect,
 	bzero(fp, sizeof (ctf_file_t));
 	fp->ctf_version = hp.cth_version;
 	fp->ctf_fileops = &ctf_fileops[hp.cth_version];
+	fp->ctf_hflags = hflags;
 	bcopy(ctfsect, &fp->ctf_data, sizeof (ctf_sect_t));
 
 	if (symsect != NULL) {
@@ -883,6 +886,8 @@ void
 ctf_close(ctf_file_t *fp)
 {
 	ctf_dtdef_t *dtd, *ntd;
+	ctf_dsdef_t *dsd, *nsd;
+	ctf_dldef_t *dld, *nld;
 
 	if (fp == NULL)
 		return; /* allow ctf_close(NULL) to simplify caller code */
@@ -906,10 +911,25 @@ ctf_close(ctf_file_t *fp)
 		ctf_dtd_delete(fp, dtd);
 	}
 
+	for (dsd = ctf_list_prev(&fp->ctf_dsdefs); dsd != NULL; dsd = nsd) {
+		nsd = ctf_list_prev(dsd);
+		ctf_dsd_delete(fp, dsd);
+	}
+
+	for (dld = ctf_list_prev(&fp->ctf_dldefs); dld != NULL; dld = nld) {
+		nld = ctf_list_prev(dld);
+		ctf_dld_delete(fp, dld);
+	}
+
 	ctf_free(fp->ctf_dthash, fp->ctf_dthashlen * sizeof (ctf_dtdef_t *));
 
 	if (fp->ctf_flags & LCTF_MMAP) {
-		if (fp->ctf_data.cts_data != NULL)
+		/*
+		 * Writeable containers shouldn't necessairily have the CTF
+		 * section freed.
+		 */
+		if (fp->ctf_data.cts_data != NULL &&
+		    !(fp->ctf_flags & LCTF_RDWR))
 			ctf_sect_munmap(&fp->ctf_data);
 		if (fp->ctf_symtab.cts_data != NULL)
 			ctf_sect_munmap(&fp->ctf_symtab);
@@ -980,6 +1000,16 @@ ctf_parent_name(ctf_file_t *fp)
 }
 
 /*
+ * Return the label of the parent CTF container, if one exists. Otherwise return
+ * NULL.
+ */
+const char *
+ctf_parent_label(ctf_file_t *fp)
+{
+	return (fp->ctf_parlabel);
+}
+
+/*
  * Import the types from the specified parent container by storing a pointer
  * to it in ctf_parent and incrementing its reference count.  Only one parent
  * is allowed: if a parent already exists, it is replaced by the new parent.
@@ -1043,3 +1073,9 @@ ctf_getspecific(ctf_file_t *fp)
 {
 	return (fp->ctf_specific);
 }
+
+uint_t
+ctf_flags(ctf_file_t *fp)
+{
+	return (fp->ctf_hflags);
+}
diff --git a/usr/src/common/ctf/ctf_types.c b/usr/src/common/ctf/ctf_types.c
index ab1b9ff14b..2ef4f42d6b 100644
--- a/usr/src/common/ctf/ctf_types.c
+++ b/usr/src/common/ctf/ctf_types.c
@@ -24,8 +24,12 @@
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
 
 #include <ctf_impl.h>
+#include <sys/debug.h>
 
 ssize_t
 ctf_get_ctt_size(const ctf_file_t *fp, const ctf_type_t *tp, ssize_t *sizep,
@@ -138,19 +142,21 @@ ctf_enum_iter(ctf_file_t *fp, ctf_id_t type, ctf_enum_f *func, void *arg)
 }
 
 /*
- * Iterate over every root (user-visible) type in the given CTF container.
- * We pass the type ID of each type to the specified callback function.
+ * Iterate over every type in the given CTF container. If the user doesn't ask
+ * for all types, then we only give them the user visible, aka root, types.  We
+ * pass the type ID of each type to the specified callback function.
  */
 int
-ctf_type_iter(ctf_file_t *fp, ctf_type_f *func, void *arg)
+ctf_type_iter(ctf_file_t *fp, boolean_t nonroot, ctf_type_f *func, void *arg)
 {
 	ctf_id_t id, max = fp->ctf_typemax;
 	int rc, child = (fp->ctf_flags & LCTF_CHILD);
 
 	for (id = 1; id <= max; id++) {
 		const ctf_type_t *tp = LCTF_INDEX_TO_TYPEPTR(fp, id);
-		if (CTF_INFO_ISROOT(tp->ctt_info) &&
-		    (rc = func(CTF_INDEX_TO_TYPE(id, child), arg)) != 0)
+		if ((nonroot || CTF_INFO_ISROOT(tp->ctt_info)) &&
+		    (rc = func(CTF_INDEX_TO_TYPE(id, child),
+		    CTF_INFO_ISROOT(tp->ctt_info),  arg)) != 0)
 			return (rc);
 	}
 
@@ -361,6 +367,9 @@ ctf_type_size(ctf_file_t *fp, ctf_id_t type)
 	case CTF_K_FUNCTION:
 		return (0); /* function size is only known by symtab */
 
+	case CTF_K_FORWARD:
+		return (0);
+
 	case CTF_K_ENUM:
 		return (fp->ctf_dmodel->ctd_int);
 
@@ -380,7 +389,22 @@ ctf_type_size(ctf_file_t *fp, ctf_id_t type)
 			return (-1); /* errno is set for us */
 
 		return (size * ar.ctr_nelems);
-
+	case CTF_K_STRUCT:
+	case CTF_K_UNION:
+		/*
+		 * If we have a zero size, we may be in the process of adding a
+		 * structure or union but having not called ctf_update() to deal
+		 * with the circular dependencies in such structures and unions.
+		 * To handle that case, if we get a size of zero from the ctt,
+		 * we look up the dtdef and use its size instead.
+		 */
+		size = ctf_get_ctt_size(fp, tp, NULL, NULL);
+		if (size == 0) {
+			ctf_dtdef_t *dtd = ctf_dtd_lookup(fp, type);
+			if (dtd != NULL)
+				return (dtd->dtd_data.ctt_size);
+		}
+		return (size);
 	default:
 		return (ctf_get_ctt_size(fp, tp, NULL, NULL));
 	}
@@ -868,3 +892,296 @@ ctf_type_visit(ctf_file_t *fp, ctf_id_t type, ctf_visit_f *func, void *arg)
 {
 	return (ctf_type_rvisit(fp, type, func, arg, "", 0, 0));
 }
+
+int
+ctf_func_info_by_id(ctf_file_t *fp, ctf_id_t type, ctf_funcinfo_t *fip)
+{
+	ctf_file_t *ofp = fp;
+	const ctf_type_t *tp;
+	const ushort_t *dp;
+	int nargs;
+	ssize_t increment;
+
+	if ((tp = ctf_lookup_by_id(&fp, type)) == NULL)
+		return (CTF_ERR); /* errno is set for us */
+
+	if (LCTF_INFO_KIND(fp, tp->ctt_info) != CTF_K_FUNCTION)
+		return (ctf_set_errno(ofp, ECTF_NOTFUNC));
+
+	fip->ctc_return = tp->ctt_type;
+	nargs = LCTF_INFO_VLEN(fp, tp->ctt_info);
+	fip->ctc_argc = nargs;
+	fip->ctc_flags = 0;
+
+	/* dp should now point to the first argument */
+	if (nargs != 0) {
+		(void) ctf_get_ctt_size(fp, tp, NULL, &increment);
+		dp = (ushort_t *)((uintptr_t)fp->ctf_buf +
+		    fp->ctf_txlate[CTF_TYPE_TO_INDEX(type)] + increment);
+		if (dp[nargs - 1] == 0) {
+			fip->ctc_flags |= CTF_FUNC_VARARG;
+			fip->ctc_argc--;
+		}
+	}
+
+	return (0);
+}
+
+int
+ctf_func_args_by_id(ctf_file_t *fp, ctf_id_t type, uint_t argc, ctf_id_t *argv)
+{
+	ctf_file_t *ofp = fp;
+	const ctf_type_t *tp;
+	const ushort_t *dp;
+	int nargs;
+	ssize_t increment;
+
+	if ((tp = ctf_lookup_by_id(&fp, type)) == NULL)
+		return (CTF_ERR); /* errno is set for us */
+
+	if (LCTF_INFO_KIND(fp, tp->ctt_info) != CTF_K_FUNCTION)
+		return (ctf_set_errno(ofp, ECTF_NOTFUNC));
+
+	nargs = LCTF_INFO_VLEN(fp, tp->ctt_info);
+	(void) ctf_get_ctt_size(fp, tp, NULL, &increment);
+	dp = (ushort_t *)((uintptr_t)fp->ctf_buf +
+	    fp->ctf_txlate[CTF_TYPE_TO_INDEX(type)] +
+	    increment);
+	if (nargs != 0 && dp[nargs - 1] == 0)
+		nargs--;
+
+	for (nargs = MIN(argc, nargs); nargs != 0; nargs--)
+		*argv++ = *dp++;
+
+	return (0);
+}
+
+int
+ctf_object_iter(ctf_file_t *fp, ctf_object_f *func, void *arg)
+{
+	int i, ret;
+	ctf_id_t id;
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+	uintptr_t strbase = (uintptr_t)fp->ctf_strtab.cts_data;
+
+	if (fp->ctf_symtab.cts_data == NULL)
+		return (ctf_set_errno(fp, ECTF_NOSYMTAB));
+
+	for (i = 0; i < fp->ctf_nsyms; i++) {
+		char *name;
+		if (fp->ctf_sxlate[i] == -1u)
+			continue;
+		id = *(ushort_t *)((uintptr_t)fp->ctf_buf +
+		    fp->ctf_sxlate[i]);
+
+		/*
+		 * Validate whether or not we're looking at a data object as
+		 * oposed to a function.
+		 */
+		if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+			const Elf32_Sym *symp = (Elf32_Sym *)symbase + i;
+			if (ELF32_ST_TYPE(symp->st_info) != STT_OBJECT)
+				continue;
+			if (fp->ctf_strtab.cts_data != NULL &&
+			    symp->st_name != 0)
+				name = (char *)(strbase + symp->st_name);
+			else
+				name = NULL;
+		} else {
+			const Elf64_Sym *symp = (Elf64_Sym *)symbase + i;
+			if (ELF64_ST_TYPE(symp->st_info) != STT_OBJECT)
+				continue;
+			if (fp->ctf_strtab.cts_data != NULL &&
+			    symp->st_name != 0)
+				name = (char *)(strbase + symp->st_name);
+			else
+				name = NULL;
+		}
+
+		if ((ret = func(name, id, i, arg)) != 0)
+			return (ret);
+	}
+
+	return (0);
+}
+
+int
+ctf_function_iter(ctf_file_t *fp, ctf_function_f *func, void *arg)
+{
+	int i, ret;
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+	uintptr_t strbase = (uintptr_t)fp->ctf_strtab.cts_data;
+
+	if (fp->ctf_symtab.cts_data == NULL)
+		return (ctf_set_errno(fp, ECTF_NOSYMTAB));
+
+	for (i = 0; i < fp->ctf_nsyms; i++) {
+		char *name;
+		ushort_t info, *dp;
+		ctf_funcinfo_t fi;
+		if (fp->ctf_sxlate[i] == -1u)
+			continue;
+
+		dp = (ushort_t *)((uintptr_t)fp->ctf_buf +
+		    fp->ctf_sxlate[i]);
+		info = *dp;
+		if (info == 0)
+			continue;
+
+		/*
+		 * This may be a function or it may be a data object. We have to
+		 * consult the symbol table to be certain. Functions are encoded
+		 * with their info, data objects with their actual type.
+		 */
+		if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+			const Elf32_Sym *symp = (Elf32_Sym *)symbase + i;
+			if (ELF32_ST_TYPE(symp->st_info) != STT_FUNC)
+				continue;
+			if (fp->ctf_strtab.cts_data != NULL)
+				name = (char *)(strbase + symp->st_name);
+			else
+				name = NULL;
+		} else {
+			const Elf64_Sym *symp = (Elf64_Sym *)symbase + i;
+			if (ELF64_ST_TYPE(symp->st_info) != STT_FUNC)
+				continue;
+			if (fp->ctf_strtab.cts_data != NULL)
+				name = (char *)(strbase + symp->st_name);
+			else
+				name = NULL;
+		}
+
+		if (LCTF_INFO_KIND(fp, info) != CTF_K_FUNCTION)
+			continue;
+		dp++;
+		fi.ctc_return = *dp;
+		dp++;
+		fi.ctc_argc = LCTF_INFO_VLEN(fp, info);
+		fi.ctc_flags = 0;
+
+		if (fi.ctc_argc != 0 && dp[fi.ctc_argc - 1] == 0) {
+			fi.ctc_flags |= CTF_FUNC_VARARG;
+			fi.ctc_argc--;
+		}
+
+		if ((ret = func(name, i, &fi, arg)) != 0)
+			return (ret);
+
+	}
+
+	return (0);
+}
+
+char *
+ctf_symbol_name(ctf_file_t *fp, ulong_t idx, char *buf, size_t len)
+{
+	const char *name;
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+	uintptr_t strbase = (uintptr_t)fp->ctf_strtab.cts_data;
+
+	if (fp->ctf_symtab.cts_data == NULL) {
+		(void) ctf_set_errno(fp, ECTF_NOSYMTAB);
+		return (NULL);
+	}
+
+	if (fp->ctf_strtab.cts_data == NULL) {
+		(void) ctf_set_errno(fp, ECTF_STRTAB);
+		return (NULL);
+	}
+
+	if (idx > fp->ctf_nsyms) {
+		(void) ctf_set_errno(fp, ECTF_NOTDATA);
+		return (NULL);
+	}
+
+	if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+		const Elf32_Sym *symp = (Elf32_Sym *)symbase + idx;
+		if (ELF32_ST_TYPE(symp->st_info) != STT_OBJECT &&
+		    ELF32_ST_TYPE(symp->st_info) != STT_FUNC) {
+			(void) ctf_set_errno(fp, ECTF_NOTDATA);
+			return (NULL);
+		}
+		if (symp->st_name == 0) {
+			(void) ctf_set_errno(fp, ENOENT);
+			return (NULL);
+		}
+		name = (const char *)(strbase + symp->st_name);
+	} else {
+		const Elf64_Sym *symp = (Elf64_Sym *)symbase + idx;
+		if (ELF64_ST_TYPE(symp->st_info) != STT_FUNC &&
+		    ELF64_ST_TYPE(symp->st_info) != STT_OBJECT) {
+			(void) ctf_set_errno(fp, ECTF_NOTDATA);
+			return (NULL);
+		}
+		if (symp->st_name == 0) {
+			(void) ctf_set_errno(fp, ENOENT);
+			return (NULL);
+		}
+		name = (const char *)(strbase + symp->st_name);
+	}
+
+	(void) strlcpy(buf, name, len);
+
+	return (buf);
+}
+
+int
+ctf_string_iter(ctf_file_t *fp, ctf_string_f *func, void *arg)
+{
+	int rc;
+	const char *strp = fp->ctf_str[CTF_STRTAB_0].cts_strs;
+	size_t strl = fp->ctf_str[CTF_STRTAB_0].cts_len;
+
+	while (strl > 0) {
+		size_t len;
+
+		if ((rc = func(strp, arg)) != 0)
+			return (rc);
+
+		len = strlen(strp) + 1;
+		strl -= len;
+		strp += len;
+	}
+
+	return (0);
+}
+
+/*
+ * fp isn't strictly necesasry at the moment. However, if we ever rev the file
+ * format, the valid values for kind will change.
+ */
+const char *
+ctf_kind_name(ctf_file_t *fp, int kind)
+{
+	switch (kind) {
+	case CTF_K_INTEGER:
+		return ("integer");
+	case CTF_K_FLOAT:
+		return ("float");
+	case CTF_K_POINTER:
+		return ("pointer");
+	case CTF_K_ARRAY:
+		return ("array");
+	case CTF_K_FUNCTION:
+		return ("function");
+	case CTF_K_STRUCT:
+		return ("struct");
+	case CTF_K_UNION:
+		return ("union");
+	case CTF_K_ENUM:
+		return ("enum");
+	case CTF_K_FORWARD:
+		return ("forward");
+	case CTF_K_TYPEDEF:
+		return ("typedef");
+	case CTF_K_VOLATILE:
+		return ("volatile");
+	case CTF_K_CONST:
+		return ("const");
+	case CTF_K_RESTRICT:
+		return ("restrict");
+	case CTF_K_UNKNOWN:
+	default:
+		return ("unknown");
+	}
+}
diff --git a/usr/src/common/ctf/ctf_util.c b/usr/src/common/ctf/ctf_util.c
index 740d403e8c..550195b5e1 100644
--- a/usr/src/common/ctf/ctf_util.c
+++ b/usr/src/common/ctf/ctf_util.c
@@ -23,10 +23,12 @@
  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
-
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
 
 #include <ctf_impl.h>
+#include <sys/debug.h>
 
 /*
  * Simple doubly-linked list append routine.  This implementation assumes that
@@ -71,6 +73,24 @@ ctf_list_prepend(ctf_list_t *lp, void *new)
 		lp->l_prev = p;
 }
 
+void
+ctf_list_insert_before(ctf_list_t *head, void *item, void *nitem)
+{
+	ctf_list_t *lp = item;
+	ctf_list_t *new = nitem;
+	ctf_list_t *prev = lp->l_prev;
+
+	lp->l_prev = new;
+	new->l_next = lp;
+	new->l_prev = prev;
+	if (prev != NULL) {
+		prev->l_next = new;
+	} else {
+		ASSERT(head->l_next == lp);
+		head->l_next = new;
+	}
+}
+
 /*
  * Delete the specified existing element from the given ctf_list_t.  The
  * existing pointer should be pointing at a struct with embedded ctf_list_t.
@@ -150,3 +170,22 @@ ctf_set_errno(ctf_file_t *fp, int err)
 	fp->ctf_errno = err;
 	return (CTF_ERR);
 }
+
+boolean_t
+ctf_sym_valid(uintptr_t strbase, int type, uint16_t shndx, uint64_t val,
+    uint32_t noff)
+{
+	const char *name;
+
+	if (type != STT_OBJECT && type != STT_FUNC)
+		return (B_FALSE);
+	if (shndx == SHN_UNDEF || noff == 0)
+		return (B_FALSE);
+	if (type == STT_OBJECT && shndx == SHN_ABS && val == 0)
+		return (B_FALSE);
+	name = (char *)(strbase + noff);
+	if (strcmp(name, "_START_") == 0 || strcmp(name, "_END_") == 0)
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
diff --git a/usr/src/common/elfcap/elfcap.c b/usr/src/common/elfcap/elfcap.c
index 7c39f30a2b..cefb986dfb 100644
--- a/usr/src/common/elfcap/elfcap.c
+++ b/usr/src/common/elfcap/elfcap.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /* LINTLIBRARY */
@@ -377,8 +377,8 @@ static const elfcap_desc_t hw2_386[ELFCAP_NUM_HW2_386] = {
 		STRDESC("AVX512VBMI"), STRDESC("avx512vbmi"),
 	},
 	{						/* 0x00020000 */
-		AV_386_2_AVX512VPOPCDQ, STRDESC("AV_386_2_AVX512VPOPCDQ"),
-		STRDESC("AVX512VPOPCDQ"), STRDESC("avx512_vpopcntdq"),
+		AV_386_2_AVX512VPOPCDQ, STRDESC("AV_386_2_AVX512_VPOPCDQ"),
+		STRDESC("AVX512_VPOPCDQ"), STRDESC("avx512_vpopcntdq"),
 	},
 	{						/* 0x00040000 */
 		AV_386_2_AVX512_4NNIW, STRDESC("AV_386_2_AVX512_4NNIW"),
diff --git a/usr/src/uts/common/os/id_space.c b/usr/src/common/idspace/id_space.c
index 2dad0cb940..7d28a8f533 100644
--- a/usr/src/uts/common/os/id_space.c
+++ b/usr/src/common/idspace/id_space.c
@@ -53,6 +53,10 @@
  *   reservation, in which an ID is allocated but placed in a internal
  *   dictionary for later use, should be added when a consuming subsystem
  *   arrives.)
+ *
+ *   This code is also shared with userland. In userland, we don't have the same
+ *   ability to have sleeping variants, so we effectively turn the normal
+ *   versions without _nosleep into _nosleep.
  */
 
 #define	ID_TO_ADDR(id) ((void *)(uintptr_t)(id + 1))
@@ -60,16 +64,22 @@
 
 /*
  * Create an arena to represent the range [low, high).
- * Caller must be in a context in which VM_SLEEP is legal.
+ * Caller must be in a context in which VM_SLEEP is legal,
+ * for the kernel. Always VM_NOSLEEP in userland.
  */
 id_space_t *
 id_space_create(const char *name, id_t low, id_t high)
 {
+#ifdef _KERNEL
+	int flag = VM_SLEEP;
+#else
+	int flag = VM_NOSLEEP;
+#endif
 	ASSERT(low >= 0);
 	ASSERT(low < high);
 
 	return (vmem_create(name, ID_TO_ADDR(low), high - low, 1,
-	    NULL, NULL, NULL, 0, VM_SLEEP | VMC_IDENTIFIER));
+	    NULL, NULL, NULL, 0, flag | VMC_IDENTIFIER));
 }
 
 /*
@@ -85,7 +95,12 @@ id_space_destroy(id_space_t *isp)
 void
 id_space_extend(id_space_t *isp, id_t low, id_t high)
 {
-	(void) vmem_add(isp, ID_TO_ADDR(low), high - low, VM_SLEEP);
+#ifdef _KERNEL
+	int flag = VM_SLEEP;
+#else
+	int flag = VM_NOSLEEP;
+#endif
+	(void) vmem_add(isp, ID_TO_ADDR(low), high - low, flag);
 }
 
 /*
@@ -95,7 +110,12 @@ id_space_extend(id_space_t *isp, id_t low, id_t high)
 id_t
 id_alloc(id_space_t *isp)
 {
-	return (ADDR_TO_ID(vmem_alloc(isp, 1, VM_SLEEP | VM_NEXTFIT)));
+#ifdef _KERNEL
+	int flag = VM_SLEEP;
+#else
+	int flag = VM_NOSLEEP;
+#endif
+	return (ADDR_TO_ID(vmem_alloc(isp, 1, flag | VM_NEXTFIT)));
 }
 
 /*
@@ -116,7 +136,12 @@ id_alloc_nosleep(id_space_t *isp)
 id_t
 id_allocff(id_space_t *isp)
 {
-	return (ADDR_TO_ID(vmem_alloc(isp, 1, VM_SLEEP | VM_FIRSTFIT)));
+#ifdef _KERNEL
+	int flag = VM_SLEEP;
+#else
+	int flag = VM_NOSLEEP;
+#endif
+	return (ADDR_TO_ID(vmem_alloc(isp, 1, flag | VM_FIRSTFIT)));
 }
 
 /*
diff --git a/usr/src/common/inet/inet_hash.c b/usr/src/common/inet/inet_hash.c
new file mode 100644
index 0000000000..3a511fe588
--- /dev/null
+++ b/usr/src/common/inet/inet_hash.c
@@ -0,0 +1,359 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
+ */
+
+/*
+ * Common routines usable by any part of the networking stack for hashing
+ * packets. The hashing logic originally was part of MAC, but it has more
+ * utility being usable by the rest of the broader system.
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+#include <sys/strsubr.h>
+#include <sys/strsun.h>
+#include <sys/vlan.h>
+#include <inet/ip.h>
+#include <inet/ip_impl.h>
+#include <inet/ip6.h>
+#include <sys/dlpi.h>
+#include <sys/sunndi.h>
+#include <inet/ipsec_impl.h>
+#include <inet/sadb.h>
+#include <inet/ipsecesp.h>
+#include <inet/ipsecah.h>
+#include <inet/inet_hash.h>
+
+/*
+ * Determines the IPv6 header length accounting for all the optional IPv6
+ * headers (hop-by-hop, destination, routing and fragment). The header length
+ * and next header value (a transport header) is captured.
+ *
+ * Returns B_FALSE if all the IP headers are not in the same mblk otherwise
+ * returns B_TRUE.
+ */
+static boolean_t
+inet_pkthash_ip_hdr_length_v6(ip6_t *ip6h, uint8_t *endptr,
+    uint16_t *hdr_length,  uint8_t *next_hdr, ip6_frag_t **fragp)
+{
+	uint16_t length;
+	uint_t	ehdrlen;
+	uint8_t *whereptr;
+	uint8_t *nexthdrp;
+	ip6_dest_t *desthdr;
+	ip6_rthdr_t *rthdr;
+	ip6_frag_t *fraghdr;
+
+	if (((uchar_t *)ip6h + IPV6_HDR_LEN) > endptr)
+		return (B_FALSE);
+	ASSERT(IPH_HDR_VERSION(ip6h) == IPV6_VERSION);
+	length = IPV6_HDR_LEN;
+	whereptr = ((uint8_t *)&ip6h[1]); /* point to next hdr */
+
+	if (fragp != NULL)
+		*fragp = NULL;
+
+	nexthdrp = &ip6h->ip6_nxt;
+	while (whereptr < endptr) {
+		/* Is there enough left for len + nexthdr? */
+		if (whereptr + MIN_EHDR_LEN > endptr)
+			break;
+
+		switch (*nexthdrp) {
+		case IPPROTO_HOPOPTS:
+		case IPPROTO_DSTOPTS:
+			/* Assumes the headers are identical for hbh and dst */
+			desthdr = (ip6_dest_t *)whereptr;
+			ehdrlen = 8 * (desthdr->ip6d_len + 1);
+			if ((uchar_t *)desthdr +  ehdrlen > endptr)
+				return (B_FALSE);
+			nexthdrp = &desthdr->ip6d_nxt;
+			break;
+		case IPPROTO_ROUTING:
+			rthdr = (ip6_rthdr_t *)whereptr;
+			ehdrlen =  8 * (rthdr->ip6r_len + 1);
+			if ((uchar_t *)rthdr +  ehdrlen > endptr)
+				return (B_FALSE);
+			nexthdrp = &rthdr->ip6r_nxt;
+			break;
+		case IPPROTO_FRAGMENT:
+			fraghdr = (ip6_frag_t *)whereptr;
+			ehdrlen = sizeof (ip6_frag_t);
+			if ((uchar_t *)&fraghdr[1] > endptr)
+				return (B_FALSE);
+			nexthdrp = &fraghdr->ip6f_nxt;
+			if (fragp != NULL)
+				*fragp = fraghdr;
+			break;
+		case IPPROTO_NONE:
+			/* No next header means we're finished */
+		default:
+			*hdr_length = length;
+			*next_hdr = *nexthdrp;
+			return (B_TRUE);
+		}
+		length += ehdrlen;
+		whereptr += ehdrlen;
+		*hdr_length = length;
+		*next_hdr = *nexthdrp;
+	}
+	switch (*nexthdrp) {
+	case IPPROTO_HOPOPTS:
+	case IPPROTO_DSTOPTS:
+	case IPPROTO_ROUTING:
+	case IPPROTO_FRAGMENT:
+		/*
+		 * If any known extension headers are still to be processed,
+		 * the packet's malformed (or at least all the IP header(s) are
+		 * not in the same mblk - and that should never happen.
+		 */
+		return (B_FALSE);
+
+	default:
+		/*
+		 * If we get here, we know that all of the IP headers were in
+		 * the same mblk, even if the ULP header is in the next mblk.
+		 */
+		*hdr_length = length;
+		*next_hdr = *nexthdrp;
+		return (B_TRUE);
+	}
+}
+
+#define	PKT_HASH_2BYTES(x) ((x)[0] ^ (x)[1])
+#define	PKT_HASH_4BYTES(x) ((x)[0] ^ (x)[1] ^ (x)[2] ^ (x)[3])
+#define	PKT_HASH_MAC(x) ((x)[0] ^ (x)[1] ^ (x)[2] ^ (x)[3] ^ (x)[4] ^ (x)[5])
+uint64_t
+inet_pkt_hash(uint_t media, mblk_t *mp, uint8_t policy)
+{
+	struct ether_header *ehp;
+	uint64_t hash = 0;
+	uint16_t sap;
+	uint_t skip_len;
+	uint8_t proto;
+	boolean_t ip_fragmented;
+
+	/*
+	 * We may want to have one of these per MAC type plugin in the
+	 * future. For now supports only ethernet.
+	 */
+	if (media != DL_ETHER)
+		return (0L);
+
+	/* for now we support only outbound packets */
+	ASSERT(IS_P2ALIGNED(mp->b_rptr, sizeof (uint16_t)));
+	ASSERT(MBLKL(mp) >= sizeof (struct ether_header));
+
+	/* compute L2 hash */
+
+	ehp = (struct ether_header *)mp->b_rptr;
+
+	if ((policy & INET_PKT_HASH_L2) != 0) {
+		uchar_t *mac_src = ehp->ether_shost.ether_addr_octet;
+		uchar_t *mac_dst = ehp->ether_dhost.ether_addr_octet;
+		hash = PKT_HASH_MAC(mac_src) ^ PKT_HASH_MAC(mac_dst);
+		policy &= ~INET_PKT_HASH_L2;
+	}
+
+	if (policy == 0)
+		goto done;
+
+	/* skip ethernet header */
+
+	sap = ntohs(ehp->ether_type);
+	if (sap == ETHERTYPE_VLAN) {
+		struct ether_vlan_header *evhp;
+		mblk_t *newmp = NULL;
+
+		skip_len = sizeof (struct ether_vlan_header);
+		if (MBLKL(mp) < skip_len) {
+			/* the vlan tag is the payload, pull up first */
+			newmp = msgpullup(mp, -1);
+			if ((newmp == NULL) || (MBLKL(newmp) < skip_len)) {
+				goto done;
+			}
+			evhp = (struct ether_vlan_header *)newmp->b_rptr;
+		} else {
+			evhp = (struct ether_vlan_header *)mp->b_rptr;
+		}
+
+		sap = ntohs(evhp->ether_type);
+		freemsg(newmp);
+	} else {
+		skip_len = sizeof (struct ether_header);
+	}
+
+	/* if ethernet header is in its own mblk, skip it */
+	if (MBLKL(mp) <= skip_len) {
+		skip_len -= MBLKL(mp);
+		mp = mp->b_cont;
+		if (mp == NULL)
+			goto done;
+	}
+
+	sap = (sap < ETHERTYPE_802_MIN) ? 0 : sap;
+
+	/* compute IP src/dst addresses hash and skip IPv{4,6} header */
+
+	switch (sap) {
+	case ETHERTYPE_IP: {
+		ipha_t *iphp;
+
+		/*
+		 * If the header is not aligned or the header doesn't fit
+		 * in the mblk, bail now. Note that this may cause packet
+		 * reordering.
+		 */
+		iphp = (ipha_t *)(mp->b_rptr + skip_len);
+		if (((unsigned char *)iphp + sizeof (ipha_t) > mp->b_wptr) ||
+		    !OK_32PTR((char *)iphp))
+			goto done;
+
+		proto = iphp->ipha_protocol;
+		skip_len += IPH_HDR_LENGTH(iphp);
+
+		/* Check if the packet is fragmented. */
+		ip_fragmented = ntohs(iphp->ipha_fragment_offset_and_flags) &
+		    IPH_OFFSET;
+
+		/*
+		 * For fragmented packets, use addresses in addition to
+		 * the frag_id to generate the hash inorder to get
+		 * better distribution.
+		 */
+		if (ip_fragmented || (policy & INET_PKT_HASH_L3) != 0) {
+			uint8_t *ip_src = (uint8_t *)&(iphp->ipha_src);
+			uint8_t *ip_dst = (uint8_t *)&(iphp->ipha_dst);
+
+			hash ^= (PKT_HASH_4BYTES(ip_src) ^
+			    PKT_HASH_4BYTES(ip_dst));
+			policy &= ~INET_PKT_HASH_L3;
+		}
+
+		if (ip_fragmented) {
+			uint8_t *identp = (uint8_t *)&iphp->ipha_ident;
+			hash ^= PKT_HASH_2BYTES(identp);
+			goto done;
+		}
+		break;
+	}
+	case ETHERTYPE_IPV6: {
+		ip6_t *ip6hp;
+		ip6_frag_t *frag = NULL;
+		uint16_t hdr_length;
+
+		/*
+		 * If the header is not aligned or the header doesn't fit
+		 * in the mblk, bail now. Note that this may cause packets
+		 * reordering.
+		 */
+
+		ip6hp = (ip6_t *)(mp->b_rptr + skip_len);
+		if (((unsigned char *)ip6hp + IPV6_HDR_LEN > mp->b_wptr) ||
+		    !OK_32PTR((char *)ip6hp))
+			goto done;
+
+		if (!inet_pkthash_ip_hdr_length_v6(ip6hp, mp->b_wptr,
+		    &hdr_length, &proto, &frag))
+			goto done;
+		skip_len += hdr_length;
+
+		/*
+		 * For fragmented packets, use addresses in addition to
+		 * the frag_id to generate the hash inorder to get
+		 * better distribution.
+		 */
+		if (frag != NULL || (policy & INET_PKT_HASH_L3) != 0) {
+			uint8_t *ip_src = &(ip6hp->ip6_src.s6_addr8[12]);
+			uint8_t *ip_dst = &(ip6hp->ip6_dst.s6_addr8[12]);
+
+			hash ^= (PKT_HASH_4BYTES(ip_src) ^
+			    PKT_HASH_4BYTES(ip_dst));
+			policy &= ~INET_PKT_HASH_L3;
+		}
+
+		if (frag != NULL) {
+			uint8_t *identp = (uint8_t *)&frag->ip6f_ident;
+			hash ^= PKT_HASH_4BYTES(identp);
+			goto done;
+		}
+		break;
+	}
+	default:
+		goto done;
+	}
+
+	if (policy == 0)
+		goto done;
+
+	/* if ip header is in its own mblk, skip it */
+	if (MBLKL(mp) <= skip_len) {
+		skip_len -= MBLKL(mp);
+		mp = mp->b_cont;
+		if (mp == NULL)
+			goto done;
+	}
+
+	/* parse ULP header */
+again:
+	switch (proto) {
+	case IPPROTO_TCP:
+	case IPPROTO_UDP:
+	case IPPROTO_ESP:
+	case IPPROTO_SCTP:
+		/*
+		 * These Internet Protocols are intentionally designed
+		 * for hashing from the git-go.  Port numbers are in the first
+		 * word for transports, SPI is first for ESP.
+		 */
+		if (mp->b_rptr + skip_len + 4 > mp->b_wptr)
+			goto done;
+		hash ^= PKT_HASH_4BYTES((mp->b_rptr + skip_len));
+		break;
+
+	case IPPROTO_AH: {
+		ah_t *ah = (ah_t *)(mp->b_rptr + skip_len);
+		uint_t ah_length = AH_TOTAL_LEN(ah);
+
+		if ((unsigned char *)ah + sizeof (ah_t) > mp->b_wptr)
+			goto done;
+
+		proto = ah->ah_nexthdr;
+		skip_len += ah_length;
+
+		/* if AH header is in its own mblk, skip it */
+		if (MBLKL(mp) <= skip_len) {
+			skip_len -= MBLKL(mp);
+			mp = mp->b_cont;
+			if (mp == NULL)
+				goto done;
+		}
+
+		goto again;
+	}
+	}
+
+done:
+	return (hash);
+}
diff --git a/usr/src/common/net/dhcp/octet.c b/usr/src/common/net/dhcp/octet.c
index d8367bbf0b..370604c4e3 100644
--- a/usr/src/common/net/dhcp/octet.c
+++ b/usr/src/common/net/dhcp/octet.c
@@ -77,6 +77,9 @@ octet_to_hexascii(const void *nump, uint_t nlen, char *bufp, uint_t *blen)
  * Converts an ASCII string into an octet string.
  *
  * Returns 0 for success, errno otherwise.
+ *
+ * If the string contains invalid hexadecimal characters, or an odd number of
+ * characters then this function returns EINVAL.
  */
 int
 hexascii_to_octet(const char *asp, uint_t alen, void *bufp, uint_t *blen)
diff --git a/usr/src/common/zfs/zfs_prop.c b/usr/src/common/zfs/zfs_prop.c
index 31f242288a..80d5ce73b0 100644
--- a/usr/src/common/zfs/zfs_prop.c
+++ b/usr/src/common/zfs/zfs_prop.c
@@ -463,6 +463,23 @@ zfs_prop_delegatable(zfs_prop_t prop)
 	return (pd->pd_attr != PROP_READONLY);
 }
 
+boolean_t
+zfs_prop_cacheable(zfs_prop_t prop)
+{
+	/*
+	 * It'd be nice if each prop had a flags field which could have flag
+	 * like PROP_CACHEABLE, but since zprop_attr_t is an enum and this
+	 * setting is orthogonal to the concepts of PROP_READONLY, etc., we have
+	 * this function.
+	 */
+	return (prop == ZFS_PROP_VERSION ||
+	    prop == ZFS_PROP_NORMALIZE ||
+	    prop == ZFS_PROP_UTF8ONLY ||
+	    prop == ZFS_PROP_CASE ||
+	    prop == ZFS_PROP_VOLSIZE ||
+	    prop == ZFS_PROP_VOLBLOCKSIZE);
+}
+
 /*
  * Given a zfs dataset property name, returns the corresponding property ID.
  */
diff --git a/usr/src/common/zfs/zfs_prop.h b/usr/src/common/zfs/zfs_prop.h
index a63262311b..1796642c68 100644
--- a/usr/src/common/zfs/zfs_prop.h
+++ b/usr/src/common/zfs/zfs_prop.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  */
 
 #ifndef	_ZFS_PROP_H
@@ -86,6 +87,7 @@ typedef struct {
 void zfs_prop_init(void);
 zprop_type_t zfs_prop_get_type(zfs_prop_t);
 boolean_t zfs_prop_delegatable(zfs_prop_t prop);
+boolean_t zfs_prop_cacheable(zfs_prop_t prop);
 zprop_desc_t *zfs_prop_get_table(void);
 
 /*
diff --git a/usr/src/compat/freebsd/amd64/machine/asmacros.h b/usr/src/compat/freebsd/amd64/machine/asmacros.h
new file mode 100644
index 0000000000..1f6955130b
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/asmacros.h
@@ -0,0 +1,31 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_ASMACROS_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_ASMACROS_H_
+
+#define	ENTRY(x) \
+	.text; .p2align 4,0x90; \
+	.globl  x; \
+	.type   x, @function; \
+x:
+
+#define	END(x) \
+	.size x, [.-x]
+
+#define	ALIGN_TEXT \
+	.p2align 4,0x90; /* 16-byte alignment, nop filled */
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_ASMACROS_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/atomic.h b/usr/src/compat/freebsd/amd64/machine/atomic.h
new file mode 100644
index 0000000000..0b5998880e
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/atomic.h
@@ -0,0 +1,208 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_ATOMIC_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_ATOMIC_H_
+
+static __inline u_int
+atomic_load_acq_int(volatile u_int *p)
+{
+	u_int res;
+
+	res = *p;
+	__asm volatile("" : : : "memory");
+
+	return (res);
+}
+
+static __inline u_long
+atomic_load_acq_long(volatile u_long *p)
+{
+	u_long res;
+
+	res = *p;
+	__asm volatile("" : : : "memory");
+
+	return (res);
+}
+
+static __inline void
+atomic_store_rel_int(volatile u_int *p, u_int v)
+{
+	__asm volatile("" : : : "memory");
+	*p = v;
+}
+
+static __inline void
+atomic_store_rel_long(volatile u_long *p, u_long v)
+{
+	__asm volatile("" : : : "memory");
+	*p = v;
+}
+
+/*
+ * Atomic compare and set.
+ *
+ * if (*dst == expect) *dst = src (all 32 bit words)
+ *
+ * Returns 0 on failure, non-zero on success
+ */
+static __inline int
+atomic_cmpset_int(volatile u_int *dst, u_int expect, u_int src)
+{
+	u_char res;
+
+	__asm __volatile(
+	"	lock ;			"
+	"	cmpxchgl %3,%1 ;	"
+	"       sete	%0 ;		"
+	"# atomic_cmpset_int"
+	: "=q" (res),			/* 0 */
+	  "+m" (*dst),			/* 1 */
+	  "+a" (expect)			/* 2 */
+	: "r" (src)			/* 3 */
+	: "memory", "cc");
+	return (res);
+}
+
+static __inline int
+atomic_cmpset_long(volatile u_long *dst, u_long expect, u_long src)
+{
+	u_char res;
+
+	__asm __volatile(
+	"	lock ;			"
+	"	cmpxchgq %3,%1 ;	"
+	"       sete	%0 ;		"
+	"# atomic_cmpset_long"
+	: "=q" (res),			/* 0 */
+	  "+m" (*dst),			/* 1 */
+	  "+a" (expect)			/* 2 */
+	: "r" (src)			/* 3 */
+	: "memory", "cc");
+	return (res);
+}
+
+/*
+ * Atomically add the value of v to the integer pointed to by p and return
+ * the previous value of *p.
+ */
+static __inline u_int
+atomic_fetchadd_int(volatile u_int *p, u_int v)
+{
+
+	__asm __volatile(
+	"	lock ;			"
+	"	xaddl	%0, %1 ;	"
+	"# atomic_fetchadd_int"
+	: "+r" (v),			/* 0 (result) */
+	  "=m" (*p)			/* 1 */
+	: "m" (*p)			/* 2 */
+	: "cc");
+	return (v);
+}
+
+static __inline void
+atomic_set_int(volatile u_int *p, u_int v)
+{
+	__asm volatile(
+	"lock ; " "orl %1,%0"
+	: "=m" (*p)
+	: "ir" (v), "m" (*p)
+	: "cc");
+}
+
+static __inline void
+atomic_clear_int(volatile u_int *p, u_int v)
+{
+	__asm volatile(
+	"lock ; " "andl %1,%0"
+	: "=m" (*p)
+	: "ir" (~v), "m" (*p)
+	: "cc");
+}
+
+static __inline void
+atomic_subtract_int(volatile u_int *p, u_int v)
+{
+	__asm volatile(
+	"lock ; " "subl %1,%0"
+	: "=m" (*p)
+	: "ir" (v), "m" (*p)
+	: "cc");
+}
+
+static __inline void
+atomic_set_long(volatile u_long *p, u_long v)
+{
+	__asm volatile(
+	"lock ; " "orq %1,%0"
+	: "+m" (*p)
+	: "ir" (v)
+	: "cc");
+}
+
+static __inline void
+atomic_clear_long(volatile u_long *p, u_long v)
+{
+	__asm volatile("lock ; " "andq %1,%0"
+	: "+m" (*p)
+	: "ir" (~v)
+	: "cc");
+}
+
+static __inline u_int
+atomic_swap_int(volatile u_int *p, u_int v)
+{
+
+	__asm __volatile(
+	"	xchgl	%1,%0 ;		"
+	"# atomic_swap_int"
+	: "+r" (v),			/* 0 */
+	  "+m" (*p));			/* 1 */
+	return (v);
+}
+
+static __inline u_long
+atomic_swap_long(volatile u_long *p, u_long v)
+{
+
+	__asm __volatile(
+	"	xchgq	%1,%0 ;		"
+	"# atomic_swap_long"
+	: "+r" (v),			/* 0 */
+	  "+m" (*p));			/* 1 */
+	return (v);
+}
+
+#define	atomic_readandclear_int(p)	atomic_swap_int(p, 0)
+#define	atomic_readandclear_long(p)	atomic_swap_long(p, 0)
+
+/* Operations on 32-bit double words. */
+#define	atomic_load_acq_32	atomic_load_acq_int
+#define	atomic_store_rel_32	atomic_store_rel_int
+#define	atomic_cmpset_32	atomic_cmpset_int
+
+/* Operations on 64-bit quad words. */
+#define	atomic_cmpset_64	atomic_cmpset_long
+#define	atomic_readandclear_64	atomic_readandclear_long
+
+/* Operations on pointers. */
+#define	atomic_cmpset_ptr	atomic_cmpset_long
+
+#define      mb()    __asm __volatile("mfence;" : : : "memory")
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_ATOMIC_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/clock.h b/usr/src/compat/freebsd/amd64/machine/clock.h
new file mode 100644
index 0000000000..f50b42a126
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/clock.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_CLOCK_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_CLOCK_H_
+
+extern uint64_t cpu_freq_hz;
+
+#define	tsc_freq	cpu_freq_hz
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_CLOCK_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/cpu.h b/usr/src/compat/freebsd/amd64/machine/cpu.h
new file mode 100644
index 0000000000..40253af108
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/cpu.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_CPU_H
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_CPU_H
+
+#include <sys/cpu.h>
+
+#define	cpu_spinwait()	SMT_PAUSE()
+
+#endif /* _COMPAT_FREEBSD_AMD64_MACHINE_CPU_H */
diff --git a/usr/src/compat/freebsd/amd64/machine/cpufunc.h b/usr/src/compat/freebsd/amd64/machine/cpufunc.h
new file mode 100644
index 0000000000..005a76b305
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/cpufunc.h
@@ -0,0 +1,292 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_CPUFUNC_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_CPUFUNC_H_
+
+#include <sys/types.h>
+
+static __inline u_long
+bsfq(u_long mask)
+{
+	u_long	result;
+
+	__asm __volatile("bsfq %1,%0" : "=r" (result) : "rm" (mask));
+	return (result);
+}
+
+static __inline u_int
+bsrl(u_int mask)
+{
+	u_int	result;
+
+	__asm __volatile("bsrl %1,%0" : "=r" (result) : "rm" (mask));
+	return (result);
+}
+
+static __inline u_long
+bsrq(u_long mask)
+{
+	u_long	result;
+
+	__asm __volatile("bsrq %1,%0" : "=r" (result) : "rm" (mask));
+	return (result);
+}
+
+static __inline void
+clts(void)
+{
+	__asm __volatile("clts");
+}
+
+static __inline void
+do_cpuid(u_int ax, u_int *p)
+{
+	__asm __volatile("cpuid"
+			 : "=a" (p[0]), "=b" (p[1]), "=c" (p[2]), "=d" (p[3])
+			 :  "0" (ax));
+}
+
+static __inline void
+cpuid_count(u_int ax, u_int cx, u_int *p)
+{
+	__asm __volatile("cpuid"
+			 : "=a" (p[0]), "=b" (p[1]), "=c" (p[2]), "=d" (p[3])
+			 :  "0" (ax), "c" (cx));
+}
+
+static __inline void
+disable_intr(void)
+{
+	__asm __volatile("cli");
+}
+
+static __inline void
+enable_intr(void)
+{
+	__asm __volatile("sti");
+}
+
+static __inline int
+ffsl(long mask)
+{
+	return (mask == 0 ? mask : (int)bsfq((u_long)mask) + 1);
+}
+
+static __inline int
+fls(int mask)
+{
+	return (mask == 0 ? mask : (int)bsrl((u_int)mask) + 1);
+}
+
+static __inline int
+flsl(long mask)
+{
+	return (mask == 0 ? mask : (int)bsrq((u_long)mask) + 1);
+}
+
+static __inline int
+flsll(long long mask)
+{
+	return (flsl((long)mask));
+}
+
+static __inline u_long
+read_rflags(void)
+{
+	u_long  rf;
+
+	__asm __volatile("pushfq; popq %0" : "=r" (rf));
+	return (rf);
+}
+
+static __inline uint64_t
+rdmsr(u_int msr)
+{
+	uint32_t low, high;
+ 
+	__asm __volatile("rdmsr" : "=a" (low), "=d" (high) : "c" (msr));
+	return (low | ((uint64_t)high << 32));
+}
+
+static __inline uint64_t
+rdtsc(void)
+{
+	extern hrtime_t tsc_gethrtimeunscaled_delta(void);
+
+	/* Get the TSC reading with any needed synch offset applied */
+	return ((uint64_t)tsc_gethrtimeunscaled_delta());
+}
+
+static __inline void
+wrmsr(u_int msr, uint64_t newval)
+{
+	uint32_t low, high;
+
+	low = newval;
+	high = newval >> 32;
+	__asm __volatile("wrmsr" : : "a" (low), "d" (high), "c" (msr));
+}
+
+static __inline void
+load_cr0(u_long data)
+{
+	__asm __volatile("movq %0,%%cr0" : : "r" (data));
+}
+
+static __inline u_long
+rcr0(void)
+{
+	u_long  data;
+ 
+	__asm __volatile("movq %%cr0,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline u_long
+rcr3(void)
+{
+	u_long  data;
+
+	__asm __volatile("movq %%cr3,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline void
+load_cr4(u_long data)
+{
+	__asm __volatile("movq %0,%%cr4" : : "r" (data));
+}
+
+static __inline u_long
+rcr4(void)
+{
+	u_long  data;
+ 
+	__asm __volatile("movq %%cr4,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline u_long
+rxcr(u_int reg)
+{
+	u_int low, high;
+
+	__asm __volatile("xgetbv" : "=a" (low), "=d" (high) : "c" (reg));
+	return (low | ((uint64_t)high << 32));
+}
+
+static __inline void
+load_xcr(u_int reg, u_long val)
+{
+	u_int low, high;
+
+	low = val;
+	high = val >> 32;
+	__asm __volatile("xsetbv" : : "c" (reg), "a" (low), "d" (high));
+}
+
+static __inline void
+write_rflags(u_long rf)
+{
+	__asm __volatile("pushq %0;  popfq" : : "r" (rf));
+}
+
+static __inline uint64_t
+rdr0(void)
+{
+	uint64_t data;
+	__asm __volatile("movq %%dr0,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline void
+load_dr0(uint64_t dr0)
+{
+	__asm __volatile("movq %0,%%dr0" : : "r" (dr0));
+}
+
+static __inline uint64_t
+rdr1(void)
+{
+	uint64_t data;
+	__asm __volatile("movq %%dr1,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline void
+load_dr1(uint64_t dr1)
+{
+	__asm __volatile("movq %0,%%dr1" : : "r" (dr1));
+}
+
+static __inline uint64_t
+rdr2(void)
+{
+	uint64_t data;
+	__asm __volatile("movq %%dr2,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline void
+load_dr2(uint64_t dr2)
+{
+	__asm __volatile("movq %0,%%dr2" : : "r" (dr2));
+}
+
+static __inline uint64_t
+rdr3(void)
+{
+	uint64_t data;
+	__asm __volatile("movq %%dr3,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline void
+load_dr3(uint64_t dr3)
+{
+	__asm __volatile("movq %0,%%dr3" : : "r" (dr3));
+}
+
+static __inline uint64_t
+rdr6(void)
+{
+	uint64_t data;
+	__asm __volatile("movq %%dr6,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline void
+load_dr6(uint64_t dr6)
+{
+	__asm __volatile("movq %0,%%dr6" : : "r" (dr6));
+}
+
+static __inline uint64_t
+rdr7(void)
+{
+	uint64_t data;
+	__asm __volatile("movq %%dr7,%0" : "=r" (data));
+	return (data);
+}
+
+static __inline void
+load_dr7(uint64_t dr7)
+{
+	__asm __volatile("movq %0,%%dr7" : : "r" (dr7));
+}
+
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_CPUFUNC_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/fpu.h b/usr/src/compat/freebsd/amd64/machine/fpu.h
new file mode 100644
index 0000000000..6bc651d996
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/fpu.h
@@ -0,0 +1,28 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_FPU_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_FPU_H_
+
+void	fpuexit(kthread_t *td);
+void	fpurestore(void *);
+void	fpusave(void *);
+
+struct savefpu	*fpu_save_area_alloc(void);
+void	fpu_save_area_free(struct savefpu *fsa);
+void	fpu_save_area_reset(struct savefpu *fsa);
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_FPU_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/iodev.h b/usr/src/compat/freebsd/amd64/machine/iodev.h
new file mode 100644
index 0000000000..c7cdddc817
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/iodev.h
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_IODEV_H
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_IODEV_H
+
+#endif /* _COMPAT_FREEBSD_AMD64_MACHINE_IODEV_H */
diff --git a/usr/src/compat/freebsd/amd64/machine/md_var.h b/usr/src/compat/freebsd/amd64/machine/md_var.h
new file mode 100644
index 0000000000..ed57a8bebc
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/md_var.h
@@ -0,0 +1,28 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_MD_VAR_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_MD_VAR_H_
+
+extern  u_int   cpu_high;		/* Highest arg to CPUID */
+extern	u_int	cpu_exthigh;		/* Highest arg to extended CPUID */
+extern	u_int	cpu_id;			/* Stepping ID */
+extern	char	cpu_vendor[];		/* CPU Origin code */
+
+#include <sys/systm.h>
+
+#define	Maxmem	(physmax + 1)
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_MD_VAR_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/param.h b/usr/src/compat/freebsd/amd64/machine/param.h
new file mode 100644
index 0000000000..eaca5ab8d7
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/param.h
@@ -0,0 +1,39 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_PARAM_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_PARAM_H_
+
+#ifdef	_KERNEL
+#define	MAXCPU		NCPU
+#endif	/* _KERNEL */
+
+#define	PAGE_SHIFT	12		/* LOG2(PAGE_SIZE) */
+#define	PAGE_SIZE	(1<<PAGE_SHIFT)	/* bytes/page */
+#define	PAGE_MASK	(PAGE_SIZE-1)
+
+/* Size of the level 1 page table units */
+#define	NPTEPG		(PAGE_SIZE/(sizeof (pt_entry_t)))
+
+/* Size of the level 2 page directory units */
+#define	NPDEPG		(PAGE_SIZE/(sizeof (pd_entry_t)))
+
+/* Size of the level 3 page directory pointer table units */
+#define	NPDPEPG		(PAGE_SIZE/(sizeof (pdp_entry_t)))
+
+/* Size of the level 4 page-map level-4 table units */
+#define	NPML4EPG	(PAGE_SIZE/(sizeof (pml4_entry_t)))
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_PARAM_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/pcb.h b/usr/src/compat/freebsd/amd64/machine/pcb.h
new file mode 100644
index 0000000000..75b5de640c
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/pcb.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_PCB_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_PCB_H_
+
+#include <machine/fpu.h>
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_PCB_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/pmap.h b/usr/src/compat/freebsd/amd64/machine/pmap.h
new file mode 100644
index 0000000000..ce3185629b
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/pmap.h
@@ -0,0 +1,489 @@
+/*
+ * All rights reserved. This copyright notice is Copyright Management
+ * Information under 17 USC 1202 and is included to protect this work and
+ * deter copyright infringement.  Removal or alteration of this Copyright
+ * Management Information without the express written permission from
+ * Pluribus Networks Inc is prohibited, and any such unauthorized removal
+ * or alteration will be a violation of federal law.
+ *
+ * Copyright (c) 2003 Peter Wemm.
+ * Copyright (c) 1991 Regents of the University of California.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to Berkeley by
+ * the Systems Programming Group of the University of Utah Computer
+ * Science Department and William Jolitz of UUNET Technologies Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * Derived from hp300 version by Mike Hibler, this version by William
+ * Jolitz uses a recursive map [a pde points to the page directory] to
+ * map the page tables using the pagetables themselves. This is done to
+ * reduce the impact on kernel virtual memory for lots of sparse address
+ * space, and to reduce the cost of memory to each process.
+ *
+ *	from: hp300: @(#)pmap.h	7.2 (Berkeley) 12/16/90
+ *	from: @(#)pmap.h	7.4 (Berkeley) 5/12/91
+ * $FreeBSD$
+ */
+
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_PMAP_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_PMAP_H_
+
+/*
+ * Page-directory and page-table entries follow this format, with a few
+ * of the fields not present here and there, depending on a lot of things.
+ */
+				/* ---- Intel Nomenclature ---- */
+#define	X86_PG_V	0x001	/* P	Valid			*/
+#define	X86_PG_RW	0x002	/* R/W	Read/Write		*/
+#define	X86_PG_U	0x004	/* U/S  User/Supervisor		*/
+#define	X86_PG_NC_PWT	0x008	/* PWT	Write through		*/
+#define	X86_PG_NC_PCD	0x010	/* PCD	Cache disable		*/
+#define	X86_PG_A	0x020	/* A	Accessed		*/
+#define	X86_PG_M	0x040	/* D	Dirty			*/
+#define	X86_PG_PS	0x080	/* PS	Page size (0=4k,1=2M)	*/
+#define	X86_PG_PTE_PAT	0x080	/* PAT	PAT index		*/
+#define	X86_PG_G	0x100	/* G	Global			*/
+#define	X86_PG_AVAIL1	0x200	/*    /	Available for system	*/
+#define	X86_PG_AVAIL2	0x400	/*   <	programmers use		*/
+#define	X86_PG_AVAIL3	0x800	/*    \				*/
+#define	X86_PG_PDE_PAT	0x1000	/* PAT	PAT index		*/
+#define	X86_PG_NX	(1ul<<63) /* No-execute */
+#define	X86_PG_AVAIL(x)	(1ul << (x))
+
+/* Page level cache control fields used to determine the PAT type */
+#define	X86_PG_PDE_CACHE (X86_PG_PDE_PAT | X86_PG_NC_PWT | X86_PG_NC_PCD)
+#define	X86_PG_PTE_CACHE (X86_PG_PTE_PAT | X86_PG_NC_PWT | X86_PG_NC_PCD)
+
+/*
+ * Intel extended page table (EPT) bit definitions.
+ */
+#define	EPT_PG_READ		0x001	/* R	Read		*/
+#define	EPT_PG_WRITE		0x002	/* W	Write		*/
+#define	EPT_PG_EXECUTE		0x004	/* X	Execute		*/
+#define	EPT_PG_IGNORE_PAT	0x040	/* IPAT	Ignore PAT	*/
+#define	EPT_PG_PS		0x080	/* PS	Page size	*/
+#define	EPT_PG_A		0x100	/* A	Accessed	*/
+#define	EPT_PG_M		0x200	/* D	Dirty		*/
+#define	EPT_PG_MEMORY_TYPE(x)	((x) << 3) /* MT Memory Type	*/
+
+/*
+ * Define the PG_xx macros in terms of the bits on x86 PTEs.
+ */
+#define	PG_V		X86_PG_V
+#define	PG_RW		X86_PG_RW
+#define	PG_U		X86_PG_U
+#define	PG_NC_PWT	X86_PG_NC_PWT
+#define	PG_NC_PCD	X86_PG_NC_PCD
+#define	PG_A		X86_PG_A
+#define	PG_M		X86_PG_M
+#define	PG_PS		X86_PG_PS
+#define	PG_PTE_PAT	X86_PG_PTE_PAT
+#define	PG_G		X86_PG_G
+#define	PG_AVAIL1	X86_PG_AVAIL1
+#define	PG_AVAIL2	X86_PG_AVAIL2
+#define	PG_AVAIL3	X86_PG_AVAIL3
+#define	PG_PDE_PAT	X86_PG_PDE_PAT
+#define	PG_NX		X86_PG_NX
+#define	PG_PDE_CACHE	X86_PG_PDE_CACHE
+#define	PG_PTE_CACHE	X86_PG_PTE_CACHE
+
+/* Our various interpretations of the above */
+#define	PG_W		X86_PG_AVAIL3	/* "Wired" pseudoflag */
+#define	PG_MANAGED	X86_PG_AVAIL2
+#define	EPT_PG_EMUL_V	X86_PG_AVAIL(52)
+#define	EPT_PG_EMUL_RW	X86_PG_AVAIL(53)
+#define	PG_PROMOTED	X86_PG_AVAIL(54)	/* PDE only */
+#define	PG_FRAME	(0x000ffffffffff000ul)
+#define	PG_PS_FRAME	(0x000fffffffe00000ul)
+
+/*
+ * Promotion to a 2MB (PDE) page mapping requires that the corresponding 4KB
+ * (PTE) page mappings have identical settings for the following fields:
+ */
+#define	PG_PTE_PROMOTE	(PG_NX | PG_MANAGED | PG_W | PG_G | PG_PTE_CACHE | \
+	    PG_M | PG_A | PG_U | PG_RW | PG_V)
+
+/*
+ * Page Protection Exception bits
+ */
+
+#define PGEX_P		0x01	/* Protection violation vs. not present */
+#define PGEX_W		0x02	/* during a Write cycle */
+#define PGEX_U		0x04	/* access from User mode (UPL) */
+#define PGEX_RSV	0x08	/* reserved PTE field is non-zero */
+#define PGEX_I		0x10	/* during an instruction fetch */
+
+/* 
+ * undef the PG_xx macros that define bits in the regular x86 PTEs that
+ * have a different position in nested PTEs. This is done when compiling
+ * code that needs to be aware of the differences between regular x86 and
+ * nested PTEs.
+ *
+ * The appropriate bitmask will be calculated at runtime based on the pmap
+ * type.
+ */
+#ifdef AMD64_NPT_AWARE
+#undef PG_AVAIL1		/* X86_PG_AVAIL1 aliases with EPT_PG_M */
+#undef PG_G
+#undef PG_A
+#undef PG_M
+#undef PG_PDE_PAT
+#undef PG_PDE_CACHE
+#undef PG_PTE_PAT
+#undef PG_PTE_CACHE
+#undef PG_RW
+#undef PG_V
+#endif
+
+/*
+ * Pte related macros.  This is complicated by having to deal with
+ * the sign extension of the 48th bit.
+ */
+#define KVADDR(l4, l3, l2, l1) ( \
+	((unsigned long)-1 << 47) | \
+	((unsigned long)(l4) << PML4SHIFT) | \
+	((unsigned long)(l3) << PDPSHIFT) | \
+	((unsigned long)(l2) << PDRSHIFT) | \
+	((unsigned long)(l1) << PAGE_SHIFT))
+
+#define UVADDR(l4, l3, l2, l1) ( \
+	((unsigned long)(l4) << PML4SHIFT) | \
+	((unsigned long)(l3) << PDPSHIFT) | \
+	((unsigned long)(l2) << PDRSHIFT) | \
+	((unsigned long)(l1) << PAGE_SHIFT))
+
+/*
+ * Number of kernel PML4 slots.  Can be anywhere from 1 to 64 or so,
+ * but setting it larger than NDMPML4E makes no sense.
+ *
+ * Each slot provides .5 TB of kernel virtual space.
+ */
+#define NKPML4E		4
+
+#define	NUPML4E		(NPML4EPG/2)	/* number of userland PML4 pages */
+#define	NUPDPE		(NUPML4E*NPDPEPG)/* number of userland PDP pages */
+#define	NUPDE		(NUPDPE*NPDEPG)	/* number of userland PD entries */
+
+/*
+ * NDMPML4E is the maximum number of PML4 entries that will be
+ * used to implement the direct map.  It must be a power of two,
+ * and should generally exceed NKPML4E.  The maximum possible
+ * value is 64; using 128 will make the direct map intrude into
+ * the recursive page table map.
+ */
+#define	NDMPML4E	8
+
+/*
+ * These values control the layout of virtual memory.  The starting address
+ * of the direct map, which is controlled by DMPML4I, must be a multiple of
+ * its size.  (See the PHYS_TO_DMAP() and DMAP_TO_PHYS() macros.)
+ *
+ * Note: KPML4I is the index of the (single) level 4 page that maps
+ * the KVA that holds KERNBASE, while KPML4BASE is the index of the
+ * first level 4 page that maps VM_MIN_KERNEL_ADDRESS.  If NKPML4E
+ * is 1, these are the same, otherwise KPML4BASE < KPML4I and extra
+ * level 4 PDEs are needed to map from VM_MIN_KERNEL_ADDRESS up to
+ * KERNBASE.
+ *
+ * (KPML4I combines with KPDPI to choose where KERNBASE starts.
+ * Or, in other words, KPML4I provides bits 39..47 of KERNBASE,
+ * and KPDPI provides bits 30..38.)
+ */
+#define	PML4PML4I	(NPML4EPG/2)	/* Index of recursive pml4 mapping */
+
+#define	KPML4BASE	(NPML4EPG-NKPML4E) /* KVM at highest addresses */
+#define	DMPML4I		rounddown(KPML4BASE-NDMPML4E, NDMPML4E) /* Below KVM */
+
+#define	KPML4I		(NPML4EPG-1)
+#define	KPDPI		(NPDPEPG-2)	/* kernbase at -2GB */
+
+/*
+ * XXX doesn't really belong here I guess...
+ */
+#define ISA_HOLE_START    0xa0000
+#define ISA_HOLE_LENGTH (0x100000-ISA_HOLE_START)
+
+#define	PMAP_PCID_NONE		0xffffffff
+#define	PMAP_PCID_KERN		0
+#define	PMAP_PCID_OVERMAX	0x1000
+
+#ifndef LOCORE
+
+#ifdef __FreeBSD__
+#include <sys/queue.h>
+#include <sys/_cpuset.h>
+#include <sys/_lock.h>
+#include <sys/_mutex.h>
+
+#include <vm/_vm_radix.h>
+#endif /* __FreeBSD__ */
+
+typedef u_int64_t pd_entry_t;
+typedef u_int64_t pt_entry_t;
+typedef u_int64_t pdp_entry_t;
+typedef u_int64_t pml4_entry_t;
+
+/*
+ * Address of current address space page table maps and directories.
+ */
+#ifdef _KERNEL
+#define	addr_PTmap	(KVADDR(PML4PML4I, 0, 0, 0))
+#define	addr_PDmap	(KVADDR(PML4PML4I, PML4PML4I, 0, 0))
+#define	addr_PDPmap	(KVADDR(PML4PML4I, PML4PML4I, PML4PML4I, 0))
+#define	addr_PML4map	(KVADDR(PML4PML4I, PML4PML4I, PML4PML4I, PML4PML4I))
+#define	addr_PML4pml4e	(addr_PML4map + (PML4PML4I * sizeof(pml4_entry_t)))
+#define	PTmap		((pt_entry_t *)(addr_PTmap))
+#define	PDmap		((pd_entry_t *)(addr_PDmap))
+#define	PDPmap		((pd_entry_t *)(addr_PDPmap))
+#define	PML4map		((pd_entry_t *)(addr_PML4map))
+#define	PML4pml4e	((pd_entry_t *)(addr_PML4pml4e))
+
+extern int nkpt;		/* Initial number of kernel page tables */
+extern u_int64_t KPDPphys;	/* physical address of kernel level 3 */
+extern u_int64_t KPML4phys;	/* physical address of kernel level 4 */
+
+/*
+ * virtual address to page table entry and
+ * to physical address.
+ * Note: these work recursively, thus vtopte of a pte will give
+ * the corresponding pde that in turn maps it.
+ */
+pt_entry_t *vtopte(vm_offset_t);
+#define	vtophys(va)	pmap_kextract(((vm_offset_t) (va)))
+#ifndef __FreeBSD__
+extern vm_paddr_t pmap_kextract(vm_offset_t);
+#endif
+
+#define	pte_load_store(ptep, pte)	atomic_swap_long(ptep, pte)
+#define	pte_load_clear(ptep)		atomic_swap_long(ptep, 0)
+#define	pte_store(ptep, pte) do { \
+	*(u_long *)(ptep) = (u_long)(pte); \
+} while (0)
+#define	pte_clear(ptep)			pte_store(ptep, 0)
+
+#define	pde_store(pdep, pde)		pte_store(pdep, pde)
+
+extern pt_entry_t pg_nx;
+
+#endif /* _KERNEL */
+
+#ifdef __FreeBSD__
+/*
+ * Pmap stuff
+ */
+struct	pv_entry;
+struct	pv_chunk;
+
+/*
+ * Locks
+ * (p) PV list lock
+ */
+struct md_page {
+	TAILQ_HEAD(, pv_entry)	pv_list;  /* (p) */
+	int			pv_gen;   /* (p) */
+	int			pat_mode;
+};
+#endif /* __FreeBSD__ */
+
+enum pmap_type {
+	PT_X86,			/* regular x86 page tables */
+	PT_EPT,			/* Intel's nested page tables */
+	PT_RVI,			/* AMD's nested page tables */
+};
+
+#ifdef __FreeBSD__
+struct pmap_pcids {
+	uint32_t	pm_pcid;
+	uint32_t	pm_gen;
+};
+
+/*
+ * The kernel virtual address (KVA) of the level 4 page table page is always
+ * within the direct map (DMAP) region.
+ */
+struct pmap {
+	struct mtx		pm_mtx;
+	pml4_entry_t		*pm_pml4;	/* KVA of level 4 page table */
+	uint64_t		pm_cr3;
+	TAILQ_HEAD(,pv_chunk)	pm_pvchunk;	/* list of mappings in pmap */
+	cpuset_t		pm_active;	/* active on cpus */
+	enum pmap_type		pm_type;	/* regular or nested tables */
+	struct pmap_statistics	pm_stats;	/* pmap statistics */
+	struct vm_radix		pm_root;	/* spare page table pages */
+	long			pm_eptgen;	/* EPT pmap generation id */
+	int			pm_flags;
+	struct pmap_pcids	pm_pcids[MAXCPU];
+};
+#endif /* __FreeBSD__ */
+
+/* flags */
+#define	PMAP_NESTED_IPIMASK	0xff
+#define	PMAP_PDE_SUPERPAGE	(1 << 8)	/* supports 2MB superpages */
+#define	PMAP_EMULATE_AD_BITS	(1 << 9)	/* needs A/D bits emulation */
+#define	PMAP_SUPPORTS_EXEC_ONLY	(1 << 10)	/* execute only mappings ok */
+
+typedef struct pmap	*pmap_t;
+
+#ifdef _KERNEL
+extern struct pmap	kernel_pmap_store;
+#define kernel_pmap	(&kernel_pmap_store)
+
+#define	PMAP_LOCK(pmap)		mtx_lock(&(pmap)->pm_mtx)
+#define	PMAP_LOCK_ASSERT(pmap, type) \
+				mtx_assert(&(pmap)->pm_mtx, (type))
+#define	PMAP_LOCK_DESTROY(pmap)	mtx_destroy(&(pmap)->pm_mtx)
+#define	PMAP_LOCK_INIT(pmap)	mtx_init(&(pmap)->pm_mtx, "pmap", \
+				    NULL, MTX_DEF | MTX_DUPOK)
+#define	PMAP_LOCKED(pmap)	mtx_owned(&(pmap)->pm_mtx)
+#define	PMAP_MTX(pmap)		(&(pmap)->pm_mtx)
+#define	PMAP_TRYLOCK(pmap)	mtx_trylock(&(pmap)->pm_mtx)
+#define	PMAP_UNLOCK(pmap)	mtx_unlock(&(pmap)->pm_mtx)
+
+int	pmap_pinit_type(pmap_t pmap, enum pmap_type pm_type, int flags);
+int	pmap_emulate_accessed_dirty(pmap_t pmap, vm_offset_t va, int ftype);
+#endif
+
+#ifdef	__FreeBSD__
+/*
+ * For each vm_page_t, there is a list of all currently valid virtual
+ * mappings of that page.  An entry is a pv_entry_t, the list is pv_list.
+ */
+typedef struct pv_entry {
+	vm_offset_t	pv_va;		/* virtual address for mapping */
+	TAILQ_ENTRY(pv_entry)	pv_next;
+} *pv_entry_t;
+
+/*
+ * pv_entries are allocated in chunks per-process.  This avoids the
+ * need to track per-pmap assignments.
+ */
+#define	_NPCM	3
+#define	_NPCPV	168
+struct pv_chunk {
+	pmap_t			pc_pmap;
+	TAILQ_ENTRY(pv_chunk)	pc_list;
+	uint64_t		pc_map[_NPCM];	/* bitmap; 1 = free */
+	TAILQ_ENTRY(pv_chunk)	pc_lru;
+	struct pv_entry		pc_pventry[_NPCPV];
+};
+
+#ifdef	_KERNEL
+
+extern caddr_t	CADDR1;
+extern pt_entry_t *CMAP1;
+extern vm_paddr_t phys_avail[];
+extern vm_paddr_t dump_avail[];
+extern vm_offset_t virtual_avail;
+extern vm_offset_t virtual_end;
+extern vm_paddr_t dmaplimit;
+extern int pmap_pcid_enabled;
+extern int invpcid_works;
+
+#define	pmap_page_get_memattr(m)	((vm_memattr_t)(m)->md.pat_mode)
+#define	pmap_page_is_write_mapped(m)	(((m)->aflags & PGA_WRITEABLE) != 0)
+#define	pmap_unmapbios(va, sz)	pmap_unmapdev((va), (sz))
+
+struct thread;
+
+void	pmap_activate_sw(struct thread *);
+void	pmap_bootstrap(vm_paddr_t *);
+int	pmap_cache_bits(pmap_t pmap, int mode, boolean_t is_pde);
+int	pmap_change_attr(vm_offset_t, vm_size_t, int);
+void	pmap_demote_DMAP(vm_paddr_t base, vm_size_t len, boolean_t invalidate);
+void	pmap_init_pat(void);
+void	pmap_kenter(vm_offset_t va, vm_paddr_t pa);
+void	*pmap_kenter_temporary(vm_paddr_t pa, int i);
+vm_paddr_t pmap_kextract(vm_offset_t);
+void	pmap_kremove(vm_offset_t);
+void	*pmap_mapbios(vm_paddr_t, vm_size_t);
+void	*pmap_mapdev(vm_paddr_t, vm_size_t);
+void	*pmap_mapdev_attr(vm_paddr_t, vm_size_t, int);
+boolean_t pmap_page_is_mapped(vm_page_t m);
+void	pmap_page_set_memattr(vm_page_t m, vm_memattr_t ma);
+void	pmap_pinit_pml4(vm_page_t);
+void	pmap_unmapdev(vm_offset_t, vm_size_t);
+void	pmap_invalidate_page(pmap_t, vm_offset_t);
+void	pmap_invalidate_range(pmap_t, vm_offset_t, vm_offset_t);
+void	pmap_invalidate_all(pmap_t);
+void	pmap_invalidate_cache(void);
+void	pmap_invalidate_cache_pages(vm_page_t *pages, int count);
+void	pmap_invalidate_cache_range(vm_offset_t sva, vm_offset_t eva,
+	    boolean_t force);
+void	pmap_get_mapping(pmap_t pmap, vm_offset_t va, uint64_t *ptr, int *num);
+boolean_t pmap_map_io_transient(vm_page_t *, vm_offset_t *, int, boolean_t);
+void	pmap_unmap_io_transient(vm_page_t *, vm_offset_t *, int, boolean_t);
+#endif /* _KERNEL */
+
+/* Return various clipped indexes for a given VA */
+static __inline vm_pindex_t
+pmap_pte_index(vm_offset_t va)
+{
+
+	return ((va >> PAGE_SHIFT) & ((1ul << NPTEPGSHIFT) - 1));
+}
+
+static __inline vm_pindex_t
+pmap_pde_index(vm_offset_t va)
+{
+
+	return ((va >> PDRSHIFT) & ((1ul << NPDEPGSHIFT) - 1));
+}
+
+static __inline vm_pindex_t
+pmap_pdpe_index(vm_offset_t va)
+{
+
+	return ((va >> PDPSHIFT) & ((1ul << NPDPEPGSHIFT) - 1));
+}
+
+static __inline vm_pindex_t
+pmap_pml4e_index(vm_offset_t va)
+{
+
+	return ((va >> PML4SHIFT) & ((1ul << NPML4EPGSHIFT) - 1));
+}
+
+#endif /* __FreeBSD__ */
+#endif /* !LOCORE */
+
+#endif /* !_COMPAT_FREEBSD_AMD64_MACHINE_PMAP_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/segments.h b/usr/src/compat/freebsd/amd64/machine/segments.h
new file mode 100644
index 0000000000..d0655f4a0e
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/segments.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_SEGMENTS_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_SEGMENTS_H_
+
+#include <x86/segments.h>
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_SEGMENTS_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/smp.h b/usr/src/compat/freebsd/amd64/machine/smp.h
new file mode 100644
index 0000000000..9c4f2d111b
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/smp.h
@@ -0,0 +1,30 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_SMP_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_SMP_H_
+
+#ifdef _KERNEL
+
+/*
+ * APIC-related functions are replaced with native calls rather than shims
+ * which attempt to replicate the FreeBSD interfaces.  This is empty, but will
+ * remain present to appease sources which wish to include the path.
+ */
+
+#endif /* _KERNEL */
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_SMP_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/specialreg.h b/usr/src/compat/freebsd/amd64/machine/specialreg.h
new file mode 100644
index 0000000000..12bcbfd0a8
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/specialreg.h
@@ -0,0 +1,43 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_SPECIALREG_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_SPECIALREG_H_
+
+#ifdef _SYS_X86_ARCHEXT_H
+/* Our x86_archext conflicts with BSD header for the XFEATURE_ defines */
+#undef	XFEATURE_AVX
+#undef	XFEATURE_MPX
+#undef	XFEATURE_AVX512
+#endif
+
+#ifdef _SYS_CONTROLREGS_H
+/* Our CR4 defines conflict with BSD header */
+#undef	CR4_VME
+#undef	CR4_PVI
+#undef	CR4_TSD
+#undef	CR4_DE
+#undef	CR4_PSE
+#undef	CR4_PAE
+#undef	CR4_MCE
+#undef	CR4_PGE
+#undef	CR4_PCE
+#undef	CR4_VMXE
+#undef	CR4_SMEP
+#undef	CR4_PCIDE
+#endif /* _SYS_CONTROLREGS_H */
+
+#include <x86/specialreg.h>
+#endif /* _COMPAT_FREEBSD_AMD64_MACHINE_SPECIALREG_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/vmm.h b/usr/src/compat/freebsd/amd64/machine/vmm.h
new file mode 100644
index 0000000000..1c54c0830d
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/vmm.h
@@ -0,0 +1,24 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_VMM_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_VMM_H_
+
+#include <sys/_cpuset.h>
+
+#include <sys/vmm.h>
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_VMM_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/vmm_dev.h b/usr/src/compat/freebsd/amd64/machine/vmm_dev.h
new file mode 100644
index 0000000000..fe9cb6c705
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/vmm_dev.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_VMM_DEV_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_VMM_DEV_H_
+
+#include <sys/vmm_dev.h>
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_VMM_DEV_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/vmm_instruction_emul.h b/usr/src/compat/freebsd/amd64/machine/vmm_instruction_emul.h
new file mode 100644
index 0000000000..02c3f391c7
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/vmm_instruction_emul.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_VMM_INSTRUCTION_EMUL_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_VMM_INSTRUCTION_EMUL_H_
+
+#include <sys/vmm_instruction_emul.h>
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_VMM_INSTRUCTION_EMUL_H_ */
diff --git a/usr/src/compat/freebsd/amd64/machine/vmparam.h b/usr/src/compat/freebsd/amd64/machine/vmparam.h
new file mode 100644
index 0000000000..167aa1f459
--- /dev/null
+++ b/usr/src/compat/freebsd/amd64/machine/vmparam.h
@@ -0,0 +1,33 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_AMD64_MACHINE_VMPARAM_H_
+#define	_COMPAT_FREEBSD_AMD64_MACHINE_VMPARAM_H_
+
+extern caddr_t kpm_vbase;
+extern size_t kpm_size;
+
+#define	PHYS_TO_DMAP(x)	({ 			\
+	ASSERT((uintptr_t)(x) < kpm_size);	\
+	(uintptr_t)(x) | (uintptr_t)kpm_vbase; })
+
+#define	DMAP_TO_PHYS(x)	({				\
+	ASSERT((uintptr_t)(x) >= (uintptr_t)kpm_vbase);		\
+	ASSERT((uintptr_t)(x) < ((uintptr_t)kpm_vbase + kpm_size));	\
+	(uintptr_t)(x) & ~(uintptr_t)kpm_vbase; })	\
+
+
+#endif	/* _COMPAT_FREEBSD_AMD64_MACHINE_VMPARAM_H_ */
diff --git a/usr/src/compat/freebsd/contrib/dev/acpica/include/acpi.h b/usr/src/compat/freebsd/contrib/dev/acpica/include/acpi.h
new file mode 100644
index 0000000000..2668f98ab3
--- /dev/null
+++ b/usr/src/compat/freebsd/contrib/dev/acpica/include/acpi.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_CONTRIB_DEV_ACPICA_INCLUDE_ACPI_H
+#define	_COMPAT_FREEBSD_CONTRIB_DEV_ACPICA_INCLUDE_ACPI_H
+
+#include <sys/acpi/acpi.h>
+
+#endif /* _COMPAT_FREEBSD_CONTRIB_DEV_ACPICA_INCLUDE_ACPI_H */
diff --git a/usr/src/compat/freebsd/dev/pci/pcivar.h b/usr/src/compat/freebsd/dev/pci/pcivar.h
new file mode 100644
index 0000000000..064d983117
--- /dev/null
+++ b/usr/src/compat/freebsd/dev/pci/pcivar.h
@@ -0,0 +1,38 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_DEV_PCI_PCIVAR_H
+#define	_COMPAT_FREEBSD_DEV_PCI_PCIVAR_H
+
+#include <sys/types.h>
+#include <sys/conf.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/pcie.h>
+#include <sys/pcie_impl.h>
+
+static inline pcie_req_id_t
+pci_get_bdf(device_t dev)
+{
+	pcie_req_id_t bdf;
+
+	VERIFY(pcie_get_bdf_from_dip(dev, &bdf) == DDI_SUCCESS);
+
+	return (bdf);
+}
+
+#define	pci_get_rid(dev)	(pci_get_bdf(dev))
+
+#endif /* _COMPAT_FREEBSD_DEV_PCI_PCIVAR_H */
diff --git a/usr/src/compat/freebsd/err.h b/usr/src/compat/freebsd/err.h
new file mode 100644
index 0000000000..40d144e025
--- /dev/null
+++ b/usr/src/compat/freebsd/err.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_ERR_H_
+#define	_COMPAT_FREEBSD_ERR_H_
+
+#define	errc(code, num, ...)	err(code, __VA_ARGS__)
+
+#include_next <err.h>
+
+#endif	/* _COMPAT_FREEBSD_ERR_H_ */
diff --git a/usr/src/compat/freebsd/libutil.h b/usr/src/compat/freebsd/libutil.h
new file mode 100644
index 0000000000..f899d4425e
--- /dev/null
+++ b/usr/src/compat/freebsd/libutil.h
@@ -0,0 +1,35 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_LIBUTIL_H_
+#define	_COMPAT_FREEBSD_LIBUTIL_H_
+
+int	expand_number(const char *_buf, uint64_t *_num);
+int	humanize_number(char *_buf, size_t _len, int64_t _number,
+    const char *_suffix, int _scale, int _flags);
+
+/* Values for humanize_number(3)'s flags parameter. */
+#define HN_DECIMAL      0x01
+#define HN_NOSPACE      0x02
+#define HN_B            0x04
+#define HN_DIVISOR_1000     0x08
+#define HN_IEC_PREFIXES     0x10
+
+/* Values for humanize_number(3)'s scale parameter. */
+#define HN_GETSCALE     0x10
+#define HN_AUTOSCALE        0x20
+
+
+#endif	/* _COMPAT_FREEBSD_LIBUTIL_H_ */
diff --git a/usr/src/compat/freebsd/net/ethernet.h b/usr/src/compat/freebsd/net/ethernet.h
new file mode 100644
index 0000000000..dcd3a58925
--- /dev/null
+++ b/usr/src/compat/freebsd/net/ethernet.h
@@ -0,0 +1,35 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_NET_ETHERNET_H_
+#define	_COMPAT_FREEBSD_SYS_NET_ETHERNET_H_
+
+#define	ether_addr_octet	octet
+
+#include <sys/ethernet.h>
+
+/*
+ * Some basic Ethernet constants.
+ */
+#define	ETHER_ADDR_LEN		6	/* length of an Ethernet address */
+#define	ETHER_CRC_LEN		4	/* length of the Ethernet CRC */
+#define	ETHER_MIN_LEN		64	/* minimum frame len, including CRC */
+
+#define	ETHER_VLAN_ENCAP_LEN	4	/* len of 802.1Q VLAN encapsulation */
+
+#define	ETHER_IS_MULTICAST(addr) (*(addr) & 0x01) /* is address mcast/bcast? */
+
+#endif	/* _COMPAT_FREEBSD_SYS_NET_ETHERNET_H_ */
diff --git a/usr/src/compat/freebsd/paths.h b/usr/src/compat/freebsd/paths.h
new file mode 100644
index 0000000000..e43c963f93
--- /dev/null
+++ b/usr/src/compat/freebsd/paths.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_PATHS_H_
+#define	_COMPAT_FREEBSD_PATHS_H_
+
+#define	_PATH_TMP	"/tmp/"
+
+#endif	/* _COMPAT_FREEBSD_PATHS_H_ */
diff --git a/usr/src/compat/freebsd/pthread_np.h b/usr/src/compat/freebsd/pthread_np.h
new file mode 100644
index 0000000000..641c58f406
--- /dev/null
+++ b/usr/src/compat/freebsd/pthread_np.h
@@ -0,0 +1,28 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_PTHREAD_NP_H_
+#define	_COMPAT_FREEBSD_PTHREAD_NP_H_
+
+#include <sys/param.h>
+#include <sys/cpuset.h>
+
+#include <synch.h>
+
+#define	pthread_set_name_np(thread, name)
+
+#define	pthread_mutex_isowned_np(x)	_mutex_held(x)
+
+#endif	/* _COMPAT_FREEBSD_PTHREAD_NP_H_ */
diff --git a/usr/src/compat/freebsd/string.h b/usr/src/compat/freebsd/string.h
new file mode 100644
index 0000000000..7e0f5c7ddc
--- /dev/null
+++ b/usr/src/compat/freebsd/string.h
@@ -0,0 +1,26 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_STRING_H_
+#define	_COMPAT_FREEBSD_STRING_H_
+
+/*
+ * This is quite a hack; blame bcopy/bcmp/bzero and memcpy/memcmp/memset.
+ */
+#include <strings.h>
+
+#include_next <string.h>
+
+#endif	/* _COMPAT_FREEBSD_STRING_H_ */
diff --git a/usr/src/compat/freebsd/strings.h b/usr/src/compat/freebsd/strings.h
new file mode 100644
index 0000000000..fa3539fb96
--- /dev/null
+++ b/usr/src/compat/freebsd/strings.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_STRINGS_H_
+#define	_COMPAT_FREEBSD_STRINGS_H_
+
+#include <machine/cpufunc.h>
+
+#include_next <strings.h>
+
+#endif	/* _COMPAT_FREEBSD_STRINGS_H_ */
diff --git a/usr/src/compat/freebsd/sys/_cpuset.h b/usr/src/compat/freebsd/sys/_cpuset.h
new file mode 100644
index 0000000000..286d26fc00
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/_cpuset.h
@@ -0,0 +1,33 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS__CPUSET_H_
+#define	_COMPAT_FREEBSD_SYS__CPUSET_H_
+
+#ifdef _KERNEL
+/*
+ * The sys/_cpuset.h header is used to communicate the layout of cpuset_t while
+ * sys/cpuset.h contains the manipulation routines.
+ *
+ * The explicit guard definition below is necessary as other contrib headers
+ * change their behavior based on its presence.
+ */
+#define	_SYS__CPUSET_H_
+
+#include <sys/cpuvar.h>
+
+#endif /* _KERNEL */
+
+#endif	/* _COMPAT_FREEBSD_SYS__CPUSET_H_ */
diff --git a/usr/src/compat/freebsd/sys/_iovec.h b/usr/src/compat/freebsd/sys/_iovec.h
new file mode 100644
index 0000000000..b755ae7e21
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/_iovec.h
@@ -0,0 +1,24 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS__IOVEC_H_
+#define	_COMPAT_FREEBSD_SYS__IOVEC_H_
+
+struct iovec {
+        void	*iov_base;	/* Base address. */
+        size_t	iov_len;	/* Length. */
+};
+
+#endif	/* _COMPAT_FREEBSD_SYS__IOVEC_H_ */
diff --git a/usr/src/compat/freebsd/sys/_pthreadtypes.h b/usr/src/compat/freebsd/sys/_pthreadtypes.h
new file mode 100644
index 0000000000..d746da3712
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/_pthreadtypes.h
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS__PTHREADTYPES_H_
+#define	_COMPAT_FREEBSD_SYS__PTHREADTYPES_H_
+
+#endif	/* _COMPAT_FREEBSD_SYS__PTHREADTYPES_H_ */
diff --git a/usr/src/compat/freebsd/sys/_types.h b/usr/src/compat/freebsd/sys/_types.h
new file mode 100644
index 0000000000..62c327d216
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/_types.h
@@ -0,0 +1,22 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS__TYPES_H_
+#define	_COMPAT_FREEBSD_SYS__TYPES_H_
+
+#include <sys/cdefs.h>
+#include <machine/_types.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS__TYPES_H_ */
diff --git a/usr/src/compat/freebsd/sys/bus.h b/usr/src/compat/freebsd/sys/bus.h
new file mode 100644
index 0000000000..e3b5e0e69d
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/bus.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_BUS_H
+#define	_COMPAT_FREEBSD_SYS_BUS_H
+
+#define	device_get_softc(dev)	ddi_get_driver_private(dev)
+
+#endif /* _COMPAT_FREEBSD_SYS_BUS_H */
diff --git a/usr/src/compat/freebsd/sys/callout.h b/usr/src/compat/freebsd/sys/callout.h
new file mode 100644
index 0000000000..6087a09f54
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/callout.h
@@ -0,0 +1,74 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_CALLOUT_H_
+#define	_COMPAT_FREEBSD_SYS_CALLOUT_H_
+
+#include <sys/cyclic.h>
+
+struct callout {
+	cyclic_id_t	c_cyc_id;
+	int		c_flags;
+	void		(*c_func)(void *);
+	void		*c_arg;
+
+};
+
+#define	CALLOUT_ACTIVE		0x0002	/* callout is currently active */
+#define	CALLOUT_PENDING		0x0004	/* callout is waiting for timeout */
+
+#define	C_ABSOLUTE		0x0200	/* event time is absolute. */
+
+#define	callout_active(c)	((c)->c_flags & CALLOUT_ACTIVE)
+#define	callout_deactivate(c)	((c)->c_flags &= ~CALLOUT_ACTIVE)
+#define	callout_pending(c)	((c)->c_flags & CALLOUT_PENDING)
+
+void	vmm_glue_callout_init(struct callout *c, int mpsafe);
+int	vmm_glue_callout_reset_sbt(struct callout *c, sbintime_t sbt,
+    sbintime_t pr, void (*func)(void *), void *arg, int flags);
+int	vmm_glue_callout_stop(struct callout *c);
+int	vmm_glue_callout_drain(struct callout *c);
+
+/* illumos-custom function for resource locality optimization */
+void	vmm_glue_callout_localize(struct callout *c);
+
+static __inline void
+callout_init(struct callout *c, int mpsafe)
+{
+	vmm_glue_callout_init(c, mpsafe);
+}
+
+static __inline int
+callout_stop(struct callout *c)
+{
+	return (vmm_glue_callout_stop(c));
+}
+
+static __inline int
+callout_drain(struct callout *c)
+{
+	return (vmm_glue_callout_drain(c));
+}
+
+static __inline int
+callout_reset_sbt(struct callout *c, sbintime_t sbt, sbintime_t pr,
+    void (*func)(void *), void *arg, int flags)
+{
+	return (vmm_glue_callout_reset_sbt(c, sbt, pr, func, arg, flags));
+}
+
+
+#endif	/* _COMPAT_FREEBSD_SYS_CALLOUT_H_ */
diff --git a/usr/src/compat/freebsd/sys/cdefs.h b/usr/src/compat/freebsd/sys/cdefs.h
new file mode 100644
index 0000000000..1713b05630
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/cdefs.h
@@ -0,0 +1,101 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_CDEFS_H_
+#define	_COMPAT_FREEBSD_SYS_CDEFS_H_
+
+/*
+ * Testing against Clang-specific extensions.
+ */
+#ifndef __has_extension
+#define	__has_extension		__has_feature
+#endif
+#ifndef __has_feature
+#define	__has_feature(x)	0
+#endif
+
+/*
+ * Macro to test if we're using a specific version of gcc or later.
+ */
+#if defined(__GNUC__) && !defined(__INTEL_COMPILER)
+#define __GNUC_PREREQ__(ma, mi) \
+	(__GNUC__ > (ma) || __GNUC__ == (ma) && __GNUC_MINOR__ >= (mi))
+#else
+#define __GNUC_PREREQ__(ma, mi) 0
+#endif
+
+#define	__FBSDID(s)
+
+#ifdef	__GNUC__
+#define	asm		__asm
+#define	inline		__inline
+
+#define	__GNUCLIKE___SECTION		1
+
+#define	__dead2		__attribute__((__noreturn__))
+#define	__used		__attribute__((__used__))
+#define	__packed	__attribute__((__packed__))
+#define	__aligned(x)	__attribute__((__aligned__(x)))
+#define	__section(x)	__attribute__((__section__(x)))
+#define	__weak_symbol   __attribute__((__weak__))
+#endif
+
+/*
+ * The __CONCAT macro is used to concatenate parts of symbol names, e.g.
+ * with "#define OLD(foo) __CONCAT(old,foo)", OLD(foo) produces oldfoo.
+ * The __CONCAT macro is a bit tricky to use if it must work in non-ANSI
+ * mode -- there must be no spaces between its arguments, and for nested
+ * __CONCAT's, all the __CONCAT's must be at the left.  __CONCAT can also
+ * concatenate double-quoted strings produced by the __STRING macro, but
+ * this only works with ANSI C.
+ *
+ * __XSTRING is like __STRING, but it expands any macros in its argument
+ * first.  It is only available with ANSI C.
+ */
+#if defined(__STDC__) || defined(__cplusplus)
+#define	__P(protos)	protos		/* full-blown ANSI C */
+#define	__CONCAT1(x,y)	x ## y
+#define	__CONCAT(x,y)	__CONCAT1(x,y)
+#define	__STRING(x)	#x		/* stringify without expanding x */
+#define	__XSTRING(x)	__STRING(x)	/* expand x, then stringify */
+#else	/* !(__STDC__ || __cplusplus) */
+#define	__P(protos)	()		/* traditional C preprocessor */
+#define	__CONCAT(x,y)	x/**/y
+#define	__STRING(x)	"x"
+#endif	/* !(__STDC__ || __cplusplus) */
+
+#if !defined(__STDC_VERSION__) || __STDC_VERSION__ < 201112L || defined(lint)
+
+#if !__has_extension(c_static_assert)
+#if (defined(__cplusplus) && __cplusplus >= 201103L) || \
+    __has_extension(cxx_static_assert)
+#define _Static_assert(x, y)    static_assert(x, y)
+#elif __GNUC_PREREQ__(4,6)
+/* Nothing, gcc 4.6 and higher has _Static_assert built-in */
+#elif defined(__COUNTER__)
+#define _Static_assert(x, y)    __Static_assert(x, __COUNTER__)
+#define __Static_assert(x, y)   ___Static_assert(x, y)
+#define ___Static_assert(x, y)  typedef char __assert_ ## y[(x) ? 1 : -1] \
+                                __unused
+#else
+#define _Static_assert(x, y)    struct __hack
+#endif
+#endif
+#define	static_assert(x, y)	_Static_assert(x, y)
+
+#endif /* __STDC_VERSION__ || __STDC_VERSION__ < 201112L */
+
+#endif	/* _COMPAT_FREEBSD_SYS_CDEFS_H_ */
diff --git a/usr/src/compat/freebsd/sys/clock.h b/usr/src/compat/freebsd/sys/clock.h
new file mode 100644
index 0000000000..ebf7f171a3
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/clock.h
@@ -0,0 +1,110 @@
+/*-
+ * Copyright (c) 1996 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Gordon W. Ross
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$NetBSD: clock_subr.h,v 1.7 2000/10/03 13:41:07 tsutsui Exp $
+ *
+ *
+ * This file is the central clearing-house for calendrical issues.
+ *
+ * In general the kernel does not know about minutes, hours, days, timezones,
+ * daylight savings time, leap-years and such.  All that is theoretically a
+ * matter for userland only.
+ *
+ * Parts of kernel code does however care: badly designed filesystems store
+ * timestamps in local time and RTC chips sometimes track time in a local
+ * timezone instead of UTC and so on.
+ *
+ * All that code should go here for service.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_CLOCK_H_
+#define	_COMPAT_FREEBSD_SYS_CLOCK_H_
+
+#include_next <sys/clock.h>
+
+#ifdef _KERNEL		/* No user serviceable parts */
+
+#ifdef __FreeBSD__
+/*
+ * Timezone info from settimeofday(2), usually not used
+ */
+extern int tz_minuteswest;
+extern int tz_dsttime;
+extern struct mtx resettodr_lock;
+
+int utc_offset(void);
+#endif /* __FreeBSD__ */
+
+/*
+ * Structure to hold the values typically reported by time-of-day clocks.
+ * This can be passed to the generic conversion functions to be converted
+ * to a struct timespec.
+ */
+struct clocktime {
+	int	year;			/* year (4 digit year) */
+	int	mon;			/* month (1 - 12) */
+	int	day;			/* day (1 - 31) */
+	int	hour;			/* hour (0 - 23) */
+	int	min;			/* minute (0 - 59) */
+	int	sec;			/* second (0 - 59) */
+	int	dow;			/* day of week (0 - 6; 0 = Sunday) */
+	long	nsec;			/* nano seconds */
+};
+
+int clock_ct_to_ts(struct clocktime *, struct timespec *);
+void clock_ts_to_ct(struct timespec *, struct clocktime *);
+#ifdef __FreeBSD__
+void clock_register(device_t, long);
+#endif
+
+#ifndef __FreeBSD__
+extern u_char const bin2bcd_data[];
+#define	bin2bcd(x)	(bin2bcd_data[bin])
+#endif
+
+/*
+ * BCD to decimal and decimal to BCD.
+ */
+#define	FROMBCD(x)	bcd2bin(x)
+#define	TOBCD(x)	bin2bcd(x)
+
+/* Some handy constants. */
+#define SECDAY		(24 * 60 * 60)
+#define SECYR		(SECDAY * 365)
+
+/* Traditional POSIX base year */
+#define	POSIX_BASE_YEAR	1970
+
+void timespec2fattime(struct timespec *tsp, int utc, u_int16_t *ddp, u_int16_t *dtp, u_int8_t *dhp);
+void fattime2timespec(unsigned dd, unsigned dt, unsigned dh, int utc, struct timespec *tsp);
+
+#endif /* _KERNEL */
+
+#endif	/* _COMPAT_FREEBSD_SYS_CLOCK_H_ */
diff --git a/usr/src/compat/freebsd/sys/cpuset.h b/usr/src/compat/freebsd/sys/cpuset.h
new file mode 100644
index 0000000000..dadadf15b2
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/cpuset.h
@@ -0,0 +1,131 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_CPUSET_H_
+#define	_COMPAT_FREEBSD_SYS_CPUSET_H_
+
+#define	NOCPU			-1
+
+#ifdef	_KERNEL
+
+#include <sys/_cpuset.h>
+
+#define	CPU_SET(cpu, set)		cpuset_add((set), (cpu))
+#define	CPU_SETOF(cpu, set)		cpuset_only((set), (cpu))
+#define	CPU_ZERO(set)			cpuset_zero((cpuset_t *)(set))
+#define	CPU_CLR(cpu, set)		cpuset_del((set), (cpu))
+#define	CPU_FFS(set)			cpusetobj_ffs(set)
+#define	CPU_ISSET(cpu, set)		cpu_in_set((cpuset_t *)(set), (cpu))
+#define	CPU_AND(dst, src)		cpuset_and(			\
+						(cpuset_t *)(dst),	\
+						(cpuset_t *)(src))
+#define	CPU_CMP(set1, set2)		(cpuset_isequal(		\
+						(cpuset_t *)(set1),	\
+						(cpuset_t *)(set2)) == 0)
+#define	CPU_SET_ATOMIC(cpu, set)	cpuset_atomic_add(		\
+						(cpuset_t *)(set),	\
+						(cpu))
+#define	CPU_CLR_ATOMIC(cpu, set)	cpuset_atomic_del(		\
+						(cpuset_t *)(set),	\
+						(cpu))
+
+/* XXXJOY: The _ACQ variants appear to imply a membar too. Is that an issue? */
+#define	CPU_SET_ATOMIC_ACQ(cpu, set)	cpuset_atomic_add((set), (cpu))
+
+
+int	cpusetobj_ffs(const cpuset_t *set);
+
+#else
+
+#include <sys/bitmap.h>
+#include <machine/atomic.h>
+#include <machine/cpufunc.h>
+
+/* For now, assume NCPU of 256 */
+#define	CPU_SETSIZE			(256)
+
+typedef struct {
+	ulong_t _bits[BT_BITOUL(CPU_SETSIZE)];
+} cpuset_t;
+
+static __inline int
+cpuset_isempty(const cpuset_t *set)
+{
+	uint_t i;
+
+	for (i = 0; i < BT_BITOUL(CPU_SETSIZE); i++) {
+		if (set->_bits[i] != 0)
+			return (0);
+	}
+	return (1);
+}
+
+static __inline void
+cpuset_zero(cpuset_t *dst)
+{
+	uint_t i;
+
+	for (i = 0; i < BT_BITOUL(CPU_SETSIZE); i++) {
+		dst->_bits[i] = 0;
+	}
+}
+
+static __inline int
+cpuset_isequal(cpuset_t *s1, cpuset_t *s2)
+{
+	uint_t i;
+
+	for (i = 0; i < BT_BITOUL(CPU_SETSIZE); i++) {
+		if (s1->_bits[i] != s2->_bits[i])
+			return (0);
+	}
+	return (1);
+}
+
+static __inline uint_t
+cpusetobj_ffs(const cpuset_t *set)
+{
+	uint_t i, cbit;
+
+	cbit = 0;
+	for (i = 0; i < BT_BITOUL(CPU_SETSIZE); i++) {
+		if (set->_bits[i] != 0) {
+			cbit = ffsl(set->_bits[i]);
+			cbit += i * sizeof (set->_bits[0]);
+			break;
+		}
+	}
+	return (cbit);
+}
+
+
+#define	CPU_SET(cpu, setp)		BT_SET((setp)->_bits, cpu)
+#define	CPU_CLR(cpu, setp)		BT_CLEAR((setp)->_bits, cpu)
+#define	CPU_ZERO(setp)			cpuset_zero((setp))
+#define	CPU_CMP(set1, set2)		(cpuset_isequal(		\
+						(cpuset_t *)(set1),	\
+						(cpuset_t *)(set2)) == 0)
+#define	CPU_FFS(set)			cpusetobj_ffs(set)
+#define	CPU_ISSET(cpu, setp)		BT_TEST((setp)->_bits, cpu)
+#define	CPU_EMPTY(setp)			cpuset_isempty((setp))
+#define	CPU_SET_ATOMIC(cpu, setp)	\
+	atomic_set_long(&(BT_WIM((setp)->_bits, cpu)), BT_BIW(cpu))
+#define	CPU_CLR_ATOMIC(cpu, setp)	\
+	atomic_clear_long(&(BT_WIM((setp)->_bits, cpu)), BT_BIW(cpu))
+
+#endif
+
+#endif	/* _COMPAT_FREEBSD_SYS_CPUSET_H_ */
diff --git a/usr/src/compat/freebsd/sys/disk.h b/usr/src/compat/freebsd/sys/disk.h
new file mode 100644
index 0000000000..c9bdc6a2d8
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/disk.h
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_DISK_H_
+#define	_COMPAT_FREEBSD_SYS_DISK_H_
+
+#endif	/* _COMPAT_FREEBSD_SYS_DISK_H_ */
diff --git a/usr/src/compat/freebsd/sys/endian.h b/usr/src/compat/freebsd/sys/endian.h
new file mode 100644
index 0000000000..a31bff55d6
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/endian.h
@@ -0,0 +1,125 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_ENDIAN_H_
+#define	_COMPAT_FREEBSD_SYS_ENDIAN_H_
+
+static __inline uint16_t
+be16dec(const void *pp)
+{
+	uint8_t const *p = (uint8_t const *)pp;
+
+	return ((p[0] << 8) | p[1]);
+}
+
+static __inline uint32_t
+be32dec(const void *pp)
+{
+	uint8_t const *p = (uint8_t const *)pp;
+
+	return (((unsigned)p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3]);
+}
+
+static __inline uint64_t
+be64dec(const void *pp)
+{
+	uint8_t const *p = (uint8_t const *)pp;
+
+	return (((uint64_t)be32dec(p) << 32) | be32dec(p + 4));
+}
+
+static __inline uint16_t
+le16dec(const void *pp)
+{
+	uint8_t const *p = (uint8_t const *)pp;
+
+	return ((p[1] << 8) | p[0]);
+}
+
+static __inline uint32_t
+le32dec(const void *pp)
+{
+	uint8_t const *p = (uint8_t const *)pp;
+
+	return (((unsigned)p[3] << 24) | (p[2] << 16) | (p[1] << 8) | p[0]);
+}
+
+static __inline uint64_t
+le64dec(const void *pp)
+{
+	uint8_t const *p = (uint8_t const *)pp;
+
+	return (((uint64_t)le32dec(p + 4) << 32) | le32dec(p));
+}
+
+static __inline void
+be16enc(void *pp, uint16_t u)
+{
+	uint8_t *p = (uint8_t *)pp;
+
+	p[0] = (u >> 8) & 0xff;
+	p[1] = u & 0xff;
+}
+
+static __inline void
+be32enc(void *pp, uint32_t u)
+{
+	uint8_t *p = (uint8_t *)pp;
+
+	p[0] = (u >> 24) & 0xff;
+	p[1] = (u >> 16) & 0xff;
+	p[2] = (u >> 8) & 0xff;
+	p[3] = u & 0xff;
+}
+
+static __inline void
+be64enc(void *pp, uint64_t u)
+{
+	uint8_t *p = (uint8_t *)pp;
+
+	be32enc(p, (uint32_t)(u >> 32));
+	be32enc(p + 4, (uint32_t)(u & 0xffffffffU));
+}
+
+static __inline void
+le16enc(void *pp, uint16_t u)
+{
+	uint8_t *p = (uint8_t *)pp;
+
+	p[0] = u & 0xff;
+	p[1] = (u >> 8) & 0xff;
+}
+
+static __inline void
+le32enc(void *pp, uint32_t u)
+{
+	uint8_t *p = (uint8_t *)pp;
+
+	p[0] = u & 0xff;
+	p[1] = (u >> 8) & 0xff;
+	p[2] = (u >> 16) & 0xff;
+	p[3] = (u >> 24) & 0xff;
+}
+
+static __inline void
+le64enc(void *pp, uint64_t u)
+{
+	uint8_t *p = (uint8_t *)pp;
+
+	le32enc(p, (uint32_t)(u & 0xffffffffU));
+	le32enc(p + 4, (uint32_t)(u >> 32));
+}
+
+#endif	/* _COMPAT_FREEBSD_SYS_ENDIAN_H_ */
diff --git a/usr/src/compat/freebsd/sys/errno.h b/usr/src/compat/freebsd/sys/errno.h
new file mode 100644
index 0000000000..bd37f43065
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/errno.h
@@ -0,0 +1,27 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_ERRNO_H_
+#define	_COMPAT_FREEBSD_SYS_ERRNO_H_
+
+#ifndef	_KERNEL
+extern int *___errno();
+
+#define	errno	(*(___errno()))
+#endif
+
+#include_next <sys/errno.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS_ERRNO_H_ */
diff --git a/usr/src/compat/freebsd/sys/fcntl.h b/usr/src/compat/freebsd/sys/fcntl.h
new file mode 100644
index 0000000000..062a3b84ac
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/fcntl.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_FCNTL_H_
+#define	_COMPAT_FREEBSD_SYS_FCNTL_H_
+
+#define	O_DIRECT	0x0
+
+#include_next <sys/fcntl.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS_FCNTL_H_ */
diff --git a/usr/src/compat/freebsd/sys/ioctl.h b/usr/src/compat/freebsd/sys/ioctl.h
new file mode 100644
index 0000000000..72a46b8085
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/ioctl.h
@@ -0,0 +1,24 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_IOCTL_H_
+#define	_COMPAT_FREEBSD_SYS_IOCTL_H_
+
+#include <sys/ioccom.h>
+/* Get BSD compatibility from the ioctl header */
+#define	BSD_COMP
+#include_next <sys/ioctl.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS_IOCTL_H_ */
diff --git a/usr/src/compat/freebsd/sys/kernel.h b/usr/src/compat/freebsd/sys/kernel.h
new file mode 100644
index 0000000000..adf96f40fc
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/kernel.h
@@ -0,0 +1,42 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_KERNEL_H_
+#define	_COMPAT_FREEBSD_SYS_KERNEL_H_
+
+#define	TUNABLE_INT_FETCH(path, var)
+
+#include <sys/linker_set.h>
+
+typedef void (*sysinit_func_t)(const void *);
+
+struct sysinit {
+	const sysinit_func_t func;
+	const void *data;
+};
+
+#define	SYSINIT(uniquifier, subsystem, order, func, ident) \
+	static struct sysinit uniquifier ## _sys_init = {  \
+		(const sysinit_func_t)func,		   \
+		(const void *)&(ident)			   \
+	};						   \
+	DATA_SET(sysinit_set, uniquifier ## _sys_init);
+
+extern void sysinit(void);
+
+#define	ticks	ddi_get_lbolt()
+
+#endif	/* _COMPAT_FREEBSD_SYS_KERNEL_H_ */
diff --git a/usr/src/compat/freebsd/sys/ktr.h b/usr/src/compat/freebsd/sys/ktr.h
new file mode 100644
index 0000000000..96c499ef18
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/ktr.h
@@ -0,0 +1,27 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_KTR_H_
+#define	_COMPAT_FREEBSD_SYS_KTR_H_
+
+#define	CTR0(m, format)
+#define	CTR1(m, format, p1)
+#define	CTR2(m, format, p1, p2)
+#define	CTR3(m, format, p1, p2, p3)
+#define	CTR4(m, format, p1, p2, p3, p4)
+#define	CTR5(m, format, p1, p2, p3, p4, p5)
+#define	CTR6(m, d, p1, p2, p3, p4, p5, p6)
+
+#endif	/* _COMPAT_FREEBSD_SYS_KTR_H_ */
diff --git a/usr/src/compat/freebsd/sys/libkern.h b/usr/src/compat/freebsd/sys/libkern.h
new file mode 100644
index 0000000000..94675a0d66
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/libkern.h
@@ -0,0 +1,25 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_LIBKERN_H_
+#define	_COMPAT_FREEBSD_SYS_LIBKERN_H_
+
+#include <sys/systm.h>
+
+#ifndef	min
+static __inline u_int min(u_int a, u_int b) { return (a < b ? a : b); }
+#endif
+
+#endif	/* _COMPAT_FREEBSD_SYS_LIBKERN_H_ */
diff --git a/usr/src/compat/freebsd/sys/limits.h b/usr/src/compat/freebsd/sys/limits.h
new file mode 100644
index 0000000000..0e66319791
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/limits.h
@@ -0,0 +1,24 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_LIMITS_H_
+#define	_COMPAT_FREEBSD_SYS_LIMITS_H_
+
+#include_next <limits.h>
+
+#define	OFF_MAX		((off_t)-1)
+
+#endif	/* _COMPAT_FREEBSD_SYS_LIMITS_H_ */
diff --git a/usr/src/compat/freebsd/sys/lock.h b/usr/src/compat/freebsd/sys/lock.h
new file mode 100644
index 0000000000..fd6021a87e
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/lock.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_LOCK_H_
+#define	_COMPAT_FREEBSD_SYS_LOCK_H_
+
+#include_next <sys/lock.h>
+
+#define	WITNESS_WARN(...)
+
+#endif	/* _COMPAT_FREEBSD_SYS_LOCK_H_ */
diff --git a/usr/src/compat/freebsd/sys/malloc.h b/usr/src/compat/freebsd/sys/malloc.h
new file mode 100644
index 0000000000..341d57b807
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/malloc.h
@@ -0,0 +1,49 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_MALLOC_H_
+#define	_COMPAT_FREEBSD_SYS_MALLOC_H_
+
+/*
+ * flags to malloc.
+ */
+#define	M_NOWAIT	0x0001		/* do not block */
+#define	M_WAITOK	0x0002		/* ok to block */
+#define	M_ZERO		0x0100		/* bzero the allocation */
+
+struct malloc_type {
+	const char	*ks_shortdesc;	/* Printable type name. */
+};
+
+#ifdef	_KERNEL
+#define	MALLOC_DEFINE(type, shortdesc, longdesc)			\
+	struct malloc_type type[1] = {					\
+		{ shortdesc }						\
+	}
+
+#define	MALLOC_DECLARE(type)						\
+	extern struct malloc_type type[1]
+
+void	free(void *addr, struct malloc_type *type);
+void	*malloc(unsigned long size, struct malloc_type *type, int flags);
+void	*old_malloc(unsigned long size, struct malloc_type *type , int flags);
+void	*contigmalloc(unsigned long, struct malloc_type *, int, vm_paddr_t,
+    vm_paddr_t, unsigned long, vm_paddr_t);
+void	contigfree(void *, unsigned long, struct malloc_type *);
+
+
+#endif	/* _KERNEL */
+
+#endif	/* _COMPAT_FREEBSD_SYS_MALLOC_H_ */
diff --git a/usr/src/compat/freebsd/sys/module.h b/usr/src/compat/freebsd/sys/module.h
new file mode 100644
index 0000000000..87b73e3fa3
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/module.h
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_MODULE_H_
+#define	_COMPAT_FREEBSD_SYS_MODULE_H_
+
+#endif	/* _COMPAT_FREEBSD_SYS_MODULE_H_ */
diff --git a/usr/src/compat/freebsd/sys/mutex.h b/usr/src/compat/freebsd/sys/mutex.h
new file mode 100644
index 0000000000..57ebfee901
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/mutex.h
@@ -0,0 +1,78 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_MUTEX_H_
+#define	_COMPAT_FREEBSD_SYS_MUTEX_H_
+
+#ifdef	_KERNEL
+
+#include <sys/debug.h>
+
+#define	MTX_DEF		0x00000000
+#define	MTX_SPIN	0x00000001
+
+struct mtx;
+
+void mtx_init(struct mtx *, char *name, const char *type_name, int opts);
+void mtx_destroy(struct mtx *);
+
+#endif	/* KERNEL */
+#include_next <sys/mutex.h>
+#ifdef	_KERNEL
+
+struct mtx {
+	kmutex_type_t	t;
+	kmutex_t	m;
+};
+
+static __inline void mtx_lock(struct mtx *mtx)
+{
+	mutex_enter(&mtx->m);
+}
+
+static __inline void mtx_unlock(struct mtx *mtx)
+{
+	mutex_exit(&mtx->m);
+}
+
+static __inline void mtx_lock_spin(struct mtx *mtx)
+{
+	mutex_enter(&mtx->m);
+}
+
+static __inline void mtx_unlock_spin(struct mtx *mtx)
+{
+	mutex_exit(&mtx->m);
+}
+
+static __inline int mtx_owned(struct mtx *mtx)
+{
+	return (mutex_owned(&mtx->m));
+}
+
+#define	MA_OWNED	0
+
+static __inline void mtx_assert(struct mtx *mtx, int what)
+{
+	switch (what) {
+	case MA_OWNED:
+		ASSERT(mutex_owned(&mtx->m));
+		break;
+	}
+}
+
+#endif	/* _KERNEL */
+
+#endif	/* _COMPAT_FREEBSD_SYS_MUTEX_H_ */
diff --git a/usr/src/compat/freebsd/sys/param.h b/usr/src/compat/freebsd/sys/param.h
new file mode 100644
index 0000000000..b125f9014f
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/param.h
@@ -0,0 +1,57 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_PARAM_H_
+#define	_COMPAT_FREEBSD_SYS_PARAM_H_
+
+#ifndef	_KERNEL
+#define	MAXCOMLEN	16
+/* default value of the kernel tunable 'maxphys' in i86pc */
+#define	MAXPHYS		(56 * 1024)
+#endif
+#define	MAXHOSTNAMELEN	256
+#define	SPECNAMELEN	63
+
+#ifdef	_KERNEL
+#include <sys/time.h>
+
+#ifndef	FALSE
+#define	FALSE	0
+#endif
+#ifndef	TRUE
+#define	TRUE	1
+#endif
+#endif
+
+#include <machine/param.h>
+
+#define	nitems(x)	(sizeof((x)) / sizeof((x)[0]))
+#define	rounddown(x,y)	(((x)/(y))*(y))
+#define	rounddown2(x, y) ((x)&(~((y)-1)))   /* if y is power of two */
+#define	roundup(x, y)	((((x)+((y)-1))/(y))*(y))  /* to any y */
+#define	roundup2(x,y)	(((x)+((y)-1))&(~((y)-1))) /* if y is powers of two */
+#define	powerof2(x)	((((x)-1)&(x))==0)
+
+/* Macros for min/max. */
+#define	MIN(a,b) (((a)<(b))?(a):(b))
+#define	MAX(a,b) (((a)>(b))?(a):(b))
+
+#define	trunc_page(x)	((unsigned long)(x) & ~(PAGE_MASK))
+#define	ptoa(x)		((unsigned long)(x) << PAGE_SHIFT)
+
+#include_next <sys/param.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS_PARAM_H_ */
diff --git a/usr/src/compat/freebsd/sys/pcpu.h b/usr/src/compat/freebsd/sys/pcpu.h
new file mode 100644
index 0000000000..f29c9c5018
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/pcpu.h
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_PCPU_H_
+#define	_COMPAT_FREEBSD_SYS_PCPU_H_
+
+#define	curcpu	(CPU->cpu_id)
+
+#endif	/* _COMPAT_FREEBSD_SYS_PCPU_H_ */
diff --git a/usr/src/compat/freebsd/sys/sched.h b/usr/src/compat/freebsd/sys/sched.h
new file mode 100644
index 0000000000..b426ee757e
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/sched.h
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_SCHED_H_
+#define	_COMPAT_FREEBSD_SYS_SCHED_H_
+
+#endif	/* _COMPAT_FREEBSD_SYS_SCHED_H_ */
diff --git a/usr/src/compat/freebsd/sys/sdt.h b/usr/src/compat/freebsd/sys/sdt.h
new file mode 100644
index 0000000000..32d887c0d8
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/sdt.h
@@ -0,0 +1,37 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_SDT_H_
+#define	_COMPAT_FREEBSD_SYS_SDT_H_
+
+/* Empty macros to cover FreeBSD's SDT linker tricks */
+
+#define	SDT_PROVIDER_DECLARE(mod)
+#define	SDT_PROVIDER_DEFINE(mod)
+
+#define	SDT_PROBE_DEFINE1(...)
+#define	SDT_PROBE_DEFINE2(...)
+#define	SDT_PROBE_DEFINE3(...)
+#define	SDT_PROBE_DEFINE4(...)
+#define	SDT_PROBE_DEFINE5(...)
+#define	SDT_PROBE1(...)
+#define	SDT_PROBE2(...)
+#define	SDT_PROBE3(...)
+#define	SDT_PROBE4(...)
+#define	SDT_PROBE5(...)
+
+#include_next <sys/sdt.h>
+
+#endif /* _COMPAT_FREEBSD_SYS_SDT_H_ */
diff --git a/usr/src/compat/freebsd/sys/select.h b/usr/src/compat/freebsd/sys/select.h
new file mode 100644
index 0000000000..fcb40c23b1
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/select.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_MODULE_H_
+#define	_COMPAT_FREEBSD_SYS_MODULE_H_
+
+void *memset(void *s, int c, size_t n);
+
+#include_next <sys/select.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS_MODULE_H_ */
diff --git a/usr/src/compat/freebsd/sys/sglist.h b/usr/src/compat/freebsd/sys/sglist.h
new file mode 100644
index 0000000000..519c67915f
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/sglist.h
@@ -0,0 +1,29 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_SGLIST_H_
+#define	_COMPAT_FREEBSD_SYS_SGLIST_H_
+
+#ifdef _KERNEL
+
+struct sglist;
+
+struct sglist *sglist_alloc(int, int);
+void sglist_free(struct sglist *);
+int sglist_append_phys(struct sglist *, vm_paddr_t, size_t);
+
+#endif /* _KERNEL */
+
+#endif	/* _COMPAT_FREEBSD_SYS_SGLIST_H_ */
diff --git a/usr/src/compat/freebsd/sys/smp.h b/usr/src/compat/freebsd/sys/smp.h
new file mode 100644
index 0000000000..8a91c6c8d7
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/smp.h
@@ -0,0 +1,31 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_SMP_H_
+#define	_COMPAT_FREEBSD_SYS_SMP_H_
+
+#include <sys/cpuset.h>
+
+void	smp_rendezvous(void (*)(void *),
+		       void (*)(void *),
+		       void (*)(void *),
+		       void *arg);
+
+#define	IPI_AST	0
+
+void	ipi_cpu(int cpu, u_int ipi);
+
+#endif	/* _COMPAT_FREEBSD_SYS_SMP_H_ */
diff --git a/usr/src/compat/freebsd/sys/socket.h b/usr/src/compat/freebsd/sys/socket.h
new file mode 100644
index 0000000000..3bf7a8f440
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/socket.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_SOCKET_H
+#define	_COMPAT_FREEBSD_SYS_SOCKET_H
+
+#include_next <sys/socket.h>
+
+#define	SO_NOSIGPIPE	0
+
+#endif /* _COMPAT_FREEBSD_SYS_SOCKET_H */
diff --git a/usr/src/compat/freebsd/sys/sysctl.h b/usr/src/compat/freebsd/sys/sysctl.h
new file mode 100644
index 0000000000..9f6a695e34
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/sysctl.h
@@ -0,0 +1,27 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_SYSCTL_H_
+#define	_COMPAT_FREEBSD_SYS_SYSCTL_H_
+
+#define	SYSCTL_DECL(name)
+
+#define	SYSCTL_NODE(parent, nbr, name, access, handler, descr)
+
+#define	SYSCTL_INT(parent, nbr, name, access, ptr, val, descr)
+#define	SYSCTL_UINT(parent, nbr, name, access, ptr, val, descr)
+#define	SYSCTL_ULONG(parent, nbr, name, access, ptr, val, descr)
+
+#endif	/* _COMPAT_FREEBSD_SYS_SYSCTL_H_ */
diff --git a/usr/src/compat/freebsd/sys/systm.h b/usr/src/compat/freebsd/sys/systm.h
new file mode 100644
index 0000000000..43fa16d450
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/systm.h
@@ -0,0 +1,44 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_SYSTM_H_
+#define	_COMPAT_FREEBSD_SYS_SYSTM_H_
+
+#include <machine/atomic.h>
+#include <machine/cpufunc.h>
+#include <sys/callout.h>
+#include <sys/queue.h>
+
+struct mtx;
+
+#define	KASSERT(exp,msg) do {						\
+	if (!(exp))							\
+		panic msg;						\
+} while (0)
+
+void	critical_enter(void);
+void	critical_exit(void);
+
+struct unrhdr *new_unrhdr(int low, int high, struct mtx *mutex);
+void delete_unrhdr(struct unrhdr *uh);
+int alloc_unr(struct unrhdr *uh);
+void free_unr(struct unrhdr *uh, u_int item);
+
+#include <sys/libkern.h>
+
+#include_next <sys/systm.h>
+#include <sys/cmn_err.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS_SYSTM_H_ */
diff --git a/usr/src/compat/freebsd/sys/time.h b/usr/src/compat/freebsd/sys/time.h
new file mode 100644
index 0000000000..4e0fbfc02c
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/time.h
@@ -0,0 +1,124 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_TIME_H_
+#define	_COMPAT_FREEBSD_SYS_TIME_H_
+
+#include_next <sys/time.h>
+
+#define	tc_precexp	0
+
+struct bintime {
+	ulong_t		sec;		/* seconds */
+	uint64_t	frac;		/* 64 bit fraction of a second */
+};
+
+#define	BT2FREQ(bt)							\
+	(((uint64_t)0x8000000000000000 + ((bt)->frac >> 2)) /		\
+	    ((bt)->frac >> 1))
+
+#define	FREQ2BT(freq, bt)						\
+{									\
+	(bt)->sec = 0;							\
+	(bt)->frac = ((uint64_t)0x8000000000000000  / (freq)) << 1;	\
+}
+
+static __inline void
+binuptime(struct bintime *bt)
+{
+	hrtime_t	now = gethrtime();
+
+	bt->sec = now / 1000000000;
+	/* 18446744073 = int(2^64 / 1000000000) = 1ns in 64-bit fractions */
+	bt->frac = (now % 1000000000) * (uint64_t)18446744073LL;
+}
+
+#define	bintime_cmp(a, b, cmp)						\
+	(((a)->sec == (b)->sec) ?					\
+	    ((a)->frac cmp (b)->frac) :					\
+	    ((a)->sec cmp (b)->sec))
+
+#define SBT_1S  ((sbintime_t)1 << 32)
+#define SBT_1M  (SBT_1S * 60)
+#define SBT_1MS (SBT_1S / 1000)
+#define SBT_1US (SBT_1S / 1000000)
+#define SBT_1NS (SBT_1S / 1000000000)
+#define SBT_MAX 0x7fffffffffffffffLL
+
+
+static __inline void
+bintime_add(struct bintime *bt, const struct bintime *bt2)
+{
+	uint64_t u;
+
+	u = bt->frac;
+	bt->frac += bt2->frac;
+	if (u > bt->frac)
+		bt->sec++;
+	bt->sec += bt2->sec;
+}
+
+static __inline void
+bintime_sub(struct bintime *bt, const struct bintime *bt2)
+{
+	uint64_t u;
+
+	u = bt->frac;
+	bt->frac -= bt2->frac;
+	if (u < bt->frac)
+		bt->sec--;
+	bt->sec -= bt2->sec;
+}
+
+static __inline void
+bintime_mul(struct bintime *bt, u_int x)
+{
+	uint64_t p1, p2;
+
+	p1 = (bt->frac & 0xffffffffull) * x;
+	p2 = (bt->frac >> 32) * x + (p1 >> 32);
+	bt->sec *= x;
+	bt->sec += (p2 >> 32);
+	bt->frac = (p2 << 32) | (p1 & 0xffffffffull);
+}
+
+static __inline sbintime_t
+bttosbt(const struct bintime bt)
+{
+	return (((sbintime_t)bt.sec << 32) + (bt.frac >> 32));
+}
+
+static __inline struct bintime
+sbttobt(sbintime_t _sbt)
+{
+	struct bintime _bt;
+
+	_bt.sec = _sbt >> 32;
+	_bt.frac = _sbt << 32;
+	return (_bt);
+}
+
+static __inline sbintime_t
+sbinuptime(void)
+{
+	hrtime_t hrt = gethrtime();
+	uint64_t sec = hrt / NANOSEC;
+	uint64_t nsec = hrt % NANOSEC;
+
+	return (((sbintime_t)sec << 32) +
+	    (nsec * (((uint64_t)1 << 63) / 500000000) >> 32));
+}
+
+#endif	/* _COMPAT_FREEBSD_SYS_TIME_H_ */
diff --git a/usr/src/compat/freebsd/sys/types.h b/usr/src/compat/freebsd/sys/types.h
new file mode 100644
index 0000000000..0a2cdda951
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/types.h
@@ -0,0 +1,88 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_TYPES_H_
+#define	_COMPAT_FREEBSD_SYS_TYPES_H_
+
+#include <sys/_types.h>
+
+typedef __uint8_t	u_int8_t;	/* unsigned integrals (deprecated) */
+typedef __uint16_t	u_int16_t;
+typedef __uint32_t	u_int32_t;
+typedef __uint64_t	u_int64_t;
+
+#ifndef	__REGISTER_T_DEFINED
+#define	__REGISTER_T_DEFINED
+typedef __register_t	register_t;
+#endif
+
+#ifndef	__SBINTIME_T_DEFINED
+#define	__SBINTIME_T_DEFINED
+typedef __int64_t	sbintime_t;
+#endif
+
+#ifndef	__VM_MEMATTR_T_DEFINED
+#define	__VM_MEMATTR_T_DEFINED
+typedef char	vm_memattr_t;
+#endif
+
+#ifndef	__VM_OFFSET_T_DEFINED
+#define	__VM_OFFSET_T_DEFINED
+typedef __vm_offset_t	vm_offset_t;
+#endif
+
+#ifndef	__VM_OOFFSET_T_DEFINED
+#define	__VM_OOFFSET_T_DEFINED
+typedef __vm_ooffset_t	vm_ooffset_t;
+#endif
+
+#ifndef	__VM_PADDR_T_DEFINED
+#define	__VM_PADDR_T_DEFINED
+typedef __vm_paddr_t	vm_paddr_t;
+#endif
+
+#ifndef	__VM_PINDEX_T_DEFINED
+#define	__VM_PINDEX_T_DEFINED
+typedef __uint64_t	vm_pindex_t;
+#endif
+
+#ifndef	__VM_SIZE_T_DEFINED
+#define	__VM_SIZE_T_DEFINED
+typedef __vm_size_t	vm_size_t;
+#endif
+
+#ifndef	__VM_MEMATTR_T_DEFINED
+#define	__VM_MEMATTR_T_DEFINED
+typedef char		vm_memattr_t;
+#endif
+
+#ifndef	__bool_true_false_are_defined
+#define	__bool_true_false_are_defined	1
+#define	false	0
+#define	true	1
+typedef _Bool bool;
+#endif
+
+#if defined(_KERNEL) && !defined(offsetof)
+#define	offsetof(s, m)	((size_t)(&(((s *)0)->m)))
+#endif
+
+#if defined(_KERNEL)
+typedef struct __dev_info **device_t;
+#endif
+
+#include_next <sys/types.h>
+
+#endif	/* _COMPAT_FREEBSD_SYS_TYPES_H_ */
diff --git a/usr/src/compat/freebsd/sys/uio.h b/usr/src/compat/freebsd/sys/uio.h
new file mode 100644
index 0000000000..05c6f2a028
--- /dev/null
+++ b/usr/src/compat/freebsd/sys/uio.h
@@ -0,0 +1,26 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_SYS_UIO_H_
+#define	_COMPAT_FREEBSD_SYS_UIO_H_
+
+#include_next <sys/uio.h>
+
+#ifndef	_KERNEL
+ssize_t preadv(int, const struct iovec *, int, off_t);
+ssize_t pwritev(int, const struct iovec *, int, off_t);
+#endif
+
+#endif	/* _COMPAT_FREEBSD_SYS_UIO_H_ */
diff --git a/usr/src/compat/freebsd/termios.h b/usr/src/compat/freebsd/termios.h
new file mode 100644
index 0000000000..feaa705358
--- /dev/null
+++ b/usr/src/compat/freebsd/termios.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_TERMIOS_H_
+#define	_COMPAT_FREEBSD_TERMIOS_H_
+
+#include_next <termios.h>
+
+void	cfmakeraw(struct termios *);
+
+#endif	/* _COMPAT_FREEBSD_TERMIOS_H_ */
diff --git a/usr/src/compat/freebsd/unistd.h b/usr/src/compat/freebsd/unistd.h
new file mode 100644
index 0000000000..b4357e1da5
--- /dev/null
+++ b/usr/src/compat/freebsd/unistd.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_UNISTD_H
+#define	_COMPAT_FREEBSD_UNISTD_H
+
+#define	setproctitle(fmt, ...)
+
+#include_next <unistd.h>
+
+#endif /* _COMPAT_FREEBSD_UNISTD_H */
diff --git a/usr/src/compat/freebsd/uuid.h b/usr/src/compat/freebsd/uuid.h
new file mode 100644
index 0000000000..72ef2c7787
--- /dev/null
+++ b/usr/src/compat/freebsd/uuid.h
@@ -0,0 +1,55 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_UUID_H_
+#define	_COMPAT_FREEBSD_UUID_H_
+
+#include <sys/endian.h>
+#include <uuid/uuid.h>
+
+/* Status codes returned by the functions. */
+#define	uuid_s_ok			0
+#define	uuid_s_bad_version		1
+#define	uuid_s_invalid_string_uuid	2
+
+static __inline void
+uuid_from_string(char *str, uuid_t *uuidp, uint32_t *status)
+{
+	if (uuid_parse(str, *uuidp) == 0) {
+		*status = uuid_s_ok;
+	} else {
+		*status = uuid_s_invalid_string_uuid;
+	}
+}
+
+static __inline void
+uuid_enc_le(void *buf, uuid_t *uuidp)
+{
+	uchar_t	*p;
+	int	i;
+
+	p = buf;
+	be32enc(p, ((struct uuid *)uuidp)->time_low);
+	be16enc(p + 4, ((struct uuid *)uuidp)->time_mid);
+	be16enc(p + 6, ((struct uuid *)uuidp)->time_hi_and_version);
+	p[8] = ((struct uuid *)uuidp)->clock_seq_hi_and_reserved;
+	p[9] = ((struct uuid *)uuidp)->clock_seq_low;
+
+	for (i = 0; i < 6; i++)
+		p[10 + i] = ((struct uuid *)uuidp)->node_addr[i];
+
+}
+
+#endif	/* _COMPAT_FREEBSD_UUID_H_ */
diff --git a/usr/src/compat/freebsd/vm/vm.h b/usr/src/compat/freebsd/vm/vm.h
new file mode 100644
index 0000000000..f5bb7b6eb8
--- /dev/null
+++ b/usr/src/compat/freebsd/vm/vm.h
@@ -0,0 +1,64 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _FREEBSD_VM_VM_H_
+#define	_FREEBSD_VM_VM_H_
+
+#include <machine/vm.h>
+#include <sys/mman.h>
+
+typedef u_char vm_prot_t;
+
+/*
+ * Even though the FreeBSD VM_PROT defines happen to match illumos, this
+ * references the native values directly so there's no risk of breakage.
+ */
+#define	VM_PROT_NONE		((vm_prot_t) 0x00)
+#define	VM_PROT_READ		((vm_prot_t) PROT_READ)
+#define	VM_PROT_WRITE		((vm_prot_t) PROT_WRITE)
+#define	VM_PROT_EXECUTE		((vm_prot_t) PROT_EXEC)
+
+#define	VM_PROT_ALL		(VM_PROT_READ|VM_PROT_WRITE|VM_PROT_EXECUTE)
+#define	VM_PROT_RW		(VM_PROT_READ|VM_PROT_WRITE)
+
+struct vm_page;
+typedef struct vm_page *vm_page_t;
+
+enum obj_type { OBJT_DEFAULT, OBJT_SWAP, OBJT_VNODE, OBJT_DEVICE, OBJT_PHYS,
+    OBJT_DEAD, OBJT_SG, OBJT_MGTDEVICE };
+typedef u_char objtype_t;
+
+union vm_map_object;
+typedef union vm_map_object vm_map_object_t;
+
+struct vm_map_entry;
+typedef struct vm_map_entry *vm_map_entry_t;
+
+struct vm_map;
+typedef struct vm_map *vm_map_t;
+
+struct vm_object;
+typedef struct vm_object *vm_object_t;
+
+/*
+ * <sys/promif.h> contains a troublesome preprocessor define for BYTE.
+ * Do this ugly workaround to avoid it.
+ */
+#define	_SYS_PROMIF_H
+#include <vm/hat_i86.h>
+#undef	_SYS_PROMIF_H
+
+#endif	/* _FREEBSD_VM_VM_H_ */
diff --git a/usr/src/compat/freebsd/vm/vm_param.h b/usr/src/compat/freebsd/vm/vm_param.h
new file mode 100644
index 0000000000..8affac9d7e
--- /dev/null
+++ b/usr/src/compat/freebsd/vm/vm_param.h
@@ -0,0 +1,18 @@
+#ifndef _COMPAT_FREEBSD_VM_VM_PARAM_H_
+#define	_COMPAT_FREEBSD_VM_VM_PARAM_H_
+
+#include <machine/vmparam.h>
+
+#define	KERN_SUCCESS		0
+
+/*
+ * The VM_MAXUSER_ADDRESS is used to determine the upper limit size limit of a
+ * vmspace, their 'struct as' equivalent.  The compat value is sized well below
+ * our native userlimit, even halving the available space below the VA hole.
+ * This is to avoid Intel EPT limits and leave room available in the usabe VA
+ * range for other mmap tricks.
+ */
+#define	VM_MAXUSER_ADDRESS	0x00003ffffffffffful
+
+
+#endif	/* _COMPAT_FREEBSD_VM_VM_PARAM_H_ */
diff --git a/usr/src/compat/freebsd/x86/_types.h b/usr/src/compat/freebsd/x86/_types.h
new file mode 100644
index 0000000000..8bbae549d8
--- /dev/null
+++ b/usr/src/compat/freebsd/x86/_types.h
@@ -0,0 +1,51 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _FREEBSD_X86__TYPES_H_
+#define	_FREEBSD_X86__TYPES_H_
+
+/*
+ * Basic types upon which most other types are built.
+ */
+typedef signed char		__int8_t;
+typedef unsigned char		__uint8_t;
+typedef short			__int16_t;
+typedef unsigned short		__uint16_t;
+typedef int			__int32_t;
+typedef unsigned int		__uint32_t;
+#ifdef	_LP64
+typedef long			__int64_t;
+typedef unsigned long		__uint64_t;
+#else
+typedef long long		__int64_t;
+typedef unsigned long long	__uint64_t;
+#endif
+
+/* 
+ * Standard type definitions.
+ */
+#ifdef	_LP64
+typedef __int64_t	__register_t;
+typedef __uint64_t	__vm_offset_t;
+typedef __uint64_t	__vm_paddr_t;
+typedef __int64_t	__vm_ooffset_t;
+typedef __uint64_t	__vm_size_t;
+#else
+typedef __int32_t	__register_t;
+typedef __uint32_t	__vm_paddr_t;
+typedef __uint32_t	__vm_size_t;
+#endif
+
+#endif	/* _FREEBSD_X86__TYPES_H_ */
diff --git a/usr/src/compat/freebsd/x86/segments.h b/usr/src/compat/freebsd/x86/segments.h
new file mode 100644
index 0000000000..11edc582b5
--- /dev/null
+++ b/usr/src/compat/freebsd/x86/segments.h
@@ -0,0 +1,29 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _COMPAT_FREEBSD_X86_SEGMENTS_H
+#define	_COMPAT_FREEBSD_X86_SEGMENTS_H
+
+#if defined(_COMPAT_FREEBSD_AMD64_MACHINE_VMM_H_) || defined(_KERNEL)
+#define	IDT_UD		6	/* #UD: Undefined/Invalid Opcode */
+#define	IDT_SS		12	/* #SS: Stack Segment Fault */
+#define	IDT_GP		13	/* #GP: General Protection Fault */
+#define	IDT_AC		17	/* #AC: Alignment Check */
+#else
+#include_next <x86/segments.h>
+#endif
+
+#endif /* _COMPAT_FREEBSD_X86_SEGMENTS_H */
diff --git a/usr/src/data/Makefile b/usr/src/data/Makefile
index 2c617eb622..e6a33bc1d5 100644
--- a/usr/src/data/Makefile
+++ b/usr/src/data/Makefile
@@ -13,12 +13,16 @@
 # Copyright 2017 Nexenta Systems, Inc.
 #
 
-SUBDIRS=	consfonts \
+COMMON_SUBDIRS=	consfonts \
 		hwdata \
 		locale \
 		terminfo \
 		zoneinfo
 
+i386_SUBDIRS=	ucode
+
+SUBDIRS = $(COMMON_SUBDIRS) $($(MACH)_SUBDIRS)
+
 MSGSUBDIRS= 	zoneinfo
 
 all :=		TARGET=all
diff --git a/usr/src/data/ucode/Makefile b/usr/src/data/ucode/Makefile
new file mode 100644
index 0000000000..2fc0ecdc69
--- /dev/null
+++ b/usr/src/data/ucode/Makefile
@@ -0,0 +1,49 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+include	$(SRC)/data/Makefile.data
+
+ROOTUCODEPATH = $(ROOT)/platform/i86pc/ucode
+ROOTAMDDIR = $(ROOTUCODEPATH)/AuthenticAMD
+ROOTINTELDIR = $(ROOTUCODEPATH)/GenuineIntel
+
+AMD_FILES :sh= (cd amd; print *)
+INTEL_FILES :sh= (cd intel; print *)
+
+ROOTAMDFILES = $(AMD_FILES:%=$(ROOTAMDDIR)/%)
+ROOTINTELFILES = $(INTEL_FILES:%=$(ROOTINTELDIR)/%)
+
+$(ROOTAMDFILES) := FILEMODE = 444
+$(ROOTINTELFILES) := FILEMODE = 444
+
+all:
+
+install: $(ROOTAMDFILES) $(ROOTINTELFILES)
+
+clean:
+
+$(ROOTUCODEPATH):
+	$(INS.dir)
+
+$(ROOTINTELDIR) $(ROOTAMDDIR): $(ROOTUCODEPATH)
+	$(INS.dir)
+
+$(ROOTAMDDIR)/%: amd/% $(ROOTAMDDIR)
+	$(INS.file)
+
+$(ROOTINTELDIR)/%: intel/% $(ROOTINTELDIR)
+	$(INS.file)
+
+include	$(SRC)/data/Makefile.targ
diff --git a/usr/src/data/ucode/README.ucode b/usr/src/data/ucode/README.ucode
new file mode 100644
index 0000000000..964c984da4
--- /dev/null
+++ b/usr/src/data/ucode/README.ucode
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+Microcode Management
+
+Historically microcode files were delivered by Intel as a single
+microcode file that we would break apart and install with ucodeadm. Each
+individual file represented a single platform's microcode. However,
+recently Intel has changed that policy and is no longer distributing
+microcode in that fashion. Further, we also relied on bootadm to go
+through and turn this microcode into individual files as part of setting
+up the boot environment.
+
+Intead of using this method, we will update the microcode and manage
+them in here as individual files. When updating files, please indicate
+the release that the microcode was obtained from here.
+
+AMD: Updated in March 2012 as part of illumos#2546. Exact revision
+unknown.
+
+Intel: Linux 20180807 release
diff --git a/usr/src/data/ucode/amd/1020-00 b/usr/src/data/ucode/amd/1020-00
new file mode 100644
index 0000000000..90b2fa7493
--- /dev/null
+++ b/usr/src/data/ucode/amd/1020-00
diff --git a/usr/src/data/ucode/amd/1022-00 b/usr/src/data/ucode/amd/1022-00
new file mode 100644
index 0000000000..0b4dcf4a3c
--- /dev/null
+++ b/usr/src/data/ucode/amd/1022-00
diff --git a/usr/src/data/ucode/amd/1041-00 b/usr/src/data/ucode/amd/1041-00
new file mode 100644
index 0000000000..38dd2f051c
--- /dev/null
+++ b/usr/src/data/ucode/amd/1041-00
diff --git a/usr/src/data/ucode/amd/1043-00 b/usr/src/data/ucode/amd/1043-00
new file mode 100644
index 0000000000..67e62f350c
--- /dev/null
+++ b/usr/src/data/ucode/amd/1043-00
diff --git a/usr/src/data/ucode/amd/1062-00 b/usr/src/data/ucode/amd/1062-00
new file mode 100644
index 0000000000..f2ddfe9c79
--- /dev/null
+++ b/usr/src/data/ucode/amd/1062-00
diff --git a/usr/src/data/ucode/amd/1080-00 b/usr/src/data/ucode/amd/1080-00
new file mode 100644
index 0000000000..3d2b265241
--- /dev/null
+++ b/usr/src/data/ucode/amd/1080-00
diff --git a/usr/src/data/ucode/amd/1081-00 b/usr/src/data/ucode/amd/1081-00
new file mode 100644
index 0000000000..4b5d2a9a82
--- /dev/null
+++ b/usr/src/data/ucode/amd/1081-00
diff --git a/usr/src/data/ucode/amd/10A0-00 b/usr/src/data/ucode/amd/10A0-00
new file mode 100644
index 0000000000..8423a6ceb9
--- /dev/null
+++ b/usr/src/data/ucode/amd/10A0-00
diff --git a/usr/src/data/ucode/amd/3010-00 b/usr/src/data/ucode/amd/3010-00
new file mode 100644
index 0000000000..dd59a1dc63
--- /dev/null
+++ b/usr/src/data/ucode/amd/3010-00
diff --git a/usr/src/data/ucode/amd/5010-00 b/usr/src/data/ucode/amd/5010-00
new file mode 100644
index 0000000000..49eb4aa83c
--- /dev/null
+++ b/usr/src/data/ucode/amd/5010-00
diff --git a/usr/src/data/ucode/amd/5020-00 b/usr/src/data/ucode/amd/5020-00
new file mode 100644
index 0000000000..23576ab88d
--- /dev/null
+++ b/usr/src/data/ucode/amd/5020-00
diff --git a/usr/src/data/ucode/amd/6012-00 b/usr/src/data/ucode/amd/6012-00
new file mode 100644
index 0000000000..38a88d14a2
--- /dev/null
+++ b/usr/src/data/ucode/amd/6012-00
diff --git a/usr/src/cmd/ucodeadm/amd-ucode.bin b/usr/src/data/ucode/amd/container
index 365d279d2b..365d279d2b 100644
--- a/usr/src/cmd/ucodeadm/amd-ucode.bin
+++ b/usr/src/data/ucode/amd/container
diff --git a/usr/src/data/ucode/amd/equivalence-table b/usr/src/data/ucode/amd/equivalence-table
new file mode 100644
index 0000000000..ebb2f9ca32
--- /dev/null
+++ b/usr/src/data/ucode/amd/equivalence-table
diff --git a/usr/src/data/ucode/intel/00000650-01 b/usr/src/data/ucode/intel/00000650-01
new file mode 100644
index 0000000000..4c2ef88238
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000650-01
diff --git a/usr/src/data/ucode/intel/00000650-02 b/usr/src/data/ucode/intel/00000650-02
new file mode 100644
index 0000000000..bc435ffeeb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000650-02
diff --git a/usr/src/data/ucode/intel/00000650-08 b/usr/src/data/ucode/intel/00000650-08
new file mode 100644
index 0000000000..024c99adef
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000650-08
diff --git a/usr/src/data/ucode/intel/00000651-01 b/usr/src/data/ucode/intel/00000651-01
new file mode 100644
index 0000000000..de548de5b5
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000651-01
diff --git a/usr/src/data/ucode/intel/00000652-01 b/usr/src/data/ucode/intel/00000652-01
new file mode 100644
index 0000000000..504bf00bf8
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000652-01
diff --git a/usr/src/data/ucode/intel/00000652-02 b/usr/src/data/ucode/intel/00000652-02
new file mode 100644
index 0000000000..bb54e0593d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000652-02
diff --git a/usr/src/data/ucode/intel/00000652-04 b/usr/src/data/ucode/intel/00000652-04
new file mode 100644
index 0000000000..7f14be12bf
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000652-04
diff --git a/usr/src/data/ucode/intel/00000653-01 b/usr/src/data/ucode/intel/00000653-01
new file mode 100644
index 0000000000..c6c16edadb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000653-01
diff --git a/usr/src/data/ucode/intel/00000653-02 b/usr/src/data/ucode/intel/00000653-02
new file mode 100644
index 0000000000..e6826c7e97
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000653-02
diff --git a/usr/src/data/ucode/intel/00000653-04 b/usr/src/data/ucode/intel/00000653-04
new file mode 100644
index 0000000000..9a4b29227c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000653-04
diff --git a/usr/src/data/ucode/intel/00000653-08 b/usr/src/data/ucode/intel/00000653-08
new file mode 100644
index 0000000000..58cafddeeb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000653-08
diff --git a/usr/src/data/ucode/intel/00000660-01 b/usr/src/data/ucode/intel/00000660-01
new file mode 100644
index 0000000000..fd9a8a7393
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000660-01
diff --git a/usr/src/data/ucode/intel/00000665-10 b/usr/src/data/ucode/intel/00000665-10
new file mode 100644
index 0000000000..522c0dbc8e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000665-10
diff --git a/usr/src/data/ucode/intel/0000066A-02 b/usr/src/data/ucode/intel/0000066A-02
new file mode 100644
index 0000000000..436eca39e2
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000066A-02
diff --git a/usr/src/data/ucode/intel/0000066A-08 b/usr/src/data/ucode/intel/0000066A-08
new file mode 100644
index 0000000000..86f1ad9aca
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000066A-08
diff --git a/usr/src/data/ucode/intel/0000066A-20 b/usr/src/data/ucode/intel/0000066A-20
new file mode 100644
index 0000000000..21e79c059d
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000066A-20
diff --git a/usr/src/data/ucode/intel/0000066D-02 b/usr/src/data/ucode/intel/0000066D-02
new file mode 100644
index 0000000000..08954cb7ae
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000066D-02
diff --git a/usr/src/data/ucode/intel/0000066D-08 b/usr/src/data/ucode/intel/0000066D-08
new file mode 100644
index 0000000000..d3dca5782a
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000066D-08
diff --git a/usr/src/data/ucode/intel/0000066D-20 b/usr/src/data/ucode/intel/0000066D-20
new file mode 100644
index 0000000000..d64c6b022e
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000066D-20
diff --git a/usr/src/data/ucode/intel/00000671-04 b/usr/src/data/ucode/intel/00000671-04
new file mode 100644
index 0000000000..e030715551
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000671-04
diff --git a/usr/src/data/ucode/intel/00000672-04 b/usr/src/data/ucode/intel/00000672-04
new file mode 100644
index 0000000000..d6c9bb7b3b
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000672-04
diff --git a/usr/src/data/ucode/intel/00000673-04 b/usr/src/data/ucode/intel/00000673-04
new file mode 100644
index 0000000000..ad8bfe4ac5
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000673-04
diff --git a/usr/src/data/ucode/intel/00000681-01 b/usr/src/data/ucode/intel/00000681-01
new file mode 100644
index 0000000000..2302408265
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000681-01
diff --git a/usr/src/data/ucode/intel/00000681-04 b/usr/src/data/ucode/intel/00000681-04
new file mode 100644
index 0000000000..d4b7c18cf3
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000681-04
diff --git a/usr/src/data/ucode/intel/00000681-08 b/usr/src/data/ucode/intel/00000681-08
new file mode 100644
index 0000000000..553798b3cc
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000681-08
diff --git a/usr/src/data/ucode/intel/00000681-10 b/usr/src/data/ucode/intel/00000681-10
new file mode 100644
index 0000000000..d76f38e8aa
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000681-10
diff --git a/usr/src/data/ucode/intel/00000681-20 b/usr/src/data/ucode/intel/00000681-20
new file mode 100644
index 0000000000..0b34c33f42
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000681-20
diff --git a/usr/src/data/ucode/intel/00000683-08 b/usr/src/data/ucode/intel/00000683-08
new file mode 100644
index 0000000000..cc44f2e43d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000683-08
diff --git a/usr/src/data/ucode/intel/00000683-20 b/usr/src/data/ucode/intel/00000683-20
new file mode 100644
index 0000000000..e8d7ab19e9
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000683-20
diff --git a/usr/src/data/ucode/intel/00000686-01 b/usr/src/data/ucode/intel/00000686-01
new file mode 100644
index 0000000000..8597cdd78e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000686-01
diff --git a/usr/src/data/ucode/intel/00000686-02 b/usr/src/data/ucode/intel/00000686-02
new file mode 100644
index 0000000000..8171109e83
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000686-02
diff --git a/usr/src/data/ucode/intel/00000686-04 b/usr/src/data/ucode/intel/00000686-04
new file mode 100644
index 0000000000..d867f495fe
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000686-04
diff --git a/usr/src/data/ucode/intel/00000686-10 b/usr/src/data/ucode/intel/00000686-10
new file mode 100644
index 0000000000..2278e65ea3
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000686-10
diff --git a/usr/src/data/ucode/intel/00000686-80 b/usr/src/data/ucode/intel/00000686-80
new file mode 100644
index 0000000000..10d643b885
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000686-80
diff --git a/usr/src/data/ucode/intel/0000068A-10 b/usr/src/data/ucode/intel/0000068A-10
new file mode 100644
index 0000000000..fbe0f22c1d
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000068A-10
diff --git a/usr/src/data/ucode/intel/0000068A-20 b/usr/src/data/ucode/intel/0000068A-20
new file mode 100644
index 0000000000..2d16db613d
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000068A-20
diff --git a/usr/src/data/ucode/intel/0000068A-80 b/usr/src/data/ucode/intel/0000068A-80
new file mode 100644
index 0000000000..a6fbe3d0e1
--- /dev/null
+++ b/usr/src/data/ucode/intel/0000068A-80
diff --git a/usr/src/data/ucode/intel/00000695-10 b/usr/src/data/ucode/intel/00000695-10
new file mode 100644
index 0000000000..5d6be17ece
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000695-10
diff --git a/usr/src/data/ucode/intel/00000695-20 b/usr/src/data/ucode/intel/00000695-20
new file mode 100644
index 0000000000..5bf5b04a6a
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000695-20
diff --git a/usr/src/data/ucode/intel/00000695-80 b/usr/src/data/ucode/intel/00000695-80
new file mode 100644
index 0000000000..3ebc524cb3
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000695-80
diff --git a/usr/src/data/ucode/intel/000006A0-04 b/usr/src/data/ucode/intel/000006A0-04
new file mode 100644
index 0000000000..184c3f4966
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006A0-04
diff --git a/usr/src/data/ucode/intel/000006A1-04 b/usr/src/data/ucode/intel/000006A1-04
new file mode 100644
index 0000000000..2fef7ceef5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006A1-04
diff --git a/usr/src/data/ucode/intel/000006B1-10 b/usr/src/data/ucode/intel/000006B1-10
new file mode 100644
index 0000000000..e1ef496135
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006B1-10
diff --git a/usr/src/data/ucode/intel/000006B1-20 b/usr/src/data/ucode/intel/000006B1-20
new file mode 100644
index 0000000000..9139601f13
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006B1-20
diff --git a/usr/src/data/ucode/intel/000006B4-10 b/usr/src/data/ucode/intel/000006B4-10
new file mode 100644
index 0000000000..562d0b7fe3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006B4-10
diff --git a/usr/src/data/ucode/intel/000006B4-20 b/usr/src/data/ucode/intel/000006B4-20
new file mode 100644
index 0000000000..5c711dc4e4
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006B4-20
diff --git a/usr/src/data/ucode/intel/000006D6-20 b/usr/src/data/ucode/intel/000006D6-20
new file mode 100644
index 0000000000..d11772c734
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006D6-20
diff --git a/usr/src/data/ucode/intel/000006E8-20 b/usr/src/data/ucode/intel/000006E8-20
new file mode 100644
index 0000000000..d31fa24037
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006E8-20
diff --git a/usr/src/data/ucode/intel/000006EC-20 b/usr/src/data/ucode/intel/000006EC-20
new file mode 100644
index 0000000000..459d820490
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006EC-20
diff --git a/usr/src/data/ucode/intel/000006EC-80 b/usr/src/data/ucode/intel/000006EC-80
new file mode 100644
index 0000000000..96fae71937
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006EC-80
diff --git a/usr/src/data/ucode/intel/000006F2-01 b/usr/src/data/ucode/intel/000006F2-01
new file mode 100644
index 0000000000..8ea3708f9c
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006F2-01
diff --git a/usr/src/data/ucode/intel/000006F2-20 b/usr/src/data/ucode/intel/000006F2-20
new file mode 100644
index 0000000000..315855b4c1
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006F2-20
diff --git a/usr/src/data/ucode/intel/000006F6-01 b/usr/src/data/ucode/intel/000006F6-01
new file mode 100644
index 0000000000..75ee10d8dc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006F6-01
diff --git a/usr/src/data/ucode/intel/000006F6-04 b/usr/src/data/ucode/intel/000006F6-04
new file mode 100644
index 0000000000..040b8e84e4
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006F6-04
diff --git a/usr/src/data/ucode/intel/000006F6-20 b/usr/src/data/ucode/intel/000006F6-20
new file mode 100644
index 0000000000..9f7367d29f
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006F6-20
diff --git a/usr/src/data/ucode/intel/000006F7-10 b/usr/src/data/ucode/intel/000006F7-10
new file mode 100644
index 0000000000..f6c6943f04
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006F7-10
diff --git a/usr/src/data/ucode/intel/000006F7-40 b/usr/src/data/ucode/intel/000006F7-40
new file mode 100644
index 0000000000..f3c7391264
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006F7-40
diff --git a/usr/src/data/ucode/intel/000006FA-80 b/usr/src/data/ucode/intel/000006FA-80
new file mode 100644
index 0000000000..436e607f50
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FA-80
diff --git a/usr/src/data/ucode/intel/000006FB-01 b/usr/src/data/ucode/intel/000006FB-01
new file mode 100644
index 0000000000..5db8260d47
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FB-01
diff --git a/usr/src/data/ucode/intel/000006FB-04 b/usr/src/data/ucode/intel/000006FB-04
new file mode 100644
index 0000000000..4e39490881
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FB-04
diff --git a/usr/src/data/ucode/intel/000006FB-08 b/usr/src/data/ucode/intel/000006FB-08
new file mode 100644
index 0000000000..9a2dfac887
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FB-08
diff --git a/usr/src/data/ucode/intel/000006FB-10 b/usr/src/data/ucode/intel/000006FB-10
new file mode 100644
index 0000000000..37a384b304
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FB-10
diff --git a/usr/src/data/ucode/intel/000006FB-20 b/usr/src/data/ucode/intel/000006FB-20
new file mode 100644
index 0000000000..ef1aebb160
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FB-20
diff --git a/usr/src/data/ucode/intel/000006FB-40 b/usr/src/data/ucode/intel/000006FB-40
new file mode 100644
index 0000000000..b5c6b8a156
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FB-40
diff --git a/usr/src/data/ucode/intel/000006FB-80 b/usr/src/data/ucode/intel/000006FB-80
new file mode 100644
index 0000000000..69ba2c8caf
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FB-80
diff --git a/usr/src/data/ucode/intel/000006FD-01 b/usr/src/data/ucode/intel/000006FD-01
new file mode 100644
index 0000000000..c687fca979
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FD-01
diff --git a/usr/src/data/ucode/intel/000006FD-20 b/usr/src/data/ucode/intel/000006FD-20
new file mode 100644
index 0000000000..f3b1bb675c
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FD-20
diff --git a/usr/src/data/ucode/intel/000006FD-80 b/usr/src/data/ucode/intel/000006FD-80
new file mode 100644
index 0000000000..9fb5a1792a
--- /dev/null
+++ b/usr/src/data/ucode/intel/000006FD-80
diff --git a/usr/src/data/ucode/intel/00000F07-01 b/usr/src/data/ucode/intel/00000F07-01
new file mode 100644
index 0000000000..c3ee79363b
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F07-01
diff --git a/usr/src/data/ucode/intel/00000F07-02 b/usr/src/data/ucode/intel/00000F07-02
new file mode 100644
index 0000000000..e576b38237
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F07-02
diff --git a/usr/src/data/ucode/intel/00000F0A-01 b/usr/src/data/ucode/intel/00000F0A-01
new file mode 100644
index 0000000000..2a68390fbf
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F0A-01
diff --git a/usr/src/data/ucode/intel/00000F0A-02 b/usr/src/data/ucode/intel/00000F0A-02
new file mode 100644
index 0000000000..15a5b2d86e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F0A-02
diff --git a/usr/src/data/ucode/intel/00000F0A-04 b/usr/src/data/ucode/intel/00000F0A-04
new file mode 100644
index 0000000000..326c32b04e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F0A-04
diff --git a/usr/src/data/ucode/intel/00000F12-04 b/usr/src/data/ucode/intel/00000F12-04
new file mode 100644
index 0000000000..a789e0d8e8
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F12-04
diff --git a/usr/src/data/ucode/intel/00000F24-02 b/usr/src/data/ucode/intel/00000F24-02
new file mode 100644
index 0000000000..38d85214bc
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F24-02
diff --git a/usr/src/data/ucode/intel/00000F24-04 b/usr/src/data/ucode/intel/00000F24-04
new file mode 100644
index 0000000000..78a2849b18
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F24-04
diff --git a/usr/src/data/ucode/intel/00000F24-10 b/usr/src/data/ucode/intel/00000F24-10
new file mode 100644
index 0000000000..7910a9c4a7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F24-10
diff --git a/usr/src/data/ucode/intel/00000F25-01 b/usr/src/data/ucode/intel/00000F25-01
new file mode 100644
index 0000000000..1aa952f623
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F25-01
diff --git a/usr/src/data/ucode/intel/00000F25-02 b/usr/src/data/ucode/intel/00000F25-02
new file mode 100644
index 0000000000..74aa5a9459
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F25-02
diff --git a/usr/src/data/ucode/intel/00000F25-04 b/usr/src/data/ucode/intel/00000F25-04
new file mode 100644
index 0000000000..ce10b1a227
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F25-04
diff --git a/usr/src/data/ucode/intel/00000F25-10 b/usr/src/data/ucode/intel/00000F25-10
new file mode 100644
index 0000000000..b8029973c5
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F25-10
diff --git a/usr/src/data/ucode/intel/00000F26-02 b/usr/src/data/ucode/intel/00000F26-02
new file mode 100644
index 0000000000..1fe95c1dc2
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F26-02
diff --git a/usr/src/data/ucode/intel/00000F27-02 b/usr/src/data/ucode/intel/00000F27-02
new file mode 100644
index 0000000000..5449a348f3
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F27-02
diff --git a/usr/src/data/ucode/intel/00000F27-04 b/usr/src/data/ucode/intel/00000F27-04
new file mode 100644
index 0000000000..8cd537f074
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F27-04
diff --git a/usr/src/data/ucode/intel/00000F27-08 b/usr/src/data/ucode/intel/00000F27-08
new file mode 100644
index 0000000000..8d4cd25bd6
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F27-08
diff --git a/usr/src/data/ucode/intel/00000F29-02 b/usr/src/data/ucode/intel/00000F29-02
new file mode 100644
index 0000000000..5f54b32594
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F29-02
diff --git a/usr/src/data/ucode/intel/00000F29-04 b/usr/src/data/ucode/intel/00000F29-04
new file mode 100644
index 0000000000..98699c9d50
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F29-04
diff --git a/usr/src/data/ucode/intel/00000F29-08 b/usr/src/data/ucode/intel/00000F29-08
new file mode 100644
index 0000000000..06ca575f40
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F29-08
diff --git a/usr/src/data/ucode/intel/00000F32-01 b/usr/src/data/ucode/intel/00000F32-01
new file mode 100644
index 0000000000..00271ee25e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F32-01
diff --git a/usr/src/data/ucode/intel/00000F32-04 b/usr/src/data/ucode/intel/00000F32-04
new file mode 100644
index 0000000000..00271ee25e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F32-04
diff --git a/usr/src/data/ucode/intel/00000F32-08 b/usr/src/data/ucode/intel/00000F32-08
new file mode 100644
index 0000000000..00271ee25e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F32-08
diff --git a/usr/src/data/ucode/intel/00000F33-01 b/usr/src/data/ucode/intel/00000F33-01
new file mode 100644
index 0000000000..10300a2bb9
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F33-01
diff --git a/usr/src/data/ucode/intel/00000F33-04 b/usr/src/data/ucode/intel/00000F33-04
new file mode 100644
index 0000000000..10300a2bb9
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F33-04
diff --git a/usr/src/data/ucode/intel/00000F33-08 b/usr/src/data/ucode/intel/00000F33-08
new file mode 100644
index 0000000000..10300a2bb9
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F33-08
diff --git a/usr/src/data/ucode/intel/00000F34-01 b/usr/src/data/ucode/intel/00000F34-01
new file mode 100644
index 0000000000..27f2b9b27f
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F34-01
diff --git a/usr/src/data/ucode/intel/00000F34-04 b/usr/src/data/ucode/intel/00000F34-04
new file mode 100644
index 0000000000..27f2b9b27f
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F34-04
diff --git a/usr/src/data/ucode/intel/00000F34-08 b/usr/src/data/ucode/intel/00000F34-08
new file mode 100644
index 0000000000..27f2b9b27f
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F34-08
diff --git a/usr/src/data/ucode/intel/00000F34-10 b/usr/src/data/ucode/intel/00000F34-10
new file mode 100644
index 0000000000..27f2b9b27f
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F34-10
diff --git a/usr/src/data/ucode/intel/00000F41-01 b/usr/src/data/ucode/intel/00000F41-01
new file mode 100644
index 0000000000..2eeb60c67c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F41-01
diff --git a/usr/src/data/ucode/intel/00000F41-02 b/usr/src/data/ucode/intel/00000F41-02
new file mode 100644
index 0000000000..be5756d367
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F41-02
diff --git a/usr/src/data/ucode/intel/00000F41-04 b/usr/src/data/ucode/intel/00000F41-04
new file mode 100644
index 0000000000..2eeb60c67c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F41-04
diff --git a/usr/src/data/ucode/intel/00000F41-08 b/usr/src/data/ucode/intel/00000F41-08
new file mode 100644
index 0000000000..2eeb60c67c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F41-08
diff --git a/usr/src/data/ucode/intel/00000F41-10 b/usr/src/data/ucode/intel/00000F41-10
new file mode 100644
index 0000000000..2eeb60c67c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F41-10
diff --git a/usr/src/data/ucode/intel/00000F41-20 b/usr/src/data/ucode/intel/00000F41-20
new file mode 100644
index 0000000000..2eeb60c67c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F41-20
diff --git a/usr/src/data/ucode/intel/00000F41-80 b/usr/src/data/ucode/intel/00000F41-80
new file mode 100644
index 0000000000..2eeb60c67c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F41-80
diff --git a/usr/src/data/ucode/intel/00000F43-01 b/usr/src/data/ucode/intel/00000F43-01
new file mode 100644
index 0000000000..0ed7e18fd7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F43-01
diff --git a/usr/src/data/ucode/intel/00000F43-04 b/usr/src/data/ucode/intel/00000F43-04
new file mode 100644
index 0000000000..0ed7e18fd7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F43-04
diff --git a/usr/src/data/ucode/intel/00000F43-08 b/usr/src/data/ucode/intel/00000F43-08
new file mode 100644
index 0000000000..0ed7e18fd7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F43-08
diff --git a/usr/src/data/ucode/intel/00000F43-10 b/usr/src/data/ucode/intel/00000F43-10
new file mode 100644
index 0000000000..0ed7e18fd7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F43-10
diff --git a/usr/src/data/ucode/intel/00000F43-80 b/usr/src/data/ucode/intel/00000F43-80
new file mode 100644
index 0000000000..0ed7e18fd7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F43-80
diff --git a/usr/src/data/ucode/intel/00000F44-01 b/usr/src/data/ucode/intel/00000F44-01
new file mode 100644
index 0000000000..669f65966c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F44-01
diff --git a/usr/src/data/ucode/intel/00000F44-04 b/usr/src/data/ucode/intel/00000F44-04
new file mode 100644
index 0000000000..669f65966c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F44-04
diff --git a/usr/src/data/ucode/intel/00000F44-08 b/usr/src/data/ucode/intel/00000F44-08
new file mode 100644
index 0000000000..669f65966c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F44-08
diff --git a/usr/src/data/ucode/intel/00000F44-10 b/usr/src/data/ucode/intel/00000F44-10
new file mode 100644
index 0000000000..669f65966c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F44-10
diff --git a/usr/src/data/ucode/intel/00000F44-80 b/usr/src/data/ucode/intel/00000F44-80
new file mode 100644
index 0000000000..669f65966c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F44-80
diff --git a/usr/src/data/ucode/intel/00000F47-01 b/usr/src/data/ucode/intel/00000F47-01
new file mode 100644
index 0000000000..0d2190c32c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F47-01
diff --git a/usr/src/data/ucode/intel/00000F47-04 b/usr/src/data/ucode/intel/00000F47-04
new file mode 100644
index 0000000000..0d2190c32c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F47-04
diff --git a/usr/src/data/ucode/intel/00000F47-08 b/usr/src/data/ucode/intel/00000F47-08
new file mode 100644
index 0000000000..0d2190c32c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F47-08
diff --git a/usr/src/data/ucode/intel/00000F47-10 b/usr/src/data/ucode/intel/00000F47-10
new file mode 100644
index 0000000000..0d2190c32c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F47-10
diff --git a/usr/src/data/ucode/intel/00000F47-80 b/usr/src/data/ucode/intel/00000F47-80
new file mode 100644
index 0000000000..0d2190c32c
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F47-80
diff --git a/usr/src/data/ucode/intel/00000F48-01 b/usr/src/data/ucode/intel/00000F48-01
new file mode 100644
index 0000000000..68f5e45583
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F48-01
diff --git a/usr/src/data/ucode/intel/00000F48-02 b/usr/src/data/ucode/intel/00000F48-02
new file mode 100644
index 0000000000..3382e18a61
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F48-02
diff --git a/usr/src/data/ucode/intel/00000F48-04 b/usr/src/data/ucode/intel/00000F48-04
new file mode 100644
index 0000000000..8e0a1fb8f2
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F48-04
diff --git a/usr/src/data/ucode/intel/00000F48-08 b/usr/src/data/ucode/intel/00000F48-08
new file mode 100644
index 0000000000..8e0a1fb8f2
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F48-08
diff --git a/usr/src/data/ucode/intel/00000F48-10 b/usr/src/data/ucode/intel/00000F48-10
new file mode 100644
index 0000000000..8e0a1fb8f2
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F48-10
diff --git a/usr/src/data/ucode/intel/00000F48-40 b/usr/src/data/ucode/intel/00000F48-40
new file mode 100644
index 0000000000..8e0a1fb8f2
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F48-40
diff --git a/usr/src/data/ucode/intel/00000F49-01 b/usr/src/data/ucode/intel/00000F49-01
new file mode 100644
index 0000000000..3307178dfb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F49-01
diff --git a/usr/src/data/ucode/intel/00000F49-04 b/usr/src/data/ucode/intel/00000F49-04
new file mode 100644
index 0000000000..3307178dfb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F49-04
diff --git a/usr/src/data/ucode/intel/00000F49-08 b/usr/src/data/ucode/intel/00000F49-08
new file mode 100644
index 0000000000..3307178dfb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F49-08
diff --git a/usr/src/data/ucode/intel/00000F49-10 b/usr/src/data/ucode/intel/00000F49-10
new file mode 100644
index 0000000000..3307178dfb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F49-10
diff --git a/usr/src/data/ucode/intel/00000F49-20 b/usr/src/data/ucode/intel/00000F49-20
new file mode 100644
index 0000000000..3307178dfb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F49-20
diff --git a/usr/src/data/ucode/intel/00000F49-80 b/usr/src/data/ucode/intel/00000F49-80
new file mode 100644
index 0000000000..3307178dfb
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F49-80
diff --git a/usr/src/data/ucode/intel/00000F4A-01 b/usr/src/data/ucode/intel/00000F4A-01
new file mode 100644
index 0000000000..35463bb4d9
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F4A-01
diff --git a/usr/src/data/ucode/intel/00000F4A-04 b/usr/src/data/ucode/intel/00000F4A-04
new file mode 100644
index 0000000000..f788f5e404
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F4A-04
diff --git a/usr/src/data/ucode/intel/00000F4A-08 b/usr/src/data/ucode/intel/00000F4A-08
new file mode 100644
index 0000000000..f788f5e404
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F4A-08
diff --git a/usr/src/data/ucode/intel/00000F4A-10 b/usr/src/data/ucode/intel/00000F4A-10
new file mode 100644
index 0000000000..f788f5e404
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F4A-10
diff --git a/usr/src/data/ucode/intel/00000F4A-40 b/usr/src/data/ucode/intel/00000F4A-40
new file mode 100644
index 0000000000..f788f5e404
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F4A-40
diff --git a/usr/src/data/ucode/intel/00000F62-04 b/usr/src/data/ucode/intel/00000F62-04
new file mode 100644
index 0000000000..dbf381c060
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F62-04
diff --git a/usr/src/data/ucode/intel/00000F64-01 b/usr/src/data/ucode/intel/00000F64-01
new file mode 100644
index 0000000000..7759473c0e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F64-01
diff --git a/usr/src/data/ucode/intel/00000F64-04 b/usr/src/data/ucode/intel/00000F64-04
new file mode 100644
index 0000000000..30c70da5ba
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F64-04
diff --git a/usr/src/data/ucode/intel/00000F64-10 b/usr/src/data/ucode/intel/00000F64-10
new file mode 100644
index 0000000000..30c70da5ba
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F64-10
diff --git a/usr/src/data/ucode/intel/00000F64-20 b/usr/src/data/ucode/intel/00000F64-20
new file mode 100644
index 0000000000..30c70da5ba
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F64-20
diff --git a/usr/src/data/ucode/intel/00000F65-01 b/usr/src/data/ucode/intel/00000F65-01
new file mode 100644
index 0000000000..d02b9dc0ad
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F65-01
diff --git a/usr/src/data/ucode/intel/00000F68-02 b/usr/src/data/ucode/intel/00000F68-02
new file mode 100644
index 0000000000..bdc81f4050
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F68-02
diff --git a/usr/src/data/ucode/intel/00000F68-20 b/usr/src/data/ucode/intel/00000F68-20
new file mode 100644
index 0000000000..bdc81f4050
--- /dev/null
+++ b/usr/src/data/ucode/intel/00000F68-20
diff --git a/usr/src/data/ucode/intel/00001632-00 b/usr/src/data/ucode/intel/00001632-00
new file mode 100644
index 0000000000..7543c59589
--- /dev/null
+++ b/usr/src/data/ucode/intel/00001632-00
diff --git a/usr/src/data/ucode/intel/00010661-01 b/usr/src/data/ucode/intel/00010661-01
new file mode 100644
index 0000000000..454a8b7c54
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010661-01
diff --git a/usr/src/data/ucode/intel/00010661-02 b/usr/src/data/ucode/intel/00010661-02
new file mode 100644
index 0000000000..f4ea3a13bd
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010661-02
diff --git a/usr/src/data/ucode/intel/00010661-80 b/usr/src/data/ucode/intel/00010661-80
new file mode 100644
index 0000000000..94f9a15a14
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010661-80
diff --git a/usr/src/data/ucode/intel/00010676-01 b/usr/src/data/ucode/intel/00010676-01
new file mode 100644
index 0000000000..3bf310b9e7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010676-01
diff --git a/usr/src/data/ucode/intel/00010676-04 b/usr/src/data/ucode/intel/00010676-04
new file mode 100644
index 0000000000..054f581a11
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010676-04
diff --git a/usr/src/data/ucode/intel/00010676-10 b/usr/src/data/ucode/intel/00010676-10
new file mode 100644
index 0000000000..778688e458
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010676-10
diff --git a/usr/src/data/ucode/intel/00010676-40 b/usr/src/data/ucode/intel/00010676-40
new file mode 100644
index 0000000000..db8492ab53
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010676-40
diff --git a/usr/src/data/ucode/intel/00010676-80 b/usr/src/data/ucode/intel/00010676-80
new file mode 100644
index 0000000000..b39f57edf8
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010676-80
diff --git a/usr/src/data/ucode/intel/00010677-10 b/usr/src/data/ucode/intel/00010677-10
new file mode 100644
index 0000000000..cc6bc811e8
--- /dev/null
+++ b/usr/src/data/ucode/intel/00010677-10
diff --git a/usr/src/data/ucode/intel/0001067A-01 b/usr/src/data/ucode/intel/0001067A-01
new file mode 100644
index 0000000000..6341a6125a
--- /dev/null
+++ b/usr/src/data/ucode/intel/0001067A-01
diff --git a/usr/src/data/ucode/intel/0001067A-04 b/usr/src/data/ucode/intel/0001067A-04
new file mode 100644
index 0000000000..5a1ae4530e
--- /dev/null
+++ b/usr/src/data/ucode/intel/0001067A-04
diff --git a/usr/src/data/ucode/intel/0001067A-10 b/usr/src/data/ucode/intel/0001067A-10
new file mode 100644
index 0000000000..6341a6125a
--- /dev/null
+++ b/usr/src/data/ucode/intel/0001067A-10
diff --git a/usr/src/data/ucode/intel/0001067A-20 b/usr/src/data/ucode/intel/0001067A-20
new file mode 100644
index 0000000000..aa845f7e7b
--- /dev/null
+++ b/usr/src/data/ucode/intel/0001067A-20
diff --git a/usr/src/data/ucode/intel/0001067A-40 b/usr/src/data/ucode/intel/0001067A-40
new file mode 100644
index 0000000000..5a1ae4530e
--- /dev/null
+++ b/usr/src/data/ucode/intel/0001067A-40
diff --git a/usr/src/data/ucode/intel/0001067A-80 b/usr/src/data/ucode/intel/0001067A-80
new file mode 100644
index 0000000000..aa845f7e7b
--- /dev/null
+++ b/usr/src/data/ucode/intel/0001067A-80
diff --git a/usr/src/data/ucode/intel/000106A4-01 b/usr/src/data/ucode/intel/000106A4-01
new file mode 100644
index 0000000000..4604f50e05
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106A4-01
diff --git a/usr/src/data/ucode/intel/000106A4-02 b/usr/src/data/ucode/intel/000106A4-02
new file mode 100644
index 0000000000..4604f50e05
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106A4-02
diff --git a/usr/src/data/ucode/intel/000106A5-01 b/usr/src/data/ucode/intel/000106A5-01
new file mode 100644
index 0000000000..154e08c826
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106A5-01
diff --git a/usr/src/data/ucode/intel/000106A5-02 b/usr/src/data/ucode/intel/000106A5-02
new file mode 100644
index 0000000000..154e08c826
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106A5-02
diff --git a/usr/src/data/ucode/intel/000106C2-01 b/usr/src/data/ucode/intel/000106C2-01
new file mode 100644
index 0000000000..6d860133b5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106C2-01
diff --git a/usr/src/data/ucode/intel/000106C2-04 b/usr/src/data/ucode/intel/000106C2-04
new file mode 100644
index 0000000000..92e0653cce
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106C2-04
diff --git a/usr/src/data/ucode/intel/000106C2-08 b/usr/src/data/ucode/intel/000106C2-08
new file mode 100644
index 0000000000..44103836d4
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106C2-08
diff --git a/usr/src/data/ucode/intel/000106CA-01 b/usr/src/data/ucode/intel/000106CA-01
new file mode 100644
index 0000000000..ab184fa76c
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106CA-01
diff --git a/usr/src/data/ucode/intel/000106CA-04 b/usr/src/data/ucode/intel/000106CA-04
new file mode 100644
index 0000000000..587f80d7bd
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106CA-04
diff --git a/usr/src/data/ucode/intel/000106CA-08 b/usr/src/data/ucode/intel/000106CA-08
new file mode 100644
index 0000000000..2908c08243
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106CA-08
diff --git a/usr/src/data/ucode/intel/000106CA-10 b/usr/src/data/ucode/intel/000106CA-10
new file mode 100644
index 0000000000..46bc63d087
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106CA-10
diff --git a/usr/src/data/ucode/intel/000106D1-08 b/usr/src/data/ucode/intel/000106D1-08
new file mode 100644
index 0000000000..fc9c5f4333
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106D1-08
diff --git a/usr/src/data/ucode/intel/000106E5-01 b/usr/src/data/ucode/intel/000106E5-01
new file mode 100644
index 0000000000..b692f51dd2
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106E5-01
diff --git a/usr/src/data/ucode/intel/000106E5-02 b/usr/src/data/ucode/intel/000106E5-02
new file mode 100644
index 0000000000..b692f51dd2
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106E5-02
diff --git a/usr/src/data/ucode/intel/000106E5-10 b/usr/src/data/ucode/intel/000106E5-10
new file mode 100644
index 0000000000..b692f51dd2
--- /dev/null
+++ b/usr/src/data/ucode/intel/000106E5-10
diff --git a/usr/src/data/ucode/intel/00020652-02 b/usr/src/data/ucode/intel/00020652-02
new file mode 100644
index 0000000000..f63ee5581e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00020652-02
diff --git a/usr/src/data/ucode/intel/00020652-10 b/usr/src/data/ucode/intel/00020652-10
new file mode 100644
index 0000000000..f63ee5581e
--- /dev/null
+++ b/usr/src/data/ucode/intel/00020652-10
diff --git a/usr/src/data/ucode/intel/00020655-02 b/usr/src/data/ucode/intel/00020655-02
new file mode 100644
index 0000000000..06bbbc501d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00020655-02
diff --git a/usr/src/data/ucode/intel/00020655-10 b/usr/src/data/ucode/intel/00020655-10
new file mode 100644
index 0000000000..06bbbc501d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00020655-10
diff --git a/usr/src/data/ucode/intel/00020655-80 b/usr/src/data/ucode/intel/00020655-80
new file mode 100644
index 0000000000..06bbbc501d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00020655-80
diff --git a/usr/src/data/ucode/intel/00020661-01 b/usr/src/data/ucode/intel/00020661-01
new file mode 100644
index 0000000000..feec6c7e03
--- /dev/null
+++ b/usr/src/data/ucode/intel/00020661-01
diff --git a/usr/src/data/ucode/intel/00020661-02 b/usr/src/data/ucode/intel/00020661-02
new file mode 100644
index 0000000000..81fb416c3d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00020661-02
diff --git a/usr/src/data/ucode/intel/000206A7-02 b/usr/src/data/ucode/intel/000206A7-02
new file mode 100644
index 0000000000..e20cdbf957
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206A7-02
diff --git a/usr/src/data/ucode/intel/000206A7-10 b/usr/src/data/ucode/intel/000206A7-10
new file mode 100644
index 0000000000..e20cdbf957
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206A7-10
diff --git a/usr/src/data/ucode/intel/000206C2-01 b/usr/src/data/ucode/intel/000206C2-01
new file mode 100644
index 0000000000..2a78b4a4d2
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206C2-01
diff --git a/usr/src/data/ucode/intel/000206C2-02 b/usr/src/data/ucode/intel/000206C2-02
new file mode 100644
index 0000000000..2a78b4a4d2
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206C2-02
diff --git a/usr/src/data/ucode/intel/000206D6-01 b/usr/src/data/ucode/intel/000206D6-01
new file mode 100644
index 0000000000..d89a291172
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D6-01
diff --git a/usr/src/data/ucode/intel/000206D6-04 b/usr/src/data/ucode/intel/000206D6-04
new file mode 100644
index 0000000000..d89a291172
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D6-04
diff --git a/usr/src/data/ucode/intel/000206D6-08 b/usr/src/data/ucode/intel/000206D6-08
new file mode 100644
index 0000000000..d89a291172
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D6-08
diff --git a/usr/src/data/ucode/intel/000206D6-20 b/usr/src/data/ucode/intel/000206D6-20
new file mode 100644
index 0000000000..d89a291172
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D6-20
diff --git a/usr/src/data/ucode/intel/000206D6-40 b/usr/src/data/ucode/intel/000206D6-40
new file mode 100644
index 0000000000..d89a291172
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D6-40
diff --git a/usr/src/data/ucode/intel/000206D7-01 b/usr/src/data/ucode/intel/000206D7-01
new file mode 100644
index 0000000000..0da2b9e3f5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D7-01
diff --git a/usr/src/data/ucode/intel/000206D7-04 b/usr/src/data/ucode/intel/000206D7-04
new file mode 100644
index 0000000000..0da2b9e3f5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D7-04
diff --git a/usr/src/data/ucode/intel/000206D7-08 b/usr/src/data/ucode/intel/000206D7-08
new file mode 100644
index 0000000000..0da2b9e3f5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D7-08
diff --git a/usr/src/data/ucode/intel/000206D7-20 b/usr/src/data/ucode/intel/000206D7-20
new file mode 100644
index 0000000000..0da2b9e3f5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D7-20
diff --git a/usr/src/data/ucode/intel/000206D7-40 b/usr/src/data/ucode/intel/000206D7-40
new file mode 100644
index 0000000000..0da2b9e3f5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206D7-40
diff --git a/usr/src/data/ucode/intel/000206E6-04 b/usr/src/data/ucode/intel/000206E6-04
new file mode 100644
index 0000000000..1ec0402183
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206E6-04
diff --git a/usr/src/data/ucode/intel/000206F2-01 b/usr/src/data/ucode/intel/000206F2-01
new file mode 100644
index 0000000000..8cebe97f86
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206F2-01
diff --git a/usr/src/data/ucode/intel/000206F2-04 b/usr/src/data/ucode/intel/000206F2-04
new file mode 100644
index 0000000000..8cebe97f86
--- /dev/null
+++ b/usr/src/data/ucode/intel/000206F2-04
diff --git a/usr/src/data/ucode/intel/000306A9-02 b/usr/src/data/ucode/intel/000306A9-02
new file mode 100644
index 0000000000..f965ba53d5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306A9-02
diff --git a/usr/src/data/ucode/intel/000306A9-10 b/usr/src/data/ucode/intel/000306A9-10
new file mode 100644
index 0000000000..f965ba53d5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306A9-10
diff --git a/usr/src/data/ucode/intel/000306C3-02 b/usr/src/data/ucode/intel/000306C3-02
new file mode 100644
index 0000000000..4dd6664e28
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306C3-02
diff --git a/usr/src/data/ucode/intel/000306C3-10 b/usr/src/data/ucode/intel/000306C3-10
new file mode 100644
index 0000000000..4dd6664e28
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306C3-10
diff --git a/usr/src/data/ucode/intel/000306C3-20 b/usr/src/data/ucode/intel/000306C3-20
new file mode 100644
index 0000000000..4dd6664e28
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306C3-20
diff --git a/usr/src/data/ucode/intel/000306D4-40 b/usr/src/data/ucode/intel/000306D4-40
new file mode 100644
index 0000000000..64d13670df
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306D4-40
diff --git a/usr/src/data/ucode/intel/000306D4-80 b/usr/src/data/ucode/intel/000306D4-80
new file mode 100644
index 0000000000..64d13670df
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306D4-80
diff --git a/usr/src/data/ucode/intel/000306E4-01 b/usr/src/data/ucode/intel/000306E4-01
new file mode 100644
index 0000000000..c9792b7515
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E4-01
diff --git a/usr/src/data/ucode/intel/000306E4-04 b/usr/src/data/ucode/intel/000306E4-04
new file mode 100644
index 0000000000..c9792b7515
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E4-04
diff --git a/usr/src/data/ucode/intel/000306E4-08 b/usr/src/data/ucode/intel/000306E4-08
new file mode 100644
index 0000000000..c9792b7515
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E4-08
diff --git a/usr/src/data/ucode/intel/000306E4-20 b/usr/src/data/ucode/intel/000306E4-20
new file mode 100644
index 0000000000..c9792b7515
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E4-20
diff --git a/usr/src/data/ucode/intel/000306E4-40 b/usr/src/data/ucode/intel/000306E4-40
new file mode 100644
index 0000000000..c9792b7515
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E4-40
diff --git a/usr/src/data/ucode/intel/000306E4-80 b/usr/src/data/ucode/intel/000306E4-80
new file mode 100644
index 0000000000..c9792b7515
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E4-80
diff --git a/usr/src/data/ucode/intel/000306E6-01 b/usr/src/data/ucode/intel/000306E6-01
new file mode 100644
index 0000000000..41b2d07cd3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E6-01
diff --git a/usr/src/data/ucode/intel/000306E6-04 b/usr/src/data/ucode/intel/000306E6-04
new file mode 100644
index 0000000000..41b2d07cd3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E6-04
diff --git a/usr/src/data/ucode/intel/000306E6-08 b/usr/src/data/ucode/intel/000306E6-08
new file mode 100644
index 0000000000..41b2d07cd3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E6-08
diff --git a/usr/src/data/ucode/intel/000306E6-20 b/usr/src/data/ucode/intel/000306E6-20
new file mode 100644
index 0000000000..41b2d07cd3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E6-20
diff --git a/usr/src/data/ucode/intel/000306E6-40 b/usr/src/data/ucode/intel/000306E6-40
new file mode 100644
index 0000000000..41b2d07cd3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E6-40
diff --git a/usr/src/data/ucode/intel/000306E6-80 b/usr/src/data/ucode/intel/000306E6-80
new file mode 100644
index 0000000000..41b2d07cd3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E6-80
diff --git a/usr/src/data/ucode/intel/000306E7-01 b/usr/src/data/ucode/intel/000306E7-01
new file mode 100644
index 0000000000..94415b1fa1
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E7-01
diff --git a/usr/src/data/ucode/intel/000306E7-04 b/usr/src/data/ucode/intel/000306E7-04
new file mode 100644
index 0000000000..94415b1fa1
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E7-04
diff --git a/usr/src/data/ucode/intel/000306E7-08 b/usr/src/data/ucode/intel/000306E7-08
new file mode 100644
index 0000000000..94415b1fa1
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E7-08
diff --git a/usr/src/data/ucode/intel/000306E7-20 b/usr/src/data/ucode/intel/000306E7-20
new file mode 100644
index 0000000000..94415b1fa1
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E7-20
diff --git a/usr/src/data/ucode/intel/000306E7-40 b/usr/src/data/ucode/intel/000306E7-40
new file mode 100644
index 0000000000..94415b1fa1
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E7-40
diff --git a/usr/src/data/ucode/intel/000306E7-80 b/usr/src/data/ucode/intel/000306E7-80
new file mode 100644
index 0000000000..94415b1fa1
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306E7-80
diff --git a/usr/src/data/ucode/intel/000306F2-01 b/usr/src/data/ucode/intel/000306F2-01
new file mode 100644
index 0000000000..d6f7d702fc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306F2-01
diff --git a/usr/src/data/ucode/intel/000306F2-02 b/usr/src/data/ucode/intel/000306F2-02
new file mode 100644
index 0000000000..d6f7d702fc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306F2-02
diff --git a/usr/src/data/ucode/intel/000306F2-04 b/usr/src/data/ucode/intel/000306F2-04
new file mode 100644
index 0000000000..d6f7d702fc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306F2-04
diff --git a/usr/src/data/ucode/intel/000306F2-08 b/usr/src/data/ucode/intel/000306F2-08
new file mode 100644
index 0000000000..d6f7d702fc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306F2-08
diff --git a/usr/src/data/ucode/intel/000306F2-20 b/usr/src/data/ucode/intel/000306F2-20
new file mode 100644
index 0000000000..d6f7d702fc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306F2-20
diff --git a/usr/src/data/ucode/intel/000306F2-40 b/usr/src/data/ucode/intel/000306F2-40
new file mode 100644
index 0000000000..d6f7d702fc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306F2-40
diff --git a/usr/src/data/ucode/intel/000306F4-80 b/usr/src/data/ucode/intel/000306F4-80
new file mode 100644
index 0000000000..f5967028bd
--- /dev/null
+++ b/usr/src/data/ucode/intel/000306F4-80
diff --git a/usr/src/data/ucode/intel/00040651-02 b/usr/src/data/ucode/intel/00040651-02
new file mode 100644
index 0000000000..62a2dc9d13
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040651-02
diff --git a/usr/src/data/ucode/intel/00040651-10 b/usr/src/data/ucode/intel/00040651-10
new file mode 100644
index 0000000000..62a2dc9d13
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040651-10
diff --git a/usr/src/data/ucode/intel/00040651-20 b/usr/src/data/ucode/intel/00040651-20
new file mode 100644
index 0000000000..62a2dc9d13
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040651-20
diff --git a/usr/src/data/ucode/intel/00040651-40 b/usr/src/data/ucode/intel/00040651-40
new file mode 100644
index 0000000000..62a2dc9d13
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040651-40
diff --git a/usr/src/data/ucode/intel/00040661-02 b/usr/src/data/ucode/intel/00040661-02
new file mode 100644
index 0000000000..ee019bb34b
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040661-02
diff --git a/usr/src/data/ucode/intel/00040661-10 b/usr/src/data/ucode/intel/00040661-10
new file mode 100644
index 0000000000..ee019bb34b
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040661-10
diff --git a/usr/src/data/ucode/intel/00040661-20 b/usr/src/data/ucode/intel/00040661-20
new file mode 100644
index 0000000000..ee019bb34b
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040661-20
diff --git a/usr/src/data/ucode/intel/00040671-02 b/usr/src/data/ucode/intel/00040671-02
new file mode 100644
index 0000000000..ed8a37ce73
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040671-02
diff --git a/usr/src/data/ucode/intel/00040671-20 b/usr/src/data/ucode/intel/00040671-20
new file mode 100644
index 0000000000..ed8a37ce73
--- /dev/null
+++ b/usr/src/data/ucode/intel/00040671-20
diff --git a/usr/src/data/ucode/intel/000406E3-40 b/usr/src/data/ucode/intel/000406E3-40
new file mode 100644
index 0000000000..96a70f69b7
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406E3-40
diff --git a/usr/src/data/ucode/intel/000406E3-80 b/usr/src/data/ucode/intel/000406E3-80
new file mode 100644
index 0000000000..96a70f69b7
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406E3-80
diff --git a/usr/src/data/ucode/intel/000406F1-01 b/usr/src/data/ucode/intel/000406F1-01
new file mode 100644
index 0000000000..ff10f9a341
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406F1-01
diff --git a/usr/src/data/ucode/intel/000406F1-02 b/usr/src/data/ucode/intel/000406F1-02
new file mode 100644
index 0000000000..ff10f9a341
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406F1-02
diff --git a/usr/src/data/ucode/intel/000406F1-04 b/usr/src/data/ucode/intel/000406F1-04
new file mode 100644
index 0000000000..ff10f9a341
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406F1-04
diff --git a/usr/src/data/ucode/intel/000406F1-08 b/usr/src/data/ucode/intel/000406F1-08
new file mode 100644
index 0000000000..ff10f9a341
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406F1-08
diff --git a/usr/src/data/ucode/intel/000406F1-20 b/usr/src/data/ucode/intel/000406F1-20
new file mode 100644
index 0000000000..ff10f9a341
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406F1-20
diff --git a/usr/src/data/ucode/intel/000406F1-40 b/usr/src/data/ucode/intel/000406F1-40
new file mode 100644
index 0000000000..ff10f9a341
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406F1-40
diff --git a/usr/src/data/ucode/intel/000406F1-80 b/usr/src/data/ucode/intel/000406F1-80
new file mode 100644
index 0000000000..ff10f9a341
--- /dev/null
+++ b/usr/src/data/ucode/intel/000406F1-80
diff --git a/usr/src/data/ucode/intel/00050653-01 b/usr/src/data/ucode/intel/00050653-01
new file mode 100644
index 0000000000..e3a7b02c14
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050653-01
diff --git a/usr/src/data/ucode/intel/00050653-02 b/usr/src/data/ucode/intel/00050653-02
new file mode 100644
index 0000000000..e3a7b02c14
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050653-02
diff --git a/usr/src/data/ucode/intel/00050653-04 b/usr/src/data/ucode/intel/00050653-04
new file mode 100644
index 0000000000..e3a7b02c14
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050653-04
diff --git a/usr/src/data/ucode/intel/00050653-10 b/usr/src/data/ucode/intel/00050653-10
new file mode 100644
index 0000000000..e3a7b02c14
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050653-10
diff --git a/usr/src/data/ucode/intel/00050653-80 b/usr/src/data/ucode/intel/00050653-80
new file mode 100644
index 0000000000..e3a7b02c14
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050653-80
diff --git a/usr/src/data/ucode/intel/00050654-01 b/usr/src/data/ucode/intel/00050654-01
new file mode 100644
index 0000000000..dda53a919d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050654-01
diff --git a/usr/src/data/ucode/intel/00050654-02 b/usr/src/data/ucode/intel/00050654-02
new file mode 100644
index 0000000000..dda53a919d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050654-02
diff --git a/usr/src/data/ucode/intel/00050654-04 b/usr/src/data/ucode/intel/00050654-04
new file mode 100644
index 0000000000..dda53a919d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050654-04
diff --git a/usr/src/data/ucode/intel/00050654-10 b/usr/src/data/ucode/intel/00050654-10
new file mode 100644
index 0000000000..dda53a919d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050654-10
diff --git a/usr/src/data/ucode/intel/00050654-20 b/usr/src/data/ucode/intel/00050654-20
new file mode 100644
index 0000000000..dda53a919d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050654-20
diff --git a/usr/src/data/ucode/intel/00050654-80 b/usr/src/data/ucode/intel/00050654-80
new file mode 100644
index 0000000000..dda53a919d
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050654-80
diff --git a/usr/src/data/ucode/intel/00050662-10 b/usr/src/data/ucode/intel/00050662-10
new file mode 100644
index 0000000000..44c2a7f731
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050662-10
diff --git a/usr/src/data/ucode/intel/00050663-10 b/usr/src/data/ucode/intel/00050663-10
new file mode 100644
index 0000000000..bdf73e86c9
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050663-10
diff --git a/usr/src/data/ucode/intel/00050664-10 b/usr/src/data/ucode/intel/00050664-10
new file mode 100644
index 0000000000..d2b33205f7
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050664-10
diff --git a/usr/src/data/ucode/intel/00050665-10 b/usr/src/data/ucode/intel/00050665-10
new file mode 100644
index 0000000000..2b38ee5d70
--- /dev/null
+++ b/usr/src/data/ucode/intel/00050665-10
diff --git a/usr/src/data/ucode/intel/000506C2-01 b/usr/src/data/ucode/intel/000506C2-01
new file mode 100644
index 0000000000..387e1e23f7
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506C2-01
diff --git a/usr/src/data/ucode/intel/000506C9-01 b/usr/src/data/ucode/intel/000506C9-01
new file mode 100644
index 0000000000..a9739ad0b5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506C9-01
diff --git a/usr/src/data/ucode/intel/000506C9-02 b/usr/src/data/ucode/intel/000506C9-02
new file mode 100644
index 0000000000..a9739ad0b5
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506C9-02
diff --git a/usr/src/data/ucode/intel/000506CA-01 b/usr/src/data/ucode/intel/000506CA-01
new file mode 100644
index 0000000000..792380734f
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506CA-01
diff --git a/usr/src/data/ucode/intel/000506CA-02 b/usr/src/data/ucode/intel/000506CA-02
new file mode 100644
index 0000000000..792380734f
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506CA-02
diff --git a/usr/src/data/ucode/intel/000506E3-02 b/usr/src/data/ucode/intel/000506E3-02
new file mode 100644
index 0000000000..6e2cd0f68d
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506E3-02
diff --git a/usr/src/data/ucode/intel/000506E3-04 b/usr/src/data/ucode/intel/000506E3-04
new file mode 100644
index 0000000000..6e2cd0f68d
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506E3-04
diff --git a/usr/src/data/ucode/intel/000506E3-10 b/usr/src/data/ucode/intel/000506E3-10
new file mode 100644
index 0000000000..6e2cd0f68d
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506E3-10
diff --git a/usr/src/data/ucode/intel/000506E3-20 b/usr/src/data/ucode/intel/000506E3-20
new file mode 100644
index 0000000000..6e2cd0f68d
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506E3-20
diff --git a/usr/src/data/ucode/intel/000506F1-01 b/usr/src/data/ucode/intel/000506F1-01
new file mode 100644
index 0000000000..83b441b9bc
--- /dev/null
+++ b/usr/src/data/ucode/intel/000506F1-01
diff --git a/usr/src/data/ucode/intel/000706A1-01 b/usr/src/data/ucode/intel/000706A1-01
new file mode 100644
index 0000000000..6fe711f7ce
--- /dev/null
+++ b/usr/src/data/ucode/intel/000706A1-01
diff --git a/usr/src/data/ucode/intel/000806E9-40 b/usr/src/data/ucode/intel/000806E9-40
new file mode 100644
index 0000000000..c03eb315a3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000806E9-40
diff --git a/usr/src/data/ucode/intel/000806E9-80 b/usr/src/data/ucode/intel/000806E9-80
new file mode 100644
index 0000000000..c03eb315a3
--- /dev/null
+++ b/usr/src/data/ucode/intel/000806E9-80
diff --git a/usr/src/data/ucode/intel/000806EA-40 b/usr/src/data/ucode/intel/000806EA-40
new file mode 100644
index 0000000000..641d07ef43
--- /dev/null
+++ b/usr/src/data/ucode/intel/000806EA-40
diff --git a/usr/src/data/ucode/intel/000806EA-80 b/usr/src/data/ucode/intel/000806EA-80
new file mode 100644
index 0000000000..641d07ef43
--- /dev/null
+++ b/usr/src/data/ucode/intel/000806EA-80
diff --git a/usr/src/data/ucode/intel/000906E9-02 b/usr/src/data/ucode/intel/000906E9-02
new file mode 100644
index 0000000000..a1cc285d60
--- /dev/null
+++ b/usr/src/data/ucode/intel/000906E9-02
diff --git a/usr/src/data/ucode/intel/000906E9-08 b/usr/src/data/ucode/intel/000906E9-08
new file mode 100644
index 0000000000..a1cc285d60
--- /dev/null
+++ b/usr/src/data/ucode/intel/000906E9-08
diff --git a/usr/src/data/ucode/intel/000906E9-20 b/usr/src/data/ucode/intel/000906E9-20
new file mode 100644
index 0000000000..a1cc285d60
--- /dev/null
+++ b/usr/src/data/ucode/intel/000906E9-20
diff --git a/usr/src/data/ucode/intel/000906EA-02 b/usr/src/data/ucode/intel/000906EA-02
new file mode 100644
index 0000000000..f4475ceea7
--- /dev/null
+++ b/usr/src/data/ucode/intel/000906EA-02
diff --git a/usr/src/data/ucode/intel/000906EA-20 b/usr/src/data/ucode/intel/000906EA-20
new file mode 100644
index 0000000000..f4475ceea7
--- /dev/null
+++ b/usr/src/data/ucode/intel/000906EA-20
diff --git a/usr/src/data/ucode/intel/000906EB-02 b/usr/src/data/ucode/intel/000906EB-02
new file mode 100644
index 0000000000..e0c1b96628
--- /dev/null
+++ b/usr/src/data/ucode/intel/000906EB-02
diff --git a/usr/src/grub/Makefile b/usr/src/grub/Makefile
index 28c2eca2ff..c31e9a802c 100644
--- a/usr/src/grub/Makefile
+++ b/usr/src/grub/Makefile
@@ -29,6 +29,7 @@ INST_TARGETS += $(ROOT_BOOT_GRUB)/$(GRUB_MENU)
 INST_TARGETS += $(ROOT_BOOT_GRUB)/$(INSTALL_MENU)
 INST_TARGETS += $(ROOT_BOOT_GRUB)/$(GRUB_DEFAULT)
 INST_TARGETS += $(ROOT_BOOT_GRUB)/$(CAPABILITY)
+INST_TARGETS += $(ROOT_USR_SBIN)/grub
 
 $(ROOT_BOOT_GRUB)/$(GRUB_DEFAULT)   := FILEMODE = 444
 $(ROOT_BOOT_GRUB)/$(CAPABILITY)   := FILEMODE = 444
@@ -45,9 +46,14 @@ $(GRUB): FRC
 $(ROOT_BOOT_GRUB)/%: $(ROOT_BOOT_GRUB) %
 	$(INS.file)
 
+$(ROOT_USR_SBIN)/%: $(GRUB)/grub/grub $(ROOT_USR_SBIN)
+	$(INS.file)
+
 $(ROOT_BOOT_GRUB):
 	$(INS.dir)
 
+$(ROOT_USR_SBIN):
+	$(INS.dir)
 
 clean clobber: $(SUBDIRS)
 
diff --git a/usr/src/grub/Makefile.grub b/usr/src/grub/Makefile.grub
index 18354324ae..99942fa2ed 100644
--- a/usr/src/grub/Makefile.grub
+++ b/usr/src/grub/Makefile.grub
@@ -10,3 +10,4 @@ PLATFORM	= i86pc
 ROOT_BOOT_GRUB	= $(ROOT)/boot/grub
 ROOT_PLAT_GRUB	= $(ROOT)/platform/$(PLATFORM)/boot/grub
 ROOT_SRC	= $(ROOT)/usr/share/src/grub
+ROOT_USR_SBIN	= $(ROOT)/usr/sbin
diff --git a/usr/src/grub/grub-0.97/stage2/boot.c b/usr/src/grub/grub-0.97/stage2/boot.c
index cfc2336a4c..027de7709b 100644
--- a/usr/src/grub/grub-0.97/stage2/boot.c
+++ b/usr/src/grub/grub-0.97/stage2/boot.c
@@ -25,6 +25,8 @@
 #include "imgact_aout.h"
 #include "i386-elf.h"
 
+#define	SAFE_LOAD_BASE	0xc800000
+
 static int cur_addr;
 entry_func entry_addr;
 static struct mod_list mll[99];
@@ -773,6 +775,17 @@ load_module (char *module, char *arg)
 {
   int len;
 
+  /*
+   * XXX Workaround for RICHMOND-16: on some systems, the region
+   * [c700000, c800000) is corrupted by an unknown external (off-CPU) actor(s)
+   * during boot.  To be on the safe side, we will simply ensure that every
+   * module is loaded above this region.  Note that this means this particular
+   * boot loader supports only systems with at least 200 MB of DRAM plus the
+   * amount of space used by any modules.
+   */
+  if (cur_addr < SAFE_LOAD_BASE)
+    cur_addr = SAFE_LOAD_BASE;
+
   /* if we are supposed to load on 4K boundaries */
   cur_addr = (cur_addr + 0xFFF) & 0xFFFFF000;
 
diff --git a/usr/src/grub/grub-0.97/stage2/cmdline.c b/usr/src/grub/grub-0.97/stage2/cmdline.c
index 46c5fda027..6d5591e1de 100644
--- a/usr/src/grub/grub-0.97/stage2/cmdline.c
+++ b/usr/src/grub/grub-0.97/stage2/cmdline.c
@@ -212,8 +212,27 @@ run_script (char *script, char *heap)
 	     intervention.  */
 	  if (fallback_entryno < 0)
 	    {
-	      grub_printf ("\nPress any key to continue...");
-	      (void) getkey ();
+             int time1, time2 = -1;
+
+             grub_printf (
+                "\nRebooting in 2 minutes (press any key to continue)...");
+             grub_timeout = 120;
+
+             /* using RT clock now, need to initialize value */
+             while ((time1 = getrtsecs()) == 0xFF);
+
+             while (grub_timeout >= 0) {
+               if ((time1 = getrtsecs()) != time2 && time1 != 0xFF) {
+                  time2 = time1;
+                  grub_timeout--;
+               }
+
+               if (checkkey() >= 0)
+                 break;
+             }
+
+             grub_printf ("\nresetting...");
+             grub_reboot();
 	    }
 	  
 	  return 1;
diff --git a/usr/src/head/Makefile b/usr/src/head/Makefile
index e9beffdf71..562664bde5 100644
--- a/usr/src/head/Makefile
+++ b/usr/src/head/Makefile
@@ -25,13 +25,16 @@
 # Copyright 2013 Garrett D'Amore <garrett@damore.org>
 # Copyright 2015 Igor Kozhukhov <ikozhukhov@gmail.com>
 # Copyright 2017 Nexenta Systems, Inc.
+# Copyright 2017 Joyent, Inc.
 #
 
 # include global definitions
 include ../Makefile.master
 
 sparc_HDRS=
-i386_HDRS=	stack_unwind.h
+i386_HDRS=		\
+	stack_unwind.h	\
+	bhyve.h
 
 KRB5HDRS=		\
 	mit_copyright.h	\
@@ -156,6 +159,7 @@ HDRS=   $($(MACH)_HDRS)	\
 	regex.h		\
 	regexp.h	\
 	resolv.h	\
+	resolv_joy.h	\
 	rje.h		\
 	rtld_db.h	\
 	sac.h		\
@@ -219,6 +223,7 @@ HDRS=   $($(MACH)_HDRS)	\
 	xlocale.h	\
 	xti.h		\
 	xti_inet.h	\
+	zdoor.h		\
 	zone.h
 
 ISOHDRS = \
diff --git a/usr/src/head/bhyve.h b/usr/src/head/bhyve.h
new file mode 100644
index 0000000000..8c79ca1ccc
--- /dev/null
+++ b/usr/src/head/bhyve.h
@@ -0,0 +1,25 @@
+/*
+ * COPYRIGHT 2013 Pluribus Networks Inc.
+ *
+ * All rights reserved. This copyright notice is Copyright Management
+ * Information under 17 USC 1202 and is included to protect this work and
+ * deter copyright infringement.  Removal or alteration of this Copyright
+ * Management Information without the express written permission from
+ * Pluribus Networks Inc is prohibited, and any such unauthorized removal
+ * or alteration will be a violation of federal law.
+ */
+#ifndef	_BHYVE_H
+#define	_BHYVE_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	BHYVE_TMPDIR			"/var/run/bhyve"
+#define	BHYVE_CONS_SOCKPATH		BHYVE_TMPDIR "/%s.console_sock"
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _BHYVE_H */
diff --git a/usr/src/head/libzonecfg.h b/usr/src/head/libzonecfg.h
index 7db0d126c7..4121b6a490 100644
--- a/usr/src/head/libzonecfg.h
+++ b/usr/src/head/libzonecfg.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #ifndef _LIBZONECFG_H
@@ -42,6 +43,7 @@ extern "C" {
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <net/if.h>
+#include <sys/mac.h>
 #include <stdio.h>
 #include <rctl.h>
 #include <zone.h>
@@ -118,6 +120,8 @@ extern "C" {
 
 #define	ZONE_STATE_MAXSTRLEN	14
 
+#define	ZONE_PROP_MAXSTRLEN	1024
+
 #define	LIBZONECFG_PATH		"libzonecfg.so.1"
 
 #define	ZONE_CONFIG_ROOT	"/etc/zones"
@@ -127,6 +131,8 @@ extern "C" {
 #define	MAXAUTHS		4096
 #define	ZONE_MGMT_PROF		"Zone Management"
 
+#define	ZONE_INT32SZ		11		/* string to hold 32bit int. */
+
 /* Owner, group, and mode (defined by packaging) for the config directory */
 #define	ZONE_CONFIG_UID		0		/* root */
 #define	ZONE_CONFIG_GID		3		/* sys */
@@ -150,9 +156,11 @@ extern "C" {
 #define	ALIAS_MAXSEMIDS		"max-sem-ids"
 #define	ALIAS_MAXLOCKEDMEM	"locked"
 #define	ALIAS_MAXSWAP		"swap"
+#define	ALIAS_MAXPHYSMEM	"physical"
 #define	ALIAS_SHARES		"cpu-shares"
 #define	ALIAS_CPUCAP		"cpu-cap"
 #define	ALIAS_MAXPROCS		"max-processes"
+#define	ALIAS_ZFSPRI		"zfs-io-priority"
 
 /* Default name for zone detached manifest */
 #define	ZONE_DETACHED	"SUNWdetached.xml"
@@ -162,6 +170,11 @@ extern "C" {
  */
 #define	ZONE_DRY_RUN		0x01
 
+typedef enum zone_iptype {
+	ZS_SHARED,
+	ZS_EXCLUSIVE
+} zone_iptype_t;
+
 /*
  * The integer field expresses the current values on a get.
  * On a put, it represents the new values if >= 0 or "don't change" if < 0.
@@ -172,6 +185,9 @@ struct zoneent {
 	char	zone_path[MAXPATHLEN];		/* path to zone storage */
 	uuid_t	zone_uuid;			/* unique ID for zone */
 	char	zone_newname[ZONENAME_MAX];	/* for doing renames */
+	char	zone_brand[MAXNAMELEN];		/* zone's brand */
+	zone_iptype_t zone_iptype;		/* zone's IP type */
+	zoneid_t zone_did;			/* persistent debug ID */
 };
 
 typedef struct zone_dochandle *zone_dochandle_t;	/* opaque handle */
@@ -191,15 +207,30 @@ struct zone_fstab {
 	char		zone_fs_raw[MAXPATHLEN];	/* device to fsck */
 };
 
+/*
+ * Generic resource attribute list.
+ * Key/value resource that can be attached to net or device.
+ */
+struct zone_res_attrtab {
+	char	zone_res_attr_name[MAXNAMELEN];
+	char	zone_res_attr_value[ZONE_PROP_MAXSTRLEN];
+	struct zone_res_attrtab *zone_res_attr_next;
+};
+
 struct zone_nwiftab {
 	char	zone_nwif_address[INET6_ADDRSTRLEN]; /* shared-ip only */
 	char	zone_nwif_allowed_address[INET6_ADDRSTRLEN]; /* excl-ip only */
 	char	zone_nwif_physical[LIFNAMSIZ];
+	char	zone_nwif_mac[MAXMACADDRLEN];		/* excl-ip only */
+	char	zone_nwif_vlan_id[ZONE_INT32SZ];	/* excl-ip only */
+	char	zone_nwif_gnic[LIFNAMSIZ];		/* excl-ip only */
 	char	zone_nwif_defrouter[INET6_ADDRSTRLEN];
+	struct zone_res_attrtab *zone_nwif_attrp;
 };
 
 struct zone_devtab {
 	char	zone_dev_match[MAXPATHLEN];
+	struct zone_res_attrtab *zone_dev_attrp;
 };
 
 struct zone_rctlvaltab {
@@ -230,10 +261,6 @@ struct zone_psettab {
 	char	zone_importance[MAXNAMELEN];
 };
 
-struct zone_mcaptab {
-	char	zone_physmem_cap[MAXNAMELEN];
-};
-
 struct zone_pkgtab {
 	char	zone_pkg_name[MAXNAMELEN];
 	char	zone_pkg_version[ZONE_PKG_VERSMAX];
@@ -271,11 +298,6 @@ typedef struct {
 	char		*zpe_vers;
 } zone_pkg_entry_t;
 
-typedef enum zone_iptype {
-	ZS_SHARED,
-	ZS_EXCLUSIVE
-} zone_iptype_t;
-
 /*
  * Basic configuration management routines.
  */
@@ -303,6 +325,7 @@ extern	boolean_t zonecfg_valid_importance(char *);
 extern	int	zonecfg_str_to_bytes(char *, uint64_t *);
 extern	boolean_t zonecfg_valid_memlimit(char *, uint64_t *);
 extern	boolean_t zonecfg_valid_alias_limit(char *, char *, uint64_t *);
+extern	void	zonecfg_notify_create(zone_dochandle_t);
 
 /*
  * Zone name, path to zone directory, autoboot setting, pool, boot
@@ -324,6 +347,8 @@ extern	int	zonecfg_set_bootargs(zone_dochandle_t, char *);
 extern	int	zonecfg_get_sched_class(zone_dochandle_t, char *, size_t);
 extern	int	zonecfg_set_sched(zone_dochandle_t, char *);
 extern	int	zonecfg_get_dflt_sched_class(zone_dochandle_t, char *, int);
+extern	zoneid_t zonecfg_get_did(zone_dochandle_t);
+extern	void	zonecfg_set_did(zone_dochandle_t);
 
 /*
  * Set/retrieve the brand for the zone
@@ -348,6 +373,15 @@ extern	int	zonecfg_find_mounts(char *, int(*)(const struct mnttab *,
     void *), void *);
 
 /*
+ * Resource key/value attributes (properties).
+ */
+extern	int	zonecfg_add_res_attr(struct zone_res_attrtab **,
+    struct zone_res_attrtab *);
+extern	void	zonecfg_free_res_attr_list(struct zone_res_attrtab *);
+extern	int	zonecfg_remove_res_attr(struct zone_res_attrtab **,
+    struct zone_res_attrtab *);
+
+/*
  * Network interface configuration.
  */
 extern	int	zonecfg_add_nwif(zone_dochandle_t, struct zone_nwiftab *);
@@ -428,13 +462,6 @@ extern	int	zonecfg_delete_pset(zone_dochandle_t);
 extern	int	zonecfg_modify_pset(zone_dochandle_t, struct zone_psettab *);
 extern	int	zonecfg_lookup_pset(zone_dochandle_t, struct zone_psettab *);
 
-/*
- * mem-cap configuration.
- */
-extern	int	zonecfg_delete_mcap(zone_dochandle_t);
-extern	int	zonecfg_modify_mcap(zone_dochandle_t, struct zone_mcaptab *);
-extern	int	zonecfg_lookup_mcap(zone_dochandle_t, struct zone_mcaptab *);
-
 /* security-flags configuration */
 extern	int	zonecfg_add_secflags(zone_dochandle_t,
     struct zone_secflagstab *);
@@ -502,7 +529,6 @@ extern	int	zonecfg_setdsent(zone_dochandle_t);
 extern	int	zonecfg_getdsent(zone_dochandle_t, struct zone_dstab *);
 extern	int	zonecfg_enddsent(zone_dochandle_t);
 extern	int	zonecfg_getpsetent(zone_dochandle_t, struct zone_psettab *);
-extern	int	zonecfg_getmcapent(zone_dochandle_t, struct zone_mcaptab *);
 extern	int	zonecfg_getpkgdata(zone_dochandle_t, uu_avl_pool_t *,
     uu_avl_t *);
 extern	int	zonecfg_setdevperment(zone_dochandle_t);
@@ -528,6 +554,7 @@ extern	int	zonecfg_set_limitpriv(zone_dochandle_t, char *);
  * Higher-level routines.
  */
 extern  int	zone_get_brand(char *, char *, size_t);
+extern  zoneid_t zone_get_did(char *);
 extern	int	zone_get_rootpath(char *, char *, size_t);
 extern	int	zone_get_devroot(char *, char *, size_t);
 extern	int	zone_get_zonepath(char *, char *, size_t);
@@ -536,7 +563,9 @@ extern	int	zone_set_state(char *, zone_state_t);
 extern	char	*zone_state_str(zone_state_t);
 extern	int	zonecfg_get_name_by_uuid(const uuid_t, char *, size_t);
 extern	int	zonecfg_get_uuid(const char *, uuid_t);
+extern	int	zonecfg_set_uuid(const char *, const char *, const char *);
 extern	int	zonecfg_default_brand(char *, size_t);
+extern	int	zonecfg_fix_obsolete(zone_dochandle_t);
 
 /*
  * Iterator for configured zones.
diff --git a/usr/src/head/limits.h b/usr/src/head/limits.h
index eea3b0429e..e4f0194575 100644
--- a/usr/src/head/limits.h
+++ b/usr/src/head/limits.h
@@ -25,6 +25,7 @@
  *
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.  All rights reserved.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -37,6 +38,7 @@
 #include <sys/feature_tests.h>
 #include <sys/isa_defs.h>
 #include <iso/limits_iso.h>
+#include <sys/limits.h>
 
 /*
  * Include fixed width type limits as proposed by the ISO/JTC1/SC22/WG14 C
@@ -243,8 +245,6 @@ extern "C" {
 #define	_XOPEN_NAME_MAX	255	/* max # bytes in filename excluding null */
 #define	_XOPEN_PATH_MAX	1024	/* max # bytes in a pathname */
 
-#define	IOV_MAX		_XOPEN_IOV_MAX
-
 #if defined(__EXTENSIONS__) || \
 	(!defined(_STRICT_STDC) && !defined(__XOPEN_OR_POSIX))
 
diff --git a/usr/src/head/regexp.h b/usr/src/head/regexp.h
index 5c6714caf4..8dfa8ae528 100644
--- a/usr/src/head/regexp.h
+++ b/usr/src/head/regexp.h
@@ -396,12 +396,12 @@ advance(const char *lp, const char *ep)
 			/*FALLTHRU*/
 
 		case CBRA:
-			braslist[*ep++] = (char *)lp;
+			braslist[(int)*ep++] = (char *)lp;
 			continue;
 			/*FALLTHRU*/
 
 		case CKET:
-			braelist[*ep++] = (char *)lp;
+			braelist[(int)*ep++] = (char *)lp;
 			continue;
 			/*FALLTHRU*/
 
@@ -479,8 +479,8 @@ advance(const char *lp, const char *ep)
 			/*FALLTHRU*/
 
 		case CBACK:
-			bbeg = braslist[*ep];
-			ct = braelist[*ep++] - bbeg;
+			bbeg = braslist[(int)*ep];
+			ct = braelist[(int)*ep++] - bbeg;
 
 			if (ecmp(bbeg, lp, ct)) {
 				lp += ct;
@@ -490,8 +490,8 @@ advance(const char *lp, const char *ep)
 			/*FALLTHRU*/
 
 		case CBACK | STAR:
-			bbeg = braslist[*ep];
-			ct = braelist[*ep++] - bbeg;
+			bbeg = braslist[(int)*ep];
+			ct = braelist[(int)*ep++] - bbeg;
 			curlp = lp;
 			while (ecmp(bbeg, lp, ct))
 				lp += ct;
diff --git a/usr/src/head/resolv_joy.h b/usr/src/head/resolv_joy.h
new file mode 100644
index 0000000000..262cf6121d
--- /dev/null
+++ b/usr/src/head/resolv_joy.h
@@ -0,0 +1,472 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ *
+ * Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T
+ * All Rights Reserved
+ *
+ * Portions of this source code were derived from Berkeley
+ * 4.3 BSD under license from the regents of the University of
+ * California.
+ */
+
+/*
+ * BIND 4.9.4:
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ * --Copyright--
+ *
+ * End BIND 4.9.4
+ */
+
+/*
+ * Copyright (c) 1983, 1987, 1989
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ *	@(#)resolv.h	8.1 (Berkeley) 6/2/93
+ *	$Id: resolv.h,v 8.52 2003/04/29 02:27:03 marka Exp $
+ */
+
+#ifndef _RESOLV_JOY_H
+#define	_RESOLV_JOY_H
+
+#ifdef	_RESOLV_H_
+#error	"resolv.h and resolv_joy.h should not be used together"
+#endif
+
+#include <sys/param.h>
+
+#include <stdio.h>
+#include <arpa/nameser.h>
+#include <sys/socket.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Revision information.  This is the release date in YYYYMMDD format.
+ * It can change every day so the right thing to do with it is use it
+ * in preprocessor commands such as "#if (__RES > 19931104)".  Do not
+ * compare for equality; rather, use it to determine whether your resolver
+ * is new enough to contain a certain feature.
+ */
+
+#define	__RES	20090302
+
+#pragma	redefine_extname dn_expand joy_dn_expand
+#pragma	redefine_extname res_nsearch joy_res_nsearch
+#pragma	redefine_extname res_ninit joy_res_ninit
+#pragma	redefine_extname res_ndestroy joy_res_ndestroy
+#pragma	redefine_extname res_gethostbyaddr joy_res_gethostbyaddr
+#pragma	redefine_extname res_gethostbyname joy_res_gethostbyname
+#pragma	redefine_extname res_gethostbyname2 joy_res_gethostbyname2
+#pragma	redefine_extname res_endhostent joy_res_endhostent
+#pragma	redefine_extname res_sethostent joy_res_sethostent
+#pragma	redefine_extname __res_override_retry __joy_res_override_retry
+#pragma	redefine_extname __res_unset_no_hosts_fallback \
+    __joy_res_unset_no_hosts_fallback
+#pragma	redefine_extname __res_set_no_hosts_fallback \
+    __joy_res_set_no_hosts_fallback
+#pragma	redefine_extname __h_errno __joy_h_errno
+#pragma	redefine_extname __ns_get16 __joy_ns_get16
+#pragma	redefine_extname __ns_get32 __joy_ns_get32
+
+
+#define	RES_SET_H_ERRNO(r, x)	__h_errno_set(r, x)
+struct __res_state;					/* forward */
+
+void __h_errno_set(struct __res_state *res, int err);
+
+/*
+ * Resolver configuration file.
+ * Normally not present, but may contain the address of the
+ * initial name server(s) to query and the domain search list.
+ */
+
+#ifndef _PATH_RESCONF
+#define	_PATH_RESCONF		"/etc/resolv.conf"
+#endif
+
+#ifdef __STDC__
+#ifndef __P
+#define	__P(x)	x
+#endif
+#else
+#ifndef __P
+#define	__P(x)	()
+#endif
+#endif /* __STDC__ */
+
+typedef enum { res_goahead, res_nextns, res_modified, res_done, res_error }
+	res_sendhookact;
+
+typedef res_sendhookact (*res_send_qhook)__P((struct sockaddr * const *ns,
+						const uchar_t **query,
+						int *querylen,
+						uchar_t *ans,
+						int anssiz,
+						int *resplen));
+
+typedef res_sendhookact (*res_send_rhook)__P((const struct sockaddr *ns,
+						const uchar_t *query,
+						int querylen,
+						uchar_t *ans,
+						int anssiz,
+						int *resplen));
+
+struct res_sym {
+	int		number;	   /* Identifying number, like T_MX */
+	const char 	*name;	   /* Its symbolic name, like "MX" */
+	const char 	*humanname; /* Its fun name, like "mail exchanger" */
+};
+
+/*
+ * Global defines and variables for resolver stub.
+ */
+/* ADDRSORT and MAXADDR retained for compatibility; not used */
+#define	ADDRSORT	1	/* enable the address-sorting option */
+#define	MAXADDR		10	/* max # addresses to sort by */
+
+#define	MAXNS			32	/* max # name servers we'll track */
+#define	MAXDFLSRCH		3	/* # default domain levels to try */
+#define	MAXDNSRCH		6	/* max # domains in search path */
+#define	LOCALDOMAINPARTS	2	/* min levels in name that is "local" */
+
+#define	RES_TIMEOUT		5	/* min. seconds between retries */
+#define	MAXRESOLVSORT		10	/* number of net to sort on */
+#define	RES_MAXNDOTS		15	/* should reflect bit field size */
+#define	RES_MAXRETRANS		30	/* only for resolv.conf/RES_OPTIONS */
+#define	RES_MAXRETRY		5	/* only for resolv.conf/RES_OPTIONS */
+#define	RES_DFLRETRY		2	/* Default #/tries. */
+#define	RES_MAXTIME		65535	/* Infinity, in milliseconds. */
+
+struct __res_state_ext;
+
+struct __res_state {
+	int	retrans;		/* retransmission time interval */
+	int	retry;			/* number of times to retransmit */
+#ifdef __sun
+	uint_t	options;		/* option flags - see below. */
+#else
+	ulong_t	options;		/* option flags - see below. */
+#endif
+	int	nscount;		/* number of name servers */
+	struct sockaddr_in
+		nsaddr_list[MAXNS];	/* address of name server */
+#define	nsaddr	nsaddr_list[0]		/* for backward compatibility */
+	ushort_t id;			/* current packet id */
+	char	*dnsrch[MAXDNSRCH+1];	/* components of domain to search */
+	char	defdname[256];		/* default domain (deprecated) */
+#ifdef __sun
+	uint_t	pfcode;			/* RES_PRF_ flags - see below. */
+#else
+	ulong_t	pfcode;			/* RES_PRF_ flags - see below. */
+#endif
+	unsigned ndots:4;		/* threshold for initial abs. query */
+	unsigned nsort:4;		/* number of elements in sort_list[] */
+	char	unused[3];
+	struct {
+		struct in_addr	addr;
+		unsigned int	mask;
+	} sort_list[MAXRESOLVSORT];
+	res_send_qhook qhook;		/* query hook */
+	res_send_rhook rhook;		/* response hook */
+	int		res_h_errno;	/* last one set for this context */
+	int		_vcsock;	/* PRIVATE: for res_send VC i/o */
+	uint_t	_flags;		/* PRIVATE: see below */
+	uint_t	_pad;			/* make _u 64 bit aligned */
+	union {
+		/* On an 32-bit arch this means 512b total. */
+		char	pad[72 - 4*sizeof (int) - 2*sizeof (void *)];
+		struct {
+			uint16_t		nscount;
+			uint16_t		nstimes[MAXNS];	/* ms. */
+			int			nssocks[MAXNS];
+			struct __res_state_ext *ext;	/* extention for IPv6 */
+			uchar_t	_rnd[16];	/* PRIVATE: random state */
+		} _ext;
+	} _u;
+};
+
+typedef	struct __res_state	*res_state;
+
+union res_sockaddr_union {
+	struct sockaddr_in	sin;
+#ifdef IN6ADDR_ANY_INIT
+	struct sockaddr_in6	sin6;
+#endif
+#ifdef ISC_ALIGN64
+	int64_t			__align64;	/* 64bit alignment */
+#else
+	int32_t			__align32;	/* 32bit alignment */
+#endif
+	char			__space[128];   /* max size */
+};
+
+/*
+ * Resolver flags (used to be discrete per-module statics ints).
+ */
+#define	RES_F_VC	0x00000001	/* socket is TCP */
+#define	RES_F_CONN	0x00000002	/* socket is connected */
+#define	RES_F_EDNS0ERR	0x00000004	/* EDNS0 caused errors */
+#define	RES_F__UNUSED	0x00000008	/* (unused) */
+#define	RES_F_LASTMASK	0x000000F0	/* ordinal server of last res_nsend */
+#define	RES_F_LASTSHIFT	4		/* bit position of LASTMASK "flag" */
+#define	RES_GETLAST(res) (((res)._flags & RES_F_LASTMASK) >> RES_F_LASTSHIFT)
+
+/* res_findzonecut2() options */
+#define	RES_EXHAUSTIVE	0x00000001	/* always do all queries */
+#define	RES_IPV4ONLY	0x00000002	/* IPv4 only */
+#define	RES_IPV6ONLY	0x00000004	/* IPv6 only */
+
+/*
+ * Resolver options (keep these in synch with res_debug.c, please)
+ */
+#define	RES_INIT	0x00000001	/* address initialized */
+#define	RES_DEBUG	0x00000002	/* print debug messages */
+#define	RES_AAONLY	0x00000004	/* authoritative answers only (!IMPL) */
+#define	RES_USEVC	0x00000008	/* use virtual circuit */
+#define	RES_PRIMARY	0x00000010	/* query primary server only (!IMPL) */
+#define	RES_IGNTC	0x00000020	/* ignore trucation errors */
+#define	RES_RECURSE	0x00000040	/* recursion desired */
+#define	RES_DEFNAMES	0x00000080	/* use default domain name */
+#define	RES_STAYOPEN	0x00000100	/* Keep TCP socket open */
+#define	RES_DNSRCH	0x00000200	/* search up local domain tree */
+#define	RES_INSECURE1	0x00000400	/* type 1 security disabled */
+#define	RES_INSECURE2	0x00000800	/* type 2 security disabled */
+#define	RES_NOALIASES	0x00001000	/* shuts off HOSTALIASES feature */
+#define	RES_USE_INET6	0x00002000	/* use/map IPv6 in gethostbyname() */
+#define	RES_ROTATE	0x00004000	/* rotate ns list after each query */
+#define	RES_NOCHECKNAME	0x00008000	/* do not check names for sanity. */
+#define	RES_KEEPTSIG	0x00010000	/* do not strip TSIG records */
+#define	RES_BLAST	0x00020000	/* blast all recursive servers */
+#define	RES_NO_NIBBLE	0x00040000	/* disable IPv6 nibble mode reverse */
+#define	RES_NO_BITSTRING 0x00080000	/* disable IPv6 bitstring mode revrse */
+#define	RES_NOTLDQUERY	0x00100000	/* don't unqualified name as a tld */
+#define	RES_USE_DNSSEC	0x00200000	/* use DNSSEC using OK bit in OPT */
+/* KAME extensions: use higher bit to avoid conflict with ISC use */
+#define	RES_USE_DNAME	0x10000000	/* use DNAME */
+#define	RES_USE_EDNS0	0x40000000	/* use EDNS0 if configured */
+#define	RES_NO_NIBBLE2	0x80000000	/* disable alternate nibble lookup */
+
+#define	RES_DEFAULT	(RES_RECURSE | RES_DEFNAMES | RES_DNSRCH)
+
+/*
+ * Resolver "pfcode" values.  Used by dig.
+ */
+#define	RES_PRF_STATS	0x00000001
+#define	RES_PRF_UPDATE	0x00000002
+#define	RES_PRF_CLASS   0x00000004
+#define	RES_PRF_CMD		0x00000008
+#define	RES_PRF_QUES	0x00000010
+#define	RES_PRF_ANS		0x00000020
+#define	RES_PRF_AUTH	0x00000040
+#define	RES_PRF_ADD		0x00000080
+#define	RES_PRF_HEAD1	0x00000100
+#define	RES_PRF_HEAD2	0x00000200
+#define	RES_PRF_TTLID	0x00000400
+#define	RES_PRF_HEADX	0x00000800
+#define	RES_PRF_QUERY	0x00001000
+#define	RES_PRF_REPLY	0x00002000
+#define	RES_PRF_INIT	0x00004000
+#define	RES_PRF_TRUNC	0x00008000
+/*			0x00010000	*/
+
+/* Things involving an internal (static) resolver context. */
+#ifdef _REENTRANT
+extern struct __res_state *__res_state(void);
+#define	_res (*__res_state())
+#else
+#ifndef __BIND_NOSTATIC
+extern struct __res_state _res;
+#endif
+#endif
+
+#ifndef __BIND_NOSTATIC
+void		fp_nquery __P((const uchar_t *, int, FILE *));
+void		fp_query __P((const uchar_t *, FILE *));
+const char *hostalias __P((const char *));
+void		p_query __P((const uchar_t *));
+void		res_close __P((void));
+int		res_init __P((void));
+int		res_isourserver __P((const struct sockaddr_in *));
+int		res_mkquery __P((int, const char *, int, int, const uchar_t *,
+				int, const uchar_t *, uchar_t *, int));
+int		res_query	__P((const char *, int, int, uchar_t *, int));
+int		res_querydomain __P((const char *, const char *, int, int,
+				uchar_t *, int));
+int		res_search __P((const char *, int, int, uchar_t *, int));
+int		res_send __P((const uchar_t *, int, uchar_t *, int));
+int		res_sendsigned __P((const uchar_t *, int, ns_tsig_key *,
+				    uchar_t *, int));
+#endif	/* __BIND_NOSTATIC */
+
+extern const struct res_sym __p_key_syms[];
+extern const struct res_sym __p_cert_syms[];
+extern const struct res_sym __p_class_syms[];
+extern const struct res_sym __p_type_syms[];
+extern const struct res_sym __p_rcode_syms[];
+
+int		res_hnok __P((const char *));
+int		res_ownok __P((const char *));
+int		res_mailok __P((const char *));
+int		res_dnok __P((const char *));
+int		sym_ston __P((const struct res_sym *, const char *, int *));
+const char	*sym_ntos __P((const struct res_sym *, int, int *));
+const char	*sym_ntop __P((const struct res_sym *, int, int *));
+int		b64_ntop __P((uchar_t const *, size_t, char *, size_t));
+int		b64_pton __P((char const *, uchar_t *, size_t));
+int		loc_aton __P((const char *ascii, uchar_t *binary));
+const char	*loc_ntoa __P((const uchar_t *binary, char *ascii));
+int		dn_skipname __P((const uchar_t *, const uchar_t *));
+void		putlong __P((unsigned int, uchar_t *));
+void		putshort __P((unsigned short, uchar_t *));
+const char	*p_class __P((int));
+const char	*p_time __P((unsigned int));
+const char	*p_type __P((int));
+const char	*p_rcode __P((int));
+const char	*p_sockun __P((union res_sockaddr_union, char *, size_t));
+const uchar_t	*p_cdnname __P((const uchar_t *, const uchar_t *, int,
+			FILE *));
+const uchar_t	*p_cdname __P((const uchar_t *, const uchar_t *, FILE *));
+const uchar_t	*p_fqnname __P((const uchar_t *cp, const uchar_t *msg,
+			int, char *, int));
+const uchar_t	*p_fqname __P((const uchar_t *, const uchar_t *, FILE *));
+const char	*p_option __P((uint_t option));
+char		*p_secstodate __P((uint_t));
+int		dn_count_labels __P((const char *));
+int		dn_comp __P((const char *, uchar_t *, int,
+				uchar_t **, uchar_t **));
+int		dn_expand __P((const uchar_t *, const uchar_t *,
+			const uchar_t *, char *, int));
+void		res_rndinit __P((res_state));
+uint_t		res_randomid __P((void));
+uint_t		res_nrandomid __P((res_state));
+int		res_nameinquery __P((const char *, int, int,
+				const uchar_t *, const uchar_t *));
+int		res_queriesmatch __P((const uchar_t *, const uchar_t *,
+				const uchar_t *, const uchar_t *));
+const char	*p_section __P((int section, int opcode));
+
+
+/* Things involving a resolver context. */
+int		res_ninit __P((res_state));
+int		res_nisourserver __P((const res_state,
+				const struct sockaddr_in *));
+void	fp_resstat __P((const res_state, FILE *));
+void	res_pquery	__P((const res_state, const uchar_t *, int, FILE *));
+const char	*res_hostalias __P((const res_state, const char *,
+				char *, size_t));
+int		res_nquery __P((res_state,
+				const char *, int, int, uchar_t *, int));
+int		res_nsearch __P((res_state, const char *, int,
+				int, uchar_t *, int));
+int		res_nquerydomain __P((res_state,
+				const char *, const char *, int, int,
+				uchar_t *, int));
+int		res_nmkquery __P((res_state,
+				int, const char *, int, int, const uchar_t *,
+				int, const uchar_t *, uchar_t *, int));
+int		res_nsend __P((res_state, const uchar_t *, int, uchar_t *,
+				int));
+int		res_nsendsigned __P((res_state, const uchar_t *, int,
+				ns_tsig_key *, uchar_t *, int));
+int		res_findzonecut __P((res_state, const char *, ns_class, int,
+				char *, size_t, struct in_addr *, int));
+int		res_findzonecut2 __P((res_state, const char *, ns_class, int,
+				char *, size_t, union res_sockaddr_union *,
+				int));
+void		res_nclose __P((res_state));
+int		res_nopt __P((res_state, int, uchar_t *, int, int));
+int		res_nopt_rdata __P((res_state, int, uchar_t *, int, uchar_t *,
+				    ushort_t, ushort_t, uchar_t *));
+void		res_send_setqhook __P((res_send_qhook hook));
+void		res_send_setrhook __P((res_send_rhook hook));
+int		__res_vinit __P((res_state, int));
+void		res_destroyservicelist __P((void));
+const char 	*res_servicename __P((uint16_t port, const char *proto));
+const char 	*res_protocolname __P((int num));
+void		res_destroyprotolist __P((void));
+void		res_buildprotolist __P((void));
+const char 	*res_get_nibblesuffix __P((res_state));
+const char 	*res_get_nibblesuffix2 __P((res_state));
+void		res_ndestroy __P((res_state));
+uint16_t	res_nametoclass __P((const char *buf, int *success));
+uint16_t	res_nametotype __P((const char *buf, int *success));
+void		res_setservers __P((res_state,
+				    const union res_sockaddr_union *, int));
+int		res_getservers __P((res_state,
+				    union res_sockaddr_union *, int));
+
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* !_RESOLV_JOY_H */
diff --git a/usr/src/head/zdoor.h b/usr/src/head/zdoor.h
new file mode 100644
index 0000000000..f2d204042d
--- /dev/null
+++ b/usr/src/head/zdoor.h
@@ -0,0 +1,74 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef _ZDOOR_H
+#define	_ZDOOR_H
+
+#include <sys/types.h>
+#include <zone.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct zdoor_handle *zdoor_handle_t;
+
+typedef struct zdoor_cookie {
+	char *zdc_zonename;
+	char *zdc_service;
+	void *zdc_biscuit;
+} zdoor_cookie_t;
+
+typedef struct zdoor_result {
+	char *zdr_data;
+	size_t zdr_size;
+} zdoor_result_t;
+
+typedef zdoor_result_t *(*zdoor_callback) (zdoor_cookie_t *cookie,
+	char *argp, size_t arpg_sz);
+
+#define	ZDOOR_OK		0
+#define	ZDOOR_ERROR		-1
+#define	ZDOOR_NOT_GLOBAL_ZONE	-2
+#define	ZDOOR_ZONE_NOT_RUNNING	-3
+#define	ZDOOR_ZONE_FORBIDDEN	-4
+#define	ZDOOR_ARGS_ERROR	-5
+#define	ZDOOR_OUT_OF_MEMORY	-6
+
+extern zdoor_handle_t	zdoor_handle_init();
+
+extern int	zdoor_open(zdoor_handle_t handle, const char *zonename,
+	const char *service, void *biscuit, zdoor_callback callback);
+
+extern void *	zdoor_close(zdoor_handle_t handle, const char *zonename,
+	const char *service);
+
+extern void 	zdoor_handle_destroy(zdoor_handle_t handle);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _ZDOOR_H */
diff --git a/usr/src/head/zone.h b/usr/src/head/zone.h
index 34528a27f5..f9ea8d4f82 100644
--- a/usr/src/head/zone.h
+++ b/usr/src/head/zone.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent Inc.
  */
 
 #ifndef _ZONE_H
@@ -46,17 +47,20 @@ extern ssize_t		getzonenamebyid(zoneid_t, char *, size_t);
  * NOTE
  *
  * The remaining contents of this file are private to the implementation
- * of Solaris and are subject to change at any time without notice,
+ * of Illumos and are subject to change at any time without notice,
  * Applications using these interfaces may fail to run on future releases.
  */
 
+#define	ZLOGIN_DISCONNECT	0x1	/* disconnect on zone halt */
+#define	ZLOGIN_ZFD_EOF		0x2	/* EOF on ZFD */
+
 extern int zonept(int, zoneid_t);
 extern int zone_get_id(const char *, zoneid_t *);
 
 /* System call API */
 extern zoneid_t	zone_create(const char *, const char *,
     const struct priv_set *, const char *, size_t, const char *, size_t, int *,
-    int, int, const bslabel_t *, int);
+    int, int, const bslabel_t *, int, zoneid_t);
 extern int	zone_boot(zoneid_t);
 extern int	zone_destroy(zoneid_t);
 extern ssize_t	zone_getattr(zoneid_t, int, void *, size_t);
@@ -69,6 +73,7 @@ extern int	zone_add_datalink(zoneid_t, datalink_id_t);
 extern int	zone_remove_datalink(zoneid_t, datalink_id_t);
 extern int	zone_check_datalink(zoneid_t *, datalink_id_t);
 extern int	zone_list_datalink(zoneid_t, int *, datalink_id_t *);
+extern const char *zone_get_nroot(void);
 
 #ifdef	__cplusplus
 }
diff --git a/usr/src/lib/Makefile b/usr/src/lib/Makefile
index 90cffe62f7..654a35dd5d 100644
--- a/usr/src/lib/Makefile
+++ b/usr/src/lib/Makefile
@@ -22,7 +22,7 @@
 #
 # Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright (c) 2012 by Delphix. All rights reserved.
-# Copyright (c) 2012, Joyent, Inc. All rights reserved.
+# Copyright 2018, Joyent, Inc.
 # Copyright (c) 2013 Gary Mills
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
 # Copyright (c) 2015 Gary Mills
@@ -94,6 +94,7 @@ SUBDIRS +=				\
 	libbrand	\
 	libbsdmalloc	\
 	libbsm		\
+	libbunyan	\
 	libc_db		\
 	libcfgadm	\
 	libcmd		\
@@ -105,6 +106,7 @@ SUBDIRS +=				\
 	libcryptoutil	\
 	libctf		\
 	libcurses	\
+	libcustr	\
 	libdevice	\
 	libdevid	\
 	libdevinfo	\
@@ -119,6 +121,7 @@ SUBDIRS +=				\
 	libdoor		\
 	libdtrace	\
 	libdtrace_jni	\
+	libdwarf	\
 	libefi		\
 	libelfsign	\
 	libeti		\
@@ -136,6 +139,7 @@ SUBDIRS +=				\
 	libgss		\
 	libhotplug	\
 	libidmap	\
+	libidspace	\
 	libilb		\
 	libima		\
 	libinetsvc	\
@@ -178,14 +182,17 @@ SUBDIRS +=				\
 	libpkg		\
 	libpool		\
 	libpp		\
+	libppt		\
 	libproc		\
 	libproject	\
 	libpthread	\
 	libraidcfg	\
 	librcm		\
+	librename	\
 	libreparse	\
 	libresolv	\
 	libresolv2	\
+	libresolv2_joy	\
 	librestart	\
 	librpcsvc	\
 	librsm		\
@@ -204,6 +211,7 @@ SUBDIRS +=				\
 	libsip		\
 	libsldap	\
 	libslp		\
+	libsmartsshd	\
 	libsmbfs	\
 	libsmbios	\
 	libsmedia	\
@@ -226,6 +234,7 @@ SUBDIRS +=				\
 	libumem		\
 	libuuid		\
 	libuutil	\
+	libvnd		\
 	libvolmgt	\
 	libvrrpadm	\
 	libvscan	\
@@ -234,6 +243,7 @@ SUBDIRS +=				\
 	libxcurses	\
 	libxcurses2	\
 	libxnet		\
+	libzdoor	\
 	libzfs		\
 	libzfs_core	\
 	libzfs_jni	\
@@ -252,9 +262,6 @@ SUBDIRS +=				\
 	pkcs11		\
 	policykit	\
 	print		\
-	pylibbe		\
-	pysolaris	\
-	pyzfs		\
 	raidcfg_plugins	\
 	rpcsec_gss	\
 	sasl_plugins	\
@@ -264,12 +271,14 @@ SUBDIRS +=				\
 	sun_fc		\
 	sun_sas		\
 	udapl		\
+	varpd		\
 	watchmalloc	\
 	$($(MACH)_SUBDIRS)
 
 i386_SUBDIRS=		\
 	libfdisk	\
-	libsaveargs
+	libsaveargs	\
+	libvmmapi
 
 sparc_SUBDIRS=		\
 	efcode		\
@@ -336,6 +345,7 @@ MSGSUBDIRS=		\
 	libshell	\
 	libsldap	\
 	libslp		\
+	libsmartsshd	\
 	libsmbfs	\
 	libsmedia	\
 	libsum		\
@@ -345,10 +355,10 @@ MSGSUBDIRS=		\
 	libvscan	\
 	libzfs		\
 	libzonecfg	\
+	libzdoor	\
 	madv		\
 	mpss		\
 	pam_modules	\
-	pyzfs		\
 	rpcsec_gss	\
 	$($(MACH)_MSGSUBDIRS)
 
@@ -368,6 +378,7 @@ HDRSUBDIRS=				\
 	libast		\
 	libbrand	\
 	libbsm		\
+	libbunyan	\
 	libc		\
 	libcmd		\
 	libcmdutils	\
@@ -377,6 +388,7 @@ HDRSUBDIRS=				\
 	libcryptoutil	\
 	libctf		\
 	libcurses	\
+	libcustr	\
 	libdevice	\
 	libdevid	\
 	libdevinfo	\
@@ -384,6 +396,7 @@ HDRSUBDIRS=				\
 	libdhcputil	\
 	libdisasm	\
 	libdiskmgt	\
+	libdwarf	\
 	libdladm	\
 	libdll		\
 	libdlpi		\
@@ -399,6 +412,7 @@ HDRSUBDIRS=				\
 	libgen		\
 	libgrubmgmt	\
 	libidmap	\
+	libidspace	\
 	libilb		\
 	libima		\
 	libinetsvc	\
@@ -431,9 +445,11 @@ HDRSUBDIRS=				\
 	libpicltree	\
 	libpool		\
 	libpp		\
+	libppt		\
 	libproc		\
 	libraidcfg	\
 	librcm		\
+	librename	\
 	libreparse	\
 	librestart	\
 	librpcsvc	\
@@ -467,6 +483,7 @@ HDRSUBDIRS=				\
 	libtsol		\
 	libumem		\
 	libuutil	\
+	libvnd		\
 	libvolmgt	\
 	libvrrpadm	\
 	libvscan	\
@@ -485,11 +502,13 @@ HDRSUBDIRS=				\
 	smbsrv		\
 	smhba		\
 	udapl		\
+	varpd		\
 	$($(MACH)_HDRSUBDIRS)
 
 i386_HDRSUBDIRS=	\
 	libfdisk	\
-	libsaveargs
+	libsaveargs	\
+	libvmmapi
 
 sparc_HDRSUBDIRS=	\
 	libds		\
@@ -563,7 +582,7 @@ dbusdeps:	libsecdb libtsol libinetutil libscf libuutil libgen libsmbios
 # libc libm libmd libmp libnsl libnvpair libsocket
 abi:		libctf libmapmalloc libproc
 auditd_plugins: libbsm libsecdb libgss libmtmalloc
-brand:		libzonecfg libmapmalloc
+brand:		libzonecfg libmapmalloc libipadm libcustr libproc librpcsvc
 cfgadm_plugins:	libdevice libdevinfo libhotplug librcm hbaapi libkstat libscf
 fm:		libexacct libipmi libzfs scsi libdevinfo libdevid libcfgadm \
 		libcontract libsysevent ../cmd/sgs/libelf libdladm libsff \
@@ -579,11 +598,13 @@ libadt_jni:	libbsm
 libadutils:	libldap5 libresolv2
 libbe:		libzfs libinstzones libuuid libgen libdevinfo libefi libficl
 libbsm:		libinetutil libscf libsecdb libtsol
+libbunyan:	libnvpair
 libcfgadm:	libdevinfo
 libcmd:		libsum libast
 libcmdutils:	libavl
 libcpc:		libpctx
 libcrypt:	libgen
+libctf:		libdwarf
 libdevid:	libdevinfo
 libdevinfo:	libsec libgen
 libdhcpagent:	libdhcputil libuuid libdlpi libcontract
@@ -591,8 +612,8 @@ libdhcputil:	libgen libinetutil libdlpi
 libdiskmgt:	libdevid libdevinfo libadm libefi libkstat libsysevent
 $(INTEL_BLD)libdiskmgt: libfdisk
 libdladm:	libdevinfo libinetutil libscf librcm libexacct libkstat \
-		libpool
-libdll:		libast
+		libpool varpd
+libdll: 	libast
 libdlpi:	libinetutil libdladm
 libds:		libsysevent
 libdtrace:	libproc libgen libctf libmapmalloc
@@ -609,6 +630,7 @@ libfsmgt:	libkstat
 libgrubmgmt:	libdevinfo libzfs libfstyp libefi
 $(INTEL_BLD)libgrubmgmt: libfdisk
 libidmap:	libavl libuutil
+libidspace:	libumem
 libinetsvc:	libscf
 libinstzones:	libzonecfg libcontract
 libipadm:	libinetutil libdlpi libdhcpagent libdladm libsecdb libdhcputil
@@ -628,6 +650,7 @@ libpctx:	libproc
 libpkg:		libscf libadm
 libpool:	libscf libexacct
 libpp:		libast
+libppt:		libpcidb libdevinfo libcmdutils
 libproc:	../cmd/sgs/librtld_db ../cmd/sgs/libelf libctf
 $(INTEL_BLD)libproc: libsaveargs
 libproject:	libpool libproc libsecdb
@@ -644,6 +667,7 @@ libshare:	libscf libzfs libuuid libfsmgt libsecdb libumem libsmbfs
 libshell:	libast libcmd libdll libsecdb
 libsip:		libmd5
 libsldap:	libldap5 libscf
+libsmartsshd:	libc libcontract
 libsmbfs:	libkrb5 libsec libidmap pkcs11
 libsmbios:	libdevinfo
 libsrpt:	libstmf
@@ -663,6 +687,7 @@ libv12n:	libds libuuid
 libvolmgt:	libadm
 libvrrpadm:	libdladm libscf
 libvscan:	libscf libsecdb
+libzdoor:	libc libzonecfg libcontract
 libzfs:		libdevid libgen libuutil libadm libavl libefi libidmap \
 		libumem libtsol libzfs_core
 libzfs_jni:	libdiskmgt libzfs
@@ -673,7 +698,8 @@ libzpool:	libavl libumem libcmdutils libsysevent libfakekernel
 madv:		libgen
 mpapi:		libpthread libdevinfo libsysevent
 mpss:		libgen
-nsswitch:	libadutils libidmap libdns_sd libscf libldap5 libsldap
+nsswitch:	libadutils libidmap libdns_sd libscf libldap5 libsldap \
+		libresolv2_joy
 pam_modules:	libproject passwdutil smbsrv libtsnet libpam libbsm libsecdb
 passwdutil:	libsldap
 pkcs11:		libcryptoutil libgen libuuid
@@ -693,6 +719,8 @@ storage:	libdevice libdevinfo libdevid
 sun_fc:		libdevinfo libsysevent
 sun_sas:	libdevinfo libsysevent libkstat libdevid
 udapl:		libdevinfo libdladm
+varpd:		libavl libidspace libumem libnsl libnvpair libmd5 librename \
+		libbunyan libcustr
 
 #
 # The reason this rule checks for the existence of the
diff --git a/usr/src/lib/Makefile.astmsg b/usr/src/lib/Makefile.astmsg
index 096805e825..ff8202d03a 100644
--- a/usr/src/lib/Makefile.astmsg
+++ b/usr/src/lib/Makefile.astmsg
@@ -47,8 +47,8 @@ MSGLIBNAME= $(LIBRARY:.a=)
 ASTMSGCATALOG= $(ROOT)/usr/lib/locale/C/LC_MESSAGES/$(MSGLIBNAME)
 
 $(DO_BUILD_AST_CATALOGS)ASTMSGCC= \
-	PATH="/usr/ast/bin/:/bin:/usr/bin" \
-		/usr/bin/ksh93 /usr/ast/bin/msgcc >>msgcc.out 2>&1
+	PATH="$(ASTBINDIR):/bin:/usr/bin" \
+		/usr/bin/ksh93 $(MSGCC) >>msgcc.out 2>&1
 
 ASTMSGS=  $(OBJECTS:%.o=msgs/%.mso)
 
diff --git a/usr/src/lib/Makefile.lib b/usr/src/lib/Makefile.lib
index 86cc330f41..82e3a22d41 100644
--- a/usr/src/lib/Makefile.lib
+++ b/usr/src/lib/Makefile.lib
@@ -21,6 +21,7 @@
 # Copyright 2015 Gary Mills
 # Copyright 2015 Igor Kozhukhov <ikozhukhov@gmail.com>
 # Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2015, Joyent, Inc.
 #
 #
 # Definitions common to libraries.
@@ -132,6 +133,23 @@ SONAME=		$(DYNLIB)
 # combining relocations into one relocation table reduces startup costs.
 # All options are tunable to allow overload/omission from lower makefiles.
 
+#
+# DTrace related rules
+#
+# These allow for multiple USDT providers to be specified by a library.
+# If a library needs to break up the set of objects that are passed to
+# the dtrace -G invocation, then they can place the following in heir
+# Makefile.com:
+#
+# pics/<provider>.o	:= USDT_G_PICS = <files>
+#
+# <provider> should be replaced with the basename of one of the USDT
+# providers specified in USDT_PROVIDERS in their Makefile.com.
+#
+USDT_HEADERS=	$(USDT_PROVIDERS:%.d=%_impl.h)
+USDT_PICS=	$(USDT_PROVIDERS:%.d=pics/%.o)
+USDT_G_PICS=	$(PICS)
+
 
 HSONAME=	-h$(SONAME)
 DYNFLAGS=	$(HSONAME) $(ZTEXT) $(ZDEFS) $(BDIRECT) \
@@ -154,7 +172,7 @@ SRCS=		$(OBJECTS:%.o=$(SRCDIR)/%.c)
 # overridden locally when extra processing is needed
 BUILD.AR=	$(AR) $(ARFLAGS) $@ $(AROBJS)
 BUILD.SO=	$(CC) $(CFLAGS) -o $@ $(GSHARED) $(DYNFLAGS) \
-		$(PICS) $(EXTPICS) $(LDLIBS)
+		$(PICS) $(EXTPICS) $(USDT_PICS) $(LDLIBS)
 BUILDCCC.SO=	$(CCC) $(CCFLAGS) -o $@ $(GSHARED) $(DYNFLAGS) \
 		$(PICS) $(EXTPICS) $(LDLIBS)
 
@@ -248,3 +266,15 @@ TARGETMACH=	$(MACH)
 # shouldn't override this - they should override $(CLOBBERFILES) instead.
 #
 CLOBBERTARGFILES= $(LIBS) $(DYNLIB) $(CLOBBERFILES)
+
+#
+# Define the default ctfdiff invocation used to check a list of types
+# supplied by a user of a library. The goal is to validate that a given
+# series of types is the same in both a 32-bit and 64-bit artifact. This
+# is only defined if we have a 64-bit build to do.
+#
+TYPECHECK_LIB32 =		$(TYPECHECK_LIB:%=$(MACH)/%)
+TYPECHECK_LIB64 =		$(TYPECHECK_LIB:%=$(MACH64)/%)
+TYPECHECK_LIST=			$(TYPELIST:%=-T %)
+$(BUILD64)TYPECHECK.lib =	$(CTFDIFF) -t -I $(TYPECHECK_LIST) $(TYPECHECK_LIB32) $(TYPECHECK_LIB64)
+TYPECHECK =			$(TYPECHECK_LIB:%=%.typecheck)
diff --git a/usr/src/lib/Makefile.targ b/usr/src/lib/Makefile.targ
index 4769c64d54..2798192343 100644
--- a/usr/src/lib/Makefile.targ
+++ b/usr/src/lib/Makefile.targ
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2014, Joyent, Inc.
 #
 
 #
@@ -90,7 +91,7 @@ $(LIBRARY): objs .WAIT $$(OBJS)
 
 $(DYNLIB): $$(MAPFILES)
 
-$(DYNLIB): pics .WAIT $$(PICS) $$(ALTPICS) $$(EXTPICS)
+$(DYNLIB): pics $(USDT_HEADERS) .WAIT $$(PICS) $$(ALTPICS) $$(EXTPICS) .WAIT $(USDT_PICS)
 	$(BUILD.SO)
 	$(POST_PROCESS_SO)
 
@@ -104,9 +105,12 @@ $(LINTLIB): $$(SRCS)
 lintcheck: $$(SRCS)
 	$(LINT.c) $(LINTCHECKFLAGS) $(SRCS) $(LDLIBS)
 
+$(TYPECHECK): $(TYPECHECK_LIB32) $(TYPECHECK_LIB64)
+	$(TYPECHECK.lib)
+
 clobber: clean
 	-$(RM) $(CLOBBERTARGFILES)
 
 clean:
-	-$(RM) $(OBJS)
+	-$(RM) $(OBJS) $(USDT_HEADERS) $(USDT_PICS)
 	-$(RM) $(PICS) $(DUPLICATE_SRC) $(LINTOUT) $(LINTLIB) $(CLEANFILES)
diff --git a/usr/src/lib/Makefile.usdt b/usr/src/lib/Makefile.usdt
new file mode 100644
index 0000000000..17140161ad
--- /dev/null
+++ b/usr/src/lib/Makefile.usdt
@@ -0,0 +1,28 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# This makefile contains the necessary targets for USDT providers; it should
+# be included after Makefile.targ.  (It is in a separate file rather than in
+# Makefile.targ because the dependency on $(USDT_G_PICS) is incompatible with
+# libraries that dynamically define $(OBJECTS).)
+#
+pics/%.o: $(SRCDIR)/%.d $(USDT_G_PICS)
+	$(COMPILE.d) -o $@ -s $< $(USDT_G_PICS)
+	$(POST_PROCESS_O)
+
+%_impl.h: $(SRCDIR)/%.d
+	$(DTRACE) -h -o $@ -s $<
+
diff --git a/usr/src/lib/brand/Makefile b/usr/src/lib/brand/Makefile
index 05bfc54764..bab69e385a 100644
--- a/usr/src/lib/brand/Makefile
+++ b/usr/src/lib/brand/Makefile
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2018, Joyent, Inc.
 #
 # lib/brand/Makefile
 #
@@ -30,6 +31,9 @@ include ../../Makefile.master
 # Build everything in parallel; use .WAIT for dependencies
 .PARALLEL:
 
+i386_SUBDIRS= lx bhyve
+i386_MSGSUBDIRS= lx
+
 SUBDIRS= shared .WAIT sn1 solaris10 ipkg labeled $($(MACH)_SUBDIRS)
 MSGSUBDIRS= solaris10 shared $($(MACH)_MSGSUBDIRS)
 
diff --git a/usr/src/lib/brand/bhyve/Makefile b/usr/src/lib/brand/bhyve/Makefile
new file mode 100644
index 0000000000..b95c3cefbd
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/Makefile
@@ -0,0 +1,32 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+default: all
+
+# Build everything in parallel; use .WAIT for dependencies
+.PARALLEL:
+
+SUBDIRS =	zone
+
+all :=		TARGET= all
+install :=	TARGET= install
+clean :=	TARGET= clean
+clobber :=	TARGET= clobber
+lint :=		TARGET= lint
+
+all install clean clobber lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/lib/brand/bhyve/Makefile.bhyve b/usr/src/lib/brand/bhyve/Makefile.bhyve
new file mode 100644
index 0000000000..c2ac3fac2c
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/Makefile.bhyve
@@ -0,0 +1,17 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+BRAND=	bhyve
+
+include $(SRC)/lib/brand/Makefile.brand
+
diff --git a/usr/src/lib/brand/bhyve/zone/Makefile b/usr/src/lib/brand/bhyve/zone/Makefile
new file mode 100644
index 0000000000..d7e957072c
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/Makefile
@@ -0,0 +1,47 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+include $(SRC)/cmd/Makefile.cmd
+include ../Makefile.bhyve
+include $(SRC)/cmd/Makefile.cmd.64
+
+PROGS =		attach detach statechange uninstall
+
+PROG1 =		boot
+PROG2 =		bhhwcompat
+PROGS +=	$(PROG1) $(PROG2)
+CLEANFILES +=	$(PROG1) $(PROG2)
+
+$(PROG1) :=	LDLIBS += -lnvpair
+$(PROG2) :=	CPPFLAGS = -I$(COMPAT)/freebsd -I$(CONTRIB)/freebsd \
+	$(CPPFLAGS.master) -I$(SRC)/uts/i86pc \
+	-I$(COMPAT)/freebsd/amd64 -I$(CONTRIB)/freebsd/amd64
+
+TEMPLATES =	SYSbhyve.xml
+XMLDOCS =	config.xml platform.xml
+CLOBBERFILES =	$(ROOTXMLDOCS) $(ROOTTEMPLATES) $(ROOTPROGS)
+
+# This shouldn't be necessary, but for some reason the same thing in
+# ../../Makefile.brand is not being picked up.
+$(ROOTPROGS) :=	FILEMODE = 755
+
+all: $(PROGS)
+
+install: $(PROGS) $(ROOTPROGS) $(ROOTXMLDOCS) $(ROOTTEMPLATES)
+
+clean:
+	$(RM) $(CLEANFILES)
+
+lint:
+
+include $(SRC)/cmd/Makefile.targ
diff --git a/usr/src/lib/brand/bhyve/zone/SYSbhyve.xml b/usr/src/lib/brand/bhyve/zone/SYSbhyve.xml
new file mode 100644
index 0000000000..4fd8cb5406
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/SYSbhyve.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    DO NOT EDIT THIS FILE.  Use zonecfg(1M) instead.
+-->
+<!DOCTYPE zone PUBLIC "-//Sun Microsystems Inc//DTD Zones//EN" "file:///usr/share/lib/xml/dtd/zonecfg.dtd.1">
+<zone name="SYSbhyve" zonepath="" autoboot="false" brand="bhyve" >
+  <attr name="bootrom" type="string" value="/usr/share/bhyve/uefi-csm-rom.bin"/>
+  <attr name="com1" type="string" value="/dev/zconsole"/>
+</zone>
diff --git a/usr/src/lib/brand/bhyve/zone/attach b/usr/src/lib/brand/bhyve/zone/attach
new file mode 100755
index 0000000000..626e608579
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/attach
@@ -0,0 +1,26 @@
+#!/bin/ksh -p
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+. /usr/lib/brand/jcommon/libhooks.ksh
+
+function jcommon_attach_hook
+{
+	jattach_kvm_final_setup
+}
+
+ps_brand="bhyve"
+. /usr/lib/brand/jcommon/cattach
diff --git a/usr/src/lib/brand/bhyve/zone/bhhwcompat.c b/usr/src/lib/brand/bhyve/zone/bhhwcompat.c
new file mode 100644
index 0000000000..5f7a20feba
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/bhhwcompat.c
@@ -0,0 +1,83 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018, Joyent, Inc.
+ */
+
+/*
+ * With no option, exit 0 if the current hardware is bhyve-compatible, non-zero
+ * otherwise. A '-v' option can be used to print the incompatibility reason
+ * provided by the kernel.
+ *
+ * The -c option can be used to print the number of virtual CPUs supported by
+ * bhyve build.
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <sys/vmm.h>
+
+#include <sys/param.h>
+#include <sys/cpuset.h>
+#include <sys/vmm.h>
+#include <sys/vmm_dev.h>
+
+static void
+usage()
+{
+	fprintf(stderr, "bhhwcompat [-cv]\n");
+	exit(1);
+}
+
+int
+main(int argc, char *argv[])
+{
+	int fd, c;
+	char emsg[128];
+	boolean_t max_cpu = B_FALSE;
+	boolean_t verbose = B_FALSE;
+
+	while ((c = getopt(argc, argv, "cv")) != -1) {
+		switch (c) {
+		case 'c':
+			max_cpu = B_TRUE;
+			break;
+		case 'v':
+			verbose = B_TRUE;
+			break;
+		default:
+			usage();
+		}
+	}
+
+	if (max_cpu) {
+		(void) printf("%d\n", VM_MAXCPU);
+	}
+
+	if ((fd = open(VMM_CTL_DEV, O_RDONLY | O_EXCL)) < 0) {
+		if (verbose)
+			fprintf(stderr, "missing %s\n", VMM_CTL_DEV);
+		exit(1);
+	}
+
+	emsg[0] = '\0';
+	if (ioctl(fd, VMM_VM_SUPPORTED, emsg) < 0)  {
+		if (verbose)
+			fprintf(stderr, "%s\n", emsg);
+		exit(1);
+	}
+
+	(void) close(fd);
+	return (0);
+}
diff --git a/usr/src/lib/brand/bhyve/zone/boot.c b/usr/src/lib/brand/bhyve/zone/boot.c
new file mode 100644
index 0000000000..1e2c6771be
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/boot.c
@@ -0,0 +1,700 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+/*
+ * This program runs as a child of zoneadmd, which sets a variety of
+ * _ZONECFG_<resource>_<instance> properties so that child processes don't have
+ * to parse xml.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <libnvpair.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/utsname.h>
+#include <unistd.h>
+#include <zone.h>
+
+/* These two paths must be relative to the zone root. */
+#define	BHYVE_DIR		"var/run/bhyve"
+#define	BHYVE_ARGS_FILE		BHYVE_DIR "/" "zhyve.cmd"
+
+#define	ZH_MAXARGS		100
+
+#define	DEFAULT_BOOTROM		"/usr/share/bhyve/uefi-rom.bin"
+#define	DEFAULT_BOOTROM_CSM	"/usr/share/bhyve/uefi-csm-rom.bin"
+
+typedef enum {
+	PCI_SLOT_HOSTBRIDGE = 0,	/* Not used here, but reserved */
+	PCI_SLOT_LPC,
+	PCI_SLOT_CD,
+	PCI_SLOT_BOOT_DISK,
+	PCI_SLOT_OTHER_DISKS,
+	PCI_SLOT_NICS,
+	PCI_SLOT_FBUF = 30,
+} pci_slot_t;
+
+static boolean_t debug;
+static const char *zonename;
+static const char *zonepath;
+
+#define	dprintf(x) if (debug) (void)printf x
+
+static char *
+get_zcfg_var(const char *rsrc, const char *inst, const char *prop)
+{
+	char envvar[MAXNAMELEN];
+	char *ret;
+
+	if (prop == NULL) {
+		if (snprintf(envvar, sizeof (envvar), "_ZONECFG_%s_%s",
+		    rsrc, inst) >= sizeof (envvar)) {
+			return (NULL);
+		}
+	} else {
+		if (snprintf(envvar, sizeof (envvar), "_ZONECFG_%s_%s_%s",
+		    rsrc, inst, prop) >= sizeof (envvar)) {
+			return (NULL);
+		}
+	}
+
+	ret = getenv(envvar);
+
+	dprintf(("%s: '%s=%s'\n", __func__, envvar, ret ? ret : "<null>"));
+
+	return (ret);
+}
+
+static boolean_t
+is_env_true(const char *rsrc, const char *inst, const char *prop)
+{
+	char *val = get_zcfg_var(rsrc, inst, prop);
+
+	return (val != NULL && strcmp(val, "true") == 0);
+}
+
+static boolean_t
+is_env_string(const char *rsrc, const char *inst, const char *prop,
+    const char *val)
+{
+	char *pval = get_zcfg_var(rsrc, inst, prop);
+
+	return (pval != NULL && strcmp(pval, val) == 0);
+}
+
+static int
+add_arg(int *argc, char **argv, const char *val)
+{
+	if (*argc >= ZH_MAXARGS) {
+		(void) printf("Error: too many arguments\n");
+		return (1);
+	}
+	argv[*argc] = strdup(val);
+	assert(argv[*argc] != NULL);
+	dprintf(("%s: argv[%d]='%s'\n", __func__, *argc, argv[*argc]));
+	(*argc)++;
+	return (0);
+}
+
+static int
+add_smbios(int *argc, char **argv)
+{
+	char smbios[MAXPATHLEN];
+	struct utsname utsname;
+	const char *version;
+	const char *uuid;
+
+	if ((uuid = getenv("_ZONECFG_uuid")) != NULL) {
+		if (add_arg(argc, argv, "-U") != 0 ||
+		    add_arg(argc, argv, uuid) != 0)
+			return (1);
+	}
+
+	/*
+	 * Look for something like joyent_20180329T120303Z.  A little mucky, but
+	 * it's exactly what sysinfo does.
+	 */
+	(void) uname(&utsname);
+	if (strncmp(utsname.version, "joyent_", strlen("joyent_")) == 0)
+		version = utsname.version + strlen("joyent_");
+	else
+		version = "?";
+
+	/*
+	 * This is based upon the SMBIOS values we expose to KVM guests.
+	 */
+	(void) snprintf(smbios, sizeof (smbios),
+	    "1,manufacturer=Joyent,product=SmartDC HVM,version=7.%s,"
+	    "serial=%s,sku=001,family=Virtual Machine",
+	    version, zonename);
+
+	if (add_arg(argc, argv, "-B") != 0 ||
+	    add_arg(argc, argv, smbios) != 0)
+		return (1);
+
+	return (0);
+}
+
+static int
+add_cpu(int *argc, char **argv)
+{
+	char *val;
+
+	if ((val = get_zcfg_var("attr", "vcpus", NULL)) != NULL) {
+		if (add_arg(argc, argv, "-c") != 0 ||
+		    add_arg(argc, argv, val) != 0) {
+			return (1);
+		}
+	}
+	return (0);
+}
+
+static int
+add_ram(int *argc, char **argv)
+{
+	char *val;
+
+	if ((val = get_zcfg_var("attr", "ram", NULL)) != NULL) {
+		if (add_arg(argc, argv, "-m") != 0 ||
+		    add_arg(argc, argv, val) != 0) {
+			return (1);
+		}
+	}
+	return (0);
+}
+
+static int
+add_disk(char *disk, char *path, char *slotconf, size_t slotconf_len)
+{
+	static char *boot = NULL;
+	static int next_cd = 0;
+	static int next_other = 0;
+	const char *model = "virtio-blk";
+	int pcislot;
+	int pcifn;
+
+	/* Allow at most one "primary" disk */
+	if (is_env_true("device", disk, "boot")) {
+		if (boot != NULL) {
+			(void) printf("Error: multiple boot disks: %s %s\n",
+			    boot, path);
+			return (-1);
+		}
+		boot = path;
+		pcislot = PCI_SLOT_BOOT_DISK;
+		pcifn = 0;
+	} else if (is_env_string("device", disk, "media", "cdrom")) {
+		pcislot = PCI_SLOT_CD;
+		pcifn = next_cd;
+		next_cd++;
+	} else {
+		pcislot = PCI_SLOT_OTHER_DISKS;
+		pcifn = next_other;
+		next_other++;
+	}
+
+
+	if (is_env_string("device", disk, "model", "virtio")) {
+		model = "virtio-blk";
+	} else if (is_env_string("device", disk, "model", "ahci")) {
+		if (is_env_string("device", disk, "media", "cdrom")) {
+			model = "ahci-cd";
+		} else {
+			model = "ahci-hd";
+		}
+	} else {
+		(void) printf("Error: unknown disk model '%s'\n", model);
+		return (-1);
+	}
+
+	if (snprintf(slotconf, slotconf_len, "%d:%d,%s,%s",
+	    pcislot, pcifn, model, path) >= slotconf_len) {
+		(void) printf("Error: disk path '%s' too long\n", path);
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+add_ppt(int *argc, char **argv, char *ppt, char *path, char *slotconf,
+    size_t slotconf_len)
+{
+	static boolean_t wired = B_FALSE;
+	static boolean_t acpi = B_FALSE;
+	unsigned int bus = 0, dev = 0, func = 0;
+	char *pcislot;
+
+	pcislot = get_zcfg_var("device", ppt, "pci_slot");
+
+	if (pcislot == NULL) {
+		(void) printf("Error: device %s has no PCI slot\n", ppt);
+		return (-1);
+	}
+
+	switch (sscanf(pcislot, "%u:%u:%u", &bus, &dev, &func)) {
+	case 3:
+		break;
+	case 2:
+	case 1:
+		func = dev;
+		dev = bus;
+		bus = 0;
+		break;
+	default:
+		(void) printf("Error: device %d has illegal PCI slot: %s\n",
+		    dev, pcislot);
+		return (-1);
+	}
+
+	if (bus > 255 || dev > 31 || func > 7) {
+		(void) printf("Error: device %d has illegal PCI slot: %s\n",
+		    dev, pcislot);
+		return (-1);
+	}
+
+	if (bus > 0) {
+		if (!acpi && add_arg(argc, argv, "-A") != 0)
+			return (-1);
+		acpi = B_TRUE;
+	}
+
+	if (!wired && add_arg(argc, argv, "-S") != 0)
+		return (-1);
+
+	wired = B_TRUE;
+
+	if (snprintf(slotconf, slotconf_len, "%d:%d:%d,passthru,%s",
+	    bus, dev, func, path) >= slotconf_len) {
+		(void) printf("Error: device path '%s' too long\n", path);
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+add_devices(int *argc, char **argv)
+{
+	char *devices;
+	char *dev;
+	char *lasts;
+	char slotconf[MAXNAMELEN];
+
+	if ((devices = get_zcfg_var("device", "resources", NULL)) == NULL) {
+		return (0);
+	}
+
+	for (dev = strtok_r(devices, " ", &lasts); dev != NULL;
+	    dev = strtok_r(NULL, " ", &lasts)) {
+		int ret;
+		char *path;
+		char *model;
+
+		/* zoneadmd is not careful about a trailing delimiter. */
+		if (dev[0] == '\0') {
+			continue;
+		}
+
+		if ((path = get_zcfg_var("device", dev, "path")) == NULL) {
+			(void) printf("Error: device %s has no path\n", dev);
+			return (-1);
+		}
+
+		if ((model = get_zcfg_var("device", dev, "model")) == NULL) {
+			(void) printf("Error: device %s has no model\n", dev);
+			return (-1);
+		}
+
+		if (strcmp(model, "passthru") == 0) {
+			ret = add_ppt(argc, argv, dev, path, slotconf,
+			    sizeof (slotconf));
+		} else {
+			ret = add_disk(dev, path, slotconf, sizeof (slotconf));
+		}
+
+		if (ret != 0)
+			return (-1);
+
+		if (add_arg(argc, argv, "-s") != 0 ||
+		    add_arg(argc, argv, slotconf) != 0) {
+			return (-1);
+		}
+	}
+
+	return (0);
+}
+
+static int
+add_nets(int *argc, char **argv)
+{
+	char *nets;
+	char *net;
+	char *lasts;
+	int nextpcifn = 1;		/* 0 reserved for primary */
+	char slotconf[MAXNAMELEN];
+	char *primary = NULL;
+
+	if ((nets = get_zcfg_var("net", "resources", NULL)) == NULL) {
+		return (0);
+	}
+
+	for (net = strtok_r(nets, " ", &lasts); net != NULL;
+	    net = strtok_r(NULL, " ", &lasts)) {
+		int pcifn;
+
+		/* zoneadmd is not careful about a trailing delimiter. */
+		if (net[0] == '\0') {
+			continue;
+		}
+
+		/* Allow at most one "primary" net */
+		if (is_env_true("net", net, "primary")) {
+			if (primary != NULL) {
+				(void) printf("Error: "
+				    "multiple primary nets: %s %s\n",
+				    primary, net);
+				return (-1);
+			}
+			primary = net;
+			pcifn = 0;
+		} else {
+			pcifn = nextpcifn;
+			nextpcifn++;
+		}
+
+		if (snprintf(slotconf, sizeof (slotconf),
+		    "%d:%d,virtio-net-viona,%s", PCI_SLOT_NICS, pcifn, net) >=
+		    sizeof (slotconf)) {
+			(void) printf("Error: net '%s' too long\n", net);
+			return (-1);
+		}
+
+		if (add_arg(argc, argv, "-s") != 0 ||
+		    add_arg(argc, argv, slotconf) != 0) {
+			return (-1);
+		}
+	}
+
+	return (0);
+}
+
+static int
+add_lpc(int *argc, char **argv)
+{
+	char *lpcdevs[] = { "bootrom", "com1", "com2", NULL };
+	const int bootrom_idx = 0;
+	int i;
+	char *val;
+	char conf[MAXPATHLEN];
+	boolean_t found_bootrom = B_FALSE;
+
+	assert(strcmp(lpcdevs[bootrom_idx], "bootrom") == 0);
+
+	(void) snprintf(conf, sizeof (conf), "%d,lpc", PCI_SLOT_LPC);
+	if (add_arg(argc, argv, "-s") != 0 ||
+	    add_arg(argc, argv, conf) != 0) {
+		return (-1);
+	}
+
+	for (i = 0; lpcdevs[i] != NULL; i++) {
+		if ((val = get_zcfg_var("attr", lpcdevs[i], NULL)) == NULL) {
+			continue;
+		}
+		if (i == bootrom_idx) {
+			found_bootrom = B_TRUE;
+			if (strcmp(val, "bios") == 0) {
+				val = DEFAULT_BOOTROM_CSM;
+			} else if (strcmp(val, "uefi") == 0) {
+				val = DEFAULT_BOOTROM;
+                        }
+		}
+		if (snprintf(conf, sizeof (conf), "%s,%s", lpcdevs[i], val) >=
+		    sizeof (conf)) {
+			(void) printf("Error: value of attr '%s' too long\n",
+			    lpcdevs[i]);
+			return (-1);
+		}
+		if (add_arg(argc, argv, "-l") != 0 ||
+		    add_arg(argc, argv, conf) != 0) {
+			return (-1);
+		}
+	}
+
+	if (!found_bootrom) {
+		if (add_arg(argc, argv, "-l") != 0 ||
+		    add_arg(argc, argv, "bootrom," DEFAULT_BOOTROM_CSM) != 0) {
+			return (-1);
+		}
+	}
+
+	return (0);
+}
+
+static int
+add_bhyve_extra_opts(int *argc, char **argv)
+{
+	char *val;
+	char *tok;
+	char *lasts;
+
+	if ((val = get_zcfg_var("attr", "bhyve_extra_opts", NULL)) == NULL) {
+		return (0);
+	}
+
+	val = strdup(val);
+	if (val == NULL) {
+		(void) printf("Error: strdup failed\n");
+		return (-1);
+	}
+
+	for (tok = strtok_r(val, " \t", &lasts); tok != NULL;
+	    tok = strtok_r(NULL, " \t", &lasts)) {
+		if (tok[0] == '\0') {
+			continue;
+		}
+		if (add_arg(argc, argv, tok) != 0) {
+			return (-1);
+		}
+	}
+
+	free(val);
+	return (0);
+}
+
+/*
+ * Adds the frame buffer and an xhci tablet to help with the pointer.
+ */
+static int
+add_fbuf(int *argc, char **argv)
+{
+	char conf[MAXPATHLEN];
+	int len;
+
+	/*
+	 * Do not add a frame buffer or tablet if VNC is disabled.
+	 */
+	if (is_env_string("attr", "vnc_port", NULL, "-1")) {
+		return (0);
+	}
+
+	len = snprintf(conf, sizeof (conf),
+	    "%d:0,fbuf,vga=off,unix=/tmp/vm.vnc", PCI_SLOT_FBUF);
+	assert(len < sizeof (conf));
+
+	if (add_arg(argc, argv, "-s") != 0 ||
+	    add_arg(argc, argv, conf) != 0) {
+		return (-1);
+	}
+
+	len = snprintf(conf, sizeof (conf), "%d:1,xhci,tablet", PCI_SLOT_FBUF);
+	assert(len < sizeof (conf));
+
+	if (add_arg(argc, argv, "-s") != 0 ||
+	    add_arg(argc, argv, conf) != 0) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+/* Must be called last */
+static int
+add_vmname(int *argc, char **argv)
+{
+	char buf[32];				/* VM_MAX_NAMELEN */
+	char *val = getenv("_ZONECFG_did");
+
+	if (val == NULL || val[0] == '\0') {
+		val = "SYSbhyve-unknown";
+	} else {
+		(void) snprintf(buf, sizeof (buf), "SYSbhyve-%s", val);
+		val = buf;
+	}
+	if (add_arg(argc, argv, val) != 0) {
+		return (-1);
+	}
+	return (0);
+}
+
+/*
+ * Write the entire buffer or return an error.  This function could be more
+ * paranoid and call fdsync() at the end.  That's not really need for this use
+ * case because it is being written to tmpfs.
+ */
+static int
+full_write(int fd, char *buf, size_t buflen)
+{
+	ssize_t nwritten;
+	size_t totwritten = 0;
+
+	while (totwritten < buflen) {
+		nwritten = write(fd, buf + totwritten, buflen - totwritten);
+		if (nwritten < 0) {
+			if (errno == EAGAIN || errno == EINTR) {
+				continue;
+			}
+			return (-1);
+		}
+		assert(nwritten > 0);
+		totwritten += nwritten;
+	}
+	assert(totwritten == buflen);
+
+	return (0);
+}
+
+static void
+init_debug(void)
+{
+	char *val = getenv("_ZONEADMD_brand_debug");
+
+	debug = (val != NULL && val[0] != '\0');
+}
+
+static int
+setup_reboot(void)
+{
+	zoneid_t	zoneid;
+
+	if ((zoneid = getzoneidbyname(zonename)) < 0) {
+		(void) printf("Error: bhyve zoneid (%s) does not exist\n",
+		    zonename);
+		return (-1);
+	}
+
+	if (zoneid == GLOBAL_ZONEID) {
+		(void) printf("Error: bhyve global zoneid (%s)\n", zonename);
+		return (-1);
+	}
+
+	if (zone_setattr(zoneid, ZONE_ATTR_INITREBOOT, NULL, 0) < 0 ||
+	    zone_setattr(zoneid, ZONE_ATTR_INITRESTART0, NULL, 0) < 0) {
+		(void) printf("Error: bhyve zoneid %ld setattr failed: %s\n",
+		    zoneid, strerror(errno));
+		return (-1);
+	}
+
+	return (0);
+}
+
+int
+main(int argc, char **argv)
+{
+	int fd, err;
+	char *zhargv[ZH_MAXARGS] = {
+		"bhyve",	/* Squats on argv[0] */
+		"-H",		/* vmexit on halt isns */
+		NULL };
+	int zhargc = 2;
+	nvlist_t *nvl;
+	char *nvbuf = NULL;
+	size_t nvbuflen = 0;
+	char zoneroot[MAXPATHLEN];
+	int zrfd;
+
+	init_debug();
+
+	if (argc != 3) {
+		(void) printf("Error: bhyve boot program called with "
+		    "%d args, expecting 2\n", argc - 1);
+		return (1);
+	}
+	zonename = argv[1];
+	zonepath = argv[2];
+
+	if (setup_reboot() < 0)
+		return (1);
+
+	if (add_smbios(&zhargc, (char **)&zhargv) != 0 ||
+	    add_lpc(&zhargc, (char **)&zhargv) != 0 ||
+	    add_cpu(&zhargc, (char **)&zhargv) != 0 ||
+	    add_ram(&zhargc, (char **)&zhargv) != 0 ||
+	    add_devices(&zhargc, (char **)&zhargv) != 0 ||
+	    add_nets(&zhargc, (char **)&zhargv) != 0 ||
+	    add_bhyve_extra_opts(&zhargc, (char **)&zhargv) != 0 ||
+	    add_fbuf(&zhargc, (char **)&zhargv) != 0 ||
+	    add_vmname(&zhargc, (char **)&zhargv) != 0) {
+		return (1);
+	}
+
+	/*
+	 * This and other dynamically allocated resources are intentionally
+	 * leaked.  It's a short-lived program and it will all get mopped up on
+	 * exit.
+	 */
+	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0 ||
+	    nvlist_add_string_array(nvl, "bhyve_args", zhargv, zhargc) != 0) {
+		(void) printf("Error: failed to create nvlist: %s\n",
+		    strerror(errno));
+		return (1);
+	}
+
+	if (debug) {
+		dprintf(("packing nvlist:\n"));
+		nvlist_print(stdout, nvl);
+	}
+
+	err = nvlist_pack(nvl, &nvbuf, &nvbuflen, NV_ENCODE_XDR, 0);
+	if (err != 0) {
+		(void) printf("Error: failed to pack nvlist: %s\n",
+		    strerror(err));
+		return (1);
+	}
+
+	if (snprintf(zoneroot, sizeof (zoneroot), "%s/root", zonepath) >=
+	    sizeof (zoneroot)) {
+		(void) printf("Error: zonepath '%s' too long\n", zonepath);
+		return (1);
+	}
+
+	if ((zrfd = open(zoneroot, O_RDONLY|O_SEARCH)) < 0) {
+		(void) printf("Error: cannot open zone root '%s': %s\n",
+		    zoneroot, strerror(errno));
+		return (1);
+	}
+
+	/*
+	 * This mkdirat() and the subsequent openat() are only safe because the
+	 * zone root is always under the global zone's exclusive control (always
+	 * read-only in all zones) and the writable directory is a tmpfs file
+	 * system that was just mounted and no zone code has run yet.
+	 */
+	if (mkdirat(zrfd, BHYVE_DIR, 0700) != 0 && errno != EEXIST) {
+		(void) printf("Error: failed to create directory %s "
+		    "in zone: %s\n", BHYVE_DIR, strerror(errno));
+		return (1);
+	}
+
+	fd = openat(zrfd, BHYVE_ARGS_FILE, O_WRONLY|O_CREAT|O_EXCL, 0600);
+	if (fd < 0) {
+		(void) printf("Error: failed to create file %s in zone: %s\n",
+		    BHYVE_ARGS_FILE, strerror(errno));
+		return (1);
+	}
+	if (full_write(fd, nvbuf, nvbuflen) != 0) {
+		(void) printf("Error: failed to write %s: %s\n",
+		    BHYVE_ARGS_FILE, strerror(errno));
+		(void) unlink(BHYVE_ARGS_FILE);
+		return (1);
+	}
+
+	return (0);
+}
diff --git a/usr/src/lib/brand/bhyve/zone/config.xml b/usr/src/lib/brand/bhyve/zone/config.xml
new file mode 100644
index 0000000000..82b95f4e57
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/config.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+
+<!--
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+ DO NOT EDIT THIS FILE.
+-->
+
+<!DOCTYPE brand PUBLIC "-//Joyent Inc//DTD Brands//EN"
+    "file:///usr/share/lib/xml/dtd/brand.dtd.1">
+
+<brand name="bhyve">
+	<modname></modname>
+
+	<initname>/usr/lib/brand/bhyve/zhyve</initname>
+	<login_cmd />
+	<forcedlogin_cmd />
+	<user_cmd />
+
+	<!-- XXX-mg
+	  Until we have better separation of concerns, bhyve brand will use the
+	  kvm installer, which is intertwined with vmadm.
+	-->
+	<install>/usr/lib/brand/kvm/kinstall -z %z -R %R</install>
+	<installopts>R:t:U:q:z:</installopts>
+	<boot>/usr/lib/brand/bhyve/boot %z %R</boot>
+	<halt />
+	<verify_cfg />
+	<verify_adm />
+	<postclone />
+	<postinstall />
+	<attach>/usr/lib/brand/bhyve/attach -z %z -R %R</attach>
+	<detach>/usr/lib/brand/bhyve/detach -z %z -R %R</detach>
+	<clone />
+	<uninstall>/usr/lib/brand/bhyve/uninstall -z %z -R %R</uninstall>
+	<prestatechange>/usr/lib/brand/bhyve/statechange pre %z %R</prestatechange>
+	<poststatechange>/usr/lib/brand/bhyve/statechange post %z %R</poststatechange>
+
+	<privilege set="default" name="net_rawaccess" ip-type="exclusive" />
+	<privilege set="default" name="proc_clock_highres" />
+	<privilege set="default" name="proc_lock_memory" />
+	<privilege set="default" name="sys_admin" />
+	<privilege set="default" name="sys_mount" />
+
+	<privilege set="prohibited" name="dtrace_kernel" />
+	<privilege set="prohibited" name="proc_zone" />
+	<privilege set="prohibited" name="sys_config" />
+	<privilege set="prohibited" name="sys_devices" />
+	<privilege set="prohibited" name="sys_ip_config" ip-type="shared" />
+	<privilege set="prohibited" name="sys_linkdir" />
+	<privilege set="prohibited" name="sys_net_config" />
+	<privilege set="prohibited" name="sys_res_config" />
+	<privilege set="prohibited" name="sys_suser_compat" />
+	<privilege set="prohibited" name="xvm_control" />
+	<privilege set="prohibited" name="virt_manage" />
+	<privilege set="prohibited" name="sys_ppp_config" ip-type="shared" />
+
+	<privilege set="required" name="proc_exec" />
+	<privilege set="required" name="sys_mount" />
+</brand>
diff --git a/usr/src/lib/brand/bhyve/zone/detach b/usr/src/lib/brand/bhyve/zone/detach
new file mode 100755
index 0000000000..8a41815258
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/detach
@@ -0,0 +1,19 @@
+#!/bin/ksh -p
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+ps_brand="bhyve"
+. /usr/lib/brand/jcommon/cdetach
diff --git a/usr/src/lib/brand/bhyve/zone/platform.xml b/usr/src/lib/brand/bhyve/zone/platform.xml
new file mode 100644
index 0000000000..0aa8d875c3
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/platform.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0"?>
+
+<!--
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+ DO NOT EDIT THIS FILE.
+-->
+
+<!DOCTYPE platform PUBLIC "-//Joyent Inc//Zones Platform//EN"
+    "file:///usr/share/lib/xml/dtd/zone_platform.dtd.1">
+
+<platform name="bhyve" allow-exclusive-ip="true">
+
+	<!-- Global filesystems to mount when booting the zone -->
+	<global_mount special="/dev" directory="/dev" type="dev"
+	    opt="attrdir=%R/root/dev"/>
+	<global_mount special="/lib" directory="/lib"
+	    opt="ro,nodevices,nosub" type="lofs" />
+	<global_mount special="/usr" directory="/usr"
+	    opt="ro,nodevices,nosub" type="lofs" />
+
+	<!-- Local filesystems to mount when booting the zone -->
+	<mount special="swap" directory="/var/run" type="tmpfs"
+	    opt="size=50m"/>
+
+	<!-- Needed by dlmgmtd -->
+	<mount special="swap" directory="/etc/svc/volatile" type="tmpfs"
+	    opt="size=10m" />
+
+	<!-- Devices to create under /dev -->
+	<device match="dld" ip-type="exclusive" />
+	<device match="fd" />
+	<device match="null" />
+	<device match="random" />
+	<device match="rdsk" />
+	<device match="viona" />
+
+	<!--
+	    Careful: this is not just about catching both /dev/vmmctl and the
+	    /dev/vmm directory.  In fact it's required to prevent a race where
+	    sdev processes "/dev/vmm/", sees it doesn't exist in the global
+	    /dev (as the module isn't loaded), then never updates its own sdev
+	    directory.  Adding the glob here ensures it's checked as needed.
+	-->
+	<device match="vmm*" />
+
+	<!-- Renamed devices to create under /dev -->
+	<device match="zcons/%z/zoneconsole" name="zconsole" />
+	<device match="zfd/%z/slave/1" name="zfd/1" />
+	<device match="zfd/%z/slave/2" name="zfd/2" />
+
+	<!-- Symlinks to create under /dev -->
+	<symlink source="console" target="zconsole" />
+	<symlink source="stderr" target="./fd/2" />
+	<symlink source="stdin" target="./fd/0" />
+	<symlink source="stdout" target="./fd/1" />
+
+</platform>
diff --git a/usr/src/lib/brand/bhyve/zone/statechange b/usr/src/lib/brand/bhyve/zone/statechange
new file mode 100644
index 0000000000..76cfbffc17
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/statechange
@@ -0,0 +1,22 @@
+#! /bin/ksh
+
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+ps_brand=bhyve
+
+typeset -A FORCED_ATTRS
+FORCED_ATTRS["zlog-mode"]=g--
+FORCED_ATTRS["zlog-name"]=platform.log
+
+. /usr/lib/brand/jcommon/statechange
diff --git a/usr/src/lib/brand/bhyve/zone/uninstall b/usr/src/lib/brand/bhyve/zone/uninstall
new file mode 100755
index 0000000000..136044ad9e
--- /dev/null
+++ b/usr/src/lib/brand/bhyve/zone/uninstall
@@ -0,0 +1,23 @@
+#!/bin/ksh -p
+#
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+function jcommon_uninstall_hook
+{
+	:
+}
+
+. /usr/lib/brand/jcommon/cuninstall
diff --git a/usr/src/lib/brand/lx/Makefile b/usr/src/lib/brand/lx/Makefile
new file mode 100644
index 0000000000..bdf0c9f441
--- /dev/null
+++ b/usr/src/lib/brand/lx/Makefile
@@ -0,0 +1,55 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2017 Joyent, Inc.
+#
+
+default: all
+
+include Makefile.lx
+
+# Build everything in parallel; use .WAIT for dependencies
+.PARALLEL:
+
+SUBDIRS=	librtld_db lx_support lx_init lx_lockd lx_brand netfiles \
+		zone lx_vdso testing .WAIT
+MSGSUBDIRS=	lx_brand lx_support zone
+
+all :=		TARGET= all
+install :=	TARGET= install
+clean :=	TARGET= clean
+clobber :=	TARGET= clobber
+lint :=		TARGET= lint
+_msg :=		TARGET= _msg
+
+.KEEP_STATE:
+
+all install clean clobber lint: $(SUBDIRS)
+
+_msg: $(MSGSUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/lib/brand/lx/Makefile.lx b/usr/src/lib/brand/lx/Makefile.lx
new file mode 100644
index 0000000000..4db4679cef
--- /dev/null
+++ b/usr/src/lib/brand/lx/Makefile.lx
@@ -0,0 +1,34 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+# lib/brand/lx/Makefile.lx
+#
+# include global definitions
+
+BRAND=	lx
+
+include $(SRC)/lib/brand/Makefile.brand
+
diff --git a/usr/src/cmd/ssh/Makefile b/usr/src/lib/brand/lx/librtld_db/Makefile
index c68aa94238..2fc0a818f6 100644
--- a/usr/src/cmd/ssh/Makefile
+++ b/usr/src/lib/brand/lx/librtld_db/Makefile
@@ -20,39 +20,35 @@
 #
 
 #
-# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
 
-include		../Makefile.cmd
+default: all
 
-SUBDIRS= \
-	etc
+include $(SRC)/lib/Makefile.lib
 
-CLOBBERFILES += $(MSGFILE) THIRDPARTYLICENSE
+SUBDIRS = $(MACH)
+$(BUILD64)SUBDIRS += $(MACH64)
 
-.KEEP_STATE:
+LINT_SUBDIRS=	$(MACH)
+$(BUILD64)LINT_SUBDIRS += $(MACH64)
 
 all :=          TARGET= all
 clean :=        TARGET= clean
 clobber :=      TARGET= clobber
 install :=      TARGET= install
+lint :=         TARGET= lint
 
-all clean install: $(SUBDIRS)
-
-lint:
-
-clobber: $(SUBDIRS) clobber_local
-clobber_local:
-	$(RM) $(CLOBBERFILES)
+.KEEP_STATE:
 
-all install: THIRDPARTYLICENSE
+all install clean clobber: $(SUBDIRS)
 
-$(SUBDIRS):     FRC
-	cd $@; pwd; $(MAKE) $(TARGET)
+lint: $(LINT_SUBDIRS)
 
-# skip the summary; just include the actual license clauses.
-THIRDPARTYLICENSE: doc/LICENCE
-	$(SED) -n '/1)/,$$p' doc/LICENCE > $@
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
 
 FRC:
diff --git a/usr/src/lib/brand/lx/librtld_db/Makefile.com b/usr/src/lib/brand/lx/librtld_db/Makefile.com
new file mode 100644
index 0000000000..202cc0fe7b
--- /dev/null
+++ b/usr/src/lib/brand/lx/librtld_db/Makefile.com
@@ -0,0 +1,83 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+LIBRARY =	lx_librtld_db.a
+VERS	=	.1
+COBJS	=	lx_librtld_db.o
+OBJECTS	=	$(COBJS) $(COBJS64)
+
+include $(SRC)/lib/Makefile.lib
+include ../../Makefile.lx
+
+CSRCS =       $(COBJS:%o=../common/%c)
+SRCS  =       $(CSRCS)
+
+SRCDIR =	../common
+UTSBASE	=	$(SRC)/uts
+
+#
+# ATTENTION:
+#	Librtl_db brand plugin libraries should NOT directly invoke any
+#	libproc.so interfaces or be linked against libproc.  If a librtl_db
+#	brand plugin library uses libproc.so interfaces then it may break
+#	any other librtld_db consumers (like mdb) that tries to attach
+#	to a branded process.  The only safe interfaces that the a librtld_db
+#	brand plugin library can use to access a target process are the
+#	proc_service(3PROC) apis.
+#
+DYNFLAGS +=	$(VERSREF) -M../common/mapfile-vers
+LIBS =		$(DYNLIB)
+LDLIBS +=	-lc -lrtld_db
+CFLAGS +=	$(CCVERBOSE)
+CPPFLAGS +=	-D_REENTRANT -I../ -I$(UTSBASE)/common/brand/lx \
+			-I$(SRC)/cmd/sgs/librtld_db/common \
+			-I$(SRC)/cmd/sgs/include \
+			-I$(SRC)/cmd/sgs/include/$(MACH)
+
+ROOTLIBDIR =	$(ROOT)/usr/lib/brand/lx
+ROOTLIBDIR64 =	$(ROOT)/usr/lib/brand/lx/$(MACH64)
+
+#
+# The top level Makefiles define define TEXT_DOMAIN.  But librtld_db.so.1
+# isn't internationalized and this library won't be either.  The only
+# messages that this library can generate are messages used for debugging
+# the operation of the library itself.
+#
+DTEXTDOM =
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+lint: lintcheck
+
+pics/%64.o:	../common/%.c
+		$(COMPILE.c) -D_ELF64 $(PICFLAGS) -o $@ $<
+		$(POST_PROCESS_O)
+
+include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/lib/brand/lx/librtld_db/amd64/Makefile b/usr/src/lib/brand/lx/librtld_db/amd64/Makefile
new file mode 100644
index 0000000000..726e7ef6d3
--- /dev/null
+++ b/usr/src/lib/brand/lx/librtld_db/amd64/Makefile
@@ -0,0 +1,38 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+COBJS64 =	lx_librtld_db64.o
+
+include ../Makefile.com
+include $(SRC)/lib/Makefile.lib.64
+
+DYNFLAGS +=	-Mmapfile-vers
+
+CLOBBERFILES = $(ROOTLIBDIR64)/$(DYNLIB)
+
+install: all $(ROOTLIBS64)
diff --git a/usr/src/tools/ctf/dump/Makefile.com b/usr/src/lib/brand/lx/librtld_db/amd64/mapfile-vers
index 9877fa06a3..4893b02998 100644
--- a/usr/src/tools/ctf/dump/Makefile.com
+++ b/usr/src/lib/brand/lx/librtld_db/amd64/mapfile-vers
@@ -18,50 +18,27 @@
 #
 # CDDL HEADER END
 #
+
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 
-.KEEP_STATE:
-.SUFFIXES:
-
-PROG = ctfdump
-SRCS = dump.c utils.c symbol.c
-
-include ../../Makefile.ctf
-
-LDFLAGS += -L$(NATIVE_ADJUNCT)/lib
-LDLIBS += -lelf -lz
-
-OBJS = $(SRCS:%.c=%.o)
-LINTFILES = $(SRCS:%.c=%.ln)
-
-CERRWARN += -_gcc=-Wno-uninitialized
-
-.NO_PARALLEL:
-.PARALLEL: $(OBJS) $(LINTFILES)
-
-all: $(PROG)
-
-$(PROG): $(OBJS)
-	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
-	$(POST_PROCESS)
-
-%.o: ../%.c
-	$(COMPILE.c) $<
-
-$(ROOTONBLDMACHPROG): $(PROG)
-
-install: $(ROOTONBLDMACHPROG)
-
-clean:
-	$(RM) $(OBJS) $(LINTFILES)
-
-%.ln: ../%.c
-	$(LINT.c) -c $<
-
-lint: $(LINTFILES)
-	$(LINT) $(LINTFLAGS) $(LINTFILES) $(LDLIBS)
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
 
-include ../../Makefile.ctf.targ
+SUNWprivate_1.1 {
+	global:
+		rtld_db_brand_ops64;
+};
diff --git a/usr/src/lib/brand/lx/librtld_db/common/lx_librtld_db.c b/usr/src/lib/brand/lx/librtld_db/common/lx_librtld_db.c
new file mode 100644
index 0000000000..ddea4f910d
--- /dev/null
+++ b/usr/src/lib/brand/lx/librtld_db/common/lx_librtld_db.c
@@ -0,0 +1,852 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc. All rights reserved.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/types.h>
+#include <sys/link.h>
+#include <libproc.h>
+#include <proc_service.h>
+#include <rtld_db.h>
+#include <synch.h>
+
+#include <sys/lx_brand.h>
+
+/*
+ * Overview of this library derived from the original "BrandZ" PSARC design
+ * document.
+ *
+ * Since Linux binaries are standard ELF objects, Illumos debug tools (i.e. mdb
+ * or ptools) are able to process them in essentially the same way that Illumos
+ * binaries are processed. The main objective is to retrieve symbols and
+ * thereby aid debugging and observability. Unfortunately, most Linux
+ * distributions strip(1) their binaries as a misguided "optimization" so the
+ * majority of the useful debugging information is lost.
+ *
+ * The debug tools use interfaces provided by librtld_db to debug live
+ * processes and core files. librtld_db discovers ELF objects which have been
+ * mapped into the target's address space and reports these back to the tool.
+ * The librtld_db library understands enough of the internals of the Illumos
+ * runtime linker to iterate over the linker's private link maps and process
+ * the objects it finds. librtld_db allows our tools to debug the Illumos
+ * portions of a branded process (e.g. the brand library, libc, etc.) but they
+ * can't understand any Linux objects that are mapped into the address space
+ * because the Illumos linker only has Illumos objects on its link maps.
+ *
+ * In order to give the tools visibility into Linux binaries, a brand helper
+ * framework is implemented in librtld_db. When librtld_db is asked to examine
+ * a branded target process or core file, it uses the AT_SUN_BRANDNAME aux
+ * vector to get our brand name (lx). It then dlopen-s this lx_librtld_db.so
+ * helper library.
+ *
+ * Once loaded, this helper library is responsible for finding any lx-specific
+ * information it needs, such as the Linux equivalent LDDATA aux entry and
+ * preparing to return details about the objects loaded into the address space
+ * by the Linux linker.
+ *
+ * When a debug tool asks to know what objects are loaded in the target,
+ * librtld_db walks the Illumos link maps and iterates over each object it
+ * finds there, handing information about each to the tool. It then calls down
+ * into this helper library, which does the same for the brand-specific objects
+ * used by the target.
+ *
+ * This debug-helper code contains a bunch of helpful ps_plog calls. To enable
+ * this output with the ptools (e.g. pmap) set LIBPROC_DEBUG=1 in your
+ * environment. To enable it with mdb set MDB_DEBUG=psvc in your environment.
+ */
+
+/*
+ * ATTENTION:
+ *	Librtl_db brand plugin libraries should NOT directly invoke any
+ *	libproc.so interfaces or be linked against libproc.  If a librtl_db
+ *	brand plugin library uses libproc.so interfaces then it may break
+ *	any other librtld_db consumers (like mdb) that tries to attach
+ *	to a branded process.  The only safe interfaces that the a librtld_db
+ *	brand plugin library can use to access a target process are the
+ *	proc_service(3PROC) apis.
+ */
+
+/*
+ * M_DATA comes from some streams header file but is also redifined in
+ * _rtld_db.h, so nuke the old streams definition here.
+ */
+#ifdef M_DATA
+#undef M_DATA
+#endif /* M_DATA */
+
+/*
+ * For 32-bit versions of this library, this file gets compiled once.
+ * For 64-bit versions of this library, this file gets compiled twice,
+ * once with _ELF64 defined and once without.  The expectation is that
+ * the 64-bit version of the library can properly deal with both 32-bit
+ * and 64-bit elf files, hence in the 64-bit library there are two copies
+ * of all the interfaces in this file, one set named *32 and one named *64.
+ *
+ * This also means that we need to be careful when declaring local pointers
+ * that point to objects in another processes address space, since these
+ * pointers may not match the current processes pointer width.  Basically,
+ * we should avoid using data types that change size between 32 and 64 bit
+ * modes like: long, void *, uintptr_t, caddr_t, psaddr_t, size_t, etc.
+ * Instead we should declare all pointers as uint32_t.  Then when we
+ * are compiled to deal with 64-bit targets we'll re-define uint32_t
+ * to be a uint64_t.
+ */
+#ifdef _LP64
+#ifdef _ELF64
+#define	lx_ldb_get_dyns32		lx_ldb_get_dyns64
+#define	lx_ldb_init32			lx_ldb_init64
+#define	lx_ldb_fini32			lx_ldb_fini64
+#define	lx_ldb_loadobj_iter32		lx_ldb_loadobj_iter64
+#define	lx_ldb_getauxval32		lx_ldb_getauxval64
+#define	lx_elf_props32			lx_elf_props64
+#define	_rd_get_dyns32			_rd_get_dyns64
+#define	_rd_get_ehdr32			_rd_get_ehdr64
+#define	uint32_t			uint64_t
+#define	Elf32_Dyn			Elf64_Dyn
+#define	Elf32_Ehdr			Elf64_Ehdr
+#define	Elf32_Phdr			Elf64_Phdr
+#define	Elf32_Sym			Elf64_Sym
+#endif /* _ELF64 */
+#endif /* _LP64 */
+
+/* Included from usr/src/cmd/sgs/librtld_db/common */
+#include <_rtld_db.h>
+
+typedef struct lx_rd {
+	rd_agent_t		*lr_rap;
+	struct ps_prochandle	*lr_php;	/* proc handle pointer */
+	uint32_t		lr_rdebug;	/* address of lx r_debug */
+	uint32_t		lr_exec;	/* base address of executable */
+} lx_rd_t;
+
+typedef struct lx_link_map {
+	uint32_t lxm_addr;	/* Base address shared object is loaded at.  */
+	uint32_t lxm_name;	/* Absolute file name object was found in.  */
+	uint32_t lxm_ld;	/* Dynamic section of the shared object.  */
+	uint32_t lxm_next;	/* Chain of loaded objects.  */
+} lx_link_map_t;
+
+typedef struct lx_r_debug {
+	int r_version;		/* Version number for this protocol.  */
+	uint32_t	r_map;	/* Head of the chain of loaded objects. */
+
+	/*
+	 * This is the address of a function internal to the run-time linker,
+	 * that will always be called when the linker begins to map in a
+	 * library or unmap it, and again when the mapping change is complete.
+	 * The debugger can set a breakpoint at this address if it wants to
+	 * notice shared object mapping changes.
+	 */
+	uint32_t	r_brk;
+	r_state_e	r_state; /* defined the same way between lx/solaris */
+	uint32_t	r_ldbase; /* Base address the linker is loaded at. */
+} lx_r_debug_t;
+
+static uint32_t
+lx_ldb_getauxval32(struct ps_prochandle *php, int type)
+{
+	const auxv_t		*auxvp = NULL;
+
+	if (ps_pauxv(php, &auxvp) != PS_OK)
+		return ((uint32_t)-1);
+
+	while (auxvp->a_type != AT_NULL) {
+		if (auxvp->a_type == type)
+			return ((uint32_t)(uintptr_t)auxvp->a_un.a_ptr);
+		auxvp++;
+	}
+	return ((uint32_t)-1);
+}
+
+/*
+ * A key difference between the linux linker and ours' is that the linux
+ * linker adds the base address of segments to certain values in the
+ * segments' ELF header. As an example, look at the address of the
+ * DT_HASH hash table in a Solaris section - it is a relative address
+ * which locates the start of the hash table, relative to the beginning
+ * of the ELF file. However, when the linux linker loads a section, it
+ * modifies the in-memory ELF image by changing address of the hash
+ * table to be an absolute address. This is only done for libraries - not for
+ * executables.
+ *
+ * Solaris tools expect the relative address to remain relative, so
+ * here we will modify the in-memory ELF image so that it once again
+ * contains relative addresses.
+ *
+ * To accomplish this, we walk through all sections in the target.
+ * Linux sections are identified by pointing to the linux linker or libc in the
+ * DT_NEEDED section. For all matching sections, we subtract the segment
+ * base address to get back to relative addresses.
+ */
+static rd_err_e
+lx_ldb_get_dyns32(rd_helper_data_t rhd,
+    psaddr_t addr, void **dynpp, size_t *dynpp_sz)
+{
+	lx_rd_t			*lx_rd = (lx_rd_t *)rhd;
+	rd_agent_t		*rap = lx_rd->lr_rap;
+	Elf32_Ehdr		ehdr;
+	Elf32_Dyn		*dynp = NULL;
+	size_t			dynp_sz;
+	uint_t			ndyns;
+	int			i;
+
+	ps_plog("lx_ldb_get_dyns: invoked for object at 0x%p", addr);
+
+	/* Read in a copy of the ehdr */
+	if (_rd_get_ehdr32(rap, addr, &ehdr, NULL) != RD_OK) {
+		ps_plog("lx_ldb_get_dyns: _rd_get_ehdr() failed");
+		return (RD_ERR);
+	}
+
+	/* read out the PT_DYNAMIC elements for this object */
+	if (_rd_get_dyns32(rap, addr, &dynp, &dynp_sz) != RD_OK) {
+		ps_plog("lx_ldb_get_dyns: _rd_get_dyns() failed");
+		return (RD_ERR);
+	}
+
+	/*
+	 * From here on out if we encounter an error we'll just return
+	 * success and pass back the unmolested dynamic elements that
+	 * we've already obtained.
+	 */
+	if (dynpp != NULL)
+		*dynpp = dynp;
+	if (dynpp_sz != NULL)
+		*dynpp_sz = dynp_sz;
+	ndyns = dynp_sz / sizeof (Elf32_Dyn);
+
+	/* If this isn't a dynamic object, there's nothing left todo */
+	if (ehdr.e_type != ET_DYN) {
+		ps_plog("lx_ldb_get_dyns: done: not a shared object");
+		return (RD_OK);
+	}
+
+	/*
+	 * Before we blindly start changing dynamic section addresses
+	 * we need to figure out if the current object that we're looking
+	 * at is a linux object or a solaris object.  To do this first
+	 * we need to find the string tab dynamic section element.
+	 */
+	for (i = 0; i < ndyns; i++) {
+		if (dynp[i].d_tag == DT_STRTAB)
+			break;
+	}
+	if (i == ndyns) {
+		ps_plog("lx_ldb_get_dyns: "
+		    "failed to find string tab in the dynamic section");
+		return (RD_OK);
+	}
+
+	/*
+	 * Check if the strtab value looks like an offset or an address.
+	 * It's an offset if the value is less then the base address that
+	 * the object is loaded at, or if the value is less than the offset
+	 * of the section headers in the same elf object.  This check isn't
+	 * perfect, but in practice it's good enough.
+	 */
+	if ((dynp[i].d_un.d_ptr < addr) ||
+	    (dynp[i].d_un.d_ptr < ehdr.e_shoff)) {
+		ps_plog("lx_ldb_get_dyns: "
+		    "doesn't appear to be an lx object");
+		return (RD_OK);
+	}
+
+	/*
+	 * This seems to be a a linux object, so we'll patch up the dynamic
+	 * section addresses
+	 */
+	ps_plog("lx_ldb_get_dyns: "
+	    "patching up lx object dynamic section addresses");
+	for (i = 0; i < ndyns; i++) {
+		switch (dynp[i].d_tag) {
+		case DT_PLTGOT:
+		case DT_HASH:
+		case DT_STRTAB:
+		case DT_SYMTAB:
+		case DT_RELA:
+		case DT_REL:
+		case DT_DEBUG:
+		case DT_JMPREL:
+		case DT_VERSYM:
+			if (dynp[i].d_un.d_val > addr) {
+				dynp[i].d_un.d_ptr -= addr;
+			}
+			break;
+		default:
+			break;
+		}
+	}
+	return (RD_OK);
+}
+
+static void
+lx_ldb_fini32(rd_helper_data_t rhd)
+{
+	lx_rd_t *lx_rd = (lx_rd_t *)rhd;
+	ps_plog("lx_ldb_fini: cleaning up lx helper");
+	free(lx_rd);
+}
+
+/*
+ * The linux linker has an r_debug structure somewhere in its data section that
+ * contains the address of the head of the link map list. To find this, we will
+ * use the DT_DEBUG token in the executable's dynamic section. The linux linker
+ * wrote the address of its r_debug structure to the DT_DEBUG dynamic entry. We
+ * get the address of the executable's program headers from the
+ * AT_SUN_BRAND_LX_PHDR aux vector entry. From there, we calculate the
+ * address of the Elf header, and from there we can easily get to the DT_DEBUG
+ * entry.
+ */
+static rd_helper_data_t
+lx_ldb_init32(rd_agent_t *rap, struct ps_prochandle *php)
+{
+	lx_rd_t		*lx_rd;
+	uint32_t	addr, phdr_addr, dyn_addr;
+	uint32_t	symtab, strtab, offs;
+	uint32_t	vaddr, memsz;
+	caddr_t		mem;
+	Elf32_Dyn	*dyn;
+	Elf32_Phdr	phdr, *ph, *dph, *phdrs;
+	Elf32_Ehdr	ehdr;
+	Elf32_Sym	*sym;
+	int		i, dyn_count;
+
+	lx_rd = calloc(sizeof (lx_rd_t), 1);
+	if (lx_rd == NULL) {
+		ps_plog("lx_ldb_init: cannot allocate memory");
+		return (NULL);
+	}
+	lx_rd->lr_rap = rap;
+	lx_rd->lr_php = php;
+
+	phdr_addr = lx_ldb_getauxval32(php, AT_SUN_BRAND_LX_PHDR);
+	if (phdr_addr == (uint32_t)-1) {
+		ps_plog("lx_ldb_init: no LX_PHDR found in aux vector");
+		return (NULL);
+	}
+	ps_plog("lx_ldb_init: found LX_PHDR auxv phdr at: 0x%p",
+	    phdr_addr);
+
+	if (ps_pread(php, phdr_addr, &phdr, sizeof (phdr)) != PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read phdr at 0x%p",
+		    phdr_addr);
+		free(lx_rd);
+		return (NULL);
+	}
+
+	/* The ELF header should be before the program header in memory */
+	lx_rd->lr_exec = addr = phdr_addr - phdr.p_offset;
+	if (ps_pread(php, addr, &ehdr, sizeof (ehdr)) != PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read ehdr at 0x%p",
+		    lx_rd->lr_exec);
+		free(lx_rd);
+		return (NULL);
+	}
+	ps_plog("lx_ldb_init: read ehdr at: 0x%p", addr);
+	ps_plog("lx_ldb_init: ehdr t %d ent 0x%p poff 0x%p psize %d pnum %d",
+	    ehdr.e_type, ehdr.e_entry, ehdr.e_phoff, ehdr.e_phentsize,
+	    ehdr.e_phnum);
+
+	if ((phdrs = malloc(ehdr.e_phnum * ehdr.e_phentsize)) == NULL) {
+		ps_plog("lx_ldb_init: couldn't alloc phdrs memory");
+		free(lx_rd);
+		return (NULL);
+	}
+
+	if (ps_pread(php, phdr_addr, phdrs, ehdr.e_phnum * ehdr.e_phentsize) !=
+	    PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read phdrs at 0x%p",
+		    phdr_addr);
+		free(lx_rd);
+		free(phdrs);
+		return (NULL);
+	}
+
+	/* program headers */
+	ps_plog("lx_ldb_init: read %d phdrs at: 0x%p",
+	    ehdr.e_phnum, phdr_addr);
+
+	for (i = 0, ph = phdrs; i < ehdr.e_phnum; i++,
+	    /*LINTED */
+	    ph = (Elf32_Phdr *)((char *)ph + ehdr.e_phentsize)) {
+		ps_plog("lx_ldb_init: ph[%d] 0x%p type %d", i,
+		    (phdr_addr + ((char *)ph - (char *)phdrs)), ph->p_type);
+		if (ph->p_type == PT_DYNAMIC)
+			break;
+	}
+	if (i == ehdr.e_phnum) {
+		ps_plog("lx_ldb_init: no PT_DYNAMIC in executable");
+		free(lx_rd);
+		free(phdrs);
+		return (NULL);
+	}
+	ps_plog("lx_ldb_init: found PT_DYNAMIC phdr[%d] at: 0x%p",
+	    i, (phdr_addr + ((char *)ph - (char *)phdrs)));
+	ps_plog("lx_ldb_init: ph t 0x%x f 0x%x o 0x%p v 0x%p s %d",
+	    ph->p_type, ph->p_flags, ph->p_offset, ph->p_vaddr, ph->p_filesz);
+
+	if ((dyn = malloc(ph->p_filesz)) == NULL) {
+		ps_plog("lx_ldb_init: couldn't alloc for PT_DYNAMIC");
+		free(lx_rd);
+		free(phdrs);
+		return (NULL);
+	}
+
+	/*
+	 * Unclear why the dyn_addr works sometimes with one value and
+	 * sometimes for the other, so we handle both cases.
+	 */
+
+	dyn_count = ph->p_filesz / sizeof (Elf32_Dyn);
+	ps_plog("lx_ldb_init: dyn_count %d %d", dyn_count, sizeof (Elf32_Dyn));
+	dyn_addr = addr + ph->p_vaddr;
+	ps_plog("lx_ldb_init: dyn_addr 0x%p 0x%x = 0x%p",
+	    addr, ph->p_offset, dyn_addr);
+	if (ps_pread(php, dyn_addr, dyn, ph->p_filesz) != PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read dynamic at 0x%p, "
+		    "trying dyn_addr 0x%p",
+		    dyn_addr, ph->p_vaddr);
+
+		dyn_addr = ph->p_vaddr;
+		if (ps_pread(php, dyn_addr, dyn, ph->p_filesz) != PS_OK) {
+			ps_plog("lx_ldb_init: couldn't read dynamic at 0x%p",
+			    dyn_addr);
+
+			free(lx_rd);
+			free(phdrs);
+			free(dyn);
+			return (NULL);
+		}
+	}
+	ps_plog("lx_ldb_init: read %d dynamic headers at: 0x%p",
+	    dyn_count, dyn_addr);
+
+	for (i = 0; i < dyn_count; i++) {
+		if (dyn[i].d_tag == DT_DEBUG) {
+			lx_rd->lr_rdebug = dyn[i].d_un.d_ptr;
+			break;
+		}
+	}
+	free(phdrs);
+	free(dyn);
+
+	if (lx_rd->lr_rdebug != 0) {
+		ps_plog("lx_ldb_init: found DT_DEBUG: 0x%p", lx_rd->lr_rdebug);
+		return ((rd_helper_data_t)lx_rd);
+	}
+
+	ps_plog("lx_ldb_init: no DT_DEBUG found in exe; looking for r_debug");
+
+	/*
+	 * If we didn't find DT_DEBUG, we're going to employ the same fallback
+	 * as gdb:  pawing through the dynamic linker's symbol table looking
+	 * for the r_debug symbol.
+	 */
+	addr = lx_ldb_getauxval32(php, AT_SUN_BRAND_LX_INTERP);
+
+	if (addr == (uint32_t)-1) {
+		ps_plog("lx_ldb_init: no interpreter; failing");
+		free(lx_rd);
+		return (NULL);
+	}
+
+	ps_plog("lx_ldb_init: reading interp ehdr at 0x%p", addr);
+
+	if (ps_pread(php, addr, &ehdr, sizeof (ehdr)) != PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read interp ehdr at 0x%p", addr);
+		free(lx_rd);
+		return (NULL);
+	}
+
+	if (ehdr.e_type != ET_DYN) {
+		ps_plog("lx_ldb_init: interp ehdr not of type ET_DYN");
+		free(lx_rd);
+		return (NULL);
+	}
+
+	phdr_addr = addr + ehdr.e_phoff;
+
+	if ((phdrs = malloc(ehdr.e_phnum * ehdr.e_phentsize)) == NULL) {
+		ps_plog("lx_ldb_init: couldn't alloc interp phdrs memory");
+		free(lx_rd);
+		return (NULL);
+	}
+
+	if (ps_pread(php, phdr_addr, phdrs,
+	    ehdr.e_phnum * ehdr.e_phentsize) != PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read interp phdrs at 0x%p",
+		    phdr_addr);
+		free(lx_rd);
+		free(phdrs);
+		return (NULL);
+	}
+
+	ps_plog("lx_ldb_init: read %d interp phdrs at: 0x%p",
+	    ehdr.e_phnum, phdr_addr);
+
+	vaddr = (uint32_t)-1;
+	memsz = 0;
+
+	for (i = 0, ph = phdrs, dph = NULL; i < ehdr.e_phnum; i++,
+	    /*LINTED */
+	    ph = (Elf32_Phdr *)((char *)ph + ehdr.e_phentsize)) {
+		/*
+		 * Keep track of our lowest PT_LOAD address, as this segment
+		 * contains the DT_SYMTAB and DT_STRTAB.
+		 */
+		if (ph->p_type == PT_LOAD && ph->p_vaddr < vaddr) {
+			vaddr = ph->p_vaddr;
+			memsz = ph->p_memsz;
+		}
+
+		if (ph->p_type == PT_DYNAMIC)
+			dph = ph;
+	}
+
+	if (vaddr == (uint32_t)-1 || memsz == 0) {
+		ps_plog("lx_ldb_init: no PT_LOAD section in interp");
+		free(lx_rd);
+		free(phdrs);
+		return (NULL);
+	}
+
+	ps_plog("lx_ldb_init: found interp PT_LOAD to be %d bytes at 0x%p",
+	    memsz, vaddr);
+
+	if ((ph = dph) == NULL) {
+		ps_plog("lx_ldb_init: no PT_DYNAMIC in interp");
+		free(lx_rd);
+		free(phdrs);
+		return (NULL);
+	}
+
+	ps_plog("lx_ldb_init: found interp PT_DYNAMIC phdr[%d] at: 0x%p",
+	    i, (phdr_addr + ((char *)ph - (char *)phdrs)));
+
+	if ((dyn = malloc(ph->p_filesz)) == NULL) {
+		ps_plog("lx_ldb_init: couldn't alloc for interp PT_DYNAMIC");
+		free(lx_rd);
+		free(phdrs);
+		return (NULL);
+	}
+
+	dyn_addr = addr + ph->p_offset;
+	dyn_count = ph->p_filesz / sizeof (Elf32_Dyn);
+
+	if (ps_pread(php, dyn_addr, dyn, ph->p_filesz) != PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read interp dynamic at 0x%p",
+		    dyn_addr);
+		free(lx_rd);
+		free(phdrs);
+		free(dyn);
+		return (NULL);
+	}
+
+	free(phdrs);
+
+	ps_plog("lx_ldb_init: read %d interp dynamic headers at: 0x%p",
+	    dyn_count, dyn_addr);
+
+	/*
+	 * As noted in lx_ldb_get_dyns32(), in Linux, the PT_DYNAMIC table
+	 * is adjusted to represent absolute addresses instead of offsets.
+	 * This is not true for the interpreter, however -- where the values
+	 * will be represented as offsets from the lowest PT_LOAD p_vaddr.
+	 */
+	symtab = strtab = (uint32_t)-1;
+
+	for (i = 0; i < dyn_count; i++) {
+		if (dyn[i].d_tag == DT_STRTAB)
+			strtab = dyn[i].d_un.d_ptr - vaddr;
+
+		if (dyn[i].d_tag == DT_SYMTAB)
+			symtab = dyn[i].d_un.d_ptr - vaddr;
+	}
+
+	free(dyn);
+
+	if (strtab == (uint32_t)-1 || strtab > memsz) {
+		ps_plog("lx_ldb_init: didn't find valid interp strtab");
+		free(lx_rd);
+		return (NULL);
+	}
+
+	if (symtab == (uint32_t)-1 || symtab > memsz) {
+		ps_plog("lx_ldb_init: didn't find valid interp symtab");
+		free(lx_rd);
+		return (NULL);
+	}
+
+	ps_plog("lx_ldb_init: strtab is 0x%p, symtab is 0x%p",
+	    addr + strtab, addr + symtab);
+
+	if ((mem = malloc(memsz)) == NULL) {
+		ps_plog("lx_ldb_init: couldn't allocate interp "
+		    "buffer of 0x%p bytes", memsz);
+		free(lx_rd);
+		return (NULL);
+	}
+
+	if (ps_pread(php, addr, mem, memsz) != PS_OK) {
+		ps_plog("lx_ldb_init: couldn't read interp at 0x%p", addr);
+		free(lx_rd);
+		free(mem);
+		return (NULL);
+	}
+
+	/*
+	 * We make an assumption that is made elsewhere in the Linux linker:
+	 * that the DT_SYMTAB immediately precedes the DT_STRTAB.
+	 */
+	for (offs = symtab; offs < strtab; offs += sizeof (Elf32_Sym)) {
+		uint32_t p;
+
+		sym = (Elf32_Sym *)&mem[offs];
+
+		if (sym->st_name > memsz) {
+			ps_plog("lx_ldb_init: invalid st_name at sym 0x%p",
+			    addr + offs);
+			continue;
+		}
+
+		p = sym->st_name;
+
+		if (strtab + p > memsz) {
+			ps_plog("lx_ldb_init: invalid symbol address 0x%p, "
+			    "memsz 0x%p", strtab + p, memsz);
+			continue;
+		}
+
+		if (mem[strtab + p] == '\0')
+			continue;
+
+		/* Sometimes we're pointing into the middle of a symbol? */
+		while ((strtab + p) > 0 && (strtab + p) < memsz &&
+		    mem[strtab + p] != '\0')
+			p--;
+		p++;
+
+		ps_plog("lx_ldb_init: interp symbol (0x%p) %s",
+		    strtab + p, &mem[strtab + p]);
+
+		if (strcmp(&mem[strtab + p], "_r_debug") == 0)
+			break;
+	}
+
+	if (offs >= strtab) {
+		ps_plog("lx_ldb_init: no _r_debug found in interpreter");
+		free(mem);
+		free(lx_rd);
+		return (NULL);
+	}
+
+	lx_rd->lr_rdebug = (sym->st_value - vaddr) + addr;
+	ps_plog("lx_ldb_init: found _r_debug at 0x%p", lx_rd->lr_rdebug);
+	free(mem);
+
+	return ((rd_helper_data_t)lx_rd);
+}
+
+/*
+ * Given the address of an ELF object in the target, return its size and
+ * the proper link map ID.
+ */
+static size_t
+lx_elf_props32(struct ps_prochandle *php, uint32_t addr, psaddr_t *data_addr)
+{
+	Elf32_Ehdr	ehdr;
+	Elf32_Phdr	*phdrs, *ph;
+	int		i;
+	uint32_t	min = (uint32_t)-1;
+	uint32_t	max = 0;
+	size_t		sz = NULL;
+
+	if (ps_pread(php, addr, &ehdr, sizeof (ehdr)) != PS_OK) {
+		ps_plog("lx_elf_props: Couldn't read ELF header at 0x%p",
+		    addr);
+		return (0);
+	}
+
+	if ((phdrs = malloc(ehdr.e_phnum * ehdr.e_phentsize)) == NULL)
+		return (0);
+
+	if (ps_pread(php, addr + ehdr.e_phoff, phdrs, ehdr.e_phnum *
+	    ehdr.e_phentsize) != PS_OK) {
+		ps_plog("lx_elf_props: Couldn't read program headers at 0x%p",
+		    addr + ehdr.e_phoff);
+		return (0);
+	}
+
+	for (i = 0, ph = phdrs; i < ehdr.e_phnum; i++,
+	    /*LINTED */
+	    ph = (Elf32_Phdr *)((char *)ph + ehdr.e_phentsize)) {
+
+		if (ph->p_type != PT_LOAD)
+			continue;
+
+		if ((ph->p_flags & (PF_W | PF_R)) == (PF_W | PF_R)) {
+			*data_addr = ph->p_vaddr;
+			if (ehdr.e_type == ET_DYN)
+				*data_addr += addr;
+			if (*data_addr & (ph->p_align - 1))
+				*data_addr = *data_addr & (~(ph->p_align -1));
+		}
+
+		if (ph->p_vaddr < min)
+			min = ph->p_vaddr;
+
+		if (ph->p_vaddr > max) {
+			max = ph->p_vaddr;
+			sz = ph->p_memsz + max - min;
+			if (sz & (ph->p_align - 1))
+				sz = (sz & (~(ph->p_align - 1))) + ph->p_align;
+		}
+	}
+
+	free(phdrs);
+	return (sz);
+}
+
+static int
+lx_ldb_loadobj_iter32(rd_helper_data_t rhd, rl_iter_f *cb, void *client_data)
+{
+	lx_rd_t			*lx_rd = (lx_rd_t *)rhd;
+	struct ps_prochandle	*php = lx_rd->lr_php;
+	lx_r_debug_t		r_debug;
+	lx_link_map_t		map;
+	uint32_t		p = NULL;
+	int			rc;
+	rd_loadobj_t		exec;
+
+	if ((rc = ps_pread(php, (psaddr_t)lx_rd->lr_rdebug, &r_debug,
+	    sizeof (r_debug))) != PS_OK) {
+		ps_plog("lx_ldb_loadobj_iter: "
+		    "Couldn't read linux r_debug at 0x%p", lx_rd->lr_rdebug);
+		return (rc);
+	}
+
+	p = r_debug.r_map;
+
+	/*
+	 * The first item on the link map list is for the executable, but it
+	 * doesn't give us any useful information about it. We need to
+	 * synthesize a rd_loadobj_t for the client.
+	 *
+	 * Linux doesn't give us the executable name, so we'll get it from
+	 * the AT_EXECNAME entry instead.
+	 */
+	if ((rc = ps_pread(php, (psaddr_t)p, &map, sizeof (map))) != PS_OK) {
+		ps_plog("lx_ldb_loadobj_iter: "
+		    "Couldn't read linux link map at 0x%p", p);
+		return (rc);
+	}
+
+	bzero(&exec, sizeof (exec));
+	exec.rl_base = lx_rd->lr_exec;
+	exec.rl_dynamic = map.lxm_ld;
+	exec.rl_nameaddr = lx_ldb_getauxval32(php, AT_SUN_EXECNAME);
+	exec.rl_lmident = LM_ID_BASE;
+
+	exec.rl_bend = exec.rl_base +
+	    lx_elf_props32(php, lx_rd->lr_exec, &exec.rl_data_base);
+
+	if ((*cb)(&exec, client_data) == 0) {
+		ps_plog("lx_ldb_loadobj_iter: "
+		    "client callb failed for executable");
+		return (PS_ERR);
+	}
+	ps_plog("lx_ldb_loadobj_iter: exec base 0x%p dyn 0x%p",
+	    exec.rl_base, exec.rl_dynamic);
+
+	for (p = map.lxm_next; p != NULL; p = map.lxm_next) {
+		rd_loadobj_t	obj;
+
+		if ((rc = ps_pread(php, (psaddr_t)p, &map, sizeof (map))) !=
+		    PS_OK) {
+			ps_plog("lx_ldb_loadobj_iter: "
+			    "Couldn't read lk map at %p", p);
+			return (rc);
+		}
+
+		/*
+		 * The linux link map has less information than the Solaris one.
+		 * We need to go fetch the missing information from the ELF
+		 * headers.
+		 */
+
+		obj.rl_nameaddr = (psaddr_t)map.lxm_name;
+		obj.rl_base = map.lxm_addr;
+		obj.rl_refnameaddr = (psaddr_t)map.lxm_name;
+		obj.rl_plt_base = NULL;
+		obj.rl_plt_size = 0;
+		obj.rl_lmident = LM_ID_BASE;
+
+		ps_plog("lx_ldb_loadobj_iter: map base 0x%p 0x%p",
+		    obj.rl_base, obj.rl_nameaddr);
+
+		/*
+		 * Ugh - we have to walk the ELF stuff, find the PT_LOAD
+		 * sections, and calculate the end of the file's mappings
+		 * ourselves.
+		 */
+
+		obj.rl_bend = map.lxm_addr +
+		    lx_elf_props32(php, map.lxm_addr, &obj.rl_data_base);
+		obj.rl_padstart = obj.rl_base;
+		obj.rl_padend = obj.rl_bend;
+		obj.rl_dynamic = map.lxm_ld;
+		obj.rl_tlsmodid = 0;
+
+		ps_plog("lx_ldb_loadobj_iter: 0x%p to 0x%p",
+		    obj.rl_base, obj.rl_bend);
+
+		if ((*cb)(&obj, client_data) == 0) {
+			ps_plog("lx_ldb_loadobj_iter: "
+			    "Client callback failed on %s", map.lxm_name);
+			return (rc);
+		}
+	}
+	return (RD_OK);
+}
+
+/*
+ * Librtld_db plugin linkage struct.
+ *
+ * When we get loaded by librtld_db, it will look for the symbol below
+ * to find our plugin entry points.
+ */
+rd_helper_ops_t RTLD_DB_BRAND_OPS = {
+	LM_ID_BRAND,
+	lx_ldb_init32,
+	lx_ldb_fini32,
+	lx_ldb_loadobj_iter32,
+	lx_ldb_get_dyns32
+};
diff --git a/usr/src/lib/brand/lx/librtld_db/common/mapfile-vers b/usr/src/lib/brand/lx/librtld_db/common/mapfile-vers
new file mode 100644
index 0000000000..5e328d6075
--- /dev/null
+++ b/usr/src/lib/brand/lx/librtld_db/common/mapfile-vers
@@ -0,0 +1,58 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+{
+	global:
+		rtld_db_brand_ops32;
+	local:
+		*;
+};
+
+#Externally defined symbols
+{
+    global:
+	ps_pauxv =		NODIRECT PARENT;
+	ps_pdmodel =		NODIRECT PARENT;
+	ps_pglobal_lookup =	NODIRECT PARENT;
+	ps_pglobal_sym =	NODIRECT PARENT;
+	ps_plog =		NODIRECT PARENT;
+	ps_pread =		NODIRECT PARENT;
+	ps_pwrite =		NODIRECT PARENT;
+};
diff --git a/usr/src/lib/brand/lx/librtld_db/i386/Makefile b/usr/src/lib/brand/lx/librtld_db/i386/Makefile
new file mode 100644
index 0000000000..b5f780c072
--- /dev/null
+++ b/usr/src/lib/brand/lx/librtld_db/i386/Makefile
@@ -0,0 +1,33 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+
+CLOBBERFILES =	$(ROOTLIBDIR)/$(DYNLIB)
+
+install: all $(ROOTLIBS)
diff --git a/usr/src/lib/brand/lx/lx_brand/Makefile b/usr/src/lib/brand/lx/lx_brand/Makefile
new file mode 100644
index 0000000000..fc217b672c
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/Makefile
@@ -0,0 +1,49 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../../../Makefile.lib
+
+default:	all
+
+SUBDIRS=	$(MACH)
+$(BUILD64)SUBDIRS += $(MACH64)
+
+all :=          TARGET= all
+clean :=        TARGET= clean
+clobber :=      TARGET= clobber
+install :=      TARGET= install
+lint :=         TARGET= lint
+_msg :=		TARGET= _msg
+
+.KEEP_STATE:
+
+all install clean clobber lint _msg:	$(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/lib/brand/lx/lx_brand/Makefile.com b/usr/src/lib/brand/lx/lx_brand/Makefile.com
new file mode 100644
index 0000000000..e57436e127
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/Makefile.com
@@ -0,0 +1,98 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
+#
+
+LX_CMN  =	$(SRC)/common/brand/lx
+
+LIBRARY =	lx_brand.a
+VERS	=	.1
+COBJS	=	capabilities.o		\
+		clock.o			\
+		clone.o			\
+		debug.o			\
+		dir.o			\
+		file.o			\
+		fork.o			\
+		lx_brand.o		\
+		misc.o			\
+		module.o		\
+		mount.o			\
+		mount_nfs.o		\
+		ptrace.o		\
+		sendfile.o		\
+		signal.o		\
+		stack.o			\
+		statfs.o		\
+		sysctl.o		\
+		sysv_ipc.o		\
+		time.o			\
+		truncate.o
+
+CMNOBJS =	lx_auxv.o	\
+		lx_errno.o	\
+		lx_signum.o
+ASOBJS	=	lx_handler.o lx_crt.o
+OBJECTS	=	$(CMNOBJS) $(COBJS) $(ASOBJS)
+
+USDT_PROVIDERS =	lx_provider.d
+
+include ../../Makefile.lx
+include ../../../../Makefile.lib
+
+CSRCS   =	$(COBJS:%o=../common/%c) $(CMNOBJS:%o=$(LX_CMN)/%c)
+ASSRCS  =	$(ASOBJS:%o=$(ISASRCDIR)/%s)
+SRCS    =	$(CSRCS) $(ASSRCS)
+
+SRCDIR =	../common
+UTSBASE	=	../../../../../uts
+
+LIBS =		$(DYNLIB)
+LDLIBS +=	-lc -lsocket -lmapmalloc -lproc -lrtld_db -lrpcsvc -lnsl
+DYNFLAGS +=	$(DYNFLAGS_$(CLASS))
+DYNFLAGS +=	$(BLOCAL) $(ZNOVERSION) -Wl,-e_start -M../common/mapfile
+CFLAGS +=	$(CCVERBOSE)
+CPPFLAGS +=	-D_REENTRANT -I. -I../ -I$(UTSBASE)/common/brand/lx -I$(LX_CMN)
+ASFLAGS =	-P $(ASFLAGS_$(CURTYPE)) -D_ASM -I../	\
+			-I$(UTSBASE)/common/brand/lx
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+lint: lintcheck
+
+include ../../../../Makefile.targ
+include ../../../../Makefile.usdt
+
+pics/%.o: $(ISASRCDIR)/%.s
+	$(COMPILE.s) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: $(LX_CMN)/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
diff --git a/usr/src/lib/brand/lx/lx_brand/amd64/Makefile b/usr/src/lib/brand/lx/lx_brand/amd64/Makefile
new file mode 100644
index 0000000000..a1db90cd38
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/amd64/Makefile
@@ -0,0 +1,42 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2015 Joyent, Inc.
+#
+#
+# lib/brand/lx/amd64/Makefile
+
+ISASRCDIR=.
+
+ASFLAGS	+= -P -D_ASM
+
+include ../Makefile.com
+include $(SRC)/lib/Makefile.lib.64
+
+DYNFLAGS +=	-Wl,-I/native/lib/64/ld.so.1
+CPPFLAGS +=	-D_SYSCALL32
+
+POFILE=		lx_brand.po
+MSGFILES=	$(CSRCS)
+
+ASSYMDEP_OBJS = lx_handler.o
+
+install: all $(ROOTLIBS64)
+
+$(POFILE): $(MSGFILES)
+	$(BUILDPO.msgfiles)
+
+_msg: $(MSGDOMAINPOFILE)
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/lib/brand/lx/lx_brand/amd64/lx_crt.s b/usr/src/lib/brand/lx/lx_brand/amd64/lx_crt.s
new file mode 100644
index 0000000000..13a88a3d50
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/amd64/lx_crt.s
@@ -0,0 +1,62 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#include <sys/asm_linkage.h>
+
+#if defined(lint)
+
+void
+_start(void)
+{
+}
+
+#else	/* lint */
+
+	/*
+	 * C language startup routine for the lx brand shared library.
+	 *
+	 * That routine expects to be called with the following arguments:
+	 *	brand_init(int argc, char *argv[], char *envp[])
+	 *
+	 * There are no arguments explicitly passed to this entry point,
+	 * routine, but we do know how our initial stack has been setup by
+	 * the kernel.  The stack format is documented in:
+	 * 	usr/src/cmd/sgs/rtld/amd64/boot.s
+	 *
+	 * So this routine will troll through the stack to setup the argument
+	 * values for the common brand library startup routine and then invoke
+	 * it.  This routine is modeled after the default crt1.s`_start()
+	 * routines.
+	 */
+	ENTRY_NP(_start)
+	pushq	$0			/ Build a stack frame. retpc = NULL
+	pushq	$0			/ fp = NULL
+	movq	%rsp, %rbp		/ first stack frame
+
+	/*
+	 * Calculate the location of the envp array by adding the size of
+	 * the argv array to the start of the argv array.
+	 */
+	movq	16(%rbp), %rdi		/ argc in %rdi (1st param)
+	leaq	24(%rbp), %rsi		/ &argv[0] in %rsi (2nd param)
+	leaq	32(%rbp,%rdi,8), %rdx	/ envp in %rdx (3rd param)
+	call	lx_init
+
+	/* lx_init will never return. */
+	/*NOTREACHED*/
+	SET_SIZE(_start)
+#endif	/* lint */
diff --git a/usr/src/lib/brand/lx/lx_brand/amd64/lx_handler.s b/usr/src/lib/brand/lx/lx_brand/amd64/lx_handler.s
new file mode 100644
index 0000000000..a01d66554d
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/amd64/lx_handler.s
@@ -0,0 +1,53 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/asm_linkage.h>
+#include <sys/regset.h>
+#include <sys/segments.h>
+#include <sys/syscall.h>
+#include <sys/lx_brand.h>
+
+#if defined(_ASM)
+#include <sys/lx_signal.h>
+#include <sys/lx_syscall.h>
+#endif	/* _ASM */
+
+/* 64-bit signal syscall numbers */
+#define	LX_SYS_rt_sigreturn	15
+
+#if defined(lint)
+
+#include <sys/types.h>
+#include <sys/regset.h>
+#include <sys/signal.h>
+
+void
+lx_rt_sigreturn_tramp(void)
+{}
+
+#else	/* lint */
+
+	/*
+	 * Trampoline code is called by the return at the end of a Linux
+	 * signal handler to return control to the interrupted application
+	 * via the lx_rt_sigreturn() syscall.
+	 */
+	ENTRY_NP(lx_rt_sigreturn_tramp)
+	movq	$LX_SYS_rt_sigreturn, %rax
+	syscall
+	SET_SIZE(lx_rt_sigreturn_tramp)
+
+#endif	/* lint */
diff --git a/usr/src/lib/brand/lx/lx_brand/common/capabilities.c b/usr/src/lib/brand/lx/lx_brand/common/capabilities.c
new file mode 100644
index 0000000000..ba6b587a92
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/capabilities.c
@@ -0,0 +1,516 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * LX Brand emulation of capget/capset syscalls
+ */
+
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/debug.h>
+#include <sys/lx_types.h>
+#include <sys/lx_syscall.h>
+#include <sys/syscall.h>
+#include <alloca.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/lx_misc.h>
+#include <priv.h>
+
+typedef struct {
+	uint32_t version;
+	int pid;
+} lx_cap_user_header_t;
+
+typedef struct {
+	uint32_t effective;
+	uint32_t permitted;
+	uint32_t inheritable;
+} lx_cap_user_data_t;
+
+typedef struct {
+	priv_set_t *p_effective;
+	priv_set_t *p_permitted;
+	priv_set_t *p_inheritable;
+} lx_cap_privs_t;
+
+#define	LX_CAP_UPDATE_PERMITTED		0x1
+#define	LX_CAP_UPDATE_EFFECTIVE		0x2
+#define	LX_CAP_UPDATE_INHERITABLE	0x4
+
+
+#define	LX_CAP_MAXLEN	2
+
+typedef struct {
+	uint32_t effective[LX_CAP_MAXLEN];
+	uint32_t permitted[LX_CAP_MAXLEN];
+	uint32_t inheritable[LX_CAP_MAXLEN];
+} lx_cap_data_t;
+
+#define	LX_CAP_VERSION_1	0x19980330
+#define	LX_CAP_VERSION_2	0x20071026	/* deprecated by Linux */
+#define	LX_CAP_VERSION_3	0x20080522
+
+#define	LX_CAP_SETPCAP	8
+
+/*
+ * Even though we lack mappings for capabilities higher than LX_CAP_MAX_VALID,
+ * it's valuable to test all the way out to the end of the second field. This
+ * ensures that new capabilities we lack support for are not silently accepted.
+ */
+#define	LX_CAP_MAX_CHECK		63
+
+#define	LX_CAP_CAPISSET(id, cap) \
+	(((id < 32) && (((0x1 << id) & cap[0]) != 0)) || \
+	((id >= 32) && (((0x1 << (id - 32) & cap[1]) != 0))))
+
+#define	LX_CAP_CAPSET(id, cap) \
+	if (id < 32) { cap[0] |= (0x1 << id); } \
+	else { cap[1] |= (0x1 << (id - 32)); }
+
+static const char *lx_cap_map_chown[] = {
+	PRIV_FILE_CHOWN,
+	PRIV_FILE_CHOWN_SELF,
+	NULL
+};
+static const char *lx_cap_map_dac_override[] = {
+	PRIV_FILE_DAC_READ,
+	PRIV_FILE_DAC_WRITE,
+	PRIV_FILE_DAC_EXECUTE,
+	NULL
+};
+static const char *lx_cap_map_dac_read_search[] = {
+	PRIV_FILE_DAC_SEARCH,
+	PRIV_FILE_DAC_READ,
+	NULL
+};
+static const char *lx_cap_map_fowner[] = { PRIV_FILE_OWNER, NULL };
+static const char *lx_cap_map_fsetid[] = { PRIV_FILE_SETID, NULL };
+static const char *lx_cap_map_kill[] = { PRIV_PROC_OWNER, NULL };
+/*
+ * One way that Linux capabilities(7) differs from Illumos privileges(5) is
+ * that it distinguishes between setuid and setgroups rights.  This will be a
+ * problem if an lx-branded process requests to drop only CAP_SETUID but not
+ * CAP_SETGID.
+ *
+ * In that case, CAP_SETUID will be maintained.
+ */
+static const char *lx_cap_map_setgid[] = { PRIV_PROC_SETID, NULL };
+static const char *lx_cap_map_setuid[] = { PRIV_PROC_SETID, NULL };
+static const char *lx_cap_map_linux_immutable[] = { PRIV_FILE_FLAG_SET, NULL };
+static const char *lx_cap_map_bind_service[] = { PRIV_NET_PRIVADDR, NULL };
+static const char *lx_cap_map_net_admin[] = {
+	PRIV_SYS_IP_CONFIG,
+	NULL
+	/*
+	 * It would probably make sense to include PRIV_SYS_DL_CONFIG, but that
+	 * privilege is not extended to non-global zones by default.  A more
+	 * sophisticated capabilities translation layer could make it optional.
+	 */
+};
+static const char *lx_cap_map_net_raw[] = {
+	PRIV_NET_RAWACCESS,
+	PRIV_NET_ICMPACCESS,
+	NULL
+};
+static const char *lx_cap_map_ipc_lock[] = { PRIV_PROC_LOCK_MEMORY, NULL };
+static const char *lx_cap_map_ipc_owner[] = {
+	PRIV_IPC_DAC_READ,
+	PRIV_IPC_DAC_WRITE,
+	PRIV_IPC_OWNER,
+	NULL
+};
+static const char *lx_cap_map_sys_chroot[] = { PRIV_PROC_CHROOT, NULL };
+static const char *lx_cap_map_sys_admin[] = {
+	PRIV_SYS_MOUNT,
+	PRIV_SYS_ADMIN,
+	NULL
+};
+static const char *lx_cap_map_sys_nice[] = { PRIV_PROC_PRIOUP, NULL };
+static const char *lx_cap_map_sys_resource[] = { PRIV_SYS_RESOURCE, NULL };
+static const char *lx_cap_map_audit_write[] = { PRIV_PROC_AUDIT, NULL };
+static const char *lx_cap_map_audit_control[] = { PRIV_SYS_AUDIT, NULL };
+
+/*
+ * Mapping of Linux capabilities -> Illumos privileges
+ * The ID definitions can be found in the Linux sources here:
+ * include/uapi/linux/capability.h
+ *
+ * Order is critical.
+ */
+static const char ** lx_cap_mapping[LX_CAP_MAX_VALID + 1] = {
+	lx_cap_map_chown,		/* CAP_CHOWN */
+	lx_cap_map_dac_override,	/* CAP_DAC_OVERRIDE */
+	lx_cap_map_dac_read_search,	/* CAP_DAC_READ_SEARCH */
+	lx_cap_map_fowner,		/* CAP_FOWNER */
+	lx_cap_map_fsetid,		/* CAP_FSETID */
+	lx_cap_map_kill,		/* CAP_KILL */
+	lx_cap_map_setgid,		/* CAP_SETGID */
+	lx_cap_map_setuid,		/* CAP_SETUID */
+	NULL,				/* CAP_SETPCAP */
+	lx_cap_map_linux_immutable,	/* CAP_LINUX_IMMUTABLE */
+	lx_cap_map_bind_service,	/* CAP_BIND_SERVICE */
+	NULL,				/* CAP_BROADCAST */
+	lx_cap_map_net_admin,		/* CAP_NET_ADMIN */
+	lx_cap_map_net_raw,		/* CAP_NET_RAW */
+	lx_cap_map_ipc_lock,		/* CAP_IPC_LOCK */
+	lx_cap_map_ipc_owner,		/* CAP_IPC_OWNER */
+	NULL,				/* CAP_MODULE */
+	NULL,				/* CAP_RAWIO */
+	lx_cap_map_sys_chroot,		/* CAP_SYS_CHROOT */
+	NULL,				/* CAP_PTRACE */
+	NULL,				/* CAP_PACCT */
+	lx_cap_map_sys_admin,		/* CAP_SYS_ADMIN */
+	NULL,				/* CAP_BOOT */
+	lx_cap_map_sys_nice,		/* CAP_SYS_NICE */
+	lx_cap_map_sys_resource,	/* CAP_SYS_RESOURCE */
+	NULL,				/* CAP_SYS_TIME */
+	NULL,				/* CAP_SYS_TTY_CONFIG */
+	NULL,				/* CAP_MKNOD */
+	NULL,				/* CAP_LEASE */
+	lx_cap_map_audit_write,		/* CAP_AUDIT_WRITE */
+	lx_cap_map_audit_control,	/* CAP_AUDIT_CONTROL */
+	NULL,				/* CAP_SETFCAP */
+	NULL,				/* CAP_MAC_OVERRIDE */
+	NULL,				/* CAP_MAC_ADMIN */
+	NULL,				/* CAP_SYSLOG */
+	NULL,				/* CAP_WAKE_ALARM */
+	NULL				/* CAP_BLOCK_SUSPEND */
+};
+
+/* track priv_set_t size, set on entry to lx_capset/lx_capget */
+static unsigned int lx_cap_priv_size = 0;
+
+/* safely allocate priv_set_t triplet on the stack */
+#define	LX_CAP_ALLOC_PRIVS(ptr)	\
+	{ \
+		ptr = SAFE_ALLOCA(sizeof (lx_cap_privs_t) + \
+		    (3 * lx_cap_priv_size)); \
+		if (ptr != NULL) { \
+			ptr->p_effective = (priv_set_t *) \
+			    ((caddr_t)ptr + sizeof (lx_cap_privs_t)); \
+			ptr->p_permitted = (priv_set_t *) \
+			    ((caddr_t)ptr + sizeof (lx_cap_privs_t) + \
+			    lx_cap_priv_size);\
+			ptr->p_inheritable = (priv_set_t *) \
+			    ((caddr_t)ptr + sizeof (lx_cap_privs_t) + \
+			    2 * lx_cap_priv_size); \
+		} \
+	}
+
+static long
+lx_cap_update_priv(priv_set_t *priv, const uint32_t cap[])
+{
+	int i, j;
+	boolean_t cap_set;
+	boolean_t priv_set;
+	boolean_t updated = B_FALSE;
+	for (i = 0; i <= LX_CAP_MAX_CHECK; i++) {
+		cap_set = LX_CAP_CAPISSET(i, cap);
+		if (lx_cap_mapping[i] == NULL || i > LX_CAP_MAX_VALID) {
+			/* don't allow setting unsupported caps */
+			if (cap_set) {
+				/*
+				 * CAP_SETPCAP is a special capability, with
+				 * varying behavior, that can be used to
+				 * control if the process can change other
+				 * process's capabilities, or to control moving
+				 * capabilities between sets. For now we ignore
+				 * this if its passed in.
+				 */
+				if (i == LX_CAP_SETPCAP) {
+					continue;
+				}
+				lx_unsupported("set unsupported capability %d",
+				    i);
+				return (-1);
+			} else {
+				continue;
+			}
+		}
+		for (j = 0; lx_cap_mapping[i][j] != NULL; j++) {
+			priv_set = priv_ismember(priv, lx_cap_mapping[i][j]);
+			if (priv_set && !cap_set) {
+				VERIFY0(priv_delset(priv,
+				    lx_cap_mapping[i][j]));
+				updated = B_TRUE;
+			} else if (!priv_set && cap_set) {
+				VERIFY0(priv_addset(priv,
+				    lx_cap_mapping[i][j]));
+				updated = B_TRUE;
+			}
+		}
+	}
+	if (updated)
+		return (1);
+	else
+		return (0);
+}
+
+static long
+lx_cap_to_priv(lx_cap_data_t *cap, lx_cap_privs_t *priv)
+{
+	long changes = 0;
+	long result;
+
+	result = lx_cap_update_priv(priv->p_permitted, cap->permitted);
+	if (result < 0)
+		return (-1);
+	else if (result > 0)
+		changes |= LX_CAP_UPDATE_PERMITTED;
+
+	result = lx_cap_update_priv(priv->p_effective, cap->effective);
+	if (result < 0)
+		return (-1);
+	else if (result > 0)
+		changes |= LX_CAP_UPDATE_EFFECTIVE;
+
+	result = lx_cap_update_priv(priv->p_inheritable, cap->inheritable);
+	if (result < 0)
+		return (-1);
+	else if (result > 0)
+		changes |= LX_CAP_UPDATE_INHERITABLE;
+
+	return (changes);
+}
+
+static void
+lx_cap_from_priv(const priv_set_t *priv, uint32_t cap[])
+{
+	int i, j;
+	boolean_t valid;
+	(void) memset(cap, '\0', sizeof (uint32_t) * LX_CAP_MAXLEN);
+	for (i = 0; i <= LX_CAP_MAX_VALID; i++) {
+		if (lx_cap_mapping[i] == NULL) {
+			continue;
+		}
+		valid = B_TRUE;
+		for (j = 0; lx_cap_mapping[i][j] != NULL; j++) {
+			if (!priv_ismember(priv,
+			    lx_cap_mapping[i][j])) {
+				valid = B_FALSE;
+			}
+		}
+		if (valid) {
+			LX_CAP_CAPSET(i, cap);
+		}
+	}
+}
+
+static long
+lx_cap_read_cap(const lx_cap_user_header_t *uhp, const lx_cap_user_data_t *udp,
+    lx_cap_data_t *cd)
+{
+	lx_cap_user_header_t uh;
+	lx_cap_user_data_t ud_buf;
+	int cap_count;
+	int i;
+
+	if (uucopy(uhp, &uh, sizeof (uh)) != 0)
+		return (-errno);
+
+	switch (uh.version) {
+	case LX_CAP_VERSION_1:
+		cap_count = 1;
+		break;
+	case LX_CAP_VERSION_2:
+	case LX_CAP_VERSION_3:
+		cap_count = 2;
+		break;
+	default:
+		return (-EINVAL);
+	}
+
+	/* Only allow capset on calling process */
+	if (uh.pid != 0 && uh.pid != getpid())
+		return (-EPERM);
+
+	/* zero the struct in case cap_count < 2 */
+	(void) memset(cd, '\0', sizeof (lx_cap_data_t));
+
+	for (i = 0; i < cap_count; i++) {
+		if (uucopy(udp + i, &ud_buf, sizeof (ud_buf)) != 0)
+			return (-errno);
+		cd->permitted[i] = ud_buf.permitted;
+		cd->effective[i] = ud_buf.effective;
+		cd->inheritable[i] = ud_buf.inheritable;
+	}
+	return (0);
+}
+
+long
+lx_capget(uintptr_t p1, uintptr_t p2)
+{
+	const priv_impl_info_t *impl;
+	lx_cap_user_header_t *uhp = (lx_cap_user_header_t *)p1;
+	lx_cap_user_data_t *udp = (lx_cap_user_data_t *)p2;
+	lx_cap_user_header_t uh;
+	lx_cap_privs_t *privs;
+	lx_cap_data_t cd_result;
+	lx_cap_user_data_t cd_buf;
+	int cap_count;
+	int i;
+
+	if (lx_cap_priv_size == 0) {
+		impl = getprivimplinfo();
+		lx_cap_priv_size = sizeof (priv_chunk_t) * impl->priv_setsize;
+	}
+
+	if (uucopy(uhp, &uh, sizeof (uh)) != 0)
+		return (-errno);
+
+	switch (uh.version) {
+	case LX_CAP_VERSION_1:
+		cap_count = 1;
+		break;
+	case LX_CAP_VERSION_2:
+	case LX_CAP_VERSION_3:
+		cap_count = 2;
+		break;
+	default:
+		/*
+		 * As per the man page: call will fail with EINVAL and set the
+		 * version field of the header to the kernel preferred version
+		 * when an unsupported version value is provided.
+		 */
+		uh.version = LX_CAP_VERSION_3;
+		if (uucopy(&uh, uhp, sizeof (uh)) != 0)
+			return (-errno);
+		return (-EINVAL);
+	}
+
+	/*
+	 * Only allow capget on the calling process.
+	 * If a pid is specified, lie about being able to locate it.
+	 */
+	if (uh.pid > 0 && uh.pid != getpid())
+		return (-ESRCH);
+	if (uh.pid < 0)
+		return (-EINVAL);
+
+	LX_CAP_ALLOC_PRIVS(privs)
+
+	if (privs == NULL)
+		return (-ENOMEM);
+
+	if (getppriv(PRIV_PERMITTED, privs->p_permitted) != 0)
+		return (-errno);
+	if (getppriv(PRIV_EFFECTIVE, privs->p_effective) != 0)
+		return (-errno);
+	if (getppriv(PRIV_INHERITABLE, privs->p_inheritable) != 0)
+		return (-errno);
+
+	lx_cap_from_priv(privs->p_permitted, cd_result.permitted);
+	lx_cap_from_priv(privs->p_effective, cd_result.effective);
+	lx_cap_from_priv(privs->p_inheritable, cd_result.inheritable);
+
+	/* convert to output format */
+	for (i = 0; i < cap_count; i++) {
+		cd_buf.effective = cd_result.effective[i];
+		cd_buf.permitted = cd_result.permitted[i];
+		cd_buf.inheritable = cd_result.inheritable[i];
+		if (uucopy(&cd_buf, udp + i, sizeof (cd_buf)) != 0)
+			return (-errno);
+	}
+
+	return (0);
+}
+
+long
+lx_capset(uintptr_t p1, uintptr_t p2)
+{
+	const priv_impl_info_t *impl;
+	lx_cap_data_t cd;
+	lx_cap_privs_t *privs;
+	long result;
+
+	if (lx_cap_priv_size == 0) {
+		impl = getprivimplinfo();
+		lx_cap_priv_size = sizeof (priv_chunk_t) * impl->priv_setsize;
+	}
+
+	/* verify header and read in desired capabilities */
+	result = lx_cap_read_cap((lx_cap_user_header_t *)p1,
+	    (lx_cap_user_data_t *)p2, &cd);
+	if (result != 0)
+		return (result);
+
+	LX_CAP_ALLOC_PRIVS(privs)
+
+	if (privs == NULL)
+		return (-ENOMEM);
+
+	/* fetch current privs to compare against */
+	if (getppriv(PRIV_PERMITTED, privs->p_permitted) != 0)
+		return (-errno);
+	if (getppriv(PRIV_EFFECTIVE, privs->p_effective) != 0)
+		return (-errno);
+	if (getppriv(PRIV_INHERITABLE, privs->p_inheritable) != 0)
+		return (-errno);
+
+
+	result = lx_cap_to_priv(&cd, privs);
+	if (result < 0)
+		return (-EPERM);
+
+	/* report success if no changes needed */
+	if (result == 0)
+		return (0);
+
+	/* Ensure the effective/inheritable caps aren't > permitted */
+	if (!priv_issubset(privs->p_effective, privs->p_permitted) ||
+	    !priv_issubset(privs->p_inheritable, privs->p_permitted))
+		return (-EPERM);
+
+	/*
+	 * Here is where things become racy.  Linux updates all three
+	 * capability sets simultaneously in the capset syscall.  In order to
+	 * emulate capabilities via privileges, three setppriv operations are
+	 * required in sequence.  If one or two should fail, there is not a
+	 * mechanism to convey the incomplete operation to the caller.
+	 *
+	 * We do two things to make this less risky:
+	 * 1. Verify that both the desired effective and inheritable
+	 *    sets are subsets of the desired permitted set.
+	 * 2. Perform the setppriv of the permitted set first.
+	 *
+	 * Should the setppriv(permitted) fail, we can safely bail out with an
+	 * error.  If it succeeds, the setppriv of effective and inheritable
+	 * are likely to succeed given that they've been verified legal.
+	 *
+	 * If the partial error does happen, we'll be forced to report failure
+	 * even though the privileges were altered.
+	 */
+
+	if ((result & LX_CAP_UPDATE_PERMITTED) != 0) {
+		/* failure here is totally safe */
+		if (setppriv(PRIV_SET, PRIV_PERMITTED, privs->p_permitted) != 0)
+			return (-errno);
+	}
+	if ((result & LX_CAP_UPDATE_EFFECTIVE) != 0) {
+		/* failure here is a bummer */
+		if (setppriv(PRIV_SET, PRIV_EFFECTIVE, privs->p_effective) != 0)
+			return (-errno);
+	}
+	if ((result & LX_CAP_UPDATE_EFFECTIVE) != 0) {
+		/* failure here is a major bummer */
+		if (setppriv(PRIV_SET, PRIV_INHERITABLE,
+		    privs->p_inheritable) != 0)
+			return (-errno);
+	}
+
+	return (0);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/clock.c b/usr/src/lib/brand/lx/lx_brand/common/clock.c
new file mode 100644
index 0000000000..e627df68dc
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/clock.c
@@ -0,0 +1,192 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <time.h>
+#include <sys/resource.h>
+#include <sys/timerfd.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+#include <lx_signum.h>
+
+/*
+ * Translating from the Linux clock types to the illumos types is a bit of a
+ * mess.
+ *
+ * Linux uses different values for it clock identifiers, so we have to do basic
+ * translations between the two.  Thankfully, both Linux and illumos implement
+ * the same POSIX SUSv3 clock types, so the semantics should be identical.
+ *
+ * However, CLOCK_REALTIME and CLOCK_HIGHRES (CLOCK_MONOTONIC) are the only two
+ * clock backends currently implemented on illumos. Functions in the kernel
+ * that use the CLOCK_BACKEND macro will return an error for any clock type
+ * that does not exist in the clock_backend array. These functions are
+ * clock_settime, clock_gettime, clock_getres and timer_create.
+ *
+ * For reference, the kernel's clock_backend array looks like this:
+ *
+ * clock_backend[CLOCK_MAX] (6 entries)
+ *    0	__CLOCK_REALTIME0		valid ptr. (obs. same as CLOCK_REALTIME)
+ *    1	CLOCK_VIRTUAL			NULL
+ *    2	CLOCK_THREAD_CPUTIME_ID		NULL
+ *    3	CLOCK_REALTIME			valid ptr.
+ *    4	CLOCK_MONOTONIC (CLOCK_HIGHRES)	valid ptr.
+ *    5	CLOCK_PROCESS_CPUTIME_ID	NULL
+ */
+
+#define	CLOCK_RT_SLOT	0
+
+#define	LX_CLOCK_REALTIME	0
+#define	LX_CLOCK_MONOTONIC	1
+
+/*
+ * Limits for a minimum interval are enforced when creating timers from the
+ * CLOCK_HIGHRES source. Values below this minimum will be clamped if the
+ * process lacks the proc_clock_highres privilege.
+ */
+static int ltos_clock[] = {
+	CLOCK_REALTIME,			/* LX_CLOCK_REALTIME */
+	CLOCK_HIGHRES,			/* LX_CLOCK_MONOTONIC */
+	CLOCK_PROCESS_CPUTIME_ID,	/* LX_CLOCK_PROCESS_CPUTIME_ID */
+	CLOCK_THREAD_CPUTIME_ID,	/* LX_CLOCK_THREAD_CPUTIME_ID */
+	CLOCK_HIGHRES,			/* LX_CLOCK_MONOTONIC_RAW */
+	CLOCK_REALTIME,			/* LX_CLOCK_REALTIME_COARSE */
+	CLOCK_HIGHRES			/* LX_CLOCK_MONOTONIC_COARSE */
+};
+
+#define	LX_CLOCK_MAX	(sizeof (ltos_clock) / sizeof (ltos_clock[0]))
+
+
+long
+lx_clock_nanosleep(int clock, int flags, struct timespec *rqtp,
+    struct timespec *rmtp)
+{
+	int ret = 0;
+	int err;
+	struct timespec rqt, rmt;
+
+	if (clock < 0 || clock >= LX_CLOCK_MAX)
+		return (-EINVAL);
+
+	if (uucopy(rqtp, &rqt, sizeof (struct timespec)) < 0)
+		return (-EFAULT);
+
+	/* the TIMER_RELTIME and TIMER_ABSTIME flags are the same on Linux */
+	if ((err = clock_nanosleep(ltos_clock[clock], flags, &rqt, &rmt))
+	    != 0) {
+		if (err != EINTR)
+			return (-err);
+		ret = -EINTR;
+		/*
+		 * We fall through in case we have to pass back the remaining
+		 * time.
+		 */
+	}
+
+	/*
+	 * Only copy values to rmtp if the timer is TIMER_RELTIME and rmtp is
+	 * non-NULL.
+	 */
+	if (((flags & TIMER_RELTIME) == TIMER_RELTIME) && (rmtp != NULL) &&
+	    (uucopy(&rmt, rmtp, sizeof (struct timespec)) < 0))
+		return (-EFAULT);
+
+	return (ret);
+}
+
+/*ARGSUSED*/
+long
+lx_adjtimex(void *tp)
+{
+	return (-EPERM);
+}
+
+long
+lx_timer_settime(timer_t tid, int flags, struct itimerspec *new_val,
+    struct itimerspec *old_val)
+{
+	return ((timer_settime(tid, flags, new_val, old_val) < 0) ? -errno : 0);
+}
+
+long
+lx_timer_gettime(timer_t tid, struct itimerspec *val)
+{
+	return ((timer_gettime(tid, val) < 0) ? -errno : 0);
+}
+
+long
+lx_timer_getoverrun(timer_t tid)
+{
+	int val;
+
+	val = timer_getoverrun(tid);
+	return ((val < 0) ? -errno : val);
+}
+
+long
+lx_timer_delete(timer_t tid)
+{
+	return ((timer_delete(tid) < 0) ? -errno : 0);
+}
+
+long
+lx_timerfd_create(int clockid, int flags)
+{
+	int r;
+
+	/* These are the only two valid values. LTP tests for this. */
+	if (clockid != LX_CLOCK_REALTIME && clockid != LX_CLOCK_MONOTONIC)
+		return (-EINVAL);
+
+	r = timerfd_create(ltos_clock[clockid], flags);
+	/*
+	 * As with the eventfd case, we return a slightly less jarring
+	 * error condition if we cannot open /dev/timerfd.
+	 */
+	if (r == -1 && errno == ENOENT)
+		return (-ENOTSUP);
+
+	return (r == -1 ? -errno : r);
+}
+
+long
+lx_timerfd_settime(int fd, int flags, const struct itimerspec *value,
+    struct itimerspec *ovalue)
+{
+	int r = timerfd_settime(fd, flags, value, ovalue);
+
+	return (r == -1 ? -errno : r);
+}
+
+long
+lx_timerfd_gettime(int fd, struct itimerspec *value)
+{
+	int r = timerfd_gettime(fd, value);
+
+	return (r == -1 ? -errno : r);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/clone.c b/usr/src/lib/brand/lx/lx_brand/common/clone.c
new file mode 100644
index 0000000000..b540d5a55e
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/clone.c
@@ -0,0 +1,724 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+#include <ucontext.h>
+#include <thread.h>
+#include <strings.h>
+#include <libintl.h>
+#include <sys/regset.h>
+#include <sys/syscall.h>
+#include <sys/inttypes.h>
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/segments.h>
+#include <signal.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_types.h>
+#include <sys/lx_signal.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_thread.h>
+#include <sys/fork.h>
+#include <sys/mman.h>
+#include <sys/debug.h>
+#include <lx_syscall.h>
+
+#define	CLONE_VFORK (LX_CLONE_VM | LX_CLONE_VFORK)
+#define	CLONE_TD (LX_CLONE_THREAD|LX_CLONE_DETACH)
+
+#define	IS_FORK(f)	(((f) & SHARED_AS) == 0)
+#define	IS_VFORK(f)	(((f) & CLONE_VFORK) == CLONE_VFORK)
+
+/*
+ * This is dicey.  This seems to be an internal glibc structure, and not
+ * part of any external interface.  Thus, it is subject to change without
+ * notice.  FWIW, clone(2) itself seems to be an internal (or at least
+ * unstable) interface, since strace(1) shows it differently than the man
+ * page.
+ */
+struct lx_desc
+{
+	uint32_t entry_number;
+	uint32_t base_addr;
+	uint32_t limit;
+	uint32_t seg_32bit:1;
+	uint32_t contents:2;
+	uint32_t read_exec_only:1;
+	uint32_t limit_in_pages:1;
+	uint32_t seg_not_present:1;
+	uint32_t useable:1;
+	uint32_t empty:25;
+};
+
+struct clone_state {
+	void		*c_retaddr;	/* instr after clone()'s int80 */
+	int		c_flags;	/* flags to clone(2) */
+	int 		c_sig;		/* signal to send on thread exit */
+	void 		*c_stk;		/* %esp of new thread */
+	void 		*c_ptidp;
+	struct lx_desc	*c_ldtinfo;	/* thread-specific segment */
+	void		*c_ctidp;
+	ucontext_t	c_uc;		/* original register state/sigmask */
+	volatile int	*c_clone_res;	/* pid/error returned to cloner */
+	int		c_ptrace_event;	/* ptrace(2) event for child stop */
+	void		*c_ntv_stk;	/* native stack for this thread */
+	size_t		c_ntv_stk_sz;	/* native stack size */
+	lx_tsd_t	*c_lx_tsd;	/* tsd area for thread */
+};
+
+long
+lx_exit(uintptr_t p1)
+{
+	int		status = (int)p1;
+	lx_tsd_t	*lx_tsd = lx_get_tsd();
+
+	/*
+	 * If we are a vfork(2)ed child, we need to exit as quickly and
+	 * cleanly as possible to avoid corrupting our parent.
+	 */
+	if (lx_tsd->lxtsd_is_vforked != 0) {
+		_exit(status);
+	}
+
+	lx_tsd->lxtsd_exit = LX_ET_EXIT;
+	lx_tsd->lxtsd_exit_status = status;
+
+	lx_ptrace_stop_if_option(LX_PTRACE_O_TRACEEXIT, B_FALSE,
+	    (ulong_t)status, NULL);
+
+	/*
+	 * This thread is exiting.  Restore the state of the thread to
+	 * what it was before we started running linux code.
+	 */
+	(void) setcontext(&lx_tsd->lxtsd_exit_context);
+
+	/*
+	 * If we returned from the setcontext(2), something is very wrong.
+	 */
+	lx_err_fatal("exit: unable to set exit context: %s", strerror(errno));
+
+	/*NOTREACHED*/
+	return (0);
+}
+
+long
+lx_group_exit(uintptr_t p1)
+{
+	int		status = (int)p1;
+	lx_tsd_t	*lx_tsd = lx_get_tsd();
+
+	/*
+	 * If we are a vfork(2)ed child, we need to exit as quickly and
+	 * cleanly as possible to avoid corrupting our parent.
+	 */
+	if (lx_tsd->lxtsd_is_vforked != 0) {
+		_exit(status);
+	}
+
+	lx_tsd->lxtsd_exit = LX_ET_EXIT_GROUP;
+	lx_tsd->lxtsd_exit_status = status;
+
+	/*
+	 * This thread is exiting.  Restore the state of the thread to
+	 * what it was before we started running linux code.
+	 */
+	(void) setcontext(&lx_tsd->lxtsd_exit_context);
+
+	/*
+	 * If we returned from the setcontext(2), something is very wrong.
+	 */
+	lx_err_fatal("group_exit: unable to set exit context: %s",
+	    strerror(errno));
+
+	/*NOTREACHED*/
+	return (0);
+}
+
+static void *
+clone_start(void *arg)
+{
+	int rval;
+	struct clone_state *cs = (struct clone_state *)arg;
+	lx_tsd_t *lxtsd;
+
+	/*
+	 * Let the kernel finish setting up all the needed state for this
+	 * new thread.
+	 *
+	 * We already created the thread using the thr_create(3C) library
+	 * call, so most of the work required to emulate lx_clone(2) has
+	 * been done by the time we get to this point.
+	 */
+	lx_debug("\tre-vectoring to lx kernel module to complete lx_clone()");
+	lx_debug("\tB_HELPER_CLONE(0x%x, 0x%p, 0x%p, 0x%p)",
+	    cs->c_flags, cs->c_ptidp, cs->c_ldtinfo, cs->c_ctidp);
+
+	rval = syscall(SYS_brand, B_HELPER_CLONE, cs->c_flags, cs->c_ptidp,
+	    cs->c_ldtinfo, cs->c_ctidp);
+
+	/*
+	 * At this point the parent is waiting for cs->c_clone_res to go
+	 * non-zero to indicate the thread has been cloned.  The value set
+	 * in cs->c_clone_res will be used for the return value from
+	 * clone().
+	 */
+	if (rval < 0) {
+		*(cs->c_clone_res) = -errno;
+		lx_debug("\tkernel clone failed, errno %d\n", errno);
+		free(cs->c_lx_tsd);
+		free(cs);
+		return (NULL);
+	}
+
+	/*
+	 * Initialize the thread specific data for this thread.
+	 */
+	lxtsd = cs->c_lx_tsd;
+	lx_init_tsd(lxtsd);
+	lxtsd->lxtsd_clone_state = cs;
+
+	/*
+	 * Install the emulation stack for this thread.  Register the
+	 * thread-specific data structure with the stack list so that it may be
+	 * freed at thread exit or fork(2).
+	 */
+	lx_install_stack(cs->c_ntv_stk, cs->c_ntv_stk_sz, lxtsd);
+
+	/*
+	 * Let the parent know that the clone has (effectively) been
+	 * completed.
+	 */
+	*(cs->c_clone_res) = rval;
+
+	/*
+	 * We want to load the general registers from this context, restore the
+	 * original signal mask, and switch to the BRAND stack.  The original
+	 * signal mask was saved to the context by lx_clone().
+	 */
+	cs->c_uc.uc_flags = UC_CPU | UC_SIGMASK;
+	cs->c_uc.uc_brand_data[0] = (void *)LX_UC_STACK_BRAND;
+
+	/*
+	 * New threads will not link into the existing context chain.
+	 */
+	cs->c_uc.uc_link = NULL;
+
+	/*
+	 * Set stack pointer and entry point for new thread:
+	 */
+	LX_REG(&cs->c_uc, REG_SP) = (uintptr_t)cs->c_stk;
+	LX_REG(&cs->c_uc, REG_PC) = (uintptr_t)cs->c_retaddr;
+
+	/*
+	 * Return 0 to the child:
+	 */
+	LX_REG(&cs->c_uc, REG_R0) = (uintptr_t)0;
+
+	/*
+	 * Fire the ptrace(2) event stop in the new thread:
+	 */
+	lx_ptrace_stop_if_option(cs->c_ptrace_event, B_TRUE, 0, &cs->c_uc);
+
+	/*
+	 * Jump to the Linux process.  This call cannot return.
+	 */
+	lx_jump_to_linux(&cs->c_uc);
+	/* NOTREACHED */
+}
+
+/*
+ * The way Linux handles stopping for FORK vs. CLONE does not map exactly to
+ * which syscall was used. Instead, it has to do with which signal is set in
+ * the low byte of the clone flag. The only time the CLONE event is emitted is
+ * if the clone signal (the low byte of the flags argument) is set to something
+ * other than SIGCHLD (see the Linux src in kernel/fork.c do_fork() for the
+ * actual code).
+ */
+static int
+ptrace_clone_event(int flags)
+{
+	if (flags & LX_CLONE_VFORK)
+		return (LX_PTRACE_O_TRACEVFORK);
+
+	if ((flags & LX_CSIGNAL) != LX_SIGCHLD)
+		return (LX_PTRACE_O_TRACECLONE);
+
+	return (LX_PTRACE_O_TRACEFORK);
+}
+
+/*
+ * See glibc sysdeps/unix/sysv/linux/x86_64/clone.S code for x64 argument order
+ * and the Linux kernel/fork.c code for the various ways arguments can be passed
+ * to the clone syscall (CONFIG_CLONE_BACKWARDS, et al).
+ */
+long
+lx_clone(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5)
+{
+	struct clone_state *cs;
+	int flags = (int)p1;
+	void *cldstk = (void *)p2;
+	void *ptidp = (void *)p3;
+#if defined(_LP64)
+	void *ctidp = (void *)p4;
+	struct lx_desc *ldtinfo = (void *)p5;
+#else /* is 32bit */
+	struct lx_desc *ldtinfo = (void *)p4;
+	void *ctidp = (void *)p5;
+#endif
+	thread_t tid;
+	volatile int clone_res;
+	int sig;
+	int rval;
+	int pid;
+	ucontext_t *ucp;
+	sigset_t sigmask, osigmask;
+	int fork_flags = 0;
+	int ptrace_event;
+	lx_tsd_t *lx_tsd = lx_get_tsd();
+
+	if (flags & LX_CLONE_SETTLS) {
+		lx_debug("lx_clone(flags=0x%x stk=0x%p ptidp=0x%p ldt=0x%p "
+		    "ctidp=0x%p", flags, cldstk, ptidp, ldtinfo, ctidp);
+	} else {
+		lx_debug("lx_clone(flags=0x%x stk=0x%p ptidp=0x%p)",
+		    flags, cldstk, ptidp);
+	}
+
+	/*
+	 * Only supported for pid 0 on Linux after version 2.3.21, and
+	 * apparently not at all since 2.5.16.
+	 */
+	if (flags & LX_CLONE_PID)
+		return (-EINVAL);
+
+	/*
+	 * CLONE_THREAD requires CLONE_SIGHAND.
+	 *
+	 * CLONE_THREAD and CLONE_DETACHED must both be either set or cleared
+	 * in kernel 2.4 and prior.
+	 * In kernel 2.6 (and later) CLONE_DETACHED was dropped completely, so
+	 * we no longer have this requirement.
+	 */
+
+	if (flags & CLONE_TD) {
+		if (!(flags & LX_CLONE_SIGHAND))
+			return (-EINVAL);
+		if (strncmp(lx_release, "2.4", 3) == 0 &&
+		    (flags & CLONE_TD) != CLONE_TD)
+			return (-EINVAL);
+	}
+
+	if ((flags & LX_CLONE_NS_UNSUP) != 0) {
+		lx_unsupported("clone(2) no namespace support "
+		    "(flags:0x%08X)\n", flags);
+		/*
+		 * When the "kernel" does not support namespaces, applications
+		 * (e.g. chromium) expect EINVAL, not ENOTSUP.
+		 */
+		return (-EINVAL);
+	}
+
+	ucp = lx_syscall_regs();
+
+	/* test if pointer passed by user are writable */
+	if (flags & LX_CLONE_PARENT_SETTID) {
+		if (uucopy(ptidp, &pid, sizeof (int)) != 0)
+			return (-EFAULT);
+		if (uucopy(&pid, ptidp, sizeof (int)) != 0)
+			return (-EFAULT);
+	}
+	if (flags & LX_CLONE_CHILD_SETTID) {
+		if (uucopy(ctidp, &pid, sizeof (int)) != 0)
+			return (-EFAULT);
+		if (uucopy(&pid, ctidp, sizeof (int)) != 0)
+			return (-EFAULT);
+	}
+
+	ptrace_event = ptrace_clone_event(flags);
+
+	/*
+	 * Inform the in-kernel ptrace(2) subsystem that we are about to
+	 * emulate a fork(2), vfork(2) or clone(2) system call.
+	 */
+	lx_ptrace_clone_begin(ptrace_event, !!(flags & LX_CLONE_PTRACE), flags);
+
+	/*
+	 * Handle a fork(2) operation here. If this is not a fork, a new
+	 * thread will be created after this block. We can also create a new
+	 * clone-group here (when two or more processes share data represented
+	 * by a subset of the SHARED_AS flags, but not a true thread).
+	 */
+	if (IS_FORK(flags) || IS_VFORK(flags) || LX_IS_CLONE_GRP(flags)) {
+		if (flags & LX_CLONE_PARENT) {
+			lx_unsupported("clone(2) only supports CLONE_PARENT "
+			    "for threads.\n");
+			return (-ENOTSUP);
+		}
+
+		if ((flags & LX_CSIGNAL) == 0)
+			fork_flags |= FORK_NOSIGCHLD;
+
+		/*
+		 * Suspend signal delivery, run the stack management prefork
+		 * handler and perform the actual fork(2) operation.
+		 *
+		 * During vfork, Linux will not deliver any signals to any
+		 * thread in the parent. Some applications (e.g. Go) depend on
+		 * this. For example, we must prevent the following sequence:
+		 * 1) Parent with many threads, one thread calls vfork
+		 * 2) vforked child resets all signal handlers
+		 * 3) a different child of the parent exits and SIGCHLD is sent
+		 *    to parent before the vforked child execs/exits
+		 * The parent cannot receive the SIGCHLD until afer we repair
+		 * the parent's signal handlers in lx_sighandlers_restore, once
+		 * the parent resumes after the vfork.
+		 */
+		if (flags & LX_CLONE_VFORK) {
+			lx_block_all_signals();
+		} else {
+			_sigoff();
+		}
+		lx_stack_prefork();
+		if (flags & LX_CLONE_VFORK) {
+			lx_sighandlers_t saved;
+
+			/*
+			 * Because we keep our signal disposition at user-land
+			 * (and in memory), we must prevent it from being
+			 * clobbered should our vforked child change the
+			 * disposition (e.g., via sigaction()) before releasing
+			 * the address space.  We preserve our disposition by
+			 * taking a snapshot of it before the vfork and
+			 * restoring it afterwards -- which we can get away
+			 * with because we know that we aren't executing
+			 * concurrently with our child.
+			 */
+			lx_sighandlers_save(&saved);
+			lx_tsd->lxtsd_is_vforked++;
+			rval = vforkx(fork_flags);
+			if (rval != 0) {
+				lx_tsd->lxtsd_is_vforked--;
+				lx_sighandlers_restore(&saved);
+			}
+		} else {
+			rval = forkx(fork_flags);
+		}
+
+		/*
+		 * The parent process returns through the regular system call
+		 * path here.
+		 */
+		if (rval != 0) {
+			/*
+			 * Run the stack management postfork handler in the
+			 * parent.  In the CLONE_VFORK case, where it only
+			 * needs to be performed once due to the shared address
+			 * space, it is critical that this step is performed in
+			 * the parent and not the child.  The latter can result
+			 * in un-woken threads blocked on lx_stack_list_lock.
+			 */
+			lx_stack_postfork();
+
+			/*
+			 * Since we've already forked, we can't do much if
+			 * uucopy fails, so we just ignore failure. Failure is
+			 * unlikely since we've tested the memory before we did
+			 * the fork.
+			 */
+			if (rval > 0 && (flags & LX_CLONE_PARENT_SETTID)) {
+				(void) uucopy(&rval, ptidp, sizeof (int));
+			}
+
+			/*
+			 * Re-enable signal delivery in the parent process.
+			 */
+			if (flags & LX_CLONE_VFORK) {
+				lx_unblock_all_signals();
+			} else {
+				_sigon();
+			}
+
+			if (rval > 0) {
+				lx_ptrace_stop_if_option(ptrace_event, B_FALSE,
+				    (ulong_t)rval, NULL);
+			}
+
+			return ((rval < 0) ? -errno : rval);
+		}
+
+		/*
+		 * The rest of this block runs only within the new child
+		 * process.
+		 */
+
+		if (!IS_VFORK(flags)) {
+			/*
+			 * For non-vfork children run the stack management
+			 * postfork handler.
+			 */
+			lx_stack_postfork();
+
+			/*
+			 * We must free the stacks and thread-specific data
+			 * objects for every thread except the one duplicated
+			 * from the parent by forkx().
+			 */
+			lx_free_other_stacks();
+		}
+
+		if (rval == 0 && (flags & LX_CLONE_CHILD_SETTID)) {
+			/*
+			 * lx_getpid should not fail, and if it does, there's
+			 * not much we can do about it since we've already
+			 * forked, so on failure, we just don't copy the
+			 * memory.
+			 */
+			pid = syscall(SYS_brand, B_GETPID);
+			if (pid >= 0)
+				(void) uucopy(&pid, ctidp, sizeof (int));
+		}
+
+		/*
+		 * Set up additional data in the lx_proc_data structure as
+		 * necessary.
+		 */
+		if ((rval = syscall(SYS_brand, B_HELPER_CLONE, flags, ptidp,
+		    ldtinfo, ctidp)) < 0) {
+			return (rval);
+		}
+
+		if (IS_VFORK(flags)) {
+			ucontext_t vforkuc;
+
+			/*
+			 * The vfork(2) interface is somewhat less than ideal.
+			 * The unfortunate notion of borrowing the address
+			 * space of the parent process requires us to jump
+			 * through several hoops to prevent corrupting parent
+			 * emulation state.
+			 *
+			 * When returning in the child, we make a copy of the
+			 * system call return context and discard three pages
+			 * of the native stack.  Returning normally would
+			 * clobber the native stack frame in which the brand
+			 * library in the parent process is presently waiting.
+			 *
+			 * The calling program is expected to correctly use
+			 * this dusty, underspecified relic.  Neglecting to
+			 * immediately call execve(2) or exit(2) is not
+			 * cricket; this stack space will be permanently lost,
+			 * not to mention myriad other undefined behaviour.
+			 */
+			bcopy(ucp, &vforkuc, sizeof (vforkuc));
+			vforkuc.uc_brand_data[1] =
+			    (caddr_t)vforkuc.uc_brand_data[1] -
+			    LX_NATIVE_STACK_VFORK_GAP;
+			vforkuc.uc_link = NULL;
+
+			lx_debug("\tvfork native stack sp %p",
+			    vforkuc.uc_brand_data[1]);
+
+			/*
+			 * If provided, the child needs its new stack set up.
+			 */
+			if (cldstk != 0) {
+				lx_debug("\tvfork cldstk %p", cldstk);
+				LX_REG(&vforkuc, REG_SP) = (uintptr_t)cldstk;
+			}
+
+			/*
+			 * Re-enable signal delivery in the child process.
+			 */
+			lx_unblock_all_signals();
+
+			/*
+			 * Stop for ptrace if required.
+			 */
+			lx_ptrace_stop_if_option(ptrace_event, B_TRUE, 0, NULL);
+
+			/*
+			 * Return to the child via the specially constructed
+			 * vfork(2) context.
+			 */
+			LX_EMULATE_RETURN(&vforkuc, LX_SYS_clone, 0, 0);
+			(void) syscall(SYS_brand, B_EMULATION_DONE, &vforkuc,
+			    LX_SYS_clone, 0, 0);
+
+			assert(0);
+		}
+
+		/*
+		 * If provided, the child needs its new stack set up.
+		 */
+		if (cldstk != 0) {
+			lx_debug("\tcldstk %p", cldstk);
+			LX_REG(ucp, REG_SP) = (uintptr_t)cldstk;
+		}
+
+		/*
+		 * Re-enable signal delivery in the child process.
+		 */
+		if (flags & LX_CLONE_VFORK) {
+			lx_unblock_all_signals();
+		} else {
+			_sigon();
+		}
+
+		/*
+		 * Stop for ptrace if required.
+		 */
+		lx_ptrace_stop_if_option(ptrace_event, B_TRUE, 0, NULL);
+
+		/*
+		 * The child process returns via the regular emulated system
+		 * call path:
+		 */
+		return (0);
+	}
+
+	/*
+	 * A supported clone-group was handled above, so now it must be a
+	 * true native thread, which means exactly these flags are supported
+	 */
+	if (((flags & SHARED_AS) != SHARED_AS)) {
+		lx_unsupported("clone(2) a thread requires that all or none of "
+		    "CLONE_VM/FS/FILES/THREAD/SIGHAND be set. (flags:0x%08X)\n",
+		    flags);
+		return (-ENOTSUP);
+	}
+
+	if (cldstk == NULL) {
+		lx_unsupported("clone(2) requires the caller to allocate the "
+		    "child's stack.\n");
+		return (-ENOTSUP);
+	}
+
+	/*
+	 * If we want a signal-on-exit, ensure that the signal is valid.
+	 */
+	if ((sig = ltos_signo[flags & LX_CSIGNAL]) == -1) {
+		lx_unsupported("clone(2) passed unsupported signal: %d", sig);
+		return (-ENOTSUP);
+	}
+
+	/*
+	 * Initialise the state structure we pass as an argument to the new
+	 * thread:
+	 */
+	if ((cs = malloc(sizeof (*cs))) == NULL) {
+		lx_debug("could not allocate clone_state: %d", errno);
+		return (-ENOMEM);
+	}
+	cs->c_flags = flags;
+	cs->c_sig = sig;
+	cs->c_stk = cldstk;
+	cs->c_ptidp = ptidp;
+	cs->c_ldtinfo = ldtinfo;
+	cs->c_ctidp = ctidp;
+	cs->c_clone_res = &clone_res;
+	cs->c_ptrace_event = ptrace_event;
+	/*
+	 * We want the new thread to return directly to the call site for
+	 * the system call.
+	 */
+	cs->c_retaddr = (void *)LX_REG(ucp, REG_PC);
+	/*
+	 * Copy the saved context for the clone(2) system call so that the
+	 * new thread may use it to initialise registers.
+	 */
+	bcopy(ucp, &cs->c_uc, sizeof (cs->c_uc));
+	if ((cs->c_lx_tsd = malloc(sizeof (*cs->c_lx_tsd))) == NULL) {
+		free(cs);
+		return (-ENOMEM);
+	}
+
+	clone_res = 0;
+
+	/*
+	 * Block all signals because the thread we create won't be able to
+	 * properly handle them until it's fully set up.
+	 */
+	VERIFY0(sigfillset(&sigmask));
+	if (sigprocmask(SIG_BLOCK, &sigmask, &osigmask) < 0) {
+		lx_debug("lx_clone sigprocmask() failed: %d", errno);
+		free(cs->c_lx_tsd);
+		free(cs);
+		return (-errno);
+	}
+	cs->c_uc.uc_sigmask = osigmask;
+
+	/*
+	 * Allocate the native stack for this new thread now, so that we
+	 * can return failure gracefully as ENOMEM.
+	 */
+	if (lx_alloc_stack(&cs->c_ntv_stk, &cs->c_ntv_stk_sz) != 0) {
+		free(cs->c_lx_tsd);
+		free(cs);
+		return (-ENOMEM);
+	}
+
+	rval = thr_create(NULL, NULL, clone_start, cs, THR_DETACHED, &tid);
+
+	/*
+	 * If the thread did not start, free the resources we allocated:
+	 */
+	if (rval != 0) {
+		(void) munmap(cs->c_ntv_stk, cs->c_ntv_stk_sz);
+		free(cs->c_lx_tsd);
+		free(cs);
+	}
+
+	/*
+	 * Release any pending signals
+	 */
+	(void) sigprocmask(SIG_SETMASK, &osigmask, NULL);
+
+	/*
+	 * Wait for the child to be created and have its tid assigned.
+	 */
+	if (rval == 0) {
+		while (clone_res == 0)
+			;
+
+		rval = clone_res;
+		lx_ptrace_stop_if_option(ptrace_event, B_FALSE, (ulong_t)rval,
+		    NULL);
+
+		return (rval);
+	} else {
+		/*
+		 * Return the error from thr_create(3C).
+		 */
+		return (-rval);
+	}
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/debug.c b/usr/src/lib/brand/lx/lx_brand/common/debug.c
new file mode 100644
index 0000000000..a8f994c43d
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/debug.c
@@ -0,0 +1,171 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <thread.h>
+#include <unistd.h>
+
+#include <sys/modctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_misc.h>
+
+/* internal debugging state */
+static const char	*lx_debug_path = NULL;	/* debug output file path */
+static char		lx_debug_path_buf[MAXPATHLEN];
+
+int		lx_dtrace_lazyload = 1;		/* patchable; see below */
+
+void
+lx_debug_init(boolean_t do_dtrace, boolean_t dbg_enable, const char *dbg_file)
+{
+	/*
+	 * Our DTrace USDT provider is loaded in our .init section, which is
+	 * not run by our e_entry ELF entry point (_start, which calls into
+	 * lx_init()).  We exploit this to only actually load our USDT provider
+	 * if LX_DTRACE is set, assuring that we don't compromise fork()
+	 * performance in the (common) case that DTrace of lx_brand.so.1 itself
+	 * isn't enabled or desired. (As with all USDT providers, it can always
+	 * be loaded by explicitly specifying the full provider name).  Note
+	 * that we also allow this behavior to be set via a manual override,
+	 * lx_dtrace_lazyload -- allowing for USDT probes to be automatically
+	 * provided in situations where setting an environment variable is
+	 * tedious or otherwise impossible.
+	 */
+	if (do_dtrace || !lx_dtrace_lazyload) {
+		extern void _init(void);
+		_init();
+	}
+
+	if (!dbg_enable)
+		return;
+
+	/*
+	 * It's OK to use this value without any locking, as all callers can
+	 * use the return value to decide whether extra work should be done
+	 * before calling lx_debug().
+	 *
+	 * If debugging is disabled after a routine calls this function it
+	 * doesn't really matter as lx_debug() will see debugging is disabled
+	 * and will not output anything.
+	 */
+	lx_debug_enabled = 1;
+
+	/* check if there's a debug log file specified */
+	lx_debug_path = dbg_file;
+	if (lx_debug_path == NULL) {
+		/* send all debugging output to /dev/tty */
+		lx_debug_path = "/dev/tty";
+	}
+
+	(void) strlcpy(lx_debug_path_buf, lx_debug_path,
+	    sizeof (lx_debug_path_buf));
+	lx_debug_path = lx_debug_path_buf;
+
+	lx_debug("lx_debug: debugging output ENABLED to path: \"%s\"",
+	    lx_debug_path);
+}
+
+void
+lx_debug(const char *msg, ...)
+{
+	va_list		ap;
+	char		*buf;
+	int		rv, fd, n;
+	int		errno_backup;
+	int		size = LX_MSG_MAXLEN + 1;
+
+	if (lx_debug_enabled == 0 && !LX_DEBUG_ENABLED())
+		return;
+
+	/*
+	 * If debugging is not enabled, we do not wish to have a large stack
+	 * footprint.  The buffer allocation is thus done conditionally,
+	 * rather than as regular automatic storage.
+	 */
+	if ((buf = SAFE_ALLOCA(size)) == NULL)
+		return;
+
+	errno_backup = errno;
+
+	/* prefix the message with pid/tid */
+	if ((n = snprintf(buf, size, "%u/%u: ", getpid(), thr_self())) == -1) {
+		errno = errno_backup;
+		return;
+	}
+
+	/* format the message */
+	va_start(ap, msg);
+	rv = vsnprintf(&buf[n], size - n, msg, ap);
+	va_end(ap);
+	if (rv == -1) {
+		errno = errno_backup;
+		return;
+	}
+
+	/* add a carrige return if there isn't one already */
+	if ((buf[strlen(buf) - 1] != '\n') &&
+	    (strlcat(buf, "\n", size) >= size)) {
+		errno = errno_backup;
+		return;
+	}
+
+	LX_DEBUG(buf);
+
+	if (!lx_debug_enabled)
+		return;
+
+	/*
+	 * Open the debugging output file.  note that we don't protect
+	 * ourselves against exec or fork1 here.  if an mt process were
+	 * to exec/fork1 while we're doing this they'd end up with an
+	 * extra open desciptor in their fd space.  a'well.  shouldn't
+	 * really matter.
+	 */
+	if ((fd = open(lx_debug_path,
+	    O_WRONLY|O_APPEND|O_CREAT|O_NDELAY|O_NOCTTY, 0666)) == -1) {
+		return;
+	}
+	(void) fchmod(fd, 0666);
+
+	/* we retry in case of EINTR */
+	do {
+		rv = write(fd, buf, strlen(buf));
+	} while ((rv == -1) && (errno == EINTR));
+	(void) fsync(fd);
+
+	(void) close(fd);
+	errno = errno_backup;
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/dir.c b/usr/src/lib/brand/lx/lx_brand/common/dir.c
new file mode 100644
index 0000000000..ed10dfb822
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/dir.c
@@ -0,0 +1,82 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <string.h>
+#include <stddef.h>
+#include <errno.h>
+#include <unistd.h>
+#include <assert.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/dirent.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_syscall.h>
+
+#define	LX_NAMEMAX	256
+
+struct lx_old_dirent {
+	long		d_ino;  /* not l_ino_t */
+	long		d_off;
+	ushort_t	d_reclen;
+	char 		d_name[LX_NAMEMAX];
+};
+
+/*
+ * Read in one dirent structure from fd into dirp.
+ * p3 (count) is ignored.
+ */
+/*ARGSUSED*/
+long
+lx_readdir(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	int fd = (int)p1;
+	struct lx_old_dirent *dirp = (struct lx_old_dirent *)p2;
+	uint_t count = sizeof (struct lx_old_dirent);
+	int rc = 0;
+	struct lx_old_dirent _ld;
+	struct dirent *sd = (struct dirent *)&_ld;
+
+	/*
+	 * The return value from getdents is not applicable, as
+	 * it might have squeezed more than one dirent in the buffer
+	 * we provided.
+	 *
+	 * getdents() will deal with the case of dirp == NULL
+	 */
+	if ((rc = getdents(fd, sd, count)) < 0)
+		return (-errno);
+
+	/*
+	 * Set rc 1 (pass), or 0 (end of directory).
+	 */
+	rc = (sd->d_reclen == 0) ? 0 : 1;
+
+	if (uucopy(sd, dirp, count) != 0)
+		return (-errno);
+
+	return (rc);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/file.c b/usr/src/lib/brand/lx/lx_brand/common/file.c
new file mode 100644
index 0000000000..a1f55e2899
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/file.c
@@ -0,0 +1,347 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/fstyp.h>
+#include <sys/fsid.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/vnode.h>
+#include <fcntl.h>
+#include <string.h>
+#include <utime.h>
+#include <atomic.h>
+#include <sys/syscall.h>
+
+#include <sys/lx_syscall.h>
+#include <sys/lx_types.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_fcntl.h>
+
+#define	LX_UTIME_NOW	((1l << 30) - 1l)
+#define	LX_UTIME_OMIT	((1l << 30) - 2l)
+
+static int
+install_checkpath(uintptr_t p1)
+{
+	int saved_errno = errno;
+	char path[MAXPATHLEN];
+
+	/*
+	 * The "dev" RPM package wants to modify /dev/pts, but /dev/pts is a
+	 * lofs mounted copy of /native/dev/pts, so that won't work.
+	 *
+	 * Instead, if we're trying to modify /dev/pts from install mode, just
+	 * act as if it succeded.
+	 */
+	if (uucopystr((void *)p1, path, MAXPATHLEN) == -1)
+		return (-errno);
+
+	if (strcmp(path, "/dev/pts") == 0)
+		return (0);
+
+	errno = saved_errno;
+	return (-errno);
+}
+
+/*
+ * Miscellaneous file-related system calls.
+ */
+
+/*
+ * fsync() and fdatasync() - On Illumos, these calls translate into a common
+ * fdsync() syscall with a different parameter. fsync is handled in the
+ * fsync wrapper.
+ */
+long
+lx_fsync(uintptr_t fd)
+{
+	int fildes = (int)fd;
+	struct stat64 statbuf;
+
+	if ((fstat64(fildes, &statbuf) == 0) &&
+	    (S_ISCHR(statbuf.st_mode) || S_ISFIFO(statbuf.st_mode)))
+		return (-EINVAL);
+
+	return (fsync((int)fd) ? -errno : 0);
+}
+
+long
+lx_fdatasync(uintptr_t fd)
+{
+	int fildes = (int)fd;
+	struct stat64 statbuf;
+
+	if ((fstat64(fildes, &statbuf) == 0) &&
+	    (S_ISCHR(statbuf.st_mode) || S_ISFIFO(statbuf.st_mode)))
+		return (-EINVAL);
+
+	return (fdatasync((int)fd) ? -errno : 0);
+}
+
+long
+lx_utime(uintptr_t p1, uintptr_t p2)
+{
+	int ret;
+
+	ret = utime((const char *)p1, (const struct utimbuf *)p2);
+
+	if (ret < 0) {
+		/*
+		 * If utime() failed and we're in install mode, return success
+		 * if the the reason we failed was because the source file
+		 * didn't actually exist or if we're trying to modify /dev/pts.
+		 */
+		if ((lx_install != 0) &&
+		    ((errno == ENOENT) || (install_checkpath(p1) == 0)))
+			return (0);
+
+		return (-errno);
+	}
+
+	return (0);
+}
+
+long
+lx_rmdir(uintptr_t p1)
+{
+	int r;
+	char *nm = (char *)p1;
+
+	r = rmdir(nm);
+	if (r < 0) {
+		int terr = errno;
+
+		/*
+		 * On both Illumos and Linux rmdir returns EINVAL if the last
+		 * component of the path is '.', but on Illumos we also return
+		 * this errno if we're trying to remove the CWD. Unfortunately,
+		 * at least the LTP test suite assumes that it can rmdir the
+		 * CWD, so we need handle this. We try to get out of the
+		 * directory we're trying to remove.
+		 */
+		if (terr == EINVAL) {
+			int l;
+
+			l = strlen(nm);
+			if (l >= 2 && !(nm[l - 2] == '/' && nm[l - 1] == '.')) {
+				if (chdir("..") == 0 && rmdir(nm) == 0) {
+					return (0);
+				}
+			}
+		}
+
+		return ((terr == EEXIST) ? -ENOTEMPTY : -terr);
+	}
+	return (0);
+}
+
+/*
+ * Exactly the same as Illumos' sysfs(2), except Linux numbers their fs indices
+ * starting at 0, and Illumos starts at 1.
+ */
+long
+lx_sysfs(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	int option = (int)p1;
+	int res;
+
+	/*
+	 * Linux actually doesn't have #defines for these; their sysfs(2)
+	 * man page literally defines the "option" field as being 1, 2 or 3,
+	 * corresponding to Solaris' GETFSIND, GETFSTYP and GETNFSTYP,
+	 * respectively.
+	 */
+	switch (option) {
+		case 1:
+			if ((res = sysfs(GETFSIND, (const char *)p2)) < 0)
+				return (-errno);
+
+			return (res - 1);
+
+		case 2:
+			if ((res = sysfs(GETFSTYP, (int)p2 + 1,
+			    (char *)p3)) < 0)
+				return (-errno);
+
+			return (0);
+
+		case 3:
+			if ((res = sysfs(GETNFSTYP)) < 0)
+				return (-errno);
+
+			return (res);
+
+		default:
+			break;
+	}
+
+	return (-EINVAL);
+}
+
+long
+lx_futimesat(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	int atfd = (int)p1;
+	char *path = (char *)p2;
+	struct timeval *times = (struct timeval *)p3;
+
+	if (atfd == LX_AT_FDCWD)
+		atfd = AT_FDCWD;
+
+	return (futimesat(atfd, path, times) ? -errno : 0);
+}
+
+/*
+ * From the utimensat man page:
+ * On Linux, futimens() is a library function implemented on top of the
+ * utimensat() system call. To support this, the Linux utimensat() system
+ * call implements a nonstandard feature: if pathname is NULL, then the
+ * call modifies the timestamps of the file referred to by the file
+ * descriptor dirfd (which may refer to any type of file). Using this
+ * feature, the call futimens(fd, times) is implemented as:
+ *
+ *     utimensat(fd, NULL, times, 0);
+ *
+ * Some of the returns fail here. Linux allows the time to be modified if:
+ *
+ *   the caller must have write access to the file
+ * or
+ *   the caller's effective user ID must match the owner of the file
+ * or
+ *   the caller must have appropriate privileges
+ *
+ * We behave differently. We fail with EPERM if:
+ *
+ *   the calling process's euid has write access to the file but does not match
+ *   the owner of the file and the calling process does not have the
+ *   appropriate privileges
+ *
+ * This causes some of the LTP utimensat tests to fail because they expect an
+ * unprivileged process can update the time on a file it can write but does not
+ * own. There are also other LTP failures when the test uses attributes
+ * (e.g. chattr a+) and expects a failure, but we succeed.
+ */
+long
+lx_utimensat(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4)
+{
+	int fd = (int)p1;
+	const char *path = (const char *)p2;
+	const timespec_t *times = (const timespec_t *)p3;
+	timespec_t ts[2];
+	int flag = (int)p4;
+
+	if (times != NULL) {
+		if (uucopy((void *)p3, ts, sizeof (ts)) == -1)
+			return (-errno);
+
+		if (ts[0].tv_nsec == LX_UTIME_NOW)
+			ts[0].tv_nsec = UTIME_NOW;
+		if (ts[1].tv_nsec == LX_UTIME_NOW)
+			ts[1].tv_nsec = UTIME_NOW;
+
+		if (ts[0].tv_nsec == LX_UTIME_OMIT)
+			ts[0].tv_nsec = UTIME_OMIT;
+		if (ts[1].tv_nsec == LX_UTIME_OMIT)
+			ts[1].tv_nsec = UTIME_OMIT;
+
+		times = (const timespec_t *)ts;
+	}
+
+	if (flag == LX_AT_SYMLINK_NOFOLLOW)
+		flag = AT_SYMLINK_NOFOLLOW;
+
+	if (fd == LX_AT_FDCWD)
+		fd = AT_FDCWD;
+
+	if (path == NULL) {
+		return (futimens(fd, times) ? -errno : 0);
+	} else {
+		return (utimensat(fd, path, times, flag) ? -errno : 0);
+	}
+}
+
+/*
+ * Constructs an absolute path string in buf from the path of fd and the
+ * relative path string pointed to by "p1". This is required for emulating
+ * *at() system calls.
+ * Example:
+ *    If the path of fd is "/foo/bar" and path is "etc" the string returned is
+ *    "/foo/bar/etc", if the fd is a file fd then it fails with ENOTDIR.
+ *    If path is absolute then no modifcations are made to it when copied.
+ */
+static int
+getpathat(int fd, uintptr_t p1, char *outbuf, size_t outbuf_size)
+{
+	char pathbuf[MAXPATHLEN];
+	char fdpathbuf[MAXPATHLEN];
+	char *fdpath;
+	struct stat64 statbuf;
+
+	if (uucopystr((void *)p1, pathbuf, MAXPATHLEN) == -1)
+		return (-errno);
+
+	/* If the path is absolute then we can early out */
+	if ((pathbuf[0] == '/') || (fd == LX_AT_FDCWD)) {
+		(void) strlcpy(outbuf, pathbuf, outbuf_size);
+		return (0);
+	}
+
+	fdpath = lx_fd_to_path(fd, fdpathbuf, sizeof (fdpathbuf));
+	if (fdpath == NULL)
+		return (-EBADF);
+
+	if ((fstat64(fd, &statbuf) < 0))
+		return (-EBADF);
+
+	if (!S_ISDIR(statbuf.st_mode))
+		return (-ENOTDIR);
+
+	if (snprintf(outbuf, outbuf_size, "%s/%s", fdpath, pathbuf) >
+	    (outbuf_size-1))
+		return (-ENAMETOOLONG);
+
+	return (0);
+}
+
+long
+lx_mknodat(uintptr_t ext1, uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	int atfd = (int)ext1;
+	char pathbuf[MAXPATHLEN];
+	int ret;
+
+	ret = getpathat(atfd, p1, pathbuf, sizeof (pathbuf));
+	if (ret < 0)
+		return (ret);
+
+	return (lx_mknod((uintptr_t)pathbuf, p2, p3));
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/fork.c b/usr/src/lib/brand/lx/lx_brand/common/fork.c
new file mode 100644
index 0000000000..beb76fcf59
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/fork.c
@@ -0,0 +1,186 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <sys/fork.h>
+#include <sys/syscall.h>
+#include <sys/debug.h>
+#include <strings.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+
+/*
+ * fork() and vfork()
+ *
+ * These cannot be pass thru system calls because we need libc to do its own
+ * initialization or else bad things will happen (i.e. ending up with a bad
+ * schedctl page).  On Linux, there is no such thing as forkall(), so we use
+ * fork1() here.
+ */
+
+long
+lx_fork(void)
+{
+	int ret;
+
+	/*
+	 * Inform the in-kernel ptrace(2) subsystem that we are about to
+	 * emulate fork(2).
+	 */
+	lx_ptrace_clone_begin(LX_PTRACE_O_TRACEFORK, B_FALSE, 0);
+
+	/*
+	 * Suspend signal delivery, run the stack management prefork handler
+	 * and perform the fork operation.
+	 */
+	_sigoff();
+	lx_stack_prefork();
+	ret = fork1();
+	lx_stack_postfork();
+
+	switch (ret) {
+	case -1:
+		_sigon();
+		return (-errno);
+
+	case 0:
+		/*
+		 * Returning in the new child.  We must free the stacks and
+		 * thread-specific data objects for the threads we did not
+		 * duplicate; i.e. every other thread.
+		 */
+		lx_free_other_stacks();
+
+		lx_ptrace_stop_if_option(LX_PTRACE_O_TRACEFORK, B_TRUE, 0,
+		    NULL);
+
+		/*
+		 * Re-enable signal delivery in the child and return to the
+		 * new process.
+		 */
+		_sigon();
+		return (0);
+
+	default:
+		lx_ptrace_stop_if_option(LX_PTRACE_O_TRACEFORK, B_FALSE,
+		    (ulong_t)ret, NULL);
+
+		/*
+		 * Re-enable signal delivery in the parent and return from
+		 * the emulated system call.
+		 */
+		_sigon();
+		return (ret);
+	}
+}
+
+long
+lx_vfork(void)
+{
+	int ret;
+	lx_sighandlers_t saved;
+	ucontext_t vforkuc;
+	ucontext_t *ucp;
+	lx_tsd_t *lx_tsd = lx_get_tsd();
+
+	ucp = lx_syscall_regs();
+
+	/*
+	 * Inform the in-kernel ptrace(2) subsystem that we are about to
+	 * emulate vfork(2).
+	 */
+	lx_ptrace_clone_begin(LX_PTRACE_O_TRACEVFORK, B_FALSE, 0);
+
+	/*
+	 * Suspend signal delivery, run the stack management prefork handler
+	 * and perform the vfork operation. We use the same approach as in
+	 * lx_clone for signal handling and child return across vfork. See
+	 * the comments in lx_clone for more detail.
+	 */
+
+	lx_block_all_signals();
+	lx_stack_prefork();
+	lx_sighandlers_save(&saved);
+	lx_tsd->lxtsd_is_vforked++;
+	ret = vfork();
+	if (ret != 0) {
+		/* parent/error */
+		lx_tsd->lxtsd_is_vforked--;
+		lx_sighandlers_restore(&saved);
+	}
+
+	switch (ret) {
+	case -1:
+		lx_stack_postfork();
+		lx_unblock_all_signals();
+		return (-errno);
+
+	case 0:
+		/*
+		 * child
+		 * Unlike the regular fork case where the child also calls
+		 * lx_stack_postfork(), we only do that in the parent once it
+		 * resumes execution. This is required there to wake any other
+		 * threads in that process that are  blocked on the lock taken
+		 * in lx_stack_prefork().
+		 */
+		bcopy(ucp, &vforkuc, sizeof (vforkuc));
+		vforkuc.uc_brand_data[1] = (caddr_t)vforkuc.uc_brand_data[1] -
+		    LX_NATIVE_STACK_VFORK_GAP;
+		vforkuc.uc_link = NULL;
+
+		lx_debug("\tvfork native stack sp %p",
+		    vforkuc.uc_brand_data[1]);
+
+		lx_unblock_all_signals();
+
+		/* Stop for ptrace if required. */
+		lx_ptrace_stop_if_option(LX_PTRACE_O_TRACEVFORK, B_TRUE, 0,
+		    NULL);
+
+		/*
+		 * Return to the child via the specially constructed vfork(2)
+		 * context.
+		 */
+		LX_EMULATE_RETURN(&vforkuc, LX_SYS_vfork, 0, 0);
+		(void) syscall(SYS_brand, B_EMULATION_DONE, &vforkuc,
+		    LX_SYS_vfork, 0, 0);
+
+		VERIFY(0);
+		return (0);
+
+	default:
+		/* parent - child should have exited or exec-ed by now */
+		lx_stack_postfork();
+		lx_unblock_all_signals();
+		lx_ptrace_stop_if_option(LX_PTRACE_O_TRACEVFORK, B_FALSE,
+		    (ulong_t)ret, NULL);
+		return (ret);
+	}
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/lx_brand.c b/usr/src/lib/brand/lx/lx_brand/common/lx_brand.c
new file mode 100644
index 0000000000..653973a2db
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/lx_brand.c
@@ -0,0 +1,1709 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/syscall.h>
+#include <sys/utsname.h>
+#include <sys/inttypes.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <sys/fstyp.h>
+#include <sys/fsid.h>
+#include <sys/systm.h>
+#include <sys/auxv.h>
+#include <sys/frame.h>
+#include <zone.h>
+#include <sys/brand.h>
+#include <sys/epoll.h>
+#include <sys/stack.h>
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <unistd.h>
+#include <errno.h>
+#include <syslog.h>
+#include <signal.h>
+#include <fcntl.h>
+#include <synch.h>
+#include <libelf.h>
+#include <libgen.h>
+#include <pthread.h>
+#include <utime.h>
+#include <dirent.h>
+#include <ucontext.h>
+#include <libintl.h>
+#include <locale.h>
+
+#include <sys/lx_misc.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+#include <sys/lx_statfs.h>
+#include <sys/lx_signal.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_thread.h>
+#include <lx_auxv.h>
+#include <sys/lx_userhz.h>
+
+/*
+ * There is a block comment in "uts/common/brand/lx/os/lx_brand.c" that
+ * describes the functioning of the LX brand in some detail.
+ *
+ * *** Setting errno
+ *
+ * This emulation library is loaded onto a seperate link map from the
+ * application whose address space we're running in. The Linux libc errno is
+ * independent of our native libc errno. To pass back an error the emulation
+ * function should return -errno back to the Linux caller.
+ */
+
+char lx_release[LX_KERN_RELEASE_MAX];
+char lx_cmd_name[MAXNAMLEN];
+boolean_t lx_no_abort_handler = B_FALSE;
+
+/*
+ * Map a linux locale ending string to the solaris equivalent.
+ */
+struct lx_locale_ending {
+	const char	*linux_end;	/* linux ending string */
+	const char	*solaris_end;	/* to transform with this string */
+	int		le_size;	/* linux ending string length */
+	int		se_size;	/* solaris ending string length */
+};
+
+#define	l2s_locale(lname, sname) \
+	{(lname), (sname), sizeof ((lname)) - 1, sizeof ((sname)) - 1}
+
+#define	MAXLOCALENAMELEN	30
+#if !defined(TEXT_DOMAIN)		/* should be defined by cc -D */
+#define	TEXT_DOMAIN	"SYS_TEST"	/* Use this only if it wasn't */
+#endif
+
+/*
+ * Most syscalls return an int but some return something else, typically a
+ * ssize_t. This can be either an int or a long, depending on if we're compiled
+ * for 32-bit or 64-bit. To correctly propagate the -errno return code in the
+ * 64-bit case, we declare all emulation wrappers will return a long. Thus,
+ * when we save the return value into the %eax or %rax register and return to
+ * Linux, we will have the right size value in both the 32 and 64 bit cases.
+ */
+
+typedef long (*lx_syscall_handler_t)();
+
+static lx_syscall_handler_t lx_handlers[LX_NSYSCALLS + 1];
+
+static uintptr_t stack_size;
+
+#if defined(_LP64)
+long lx_fsb;
+long lx_fs;
+#endif
+int lx_install = 0;		/* install mode enabled if non-zero */
+int lx_verbose = 0;		/* verbose mode enabled if non-zero */
+int lx_debug_enabled = 0;	/* debugging output enabled if non-zero */
+
+pid_t zoneinit_pid;		/* zone init PID */
+
+thread_key_t lx_tsd_key;
+
+uint_t lx_hz_scale;		/* USER_HZ scaling factor */
+
+int
+uucopy_unsafe(const void *src, void *dst, size_t n)
+{
+	bcopy(src, dst, n);
+	return (0);
+}
+
+int
+uucopystr_unsafe(const void *src, void *dst, size_t n)
+{
+	(void) strncpy((char *)src, dst, n);
+	return (0);
+}
+
+static void
+i_lx_msg(int fd, char *msg, va_list ap)
+{
+	int	i;
+	char	buf[LX_MSG_MAXLEN];
+
+	/* LINTED [possible expansion issues] */
+	i = vsnprintf(buf, sizeof (buf), msg, ap);
+	buf[LX_MSG_MAXLEN - 1] = '\0';
+	if (i == -1)
+		return;
+
+	/* if debugging is enabled, send this message to debug output */
+	if (LX_DEBUG_ISENABLED)
+		lx_debug(buf);
+
+	if (fd == 2) {
+		/*
+		 * We let the user choose whether or not to see these
+		 * messages on the console.
+		 */
+		if (lx_verbose == 0)
+			return;
+	}
+
+	/* we retry in case of EINTR */
+	do {
+		i = write(fd, buf, strlen(buf));
+	} while ((i == -1) && (errno == EINTR));
+}
+
+/*PRINTFLIKE1*/
+void
+lx_err(char *msg, ...)
+{
+	va_list	ap;
+
+	assert(msg != NULL);
+
+	va_start(ap, msg);
+	i_lx_msg(STDERR_FILENO, msg, ap);
+	va_end(ap);
+}
+
+/*
+ * This is just a non-zero exit value which also isn't one that would allow
+ * us to easily detect if a branded process exited because of a recursive
+ * fatal error.
+ */
+#define	LX_ERR_FATAL	42
+
+/*
+ * Our own custom version of abort(), this routine will be used in place
+ * of the one located in libc.  The primary difference is that this version
+ * will first reset the signal handler for SIGABRT to SIG_DFL, ensuring the
+ * SIGABRT sent causes us to dump core and is not caught by a user program.
+ */
+void
+abort(void)
+{
+	static int aborting = 0;
+
+	struct sigaction sa;
+	sigset_t sigmask;
+
+	/* watch out for recursive calls to this function */
+	if (aborting != 0)
+		exit(LX_ERR_FATAL);
+
+	aborting = 1;
+
+	/*
+	 * Block all signals here to avoid taking any signals while exiting
+	 * in an effort to avoid any strange user interaction with our death.
+	 */
+	(void) sigfillset(&sigmask);
+	(void) sigprocmask(SIG_BLOCK, &sigmask, NULL);
+
+	/*
+	 * Our own version of abort(3C) that we know will never call
+	 * a user-installed SIGABRT handler first.  We WANT to die.
+	 *
+	 * Do this by resetting the handler to SIG_DFL, and releasing any
+	 * held SIGABRTs.
+	 *
+	 * If no SIGABRTs are pending, send ourselves one.
+	 *
+	 * The while loop is a bit of overkill, but abort(3C) does it to
+	 * assure it never returns so we will as well.
+	 */
+	(void) sigemptyset(&sa.sa_mask);
+	sa.sa_sigaction = SIG_DFL;
+	sa.sa_flags = 0;
+
+	for (;;) {
+		(void) sigaction(SIGABRT, &sa, NULL);
+		(void) sigrelse(SIGABRT);
+		(void) thr_kill(thr_self(), SIGABRT);
+	}
+
+	/*NOTREACHED*/
+}
+
+/*PRINTFLIKE1*/
+void
+lx_msg(char *msg, ...)
+{
+	va_list	ap;
+
+	assert(msg != NULL);
+	va_start(ap, msg);
+	i_lx_msg(STDOUT_FILENO, msg, ap);
+	va_end(ap);
+}
+
+/*PRINTFLIKE1*/
+void
+lx_err_fatal(char *msg, ...)
+{
+	va_list	ap;
+
+	assert(msg != NULL);
+
+	va_start(ap, msg);
+	i_lx_msg(STDERR_FILENO, msg, ap);
+	va_end(ap);
+	abort();
+}
+
+/*
+ * See if it is safe to alloca() sz bytes.  Return 1 for yes, 0 for no.
+ * We can't be certain we won't blow the stack since we don't know where it
+ * starts, but since the stack is only two pages we know any allocation bigger
+ * than that will blow the stack. Fortunately most allocations are small (e.g.
+ * 128 bytes).
+ */
+int
+lx_check_alloca(size_t sz)
+{
+	uintptr_t sp = (uintptr_t)&sz;
+	uintptr_t end = sp - sz;
+
+	return ((end < sp) && (sz < stack_size));
+}
+
+/*PRINTFLIKE1*/
+void
+lx_unsupported(char *msg, ...)
+{
+	va_list	ap;
+	char dmsg[256];
+	int lastc;
+
+	assert(msg != NULL);
+
+	/* make a brand call so we can easily dtrace unsupported actions */
+	va_start(ap, msg);
+	(void) vsnprintf(dmsg, sizeof (dmsg), msg, ap);
+	dmsg[255] = '\0';
+	lastc = strlen(dmsg) - 1;
+	if (dmsg[lastc] == '\n')
+		dmsg[lastc] = '\0';
+	(void) syscall(SYS_brand, B_UNSUPPORTED, dmsg);
+	va_end(ap);
+
+	/* send the msg to the error stream */
+	va_start(ap, msg);
+	i_lx_msg(STDERR_FILENO, msg, ap);
+	va_end(ap);
+}
+
+int lx_init(int argc, char *argv[], char *envp[]);
+
+lx_tsd_t *
+lx_get_tsd(void)
+{
+	int ret;
+	lx_tsd_t *lx_tsd;
+
+	if ((ret = thr_getspecific(lx_tsd_key, (void **)&lx_tsd)) != 0) {
+		lx_err_fatal("lx_get_tsd: unable to read "
+		    "thread-specific data: %s", strerror(ret));
+	}
+
+	assert(lx_tsd != 0);
+
+	return (lx_tsd);
+}
+
+/*
+ * This function is called from the kernel like a signal handler.  Each
+ * function call is a request to provide emulation for a system call that, on
+ * illumos, is implemented in userland.  The system call number selection and
+ * argument parsing have already been done by the kernel.
+ */
+void
+lx_emulate(ucontext_t *ucp, int syscall_num, uintptr_t *args)
+{
+	long emu_ret;
+	int emu_errno = 0;
+
+	LX_EMULATE_ENTER(ucp, syscall_num, args);
+	lx_debug("lx_emulate(%p, %d, [%p, %p, %p, %p, %p, %p])\n",
+	    ucp, syscall_num, args[0], args[1], args[2], args[3], args[4],
+	    args[5]);
+
+	/*
+	 * The kernel should have saved us a context that will not restore the
+	 * previous signal mask.  Some emulated system calls alter the signal
+	 * mask; restoring it after the emulation would cancel that out.
+	 */
+	assert(!(ucp->uc_flags & UC_SIGMASK));
+
+	/*
+	 * The kernel ensures that the syscall_num is sane; Use it as is.
+	 */
+	assert(syscall_num >= 0);
+	assert(syscall_num < (sizeof (lx_handlers) / sizeof (lx_handlers[0])));
+	if (lx_handlers[syscall_num] == NULL) {
+		lx_err_fatal("lx_emulate: kernel sent us a call we cannot "
+		    "emulate (%d)", syscall_num);
+	}
+
+	/*
+	 * Call our handler function:
+	 */
+	emu_ret = lx_handlers[syscall_num](args[0], args[1], args[2], args[3],
+	    args[4], args[5]);
+
+	/*
+	 * If the return value is between -1 and -4095 then it's an errno.
+	 * The kernel will translate it to the Linux equivalent for us.
+	 */
+	if (emu_ret < 0 && emu_ret > -4096) {
+		emu_errno = (int)-emu_ret;
+	}
+
+	/*
+	 * Return to the context we were passed
+	 */
+	LX_EMULATE_RETURN(ucp, syscall_num, emu_ret, emu_errno);
+	lx_debug("\tlx_emulate(%d) done (ret %ld / 0x%p ; errno %d)",
+	    syscall_num, emu_ret, emu_ret, emu_errno);
+	(void) syscall(SYS_brand, B_EMULATION_DONE, ucp, syscall_num, emu_ret,
+	    emu_errno);
+
+	assert(!"cannot be returned here");
+}
+
+static void
+lx_close_fh(FILE *file)
+{
+	int fd, fd_new;
+
+	if (file == NULL)
+		return;
+
+	if ((fd = fileno(file)) < 0)
+		return;
+
+	fd_new = dup(fd);
+	if (fd_new == -1)
+		return;
+
+	(void) fclose(file);
+	(void) dup2(fd_new, fd);
+	(void) close(fd_new);
+}
+
+
+extern int set_l10n_alternate_root(char *path);
+
+/*
+ * Initialize the thread specific data for this thread.
+ */
+void
+lx_init_tsd(lx_tsd_t *lxtsd)
+{
+	int err;
+
+	bzero(lxtsd, sizeof (*lxtsd));
+	lxtsd->lxtsd_exit = LX_ET_NONE;
+
+	/*
+	 * The Linux alternate signal stack is initially disabled:
+	 */
+	lxtsd->lxtsd_sigaltstack.ss_flags = LX_SS_DISABLE;
+
+	/*
+	 * Create a per-thread exit context from the current register and
+	 * native/brand stack state.  Replace the saved program counter value
+	 * with the address of lx_exit_common(); we wish to revector there when
+	 * the thread or process is exiting.
+	 */
+	if (getcontext(&lxtsd->lxtsd_exit_context) != 0) {
+		lx_err_fatal("Unable to initialize thread-specific exit "
+		    "context: %s", strerror(errno));
+	}
+	LX_REG(&lxtsd->lxtsd_exit_context, REG_PC) = (uintptr_t)lx_exit_common;
+
+	/*
+	 * Align the stack pointer and clear the frame pointer.
+	 */
+	LX_REG(&lxtsd->lxtsd_exit_context, REG_FP) = 0;
+	LX_REG(&lxtsd->lxtsd_exit_context, REG_SP) &= ~(STACK_ALIGN - 1UL);
+#if defined(_LP64)
+#if (STACK_ENTRY_ALIGN != 8) && (STACK_ALIGN != 16)
+#error "lx_init_tsd: unexpected STACK_[ENTRY_]ALIGN values"
+#endif
+	/*
+	 * The AMD64 ABI requires that, on entry to a function, the stack
+	 * pointer must be 8-byte aligned, but _not_ 16-byte aligned.  When
+	 * the frame pointer is pushed, the alignment will then be correct.
+	 */
+	LX_REG(&lxtsd->lxtsd_exit_context, REG_SP) -= STACK_ENTRY_ALIGN;
+#endif
+
+	/*
+	 * Block all signals in the exit context to avoid taking any signals
+	 * (to the degree possible) while exiting.
+	 */
+	(void) sigfillset(&lxtsd->lxtsd_exit_context.uc_sigmask);
+
+	if ((err = thr_setspecific(lx_tsd_key, lxtsd)) != 0) {
+		lx_err_fatal("Unable to initialize thread-specific data: %s",
+		    strerror(err));
+	}
+}
+
+void
+lx_jump_to_linux(ucontext_t *ucp)
+{
+	extern void setcontext_sigmask(ucontext_t *);
+
+	/*
+	 * Call into this private libc interface to allow us to use only the
+	 * signal mask handling part of a regular setcontext() operation.
+	 */
+	setcontext_sigmask(ucp);
+
+	if (syscall(SYS_brand, B_JUMP_TO_LINUX, ucp) != 0) {
+		lx_err_fatal("B_JUMP_TO_LINUX failed: %s", strerror(errno));
+	}
+
+	/*
+	 * This system call should not return.
+	 */
+	abort();
+}
+
+static void
+lx_start(uintptr_t sp, uintptr_t entry)
+{
+	ucontext_t jump_uc;
+
+	if (getcontext(&jump_uc) != 0) {
+		lx_err_fatal("Unable to getcontext for program start: %s",
+		    strerror(errno));
+	}
+
+	/*
+	 * We want to load the general registers from this
+	 * context, and switch to the BRAND stack.
+	 */
+	jump_uc.uc_flags = UC_CPU;
+	jump_uc.uc_brand_data[0] = (void *)LX_UC_STACK_BRAND;
+
+	LX_REG(&jump_uc, REG_FP) = NULL;
+	LX_REG(&jump_uc, REG_SP) = sp;
+	LX_REG(&jump_uc, REG_PC) = entry;
+
+	/*
+	 * The AMD64 ABI states that at process entry, %rdx contains "a
+	 * function pointer that the application should register with
+	 * atexit()".  This behavior has been observed in statically linked
+	 * i386 programs as well.  As a precaution, all of the registers are
+	 * zeroed prior to initial execution.
+	 */
+#if defined(_LP64)
+	LX_REG(&jump_uc, REG_RAX) = NULL;
+	LX_REG(&jump_uc, REG_RCX) = NULL;
+	LX_REG(&jump_uc, REG_RDX) = NULL;
+	LX_REG(&jump_uc, REG_RBX) = NULL;
+	LX_REG(&jump_uc, REG_RBP) = NULL;
+	LX_REG(&jump_uc, REG_RSI) = NULL;
+	LX_REG(&jump_uc, REG_RDI) = NULL;
+	LX_REG(&jump_uc, REG_R8) = NULL;
+	LX_REG(&jump_uc, REG_R9) = NULL;
+	LX_REG(&jump_uc, REG_R10) = NULL;
+	LX_REG(&jump_uc, REG_R11) = NULL;
+	LX_REG(&jump_uc, REG_R12) = NULL;
+	LX_REG(&jump_uc, REG_R13) = NULL;
+	LX_REG(&jump_uc, REG_R14) = NULL;
+	LX_REG(&jump_uc, REG_R15) = NULL;
+#else
+	LX_REG(&jump_uc, EAX) = NULL;
+	LX_REG(&jump_uc, ECX) = NULL;
+	LX_REG(&jump_uc, EDX) = NULL;
+	LX_REG(&jump_uc, EBX) = NULL;
+	LX_REG(&jump_uc, EBP) = NULL;
+	LX_REG(&jump_uc, ESI) = NULL;
+	LX_REG(&jump_uc, EDI) = NULL;
+#endif /* defined(_LP64) */
+
+	lx_debug("starting Linux program sp %p ldentry %p", sp, entry);
+	lx_jump_to_linux(&jump_uc);
+}
+
+enum lx_env_setting {
+	LXES_INSTALL = 0,
+	LXES_VERBOSE,
+	LXES_DTRACE,
+	LXES_DEBUG,
+	LXES_DEBUG_FILE,
+	LXES_NO_ABORT_HANDLER,
+	LXES_RELEASE,
+	LXES_VERSION,
+	LXES_STRICT,
+	LXES_LIMIT
+};
+
+static void
+lx_parse_env(char *envp[], char *settings[])
+{
+	int i, j;
+	char *env;
+
+	typedef struct lx_env_entry {
+		char *lee_name;
+		int lee_len;
+		int lee_index;
+	} lx_env_entry_t;
+#define	LX_ENV_ENTRY(name, idx) { name, (sizeof (name)) - 1, idx }
+	static const lx_env_entry_t lx_env_entries[] = {
+		LX_ENV_ENTRY("LX_INSTALL", LXES_INSTALL),
+		LX_ENV_ENTRY("LX_VERBOSE", LXES_VERBOSE),
+		LX_ENV_ENTRY("LX_DTRACE", LXES_DTRACE),
+		LX_ENV_ENTRY("LX_DEBUG", LXES_DEBUG),
+		LX_ENV_ENTRY("LX_DEBUG_FILE", LXES_DEBUG_FILE),
+		LX_ENV_ENTRY("LX_NO_ABORT_HANDLER", LXES_NO_ABORT_HANDLER),
+		LX_ENV_ENTRY("LX_RELEASE", LXES_RELEASE),
+		LX_ENV_ENTRY("LX_VERSION", LXES_VERSION),
+		LX_ENV_ENTRY("LX_STRICT", LXES_STRICT)
+	};
+#define	LX_ENV_ENTRY_COUNT	\
+	(sizeof (lx_env_entries) / sizeof (lx_env_entries[0]))
+
+	for (i = 0; (env = envp[i]) != NULL; i++) {
+		if (env[0] != 'L' || env[1] != 'X' || env[2] != '_')
+			continue;
+		for (j = 0; j < LX_ENV_ENTRY_COUNT; j++) {
+			const lx_env_entry_t *lee = &lx_env_entries[j];
+
+			if (strncmp(env, lee->lee_name, lee->lee_len) != 0 ||
+			    env[lee->lee_len] != '=')
+				continue;
+			settings[lee->lee_index] = &env[lee->lee_len + 1];
+			break;
+		}
+	}
+}
+
+/*ARGSUSED*/
+int
+lx_init(int argc, char *argv[], char *envp[])
+{
+	auxv_t		*ap, *oap;
+	long		*p;
+	int		err;
+	lx_elf_data_t	edp;
+	lx_brand_registration_t reg;
+	lx_tsd_t	*lxtsd;
+	char		*lx_settings[LXES_LIMIT];
+
+	bzero(&reg, sizeof (reg));
+	stack_size = 2 * sysconf(_SC_PAGESIZE);
+
+	lx_hz_scale = sysconf(_SC_CLK_TCK) / LX_USERHZ;
+
+	/*
+	 * We need to shutdown all libc stdio.  libc stdio normally goes to
+	 * file descriptors, but since we're actually part of a linux
+	 * process we don't own these file descriptors and we can't make
+	 * any assumptions about their state.
+	 */
+	lx_close_fh(stdin);
+	lx_close_fh(stdout);
+	lx_close_fh(stderr);
+
+	/*
+	 * Parse LX-related settings out of the environment array.
+	 * This is done manually instead of utilizing libc's getenv() to avoid
+	 * triggering any env-cleaning routines which are present.
+	 */
+	bzero(lx_settings, sizeof (lx_settings));
+	lx_parse_env(envp, lx_settings);
+
+	/*
+	 * Setting LX_NO_ABORT_HANDLER in the environment will prevent the
+	 * emulated Linux program from modifying the signal handling
+	 * disposition for SIGSEGV or SIGABRT.  It is useful for debugging
+	 * programs which fall over themselves to prevent useful core files
+	 * being generated.
+	 */
+	lx_no_abort_handler = (lx_settings[LXES_NO_ABORT_HANDLER] != NULL);
+
+	lx_debug_init(lx_settings[LXES_DTRACE] != NULL,
+	    lx_settings[LXES_DEBUG] != NULL,
+	    lx_settings[LXES_DEBUG_FILE]);
+
+	if (lx_settings[LXES_RELEASE] == NULL) {
+		if (zone_getattr(getzoneid(), LX_ATTR_KERN_RELEASE,
+		    lx_release, sizeof (lx_release)) <= 0)
+			(void) strlcpy(lx_release, "2.4.21",
+			    LX_KERN_RELEASE_MAX);
+	} else {
+		(void) strlcpy(lx_release, lx_settings[LXES_RELEASE],
+		    LX_KERN_RELEASE_MAX);
+	}
+
+	if (lx_settings[LXES_RELEASE] != NULL ||
+	    lx_settings[LXES_VERSION] != NULL) {
+		if (syscall(SYS_brand, B_OVERRIDE_KERN_VER,
+		    lx_settings[LXES_RELEASE],
+		    lx_settings[LXES_VERSION]) != 0) {
+			lx_debug("failed to override kernel release/version");
+		}
+	}
+	lx_debug("lx_release: %s\n", lx_release);
+
+
+	/*
+	 * Should we kill an application that attempts an unimplemented
+	 * system call?
+	 */
+	if (lx_settings[LXES_STRICT] != NULL) {
+		reg.lxbr_flags |= LX_PROC_STRICT_MODE;
+		lx_debug("STRICT mode enabled.\n");
+	}
+
+	/*
+	 * Are we in install mode?
+	 */
+	if (lx_settings[LXES_INSTALL] != NULL) {
+		reg.lxbr_flags |= LX_PROC_INSTALL_MODE;
+		lx_install = 1;
+		lx_debug("INSTALL mode enabled.\n");
+	}
+
+	(void) strlcpy(lx_cmd_name, basename(argv[0]), sizeof (lx_cmd_name));
+	lx_debug("executing linux process: %s", argv[0]);
+	lx_debug("branding myself and setting handler to 0x%p",
+	    (void *)lx_emulate);
+
+	reg.lxbr_version = LX_VERSION;
+	reg.lxbr_handler = (void *)&lx_emulate;
+
+	/*
+	 * Register the address of the user-space handler with the lx brand
+	 * module. As a side-effect this leaves the thread in native syscall
+	 * mode so that it's ok to continue to make syscalls during setup. We
+	 * need to switch to Linux mode at the end of initialization.
+	 */
+	if (syscall(SYS_brand, B_REGISTER, &reg))
+		lx_err_fatal("failed to brand the process");
+
+	/* Look up the PID that serves as init for this zone */
+	if ((err = lx_lpid_to_spid(1, &zoneinit_pid)) < 0)
+		lx_err_fatal("Unable to find PID for zone init process: %s",
+		    strerror(err));
+
+	/*
+	 * Upload data about the lx executable from the kernel.
+	 */
+	if (syscall(SYS_brand, B_ELFDATA, (void *)&edp))
+		lx_err_fatal("failed to get required ELF data from the kernel");
+
+	if (lx_statfs_init() != 0)
+		lx_err_fatal("failed to setup the statfs translator");
+
+	/*
+	 * Find the aux vector on the stack.
+	 */
+	p = (long *)envp;
+	while (*p != NULL)
+		p++;
+
+	/*
+	 * Now 'p' points at the NULL word immediately following the environ
+	 * pointers.  The list of auxv entries _should_ immediately follow.
+	 * If anything (such as the native linker or libc) has removed entries
+	 * from the environment array, extra NULLs will be present.
+	 *
+	 * The brand library takes care to avoid such behavior (via the
+	 * lx_parse_env routine above) but a belt-and-suspenders approach is
+	 * taken for safety.
+	 *
+	 * The address following the NULL spacer is recorded as the target for
+	 * auxv translation and any addition NULLs following it are skipped
+	 * until the first auxv entry is located.
+	 */
+	p++;
+	oap = (auxv_t *)p;
+	while (*p == NULL)
+		p++;
+	ap = (auxv_t *)p;
+
+	/*
+	 * Translate auxv entries to Linux equivalents.
+	 */
+	for (; ap->a_type != AT_NULL; ap++) {
+		if (lx_auxv_stol(ap, oap, &edp) == 0) {
+			/*
+			 * Copy only auxv entries which Linux programs will
+			 * understand. Other entries will be skipped.
+			 */
+			oap++;
+		}
+	}
+
+	/* NULL out skipped entries */
+	if (oap < ap) {
+		bzero(oap, (uintptr_t)ap - (uintptr_t)oap);
+	}
+
+	/* Setup signal handler information. */
+	if (lx_siginit()) {
+		lx_err_fatal("failed to initialize lx signals for the "
+		    "branded process");
+	}
+
+	/* Setup thread-specific data area for managing linux threads. */
+	if ((err = thr_keycreate(&lx_tsd_key, NULL)) != 0) {
+		lx_err_fatal("thr_keycreate(lx_tsd_key) failed: %s",
+		    strerror(err));
+	}
+
+	lx_debug("thr_keycreate created lx_tsd_key (%d)", lx_tsd_key);
+
+	/*
+	 * Initialize the thread specific data for this thread.
+	 */
+	if ((lxtsd = malloc(sizeof (*lxtsd))) == NULL) {
+		lx_err_fatal("failed to allocate tsd for main thread: %s",
+		    strerror(errno));
+	}
+	lx_debug("lx tsd allocated @ %p", lxtsd);
+	lx_init_tsd(lxtsd);
+
+	/*
+	 * Allocate the brand emulation stack for the main process thread.
+	 * Register the thread-specific data structure with the stack list so
+	 * that it may be freed at thread exit or fork(2).
+	 */
+	lx_install_stack(NULL, 0, lxtsd);
+
+	/*
+	 * The brand linker expects the stack pointer to point to
+	 * "argc", which is just before &argv[0].
+	 */
+	lx_start((uintptr_t)argv - sizeof (void *), edp.ed_ldentry);
+
+	/*NOTREACHED*/
+	abort();
+	return (0);
+}
+
+/*
+ * We "return" to this function via a context hand-crafted by
+ * "lx_init_tsd()"; see that function for more detail.
+ *
+ * NOTE: Our call frame is on the main thread stack, not the alternate native
+ * stack -- it is safe to release the latter here.  The frame does not have a
+ * valid return address, so this function MUST NOT return.
+ */
+void
+lx_exit_common(void)
+{
+	lx_tsd_t *lxtsd = lx_get_tsd();
+	int ev = (0xff & lxtsd->lxtsd_exit_status);
+
+	switch (lxtsd->lxtsd_exit) {
+	case LX_ET_EXIT:
+		lx_debug("lx_exit_common(LX_ET_EXIT, %d, %d)\n", thr_self(),
+		    ev);
+
+		if (thr_self() == 1) {
+			/*
+			 * Modern versions of glibc will call the exit_group
+			 * syscall when exit(3) is called, but if the primary
+			 * thread explicitly invokes the exit syscall we now
+			 * need to exit with the proper value.
+			 */
+			exit(ev);
+		} else {
+			/*
+			 * If the thread is exiting, but not the entire process,
+			 * we must free the stack we allocated for usermode
+			 * emulation. This is safe to do here because the
+			 * setcontext() put us back on the BRAND stack for this
+			 * process.  This function also frees the
+			 * thread-specific data object for this thread.
+			 */
+			lx_free_stack();
+
+			/*
+			 * The native thread return value is never seen so we
+			 * pass NULL.
+			 */
+			thr_exit(NULL);
+		}
+		break;
+
+	case LX_ET_EXIT_GROUP:
+		lx_debug("lx_exit_common(LX_ET_EXIT_GROUP, %d)\n", ev);
+		exit(ev);
+		break;
+
+	default:
+		abort();
+	}
+
+	abort();
+}
+
+const ucontext_t *
+lx_find_brand_uc(void)
+{
+	ucontext_t *ucp = NULL;
+
+	/*
+	 * Ask for the current emulation (or signal handling) ucontext_t...
+	 */
+	assert(syscall(SYS_brand, B_GET_CURRENT_CONTEXT, &ucp) == 0);
+
+	for (;;) {
+		uintptr_t flags;
+
+		lx_debug("lx_find_brand_uc: inspect ucp %p...\n", ucp);
+		assert(ucp != NULL);
+
+		flags = (uintptr_t)ucp->uc_brand_data[0];
+
+		if (flags & LX_UC_STACK_BRAND) {
+			lx_debug("lx_find_brand_uc: ucp %p\n", ucp);
+
+			return (ucp);
+		}
+
+		lx_debug("lx_find_brand_uc: skip non-BRAND ucp %p\n", ucp);
+
+		/*
+		 * Walk up the context chain to find the most recently stored
+		 * brand register state.
+		 */
+		ucp = ucp->uc_link;
+	}
+}
+
+uintptr_t
+lx_find_brand_sp(void)
+{
+	const ucontext_t *ucp = lx_find_brand_uc();
+	uintptr_t sp = LX_REG(ucp, REG_SP);
+
+	lx_debug("lx_find_brand_sp: ucp %p sp %p\n", ucp, sp);
+
+	return (sp);
+}
+
+ucontext_t *
+lx_syscall_regs(void)
+{
+	ucontext_t *ucp = NULL;
+	uintptr_t flags;
+
+	/*
+	 * Ask for the current emulation (or signal handling) ucontext_t...
+	 */
+	assert(syscall(SYS_brand, B_GET_CURRENT_CONTEXT, &ucp) == 0);
+	assert(ucp != NULL);
+
+	/*
+	 * Use of the lx_syscall_regs() function implies that the topmost (i.e.
+	 * current) context is for a system call emulation request from the
+	 * kernel, rather than a signal handling frame.
+	 */
+	flags = (uintptr_t)ucp->uc_brand_data[0];
+	assert(flags & LX_UC_FRAME_IS_SYSCALL);
+
+	lx_debug("lx_syscall_regs: ucp %p\n", ucp);
+
+	return (ucp);
+}
+
+int
+lx_lpid_to_spair(pid_t lpid, pid_t *spid, lwpid_t *slwp)
+{
+	pid_t pid;
+	lwpid_t tid;
+
+	if (lpid == 0) {
+		pid = getpid();
+		tid = thr_self();
+	} else {
+		if (syscall(SYS_brand, B_LPID_TO_SPAIR, lpid, &pid, &tid) < 0)
+			return (-errno);
+
+		/*
+		 * If the returned pid is -1, that indicates we tried to
+		 * look up the PID for init, but that process no longer
+		 * exists.
+		 */
+		if (pid == -1)
+			return (-ESRCH);
+	}
+
+	if (uucopy(&pid, spid, sizeof (pid_t)) != 0)
+		return (-errno);
+
+	if (uucopy(&tid, slwp, sizeof (lwpid_t)) != 0)
+		return (-errno);
+
+	return (0);
+}
+
+int
+lx_lpid_to_spid(pid_t lpid, pid_t *spid)
+{
+	lwpid_t slwp;
+
+	return (lx_lpid_to_spair(lpid, spid, &slwp));
+}
+
+char *
+lx_fd_to_path(int fd, char *buf, int buf_size)
+{
+	char	path_proc[MAXPATHLEN];
+	pid_t	pid;
+	int	n;
+
+	assert((buf != NULL) && (buf_size >= 0));
+
+	if (fd < 0)
+		return (NULL);
+
+	if ((pid = getpid()) == -1)
+		return (NULL);
+
+	(void) snprintf(path_proc, MAXPATHLEN,
+	    "/native/proc/%d/path/%d", pid, fd);
+
+	if ((n = readlink(path_proc, buf, buf_size - 1)) == -1)
+		return (NULL);
+	buf[n] = '\0';
+
+	return (buf);
+}
+
+#if defined(_LP64)
+/* The following is the 64-bit syscall table */
+
+static lx_syscall_handler_t lx_handlers[] = {
+	NULL,				/*   0: read */
+	NULL,				/*   1: write */
+	NULL,				/*   2: open */
+	NULL,				/*   3: close */
+	NULL,				/*   4: stat */
+	NULL,				/*   5: fstat */
+	NULL,				/*   6: lstat */
+	NULL,				/*   7: poll */
+	NULL,				/*   8: lseek */
+	NULL,				/*   9: mmap */
+	NULL,				/*  10: mprotect */
+	NULL,				/*  11: munmap */
+	NULL,				/*  12: brk */
+	lx_rt_sigaction,		/*  13: rt_sigaction */
+	lx_rt_sigprocmask,		/*  14: rt_sigprocmask */
+	lx_rt_sigreturn,		/*  15: rt_sigreturn */
+	NULL,				/*  16: ioctl */
+	NULL,				/*  17: pread64 */
+	NULL,				/*  18: pwrite64 */
+	NULL,				/*  19: readv */
+	NULL,				/*  20: writev */
+	NULL,				/*  21: access */
+	NULL,				/*  22: pipe */
+	NULL,				/*  23: select */
+	NULL,				/*  24: sched_yield */
+	NULL,				/*  25: mremap */
+	NULL,				/*  26: msync */
+	NULL,				/*  27: mincore */
+	NULL,				/*  28: madvise */
+	lx_shmget,			/*  29: shmget */
+	lx_shmat,			/*  30: shmat */
+	lx_shmctl,			/*  31: shmctl */
+	NULL,				/*  32: dup */
+	NULL,				/*  33: dup2 */
+	NULL,				/*  34: pause */
+	NULL,				/*  35: nanosleep */
+	NULL,				/*  36: getitimer */
+	NULL,				/*  37: alarm */
+	lx_setitimer,			/*  38: setitimer */
+	NULL,				/*  39: getpid */
+	lx_sendfile64,			/*  40: sendfile */
+	NULL,				/*  41: socket */
+	NULL,				/*  42: connect */
+	NULL,				/*  43: accept */
+	NULL,				/*  44: sendto */
+	NULL,				/*  45: recvfrom */
+	NULL,				/*  46: sendmsg */
+	NULL,				/*  47: recvmsg */
+	NULL,				/*  48: shutdown */
+	NULL,				/*  49: bind */
+	NULL,				/*  50: listen */
+	NULL,				/*  51: getsockname */
+	NULL,				/*  52: getpeername */
+	NULL,				/*  53: socketpair */
+	NULL,				/*  54: setsockopt */
+	NULL,				/*  55: getsockopt */
+	lx_clone,			/*  56: clone */
+	lx_fork,			/*  57: fork */
+	lx_vfork,			/*  58: vfork */
+	lx_execve,			/*  59: execve */
+	lx_exit,			/*  60: exit */
+	NULL,				/*  61: wait4 */
+	NULL,				/*  62: kill */
+	NULL,				/*  63: uname */
+	lx_semget,			/*  64: semget */
+	lx_semop,			/*  65: semop */
+	lx_semctl,			/*  66: semctl */
+	lx_shmdt,			/*  67: shmdt */
+	lx_msgget,			/*  68: msgget */
+	lx_msgsnd,			/*  69: msgsnd */
+	lx_msgrcv,			/*  70: msgrcv */
+	lx_msgctl,			/*  71: msgctl */
+	NULL,				/*  72: fcntl */
+	NULL,				/*  73: flock */
+	lx_fsync,			/*  74: fsync */
+	lx_fdatasync,			/*  75: fdatasync */
+	lx_truncate,			/*  76: truncate */
+	lx_ftruncate,			/*  77: ftruncate */
+	NULL,				/*  78: getdents */
+	NULL,				/*  79: getcwd */
+	NULL,				/*  80: chdir */
+	NULL,				/*  81: fchdir */
+	NULL,				/*  82: rename */
+	NULL,				/*  83: mkdir */
+	lx_rmdir,			/*  84: rmdir */
+	NULL,				/*  85: creat */
+	NULL,				/*  86: link */
+	NULL,				/*  87: unlink */
+	NULL,				/*  88: symlink */
+	NULL,				/*  89: readlink */
+	NULL,				/*  90: chmod */
+	NULL,				/*  91: fchmod */
+	NULL,				/*  92: chown */
+	NULL,				/*  93: fchown */
+	NULL,				/*  94: lchown */
+	NULL,				/*  95: umask */
+	NULL,				/*  96: gettimeofday */
+	NULL,				/*  97: getrlimit */
+	NULL,				/*  98: getrusage */
+	NULL,				/*  99: sysinfo */
+	NULL,				/* 100: times */
+	NULL,				/* 101: ptrace */
+	NULL,				/* 102: getuid */
+	NULL,				/* 103: syslog */
+	NULL,				/* 104: getgid */
+	NULL,				/* 105: setuid */
+	NULL,				/* 106: setgid */
+	NULL,				/* 107: geteuid */
+	NULL,				/* 108: getegid */
+	NULL,				/* 109: setpgid */
+	NULL,				/* 110: getppid */
+	NULL,				/* 111: getpgrp */
+	NULL,				/* 112: setsid */
+	NULL,				/* 113: setreuid */
+	NULL,				/* 114: setregid */
+	lx_getgroups,			/* 115: getgroups */
+	lx_setgroups,			/* 116: setgroups */
+	NULL,				/* 117: setresuid */
+	NULL,				/* 118: getresuid */
+	NULL,				/* 119: setresgid */
+	NULL,				/* 120: getresgid */
+	NULL,				/* 121: getpgid */
+	NULL,				/* 122: setfsuid */
+	NULL,				/* 123: setfsgid */
+	NULL,				/* 124: getsid */
+	lx_capget,			/* 125: capget */
+	lx_capset,			/* 126: capset */
+	lx_rt_sigpending,		/* 127: rt_sigpending */
+	lx_rt_sigtimedwait,		/* 128: rt_sigtimedwait */
+	lx_rt_sigqueueinfo,		/* 129: rt_sigqueueinfo */
+	lx_rt_sigsuspend,		/* 130: rt_sigsuspend */
+	lx_sigaltstack,			/* 131: sigaltstack */
+	lx_utime,			/* 132: utime */
+	lx_mknod,			/* 133: mknod */
+	NULL,				/* 134: uselib */
+	NULL,				/* 135: personality */
+	NULL,				/* 136: ustat */
+	lx_statfs,			/* 137: statfs */
+	lx_fstatfs,			/* 138: fstatfs */
+	lx_sysfs,			/* 139: sysfs */
+	NULL,				/* 140: getpriority */
+	NULL,				/* 141: setpriority */
+	NULL,				/* 142: sched_setparam */
+	NULL,				/* 143: sched_getparam */
+	NULL,				/* 144: sched_setscheduler */
+	NULL,				/* 145: sched_getscheduler */
+	NULL,				/* 146: sched_get_priority_max */
+	NULL,				/* 147: sched_get_priority_min */
+	NULL,				/* 148: sched_rr_get_interval */
+	NULL,				/* 149: mlock */
+	NULL,				/* 150: munlock */
+	NULL,				/* 151: mlockall */
+	NULL,				/* 152: munlockall */
+	NULL,				/* 153: vhangup */
+	NULL,				/* 154: modify_ldt */
+	NULL,				/* 155: pivot_root */
+	lx_sysctl,			/* 156: sysctl */
+	NULL,				/* 157: prctl */
+	NULL,				/* 158: arch_prctl */
+	lx_adjtimex,			/* 159: adjtimex */
+	NULL,				/* 160: setrlimit */
+	NULL,				/* 161: chroot */
+	NULL,				/* 162: sync */
+	NULL,				/* 163: acct */
+	lx_settimeofday,		/* 164: settimeofday */
+	lx_mount,			/* 165: mount */
+	NULL,				/* 166: umount2 */
+	NULL,				/* 167: swapon */
+	NULL,				/* 168: swapoff */
+	NULL,				/* 169: reboot */
+	NULL,				/* 170: sethostname */
+	NULL,				/* 171: setdomainname */
+	NULL,				/* 172: iopl */
+	NULL,				/* 173: ioperm */
+	NULL,				/* 174: create_module */
+	NULL,				/* 175: init_module */
+	NULL,				/* 176: delete_module */
+	NULL,				/* 177: get_kernel_syms */
+	lx_query_module,		/* 178: query_module */
+	NULL,				/* 179: quotactl */
+	NULL,				/* 180: nfsservctl */
+	NULL,				/* 181: getpmsg */
+	NULL,				/* 182: putpmsg */
+	NULL,				/* 183: afs_syscall */
+	NULL,				/* 184: tux */
+	NULL,				/* 185: security */
+	NULL,				/* 186: gettid */
+	NULL,				/* 187: readahead */
+	NULL,				/* 188: setxattr */
+	NULL,				/* 189: lsetxattr */
+	NULL,				/* 190: fsetxattr */
+	NULL,				/* 191: getxattr */
+	NULL,				/* 192: lgetxattr */
+	NULL,				/* 193: fgetxattr */
+	NULL,				/* 194: listxattr */
+	NULL,				/* 195: llistxattr */
+	NULL,				/* 196: flistxattr */
+	NULL,				/* 197: removexattr */
+	NULL,				/* 198: lremovexattr */
+	NULL,				/* 199: fremovexattr */
+	NULL,				/* 200: tkill */
+	NULL,				/* 201: time */
+	NULL,				/* 202: futex */
+	NULL,				/* 203: sched_setaffinity */
+	NULL,				/* 204: sched_getaffinity */
+	NULL,				/* 205: set_thread_area */
+	NULL,				/* 206: io_setup */
+	NULL,				/* 207: io_destroy */
+	NULL,				/* 208: io_getevents */
+	NULL,				/* 209: io_submit */
+	NULL,				/* 210: io_cancel */
+	NULL,				/* 211: get_thread_area */
+	NULL,				/* 212: lookup_dcookie */
+	NULL,				/* 213: epoll_create */
+	NULL,				/* 214: epoll_ctl_old */
+	NULL,				/* 215: epoll_wait_old */
+	NULL,				/* 216: remap_file_pages */
+	NULL,				/* 217: getdents64 */
+	NULL,				/* 218: set_tid_address */
+	NULL,				/* 219: restart_syscall */
+	lx_semtimedop,			/* 220: semtimedop */
+	NULL,				/* 221: fadvise64 */
+	NULL,				/* 222: timer_create */
+	lx_timer_settime,		/* 223: timer_settime */
+	lx_timer_gettime,		/* 224: timer_gettime */
+	lx_timer_getoverrun,		/* 225: timer_getoverrun */
+	lx_timer_delete,		/* 226: timer_delete */
+	NULL,				/* 227: clock_settime */
+	NULL,				/* 228: clock_gettime */
+	NULL,				/* 229: clock_getres */
+	lx_clock_nanosleep,		/* 230: clock_nanosleep */
+	lx_group_exit,			/* 231: exit_group */
+	NULL,				/* 232: epoll_wait */
+	NULL,				/* 233: epoll_ctl */
+	NULL,				/* 234: tgkill */
+	lx_utimes,			/* 235: utimes */
+	NULL,				/* 236: vserver */
+	NULL,				/* 237: mbind */
+	NULL,				/* 238: set_mempolicy */
+	NULL,				/* 239: get_mempolicy */
+	NULL,				/* 240: mq_open */
+	NULL,				/* 241: mq_unlink */
+	NULL,				/* 242: mq_timedsend */
+	NULL,				/* 243: mq_timedreceive */
+	NULL,				/* 244: mq_notify */
+	NULL,				/* 245: mq_getsetattr */
+	NULL,				/* 246: kexec_load */
+	NULL,				/* 247: waitid */
+	NULL,				/* 248: add_key */
+	NULL,				/* 249: request_key */
+	NULL,				/* 250: keyctl */
+	NULL,				/* 251: ioprio_set */
+	NULL,				/* 252: ioprio_get */
+	lx_inotify_init,		/* 253: inotify_init */
+	lx_inotify_add_watch,		/* 254: inotify_add_watch */
+	lx_inotify_rm_watch,		/* 255: inotify_rm_watch */
+	NULL,				/* 256: migrate_pages */
+	NULL,				/* 257: openat */
+	NULL,				/* 258: mkdirat */
+	lx_mknodat,			/* 259: mknodat */
+	NULL,				/* 260: fchownat */
+	lx_futimesat,			/* 261: futimesat */
+	NULL,				/* 262: fstatat64 */
+	NULL,				/* 263: unlinkat */
+	NULL,				/* 264: renameat */
+	NULL,				/* 265: linkat */
+	NULL,				/* 266: symlinkat */
+	NULL,				/* 267: readlinkat */
+	NULL,				/* 268: fchmodat */
+	NULL,				/* 269: faccessat */
+	NULL,				/* 270: pselect6 */
+	NULL,				/* 271: ppoll */
+	NULL,				/* 272: unshare */
+	NULL,				/* 273: set_robust_list */
+	NULL,				/* 274: get_robust_list */
+	NULL,				/* 275: splice */
+	NULL,				/* 276: tee */
+	NULL,				/* 277: sync_file_range */
+	NULL,				/* 278: vmsplice */
+	NULL,				/* 279: move_pages */
+	lx_utimensat,			/* 280: utimensat */
+	NULL,				/* 281: epoll_pwait */
+	lx_signalfd,			/* 282: signalfd */
+	lx_timerfd_create,		/* 283: timerfd_create */
+	NULL,				/* 284: eventfd */
+	NULL,				/* 285: fallocate */
+	lx_timerfd_settime,		/* 286: timerfd_settime */
+	lx_timerfd_gettime,		/* 287: timerfd_gettime */
+	NULL,				/* 288: accept4 */
+	lx_signalfd4,			/* 289: signalfd4 */
+	NULL,				/* 290: eventfd2 */
+	NULL,				/* 291: epoll_create1 */
+	NULL,				/* 292: dup3 */
+	NULL,				/* 293: pipe2 */
+	lx_inotify_init1,		/* 294: inotify_init1 */
+	NULL,				/* 295: preadv */
+	NULL,				/* 296: pwritev */
+	lx_rt_tgsigqueueinfo,		/* 297: rt_tgsigqueueinfo */
+	NULL,				/* 298: perf_event_open */
+	NULL,				/* 299: recvmmsg */
+	NULL,				/* 300: fanotify_init */
+	NULL,				/* 301: fanotify_mark */
+	NULL,				/* 302: prlimit64 */
+	NULL,				/* 303: name_to_handle_at */
+	NULL,				/* 304: open_by_handle_at */
+	NULL,				/* 305: clock_adjtime */
+	NULL,				/* 306: syncfs */
+	NULL,				/* 307: sendmmsg */
+	NULL,				/* 309: setns */
+	NULL,				/* 309: getcpu */
+	NULL,				/* 310: process_vm_readv */
+	NULL,				/* 311: process_vm_writev */
+	NULL,				/* 312: kcmp */
+	NULL,				/* 313: finit_module */
+	NULL,				/* 314: sched_setattr */
+	NULL,				/* 315: sched_getattr */
+	NULL,				/* 316: renameat2 */
+	NULL,				/* 317: seccomp */
+	NULL,				/* 318: getrandom */
+	NULL,				/* 319: memfd_create */
+	NULL,				/* 320: kexec_file_load */
+	NULL,				/* 321: bpf */
+	NULL,				/* 322: execveat */
+
+	/* XXX TBD gap then x32 syscalls from 512 - 544 */
+};
+
+#else
+/* The following is the 32-bit syscall table */
+
+static lx_syscall_handler_t lx_handlers[] = {
+	NULL,				/*   0: nosys */
+	lx_exit,			/*   1: exit */
+	lx_fork,			/*   2: fork */
+	NULL,				/*   3: read */
+	NULL,				/*   4: write */
+	NULL,				/*   5: open */
+	NULL,				/*   6: close */
+	NULL,				/*   7: waitpid */
+	NULL,				/*   8: creat */
+	NULL,				/*   9: link */
+	NULL,				/*  10: unlink */
+	lx_execve,			/*  11: execve */
+	NULL,				/*  12: chdir */
+	NULL,				/*  13: time */
+	lx_mknod,			/*  14: mknod */
+	NULL,				/*  15: chmod */
+	NULL,				/*  16: lchown16 */
+	NULL,				/*  17: break */
+	NULL,				/*  18: stat */
+	NULL,				/*  19: lseek */
+	NULL,				/*  20: getpid */
+	lx_mount,			/*  21: mount */
+	NULL,				/*  22: umount */
+	NULL,				/*  23: setuid16 */
+	NULL,				/*  24: getuid16 */
+	NULL,				/*  25: stime */
+	NULL,				/*  26: ptrace */
+	NULL,				/*  27: alarm */
+	NULL,				/*  28: fstat */
+	NULL,				/*  29: pause */
+	lx_utime,			/*  30: utime */
+	NULL,				/*  31: stty */
+	NULL,				/*  32: gtty */
+	NULL,				/*  33: access */
+	NULL,				/*  34: nice */
+	NULL,				/*  35: ftime */
+	NULL,				/*  36: sync */
+	NULL,				/*  37: kill */
+	NULL,				/*  38: rename */
+	NULL,				/*  39: mkdir */
+	lx_rmdir,			/*  40: rmdir */
+	NULL,				/*  41: dup */
+	NULL,				/*  42: pipe */
+	NULL,				/*  43: times */
+	NULL,				/*  44: prof */
+	NULL,				/*  45: brk */
+	NULL,				/*  46: setgid16 */
+	NULL,				/*  47: getgid16 */
+	lx_signal,			/*  48: signal */
+	NULL,				/*  49: geteuid16 */
+	NULL,				/*  50: getegid16 */
+	NULL,				/*  51: acct */
+	NULL,				/*  52: umount2 */
+	NULL,				/*  53: lock */
+	NULL,				/*  54: ioctl */
+	NULL,				/*  55: fcntl */
+	NULL,				/*  56: mpx */
+	NULL,				/*  57: setpgid */
+	NULL,				/*  58: ulimit */
+	NULL,				/*  59: olduname */
+	NULL,				/*  60: umask */
+	NULL,				/*  61: chroot */
+	NULL,				/*  62: ustat */
+	NULL,				/*  63: dup2 */
+	NULL,				/*  64: getppid */
+	NULL,				/*  65: getpgrp */
+	NULL,				/*  66: setsid */
+	lx_sigaction,			/*  67: sigaction */
+	NULL,				/*  68: sgetmask */
+	NULL,				/*  69: ssetmask */
+	NULL,				/*  70: setreuid16 */
+	NULL,				/*  71: setregid16 */
+	lx_sigsuspend,			/*  72: sigsuspend */
+	lx_sigpending,			/*  73: sigpending */
+	NULL,				/*  74: sethostname */
+	NULL,				/*  75: setrlimit */
+	NULL,				/*  76: getrlimit */
+	NULL,				/*  77: getrusage */
+	NULL,				/*  78: gettimeofday */
+	lx_settimeofday,		/*  79: settimeofday */
+	lx_getgroups16,			/*  80: getgroups16 */
+	lx_setgroups16,			/*  81: setgroups16 */
+	NULL,				/*  82: select */
+	NULL,				/*  83: symlink */
+	NULL,				/*  84: oldlstat */
+	NULL,				/*  85: readlink */
+	NULL,				/*  86: uselib */
+	NULL,				/*  87: swapon */
+	NULL,				/*  88: reboot */
+	lx_readdir,			/*  89: readdir */
+	NULL,				/*  90: mmap */
+	NULL,				/*  91: munmap */
+	lx_truncate,			/*  92: truncate */
+	lx_ftruncate,			/*  93: ftruncate */
+	NULL,				/*  94: fchmod */
+	NULL,				/*  95: fchown16 */
+	NULL,				/*  96: getpriority */
+	NULL,				/*  97: setpriority */
+	NULL,				/*  98: profil */
+	lx_statfs,			/*  99: statfs */
+	lx_fstatfs,			/* 100: fstatfs */
+	NULL,				/* 101: ioperm */
+	NULL,				/* 102: socketcall */
+	NULL,				/* 103: syslog */
+	lx_setitimer,			/* 104: setitimer */
+	NULL,				/* 105: getitimer */
+	NULL,				/* 106: stat */
+	NULL,				/* 107: lstat */
+	NULL,				/* 108: fstat */
+	NULL,				/* 109: uname */
+	NULL,				/* 110: oldiopl */
+	NULL,				/* 111: vhangup */
+	NULL,				/* 112: idle */
+	NULL,				/* 113: vm86old */
+	NULL,				/* 114: wait4 */
+	NULL,				/* 115: swapoff */
+	NULL,				/* 116: sysinfo */
+	lx_ipc,				/* 117: ipc */
+	lx_fsync,			/* 118: fsync */
+	lx_sigreturn,			/* 119: sigreturn */
+	lx_clone,			/* 120: clone */
+	NULL,				/* 121: setdomainname */
+	NULL,				/* 122: uname */
+	NULL,				/* 123: modify_ldt */
+	lx_adjtimex,			/* 124: adjtimex */
+	NULL,				/* 125: mprotect */
+	lx_sigprocmask,			/* 126: sigprocmask */
+	NULL,				/* 127: create_module */
+	NULL,				/* 128: init_module */
+	NULL,				/* 129: delete_module */
+	NULL,				/* 130: get_kernel_syms */
+	NULL,				/* 131: quotactl */
+	NULL,				/* 132: getpgid */
+	NULL,				/* 133: fchdir */
+	NULL,				/* 134: bdflush */
+	lx_sysfs,			/* 135: sysfs */
+	NULL,				/* 136: personality */
+	NULL,				/* 137: afs_syscall */
+	NULL,				/* 138: setfsuid16 */
+	NULL,				/* 139: setfsgid16 */
+	NULL,				/* 140: llseek */
+	NULL,				/* 141: getdents */
+	NULL,				/* 142: select */
+	NULL,				/* 143: flock */
+	NULL,				/* 144: msync */
+	NULL,				/* 145: readv */
+	NULL,				/* 146: writev */
+	NULL,				/* 147: getsid */
+	lx_fdatasync,			/* 148: fdatasync */
+	lx_sysctl,			/* 149: sysctl */
+	NULL,				/* 150: mlock */
+	NULL,				/* 151: munlock */
+	NULL,				/* 152: mlockall */
+	NULL,				/* 153: munlockall */
+	NULL,				/* 154: sched_setparam */
+	NULL,				/* 155: sched_getparam */
+	NULL,				/* 156: sched_setscheduler */
+	NULL,				/* 157: sched_getscheduler */
+	NULL,				/* 158: sched_yield */
+	NULL,				/* 159: sched_get_priority_max */
+	NULL,				/* 160: sched_get_priority_min */
+	NULL,				/* 161: sched_rr_get_interval */
+	NULL,				/* 162: nanosleep */
+	NULL,				/* 163: mremap */
+	NULL,				/* 164: setresuid16 */
+	NULL,				/* 165: getresuid16 */
+	NULL,				/* 166: vm86 */
+	lx_query_module,		/* 167: query_module */
+	NULL,				/* 168: poll */
+	NULL,				/* 169: nfsservctl */
+	NULL,				/* 170: setresgid16 */
+	NULL,				/* 171: getresgid16 */
+	NULL,				/* 172: prctl */
+	lx_rt_sigreturn,		/* 173: rt_sigreturn */
+	lx_rt_sigaction,		/* 174: rt_sigaction */
+	lx_rt_sigprocmask,		/* 175: rt_sigprocmask */
+	lx_rt_sigpending,		/* 176: rt_sigpending */
+	lx_rt_sigtimedwait,		/* 177: rt_sigtimedwait */
+	lx_rt_sigqueueinfo,		/* 178: rt_sigqueueinfo */
+	lx_rt_sigsuspend,		/* 179: rt_sigsuspend */
+	NULL,				/* 180: pread64 */
+	NULL,				/* 181: pwrite64 */
+	NULL,				/* 182: chown16 */
+	NULL,				/* 183: getcwd */
+	lx_capget,			/* 184: capget */
+	lx_capset,			/* 185: capset */
+	lx_sigaltstack,			/* 186: sigaltstack */
+	lx_sendfile,			/* 187: sendfile */
+	NULL,				/* 188: getpmsg */
+	NULL,				/* 189: putpmsg */
+	lx_vfork,			/* 190: vfork */
+	NULL,				/* 191: getrlimit */
+	NULL,				/* 192: mmap2 */
+	lx_truncate64,			/* 193: truncate64 */
+	lx_ftruncate64,			/* 194: ftruncate64 */
+	NULL,				/* 195: stat64 */
+	NULL,				/* 196: lstat64 */
+	NULL,				/* 197: fstat64 */
+	NULL,				/* 198: lchown */
+	NULL,				/* 199: getuid */
+	NULL,				/* 200: getgid */
+	NULL,				/* 201: geteuid */
+	NULL,				/* 202: getegid */
+	NULL,				/* 203: setreuid */
+	NULL,				/* 204: setregid */
+	lx_getgroups,			/* 205: getgroups */
+	lx_setgroups,			/* 206: setgroups */
+	NULL,				/* 207: fchown */
+	NULL,				/* 208: setresuid */
+	NULL,				/* 209: getresuid */
+	NULL,				/* 210: setresgid */
+	NULL,				/* 211: getresgid */
+	NULL,				/* 212: chown */
+	NULL,				/* 213: setuid */
+	NULL,				/* 214: setgid */
+	NULL,				/* 215: setfsuid */
+	NULL,				/* 216: setfsgid */
+	NULL,				/* 217: pivot_root */
+	NULL,				/* 218: mincore */
+	NULL,				/* 219: madvise */
+	NULL,				/* 220: getdents64 */
+	NULL,				/* 221: fcntl64 */
+	NULL,				/* 222: tux */
+	NULL,				/* 223: security */
+	NULL,				/* 224: gettid */
+	NULL,				/* 225: readahead */
+	NULL,				/* 226: setxattr */
+	NULL,				/* 227: lsetxattr */
+	NULL,				/* 228: fsetxattr */
+	NULL,				/* 229: getxattr */
+	NULL,				/* 230: lgetxattr */
+	NULL,				/* 231: fgetxattr */
+	NULL,				/* 232: listxattr */
+	NULL,				/* 233: llistxattr */
+	NULL,				/* 234: flistxattr */
+	NULL,				/* 235: removexattr */
+	NULL,				/* 236: lremovexattr */
+	NULL,				/* 237: fremovexattr */
+	NULL,				/* 238: tkill */
+	lx_sendfile64,			/* 239: sendfile64 */
+	NULL,				/* 240: futex */
+	NULL,				/* 241: sched_setaffinity */
+	NULL,				/* 242: sched_getaffinity */
+	NULL,				/* 243: set_thread_area */
+	NULL,				/* 244: get_thread_area */
+	NULL,				/* 245: io_setup */
+	NULL,				/* 246: io_destroy */
+	NULL,				/* 247: io_getevents */
+	NULL,				/* 248: io_submit */
+	NULL,				/* 249: io_cancel */
+	NULL,				/* 250: fadvise64 */
+	NULL,				/* 251: nosys */
+	lx_group_exit,			/* 252: group_exit */
+	NULL,				/* 253: lookup_dcookie */
+	NULL,				/* 254: epoll_create */
+	NULL,				/* 255: epoll_ctl */
+	NULL,				/* 256: epoll_wait */
+	NULL,				/* 257: remap_file_pages */
+	NULL,				/* 258: set_tid_address */
+	NULL,				/* 259: timer_create */
+	lx_timer_settime,		/* 260: timer_settime */
+	lx_timer_gettime,		/* 261: timer_gettime */
+	lx_timer_getoverrun,		/* 262: timer_getoverrun */
+	lx_timer_delete,		/* 263: timer_delete */
+	NULL,				/* 264: clock_settime */
+	NULL,				/* 265: clock_gettime */
+	NULL,				/* 266: clock_getres */
+	lx_clock_nanosleep,		/* 267: clock_nanosleep */
+	lx_statfs64,			/* 268: statfs64 */
+	lx_fstatfs64,			/* 269: fstatfs64 */
+	NULL,				/* 270: tgkill */
+	lx_utimes,			/* 271: utimes */
+	NULL,			/* 272: fadvise64_64 */
+	NULL,				/* 273: vserver */
+	NULL,				/* 274: mbind */
+	NULL,				/* 275: get_mempolicy */
+	NULL,				/* 276: set_mempolicy */
+	NULL,				/* 277: mq_open */
+	NULL,				/* 278: mq_unlink */
+	NULL,				/* 279: mq_timedsend */
+	NULL,				/* 280: mq_timedreceive */
+	NULL,				/* 281: mq_notify */
+	NULL,				/* 282: mq_getsetattr */
+	NULL,				/* 283: kexec_load */
+	NULL,				/* 284: waitid */
+	NULL,				/* 285: sys_setaltroot */
+	NULL,				/* 286: add_key */
+	NULL,				/* 287: request_key */
+	NULL,				/* 288: keyctl */
+	NULL,				/* 289: ioprio_set */
+	NULL,				/* 290: ioprio_get */
+	lx_inotify_init,		/* 291: inotify_init */
+	lx_inotify_add_watch,		/* 292: inotify_add_watch */
+	lx_inotify_rm_watch,		/* 293: inotify_rm_watch */
+	NULL,				/* 294: migrate_pages */
+	NULL,				/* 295: openat */
+	NULL,				/* 296: mkdirat */
+	lx_mknodat,			/* 297: mknodat */
+	NULL,				/* 298: fchownat */
+	lx_futimesat,			/* 299: futimesat */
+	NULL,				/* 300: fstatat64 */
+	NULL,				/* 301: unlinkat */
+	NULL,				/* 302: renameat */
+	NULL,				/* 303: linkat */
+	NULL,				/* 304: symlinkat */
+	NULL,				/* 305: readlinkat */
+	NULL,				/* 306: fchmodat */
+	NULL,				/* 307: faccessat */
+	NULL,				/* 308: pselect6 */
+	NULL,				/* 309: ppoll */
+	NULL,				/* 310: unshare */
+	NULL,				/* 311: set_robust_list */
+	NULL,				/* 312: get_robust_list */
+	NULL,				/* 313: splice */
+	NULL,				/* 314: sync_file_range */
+	NULL,				/* 315: tee */
+	NULL,				/* 316: vmsplice */
+	NULL,				/* 317: move_pages */
+	NULL,				/* 318: getcpu */
+	NULL,				/* 319: epoll_pwait */
+	lx_utimensat,			/* 320: utimensat */
+	lx_signalfd,			/* 321: signalfd */
+	lx_timerfd_create,		/* 322: timerfd_create */
+	NULL,				/* 323: eventfd */
+	NULL,				/* 324: fallocate */
+	lx_timerfd_settime,		/* 325: timerfd_settime */
+	lx_timerfd_gettime,		/* 326: timerfd_gettime */
+	lx_signalfd4,			/* 327: signalfd4 */
+	NULL,				/* 328: eventfd2 */
+	NULL,				/* 329: epoll_create1 */
+	NULL,				/* 330: dup3 */
+	NULL,				/* 331: pipe2 */
+	lx_inotify_init1,		/* 332: inotify_init1 */
+	NULL,				/* 333: preadv */
+	NULL,				/* 334: pwritev */
+	lx_rt_tgsigqueueinfo,		/* 335: rt_tgsigqueueinfo */
+	NULL,				/* 336: perf_event_open */
+	NULL,				/* 337: recvmmsg */
+	NULL,				/* 338: fanotify_init */
+	NULL,				/* 339: fanotify_mark */
+	NULL,				/* 340: prlimit64 */
+	NULL,				/* 341: name_to_handle_at */
+	NULL,				/* 342: open_by_handle_at */
+	NULL,				/* 343: clock_adjtime */
+	NULL,				/* 344: syncfs */
+	NULL,				/* 345: sendmmsg */
+	NULL,				/* 346: setns */
+	NULL,				/* 347: process_vm_readv */
+	NULL,				/* 348: process_vm_writev */
+	NULL,				/* 349: kcmp */
+	NULL,				/* 350: finit_module */
+	NULL,				/* 351: sched_setattr */
+	NULL,				/* 352: sched_getattr */
+	NULL,				/* 353: renameat2 */
+	NULL,				/* 354: seccomp */
+	NULL,				/* 355: getrandom */
+	NULL,				/* 356: memfd_create */
+	NULL,				/* 357: bpf */
+	NULL,				/* 358: execveat */
+};
+#endif
diff --git a/usr/src/lib/brand/lx/lx_brand/common/lx_provider.d b/usr/src/lib/brand/lx/lx_brand/common/lx_provider.d
new file mode 100644
index 0000000000..14326e8f56
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/lx_provider.d
@@ -0,0 +1,39 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+provider lx {
+	probe debug(char *buf);
+	probe sigdeliver(int sig, void *lx_sigaction, void *lx_sigstack);
+	probe sigreturn(void *lx_ucontext, void *ucontext, uintptr_t sp);
+
+	probe signal__delivery__frame__create(void *lx_sigdeliver_frame);
+	probe signal__delivery__frame__found(void *lx_sigdeliver_frame);
+	probe signal__delivery__frame__corrupt(void *lx_sigdeliver_frame);
+
+	probe signal__post__handler(uintptr_t old_sp, uintptr_t new_sp);
+
+	probe signal__altstack__enable(uintptr_t alt_sp);
+	probe signal__altstack__disable();
+
+	probe emulate__enter(void *ucp, int syscall_num, uintptr_t *args);
+	probe emulate__return(void *ucp, int syscall_num, uintptr_t ret,
+	    uintptr_t errn);
+};
+
+#pragma D attributes Evolving/Evolving/ISA provider lx provider
+#pragma D attributes Private/Private/Unknown provider lx module
+#pragma D attributes Private/Private/Unknown provider lx function
+#pragma D attributes Private/Private/ISA provider lx name
+#pragma D attributes Private/Private/ISA provider lx args
diff --git a/usr/src/lib/brand/lx/lx_brand/common/mapfile b/usr/src/lib/brand/lx/lx_brand/common/mapfile
new file mode 100644
index 0000000000..0663f4bc19
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/mapfile
@@ -0,0 +1,47 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+#
+# Scope everything local -- our .init section is our only public interface.
+#
+{
+	local:
+		*;
+};
diff --git a/usr/src/lib/brand/lx/lx_brand/common/mapfile-vers b/usr/src/lib/brand/lx/lx_brand/common/mapfile-vers
new file mode 100644
index 0000000000..0663f4bc19
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/mapfile-vers
@@ -0,0 +1,47 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+#
+# Scope everything local -- our .init section is our only public interface.
+#
+{
+	local:
+		*;
+};
diff --git a/usr/src/lib/brand/lx/lx_brand/common/misc.c b/usr/src/lib/brand/lx/lx_brand/common/misc.c
new file mode 100644
index 0000000000..a223d0ac35
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/misc.c
@@ -0,0 +1,359 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <priv.h>
+#include <strings.h>
+#include <sys/reboot.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/sysmacros.h>
+#include <sys/systeminfo.h>
+#include <sys/types.h>
+#include <sys/shm.h>
+#include <sys/socket.h>
+#include <sys/inotify.h>
+#include <sys/eventfd.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_fcntl.h>
+
+/*
+ * {get,set}groups16() - Handle the conversion between 16-bit Linux gids and
+ * 32-bit illumos gids.
+ */
+long
+lx_getgroups16(uintptr_t p1, uintptr_t p2)
+{
+	int count = (int)p1;
+	lx_gid16_t *grouplist = (lx_gid16_t *)p2;
+	gid_t *grouplist32;
+	int ret;
+	int i;
+
+	if (count < 0)
+		return (-EINVAL);
+
+	grouplist32 = malloc(count * sizeof (gid_t));
+	if (grouplist32 == NULL && count > 0) {
+		free(grouplist32);
+		return (-ENOMEM);
+	}
+	if ((ret = getgroups(count, grouplist32)) < 0) {
+		free(grouplist32);
+		return (-errno);
+	}
+
+	/* we must not modify the list if the incoming count was 0 */
+	if (count > 0) {
+		for (i = 0; i < ret; i++)
+			grouplist[i] = LX_GID32_TO_GID16(grouplist32[i]);
+	}
+
+	free(grouplist32);
+	return (ret);
+}
+
+long
+lx_setgroups16(uintptr_t p1, uintptr_t p2)
+{
+	long rv;
+	int count = (int)p1;
+	lx_gid16_t *grouplist = NULL;
+	gid_t *grouplist32 = NULL;
+	int i;
+
+	if ((grouplist = malloc(count * sizeof (lx_gid16_t))) == NULL) {
+		return (-ENOMEM);
+	}
+	if (uucopy((void *)p2, grouplist, count * sizeof (lx_gid16_t)) != 0) {
+		free(grouplist);
+		return (-EFAULT);
+	}
+
+	grouplist32 = malloc(count * sizeof (gid_t));
+	if (grouplist32 == NULL) {
+		free(grouplist);
+		return (-ENOMEM);
+	}
+	for (i = 0; i < count; i++)
+		grouplist32[i] = LX_GID16_TO_GID32(grouplist[i]);
+
+	/* order matters here to get the correct errno back */
+	if (count > NGROUPS_MAX_DEFAULT) {
+		free(grouplist);
+		free(grouplist32);
+		return (-EINVAL);
+	}
+
+	rv = setgroups(count, grouplist32);
+
+	free(grouplist);
+	free(grouplist32);
+
+	return (rv != 0 ? -errno : 0);
+}
+
+/*
+ * mknod() - Since we don't have the SYS_CONFIG privilege within a zone, the
+ * only mode we have to support is S_IFIFO.  We also have to distinguish between
+ * an invalid type and insufficient privileges.
+ */
+#define	LX_S_IFMT	0170000
+#define	LX_S_IFDIR	0040000
+#define	LX_S_IFCHR	0020000
+#define	LX_S_IFBLK	0060000
+#define	LX_S_IFREG	0100000
+#define	LX_S_IFIFO	0010000
+#define	LX_S_IFLNK	0120000
+#define	LX_S_IFSOCK	0140000
+
+/*ARGSUSED*/
+long
+lx_mknod(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	char *path = (char *)p1;
+	lx_dev_t lx_dev = (lx_dev_t)p3;
+	struct sockaddr_un sockaddr;
+	struct stat statbuf;
+	mode_t mode, type;
+	dev_t dev;
+	int fd;
+
+	type = ((mode_t)p2 & LX_S_IFMT);
+	mode = ((mode_t)p2 & 07777);
+
+	switch (type) {
+	case 0:
+	case LX_S_IFREG:
+		/* create a regular file */
+		if (stat(path, &statbuf) == 0)
+			return (-EEXIST);
+
+		if (errno != ENOENT)
+			return (-errno);
+
+		if ((fd = creat(path, mode)) < 0)
+			return (-errno);
+
+		(void) close(fd);
+		return (0);
+
+	case LX_S_IFSOCK:
+		/*
+		 * Create a UNIX domain socket.
+		 *
+		 * Most programmers aren't even aware you can do this.
+		 *
+		 * Note you can also do this via illumos' mknod(2), but
+		 * Linux allows anyone who can create a UNIX domain
+		 * socket via bind(2) to create one via mknod(2);
+		 * illumos requires the caller to be privileged.
+		 */
+		if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
+			return (-errno);
+
+		if (stat(path, &statbuf) == 0)
+			return (-EEXIST);
+
+		if (errno != ENOENT)
+			return (-errno);
+
+		if (uucopy(path, &sockaddr.sun_path,
+		    sizeof (sockaddr.sun_path)) < 0)
+			return (-errno);
+
+		/* assure NULL termination of sockaddr.sun_path */
+		sockaddr.sun_path[sizeof (sockaddr.sun_path) - 1] = '\0';
+		sockaddr.sun_family = AF_UNIX;
+
+		if (bind(fd, (struct sockaddr *)&sockaddr,
+		    strlen(sockaddr.sun_path) +
+		    sizeof (sockaddr.sun_family)) < 0)
+			return (-errno);
+
+		(void) close(fd);
+		return (0);
+
+	case LX_S_IFIFO:
+		dev = 0;
+		break;
+
+	case LX_S_IFCHR:
+	case LX_S_IFBLK:
+		/*
+		 * The "dev" RPM package wants to create all possible Linux
+		 * device nodes, so just report its mknod()s as having
+		 * succeeded if we're in install mode.
+		 */
+		if (lx_install != 0) {
+			lx_debug("lx_mknod: install mode spoofed creation of "
+			    "Linux device [%lld, %lld]\n",
+			    LX_GETMAJOR(lx_dev), LX_GETMINOR(lx_dev));
+
+			return (0);
+		}
+
+		dev = makedevice(LX_GETMAJOR(lx_dev), LX_GETMINOR(lx_dev));
+		break;
+
+	default:
+		return (-EINVAL);
+	}
+
+	return (mknod(path, mode | type, dev) ? -errno : 0);
+}
+
+long
+lx_execve(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	char *filename = (char *)p1;
+	char **argv = (char **)p2;
+	char **envp = (char **)p3;
+	char *nullist[] = { NULL };
+
+	if (argv == NULL)
+		argv = nullist;
+
+	/*
+	 * Emulate PR_SET_KEEPCAPS which is reset on execve. If this is not done
+	 * the emulated capabilities could be reduced more than expected.
+	 */
+	(void) setpflags(PRIV_AWARE_RESET, 1);
+
+	/* This is a normal exec call. */
+	(void) execve(filename, argv, envp);
+
+	return (-errno);
+}
+
+long
+lx_setgroups(uintptr_t p1, uintptr_t p2)
+{
+	int ng = (int)p1;
+	gid_t *glist = NULL;
+	int i, r;
+
+	lx_debug("\tlx_setgroups(%d, 0x%p", ng, p2);
+
+	if (ng > 0) {
+		if ((glist = (gid_t *)malloc(ng * sizeof (gid_t))) == NULL)
+			return (-ENOMEM);
+
+		if (uucopy((void *)p2, glist, ng * sizeof (gid_t)) != 0) {
+			free(glist);
+			return (-errno);
+		}
+
+		/*
+		 * Linux doesn't check the validity of the group IDs, but
+		 * illumos does. Change any invalid group IDs to a known, valid
+		 * value (yuck).
+		 */
+		for (i = 0; i < ng; i++) {
+			if (glist[i] > MAXUID)
+				glist[i] = MAXUID;
+		}
+	}
+
+	/* order matters here to get the correct errno back */
+	if (ng > NGROUPS_MAX_DEFAULT) {
+		free(glist);
+		return (-EINVAL);
+	}
+
+	r = syscall(SYS_brand, B_HELPER_SETGROUPS, ng, glist);
+
+	free(glist);
+	return ((r == -1) ? -errno : r);
+}
+
+long
+lx_getgroups(int gidsetsize, gid_t *grouplist)
+{
+	int r;
+
+	r = getgroups(gidsetsize, grouplist);
+	return ((r == -1) ? -errno : r);
+}
+
+long
+lx_inotify_add_watch(int fd, const char *pathname, uint32_t mask)
+{
+	int r;
+
+	r = inotify_add_watch(fd, pathname, mask);
+	return ((r == -1) ? -errno : r);
+}
+
+long
+lx_inotify_init(void)
+{
+	int r;
+
+	r = inotify_init();
+	return ((r == -1) ? -errno : r);
+}
+
+long
+lx_inotify_init1(int flags)
+{
+	int r;
+
+	r = inotify_init1(flags);
+	return ((r == -1) ? -errno : r);
+}
+
+long
+lx_inotify_rm_watch(int fd, int wd)
+{
+	int r;
+
+	r = inotify_rm_watch(fd, wd);
+	return ((r == -1) ? -errno : r);
+}
+
+long
+lx_shmdt(char *shmaddr)
+{
+	int r;
+
+	r = shmdt(shmaddr);
+	return ((r == -1) ? -errno : r);
+}
+
+long
+lx_utimes(const char *path, const struct timeval times[2])
+{
+	int r;
+
+	r = utimes(path, times);
+	return ((r == -1) ? -errno : r);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/module.c b/usr/src/lib/brand/lx/lx_brand/common/module.c
new file mode 100644
index 0000000000..78a593712f
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/module.c
@@ -0,0 +1,90 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * We don't support Linux modules, but we have to emulate enough of the system
+ * calls to show that we don't have any modules installed.
+ */
+
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+
+/*
+ * For query_module(), we provide an empty list of modules, and return ENOENT
+ * on any request for a specific module.
+ */
+#define	LX_QM_MODULES	1
+#define	LX_QM_DEPS	2
+#define	LX_QM_REFS	3
+#define	LX_QM_SYMBOLS	4
+#define	LX_QM_INFO	5
+
+/*ARGSUSED*/
+long
+lx_query_module(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4,
+    uintptr_t p5)
+{
+	/*
+	 * parameter p1 is the 'name' argument.
+	 */
+	int which = (int)p2;
+	char *buf = (char *)p3;
+	size_t bufsize = (size_t)p4;
+	size_t *ret = (size_t *)p5;
+
+	switch (which) {
+	case 0:
+		/*
+		 * Special case: always return 0
+		 */
+		return (0);
+
+	case LX_QM_MODULES:
+		/*
+		 * Generate an empty list of modules.
+		 */
+		if (bufsize && buf)
+			buf[0] = '\0';
+		if (ret)
+			*ret = 0;
+		return (0);
+
+	case LX_QM_DEPS:
+	case LX_QM_REFS:
+	case LX_QM_SYMBOLS:
+	case LX_QM_INFO:
+		/*
+		 * Any requests for specific module information return ENOENT.
+		 */
+		return (-ENOENT);
+
+	default:
+		return (-EINVAL);
+	}
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/mount.c b/usr/src/lib/brand/lx/lx_brand/common/mount.c
new file mode 100644
index 0000000000..6ecd5cfc4f
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/mount.c
@@ -0,0 +1,540 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <strings.h>
+#include <nfs/mount.h>
+#include <sys/types.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdlib.h>
+
+#include <sys/lx_debug.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_mount.h>
+
+/*
+ * support definitions
+ */
+union fh_buffer {
+	struct nfs_fid	fh2;
+	struct nfs_fh3	fh3;
+	char		fh_data[NFS3_FHSIZE + 2];
+};
+
+static int
+i_add_option(char *option, char *buf, size_t buf_size)
+{
+	char *fmt_str = NULL;
+
+	assert((option != NULL) && (strlen(option) > 0));
+	assert((buf != NULL) && (buf_size > 0));
+
+	if (buf[0] == '\0') {
+		fmt_str = "%s";
+	} else {
+		fmt_str = ",%s";
+	}
+
+	buf_size -= strlen(buf);
+	buf += strlen(buf);
+
+	/*LINTED*/
+	if (snprintf(buf, buf_size, fmt_str, option) > (buf_size - 1))
+		return (-EOVERFLOW);
+	return (0);
+}
+
+static int
+i_add_option_int(char *option, int val, char *buf, size_t buf_size)
+{
+	char *fmt_str = NULL;
+
+	assert((option != NULL) && (strlen(option) > 0));
+	assert((buf != NULL) && (buf_size > 0));
+
+	if (buf[0] == '\0') {
+		fmt_str = "%s=%d";
+	} else {
+		fmt_str = ",%s=%d";
+	}
+
+	buf_size -= strlen(buf);
+	buf += strlen(buf);
+
+	/*LINTED*/
+	if (snprintf(buf, buf_size, fmt_str, option, val) > (buf_size - 1))
+		return (-EOVERFLOW);
+	return (0);
+}
+
+static int
+i_make_nfs_args(lx_nfs_mount_data_t *lx_nmd, struct nfs_args *nfs_args,
+    struct netbuf *nfs_args_addr, struct knetconfig *nfs_args_knconf,
+    union fh_buffer *nfs_args_fh, struct sec_data *nfs_args_secdata,
+    char *fstype, char *options, int options_size)
+{
+	struct stat	statbuf;
+	int		i, rv, use_tcp;
+
+	/* Sanity check the incomming Linux request. */
+	if ((lx_nmd->nmd_rsize < 0) || (lx_nmd->nmd_wsize < 0) ||
+	    (lx_nmd->nmd_timeo < 0) || (lx_nmd->nmd_retrans < 0) ||
+	    (lx_nmd->nmd_acregmin < 0) || (lx_nmd->nmd_acregmax < 0) ||
+	    (lx_nmd->nmd_acdirmax < 0)) {
+		return (-EINVAL);
+	}
+
+	/*
+	 * Additional sanity checks of incomming request.
+	 *
+	 * Some of the sanity checks below should probably return
+	 * EINVAL (or some other error code) instead or ENOTSUP,
+	 * but without experiminting on Linux to see how it
+	 * deals with certain strange values there is no way
+	 * to really know what we should return, hence we return
+	 * ENOTSUP to tell us that eventually if we see some
+	 * application hitting the problem we can go to a real
+	 * Linux system, figure out how it deals with the situation
+	 * and update our code to handle it in the same fashion.
+	 */
+	if (lx_nmd->nmd_version != 4) {
+		lx_unsupported("unsupported nfs mount request, "
+		    "unrecognized NFS mount structure: %d\n",
+		    lx_nmd->nmd_version);
+		return (-ENOTSUP);
+	}
+	if ((lx_nmd->nmd_flags & ~LX_NFS_MOUNT_SUPPORTED) != 0) {
+		lx_unsupported("unsupported nfs mount request, "
+		    "flags: 0x%x\n", lx_nmd->nmd_flags);
+		return (-ENOTSUP);
+	}
+	if (lx_nmd->nmd_addr.sin_family != AF_INET) {
+		lx_unsupported("unsupported nfs mount request, "
+		    "transport address family: 0x%x\n",
+		    lx_nmd->nmd_addr.sin_family);
+		return (-ENOTSUP);
+	}
+	for (i = 0; i < LX_NMD_MAXHOSTNAMELEN; i++) {
+		if (lx_nmd->nmd_hostname[i] == '\0')
+			break;
+	}
+	if (i == 0) {
+		lx_unsupported("unsupported nfs mount request, "
+		    "no hostname specified\n");
+		return (-ENOTSUP);
+	}
+	if (i == LX_NMD_MAXHOSTNAMELEN) {
+		lx_unsupported("unsupported nfs mount request, "
+		    "hostname not terminated\n");
+		return (-ENOTSUP);
+	}
+	if (lx_nmd->nmd_namlen < i) {
+		lx_unsupported("unsupported nfs mount request, "
+		    "invalid namlen value: 0x%x\n", lx_nmd->nmd_namlen);
+		return (-ENOTSUP);
+	}
+	if (lx_nmd->nmd_bsize != 0) {
+		lx_unsupported("unsupported nfs mount request, "
+		    "bsize value: 0x%x\n", lx_nmd->nmd_bsize);
+		return (-ENOTSUP);
+	}
+
+	/* Initialize and clear the output structure pointers passed in. */
+	bzero(nfs_args, sizeof (*nfs_args));
+	bzero(nfs_args_addr, sizeof (*nfs_args_addr));
+	bzero(nfs_args_knconf, sizeof (*nfs_args_knconf));
+	bzero(nfs_args_fh, sizeof (*nfs_args_fh));
+	bzero(nfs_args_secdata, sizeof (*nfs_args_secdata));
+	nfs_args->addr = nfs_args_addr;
+	nfs_args->knconf = nfs_args_knconf;
+	nfs_args->fh = (caddr_t)nfs_args_fh;
+	nfs_args->nfs_ext_u.nfs_extB.secdata = nfs_args_secdata;
+
+	/* Check if we're using tcp. */
+	use_tcp = (lx_nmd->nmd_flags & LX_NFS_MOUNT_TCP) ? 1 : 0;
+
+	/*
+	 * These seem to be the default flags used by Solaris for v2 and v3
+	 * nfs mounts.
+	 *
+	 * Don't bother with NFSMNT_TRYRDMA since we always specify a
+	 * transport (either udp or tcp).
+	 */
+	nfs_args->flags = NFSMNT_NEWARGS | NFSMNT_KNCONF | NFSMNT_INT |
+	    NFSMNT_HOSTNAME;
+
+	/* Translate some Linux mount flags into Solaris mount flags. */
+	if (lx_nmd->nmd_flags & LX_NFS_MOUNT_SOFT)
+		nfs_args->flags |= NFSMNT_SOFT;
+	if (lx_nmd->nmd_flags & LX_NFS_MOUNT_INTR)
+		nfs_args->flags |= NFSMNT_INT;
+	if (lx_nmd->nmd_flags & LX_NFS_MOUNT_POSIX)
+		nfs_args->flags |= NFSMNT_POSIX;
+	if (lx_nmd->nmd_flags & LX_NFS_MOUNT_NOCTO)
+		nfs_args->flags |= NFSMNT_NOCTO;
+	if (lx_nmd->nmd_flags & LX_NFS_MOUNT_NOAC)
+		nfs_args->flags |= NFSMNT_NOAC;
+	if (lx_nmd->nmd_flags & LX_NFS_MOUNT_NONLM)
+		nfs_args->flags |= NFSMNT_LLOCK;
+
+	if ((lx_nmd->nmd_flags & LX_NFS_MOUNT_VER3) != 0) {
+		(void) strcpy(fstype, "nfs3");
+		if ((rv = i_add_option_int("vers", 3,
+		    options, options_size)) != 0)
+			return (rv);
+
+		if (lx_nmd->nmd_root.lx_fh3_length >
+		    sizeof (nfs_args_fh->fh3.fh3_u.data)) {
+			lx_unsupported("unsupported nfs mount request, "
+			    "nfs file handle length: 0x%x\n",
+			    lx_nmd->nmd_root.lx_fh3_length);
+			return (-ENOTSUP);
+		}
+
+		/* Set the v3 file handle info. */
+		nfs_args_fh->fh3.fh3_length = lx_nmd->nmd_root.lx_fh3_length;
+		bcopy(&lx_nmd->nmd_root.lx_fh3_data,
+		    nfs_args_fh->fh3.fh3_u.data,
+		    lx_nmd->nmd_root.lx_fh3_length);
+	} else {
+		/*
+		 * Assume nfs v2.  Note that this could also be a v1
+		 * mount request but there doesn't seem to be any difference
+		 * in the parameters passed to the Linux mount system
+		 * call for v1 or v2 mounts so there is no way of really
+		 * knowing.
+		 */
+		(void) strcpy(fstype, "nfs");
+		if ((rv = i_add_option_int("vers", 2,
+		    options, options_size)) != 0)
+			return (rv);
+
+		/* Solaris seems to add this flag when using v2. */
+		nfs_args->flags |= NFSMNT_SECDEFAULT;
+
+		/* Set the v2 file handle info. */
+		bcopy(&lx_nmd->nmd_old_root,
+		    nfs_args_fh, sizeof (nfs_args_fh->fh2));
+	}
+
+	/*
+	 * We can't use getnetconfig() here because there is no netconfig
+	 * database in linux.
+	 */
+	nfs_args_knconf->knc_protofmly = "inet";
+	if (use_tcp) {
+		/*
+		 * TCP uses NC_TPI_COTS_ORD semantics.
+		 * See /etc/netconfig.
+		 */
+		nfs_args_knconf->knc_semantics = NC_TPI_COTS_ORD;
+		nfs_args_knconf->knc_proto = "tcp";
+		if ((rv = i_add_option("proto=tcp",
+		    options, options_size)) != 0)
+			return (rv);
+		if (stat("/dev/tcp", &statbuf) != 0)
+			return (-errno);
+		nfs_args_knconf->knc_rdev = statbuf.st_rdev;
+	} else {
+		/*
+		 * Assume UDP.  UDP uses NC_TPI_CLTS semantics.
+		 * See /etc/netconfig.
+		 */
+		nfs_args_knconf->knc_semantics = NC_TPI_CLTS;
+		nfs_args_knconf->knc_proto = "udp";
+		if ((rv = i_add_option("proto=udp",
+		    options, options_size)) != 0)
+			return (rv);
+		if (stat("/dev/udp", &statbuf) != 0)
+			return (-errno);
+		nfs_args_knconf->knc_rdev = statbuf.st_rdev;
+	}
+
+	/* Set the server address. */
+	nfs_args_addr->maxlen = nfs_args_addr->len =
+	    sizeof (struct sockaddr_in);
+	nfs_args_addr->buf = (char *)&lx_nmd->nmd_addr;
+
+	/* Set the server hostname string. */
+	nfs_args->hostname = lx_nmd->nmd_hostname;
+
+	/* Translate Linux nfs mount parameters into Solaris mount options. */
+	if (lx_nmd->nmd_rsize != LX_NMD_DEFAULT_RSIZE) {
+		if ((rv = i_add_option_int("rsize", lx_nmd->nmd_rsize,
+		    options, options_size)) != 0)
+			return (rv);
+		nfs_args->rsize = lx_nmd->nmd_rsize;
+		nfs_args->flags |= NFSMNT_RSIZE;
+	}
+	if (lx_nmd->nmd_wsize != LX_NMD_DEFAULT_WSIZE) {
+		if ((rv = i_add_option_int("wsize", lx_nmd->nmd_wsize,
+		    options, options_size)) != 0)
+			return (rv);
+		nfs_args->wsize = lx_nmd->nmd_wsize;
+		nfs_args->flags |= NFSMNT_WSIZE;
+	}
+	if ((rv = i_add_option_int("timeo", lx_nmd->nmd_timeo,
+	    options, options_size)) != 0)
+		return (rv);
+	nfs_args->timeo = lx_nmd->nmd_timeo;
+	nfs_args->flags |= NFSMNT_TIMEO;
+	if ((rv = i_add_option_int("retrans", lx_nmd->nmd_retrans,
+	    options, options_size)) != 0)
+		return (rv);
+	nfs_args->retrans = lx_nmd->nmd_retrans;
+	nfs_args->flags |= NFSMNT_RETRANS;
+	if ((rv = i_add_option_int("acregmin", lx_nmd->nmd_acregmin,
+	    options, options_size)) != 0)
+		return (rv);
+	nfs_args->acregmin = lx_nmd->nmd_acregmin;
+	nfs_args->flags |= NFSMNT_ACREGMIN;
+	if ((rv = i_add_option_int("acregmax", lx_nmd->nmd_acregmax,
+	    options, options_size)) != 0)
+		return (rv);
+	nfs_args->acregmax = lx_nmd->nmd_acregmax;
+	nfs_args->flags |= NFSMNT_ACREGMAX;
+	if ((rv = i_add_option_int("acdirmin", lx_nmd->nmd_acdirmin,
+	    options, options_size)) != 0)
+		return (rv);
+	nfs_args->acdirmin = lx_nmd->nmd_acdirmin;
+	nfs_args->flags |= NFSMNT_ACDIRMIN;
+	if ((rv = i_add_option_int("acdirmax", lx_nmd->nmd_acdirmax,
+	    options, options_size)) != 0)
+		return (rv);
+	nfs_args->acdirmax = lx_nmd->nmd_acdirmax;
+	nfs_args->flags |= NFSMNT_ACDIRMAX;
+
+	/* We only support nfs with a security type of AUTH_SYS. */
+	nfs_args->nfs_args_ext = NFS_ARGS_EXTB;
+	nfs_args_secdata->secmod = AUTH_SYS;
+	nfs_args_secdata->rpcflavor = AUTH_SYS;
+	nfs_args_secdata->flags = 0;
+	nfs_args_secdata->uid = 0;
+	nfs_args_secdata->data = NULL;
+	nfs_args->nfs_ext_u.nfs_extB.next = NULL;
+
+	/*
+	 * The Linux nfs mount command seems to pass an open socket fd
+	 * to the kernel during the mount system call.  We don't need
+	 * this fd on Solaris so just close it.
+	 */
+	(void) close(lx_nmd->nmd_fd);
+
+	return (0);
+}
+
+/*
+ * The user-level mount(2) code is only used to support NFS mounts. All other
+ * fstypes are handled in-kernel.
+ */
+long
+lx_mount(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4,
+    uintptr_t p5)
+{
+	/* Linux input arguments. */
+	const char		*sourcep = (const char *)p1;
+	const char		*targetp = (const char *)p2;
+	const char		*fstypep = (const char *)p3;
+	unsigned int		flags = (unsigned int)p4;
+	const void		*datap = (const void *)p5;
+
+	char			source[MAXPATHLEN + LX_NMD_MAXHOSTNAMELEN + 1];
+	char			target[MAXPATHLEN];
+	char			fstype[8], options[MAX_MNTOPT_STR];
+	int			sflags, rv;
+	long			res;
+
+	lx_nfs_mount_data_t	lx_nmd;
+	struct nfs_args		nfs_args;
+	struct netbuf 		nfs_args_addr;
+	struct knetconfig	nfs_args_knconf;
+	union fh_buffer		nfs_args_fh;
+	struct sec_data		nfs_args_secdata;
+	char			*sdataptr = NULL;
+	int			sdatalen = 0;
+	int			vers;
+
+	/* Initialize illumos mount arguments. */
+	sflags = MS_OPTIONSTR;
+	options[0] = '\0';
+	sdatalen = 0;
+
+	/* Copy in parameters that are always present. */
+	rv = uucopystr((void *)sourcep, &source, sizeof (source));
+	if ((rv == -1) || (rv == sizeof (source)))
+		return (-EFAULT);
+
+	rv = uucopystr((void *)targetp, &target, sizeof (target));
+	if ((rv == -1) || (rv == sizeof (target)))
+		return (-EFAULT);
+
+	rv = uucopystr((void *)fstypep, &fstype, sizeof (fstype));
+	if ((rv == -1) || (rv == sizeof (fstype)))
+		return (-EFAULT);
+
+	lx_debug("\tlinux mount source: %s", source);
+	lx_debug("\tlinux mount target: %s", target);
+	lx_debug("\tlinux mount fstype: %s", fstype);
+
+	/* The in-kernel mount code should only call us for an NFS mount. */
+	assert(strcmp(fstype, "nfs") == 0 || strcmp(fstype, "nfs4") == 0);
+
+	/*
+	 * While SunOS is picky about mount(2) target paths being absolute,
+	 * Linux is not so strict.  In order to facilitate this looser
+	 * requirement, the cwd is prepended to non-absolute target paths.
+	 */
+	if (target[0] != '/') {
+		char *cpath, *buf = NULL;
+		int len;
+
+		if ((cpath = getcwd(NULL, MAXPATHLEN)) == NULL) {
+			return (-ENOMEM);
+		}
+		len = asprintf(&buf, "%s/%s", cpath, target);
+		free(cpath);
+		if (len < 0) {
+			return (-ENOMEM);
+		} else if (len >= MAXPATHLEN) {
+			free(buf);
+			return (-ENAMETOOLONG);
+		}
+		(void) strlcpy(target, buf, sizeof (target));
+		free(buf);
+	}
+
+	/* Make sure we support the requested mount flags. */
+	if ((flags & ~LX_MS_SUPPORTED) != 0) {
+		lx_unsupported("unsupported mount flags: 0x%x", flags);
+		return (-ENOTSUP);
+	}
+
+	/*
+	 * Copy in Linux mount options. Note that for older Linux kernels
+	 * (pre 2.6.23) the mount options pointer (which normally points to a
+	 * string) points to a structure which is populated by the user-level
+	 * code after it has done the preliminary RPCs (similar to how our NFS
+	 * mount cmd works). For newer kernels the options pointer is just a
+	 * string of options. We're unlikely to actually emulate a kernel that
+	 * uses the old style but support is kept and handled in
+	 * i_make_nfs_args(). The new style handling is implemented in
+	 * lx_nfs_mount(). The user-level mount caller is in charge of
+	 * determining the format in which it passes the data parameter.
+	 */
+	if (datap == NULL)
+		return (-EINVAL);
+	if (uucopy((void *)datap, &vers, sizeof (int)) < 0)
+		return (-errno);
+
+	/*
+	 * As described above, the data parameter might be a versioned lx_nmd
+	 * structure or (most likely on a modern distribution) it is a string.
+	 */
+	if (vers < 1 || vers > 6) {
+		/*
+		 * Handle the modern style with options as a string, make the
+		 * preliminary RPC calls and do the native mount all within
+		 * lx_nfs_mount().
+		 */
+		if (uucopystr((void *)datap, options, sizeof (options)) < 0)
+			return (-errno);
+		return (lx_nfs_mount(source, target, fstype, flags, options));
+	}
+
+	/*
+	 * This is an old style NFS mount call and we only support v4.
+	 */
+	if (vers != 4) {
+		lx_unsupported("unsupported nfs mount request version: %d\n",
+		    vers);
+		return (-ENOTSUP);
+	}
+
+	if (uucopy((void *)datap, &lx_nmd, sizeof (lx_nmd)) < 0)
+		return (-errno);
+
+	/*
+	 * For illumos NFS mounts, the kernel expects a special structure, but
+	 * a pointer to this structure is passed in via an extra parameter
+	 * (sdataptr below.)
+	 */
+	if ((rv = i_make_nfs_args(&lx_nmd, &nfs_args, &nfs_args_addr,
+	    &nfs_args_knconf, &nfs_args_fh, &nfs_args_secdata, fstype, options,
+	    sizeof (options))) != 0)
+		return (rv);
+
+	/*
+	 * For the following old-style NFS mount we need to tell the mount
+	 * system call to expect extra parameters.
+	 */
+	sflags |= MS_DATA;
+	sdataptr = (char *)&nfs_args;
+	sdatalen = sizeof (nfs_args);
+
+	/* Linux seems to always allow overlay mounts */
+	sflags |= MS_OVERLAY;
+
+	/* Convert some Linux flags to illumos flags. */
+	if (flags & LX_MS_RDONLY)
+		sflags |= MS_RDONLY;
+	if (flags & LX_MS_NOSUID)
+		sflags |= MS_NOSUID;
+	if (flags & LX_MS_REMOUNT)
+		sflags |= MS_REMOUNT;
+
+	/*
+	 * Convert some Linux flags to illumos option strings.
+	 */
+	if (flags & LX_MS_STRICTATIME) {
+		/*
+		 * The "strictatime" mount option ensures that none of the
+		 * weaker atime-related mode options are in effect.
+		 */
+		flags &= ~(LX_MS_RELATIME | LX_MS_NOATIME);
+	}
+	if ((flags & LX_MS_NODEV) &&
+	    ((rv = i_add_option("nodev", options, sizeof (options))) != 0))
+		return (rv);
+	if ((flags & LX_MS_NOEXEC) &&
+	    ((rv = i_add_option("noexec", options, sizeof (options))) != 0))
+		return (rv);
+	if ((flags & LX_MS_NOATIME) &&
+	    ((rv = i_add_option("noatime", options, sizeof (options))) != 0))
+		return (rv);
+
+	lx_debug("\tsolaris mount fstype: %s", fstype);
+	lx_debug("\tsolaris mount options: \"%s\"", options);
+
+	res = mount(source, target, sflags, fstype, sdataptr, sdatalen,
+	    options, sizeof (options));
+
+	return ((res == 0) ? 0 : -errno);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/mount_nfs.c b/usr/src/lib/brand/lx/lx_brand/common/mount_nfs.c
new file mode 100644
index 0000000000..ca90a80e5f
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/mount_nfs.c
@@ -0,0 +1,1506 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * NFS mount syscall support
+ *
+ * The illumos NFS user-level mount code encapsulates a significant amount of
+ * functionality into librpc and libnsl. This includes a variety of functions
+ * to perform lookups in the various /etc configuration files. For v2/v3 in
+ * particular, the library code must make a call to the server's 'mountd' to
+ * obtain a file handle to pass into the mount(2) syscall. There can be a
+ * variety of calls to the server's 'rpcbind' made by the libraries during the
+ * preliminaries before calling mount(2). All of the logic for falling back
+ * when determining which version to use (when none is explicitly provided), as
+ * well as retries when the server is not responding, is encapsulated in the
+ * libraries.
+ *
+ * For Linux, much of this functionality is also included in the user-level
+ * mount code, and thus not of concern to us at the Linux syscall level. The
+ * major difference is that the RPC to the 'mountd' to get the file handle for
+ * v2/v3 is made within the kernel as part of the mount(2) syscall. However,
+ * the Linux user-level code will perform all of the logical name lookups (e.g.
+ * hostname to IP address), will make the 'rpcbind' call to determine the
+ * server's 'mountd' protocol and port, and will handle the retry logic.
+ *
+ * Thus, when we reach our code here, we don't need to do any name lookups in
+ * any of the /etc files and we never need to call 'rpcbind'. We only need to
+ * make the RPC to get the file handle for v2/v3 mounts. We're still dependent
+ * on librpc/libnsl to make this RPC, but our overall complexity is much less
+ * than what is seen with the native mount library usage. In addition, we also
+ * have to convert the Linux mount arguments into our native format. Because
+ * we're really just making the RPC to get a file handle and reformatting the
+ * mount arguments, this code should be amenable to living in-kernel at some
+ * point.
+ *
+ * Finally, in most of the functions below, when the code refers to the
+ * hostname we're really working with the IP addr that the Linux user-level
+ * mount command passed in to us.
+ */
+
+/*
+ * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ */
+
+/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
+/*	  All Rights Reserved  	*/
+
+/*
+ * University Copyright- Copyright (c) 1982, 1986, 1988
+ * The Regents of the University of California
+ * All Rights Reserved
+ *
+ * University Acknowledgment- Portions of this document are derived from
+ * software developed by the University of California, Berkeley, and its
+ * contributors.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#define	NFSCLIENT
+#include <string.h>
+#include <stdarg.h>
+#include <unistd.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <sys/param.h>
+#include <rpc/rpc.h>
+#include <errno.h>
+#include <netdb.h>
+#include <sys/mount.h>
+#include <sys/mntent.h>
+#include <sys/mnttab.h>
+#include <nfs/nfs.h>
+#include <nfs/mount.h>
+#include <rpcsvc/mount.h>
+#include <sys/pathconf.h>
+#include <netdir.h>
+#include <netconfig.h>
+#include <sys/sockio.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <nfs/nfs_sec.h>
+#include <rpcsvc/daemon_utils.h>
+#include <rpcsvc/nfs4_prot.h>
+#include <limits.h>
+#include <nfs/nfssys.h>
+#include <strings.h>
+#include <assert.h>
+#include <sys/lx_mount.h>
+#include <sys/lx_misc.h>
+#include <sys/syscall.h>
+
+#ifndef	NFS_VERSMAX
+#define	NFS_VERSMAX	4
+#endif
+#ifndef	NFS_VERSMIN
+#define	NFS_VERSMIN	2
+#endif
+
+#define	RET_OK		0
+#define	RET_RETRY	32
+#define	RET_ERR		33
+#define	RET_PROTOUNSUPP	34
+#define	RET_MNTERR	1000
+#define	ERR_PROTO_NONE		0
+#define	ERR_PROTO_INVALID	901
+#define	ERR_PROTO_UNSUPP	902
+#define	ERR_NETPATH		903
+#define	ERR_NOHOST		904
+#define	ERR_RPCERROR		905
+
+typedef struct err_ret {
+	int error_type;
+	int error_value;
+} err_ret_t;
+
+#define	SET_ERR_RET(errst, etype, eval) \
+	{ \
+	(errst)->error_type = etype; \
+	(errst)->error_value = eval; \
+	}
+
+/*
+ * Built-in netconfig table.
+ */
+#define	N_NETCONF_ENTS	4
+static struct netconfig nca[N_NETCONF_ENTS] = {
+	{"udp6", NC_TPI_CLTS,     1, "inet6", "udp", "/dev/udp6", 0, NULL},
+	{"tcp6", NC_TPI_COTS_ORD, 1, "inet6", "tcp", "/dev/tcp6", 0, NULL},
+	{"udp",  NC_TPI_CLTS,     1, "inet",  "udp", "/dev/udp", 0, NULL},
+	{"tcp",  NC_TPI_COTS_ORD, 1, "inet",  "tcp", "/dev/tcp", 0, NULL}
+};
+
+/*
+ * Mapping table of Linux NFS mount options to the corresponding Illumos
+ * option. The nmo_argtyp field tells us how to handle the argument.
+ */
+typedef enum map_mount_opt_type {
+	MOUNT_OPT_INVALID	= 0,
+	MOUNT_OPT_PASTHRU	= 1,
+	MOUNT_OPT_IGNORE	= 2,
+	MOUNT_OPT_TOKEN		= 3,
+	MOUNT_OPT_HAS_ARG	= 4
+} map_mount_opt_type_t;
+
+typedef struct nfs_map_opt {
+	char			*nmo_lx_opt;
+	char			*nmo_il_opt;
+	map_mount_opt_type_t	nmo_argtyp;
+} nfs_map_opt_t;
+
+static nfs_map_opt_t nmo_tab[] = {
+	{"ac",		NULL,		MOUNT_OPT_IGNORE},
+	{"acdirmax",	NULL,		MOUNT_OPT_PASTHRU},
+	{"acdirmin",	NULL,		MOUNT_OPT_PASTHRU},
+	{"acl",		NULL,		MOUNT_OPT_INVALID},
+	{"acregmax",	NULL,		MOUNT_OPT_PASTHRU},
+	{"acregmin",	NULL,		MOUNT_OPT_PASTHRU},
+	{"actimeo",	NULL,		MOUNT_OPT_PASTHRU},
+	{"bg",		NULL,		MOUNT_OPT_IGNORE},
+	{"cto",		NULL,		MOUNT_OPT_IGNORE},
+	{"fg",		NULL,		MOUNT_OPT_IGNORE},
+	{"fsc",		NULL,		MOUNT_OPT_IGNORE},
+	{"hard",	NULL,		MOUNT_OPT_PASTHRU},
+	{"intr",	NULL,		MOUNT_OPT_PASTHRU},
+	{"lock",	NULL,		MOUNT_OPT_IGNORE},
+	{"lookupcache",	NULL,		MOUNT_OPT_INVALID},
+	{"local_lock=%s", NULL,		MOUNT_OPT_INVALID },
+	{"migration",	NULL,		MOUNT_OPT_INVALID},
+	{"minorversion", NULL,		MOUNT_OPT_INVALID},
+	{"mountaddr",	NULL,		MOUNT_OPT_INVALID},
+	{"mounthost",	NULL,		MOUNT_OPT_INVALID},
+	{"mountport",	NULL,		MOUNT_OPT_PASTHRU},
+	{"mountproto",	NULL,		MOUNT_OPT_PASTHRU},
+	{"mountvers",	NULL,		MOUNT_OPT_PASTHRU},
+	{"namlen",	NULL,		MOUNT_OPT_INVALID},
+	{"nfsvers",	NULL,		MOUNT_OPT_INVALID},
+	{"noac",	NULL,		MOUNT_OPT_PASTHRU},
+	{"noacl",	NULL,		MOUNT_OPT_INVALID},
+	{"nocto",	NULL,		MOUNT_OPT_PASTHRU},
+	{"nofsc",	NULL,		MOUNT_OPT_IGNORE},
+	{"nointr",	NULL,		MOUNT_OPT_PASTHRU},
+	{"nolock",	"llock",	MOUNT_OPT_TOKEN},
+	{"nomigration",	NULL,		MOUNT_OPT_INVALID},
+	{"noposix",	NULL,		MOUNT_OPT_IGNORE},
+	{"nordirplus",	NULL,		MOUNT_OPT_IGNORE},
+	{"noresvport",	NULL,		MOUNT_OPT_INVALID},
+	{"nosharecache", NULL,		MOUNT_OPT_IGNORE},
+	{"port",	NULL,		MOUNT_OPT_PASTHRU},
+	{"posix",	NULL,		MOUNT_OPT_PASTHRU},
+	{"proto",	NULL,		MOUNT_OPT_PASTHRU},
+	{"rdirplus",	NULL,		MOUNT_OPT_IGNORE},
+	{"rdma",	"proto=rdma",	MOUNT_OPT_TOKEN},
+	{"resvport",	NULL,		MOUNT_OPT_IGNORE},
+	{"retrans",	NULL,		MOUNT_OPT_PASTHRU},
+	{"retry",	NULL,		MOUNT_OPT_IGNORE},
+	{"rsize",	NULL,		MOUNT_OPT_PASTHRU},
+	{"sec",		NULL,		MOUNT_OPT_PASTHRU},
+	{"sharecache",	NULL,		MOUNT_OPT_IGNORE},
+	{"sloppy",	NULL,		MOUNT_OPT_IGNORE},
+	{"soft",	NULL,		MOUNT_OPT_PASTHRU},
+	{"tcp",		"proto=tcp",	MOUNT_OPT_TOKEN},
+	{"timeo",	NULL,		MOUNT_OPT_PASTHRU},
+	{"udp",		"proto=udp",	MOUNT_OPT_TOKEN},
+	{"vers",	NULL,		MOUNT_OPT_PASTHRU},
+	{"wsize",	NULL,		MOUNT_OPT_PASTHRU},
+	{NULL,		NULL,		MOUNT_OPT_INVALID}
+};
+
+/*
+ * This struct is used to keep track of misc. variables which are set deep
+ * in one function then referenced someplace else. We pass this around to
+ * avoid the use of global variables as is done the the NFS mount command.
+ *
+ * The nfsvers variables control the NFS version number to be used.
+ *
+ * nmd_nfsvers defaults to 0 which means to use the highest number that
+ * both the client and the server support.  It can also be set to
+ * a particular value, either 2, 3, or 4 to indicate the version
+ * number of choice.  If the server (or the client) do not support
+ * the version indicated, then the mount attempt will be failed.
+ */
+typedef struct nfs_mnt_data {
+	int		nmd_posix;
+	ushort_t	nmd_nfs_port;
+	char		*nmd_nfs_proto;
+	ushort_t	nmd_mnt_port;
+	char		*nmd_mnt_proto;
+	char		*nmd_fstype;
+	seconfig_t	nmd_nfs_sec;
+	int		nmd_sec_opt;	/* any security option ? */
+	int		nmd_nolock_opt;	/* 'nolock' specified */
+	rpcvers_t	nmd_mnt_vers;
+	rpcvers_t	nmd_nfsvers;
+} nfs_mnt_data_t;
+
+/* number of transports to try */
+#define	MNT_PREF_LISTLEN	2
+#define	FIRST_TRY		1
+#define	SECOND_TRY		2
+
+#define	BIGRETRY	10000
+
+/* maximum length of RPC header for NFS messages */
+#define	NFS_RPC_HDR	432
+
+extern int __clnt_bindresvport(CLIENT *);
+
+static int set_args(int *, struct nfs_args *, char *, char *, nfs_mnt_data_t *);
+static int get_fh(struct nfs_args *, char *, char *, nfs_mnt_data_t *);
+static int make_secure(struct nfs_args *, nfs_mnt_data_t *);
+static int getaddr_nfs(struct nfs_args *, char *, struct netconfig **,
+	nfs_mnt_data_t *);
+
+static void
+log_err(const char *fmt, ...)
+{
+	va_list ap;
+	char buf[128];
+	int fd;
+
+	va_start(ap, fmt);
+	(void) vsnprintf(buf, sizeof (buf), fmt, ap);
+	va_end(ap);
+
+	if ((fd = open("/dev/conslog", O_WRONLY)) != -1) {
+		(void) write(fd, buf, strlen(buf));
+		(void) close(fd);
+	}
+}
+
+static int
+i_add_option(char *option, char *buf, size_t buf_size)
+{
+	int len;
+	char *fmt_str = NULL;
+
+	if (buf[0] == '\0') {
+		fmt_str = "%s";
+	} else {
+		fmt_str = ",%s";
+	}
+
+	len = strlen(buf);
+	buf_size -= len;
+	buf += len;
+
+	/*LINTED*/
+	if (snprintf(buf, buf_size, fmt_str, option) > (buf_size - 1))
+		return (-EOVERFLOW);
+	return (0);
+}
+
+/*
+ * These options were initially derived from uts/common/fs/nfs/nfs_dlinet.c
+ * but have been extended to add additional Linux options.
+ */
+static char *optlist[] = {
+#define	OPT_RO		0
+	MNTOPT_RO,
+#define	OPT_RW		1
+	MNTOPT_RW,
+#define	OPT_QUOTA	2
+	MNTOPT_QUOTA,
+#define	OPT_NOQUOTA	3
+	MNTOPT_NOQUOTA,
+#define	OPT_SOFT	4
+	MNTOPT_SOFT,
+#define	OPT_HARD	5
+	MNTOPT_HARD,
+#define	OPT_SUID	6
+	MNTOPT_SUID,
+#define	OPT_NOSUID	7
+	MNTOPT_NOSUID,
+#define	OPT_GRPID	8
+	MNTOPT_GRPID,
+#define	OPT_REMOUNT	9
+	MNTOPT_REMOUNT,
+#define	OPT_NOSUB	10
+	MNTOPT_NOSUB,
+#define	OPT_INTR	11
+	MNTOPT_INTR,
+#define	OPT_NOINTR	12
+	MNTOPT_NOINTR,
+#define	OPT_PORT	13
+	MNTOPT_PORT,
+#define	OPT_SECURE	14
+	MNTOPT_SECURE,
+#define	OPT_RSIZE	15
+	MNTOPT_RSIZE,
+#define	OPT_WSIZE	16
+	MNTOPT_WSIZE,
+#define	OPT_TIMEO	17
+	MNTOPT_TIMEO,
+#define	OPT_RETRANS	18
+	MNTOPT_RETRANS,
+#define	OPT_ACTIMEO	19
+	MNTOPT_ACTIMEO,
+#define	OPT_ACREGMIN	20
+	MNTOPT_ACREGMIN,
+#define	OPT_ACREGMAX	21
+	MNTOPT_ACREGMAX,
+#define	OPT_ACDIRMIN	22
+	MNTOPT_ACDIRMIN,
+#define	OPT_ACDIRMAX	23
+	MNTOPT_ACDIRMAX,
+#define	OPT_BG		24
+	MNTOPT_BG,
+#define	OPT_FG		25
+	MNTOPT_FG,
+#define	OPT_RETRY	26
+	MNTOPT_RETRY,
+#define	OPT_NOAC	27
+	MNTOPT_NOAC,
+#define	OPT_NOCTO	28
+	MNTOPT_NOCTO,
+#define	OPT_LLOCK	29
+	MNTOPT_LLOCK,
+#define	OPT_POSIX	30
+	MNTOPT_POSIX,
+#define	OPT_VERS	31
+	MNTOPT_VERS,
+#define	OPT_PROTO	32
+	MNTOPT_PROTO,
+#define	OPT_SEMISOFT	33
+	MNTOPT_SEMISOFT,
+#define	OPT_NOPRINT	34
+	MNTOPT_NOPRINT,
+#define	OPT_SEC		35
+	MNTOPT_SEC,
+#define	OPT_LARGEFILES	36
+	MNTOPT_LARGEFILES,
+#define	OPT_NOLARGEFILES 37
+	MNTOPT_NOLARGEFILES,
+#define	OPT_PUBLIC	38
+	MNTOPT_PUBLIC,
+#define	OPT_DIRECTIO	39
+	MNTOPT_FORCEDIRECTIO,
+#define	OPT_NODIRECTIO	40
+	MNTOPT_NOFORCEDIRECTIO,
+#define	OPT_XATTR	41
+	MNTOPT_XATTR,
+#define	OPT_NOXATTR	42
+	MNTOPT_NOXATTR,
+#define	OPT_DEVICES	43
+	MNTOPT_DEVICES,
+#define	OPT_NODEVICES	44
+	MNTOPT_NODEVICES,
+#define	OPT_SETUID	45
+	MNTOPT_SETUID,
+#define	OPT_NOSETUID	46
+	MNTOPT_NOSETUID,
+#define	OPT_EXEC	47
+	MNTOPT_EXEC,
+#define	OPT_NOEXEC	48
+	MNTOPT_NOEXEC,
+#define	OPT_MNT_VERS	49
+	"mountvers",
+#define	OPT_MNT_PORT	50
+	"mountport",
+#define	OPT_MNT_PROTO	51
+	"mountproto",
+
+	NULL
+};
+
+static int
+convert_int(int *val, char *str)
+{
+	long lval;
+
+	if (str == NULL || !isdigit(*str))
+		return (-1);
+
+	lval = strtol(str, &str, 10);
+	if (*str != '\0' || lval > INT_MAX)
+		return (-2);
+
+	*val = (int)lval;
+	return (0);
+}
+
+static int
+set_args(int *mntflags, struct nfs_args *args, char *fshost, char *mntopts,
+    nfs_mnt_data_t *nmdp)
+{
+	char *saveopt, *optstr, *opts, *newopts, *val;
+	int num;
+	int largefiles = 0;
+	int invalid = 0;
+	int attrpref = 0;
+	int optlen, oldlen;
+
+	args->flags = NFSMNT_INT;	/* default is "intr" */
+	args->flags |= NFSMNT_HOSTNAME;
+	args->flags |= NFSMNT_NEWARGS;	/* using extented nfs_args structure */
+	args->hostname = fshost;
+
+	oldlen = strlen(mntopts);
+	optstr = opts = strdup(mntopts);
+	if (opts == NULL)
+		return (-ENOMEM);
+	/* sizeof (MNTOPT_XXX) includes one extra byte we may need for "," */
+	optlen = oldlen + sizeof (MNTOPT_XATTR) + 1;
+	if (optlen > MAX_MNTOPT_STR)
+		return (-EINVAL);
+
+	newopts = malloc(optlen);
+	if (opts == NULL || newopts == NULL) {
+		if (opts)
+			free(opts);
+		if (newopts)
+			free(newopts);
+		return (-EINVAL);
+	}
+	newopts[0] = '\0';
+
+	while (*opts) {
+		invalid = 0;
+		saveopt = opts;
+		switch (getsubopt(&opts, optlist, &val)) {
+		case OPT_RO:
+			*mntflags |= MS_RDONLY;
+			break;
+		case OPT_RW:
+			*mntflags &= ~(MS_RDONLY);
+			break;
+		case OPT_QUOTA:
+		case OPT_NOQUOTA:
+			break;
+		case OPT_SOFT:
+			args->flags |= NFSMNT_SOFT;
+			args->flags &= ~(NFSMNT_SEMISOFT);
+			break;
+		case OPT_SEMISOFT:
+			args->flags |= NFSMNT_SOFT;
+			args->flags |= NFSMNT_SEMISOFT;
+			break;
+		case OPT_HARD:
+			args->flags &= ~(NFSMNT_SOFT);
+			args->flags &= ~(NFSMNT_SEMISOFT);
+			break;
+		case OPT_SUID:
+			*mntflags &= ~(MS_NOSUID);
+			break;
+		case OPT_NOSUID:
+			*mntflags |= MS_NOSUID;
+			break;
+		case OPT_GRPID:
+			args->flags |= NFSMNT_GRPID;
+			break;
+		case OPT_REMOUNT:
+			*mntflags |= MS_REMOUNT;
+			break;
+		case OPT_INTR:
+			args->flags |= NFSMNT_INT;
+			break;
+		case OPT_NOINTR:
+			args->flags &= ~(NFSMNT_INT);
+			break;
+		case OPT_NOAC:
+			args->flags |= NFSMNT_NOAC;
+			break;
+		case OPT_PORT:
+			if (convert_int(&num, val) != 0)
+				goto badopt;
+			nmdp->nmd_nfs_port = num;
+			break;
+
+		case OPT_NOCTO:
+			args->flags |= NFSMNT_NOCTO;
+			break;
+
+		case OPT_RSIZE:
+			if (convert_int(&args->rsize, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_RSIZE;
+			break;
+		case OPT_WSIZE:
+			if (convert_int(&args->wsize, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_WSIZE;
+			break;
+		case OPT_TIMEO:
+			if (convert_int(&args->timeo, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_TIMEO;
+			break;
+		case OPT_RETRANS:
+			if (convert_int(&args->retrans, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_RETRANS;
+			break;
+		case OPT_ACTIMEO:
+			if (convert_int(&args->acregmax, val) != 0)
+				goto badopt;
+			args->acdirmin = args->acregmin = args->acdirmax
+			    = args->acregmax;
+			args->flags |= NFSMNT_ACDIRMAX;
+			args->flags |= NFSMNT_ACREGMAX;
+			args->flags |= NFSMNT_ACDIRMIN;
+			args->flags |= NFSMNT_ACREGMIN;
+			break;
+		case OPT_ACREGMIN:
+			if (convert_int(&args->acregmin, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_ACREGMIN;
+			break;
+		case OPT_ACREGMAX:
+			if (convert_int(&args->acregmax, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_ACREGMAX;
+			break;
+		case OPT_ACDIRMIN:
+			if (convert_int(&args->acdirmin, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_ACDIRMIN;
+			break;
+		case OPT_ACDIRMAX:
+			if (convert_int(&args->acdirmax, val) != 0)
+				goto badopt;
+			args->flags |= NFSMNT_ACDIRMAX;
+			break;
+		case OPT_BG:
+			/* Ignored as does Linux kernel */
+			break;
+		case OPT_FG:
+			/* Ignored as does Linux kernel */
+			break;
+		case OPT_RETRY:
+			/* Ignored as does Linux kernel */
+			break;
+		case OPT_LLOCK:
+			args->flags |= NFSMNT_LLOCK;
+			break;
+		case OPT_POSIX:
+			nmdp->nmd_posix = 1;
+			break;
+		case OPT_VERS:
+			if (convert_int(&num, val) != 0)
+				goto badopt;
+			nmdp->nmd_nfsvers = (rpcvers_t)num;
+			break;
+		case OPT_PROTO:
+			if (val == NULL)
+				goto badopt;
+
+			nmdp->nmd_nfs_proto = (char *)malloc(strlen(val)+1);
+			if (!nmdp->nmd_nfs_proto)
+				return (-EINVAL);
+
+			(void) strncpy(nmdp->nmd_nfs_proto, val, strlen(val)+1);
+			break;
+
+		case OPT_NOPRINT:
+			args->flags |= NFSMNT_NOPRINT;
+			break;
+
+		case OPT_LARGEFILES:
+			largefiles = 1;
+			break;
+
+		case OPT_NOLARGEFILES:
+			free(optstr);
+			return (-EINVAL);
+
+		case OPT_SEC:
+			if (val == NULL)
+				return (-EINVAL);
+			/*
+			 * We initialize the nfs_sec struct as if we had the
+			 * basic /etc/nfssec.conf file.
+			 */
+			if (strcmp(val, "none") == 0) {
+				(void) strlcpy(nmdp->nmd_nfs_sec.sc_name,
+				    "none", MAX_NAME_LEN);
+				nmdp->nmd_nfs_sec.sc_nfsnum =
+				    nmdp->nmd_nfs_sec.sc_rpcnum = 0;
+			} else if (strcmp(val, "sys") == 0) {
+				(void) strlcpy(nmdp->nmd_nfs_sec.sc_name,
+				    "sys", MAX_NAME_LEN);
+				nmdp->nmd_nfs_sec.sc_nfsnum =
+				    nmdp->nmd_nfs_sec.sc_rpcnum = 1;
+			} else {
+				return (-EINVAL);
+			}
+			nmdp->nmd_sec_opt++;
+			break;
+
+		case OPT_DIRECTIO:
+			args->flags |= NFSMNT_DIRECTIO;
+			break;
+
+		case OPT_NODIRECTIO:
+			args->flags &= ~(NFSMNT_DIRECTIO);
+			break;
+
+		case OPT_XATTR:
+		case OPT_NOXATTR:
+			/*
+			 * VFS options; just need to get them into the
+			 * new mount option string and note we've seen them
+			 */
+			attrpref = 1;
+			break;
+
+		case OPT_MNT_VERS:
+			if (convert_int(&num, val) != 0)
+				goto badopt;
+			nmdp->nmd_mnt_vers = (rpcvers_t)num;
+			invalid = 1;	/* Invalid as a native option */
+			break;
+
+		case OPT_MNT_PORT:
+			if (convert_int(&num, val) != 0)
+				goto badopt;
+			nmdp->nmd_mnt_port = num;
+			invalid = 1;	/* Invalid as a native option */
+			break;
+
+		case OPT_MNT_PROTO:
+			if (val == NULL)
+				goto badopt;
+			nmdp->nmd_mnt_proto = strdup(val);
+			if (nmdp->nmd_mnt_proto == NULL)
+				return (-ENOMEM);
+			invalid = 1;	/* Invalid as a native option */
+			break;
+
+		default:
+			invalid = 1;
+			break;
+		}
+		if (!invalid) {
+			if (newopts[0] != '\0') {
+				(void) strlcat(newopts, ",", optlen);
+			}
+			(void) strlcat(newopts, saveopt, optlen);
+		}
+	}
+	/* Default is to turn extended attrs on */
+	if (!attrpref) {
+		if (newopts[0]) {
+			(void) strlcat(newopts, ",", optlen);
+		}
+		(void) strlcat(newopts, MNTOPT_XATTR, optlen);
+	}
+	(void) strlcpy(mntopts, newopts, oldlen);
+	free(newopts);
+	free(optstr);
+
+	/* ensure that only one secure mode is requested */
+	if (nmdp->nmd_sec_opt > 1)
+		return (-EINVAL);
+
+	/* ensure that the user isn't trying to get large files over V2 */
+	if (nmdp->nmd_nfsvers == NFS_VERSION && largefiles)
+		return (-EINVAL);
+
+	if (nmdp->nmd_nfsvers == NFS_V4) {
+		/*
+		 * NFSv4 specifies the TCP protocol and port 2049 - default to
+		 * these. The user-level mount code is not expected to pass
+		 * these in, but if it did, validate the proto value.
+		 */
+		if (nmdp->nmd_nfs_proto == NULL) {
+			nmdp->nmd_nfs_proto = strdup(NC_TCP);
+			if (nmdp->nmd_nfs_proto == NULL)
+				return (-ENOMEM);
+
+		} else if (strcmp(nmdp->nmd_nfs_proto, NC_TCP) != 0) {
+			return (-EINVAL);
+		}
+
+	} else {
+		/*
+		 * The user-level mount code normally passes in the proto, but
+		 * if it didn't for some reason, use a sensible default.
+		 * Otherwise we normally just validate the proto value and we
+		 * only support TCP or UDP.
+		 */
+		if (nmdp->nmd_nfs_proto == NULL) {
+			nmdp->nmd_nfs_proto = strdup(NC_TCP);
+			if (nmdp->nmd_nfs_proto == NULL)
+				return (-ENOMEM);
+
+		} else if (strcmp(nmdp->nmd_nfs_proto, NC_TCP) != 0 &&
+		    strcmp(nmdp->nmd_nfs_proto, NC_UDP) != 0) {
+			return (-EINVAL);
+		}
+	}
+
+	/*
+	 * The user-level mount code only passes the port when it is
+	 * non-standard.
+	 */
+	if (nmdp->nmd_nfs_port == 0) {
+		nmdp->nmd_nfs_port = NFS_PORT;
+	}
+
+	return (0);
+
+badopt:
+	free(optstr);
+	return (-EINVAL);
+}
+
+static int
+make_secure(struct nfs_args *args, nfs_mnt_data_t *nmdp)
+{
+	sec_data_t *secdata;
+
+	/*
+	 * Check to see if any secure mode is requested. If not, use default
+	 * security mode. Note: we currently only support sec=none and sec=sys.
+	 */
+	if (nmdp->nmd_sec_opt == 0) {
+		/* AUTH_UNIX is the default. */
+		(void) strlcpy(nmdp->nmd_nfs_sec.sc_name, "sys", MAX_NAME_LEN);
+		nmdp->nmd_nfs_sec.sc_nfsnum = nmdp->nmd_nfs_sec.sc_rpcnum = 1;
+		args->flags |= NFSMNT_SECDEFAULT;
+	}
+
+	secdata = malloc(sizeof (sec_data_t));
+	if (secdata == NULL)
+		return (-ENOMEM);
+
+	(void) memset(secdata, 0, sizeof (sec_data_t));
+
+	secdata->secmod = nmdp->nmd_nfs_sec.sc_nfsnum;
+	secdata->rpcflavor = nmdp->nmd_nfs_sec.sc_rpcnum;
+	secdata->uid = nmdp->nmd_nfs_sec.sc_uid;
+	secdata->flags = 0;
+	secdata->data = NULL;
+
+	args->nfs_args_ext = NFS_ARGS_EXTB;
+	args->nfs_ext_u.nfs_extB.secdata = secdata;
+
+	return (0);
+}
+
+/*
+ * Use our built-in netconfig table to lookup and construct a netconfig struct
+ * for the given netid.
+ */
+static struct netconfig *
+get_netconf(char *id)
+{
+	int i;
+	struct netconfig *nconf, *np;
+
+	if ((nconf = calloc(1, sizeof (struct netconfig))) == NULL)
+		return (NULL);
+
+	for (i = 0; i < N_NETCONF_ENTS; i++) {
+		np = &nca[i];
+		if (strcmp(np->nc_netid, id) != 0)
+			continue;
+
+		nconf->nc_semantics = np->nc_semantics;
+		if ((nconf->nc_netid = strdup(np->nc_netid)) == NULL)
+			goto out;
+		if ((nconf->nc_protofmly = strdup(np->nc_protofmly)) == NULL)
+			goto out;
+		if ((nconf->nc_proto = strdup(np->nc_proto)) == NULL)
+			goto out;
+		if ((nconf->nc_device = strdup(np->nc_device)) == NULL)
+			goto out;
+
+		return (nconf);
+	}
+
+out:
+	freenetconfigent(nconf);
+	return (NULL);
+}
+
+/*
+ * If the user provided a logical name for the NFS server, then the user-level
+ * mount command will have already resolved that name and passed it in using
+ * the 'addr' option (see convert_nfs_arg_str where we've already handled this).
+ * We construct a netbuf from that provided IP and a given port option.
+ *
+ * Note: this code may need to be revisited when we add IPv6 support.
+ */
+static struct netbuf *
+get_netbuf(struct netconfig *nconf, char *ip, ushort_t port)
+{
+	char buf[64];
+
+	assert(port != 0);
+	(void) snprintf(buf, sizeof (buf), "%s.%d.%d", ip,
+	    port >> 8 & 0xff, port & 0xff);
+	return (uaddr2taddr(nconf, buf));
+}
+
+/*
+ * Construct a CLIENT handle to talk to the mountd without having to contact
+ * the rpcbind daemon on the server. This works for both the TCP and UDP cases,
+ * but it is primarily intended to the handle the TCP case. As an aside, note
+ * that TCP is never used by the native NFS mount client, even when the
+ * 'proto=tcp' argument is given to the mount command. The native mount code
+ * always uses UDP to get a file handle from the mountd.
+ */
+static CLIENT *
+get_mountd_client(char *fshost, nfs_mnt_data_t *nmdp, int *fdp)
+{
+	struct netconfig *nconf;
+	struct netbuf *srvaddr;
+	CLIENT *cl = NULL;
+	rpcvers_t vers;
+	int fd;
+	struct t_bind *tbind = NULL;
+	struct t_info tinfo;
+
+	vers = nmdp->nmd_mnt_vers;
+	*fdp = -1;
+
+	if ((nconf = get_netconf(nmdp->nmd_mnt_proto)) == NULL)
+		return (NULL);
+
+	if ((srvaddr = get_netbuf(nconf, fshost, nmdp->nmd_mnt_port)) == NULL) {
+		freenetconfigent(nconf);
+		return (NULL);
+	}
+
+	tinfo.tsdu = 0;
+	if ((fd = t_open(nconf->nc_device, O_RDWR, &tinfo)) == -1)
+		goto done;
+
+	/* LINTED pointer alignment */
+	if ((tbind = (struct t_bind *)t_alloc(fd, T_BIND, T_ADDR)) == NULL) {
+		(void) t_close(fd);
+		goto done;
+	}
+
+	/* assign our srvaddr to tbind addr */
+	(void) memcpy(tbind->addr.buf, srvaddr->buf, srvaddr->len);
+	tbind->addr.len = srvaddr->len;
+
+	/*
+	 * For compatibility, the mountd call to get the file handle must come
+	 * from a privileged port.
+	 */
+	(void) netdir_options(nconf, ND_SET_RESERVEDPORT, fd, NULL);
+
+	cl = clnt_tli_create(fd, nconf, &tbind->addr, MOUNTPROG, vers, 0, 0);
+	if (cl == NULL) {
+		(void) t_close(fd);
+		/*
+		 * Unfortunately, a failure in the:
+		 *    clnt_tli_create -> set_up_connection -> t_connect
+		 * call path doesn't return any useful information about why we
+		 * had an error. We basically see the following rpc_createerr
+		 * status for a variety of conditions (e.g. invalid port, no
+		 * service at IP, timeout, etc.):
+		 *    rpc_createerr.cf_stat == RPC_TLIERROR
+		 *    rpc_createerr.cf_error.re_terrno == 9 (TLOOK)
+		 *    rpc_createerr.cf_error.re_errno == 0
+		 */
+	} else {
+		*fdp = fd;
+	}
+
+done:
+	if (tbind != NULL)
+		(void) t_free((char *)tbind, T_BIND);
+	free(srvaddr->buf);
+	free(srvaddr);
+	freenetconfigent(nconf);
+
+	return (cl);
+}
+
+static int
+get_fh_cleanup(CLIENT *cl, int fd, int err)
+{
+	if (cl != NULL)
+		clnt_destroy(cl);
+	if (fd != -1)
+		(void) t_close(fd);
+	assert(err <= 0);
+	return (err);
+}
+
+/*
+ * Get fhandle of remote path from server's mountd. This is only applicable to
+ * v2 or v3.
+ */
+static int
+get_fh(struct nfs_args *args, char *fshost, char *fspath, nfs_mnt_data_t *nmdp)
+{
+	struct fhstatus fhs;
+	struct mountres3 mountres3;
+	struct pathcnf p;
+	nfs_fh3 *fh3p;
+	struct timeval timeout = { 25, 0};
+	CLIENT *cl = NULL;
+	int fd = -1;
+	enum clnt_stat rpc_stat;
+	int count, i, *auths;
+
+	bzero(&fhs, sizeof (fhs));
+	bzero(&mountres3, sizeof (mountres3));
+	bzero(&p, sizeof (p));
+
+	/*
+	 * The user-level mount code should have contacted the server's rpcbind
+	 * daemon and passed us the mount protocol and port.
+	 */
+	if (nmdp->nmd_mnt_port == 0 || nmdp->nmd_mnt_proto == NULL ||
+	    nmdp->nmd_mnt_vers == 0) {
+		return (-EAGAIN);
+	}
+
+	cl = get_mountd_client(fshost, nmdp, &fd);
+	if (cl == NULL) {
+		/*
+		 * As noted in get_mountd_client, we don't get a good indication
+		 * as to why the connection failed. Linux returns ETIMEDOUT
+		 * under many of the same conditions, and our native code notes
+		 * that this is a common reason, so we do that here too.
+		 */
+		return (-ETIMEDOUT);
+	}
+
+	if ((cl->cl_auth = authsys_create_default()) == NULL) {
+		return (get_fh_cleanup(cl, fd, -EAGAIN));
+	}
+
+	if (nmdp->nmd_mnt_vers == 2) {
+		rpc_stat = clnt_call(cl, MOUNTPROC_MNT, xdr_dirpath,
+		    (caddr_t)&fspath, xdr_fhstatus, (caddr_t)&fhs, timeout);
+		if (rpc_stat != RPC_SUCCESS) {
+			log_err("%s:%s: server not responding %s\n",
+			    fshost, fspath, clnt_sperror(cl, ""));
+			return (get_fh_cleanup(cl, fd, -EAGAIN));
+		}
+
+		if ((errno = fhs.fhs_status) != MNT_OK) {
+			return (get_fh_cleanup(cl, fd, -fhs.fhs_status));
+		}
+		args->fh = malloc(sizeof (fhs.fhstatus_u.fhs_fhandle));
+		if (args->fh == NULL)
+			return (get_fh_cleanup(cl, fd, -EAGAIN));
+
+		(void) memcpy((caddr_t)args->fh,
+		    (caddr_t)&fhs.fhstatus_u.fhs_fhandle,
+		    sizeof (fhs.fhstatus_u.fhs_fhandle));
+		if (!errno && nmdp->nmd_posix) {
+			rpc_stat = clnt_call(cl, MOUNTPROC_PATHCONF,
+			    xdr_dirpath, (caddr_t)&fspath, xdr_ppathcnf,
+			    (caddr_t)&p, timeout);
+			if (rpc_stat != RPC_SUCCESS) {
+				log_err("%s:%s: server not responding %s\n",
+				    fshost, fspath, clnt_sperror(cl, ""));
+				free(args->fh);
+				return (get_fh_cleanup(cl, fd, -EAGAIN));
+			}
+			if (_PC_ISSET(_PC_ERROR, p.pc_mask)) {
+				free(args->fh);
+				return (get_fh_cleanup(cl, fd, -EAGAIN));
+			}
+			args->flags |= NFSMNT_POSIX;
+			args->pathconf = malloc(sizeof (p));
+			if (args->pathconf == NULL) {
+				free(args->fh);
+				return (get_fh_cleanup(cl, fd, -EAGAIN));
+			}
+			(void) memcpy((caddr_t)args->pathconf, (caddr_t)&p,
+			    sizeof (p));
+		}
+
+	} else { /* nmdp->nmd_mnt_vers == 3 */
+
+		rpc_stat = clnt_call(cl, MOUNTPROC_MNT, xdr_dirpath,
+		    (caddr_t)&fspath, xdr_mountres3, (caddr_t)&mountres3,
+		    timeout);
+		if (rpc_stat != RPC_SUCCESS) {
+			log_err("%s:%s: server not responding %s\n",
+			    fshost, fspath, clnt_sperror(cl, ""));
+			return (get_fh_cleanup(cl, fd, -EAGAIN));
+		}
+
+		/*
+		 * Assume here that most of the MNT3ERR_*
+		 * codes map into E* errors. See the nfsstat enum for values.
+		 */
+		if ((errno = mountres3.fhs_status) != MNT_OK) {
+			return (get_fh_cleanup(cl, fd, -mountres3.fhs_status));
+		}
+
+		fh3p = (nfs_fh3 *)malloc(sizeof (*fh3p));
+		if (fh3p == NULL)
+			return (get_fh_cleanup(cl, fd, -EAGAIN));
+
+		fh3p->fh3_length =
+		    mountres3.mountres3_u.mountinfo.fhandle.fhandle3_len;
+		(void) memcpy(fh3p->fh3_u.data,
+		    mountres3.mountres3_u.mountinfo.fhandle.fhandle3_val,
+		    fh3p->fh3_length);
+		args->fh = (caddr_t)fh3p;
+		nmdp->nmd_fstype = MNTTYPE_NFS3;
+
+		/*
+		 * If "sec=flavor" is a mount option, check if the server
+		 * supports the "flavor". If the server does not support the
+		 * flavor, return error. It is unlikely that the server will
+		 * not support "sys", although "none" may not be allowed.
+		 */
+		auths =
+		    mountres3.mountres3_u.mountinfo.auth_flavors
+		    .auth_flavors_val;
+		count =
+		    mountres3.mountres3_u.mountinfo.auth_flavors
+		    .auth_flavors_len;
+
+		if (count <= 0) {
+			return (get_fh_cleanup(cl, fd, -EAGAIN));
+		}
+
+		if (nmdp->nmd_sec_opt) {
+			for (i = 0; i < count; i++) {
+				if (auths[i] == nmdp->nmd_nfs_sec.sc_nfsnum)
+					break;
+			}
+			if (i == count)
+				return (get_fh_cleanup(cl, fd, -EACCES));
+		} else {
+			/* AUTH_SYS is our default. */
+			(void) strlcpy(nmdp->nmd_nfs_sec.sc_name, "sys",
+			    MAX_NAME_LEN);
+			nmdp->nmd_nfs_sec.sc_nfsnum =
+			    nmdp->nmd_nfs_sec.sc_rpcnum = 1;
+		}
+	}
+
+	return (get_fh_cleanup(cl, fd, 0));
+}
+
+/*
+ * Fill in the address for the server's NFS service and fill in a knetconfig
+ * structure for the transport that the service is available on.
+ */
+static int
+getaddr_nfs(struct nfs_args *args, char *fshost, struct netconfig **nconfp,
+    nfs_mnt_data_t *nmdp)
+{
+	struct stat sb;
+	struct netconfig *nconf = NULL;
+	struct knetconfig *knconfp;
+	struct t_info tinfo;
+	err_ret_t addr_error;
+
+	SET_ERR_RET(&addr_error, ERR_PROTO_NONE, 0);
+
+	/*
+	 * Given the values passed in from the user-land mount command (or our
+	 * built-in defaults), we should have the necessary NFS host address
+	 * info. We have already validated that we have a supported
+	 * nmd_nfs_proto.
+	 */
+	assert(nmdp->nmd_nfs_port != 0);
+	assert(nmdp->nmd_nfs_proto != NULL);
+	nconf = get_netconf(nmdp->nmd_nfs_proto);
+	assert(nconf != NULL);
+	args->addr = get_netbuf(nconf, fshost, nmdp->nmd_nfs_port);
+	if (args->addr == NULL)
+		return (-ENOMEM);
+	*nconfp = nconf;
+	tinfo.tsdu = 0;
+
+	/* This shouldn't fail unless the zone is misconfigured */
+	if (stat(nconf->nc_device, &sb) < 0)
+		return (-ENOSR);
+
+	knconfp = (struct knetconfig *)malloc(sizeof (*knconfp));
+	if (!knconfp)
+		return (-ENOMEM);
+
+	knconfp->knc_semantics = nconf->nc_semantics;
+	knconfp->knc_protofmly = nconf->nc_protofmly;
+	knconfp->knc_proto = nconf->nc_proto;
+	knconfp->knc_rdev = sb.st_rdev;
+	args->flags |= NFSMNT_KNCONF;
+	args->knconf = knconfp;
+
+	/* make sure we don't overload the transport */
+	if (tinfo.tsdu > 0 && tinfo.tsdu < NFS_MAXDATA + NFS_RPC_HDR) {
+		args->flags |= (NFSMNT_RSIZE | NFSMNT_WSIZE);
+		if (args->rsize == 0 || args->rsize > tinfo.tsdu - NFS_RPC_HDR)
+			args->rsize = tinfo.tsdu - NFS_RPC_HDR;
+		if (args->wsize == 0 || args->wsize > tinfo.tsdu - NFS_RPC_HDR)
+			args->wsize = tinfo.tsdu - NFS_RPC_HDR;
+	}
+
+	return (0);
+}
+
+static int
+append_opt(char *optstr, int len, char *k, char *v)
+{
+	int i;
+
+	for (i = 0; nmo_tab[i].nmo_lx_opt != NULL; i++) {
+		if (strcmp(k, nmo_tab[i].nmo_lx_opt) == 0) {
+			switch (nmo_tab[i].nmo_argtyp) {
+			case MOUNT_OPT_INVALID:
+				lx_unsupported("invalid NFS mount option: %s",
+				    k);
+				return (-EINVAL);
+
+			case MOUNT_OPT_PASTHRU:
+				if (*optstr != '\0')
+					(void) strlcat(optstr, ",", len);
+				if (v == NULL) {
+					(void) strlcat(optstr, k, len);
+				} else {
+					(void) strlcat(optstr, k, len);
+					(void) strlcat(optstr, "=", len);
+					(void) strlcat(optstr, v, len);
+				}
+				break;
+
+			case MOUNT_OPT_IGNORE:
+				break;
+
+			case MOUNT_OPT_TOKEN:
+				if (*optstr != '\0')
+					(void) strlcat(optstr, ",", len);
+				(void) strlcat(optstr,
+				    nmo_tab[i].nmo_il_opt, len);
+				break;
+
+			case MOUNT_OPT_HAS_ARG:
+				if (*optstr != '\0')
+					(void) strlcat(optstr, ",", len);
+				(void) strlcat(optstr,
+				    nmo_tab[i].nmo_il_opt, len);
+				(void) strlcat(optstr, "=", len);
+				(void) strlcat(optstr, v, len);
+				break;
+			}
+			break;
+		}
+	}
+
+	return (0);
+}
+
+static int
+get_nfs_kv(char *vs, char **kp, char **vp)
+{
+	char *p;
+
+	p = strchr(vs, '=');
+	if (p == NULL) {
+		*kp = vs;
+		return (1);
+	}
+
+	*vp = p + 1;
+	*p = '\0';
+	*kp = vs;
+	return (0);
+}
+
+/*
+ * Convert the Linux-specific opt string into an Illumos opt string. We also
+ * fix up the special string (host:/path) to use the address that the
+ * user-level mount code has looked up. This overwrites both the srcp special
+ * string and the mntopts string.
+ *
+ * example input string, given 'nolock' as the only user-level option:
+ *     nolock,vers=4,addr=127.0.0.1,clientaddr=0.0.0.0
+ *
+ * opt string (all one line) from a Centos 6 distro given 'nolock,vers=3' as
+ * the explicit options:
+ *     nolock,addr=127.0.0.1,vers=3,proto=tcp,mountvers=3,mountproto=tcp,
+ *     mountport=1892
+ *
+ * This is an example emitted by the Ubuntu 14.04 automounter for an explicit
+ * v3 mount:
+ *	timeo=60,soft,intr,sloppy,addr=10.88.88.200,vers=3,proto=tcp,
+ *	mountvers=3,mountproto=tcp,mountport=63484
+ */
+static int
+convert_nfs_arg_str(char *srcp, char *mntopts, nfs_mnt_data_t *nmdp)
+{
+	char *key, *val, *p;
+	char tmpbuf[MAX_MNTOPT_STR];
+	char *tbp = tmpbuf;
+	boolean_t no_sec = B_TRUE;
+	boolean_t no_addr = B_TRUE;
+
+	(void) strlcpy(tmpbuf, mntopts, sizeof (tmpbuf));
+	*mntopts = '\0';
+
+	while ((p = strsep(&tbp, ",")) != NULL) {
+		int tok;
+
+		tok = get_nfs_kv(p, &key, &val);
+
+		if (tok == 0) {
+			if (strcmp(key, "addr") == 0) {
+				/*
+				 * The Linux user-level code looked up the
+				 * address of the NFS server. We need to
+				 * substitute that into the special string.
+				 */
+				char *pp;
+				char spec[MAXPATHLEN + LX_NMD_MAXHOSTNAMELEN
+				    + 1];
+
+				(void) strlcpy(spec, srcp, sizeof (spec));
+				pp = strchr(spec, ':');
+				if (pp == NULL)
+					return (-EINVAL);
+
+				pp++;
+				(void) snprintf(srcp,
+				    MAXPATHLEN + LX_NMD_MAXHOSTNAMELEN + 1,
+				    "%s:%s", val, pp);
+
+				no_addr = B_FALSE;
+			} else if (strcmp(key, "clientaddr") == 0) {
+				/*
+				 * Ignore, this is an artifact of the
+				 * user-level lx mount code.
+				 */
+				/* EMPTY */
+			} else if (strcmp(key, "vers") == 0) {
+				/*
+				 * This may be implicitly or explicitly passed.
+				 * Check for the versions we want to support.
+				 */
+				int r;
+				int v = atoi(val);
+
+				if (v != 3 && v != 4)
+					return (-EINVAL);
+
+				r = append_opt(mntopts, MAX_MNTOPT_STR,
+				    key, val);
+				if (r != 0)
+					return (r);
+
+			} else if (strcmp(key, "sec") == 0) {
+				/*
+				 * Linux supports: none, sys, krb5, krb5i, and
+				 * krb5p. Of these, only none and sys overlap
+				 * with our current support. Anything else is
+				 * an error.
+				 */
+				int r;
+
+				if (strcmp(val, "none") != 0 &&
+				    strcmp(val, "sys") != 0)
+					return (-EINVAL);
+				r = append_opt(mntopts, MAX_MNTOPT_STR, key,
+				    val);
+				if (r != 0)
+					return (r);
+				no_sec = B_FALSE;
+			} else if (strcmp(key, "nolock") == 0) {
+				int r;
+				nmdp->nmd_nolock_opt = 1;
+				r = append_opt(mntopts, MAX_MNTOPT_STR, key,
+				    val);
+				if (r != 0)
+					return (r);
+			} else {
+				int r;
+
+				r = append_opt(mntopts, MAX_MNTOPT_STR,
+				    key, val);
+				if (r != 0)
+					return (r);
+			}
+		} else {
+			int r;
+
+			r = append_opt(mntopts, MAX_MNTOPT_STR, key, NULL);
+			if (r != 0)
+				return (r);
+		}
+	}
+
+	if (no_addr) {
+		/*
+		 * The Linux kernel requires an 'addr' option and will return
+		 * EINVAL if one has not been provided. In particular, this
+		 * behavior can be seen when the package which delivers NFS CLI
+		 * support (e.g. nfs-common on Ubuntu, nfs-utils on Centos,
+		 * etc.) is not installed. The generic mount command will not
+		 * implicitly pass in the 'addr' option, the kernel will return
+		 * EINVAL, and the mount will fail.
+		 */
+		return (-EINVAL);
+	}
+
+	if (no_sec) {
+		/*
+		 * XXX Temporarily work around missing DES auth by defaulting
+		 * to sec=sys.
+		 */
+		int r;
+
+		r = append_opt(mntopts, MAX_MNTOPT_STR, "sec", "sys");
+		if (r != 0)
+			return (r);
+	}
+
+	return (0);
+}
+
+int
+lx_nfs_mount(char *srcp, char *mntp, char *fst, int lx_flags, char *opts)
+{
+	int r;
+	int il_flags = 0;
+	nfs_mnt_data_t nmd, *nmdp = &nmd;
+	struct nfs_args *argp = NULL;
+	struct netconfig *nconf = NULL;
+	char *colonp;
+	char *path;
+	char *host;
+	char spec_buf[MAXPATHLEN + LX_NMD_MAXHOSTNAMELEN + 1];
+
+	bzero(&nmd, sizeof (nmd));
+	nmd.nmd_fstype = MNTTYPE_NFS;
+
+	/*
+	 * This will modify the special string so that the hostname passed
+	 * in will be replaced with the host address that the user-land code
+	 * looked up. This also converts the opts string so that we'll be
+	 * dealing with illumos options after this.
+	 */
+	if ((r = convert_nfs_arg_str(srcp, opts, nmdp)) < 0) {
+		return (r);
+	}
+
+	if (strcmp(fst, "nfs4") == 0)
+		nmdp->nmd_nfsvers = NFS_V4;
+
+	/* Linux seems to always allow overlay mounts */
+	il_flags |= MS_OVERLAY;
+
+	/* Convert some Linux flags to Illumos flags. */
+	if (lx_flags & LX_MS_RDONLY)
+		il_flags |= MS_RDONLY;
+	if (lx_flags & LX_MS_NOSUID)
+		il_flags |= MS_NOSUID;
+	if (lx_flags & LX_MS_REMOUNT)
+		il_flags |= MS_REMOUNT;
+
+	/*
+	 * Convert some Linux flags to Illumos option strings.
+	 */
+	if (lx_flags & LX_MS_STRICTATIME) {
+		/*
+		 * The "strictatime" mount option ensures that none of the
+		 * weaker atime-related mode options are in effect.
+		 */
+		lx_flags &= ~(LX_MS_RELATIME | LX_MS_NOATIME);
+	}
+	if ((lx_flags & LX_MS_NODEV) &&
+	    ((r = i_add_option("nodev", opts, MAX_MNTOPT_STR)) != 0))
+		return (r);
+	if ((lx_flags & LX_MS_NOEXEC) &&
+	    ((r = i_add_option("noexec", opts, MAX_MNTOPT_STR)) != 0))
+		return (r);
+	if ((lx_flags & LX_MS_NOATIME) &&
+	    ((r = i_add_option("noatime", opts, MAX_MNTOPT_STR)) != 0))
+		return (r);
+
+	(void) strlcpy(spec_buf, srcp, sizeof (spec_buf));
+	colonp = strchr(spec_buf, ':');
+	if (colonp == NULL)
+		return (-EINVAL);
+
+	*colonp = '\0';
+	host = spec_buf;
+	path = colonp + 1;
+
+	argp = (struct nfs_args *)malloc(sizeof (*argp));
+	if (argp == NULL)
+		return (-ENOMEM);
+
+	(void) memset(argp, 0, sizeof (*argp));
+	(void) memset(&nmdp->nmd_nfs_sec, 0, sizeof (seconfig_t));
+	nmdp->nmd_sec_opt = 0;
+
+	/* returns a negative errno */
+	if ((r = set_args(&il_flags, argp, host, opts, nmdp)) != 0)
+		goto out;
+
+	if (nmdp->nmd_nfsvers == NFS_V4) {
+		/*
+		 * In the case of version 4 there is no MOUNT program, thus no
+		 * need for an RPC to get a file handle.
+		 */
+		nmdp->nmd_fstype = MNTTYPE_NFS4;
+		argp->fh = strdup(path);
+		if (argp->fh == NULL) {
+			r = -ENOMEM;
+			goto out;
+		}
+	} else {
+		if ((r = get_fh(argp, host, path, nmdp)) < 0)
+			goto out;
+	}
+
+	if ((r = getaddr_nfs(argp, host, &nconf, nmdp)) < 0)
+		goto out;
+
+	if ((r = make_secure(argp, nmdp)) < 0)
+		goto out;
+
+	il_flags |= MS_DATA | MS_OPTIONSTR;
+
+	r = mount(srcp, mntp, il_flags, nmdp->nmd_fstype, argp, sizeof (*argp),
+	    opts, MAX_MNTOPT_STR);
+	if (r != 0) {
+		r = -errno;
+	} else if (nmdp->nmd_nolock_opt == 0) {
+		(void) syscall(SYS_brand, B_START_NFS_LOCKD);
+	}
+
+out:
+	if (nconf != NULL)
+		freenetconfigent(nconf);
+	if (argp->fh)
+		free(argp->fh);
+	if (argp->pathconf)
+		free(argp->pathconf);
+	if (argp->knconf)
+		free(argp->knconf);
+	if (argp->addr) {
+		free(argp->addr->buf);
+		free(argp->addr);
+	}
+	if (argp->nfs_ext_u.nfs_extB.secdata)
+		free(argp->nfs_ext_u.nfs_extB.secdata);
+	if (argp->syncaddr) {
+		free(argp->syncaddr->buf);
+		free(argp->syncaddr);
+	}
+	if (argp->netname)
+		free(argp->netname);
+	free(argp);
+	if (nmdp->nmd_nfs_proto != NULL)
+		free(nmdp->nmd_nfs_proto);
+
+	return (r);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/ptrace.c b/usr/src/lib/brand/lx/lx_brand/common/ptrace.c
new file mode 100644
index 0000000000..2c6f5041a1
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/ptrace.c
@@ -0,0 +1,105 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.  All rights reserved.
+ */
+
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_signal.h>
+#include <sys/lx_thread.h>
+#include <sys/lwp.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <procfs.h>
+#include <sys/frame.h>
+#include <strings.h>
+#include <signal.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+#include <sys/auxv.h>
+#include <thread.h>
+#include <pthread.h>
+#include <synch.h>
+#include <elf.h>
+#include <ieeefp.h>
+#include <assert.h>
+#include <libintl.h>
+#include <lx_syscall.h>
+
+/*
+ * Much of the Linux ptrace(2) emulation is performed in the kernel, and there
+ * is a block comment in "lx_ptrace.c" that describes the facility in some
+ * detail.
+ */
+
+
+void
+lx_ptrace_stop_if_option(int option, boolean_t child, ulong_t msg,
+    ucontext_t *ucp)
+{
+	/*
+	 * We call into the kernel to see if we need to stop for specific
+	 * ptrace(2) events.
+	 */
+	lx_debug("lx_ptrace_stop_if_option(%d, %s, %lu, %p)", option,
+	    child ? "TRUE [child]" : "FALSE [parent]", msg, ucp);
+	if (ucp == NULL) {
+		ucp = (ucontext_t *)lx_find_brand_uc();
+		lx_debug("\tucp = %p", ucp);
+	}
+	if (syscall(SYS_brand, B_PTRACE_STOP_FOR_OPT, option, child, msg,
+	    ucp) != 0) {
+		if (errno != ESRCH) {
+			/*
+			 * This should _only_ fail if we are not traced, or do
+			 * not have this option set.
+			 */
+			lx_err_fatal("B_PTRACE_STOP_FOR_OPT failed: %s",
+			    strerror(errno));
+		}
+	}
+}
+
+/*
+ * Signal to the in-kernel ptrace(2) subsystem that the next native fork() or
+ * thr_create() is part of an emulated fork(2) or clone(2).  If PTRACE_CLONE
+ * was passed to clone(2), inherit_flag should be B_TRUE.
+ */
+void
+lx_ptrace_clone_begin(int option, boolean_t inherit_flag, int flags)
+{
+	lx_debug("lx_ptrace_clone_begin(%d, %sPTRACE_CLONE)", option,
+	    inherit_flag ? "" : "!");
+	if (syscall(SYS_brand, B_PTRACE_CLONE_BEGIN, option,
+	    inherit_flag, flags) != 0) {
+		lx_err_fatal("B_PTRACE_CLONE_BEGIN failed: %s",
+		    strerror(errno));
+	}
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/sendfile.c b/usr/src/lib/brand/lx/lx_brand/common/sendfile.c
new file mode 100644
index 0000000000..c09e8c51dc
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/sendfile.c
@@ -0,0 +1,143 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * lx_sendfile() and lx_sendfile64() are primarily branded versions of the
+ * library calls available in the Solaris libsendfile (see sendfile(3EXT)).
+ */
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+#include <sys/sendfile.h>
+#include <string.h>
+#include <errno.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+
+#if defined(_ILP32)
+long
+lx_sendfile(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4)
+{
+	sysret_t rval;
+	off_t off = 0;
+	off_t *offp = (off_t *)p3;
+	int error;
+	struct sendfilevec sfv;
+	size_t xferred = 0;
+	size_t sz = (size_t)p4;
+
+	if (offp == NULL) {
+		/* If no offp, we must use the current offset */
+		if ((off = lseek((int)p2, 0, SEEK_CUR)) == -1)
+			return (-errno);
+	} else {
+		if (sz > 0 && uucopy(offp, &off, sizeof (off)) != 0)
+			return (-errno);
+		if (off < 0)
+			return (-EINVAL);
+	}
+
+	sfv.sfv_fd = p2;
+	sfv.sfv_flag = 0;
+	sfv.sfv_off = off;
+	sfv.sfv_len = sz;
+	error = __systemcall(&rval, SYS_sendfilev, SENDFILEV, p1, &sfv,
+	    1, &xferred);
+
+	/* Suppress errors if we were able to write any data at all. */
+	if (xferred > 0) {
+		error = 0;
+	}
+
+	if (error == 0) {
+		off += xferred;
+		if (offp == NULL) {
+			/* If no offp, we must adjust current offset */
+			if (lseek((int)p2, off, SEEK_SET) == -1)
+				return (-errno);
+		} else {
+			if (uucopy(&off, offp, sizeof (off)) != 0) {
+				return (-EFAULT);
+			}
+		}
+	}
+
+	return (error ? -error : xferred);
+}
+#endif
+
+long
+lx_sendfile64(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4)
+{
+	sysret_t rval;
+	off64_t off = 0;
+	off64_t *offp = (off64_t *)p3;
+	size_t sz = (size_t)p4;
+	int error;
+	struct sendfilevec64 sfv;
+	size_t xferred;
+
+	if (offp == NULL) {
+		/* If no offp, we must use the current offset */
+		if ((off = lseek((int)p2, 0, SEEK_CUR)) == -1)
+			return (-errno);
+	} else {
+		if (sz > 0 && uucopy(offp, &off, sizeof (off)) != 0)
+			return (-errno);
+		if (off < 0)
+			return (-EINVAL);
+	}
+
+	sfv.sfv_fd = p2;
+	sfv.sfv_flag = 0;
+	sfv.sfv_off = off;
+	sfv.sfv_len = sz;
+	xferred = 0;
+	error = __systemcall(&rval, SYS_sendfilev, SENDFILEV64, p1, &sfv,
+	    1, &xferred);
+
+	/* Suppress errors if we were able to write any data at all. */
+	if (xferred > 0) {
+		error = 0;
+	}
+
+	if (error == 0) {
+		off += xferred;
+		if (offp == NULL) {
+			/* If no offp, we must adjust current offset */
+			if (lseek((int)p2, off, SEEK_SET) == -1)
+				return (-errno);
+		} else {
+			if (uucopy(&off, offp, sizeof (off)) != 0) {
+				return (-EFAULT);
+			}
+		}
+	}
+
+	return (error ? -error : xferred);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/signal.c b/usr/src/lib/brand/lx/lx_brand/common/signal.c
new file mode 100644
index 0000000000..a8e3601cb9
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/signal.c
@@ -0,0 +1,2392 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc. All rights reserved.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/segments.h>
+#include <sys/lx_types.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_poll.h>
+#include <sys/lx_signal.h>
+#include <sys/lx_sigstack.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_thread.h>
+#include <sys/lx_userhz.h>
+#include <sys/syscall.h>
+#include <lx_provider_impl.h>
+#include <sys/stack.h>
+#include <assert.h>
+#include <errno.h>
+#include <poll.h>
+#include <rctl.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <thread.h>
+#include <ucontext.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <libintl.h>
+#include <ieeefp.h>
+#include <sys/signalfd.h>
+
+#if defined(_ILP32)
+extern int pselect_large_fdset(int nfds, fd_set *in0, fd_set *out0, fd_set *ex0,
+	const timespec_t *tsp, const sigset_t *sp);
+#endif
+
+#define	MIN(a, b)	((a) < (b) ? (a) : (b))
+
+/*
+ * Delivering signals to a Linux process is complicated by differences in
+ * signal numbering, stack structure and contents, and the action taken when a
+ * signal handler exits.  In addition, many signal-related structures, such as
+ * sigset_ts, vary between Illumos and Linux.
+ *
+ * To support user-level signal handlers, the brand uses a double layer of
+ * indirection to process and deliver signals to branded threads.
+ *
+ * When a Linux process sends a signal using the kill(2) system call, we must
+ * translate the signal into the Illumos equivalent before handing control off
+ * to the standard signalling mechanism.  When a signal is delivered to a Linux
+ * process, we translate the signal number from Illumos to back to Linux.
+ * Translating signals both at generation and delivery time ensures both that
+ * Illumos signals are sent properly to Linux applications and that signals'
+ * default behavior works as expected.
+ *
+ * In a normal Illumos process, signal delivery is interposed on for any thread
+ * registering a signal handler by libc. Libc needs to do various bits of magic
+ * to provide thread-safe critical regions, so it registers its own handler,
+ * named sigacthandler(), using the sigaction(2) system call. When a signal is
+ * received, sigacthandler() is called, and after some processing, libc turns
+ * around and calls the user's signal handler via a routine named
+ * call_user_handler().
+ *
+ * Adding a Linux branded thread to the mix complicates things somewhat.
+ *
+ * First, when a thread receives a signal, it may either be running in an
+ * emulated Linux context or a native illumos context.  In either case, the
+ * in-kernel brand module is responsible for preserving the register state
+ * from the interrupted context, regardless of whether emulated or native
+ * software was running at the time.  The kernel is also responsible for
+ * ensuring that the illumos native sigacthandler() is called with register
+ * values appropriate for native code.  Of particular note is the %gs segment
+ * selector for 32-bit code, and the %fsbase segment base register for 64-bit
+ * code; these are used by libc to locate per-thread data structures.
+ *
+ * Second, the signal number translation referenced above must take place.
+ * Finally, when we hand control to the Linux signal handler we must do so
+ * on the brand stack, and with registers configured appropriately for the
+ * Linux application.
+ *
+ * This need to translate signal numbers (and manipulate the signal handling
+ * context) means that with standard Illumos libc, following a signal from
+ * generation to delivery looks something like:
+ *
+ * 	kernel ->
+ *	    sigacthandler() ->
+ *		call_user_handler() ->
+ *		    user signal handler
+ *
+ * but for the brand's Linux threads, this would look like:
+ *
+ *	kernel ->
+ *	    sigacthandler() ->
+ *		call_user_handler() ->
+ *		    lx_call_user_handler() ->
+ *			lx_sigdeliver() ->
+ *			    syscall(B_JUMP_TO_LINUX, ...) ->
+ *				Linux user signal handler
+ *
+ * The new addtions are:
+ *
+ * 	lx_call_user_handler
+ *	====================
+ *	This routine is responsible for translating Illumos signal numbers to
+ *	their Linux equivalents, building a Linux signal stack based on the
+ * 	information Illumos has provided, and passing the stack to the
+ *	registered Linux signal handler. It is, in effect, the Linux thread
+ *	equivalent to libc's call_user_handler().
+ *
+ * 	lx_sigdeliver
+ *	=============
+ *
+ * Note that none of this interposition is necessary unless a Linux thread
+ * registers a user signal handler, as the default action for all signals is the
+ * same between Illumos and Linux save for one signal, SIGPWR.  For this reason,
+ * the brand ALWAYS installs its own internal signal handler for SIGPWR that
+ * translates the action to the Linux default, to terminate the process.
+ * (Illumos' default action is to ignore SIGPWR.)
+ *
+ * A notable behavior of lx_sigdeliver is that it must replace the stack
+ * pointer in the context that will be handed to the Linux signal handler.
+ * There is at least one application (mono) which inspects the SP in the
+ * context it receives and which fails when the SP is not within the thread's
+ * stack range. There is not much else within the context that a signal
+ * handler could depend on, so we only ensure that the SP is from the Linux
+ * stack and not the alternate stack. lx_sigdeliver will restore the correct
+ * SP when setcontext returns into this function as part of returning from
+ * the signal handler.
+ *
+ * It is also important to note that when signals are not translated, the brand
+ * relies upon code interposing upon the wait(2) system call to translate
+ * signals to their proper values for any Linux threads retrieving the status
+ * of others.  So while the Illumos signal number for a particular signal is set
+ * in a process' data structures (and would be returned as the result of say,
+ * WTERMSIG()), the brand's interposiiton upon wait(2) is responsible for
+ * translating the value WTERMSIG() would return from a Illumos signal number
+ * to the appropriate Linux value.
+ *
+ * lx_call_user_handler() calls lx_sigdeliver() with a helper function
+ * (typically lx_build_signal_frame) which builds a stack frame for the 32-bit
+ * Linux signal handler, or populates a local (on the stack) structure for the
+ * 64-bit Linux signal handler. The stack at that time looks like this:
+ *
+ * 	=========================================================
+ * |	| lx_sigdeliver_frame_t -- includes LX_SIGRT_MAGIC and	|
+ * |	| a return context for the eventual sigreturn(2) call	|
+ * | 	=========================================================
+ * |	| Linux signal frame (32-bit) or local data		|
+ * V	| (64-bit) built by stack_builder()			|
+ * 	=========================================================
+ *
+ * The process of returning to an interrupted thread of execution from a user
+ * signal handler is entirely different between Illumos and Linux.  While
+ * Illumos generally expects to set the context to the interrupted one on a
+ * normal return from a signal handler, in the normal case Linux instead calls
+ * code that calls a specific Linux system call, rt_sigreturn(2) (or it also
+ * can call sigreturn(2) in 32-bit code).  Thus when a Linux signal handler
+ * completes execution, instead of returning through what would in libc be a
+ * call to setcontext(2), the rt_sigreturn(2) Linux system call is responsible
+ * for accomplishing much the same thing. It's for this reason that the stack
+ * frame we build has the lx_(rt_)sigreturn_tramp code on the top of the
+ * stack.  The code looks like this:
+ *
+ *	32-bit					64-bit
+ *	--------------------------------	-----------------------------
+ *	mov LX_SYS_rt_sigreturn, %eax		movq LX_SYS_rt_sigreturn, %rax
+ *	int $0x80				syscall
+ *
+ * We also use these same functions (lx_rt_sigreturn_tramp or
+ * lx_sigreturn_tramp) to actually return from the signal handler.
+ *
+ * (Note that this trampoline code actually lives in a proper executable segment
+ * and not on the stack, but gdb checks for the exact code sequence of the
+ * trampoline code on the stack to determine whether it is in a signal stack
+ * frame or not.  Really.)
+ *
+ * When the 32-bit Linux user signal handler is eventually called, the brand
+ * stack frame looks like this (in the case of a "modern" signal stack; see
+ * the lx_sigstack structure definition):
+ *
+ *	=========================================================
+ * |	| lx_sigdeliver_frame_t					|
+ * |	=========================================================
+ * |	| Trampoline code (marker for gdb, not really executed)	|
+ * |	=========================================================
+ * |	| Linux struct _fpstate					|
+ * |	=========================================================
+ * V	| Linux ucontext_t					| <--+
+ *	=========================================================    |
+ *	| Linux siginfo_t					| <--|-----+
+ *	=========================================================    |     |
+ *	| Pointer to Linux ucontext_t (or NULL)	(sigaction arg2)| ---+     |
+ *	=========================================================          |
+ *	| Pointer to Linux siginfo_t (or NULL)  (sigaction arg1)| ---------+
+ *	=========================================================
+ *	| Linux signal number                   (sigaction arg0)|
+ *	=========================================================
+ *	| Pointer to signal return code (trampoline code)	|
+ *	=========================================================
+ *
+ * The 64-bit stack-local data looks like this:
+ *
+ *	=========================================================
+ * |	| lx_sigdeliver_frame_t					|
+ * |	=========================================================
+ * |	| Trampoline code (marker for gdb, not really executed)	|
+ * |	=========================================================
+ * |	| Linux struct _fpstate					|
+ * |	=========================================================
+ * V	| Linux ucontext_t					| %rdx arg2
+ *	=========================================================
+ *	| Linux siginfo_t					| %rsi arg1
+ *	=========================================================
+ *	| Pointer to signal return code (trampoline code)	|
+ *	=========================================================
+ *
+ * As usual in 64-bit code, %rdi is arg0 which is the signal number.
+ *
+ * The *sigreturn(2) family of emulated system call handlers locates the
+ * "lx_sigdeliver_frame_t" struct on the Linux stack as part of processing
+ * the system call.  This object contains a guard value (LX_SIGRT_MAGIC) to
+ * detect stack smashing or an incorrect stack pointer.  It also contains a
+ * "return" context, which we use to get back to the "lx_sigdeliver()" frame
+ * on the native stack that originally dispatched to the Linux signal
+ * handler.  The lx_sigdeliver() function is then able to return to the
+ * native libc signal handler in the usual way.  This results in a further
+ * setcontext() back to whatever was running when we took the signal.
+ *
+ * There are some edge cases where the "return" context cannot be located
+ * by inspection of the Linux stack; e.g. if the guard value has been
+ * corrupted, or the emulated program has relocated parts of the signal
+ * delivery stack frame.  If this case is detected, a fallback mechanism is
+ * used to attempt to find the return context.  A chain of "lx_sigbackup_t"
+ * objects is maintained in signal interposer call frames, with the current
+ * head stored in the thread-specific "lx_tsd_t".  This mechanism is
+ * similar in principle to the "lwp_oldcontext" member of the "klwp_t" used
+ * by the native signal handling infrastructure.  This backup chain is used
+ * by the sigreturn(2) family of emulated system calls in the event that
+ * the Linux stack did not correctly reference a return context.
+ */
+
+typedef struct lx_sigdeliver_frame {
+	uintptr_t lxsdf_magic;
+	ucontext_t *lxsdf_retucp;
+	ucontext_t *lxsdf_sigucp;
+	lx_sigbackup_t *lxsdf_sigbackup;
+} lx_sigdeliver_frame_t;
+
+struct lx_oldsigstack {
+	void (*retaddr)();	/* address of real lx_sigreturn code */
+	int sig;		/* signal number */
+	lx_sigcontext_t sigc;	/* saved user context */
+	lx_fpstate_t fpstate;	/* saved FP state */
+	int sig_extra;		/* signal mask for signals [32 .. NSIG - 1] */
+	char trampoline[8];	/* code for trampoline to lx_sigreturn() */
+};
+
+/*
+ * The lx_sighandlers structure needs to be a global due to the semantics of
+ * clone().
+ *
+ * If CLONE_SIGHAND is set, the calling process and child share signal
+ * handlers, and if either calls sigaction(2) it should change the behavior
+ * in the other thread.  Each thread does, however, have its own signal mask
+ * and set of pending signals.
+ *
+ * If CLONE_SIGHAND is not set, the child process should inherit a copy of
+ * the signal handlers at the time of the clone() but later calls to
+ * sigaction(2) should only affect the individual thread calling it.
+ *
+ * This maps perfectly to a thr_create(3C) thread semantic in the first
+ * case and a fork(2)-type semantic in the second case.  By making
+ * lx_sighandlers global, we automatically get the correct behavior.
+ */
+static lx_sighandlers_t lx_sighandlers;
+
+static void lx_sigdeliver(int, siginfo_t *, ucontext_t *, size_t, void (*)(),
+    void (*)(), struct lx_sigaction *);
+
+/*
+ * stol_stack() and ltos_stack() convert between Illumos and Linux stack_t
+ * structures.
+ *
+ * These routines are needed because although the two structures have the same
+ * contents, their contents are declared in a different order, so the content
+ * of the structures cannot be copied with a simple bcopy().
+ */
+static void
+stol_stack(stack_t *fr, lx_stack_t *to)
+{
+	to->ss_sp = fr->ss_sp;
+	to->ss_flags = fr->ss_flags;
+	to->ss_size = fr->ss_size;
+}
+
+static void
+ltos_stack(lx_stack_t *fr, stack_t *to)
+{
+	to->ss_sp = fr->ss_sp;
+	to->ss_flags = fr->ss_flags;
+	to->ss_size = fr->ss_size;
+}
+
+static int
+ltos_sigset(lx_sigset_t *lx_sigsetp, sigset_t *s_sigsetp)
+{
+	lx_sigset_t l;
+	int lx_sig, sig;
+
+	if (uucopy(lx_sigsetp, &l, sizeof (lx_sigset_t)) != 0)
+		return (-errno);
+
+	(void) sigemptyset(s_sigsetp);
+
+	for (lx_sig = 1; lx_sig <= LX_NSIG; lx_sig++) {
+		if (lx_sigismember(&l, lx_sig) &&
+		    ((sig = ltos_signo[lx_sig]) > 0))
+			(void) sigaddset(s_sigsetp, sig);
+	}
+
+	return (0);
+}
+
+static int
+stol_sigset(sigset_t *s_sigsetp, lx_sigset_t *lx_sigsetp)
+{
+	lx_sigset_t l;
+	int sig, lx_sig;
+
+	bzero(&l, sizeof (lx_sigset_t));
+
+	for (sig = 1; sig < NSIG; sig++) {
+		if (sigismember(s_sigsetp, sig) &&
+		    ((lx_sig = stol_signo[sig]) > 0))
+			lx_sigaddset(&l, lx_sig);
+	}
+
+	return ((uucopy(&l, lx_sigsetp, sizeof (lx_sigset_t)) != 0)
+	    ? -errno : 0);
+}
+
+#if defined(_ILP32)
+static int
+ltos_osigset(lx_osigset_t *lx_osigsetp, sigset_t *s_sigsetp)
+{
+	lx_osigset_t lo;
+	int lx_sig, sig;
+
+	if (uucopy(lx_osigsetp, &lo, sizeof (lx_osigset_t)) != 0)
+		return (-errno);
+
+	(void) sigemptyset(s_sigsetp);
+
+	for (lx_sig = 1; lx_sig <= OSIGSET_NBITS; lx_sig++)
+		if ((lo & OSIGSET_BITSET(lx_sig)) &&
+		    ((sig = ltos_signo[lx_sig]) > 0))
+			(void) sigaddset(s_sigsetp, sig);
+
+	return (0);
+}
+
+static int
+stol_osigset(sigset_t *s_sigsetp, lx_osigset_t *lx_osigsetp)
+{
+	lx_osigset_t lo = 0;
+	int lx_sig, sig;
+
+	/*
+	 * Note that an lx_osigset_t can only represent the signals from
+	 * [1 .. OSIGSET_NBITS], so even though a signal may be present in the
+	 * Illumos sigset_t, it may not be representable as a bit in the
+	 * lx_osigset_t.
+	 */
+	for (sig = 1; sig < NSIG; sig++)
+		if (sigismember(s_sigsetp, sig) &&
+		    ((lx_sig = stol_signo[sig]) > 0) &&
+		    (lx_sig <= OSIGSET_NBITS))
+			lo |= OSIGSET_BITSET(lx_sig);
+
+	return ((uucopy(&lo, lx_osigsetp, sizeof (lx_osigset_t)) != 0)
+	    ? -errno : 0);
+}
+#endif
+
+static int
+ltos_sigcode(int si_code)
+{
+	switch (si_code) {
+		case LX_SI_USER:
+			return (SI_USER);
+		case LX_SI_TKILL:
+			return (SI_LWP);
+		case LX_SI_QUEUE:
+			return (SI_QUEUE);
+		case LX_SI_TIMER:
+			return (SI_TIMER);
+		case LX_SI_ASYNCIO:
+			return (SI_ASYNCIO);
+		case LX_SI_MESGQ:
+			return (SI_MESGQ);
+		default:
+			return (LX_SI_CODE_NOT_EXIST);
+	}
+}
+
+int
+stol_siginfo(siginfo_t *siginfop, lx_siginfo_t *lx_siginfop)
+{
+	int ret = 0;
+	lx_siginfo_t lx_siginfo;
+
+	bzero(&lx_siginfo, sizeof (*lx_siginfop));
+
+	if ((lx_siginfo.lsi_signo = stol_signo[siginfop->si_signo]) <= 0) {
+		/*
+		 * Depending on the caller we may still need to get a usable
+		 * converted siginfo struct.
+		 */
+		lx_siginfo.lsi_signo = LX_SIGKILL;
+		errno = EINVAL;
+		ret = -1;
+	}
+
+	lx_siginfo.lsi_code = lx_stol_sigcode(siginfop->si_code);
+	lx_siginfo.lsi_errno = siginfop->si_errno;
+
+	switch (lx_siginfo.lsi_signo) {
+		/*
+		 * Semantics ARE defined for SIGKILL, but since
+		 * we can't catch it, we can't translate it. :-(
+		 */
+		case LX_SIGPOLL:
+			lx_siginfo.lsi_band = siginfop->si_band;
+			lx_siginfo.lsi_fd = siginfop->si_fd;
+			break;
+
+		case LX_SIGCHLD:
+			lx_siginfo.lsi_pid = siginfop->si_pid;
+			if (siginfop->si_code <= 0 || siginfop->si_code ==
+			    CLD_EXITED) {
+				lx_siginfo.lsi_status = siginfop->si_status;
+			} else {
+				lx_siginfo.lsi_status = lx_stol_status(
+				    siginfop->si_status, -1);
+			}
+			lx_siginfo.lsi_utime =
+			    HZ_TO_LX_USERHZ(siginfop->si_utime);
+			lx_siginfo.lsi_stime =
+			    HZ_TO_LX_USERHZ(siginfop->si_stime);
+			break;
+
+		case LX_SIGILL:
+		case LX_SIGBUS:
+		case LX_SIGFPE:
+		case LX_SIGSEGV:
+			lx_siginfo.lsi_addr = siginfop->si_addr;
+			break;
+
+		default:
+			lx_siginfo.lsi_pid = siginfop->si_pid;
+			lx_siginfo.lsi_uid =
+			    LX_UID32_TO_UID16(siginfop->si_uid);
+			lx_siginfo.lsi_value = siginfop->si_value;
+			break;
+	}
+
+	if (uucopy(&lx_siginfo, lx_siginfop, sizeof (lx_siginfo_t)) != 0)
+		return (-errno);
+	return ((ret != 0) ? -errno : 0);
+}
+
+static void
+stol_fpstate(fpregset_t *fpr, lx_fpstate_t *lfpr)
+{
+	size_t copy_len;
+
+#if defined(_LP64)
+	/*
+	 * The 64-bit Illumos struct fpregset_t and lx_fpstate_t are identical
+	 * so just bcopy() those entries (see usr/src/uts/intel/sys/regset.h
+	 * for __amd64's struct fpu).
+	 */
+	copy_len = sizeof (fpr->fp_reg_set.fpchip_state);
+	bcopy(fpr, lfpr, copy_len);
+
+#else /* is _ILP32 */
+	struct _fpstate *fpsp = (struct _fpstate *)fpr;
+
+	/*
+	 * The Illumos struct _fpstate and lx_fpstate_t are identical from the
+	 * beginning of the structure to the lx_fpstate_t "magic" field, so
+	 * just bcopy() those entries.
+	 */
+	copy_len = (size_t)&(((lx_fpstate_t *)0)->magic);
+	bcopy(fpsp, lfpr, copy_len);
+
+	/*
+	 * These fields are all only significant for the first 16 bits.
+	 */
+	lfpr->cw &= 0xffff;		/* x87 control word */
+	lfpr->tag &= 0xffff;		/* x87 tag word */
+	lfpr->cssel &= 0xffff;		/* cs selector */
+	lfpr->datasel &= 0xffff;	/* ds selector */
+
+	/*
+	 * Linux wants the x87 status word field to contain the value of the
+	 * x87 saved exception status word.
+	 */
+	lfpr->sw = lfpr->status & 0xffff;	/* x87 status word */
+
+	lfpr->mxcsr = fpsp->mxcsr;
+
+	if (fpsp->mxcsr != 0) {
+		/*
+		 * Linux uses the "magic" field to denote whether the XMM
+		 * registers contain legal data or not.  Since we can't get to
+		 * %cr4 from userland to check the status of the OSFXSR bit,
+		 * check the mxcsr field to see if it's 0, which it should
+		 * never be on a system with the OXFXSR bit enabled.
+		 */
+		lfpr->magic = LX_X86_FXSR_MAGIC;
+		bcopy(fpsp->xmm, lfpr->_xmm, sizeof (lfpr->_xmm));
+	} else {
+		lfpr->magic = LX_X86_FXSR_NONE;
+	}
+#endif
+}
+
+static void
+ltos_fpstate(lx_fpstate_t *lfpr, fpregset_t *fpr)
+{
+	size_t copy_len;
+
+#if defined(_LP64)
+	/*
+	 * The 64-bit Illumos struct fpregset_t and lx_fpstate_t are identical
+	 * so just bcopy() those entries (see usr/src/uts/intel/sys/regset.h
+	 * for __amd64's struct fpu).
+	 */
+	copy_len = sizeof (fpr->fp_reg_set.fpchip_state);
+	bcopy(lfpr, fpr, copy_len);
+
+#else /* is _ILP32 */
+	struct _fpstate *fpsp = (struct _fpstate *)fpr;
+
+	/*
+	 * The lx_fpstate_t and Illumos struct _fpstate are identical from the
+	 * beginning of the structure to the struct _fpstate "mxcsr" field, so
+	 * just bcopy() those entries.
+	 *
+	 * Note that we do NOT have to propogate changes the user may have made
+	 * to the "status" word back to the "sw" word, unlike the way we have
+	 * to deal with processing the ESP and UESP register values on return
+	 * from a signal handler.
+	 */
+	copy_len = (size_t)&(((struct _fpstate *)0)->mxcsr);
+	bcopy(lfpr, fpsp, copy_len);
+
+	/*
+	 * These fields are all only significant for the first 16 bits.
+	 */
+	fpsp->cw &= 0xffff;		/* x87 control word */
+	fpsp->sw &= 0xffff;		/* x87 status word */
+	fpsp->tag &= 0xffff;		/* x87 tag word */
+	fpsp->cssel &= 0xffff;		/* cs selector */
+	fpsp->datasel &= 0xffff;	/* ds selector */
+	fpsp->status &= 0xffff;		/* saved status */
+
+	fpsp->mxcsr = lfpr->mxcsr;
+
+	if (lfpr->magic == LX_X86_FXSR_MAGIC)
+		bcopy(lfpr->_xmm, fpsp->xmm, sizeof (fpsp->xmm));
+#endif
+}
+
+/*
+ * We do not use the system sigaltstack() infrastructure as that would conflict
+ * with our handling of both system call emulation and native signals on the
+ * native stack.  Instead, we track the Linux stack structure in our
+ * thread-specific data.  This function is modeled on the behaviour of the
+ * native sigaltstack system call handler.
+ */
+long
+lx_sigaltstack(uintptr_t ssp, uintptr_t oss)
+{
+	lx_tsd_t *lxtsd = lx_get_tsd();
+	lx_stack_t ss;
+
+	if (ssp != NULL) {
+		if (lxtsd->lxtsd_sigaltstack.ss_flags & LX_SS_ONSTACK) {
+			/*
+			 * If we are currently using the installed alternate
+			 * stack for signal handling, the user may not modify
+			 * the stack for this thread.
+			 */
+			return (-EPERM);
+		}
+
+		if (uucopy((void *)ssp, &ss, sizeof (ss)) != 0) {
+			return (-EFAULT);
+		}
+
+		if (ss.ss_flags & ~LX_SS_DISABLE) {
+			/*
+			 * The user may not specify a value for flags other
+			 * than 0 or SS_DISABLE.
+			 */
+			return (-EINVAL);
+		}
+
+		if (!(ss.ss_flags & LX_SS_DISABLE) && ss.ss_size <
+		    LX_MINSIGSTKSZ) {
+			return (-ENOMEM);
+		}
+
+		if ((ss.ss_flags & LX_SS_DISABLE) != 0) {
+			ss.ss_sp = NULL;
+			ss.ss_size = 0;
+		}
+	}
+
+	if (oss != NULL) {
+		/*
+		 * User provided old and new stack_t pointers may point to
+		 * the same location.  Copy out before we modify.
+		 */
+		if (uucopy(&lxtsd->lxtsd_sigaltstack, (void *)oss,
+		    sizeof (lxtsd->lxtsd_sigaltstack)) != 0) {
+			return (-EFAULT);
+		}
+	}
+
+	if (ssp != NULL) {
+		lxtsd->lxtsd_sigaltstack = ss;
+	}
+
+	return (0);
+}
+
+#if defined(_ILP32)
+/*
+ * The following routines are needed because sigset_ts and siginfo_ts are
+ * different in format between Linux and Illumos.
+ *
+ * Note that there are two different lx_sigset structures, lx_sigset_ts and
+ * lx_osigset_ts:
+ *
+ *    + An lx_sigset_t is the equivalent of a Illumos sigset_t and supports
+ *	more than 32 signals.
+ *
+ *    + An lx_osigset_t is simply a uint32_t, so it by definition only supports
+ *	32 signals.
+ *
+ * When there are two versions of a routine, one prefixed with lx_rt_ and
+ * one prefixed with lx_ alone, in GENERAL the lx_rt_ routines deal with
+ * lx_sigset_ts while the lx_ routines deal with lx_osigset_ts.  Unfortunately,
+ * this is not always the case (e.g. lx_sigreturn() vs. lx_rt_sigreturn())
+ */
+long
+lx_sigpending(uintptr_t sigpend)
+{
+	sigset_t sigpendset;
+
+	if (sigpending(&sigpendset) != 0)
+		return (-errno);
+
+	return (stol_osigset(&sigpendset, (lx_osigset_t *)sigpend));
+}
+#endif
+
+long
+lx_rt_sigpending(uintptr_t sigpend, uintptr_t setsize)
+{
+	sigset_t sigpendset;
+
+	if ((size_t)setsize != sizeof (lx_sigset_t))
+		return (-EINVAL);
+
+	if (sigpending(&sigpendset) != 0)
+		return (-errno);
+
+	return (stol_sigset(&sigpendset, (lx_sigset_t *)sigpend));
+}
+
+/*
+ * Create a common routine to encapsulate all of the sigprocmask code,
+ * as the only difference between lx_sigprocmask() and lx_rt_sigprocmask()
+ * is the usage of lx_osigset_ts vs. lx_sigset_ts, as toggled in the code by
+ * the setting of the "sigset_type" flag.
+ */
+static int
+lx_sigprocmask_common(uintptr_t how, uintptr_t l_setp, uintptr_t l_osetp,
+    uintptr_t sigset_type)
+{
+	int err = 0;
+	sigset_t set, oset;
+	sigset_t *s_setp = NULL;
+	sigset_t *s_osetp;
+
+	if (l_setp) {
+		switch (how) {
+			case LX_SIG_BLOCK:
+				how = SIG_BLOCK;
+				break;
+
+			case LX_SIG_UNBLOCK:
+				how = SIG_UNBLOCK;
+				break;
+
+			case LX_SIG_SETMASK:
+				how = SIG_SETMASK;
+				break;
+
+			default:
+				return (-EINVAL);
+		}
+
+		s_setp = &set;
+
+		/* Only 32-bit code passes other than USE_SIGSET */
+		if (sigset_type == USE_SIGSET)
+			err = ltos_sigset((lx_sigset_t *)l_setp, s_setp);
+#if defined(_ILP32)
+		else
+			err = ltos_osigset((lx_osigset_t *)l_setp, s_setp);
+#endif
+
+		if (err != 0)
+			return (err);
+
+	}
+
+	s_osetp = (l_osetp ? &oset : NULL);
+
+	/*
+	 * In a multithreaded environment, a call to sigprocmask(2) should
+	 * only affect the current thread's signal mask so we don't need to
+	 * explicitly call thr_sigsetmask(3C) here.
+	 */
+	if (sigprocmask(how, s_setp, s_osetp) != 0)
+		return (-errno);
+
+	if (l_osetp) {
+		if (sigset_type == USE_SIGSET)
+			err = stol_sigset(s_osetp, (lx_sigset_t *)l_osetp);
+#if defined(_ILP32)
+		else
+			err = stol_osigset(s_osetp, (lx_osigset_t *)l_osetp);
+#endif
+
+		if (err != 0) {
+			/*
+			 * Encountered a fault while writing to the old signal
+			 * mask buffer, so unwind the signal mask change made
+			 * above.
+			 */
+			(void) sigprocmask(how, s_osetp, (sigset_t *)NULL);
+			return (err);
+		}
+	}
+
+	return (0);
+}
+
+#if defined(_ILP32)
+long
+lx_sigprocmask(uintptr_t how, uintptr_t setp, uintptr_t osetp)
+{
+	return (lx_sigprocmask_common(how, setp, osetp, USE_OSIGSET));
+}
+#endif
+
+long
+lx_rt_sigprocmask(uintptr_t how, uintptr_t setp, uintptr_t osetp,
+    uintptr_t setsize)
+{
+	if ((size_t)setsize != sizeof (lx_sigset_t))
+		return (-EINVAL);
+
+	return (lx_sigprocmask_common(how, setp, osetp, USE_SIGSET));
+}
+
+#if defined(_ILP32)
+long
+lx_sigsuspend(uintptr_t set)
+{
+	sigset_t s_set;
+
+	if (ltos_osigset((lx_osigset_t *)set, &s_set) != 0)
+		return (-errno);
+
+	return ((sigsuspend(&s_set) == -1) ? -errno : 0);
+}
+#endif
+
+long
+lx_rt_sigsuspend(uintptr_t set, uintptr_t setsize)
+{
+	sigset_t s_set;
+
+	if ((size_t)setsize != sizeof (lx_sigset_t))
+		return (-EINVAL);
+
+	if (ltos_sigset((lx_sigset_t *)set, &s_set) != 0)
+		return (-errno);
+
+	return ((sigsuspend(&s_set) == -1) ? -errno : 0);
+}
+
+long
+lx_rt_sigwaitinfo(uintptr_t set, uintptr_t sinfo, uintptr_t setsize)
+{
+	sigset_t s_set;
+	siginfo_t s_sinfo, *s_sinfop;
+	int rc;
+
+	lx_sigset_t *setp = (lx_sigset_t *)set;
+	lx_siginfo_t *sinfop = (lx_siginfo_t *)sinfo;
+
+	if ((size_t)setsize != sizeof (lx_sigset_t))
+		return (-EINVAL);
+
+	if (ltos_sigset(setp, &s_set) != 0)
+		return (-errno);
+
+	s_sinfop = (sinfop == NULL) ? NULL : &s_sinfo;
+
+	if ((rc = sigwaitinfo(&s_set, s_sinfop)) == -1)
+		return (-errno);
+
+	if (s_sinfop == NULL)
+		return (stol_signo[rc]);
+
+	return ((stol_siginfo(s_sinfop, sinfop) != 0)
+	    ? -errno : stol_signo[rc]);
+}
+
+long
+lx_rt_sigtimedwait(uintptr_t set, uintptr_t sinfo, uintptr_t toutp,
+    uintptr_t setsize)
+{
+	sigset_t s_set;
+	siginfo_t s_sinfo, *s_sinfop;
+	int rc;
+
+	lx_sigset_t *setp = (lx_sigset_t *)set;
+	lx_siginfo_t *sinfop = (lx_siginfo_t *)sinfo;
+
+	if ((size_t)setsize != sizeof (lx_sigset_t))
+		return (-EINVAL);
+
+	if (ltos_sigset(setp, &s_set) != 0)
+		return (-errno);
+
+	s_sinfop = (sinfop == NULL) ? NULL : &s_sinfo;
+
+	/*
+	 * "If timeout is the NULL pointer, the behavior is unspecified."
+	 * Match what LTP expects.
+	 */
+	if ((rc = sigtimedwait(&s_set, s_sinfop,
+	    (struct timespec *)toutp)) == -1)
+		return (toutp == NULL ? -EINTR : -errno);
+
+	if (s_sinfop == NULL)
+		return (stol_signo[rc]);
+
+	return ((stol_siginfo(s_sinfop, sinfop) != 0)
+	    ? -errno : stol_signo[rc]);
+}
+
+static void
+lx_sigreturn_find_native_context(const char *caller, ucontext_t **sigucp,
+    ucontext_t **retucp, uintptr_t sp)
+{
+	lx_tsd_t *lxtsd = lx_get_tsd();
+	lx_sigdeliver_frame_t *lxsdfp = (lx_sigdeliver_frame_t *)sp;
+	lx_sigdeliver_frame_t lxsdf;
+	boolean_t copy_ok;
+
+	lx_debug("%s: reading lx_sigdeliver_frame_t @ %p\n", caller, lxsdfp);
+	if (uucopy(lxsdfp, &lxsdf, sizeof (lxsdf)) != 0) {
+		lx_debug("%s: failed to read lx_sigdeliver_frame_t @ %p\n",
+		    lxsdfp);
+
+		copy_ok = B_FALSE;
+	} else {
+		lx_debug("%s: lxsdf: magic %p retucp %p sigucp %p\n", caller,
+		    lxsdf.lxsdf_magic, lxsdf.lxsdf_retucp, lxsdf.lxsdf_sigucp);
+
+		copy_ok = B_TRUE;
+	}
+
+	/*
+	 * lx_sigdeliver() pushes a lx_sigdeliver_frame_t onto the stack
+	 * before it creates the struct lx_oldsigstack.
+	 */
+	if (copy_ok && lxsdf.lxsdf_magic == LX_SIGRT_MAGIC) {
+		LX_SIGNAL_DELIVERY_FRAME_FOUND(lxsdfp);
+
+		/*
+		 * The guard value is intact; use the context pointers stored
+		 * in the signal delivery frame:
+		 */
+		*sigucp = lxsdf.lxsdf_sigucp;
+		*retucp = lxsdf.lxsdf_retucp;
+
+		/*
+		 * Ensure that the backup signal delivery chain is in sync with
+		 * the frame we are returning via:
+		 */
+		lxtsd->lxtsd_sigbackup = lxsdf.lxsdf_sigbackup;
+	} else {
+		/*
+		 * The guard value was not intact.  Either the program smashed
+		 * the stack unintentionally, or worse: intentionally moved
+		 * some parts of the signal delivery frame we constructed to
+		 * another location before calling rt_sigreturn(2).
+		 */
+		LX_SIGNAL_DELIVERY_FRAME_CORRUPT(lxsdfp);
+
+		if (lxtsd->lxtsd_sigbackup == NULL) {
+			/*
+			 * There was no backup context to use, so we must
+			 * kill the process.
+			 */
+			if (copy_ok) {
+				lx_err_fatal("%s: sp 0x%p, expected 0x%x, "
+				    "found 0x%lx!", caller, (void *)sp,
+				    LX_SIGRT_MAGIC,
+				    (unsigned long)lxsdf.lxsdf_magic);
+			} else {
+				lx_err_fatal("%s: sp 0x%p, could not read "
+				    "magic", caller, (void *)sp);
+			}
+		}
+
+		/*
+		 * Attempt to recover by using the backup signal delivery
+		 * chain:
+		 */
+		lx_debug("%s: SIGRT_MAGIC not found @ sp %p; using backup "
+		    "@ %p\n", caller, (void *)sp, lxtsd->lxtsd_sigbackup);
+		*sigucp = lxtsd->lxtsd_sigbackup->lxsb_sigucp;
+		*retucp = lxtsd->lxtsd_sigbackup->lxsb_retucp;
+	}
+}
+
+#if defined(_ILP32)
+/*
+ * Intercept the Linux sigreturn() syscall to turn it into the return through
+ * the libc call stack that Illumos expects.
+ *
+ * When control returns to libc's call_user_handler() routine, a setcontext(2)
+ * will be done that returns thread execution to the point originally
+ * interrupted by receipt of the signal.
+ *
+ * This is only used by 32-bit code.
+ */
+long
+lx_sigreturn(void)
+{
+	struct lx_oldsigstack *lx_ossp;
+	lx_sigset_t lx_sigset;
+	ucontext_t *ucp;
+	ucontext_t *sigucp;
+	ucontext_t *retucp;
+	uintptr_t sp;
+
+	ucp = lx_syscall_regs();
+
+	/*
+	 * NOTE:  The sp saved in the context is eight bytes off of where we
+	 *	  need it to be (either due to trampoline or the copying of
+	 *	  sp = uesp, not clear which).
+	 */
+	sp = LX_REG(ucp, REG_SP) - 8;
+
+	/*
+	 * At this point, the stack pointer should point to the struct
+	 * lx_oldsigstack that lx_build_old_signal_frame() constructed and
+	 * placed on the stack.  We need to reference it a bit later, so
+	 * save a pointer to it before incrementing our copy of the sp.
+	 */
+	lx_ossp = (struct lx_oldsigstack *)sp;
+	sp += SA(sizeof (struct lx_oldsigstack));
+
+	lx_sigreturn_find_native_context(__func__, &sigucp, &retucp, sp);
+
+	/*
+	 * We need to copy machine registers the Linux signal handler may have
+	 * modified back to the Illumos ucontext_t.
+	 *
+	 * General registers copy across as-is, except Linux expects that
+	 * changes made to uc_mcontext.gregs[ESP] will be reflected when the
+	 * interrupted thread resumes execution after the signal handler. To
+	 * emulate this behavior, we must modify uc_mcontext.gregs[UESP] to
+	 * match uc_mcontext.gregs[ESP] as Illumos will restore the UESP
+	 * value to ESP.
+	 */
+	lx_ossp->sigc.sc_esp_at_signal = lx_ossp->sigc.sc_esp;
+	bcopy(&lx_ossp->sigc, &sigucp->uc_mcontext, sizeof (gregset_t));
+
+	LX_SIGRETURN(NULL, sigucp, sp);
+
+	/* copy back FP regs if present */
+	if (lx_ossp->sigc.sc_fpstate != NULL)
+		ltos_fpstate(&lx_ossp->fpstate, &sigucp->uc_mcontext.fpregs);
+
+	/* convert Linux signal mask back to its Illumos equivalent */
+	bzero(&lx_sigset, sizeof (lx_sigset_t));
+	lx_sigset.__bits[0] = lx_ossp->sigc.sc_mask;
+	lx_sigset.__bits[1] = lx_ossp->sig_extra;
+	(void) ltos_sigset(&lx_sigset, &sigucp->uc_sigmask);
+
+	/*
+	 * For signal mask handling to be done properly, this call needs to
+	 * return to the libc routine that originally called the signal handler
+	 * rather than directly set the context back to the place the signal
+	 * interrupted execution as the original Linux code would do.
+	 */
+	lx_debug("lx_sigreturn: calling setcontext; retucp %p flags %lx "
+	    "link %p\n", retucp, retucp->uc_flags, retucp->uc_link);
+	(void) setcontext(retucp);
+	assert(0);
+
+	/*NOTREACHED*/
+	return (0);
+}
+#endif
+
+/*
+ * This signal return syscall is used by both 32-bit and 64-bit code.
+ */
+long
+lx_rt_sigreturn(void)
+{
+	struct lx_sigstack *lx_ssp;
+	lx_ucontext_t *lx_ucp;
+	ucontext_t *ucp;
+	ucontext_t *sigucp;
+	ucontext_t *retucp;
+	uintptr_t sp;
+
+	/*
+	 * Since we don't take the normal return path from this syscall, we
+	 * inform the kernel that we're returning, for the sake of ptrace.
+	 */
+	(void) syscall(SYS_brand, B_PTRACE_SIG_RETURN);
+
+	/* Get the registers at the emulated Linux rt_sigreturn syscall */
+	ucp = lx_syscall_regs();
+
+#if defined(_ILP32)
+	lx_debug("lx_rt_sigreturn: ESP %p UESP %p\n", LX_REG(ucp, ESP),
+	    LX_REG(ucp, UESP));
+	/*
+	 * For 32-bit
+	 *
+	 * NOTE:  Because of the silly compatibility measures done in the
+	 *	  signal trampoline code to make sure the stack holds the
+	 *	   _exact same_  instruction sequence Linux does, we have to
+	 *	  manually "pop" some extra instructions off the stack here
+	 *	  before passing the stack address to the syscall because the
+	 *	  trampoline code isn't allowed to do it due to the gdb
+	 *	  compatability issues.
+	 *
+	 *	  No, I'm not kidding.
+	 *
+	 *	  The sp saved in the context is eight bytes off of where we
+	 *	  need it to be (either due to trampoline or the copying of
+	 *	  sp = uesp, not clear which but looks like the uesp case), so
+	 *	  the need to pop the extra four byte instruction means we need
+	 *	  to subtract  a net four bytes from the sp before "popping" the
+	 *	  struct lx_sigstack off the stack.
+	 *
+	 *	  This will yield the value the stack pointer had before
+	 *	  lx_sigdeliver() created the stack frame for the Linux signal
+	 *	  handler.
+	 */
+	sp = (uintptr_t)LX_REG(ucp, REG_SP) - 4;
+#else
+	/*
+	 * We need to make an adjustment for 64-bit code as well. Since 64-bit
+	 * does not use the trampoline, it's probably for the same reason as
+	 * alluded to above.
+	 */
+	sp = (uintptr_t)LX_REG(ucp, REG_SP) - 8;
+#endif
+
+	/*
+	 * At this point, the stack pointer should point to the struct
+	 * lx_sigstack that lx_build_signal_frame() constructed and
+	 * placed on the stack.  We need to reference it a bit later, so
+	 * save a pointer to it before incrementing our copy of the sp.
+	 */
+	lx_ssp = (struct lx_sigstack *)sp;
+	sp += SA(sizeof (struct lx_sigstack));
+
+#if defined(_LP64)
+	/*
+	 * The 64-bit lx_sigdeliver() inserts 8 bytes of padding between
+	 * the lx_sigstack_t and the delivery frame to maintain ABI stack
+	 * alignment.
+	 */
+	sp += 8;
+#endif
+
+	lx_sigreturn_find_native_context(__func__, &sigucp, &retucp, sp);
+
+	/*
+	 * We need to copy machine registers the Linux signal handler may have
+	 * modified back to the Illumos version.
+	 */
+#if defined(_LP64)
+	lx_ucp = &lx_ssp->uc;
+
+	/*
+	 * General register layout is completely different.
+	 */
+	LX_REG(sigucp, REG_R15) = lx_ucp->uc_sigcontext.sc_r15;
+	LX_REG(sigucp, REG_R14) = lx_ucp->uc_sigcontext.sc_r14;
+	LX_REG(sigucp, REG_R13) = lx_ucp->uc_sigcontext.sc_r13;
+	LX_REG(sigucp, REG_R12) = lx_ucp->uc_sigcontext.sc_r12;
+	LX_REG(sigucp, REG_R11) = lx_ucp->uc_sigcontext.sc_r11;
+	LX_REG(sigucp, REG_R10) = lx_ucp->uc_sigcontext.sc_r10;
+	LX_REG(sigucp, REG_R9) = lx_ucp->uc_sigcontext.sc_r9;
+	LX_REG(sigucp, REG_R8) = lx_ucp->uc_sigcontext.sc_r8;
+	LX_REG(sigucp, REG_RDI) = lx_ucp->uc_sigcontext.sc_rdi;
+	LX_REG(sigucp, REG_RSI) = lx_ucp->uc_sigcontext.sc_rsi;
+	LX_REG(sigucp, REG_RBP) = lx_ucp->uc_sigcontext.sc_rbp;
+	LX_REG(sigucp, REG_RBX) = lx_ucp->uc_sigcontext.sc_rbx;
+	LX_REG(sigucp, REG_RDX) = lx_ucp->uc_sigcontext.sc_rdx;
+	LX_REG(sigucp, REG_RCX) = lx_ucp->uc_sigcontext.sc_rcx;
+	LX_REG(sigucp, REG_RAX) = lx_ucp->uc_sigcontext.sc_rax;
+	LX_REG(sigucp, REG_TRAPNO) = lx_ucp->uc_sigcontext.sc_trapno;
+	LX_REG(sigucp, REG_ERR) = lx_ucp->uc_sigcontext.sc_err;
+	LX_REG(sigucp, REG_RIP) = lx_ucp->uc_sigcontext.sc_rip;
+	LX_REG(sigucp, REG_CS) = lx_ucp->uc_sigcontext.sc_cs;
+	LX_REG(sigucp, REG_RFL) = lx_ucp->uc_sigcontext.sc_eflags;
+	LX_REG(sigucp, REG_RSP) = lx_ucp->uc_sigcontext.sc_rsp;
+	LX_REG(sigucp, REG_SS) = lx_ucp->uc_sigcontext.sc_pad0;
+	LX_REG(sigucp, REG_FS) = lx_ucp->uc_sigcontext.sc_fs;
+	LX_REG(sigucp, REG_GS) = lx_ucp->uc_sigcontext.sc_gs;
+
+#else /* is _ILP32 */
+	lx_ucp = &lx_ssp->uc;
+
+	/*
+	 * Illumos and Linux both follow the SysV i386 ABI layout for the
+	 * mcontext.
+	 *
+	 * General registers copy across as-is, except Linux expects that
+	 * changes made to uc_mcontext.gregs[ESP] will be reflected when the
+	 * interrupted thread resumes execution after the signal handler. To
+	 * emulate this behavior, we must modify uc_mcontext.gregs[UESP] to
+	 * match uc_mcontext.gregs[ESP] as Illumos will restore the UESP value
+	 * to ESP.
+	 */
+	lx_ucp->uc_sigcontext.sc_esp_at_signal = lx_ucp->uc_sigcontext.sc_esp;
+
+	bcopy(&lx_ucp->uc_sigcontext, &sigucp->uc_mcontext.gregs,
+	    sizeof (gregset_t));
+#endif
+
+	LX_SIGRETURN(lx_ucp, sigucp, sp);
+
+	if (lx_ucp->uc_sigcontext.sc_fpstate != NULL) {
+		ltos_fpstate(lx_ucp->uc_sigcontext.sc_fpstate,
+		    &sigucp->uc_mcontext.fpregs);
+	}
+
+	/*
+	 * Convert the Linux signal mask and stack back to their
+	 * Illumos equivalents.
+	 */
+	(void) ltos_sigset(&lx_ucp->uc_sigmask, &sigucp->uc_sigmask);
+	ltos_stack(&lx_ucp->uc_stack, &sigucp->uc_stack);
+
+	/*
+	 * For signal mask handling to be done properly, this call needs to
+	 * return to the libc routine that originally called the signal handler
+	 * rather than directly set the context back to the place the signal
+	 * interrupted execution as the original Linux code would do.
+	 */
+	lx_debug("lx_rt_sigreturn: calling setcontext; retucp %p\n", retucp);
+	(void) setcontext(retucp);
+	assert(0);
+
+	/*NOTREACHED*/
+	return (0);
+}
+
+
+#if defined(_ILP32)
+/*
+ * Build signal frame for processing for "old" (legacy) Linux signals
+ * This stack-builder function is only used by 32-bit code.
+ */
+/* ARGSUSED4 */
+static void
+lx_build_old_signal_frame(int lx_sig, siginfo_t *sip, void *p, void *sp,
+    uintptr_t *hargs)
+{
+	extern void lx_sigreturn_tramp();
+
+	lx_sigset_t lx_sigset;
+	ucontext_t *ucp = (ucontext_t *)p;
+	struct lx_sigaction *lxsap;
+	struct lx_oldsigstack *lx_ossp = sp;
+
+	lx_debug("building old signal frame for lx sig %d at 0x%p", lx_sig, sp);
+
+	lx_ossp->sig = lx_sig;
+	lxsap = &lx_sighandlers.lx_sa[lx_sig];
+	lx_debug("lxsap @ 0x%p", lxsap);
+
+	if (lxsap && (lxsap->lxsa_flags & LX_SA_RESTORER) &&
+	    lxsap->lxsa_restorer) {
+		lx_ossp->retaddr = lxsap->lxsa_restorer;
+		lx_debug("lxsa_restorer exists @ 0x%p", lx_ossp->retaddr);
+	} else {
+		lx_ossp->retaddr = lx_sigreturn_tramp;
+		lx_debug("lx_ossp->retaddr set to 0x%p", lx_sigreturn_tramp);
+	}
+
+	lx_debug("osf retaddr = 0x%p", lx_ossp->retaddr);
+
+	/* convert Illumos signal mask and stack to their Linux equivalents */
+	(void) stol_sigset(&ucp->uc_sigmask, &lx_sigset);
+	lx_ossp->sigc.sc_mask = lx_sigset.__bits[0];
+	lx_ossp->sig_extra = lx_sigset.__bits[1];
+
+	/*
+	 * General registers copy across as-is, except Linux expects that
+	 * uc_mcontext.gregs[ESP] == uc_mcontext.gregs[UESP] on receipt of a
+	 * signal.
+	 */
+	bcopy(&ucp->uc_mcontext, &lx_ossp->sigc, sizeof (gregset_t));
+	lx_ossp->sigc.sc_esp = lx_ossp->sigc.sc_esp_at_signal;
+
+	/*
+	 * cr2 contains the faulting address, and Linux only sets cr2 for a
+	 * a segmentation fault.
+	 */
+	lx_ossp->sigc.sc_cr2 = (((lx_sig == LX_SIGSEGV) && (sip)) ?
+	    (uintptr_t)sip->si_addr : 0);
+
+	/* convert FP regs if present */
+	if (ucp->uc_flags & UC_FPU) {
+		stol_fpstate(&ucp->uc_mcontext.fpregs, &lx_ossp->fpstate);
+		lx_ossp->sigc.sc_fpstate = &lx_ossp->fpstate;
+	} else {
+		lx_ossp->sigc.sc_fpstate = NULL;
+	}
+
+	/*
+	 * Believe it or not, gdb wants to SEE the trampoline code on the
+	 * bottom of the stack to determine whether the stack frame belongs to
+	 * a signal handler, even though this code is no longer actually
+	 * called.
+	 *
+	 * You can't make this stuff up.
+	 */
+	bcopy((void *)lx_sigreturn_tramp, lx_ossp->trampoline,
+	    sizeof (lx_ossp->trampoline));
+}
+#endif
+
+/*
+ * Build stack frame (32-bit) or stack local data (64-bit) for processing for
+ * modern Linux signals. This is the only stack-builder function for 64-bit
+ * code (32-bit code also calls this when using "modern" signals).
+ */
+/* ARGSUSED4 */
+static void
+lx_build_signal_frame(int lx_sig, siginfo_t *sip, void *p, void *sp,
+    uintptr_t *hargs)
+{
+	extern void lx_rt_sigreturn_tramp();
+
+	lx_ucontext_t *lx_ucp;
+	ucontext_t *ucp = (ucontext_t *)p;
+	struct lx_sigstack *lx_ssp = sp;
+	struct lx_sigaction *lxsap;
+
+	lx_debug("building signal frame for lx sig %d at 0x%p", lx_sig, sp);
+
+	lx_ucp = &lx_ssp->uc;
+#if defined(_ILP32)
+	/*
+	 * Arguments are passed to the 32-bit signal handler on the stack.
+	 */
+	lx_ssp->ucp = lx_ucp;
+	lx_ssp->sip = sip != NULL ? &lx_ssp->si : NULL;
+	lx_ssp->sig = lx_sig;
+#else
+	/*
+	 * Arguments to the 64-bit signal handler are passed in registers:
+	 *   hdlr(int sig, siginfo_t *sip, void *ucp);
+	 */
+	hargs[0] = lx_sig;
+	hargs[1] = sip != NULL ? (uintptr_t)&lx_ssp->si : NULL;
+	hargs[2] = (uintptr_t)lx_ucp;
+#endif
+
+	lxsap = &lx_sighandlers.lx_sa[lx_sig];
+	lx_debug("lxsap @ 0x%p", lxsap);
+
+	if (lxsap && (lxsap->lxsa_flags & LX_SA_RESTORER) &&
+	    lxsap->lxsa_restorer) {
+		/*
+		 * lxsa_restorer is explicitly set by sigaction in 32-bit code
+		 * but it can also be implicitly set for both 32 and 64 bit
+		 * code via lx_sigaction_common when we bcopy the user-supplied
+		 * lx_sigaction element into the proper slot in the sighandler
+		 * array.
+		 */
+		lx_ssp->retaddr = lxsap->lxsa_restorer;
+		lx_debug("lxsa_restorer exists @ 0x%p", lx_ssp->retaddr);
+	} else {
+		lx_ssp->retaddr = lx_rt_sigreturn_tramp;
+		lx_debug("lx_ssp->retaddr set to 0x%p", lx_rt_sigreturn_tramp);
+	}
+
+	/* Linux has these fields but always clears them to 0 */
+	lx_ucp->uc_flags = 0;
+	lx_ucp->uc_link = NULL;
+
+	/* convert Illumos signal mask and stack to their Linux equivalents */
+	(void) stol_sigset(&ucp->uc_sigmask, &lx_ucp->uc_sigmask);
+	stol_stack(&ucp->uc_stack, &lx_ucp->uc_stack);
+
+#if defined(_LP64)
+	/*
+	 * General register layout is completely different.
+	 */
+	lx_ucp->uc_sigcontext.sc_r8 = LX_REG(ucp, REG_R8);
+	lx_ucp->uc_sigcontext.sc_r9 = LX_REG(ucp, REG_R9);
+	lx_ucp->uc_sigcontext.sc_r10 = LX_REG(ucp, REG_R10);
+	lx_ucp->uc_sigcontext.sc_r11 = LX_REG(ucp, REG_R11);
+	lx_ucp->uc_sigcontext.sc_r12 = LX_REG(ucp, REG_R12);
+	lx_ucp->uc_sigcontext.sc_r13 = LX_REG(ucp, REG_R13);
+	lx_ucp->uc_sigcontext.sc_r14 = LX_REG(ucp, REG_R14);
+	lx_ucp->uc_sigcontext.sc_r15 = LX_REG(ucp, REG_R15);
+	lx_ucp->uc_sigcontext.sc_rdi = LX_REG(ucp, REG_RDI);
+	lx_ucp->uc_sigcontext.sc_rsi = LX_REG(ucp, REG_RSI);
+	lx_ucp->uc_sigcontext.sc_rbp = LX_REG(ucp, REG_RBP);
+	lx_ucp->uc_sigcontext.sc_rbx = LX_REG(ucp, REG_RBX);
+	lx_ucp->uc_sigcontext.sc_rdx = LX_REG(ucp, REG_RDX);
+	lx_ucp->uc_sigcontext.sc_rax = LX_REG(ucp, REG_RAX);
+	lx_ucp->uc_sigcontext.sc_rcx = LX_REG(ucp, REG_RCX);
+	lx_ucp->uc_sigcontext.sc_rsp = LX_REG(ucp, REG_RSP);
+	lx_ucp->uc_sigcontext.sc_rip = LX_REG(ucp, REG_RIP);
+	lx_ucp->uc_sigcontext.sc_eflags = LX_REG(ucp, REG_RFL);
+	lx_ucp->uc_sigcontext.sc_cs = LX_REG(ucp, REG_CS);
+	lx_ucp->uc_sigcontext.sc_gs = LX_REG(ucp, REG_GS);
+	lx_ucp->uc_sigcontext.sc_fs = LX_REG(ucp, REG_FS);
+	lx_ucp->uc_sigcontext.sc_pad0 = LX_REG(ucp, REG_SS);
+	lx_ucp->uc_sigcontext.sc_err = LX_REG(ucp, REG_ERR);
+	lx_ucp->uc_sigcontext.sc_trapno = LX_REG(ucp, REG_TRAPNO);
+
+#else /* is _ILP32 */
+	/*
+	 * General registers copy across as-is, except Linux expects that
+	 * uc_mcontext.gregs[ESP] == uc_mcontext.gregs[UESP] on receipt of a
+	 * signal.
+	 */
+	bcopy(&ucp->uc_mcontext, &lx_ucp->uc_sigcontext, sizeof (gregset_t));
+	lx_ucp->uc_sigcontext.sc_esp = lx_ucp->uc_sigcontext.sc_esp_at_signal;
+#endif
+
+	/*
+	 * cr2 contains the faulting address, which Linux only sets for a
+	 * a segmentation fault.
+	 */
+	lx_ucp->uc_sigcontext.sc_cr2 = ((lx_sig == LX_SIGSEGV) && (sip)) ?
+	    (uintptr_t)sip->si_addr : 0;
+
+	/*
+	 * This should only return an error if the signum is invalid but that
+	 * also gets converted into a LX_SIGKILL by this function.
+	 */
+	if (sip != NULL)
+		(void) stol_siginfo(sip, &lx_ssp->si);
+	else
+		bzero(&lx_ssp->si, sizeof (lx_siginfo_t));
+
+	/* convert FP regs if present */
+	if (ucp->uc_flags & UC_FPU) {
+		/*
+		 * Copy FP regs to the appropriate place in the the lx_sigstack
+		 * structure.
+		 */
+		stol_fpstate(&ucp->uc_mcontext.fpregs, &lx_ssp->fpstate);
+		lx_ucp->uc_sigcontext.sc_fpstate = &lx_ssp->fpstate;
+	} else {
+		lx_ucp->uc_sigcontext.sc_fpstate = NULL;
+	}
+
+#if defined(_ILP32)
+	/*
+	 * Believe it or not, gdb wants to SEE the sigreturn code on the
+	 * top of the stack to determine whether the stack frame belongs to
+	 * a signal handler, even though this code is not actually called.
+	 *
+	 * You can't make this stuff up.
+	 */
+	bcopy((void *)lx_rt_sigreturn_tramp, lx_ssp->trampoline,
+	    sizeof (lx_ssp->trampoline));
+#endif
+}
+
+/*
+ * This is the interposition handler for Linux signals.
+ */
+static void
+lx_call_user_handler(int sig, siginfo_t *sip, void *p)
+{
+	void (*user_handler)();
+	void (*stk_builder)();
+	struct lx_sigaction *lxsap;
+	ucontext_t *ucp = (ucontext_t *)p;
+	size_t stksize;
+	int lx_sig;
+
+	/*
+	 * If Illumos signal has no Linux equivalent, effectively ignore it.
+	 */
+	if ((lx_sig = stol_signo[sig]) == -1) {
+		lx_unsupported("caught Illumos signal %d, no Linux equivalent",
+		    sig);
+		return;
+	}
+
+	lx_debug("interpose caught Illumos signal %d, translating to Linux "
+	    "signal %d", sig, lx_sig);
+
+	lxsap = &lx_sighandlers.lx_sa[lx_sig];
+	lx_debug("lxsap @ 0x%p", lxsap);
+
+	if ((sig == SIGPWR) && (lxsap->lxsa_handler == SIG_DFL)) {
+		/*
+		 * Linux SIG_DFL for SIGPWR is to terminate. The lx wait
+		 * emulation will translate SIGPWR to LX_SIGPWR.
+		 */
+		(void) syscall(SYS_brand, B_EXIT_AS_SIG, SIGPWR);
+		/* This should never return */
+		assert(0);
+	}
+
+	if (lxsap->lxsa_handler == SIG_DFL || lxsap->lxsa_handler == SIG_IGN)
+		lx_err_fatal("lxsa_handler set to %s?  How?!?!?",
+		    (lxsap->lxsa_handler == SIG_DFL) ? "SIG_DFL" : "SIG_IGN");
+
+#if defined(_LP64)
+	stksize = sizeof (struct lx_sigstack);
+	stk_builder = lx_build_signal_frame;
+#else
+	if (lxsap->lxsa_flags & LX_SA_SIGINFO) {
+		stksize = sizeof (struct lx_sigstack);
+		stk_builder = lx_build_signal_frame;
+	} else  {
+		stksize = sizeof (struct lx_oldsigstack);
+		stk_builder = lx_build_old_signal_frame;
+	}
+#endif
+
+	user_handler = lxsap->lxsa_handler;
+
+	lx_debug("delivering %d (lx %d) to handler at 0x%p", sig, lx_sig,
+	    lxsap->lxsa_handler);
+
+	if (lxsap->lxsa_flags & LX_SA_RESETHAND)
+		lxsap->lxsa_handler = SIG_DFL;
+
+	lx_sigdeliver(lx_sig, sip, ucp, stksize, stk_builder, user_handler,
+	    lxsap);
+
+	/*
+	 * We need to handle restarting system calls if requested by the
+	 * program for this signal type:
+	 */
+	if (lxsap->lxsa_flags & LX_SA_RESTART) {
+		uintptr_t flags = (uintptr_t)ucp->uc_brand_data[0];
+		long ret = (long)LX_REG(ucp, REG_R0);
+		boolean_t interrupted = (ret == -lx_errno(EINTR, -1));
+
+		/*
+		 * If the system call returned EINTR, and the system
+		 * call handler set "br_syscall_restart" when returning,
+		 * we modify the context to try the system call again
+		 * when we return from this signal handler.
+		 */
+		if ((flags & LX_UC_RESTART_SYSCALL) && interrupted) {
+			int syscall_num = (int)(uintptr_t)ucp->uc_brand_data[2];
+
+			lx_debug("restarting interrupted system call %d",
+			    syscall_num);
+
+			/*
+			 * Both the "int 0x80" and the "syscall" instruction
+			 * are two bytes long.  Wind the program counter back
+			 * to the start of this instruction.
+			 *
+			 * The system call we interrupted is preserved in the
+			 * brand-specific data in the ucontext_t when the
+			 * LX_UC_RESTART_SYSCALL flag is set.  This is
+			 * analogous to the "orig_[er]ax" field in the Linux
+			 * "user_regs_struct".
+			 */
+			LX_REG(ucp, REG_PC) -= 2;
+			LX_REG(ucp, REG_R0) = syscall_num;
+		}
+	}
+}
+
+/*
+ * The "lx_sigdeliver()" function is responsible for constructing the emulated
+ * signal delivery frame on the brand stack for this LWP.  A context is saved
+ * on the stack which will be used by the "sigreturn(2)" family of emulated
+ * system calls to get us back here after the Linux signal handler returns.
+ * This function is modelled on the in-kernel "sendsig()" signal delivery
+ * mechanism.
+ */
+void
+lx_sigdeliver(int lx_sig, siginfo_t *sip, ucontext_t *ucp, size_t stacksz,
+    void (*stack_builder)(), void (*user_handler)(),
+    struct lx_sigaction *lxsap)
+{
+	lx_sigbackup_t sigbackup;
+	ucontext_t uc;
+	lx_tsd_t *lxtsd = lx_get_tsd();
+	int totsz = 0;
+	uintptr_t flags;
+	uintptr_t hargs[3];
+	uintptr_t orig_sp = 0;
+
+	/*
+	 * These variables must be "volatile", as they are modified after the
+	 * getcontext() stores the register state:
+	 */
+	volatile boolean_t signal_delivered = B_FALSE;
+	volatile boolean_t sp_modified = B_FALSE;
+	volatile uintptr_t lxfp = 0;
+	volatile uintptr_t old_tsd_sp = 0;
+	volatile int newstack = 0;
+
+	/*
+	 * This function involves modifying the Linux process stack for this
+	 * thread.  To do so without corruption requires us to exclude other
+	 * signal handlers (or emulated system calls called from within those
+	 * handlers) from running while we reserve space on that stack.  We
+	 * defer the execution of further instances of lx_call_user_handler()
+	 * until we have completed this operation.
+	 */
+	_sigoff();
+
+	/*
+	 * Clear register arguments vector.
+	 */
+	bzero(hargs, sizeof (hargs));
+
+	/* Save our SP so we can restore it after coming back in. */
+	orig_sp = LX_REG(ucp, REG_SP);
+
+	/*
+	 * We save a context here so that we can be returned later to complete
+	 * handling the signal.
+	 */
+	lx_debug("lx_sigdeliver: STORING RETURN CONTEXT @ %p\n", &uc);
+	assert(getcontext(&uc) == 0);
+	lx_debug("lx_sigdeliver: RETURN CONTEXT %p LINK %p FLAGS %lx\n",
+	    &uc, uc.uc_link, uc.uc_flags);
+	if (signal_delivered) {
+		/*
+		 * If the "signal_delivered" flag is set, we are returned here
+		 * via setcontext() as called by the emulated Linux signal
+		 * return system call.
+		 */
+		lx_debug("lx_sigdeliver: WE ARE BACK, VIA UC @ %p!\n", &uc);
+
+		if (sp_modified) {
+			/*
+			 * Restore the original stack pointer, which we saved
+			 * on our alt. stack, back into the context.
+			 */
+			LX_REG(ucp, REG_SP) = orig_sp;
+		}
+
+		goto after_signal_handler;
+	}
+	signal_delivered = B_TRUE;
+
+	/*
+	 * Preserve the current tsd value of the Linux process stack pointer,
+	 * even if it is zero.  We will restore it when we are returned here
+	 * via setcontext() after the Linux process has completed execution of
+	 * its signal handler.
+	 */
+	old_tsd_sp = lxtsd->lxtsd_lx_sp;
+
+	/*
+	 * Figure out whether we will be handling this signal on an alternate
+	 * stack specified by the user.
+	 */
+	newstack = (lxsap->lxsa_flags & LX_SA_ONSTACK) &&
+	    !(lxtsd->lxtsd_sigaltstack.ss_flags & (LX_SS_ONSTACK |
+	    LX_SS_DISABLE));
+
+	/*
+	 * Find the first unused region of the Linux process stack, where
+	 * we will assemble our signal delivery frame.
+	 */
+	flags = (uintptr_t)ucp->uc_brand_data[0];
+	if (newstack) {
+		/*
+		 * We are moving to the user-provided alternate signal
+		 * stack.
+		 */
+		lxfp = SA((uintptr_t)lxtsd->lxtsd_sigaltstack.ss_sp) +
+		    SA(lxtsd->lxtsd_sigaltstack.ss_size) - STACK_ALIGN;
+		lx_debug("lx_sigdeliver: moving to ALTSTACK sp %p\n", lxfp);
+		LX_SIGNAL_ALTSTACK_ENABLE(lxfp);
+	} else if (flags & LX_UC_STACK_BRAND) {
+		/*
+		 * We interrupted the Linux process to take this signal.  The
+		 * stack pointer is the one saved in this context.
+		 */
+		lxfp = LX_REG(ucp, REG_SP);
+	} else {
+		/*
+		 * We interrupted a native (emulation) routine, so we must get
+		 * the current stack pointer from either the tsd (if one is
+		 * stored there) or via the context chain.
+		 *
+		 */
+		lxfp = lx_find_brand_sp();
+		if (lxtsd->lxtsd_lx_sp != 0) {
+			/*
+			 * We must also make room for the possibility of nested
+			 * signal delivery -- we may be pre-empting the
+			 * in-progress handling of another signal.
+			 *
+			 * Note that if we were already on the alternate stack,
+			 * any emulated Linux system calls would be betwixt
+			 * that original signal frame and this new one on the
+			 * one contiguous stack, so this logic holds either
+			 * way:
+			 */
+			lxfp = MIN(lxtsd->lxtsd_lx_sp, lxfp);
+		}
+
+		/* Replace the context SP with the one from the Linux context */
+		LX_REG(ucp, REG_SP) = lxfp;
+		sp_modified = B_TRUE;
+	}
+
+	/*
+	 * Account for a reserved stack region (for amd64, this is 128 bytes),
+	 * and align the stack:
+	 */
+	lxfp -= STACK_RESERVE;
+	lxfp &= ~(STACK_ALIGN - 1);
+
+	/*
+	 * Allocate space on the Linux process stack for our delivery frame,
+	 * including:
+	 *
+	 *   ----------------------------------------------------- old %sp
+	 *   - lx_sigdeliver_frame_t
+	 *   - (ucontext_t pointers and stack magic)
+	 *   -----------------------------------------------------
+	 *   - (amd64-only 8-byte alignment gap)
+	 *   -----------------------------------------------------
+	 *   - frame of size "stacksz" from the stack builder
+	 *   ----------------------------------------------------- new %sp
+	 */
+#if defined(_LP64)
+	/*
+	 * The AMD64 ABI requires us to align the stack such that when the
+	 * called function pushes the base pointer, the stack is 16 byte
+	 * aligned.  The stack must, therefore, be 8- but _not_ 16-byte
+	 * aligned.
+	 */
+#if (STACK_ALIGN != 16) || (STACK_ENTRY_ALIGN != 8)
+#error "lx_sigdeliver() did not find expected stack alignment"
+#endif
+	totsz = SA(sizeof (lx_sigdeliver_frame_t)) + SA(stacksz) + 8;
+	assert((totsz & (STACK_ENTRY_ALIGN - 1)) == 0);
+	assert((totsz & (STACK_ALIGN - 1)) == 8);
+#else
+	totsz = SA(sizeof (lx_sigdeliver_frame_t)) + SA(stacksz);
+	assert((totsz & (STACK_ALIGN - 1)) == 0);
+#endif
+
+	/*
+	 * Copy our return frame into place:
+	 */
+	lxfp -= SA(sizeof (lx_sigdeliver_frame_t));
+	lx_debug("lx_sigdeliver: lx_sigdeliver_frame_t @ %p\n", lxfp);
+	{
+		lx_sigdeliver_frame_t frm;
+
+		frm.lxsdf_magic = LX_SIGRT_MAGIC;
+		frm.lxsdf_retucp = &uc;
+		frm.lxsdf_sigucp = ucp;
+		frm.lxsdf_sigbackup = &sigbackup;
+
+		lx_debug("lx_sigdeliver: retucp %p sigucp %p\n",
+		    frm.lxsdf_retucp, frm.lxsdf_sigucp);
+
+		if (uucopy(&frm, (void *)lxfp, sizeof (frm)) != 0) {
+			/*
+			 * We could not modify the stack of the emulated Linux
+			 * program.  Act like the kernel and terminate the
+			 * program with a segmentation violation.
+			 */
+			(void) syscall(SYS_brand, B_EXIT_AS_SIG, SIGSEGV);
+		}
+
+		LX_SIGNAL_DELIVERY_FRAME_CREATE((void *)lxfp);
+
+		/*
+		 * Populate a backup copy of signal linkage to use in case
+		 * the Linux program completely destroys (or relocates) the
+		 * delivery frame.
+		 *
+		 * This is necessary for programs that have flown so far off
+		 * the architectural rails that they believe it is
+		 * acceptable to make assumptions about the precise size and
+		 * layout of the signal handling frame assembled by the
+		 * kernel.
+		 */
+		sigbackup.lxsb_retucp = frm.lxsdf_retucp;
+		sigbackup.lxsb_sigucp = frm.lxsdf_sigucp;
+		sigbackup.lxsb_sigdeliver_frame = lxfp;
+		sigbackup.lxsb_previous = lxtsd->lxtsd_sigbackup;
+		lxtsd->lxtsd_sigbackup = &sigbackup;
+
+		lx_debug("lx_sigdeliver: installed sigbackup %p; prev %p\n",
+		    &sigbackup, sigbackup.lxsb_previous);
+	}
+
+	/*
+	 * Build the Linux signal handling frame:
+	 */
+#if defined(_LP64)
+	lxfp -= SA(stacksz) + 8;
+#else
+	lxfp -= SA(stacksz);
+#endif
+	lx_debug("lx_sigdeliver: Linux sig frame @ %p\n", lxfp);
+	stack_builder(lx_sig, sip, ucp, lxfp, hargs);
+
+	/*
+	 * Record our reservation so that any nested signal handlers
+	 * can see it.
+	 */
+	lx_debug("lx_sigdeliver: Linux tsd sp %p -> %p\n", lxtsd->lxtsd_lx_sp,
+	    lxfp);
+	lxtsd->lxtsd_lx_sp = lxfp;
+
+	if (newstack) {
+		lxtsd->lxtsd_sigaltstack.ss_flags |= LX_SS_ONSTACK;
+	}
+
+	LX_SIGDELIVER(lx_sig, lxsap, (void *)lxfp);
+
+	/*
+	 * Re-enable signal delivery.  If a signal was queued while we were
+	 * in the critical section, it will be delivered immediately.
+	 */
+	_sigon();
+
+	/*
+	 * Pass control to the Linux signal handler:
+	 */
+	lx_debug("lx_sigdeliver: JUMPING TO LINUX (sig %d sp %p eip %p)\n",
+	    lx_sig, lxfp, user_handler);
+	{
+		ucontext_t jump_uc;
+
+		bcopy(lx_find_brand_uc(), &jump_uc, sizeof (jump_uc));
+
+		/*
+		 * We want to load the general registers from this context, and
+		 * switch to the BRAND stack.  We do _not_ want to restore the
+		 * uc_link value from this synthetic context, as that would
+		 * break the signal handling context chain.
+		 */
+		jump_uc.uc_flags = UC_CPU;
+		jump_uc.uc_brand_data[0] = (void *)(LX_UC_STACK_BRAND |
+		    LX_UC_IGNORE_LINK);
+
+		LX_REG(&jump_uc, REG_FP) = 0;
+		LX_REG(&jump_uc, REG_SP) = lxfp;
+		LX_REG(&jump_uc, REG_PC) = (uintptr_t)user_handler;
+
+#if defined(_LP64)
+		/*
+		 * Pass signal handler arguments by registers on AMD64.
+		 */
+		LX_REG(&jump_uc, REG_RDI) = hargs[0];
+		LX_REG(&jump_uc, REG_RSI) = hargs[1];
+		LX_REG(&jump_uc, REG_RDX) = hargs[2];
+#endif
+
+		lx_jump_to_linux(&jump_uc);
+	}
+
+	assert(0);
+	abort();
+
+after_signal_handler:
+	/*
+	 * Ensure all nested signal handlers have completed correctly
+	 * and then remove our stack reservation.
+	 */
+	_sigoff();
+	LX_SIGNAL_POST_HANDLER(lxfp, old_tsd_sp);
+	assert(lxtsd->lxtsd_lx_sp == lxfp);
+	lx_debug("lx_sigdeliver: after; Linux tsd sp %p -> %p\n", lxfp,
+	    old_tsd_sp);
+	lxtsd->lxtsd_lx_sp = old_tsd_sp;
+	if (newstack) {
+		LX_SIGNAL_ALTSTACK_DISABLE();
+		lx_debug("lx_sigdeliver: disabling ALTSTACK sp %p\n", lxfp);
+		lxtsd->lxtsd_sigaltstack.ss_flags &= ~LX_SS_ONSTACK;
+	}
+	/*
+	 * Restore backup signal tracking chain pointer to previous value:
+	 */
+	if (lxtsd->lxtsd_sigbackup != NULL) {
+		lx_sigbackup_t *bprev = lxtsd->lxtsd_sigbackup->lxsb_previous;
+
+		lx_debug("lx_sigdeliver: restoring sigbackup %p to %p\n",
+		    lxtsd->lxtsd_sigbackup, bprev);
+
+		lxtsd->lxtsd_sigbackup = bprev;
+	}
+	_sigon();
+
+	/*
+	 * Here we return to libc so that it may clean up and restore the
+	 * context originally interrupted by this signal.
+	 */
+}
+
+/*
+ * Common routine to modify sigaction characteristics of a thread.
+ *
+ * We shouldn't need any special locking code here as we actually use our copy
+ * of libc's sigaction() to do all the real work, so its thread locking should
+ * take care of any issues for us.
+ */
+static int
+lx_sigaction_common(int lx_sig, struct lx_sigaction *lxsp,
+    struct lx_sigaction *olxsp)
+{
+	struct lx_sigaction *lxsap;
+	struct sigaction sa;
+
+	if (lx_sig <= 0 || lx_sig > LX_NSIG)
+		return (-EINVAL);
+
+	lxsap = &lx_sighandlers.lx_sa[lx_sig];
+	lx_debug("&lx_sighandlers.lx_sa[%d] = 0x%p", lx_sig, lxsap);
+
+	if ((olxsp != NULL) &&
+	    ((uucopy(lxsap, olxsp, sizeof (struct lx_sigaction))) != 0))
+		return (-errno);
+
+	if (lxsp != NULL) {
+		int err, sig;
+		struct lx_sigaction lxsa;
+		sigset_t new_set, oset;
+
+		if (uucopy(lxsp, &lxsa, sizeof (struct lx_sigaction)) != 0)
+			return (-errno);
+
+		if ((sig = ltos_signo[lx_sig]) != -1) {
+			if (lx_no_abort_handler) {
+				/*
+				 * If LX_NO_ABORT_HANDLER has been set, we will
+				 * not allow the emulated program to do
+				 * anything hamfisted with SIGSEGV or SIGABRT
+				 * signals.
+				 */
+				if (sig == SIGSEGV || sig == SIGABRT) {
+					return (0);
+				}
+			}
+
+			/*
+			 * Block this signal while messing with its dispostion
+			 */
+			(void) sigemptyset(&new_set);
+			(void) sigaddset(&new_set, sig);
+
+			if (sigprocmask(SIG_BLOCK, &new_set, &oset) < 0) {
+				err = errno;
+				lx_debug("unable to block signal %d: %d",
+				    sig, err);
+				return (-err);
+			}
+
+			/*
+			 * We don't really need the old signal disposition at
+			 * this point, but this weeds out signals that would
+			 * cause sigaction() to return an error before we change
+			 * anything other than the current signal mask.
+			 */
+			if (sigaction(sig, NULL, &sa) < 0) {
+				err = errno;
+				lx_debug("sigaction() to get old "
+				    "disposition for signal %d failed: %d",
+				    sig, err);
+				(void) sigprocmask(SIG_SETMASK, &oset, NULL);
+				return (-err);
+			}
+
+			if ((lxsa.lxsa_handler != SIG_DFL) &&
+			    (lxsa.lxsa_handler != SIG_IGN)) {
+				sa.sa_handler = lx_call_user_handler;
+
+				/*
+				 * The interposition signal handler needs the
+				 * information provided via the SA_SIGINFO flag.
+				 */
+				sa.sa_flags = SA_SIGINFO;
+
+				/*
+				 * When translating from Linux to illumos
+				 * sigaction(2) flags, we explicitly do not
+				 * pass SA_ONSTACK to the kernel.  The
+				 * alternate stack for Linux signal handling is
+				 * handled entirely by the emulation code.
+				 */
+				if (lxsa.lxsa_flags & LX_SA_NOCLDSTOP)
+					sa.sa_flags |= SA_NOCLDSTOP;
+				if (lxsa.lxsa_flags & LX_SA_NOCLDWAIT)
+					sa.sa_flags |= SA_NOCLDWAIT;
+				if (lxsa.lxsa_flags & LX_SA_RESTART)
+					sa.sa_flags |= SA_RESTART;
+				if (lxsa.lxsa_flags & LX_SA_NODEFER)
+					sa.sa_flags |= SA_NODEFER;
+
+				/*
+				 * RESETHAND cannot be used be passed through
+				 * for SIGPWR due to different default actions
+				 * between Linux and Illumos.
+				 */
+				if ((sig != SIGPWR) &&
+				    (lxsa.lxsa_flags & LX_SA_RESETHAND))
+					sa.sa_flags |= SA_RESETHAND;
+
+				if (ltos_sigset(&lxsa.lxsa_mask,
+				    &sa.sa_mask) != 0) {
+					err = errno;
+					(void) sigprocmask(SIG_SETMASK, &oset,
+					    NULL);
+					return (-err);
+				}
+
+				lx_debug("interposing handler @ 0x%p for "
+				    "signal %d (lx %d), flags 0x%x",
+				    lxsa.lxsa_handler, sig, lx_sig,
+				    lxsa.lxsa_flags);
+
+				if (sigaction(sig, &sa, NULL) < 0) {
+					err = errno;
+					lx_debug("sigaction() to set new "
+					    "disposition for signal %d failed: "
+					    "%d", sig, err);
+					(void) sigprocmask(SIG_SETMASK, &oset,
+					    NULL);
+					return (-err);
+				}
+			} else if ((sig != SIGPWR) ||
+			    ((sig == SIGPWR) &&
+			    (lxsa.lxsa_handler == SIG_IGN))) {
+				/*
+				 * There's no need to interpose for SIG_DFL or
+				 * SIG_IGN so just call our copy of libc's
+				 * sigaction(), but don't allow SIG_DFL for
+				 * SIGPWR due to differing default actions
+				 * between Linux and Illumos.
+				 *
+				 * Get the previous disposition first so things
+				 * like sa_mask and sa_flags are preserved over
+				 * a transition to SIG_DFL or SIG_IGN, which is
+				 * what Linux expects.
+				 */
+
+				sa.sa_handler = lxsa.lxsa_handler;
+
+				if (sigaction(sig, &sa, NULL) < 0) {
+					err = errno;
+					lx_debug("sigaction(%d, %s) failed: %d",
+					    sig, ((sa.sa_handler == SIG_DFL) ?
+					    "SIG_DFL" : "SIG_IGN"), err);
+					(void) sigprocmask(SIG_SETMASK, &oset,
+					    NULL);
+					return (-err);
+				}
+			}
+		} else {
+			lx_debug("Linux signal with no kill support "
+			    "specified: %d", lx_sig);
+		}
+
+		/*
+		 * Save the new disposition for the signal in the global
+		 * lx_sighandlers structure.
+		 */
+		bcopy(&lxsa, lxsap, sizeof (struct lx_sigaction));
+
+		/*
+		 * Reset the signal mask to what we came in with if
+		 * we were modifying a kill-supported signal.
+		 */
+		if (sig != -1)
+			(void) sigprocmask(SIG_SETMASK, &oset, NULL);
+	}
+
+	return (0);
+}
+
+#if defined(_ILP32)
+/*
+ * sigaction is only used in 32-bit code.
+ */
+long
+lx_sigaction(uintptr_t lx_sig, uintptr_t actp, uintptr_t oactp)
+{
+	int val;
+	struct lx_sigaction sa, osa;
+	struct lx_sigaction *sap, *osap;
+	struct lx_osigaction *osp;
+
+	sap = (actp ? &sa : NULL);
+	osap = (oactp ? &osa : NULL);
+
+	/*
+	 * If we have a source pointer, convert source lxsa_mask from
+	 * lx_osigset_t to lx_sigset_t format.
+	 */
+	if (sap) {
+		osp = (struct lx_osigaction *)actp;
+		sap->lxsa_handler = osp->lxsa_handler;
+
+		bzero(&sap->lxsa_mask, sizeof (lx_sigset_t));
+
+		for (val = 1; val <= OSIGSET_NBITS; val++)
+			if (osp->lxsa_mask & OSIGSET_BITSET(val))
+				(void) lx_sigaddset(&sap->lxsa_mask, val);
+
+		sap->lxsa_flags = osp->lxsa_flags;
+		sap->lxsa_restorer = osp->lxsa_restorer;
+	}
+
+	if ((val = lx_sigaction_common(lx_sig, sap, osap)))
+		return (val);
+
+	/*
+	 * If we have a save pointer, convert the old lxsa_mask from
+	 * lx_sigset_t to lx_osigset_t format.
+	 */
+	if (osap) {
+		osp = (struct lx_osigaction *)oactp;
+
+		osp->lxsa_handler = osap->lxsa_handler;
+
+		bzero(&osp->lxsa_mask, sizeof (osp->lxsa_mask));
+		for (val = 1; val <= OSIGSET_NBITS; val++)
+			if (lx_sigismember(&osap->lxsa_mask, val))
+				osp->lxsa_mask |= OSIGSET_BITSET(val);
+
+		osp->lxsa_flags = osap->lxsa_flags;
+		osp->lxsa_restorer = osap->lxsa_restorer;
+	}
+
+	return (0);
+}
+#endif
+
+long
+lx_rt_sigaction(uintptr_t lx_sig, uintptr_t actp, uintptr_t oactp,
+    uintptr_t setsize)
+{
+	/*
+	 * The "new" rt_sigaction call checks the setsize
+	 * parameter.
+	 */
+	if ((size_t)setsize != sizeof (lx_sigset_t))
+		return (-EINVAL);
+
+	return (lx_sigaction_common(lx_sig, (struct lx_sigaction *)actp,
+	    (struct lx_sigaction *)oactp));
+}
+
+#if defined(_ILP32)
+/*
+ * Convert signal syscall to a call to the lx_sigaction() syscall
+ * Only used in 32-bit code.
+ */
+long
+lx_signal(uintptr_t lx_sig, uintptr_t handler)
+{
+	struct sigaction act;
+	struct sigaction oact;
+	int rc;
+
+	/*
+	 * Use sigaction to mimic SYSV signal() behavior; glibc will
+	 * actually call sigaction(2) itself, so we're really reaching
+	 * back for signal(2) semantics here.
+	 */
+	bzero(&act, sizeof (act));
+	act.sa_handler = (void (*)())handler;
+	act.sa_flags = SA_RESETHAND | SA_NODEFER;
+
+	rc = lx_sigaction(lx_sig, (uintptr_t)&act, (uintptr_t)&oact);
+	return ((rc == 0) ? ((ssize_t)oact.sa_handler) : rc);
+}
+#endif
+
+void
+lx_sighandlers_save(lx_sighandlers_t *saved)
+{
+	bcopy(&lx_sighandlers, saved, sizeof (lx_sighandlers_t));
+}
+
+void
+lx_sighandlers_restore(lx_sighandlers_t *saved)
+{
+	bcopy(saved, &lx_sighandlers, sizeof (lx_sighandlers_t));
+}
+
+int
+lx_siginit(void)
+{
+	extern void set_setcontext_enforcement(int);
+	extern void set_escaped_context_cleanup(int);
+
+	struct sigaction sa;
+	sigset_t new_set, oset;
+	int lx_sig, sig;
+
+	/*
+	 * Block all signals possible while setting up the signal imposition
+	 * mechanism.
+	 */
+	(void) sigfillset(&new_set);
+
+	if (sigprocmask(SIG_BLOCK, &new_set, &oset) < 0)
+		lx_err_fatal("unable to block signals while setting up "
+		    "imposition mechanism: %s", strerror(errno));
+
+	/*
+	 * Ignore any signals that have no Linux analog so that those
+	 * signals cannot be sent to Linux processes from the global zone
+	 */
+	for (sig = 1; sig < NSIG; sig++)
+		if (stol_signo[sig] < 0)
+			(void) sigignore(sig);
+
+	/*
+	 * Mark any signals that are ignored as ignored in our interposition
+	 * handler array
+	 */
+	for (lx_sig = 1; lx_sig <= LX_NSIG; lx_sig++) {
+		if (((sig = ltos_signo[lx_sig]) != -1) &&
+		    (sigaction(sig, NULL, &sa) < 0))
+			lx_err_fatal("unable to determine previous disposition "
+			    "for signal %d: %s", sig, strerror(errno));
+
+		if (sa.sa_handler == SIG_IGN) {
+			lx_debug("marking signal %d (lx %d) as SIG_IGN",
+			    sig, lx_sig);
+			lx_sighandlers.lx_sa[lx_sig].lxsa_handler = SIG_IGN;
+		}
+	}
+
+	/*
+	 * Have our interposition handler handle SIGPWR to start with,
+	 * as it has a default action of terminating the process in Linux
+	 * but its default is to be ignored in Illumos.
+	 */
+	(void) sigemptyset(&sa.sa_mask);
+	sa.sa_sigaction = lx_call_user_handler;
+	sa.sa_flags = SA_SIGINFO;
+
+	if (sigaction(SIGPWR, &sa, NULL) < 0)
+		lx_err_fatal("sigaction(SIGPWR) failed: %s", strerror(errno));
+
+	/*
+	 * Illumos' libc forces certain register values in the ucontext_t
+	 * used to restore a post-signal user context to be those Illumos
+	 * expects; however that is not what we want to happen if the signal
+	 * was taken while branded code was executing, so we must disable
+	 * that behavior.
+	 */
+	set_setcontext_enforcement(0);
+
+	/*
+	 * The illumos libc attempts to clean up dangling uc_link pointers in
+	 * signal handling contexts when libc believes us to have escaped a
+	 * signal handler incorrectly in the past.  We want to disable this
+	 * behaviour, so that the system call emulation context saved by the
+	 * kernel brand module for lx_emulate() may be part of the context
+	 * chain without itself being used for signal handling.
+	 */
+	set_escaped_context_cleanup(0);
+
+	/*
+	 * Reset the signal mask to what we came in with.
+	 */
+	(void) sigprocmask(SIG_SETMASK, &oset, NULL);
+
+	lx_debug("interposition handler setup for SIGPWR");
+	return (0);
+}
+
+/*
+ * The first argument is the pid (Linux tgid) to send the signal to, second
+ * argument is the signal to send (an lx signal), and third is the siginfo_t
+ * with extra information. We translate the code and signal only from the
+ * siginfo_t, and leave everything else the same as it gets passed through the
+ * signalling system. This is enough to get sigqueue working. See Linux man
+ * page rt_sigqueueinfo(2).
+ */
+long
+lx_rt_sigqueueinfo(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	pid_t tgid = (pid_t)p1;
+	int lx_sig = (int)p2;
+	int sig;
+	lx_siginfo_t lx_siginfo;
+	siginfo_t siginfo;
+	int s_code;
+	pid_t s_pid;
+
+	if (uucopy((void *)p3, &lx_siginfo, sizeof (lx_siginfo_t)) != 0)
+		return (-EFAULT);
+	s_code = ltos_sigcode(lx_siginfo.lsi_code);
+	if (s_code == LX_SI_CODE_NOT_EXIST)
+		return (-EINVAL);
+	if (lx_sig < 0 || lx_sig > LX_NSIG || (sig = ltos_signo[lx_sig]) < 0) {
+		return (-EINVAL);
+	}
+	/*
+	 * This case (when trying to kill pid 0) just has a different errno
+	 * returned in illumos than in Linux.
+	 */
+	if (tgid == 0)
+		return (-ESRCH);
+	if (lx_lpid_to_spid(tgid, &s_pid) != 0)
+		return (-ESRCH);
+	if (SI_CANQUEUE(s_code)) {
+		return ((syscall(SYS_sigqueue, s_pid, sig,
+		    lx_siginfo.lsi_value, s_code, 0) == -1) ?
+		    (-errno): 0);
+	} else {
+		/*
+		 * This case is unlikely, as the main entry point is through
+		 * sigqueue, which always has a queuable si_code.
+		 */
+		siginfo.si_signo = sig;
+		siginfo.si_code = s_code;
+		siginfo.si_pid = lx_siginfo.lsi_pid;
+		siginfo.si_value = lx_siginfo.lsi_value;
+		siginfo.si_uid = lx_siginfo.lsi_uid;
+		return ((syscall(SYS_brand, B_HELPER_SIGQUEUE,
+		    tgid, sig, &siginfo)) ? (-errno) : 0);
+	}
+}
+
+/*
+ * Adds an additional argument for which thread within a thread group to send
+ * the signal to (added as the second argument).
+ */
+long
+lx_rt_tgsigqueueinfo(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4)
+{
+	pid_t tgid = (pid_t)p1;
+	pid_t tid = (pid_t)p2;
+	int lx_sig = (int)p3;
+	int sig;
+	lx_siginfo_t lx_siginfo;
+	siginfo_t siginfo;
+	int si_code;
+
+	if (uucopy((void *)p4, &lx_siginfo, sizeof (lx_siginfo_t)) != 0)
+		return (-EFAULT);
+	if (lx_sig < 0 || lx_sig > LX_NSIG || (sig = ltos_signo[lx_sig]) < 0) {
+		return (-EINVAL);
+	}
+	si_code = ltos_sigcode(lx_siginfo.lsi_code);
+	if (si_code == LX_SI_CODE_NOT_EXIST)
+		return (-EINVAL);
+	/*
+	 * Check for invalid tgid and tids. That appears to be only negatives
+	 * and 0 values. Everything else that doesn't exist is instead ESRCH.
+	 */
+	if (tgid <= 0 || tid <= 0)
+		return (-EINVAL);
+	siginfo.si_signo = sig;
+	siginfo.si_code = si_code;
+	siginfo.si_pid = lx_siginfo.lsi_pid;
+	siginfo.si_value = lx_siginfo.lsi_value;
+	siginfo.si_uid = lx_siginfo.lsi_uid;
+
+	return ((syscall(SYS_brand, B_HELPER_TGSIGQUEUE, tgid, tid, sig,
+	    &siginfo)) ? (-errno) : 0);
+}
+
+long
+lx_signalfd(int fd, uintptr_t mask, size_t msize)
+{
+	return (lx_signalfd4(fd, mask, msize, 0));
+}
+
+long
+lx_signalfd4(int fd, uintptr_t mask, size_t msize, int flags)
+{
+	sigset_t s_set;
+	int r;
+
+	if (msize != sizeof (int64_t))
+		return (-EINVAL);
+
+	if (ltos_sigset((lx_sigset_t *)mask, &s_set) != 0)
+		return (-errno);
+
+	r = signalfd(fd, &s_set, flags);
+
+	/*
+	 * signalfd(3C) may fail with ENOENT if /dev/signalfd is not available.
+	 * It is less jarring to Linux programs to tell them that internal
+	 * allocation failed than to report an error number they are not
+	 * expecting.
+	 */
+	if (r == -1 && errno == ENOENT)
+		return (-ENODEV);
+
+	return (r == -1 ? -errno : r);
+}
+
+void
+lx_block_all_signals()
+{
+	(void) syscall(SYS_brand, B_BLOCK_ALL_SIGS);
+}
+
+void
+lx_unblock_all_signals()
+{
+	(void) syscall(SYS_brand, B_UNBLOCK_ALL_SIGS);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/stack.c b/usr/src/lib/brand/lx/lx_brand/common/stack.c
new file mode 100644
index 0000000000..8f2c1cacc7
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/stack.c
@@ -0,0 +1,337 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * Manage the native/emulation stack for LX-branded LWPs.
+ */
+
+#include <assert.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <errno.h>
+
+#include <thread.h>
+#include <sys/mman.h>
+#include <sys/brand.h>
+#include <sys/syscall.h>
+#include <sys/debug.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_thread.h>
+
+
+typedef struct lx_stack_list_ent {
+	thread_t sle_tid;
+	void *sle_stack;
+	size_t sle_stack_size;
+	lx_tsd_t *sle_tsd;
+} lx_stack_list_ent_t;
+
+static mutex_t lx_stack_list_lock = ERRORCHECKMUTEX;
+lx_stack_list_ent_t *lx_stack_list = NULL;
+unsigned int lx_stack_list_elems = 0;
+
+/*
+ * Usermode emulation alternate stack size, expressed as a page count:
+ */
+int lx_native_stack_page_count = LX_NATIVE_STACK_PAGE_COUNT;
+
+/*
+ * We use these private functions from libc to suspend signal delivery in
+ * critical sections:
+ */
+extern void _sigon(void);
+extern void _sigoff(void);
+
+void
+lx_stack_prefork(void)
+{
+	lx_tsd_t *lx_tsd = lx_get_tsd();
+
+	/*
+	 * The "lx_stack_list_lock" mutex is used to protect access to the list
+	 * of per-thread native stacks.  Management of native stacks is
+	 * generally performed while servicing an emulated fork(2), vfork(2) or
+	 * clone(2) system call.
+	 *
+	 * Multiple threads may be attempting to create new threads or
+	 * processes concurrently, but in the case of fork(2) only the
+	 * currently executing thread is duplicated in the child process.  We
+	 * require that the stack list lock be taken before the native fork1()
+	 * or forkx(), and released in both the parent and the child once the
+	 * operation is complete. For vfork() the lock must only be released in
+	 * the parent (once it resumes execution) since the child is borrowing
+	 * the parent's thread. The _sigoff/_sigon dance will also only take
+	 * place in the parent.
+	 *
+	 * Holding this mutex prevents the forked child from containing a
+	 * copy-on-write copy of a locked mutex without the thread that would
+	 * later unlock it.  We also suspend signal delivery while entering
+	 * this critical section to ensure async signal safety.
+	 *
+	 * Unfortunately some Linux applications (e.g. busybox) will call vfork
+	 * and then call fork (without the expected intervening exec). We
+	 * avoid the mutex deadlock by skipping the call since we know this
+	 * thread has borrowed the parent's address space and the parent cannot
+	 * execute until we exit/exec.
+	 */
+	_sigoff();
+	if (lx_tsd->lxtsd_is_vforked == 0)
+		VERIFY0(mutex_lock(&lx_stack_list_lock));
+}
+
+void
+lx_stack_postfork(void)
+{
+	lx_tsd_t *lx_tsd = lx_get_tsd();
+
+	if (lx_tsd->lxtsd_is_vforked == 0)
+		VERIFY0(mutex_unlock(&lx_stack_list_lock));
+	_sigon();
+}
+
+/*
+ * Free the alternate stack for this thread.
+ */
+void
+lx_free_stack(void)
+{
+	thread_t me = thr_self();
+	int i;
+
+	_sigoff();
+	VERIFY0(mutex_lock(&lx_stack_list_lock));
+
+	/*
+	 * Find this thread's stack in the list of stacks.
+	 */
+	for (i = 0; i < lx_stack_list_elems; i++) {
+		if (lx_stack_list[i].sle_tid != me) {
+			continue;
+		}
+
+		(void) munmap(lx_stack_list[i].sle_stack,
+		    lx_stack_list[i].sle_stack_size);
+
+		/*
+		 * Free the thread-specific data structure for this thread.
+		 */
+		if (lx_stack_list[i].sle_tsd != NULL) {
+			free(lx_stack_list[i].sle_tsd->lxtsd_clone_state);
+			free(lx_stack_list[i].sle_tsd);
+		}
+
+		/*
+		 * Free up this stack list entry:
+		 */
+		bzero(&lx_stack_list[i], sizeof (lx_stack_list[i]));
+
+		VERIFY0(mutex_unlock(&lx_stack_list_lock));
+		_sigon();
+		return;
+	}
+
+	/*
+	 * Did not find the stack in the list.
+	 */
+	assert(0);
+}
+
+/*
+ * After fork1(), we must unmap the stack of every thread other than the
+ * one copied into the child process.
+ */
+void
+lx_free_other_stacks(void)
+{
+	int i, this_stack = -1;
+	thread_t me = thr_self();
+	lx_tsd_t *lx_tsd = lx_get_tsd();
+
+	_sigoff();
+
+	/*
+	 * We don't need to check or take the lx_stack_list_lock here because
+	 * we are the only thread in this process, but if we got here via an
+	 * evil vfork->fork path then we must drop the lock for the new child
+	 * and reset our "is_vforked" counter.
+	 */
+	if (lx_tsd->lxtsd_is_vforked != 0) {
+		VERIFY0(mutex_unlock(&lx_stack_list_lock));
+		lx_tsd->lxtsd_is_vforked = 0;
+	}
+
+	for (i = 0; i < lx_stack_list_elems; i++) {
+		if (lx_stack_list[i].sle_tid == me) {
+			/*
+			 * Do not unmap the stack for this LWP.
+			 */
+			this_stack = i;
+			continue;
+		} else if (lx_stack_list[i].sle_tid == 0) {
+			/*
+			 * Skip any holes in the list.
+			 */
+			continue;
+		}
+
+		/*
+		 * Free the thread-specific data structure for this thread.
+		 */
+		if (lx_stack_list[i].sle_tsd != NULL) {
+			free(lx_stack_list[i].sle_tsd->lxtsd_clone_state);
+			free(lx_stack_list[i].sle_tsd);
+		}
+
+		/*
+		 * Unmap the stack of every other LWP.
+		 */
+		(void) munmap(lx_stack_list[i].sle_stack,
+		    lx_stack_list[i].sle_stack_size);
+	}
+	/*
+	 * Did not find the stack for this LWP in the list.
+	 */
+	assert(this_stack != -1);
+
+	/*
+	 * Ensure the stack data for this LWP is in the first slot and shrink
+	 * the list.
+	 */
+	if (this_stack != 0) {
+		lx_stack_list[0] = lx_stack_list[this_stack];
+	}
+	lx_stack_list_elems = 1;
+	lx_stack_list = realloc(lx_stack_list, lx_stack_list_elems *
+	    sizeof (lx_stack_list[0]));
+	if (lx_stack_list == NULL) {
+		lx_err_fatal("failed to shrink stack list: %s",
+		    strerror(errno));
+	}
+
+	_sigon();
+}
+
+/*
+ * Allocate an alternate stack for the execution of native emulation routines.
+ * This routine is based, in part, on find_stack() from libc.
+ */
+int
+lx_alloc_stack(void **nstack, size_t *nstack_size)
+{
+	static int pagesize = 0;
+	static int stackprot = 0;
+	int stacksize = 0;
+	void *stack;
+
+	/*
+	 * Fetch configuration once:
+	 */
+	if (pagesize == 0) {
+		pagesize = _sysconf(_SC_PAGESIZE);
+		assert(pagesize > 0);
+	}
+	if (stackprot == 0) {
+		long lprot = _sysconf(_SC_STACK_PROT);
+
+		stackprot = lprot > 0 ? lprot : (PROT_READ | PROT_WRITE);
+	}
+
+	stacksize = lx_native_stack_page_count * pagesize;
+
+	if ((stack = mmap(NULL, stacksize, stackprot, MAP_PRIVATE |
+	    MAP_NORESERVE | MAP_ANON, -1, (off_t)0)) == MAP_FAILED) {
+		int en = errno;
+		lx_debug("lx_alloc_stack: failed to allocate stack: %d", errno);
+		errno = en;
+		return (-1);
+	}
+
+#if DEBUG
+	/*
+	 * Write a recognisable pattern into the allocated stack pages.
+	 */
+	for (pos = 0; pos < ((stacksize - 1) / 4); pos++) {
+		((uint32_t *)stack)[pos] = 0x0facade0;
+	}
+#endif
+
+	*nstack = stack;
+	*nstack_size = stacksize;
+
+	return (0);
+}
+
+/*
+ * Configure the in-kernel brand-specific LWP data with the native stack
+ * pointer for this thread.  If a stack is not passed, allocate one first.
+ */
+void
+lx_install_stack(void *stack, size_t stacksize, lx_tsd_t *tsd)
+{
+	thread_t me = thr_self();
+	int i;
+	uintptr_t stack_top;
+
+	if (stack == NULL) {
+		/*
+		 * If we were not passed a stack, then allocate one:
+		 */
+		if (lx_alloc_stack(&stack, &stacksize) == -1) {
+			lx_err_fatal("failed to allocate stack for thread "
+			    "%d: %s", me, strerror(errno));
+		}
+	}
+
+	/*
+	 * Install the stack in the global list of thread stacks.
+	 */
+	_sigoff();
+	VERIFY0(mutex_lock(&lx_stack_list_lock));
+
+	for (i = 0; i < lx_stack_list_elems; i++) {
+		assert(lx_stack_list[i].sle_tid != me);
+		if (lx_stack_list[i].sle_tid == 0)
+			break;
+	}
+	if (i >= lx_stack_list_elems) {
+		lx_stack_list_elems++;
+		lx_stack_list = realloc(lx_stack_list, lx_stack_list_elems *
+		    sizeof (lx_stack_list[0]));
+		if (lx_stack_list == NULL) {
+			lx_err_fatal("failed to extend stack list: %s",
+			    strerror(errno));
+		}
+	}
+	lx_stack_list[i].sle_tid = me;
+	lx_stack_list[i].sle_stack = stack;
+	lx_stack_list[i].sle_stack_size = stacksize;
+	lx_stack_list[i].sle_tsd = tsd;
+
+	VERIFY0(mutex_unlock(&lx_stack_list_lock));
+	_sigon();
+
+	/*
+	 * Inform the kernel of the location of the brand emulation
+	 * stack for this LWP:
+	 */
+	stack_top = (uintptr_t)stack + stacksize;
+	lx_debug("stack %p stack_top %p\n", stack, stack_top);
+	if (syscall(SYS_brand, B_SET_NATIVE_STACK, stack_top) != 0) {
+		lx_err_fatal("unable to set native stack: %s", strerror(errno));
+	}
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/statfs.c b/usr/src/lib/brand/lx/lx_brand/common/statfs.c
new file mode 100644
index 0000000000..629e549831
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/statfs.c
@@ -0,0 +1,348 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <libintl.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/types.h>
+#include <sys/statvfs.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+
+#include <sys/lx_debug.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_statfs.h>
+#include <sys/lx_syscall.h>
+
+/*
+ * these defines must exist before we include regexp.h, see regexp(5)
+ */
+#define	RE_SIZE		1024
+#define	INIT		char *sp = instring;
+#define	GETC()		(*sp++)
+#define	PEEKC()		(*sp)
+#define	UNGETC(c)	(--sp)
+#define	RETURN(c)	return (NULL);
+#define	ERROR(c)	return ((char *)c);
+
+/*
+ * for regular expressions we're using regexp(5).
+ *
+ * we'd really prefer to use some other nicer regular expressions
+ * interfaces (like regcmp(3c), regcomp(3c), or re_comp(3c)) but we
+ * can't because all these other interfaces rely on the ability
+ * to allocate memory via libc malloc()/calloc() calls, which
+ * we can't really do here.
+ *
+ * we could optionally use regexpr(3gen) but we don't since the
+ * interfaces there are incredibly similar to the regexp(5)
+ * interfaces we're already using and we'd have the added
+ * requirement of linking against libgen.
+ *
+ * another option that was considered is fnmatch(3c) but the
+ * limited pattern expansion capability of this interface would
+ * force us to include more patterns to check against.
+ */
+#include <regexp.h>
+
+static struct lx_ftype_path {
+	char		*lfp_path;
+	char		lfp_re[RE_SIZE];
+	int		lfp_magic;
+	char		*lfp_magic_str;
+} ftype_path_list[] = {
+	{ "^/dev/pts$",		"",
+		LX_DEVPTS_SUPER_MAGIC,	"LX_DEVPTS_SUPER_MAGIC"	},
+	{ "^/dev/pts/$",	"",
+		LX_DEVPTS_SUPER_MAGIC,	"LX_DEVPTS_SUPER_MAGIC"	},
+	{ "^/dev/pts/[0-9][0-9]*$",	"",
+		LX_DEVPTS_SUPER_MAGIC,	"LX_DEVPTS_SUPER_MAGIC"	},
+	{ NULL,			"",
+		0,			NULL			}
+};
+
+/*
+ * For lack of linux equivalents, we present lofs and zfs as being ext2. Yes,
+ * this is a total lie, but Linux can't handle the truth of ZFS -- and ext2's
+ * small surface area seems to make it the most tenable lie to tell.
+ */
+static struct lx_ftype_name {
+	const char	*lfn_name;
+	int		lfn_magic;
+	char		*lfn_magic_str;
+} ftype_name_list[] = {
+	{ "hsfs",	LX_ISOFS_SUPER_MAGIC,	"LX_ISOFS_SUPER_MAGIC"	},
+	{ "nfs",	LX_NFS_SUPER_MAGIC,	"LX_NFS_SUPER_MAGIC"	},
+	{ "pcfs",	LX_MSDOS_SUPER_MAGIC,	"LX_MSDOS_SUPER_MAGIC"	},
+	{ "lx_proc",	LX_PROC_SUPER_MAGIC,	"LX_PROC_SUPER_MAGIC"	},
+	{ "tmpfs",	LX_TMPFS_SUPER_MAGIC,	"LX_TMPFS_SUPER_MAGIC"	},
+	{ "ufs",	LX_UFS_MAGIC,		"LX_UFS_MAGIC"		},
+	{ "lofs",	LX_EXT2_SUPER_MAGIC,	"LX_EXT2_SUPER_MAGIC"	},
+	{ "zfs",	LX_EXT2_SUPER_MAGIC,	"LX_EXT2_SUPER_MAGIC"	},
+	{ "lxautofs",	LX_AUTOFS_SUPER_MAGIC,	"LX_AUTOFS_SUPER_MAGIC"	},
+	{ "lx_cgroup",	LX_CGROUP_SUPER_MAGIC,	"LX_CGROUP_SUPER_MAGIC"	},
+	{ "lx_sysfs",	LX_SYSFS_SUPER_MAGIC,	"LX_SYSFS_SUPER_MAGIC"	},
+	{ NULL,		0,			NULL	}
+};
+
+int
+lx_statfs_init()
+{
+	int	i;
+	char	*rv;
+
+	for (i = 0; ftype_path_list[i].lfp_path != NULL; i++) {
+		rv = compile(
+		    ftype_path_list[i].lfp_path,
+		    ftype_path_list[i].lfp_re,
+		    ftype_path_list[i].lfp_re + RE_SIZE, '\0');
+		if (rv == NULL)
+			continue;
+
+		lx_debug("lx_statfs_init compile(\"%s\") failed",
+		    ftype_path_list[i].lfp_path);
+		return (1);
+	}
+	return (0);
+}
+
+static int
+stol_type(const char *path, const char *name)
+{
+	int	i;
+	lx_debug("\tstol_type(\"%s\", \"%s\")\n", path == NULL ? "NULL" : path,
+	    name == NULL ? "NULL" : name);
+
+	if (path != NULL) {
+		char userpath[MAXPATHLEN];
+
+		if (uucopystr(path, userpath, MAXPATHLEN) == -1)
+			return (-errno);
+
+		for (i = 0; ftype_path_list[i].lfp_path != NULL; i++) {
+			if (step(userpath, ftype_path_list[i].lfp_re) == 0)
+				continue;
+
+			/* got a match on the fs path */
+			lx_debug("\ttranslated f_type to 0x%x - %s",
+			    ftype_path_list[i].lfp_magic,
+			    ftype_path_list[i].lfp_magic_str);
+			return (ftype_path_list[i].lfp_magic);
+		}
+	}
+
+	assert(name != NULL);
+	for (i = 0; ftype_name_list[i].lfn_name != NULL; i++) {
+		if (strcmp(name, ftype_name_list[i].lfn_name) == 0) {
+
+			/* got a match on the fs name */
+			lx_debug("\ttranslated f_type to 0x%x - %s",
+			    ftype_name_list[i].lfn_magic,
+			    ftype_name_list[i].lfn_magic_str);
+			return (ftype_name_list[i].lfn_magic);
+		}
+	}
+
+	/* we don't know what the fs type is so just set it to 0 */
+	return (0);
+}
+
+/*
+ * The Linux statfs() is similar to the Solaris statvfs() call, the main
+ * difference being the use of a numeric 'f_type' identifier instead of the
+ * 'f_basetype' string.
+ */
+static int
+stol_statfs(const char *path, struct lx_statfs *l, struct statvfs *s)
+{
+	int type;
+
+	if ((type = stol_type(path, s->f_basetype)) < 0)
+		return (type);
+
+	l->f_type = type;
+	l->f_bsize = s->f_frsize;	/* other fields depend on frsize */
+	l->f_blocks = s->f_blocks;
+	l->f_bfree = s->f_bfree;
+	l->f_bavail = s->f_bavail;
+	l->f_files = s->f_files;
+	l->f_ffree = s->f_ffree;
+	l->f_fsid = s->f_fsid;
+	l->f_namelen = s->f_namemax;
+	l->f_frsize = s->f_frsize;
+	bzero(&(l->f_spare), sizeof (l->f_spare));
+
+	return (0);
+}
+
+static int
+stol_statfs64(const char *path, struct lx_statfs64 *l, struct statvfs64 *s)
+{
+	int type;
+
+	if ((type = stol_type(path, s->f_basetype)) < 0)
+		return (type);
+
+	l->f_type = type;
+	l->f_bsize = s->f_frsize;	/* other fields depend on frsize */
+	l->f_blocks = s->f_blocks;
+	l->f_bfree = s->f_bfree;
+	l->f_bavail = s->f_bavail;
+	l->f_files = s->f_files;
+	l->f_ffree = s->f_ffree;
+	l->f_fsid = s->f_fsid;
+	l->f_namelen = s->f_namemax;
+	l->f_frsize = s->f_frsize;
+	bzero(&(l->f_spare), sizeof (l->f_spare));
+
+	return (0);
+}
+
+long
+lx_statfs(uintptr_t p1, uintptr_t p2)
+{
+	const char *path = (const char *)p1;
+	struct lx_statfs lxfs, *fs = (struct lx_statfs *)p2;
+	struct statvfs vfs;
+	int err;
+
+	lx_debug("\tstatvfs(%s, 0x%p)", path, fs);
+	if (statvfs(path, &vfs) != 0)
+		return (-errno);
+
+	if ((err = stol_statfs(path, &lxfs, &vfs)) != 0)
+		return (err);
+
+	if (uucopy(&lxfs, fs, sizeof (struct lx_statfs)) != 0)
+		return (-errno);
+
+	return (0);
+}
+
+long
+lx_fstatfs(uintptr_t p1, uintptr_t p2)
+{
+	struct lx_statfs lxfs, *fs = (struct lx_statfs *)p2;
+	struct stat64 sb;
+	struct statvfs vfs;
+	char *path, path_buf[MAXPATHLEN];
+	int fd = (int)p1;
+	int err;
+
+	lx_debug("\tfstatvfs(%d, 0x%p)", fd, fs);
+
+	/*
+	 * fstatfs emulation for a pipe.
+	 */
+	if (fstat64(fd, &sb) == 0 && S_ISFIFO(sb.st_mode)) {
+		lxfs.f_type = LX_PIPEFS_MAGIC;
+		lxfs.f_bsize = 4096;
+		lxfs.f_blocks = 0;
+		lxfs.f_bfree = 0;
+		lxfs.f_bavail = 0;
+		lxfs.f_files = 0;
+		lxfs.f_ffree = 0;
+		lxfs.f_fsid = 0;
+		lxfs.f_namelen = 255;
+		lxfs.f_frsize = 4096;
+	} else {
+		if (fstatvfs(fd, &vfs) != 0)
+			return (-errno);
+
+		path = lx_fd_to_path(fd, path_buf, sizeof (path_buf));
+
+		if ((err = stol_statfs(path, &lxfs, &vfs)) != 0)
+			return (err);
+	}
+
+	if (uucopy(&lxfs, fs, sizeof (struct lx_statfs)) != 0)
+		return (-errno);
+
+	return (0);
+}
+
+/* ARGSUSED */
+long
+lx_statfs64(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	const char *path = (const char *)p1;
+	struct lx_statfs64 lxfs, *fs = (struct lx_statfs64 *)p3;
+	struct statvfs64 vfs;
+	int err;
+
+	lx_debug("\tstatvfs64(%s, %d, 0x%p)", path, p2, fs);
+	if (statvfs64(path, &vfs) != 0)
+		return (-errno);
+
+	if ((err = stol_statfs64(path, &lxfs, &vfs)) != 0)
+		return (err);
+
+	if (uucopy(&lxfs, fs, sizeof (struct lx_statfs64)) != 0)
+		return (-errno);
+
+	return (0);
+}
+
+/* ARGSUSED */
+long
+lx_fstatfs64(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	struct lx_statfs64 lxfs, *fs = (struct lx_statfs64 *)p3;
+	struct stat64 sb;
+	struct statvfs64 vfs;
+	char *path, path_buf[MAXPATHLEN];
+	int fd = (int)p1;
+	int err;
+
+	lx_debug("\tfstatvfs64(%d, %d, 0x%p)", fd, p2, fs);
+	if (fstat64(fd, &sb) == 0 && S_ISFIFO(sb.st_mode)) {
+		lxfs.f_type = LX_PIPEFS_MAGIC;
+		lxfs.f_bsize = 4096;
+		lxfs.f_blocks = 0;
+		lxfs.f_bfree = 0;
+		lxfs.f_bavail = 0;
+		lxfs.f_files = 0;
+		lxfs.f_ffree = 0;
+		lxfs.f_fsid = 0;
+		lxfs.f_namelen = 255;
+		lxfs.f_frsize = 4096;
+	} else {
+		if (fstatvfs64(fd, &vfs) != 0)
+			return (-errno);
+
+		path = lx_fd_to_path(fd, path_buf, sizeof (path_buf));
+
+		if ((err = stol_statfs64(path, &lxfs, &vfs)) != 0)
+			return (err);
+	}
+
+	if (uucopy(&lxfs, fs, sizeof (struct lx_statfs64)) != 0)
+		return (-errno);
+
+	return (0);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/sysctl.c b/usr/src/lib/brand/lx/lx_brand/common/sysctl.c
new file mode 100644
index 0000000000..262a9c3830
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/sysctl.c
@@ -0,0 +1,137 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#include <alloca.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_debug.h>
+
+/*
+ * sysctl() implementation.  The full set of possible values is incredibly
+ * large; we only implement the bare minimum here, namely basic kernel
+ * information.
+ *
+ * For the moment, we also print out debugging messages if the application
+ * attempts to write or access any other values, so we can tell if we are not
+ * supporting something we should be.
+ */
+
+struct lx_sysctl_args {
+	int *name;
+	int nlen;
+	void *oldval;
+	size_t *oldlenp;
+	void *newval;
+	size_t newlen;
+};
+
+#define	LX_CTL_KERN		1
+
+#define	LX_KERN_OSTYPE		1
+#define	LX_KERN_OSRELEASE	2
+#define	LX_KERN_OSREV		3
+#define	LX_KERN_VERSION		4
+
+long
+lx_sysctl(uintptr_t raw)
+{
+	struct lx_sysctl_args args;
+	int name[2];
+	size_t oldlen;
+	char *namebuf;
+
+	if (uucopy((void *)raw, &args, sizeof (args)) < 0)
+		return (-EFAULT);
+
+	/*
+	 * We only allow [ CTL_KERN, KERN_* ] pairs, so reject anything that
+	 * doesn't have exactly two values starting with LX_CTL_KERN.
+	 */
+	if (args.nlen != 2)
+		return (-ENOTDIR);
+
+	if (uucopy(args.name, name, sizeof (name)) < 0)
+		return (-EFAULT);
+
+	if (name[0] != LX_CTL_KERN) {
+		lx_debug("sysctl: read of [%d, %d] unsupported",
+		    name[0], name[1]);
+		return (-ENOTDIR);
+	}
+
+	/* We don't support writing new sysctl values. */
+	if ((args.newval != NULL) || (args.newlen != 0)) {
+		lx_debug("sysctl: write of [%d, %d] unsupported",
+		    name[0], name[1]);
+		return (-EPERM);
+	}
+
+	/*
+	 * It may seem silly, but passing in a NULL oldval pointer and not
+	 * writing any new values is a perfectly legal thing to do and should
+	 * succeed.
+	 */
+	if (args.oldval == NULL)
+		return (0);
+
+	/*
+	 * Likewise, Linux specifies that setting a non-NULL oldval but a
+	 * zero *oldlenp should result in an errno of EFAULT.
+	 */
+	if ((uucopy(args.oldlenp, &oldlen, sizeof (oldlen)) < 0) ||
+	    (oldlen == 0))
+		return (-EFAULT);
+
+	namebuf = SAFE_ALLOCA(oldlen);
+	if (namebuf == NULL)
+		return (-ENOMEM);
+
+	switch (name[1]) {
+	case LX_KERN_OSTYPE:
+		(void) strlcpy(namebuf, LX_UNAME_SYSNAME, oldlen);
+		break;
+	case LX_KERN_OSRELEASE:
+		(void) strlcpy(namebuf, lx_release, oldlen);
+		break;
+	case LX_KERN_VERSION:
+		(void) strlcpy(namebuf, LX_UNAME_VERSION, oldlen);
+		break;
+	default:
+		lx_debug("sysctl: read of [CTL_KERN, %d] unsupported", name[1]);
+		return (-ENOTDIR);
+	}
+
+	oldlen = strlen(namebuf);
+
+	if ((uucopy(namebuf, args.oldval, oldlen) < 0) ||
+	    (uucopy(&oldlen, args.oldlenp, sizeof (oldlen)) < 0))
+		return (-EFAULT);
+
+	return (0);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/sysv_ipc.c b/usr/src/lib/brand/lx/lx_brand/common/sysv_ipc.c
new file mode 100644
index 0000000000..aa4f4ffb40
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/sysv_ipc.c
@@ -0,0 +1,987 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <strings.h>
+#include <rctl.h>
+#include <alloca.h>
+#include <values.h>
+#include <sys/syscall.h>
+#include <sys/msg.h>
+#include <sys/ipc.h>
+#include <sys/sem.h>
+#include <sys/shm.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/lx_debug.h>
+#include <sys/lx_types.h>
+#include <sys/lx_sysv_ipc.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+
+#define	SLOT_SEM	0
+#define	SLOT_SHM	1
+#define	SLOT_MSG	2
+
+/* Use private SHM_RMID interface for IPC_RMID */
+#define	SHM_RMID	5
+
+static int
+get_rctlval(rctlblk_t *rblk, char *name, ulong_t limit, uint64_t *val)
+{
+	rctl_qty_t r;
+
+	if (getrctl(name, NULL, rblk, RCTL_FIRST) == -1)
+		return (-errno);
+
+	r = rctlblk_get_value(rblk);
+	if (r > limit)
+		return (-EOVERFLOW);
+
+	*val = r;
+	return (0);
+}
+
+/*
+ * Given a slot number and a maximum number of ids to extract from the
+ * kernel, return the msgid in the provided slot.
+ */
+static int
+slot_to_id(int type, int slot)
+{
+	uint_t nids, max;
+	int *idbuf = NULL;
+	int r = 0;
+
+	nids = 0;
+	for (;;) {
+		switch (type) {
+		case SLOT_SEM:
+			r = semids(idbuf, nids, &max);
+			break;
+		case SLOT_SHM:
+			r = shmids(idbuf, nids, &max);
+			break;
+		case SLOT_MSG:
+			r = msgids(idbuf, nids, &max);
+			break;
+		}
+
+		if (r < 0)
+			return (-errno);
+
+		if (max == 0)
+			return (-EINVAL);
+
+		if (max <= nids)
+			return (idbuf[slot]);
+
+		nids = max;
+		if ((idbuf = (int *)SAFE_ALLOCA(sizeof (int) * nids)) == NULL)
+			return (-ENOMEM);
+	}
+}
+
+/*
+ * Semaphore operations.
+ */
+long
+lx_semget(key_t key, int nsems, int semflg)
+{
+	int sol_flag;
+	int r;
+
+	lx_debug("\nsemget(%d, %d, %d)\n", key, nsems, semflg);
+	sol_flag = semflg & S_IAMB;
+	if (semflg & LX_IPC_CREAT)
+		sol_flag |= IPC_CREAT;
+	if (semflg & LX_IPC_EXCL)
+		sol_flag |= IPC_EXCL;
+
+	r = semget(key, nsems, sol_flag);
+	return ((r < 0) ? -errno : r);
+}
+
+long
+lx_semop(int semid, void *p1, size_t nsops)
+{
+	int r;
+	struct sembuf *sops = (struct sembuf *)p1;
+
+	lx_debug("\nsemop(%d, 0x%p, %u)\n", semid, sops, nsops);
+	if (nsops == 0)
+		return (-EINVAL);
+
+	r = semop(semid, sops, nsops);
+	return ((r < 0) ? -errno : r);
+}
+
+long
+lx_semtimedop(int semid, void *p1, size_t nsops, struct timespec *timeout)
+{
+	int r;
+	struct sembuf *sops = (struct sembuf *)p1;
+
+	lx_debug("\nsemtimedop(%d, 0x%p, %u, 0x%p)\n", semid, sops, nsops,
+	    timeout);
+	if (nsops == 0)
+		return (-EINVAL);
+
+	r = semtimedop(semid, sops, nsops, timeout);
+	return ((r < 0) ? -errno : r);
+}
+
+static int
+lx_semctl_ipcset(int semid, void *buf)
+{
+	struct lx_semid_ds semds;
+	struct semid_ds sol_semds;
+	int r;
+
+	if (uucopy(buf, &semds, sizeof (semds)))
+		return (-errno);
+
+	bzero(&sol_semds, sizeof (sol_semds));
+	sol_semds.sem_perm.uid = semds.sem_perm.uid;
+	sol_semds.sem_perm.gid = semds.sem_perm.gid;
+	sol_semds.sem_perm.mode = semds.sem_perm.mode;
+
+	r = semctl(semid, 0, IPC_SET, &sol_semds);
+	return ((r < 0) ? -errno : r);
+}
+
+static int
+lx_semctl_ipcstat(int semid, void *buf)
+{
+	struct lx_semid_ds semds;
+	struct semid_ds sol_semds;
+
+	if (semctl(semid, 0, IPC_STAT, &sol_semds) != 0)
+		return (-errno);
+
+	bzero(&semds, sizeof (semds));
+	semds.sem_perm.key = sol_semds.sem_perm.key;
+	semds.sem_perm.seq = sol_semds.sem_perm.seq;
+	semds.sem_perm.uid = sol_semds.sem_perm.uid;
+	semds.sem_perm.gid = sol_semds.sem_perm.gid;
+	semds.sem_perm.cuid = sol_semds.sem_perm.cuid;
+	semds.sem_perm.cgid = sol_semds.sem_perm.cgid;
+
+	/* Linux only uses the bottom 9 bits */
+	semds.sem_perm.mode = sol_semds.sem_perm.mode & S_IAMB;
+	semds.sem_otime = sol_semds.sem_otime;
+	semds.sem_ctime = sol_semds.sem_ctime;
+	semds.sem_nsems = sol_semds.sem_nsems;
+
+	if (uucopy(&semds, buf, sizeof (semds)))
+		return (-errno);
+
+	return (0);
+}
+
+static int
+lx_semctl_ipcinfo(void *buf)
+{
+	struct lx_seminfo i;
+	rctlblk_t *rblk;
+	int rblksz;
+	uint_t nids;
+	int idbuf;
+	int err;
+	uint64_t val;
+
+	rblksz = rctlblk_size();
+	if ((rblk = (rctlblk_t *)SAFE_ALLOCA(rblksz)) == NULL)
+		return (-ENOMEM);
+
+	bzero(&i, sizeof (i));
+	err = get_rctlval(rblk, "project.max-sem-ids", (ulong_t)MAXINT, &val);
+	if (err < 0)
+		return (err);
+	i.semmni = (int)val;
+	err = get_rctlval(rblk, "process.max-sem-nsems", (ulong_t)MAXINT, &val);
+	if (err < 0)
+		return (err);
+	i.semmsl = (int)val;
+	err = get_rctlval(rblk, "process.max-sem-ops", (ulong_t)MAXINT, &val);
+	if (err < 0)
+		return (err);
+	i.semopm = (int)val;
+
+	/*
+	 * We don't have corresponding rctls for these fields.  The values
+	 * are taken from the formulas used to derive the defaults listed
+	 * in the Linux header file.  We're lying, but trying to be
+	 * coherent about it.
+	 */
+	i.semmap = i.semmni;
+	i.semmns = i.semmni * i.semmsl;
+	i.semmnu = INT_MAX;
+	i.semume = INT_MAX;
+	i.semvmx = LX_SEMVMX;
+	if (semids(&idbuf, 0, &nids) < 0)
+		return (-errno);
+	i.semusz = nids;
+	i.semaem = INT_MAX;
+
+	if (uucopy(&i, buf, sizeof (i)) != 0)
+		return (-errno);
+
+	return (nids);
+}
+
+static int
+lx_semctl_semstat(int slot, void *buf)
+{
+	int r, semid;
+
+	semid = slot_to_id(SLOT_SEM, slot);
+	if (semid < 0)
+		return (semid);
+
+	r = lx_semctl_ipcstat(semid, buf);
+	return (r < 0 ? r : semid);
+}
+
+/*
+ * For the SETALL operation, we have to examine each of the semaphore
+ * values to be sure it is legal.
+ */
+static int
+lx_semctl_setall(int semid, ushort_t *arg)
+{
+	struct semid_ds semds;
+	ushort_t *vals;
+	int i, sz, r;
+
+	/*
+	 * Find out how many semaphores are involved, reserve enough
+	 * memory for an internal copy of the array, and then copy it in
+	 * from the process.
+	 */
+	if (semctl(semid, 0, IPC_STAT, &semds) != 0)
+		return (-errno);
+	sz = semds.sem_nsems * sizeof (ushort_t);
+	if ((vals = SAFE_ALLOCA(sz)) == NULL)
+		return (-ENOMEM);
+	if (uucopy(arg, vals, sz))
+		return (-errno);
+
+	/* Validate each of the values. */
+	for (i = 0; i < semds.sem_nsems; i++)
+		if (vals[i] > LX_SEMVMX)
+			return (-ERANGE);
+
+	r = semctl(semid, 0, SETALL, arg);
+
+	return ((r < 0) ? -errno : r);
+}
+
+long
+lx_semctl(int semid, int semnum, int cmd, void *ptr)
+{
+#if defined(_ILP32)
+	union lx_semun arg;
+#endif
+	int rval;
+	int opt = cmd & ~LX_IPC_64;
+	int use_errno = 0;
+	uint_t val;
+
+	lx_debug("\nsemctl(%d, %d, %d, 0x%p)\n", semid, semnum, cmd, ptr);
+
+#if defined(_ILP32)
+	/*
+	 * The final arg to semctl() is a pointer to a union.  For some
+	 * commands we can hand that pointer directly to the kernel.  For
+	 * these commands, we need to extract an argument from the union
+	 * before calling into the kernel.
+	 */
+	if (opt == LX_SETVAL || opt == LX_SETALL || opt == LX_GETALL ||
+	    opt == LX_IPC_SET || opt == LX_IPC_STAT || opt == LX_SEM_STAT ||
+	    opt == LX_IPC_INFO || opt == LX_SEM_INFO)
+		if (uucopy(ptr, &arg, sizeof (arg)))
+			return (-errno);
+#endif
+
+	switch (opt) {
+	case LX_GETVAL:
+		use_errno = 1;
+		rval = semctl(semid, semnum, GETVAL, NULL);
+		break;
+	case LX_SETVAL:
+#if defined(_ILP32)
+		val = arg.val;
+#else
+		val = (uint_t)(uintptr_t)ptr;
+#endif
+		if (val > LX_SEMVMX) {
+			return (-ERANGE);
+		}
+		use_errno = 1;
+		rval = semctl(semid, semnum, SETVAL, val);
+		break;
+	case LX_GETPID:
+		use_errno = 1;
+		rval = semctl(semid, semnum, GETPID, NULL);
+		break;
+	case LX_GETNCNT:
+		use_errno = 1;
+		rval = semctl(semid, semnum, GETNCNT, NULL);
+		break;
+	case LX_GETZCNT:
+		use_errno = 1;
+		rval = semctl(semid, semnum, GETZCNT, NULL);
+		break;
+	case LX_GETALL:
+		use_errno = 1;
+#if defined(_ILP32)
+		rval = semctl(semid, semnum, GETALL, arg.sems);
+#else
+		rval = semctl(semid, semnum, GETALL, ptr);
+#endif
+		break;
+	case LX_SETALL:
+#if defined(_ILP32)
+		rval = lx_semctl_setall(semid, arg.sems);
+#else
+		rval = lx_semctl_setall(semid, ptr);
+#endif
+		break;
+	case LX_IPC_RMID:
+		use_errno = 1;
+		rval = semctl(semid, semnum, IPC_RMID, NULL);
+		break;
+	case LX_SEM_STAT:
+#if defined(_ILP32)
+		rval = lx_semctl_semstat(semid, arg.semds);
+#else
+		rval = lx_semctl_semstat(semid, ptr);
+#endif
+		break;
+	case LX_IPC_STAT:
+#if defined(_ILP32)
+		rval = lx_semctl_ipcstat(semid, arg.semds);
+#else
+		rval = lx_semctl_ipcstat(semid, ptr);
+#endif
+		break;
+
+	case LX_IPC_SET:
+#if defined(_ILP32)
+		rval = lx_semctl_ipcset(semid, arg.semds);
+#else
+		rval = lx_semctl_ipcset(semid, ptr);
+#endif
+		break;
+
+	case LX_IPC_INFO:
+	case LX_SEM_INFO:
+#if defined(_ILP32)
+		rval = lx_semctl_ipcinfo(arg.semds);
+#else
+		rval = lx_semctl_ipcinfo(ptr);
+#endif
+		break;
+
+	default:
+		return (-EINVAL);
+	}
+
+	if (use_errno == 1 && rval < 0)
+		return (-errno);
+	return (rval);
+}
+
+/*
+ * msg operations.
+ */
+long
+lx_msgget(key_t key, int flag)
+{
+	int sol_flag;
+	int r;
+
+	lx_debug("\tlx_msgget(%d, %d)\n", key, flag);
+
+	sol_flag = flag & S_IAMB;
+	if (flag & LX_IPC_CREAT)
+		sol_flag |= IPC_CREAT;
+	if (flag & LX_IPC_EXCL)
+		sol_flag |= IPC_EXCL;
+
+	r = msgget(key, sol_flag);
+	return (r < 0 ? -errno : r);
+}
+
+long
+lx_msgsnd(int id, void *p1, size_t sz, int flag)
+{
+	int sol_flag = 0;
+	int r;
+	struct msgbuf *buf = (struct msgbuf *)p1;
+
+	lx_debug("\tlx_msgsnd(%d, 0x%p, %d, %d)\n", id, buf, sz, flag);
+
+	if (flag & LX_IPC_NOWAIT)
+		sol_flag |= IPC_NOWAIT;
+
+	if (((ssize_t)sz < 0) || (sz > LX_MSGMAX))
+		return (-EINVAL);
+
+	r = msgsnd(id, buf, sz, sol_flag);
+	return (r < 0 ? -errno : r);
+}
+
+long
+lx_msgrcv(int id, void *msgp, size_t sz, long msgtype, int flag)
+{
+	int sol_flag = 0;
+	ssize_t r;
+
+	lx_debug("\tlx_msgrcv(%d, 0x%p, %d, %d, %ld, %d)\n",
+	    id, msgp, sz, msgtype, flag);
+
+	/*
+	 * Check for a negative sz parameter.
+	 *
+	 * Unlike msgsnd(2), the Linux man page does not specify that
+	 * msgrcv(2) should return EINVAL if (sz > MSGMAX), only if (sz < 0).
+	 */
+	if ((ssize_t)sz < 0)
+		return (-EINVAL);
+
+	if (flag & LX_MSG_NOERROR)
+		sol_flag |= MSG_NOERROR;
+	if (flag & LX_IPC_NOWAIT)
+		sol_flag |= IPC_NOWAIT;
+
+	r = msgrcv(id, msgp, sz, msgtype, sol_flag);
+	return (r < 0 ? -errno : r);
+}
+
+static int
+lx_msgctl_ipcstat(int msgid, void *buf)
+{
+	struct lx_msqid_ds msgids;
+	struct msqid_ds sol_msgids;
+	int r;
+
+	r = msgctl(msgid, IPC_STAT, &sol_msgids);
+	if (r < 0)
+		return (-errno);
+
+	bzero(&msgids, sizeof (msgids));
+	msgids.msg_perm.key = sol_msgids.msg_perm.key;
+	msgids.msg_perm.seq = sol_msgids.msg_perm.seq;
+	msgids.msg_perm.uid = sol_msgids.msg_perm.uid;
+	msgids.msg_perm.gid = sol_msgids.msg_perm.gid;
+	msgids.msg_perm.cuid = sol_msgids.msg_perm.cuid;
+	msgids.msg_perm.cgid = sol_msgids.msg_perm.cgid;
+
+	/* Linux only uses the bottom 9 bits */
+	msgids.msg_perm.mode = sol_msgids.msg_perm.mode & S_IAMB;
+
+	msgids.msg_stime = sol_msgids.msg_stime;
+	msgids.msg_rtime = sol_msgids.msg_rtime;
+	msgids.msg_ctime = sol_msgids.msg_ctime;
+	msgids.msg_qbytes = sol_msgids.msg_qbytes;
+	msgids.msg_cbytes = sol_msgids.msg_cbytes;
+	msgids.msg_qnum = sol_msgids.msg_qnum;
+	msgids.msg_lspid = sol_msgids.msg_lspid;
+	msgids.msg_lrpid = sol_msgids.msg_lrpid;
+
+	if (uucopy(&msgids, buf, sizeof (msgids)))
+		return (-errno);
+
+	return (0);
+}
+
+static int
+lx_msgctl_ipcinfo(int cmd, void *buf)
+{
+	struct lx_msginfo m;
+	rctlblk_t *rblk;
+	int idbuf, rblksz, msgseg, maxmsgs;
+	uint_t nids;
+	int rval;
+	int err;
+	uint64_t val;
+
+	rblksz = rctlblk_size();
+	if ((rblk = (rctlblk_t *)SAFE_ALLOCA(rblksz)) == NULL)
+		return (-ENOMEM);
+
+	bzero(&m, sizeof (m));
+	err = get_rctlval(rblk, "project.max-msg-ids", (ulong_t)MAXINT, &val);
+	if (err < 0)
+		return (err);
+	m.msgmni = (int)val;
+	err = get_rctlval(rblk, "process.max-msg-qbytes", (ulong_t)MAXINT,
+	    &val);
+	if (err < 0)
+		return (err);
+	m.msgmnb = (int)val;
+
+	if (cmd == LX_IPC_INFO) {
+		err = get_rctlval(rblk, "process.max-msg-messages",
+		    (ulong_t)MAXINT, &val);
+		if (err < 0)
+			return (err);
+		maxmsgs = (int)val;
+		m.msgtql = maxmsgs * m.msgmni;
+		m.msgmap = m.msgmnb;
+		m.msgpool = m.msgmax * m.msgmnb;
+		rval = 0;
+	} else {
+		if (msgids(&idbuf, 0, &nids) < 0)
+			return (-errno);
+		m.msgpool = nids;
+
+		/*
+		 * For these fields, we can't even come up with a good fake
+		 * approximation.  These are listed as 'obsolete' or
+		 * 'unused' in the header files, so hopefully nobody is
+		 * relying on them anyway.
+		 */
+		m.msgtql = INT_MAX;
+		m.msgmap = INT_MAX;
+		rval = nids;
+	}
+
+	/*
+	 * We don't have corresponding rctls for these fields.  The values
+	 * are taken from the formulas used to derive the defaults listed
+	 * in the Linux header file.  We're lying, but trying to be
+	 * coherent about it.
+	 */
+	m.msgmax = LX_MSGMAX;
+	m.msgssz = 16;
+	msgseg = (m.msgpool * 1024) / m.msgssz;
+	m.msgseg = (msgseg > 0xffff) ? 0xffff : msgseg;
+
+	if (uucopy(&m, buf, sizeof (m)))
+		return (-errno);
+	return (rval);
+}
+
+static int
+lx_msgctl_ipcset(int msgid, void *buf)
+{
+	struct lx_msqid_ds msgids;
+	struct msqid_ds sol_msgids;
+	int r;
+
+	if (uucopy(buf, &msgids, sizeof (msgids)))
+		return (-errno);
+
+	bzero(&sol_msgids, sizeof (sol_msgids));
+	sol_msgids.msg_perm.uid = LX_UID16_TO_UID32(msgids.msg_perm.uid);
+	sol_msgids.msg_perm.gid = LX_UID16_TO_UID32(msgids.msg_perm.gid);
+
+	/* Linux only uses the bottom 9 bits */
+	sol_msgids.msg_perm.mode = msgids.msg_perm.mode & S_IAMB;
+	sol_msgids.msg_qbytes = msgids.msg_qbytes;
+
+	r = msgctl(msgid, IPC_SET, &sol_msgids);
+	return (r < 0 ? -errno : r);
+}
+
+static int
+lx_msgctl_msgstat(int slot, void *buf)
+{
+	int r, msgid;
+
+	lx_debug("msgstat(%d, 0x%p)\n", slot, buf);
+
+	msgid = slot_to_id(SLOT_MSG, slot);
+
+	if (msgid < 0)
+		return (msgid);
+
+	r = lx_msgctl_ipcstat(msgid, buf);
+	return (r < 0 ? r : msgid);
+}
+
+/*
+ * Split off the various msgctl's here
+ */
+long
+lx_msgctl(int msgid, int cmd, void *buf)
+{
+	int r;
+
+	lx_debug("\tlx_msgctl(%d, %d, 0x%p)\n", msgid, cmd, buf);
+	switch (cmd & ~LX_IPC_64) {
+	case LX_IPC_RMID:
+		r = msgctl(msgid, IPC_RMID, NULL);
+		if (r < 0)
+			r = -errno;
+		break;
+	case LX_IPC_SET:
+		r = lx_msgctl_ipcset(msgid, buf);
+		break;
+	case LX_IPC_STAT:
+		r = lx_msgctl_ipcstat(msgid, buf);
+		break;
+	case LX_MSG_STAT:
+		r = lx_msgctl_msgstat(msgid, buf);
+		break;
+
+	case LX_IPC_INFO:
+	case LX_MSG_INFO:
+		r = lx_msgctl_ipcinfo(cmd, buf);
+		break;
+
+	default:
+		r = -EINVAL;
+		break;
+	}
+
+	return (r);
+}
+
+/*
+ * shm-related operations.
+ */
+long
+lx_shmget(key_t key, size_t size, int flag)
+{
+	int sol_flag;
+	int r;
+
+	lx_debug("\tlx_shmget(%d, %d, %d)\n", key, size, flag);
+
+	sol_flag = flag & S_IAMB;
+	if (flag & LX_IPC_CREAT)
+		sol_flag |= IPC_CREAT;
+	if (flag & LX_IPC_EXCL)
+		sol_flag |= IPC_EXCL;
+
+	r = shmget(key, size, sol_flag);
+	return (r < 0 ? -errno : r);
+}
+
+long
+lx_shmat(int shmid, void *addr, int flags)
+{
+	int sol_flags;
+	void *ptr;
+
+	lx_debug("\tlx_shmat(%d, 0x%p, %d)\n", shmid, addr, flags);
+
+	/*
+	 * Linux has a fix for CVE-2017-5669 which LTP is testing for. The
+	 * kernel will disallow mapping into the first 64k of the address space.
+	 * LTP passes 1 as the address which will then round down to 0.
+	 * In the future, once more work has been done to tighten up the lx
+	 * brand handling for the minimum mappable address (e.g. with secflags),
+	 * then we can remove this check.
+	 */
+	if ((flags & LX_SHM_RND) && addr != NULL && addr < (void *)0x10000) {
+		return (-EINVAL);
+	}
+
+	sol_flags = 0;
+	if (flags & LX_SHM_RDONLY)
+		sol_flags |= SHM_RDONLY;
+	if (flags & LX_SHM_RND)
+		sol_flags |= SHM_RND;
+	if ((flags & LX_SHM_REMAP) && (addr == NULL))
+		return (-EINVAL);
+
+	ptr = shmat(shmid, addr, sol_flags);
+	if (ptr == (void *)-1)
+		return (-errno);
+
+	return ((ssize_t)ptr);
+}
+
+static int
+lx_shmctl_ipcinfo(void *buf)
+{
+	struct lx_shminfo s;
+	rctlblk_t *rblk;
+	int rblksz;
+	int err;
+	uint64_t val;
+
+	rblksz = rctlblk_size();
+	if ((rblk = (rctlblk_t *)SAFE_ALLOCA(rblksz)) == NULL)
+		return (-ENOMEM);
+
+	bzero(&s, sizeof (s));
+	err = get_rctlval(rblk, "project.max-shm-ids", ULONG_MAX, &val);
+	if (err < 0)
+		return (err);
+	s.shmmni = val;
+	err = get_rctlval(rblk, "project.max-shm-memory", ULONG_MAX, &val);
+	if (err < 0)
+		return (err);
+	s.shmmax = val;
+
+	/*
+	 * We don't have corresponding rctls for these fields.  The values
+	 * are taken from the formulas used to derive the defaults listed
+	 * in the Linux header file.  We're lying, but trying to be
+	 * coherent about it.
+	 */
+	s.shmmin = 1;
+	s.shmseg = ULONG_MAX;
+	s.shmall = s.shmmax / getpagesize();
+
+	if (uucopy(&s, buf, sizeof (s)))
+		return (-errno);
+
+	return (0);
+}
+
+static int
+lx_shmctl_ipcstat(int shmid, void *buf)
+{
+	struct lx_shmid_ds shmds;
+	struct shmid_ds sol_shmds;
+
+	if (shmctl(shmid, IPC_STAT, &sol_shmds) != 0)
+		return (-errno);
+
+	bzero(&shmds, sizeof (shmds));
+	shmds.shm_perm.key = sol_shmds.shm_perm.key;
+	shmds.shm_perm.seq = sol_shmds.shm_perm.seq;
+	shmds.shm_perm.uid = sol_shmds.shm_perm.uid;
+	shmds.shm_perm.gid = sol_shmds.shm_perm.gid;
+	shmds.shm_perm.cuid = sol_shmds.shm_perm.cuid;
+	shmds.shm_perm.cgid = sol_shmds.shm_perm.cgid;
+	shmds.shm_perm.mode = sol_shmds.shm_perm.mode & S_IAMB;
+	if (sol_shmds.shm_lkcnt > 0)
+		shmds.shm_perm.mode |= LX_SHM_LOCKED;
+	shmds.shm_segsz = sol_shmds.shm_segsz;
+	shmds.shm_atime	 = sol_shmds.shm_atime;
+	shmds.shm_dtime = sol_shmds.shm_dtime;
+	shmds.shm_ctime = sol_shmds.shm_ctime;
+	shmds.shm_cpid = sol_shmds.shm_cpid;
+	shmds.shm_lpid = sol_shmds.shm_lpid;
+	shmds.shm_nattch = (ushort_t)sol_shmds.shm_nattch;
+
+	if (uucopy(&shmds, buf, sizeof (shmds)))
+		return (-errno);
+
+	return (0);
+}
+
+static int
+lx_shmctl_ipcset(int shmid, void *buf)
+{
+	struct lx_shmid_ds shmds;
+	struct shmid_ds sol_shmds;
+	int r;
+
+	if (uucopy(buf, &shmds, sizeof (shmds)))
+		return (-errno);
+
+	bzero(&sol_shmds, sizeof (sol_shmds));
+	sol_shmds.shm_perm.uid = shmds.shm_perm.uid;
+	sol_shmds.shm_perm.gid = shmds.shm_perm.gid;
+	sol_shmds.shm_perm.mode = shmds.shm_perm.mode & S_IAMB;
+
+	r = shmctl(shmid, IPC_SET, &sol_shmds);
+	return (r < 0 ? -errno : r);
+}
+
+/*
+ * Build and return a shm_info structure. We only return the bare
+ * essentials required by ipcs. The rest of the info is not readily
+ * available.
+ */
+static int
+lx_shmctl_shminfo(void *buf)
+{
+	struct lx_shm_info shminfo;
+	uint_t nids;
+	int idbuf;
+
+	bzero(&shminfo, sizeof (shminfo));
+
+	if (shmids(&idbuf, 0, &nids) < 0)
+		return (-errno);
+
+	shminfo.used_ids = nids;
+	if (uucopy(&shminfo, buf, sizeof (shminfo)) != 0)
+		return (-errno);
+
+	return (nids);
+}
+
+static int
+lx_shmctl_shmstat(int slot, void *buf)
+{
+	int r, shmid;
+
+	lx_debug("shmctl_shmstat(%d, 0x%p)\n", slot, buf);
+	shmid = slot_to_id(SLOT_SHM, slot);
+	if (shmid < 0)
+		return (shmid);
+
+	r = lx_shmctl_ipcstat(shmid, buf);
+	return (r < 0 ? r : shmid);
+}
+
+long
+lx_shmctl(int shmid, int cmd, void *buf)
+{
+	int r;
+	int use_errno = 0;
+
+	lx_debug("\tlx_shmctl(%d, %d, 0x%p)\n", shmid, cmd, buf);
+	switch (cmd & ~LX_IPC_64) {
+	case LX_IPC_RMID:
+		use_errno = 1;
+		r = shmctl(shmid, SHM_RMID, NULL);	/* lx-private cmd */
+		break;
+
+	case LX_IPC_SET:
+		r = lx_shmctl_ipcset(shmid, buf);
+		break;
+
+	case LX_IPC_STAT:
+		r = lx_shmctl_ipcstat(shmid, buf);
+		break;
+
+	case LX_IPC_INFO:
+		r = lx_shmctl_ipcinfo(buf);
+		break;
+
+	case LX_SHM_LOCK:
+		use_errno = 1;
+		r = shmctl(shmid, SHM_LOCK, NULL);
+		break;
+
+	case LX_SHM_UNLOCK:
+		use_errno = 1;
+		r = shmctl(shmid, SHM_UNLOCK, NULL);
+		break;
+
+	case LX_SHM_INFO:
+		r = lx_shmctl_shminfo(buf);
+		break;
+
+	case LX_SHM_STAT:
+		r = lx_shmctl_shmstat(shmid, buf);
+		break;
+	default:
+		r = -EINVAL;
+		break;
+	}
+
+	if (use_errno == 1 && r < 0)
+		return (-errno);
+
+	return (r);
+}
+
+/*
+ * Under 32-bit Linux, glibc funnels all of the sysv IPC operations into this
+ * single ipc(2) system call.  We need to blow that up and filter the
+ * remnants into the proper Solaris system calls.
+ */
+long
+lx_ipc(uintptr_t cmd, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3,
+    uintptr_t arg4)
+{
+	int r;
+	void *bufptr = (void *)arg4;
+
+	lx_debug("lx_ipc(%d, %d, %d, %d, 0x%p, %d)\n",
+	    cmd, arg1, arg2, arg3, bufptr, arg4);
+
+	switch (cmd) {
+	case LX_MSGGET:
+		r = lx_msgget((key_t)arg1, (int)arg2);
+		break;
+	case LX_MSGSND:
+		r = lx_msgsnd((int)arg1, bufptr, (size_t)arg2, (int)arg3);
+		break;
+	case LX_MSGRCV:
+		{
+			struct {
+				void *msgp;
+				long msgtype;
+			} args;
+
+			/*
+			 * Rather than passing 5 args into ipc(2) directly,
+			 * glibc passes 4 args and uses the buf argument to
+			 * point to a structure containing two args: a pointer
+			 * to the message and the message type.
+			 */
+			if (uucopy(bufptr, &args, sizeof (args)))
+				return (-errno);
+			r = lx_msgrcv((int)arg1, args.msgp, (size_t)arg2,
+			    args.msgtype, (int)arg3);
+		}
+		break;
+	case LX_MSGCTL:
+		r = lx_msgctl((int)arg1, (int)arg2, bufptr);
+		break;
+	case LX_SEMCTL:
+		r = lx_semctl((int)arg1, (size_t)arg2, (int)arg3, bufptr);
+		break;
+	case LX_SEMOP:
+		/*
+		 * 'struct sembuf' is the same on Linux and Solaris, so we
+		 * pass bufptr straight through.
+		 */
+		r = lx_semop((int)arg1, bufptr, (size_t)arg2);
+		break;
+	case LX_SEMGET:
+		r = lx_semget((int)arg1, (size_t)arg2, (int)arg3);
+		break;
+	case LX_SHMAT:
+		r = lx_shmat((int)arg1, bufptr, (size_t)arg2);
+		if (r >= 0 || r <= -4096) {
+			if (uucopy(&r, (void *)arg3, sizeof (r)) != 0)
+				r = -errno;
+		}
+		break;
+	case LX_SHMDT:
+		r = shmdt(bufptr);
+		if (r < 0)
+			r = -errno;
+		break;
+	case LX_SHMGET:
+		r = lx_shmget((int)arg1, (size_t)arg2, (int)arg3);
+		break;
+	case LX_SHMCTL:
+		r = lx_shmctl((int)arg1, (int)arg2, bufptr);
+		break;
+
+	default:
+		r = -EINVAL;
+	}
+
+	return (r);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/time.c b/usr/src/lib/brand/lx/lx_brand/common/time.c
new file mode 100644
index 0000000000..db63c5643c
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/time.c
@@ -0,0 +1,113 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
+ */
+
+#include <errno.h>
+#include <time.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/times.h>
+#include <sys/lx_syscall.h>
+#include <sys/lx_misc.h>
+
+/*
+ * setitimer() - the Linux implementation can handle tv_usec values greater
+ *		 than 1,000,000 where Illumos would return EINVAL.
+ *
+ *		 There's still an issue here where Linux can handle a
+ *		 tv_sec value greater than 100,000,000 but Illumos cannot,
+ *		 but that would also mean setting an interval timer to fire
+ *		 over _three years_ in the future so it's unlikely anything
+ *		 other than Linux test suites will trip over it.
+ */
+long
+lx_setitimer(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	struct itimerval itv;
+	struct itimerval *itp = (struct itimerval *)p2;
+
+	if (itp != NULL) {
+		if (uucopy(itp, &itv, sizeof (itv)) != 0)
+			return (-errno);
+
+		/*
+		 * Adjust any tv_usec fields >= 1,000,000 by adding any whole
+		 * seconds so indicated to tv_sec and leaving tv_usec as the
+		 * remainder.
+		 */
+		if (itv.it_interval.tv_usec >= MICROSEC) {
+			itv.it_interval.tv_sec +=
+			    itv.it_interval.tv_usec / MICROSEC;
+
+			itv.it_interval.tv_usec %= MICROSEC;
+		}
+		if (itv.it_value.tv_usec >= MICROSEC) {
+			itv.it_value.tv_sec +=
+			    itv.it_value.tv_usec / MICROSEC;
+
+			itv.it_value.tv_usec %= MICROSEC;
+		}
+
+		itp = &itv;
+	}
+
+	return ((setitimer((int)p1, itp, (struct itimerval *)p3) != 0) ?
+	    -errno : 0);
+}
+
+/*
+ * NOTE: The Linux man pages state this structure is obsolete and is
+ *	 unsupported, so it is declared here for sizing purposes only.
+ */
+struct lx_timezone {
+	int tz_minuteswest;	/* minutes W of Greenwich */
+	int tz_dsttime;		/* type of dst correction */
+};
+
+long
+lx_settimeofday(uintptr_t p1, uintptr_t p2)
+{
+	struct timeval tv;
+	struct lx_timezone tz;
+
+	if ((p1 != NULL) &&
+	    (uucopy((struct timeval *)p1, &tv, sizeof (tv)) < 0))
+		return (-errno);
+
+	/*
+	 * The Linux man page states use of the second parameter is obsolete,
+	 * but settimeofday(2) should still return EFAULT if it is set
+	 * to a bad non-NULL pointer (sigh...)
+	 */
+	if ((p2 != NULL) &&
+	    (uucopy((struct lx_timezone *)p2, &tz, sizeof (tz)) < 0))
+		return (-errno);
+
+	if ((p1 != NULL) && (settimeofday(&tv, NULL) < 0))
+		return (-errno);
+
+	return (0);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/common/truncate.c b/usr/src/lib/brand/lx/lx_brand/common/truncate.c
new file mode 100644
index 0000000000..ba3e452408
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/common/truncate.c
@@ -0,0 +1,173 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/resource.h>
+#include <sys/lx_types.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_syscall.h>
+
+/*
+ * ZFS does not enforce the process.max-file-size rctl on a file which is
+ * grown in size via truncate/ftruncate, since that is simply metadata which
+ * does  not consume any additional space. However, LTP truncate03 depends on
+ * this behavior so we enforce it here.
+ */
+static boolean_t
+p_fsize_excd(const char *path, off_t length)
+{
+	struct stat64 sb;
+	struct rlimit rl;
+
+	if (stat64(path, &sb) == 0 && sb.st_size < length) {
+		/* We are growing the file, check the rlimit */
+		if (getrlimit(RLIMIT_FSIZE, &rl) == 0 && length > rl.rlim_cur)
+			return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+static boolean_t
+f_fsize_excd(int fd, off_t length)
+{
+	struct stat64 sb;
+	struct rlimit rl;
+
+	if (fstat64(fd, &sb) == 0 && sb.st_size < length) {
+		/* We are growing the file, check the rlimit */
+		if (getrlimit(RLIMIT_FSIZE, &rl) == 0 && length > rl.rlim_cur)
+			return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * On Illumos, truncate() and ftruncate() are implemented in libc, so these are
+ * layered on those interfaces.
+ */
+
+long
+lx_truncate(uintptr_t path, uintptr_t length)
+{
+#if defined(_ILP32)
+	if ((off_t)length >= 0xffffffffUL)
+		return (-EFBIG);
+#endif
+
+	if (length > 0 && p_fsize_excd((const char *)path, (off_t)length))
+		return (-EFBIG);
+
+	return (truncate((const char *)path, (off_t)length) == 0 ? 0 : -errno);
+}
+
+long
+lx_ftruncate(uintptr_t fd, uintptr_t length)
+{
+	int r;
+
+#if defined(_ILP32)
+	if ((off_t)length >= 0xffffffffUL)
+		return (-EFBIG);
+#endif
+
+	if (length > 0 && f_fsize_excd((int)fd, (off_t)length))
+		return (-EFBIG);
+
+	r = ftruncate((int)fd, (off_t)length);
+	/*
+	 * On Linux, truncating a file opened read-only returns EINVAL whereas
+	 * Illumos returns EBADF.
+	 */
+	if (r != 0) {
+		if (errno == EBADF) {
+			int mode;
+
+			if ((mode = fcntl(fd, F_GETFL, 0)) != -1 &&
+			    (mode & O_ACCMODE) == O_RDONLY)
+				r = -EINVAL;
+			else
+				r = -EBADF; /* keep existing errno */
+		} else {
+			r = -errno;
+		}
+	}
+	return (r);
+}
+
+long
+lx_truncate64(uintptr_t path, uintptr_t length_lo, uintptr_t length_hi)
+{
+	uint64_t len = LX_32TO64(length_lo, length_hi);
+
+	if (len >= 0x7fffffffffffffffULL)
+		return (-EFBIG);
+
+	if (len > 0 && p_fsize_excd((const char *)path, (off_t)len))
+		return (-EFBIG);
+
+	return (truncate64((const char *)path, len) == 0 ? 0 : -errno);
+}
+
+long
+lx_ftruncate64(uintptr_t fd, uintptr_t length_lo, uintptr_t length_hi)
+{
+	int r;
+	uint64_t len = LX_32TO64(length_lo, length_hi);
+
+	if (len >= 0x7fffffffffffffffULL)
+		return (-EFBIG);
+
+	if (len > 0 && f_fsize_excd((int)fd, (off_t)len))
+		return (-EFBIG);
+
+	r = ftruncate64((int)fd, len);
+	/*
+	 * On Linux, truncating a file opened read-only returns EINVAL whereas
+	 * Illumos returns EBADF.
+	 */
+	if (r != 0) {
+		if (errno == EBADF) {
+			int mode;
+
+			if ((mode = fcntl(fd, F_GETFL, 0)) != -1 &&
+			    (mode & O_ACCMODE) == O_RDONLY)
+				r = -EINVAL;
+			else
+				r = -EBADF; /* keep existing errno */
+		} else {
+			r = -errno;
+		}
+	}
+
+	return (r);
+}
diff --git a/usr/src/lib/brand/lx/lx_brand/i386/Makefile b/usr/src/lib/brand/lx/lx_brand/i386/Makefile
new file mode 100644
index 0000000000..8723f64292
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/i386/Makefile
@@ -0,0 +1,48 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2015 Joyent, Inc.
+#
+# lib/brand/lx/i386/Makefile
+
+ISASRCDIR=.
+
+ASFLAGS	+= -P -D_ASM
+
+include ../Makefile.com
+
+DYNFLAGS +=	-Wl,-I/native/lib/ld.so.1
+
+POFILE=		lx_brand.po
+MSGFILES=	$(CSRCS)
+
+ASSYMDEP_OBJS = lx_handler.o
+
+install: all $(ROOTLIBS)
+
+$(POFILE): $(MSGFILES)
+	$(BUILDPO.msgfiles)
+
+_msg: $(MSGDOMAINPOFILE)
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/lib/brand/lx/lx_brand/i386/lx_crt.s b/usr/src/lib/brand/lx/lx_brand/i386/lx_crt.s
new file mode 100644
index 0000000000..c457c1c209
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/i386/lx_crt.s
@@ -0,0 +1,65 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ident	"%Z%%M%	%I%	%E% SMI"
+
+#include <sys/asm_linkage.h>
+
+#if defined(lint)
+
+void
+_start(void)
+{
+}
+
+#else	/* lint */
+
+	/*
+	 * C language startup routine for the lx brand shared library.
+	 */
+	ENTRY_NP(_start)
+	pushl	$0			/ Build a stack frame. retpc = NULL
+	pushl	$0			/ fp = NULL
+	movl	%esp, %ebp		/ first stack frame
+
+	/*
+	 * Calculate the location of the envp array by adding the size of
+	 * the argv array to the start of the argv array.
+	 */
+	movl	8(%ebp), %eax		/ argc in %eax
+	leal	16(%ebp,%eax,4), %edx	/ envp in %edx
+	andl	$-16, %esp
+	pushl	%edx			/ push envp
+	leal	12(%ebp),%edx		/ compute &argv[0]
+	pushl	%edx			/ push argv
+	pushl	%eax			/ push argc
+	call	lx_init
+	/*
+	 * lx_init will never return.
+	 */
+	SET_SIZE(_start)
+
+#endif	/* lint */
diff --git a/usr/src/lib/brand/lx/lx_brand/i386/lx_handler.s b/usr/src/lib/brand/lx/lx_brand/i386/lx_handler.s
new file mode 100644
index 0000000000..7afb9c4b7f
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/i386/lx_handler.s
@@ -0,0 +1,91 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/asm_linkage.h>
+#include <sys/regset.h>
+#include <sys/segments.h>
+#include <sys/syscall.h>
+#include <sys/lx_brand.h>
+
+#if defined(_ASM)
+#include <sys/lx_signal.h>
+#include <sys/lx_syscall.h>
+#endif	/* _ASM */
+
+/* 32-bit syscall numbers */
+#define	LX_SYS_sigreturn	119
+#define	LX_SYS_rt_sigreturn	173
+
+#if defined(lint)
+
+#include <sys/types.h>
+#include <sys/regset.h>
+#include <sys/signal.h>
+
+void
+lx_sigreturn_tramp(void)
+{}
+
+void
+lx_rt_sigreturn_tramp(void)
+{}
+
+#else	/* lint */
+
+	ENTRY_NP(lx_swap_gs)
+	push	%eax		/* save the current eax value */
+	movl	0xc(%esp),%eax	/* 2nd param is a pointer */
+	movw	%gs,(%eax)	/* use the pointer to save current gs */
+	movl	0x8(%esp),%eax	/* first parameter is the new gs value */
+	movw	%ax, %gs	/* switch to the new gs value */
+	pop	%eax		/* restore eax */
+	ret
+	SET_SIZE(lx_swap_gs)
+
+	/*
+	 * Trampoline code is called by the return at the end of a Linux
+	 * signal handler to return control to the interrupted application
+	 * via the lx_sigreturn() or lx_rt_sigreturn() syscalls.
+	 *
+	 * (lx_sigreturn() is called for legacy signal handling, and
+	 * lx_rt_sigreturn() is called for "new"-style signals.)
+	 *
+	 * These two routines must consist of the EXACT code sequences below
+	 * as gdb looks at the sequence of instructions a routine will return
+	 * to determine whether it is in a signal handler or not.
+	 * See the Linux code setup_signal_stack_sc() in arch/x86/um/signal.c.
+	 */
+	ENTRY_NP(lx_sigreturn_tramp)
+	popl	%eax
+	movl	$LX_SYS_sigreturn, %eax
+	int	$0x80
+	SET_SIZE(lx_sigreturn_tramp)
+
+	ENTRY_NP(lx_rt_sigreturn_tramp)
+	movl	$LX_SYS_rt_sigreturn, %eax
+	int	$0x80
+	SET_SIZE(lx_rt_sigreturn_tramp)
+#endif	/* lint */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_debug.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_debug.h
new file mode 100644
index 0000000000..18e452876a
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_debug.h
@@ -0,0 +1,54 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_LX_DEBUG_H
+#define	_LX_DEBUG_H
+
+#include <lx_provider_impl.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/* initialize the debugging subsystem */
+extern void lx_debug_init(boolean_t, boolean_t, const char *);
+
+/* printf() style debug message functionality */
+extern void lx_debug(const char *, ...);
+
+extern int lx_debug_enabled;
+
+#define	LX_DEBUG_ISENABLED	\
+	(lx_debug_enabled || LX_DEBUG_ENABLED())
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_DEBUG_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_misc.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_misc.h
new file mode 100644
index 0000000000..ce241db8bc
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_misc.h
@@ -0,0 +1,178 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _SYS_LX_H
+#define	_SYS_LX_H
+
+#include <stdio.h>
+#include <alloca.h>
+#include <dirent.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/lwp.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_thread.h>
+
+#include <lx_errno.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern char lx_release[LX_KERN_RELEASE_MAX];
+extern char lx_cmd_name[MAXNAMLEN];
+extern pid_t zoneinit_pid;
+extern int lx_is_vforked;
+extern boolean_t lx_no_abort_handler;
+
+/*
+ * Values Linux expects for init
+ */
+#define	LX_INIT_PID	1
+
+/*
+ * the maximum length of messages to be output with lx_msg(), lx_err(),
+ * lx_debug(), or lx_unsupported().
+ */
+#define	LX_MSG_MAXLEN			(128 + MAXPATHLEN)
+
+/*
+ * Linux scheduler priority ranges.
+ */
+#define	LX_SCHED_PRIORITY_MIN_OTHER	0
+#define	LX_SCHED_PRIORITY_MAX_OTHER	0
+#define	LX_SCHED_PRIORITY_MIN_RRFIFO	1
+#define	LX_SCHED_PRIORITY_MAX_RRFIFO	99
+
+/*
+ * Based on code from brand_misc.h, but use of that is incompatible with the
+ * lx brand.
+ *
+ * These macros invoke a brandsys subcommand, B_TRUSS_POINT, which makes it
+ * easy to debug with DTrace.
+ */
+#define	B_TRUSS_POINT	6
+
+#define	B_TRACE_POINT_5(a0, a1, a2, a3, a4) \
+	(void) syscall(SYS_brand, B_TRUSS_POINT, (a0), (a1), (a2), (a3), (a4))
+
+#define	B_TRACE_POINT_4(a0, a1, a2, a3) \
+	B_TRACE_POINT_5((a0), (a1), (a2), (a3), 0)
+
+#define	B_TRACE_POINT_3(a0, a1, a2) \
+	B_TRACE_POINT_5((a0), (a1), (a2), 0, 0)
+
+#define	B_TRACE_POINT_2(a0, a1) \
+	B_TRACE_POINT_5((a0), (a1), 0, 0, 0)
+
+#define	B_TRACE_POINT_1(a0) \
+	B_TRACE_POINT_5((a0), 0, 0, 0, 0)
+
+#define	B_TRACE_POINT_0() \
+	B_TRACE_POINT_5(0, 0, 0, 0, 0)
+
+/*
+ * Macros to access register state within a ucontext_t:
+ */
+#define	LX_REG(ucp, r)	((ucp)->uc_mcontext.gregs[(r)])
+
+/*
+ * normally we never want to write to stderr or stdout because it's unsafe
+ * to make assumptions about the underlying file descriptors.  to protect
+ * against writes to these file descriptors we go ahead and close them
+ * our brand process initalization code.  but there are still occasions
+ * where we are willing to make assumptions about our file descriptors
+ * and write to them.  at thes times we should use one lx_msg() or
+ * lx_msg_error()
+ */
+extern void lx_msg(char *, ...);
+extern void lx_err(char *, ...);
+extern void lx_err_fatal(char *, ...);
+extern void lx_unsupported(char *, ...);
+
+struct ucontext;
+
+extern ucontext_t *lx_syscall_regs(void);
+extern uintptr_t lx_find_brand_sp(void);
+extern const ucontext_t *lx_find_brand_uc(void);
+
+extern void lx_jump_to_linux(ucontext_t *) __NORETURN;
+
+extern char *lx_fd_to_path(int fd, char *buf, int buf_size);
+extern int lx_lpid_to_spair(pid_t, pid_t *, lwpid_t *);
+extern int lx_lpid_to_spid(pid_t, pid_t *);
+
+extern void lx_ptrace_init();
+extern int lx_ptrace_wait(siginfo_t *);
+extern void lx_ptrace_fork(void);
+extern void lx_ptrace_stop_if_option(int, boolean_t, ulong_t msg, ucontext_t *);
+extern void lx_ptrace_clone_begin(int, boolean_t, int);
+
+extern int lx_check_alloca(size_t);
+#define	SAFE_ALLOCA(sz)	(lx_check_alloca(sz) ? alloca(sz) : NULL)
+
+extern void lx_init_tsd(lx_tsd_t *);
+extern int lx_alloc_stack(void **, size_t *);
+extern void lx_install_stack(void *, size_t, lx_tsd_t *);
+extern void lx_free_stack(void);
+extern void lx_free_other_stacks(void);
+extern void lx_stack_prefork(void);
+extern void lx_stack_postfork(void);
+
+extern void lx_block_all_signals();
+extern void lx_unblock_all_signals();
+
+/*
+ * NO_UUCOPY disables calls to the uucopy* system calls to help with
+ * debugging brand library accesses to linux application memory.
+ */
+#ifdef NO_UUCOPY
+
+int uucopy_unsafe(const void *src, void *dst, size_t n);
+int uucopystr_unsafe(const void *src, void *dst, size_t n);
+
+#define	uucopy(src, dst, n)	uucopy_unsafe((src), (dst), (n))
+#define	uucopystr(src, dst, n)	uucopystr_unsafe((src), (dst), (n))
+
+#endif /* NO_UUCOPY */
+
+/*
+ * We use these Private libc interfaces to defer signals during critical
+ * sections.
+ */
+extern void _sigon(void);
+extern void _sigoff(void);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_mount.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_mount.h
new file mode 100644
index 0000000000..f9b239150d
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_mount.h
@@ -0,0 +1,163 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_LX_MOUNT_H
+#define	_LX_MOUNT_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#include <rpc/rpc.h>
+#include <nfs/nfs.h>
+
+extern int lx_nfs_mount(char *, char *, char *, int, char *);
+
+/*
+ * mount() is significantly different between Linux and Solaris.  The main
+ * difference is between the set of flags.  Some flags on Linux can be
+ * translated to a Solaris equivalent, some are converted to a
+ * filesystem-specific option, while others have no equivalent whatsoever.
+ */
+#define	LX_MS_MGC_VAL		0xC0ED0000
+#define	LX_MS_RDONLY		0x00000001
+#define	LX_MS_NOSUID		0x00000002
+#define	LX_MS_NODEV		0x00000004
+#define	LX_MS_NOEXEC		0x00000008
+#define	LX_MS_SYNCHRONOUS	0x00000010
+#define	LX_MS_REMOUNT		0x00000020
+#define	LX_MS_MANDLOCK		0x00000040
+#define	LX_MS_NOATIME		0x00000400
+#define	LX_MS_NODIRATIME	0x00000800
+#define	LX_MS_BIND		0x00001000
+#define	LX_MS_MOVE		0x00002000
+#define	LX_MS_REC		0x00004000
+#define	LX_MS_SILENT		0x00008000
+#define	LX_MS_POSIXACL		0x00010000
+#define	LX_MS_UNBINDABLE	0x00020000
+#define	LX_MS_PRIVATE		0x00040000
+#define	LX_MS_SLAVE		0x00080000
+#define	LX_MS_SHARED		0x00100000
+#define	LX_MS_RELATIME		0x00200000
+#define	LX_MS_KERNMOUNT		0x00400000
+#define	LX_MS_I_VERSION		0x00800000
+#define	LX_MS_STRICTATIME	0x01000000
+#define	LX_MS_LAZYTIME		0x02000000
+
+/* internal flags - ignored if passed in */
+#define	LX_MS_NOSEC		0x10000000
+#define	LX_MS_BORN		0x20000000
+#define	LX_MS_ACTIVE		0x40000000
+#define	LX_MS_NOUSER		0x80000000
+
+#define	LX_MS_SUPPORTED		(LX_MS_MGC_VAL | \
+				LX_MS_RDONLY | LX_MS_NOSUID | \
+				LX_MS_NODEV | LX_MS_NOEXEC | \
+				LX_MS_REMOUNT | LX_MS_NOATIME | \
+				LX_MS_NODIRATIME | LX_MS_BIND | LX_MS_SILENT | \
+				LX_MS_STRICTATIME | LX_MS_NOSEC | \
+				LX_MS_BORN | LX_MS_ACTIVE | LX_MS_NOUSER)
+
+/*
+ * support for nfs mounts
+ */
+#define	LX_NMD_MAXHOSTNAMELEN		256
+
+#define	LX_NFS_MOUNT_SOFT		0x00000001
+#define	LX_NFS_MOUNT_INTR		0x00000002
+#define	LX_NFS_MOUNT_SECURE		0x00000004
+#define	LX_NFS_MOUNT_POSIX		0x00000008
+#define	LX_NFS_MOUNT_NOCTO		0x00000010
+#define	LX_NFS_MOUNT_NOAC		0x00000020
+#define	LX_NFS_MOUNT_TCP		0x00000040
+#define	LX_NFS_MOUNT_VER3		0x00000080
+#define	LX_NFS_MOUNT_KERBEROS		0x00000100
+#define	LX_NFS_MOUNT_NONLM		0x00000200
+#define	LX_NFS_MOUNT_BROKEN_SUID	0x00000400
+#define	LX_NFS_MOUNT_SUPPORTED		(LX_NFS_MOUNT_SOFT | \
+					LX_NFS_MOUNT_INTR | \
+					LX_NFS_MOUNT_POSIX | \
+					LX_NFS_MOUNT_NOCTO | \
+					LX_NFS_MOUNT_NOAC | \
+					LX_NFS_MOUNT_TCP | \
+					LX_NFS_MOUNT_VER3 | \
+					LX_NFS_MOUNT_NONLM)
+
+#define	LX_NMD_DEFAULT_RSIZE		0
+#define	LX_NMD_DEFAULT_WSIZE		0
+
+/*
+ * the nfs v3 file handle structure definitions are _almost_ the same
+ * on linux and solaris.  the key difference are:
+ *
+ * 1) on linux fh3_length is an unsigned short where as on solaris it's
+ *    an int.
+ *
+ * 2) on linux the file handle data doesn't 32 bit members, so the structure
+ *    is not 32 bit aligned.  (where as on solaris it is.)
+ *
+ * so rather than defining a structure that would allow us to intrepret
+ * all the contents of the nfs v3 file handle here, we decide to treate
+ * the file handle as an array of chars.  this works just fine since it
+ * avoids the alignment issues and the actual file handle handle contects
+ * are defined by the nfs specification so they are common across solaris
+ * and linux.  we do the same thing for nfs v2 file handles.
+ */
+struct lx_nfs_fh2 {
+	unsigned char	lx_fh_data[NFS_FHSIZE];
+} lx_nfs_fh2;
+
+struct lx_nfs_fh3 {
+	unsigned short	lx_fh3_length;
+	unsigned char	lx_fh3_data[NFS3_FHSIZE];
+} lx_nfs_fh3;
+
+typedef struct lx_nfs_mount_data {
+	int			nmd_version;
+	int			nmd_fd;
+	struct lx_nfs_fh2	nmd_old_root;
+	int			nmd_flags;
+	int			nmd_rsize;
+	int			nmd_wsize;
+	int			nmd_timeo;
+	int			nmd_retrans;
+	int			nmd_acregmin;
+	int			nmd_acregmax;
+	int			nmd_acdirmin;
+	int			nmd_acdirmax;
+	struct sockaddr_in	nmd_addr;
+	char			nmd_hostname[LX_NMD_MAXHOSTNAMELEN];
+	int			nmd_namlen;
+	uint_t			nmd_bsize;
+	struct lx_nfs_fh3	nmd_root;
+} lx_nfs_mount_data_t;
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_MOUNT_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_poll.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_poll.h
new file mode 100644
index 0000000000..99abdbbf46
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_poll.h
@@ -0,0 +1,65 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.	All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef _SYS_LX_POLL_H
+#define	_SYS_LX_POLL_H
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * These events are identical between Linux and Solaris
+ */
+#define	LX_POLLIN	0x001
+#define	LX_POLLPRI	0x002
+#define	LX_POLLOUT	0x004
+#define	LX_POLLERR	0x008
+#define	LX_POLLHUP	0x010
+#define	LX_POLLNVAL	0x020
+#define	LX_POLLRDNORM	0x040
+#define	LX_POLLRDBAND	0x080
+
+#define	LX_POLL_COMMON_EVENTS (LX_POLLIN | LX_POLLPRI | LX_POLLOUT |	\
+	LX_POLLERR | LX_POLLHUP | LX_POLLNVAL | LX_POLLRDNORM | LX_POLLRDBAND)
+
+/*
+ * These events differ between Linux and Solaris
+ */
+#define	LX_POLLWRNORM	0x0100
+#define	LX_POLLWRBAND	0x0200
+#define	LX_POLLRDHUP	0x2000
+
+
+#define	LX_POLL_SUPPORTED_EVENTS	\
+	(LX_POLL_COMMON_EVENTS | LX_POLLWRNORM | LX_POLLWRBAND | LX_POLLRDHUP)
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_POLL_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_signal.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_signal.h
new file mode 100644
index 0000000000..9d77524410
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_signal.h
@@ -0,0 +1,289 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_LX_SIGNAL_H
+#define	_SYS_LX_SIGNAL_H
+
+#if !defined(_ASM)
+#include <sys/lx_types.h>
+#include <sys/ucontext.h>
+#include <sys/lx_siginfo.h>
+#include <lx_signum.h>
+
+#endif	/* !defined(_ASM) */
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Linux sigaction flags
+ */
+#define	LX_SA_NOCLDSTOP		0x00000001
+#define	LX_SA_NOCLDWAIT		0x00000002
+#define	LX_SA_SIGINFO		0x00000004
+#define	LX_SA_RESTORER		0x04000000
+#define	LX_SA_ONSTACK		0x08000000
+#define	LX_SA_RESTART		0x10000000
+#define	LX_SA_NODEFER		0x40000000
+#define	LX_SA_RESETHAND		0x80000000
+#define	LX_SA_NOMASK		LX_SA_NODEFER
+#define	LX_SA_ONESHOT		LX_SA_RESETHAND
+
+#define	LX_SIG_BLOCK		0
+#define	LX_SIG_UNBLOCK		1
+#define	LX_SIG_SETMASK		2
+
+#define	LX_MINSIGSTKSZ		2048
+#define	LX_SS_ONSTACK		1
+#define	LX_SS_DISABLE		2
+
+#define	LX_SIGRT_MAGIC		0xdeadf00d
+
+#if !defined(_ASM)
+
+typedef struct lx_sigaction {
+	void (*lxsa_handler)();
+	int lxsa_flags;
+	void (*lxsa_restorer)(void);
+	lx_sigset_t lxsa_mask;
+} lx_sigaction_t;
+
+#if defined(_ILP32)
+typedef	uint32_t lx_osigset_t;
+
+#define	OSIGSET_NBITS		(sizeof (lx_osigset_t) * NBBY)
+#define	OSIGSET_BITSET(sig)	(1U << (((sig) - 1) % OSIGSET_NBITS))
+
+typedef struct lx_osigaction {
+	void (*lxsa_handler)();
+	lx_osigset_t lxsa_mask;
+	int lxsa_flags;
+	void (*lxsa_restorer)(void);
+} lx_osigaction_t;
+#endif
+
+/*
+ * Flag settings to determine whether common routines should operate on
+ * lx_sigset_ts or lx_osigset_ts.
+ */
+#define	USE_OSIGSET	0
+#define	USE_SIGSET	1
+
+typedef struct lx_sighandlers {
+	struct lx_sigaction lx_sa[LX_NSIG + 1];
+} lx_sighandlers_t;
+
+typedef struct lx_sigaltstack {
+	void *ss_sp;
+	int ss_flags;
+	size_t ss_size;
+} lx_stack_t;
+
+/*
+ * _fpreg, _fpxreg, _xmmreg and _fpstate are defined in Linux src in:
+ *     arch/x86/include/uapi/asm/sigcontext.h
+ */
+#define	LX_X86_FXSR_MAGIC	0x0000
+#define	LX_X86_FXSR_NONE	0xffff
+
+#if defined(_LP64)
+
+typedef struct lx_fpstate {
+	ushort_t cwd;
+	ushort_t swd;
+	ushort_t twd; /* Note this is not the same as the 32bit/x87/FSAVE twd */
+	ushort_t fop;
+	uint64_t rip;
+	uint64_t rdp;
+	uint32_t mxcsr;
+	uint32_t mxcsr_mask;
+	uint32_t st_space[32];   /* 8 * 16 bytes for each FP-reg */
+	uint32_t xmm_space[64];  /* 16 * 16 bytes for each XMM-reg  */
+	uint32_t reserved2[12];
+	uint32_t reserved3[12];
+} lx_fpstate_t;
+
+/*
+ * The Linux layout is defined in the Linux src tree in:
+ *     arch/x86/include/asm/sigcontext.h
+ * and the user-level def (which is what we want) at:
+ *     arch/x86/include/uapi/asm/sigcontext.h
+ *
+ * The Illumos offsets of the registers in the context are defined in:
+ *     usr/src/uts/intel/sys/regset.h
+ * this is an mcontext_t from uc_mcontext.
+ *
+ * For the 64-bit case the register layout is completely different in the
+ * context.
+ */
+typedef struct lx_sigcontext {
+	ulong_t sc_r8;
+	ulong_t sc_r9;
+	ulong_t sc_r10;
+	ulong_t sc_r11;
+	ulong_t sc_r12;
+	ulong_t sc_r13;
+	ulong_t sc_r14;
+	ulong_t sc_r15;
+	ulong_t sc_rdi;
+	ulong_t sc_rsi;
+	ulong_t sc_rbp;
+	ulong_t sc_rbx;
+	ulong_t sc_rdx;
+	ulong_t sc_rax;
+	ulong_t sc_rcx;
+	ulong_t sc_rsp;
+	ulong_t sc_rip;
+	ulong_t sc_eflags;
+	ushort_t sc_cs;
+	ushort_t sc_gs;
+	ushort_t sc_fs;
+	ushort_t sc_pad0;
+	ulong_t sc_err;
+	ulong_t sc_trapno;
+
+	ulong_t sc_mask;
+	ulong_t sc_cr2;
+	lx_fpstate_t *sc_fpstate;
+
+	ulong_t reserved[8];
+} lx_sigcontext_t;
+
+#else /* is _ILP32 */
+
+struct lx_fpreg {
+	ushort_t significand[4];
+	ushort_t exponent;
+};
+
+struct lx_fpxreg {
+	ushort_t significand[4];
+	ushort_t exponent;
+	ushort_t padding[3];
+};
+
+struct lx_xmmreg {
+	uint32_t element[4];
+};
+
+typedef struct lx_fpstate {
+	/* Regular FPU environment */
+	ulong_t cw;
+	ulong_t sw;
+	ulong_t tag;
+	ulong_t ipoff;
+	ulong_t cssel;
+	ulong_t dataoff;
+	ulong_t datasel;
+	struct lx_fpreg _st[8];
+	ushort_t status;
+	ushort_t magic;  		/* 0xffff = regular FPU data */
+
+	/* FXSR FPU environment */
+	ulong_t _fxsr_env[6]; 		/* env is ignored */
+	ulong_t mxcsr;
+	ulong_t reserved;
+	struct lx_fpxreg _fxsr_st[8];  /* reg data is ignored */
+	struct lx_xmmreg _xmm[8];
+	ulong_t padding[56];
+} lx_fpstate_t;
+
+/*
+ * The Linux layout is defined in the Linux src tree in:
+ *     arch/x86/include/asm/sigcontext.h
+ * and the user-level def (which is what we want) at:
+ *     arch/x86/include/uapi/asm/sigcontext.h
+ *
+ * The Illumos offsets of the registers in the context are defined by the
+ * i386 ABI (see usr/src/uts/intel/sys/regset.h).
+ *
+ * Both Illumos and Linux match up here.
+ */
+typedef struct lx_sigcontext {
+	ulong_t sc_gs;
+	ulong_t sc_fs;
+	ulong_t sc_es;
+	ulong_t sc_ds;
+	ulong_t sc_edi;
+	ulong_t sc_esi;
+	ulong_t sc_ebp;
+	ulong_t sc_esp;
+	ulong_t sc_ebx;
+	ulong_t sc_edx;
+	ulong_t sc_ecx;
+	ulong_t sc_eax;
+	ulong_t sc_trapno;
+	ulong_t sc_err;
+	ulong_t sc_eip;
+	ulong_t sc_cs;
+	ulong_t sc_eflags;
+	ulong_t sc_esp_at_signal;
+	ulong_t sc_ss;
+
+	lx_fpstate_t *sc_fpstate;
+	ulong_t sc_mask;
+	ulong_t sc_cr2;
+} lx_sigcontext_t;
+#endif
+
+typedef struct lx_ucontext {
+	ulong_t uc_flags;		/* Linux always sets this to 0 */
+	struct lx_ucontext *uc_link;	/* Linux always sets this to NULL */
+	lx_stack_t uc_stack;
+	lx_sigcontext_t uc_sigcontext;
+	lx_sigset_t uc_sigmask;
+} lx_ucontext_t;
+
+typedef struct lx_sigbackup lx_sigbackup_t;
+struct lx_sigbackup {
+	ucontext_t *lxsb_retucp;
+	ucontext_t *lxsb_sigucp;
+	uintptr_t lxsb_sigdeliver_frame;
+	lx_sigbackup_t *lxsb_previous;
+};
+
+extern const int ltos_signo[];
+extern const int stol_signo[];
+
+extern void setsigacthandler(void (*)(int, siginfo_t *, void *),
+    void (**)(int, siginfo_t *, void *),
+    int (*)(const ucontext_t *));
+
+extern int lx_siginit(void);
+extern void lx_sighandlers_save(lx_sighandlers_t *);
+extern void lx_sighandlers_restore(lx_sighandlers_t *);
+
+extern int stol_siginfo(siginfo_t *siginfop, lx_siginfo_t *lx_siginfop);
+extern int stol_status(int);
+
+#endif	/* !defined(_ASM) */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_SIGNAL_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_sigstack.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_sigstack.h
new file mode 100644
index 0000000000..fbbf462389
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_sigstack.h
@@ -0,0 +1,78 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_LX_SIGSTACK_H
+#define	_SYS_LX_SIGSTACK_H
+
+#if !defined(_ASM)
+#include <sys/lx_types.h>
+#include <sys/ucontext.h>
+#include <sys/lx_signal.h>
+#include <lx_signum.h>
+
+#endif	/* !defined(_ASM) */
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Two flavors of Linux signal stacks:
+ *
+ * lx_sigstack - used for "modern" signal handlers, in practice those
+ *               that have the sigaction(2) flag SA_SIGINFO set
+ *
+ * lx_oldsigstack - used for legacy signal handlers, those that do not have
+ *		    the sigaction(2) flag SA_SIGINFO set or that were setup via
+ *		    the signal(2) call.
+ *
+ * NOTE: Since these structures will be placed on the stack and stack math will
+ *	 be done with their sizes, for the 32-bit code they must be word
+ *	 aligned in size (4 bytes) so the stack remains word aligned per the
+ *	 i386 ABI, or, for 64-bit code they must be 16 byte aligned as per the
+ *	 AMD64 ABI.
+ *
+ *	 The precise layout of these stack frames is also potentially
+ *	 depended on by particularly esoteric (or broken) software, and
+ *	 should be preserved.  The Linux structures (rt_sigframe, et al)
+ *	 are defined in "arch/x86/include/asm/sigframe.h".
+ */
+#if defined(_LP64)
+typedef struct lx_sigstack {
+	void (*retaddr)();	/* address of real lx_rt_sigreturn code */
+	lx_ucontext_t uc;	/* saved user context */
+	lx_siginfo_t si;	/* saved signal information */
+	lx_fpstate_t fpstate;	/* saved FP state */
+	char pad[2];		/* stack alignment */
+} lx_sigstack_t;
+#else
+struct lx_sigstack {
+	void (*retaddr)();	/* address of real lx_rt_sigreturn code */
+	int sig;		/* signal number */
+	lx_siginfo_t *sip;	/* points to "si" if valid, NULL if not */
+	lx_ucontext_t *ucp;	/* points to "uc" */
+	lx_siginfo_t si;	/* saved signal information */
+	lx_ucontext_t uc;	/* saved user context */
+	lx_fpstate_t fpstate;	/* saved FP state */
+	char trampoline[8];	/* code for trampoline to lx_rt_sigreturn() */
+};
+#endif
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_SIGSTACK_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_socket.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_socket.h
new file mode 100644
index 0000000000..2bbc31a234
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_socket.h
@@ -0,0 +1,147 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.	All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc. All rights reserved.
+ */
+
+#ifndef _SYS_LX_SOCKET_H
+#define	_SYS_LX_SOCKET_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <sys/lx_types.h>
+
+/*
+ * Linux address family definitions
+ * Some of these are not supported
+ */
+#define	LX_AF_UNSPEC		0  /* Unspecified */
+#define	LX_AF_UNIX		1  /* local file/pipe name */
+#define	LX_AF_INET		2  /* IP protocol family */
+#define	LX_AF_AX25		3  /* Amateur Radio AX.25 */
+#define	LX_AF_IPX		4  /* Novell Internet Protocol */
+#define	LX_AF_APPLETALK		5  /* Appletalk */
+#define	LX_AF_NETROM		6  /* Amateur radio */
+#define	LX_AF_BRIDGE		7  /* Multiprotocol bridge */
+#define	LX_AF_ATMPVC		8  /* ATM PVCs */
+#define	LX_AF_X25		9  /* X.25 */
+#define	LX_AF_INET6		10 /* IPV 6 */
+#define	LX_AF_ROSE		11 /* Amateur Radio X.25 */
+#define	LX_AF_DECnet		12 /* DECnet */
+#define	LX_AF_NETBEUI		13 /* 802.2LLC */
+#define	LX_AF_SECURITY		14 /* Security callback */
+#define	LX_AF_KEY		15 /* key management */
+#define	LX_AF_ROUTE		16 /* Alias to emulate 4.4BSD */
+#define	LX_AF_PACKET		17 /* Packet family */
+#define	LX_AF_ASH		18 /* Ash ? */
+#define	LX_AF_ECONET		19 /* Acorn Econet */
+#define	LX_AF_ATMSVC		20 /* ATM SVCs */
+#define	LX_AF_SNA		22 /* Linux SNA */
+#define	LX_AF_IRDA		23 /* IRDA sockets */
+#define	LX_AF_PPPOX		24 /* PPPoX sockets */
+#define	LX_AF_WANPIPE		25 /* Wanpipe API sockets */
+#define	LX_AF_BLUETOOTH		31 /* Bluetooth sockets */
+#define	LX_AF_MAX		33 /* MAX socket type  */
+
+#define	AF_NOTSUPPORTED		-1
+#define	AF_INVAL		-2
+
+/*
+ * Linux ARP protocol hardware identifiers
+ */
+#define	LX_ARPHRD_ETHER		1	/* Ethernet */
+#define	LX_ARPHRD_LOOPBACK	772	/* Loopback */
+#define	LX_ARPHRD_VOID		0xffff	/* Unknown */
+
+/*
+ * Linux socket type definitions
+ */
+#define	LX_SOCK_STREAM		1  /* Connection-based byte streams */
+#define	LX_SOCK_DGRAM		2  /* Connectionless, datagram */
+#define	LX_SOCK_RAW		3  /* Raw protocol interface */
+#define	LX_SOCK_RDM		4  /* Reliably-delivered message */
+#define	LX_SOCK_SEQPACKET	5  /* Sequenced packet stream */
+#define	LX_SOCK_PACKET		10 /* Linux specific */
+#define	LX_SOCK_MAX		11
+
+/*
+ * The Linux socket type can be or-ed with other flags (e.g. SOCK_CLOEXEC).
+ */
+#define	LX_SOCK_TYPE_MASK	0xf
+
+/*
+ * Linux flags for socket, socketpair and accept4. These are or-ed into the
+ * socket type value. In the Linux net.h header these come from fcntl.h (note
+ * that they are in octal in the Linux header).
+ */
+#define	LX_SOCK_CLOEXEC		0x80000
+#define	LX_SOCK_NONBLOCK	0x800
+
+#define	SOCK_NOTSUPPORTED	-1
+#define	SOCK_INVAL		-2
+
+/*
+ * PF_PACKET protocol definitions.
+ */
+#define	LX_ETH_P_802_3	0x0001
+#define	LX_ETH_P_ALL	0x0003
+#define	LX_ETH_P_802_2	0x0004
+#define	LX_ETH_P_IP	0x0800
+#define	LX_ETH_P_ARP	0x0806
+#define	LX_ETH_P_IPV6	0x86DD
+
+/*
+ * Linux socketcall indices.
+ * These constitute all 17 socket related system calls
+ *
+ * These system calls are called via a single system call socketcall().
+ * The first arg being the endex of the system call type
+ */
+#define	LX_SOCKET		1
+#define	LX_BIND			2
+#define	LX_CONNECT		3
+#define	LX_LISTEN		4
+#define	LX_ACCEPT		5
+#define	LX_GETSOCKNAME		6
+#define	LX_GETPEERNAME		7
+#define	LX_SOCKETPAIR		8
+#define	LX_SEND			9
+#define	LX_RECV			10
+#define	LX_SENDTO		11
+#define	LX_RECVFROM		12
+#define	LX_SHUTDOWN		13
+#define	LX_SETSOCKOPT		14
+#define	LX_GETSOCKOPT		15
+#define	LX_SENDMSG		16
+#define	LX_RECVMSG		17
+#define	LX_ACCEPT4		18
+#define	LX_RECVMMSG		19
+#define	LX_SENDMMSG		20
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_SOCKET_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_statfs.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_statfs.h
new file mode 100644
index 0000000000..02f1a9b32b
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_statfs.h
@@ -0,0 +1,85 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef	_LX_STATFS_H
+#define	_LX_STATFS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+extern int lx_statfs_init(void);
+
+struct lx_statfs {
+	size_t		f_type;
+	size_t		f_bsize;
+	ulong_t		f_blocks;
+	ulong_t		f_bfree;
+	ulong_t		f_bavail;
+	ulong_t		f_files;
+	ulong_t		f_ffree;
+	u_longlong_t	f_fsid;
+	size_t		f_namelen;
+	size_t		f_frsize;
+	size_t		f_spare[5];
+};
+
+struct lx_statfs64 {
+	int		f_type;
+	int		f_bsize;
+	u_longlong_t	f_blocks;
+	u_longlong_t	f_bfree;
+	u_longlong_t	f_bavail;
+	u_longlong_t	f_files;
+	u_longlong_t	f_ffree;
+	u_longlong_t	f_fsid;
+	int		f_namelen;
+	int		f_frsize;
+	int		f_spare[5];
+};
+
+/*
+ * These magic values are taken mostly from statfs(2) or magic.h
+ */
+#define	LX_AUTOFS_SUPER_MAGIC		0x0187
+#define	LX_CGROUP_SUPER_MAGIC		0x27e0eb
+#define	LX_DEVFS_SUPER_MAGIC		0x1373
+#define	LX_DEVPTS_SUPER_MAGIC		0x1cd1
+#define	LX_EXT2_SUPER_MAGIC		0xEF53
+#define	LX_ISOFS_SUPER_MAGIC		0x9660
+#define	LX_MSDOS_SUPER_MAGIC		0x4d44
+#define	LX_NFS_SUPER_MAGIC		0x6969
+#define	LX_PROC_SUPER_MAGIC		0x9fa0
+#define	LX_SYSFS_SUPER_MAGIC		0x62656572
+#define	LX_TMPFS_SUPER_MAGIC		0x01021994
+#define	LX_UFS_MAGIC			0x00011954
+#define	LX_PIPEFS_MAGIC			0x50495045
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_STATFS_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_syscall.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_syscall.h
new file mode 100644
index 0000000000..6b06140db2
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_syscall.h
@@ -0,0 +1,194 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _SYS_LX_SYSCALL_H
+#define	_SYS_LX_SYSCALL_H
+
+#include <sys/lx_brand.h>
+
+#if !defined(_ASM)
+
+#include <sys/types.h>
+#include <sys/procset.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern int lx_install;
+
+extern long lx_mknodat(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_futimesat(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_utimensat(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_fstatat64(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_stat(uintptr_t, uintptr_t);
+extern long lx_fstat(uintptr_t, uintptr_t);
+extern long lx_lstat(uintptr_t, uintptr_t);
+extern long lx_stat64(uintptr_t, uintptr_t);
+extern long lx_fstat64(uintptr_t, uintptr_t);
+extern long lx_lstat64(uintptr_t, uintptr_t);
+extern long lx_fcntl(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_fcntl64(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_readdir(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_execve(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_ioctl(uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_settimeofday(uintptr_t, uintptr_t);
+extern long lx_mknod(uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_capget(uintptr_t, uintptr_t);
+extern long lx_capset(uintptr_t, uintptr_t);
+
+extern long lx_clock_nanosleep(int, int flags, struct timespec *,
+    struct timespec *);
+extern long lx_adjtimex(void *);
+extern long lx_timer_settime(timer_t, int, struct itimerspec *,
+    struct itimerspec *);
+extern long lx_timer_gettime(timer_t, struct itimerspec *);
+extern long lx_timer_getoverrun(timer_t);
+extern long lx_timer_delete(timer_t);
+
+extern long lx_truncate(uintptr_t, uintptr_t);
+extern long lx_ftruncate(uintptr_t, uintptr_t);
+extern long lx_truncate64(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_ftruncate64(uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_sysctl(uintptr_t);
+extern long lx_fsync(uintptr_t);
+extern long lx_fdatasync(uintptr_t);
+extern long lx_rmdir(uintptr_t);
+extern long lx_utime(uintptr_t, uintptr_t);
+extern long lx_sysfs(uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_uname(uintptr_t);
+extern long lx_getgroups16(uintptr_t, uintptr_t);
+extern long lx_setgroups(uintptr_t, uintptr_t);
+extern long lx_setgroups16(uintptr_t, uintptr_t);
+
+extern long lx_query_module(uintptr_t, uintptr_t, uintptr_t, uintptr_t,
+    uintptr_t);
+
+extern long lx_setitimer(uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_clone(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_exit(uintptr_t);
+extern long lx_group_exit(uintptr_t);
+
+extern long lx_mount(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_statfs(uintptr_t, uintptr_t);
+extern long lx_fstatfs(uintptr_t, uintptr_t);
+extern long lx_statfs64(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_fstatfs64(uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_sigreturn(void);
+extern long lx_rt_sigreturn(void);
+extern long lx_signal(uintptr_t, uintptr_t);
+extern long lx_sigaction(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_rt_sigaction(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_sigaltstack(uintptr_t, uintptr_t);
+extern long lx_sigpending(uintptr_t);
+extern long lx_rt_sigpending(uintptr_t, uintptr_t);
+extern long lx_sigprocmask(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_rt_sigprocmask(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_sigsuspend(uintptr_t);
+extern long lx_rt_sigsuspend(uintptr_t, uintptr_t);
+extern long lx_rt_sigwaitinfo(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_rt_sigtimedwait(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_rt_sigqueueinfo(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_rt_tgsigqueueinfo(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_futex(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t,
+    uintptr_t);
+
+extern long lx_tkill(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t,
+    uintptr_t);
+extern long lx_tgkill(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t,
+    uintptr_t);
+
+extern long lx_sendfile(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_sendfile64(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_fork(void);
+extern long lx_vfork(void);
+extern long lx_exec(uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_ptrace(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_xattr2(uintptr_t, uintptr_t);
+extern long lx_xattr3(uintptr_t, uintptr_t, uintptr_t);
+extern long lx_xattr4(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+
+extern long lx_keyctl(void);
+
+extern long lx_ipc(uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+extern long lx_msgget(key_t, int);
+extern long lx_msgsnd(int, void *, size_t, int);
+extern long lx_msgrcv(int, void *, size_t, long, int);
+extern long lx_msgctl(int, int, void *);
+extern long lx_semget(key_t, int, int);
+extern long lx_semop(int, void *, size_t);
+extern long lx_semtimedop(int, void *, size_t, struct timespec *);
+extern long lx_semctl(int, int, int, void *);
+extern long lx_shmget(key_t, size_t, int);
+extern long lx_shmat(int, void *, int);
+extern long lx_shmctl(int, int, void *);
+
+extern long lx_getgroups(int, gid_t *);
+extern long lx_inotify_add_watch(int, const char *, uint32_t);
+extern long lx_inotify_init(void);
+extern long lx_inotify_init1(int);
+extern long lx_inotify_rm_watch(int, int);
+extern long lx_shmdt(char *);
+extern long lx_signalfd(int, uintptr_t, size_t);
+extern long lx_signalfd4(int, uintptr_t, size_t, int);
+extern long lx_timerfd_create(int, int);
+extern long lx_timerfd_settime(int, int,
+    const struct itimerspec *, struct itimerspec *);
+extern long lx_timerfd_gettime(int, struct itimerspec *);
+extern long lx_utimes(const char *, const struct timeval *);
+
+#endif	/* !defined(_ASM) */
+
+
+#if defined(_LP64)
+#define	LX_SYS_clone		56
+#define	LX_SYS_vfork		58
+#else
+#define	LX_SYS_clone		120
+#define	LX_SYS_vfork		190
+#endif
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_SYSCALL_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_sysv_ipc.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_sysv_ipc.h
new file mode 100644
index 0000000000..f9f49598b7
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_sysv_ipc.h
@@ -0,0 +1,222 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _LX_SYSV_IPC_H
+#define	_LX_SYSV_IPC_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * msg-related definitions.
+ */
+#define	LX_IPC_CREAT	00001000
+#define	LX_IPC_EXCL	00002000
+#define	LX_IPC_NOWAIT	00004000
+
+#define	LX_IPC_RMID	0
+#define	LX_IPC_SET	1
+#define	LX_IPC_STAT	2
+#define	LX_IPC_INFO	3
+
+#define	LX_IPC_64	0x0100
+
+#define	LX_SEMOP	1
+#define	LX_SEMGET	2
+#define	LX_SEMCTL	3
+#define	LX_MSGSND	11
+#define	LX_MSGRCV	12
+#define	LX_MSGGET	13
+#define	LX_MSGCTL	14
+#define	LX_SHMAT	21
+#define	LX_SHMDT	22
+#define	LX_SHMGET	23
+#define	LX_SHMCTL	24
+
+#define	LX_MSG_STAT	11
+#define	LX_MSG_INFO	12
+
+#define	LX_MSG_NOERROR	010000
+
+/*
+ * Linux hard codes the maximum msgbuf length to be 8192 bytes.  Really.
+ */
+#define	LX_MSGMAX	8192
+
+struct lx_ipc_perm {
+	key_t		key;
+	uid_t		uid;
+	uid_t		gid;
+	uid_t		cuid;
+	uid_t		cgid;
+	ushort_t	mode;
+	ushort_t	_pad1;
+	ushort_t	seq;
+	ushort_t	_pad2;
+	ulong_t		_unused1;
+	ulong_t		_unused2;
+};
+
+struct lx_msqid_ds {
+	struct lx_ipc_perm	msg_perm;
+	time_t			msg_stime;
+#if defined(_ILP32)
+	ulong_t			_unused1;
+#endif
+	time_t			msg_rtime;
+#if defined(_ILP32)
+	ulong_t			_unused2;
+#endif
+	time_t			msg_ctime;
+#if defined(_ILP32)
+	ulong_t			_unused3;
+#endif
+	ulong_t			msg_cbytes;
+	ulong_t			msg_qnum;
+	ulong_t			msg_qbytes;
+	pid_t			msg_lspid;
+	pid_t			msg_lrpid;
+	ulong_t			_unused4;
+	ulong_t			_unused5;
+};
+
+struct lx_msginfo {
+	int		msgpool;
+	int		msgmap;
+	int		msgmax;
+	int		msgmnb;
+	int		msgmni;
+	int		msgssz;
+	int		msgtql;
+	ushort_t	msgseg;
+};
+
+/*
+ * semaphore-related definitions.
+ */
+#define	LX_GETPID	11
+#define	LX_GETVAL	12
+#define	LX_GETALL	13
+#define	LX_GETNCNT	14
+#define	LX_GETZCNT	15
+#define	LX_SETVAL	16
+#define	LX_SETALL	17
+#define	LX_SEM_STAT	18
+#define	LX_SEM_INFO	19
+#define	LX_SEM_UNDO	0x1000
+#define	LX_SEMVMX	32767
+
+struct lx_semid_ds {
+	struct lx_ipc_perm	sem_perm;
+	time_t			sem_otime;
+	ulong_t			_unused1;
+	time_t			sem_ctime;
+	ulong_t			_unused2;
+	ulong_t			sem_nsems;
+	ulong_t			_unused3;
+	ulong_t			_unused4;
+};
+
+struct lx_seminfo {
+	int semmap;
+	int semmni;
+	int semmns;
+	int semmnu;
+	int semmsl;
+	int semopm;
+	int semume;
+	int semusz;
+	int semvmx;
+	int semaem;
+};
+
+union lx_semun {
+	int val;
+	struct lx_semid_ds *semds;
+	ushort_t *sems;
+	struct lx_seminfo *info;
+	uintptr_t dummy;
+};
+
+/*
+ * shm-related definitions
+ */
+#define	LX_SHM_LOCKED	02000
+#define	LX_SHM_RDONLY	010000
+#define	LX_SHM_RND	020000
+#define	LX_SHM_REMAP	040000
+
+#define	LX_SHM_LOCK	11
+#define	LX_SHM_UNLOCK	12
+#define	LX_SHM_STAT	13
+#define	LX_SHM_INFO	14
+
+struct lx_shmid_ds {
+	struct lx_ipc_perm	shm_perm;
+	size_t			shm_segsz;
+	time_t			shm_atime;
+#if defined(_ILP32)
+	ulong_t			_unused1;
+#endif
+	time_t			shm_dtime;
+#if defined(_ILP32)
+	ulong_t			_unused2;
+#endif
+	time_t			shm_ctime;
+#if defined(_ILP32)
+	ulong_t			_unused3;
+#endif
+	pid_t			shm_cpid;
+	pid_t			shm_lpid;
+	ushort_t		shm_nattch;
+	ulong_t			_unused4;
+	ulong_t			_unused5;
+};
+
+struct lx_shm_info {
+	int	used_ids;
+	ulong_t	shm_tot;
+	ulong_t	shm_rss;
+	ulong_t	shm_swp;
+	ulong_t	swap_attempts;
+	ulong_t	swap_successes;
+};
+
+struct lx_shminfo {
+	ulong_t	shmmax;
+	ulong_t	shmmin;
+	ulong_t	shmmni;
+	ulong_t	shmseg;
+	ulong_t	shmall;
+};
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_SYSV_IPC_H */
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_thread.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_thread.h
new file mode 100644
index 0000000000..0a17705dd1
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_thread.h
@@ -0,0 +1,80 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.	All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc
+ */
+
+#ifndef _SYS_LX_THREAD_H
+#define	_SYS_LX_THREAD_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <sys/lx_signal.h>
+#include <thread.h>
+
+typedef enum lx_exit_type {
+	LX_ET_NONE = 0,
+	LX_ET_EXIT,
+	LX_ET_EXIT_GROUP
+} lx_exit_type_t;
+
+typedef struct lx_tsd {
+	/* per-thread flag set on parent vfork, cleared on thread resume */
+	int		lxtsd_is_vforked;
+	lx_exit_type_t	lxtsd_exit;
+	int		lxtsd_exit_status;
+	ucontext_t	lxtsd_exit_context;
+
+	/*
+	 * If this value is non-zero, we use it in lx_sigdeliver() to represent
+	 * the in-use extent of the Linux (i.e. BRAND) stack for this thread.
+	 * Access to this value must be protected by _sigoff()/_sigon().
+	 */
+	uintptr_t	lxtsd_lx_sp;
+
+	/*
+	 * Alternate stack for Linux sigaltstack emulation:
+	 */
+	lx_stack_t	lxtsd_sigaltstack;
+
+	void		*lxtsd_clone_state;
+
+	lx_sigbackup_t	*lxtsd_sigbackup;
+} lx_tsd_t;
+
+extern thread_key_t	lx_tsd_key;
+
+extern void		lx_swap_gs(long, long *);
+
+extern void		lx_exit_common(void) __NORETURN;
+
+extern lx_tsd_t		*lx_get_tsd(void);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_THREAD_H */
diff --git a/usr/src/lib/brand/lx/lx_init/Makefile b/usr/src/lib/brand/lx/lx_init/Makefile
new file mode 100644
index 0000000000..e887e893f5
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_init/Makefile
@@ -0,0 +1,71 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+PROG =		lxinit
+
+PROG_OBJS =	lxinit.o pipe_stream.o run_command.o
+LIST_OBJS =	list.o
+
+OBJS =		$(PROG_OBJS) \
+		$(LIST_OBJS)
+SRCS =		$(PROG_OBJS:%.o=%.c) \
+		$(LIST_OBJS:%.o=$(SRC)/common/list/%.c)
+
+all:		$(PROG)
+
+include ../Makefile.lx
+include $(SRC)/cmd/Makefile.cmd
+
+# override the install directory
+ROOTBIN =	$(ROOTBRANDDIR)
+CLOBBERFILES =	$(OBJS) $(ROOTPROG)
+
+UTSBASE =	$(SRC)/uts
+
+CFLAGS +=	$(CCVERBOSE)
+CPPFLAGS +=	-D_REENTRANT -I$(UTSBASE)/common/brand/lx
+LDLIBS +=	-lzonecfg -lipadm -lsocket -linetutil -lnsl -lcustr -ldhcpagent
+
+.KEEP_STATE:
+
+install: all $(ROOTPROG)
+
+clean:
+	$(RM) $(PROG) $(OBJS)
+
+lint: lint_PROG lint_SRCS
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: %.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+%.o: $(SRC)/common/list/%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+include $(SRC)/cmd/Makefile.targ
diff --git a/usr/src/lib/brand/lx/lx_init/lxinit.c b/usr/src/lib/brand/lx/lx_init/lxinit.c
new file mode 100644
index 0000000000..983318c7eb
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_init/lxinit.c
@@ -0,0 +1,934 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * lxinit performs zone-specific initialization prior to handing control to the
+ * guest Linux init.  This primarily consists of:
+ *
+ * - Starting ipmgmtd
+ * - Configuring network interfaces
+ * - Adding a default route
+ */
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <limits.h>
+#include <net/if.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <stropts.h>
+#include <sys/ioccom.h>
+#include <sys/stat.h>
+#include <sys/systeminfo.h>
+#include <sys/sockio.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/varargs.h>
+#include <unistd.h>
+#include <libintl.h>
+#include <locale.h>
+#include <libcustr.h>
+
+#include <netinet/dhcp.h>
+#include <dhcpagent_util.h>
+#include <dhcpagent_ipc.h>
+
+#include <arpa/inet.h>
+#include <net/route.h>
+#include <libipadm.h>
+#include <libzonecfg.h>
+#include <libinetutil.h>
+#include <sys/lx_brand.h>
+
+#include "run_command.h"
+
+static void lxi_err(char *msg, ...) __NORETURN;
+static void lxi_err(char *msg, ...);
+
+#define	IPMGMTD_PATH		"/lib/inet/ipmgmtd"
+#define	IN_NDPD_PATH		"/usr/lib/inet/in.ndpd"
+#define	HOOK_POSTNET_PATH	"/usr/lib/brand/lx/lx_hook_postnet"
+
+#define	PREFIX_LOG_WARN	"lx_init warn: "
+#define	PREFIX_LOG_ERR	"lx_init err: "
+
+#define	RTMBUFSZ	(sizeof (struct rt_msghdr) + \
+		(3 * sizeof (struct sockaddr_in)))
+
+ipadm_handle_t iph;
+
+static void
+lxi_err(char *msg, ...)
+{
+	char buf[1024];
+	int len;
+	va_list ap;
+
+	va_start(ap, msg);
+	/*LINTED*/
+	len = vsnprintf(buf, sizeof (buf), msg, ap);
+	va_end(ap);
+
+	(void) write(1, PREFIX_LOG_ERR, strlen(PREFIX_LOG_ERR));
+	(void) write(1, buf, len);
+	(void) write(1, "\n", 1);
+
+	/*
+	 * Since a non-zero exit will cause the zone to reboot, a pause here
+	 * will prevent a mis-configured zone from spinning in a reboot loop.
+	 */
+	pause();
+	exit(1);
+	/*NOTREACHED*/
+}
+
+static void
+lxi_warn(char *msg, ...)
+{
+	char buf[1024];
+	int len;
+	va_list ap;
+
+	va_start(ap, msg);
+	/*LINTED*/
+	len = vsnprintf(buf, sizeof (buf), msg, ap);
+	va_end(ap);
+
+	(void) write(1, PREFIX_LOG_WARN, strlen(PREFIX_LOG_WARN));
+	(void) write(1, buf, len);
+	(void) write(1, "\n", 1);
+}
+
+static void
+lxi_log_open()
+{
+	int fd = open("/dev/console", O_WRONLY);
+
+	if (fd < 0) {
+		/* hard to log at this point... */
+		exit(1);
+	} else if (fd != 1) {
+		/*
+		 * Use stdout as the log fd.  Init should start with no files
+		 * open, so we should be required to perform this relocation
+		 * every time.
+		 */
+		if (dup2(fd, 1) != 1) {
+			exit(1);
+		}
+	}
+}
+
+static void
+lxi_log_close()
+{
+	(void) close(0);
+	(void) close(1);
+}
+
+static zone_dochandle_t
+lxi_config_open()
+{
+	zoneid_t zoneid;
+	char zonename[ZONENAME_MAX];
+	zone_dochandle_t handle;
+	zone_iptype_t iptype;
+	int res;
+
+	zoneid = getzoneid();
+	if (getzonenamebyid(zoneid, zonename, sizeof (zonename)) < 0) {
+		lxi_err("could not determine zone name");
+	}
+
+	if ((handle = zonecfg_init_handle()) == NULL)
+		lxi_err("internal libzonecfg.so.1 error", 0);
+
+	if ((res = zonecfg_get_handle(zonename, handle)) != Z_OK) {
+		zonecfg_fini_handle(handle);
+		lxi_err("could not locate zone config %d", res);
+	}
+
+	/*
+	 * Only exclusive stack is supported.
+	 */
+	if (zonecfg_get_iptype(handle, &iptype) != Z_OK ||
+	    iptype != ZS_EXCLUSIVE) {
+		zonecfg_fini_handle(handle);
+		lxi_err("lx zones do not support shared IP stacks");
+	}
+
+	return (handle);
+
+}
+
+static int
+zone_find_attr(struct zone_res_attrtab *attrs, const char *name,
+    const char **result)
+{
+	while (attrs != NULL) {
+		if (strncmp(attrs->zone_res_attr_name, name,
+		    MAXNAMELEN) == 0) {
+			*result = attrs->zone_res_attr_value;
+			return (0);
+		}
+		attrs = attrs->zone_res_attr_next;
+	}
+	return (-1);
+}
+
+void
+lxi_svc_start(char *name, char *path, char *fmri)
+{
+	pid_t pid;
+	int status;
+	char *const argv[] = {
+		name,
+		NULL
+	};
+	char *const envp[] = {
+		fmri,
+		NULL
+	};
+
+	pid = fork();
+	if (pid == -1) {
+		lxi_err("fork() failed: %s", strerror(errno));
+	}
+
+	if (pid == 0) {
+		/* child */
+		const char *zroot = zone_get_nroot();
+		char cmd[MAXPATHLEN];
+
+		/*
+		 * Construct the full path to the binary, including the native
+		 * system root (e.g. "/native") if in use for this zone:
+		 */
+		(void) snprintf(cmd, sizeof (cmd), "%s%s", zroot != NULL ?
+		    zroot : "", path);
+
+		execve(cmd, argv, envp);
+
+		lxi_err("execve(%s) failed: %s", cmd, strerror(errno));
+		/* NOTREACHED */
+	}
+
+	/* parent */
+	while (wait(&status) != pid) {
+		/* EMPTY */;
+	}
+
+	if (WIFEXITED(status)) {
+		if (WEXITSTATUS(status) != 0) {
+			lxi_err("%s[%d] exited: %d", name,
+			    (int)pid, WEXITSTATUS(status));
+		}
+	} else if (WIFSIGNALED(status)) {
+		lxi_err("%s[%d] died on signal: %d", name,
+		    (int)pid, WTERMSIG(status));
+	} else {
+		lxi_err("%s[%d] failed in unknown way", name,
+		    (int)pid);
+	}
+}
+
+void
+lxi_net_ipmgmtd_start()
+{
+	lxi_svc_start("ipmgmtd", IPMGMTD_PATH,
+	    "SMF_FMRI=svc:/network/ip-interface-management:default");
+}
+
+void
+lxi_net_ndpd_start()
+{
+	lxi_svc_start("in.ndpd", IN_NDPD_PATH,
+	    "SMF_FMRI=svc:/network/routing/ndp:default");
+}
+
+
+static void
+lxi_net_ipadm_open()
+{
+	ipadm_status_t status;
+
+	if ((status = ipadm_open(&iph, IPH_LEGACY)) != IPADM_SUCCESS) {
+		lxi_err("Error opening ipadm handle: %s",
+		    ipadm_status2str(status));
+	}
+}
+
+static void
+lxi_net_ipadm_close()
+{
+	ipadm_close(iph);
+}
+
+void
+lxi_net_plumb(const char *iface)
+{
+	ipadm_status_t status;
+	char ifbuf[LIFNAMSIZ];
+
+	/* ipadm_create_if stomps on ifbuf, so create a copy: */
+	(void) strncpy(ifbuf, iface, sizeof (ifbuf));
+
+	if ((status = ipadm_create_if(iph, ifbuf, AF_INET, IPADM_OPT_ACTIVE))
+	    != IPADM_SUCCESS) {
+		lxi_err("ipadm_create_if error %d: %s/v4: %s",
+		    status, iface, ipadm_status2str(status));
+	}
+
+	if ((status = ipadm_create_if(iph, ifbuf, AF_INET6, IPADM_OPT_ACTIVE))
+	    != IPADM_SUCCESS) {
+		lxi_err("ipadm_create_if error %d: %s/v6: %s",
+		    status, iface, ipadm_status2str(status));
+	}
+}
+
+static int
+lxi_getif(int af, char *iface, int len, boolean_t first_ipv4_configured)
+{
+	struct lifreq lifr;
+	int s = socket(af, SOCK_DGRAM, 0);
+	if (s < 0) {
+		lxi_warn("socket error %d: bringing up %s: %s",
+		    errno, iface, strerror(errno));
+		return (-1);
+	}
+
+	/*
+	 * We need a new logical interface for every IP address we add, except
+	 * for the very first IPv4 address.
+	 */
+	if (af == AF_INET6 || first_ipv4_configured) {
+		(void) strncpy(lifr.lifr_name, iface, sizeof (lifr.lifr_name));
+		(void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
+		if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
+			if (close(s) != 0) {
+				lxi_warn("failed to close socket: %s\n",
+				    strerror(errno));
+			}
+			return (-1);
+		}
+		(void) strncpy(iface, lifr.lifr_name, len);
+	}
+
+	if (close(s) != 0) {
+		lxi_warn("failed to close socket: %s\n",
+		    strerror(errno));
+	}
+	return (0);
+}
+
+static int
+lxi_iface_ip(const char *origiface, const char *addr,
+    boolean_t *first_ipv4_configured)
+{
+	static int addrnum = 0;
+	ipadm_status_t status;
+	ipadm_addrobj_t ipaddr = NULL;
+	char iface[LIFNAMSIZ];
+	char aobjname[IPADM_AOBJSIZ];
+	int af, err = 0;
+
+	(void) strncpy(iface, origiface, sizeof (iface));
+
+	af = strstr(addr, ":") == NULL ? AF_INET : AF_INET6;
+	if (lxi_getif(af, iface, sizeof (iface), *first_ipv4_configured) != 0) {
+		lxi_warn("failed to create new logical interface "
+		    "on %s: %s", origiface, strerror(errno));
+		return (-1);
+	}
+
+	(void) snprintf(aobjname, IPADM_AOBJSIZ, "%s/addr%d", iface,
+	    addrnum++);
+
+	if ((status = ipadm_create_addrobj(IPADM_ADDR_STATIC, aobjname,
+	    &ipaddr)) != IPADM_SUCCESS) {
+		lxi_warn("ipadm_create_addrobj error %d: addr %s, "
+		    "interface %s: %s\n", status, addr, iface,
+		    ipadm_status2str(status));
+		return (-2);
+	}
+
+	if ((status = ipadm_set_addr(ipaddr, addr, AF_UNSPEC))
+	    != IPADM_SUCCESS) {
+		lxi_warn("ipadm_set_addr error %d: addr %s"
+		    ", interface %s: %s\n", status, addr,
+		    iface, ipadm_status2str(status));
+		err = -3;
+		goto done;
+	}
+
+	if ((status = ipadm_create_addr(iph, ipaddr,
+	    IPADM_OPT_ACTIVE | IPADM_OPT_UP)) != IPADM_SUCCESS) {
+		lxi_warn("ipadm_create_addr error for %s: %s\n", iface,
+		    ipadm_status2str(status));
+		err = -4;
+		goto done;
+	}
+
+	if (af == AF_INET) {
+		*first_ipv4_configured = B_TRUE;
+	}
+
+done:
+	ipadm_destroy_addrobj(ipaddr);
+	return (err);
+}
+
+static int
+lxi_iface_dhcp(const char *origiface, boolean_t *first_ipv4_configured)
+{
+	dhcp_ipc_request_t *dhcpreq = NULL;
+	dhcp_ipc_reply_t *dhcpreply = NULL;
+	int err = 0, timeout = 5;
+	char iface[LIFNAMSIZ];
+
+	(void) strncpy(iface, origiface, sizeof (iface));
+
+	if (lxi_getif(AF_INET, iface, sizeof (iface), *first_ipv4_configured)
+	    != 0) {
+		lxi_warn("failed to create new logical interface "
+		    "on %s: %s", origiface, strerror(errno));
+		return (-1);
+	}
+
+	if (dhcp_start_agent(timeout) != 0) {
+		lxi_err("Failed to start dhcpagent\n");
+		/* NOTREACHED */
+	}
+
+	dhcpreq = dhcp_ipc_alloc_request(DHCP_START, iface,
+	    NULL, 0, DHCP_TYPE_NONE);
+	if (dhcpreq == NULL) {
+		lxi_warn("Unable to allocate memory "
+		    "to start DHCP on %s\n", iface);
+		return (-1);
+	}
+
+	err = dhcp_ipc_make_request(dhcpreq, &dhcpreply, timeout);
+	if (err != 0) {
+		free(dhcpreq);
+		lxi_warn("Failed to start DHCP on %s: %s\n", iface,
+		    dhcp_ipc_strerror(err));
+		return (-1);
+	}
+	err = dhcpreply->return_code;
+	if (err != 0) {
+		lxi_warn("Failed to start DHCP on %s: %s\n", iface,
+		    dhcp_ipc_strerror(err));
+		goto done;
+	}
+
+	*first_ipv4_configured = B_TRUE;
+
+done:
+	free(dhcpreq);
+	free(dhcpreply);
+	return (err);
+}
+
+/*
+ * Initialize an IPv6 link-local address on a given interface
+ */
+static int
+lxi_iface_ipv6_link_local(const char *iface)
+{
+	struct lifreq lifr;
+	int s;
+
+	s = socket(AF_INET6, SOCK_DGRAM, 0);
+	if (s == -1) {
+		lxi_warn("socket error %d: bringing up %s: %s",
+		    errno, iface, strerror(errno));
+	}
+
+	(void) strncpy(lifr.lifr_name, iface, sizeof (lifr.lifr_name));
+	if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
+		lxi_warn("SIOCGLIFFLAGS error %d: bringing up %s: %s",
+		    errno, iface, strerror(errno));
+		return (-1);
+	}
+
+	lifr.lifr_flags |= IFF_UP;
+	if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
+		lxi_warn("SIOCSLIFFLAGS error %d: bringing up %s: %s",
+		    errno, iface, strerror(errno));
+		return (-1);
+	}
+
+	(void) close(s);
+	return (0);
+}
+
+static int
+lxi_iface_gateway(const char *iface, const char *dst, int dstpfx,
+    const char *gwaddr)
+{
+	int idx, len, sockfd;
+	char rtbuf[RTMBUFSZ];
+	struct rt_msghdr *rtm = (struct rt_msghdr *)rtbuf;
+	struct sockaddr_in *dst_sin = (struct sockaddr_in *)
+	    (rtbuf + sizeof (struct rt_msghdr));
+	struct sockaddr_in *gw_sin = (struct sockaddr_in *)(dst_sin + 1);
+	struct sockaddr_in *netmask_sin = (struct sockaddr_in *)(gw_sin + 1);
+
+	(void) bzero(rtm, RTMBUFSZ);
+	rtm->rtm_addrs = RTA_DST | RTA_GATEWAY | RTA_NETMASK;
+	rtm->rtm_flags = RTF_UP | RTF_STATIC | RTF_GATEWAY;
+	rtm->rtm_msglen = sizeof (rtbuf);
+	rtm->rtm_pid = getpid();
+	rtm->rtm_type = RTM_ADD;
+	rtm->rtm_version = RTM_VERSION;
+
+
+	/*
+	 * The destination and netmask components have already been zeroed,
+	 * which represents the default gateway.  If we were passed a more
+	 * specific destination network, use that instead.
+	 */
+	dst_sin->sin_family = AF_INET;
+	netmask_sin->sin_family = AF_INET;
+	if (dst != NULL) {
+		struct sockaddr *mask = (struct sockaddr *)netmask_sin;
+
+		if ((inet_pton(AF_INET, dst, &(dst_sin->sin_addr))) != 1 ||
+		    plen2mask(dstpfx, AF_INET, mask) != 0) {
+			lxi_warn("bad destination network %s/%d: %s", dst,
+			    dstpfx, strerror(errno));
+			return (-1);
+		}
+	}
+
+	if ((inet_pton(AF_INET, gwaddr, &(gw_sin->sin_addr))) != 1) {
+		lxi_warn("bad gateway %s: %s", gwaddr, strerror(errno));
+		return (-1);
+	}
+
+	if (iface != NULL) {
+		if ((idx = if_nametoindex(iface)) == 0) {
+			lxi_warn("unable to get interface index for %s: %s\n",
+			    iface, strerror(errno));
+			return (-1);
+		}
+		rtm->rtm_index = idx;
+	}
+
+	if ((sockfd = socket(PF_ROUTE, SOCK_RAW, AF_INET)) < 0) {
+		lxi_warn("socket(PF_ROUTE): %s\n", strerror(errno));
+		return (-1);
+	}
+
+	if ((len = write(sockfd, rtbuf, rtm->rtm_msglen)) < 0) {
+		lxi_warn("could not write rtmsg: %s", strerror(errno));
+		close(sockfd);
+		return (-1);
+	} else if (len < rtm->rtm_msglen) {
+		lxi_warn("write() rtmsg incomplete");
+		close(sockfd);
+		return (-1);
+	}
+
+	close(sockfd);
+	return (0);
+}
+
+static void
+lxi_net_loopback()
+{
+	const char *iface = "lo0";
+	boolean_t first_ipv4_configured = B_FALSE;
+
+	lxi_net_plumb(iface);
+	(void) lxi_iface_ip(iface, "127.0.0.1/8", &first_ipv4_configured);
+	(void) lxi_iface_ipv6_link_local(iface);
+}
+
+
+/*
+ * This function is used when the "ips" property doesn't exist in a zone's
+ * configuration. It may be an older configuration, so we should search for
+ * "ip" and "netmask" and convert them into the new format.
+ */
+static int
+lxi_get_old_ip(struct zone_res_attrtab *attrs, const char **ipaddrs,
+    char *cidraddr, int len)
+{
+
+	const char *netmask;
+	int prefixlen;
+	struct sockaddr_in mask_sin;
+
+	lxi_warn("Could not find \"ips\" property for zone. Looking "
+	    "for older \"ip\" and \"netmask\" properties, instead.");
+
+	if (zone_find_attr(attrs, "ip", ipaddrs) != 0) {
+		return (-1);
+	}
+
+	if (strcmp(*ipaddrs, "dhcp") == 0) {
+		return (0);
+	}
+
+	if (zone_find_attr(attrs, "netmask", &netmask) != 0) {
+		lxi_err("could not find netmask for interface");
+		/* NOTREACHED */
+	}
+
+	/* Convert the netmask to a number */
+	mask_sin.sin_family = AF_INET;
+	if (inet_pton(AF_INET, netmask, &mask_sin.sin_addr) != 1) {
+		lxi_err("invalid netmask address: %s\n",
+		    strerror(errno));
+		/* NOTREACHED */
+	}
+	prefixlen = mask2plen((struct sockaddr *)&mask_sin);
+
+	/*
+	 * Write out the IP address in the new format and use
+	 * that instead
+	 */
+	(void) snprintf(cidraddr, len, "%s/%d", *ipaddrs, prefixlen);
+
+	*ipaddrs = cidraddr;
+	return (0);
+}
+
+static void
+lxi_net_setup(zone_dochandle_t handle)
+{
+	struct zone_nwiftab lookup;
+	boolean_t do_addrconf = B_FALSE;
+
+	if (zonecfg_setnwifent(handle) != Z_OK)
+		return;
+	while (zonecfg_getnwifent(handle, &lookup) == Z_OK) {
+		const char *iface = lookup.zone_nwif_physical;
+		struct zone_res_attrtab *attrs = lookup.zone_nwif_attrp;
+		const char *ipaddrs, *primary, *gateway;
+		char ipaddrs_copy[MAXNAMELEN], cidraddr[BUFSIZ],
+		    *ipaddr, *tmp, *lasts;
+		boolean_t first_ipv4_configured = B_FALSE;
+		boolean_t *ficp = &first_ipv4_configured;
+
+		lxi_net_plumb(iface);
+		if (zone_find_attr(attrs, "ips", &ipaddrs) != 0 &&
+		    lxi_get_old_ip(attrs, &ipaddrs, cidraddr, BUFSIZ) != 0) {
+			lxi_warn("Could not find a valid network configuration "
+			    "for the %s interface", iface);
+			continue;
+		}
+
+		if (lxi_iface_ipv6_link_local(iface) != 0) {
+			lxi_warn("unable to bring up link-local address on "
+			    "interface %s", iface);
+		}
+
+		/*
+		 * If we're going to be doing DHCP, we have to do it first since
+		 * dhcpagent doesn't like to operate on non-zero logical
+		 * interfaces.
+		 */
+		if (strstr(ipaddrs, "dhcp") != NULL &&
+		    lxi_iface_dhcp(iface, ficp) != 0) {
+			lxi_warn("Failed to start DHCP on %s\n", iface);
+		}
+
+		/*
+		 * Copy the ipaddrs string, since strtok_r will write NUL
+		 * characters into it.
+		 */
+		(void) strlcpy(ipaddrs_copy, ipaddrs, MAXNAMELEN);
+		tmp = ipaddrs_copy;
+
+		/*
+		 * Iterate over each IP and then set it up on the interface.
+		 */
+		while ((ipaddr = strtok_r(tmp, ",", &lasts)) != NULL) {
+			tmp = NULL;
+			if (strcmp(ipaddr, "addrconf") == 0) {
+				do_addrconf = B_TRUE;
+			} else if (strcmp(ipaddr, "dhcp") == 0) {
+				continue;
+			} else if (lxi_iface_ip(iface, ipaddr, ficp) < 0) {
+				lxi_warn("Unable to add new IP address (%s) "
+				    "to interface %s", ipaddr, iface);
+			}
+		}
+
+		if (zone_find_attr(attrs, "primary", &primary) == 0 &&
+		    strncmp(primary, "true", MAXNAMELEN) == 0 &&
+		    zone_find_attr(attrs, "gateway", &gateway) == 0) {
+			lxi_iface_gateway(iface, NULL, 0, gateway);
+		}
+	}
+
+	if (do_addrconf) {
+		lxi_net_ndpd_start();
+	}
+
+	(void) zonecfg_endnwifent(handle);
+}
+
+static void
+lxi_net_static_route(const char *line)
+{
+	/*
+	 * Each static route line is a string of the form:
+	 *
+	 *	"10.77.77.2|10.1.1.0/24|false"
+	 *
+	 * i.e. gateway address, destination network, and whether this is
+	 * a "link local" route or a next hop route.
+	 */
+	custr_t *cu = NULL;
+	char *gw = NULL, *dst = NULL;
+	int pfx = -1;
+	int i;
+
+	if (custr_alloc(&cu) != 0) {
+		lxi_err("custr_alloc failure");
+	}
+
+	for (i = 0; line[i] != '\0'; i++) {
+		if (gw == NULL) {
+			if (line[i] == '|') {
+				if ((gw = strdup(custr_cstr(cu))) == NULL) {
+					lxi_err("strdup failure");
+				}
+				custr_reset(cu);
+			} else {
+				if (custr_appendc(cu, line[i]) != 0) {
+					lxi_err("custr_appendc failure");
+				}
+			}
+			continue;
+		}
+
+		if (dst == NULL) {
+			if (line[i] == '/') {
+				if ((dst = strdup(custr_cstr(cu))) == NULL) {
+					lxi_err("strdup failure");
+				}
+				custr_reset(cu);
+			} else {
+				if (custr_appendc(cu, line[i]) != 0) {
+					lxi_err("custr_appendc failure");
+				}
+			}
+			continue;
+		}
+
+		if (pfx == -1) {
+			if (line[i] == '|') {
+				pfx = atoi(custr_cstr(cu));
+				custr_reset(cu);
+			} else {
+				if (custr_appendc(cu, line[i]) != 0) {
+					lxi_err("custr_appendc failure");
+				}
+			}
+			continue;
+		}
+
+		if (custr_appendc(cu, line[i]) != 0) {
+			lxi_err("custr_appendc failure");
+		}
+	}
+
+	/*
+	 * We currently only support "next hop" routes, so ensure that
+	 * "linklocal" is false:
+	 */
+	if (strcmp(custr_cstr(cu), "false") != 0) {
+		lxi_warn("invalid static route: %s", line);
+	}
+
+	if (lxi_iface_gateway(NULL, dst, pfx, gw) != 0) {
+		lxi_err("failed to add route: %s/%d -> %s", dst, pfx, gw);
+	}
+
+	custr_free(cu);
+	free(gw);
+	free(dst);
+}
+
+static void
+lxi_net_static_routes(void)
+{
+	const char *cmd = "/native/usr/lib/brand/lx/routeinfo";
+	char *const argv[] = { "routeinfo", NULL };
+	char *const envp[] = { NULL };
+	int code;
+	struct stat st;
+	char errbuf[512];
+
+	if (stat(cmd, &st) != 0 || !S_ISREG(st.st_mode)) {
+		/*
+		 * This binary is (potentially) shipped from another
+		 * consolidation.  If it does not exist, then the platform does
+		 * not currently support static routes for LX-branded zones.
+		 */
+		return;
+	}
+
+	/*
+	 * Run the command, firing the callback for each line that it
+	 * outputs.  When this function returns, static route processing
+	 * is complete.
+	 */
+	if (run_command(cmd, argv, envp, errbuf, sizeof (errbuf),
+	    lxi_net_static_route, &code) != 0 || code != 0) {
+		lxi_err("failed to run \"%s\": %s", cmd, errbuf);
+	}
+}
+
+static void
+lxi_config_close(zone_dochandle_t handle)
+{
+	zonecfg_fini_handle(handle);
+}
+
+static void
+lxi_hook_postnet()
+{
+	char cmd[MAXPATHLEN];
+	const char *zroot = zone_get_nroot();
+	pid_t pid;
+	int status;
+
+	(void) snprintf(cmd, sizeof (cmd), "%s%s", zroot, HOOK_POSTNET_PATH);
+	if (access(cmd, X_OK) != 0) {
+		/* If no suitable script is present, soldier on. */
+		return;
+	}
+
+	if ((pid = fork()) < 0) {
+		lxi_err("fork() failed: %s", strerror(errno));
+	}
+	if (pid == 0) {
+		char *const argv[] = { cmd, NULL };
+		char *const envp[] = { NULL };
+
+		/* wire up stderr first, in case the hook wishes to use it */
+		if (dup2(1, 2) < 0) {
+			lxi_err("dup2() failed: %s", cmd, strerror(errno));
+		}
+
+		/* child executes the hook */
+		execve(cmd, argv, envp);
+
+		/*
+		 * Since this is running as root, access(2) is less strict than
+		 * necessary to ensure a successful exec.  If the permissions
+		 * on the hook are busted, ignore the failure and move on.
+		 */
+		if (errno == EACCES) {
+			exit(0);
+		}
+
+		lxi_err("execve(%s) failed: %s", cmd, strerror(errno));
+		/* NOTREACHED */
+	}
+
+	/* Parent waits for the hook to complete */
+	while (wait(&status) != pid) {
+		/* EMPTY */;
+	}
+	if (WIFEXITED(status)) {
+		if (WEXITSTATUS(status) != 0) {
+			lxi_err("%s[%d] exited: %d", cmd, (int)pid,
+			    WEXITSTATUS(status));
+		}
+	} else if (WIFSIGNALED(status)) {
+		lxi_err("%s[%d] died on signal: %d", cmd, (int)pid,
+		    WTERMSIG(status));
+	} else {
+		lxi_err("%s[%d] failed in unknown way", cmd, (int)pid);
+	}
+}
+
+static void
+lxi_init_exec(char **argv)
+{
+	const char *cmd = "/sbin/init";
+	char *const envp[] = { "container=zone", NULL };
+	int e;
+
+	argv[0] = "init";
+
+	/*
+	 * systemd uses the 'container' env var to determine it is running
+	 * inside a container. It only supports a few well-known types and
+	 * treats anything else as 'other' but this is enough to make it
+	 * behave better inside a zone. See 'detect_container' in systemd.
+	 */
+	execve(cmd, argv, envp);
+	e = errno;
+
+	/*
+	 * Because stdout was closed prior to exec, it must be opened again in
+	 * the face of failure to log the error.
+	 */
+	lxi_log_open();
+	lxi_err("execve(%s) failed: %s", cmd, strerror(e));
+}
+
+/*ARGSUSED*/
+int
+main(int argc, char *argv[])
+{
+	zone_dochandle_t handle;
+
+	lxi_log_open();
+
+	lxi_net_ipmgmtd_start();
+	lxi_net_ipadm_open();
+
+	handle = lxi_config_open();
+	lxi_net_loopback();
+	lxi_net_setup(handle);
+	lxi_config_close(handle);
+
+	lxi_net_static_routes();
+
+	lxi_net_ipadm_close();
+
+	lxi_hook_postnet();
+
+	lxi_log_close();
+
+	lxi_init_exec(argv);
+
+	/* NOTREACHED */
+	return (0);
+}
diff --git a/usr/src/lib/brand/lx/lx_init/pipe_stream.c b/usr/src/lib/brand/lx/lx_init/pipe_stream.c
new file mode 100644
index 0000000000..8f06a07906
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_init/pipe_stream.c
@@ -0,0 +1,326 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stddef.h>
+#include <unistd.h>
+#include <port.h>
+#include <poll.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/debug.h>
+#include <sys/list.h>
+
+#include "pipe_stream.h"
+
+struct pipe_stream {
+	pipe_stream_loop_t *pis_loop;
+
+	boolean_t pis_finished;
+	boolean_t pis_associated;
+
+	void *pis_arg0;
+	void *pis_arg1;
+
+	int pis_fd_write;
+	int pis_fd_read;
+	list_node_t pis_linkage;
+};
+
+struct pipe_stream_loop {
+	int psl_port;
+
+	uint8_t *psl_buf;
+	size_t psl_buf_cap;
+	size_t psl_buf_occ;
+
+	list_t psl_pipes;
+
+	pipe_stream_data_cb *psl_cb_data;
+	pipe_stream_eof_cb *psl_cb_eof;
+	pipe_stream_error_cb *psl_cb_error;
+};
+
+
+int
+pipe_stream_loop_fini(pipe_stream_loop_t *psl)
+{
+	if (psl == NULL) {
+		return (0);
+	}
+
+	VERIFY0(close(psl->psl_port));
+
+	while (!list_is_empty(&psl->psl_pipes)) {
+		pipe_stream_fini(list_head(&psl->psl_pipes));
+	}
+
+	list_destroy(&psl->psl_pipes);
+	free(psl);
+
+	return (0);
+}
+
+int
+pipe_stream_loop_init(pipe_stream_loop_t **pslp, size_t bufsize,
+    pipe_stream_data_cb *data_cb, pipe_stream_eof_cb *eof_cb,
+    pipe_stream_error_cb *error_cb)
+{
+	pipe_stream_loop_t *psl;
+
+	if ((psl = calloc(1, sizeof (*psl))) == NULL) {
+		return (-1);
+	}
+
+	psl->psl_buf_cap = bufsize;
+	psl->psl_buf_occ = 0;
+	if ((psl->psl_buf = calloc(1, bufsize)) == NULL) {
+		free(psl);
+		return (-1);
+	}
+
+	if ((psl->psl_port = port_create()) == -1) {
+		free(psl->psl_buf);
+		free(psl);
+		return (-1);
+	}
+
+	psl->psl_cb_data = data_cb;
+	psl->psl_cb_eof = eof_cb;
+	psl->psl_cb_error = error_cb;
+
+	list_create(&psl->psl_pipes, sizeof (pipe_stream_t),
+	    offsetof(pipe_stream_t, pis_linkage));
+
+	*pslp = psl;
+	return (0);
+}
+
+boolean_t
+pipe_stream_loop_should_run(pipe_stream_loop_t *psl)
+{
+	pipe_stream_t *pis;
+
+	for (pis = list_head(&psl->psl_pipes); pis != NULL;
+	    pis = list_next(&psl->psl_pipes, pis)) {
+		if (!pis->pis_finished) {
+			return (B_TRUE);
+		}
+	}
+
+	return (B_FALSE);
+}
+
+int
+pipe_stream_loop_run(pipe_stream_loop_t *psl)
+{
+	pipe_stream_t *pis;
+	port_event_t pev;
+	ssize_t sz;
+
+	for (pis = list_head(&psl->psl_pipes); pis != NULL;
+	    pis = list_next(&psl->psl_pipes, pis)) {
+		if (pis->pis_finished || pis->pis_associated) {
+			/*
+			 * Skip streams that are already finished, as well as
+			 * those that have already been associated with the
+			 * port.
+			 */
+			continue;
+		}
+
+		if (port_associate(psl->psl_port, PORT_SOURCE_FD,
+		    pis->pis_fd_read, POLLIN, pis) != 0) {
+			return (-1);
+		}
+	}
+
+again:
+	if (port_get(psl->psl_port, &pev, NULL) != 0) {
+		switch (errno) {
+		case ETIME:
+			/*
+			 * Timeout expired; return to caller.
+			 */
+			return (0);
+
+		case EINTR:
+			/*
+			 * Interrupted by signal.  Try again.
+			 */
+			goto again;
+
+		default:
+			return (-1);
+		}
+	}
+
+	VERIFY(pev.portev_source == PORT_SOURCE_FD);
+	pis = (pipe_stream_t *)pev.portev_user;
+	VERIFY((int)pev.portev_object == pis->pis_fd_read);
+	pis->pis_associated = B_FALSE;
+
+read_again:
+	if ((sz = read(pis->pis_fd_read, psl->psl_buf,
+	    psl->psl_buf_cap)) == -1) {
+		if (errno == EINTR) {
+			goto read_again;
+		}
+
+		if (psl->psl_cb_error != NULL) {
+			psl->psl_cb_error(errno, pis->pis_arg0, pis->pis_arg1);
+		}
+
+		VERIFY0(close(pis->pis_fd_read));
+		pis->pis_fd_read = -1;
+		pis->pis_finished = B_TRUE;
+	}
+	psl->psl_buf_occ = sz;
+
+	if (sz == 0) {
+		/*
+		 * Stream EOF.
+		 */
+		pis->pis_finished = B_TRUE;
+		VERIFY0(close(pis->pis_fd_read));
+		pis->pis_fd_read = -1;
+		if (psl->psl_cb_eof != NULL) {
+			psl->psl_cb_eof(pis->pis_arg0, pis->pis_arg1);
+		}
+		return (0);
+	}
+
+	if (psl->psl_cb_data != NULL) {
+		int cbr = psl->psl_cb_data(psl->psl_buf, psl->psl_buf_occ,
+		    pis->pis_arg0, pis->pis_arg1);
+
+		if (cbr != 0) {
+			/*
+			 * Callback failure: close file descriptor.
+			 */
+			pis->pis_finished = B_TRUE;
+			VERIFY0(close(pis->pis_fd_read));
+			pis->pis_fd_read = -1;
+			if (psl->psl_cb_eof != NULL) {
+				psl->psl_cb_eof(pis->pis_arg0, pis->pis_arg1);
+			}
+		}
+
+		return (0);
+	}
+
+	return (0);
+}
+
+int
+pipe_stream_init(pipe_stream_loop_t *psl, pipe_stream_t **pisp, void *arg0,
+    void *arg1)
+{
+	int e = 0;
+	pipe_stream_t *pis;
+	int fds[2] = { -1, -1 };
+
+	if ((pis = calloc(1, sizeof (*pis))) == NULL) {
+		return (-1);
+	}
+
+	if (pipe(fds) != 0) {
+		e = errno;
+		goto fail;
+	}
+
+	pis->pis_fd_read = fds[0];
+	pis->pis_fd_write = fds[1];
+
+	pis->pis_arg0 = arg0;
+	pis->pis_arg1 = arg1;
+
+	pis->pis_finished = B_FALSE;
+	pis->pis_associated = B_FALSE;
+
+	pis->pis_loop = psl;
+	list_insert_tail(&psl->psl_pipes, pis);
+
+	*pisp = pis;
+	return (0);
+
+fail:
+	if (fds[0] != -1) {
+		VERIFY0(close(fds[0]));
+	}
+	if (fds[1] != -1) {
+		VERIFY0(close(fds[1]));
+	}
+	free(pis);
+	errno = e;
+	return (-1);
+}
+
+int
+pipe_stream_fini(pipe_stream_t *pis)
+{
+	if (pis == NULL) {
+		return (0);
+	}
+
+	if (pis->pis_fd_read != -1) {
+		VERIFY0(close(pis->pis_fd_read));
+	}
+	if (pis->pis_fd_write != -1) {
+		VERIFY0(close(pis->pis_fd_write));
+	}
+
+	list_remove(&pis->pis_loop->psl_pipes, pis);
+
+	free(pis);
+	return (0);
+}
+
+/*
+ * Called in the parent, after forking, to close the "write" end of the pipe.
+ */
+void
+pipe_stream_parent_afterfork(pipe_stream_t *pis)
+{
+	if (pis->pis_fd_write != -1) {
+		(void) close(pis->pis_fd_write);
+		pis->pis_fd_write = -1;
+	}
+}
+
+/*
+ * Called in the child, after forking, to close the "read" end of the
+ * pipe, and to dup the file descriptor into the right place.
+ */
+int
+pipe_stream_child_afterfork(pipe_stream_t *pis, int dup_to)
+{
+	int e = 0;
+
+	if (dup_to != -1) {
+		if (dup2(pis->pis_fd_write, dup_to) == -1) {
+			e = errno;
+		}
+		VERIFY0(close(pis->pis_fd_write));
+		pis->pis_fd_write = dup_to;
+	}
+
+	(void) close(pis->pis_fd_read);
+	pis->pis_fd_read = -1;
+
+	errno = e;
+	return (e == 0 ? 0 : -1);
+}
diff --git a/usr/src/lib/brand/lx/lx_init/pipe_stream.h b/usr/src/lib/brand/lx/lx_init/pipe_stream.h
new file mode 100644
index 0000000000..140ef18f8c
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_init/pipe_stream.h
@@ -0,0 +1,48 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _PIPE_STREAM_H
+#define	_PIPE_STREAM_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef int pipe_stream_data_cb(const uint8_t *, size_t, void *, void *);
+typedef void pipe_stream_eof_cb(void *, void *);
+typedef void pipe_stream_error_cb(int, void *, void *);
+
+typedef struct pipe_stream pipe_stream_t;
+typedef struct pipe_stream_loop pipe_stream_loop_t;
+
+extern int pipe_stream_loop_fini(pipe_stream_loop_t *);
+extern int pipe_stream_loop_init(pipe_stream_loop_t **, size_t,
+    pipe_stream_data_cb *, pipe_stream_eof_cb *, pipe_stream_error_cb *);
+
+extern int pipe_stream_init(pipe_stream_loop_t *, pipe_stream_t **, void *,
+    void *);
+extern int pipe_stream_fini(pipe_stream_t *);
+
+extern void pipe_stream_parent_afterfork(pipe_stream_t *);
+extern int pipe_stream_child_afterfork(pipe_stream_t *, int);
+
+extern boolean_t pipe_stream_loop_should_run(pipe_stream_loop_t *);
+extern int pipe_stream_loop_run(pipe_stream_loop_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _PIPE_STREAM_H */
diff --git a/usr/src/lib/brand/lx/lx_init/run_command.c b/usr/src/lib/brand/lx/lx_init/run_command.c
new file mode 100644
index 0000000000..9130838625
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_init/run_command.c
@@ -0,0 +1,282 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <err.h>
+#include <errno.h>
+#include <strings.h>
+#include <unistd.h>
+#include <wait.h>
+#include <sys/types.h>
+#include <sys/debug.h>
+#include <libcustr.h>
+
+#include "run_command.h"
+#include "pipe_stream.h"
+
+typedef struct cmd {
+	int cmd_pid;
+	int cmd_wstatus;
+	pipe_stream_t *cmd_pipe[2];
+	custr_t *cmd_err;
+	custr_t *cmd_out;
+	run_command_line_cb *cmd_func;
+	boolean_t cmd_cancel;
+} cmd_t;
+
+static int cb_data(const uint8_t *, size_t, void *, void *);
+static void cb_eof(void *, void *);
+static void cb_error(int, void *, void *);
+
+void
+post_error(cmd_t *cmd, const char *estr)
+{
+	if (cmd->cmd_cancel) {
+		return;
+	}
+	cmd->cmd_cancel = B_TRUE;
+
+	custr_reset(cmd->cmd_err);
+	(void) custr_append(cmd->cmd_err, estr);
+}
+
+int
+run_command(const char *path, char *const argv[], char *const envp[],
+    char *errbuf, size_t errlen, run_command_line_cb *func, int *status)
+{
+	pipe_stream_loop_t *psl = NULL;
+	int e = 0;
+	cmd_t cmd;
+	pid_t wpid;
+
+	bzero(&cmd, sizeof (cmd));
+
+	cmd.cmd_func = func;
+
+	/*
+	 * Allocate string buffers for stdout line buffering and error
+	 * messages:
+	 */
+	if (custr_alloc_buf(&cmd.cmd_err, errbuf, errlen) != 0 ||
+	    custr_alloc(&cmd.cmd_out) != 0) {
+		e = errno;
+		goto out;
+	}
+
+	/*
+	 * Initialise pipe stream event loop:
+	 */
+	if (pipe_stream_loop_init(&psl, 256, cb_data, cb_eof, cb_error) != 0) {
+		e = errno;
+		post_error(&cmd, "could not init pipe stream loop");
+		goto out;
+	}
+
+	/*
+	 * Create pipe streams for stdout and stderr communication with
+	 * child process:
+	 */
+	if (pipe_stream_init(psl, &cmd.cmd_pipe[0], &cmd,
+	    (void *)STDOUT_FILENO) != 0 ||
+	    pipe_stream_init(psl, &cmd.cmd_pipe[1], &cmd,
+	    (void *)STDERR_FILENO) != 0) {
+		e = errno;
+		post_error(&cmd, "could not init pipe streams");
+		goto out;
+	}
+
+	/*
+	 * Fork a child process:
+	 */
+	if ((cmd.cmd_pid = fork()) == -1) {
+		e = errno;
+		post_error(&cmd, "could not fork");
+		goto out;
+	}
+
+	if (cmd.cmd_pid == 0) {
+		/*
+		 * This is the child process.  Clean up file descriptors, and
+		 * connect stdio to the pipes we allocated:
+		 */
+		VERIFY0(close(STDIN_FILENO));
+		VERIFY0(pipe_stream_child_afterfork(cmd.cmd_pipe[0],
+		    STDOUT_FILENO));
+		VERIFY0(pipe_stream_child_afterfork(cmd.cmd_pipe[1],
+		    STDERR_FILENO));
+		closefrom(3);
+
+		execve(path, argv, envp);
+		err(127, "exec(%s) failed", path);
+	}
+
+	/*
+	 * Back in the parent.  Close the remote end of the stdio pipes:
+	 */
+	pipe_stream_parent_afterfork(cmd.cmd_pipe[0]);
+	pipe_stream_parent_afterfork(cmd.cmd_pipe[1]);
+
+	/*
+	 * Run the pipe event loop until all streams are completely
+	 * consumed:
+	 */
+	while (pipe_stream_loop_should_run(psl)) {
+		if (pipe_stream_loop_run(psl) != 0) {
+			e = errno;
+			post_error(&cmd, "pipe stream loop run failure");
+			goto out;
+		}
+	}
+
+	/*
+	 * Collect exit status of child process:
+	 */
+	while ((wpid = waitpid(cmd.cmd_pid, &cmd.cmd_wstatus, 0)) !=
+	    cmd.cmd_pid) {
+		if (wpid == -1 && errno != EINTR) {
+			e = errno;
+			post_error(&cmd, "waitpid failure");
+			goto out;
+		}
+	}
+
+	/*
+	 * If the child died on a signal, fail the whole operation:
+	 */
+	if (WIFSIGNALED(cmd.cmd_wstatus)) {
+		e = ENXIO;
+		post_error(&cmd, "child process died on signal");
+		(void) custr_append_printf(cmd.cmd_err, " (pid %d signal %d)",
+		    cmd.cmd_pid, WTERMSIG(cmd.cmd_wstatus));
+		goto out;
+	}
+
+	/*
+	 * If the child did not appear to exit, fail the whole operation:
+	 */
+	if (!WIFEXITED(cmd.cmd_wstatus)) {
+		e = ENXIO;
+		post_error(&cmd, "child process did not exit");
+		(void) custr_append_printf(cmd.cmd_err, " (pid %d status %x)",
+		    cmd.cmd_pid, cmd.cmd_wstatus);
+		goto out;
+	}
+
+	/*
+	 * Report exit status to the caller:
+	 */
+	*status = WEXITSTATUS(cmd.cmd_wstatus);
+	e = 0;
+
+out:
+	VERIFY0(pipe_stream_loop_fini(psl));
+	/*
+	 * Note that freeing the static error custr_t does not touch the
+	 * underlying storage; we use this property to return the error
+	 * message (if one exists) to the caller.
+	 */
+	custr_free(cmd.cmd_err);
+	custr_free(cmd.cmd_out);
+	errno = e;
+	return (e == 0 ? 0 : -1);
+}
+
+static int
+cb_data(const uint8_t *buf, size_t sz, void *arg0, void *arg1)
+{
+	cmd_t *cmd = arg0;
+	int fd = (int)arg1;
+	unsigned int i;
+
+	if (cmd->cmd_cancel) {
+		return (-1);
+	}
+
+	switch (fd) {
+	case STDOUT_FILENO:
+		for (i = 0; i < sz; i++) {
+			if (buf[i] == '\0' || buf[i] == '\r') {
+				continue;
+			}
+
+			if (buf[i] == '\n') {
+				cmd->cmd_func(custr_cstr(cmd->cmd_out));
+				custr_reset(cmd->cmd_out);
+				continue;
+			}
+
+			if (custr_appendc(cmd->cmd_out, buf[i]) != 0) {
+				/*
+				 * Failed to allocate memory; returning
+				 * -1 here will abort the stream.
+				 */
+				post_error(cmd, "custr_appendc failure");
+				return (-1);
+			}
+		}
+		break;
+
+	case STDERR_FILENO:
+		/*
+		 * Collect as much stderr output as will fit in our static
+		 * buffer.
+		 */
+		for (i = 0; i < sz; i++) {
+			if (buf[i] == '\0') {
+				continue;
+			}
+
+			(void) custr_appendc(cmd->cmd_err, buf[i]);
+		}
+		break;
+
+	default:
+		abort();
+	}
+
+	return (0);
+}
+
+static void
+cb_eof(void *arg0, void *arg1)
+{
+	cmd_t *cmd = arg0;
+	int fd = (int)arg1;
+
+	if (cmd->cmd_cancel) {
+		return;
+	}
+
+	if (fd == STDOUT_FILENO && custr_len(cmd->cmd_out) > 0) {
+		cmd->cmd_func(custr_cstr(cmd->cmd_out));
+		custr_reset(cmd->cmd_out);
+	}
+}
+
+static void
+cb_error(int e, void *arg0, void *arg1)
+{
+	cmd_t *cmd = arg0;
+	int fd = (int)arg1;
+
+	if (cmd->cmd_cancel) {
+		return;
+	}
+
+	post_error(cmd, "stream read failure");
+	(void) custr_append_printf(cmd->cmd_err, " (pid %d fd %d): %s",
+	    cmd->cmd_pid, fd, strerror(e));
+}
diff --git a/usr/src/lib/brand/lx/lx_init/run_command.h b/usr/src/lib/brand/lx/lx_init/run_command.h
new file mode 100644
index 0000000000..3484b265b6
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_init/run_command.h
@@ -0,0 +1,32 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _RUN_COMMAND_H
+#define	_RUN_COMMAND_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void run_command_line_cb(const char *);
+
+extern int run_command(const char *, char *const [], char *const [], char *,
+    size_t, run_command_line_cb *, int *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _RUN_COMMAND_H */
diff --git a/usr/src/lib/brand/lx/lx_lockd/Makefile b/usr/src/lib/brand/lx/lx_lockd/Makefile
new file mode 100644
index 0000000000..debefdf815
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_lockd/Makefile
@@ -0,0 +1,62 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+
+#
+# Copyright 2017 Joyent, Inc.
+#
+
+PROG =	lx_lockd
+
+PROG_OBJS = lockd.o nfs_tbind.o
+UTIL_OBJS = thrpool.o
+
+OBJS =	$(PROG_OBJS) $(UTIL_OBJS)
+SRCS =	$(PROG_OBJS:%.o=%.c)
+
+all:		$(PROG)
+
+include ../Makefile.lx
+include $(SRC)/cmd/Makefile.cmd
+
+# override the install directory
+ROOTBIN =	$(ROOTBRANDDIR)
+CLOBBERFILES =	$(OBJS) $(ROOTPROG)
+
+CPPFLAGS +=	-I$(SRC)/cmd/fs.d/nfs/lib
+CSTD =		$(CSTD_GNU99)
+LDLIBS +=	-lnsl -lsocket
+
+CERRWARN += -_gcc=-Wno-parentheses
+CERRWARN += -_gcc=-Wno-uninitialized
+CERRWARN += -_gcc=-Wno-unused-function
+
+.KEEP_STATE:
+
+install: all $(ROOTPROG)
+
+clean:
+	$(RM) $(PROG) $(OBJS)
+
+lint:
+	$(LINT.c) -erroff=E_SEC_PRINTF_VAR_FMT lockd.c $(LDLIBS)
+
+$(PROG): $(OBJS)
+	$(LINK.c) -o $@ $(OBJS) $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: %.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+%.o: $(SRC)/cmd/fs.d/nfs/lib/%.c
+	$(COMPILE.c) $<
+	$(POST_PROCESS_O)
+
+include $(SRC)/cmd/Makefile.targ
diff --git a/usr/src/lib/brand/lx/lx_lockd/lockd.c b/usr/src/lib/brand/lx/lx_lockd/lockd.c
new file mode 100644
index 0000000000..6a80b5355c
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_lockd/lockd.c
@@ -0,0 +1,568 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+
+/*
+ * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T		*/
+/*	  All Rights Reserved  	*/
+
+/*
+ * University Copyright- Copyright (c) 1982, 1986, 1988
+ * The Regents of the University of California
+ * All Rights Reserved
+ *
+ * University Acknowledgment- Portions of this document are derived from
+ * software developed by the University of California, Berkeley, and its
+ * contributors.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+/*
+ * lx-brand NFS lockd (NLM) server.
+ *
+ * This code is derived from the native lockd. The original history starts
+ * from:
+ *    copied from usr/src/cmd/fs.d/nfs/nfsd/nfsd.c and then s:NFS:NLM: applied
+ *
+ * On Linux 'lockd' is implemented entirely inside the kernel, whereas our
+ * native lockd support is a combination of user-level and kernel code.
+ * Unfortunately, the native lockd is unable to run in lx for several reasons:
+ * - tightly bound to SMF
+ * - interacts with various native libnsl configuration files
+ * - expects to register with a native rpcbind using /dev/ticlts
+ * Thus, this code is derived from the native lockd, but modified to address
+ * these issues and run inside an lx-branded zone. Because the Linux lockd
+ * lives entirely in the kernel, our lockd must be started automatically if
+ * it is needed. This is done by the NFS mount code when it determines that
+ * a lockd is not already running. The kernel code ensures that there is only a
+ * single instance of the lockd running, in the case that there is a race with
+ * two NFS mounts occuring in parallel.
+ *
+ * lockd is required for both NFSv3 and v4 locking. Although v4 locking is
+ * part of the v4 protocol, the kernel support to allow NFS locking is enabled
+ * by the lockd when it starts. For v3, there must be a lockd registered with
+ * rpcbind or the server side will fail the lock. This is because the server
+ * side expects to make callbacks to the client. We must successfully register
+ * with the Linux rpcbind, otherwise the NFS syscall to enable the kernel side
+ * of locking will fail. For the v3 case, the user-level Linux mount helper cmd
+ * already checks for the presence of rpcbind. It fails if rpcbind is not
+ * running and the mount does not include the "nolock" option. For v4 the use
+ * of rpcbind appears unnecessary, since locking is built-in to the protocol,
+ * but it still required by our kernel NFS locking code.
+ *
+ * As with the native lockd, the kernel locking code makes upcalls to our lockd
+ * over /dev/ticotsord, so that device must be present inside an lx zone.
+ *
+ * Because this process tries to mimic the Linux kernel lockd, there is no
+ * stdin/out/err and we block all signals, unless we're running in debug mode.
+ */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <tiuser.h>
+#include <rpc/rpc.h>
+#include <errno.h>
+#include <thread.h>
+#include <sys/time.h>
+#include <sys/file.h>
+#include <nfs/nfs.h>
+#include <nfs/nfssys.h>
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <netconfig.h>
+#include <netdir.h>
+#include <string.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <sys/tihdr.h>
+#include <poll.h>
+#include <priv_utils.h>
+#include <sys/tiuser.h>
+#include <netinet/tcp.h>
+#include <deflt.h>
+#include <rpcsvc/nlm_prot.h>
+#include <ctype.h>
+#include <strings.h>
+#include <sys/varargs.h>
+#include <rpcsvc/nlm_prot.h>
+#include <rpc/pmap_prot.h>
+#include "nfs_tbind.h"
+#include "thrpool.h"
+
+/* Option defaults.  See nfssys.h */
+struct lm_svc_args lmargs = {
+	.version = LM_SVC_CUR_VERS,
+	/* fd, n_fmly, n_proto, n_rdev (below) */
+	.n_v4_only = 0,
+	.timout = 5 * 60,
+	.grace = 90, /* How long to wait for clients to re-establish locks. */
+	.retransmittimeout = 5
+};
+int max_servers = 256;
+
+#define	RET_OK		0	/* return code for no error */
+#define	RET_ERR		33	/* return code for error(s) */
+
+#define	SYSLOG_BLEN	256
+
+int nlmsvc(int fd, struct netbuf addrmask, struct netconfig *nconf);
+
+static int nlmsvcpool(int max_servers);
+static void usage(void);
+
+static struct timeval tottimeout = { 60, 0 };
+static struct timeval rpcbtime = { 15, 0 };
+static const char nullstring[] = "\000";
+
+boolean_t have_rpcbind = B_FALSE;
+
+extern int _nfssys(int, void *);
+extern void nlm_do_one(char *, int (*)(int, struct netbuf, struct netconfig *));
+extern int nlm_bind_to_provider(char *, struct netbuf **, struct netconfig **);
+
+/*
+ * We want to bind to these TLI providers, and in this order,
+ * because the kernel NLM needs the loopback first for its
+ * initialization. (It uses it to talk to statd.)
+ */
+static  NETSELDECL(defaultproviders)[] = {
+	"/dev/ticotsord",
+	"/dev/tcp",
+	"/dev/udp",
+	"/dev/tcp6",
+	"/dev/udp6",
+	NULL
+};
+
+/*
+ * The following are all globals used by routines in nfs_tbind.c.
+ */
+size_t	end_listen_fds;		/* used by conn_close_oldest() */
+size_t	num_fds = 0;		/* used by multiple routines */
+int	listen_backlog = 32;	/* used by bind_to_{provider,proto}() */
+				/* used by cots_listen_event() */
+int	max_conns_allowed = -1;	/* used by cots_listen_event() */
+int	(*Mysvc)(int, struct netbuf, struct netconfig *) = nlmsvc;
+
+boolean_t	debug = B_FALSE;
+
+#define	LX_PMAP_VERS	4
+
+/*
+ * Set a mapping between program, version and address.
+ * Calls the lx-zone's rpcbind service to do the mapping.
+ */
+boolean_t
+lx_rpcb_set(const rpcvers_t version, const struct netconfig *nconf,
+    const struct netbuf *address)
+{
+	CLIENT *client;
+	bool_t rslt = FALSE;
+	RPCB parms;
+	char uidbuf[32];
+
+	client = clnt_create_timed("localhost", PMAPPROG, LX_PMAP_VERS,
+	    "datagram_v", &rpcbtime);
+	if (client == NULL)
+		return (B_FALSE);
+
+	parms.r_addr = taddr2uaddr((struct netconfig *)nconf,
+	    (struct netbuf *)address); /* convert to universal */
+	if (!parms.r_addr) {
+		rpc_createerr.cf_stat = RPC_N2AXLATEFAILURE;
+		return (B_FALSE);
+	}
+	parms.r_prog = NLM_PROG;
+	parms.r_vers = version;
+	parms.r_netid = nconf->nc_netid;
+	/*
+	 * Though uid is not being used directly, we still send it for
+	 * completeness.  For non-unix platforms, perhaps some other
+	 * string or an empty string can be sent.
+	 */
+	(void) sprintf(uidbuf, "%d", (int)geteuid());
+	parms.r_owner = uidbuf;
+
+	CLNT_CALL(client, RPCBPROC_SET, (xdrproc_t)xdr_rpcb, (char *)&parms,
+	    (xdrproc_t)xdr_bool, (char *)&rslt, tottimeout);
+
+	CLNT_DESTROY(client);
+	free(parms.r_addr);
+	return (B_TRUE);
+}
+
+/*
+ * Remove the mapping between program, version and netbuf address.
+ * Calls the rpcbind service to do the un-mapping.
+ */
+void
+lx_rpcb_unset(const rpcvers_t version, char *nc_netid)
+{
+	CLIENT *client;
+	bool_t rslt;
+	RPCB parms;
+	char uidbuf[32];
+
+	if (!have_rpcbind)
+		return;
+
+	client = clnt_create_timed("localhost", PMAPPROG, LX_PMAP_VERS,
+	    "datagram_v", &rpcbtime);
+	if (client == NULL)
+		return;
+
+	parms.r_prog = NLM_PROG;
+	parms.r_vers = version;
+	parms.r_netid = nc_netid;
+	parms.r_addr = (char *)&nullstring[0];
+	(void) sprintf(uidbuf, "%d", (int)geteuid());
+	parms.r_owner = uidbuf;
+
+	CLNT_CALL(client, RPCBPROC_UNSET, (xdrproc_t)xdr_rpcb, (char *)&parms,
+	    (xdrproc_t)xdr_bool, (char *)&rslt, tottimeout);
+
+	CLNT_DESTROY(client);
+}
+
+static void
+lx_nlm_unreg(char *provider)
+{
+	struct netconfig *retnconf;
+	int vers;
+
+	if (nlm_bind_to_provider(provider, NULL, &retnconf) == -1)
+		return;
+
+	/* Unregister all versions of the program. */
+	for (vers = NLM_VERS; vers <= NLM4_VERS; vers++) {
+		lx_rpcb_unset(vers, retnconf->nc_netid);
+	}
+}
+
+void
+lx_syslog(char *fmt, ...)
+{
+	int fd, l;
+	struct sockaddr_un snd_addr;
+	char buf[SYSLOG_BLEN], fb[SYSLOG_BLEN], *bp, *fp, *ep;
+	va_list ap;
+
+	/* First we replace %m in fmt string with error string into fb. */
+	ep = fb + sizeof (fb);
+	fb[SYSLOG_BLEN - 1] = '\0';
+	for (bp = fb, fp = fmt; bp < ep && (*bp = *fp) != '\0'; bp++, fp++) {
+		if (*fp == '%' && *(fp + 1) == 'm') {
+			(void) strlcpy(bp, strerror(errno), ep - bp);
+			bp += strlen(bp);
+			fp += 2;
+		}
+	}
+
+	va_start(ap, fmt);
+	(void) snprintf(buf, sizeof (buf), "  rpc.lockd[%d]: ", getpid());
+	l = strlen(buf);
+	bp = &buf[l];
+	(void) vsnprintf(bp, sizeof (buf) - l, fb, ap);
+	va_end(ap);
+
+	if ((fd = socket(AF_UNIX, SOCK_DGRAM, 0)) == -1)
+		return;
+
+	bzero(&snd_addr, sizeof (snd_addr));
+	strcpy(snd_addr.sun_path, "/dev/log");
+	snd_addr.sun_family = AF_LOCAL;
+	l = strlen(snd_addr.sun_path) + sizeof (snd_addr.sun_family);
+
+	if (connect(fd, (struct sockaddr *)&snd_addr, l) == 0) {
+		l = strlen(buf);
+		(void) send(fd, buf, l, 0);
+	}
+
+	close(fd);
+}
+
+/* When debugging, ensure cleanup */
+static void
+sigint_handler(void)
+{
+	NETSELPDECL(providerp);
+
+	lx_syslog("Stopping");
+
+	/* unregister from rpcbind */
+	for (providerp = defaultproviders; *providerp != NULL; providerp++) {
+		char *provider = *providerp;
+		lx_nlm_unreg(provider);
+	}
+	(void) _nfssys(KILL_LOCKMGR, NULL);
+
+	exit(0);
+}
+
+int
+main(int ac, char *av[])
+{
+	NETSELPDECL(providerp);
+	int i, c, val;
+
+	if (geteuid() != 0) {
+		exit(1);
+	}
+
+	/* Initializations that require more privileges than we need to run. */
+	if (__init_daemon_priv(PU_RESETGROUPS | PU_CLEARLIMITSET, 1, 1,
+	    PRIV_SYS_NFS, NULL) == -1) {
+		exit(1);
+	}
+
+	(void) enable_extended_FILE_stdio(-1, -1);
+
+	while ((c = getopt(ac, av, "c:dg:l:t:")) != EOF)
+		switch (c) {
+		case 'c': /* max_connections */
+			if ((val = atoi(optarg)) <= 0)
+				goto badval;
+			max_conns_allowed = val;
+			break;
+
+		case 'd': /* debug */
+			debug = B_TRUE;
+			break;
+
+		case 'g': /* grace_period */
+			if ((val = atoi(optarg)) <= 0)
+				goto badval;
+			lmargs.grace = val;
+			break;
+
+		case 'l': /* listen_backlog */
+			if ((val = atoi(optarg)) <= 0)
+				goto badval;
+			listen_backlog = val;
+			break;
+
+		case 't': /* retrans_timeout */
+			if ((val = atoi(optarg)) <= 0)
+				goto badval;
+			lmargs.retransmittimeout = val;
+			break;
+
+		badval:
+			if (debug) {
+				fprintf(stderr, "Invalid -%c option value", c);
+			}
+			/* FALLTHROUGH */
+		default:
+			if (debug) {
+				usage();
+			}
+			exit(1);
+		}
+
+	/* If there is one more argument, it is the number of servers. */
+	if (optind < ac) {
+		val = atoi(av[optind]);
+		if (val <= 0) {
+			if (debug) {
+				fprintf(stderr, "Invalid max_servers argument");
+				usage();
+			}
+			exit(1);
+		}
+		max_servers = val;
+		optind++;
+	}
+	/* If there are two or more arguments, then this is a usage error. */
+	if (optind != ac) {
+		if (debug) {
+			usage();
+		}
+		exit(1);
+	}
+
+	if (debug) {
+		printf("lx_lockd: debug=%d, conn_idle_timout=%d, "
+		    "grace_period=%d, listen_backlog=%d, "
+		    "max_connections=%d, max_servers=%d, "
+		    "retrans_timeout=%d\n",
+		    debug, lmargs.timout, lmargs.grace, listen_backlog,
+		    max_conns_allowed, max_servers, lmargs.retransmittimeout);
+	}
+
+	/* Set current dir to server root */
+	if (chdir("/") < 0) {
+		lx_syslog("chdir: %m");
+		exit(1);
+	}
+
+	if (!debug) {
+		/* Block all signals if not debugging. */
+		sigset_t set;
+
+		(void) sigfillset(&set);
+		(void) sigprocmask(SIG_BLOCK, &set, NULL);
+		(void) setsid();
+	} else {
+		struct sigaction act;
+
+		act.sa_handler = sigint_handler;
+		act.sa_flags = 0;
+		(void) sigaction(SIGINT, &act, NULL);
+	}
+
+	lx_syslog("Starting");
+
+	/* Unregister any previous versions. */
+	for (i = NLM_VERS; i < NLM4_VERS; i++) {
+		svc_unreg(NLM_PROG, i);
+	}
+
+	/* Set up kernel RPC thread pool for the NLM server. */
+	if (nlmsvcpool(max_servers)) {
+		lx_syslog("Can't set up kernel NLM service: %m. Exiting");
+		exit(1);
+	}
+
+	/* Set up blocked thread to do LWP creation on behalf of the kernel. */
+	if (svcwait(NLM_SVCPOOL_ID)) {
+		lx_syslog("Can't set up NLM pool creator: %m. Exiting");
+		exit(1);
+	}
+
+	for (providerp = defaultproviders; *providerp != NULL; providerp++) {
+		char *provider = *providerp;
+		nlm_do_one(provider, nlmsvc);
+	}
+
+	if (num_fds == 0) {
+		lx_syslog("Could not start NLM service for any protocol. "
+		    "Exiting");
+		exit(1);
+	}
+
+	end_listen_fds = num_fds;
+
+	/*
+	 * lockd is up and running as far as we are concerned.
+	 *
+	 * Get rid of unneeded privileges.
+	 */
+	__fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION,
+	    PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL);
+
+	/* Poll for non-data control events on the transport descriptors. */
+	poll_for_action();
+
+	/* If we get here, something failed in poll_for_action(). */
+	return (1);
+}
+
+static int
+nlmsvcpool(int maxservers)
+{
+	struct svcpool_args npa;
+
+	npa.id = NLM_SVCPOOL_ID;
+	npa.maxthreads = maxservers;
+	npa.redline = 0;
+	npa.qsize = 0;
+	npa.timeout = 0;
+	npa.stksize = 0;
+	npa.max_same_xprt = 0;
+	return (_nfssys(SVCPOOL_CREATE, &npa));
+}
+
+static int
+ncfmly_to_lmfmly(const char *ncfmly)
+{
+	if (0 == strcmp(ncfmly, NC_INET))
+		return (LM_INET);
+	if (0 == strcmp(ncfmly, NC_INET6))
+		return (LM_INET6);
+	if (0 == strcmp(ncfmly, NC_LOOPBACK))
+		return (LM_LOOPBACK);
+	return (-1);
+}
+
+static int
+nctype_to_lmprot(uint_t semantics)
+{
+	switch (semantics) {
+	case NC_TPI_CLTS:
+		return (LM_UDP);
+	case NC_TPI_COTS_ORD:
+		return (LM_TCP);
+	}
+	return (-1);
+}
+
+static dev_t
+ncdev_to_rdev(const char *ncdev)
+{
+	struct stat st;
+
+	if (stat(ncdev, &st) < 0)
+		return (NODEV);
+	return (st.st_rdev);
+}
+
+/*
+ * Establish NLM service thread.
+ */
+int
+nlmsvc(int fd, struct netbuf addrmask, struct netconfig *nconf)
+{
+	struct lm_svc_args lma;
+
+	lma = lmargs; /* init by struct copy */
+
+	/*
+	 * The kernel code needs to reconstruct a complete
+	 * knetconfig from n_fmly, n_proto.  We use these
+	 * two fields to convey the family and semantics.
+	 */
+	lma.fd = fd;
+	lma.n_fmly = ncfmly_to_lmfmly(nconf->nc_protofmly);
+	lma.n_proto = nctype_to_lmprot(nconf->nc_semantics);
+	lma.n_rdev = ncdev_to_rdev(nconf->nc_device);
+
+	if (!have_rpcbind) {
+		/*
+		 * Inform the kernel NLM code to run without rpcbind and
+		 * rpc.statd.
+		 */
+		lma.n_v4_only = -1;
+	}
+
+	return (_nfssys(LM_SVC, &lma));
+}
+
+static void
+usage(void)
+{
+	(void) fprintf(stderr, "usage: lx_lockd [options] [max_servers]\n");
+	(void) fprintf(stderr, "\t-c max_connections\n");
+	(void) fprintf(stderr, "\t-d enable debugging\n");
+	(void) fprintf(stderr, "\t-g grace_period\n");
+	(void) fprintf(stderr, "\t-l listen_backlog\n");
+	(void) fprintf(stderr, "\t-t retransmit_timeout\n");
+}
diff --git a/usr/src/lib/brand/lx/lx_lockd/nfs_tbind.c b/usr/src/lib/brand/lx/lx_lockd/nfs_tbind.c
new file mode 100644
index 0000000000..1f8f50e23c
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_lockd/nfs_tbind.c
@@ -0,0 +1,1832 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2014 Gary Mills
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * Derived from usr/src/cmd/fs.d/nfs/lib/nfs_tbind.c, but modified to work
+ * within an lx-branded zone and to only support the lx lockd. Changes from the
+ * original have been minimized, thus this file is not cstyle or lint clean.
+ */
+
+#include <tiuser.h>
+#include <fcntl.h>
+#include <netconfig.h>
+#include <stropts.h>
+#include <errno.h>
+#include <rpc/rpc.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <signal.h>
+#include <netdir.h>
+#include <unistd.h>
+#include <string.h>
+#include <netinet/tcp.h>
+#include <malloc.h>
+#include <stdlib.h>
+#include "nfs_tbind.h"
+#include <nfs/nfs.h>
+#include <nfs/nfs_acl.h>
+#include <nfs/nfssys.h>
+#include <nfs/nfs4.h>
+#include <zone.h>
+#include <sys/socket.h>
+#include <tsol/label.h>
+#include <sys/varargs.h>
+#include <rpcsvc/nlm_prot.h>
+
+/*
+ * Determine valid semantics for most applications.
+ */
+#define	OK_TPI_TYPE(_nconf) \
+	(_nconf->nc_semantics == NC_TPI_CLTS || \
+	_nconf->nc_semantics == NC_TPI_COTS || \
+	_nconf->nc_semantics == NC_TPI_COTS_ORD)
+
+#define	BE32_TO_U32(a) \
+	((((ulong_t)((uchar_t *)a)[0] & 0xFF) << (ulong_t)24) | \
+	(((ulong_t)((uchar_t *)a)[1] & 0xFF) << (ulong_t)16) | \
+	(((ulong_t)((uchar_t *)a)[2] & 0xFF) << (ulong_t)8)  | \
+	((ulong_t)((uchar_t *)a)[3] & 0xFF))
+
+/*
+ * Number of elements to add to the poll array on each allocation.
+ */
+#define	POLL_ARRAY_INC_SIZE	64
+
+/*
+ * Number of file descriptors by which the process soft limit may be
+ * increased on each call to nofile_increase(0).
+ */
+#define	NOFILE_INC_SIZE	64
+
+/*
+ * Default TCP send and receive buffer size of NFS server.
+ */
+#define	NFSD_TCP_BUFSZ	(1024*1024)
+
+struct conn_ind {
+	struct conn_ind *conn_next;
+	struct conn_ind *conn_prev;
+	struct t_call   *conn_call;
+};
+
+struct conn_entry {
+	bool_t			closing;
+	struct netconfig	nc;
+};
+
+/*
+ * this file contains transport routines common to nfsd and lockd
+ */
+static	int	nofile_increase(int);
+static	int	reuseaddr(int);
+static	int	recvucred(int);
+static  int	anonmlp(int);
+static	void	add_to_poll_list(int, struct netconfig *);
+static	char	*serv_name_to_port_name(char *);
+static	int	bind_to_proto(char *, char *, struct netbuf **,
+				struct netconfig **);
+int	nlm_bind_to_provider(char *, struct netbuf **, struct netconfig **);
+static	void	conn_close_oldest(void);
+static	boolean_t conn_get(int, struct netconfig *, struct conn_ind **);
+static	void	cots_listen_event(int, int);
+static	int	discon_get(int, struct netconfig *, struct conn_ind **);
+static	int	do_poll_clts_action(int, int);
+static	int	do_poll_cots_action(int, int);
+static	void	remove_from_poll_list(int);
+static	int	set_addrmask(int, struct netconfig *, struct netbuf *);
+static	int	is_listen_fd_index(int);
+
+static	struct pollfd *poll_array;
+static	struct conn_entry *conn_polled;
+static	int	num_conns;		/* Current number of connections */
+int		(*Mysvc4)(int, struct netbuf *, struct netconfig *, int,
+		struct netbuf *);
+static int	setopt(int fd, int level, int name, int value);
+static int	get_opt(int fd, int level, int name);
+static void	nfslib_set_sockbuf(int fd);
+
+extern boolean_t have_rpcbind;
+extern void lx_syslog(char *, ...);
+extern boolean_t lx_rpcb_set(const rpcvers_t, const struct netconfig *,
+    const struct netbuf *);
+extern void lx_rpcb_unset(const rpcvers_t, char *);
+
+/* We can't include syslog.h since we override it, so define these here. */
+#define	LOG_ERR		3
+#define	LOG_WARNING	4
+#define	LOG_DEBUG	7
+
+/*
+ * Built-in netconfig table.
+ */
+#define	N_NETCONF_ENTS	5
+static struct netconfig nca[N_NETCONF_ENTS] = {
+	{"udp6", NC_TPI_CLTS,     1, "inet6", "udp", "/dev/udp6", 0, NULL},
+	{"tcp6", NC_TPI_COTS_ORD, 1, "inet6", "tcp", "/dev/tcp6", 0, NULL},
+	{"udp",  NC_TPI_CLTS,     1, "inet",  "udp", "/dev/udp", 0, NULL},
+	{"tcp",  NC_TPI_COTS_ORD, 1, "inet",  "tcp", "/dev/tcp", 0, NULL},
+	{"ticotsord", NC_TPI_COTS_ORD, 1, "loopback", "-", "/dev/ticotsord", 0,
+	    NULL}
+};
+
+/* To minimize file diffs we provide our own syslog wrapper. */
+static void
+syslog(int level, char *fmt, ...)
+{
+	va_list ap;
+
+	if (level == LOG_DEBUG)
+		return;
+	va_start(ap, fmt);
+	lx_syslog(fmt, ap);
+	va_end(ap);
+}
+
+/*
+ * Called to create and prepare a transport descriptor for in-kernel
+ * RPC service.
+ * Returns -1 on failure and a valid descriptor on success.
+ */
+int
+nfslib_transport_open(struct netconfig *nconf)
+{
+	int fd;
+	struct strioctl	strioc;
+
+	if ((nconf == (struct netconfig *)NULL) ||
+	    (nconf->nc_device == (char *)NULL)) {
+		syslog(LOG_ERR, "no netconfig device");
+		return (-1);
+	}
+
+	/*
+	 * Open the transport device.
+	 */
+	fd = t_open(nconf->nc_device, O_RDWR, (struct t_info *)NULL);
+	if (fd == -1) {
+		if (t_errno == TSYSERR && errno == EMFILE &&
+		    (nofile_increase(0) == 0)) {
+			/* Try again with a higher NOFILE limit. */
+			fd = t_open(nconf->nc_device, O_RDWR,
+			    (struct t_info *)NULL);
+		}
+		if (fd == -1) {
+			syslog(LOG_ERR, "t_open %s failed:  t_errno %d, %m",
+			    nconf->nc_device, t_errno);
+			return (-1);
+		}
+	}
+
+	/*
+	 * Pop timod because the RPC module must be as close as possible
+	 * to the transport.
+	 */
+	if (ioctl(fd, I_POP, 0) < 0) {
+		syslog(LOG_ERR, "I_POP of timod failed: %m");
+		(void) t_close(fd);
+		return (-1);
+	}
+
+	/*
+	 * Common code for CLTS and COTS transports
+	 */
+	if (ioctl(fd, I_PUSH, "rpcmod") < 0) {
+		syslog(LOG_ERR, "I_PUSH of rpcmod failed: %m");
+		(void) t_close(fd);
+		return (-1);
+	}
+
+	strioc.ic_cmd = RPC_SERVER;
+	strioc.ic_dp = (char *)0;
+	strioc.ic_len = 0;
+	strioc.ic_timout = -1;
+
+	/* Tell rpcmod to act like a server stream. */
+	if (ioctl(fd, I_STR, &strioc) < 0) {
+		syslog(LOG_ERR, "rpcmod set-up ioctl failed: %m");
+		(void) t_close(fd);
+		return (-1);
+	}
+
+	/*
+	 * Re-push timod so that we will still be doing TLI
+	 * operations on the descriptor.
+	 */
+	if (ioctl(fd, I_PUSH, "timod") < 0) {
+		syslog(LOG_ERR, "I_PUSH of timod failed: %m");
+		(void) t_close(fd);
+		return (-1);
+	}
+
+	/*
+	 * Enable options of returning the ip's for udp.
+	 */
+	if (strcmp(nconf->nc_netid, "udp6") == 0)
+		__rpc_tli_set_options(fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, 1);
+	else if (strcmp(nconf->nc_netid, "udp") == 0)
+		__rpc_tli_set_options(fd, IPPROTO_IP, IP_RECVDSTADDR, 1);
+
+	return (fd);
+}
+
+static int
+nofile_increase(int limit)
+{
+	struct rlimit rl;
+
+	if (getrlimit(RLIMIT_NOFILE, &rl) == -1) {
+		syslog(LOG_ERR, "getrlimit of NOFILE failed: %m");
+		return (-1);
+	}
+
+	if (limit > 0)
+		rl.rlim_cur = limit;
+	else
+		rl.rlim_cur += NOFILE_INC_SIZE;
+
+	if (rl.rlim_cur > rl.rlim_max &&
+	    rl.rlim_max != RLIM_INFINITY)
+		rl.rlim_max = rl.rlim_cur;
+
+	if (setrlimit(RLIMIT_NOFILE, &rl) == -1) {
+		syslog(LOG_ERR, "setrlimit of NOFILE to %d failed: %m",
+		    rl.rlim_cur);
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+nfslib_set_sockbuf(int fd)
+{
+	int curval, val;
+
+	val = NFSD_TCP_BUFSZ;
+
+	curval = get_opt(fd, SOL_SOCKET, SO_SNDBUF);
+	syslog(LOG_DEBUG, "Current SO_SNDBUF value is %d", curval);
+	if ((curval != -1) && (curval < val)) {
+		syslog(LOG_DEBUG, "Set SO_SNDBUF  option to %d", val);
+		if (setopt(fd, SOL_SOCKET, SO_SNDBUF, val) < 0) {
+			syslog(LOG_ERR,
+			    "couldn't set SO_SNDBUF to %d - t_errno = %d",
+			    val, t_errno);
+			syslog(LOG_ERR,
+			    "Check and increase system-wide tcp_max_buf");
+		}
+	}
+
+	curval = get_opt(fd, SOL_SOCKET, SO_RCVBUF);
+	syslog(LOG_DEBUG, "Current SO_RCVBUF value is %d", curval);
+	if ((curval != -1) && (curval < val)) {
+		syslog(LOG_DEBUG, "Set SO_RCVBUF  option to %d", val);
+		if (setopt(fd, SOL_SOCKET, SO_RCVBUF, val) < 0) {
+			syslog(LOG_ERR,
+			    "couldn't set SO_RCVBUF to %d - t_errno = %d",
+			    val, t_errno);
+			syslog(LOG_ERR,
+			    "Check and increase system-wide tcp_max_buf");
+		}
+	}
+}
+
+static int
+nlm_bindit(struct netconfig *nconf, struct netbuf **addr, int backlog)
+{
+	int fd;
+	struct t_bind  *ntb;
+	struct t_bind tb;
+	struct nd_addrlist *addrlist;
+	struct t_optmgmt req, resp;
+	struct opthdr *opt;
+	char reqbuf[128];
+	struct nd_hostserv hs;
+
+	if ((fd = nfslib_transport_open(nconf)) == -1) {
+		syslog(LOG_ERR, "cannot establish transport service over %s",
+		    nconf->nc_device);
+		return (-1);
+	}
+
+	addrlist = (struct nd_addrlist *)NULL;
+
+	/*
+	 * This is the well-defined 'lockd' port from /etc/services. We can
+	 * pass down the NLM port number to nlm_bindit and that resolves
+	 * properly in the native *getby* calling paths.
+	 */
+	hs.h_serv = "4045";
+	hs.h_host = HOST_SELF;
+
+	/*
+	 * The following block is based on _netdir_getbyname in
+	 * usr/src/lib/nametoaddr/straddr/common/straddr.c. This is what would
+	 * be used by __classic_netdir_getbyname for the loopback.
+	 */
+	if (strcmp(nconf->nc_netid, "ticotsord") == 0) {
+		struct nd_addrlist *ap;
+		struct netbuf *netbufp;
+		char *fulladdr = "localhost.4045";
+
+		if ((ap = malloc(sizeof (struct nd_addrlist))) == NULL) {
+			(void) t_close(fd);
+			return (-1);
+		}
+
+		ap->n_cnt = 1;
+		if ((ap->n_addrs = malloc(sizeof (struct netbuf))) == NULL) {
+			free(ap);
+			(void) t_close(fd);
+			return (-1);
+		}
+
+		netbufp = ap->n_addrs;
+
+		/* Don't include the terminating NULL character in the length */
+		netbufp->len = netbufp->maxlen = (int)strlen(fulladdr);
+		if ((netbufp->buf = strdup(fulladdr)) == NULL) {
+			free(netbufp);
+			free(ap);
+			(void) t_close(fd);
+			return (-1);
+		}
+		addrlist = ap;
+
+	} else if (netdir_getbyname(nconf, &hs, &addrlist) != 0) {
+		syslog(LOG_ERR,
+		"Cannot get address for transport %s",
+		    nconf->nc_netid);
+		(void) t_close(fd);
+		return (-1);
+	}
+
+	if (strcmp(nconf->nc_proto, "tcp") == 0) {
+		/*
+		 * If we're running over TCP, then set the
+		 * SO_REUSEADDR option so that we can bind
+		 * to our preferred address even if previously
+		 * left connections exist in FIN_WAIT states.
+		 * This is somewhat bogus, but otherwise you have
+		 * to wait 2 minutes to restart after killing it.
+		 */
+		if (reuseaddr(fd) == -1) {
+			syslog(LOG_WARNING,
+			"couldn't set SO_REUSEADDR option on transport");
+		}
+	} else if (strcmp(nconf->nc_proto, "udp") == 0) {
+		/*
+		 * In order to run MLP on UDP, we need to handle creds.
+		 */
+		if (recvucred(fd) == -1) {
+			syslog(LOG_WARNING,
+			    "couldn't set SO_RECVUCRED option on transport");
+		}
+	}
+
+	if (nconf->nc_semantics == NC_TPI_CLTS)
+		tb.qlen = 0;
+	else
+		tb.qlen = backlog;
+
+	/* LINTED pointer alignment */
+	ntb = (struct t_bind *)t_alloc(fd, T_BIND, T_ALL);
+	if (ntb == (struct t_bind *)NULL) {
+		syslog(LOG_ERR, "t_alloc failed:  t_errno %d, %m", t_errno);
+		(void) t_close(fd);
+		netdir_free((void *)addrlist, ND_ADDRLIST);
+		return (-1);
+	}
+
+	/*
+	 * XXX - what about the space tb->addr.buf points to? This should
+	 * be either a memcpy() to/from the buf fields, or t_alloc(fd,T_BIND,)
+	 * should't be called with T_ALL.
+	 */
+	if (addrlist)
+		tb.addr = *(addrlist->n_addrs);		/* structure copy */
+
+	if (t_bind(fd, &tb, ntb) == -1) {
+		syslog(LOG_ERR, "t_bind failed:  t_errno %d, %m", t_errno);
+		(void) t_free((char *)ntb, T_BIND);
+		netdir_free((void *)addrlist, ND_ADDRLIST);
+		(void) t_close(fd);
+		return (-1);
+	}
+
+	/* make sure we bound to the right address */
+	if (tb.addr.len != ntb->addr.len ||
+	    memcmp(tb.addr.buf, ntb->addr.buf, tb.addr.len) != 0) {
+		syslog(LOG_ERR, "t_bind to wrong address");
+		(void) t_free((char *)ntb, T_BIND);
+		netdir_free((void *)addrlist, ND_ADDRLIST);
+		(void) t_close(fd);
+		return (-1);
+	}
+
+	*addr = &ntb->addr;
+	netdir_free((void *)addrlist, ND_ADDRLIST);
+
+	if (strcmp(nconf->nc_proto, "tcp") == 0) {
+		/*
+		 * Disable the Nagle algorithm on TCP connections.
+		 * Connections accepted from this listener will
+		 * inherit the listener options.
+		 */
+
+		/* LINTED pointer alignment */
+		opt = (struct opthdr *)reqbuf;
+		opt->level = IPPROTO_TCP;
+		opt->name = TCP_NODELAY;
+		opt->len = sizeof (int);
+
+		/* LINTED pointer alignment */
+		*(int *)((char *)opt + sizeof (*opt)) = 1;
+
+		req.flags = T_NEGOTIATE;
+		req.opt.len = sizeof (*opt) + opt->len;
+		req.opt.buf = (char *)opt;
+		resp.flags = 0;
+		resp.opt.buf = reqbuf;
+		resp.opt.maxlen = sizeof (reqbuf);
+
+		if (t_optmgmt(fd, &req, &resp) < 0 ||
+		    resp.flags != T_SUCCESS) {
+			syslog(LOG_ERR,
+	"couldn't set NODELAY option for proto %s: t_errno = %d, %m",
+			    nconf->nc_proto, t_errno);
+		}
+
+		nfslib_set_sockbuf(fd);
+	}
+
+	return (fd);
+}
+
+static int
+get_opt(int fd, int level, int name)
+{
+	struct t_optmgmt req, res;
+	struct {
+		struct opthdr opt;
+		int value;
+	} reqbuf;
+
+	reqbuf.opt.level = level;
+	reqbuf.opt.name = name;
+	reqbuf.opt.len = sizeof (int);
+	reqbuf.value = 0;
+
+	req.flags = T_CURRENT;
+	req.opt.len = sizeof (reqbuf);
+	req.opt.buf = (char *)&reqbuf;
+
+	res.flags = 0;
+	res.opt.buf = (char *)&reqbuf;
+	res.opt.maxlen = sizeof (reqbuf);
+
+	if (t_optmgmt(fd, &req, &res) < 0 || res.flags != T_SUCCESS) {
+		t_error("t_optmgmt");
+		return (-1);
+	}
+	return (reqbuf.value);
+}
+
+static int
+setopt(int fd, int level, int name, int value)
+{
+	struct t_optmgmt req, resp;
+	struct {
+		struct opthdr opt;
+		int value;
+	} reqbuf;
+
+	reqbuf.opt.level = level;
+	reqbuf.opt.name = name;
+	reqbuf.opt.len = sizeof (int);
+
+	reqbuf.value = value;
+
+	req.flags = T_NEGOTIATE;
+	req.opt.len = sizeof (reqbuf);
+	req.opt.buf = (char *)&reqbuf;
+
+	resp.flags = 0;
+	resp.opt.buf = (char *)&reqbuf;
+	resp.opt.maxlen = sizeof (reqbuf);
+
+	if (t_optmgmt(fd, &req, &resp) < 0 || resp.flags != T_SUCCESS) {
+		t_error("t_optmgmt");
+		return (-1);
+	}
+	return (0);
+}
+
+static int
+reuseaddr(int fd)
+{
+	return (setopt(fd, SOL_SOCKET, SO_REUSEADDR, 1));
+}
+
+static int
+recvucred(int fd)
+{
+	return (setopt(fd, SOL_SOCKET, SO_RECVUCRED, 1));
+}
+
+static int
+anonmlp(int fd)
+{
+	return (setopt(fd, SOL_SOCKET, SO_ANON_MLP, 1));
+}
+
+void
+nfslib_log_tli_error(char *tli_name, int fd, struct netconfig *nconf)
+{
+	int error;
+
+	/*
+	 * Save the error code across syslog(), just in case syslog()
+	 * gets its own error and, therefore, overwrites errno.
+	 */
+	error = errno;
+	if (t_errno == TSYSERR) {
+		syslog(LOG_ERR, "%s(file descriptor %d/transport %s) %m",
+		    tli_name, fd, nconf->nc_proto);
+	} else {
+		syslog(LOG_ERR,
+		    "%s(file descriptor %d/transport %s) TLI error %d",
+		    tli_name, fd, nconf->nc_proto, t_errno);
+	}
+	errno = error;
+}
+
+/*
+ * Called to set up service over a particular transport.
+ */
+void
+nlm_do_one(char *provider, int (*svc)(int, struct netbuf, struct netconfig *))
+{
+	register int sock;
+	struct netbuf *retaddr;
+	struct netconfig *retnconf;
+	struct netbuf addrmask;
+	int vers;
+	int err;
+	static boolean_t elogged = B_FALSE;
+
+	sock = nlm_bind_to_provider(provider, &retaddr, &retnconf);
+	if (sock == -1) {
+		(void) syslog(LOG_ERR,
+	"Cannot establish NLM service over %s: transport setup problem.",
+		    provider);
+		return;
+	}
+
+	if (set_addrmask(sock, retnconf, &addrmask) < 0) {
+		(void) syslog(LOG_ERR,
+		    "Cannot set address mask for %s", retnconf->nc_netid);
+		return;
+	}
+
+	/* Register all versions of the NLM with rpcbind. */
+	if (strcmp(provider, "/dev/ticotsord") != 0) {
+		for (vers = NLM_VERS; vers <= NLM4_VERS; vers++) {
+			lx_rpcb_unset(vers, retnconf->nc_netid);
+			have_rpcbind = lx_rpcb_set(vers, retnconf, retaddr);
+			if (!have_rpcbind && !elogged) {
+				/*
+				 * No rpcbind running. The kernel NFS locking
+				 * code interacts with rpcbind & rpc.statd for
+				 * NFSv3 locking. We warn about this but
+				 * proceed since NFSv4 locking is still usable.
+				 */
+				lx_syslog("Warning: rpcbind is not running, "
+				    "but is required for NFSv3 locking");
+				elogged = B_TRUE;
+				break;
+			}
+		}
+	}
+
+	/*
+	 * Register services with CLTS semantics right now.
+	 * Note: services with COTS/COTS_ORD semantics will be
+	 * registered later from cots_listen_event function.
+	 */
+	if (retnconf->nc_semantics == NC_TPI_CLTS) {
+		/* Don't drop core if supporting module(s) aren't loaded. */
+		(void) signal(SIGSYS, SIG_IGN);
+
+		/*
+		 * svc() doesn't block, it returns success or failure.
+		 */
+
+		if (svc == NULL && Mysvc4 != NULL)
+			err = (*Mysvc4)(sock, &addrmask, retnconf,
+			    NFS4_SETPORT|NFS4_KRPC_START, retaddr);
+		else
+			err = (*svc)(sock, addrmask, retnconf);
+
+		if (err < 0) {
+			(void) syslog(LOG_ERR,
+			    "Cannot establish NLM service over <file desc."
+			    " %d, protocol %s> : %m. Exiting",
+			    sock, retnconf->nc_proto);
+			exit(1);
+		}
+	}
+	free(addrmask.buf);
+
+	/*
+	 * We successfully set up the server over this transport.
+	 * Add this descriptor to the one being polled on.
+	 */
+	add_to_poll_list(sock, retnconf);
+}
+
+/*
+ * Set up the NFS service over all the available transports.
+ * Returns -1 for failure, 0 for success.
+ */
+int
+do_all(struct protob *protobp,
+    int (*svc)(int, struct netbuf, struct netconfig *))
+{
+	struct netconfig *nconf;
+	NCONF_HANDLE *nc;
+	int l;
+
+	if ((nc = setnetconfig()) == (NCONF_HANDLE *)NULL) {
+		syslog(LOG_ERR, "setnetconfig failed: %m");
+		return (-1);
+	}
+	l = strlen(NC_UDP);
+	while (nconf = getnetconfig(nc)) {
+		if ((nconf->nc_flag & NC_VISIBLE) &&
+		    strcmp(nconf->nc_protofmly, NC_LOOPBACK) != 0 &&
+		    OK_TPI_TYPE(nconf) &&
+		    (protobp->program != NFS4_CALLBACK ||
+		    strncasecmp(nconf->nc_proto, NC_UDP, l) != 0))
+			continue; /* do_all should never be called */
+	}
+	(void) endnetconfig(nc);
+	return (0);
+}
+
+/*
+ * poll on the open transport descriptors for events and errors.
+ */
+void
+poll_for_action(void)
+{
+	int nfds;
+	int i;
+
+	/*
+	 * Keep polling until all transports have been closed. When this
+	 * happens, we return.
+	 */
+	while ((int)num_fds > 0) {
+		nfds = poll(poll_array, num_fds, INFTIM);
+		switch (nfds) {
+		case 0:
+			continue;
+
+		case -1:
+			/*
+			 * Some errors from poll could be
+			 * due to temporary conditions, and we try to
+			 * be robust in the face of them. Other
+			 * errors (should never happen in theory)
+			 * are fatal (eg. EINVAL, EFAULT).
+			 */
+			switch (errno) {
+			case EINTR:
+				continue;
+
+			case EAGAIN:
+			case ENOMEM:
+				(void) sleep(10);
+				continue;
+
+			default:
+				(void) syslog(LOG_ERR,
+				    "poll failed: %m. Exiting");
+				exit(1);
+			}
+		default:
+			break;
+		}
+
+		/*
+		 * Go through the poll list looking for events.
+		 */
+		for (i = 0; i < num_fds && nfds > 0; i++) {
+			if (poll_array[i].revents) {
+				nfds--;
+				/*
+				 * We have a message, so try to read it.
+				 * Record the error return in errno,
+				 * so that syslog(LOG_ERR, "...%m")
+				 * dumps the corresponding error string.
+				 */
+				if (conn_polled[i].nc.nc_semantics ==
+				    NC_TPI_CLTS) {
+					errno = do_poll_clts_action(
+					    poll_array[i].fd, i);
+				} else {
+					errno = do_poll_cots_action(
+					    poll_array[i].fd, i);
+				}
+
+				if (errno == 0)
+					continue;
+				/*
+				 * Most returned error codes mean that there is
+				 * fatal condition which we can only deal with
+				 * by closing the transport.
+				 */
+				if (errno != EAGAIN && errno != ENOMEM) {
+					(void) syslog(LOG_ERR,
+		"Error (%m) reading descriptor %d/transport %s. Closing it.",
+					    poll_array[i].fd,
+					    conn_polled[i].nc.nc_proto);
+					(void) t_close(poll_array[i].fd);
+					remove_from_poll_list(poll_array[i].fd);
+
+				} else if (errno == ENOMEM)
+					(void) sleep(5);
+			}
+		}
+	}
+
+	(void) syslog(LOG_ERR,
+	    "All transports have been closed with errors. Exiting.");
+}
+
+/*
+ * Allocate poll/transport array entries for this descriptor.
+ */
+static void
+add_to_poll_list(int fd, struct netconfig *nconf)
+{
+	static int poll_array_size = 0;
+
+	/*
+	 * If the arrays are full, allocate new ones.
+	 */
+	if (num_fds == poll_array_size) {
+		struct pollfd *tpa;
+		struct conn_entry *tnp;
+
+		if (poll_array_size != 0) {
+			tpa = poll_array;
+			tnp = conn_polled;
+		} else
+			tpa = (struct pollfd *)0;
+
+		poll_array_size += POLL_ARRAY_INC_SIZE;
+		/*
+		 * Allocate new arrays.
+		 */
+		poll_array = (struct pollfd *)
+		    malloc(poll_array_size * sizeof (struct pollfd) + 256);
+		conn_polled = (struct conn_entry *)
+		    malloc(poll_array_size * sizeof (struct conn_entry) + 256);
+		if (poll_array == (struct pollfd *)NULL ||
+		    conn_polled == (struct conn_entry *)NULL) {
+			syslog(LOG_ERR, "malloc failed for poll array");
+			exit(1);
+		}
+
+		/*
+		 * Copy the data of the old ones into new arrays, and
+		 * free the old ones.
+		 */
+		if (tpa) {
+			(void) memcpy((void *)poll_array, (void *)tpa,
+			    num_fds * sizeof (struct pollfd));
+			(void) memcpy((void *)conn_polled, (void *)tnp,
+			    num_fds * sizeof (struct conn_entry));
+			free((void *)tpa);
+			free((void *)tnp);
+		}
+	}
+
+	/*
+	 * Set the descriptor and event list. All possible events are
+	 * polled for.
+	 */
+	poll_array[num_fds].fd = fd;
+	poll_array[num_fds].events = POLLIN|POLLRDNORM|POLLRDBAND|POLLPRI;
+
+	/*
+	 * Copy the transport data over too.
+	 */
+	conn_polled[num_fds].nc = *nconf;
+	conn_polled[num_fds].closing = 0;
+
+	/*
+	 * Set the descriptor to non-blocking. Avoids a race
+	 * between data arriving on the stream and then having it
+	 * flushed before we can read it.
+	 */
+	if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
+		(void) syslog(LOG_ERR,
+	"fcntl(file desc. %d/transport %s, F_SETFL, O_NONBLOCK): %m. Exiting",
+		    num_fds, nconf->nc_proto);
+		exit(1);
+	}
+
+	/*
+	 * Count this descriptor.
+	 */
+	++num_fds;
+}
+
+static void
+remove_from_poll_list(int fd)
+{
+	int i;
+	int num_to_copy;
+
+	for (i = 0; i < num_fds; i++) {
+		if (poll_array[i].fd == fd) {
+			--num_fds;
+			num_to_copy = num_fds - i;
+			(void) memcpy((void *)&poll_array[i],
+			    (void *)&poll_array[i+1],
+			    num_to_copy * sizeof (struct pollfd));
+			(void) memset((void *)&poll_array[num_fds], 0,
+			    sizeof (struct pollfd));
+			(void) memcpy((void *)&conn_polled[i],
+			    (void *)&conn_polled[i+1],
+			    num_to_copy * sizeof (struct conn_entry));
+			(void) memset((void *)&conn_polled[num_fds], 0,
+			    sizeof (struct conn_entry));
+			return;
+		}
+	}
+	syslog(LOG_ERR, "attempt to remove nonexistent fd from poll list");
+
+}
+
+/*
+ * Called to read and interpret the event on a connectionless descriptor.
+ * Returns 0 if successful, or a UNIX error code if failure.
+ */
+static int
+do_poll_clts_action(int fd, int conn_index)
+{
+	int error;
+	int ret;
+	int flags;
+	struct netconfig *nconf = &conn_polled[conn_index].nc;
+	static struct t_unitdata *unitdata = NULL;
+	static struct t_uderr *uderr = NULL;
+	static int oldfd = -1;
+	struct nd_hostservlist *host = NULL;
+	struct strbuf ctl[1], data[1];
+	/*
+	 * We just need to have some space to consume the
+	 * message in the event we can't use the TLI interface to do the
+	 * job.
+	 *
+	 * We flush the message using getmsg(). For the control part
+	 * we allocate enough for any TPI header plus 32 bytes for address
+	 * and options. For the data part, there is nothing magic about
+	 * the size of the array, but 256 bytes is probably better than
+	 * 1 byte, and we don't expect any data portion anyway.
+	 *
+	 * If the array sizes are too small, we handle this because getmsg()
+	 * (called to consume the message) will return MOREDATA|MORECTL.
+	 * Thus we just call getmsg() until it's read the message.
+	 */
+	char ctlbuf[sizeof (union T_primitives) + 32];
+	char databuf[256];
+
+	/*
+	 * If this is the same descriptor as the last time
+	 * do_poll_clts_action was called, we can save some
+	 * de-allocation and allocation.
+	 */
+	if (oldfd != fd) {
+		oldfd = fd;
+
+		if (unitdata) {
+			(void) t_free((char *)unitdata, T_UNITDATA);
+			unitdata = NULL;
+		}
+		if (uderr) {
+			(void) t_free((char *)uderr, T_UDERROR);
+			uderr = NULL;
+		}
+	}
+
+	/*
+	 * Allocate a unitdata structure for receiving the event.
+	 */
+	if (unitdata == NULL) {
+		/* LINTED pointer alignment */
+		unitdata = (struct t_unitdata *)t_alloc(fd, T_UNITDATA, T_ALL);
+		if (unitdata == NULL) {
+			if (t_errno == TSYSERR) {
+				/*
+				 * Save the error code across
+				 * syslog(), just in case
+				 * syslog() gets its own error
+				 * and therefore overwrites errno.
+				 */
+				error = errno;
+				(void) syslog(LOG_ERR,
+	"t_alloc(file descriptor %d/transport %s, T_UNITDATA) failed: %m",
+				    fd, nconf->nc_proto);
+				return (error);
+			}
+			(void) syslog(LOG_ERR,
+"t_alloc(file descriptor %d/transport %s, T_UNITDATA) failed TLI error %d",
+			    fd, nconf->nc_proto, t_errno);
+			goto flush_it;
+		}
+	}
+
+try_again:
+	flags = 0;
+
+	/*
+	 * The idea is we wait for T_UNITDATA_IND's. Of course,
+	 * we don't get any, because rpcmod filters them out.
+	 * However, we need to call t_rcvudata() to let TLI
+	 * tell us we have a T_UDERROR_IND.
+	 *
+	 * algorithm is:
+	 * 	t_rcvudata(), expecting TLOOK.
+	 * 	t_look(), expecting T_UDERR.
+	 * 	t_rcvuderr(), expecting success (0).
+	 * 	expand destination address into ASCII,
+	 *	and dump it.
+	 */
+
+	ret = t_rcvudata(fd, unitdata, &flags);
+	if (ret == 0 || t_errno == TBUFOVFLW) {
+		(void) syslog(LOG_WARNING,
+"t_rcvudata(file descriptor %d/transport %s) got unexpected data, %d bytes",
+		    fd, nconf->nc_proto, unitdata->udata.len);
+
+		/*
+		 * Even though we don't expect any data, in case we do,
+		 * keep reading until there is no more.
+		 */
+		if (flags & T_MORE)
+			goto try_again;
+
+		return (0);
+	}
+
+	switch (t_errno) {
+	case TNODATA:
+		return (0);
+	case TSYSERR:
+		/*
+		 * System errors are returned to caller.
+		 * Save the error code across
+		 * syslog(), just in case
+		 * syslog() gets its own error
+		 * and therefore overwrites errno.
+		 */
+		error = errno;
+		(void) syslog(LOG_ERR,
+		    "t_rcvudata(file descriptor %d/transport %s) %m",
+		    fd, nconf->nc_proto);
+		return (error);
+	case TLOOK:
+		break;
+	default:
+		(void) syslog(LOG_ERR,
+		"t_rcvudata(file descriptor %d/transport %s) TLI error %d",
+		    fd, nconf->nc_proto, t_errno);
+		goto flush_it;
+	}
+
+	ret = t_look(fd);
+	switch (ret) {
+	case 0:
+		return (0);
+	case -1:
+		/*
+		 * System errors are returned to caller.
+		 */
+		if (t_errno == TSYSERR) {
+			/*
+			 * Save the error code across
+			 * syslog(), just in case
+			 * syslog() gets its own error
+			 * and therefore overwrites errno.
+			 */
+			error = errno;
+			(void) syslog(LOG_ERR,
+			    "t_look(file descriptor %d/transport %s) %m",
+			    fd, nconf->nc_proto);
+			return (error);
+		}
+		(void) syslog(LOG_ERR,
+		    "t_look(file descriptor %d/transport %s) TLI error %d",
+		    fd, nconf->nc_proto, t_errno);
+		goto flush_it;
+	case T_UDERR:
+		break;
+	default:
+		(void) syslog(LOG_WARNING,
+	"t_look(file descriptor %d/transport %s) returned %d not T_UDERR (%d)",
+		    fd, nconf->nc_proto, ret, T_UDERR);
+	}
+
+	if (uderr == NULL) {
+		/* LINTED pointer alignment */
+		uderr = (struct t_uderr *)t_alloc(fd, T_UDERROR, T_ALL);
+		if (uderr == NULL) {
+			if (t_errno == TSYSERR) {
+				/*
+				 * Save the error code across
+				 * syslog(), just in case
+				 * syslog() gets its own error
+				 * and therefore overwrites errno.
+				 */
+				error = errno;
+				(void) syslog(LOG_ERR,
+	"t_alloc(file descriptor %d/transport %s, T_UDERROR) failed: %m",
+				    fd, nconf->nc_proto);
+				return (error);
+			}
+			(void) syslog(LOG_ERR,
+"t_alloc(file descriptor %d/transport %s, T_UDERROR) failed TLI error: %d",
+			    fd, nconf->nc_proto, t_errno);
+			goto flush_it;
+		}
+	}
+
+	ret = t_rcvuderr(fd, uderr);
+	if (ret == 0) {
+
+		/*
+		 * Save the datagram error in errno, so that the
+		 * %m argument to syslog picks up the error string.
+		 */
+		errno = uderr->error;
+
+		/*
+		 * Log the datagram error, then log the host that
+		 * probably triggerred. Cannot log both in the
+		 * same transaction because of packet size limitations
+		 * in /dev/log.
+		 */
+		(void) syslog((errno == ECONNREFUSED) ? LOG_DEBUG : LOG_WARNING,
+"NFS response over <file descriptor %d/transport %s> generated error: %m",
+		    fd, nconf->nc_proto);
+
+		/*
+		 * Try to map the client's address back to a
+		 * name.
+		 */
+		ret = netdir_getbyaddr(nconf, &host, &uderr->addr);
+		if (ret != -1 && host && host->h_cnt > 0 &&
+		    host->h_hostservs) {
+		(void) syslog((errno == ECONNREFUSED) ? LOG_DEBUG : LOG_WARNING,
+"Bad NFS response was sent to client with host name: %s; service port: %s",
+		    host->h_hostservs->h_host,
+		    host->h_hostservs->h_serv);
+		} else {
+			int i, j;
+			char *buf;
+			char *hex = "0123456789abcdef";
+
+			/*
+			 * Mapping failed, print the whole thing
+			 * in ASCII hex.
+			 */
+			buf = (char *)malloc(uderr->addr.len * 2 + 1);
+			for (i = 0, j = 0; i < uderr->addr.len; i++, j += 2) {
+				buf[j] = hex[((uderr->addr.buf[i]) >> 4) & 0xf];
+				buf[j+1] = hex[uderr->addr.buf[i] & 0xf];
+			}
+			buf[j] = '\0';
+		(void) syslog((errno == ECONNREFUSED) ? LOG_DEBUG : LOG_WARNING,
+	"Bad NFS response was sent to client with transport address: 0x%s",
+		    buf);
+			free((void *)buf);
+		}
+
+		if (ret == 0 && host != NULL)
+			netdir_free((void *)host, ND_HOSTSERVLIST);
+		return (0);
+	}
+
+	switch (t_errno) {
+	case TNOUDERR:
+		goto flush_it;
+	case TSYSERR:
+		/*
+		 * System errors are returned to caller.
+		 * Save the error code across
+		 * syslog(), just in case
+		 * syslog() gets its own error
+		 * and therefore overwrites errno.
+		 */
+		error = errno;
+		(void) syslog(LOG_ERR,
+		    "t_rcvuderr(file descriptor %d/transport %s) %m",
+		    fd, nconf->nc_proto);
+		return (error);
+	default:
+		(void) syslog(LOG_ERR,
+		"t_rcvuderr(file descriptor %d/transport %s) TLI error %d",
+		    fd, nconf->nc_proto, t_errno);
+		goto flush_it;
+	}
+
+flush_it:
+	/*
+	 * If we get here, then we could not cope with whatever message
+	 * we attempted to read, so flush it. If we did read a message,
+	 * and one isn't present, that is all right, because fd is in
+	 * nonblocking mode.
+	 */
+	(void) syslog(LOG_ERR,
+	"Flushing one input message from <file descriptor %d/transport %s>",
+	    fd, nconf->nc_proto);
+
+	/*
+	 * Read and discard the message. Do this this until there is
+	 * no more control/data in the message or until we get an error.
+	 */
+	do {
+		ctl->maxlen = sizeof (ctlbuf);
+		ctl->buf = ctlbuf;
+		data->maxlen = sizeof (databuf);
+		data->buf = databuf;
+		flags = 0;
+		ret = getmsg(fd, ctl, data, &flags);
+		if (ret == -1)
+			return (errno);
+	} while (ret != 0);
+
+	return (0);
+}
+
+static void
+conn_close_oldest(void)
+{
+	int fd;
+	int i1;
+
+	/*
+	 * Find the oldest connection that is not already in the
+	 * process of shutting down.
+	 */
+	for (i1 = end_listen_fds; /* no conditional expression */; i1++) {
+		if (i1 >= num_fds)
+			return;
+		if (conn_polled[i1].closing == 0)
+			break;
+	}
+#ifdef DEBUG
+	printf("too many connections (%d), releasing oldest (%d)\n",
+	    num_conns, poll_array[i1].fd);
+#else
+	syslog(LOG_WARNING, "too many connections (%d), releasing oldest (%d)",
+	    num_conns, poll_array[i1].fd);
+#endif
+	fd = poll_array[i1].fd;
+	if (conn_polled[i1].nc.nc_semantics == NC_TPI_COTS) {
+		/*
+		 * For politeness, send a T_DISCON_REQ to the transport
+		 * provider.  We close the stream anyway.
+		 */
+		(void) t_snddis(fd, (struct t_call *)0);
+		num_conns--;
+		remove_from_poll_list(fd);
+		(void) t_close(fd);
+	} else {
+		/*
+		 * For orderly release, we do not close the stream
+		 * until the T_ORDREL_IND arrives to complete
+		 * the handshake.
+		 */
+		if (t_sndrel(fd) == 0)
+			conn_polled[i1].closing = 1;
+	}
+}
+
+static boolean_t
+conn_get(int fd, struct netconfig *nconf, struct conn_ind **connp)
+{
+	struct conn_ind	*conn;
+	struct conn_ind	*next_conn;
+
+	conn = (struct conn_ind *)malloc(sizeof (*conn));
+	if (conn == NULL) {
+		syslog(LOG_ERR, "malloc for listen indication failed");
+		return (FALSE);
+	}
+
+	/* LINTED pointer alignment */
+	conn->conn_call = (struct t_call *)t_alloc(fd, T_CALL, T_ALL);
+	if (conn->conn_call == NULL) {
+		free((char *)conn);
+		nfslib_log_tli_error("t_alloc", fd, nconf);
+		return (FALSE);
+	}
+
+	if (t_listen(fd, conn->conn_call) == -1) {
+		nfslib_log_tli_error("t_listen", fd, nconf);
+		(void) t_free((char *)conn->conn_call, T_CALL);
+		free((char *)conn);
+		return (FALSE);
+	}
+
+	if (conn->conn_call->udata.len > 0) {
+		syslog(LOG_WARNING,
+	"rejecting inbound connection(%s) with %d bytes of connect data",
+		    nconf->nc_proto, conn->conn_call->udata.len);
+
+		conn->conn_call->udata.len = 0;
+		(void) t_snddis(fd, conn->conn_call);
+		(void) t_free((char *)conn->conn_call, T_CALL);
+		free((char *)conn);
+		return (FALSE);
+	}
+
+	if ((next_conn = *connp) != NULL) {
+		next_conn->conn_prev->conn_next = conn;
+		conn->conn_next = next_conn;
+		conn->conn_prev = next_conn->conn_prev;
+		next_conn->conn_prev = conn;
+	} else {
+		conn->conn_next = conn;
+		conn->conn_prev = conn;
+		*connp = conn;
+	}
+	return (TRUE);
+}
+
+static int
+discon_get(int fd, struct netconfig *nconf, struct conn_ind **connp)
+{
+	struct conn_ind	*conn;
+	struct t_discon	discon;
+
+	discon.udata.buf = (char *)0;
+	discon.udata.maxlen = 0;
+	if (t_rcvdis(fd, &discon) == -1) {
+		nfslib_log_tli_error("t_rcvdis", fd, nconf);
+		return (-1);
+	}
+
+	conn = *connp;
+	if (conn == NULL)
+		return (0);
+
+	do {
+		if (conn->conn_call->sequence == discon.sequence) {
+			if (conn->conn_next == conn)
+				*connp = (struct conn_ind *)0;
+			else {
+				if (conn == *connp) {
+					*connp = conn->conn_next;
+				}
+				conn->conn_next->conn_prev = conn->conn_prev;
+				conn->conn_prev->conn_next = conn->conn_next;
+			}
+			free((char *)conn);
+			break;
+		}
+		conn = conn->conn_next;
+	} while (conn != *connp);
+
+	return (0);
+}
+
+static void
+cots_listen_event(int fd, int conn_index)
+{
+	struct t_call *call;
+	struct conn_ind	*conn;
+	struct conn_ind	*conn_head;
+	int event;
+	struct netconfig *nconf = &conn_polled[conn_index].nc;
+	int new_fd;
+	struct netbuf addrmask;
+	int ret = 0;
+	char *clnt;
+	char *clnt_uaddr = NULL;
+	struct nd_hostservlist *clnt_serv = NULL;
+
+	conn_head = NULL;
+	(void) conn_get(fd, nconf, &conn_head);
+
+	while ((conn = conn_head) != NULL) {
+		conn_head = conn->conn_next;
+		if (conn_head == conn)
+			conn_head = NULL;
+		else {
+			conn_head->conn_prev = conn->conn_prev;
+			conn->conn_prev->conn_next = conn_head;
+		}
+		call = conn->conn_call;
+		free(conn);
+
+		/*
+		 * If we have already accepted the maximum number of
+		 * connections allowed on the command line, then drop
+		 * the oldest connection (for any protocol) before
+		 * accepting the new connection.  Unless explicitly
+		 * set on the command line, max_conns_allowed is -1.
+		 */
+		if (max_conns_allowed != -1 && num_conns >= max_conns_allowed)
+			conn_close_oldest();
+
+		/*
+		 * Create a new transport endpoint for the same proto as
+		 * the listener.
+		 */
+		new_fd = nfslib_transport_open(nconf);
+		if (new_fd == -1) {
+			call->udata.len = 0;
+			(void) t_snddis(fd, call);
+			(void) t_free((char *)call, T_CALL);
+			syslog(LOG_ERR, "Cannot establish transport over %s",
+			    nconf->nc_device);
+			continue;
+		}
+
+		/* Bind to a generic address/port for the accepting stream. */
+		if (t_bind(new_fd, NULL, NULL) == -1) {
+			nfslib_log_tli_error("t_bind", new_fd, nconf);
+			call->udata.len = 0;
+			(void) t_snddis(fd, call);
+			(void) t_free((char *)call, T_CALL);
+			(void) t_close(new_fd);
+			continue;
+		}
+
+		while (t_accept(fd, new_fd, call) == -1) {
+			if (t_errno != TLOOK) {
+#ifdef DEBUG
+				nfslib_log_tli_error("t_accept", fd, nconf);
+#endif
+				call->udata.len = 0;
+				(void) t_snddis(fd, call);
+				(void) t_free((char *)call, T_CALL);
+				(void) t_close(new_fd);
+				goto do_next_conn;
+			}
+			while (event = t_look(fd)) {
+				switch (event) {
+				case T_LISTEN:
+#ifdef DEBUG
+					printf(
+"cots_listen_event(%s): T_LISTEN during accept processing\n", nconf->nc_proto);
+#endif
+					(void) conn_get(fd, nconf, &conn_head);
+					continue;
+				case T_DISCONNECT:
+#ifdef DEBUG
+					printf(
+	"cots_listen_event(%s): T_DISCONNECT during accept processing\n",
+					    nconf->nc_proto);
+#endif
+					(void) discon_get(fd, nconf,
+					    &conn_head);
+					continue;
+				default:
+					syslog(LOG_ERR,
+			"unexpected event 0x%x during accept processing (%s)",
+					    event, nconf->nc_proto);
+					call->udata.len = 0;
+					(void) t_snddis(fd, call);
+					(void) t_free((char *)call, T_CALL);
+					(void) t_close(new_fd);
+					goto do_next_conn;
+				}
+			}
+		}
+
+		if (set_addrmask(new_fd, nconf, &addrmask) < 0) {
+			(void) syslog(LOG_ERR,
+			    "Cannot set address mask for %s",
+			    nconf->nc_netid);
+			(void) t_snddis(new_fd, NULL);
+			(void) t_free((char *)call, T_CALL);
+			(void) t_close(new_fd);
+			continue;
+		}
+
+		/* Tell kRPC about the new stream. */
+		if (Mysvc4 != NULL)
+			ret = (*Mysvc4)(new_fd, &addrmask, nconf,
+			    NFS4_KRPC_START, &call->addr);
+		else
+			ret = (*Mysvc)(new_fd, addrmask, nconf);
+
+		if (ret < 0) {
+			if (errno != ENOTCONN) {
+				syslog(LOG_ERR,
+				    "unable to register new connection: %m");
+			} else {
+				/*
+				 * This is the only error that could be
+				 * caused by the client, so who was it?
+				 */
+				if (netdir_getbyaddr(nconf, &clnt_serv,
+				    &(call->addr)) == ND_OK &&
+				    clnt_serv->h_cnt > 0)
+					clnt = clnt_serv->h_hostservs->h_host;
+				else
+					clnt = clnt_uaddr = taddr2uaddr(nconf,
+					    &(call->addr));
+				/*
+				 * If we don't know who the client was,
+				 * remain silent.
+				 */
+				if (clnt)
+					syslog(LOG_ERR,
+"unable to register new connection: client %s has dropped connection", clnt);
+				if (clnt_serv) {
+					netdir_free(clnt_serv, ND_HOSTSERVLIST);
+					clnt_serv = NULL;
+				}
+				if (clnt_uaddr) {
+					free(clnt_uaddr);
+					clnt_uaddr = NULL;
+				}
+			}
+			free(addrmask.buf);
+			(void) t_snddis(new_fd, NULL);
+			(void) t_free((char *)call, T_CALL);
+			(void) t_close(new_fd);
+			goto do_next_conn;
+		}
+
+		free(addrmask.buf);
+		(void) t_free((char *)call, T_CALL);
+
+		/*
+		 * Poll on the new descriptor so that we get disconnect
+		 * and orderly release indications.
+		 */
+		num_conns++;
+		add_to_poll_list(new_fd, nconf);
+
+		/* Reset nconf in case it has been moved. */
+		nconf = &conn_polled[conn_index].nc;
+do_next_conn:;
+	}
+}
+
+static int
+do_poll_cots_action(int fd, int conn_index)
+{
+	char buf[256];
+	int event;
+	int i1;
+	int flags;
+	struct conn_entry *connent = &conn_polled[conn_index];
+	struct netconfig *nconf = &(connent->nc);
+	const char *errorstr;
+
+	while (event = t_look(fd)) {
+		switch (event) {
+		case T_LISTEN:
+#ifdef DEBUG
+printf("do_poll_cots_action(%s,%d): T_LISTEN event\n", nconf->nc_proto, fd);
+#endif
+			cots_listen_event(fd, conn_index);
+			break;
+
+		case T_DATA:
+#ifdef DEBUG
+printf("do_poll_cots_action(%d,%s): T_DATA event\n", fd, nconf->nc_proto);
+#endif
+			/*
+			 * Receive a private notification from CONS rpcmod.
+			 */
+			i1 = t_rcv(fd, buf, sizeof (buf), &flags);
+			if (i1 == -1) {
+				syslog(LOG_ERR, "t_rcv failed");
+				break;
+			}
+			if (i1 < sizeof (int))
+				break;
+			i1 = BE32_TO_U32(buf);
+			if (i1 == 1 || i1 == 2) {
+				/*
+				 * This connection has been idle for too long,
+				 * so release it as politely as we can.  If we
+				 * have already initiated an orderly release
+				 * and we get notified that the stream is
+				 * still idle, pull the plug.  This prevents
+				 * hung connections from continuing to consume
+				 * resources.
+				 */
+#ifdef DEBUG
+printf("do_poll_cots_action(%s,%d): ", nconf->nc_proto, fd);
+printf("initiating orderly release of idle connection\n");
+#endif
+				if (nconf->nc_semantics == NC_TPI_COTS ||
+				    connent->closing != 0) {
+					(void) t_snddis(fd, (struct t_call *)0);
+					goto fdclose;
+				}
+				/*
+				 * For NC_TPI_COTS_ORD, the stream is closed
+				 * and removed from the poll list when the
+				 * T_ORDREL is received from the provider.  We
+				 * don't wait for it here because it may take
+				 * a while for the transport to shut down.
+				 */
+				if (t_sndrel(fd) == -1) {
+					syslog(LOG_ERR,
+					"unable to send orderly release %m");
+				}
+				connent->closing = 1;
+			} else
+				syslog(LOG_ERR,
+				"unexpected event from CONS rpcmod %d", i1);
+			break;
+
+		case T_ORDREL:
+#ifdef DEBUG
+printf("do_poll_cots_action(%s,%d): T_ORDREL event\n", nconf->nc_proto, fd);
+#endif
+			/* Perform an orderly release. */
+			if (t_rcvrel(fd) == 0) {
+				/* T_ORDREL on listen fd's should be ignored */
+				if (!is_listen_fd_index(conn_index)) {
+					(void) t_sndrel(fd);
+					goto fdclose;
+				}
+				break;
+
+			} else if (t_errno == TLOOK) {
+				break;
+			} else {
+				nfslib_log_tli_error("t_rcvrel", fd, nconf);
+
+				/*
+				 * check to make sure we do not close
+				 * listen fd
+				 */
+				if (is_listen_fd_index(conn_index))
+					break;
+				else
+					goto fdclose;
+			}
+
+		case T_DISCONNECT:
+#ifdef DEBUG
+printf("do_poll_cots_action(%s,%d): T_DISCONNECT event\n", nconf->nc_proto, fd);
+#endif
+			if (t_rcvdis(fd, (struct t_discon *)NULL) == -1)
+				nfslib_log_tli_error("t_rcvdis", fd, nconf);
+
+			/*
+			 * T_DISCONNECT on listen fd's should be ignored.
+			 */
+			if (is_listen_fd_index(conn_index))
+				break;
+			else
+				goto fdclose;
+
+		default:
+			if (t_errno == TSYSERR) {
+				if ((errorstr = strerror(errno)) == NULL) {
+					(void) sprintf(buf,
+					    "Unknown error num %d", errno);
+					errorstr = (const char *) buf;
+				}
+			} else if (event == -1)
+				errorstr = t_strerror(t_errno);
+			else
+				errorstr = "";
+			syslog(LOG_ERR,
+			    "unexpected TLI event (0x%x) on "
+			    "connection-oriented transport(%s,%d):%s",
+			    event, nconf->nc_proto, fd, errorstr);
+fdclose:
+			num_conns--;
+			remove_from_poll_list(fd);
+			(void) t_close(fd);
+			return (0);
+		}
+	}
+
+	return (0);
+}
+
+static char *
+serv_name_to_port_name(char *name)
+{
+	/*
+	 * Map service names (used primarily in logging) to
+	 * RPC port names (used by netdir_*() routines).
+	 */
+	if (strcmp(name, "NFS") == 0) {
+		return ("nfs");
+	} else if (strcmp(name, "NLM") == 0) {
+		return ("lockd");
+	} else if (strcmp(name, "NFS4_CALLBACK") == 0) {
+		return ("nfs4_callback");
+	}
+
+	return ("unrecognized");
+}
+
+int
+nlm_bind_to_provider(char *provider, struct netbuf **addr,
+    struct netconfig **retnconf)
+{
+	int i, res;
+	struct netconfig *nconf = NULL, *np;
+
+	for (i = 0; i < N_NETCONF_ENTS; i++) {
+		np = &nca[i];
+
+		if (strcmp(np->nc_device, provider) != 0)
+			continue;
+
+		/* Construct our own netconfig */
+		if ((nconf = calloc(1, sizeof (struct netconfig))) == NULL)
+			goto out;
+
+		nconf->nc_semantics = np->nc_semantics;
+		if ((nconf->nc_netid = strdup(np->nc_netid)) == NULL)
+			goto out;
+		if ((nconf->nc_protofmly = strdup(np->nc_protofmly)) == NULL)
+			goto out;
+		if ((nconf->nc_proto = strdup(np->nc_proto)) == NULL)
+			goto out;
+		if ((nconf->nc_device = strdup(np->nc_device)) == NULL)
+			goto out;
+
+		*retnconf = nconf;
+
+		/*
+		 * Passing addr == NULL implies we skip the bind since we only
+		 * need the netconfig for unregistering from rpcbind.
+		 */
+		if (addr == NULL)
+			return (0);
+		if ((res = nlm_bindit(nconf, addr, listen_backlog)) == -1)
+			freenetconfigent(nconf);
+		return (res);
+	}
+
+out:
+	if (nconf != NULL)
+		freenetconfigent(nconf);
+	syslog(LOG_ERR, "couldn't find netconfig entry for provider %s",
+	    provider);
+	return (-1);
+}
+
+static int
+bind_to_proto(NETSELDECL(proto), char *serv, struct netbuf **addr,
+    struct netconfig **retnconf)
+{
+	struct netconfig *nconf;
+	NCONF_HANDLE *nc = NULL;
+	struct nd_hostserv hs;
+
+	hs.h_host = HOST_SELF;
+	hs.h_serv = serv_name_to_port_name(serv);
+
+	if ((nc = setnetconfig()) == (NCONF_HANDLE *)NULL) {
+		syslog(LOG_ERR, "setnetconfig failed: %m");
+		return (-1);
+	}
+	while (nconf = getnetconfig(nc)) {
+		if (OK_TPI_TYPE(nconf) && NETSELEQ(nconf->nc_proto, proto)) {
+			*retnconf = nconf;
+			return (nfslib_bindit(nconf, addr, &hs,
+			    listen_backlog));
+		}
+	}
+	(void) endnetconfig(nc);
+
+	syslog(LOG_ERR, "couldn't find netconfig entry for protocol %s",
+	    proto);
+	return (-1);
+}
+
+#include <netinet/in.h>
+
+/*
+ * Create an address mask appropriate for the transport.
+ * The mask is used to obtain the host-specific part of
+ * a network address when comparing addresses.
+ * For an internet address the host-specific part is just
+ * the 32 bit IP address and this part of the mask is set
+ * to all-ones. The port number part of the mask is zeroes.
+ */
+static int
+set_addrmask(int fd, struct netconfig *nconf, struct netbuf *mask)
+{
+	struct t_info info;
+
+	/*
+	 * Find the size of the address we need to mask.
+	 */
+	if (t_getinfo(fd, &info) < 0) {
+		t_error("t_getinfo");
+		return (-1);
+	}
+	mask->len = mask->maxlen = info.addr;
+	if (info.addr <= 0) {
+		/*
+		 * loopback devices have infinite addr size
+		 * (it is identified by -1 in addr field of t_info structure),
+		 * so don't build the netmask for them. It's a special case
+		 * that should be handled properly.
+		 */
+		if ((info.addr == -1) &&
+		    (0 == strcmp(nconf->nc_protofmly, NC_LOOPBACK))) {
+			memset(mask, 0, sizeof (*mask));
+			return (0);
+		}
+
+		syslog(LOG_ERR, "set_addrmask: address size: %ld", info.addr);
+		return (-1);
+	}
+
+	mask->buf = (char *)malloc(mask->len);
+	if (mask->buf == NULL) {
+		syslog(LOG_ERR, "set_addrmask: no memory");
+		return (-1);
+	}
+	(void) memset(mask->buf, 0, mask->len);	/* reset all mask bits */
+
+	if (strcmp(nconf->nc_protofmly, NC_INET) == 0) {
+		/*
+		 * Set the mask so that the port is ignored.
+		 */
+		/* LINTED pointer alignment */
+		((struct sockaddr_in *)mask->buf)->sin_addr.s_addr =
+		    (ulong_t)~0;
+		/* LINTED pointer alignment */
+		((struct sockaddr_in *)mask->buf)->sin_family =
+		    (ushort_t)~0;
+	} else if (strcmp(nconf->nc_protofmly, NC_INET6) == 0) {
+		/* LINTED pointer alignment */
+		(void) memset(&((struct sockaddr_in6 *)mask->buf)->sin6_addr,
+		    (uchar_t)~0, sizeof (struct in6_addr));
+		/* LINTED pointer alignment */
+		((struct sockaddr_in6 *)mask->buf)->sin6_family =
+		    (ushort_t)~0;
+	} else {
+
+		/*
+		 * Set all mask bits.
+		 */
+		(void) memset(mask->buf, 0xFF, mask->len);
+	}
+	return (0);
+}
+
+/*
+ * For listen fd's index is always less than end_listen_fds.
+ * end_listen_fds is defined externally in the daemon that uses this library.
+ * It's value is equal to the number of open file descriptors after the
+ * last listen end point was opened but before any connection was accepted.
+ */
+static int
+is_listen_fd_index(int index)
+{
+	return (index < end_listen_fds);
+}
diff --git a/usr/src/cmd/ssh/etc/Makefile b/usr/src/lib/brand/lx/lx_support/Makefile
index 1525d642b0..e7c958e13a 100644
--- a/usr/src/cmd/ssh/etc/Makefile
+++ b/usr/src/lib/brand/lx/lx_support/Makefile
@@ -18,38 +18,37 @@
 #
 # CDDL HEADER END
 #
+#
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 
-MANIFEST = ssh.xml
-SVCMETHOD = sshd
-
-include ../../Makefile.cmd
-
-ETCSSHDIR=	$(ROOTETC)/ssh
-DIRS=		$(ETCSSHDIR)
-
-FILES= sshd_config ssh_config
+PROG =		lx_support
+PROGS =		$(PROG)
+OBJS =		lx_support
 
-ETCSSHFILES=	$(FILES:%=$(ETCSSHDIR)/%)
+all:		$(PROG)
 
-$(ETCSSHFILES) := FILEMODE=	644
+include ../Makefile.lx
+include $(SRC)/cmd/Makefile.cmd
 
-ROOTMANIFESTDIR = $(ROOTSVCNETWORK)
+# override the install directory
+ROOTBIN =	$(ROOTBRANDDIR)
+CLOBBERFILES =	$(OBJS) $(ROOTPROGS)
 
-$(ETCSSHDIR)/% : %
-	$(INS.file)
+UTSBASE =	$(SRC)/uts
 
-$(DIRS):
-	$(INS.dir)
+CFLAGS +=	$(CCVERBOSE)
+CPPFLAGS +=	-D_REENTRANT -I$(UTSBASE)/common/brand/lx
+LDLIBS +=	-lzonecfg
 
-$(POFILE):
+.KEEP_STATE:
 
-all lint clean clobber _msg:
+install:	all $(ROOTPROGS)
 
-install: all $(DIRS) $(ETCSSHFILES) $(ROOTMANIFEST) $(ROOTSVCMETHOD)
+clean:
+		$(RM) $(PROG) $(OBJS)
 
-check: $(CHKMANIFEST)
+lint:		lint_PROG
 
-include ../../Makefile.targ
+include $(SRC)/cmd/Makefile.targ
diff --git a/usr/src/lib/brand/lx/lx_support/lx_support.c b/usr/src/lib/brand/lx/lx_support/lx_support.c
new file mode 100644
index 0000000000..d35c68ed8d
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_support/lx_support.c
@@ -0,0 +1,392 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * lx_support is a small cli utility used to perform some brand-specific
+ * tasks when booting, halting, or verifying a zone.  This utility is not
+ * intended to be called by users - it is intended to be invoked by the
+ * zones utilities.
+ */
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <stropts.h>
+#include <sys/ioccom.h>
+#include <sys/stat.h>
+#include <sys/systeminfo.h>
+#include <sys/types.h>
+#include <sys/varargs.h>
+#include <unistd.h>
+#include <libintl.h>
+#include <locale.h>
+
+#include <libzonecfg.h>
+#include <sys/lx_brand.h>
+
+static void lxs_err(char *msg, ...) __NORETURN;
+static void usage(void) __NORETURN;
+
+#define	CP_CMD		"/usr/bin/cp"
+#define	MOUNT_CMD	"/sbin/mount"
+
+static char *bname = NULL;
+static char *zonename = NULL;
+static char *zoneroot = NULL;
+
+#if !defined(TEXT_DOMAIN)		/* should be defined by cc -D */
+#define	TEXT_DOMAIN	"SYS_TEST"	/* Use this only if it wasn't */
+#endif
+
+static void
+lxs_err(char *msg, ...)
+{
+	char	buf[1024];
+	va_list	ap;
+
+	va_start(ap, msg);
+	/*LINTED*/
+	(void) vsnprintf(buf, sizeof (buf), msg, ap);
+	va_end(ap);
+
+	(void) printf("%s error: %s\n", bname, buf);
+
+	exit(1);
+	/*NOTREACHED*/
+}
+
+/*
+ * Cleanup from earlier versions of the code which created a /dev/initctl FIFO.
+ */
+static void
+lxs_remove_initctl()
+{
+	char		special[MAXPATHLEN];
+
+	if (snprintf(special, sizeof (special), "%s/dev/initctl", zoneroot) >=
+	    sizeof (special))
+		lxs_err("%s: %s", gettext("Failed to cleanup /dev/initctl"),
+		    gettext("zoneroot is too long"));
+
+	(void) unlink(special);
+}
+
+/*
+ * fsck gets really confused when run inside a zone.  Removing this file
+ * prevents it from running
+ */
+static void
+lxs_remove_autofsck()
+{
+	char	path[MAXPATHLEN];
+	int	err;
+
+	if (snprintf(path, MAXPATHLEN, "%s/root/.autofsck", zoneroot) >=
+	    MAXPATHLEN)
+		lxs_err("%s: %s", gettext("Failed to remove /.autofsck"),
+		    gettext("zoneroot is too long"));
+
+	if (unlink(path) < 0) {
+		err = errno;
+		if (err != ENOENT)
+			lxs_err("%s: %s",
+			    gettext("Failed to remove /.autofsck"),
+			    strerror(err));
+	}
+}
+
+/*
+ * Extract any lx-supported attributes from the zone configuration file.
+ */
+static void
+lxs_getattrs(zone_dochandle_t zdh, char **krelease)
+{
+	struct zone_attrtab	attrtab;
+	int			err;
+
+	/* initialize the attribute iterator */
+	if (zonecfg_setattrent(zdh) != Z_OK) {
+		zonecfg_fini_handle(zdh);
+		lxs_err(gettext("error accessing zone configuration"));
+	}
+
+	*krelease = (char *)malloc(LX_KERN_RELEASE_MAX);
+	if (*krelease == NULL)
+		lxs_err(gettext("out of memory"));
+
+	bzero(*krelease, LX_KERN_RELEASE_MAX);
+	while ((err = zonecfg_getattrent(zdh, &attrtab)) == Z_OK) {
+		if ((strcmp(attrtab.zone_attr_name, "kernel-version") == 0) &&
+		    (zonecfg_get_attr_string(&attrtab, *krelease,
+		    LX_KERN_RELEASE_MAX) != Z_OK))
+			lxs_err(gettext("invalid type for zone attribute: %s"),
+			    attrtab.zone_attr_name);
+	}
+
+	if (strlen(*krelease) == 0) {
+		free(*krelease);
+		*krelease = NULL;
+	}
+
+	/* some kind of error while looking up attributes */
+	if (err != Z_NO_ENTRY)
+		lxs_err(gettext("error accessing zone configuration"));
+}
+
+/*
+ * Attempt to lookup the "tty" gid from within the zone's /etc/group file.
+ * The gid is used to emulate existing Linux udev behavior for setting the gid
+ * on a pty. If we cannot lookup the gid for some reason, we still allow
+ * the zone to boot.
+ *
+ * Because we're reading the lx zone's /etc/group file, we have to parse it
+ * ourselves, but this is simple since we only need the gid.
+ */
+static void
+lxs_set_ttygid(zoneid_t zoneid)
+{
+	char	buf[MAXPATHLEN];
+	FILE	*fp;
+	gid_t	tty_gid = 0;
+
+	if (snprintf(buf, sizeof (buf), "%s/root/etc/group", zoneroot) >=
+	    sizeof (buf))
+		return;
+
+	if ((fp = fopen(buf, "r")) == NULL)
+		return;
+
+	/*
+	 * Look for the "tty" line and get the gid. Note that this loop will
+	 * properly handle a long line that won't fit into buf on a single
+	 * fgets. The subsequent fgets will consume more of the line but we
+	 * continue on through that. In practice this is unlikely to occur.
+	 */
+	while (fgets(buf, sizeof (buf), fp) != NULL) {
+		char *p, *p_id;
+		long val;
+
+		/* group name */
+		if ((p = strchr(buf, ':')) == NULL)
+			continue;
+		*p = '\0';
+		if (strcmp(buf, "tty") != 0)
+			continue;
+
+		/* found tty entry, skip the "x" field */
+		if ((p = strchr(p + 1, ':')) == NULL)
+			goto done;
+		/* gid field */
+		p_id = p + 1;
+		if ((p = strchr(p_id, ':')) == NULL)
+			goto done;
+		*p = '\0';
+
+		errno = 0;
+		val = strtol(p_id, &p, 10);
+		/* Perform simple validation on the gid */
+		if (errno != 0 || *p != '\0' || val > MAXUID || val < 0)
+			goto done;
+		tty_gid = (gid_t)val;
+		break;
+	}
+
+	if (tty_gid != 0)
+		(void) zone_setattr(zoneid, LX_ATTR_TTY_GID, &tty_gid,
+		    sizeof (tty_gid));
+
+done:
+	(void) fclose(fp);
+}
+
+static int
+lxs_boot()
+{
+	zoneid_t	zoneid;
+	zone_dochandle_t zdh;
+	char		*krelease;
+
+	lxs_remove_initctl();
+	lxs_remove_autofsck();
+
+	if ((zdh = zonecfg_init_handle()) == NULL)
+		lxs_err(gettext("unable to initialize zone handle"));
+
+	if (zonecfg_get_handle((char *)zonename, zdh) != Z_OK) {
+		zonecfg_fini_handle(zdh);
+		lxs_err(gettext("unable to load zone configuration"));
+	}
+
+	/* Extract any relevant attributes from the config file. */
+	lxs_getattrs(zdh, &krelease);
+	zonecfg_fini_handle(zdh);
+
+	/*
+	 * Let the kernel know whether or not this zone's init process
+	 * should be automatically restarted on its death.
+	 */
+	if ((zoneid = getzoneidbyname(zonename)) < 0)
+		lxs_err(gettext("unable to get zoneid"));
+
+	if (krelease != NULL) {
+		/* Backward compatability with incomplete version attr */
+		if (strcmp(krelease, "2.4") == 0) {
+			krelease = "2.4.21";
+		} else if (strcmp(krelease, "2.6") == 0) {
+			krelease = "2.6.18";
+		}
+
+		if (zone_setattr(zoneid, LX_ATTR_KERN_RELEASE, krelease,
+		    strlen(krelease)) < 0)
+			lxs_err(gettext("unable to set kernel version"));
+	}
+
+	lxs_set_ttygid(zoneid);
+
+	return (0);
+}
+
+static int
+lxs_halt()
+{
+	return (0);
+}
+
+static int
+lxs_verify(char *xmlfile)
+{
+	zone_dochandle_t	handle;
+	char			*krelease;
+	char			hostidp[HW_HOSTID_LEN];
+	zone_iptype_t		iptype;
+
+	if ((handle = zonecfg_init_handle()) == NULL)
+		lxs_err(gettext("internal libzonecfg.so.1 error"), 0);
+
+	if (zonecfg_get_xml_handle(xmlfile, handle) != Z_OK) {
+		zonecfg_fini_handle(handle);
+		lxs_err(gettext("zonecfg provided an invalid XML file"));
+	}
+
+	/*
+	 * Check to see whether the zone has hostid emulation enabled.
+	 */
+	if (zonecfg_get_hostid(handle, hostidp, sizeof (hostidp)) == Z_OK) {
+		zonecfg_fini_handle(handle);
+		lxs_err(gettext("lx zones do not support hostid emulation"));
+	}
+
+	/*
+	 * Only exclusive stack is supported.
+	 */
+	if (zonecfg_get_iptype(handle, &iptype) != Z_OK ||
+	    iptype != ZS_EXCLUSIVE) {
+		zonecfg_fini_handle(handle);
+		lxs_err(gettext("lx zones do not support shared IP stacks"));
+	}
+
+	/* Extract any relevant attributes from the config file. */
+	lxs_getattrs(handle, &krelease);
+	zonecfg_fini_handle(handle);
+
+	if (krelease) {
+		char *pdot, *ep;
+		long major_ver;
+
+		pdot = strchr(krelease, '.');
+		if (pdot != NULL)
+			*pdot = '\0';
+		errno = 0;
+		major_ver = strtol(krelease, &ep, 10);
+		if (major_ver < 2 || errno != 0 || *ep != '\0')
+			lxs_err(gettext("invalid value for zone attribute: %s"),
+			    "kernel-version");
+		if (pdot != NULL)
+			*pdot = '.';
+
+	}
+	return (0);
+}
+
+static void
+usage()
+{
+
+	(void) fprintf(stderr,
+	    gettext("usage:\t%s boot <zoneroot> <zonename>\n"), bname);
+	(void) fprintf(stderr,
+	    gettext("      \t%s halt <zoneroot> <zonename>\n"), bname);
+	(void) fprintf(stderr,
+	    gettext("      \t%s verify <xml file>\n\n"), bname);
+	exit(1);
+}
+
+int
+main(int argc, char *argv[])
+{
+	(void) setlocale(LC_ALL, "");
+	(void) textdomain(TEXT_DOMAIN);
+
+	bname = basename(argv[0]);
+
+	if (argc < 3)
+		usage();
+
+	if (strcmp(argv[1], "boot") == 0) {
+		if (argc != 4)
+			lxs_err(gettext("usage: %s %s <zoneroot> <zonename>"),
+			    bname, argv[1]);
+		zoneroot = argv[2];
+		zonename = argv[3];
+		return (lxs_boot());
+	}
+
+	if (strcmp(argv[1], "halt") == 0) {
+		if (argc != 4)
+			lxs_err(gettext("usage: %s %s <zoneroot> <zonename>"),
+			    bname, argv[1]);
+		zoneroot = argv[2];
+		zonename = argv[3];
+		return (lxs_halt());
+	}
+
+	if (strcmp(argv[1], "verify") == 0) {
+		if (argc != 3)
+			lxs_err(gettext("usage: %s verify <xml file>"),
+			    bname);
+		return (lxs_verify(argv[2]));
+	}
+
+	usage();
+	/*NOTREACHED*/
+}
diff --git a/usr/src/lib/brand/lx/lx_vdso/Makefile b/usr/src/lib/brand/lx/lx_vdso/Makefile
new file mode 100644
index 0000000000..56dd0a7a3c
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/Makefile
@@ -0,0 +1,39 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+include ../../../Makefile.lib
+
+SUBDIRS = tools $(MACH)
+$(BUILD64)SUBDIRS += $(MACH64)
+
+all :=          TARGET= all
+clean :=        TARGET= clean
+clobber :=      TARGET= clobber
+install :=      TARGET= install
+lint :=         TARGET= lint
+
+.KEEP_STATE:
+
+all install clean clobber: $(SUBDIRS)
+
+lint: $(LINT_SUBDIRS)
+
+$(MACH): tools
+$(MACH64): tools
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/lib/brand/lx/lx_vdso/Makefile.com b/usr/src/lib/brand/lx/lx_vdso/Makefile.com
new file mode 100644
index 0000000000..b6d46d38cd
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/Makefile.com
@@ -0,0 +1,85 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+LIBRARY	=	lx_vdso.a
+VERS =		.1
+
+include $(SRC)/lib/commpage/Makefile.shared.com
+
+COBJS =		vdso_main.o vdso_subr.o
+OBJECTS =	$(COBJS) $(COMMPAGE_OBJS)
+
+include ../../../../Makefile.lib
+include ../../Makefile.lx
+
+#
+# Since our name doesn't start with "lib", Makefile.lib incorrectly
+# calculates LIBNAME. Therefore, we set it here.
+#
+LIBNAME =	lx_vdso
+
+MAPFILES =	../common/mapfile-vers
+MAPOPTS =	$(MAPFILES:%=-M%)
+
+ASOBJS  =	vdso_subr.o
+COBJS  =	vdso_main.o
+OBJECTS =	$(ASOBJS) $(COBJS) $(COMMPAGE_OBJS)
+
+SRCDIR =	../common
+
+ASSRCS =	$(ASOBJS:%.o=$(ISASRCDIR)/%.s)
+CSRCS =		$(COBJS:%.o=$(SRCDIR)/%.c)
+SRCS =		$(ASSRCS) $(CSRCS)
+
+LIBS =		$(DYNLIB)
+DYNFLAGS +=	$(DYNFLAGS_$(CLASS))
+DYNFLAGS +=	$(MAPOPTS)
+LDLIBS +=
+ASFLAGS =	-P $(ASFLAGS_$(CURTYPE)) -D_ASM
+
+
+LIBS =		$(DYNLIB)
+
+CLEANFILES +=	$(DYNLIB)
+ROOTLIBDIR =	$(ROOT)/usr/lib/brand/lx
+ROOTLIBDIR64 =	$(ROOT)/usr/lib/brand/lx/$(MACH64)
+
+VDSO_TOOL =	../tools/vdso_tool
+
+.KEEP_STATE:
+
+#
+# While $(VDSO_TOOL) performs most of the transformations required to
+# construct a correct VDSO object, we still make use of $(ELFEDIT).  To
+# remove the $(ELFEDIT) requirement would mean shouldering the burden of
+# becoming a link-editor; this dark lore is best left to the linker aliens.
+#
+all: $(LIBS)
+	$(ELFEDIT) -e "dyn:value -add VERSYM $$($(ELFEDIT) \
+	    -e 'shdr:dump .SUNW_versym' $(DYNLIB) | \
+	    $(AWK) '{ if ($$1 == "sh_addr:") { print $$2 } }')" $(DYNLIB)
+	$(VDSO_TOOL) -f $(DYNLIB)
+
+lint: $(LINTLIB) lintcheck
+
+include ../../../../Makefile.targ
+include $(SRC)/lib/commpage/Makefile.shared.targ
+
+pics/%.o: $(ISASRCDIR)/%.s
+	$(COMPILE.s) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/vdso_main.o := CPPFLAGS += $(COMMPAGE_CPPFLAGS) -I$(SRCDIR)
+pics/vdso_subr.o := ASFLAGS += -I$(SRC)/uts/common/brand/lx -I$(SRCDIR)
diff --git a/usr/src/lib/brand/lx/lx_vdso/amd64/Makefile b/usr/src/lib/brand/lx/lx_vdso/amd64/Makefile
new file mode 100644
index 0000000000..1a12492a97
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/amd64/Makefile
@@ -0,0 +1,42 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+ISASRCDIR=.
+TARGET_ARCH=$(MACH64)
+
+include ../Makefile.com
+include $(SRC)/lib/Makefile.lib.64
+
+ASFLAGS += -D__$(MACH64)
+
+SONAME = linux-vdso.so.1
+
+# Disable save-args since some vDSO consumers are sensitive to stack usage.
+SAVEARGS =
+
+#
+# You might ask, why aren't we overriding BUILD.SO in Makefile.com.
+# That's a sad story. The answer is that Makefile.lib.64 includes
+# Makefile.master.64 which redefines BUILD.SO, leaving us in an
+# unfortunate jumble. Therefore we have to redefine it in the
+# lower-level Makefile.
+#
+BUILD.SO =	$(LD) -o $@ $(GSHARED) $(DYNFLAGS) $(PICS) $(LDLIBS)
+
+ASSYMDEP_OBJS = lx_vdso.o
+
+CLOBBERFILES	= $(ROOTLIBDIR64)/$(DYNLIB) $(ROOTLIBDIR64)/$(LINTLIB)
+
+install: all $(ROOTLIBS64)
diff --git a/usr/src/lib/brand/lx/lx_vdso/amd64/vdso_subr.s b/usr/src/lib/brand/lx/lx_vdso/amd64/vdso_subr.s
new file mode 100644
index 0000000000..592884aa32
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/amd64/vdso_subr.s
@@ -0,0 +1,131 @@
+/*
+ *
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+
+#include <sys/asm_linkage.h>
+#include <sys/lx_syscalls.h>
+#include <vdso_defs.h>
+
+#if defined(lint)
+
+comm_page_t *
+__vdso_find_commpage()
+{}
+
+long
+__vdso_sys_clock_gettime(uint_t clock_id, timespec_t *tp)
+{}
+
+int
+__vdso_sys_gettimeofday(timespec_t *tp, struct lx_timezone *tz)
+{}
+
+time_t
+__vdso_sys_time(timespec_t *tp)
+{}
+
+#else /* lint */
+
+	ENTRY_NP(__vdso_find_commpage)
+	leaq	0x0(%rip), %rax
+	andq	$LX_VDSO_ADDR_MASK, %rax
+	addq	$LX_VDSO_SIZE, %rax
+	ret
+	SET_SIZE(__vdso_find_commpage)
+
+	ENTRY_NP(__vdso_sys_clock_gettime)
+	movl	$LX_SYS_clock_gettime, %eax
+	syscall
+	ret
+	SET_SIZE(__vdso_sys_clock_gettime)
+
+	ENTRY_NP(__vdso_sys_gettimeofday)
+	movl	$LX_SYS_gettimeofday, %eax
+	syscall
+	ret
+	SET_SIZE(__vdso_sys_gettimeofday)
+
+	ENTRY_NP(__vdso_sys_time)
+	movl	$LX_SYS_time, %eax
+	syscall
+	ret
+	SET_SIZE(__vdso_sys_time)
+
+/*
+ * long
+ * __vdso_clock_gettime(uint_t, timespec_t *)
+ */
+	ENTRY_NP(__vdso_clock_gettime)
+	subq	$0x18, %rsp
+	movl	%edi, (%rsp)
+	movq	%rsi, 0x8(%rsp)
+
+	call	__vdso_find_commpage
+	movq	%rax, 0x10(%rsp)
+
+	movq	%rax, %rdi
+	call	__cp_can_gettime
+	cmpl	$0, %eax
+	je	5f
+
+	/*
+	 * Restore the original args/stack (with commpage pointer in rdx)
+	 * This enables the coming tail-call to the desired function, be it
+	 * __cp_clock_gettime_* or __vdso_sys_clock_gettime.
+	 */
+	movl	(%rsp), %edi
+	movq	0x8(%rsp), %rsi
+	movq	0x10(%rsp), %rdx
+	addq	$0x18, %rsp
+
+	cmpl	$LX_CLOCK_REALTIME, %edi
+	jne	2f
+1:
+	movq	%rdx, %rdi
+	jmp	__cp_clock_gettime_realtime
+
+2:
+	cmpl	$LX_CLOCK_MONOTONIC, %edi
+	jne	4f
+3:
+	movq	%rdx, %rdi
+	jmp	__cp_clock_gettime_monotonic
+
+4:
+	cmpl	$LX_CLOCK_REALTIME_COARSE, %edi
+	je	1b
+	cmpl	$LX_CLOCK_MONOTONIC_RAW, %edi
+	je	3b
+	cmpl	$LX_CLOCK_MONOTONIC_COARSE, %edi
+	je	3b
+	jmp	6f
+
+5:
+	/*
+	 * When falling through from a failed cp_can_gettime, the stack
+	 * allocation must be released before a tail-call is made to the
+	 * fallback syscall function.
+	 */
+	addq	$0x18, %rsp
+
+6:
+	/* Let the real syscall handle all other cases */
+	jmp	__vdso_sys_clock_gettime
+	SET_SIZE(__vdso_clock_gettime)
+
+
+#endif /* lint */
diff --git a/usr/src/lib/brand/lx/lx_vdso/common/mapfile-vers b/usr/src/lib/brand/lx/lx_vdso/common/mapfile-vers
new file mode 100644
index 0000000000..11690ce7d6
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/common/mapfile-vers
@@ -0,0 +1,59 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION LINUX_2.6 {
+    global:
+	__vdso_gettimeofday;
+	__vdso_clock_gettime;
+	__vdso_getcpu;
+	__vdso_time;
+    local:
+        *;
+};
+
+#
+# The vDSO module in GNU/Linux must only have a single PT_LOAD section.
+# Further, we should not have any data sections at all. Therefore, we go
+# through and explicitly disable several of the writeable sections that
+# might commonly show up.
+#
+LOAD_SEGMENT data {
+        disable;
+};
+
+LOAD_SEGMENT ldata {
+        disable;
+};
+
+LOAD_SEGMENT bss {
+        disable;
+};
+
diff --git a/usr/src/lib/brand/lx/lx_vdso/common/vdso_defs.h b/usr/src/lib/brand/lx/lx_vdso/common/vdso_defs.h
new file mode 100644
index 0000000000..dfac918a53
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/common/vdso_defs.h
@@ -0,0 +1,42 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_VDSO_DEFS_H_
+#define	_VDSO_DEFS_H_
+
+#define	LX_CLOCK_REALTIME		0	/* CLOCK_REALTIME	*/
+#define	LX_CLOCK_MONOTONIC		1	/* CLOCK_HIGHRES	*/
+#define	LX_CLOCK_PROCESS_CPUTIME_ID	2	/* Emulated		*/
+#define	LX_CLOCK_THREAD_CPUTIME_ID	3	/* Emulated		*/
+#define	LX_CLOCK_MONOTONIC_RAW		4	/* CLOCK_HIGHRES	*/
+#define	LX_CLOCK_REALTIME_COARSE	5	/* CLOCK_REALTIME	*/
+#define	LX_CLOCK_MONOTONIC_COARSE	6	/* CLOCK_HIGHRES	*/
+
+#if !defined(_ASM)
+
+struct lx_timezone {
+	int tz_minuteswest;	/* minutes W of Greenwich */
+	int tz_dsttime;		/* type of dst correction */
+};
+
+/* Functions provided by the mach-specific vdso_subr.s */
+extern comm_page_t *__vdso_find_commpage();
+extern int __vdso_sys_gettimeofday(timespec_t *, struct lx_timezone *);
+extern time_t __vdso_sys_time(time_t *);
+extern long __vdso_sys_clock_gettime(uint_t, timespec_t *);
+
+#endif /* !defined(_ASM) */
+
+#endif /* _VDSO_DEFS_H_ */
diff --git a/usr/src/lib/brand/lx/lx_vdso/common/vdso_main.c b/usr/src/lib/brand/lx/lx_vdso/common/vdso_main.c
new file mode 100644
index 0000000000..f7d86e3da4
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/common/vdso_main.c
@@ -0,0 +1,139 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <cp_defs.h>
+#include <vdso_defs.h>
+
+
+#if defined(__i386)
+
+long
+__vdso_clock_gettime(uint_t clock_id, timespec_t *tp)
+{
+	comm_page_t *cp = __vdso_find_commpage();
+
+	if (__cp_can_gettime(cp) == 0) {
+		return (__vdso_sys_clock_gettime(clock_id, tp));
+	}
+
+	switch (clock_id) {
+	case LX_CLOCK_REALTIME:
+	case LX_CLOCK_REALTIME_COARSE:
+		return (__cp_clock_gettime_realtime(cp, tp));
+
+	case LX_CLOCK_MONOTONIC:
+	case LX_CLOCK_MONOTONIC_RAW:
+	case LX_CLOCK_MONOTONIC_COARSE:
+		return (__cp_clock_gettime_monotonic(cp, tp));
+
+	case LX_CLOCK_PROCESS_CPUTIME_ID:
+	case LX_CLOCK_THREAD_CPUTIME_ID:
+	default:
+		return (__vdso_sys_clock_gettime(clock_id, tp));
+	}
+}
+
+/*
+ * On i386, the implementation of __cp_clock_gettime_monotonic expects that an
+ * hrt2ts function is provided.  It is provided below since the vDSO is
+ * operating on its own, without native libc.
+ */
+void
+hrt2ts(hrtime_t hrt, timespec_t *tsp)
+{
+	uint32_t sec, nsec, tmp;
+
+	tmp = (uint32_t)(hrt >> 30);
+	sec = tmp - (tmp >> 2);
+	sec = tmp - (sec >> 5);
+	sec = tmp + (sec >> 1);
+	sec = tmp - (sec >> 6) + 7;
+	sec = tmp - (sec >> 3);
+	sec = tmp + (sec >> 1);
+	sec = tmp + (sec >> 3);
+	sec = tmp + (sec >> 4);
+	tmp = (sec << 7) - sec - sec - sec;
+	tmp = (tmp << 7) - tmp - tmp - tmp;
+	tmp = (tmp << 7) - tmp - tmp - tmp;
+	nsec = (uint32_t)hrt - (tmp << 9);
+	while (nsec >= NANOSEC) {
+		nsec -= NANOSEC;
+		sec++;
+	}
+	tsp->tv_sec = (time_t)sec;
+	tsp->tv_nsec = nsec;
+}
+
+#else
+
+/*
+ * On amd64, the __vdso_clock_gettime function is implemented in asm to stay
+ * within the allowed stack budget.
+ */
+
+#endif /* defined(__i386) */
+
+
+int
+__vdso_gettimeofday(timespec_t *tp, struct lx_timezone *tz)
+{
+	if (tz != NULL) {
+		tz->tz_minuteswest = 0;
+		tz->tz_dsttime = 0;
+	}
+
+	if (tp != NULL) {
+		comm_page_t *cp = __vdso_find_commpage();
+
+		if (__cp_can_gettime(cp) == 0) {
+			return (__vdso_sys_gettimeofday(tp, tz));
+		}
+
+		__cp_clock_gettime_realtime(cp, tp);
+		tp->tv_nsec /= 1000;
+	}
+	return (0);
+}
+
+time_t
+__vdso_time(time_t *tp)
+{
+	comm_page_t *cp = __vdso_find_commpage();
+	timespec_t ts;
+
+	if (__cp_can_gettime(cp) == 0) {
+		return (__vdso_sys_time(tp));
+	}
+
+	__cp_clock_gettime_realtime(cp, &ts);
+	if (tp != NULL) {
+		*tp = ts.tv_sec;
+	}
+	return (ts.tv_sec);
+}
+
+int
+__vdso_getcpu(uint_t *cpu, uint_t *node, void *tcache)
+{
+	comm_page_t *cp = __vdso_find_commpage();
+
+	if (cpu != NULL) {
+		*cpu = __cp_getcpu(cp);
+	}
+	if (node != NULL) {
+		*node = 0;
+	}
+	return (0);
+}
diff --git a/usr/src/lib/brand/lx/lx_vdso/i386/Makefile b/usr/src/lib/brand/lx/lx_vdso/i386/Makefile
new file mode 100644
index 0000000000..7f9a6a13e6
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/i386/Makefile
@@ -0,0 +1,43 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+ISASRCDIR=.
+TARGET_ARCH=$(MACH)
+
+include ../Makefile.com
+
+ASFLAGS += -D__$(MACH)
+
+SONAME = linux-gate.so.1
+
+#
+# You might ask, why aren't we overriding BUILD.SO in Makefile.com.
+# See the amd64 Makefile for more answers
+#
+BUILD.SO =	$(LD) -o $@ $(GSHARED) $(DYNFLAGS) $(PICS) $(LDLIBS)
+
+ASSYMDEP_OBJS = lx_vdso.o
+
+CLOBBERFILES	= $(ROOTLIBDIR)/$(DYNLIB) $(ROOTLIBDIR)/$(LINTLIB)
+
+# Set the object entry point for __vsyscall-ers
+entryfix: $(DYNLIB)
+	$(ELFEDIT) -e "ehdr:e_entry \
+	    $$($(ELFEDIT) -re 'sym:st_value -osimple __vsyscall' $(DYNLIB))" \
+	    $(DYNLIB)
+
+all: entryfix
+
+install: all $(ROOTLIBS)
diff --git a/usr/src/lib/brand/lx/lx_vdso/i386/vdso_subr.s b/usr/src/lib/brand/lx/lx_vdso/i386/vdso_subr.s
new file mode 100644
index 0000000000..ed7be8bb23
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/i386/vdso_subr.s
@@ -0,0 +1,92 @@
+/*
+ *
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+
+#include <sys/asm_linkage.h>
+#include <sys/lx_syscalls.h>
+
+
+#if defined(lint)
+
+comm_page_t *
+__vdso_find_commpage()
+{}
+
+long
+__vdso_sys_clock_gettime(uint_t clock_id, timespec_t *tp)
+{}
+
+int
+__vdso_sys_gettimeofday(timespec_t *tp, struct lx_timezone *tz)
+{}
+
+time_t
+__vdso_sys_time(timespec_t *tp)
+{}
+
+#else /* lint */
+
+	ENTRY_NP(__vdso_find_commpage)
+	call	1f
+1:	popl	%eax
+	andl	$LX_VDSO_ADDR_MASK, %eax
+	addl	$LX_VDSO_SIZE, %eax
+	ret
+	SET_SIZE(__vdso_find_commpage)
+
+	ENTRY_NP(__vdso_sys_clock_gettime)
+	movl	$LX_SYS_clock_gettime, %eax
+	movl	0x4(%esp), %ebx
+	movl	0x8(%esp), %ecx
+	int	$0x80
+	ret
+	SET_SIZE(__vdso_sys_clock_gettime)
+
+	ENTRY_NP(__vdso_sys_gettimeofday)
+	movl	$LX_SYS_gettimeofday, %eax
+	movl	0x4(%esp), %ebx
+	movl	0x8(%esp), %ecx
+	int	$0x80
+	ret
+	SET_SIZE(__vdso_sys_gettimeofday)
+
+	ENTRY_NP(__vdso_sys_time)
+	movl	$LX_SYS_time, %eax
+	movl	0x4(%esp), %ebx
+	int	$0x80
+	ret
+	SET_SIZE(__vdso_sys_time)
+
+	ENTRY_NP(__vsyscall)
+	/*
+	 * On 32-bit Linux, the VDSO entry point (specified by e_entry)
+	 * provides a potentially accelerated means to vector into the kernel.
+	 * Normally this means using 'sysenter' with a Linux-custom calling
+	 * convention so programs expecting int80 behavior are not required to
+	 * change how arguments are passed.
+	 *
+	 * The SunOS sysenter entry point does _not_ tolerate such a departure
+	 * from convention, so if this function is updated to use sysenter, it
+	 * must properly marshal arguments onto the stack from the int80 style.
+	 * Such an enhancement can only occur once sysenter receives the same
+	 * branding hooks as syscall and int80.
+	 */
+	int	$0x80
+	ret
+	SET_SIZE(__vsyscall)
+
+#endif /* lint */
diff --git a/usr/src/lib/brand/lx/lx_vdso/tools/Makefile b/usr/src/lib/brand/lx/lx_vdso/tools/Makefile
new file mode 100644
index 0000000000..7907aa67c4
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/tools/Makefile
@@ -0,0 +1,42 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+PROG =			vdso_tool
+
+include ../../../../../cmd/Makefile.cmd
+
+OBJS =			vdso_tool.o
+
+CLOBBERFILES +=		$(PROG)
+
+NATIVECC_CFLAGS +=	$(CFLAGS) $(CCVERBOSE)
+NATIVECC_LDLIBS +=	-lelf
+
+.KEEP_STATE:
+
+all: $(PROG)
+
+install: all
+
+lint:	lint_PROG
+
+clean:
+	$(RM) $(OBJS)
+
+$(PROG): $(OBJS)
+	$(NATIVECC) $(NATIVECC_CFLAGS) $(NATIVECC_LDLIBS) $(OBJS) -o $@
+	$(POST_PROCESS)
+
+include ../../../../../cmd/Makefile.targ
diff --git a/usr/src/lib/brand/lx/lx_vdso/tools/vdso_tool.c b/usr/src/lib/brand/lx/lx_vdso/tools/vdso_tool.c
new file mode 100644
index 0000000000..0e1d99f9da
--- /dev/null
+++ b/usr/src/lib/brand/lx/lx_vdso/tools/vdso_tool.c
@@ -0,0 +1,388 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * vdso_tool: a build-time tool for adjusting properties of the "lx_vdso.so.1"
+ * object we build for VDSO emulation in the LX brand.
+ *
+ * This tool ensures that the shared object contains only one loadable program
+ * header (PT_LOAD), and extends the size of that program header to induce the
+ * loading of all sections into memory.  It also sets a few attributes in the
+ * ELF header.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <strings.h>
+#include <fcntl.h>
+#include <err.h>
+#include <errno.h>
+#include <libelf.h>
+#include <gelf.h>
+
+#define	PROG	"vdso_tool"
+
+typedef enum vdso_flags {
+	VDSO_UNLINK = 0x0001,
+	VDSO_UPDATE = 0x0002
+} vdso_flags_t;
+
+typedef struct vdso {
+	int v_fd;
+	char *v_path;
+	Elf *v_elf;
+	vdso_flags_t v_flags;
+	int v_ptload_phdr;
+	Elf64_Off v_max_offset;
+} vdso_t;
+
+static int
+open_vdso(vdso_t **vp, char *path)
+{
+	vdso_t *v;
+
+	if ((v = calloc(1, sizeof (vdso_t))) == NULL ||
+	    (v->v_path = strdup(path)) == NULL) {
+		err(1, "could not allocate memory");
+	}
+	v->v_ptload_phdr = -1;
+	v->v_fd = -1;
+	*vp = v;
+
+	/*
+	 * Open shared object file.
+	 */
+	if ((v->v_fd = open(v->v_path, O_RDWR)) == -1) {
+		(void) fprintf(stderr, "could not open: %s: %s\n", v->v_path,
+		    strerror(errno));
+		return (-1);
+	}
+
+	/*
+	 * Attach libelf.
+	 */
+	if ((v->v_elf = elf_begin(v->v_fd, ELF_C_RDWR, NULL)) == NULL) {
+		(void) fprintf(stderr, "could not attach libelf: %s\n",
+		    elf_errmsg(-1));
+		return (-1);
+	}
+
+	if (elf_kind(v->v_elf) != ELF_K_ELF) {
+		(void) fprintf(stderr, "wrong elf type\n");
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+close_vdso(vdso_t *v)
+{
+	int rval = 0;
+
+	if (v == NULL) {
+		return (0);
+	}
+
+	if (v->v_elf != NULL) {
+		/*
+		 * If we want to write to the file, do so now.
+		 */
+		if (v->v_flags & VDSO_UPDATE) {
+			if (elf_update(v->v_elf, ELF_C_WRITE) == -1) {
+				(void) fprintf(stderr, "ERROR: elf_update "
+				    "failed: %s\n", elf_errmsg(-1));
+				v->v_flags |= VDSO_UNLINK;
+				rval = -1;
+			}
+		}
+
+		/*
+		 * Close the libelf handle for this file.
+		 */
+		if (elf_end(v->v_elf) == -1) {
+			(void) fprintf(stderr, "ERROR: elf_end failed: %s\n",
+			    elf_errmsg(-1));
+			v->v_flags |= VDSO_UNLINK;
+			rval = -1;
+		}
+	}
+
+	if (v->v_fd > 0) {
+		(void) close(v->v_fd);
+	}
+
+	if (v->v_flags & VDSO_UNLINK) {
+		(void) fprintf(stderr, "unlinking file: %s\n", v->v_path);
+		if (unlink(v->v_path) != 0) {
+			(void) fprintf(stderr, "unlink failed: %s\n",
+			    strerror(errno));
+			rval = -1;
+		}
+	}
+
+	free(v->v_path);
+	free(v);
+
+	return (rval);
+}
+
+static int
+adjust_elf_ehdr(vdso_t *v)
+{
+	GElf_Ehdr ehdr;
+	boolean_t dirty = B_FALSE;
+
+	if (gelf_getehdr(v->v_elf, &ehdr) == NULL) {
+		(void) fprintf(stderr, "could not get ehdr: %s\n",
+		    elf_errmsg(-1));
+		goto errout;
+	}
+
+	if (ehdr.e_ident[EI_OSABI] != ELFOSABI_NONE) {
+		(void) fprintf(stdout, "set EI_OSABI = ELFOSABI_NONE\n");
+		ehdr.e_ident[EI_OSABI] = ELFOSABI_NONE;
+		dirty = B_TRUE;
+	}
+
+	if (ehdr.e_ident[EI_ABIVERSION] != 0) {
+		(void) fprintf(stdout, "set EI_ABIVERSION = 0\n");
+		ehdr.e_ident[EI_ABIVERSION] = 0;
+		dirty = B_TRUE;
+	}
+
+	if (dirty && gelf_update_ehdr(v->v_elf, &ehdr) == 0) {
+		(void) fprintf(stderr, "could not update ehdr: %s\n",
+		    elf_errmsg(-1));
+		goto errout;
+	}
+
+	v->v_flags |= VDSO_UPDATE;
+	return (0);
+
+errout:
+	v->v_flags |= VDSO_UNLINK;
+	return (-1);
+}
+
+static int
+find_pt_load_phdr(vdso_t *v)
+{
+	size_t nphdr, nloadable = 0;
+	int i;
+
+	if (elf_getphdrnum(v->v_elf, &nphdr) != 0) {
+		(void) fprintf(stderr, "could not get phdr count: %s\n",
+		    elf_errmsg(-1));
+		goto errout;
+	}
+	(void) fprintf(stdout, "phdr count: %d\n", nphdr);
+
+	for (i = 0; i < nphdr; i++) {
+		GElf_Phdr phdr;
+
+		if (gelf_getphdr(v->v_elf, i, &phdr) == NULL) {
+			(void) fprintf(stderr, "could not get phdr[%d] count: "
+			    "%s\n", i, elf_errmsg(-1));
+			goto errout;
+		}
+
+		if (phdr.p_type == PT_LOAD) {
+			if (nloadable++ != 0) {
+				(void) fprintf(stderr, "multiple PT_LOAD "
+				    "phdrs\n");
+				goto errout;
+			}
+
+			(void) fprintf(stdout, "PT_LOAD header is phdr[%d]\n",
+			    i);
+			v->v_ptload_phdr = i;
+
+			if (phdr.p_filesz != phdr.p_memsz) {
+				(void) fprintf(stderr, "mismatched filesz "
+				    "(%llx) and memsz (%llx)\n", phdr.p_filesz,
+				    phdr.p_memsz);
+				goto errout;
+			}
+
+			if (phdr.p_filesz == 0) {
+				(void) fprintf(stderr, "filesz was zero\n");
+				goto errout;
+			}
+		}
+	}
+
+	return (0);
+
+errout:
+	v->v_flags |= VDSO_UNLINK;
+	return (-1);
+}
+
+static int
+find_maximum_offset(vdso_t *v)
+{
+	size_t nshdr;
+	int i;
+
+	if (elf_getshdrnum(v->v_elf, &nshdr) != 0) {
+		(void) fprintf(stderr, "could not get shdr count: %s\n",
+		    elf_errmsg(-1));
+		v->v_flags |= VDSO_UNLINK;
+		return (-1);
+	}
+	(void) fprintf(stdout, "shdr count: %d\n", nshdr);
+
+	for (i = 0; i < nshdr; i++) {
+		Elf_Scn *scn = elf_getscn(v->v_elf, i);
+		GElf_Shdr shdr;
+		Elf64_Off end;
+
+		if (gelf_getshdr(scn, &shdr) == NULL) {
+			(void) fprintf(stderr, "could not get shdr[%d] "
+			    "count: %s\n", i, elf_errmsg(-1));
+			goto errout;
+		}
+
+		end = shdr.sh_offset + shdr.sh_size;
+
+		if (end > v->v_max_offset) {
+			v->v_max_offset = end;
+		}
+	}
+
+	(void) fprintf(stdout, "maximum offset: %llx\n", v->v_max_offset);
+
+	return (0);
+
+errout:
+	v->v_flags |= VDSO_UNLINK;
+	return (-1);
+}
+
+static int
+update_pt_load_size(vdso_t *v)
+{
+	GElf_Phdr phdr;
+
+	if (gelf_getphdr(v->v_elf, v->v_ptload_phdr, &phdr) == NULL) {
+		(void) fprintf(stderr, "could not get phdr[%d] count: %s\n",
+		    v->v_ptload_phdr, elf_errmsg(-1));
+		goto errout;
+	}
+
+	(void) fprintf(stdout, "PT_LOAD size is currently %llx\n",
+	    phdr.p_filesz);
+	if (phdr.p_filesz < v->v_max_offset) {
+		(void) fprintf(stdout, "extending PT_LOAD size from %llx "
+		    "to %llx\n", phdr.p_filesz, v->v_max_offset);
+
+		phdr.p_memsz = phdr.p_filesz = v->v_max_offset;
+
+		if (gelf_update_phdr(v->v_elf, v->v_ptload_phdr, &phdr) ==
+		    NULL) {
+			(void) fprintf(stderr, "could not update PT_LOAD "
+			    "phdr: %s", elf_errmsg(-1));
+			goto errout;
+		}
+
+		v->v_flags |= VDSO_UPDATE;
+	}
+
+	return (0);
+
+errout:
+	v->v_flags |= VDSO_UNLINK;
+	return (-1);
+}
+
+int
+main(int argc, char **argv)
+{
+	vdso_t *v;
+	char *filen = NULL;
+	int errflg = 0;
+	int c;
+	int status = 0;
+	boolean_t do_update = B_TRUE;
+
+	while ((c = getopt(argc, argv, ":nf:")) != -1) {
+		switch (c) {
+		case 'n':
+			do_update = B_FALSE;
+			break;
+		case 'f':
+			filen = optarg;
+			break;
+		case ':':
+			(void) fprintf(stderr, "option -%c requires an "
+			    "operand\n", optopt);
+			errflg++;
+			break;
+		case '?':
+			(void) fprintf(stderr, "unrecognised option: -%c\n",
+			    optopt);
+			errflg++;
+			break;
+		}
+	}
+
+	if (errflg != 0 || optind != argc || filen == NULL) {
+		(void) fprintf(stderr, "usage: %s -f <vdso.so>\n", PROG);
+		return (1);
+	}
+
+	(void) fprintf(stdout, "vdso file: %s\n", filen);
+
+	if (elf_version(EV_CURRENT) == EV_NONE) {
+		(void) fprintf(stderr, "libelf mismatch: %s\n", elf_errmsg(-1));
+		return (2);
+	}
+
+	status = 3;
+	if (open_vdso(&v, filen) == -1) {
+		goto out;
+	}
+
+	status++;
+	if (adjust_elf_ehdr(v) == -1) {
+		goto out;
+	}
+
+	status++;
+	if (find_pt_load_phdr(v) == -1) {
+		goto out;
+	}
+
+	status++;
+	if (find_maximum_offset(v) == -1) {
+		goto out;
+	}
+
+	status++;
+	if (do_update && update_pt_load_size(v) == -1) {
+		goto out;
+	}
+
+out:
+	status++;
+	if (close_vdso(v) == 0) {
+		status = 0;
+	}
+
+	return (status);
+}
diff --git a/usr/src/lib/brand/lx/netfiles/Makefile b/usr/src/lib/brand/lx/netfiles/Makefile
new file mode 100644
index 0000000000..1d15d69850
--- /dev/null
+++ b/usr/src/lib/brand/lx/netfiles/Makefile
@@ -0,0 +1,47 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2015 Joyent, Inc.
+#
+
+TXTS = etc_default_nfs
+NFS_DFL = ../../../../cmd/fs.d/nfs/etc/nfs.dfl
+
+all: $(TXTS)
+
+include ../Makefile.lx
+
+lint:
+
+install: $(ROOTTXTS)
+
+clean:
+	-$(RM) etc_default_nfs
+
+clobber: clean
+	-$(RM) $(ROOTXMLDOCS) $(ROOTTXTS)
+
+etc_default_nfs: $(NFS_DFL)
+	$(RM) $@
+	$(CP) $(NFS_DFL) $@
diff --git a/usr/src/lib/brand/lx/testing/Makefile b/usr/src/lib/brand/lx/testing/Makefile
new file mode 100644
index 0000000000..9149929b60
--- /dev/null
+++ b/usr/src/lib/brand/lx/testing/Makefile
@@ -0,0 +1,36 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+TXTS = ltp_skiplist ltp_tests pts_ignorelist
+
+all:
+
+include $(SRC)/cmd/Makefile.cmd
+include ../Makefile.lx
+
+all :=		TARGET= all
+install :=	TARGET= install
+clobber :=	TARGET= clobber
+
+install: $(ROOTTXTS)
+
+_msg:
+
+lint:
+
+clean:
+
+clobber:
+	-$(RM) $(ROOTTXTS)
diff --git a/usr/src/lib/brand/lx/testing/Readme_ltp b/usr/src/lib/brand/lx/testing/Readme_ltp
new file mode 100644
index 0000000000..4a2fcd353b
--- /dev/null
+++ b/usr/src/lib/brand/lx/testing/Readme_ltp
@@ -0,0 +1,294 @@
+The Linux Test Project (LTP) provides the basis for testing the lx API
+implementation. The project webpage is at http://linux-test-project.github.io/
+and the source is available on GitHub at
+https://github.com/linux-test-project/ltp.git.
+
+LTP should be built and run from within an lx zone.
+
+To build
+--------
+As root first make sure you have the tools installed:
+    apt-get install build-essential autoconf automake git quota
+
+For 64-bit:
+    apt-get install libc6-dev-i386
+
+Additional prerequisites are required activate some tests:
+    apt-get install attr-dev libaio-dev
+
+As a normal user:
+    git clone https://github.com/linux-test-project/ltp.git
+    cd ltp
+    make autotools
+    ./configure
+    make all
+
+As root:
+    make install
+
+The tests can be built in both a zone that has been installed with a 32-bit
+version of Linux and another zone that has been installed with a 64-bit version
+of the same release. When testing the 64-bit zone, a copy of the 32-bit build
+can be run in the 64-bit zone to ensure that 32-bit applications work
+correctly on a 64-bit install.
+
+Running the tests
+-----------------
+The LTP source tree provides detailed documentation on using the test suite, so
+this readme only give a short summary.
+
+Because many of the tests are targetted at kernel functionality which does not
+apply to Illumos, or test capabilities which are not available from within a
+zone, or test system call functionality which has not yet been completed, a
+skip list is used during the test run to bypass tests which are known to fail.
+
+The skip list lives in this directory and is delivered on the system. It is
+available from within the lx zone as /native/usr/lib/brand/lx/ltp_skiplist. As
+new functionality is completed, the skip list should be updated to remove tests
+which now work.
+
+As root:
+    cd /opt/ltp
+    /opt/ltp/runltp -f `cat /native/usr/lib/brand/lx/ltp_tests` \
+        -S /native/usr/lib/brand/lx/ltp_skiplist -p >/tmp/test.log
+
+When the test run has finished, the results will be logged in a date/time
+stamped file under /opt/ltp/results. The summary at the end of the log file
+should show "Total Failures: 0". If not, something is wrong.
+
+Running tests for development
+-----------------------------
+The source for the tests can be found under the testcases directory. The
+largest and most useful set for lx live under testcases/kernel/syscalls.
+
+For development purposes, an individual test (or tests) can be run by listing
+them in a command file, one per line. For example, with a command file named
+~/tcmds, to run the read01 test you setup the file so it looks like this:
+    read01 read01
+
+You can run that specific test as follows:
+    /opt/ltp/runltp -f ~/tcmds -p -l ~/read.log
+
+Test status
+-----------
+This section provides a short summary of the rationale for why tests are being
+skipped.
+
+LTP groups tests into command files (i.e. syscalls, nptl, etc. provided with
+the -f option in the runltp command shown above). A complete list of the groups
+can be seen in LTP source tree under the runtest directory. Some of these
+groups are obviously not applicable when running in an lx zone. The remaining
+groups still need work before they can be run. The groups shown in the runltp
+command above are expected to work when the skip list is used. The 'syscalls'
+command file runs the majority of the actual system call tests which we are
+interested in.
+
+The following table indicates why specific subtests are being skipped. Also
+note that the following tests pass in a 64-bit lx zone, but fail in a zone
+installed with a 32-bit Linux build: mmap15, open12, openat02 and sendfile09.
+
+    Legend:
+	x = never in a zone
+	* = fails on kvm and bare metal too
+	# = emulation not implemented yet
+	- = could enable with a test zone config change
+
+- access06	wants a block device
+x acct01	enables bsd process accounting
+# add_key01
+# add_key02
+x adjtimex01
+x adjtimex02
+x bdflush01
+x cacheflush01
+x chmod03	need PRIV_SYS_CONFIG to set sticky bit on reg file
+- chmod06	needs dev
+x chmod07	need PRIV_SYS_CONFIG to set sticky bit on reg file
+- chown04	needs dev
+- chown04_16	needs dev
+# clone02
+# clone08
+- creat06	wants to mount a ro fs
+x creat07	we don't behave this way for ETXTBSY
+x creat08	sets euid to 'nobody', loses PRIV_FILE_SETID to set sgid
+x execve04	we don't behave this way for ETXTBSY
+# fallocate01
+# fallocate02
+# fallocate03
+x fchmod02	need PRIV_SYS_CONFIG to set sticky bit on reg file
+x fchmod03	need PRIV_SYS_CONFIG to set sticky bit on reg file
+- fchmod06	needs dev
+# fchown04	mounts
+# fchown04_16
+# fcntl06	not supported on linux
+# fcntl06_64
+# fcntl23	leases not implemented
+# fcntl23_64	"
+# fcntl24	"
+# fcntl24_64	"
+# fcntl25	"
+# fcntl25_64	"
+# fcntl26	"
+# fcntl26_64	"
+# fcntl30
+# fcntl30_64
+# fcntl31	setown/getown not impl
+# fcntl31_64
+# fcntl32	F_SETLEASE not impl
+# fcntl32_64
+# fcntl33	F_SETLEASE not impl
+# fcntl33_64
+# fork05	asm into %fs reg
+- fork09	needs a swap cap of ~9GB
+# fork13	decided not to support this
+# fork14	"
+# ftruncate04	need a mnt with mandatory locking
+# ftruncate04_64
+# getdents02	wrong errno on test 4 - perf. impact too high
+# getdents02_64
+# get_mempolicy01
+x getrusage03	we don't fill in the ru_maxrss field
+- getxattr01	need attr/xattr.h at build time
+- getxattr02
+- getxattr03
+# ioctl03	needs /dev/net/tun
+# io_cancel01	libaio stuff not done
+# io_destroy01
+# io_getevents01
+# io_setup01
+# io_submit01
+- inotify03	needs dev
+# fanotify01	don't have fanotify
+# fanotify02
+# fanotify03
+# fanotify04
+# fanotify05
+# keyctl01	no kernel keyring support
+- lchown03	needs to mount ro fs
+- lchown03_16
+- linkat02	needs dev
+- link08	needs dev
+x mem01		crashme test which expects OOM killer to save the day
+- mkdir03	needs dev
+- mkdirat02	needs dev
+x mknod01	makes block and chr devs
+- mknod07	needs dev
+- mknodat02	needs dev
+# mmap13	expects "invalid access" to SIGBUS
+- mount01	needs dev
+- mount02	needs dev
+x mount03	mounts ext2
+- mount04	needs dev
+x mount05	mounts ext2
+x mount06	mounts ext2
+# mq_notify01
+# mq_notify02
+# mq_open01
+# mq_timedreceive01
+# mq_timedsend01
+# mq_unlink01
+x mremap01
+x mremap02
+x mremap03
+x mremap04
+x mremap05
+# msgctl12	uses MSG_STAT
+# msgrcv07	MSG_EXCEPT subtest - not avail.
+x open01	need PRIV_SYS_CONFIG to set sticky bit on reg file
+# open02	expects NOATIME to cause err for unpriv user
+# open10	setgid on sgid subdir behavior
+x open11	makes device
+# ppoll01
+# process_vm_readv01
+# process_vm_readv02
+# process_vm_readv03
+# process_vm_writev01
+# process_vm_writev02
+# prot_hsymlinks	/proc/sys/fs/protected_hardlinks
+x ptrace04	not supp on our arch
+# ptrace05	OS-3307
+# read02	checks errno for O_DIRECT
+# readahead01
+# readahead02
+# readdir21	dir perf. issue
+- rename11	needs dev
+- renameat01	needs dev
+- rmdir02	needs dev
+x sched_getparam01	assumes Linux SCHED_OTHER return value
+x sched_getparam02	assumes Linux SCHED_OTHER return value
+# sched_rr_get_interval01
+# sched_rr_get_interval02
+# sched_rr_get_interval03
+x sched_setparam02	tries to set Linux policies
+x sched_setparam03	tries to set Linux policies
+# sched_getscheduler01
+# sched_getscheduler02
+x sched_setscheduler01
+x sched_setaffinity01
+x sched_getaffinity01
+# semctl01	all pass but SEM_STAT - linux specific
+# semop02	last test fails errno - expensive
+# sendfile02	OS-3296
+# sendfile02_64	"
+# sendfile04	"
+# sendfile04_64	"
+# sendfile06	"
+# sendfile06_64	"
+# sendfile07	"
+# sendfile07_64	"
+sendmsg01	OS-3295 - tests actually pass
+x setfsuid04	no real equiv. and only for NFS server
+x setfsuid04_16
+# sgetmask01	obsolete
+# setgroups04_16	expects sig11 for certain err
+# setns01
+# setns02
+# setpgid02	all pass but one, expects pid 0 to be there
+* setregid02	fails on bare metal, expects to lookup group "nobody" which
+* setregid02_16	doesn't exist. it is "nogroup" on ubuntu at least
+# setrlimit01	all pass but one, expects to set proc limit
+x settimeofday01
+# setxattr01
+# setxattr02
+# setxattr03
+# shmget05	OS-3326
+# splice01
+# splice02
+# splice03
+# tee01
+# tee02
+# ssetmask01	obsolete
+x stime01
+x switch01
+# sync_file_range01
+# sysconf01	most pass but see OS-3305
+# sysctl01	the build compiled this out,
+# sysctl03	this syscall is basically obsolete
+# sysctl04	obsolete
+# sysctl05
+# syslog01
+# syslog02
+# syslog03
+# syslog04
+# syslog05
+# syslog06
+# syslog07
+# syslog08
+# syslog09
+# syslog10
+# syslog11
+# syslog12
+# unshare01
+# unshare02
+- umount01	needs dev
+- umount02	needs dev
+- umount03	needs dev
+x ustat01	obsolete call to stat FS
+x ustat02	obsolete call to stat FS
+- utime06	needs dev
+- utimes01	needs dev
+# utimensat01	many subtests pass but see OS-3328 for the rest
+# vmsplice01
+# vmsplice02
+# perf_event_open01
+# perf_event_open02
diff --git a/usr/src/lib/brand/lx/testing/ltp_skiplist b/usr/src/lib/brand/lx/testing/ltp_skiplist
new file mode 100644
index 0000000000..09ff2cacc1
--- /dev/null
+++ b/usr/src/lib/brand/lx/testing/ltp_skiplist
@@ -0,0 +1,272 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+# Copyright 2017 Joyent, Inc.
+
+# Broken tests
+poll02		# OS-3997
+
+# tests functionality not allowed in a zone
+accept4_01
+acct01
+adjtimex01
+adjtimex02
+bdflush01
+cacheflush01
+chmod03
+chmod07
+creat07
+creat08
+execve04
+fchmod02
+fchmod03
+getrusage03
+ioperm01
+ioperm02
+iopl01
+iopl02
+isofs
+mbind01
+mem01
+migrate_pages01
+migrate_pages02
+mknod01
+mmap12
+mount03
+mount05
+mount06
+modify_ldt01
+modify_ldt02
+move_pages01
+move_pages02
+move_pages03
+move_pages04
+move_pages05
+move_pages06
+move_pages07
+move_pages08
+move_pages09
+move_pages10
+move_pages11
+mremap04		# we don't yet support remapping shm
+open01
+open11
+open12			# needs a device
+ptrace04
+quotactl01
+quotactl02
+remap_file_pages01
+remap_file_pages02
+setfsuid04
+setfsuid04_16
+settimeofday01
+stime01
+swapoff02
+swapon02
+swapon03
+switch01
+ustat01
+ustat02
+
+# needs a config with a dev or mounting
+# As of February 2017, an increasing number of tests require device support
+# (often via a zeroed file mounted via loopback) to function properly.
+access04
+chmod06
+chown04
+chown04_16
+creat06
+fchmod06
+fchown04
+fchown04_16
+inotify03
+lchown03
+lchown03_16
+linkat02
+link08
+madvise06
+mkdir03
+mkdirat02
+mknod07
+mknodat02
+mmap16
+mount01
+mount02
+mount04
+rename11
+renameat01
+rmdir02
+umount01
+umount02
+umount2_01
+umount2_02
+umount2_03
+umount03
+utime06
+utimes01
+
+# These tests are broken on 32-bit (including on "real" Linux)
+preadv01
+preadv02
+pwritev01
+pwritev02
+
+# tests functionality not implemented yet
+access06
+add_key01
+add_key02
+clone02
+clone08
+clone09
+crash02
+dirtyc0w
+fallocate04		# needs SEEK_HOLE
+fallocate05		# needs to mount a filesystem
+fanotify01
+fanotify02
+fanotify03
+fanotify04
+fanotify05
+fanotify06
+fcntl06
+fcntl23
+fcntl23_64
+fcntl24
+fcntl24_64
+fcntl25
+fcntl25_64
+fcntl26
+fcntl26_64
+fcntl31
+fcntl31_64
+fcntl32
+fcntl32_64
+fcntl33
+fcntl33_64
+fork05
+fork09
+fork13
+fork14
+fsync01
+ftruncate04
+ftruncate04_64
+futex_wake04		# OS-4471
+getdents02
+getdents02_64
+get_mempolicy01
+getxattr01
+getxattr02
+getxattr03
+getxattr04
+ioctl03
+ioctl04
+ioctl05
+ioctl06
+ioctl07			# OS-6397
+keyctl01
+keyctl02
+keyctl03
+keyctl04
+keyctl05
+keyctl06
+keyctl07
+kcmp01
+kcmp02
+kcmp03
+lgetxattr01
+lgetxattr02
+llistxattr01
+llistxattr02
+llistxattr03
+madvise08		# no MADV_DONTDUMP support (yet?)
+mmap13
+mq_notify01
+mq_notify02
+mq_open01
+mq_timedreceive01
+mq_timedsend01
+mq_unlink01
+msgctl12
+msgrcv07
+msync04
+open02
+open10
+perf_event_open01
+perf_event_open02
+ppoll01
+process_vm_readv01
+process_vm_readv02
+process_vm_readv03
+process_vm_writev01
+process_vm_writev02
+prot_hsymlinks
+pty01			# OS-5437
+read02
+readahead01
+readahead02
+readdir2
+readdir21
+removexattr01
+removexattr02
+request_key01
+request_key02
+semctl01
+semop02
+sendfile02		# OS-3296
+sendfile02_64
+sendfile04
+sendfile04_64
+sendfile06
+sendfile06_64
+sendfile07
+sendfile07_64
+sendmsg01
+sendto02		# OS-5764
+setgroups04_16
+setns01
+setns02
+setpgid02
+setregid02
+setregid02_16
+setrlimit01
+setsockopt02
+setxattr01
+setxattr02
+setxattr03
+sgetmask01
+shmget05		# OS-3326
+splice02		# bad test, fails on Linux too
+ssetmask01
+sync_file_range01
+sysconf01		# OS-3305
+sysctl01
+sysctl03
+sysctl04
+sysctl05
+syslog01
+syslog02
+syslog03
+syslog04
+syslog05
+syslog06
+syslog07
+syslog08
+syslog09
+syslog10
+syslog11
+syslog12
+tee01
+tee02
+unshare01
+utimensat01		# OS-3328
+unshare02
+vmsplice01
+vmsplice02
diff --git a/usr/src/lib/brand/lx/testing/ltp_tests b/usr/src/lib/brand/lx/testing/ltp_tests
new file mode 100644
index 0000000000..86e9725638
--- /dev/null
+++ b/usr/src/lib/brand/lx/testing/ltp_tests
@@ -0,0 +1 @@
+syscalls,nptl,ipc,pipes,pty,crashme,math
diff --git a/usr/src/lib/brand/lx/testing/pts_ignorelist b/usr/src/lib/brand/lx/testing/pts_ignorelist
new file mode 100644
index 0000000000..2c4f307b55
--- /dev/null
+++ b/usr/src/lib/brand/lx/testing/pts_ignorelist
@@ -0,0 +1,366 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+# Copyright 2016 Joyent, Inc.
+
+# The Open POSIX Test Suite (PTS) tests the POSIX conformance of an
+# operating system. A test may have one of six different results:
+#
+# o PASS: the test passed
+# o FAIL: the test failed
+# o UNRESOLVED: the test was unable to determine pass/fail
+# o UNSUPPORTED: this feature is not supported by the OS
+# o UNTESTED: this test is not yet implemented
+#
+# You can read more about these result codes in:
+#
+#   ltp/testcases/open_posix_testsuite/Documentation/HOWTO_ResultCodes
+#
+# This file (pts_ignorelist) contains a list of tests which are known
+# not to pass on lx-brand zones, along with the expected test result.
+# These tests are grouped based on the reason for their failure,
+# described by the comment above the grouping. Ideally, any test
+# resulting in FAILED indicates a bug in lx-brand, but PTS is not
+# ideal. Many of the tests will return FAILED when they should return
+# UNRESOLVED instead. E.g., some of the MQ tests will return FAILED if
+# mq_open() fails while some will return UNRESOLVED. Unless otherwise
+# noted in the group comment, assume FAILED is a true bug (as opposed
+# to a lack of support by lx-brand).
+#
+# To run the tests and check your results against this list:
+#
+# cd ltp/testcases/open_posix_testsuite
+# make
+# make test 2>&1 | tee pts.log
+# diff <(egrep -v '^#|^$' /native/usr/lib/brand/lx/pts_ignorelist | sort) \
+# <(grep execution pts.log | tr -d : | awk '{ print $1, $3 }' | sort)
+#
+# Any delta reported by the diff is either a regression in lx-brand or
+# a change in the test code.
+
+#
+# POSIX message queues are not implemented in lx-brand. In illumos,
+# MQs are implemented completely in libc. In Linux, MQs are
+# implemented as system calls. The lx-brand code returns ENOSYS for
+# all the MQ system calls. The MQ tests are not consistent in how they
+# classify a failed mq_open() and thus the tests return a mixture of
+# UNRESOLVED and FAILED.
+#
+conformance/interfaces/fork/fork_19-1 UNRESOLVED
+conformance/interfaces/mq_close/mq_close_1-1 UNRESOLVED
+conformance/interfaces/mq_close/mq_close_2-1 UNRESOLVED
+conformance/interfaces/mq_close/mq_close_3-1 UNRESOLVED
+conformance/interfaces/mq_close/mq_close_4-1 UNRESOLVED
+conformance/interfaces/mq_getattr/mq_getattr_2-1 UNRESOLVED
+conformance/interfaces/mq_getattr/mq_getattr_2-2 UNRESOLVED
+conformance/interfaces/mq_getattr/mq_getattr_3-1 UNRESOLVED
+conformance/interfaces/mq_getattr/mq_getattr_4-1 UNRESOLVED
+conformance/interfaces/mq_notify/mq_notify_1-1 UNRESOLVED
+conformance/interfaces/mq_notify/mq_notify_2-1 UNRESOLVED
+conformance/interfaces/mq_notify/mq_notify_3-1 UNRESOLVED
+conformance/interfaces/mq_notify/mq_notify_4-1 UNRESOLVED
+conformance/interfaces/mq_notify/mq_notify_5-1 UNRESOLVED
+conformance/interfaces/mq_notify/mq_notify_8-1 FAILED
+conformance/interfaces/mq_notify/mq_notify_9-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_1-1 FAILED
+conformance/interfaces/mq_open/mq_open_11-1 FAILED
+conformance/interfaces/mq_open/mq_open_12-1 FAILED
+conformance/interfaces/mq_open/mq_open_13-1 FAILED
+conformance/interfaces/mq_open/mq_open_15-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_16-1 FAILED
+conformance/interfaces/mq_open/mq_open_18-1 FAILED
+conformance/interfaces/mq_open/mq_open_19-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_2-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_20-1 FAILED
+conformance/interfaces/mq_open/mq_open_23-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_25-2 FAILED
+conformance/interfaces/mq_open/mq_open_27-1 FAILED
+conformance/interfaces/mq_open/mq_open_27-2 FAILED
+conformance/interfaces/mq_open/mq_open_29-1 FAILED
+conformance/interfaces/mq_open/mq_open_7-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_7-2 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_7-3 FAILED
+conformance/interfaces/mq_open/mq_open_8-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_8-2 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_9-1 UNRESOLVED
+conformance/interfaces/mq_open/mq_open_9-2 UNRESOLVED
+conformance/interfaces/mq_receive/mq_receive_1-1 FAILED
+conformance/interfaces/mq_receive/mq_receive_10-1 FAILED
+conformance/interfaces/mq_receive/mq_receive_11-1 FAILED
+conformance/interfaces/mq_receive/mq_receive_11-2 FAILED
+conformance/interfaces/mq_receive/mq_receive_12-1 FAILED
+conformance/interfaces/mq_receive/mq_receive_13-1 UNRESOLVED
+conformance/interfaces/mq_receive/mq_receive_2-1 UNRESOLVED
+conformance/interfaces/mq_receive/mq_receive_5-1 FAILED
+conformance/interfaces/mq_receive/mq_receive_7-1 UNRESOLVED
+conformance/interfaces/mq_receive/mq_receive_8-1 FAILED
+conformance/interfaces/mq_send/mq_send_1-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_10-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_11-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_11-2 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_12-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_13-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_14-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_2-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_3-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_3-2 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_4-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_4-2 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_4-3 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_5-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_5-2 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_7-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_8-1 UNRESOLVED
+conformance/interfaces/mq_send/mq_send_9-1 UNRESOLVED
+conformance/interfaces/mq_setattr/mq_setattr_1-1 UNRESOLVED
+conformance/interfaces/mq_setattr/mq_setattr_1-2 UNRESOLVED
+conformance/interfaces/mq_setattr/mq_setattr_2-1 UNRESOLVED
+conformance/interfaces/mq_setattr/mq_setattr_5-1 UNRESOLVED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_1-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_10-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_10-2 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_11-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_13-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_14-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_15-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_17-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_17-2 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_17-3 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_18-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_18-2 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_2-1 UNRESOLVED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_5-1 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_5-2 FAILED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_5-3 UNRESOLVED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_7-1 UNRESOLVED
+conformance/interfaces/mq_timedreceive/mq_timedreceive_8-1 FAILED
+conformance/interfaces/mq_timedsend/mq_timedsend_1-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_10-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_11-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_11-2 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_12-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_13-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_14-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_15-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_16-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_18-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_19-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_2-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_20-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_3-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_3-2 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_4-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_4-2 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_4-3 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_5-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_5-2 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_5-3 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_7-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_8-1 UNRESOLVED
+conformance/interfaces/mq_timedsend/mq_timedsend_9-1 UNRESOLVED
+conformance/interfaces/mq_unlink/mq_unlink_1-1 UNRESOLVED
+conformance/interfaces/mq_unlink/mq_unlink_2-1 UNRESOLVED
+conformance/interfaces/mq_unlink/mq_unlink_2-2 UNRESOLVED
+conformance/interfaces/mq_unlink/mq_unlink_7-1 FAILED
+functional/mqueues/mqueues_send_rev_1 UNRESOLVED
+functional/mqueues/mqueues_send_rev_2 UNRESOLVED
+
+#
+# Other features not implemented on Linux.
+#
+conformance/interfaces/pthread_rwlock_unlock/pthread_rwlock_unlock_4-1 UNSUPPORTED
+conformance/interfaces/pthread_rwlock_unlock/pthread_rwlock_unlock_4-2 UNSUPPORTED
+
+#
+# Part of this test is verifying specific thread scheduling and I'm
+# not sure how much I trust it. This test fails on native too.
+#
+conformance/interfaces/sched_setparam/sched_setparam_9-1 FAILED
+
+#
+# Linux doesn't support PTHREAD_SCOPE_PROCESS, see
+# pthread_attr_setscope(3).
+#
+conformance/interfaces/sched_setscheduler/sched_setscheduler_22-1 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_22-2 UNSUPPORTED
+
+#
+# These tests test specific scheduling behavior. They pass on native
+# when actually running in the RT class, but we run lx zones in the
+# FSS class and can't guarantee specific scheduling order.
+#
+conformance/interfaces/pthread_create/pthread_create_1-6 FAILED
+conformance/interfaces/sem_post/sem_post_8-1 FAILED
+
+#
+# It looks like we are missing some futex support that
+# pthread_mutex_timedlock() requires:
+#
+# futex(0x602820, FUTEX_LOCK_PI_PRIVATE, 1) = -1 ENOSYS
+#
+functional/threads/pi_test/pi_test_pitest-1 FAILED
+functional/threads/pi_test/pi_test_pitest-2 FAILED
+functional/threads/pi_test/pi_test_pitest-3 FAILED
+functional/threads/pi_test/pi_test_pitest-4 FAILED
+functional/threads/pi_test/pi_test_pitest-6 FAILED
+
+#
+# Another case where we need FUTEX_LOCK_PI, but slightly different
+# from the ones above. Glibc's implementation of pthread_mutex_lock()
+# doesn't check for ENOSYS from FUTEX_LOCK_PI and instead chugs along
+# assuming it has the mutex.
+#
+functional/threads/pi_test/pi_test_pitest-5 UNRESOLVED
+
+#
+# glibc doesn't support PTHREAD_SCOPE_PROCESS.
+#
+conformance/interfaces/sched_setparam/sched_setparam_20-1 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_21-1 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_21-2 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_15-1 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_15-2 UNSUPPORTED
+
+#
+# _POSIX_SPORADIC_SERVER is not available on Linux.
+#
+conformance/interfaces/sched_get_priority_max/sched_get_priority_max_1-3 UNSUPPORTED
+conformance/interfaces/sched_get_priority_min/sched_get_priority_min_1-3 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_23-2 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_23-3 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_23-4 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_23-5 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_25-2 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_25-3 UNSUPPORTED
+conformance/interfaces/sched_setparam/sched_setparam_25-4 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_17-2 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_17-3 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_17-4 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_19-2 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_19-3 UNSUPPORTED
+conformance/interfaces/sched_setscheduler/sched_setscheduler_19-4 UNSUPPORTED
+
+#
+# No semaphore limit (_SC_SEM_NSEMS_MAX).
+#
+conformance/interfaces/sem_init/sem_init_7-1 UNTESTED
+
+#
+# CLOCK_PROCESS_CPUTIME_ID/CLOCK_THREAD_CPUTIME_ID not supported.
+#
+conformance/interfaces/fork/fork_22-1 UNRESOLVED
+conformance/interfaces/timer_create/timer_create_10-1 UNRESOLVED
+
+#
+# Multiple instances of the same signal are coalesced on sigwait().
+#
+conformance/interfaces/sigwait/sigwait_2-1 FAILED
+
+#
+# Need sys_time privs.
+#
+# clock_settime_20-1 returns FAILED because it expects EINVAL but gets EPERM.
+#
+conformance/interfaces/clock_settime/clock_settime_1-1 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_4-1 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_4-2 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_5-1 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_5-2 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_7-1 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_7-2 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_8-1 UNRESOLVED
+conformance/interfaces/clock_settime/clock_settime_20-1 FAILED
+
+#
+# https://github.com/joyent/illumos-joyent/issues/66
+#
+conformance/interfaces/clock_getcpuclockid/clock_getcpuclockid_1-1 FAILED
+conformance/interfaces/clock_getcpuclockid/clock_getcpuclockid_1-2 UNRESOLVED
+conformance/interfaces/clock_getcpuclockid/clock_getcpuclockid_2-1 FAILED
+conformance/interfaces/clock_getcpuclockid/clock_getcpuclockid_5-1 UNRESOLVED
+
+#
+# Various AIO functions don't EINVAL on bogus struct aiocb.
+#
+# Faulty on lx brand, Linux on KVM, and illumos.
+#
+conformance/interfaces/aio_error/aio_error_3-1 UNTESTED
+conformance/interfaces/aio_return/aio_return_4-1 UNTESTED
+
+#
+# _SC_AIO_MAX == -1
+#
+conformance/interfaces/aio_read/aio_read_9-1 UNSUPPORTED
+conformance/interfaces/aio_write/aio_write_7-1 UNSUPPORTED
+
+#
+# PTS is a wasteland, these tests hard-coded to fail.
+#
+conformance/interfaces/aio_suspend/aio_suspend_5-1 UNSUPPORTED
+
+#
+# Tests that fail on lx-brand and Linux but pass illumos.
+#
+conformance/interfaces/aio_return/aio_return_2-1 UNTESTED
+conformance/interfaces/aio_return/aio_return_3-2 UNTESTED
+conformance/interfaces/pthread_rwlock_rdlock/pthread_rwlock_rdlock_2-1 FAILED
+conformance/interfaces/pthread_rwlock_rdlock/pthread_rwlock_rdlock_2-2 FAILED
+
+#
+# Tests that fail everywhere: lx-brand, Linux, and illumos.
+#
+conformance/interfaces/pthread_rwlock_unlock/pthread_rwlock_unlock_3-1 FAILED
+conformance/interfaces/sched_getparam/sched_getparam_6-1 UNTESTED
+conformance/interfaces/sched_getscheduler/sched_getscheduler_7-1 UNTESTED
+
+#
+# mmap() is supposed to return ENODEV for pipe but returns ENOSYS.
+# This is an illumos bug.
+#
+conformance/interfaces/mmap/mmap_23-1 FAILED
+
+#
+# I'm not sure.
+#
+conformance/interfaces/mmap/mmap_18-1 FAILED
+
+#
+# According to the spec "Memory access within the mapping but beyond
+# the current end of the underlying objects __may__ result in SIGBUS
+# signals being sent to the process". So I don't think it breaks POSIX
+# but it surely doesn't behave like Linux.
+#
+conformance/interfaces/mmap/mmap_11-2 FAILED
+
+#
+# The test uses /proc/mounts to check for noatime but the lx-brand
+# does not indicate noatime even if the underlying zfs fs has atime
+# disabled.
+#
+conformance/interfaces/mmap/mmap_13-1 FAILED
+
+#
+# Doesn't run on 64bit.
+#
+conformance/interfaces/mmap/mmap_31-1 UNSUPPORTED
+
+#
+# Bytes written past the end of the mmap object (but still in page)
+# are not written to disk but they do appear to persist in the page
+# when mmap'd by another pid. Perhaps this test is really testing an
+# implementation detail of Linux's VM system.
+#
+conformance/interfaces/mmap/mmap_11-4 FAILED
+
+#
+# lx-brand doesn't implement clock_getcpudclockid(pid,...).
+#
+conformance/interfaces/pthread_condattr_setclock/pthread_condattr_setclock_1-3 FAILED
diff --git a/usr/src/lib/brand/lx/zone/Makefile b/usr/src/lib/brand/lx/zone/Makefile
new file mode 100644
index 0000000000..ddcca6046a
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/Makefile
@@ -0,0 +1,71 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2015 Joyent, Inc.  All rights reserved.
+# Copyright 2017 ASS-Einrichtungssysteme GmbH, Inc.  All rights reserved.
+#
+
+PROGS =	lx_boot
+PROGS += lx_boot_zone_redhat lx_boot_zone_ubuntu lx_boot_zone_debian
+PROGS += lx_boot_zone_busybox lx_boot_zone_suse
+XMLDOCS =	config.xml platform.xml
+TEMPLATES =	SUNWlx.xml SUNWlx26.xml
+
+all:	$(PROGS)
+
+include $(SRC)/cmd/Makefile.cmd
+include ../Makefile.lx
+
+all :=		TARGET= all
+install :=	TARGET= install
+clobber :=	TARGET= clobber
+
+POFILES=	$(PROGS:%=%.po)
+POFILE=		lx_zone.po
+
+$(POFILE): $(POFILES)
+	$(RM) $@
+	$(BUILDPO.pofiles)
+
+_msg: $(MSGDOMAINPOFILE)
+
+install: $(PROGS) $(ROOTXMLDOCS) $(ROOTTEMPLATES) $(ROOTPROGS)
+	mkdir -p $(ROOT)/usr/lib/brand/lx/ld/64
+	crle -c $(ROOT)/usr/lib/brand/lx/ld/ld.config \
+		-l /native/lib:/native/usr/lib \
+		-s /native/lib/secure:/native/usr/lib/secure
+	crle -64 -c $(ROOT)/usr/lib/brand/lx/ld/64/ld.config \
+		-l /native/lib/64:/native/usr/lib/64 \
+		-s /native/lib/secure/64:/native/usr/lib/secure/64
+
+lint:
+
+clean:
+	-$(RM) $(PROGS)
+
+clobber: clean
+	-$(RM) $(ROOTXMLDOCS) $(ROOTPROGS) $(ROOTTEMPLATES)
+
+FRC:
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/lib/brand/lx/zone/SUNWlx.xml b/usr/src/lib/brand/lx/zone/SUNWlx.xml
new file mode 100644
index 0000000000..04c38873de
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/SUNWlx.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+
+<!--
+ Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ Use is subject to license terms.
+
+ CDDL HEADER START
+
+ The contents of this file are subject to the terms of the
+ Common Development and Distribution License (the "License").
+ You may not use this file except in compliance with the License.
+
+ You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ or http://www.opensolaris.org/os/licensing.
+ See the License for the specific language governing permissions
+ and limitations under the License.
+
+ When distributing Covered Code, include this CDDL HEADER in each
+ file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ If applicable, add the following below this CDDL HEADER, with the
+ fields enclosed by brackets "[]" replaced with your own identifying
+ information: Portions Copyright [yyyy] [name of copyright owner]
+
+ CDDL HEADER END
+
+    ident	"%Z%%M%	%I%	%E% SMI"
+
+    DO NOT EDIT THIS FILE.  Use zonecfg(1M) instead.
+-->
+
+<!DOCTYPE zone PUBLIC "-//Sun Microsystems Inc//DTD Zones//EN" "file:///usr/share/lib/xml/dtd/zonecfg.dtd.1">
+
+<zone name="default" zonepath="" autoboot="false" brand="lx">
+</zone>
diff --git a/usr/src/lib/brand/lx/zone/SUNWlx26.xml b/usr/src/lib/brand/lx/zone/SUNWlx26.xml
new file mode 100644
index 0000000000..9bd8af4d92
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/SUNWlx26.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+
+<!--
+ Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ Use is subject to license terms.
+
+ CDDL HEADER START
+
+ The contents of this file are subject to the terms of the
+ Common Development and Distribution License (the "License").
+ You may not use this file except in compliance with the License.
+
+ You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ or http://www.opensolaris.org/os/licensing.
+ See the License for the specific language governing permissions
+ and limitations under the License.
+
+ When distributing Covered Code, include this CDDL HEADER in each
+ file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ If applicable, add the following below this CDDL HEADER, with the
+ fields enclosed by brackets "[]" replaced with your own identifying
+ information: Portions Copyright [yyyy] [name of copyright owner]
+
+ CDDL HEADER END
+
+    ident	"%Z%%M%	%I%	%E% SMI"
+
+    DO NOT EDIT THIS FILE.  Use zonecfg(1M) instead.
+-->
+
+<!DOCTYPE zone PUBLIC "-//Sun Microsystems Inc//DTD Zones//EN" "file:///usr/share/lib/xml/dtd/zonecfg.dtd.1">
+
+<zone name="default" zonepath="" autoboot="false" brand="lx">
+  <attr name="kernel-version" type="string" value="2.6"/>
+</zone>
diff --git a/usr/src/lib/brand/lx/zone/config.xml b/usr/src/lib/brand/lx/zone/config.xml
new file mode 100644
index 0000000000..ba7a150a2c
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/config.xml
@@ -0,0 +1,105 @@
+<?xml version="1.0"?>
+
+<!--
+ CDDL HEADER START
+
+ The contents of this file are subject to the terms of the
+ Common Development and Distribution License (the "License").
+ You may not use this file except in compliance with the License.
+
+ You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ or http://www.opensolaris.org/os/licensing.
+ See the License for the specific language governing permissions
+ and limitations under the License.
+
+ When distributing Covered Code, include this CDDL HEADER in each
+ file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ If applicable, add the following below this CDDL HEADER, with the
+ fields enclosed by brackets "[]" replaced with your own identifying
+ information: Portions Copyright [yyyy] [name of copyright owner]
+
+ CDDL HEADER END
+
+ Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ Copyright 2015, Joyent, Inc.
+
+ DO NOT EDIT THIS FILE.
+-->
+
+<!DOCTYPE brand PUBLIC "-//Sun Microsystems Inc//DTD Brands//EN"
+    "file:///usr/share/lib/xml/dtd/brand.dtd.1">
+
+<brand name="lx">
+	<modname>lx_brand</modname>
+
+	<initname>/native/usr/lib/brand/lx/lxinit</initname>
+	<login_cmd>/bin/login -h zone:%Z %u</login_cmd>
+	<forcedlogin_cmd>/bin/login -h zone:%Z -f %u</forcedlogin_cmd>
+	<user_cmd>/usr/bin/getent passwd %u</user_cmd>
+
+	<install>/usr/lib/brand/lx/lx_install %z %R</install>
+	<installopts>d:hsvX</installopts>
+	<boot>/usr/lib/brand/lx/lx_boot %z %R</boot>
+	<halt>/usr/lib/brand/lx/lx_support halt %R %z</halt>
+	<verify_cfg>/usr/lib/brand/lx/lx_support verify</verify_cfg>
+	<verify_adm></verify_adm>
+	<postclone></postclone>
+	<postinstall></postinstall>
+
+	<privilege set="default" name="contract_event" />
+	<privilege set="default" name="contract_identity" />
+	<privilege set="default" name="contract_observer" />
+	<privilege set="default" name="dtrace_proc" />
+	<privilege set="default" name="dtrace_user" />
+	<privilege set="default" name="file_chown" />
+	<privilege set="default" name="file_chown_self" />
+	<privilege set="default" name="file_dac_execute" />
+	<privilege set="default" name="file_dac_read" />
+	<privilege set="default" name="file_dac_search" />
+	<privilege set="default" name="file_dac_write" />
+	<privilege set="default" name="file_owner" />
+	<privilege set="default" name="file_setid" />
+	<privilege set="default" name="ipc_dac_read" />
+	<privilege set="default" name="ipc_dac_write" />
+	<privilege set="default" name="ipc_owner" />
+	<privilege set="default" name="net_bindmlp" />
+	<privilege set="default" name="net_icmpaccess" />
+	<privilege set="default" name="net_mac_aware" />
+	<privilege set="default" name="net_privaddr" />
+	<privilege set="default" name="net_rawaccess" ip-type="exclusive" />
+	<privilege set="default" name="proc_chroot" />
+	<privilege set="default" name="sys_audit" />
+	<privilege set="default" name="proc_audit" />
+	<privilege set="default" name="proc_lock_memory" />
+	<privilege set="default" name="proc_owner" />
+	<privilege set="default" name="proc_secflags" />
+	<privilege set="default" name="proc_setid" />
+	<privilege set="default" name="proc_prioup" />
+	<privilege set="default" name="proc_taskid" />
+	<privilege set="default" name="sys_acct" />
+	<privilege set="default" name="sys_admin" />
+	<privilege set="default" name="sys_ip_config" ip-type="exclusive" />
+	<privilege set="default" name="sys_iptun_config" ip-type="exclusive" />
+	<privilege set="default" name="sys_mount" />
+	<privilege set="default" name="sys_nfs" />
+	<privilege set="default" name="sys_resource" />
+	<privilege set="default" name="sys_ppp_config" ip-type="exclusive" />
+
+	<privilege set="prohibited" name="dtrace_kernel" />
+	<privilege set="prohibited" name="proc_zone" />
+	<privilege set="prohibited" name="sys_config" />
+	<privilege set="prohibited" name="sys_devices" />
+	<privilege set="prohibited" name="sys_ip_config" ip-type="shared" />
+	<privilege set="prohibited" name="sys_linkdir" />
+	<privilege set="prohibited" name="sys_net_config" />
+	<privilege set="prohibited" name="sys_ppp_config" ip-type="shared" />
+	<privilege set="prohibited" name="sys_res_config" />
+	<privilege set="prohibited" name="sys_suser_compat" />
+	<privilege set="prohibited" name="xvm_control" />
+	<privilege set="prohibited" name="virt_manage" />
+
+	<privilege set="required" name="proc_exec" />
+	<privilege set="required" name="proc_fork" />
+	<privilege set="required" name="sys_ip_config" ip-type="exclusive" />
+	<privilege set="required" name="sys_mount" />
+</brand>
diff --git a/usr/src/lib/brand/lx/zone/lx_boot.ksh b/usr/src/lib/brand/lx/zone/lx_boot.ksh
new file mode 100644
index 0000000000..da93e03733
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/lx_boot.ksh
@@ -0,0 +1,95 @@
+#!/bin/ksh -p
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015, Joyent, Inc.
+# Copyright 2017 ASS-Einrichtungssysteme GmbH, Inc.
+#
+# lx boot script.
+#
+# The arguments to this script are the zone name and the zonepath.
+#
+
+. /usr/lib/brand/shared/common.ksh
+
+ZONENAME=$1
+ZONEPATH=$2
+ZONEROOT=$ZONEPATH/root
+
+w_missing=$(gettext "Warning: \"%s\" is not installed in the global zone")
+
+arch=`uname -p`
+if [ "$arch" = "i386" ]; then
+	ARCH32=i86
+        ARCH64=amd64
+else
+        echo "Unsupported architecture: $arch"
+        exit 2
+fi
+
+#
+# Run the lx_support boot hook.
+#
+/usr/lib/brand/lx/lx_support boot $ZONEPATH $ZONENAME
+if (( $? != 0 )) ; then
+        exit 1
+fi
+
+BRANDDIR=/native/usr/lib/brand/lx;
+EXIT_CODE=1
+
+#
+# Before we boot we validate and fix, if necessary, the required files within
+# the zone.  These modifications can be lost if a patch or upgrade is applied
+# within the zone, so we validate and fix the zone every time it boots.
+#
+
+#
+# Determine the distro.
+#
+distro=""
+if [[ $(zonecfg -z $ZONENAME info attr name=docker) =~ "value: true" ]]; then
+	distro="docker"
+elif [[ -f $ZONEROOT/etc/redhat-release ]]; then
+	distro="redhat"
+elif [[ -f $ZONEROOT/etc/lsb-release ]]; then
+	if egrep -s Ubuntu $ZONEROOT/etc/lsb-release; then
+		distro="ubuntu"
+	elif [[ -f $ZONEROOT/etc/debian_version ]]; then
+		distro="debian"
+	fi
+elif [[ -f $ZONEROOT/etc/debian_version ]]; then
+	distro="debian"
+elif [[ -f $ZONEROOT/etc/alpine-release ]]; then
+	distro="busybox"
+elif [[ -f $ZONEROOT/etc/SuSE-release ]]; then
+	distro="suse"
+fi
+
+[[ -z $distro ]] && fatal "Unsupported distribution!"
+
+#
+# Perform distro-specific customization.
+#
+. $(dirname $0)/lx_boot_zone_${distro}
+
+exit 0
diff --git a/usr/src/lib/brand/lx/zone/lx_boot_zone_busybox.ksh b/usr/src/lib/brand/lx/zone/lx_boot_zone_busybox.ksh
new file mode 100644
index 0000000000..1ad83902bc
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/lx_boot_zone_busybox.ksh
@@ -0,0 +1,168 @@
+#!/bin/ksh -p
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# Customisation for busybox-init-based distributions.  Assumes to have been
+# sourced from lx_boot.
+#
+
+tmpfile=/tmp/lx-busybox.$$
+
+# Check that the directories we're writing to aren't symlinks outside the zone
+safe_dir /etc
+safe_dir /etc/init.d
+
+# Generate network setup script
+#
+cat > $tmpfile <<EOF
+#!/sbin/runscript
+depend() {
+    need localmount
+    after bootmisc hwdrivers modules
+    provide net
+    keyword nojail noprefix novserver
+}
+start() {
+    if [ ! -e /etc/resolv.conf ]; then
+        echo "# AUTOMATIC ZONE CONFIG" > /etc/resolv.conf
+EOF
+zonecfg -z $ZONENAME info attr name=resolvers |
+awk '
+    {
+        if ($1 == "value:") {
+            nres = split($2, resolvers, ",")
+        }
+    }
+    END {
+        for (i = 1; i <= nres; i++) {
+            printf("        echo \"nameserver %s\" >> %s\n", resolvers[i],
+                "/etc/resolv.conf")
+        }
+    }
+' >> $tmpfile
+zonecfg -z $ZONENAME info attr name=dns-domain |
+awk '
+    {
+        if ($1 == "value:") {
+            dom = $2
+        }
+    }
+    END {
+        printf("        echo \"search %s\" >> %s\n", dom, "/etc/resolv.conf")
+    }
+' >> $tmpfile
+cat >> $tmpfile <<EOF
+    fi
+    return 0
+}
+stop() {
+    return 0
+}
+EOF
+fnm=$ZONEROOT/etc/init.d/networking
+if [[ -f $fnm || -h $fnm ]]; then
+	mv -f $tmpfile $fnm
+	chmod 755 $fnm
+fi
+
+
+#
+# The default /etc/inittab might spawn mingetty on each of the virtual consoles
+# as well as xdm on the X console.  Since we don't have virtual consoles nor
+# an X console, spawn a single mingetty on /dev/console instead.
+#
+# Don't bother changing the file if it looks like we already did.
+#
+fnm=$ZONEROOT/etc/inittab
+if ! egrep -s "Modified by lx brand" $fnm; then
+	sed 's/^tty[1-6]:/# Disabled by lx brand: &/' \
+	    $fnm > $tmpfile
+	echo "console::respawn:/sbin/getty 38400 console" >> $tmpfile
+	echo "# Modified by lx brand" >> $tmpfile
+
+	if [[ ! -h $fnm ]]; then
+		mv -f $tmpfile $fnm
+		chmod 644 $fnm
+	fi
+fi
+
+#
+# The following scripts attempt to start services or otherwise configure the
+# system in ways incompatible with zones, so replace them with stubs.
+#
+
+fnm=$ZONEROOT/etc/init.d/fsck
+[[ ! -h $fnm && -f $fnm ]] && cat <<DONE > $fnm
+#!/sbin/runscript
+
+depend() {
+    use dev clock modules
+}
+
+start() {
+    return 0
+}
+DONE
+
+fnm=$ZONEROOT/etc/init.d/hwclock
+[[ ! -h $fnm && -f $fnm ]] && cat <<DONE > $fnm
+#!/sbin/runscript
+
+depend() {
+    provide clock
+}
+
+start() {
+    return 0
+}
+DONE
+
+fnm=$ZONEROOT/etc/init.d/klogd
+[[ ! -h $fnm && -f $fnm ]] && cat <<DONE > $fnm
+#!/sbin/runscript
+
+depend() {
+    need clock hostname localmount
+    before net
+}
+
+start() {
+    return 0
+}
+DONE
+
+fnm=$ZONEROOT/etc/init.d/sysfs
+[[ ! -h $fnm && -f $fnm ]] && cat <<DONE > $fnm
+#!/sbin/runscript
+
+depend() {
+}
+
+start() {
+    return 0
+}
+DONE
+
+#
+# Setup for the /dev/shm mount.
+#
+fnm=$ZONEROOT/etc/fstab
+entry=$(awk '{if ($2 == "/dev/shm") print $2}' $fnm)
+if [[ -z "$entry" && ! -h $fnm ]]; then
+    echo "swapfs    /dev/shm    tmpfs    defaults    0 0" >> $fnm
+fi
+
+# Hand control back to lx_boot
diff --git a/usr/src/lib/brand/lx/zone/lx_boot_zone_debian.ksh b/usr/src/lib/brand/lx/zone/lx_boot_zone_debian.ksh
new file mode 100644
index 0000000000..35ae59c19c
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/lx_boot_zone_debian.ksh
@@ -0,0 +1,172 @@
+#!/bin/ksh -p
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# Customisation for Debian-based distributions.  Assumes to have been
+# sourced from lx_boot.
+#
+
+tmpfile=/tmp/lx-debian.$$
+
+
+# Check that the directories we're writing to aren't symlinks outside the zone
+safe_dir /etc
+safe_dir /etc/init.d
+safe_dir /etc/network
+safe_dir /etc/rc0.d
+safe_dir /etc/rc1.d
+safe_dir /etc/rc2.d
+safe_dir /etc/rc3.d
+safe_dir /etc/rc4.d
+safe_dir /etc/rc5.d
+safe_dir /etc/rc6.d
+safe_dir /etc/rcS.d
+safe_opt_dir /etc/selinux
+
+# Populate resolve.conf setup files
+zonecfg -z $ZONENAME info attr name=resolvers | awk '
+BEGIN {
+	print("# AUTOMATIC ZONE CONFIG")
+}
+$1 == "value:" {
+	nres = split($2, resolvers, ",");
+	for (i = 1; i <= nres; i++) {
+		print("nameserver", resolvers[i]);
+	}
+}
+' > $tmpfile
+zonecfg -z $ZONENAME info attr name=dns-domain | awk '
+$1 == "value:" {
+	dom = $2
+}
+END {
+	print("search", dom);
+}
+' >> $tmpfile
+fnm=$ZONEROOT/etc/resolv.conf
+if [[ -f $fnm || -h $fnm ]]; then
+	mv -f $tmpfile $fnm
+fi
+
+# Override network configuration
+zonecfg -z $ZONENAME info net | awk '
+BEGIN {
+	print("# AUTOMATIC ZONE CONFIG")
+	print("iface lo inet manual");
+}
+$1 == "physical:" {
+	print("iface", $2, "inet manual");
+}
+' > $tmpfile
+fnm=$ZONEROOT/etc/network/interfaces
+if [[ -f $fnm || -h $fnm ]]; then
+	mv -f $tmpfile $fnm
+fi
+
+#
+# The default /etc/inittab might spawn mingetty on each of the virtual consoles
+# as well as xdm on the X console.  Since we don't have virtual consoles nor
+# an X console, spawn a single mingetty on /dev/console instead.
+#
+# Don't bother changing the file if it looks like we already did.
+#
+fnm=$ZONEROOT/etc/inittab
+if ! egrep -s "Modified by lx brand" $fnm; then
+	sed 's/^[1-6]:/# Disabled by lx brand: &/' \
+	    $fnm > $tmpfile
+	echo "1:2345:respawn:/sbin/getty 38400 console" >> $tmpfile
+	echo "# Modified by lx brand" >> $tmpfile
+
+	if [[ ! -h $fnm ]]; then
+		mv -f $tmpfile $fnm
+		chmod 644 $fnm
+	fi
+fi
+
+# The Debian init uses a combination of traditional rc-style service
+# definitions and upstart-style definitions.
+
+#
+# The following rc-style scripts attempt to start services or otherwise
+# configure the system in ways incompatible with zones, so don't execute them
+# at boot time.
+#
+unsupported_rc_services="
+	checkfs.sh
+	checkroot.sh
+	hwclock.sh
+	kmod
+	mtab.sh
+	procps
+	udev
+	udev-mtab
+"
+
+for file in $unsupported_rc_services; do
+	rm -f $ZONEROOT/etc/init.d/$file
+
+	rc_files="$(echo $ZONEROOT/etc/rc[0-6S].d/[SK]+([0-9])$file)"
+
+	if [[ "$rc_files" != \
+	    "$ZONEROOT/etc/rc[0-6S].d/[SK]+([0-9])$file" ]]; then
+		for file in $rc_files; do
+			rm -f "$file"
+		done
+	fi
+done
+
+disable_svc()
+{
+	fnm=$ZONEROOT/etc/init/$1.override
+	[[ -h $fnm || -f $fnm ]] && return
+	echo "manual" > $fnm
+}
+
+
+#
+# Now customize upstart
+#
+
+RMSVCS="
+	network-interface-security
+	udev
+	udevmonitor
+	udevtrigger
+	udev-fallback-graphics
+	udev-finish
+"
+for f in $RMSVCS
+do
+	disable_svc $f
+done
+
+#
+# We need to setup for the /dev/shm mount. Unlike some other distros, Debian
+# can handle it as either /dev/shm or /run/shm. For simplicity we create an
+# fstab entry to force it into the /dev/shm style.
+#
+fnm=$ZONEROOT/etc/fstab
+entry=$(awk '{if ($2 == "/dev/shm") print $2}' $fnm)
+if [[ -z "$entry" && ! -h $fnm ]]; then
+    echo "swapfs    /dev/shm    tmpfs    defaults    0 0" >> $fnm
+fi
+
+#
+# upstart modifications are complete
+#
+rm -f $tmpfile
+
+# Hand control back to lx_boot
diff --git a/usr/src/lib/brand/lx/zone/lx_boot_zone_redhat.ksh b/usr/src/lib/brand/lx/zone/lx_boot_zone_redhat.ksh
new file mode 100644
index 0000000000..566b401c18
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/lx_boot_zone_redhat.ksh
@@ -0,0 +1,361 @@
+#!/bin/ksh -p
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+# Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+#
+# Since CentOS, Red Hat Enterprise Linux, and Fedora all use approximately
+# the same source, this file should be good for all three.
+#
+# Currently, this file assumed a pre-systemd existence, so this should be
+# CentOS 6.x or earlier.  Testing has been done on CentOS 6.6.
+#
+
+tmpfile=/tmp/lx-redhat.$$
+
+
+# Before doing anything else, make sure some Centos-specific dirs are safe.
+# /etc/init.d is normally a symlink so we can't easily tell if it's safe so
+# check rc.d/init.d instead.
+
+safe_dir /etc/sysconfig
+safe_dir /etc/rc.d
+safe_dir /etc/rc.d/init.d
+safe_dir /etc/rc.d/rc0.d
+safe_dir /etc/rc.d/rc1.d
+safe_dir /etc/rc.d/rc2.d
+safe_dir /etc/rc.d/rc3.d
+safe_dir /etc/rc.d/rc4.d
+safe_dir /etc/rc.d/rc5.d
+safe_dir /etc/rc.d/rc6.d
+safe_opt_dir /etc/selinux
+
+# Generate the /etc/rc.d/init.d/network rc script
+cat > $tmpfile <<EOF
+#!/bin/bash
+# network       Bring up/down networking
+#
+### BEGIN INIT INFO
+# Provides: \$network
+# Short-Description: Bring up/down networking
+# Description: Bring up/down networking
+### END INIT INFO
+
+case "\$1" in
+    start)
+    [ "\$EUID" != "0" ] && exit 4
+
+    if [ ! -e /etc/resolv.conf ]; then
+        if [ -h /etc/resolv.conf ]; then
+            rm -f /etc/resolv.conf
+        fi
+        echo "# AUTOMATIC ZONE CONFIG" > /etc/resolv.conf
+EOF
+zonecfg -z $ZONENAME info attr name=resolvers |
+awk '
+    {
+        if ($1 == "value:") {
+            nres = split($2, resolvers, ",")
+        }
+    }
+    END {
+        for (i = 1; i <= nres; i++) {
+            printf("        echo \"nameserver %s\" >> %s\n", resolvers[i],
+                "/etc/resolv.conf")
+        }
+    }
+' >> $tmpfile
+zonecfg -z $ZONENAME info attr name=dns-domain |
+awk '
+    {
+        if ($1 == "value:") {
+            dom = $2
+        }
+    }
+    END {
+        printf("        echo \"search %s\" >> %s\n", dom, "/etc/resolv.conf")
+    }
+' >> $tmpfile
+cat >> $tmpfile <<EOF
+    fi
+    touch /var/lock/subsys/network
+    rc=0
+    ;;
+  stop)
+    [ "\$EUID" != "0" ] && exit 4
+
+    rm -f /var/lock/subsys/network
+    rc=0
+    ;;
+  status)
+    echo "Configured devices:"
+    echo "lo \$(cd /dev/net; ls)"
+    echo "Currently active devices:"
+    echo \$(/sbin/ip -o link show up | awk -F ": " '{ print \$2 }')
+    rc=0
+    ;;
+  restart|reload|force-reload)
+    cd "\$CWD"
+    \$0 stop
+    \$0 start
+    rc=\$?
+    ;;
+  *)
+    echo "Usage: \$0 {start|stop|status|restart|reload|force-reload}"
+    exit 2
+esac
+
+exit \$rc
+EOF
+fnm=$ZONEROOT/etc/rc.d/init.d/network
+if [[ -f $fnm || -h $fnm ]]; then
+	mv -f $tmpfile $fnm
+	chmod 755 $fnm
+fi
+
+# This is specific to a systemd-based image
+sysdir=$ZONEROOT/etc/systemd/system
+if [[ -d $ZONEROOT/etc && ! -h $ZONEROOT/etc && -d $ZONEROOT/etc/systemd &&
+    ! -h $ZONEROOT/etc/systemd && -d $sysdir && ! -h $sysdir ]]; then
+    # don't use NetworkManager
+    rm -f $sysdir/dbus-org.freedesktop.nm-dispatcher.service
+    rm -f $sysdir/multi-user.target.wants/NetworkManager.service
+    rm -f $sysdir/dbus-org.freedesktop.NetworkManager.service
+    # our network setup needs to run
+    fnm=$sysdir/multi-user.target.wants/network.service
+    if [[ ! -f $fnm ]]; then
+        ln -s /etc/rc.d/init.d/network \
+            $sysdir/multi-user.target.wants/network.service
+    fi
+fi
+
+#
+# The default /etc/inittab only sets the runlevel. Make sure it's runlevel 3
+# and not runlevel 5 (X11).
+# Don't bother changing the file if it looks like we already did.
+#
+fnm=$ZONEROOT/etc/inittab
+if ! egrep -s "Modified by lx brand" $fnm; then
+	sed 's/^id:5:initdefault:/id:3:initdefault: &/' \
+	    $fnm > $tmpfile
+	echo "# Modified by lx brand" >> $tmpfile
+
+	if [[ ! -h $fnm ]]; then
+		mv -f $tmpfile $fnm
+		chmod 644 $fnm
+	fi
+fi
+
+#
+# Ensure svcs depending on $network will start.
+#
+fnm=$ZONEROOT/etc/sysconfig/network
+if ! egrep -s "NETWORKING=yes" $fnm; then
+	cfghnm=$(zonecfg -z $ZONENAME info attr name=hostname | \
+	    awk '{if ($1 == "value:") print $2}')
+	if [[ -z "$cfghnm" ]]; then
+		cfghnm=$ZONENAME
+	fi
+	if [[ ! -h $fnm ]]; then
+		cat > $fnm <<- EOF
+		NETWORKING=yes
+		HOSTNAME=$cfghnm
+		EOF
+	fi
+fi
+
+#
+# SELinux must be disabled otherwise we won't get past init.
+#
+fnm=$ZONEROOT/etc/selinux/config
+if egrep -s "^SELINUX=enforcing|^SELINUX=permissive" $fnm; then
+	tmpfile=/tmp/selinux_config.$$
+
+	sed 's/^SELINUX=.*$/SELINUX=disabled/' $fnm > $tmpfile
+	if [[ ! -h $fnm ]]; then
+		mv -f $tmpfile $fnm
+		chmod 644 $fnm
+	fi
+fi
+
+#
+# /etc/rc.d/init.d/keytable tries to load a physical keyboard map, which won't
+# work in a zone. If we remove etc/sysconfig/keyboard, it won't try this at all.
+#
+fnm=$ZONEROOT/etc/sysconfig/keyboard
+if [[ ! -h $fnm ]]; then
+	rm -f $ZONEROOT/etc/sysconfig/keyboard
+fi
+
+# The Centos init uses a combination of traditional rc-style service
+# definitions and upstart-style definitions.
+
+#
+# The following rc-style scripts attempt to start services or otherwise
+# configure the system in ways incompatible with zones, so don't execute them
+# at boot time.
+#
+unsupported_rc_services="
+	acpid
+	auditd
+	gpm
+	hpoj
+	ip6tables
+	iptables
+	irda
+	irqbalance
+	iscsi
+	isdn
+	kdump
+	kudzu
+	mdmpd
+	mdmonitor
+	microcode_ctl
+	netdump
+	ntpd
+	ntpdate
+	pcmcia
+	psacct
+	quota_nld
+	random
+	rawdevices
+	smartd
+"
+
+for file in $unsupported_rc_services; do
+	rm -f $ZONEROOT/etc/rc.d/init.d/$file
+
+	rc_files="$(echo $ZONEROOT/etc/rc.d/rc[0-6].d/[SK]+([0-9])$file)"
+
+	if [[ "$rc_files" != \
+	    "$ZONEROOT/etc/rc.d/rc[0-6].d/[SK]+([0-9])$file" ]]; then
+		for file in $rc_files; do
+			rm -f "$file"
+		done
+	fi
+done
+
+disable_svc()
+{
+	# XXX - TBD does this work like on Ubuntu?
+	#
+	fnm=$ZONEROOT/etc/init/$1.override
+	[[ -h $fnm || -f $fnm ]] && return
+	echo "manual" > $fnm
+
+	# fnm=$ZONEROOT/etc/init/$1.conf
+	# rm -f $fnm
+}
+
+RMSVCS="control-alt-delete
+	ttyS0"
+
+#
+# Now customize upstart services
+#
+
+for f in $RMSVCS
+do
+	disable_svc $f
+done
+
+if [[ ! -f $ZONEROOT/etc/init/tty.override ]]; then
+	cat > $ZONEROOT/etc/init/tty.override <<- EOF
+	# tty - getty
+	#
+	# This service maintains a getty on the console.
+
+	stop on runlevel [S016]
+
+	respawn
+	instance console
+	exec /sbin/mingetty console
+	EOF
+fi
+
+if [[ ! -f $ZONEROOT/etc/init/start-ttys.override ]]; then
+	cat > $ZONEROOT/etc/init/start-ttys.override <<- EOF
+	# This service starts the configured number of gettys.
+	#
+
+	start on stopped rc RUNLEVEL=[2345]
+
+	task
+	script
+		initctl start tty
+	end script
+	EOF
+fi
+
+#
+# There is a lot of stuff in the standard halt and reboot scripts that we
+# have no business running in a zone.  Fortunately, the stuff we want to
+# skip is all in one contiguous chunk.
+#
+# Don't bother to modify the file if it looks like we already did.
+#
+fnm=$ZONEROOT/etc/rc.d/init.d/halt
+if ! egrep -s "Disabled by lx brand" $fnm; then
+	awk 'BEGIN {skip = ""}
+	    /^# Save mixer/ {skip = "# Disabled by lx brand: "}
+	    /halt.local/ {skip = ""}
+	    /./ {print skip $0}' $fnm > /tmp/halt.$$
+
+	if [[ $? -eq 0 && ! -h $fnm ]]; then
+		mv -f /tmp/halt.$$ $fnm
+		chmod 755 $fnm
+	fi
+fi
+
+#
+# Fix up /etc/rc.d/rc.sysinit:
+#
+# 1) /sbin/hwclock requires the iopl() system call, which BrandZ won't support.
+#    Since the hardware clock cannot be set from within a zone, we comment out
+#    the line.
+#
+# 2) Disable dmesg commands, since we don't implement klogctl
+#
+# 3) Disable initlog and the mount of /dev/pts
+#
+# 4) Don't touch /dev/tty* in order to start virtual terminals, as that won't
+#    work from within a zone.
+#
+# 5) Don't try to check the root filesystem (/) as there is no associated
+#    physical device, and any attempt to run fsck will fail.
+#
+fnm=$ZONEROOT/etc/rc.d/rc.sysinit
+tmpfile=/tmp/lx_rc.sysinit.$$
+
+sed 's@^/sbin/hwclock@# lx: &@
+    s@^/bin/dmesg -n@# lx: &@
+    s@^dmesg -s@# lx: &@
+    s@^initlog -c \"fsck@# lx: &@
+    s@^mount -n -o remount /dev/shm @mount -t tmpfs tmpfs /dev/shm @
+    s@^mount .* /dev/pts@# lx: &@
+    /^#remount \/dev\/shm/d' \
+    $fnm > $tmpfile
+
+if [[ ! -h $fnm ]]; then
+	mv -f $tmpfile $fnm
+	chmod 755 $fnm
+fi
+
+#
+# sysinit modifications are complete
+#
+rm -f $tmpfile
+
+# Hand control back to lx_boot
diff --git a/usr/src/lib/brand/lx/zone/lx_boot_zone_suse.ksh b/usr/src/lib/brand/lx/zone/lx_boot_zone_suse.ksh
new file mode 100644
index 0000000000..dd8b4e3721
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/lx_boot_zone_suse.ksh
@@ -0,0 +1,213 @@
+#!/bin/ksh -p
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2017 Joyent, Inc.
+# Copyright 2017 ASS-Einrichtungssysteme GmbH, Inc.
+#
+
+#
+# Customisation for SuSE-based distributions.  Assumes to have been
+# sourced from lx_boot.
+#
+
+tmpfile=/tmp/lx-suse.$$
+
+
+# Check that the directories we're writing to aren't symlinks outside the zone
+safe_dir /etc
+safe_dir /etc/init.d
+safe_dir /etc/rc.d/rc0.d
+safe_dir /etc/rc.d/rc1.d
+safe_dir /etc/rc.d/rc2.d
+safe_dir /etc/rc.d/rc3.d
+safe_dir /etc/rc.d/rc4.d
+safe_dir /etc/rc.d/rc5.d
+safe_dir /etc/rc.d/rc6.d
+safe_dir /etc/rc.d/rcS.d
+safe_dir /etc/sysconfig
+safe_dir /etc/sysconfig/network
+safe_opt_dir /etc/systemd
+safe_opt_dir /etc/systemd/system
+safe_opt_dir /etc/systemd/system/multi-user.target.wants
+safe_opt_dir /etc/systemd/system/network-online.target.wants
+safe_dir /etc/YaST2
+safe_opt_dir /etc/selinux
+
+# Populate resolve.conf setup files
+zonecfg -z $ZONENAME info attr name=resolvers | awk '
+BEGIN {
+	print("# AUTOMATIC ZONE CONFIG")
+}
+$1 == "value:" {
+	nres = split($2, resolvers, ",");
+	for (i = 1; i <= nres; i++) {
+		print("nameserver", resolvers[i]);
+	}
+}
+' > $tmpfile
+zonecfg -z $ZONENAME info attr name=dns-domain | awk '
+$1 == "value:" {
+	dom = $2
+}
+END {
+	print("search", dom);
+}
+' >> $tmpfile
+fnm=$ZONEROOT/etc/resolv.conf
+if [[ -f $fnm || -h $fnm ]]; then
+	mv -f $tmpfile $fnm
+fi
+
+# network configuration
+netdir="$ZONEROOT/etc/sysconfig/network"
+
+# first cleanup potentially obsolete configuration
+rm -f $netdir/ifcfg-*
+
+# Override network configuration for Loopback (lo) configuration
+cat <<LOEOF > $netdir/ifcfg-lo
+# AUTOMATIC ZONE CONFIG
+IPADDR=127.0.0.1/8
+NETMASK=255.0.0.0
+NETWORK=127.0.0.0
+STARTMODE=nfsroot
+BOOTPROTO=static
+USERCONTROL=no
+FIREWALL=no
+LOEOF
+
+zonecfg -z $ZONENAME info net | awk -v npath=$netdir '
+$1 == "physical:" {
+    fname = npath "/ifcfg-" $2
+    print("# Automatic zone config for interface:", $2) > fname
+    print("STARTMODE=auto") >> fname
+    print("BOOTPROTO=dhcp4") >> fname
+}
+$1 == "property:" && $2 == "(name=primary,value=\"true\")" {
+    print("DHCLIENT_SET_DEFAULT_ROUTE=yes") >> fname
+}'
+
+# This is specific to a systemd-based image
+sysdir="$ZONEROOT/etc/systemd/system"
+if [[ -d $sysdir ]]; then
+    # don't use NetworkManager wickedd service units
+    rm -f $sysdir/dbus-org.opensuse.Network.AUTO4.service
+    rm -f $sysdir/dbus-org.opensuse.Network.DHCP4.service
+    rm -f $sysdir/dbus-org.opensuse.Network.DHCP6.service
+    rm -f $sysdir/dbus-org.opensuse.Network.Nanny.service
+    rm -f $sysdir/network-online.target.wants/wicked.service
+    rm -f $sysdir/multi-user.target.wants/wicked.service
+    # our network setup needs to run
+    fnm=$sysdir/multi-user.target.wants/network.service
+    if [[ ! -f $fnm ]]; then
+        ln -s /usr/lib/systemd/system/wicked.service \
+            $sysdir/network.service
+    fi
+    # disable purge-kernels.service
+    rm -f $sysdir/multi-user.target.wants/purge-kernels.service
+fi
+
+#
+# The default /etc/inittab might spawn mingetty on each of the virtual consoles
+# as well as xdm on the X console.  Since we don't have virtual consoles nor
+# an X console, spawn a single mingetty on /dev/console instead.
+#
+# Don't bother changing the file if it looks like we already did.
+#
+fnm=$ZONEROOT/etc/inittab
+if ! egrep -s "Modified by lx brand" $fnm; then
+	sed 's/^[1-6]:/# Disabled by lx brand: &/' \
+	    $fnm > $tmpfile
+	echo "1:2345:respawn:/sbin/getty 38400 console" >> $tmpfile
+	echo "# Modified by lx brand" >> $tmpfile
+
+	if [[ ! -h $fnm ]]; then
+		mv -f $tmpfile $fnm
+		chmod 644 $fnm
+	fi
+fi
+
+# The SuSE init uses a combination of traditional rc-style service
+# definitions and systemd-style definitions.
+
+#
+# The following rc-style scripts attempt to start services or otherwise
+# configure the system in ways incompatible with zones, so don't execute them
+# at boot time.
+#
+unsupported_rc_services="
+	checkfs.sh
+	checkroot.sh
+	hwclock.sh
+	kmod
+	mtab.sh
+	procps
+	udev
+	udev-mtab
+"
+
+for file in $unsupported_rc_services; do
+	rm -f $ZONEROOT/etc/init.d/$file
+
+	rc_files="$(echo $ZONEROOT/etc/rc[0-6S].d/[SK]+([0-9])$file)"
+
+	if [[ "$rc_files" != \
+	    "$ZONEROOT/etc/rc[0-6S].d/[SK]+([0-9])$file" ]]; then
+		for file in $rc_files; do
+			rm -f "$file"
+		done
+	fi
+done
+
+disable_svc()
+{
+	fnm=$ZONEROOT/etc/init/$1.override
+	[[ -h $fnm || -f $fnm ]] && return
+	echo "manual" > $fnm
+}
+
+
+#
+# Now customize systemd
+#
+
+RMSVCS="
+	network-interface-security
+	udev
+	udevmonitor
+	udevtrigger
+	udev-fallback-graphics
+	udev-finish
+"
+for f in $RMSVCS
+do
+	disable_svc $f
+done
+
+#
+# We need to setup for the /dev/shm mount. Unlike some other distros, SuSE
+# can handle it as either /dev/shm or /run/shm. For simplicity we create an
+# fstab entry to force it into the /dev/shm style.
+#
+fnm=$ZONEROOT/etc/fstab
+entry=$(awk '{if ($2 == "/dev/shm") print $2}' $fnm)
+if [[ -z "$entry" && ! -h $fnm ]]; then
+    echo "swapfs    /dev/shm    tmpfs    defaults    0 0" >> $fnm
+fi
+
+#
+# systemd modifications are complete
+#
+rm -f $tmpfile
+
+# Hand control back to lx_boot
diff --git a/usr/src/lib/brand/lx/zone/lx_boot_zone_ubuntu.ksh b/usr/src/lib/brand/lx/zone/lx_boot_zone_ubuntu.ksh
new file mode 100644
index 0000000000..27d047e4ca
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/lx_boot_zone_ubuntu.ksh
@@ -0,0 +1,139 @@
+#!/bin/ksh -p
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# Customisation for Ubuntu-based distributions.  Assumes to have been
+# sourced from lx_boot.
+#
+tmpfile=/tmp/lx-ubuntu.$$
+
+# Check that the directories we're writing to aren't symlinks outside the zone
+safe_dir /etc
+safe_dir /etc/init
+safe_dir /etc/resolvconf
+safe_dir /etc/resolvconf/resolv.conf.d
+safe_dir /etc/network
+safe_dir /etc/network/interfaces.d
+safe_dir /etc/network/interfaces.d/smartos
+
+# Populate resolve.conf setup files
+zonecfg -z $ZONENAME info attr name=resolvers | awk '
+BEGIN {
+	print("# AUTOMATIC ZONE CONFIG")
+}
+$1 == "value:" {
+	nres = split($2, resolvers, ",");
+	for (i = 1; i <= nres; i++) {
+		print("nameserver", resolvers[i]);
+	}
+}
+' > $tmpfile
+zonecfg -z $ZONENAME info attr name=dns-domain | awk '
+$1 == "value:" {
+	dom = $2
+}
+END {
+	print("search", dom);
+}
+' >> $tmpfile
+fnm=$ZONEROOT/etc/resolvconf/resolv.conf.d/tail
+if [[ -f $fnm || -h $fnm || ! -e $fnm ]]; then
+	mv -f $tmpfile $fnm
+fi
+
+# Override network configuration
+zonecfg -z $ZONENAME info net | awk '
+BEGIN {
+	print("# AUTOMATIC ZONE CONFIG")
+}
+$1 == "physical:" {
+	print("iface", $2, "inet manual");
+}
+' > $tmpfile
+fnm=$ZONEROOT/etc/network/interfaces.d/smartos
+if [[ -f $fnm || -h $fnm ]]; then
+	mv -f $tmpfile $fnm
+fi
+
+src_fnm=$ZONEROOT/etc/init/console.conf
+tgt_fnm=$ZONEROOT/etc/init/console.override
+if [[ -f $src_fnm && ! -f $tgt_fnm && ! -h $tgt_fnm ]] then
+	sed -e 's/lxc/smartos/' $src_fnm > /tmp/console.conf.$$
+	mv /tmp/console.conf.$$ $tgt_fnm
+fi
+
+fnm=$ZONEROOT/etc/init/container-detect.override
+if [[ ! -f $fnm && ! -h $fnm ]] then
+	cat <<'DONE' > $fnm
+description "Track if upstart is running in a container"
+
+start on mounted MOUNTPOINT=/run
+
+env container
+env LIBVIRT_LXC_UUID
+
+emits container
+
+pre-start script
+    container=smartos
+    echo "$container" > /run/container_type || true
+    initctl emit --no-wait container CONTAINER=$container
+    exit 0
+end script
+DONE
+fi
+
+# XXX need to add real mounting into this svc definition
+
+fnm=$ZONEROOT/etc/init/mountall.override
+if [[ ! -h $fnm ]] then
+	cat <<DONE > $fnm
+description	"Mount filesystems on boot"
+
+start on startup
+
+task
+
+emits virtual-filesystems
+emits local-filesystems
+emits remote-filesystems
+emits all-swaps
+emits filesystem
+emits mounted
+
+script
+    echo "/dev/zfsds0 / zfs rw 0 0" > /etc/mtab
+    echo "proc /proc proc rw,noexec,nosuid,nodev 0 0" >> /etc/mtab
+
+    /sbin/initctl emit --no-wait virtual-filesystems
+    /bin/mount -t tmpfs tmpfs /dev/shm || true
+    /bin/mount -t tmpfs tmpfs /run || true
+    /bin/mkdir -p /run/lock || true
+    /bin/ln -s /dev/shm /run/shm || true
+    /sbin/initctl emit --no-wait mounted MOUNTPOINT=/run TYPE=tmpfs
+    /sbin/initctl emit --no-wait local-filesystems
+    /sbin/initctl emit --no-wait all-swaps
+    /sbin/initctl emit --no-wait filesystem
+end script
+DONE
+fi
+
+#
+# upstart modifications are complete
+#
+rm -f $tmpfile
+
+# Hand control back to lx_boot
diff --git a/usr/src/lib/brand/lx/zone/lx_install.ksh b/usr/src/lib/brand/lx/zone/lx_install.ksh
new file mode 100644
index 0000000000..c31b8355ac
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/lx_install.ksh
@@ -0,0 +1,194 @@
+#!/bin/ksh -p
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright 2016 Joyent, Inc.  All rights reserved.
+#
+
+#
+# This is only an example install script. It is not currently used for anything.
+#
+
+PATH=/bin:/usr/bin:/usr/sbin
+export PATH
+
+fullpath()
+{
+	typeset path="$1"
+
+	echo $path | egrep -s "^/" || path="${PWD:=$(pwd)}/$path"
+	echo $path
+}
+
+makedir()
+{
+	typeset dirname=$(fullpath "$1")
+	typeset mode=""
+
+	[[ $# -eq 2 ]] && mode="-m $2"
+
+	[[ -d "$dirname" ]] && return
+
+	if ! mkdir $mode -p "$dirname"; then
+		echo $(gettext "Aborting installation...")
+		exit 255
+	fi
+}
+
+symlink()
+{
+	typeset src="$1"
+	typeset dst=$(fullpath "$2")
+
+	[[ -e "$dst" || -h "$dst" ]] && rm -f "$dst"
+	
+	if ! ln -s "$src" "$dst"; then
+		echo $(gettext "Aborting installation...")
+		exit 255
+	fi
+}
+
+install_ln()
+{
+	typeset source="$1"
+	typeset target=$(fullpath "$2")
+
+	log "    Installing \"$target\""
+
+	mv -f "$target" "$target.$tag" 2>/dev/null
+
+	if ! ln -s "$source" "$target"; then
+		return 1
+	fi
+
+	return 0
+}
+
+# If we weren't passed 3 arguments, exit now.
+[[ $# -lt 3 ]] && exit 254
+
+# Extract the brand directory name from the path.
+branddir=$(dirname "$0")
+zonename="$1"
+zoneroot="$2"
+install_src="3"
+install_root="$zoneroot/root"
+ZPOOL=`df $ZONEROOT | awk -F '[()]' '{split($2, field, "/"); print field[1]; }'`
+if [ -z "$ZPOOL" ]; then
+	ROOTDEV="none"
+else
+	ROOTDEV="/dev/$ZPOOL"
+fi
+
+if [[ ! -f "$install_src" ]]; then
+	echo "$install_src: file not found\n"
+	exit 254
+fi
+
+if [[ ! -d "$install_root" ]]; then
+	if ! mkdir -p "$install_root" 2>/dev/null; then
+		echo "Could not create install directory $install_root"
+		exit 254
+	fi
+fi
+
+if ! ( cd "$install_root" && gtar -xzf "$install_src" ) ; then
+	echo "Error: extraction from tar archive failed"
+	exit 255
+fi
+
+tag="lxsave_$(date +%m.%d.%Y@%T)"
+
+if [[ ! -d "$install_root" ]]; then
+	exit 255
+fi
+
+cd "$install_root"
+
+makedir native/dev
+makedir native/etc/default
+makedir native/etc/svc/volatile
+makedir native/lib
+makedir native/proc
+makedir native/tmp 1777
+makedir native/usr
+makedir native/var
+
+makedir mnt
+makedir opt
+makedir usr/local/bin
+makedir usr/local/include
+makedir usr/local/lib
+makedir usr/local/sbin
+makedir usr/local/share
+makedir usr/local/src
+
+makedir dev 0755
+makedir tmp 1777
+makedir proc 0555
+makedir boot 0755
+
+symlink /bin/sh sbin/sh
+symlink /bin/su usr/bin/su
+symlink /native/usr/lib/ld.so.1 usr/lib/ld.so.1
+
+libpam_so="$(echo lib/libpam.so.0.*)"
+libpam_misc="$(echo lib/libpam_misc.so.0.*)"
+libpamc_so="$(echo lib/libpamc.so.0.*)"
+
+symlink "/$libpam_so" lib/libpam.so.0
+symlink "/$libpam_misc" lib/libpam_misc.so.0
+symlink "/$libpamc_so" lib/libpamc.so.0
+
+makedir var/ld
+
+if ! crle -c var/ld/ld.config -l /native/lib:/native/usr/lib \
+     -s /native/lib/secure:/native/usr/lib/secure; then
+	exit 255
+fi
+
+mv -f etc/fstab etc/fstab.$tag 2>/dev/null
+
+cat > etc/fstab <<- EOF
+	$ROOTDEV	/			zfs	defaults	1 1
+	proc		/proc			proc	defaults	0 0
+EOF
+
+if [[ $? -ne 0 ]]; then
+	exit 255
+fi
+
+if [[ ! -e "$install_root/etc/hosts" ]]; then
+	cat > "$install_root/etc/hosts" <<-_EOF_
+		127.0.0.1		localhost
+	_EOF_
+fi
+
+#
+# Perform distribution-specific changes.
+#
+distro=""
+if [[ -f etc/redhat-release ]]; then
+	distro="redhat"
+elif [[ -f etc/lsb-release ]]; then
+	if egrep -s Ubuntu etc/lsb-release; then
+		distro="ubuntu"
+	elif [[ -f etc/debian_version ]]; then
+		distro="debian"
+	fi
+elif [[ -f etc/debian_version ]]; then
+	distro="debian"
+fi
+
+if [[ -z $distro ]]; then
+	exit 255
+fi
+
+exit 0
diff --git a/usr/src/lib/brand/lx/zone/platform.xml b/usr/src/lib/brand/lx/zone/platform.xml
new file mode 100644
index 0000000000..060343e38f
--- /dev/null
+++ b/usr/src/lib/brand/lx/zone/platform.xml
@@ -0,0 +1,163 @@
+<?xml version="1.0"?>
+
+<!--
+ CDDL HEADER START
+
+ The contents of this file are subject to the terms of the
+ Common Development and Distribution License (the "License").
+ You may not use this file except in compliance with the License.
+
+ You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ or http://www.opensolaris.org/os/licensing.
+ See the License for the specific language governing permissions
+ and limitations under the License.
+
+ When distributing Covered Code, include this CDDL HEADER in each
+ file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ If applicable, add the following below this CDDL HEADER, with the
+ fields enclosed by brackets "[]" replaced with your own identifying
+ information: Portions Copyright [yyyy] [name of copyright owner]
+
+ CDDL HEADER END
+
+ Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ Use is subject to license terms.
+ Copyright 2017 Joyent, Inc.
+
+ DO NOT EDIT THIS FILE.
+-->
+
+<!DOCTYPE platform PUBLIC "-//Sun Microsystems Inc//Zones Platform//EN"
+    "file:///usr/share/lib/xml/dtd/zone_platform.dtd.1">
+
+<platform name="lx" allow-exclusive-ip="true">
+	<!-- Global filesystems to mount when booting the zone -->
+	<global_mount special="/dev" directory="/native/dev" type="dev"
+	    opt="attrdir=%R/dev" />
+
+	<!--
+	    Local filesystems to mount when booting the zone. The /native/sbin
+	    entry is needed so that we can replace ifconfig with its native
+	    counterpart (this is required for exclusive-stack zones to work).
+	    We also need dladm from /native/sbin.
+	-->
+	<global_mount special="/lib" directory="/native/lib"
+	    opt="ro" type="lofs" />
+	<global_mount special="/usr" directory="/native/usr"
+	    opt="ro" type="lofs" />
+	<global_mount special="/usr/lib/brand/lx/etc_default_nfs"
+	    directory="/native/etc/default/nfs" type="lofs" opt="ro" />
+	<global_mount special="/etc/default/dhcpagent"
+	    directory="/native/etc/default/dhcpagent" type="lofs" opt="ro" />
+	<global_mount special="/etc/netconfig"
+	    directory="/native/etc/netconfig" type="lofs" opt="ro" />
+	<global_mount special="/etc/nfssec.conf"
+	    directory="/native/etc/nfssec.conf" type="lofs" opt="ro" />
+	<global_mount special="/sbin"
+	    directory="/native/sbin" opt="ro,nodevices" type="lofs" />
+	<global_mount special="/usr/lib/brand/lx/ld" directory="/var/ld"
+	    opt="ro" type="lofs" />
+	<global_mount special="/etc/zones/%z.xml"
+	    directory="/native/etc/zones/%z.xml" opt="ro" type="lofs" />
+	<global_mount special="/var/zonecontrol/%z" directory="/native/.zonecontrol"
+	    opt="ro,nodevices,nosetuid,noexec" type="lofs" />
+
+	<!-- Local filesystems to mount when booting the zone -->
+	<mount special="/native/dev" directory="/dev" type="lx_devfs" />
+	<mount special="proc" directory="/native/proc" type="proc" />
+	<mount special="swap" directory="/native/etc/svc/volatile"
+	    type="tmpfs" />
+	<mount special="swap" directory="/native/tmp" type="tmpfs" />
+	<mount special="objfs" directory="/system/object" type="objfs" />
+	<mount special="ctfs" directory="/system/contract" type="ctfs" />
+	<mount special="mnttab" directory="/etc/mnttab" type="mntfs" />
+	<mount special="lxproc" directory="/proc" type="lx_proc" />
+
+	<!-- Devices to create under /dev -->
+	<device match="arp" />
+	<device match="dtrace/*" />
+	<device match="dtrace/provider/*" />
+	<device match="eventfd" />
+	<device match="full" />
+	<device match="inotify" />
+	<device match="ipnet" />
+	<device match="kstat" />
+	<device match="lo0" />
+	<device match="null" />
+	<device match="poll" />
+	<device match="pts/*" />
+	<device match="random" />
+	<device match="signalfd" />
+	<device match="tcp" />
+	<device match="tcp6" />
+	<device match="ticotsord" />
+	<device match="timerfd" />
+	<device match="tty" />
+	<device match="udp" />
+	<device match="udp6" />
+	<device match="urandom" />
+	<device match="zero" />
+	<device match="zfs" />
+	<device match="zvol/dsk/%P/%z/*" />
+	<device match="zvol/rdsk/%P/%z/*" />
+
+	<!-- Devices to create in exclusive IP zone only -->
+	<device match="dld" ip-type="exclusive" />
+	<device match="icmp" ip-type="exclusive" />
+	<device match="icmp6" ip-type="exclusive" />
+	<device match="ip" ip-type="exclusive" />
+	<device match="ip6" ip-type="exclusive" />
+	<device match="ipauth" ip-type="exclusive" />
+	<device match="ipf" ip-type="exclusive" />
+	<device match="ipl" ip-type="exclusive" />
+	<device match="iplookup" ip-type="exclusive" />
+	<device match="ipmpstub" ip-type="exclusive" />
+	<device match="ipnat" ip-type="exclusive" />
+	<device match="ipscan" ip-type="exclusive" />
+	<device match="ipsecah" ip-type="exclusive" />
+	<device match="ipsecesp" ip-type="exclusive" />
+	<device match="ipstate" ip-type="exclusive" />
+	<device match="ipsync" ip-type="exclusive" />
+	<device match="keysock" ip-type="exclusive" />
+	<device match="net/*" ip-type="exclusive" />
+	<device match="rawip" ip-type="exclusive" />
+	<device match="rawip6" ip-type="exclusive" />
+	<device match="rts" ip-type="exclusive" />
+	<device match="sad/admin" ip-type="exclusive" />
+	<device match="sctp" ip-type="exclusive" />
+	<device match="sctp6" ip-type="exclusive" />
+	<device match="spdsock" ip-type="exclusive" />
+	<device match="sppp" ip-type="exclusive" />
+	<device match="sppptun" ip-type="exclusive" />
+	<device match="vni" ip-type="exclusive" />
+
+	<!-- Renamed devices to create under /dev -->
+	<device match="brand/lx/autofs" name="autofs" />
+	<device match="brand/lx/ptmx" name="ptmx" />
+	<device match="zcons/%z/zoneconsole" name="console" />
+	<device match="zfd/%z/slave/0" name="zfd/0" />
+	<device match="zfd/%z/slave/1" name="zfd/1" />
+	<device match="zfd/%z/slave/2" name="zfd/2" />
+	<device match="zfd/%z/slave/3" name="zfd/3" />
+	<device match="zfd/%z/slave/4" name="zfd/4" />
+
+	<!-- Audio devices to create under /dev -->
+	<device match="brand/lx/dsp" name="dsp" />
+	<device match="brand/lx/mixer" name="mixer" />
+
+	<!-- Symlinks to create under /dev -->
+	<symlink source="fd" target="../proc/self/fd" />
+	<symlink source="stderr" target="../proc/self/fd/2" />
+	<symlink source="stdin" target="../proc/self/fd/0" />
+	<symlink source="stdout" target="../proc/self/fd/1" />
+	<symlink source="systty" target="console" />
+	<symlink source="kmsg" target="console" />
+	<symlink source="conslog" target="console" />
+
+	<!-- Create a mount point for /dev/shm tmpfs (see shm_overview(7)) -->
+	<!-- We need to force a dir for the Linux mount to work ok -->
+	<symlink source="shm/loop" target="." />
+	<!-- Create a dummy /dev/xconsole -->
+	<device match="null" name="xconsole" />
+
+</platform>
diff --git a/usr/src/lib/brand/shared/zone/common.ksh b/usr/src/lib/brand/shared/zone/common.ksh
index 3857a806cf..9d1bbbb2d6 100644
--- a/usr/src/lib/brand/shared/zone/common.ksh
+++ b/usr/src/lib/brand/shared/zone/common.ksh
@@ -19,6 +19,7 @@
 # CDDL HEADER END
 #
 # Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2014, Joyent, Inc. All rights reserved.
 #
 
 #
@@ -96,9 +97,27 @@ vlog()
 safe_dir()
 {
 	typeset dir="$1"
+	typeset pwd_dir=""
 
-	if [[ -h $ZONEROOT/$dir || ! -d $ZONEROOT/$dir ]]; then
-		fatal "$e_baddir" "$dir"
+	if [[ -d $ZONEROOT/$dir ]]; then
+		if [[ -h $ZONEROOT/$dir ]]; then
+			#
+			# When dir is a symlink to a directory, we 'cd' to that
+			# directory to ensure that's under $ZONEROOT. We use pwd
+			# from /usr/bin instead of built-in because they give
+			# different results.
+			#
+			pwd_dir=$(cd $ZONEROOT/$dir && /usr/bin/pwd)
+			if [[ $pwd_dir =~ "^$ZONEROOT" ]]; then
+				return;
+			else
+				fatal \
+				    "$e_baddir: symlink out of zoneroot" "$dir"
+			fi
+		else
+			# it's a dir and not a symlink, so that's ok.
+			return
+		fi
 	fi
 }
 
@@ -109,9 +128,7 @@ safe_opt_dir()
 
 	[[ ! -e $ZONEROOT/$dir ]] && return
 
-	if [[ -h $ZONEROOT/$dir || ! -d $ZONEROOT/$dir ]]; then
-		fatal "$e_baddir" "$dir"
-	fi
+	safe_dir $dir
 }
 
 # Only make a copy if we haven't already done so.
@@ -187,7 +204,7 @@ safe_replace()
 	fi
 
 	cat <<-END >$filename || exit 1
-	#!/bin/sh -p
+	#!/bin/sh
 	#
 	# Solaris Brand Replacement
 	#
@@ -333,10 +350,12 @@ post_unpack()
 	#
 	# Check if the image was created with a valid libc.so.1.
 	#
-	hwcap=`moe -v -32 $ZONEROOT/lib/libc.so.1 2>&1`
-	if (( $? != 0 )); then
-		vlog "$f_hwcap_info" "$hwcap"
-		fail_fatal "$f_sanity_hwcap"
+	if [[ -f $ZONEROOT/lib/libc.so.1 ]]; then
+		hwcap=`moe -v -32 $ZONEROOT/lib/libc.so.1 2>&1`
+		if (( $? != 0 )); then
+			vlog "$f_hwcap_info" "$hwcap"
+			fail_fatal "$f_sanity_hwcap"
+		fi
 	fi
 
 	( cd "$ZONEROOT" && \
@@ -1003,41 +1022,36 @@ install_image()
 	return 0
 }
 
-# Setup i18n output
-TEXTDOMAIN="SUNW_OST_OSCMD"
-export TEXTDOMAIN
-
-e_cannot_wrap=$(gettext "%s: error: wrapper file already exists")
-e_baddir=$(gettext "Invalid '%s' directory within the zone")
-e_badfile=$(gettext "Invalid '%s' file within the zone")
-e_path_abs=$(gettext "Pathname specified to -a '%s' must be absolute.")
-e_not_found=$(gettext "%s: error: file or directory not found.")
-e_install_abort=$(gettext "Installation aborted.")
-e_not_readable=$(gettext "Cannot read directory '%s'")
-e_not_dir=$(gettext "Error: must be a directory")
-e_unknown_archive=$(gettext "Error: Unknown archive format. Must be a flash archive, a cpio archive (can also be gzipped or bzipped), a pax XUSTAR archive, or a level 0 ufsdump archive.")
-e_absolute_archive=$(gettext "Error: archive contains absolute paths instead of relative paths.")
-e_mismatch_archive=$(gettext "Error: the archive top-level directory (%s) does not match the zonepath (%s).")
-e_tmpfile=$(gettext "Unable to create temporary file")
-e_root_full=$(gettext "Zonepath root %s exists and contains data; remove or move aside prior to install.")
-f_mkdir=$(gettext "Unable to create directory %s.")
-f_chmod=$(gettext "Unable to chmod directory %s.")
-f_chown=$(gettext "Unable to chown directory %s.")
-f_hwcap_info=$(gettext "HWCAP: %s\n")
-f_sanity_hwcap=$(gettext \
-"The image was created with an incompatible libc.so.1 hwcap lofs mount.\n"\
+e_cannot_wrap="%s: error: wrapper file already exists"
+e_baddir="Invalid '%s' directory within the zone"
+e_badfile="Invalid '%s' file within the zone"
+e_path_abs="Pathname specified to -a '%s' must be absolute."
+e_not_found="%s: error: file or directory not found."
+e_install_abort="Installation aborted."
+e_not_readable="Cannot read directory '%s'"
+e_not_dir="Error: must be a directory"
+e_unknown_archive="Error: Unknown archive format. Must be a flash archive, a cpio archive (can also be gzipped or bzipped), a pax XUSTAR archive, or a level 0 ufsdump archive."
+e_absolute_archive="Error: archive contains absolute paths instead of relative paths."
+e_mismatch_archive="Error: the archive top-level directory (%s) does not match the zonepath (%s)."
+e_tmpfile="Unable to create temporary file"
+e_root_full="Zonepath root %s exists and contains data; remove or move aside prior to install."
+f_mkdir="Unable to create directory %s."
+f_chmod="Unable to chmod directory %s."
+f_chown="Unable to chown directory %s."
+f_hwcap_info="HWCAP: %s\n"
+f_sanity_hwcap="The image was created with an incompatible libc.so.1 hwcap lofs mount.\n"\
 "       The zone will not boot on this platform.  See the zone's\n"\
-"       documentation for the recommended way to create the archive.")
+"       documentation for the recommended way to create the archive."
 
-m_analyse_archive=$(gettext "Analysing the archive")
+m_analyse_archive="Analysing the archive"
 
-not_readable=$(gettext "Cannot read file '%s'")
-not_flar=$(gettext "Input is not a flash archive")
-bad_flar=$(gettext "Flash archive is a corrupt")
-bad_zfs_flar=$(gettext "Flash archive contains a ZFS send stream.\n\tRecreate the flar using the -L option with cpio or pax.")
-f_unpack_failed=$(gettext "Unpacking the archive failed")
-unknown_archiver=$(gettext "Archiver %s is not supported")
-cmd_not_exec=$(gettext "Required command '%s' not executable!")
+not_readable="Cannot read file '%s'"
+not_flar="Input is not a flash archive"
+bad_flar="Flash archive is a corrupt"
+bad_zfs_flar="Flash archive contains a ZFS send stream.\n\tRecreate the flar using the -L option with cpio or pax."
+f_unpack_failed="Unpacking the archive failed"
+unknown_archiver="Archiver %s is not supported"
+cmd_not_exec="Required command '%s' not executable!"
 
 #
 # Exit values used by the script, as #defined in <sys/zone.h>
diff --git a/usr/src/lib/brand/shared/zone/uninstall.ksh b/usr/src/lib/brand/shared/zone/uninstall.ksh
index 468a7ed92f..923363c864 100644
--- a/usr/src/lib/brand/shared/zone/uninstall.ksh
+++ b/usr/src/lib/brand/shared/zone/uninstall.ksh
@@ -35,31 +35,31 @@ bname=`basename $0`
 #
 # error messages
 #
-m_usage=$(gettext "Usage: %s: [-hFn]")
-
-m_1_zfs_promote=$(gettext "promoting '%s'.")
-m_1_zfs_destroy=$(gettext "destroying '%s'.")
-m_2_zfs_rename=$(gettext "renaming '%s' to '%s'.")
-m_3_zfs_set=$(gettext "setting property %s='%s' for '%s'.")
-m_rm_r=$(gettext "recursively deleting '%s'.")
-m_rm=$(gettext "deleting '%s'.")
-
-w_no_ds=$(gettext "Warning: no zonepath dataset found.")
-
-f_usage_err=$(gettext "Error: invalid usage")
-f_abort=$(gettext "Error: internal error detected, aborting.")
-f_1_zfs_promote=$(gettext "Error: promoting ZFS dataset '%s'.")
-f_2_zfs_rename=$(gettext "Error: renaming ZFS dataset '%s' to '%s'.")
-f_3_zfs_set=$(gettext "Error: setting ZFS propery %s='%s' for '%s'.")
-f_1_zfs_destroy=$(gettext "Error: destroying ZFS dataset.")
-f_2_zfs_get=$(gettext "Error: reading ZFS dataset property '%s' from '%s'.")
-f_user_snap=$(gettext "Error: user snapshot(s) detected.")
-f_stray_snap=$(gettext "Error: uncloned snapshot(s) detected.")
-f_stray_clone=$(gettext "Error: cloned zone datasets found outsize of zone.")
-f_rm_snap=$(gettext "Error: please delete snapshot(s) and retry uninstall.")
-f_rm_clone=$(gettext "Error: please delete clone(s) and retry uninstall.")
-f_iu_clone=$(gettext "Error: cloned zone dataset(s) in use.")
-f_dis_clone=$(gettext "Error: please stop using clone(s) and retry uninstall.")
+m_usage="Usage: %s: [-hFn]"
+
+m_1_zfs_promote="promoting '%s'."
+m_1_zfs_destroy="destroying '%s'."
+m_2_zfs_rename="renaming '%s' to '%s'."
+m_3_zfs_set="setting property %s='%s' for '%s'."
+m_rm_r="recursively deleting '%s'."
+m_rm="deleting '%s'."
+
+w_no_ds="Warning: no zonepath dataset found."
+
+f_usage_err="Error: invalid usage"
+f_abort="Error: internal error detected, aborting."
+f_1_zfs_promote="Error: promoting ZFS dataset '%s'."
+f_2_zfs_rename="Error: renaming ZFS dataset '%s' to '%s'."
+f_3_zfs_set="Error: setting ZFS propery %s='%s' for '%s'."
+f_1_zfs_destroy="Error: destroying ZFS dataset."
+f_2_zfs_get="Error: reading ZFS dataset property '%s' from '%s'."
+f_user_snap="Error: user snapshot(s) detected."
+f_stray_snap="Error: uncloned snapshot(s) detected."
+f_stray_clone="Error: cloned zone datasets found outsize of zone."
+f_rm_snap="Error: please delete snapshot(s) and retry uninstall."
+f_rm_clone="Error: please delete clone(s) and retry uninstall."
+f_iu_clone="Error: cloned zone dataset(s) in use."
+f_dis_clone="Error: please stop using clone(s) and retry uninstall."
 
 #
 # functions
diff --git a/usr/src/lib/fm/topo/libtopo/common/hc.c b/usr/src/lib/fm/topo/libtopo/common/hc.c
index df718d6490..26d7b2a642 100644
--- a/usr/src/lib/fm/topo/libtopo/common/hc.c
+++ b/usr/src/lib/fm/topo/libtopo/common/hc.c
@@ -22,7 +22,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #include <stdio.h>
@@ -191,6 +191,7 @@ static const hcc_t hc_canon[] = {
 	{ SCSI_DEVICE, TOPO_STABILITY_PRIVATE },
 	{ SHELF, TOPO_STABILITY_PRIVATE },
 	{ SES_ENCLOSURE, TOPO_STABILITY_PRIVATE },
+	{ SLOT, TOPO_STABILITY_PRIVATE },
 	{ SMP_DEVICE, TOPO_STABILITY_PRIVATE },
 	{ SP, TOPO_STABILITY_PRIVATE },
 	{ STRAND, TOPO_STABILITY_PRIVATE },
@@ -232,84 +233,6 @@ hc_fini(topo_mod_t *mod)
 	topo_mod_unregister(mod);
 }
 
-
-static const topo_pgroup_info_t sys_pgroup = {
-	TOPO_PGROUP_SYSTEM,
-	TOPO_STABILITY_PRIVATE,
-	TOPO_STABILITY_PRIVATE,
-	1
-};
-
-static const topo_pgroup_info_t auth_pgroup = {
-	FM_FMRI_AUTHORITY,
-	TOPO_STABILITY_PRIVATE,
-	TOPO_STABILITY_PRIVATE,
-	1
-};
-
-static void
-hc_prop_set(tnode_t *node, nvlist_t *auth)
-{
-	int err;
-	char isa[MAXNAMELEN];
-	struct utsname uts;
-	char *prod, *psn, *csn, *server;
-
-	if (auth == NULL)
-		return;
-
-	if (topo_pgroup_create(node, &auth_pgroup, &err) != 0) {
-		if (err != ETOPO_PROP_DEFD)
-			return;
-	}
-
-	/*
-	 * Inherit if we can, it saves memory
-	 */
-	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_PRODUCT,
-	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
-		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_PRODUCT, &prod)
-		    == 0)
-			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
-			    FM_FMRI_AUTH_PRODUCT, TOPO_PROP_IMMUTABLE, prod,
-			    &err);
-	}
-	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_PRODUCT_SN,
-	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
-		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_PRODUCT_SN, &psn)
-		    == 0)
-			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
-			    FM_FMRI_AUTH_PRODUCT_SN, TOPO_PROP_IMMUTABLE, psn,
-			    &err);
-	}
-	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_CHASSIS,
-	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
-		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_CHASSIS, &csn) == 0)
-			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
-			    FM_FMRI_AUTH_CHASSIS, TOPO_PROP_IMMUTABLE, csn,
-			    &err);
-	}
-	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_SERVER,
-	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
-		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_SERVER, &server)
-		    == 0)
-			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
-			    FM_FMRI_AUTH_SERVER, TOPO_PROP_IMMUTABLE, server,
-			    &err);
-	}
-
-	if (topo_pgroup_create(node, &sys_pgroup, &err) != 0)
-		return;
-
-	isa[0] = '\0';
-	(void) sysinfo(SI_ARCHITECTURE, isa, sizeof (isa));
-	(void) uname(&uts);
-	(void) topo_prop_set_string(node, TOPO_PGROUP_SYSTEM, TOPO_PROP_ISA,
-	    TOPO_PROP_IMMUTABLE, isa, &err);
-	(void) topo_prop_set_string(node, TOPO_PGROUP_SYSTEM, TOPO_PROP_MACHINE,
-	    TOPO_PROP_IMMUTABLE, uts.machine, &err);
-}
-
 /*ARGSUSED*/
 int
 hc_enum(topo_mod_t *mod, tnode_t *pnode, const char *name, topo_instance_t min,
@@ -363,7 +286,7 @@ hc_enum(topo_mod_t *mod, tnode_t *pnode, const char *name, topo_instance_t min,
 	if (strcmp(name, MOTHERBOARD) == 0)
 		(void) topo_node_fru_set(node, nvl, 0, &err);
 
-	hc_prop_set(node, auth);
+	topo_pgroup_hcset(node, auth);
 	nvlist_free(nvl);
 	nvlist_free(auth);
 
diff --git a/usr/src/lib/fm/topo/libtopo/common/libtopo.h b/usr/src/lib/fm/topo/libtopo/common/libtopo.h
index 53458e07ef..156b04342e 100644
--- a/usr/src/lib/fm/topo/libtopo/common/libtopo.h
+++ b/usr/src/lib/fm/topo/libtopo/common/libtopo.h
@@ -365,6 +365,7 @@ extern int topo_fmri_getpgrp(topo_hdl_t *, nvlist_t *, const char *,
     nvlist_t **, int *);
 extern int topo_fmri_setprop(topo_hdl_t *, nvlist_t *, const char *,
     nvlist_t *, int, nvlist_t *, int *);
+extern void topo_pgroup_hcset(tnode_t *, nvlist_t *);
 
 /* Property node NVL names used in topo_prop_getprops */
 #define	TOPO_PROP_GROUP		"property-group"
@@ -392,6 +393,8 @@ extern void topo_hdl_free(topo_hdl_t *, void *, size_t);
 extern int topo_hdl_nvalloc(topo_hdl_t *, nvlist_t **, uint_t);
 extern int topo_hdl_nvdup(topo_hdl_t *, nvlist_t *, nvlist_t **);
 extern char *topo_hdl_strdup(topo_hdl_t *, const char *);
+extern char *topo_hdl_strsplit(topo_hdl_t *, const char *, const char *,
+    char **);
 
 /*
  * Interfaces for converting sensor/indicator types, units, states, etc to
@@ -1007,6 +1010,10 @@ typedef enum topo_led_type {
 	TOPO_LED_TYPE_PRESENT
 } topo_led_type_t;
 
+typedef enum topo_slot_type {
+	TOPO_SLOT_TYPE_DIMM = 1
+} topo_slot_type_t;
+
 
 #ifdef __cplusplus
 }
diff --git a/usr/src/lib/fm/topo/libtopo/common/mapfile-vers b/usr/src/lib/fm/topo/libtopo/common/mapfile-vers
index ca10d4fad3..0cb00e6508 100644
--- a/usr/src/lib/fm/topo/libtopo/common/mapfile-vers
+++ b/usr/src/lib/fm/topo/libtopo/common/mapfile-vers
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 #
@@ -76,6 +77,7 @@ SYMBOL_VERSION SUNWprivate {
 	topo_hdl_prominfo;
 	topo_hdl_strdup;
 	topo_hdl_strfree;
+	topo_hdl_strsplit;
 	topo_hdl_zalloc;
 	topo_led_state_name;
 	topo_led_type_name;
@@ -89,6 +91,7 @@ SYMBOL_VERSION SUNWprivate {
 	topo_method_unregister_all;
 	topo_mod_alloc;
 	topo_mod_auth;
+	topo_mod_clean_str;
 	topo_mod_clrdebug;
 	topo_mod_cpufmri;
 	topo_mod_devfmri;
@@ -119,6 +122,7 @@ SYMBOL_VERSION SUNWprivate {
 	topo_mod_str2nvl;
 	topo_mod_strdup;
 	topo_mod_strfree;
+	topo_mod_strsplit;
 	topo_mod_unload;
 	topo_mod_unregister;
 	topo_mod_walk_init;
@@ -149,6 +153,7 @@ SYMBOL_VERSION SUNWprivate {
 	topo_pgroup_create;
 	topo_pgroup_destroy;
 	topo_pgroup_info;
+	topo_pgroup_hcset;
 	topo_prop_get_fmri;
 	topo_prop_get_int32;
 	topo_prop_get_int64;
diff --git a/usr/src/lib/fm/topo/libtopo/common/topo_hc.h b/usr/src/lib/fm/topo/libtopo/common/topo_hc.h
index 8d4a4dd2a4..fdeb5f7193 100644
--- a/usr/src/lib/fm/topo/libtopo/common/topo_hc.h
+++ b/usr/src/lib/fm/topo/libtopo/common/topo_hc.h
@@ -87,6 +87,7 @@ extern "C" {
 #define	SHELF		"shelf"
 #define	SCSI_DEVICE	"scsi-device"
 #define	SES_ENCLOSURE	"ses-enclosure"
+#define	SLOT		"slot"
 #define	SMP_DEVICE	"smp-device"
 #define	SP		"sp"
 #define	SUBCHASSIS	"subchassis"
@@ -194,6 +195,56 @@ extern "C" {
  */
 #define	TOPO_PROP_IPMI_ENTITY_LIST	"entity-list"
 
+/*
+ * These properties can be used to describe the network configuration of a
+ * given hardware components.  They're currently used to describe the
+ * network config on the service processor (sp)
+ */
+#define	TOPO_PGROUP_NETCFG		"network-config"
+#define	TOPO_PROP_NETCFG_MACADDR	"mac-address"
+#define	TOPO_PROP_NETCFG_VLAN_ID	"vlan-id"
+#define	TOPO_PROP_NETCFG_IPV4_ADDR	"ipv4-address"
+#define	TOPO_PROP_NETCFG_IPV4_SUBNET	"ipv4-subnet"
+#define	TOPO_PROP_NETCFG_IPV4_GATEWAY	"ipv4-gateway"
+#define	TOPO_PROP_NETCFG_IPV4_TYPE	"ipv4-config-type"
+#define	TOPO_PROP_NETCFG_IPV6_ADDR	"ipv6-address"
+#define	TOPO_PROP_NETCFG_IPV6_ROUTES	"ipv6-routes"
+#define	TOPO_PROP_NETCFG_IPV6_TYPE	"ipv6-config-type"
+
+/* Possible values for TOPO_PROP_NETCFG_TYPE */
+#define	TOPO_NETCFG_TYPE_UNKNOWN	"unknown"
+#define	TOPO_NETCFG_TYPE_STATIC		"static"
+#define	TOPO_NETCFG_TYPE_DHCP		"dhcp"
+
+#define	TOPO_PGROUP_SLOT		"slot"
+#define	TOPO_PROP_SLOT_TYPE		"slot-type"
+
+#define	TOPO_PGROUP_DIMM_SLOT		"dimm-slot"
+#define	TOPO_PROP_DIMM_SLOT_FORM	"form-factor"
+#define	TOPO_DIMM_SLOT_FORM_DIMM	"DIMM"
+#define	TOPO_DIMM_SLOT_FORM_SODIMM	"SODIMM"
+#define	TOPO_DIMM_SLOT_FORM_FBDIMM	"FBDIMM"
+
+#define	TOPO_PGROUP_DIMM_PROPS		"dimm-properties"
+#define	TOPO_PROP_DIMM_TYPE
+#define	TOPO_DIMM_TYPE_UNKNOWN		"UNKNOWN"
+#define	TOPO_DIMM_TYPE_DDR		"DDR"
+#define	TOPO_DIMM_TYPE_DDR2		"DDR2"
+#define	TOPO_DIMM_TYPE_DDR3		"DDR3"
+#define	TOPO_DIMM_TYPE_DDR4		"DDR4"
+#define	TOPO_DIMM_TYPE_LPDDR		"LPDDR"
+#define	TOPO_DIMM_TYPE_LPDDR2		"LPDDR2"
+#define	TOPO_DIMM_TYPE_LPDDR3		"LPDDR3"
+#define	TOPO_DIMM_TYPE_LPDDR4		"LPDDR4"
+
+#define	TOPO_PGROUP_MOTHERBOARD		"motherboard-properties"
+#define	TOPO_PROP_MB_MANUFACTURER	"manufacturer"
+#define	TOPO_PROP_MB_PRODUCT		"product-id"
+#define	TOPO_PROP_MB_ASSET		"assert-tag"
+#define	TOPO_PROP_MB_FIRMWARE_VENDOR	"firmware-vendor"
+#define	TOPO_PROP_MB_FIRMWARE_REV	"firmware-revision"
+#define	TOPO_PROP_MB_FIRMWARE_RELDATE	"firmware-release-date"
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/lib/fm/topo/libtopo/common/topo_mod.c b/usr/src/lib/fm/topo/libtopo/common/topo_mod.c
index 253466aadc..72d40475f8 100644
--- a/usr/src/lib/fm/topo/libtopo/common/topo_mod.c
+++ b/usr/src/lib/fm/topo/libtopo/common/topo_mod.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -908,3 +909,12 @@ topo_mod_walk_init(topo_mod_t *mod, tnode_t *node, topo_mod_walk_cb_t cb_f,
 
 	return (wp);
 }
+
+char *
+topo_mod_clean_str(topo_mod_t *mod, const char *str)
+{
+	if (str == NULL)
+		return (NULL);
+
+	return (topo_cleanup_auth_str(mod->tm_hdl, str));
+}
diff --git a/usr/src/lib/fm/topo/libtopo/common/topo_mod.h b/usr/src/lib/fm/topo/libtopo/common/topo_mod.h
index d9501d8b7d..9986fbd89f 100644
--- a/usr/src/lib/fm/topo/libtopo/common/topo_mod.h
+++ b/usr/src/lib/fm/topo/libtopo/common/topo_mod.h
@@ -22,6 +22,9 @@
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  */
+/*
+ * Copyright (c) 2018, Joyent, Inc. All rights reserved.
+ */
 
 #ifndef _TOPO_MOD_H
 #define	_TOPO_MOD_H
@@ -217,6 +220,8 @@ extern void *topo_mod_zalloc(topo_mod_t *, size_t);
 extern void topo_mod_free(topo_mod_t *, void *, size_t);
 extern char *topo_mod_strdup(topo_mod_t *, const char *);
 extern void topo_mod_strfree(topo_mod_t *, char *);
+extern char *topo_mod_strsplit(topo_mod_t *, const char *, const char *,
+    char **);
 extern int topo_mod_nvalloc(topo_mod_t *, nvlist_t **, uint_t);
 extern int topo_mod_nvdup(topo_mod_t *, nvlist_t *, nvlist_t **);
 
@@ -225,6 +230,7 @@ extern void topo_mod_setdebug(topo_mod_t *);
 extern void topo_mod_dprintf(topo_mod_t *, const char *, ...);
 extern const char *topo_mod_errmsg(topo_mod_t *);
 extern int topo_mod_errno(topo_mod_t *);
+extern char *topo_mod_clean_str(topo_mod_t *, const char *);
 
 /*
  * Topo node utilities: callable from module enumeration, topo_mod_enumerate()
diff --git a/usr/src/lib/fm/topo/libtopo/common/topo_mod.map b/usr/src/lib/fm/topo/libtopo/common/topo_mod.map
index 82d22b87ee..c5eaab059f 100644
--- a/usr/src/lib/fm/topo/libtopo/common/topo_mod.map
+++ b/usr/src/lib/fm/topo/libtopo/common/topo_mod.map
@@ -1,5 +1,6 @@
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2018, Joyent, Inc.
 #
 # CDDL HEADER START
 #
@@ -64,6 +65,7 @@ SYMBOL_SCOPE {
 	topo_mod_nvl2str		{ TYPE = FUNCTION; FLAGS = extern };
 	topo_mod_str2nvl		{ TYPE = FUNCTION; FLAGS = extern };
 	topo_mod_auth			{ TYPE = FUNCTION; FLAGS = extern };
+	topo_mod_clean_str		{ TYPE = FUNCTION; FLAGS = extern };
 
 	topo_mod_walk_init		{ TYPE = FUNCTION; FLAGS = extern };
 
@@ -92,4 +94,5 @@ SYMBOL_SCOPE {
 	topo_prop_set_fmri_array	{ TYPE = FUNCTION; FLAGS = extern };
 	topo_prop_inherit		{ TYPE = FUNCTION; FLAGS = extern };
 	topo_pgroup_create		{ TYPE = FUNCTION; FLAGS = extern };
+	topo_pgroup_hcset		{ TYPE = FUNCTION; FLAGS = extern };
 };
diff --git a/usr/src/lib/fm/topo/libtopo/common/topo_string.c b/usr/src/lib/fm/topo/libtopo/common/topo_string.c
index 2c1f451770..2f59013e9e 100644
--- a/usr/src/lib/fm/topo/libtopo/common/topo_string.c
+++ b/usr/src/lib/fm/topo/libtopo/common/topo_string.c
@@ -23,8 +23,9 @@
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
-
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ */
 
 #include <strings.h>
 #include <ctype.h>
@@ -56,6 +57,58 @@ topo_hdl_strfree(topo_hdl_t *thp, char *s)
 }
 
 char *
+topo_hdl_strsplit(topo_hdl_t *hdl, const char *input, const char *sep,
+    char **lastp)
+{
+	size_t seplen = strlen(sep);
+	const char *scanstart;
+	char *token;
+	char *ret;
+
+	if (input != NULL) {
+		/*
+		 * Start scanning at beginning of input:
+		 */
+		scanstart = input;
+	} else if (*lastp == NULL) {
+		/*
+		 * If we have already finished scanning, return NULL.
+		 */
+		return (NULL);
+	} else {
+		/*
+		 * Otherwise, start scanning where we left off:
+		 */
+		scanstart = *lastp;
+	}
+
+	token = strstr(scanstart, sep);
+	if (token != NULL) {
+		/*
+		 * We still have a separator, so advance the next-start
+		 * pointer past it:
+		 */
+		*lastp = token + seplen;
+		/*
+		 * Copy out this element.  The buffer must fit the string
+		 * exactly, so that topo_hdl_strfree() can determine its
+		 * size with strlen().
+		 */
+		ret = topo_hdl_alloc(hdl, token - scanstart + 1);
+		(void) strncpy(ret, scanstart, token - scanstart);
+		ret[token - scanstart] = '\0';
+	} else {
+		/*
+		 * We have no separator, so this is the last element:
+		 */
+		*lastp = NULL;
+		ret = topo_hdl_strdup(hdl, scanstart);
+	}
+
+	return (ret);
+}
+
+char *
 topo_mod_strdup(topo_mod_t *mod, const char *s)
 {
 	return (topo_hdl_strdup(mod->tm_hdl, s));
@@ -67,6 +120,13 @@ topo_mod_strfree(topo_mod_t *mod, char *s)
 	topo_hdl_strfree(mod->tm_hdl, s);
 }
 
+char *
+topo_mod_strsplit(topo_mod_t *mod, const char *input, const char *sep,
+    char **lastp)
+{
+	return (topo_hdl_strsplit(mod->tm_hdl, input, sep, lastp));
+}
+
 const char *
 topo_strbasename(const char *s)
 {
diff --git a/usr/src/lib/fm/topo/libtopo/common/topo_subr.c b/usr/src/lib/fm/topo/libtopo/common/topo_subr.c
index 7a6ed4be77..8d9408dd59 100644
--- a/usr/src/lib/fm/topo/libtopo/common/topo_subr.c
+++ b/usr/src/lib/fm/topo/libtopo/common/topo_subr.c
@@ -22,6 +22,9 @@
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  */
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
 
 #include <alloca.h>
 #include <ctype.h>
@@ -29,6 +32,9 @@
 #include <syslog.h>
 #include <strings.h>
 #include <unistd.h>
+#include <sys/fm/protocol.h>
+#include <sys/systeminfo.h>
+#include <sys/utsname.h>
 
 #include <topo_error.h>
 #include <topo_subr.h>
@@ -394,7 +400,7 @@ topo_led_state_name(uint8_t type, char *buf, size_t len)
 
 void
 topo_sensor_state_name(uint32_t sensor_type, uint8_t state, char *buf,
-size_t len)
+    size_t len)
 {
 	topo_name_trans_t *ntp;
 
@@ -538,3 +544,79 @@ size_t len)
 
 	(void) snprintf(buf, len, "0x%02x", state);
 }
+
+static const topo_pgroup_info_t sys_pgroup = {
+	TOPO_PGROUP_SYSTEM,
+	TOPO_STABILITY_PRIVATE,
+	TOPO_STABILITY_PRIVATE,
+	1
+};
+static const topo_pgroup_info_t auth_pgroup = {
+	FM_FMRI_AUTHORITY,
+	TOPO_STABILITY_PRIVATE,
+	TOPO_STABILITY_PRIVATE,
+	1
+};
+
+void
+topo_pgroup_hcset(tnode_t *node, nvlist_t *auth)
+{
+	int err;
+	char isa[MAXNAMELEN];
+	struct utsname uts;
+	char *prod, *psn, *csn, *server;
+
+	if (auth == NULL)
+		return;
+
+	if (topo_pgroup_create(node, &auth_pgroup, &err) != 0) {
+		if (err != ETOPO_PROP_DEFD)
+			return;
+	}
+
+	/*
+	 * Inherit if we can, it saves memory
+	 */
+	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_PRODUCT,
+	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
+		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_PRODUCT, &prod) ==
+		    0)
+			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
+			    FM_FMRI_AUTH_PRODUCT, TOPO_PROP_IMMUTABLE, prod,
+			    &err);
+	}
+	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_PRODUCT_SN,
+	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
+		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_PRODUCT_SN, &psn) ==
+		    0)
+			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
+			    FM_FMRI_AUTH_PRODUCT_SN, TOPO_PROP_IMMUTABLE, psn,
+			    &err);
+	}
+	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_CHASSIS,
+	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
+		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_CHASSIS, &csn) == 0)
+			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
+			    FM_FMRI_AUTH_CHASSIS, TOPO_PROP_IMMUTABLE, csn,
+			    &err);
+	}
+	if ((topo_prop_inherit(node, FM_FMRI_AUTHORITY, FM_FMRI_AUTH_SERVER,
+	    &err) != 0) && (err != ETOPO_PROP_DEFD)) {
+		if (nvlist_lookup_string(auth, FM_FMRI_AUTH_SERVER, &server) ==
+		    0)
+			(void) topo_prop_set_string(node, FM_FMRI_AUTHORITY,
+			    FM_FMRI_AUTH_SERVER, TOPO_PROP_IMMUTABLE, server,
+			    &err);
+	}
+
+	if (topo_pgroup_create(node, &sys_pgroup, &err) != 0)
+		return;
+
+	if (sysinfo(SI_ARCHITECTURE, isa, sizeof (isa)) != -1)
+		(void) topo_prop_set_string(node, TOPO_PGROUP_SYSTEM,
+		    TOPO_PROP_ISA, TOPO_PROP_IMMUTABLE, isa, &err);
+
+	if (uname(&uts) != -1)
+		(void) topo_prop_set_string(node, TOPO_PGROUP_SYSTEM,
+		    TOPO_PROP_MACHINE, TOPO_PROP_IMMUTABLE, uts.machine, &err);
+}
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-1101/Joyent-Compute-Platform-1101-disk-hc-topology.xmlgenksh b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-1101/Joyent-Compute-Platform-1101-disk-hc-topology.xmlgenksh
index 000742db71..874bad142f 100644..100755
--- a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-1101/Joyent-Compute-Platform-1101-disk-hc-topology.xmlgenksh
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-1101/Joyent-Compute-Platform-1101-disk-hc-topology.xmlgenksh
@@ -69,17 +69,19 @@ EOF
 enclosure=1
 bay=0
 slot=0
-devctl='/devices/pci@0,0/pci8086,3c02@1/pci15d9,691@0:devctl'
+devctl0='/devices/pci@0,0/pci8086,3c02@1/pci15d9,691@0:devctl'
+devctl1='/devices/pci@0,0/pci8086,e02@1/pci15d9,691@0:devctl'
 while (( slot <= 7 )); do
-  do_node $bay "Front Disk $bay" "$devctl" $enclosure $slot
+  do_node $bay "Front Disk $bay" "$devctl0|$devctl1" $enclosure $slot
   (( bay = bay + 1 ))
   (( slot = slot + 1 ))
 done
 
 slot=0
-devctl='/devices/pci@0,0/pci8086,3c06@2,2/pci15d9,691@0:devctl'
+devctl0='/devices/pci@0,0/pci8086,3c06@2,2/pci15d9,691@0:devctl'
+devctl1='/devices/pci@0,0/pci8086,e06@2,2/pci15d9,691@0:devctl'
 while (( slot <= 7 )); do
-  do_node $bay "Front Disk $bay" "$devctl" $enclosure $slot
+  do_node $bay "Front Disk $bay" "$devctl0|$devctl1" $enclosure $slot
   (( bay = bay + 1 ))
   (( slot = slot + 1 ))
 done
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-3301-hc-topology.xml b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-3301-hc-topology.xml
new file mode 100644
index 0000000000..000ed261a8
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-3301-hc-topology.xml
@@ -0,0 +1,251 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+-->
+
+<topology name='i86pc' scheme='hc'>
+
+  <range name='motherboard' min='0' max='0'>
+    <enum-method name='smbios' version='1' />
+    <node instance='0' static='true'>
+        <fac-enum provider='fac_prov_ipmi' />
+        <facility name='3.3V PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='3.3V PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='5V AUX PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='5V AUX PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='1.05V PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='1.05V PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='BP0 5V PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='BP0 5V PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='5V SWITCH PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='5V SWITCH PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='VCCIO PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='VCCIO PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='NDC PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='2.5V AUX PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='1.5V PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='1.5V PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='BP1 5V PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='BP1 5V PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='BP2 5V PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='BP2 5V PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='1.5V AUX PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='1.5V AUX PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='1.05V PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='1.05V PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <facility name='DIMM PG' type='sensor' provider='fac_prov_ipmi' >
+              <propgroup name='facility' version='1' name-stability='Private'
+                data-stability='Private' >
+                    <propval name='type' type='uint32' value='269' />
+                    <propval name='sensor-class' type='string' value='discrete' />
+                    <propval name='entity_ref' type='string_array' >
+                        <propitem value='DIMM PG' />
+                    </propval>
+                    <propmethod name='ipmi_sensor_state' version='0'
+                        propname='state' proptype='uint32' >
+                    </propmethod>
+              </propgroup>
+        </facility>
+        <propgroup name='protocol' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='label' type='string' value='MB' />
+        </propgroup>
+        <propgroup name='ipmi' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='entity-id' type='uint32' value='7' />
+            <propval name='entity-instance' type='uint32' value='1' />
+            <propval name='entity-list' type='string_array' >
+                <propitem value='CMOS Battery' />
+                <propitem value='Dedicated NIC' />
+                <propitem value='LCD Cable Pres' />
+                <propitem value='NDC PG' />
+                <propitem value='Riser Config Err' />
+                <propitem value='Riser 2 Presence' />
+                <propitem value='Riser 3 Presence' />
+                <propitem value='USB Cable Pres' />
+                <propitem value='VGA Cable Pres' />
+           </propval>
+        </propgroup>
+
+    </node> <!-- motherboard -->
+
+    <dependents grouping='children'>
+      <range name='chip' min='0' max='1'>
+        <enum-method name='chip' version='1' />
+      </range>
+      <range name='hostbridge' min='0' max='254'>
+        <enum-method name='hostbridge' version='1' />
+      </range>
+      <range name='sp' min='0' max='0'>
+        <enum-method name='ipmi' version='1' />
+      </range>
+      <range name='slot' min='0' max='23'>
+        <enum-method name='smbios' version='1' />
+      </range>
+    </dependents>
+
+  </range>
+
+  <range name='chassis' min='0' max='0'>
+    <propmap name='Joyent-Compute-Platform-330x-chassis' />
+
+    <dependents grouping='children'>
+
+       <range name='psu' min='0' max='1'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+       <range name='fan' min='0' max='5'>
+          <propmap name='Joyent-Compute-Platform-330x-fan' />
+       </range>
+
+    </dependents>
+
+  </range>
+
+  <range name='ses-enclosure' min='0' max='1'>
+    <enum-method name='ses' version='1' />
+  </range>
+
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-330x-chassis-hc-topology.xml b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-330x-chassis-hc-topology.xml
new file mode 100644
index 0000000000..20dbc301eb
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-330x-chassis-hc-topology.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+-->
+
+<topology name='chassis' scheme='hc'>
+  <range name='chassis' min='0' max='0'>
+    <node instance='0'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <!--
+        chassis locate LED
+      -->
+      <facility name='locate' type='indicator' provider='fac_prov_ipmi' >
+          <propgroup name='facility' version='1' name-stability='Private'
+             data-stability='Private' >
+                <propval name='type' type='uint32' value='1' />
+                <propmethod name='chassis_ident_mode' version='0'
+                    propname='mode' proptype='uint32' mutable='1' >
+                </propmethod>
+          </propgroup>
+      </facility>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Intrusion' />
+           <propitem value='Pwr Consumption' />
+           <propitem value='Inlet Temp' />
+           <propitem value='Exhaust Temp' />
+         </propval>
+      </propgroup>
+    </node>
+  </range>
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-330x-fan-hc-topology.xml b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-330x-fan-hc-topology.xml
new file mode 100644
index 0000000000..5284971c19
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Joyent-Compute-Platform-330x-fan-hc-topology.xml
@@ -0,0 +1,127 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+-->
+
+<topology name='fan' scheme='hc'>
+  <range name='fan' min='0' max='5'>
+    <node instance='0'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <propgroup name='protocol' version='1' name-stability='Private'
+          data-stability='Private'>
+          <propval name='label' type='string' value='FAN 1' />
+          <propmethod name='ipmi_fru_fmri' version='0' propname='FRU'
+            proptype='fmri'>
+            <argval name='entity' type='string' value='self' />
+          </propmethod>
+      </propgroup>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Fan1' />
+         </propval>
+      </propgroup>
+      <enum-method name='ipmi' version='1' />
+    </node>
+    <node instance='1'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <propgroup name='protocol' version='1' name-stability='Private'
+          data-stability='Private'>
+          <propval name='label' type='string' value='FAN 2' />
+          <propmethod name='ipmi_fru_fmri' version='0' propname='FRU'
+            proptype='fmri'>
+            <argval name='entity' type='string' value='self' />
+          </propmethod>
+      </propgroup>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Fan2' />
+         </propval>
+      </propgroup>
+      <enum-method name='ipmi' version='1' />
+    </node>
+    <node instance='2'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <propgroup name='protocol' version='1' name-stability='Private'
+          data-stability='Private'>
+          <propval name='label' type='string' value='FAN 3' />
+          <propmethod name='ipmi_fru_fmri' version='0' propname='FRU'
+            proptype='fmri'>
+            <argval name='entity' type='string' value='self' />
+          </propmethod>
+      </propgroup>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Fan3' />
+         </propval>
+      </propgroup>
+      <enum-method name='ipmi' version='1' />
+    </node>
+    <node instance='3'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <propgroup name='protocol' version='1' name-stability='Private'
+          data-stability='Private'>
+          <propval name='label' type='string' value='FAN 4' />
+          <propmethod name='ipmi_fru_fmri' version='0' propname='FRU'
+            proptype='fmri'>
+            <argval name='entity' type='string' value='self' />
+          </propmethod>
+      </propgroup>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Fan4' />
+         </propval>
+      </propgroup>
+      <enum-method name='ipmi' version='1' />
+    </node>
+    <node instance='4'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <propgroup name='protocol' version='1' name-stability='Private'
+          data-stability='Private'>
+          <propval name='label' type='string' value='FAN 5' />
+          <propmethod name='ipmi_fru_fmri' version='0' propname='FRU'
+            proptype='fmri'>
+            <argval name='entity' type='string' value='self' />
+          </propmethod>
+      </propgroup>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Fan5' />
+         </propval>
+      </propgroup>
+      <enum-method name='ipmi' version='1' />
+    </node>
+    <node instance='5'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <propgroup name='protocol' version='1' name-stability='Private'
+          data-stability='Private'>
+          <propval name='label' type='string' value='FAN 6' />
+          <propmethod name='ipmi_fru_fmri' version='0' propname='FRU'
+            proptype='fmri'>
+            <argval name='entity' type='string' value='self' />
+          </propmethod>
+      </propgroup>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Fan6' />
+         </propval>
+      </propgroup>
+      <enum-method name='ipmi' version='1' />
+    </node>
+  </range>
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Makefile b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Makefile
new file mode 100644
index 0000000000..677a099c43
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Compute-Platform-330x/Makefile
@@ -0,0 +1,49 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+ARCH = i86pc
+CLASS = arch
+DTDFILE = topology.dtd.1
+OTHER_VARIANTS = \
+	Joyent-Compute-Platform-3302-hc-topology.xml
+
+ROOTJOYENTMAPS = $(OTHER_VARIANTS:%=$(arch_ROOTTOPOROOT)/%)
+
+TOPOFILE = \
+	Joyent-Compute-Platform-3301-hc-topology.xml \
+	Joyent-Compute-Platform-330x-chassis-hc-topology.xml \
+	Joyent-Compute-Platform-330x-fan-hc-topology.xml
+
+SRCDIR = ../Joyent,Joyent-Compute-Platform-330x
+
+PLATFORM = Joyent-Compute-Platform-330x
+
+CLOBBERFILES +=	$(ROOTJOYENTMAPS)
+
+include ../Makefile.map
+
+install: $(ROOTJOYENTMAPS)
+
+#
+# The JCP-3301 and JCP-3302 are essentially the same underlying hardware.  The
+# only significant difference is the JCP-3302 uses SSDs internally instead of
+# traditional disks.  As such, the same platform topo map should work for
+# both platforms so we simply create a symlink from the JCP 3301 map for the
+# JCP 3302.
+#
+$(ROOTJOYENTMAPS): Joyent-Compute-Platform-3301-hc-topology.xml
+	$(RM) $@
+	$(SYMLINK) ./$? $@
+
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-chassis-hc-topology.xml b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-chassis-hc-topology.xml
new file mode 100644
index 0000000000..d71085a615
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-chassis-hc-topology.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='chassis' scheme='hc'>
+  <range name='chassis' min='0' max='0'>
+    <node instance='0'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <!--
+        chassis locate LED
+      -->
+      <facility name='locate' type='indicator' provider='fac_prov_ipmi' >
+          <propgroup name='facility' version='1' name-stability='Private'
+	     data-stability='Private' >
+                <propval name='type' type='uint32' value='1' />
+                <propmethod name='chassis_ident_mode' version='0'
+                    propname='mode' proptype='uint32' mutable='1' >
+                </propmethod>
+          </propgroup>
+      </facility>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Chassis Intru' />
+           <propitem value='System Temp' />
+	 </propval>
+      </propgroup>
+    </node>
+  </range>
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-hc-topology.xml b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-hc-topology.xml
new file mode 100644
index 0000000000..915e3ccfb0
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-hc-topology.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='i86pc' scheme='hc'>
+
+  <range name='motherboard' min='0' max='0'>
+    <enum-method name='smbios' version='1' />
+    <node instance='0' static='true'>
+        <fac-enum provider='fac_prov_ipmi' />
+        <propgroup name='protocol' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='label' type='string' value='MB' />
+        </propgroup>
+        <propgroup name='ipmi' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='entity-list' type='string_array' >
+                <propitem value='MB_10G Temp' />
+                <propitem value='PCH Temp' />
+                <propitem value='Peripheral Temp' />
+                <propitem value='5VSB' />
+                <propitem value='5VSB' />
+                <propitem value='3.3VSB' />
+                <propitem value='3.3VCC' />
+                <propitem value='1.5V PCH' />
+                <propitem value='1.2V BMC' />
+                <propitem value='1.05V PCH' />
+                <propitem value='12V' />
+                <propitem value='5VCC' />
+                <propitem value='VBAT' />
+                <propitem value='VDIMMAB' />
+                <propitem value='VDIMMCD' />
+                <propitem value='VDIMMEF' />
+                <propitem value='VDIMMGH' />
+	    </propval>
+        </propgroup>
+    </node>
+
+    <dependents grouping='children'>
+      <range name='chip' min='0' max='1'>
+        <enum-method name='chip' version='1' />
+      </range>
+      <range name='hostbridge' min='0' max='254'>
+        <enum-method name='hostbridge' version='1' />
+      </range>
+      <range name='sp' min='0' max='0'>
+        <enum-method name='ipmi' version='1' />
+      </range>
+      <range name='slot' min='0' max='15'>
+        <enum-method name='smbios' version='1' />
+        <propmap name='Joyent-Storage-Platform-7001-slot' />
+      </range>
+    </dependents>
+
+  </range>
+
+  <range name='chassis' min='0' max='0'>
+    <propmap name='Joyent-Storage-Platform-7001-chassis' />
+
+    <dependents grouping='children'>
+
+       <range name='psu' min='0' max='1'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+       <range name='fan' min='0' max='7'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+
+    </dependents>
+  </range>
+
+  <range name='ses-enclosure' min='0' max='1'>
+     <enum-method name='ses' version='1' />
+  </range>
+
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-slot-hc-topology.xml b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-slot-hc-topology.xml
new file mode 100644
index 0000000000..6b16063427
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Joyent-Storage-Platform-7001-slot-hc-topology.xml
@@ -0,0 +1,277 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='slot' scheme='hc'>
+  <range name='slot' min='0' max='15'>
+    <node instance='0' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='1' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='2' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMB1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='3' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMB2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='4' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMC1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='5' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMC2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='6' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='7' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='8' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMME1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='9' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMME2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='10' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='11' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='12' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMG1 Temp' />
+             </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='13' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMG2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='14' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMH1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='15' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMH2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+   </range> <!-- slot -->
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Makefile b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Makefile
new file mode 100644
index 0000000000..bffc198721
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/Joyent,Joyent-Storage-Platform-7001/Makefile
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+# NOTE: The name of the xml file we are building is 'platform'
+# specific, but its build is structured as 'arch' specific since
+# 'uname -i' on all x86 platforms returns i86pc.
+
+ARCH = i86pc
+CLASS = arch
+DTDFILE = topology.dtd.1
+
+TOPOFILE = \
+	Joyent-Storage-Platform-7001-hc-topology.xml \
+	Joyent-Storage-Platform-7001-chassis-hc-topology.xml \
+	Joyent-Storage-Platform-7001-slot-hc-topology.xml
+
+SRCDIR = ../Joyent,Joyent-Storage-Platform-7001
+
+PLATFORM = Joyent-Storage-Platform-7001
+
+include ../Makefile.map
diff --git a/usr/src/lib/fm/topo/maps/Makefile b/usr/src/lib/fm/topo/maps/Makefile
index a01b016ebe..a35419192f 100644
--- a/usr/src/lib/fm/topo/maps/Makefile
+++ b/usr/src/lib/fm/topo/maps/Makefile
@@ -22,6 +22,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 sparc_SUBDIRS =	sun4u \
@@ -49,7 +50,12 @@ i386_SUBDIRS = i86pc \
 		SUNW,Sun-Fire-X4500 \
 		SUNW,Sun-Fire-X4540 \
 		SUNW,Sun-Fire-X4600-M2 \
-		Joyent,Joyent-Compute-Platform-1101
+		Joyent,Joyent-Compute-Platform-1101 \
+		Joyent,Joyent-Compute-Platform-330x \
+		Joyent,Joyent-Storage-Platform-7001 \
+		SMCI,SSG-2028R-ACR24L \
+		SMCI,SSG-6049P-E1CR36L \
+		SMCI,SSG-2029P-ACR24L
 
 SUBDIRS = $($(MACH)_SUBDIRS)
 
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/Makefile b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/Makefile
new file mode 100644
index 0000000000..15401c3abb
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/Makefile
@@ -0,0 +1,65 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+# NOTE: The name of the xml file we are building is 'platform'
+# specific, but its build is structured as 'arch' specific since
+# 'uname -i' on all x86 platforms returns i86pc.
+
+ARCH = i86pc
+CLASS = arch
+DTDFILE = topology.dtd.1
+JOYENT_PLATFORMS = \
+	Joyent-Compute-Platform-3101-hc-topology.xml \
+	Joyent-Compute-Platform-3102-hc-topology.xml
+
+ROOTJOYENTMAPS = $(JOYENT_PLATFORMS:%=$(arch_ROOTTOPOROOT)/%)
+
+TOPOFILE = \
+	SSG-2028R-ACR24L-hc-topology.xml \
+	SSG-2028R-ACR24L-chassis-hc-topology.xml \
+	SSG-2028R-ACR24L-disk-hc-topology.xml \
+	SSG-2028R-ACR24L-slot-hc-topology.xml
+
+SRCDIR = ../SMCI,SSG-2028R-ACR24L
+
+PLATFORM = SSG-2028R-ACR24L
+
+CLOBBERFILES +=	$(ROOTJOYENTMAPS) SSG-2028R-ACR24L-disk-hc-topology.xml
+
+include ../Makefile.map
+
+install: $(ROOTJOYENTMAPS)
+
+#
+# Note, the Joyent Compute Platform 310x is based on the SuperMicro
+# SSG-2028R-ACR24L. Because of that, the topo map used here will work for all
+# such systems.
+#
+$(ROOTJOYENTMAPS): SSG-2028R-ACR24L-hc-topology.xml
+	$(RM) $@
+	$(SYMLINK) ./$? $@
+
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-chassis-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-chassis-hc-topology.xml
new file mode 100644
index 0000000000..8a53632472
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-chassis-hc-topology.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+ Copyright (c) 2017, Joyent, Inc.
+
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+-->
+
+<topology name='chassis' scheme='hc'>
+  <range name='chassis' min='0' max='0'>
+    <node instance='0'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <!--
+        chassis locate LED
+      -->
+      <facility name='locate' type='indicator' provider='fac_prov_ipmi' >
+          <propgroup name='facility' version='1' name-stability='Private'
+	     data-stability='Private' >
+                <propval name='type' type='uint32' value='1' />
+                <propmethod name='chassis_ident_mode' version='0'
+                    propname='mode' proptype='uint32' mutable='1' >
+                </propmethod>
+          </propgroup>
+      </facility>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Chassis Intru' />
+	 </propval>
+      </propgroup>
+    </node>
+  </range>
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-disk-hc-topology.xmlgenksh b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-disk-hc-topology.xmlgenksh
new file mode 100755
index 0000000000..0f4b6c9731
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-disk-hc-topology.xmlgenksh
@@ -0,0 +1,108 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2017, Joyent, Inc.
+#
+
+#
+# Generate the topology map for an expanderless system with 3 bays. HBAs
+# are in slots 1, 3, and 5.
+#
+
+function do_node
+{
+  cat <<EOF
+    <node instance='${1}'>
+      <propgroup name='protocol' version='1' name-stability='Private'
+        data-stability='Private'>
+        <propval name='label' type='string' value='${2}' />
+      </propgroup>
+      <propgroup name='binding' version='1' name-stability='Private'
+        data-stability='Private'>
+        <propval name='driver' type='string' value='mpt_sas' />
+        <propval name='devctl' type='string' value='${3}' />
+        <propval name='enclosure' type='uint32' value='${4}' />
+        <propval name='slot' type='uint32' value='${5}' />
+      </propgroup>
+    </node>
+EOF
+}
+
+
+cat <<EOF
+<topology name='disk' scheme='hc'>
+  <range name='bay' min='0' max='23'>
+    <facility name='fail' type='indicator' provider='fac_prov_mptsas' >
+      <propgroup name='facility' version='1' name-stability='Private'
+        data-stability='Private' >
+        <propval name='type' type='uint32' value='0' />
+        <propmethod name='mptsas_led_mode' version='0' propname='mode'
+          proptype='uint32' mutable='1'>
+        </propmethod>
+      </propgroup>
+    </facility>
+    <facility name='ident' type='indicator' provider='fac_prov_mptsas' >
+      <propgroup name='facility' version='1' name-stability='Private'
+        data-stability='Private' >
+        <propval name='type' type='uint32' value='1' />
+        <propmethod name='mptsas_led_mode' version='0' propname='mode'
+          proptype='uint32' mutable='1'>
+        </propmethod>
+      </propgroup>
+    </facility>
+    <facility name='ok2rm' type='indicator' provider='fac_prov_mptsas' >
+      <propgroup name='facility' version='1' name-stability='Private'
+        data-stability='Private' >
+        <propval name='type' type='uint32' value='2' />
+        <propmethod name='mptsas_led_mode' version='0' propname='mode'
+          proptype='uint32' mutable='1'>
+        </propmethod>
+      </propgroup>
+    </facility>
+EOF
+
+enclosure=1
+bay=0
+slot=0
+devctl0='/devices/pci@0,0/pci8086,6f04@2/pci15d9,808@0:devctl'
+while (( slot <= 7 )); do
+  do_node $bay "Front Disk $bay" "$devctl0" $enclosure $slot
+  (( bay = bay + 1 ))
+  (( slot = slot + 1 ))
+done
+
+slot=0
+devctl0='/devices/pci@0,0/pci8086,6f08@3/pci15d9,808@0:devctl'
+while (( slot <= 7 )); do
+  do_node $bay "Front Disk $bay" "$devctl0" $enclosure $slot
+  (( bay = bay + 1 ))
+  (( slot = slot + 1 ))
+done
+
+slot=0
+devctl0='/devices/pci@78,0/pci8086,6f02@1/pci15d9,808@0:devctl'
+while (( slot <= 7 )); do
+  do_node $bay "Front Disk $bay" "$devctl0" $enclosure $slot
+  (( bay = bay + 1 ))
+  (( slot = slot + 1 ))
+done
+
+cat <<EOF
+    <dependents grouping='children'>
+      <range name='disk' min='0' max='0'>
+        <enum-method name='disk' version='1' />
+      </range>
+    </dependents>
+  </range>
+</topology>
+EOF
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-hc-topology.xml
new file mode 100644
index 0000000000..8406db227d
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-hc-topology.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+Copyright (c) 2018, Joyent, Inc.
+
+ CDDL HEADER START
+
+ The contents of this file are subject to the terms of the
+ Common Development and Distribution License (the "License").
+ You may not use this file except in compliance with the License.
+
+ You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ or http://www.opensolaris.org/os/licensing.
+ See the License for the specific language governing permissions
+ and limitations under the License.
+
+ When distributing Covered Code, include this CDDL HEADER in each
+ file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ If applicable, add the following below this CDDL HEADER, with the
+ fields enclosed by brackets "[]" replaced with your own identifying
+ information: Portions Copyright [yyyy] [name of copyright owner]
+
+ CDDL HEADER END
+
+-->
+
+<topology name='i86pc' scheme='hc'>
+
+  <range name='motherboard' min='0' max='0'>
+    <enum-method name='smbios' version='1' />
+    <node instance='0' static='true'>
+        <fac-enum provider='fac_prov_ipmi' />
+        <propgroup name='protocol' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='label' type='string' value='MB' />
+        </propgroup>
+        <propgroup name='ipmi' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='entity-list' type='string_array' >
+                <propitem value='MB_10G Temp' />
+                <propitem value='PCH Temp' />
+                <propitem value='Peripheral Temp' />
+                <propitem value='5VSB' />
+                <propitem value='5VSB' />
+                <propitem value='3.3VSB' />
+                <propitem value='3.3VCC' />
+                <propitem value='1.5V PCH' />
+                <propitem value='1.2V BMC' />
+                <propitem value='1.05V PCH' />
+                <propitem value='12V' />
+                <propitem value='5VCC' />
+                <propitem value='VBAT' />
+                <propitem value='VDIMMAB' />
+                <propitem value='VDIMMCD' />
+                <propitem value='VDIMMEF' />
+                <propitem value='VDIMMGH' />
+           </propval>
+        </propgroup>
+    </node>
+
+    <dependents grouping='children'>
+      <range name='chip' min='0' max='100'>
+        <enum-method name='chip' version='1' />
+      </range>
+      <range name='hostbridge' min='0' max='254'>
+        <enum-method name='hostbridge' version='1' />
+      </range>
+      <range name='sp' min='0' max='0'>
+        <enum-method name='ipmi' version='1' />
+      </range>
+      <range name='slot' min='0' max='15'>
+        <enum-method name='smbios' version='1' />
+        <propmap name='SSG-2028R-ACR24L-slot' />
+      </range>
+    </dependents>
+
+  </range>
+
+  <range name='chassis' min='0' max='0'>
+    <propmap name='SSG-2028R-ACR24L-chassis' />
+
+    <dependents grouping='children'>
+
+       <range name='psu' min='0' max='1'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+       <range name='fan' min='0' max='100'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+       <range name='bay' min='0' max='23'>
+          <propmap name='SSG-2028R-ACR24L-disk' />
+       </range>
+
+    </dependents>
+
+  </range>
+
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-slot-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-slot-hc-topology.xml
new file mode 100644
index 0000000000..6b16063427
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2028R-ACR24L/SSG-2028R-ACR24L-slot-hc-topology.xml
@@ -0,0 +1,277 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='slot' scheme='hc'>
+  <range name='slot' min='0' max='15'>
+    <node instance='0' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='1' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='2' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMB1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='3' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMB2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='4' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMC1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='5' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMC2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='6' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='7' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='8' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMME1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='9' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMME2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='10' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='11' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='12' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMG1 Temp' />
+             </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='13' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMG2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='14' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMH1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='15' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMH2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+   </range> <!-- slot -->
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/Makefile b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/Makefile
new file mode 100644
index 0000000000..0cd1c11a20
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/Makefile
@@ -0,0 +1,51 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+# NOTE: The name of the xml file we are building is 'platform'
+# specific, but its build is structured as 'arch' specific since
+# 'uname -i' on all x86 platforms returns i86pc.
+
+ARCH = i86pc
+CLASS = arch
+DTDFILE = topology.dtd.1
+JOYENT_PLATFORMS = \
+	Joyent-M12G5-hc-topology.xml
+
+ROOTJOYENTMAPS = $(JOYENT_PLATFORMS:%=$(arch_ROOTTOPOROOT)/%)
+
+TOPOFILE = \
+	SSG-2029P-ACR24L-hc-topology.xml \
+	SSG-2029P-ACR24L-chassis-hc-topology.xml \
+	SSG-2029P-ACR24L-disk-hc-topology.xml \
+	SSG-2029P-ACR24L-slot-hc-topology.xml
+
+SRCDIR = ../SMCI,SSG-2029P-ACR24L
+
+PLATFORM = SSG-2029P-ACR24L
+
+CLOBBERFILES +=	SSG-2029P-ACR24L-disk-hc-topology.xml
+
+include ../Makefile.map
+
+install: $(ROOTJOYENTMAPS)
+
+#
+# Note, the Joyent M12G5 is based on the SuperMicro SSG-2029P-ACR24L.
+# Because of that, the topo map used here will work for all such
+# systems.
+#
+$(ROOTJOYENTMAPS): SSG-2029P-ACR24L-hc-topology.xml
+	$(RM) $@
+	$(SYMLINK) ./$? $@
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-chassis-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-chassis-hc-topology.xml
new file mode 100644
index 0000000000..8f1d790414
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-chassis-hc-topology.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+ Copyright (c) 2018, Joyent, Inc.
+
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+-->
+
+<topology name='chassis' scheme='hc'>
+  <range name='chassis' min='0' max='0'>
+    <node instance='0'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <!--
+        chassis locate LED
+      -->
+      <facility name='locate' type='indicator' provider='fac_prov_ipmi' >
+          <propgroup name='facility' version='1' name-stability='Private'
+             data-stability='Private' >
+                <propval name='type' type='uint32' value='1' />
+                <propmethod name='chassis_ident_mode' version='0'
+                    propname='mode' proptype='uint32' mutable='1' >
+                </propmethod>
+          </propgroup>
+      </facility>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Chassis Intru' />
+           <propitem value='System Temp' />
+         </propval>
+      </propgroup>
+    </node>
+  </range>
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-disk-hc-topology.xmlgenksh b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-disk-hc-topology.xmlgenksh
new file mode 100755
index 0000000000..9ab078cff4
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-disk-hc-topology.xmlgenksh
@@ -0,0 +1,143 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+#
+# Generate the topology map for an expanderless system with 24 bays. HBAs are
+# in slots 2, 4, and 6. Additionally, there are two rear-facing SATA drive
+# bays, connected to the SATA headers on the motherboard.
+#
+
+function do_sas_node
+{
+  cat <<EOF
+    <node instance='${1}'>
+    <facility name='fail' type='indicator' provider='fac_prov_mptsas' >
+      <propgroup name='facility' version='1' name-stability='Private'
+        data-stability='Private' >
+        <propval name='type' type='uint32' value='0' />
+        <propmethod name='mptsas_led_mode' version='0' propname='mode'
+          proptype='uint32' mutable='1'>
+        </propmethod>
+      </propgroup>
+    </facility>
+    <facility name='ident' type='indicator' provider='fac_prov_mptsas' >
+      <propgroup name='facility' version='1' name-stability='Private'
+        data-stability='Private' >
+        <propval name='type' type='uint32' value='1' />
+        <propmethod name='mptsas_led_mode' version='0' propname='mode'
+          proptype='uint32' mutable='1'>
+        </propmethod>
+      </propgroup>
+    </facility>
+    <facility name='ok2rm' type='indicator' provider='fac_prov_mptsas' >
+      <propgroup name='facility' version='1' name-stability='Private'
+        data-stability='Private' >
+        <propval name='type' type='uint32' value='2' />
+        <propmethod name='mptsas_led_mode' version='0' propname='mode'
+          proptype='uint32' mutable='1'>
+        </propmethod>
+      </propgroup>
+    </facility>
+      <propgroup name='protocol' version='1' name-stability='Private'
+        data-stability='Private'>
+        <propval name='label' type='string' value='${2}' />
+      </propgroup>
+      <propgroup name='binding' version='1' name-stability='Private'
+        data-stability='Private'>
+        <propval name='driver' type='string' value='mpt_sas' />
+        <propval name='devctl' type='string' value='${3}' />
+        <propval name='enclosure' type='uint32' value='${4}' />
+        <propval name='slot' type='uint32' value='${5}' />
+      </propgroup>
+    </node>
+EOF
+}
+
+function do_sata_node
+{
+	bay=$1
+	bay_inst=$2
+	#
+	# There are six SATA headers on the motherboard, which represent
+	# targets 0-5.  The two rear-facing SATA bays are connected to the two
+	# headers associated with targets 4 and 5.
+	#
+	(( target = bay + 4 ))
+	hpath="/pci@0,0/pci15d9,981@11,5"
+	tpath="/disk@${target},0"
+  cat <<EOF
+    <node instance='$bay_inst'>
+      <propgroup name='protocol' version='1' name-stability='Private'
+        data-stability='Private'>
+        <propval name='label' type='string' value='Rear Disk $bay' />
+      </propgroup>
+      <propgroup name='io' version='1' name-stability='Private'
+        data-stability='Private'>
+        <propval name='ap-path' type='string' value='/devices${hpath}:$target' />
+      </propgroup>
+      <propgroup name='binding' version='1' name-stability='Private'
+        data-stability='Private'>
+        <propval name='occupant-path' type='string'
+          value='$hpath$tpath' />
+      </propgroup>
+    </node>
+EOF
+}
+
+
+cat <<EOF
+<topology name='disk' scheme='hc'>
+  <range name='bay' min='0' max='25'>
+EOF
+
+enclosure=1
+bay=0
+slot=0
+devctl0='/devices/pci@7c,0/pci8086,2030@0/pci15d9,808@0:devctl'
+while (( slot <= 7 )); do
+  do_sas_node $bay "Front Disk $bay" "$devctl0" $enclosure $slot
+  (( bay = bay + 1 ))
+  (( slot = slot + 1 ))
+done
+
+slot=0
+devctl0='/devices/pci@cc,0/pci8086,2030@0/pci15d9,808@0:devctl'
+while (( slot <= 7 )); do
+  do_sas_node $bay "Front Disk $bay" "$devctl0" $enclosure $slot
+  (( bay = bay + 1 ))
+  (( slot = slot + 1 ))
+done
+
+slot=0
+devctl0='/devices/pci@55,0/pci8086,2030@0/pci15d9,808@0:devctl'
+while (( slot <= 7 )); do
+  do_sas_node $bay "Front Disk $bay" "$devctl0" $enclosure $slot
+  (( bay = bay + 1 ))
+  (( slot = slot + 1 ))
+done
+
+do_sata_node 0 24
+do_sata_node 1 25
+
+cat <<EOF
+    <dependents grouping='children'>
+      <range name='disk' min='0' max='0'>
+        <enum-method name='disk' version='1' />
+      </range>
+    </dependents>
+   </range>
+</topology>
+EOF
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-hc-topology.xml
new file mode 100644
index 0000000000..68182bfef3
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-hc-topology.xml
@@ -0,0 +1,96 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+-->
+<topology name='i86pc' scheme='hc'>
+
+  <range name='motherboard' min='0' max='0'>
+    <enum-method name='smbios' version='1' />
+    <node instance='0' static='true'>
+        <fac-enum provider='fac_prov_ipmi' />
+        <propgroup name='protocol' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='label' type='string' value='MB' />
+        </propgroup>
+        <propgroup name='ipmi' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='entity-list' type='string_array' >
+                <propitem value='1.05V PCH' />
+                <propitem value='1.8V PCH' />
+                <propitem value='3.3VSB' />
+                <propitem value='3.3VCC' />
+                <propitem value='5VCC' />
+                <propitem value='5VSB' />
+                <propitem value='12V' />
+                <propitem value='MB_10G Temp' />
+                <propitem value='PCH Temp' />
+                <propitem value='Peripheral Temp' />
+                <propitem value='PVNN PCH' />
+                <propitem value='VBAT' />
+                <propitem value='Vcpu1' />
+                <propitem value='Vcpu2' />
+                <propitem value='VDIMMP1ABC' />
+                <propitem value='VDIMMP1DEF' />
+                <propitem value='VDIMMP2ABC' />
+                <propitem value='VDIMMP2DEF' />
+                <propitem value='VRMCpu1SA Temp' />
+                <propitem value='VRMCpu1IO Temp' />
+                <propitem value='VRMCpu1CCH Temp' />
+                <propitem value='VRMCpu2SA Temp ' />
+                <propitem value='VRMCpu2IO Temp' />
+                <propitem value='VRMP1ABC Temp' />
+                <propitem value='VRMP1DEF Temp' />
+                <propitem value='VRMP2ABC Temp' />
+                <propitem value='VRMP2DEF Temp' />
+           </propval>
+        </propgroup>
+    </node>
+
+    <dependents grouping='children'>
+      <range name='chip' min='0' max='100'>
+        <enum-method name='chip' version='1' />
+      </range>
+      <range name='hostbridge' min='0' max='254'>
+        <enum-method name='hostbridge' version='1' />
+      </range>
+      <range name='sp' min='0' max='0'>
+        <enum-method name='ipmi' version='1' />
+      </range>
+      <range name='slot' min='0' max='15'>
+        <enum-method name='smbios' version='1' />
+        <propmap name='SSG-2029P-ACR24L-slot' />
+      </range>
+    </dependents>
+
+  </range>
+
+  <range name='chassis' min='0' max='0'>
+    <propmap name='SSG-2029P-ACR24L-chassis' />
+
+    <dependents grouping='children'>
+
+       <range name='psu' min='0' max='1'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+       <range name='fan' min='0' max='7'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+       <range name='bay' min='0' max='25'>
+          <propmap name='SSG-2029P-ACR24L-disk' />
+       </range>
+
+    </dependents>
+
+  </range>
+
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-slot-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-slot-hc-topology.xml
new file mode 100644
index 0000000000..29dcc6d206
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-2029P-ACR24L/SSG-2029P-ACR24L-slot-hc-topology.xml
@@ -0,0 +1,277 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='slot' scheme='hc'>
+  <range name='slot' min='0' max='15'>
+    <node instance='0' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='1' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='2' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMB1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='3' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMC1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='4' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='5' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='6' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMME1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='7' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='8' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMA1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='9' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMA2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='10' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMB1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='11' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMC1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='12' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMD1 Temp' />
+             </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='13' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMD2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='14' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMME1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='15' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+   </range> <!-- slot -->
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/Makefile b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/Makefile
new file mode 100644
index 0000000000..eeaf0c9045
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/Makefile
@@ -0,0 +1,47 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+# NOTE: The name of the xml file we are building is 'platform'
+# specific, but its build is structured as 'arch' specific since
+# 'uname -i' on all x86 platforms returns i86pc.
+
+ARCH = i86pc
+CLASS = arch
+DTDFILE = topology.dtd.1
+JOYENT_PLATFORMS = \
+	Joyent-S10G5-hc-topology.xml
+
+ROOTJOYENTMAPS = $(JOYENT_PLATFORMS:%=$(arch_ROOTTOPOROOT)/%)
+
+TOPOFILE = \
+	SSG-6049P-E1CR36L-hc-topology.xml \
+	SSG-6049P-E1CR36L-chassis-hc-topology.xml \
+	SSG-6049P-E1CR36L-slot-hc-topology.xml
+
+SRCDIR = ../SMCI,SSG-6049P-E1CR36L
+
+PLATFORM = SSG-6049P-E1CR36L
+
+include ../Makefile.map
+
+install: $(ROOTJOYENTMAPS)
+#
+# Note, the Joyent S10G5 is based on the SuperMicro SSG-6049P-E1CR36L.
+# Because of that, the topo map used here will work for all such
+# systems.
+#
+$(ROOTJOYENTMAPS): SSG-6049P-E1CR36L-hc-topology.xml
+	$(RM) $@
+	$(SYMLINK) ./$? $@
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-chassis-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-chassis-hc-topology.xml
new file mode 100644
index 0000000000..346f77966e
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-chassis-hc-topology.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='chassis' scheme='hc'>
+  <range name='chassis' min='0' max='0'>
+    <node instance='0'>
+      <fac-enum provider='fac_prov_ipmi' />
+      <!--
+        chassis locate LED
+      -->
+      <facility name='locate' type='indicator' provider='fac_prov_ipmi' >
+          <propgroup name='facility' version='1' name-stability='Private'
+             data-stability='Private' >
+                <propval name='type' type='uint32' value='1' />
+                <propmethod name='chassis_ident_mode' version='0'
+                    propname='mode' proptype='uint32' mutable='1' >
+                </propmethod>
+          </propgroup>
+      </facility>
+      <propgroup name='ipmi' version='1'
+          name-stability='Private' data-stability='Private' >
+         <propval name='entity-list' type='string_array' >
+           <propitem value='Chassis Intru' />
+           <propitem value='System Temp' />
+         </propval>
+      </propgroup>
+    </node>
+  </range>
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-hc-topology.xml
new file mode 100644
index 0000000000..f3f7311249
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-hc-topology.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='i86pc' scheme='hc'>
+
+  <range name='motherboard' min='0' max='0'>
+    <enum-method name='smbios' version='1' />
+    <node instance='0' static='true'>
+        <fac-enum provider='fac_prov_ipmi' />
+        <propgroup name='protocol' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='label' type='string' value='MB' />
+        </propgroup>
+        <propgroup name='ipmi' version='1'
+            name-stability='Private' data-stability='Private' >
+            <propval name='entity-list' type='string_array' >
+                <propitem value='PCH Temp' />
+                <propitem value='Peripheral Temp' />
+                <propitem value='MB_10G Temp' />
+                <propitem value='12V' />
+                <propitem value='5VCC' />
+                <propitem value='3.3VCC' />
+                <propitem value='VDimmP1ABC' />
+                <propitem value='VDimmP1DEF' />
+                <propitem value='VDimmP2ABC' />
+                <propitem value='VDimmP2DEF' />
+                <propitem value='5SVB' />
+                <propitem value='3.3VSB' />
+                <propitem value='1.8V PCH' />
+                <propitem value='PVNN PCH' />
+                <propitem value='1.05V PCH' />
+            </propval>
+        </propgroup>
+    </node>
+
+    <dependents grouping='children'>
+      <range name='chip' min='0' max='1'>
+        <enum-method name='chip' version='1' />
+      </range>
+      <range name='hostbridge' min='0' max='254'>
+        <enum-method name='hostbridge' version='1' />
+      </range>
+      <range name='sp' min='0' max='0'>
+        <enum-method name='ipmi' version='1' />
+      </range>
+      <range name='slot' min='0' max='15'>
+        <enum-method name='smbios' version='1' />
+        <propmap name='SSG-6049P-E1CR36L-slot' />
+      </range>
+    </dependents>
+
+  </range>
+
+  <range name='chassis' min='0' max='0'>
+    <propmap name='SSG-6049P-E1CR36L-chassis' />
+
+    <dependents grouping='children'>
+
+       <range name='psu' min='0' max='1'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+       <range name='fan' min='0' max='7'>
+          <enum-method name='ipmi' version='1' />
+       </range>
+
+    </dependents>
+  </range>
+
+  <range name='ses-enclosure' min='0' max='1'>
+     <enum-method name='ses' version='1' />
+  </range>
+
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-slot-hc-topology.xml b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-slot-hc-topology.xml
new file mode 100644
index 0000000000..d367c42744
--- /dev/null
+++ b/usr/src/lib/fm/topo/maps/SMCI,SSG-6049P-E1CR36L/SSG-6049P-E1CR36L-slot-hc-topology.xml
@@ -0,0 +1,277 @@
+<?xml version="1.0"?>
+<!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
+<!--
+
+ This file and its contents are supplied under the terms of the
+ Common Development and Distribution License ("CDDL"), version 1.0.
+ You may only use this file in accordance with the terms of version
+ 1.0 of the CDDL.
+
+ A full copy of the text of the CDDL should have accompanied this
+ source.  A copy of the CDDL is also available via the Internet at
+ http://www.illumos.org/license/CDDL.
+
+ Copyright (c) 2018, Joyent, Inc.
+
+-->
+
+<topology name='slot' scheme='hc'>
+  <range name='slot' min='0' max='15'>
+    <node instance='0' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='1' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMA2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='2' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMB1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='3' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMC2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+    <node instance='4' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='5' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMD2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='6' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMME1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='7' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P1-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='8' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMA1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='9' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMA2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='10' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMB1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='11' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMC1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='12' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMD1 Temp' />
+             </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='13' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMD2 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='14' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMME1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+     <node instance='15' static='true'>
+       <dependents grouping='children'>
+       <range name='dimm' min='0' max='0'>
+           <node instance='0' static='true'>
+           <fac-enum provider='fac_prov_ipmi' />
+             <propgroup name='ipmi' version='1'
+               name-stability='Private' data-stability='Private' >
+               <propval name='entity-list' type='string_array' >
+                 <propitem value='P2-DIMMF1 Temp' />
+               </propval>
+             </propgroup>
+           </node>
+        </range>
+        </dependents>
+     </node>
+
+   </range> <!-- slot -->
+</topology>
diff --git a/usr/src/lib/fm/topo/maps/common/topology.dtd.1 b/usr/src/lib/fm/topo/maps/common/topology.dtd.1
index ae749e6e46..ba474a66b6 100644
--- a/usr/src/lib/fm/topo/maps/common/topology.dtd.1
+++ b/usr/src/lib/fm/topo/maps/common/topology.dtd.1
@@ -3,6 +3,8 @@
  Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  Use is subject to license terms.
 
+ Copyright (c) 2018, Joyent, Inc.
+ 
  CDDL HEADER START
 
  The contents of this file are subject to the terms of the
@@ -275,7 +277,8 @@
 	( fac-enum?, facility*, propgroup*, set*, enum-method*, dependents? ) >
 
 <!ATTLIST node
-	instance	CDATA #REQUIRED >
+	instance	CDATA #REQUIRED
+	static		(false|true) "false" >
 
 <!--
   dependents
diff --git a/usr/src/lib/fm/topo/maps/i86pc/i86pc-legacy-hc-topology.xml b/usr/src/lib/fm/topo/maps/i86pc/i86pc-legacy-hc-topology.xml
index fda43bca6c..607f7e1eb1 100644
--- a/usr/src/lib/fm/topo/maps/i86pc/i86pc-legacy-hc-topology.xml
+++ b/usr/src/lib/fm/topo/maps/i86pc/i86pc-legacy-hc-topology.xml
@@ -2,7 +2,7 @@
 <!DOCTYPE topology SYSTEM "/usr/share/lib/xml/dtd/topology.dtd.1">
 <!--
 Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
-Copyright (c) 2013, Joyent, Inc. All rights reserved.
+Copyright (c) 2018, Joyent, Inc.
 
  CDDL HEADER START
 
@@ -77,9 +77,15 @@ Copyright (c) 2013, Joyent, Inc. All rights reserved.
         <enum-method name='chip' version='1' />
 	<propmap name='chip' />
       </range>
+      <range name='slot' min='0' max='31'>
+        <enum-method name='smbios' version='1' />
+      </range>
       <range name='hostbridge' min='0' max='254'>
         <enum-method name='hostbridge' version='1' />
       </range>
+      <range name='sp' min='0' max='0'>
+        <enum-method name='ipmi' version='1' />
+      </range>
     </dependents>
     
   </range>
@@ -152,7 +158,7 @@ Copyright (c) 2013, Joyent, Inc. All rights reserved.
        </range>
     </set>
 
-    <set type='product' setlist='Joyent-Compute-Platform-1101|Joyent-Compute-Platform-1102'>
+    <set type='product' setlist='Joyent-Compute-Platform-1101|Joyent-Compute-Platform-1102|Joyent-Compute-Platform-2101|Joyent-Compute-Platform-2102'>
        <range name='psu' min='0' max='1'>
           <enum-method name='ipmi' version='1' />
        </range>
diff --git a/usr/src/lib/fm/topo/modules/common/Makefile b/usr/src/lib/fm/topo/modules/common/Makefile
index d725016aef..f7f47f5e06 100644
--- a/usr/src/lib/fm/topo/modules/common/Makefile
+++ b/usr/src/lib/fm/topo/modules/common/Makefile
@@ -22,7 +22,7 @@
 #
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
-# Copyright (c) 2017, Joyent, Inc.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 SUBDIRS =		\
@@ -32,6 +32,7 @@ SUBDIRS =		\
 	ipmi		\
 	nic		\
 	ses		\
+	smbios		\
 	xfp
 
 ses:	disk
diff --git a/usr/src/lib/fm/topo/modules/common/disk/Makefile b/usr/src/lib/fm/topo/modules/common/disk/Makefile
index 4b4c965050..8e8935be65 100644
--- a/usr/src/lib/fm/topo/modules/common/disk/Makefile
+++ b/usr/src/lib/fm/topo/modules/common/disk/Makefile
@@ -22,6 +22,8 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright (c) 2018, Joyent, Inc.
+#
 
 MODULE = disk
 CLASS = common
@@ -32,5 +34,5 @@ include ../../Makefile.plugin
 
 CPPFLAGS += -I$(SRC)/uts/common
 
-LDLIBS += -ldevinfo -ldevid -lcfgadm -ldiskstatus
+LDLIBS += -ldevinfo -ldevid -lcfgadm -ldiskstatus -ldiskmgt
 
diff --git a/usr/src/lib/fm/topo/modules/common/disk/disk.h b/usr/src/lib/fm/topo/modules/common/disk/disk.h
index d597df27b1..02aa7efc87 100644
--- a/usr/src/lib/fm/topo/modules/common/disk/disk.h
+++ b/usr/src/lib/fm/topo/modules/common/disk/disk.h
@@ -23,7 +23,7 @@
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 /*
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef _DISK_H
@@ -50,6 +50,7 @@ extern "C" {
 #define	TOPO_STORAGE_SERIAL_NUM		"serial-number"
 #define	TOPO_STORAGE_FIRMWARE_REV	"firmware-revision"
 #define	TOPO_STORAGE_CAPACITY		"capacity-in-bytes"
+#define	TOPO_STORAGE_RPM		"speed-in-rpm"
 
 /*
  * Properties for binding group: The binding group required in platform
diff --git a/usr/src/lib/fm/topo/modules/common/disk/disk_common.c b/usr/src/lib/fm/topo/modules/common/disk/disk_common.c
index 123e86f44f..5a7a5b5467 100644
--- a/usr/src/lib/fm/topo/modules/common/disk/disk_common.c
+++ b/usr/src/lib/fm/topo/modules/common/disk/disk_common.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -38,6 +38,7 @@
 #include <ctype.h>
 #include <strings.h>
 #include <libdevinfo.h>
+#include <libdiskmgt.h>
 #include <devid.h>
 #include <sys/libdevid.h>
 #include <pthread.h>
@@ -86,6 +87,20 @@ static const topo_method_t disk_methods[] = {
 	{ NULL }
 };
 
+static int disk_temp_reading(topo_mod_t *, tnode_t *, topo_version_t,
+    nvlist_t *, nvlist_t **);
+
+#define	TOPO_METH_DISK_TEMP		"disk_temp_reading"
+#define	TOPO_METH_DISK_TEMP_DESC	"Disk Temperature Reading"
+#define	TOPO_METH_DISK_TEMP_VERSION	0
+
+static const topo_method_t disk_fac_methods[] = {
+	{ TOPO_METH_DISK_TEMP, TOPO_METH_DISK_TEMP_DESC,
+	    TOPO_METH_DISK_TEMP_VERSION, TOPO_STABILITY_INTERNAL,
+	    disk_temp_reading },
+	{ NULL }
+};
+
 static const topo_pgroup_info_t io_pgroup = {
 	TOPO_PGROUP_IO,
 	TOPO_STABILITY_PRIVATE,
@@ -125,9 +140,11 @@ static int
 disk_set_props(topo_mod_t *mod, tnode_t *parent,
     tnode_t *dtn, dev_di_node_t *dnode)
 {
-	nvlist_t	*asru = NULL;
+	nvlist_t	*asru = NULL, *drive_attrs;
 	char		*label = NULL;
 	nvlist_t	*fmri = NULL;
+	dm_descriptor_t drive_descr = NULL;
+	uint32_t	rpm;
 	int		err;
 
 	/* pull the label property down from our parent 'bay' node */
@@ -265,9 +282,29 @@ disk_set_props(topo_mod_t *mod, tnode_t *parent,
 		    "set cap error %s\n", topo_strerror(err));
 		goto error;
 	}
+
+	if (dnode->ddn_devid == NULL ||
+	    (drive_descr = dm_get_descriptor_by_name(DM_DRIVE,
+	    dnode->ddn_devid, &err)) == NULL ||
+	    (drive_attrs = dm_get_attributes(drive_descr, &err)) == NULL)
+		goto out;
+
+	if (nvlist_lookup_boolean(drive_attrs, DM_SOLIDSTATE) == 0 ||
+	    nvlist_lookup_uint32(drive_attrs, DM_RPM, &rpm) != 0)
+		goto out;
+
+	if (topo_prop_set_uint32(dtn, TOPO_PGROUP_STORAGE, TOPO_STORAGE_RPM,
+	    TOPO_PROP_IMMUTABLE, rpm, &err) != 0) {
+		topo_mod_dprintf(mod, "disk_set_props: "
+		    "set rpm error %s\n", topo_strerror(err));
+		dm_free_descriptor(drive_descr);
+		goto error;
+	}
 	err = 0;
 
 out:
+	if (drive_descr != NULL)
+		dm_free_descriptor(drive_descr);
 	nvlist_free(fmri);
 	if (label)
 		topo_mod_strfree(mod, label);
@@ -307,26 +344,134 @@ disk_trim_whitespace(topo_mod_t *mod, const char *begin)
 	return (buf);
 }
 
-/*
- * Manufacturing strings can contain characters that are invalid for use in hc
- * authority names.  This trims leading and trailing whitespace, and
- * substitutes any characters known to be bad.
- */
-char *
-disk_auth_clean(topo_mod_t *mod, const char *str)
+/*ARGSUSED*/
+static int
+disk_temp_reading(topo_mod_t *mod, tnode_t *node, topo_version_t vers,
+    nvlist_t *in, nvlist_t **out)
 {
-	char *buf, *p;
+	char *devid;
+	uint32_t temp;
+	dm_descriptor_t drive_descr = NULL;
+	nvlist_t *drive_stats, *pargs, *nvl;
+	int err;
+
+	if (vers > TOPO_METH_DISK_TEMP_VERSION)
+		return (topo_mod_seterrno(mod, ETOPO_METHOD_VERNEW));
+
+	if (nvlist_lookup_nvlist(in, TOPO_PROP_ARGS, &pargs) != 0 ||
+	    nvlist_lookup_string(pargs, TOPO_IO_DEVID, &devid) != 0) {
+		topo_mod_dprintf(mod, "Failed to lookup %s arg",
+		    TOPO_IO_DEVID);
+		return (topo_mod_seterrno(mod, EMOD_NVL_INVAL));
+	}
 
-	if (str == NULL)
-		return (NULL);
+	if ((drive_descr = dm_get_descriptor_by_name(DM_DRIVE, devid,
+	    &err)) == NULL) {
+		topo_mod_dprintf(mod, "failed to get drive decriptor for %s",
+		    devid);
+		return (topo_mod_seterrno(mod, EMOD_UNKNOWN));
+	}
 
-	if ((buf = topo_mod_strdup(mod, str)) == NULL)
-		return (NULL);
+	if ((drive_stats = dm_get_stats(drive_descr, DM_DRV_STAT_TEMPERATURE,
+	    &err)) == NULL ||
+	    nvlist_lookup_uint32(drive_stats, DM_TEMPERATURE, &temp) != 0) {
+		topo_mod_dprintf(mod, "failed to read disk temp for %s",
+		    devid);
+		dm_free_descriptor(drive_descr);
+		return (topo_mod_seterrno(mod, EMOD_UNKNOWN));
+	}
+	dm_free_descriptor(drive_descr);
+
+	if (topo_mod_nvalloc(mod, &nvl, NV_UNIQUE_NAME) != 0 ||
+	    nvlist_add_string(nvl, TOPO_PROP_VAL_NAME,
+	    TOPO_SENSOR_READING) != 0 ||
+	    nvlist_add_uint32(nvl, TOPO_PROP_VAL_TYPE, TOPO_TYPE_DOUBLE) !=
+	    0 || nvlist_add_double(nvl, TOPO_PROP_VAL_VAL, (double)temp) != 0) {
+		topo_mod_dprintf(mod, "Failed to allocate 'out' nvlist\n");
+		nvlist_free(nvl);
+		return (topo_mod_seterrno(mod, EMOD_NOMEM));
+	}
+	*out = nvl;
 
-	while ((p = strpbrk(buf, " :=")) != NULL)
-		*p = '-';
+	return (0);
+}
 
-	return (buf);
+static int
+disk_add_temp_sensor(topo_mod_t *mod, tnode_t *pnode, const char *devid)
+{
+	tnode_t *fnode;
+	topo_pgroup_info_t pgi;
+	nvlist_t *arg_nvl = NULL;
+	int err;
+
+	if ((fnode = topo_node_facbind(mod, pnode, "temp",
+	    TOPO_FAC_TYPE_SENSOR)) == NULL) {
+		topo_mod_dprintf(mod, "failed to bind facility node");
+		/* errno set */
+		return (-1);
+	}
+
+	/*
+	 * Set props:
+	 * - facility/sensor-class
+	 * - facility/sensor-type
+	 * - facility/units
+	 */
+	pgi.tpi_name = TOPO_PGROUP_FACILITY;
+	pgi.tpi_namestab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_datastab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_version = 1;
+	if (topo_pgroup_create(fnode, &pgi, &err) != 0) {
+		if (err != ETOPO_PROP_DEFD) {
+			topo_mod_dprintf(mod,  "pgroups create failure (%s)\n",
+			    topo_strerror(err));
+			/* errno set */
+			goto err;
+		}
+	}
+	if (topo_prop_set_string(fnode, TOPO_PGROUP_FACILITY,
+	    TOPO_SENSOR_CLASS, TOPO_PROP_IMMUTABLE,
+	    TOPO_SENSOR_CLASS_THRESHOLD, &err) != 0 ||
+	    topo_prop_set_uint32(fnode, TOPO_PGROUP_FACILITY,
+	    TOPO_FACILITY_TYPE, TOPO_PROP_IMMUTABLE, TOPO_SENSOR_TYPE_TEMP,
+	    &err) != 0 ||
+	    topo_prop_set_uint32(fnode, TOPO_PGROUP_FACILITY,
+	    TOPO_SENSOR_UNITS, TOPO_PROP_IMMUTABLE,
+	    TOPO_SENSOR_UNITS_DEGREES_C, &err) != 0) {
+		topo_mod_dprintf(mod, "Failed to set props on facnode (%s)",
+		    topo_strerror(err));
+		/* errno set */
+		goto err;
+	}
+
+	/*
+	 * Register a property method for facility/reading
+	 */
+	if (topo_method_register(mod, fnode, disk_fac_methods) < 0) {
+		topo_mod_dprintf(mod, "failed to register facility methods");
+		goto err;
+	}
+	if (topo_mod_nvalloc(mod, &arg_nvl, NV_UNIQUE_NAME) < 0 ||
+	    nvlist_add_string(arg_nvl, TOPO_IO_DEVID, devid) != 0) {
+		topo_mod_dprintf(mod, "Failed build arg nvlist\n");
+		(void) topo_mod_seterrno(mod, EMOD_NOMEM);
+		goto err;
+	}
+	if (topo_prop_method_register(fnode, TOPO_PGROUP_FACILITY,
+	    TOPO_SENSOR_READING, TOPO_TYPE_DOUBLE, "disk_temp_reading",
+	    arg_nvl, &err) != 0) {
+		topo_mod_dprintf(mod, "Failed to register %s propmeth "
+		    "on fac node %s (%s)\n", TOPO_SENSOR_READING,
+		    topo_node_name(fnode), topo_strerror(err));
+		/* errno set */
+		goto err;
+	}
+	nvlist_free(arg_nvl);
+	return (0);
+err:
+	topo_node_unbind(fnode);
+	nvlist_free(arg_nvl);
+	return (-1);
 }
 
 /* create the disk topo node */
@@ -343,10 +488,10 @@ disk_tnode_create(topo_mod_t *mod, tnode_t *parent,
 
 	*rval = NULL;
 	if (dnode != NULL) {
-		mfg = disk_auth_clean(mod, dnode->ddn_mfg);
-		model = disk_auth_clean(mod, dnode->ddn_model);
-		firm = disk_auth_clean(mod, dnode->ddn_firm);
-		serial = disk_auth_clean(mod, dnode->ddn_serial);
+		mfg = topo_mod_clean_str(mod, dnode->ddn_mfg);
+		model = topo_mod_clean_str(mod, dnode->ddn_model);
+		firm = topo_mod_clean_str(mod, dnode->ddn_firm);
+		serial = topo_mod_clean_str(mod, dnode->ddn_serial);
 	} else {
 		mfg = model = firm = serial = NULL;
 	}
@@ -404,6 +549,13 @@ disk_tnode_create(topo_mod_t *mod, tnode_t *parent,
 		topo_node_unbind(dtn);
 		return (-1);
 	}
+
+	if (dnode->ddn_devid != NULL &&
+	    disk_add_temp_sensor(mod, dtn, dnode->ddn_devid) != 0) {
+		topo_mod_dprintf(mod, "disk_tnode_create: failed to create "
+		    "temperature sensor node on bay=%d/disk=0",
+		    topo_node_instance(parent));
+	}
 	*rval = dtn;
 	return (0);
 }
diff --git a/usr/src/lib/fm/topo/modules/common/disk/disk_mptsas.c b/usr/src/lib/fm/topo/modules/common/disk/disk_mptsas.c
index db853c6695..beae89f9f1 100644
--- a/usr/src/lib/fm/topo/modules/common/disk/disk_mptsas.c
+++ b/usr/src/lib/fm/topo/modules/common/disk/disk_mptsas.c
@@ -32,11 +32,18 @@
 #include "disk.h"
 #include "disk_drivers.h"
 
+/*
+ * Request the SAS address of the disk (if any) attached to this mpt_sas
+ * instance at (Enclosure Number, Slot Number).  The function returns
+ * -1 on error and sets errno to ENOENT _only_ if the /devices node
+ * (*devctl) does not exist.
+ */
 static int
 get_sas_address(topo_mod_t *mod, char *devctl, uint32_t enclosure,
     uint32_t slot, char **sas_address)
 {
-	int fd, err, i;
+	int ret = -1, en = ENXIO;
+	int fd, i;
 	mptsas_get_disk_info_t gdi;
 	mptsas_disk_info_t *di;
 	size_t disz;
@@ -44,16 +51,19 @@ get_sas_address(topo_mod_t *mod, char *devctl, uint32_t enclosure,
 	bzero(&gdi, sizeof (gdi));
 
 	if ((fd = open(devctl, O_RDWR)) == -1) {
+		en = errno;
 		topo_mod_dprintf(mod, "could not open '%s' for ioctl: %s\n",
 		    devctl, strerror(errno));
+		errno = en;
 		return (-1);
 	}
 
 	if (ioctl(fd, MPTIOCTL_GET_DISK_INFO, &gdi) == -1) {
+		if (errno != ENOENT)
+			en = errno;
 		topo_mod_dprintf(mod, "ioctl 1 on '%s' failed: %s\n", devctl,
 		    strerror(errno));
-		(void) close(fd);
-		return (-1);
+		goto out;
 	}
 
 	gdi.DiskInfoArraySize = disz = sizeof (mptsas_disk_info_t) *
@@ -61,19 +71,19 @@ get_sas_address(topo_mod_t *mod, char *devctl, uint32_t enclosure,
 	gdi.PtrDiskInfoArray = di = topo_mod_alloc(mod, disz);
 	if (di == NULL) {
 		topo_mod_dprintf(mod, "memory allocation failed\n");
-		(void) close(fd);
-		return (-1);
+		en = ENOMEM;
+		goto out;
 	}
 
 	if (ioctl(fd, MPTIOCTL_GET_DISK_INFO, &gdi) == -1) {
+		if (errno != ENOENT)
+			en = errno;
 		topo_mod_dprintf(mod, "ioctl 2 on '%s' failed: %s\n", devctl,
 		    strerror(errno));
 		topo_mod_free(mod, di, disz);
-		(void) close(fd);
-		return (-1);
+		goto out;
 	}
 
-	err = -1;
 	for (i = 0; i < gdi.DiskCount; i++) {
 		if (di[i].Enclosure == enclosure && di[i].Slot == slot) {
 			char sas[17]; /* 16 hex digits and NUL */
@@ -81,14 +91,16 @@ get_sas_address(topo_mod_t *mod, char *devctl, uint32_t enclosure,
 			topo_mod_dprintf(mod, "found mpt_sas disk (%d/%d) "
 			    "with adddress %s\n", enclosure, slot, sas);
 			*sas_address = topo_mod_strdup(mod, sas);
-			err = 0;
+			en = ret = 0;
 			break;
 		}
 	}
 
 	topo_mod_free(mod, di, disz);
+out:
 	(void) close(fd);
-	return (err);
+	errno = en;
+	return (ret);
 }
 
 int
@@ -97,6 +109,8 @@ disk_mptsas_find_disk(topo_mod_t *mod, tnode_t *baynode, char **sas_address)
 	char *devctl = NULL;
 	uint32_t enclosure, slot;
 	int err;
+	char *elem, *lastp;
+	int ret = -1;
 
 	/*
 	 * Get the required properties from the node.  These come from
@@ -115,6 +129,35 @@ disk_mptsas_find_disk(topo_mod_t *mod, tnode_t *baynode, char **sas_address)
 		return (-1);
 	}
 
-	return (get_sas_address(mod, devctl, enclosure, slot, sas_address));
+	/*
+	 * devctl is a (potentially) pipe-separated list of different device
+	 * paths to try.
+	 */
+	if ((elem = topo_mod_strsplit(mod, devctl, "|", &lastp)) != NULL) {
+		boolean_t done = B_FALSE;
+		do {
+			topo_mod_dprintf(mod, "trying mpt_sas instance at %s\n",
+			    elem);
+
+			ret = get_sas_address(mod, elem, enclosure,
+			    slot, sas_address);
+
+			/*
+			 * Only try further devctl paths from the list if this
+			 * one was not found:
+			 */
+			if (ret == 0 || errno != ENOENT) {
+				done = B_TRUE;
+			} else {
+				topo_mod_dprintf(mod, "instance not found\n");
+			}
+
+			topo_mod_strfree(mod, elem);
+
+		} while (!done && (elem = topo_mod_strsplit(mod, NULL, "|",
+		    &lastp)) != NULL);
+	}
 
+	topo_mod_strfree(mod, devctl);
+	return (ret);
 }
diff --git a/usr/src/lib/fm/topo/modules/common/fac_prov_mptsas/fac_prov_mptsas.c b/usr/src/lib/fm/topo/modules/common/fac_prov_mptsas/fac_prov_mptsas.c
index a49a131811..115e3b801d 100644
--- a/usr/src/lib/fm/topo/modules/common/fac_prov_mptsas/fac_prov_mptsas.c
+++ b/usr/src/lib/fm/topo/modules/common/fac_prov_mptsas/fac_prov_mptsas.c
@@ -72,6 +72,12 @@ _topo_fini(topo_mod_t *mod)
 	topo_mod_unregister(mod);
 }
 
+/*
+ * Get or set LED state for a particular target attached to an mpt_sas
+ * instance at (Enclosure Number, Slot Number).  The function returns
+ * -1 on error and sets errno to ENOENT _only_ if the /devices node
+ *  (*devctl) does not exist.
+ */
 static int
 do_led_control(topo_mod_t *mod, char *devctl, uint16_t enclosure,
     uint16_t slot, uint8_t led, uint32_t *ledmode, boolean_t set)
@@ -88,8 +94,10 @@ do_led_control(topo_mod_t *mod, char *devctl, uint16_t enclosure,
 	lc.LedStatus = *ledmode;
 
 	if ((fd = open(devctl, (set ? O_RDWR : O_RDONLY))) == -1) {
+		int en = errno;
 		topo_mod_dprintf(mod, "devctl open failed: %s",
 		    strerror(errno));
+		errno = en;
 		return (-1);
 	}
 
@@ -103,9 +111,11 @@ do_led_control(topo_mod_t *mod, char *devctl, uint16_t enclosure,
 			 */
 			lc.LedStatus = 0;
 		} else {
+			int en = errno;
 			topo_mod_dprintf(mod, "led control ioctl failed: %s",
 			    strerror(errno));
 			(void) close(fd);
+			errno = en;
 			return (-1);
 		}
 	}
@@ -113,6 +123,7 @@ do_led_control(topo_mod_t *mod, char *devctl, uint16_t enclosure,
 	*ledmode = lc.LedStatus ? TOPO_LED_STATE_ON : TOPO_LED_STATE_OFF;
 
 	(void) close(fd);
+	errno = 0;
 	return (0);
 }
 
@@ -127,7 +138,8 @@ mptsas_led_mode(topo_mod_t *mod, tnode_t *node, topo_version_t vers,
 	char *driver = NULL, *devctl = NULL;
 	uint32_t enclosure, slot;
 	uint8_t mptsas_led;
-	boolean_t set;
+	boolean_t set, done;
+	char *elem, *lastp;
 
 	if (vers > TOPO_METH_MPTSAS_LED_MODE_VERSION)
 		return (topo_mod_seterrno(mod, ETOPO_METHOD_VERNEW));
@@ -197,8 +209,41 @@ mptsas_led_mode(topo_mod_t *mod, tnode_t *node, topo_version_t vers,
 		topo_mod_dprintf(mod, "%s: Getting LED mode\n", __func__);
 	}
 
-	if (do_led_control(mod, devctl, enclosure, slot, mptsas_led, &ledmode,
-	    set) != 0) {
+	/*
+	 * devctl is a (potentially) pipe-separated list of different device
+	 * paths to try.
+	 */
+	if ((elem = topo_mod_strsplit(mod, devctl, "|", &lastp)) == NULL) {
+		topo_mod_dprintf(mod, "%s: could not parse devctl list",
+		    __func__);
+		ret = topo_mod_seterrno(mod, EMOD_UNKNOWN);
+		goto out;
+	}
+	done = B_FALSE;
+	do {
+		topo_mod_dprintf(mod, "%s: trying mpt_sas instance at %s\n",
+		    __func__, elem);
+
+		ret = do_led_control(mod, elem, enclosure, slot,
+		    mptsas_led, &ledmode, set);
+
+		/*
+		 * Only try further devctl paths from the list if this one
+		 * was not found:
+		 */
+		if (ret == 0 || errno != ENOENT) {
+			done = B_TRUE;
+		} else {
+			topo_mod_dprintf(mod, "%s: instance not found\n",
+			    __func__);
+		}
+
+		topo_mod_strfree(mod, elem);
+
+	} while (!done && (elem = topo_mod_strsplit(mod, NULL, "|",
+	    &lastp)) != NULL);
+
+	if (ret != 0) {
 		topo_mod_dprintf(mod, "%s: do_led_control failed", __func__);
 		ret = topo_mod_seterrno(mod, EMOD_UNKNOWN);
 		goto out;
diff --git a/usr/src/lib/fm/topo/modules/common/ipmi/Makefile b/usr/src/lib/fm/topo/modules/common/ipmi/Makefile
index b6f2839c42..4a0bf39401 100644
--- a/usr/src/lib/fm/topo/modules/common/ipmi/Makefile
+++ b/usr/src/lib/fm/topo/modules/common/ipmi/Makefile
@@ -22,7 +22,8 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
+# Copyright (c) 2018, Joyent, Inc.
+#
 
 MODULE = ipmi
 CLASS = common
@@ -31,4 +32,4 @@ MODULESRCS = ipmi_enum.c ipmi_methods.c
 
 include ../../Makefile.plugin
 
-LDLIBS += -lipmi
+LDLIBS += -lipmi -lnsl
diff --git a/usr/src/lib/fm/topo/modules/common/ipmi/ipmi_enum.c b/usr/src/lib/fm/topo/modules/common/ipmi/ipmi_enum.c
index ef7a2d23ac..1220305584 100644
--- a/usr/src/lib/fm/topo/modules/common/ipmi/ipmi_enum.c
+++ b/usr/src/lib/fm/topo/modules/common/ipmi/ipmi_enum.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #include <assert.h>
@@ -29,6 +29,9 @@
 #include <fm/topo_mod.h>
 #include <sys/fm/protocol.h>
 #include <string.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
 
 #define	TOPO_PGROUP_IPMI 		"ipmi"
 #define	TOPO_PROP_IPMI_ENTITY_REF	"entity_ref"
@@ -472,6 +475,260 @@ ipmi_check_entity(ipmi_handle_t *ihp, ipmi_entity_t *ep, void *data)
 	return (0);
 }
 
+static const char *
+ipmi2toposrc(uint8_t ipmi_ip_src)
+{
+	char *cfgtype;
+
+	switch (ipmi_ip_src) {
+	case (IPMI_LAN_SRC_STATIC):
+	case (IPMI_LAN_SRC_BIOS):
+		cfgtype = TOPO_NETCFG_TYPE_STATIC;
+		break;
+	case (IPMI_LAN_SRC_DHCP):
+		cfgtype = TOPO_NETCFG_TYPE_DHCP;
+		break;
+	default:
+		cfgtype = TOPO_NETCFG_TYPE_UNKNOWN;
+		break;
+	}
+	return (cfgtype);
+}
+
+/*
+ * Channel related IPMI commands reserve 4 bits for the channel number.
+ */
+#define	IPMI_MAX_CHANNEL	0xf
+
+static int
+ipmi_enum_sp(topo_mod_t *mod, tnode_t *pnode)
+{
+	ipmi_handle_t *ihp;
+	ipmi_channel_info_t *chinfo;
+	ipmi_lan_config_t lancfg = { 0 };
+	boolean_t found_lan = B_TRUE;
+	char ipv4_addr[INET_ADDRSTRLEN], subnet[INET_ADDRSTRLEN];
+	char gateway[INET_ADDRSTRLEN], macaddr[18];
+	char ipv6_addr[INET6_ADDRSTRLEN];
+	char **ipv6_routes;
+	const char *sp_rev, *ipv4_cfgtype, *ipv6_cfgtype;
+	nvlist_t *auth, *fmri;
+	tnode_t *sp_node;
+	topo_pgroup_info_t pgi;
+	int err, ch, i, ret = -1;
+
+	if ((ihp = topo_mod_ipmi_hold(mod)) == NULL)
+		return (0);
+
+	/*
+	 * If we're able to successfully get the service processor version by
+	 * issuing a GET_DEVICE_ID IPMI command over the KCS interface, then we
+	 * can say with certainty that a service processor exists.  If not,
+	 * then either the SP is unresponsive or one isn't present.  In either
+	 * case, we bail.
+	 */
+	if ((sp_rev = ipmi_firmware_version(ihp)) == NULL) {
+		topo_mod_dprintf(mod, "failed to query SP");
+		topo_mod_ipmi_rele(mod);
+		return (0);
+	}
+
+	if ((auth = topo_mod_auth(mod, pnode)) == NULL) {
+		topo_mod_dprintf(mod, "topo_mod_auth() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto out;
+	}
+	if ((fmri = topo_mod_hcfmri(mod, pnode, FM_HC_SCHEME_VERSION,
+	    SP, 0, NULL, auth, NULL, sp_rev, NULL)) == NULL) {
+		nvlist_free(auth);
+		topo_mod_dprintf(mod, "topo_mod_hcfmri() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto out;
+	}
+	nvlist_free(auth);
+
+	if ((sp_node = topo_node_bind(mod, pnode, SP, 0, fmri)) == NULL) {
+		nvlist_free(fmri);
+		topo_mod_dprintf(mod, "topo_node_bind() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto out;
+	}
+	nvlist_free(fmri);
+	fmri = NULL;
+
+	if (topo_node_label_set(sp_node, "service-processor", &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set label on %s=%d: %s", SP,
+		    0, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		goto out;
+	}
+
+	if (topo_node_fru(pnode, &fmri, NULL, &err) != 0 ||
+	    topo_node_fru_set(sp_node, fmri, NULL, &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set FRU on %s=%d: %s", SP, 0,
+		    topo_strerror(err));
+		nvlist_free(fmri);
+		(void) topo_mod_seterrno(mod, err);
+		goto out;
+	}
+	nvlist_free(fmri);
+
+	/*
+	 * Iterate through the channels to find the LAN channel.
+	 */
+	for (ch = 0; ch <= IPMI_MAX_CHANNEL; ch++) {
+		if ((chinfo = ipmi_get_channel_info(ihp, ch)) != NULL &&
+		    chinfo->ici_medium == IPMI_MEDIUM_8023LAN) {
+			found_lan = B_TRUE;
+			break;
+		}
+	}
+	/*
+	 * If we found a LAN channel, look up its configuration so that we can
+	 * expose it via node properties.
+	 */
+	if (found_lan != B_TRUE ||
+	    ipmi_lan_get_config(ihp, ch, &lancfg) != 0) {
+		(void) fprintf(stderr, "failed to get LAN config\n");
+		(void) topo_mod_seterrno(mod, EMOD_UNKNOWN);
+		goto out;
+	}
+
+	pgi.tpi_name = TOPO_PGROUP_NETCFG;
+	pgi.tpi_namestab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_datastab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_version = TOPO_VERSION;
+
+	if (topo_pgroup_create(sp_node, &pgi, &err) != 0) {
+		(void) topo_mod_seterrno(mod, err);
+		goto out;
+	}
+
+	/* Set MAC address property */
+	(void) sprintf(macaddr, "%02x:%02x:%02x:%02x:%02x:%02x",
+	    lancfg.ilc_macaddr[0], lancfg.ilc_macaddr[1],
+	    lancfg.ilc_macaddr[2], lancfg.ilc_macaddr[3],
+	    lancfg.ilc_macaddr[4], lancfg.ilc_macaddr[5]);
+	macaddr[17] = '\0';
+
+	if (topo_prop_set_string(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_MACADDR, TOPO_PROP_IMMUTABLE, macaddr,
+	    &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set properties on %s=%d: %s",
+		    SP, 0, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		goto out;
+	}
+
+	/* Set VLAN ID property, if VLAN is enabled */
+	if (lancfg.ilc_vlan_enabled == B_TRUE &&
+	    topo_prop_set_uint32(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_VLAN_ID, TOPO_PROP_IMMUTABLE, lancfg.ilc_vlan_id,
+	    &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set properties on %s=%d: %s",
+		    SP, 0, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		goto out;
+	}
+
+	/* Set IPv4 configuration properties if IPv4 is enabled */
+	if (lancfg.ilc_ipv4_enabled == B_TRUE &&
+	    (inet_ntop(AF_INET, &lancfg.ilc_ipaddr, ipv4_addr,
+	    sizeof (ipv4_addr)) == NULL ||
+	    inet_ntop(AF_INET, &lancfg.ilc_subnet, subnet,
+	    sizeof (subnet)) == NULL ||
+	    inet_ntop(AF_INET, &lancfg.ilc_gateway_addr, gateway,
+	    sizeof (gateway)) == NULL)) {
+		(void) fprintf(stderr, "failed to convert IP addresses: %s\n",
+		    strerror(errno));
+		(void) topo_mod_seterrno(mod, EMOD_UNKNOWN);
+		goto out;
+	}
+	ipv4_cfgtype = ipmi2toposrc(lancfg.ilc_ipaddr_source);
+	if (lancfg.ilc_ipv4_enabled == B_TRUE &&
+	    (topo_prop_set_string(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_IPV4_ADDR, TOPO_PROP_IMMUTABLE, ipv4_addr,
+	    &err) != 0 ||
+	    topo_prop_set_string(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_IPV4_SUBNET, TOPO_PROP_IMMUTABLE, subnet,
+	    &err) != 0 ||
+	    topo_prop_set_string(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_IPV4_GATEWAY, TOPO_PROP_IMMUTABLE, gateway,
+	    &err) != 0 ||
+	    topo_prop_set_string(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_IPV4_TYPE, TOPO_PROP_IMMUTABLE, ipv4_cfgtype,
+	    &err) != 0)) {
+		topo_mod_dprintf(mod, "failed to set properties on %s=%d: %s",
+		    SP, 0, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		goto out;
+	}
+
+	/* Set IPv6 configuration properties if IPv6 is enabled */
+	if (lancfg.ilc_ipv6_enabled == B_TRUE) {
+		ipv6_cfgtype = ipmi2toposrc(lancfg.ilc_ipv6_source);
+
+		if (inet_ntop(AF_INET6, &lancfg.ilc_ipv6_addr, ipv6_addr,
+		    sizeof (ipv6_addr)) == NULL) {
+			(void) fprintf(stderr, "failed to convert IPv6 "
+			    "address: %s\n", strerror(errno));
+			(void) topo_mod_seterrno(mod, EMOD_UNKNOWN);
+			goto out;
+		}
+
+		/* allocate and populate ipv6-routes string array */
+		if ((ipv6_routes = topo_mod_zalloc(mod,
+		    lancfg.ilc_ipv6_nroutes * sizeof (char *))) == NULL) {
+			/* errno set */
+			goto out;
+		}
+		for (i = 0; i < lancfg.ilc_ipv6_nroutes; i++) {
+			if ((ipv6_routes[i] = topo_mod_alloc(mod,
+			    INET6_ADDRSTRLEN)) == NULL) {
+				/* errno set */
+				goto out;
+			}
+		}
+		for (i = 0; i < lancfg.ilc_ipv6_nroutes; i++) {
+			if (inet_ntop(AF_INET6, &lancfg.ilc_ipv6_routes[i],
+			    ipv6_routes[i], sizeof (ipv6_routes[i])) == NULL) {
+				(void) fprintf(stderr, "failed to convert "
+				    "IPv6 addresses: %s\n", strerror(errno));
+				(void) topo_mod_seterrno(mod, EMOD_UNKNOWN);
+				goto out;
+			}
+		}
+	}
+	if (lancfg.ilc_ipv6_enabled == B_TRUE &&
+	    (topo_prop_set_string(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_IPV6_ADDR, TOPO_PROP_IMMUTABLE, ipv6_addr,
+	    &err) != 0 ||
+	    topo_prop_set_string_array(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_IPV6_ROUTES, TOPO_PROP_IMMUTABLE,
+	    (const char **)ipv6_routes, lancfg.ilc_ipv6_nroutes, &err) != 0 ||
+	    topo_prop_set_string(sp_node, TOPO_PGROUP_NETCFG,
+	    TOPO_PROP_NETCFG_IPV6_TYPE, TOPO_PROP_IMMUTABLE, ipv6_cfgtype,
+	    &err) != 0)) {
+		topo_mod_dprintf(mod, "failed to set properties on %s=%d: %s",
+		    SP, 0, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		goto out;
+	}
+	ret = 0;
+out:
+	if (lancfg.ilc_ipv6_nroutes > 0) {
+		for (i = 0; i < lancfg.ilc_ipv6_nroutes; i++)
+			topo_mod_free(mod, ipv6_routes[i], INET6_ADDRSTRLEN);
+		topo_mod_free(mod, ipv6_routes,
+		    lancfg.ilc_ipv6_nroutes * sizeof (char *));
+	}
+	topo_mod_ipmi_rele(mod);
+	return (ret);
+}
+
 /*
  * libtopo enumeration point.  This simply iterates over entities looking for
  * the appropriate type.
@@ -486,10 +743,11 @@ ipmi_enum(topo_mod_t *mod, tnode_t *rnode, const char *name,
 	int ret;
 
 	/*
-	 * If the node being passed in ISN'T the chassis node, then we're being
-	 * asked to post-process a statically defined node.
+	 * If the node being passed in ISN'T the chassis or motherboard node,
+	 * then we're being asked to post-process a statically defined node.
 	 */
-	if (strcmp(topo_node_name(rnode), CHASSIS) != 0) {
+	if (strcmp(topo_node_name(rnode), CHASSIS) != 0 &&
+	    strcmp(topo_node_name(rnode), MOTHERBOARD) != 0) {
 		if (ipmi_post_process(mod, rnode) != 0) {
 			topo_mod_dprintf(mod, "post processing of node %s=%d "
 			    "failed!", topo_node_name(rnode),
@@ -499,6 +757,19 @@ ipmi_enum(topo_mod_t *mod, tnode_t *rnode, const char *name,
 		return (0);
 	}
 
+	/*
+	 * For service processor enumeration we vector off into a special code
+	 * path.
+	 */
+	if (strcmp(name, SP) == 0) {
+		if (ipmi_enum_sp(mod, rnode) != 0) {
+			topo_mod_dprintf(mod, "failed to enumerate the "
+			    "service-processor");
+			return (-1);
+		}
+		return (0);
+	}
+
 	if (strcmp(name, POWERMODULE) == 0) {
 		data.ed_entity = IPMI_ET_POWER_DOMAIN;
 	} else if (strcmp(name, PSU) == 0) {
diff --git a/usr/src/lib/fm/topo/modules/common/ses/Makefile b/usr/src/lib/fm/topo/modules/common/ses/Makefile
index 578b5bf493..acd772c92f 100644
--- a/usr/src/lib/fm/topo/modules/common/ses/Makefile
+++ b/usr/src/lib/fm/topo/modules/common/ses/Makefile
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 MODULE = ses
@@ -34,6 +35,6 @@ include ../../Makefile.plugin
 CPPFLAGS += -I../disk
 
 LDLIBS += -L$(ROOTLIBDIR)/scsi -R/usr/lib/scsi -lses
-LDLIBS += -ldevinfo -ldevid -ldiskstatus -lcontract -lsysevent
+LDLIBS += -ldevinfo -ldevid -ldiskstatus -lcontract -lsysevent -ldiskmgt
 
 CLOBBERFILES += disk_common.ln
diff --git a/usr/src/lib/fm/topo/modules/common/ses/ses.c b/usr/src/lib/fm/topo/modules/common/ses/ses.c
index 681c47f005..2f85476cb8 100644
--- a/usr/src/lib/fm/topo/modules/common/ses/ses.c
+++ b/usr/src/lib/fm/topo/modules/common/ses/ses.c
@@ -23,7 +23,7 @@
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2012 Milan Jurik. All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #include <alloca.h>
@@ -2854,9 +2854,9 @@ ses_create_chassis(ses_enum_data_t *sdp, tnode_t *pnode, ses_enum_chassis_t *cp)
 	 * 'product-id', we use a concatenation of 'manufacturer-model'.  We
 	 * also take the numerical serial number and convert it to a string.
 	 */
-	if ((manufacturer = disk_auth_clean(mod, raw_manufacturer)) == NULL ||
-	    (model = disk_auth_clean(mod, raw_model)) == NULL ||
-	    (revision = disk_auth_clean(mod, raw_revision)) == NULL) {
+	if ((manufacturer = topo_mod_clean_str(mod, raw_manufacturer)) ==
+	    NULL || (model = topo_mod_clean_str(mod, raw_model)) == NULL ||
+	    (revision = topo_mod_clean_str(mod, raw_revision)) == NULL) {
 		goto error;
 	}
 
diff --git a/usr/src/lib/fm/topo/modules/common/ses/ses_facility.c b/usr/src/lib/fm/topo/modules/common/ses/ses_facility.c
index 08a4a569ee..125c41a83f 100644
--- a/usr/src/lib/fm/topo/modules/common/ses/ses_facility.c
+++ b/usr/src/lib/fm/topo/modules/common/ses/ses_facility.c
@@ -29,6 +29,10 @@
  */
 
 /*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+/*
  * Facility node support for SES enclosures.  We support the following facility
  * nodes, based on the node type:
  *
@@ -930,7 +934,7 @@ ses_add_enclosure_sensors(topo_mod_t *mod, tnode_t *tn, ses_node_t *agg,
 			    "%.*s %llu", len, desc, index);
 		}
 
-		if ((name = disk_auth_clean(mod, rawname)) == NULL)
+		if ((name = topo_mod_clean_str(mod, rawname)) == NULL)
 			return (-1);
 
 		if (ses_add_sensor(mod, tn, nodeid, name, &sd) != 0) {
diff --git a/usr/src/lib/fm/topo/modules/common/smbios/Makefile b/usr/src/lib/fm/topo/modules/common/smbios/Makefile
new file mode 100644
index 0000000000..04590063c5
--- /dev/null
+++ b/usr/src/lib/fm/topo/modules/common/smbios/Makefile
@@ -0,0 +1,22 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2018, Joyent, Inc.
+#
+
+MODULE = smbios
+CLASS = common
+MODULESRCS = smbios_enum.c
+
+include ../../Makefile.plugin
+
+LDLIBS += -lsmbios
diff --git a/usr/src/lib/fm/topo/modules/common/smbios/smbios_enum.c b/usr/src/lib/fm/topo/modules/common/smbios/smbios_enum.c
new file mode 100644
index 0000000000..ac209e90c7
--- /dev/null
+++ b/usr/src/lib/fm/topo/modules/common/smbios/smbios_enum.c
@@ -0,0 +1,638 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+#include <assert.h>
+#include <fcntl.h>
+#include <fm/libtopo.h>
+#include <fm/topo_mod.h>
+#ifdef	__x86
+#include <sys/mc.h>
+#endif
+#include <sys/fm/protocol.h>
+#include <string.h>
+#include <unistd.h>
+
+typedef struct smb_enum_data {
+	topo_mod_t	*sme_mod;
+	tnode_t		*sme_pnode;
+	tnode_t		*sme_slotnode;
+	topo_instance_t	sme_slot_inst;
+	topo_instance_t	sme_slot_maxinst;
+	smbios_info_t	*sme_smb_info;
+	char		*sme_slot_form;
+} smb_enum_data_t;
+
+/*
+ * This function serves two purposes.  It filters out memory devices that
+ * don't have a formfactor that represents a reasonably modern DIMM-like
+ * device (and hence not a device we're insterested in enumerating).  It also
+ * converts the numeric SMBIOS type representation to a more generic TOPO dimm
+ * type.
+ *
+ * Caller must free the returned string.
+ */
+static char *
+distill_dimm_form(topo_mod_t *mod, smbios_memdevice_t *smb_md)
+{
+	switch (smb_md->smbmd_form) {
+	case (SMB_MDFF_DIMM):
+		return (topo_mod_strdup(mod, TOPO_DIMM_SLOT_FORM_DIMM));
+	case (SMB_MDFF_SODIMM):
+		return (topo_mod_strdup(mod, TOPO_DIMM_SLOT_FORM_SODIMM));
+	case (SMB_MDFF_FBDIMM):
+		return (topo_mod_strdup(mod, TOPO_DIMM_SLOT_FORM_FBDIMM));
+	default:
+		topo_mod_dprintf(mod, "skipping device with form factor 0x%x",
+		    smb_md->smbmd_form);
+		return (NULL);
+	}
+}
+
+static char *
+smbios2topotype(topo_mod_t *mod, uint8_t type)
+{
+	switch (type) {
+	case (SMB_MDT_DDR):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_DDR));
+	case (SMB_MDT_DDR2):
+	case (SMB_MDT_DDR2FBDIMM):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_DDR2));
+	case (SMB_MDT_DDR3):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_DDR3));
+	case (SMB_MDT_DDR4):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_DDR4));
+	case (SMB_MDT_LPDDR):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_LPDDR));
+	case (SMB_MDT_LPDDR2):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_LPDDR2));
+	case (SMB_MDT_LPDDR3):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_LPDDR3));
+	case (SMB_MDT_LPDDR4):
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_LPDDR4));
+	default:
+		return (topo_mod_strdup(mod, TOPO_DIMM_TYPE_UNKNOWN));
+	}
+}
+
+static boolean_t
+is_valid_string(const char *str)
+{
+	if (strcmp(str, SMB_DEFAULT1) != 0 && strcmp(str, SMB_DEFAULT2) != 0 &&
+	    strcmp(str, SMB_DEFAULT3) != 0 && strlen(str) > 0)
+		return (B_TRUE);
+
+	return (B_FALSE);
+}
+
+static tnode_t *
+smbios_make_slot(smb_enum_data_t *smed, smbios_memdevice_t *smb_md)
+{
+	nvlist_t *auth, *fmri;
+	tnode_t *slotnode;
+	topo_mod_t *mod = smed->sme_mod;
+	topo_pgroup_info_t pgi;
+	int err;
+
+	if ((auth = topo_mod_auth(mod, smed->sme_pnode)) == NULL) {
+		topo_mod_dprintf(mod, "topo_mod_auth() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		return (NULL);
+	}
+
+	if ((fmri = topo_mod_hcfmri(mod, smed->sme_pnode, FM_HC_SCHEME_VERSION,
+	    SLOT, smed->sme_slot_inst, NULL, auth, NULL, NULL, NULL)) ==
+	    NULL) {
+		nvlist_free(auth);
+		topo_mod_dprintf(mod, "topo_mod_hcfmri() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		return (NULL);
+	}
+	if ((slotnode = topo_node_bind(mod, smed->sme_pnode, SLOT,
+	    smed->sme_slot_inst, fmri)) == NULL) {
+		nvlist_free(auth);
+		nvlist_free(fmri);
+		topo_mod_dprintf(mod, "topo_node_bind() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		return (NULL);
+	}
+	nvlist_free(fmri);
+	fmri = NULL;
+
+	/* Create authority and system pgroups */
+	topo_pgroup_hcset(slotnode, auth);
+	nvlist_free(auth);
+
+	if (topo_node_label_set(slotnode, (char *)smb_md->smbmd_dloc, &err) !=
+	    0) {
+		topo_mod_dprintf(mod, "failed to set label on %s=%d: %s",
+		    SLOT, smed->sme_slot_inst, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		return (NULL);
+	}
+	if (topo_node_fru(smed->sme_pnode, &fmri, NULL, &err) != 0 ||
+	    topo_node_fru_set(slotnode, fmri, NULL, &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set FRU on %s=%d: %s", SLOT,
+		    smed->sme_slot_inst, topo_strerror(err));
+		nvlist_free(fmri);
+		(void) topo_mod_seterrno(mod, err);
+		return (NULL);
+	}
+	nvlist_free(fmri);
+
+	pgi.tpi_name = TOPO_PGROUP_SLOT;
+	pgi.tpi_namestab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_datastab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_version = TOPO_VERSION;
+	if (topo_pgroup_create(slotnode, &pgi, &err) != 0 ||
+	    topo_prop_set_uint32(slotnode, TOPO_PGROUP_SLOT,
+	    TOPO_PROP_SLOT_TYPE, TOPO_PROP_IMMUTABLE, TOPO_SLOT_TYPE_DIMM,
+	    &err)) {
+		topo_mod_dprintf(mod, "failed to create slot properties: %s",
+		    topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		return (NULL);
+	}
+
+	pgi.tpi_name = TOPO_PGROUP_DIMM_SLOT;
+	pgi.tpi_namestab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_datastab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_version = TOPO_VERSION;
+	if (topo_pgroup_create(slotnode, &pgi, &err) != 0 ||
+	    topo_prop_set_string(slotnode, TOPO_PGROUP_DIMM_SLOT,
+	    TOPO_PROP_DIMM_SLOT_FORM, TOPO_PROP_IMMUTABLE, smed->sme_slot_form,
+	    &err)) {
+		topo_mod_dprintf(mod, "failed to create slot properties: %s",
+		    topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		return (NULL);
+	}
+	return (slotnode);
+}
+
+static tnode_t *
+smbios_make_dimm(smb_enum_data_t *smed, smbios_memdevice_t *smb_md)
+{
+	nvlist_t *auth, *fmri;
+	smbios_info_t *smb_info = smed->sme_smb_info;
+	tnode_t *slotnode = smed->sme_slotnode;
+	tnode_t *dimmnode, *ret = NULL;
+	topo_mod_t *mod = smed->sme_mod;
+	topo_pgroup_info_t pgi;
+	const char *part = NULL, *rev = NULL, *serial = NULL;
+	char *type, *manuf = NULL, *prod = NULL, *asset = NULL, *loc = NULL;
+	int err, rc = 0;
+
+	if ((auth = topo_mod_auth(mod, slotnode)) == NULL) {
+		topo_mod_dprintf(mod, "topo_mod_auth() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		return (NULL);
+	}
+
+	if (smed->sme_smb_info != NULL) {
+		if (is_valid_string(smb_info->smbi_part) == B_TRUE)
+			part = smb_info->smbi_part;
+		if (is_valid_string(smb_info->smbi_version) == B_TRUE)
+			rev = smb_info->smbi_version;
+		if (is_valid_string(smb_info->smbi_serial) == B_TRUE)
+			serial = smb_info->smbi_serial;
+		if (is_valid_string(smb_info->smbi_manufacturer) == B_TRUE)
+			manuf = topo_mod_clean_str(mod,
+			    smb_info->smbi_manufacturer);
+		if (is_valid_string(smb_info->smbi_product) == B_TRUE)
+			prod = topo_mod_clean_str(mod, smb_info->smbi_product);
+		if (is_valid_string(smb_info->smbi_asset) == B_TRUE)
+			asset = topo_mod_clean_str(mod, smb_info->smbi_asset);
+		if (is_valid_string(smb_info->smbi_location) == B_TRUE)
+			loc = topo_mod_clean_str(mod, smb_info->smbi_location);
+	}
+
+	if ((fmri = topo_mod_hcfmri(mod, slotnode, FM_HC_SCHEME_VERSION,
+	    DIMM, 0, NULL, auth, part, rev, serial)) == NULL) {
+		nvlist_free(auth);
+		topo_mod_dprintf(mod, "topo_mod_hcfmri() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto err;
+	}
+
+	if (topo_node_range_create(mod, slotnode, DIMM, 0, 0) < 0 ||
+	    (dimmnode = topo_node_bind(mod, slotnode, DIMM, 0, fmri)) ==
+	    NULL) {
+		nvlist_free(auth);
+		nvlist_free(fmri);
+		topo_mod_dprintf(mod, "failed to bind dimm node: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto err;
+	}
+
+	/* Create authority and system pgroups */
+	topo_pgroup_hcset(dimmnode, auth);
+	nvlist_free(auth);
+
+	if (topo_node_fru_set(dimmnode, fmri, NULL, &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set FRU on %s: %s",
+		    DIMM, topo_strerror(err));
+		nvlist_free(fmri);
+		(void) topo_mod_seterrno(mod, err);
+		goto err;
+	}
+	nvlist_free(fmri);
+
+	if (topo_node_label_set(dimmnode, (char *)smb_md->smbmd_dloc, &err) !=
+	    0) {
+		topo_mod_dprintf(mod, "failed to set label on %s: %s",
+		    DIMM, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		goto err;
+	}
+
+	pgi.tpi_name = TOPO_PGROUP_DIMM_PROPS;
+	pgi.tpi_namestab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_datastab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_version = TOPO_VERSION;
+	if (topo_pgroup_create(dimmnode, &pgi, &err) != 0) {
+		(void) topo_mod_seterrno(mod, err);
+		goto err;
+	}
+
+	rc += topo_prop_set_uint64(dimmnode, TOPO_PGROUP_DIMM_PROPS, "size",
+	    TOPO_PROP_IMMUTABLE, smb_md->smbmd_size, &err);
+	if (rc == 0 && (type = smbios2topotype(mod, smb_md->smbmd_type)) !=
+	    NULL) {
+		rc += topo_prop_set_string(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "type", TOPO_PROP_IMMUTABLE, type, &err);
+		topo_mod_strfree(mod, type);
+	}
+	if (rc == 0 && smb_md->smbmd_set != 0 && smb_md->smbmd_set != 0xFF)
+		rc += topo_prop_set_uint32(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "set", TOPO_PROP_IMMUTABLE, smb_md->smbmd_set, &err);
+	if (rc == 0 && smb_md->smbmd_rank != 0)
+		rc += topo_prop_set_uint32(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "rank", TOPO_PROP_IMMUTABLE, smb_md->smbmd_rank, &err);
+	if (rc == 0 && smb_md->smbmd_clkspeed != 0)
+		rc += topo_prop_set_uint32(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "configured-speed", TOPO_PROP_IMMUTABLE,
+		    smb_md->smbmd_clkspeed, &err);
+	if (rc == 0 && smb_md->smbmd_speed != 0)
+		rc += topo_prop_set_uint32(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "maximum-speed", TOPO_PROP_IMMUTABLE, smb_md->smbmd_speed,
+		    &err);
+	if (rc == 0 && smb_md->smbmd_maxvolt != 0)
+		rc += topo_prop_set_double(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "maximum-voltage", TOPO_PROP_IMMUTABLE,
+		    (smb_md->smbmd_maxvolt / 1000), &err);
+	if (rc == 0 && smb_md->smbmd_minvolt != 0)
+		rc += topo_prop_set_double(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "minimum-voltage", TOPO_PROP_IMMUTABLE,
+		    (smb_md->smbmd_minvolt / 1000), &err);
+	if (rc == 0 && smb_md->smbmd_confvolt != 0)
+		rc += topo_prop_set_double(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "configured-voltage", TOPO_PROP_IMMUTABLE,
+		    (smb_md->smbmd_confvolt / 1000), &err);
+	if (rc == 0 && manuf != NULL)
+		rc += topo_prop_set_string(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "manufacturer", TOPO_PROP_IMMUTABLE, manuf, &err);
+	if (rc == 0 && prod != NULL)
+		rc += topo_prop_set_string(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "product", TOPO_PROP_IMMUTABLE, prod, &err);
+	if (rc == 0 && asset != NULL)
+		rc += topo_prop_set_string(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "asset-tag", TOPO_PROP_IMMUTABLE, asset, &err);
+	if (rc == 0 && loc != NULL)
+		rc += topo_prop_set_string(dimmnode, TOPO_PGROUP_DIMM_PROPS,
+		    "location", TOPO_PROP_IMMUTABLE, loc, &err);
+
+	if (rc != 0) {
+		topo_mod_dprintf(mod, "error setting properties on %s node",
+		    DIMM);
+		(void) topo_mod_seterrno(mod, err);
+		goto err;
+	}
+	ret = dimmnode;
+err:
+	topo_mod_strfree(mod, manuf);
+	topo_mod_strfree(mod, prod);
+	topo_mod_strfree(mod, asset);
+	topo_mod_strfree(mod, loc);
+	return (ret);
+}
+
+static int
+smbios_enum_memory(smbios_hdl_t *shp, const smbios_struct_t *sp, void *arg)
+{
+	smbios_info_t smb_info;
+	smbios_memdevice_t smb_md;
+	smb_enum_data_t *smed = arg;
+	topo_mod_t *mod = smed->sme_mod;
+	tnode_t *slotnode;
+
+	if (sp->smbstr_type != SMB_TYPE_MEMDEVICE)
+		return (0);
+
+	if (smbios_info_memdevice(shp, sp->smbstr_id, &smb_md) != 0) {
+		topo_mod_dprintf(mod, "libsmbios error");
+		return (topo_mod_seterrno(mod, EMOD_UNKNOWN));
+	}
+
+	/*
+	 * SMB_TYPE_MEMDEVICE records can also be used to represent memory
+	 * that come in non-DIMM form factors. If we encounter something like
+	 * that, then we skip over it.
+	 */
+	if ((smed->sme_slot_form = distill_dimm_form(mod, &smb_md)) == NULL)
+		return (0);
+
+	if ((slotnode = smbios_make_slot(smed, &smb_md)) == NULL) {
+		topo_mod_dprintf(mod, "failed to create %s node", SLOT);
+		topo_mod_strfree(mod, smed->sme_slot_form);
+		/* errno set */
+		return (-1);
+	}
+	topo_mod_strfree(mod, smed->sme_slot_form);
+	smed->sme_slotnode = slotnode;
+
+	/*
+	 * A size of zero indicates that the DIMM slot is not populated, so
+	 * we skip creating a child dimm node and return.
+	 */
+	if (smb_md.smbmd_size == 0) {
+		smed->sme_slot_inst++;
+		return (0);
+	}
+
+	if (smbios_info_common(shp, sp->smbstr_id, &smb_info) == 0)
+		smed->sme_smb_info = &smb_info;
+
+	if (smbios_make_dimm(smed, &smb_md) == NULL) {
+		topo_mod_dprintf(mod, "failed to create %s node", DIMM);
+		/* errno set */
+		return (-1);
+	}
+	/*
+	 * If we've exceeded our max inst then return non-zero to cause
+	 * the walk to terminate.
+	 */
+	if (++smed->sme_slot_inst > smed->sme_slot_maxinst)
+		return (1);
+
+	return (0);
+}
+
+static int
+smbios_enum_motherboard(smbios_hdl_t *shp, smb_enum_data_t *smed)
+{
+	smbios_struct_t sp;
+	smbios_bboard_t smb_mb;
+	smbios_bios_t smb_bios;
+	smbios_info_t smb_info;
+	const char *part = NULL, *rev = NULL, *serial = NULL;
+	char *manuf = NULL, *prod = NULL, *asset = NULL;
+	char *bios_vendor = NULL, *bios_rev = NULL, *bios_reldate = NULL;
+	nvlist_t *auth, *fmri;
+	topo_mod_t *mod = smed->sme_mod;
+	tnode_t *mbnode;
+	topo_pgroup_info_t pgi;
+	int rc = 0, err;
+
+	if (smbios_lookup_type(shp, SMB_TYPE_BASEBOARD, &sp) == 0 &&
+	    smbios_info_bboard(shp, sp.smbstr_id, &smb_mb) == 0 &&
+	    smbios_info_common(shp, sp.smbstr_id, &smb_info) == 0) {
+		if (is_valid_string(smb_info.smbi_part) == B_TRUE)
+			part = smb_info.smbi_part;
+		if (is_valid_string(smb_info.smbi_version) == B_TRUE)
+			rev = smb_info.smbi_version;
+		if (is_valid_string(smb_info.smbi_serial) == B_TRUE)
+			serial = smb_info.smbi_serial;
+		if (is_valid_string(smb_info.smbi_manufacturer) == B_TRUE)
+			manuf = topo_mod_clean_str(mod,
+			    smb_info.smbi_manufacturer);
+		if (is_valid_string(smb_info.smbi_product) == B_TRUE)
+			prod = topo_mod_clean_str(mod, smb_info.smbi_product);
+		if (is_valid_string(smb_info.smbi_asset) == B_TRUE)
+			asset = topo_mod_clean_str(mod, smb_info.smbi_asset);
+	}
+	if (smbios_lookup_type(shp, SMB_TYPE_BIOS, &sp) == 0 &&
+	    smbios_info_bios(shp, &smb_bios) == 0) {
+		if (is_valid_string(smb_bios.smbb_vendor) == B_TRUE)
+			bios_vendor = topo_mod_clean_str(mod,
+			    smb_bios.smbb_vendor);
+		if (is_valid_string(smb_bios.smbb_version) == B_TRUE)
+			bios_rev = topo_mod_clean_str(mod,
+			    smb_bios.smbb_version);
+		if (is_valid_string(smb_bios.smbb_reldate) == B_TRUE)
+			bios_reldate = topo_mod_clean_str(mod,
+			    smb_bios.smbb_reldate);
+	}
+	if ((auth = topo_mod_auth(mod, smed->sme_pnode)) == NULL) {
+		topo_mod_dprintf(mod, "topo_mod_auth() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto err;
+	}
+
+	if ((fmri = topo_mod_hcfmri(mod, NULL, FM_HC_SCHEME_VERSION,
+	    MOTHERBOARD, 0, NULL, auth, part, rev, serial)) ==
+	    NULL) {
+		nvlist_free(auth);
+		topo_mod_dprintf(mod, "topo_mod_hcfmri() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto err;
+	}
+
+	if ((mbnode = topo_node_bind(mod, smed->sme_pnode, MOTHERBOARD, 0,
+	    fmri)) == NULL) {
+		nvlist_free(auth);
+		nvlist_free(fmri);
+		topo_mod_dprintf(mod, "topo_node_bind() failed: %s",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		goto err;
+	}
+
+	/* Create authority and system pgroups */
+	topo_pgroup_hcset(mbnode, auth);
+	nvlist_free(auth);
+
+	if (topo_node_fru_set(mbnode, fmri, NULL, &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set FRU on %s: %s",
+		    MOTHERBOARD, topo_strerror(err));
+		nvlist_free(fmri);
+		(void) topo_mod_seterrno(mod, err);
+		goto err;
+	}
+	nvlist_free(fmri);
+	fmri = NULL;
+
+	if (topo_node_label_set(mbnode, "MB", &err) != 0) {
+		topo_mod_dprintf(mod, "failed to set label on %s: %s",
+		    MOTHERBOARD, topo_strerror(err));
+		(void) topo_mod_seterrno(mod, err);
+		goto err;
+	}
+
+	pgi.tpi_name = TOPO_PGROUP_MOTHERBOARD;
+	pgi.tpi_namestab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_datastab = TOPO_STABILITY_PRIVATE;
+	pgi.tpi_version = TOPO_VERSION;
+	rc = topo_pgroup_create(mbnode, &pgi, &err);
+
+	if (rc == 0 && manuf != NULL)
+		rc += topo_prop_set_string(mbnode, TOPO_PGROUP_MOTHERBOARD,
+		    TOPO_PROP_MB_MANUFACTURER, TOPO_PROP_IMMUTABLE, manuf,
+		    &err);
+	if (rc == 0 && prod != NULL)
+		rc += topo_prop_set_string(mbnode, TOPO_PGROUP_MOTHERBOARD,
+		    TOPO_PROP_MB_PRODUCT, TOPO_PROP_IMMUTABLE, prod, &err);
+	if (rc == 0 && asset != NULL)
+		rc += topo_prop_set_string(mbnode, TOPO_PGROUP_MOTHERBOARD,
+		    TOPO_PROP_MB_ASSET, TOPO_PROP_IMMUTABLE, asset, &err);
+	if (rc == 0 && bios_vendor != NULL)
+		rc += topo_prop_set_string(mbnode, TOPO_PGROUP_MOTHERBOARD,
+		    TOPO_PROP_MB_FIRMWARE_VENDOR, TOPO_PROP_IMMUTABLE,
+		    bios_vendor, &err);
+	if (rc == 0 && bios_rev != NULL)
+		rc += topo_prop_set_string(mbnode, TOPO_PGROUP_MOTHERBOARD,
+		    TOPO_PROP_MB_FIRMWARE_REV, TOPO_PROP_IMMUTABLE,
+		    bios_rev, &err);
+	if (rc == 0 && bios_reldate != NULL)
+		rc += topo_prop_set_string(mbnode, TOPO_PGROUP_MOTHERBOARD,
+		    TOPO_PROP_MB_FIRMWARE_RELDATE, TOPO_PROP_IMMUTABLE,
+		    bios_reldate, &err);
+
+	if (rc != 0) {
+		topo_mod_dprintf(mod, "error setting properties on %s node",
+		    MOTHERBOARD);
+		(void) topo_mod_seterrno(mod, err);
+		goto err;
+	}
+err:
+	topo_mod_strfree(mod, manuf);
+	topo_mod_strfree(mod, prod);
+	topo_mod_strfree(mod, asset);
+	topo_mod_strfree(mod, bios_vendor);
+	topo_mod_strfree(mod, bios_rev);
+	topo_mod_strfree(mod, bios_reldate);
+
+	return (0);
+}
+
+/*
+ * A system with a functional memory controller driver will have one  mc device
+ * node per chip instance, starting at instance 0.  The driver provides an
+ * ioctl interface for retrieving a snapshot of the system's memory topology.
+ * If we're able to issue this ioctl on one of the mc device nodes then we'll
+ * return B_TRUE, indicating that this system has a minimally functional memory
+ * controller driver.
+ */
+static boolean_t
+has_mc_driver()
+{
+#ifdef	__x86
+	int mc_fd;
+	mc_snapshot_info_t mcs;
+
+	if ((mc_fd = open("/dev/mc/mc0", O_RDONLY)) < 0)
+		return (B_FALSE);
+
+	if (ioctl(mc_fd, MC_IOC_SNAPSHOT_INFO, &mcs) < 0) {
+		(void) close(mc_fd);
+		return (B_FALSE);
+	}
+	(void) close(mc_fd);
+	return (B_TRUE);
+#else
+	return (B_TRUE);
+#endif
+}
+
+/*ARGSUSED*/
+static int
+smbios_enum(topo_mod_t *mod, tnode_t *rnode, const char *name,
+    topo_instance_t min, topo_instance_t max, void *arg, void *unused)
+{
+	smbios_hdl_t *smbh;
+	smb_enum_data_t smed = { 0 };
+
+	if ((smbh = topo_mod_smbios(mod)) == NULL) {
+		topo_mod_dprintf(mod, "failed to get libsmbios handle");
+		return (topo_mod_seterrno(mod, EMOD_UNKNOWN));
+	}
+	smed.sme_mod = mod;
+	smed.sme_pnode = rnode;
+	smed.sme_slot_inst = min;
+	smed.sme_slot_maxinst = max;
+
+	/*
+	 * Currently we only support enumerating dimm-slot and dimm nodes, but
+	 * this module could be expanded in the future to enumerate other
+	 * hardware components from SMBIOS.
+	 */
+	if (strcmp(name, SLOT) == 0) {
+		/*
+		 * If the system has a functional memory controller driver then
+		 * we'll assume that it has responsibility for enumerating the
+		 * memory topology.
+		 */
+		if (has_mc_driver() == B_TRUE)
+			return (0);
+		if (smbios_iter(smbh, smbios_enum_memory, &smed) < 0)
+			/* errno set */
+			return (-1);
+	} else if (strcmp(name, MOTHERBOARD) == 0) {
+		if (smbios_enum_motherboard(smbh, &smed) < 0)
+			/* errno set */
+			return (-1);
+	} else {
+		topo_mod_dprintf(mod, "smbios_enum() invoked for unsupported "
+		    "node type: %s", name);
+		return (topo_mod_seterrno(mod, EMOD_UNKNOWN));
+	}
+	return (0);
+}
+
+const topo_modops_t smbios_ops = { smbios_enum, NULL };
+
+const topo_modinfo_t smbios_info =
+	{ "smbios", FM_FMRI_SCHEME_HC, TOPO_VERSION, &smbios_ops };
+
+/*ARGSUSED*/
+int
+_topo_init(topo_mod_t *mod, topo_version_t version)
+{
+	if (getenv("TOPOSMBIOSDEBUG") != NULL)
+		topo_mod_setdebug(mod);
+
+	if (topo_mod_register(mod, &smbios_info, TOPO_VERSION) != 0) {
+		topo_mod_dprintf(mod, "module registration failed: %s\n",
+		    topo_mod_errmsg(mod));
+		/* errno set */
+		return (-1);
+	}
+
+	topo_mod_dprintf(mod, "SMBIOS enumerator initialized\n");
+	return (0);
+}
+
+void
+_topo_fini(topo_mod_t *mod)
+{
+	topo_mod_unregister(mod);
+}
diff --git a/usr/src/lib/fm/topo/modules/i86pc/chip/chip.c b/usr/src/lib/fm/topo/modules/i86pc/chip/chip.c
index b293cadf78..dd18ca5e33 100644
--- a/usr/src/lib/fm/topo/modules/i86pc/chip/chip.c
+++ b/usr/src/lib/fm/topo/modules/i86pc/chip/chip.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #include <unistd.h>
@@ -86,6 +87,9 @@ static const topo_method_t chip_methods[] = {
 	    TOPO_STABILITY_INTERNAL, a4fplus_chip_label},
 	{ FSB2_CHIP_LBL, "Property method", 0,
 	    TOPO_STABILITY_INTERNAL, fsb2_chip_label},
+	{ TOPO_METH_REPLACED, TOPO_METH_REPLACED_DESC,
+	    TOPO_METH_REPLACED_VERSION, TOPO_STABILITY_INTERNAL,
+	    chip_fmri_replaced },
 	{ NULL }
 };
 
@@ -143,7 +147,7 @@ is_xpv(void)
 
 static tnode_t *
 create_node(topo_mod_t *mod, tnode_t *pnode, nvlist_t *auth, char *name,
-    topo_instance_t inst, uint16_t smbios_id)
+    topo_instance_t inst, nvlist_t *cpu, uint16_t smbios_id)
 {
 	nvlist_t *fmri;
 	tnode_t *cnode;
@@ -179,6 +183,17 @@ create_node(topo_mod_t *mod, tnode_t *pnode, nvlist_t *auth, char *name,
 		topo_mod_strfree(mod, (char *)serial);
 		topo_mod_strfree(mod, (char *)part);
 		topo_mod_strfree(mod, (char *)rev);
+	} else {
+		char *serial = NULL;
+
+		if (nvlist_lookup_string(cpu, FM_PHYSCPU_INFO_CHIP_IDENTSTR,
+		    &serial) == 0) {
+			if (nvlist_add_string(fmri, FM_FMRI_HC_SERIAL_ID,
+			    serial) != 0) {
+				whinge(mod, NULL,
+				    "create_node: nvlist_add_string failed\n");
+			}
+		}
 	}
 
 	cnode = topo_node_bind(mod, pnode, name, inst, fmri);
@@ -218,7 +233,7 @@ create_strand(topo_mod_t *mod, tnode_t *pnode, nvlist_t *cpu,
 	}
 
 	if ((strand = create_node(mod, pnode, auth, STRAND_NODE_NAME,
-	    strandid, chip_smbiosid)) == NULL)
+	    strandid, cpu, chip_smbiosid)) == NULL)
 		return (-1);
 
 	/*
@@ -339,7 +354,7 @@ create_core(topo_mod_t *mod, tnode_t *pnode, nvlist_t *cpu,
 	}
 	if ((core = topo_node_lookup(pnode, CORE_NODE_NAME, coreid)) == NULL) {
 		if ((core = create_node(mod, pnode, auth, CORE_NODE_NAME,
-		    coreid, chip_smbiosid)) == NULL)
+		    coreid, cpu, chip_smbiosid)) == NULL)
 			return (-1);
 
 		/*
@@ -508,7 +523,7 @@ create_chip(topo_mod_t *mod, tnode_t *pnode, topo_instance_t min,
 
 	if ((chip = topo_node_lookup(pnode, CHIP_NODE_NAME, chipid)) == NULL) {
 		if ((chip = create_node(mod, pnode, auth, CHIP_NODE_NAME,
-		    chipid, smbios_id)) == NULL)
+		    chipid, cpu, smbios_id)) == NULL)
 			return (-1);
 		/*
 		 * Do not register XML map methods if SMBIOS can provide
diff --git a/usr/src/lib/fm/topo/modules/i86pc/chip/chip.h b/usr/src/lib/fm/topo/modules/i86pc/chip/chip.h
index 503e3c4ede..a07b92380d 100644
--- a/usr/src/lib/fm/topo/modules/i86pc/chip/chip.h
+++ b/usr/src/lib/fm/topo/modules/i86pc/chip/chip.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef _CHIP_H
@@ -182,6 +183,8 @@ extern int ntv_page_unretire(topo_mod_t *, tnode_t *, topo_version_t,
     nvlist_t *, nvlist_t **);
 extern int ntv_page_unusable(topo_mod_t *, tnode_t *, topo_version_t,
     nvlist_t *, nvlist_t **);
+extern int chip_fmri_replaced(topo_mod_t *, tnode_t *, topo_version_t,
+    nvlist_t *, nvlist_t **);
 
 extern int mem_asru_create(topo_mod_t *, nvlist_t *, nvlist_t **);
 
diff --git a/usr/src/lib/fm/topo/modules/i86pc/chip/chip_subr.c b/usr/src/lib/fm/topo/modules/i86pc/chip/chip_subr.c
index 3725a63a12..93c308a281 100644
--- a/usr/src/lib/fm/topo/modules/i86pc/chip/chip_subr.c
+++ b/usr/src/lib/fm/topo/modules/i86pc/chip/chip_subr.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -812,3 +813,54 @@ ntv_page_unusable(topo_mod_t *mod, tnode_t *node, topo_version_t version,
 	return (set_retnvl(mod, out, TOPO_METH_UNUSABLE_RET,
 	    rc == FMD_AGENT_RETIRE_DONE ? 1 : 0));
 }
+
+/*
+ * Determine whether or not we believe a chip has been replaced. While it's
+ * tempting to just do a straight up comparison of the FMRI and its serial
+ * number, things are not that straightforward.
+ *
+ * The presence of a serial number on the CPU is not always guaranteed. It is
+ * possible that systems firmware can hide the information required to generate
+ * a synthesized serial number or that it is strictly not present. As such, we
+ * will only declare something replaced when both the old and current resource
+ * have a serial number present. If it is missing for whatever reason, then we
+ * cannot assume anything about a replacement having occurred.
+ *
+ * This logic applies regardless of whether or not we have an FM-aware SMBIOS.
+ */
+int
+chip_fmri_replaced(topo_mod_t *mod, tnode_t *node, topo_version_t version,
+    nvlist_t *in, nvlist_t **out)
+{
+	nvlist_t *rsrc = NULL;
+	int err, ret;
+	char *old_serial, *new_serial;
+
+	if (version > TOPO_METH_REPLACED_VERSION)
+		return (topo_mod_seterrno(mod, EMOD_VER_NEW));
+
+	if (topo_node_resource(node, &rsrc, &err) == -1) {
+		return (topo_mod_seterrno(mod, err));
+	}
+
+	if (nvlist_lookup_string(rsrc, FM_FMRI_HC_SERIAL_ID,
+	    &new_serial) != 0) {
+		ret = FMD_OBJ_STATE_UNKNOWN;
+		goto out;
+	}
+
+	if (nvlist_lookup_string(in, FM_FMRI_HC_SERIAL_ID, &old_serial) != 0) {
+		ret = FMD_OBJ_STATE_UNKNOWN;
+		goto out;
+	}
+
+	if (strcmp(old_serial, new_serial) == 0) {
+		ret = FMD_OBJ_STATE_STILL_PRESENT;
+	} else {
+		ret = FMD_OBJ_STATE_REPLACED;
+	}
+
+out:
+	nvlist_free(rsrc);
+	return (set_retnvl(mod, out, TOPO_METH_REPLACED_RET, ret));
+}
diff --git a/usr/src/lib/krb5/plugins/preauth/pkinit/Makefile.com b/usr/src/lib/krb5/plugins/preauth/pkinit/Makefile.com
index 8449d22e24..07fcb2bbf7 100644
--- a/usr/src/lib/krb5/plugins/preauth/pkinit/Makefile.com
+++ b/usr/src/lib/krb5/plugins/preauth/pkinit/Makefile.com
@@ -70,7 +70,7 @@ CERRWARN	+= -_gcc=-Wno-unused-function
 
 CFLAGS +=	$(CCVERBOSE) -I..
 DYNFLAGS +=	$(KRUNPATH) $(KMECHLIB) -znodelete
-LDLIBS +=	-L $(ROOTLIBDIR) -lcrypto -lc
+LDLIBS +=	-L $(ROOTLIBDIR) -lsunw_crypto -lc
 
 ROOTLIBDIR= $(ROOT)/usr/lib/krb5/plugins/preauth
 
diff --git a/usr/src/lib/libbc/inc/include/sys/socket.h b/usr/src/lib/libbc/inc/include/sys/socket.h
index 03961f805b..6607721e62 100644
--- a/usr/src/lib/libbc/inc/include/sys/socket.h
+++ b/usr/src/lib/libbc/inc/include/sys/socket.h
@@ -3,8 +3,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * Copyright (c) 1982, 1985, 1986 Regents of the University of California.
  * All rights reserved.  The Berkeley software License Agreement
@@ -169,6 +167,4 @@ struct msghdr {
 #define	MSG_PEEK	0x2		/* peek at incoming message */
 #define	MSG_DONTROUTE	0x4		/* send without using routing tables */
 
-#define	MSG_MAXIOVLEN	16
-
 #endif /*!_sys_socket_h*/
diff --git a/usr/src/lib/libbe/common/be_list.c b/usr/src/lib/libbe/common/be_list.c
index 373b8ef6e5..d56a9b6974 100644
--- a/usr/src/lib/libbe/common/be_list.c
+++ b/usr/src/lib/libbe/common/be_list.c
@@ -25,6 +25,7 @@
 
 /*
  * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2011 Joyent, Inc. All rights reserved.
  * Copyright 2015 Toomas Soome <tsoome@me.com>
  * Copyright 2015 Gary Mills
  * Copyright (c) 2016 Martin Matuska. All rights reserved.
diff --git a/usr/src/lib/libbrand/common/libbrand.c b/usr/src/lib/libbrand/common/libbrand.c
index d0343acc47..dc406d60a0 100644
--- a/usr/src/lib/libbrand/common/libbrand.c
+++ b/usr/src/lib/libbrand/common/libbrand.c
@@ -323,6 +323,7 @@ i_substitute_tokens(const char *sbuf, char *dbuf, int dbuf_size,
     const char *curr_zone)
 {
 	int dst, src;
+	static char *env_pool = NULL;
 
 	/*
 	 * Walk through the characters, substituting values as needed.
@@ -339,6 +340,13 @@ i_substitute_tokens(const char *sbuf, char *dbuf, int dbuf_size,
 		case '%':
 			dst += strlcpy(dbuf + dst, "%", dbuf_size - dst);
 			break;
+		case 'P':
+			if (env_pool == NULL)
+				env_pool = getenv("_ZONEADMD_ZPOOL");
+			if (env_pool == NULL)
+				break;
+			dst += strlcpy(dbuf + dst, env_pool, dbuf_size - dst);
+			break;
 		case 'R':
 			if (zonepath == NULL)
 				break;
@@ -817,6 +825,7 @@ i_brand_platform_iter_mounts(struct brand_handle *bhp, const char *zonename,
 	xmlNodePtr node;
 	xmlChar *special, *dir, *type, *opt;
 	char special_exp[MAXPATHLEN];
+	char dir_exp[MAXPATHLEN];
 	char opt_exp[MAXPATHLEN];
 	int ret;
 
@@ -843,6 +852,10 @@ i_brand_platform_iter_mounts(struct brand_handle *bhp, const char *zonename,
 		    special_exp, sizeof (special_exp),
 		    zonename, zonepath, NULL, NULL)) != 0)
 			goto next;
+		if ((ret = i_substitute_tokens((char *)dir,
+		    dir_exp, sizeof (dir_exp),
+		    zonename, zonepath, NULL, NULL)) != 0)
+			goto next;
 
 		/* opt might not be defined */
 		if (strlen((const char *)opt) == 0) {
@@ -855,7 +868,7 @@ i_brand_platform_iter_mounts(struct brand_handle *bhp, const char *zonename,
 				goto next;
 		}
 
-		ret = func(data, (char *)special_exp, (char *)dir,
+		ret = func(data, (char *)special_exp, (char *)dir_exp,
 		    (char *)type, ((opt != NULL) ? opt_exp : NULL));
 
 next:
diff --git a/usr/src/lib/libbsm/common/adt.c b/usr/src/lib/libbsm/common/adt.c
index d598decc60..20741efa75 100644
--- a/usr/src/lib/libbsm/common/adt.c
+++ b/usr/src/lib/libbsm/common/adt.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  * Copyright 2017 OmniOS Community Edition (OmniOSce) Association.
  */
 
@@ -731,7 +732,37 @@ adt_get_hostIP(const char *hostname, au_tid_addr_t *p_term)
 	int	tries = 3;
 	char	msg[512];
 	int	eai_err;
+	struct ifaddrlist al;
+	int	family;
+	boolean_t found = B_FALSE;
 
+	/*
+	 * getaddrinfo can take a long time to timeout if it can't map the
+	 * hostname to an IP address so try to get an IP address from a local
+	 * interface first.
+	 */
+	family = AF_INET6;
+	if (adt_get_local_address(family, &al) == 0) {
+		found = B_TRUE;
+	} else {
+		family = AF_INET;
+		if (adt_get_local_address(family, &al) == 0)
+			found = B_TRUE;
+	}
+
+	if (found) {
+		if (family == AF_INET) {
+			p_term->at_type = AU_IPv4;
+			(void) memcpy(p_term->at_addr, &al.addr.addr, AU_IPv4);
+		} else {
+			p_term->at_type = AU_IPv6;
+			(void) memcpy(p_term->at_addr, &al.addr.addr6, AU_IPv6);
+		}
+
+		return (0);
+	}
+
+	/* Now try getaddrinfo */
 	while ((tries-- > 0) &&
 	    ((eai_err = getaddrinfo(hostname, NULL, NULL, &ai)) != 0)) {
 		/*
@@ -768,7 +799,9 @@ adt_get_hostIP(const char *hostname, au_tid_addr_t *p_term)
 		}
 		freeaddrinfo(ai);
 		return (0);
-	} else if (auditstate & (AUC_AUDITING | AUC_NOSPACE)) {
+	}
+
+	if (auditstate & (AUC_AUDITING | AUC_NOSPACE)) {
 		auditinfo_addr_t  audit_info;
 
 		/*
@@ -776,58 +809,23 @@ adt_get_hostIP(const char *hostname, au_tid_addr_t *p_term)
 		 * kernel audit context
 		 */
 		if (auditon(A_GETKAUDIT, (caddr_t)&audit_info,
-		    sizeof (audit_info)) < 0) {
-			adt_write_syslog("unable to get kernel audit context",
-			    errno);
-			goto try_interface;
+		    sizeof (audit_info)) >= 0) {
+			adt_write_syslog("setting Audit IP address to kernel",
+			    0);
+			*p_term = audit_info.ai_termid;
+			return (0);
 		}
-		adt_write_syslog("setting Audit IP address to kernel", 0);
-		*p_term = audit_info.ai_termid;
-		return (0);
+		adt_write_syslog("unable to get kernel audit context", errno);
 	}
-try_interface:
-	{
-		struct ifaddrlist al;
-		int	family;
-		char	ntop[INET6_ADDRSTRLEN];
-
-		/*
-		 * getaddrinfo has failed to map the hostname
-		 * to an IP address, try to get an IP address
-		 * from a local interface.  If none up, default
-		 * to loopback.
-		 */
-		family = AF_INET6;
-		if (adt_get_local_address(family, &al) != 0) {
-			family = AF_INET;
-
-			if (adt_get_local_address(family, &al) != 0) {
-				adt_write_syslog("adt_get_local_address "
-				    "failed, no Audit IP address available, "
-				    "faking loopback and error",
-				    errno);
-				IN_SET_LOOPBACK_ADDR(
-				    (struct sockaddr_in *)&(al.addr.addr));
-				(void) memcpy(p_term->at_addr, &al.addr.addr,
-				    AU_IPv4);
-				p_term->at_type = AU_IPv4;
-				return (-1);
-			}
-		}
-		if (family == AF_INET) {
-			p_term->at_type = AU_IPv4;
-			(void) memcpy(p_term->at_addr, &al.addr.addr, AU_IPv4);
-		} else {
-			p_term->at_type = AU_IPv6;
-			(void) memcpy(p_term->at_addr, &al.addr.addr6, AU_IPv6);
-		}
 
-		(void) snprintf(msg, sizeof (msg), "mapping %s to %s",
-		    hostname, inet_ntop(family, &(al.addr), ntop,
-		    sizeof (ntop)));
-		adt_write_syslog(msg, 0);
-		return (0);
-	}
+	/* No mapping, default to loopback. */
+	errno = ENETDOWN;
+	adt_write_syslog("adt_get_local_address failed, no Audit IP address "
+	    "available, faking loopback and error", errno);
+	IN_SET_LOOPBACK_ADDR((struct sockaddr_in *)&(al.addr.addr));
+	(void) memcpy(p_term->at_addr, &al.addr.addr, AU_IPv4);
+	p_term->at_type = AU_IPv4;
+	return (-1);
 }
 
 /*
@@ -2122,8 +2120,8 @@ adt_selected(struct adt_event_state *event, au_event_t actual_id, int status)
 }
 
 /*
- * Can't map the host name to an IP address in
- * adt_get_hostIP.  Get something off an interface
+ * Before trying to map the host name to an IP address in
+ * adt_get_hostIP, get something off an interface
  * to act as the hosts IP address for auditing.
  */
 
diff --git a/usr/src/lib/libbunyan/Makefile b/usr/src/lib/libbunyan/Makefile
new file mode 100644
index 0000000000..a59de91113
--- /dev/null
+++ b/usr/src/lib/libbunyan/Makefile
@@ -0,0 +1,42 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.
+#
+
+include		../Makefile.lib
+
+HDRS =		bunyan.h
+HDRDIR =	common
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+install_h: 	$(ROOTHDRS)
+
+check:		$(CHECKHDRS)
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/lib/libbunyan/Makefile.com b/usr/src/lib/libbunyan/Makefile.com
new file mode 100644
index 0000000000..5214915c56
--- /dev/null
+++ b/usr/src/lib/libbunyan/Makefile.com
@@ -0,0 +1,36 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc. All rights reserved.
+#
+
+LIBRARY =	libbunyan.a
+VERS =		.1
+OBJECTS =	bunyan.o
+USDT_PROVIDERS =	bunyan_provider.d
+
+include ../../Makefile.lib
+
+LIBS =		$(DYNLIB) $(LINTLIB)
+LDLIBS +=	-lc -lumem -lnvpair -lnsl
+CPPFLAGS +=	-I../common -I. -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
+
+SRCDIR =	../common
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../Makefile.targ
+include ../../Makefile.usdt
diff --git a/usr/src/lib/libbunyan/amd64/Makefile b/usr/src/lib/libbunyan/amd64/Makefile
new file mode 100644
index 0000000000..15d904c616
--- /dev/null
+++ b/usr/src/lib/libbunyan/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libbunyan/common/bunyan.c b/usr/src/lib/libbunyan/common/bunyan.c
new file mode 100644
index 0000000000..a442c33cec
--- /dev/null
+++ b/usr/src/lib/libbunyan/common/bunyan.c
@@ -0,0 +1,913 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <stdarg.h>
+#include <umem.h>
+#include <netdb.h>
+#include <string.h>
+#include <strings.h>
+#include <time.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <sys/sysmacros.h>
+#include <thread.h>
+#include <sys/debug.h>
+
+#include <bunyan.h>
+#include <bunyan_provider_impl.h>
+
+struct bunyan_key;
+struct bunyan_stream;
+struct bunyan;
+
+typedef struct bunyan_stream {
+	struct bunyan_stream	*bs_next;
+	char			*bs_name;
+	bunyan_level_t		bs_level;
+	bunyan_stream_f		bs_func;
+	void			*bs_arg;
+	uint_t			bs_count;
+} bunyan_stream_t;
+
+typedef struct bunyan_key {
+	struct bunyan_key	*bk_next;
+	char			*bk_name;
+	bunyan_type_t		bk_type;
+	void			*bk_data;
+	size_t			bk_len;
+} bunyan_key_t;
+
+typedef struct bunyan {
+	pthread_mutex_t	bun_lock;
+	bunyan_key_t	*bun_keys;
+	bunyan_stream_t	*bun_streams;
+	char		*bun_name;
+	char		bun_host[MAXHOSTNAMELEN+1];
+} bunyan_t;
+
+#define	ISO_TIMELEN	25
+static const int bunyan_version = 0;
+
+static void
+bunyan_key_fini(bunyan_key_t *bkp)
+{
+	size_t nlen = strlen(bkp->bk_name) + 1;
+	umem_free(bkp->bk_data, bkp->bk_len);
+	umem_free(bkp->bk_name, nlen);
+	umem_free(bkp, sizeof (bunyan_key_t));
+}
+
+static void
+bunyan_stream_fini(bunyan_stream_t *bsp)
+{
+	size_t nlen = strlen(bsp->bs_name) + 1;
+	umem_free(bsp->bs_name, nlen);
+	umem_free(bsp, sizeof (bunyan_stream_t));
+}
+
+int
+bunyan_init(const char *name, bunyan_logger_t **bhp)
+{
+	int ret;
+	bunyan_t *b;
+	size_t nlen = strlen(name) + 1;
+
+	b = umem_zalloc(sizeof (bunyan_t), UMEM_DEFAULT);
+	if (b == NULL)
+		return (ENOMEM);
+
+	b->bun_name = umem_alloc(nlen, UMEM_DEFAULT);
+	if (b->bun_name == NULL) {
+		umem_free(b, sizeof (bunyan_t));
+		return (ENOMEM);
+	}
+	bcopy(name, b->bun_name, nlen);
+
+	if ((ret = pthread_mutex_init(&b->bun_lock, NULL)) != 0) {
+		umem_free(b->bun_name, nlen);
+		umem_free(b, sizeof (bunyan_t));
+		return (ret);
+	}
+
+	VERIFY(gethostname(b->bun_host, sizeof (b->bun_host)) == 0);
+	b->bun_host[MAXHOSTNAMELEN] = '\0';
+
+	*bhp = (bunyan_logger_t *)b;
+	return (0);
+}
+
+void
+bunyan_fini(bunyan_logger_t *bhp)
+{
+	bunyan_t *b = (bunyan_t *)bhp;
+	bunyan_key_t *bkp;
+	bunyan_stream_t *bsp;
+
+	while ((bkp = b->bun_keys) != NULL) {
+		b->bun_keys = bkp->bk_next;
+		bunyan_key_fini(bkp);
+	}
+
+	while ((bsp = b->bun_streams) != NULL) {
+		b->bun_streams = bsp->bs_next;
+		bunyan_stream_fini(bsp);
+	}
+
+	if (b->bun_name != NULL)
+		umem_free(b->bun_name, strlen(b->bun_name) + 1);
+
+	VERIFY(pthread_mutex_destroy(&b->bun_lock) == 0);
+	umem_free(b, sizeof (bunyan_t));
+}
+
+/* ARGSUSED */
+int
+bunyan_stream_fd(nvlist_t *nvl, const char *js, void *arg)
+{
+	uintptr_t fd = (uintptr_t)arg;
+	size_t jslen = strlen(js);
+	off_t off = 0;
+	ssize_t ret = 0;
+	static int maxbuf = -1;
+
+	if (maxbuf == -1)
+		maxbuf = getpagesize();
+
+	while (off != jslen) {
+		/*
+		 * Write up to a page of data at a time. If for some reason an
+		 * individual write fails, move on and try to still write a new
+		 * line at least...
+		 */
+		ret = write(fd, js + off, MIN(jslen - off, maxbuf));
+		if (ret < 0)
+			break;
+		off += ret;
+	}
+
+	if (ret < 0) {
+		(void) write(fd, "\n", 1);
+	} else {
+		ret = write(fd, "\n", 1);
+	}
+	return (ret < 0 ? 1: 0);
+}
+
+int
+bunyan_stream_add(bunyan_logger_t *bhp, const char *name, int level,
+    bunyan_stream_f func, void *arg)
+{
+	bunyan_stream_t *bs, *cur;
+	size_t nlen = strlen(name) + 1;
+	bunyan_t *b = (bunyan_t *)bhp;
+
+	if (level != BUNYAN_L_TRACE &&
+	    level != BUNYAN_L_DEBUG &&
+	    level != BUNYAN_L_INFO &&
+	    level != BUNYAN_L_WARN &&
+	    level != BUNYAN_L_ERROR &&
+	    level != BUNYAN_L_FATAL)
+		return (EINVAL);
+
+	bs = umem_alloc(sizeof (bunyan_stream_t), UMEM_DEFAULT);
+	if (bs == NULL)
+		return (ENOMEM);
+
+	bs->bs_name = umem_alloc(nlen, UMEM_DEFAULT);
+	if (bs->bs_name == NULL) {
+		umem_free(bs, sizeof (bunyan_stream_t));
+		return (ENOMEM);
+	}
+	bcopy(name, bs->bs_name, nlen);
+	bs->bs_level = level;
+	bs->bs_func = func;
+	bs->bs_arg = arg;
+	bs->bs_count = 0;
+	(void) pthread_mutex_lock(&b->bun_lock);
+	cur = b->bun_streams;
+	while (cur != NULL) {
+		if (strcmp(name, cur->bs_name) == 0) {
+			(void) pthread_mutex_unlock(&b->bun_lock);
+			umem_free(bs->bs_name, nlen);
+			umem_free(bs, sizeof (bunyan_stream_t));
+			return (EEXIST);
+		}
+		cur = cur->bs_next;
+	}
+	bs->bs_next = b->bun_streams;
+	b->bun_streams = bs;
+	(void) pthread_mutex_unlock(&b->bun_lock);
+
+	return (0);
+}
+
+int
+bunyan_stream_remove(bunyan_logger_t *bhp, const char *name)
+{
+	bunyan_stream_t *cur, *prev;
+	bunyan_t *b = (bunyan_t *)bhp;
+
+	(void) pthread_mutex_lock(&b->bun_lock);
+	prev = NULL;
+	cur = b->bun_streams;
+	while (cur != NULL) {
+		if (strcmp(name, cur->bs_name) == 0)
+			break;
+		prev = cur;
+		cur = cur->bs_next;
+	}
+	if (cur == NULL) {
+		(void) pthread_mutex_unlock(&b->bun_lock);
+		return (ENOENT);
+	}
+	if (prev == NULL)
+		b->bun_streams = cur->bs_next;
+	else
+		prev->bs_next = cur->bs_next;
+	cur->bs_next = NULL;
+	(void) pthread_mutex_unlock(&b->bun_lock);
+
+	bunyan_stream_fini(cur);
+
+	return (0);
+}
+
+static int
+bunyan_key_add_one(bunyan_t *b, const char *name, bunyan_type_t type,
+    const void *arg)
+{
+	bunyan_key_t *bkp, *cur, *prev;
+	size_t nlen = strlen(name) + 1;
+	size_t blen;
+
+	bkp = umem_alloc(sizeof (bunyan_key_t), UMEM_DEFAULT);
+	if (bkp == NULL)
+		return (ENOMEM);
+	bkp->bk_name = umem_alloc(nlen, UMEM_DEFAULT);
+	if (bkp->bk_name == NULL) {
+		umem_free(bkp, sizeof (bunyan_key_t));
+		return (ENOMEM);
+	}
+	bcopy(name, bkp->bk_name, nlen);
+
+	switch (type) {
+	case BUNYAN_T_STRING:
+		blen = strlen(arg) + 1;
+		break;
+	case BUNYAN_T_POINTER:
+		blen = sizeof (uintptr_t);
+		break;
+	case BUNYAN_T_IP:
+		blen = sizeof (struct in_addr);
+		break;
+	case BUNYAN_T_IP6:
+		blen = sizeof (struct in6_addr);
+		break;
+	case BUNYAN_T_BOOLEAN:
+		blen = sizeof (boolean_t);
+		break;
+	case BUNYAN_T_INT32:
+		blen = sizeof (int32_t);
+		break;
+	case BUNYAN_T_INT64:
+	case BUNYAN_T_INT64STR:
+		blen = sizeof (int64_t);
+		break;
+	case BUNYAN_T_UINT32:
+		blen = sizeof (uint32_t);
+		break;
+	case BUNYAN_T_UINT64:
+	case BUNYAN_T_UINT64STR:
+		blen = sizeof (uint64_t);
+		break;
+	case BUNYAN_T_DOUBLE:
+		blen = sizeof (double);
+		break;
+	default:
+		umem_free(bkp->bk_name, nlen);
+		umem_free(bkp, sizeof (bunyan_key_t));
+		return (EINVAL);
+	}
+
+	bkp->bk_data = umem_alloc(blen, UMEM_DEFAULT);
+	if (bkp->bk_data == NULL) {
+		umem_free(bkp->bk_name, nlen);
+		umem_free(bkp, sizeof (bunyan_key_t));
+		return (ENOMEM);
+	}
+	bcopy(arg, bkp->bk_data, blen);
+	bkp->bk_len = blen;
+	bkp->bk_type = type;
+
+	(void) pthread_mutex_lock(&b->bun_lock);
+	prev = NULL;
+	cur = b->bun_keys;
+	while (cur != NULL) {
+		if (strcmp(name, cur->bk_name) == 0)
+			break;
+		prev = cur;
+		cur = cur->bk_next;
+	}
+	if (cur != NULL) {
+		if (prev == NULL)
+			b->bun_keys = cur->bk_next;
+		else
+			prev->bk_next = cur->bk_next;
+		bunyan_key_fini(cur);
+	}
+	bkp->bk_next = b->bun_keys;
+	b->bun_keys = bkp;
+	(void) pthread_mutex_unlock(&b->bun_lock);
+
+	return (0);
+}
+
+static int
+bunyan_key_vadd(bunyan_t *b, va_list *ap)
+{
+	int type, ret;
+	void *data;
+	boolean_t bt;
+	int32_t i32;
+	int64_t i64;
+	uint32_t ui32;
+	uint64_t ui64;
+	double d;
+	uintptr_t ptr;
+
+	while ((type = va_arg(*ap, int)) != BUNYAN_T_END) {
+		const char *name = va_arg(*ap, char *);
+
+		switch (type) {
+		case BUNYAN_T_STRING:
+			data = va_arg(*ap, char *);
+			break;
+		case BUNYAN_T_POINTER:
+			ptr = (uintptr_t)va_arg(*ap, void *);
+			data = &ptr;
+			break;
+		case BUNYAN_T_IP:
+		case BUNYAN_T_IP6:
+			data = va_arg(*ap, void *);
+			break;
+		case BUNYAN_T_BOOLEAN:
+			bt  = va_arg(*ap, boolean_t);
+			data = &bt;
+			break;
+		case BUNYAN_T_INT32:
+			i32 = va_arg(*ap, int32_t);
+			data = &i32;
+			break;
+		case BUNYAN_T_INT64:
+		case BUNYAN_T_INT64STR:
+			i64 = va_arg(*ap, int64_t);
+			data = &i64;
+			break;
+		case BUNYAN_T_UINT32:
+			ui32 = va_arg(*ap, uint32_t);
+			data = &ui32;
+			break;
+		case BUNYAN_T_UINT64:
+		case BUNYAN_T_UINT64STR:
+			ui64 = va_arg(*ap, uint64_t);
+			data = &ui64;
+			break;
+		case BUNYAN_T_DOUBLE:
+			d = va_arg(*ap, double);
+			data = &d;
+			break;
+		default:
+			return (EINVAL);
+		}
+
+		if ((ret = bunyan_key_add_one(b, name, type, data)) != 0)
+			return (ret);
+	}
+
+	return (0);
+}
+
+int
+bunyan_key_add(bunyan_logger_t *bhp, ...)
+{
+	int ret;
+	va_list ap;
+	bunyan_t *b = (bunyan_t *)bhp;
+
+	va_start(ap, bhp);
+	ret = bunyan_key_vadd(b, &ap);
+	va_end(ap);
+
+	return (ret);
+}
+
+int
+bunyan_key_remove(bunyan_logger_t *bhp, const char *name)
+{
+	bunyan_t *b = (bunyan_t *)bhp;
+	bunyan_key_t *cur, *prev;
+
+	(void) pthread_mutex_lock(&b->bun_lock);
+	prev = NULL;
+	cur = b->bun_keys;
+	while (cur != NULL) {
+		if (strcmp(name, cur->bk_name) == 0)
+			break;
+		prev = cur;
+		cur = cur->bk_next;
+	}
+
+	if (cur == NULL) {
+		(void) pthread_mutex_unlock(&b->bun_lock);
+		return (ENOENT);
+	}
+
+	if (prev == NULL)
+		b->bun_keys = cur->bk_next;
+	else
+		prev->bk_next = cur->bk_next;
+	(void) pthread_mutex_unlock(&b->bun_lock);
+
+	bunyan_key_fini(cur);
+	return (0);
+}
+
+static bunyan_key_t *
+bunyan_key_dup(const bunyan_key_t *bkp)
+{
+	bunyan_key_t *nkp;
+	size_t nlen = strlen(bkp->bk_name) + 1;
+
+	nkp = umem_alloc(sizeof (bunyan_key_t), UMEM_DEFAULT);
+	if (nkp == NULL)
+		return (NULL);
+	nkp->bk_next = NULL;
+	nkp->bk_name = umem_alloc(nlen, UMEM_DEFAULT);
+	if (nkp->bk_name == NULL) {
+		umem_free(nkp, sizeof (bunyan_key_t));
+		return (NULL);
+	}
+	bcopy(bkp->bk_name, nkp->bk_name, nlen);
+	nkp->bk_type = bkp->bk_type;
+	nkp->bk_data = umem_alloc(bkp->bk_len, UMEM_DEFAULT);
+	if (nkp->bk_data == NULL) {
+		umem_free(nkp->bk_name, nlen);
+		umem_free(nkp, sizeof (bunyan_key_t));
+		return (NULL);
+	}
+	bcopy(bkp->bk_data, nkp->bk_data, bkp->bk_len);
+	nkp->bk_len = bkp->bk_len;
+
+	return (nkp);
+}
+
+static bunyan_stream_t *
+bunyan_stream_dup(const bunyan_stream_t *bsp)
+{
+	bunyan_stream_t *nsp;
+	size_t nlen = strlen(bsp->bs_name) + 1;
+
+	nsp = umem_alloc(sizeof (bunyan_stream_t), UMEM_DEFAULT);
+	if (nsp == NULL)
+		return (NULL);
+
+	nsp->bs_next = NULL;
+	nsp->bs_name = umem_alloc(nlen, UMEM_DEFAULT);
+	if (nsp->bs_name == NULL) {
+		umem_free(nsp, sizeof (bunyan_stream_t));
+		return (NULL);
+	}
+	bcopy(bsp->bs_name, nsp->bs_name, nlen);
+	nsp->bs_level = bsp->bs_level;
+	nsp->bs_func = bsp->bs_func;
+	nsp->bs_arg = bsp->bs_arg;
+	nsp->bs_count = 0;
+
+	return (nsp);
+}
+
+static bunyan_t *
+bunyan_dup(const bunyan_t *b)
+{
+	bunyan_t *n;
+	const bunyan_key_t *bkp;
+	const bunyan_stream_t *bsp;
+	size_t nlen;
+
+	n = umem_zalloc(sizeof (bunyan_t), UMEM_DEFAULT);
+	if (n == NULL)
+		return (NULL);
+
+	if (pthread_mutex_init(&n->bun_lock, NULL) != 0) {
+		umem_free(n, sizeof (bunyan_t));
+		return (NULL);
+	}
+
+	for (bkp = b->bun_keys; bkp != NULL; bkp = bkp->bk_next) {
+		bunyan_key_t *nkp;
+		nkp = bunyan_key_dup(bkp);
+		if (nkp == NULL) {
+			bunyan_fini((bunyan_logger_t *)n);
+			return (NULL);
+		}
+
+		nkp->bk_next = n->bun_keys;
+		n->bun_keys = nkp;
+	}
+
+	for (bsp = b->bun_streams; bsp != NULL; bsp = bsp->bs_next) {
+		bunyan_stream_t *nsp;
+		nsp = bunyan_stream_dup(bsp);
+		if (bsp == NULL) {
+			bunyan_fini((bunyan_logger_t *)n);
+			return (NULL);
+		}
+
+		nsp->bs_next = n->bun_streams;
+		n->bun_streams = nsp;
+	}
+
+	nlen = strlen(b->bun_name) + 1;
+	n->bun_name = umem_alloc(nlen, UMEM_DEFAULT);
+	if (n->bun_name == NULL) {
+		bunyan_fini((bunyan_logger_t *)n);
+		return (NULL);
+	}
+	bcopy(b->bun_name, n->bun_name, nlen);
+	bcopy(b->bun_host, n->bun_host, MAXHOSTNAMELEN+1);
+
+	return (n);
+}
+
+int
+bunyan_child(const bunyan_logger_t *bhp, bunyan_logger_t **outp, ...)
+{
+	const bunyan_t *b = (const bunyan_t *)bhp;
+	bunyan_t *n;
+	va_list ap;
+	int ret;
+
+	n = bunyan_dup(b);
+	if (n == NULL)
+		return (ENOMEM);
+
+	va_start(ap, outp);
+	ret = bunyan_key_vadd(n, &ap);
+	va_end(ap);
+
+	if (ret != 0)
+		bunyan_fini((bunyan_logger_t *)n);
+	else
+		*outp = (bunyan_logger_t *)n;
+
+	return (ret);
+}
+
+static int
+bunyan_iso_time(char *buf)
+{
+	struct timeval tv;
+	struct tm tm;
+
+	if (gettimeofday(&tv, NULL) != 0)
+		return (errno);
+
+	if (gmtime_r(&tv.tv_sec, &tm) == NULL)
+		return (errno);
+
+	VERIFY(strftime(buf, ISO_TIMELEN, "%FT%T", &tm) == 19);
+
+	(void) snprintf(&buf[19], 6, ".%03dZ", (int)(tv.tv_usec / 1000));
+
+	return (0);
+}
+
+/*
+ * Note, these fields are all required, so even if a user attempts to use one of
+ * them in their own fields, we'll override them and therefore, have it be the
+ * last one.
+ */
+static int
+bunyan_vlog_defaults(nvlist_t *nvl, bunyan_t *b, bunyan_level_t level,
+    const char *msg)
+{
+	int ret;
+	char tbuf[ISO_TIMELEN];
+
+	if ((ret = bunyan_iso_time(tbuf)) != 0)
+		return (ret);
+
+	if ((ret = nvlist_add_int32(nvl, "v", bunyan_version)) != 0 ||
+	    (ret = nvlist_add_int32(nvl, "level", level) != 0) ||
+	    (ret = nvlist_add_string(nvl, "name", b->bun_name) != 0) ||
+	    (ret = nvlist_add_string(nvl, "hostname", b->bun_host) != 0) ||
+	    (ret = nvlist_add_int32(nvl, "pid", getpid()) != 0) ||
+	    (ret = nvlist_add_uint32(nvl, "tid", thr_self()) != 0) ||
+	    (ret = nvlist_add_string(nvl, "time", tbuf) != 0) ||
+	    (ret = nvlist_add_string(nvl, "msg", msg) != 0))
+		return (ret);
+
+	return (0);
+}
+
+static int
+bunyan_vlog_add(nvlist_t *nvl, const char *key, bunyan_type_t type, void *arg)
+{
+	int ret;
+	uintptr_t *up;
+	struct in_addr *v4;
+	struct in6_addr *v6;
+
+	/*
+	 * Our buffer needs to hold the string forms of pointers, IPv6 strings,
+	 * etc. INET6_ADDRSTRLEN is large enough for all of these.
+	 */
+	char buf[INET6_ADDRSTRLEN];
+
+	switch (type) {
+	case BUNYAN_T_STRING:
+		ret = nvlist_add_string(nvl, key, (char *)arg);
+		break;
+	case BUNYAN_T_POINTER:
+		up = arg;
+		(void) snprintf(buf, sizeof (buf), "0x%p", *up);
+		ret = nvlist_add_string(nvl, key, buf);
+		break;
+	case BUNYAN_T_IP:
+		v4 = arg;
+		VERIFY(inet_ntop(AF_INET, v4, buf, sizeof (buf)) != NULL);
+		ret = nvlist_add_string(nvl, key, buf);
+		break;
+	case BUNYAN_T_IP6:
+		v6 = arg;
+		VERIFY(inet_ntop(AF_INET6, v6, buf, sizeof (buf)) != NULL);
+		ret = nvlist_add_string(nvl, key, buf);
+		break;
+	case BUNYAN_T_BOOLEAN:
+		ret = nvlist_add_boolean_value(nvl, key, *(boolean_t *)arg);
+		break;
+	case BUNYAN_T_INT32:
+		ret = nvlist_add_int32(nvl, key, *(int32_t *)arg);
+		break;
+	case BUNYAN_T_INT64:
+		ret = nvlist_add_int64(nvl, key, *(int64_t *)arg);
+		break;
+	case BUNYAN_T_UINT32:
+		ret = nvlist_add_uint32(nvl, key, *(uint32_t *)arg);
+		break;
+	case BUNYAN_T_UINT64:
+		ret = nvlist_add_uint64(nvl, key, *(uint32_t *)arg);
+		break;
+	case BUNYAN_T_DOUBLE:
+		ret = nvlist_add_double(nvl, key, *(double *)arg);
+		break;
+	case BUNYAN_T_INT64STR:
+		(void) snprintf(buf, sizeof (buf), "%lld", *(int64_t *)arg);
+		ret = nvlist_add_string(nvl, key, buf);
+		break;
+	case BUNYAN_T_UINT64STR:
+		(void) snprintf(buf, sizeof (buf), "%llu", *(uint64_t *)arg);
+		ret = nvlist_add_string(nvl, key, buf);
+		break;
+	default:
+		ret = EINVAL;
+		break;
+	}
+
+	return (ret);
+}
+
+static int
+bunyan_vlog(bunyan_logger_t *bhp, bunyan_level_t level, const char *msg,
+    va_list *ap)
+{
+	nvlist_t *nvl = NULL;
+	int ret, type;
+	bunyan_key_t *bkp;
+	bunyan_stream_t *bsp;
+	char *buf = NULL;
+	bunyan_t *b = (bunyan_t *)bhp;
+
+	if (msg == NULL)
+		return (EINVAL);
+
+	(void) pthread_mutex_lock(&b->bun_lock);
+
+	if ((ret = nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0)) != 0) {
+		(void) pthread_mutex_unlock(&b->bun_lock);
+		return (ret);
+	}
+
+	/*
+	 * We add pre-defined keys, then go through and process the users keys,
+	 * and finally go ahead and our defaults. If all that succeeds, then we
+	 * can go ahead and call all the built-in logs.
+	 */
+	for (bkp = b->bun_keys; bkp != NULL; bkp = bkp->bk_next) {
+		if ((ret = bunyan_vlog_add(nvl, bkp->bk_name, bkp->bk_type,
+		    bkp->bk_data)) != 0)
+			goto out;
+	}
+
+	while ((type = va_arg(*ap, int)) != BUNYAN_T_END) {
+		void *data;
+		boolean_t bt;
+		int32_t i32;
+		int64_t i64;
+		uint32_t ui32;
+		uint64_t ui64;
+		double d;
+		uintptr_t ptr;
+		const char *key = va_arg(*ap, char *);
+
+		switch (type) {
+		case BUNYAN_T_STRING:
+			data = va_arg(*ap, char *);
+			break;
+		case BUNYAN_T_POINTER:
+			ptr = (uintptr_t)va_arg(*ap, void *);
+			data = &ptr;
+			break;
+		case BUNYAN_T_IP:
+		case BUNYAN_T_IP6:
+			data = va_arg(*ap, void *);
+			break;
+		case BUNYAN_T_BOOLEAN:
+			bt  = va_arg(*ap, boolean_t);
+			data = &bt;
+			break;
+		case BUNYAN_T_INT32:
+			i32 = va_arg(*ap, int32_t);
+			data = &i32;
+			break;
+		case BUNYAN_T_INT64:
+		case BUNYAN_T_INT64STR:
+			i64 = va_arg(*ap, int64_t);
+			data = &i64;
+			break;
+		case BUNYAN_T_UINT32:
+			ui32 = va_arg(*ap, uint32_t);
+			data = &ui32;
+			break;
+		case BUNYAN_T_UINT64:
+		case BUNYAN_T_UINT64STR:
+			ui64 = va_arg(*ap, uint64_t);
+			data = &ui64;
+			break;
+		case BUNYAN_T_DOUBLE:
+			d = va_arg(*ap, double);
+			data = &d;
+			break;
+		default:
+			ret = EINVAL;
+			goto out;
+		}
+
+		if ((ret = bunyan_vlog_add(nvl, key, type, data)) != 0)
+			goto out;
+
+	}
+	/*
+	 * This must be the last thing we do before we log to ensure that all of
+	 * our defaults always make it out.
+	 */
+	if ((ret = bunyan_vlog_defaults(nvl, b, level, msg)) != 0)
+		goto out;
+
+	if (nvlist_dump_json(nvl, &buf) < 0) {
+		ret = errno;
+		goto out;
+	}
+
+	/* Fire DTrace probes */
+	switch (level) {
+	case BUNYAN_L_TRACE:
+		BUNYAN_LOG_TRACE(buf);
+		break;
+	case BUNYAN_L_DEBUG:
+		BUNYAN_LOG_DEBUG(buf);
+		break;
+	case BUNYAN_L_INFO:
+		BUNYAN_LOG_INFO(buf);
+		break;
+	case BUNYAN_L_WARN:
+		BUNYAN_LOG_WARN(buf);
+		break;
+	case BUNYAN_L_ERROR:
+		BUNYAN_LOG_ERROR(buf);
+		break;
+	case BUNYAN_L_FATAL:
+		BUNYAN_LOG_FATAL(buf);
+		break;
+	}
+
+	for (bsp = b->bun_streams; bsp != NULL; bsp = bsp->bs_next) {
+		if (bsp->bs_level <= level)
+			if (bsp->bs_func(nvl, buf, bsp->bs_arg) != 0)
+				bsp->bs_count++;
+	}
+	ret = 0;
+out:
+	(void) pthread_mutex_unlock(&b->bun_lock);
+	if (buf != NULL)
+		nvlist_dump_json_free(nvl, buf);
+	if (nvl != NULL)
+		nvlist_free(nvl);
+	return (ret);
+}
+
+int
+bunyan_trace(bunyan_logger_t *bhp, const char *msg, ...)
+{
+	va_list va;
+	int ret;
+
+	va_start(va, msg);
+	ret = bunyan_vlog(bhp, BUNYAN_L_TRACE, msg, &va);
+	va_end(va);
+
+	return (ret);
+}
+
+int
+bunyan_debug(bunyan_logger_t *bhp, const char *msg, ...)
+{
+	va_list va;
+	int ret;
+
+	va_start(va, msg);
+	ret = bunyan_vlog(bhp, BUNYAN_L_DEBUG, msg, &va);
+	va_end(va);
+
+	return (ret);
+}
+
+int
+bunyan_info(bunyan_logger_t *bhp, const char *msg, ...)
+{
+	va_list va;
+	int ret;
+
+	va_start(va, msg);
+	ret = bunyan_vlog(bhp, BUNYAN_L_INFO, msg, &va);
+	va_end(va);
+
+	return (ret);
+}
+
+int
+bunyan_warn(bunyan_logger_t *bhp, const char *msg, ...)
+{
+	va_list va;
+	int ret;
+
+	va_start(va, msg);
+	ret = bunyan_vlog(bhp, BUNYAN_L_WARN, msg, &va);
+	va_end(va);
+
+	return (ret);
+}
+
+int
+bunyan_error(bunyan_logger_t *bhp, const char *msg, ...)
+{
+	va_list va;
+	int ret;
+
+	va_start(va, msg);
+	ret = bunyan_vlog(bhp, BUNYAN_L_ERROR, msg, &va);
+	va_end(va);
+
+	return (ret);
+}
+
+
+int
+bunyan_fatal(bunyan_logger_t *bhp, const char *msg, ...)
+{
+	va_list va;
+	int ret;
+
+	va_start(va, msg);
+	ret = bunyan_vlog(bhp, BUNYAN_L_FATAL, msg, &va);
+	va_end(va);
+
+	return (ret);
+}
diff --git a/usr/src/lib/libbunyan/common/bunyan.h b/usr/src/lib/libbunyan/common/bunyan.h
new file mode 100644
index 0000000000..9a01f6f6cd
--- /dev/null
+++ b/usr/src/lib/libbunyan/common/bunyan.h
@@ -0,0 +1,88 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014, Joyent, Inc.
+ */
+
+#ifndef _BUNYAN_H
+#define	_BUNYAN_H
+
+/*
+ * C version of the bunyan logging format.
+ */
+
+#include <limits.h>
+#include <libnvpair.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct bunyan_logger bunyan_logger_t;
+
+typedef enum bunyan_level {
+	BUNYAN_L_TRACE	= 10,
+	BUNYAN_L_DEBUG 	= 20,
+	BUNYAN_L_INFO	= 30,
+	BUNYAN_L_WARN	= 40,
+	BUNYAN_L_ERROR	= 50,
+	BUNYAN_L_FATAL	= 60
+} bunyan_level_t;
+
+typedef enum bunyan_type {
+	BUNYAN_T_END	= 0x0,
+	BUNYAN_T_STRING,
+	BUNYAN_T_POINTER,
+	BUNYAN_T_IP,
+	BUNYAN_T_IP6,
+	BUNYAN_T_BOOLEAN,
+	BUNYAN_T_INT32,
+	BUNYAN_T_INT64,
+	BUNYAN_T_UINT32,
+	BUNYAN_T_UINT64,
+	BUNYAN_T_DOUBLE,
+	BUNYAN_T_INT64STR,
+	BUNYAN_T_UINT64STR
+} bunyan_type_t;
+
+/*
+ * A handle is MT-safe, but not fork-safe.
+ */
+extern int bunyan_init(const char *, bunyan_logger_t **);
+extern int bunyan_child(const bunyan_logger_t *, bunyan_logger_t **, ...);
+extern void bunyan_fini(bunyan_logger_t *);
+
+/*
+ * Bunyan stream callbacks are guaranteed to be serialized.
+ */
+typedef int (*bunyan_stream_f)(nvlist_t *, const char *, void *);
+extern int bunyan_stream_fd(nvlist_t *, const char *, void *);
+
+extern int bunyan_stream_add(bunyan_logger_t *, const char *, int,
+    bunyan_stream_f, void *);
+extern int bunyan_stream_remove(bunyan_logger_t *, const char *);
+
+extern int bunyan_key_add(bunyan_logger_t *, ...);
+extern int bunyan_key_remove(bunyan_logger_t *, const char *);
+
+extern int bunyan_trace(bunyan_logger_t *, const char *msg, ...);
+extern int bunyan_debug(bunyan_logger_t *, const char *msg, ...);
+extern int bunyan_info(bunyan_logger_t *, const char *msg, ...);
+extern int bunyan_warn(bunyan_logger_t *, const char *msg, ...);
+extern int bunyan_error(bunyan_logger_t *, const char *msg, ...);
+extern int bunyan_fatal(bunyan_logger_t *, const char *msg, ...);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _BUNYAN_H */
diff --git a/usr/src/lib/libbunyan/common/bunyan_provider.d b/usr/src/lib/libbunyan/common/bunyan_provider.d
new file mode 100644
index 0000000000..d47ea75733
--- /dev/null
+++ b/usr/src/lib/libbunyan/common/bunyan_provider.d
@@ -0,0 +1,32 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014, Joyent, Inc. 
+ */
+
+/*
+ * Bunyan DTrace provider
+ */
+provider bunyan {
+	probe log__trace(char *);
+	probe log__debug(char *);
+	probe log__info(char *);
+	probe log__warn(char *);
+	probe log__error(char *);
+	probe log__fatal(char *);
+};
+
+#pragma D attributes Stable/Stable/ISA		provider bunyan provider
+#pragma D attributes Private/Private/Unknown	provider bunyan module
+#pragma D attributes Private/Private/Unknown	provider bunyan function
+#pragma D attributes Stable/Stable/ISA		provider bunyan name
+#pragma D attributes Stable/Stable/ISA		provider bunyan args
diff --git a/usr/src/lib/libbunyan/common/llib-lbunyan b/usr/src/lib/libbunyan/common/llib-lbunyan
new file mode 100644
index 0000000000..31f6a52aba
--- /dev/null
+++ b/usr/src/lib/libbunyan/common/llib-lbunyan
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+#include <bunyan.h>
diff --git a/usr/src/lib/libbunyan/common/mapfile-vers b/usr/src/lib/libbunyan/common/mapfile-vers
new file mode 100644
index 0000000000..775af4ab45
--- /dev/null
+++ b/usr/src/lib/libbunyan/common/mapfile-vers
@@ -0,0 +1,53 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION ILLUMOS_1.0 {
+    global:
+	bunyan_init;
+	bunyan_child;
+	bunyan_fini;
+	bunyan_stream_fd;
+	bunyan_stream_add;
+	bunyan_stream_remove;
+	bunyan_key_add;
+	bunyan_key_remove;
+	bunyan_trace;
+	bunyan_debug;
+	bunyan_info;
+	bunyan_warn;
+	bunyan_error;
+	bunyan_fatal;
+};
+
+SYMBOL_VERSION ILLUMOSprivate {
+    local:
+	*;
+};
diff --git a/usr/src/lib/libbunyan/i386/Makefile b/usr/src/lib/libbunyan/i386/Makefile
new file mode 100644
index 0000000000..41e699e8f8
--- /dev/null
+++ b/usr/src/lib/libbunyan/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libbunyan/sparc/Makefile b/usr/src/lib/libbunyan/sparc/Makefile
new file mode 100644
index 0000000000..41e699e8f8
--- /dev/null
+++ b/usr/src/lib/libbunyan/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libbunyan/sparcv9/Makefile b/usr/src/lib/libbunyan/sparcv9/Makefile
new file mode 100644
index 0000000000..15d904c616
--- /dev/null
+++ b/usr/src/lib/libbunyan/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libc/amd64/Makefile b/usr/src/lib/libc/amd64/Makefile
index 266a12f48b..9b57d2517e 100644
--- a/usr/src/lib/libc/amd64/Makefile
+++ b/usr/src/lib/libc/amd64/Makefile
@@ -21,7 +21,7 @@
 
 #
 # Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
-# Copyright 2016 Joyent, Inc.
+# Copyright (c) 2017, Joyent, Inc.
 # Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved.
 # Copyright 2013 Garrett D'Amore <garrett@damore.org>
 # Copyright 2018 Nexenta Systems, Inc.
@@ -897,6 +897,7 @@ PORTSYS=			\
 	fcntl.o			\
 	getpagesizes.o		\
 	getpeerucred.o		\
+	inotify.o		\
 	inst_sync.o		\
 	issetugid.o		\
 	label.o			\
@@ -1213,6 +1214,7 @@ $(PORTI18N_COND:%=pics/%) := \
 pics/arc4random.o :=	CPPFLAGS += -I$(SRC)/common/crypto/chacha
 
 pics/__clock_gettime.o := CPPFLAGS += $(COMMPAGE_CPPFLAGS)
+pics/gettimeofday.o := CPPFLAGS += $(COMMPAGE_CPPFLAGS)
 
 .KEEP_STATE:
 
diff --git a/usr/src/lib/libc/amd64/gen/siginfolst.c b/usr/src/lib/libc/amd64/gen/siginfolst.c
index 8451dfbb4f..8b8a1b4669 100644
--- a/usr/src/lib/libc/amd64/gen/siginfolst.c
+++ b/usr/src/lib/libc/amd64/gen/siginfolst.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -188,6 +189,7 @@ static const struct siginfolist _sys_siginfolist_data[NSIG-1] = {
 	0,		0,
 	0,		0,
 	0,		0,			/* SIGRTMIN+15 */
+	0,		0,			/* SIGRTMIN+16 */
 	0,		0,			/* SIGRTMAX-15 */
 	0,		0,
 	0,		0,
diff --git a/usr/src/lib/libc/amd64/sys/gettimeofday.s b/usr/src/lib/libc/amd64/sys/gettimeofday.s
deleted file mode 100644
index 1948a008d4..0000000000
--- a/usr/src/lib/libc/amd64/sys/gettimeofday.s
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * CDDL HEADER START
- *
- * The contents of this file are subject to the terms of the
- * Common Development and Distribution License (the "License").
- * You may not use this file except in compliance with the License.
- *
- * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- *
- * When distributing Covered Code, include this CDDL HEADER in each
- * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- * If applicable, add the following below this CDDL HEADER, with the
- * fields enclosed by brackets "[]" replaced with your own identifying
- * information: Portions Copyright [yyyy] [name of copyright owner]
- *
- * CDDL HEADER END
- */
-
-/*
- * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-
-	.file	"gettimeofday.s"
-
-#include "SYS.h"
-
-	ANSI_PRAGMA_WEAK(gettimeofday,function)
-
-/*
- *  implements int gettimeofday(struct timeval *tp, void *tzp)
- *
- *	note that tzp is always ignored
- */
-
-	ENTRY(gettimeofday)
-/*
- *	use long long gethrestime()
- */
-	pushq	%rdi		/* pointer to timeval */
-	SYSFASTTRAP(GETHRESTIME)
-/*
- *	gethrestime trap returns seconds in %eax, nsecs in %edx
- *	need to convert nsecs to usecs & store into area pointed
- *	to by struct timeval * argument.
- */
-	popq	%rcx		/* pointer to timeval */
-	jrcxz	1f		/* bail if we get a null pointer */
-	movq	%rax, (%rcx)	/* store seconds into timeval ptr	 */
-	movl	$274877907, %eax	/* divide by 1000 as impl. by gcc */
-	imull	%edx		/* See Hacker's Delight pg 162 */
-	sarl	$6, %edx	/* simplified by 0 <= nsec <= 1e9 */
-	movq	%rdx, 8(%rcx)	/* store usecs into timeval ptr + 8. */
-1:
-	RETC			/* return 0 */
-	SET_SIZE(gettimeofday)
-
diff --git a/usr/src/lib/libc/i386/Makefile.com b/usr/src/lib/libc/i386/Makefile.com
index 38e69d0769..dd647b2811 100644
--- a/usr/src/lib/libc/i386/Makefile.com
+++ b/usr/src/lib/libc/i386/Makefile.com
@@ -21,7 +21,7 @@
 
 #
 # Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
-# Copyright 2016 Joyent, Inc.
+# Copyright (c) 2017, Joyent, Inc.
 # Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved.
 # Copyright 2013 Garrett D'Amore <garrett@damore.org>
 # Copyright 2018 Nexenta Systems, Inc.
@@ -937,6 +937,7 @@ PORTSYS=			\
 	fcntl.o			\
 	getpagesizes.o		\
 	getpeerucred.o		\
+	inotify.o		\
 	inst_sync.o		\
 	issetugid.o		\
 	label.o			\
@@ -1281,6 +1282,7 @@ $(PORTI18N_COND:%=pics/%) := \
 pics/arc4random.o :=	CPPFLAGS += -I$(SRC)/common/crypto/chacha
 
 pics/__clock_gettime.o := CPPFLAGS += $(COMMPAGE_CPPFLAGS)
+pics/gettimeofday.o := CPPFLAGS += $(COMMPAGE_CPPFLAGS)
 
 .KEEP_STATE:
 
diff --git a/usr/src/lib/libc/i386/gen/siginfolst.c b/usr/src/lib/libc/i386/gen/siginfolst.c
index 8451dfbb4f..8b8a1b4669 100644
--- a/usr/src/lib/libc/i386/gen/siginfolst.c
+++ b/usr/src/lib/libc/i386/gen/siginfolst.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -188,6 +189,7 @@ static const struct siginfolist _sys_siginfolist_data[NSIG-1] = {
 	0,		0,
 	0,		0,
 	0,		0,			/* SIGRTMIN+15 */
+	0,		0,			/* SIGRTMIN+16 */
 	0,		0,			/* SIGRTMAX-15 */
 	0,		0,
 	0,		0,
diff --git a/usr/src/lib/libc/i386/sys/gettimeofday.c b/usr/src/lib/libc/i386/sys/gettimeofday.c
new file mode 100644
index 0000000000..7539c2143e
--- /dev/null
+++ b/usr/src/lib/libc/i386/sys/gettimeofday.c
@@ -0,0 +1,50 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+
+#include "thr_uberdata.h"
+#include <cp_defs.h>
+
+#pragma weak _gettimeofday = gettimeofday
+
+extern int __clock_gettime_sys(clockid_t, timespec_t *);
+
+int
+gettimeofday(struct timeval *tv, void *tz)
+{
+	comm_page_t *cp = (comm_page_t *)__uberdata.ub_comm_page;
+
+	/*
+	 * Perform a NULL check before attempting to store the result directly.
+	 * The old fasttrop logic would perform this same check, but after the
+	 * call into hrestime().
+	 */
+	if (tv == NULL) {
+		return (0);
+	}
+
+	/*
+	 * Since timeval and timespec structs feature the same effective types
+	 * and layout of their members, the conversion can be done in-place.
+	 */
+	if (cp != NULL && __cp_can_gettime(cp) != 0) {
+		__cp_clock_gettime_realtime(cp, (struct timespec *)tv);
+	} else {
+		__clock_gettime_sys(CLOCK_REALTIME, (struct timespec *)tv);
+	}
+	/* Convert from tv_nsec to tv_usec */
+	tv->tv_usec /= 1000;
+	return (0);
+}
diff --git a/usr/src/lib/libc/i386/sys/gettimeofday.s b/usr/src/lib/libc/i386/sys/gettimeofday.s
deleted file mode 100644
index 1e21601aba..0000000000
--- a/usr/src/lib/libc/i386/sys/gettimeofday.s
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * CDDL HEADER START
- *
- * The contents of this file are subject to the terms of the
- * Common Development and Distribution License (the "License").
- * You may not use this file except in compliance with the License.
- *
- * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- *
- * When distributing Covered Code, include this CDDL HEADER in each
- * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- * If applicable, add the following below this CDDL HEADER, with the
- * fields enclosed by brackets "[]" replaced with your own identifying
- * information: Portions Copyright [yyyy] [name of copyright owner]
- *
- * CDDL HEADER END
- */
-
-/*
- * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-
-	.file	"gettimeofday.s"
-
-#include "SYS.h"
-
-	ANSI_PRAGMA_WEAK(gettimeofday,function)
-
-/
-/  implements int gettimeofday(struct timeval *tp, void *tzp)
-/
-/	note that tzp is always ignored
-/
-
-	ENTRY(gettimeofday)
-/
-/	use long long gethrestime()
-/
-	SYSFASTTRAP(GETHRESTIME)
-/
-/	gethrestime trap returns seconds in %eax, nsecs in %edx
-/	need to convert nsecs to usecs & store into area pointed
-/	to by struct timeval * argument.
-/
-	movl 4(%esp), %ecx	/ put ptr to timeval in %ecx
-	jecxz 1f		/ bail if we get a null pointer
-	movl %eax, (%ecx)	/ store seconds into timeval ptr	
-	movl $274877907, %eax	/ divide by 1000 as impl. by gcc
-	imull %edx		/ See Hacker's Delight pg 162
-	sarl $6, %edx		/ simplified by 0 <= nsec <= 1e9
-	movl %edx, 4(%ecx)	/ store usecs into timeval ptr + 4.
-1:
-	RETC			/ return 0
-	SET_SIZE(gettimeofday)
-	
-
diff --git a/usr/src/lib/libc/inc/thr_inlines.h b/usr/src/lib/libc/inc/thr_inlines.h
index f7cdc6a6bd..66d811f25b 100644
--- a/usr/src/lib/libc/inc/thr_inlines.h
+++ b/usr/src/lib/libc/inc/thr_inlines.h
@@ -47,17 +47,19 @@
 extern __GNU_INLINE ulwp_t *
 _curthread(void)
 {
-#if defined(__amd64)
 	ulwp_t *__value;
-	__asm__ __volatile__("movq %%fs:0, %0" : "=r" (__value));
+	__asm__ __volatile__(
+#if defined(__amd64)
+	    "movq %%fs:0, %0\n\t"
 #elif defined(__i386)
-	ulwp_t *__value;
-	__asm__ __volatile__("movl %%gs:0, %0" : "=r" (__value));
+	    "movl %%gs:0, %0\n\t"
 #elif defined(__sparc)
-	register ulwp_t *__value __asm__("g7");
+	    ".register %%g7, #scratch\n\t"
+	    "mov %%g7, %0\n\t"
 #else
 #error	"port me"
 #endif
+	    : "=r" (__value));
 	return (__value);
 }
 
diff --git a/usr/src/lib/libc/inc/thr_uberdata.h b/usr/src/lib/libc/inc/thr_uberdata.h
index 81781fe04c..2c56e76f17 100644
--- a/usr/src/lib/libc/inc/thr_uberdata.h
+++ b/usr/src/lib/libc/inc/thr_uberdata.h
@@ -968,6 +968,7 @@ typedef struct uberdata {
 	int	ndaemons;	/* total number of THR_DAEMON threads/lwps */
 	pid_t	pid;		/* the current process's pid */
 	void	(*sigacthandler)(int, siginfo_t *, void *);
+	int	(*setctxt)(const ucontext_t *);
 	ulwp_t	*lwp_stacks;
 	ulwp_t	*lwp_laststack;
 	int	nfreestack;
@@ -980,6 +981,7 @@ typedef struct uberdata {
 	robust_t	**robustlocks;	/* table of registered robust locks */
 	robust_t	*robustlist;	/* list of registered robust locks */
 	char	*progname;	/* the basename of the program, from argv[0] */
+	char	*ub_broot;	/* the root of the native code in the brand */
 	void	*ub_comm_page;	/* arch-specific comm page of kernel data */
 	struct uberdata **tdb_bootstrap;
 	tdb_t	tdb;		/* thread debug interfaces (for libc_db) */
@@ -1182,6 +1184,7 @@ typedef struct uberdata32 {
 	int		ndaemons;
 	int		pid;
 	caddr32_t	sigacthandler;
+	caddr32_t	setctxt;
 	caddr32_t	lwp_stacks;
 	caddr32_t	lwp_laststack;
 	int		nfreestack;
@@ -1194,6 +1197,7 @@ typedef struct uberdata32 {
 	caddr32_t	robustlocks;
 	caddr32_t	robustlist;
 	caddr32_t	progname;
+	caddr32_t	ub_broot;
 	caddr32_t	ub_comm_page;
 	caddr32_t	tdb_bootstrap;
 	tdb32_t		tdb;
@@ -1284,6 +1288,7 @@ extern	void	rwl_free(ulwp_t *);
 extern	void	heldlock_exit(void);
 extern	void	heldlock_free(ulwp_t *);
 extern	void	sigacthandler(int, siginfo_t *, void *);
+extern	int	setctxt(const ucontext_t *);
 extern	void	signal_init(void);
 extern	int	sigequalset(const sigset_t *, const sigset_t *);
 extern	void	mutex_setup(void);
diff --git a/usr/src/lib/libc/port/gen/getauxv.c b/usr/src/lib/libc/port/gen/getauxv.c
index 500675719c..4356a01392 100644
--- a/usr/src/lib/libc/port/gen/getauxv.c
+++ b/usr/src/lib/libc/port/gen/getauxv.c
@@ -24,9 +24,8 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include "lint.h"
+#include "thr_uberdata.h"
 #include <libc.h>
 #include <fcntl.h>
 #include <stdlib.h>
@@ -38,6 +37,7 @@
 #include <thread.h>
 #include <synch.h>
 #include <atomic.h>
+#include <limits.h>
 
 static mutex_t auxlock = DEFAULTMUTEX;
 
@@ -59,11 +59,20 @@ _getaux(int type)
 	if (auxb == NULL) {
 		lmutex_lock(&auxlock);
 		if (auxb == NULL) {
+			uberdata_t *udp = curthread->ul_uberdata;
 			struct stat statb;
 			auxv_t *buf = NULL;
+			char *path = "/proc/self/auxv";
+			char pbuf[PATH_MAX];
 			int fd;
 
-			if ((fd = open("/proc/self/auxv", O_RDONLY)) != -1 &&
+			if (udp->ub_broot != NULL) {
+				(void) snprintf(pbuf, sizeof (pbuf),
+				    "%s/proc/self/auxv", udp->ub_broot);
+				path = pbuf;
+			}
+
+			if ((fd = open(path, O_RDONLY)) != -1 &&
 			    fstat(fd, &statb) != -1)
 				buf = libc_malloc(
 				    statb.st_size + sizeof (auxv_t));
diff --git a/usr/src/lib/libc/port/gen/sh_locks.c b/usr/src/lib/libc/port/gen/sh_locks.c
index 6583efbc9c..cf879195c6 100644
--- a/usr/src/lib/libc/port/gen/sh_locks.c
+++ b/usr/src/lib/libc/port/gen/sh_locks.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include "lint.h"
 #include <mtlib.h>
 #include <sys/types.h>
diff --git a/usr/src/lib/libc/port/gen/siglist.c b/usr/src/lib/libc/port/gen/siglist.c
index 441cc4c2c5..bc6dc1b731 100644
--- a/usr/src/lib/libc/port/gen/siglist.c
+++ b/usr/src/lib/libc/port/gen/siglist.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -128,6 +129,7 @@ static const char *_sys_siglist_data[NSIG] = {
 		"Fourteenth Realtime Signal",		/* SIGRTMIN+13	*/
 		"Fifteenth Realtime Signal",		/* SIGRTMIN+14	*/
 		"Sixteenth Realtime Signal",		/* SIGRTMIN+15	*/
+		"Seventeenth Realtime Signal",		/* SIGRTMIN+16	*/
 		"Sixteenth Last Realtime Signal",	/* SIGRTMAX-15	*/
 		"Fifteenth Last Realtime Signal",	/* SIGRTMAX-14	*/
 		"Fourteenth Last Realtime Signal",	/* SIGRTMAX-13	*/
diff --git a/usr/src/lib/libc/port/gen/str2sig.c b/usr/src/lib/libc/port/gen/str2sig.c
index e0c4e89d68..02c6f3cb65 100644
--- a/usr/src/lib/libc/port/gen/str2sig.c
+++ b/usr/src/lib/libc/port/gen/str2sig.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -102,6 +102,7 @@ static signame_t signames[] = {
 	{ "RTMIN+13",	_SIGRTMIN+13 },
 	{ "RTMIN+14",	_SIGRTMIN+14 },
 	{ "RTMIN+15",	_SIGRTMIN+15 },
+	{ "RTMIN+16",	_SIGRTMIN+16 },
 	{ "RTMAX-15",	_SIGRTMAX-15 },
 	{ "RTMAX-14",	_SIGRTMAX-14 },
 	{ "RTMAX-13",	_SIGRTMAX-13 },
diff --git a/usr/src/lib/libc/port/llib-lc b/usr/src/lib/libc/port/llib-lc
index b7521a2f86..5c0d397cbb 100644
--- a/usr/src/lib/libc/port/llib-lc
+++ b/usr/src/lib/libc/port/llib-lc
@@ -25,6 +25,7 @@
  * Copyright 2013 OmniTI Computer Consulting, Inc. All rights reserved.
  * Copyright (c) 2013 Gary Mills
  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
+ * Copyright 2015 Joyent, Inc.
  * Copyright 2015 Circonus, Inc.  All rights reserved.
  * Copyright 2015 Joyent, Inc.
  */
diff --git a/usr/src/lib/libc/port/mapfile-vers b/usr/src/lib/libc/port/mapfile-vers
index c2db2cf62c..812c0c94d5 100644
--- a/usr/src/lib/libc/port/mapfile-vers
+++ b/usr/src/lib/libc/port/mapfile-vers
@@ -3020,6 +3020,10 @@ $endif
 	__idmap_unreg;
 	__init_daemon_priv;
 	__init_suid_priv;
+	inotify_init;
+	inotify_init1;
+	inotify_add_watch;
+	inotify_rm_watch;
 	_insert;
 	inst_sync;
 	_iswctype;
@@ -3122,7 +3126,9 @@ $endif
 	psecflags_validate;
 	semctl64;
 	_semctl64;
+	set_escaped_context_cleanup;
 	set_setcontext_enforcement;
+	setcontext_sigmask;
 	_setbufend;
 	__set_errno;
 	setprojrctl;
@@ -3239,6 +3245,7 @@ $endif
 	zone_list;
 	zone_list_datalink;
 	zonept;
+	zone_get_nroot;
 	zone_remove_datalink;
 	zone_setattr;
 	zone_shutdown;
diff --git a/usr/src/lib/libc/port/stdio/system.c b/usr/src/lib/libc/port/stdio/system.c
index bc7e412d52..698d02b2ec 100644
--- a/usr/src/lib/libc/port/stdio/system.c
+++ b/usr/src/lib/libc/port/stdio/system.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -43,6 +44,7 @@
 #include <synch.h>
 #include <spawn.h>
 #include <paths.h>
+#include <zone.h>
 #include "libc.h"
 
 extern const char **_environ;
@@ -125,11 +127,18 @@ system(const char *cmd)
 	int error;
 	sigset_t mask;
 	struct stat64 buf;
-	const char *shpath = _PATH_BSHELL;
+	char shpath[MAXPATHLEN];
+	const char *zroot = zone_get_nroot();
 	char *argv[4];
 	posix_spawnattr_t attr;
 	static const char *shell = "sh";
 
+	/*
+	 * If executing in brand use native root.
+	 */
+	(void) snprintf(shpath, sizeof (shpath), "%s%s",
+	    zroot != NULL ? zroot : "", _PATH_BSHELL);
+
 	if (cmd == NULL) {
 		if (stat64(shpath, &buf) != 0) {
 			return (0);
diff --git a/usr/src/lib/libc/port/sys/epoll.c b/usr/src/lib/libc/port/sys/epoll.c
index 34cb151135..e510b0b247 100644
--- a/usr/src/lib/libc/port/sys/epoll.c
+++ b/usr/src/lib/libc/port/sys/epoll.c
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -64,6 +64,15 @@
 #define	EPOLLSWIZZLED	\
 	(EPOLLRDHUP | EPOLLONESHOT | EPOLLET | EPOLLWRBAND | EPOLLWRNORM)
 
+/*
+ * The defined behavior for epoll_wait/epoll_pwait when using a timeout less
+ * than 0 is to wait for events until they arrive (or interrupted by a signal).
+ * While poll(7d) operates in this manner for a timeout of -1, using other
+ * negative values results in an immediate timeout, as if it had been set to 0.
+ * For that reason, negative values are clamped to -1.
+ */
+#define	EPOLL_TIMEOUT_CLAMP(t)	(((t) < -1) ? -1 : (t))
+
 int
 epoll_create(int size)
 {
@@ -209,7 +218,7 @@ epoll_wait(int epfd, struct epoll_event *events,
 	}
 
 	arg.dp_nfds = maxevents;
-	arg.dp_timeout = timeout;
+	arg.dp_timeout = EPOLL_TIMEOUT_CLAMP(timeout);
 	arg.dp_fds = (pollfd_t *)events;
 
 	return (ioctl(epfd, DP_POLL, &arg));
@@ -227,7 +236,7 @@ epoll_pwait(int epfd, struct epoll_event *events,
 	}
 
 	arg.dp_nfds = maxevents;
-	arg.dp_timeout = timeout;
+	arg.dp_timeout = EPOLL_TIMEOUT_CLAMP(timeout);
 	arg.dp_fds = (pollfd_t *)events;
 	arg.dp_setp = (sigset_t *)sigmask;
 
diff --git a/usr/src/lib/libc/port/sys/inotify.c b/usr/src/lib/libc/port/sys/inotify.c
new file mode 100644
index 0000000000..90d04b5dd3
--- /dev/null
+++ b/usr/src/lib/libc/port/sys/inotify.c
@@ -0,0 +1,142 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ */
+
+#include <sys/inotify.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <strings.h>
+#include <dirent.h>
+
+int
+inotify_init()
+{
+	return (open("/dev/inotify", O_RDWR));
+}
+
+int
+inotify_init1(int flags)
+{
+	int oflags = O_RDWR;
+
+	if (flags & IN_NONBLOCK)
+		oflags |= O_NONBLOCK;
+
+	if (flags & IN_CLOEXEC)
+		oflags |= O_CLOEXEC;
+
+	return (open("/dev/inotify", oflags));
+}
+
+int
+inotify_add_watch(int fd, const char *pathname, uint32_t mask)
+{
+	inotify_addwatch_t ioc;
+	inotify_addchild_t cioc;
+	struct stat buf;
+	int dirfd, wd;
+	DIR *dir;
+	struct dirent *dp;
+	int oflags = O_RDONLY;
+
+	if (mask & IN_DONT_FOLLOW)
+		oflags |= O_NOFOLLOW;
+
+	if ((dirfd = open(pathname, oflags)) < 0)
+		return (-1);
+
+	if (fstat(dirfd, &buf) != 0) {
+		(void) close(dirfd);
+		return (-1);
+	}
+
+	if ((mask & IN_ONLYDIR) && !(buf.st_mode & S_IFDIR)) {
+		(void) close(dirfd);
+		errno = ENOTDIR;
+		return (-1);
+	}
+
+	bzero(&ioc, sizeof (ioc));
+	ioc.inaw_fd = dirfd;
+	ioc.inaw_mask = mask;
+
+	if ((wd = ioctl(fd, INOTIFYIOC_ADD_WATCH, &ioc)) < 0) {
+		(void) close(dirfd);
+		return (-1);
+	}
+
+	if (!(buf.st_mode & S_IFDIR) || !(mask & IN_CHILD_EVENTS)) {
+		(void) close(dirfd);
+		(void) ioctl(fd, INOTIFYIOC_ACTIVATE, wd);
+		return (wd);
+	}
+
+	/*
+	 * If we have a directory and we have a mask that denotes child events,
+	 * we need to manually add a child watch to every directory entry.
+	 * (Because our watch is in place, it will automatically be added to
+	 * files that are newly created after this point.)
+	 */
+	if ((dir = fdopendir(dirfd)) == NULL) {
+		(void) inotify_rm_watch(fd, wd);
+		(void) close(dirfd);
+		return (-1);
+	}
+
+	bzero(&cioc, sizeof (cioc));
+	cioc.inac_fd = dirfd;
+
+	while ((dp = readdir(dir)) != NULL) {
+		if (strcmp(dp->d_name, ".") == 0)
+			continue;
+
+		if (strcmp(dp->d_name, "..") == 0)
+			continue;
+
+		cioc.inac_name = dp->d_name;
+
+		if (ioctl(fd, INOTIFYIOC_ADD_CHILD, &cioc) != 0) {
+			/*
+			 * If we get an error that indicates clear internal
+			 * malfunctioning, we propagate the error.  Otherwise
+			 * we eat it:  this could be a file that no longer
+			 * exists or a symlink or something else that we
+			 * can't lookup.
+			 */
+			switch (errno) {
+			case ENXIO:
+			case EFAULT:
+			case EBADF:
+				(void) closedir(dir);
+				(void) inotify_rm_watch(fd, wd);
+				return (-1);
+			default:
+				break;
+			}
+		}
+	}
+
+	(void) closedir(dir);
+	(void) ioctl(fd, INOTIFYIOC_ACTIVATE, wd);
+
+	return (wd);
+}
+
+int
+inotify_rm_watch(int fd, int wd)
+{
+	return (ioctl(fd, INOTIFYIOC_RM_WATCH, wd));
+}
diff --git a/usr/src/lib/libc/port/sys/time_util.c b/usr/src/lib/libc/port/sys/time_util.c
index 93a07aaee0..b6ea0291e2 100644
--- a/usr/src/lib/libc/port/sys/time_util.c
+++ b/usr/src/lib/libc/port/sys/time_util.c
@@ -22,10 +22,9 @@
 /*
  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <time.h>
 #include <errno.h>
@@ -39,6 +38,10 @@
 void
 hrt2ts(hrtime_t hrt, timespec_t *tsp)
 {
+#if defined(__amd64)
+	tsp->tv_sec = hrt / NANOSEC;
+	tsp->tv_nsec = hrt % NANOSEC;
+#else
 	uint32_t sec, nsec, tmp;
 
 	tmp = (uint32_t)(hrt >> 30);
@@ -60,6 +63,7 @@ hrt2ts(hrtime_t hrt, timespec_t *tsp)
 	}
 	tsp->tv_sec = (time_t)sec;
 	tsp->tv_nsec = nsec;
+#endif /* defined(__amd64) */
 }
 
 /*
@@ -67,8 +71,8 @@ hrt2ts(hrtime_t hrt, timespec_t *tsp)
  * All *timedwait() system call traps expect relative time.
  */
 void
-abstime_to_reltime(clockid_t clock_id,
-	const timespec_t *abstime, timespec_t *reltime)
+abstime_to_reltime(clockid_t clock_id, const timespec_t *abstime,
+    timespec_t *reltime)
 {
 	extern int __clock_gettime(clockid_t, timespec_t *);
 	timespec_t now;
diff --git a/usr/src/lib/libc/port/sys/zone.c b/usr/src/lib/libc/port/sys/zone.c
index 4a4c70043d..8cf28c3ccf 100644
--- a/usr/src/lib/libc/port/sys/zone.c
+++ b/usr/src/lib/libc/port/sys/zone.c
@@ -22,9 +22,11 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011 Joyent Inc.  All rights reserved.
  */
 
 #include "lint.h"
+#include "thr_uberdata.h"
 #include <sys/types.h>
 #include <sys/syscall.h>
 #include <sys/zone.h>
@@ -39,7 +41,8 @@
 zoneid_t
 zone_create(const char *name, const char *root, const struct priv_set *privs,
     const char *rctls, size_t rctlsz, const char *zfs, size_t zfssz,
-    int *extended_error, int match, int doi, const bslabel_t *label, int flags)
+    int *extended_error, int match, int doi, const bslabel_t *label, int flags,
+    zoneid_t req_zoneid)
 {
 	zone_def  zd;
 	priv_data_t *d;
@@ -59,6 +62,7 @@ zone_create(const char *name, const char *root, const struct priv_set *privs,
 	zd.doi = doi;
 	zd.label = label;
 	zd.flags = flags;
+	zd.zoneid = req_zoneid;
 
 	return ((zoneid_t)syscall(SYS_zone, ZONE_CREATE, &zd));
 }
@@ -241,3 +245,10 @@ zone_list_datalink(zoneid_t zoneid, int *dlnump, datalink_id_t *linkids)
 {
 	return (syscall(SYS_zone, ZONE_LIST_DATALINK, zoneid, dlnump, linkids));
 }
+
+const char *
+zone_get_nroot()
+{
+	uberdata_t *udp = curthread->ul_uberdata;
+	return (udp->ub_broot);
+}
diff --git a/usr/src/lib/libc/port/threads/sigaction.c b/usr/src/lib/libc/port/threads/sigaction.c
index 571e211f97..6a283be33b 100644
--- a/usr/src/lib/libc/port/threads/sigaction.c
+++ b/usr/src/lib/libc/port/threads/sigaction.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #include "lint.h"
@@ -284,6 +285,24 @@ take_deferred_signal(int sig)
 		thr_panic("take_deferred_signal(): __sigresend() failed");
 }
 
+/*
+ * sigacthandler() attempts to clean up dangling uc_link pointers in
+ * signal handling contexts when libc believes us to have escaped
+ * a signal handler incorrectly in the past.
+ *
+ * Branded processes have a legitimate use for a chain including contexts
+ * other than those used for signal handling when tracking emulation
+ * requests from the kernel.  We allow them to disable this cleanup
+ * behaviour.
+ */
+static int escaped_context_cleanup = 1;
+
+void
+set_escaped_context_cleanup(int on)
+{
+	escaped_context_cleanup = on;
+}
+
 void
 sigacthandler(int sig, siginfo_t *sip, void *uvp)
 {
@@ -306,7 +325,7 @@ sigacthandler(int sig, siginfo_t *sip, void *uvp)
 	 * we are actually executing at main level (self->ul_siglink == NULL).
 	 * See the code for setjmp()/longjmp() for more details.
 	 */
-	if (self->ul_siglink == NULL)
+	if (escaped_context_cleanup && self->ul_siglink == NULL)
 		ucp->uc_link = NULL;
 
 	/*
@@ -458,11 +477,12 @@ sigaction(int sig, const struct sigaction *nact, struct sigaction *oact)
 }
 
 /*
- * This is a private interface for the linux brand interface.
+ * This is a private interface for the lx brand.
  */
 void
 setsigacthandler(void (*nsigacthandler)(int, siginfo_t *, void *),
-    void (**osigacthandler)(int, siginfo_t *, void *))
+    void (**osigacthandler)(int, siginfo_t *, void *),
+    int (*brsetctxt)(const ucontext_t *))
 {
 	ulwp_t *self = curthread;
 	uberdata_t *udp = self->ul_uberdata;
@@ -471,6 +491,9 @@ setsigacthandler(void (*nsigacthandler)(int, siginfo_t *, void *),
 		*osigacthandler = udp->sigacthandler;
 
 	udp->sigacthandler = nsigacthandler;
+
+	if (brsetctxt != NULL)
+		udp->setctxt = brsetctxt;
 }
 
 /*
@@ -517,11 +540,39 @@ set_setcontext_enforcement(int on)
 	setcontext_enforcement = on;
 }
 
+/*
+ * The LX brand emulation library implements an operation that is analogous to
+ * setcontext(), but takes a different path in to the kernel.  So that it can
+ * correctly restore a signal mask, we expose just the signal mask handling
+ * part of the regular setcontext() routine as a private interface.
+ */
+void
+setcontext_sigmask(ucontext_t *ucp)
+{
+	ulwp_t *self = curthread;
+
+	if (ucp->uc_flags & UC_SIGMASK) {
+		block_all_signals(self);
+		delete_reserved_signals(&ucp->uc_sigmask);
+		self->ul_sigmask = ucp->uc_sigmask;
+		if (self->ul_cursig) {
+			/*
+			 * We have a deferred signal present.
+			 * The signal mask will be set when the
+			 * signal is taken in take_deferred_signal().
+			 */
+			ASSERT(self->ul_critical + self->ul_sigdefer != 0);
+			ucp->uc_flags &= ~UC_SIGMASK;
+		}
+	}
+}
+
 #pragma weak _setcontext = setcontext
 int
 setcontext(const ucontext_t *ucp)
 {
 	ulwp_t *self = curthread;
+	uberdata_t *udp = self->ul_uberdata;
 	int ret;
 	ucontext_t uc;
 
@@ -536,20 +587,7 @@ setcontext(const ucontext_t *ucp)
 	/*
 	 * Restore previous signal mask and context link.
 	 */
-	if (uc.uc_flags & UC_SIGMASK) {
-		block_all_signals(self);
-		delete_reserved_signals(&uc.uc_sigmask);
-		self->ul_sigmask = uc.uc_sigmask;
-		if (self->ul_cursig) {
-			/*
-			 * We have a deferred signal present.
-			 * The signal mask will be set when the
-			 * signal is taken in take_deferred_signal().
-			 */
-			ASSERT(self->ul_critical + self->ul_sigdefer != 0);
-			uc.uc_flags &= ~UC_SIGMASK;
-		}
-	}
+	setcontext_sigmask(&uc);
 	self->ul_siglink = uc.uc_link;
 
 	/*
@@ -578,7 +616,7 @@ setcontext(const ucontext_t *ucp)
 	 */
 	set_parking_flag(self, 0);
 	self->ul_sp = 0;
-	ret = __setcontext(&uc);
+	ret = udp->setctxt(&uc);
 
 	/*
 	 * It is OK for setcontext() to return if the user has not specified
diff --git a/usr/src/lib/libc/port/threads/thr.c b/usr/src/lib/libc/port/threads/thr.c
index 640c1c9645..b6580b3e3a 100644
--- a/usr/src/lib/libc/port/threads/thr.c
+++ b/usr/src/lib/libc/port/threads/thr.c
@@ -127,6 +127,7 @@ uberdata_t __uberdata = {
 	0,			/* ndaemons */
 	0,			/* pid */
 	sigacthandler,		/* sigacthandler */
+	__setcontext,		/* setctxt */
 	NULL,			/* lwp_stacks */
 	NULL,			/* lwp_laststack */
 	0,			/* nfreestack */
@@ -139,6 +140,7 @@ uberdata_t __uberdata = {
 	NULL,			/* robustlocks */
 	NULL,			/* robustlist */
 	NULL,			/* progname */
+	NULL,			/* ub_broot */
 	NULL,			/* ub_comm_page */
 	NULL,			/* __tdb_bootstrap */
 	{			/* tdb */
@@ -1233,13 +1235,19 @@ init_auxv_data(uberdata_t *udp)
 {
 	Dl_argsinfo_t args;
 
+	udp->ub_broot = NULL;
 	udp->ub_comm_page = NULL;
 	if (dlinfo(RTLD_SELF, RTLD_DI_ARGSINFO, &args) < 0)
 		return;
 
 	while (args.dla_auxv->a_type != AT_NULL) {
-		if (args.dla_auxv->a_type == AT_SUN_COMMPAGE) {
+		switch (args.dla_auxv->a_type) {
+		case AT_SUN_BRAND_NROOT:
+			udp->ub_broot = args.dla_auxv->a_un.a_ptr;
+			break;
+		case AT_SUN_COMMPAGE:
 			udp->ub_comm_page = args.dla_auxv->a_un.a_ptr;
+			break;
 		}
 		args.dla_auxv++;
 	}
@@ -1283,7 +1291,8 @@ libc_init(void)
 	/*
 	 * Every libc, regardless of link map, needs to go through and check
 	 * its aux vectors.  Doing so will indicate whether or not this has
-	 * been given a comm page (to optimize certain system actions).
+	 * been given a brand root (used to qualify various other data) or a
+	 * comm page (to optimize certain system actions).
 	 */
 	init_auxv_data(udp);
 
diff --git a/usr/src/lib/libc/sparc/Makefile.com b/usr/src/lib/libc/sparc/Makefile.com
index 92efd03df5..20a4e0fd4e 100644
--- a/usr/src/lib/libc/sparc/Makefile.com
+++ b/usr/src/lib/libc/sparc/Makefile.com
@@ -965,6 +965,7 @@ PORTSYS=			\
 	fcntl.o			\
 	getpagesizes.o		\
 	getpeerucred.o		\
+	inotify.o		\
 	inst_sync.o		\
 	issetugid.o		\
 	label.o			\
diff --git a/usr/src/lib/libc/sparc/gen/siginfolst.c b/usr/src/lib/libc/sparc/gen/siginfolst.c
index 8451dfbb4f..8b8a1b4669 100644
--- a/usr/src/lib/libc/sparc/gen/siginfolst.c
+++ b/usr/src/lib/libc/sparc/gen/siginfolst.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -188,6 +189,7 @@ static const struct siginfolist _sys_siginfolist_data[NSIG-1] = {
 	0,		0,
 	0,		0,
 	0,		0,			/* SIGRTMIN+15 */
+	0,		0,			/* SIGRTMIN+16 */
 	0,		0,			/* SIGRTMAX-15 */
 	0,		0,
 	0,		0,
diff --git a/usr/src/lib/libc/sparcv9/Makefile.com b/usr/src/lib/libc/sparcv9/Makefile.com
index b756ad5ab2..8e8fc96f16 100644
--- a/usr/src/lib/libc/sparcv9/Makefile.com
+++ b/usr/src/lib/libc/sparcv9/Makefile.com
@@ -901,6 +901,7 @@ PORTSYS=			\
 	chmod.o			\
 	chown.o			\
 	corectl.o		\
+	epoll.o			\
 	eventfd.o		\
 	epoll.o			\
 	exacctsys.o		\
diff --git a/usr/src/lib/libc/sparcv9/gen/siginfolst.c b/usr/src/lib/libc/sparcv9/gen/siginfolst.c
index 8451dfbb4f..8b8a1b4669 100644
--- a/usr/src/lib/libc/sparcv9/gen/siginfolst.c
+++ b/usr/src/lib/libc/sparcv9/gen/siginfolst.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -188,6 +189,7 @@ static const struct siginfolist _sys_siginfolist_data[NSIG-1] = {
 	0,		0,
 	0,		0,
 	0,		0,			/* SIGRTMIN+15 */
+	0,		0,			/* SIGRTMIN+16 */
 	0,		0,			/* SIGRTMAX-15 */
 	0,		0,
 	0,		0,
diff --git a/usr/src/lib/libcmdutils/Makefile.com b/usr/src/lib/libcmdutils/Makefile.com
index 9cb35f8795..72e7330eba 100644
--- a/usr/src/lib/libcmdutils/Makefile.com
+++ b/usr/src/lib/libcmdutils/Makefile.com
@@ -21,12 +21,13 @@
 #
 # Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright (c) 2013 RackTop Systems.
+# Copyright 2018, Joyent, Inc.
 #
 
 LIBRARY=	libcmdutils.a
 VERS=		.1
 CMD_OBJS=	avltree.o sysattrs.o writefile.o process_xattrs.o uid.o gid.o \
-		custr.o nicenum.o
+		nicenum.o
 COM_OBJS=	list.o
 OBJECTS=	$(CMD_OBJS) $(COM_OBJS)
 
diff --git a/usr/src/lib/libcmdutils/common/mapfile-vers b/usr/src/lib/libcmdutils/common/mapfile-vers
index 0ac77eb010..2a3e95f95c 100644
--- a/usr/src/lib/libcmdutils/common/mapfile-vers
+++ b/usr/src/lib/libcmdutils/common/mapfile-vers
@@ -21,6 +21,7 @@
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright (c) 2013 RackTop Systems.
+# Copyright 2018, Joyent, Inc.
 #
 
 #
@@ -42,16 +43,16 @@ $mapfile_version 2
 SYMBOL_VERSION SUNWprivate_1.1 {
     global:
 	add_tnode;
-	custr_alloc;
-	custr_alloc_buf;
-	custr_append;
-	custr_appendc;
-	custr_append_printf;
-	custr_append_vprintf;
-	custr_cstr;
-	custr_free;
-	custr_len;
-	custr_reset;
+	custr_alloc		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_alloc_buf		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_append		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_appendc		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_append_printf	{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_append_vprintf	{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_cstr		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_free		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_len		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
+	custr_reset		{ TYPE = FUNCTION; FILTER = libcustr.so.1 };
 	destroy_tree;
 	findnextgid;
 	findnextuid;
diff --git a/usr/src/lib/libcmdutils/libcmdutils.h b/usr/src/lib/libcmdutils/libcmdutils.h
index 5f9957b861..c9a61aab4d 100644
--- a/usr/src/lib/libcmdutils/libcmdutils.h
+++ b/usr/src/lib/libcmdutils/libcmdutils.h
@@ -26,7 +26,7 @@
  * Copyright (c) 2013 RackTop Systems.
  */
 /*
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -162,60 +162,6 @@ extern int findnextuid(uid_t, uid_t, uid_t *);
  */
 extern int findnextgid(gid_t, gid_t, gid_t *);
 
-
-
-		/* dynamic string utilities */
-
-typedef struct custr custr_t;
-
-/*
- * Allocate and free a "custr_t" dynamic string object.  Returns 0 on success
- * and -1 otherwise.
- */
-extern int custr_alloc(custr_t **);
-extern void custr_free(custr_t *);
-
-/*
- * Allocate a "custr_t" dynamic string object that operates on a fixed external
- * buffer.
- */
-extern int custr_alloc_buf(custr_t **, void *, size_t);
-
-/*
- * Append a single character, or a NUL-terminated string of characters, to a
- * dynamic string.  Returns 0 on success and -1 otherwise.  The dynamic string
- * will be unmodified if the function returns -1.
- */
-extern int custr_appendc(custr_t *, char);
-extern int custr_append(custr_t *, const char *);
-
-/*
- * Append a format string and arguments as though the contents were being parsed
- * through snprintf. Returns 0 on success and -1 otherwise.  The dynamic string
- * will be unmodified if the function returns -1.
- */
-extern int custr_append_printf(custr_t *, const char *, ...);
-extern int custr_append_vprintf(custr_t *, const char *, va_list);
-
-/*
- * Determine the length in bytes, not including the NUL terminator, of the
- * dynamic string.
- */
-extern size_t custr_len(custr_t *);
-
-/*
- * Clear the contents of a dynamic string.  Does not free the underlying
- * memory.
- */
-extern void custr_reset(custr_t *);
-
-/*
- * Retrieve a const pointer to a NUL-terminated string version of the contents
- * of the dynamic string.  Storage for this string should not be freed, and
- * the pointer will be invalidated by any mutations to the dynamic string.
- */
-extern const char *custr_cstr(custr_t *str);
-
 #define	NN_DIVISOR_1000		(1U << 0)
 
 /* Minimum size for the output of nicenum, including NULL */
diff --git a/usr/src/lib/libcryptoutil/common/cryptoutil.h b/usr/src/lib/libcryptoutil/common/cryptoutil.h
index 63a3df665f..d5c67c48a4 100644
--- a/usr/src/lib/libcryptoutil/common/cryptoutil.h
+++ b/usr/src/lib/libcryptoutil/common/cryptoutil.h
@@ -23,6 +23,7 @@
 /*
  * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2018, Joyent, Inc.
  */
 
 #ifndef _CRYPTOUTIL_H
@@ -227,6 +228,8 @@ extern int update_conf(char *conf_file, char *entry);
 extern int pkcs11_parse_uri(const char *str, pkcs11_uri_t *uri);
 extern void pkcs11_free_uri(pkcs11_uri_t *uri);
 
+extern CK_RV crypto2pkcs11_error_number(uint_t);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/usr/src/lib/libcryptoutil/common/mapfile-vers b/usr/src/lib/libcryptoutil/common/mapfile-vers
index c7f2576f37..1b7d788045 100644
--- a/usr/src/lib/libcryptoutil/common/mapfile-vers
+++ b/usr/src/lib/libcryptoutil/common/mapfile-vers
@@ -20,6 +20,7 @@
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2014, OmniTI Computer Consulting Inc. All rights reserved.
+# Copyright 2018, Joyent, Inc.
 #
 
 #
@@ -41,6 +42,7 @@ $mapfile_version 2
 SYMBOL_VERSION SUNWprivate {
     global:
 	create_umech;
+	crypto2pkcs11_error_number;
 	cryptodebug;
 	cryptodebug_init;
 	cryptoerror;
diff --git a/usr/src/lib/libcryptoutil/common/util.c b/usr/src/lib/libcryptoutil/common/util.c
index 6fbf175d77..e7368dc4e7 100644
--- a/usr/src/lib/libcryptoutil/common/util.c
+++ b/usr/src/lib/libcryptoutil/common/util.c
@@ -21,14 +21,111 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018, Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <cryptoutil.h>
 #include <strings.h>
 #include <stdio.h>
 #include <tzfile.h>
+#include <sys/crypto/common.h>
+
+/*
+ * In order to fit everything on one line, the 'CRYPTO_' prefix
+ * has been dropped from the KCF #defines, e.g.
+ * CRYPTO_SUCCESS becomes SUCCESS.
+ */
+
+static CK_RV error_number_table[CRYPTO_LAST_ERROR + 1] = {
+CKR_OK,					/* SUCCESS */
+CKR_CANCEL,				/* CANCEL */
+CKR_HOST_MEMORY,			/* HOST_MEMORY */
+CKR_GENERAL_ERROR,			/* GENERAL_ERROR */
+CKR_FUNCTION_FAILED,			/* FAILED */
+CKR_ARGUMENTS_BAD,			/* ARGUMENTS_BAD */
+CKR_ATTRIBUTE_READ_ONLY,		/* ATTRIBUTE_READ_ONLY */
+CKR_ATTRIBUTE_SENSITIVE,		/* ATTRIBUTE_SENSITIVE */
+CKR_ATTRIBUTE_TYPE_INVALID,		/* ATTRIBUTE_TYPE_INVALID */
+CKR_ATTRIBUTE_VALUE_INVALID,		/* ATTRIBUTE_VALUE_INVALID */
+CKR_FUNCTION_FAILED,			/* CANCELED */
+CKR_DATA_INVALID,			/* DATA_INVALID */
+CKR_DATA_LEN_RANGE,			/* DATA_LEN_RANGE */
+CKR_DEVICE_ERROR,			/* DEVICE_ERROR */
+CKR_DEVICE_MEMORY,			/* DEVICE_MEMORY */
+CKR_DEVICE_REMOVED,			/* DEVICE_REMOVED */
+CKR_ENCRYPTED_DATA_INVALID,		/* ENCRYPTED_DATA_INVALID */
+CKR_ENCRYPTED_DATA_LEN_RANGE,		/* ENCRYPTED_DATA_LEN_RANGE */
+CKR_KEY_HANDLE_INVALID,			/* KEY_HANDLE_INVALID */
+CKR_KEY_SIZE_RANGE,			/* KEY_SIZE_RANGE */
+CKR_KEY_TYPE_INCONSISTENT,		/* KEY_TYPE_INCONSISTENT */
+CKR_KEY_NOT_NEEDED,			/* KEY_NOT_NEEDED */
+CKR_KEY_CHANGED,			/* KEY_CHANGED */
+CKR_KEY_NEEDED,				/* KEY_NEEDED */
+CKR_KEY_INDIGESTIBLE,			/* KEY_INDIGESTIBLE */
+CKR_KEY_FUNCTION_NOT_PERMITTED,		/* KEY_FUNCTION_NOT_PERMITTED */
+CKR_KEY_NOT_WRAPPABLE,			/* KEY_NOT_WRAPPABLE */
+CKR_KEY_UNEXTRACTABLE,			/* KEY_UNEXTRACTABLE */
+CKR_MECHANISM_INVALID,			/* MECHANISM_INVALID */
+CKR_MECHANISM_PARAM_INVALID,		/* MECHANISM_PARAM_INVALID */
+CKR_OBJECT_HANDLE_INVALID,		/* OBJECT_HANDLE_INVALID */
+CKR_OPERATION_ACTIVE,			/* OPERATION_ACTIVE */
+CKR_OPERATION_NOT_INITIALIZED,		/* OPERATION_NOT_INITIALIZED */
+CKR_PIN_INCORRECT,			/* PIN_INCORRECT */
+CKR_PIN_INVALID,			/* PIN_INVALID */
+CKR_PIN_LEN_RANGE,			/* PIN_LEN_RANGE */
+CKR_PIN_EXPIRED,			/* PIN_EXPIRED */
+CKR_PIN_LOCKED,				/* PIN_LOCKED */
+CKR_SESSION_CLOSED,			/* SESSION_CLOSED */
+CKR_SESSION_COUNT,			/* SESSION_COUNT */
+CKR_SESSION_HANDLE_INVALID,		/* SESSION_HANDLE_INVALID */
+CKR_SESSION_READ_ONLY,			/* SESSION_READ_ONLY */
+CKR_SESSION_EXISTS,			/* SESSION_EXISTS */
+CKR_SESSION_READ_ONLY_EXISTS,		/* SESSION_READ_ONLY_EXISTS */
+CKR_SESSION_READ_WRITE_SO_EXISTS,	/* SESSION_READ_WRITE_SO_EXISTS */
+CKR_SIGNATURE_INVALID,			/* SIGNATURE_INVALID */
+CKR_SIGNATURE_LEN_RANGE,		/* SIGNATURE_LEN_RANGE */
+CKR_TEMPLATE_INCOMPLETE,		/* TEMPLATE_INCOMPLETE */
+CKR_TEMPLATE_INCONSISTENT,		/* TEMPLATE_INCONSISTENT */
+CKR_UNWRAPPING_KEY_HANDLE_INVALID,	/* UNWRAPPING_KEY_HANDLE_INVALID */
+CKR_UNWRAPPING_KEY_SIZE_RANGE,		/* UNWRAPPING_KEY_SIZE_RANGE */
+CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT,	/* UNWRAPPING_KEY_TYPE_INCONSISTENT */
+CKR_USER_ALREADY_LOGGED_IN,		/* USER_ALREADY_LOGGED_IN */
+CKR_USER_NOT_LOGGED_IN,			/* USER_NOT_LOGGED_IN */
+CKR_USER_PIN_NOT_INITIALIZED,		/* USER_PIN_NOT_INITIALIZED */
+CKR_USER_TYPE_INVALID,			/* USER_TYPE_INVALID */
+CKR_USER_ANOTHER_ALREADY_LOGGED_IN,	/* USER_ANOTHER_ALREADY_LOGGED_IN */
+CKR_USER_TOO_MANY_TYPES,		/* USER_TOO_MANY_TYPES */
+CKR_WRAPPED_KEY_INVALID,		/* WRAPPED_KEY_INVALID */
+CKR_WRAPPED_KEY_LEN_RANGE,		/* WRAPPED_KEY_LEN_RANGE */
+CKR_WRAPPING_KEY_HANDLE_INVALID,	/* WRAPPING_KEY_HANDLE_INVALID */
+CKR_WRAPPING_KEY_SIZE_RANGE,		/* WRAPPING_KEY_SIZE_RANGE */
+CKR_WRAPPING_KEY_TYPE_INCONSISTENT,	/* WRAPPING_KEY_TYPE_INCONSISTENT */
+CKR_RANDOM_SEED_NOT_SUPPORTED,		/* RANDOM_SEED_NOT_SUPPORTED */
+CKR_RANDOM_NO_RNG,			/* RANDOM_NO_RNG */
+CKR_DOMAIN_PARAMS_INVALID,		/* DOMAIN_PARAMS_INVALID */
+CKR_BUFFER_TOO_SMALL,			/* BUFFER_TOO_SMALL */
+CKR_INFORMATION_SENSITIVE,		/* INFORMATION_SENSITIVE */
+CKR_FUNCTION_NOT_SUPPORTED,		/* NOT_SUPPORTED */
+CKR_GENERAL_ERROR,			/* QUEUED */
+CKR_GENERAL_ERROR,			/* BUFFER_TOO_BIG */
+CKR_OPERATION_NOT_INITIALIZED,		/* INVALID_CONTEXT */
+CKR_GENERAL_ERROR,			/* INVALID_MAC */
+CKR_GENERAL_ERROR,			/* MECH_NOT_SUPPORTED */
+CKR_GENERAL_ERROR,			/* INCONSISTENT_ATTRIBUTE */
+CKR_GENERAL_ERROR,			/* NO_PERMISSION */
+CKR_SLOT_ID_INVALID,			/* INVALID_PROVIDER_ID */
+CKR_GENERAL_ERROR,			/* VERSION_MISMATCH */
+CKR_GENERAL_ERROR,			/* BUSY */
+CKR_GENERAL_ERROR,			/* UNKNOWN_PROVIDER */
+CKR_GENERAL_ERROR,			/* MODVERIFICATION_FAILED */
+CKR_GENERAL_ERROR,			/* OLD_CTX_TEMPLATE */
+CKR_GENERAL_ERROR,			/* WEAK_KEY */
+CKR_GENERAL_ERROR			/* FIPS140_ERROR */
+};
+
+#if CRYPTO_LAST_ERROR != CRYPTO_FIPS140_ERROR
+#error "Crypto to PKCS11 error mapping table needs to be updated!"
+#endif
 
 /*
  * This function returns a fullpath based on the "dir" and "filepath" input
@@ -96,16 +193,16 @@ str2lifetime(char *ltimestr, uint32_t *ltime)
 		return (-1);
 
 	if (!strcasecmp(timetok, "second") ||
-		!strcasecmp(timetok, "seconds")) {
+	    !strcasecmp(timetok, "seconds")) {
 		*ltime = num;
 	} else if (!strcasecmp(timetok, "minute") ||
-		!strcasecmp(timetok, "minutes")) {
+	    !strcasecmp(timetok, "minutes")) {
 		*ltime = num * SECSPERMIN;
 	} else if (!strcasecmp(timetok, "day") ||
 	    !strcasecmp(timetok, "days")) {
 		*ltime = num * SECSPERDAY;
 	} else if (!strcasecmp(timetok, "hour") ||
-		!strcasecmp(timetok, "hours")) {
+	    !strcasecmp(timetok, "hours")) {
 		*ltime = num * SECSPERHOUR;
 	} else {
 		*ltime = 0;
@@ -114,3 +211,15 @@ str2lifetime(char *ltimestr, uint32_t *ltime)
 
 	return (0);
 }
+
+/*
+ * Map KCF error codes into PKCS11 error codes.
+ */
+CK_RV
+crypto2pkcs11_error_number(uint_t n)
+{
+	if (n >= sizeof (error_number_table) / sizeof (error_number_table[0]))
+		return (CKR_GENERAL_ERROR);
+
+	return (error_number_table[n]);
+}
diff --git a/usr/src/lib/libctf/Makefile.com b/usr/src/lib/libctf/Makefile.com
index 4d1e01d4eb..0169c2a367 100644
--- a/usr/src/lib/libctf/Makefile.com
+++ b/usr/src/lib/libctf/Makefile.com
@@ -23,43 +23,9 @@
 # Use is subject to license terms.
 #
 
-LIBRARY = libctf.a
-VERS = .1
-
-COMMON_OBJS = \
-	ctf_create.o \
-	ctf_decl.o \
-	ctf_error.o \
-	ctf_hash.o \
-	ctf_labels.o \
-	ctf_lookup.o \
-	ctf_open.o \
-	ctf_types.o \
-	ctf_util.o
-
-LIB_OBJS = \
-	ctf_lib.o \
-	ctf_subr.o
-
-OBJECTS = $(COMMON_OBJS) $(LIB_OBJS)
-
-include ../../Makefile.lib
+include ../Makefile.shared.com
 include ../../Makefile.rootfs
 
-SRCS = $(COMMON_OBJS:%.o=../../../common/ctf/%.c) $(LIB_OBJS:%.o=../common/%.c)
-LIBS = $(DYNLIB) $(LINTLIB)
-
-SRCDIR = ../common
-
-CPPFLAGS += -I../common -I../../../common/ctf -DCTF_OLD_VERSIONS
-CFLAGS += $(CCVERBOSE)
-
-CERRWARN += -_gcc=-Wno-uninitialized
-
-LDLIBS += -lc
-
-$(LINTLIB) := SRCS = $(SRCDIR)/$(LINTSRC)
-
 .KEEP_STATE:
 
 all: $(LIBS)
@@ -67,7 +33,4 @@ all: $(LIBS)
 lint: lintcheck
 
 include ../../Makefile.targ
-
-objs/%.o pics/%.o: ../../../common/ctf/%.c
-	$(COMPILE.c) -o $@ $<
-	$(POST_PROCESS_O)
+include ../Makefile.shared.targ
diff --git a/usr/src/lib/libctf/Makefile.shared.com b/usr/src/lib/libctf/Makefile.shared.com
new file mode 100644
index 0000000000..55f090e7f8
--- /dev/null
+++ b/usr/src/lib/libctf/Makefile.shared.com
@@ -0,0 +1,90 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+#
+
+#
+# This Makefile is shared between the libctf native build in tools and
+# the libctf build here for the system.
+#
+LIBRARY = libctf.a
+VERS = .1
+
+COMMON_OBJS = \
+	ctf_create.o \
+	ctf_decl.o \
+	ctf_dwarf.o \
+	ctf_error.o \
+	ctf_hash.o \
+	ctf_labels.o \
+	ctf_lookup.o \
+	ctf_open.o \
+	ctf_types.o \
+	ctf_util.o
+
+MERGEQ_OBJS = \
+	mergeq.o \
+	workq.o
+
+LIST_OBJS = \
+	list.o
+
+LIB_OBJS = \
+	ctf_convert.o \
+	ctf_elfwrite.o \
+	ctf_diff.o \
+	ctf_lib.o \
+	ctf_merge.o \
+	ctf_subr.o
+
+OBJECTS = $(COMMON_OBJS) $(LIB_OBJS) $(LIST_OBJS) $(MERGEQ_OBJS)
+MAPFILEDIR = $(SRC)/lib/libctf
+
+include $(SRC)/lib/Makefile.lib
+
+SRCS = \
+	$(COMMON_OBJS:%.o=$(SRC)/common/ctf/%.c) \
+	$(LIB_OBJS:%.o=$(SRC)/lib/libctf/common/%.c) \
+	$(LIST_OBJS:%.o=$(SRC)/common/list/%.c) \
+	$(MERGEQ_OBJS:%.o=$(SRC)/lib/mergeq/%.c)
+	
+LIBS = $(DYNLIB) $(LINTLIB)
+LDLIBS += -lc -lelf -ldwarf -lavl
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+SRCDIR = $(SRC)/lib/libctf/common
+
+CPPFLAGS +=	-I$(SRC)/lib/libctf/common 	\
+		-I$(SRC)/common/ctf		\
+		-I$(SRC)/lib/libdwarf/common	\
+		-I$(SRC)/lib/mergeq		\
+		-DCTF_OLD_VERSIONS
+CFLAGS += $(CCVERBOSE)
+
+CERRWARN += -_gcc=-Wno-uninitialized
+
+$(LINTLIB) := SRCS = $(SRCDIR)/$(LINTSRC)
diff --git a/usr/src/lib/libctf/Makefile.shared.targ b/usr/src/lib/libctf/Makefile.shared.targ
new file mode 100644
index 0000000000..b6520f2366
--- /dev/null
+++ b/usr/src/lib/libctf/Makefile.shared.targ
@@ -0,0 +1,30 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+#
+
+#
+# This Makefile is shared between both the tools and the normal library build.
+#
+
+pics/%.o: $(SRC)/common/ctf/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: $(SRC)/common/list/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: $(SRC)/lib/mergeq/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
diff --git a/usr/src/lib/libctf/common/ctf_convert.c b/usr/src/lib/libctf/common/ctf_convert.c
new file mode 100644
index 0000000000..1a433d17db
--- /dev/null
+++ b/usr/src/lib/libctf/common/ctf_convert.c
@@ -0,0 +1,210 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Main conversion entry points. This has been designed such that there can be
+ * any number of different conversion backends. Currently we only have one that
+ * understands DWARFv2 (and bits of DWARFv4). Each backend should be placed in
+ * the ctf_converters list and each will be tried in turn.
+ */
+
+#include <libctf_impl.h>
+#include <gelf.h>
+
+ctf_convert_f ctf_converters[] = {
+	ctf_dwarf_convert
+};
+
+#define	NCONVERTS	(sizeof (ctf_converters) / sizeof (ctf_convert_f))
+
+typedef enum ctf_convert_source {
+	CTFCONV_SOURCE_NONE = 0x0,
+	CTFCONV_SOURCE_UNKNOWN = 0x01,
+	CTFCONV_SOURCE_C = 0x02,
+	CTFCONV_SOURCE_S = 0x04
+} ctf_convert_source_t;
+
+static void
+ctf_convert_ftypes(Elf *elf, ctf_convert_source_t *types)
+{
+	int i;
+	Elf_Scn *scn = NULL, *strscn;
+	*types = CTFCONV_SOURCE_NONE;
+	GElf_Shdr shdr;
+	Elf_Data *data, *strdata;
+
+	while ((scn = elf_nextscn(elf, scn)) != NULL) {
+
+		if (gelf_getshdr(scn, &shdr) == NULL)
+			return;
+
+		if (shdr.sh_type == SHT_SYMTAB)
+			break;
+	}
+
+	if (scn == NULL)
+		return;
+
+	if ((strscn = elf_getscn(elf, shdr.sh_link)) == NULL)
+		return;
+
+	if ((data = elf_getdata(scn, NULL)) == NULL)
+		return;
+
+	if ((strdata = elf_getdata(strscn, NULL)) == NULL)
+		return;
+
+	for (i = 0; i < shdr.sh_size / shdr.sh_entsize; i++) {
+		GElf_Sym sym;
+		const char *file;
+		size_t len;
+
+		if (gelf_getsym(data, i, &sym) == NULL)
+			return;
+
+		if (GELF_ST_TYPE(sym.st_info) != STT_FILE)
+			continue;
+
+		file = (const char *)((uintptr_t)strdata->d_buf + sym.st_name);
+		len = strlen(file);
+		if (len < 2 || file[len - 2] != '.') {
+			*types |= CTFCONV_SOURCE_UNKNOWN;
+			continue;
+		}
+
+		switch (file[len - 1]) {
+		case 'c':
+			*types |= CTFCONV_SOURCE_C;
+			break;
+		case 'h':
+			/* We traditionally ignore header files... */
+			break;
+		case 's':
+			*types |= CTFCONV_SOURCE_S;
+			break;
+		default:
+			*types |= CTFCONV_SOURCE_UNKNOWN;
+			break;
+		}
+	}
+}
+
+ctf_file_t *
+ctf_elfconvert(int fd, Elf *elf, const char *label, uint_t nthrs, uint_t flags,
+    int *errp, char *errbuf, size_t errlen)
+{
+	int err, i;
+	ctf_file_t *fp = NULL;
+	boolean_t notsup = B_TRUE;
+	ctf_convert_source_t type;
+
+	if (errp == NULL)
+		errp = &err;
+
+	if (elf == NULL) {
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	if (flags & ~CTF_CONVERT_F_IGNNONC) {
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	if (elf_kind(elf) != ELF_K_ELF) {
+		*errp = ECTF_FMT;
+		return (NULL);
+	}
+
+	ctf_convert_ftypes(elf, &type);
+	ctf_dprintf("got types: %d\n", type);
+	if (flags & CTF_CONVERT_F_IGNNONC) {
+		if (type == CTFCONV_SOURCE_NONE ||
+		    (type & CTFCONV_SOURCE_UNKNOWN)) {
+			*errp = ECTF_CONVNOCSRC;
+			return (NULL);
+		}
+	}
+
+	for (i = 0; i < NCONVERTS; i++) {
+		ctf_conv_status_t cs;
+
+		fp = NULL;
+		cs = ctf_converters[i](fd, elf, nthrs, errp, &fp, errbuf,
+		    errlen);
+		if (cs == CTF_CONV_SUCCESS) {
+			notsup = B_FALSE;
+			break;
+		}
+		if (cs == CTF_CONV_ERROR) {
+			fp = NULL;
+			notsup = B_FALSE;
+			break;
+		}
+	}
+
+	if (notsup == B_TRUE) {
+		if ((flags & CTF_CONVERT_F_IGNNONC) != 0 &&
+		    (type & CTFCONV_SOURCE_C) == 0) {
+			*errp = ECTF_CONVNOCSRC;
+			return (NULL);
+		}
+		*errp = ECTF_NOCONVBKEND;
+		return (NULL);
+	}
+
+	/*
+	 * Succsesful conversion.
+	 */
+	if (fp != NULL) {
+		if (label == NULL)
+			label = "";
+		if (ctf_add_label(fp, label, fp->ctf_typemax, 0) == CTF_ERR) {
+			*errp = ctf_errno(fp);
+			ctf_close(fp);
+			return (NULL);
+		}
+		if (ctf_update(fp) == CTF_ERR) {
+			*errp = ctf_errno(fp);
+			ctf_close(fp);
+			return (NULL);
+		}
+	}
+
+	return (fp);
+}
+
+ctf_file_t *
+ctf_fdconvert(int fd, const char *label, uint_t nthrs, uint_t flags, int *errp,
+    char *errbuf, size_t errlen)
+{
+	int err;
+	Elf *elf;
+	ctf_file_t *fp;
+
+	if (errp == NULL)
+		errp = &err;
+
+	elf = elf_begin(fd, ELF_C_READ, NULL);
+	if (elf == NULL) {
+		*errp = ECTF_FMT;
+		return (NULL);
+	}
+
+	fp = ctf_elfconvert(fd, elf, label, nthrs, flags, errp, errbuf, errlen);
+
+	(void) elf_end(elf);
+	return (fp);
+}
diff --git a/usr/src/lib/libctf/common/ctf_diff.c b/usr/src/lib/libctf/common/ctf_diff.c
new file mode 100644
index 0000000000..d070488bbb
--- /dev/null
+++ b/usr/src/lib/libctf/common/ctf_diff.c
@@ -0,0 +1,1362 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * The following ia a basic overview of how we diff types in containers (the
+ * generally interesting part of diff, and what's used by merge). We maintain
+ * two mapping tables, a table of forward mappings (src->dest), and a reverse
+ * mapping (dest->src). Both are initialized to contain no mapping, and can also
+ * be updated to contain a negative mapping.
+ *
+ * What we do first is iterate over each type in the src container, and compare
+ * it with a type in the destination container. This may involve doing recursive
+ * comparisons -- which can involve cycles. To deal with this, whenever we
+ * encounter something which may be cyclic, we insert a guess. In other words,
+ * we assume that it may be true. This is necessary for the classic case of the
+ * following structure:
+ *
+ * struct foo {
+ * 	struct foo *foo_next;
+ * };
+ *
+ * If it turns out that we were wrong, we discard our guesses.
+ *
+ * If we find that a given type in src has no corresponding entry in dst, we
+ * then mark its map as CTF_ERR (-1) to indicate that it has *no* match, as
+ * opposed to the default value of 0, which indicates an unknown match.
+ * Once we've done the first iteration through src, we know at that point in
+ * time whether everything in dst is similar or not and can simply walk over it
+ * and don't have to do any additional checks.
+ */
+
+#include <libctf.h>
+#include <ctf_impl.h>
+#include <sys/debug.h>
+
+typedef struct ctf_diff_func {
+	const char *cdf_name;
+	ulong_t cdf_symidx;
+	ulong_t cdf_matchidx;
+} ctf_diff_func_t;
+
+typedef struct ctf_diff_obj {
+	const char *cdo_name;
+	ulong_t cdo_symidx;
+	ctf_id_t cdo_id;
+	ulong_t cdo_matchidx;
+} ctf_diff_obj_t;
+
+typedef struct ctf_diff_guess {
+	struct ctf_diff_guess *cdg_next;
+	ctf_id_t cdg_iid;
+	ctf_id_t cdg_oid;
+} ctf_diff_guess_t;
+
+/* typedef in libctf.h */
+struct ctf_diff {
+	uint_t cds_flags;
+	boolean_t cds_tvalid;	/* types valid */
+	ctf_file_t *cds_ifp;
+	ctf_file_t *cds_ofp;
+	ctf_id_t *cds_forward;
+	ctf_id_t *cds_reverse;
+	size_t cds_fsize;
+	size_t cds_rsize;
+	ctf_diff_type_f cds_func;
+	ctf_diff_guess_t *cds_guess;
+	void *cds_arg;
+	uint_t cds_nifuncs;
+	uint_t cds_nofuncs;
+	uint_t cds_nextifunc;
+	uint_t cds_nextofunc;
+	ctf_diff_func_t *cds_ifuncs;
+	ctf_diff_func_t *cds_ofuncs;
+	boolean_t cds_ffillip;
+	boolean_t cds_fvalid;
+	uint_t cds_niobj;
+	uint_t cds_noobj;
+	uint_t cds_nextiobj;
+	uint_t cds_nextoobj;
+	ctf_diff_obj_t *cds_iobj;
+	ctf_diff_obj_t *cds_oobj;
+	boolean_t cds_ofillip;
+	boolean_t cds_ovalid;
+};
+
+#define	TINDEX(tid) (tid - 1)
+
+/*
+ * Team Diff
+ */
+static int ctf_diff_type(ctf_diff_t *, ctf_file_t *, ctf_id_t, ctf_file_t *,
+    ctf_id_t);
+
+static int
+ctf_diff_name(ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp, ctf_id_t oid)
+{
+	const char *iname, *oname;
+	const ctf_type_t *itp, *otp;
+
+	if ((itp = ctf_lookup_by_id(&ifp, iid)) == NULL)
+		return (CTF_ERR);
+
+	if ((otp = ctf_lookup_by_id(&ofp, oid)) == NULL)
+		return (ctf_set_errno(ifp, iid));
+
+	iname = ctf_strptr(ifp, itp->ctt_name);
+	oname = ctf_strptr(ofp, otp->ctt_name);
+
+	if ((iname == NULL || oname == NULL) && (iname != oname))
+		return (B_TRUE);
+
+	/* Two anonymous names are the same */
+	if (iname == NULL && oname == NULL)
+		return (B_FALSE);
+
+	return (strcmp(iname, oname) == 0 ? B_FALSE: B_TRUE);
+}
+
+/*
+ * For floats and ints
+ */
+static int
+ctf_diff_number(ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp, ctf_id_t oid)
+{
+	ctf_encoding_t ien, den;
+
+	if (ctf_type_encoding(ifp, iid, &ien) != 0)
+		return (CTF_ERR);
+
+	if (ctf_type_encoding(ofp, oid, &den) != 0)
+		return (ctf_set_errno(ifp, iid));
+
+	if (bcmp(&ien, &den, sizeof (ctf_encoding_t)) != 0)
+		return (B_TRUE);
+
+	return (B_FALSE);
+}
+
+/*
+ * Two typedefs are equivalent, if after we resolve a chain of typedefs, they
+ * point to equivalent types. This means that if a size_t is defined as follows:
+ *
+ * size_t -> ulong_t -> unsigned long
+ * size_t -> unsigned long
+ *
+ * That we'll ultimately end up treating them the same.
+ */
+static int
+ctf_diff_typedef(ctf_diff_t *cds, ctf_file_t *ifp, ctf_id_t iid,
+    ctf_file_t *ofp, ctf_id_t oid)
+{
+	ctf_id_t iref = CTF_ERR, oref = CTF_ERR;
+
+	while (ctf_type_kind(ifp, iid) == CTF_K_TYPEDEF) {
+		iref = ctf_type_reference(ifp, iid);
+		if (iref == CTF_ERR)
+			return (CTF_ERR);
+		iid = iref;
+	}
+
+	while (ctf_type_kind(ofp, oid) == CTF_K_TYPEDEF) {
+		oref = ctf_type_reference(ofp, oid);
+		if (oref == CTF_ERR)
+			return (CTF_ERR);
+		oid = oref;
+	}
+
+	VERIFY(iref != CTF_ERR && oref != CTF_ERR);
+	return (ctf_diff_type(cds, ifp, iref, ofp, oref));
+}
+
+/*
+ * Two qualifiers are equivalent iff they point to two equivalent types.
+ */
+static int
+ctf_diff_qualifier(ctf_diff_t *cds, ctf_file_t *ifp, ctf_id_t iid,
+    ctf_file_t *ofp, ctf_id_t oid)
+{
+	ctf_id_t iref, oref;
+
+	iref = ctf_type_reference(ifp, iid);
+	if (iref == CTF_ERR)
+		return (CTF_ERR);
+
+	oref = ctf_type_reference(ofp, oid);
+	if (oref == CTF_ERR)
+		return (ctf_set_errno(ifp, ctf_errno(ofp)));
+
+	return (ctf_diff_type(cds, ifp, iref, ofp, oref));
+}
+
+/*
+ * Two arrays are the same iff they have the same type for contents, the same
+ * type for the index, and the same number of elements.
+ */
+static int
+ctf_diff_array(ctf_diff_t *cds, ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp,
+    ctf_id_t oid)
+{
+	int ret;
+	ctf_arinfo_t iar, oar;
+
+	if (ctf_array_info(ifp, iid, &iar) == CTF_ERR)
+		return (CTF_ERR);
+
+	if (ctf_array_info(ofp, oid, &oar) == CTF_ERR)
+		return (ctf_set_errno(ifp, ctf_errno(ofp)));
+
+	ret = ctf_diff_type(cds, ifp, iar.ctr_contents, ofp, oar.ctr_contents);
+	if (ret != B_FALSE)
+		return (ret);
+
+	if (iar.ctr_nelems != oar.ctr_nelems)
+		return (B_TRUE);
+
+	/*
+	 * If we're ignoring integer types names, then we're trying to do a bit
+	 * of a logical diff and we don't really care about the fact that the
+	 * index element might not be the same here, what we care about are the
+	 * number of elements and that they're the same type.
+	 */
+	if ((cds->cds_flags & CTF_DIFF_F_IGNORE_INTNAMES) == 0) {
+		ret = ctf_diff_type(cds, ifp, iar.ctr_index, ofp,
+		    oar.ctr_index);
+		if (ret != B_FALSE)
+			return (ret);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * Two function pointers are the same if the following is all true:
+ *
+ *   o They have the same return type
+ *   o They have the same number of arguments
+ *   o The arguments are of the same type
+ *   o They have the same flags
+ */
+static int
+ctf_diff_fptr(ctf_diff_t *cds, ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp,
+    ctf_id_t oid)
+{
+	int ret, i;
+	ctf_funcinfo_t ifunc, ofunc;
+	ctf_id_t *iids, *oids;
+
+	if (ctf_func_info_by_id(ifp, iid, &ifunc) == CTF_ERR)
+		return (CTF_ERR);
+
+	if (ctf_func_info_by_id(ofp, oid, &ofunc) == CTF_ERR)
+		return (ctf_set_errno(ifp, ctf_errno(ofp)));
+
+	if (ifunc.ctc_argc != ofunc.ctc_argc)
+		return (B_TRUE);
+
+	if (ifunc.ctc_flags != ofunc.ctc_flags)
+		return (B_TRUE);
+
+	ret = ctf_diff_type(cds, ifp, ifunc.ctc_return, ofp, ofunc.ctc_return);
+	if (ret != B_FALSE)
+		return (ret);
+
+	iids = ctf_alloc(sizeof (ctf_id_t) * ifunc.ctc_argc);
+	if (iids == NULL)
+		return (ctf_set_errno(ifp, ENOMEM));
+
+	oids = ctf_alloc(sizeof (ctf_id_t) * ifunc.ctc_argc);
+	if (oids == NULL) {
+		ctf_free(iids, sizeof (ctf_id_t) * ifunc.ctc_argc);
+		return (ctf_set_errno(ifp, ENOMEM));
+	}
+
+	if (ctf_func_args_by_id(ifp, iid, ifunc.ctc_argc, iids) == CTF_ERR) {
+		ret = CTF_ERR;
+		goto out;
+	}
+
+	if (ctf_func_args_by_id(ofp, oid, ofunc.ctc_argc, oids) == CTF_ERR) {
+		ret = ctf_set_errno(ifp, ctf_errno(ofp));
+		goto out;
+	}
+
+	ret = B_TRUE;
+	for (i = 0; i < ifunc.ctc_argc; i++) {
+		ret = ctf_diff_type(cds, ifp, iids[i], ofp, oids[i]);
+		if (ret != B_FALSE)
+			goto out;
+	}
+	ret = B_FALSE;
+
+out:
+	ctf_free(iids, sizeof (ctf_id_t) * ifunc.ctc_argc);
+	ctf_free(oids, sizeof (ctf_id_t) * ofunc.ctc_argc);
+	return (ret);
+}
+
+/*
+ * Two structures are the same if every member is identical to its corresponding
+ * type, at the same offset, and has the same name, as well as them having the
+ * same overall size.
+ */
+static int
+ctf_diff_struct(ctf_diff_t *cds, ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp,
+    ctf_id_t oid)
+{
+	ctf_file_t *oifp;
+	const ctf_type_t *itp, *otp;
+	ssize_t isize, iincr, osize, oincr;
+	const ctf_member_t *imp, *omp;
+	const ctf_lmember_t *ilmp, *olmp;
+	int n;
+	ctf_diff_guess_t *cdg;
+
+	oifp = ifp;
+
+	if ((itp = ctf_lookup_by_id(&ifp, iid)) == NULL)
+		return (CTF_ERR);
+
+	if ((otp = ctf_lookup_by_id(&ofp, oid)) == NULL)
+		return (ctf_set_errno(oifp, ctf_errno(ofp)));
+
+	if (ctf_type_size(ifp, iid) != ctf_type_size(ofp, oid))
+		return (B_TRUE);
+
+	if (LCTF_INFO_VLEN(ifp, itp->ctt_info) !=
+	    LCTF_INFO_VLEN(ofp, otp->ctt_info))
+		return (B_TRUE);
+
+	(void) ctf_get_ctt_size(ifp, itp, &isize, &iincr);
+	(void) ctf_get_ctt_size(ofp, otp, &osize, &oincr);
+
+	if (ifp->ctf_version == CTF_VERSION_1 || isize < CTF_LSTRUCT_THRESH) {
+		imp = (const ctf_member_t *)((uintptr_t)itp + iincr);
+		ilmp = NULL;
+	} else {
+		imp = NULL;
+		ilmp = (const ctf_lmember_t *)((uintptr_t)itp + iincr);
+	}
+
+	if (ofp->ctf_version == CTF_VERSION_1 || osize < CTF_LSTRUCT_THRESH) {
+		omp = (const ctf_member_t *)((uintptr_t)otp + oincr);
+		olmp = NULL;
+	} else {
+		omp = NULL;
+		olmp = (const ctf_lmember_t *)((uintptr_t)otp + oincr);
+	}
+
+	/*
+	 * Insert our assumption that they're equal for the moment.
+	 */
+	cdg = ctf_alloc(sizeof (ctf_diff_guess_t));
+	if (cdg == NULL)
+		return (ctf_set_errno(ifp, ENOMEM));
+	cdg->cdg_iid = iid;
+	cdg->cdg_oid = oid;
+	cdg->cdg_next = cds->cds_guess;
+	cds->cds_guess = cdg;
+	cds->cds_forward[TINDEX(iid)] = oid;
+	cds->cds_reverse[TINDEX(oid)] = iid;
+
+	for (n = LCTF_INFO_VLEN(ifp, itp->ctt_info); n != 0; n--) {
+		const char *iname, *oname;
+		ulong_t ioff, ooff;
+		ctf_id_t itype, otype;
+		int ret;
+
+		if (imp != NULL) {
+			iname = ctf_strptr(ifp, imp->ctm_name);
+			ioff = imp->ctm_offset;
+			itype = imp->ctm_type;
+		} else {
+			iname = ctf_strptr(ifp, ilmp->ctlm_name);
+			ioff = CTF_LMEM_OFFSET(ilmp);
+			itype = ilmp->ctlm_type;
+		}
+
+		if (omp != NULL) {
+			oname = ctf_strptr(ofp, omp->ctm_name);
+			ooff = omp->ctm_offset;
+			otype = omp->ctm_type;
+		} else {
+			oname = ctf_strptr(ofp, olmp->ctlm_name);
+			ooff = CTF_LMEM_OFFSET(olmp);
+			otype = olmp->ctlm_type;
+		}
+
+		if (ioff != ooff) {
+			return (B_TRUE);
+		}
+		if (strcmp(iname, oname) != 0) {
+			return (B_TRUE);
+		}
+		ret = ctf_diff_type(cds, ifp, itype, ofp, otype);
+		if (ret != B_FALSE) {
+			return (ret);
+		}
+
+		/* Advance our pointers */
+		if (imp != NULL)
+			imp++;
+		if (ilmp != NULL)
+			ilmp++;
+		if (omp != NULL)
+			omp++;
+		if (olmp != NULL)
+			olmp++;
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * Two unions are the same if they have the same set of members. This is similar
+ * to, but slightly different from a struct. The offsets of members don't
+ * matter. However, their is no guarantee of ordering so we have to fall back to
+ * doing an O(N^2) scan.
+ */
+typedef struct ctf_diff_union_member {
+	ctf_diff_t *cdum_cds;
+	ctf_file_t *cdum_fp;
+	ctf_file_t *cdum_iterfp;
+	const char *cdum_name;
+	ctf_id_t cdum_type;
+	int cdum_ret;
+} ctf_diff_union_member_t;
+
+typedef struct ctf_diff_union_fp {
+	ctf_diff_t *cduf_cds;
+	ctf_file_t *cduf_curfp;
+	ctf_file_t *cduf_altfp;
+	ctf_id_t cduf_type;
+	int cduf_ret;
+} ctf_diff_union_fp_t;
+
+/* ARGSUSED */
+static int
+ctf_diff_union_check_member(const char *name, ctf_id_t id, ulong_t off,
+    void *arg)
+{
+	int ret;
+	ctf_diff_union_member_t *cdump = arg;
+
+	if (strcmp(name, cdump->cdum_name) != 0)
+		return (0);
+
+	ret = ctf_diff_type(cdump->cdum_cds, cdump->cdum_fp, cdump->cdum_type,
+	    cdump->cdum_iterfp, id);
+	if (ret == CTF_ERR) {
+		cdump->cdum_ret = CTF_ERR;
+		return (1);
+	}
+
+	if (ret == B_FALSE) {
+		cdump->cdum_ret = B_FALSE;
+		/* Return non-zero to stop iteration as we have a match */
+		return (1);
+	}
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ctf_diff_union_check_fp(const char *name, ctf_id_t id, ulong_t off, void *arg)
+{
+	int ret;
+	ctf_diff_union_member_t cdum;
+	ctf_diff_union_fp_t *cdufp = arg;
+
+	cdum.cdum_cds = cdufp->cduf_cds;
+	cdum.cdum_fp = cdufp->cduf_curfp;
+	cdum.cdum_iterfp = cdufp->cduf_altfp;
+	cdum.cdum_name = name;
+	cdum.cdum_type = id;
+	cdum.cdum_ret = B_TRUE;
+
+	ret = ctf_member_iter(cdum.cdum_iterfp, cdufp->cduf_type,
+	    ctf_diff_union_check_member, &cdum);
+	if (ret == 0 || cdum.cdum_ret == CTF_ERR) {
+		/* No match found or error, terminate now */
+		cdufp->cduf_ret = cdum.cdum_ret;
+		return (1);
+	} else if (ret == CTF_ERR) {
+		(void) ctf_set_errno(cdum.cdum_fp, ctf_errno(cdum.cdum_iterfp));
+		cdufp->cduf_ret = CTF_ERR;
+		return (1);
+	} else {
+		ASSERT(cdum.cdum_ret == B_FALSE);
+		cdufp->cduf_ret = cdum.cdum_ret;
+		return (0);
+	}
+}
+
+static int
+ctf_diff_union(ctf_diff_t *cds, ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp,
+    ctf_id_t oid)
+{
+	ctf_file_t *oifp;
+	const ctf_type_t *itp, *otp;
+	ctf_diff_union_fp_t cduf;
+	ctf_diff_guess_t *cdg;
+	int ret;
+
+	oifp = ifp;
+	if ((itp = ctf_lookup_by_id(&ifp, iid)) == NULL)
+		return (CTF_ERR);
+	if ((otp = ctf_lookup_by_id(&ofp, oid)) == NULL)
+		return (ctf_set_errno(oifp, ctf_errno(ofp)));
+
+	if (LCTF_INFO_VLEN(ifp, itp->ctt_info) !=
+	    LCTF_INFO_VLEN(ofp, otp->ctt_info))
+		return (B_TRUE);
+
+	cdg = ctf_alloc(sizeof (ctf_diff_guess_t));
+	if (cdg == NULL)
+		return (ctf_set_errno(ifp, ENOMEM));
+	cdg->cdg_iid = iid;
+	cdg->cdg_oid = oid;
+	cdg->cdg_next = cds->cds_guess;
+	cds->cds_guess = cdg;
+	cds->cds_forward[TINDEX(iid)] = oid;
+	cds->cds_reverse[TINDEX(oid)] = iid;
+
+	cduf.cduf_cds = cds;
+	cduf.cduf_curfp = ifp;
+	cduf.cduf_altfp = ofp;
+	cduf.cduf_type = oid;
+	cduf.cduf_ret = B_TRUE;
+	ret = ctf_member_iter(ifp, iid, ctf_diff_union_check_fp, &cduf);
+	if (ret != CTF_ERR)
+		ret = cduf.cduf_ret;
+
+	return (ret);
+}
+
+/*
+ * Two enums are equivalent if they share the same underlying type and they have
+ * the same set of members.
+ */
+static int
+ctf_diff_enum(ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp, ctf_id_t oid)
+{
+	ctf_file_t *oifp;
+	const ctf_type_t *itp, *otp;
+	ssize_t iincr, oincr;
+	const ctf_enum_t *iep, *oep;
+	int n;
+
+	oifp = ifp;
+	if ((itp = ctf_lookup_by_id(&ifp, iid)) == NULL)
+		return (CTF_ERR);
+	if ((otp = ctf_lookup_by_id(&ofp, oid)) == NULL)
+		return (ctf_set_errno(oifp, ctf_errno(ofp)));
+
+	if (LCTF_INFO_VLEN(ifp, itp->ctt_info) !=
+	    LCTF_INFO_VLEN(ofp, otp->ctt_info))
+		return (B_TRUE);
+
+	(void) ctf_get_ctt_size(ifp, itp, NULL, &iincr);
+	(void) ctf_get_ctt_size(ofp, otp, NULL, &oincr);
+	iep = (const ctf_enum_t *)((uintptr_t)itp + iincr);
+	oep = (const ctf_enum_t *)((uintptr_t)otp + oincr);
+
+	for (n = LCTF_INFO_VLEN(ifp, itp->ctt_info); n != 0;
+	    n--, iep++, oep++) {
+		if (strcmp(ctf_strptr(ifp, iep->cte_name),
+		    ctf_strptr(ofp, oep->cte_name)) != 0)
+			return (B_TRUE);
+
+		if (iep->cte_value != oep->cte_value)
+			return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * Two forwards are equivalent in one of two cases. If both are forwards, than
+ * they are the same. Otherwise, they're equivalent if one is a struct or union
+ * and the other is a forward.
+ */
+static int
+ctf_diff_forward(ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp, ctf_id_t oid)
+{
+	int ikind, okind;
+
+	ikind = ctf_type_kind(ifp, iid);
+	okind = ctf_type_kind(ofp, oid);
+
+	if (ikind == okind) {
+		ASSERT(ikind == CTF_K_FORWARD);
+		return (B_FALSE);
+	} else if (ikind == CTF_K_FORWARD) {
+		return (okind != CTF_K_UNION && okind != CTF_K_STRUCT);
+	} else {
+		return (ikind != CTF_K_UNION && ikind != CTF_K_STRUCT);
+	}
+}
+
+/*
+ * Are two types equivalent?
+ */
+int
+ctf_diff_type(ctf_diff_t *cds, ctf_file_t *ifp, ctf_id_t iid, ctf_file_t *ofp,
+    ctf_id_t oid)
+{
+	int ret, ikind, okind;
+
+	/* Do a quick short circuit */
+	if (ifp == ofp && iid == oid)
+		return (B_FALSE);
+
+	/*
+	 * Check if it's something we've already encountered in a forward
+	 * reference or forward negative table. Also double check the reverse
+	 * table.
+	 */
+	if (cds->cds_forward[TINDEX(iid)] == oid)
+		return (B_FALSE);
+	if (cds->cds_forward[TINDEX(iid)] != 0)
+		return (B_TRUE);
+	if (cds->cds_reverse[TINDEX(oid)] == iid)
+		return (B_FALSE);
+	if ((cds->cds_flags & CTF_DIFF_F_IGNORE_INTNAMES) == 0 &&
+	    cds->cds_reverse[TINDEX(oid)] != 0)
+		return (B_TRUE);
+
+	ikind = ctf_type_kind(ifp, iid);
+	okind = ctf_type_kind(ofp, oid);
+
+	if (ikind != okind &&
+	    ikind != CTF_K_FORWARD && okind != CTF_K_FORWARD)
+			return (B_TRUE);
+
+	/* Check names */
+	if ((ret = ctf_diff_name(ifp, iid, ofp, oid)) != B_FALSE) {
+		if (ikind != okind || ikind != CTF_K_INTEGER ||
+		    (cds->cds_flags & CTF_DIFF_F_IGNORE_INTNAMES) == 0)
+			return (ret);
+	}
+
+	if (ikind == CTF_K_FORWARD || okind == CTF_K_FORWARD)
+		return (ctf_diff_forward(ifp, iid, ofp, oid));
+
+	switch (ikind) {
+	case CTF_K_INTEGER:
+	case CTF_K_FLOAT:
+		ret = ctf_diff_number(ifp, iid, ofp, oid);
+		break;
+	case CTF_K_ARRAY:
+		ret = ctf_diff_array(cds, ifp, iid, ofp, oid);
+		break;
+	case CTF_K_FUNCTION:
+		ret = ctf_diff_fptr(cds, ifp, iid, ofp, oid);
+		break;
+	case CTF_K_STRUCT:
+		ret = ctf_diff_struct(cds, ifp, iid, ofp, oid);
+		break;
+	case CTF_K_UNION:
+		ret = ctf_diff_union(cds, ifp, iid, ofp, oid);
+		break;
+	case CTF_K_ENUM:
+		ret = ctf_diff_enum(ifp, iid, ofp, oid);
+		break;
+	case CTF_K_FORWARD:
+		ret = ctf_diff_forward(ifp, iid, ofp, oid);
+		break;
+	case CTF_K_TYPEDEF:
+		ret = ctf_diff_typedef(cds, ifp, iid, ofp, oid);
+		break;
+	case CTF_K_POINTER:
+	case CTF_K_VOLATILE:
+	case CTF_K_CONST:
+	case CTF_K_RESTRICT:
+		ret = ctf_diff_qualifier(cds, ifp, iid, ofp, oid);
+		break;
+	case CTF_K_UNKNOWN:
+		/*
+		 * The current CTF tools use CTF_K_UNKNOWN as a padding type. We
+		 * always declare two instances of CTF_K_UNKNOWN as different,
+		 * even though this leads to additional diff noise.
+		 */
+		ret = B_TRUE;
+		break;
+	default:
+		abort();
+	}
+
+	return (ret);
+}
+
+/*
+ * Walk every type in the first container and try to find a match in the second.
+ * If there is a match, then update both the forward and reverse mapping tables.
+ *
+ * The self variable tells us whether or not we should be comparing the input
+ * ctf container with itself or not.
+ */
+static int
+ctf_diff_pass1(ctf_diff_t *cds, boolean_t self)
+{
+	int i, j, diff;
+	int istart, iend, jstart, jend;
+
+	if (cds->cds_ifp->ctf_flags & LCTF_CHILD) {
+		istart = 0x8001;
+		iend = cds->cds_ifp->ctf_typemax + 0x8000;
+	} else {
+		istart = 1;
+		iend = cds->cds_ifp->ctf_typemax;
+	}
+
+	if (cds->cds_ofp->ctf_flags & LCTF_CHILD) {
+		jstart = 0x8001;
+		jend = cds->cds_ofp->ctf_typemax + 0x8000;
+	} else {
+		jstart = 1;
+		jend = cds->cds_ofp->ctf_typemax;
+	}
+
+	for (i = istart; i <= iend; i++) {
+		diff = B_TRUE;
+
+		/*
+		 * If we're doing a self diff for dedup purposes, then we want
+		 * to ensure that we compare a type i with every type in the
+		 * range, [ 1, i ). Yes, this does mean that when i equals 1,
+		 * we won't compare anything.
+		 */
+		if (self == B_TRUE) {
+			jstart = istart;
+			jend = i - 1;
+		}
+		for (j = jstart; j <= jend; j++) {
+			ctf_diff_guess_t *cdg, *tofree;
+
+			ASSERT(cds->cds_guess == NULL);
+			diff = ctf_diff_type(cds, cds->cds_ifp, i,
+			    cds->cds_ofp, j);
+			if (diff == CTF_ERR)
+				return (CTF_ERR);
+
+			/* Clean up our guesses */
+			cdg = cds->cds_guess;
+			cds->cds_guess = NULL;
+			while (cdg != NULL) {
+				if (diff == B_TRUE) {
+					cds->cds_forward[TINDEX(cdg->cdg_iid)] =
+					    0;
+					cds->cds_reverse[TINDEX(cdg->cdg_oid)] =
+					    0;
+				}
+				tofree = cdg;
+				cdg = cdg->cdg_next;
+				ctf_free(tofree, sizeof (ctf_diff_guess_t));
+			}
+
+			/* Found a hit, update the tables */
+			if (diff == B_FALSE) {
+				cds->cds_forward[TINDEX(i)] = j;
+				if (cds->cds_reverse[TINDEX(j)] == 0)
+					cds->cds_reverse[TINDEX(j)] = i;
+				break;
+			}
+		}
+
+		/* Call the callback at this point */
+		if (diff == B_TRUE) {
+			cds->cds_forward[TINDEX(i)] = CTF_ERR;
+			cds->cds_func(cds->cds_ifp, i, B_FALSE, NULL, CTF_ERR,
+			    cds->cds_arg);
+		} else {
+			cds->cds_func(cds->cds_ifp, i, B_TRUE, cds->cds_ofp, j,
+			    cds->cds_arg);
+		}
+	}
+
+	return (0);
+}
+
+/*
+ * Now we need to walk the second container and emit anything that we didn't
+ * find as common in the first pass.
+ */
+static int
+ctf_diff_pass2(ctf_diff_t *cds)
+{
+	int i, start, end;
+
+	start = 0x1;
+	end = cds->cds_ofp->ctf_typemax;
+	if (cds->cds_ofp->ctf_flags & LCTF_CHILD) {
+		start += 0x8000;
+		end += 0x8000;
+	}
+
+	for (i = start; i <= end; i++) {
+		if (cds->cds_reverse[TINDEX(i)] != 0)
+			continue;
+		cds->cds_func(cds->cds_ofp, i, B_FALSE, NULL, CTF_ERR,
+		    cds->cds_arg);
+	}
+
+	return (0);
+}
+
+int
+ctf_diff_init(ctf_file_t *ifp, ctf_file_t *ofp, ctf_diff_t **cdsp)
+{
+	ctf_diff_t *cds;
+	size_t fsize, rsize;
+
+	cds = ctf_alloc(sizeof (ctf_diff_t));
+	if (cds == NULL)
+		return (ctf_set_errno(ifp, ENOMEM));
+
+	bzero(cds, sizeof (ctf_diff_t));
+	cds->cds_ifp = ifp;
+	cds->cds_ofp = ofp;
+
+	fsize = sizeof (ctf_id_t) * ifp->ctf_typemax;
+	rsize = sizeof (ctf_id_t) * ofp->ctf_typemax;
+	if (ifp->ctf_flags & LCTF_CHILD)
+		fsize += 0x8000 * sizeof (ctf_id_t);
+	if (ofp->ctf_flags & LCTF_CHILD)
+		rsize += 0x8000 * sizeof (ctf_id_t);
+
+	cds->cds_forward = ctf_alloc(fsize);
+	if (cds->cds_forward == NULL) {
+		ctf_free(cds, sizeof (ctf_diff_t));
+		return (ctf_set_errno(ifp, ENOMEM));
+	}
+	cds->cds_fsize = fsize;
+	cds->cds_reverse = ctf_alloc(rsize);
+	if (cds->cds_reverse == NULL) {
+		ctf_free(cds->cds_forward, fsize);
+		ctf_free(cds, sizeof (ctf_diff_t));
+		return (ctf_set_errno(ifp, ENOMEM));
+	}
+	cds->cds_rsize = rsize;
+	bzero(cds->cds_forward, fsize);
+	bzero(cds->cds_reverse, rsize);
+
+	cds->cds_ifp->ctf_refcnt++;
+	cds->cds_ofp->ctf_refcnt++;
+	*cdsp = cds;
+	return (0);
+}
+
+int
+ctf_diff_types(ctf_diff_t *cds, ctf_diff_type_f cb, void *arg)
+{
+	int ret;
+
+	cds->cds_func = cb;
+	cds->cds_arg = arg;
+
+	ret = ctf_diff_pass1(cds, B_FALSE);
+	if (ret == 0)
+		ret = ctf_diff_pass2(cds);
+
+	cds->cds_func = NULL;
+	cds->cds_arg = NULL;
+	cds->cds_tvalid = B_TRUE;
+	return (ret);
+}
+
+/*
+ * Do a diff where we're comparing a container with itself. In other words we'd
+ * like to know what types are actually duplicates of existing types in the
+ * container.
+ *
+ * Note this should remain private to libctf and not be exported in the public
+ * mapfile for the time being.
+ */
+int
+ctf_diff_self(ctf_diff_t *cds, ctf_diff_type_f cb, void *arg)
+{
+	if (cds->cds_ifp != cds->cds_ofp)
+		return (EINVAL);
+
+	cds->cds_func = cb;
+	cds->cds_arg = arg;
+
+	return (ctf_diff_pass1(cds, B_TRUE));
+}
+
+
+void
+ctf_diff_fini(ctf_diff_t *cds)
+{
+	ctf_diff_guess_t *cdg;
+	size_t fsize, rsize;
+
+	if (cds == NULL)
+		return;
+
+	cds->cds_ifp->ctf_refcnt--;
+	cds->cds_ofp->ctf_refcnt--;
+
+	fsize = sizeof (ctf_id_t) * cds->cds_ifp->ctf_typemax;
+	rsize = sizeof (ctf_id_t) * cds->cds_ofp->ctf_typemax;
+	if (cds->cds_ifp->ctf_flags & LCTF_CHILD)
+		fsize += 0x8000 * sizeof (ctf_id_t);
+	if (cds->cds_ofp->ctf_flags & LCTF_CHILD)
+		rsize += 0x8000 * sizeof (ctf_id_t);
+
+	if (cds->cds_ifuncs != NULL)
+		ctf_free(cds->cds_ifuncs,
+		    sizeof (ctf_diff_func_t) * cds->cds_nifuncs);
+	if (cds->cds_ofuncs != NULL)
+		ctf_free(cds->cds_ofuncs,
+		    sizeof (ctf_diff_func_t) * cds->cds_nofuncs);
+	if (cds->cds_iobj != NULL)
+		ctf_free(cds->cds_iobj,
+		    sizeof (ctf_diff_obj_t) * cds->cds_niobj);
+	if (cds->cds_oobj != NULL)
+		ctf_free(cds->cds_oobj,
+		    sizeof (ctf_diff_obj_t) * cds->cds_noobj);
+	cdg = cds->cds_guess;
+	while (cdg != NULL) {
+		ctf_diff_guess_t *tofree = cdg;
+		cdg = cdg->cdg_next;
+		ctf_free(tofree, sizeof (ctf_diff_guess_t));
+	}
+	if (cds->cds_forward != NULL)
+		ctf_free(cds->cds_forward, cds->cds_fsize);
+	if (cds->cds_reverse != NULL)
+		ctf_free(cds->cds_reverse, cds->cds_rsize);
+	ctf_free(cds, sizeof (ctf_diff_t));
+}
+
+uint_t
+ctf_diff_getflags(ctf_diff_t *cds)
+{
+	return (cds->cds_flags);
+}
+
+int
+ctf_diff_setflags(ctf_diff_t *cds, uint_t flags)
+{
+	if ((flags & ~CTF_DIFF_F_IGNORE_INTNAMES) != 0)
+		return (ctf_set_errno(cds->cds_ifp, EINVAL));
+
+	cds->cds_flags = flags;
+	return (0);
+}
+
+static boolean_t
+ctf_diff_symid(ctf_diff_t *cds, ctf_id_t iid, ctf_id_t oid)
+{
+	ctf_file_t *ifp, *ofp;
+
+	ifp = cds->cds_ifp;
+	ofp = cds->cds_ofp;
+
+	/*
+	 * If we have parent containers on the scene here, we need to go through
+	 * and do a full diff check because while a diff for types will not
+	 * actually go through and check types in the parent container.
+	 */
+	if (iid == 0 || oid == 0)
+		return (iid == oid ? B_FALSE: B_TRUE);
+
+	if (!(ifp->ctf_flags & LCTF_CHILD) && !(ofp->ctf_flags & LCTF_CHILD)) {
+		if (cds->cds_forward[TINDEX(iid)] != oid)
+			return (B_TRUE);
+		return (B_FALSE);
+	}
+
+	return (ctf_diff_type(cds, ifp, iid, ofp, oid));
+}
+
+/* ARGSUSED */
+static void
+ctf_diff_void_cb(ctf_file_t *ifp, ctf_id_t iid, boolean_t same, ctf_file_t *ofp,
+    ctf_id_t oid, void *arg)
+{
+}
+
+/* ARGSUSED */
+static int
+ctf_diff_func_count(const char *name, ulong_t symidx, ctf_funcinfo_t *fip,
+    void *arg)
+{
+	uint32_t *ip = arg;
+
+	*ip = *ip + 1;
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ctf_diff_func_fill_cb(const char *name, ulong_t symidx, ctf_funcinfo_t *fip,
+    void *arg)
+{
+	uint_t *next, max;
+	ctf_diff_func_t *funcptr;
+	ctf_diff_t *cds = arg;
+
+	if (cds->cds_ffillip == B_TRUE) {
+		max = cds->cds_nifuncs;
+		next = &cds->cds_nextifunc;
+		funcptr = cds->cds_ifuncs + *next;
+	} else {
+		max = cds->cds_nofuncs;
+		next = &cds->cds_nextofunc;
+		funcptr = cds->cds_ofuncs + *next;
+
+	}
+
+	VERIFY(*next < max);
+	funcptr->cdf_name = name;
+	funcptr->cdf_symidx = symidx;
+	funcptr->cdf_matchidx = ULONG_MAX;
+	*next = *next + 1;
+
+	return (0);
+}
+
+int
+ctf_diff_func_fill(ctf_diff_t *cds)
+{
+	int ret;
+	uint32_t ifcount, ofcount, idcnt, cti;
+	ulong_t i, j;
+	ctf_id_t *iids, *oids;
+
+	ifcount = 0;
+	ofcount = 0;
+	idcnt = 0;
+	iids = NULL;
+	oids = NULL;
+
+	ret = ctf_function_iter(cds->cds_ifp, ctf_diff_func_count, &ifcount);
+	if (ret != 0)
+		return (ret);
+	ret = ctf_function_iter(cds->cds_ofp, ctf_diff_func_count, &ofcount);
+	if (ret != 0)
+		return (ret);
+
+	cds->cds_ifuncs = ctf_alloc(sizeof (ctf_diff_func_t) * ifcount);
+	if (cds->cds_ifuncs == NULL)
+		return (ctf_set_errno(cds->cds_ifp, ENOMEM));
+
+	cds->cds_nifuncs = ifcount;
+	cds->cds_nextifunc = 0;
+
+	cds->cds_ofuncs = ctf_alloc(sizeof (ctf_diff_func_t) * ofcount);
+	if (cds->cds_ofuncs == NULL)
+		return (ctf_set_errno(cds->cds_ifp, ENOMEM));
+
+	cds->cds_nofuncs = ofcount;
+	cds->cds_nextofunc = 0;
+
+	cds->cds_ffillip = B_TRUE;
+	if ((ret = ctf_function_iter(cds->cds_ifp, ctf_diff_func_fill_cb,
+	    cds)) != 0)
+		return (ret);
+
+	cds->cds_ffillip = B_FALSE;
+	if ((ret = ctf_function_iter(cds->cds_ofp, ctf_diff_func_fill_cb,
+	    cds)) != 0)
+		return (ret);
+
+	/*
+	 * Everything is initialized to not match. This could probably be faster
+	 * with something that used a hash. But this part of the diff isn't used
+	 * by merge.
+	 */
+	for (i = 0; i < cds->cds_nifuncs; i++) {
+		for (j = 0; j < cds->cds_nofuncs; j++) {
+			ctf_diff_func_t *ifd, *ofd;
+			ctf_funcinfo_t ifip, ofip;
+			boolean_t match;
+
+			ifd = &cds->cds_ifuncs[i];
+			ofd = &cds->cds_ofuncs[j];
+			if (strcmp(ifd->cdf_name, ofd->cdf_name) != 0)
+				continue;
+
+			ret = ctf_func_info(cds->cds_ifp, ifd->cdf_symidx,
+			    &ifip);
+			if (ret != 0)
+				goto out;
+			ret = ctf_func_info(cds->cds_ofp, ofd->cdf_symidx,
+			    &ofip);
+			if (ret != 0) {
+				ret = ctf_set_errno(cds->cds_ifp,
+				    ctf_errno(cds->cds_ofp));
+				goto out;
+			}
+
+			if (ifip.ctc_argc != ofip.ctc_argc &&
+			    ifip.ctc_flags != ofip.ctc_flags)
+				continue;
+
+			/* Validate return type and arguments are the same */
+			if (ctf_diff_symid(cds, ifip.ctc_return,
+			    ofip.ctc_return))
+				continue;
+
+			if (ifip.ctc_argc > idcnt) {
+				if (iids != NULL)
+					ctf_free(iids,
+					    sizeof (ctf_id_t) * idcnt);
+				if (oids != NULL)
+					ctf_free(oids,
+					    sizeof (ctf_id_t) * idcnt);
+				iids = oids = NULL;
+				idcnt = ifip.ctc_argc;
+				iids = ctf_alloc(sizeof (ctf_id_t) * idcnt);
+				if (iids == NULL) {
+					ret = ctf_set_errno(cds->cds_ifp,
+					    ENOMEM);
+					goto out;
+				}
+				oids = ctf_alloc(sizeof (ctf_id_t) * idcnt);
+				if (iids == NULL) {
+					ret = ctf_set_errno(cds->cds_ifp,
+					    ENOMEM);
+					goto out;
+				}
+			}
+
+			if ((ret = ctf_func_args(cds->cds_ifp, ifd->cdf_symidx,
+			    ifip.ctc_argc, iids)) != 0)
+				goto out;
+			if ((ret = ctf_func_args(cds->cds_ofp, ofd->cdf_symidx,
+			    ofip.ctc_argc, oids)) != 0)
+				goto out;
+
+			match = B_TRUE;
+			for (cti = 0; cti < ifip.ctc_argc; cti++) {
+				if (ctf_diff_symid(cds, iids[cti], oids[cti])) {
+					match = B_FALSE;
+					break;
+				}
+			}
+
+			if (match == B_FALSE)
+				continue;
+
+			ifd->cdf_matchidx = j;
+			ofd->cdf_matchidx = i;
+			break;
+		}
+	}
+
+	ret = 0;
+
+out:
+	if (iids != NULL)
+		ctf_free(iids, sizeof (ctf_id_t) * idcnt);
+	if (oids != NULL)
+		ctf_free(oids, sizeof (ctf_id_t) * idcnt);
+
+	return (ret);
+}
+
+/*
+ * In general, two functions are the same, if they have the same name and their
+ * arguments have the same types, including the return type. Like types, we
+ * basically have to do this in two passes. In the first phase we walk every
+ * type in the first container and try to find a match in the second.
+ */
+int
+ctf_diff_functions(ctf_diff_t *cds, ctf_diff_func_f cb, void *arg)
+{
+	int ret;
+	ulong_t i;
+
+	if (cds->cds_tvalid == B_FALSE) {
+		if ((ret = ctf_diff_types(cds, ctf_diff_void_cb, NULL)) != 0)
+			return (ret);
+	}
+
+	if (cds->cds_fvalid == B_FALSE) {
+		if ((ret = ctf_diff_func_fill(cds)) != 0)
+			return (ret);
+		cds->cds_fvalid = B_TRUE;
+	}
+
+	for (i = 0; i < cds->cds_nifuncs; i++) {
+		if (cds->cds_ifuncs[i].cdf_matchidx == ULONG_MAX) {
+			cb(cds->cds_ifp, cds->cds_ifuncs[i].cdf_symidx,
+			    B_FALSE, NULL, ULONG_MAX, arg);
+		} else {
+			ulong_t idx = cds->cds_ifuncs[i].cdf_matchidx;
+			cb(cds->cds_ifp, cds->cds_ifuncs[i].cdf_symidx, B_TRUE,
+			    cds->cds_ofp, cds->cds_ofuncs[idx].cdf_symidx, arg);
+		}
+	}
+
+	for (i = 0; i < cds->cds_nofuncs; i++) {
+		if (cds->cds_ofuncs[i].cdf_matchidx != ULONG_MAX)
+			continue;
+		cb(cds->cds_ofp, cds->cds_ofuncs[i].cdf_symidx, B_FALSE,
+		    NULL, ULONG_MAX, arg);
+	}
+
+	return (0);
+}
+
+static int
+ctf_diff_obj_fill_cb(const char *name, ctf_id_t id, ulong_t symidx, void *arg)
+{
+	uint_t *next, max;
+	ctf_diff_obj_t *objptr;
+	ctf_diff_t *cds = arg;
+
+	if (cds->cds_ofillip == B_TRUE) {
+		max = cds->cds_niobj;
+		next = &cds->cds_nextiobj;
+		objptr = cds->cds_iobj + *next;
+	} else {
+		max = cds->cds_noobj;
+		next = &cds->cds_nextoobj;
+		objptr = cds->cds_oobj+ *next;
+
+	}
+
+	VERIFY(*next < max);
+	objptr->cdo_name = name;
+	objptr->cdo_symidx = symidx;
+	objptr->cdo_id = id;
+	objptr->cdo_matchidx = ULONG_MAX;
+	*next = *next + 1;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ctf_diff_obj_count(const char *name, ctf_id_t id, ulong_t symidx, void *arg)
+{
+	uint32_t *count = arg;
+
+	*count = *count + 1;
+
+	return (0);
+}
+
+
+static int
+ctf_diff_obj_fill(ctf_diff_t *cds)
+{
+	int ret;
+	uint32_t iocount, oocount;
+	ulong_t i, j;
+
+	iocount = 0;
+	oocount = 0;
+
+	ret = ctf_object_iter(cds->cds_ifp, ctf_diff_obj_count, &iocount);
+	if (ret != 0)
+		return (ret);
+
+	ret = ctf_object_iter(cds->cds_ofp, ctf_diff_obj_count, &oocount);
+	if (ret != 0)
+		return (ret);
+
+	cds->cds_iobj = ctf_alloc(sizeof (ctf_diff_obj_t) * iocount);
+	if (cds->cds_iobj == NULL)
+		return (ctf_set_errno(cds->cds_ifp, ENOMEM));
+	cds->cds_niobj = iocount;
+	cds->cds_nextiobj = 0;
+
+	cds->cds_oobj = ctf_alloc(sizeof (ctf_diff_obj_t) * oocount);
+	if (cds->cds_oobj == NULL)
+		return (ctf_set_errno(cds->cds_ifp, ENOMEM));
+	cds->cds_noobj = oocount;
+	cds->cds_nextoobj = 0;
+
+	cds->cds_ofillip = B_TRUE;
+	if ((ret = ctf_object_iter(cds->cds_ifp, ctf_diff_obj_fill_cb,
+	    cds)) != 0)
+		return (ret);
+
+	cds->cds_ofillip = B_FALSE;
+	if ((ret = ctf_object_iter(cds->cds_ofp, ctf_diff_obj_fill_cb,
+	    cds)) != 0)
+		return (ret);
+
+	for (i = 0; i < cds->cds_niobj; i++) {
+		for (j = 0; j < cds->cds_noobj; j++) {
+			ctf_diff_obj_t *id, *od;
+
+			id = &cds->cds_iobj[i];
+			od = &cds->cds_oobj[j];
+
+			if (id->cdo_name == NULL || od->cdo_name == NULL)
+				continue;
+			if (strcmp(id->cdo_name, od->cdo_name) != 0)
+				continue;
+
+			if (ctf_diff_symid(cds, id->cdo_id, od->cdo_id)) {
+				continue;
+			}
+
+			id->cdo_matchidx = j;
+			od->cdo_matchidx = i;
+			break;
+		}
+	}
+
+	return (0);
+}
+
+int
+ctf_diff_objects(ctf_diff_t *cds, ctf_diff_obj_f cb, void *arg)
+{
+	int ret;
+	ulong_t i;
+
+	if (cds->cds_tvalid == B_FALSE) {
+		if ((ret = ctf_diff_types(cds, ctf_diff_void_cb, NULL)) != 0)
+			return (ret);
+	}
+
+	if (cds->cds_ovalid == B_FALSE) {
+		if ((ret = ctf_diff_obj_fill(cds)) != 0)
+			return (ret);
+		cds->cds_ovalid = B_TRUE;
+	}
+
+	for (i = 0; i < cds->cds_niobj; i++) {
+		ctf_diff_obj_t *o = &cds->cds_iobj[i];
+
+		if (cds->cds_iobj[i].cdo_matchidx == ULONG_MAX) {
+			cb(cds->cds_ifp, o->cdo_symidx, o->cdo_id, B_FALSE,
+			    NULL, ULONG_MAX, CTF_ERR, arg);
+		} else {
+			ctf_diff_obj_t *alt = &cds->cds_oobj[o->cdo_matchidx];
+			cb(cds->cds_ifp, o->cdo_symidx, o->cdo_id, B_TRUE,
+			    cds->cds_ofp, alt->cdo_symidx, alt->cdo_id, arg);
+		}
+	}
+
+	for (i = 0; i < cds->cds_noobj; i++) {
+		ctf_diff_obj_t *o = &cds->cds_oobj[i];
+		if (o->cdo_matchidx != ULONG_MAX)
+			continue;
+		cb(cds->cds_ofp, o->cdo_symidx, o->cdo_id, B_FALSE, NULL,
+		    ULONG_MAX, CTF_ERR, arg);
+	}
+
+	return (0);
+}
diff --git a/usr/src/lib/libctf/common/ctf_dwarf.c b/usr/src/lib/libctf/common/ctf_dwarf.c
new file mode 100644
index 0000000000..811a55bc64
--- /dev/null
+++ b/usr/src/lib/libctf/common/ctf_dwarf.c
@@ -0,0 +1,2957 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright 2012 Jason King.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * CTF DWARF conversion theory.
+ *
+ * DWARF data contains a series of compilation units. Each compilation unit
+ * generally refers to an object file or what once was, in the case of linked
+ * binaries and shared objects. Each compilation unit has a series of what DWARF
+ * calls a DIE (Debugging Information Entry). The set of entries that we care
+ * about have type information stored in a series of attributes. Each DIE also
+ * has a tag that identifies the kind of attributes that it has.
+ *
+ * A given DIE may itself have children. For example, a DIE that represents a
+ * structure has children which represent members. Whenever we encounter a DIE
+ * that has children or other values or types associated with it, we recursively
+ * process those children first so that way we can then refer to the generated
+ * CTF type id while processing its parent. This reduces the amount of unknowns
+ * and fixups that we need. It also ensures that we don't accidentally add types
+ * that an overzealous compiler might add to the DWARF data but aren't used by
+ * anything in the system.
+ *
+ * Once we do a conversion, we store a mapping in an AVL tree that goes from the
+ * DWARF's die offset, which is relative to the given compilation unit), to a
+ * ctf_id_t.
+ *
+ * Unfortunately, some compilers actually will emit duplicate entries for a
+ * given type that look similar, but aren't quite. To that end, we go through
+ * and do a variant on a merge once we're done processing a single compilation
+ * unit which deduplicates all of the types that are in the unit.
+ *
+ * Finally, if we encounter an object that has multiple compilation units, then
+ * we'll convert all of the compilation units separately and then do a merge, so
+ * that way we can result in one single ctf_file_t that represents everything
+ * for the object.
+ *
+ * Conversion Steps
+ * ----------------
+ *
+ * Because a given object we've been given to convert may have multiple
+ * compilation units, we break the work into two halves. The first half
+ * processes each compilation unit (potentially in parallel) and then the second
+ * half optionally merges all of the dies in the first half. First, we'll cover
+ * what's involved in converting a single ctf_die_t's dwarf to CTF. This covers
+ * the work done in ctf_dwarf_convert_one().
+ *
+ * An individual ctf_die_t, which represents a compilation unit, is converted to
+ * CTF in a series of multiple passes.
+ *
+ * Pass 1: During the first pass we walk all of the dies and if we find a
+ * function, variable, struct, union, enum or typedef, we recursively transform
+ * all of its types. We don't recurse or process everything, because we don't
+ * want to add some of the types that compilers may add which are effectively
+ * unused.
+ *
+ * During pass 1, if we encounter any structures or unions we mark them for
+ * fixing up later. This is necessary because we may not be able to determine
+ * the full size of a structure at the beginning of time. This will happen if
+ * the DWARF attribute DW_AT_byte_size is not present for a member. Because of
+ * this possibility we defer adding members to structures or even converting
+ * them during pass 1 and save that for pass 2. Adding all of the base
+ * structures without any of their members helps deal with any circular
+ * dependencies that we might encounter.
+ *
+ * Pass 2: This pass is used to do the first half of fixing up structures and
+ * unions. Rather than walk the entire type space again, we actually walk the
+ * list of structures and unions that we marked for later fixing up. Here, we
+ * iterate over every structure and add members to the underlying ctf_file_t,
+ * but not to the structs themselves. One might wonder why we don't, and the
+ * main reason is that libctf requires a ctf_update() be done before adding the
+ * members to structures or unions.
+ *
+ * Pass 3: This pass is used to do the second half of fixing up structures and
+ * unions. During this part we always go through and add members to structures
+ * and unions that we added to the container in the previous pass. In addition,
+ * we set the structure and union's actual size, which may have additional
+ * padding added by the compiler, it isn't simply the last offset. DWARF always
+ * guarantees an attribute exists for this. Importantly no ctf_id_t's change
+ * during pass 2.
+ *
+ * Pass 4: The next phase is to add CTF entries for all of the symbols and
+ * variables that are present in this die. During pass 1 we added entries to a
+ * map for each variable and function. During this pass, we iterate over the
+ * symbol table and when we encounter a symbol that we have in our lists of
+ * translated information which matches, we then add it to the ctf_file_t.
+ *
+ * Pass 5: Here we go and look for any weak symbols and functions and see if
+ * they match anything that we recognize. If so, then we add type information
+ * for them at this point based on the matching type.
+ *
+ * Pass 6: This pass is actually a variant on a merge. The traditional merge
+ * process expects there to be no duplicate types. As such, at the end of
+ * conversion, we do a dedup on all of the types in the system. The
+ * deduplication process is described in lib/libctf/common/ctf_merge.c.
+ *
+ * Once pass 6 is done, we've finished processing the individual compilation
+ * unit.
+ *
+ * The following steps reflect the general process of doing a conversion.
+ *
+ * 1) Walk the dwarf section and determine the number of compilation units
+ * 2) Create a ctf_die_t for each compilation unit
+ * 3) Add all ctf_die_t's to a workq
+ * 4) Have the workq process each die with ctf_dwarf_convert_one. This itself
+ *    is comprised of several steps, which were already enumerated.
+ * 5) If we have multiple dies, we do a ctf merge of all the dies. The mechanics
+ *    of the merge are discussed in lib/libctf/common/ctf_merge.c.
+ * 6) Free everything up and return a ctf_file_t to the user. If we only had a
+ *    single compilation unit, then we give that to the user. Otherwise, we
+ *    return the merged ctf_file_t.
+ *
+ * Threading
+ * ---------
+ *
+ * The process has been designed to be amenable to threading. Each compilation
+ * unit has its own type stream, therefore the logical place to divide and
+ * conquer is at the compilation unit. Each ctf_die_t has been built to be able
+ * to be processed independently of the others. It has its own libdwarf handle,
+ * as a given libdwarf handle may only be used by a single thread at a time.
+ * This allows the various ctf_die_t's to be processed in parallel by different
+ * threads.
+ *
+ * All of the ctf_die_t's are loaded into a workq which allows for a number of
+ * threads to be specified and used as a thread pool to process all of the
+ * queued work. We set the number of threads to use in the workq equal to the
+ * number of threads that the user has specified.
+ *
+ * After all of the compilation units have been drained, we use the same number
+ * of threads when performing a merge of multiple compilation units, if they
+ * exist.
+ *
+ * While all of these different parts do support and allow for multiple threads,
+ * it's important that when only a single thread is specified, that it be the
+ * calling thread. This allows the conversion routines to be used in a context
+ * that doesn't allow additional threads, such as rtld.
+ *
+ * Common DWARF Mechanics and Notes
+ * --------------------------------
+ *
+ * At this time, we really only support DWARFv2, though support for DWARFv4 is
+ * mostly there. There is no intent to support DWARFv3.
+ *
+ * Generally types for something are stored in the DW_AT_type attribute. For
+ * example, a function's return type will be stored in the local DW_AT_type
+ * attribute while the arguments will be in child DIEs. There are also various
+ * times when we don't have any DW_AT_type. In that case, the lack of a type
+ * implies, at least for C, that it's C type is void. Because DWARF doesn't emit
+ * one, we have a synthetic void type that we create and manipulate instead and
+ * pass it off to consumers on an as-needed basis. If nothing has a void type,
+ * it will not be emitted.
+ *
+ * Architecture Specific Parts
+ * ---------------------------
+ *
+ * The CTF tooling encodes various information about the various architectures
+ * in the system. Importantly, the tool assumes that every architecture has a
+ * data model where long and pointer are the same size. This is currently the
+ * case, as the two data models illumos supports are ILP32 and LP64.
+ *
+ * In addition, we encode the mapping of various floating point sizes to various
+ * types for each architecture. If a new architecture is being added, it should
+ * be added to the list. The general design of the ctf conversion tools is to be
+ * architecture independent. eg. any of the tools here should be able to convert
+ * any architecture's DWARF into ctf; however, this has not been rigorously
+ * tested and more importantly, the ctf routines don't currently write out the
+ * data in an endian-aware form, they only use that of the currently running
+ * library.
+ */
+
+#include <libctf_impl.h>
+#include <sys/avl.h>
+#include <sys/debug.h>
+#include <gelf.h>
+#include <libdwarf.h>
+#include <dwarf.h>
+#include <libgen.h>
+#include <workq.h>
+#include <errno.h>
+
+#define	DWARF_VERSION_TWO	2
+#define	DWARF_VARARGS_NAME	"..."
+
+/*
+ * Dwarf may refer recursively to other types that we've already processed. To
+ * see if we've already converted them, we look them up in an AVL tree that's
+ * sorted by the DWARF id.
+ */
+typedef struct ctf_dwmap {
+	avl_node_t	cdm_avl;
+	Dwarf_Off	cdm_off;
+	Dwarf_Die	cdm_die;
+	ctf_id_t	cdm_id;
+	boolean_t	cdm_fix;
+} ctf_dwmap_t;
+
+typedef struct ctf_dwvar {
+	ctf_list_t	cdv_list;
+	char 		*cdv_name;
+	ctf_id_t	cdv_type;
+	boolean_t	cdv_global;
+} ctf_dwvar_t;
+
+typedef struct ctf_dwfunc {
+	ctf_list_t	cdf_list;
+	char		*cdf_name;
+	ctf_funcinfo_t	cdf_fip;
+	ctf_id_t	*cdf_argv;
+	boolean_t	cdf_global;
+} ctf_dwfunc_t;
+
+typedef struct ctf_dwbitf {
+	ctf_list_t	cdb_list;
+	ctf_id_t	cdb_base;
+	uint_t		cdb_nbits;
+	ctf_id_t	cdb_id;
+} ctf_dwbitf_t;
+
+/*
+ * The ctf_die_t represents a single top-level DWARF die unit. While generally,
+ * the typical object file hs only a single die, if we're asked to convert
+ * something that's been linked from multiple sources, multiple dies will exist.
+ */
+typedef struct ctf_die {
+	Elf		*cd_elf;	/* shared libelf handle */
+	char		*cd_name;	/* basename of the DIE */
+	ctf_merge_t	*cd_cmh;	/* merge handle */
+	ctf_list_t	cd_vars;	/* List of variables */
+	ctf_list_t	cd_funcs;	/* List of functions */
+	ctf_list_t	cd_bitfields;	/* Bit field members */
+	Dwarf_Debug	cd_dwarf;	/* shared libdwarf handle */
+	Dwarf_Die	cd_cu;		/* libdwarf compilation unit */
+	Dwarf_Off	cd_cuoff;	/* cu's offset */
+	Dwarf_Off	cd_maxoff;	/* maximum offset */
+	ctf_file_t	*cd_ctfp;	/* output CTF file */
+	avl_tree_t	cd_map;		/* map die offsets to CTF types */
+	char		*cd_errbuf;	/* error message buffer */
+	size_t		cd_errlen;	/* error message buffer length */
+	size_t		cd_ptrsz;	/* object's pointer size */
+	boolean_t	cd_bigend;	/* is it big endian */
+	boolean_t	cd_doweaks;	/* should we convert weak symbols? */
+	uint_t		cd_mach;	/* machine type */
+	ctf_id_t	cd_voidtid;	/* void pointer */
+	ctf_id_t	cd_longtid;	/* id for a 'long' */
+} ctf_die_t;
+
+static int ctf_dwarf_offset(ctf_die_t *, Dwarf_Die, Dwarf_Off *);
+static int ctf_dwarf_convert_die(ctf_die_t *, Dwarf_Die);
+static int ctf_dwarf_convert_type(ctf_die_t *, Dwarf_Die, ctf_id_t *, int);
+
+static int ctf_dwarf_function_count(ctf_die_t *, Dwarf_Die, ctf_funcinfo_t *,
+    boolean_t);
+static int ctf_dwarf_convert_fargs(ctf_die_t *, Dwarf_Die, ctf_funcinfo_t *,
+    ctf_id_t *);
+
+typedef int (ctf_dwarf_symtab_f)(ctf_die_t *, const GElf_Sym *, ulong_t,
+    const char *, const char *, void *);
+
+/*
+ * This is a generic way to set a CTF Conversion backend error depending on what
+ * we were doing. Unless it was one of a specific set of errors that don't
+ * indicate a programming / translation bug, eg. ENOMEM, then we transform it
+ * into a CTF backend error and fill in the error buffer.
+ */
+static int
+ctf_dwarf_error(ctf_die_t *cdp, ctf_file_t *cfp, int err, const char *fmt, ...)
+{
+	va_list ap;
+	int ret;
+	size_t off = 0;
+	ssize_t rem = cdp->cd_errlen;
+	if (cfp != NULL)
+		err = ctf_errno(cfp);
+
+	if (err == ENOMEM)
+		return (err);
+
+	ret = snprintf(cdp->cd_errbuf, rem, "die %s: ", cdp->cd_name);
+	if (ret < 0)
+		goto err;
+	off += ret;
+	rem = MAX(rem - ret, 0);
+
+	va_start(ap, fmt);
+	ret = vsnprintf(cdp->cd_errbuf + off, rem, fmt, ap);
+	va_end(ap);
+	if (ret < 0)
+		goto err;
+
+	off += ret;
+	rem = MAX(rem - ret, 0);
+	if (fmt[strlen(fmt) - 1] != '\n') {
+		(void) snprintf(cdp->cd_errbuf + off, rem,
+		    ": %s\n", ctf_errmsg(err));
+	}
+	va_end(ap);
+	return (ECTF_CONVBKERR);
+
+err:
+	cdp->cd_errbuf[0] = '\0';
+	return (ECTF_CONVBKERR);
+}
+
+/*
+ * DWARF often ops to put no explicit type to describe a void type. eg. if we
+ * have a reference type whose DW_AT_type member doesn't exist, then we should
+ * instead assume it points to void. Because this isn't represented, we
+ * instead cause it to come into existence.
+ */
+static ctf_id_t
+ctf_dwarf_void(ctf_die_t *cdp)
+{
+	if (cdp->cd_voidtid == CTF_ERR) {
+		ctf_encoding_t enc = { CTF_INT_SIGNED, 0, 0 };
+		cdp->cd_voidtid = ctf_add_integer(cdp->cd_ctfp, CTF_ADD_ROOT,
+		    "void", &enc);
+		if (cdp->cd_voidtid == CTF_ERR) {
+			(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+			    "failed to create void type: %s\n",
+			    ctf_errmsg(ctf_errno(cdp->cd_ctfp)));
+		}
+	}
+
+	return (cdp->cd_voidtid);
+}
+
+/*
+ * There are many different forms that an array index may take. However, we just
+ * always force it to be of a type long no matter what. Therefore we use this to
+ * have a single instance of long across everything.
+ */
+static ctf_id_t
+ctf_dwarf_long(ctf_die_t *cdp)
+{
+	if (cdp->cd_longtid == CTF_ERR) {
+		ctf_encoding_t enc;
+
+		enc.cte_format = CTF_INT_SIGNED;
+		enc.cte_offset = 0;
+		/* All illumos systems are LP */
+		enc.cte_bits = cdp->cd_ptrsz * 8;
+		cdp->cd_longtid = ctf_add_integer(cdp->cd_ctfp, CTF_ADD_NONROOT,
+		    "long", &enc);
+		if (cdp->cd_longtid == CTF_ERR) {
+			(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+			    "failed to create long type: %s\n",
+			    ctf_errmsg(ctf_errno(cdp->cd_ctfp)));
+		}
+
+	}
+
+	return (cdp->cd_longtid);
+}
+
+static int
+ctf_dwmap_comp(const void *a, const void *b)
+{
+	const ctf_dwmap_t *ca = a;
+	const ctf_dwmap_t *cb = b;
+
+	if (ca->cdm_off > cb->cdm_off)
+		return (1);
+	if (ca->cdm_off < cb->cdm_off)
+		return (-1);
+	return (0);
+}
+
+static int
+ctf_dwmap_add(ctf_die_t *cdp, ctf_id_t id, Dwarf_Die die, boolean_t fix)
+{
+	int ret;
+	avl_index_t index;
+	ctf_dwmap_t *dwmap;
+	Dwarf_Off off;
+
+	VERIFY(id > 0 && id < CTF_MAX_TYPE);
+
+	if ((ret = ctf_dwarf_offset(cdp, die, &off)) != 0)
+		return (ret);
+
+	if ((dwmap = ctf_alloc(sizeof (ctf_dwmap_t))) == NULL)
+		return (ENOMEM);
+
+	dwmap->cdm_die = die;
+	dwmap->cdm_off = off;
+	dwmap->cdm_id = id;
+	dwmap->cdm_fix = fix;
+
+	ctf_dprintf("dwmap: %p %x->%d\n", dwmap, (uint32_t)off, id);
+	VERIFY(avl_find(&cdp->cd_map, dwmap, &index) == NULL);
+	avl_insert(&cdp->cd_map, dwmap, index);
+	return (0);
+}
+
+static int
+ctf_dwarf_attribute(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half name,
+    Dwarf_Attribute *attrp)
+{
+	int ret;
+	Dwarf_Error derr;
+
+	if ((ret = dwarf_attr(die, name, attrp, &derr)) == DW_DLV_OK)
+		return (0);
+	if (ret == DW_DLV_NO_ENTRY) {
+		*attrp = NULL;
+		return (ENOENT);
+	}
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get attribute for type: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_ref(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half name, Dwarf_Off *refp)
+{
+	int ret;
+	Dwarf_Attribute attr;
+	Dwarf_Error derr;
+
+	if ((ret = ctf_dwarf_attribute(cdp, die, name, &attr)) != 0)
+		return (ret);
+
+	if (dwarf_formref(attr, refp, &derr) == DW_DLV_OK) {
+		dwarf_dealloc(cdp->cd_dwarf, attr, DW_DLA_ATTR);
+		return (0);
+	}
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get unsigned attribute for type: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_refdie(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half name,
+    Dwarf_Die *diep)
+{
+	int ret;
+	Dwarf_Off off;
+	Dwarf_Error derr;
+
+	if ((ret = ctf_dwarf_ref(cdp, die, DW_AT_type, &off)) != 0)
+		return (ret);
+
+	off += cdp->cd_cuoff;
+	if ((ret = dwarf_offdie(cdp->cd_dwarf, off, diep, &derr)) !=
+	    DW_DLV_OK) {
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "failed to get die from offset %llu: %s\n",
+		    off, dwarf_errmsg(derr));
+		return (ECTF_CONVBKERR);
+	}
+
+	return (0);
+}
+
+static int
+ctf_dwarf_signed(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half name,
+    Dwarf_Signed *valp)
+{
+	int ret;
+	Dwarf_Attribute attr;
+	Dwarf_Error derr;
+
+	if ((ret = ctf_dwarf_attribute(cdp, die, name, &attr)) != 0)
+		return (ret);
+
+	if (dwarf_formsdata(attr, valp, &derr) == DW_DLV_OK) {
+		dwarf_dealloc(cdp->cd_dwarf, attr, DW_DLA_ATTR);
+		return (0);
+	}
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get unsigned attribute for type: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_unsigned(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half name,
+    Dwarf_Unsigned *valp)
+{
+	int ret;
+	Dwarf_Attribute attr;
+	Dwarf_Error derr;
+
+	if ((ret = ctf_dwarf_attribute(cdp, die, name, &attr)) != 0)
+		return (ret);
+
+	if (dwarf_formudata(attr, valp, &derr) == DW_DLV_OK) {
+		dwarf_dealloc(cdp->cd_dwarf, attr, DW_DLA_ATTR);
+		return (0);
+	}
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get unsigned attribute for type: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_boolean(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half name,
+    Dwarf_Bool *val)
+{
+	int ret;
+	Dwarf_Attribute attr;
+	Dwarf_Error derr;
+
+	if ((ret = ctf_dwarf_attribute(cdp, die, name, &attr)) != 0)
+		return (ret);
+
+	if (dwarf_formflag(attr, val, &derr) == DW_DLV_OK) {
+		dwarf_dealloc(cdp->cd_dwarf, attr, DW_DLA_ATTR);
+		return (0);
+	}
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get boolean attribute for type: %s\n",
+	    dwarf_errmsg(derr));
+
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_string(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half name, char **strp)
+{
+	int ret;
+	char *s;
+	Dwarf_Attribute attr;
+	Dwarf_Error derr;
+
+	*strp = NULL;
+	if ((ret = ctf_dwarf_attribute(cdp, die, name, &attr)) != 0)
+		return (ret);
+
+	if (dwarf_formstring(attr, &s, &derr) == DW_DLV_OK) {
+		if ((*strp = ctf_strdup(s)) == NULL)
+			ret = ENOMEM;
+		else
+			ret = 0;
+		dwarf_dealloc(cdp->cd_dwarf, attr, DW_DLA_ATTR);
+		return (ret);
+	}
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get string attribute for type: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_member_location(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Unsigned *valp)
+{
+	int ret;
+	Dwarf_Error derr;
+	Dwarf_Attribute attr;
+	Dwarf_Locdesc *loc;
+	Dwarf_Signed locnum;
+
+	if ((ret = ctf_dwarf_attribute(cdp, die, DW_AT_data_member_location,
+	    &attr)) != 0)
+		return (ret);
+
+	if (dwarf_loclist(attr, &loc, &locnum, &derr) != DW_DLV_OK) {
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "failed to obtain location list for member offset: %s",
+		    dwarf_errmsg(derr));
+		dwarf_dealloc(cdp->cd_dwarf, attr, DW_DLA_ATTR);
+		return (ECTF_CONVBKERR);
+	}
+	dwarf_dealloc(cdp->cd_dwarf, attr, DW_DLA_ATTR);
+
+	if (locnum != 1 || loc->ld_s->lr_atom != DW_OP_plus_uconst) {
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "failed to parse location structure for member");
+		dwarf_dealloc(cdp->cd_dwarf, loc->ld_s, DW_DLA_LOC_BLOCK);
+		dwarf_dealloc(cdp->cd_dwarf, loc, DW_DLA_LOCDESC);
+		return (ECTF_CONVBKERR);
+	}
+
+	*valp = loc->ld_s->lr_number;
+
+	dwarf_dealloc(cdp->cd_dwarf, loc->ld_s, DW_DLA_LOC_BLOCK);
+	dwarf_dealloc(cdp->cd_dwarf, loc, DW_DLA_LOCDESC);
+	return (0);
+}
+
+
+static int
+ctf_dwarf_offset(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Off *offsetp)
+{
+	Dwarf_Error derr;
+
+	if (dwarf_dieoffset(die, offsetp, &derr) == DW_DLV_OK)
+		return (0);
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get die offset: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_tag(ctf_die_t *cdp, Dwarf_Die die, Dwarf_Half *tagp)
+{
+	Dwarf_Error derr;
+
+	if (dwarf_tag(die, tagp, &derr) == DW_DLV_OK)
+		return (0);
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to get tag type: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_sib(ctf_die_t *cdp, Dwarf_Die base, Dwarf_Die *sibp)
+{
+	Dwarf_Error derr;
+	int ret;
+
+	*sibp = NULL;
+	ret = dwarf_siblingof(cdp->cd_dwarf, base, sibp, &derr);
+	if (ret == DW_DLV_OK || ret == DW_DLV_NO_ENTRY)
+		return (0);
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to sibling from die: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+static int
+ctf_dwarf_child(ctf_die_t *cdp, Dwarf_Die base, Dwarf_Die *childp)
+{
+	Dwarf_Error derr;
+	int ret;
+
+	*childp = NULL;
+	ret = dwarf_child(base, childp, &derr);
+	if (ret == DW_DLV_OK || ret == DW_DLV_NO_ENTRY)
+		return (0);
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to child from die: %s\n",
+	    dwarf_errmsg(derr));
+	return (ECTF_CONVBKERR);
+}
+
+/*
+ * Compilers disagree on what to do to determine if something has global
+ * visiblity. Traditionally gcc has used DW_AT_external to indicate this while
+ * Studio has used DW_AT_visibility. We check DW_AT_visibility first and then
+ * fall back to DW_AT_external. Lack of DW_AT_external implies that it is not.
+ */
+static int
+ctf_dwarf_isglobal(ctf_die_t *cdp, Dwarf_Die die, boolean_t *igp)
+{
+	int ret;
+	Dwarf_Signed vis;
+	Dwarf_Bool ext;
+
+	if ((ret = ctf_dwarf_signed(cdp, die, DW_AT_visibility, &vis)) == 0) {
+		*igp = vis == DW_VIS_exported;
+		return (0);
+	} else if (ret != ENOENT) {
+		return (ret);
+	}
+
+	if ((ret = ctf_dwarf_boolean(cdp, die, DW_AT_external, &ext)) != 0) {
+		if (ret == ENOENT) {
+			*igp = B_FALSE;
+			return (0);
+		}
+		return (ret);
+	}
+	*igp = ext != 0 ? B_TRUE : B_FALSE;
+	return (0);
+}
+
+static int
+ctf_dwarf_die_elfenc(Elf *elf, ctf_die_t *cdp, char *errbuf, size_t errlen)
+{
+	GElf_Ehdr ehdr;
+
+	if (gelf_getehdr(elf, &ehdr) == NULL) {
+		(void) snprintf(errbuf, errlen,
+		    "failed to get ELF header: %s\n",
+		    elf_errmsg(elf_errno()));
+		return (ECTF_CONVBKERR);
+	}
+
+	cdp->cd_mach = ehdr.e_machine;
+
+	if (ehdr.e_ident[EI_CLASS] == ELFCLASS32) {
+		cdp->cd_ptrsz = 4;
+		VERIFY(ctf_setmodel(cdp->cd_ctfp, CTF_MODEL_ILP32) == 0);
+	} else if (ehdr.e_ident[EI_CLASS] == ELFCLASS64) {
+		cdp->cd_ptrsz = 8;
+		VERIFY(ctf_setmodel(cdp->cd_ctfp, CTF_MODEL_LP64) == 0);
+	} else {
+		(void) snprintf(errbuf, errlen,
+		    "unknown ELF class %d", ehdr.e_ident[EI_CLASS]);
+		return (ECTF_CONVBKERR);
+	}
+
+	if (ehdr.e_ident[EI_DATA] == ELFDATA2LSB) {
+		cdp->cd_bigend = B_FALSE;
+	} else if (ehdr.e_ident[EI_DATA] == ELFDATA2MSB) {
+		cdp->cd_bigend = B_TRUE;
+	} else {
+		(void) snprintf(errbuf, errlen,
+		    "unknown ELF data encoding: %d", ehdr.e_ident[EI_DATA]);
+		return (ECTF_CONVBKERR);
+	}
+
+	return (0);
+}
+
+typedef struct ctf_dwarf_fpent {
+	size_t	cdfe_size;
+	uint_t	cdfe_enc[3];
+} ctf_dwarf_fpent_t;
+
+typedef struct ctf_dwarf_fpmap {
+	uint_t			cdf_mach;
+	ctf_dwarf_fpent_t	cdf_ents[4];
+} ctf_dwarf_fpmap_t;
+
+static const ctf_dwarf_fpmap_t ctf_dwarf_fpmaps[] = {
+	{ EM_SPARC, {
+		{ 4, { CTF_FP_SINGLE, CTF_FP_CPLX, CTF_FP_IMAGRY } },
+		{ 8, { CTF_FP_DOUBLE, CTF_FP_DCPLX, CTF_FP_DIMAGRY } },
+		{ 16, { CTF_FP_LDOUBLE, CTF_FP_LDCPLX, CTF_FP_LDIMAGRY } },
+		{ 0, { 0 } }
+	} },
+	{ EM_SPARC32PLUS, {
+		{ 4, { CTF_FP_SINGLE, CTF_FP_CPLX, CTF_FP_IMAGRY } },
+		{ 8, { CTF_FP_DOUBLE, CTF_FP_DCPLX, CTF_FP_DIMAGRY } },
+		{ 16, { CTF_FP_LDOUBLE, CTF_FP_LDCPLX, CTF_FP_LDIMAGRY } },
+		{ 0, { 0 } }
+	} },
+	{ EM_SPARCV9, {
+		{ 4, { CTF_FP_SINGLE, CTF_FP_CPLX, CTF_FP_IMAGRY } },
+		{ 8, { CTF_FP_DOUBLE, CTF_FP_DCPLX, CTF_FP_DIMAGRY } },
+		{ 16, { CTF_FP_LDOUBLE, CTF_FP_LDCPLX, CTF_FP_LDIMAGRY } },
+		{ 0, { 0 } }
+	} },
+	{ EM_386, {
+		{ 4, { CTF_FP_SINGLE, CTF_FP_CPLX, CTF_FP_IMAGRY } },
+		{ 8, { CTF_FP_DOUBLE, CTF_FP_DCPLX, CTF_FP_DIMAGRY } },
+		{ 12, { CTF_FP_LDOUBLE, CTF_FP_LDCPLX, CTF_FP_LDIMAGRY } },
+		{ 0, { 0 } }
+	} },
+	{ EM_X86_64, {
+		{ 4, { CTF_FP_SINGLE, CTF_FP_CPLX, CTF_FP_IMAGRY } },
+		{ 8, { CTF_FP_DOUBLE, CTF_FP_DCPLX, CTF_FP_DIMAGRY } },
+		{ 16, { CTF_FP_LDOUBLE, CTF_FP_LDCPLX, CTF_FP_LDIMAGRY } },
+		{ 0, { 0 } }
+	} },
+	{ EM_NONE }
+};
+
+static int
+ctf_dwarf_float_base(ctf_die_t *cdp, Dwarf_Signed type, ctf_encoding_t *enc)
+{
+	const ctf_dwarf_fpmap_t *map = &ctf_dwarf_fpmaps[0];
+	const ctf_dwarf_fpent_t *ent;
+	uint_t col = 0, mult = 1;
+
+	for (map = &ctf_dwarf_fpmaps[0]; map->cdf_mach != EM_NONE; map++) {
+		if (map->cdf_mach == cdp->cd_mach)
+			break;
+	}
+
+	if (map->cdf_mach == EM_NONE) {
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "Unsupported machine type: %d\n", cdp->cd_mach);
+		return (ENOTSUP);
+	}
+
+	if (type == DW_ATE_complex_float) {
+		mult = 2;
+		col = 1;
+	} else if (type == DW_ATE_imaginary_float ||
+	    type == DW_ATE_SUN_imaginary_float) {
+		col = 2;
+	}
+
+	ent = &map->cdf_ents[0];
+	for (ent = &map->cdf_ents[0]; ent->cdfe_size != 0; ent++) {
+		if (ent->cdfe_size * mult * 8 == enc->cte_bits) {
+			enc->cte_format = ent->cdfe_enc[col];
+			return (0);
+		}
+	}
+
+	(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+	    "failed to find valid fp mapping for encoding %d, size %d bits\n",
+	    type, enc->cte_bits);
+	return (EINVAL);
+}
+
+static int
+ctf_dwarf_dwarf_base(ctf_die_t *cdp, Dwarf_Die die, int *kindp,
+    ctf_encoding_t *enc)
+{
+	int ret;
+	Dwarf_Signed type;
+
+	if ((ret = ctf_dwarf_signed(cdp, die, DW_AT_encoding, &type)) != 0)
+		return (ret);
+
+	switch (type) {
+	case DW_ATE_unsigned:
+	case DW_ATE_address:
+		*kindp = CTF_K_INTEGER;
+		enc->cte_format = 0;
+		break;
+	case DW_ATE_unsigned_char:
+		*kindp = CTF_K_INTEGER;
+		enc->cte_format = CTF_INT_CHAR;
+		break;
+	case DW_ATE_signed:
+		*kindp = CTF_K_INTEGER;
+		enc->cte_format = CTF_INT_SIGNED;
+		break;
+	case DW_ATE_signed_char:
+		*kindp = CTF_K_INTEGER;
+		enc->cte_format = CTF_INT_SIGNED | CTF_INT_CHAR;
+		break;
+	case DW_ATE_boolean:
+		*kindp = CTF_K_INTEGER;
+		enc->cte_format = CTF_INT_SIGNED | CTF_INT_BOOL;
+		break;
+	case DW_ATE_float:
+	case DW_ATE_complex_float:
+	case DW_ATE_imaginary_float:
+	case DW_ATE_SUN_imaginary_float:
+	case DW_ATE_SUN_interval_float:
+		*kindp = CTF_K_FLOAT;
+		if ((ret = ctf_dwarf_float_base(cdp, type, enc)) != 0)
+			return (ret);
+		break;
+	default:
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "encountered unkown DWARF encoding: %d", type);
+		return (ECTF_CONVBKERR);
+	}
+
+	return (0);
+}
+
+/*
+ * Different compilers (at least GCC and Studio) use different names for types.
+ * This parses the types and attempts to unify them. If this fails, we just fall
+ * back to using the DWARF itself.
+ */
+static int
+ctf_dwarf_parse_base(const char *name, int *kindp, ctf_encoding_t *enc,
+    char **newnamep)
+{
+	char buf[256];
+	char *base, *c;
+	int nlong = 0, nshort = 0, nchar = 0, nint = 0;
+	int sign = 1;
+
+	if (strlen(name) + 1 > sizeof (buf))
+		return (EINVAL);
+
+	(void) strlcpy(buf, name, sizeof (buf));
+	for (c = strtok(buf, " "); c != NULL; c = strtok(NULL, " ")) {
+		if (strcmp(c, "signed") == 0) {
+			sign = 1;
+		} else if (strcmp(c, "unsigned") == 0) {
+			sign = 0;
+		} else if (strcmp(c, "long") == 0) {
+			nlong++;
+		} else if (strcmp(c, "char") == 0) {
+			nchar++;
+		} else if (strcmp(c, "short") == 0) {
+			nshort++;
+		} else if (strcmp(c, "int") == 0) {
+			nint++;
+		} else {
+			/*
+			 * If we don't recognize any of the tokens, we'll tell
+			 * the caller to fall back to the dwarf-provided
+			 * encoding information.
+			 */
+			return (EINVAL);
+		}
+	}
+
+	if (nchar > 1 || nshort > 1 || nint > 1 || nlong > 2)
+		return (EINVAL);
+
+	if (nchar > 0) {
+		if (nlong > 0 || nshort > 0 || nint > 0)
+			return (EINVAL);
+		base = "char";
+	} else if (nshort > 0) {
+		if (nlong > 0)
+			return (EINVAL);
+		base = "short";
+	} else if (nlong > 0) {
+		base = "long";
+	} else {
+		base = "int";
+	}
+
+	if (nchar > 0)
+		enc->cte_format = CTF_INT_CHAR;
+	else
+		enc->cte_format = 0;
+
+	if (sign > 0)
+		enc->cte_format |= CTF_INT_SIGNED;
+
+	(void) snprintf(buf, sizeof (buf), "%s%s%s",
+	    (sign ? "" : "unsigned "),
+	    (nlong > 1 ? "long " : ""),
+	    base);
+
+	*newnamep = ctf_strdup(buf);
+	if (*newnamep == NULL)
+		return (ENOMEM);
+	*kindp = CTF_K_INTEGER;
+	return (0);
+}
+
+static int
+ctf_dwarf_create_base(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp, int isroot,
+    Dwarf_Off off)
+{
+	int ret;
+	char *name, *nname;
+	Dwarf_Unsigned sz;
+	int kind;
+	ctf_encoding_t enc;
+	ctf_id_t id;
+
+	if ((ret = ctf_dwarf_string(cdp, die, DW_AT_name, &name)) != 0)
+		return (ret);
+	if ((ret = ctf_dwarf_unsigned(cdp, die, DW_AT_byte_size, &sz)) != 0) {
+		goto out;
+	}
+	ctf_dprintf("Creating base type %s from off %llu, size: %d\n", name,
+	    off, sz);
+
+	bzero(&enc, sizeof (ctf_encoding_t));
+	enc.cte_bits = sz * 8;
+	if ((ret = ctf_dwarf_parse_base(name, &kind, &enc, &nname)) == 0) {
+		ctf_free(name, strlen(name) + 1);
+		name = nname;
+	} else {
+		if (ret != EINVAL)
+			return (ret);
+		ctf_dprintf("falling back to dwarf for base type %s\n", name);
+		if ((ret = ctf_dwarf_dwarf_base(cdp, die, &kind, &enc)) != 0)
+			return (ret);
+	}
+
+	id = ctf_add_encoded(cdp->cd_ctfp, isroot, name, &enc, kind);
+	if (id == CTF_ERR) {
+		ret = ctf_errno(cdp->cd_ctfp);
+	} else {
+		*idp = id;
+		ret = ctf_dwmap_add(cdp, id, die, B_FALSE);
+	}
+out:
+	ctf_free(name, strlen(name) + 1);
+	return (ret);
+}
+
+/*
+ * Getting a member's offset is a surprisingly intricate dance. It works as
+ * follows:
+ *
+ * 1) If we're in DWARFv4, then we either have a DW_AT_data_bit_offset or we
+ * have a DW_AT_data_member_location. We won't have both. Thus we check first
+ * for DW_AT_data_bit_offset, and if it exists, we're set.
+ *
+ * Next, if we have a bitfield and we don't ahve a DW_AT_data_bit_offset, then
+ * we have to grab the data location and use the following dance:
+ *
+ * 2) Gather the set of DW_AT_byte_size, DW_AT_bit_offset, and DW_AT_bit_size.
+ * Of course, the DW_AT_byte_size may be omitted, even though it isn't always.
+ * When it's been omitted, we then have to say that the size is that of the
+ * underlying type, which forces that to be after a ctf_update(). Here, we have
+ * to do different things based on whether or not we're using big endian or
+ * little endian to obtain the proper offset.
+ */
+static int
+ctf_dwarf_member_offset(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t mid,
+    ulong_t *offp)
+{
+	int ret;
+	Dwarf_Unsigned loc, bitsz, bytesz;
+	Dwarf_Signed bitoff;
+	size_t off, tsz;
+
+	if ((ret = ctf_dwarf_unsigned(cdp, die, DW_AT_data_bit_offset,
+	    &loc)) == 0) {
+		*offp = loc;
+		return (0);
+	} else if (ret != ENOENT) {
+		return (ret);
+	}
+
+	if ((ret = ctf_dwarf_member_location(cdp, die, &loc)) != 0)
+		return (ret);
+	off = loc * 8;
+
+	if ((ret = ctf_dwarf_signed(cdp, die, DW_AT_bit_offset,
+	    &bitoff)) != 0) {
+		if (ret != ENOENT)
+			return (ret);
+		*offp = off;
+		return (0);
+	}
+
+	/* At this point we have to have DW_AT_bit_size */
+	if ((ret = ctf_dwarf_unsigned(cdp, die, DW_AT_bit_size, &bitsz)) != 0)
+		return (ret);
+
+	if ((ret = ctf_dwarf_unsigned(cdp, die, DW_AT_byte_size,
+	    &bytesz)) != 0) {
+		if (ret != ENOENT)
+			return (ret);
+		if ((tsz = ctf_type_size(cdp->cd_ctfp, mid)) == CTF_ERR) {
+			int e = ctf_errno(cdp->cd_ctfp);
+			(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+			    "failed to get type size: %s", ctf_errmsg(e));
+			return (ECTF_CONVBKERR);
+		}
+	} else {
+		tsz = bytesz;
+	}
+	tsz *= 8;
+	if (cdp->cd_bigend == B_TRUE) {
+		*offp = off + bitoff;
+	} else {
+		*offp = off + tsz - bitoff - bitsz;
+	}
+
+	return (0);
+}
+
+/*
+ * We need to determine if the member in question is a bitfield. If it is, then
+ * we need to go through and create a new type that's based on the actual base
+ * type, but has a different size. We also rename the type as a result to help
+ * deal with future collisions.
+ *
+ * Here we need to look and see if we have a DW_AT_bit_size value. If we have a
+ * bit size member and it does not equal the byte size member, then we need to
+ * create a bitfield type based on this.
+ *
+ * Note: When we support DWARFv4, there may be a chance that we ned to also
+ * search for the DW_AT_byte_size if we don't have a DW_AT_bit_size member.
+ */
+static int
+ctf_dwarf_member_bitfield(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp)
+{
+	int ret;
+	Dwarf_Unsigned bitsz;
+	ctf_encoding_t e;
+	ctf_dwbitf_t *cdb;
+	ctf_dtdef_t *dtd;
+	ctf_id_t base = *idp;
+	int kind;
+
+	if ((ret = ctf_dwarf_unsigned(cdp, die, DW_AT_bit_size, &bitsz)) != 0) {
+		if (ret == ENOENT)
+			return (0);
+		return (ret);
+	}
+
+	ctf_dprintf("Trying to deal with bitfields on %d:%d\n", base, bitsz);
+	/*
+	 * Given that we now have a bitsize, time to go do something about it.
+	 * We're going to create a new type based on the current one, but first
+	 * we need to find the base type. This means we need to traverse any
+	 * typedef's, consts, and volatiles until we get to what should be
+	 * something of type integer or enumeration.
+	 */
+	VERIFY(bitsz < UINT32_MAX);
+	dtd = ctf_dtd_lookup(cdp->cd_ctfp, base);
+	VERIFY(dtd != NULL);
+	kind = CTF_INFO_KIND(dtd->dtd_data.ctt_info);
+	while (kind == CTF_K_TYPEDEF || kind == CTF_K_CONST ||
+	    kind == CTF_K_VOLATILE) {
+		dtd = ctf_dtd_lookup(cdp->cd_ctfp, dtd->dtd_data.ctt_type);
+		VERIFY(dtd != NULL);
+		kind = CTF_INFO_KIND(dtd->dtd_data.ctt_info);
+	}
+	ctf_dprintf("got kind %d\n", kind);
+	VERIFY(kind == CTF_K_INTEGER || kind == CTF_K_ENUM);
+
+	/*
+	 * As surprising as it may be, it is strictly possible to create a
+	 * bitfield that is based on an enum. Of course, the C standard leaves
+	 * enums sizing as an ABI concern more or less. To that effect, today on
+	 * all illumos platforms the size of an enum is generally that of an
+	 * int as our supported data models and ABIs all agree on that. So what
+	 * we'll do is fake up a CTF enconding here to use. In this case, we'll
+	 * treat it as an unsigned value of whatever size the underlying enum
+	 * currently has (which is in the ctt_size member of its dynamic type
+	 * data).
+	 */
+	if (kind == CTF_K_INTEGER) {
+		e = dtd->dtd_u.dtu_enc;
+	} else {
+		bzero(&e, sizeof (ctf_encoding_t));
+		e.cte_bits = dtd->dtd_data.ctt_size * NBBY;
+	}
+
+	for (cdb = ctf_list_next(&cdp->cd_bitfields); cdb != NULL;
+	    cdb = ctf_list_next(cdb)) {
+		if (cdb->cdb_base == base && cdb->cdb_nbits == bitsz)
+			break;
+	}
+
+	/*
+	 * Create a new type if none exists. We name all types in a way that is
+	 * guaranteed not to conflict with the corresponding C type. We do this
+	 * by using the ':' operator.
+	 */
+	if (cdb == NULL) {
+		size_t namesz;
+		char *name;
+
+		e.cte_bits = bitsz;
+		namesz = snprintf(NULL, 0, "%s:%d", dtd->dtd_name,
+		    (uint32_t)bitsz);
+		name = ctf_alloc(namesz + 1);
+		if (name == NULL)
+			return (ENOMEM);
+		cdb = ctf_alloc(sizeof (ctf_dwbitf_t));
+		if (cdb == NULL) {
+			ctf_free(name, namesz + 1);
+			return (ENOMEM);
+		}
+		(void) snprintf(name, namesz + 1, "%s:%d", dtd->dtd_name,
+		    (uint32_t)bitsz);
+
+		cdb->cdb_base = base;
+		cdb->cdb_nbits = bitsz;
+		cdb->cdb_id = ctf_add_integer(cdp->cd_ctfp, CTF_ADD_NONROOT,
+		    name, &e);
+		if (cdb->cdb_id == CTF_ERR) {
+			(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+			    "failed to get add bitfield type %s: %s", name,
+			    ctf_errmsg(ctf_errno(cdp->cd_ctfp)));
+			ctf_free(name, namesz + 1);
+			ctf_free(cdb, sizeof (ctf_dwbitf_t));
+			return (ECTF_CONVBKERR);
+		}
+		ctf_free(name, namesz + 1);
+		ctf_list_append(&cdp->cd_bitfields, cdb);
+	}
+
+	*idp = cdb->cdb_id;
+
+	return (0);
+}
+
+static int
+ctf_dwarf_fixup_sou(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t base, boolean_t add)
+{
+	int ret, kind;
+	Dwarf_Die child, memb;
+	Dwarf_Unsigned size;
+	ulong_t nsz;
+
+	kind = ctf_type_kind(cdp->cd_ctfp, base);
+	VERIFY(kind != CTF_ERR);
+	VERIFY(kind == CTF_K_STRUCT || kind == CTF_K_UNION);
+
+	/*
+	 * Members are in children. However, gcc also allows empty ones.
+	 */
+	if ((ret = ctf_dwarf_child(cdp, die, &child)) != 0)
+		return (ret);
+	if (child == NULL)
+		return (0);
+
+	memb = child;
+	while (memb != NULL) {
+		Dwarf_Die sib, tdie;
+		Dwarf_Half tag;
+		ctf_id_t mid;
+		char *mname;
+		ulong_t memboff = 0;
+
+		if ((ret = ctf_dwarf_tag(cdp, memb, &tag)) != 0)
+			return (ret);
+
+		if (tag != DW_TAG_member)
+			continue;
+
+		if ((ret = ctf_dwarf_refdie(cdp, memb, DW_AT_type, &tdie)) != 0)
+			return (ret);
+
+		if ((ret = ctf_dwarf_convert_type(cdp, tdie, &mid,
+		    CTF_ADD_NONROOT)) != 0)
+			return (ret);
+		ctf_dprintf("Got back type id: %d\n", mid);
+
+		/*
+		 * If we're not adding a member, just go ahead and return.
+		 */
+		if (add == B_FALSE) {
+			if ((ret = ctf_dwarf_member_bitfield(cdp, memb,
+			    &mid)) != 0)
+				return (ret);
+			goto next;
+		}
+
+		if ((ret = ctf_dwarf_string(cdp, memb, DW_AT_name,
+		    &mname)) != 0 && ret != ENOENT)
+			return (ret);
+		if (ret == ENOENT)
+			mname = NULL;
+
+		if (kind == CTF_K_UNION) {
+			memboff = 0;
+		} else if ((ret = ctf_dwarf_member_offset(cdp, memb, mid,
+		    &memboff)) != 0) {
+			if (mname != NULL)
+				ctf_free(mname, strlen(mname) + 1);
+			return (ret);
+		}
+
+		if ((ret = ctf_dwarf_member_bitfield(cdp, memb, &mid)) != 0)
+			return (ret);
+
+		ret = ctf_add_member(cdp->cd_ctfp, base, mname, mid, memboff);
+		if (ret == CTF_ERR) {
+			(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+			    "failed to add member %s: %s",
+			    mname, ctf_errmsg(ctf_errno(cdp->cd_ctfp)));
+			if (mname != NULL)
+				ctf_free(mname, strlen(mname) + 1);
+			return (ECTF_CONVBKERR);
+		}
+
+		if (mname != NULL)
+			ctf_free(mname, strlen(mname) + 1);
+
+next:
+		if ((ret = ctf_dwarf_sib(cdp, memb, &sib)) != 0)
+			return (ret);
+		memb = sib;
+	}
+
+	/*
+	 * If we're not adding members, then we don't know the final size of the
+	 * structure, so end here.
+	 */
+	if (add == B_FALSE)
+		return (0);
+
+	/* Finally set the size of the structure to the actual byte size */
+	if ((ret = ctf_dwarf_unsigned(cdp, die, DW_AT_byte_size, &size)) != 0)
+		return (ret);
+	nsz = size;
+	if ((ctf_set_size(cdp->cd_ctfp, base, nsz)) == CTF_ERR) {
+		int e = ctf_errno(cdp->cd_ctfp);
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "failed to set type size for %d to 0x%x: %s", base,
+		    (uint32_t)size, ctf_errmsg(e));
+		return (ECTF_CONVBKERR);
+	}
+
+	return (0);
+}
+
+static int
+ctf_dwarf_create_sou(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp,
+    int kind, int isroot)
+{
+	int ret;
+	char *name;
+	ctf_id_t base;
+	Dwarf_Die child;
+	Dwarf_Bool decl;
+
+	/*
+	 * Deal with the terribly annoying case of anonymous structs and unions.
+	 * If they don't have a name, set the name to the empty string.
+	 */
+	if ((ret = ctf_dwarf_string(cdp, die, DW_AT_name, &name)) != 0 &&
+	    ret != ENOENT)
+		return (ret);
+	if (ret == ENOENT)
+		name = NULL;
+
+	/*
+	 * We need to check if we just have a declaration here. If we do, then
+	 * instead of creating an actual structure or union, we're just going to
+	 * go ahead and create a forward. During a dedup or merge, the forward
+	 * will be replaced with the real thing.
+	 */
+	if ((ret = ctf_dwarf_boolean(cdp, die, DW_AT_declaration,
+	    &decl)) != 0) {
+		if (ret != ENOENT)
+			return (ret);
+		decl = 0;
+	}
+
+	if (decl != 0) {
+		base = ctf_add_forward(cdp->cd_ctfp, isroot, name, kind);
+	} else if (kind == CTF_K_STRUCT) {
+		base = ctf_add_struct(cdp->cd_ctfp, isroot, name);
+	} else {
+		base = ctf_add_union(cdp->cd_ctfp, isroot, name);
+	}
+	ctf_dprintf("added sou %s (%d) (%d)\n", name, kind, base);
+	if (name != NULL)
+		ctf_free(name, strlen(name) + 1);
+	if (base == CTF_ERR)
+		return (ctf_errno(cdp->cd_ctfp));
+	*idp = base;
+
+	/*
+	 * If it's just a declaration, we're not going to mark it for fix up or
+	 * do anything else.
+	 */
+	if (decl == B_TRUE)
+		return (ctf_dwmap_add(cdp, base, die, B_FALSE));
+	if ((ret = ctf_dwmap_add(cdp, base, die, B_TRUE)) != 0)
+		return (ret);
+
+	/*
+	 * Members are in children. However, gcc also allows empty ones.
+	 */
+	if ((ret = ctf_dwarf_child(cdp, die, &child)) != 0)
+		return (ret);
+	if (child == NULL)
+		return (0);
+
+	return (0);
+}
+
+static int
+ctf_dwarf_create_array_range(ctf_die_t *cdp, Dwarf_Die range, ctf_id_t *idp,
+    ctf_id_t base, int isroot)
+{
+	int ret;
+	Dwarf_Die sib;
+	Dwarf_Unsigned val;
+	Dwarf_Signed sval;
+	ctf_arinfo_t ar;
+
+	ctf_dprintf("creating array range\n");
+
+	if ((ret = ctf_dwarf_sib(cdp, range, &sib)) != 0)
+		return (ret);
+	if (sib != NULL) {
+		ctf_id_t id;
+		if ((ret = ctf_dwarf_create_array_range(cdp, sib, &id,
+		    base, CTF_ADD_NONROOT)) != 0)
+			return (ret);
+		ar.ctr_contents = id;
+	} else {
+		ar.ctr_contents = base;
+	}
+
+	if ((ar.ctr_index = ctf_dwarf_long(cdp)) == CTF_ERR)
+		return (ctf_errno(cdp->cd_ctfp));
+
+	/*
+	 * Array bounds can be signed or unsigned, but there are several kinds
+	 * of signless forms (data1, data2, etc) that take their sign from the
+	 * routine that is trying to interpret them.  That is, data1 can be
+	 * either signed or unsigned, depending on whether you use the signed or
+	 * unsigned accessor function.  GCC will use the signless forms to store
+	 * unsigned values which have their high bit set, so we need to try to
+	 * read them first as unsigned to get positive values.  We could also
+	 * try signed first, falling back to unsigned if we got a negative
+	 * value.
+	 */
+	if ((ret = ctf_dwarf_unsigned(cdp, range, DW_AT_upper_bound,
+	    &val)) == 0) {
+		ar.ctr_nelems = val + 1;
+	} else if (ret != ENOENT) {
+		return (ret);
+	} else if ((ret = ctf_dwarf_signed(cdp, range, DW_AT_upper_bound,
+	    &sval)) == 0) {
+		ar.ctr_nelems = sval + 1;
+	} else if (ret != ENOENT) {
+		return (ret);
+	} else {
+		ar.ctr_nelems = 0;
+	}
+
+	if ((*idp = ctf_add_array(cdp->cd_ctfp, isroot, &ar)) == CTF_ERR)
+		return (ctf_errno(cdp->cd_ctfp));
+
+	return (0);
+}
+
+/*
+ * Try and create an array type. First, the kind of the array is specified in
+ * the DW_AT_type entry. Next, the number of entries is stored in a more
+ * complicated form, we should have a child that has the DW_TAG_subrange type.
+ */
+static int
+ctf_dwarf_create_array(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp, int isroot)
+{
+	int ret;
+	Dwarf_Die tdie, rdie;
+	ctf_id_t tid;
+	Dwarf_Half rtag;
+	ctf_arinfo_t ar;
+
+	if ((ret = ctf_dwarf_refdie(cdp, die, DW_AT_type, &tdie)) != 0)
+		return (ret);
+	if ((ret = ctf_dwarf_convert_type(cdp, tdie, &tid,
+	    CTF_ADD_NONROOT)) != 0)
+		return (ret);
+
+	ar.ctr_contents = tid;
+
+	if ((ret = ctf_dwarf_child(cdp, die, &rdie)) != 0)
+		return (ret);
+	if ((ret = ctf_dwarf_tag(cdp, rdie, &rtag)) != 0)
+		return (ret);
+	if (rtag != DW_TAG_subrange_type) {
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "encountered array without DW_TAG_subrange_type child\n");
+		return (ECTF_CONVBKERR);
+	}
+
+	/*
+	 * The compiler may opt to describe a multi-dimensional array as one
+	 * giant array or it may opt to instead encode it as a series of
+	 * subranges. If it's the latter, then for each subrange we introduce a
+	 * type. We can always use the base type.
+	 */
+	if ((ret = ctf_dwarf_create_array_range(cdp, rdie, idp, tid,
+	    isroot)) != 0)
+		return (ret);
+	ctf_dprintf("Got back id %d\n", *idp);
+	return (ctf_dwmap_add(cdp, *idp, die, B_FALSE));
+}
+
+static int
+ctf_dwarf_create_reference(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp,
+    int kind, int isroot)
+{
+	int ret;
+	ctf_id_t id;
+	Dwarf_Die tdie;
+	char *name;
+	size_t namelen;
+
+	if ((ret = ctf_dwarf_string(cdp, die, DW_AT_name, &name)) != 0 &&
+	    ret != ENOENT)
+		return (ret);
+	if (ret == ENOENT) {
+		name = NULL;
+		namelen = 0;
+	} else {
+		namelen = strlen(name);
+	}
+
+	ctf_dprintf("reference kind %d %s\n", kind, name != NULL ? name : "<>");
+
+	if ((ret = ctf_dwarf_refdie(cdp, die, DW_AT_type, &tdie)) != 0) {
+		if (ret != ENOENT) {
+			ctf_free(name, namelen);
+			return (ret);
+		}
+		if ((id = ctf_dwarf_void(cdp)) == CTF_ERR) {
+			ctf_free(name, namelen);
+			return (ctf_errno(cdp->cd_ctfp));
+		}
+	} else {
+		if ((ret = ctf_dwarf_convert_type(cdp, tdie, &id,
+		    CTF_ADD_NONROOT)) != 0) {
+			ctf_free(name, namelen);
+			return (ret);
+		}
+	}
+
+	if ((*idp = ctf_add_reftype(cdp->cd_ctfp, isroot, name, id, kind)) ==
+	    CTF_ERR) {
+		ctf_free(name, namelen);
+		return (ctf_errno(cdp->cd_ctfp));
+	}
+
+	ctf_free(name, namelen);
+	return (ctf_dwmap_add(cdp, *idp, die, B_FALSE));
+}
+
+static int
+ctf_dwarf_create_enum(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp, int isroot)
+{
+	int ret;
+	ctf_id_t id;
+	Dwarf_Die child;
+	char *name;
+
+	if ((ret = ctf_dwarf_string(cdp, die, DW_AT_name, &name)) != 0 &&
+	    ret != ENOENT)
+		return (ret);
+	if (ret == ENOENT)
+		name = NULL;
+	id = ctf_add_enum(cdp->cd_ctfp, isroot, name);
+	ctf_dprintf("added enum %s (%d)\n", name, id);
+	if (name != NULL)
+		ctf_free(name, strlen(name) + 1);
+	if (id == CTF_ERR)
+		return (ctf_errno(cdp->cd_ctfp));
+	*idp = id;
+	if ((ret = ctf_dwmap_add(cdp, id, die, B_FALSE)) != 0)
+		return (ret);
+
+
+	if ((ret = ctf_dwarf_child(cdp, die, &child)) != 0) {
+		if (ret == ENOENT)
+			ret = 0;
+		return (ret);
+	}
+
+	while (child != NULL) {
+		Dwarf_Half tag;
+		Dwarf_Signed sval;
+		Dwarf_Unsigned uval;
+		Dwarf_Die arg = child;
+		int eval;
+
+		if ((ret = ctf_dwarf_sib(cdp, arg, &child)) != 0)
+			return (ret);
+
+		if ((ret = ctf_dwarf_tag(cdp, arg, &tag)) != 0)
+			return (ret);
+
+		if (tag != DW_TAG_enumerator) {
+			if ((ret = ctf_dwarf_convert_type(cdp, arg, NULL,
+			    CTF_ADD_NONROOT)) != 0)
+				return (ret);
+			continue;
+		}
+
+		if ((ret = ctf_dwarf_signed(cdp, arg, DW_AT_const_value,
+		    &sval)) == 0) {
+			eval = sval;
+		} else if (ret != ENOENT) {
+			return (ret);
+		} else if ((ret = ctf_dwarf_unsigned(cdp, arg,
+		    DW_AT_const_value, &uval)) == 0) {
+			eval = (int)uval;
+		} else {
+			(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+			    "encountered enumration without constant value\n");
+			return (ECTF_CONVBKERR);
+		}
+
+		/*
+		 * DWARF v4 section 5.7 tells us we'll always have names.
+		 */
+		if ((ret = ctf_dwarf_string(cdp, arg, DW_AT_name,
+		    &name)) != 0)
+			return (ret);
+
+		ret = ctf_add_enumerator(cdp->cd_ctfp, id, name, eval);
+		if (ret == CTF_ERR) {
+			(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+			    "failed to add enumarator %s (%d) to %d\n",
+			    name, eval, id);
+			ctf_free(name, strlen(name) + 1);
+			return (ctf_errno(cdp->cd_ctfp));
+		}
+		ctf_free(name, strlen(name) + 1);
+	}
+
+	return (0);
+}
+
+/*
+ * For a function pointer, walk over and process all of its children, unless we
+ * encounter one that's just a declaration. In which case, we error on it.
+ */
+static int
+ctf_dwarf_create_fptr(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp, int isroot)
+{
+	int ret;
+	Dwarf_Bool b;
+	ctf_funcinfo_t fi;
+	Dwarf_Die retdie;
+	ctf_id_t *argv = NULL;
+
+	bzero(&fi, sizeof (ctf_funcinfo_t));
+
+	if ((ret = ctf_dwarf_boolean(cdp, die, DW_AT_declaration, &b)) != 0) {
+		if (ret != ENOENT)
+			return (ret);
+	} else {
+		if (b != 0)
+			return (EPROTOTYPE);
+	}
+
+	/*
+	 * Return type is in DW_AT_type, if none, it returns void.
+	 */
+	if ((ret = ctf_dwarf_refdie(cdp, die, DW_AT_type, &retdie)) != 0) {
+		if (ret != ENOENT)
+			return (ret);
+		if ((fi.ctc_return = ctf_dwarf_void(cdp)) == CTF_ERR)
+			return (ctf_errno(cdp->cd_ctfp));
+	} else {
+		if ((ret = ctf_dwarf_convert_type(cdp, retdie, &fi.ctc_return,
+		    CTF_ADD_NONROOT)) != 0)
+			return (ret);
+	}
+
+	if ((ret = ctf_dwarf_function_count(cdp, die, &fi, B_TRUE)) != 0) {
+		return (ret);
+	}
+
+	if (fi.ctc_argc != 0) {
+		argv = ctf_alloc(sizeof (ctf_id_t) * fi.ctc_argc);
+		if (argv == NULL)
+			return (ENOMEM);
+
+		if ((ret = ctf_dwarf_convert_fargs(cdp, die, &fi, argv)) != 0) {
+			ctf_free(argv, sizeof (ctf_id_t) * fi.ctc_argc);
+			return (ret);
+		}
+	}
+
+	if ((*idp = ctf_add_funcptr(cdp->cd_ctfp, isroot, &fi, argv)) ==
+	    CTF_ERR) {
+		ctf_free(argv, sizeof (ctf_id_t) * fi.ctc_argc);
+		return (ctf_errno(cdp->cd_ctfp));
+	}
+
+	ctf_free(argv, sizeof (ctf_id_t) * fi.ctc_argc);
+	return (ctf_dwmap_add(cdp, *idp, die, B_FALSE));
+}
+
+static int
+ctf_dwarf_convert_type(ctf_die_t *cdp, Dwarf_Die die, ctf_id_t *idp,
+    int isroot)
+{
+	int ret;
+	Dwarf_Off offset;
+	Dwarf_Half tag;
+	ctf_dwmap_t lookup, *map;
+	ctf_id_t id;
+
+	if (idp == NULL)
+		idp = &id;
+
+	if ((ret = ctf_dwarf_offset(cdp, die, &offset)) != 0)
+		return (ret);
+
+	if (offset > cdp->cd_maxoff) {
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "die offset %llu beyond maximum for header %llu\n",
+		    offset, cdp->cd_maxoff);
+		return (ECTF_CONVBKERR);
+	}
+
+	/*
+	 * If we've already added an entry for this offset, then we're done.
+	 */
+	lookup.cdm_off = offset;
+	if ((map = avl_find(&cdp->cd_map, &lookup, NULL)) != NULL) {
+		*idp = map->cdm_id;
+		return (0);
+	}
+
+	if ((ret = ctf_dwarf_tag(cdp, die, &tag)) != 0)
+		return (ret);
+
+	ret = ENOTSUP;
+	switch (tag) {
+	case DW_TAG_base_type:
+		ctf_dprintf("base\n");
+		ret = ctf_dwarf_create_base(cdp, die, idp, isroot, offset);
+		break;
+	case DW_TAG_array_type:
+		ctf_dprintf("array\n");
+		ret = ctf_dwarf_create_array(cdp, die, idp, isroot);
+		break;
+	case DW_TAG_enumeration_type:
+		ctf_dprintf("enum\n");
+		ret = ctf_dwarf_create_enum(cdp, die, idp, isroot);
+		break;
+	case DW_TAG_pointer_type:
+		ctf_dprintf("pointer\n");
+		ret = ctf_dwarf_create_reference(cdp, die, idp, CTF_K_POINTER,
+		    isroot);
+		break;
+	case DW_TAG_structure_type:
+		ctf_dprintf("struct\n");
+		ret = ctf_dwarf_create_sou(cdp, die, idp, CTF_K_STRUCT,
+		    isroot);
+		break;
+	case DW_TAG_subroutine_type:
+		ctf_dprintf("fptr\n");
+		ret = ctf_dwarf_create_fptr(cdp, die, idp, isroot);
+		break;
+	case DW_TAG_typedef:
+		ctf_dprintf("typedef\n");
+		ret = ctf_dwarf_create_reference(cdp, die, idp, CTF_K_TYPEDEF,
+		    isroot);
+		break;
+	case DW_TAG_union_type:
+		ctf_dprintf("union\n");
+		ret = ctf_dwarf_create_sou(cdp, die, idp, CTF_K_UNION,
+		    isroot);
+		break;
+	case DW_TAG_const_type:
+		ctf_dprintf("const\n");
+		ret = ctf_dwarf_create_reference(cdp, die, idp, CTF_K_CONST,
+		    isroot);
+		break;
+	case DW_TAG_volatile_type:
+		ctf_dprintf("volatile\n");
+		ret = ctf_dwarf_create_reference(cdp, die, idp, CTF_K_VOLATILE,
+		    isroot);
+		break;
+	case DW_TAG_restrict_type:
+		ctf_dprintf("restrict\n");
+		ret = ctf_dwarf_create_reference(cdp, die, idp, CTF_K_RESTRICT,
+		    isroot);
+		break;
+	default:
+		ctf_dprintf("ignoring tag type %x\n", tag);
+		ret = 0;
+		break;
+	}
+	ctf_dprintf("ctf_dwarf_convert_type tag specific handler returned %d\n",
+	    ret);
+
+	return (ret);
+}
+
+static int
+ctf_dwarf_walk_lexical(ctf_die_t *cdp, Dwarf_Die die)
+{
+	int ret;
+	Dwarf_Die child;
+
+	if ((ret = ctf_dwarf_child(cdp, die, &child)) != 0)
+		return (ret);
+
+	if (child == NULL)
+		return (0);
+
+	return (ctf_dwarf_convert_die(cdp, die));
+}
+
+static int
+ctf_dwarf_function_count(ctf_die_t *cdp, Dwarf_Die die, ctf_funcinfo_t *fip,
+    boolean_t fptr)
+{
+	int ret;
+	Dwarf_Die child, sib, arg;
+
+	if ((ret = ctf_dwarf_child(cdp, die, &child)) != 0)
+		return (ret);
+
+	arg = child;
+	while (arg != NULL) {
+		Dwarf_Half tag;
+
+		if ((ret = ctf_dwarf_tag(cdp, arg, &tag)) != 0)
+			return (ret);
+
+		/*
+		 * We have to check for a varargs type decleration. This will
+		 * happen in one of two ways. If we have a function pointer
+		 * type, then it'll be done with a tag of type
+		 * DW_TAG_unspecified_parameters. However, it only means we have
+		 * a variable number of arguments, if we have more than one
+		 * argument found so far. Otherwise, when we have a function
+		 * type, it instead uses a formal parameter whose name is '...'
+		 * to indicate a variable arguments member.
+		 *
+		 * Also, if we have a function pointer, then we have to expect
+		 * that we might not get a name at all.
+		 */
+		if (tag == DW_TAG_formal_parameter && fptr == B_FALSE) {
+			char *name;
+			if ((ret = ctf_dwarf_string(cdp, die, DW_AT_name,
+			    &name)) != 0)
+				return (ret);
+			if (strcmp(name, DWARF_VARARGS_NAME) == 0)
+				fip->ctc_flags |= CTF_FUNC_VARARG;
+			else
+				fip->ctc_argc++;
+			ctf_free(name, strlen(name) + 1);
+		} else if (tag == DW_TAG_formal_parameter) {
+			fip->ctc_argc++;
+		} else if (tag == DW_TAG_unspecified_parameters &&
+		    fip->ctc_argc > 0) {
+			fip->ctc_flags |= CTF_FUNC_VARARG;
+		}
+		if ((ret = ctf_dwarf_sib(cdp, arg, &sib)) != 0)
+			return (ret);
+		arg = sib;
+	}
+
+	return (0);
+}
+
+static int
+ctf_dwarf_convert_fargs(ctf_die_t *cdp, Dwarf_Die die, ctf_funcinfo_t *fip,
+    ctf_id_t *argv)
+{
+	int ret;
+	int i = 0;
+	Dwarf_Die child, sib, arg;
+
+	if ((ret = ctf_dwarf_child(cdp, die, &child)) != 0)
+		return (ret);
+
+	arg = child;
+	while (arg != NULL) {
+		Dwarf_Half tag;
+
+		if ((ret = ctf_dwarf_tag(cdp, arg, &tag)) != 0)
+			return (ret);
+		if (tag == DW_TAG_formal_parameter) {
+			Dwarf_Die tdie;
+
+			if ((ret = ctf_dwarf_refdie(cdp, arg, DW_AT_type,
+			    &tdie)) != 0)
+				return (ret);
+
+			if ((ret = ctf_dwarf_convert_type(cdp, tdie, &argv[i],
+			    CTF_ADD_ROOT)) != 0)
+				return (ret);
+			i++;
+
+			/*
+			 * Once we hit argc entries, we're done. This ensures we
+			 * don't accidentally hit a varargs which should be the
+			 * least entry.
+			 */
+			if (i == fip->ctc_argc)
+				break;
+		}
+
+		if ((ret = ctf_dwarf_sib(cdp, arg, &sib)) != 0)
+			return (ret);
+		arg = sib;
+	}
+
+	return (0);
+}
+
+static int
+ctf_dwarf_convert_function(ctf_die_t *cdp, Dwarf_Die die)
+{
+	int ret;
+	char *name;
+	ctf_dwfunc_t *cdf;
+	Dwarf_Die tdie;
+
+	/*
+	 * Functions that don't have a name are generally functions that have
+	 * been inlined and thus most information about them has been lost. If
+	 * we can't get a name, then instead of returning ENOENT, we silently
+	 * swallow the error.
+	 */
+	if ((ret = ctf_dwarf_string(cdp, die, DW_AT_name, &name)) != 0) {
+		if (ret == ENOENT)
+			return (0);
+		return (ret);
+	}
+
+	ctf_dprintf("beginning work on function %s\n", name);
+	if ((cdf = ctf_alloc(sizeof (ctf_dwfunc_t))) == NULL) {
+		ctf_free(name, strlen(name) + 1);
+		return (ENOMEM);
+	}
+	bzero(cdf, sizeof (ctf_dwfunc_t));
+	cdf->cdf_name = name;
+
+	if ((ret = ctf_dwarf_refdie(cdp, die, DW_AT_type, &tdie)) == 0) {
+		if ((ret = ctf_dwarf_convert_type(cdp, tdie,
+		    &(cdf->cdf_fip.ctc_return), CTF_ADD_ROOT)) != 0) {
+			ctf_free(name, strlen(name) + 1);
+			ctf_free(cdf, sizeof (ctf_dwfunc_t));
+			return (ret);
+		}
+	} else if (ret != ENOENT) {
+		ctf_free(name, strlen(name) + 1);
+		ctf_free(cdf, sizeof (ctf_dwfunc_t));
+		return (ret);
+	} else {
+		if ((cdf->cdf_fip.ctc_return = ctf_dwarf_void(cdp)) ==
+		    CTF_ERR) {
+			ctf_free(name, strlen(name) + 1);
+			ctf_free(cdf, sizeof (ctf_dwfunc_t));
+			return (ctf_errno(cdp->cd_ctfp));
+		}
+	}
+
+	/*
+	 * A function has a number of children, some of which may not be ones we
+	 * care about. Children that we care about have a type of
+	 * DW_TAG_formal_parameter. We're going to do two passes, the first to
+	 * count the arguments, the second to process them. Afterwards, we
+	 * should be good to go ahead and add this function.
+	 *
+	 * Note, we already got the return type by going in and grabbing it out
+	 * of the DW_AT_type.
+	 */
+	if ((ret = ctf_dwarf_function_count(cdp, die, &cdf->cdf_fip,
+	    B_FALSE)) != 0) {
+		ctf_free(name, strlen(name) + 1);
+		ctf_free(cdf, sizeof (ctf_dwfunc_t));
+		return (ret);
+	}
+
+	ctf_dprintf("beginning to convert function arguments %s\n", name);
+	if (cdf->cdf_fip.ctc_argc != 0) {
+		uint_t argc = cdf->cdf_fip.ctc_argc;
+		cdf->cdf_argv = ctf_alloc(sizeof (ctf_id_t) * argc);
+		if (cdf->cdf_argv == NULL) {
+			ctf_free(name, strlen(name) + 1);
+			ctf_free(cdf, sizeof (ctf_dwfunc_t));
+			return (ENOMEM);
+		}
+		if ((ret = ctf_dwarf_convert_fargs(cdp, die,
+		    &cdf->cdf_fip, cdf->cdf_argv)) != 0) {
+			ctf_free(cdf->cdf_argv, sizeof (ctf_id_t) * argc);
+			ctf_free(name, strlen(name) + 1);
+			ctf_free(cdf, sizeof (ctf_dwfunc_t));
+			return (ret);
+		}
+	} else {
+		cdf->cdf_argv = NULL;
+	}
+
+	if ((ret = ctf_dwarf_isglobal(cdp, die, &cdf->cdf_global)) != 0) {
+		ctf_free(cdf->cdf_argv, sizeof (ctf_id_t) *
+		    cdf->cdf_fip.ctc_argc);
+		ctf_free(name, strlen(name) + 1);
+		ctf_free(cdf, sizeof (ctf_dwfunc_t));
+		return (ret);
+	}
+
+	ctf_list_append(&cdp->cd_funcs, cdf);
+	return (ret);
+}
+
+/*
+ * Convert variables, but only if they're not prototypes and have names.
+ */
+static int
+ctf_dwarf_convert_variable(ctf_die_t *cdp, Dwarf_Die die)
+{
+	int ret;
+	char *name;
+	Dwarf_Bool b;
+	Dwarf_Die tdie;
+	ctf_id_t id;
+	ctf_dwvar_t *cdv;
+
+	if ((ret = ctf_dwarf_boolean(cdp, die, DW_AT_declaration, &b)) != 0) {
+		if (ret != ENOENT)
+			return (ret);
+	} else if (b != 0) {
+		return (0);
+	}
+
+	if ((ret = ctf_dwarf_string(cdp, die, DW_AT_name, &name)) != 0 &&
+	    ret != ENOENT)
+		return (ret);
+	if (ret == ENOENT)
+		return (0);
+
+	if ((ret = ctf_dwarf_refdie(cdp, die, DW_AT_type, &tdie)) != 0) {
+		ctf_free(name, strlen(name) + 1);
+		return (ret);
+	}
+
+	if ((ret = ctf_dwarf_convert_type(cdp, tdie, &id,
+	    CTF_ADD_ROOT)) != 0)
+		return (ret);
+
+	if ((cdv = ctf_alloc(sizeof (ctf_dwvar_t))) == NULL) {
+		ctf_free(name, strlen(name) + 1);
+		return (ENOMEM);
+	}
+
+	cdv->cdv_name = name;
+	cdv->cdv_type = id;
+
+	if ((ret = ctf_dwarf_isglobal(cdp, die, &cdv->cdv_global)) != 0) {
+		ctf_free(cdv, sizeof (ctf_dwvar_t));
+		ctf_free(name, strlen(name) + 1);
+		return (ret);
+	}
+
+	ctf_list_append(&cdp->cd_vars, cdv);
+	return (0);
+}
+
+/*
+ * Walk through our set of top-level types and process them.
+ */
+static int
+ctf_dwarf_walk_toplevel(ctf_die_t *cdp, Dwarf_Die die)
+{
+	int ret;
+	Dwarf_Off offset;
+	Dwarf_Half tag;
+
+	if ((ret = ctf_dwarf_offset(cdp, die, &offset)) != 0)
+		return (ret);
+
+	if (offset > cdp->cd_maxoff) {
+		(void) snprintf(cdp->cd_errbuf, cdp->cd_errlen,
+		    "die offset %llu beyond maximum for header %llu\n",
+		    offset, cdp->cd_maxoff);
+		return (ECTF_CONVBKERR);
+	}
+
+	if ((ret = ctf_dwarf_tag(cdp, die, &tag)) != 0)
+		return (ret);
+
+	ret = 0;
+	switch (tag) {
+	case DW_TAG_subprogram:
+		ctf_dprintf("top level func\n");
+		ret = ctf_dwarf_convert_function(cdp, die);
+		break;
+	case DW_TAG_variable:
+		ctf_dprintf("top level var\n");
+		ret = ctf_dwarf_convert_variable(cdp, die);
+		break;
+	case DW_TAG_lexical_block:
+		ctf_dprintf("top level block\n");
+		ret = ctf_dwarf_walk_lexical(cdp, die);
+		break;
+	case DW_TAG_enumeration_type:
+	case DW_TAG_structure_type:
+	case DW_TAG_typedef:
+	case DW_TAG_union_type:
+		ctf_dprintf("top level type\n");
+		ret = ctf_dwarf_convert_type(cdp, die, NULL, B_TRUE);
+		break;
+	default:
+		break;
+	}
+
+	return (ret);
+}
+
+
+/*
+ * We're given a node. At this node we need to convert it and then proceed to
+ * convert any siblings that are associaed with this die.
+ */
+static int
+ctf_dwarf_convert_die(ctf_die_t *cdp, Dwarf_Die die)
+{
+	while (die != NULL) {
+		int ret;
+		Dwarf_Die sib;
+
+		if ((ret = ctf_dwarf_walk_toplevel(cdp, die)) != 0)
+			return (ret);
+
+		if ((ret = ctf_dwarf_sib(cdp, die, &sib)) != 0)
+			return (ret);
+		die = sib;
+	}
+	return (0);
+}
+
+static int
+ctf_dwarf_fixup_die(ctf_die_t *cdp, boolean_t addpass)
+{
+	ctf_dwmap_t *map;
+
+	for (map = avl_first(&cdp->cd_map); map != NULL;
+	    map = AVL_NEXT(&cdp->cd_map, map)) {
+		int ret;
+		if (map->cdm_fix == B_FALSE)
+			continue;
+		if ((ret = ctf_dwarf_fixup_sou(cdp, map->cdm_die, map->cdm_id,
+		    addpass)) != 0)
+			return (ret);
+	}
+
+	return (0);
+}
+
+static ctf_dwfunc_t *
+ctf_dwarf_match_func(ctf_die_t *cdp, const char *file, const char *name,
+    int bind)
+{
+	ctf_dwfunc_t *cdf;
+
+	if (bind == STB_WEAK)
+		return (NULL);
+
+	/* Nothing we can do if we can't find a name to compare it to. */
+	if (bind == STB_LOCAL && (file == NULL || cdp->cd_name == NULL))
+		return (NULL);
+
+	for (cdf = ctf_list_next(&cdp->cd_funcs); cdf != NULL;
+	    cdf = ctf_list_next(cdf)) {
+		if (bind == STB_GLOBAL && cdf->cdf_global == B_FALSE)
+			continue;
+		if (bind == STB_LOCAL && cdf->cdf_global == B_TRUE)
+			continue;
+		if (strcmp(name, cdf->cdf_name) != 0)
+			continue;
+		if (bind == STB_LOCAL && strcmp(file, cdp->cd_name) != 0)
+			continue;
+		return (cdf);
+	}
+
+	return (NULL);
+}
+static ctf_dwvar_t *
+ctf_dwarf_match_var(ctf_die_t *cdp, const char *file, const char *name,
+    int bind)
+{
+	ctf_dwvar_t *cdv;
+
+	/* Nothing we can do if we can't find a name to compare it to. */
+	if (bind == STB_LOCAL && (file == NULL || cdp->cd_name == NULL))
+		return (NULL);
+	ctf_dprintf("Still considering %s\n", name);
+
+	for (cdv = ctf_list_next(&cdp->cd_vars); cdv != NULL;
+	    cdv = ctf_list_next(cdv)) {
+		if (bind == STB_GLOBAL && cdv->cdv_global == B_FALSE)
+			continue;
+		if (bind == STB_LOCAL && cdv->cdv_global == B_TRUE)
+			continue;
+		if (strcmp(name, cdv->cdv_name) != 0)
+			continue;
+		if (bind == STB_LOCAL && strcmp(file, cdp->cd_name) != 0)
+			continue;
+		return (cdv);
+	}
+
+	return (NULL);
+}
+
+static int
+ctf_dwarf_symtab_iter(ctf_die_t *cdp, ctf_dwarf_symtab_f *func, void *arg)
+{
+	int ret;
+	ulong_t i;
+	ctf_file_t *fp = cdp->cd_ctfp;
+	const char *file = NULL;
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+	uintptr_t strbase = (uintptr_t)fp->ctf_strtab.cts_data;
+
+	for (i = 0; i < fp->ctf_nsyms; i++) {
+		const char *name;
+		int type;
+		GElf_Sym gsym;
+		const GElf_Sym *gsymp;
+
+		if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+			const Elf32_Sym *symp = (Elf32_Sym *)symbase + i;
+			type = ELF32_ST_TYPE(symp->st_info);
+			if (type == STT_FILE) {
+				file = (char *)(strbase + symp->st_name);
+				continue;
+			}
+			if (type != STT_OBJECT && type != STT_FUNC)
+				continue;
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+			name = (char *)(strbase + symp->st_name);
+			gsym.st_name = symp->st_name;
+			gsym.st_value = symp->st_value;
+			gsym.st_size = symp->st_size;
+			gsym.st_info = symp->st_info;
+			gsym.st_other = symp->st_other;
+			gsym.st_shndx = symp->st_shndx;
+			gsymp = &gsym;
+		} else {
+			const Elf64_Sym *symp = (Elf64_Sym *)symbase + i;
+			type = ELF64_ST_TYPE(symp->st_info);
+			if (type == STT_FILE) {
+				file = (char *)(strbase + symp->st_name);
+				continue;
+			}
+			if (type != STT_OBJECT && type != STT_FUNC)
+				continue;
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+			name = (char *)(strbase + symp->st_name);
+			gsymp = symp;
+		}
+
+		ret = func(cdp, gsymp, i, file, name, arg);
+		if (ret != 0)
+			return (ret);
+	}
+
+	return (0);
+}
+
+static int
+ctf_dwarf_conv_funcvars_cb(ctf_die_t *cdp, const GElf_Sym *symp, ulong_t idx,
+    const char *file, const char *name, void *arg)
+{
+	int ret, bind, type;
+
+	bind = GELF_ST_BIND(symp->st_info);
+	type = GELF_ST_TYPE(symp->st_info);
+
+	/*
+	 * Come back to weak symbols in another pass
+	 */
+	if (bind == STB_WEAK)
+		return (0);
+
+	if (type == STT_OBJECT) {
+		ctf_dwvar_t *cdv = ctf_dwarf_match_var(cdp, file, name,
+		    bind);
+		ctf_dprintf("match for %s (%d): %p\n", name, idx, cdv);
+		if (cdv == NULL)
+			return (0);
+		ret = ctf_add_object(cdp->cd_ctfp, idx, cdv->cdv_type);
+		ctf_dprintf("added object %s\n", name);
+	} else {
+		ctf_dwfunc_t *cdf = ctf_dwarf_match_func(cdp, file, name,
+		    bind);
+		if (cdf == NULL)
+			return (0);
+		ret = ctf_add_function(cdp->cd_ctfp, idx, &cdf->cdf_fip,
+		    cdf->cdf_argv);
+	}
+
+	if (ret == CTF_ERR) {
+		return (ctf_errno(cdp->cd_ctfp));
+	}
+
+	return (0);
+}
+
+static int
+ctf_dwarf_conv_funcvars(ctf_die_t *cdp)
+{
+	return (ctf_dwarf_symtab_iter(cdp, ctf_dwarf_conv_funcvars_cb, NULL));
+}
+
+/*
+ * Note, this comment comes from the original version of the CTF tools.
+ *
+ * If we have a weak symbol, attempt to find the strong symbol it will
+ * resolve to.  Note: the code where this actually happens is in
+ * sym_process() in cmd/sgs/libld/common/syms.c
+ *
+ * Finding the matching symbol is unfortunately not trivial.  For a
+ * symbol to be a candidate, it must:
+ *
+ * - have the same type (function, object)
+ * - have the same value (address)
+ * - have the same size
+ * - not be another weak symbol
+ * - belong to the same section (checked via section index)
+ *
+ * If such a candidate is global, then we assume we've found it.  The
+ * linker generates the symbol table such that the curfile might be
+ * incorrect; this is OK for global symbols, since find_iidesc() doesn't
+ * need to check for the source file for the symbol.
+ *
+ * We might have found a strong local symbol, where the curfile is
+ * accurate and matches that of the weak symbol.  We assume this is a
+ * reasonable match.
+ *
+ * If we've got a local symbol with a non-matching curfile, there are
+ * two possibilities.  Either this is a completely different symbol, or
+ * it's a once-global symbol that was scoped to local via a mapfile.  In
+ * the latter case, curfile is likely inaccurate since the linker does
+ * not preserve the needed curfile in the order of the symbol table (see
+ * the comments about locally scoped symbols in libld's update_osym()).
+ * As we can't tell this case from the former one, we use this symbol
+ * iff no other matching symbol is found.
+ *
+ * What we really need here is a SUNW section containing weak<->strong
+ * mappings that we can consume.
+ */
+typedef struct ctf_dwarf_weak_arg {
+	const GElf_Sym *cweak_symp;
+	const char *cweak_file;
+	boolean_t cweak_candidate;
+	ulong_t cweak_idx;
+} ctf_dwarf_weak_arg_t;
+
+static int
+ctf_dwarf_conv_check_weak(ctf_die_t *cdp, const GElf_Sym *symp,
+    ulong_t idx, const char *file, const char *name, void *arg)
+{
+	ctf_dwarf_weak_arg_t *cweak = arg;
+	const GElf_Sym *wsymp = cweak->cweak_symp;
+
+	ctf_dprintf("comparing weak to %s\n", name);
+
+	if (GELF_ST_BIND(symp->st_info) == STB_WEAK) {
+		return (0);
+	}
+
+	if (GELF_ST_TYPE(wsymp->st_info) != GELF_ST_TYPE(symp->st_info)) {
+		return (0);
+	}
+
+	if (wsymp->st_value != symp->st_value) {
+		return (0);
+	}
+
+	if (wsymp->st_size != symp->st_size) {
+		return (0);
+	}
+
+	if (wsymp->st_shndx != symp->st_shndx) {
+		return (0);
+	}
+
+	/*
+	 * Check if it's a weak candidate.
+	 */
+	if (GELF_ST_BIND(symp->st_info) == STB_LOCAL &&
+	    (file == NULL || cweak->cweak_file == NULL ||
+	    strcmp(file, cweak->cweak_file) != 0)) {
+		cweak->cweak_candidate = B_TRUE;
+		cweak->cweak_idx = idx;
+		return (0);
+	}
+
+	/*
+	 * Found a match, break.
+	 */
+	cweak->cweak_idx = idx;
+	return (1);
+}
+
+static int
+ctf_dwarf_duplicate_sym(ctf_die_t *cdp, ulong_t idx, ulong_t matchidx)
+{
+	ctf_id_t id = ctf_lookup_by_symbol(cdp->cd_ctfp, matchidx);
+
+	/*
+	 * If we matched something that for some reason didn't have type data,
+	 * we don't consider that a fatal error and silently swallow it.
+	 */
+	if (id == CTF_ERR) {
+		if (ctf_errno(cdp->cd_ctfp) == ECTF_NOTYPEDAT)
+			return (0);
+		else
+			return (ctf_errno(cdp->cd_ctfp));
+	}
+
+	if (ctf_add_object(cdp->cd_ctfp, idx, id) == CTF_ERR)
+		return (ctf_errno(cdp->cd_ctfp));
+
+	return (0);
+}
+
+static int
+ctf_dwarf_duplicate_func(ctf_die_t *cdp, ulong_t idx, ulong_t matchidx)
+{
+	int ret;
+	ctf_funcinfo_t fip;
+	ctf_id_t *args = NULL;
+
+	if (ctf_func_info(cdp->cd_ctfp, matchidx, &fip) == CTF_ERR) {
+		if (ctf_errno(cdp->cd_ctfp) == ECTF_NOFUNCDAT)
+			return (0);
+		else
+			return (ctf_errno(cdp->cd_ctfp));
+	}
+
+	if (fip.ctc_argc != 0) {
+		args = ctf_alloc(sizeof (ctf_id_t) * fip.ctc_argc);
+		if (args == NULL)
+			return (ENOMEM);
+
+		if (ctf_func_args(cdp->cd_ctfp, matchidx, fip.ctc_argc, args) ==
+		    CTF_ERR) {
+			ctf_free(args, sizeof (ctf_id_t) * fip.ctc_argc);
+			return (ctf_errno(cdp->cd_ctfp));
+		}
+	}
+
+	ret = ctf_add_function(cdp->cd_ctfp, idx, &fip, args);
+	if (args != NULL)
+		ctf_free(args, sizeof (ctf_id_t) * fip.ctc_argc);
+	if (ret == CTF_ERR)
+		return (ctf_errno(cdp->cd_ctfp));
+
+	return (0);
+}
+
+static int
+ctf_dwarf_conv_weaks_cb(ctf_die_t *cdp, const GElf_Sym *symp,
+    ulong_t idx, const char *file, const char *name, void *arg)
+{
+	int ret, type;
+	ctf_dwarf_weak_arg_t cweak;
+
+	/*
+	 * We only care about weak symbols.
+	 */
+	if (GELF_ST_BIND(symp->st_info) != STB_WEAK)
+		return (0);
+
+	type = GELF_ST_TYPE(symp->st_info);
+	ASSERT(type == STT_OBJECT || type == STT_FUNC);
+
+	/*
+	 * For each weak symbol we encounter, we need to do a second iteration
+	 * to try and find a match. We should probably think about other
+	 * techniques to try and save us time in the future.
+	 */
+	cweak.cweak_symp = symp;
+	cweak.cweak_file = file;
+	cweak.cweak_candidate = B_FALSE;
+	cweak.cweak_idx = 0;
+
+	ctf_dprintf("Trying to find weak equiv for %s\n", name);
+
+	ret = ctf_dwarf_symtab_iter(cdp, ctf_dwarf_conv_check_weak, &cweak);
+	VERIFY(ret == 0 || ret == 1);
+
+	/*
+	 * Nothing was ever found, we're not going to add anything for this
+	 * entry.
+	 */
+	if (ret == 0 && cweak.cweak_candidate == B_FALSE) {
+		ctf_dprintf("found no weak match for %s\n", name);
+		return (0);
+	}
+
+	/*
+	 * Now, finally go and add the type based on the match.
+	 */
+	if (type == STT_OBJECT) {
+		ret = ctf_dwarf_duplicate_sym(cdp, idx, cweak.cweak_idx);
+	} else {
+		ret = ctf_dwarf_duplicate_func(cdp, idx, cweak.cweak_idx);
+	}
+
+	return (ret);
+}
+
+static int
+ctf_dwarf_conv_weaks(ctf_die_t *cdp)
+{
+	return (ctf_dwarf_symtab_iter(cdp, ctf_dwarf_conv_weaks_cb, NULL));
+}
+
+/* ARGSUSED */
+static int
+ctf_dwarf_convert_one(void *arg, void *unused)
+{
+	int ret;
+	ctf_file_t *dedup;
+	ctf_die_t *cdp = arg;
+
+	ctf_dprintf("converting die: %s\n", cdp->cd_name);
+	ctf_dprintf("max offset: %x\n", cdp->cd_maxoff);
+	VERIFY(cdp != NULL);
+
+	ret = ctf_dwarf_convert_die(cdp, cdp->cd_cu);
+	ctf_dprintf("ctf_dwarf_convert_die (%s) returned %d\n", cdp->cd_name,
+	    ret);
+	if (ret != 0) {
+		return (ret);
+	}
+	if (ctf_update(cdp->cd_ctfp) != 0) {
+		return (ctf_dwarf_error(cdp, cdp->cd_ctfp, 0,
+		    "failed to update output ctf container"));
+	}
+
+	ret = ctf_dwarf_fixup_die(cdp, B_FALSE);
+	ctf_dprintf("ctf_dwarf_fixup_die (%s) returned %d\n", cdp->cd_name,
+	    ret);
+	if (ret != 0) {
+		return (ret);
+	}
+	if (ctf_update(cdp->cd_ctfp) != 0) {
+		return (ctf_dwarf_error(cdp, cdp->cd_ctfp, 0,
+		    "failed to update output ctf container"));
+	}
+
+	ret = ctf_dwarf_fixup_die(cdp, B_TRUE);
+	ctf_dprintf("ctf_dwarf_fixup_die (%s) returned %d\n", cdp->cd_name,
+	    ret);
+	if (ret != 0) {
+		return (ret);
+	}
+	if (ctf_update(cdp->cd_ctfp) != 0) {
+		return (ctf_dwarf_error(cdp, cdp->cd_ctfp, 0,
+		    "failed to update output ctf container"));
+	}
+
+
+	if ((ret = ctf_dwarf_conv_funcvars(cdp)) != 0) {
+		return (ctf_dwarf_error(cdp, NULL, ret,
+		    "failed to convert strong functions and variables"));
+	}
+
+	if (ctf_update(cdp->cd_ctfp) != 0) {
+		return (ctf_dwarf_error(cdp, cdp->cd_ctfp, 0,
+		    "failed to update output ctf container"));
+	}
+
+	if (cdp->cd_doweaks == B_TRUE) {
+		if ((ret = ctf_dwarf_conv_weaks(cdp)) != 0) {
+			return (ctf_dwarf_error(cdp, NULL, ret,
+			    "failed to convert weak functions and variables"));
+		}
+
+		if (ctf_update(cdp->cd_ctfp) != 0) {
+			return (ctf_dwarf_error(cdp, cdp->cd_ctfp, 0,
+			    "failed to update output ctf container"));
+		}
+	}
+
+	ctf_phase_dump(cdp->cd_ctfp, "pre-dedup");
+	ctf_dprintf("adding inputs for dedup\n");
+	if ((ret = ctf_merge_add(cdp->cd_cmh, cdp->cd_ctfp)) != 0) {
+		return (ctf_dwarf_error(cdp, NULL, ret,
+		    "failed to add inputs for merge"));
+	}
+
+	ctf_dprintf("starting merge\n");
+	if ((ret = ctf_merge_dedup(cdp->cd_cmh, &dedup)) != 0) {
+		return (ctf_dwarf_error(cdp, NULL, ret,
+		    "failed to deduplicate die"));
+	}
+	ctf_close(cdp->cd_ctfp);
+	cdp->cd_ctfp = dedup;
+
+	return (0);
+}
+
+/*
+ * Note, we expect that if we're returning a ctf_file_t from one of the dies,
+ * say in the single node case, it's been saved and the entry here has been set
+ * to NULL, which ctf_close happily ignores.
+ */
+static void
+ctf_dwarf_free_die(ctf_die_t *cdp)
+{
+	ctf_dwfunc_t *cdf, *ndf;
+	ctf_dwvar_t *cdv, *ndv;
+	ctf_dwbitf_t *cdb, *ndb;
+	ctf_dwmap_t *map;
+	void *cookie;
+	Dwarf_Error derr;
+
+	ctf_dprintf("Beginning to free die: %p\n", cdp);
+	cdp->cd_elf = NULL;
+	ctf_dprintf("Trying to free name: %p\n", cdp->cd_name);
+	if (cdp->cd_name != NULL)
+		ctf_free(cdp->cd_name, strlen(cdp->cd_name) + 1);
+	ctf_dprintf("Trying to free merge handle: %p\n", cdp->cd_cmh);
+	if (cdp->cd_cmh != NULL) {
+		ctf_merge_fini(cdp->cd_cmh);
+		cdp->cd_cmh = NULL;
+	}
+
+	ctf_dprintf("Trying to free functions\n");
+	for (cdf = ctf_list_next(&cdp->cd_funcs); cdf != NULL; cdf = ndf) {
+		ndf = ctf_list_next(cdf);
+		ctf_free(cdf->cdf_name, strlen(cdf->cdf_name) + 1);
+		if (cdf->cdf_fip.ctc_argc != 0) {
+			ctf_free(cdf->cdf_argv,
+			    sizeof (ctf_id_t) * cdf->cdf_fip.ctc_argc);
+		}
+		ctf_free(cdf, sizeof (ctf_dwfunc_t));
+	}
+
+	ctf_dprintf("Trying to free variables\n");
+	for (cdv = ctf_list_next(&cdp->cd_vars); cdv != NULL; cdv = ndv) {
+		ndv = ctf_list_next(cdv);
+		ctf_free(cdv->cdv_name, strlen(cdv->cdv_name) + 1);
+		ctf_free(cdv, sizeof (ctf_dwvar_t));
+	}
+
+	ctf_dprintf("Trying to free bitfields\n");
+	for (cdb = ctf_list_next(&cdp->cd_bitfields); cdb != NULL; cdb = ndb) {
+		ndb = ctf_list_next(cdb);
+		ctf_free(cdb, sizeof (ctf_dwbitf_t));
+	}
+
+	/* How do we clean up die usage? */
+	ctf_dprintf("Trying to clean up dwarf_t: %p\n", cdp->cd_dwarf);
+	(void) dwarf_finish(cdp->cd_dwarf, &derr);
+	cdp->cd_dwarf = NULL;
+	ctf_close(cdp->cd_ctfp);
+
+	cookie = NULL;
+	while ((map = avl_destroy_nodes(&cdp->cd_map, &cookie)) != NULL) {
+		ctf_free(map, sizeof (ctf_dwmap_t));
+	}
+	avl_destroy(&cdp->cd_map);
+	cdp->cd_errbuf = NULL;
+}
+
+static void
+ctf_dwarf_free_dies(ctf_die_t *cdies, int ndies)
+{
+	int i;
+
+	ctf_dprintf("Beginning to free dies\n");
+	for (i = 0; i < ndies; i++) {
+		ctf_dwarf_free_die(&cdies[i]);
+	}
+
+	ctf_free(cdies, sizeof (ctf_die_t) * ndies);
+}
+
+static int
+ctf_dwarf_count_dies(Dwarf_Debug dw, Dwarf_Error *derr, int *ndies,
+    char *errbuf, size_t errlen)
+{
+	int ret;
+	Dwarf_Half vers;
+	Dwarf_Unsigned nexthdr;
+
+	while ((ret = dwarf_next_cu_header(dw, NULL, &vers, NULL, NULL,
+	    &nexthdr, derr)) != DW_DLV_NO_ENTRY) {
+		if (ret != DW_DLV_OK) {
+			(void) snprintf(errbuf, errlen,
+			    "file does not contain valid DWARF data: %s\n",
+			    dwarf_errmsg(*derr));
+			return (ECTF_CONVBKERR);
+		}
+
+		if (vers != DWARF_VERSION_TWO) {
+			(void) snprintf(errbuf, errlen,
+			    "unsupported DWARF version: %d\n", vers);
+			return (ECTF_CONVBKERR);
+		}
+		*ndies = *ndies + 1;
+	}
+
+	if (*ndies == 0) {
+		(void) snprintf(errbuf, errlen,
+		    "file does not contain valid DWARF data: %s\n",
+		    dwarf_errmsg(*derr));
+		return (ECTF_CONVBKERR);
+	}
+
+	return (0);
+}
+
+/*
+ * Iterate over all of the dies and create a ctf_die_t for each of them. This is
+ * used to determine if we have zero, one, or multiple dies to convert. If we
+ * have zero, that's an error. If there's only one die, that's the simple case.
+ * No merge needed and only a single Dwarf_Debug as well.
+ */
+static int
+ctf_dwarf_init_die(int fd, Elf *elf, ctf_die_t *cdp, int ndie, char *errbuf,
+    size_t errlen)
+{
+	int ret;
+	Dwarf_Unsigned hdrlen, abboff, nexthdr;
+	Dwarf_Half addrsz;
+	Dwarf_Unsigned offset = 0;
+	Dwarf_Error derr;
+
+	while ((ret = dwarf_next_cu_header(cdp->cd_dwarf, &hdrlen, NULL,
+	    &abboff, &addrsz, &nexthdr, &derr)) != DW_DLV_NO_ENTRY) {
+		char *name;
+		Dwarf_Die cu, child;
+
+		/* Based on the counting above, we should be good to go */
+		VERIFY(ret == DW_DLV_OK);
+		if (ndie > 0) {
+			ndie--;
+			offset = nexthdr;
+			continue;
+		}
+
+		/*
+		 * Compilers are apparently inconsistent. Some emit no DWARF for
+		 * empty files and others emit empty compilation unit.
+		 */
+		cdp->cd_voidtid = CTF_ERR;
+		cdp->cd_longtid = CTF_ERR;
+		cdp->cd_elf = elf;
+		cdp->cd_maxoff = nexthdr - 1;
+		cdp->cd_ctfp = ctf_fdcreate(fd, &ret);
+		if (cdp->cd_ctfp == NULL) {
+			ctf_free(cdp, sizeof (ctf_die_t));
+			return (ret);
+		}
+		avl_create(&cdp->cd_map, ctf_dwmap_comp, sizeof (ctf_dwmap_t),
+		    offsetof(ctf_dwmap_t, cdm_avl));
+		cdp->cd_errbuf = errbuf;
+		cdp->cd_errlen = errlen;
+		bzero(&cdp->cd_vars, sizeof (ctf_list_t));
+		bzero(&cdp->cd_funcs, sizeof (ctf_list_t));
+		bzero(&cdp->cd_bitfields, sizeof (ctf_list_t));
+
+		if ((ret = ctf_dwarf_die_elfenc(elf, cdp, errbuf,
+		    errlen)) != 0) {
+			avl_destroy(&cdp->cd_map);
+			ctf_free(cdp, sizeof (ctf_die_t));
+			return (ret);
+		}
+
+		if ((ret = ctf_dwarf_sib(cdp, NULL, &cu)) != 0) {
+			avl_destroy(&cdp->cd_map);
+			ctf_free(cdp, sizeof (ctf_die_t));
+			return (ret);
+		}
+		if (cu == NULL) {
+			(void) snprintf(errbuf, errlen,
+			    "file does not contain DWARF data\n");
+			avl_destroy(&cdp->cd_map);
+			ctf_free(cdp, sizeof (ctf_die_t));
+			return (ECTF_CONVBKERR);
+		}
+
+		if ((ret = ctf_dwarf_child(cdp, cu, &child)) != 0) {
+			avl_destroy(&cdp->cd_map);
+			ctf_free(cdp, sizeof (ctf_die_t));
+			return (ret);
+		}
+		if (child == NULL) {
+			(void) snprintf(errbuf, errlen,
+			    "file does not contain DWARF data\n");
+			avl_destroy(&cdp->cd_map);
+			ctf_free(cdp, sizeof (ctf_die_t));
+			return (ECTF_CONVBKERR);
+		}
+
+		cdp->cd_cuoff = offset;
+		cdp->cd_cu = child;
+
+		if ((cdp->cd_cmh = ctf_merge_init(fd, &ret)) == NULL) {
+			avl_destroy(&cdp->cd_map);
+			ctf_free(cdp, sizeof (ctf_die_t));
+			return (ret);
+		}
+
+		if (ctf_dwarf_string(cdp, cu, DW_AT_name, &name) == 0) {
+			size_t len = strlen(name) + 1;
+			char *b = basename(name);
+			cdp->cd_name = strdup(b);
+			ctf_free(name, len);
+		}
+		break;
+	}
+
+	return (0);
+}
+
+
+ctf_conv_status_t
+ctf_dwarf_convert(int fd, Elf *elf, uint_t nthrs, int *errp, ctf_file_t **fpp,
+    char *errmsg, size_t errlen)
+{
+	int err, ret, ndies, i;
+	Dwarf_Debug dw;
+	Dwarf_Error derr;
+	ctf_die_t *cdies = NULL, *cdp;
+	workq_t *wqp = NULL;
+
+	if (errp == NULL)
+		errp = &err;
+	*errp = 0;
+	*fpp = NULL;
+
+	ret = dwarf_elf_init(elf, DW_DLC_READ, NULL, NULL, &dw, &derr);
+	if (ret != DW_DLV_OK) {
+		/*
+		 * The old CTF tools used to check if we expected DWARF data
+		 * here. In this case, if we actually have some amount of DWARF,
+		 * but no section, for now, just go ahead and create an empty
+		 * CTF file.
+		 */
+		if (ret == DW_DLV_NO_ENTRY ||
+		    dwarf_errno(derr) == DW_DLE_DEBUG_INFO_NULL) {
+			*fpp = ctf_create(errp);
+			return (*fpp != NULL ? CTF_CONV_SUCCESS :
+			    CTF_CONV_ERROR);
+		}
+		(void) snprintf(errmsg, errlen,
+		    "failed to initialize DWARF: %s\n",
+		    dwarf_errmsg(derr));
+		*errp = ECTF_CONVBKERR;
+		return (CTF_CONV_ERROR);
+	}
+
+	ndies = 0;
+	ret = ctf_dwarf_count_dies(dw, &derr, &ndies, errmsg, errlen);
+	if (ret != 0) {
+		*errp = ret;
+		goto out;
+	}
+
+	(void) dwarf_finish(dw, &derr);
+	cdies = ctf_alloc(sizeof (ctf_die_t) * ndies);
+	if (cdies == NULL) {
+		*errp = ENOMEM;
+		return (CTF_CONV_ERROR);
+	}
+
+	for (i = 0; i < ndies; i++) {
+		cdp = &cdies[i];
+		ret = dwarf_elf_init(elf, DW_DLC_READ, NULL, NULL,
+		    &cdp->cd_dwarf, &derr);
+		if (ret != 0) {
+			ctf_free(cdies, sizeof (ctf_die_t) * ndies);
+			(void) snprintf(errmsg, errlen,
+			    "failed to initialize DWARF: %s\n",
+			    dwarf_errmsg(derr));
+			*errp = ECTF_CONVBKERR;
+			return (CTF_CONV_ERROR);
+		}
+
+		ret = ctf_dwarf_init_die(fd, elf, &cdies[i], i, errmsg, errlen);
+		if (ret != 0) {
+			*errp = ret;
+			goto out;
+		}
+		cdp->cd_doweaks = ndies > 1 ? B_FALSE : B_TRUE;
+	}
+
+	ctf_dprintf("found %d DWARF die(s)\n", ndies);
+
+	/*
+	 * If we only have one die, there's no reason to use multiple threads,
+	 * even if the user requested them. After all, they just gave us an
+	 * upper bound.
+	 */
+	if (ndies == 1)
+		nthrs = 1;
+
+	if (workq_init(&wqp, nthrs) == -1) {
+		*errp = errno;
+		goto out;
+	}
+
+	for (i = 0; i < ndies; i++) {
+		cdp = &cdies[i];
+		ctf_dprintf("adding die %s: %p, %x %x\n", cdp->cd_name,
+		    cdp->cd_cu, cdp->cd_cuoff, cdp->cd_maxoff);
+		if (workq_add(wqp, cdp) == -1) {
+			*errp = errno;
+			goto out;
+		}
+	}
+
+	ret = workq_work(wqp, ctf_dwarf_convert_one, NULL, errp);
+	if (ret == WORKQ_ERROR) {
+		*errp = errno;
+		goto out;
+	} else if (ret == WORKQ_UERROR) {
+		ctf_dprintf("internal convert failed: %s\n",
+		    ctf_errmsg(*errp));
+		goto out;
+	}
+
+	ctf_dprintf("Determining next phase: have %d dies\n", ndies);
+	if (ndies != 1) {
+		ctf_merge_t *cmp;
+
+		cmp = ctf_merge_init(fd, &ret);
+		if (cmp == NULL) {
+			*errp = ret;
+			goto out;
+		}
+
+		ctf_dprintf("setting threads\n");
+		if ((ret = ctf_merge_set_nthreads(cmp, nthrs)) != 0) {
+			ctf_merge_fini(cmp);
+			*errp = ret;
+			goto out;
+		}
+
+		ctf_dprintf("adding dies\n");
+		for (i = 0; i < ndies; i++) {
+			cdp = &cdies[i];
+			if ((ret = ctf_merge_add(cmp, cdp->cd_ctfp)) != 0) {
+				ctf_merge_fini(cmp);
+				*errp = ret;
+				goto out;
+			}
+		}
+
+		ctf_dprintf("performing merge\n");
+		ret = ctf_merge_merge(cmp, fpp);
+		if (ret != 0) {
+			ctf_dprintf("failed merge!\n");
+			*fpp = NULL;
+			ctf_merge_fini(cmp);
+			*errp = ret;
+			goto out;
+		}
+		ctf_merge_fini(cmp);
+		*errp = 0;
+		ctf_dprintf("successfully converted!\n");
+	} else {
+		*errp = 0;
+		*fpp = cdies->cd_ctfp;
+		cdies->cd_ctfp = NULL;
+		ctf_dprintf("successfully converted!\n");
+	}
+
+out:
+	workq_fini(wqp);
+	ctf_dwarf_free_dies(cdies, ndies);
+	return (*fpp != NULL ? CTF_CONV_SUCCESS : CTF_CONV_ERROR);
+}
diff --git a/usr/src/lib/libctf/common/ctf_elfwrite.c b/usr/src/lib/libctf/common/ctf_elfwrite.c
new file mode 100644
index 0000000000..4d7c10aeec
--- /dev/null
+++ b/usr/src/lib/libctf/common/ctf_elfwrite.c
@@ -0,0 +1,422 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
+
+/*
+ * Routines for writing ctf data to elf files, originally from the ctf tools.
+ */
+
+#include <libctf_impl.h>
+#include <libctf.h>
+#include <gelf.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <unistd.h>
+#include <libelf.h>
+
+static int
+ctf_write_elf(ctf_file_t *fp, Elf *src, Elf *dst, int flags)
+{
+	GElf_Ehdr sehdr, dehdr;
+	Elf_Scn *sscn, *dscn;
+	Elf_Data *sdata, *ddata;
+	GElf_Shdr shdr;
+	int symtab_idx = -1;
+	off_t new_offset = 0;
+	off_t ctfnameoff = 0;
+	int compress = (flags & CTF_ELFWRITE_F_COMPRESS);
+	int *secxlate = NULL;
+	int srcidx, dstidx, pad, i;
+	int curnmoff = 0;
+	int changing = 0;
+	int ret;
+	size_t nshdr, nphdr, strndx;
+	void *strdatabuf = NULL, *symdatabuf = NULL;
+	size_t strdatasz = 0, symdatasz = 0;
+
+	void *cdata = NULL;
+	size_t elfsize, asize;
+
+	if ((flags & ~(CTF_ELFWRITE_F_COMPRESS)) != 0) {
+		ret = ctf_set_errno(fp, EINVAL);
+		goto out;
+	}
+
+	if (gelf_newehdr(dst, gelf_getclass(src)) == NULL) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+	if (gelf_getehdr(src, &sehdr) == NULL) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+	(void) memcpy(&dehdr, &sehdr, sizeof (GElf_Ehdr));
+	if (gelf_update_ehdr(dst, &dehdr) == 0) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+
+	/*
+	 * Use libelf to get the number of sections and the string section to
+	 * deal with ELF files that may have a large number of sections. We just
+	 * always use this to make our live easier.
+	 */
+	if (elf_getphdrnum(src, &nphdr) != 0) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+	if (elf_getshdrnum(src, &nshdr) != 0) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+	if (elf_getshdrstrndx(src, &strndx) != 0) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+
+	/*
+	 * Neither the existing debug sections nor the SUNW_ctf sections (new or
+	 * existing) are SHF_ALLOC'd, so they won't be in areas referenced by
+	 * program headers.  As such, we can just blindly copy the program
+	 * headers from the existing file to the new file.
+	 */
+	if (nphdr != 0) {
+		(void) elf_flagelf(dst, ELF_C_SET, ELF_F_LAYOUT);
+		if (gelf_newphdr(dst, nphdr) == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+
+		for (i = 0; i < nphdr; i++) {
+			GElf_Phdr phdr;
+
+			if (gelf_getphdr(src, i, &phdr) == NULL) {
+				ret = ctf_set_errno(fp, ECTF_ELF);
+				goto out;
+			}
+			if (gelf_update_phdr(dst, i, &phdr) == 0) {
+				ret = ctf_set_errno(fp, ECTF_ELF);
+				goto out;
+			}
+		}
+	}
+
+	secxlate = ctf_alloc(sizeof (int) * nshdr);
+	for (srcidx = dstidx = 0; srcidx < nshdr; srcidx++) {
+		Elf_Scn *scn = elf_getscn(src, srcidx);
+		GElf_Shdr shdr;
+		char *sname;
+
+		if (gelf_getshdr(scn, &shdr) == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+		sname = elf_strptr(src, strndx, shdr.sh_name);
+		if (sname == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+
+		if (strcmp(sname, CTF_ELF_SCN_NAME) == 0) {
+			secxlate[srcidx] = -1;
+		} else {
+			secxlate[srcidx] = dstidx++;
+			curnmoff += strlen(sname) + 1;
+		}
+
+		new_offset = (off_t)dehdr.e_phoff;
+	}
+
+	for (srcidx = 1; srcidx < nshdr; srcidx++) {
+		char *sname;
+
+		sscn = elf_getscn(src, srcidx);
+		if (gelf_getshdr(sscn, &shdr) == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+
+		if (secxlate[srcidx] == -1) {
+			changing = 1;
+			continue;
+		}
+
+		dscn = elf_newscn(dst);
+		if (dscn == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+
+		/*
+		 * If this file has program headers, we need to explicitly lay
+		 * out sections.  If none of the sections prior to this one have
+		 * been removed, then we can just use the existing location.  If
+		 * one or more sections have been changed, then we need to
+		 * adjust this one to avoid holes.
+		 */
+		if (changing && nphdr != 0) {
+			pad = new_offset % shdr.sh_addralign;
+
+			if (pad != 0)
+				new_offset += shdr.sh_addralign - pad;
+			shdr.sh_offset = new_offset;
+		}
+
+		shdr.sh_link = secxlate[shdr.sh_link];
+
+		if (shdr.sh_type == SHT_REL || shdr.sh_type == SHT_RELA)
+			shdr.sh_info = secxlate[shdr.sh_info];
+
+		sname = elf_strptr(src, strndx, shdr.sh_name);
+		if (sname == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+		if ((sdata = elf_getdata(sscn, NULL)) == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+		if ((ddata = elf_newdata(dscn)) == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+		bcopy(sdata, ddata, sizeof (Elf_Data));
+
+		if (srcidx == strndx) {
+			char seclen = strlen(CTF_ELF_SCN_NAME);
+
+			strdatasz = ddata->d_size + shdr.sh_size +
+			    seclen + 1;
+			ddata->d_buf = strdatabuf = ctf_alloc(strdatasz);
+			if (ddata->d_buf == NULL) {
+				ret = ctf_set_errno(fp, ECTF_ELF);
+				goto out;
+			}
+			bcopy(sdata->d_buf, ddata->d_buf, shdr.sh_size);
+			(void) strcpy((caddr_t)ddata->d_buf + shdr.sh_size,
+			    CTF_ELF_SCN_NAME);
+			ctfnameoff = (off_t)shdr.sh_size;
+			shdr.sh_size += seclen + 1;
+			ddata->d_size += seclen + 1;
+
+			if (nphdr != 0)
+				changing = 1;
+		}
+
+		if (shdr.sh_type == SHT_SYMTAB && shdr.sh_entsize != 0) {
+			int nsym = shdr.sh_size / shdr.sh_entsize;
+
+			symtab_idx = secxlate[srcidx];
+
+			symdatasz = shdr.sh_size;
+			ddata->d_buf = symdatabuf = ctf_alloc(symdatasz);
+			if (ddata->d_buf == NULL) {
+				ret = ctf_set_errno(fp, ECTF_ELF);
+				goto out;
+			}
+			(void) bcopy(sdata->d_buf, ddata->d_buf, shdr.sh_size);
+
+			for (i = 0; i < nsym; i++) {
+				GElf_Sym sym;
+				short newscn;
+
+				(void) gelf_getsym(ddata, i, &sym);
+
+				if (sym.st_shndx >= SHN_LORESERVE)
+					continue;
+
+				if ((newscn = secxlate[sym.st_shndx]) !=
+				    sym.st_shndx) {
+					sym.st_shndx =
+					    (newscn == -1 ? 1 : newscn);
+
+					if (gelf_update_sym(ddata, i, &sym) ==
+					    0) {
+						ret = ctf_set_errno(fp,
+						    ECTF_ELF);
+						goto out;
+					}
+				}
+			}
+		}
+
+		if (gelf_update_shdr(dscn, &shdr) == NULL) {
+			ret = ctf_set_errno(fp, ECTF_ELF);
+			goto out;
+		}
+
+		new_offset = (off_t)shdr.sh_offset;
+		if (shdr.sh_type != SHT_NOBITS)
+			new_offset += shdr.sh_size;
+	}
+
+	if (symtab_idx == -1) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+
+	/* Add the ctf section */
+	if ((dscn = elf_newscn(dst)) == NULL) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+	if (gelf_getshdr(dscn, &shdr) == NULL) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+	shdr.sh_name = ctfnameoff;
+	shdr.sh_type = SHT_PROGBITS;
+	shdr.sh_size = fp->ctf_size;
+	shdr.sh_link = symtab_idx;
+	shdr.sh_addralign = 4;
+	if (changing && nphdr != 0) {
+		pad = new_offset % shdr.sh_addralign;
+
+		if (pad)
+			new_offset += shdr.sh_addralign - pad;
+
+		shdr.sh_offset = new_offset;
+		new_offset += shdr.sh_size;
+	}
+
+	if ((ddata = elf_newdata(dscn)) == NULL) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+
+	if (compress != 0) {
+		int err;
+
+		if (ctf_zopen(&err) == NULL) {
+			ret = ctf_set_errno(fp, err);
+			goto out;
+		}
+
+		if ((err = ctf_compress(fp, &cdata, &asize, &elfsize)) != 0) {
+			ret = ctf_set_errno(fp, err);
+			goto out;
+		}
+		ddata->d_buf = cdata;
+		ddata->d_size = elfsize;
+	} else {
+		ddata->d_buf = (void *)fp->ctf_base;
+		ddata->d_size = fp->ctf_size;
+	}
+	ddata->d_align = shdr.sh_addralign;
+
+	if (gelf_update_shdr(dscn, &shdr) == 0) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+
+	/* update the section header location */
+	if (nphdr != 0) {
+		size_t align = gelf_fsize(dst, ELF_T_ADDR, 1, EV_CURRENT);
+		size_t r = new_offset % align;
+
+		if (r)
+			new_offset += align - r;
+
+		dehdr.e_shoff = new_offset;
+	}
+
+	/* commit to disk */
+	if (sehdr.e_shstrndx == SHN_XINDEX)
+		dehdr.e_shstrndx = SHN_XINDEX;
+	else
+		dehdr.e_shstrndx = secxlate[sehdr.e_shstrndx];
+	if (gelf_update_ehdr(dst, &dehdr) == NULL) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+	if (elf_update(dst, ELF_C_WRITE) < 0) {
+		ret = ctf_set_errno(fp, ECTF_ELF);
+		goto out;
+	}
+
+	ret = 0;
+
+out:
+	if (strdatabuf != NULL)
+		ctf_free(strdatabuf, strdatasz);
+	if (symdatabuf != NULL)
+		ctf_free(symdatabuf, symdatasz);
+	if (cdata != NULL)
+		ctf_data_free(cdata, fp->ctf_size);
+	if (secxlate != NULL)
+		ctf_free(secxlate, sizeof (int) * nshdr);
+
+	return (ret);
+}
+
+int
+ctf_elffdwrite(ctf_file_t *fp, int ifd, int ofd, int flags)
+{
+	int ret;
+	Elf *ielf, *oelf;
+
+	(void) elf_version(EV_CURRENT);
+	if ((ielf = elf_begin(ifd, ELF_C_READ, NULL)) == NULL)
+		return (ctf_set_errno(fp, ECTF_ELF));
+
+	if ((oelf = elf_begin(ofd, ELF_C_WRITE, NULL)) == NULL)
+		return (ctf_set_errno(fp, ECTF_ELF));
+
+	ret = ctf_write_elf(fp, ielf, oelf, flags);
+
+	(void) elf_end(ielf);
+	(void) elf_end(oelf);
+
+	return (ret);
+}
+
+int
+ctf_elfwrite(ctf_file_t *fp, const char *input, const char *output, int flags)
+{
+	struct stat st;
+	int ifd, ofd, ret;
+
+	if ((ifd = open(input, O_RDONLY)) < 0)
+		return (ctf_set_errno(fp, errno));
+
+	if (fstat(ifd, &st) < 0)
+		return (ctf_set_errno(fp, errno));
+
+	if ((ofd = open(output, O_RDWR | O_CREAT | O_TRUNC, st.st_mode)) < 0)
+		return (ctf_set_errno(fp, errno));
+
+	ret = ctf_elffdwrite(fp, ifd, ofd, flags);
+
+	if (close(ifd) != 0 && ret != 0)
+		ret = ctf_set_errno(fp, errno);
+	if (close(ofd) != 0 && ret != 0)
+		ret = ctf_set_errno(fp, errno);
+
+	return (ret);
+}
diff --git a/usr/src/lib/libctf/common/ctf_lib.c b/usr/src/lib/libctf/common/ctf_lib.c
index e71ebc6d9d..6b637ba663 100644
--- a/usr/src/lib/libctf/common/ctf_lib.c
+++ b/usr/src/lib/libctf/common/ctf_lib.c
@@ -23,6 +23,9 @@
  * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -33,6 +36,9 @@
 #include <errno.h>
 #include <dlfcn.h>
 #include <gelf.h>
+#include <zlib.h>
+#include <zone.h>
+#include <sys/debug.h>
 
 #ifdef _LP64
 static const char *_libctf_zlib = "/usr/lib/64/libz.so.1";
@@ -42,6 +48,9 @@ static const char *_libctf_zlib = "/usr/lib/libz.so.1";
 
 static struct {
 	int (*z_uncompress)(uchar_t *, ulong_t *, const uchar_t *, ulong_t);
+	int (*z_initcomp)(z_stream *, int, const char *, int);
+	int (*z_compress)(z_stream *, int);
+	int (*z_finicomp)(z_stream *);
 	const char *(*z_error)(int);
 	void *z_dlp;
 } zlib;
@@ -49,6 +58,18 @@ static struct {
 static size_t _PAGESIZE;
 static size_t _PAGEMASK;
 
+static uint64_t ctf_phase = 0;
+
+#define	CTF_COMPRESS_CHUNK	(64*1024)
+
+typedef struct ctf_zdata {
+	void		*czd_buf;
+	void		*czd_next;
+	ctf_file_t	*czd_ctfp;
+	size_t		czd_allocsz;
+	z_stream	czd_zstr;
+} ctf_zdata_t;
+
 #pragma init(_libctf_init)
 void
 _libctf_init(void)
@@ -72,21 +93,47 @@ _libctf_init(void)
 void *
 ctf_zopen(int *errp)
 {
-	ctf_dprintf("decompressing CTF data using %s\n", _libctf_zlib);
+	char buf[MAXPATHLEN];
+	const char *path = _libctf_zlib, *zroot;
 
 	if (zlib.z_dlp != NULL)
 		return (zlib.z_dlp); /* library is already loaded */
 
-	if (access(_libctf_zlib, R_OK) == -1)
+	/*
+	 * Get the zone native root.  For the tools build, we don't need
+	 * this (it seems fair to impose that we always build the system in
+	 * a native zone), and we want to allow build machines that are older
+	 * that the notion of the native root, so we only actually make this
+	 * call if we're not the tools build.
+	 */
+#ifndef	CTF_TOOLS_BUILD
+	zroot = zone_get_nroot();
+#else
+	zroot = NULL;
+#endif
+
+	if (zroot != NULL) {
+		(void) snprintf(buf, MAXPATHLEN, "%s/%s", zroot, _libctf_zlib);
+		path = buf;
+	}
+
+	ctf_dprintf("decompressing CTF data using %s\n", path);
+
+	if (access(path, R_OK) == -1)
 		return (ctf_set_open_errno(errp, ECTF_ZMISSING));
 
-	if ((zlib.z_dlp = dlopen(_libctf_zlib, RTLD_LAZY | RTLD_LOCAL)) == NULL)
+	if ((zlib.z_dlp = dlopen(path, RTLD_LAZY | RTLD_LOCAL)) == NULL)
 		return (ctf_set_open_errno(errp, ECTF_ZINIT));
 
 	zlib.z_uncompress = (int (*)()) dlsym(zlib.z_dlp, "uncompress");
+	zlib.z_initcomp = (int (*)()) dlsym(zlib.z_dlp, "deflateInit_");
+	zlib.z_compress = (int (*)()) dlsym(zlib.z_dlp, "deflate");
+	zlib.z_finicomp = (int (*)()) dlsym(zlib.z_dlp, "deflateEnd");
 	zlib.z_error = (const char *(*)()) dlsym(zlib.z_dlp, "zError");
 
-	if (zlib.z_uncompress == NULL || zlib.z_error == NULL) {
+	if (zlib.z_uncompress == NULL || zlib.z_error == NULL ||
+	    zlib.z_initcomp == NULL|| zlib.z_compress == NULL ||
+	    zlib.z_finicomp == NULL) {
 		(void) dlclose(zlib.z_dlp);
 		bzero(&zlib, sizeof (zlib));
 		return (ctf_set_open_errno(errp, ECTF_ZINIT));
@@ -111,6 +158,207 @@ z_strerror(int err)
 	return (zlib.z_error(err));
 }
 
+static int
+ctf_zdata_init(ctf_zdata_t *czd, ctf_file_t *fp)
+{
+	int err;
+	ctf_header_t *cthp;
+
+	bzero(czd, sizeof (ctf_zdata_t));
+
+	czd->czd_allocsz = fp->ctf_size;
+	czd->czd_buf = ctf_data_alloc(czd->czd_allocsz);
+	if (czd->czd_buf == MAP_FAILED)
+		return (ctf_set_errno(fp, ENOMEM));
+
+	bcopy(fp->ctf_base, czd->czd_buf, sizeof (ctf_header_t));
+	czd->czd_ctfp = fp;
+	cthp = czd->czd_buf;
+	cthp->cth_flags |= CTF_F_COMPRESS;
+	czd->czd_next = (void *)((uintptr_t)czd->czd_buf +
+	    sizeof (ctf_header_t));
+
+	if ((err = zlib.z_initcomp(&czd->czd_zstr, Z_BEST_COMPRESSION,
+	    ZLIB_VERSION, sizeof (z_stream))) != Z_OK)
+		return (ctf_set_errno(fp, ECTF_ZLIB));
+
+	return (0);
+}
+
+static int
+ctf_zdata_grow(ctf_zdata_t *czd)
+{
+	size_t off;
+	size_t newsz;
+	void *ndata;
+
+	off = (uintptr_t)czd->czd_next - (uintptr_t)czd->czd_buf;
+	newsz = czd->czd_allocsz + CTF_COMPRESS_CHUNK;
+	ndata = ctf_data_alloc(newsz);
+	if (ndata == MAP_FAILED) {
+		return (ctf_set_errno(czd->czd_ctfp, ENOMEM));
+	}
+
+	bcopy(czd->czd_buf, ndata, off);
+	ctf_data_free(czd->czd_buf, czd->czd_allocsz);
+	czd->czd_allocsz = newsz;
+	czd->czd_buf = ndata;
+	czd->czd_next = (void *)((uintptr_t)ndata + off);
+
+	czd->czd_zstr.next_out = (Bytef *)czd->czd_next;
+	czd->czd_zstr.avail_out = CTF_COMPRESS_CHUNK;
+	return (0);
+}
+
+static int
+ctf_zdata_compress_buffer(ctf_zdata_t *czd, const void *buf, size_t bufsize)
+{
+	int err;
+
+	czd->czd_zstr.next_out = czd->czd_next;
+	czd->czd_zstr.avail_out = czd->czd_allocsz -
+	    (czd->czd_next - czd->czd_buf);
+	czd->czd_zstr.next_in = (Bytef *)buf;
+	czd->czd_zstr.avail_in = bufsize;
+
+	while (czd->czd_zstr.avail_in != 0) {
+		if (czd->czd_zstr.avail_out == 0) {
+			czd->czd_next = czd->czd_zstr.next_out;
+			if ((err = ctf_zdata_grow(czd)) != 0) {
+				return (err);
+			}
+		}
+
+		if ((err = zlib.z_compress(&czd->czd_zstr, Z_NO_FLUSH)) != Z_OK)
+			return (ctf_set_errno(czd->czd_ctfp, ECTF_ZLIB));
+	}
+	czd->czd_next = czd->czd_zstr.next_out;
+
+	return (0);
+}
+
+static int
+ctf_zdata_flush(ctf_zdata_t *czd, boolean_t finish)
+{
+	int err;
+	int flag = finish == B_TRUE ? Z_FINISH : Z_FULL_FLUSH;
+	int bret = finish == B_TRUE ? Z_STREAM_END : Z_BUF_ERROR;
+
+	for (;;) {
+		if (czd->czd_zstr.avail_out == 0) {
+			czd->czd_next = czd->czd_zstr.next_out;
+			if ((err = ctf_zdata_grow(czd)) != 0) {
+				return (err);
+			}
+		}
+
+		err = zlib.z_compress(&czd->czd_zstr, flag);
+		if (err == bret) {
+			break;
+		}
+		if (err != Z_OK)
+			return (ctf_set_errno(czd->czd_ctfp, ECTF_ZLIB));
+
+	}
+
+	czd->czd_next = czd->czd_zstr.next_out;
+
+	return (0);
+}
+
+static int
+ctf_zdata_end(ctf_zdata_t *czd)
+{
+	int ret;
+
+	if ((ret = ctf_zdata_flush(czd, B_TRUE)) != 0)
+		return (ret);
+
+	if ((ret = zlib.z_finicomp(&czd->czd_zstr)) != 0)
+		return (ctf_set_errno(czd->czd_ctfp, ECTF_ZLIB));
+
+	return (0);
+}
+
+static void
+ctf_zdata_cleanup(ctf_zdata_t *czd)
+{
+	ctf_data_free(czd->czd_buf, czd->czd_allocsz);
+	(void) zlib.z_finicomp(&czd->czd_zstr);
+}
+
+/*
+ * Compress our CTF data and return both the size of the compressed data and the
+ * size of the allocation. These may be different due to the nature of
+ * compression.
+ *
+ * In addition, we flush the compression inbetween our two phases such that we
+ * maintain a different dictionary bbetween the CTF data and the string section.
+ */
+int
+ctf_compress(ctf_file_t *fp, void **buf, size_t *allocsz, size_t *elfsize)
+{
+	int err;
+	ctf_zdata_t czd;
+	ctf_header_t *cthp = (ctf_header_t *)fp->ctf_base;
+
+	if ((err = ctf_zdata_init(&czd, fp)) != 0)
+		return (err);
+
+	if ((err = ctf_zdata_compress_buffer(&czd, fp->ctf_buf,
+	    cthp->cth_stroff)) != 0) {
+		ctf_zdata_cleanup(&czd);
+		return (err);
+	}
+
+	if ((err = ctf_zdata_flush(&czd, B_FALSE)) != 0) {
+		ctf_zdata_cleanup(&czd);
+		return (err);
+	}
+
+	if ((err = ctf_zdata_compress_buffer(&czd,
+	    fp->ctf_buf + cthp->cth_stroff, cthp->cth_strlen)) != 0) {
+		ctf_zdata_cleanup(&czd);
+		return (err);
+	}
+
+	if ((err = ctf_zdata_end(&czd)) != 0) {
+		ctf_zdata_cleanup(&czd);
+		return (err);
+	}
+
+	*buf = czd.czd_buf;
+	*allocsz = czd.czd_allocsz;
+	*elfsize = (uintptr_t)(czd.czd_next - czd.czd_buf);
+
+	return (0);
+}
+
+int
+z_compress(void *dst, size_t *dstlen, const void *src, size_t srclen)
+{
+	z_stream zs;
+	int err;
+
+	bzero(&zs, sizeof (z_stream));
+	zs.next_in = (uchar_t *)src;
+	zs.avail_in = srclen;
+	zs.next_out = dst;
+	zs.avail_out = *dstlen;
+
+	if ((err = zlib.z_initcomp(&zs, Z_BEST_COMPRESSION, ZLIB_VERSION,
+	    sizeof (z_stream))) != Z_OK)
+		return (err);
+
+	if ((err = zlib.z_compress(&zs, Z_FINISH)) != Z_STREAM_END) {
+		(void) zlib.z_finicomp(&zs);
+		return (err == Z_OK ? Z_BUF_ERROR : err);
+	}
+
+	*dstlen = zs.total_out;
+	return (zlib.z_finicomp(&zs));
+}
+
 /*
  * Convert a 32-bit ELF file header into GElf.
  */
@@ -189,7 +437,7 @@ ctf_sect_munmap(const ctf_sect_t *sp)
  * responsible for closing the file descriptor when it is no longer needed.
  */
 ctf_file_t *
-ctf_fdopen(int fd, int *errp)
+ctf_fdcreate_int(int fd, int *errp, ctf_sect_t *ctfp)
 {
 	ctf_sect_t ctfsect, symsect, strsect;
 	ctf_file_t *fp = NULL;
@@ -221,6 +469,9 @@ ctf_fdopen(int fd, int *errp)
 	 */
 	if (nbytes >= sizeof (ctf_preamble_t) &&
 	    hdr.ctf.ctp_magic == CTF_MAGIC) {
+		if (ctfp != NULL)
+			return (ctf_set_open_errno(errp, EINVAL));
+
 		if (hdr.ctf.ctp_version > CTF_VERSION)
 			return (ctf_set_open_errno(errp, ECTF_CTFVERS));
 
@@ -370,7 +621,8 @@ ctf_fdopen(int fd, int *errp)
 				continue; /* corrupt sh_name field */
 
 			if (shp->sh_type == SHT_PROGBITS &&
-			    strcmp(strs + shp->sh_name, _CTF_SECTION) == 0) {
+			    strcmp(strs + shp->sh_name, _CTF_SECTION) == 0 &&
+			    ctfp == NULL) {
 				ctfsect.cts_name = strs + shp->sh_name;
 				ctfsect.cts_type = shp->sh_type;
 				ctfsect.cts_flags = shp->sh_flags;
@@ -397,18 +649,22 @@ ctf_fdopen(int fd, int *errp)
 
 		free(sp); /* free section header array */
 
-		if (ctfsect.cts_type == SHT_NULL) {
-			(void) munmap(strs_map, strs_mapsz);
-			return (ctf_set_open_errno(errp, ECTF_NOCTFDATA));
-		}
+		if (ctfp == NULL) {
+			if (ctfsect.cts_type == SHT_NULL && ctfp == NULL) {
+				(void) munmap(strs_map, strs_mapsz);
+				return (ctf_set_open_errno(errp,
+				    ECTF_NOCTFDATA));
+			}
 
-		/*
-		 * Now mmap the CTF data, symtab, and strtab sections and
-		 * call ctf_bufopen() to do the rest of the work.
-		 */
-		if (ctf_sect_mmap(&ctfsect, fd) == MAP_FAILED) {
-			(void) munmap(strs_map, strs_mapsz);
-			return (ctf_set_open_errno(errp, ECTF_MMAP));
+			/*
+			 * Now mmap the CTF data, symtab, and strtab sections
+			 * and call ctf_bufopen() to do the rest of the work.
+			 */
+			if (ctf_sect_mmap(&ctfsect, fd) == MAP_FAILED) {
+				(void) munmap(strs_map, strs_mapsz);
+				return (ctf_set_open_errno(errp, ECTF_MMAP));
+			}
+			ctfp = &ctfsect;
 		}
 
 		if (symsect.cts_type != SHT_NULL &&
@@ -418,12 +674,13 @@ ctf_fdopen(int fd, int *errp)
 				(void) ctf_set_open_errno(errp, ECTF_MMAP);
 				goto bad; /* unmap all and abort */
 			}
-			fp = ctf_bufopen(&ctfsect, &symsect, &strsect, errp);
+			fp = ctf_bufopen(ctfp, &symsect, &strsect, errp);
 		} else
-			fp = ctf_bufopen(&ctfsect, NULL, NULL, errp);
+			fp = ctf_bufopen(ctfp, NULL, NULL, errp);
 bad:
 		if (fp == NULL) {
-			ctf_sect_munmap(&ctfsect);
+			if (ctfp == NULL)
+				ctf_sect_munmap(&ctfsect);
 			ctf_sect_munmap(&symsect);
 			ctf_sect_munmap(&strsect);
 		} else
@@ -436,6 +693,12 @@ bad:
 	return (ctf_set_open_errno(errp, ECTF_FMT));
 }
 
+ctf_file_t *
+ctf_fdopen(int fd, int *errp)
+{
+	return (ctf_fdcreate_int(fd, errp, NULL));
+}
+
 /*
  * Open the specified file and return a pointer to a CTF container.  The file
  * can be either an ELF file or raw CTF file.  This is just a convenient
@@ -502,3 +765,25 @@ ctf_version(int version)
 
 	return (_libctf_version);
 }
+
+/*
+ * A utility function for folks debugging CTF conversion and merging.
+ */
+void
+ctf_phase_dump(ctf_file_t *fp, const char *phase)
+{
+	int fd;
+	static char *base;
+	char path[MAXPATHLEN];
+
+	if (base == NULL && (base = getenv("LIBCTF_WRITE_PHASES")) == NULL)
+		return;
+
+	(void) snprintf(path, sizeof (path), "%s/libctf.%s.%d.ctf", base,
+	    phase != NULL ? phase : "",
+	    ctf_phase);
+	if ((fd = open(path, O_CREAT | O_TRUNC | O_RDWR, 0777)) < 0)
+		return;
+	(void) ctf_write(fp, fd);
+	(void) close(fd);
+}
diff --git a/usr/src/lib/libctf/common/ctf_merge.c b/usr/src/lib/libctf/common/ctf_merge.c
new file mode 100644
index 0000000000..f23dbc232d
--- /dev/null
+++ b/usr/src/lib/libctf/common/ctf_merge.c
@@ -0,0 +1,1570 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015 Joyent, Inc.
+ */
+
+/*
+ * To perform a merge of two CTF containers, we first diff the two containers
+ * types. For every type that's in the src container, but not in the dst
+ * container, we note it and add it to dst container. If there are any objects
+ * or functions associated with src, we go through and update the types that
+ * they refer to such that they all refer to types in the dst container.
+ *
+ * The bulk of the logic for the merge, after we've run the diff, occurs in
+ * ctf_merge_common().
+ *
+ * In terms of exported APIs, we don't really export a simple merge two
+ * containers, as the general way this is used, in something like ctfmerge(1),
+ * is to add all the containers and then let us figure out the best way to merge
+ * it. In the future we'll want to grow some control over the number of threads
+ * that we use to do this, if we end up wanting a muli-threaded merge. If we do,
+ * we should take care to do the merge in the same way every time.
+ */
+
+#include <libctf_impl.h>
+#include <sys/debug.h>
+#include <sys/list.h>
+#include <stddef.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <mergeq.h>
+#include <errno.h>
+
+typedef struct ctf_merge_tinfo {
+	uint16_t cmt_map;	/* Map to the type in out */
+	boolean_t cmt_fixup;
+	boolean_t cmt_forward;
+	boolean_t cmt_missing;
+} ctf_merge_tinfo_t;
+
+/*
+ * State required for doing an individual merge of two containers.
+ */
+typedef struct ctf_merge_types {
+	ctf_file_t *cm_out;		/* Output CTF file */
+	ctf_file_t *cm_src;		/* Input CTF file */
+	ctf_merge_tinfo_t *cm_tmap;	/* Type state information */
+	boolean_t cm_dedup;		/* Are we doing a dedup? */
+	boolean_t cm_unique;		/* are we doing a uniquify? */
+} ctf_merge_types_t;
+
+typedef struct ctf_merge_objmap {
+	list_node_t cmo_node;
+	const char *cmo_name;		/* Symbol name */
+	ulong_t cmo_idx;		/* Symbol ID */
+	ctf_id_t cmo_tid;		/* Type ID */
+} ctf_merge_objmap_t;
+
+typedef struct ctf_merge_funcmap {
+	list_node_t cmf_node;
+	const char *cmf_name;		/* Symbol name */
+	ulong_t cmf_idx;		/* Symbol ID */
+	ctf_id_t cmf_rtid;		/* Type ID */
+	uint_t cmf_flags;		/* ctf_funcinfo_t ctc_flags */
+	uint_t cmf_argc;		/* Number of arguments */
+	ctf_id_t cmf_args[];		/* Types of arguments */
+} ctf_merge_funcmap_t;
+
+typedef struct ctf_merge_input {
+	list_node_t cmi_node;
+	ctf_file_t *cmi_input;
+	list_t cmi_omap;
+	list_t cmi_fmap;
+	boolean_t cmi_created;
+} ctf_merge_input_t;
+
+struct ctf_merge_handle {
+	list_t cmh_inputs;		/* Input list */
+	uint_t cmh_ninputs;		/* Number of inputs */
+	uint_t cmh_nthreads;		/* Number of threads to use */
+	ctf_file_t *cmh_unique;		/* ctf to uniquify against */
+	boolean_t cmh_msyms;		/* Should we merge symbols/funcs? */
+	int cmh_ofd;			/* FD for output file */
+	int cmh_flags;			/* Flags that control merge behavior */
+	char *cmh_label;		/* Optional label */
+	char *cmh_pname;		/* Parent name */
+};
+
+static int ctf_merge_add_type(ctf_merge_types_t *, ctf_id_t);
+
+static ctf_id_t
+ctf_merge_gettype(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	if (cmp->cm_dedup == B_FALSE) {
+		VERIFY(cmp->cm_tmap[id].cmt_map != 0);
+		return (cmp->cm_tmap[id].cmt_map);
+	}
+
+	while (cmp->cm_tmap[id].cmt_missing == B_FALSE) {
+		VERIFY(cmp->cm_tmap[id].cmt_map != 0);
+		id = cmp->cm_tmap[id].cmt_map;
+	}
+	VERIFY(cmp->cm_tmap[id].cmt_map != 0);
+	return (cmp->cm_tmap[id].cmt_map);
+}
+
+static void
+ctf_merge_diffcb(ctf_file_t *ifp, ctf_id_t iid, boolean_t same, ctf_file_t *ofp,
+    ctf_id_t oid, void *arg)
+{
+	ctf_merge_types_t *cmp = arg;
+	ctf_merge_tinfo_t *cmt = cmp->cm_tmap;
+
+	if (same == B_TRUE) {
+		if (ctf_type_kind(ifp, iid) == CTF_K_FORWARD &&
+		    ctf_type_kind(ofp, oid) != CTF_K_FORWARD) {
+			VERIFY(cmt[oid].cmt_map == 0);
+
+			/*
+			 * If we're uniquifying types, it's possible for the
+			 * container that we're uniquifying against to have a
+			 * forward which exists in the container being reduced.
+			 * For example, genunix has the machcpu structure as a
+			 * forward which is actually in unix and we uniquify
+			 * unix against genunix. In such cases, we explicitly do
+			 * not do any mapping of the forward information, lest
+			 * we risk losing the real definition. Instead, mark
+			 * that it's missing.
+			 */
+			if (cmp->cm_unique == B_TRUE) {
+				cmt[oid].cmt_missing = B_TRUE;
+				return;
+			}
+
+			cmt[oid].cmt_map = iid;
+			cmt[oid].cmt_forward = B_TRUE;
+			ctf_dprintf("merge diff forward mapped %d->%d\n", oid,
+			    iid);
+			return;
+		}
+
+		/*
+		 * We could have multiple things that a given type ends up
+		 * matching in the world of forwards and pointers to forwards.
+		 * For now just take the first one...
+		 */
+		if (cmt[oid].cmt_map != 0)
+			return;
+		cmt[oid].cmt_map = iid;
+		ctf_dprintf("merge diff mapped %d->%d\n", oid, iid);
+	} else if (ifp == cmp->cm_src) {
+		VERIFY(cmt[iid].cmt_map == 0);
+		cmt[iid].cmt_missing = B_TRUE;
+		ctf_dprintf("merge diff said %d is missing\n", iid);
+	}
+}
+
+static int
+ctf_merge_add_number(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int ret, flags;
+	const ctf_type_t *tp;
+	const char *name;
+	ctf_encoding_t en;
+
+	if (ctf_type_encoding(cmp->cm_src, id, &en) != 0)
+		return (CTF_ERR);
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	name = ctf_strraw(cmp->cm_src, tp->ctt_name);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+
+	ret = ctf_add_encoded(cmp->cm_out, flags, name, &en,
+	    ctf_type_kind(cmp->cm_src, id));
+
+	if (ret == CTF_ERR)
+		return (ret);
+
+	VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+	cmp->cm_tmap[id].cmt_map = ret;
+	return (0);
+}
+
+static int
+ctf_merge_add_array(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int ret, flags;
+	const ctf_type_t *tp;
+	ctf_arinfo_t ar;
+
+	if (ctf_array_info(cmp->cm_src, id, &ar) == CTF_ERR)
+		return (CTF_ERR);
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+
+	if (cmp->cm_tmap[ar.ctr_contents].cmt_map == 0) {
+		ret = ctf_merge_add_type(cmp, ar.ctr_contents);
+		if (ret != 0)
+			return (ret);
+		ASSERT(cmp->cm_tmap[ar.ctr_contents].cmt_map != 0);
+	}
+	ar.ctr_contents = ctf_merge_gettype(cmp, ar.ctr_contents);
+
+	if (cmp->cm_tmap[ar.ctr_index].cmt_map == 0) {
+		ret = ctf_merge_add_type(cmp, ar.ctr_index);
+		if (ret != 0)
+			return (ret);
+		ASSERT(cmp->cm_tmap[ar.ctr_index].cmt_map != 0);
+	}
+	ar.ctr_index = ctf_merge_gettype(cmp, ar.ctr_index);
+
+	ret = ctf_add_array(cmp->cm_out, flags, &ar);
+	if (ret == CTF_ERR)
+		return (ret);
+
+	VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+	cmp->cm_tmap[id].cmt_map = ret;
+
+	return (0);
+}
+
+static int
+ctf_merge_add_reftype(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int ret, flags;
+	const ctf_type_t *tp;
+	ctf_id_t reftype;
+	const char *name;
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	name = ctf_strraw(cmp->cm_src, tp->ctt_name);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+
+	reftype = ctf_type_reference(cmp->cm_src, id);
+	if (reftype == CTF_ERR)
+		return (ctf_set_errno(cmp->cm_out, ctf_errno(cmp->cm_src)));
+
+	if (cmp->cm_tmap[reftype].cmt_map == 0) {
+		ret = ctf_merge_add_type(cmp, reftype);
+		if (ret != 0)
+			return (ret);
+		ASSERT(cmp->cm_tmap[reftype].cmt_map != 0);
+	}
+	reftype = ctf_merge_gettype(cmp, reftype);
+
+	ret = ctf_add_reftype(cmp->cm_out, flags, name, reftype,
+	    ctf_type_kind(cmp->cm_src, id));
+	if (ret == CTF_ERR)
+		return (ret);
+
+	VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+	cmp->cm_tmap[id].cmt_map = ret;
+	return (0);
+}
+
+static int
+ctf_merge_add_typedef(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int ret, flags;
+	const ctf_type_t *tp;
+	const char *name;
+	ctf_id_t reftype;
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	name = ctf_strraw(cmp->cm_src, tp->ctt_name);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+
+	reftype = ctf_type_reference(cmp->cm_src, id);
+	if (reftype == CTF_ERR)
+		return (ctf_set_errno(cmp->cm_out, ctf_errno(cmp->cm_src)));
+
+	if (cmp->cm_tmap[reftype].cmt_map == 0) {
+		ret = ctf_merge_add_type(cmp, reftype);
+		if (ret != 0)
+			return (ret);
+		ASSERT(cmp->cm_tmap[reftype].cmt_map != 0);
+	}
+	reftype = ctf_merge_gettype(cmp, reftype);
+
+	ret = ctf_add_typedef(cmp->cm_out, flags, name, reftype);
+	if (ret == CTF_ERR)
+		return (ret);
+
+	VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+	cmp->cm_tmap[id].cmt_map = ret;
+	return (0);
+}
+
+typedef struct ctf_merge_enum {
+	ctf_file_t *cme_fp;
+	ctf_id_t cme_id;
+} ctf_merge_enum_t;
+
+static int
+ctf_merge_add_enumerator(const char *name, int value, void *arg)
+{
+	ctf_merge_enum_t *cmep = arg;
+
+	return (ctf_add_enumerator(cmep->cme_fp, cmep->cme_id, name, value) ==
+	    CTF_ERR);
+}
+
+static int
+ctf_merge_add_enum(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int flags;
+	const ctf_type_t *tp;
+	const char *name;
+	ctf_id_t enumid;
+	ctf_merge_enum_t cme;
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	name = ctf_strraw(cmp->cm_src, tp->ctt_name);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+
+	enumid = ctf_add_enum(cmp->cm_out, flags, name);
+	if (enumid == CTF_ERR)
+		return (enumid);
+
+	cme.cme_fp = cmp->cm_out;
+	cme.cme_id = enumid;
+	if (ctf_enum_iter(cmp->cm_src, id, ctf_merge_add_enumerator,
+	    &cme) != 0)
+		return (CTF_ERR);
+
+	VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+	cmp->cm_tmap[id].cmt_map = enumid;
+	return (0);
+}
+
+static int
+ctf_merge_add_func(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int ret, flags, i;
+	const ctf_type_t *tp;
+	ctf_funcinfo_t ctc;
+	ctf_id_t *argv;
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+
+	if (ctf_func_info_by_id(cmp->cm_src, id, &ctc) == CTF_ERR)
+		return (ctf_set_errno(cmp->cm_out, ctf_errno(cmp->cm_src)));
+
+	argv = ctf_alloc(sizeof (ctf_id_t) * ctc.ctc_argc);
+	if (argv == NULL)
+		return (ctf_set_errno(cmp->cm_out, ENOMEM));
+	if (ctf_func_args_by_id(cmp->cm_src, id, ctc.ctc_argc, argv) ==
+	    CTF_ERR) {
+		ctf_free(argv, sizeof (ctf_id_t) * ctc.ctc_argc);
+		return (ctf_set_errno(cmp->cm_out, ctf_errno(cmp->cm_src)));
+	}
+
+	if (cmp->cm_tmap[ctc.ctc_return].cmt_map == 0) {
+		ret = ctf_merge_add_type(cmp, ctc.ctc_return);
+		if (ret != 0)
+			return (ret);
+		ASSERT(cmp->cm_tmap[ctc.ctc_return].cmt_map != 0);
+	}
+	ctc.ctc_return = ctf_merge_gettype(cmp, ctc.ctc_return);
+
+	for (i = 0; i < ctc.ctc_argc; i++) {
+		if (cmp->cm_tmap[argv[i]].cmt_map == 0) {
+			ret = ctf_merge_add_type(cmp, argv[i]);
+			if (ret != 0)
+				return (ret);
+			ASSERT(cmp->cm_tmap[argv[i]].cmt_map != 0);
+		}
+		argv[i] = ctf_merge_gettype(cmp, argv[i]);
+	}
+
+	ret = ctf_add_funcptr(cmp->cm_out, flags, &ctc, argv);
+	ctf_free(argv, sizeof (ctf_id_t) * ctc.ctc_argc);
+	if (ret == CTF_ERR)
+		return (ret);
+
+	VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+	cmp->cm_tmap[id].cmt_map = ret;
+	return (0);
+}
+
+static int
+ctf_merge_add_forward(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int ret, flags;
+	const ctf_type_t *tp;
+	const char *name;
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	name = ctf_strraw(cmp->cm_src, tp->ctt_name);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+
+	/*
+	 * ctf_add_forward tries to check to see if a given forward already
+	 * exists in one of its hash tables.  If we're here then we know that we
+	 * have a forward in a container that isn't present in another.
+	 * Therefore, we choose a token hash table to satisfy the API choice
+	 * here.
+	 */
+	ret = ctf_add_forward(cmp->cm_out, flags, name, CTF_K_STRUCT);
+	if (ret == CTF_ERR)
+		return (CTF_ERR);
+
+	VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+	cmp->cm_tmap[id].cmt_map = ret;
+	return (0);
+}
+
+typedef struct ctf_merge_su {
+	ctf_merge_types_t *cms_cm;
+	ctf_id_t cms_id;
+} ctf_merge_su_t;
+
+static int
+ctf_merge_add_member(const char *name, ctf_id_t type, ulong_t offset, void *arg)
+{
+	ctf_merge_su_t *cms = arg;
+
+	VERIFY(cms->cms_cm->cm_tmap[type].cmt_map != 0);
+	type = cms->cms_cm->cm_tmap[type].cmt_map;
+
+	ctf_dprintf("Trying to add member %s to %d\n", name, cms->cms_id);
+	return (ctf_add_member(cms->cms_cm->cm_out, cms->cms_id, name,
+	    type, offset) == CTF_ERR);
+}
+
+/*
+ * During the first pass, we always add the generic structure and union but none
+ * of its members as they might not all have been mapped yet. Instead we just
+ * mark all structures and unions as needing to be fixed up.
+ */
+static int
+ctf_merge_add_sou(ctf_merge_types_t *cmp, ctf_id_t id, boolean_t forward)
+{
+	int flags, kind;
+	const ctf_type_t *tp;
+	const char *name;
+	ctf_id_t suid;
+
+	tp = LCTF_INDEX_TO_TYPEPTR(cmp->cm_src, id);
+	name = ctf_strraw(cmp->cm_src, tp->ctt_name);
+	if (CTF_INFO_ISROOT(tp->ctt_info) != 0)
+		flags = CTF_ADD_ROOT;
+	else
+		flags = CTF_ADD_NONROOT;
+	kind = ctf_type_kind(cmp->cm_src, id);
+
+	if (kind == CTF_K_STRUCT)
+		suid = ctf_add_struct(cmp->cm_out, flags, name);
+	else
+		suid = ctf_add_union(cmp->cm_out, flags, name);
+
+	if (suid == CTF_ERR)
+		return (suid);
+
+	/*
+	 * If this is a forward reference then it's mapping should already
+	 * exist.
+	 */
+	if (forward == B_FALSE) {
+		VERIFY(cmp->cm_tmap[id].cmt_map == 0);
+		cmp->cm_tmap[id].cmt_map = suid;
+		ctf_dprintf("added sou \"%s\" as (%d) %d->%d\n", name, kind, id,
+		    suid);
+	} else {
+		VERIFY(cmp->cm_tmap[id].cmt_map == suid);
+	}
+	cmp->cm_tmap[id].cmt_fixup = B_TRUE;
+
+	return (0);
+}
+
+static int
+ctf_merge_add_type(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int kind, ret;
+
+	/*
+	 * We may end up evaluating a type more than once as we may deal with it
+	 * as we recursively evaluate some kind of reference and then we may see
+	 * it normally.
+	 */
+	if (cmp->cm_tmap[id].cmt_map != 0)
+		return (0);
+
+	kind = ctf_type_kind(cmp->cm_src, id);
+	switch (kind) {
+	case CTF_K_INTEGER:
+	case CTF_K_FLOAT:
+		ret = ctf_merge_add_number(cmp, id);
+		break;
+	case CTF_K_ARRAY:
+		ret = ctf_merge_add_array(cmp, id);
+		break;
+	case CTF_K_POINTER:
+	case CTF_K_VOLATILE:
+	case CTF_K_CONST:
+	case CTF_K_RESTRICT:
+		ret = ctf_merge_add_reftype(cmp, id);
+		break;
+	case CTF_K_TYPEDEF:
+		ret = ctf_merge_add_typedef(cmp, id);
+		break;
+	case CTF_K_ENUM:
+		ret = ctf_merge_add_enum(cmp, id);
+		break;
+	case CTF_K_FUNCTION:
+		ret = ctf_merge_add_func(cmp, id);
+		break;
+	case CTF_K_FORWARD:
+		ret = ctf_merge_add_forward(cmp, id);
+		break;
+	case CTF_K_STRUCT:
+	case CTF_K_UNION:
+		ret = ctf_merge_add_sou(cmp, id, B_FALSE);
+		break;
+	case CTF_K_UNKNOWN:
+		/*
+		 * We don't add uknown types, and we later assert that nothing
+		 * should reference them.
+		 */
+		return (0);
+	default:
+		abort();
+	}
+
+	return (ret);
+}
+
+static int
+ctf_merge_fixup_sou(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	ctf_dtdef_t *dtd;
+	ctf_merge_su_t cms;
+	ctf_id_t mapid;
+	ssize_t size;
+
+	mapid = cmp->cm_tmap[id].cmt_map;
+	VERIFY(mapid != 0);
+	dtd = ctf_dtd_lookup(cmp->cm_out, mapid);
+	VERIFY(dtd != NULL);
+
+	ctf_dprintf("Trying to fix up sou %d\n", id);
+	cms.cms_cm = cmp;
+	cms.cms_id = mapid;
+	if (ctf_member_iter(cmp->cm_src, id, ctf_merge_add_member, &cms) != 0)
+		return (CTF_ERR);
+
+	if ((size = ctf_type_size(cmp->cm_src, id)) == CTF_ERR)
+		return (CTF_ERR);
+	if (ctf_set_size(cmp->cm_out, mapid, size) == CTF_ERR)
+		return (CTF_ERR);
+
+	return (0);
+}
+
+static int
+ctf_merge_fixup_type(ctf_merge_types_t *cmp, ctf_id_t id)
+{
+	int kind, ret;
+
+	kind = ctf_type_kind(cmp->cm_src, id);
+	switch (kind) {
+	case CTF_K_STRUCT:
+	case CTF_K_UNION:
+		ret = ctf_merge_fixup_sou(cmp, id);
+		break;
+	default:
+		VERIFY(0);
+		ret = CTF_ERR;
+	}
+
+	return (ret);
+}
+
+/*
+ * Now that we've successfully merged everything, we're going to clean
+ * up the merge type table. Traditionally if we had just two different
+ * files that we were working between, the types would be fully
+ * resolved. However, because we were comparing with ourself every step
+ * of the way and not our reduced self, we need to go through and update
+ * every mapped entry to what it now points to in the deduped file.
+ */
+static void
+ctf_merge_fixup_dedup_map(ctf_merge_types_t *cmp)
+{
+	int i;
+
+	for (i = 1; i < cmp->cm_src->ctf_typemax + 1; i++) {
+		ctf_id_t tid;
+
+		/*
+		 * Missing types always have their id updated to exactly what it
+		 * should be.
+		 */
+		if (cmp->cm_tmap[i].cmt_missing == B_TRUE) {
+			VERIFY(cmp->cm_tmap[i].cmt_map != 0);
+			continue;
+		}
+
+		tid = i;
+		while (cmp->cm_tmap[tid].cmt_missing == B_FALSE) {
+			VERIFY(cmp->cm_tmap[tid].cmt_map != 0);
+			tid = cmp->cm_tmap[tid].cmt_map;
+		}
+		VERIFY(cmp->cm_tmap[tid].cmt_map != 0);
+		cmp->cm_tmap[i].cmt_map = cmp->cm_tmap[tid].cmt_map;
+	}
+}
+
+
+/*
+ * We're going to do three passes over the containers.
+ *
+ * Pass 1 checks for forward references in the output container that we know
+ * exist in the source container.
+ *
+ * Pass 2 adds all the missing types from the source container. As part of this
+ * we may be adding a type as a forward reference that doesn't exist yet.
+ * Any types that we encounter in this form, we need to add to a third pass.
+ *
+ * Pass 3 is the fixup pass. Here we go through and find all the types that were
+ * missing in the first.
+ *
+ * Importantly, we *must* call ctf_update between the second and third pass,
+ * otherwise several of the libctf functions will not properly find the data in
+ * the container. If we're doing a dedup we also fix up the type mapping.
+ */
+static int
+ctf_merge_common(ctf_merge_types_t *cmp)
+{
+	int ret, i;
+
+	ctf_phase_dump(cmp->cm_src, "merge-common-src");
+	ctf_phase_dump(cmp->cm_out, "merge-common-dest");
+
+	/* Pass 1 */
+	for (i = 1; i <= cmp->cm_src->ctf_typemax; i++) {
+		if (cmp->cm_tmap[i].cmt_forward == B_TRUE) {
+			ret = ctf_merge_add_sou(cmp, i, B_TRUE);
+			if (ret != 0) {
+				return (ret);
+			}
+		}
+	}
+
+	/* Pass 2 */
+	for (i = 1; i <= cmp->cm_src->ctf_typemax; i++) {
+		if (cmp->cm_tmap[i].cmt_missing == B_TRUE) {
+			ret = ctf_merge_add_type(cmp, i);
+			if (ret != 0) {
+				ctf_dprintf("Failed to merge type %d\n", i);
+				return (ret);
+			}
+		}
+	}
+
+	ret = ctf_update(cmp->cm_out);
+	if (ret != 0)
+		return (ret);
+
+	if (cmp->cm_dedup == B_TRUE) {
+		ctf_merge_fixup_dedup_map(cmp);
+	}
+
+	ctf_dprintf("Beginning merge pass 3\n");
+	/* Pass 3 */
+	for (i = 1; i <= cmp->cm_src->ctf_typemax; i++) {
+		if (cmp->cm_tmap[i].cmt_fixup == B_TRUE) {
+			ret = ctf_merge_fixup_type(cmp, i);
+			if (ret != 0)
+				return (ret);
+		}
+	}
+
+	if (cmp->cm_dedup == B_TRUE) {
+		ctf_merge_fixup_dedup_map(cmp);
+	}
+
+	return (0);
+}
+
+/*
+ * Uniquification is slightly different from a stock merge. For starters, we
+ * don't need to replace any forward references in the output. In this case
+ * though, the types that already exist are in a parent container to the empty
+ * output container.
+ */
+static int
+ctf_merge_uniquify_types(ctf_merge_types_t *cmp)
+{
+	int i, ret;
+
+	for (i = 1; i <= cmp->cm_src->ctf_typemax; i++) {
+		if (cmp->cm_tmap[i].cmt_missing == B_FALSE)
+			continue;
+		ret = ctf_merge_add_type(cmp, i);
+		if (ret != 0)
+			return (ret);
+	}
+
+	ret = ctf_update(cmp->cm_out);
+	if (ret != 0)
+		return (ret);
+
+	for (i = 1; i <= cmp->cm_src->ctf_typemax; i++) {
+		if (cmp->cm_tmap[i].cmt_fixup == B_FALSE)
+			continue;
+		ret = ctf_merge_fixup_type(cmp, i);
+		if (ret != 0)
+			return (ret);
+	}
+
+	return (0);
+}
+
+static int
+ctf_merge_types_init(ctf_merge_types_t *cmp)
+{
+	cmp->cm_tmap = ctf_alloc(sizeof (ctf_merge_tinfo_t) *
+	    (cmp->cm_src->ctf_typemax + 1));
+	if (cmp->cm_tmap == NULL)
+		return (ctf_set_errno(cmp->cm_out, ENOMEM));
+	bzero(cmp->cm_tmap, sizeof (ctf_merge_tinfo_t) *
+	    (cmp->cm_src->ctf_typemax + 1));
+	return (0);
+}
+
+static void
+ctf_merge_types_fini(ctf_merge_types_t *cmp)
+{
+	ctf_free(cmp->cm_tmap, sizeof (ctf_merge_tinfo_t) *
+	    (cmp->cm_src->ctf_typemax + 1));
+}
+
+/*
+ * Merge the types contained inside of two input files. The second input file is
+ * always going to be the destination. We're guaranteed that it's always
+ * writeable.
+ */
+static int
+ctf_merge_types(void *arg, void *arg2, void **outp, void *unsued)
+{
+	int ret;
+	ctf_merge_types_t cm;
+	ctf_diff_t *cdp;
+	ctf_merge_objmap_t *cmo;
+	ctf_merge_funcmap_t *cmf;
+	ctf_merge_input_t *scmi = arg;
+	ctf_merge_input_t *dcmi = arg2;
+	ctf_file_t *out = dcmi->cmi_input;
+	ctf_file_t *source = scmi->cmi_input;
+
+	ctf_dprintf("merging %p->%p\n", source, out);
+
+	if (!(out->ctf_flags & LCTF_RDWR))
+		return (ctf_set_errno(out, ECTF_RDONLY));
+
+	if (ctf_getmodel(out) != ctf_getmodel(source))
+		return (ctf_set_errno(out, ECTF_DMODEL));
+
+	if ((ret = ctf_diff_init(out, source, &cdp)) != 0)
+		return (ret);
+
+	cm.cm_out = out;
+	cm.cm_src = source;
+	cm.cm_dedup = B_FALSE;
+	cm.cm_unique = B_FALSE;
+	ret = ctf_merge_types_init(&cm);
+	if (ret != 0) {
+		ctf_diff_fini(cdp);
+		return (ctf_set_errno(out, ret));
+	}
+
+	ret = ctf_diff_types(cdp, ctf_merge_diffcb, &cm);
+	if (ret != 0)
+		goto cleanup;
+	ret = ctf_merge_common(&cm);
+	ctf_dprintf("merge common returned with %d\n", ret);
+	if (ret == 0) {
+		ret = ctf_update(out);
+		ctf_dprintf("update returned with %d\n", ret);
+	} else {
+		goto cleanup;
+	}
+
+	/*
+	 * Now we need to fix up the object and function maps.
+	 */
+	for (cmo = list_head(&scmi->cmi_omap); cmo != NULL;
+	    cmo = list_next(&scmi->cmi_omap, cmo)) {
+		if (cmo->cmo_tid == 0)
+			continue;
+		VERIFY(cm.cm_tmap[cmo->cmo_tid].cmt_map != 0);
+		cmo->cmo_tid = cm.cm_tmap[cmo->cmo_tid].cmt_map;
+	}
+
+	for (cmf = list_head(&scmi->cmi_fmap); cmf != NULL;
+	    cmf = list_next(&scmi->cmi_fmap, cmf)) {
+		int i;
+
+		VERIFY(cm.cm_tmap[cmf->cmf_rtid].cmt_map != 0);
+		cmf->cmf_rtid = cm.cm_tmap[cmf->cmf_rtid].cmt_map;
+		for (i = 0; i < cmf->cmf_argc; i++) {
+			VERIFY(cm.cm_tmap[cmf->cmf_args[i]].cmt_map != 0);
+			cmf->cmf_args[i] = cm.cm_tmap[cmf->cmf_args[i]].cmt_map;
+		}
+	}
+
+	/*
+	 * Now that we've fixed things up, we need to give our function and
+	 * object maps to the destination, such that it can continue to update
+	 * them going forward.
+	 */
+	list_move_tail(&dcmi->cmi_fmap, &scmi->cmi_fmap);
+	list_move_tail(&dcmi->cmi_omap, &scmi->cmi_omap);
+
+cleanup:
+	if (ret == 0)
+		*outp = dcmi;
+	ctf_merge_types_fini(&cm);
+	ctf_diff_fini(cdp);
+	if (ret != 0)
+		return (ctf_errno(out));
+	return (0);
+}
+
+static int
+ctf_uniquify_types(ctf_merge_t *cmh, ctf_file_t *src, ctf_file_t **outp)
+{
+	int err, ret;
+	ctf_file_t *out;
+	ctf_merge_types_t cm;
+	ctf_diff_t *cdp;
+	ctf_merge_input_t *cmi;
+	ctf_file_t *parent = cmh->cmh_unique;
+
+	*outp = NULL;
+	out = ctf_fdcreate(cmh->cmh_ofd, &err);
+	if (out == NULL)
+		return (ctf_set_errno(src, err));
+
+	out->ctf_parname = cmh->cmh_pname;
+	if (ctf_setmodel(out, ctf_getmodel(parent)) != 0) {
+		(void) ctf_set_errno(src, ctf_errno(out));
+		ctf_close(out);
+		return (CTF_ERR);
+	}
+
+	if (ctf_import(out, parent) != 0) {
+		(void) ctf_set_errno(src, ctf_errno(out));
+		ctf_close(out);
+		return (CTF_ERR);
+	}
+
+	if ((ret = ctf_diff_init(parent, src, &cdp)) != 0) {
+		ctf_close(out);
+		return (ctf_set_errno(src, ctf_errno(parent)));
+	}
+
+	cm.cm_out = parent;
+	cm.cm_src = src;
+	cm.cm_dedup = B_FALSE;
+	cm.cm_unique = B_TRUE;
+	ret = ctf_merge_types_init(&cm);
+	if (ret != 0) {
+		ctf_close(out);
+		ctf_diff_fini(cdp);
+		return (ctf_set_errno(src, ret));
+	}
+
+	ret = ctf_diff_types(cdp, ctf_merge_diffcb, &cm);
+	if (ret == 0) {
+		cm.cm_out = out;
+		ret = ctf_merge_uniquify_types(&cm);
+		if (ret == 0)
+			ret = ctf_update(out);
+	}
+
+	if (ret != 0) {
+		ctf_merge_types_fini(&cm);
+		ctf_diff_fini(cdp);
+		return (ctf_set_errno(src, ctf_errno(cm.cm_out)));
+	}
+
+	for (cmi = list_head(&cmh->cmh_inputs); cmi != NULL;
+	    cmi = list_next(&cmh->cmh_inputs, cmi)) {
+		ctf_merge_objmap_t *cmo;
+		ctf_merge_funcmap_t *cmf;
+
+		for (cmo = list_head(&cmi->cmi_omap); cmo != NULL;
+		    cmo = list_next(&cmi->cmi_omap, cmo)) {
+			if (cmo->cmo_tid == 0)
+				continue;
+			VERIFY(cm.cm_tmap[cmo->cmo_tid].cmt_map != 0);
+			cmo->cmo_tid = cm.cm_tmap[cmo->cmo_tid].cmt_map;
+		}
+
+		for (cmf = list_head(&cmi->cmi_fmap); cmf != NULL;
+		    cmf = list_next(&cmi->cmi_fmap, cmf)) {
+			int i;
+
+			VERIFY(cm.cm_tmap[cmf->cmf_rtid].cmt_map != 0);
+			cmf->cmf_rtid = cm.cm_tmap[cmf->cmf_rtid].cmt_map;
+			for (i = 0; i < cmf->cmf_argc; i++) {
+				VERIFY(cm.cm_tmap[cmf->cmf_args[i]].cmt_map !=
+				    0);
+				cmf->cmf_args[i] =
+				    cm.cm_tmap[cmf->cmf_args[i]].cmt_map;
+			}
+		}
+	}
+
+	ctf_merge_types_fini(&cm);
+	ctf_diff_fini(cdp);
+	*outp = out;
+	return (0);
+}
+
+static void
+ctf_merge_fini_input(ctf_merge_input_t *cmi)
+{
+	ctf_merge_objmap_t *cmo;
+	ctf_merge_funcmap_t *cmf;
+
+	while ((cmo = list_remove_head(&cmi->cmi_omap)) != NULL)
+		ctf_free(cmo, sizeof (ctf_merge_objmap_t));
+
+	while ((cmf = list_remove_head(&cmi->cmi_fmap)) != NULL)
+		ctf_free(cmf, sizeof (ctf_merge_funcmap_t) +
+		    sizeof (ctf_id_t) * cmf->cmf_argc);
+
+	if (cmi->cmi_created == B_TRUE && cmi->cmi_input != NULL)
+		ctf_close(cmi->cmi_input);
+
+	ctf_free(cmi, sizeof (ctf_merge_input_t));
+}
+
+void
+ctf_merge_fini(ctf_merge_t *cmh)
+{
+	size_t len;
+	ctf_merge_input_t *cmi;
+
+	if (cmh->cmh_label != NULL) {
+		len = strlen(cmh->cmh_label) + 1;
+		ctf_free(cmh->cmh_label, len);
+	}
+
+	if (cmh->cmh_pname != NULL) {
+		len = strlen(cmh->cmh_pname) + 1;
+		ctf_free(cmh->cmh_pname, len);
+	}
+
+	while ((cmi = list_remove_head(&cmh->cmh_inputs)) != NULL)
+		ctf_merge_fini_input(cmi);
+
+	ctf_free(cmh, sizeof (ctf_merge_t));
+}
+
+ctf_merge_t *
+ctf_merge_init(int fd, int *errp)
+{
+	int err;
+	ctf_merge_t *out;
+	struct stat st;
+
+	if (errp == NULL)
+		errp = &err;
+
+	if (fd != -1 && fstat(fd, &st) != 0) {
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	out = ctf_alloc(sizeof (ctf_merge_t));
+	if (out == NULL) {
+		*errp = ENOMEM;
+		return (NULL);
+	}
+
+	if (fd == -1) {
+		out->cmh_msyms = B_FALSE;
+	} else {
+		out->cmh_msyms = B_TRUE;
+	}
+
+	list_create(&out->cmh_inputs, sizeof (ctf_merge_input_t),
+	    offsetof(ctf_merge_input_t, cmi_node));
+	out->cmh_ninputs = 0;
+	out->cmh_nthreads = 1;
+	out->cmh_unique = NULL;
+	out->cmh_ofd = fd;
+	out->cmh_flags = 0;
+	out->cmh_label = NULL;
+	out->cmh_pname = NULL;
+
+	return (out);
+}
+
+int
+ctf_merge_label(ctf_merge_t *cmh, const char *label)
+{
+	char *dup;
+
+	if (label == NULL)
+		return (EINVAL);
+
+	dup = ctf_strdup(label);
+	if (dup == NULL)
+		return (EAGAIN);
+
+	if (cmh->cmh_label != NULL) {
+		size_t len = strlen(cmh->cmh_label) + 1;
+		ctf_free(cmh->cmh_label, len);
+	}
+
+	cmh->cmh_label = dup;
+	return (0);
+}
+
+static int
+ctf_merge_add_funcs(const char *name, ulong_t idx, ctf_funcinfo_t *fip,
+    void *arg)
+{
+	ctf_merge_input_t *cmi = arg;
+	ctf_merge_funcmap_t *fmap;
+
+	fmap = ctf_alloc(sizeof (ctf_merge_funcmap_t) +
+	    sizeof (ctf_id_t) * fip->ctc_argc);
+	if (fmap == NULL)
+		return (ENOMEM);
+
+	fmap->cmf_idx = idx;
+	fmap->cmf_rtid = fip->ctc_return;
+	fmap->cmf_flags = fip->ctc_flags;
+	fmap->cmf_argc = fip->ctc_argc;
+	fmap->cmf_name = name;
+
+	if (ctf_func_args(cmi->cmi_input, idx, fmap->cmf_argc,
+	    fmap->cmf_args) != 0) {
+		ctf_free(fmap, sizeof (ctf_merge_funcmap_t) +
+		    sizeof (ctf_id_t) * fip->ctc_argc);
+		return (ctf_errno(cmi->cmi_input));
+	}
+
+	list_insert_tail(&cmi->cmi_fmap, fmap);
+	return (0);
+}
+
+static int
+ctf_merge_add_objs(const char *name, ctf_id_t id, ulong_t idx, void *arg)
+{
+	ctf_merge_input_t *cmi = arg;
+	ctf_merge_objmap_t *cmo;
+
+	cmo = ctf_alloc(sizeof (ctf_merge_objmap_t));
+	if (cmo == NULL)
+		return (ENOMEM);
+
+	cmo->cmo_name = name;
+	cmo->cmo_idx = idx;
+	cmo->cmo_tid = id;
+	list_insert_tail(&cmi->cmi_omap, cmo);
+	return (0);
+}
+
+/*
+ * Whenever we create an entry to merge, we then go and add a second empty
+ * ctf_file_t which we use for the purposes of our merging. It's not the best,
+ * but it's the best that we've got at the moment.
+ */
+int
+ctf_merge_add(ctf_merge_t *cmh, ctf_file_t *input)
+{
+	int ret;
+	ctf_merge_input_t *cmi;
+	ctf_file_t *empty;
+
+	if (input->ctf_flags & LCTF_CHILD)
+		return (ECTF_MCHILD);
+
+	cmi = ctf_alloc(sizeof (ctf_merge_input_t));
+	if (cmi == NULL)
+		return (ENOMEM);
+
+	cmi->cmi_created = B_FALSE;
+	cmi->cmi_input = input;
+	list_create(&cmi->cmi_fmap, sizeof (ctf_merge_funcmap_t),
+	    offsetof(ctf_merge_funcmap_t, cmf_node));
+	list_create(&cmi->cmi_omap, sizeof (ctf_merge_funcmap_t),
+	    offsetof(ctf_merge_objmap_t, cmo_node));
+
+	if (cmh->cmh_msyms == B_TRUE) {
+		if ((ret = ctf_function_iter(input, ctf_merge_add_funcs,
+		    cmi)) != 0) {
+			ctf_merge_fini_input(cmi);
+			return (ret);
+		}
+
+		if ((ret = ctf_object_iter(input, ctf_merge_add_objs,
+		    cmi)) != 0) {
+			ctf_merge_fini_input(cmi);
+			return (ret);
+		}
+	}
+
+	list_insert_tail(&cmh->cmh_inputs, cmi);
+	cmh->cmh_ninputs++;
+
+	/* And now the empty one to merge into this */
+	cmi = ctf_alloc(sizeof (ctf_merge_input_t));
+	if (cmi == NULL)
+		return (ENOMEM);
+	list_create(&cmi->cmi_fmap, sizeof (ctf_merge_funcmap_t),
+	    offsetof(ctf_merge_funcmap_t, cmf_node));
+	list_create(&cmi->cmi_omap, sizeof (ctf_merge_funcmap_t),
+	    offsetof(ctf_merge_objmap_t, cmo_node));
+
+	empty = ctf_fdcreate(cmh->cmh_ofd, &ret);
+	if (empty == NULL)
+		return (ret);
+	cmi->cmi_input = empty;
+	cmi->cmi_created = B_TRUE;
+
+	if (ctf_setmodel(empty, ctf_getmodel(input)) == CTF_ERR) {
+		return (ctf_errno(empty));
+	}
+
+	list_insert_tail(&cmh->cmh_inputs, cmi);
+	cmh->cmh_ninputs++;
+	ctf_dprintf("added containers %p and %p\n", input, empty);
+	return (0);
+}
+
+int
+ctf_merge_uniquify(ctf_merge_t *cmh, ctf_file_t *u, const char *pname)
+{
+	char *dup;
+
+	if (u->ctf_flags & LCTF_CHILD)
+		return (ECTF_MCHILD);
+	if (pname == NULL)
+		return (EINVAL);
+	dup = ctf_strdup(pname);
+	if (dup == NULL)
+		return (EINVAL);
+	if (cmh->cmh_pname != NULL) {
+		size_t len = strlen(cmh->cmh_pname) + 1;
+		ctf_free(cmh->cmh_pname, len);
+	}
+	cmh->cmh_pname = dup;
+	cmh->cmh_unique = u;
+	return (0);
+}
+
+static int
+ctf_merge_symbols(ctf_merge_t *cmh, ctf_file_t *fp)
+{
+	int err;
+	ulong_t i;
+
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+	uintptr_t strbase = (uintptr_t)fp->ctf_strtab.cts_data;
+
+	for (i = 0; i < fp->ctf_nsyms; i++) {
+		const char *name;
+		ctf_merge_input_t *cmi;
+		ctf_merge_objmap_t *cmo;
+
+		if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+			const Elf32_Sym *symp = (Elf32_Sym *)symbase + i;
+			int type = ELF32_ST_TYPE(symp->st_info);
+			if (type != STT_OBJECT)
+				continue;
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+			name = (char *)(strbase + symp->st_name);
+		} else {
+			const Elf64_Sym *symp = (Elf64_Sym *)symbase + i;
+			int type = ELF64_ST_TYPE(symp->st_info);
+			if (type != STT_OBJECT)
+				continue;
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+			name = (char *)(strbase + symp->st_name);
+		}
+
+		cmo = NULL;
+		for (cmi = list_head(&cmh->cmh_inputs); cmi != NULL;
+		    cmi = list_next(&cmh->cmh_inputs, cmi)) {
+			for (cmo = list_head(&cmi->cmi_omap); cmo != NULL;
+			    cmo = list_next(&cmi->cmi_omap, cmo)) {
+				if (strcmp(cmo->cmo_name, name) == 0)
+					goto found;
+			}
+		}
+found:
+		if (cmo != NULL) {
+			if (cmo->cmo_tid == 0)
+				continue;
+			if ((err = ctf_add_object(fp, i, cmo->cmo_tid)) != 0) {
+				ctf_dprintf("Failed to add symbol %s->%d: %s\n",
+				    name, cmo->cmo_tid,
+				    ctf_errmsg(ctf_errno(fp)));
+				return (err);
+			}
+		}
+	}
+
+	return (0);
+}
+
+static int
+ctf_merge_functions(ctf_merge_t *cmh, ctf_file_t *fp)
+{
+	int err;
+	ulong_t i;
+	ctf_funcinfo_t fi;
+
+	uintptr_t symbase = (uintptr_t)fp->ctf_symtab.cts_data;
+	uintptr_t strbase = (uintptr_t)fp->ctf_strtab.cts_data;
+
+	for (i = 0; i < fp->ctf_nsyms; i++) {
+		const char *name;
+		ctf_merge_input_t *cmi;
+		ctf_merge_funcmap_t *cmf;
+
+		if (fp->ctf_symtab.cts_entsize == sizeof (Elf32_Sym)) {
+			const Elf32_Sym *symp = (Elf32_Sym *)symbase + i;
+			int type = ELF32_ST_TYPE(symp->st_info);
+			if (ELF32_ST_TYPE(symp->st_info) != STT_FUNC)
+				continue;
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+			name = (char *)(strbase + symp->st_name);
+		} else {
+			const Elf64_Sym *symp = (Elf64_Sym *)symbase + i;
+			int type = ELF64_ST_TYPE(symp->st_info);
+			if (ELF64_ST_TYPE(symp->st_info) != STT_FUNC)
+				continue;
+			if (ctf_sym_valid(strbase, type, symp->st_shndx,
+			    symp->st_value, symp->st_name) == B_FALSE)
+				continue;
+			name = (char *)(strbase + symp->st_name);
+		}
+
+		cmf = NULL;
+		for (cmi = list_head(&cmh->cmh_inputs); cmi != NULL;
+		    cmi = list_next(&cmh->cmh_inputs, cmi)) {
+			for (cmf = list_head(&cmi->cmi_fmap); cmf != NULL;
+			    cmf = list_next(&cmi->cmi_fmap, cmf)) {
+				if (strcmp(cmf->cmf_name, name) == 0)
+					goto found;
+			}
+		}
+found:
+		if (cmf != NULL) {
+			fi.ctc_return = cmf->cmf_rtid;
+			fi.ctc_argc = cmf->cmf_argc;
+			fi.ctc_flags = cmf->cmf_flags;
+			if ((err = ctf_add_function(fp, i, &fi,
+			    cmf->cmf_args)) != 0)
+				return (err);
+		}
+	}
+
+	return (0);
+
+}
+
+int
+ctf_merge_merge(ctf_merge_t *cmh, ctf_file_t **outp)
+{
+	int err, merr;
+	ctf_merge_input_t *cmi;
+	ctf_id_t ltype;
+	mergeq_t *mqp;
+	ctf_merge_input_t *final;
+	ctf_file_t *out;
+
+	if (cmh->cmh_label != NULL && cmh->cmh_unique != NULL) {
+		const char *label = ctf_label_topmost(cmh->cmh_unique);
+		if (label == NULL)
+			return (ECTF_NOLABEL);
+		if (strcmp(label, cmh->cmh_label) != 0)
+			return (ECTF_LCONFLICT);
+	}
+
+	if (mergeq_init(&mqp, cmh->cmh_nthreads) == -1) {
+		return (errno);
+	}
+
+	/*
+	 * We should consider doing a divide and conquer and parallel merge
+	 * here. If we did, we'd want to use some number of threads to perform
+	 * this operation.
+	 */
+	VERIFY(cmh->cmh_ninputs % 2 == 0);
+	for (cmi = list_head(&cmh->cmh_inputs); cmi != NULL;
+	    cmi = list_next(&cmh->cmh_inputs, cmi)) {
+		if (mergeq_add(mqp, cmi) == -1) {
+			err = errno;
+			mergeq_fini(mqp);
+		}
+	}
+
+	err = mergeq_merge(mqp, ctf_merge_types, NULL, (void **)&final, &merr);
+	mergeq_fini(mqp);
+
+	if (err == MERGEQ_ERROR) {
+		return (errno);
+	} else if (err == MERGEQ_UERROR) {
+		return (merr);
+	}
+
+	/*
+	 * Disassociate the generated ctf_file_t from the original input. That
+	 * way when the input gets cleaned up, we don't accidentally kill the
+	 * final reference to the ctf_file_t. If it gets uniquified then we'll
+	 * kill it.
+	 */
+	VERIFY(final->cmi_input != NULL);
+	out = final->cmi_input;
+	final->cmi_input = NULL;
+
+	ctf_dprintf("preparing to uniquify against: %p\n", cmh->cmh_unique);
+	if (cmh->cmh_unique != NULL) {
+		ctf_file_t *u;
+		err = ctf_uniquify_types(cmh, out, &u);
+		if (err != 0) {
+			err = ctf_errno(out);
+			ctf_close(out);
+			return (err);
+		}
+		ctf_close(out);
+		out = u;
+	}
+
+	ltype = out->ctf_typemax;
+	if ((out->ctf_flags & LCTF_CHILD) && ltype != 0)
+		ltype += 0x8000;
+	ctf_dprintf("trying to add the label\n");
+	if (cmh->cmh_label != NULL &&
+	    ctf_add_label(out, cmh->cmh_label, ltype, 0) != 0) {
+		ctf_close(out);
+		return (ctf_errno(out));
+	}
+
+	ctf_dprintf("merging symbols and the like\n");
+	if (cmh->cmh_msyms == B_TRUE) {
+		err = ctf_merge_symbols(cmh, out);
+		if (err != 0) {
+			ctf_close(out);
+			return (ctf_errno(out));
+		}
+
+		err = ctf_merge_functions(cmh, out);
+		if (err != 0) {
+			ctf_close(out);
+			return (ctf_errno(out));
+		}
+	}
+
+	err = ctf_update(out);
+	if (err != 0) {
+		ctf_close(out);
+		return (ctf_errno(out));
+	}
+
+	*outp = out;
+	return (0);
+}
+
+/*
+ * When we get told that something is unique, eg. same is B_FALSE, then that
+ * tells us that we need to add it to the output. If same is B_TRUE, then we'll
+ * want to record it in the mapping table so that we know how to redirect types
+ * to the extant ones.
+ */
+static void
+ctf_dedup_cb(ctf_file_t *ifp, ctf_id_t iid, boolean_t same, ctf_file_t *ofp,
+    ctf_id_t oid, void *arg)
+{
+	ctf_merge_types_t *cmp = arg;
+	ctf_merge_tinfo_t *cmt = cmp->cm_tmap;
+
+	if (same == B_TRUE) {
+		/*
+		 * The output id here may itself map to something else.
+		 * Therefore, we need to basically walk a chain and see what it
+		 * points to until it itself points to a base type, eg. -1.
+		 * Otherwise we'll dedup to something which no longer exists.
+		 */
+		while (cmt[oid].cmt_missing == B_FALSE)
+			oid = cmt[oid].cmt_map;
+		cmt[iid].cmt_map = oid;
+		ctf_dprintf("%d->%d \n", iid, oid);
+	} else {
+		VERIFY(cmt[iid].cmt_map == 0);
+		cmt[iid].cmt_missing = B_TRUE;
+		ctf_dprintf("%d is missing\n", iid);
+	}
+}
+
+/*
+ * Dedup a CTF container.
+ *
+ * DWARF and other encoding formats that we use to create CTF data may create
+ * multiple copies of a given type. However, after doing a conversion, and
+ * before doing a merge, we'd prefer, if possible, to have every input container
+ * to be unique.
+ *
+ * Doing a deduplication is like a normal merge. However, when we diff the types
+ * in the container, rather than doing a normal diff, we instead want to diff
+ * against any already processed types. eg, for a given type i in a container,
+ * we want to diff it from 0 to i - 1.
+ */
+int
+ctf_merge_dedup(ctf_merge_t *cmp, ctf_file_t **outp)
+{
+	int ret;
+	ctf_diff_t *cdp = NULL;
+	ctf_merge_input_t *cmi, *cmc;
+	ctf_file_t *ifp, *ofp;
+	ctf_merge_objmap_t *cmo;
+	ctf_merge_funcmap_t *cmf;
+	ctf_merge_types_t cm;
+
+	if (cmp == NULL || outp == NULL)
+		return (EINVAL);
+
+	ctf_dprintf("encountered %d inputs\n", cmp->cmh_ninputs);
+	if (cmp->cmh_ninputs != 2)
+		return (EINVAL);
+
+	ctf_dprintf("passed argument sanity check\n");
+
+	cmi = list_head(&cmp->cmh_inputs);
+	VERIFY(cmi != NULL);
+	cmc = list_next(&cmp->cmh_inputs, cmi);
+	VERIFY(cmc != NULL);
+	ifp = cmi->cmi_input;
+	ofp = cmc->cmi_input;
+	VERIFY(ifp != NULL);
+	VERIFY(ofp != NULL);
+	cm.cm_src = ifp;
+	cm.cm_out = ofp;
+	cm.cm_dedup = B_TRUE;
+	cm.cm_unique = B_FALSE;
+
+	if ((ret = ctf_merge_types_init(&cm)) != 0) {
+		return (ret);
+	}
+
+	if ((ret = ctf_diff_init(ifp, ifp, &cdp)) != 0)
+		goto err;
+
+	ctf_dprintf("Successfully initialized dedup\n");
+	if ((ret = ctf_diff_self(cdp, ctf_dedup_cb, &cm)) != 0)
+		goto err;
+
+	ctf_dprintf("Successfully diffed types\n");
+	ret = ctf_merge_common(&cm);
+	ctf_dprintf("deduping types result: %d\n", ret);
+	if (ret == 0)
+		ret = ctf_update(cm.cm_out);
+	if (ret != 0)
+		goto err;
+
+	ctf_dprintf("Successfully deduped types\n");
+	ctf_phase_dump(cm.cm_out, "dedup-pre-syms");
+
+
+	/*
+	 * Now we need to fix up the object and function maps.
+	 */
+	for (cmo = list_head(&cmi->cmi_omap); cmo != NULL;
+	    cmo = list_next(&cmi->cmi_omap, cmo)) {
+		if (cmo->cmo_tid == 0)
+			continue;
+		ctf_dprintf("mapped %s %d->%d\n", cmo->cmo_name,
+		    cmo->cmo_tid, cm.cm_tmap[cmo->cmo_tid].cmt_map);
+		cmo->cmo_tid = cm.cm_tmap[cmo->cmo_tid].cmt_map;
+	}
+
+	for (cmf = list_head(&cmi->cmi_fmap); cmf != NULL;
+	    cmf = list_next(&cmi->cmi_fmap, cmf)) {
+		int i;
+
+		VERIFY(cm.cm_tmap[cmf->cmf_rtid].cmt_map != 0);
+		cmf->cmf_rtid = cm.cm_tmap[cmf->cmf_rtid].cmt_map;
+		for (i = 0; i < cmf->cmf_argc; i++) {
+			VERIFY(cm.cm_tmap[cmf->cmf_args[i]].cmt_map != 0);
+			cmf->cmf_args[i] = cm.cm_tmap[cmf->cmf_args[i]].cmt_map;
+		}
+	}
+
+	if (cmp->cmh_msyms == B_TRUE) {
+		ret = ctf_merge_symbols(cmp, cm.cm_out);
+		if (ret != 0) {
+			ret = ctf_errno(cm.cm_out);
+			ctf_dprintf("failed to dedup symbols: %s\n",
+			    ctf_errmsg(ret));
+			goto err;
+		}
+
+		ret = ctf_merge_functions(cmp, cm.cm_out);
+		if (ret != 0) {
+			ret = ctf_errno(cm.cm_out);
+			ctf_dprintf("failed to dedup functions: %s\n",
+			    ctf_errmsg(ret));
+			goto err;
+		}
+	}
+
+	ret = ctf_update(cm.cm_out);
+	if (ret == 0) {
+		cmc->cmi_input = NULL;
+		*outp = cm.cm_out;
+	}
+err:
+	ctf_merge_types_fini(&cm);
+	ctf_diff_fini(cdp);
+	return (ret);
+}
+
+int
+ctf_merge_set_nthreads(ctf_merge_t *cmp, const uint_t nthrs)
+{
+	if (nthrs == 0)
+		return (EINVAL);
+	cmp->cmh_nthreads = nthrs;
+	return (0);
+}
diff --git a/usr/src/lib/libctf/common/ctf_subr.c b/usr/src/lib/libctf/common/ctf_subr.c
index 467b6a8181..26f7e8c4db 100644
--- a/usr/src/lib/libctf/common/ctf_subr.c
+++ b/usr/src/lib/libctf/common/ctf_subr.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <ctf_impl.h>
 #include <libctf.h>
 #include <sys/mman.h>
@@ -56,6 +54,18 @@ ctf_alloc(size_t size)
 	return (malloc(size));
 }
 
+void *
+mergeq_alloc(size_t size)
+{
+	return (malloc(size));
+}
+
+void *
+workq_alloc(size_t size)
+{
+	return (malloc(size));
+}
+
 /*ARGSUSED*/
 void
 ctf_free(void *buf, size_t size)
@@ -63,6 +73,20 @@ ctf_free(void *buf, size_t size)
 	free(buf);
 }
 
+/*ARGSUSED*/
+void
+mergeq_free(void *buf, size_t size)
+{
+	free(buf);
+}
+
+/*ARGSUSED*/
+void
+workq_free(void *buf, size_t size)
+{
+	free(buf);
+}
+
 const char *
 ctf_strerror(int err)
 {
diff --git a/usr/src/lib/libctf/common/libctf.h b/usr/src/lib/libctf/common/libctf.h
index 3fd69318de..a5c5027048 100644
--- a/usr/src/lib/libctf/common/libctf.h
+++ b/usr/src/lib/libctf/common/libctf.h
@@ -23,6 +23,9 @@
  * Copyright 2001-2003 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
 
 /*
  * This header file defines the interfaces available from the CTF debugger
@@ -32,7 +35,7 @@
  * the fullness of time after we gain more experience with the interfaces.
  *
  * In the meantime, be aware that any program linked with libctf in this
- * release of Solaris is almost guaranteed to break in the next release.
+ * release of illumos is almost guaranteed to break in the next release.
  *
  * In short, do not user this header file or libctf for any purpose.
  */
@@ -40,9 +43,8 @@
 #ifndef	_LIBCTF_H
 #define	_LIBCTF_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/ctf_api.h>
+#include <libelf.h>
 
 #ifdef	__cplusplus
 extern "C" {
@@ -53,6 +55,46 @@ extern "C" {
  */
 extern int _libctf_debug;
 
+typedef enum ctf_diff_flag {
+	CTF_DIFF_F_IGNORE_INTNAMES = 0x01
+} ctf_diff_flag_t;
+
+typedef struct ctf_diff ctf_diff_t;
+typedef void (*ctf_diff_type_f)(ctf_file_t *, ctf_id_t, boolean_t, ctf_file_t *,
+    ctf_id_t, void *);
+typedef void (*ctf_diff_func_f)(ctf_file_t *, ulong_t, boolean_t, ctf_file_t *,
+    ulong_t, void *);
+typedef void (*ctf_diff_obj_f)(ctf_file_t *, ulong_t, ctf_id_t, boolean_t,
+    ctf_file_t *, ulong_t, ctf_id_t, void *);
+
+extern int ctf_diff_init(ctf_file_t *, ctf_file_t *, ctf_diff_t **);
+extern uint_t ctf_diff_getflags(ctf_diff_t *);
+extern int ctf_diff_setflags(ctf_diff_t *, uint_t);
+extern int ctf_diff_types(ctf_diff_t *, ctf_diff_type_f, void *);
+extern int ctf_diff_functions(ctf_diff_t *, ctf_diff_func_f, void *);
+extern int ctf_diff_objects(ctf_diff_t *, ctf_diff_obj_f, void *);
+extern void ctf_diff_fini(ctf_diff_t *);
+
+#define	CTF_CONVERT_F_IGNNONC	0x01
+extern ctf_file_t *ctf_elfconvert(int, Elf *, const char *, uint_t, uint_t,
+    int *, char *, size_t);
+extern ctf_file_t *ctf_fdconvert(int, const char *, uint_t, uint_t, int *,
+    char *, size_t);
+
+typedef struct ctf_merge_handle ctf_merge_t;
+extern ctf_merge_t *ctf_merge_init(int, int *);
+extern int ctf_merge_add(ctf_merge_t *, ctf_file_t *);
+extern int ctf_merge_set_nthreads(ctf_merge_t *, const uint_t);
+extern int ctf_merge_label(ctf_merge_t *, const char *);
+extern int ctf_merge_uniquify(ctf_merge_t *, ctf_file_t *, const char *);
+extern int ctf_merge_merge(ctf_merge_t *, ctf_file_t **);
+extern int ctf_merge_dedup(ctf_merge_t *, ctf_file_t **);
+extern void ctf_merge_fini(ctf_merge_t *);
+
+#define	CTF_ELFWRITE_F_COMPRESS		0x1
+extern int ctf_elffdwrite(ctf_file_t *, int, int, int);
+extern int ctf_elfwrite(ctf_file_t *, const char *, const char *, int);
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/lib/libctf/common/libctf_impl.h b/usr/src/lib/libctf/common/libctf_impl.h
new file mode 100644
index 0000000000..11193e97d0
--- /dev/null
+++ b/usr/src/lib/libctf/common/libctf_impl.h
@@ -0,0 +1,59 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBCTF_IMPL_H
+#define	_LIBCTF_IMPL_H
+
+/*
+ * Portions of libctf implementations that are only suitable for CTF's userland
+ * library, eg. converting and merging related routines.
+ */
+
+#include <libelf.h>
+#include <libctf.h>
+#include <ctf_impl.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum ctf_conv_status {
+	CTF_CONV_SUCCESS	= 0,
+	CTF_CONV_ERROR		= 1,
+	CTF_CONV_NOTSUP		= 2
+} ctf_conv_status_t;
+
+typedef ctf_conv_status_t (*ctf_convert_f)(int, Elf *, uint_t, int *,
+    ctf_file_t **, char *, size_t);
+extern ctf_conv_status_t ctf_dwarf_convert(int, Elf *, uint_t, int *,
+    ctf_file_t **, char *, size_t);
+
+/*
+ * zlib compression routines
+ */
+extern int ctf_compress(ctf_file_t *fp, void **, size_t *, size_t *);
+
+extern int ctf_diff_self(ctf_diff_t *, ctf_diff_type_f, void *);
+
+/*
+ * Internal debugging aids
+ */
+extern void ctf_phase_dump(ctf_file_t *, const char *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBCTF_IMPL_H */
diff --git a/usr/src/lib/libctf/common/mapfile-vers b/usr/src/lib/libctf/common/mapfile-vers
index 5573e8db25..cfd2952bbe 100644
--- a/usr/src/lib/libctf/common/mapfile-vers
+++ b/usr/src/lib/libctf/common/mapfile-vers
@@ -23,7 +23,7 @@
 #
 
 #
-# Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+# Copyright (c) 2015, Joyent, Inc.  All rights reserved.
 #
 
 #
@@ -53,10 +53,13 @@ SYMBOL_VERSION SUNWprivate_1.2 {
 	ctf_add_enumerator;
 	ctf_add_float;
 	ctf_add_forward;
+	ctf_add_funcptr;
 	ctf_add_function;
 	ctf_add_integer;
+	ctf_add_label;
 	ctf_add_member;
 	ctf_add_pointer;
+	ctf_add_object;
 	ctf_add_restrict;
 	ctf_add_struct;
 	ctf_add_type;
@@ -64,17 +67,48 @@ SYMBOL_VERSION SUNWprivate_1.2 {
 	ctf_add_union;
 	ctf_add_volatile;
 	ctf_create;
+	ctf_dataptr;
 	ctf_delete_type;
+	ctf_diff_init;
+	ctf_diff_fini;
+	ctf_diff_functions;
+	ctf_diff_getflags;
+	ctf_diff_objects;
+	ctf_diff_setflags;
+	ctf_diff_types;
 	ctf_discard;
 	ctf_dup;
+	ctf_elfconvert;
+	ctf_elffdwrite;
+	ctf_elfwrite;
 	ctf_enum_value;
+	ctf_fdconvert;
+	ctf_flags;
+	ctf_func_args_by_id;
+	ctf_func_info_by_id;
+	ctf_function_iter;
+	ctf_kind_name;
 	ctf_label_info;
 	ctf_label_iter;
 	ctf_label_topmost;
 	ctf_member_info;
+	ctf_merge_add;
+	ctf_merge_dedup;
+	ctf_merge_fini;
+	ctf_merge_init;
+	ctf_merge_label;
+	ctf_merge_merge;
+	ctf_merge_set_nthreads;
+	ctf_merge_uniquify;
+	ctf_object_iter;
 	ctf_parent_file;
+	ctf_parent_label;
 	ctf_parent_name;
 	ctf_set_array;
+	ctf_set_root;
+	ctf_set_size;
+	ctf_string_iter;
+	ctf_symbol_name;
 	ctf_type_align;
 	ctf_type_cmp;
 	ctf_type_compat;
diff --git a/usr/src/lib/libcurses/screen/setupterm.c b/usr/src/lib/libcurses/screen/setupterm.c
index c1f4bdeb04..f67e8751b7 100644
--- a/usr/src/lib/libcurses/screen/setupterm.c
+++ b/usr/src/lib/libcurses/screen/setupterm.c
@@ -37,8 +37,6 @@
  * contributors.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*LINTLIBRARY*/
 
 #include	<stdio.h>
@@ -48,6 +46,7 @@
 #include	<string.h>
 #include	<unistd.h>
 #include	<errno.h>
+#include	<zone.h>
 #include	"curses_inc.h"
 
 #define	TERMPATH	"/usr/share/lib/terminfo/"
@@ -272,9 +271,11 @@ setupterm(char *term, int filenum, int *errret)
 	}
 
 	if (tfd < 0) {
+		const char *zroot = zone_get_nroot();
 		/* /usr/share/lib/terminfo/?/$TERM */
 		if (snprintf(fname, sizeof (fname),
-			"%s/%c/%s", TERMPATH, *term, term) >= sizeof (fname)) {
+			"%s/%s/%c/%s", zroot == NULL ? "" : zroot, TERMPATH,
+			*term, term) >= sizeof (fname)) {
 			term_errno = TERMINFO_TOO_LONG;
 			goto out_err;
 		}
diff --git a/usr/src/cmd/acpi/common/Makefile b/usr/src/lib/libcustr/Makefile
index 9053fe061b..19b08dc521 100644
--- a/usr/src/cmd/acpi/common/Makefile
+++ b/usr/src/lib/libcustr/Makefile
@@ -8,32 +8,36 @@
 # source.  A copy of the CDDL is also available via the Internet at
 # http://www.illumos.org/license/CDDL.
 #
-# Copyright 2016 Joyent, Inc.
-#
 
-LIBRARY =	acpi.a
+#
+# Copyright 2018, Joyent, Inc.
+#
 
-include	$(SRC)/lib/Makefile.lib
+include $(SRC)/lib/Makefile.lib
 
-OBJECTS= getopt.o osl.o utascii.o utdebug.o utexcep.o utglobal.o  utmath.o \
-	utnonansi.o utprint.o utxferror.o
-SRCS = $(OBJECTS:.o=.c)
+HDRS =		libcustr.h
+HDRDIR =	common
 
-CERRWARN += -_gcc=-Wno-unused-function
+SUBDIRS =		$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
 
-CPPFLAGS += -I$(SRC)/uts/intel/sys/acpi -DACPI_APPLICATION
+all :=		TARGET= all
+clean :=	TARGET= clean
+clobber :=	TARGET= clobber
+install :=	TARGET= install
+lint :=		TARGET= lint
 
-LDLIBS += -lc
+.KEEP_STATE:
 
-HSONAME=
-MAPFILES = mapfile-vers
+all clean clobber install lint: $(SUBDIRS)
 
-CLOBBERFILES= $(LIBRARY)
+install_h: $(ROOTHDRS)
 
-.KEEP_STATE:
+check: $(CHECKHDRS)
 
-all: $(LIBRARY)
+$(SUBDIRS):	FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
 
-install: all
+FRC:
 
 include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/lib/libcustr/Makefile.com b/usr/src/lib/libcustr/Makefile.com
new file mode 100644
index 0000000000..747026da89
--- /dev/null
+++ b/usr/src/lib/libcustr/Makefile.com
@@ -0,0 +1,38 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018, Joyent, Inc.
+#
+
+LIBRARY =	libcustr.a
+VERS =		.1
+OBJECTS =	custr.o
+
+include $(SRC)/lib/Makefile.lib
+
+# Things out of /sbin like dladm require custr, so it should go into /lib so
+# they can work in case /usr is split
+include $(SRC)/lib/Makefile.rootfs
+
+LIBS =		$(DYNLIB) $(LINTLIB)
+LDLIBS +=	-lc
+CPPFLAGS +=	-D__EXTENSIONS__
+
+SRCDIR =	../common
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+lint: lintcheck
+
+include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/lib/libcustr/amd64/Makefile b/usr/src/lib/libcustr/amd64/Makefile
new file mode 100644
index 0000000000..4b3c5dd187
--- /dev/null
+++ b/usr/src/lib/libcustr/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018, Joyent, Inc.
+#
+
+include ../Makefile.com
+include $(SRC)/lib/Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64)
diff --git a/usr/src/lib/libcmdutils/common/custr.c b/usr/src/lib/libcustr/common/custr.c
index 95d44e431f..429fedf8e9 100644
--- a/usr/src/lib/libcmdutils/common/custr.c
+++ b/usr/src/lib/libcustr/common/custr.c
@@ -19,12 +19,13 @@
 
 #include <stdlib.h>
 #include <err.h>
+#include <errno.h>
 #include <string.h>
 #include <stdio.h>
 #include <stdarg.h>
 #include <sys/debug.h>
 
-#include "libcmdutils.h"
+#include "libcustr.h"
 
 typedef enum {
 	CUSTR_FIXEDBUF	= 0x01
diff --git a/usr/src/lib/libcustr/common/libcustr.h b/usr/src/lib/libcustr/common/libcustr.h
new file mode 100644
index 0000000000..7671390d7f
--- /dev/null
+++ b/usr/src/lib/libcustr/common/libcustr.h
@@ -0,0 +1,82 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018, Joyent, Inc.
+ */
+
+#ifndef _LIBCUSTR_H
+#define	_LIBCUSTR_H
+
+#include <stdarg.h>
+#include <sys/types.h>
+
+/* dynamic string utilities */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct custr custr_t;
+
+/*
+ * Allocate and free a "custr_t" dynamic string object.  Returns 0 on success
+ * and -1 otherwise.
+ */
+int custr_alloc(custr_t **);
+void custr_free(custr_t *);
+
+/*
+ * Allocate a "custr_t" dynamic string object that operates on a fixed external
+ * buffer.
+ */
+int custr_alloc_buf(custr_t **, void *, size_t);
+
+/*
+ * Append a single character, or a NUL-terminated string of characters, to a
+ * dynamic string.  Returns 0 on success and -1 otherwise.  The dynamic string
+ * will be unmodified if the function returns -1.
+ */
+int custr_appendc(custr_t *, char);
+int custr_append(custr_t *, const char *);
+
+/*
+ * Append a format string and arguments as though the contents were being parsed
+ * through snprintf. Returns 0 on success and -1 otherwise.  The dynamic string
+ * will be unmodified if the function returns -1.
+ */
+int custr_append_printf(custr_t *, const char *, ...);
+int custr_append_vprintf(custr_t *, const char *, va_list);
+
+/*
+ * Determine the length in bytes, not including the NUL terminator, of the
+ * dynamic string.
+ */
+size_t custr_len(custr_t *);
+
+/*
+ * Clear the contents of a dynamic string.  Does not free the underlying
+ * memory.
+ */
+void custr_reset(custr_t *);
+
+/*
+ * Retrieve a const pointer to a NUL-terminated string version of the contents
+ * of the dynamic string.  Storage for this string should not be freed, and
+ * the pointer will be invalidated by any mutations to the dynamic string.
+ */
+const char *custr_cstr(custr_t *str);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBCUSTR_H */
diff --git a/usr/src/lib/libcustr/common/llib-lcustr b/usr/src/lib/libcustr/common/llib-lcustr
new file mode 100644
index 0000000000..5c08550594
--- /dev/null
+++ b/usr/src/lib/libcustr/common/llib-lcustr
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018, Joyent, Inc.
+ */
+
+/*LINTLIBRARY*/
+/*PROTOLIB1*/
+
+#include <libcustr.h>
diff --git a/usr/src/lib/libcustr/common/mapfile-vers b/usr/src/lib/libcustr/common/mapfile-vers
new file mode 100644
index 0000000000..369771929a
--- /dev/null
+++ b/usr/src/lib/libcustr/common/mapfile-vers
@@ -0,0 +1,46 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018, Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION ILLUMOSprivate {
+    global:
+	custr_alloc;
+	custr_alloc_buf;
+	custr_append;
+	custr_appendc;
+	custr_append_printf;
+	custr_append_vprintf;
+	custr_cstr;
+	custr_free;
+	custr_len;
+	custr_reset;
+    local:
+	*;
+};
diff --git a/usr/src/lib/libcustr/i386/Makefile b/usr/src/lib/libcustr/i386/Makefile
new file mode 100644
index 0000000000..f32d7a5b91
--- /dev/null
+++ b/usr/src/lib/libcustr/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018, Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libcustr/sparc/Makefile b/usr/src/lib/libcustr/sparc/Makefile
new file mode 100644
index 0000000000..f32d7a5b91
--- /dev/null
+++ b/usr/src/lib/libcustr/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018, Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libcustr/sparcv9/Makefile b/usr/src/lib/libcustr/sparcv9/Makefile
new file mode 100644
index 0000000000..4b3c5dd187
--- /dev/null
+++ b/usr/src/lib/libcustr/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018, Joyent, Inc.
+#
+
+include ../Makefile.com
+include $(SRC)/lib/Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64)
diff --git a/usr/src/lib/libdhcpagent/common/dhcpagent_util.c b/usr/src/lib/libdhcpagent/common/dhcpagent_util.c
index 1c381fa08f..7a44ae5249 100644
--- a/usr/src/lib/libdhcpagent/common/dhcpagent_util.c
+++ b/usr/src/lib/libdhcpagent/common/dhcpagent_util.c
@@ -36,6 +36,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <zone.h>
 
 #include "dhcpagent_ipc.h"
 #include "dhcpagent_util.h"
@@ -125,6 +126,12 @@ dhcp_start_agent(int timeout)
 	int			ctfd;
 	pid_t			childpid;
 	ctid_t			ct;
+	char			dhcpcmd[MAXPATHLEN];
+	const char		*zroot = zone_get_nroot();
+
+	/* Prepend the root of the native code in the brand to the command */
+	(void) snprintf(dhcpcmd, sizeof (dhcpcmd), "%s%s", zroot != NULL ?
+	    zroot : "", DHCP_AGENT_PATH);
 
 	/*
 	 * just send a dummy request to the agent to find out if it's
@@ -160,7 +167,7 @@ dhcp_start_agent(int timeout)
 		goto fail;
 
 	case  0:
-		(void) execl(DHCP_AGENT_PATH, DHCP_AGENT_PATH, (char *)0);
+		(void) execl(dhcpcmd, dhcpcmd, (char *)0);
 		_exit(EXIT_FAILURE);
 
 	default:
diff --git a/usr/src/lib/libdiskmgt/common/findevs.c b/usr/src/lib/libdiskmgt/common/findevs.c
index 8114f31352..2ac0e6cada 100644
--- a/usr/src/lib/libdiskmgt/common/findevs.c
+++ b/usr/src/lib/libdiskmgt/common/findevs.c
@@ -27,6 +27,7 @@
 /*
  * Copyright (c) 2011 by Delphix. All rights reserved.
  * Copyright 2017 Nexenta Systems, Inc.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <fcntl.h>
@@ -67,6 +68,7 @@
 static char *ctrltypes[] = {
 	DDI_NT_FC_ATTACHMENT_POINT,
 	DDI_NT_NVME_ATTACHMENT_POINT,
+	DDI_NT_NVME_NEXUS,
 	DDI_NT_SATA_ATTACHMENT_POINT,
 	DDI_NT_SATA_NEXUS,
 	DDI_NT_SCSI_ATTACHMENT_POINT,
@@ -1019,8 +1021,10 @@ ctype(di_node_t node, di_minor_t minor)
 	    libdiskmgt_str_eq(name, "fp")))
 		return (DM_CTYPE_FIBRE);
 
-	if (libdiskmgt_str_eq(type, DDI_NT_NVME_ATTACHMENT_POINT))
+	if (libdiskmgt_str_eq(type, DDI_NT_NVME_NEXUS) ||
+	    libdiskmgt_str_eq(type, DDI_NT_NVME_ATTACHMENT_POINT)) {
 		return (DM_CTYPE_NVME);
+	}
 
 	if (libdiskmgt_str_eq(type, DDI_NT_SATA_NEXUS) ||
 	    libdiskmgt_str_eq(type, DDI_NT_SATA_ATTACHMENT_POINT))
diff --git a/usr/src/lib/libdiskmgt/common/libdiskmgt.h b/usr/src/lib/libdiskmgt/common/libdiskmgt.h
index 7391350962..96bf472842 100644
--- a/usr/src/lib/libdiskmgt/common/libdiskmgt.h
+++ b/usr/src/lib/libdiskmgt/common/libdiskmgt.h
@@ -25,8 +25,8 @@
  */
 
 /*
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright 2017 Nexenta Systems, Inc.
+ * Copyright (c) 2017, Joyent, Inc. All rights reserved.
  */
 
 #ifndef _LIBDISKMGT_H
diff --git a/usr/src/lib/libdladm/Makefile b/usr/src/lib/libdladm/Makefile
index 92de14cc8a..275c1c0866 100644
--- a/usr/src/lib/libdladm/Makefile
+++ b/usr/src/lib/libdladm/Makefile
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015, Joyent, Inc.
 #
 #
 
@@ -29,7 +30,7 @@ HDRS =		libdladm.h libdladm_impl.h libdllink.h libdlaggr.h	\
 		libdlwlan.h libdlwlan_impl.h libdlvnic.h libdlvlan.h	\
 		libdlmgmt.h libdlflow.h libdlflow_impl.h libdlstat.h	\
 		libdlether.h libdlsim.h libdlbridge.h libdliptun.h	\
-		libdlib.h
+		libdlib.h libdloverlay.h
 
 HDRDIR =	common
 
@@ -50,6 +51,15 @@ MSGFILES =	common/libdladm.c common/linkprop.c common/secobj.c	\
 
 XGETFLAGS =     -a -x libdladm.xcl
 
+TYPECHECK_LIB =	libdladm.so.1
+TYPELIST =	overlay_ioc_create_t \
+		overlay_ioc_activate_t \
+		overlay_ioc_delete_t \
+		overlay_ioc_nprops_t \
+		overlay_ioc_propinfo_t \
+		overlay_ioc_prop_t \
+		mac_protect_t
+
 all :=		TARGET = all
 clean :=	TARGET = clean
 clobber :=	TARGET = clobber
@@ -62,7 +72,7 @@ all clean clobber install lint: $(SUBDIRS)
 
 install_h:	$(ROOTHDRS)
 
-check:		$(CHECKHDRS)
+check:		$(CHECKHDRS) $(TYPECHECK)
 
 $(POFILE):	pofile_MSGFILES
 
diff --git a/usr/src/lib/libdladm/Makefile.com b/usr/src/lib/libdladm/Makefile.com
index 8d036ccd27..f9270f9769 100644
--- a/usr/src/lib/libdladm/Makefile.com
+++ b/usr/src/lib/libdladm/Makefile.com
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015, Joyent, Inc.
 #
 
 LIBRARY = libdladm.a
@@ -27,7 +28,8 @@ VERS    = .1
 OBJECTS = libdladm.o secobj.o linkprop.o libdllink.o libdlaggr.o \
 	libdlwlan.o libdlvnic.o libdlmgmt.o libdlvlan.o	libdlib.o\
 	flowattr.o flowprop.o propfuncs.o libdlflow.o libdlstat.o \
-	usage.o libdlether.o libdlsim.o libdlbridge.o libdliptun.o
+	usage.o libdlether.o libdlsim.o libdlbridge.o libdliptun.o \
+	libdloverlay.o
 
 include ../../Makefile.lib
 
@@ -36,7 +38,7 @@ include ../../Makefile.rootfs
 
 LIBS =		$(DYNLIB) $(LINTLIB)
 LDLIBS +=	-ldevinfo -lc -linetutil -lsocket -lscf -lrcm -lnvpair \
-		-lexacct -lkstat -lpool
+		-lexacct -lnsl -lkstat -lpool -lvarpd
 
 SRCDIR =	../common
 $(LINTLIB) :=	SRCS = $(SRCDIR)/$(LINTSRC)
@@ -48,6 +50,9 @@ CERRWARN +=	-_gcc=-Wno-unused-label
 CERRWARN +=	-_gcc=-Wno-uninitialized
 CPPFLAGS +=	-I$(SRCDIR) -D_REENTRANT
 
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
 .KEEP_STATE:
 
 all:		$(LIBS)
diff --git a/usr/src/lib/libdladm/common/libdladm.c b/usr/src/lib/libdladm/common/libdladm.c
index b8e744f4f9..1616885309 100644
--- a/usr/src/lib/libdladm/common/libdladm.c
+++ b/usr/src/lib/libdladm/common/libdladm.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 #include <unistd.h>
@@ -29,6 +30,9 @@
 #include <strings.h>
 #include <dirent.h>
 #include <stdlib.h>
+#include <assert.h>
+#include <stdio.h>
+#include <stdarg.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <sys/param.h>
@@ -95,6 +99,18 @@ static link_protect_t link_protect_types[] = {
 };
 #define	LPTYPES	(sizeof (link_protect_types) / sizeof (link_protect_t))
 
+typedef struct {
+	uint32_t	ld_type;
+	char		*ld_name;
+} link_dynamic_t;
+
+static link_dynamic_t link_dynamic_types[] = {
+	{ MPT_DYN_DHCPV4, "dhcpv4" },
+	{ MPT_DYN_DHCPV6, "dhcpv6" },
+	{ MPT_DYN_SLAAC, "slaac" },
+};
+#define	DYNTYPES	(sizeof (link_dynamic_types) / sizeof (link_dynamic_t))
+
 dladm_status_t
 dladm_open(dladm_handle_t *handle)
 {
@@ -418,6 +434,9 @@ dladm_status2str(dladm_status_t status, char *buf)
 	case DLADM_STATUS_INVALID_MTU:
 		s = "MTU check failed, MTU outside of device's supported range";
 		break;
+	case DLADM_STATUS_BAD_ENCAP:
+		s = "invalid encapsulation protocol";
+		break;
 	default:
 		s = "<unknown error>";
 		break;
@@ -654,6 +673,9 @@ dladm_class2str(datalink_class_t class, char *buf)
 	case DATALINK_CLASS_PART:
 		s = "part";
 		break;
+	case DATALINK_CLASS_OVERLAY:
+		s = "overlay";
+		break;
 	default:
 		s = "unknown";
 		break;
@@ -941,6 +963,28 @@ dladm_protect2str(uint32_t ptype, char *buf)
 	return (buf);
 }
 
+
+/*
+ * Convert dynamic address method value to a string.
+ */
+const char *
+dladm_dynamic2str(uint32_t dtype, char *buf, size_t size)
+{
+	const char	*s = "--";
+	link_dynamic_t	*ld;
+	int		i;
+
+	for (i = 0; i < DYNTYPES; i++) {
+		ld = &link_dynamic_types[i];
+		if (ld->ld_type == dtype) {
+			s = ld->ld_name;
+			break;
+		}
+	}
+	(void) snprintf(buf, size, "%s", dgettext(TEXT_DOMAIN, s));
+	return (buf);
+}
+
 /*
  * Convert an IPv4 address to/from a string.
  */
@@ -1082,8 +1126,8 @@ fail:
  * is allocated here but should be freed by the caller.
  */
 dladm_status_t
-dladm_strs2range(char **prop_val, uint_t val_cnt, mac_propval_type_t type,
-    mac_propval_range_t **range)
+dladm_strs2range(char **prop_val, uint_t val_cnt,
+    mac_propval_type_t type, mac_propval_range_t **range)
 {
 	int			i;
 	char			*endp;
@@ -1139,15 +1183,15 @@ dladm_strs2range(char **prop_val, uint_t val_cnt, mac_propval_type_t type,
  * Convert a mac_propval_range_t structure into an array of elements.
  */
 dladm_status_t
-dladm_range2list(mac_propval_range_t *rangep, void *elem, uint_t *nelem)
+dladm_range2list(const mac_propval_range_t *rangep, void *elem, uint_t *nelem)
 {
 	int		i, j, k;
 	dladm_status_t	status = DLADM_STATUS_OK;
 
 	switch (rangep->mpr_type) {
 	case MAC_PROPVAL_UINT32: {
-		mac_propval_uint32_range_t	*ur;
-		uint32_t			*elem32 = elem;
+		const mac_propval_uint32_range_t	*ur;
+		uint32_t				*elem32 = elem;
 
 		k = 0;
 		ur = &rangep->mpr_range_uint32[0];
@@ -1175,13 +1219,13 @@ dladm_range2list(mac_propval_range_t *rangep, void *elem, uint_t *nelem)
  * of single elements or ranges.
  */
 int
-dladm_range2strs(mac_propval_range_t *rangep, char **prop_val)
+dladm_range2strs(const mac_propval_range_t *rangep, char **prop_val)
 {
 	int	i;
 
 	switch (rangep->mpr_type) {
 	case MAC_PROPVAL_UINT32: {
-		mac_propval_uint32_range_t	*ur;
+		const mac_propval_uint32_range_t	*ur;
 
 		/* Write ranges and individual elements */
 		ur = &rangep->mpr_range_uint32[0];
@@ -1198,6 +1242,20 @@ dladm_range2strs(mac_propval_range_t *rangep, char **prop_val)
 		}
 		return (0);
 	}
+	case MAC_PROPVAL_STR: {
+		const mac_propval_str_range_t	*str;
+		size_t				coff, len;
+
+		coff = 0;
+		str = &rangep->u.mpr_str;
+		for (i = 0; i < rangep->mpr_count; i++) {
+			len = strlen(&str->mpur_data[coff]);
+			(void) strlcpy(prop_val[i], &str->mpur_data[coff],
+			    DLADM_PROP_VAL_MAX);
+			coff += len + 1;
+		}
+		return (0);
+	}
 	default:
 		break;
 	}
@@ -1275,3 +1333,54 @@ dladm_list2range(void *elem, uint_t nelem, mac_propval_type_t type,
 
 	return (status);
 }
+
+void
+dladm_errlist_init(dladm_errlist_t *erl)
+{
+	bzero(erl, sizeof (dladm_errlist_t));
+}
+
+void
+dladm_errlist_reset(dladm_errlist_t *erl)
+{
+	uint_t i;
+
+	for (i = 0; i < erl->el_count; i++)
+		free(erl->el_errs[i]);
+	free(erl->el_errs);
+	dladm_errlist_init(erl);
+}
+
+dladm_status_t
+dladm_errlist_append(dladm_errlist_t *erl, const char *fmt, ...)
+{
+	int ret;
+	va_list ap;
+	char *m = NULL;
+
+	if (erl->el_count == erl->el_alloc) {
+		int alloc;
+		void *addr;
+		if (erl->el_alloc == 0) {
+			assert(erl->el_errs == NULL);
+			alloc = 32;
+		} else {
+			alloc = erl->el_alloc + 32;
+		}
+		addr = realloc(erl->el_errs, sizeof (char *) * alloc);
+		if (addr == NULL)
+			return (DLADM_STATUS_NOMEM);
+
+		erl->el_errs = addr;
+		erl->el_alloc = alloc;
+	}
+
+	va_start(ap, fmt);
+	ret = vasprintf(&m, fmt, ap);
+	va_end(ap);
+	if (ret == -1)
+		return (dladm_errno2status(errno));
+	erl->el_errs[erl->el_count] = m;
+	erl->el_count++;
+	return (DLADM_STATUS_OK);
+}
diff --git a/usr/src/lib/libdladm/common/libdladm.h b/usr/src/lib/libdladm/common/libdladm.h
index c2fceb25ab..8285517a95 100644
--- a/usr/src/lib/libdladm/common/libdladm.h
+++ b/usr/src/lib/libdladm/common/libdladm.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 #ifndef _LIBDLADM_H
@@ -41,7 +42,7 @@ extern "C" {
 #endif
 
 #define	LINKID_STR_WIDTH	10
-#define	DLADM_STRSIZE		256
+#define	DLADM_STRSIZE		2048
 
 /*
  * option flags taken by the libdladm functions
@@ -71,6 +72,10 @@ extern "C" {
  *  - DLADM_OPT_BOOT:
  *    Bypass check functions during boot (used by pool property since pools
  *    can come up after link properties are set)
+ *
+ *  - DLADM_OPT_TRANSIENT:
+ *    Indicates that the link assigned to a zone is transient and will be
+ *    removed when the zone shuts down.
  */
 #define	DLADM_OPT_ACTIVE	0x00000001
 #define	DLADM_OPT_PERSIST	0x00000002
@@ -81,6 +86,7 @@ extern "C" {
 #define	DLADM_OPT_VLAN		0x00000040
 #define	DLADM_OPT_NOREFRESH	0x00000080
 #define	DLADM_OPT_BOOT		0x00000100
+#define	DLADM_OPT_TRANSIENT	0x00000200
 
 #define	DLADM_WALK_TERMINATE	0
 #define	DLADM_WALK_CONTINUE	-1
@@ -173,7 +179,8 @@ typedef enum {
 	DLADM_STATUS_NO_IB_HW_RESOURCE,
 	DLADM_STATUS_INVALID_PKEY_TBL_SIZE,
 	DLADM_STATUS_PORT_NOPROTO,
-	DLADM_STATUS_INVALID_MTU
+	DLADM_STATUS_INVALID_MTU,
+	DLADM_STATUS_BAD_ENCAP
 } dladm_status_t;
 
 typedef enum {
@@ -221,6 +228,12 @@ typedef struct dladm_arg_list {
 	char			*al_buf;
 } dladm_arg_list_t;
 
+typedef struct dladm_errlist {
+	uint_t		el_count;
+	uint_t		el_alloc;
+	char		**el_errs;
+} dladm_errlist_t;
+
 typedef enum {
 	DLADM_LOGTYPE_LINK = 1,
 	DLADM_LOGTYPE_FLOW
@@ -252,6 +265,7 @@ extern dladm_status_t	dladm_str2pri(char *, mac_priority_level_t *);
 extern const char	*dladm_pri2str(mac_priority_level_t, char *);
 extern dladm_status_t	dladm_str2protect(char *, uint32_t *);
 extern const char	*dladm_protect2str(uint32_t, char *);
+extern const char	*dladm_dynamic2str(uint32_t, char *, size_t);
 extern dladm_status_t	dladm_str2ipv4addr(char *, void *);
 extern const char	*dladm_ipv4addr2str(void *, char *);
 extern dladm_status_t	dladm_str2ipv6addr(char *, void *);
@@ -282,12 +296,15 @@ extern dladm_status_t	dladm_zone_halt(dladm_handle_t, zoneid_t);
 
 extern dladm_status_t	dladm_strs2range(char **, uint_t, mac_propval_type_t,
 			    mac_propval_range_t **);
-extern dladm_status_t	dladm_range2list(mac_propval_range_t *, void*,
+extern dladm_status_t	dladm_range2list(const mac_propval_range_t *, void *,
 			    uint_t *);
-extern int		dladm_range2strs(mac_propval_range_t *, char **);
+extern int		dladm_range2strs(const mac_propval_range_t *, char **);
 extern dladm_status_t	dladm_list2range(void *, uint_t, mac_propval_type_t,
 			    mac_propval_range_t **);
 
+extern void		dladm_errlist_init(dladm_errlist_t *);
+extern void		dladm_errlist_reset(dladm_errlist_t *);
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/lib/libdladm/common/libdladm_impl.h b/usr/src/lib/libdladm/common/libdladm_impl.h
index 13169285e3..285cb27aad 100644
--- a/usr/src/lib/libdladm/common/libdladm_impl.h
+++ b/usr/src/lib/libdladm/common/libdladm_impl.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 #ifndef _LIBDLADM_IMPL_H
@@ -146,10 +147,10 @@ extern dladm_status_t	dladm_flow_proplist_extract(dladm_arg_list_t *,
  * by the pd_check function.
  */
 typedef	dladm_status_t	rp_extractf_t(val_desc_t *, uint_t, void *);
-extern rp_extractf_t	extract_maxbw, extract_priority,
-			extract_cpus, extract_protection,
-			extract_allowedips, extract_allowedcids,
-			extract_rxrings, extract_txrings, extract_pool;
+extern rp_extractf_t	extract_dynamic_methods, extract_priority, extract_cpus,
+			extract_protection, extract_allowallcids, extract_pool,
+			extract_allowedips, extract_allowedcids, extract_maxbw,
+			extract_rxrings, extract_txrings;
 
 typedef struct resource_prop_s {
 	/*
@@ -168,6 +169,12 @@ typedef struct resource_prop_s {
  */
 #define	FBRIDGE		"bridge"	/* string */
 
+/*
+ * For error lists
+ */
+extern dladm_status_t	dladm_errlist_append(dladm_errlist_t *,
+    const char *, ...);
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/lib/libdladm/common/libdllink.c b/usr/src/lib/libdladm/common/libdllink.c
index 58bec0ad30..7e952b97e9 100644
--- a/usr/src/lib/libdladm/common/libdllink.c
+++ b/usr/src/lib/libdladm/common/libdllink.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent Inc. All rights reserved.
  */
 
 #include <sys/types.h>
@@ -386,10 +387,14 @@ dladm_linkduplex2str(link_duplex_t duplex, char *buf)
 /*
  * Case 1: rename an existing link1 to a link2 that does not exist.
  * Result: <linkid1, link2>
+ * The zonename parameter is used to allow us to create a VNIC in the global
+ * zone which is assigned to a non-global zone.  Since there is a race condition
+ * in the create process if two VNICs have the same name, we need to rename it
+ * after it has been assigned to the zone.
  */
 static dladm_status_t
 i_dladm_rename_link_c1(dladm_handle_t handle, datalink_id_t linkid1,
-    const char *link1, const char *link2, uint32_t flags)
+    const char *link1, const char *link2, uint32_t flags, const char *zonename)
 {
 	dld_ioc_rename_t	dir;
 	dladm_status_t		status = DLADM_STATUS_OK;
@@ -402,6 +407,10 @@ i_dladm_rename_link_c1(dladm_handle_t handle, datalink_id_t linkid1,
 		dir.dir_linkid1 = linkid1;
 		dir.dir_linkid2 = DATALINK_INVALID_LINKID;
 		(void) strlcpy(dir.dir_link, link2, MAXLINKNAMELEN);
+		if (zonename != NULL)
+			dir.dir_zoneinit = B_TRUE;
+		else
+			dir.dir_zoneinit = B_FALSE;
 
 		if (ioctl(dladm_dld_fd(handle), DLDIOC_RENAME, &dir) < 0) {
 			status = dladm_errno2status(errno);
@@ -412,6 +421,7 @@ i_dladm_rename_link_c1(dladm_handle_t handle, datalink_id_t linkid1,
 	status = dladm_remap_datalink_id(handle, linkid1, link2);
 	if (status != DLADM_STATUS_OK && (flags & DLADM_OPT_ACTIVE)) {
 		(void) strlcpy(dir.dir_link, link1, MAXLINKNAMELEN);
+		dir.dir_zoneinit = B_FALSE;
 		(void) ioctl(dladm_dld_fd(handle), DLDIOC_RENAME, &dir);
 	}
 	return (status);
@@ -508,6 +518,7 @@ i_dladm_rename_link_c2(dladm_handle_t handle, datalink_id_t linkid1,
 	 */
 	dir.dir_linkid1 = linkid1;
 	dir.dir_linkid2 = linkid2;
+	dir.dir_zoneinit = B_FALSE;
 	if (ioctl(dladm_dld_fd(handle), DLDIOC_RENAME, &dir) < 0)
 		status = dladm_errno2status(errno);
 
@@ -616,7 +627,8 @@ done:
 }
 
 dladm_status_t
-dladm_rename_link(dladm_handle_t handle, const char *link1, const char *link2)
+dladm_rename_link(dladm_handle_t handle, const char *zonename,
+    const char *link1, const char *link2)
 {
 	datalink_id_t		linkid1 = DATALINK_INVALID_LINKID;
 	datalink_id_t		linkid2 = DATALINK_INVALID_LINKID;
@@ -626,11 +638,11 @@ dladm_rename_link(dladm_handle_t handle, const char *link1, const char *link2)
 	boolean_t		remphy2 = B_FALSE;
 	dladm_status_t  	status;
 
-	(void) dladm_name2info(handle, link1, &linkid1, &flags1, &class1,
-	    &media1);
-	if ((dladm_name2info(handle, link2, &linkid2, &flags2, &class2,
-	    &media2) == DLADM_STATUS_OK) && (class2 == DATALINK_CLASS_PHYS) &&
-	    (flags2 == DLADM_OPT_PERSIST)) {
+	(void) dladm_zname2info(handle, zonename, link1, &linkid1, &flags1,
+	    &class1, &media1);
+	if ((dladm_zname2info(handle, zonename, link2, &linkid2, &flags2,
+	    &class2, &media2) == DLADM_STATUS_OK) &&
+	    (class2 == DATALINK_CLASS_PHYS) && (flags2 == DLADM_OPT_PERSIST)) {
 		/*
 		 * see whether link2 is a removed physical link.
 		 */
@@ -644,7 +656,7 @@ dladm_rename_link(dladm_handle_t handle, const char *link1, const char *link2)
 			 * does not exist.
 			 */
 			status = i_dladm_rename_link_c1(handle, linkid1, link1,
-			    link2, flags1);
+			    link2, flags1, zonename);
 		} else if (remphy2) {
 			/*
 			 * case 2: rename an available link to a REMOVED
diff --git a/usr/src/lib/libdladm/common/libdllink.h b/usr/src/lib/libdladm/common/libdllink.h
index a2830b5e37..a858e78aa3 100644
--- a/usr/src/lib/libdladm/common/libdllink.h
+++ b/usr/src/lib/libdladm/common/libdllink.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent Inc. All rights reserved.
  */
 
 #ifndef _LIBDLLINK_H
@@ -121,7 +122,7 @@ extern dladm_status_t	dladm_info(dladm_handle_t, datalink_id_t,
 			    dladm_attr_t *);
 
 extern dladm_status_t	dladm_rename_link(dladm_handle_t, const char *,
-			    const char *);
+			    const char *, const char *);
 
 extern dladm_status_t	dladm_set_linkprop(dladm_handle_t, datalink_id_t,
 			    const char *, char **, uint_t, uint_t);
@@ -170,6 +171,9 @@ extern dladm_status_t	dladm_up_datalink_id(dladm_handle_t, datalink_id_t);
 extern dladm_status_t	dladm_name2info(dladm_handle_t, const char *,
 			    datalink_id_t *, uint32_t *, datalink_class_t *,
 			    uint32_t *);
+extern dladm_status_t	dladm_zname2info(dladm_handle_t, const char *,
+			    const char *, datalink_id_t *, uint32_t *,
+			    datalink_class_t *, uint32_t *);
 extern dladm_status_t	dladm_datalink_id2info(dladm_handle_t, datalink_id_t,
 			    uint32_t *, datalink_class_t *, uint32_t *, char *,
 			    size_t);
diff --git a/usr/src/lib/libdladm/common/libdlmgmt.c b/usr/src/lib/libdladm/common/libdlmgmt.c
index 4b0753417c..b5d7aadb4f 100644
--- a/usr/src/lib/libdladm/common/libdlmgmt.c
+++ b/usr/src/lib/libdladm/common/libdlmgmt.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <door.h>
@@ -124,6 +125,7 @@ dladm_create_datalink_id(dladm_handle_t handle, const char *link,
 
 	dlmgmt_flags = (flags & DLADM_OPT_ACTIVE) ? DLMGMT_ACTIVE : 0;
 	dlmgmt_flags |= (flags & DLADM_OPT_PERSIST) ? DLMGMT_PERSIST : 0;
+	dlmgmt_flags |= (flags & DLADM_OPT_TRANSIENT) ? DLMGMT_TRANSIENT : 0;
 
 	(void) strlcpy(createid.ld_link, link, MAXLINKNAMELEN);
 	createid.ld_class = class;
@@ -285,6 +287,7 @@ dladm_walk_datalink_id(int (*fn)(dladm_handle_t, datalink_id_t, void *),
 
 	dlmgmt_flags = (flags & DLADM_OPT_ACTIVE) ? DLMGMT_ACTIVE : 0;
 	dlmgmt_flags |= ((flags & DLADM_OPT_PERSIST) ? DLMGMT_PERSIST : 0);
+	dlmgmt_flags |= ((flags & DLADM_OPT_TRANSIENT) ? DLMGMT_TRANSIENT : 0);
 
 	getnext.ld_cmd = DLMGMT_CMD_GETNEXT;
 	getnext.ld_class = class;
@@ -528,12 +531,24 @@ dladm_getnext_conf_linkprop(dladm_handle_t handle, dladm_conf_t conf,
 }
 
 /*
- * Get the link ID that is associated with the given name.
+ * Get the link ID that is associated with the given name in the current zone.
  */
 dladm_status_t
 dladm_name2info(dladm_handle_t handle, const char *link, datalink_id_t *linkidp,
     uint32_t *flagp, datalink_class_t *classp, uint32_t *mediap)
 {
+	return (dladm_zname2info(handle, NULL, link, linkidp, flagp, classp,
+	   mediap));
+}
+
+/*
+ * Get the link ID that is associated with the given zone/name pair.
+ */
+dladm_status_t
+dladm_zname2info(dladm_handle_t handle, const char *zonename, const char *link,
+    datalink_id_t *linkidp, uint32_t *flagp, datalink_class_t *classp,
+    uint32_t *mediap)
+{
 	dlmgmt_door_getlinkid_t		getlinkid;
 	dlmgmt_getlinkid_retval_t	retval;
 	datalink_id_t			linkid;
@@ -542,6 +557,10 @@ dladm_name2info(dladm_handle_t handle, const char *link, datalink_id_t *linkidp,
 
 	getlinkid.ld_cmd = DLMGMT_CMD_GETLINKID;
 	(void) strlcpy(getlinkid.ld_link, link, MAXLINKNAMELEN);
+	if (zonename != NULL)
+		getlinkid.ld_zoneid = getzoneidbyname(zonename);
+	else
+		getlinkid.ld_zoneid = -1;
 
 	if ((status = dladm_door_call(handle, &getlinkid, sizeof (getlinkid),
 	    &retval, &sz)) != DLADM_STATUS_OK) {
@@ -621,10 +640,12 @@ dladm_datalink_id2info(dladm_handle_t handle, datalink_id_t linkid,
 	if (mediap != NULL)
 		*mediap = retval.lr_media;
 	if (flagp != NULL) {
-		*flagp = retval.lr_flags & DLMGMT_ACTIVE ?
+		*flagp = (retval.lr_flags & DLMGMT_ACTIVE) ?
 		    DLADM_OPT_ACTIVE : 0;
 		*flagp |= (retval.lr_flags & DLMGMT_PERSIST) ?
 		    DLADM_OPT_PERSIST : 0;
+		*flagp |= (retval.lr_flags & DLMGMT_TRANSIENT) ?
+		    DLADM_OPT_TRANSIENT : 0;
 	}
 	return (DLADM_STATUS_OK);
 }
diff --git a/usr/src/lib/libdladm/common/libdloverlay.c b/usr/src/lib/libdladm/common/libdloverlay.c
new file mode 100644
index 0000000000..a83105b91c
--- /dev/null
+++ b/usr/src/lib/libdladm/common/libdloverlay.c
@@ -0,0 +1,908 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015 Joyent, Inc.
+ */
+
+#include <libdladm_impl.h>
+#include <libdllink.h>
+#include <libdloverlay.h>
+#include <sys/dld.h>
+#include <sys/overlay.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <limits.h>
+#include <libvarpd_client.h>
+
+#define	VARPD_PROPERTY_NAME	"varpd/id"
+
+static const char *dladm_overlay_doorpath = "/var/run/varpd/varpd.door";
+
+typedef struct dladm_overlay_propinfo {
+	boolean_t dop_isvarpd;
+	union {
+		overlay_ioc_propinfo_t *dop_overlay;
+		varpd_client_prop_handle_t *dop_varpd;
+	} dop_un;
+} dladm_overlay_propinfo_t;
+
+dladm_status_t
+dladm_overlay_prop_info(dladm_overlay_propinfo_handle_t phdl,
+    const char **namep, uint_t *typep, uint_t *protp, const void **defp,
+    uint32_t *sizep, const mac_propval_range_t **possp)
+{
+	dladm_overlay_propinfo_t *infop = (dladm_overlay_propinfo_t *)phdl;
+	overlay_ioc_propinfo_t *oinfop = infop->dop_un.dop_overlay;
+
+	if (infop->dop_isvarpd == B_FALSE) {
+		if (namep != NULL)
+			*namep = oinfop->oipi_name;
+		if (typep != NULL)
+			*typep = oinfop->oipi_type;
+		if (protp != NULL)
+			*protp = oinfop->oipi_prot;
+		if (defp != NULL)
+			*defp = oinfop->oipi_default;
+		if (sizep != NULL)
+			*sizep = oinfop->oipi_defsize;
+		if (possp != NULL) {
+			/* LINTED: E_BAD_PTR_CAST_ALIGN */
+			*possp = (const mac_propval_range_t *)oinfop->oipi_poss;
+		}
+
+	} else {
+		int ret;
+		ret = libvarpd_c_prop_info(infop->dop_un.dop_varpd, namep,
+		    typep, protp, defp, sizep, possp);
+		if (ret != 0)
+			return (dladm_errno2status(ret));
+
+	}
+
+	return (DLADM_STATUS_OK);
+}
+
+static dladm_status_t
+dladm_overlay_parse_prop(overlay_prop_type_t type, void *buf, uint32_t *sizep,
+    const char *val)
+{
+	int ret;
+	int64_t ival;
+	uint64_t uval;
+	char *eptr;
+	struct in6_addr ipv6;
+	struct in_addr ip;
+
+	switch (type) {
+	case OVERLAY_PROP_T_INT:
+		errno = 0;
+		ival = strtol(val, &eptr, 10);
+		if ((ival == 0 && errno == EINVAL) ||
+		    ((ival == LONG_MAX || ival == LONG_MIN) &&
+		    errno == ERANGE))
+			return (DLADM_STATUS_BADARG);
+		bcopy(&ival, buf, sizeof (int64_t));
+		*sizep = sizeof (int64_t);
+		break;
+	case OVERLAY_PROP_T_UINT:
+		errno = 0;
+		uval = strtol(val, &eptr, 10);
+		if ((uval == 0 && errno == EINVAL) ||
+		    (uval == ULONG_MAX && errno == ERANGE))
+			return (DLADM_STATUS_BADARG);
+		bcopy(&uval, buf, sizeof (uint64_t));
+		*sizep = sizeof (uint64_t);
+		break;
+	case OVERLAY_PROP_T_STRING:
+		ret = strlcpy((char *)buf, val, OVERLAY_PROP_SIZEMAX);
+		if (ret >= OVERLAY_PROP_SIZEMAX)
+			return (DLADM_STATUS_BADARG);
+		*sizep = ret + 1;
+		break;
+	case OVERLAY_PROP_T_IP:
+		/*
+		 * Always try to parse the IP as an IPv6 address. If that fails,
+		 * try to interpret it as an IPv4 address and transform it into
+		 * an IPv6 mapped IPv4 address.
+		 */
+		if (inet_pton(AF_INET6, val, &ipv6) != 1) {
+			if (inet_pton(AF_INET, val, &ip) != 1)
+				return (DLADM_STATUS_BADARG);
+
+			IN6_INADDR_TO_V4MAPPED(&ip, &ipv6);
+		}
+		bcopy(&ipv6, buf, sizeof (struct in6_addr));
+		*sizep = sizeof (struct in6_addr);
+		break;
+	default:
+		abort();
+	}
+
+	return (DLADM_STATUS_OK);
+}
+
+/* ARGSUSED */
+static dladm_status_t
+dladm_overlay_varpd_setprop(dladm_handle_t handle, varpd_client_handle_t *chdl,
+    uint64_t inst, const char *name, char *const *valp, uint_t cnt)
+{
+	int ret;
+	uint32_t size;
+	uint8_t buf[LIBVARPD_PROP_SIZEMAX];
+	varpd_client_prop_handle_t *phdl;
+	uint_t type;
+	dladm_status_t status;
+
+	if ((ret = libvarpd_c_prop_handle_alloc(chdl, inst, &phdl)) != 0)
+		return (dladm_errno2status(ret));
+
+	if ((ret = libvarpd_c_prop_info_fill_by_name(phdl, name)) != 0) {
+		libvarpd_c_prop_handle_free(phdl);
+		return (dladm_errno2status(ret));
+	}
+
+	if ((ret = libvarpd_c_prop_info(phdl, NULL, &type, NULL, NULL, NULL,
+	    NULL)) != 0) {
+		libvarpd_c_prop_handle_free(phdl);
+		return (dladm_errno2status(ret));
+	}
+
+	if ((status = dladm_overlay_parse_prop(type, buf, &size, valp[0])) !=
+	    DLADM_STATUS_OK) {
+		libvarpd_c_prop_handle_free(phdl);
+		return (status);
+	}
+
+	ret = libvarpd_c_prop_set(phdl, buf, size);
+	libvarpd_c_prop_handle_free(phdl);
+
+	return (dladm_errno2status(ret));
+}
+
+dladm_status_t
+dladm_overlay_setprop(dladm_handle_t handle, datalink_id_t linkid,
+    const char *name, char *const *valp, uint_t cnt)
+{
+	int			ret;
+	dladm_status_t		status;
+	overlay_ioc_propinfo_t	info;
+	overlay_ioc_prop_t	prop;
+
+	if (linkid == DATALINK_INVALID_LINKID ||
+	    name == NULL || valp == NULL || cnt != 1)
+		return (DLADM_STATUS_BADARG);
+
+	bzero(&info, sizeof (overlay_ioc_propinfo_t));
+	info.oipi_linkid = linkid;
+	info.oipi_id = -1;
+	if (strlcpy(info.oipi_name, name, OVERLAY_PROP_NAMELEN) >=
+	    OVERLAY_PROP_NAMELEN)
+		return (DLADM_STATUS_BADARG);
+
+	status = DLADM_STATUS_OK;
+	ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_PROPINFO, &info);
+	if (ret != 0)
+		status = dladm_errno2status(errno);
+
+	if (status != DLADM_STATUS_OK)
+		return (status);
+
+	prop.oip_linkid = linkid;
+	prop.oip_id = info.oipi_id;
+	prop.oip_name[0] = '\0';
+	if ((ret = dladm_overlay_parse_prop(info.oipi_type, prop.oip_value,
+	    &prop.oip_size, valp[0])) != DLADM_STATUS_OK)
+		return (ret);
+
+	status = DLADM_STATUS_OK;
+	ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_SETPROP, &prop);
+	if (ret != 0)
+		status = dladm_errno2status(errno);
+
+	return (ret);
+}
+
+/*
+ * Tell the user about any unset required properties.
+ */
+static int
+dladm_overlay_activate_cb(dladm_handle_t handle, datalink_id_t linkid,
+    dladm_overlay_propinfo_handle_t phdl, void *arg)
+{
+	dladm_status_t status;
+	uint8_t buf[DLADM_OVERLAY_PROP_SIZEMAX];
+	uint_t prot;
+	size_t size = sizeof (buf);
+	const char *name;
+	dladm_errlist_t *errs = arg;
+
+	if ((status = dladm_overlay_prop_info(phdl, &name, NULL, &prot, NULL,
+	    NULL, NULL)) != DLADM_STATUS_OK)
+		return (status);
+
+	if ((prot & OVERLAY_PROP_PERM_REQ) == 0)
+		return (DLADM_WALK_CONTINUE);
+
+	if (dladm_overlay_get_prop(handle, linkid, phdl, buf, &size) !=
+	    DLADM_STATUS_OK)
+		return (DLADM_WALK_CONTINUE);
+
+	if (size == 0)
+		(void) dladm_errlist_append(errs, "unset required property: %s",
+		    name);
+
+	return (DLADM_WALK_CONTINUE);
+}
+
+/*
+ * We need to clean up the world here. The problem is that we may or may not
+ * actually have everything created. While in the normal case, we'd always have
+ * an overlay device, assigned datalink id, and a varpd instance, we might not
+ * have any of those, except for the datalink instance. Therefore, as long as
+ * the id refers to a valid overlay, we should try to clean up as much of the
+ * state as possible and most importantly, we need to make sure we delete the
+ * datalink id. If we fail to do that, then that name will become lost to time.
+ */
+dladm_status_t
+dladm_overlay_delete(dladm_handle_t handle, datalink_id_t linkid)
+{
+	datalink_class_t class;
+	overlay_ioc_delete_t oid;
+	varpd_client_handle_t *chdl;
+	int ret;
+	uint32_t flags;
+	uint64_t varpdid;
+
+	if (dladm_datalink_id2info(handle, linkid, &flags, &class, NULL,
+	    NULL, 0) != DLADM_STATUS_OK)
+		return (DLADM_STATUS_BADARG);
+
+	if (class != DATALINK_CLASS_OVERLAY)
+		return (DLADM_STATUS_BADARG);
+
+	oid.oid_linkid = linkid;
+	ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_DELETE, &oid);
+	if (ret != 0 && errno != ENOENT) {
+		return (dladm_errno2status(errno));
+	}
+
+	if ((ret = libvarpd_c_create(&chdl, dladm_overlay_doorpath)) != 0) {
+		return (dladm_errno2status(ret));
+	}
+
+	if ((ret = libvarpd_c_instance_lookup(chdl, linkid, &varpdid)) != 0) {
+		if (ret == ENOENT) {
+			goto finish;
+		}
+		(void) libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	ret = libvarpd_c_instance_destroy(chdl, varpdid);
+finish:
+	(void) libvarpd_c_destroy(chdl);
+	(void) dladm_destroy_datalink_id(handle, linkid, flags);
+
+	return (dladm_errno2status(ret));
+}
+
+dladm_status_t
+dladm_overlay_get_prop(dladm_handle_t handle, datalink_id_t linkid,
+    dladm_overlay_propinfo_handle_t infohdl, void *buf, size_t *sizep)
+{
+	int ret;
+	overlay_ioc_prop_t oip;
+	dladm_overlay_propinfo_t *infop = (dladm_overlay_propinfo_t *)infohdl;
+
+	/*
+	 * It'd be nice if we had a better or more specific error for this. If
+	 * this kind of error becomes common place, let's get a better dladm
+	 * error.
+	 */
+	if (*sizep < DLADM_OVERLAY_PROP_SIZEMAX)
+		return (dladm_errno2status(ERANGE));
+
+	if (infop->dop_isvarpd == B_FALSE) {
+		bzero(&oip, sizeof (overlay_ioc_prop_t));
+		oip.oip_linkid = linkid;
+		oip.oip_id = infop->dop_un.dop_overlay->oipi_id;
+		ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_GETPROP, &oip);
+		if (ret != 0)
+			return (dladm_errno2status(errno));
+		bcopy(oip.oip_value, buf, DLADM_OVERLAY_PROP_SIZEMAX);
+		*sizep = oip.oip_size;
+	} else {
+		uint32_t size = *sizep;
+
+		ret = libvarpd_c_prop_get(infop->dop_un.dop_varpd, buf, &size);
+		if (ret != 0)
+			return (dladm_errno2status(errno));
+		*sizep = size;
+	}
+
+	return (DLADM_STATUS_OK);
+}
+
+static dladm_status_t
+dladm_overlay_walk_varpd_prop(dladm_handle_t handle, datalink_id_t linkid,
+    uint64_t varpdid, dladm_overlay_prop_f func, void *arg)
+{
+	int ret, i;
+	varpd_client_handle_t *chdl;
+	varpd_client_prop_handle_t *phdl;
+	uint_t nprops;
+	dladm_status_t status;
+
+	if ((ret = libvarpd_c_create(&chdl, dladm_overlay_doorpath)) != 0)
+		return (dladm_errno2status(ret));
+
+	if ((ret = libvarpd_c_prop_handle_alloc(chdl, varpdid, &phdl)) != 0) {
+		(void) libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	if ((ret = libvarpd_c_prop_nprops(chdl, varpdid, &nprops)) != 0) {
+		libvarpd_c_prop_handle_free(phdl);
+		(void) libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	status = DLADM_STATUS_OK;
+	for (i = 0; i < nprops; i++) {
+		dladm_overlay_propinfo_t dop;
+
+		bzero(&dop, sizeof (dop));
+		dop.dop_isvarpd = B_TRUE;
+		dop.dop_un.dop_varpd = phdl;
+
+		if ((ret = libvarpd_c_prop_info_fill(phdl, i)) != 0) {
+			status = dladm_errno2status(ret);
+			break;
+		}
+
+		ret = func(handle, linkid,
+		    (dladm_overlay_propinfo_handle_t)&dop, arg);
+		if (ret == DLADM_WALK_TERMINATE)
+			break;
+	}
+
+	libvarpd_c_prop_handle_free(phdl);
+	libvarpd_c_destroy(chdl);
+
+	return (status);
+}
+
+dladm_status_t
+dladm_overlay_walk_prop(dladm_handle_t handle, datalink_id_t linkid,
+    dladm_overlay_prop_f func, void *arg, dladm_errlist_t *errs)
+{
+	int i, ret;
+	char buf[MAXLINKNAMELEN];
+	char errmsg[DLADM_STRSIZE];
+	datalink_class_t class;
+	dladm_status_t info_status;
+	overlay_ioc_nprops_t oin;
+	overlay_ioc_propinfo_t oipi;
+	dladm_overlay_propinfo_t dop;
+	uint64_t varpdid = UINT64_MAX;
+
+	if ((info_status = dladm_datalink_id2info(handle, linkid, NULL, &class,
+	    NULL, buf, MAXLINKNAMELEN)) != DLADM_STATUS_OK) {
+		(void) dladm_errlist_append(errs, "failed to get info for "
+		    "datalink id %u: %s",
+		    linkid, dladm_status2str(info_status, errmsg));
+		return (DLADM_STATUS_BADARG);
+	}
+
+	if (class != DATALINK_CLASS_OVERLAY) {
+		(void) dladm_errlist_append(errs, "%s is not an overlay", buf);
+		return (DLADM_STATUS_BADARG);
+	}
+
+	bzero(&oin, sizeof (overlay_ioc_nprops_t));
+	oin.oipn_linkid = linkid;
+	ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_NPROPS, &oin);
+	if (ret != 0) {
+		(void) dladm_errlist_append(errs, "failed to get "
+		    "overlay properties for overlay %s: %s",
+		    buf, strerror(errno));
+		return (dladm_errno2status(errno));
+	}
+
+	for (i = 0; i < oin.oipn_nprops; i++) {
+		bzero(&dop, sizeof (dladm_overlay_propinfo_t));
+		bzero(&oipi, sizeof (overlay_ioc_propinfo_t));
+		oipi.oipi_linkid = linkid;
+		oipi.oipi_id = i;
+		ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_PROPINFO, &oipi);
+		if (ret != 0) {
+			(void) dladm_errlist_append(errs, "failed to get "
+			    "propinfo for overlay %s, property %d: %s",
+			    buf, i, strerror(errno));
+			return (dladm_errno2status(errno));
+		}
+
+		dop.dop_isvarpd = B_FALSE;
+		dop.dop_un.dop_overlay = &oipi;
+		ret = func(handle, linkid,
+		    (dladm_overlay_propinfo_handle_t)&dop, arg);
+		if (ret == DLADM_WALK_TERMINATE)
+			break;
+
+		if (strcmp(oipi.oipi_name, VARPD_PROPERTY_NAME) == 0) {
+			uint8_t buf[DLADM_OVERLAY_PROP_SIZEMAX];
+			size_t bufsize = sizeof (buf);
+			uint64_t *vp;
+
+			if (dladm_overlay_get_prop(handle, linkid,
+			    (dladm_overlay_propinfo_handle_t)&dop, buf,
+			    &bufsize) != DLADM_STATUS_OK)
+				continue;
+
+			/* LINTED: E_BAD_PTR_CAST_ALIGN */
+			vp = (uint64_t *)buf;
+			varpdid = *vp;
+		}
+	}
+
+	/* Should this really be possible? */
+	if (varpdid == UINT64_MAX)
+		return (DLADM_STATUS_OK);
+
+	ret = dladm_overlay_walk_varpd_prop(handle, linkid, varpdid, func,
+	    arg);
+	if (ret != DLADM_STATUS_OK) {
+		(void) dladm_errlist_append(errs,
+		    "failed to get varpd props for "
+		    "overlay %s, varpd id %llu: %s",
+		    buf, varpdid, dladm_status2str(info_status, errmsg));
+	}
+	return (ret);
+}
+
+dladm_status_t
+dladm_overlay_create(dladm_handle_t handle, const char *name,
+    const char *encap, const char *search, uint64_t vid,
+    dladm_arg_list_t *props, dladm_errlist_t *errs, uint32_t flags)
+{
+	int ret, i;
+	dladm_status_t status;
+	datalink_id_t linkid;
+	overlay_ioc_create_t oic;
+	overlay_ioc_activate_t oia;
+	size_t slen;
+	varpd_client_handle_t *vch;
+	uint64_t id;
+
+	status = dladm_create_datalink_id(handle, name, DATALINK_CLASS_OVERLAY,
+	    DL_ETHER, flags, &linkid);
+	if (status != DLADM_STATUS_OK)
+		return (status);
+
+	bzero(&oic, sizeof (oic));
+	oic.oic_linkid = linkid;
+	oic.oic_vnetid = vid;
+	(void) strlcpy(oic.oic_encap, encap, MAXLINKNAMELEN);
+
+	status = DLADM_STATUS_OK;
+	ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_CREATE, &oic);
+	if (ret != 0) {
+		/*
+		 * It'd be nice if we had private errors so we could better
+		 * distinguish between different classes of errors.
+		 */
+		status = dladm_errno2status(errno);
+	}
+
+	if (status != DLADM_STATUS_OK) {
+		(void) dladm_destroy_datalink_id(handle, linkid, flags);
+		return (status);
+	}
+
+	slen = strlen(search);
+	for (i = 0; props != NULL && i < props->al_count; i++) {
+		dladm_arg_info_t	*aip = &props->al_info[i];
+
+		/*
+		 * If it's a property for the search plugin, eg. it has the
+		 * prefix '<search>/', then we don't set the property on the
+		 * overlay device and instead set it on the varpd instance.
+		 */
+		if (strncmp(aip->ai_name, search, slen) == 0 &&
+		    aip->ai_name[slen] == '/')
+			continue;
+		status = dladm_overlay_setprop(handle, linkid, aip->ai_name,
+		    aip->ai_val, aip->ai_count);
+		if (status != DLADM_STATUS_OK) {
+			(void) dladm_errlist_append(errs,
+			    "failed to set property %s",
+			    aip->ai_name);
+			(void) dladm_overlay_delete(handle, linkid);
+			return (status);
+		}
+	}
+
+	if ((ret = libvarpd_c_create(&vch, dladm_overlay_doorpath)) != 0) {
+		(void) dladm_errlist_append(errs,
+		    "failed to create libvarpd handle: %s", strerror(ret));
+		(void) dladm_overlay_delete(handle, linkid);
+		return (dladm_errno2status(ret));
+	}
+
+	if ((ret = libvarpd_c_instance_create(vch, linkid, search,
+	    &id)) != 0) {
+		(void) dladm_errlist_append(errs,
+		    "failed to create varpd instance: %s", strerror(ret));
+		libvarpd_c_destroy(vch);
+		(void) dladm_overlay_delete(handle, linkid);
+		return (dladm_errno2status(ret));
+	}
+
+	for (i = 0; props != NULL && i < props->al_count; i++) {
+		dladm_arg_info_t	*aip = &props->al_info[i];
+
+		/*
+		 * Skip arguments we've processed already.
+		 */
+		if (strncmp(aip->ai_name, search, slen) != 0)
+			continue;
+
+		if (aip->ai_name[slen] != '/')
+			continue;
+
+		ret = dladm_overlay_varpd_setprop(handle, vch, id, aip->ai_name,
+		    aip->ai_val, aip->ai_count);
+		if (ret != 0) {
+			(void) dladm_errlist_append(errs,
+			    "failed to set varpd prop: %s\n",
+			    aip->ai_name);
+			(void) libvarpd_c_instance_destroy(vch, id);
+			libvarpd_c_destroy(vch);
+			(void) dladm_overlay_delete(handle, linkid);
+			return (dladm_errno2status(ret));
+		}
+	}
+
+	if ((ret = libvarpd_c_instance_activate(vch, id)) != 0) {
+		(void) dladm_errlist_append(errs,
+		    "failed to activate varpd instance: %s", strerror(ret));
+		(void) dladm_overlay_walk_varpd_prop(handle, linkid, id,
+		    dladm_overlay_activate_cb, errs);
+		(void) libvarpd_c_instance_destroy(vch, id);
+		libvarpd_c_destroy(vch);
+		(void) dladm_overlay_delete(handle, linkid);
+		return (dladm_errno2status(ret));
+
+	}
+
+	bzero(&oia, sizeof (oia));
+	oia.oia_linkid = linkid;
+	status = DLADM_STATUS_OK;
+	ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_ACTIVATE, &oia);
+	if (ret != 0) {
+		ret = errno;
+		(void) dladm_errlist_append(errs, "failed to activate "
+		    "device: %s", strerror(ret));
+		(void) libvarpd_c_instance_destroy(vch, id);
+		(void) dladm_overlay_walk_prop(handle, linkid,
+		    dladm_overlay_activate_cb, errs, errs);
+		status = dladm_errno2status(ret);
+		(void) libvarpd_c_instance_destroy(vch, id);
+	}
+
+	libvarpd_c_destroy(vch);
+	if (status != DLADM_STATUS_OK)
+		(void) dladm_overlay_delete(handle, linkid);
+
+	return (status);
+}
+
+
+
+typedef struct overlay_walk_cb {
+	dladm_handle_t		owc_handle;
+	datalink_id_t		owc_linkid;
+	void			*owc_arg;
+	dladm_overlay_cache_f	owc_func;
+	uint_t			owc_mode;
+	uint_t			owc_dest;
+} overlay_walk_cb_t;
+
+/* ARGSUSED */
+static int
+dladm_overlay_walk_cache_cb(varpd_client_handle_t *chdl, uint64_t varpdid,
+    const struct ether_addr *key, const varpd_client_cache_entry_t *entry,
+    void *arg)
+{
+	overlay_walk_cb_t *owc = arg;
+	dladm_overlay_point_t point;
+
+	bzero(&point, sizeof (dladm_overlay_point_t));
+	point.dop_dest = owc->owc_dest;
+	point.dop_mac = entry->vcp_mac;
+	point.dop_flags = entry->vcp_flags;
+	point.dop_ip = entry->vcp_ip;
+	point.dop_port = entry->vcp_port;
+
+	if (owc->owc_mode == OVERLAY_TARGET_POINT)
+		point.dop_flags |= DLADM_OVERLAY_F_DEFAULT;
+
+	if (owc->owc_func(owc->owc_handle, owc->owc_linkid, key, &point,
+	    owc->owc_arg) == DLADM_WALK_TERMINATE)
+		return (1);
+	return (0);
+}
+
+dladm_status_t
+dladm_overlay_walk_cache(dladm_handle_t handle, datalink_id_t linkid,
+    dladm_overlay_cache_f func, void *arg)
+{
+	int ret;
+	uint_t mode, dest;
+	uint64_t varpdid;
+	varpd_client_handle_t *chdl;
+	overlay_walk_cb_t cbarg;
+
+	if ((ret = libvarpd_c_create(&chdl, dladm_overlay_doorpath)) != 0)
+		return (dladm_errno2status(ret));
+
+	if ((ret = libvarpd_c_instance_lookup(chdl, linkid, &varpdid)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	if ((ret = libvarpd_c_instance_target_mode(chdl, varpdid,
+	    &dest, &mode)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	cbarg.owc_handle = handle;
+	cbarg.owc_linkid = linkid;
+	cbarg.owc_arg = arg;
+	cbarg.owc_func = func;
+	cbarg.owc_dest = dest;
+	cbarg.owc_mode = mode;
+	ret = libvarpd_c_instance_cache_walk(chdl, varpdid,
+	    dladm_overlay_walk_cache_cb, &cbarg);
+	libvarpd_c_destroy(chdl);
+
+	return (dladm_errno2status(ret));
+}
+
+/* ARGSUSED */
+dladm_status_t
+dladm_overlay_cache_flush(dladm_handle_t handle, datalink_id_t linkid)
+{
+	int ret;
+	uint64_t varpdid;
+	varpd_client_handle_t *chdl;
+
+	if ((ret = libvarpd_c_create(&chdl, dladm_overlay_doorpath)) != 0)
+		return (dladm_errno2status(ret));
+
+	if ((ret = libvarpd_c_instance_lookup(chdl, linkid, &varpdid)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	ret = libvarpd_c_instance_cache_flush(chdl, varpdid);
+	libvarpd_c_destroy(chdl);
+
+	return (dladm_errno2status(ret));
+}
+
+/* ARGSUSED */
+dladm_status_t
+dladm_overlay_cache_delete(dladm_handle_t handle, datalink_id_t linkid,
+    const struct ether_addr *key)
+{
+	int ret;
+	uint64_t varpdid;
+	varpd_client_handle_t *chdl;
+
+	if ((ret = libvarpd_c_create(&chdl, dladm_overlay_doorpath)) != 0)
+		return (dladm_errno2status(ret));
+
+	if ((ret = libvarpd_c_instance_lookup(chdl, linkid, &varpdid)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	ret = libvarpd_c_instance_cache_delete(chdl, varpdid, key);
+	libvarpd_c_destroy(chdl);
+
+	return (dladm_errno2status(ret));
+}
+
+/* ARGSUSED */
+dladm_status_t
+dladm_overlay_cache_set(dladm_handle_t handle, datalink_id_t linkid,
+    const struct ether_addr *key, char *val)
+{
+	int ret;
+	uint_t dest;
+	uint64_t varpdid;
+	char *ip, *port = NULL;
+	varpd_client_handle_t *chdl;
+	varpd_client_cache_entry_t vcp;
+
+
+	if ((ret = libvarpd_c_create(&chdl, dladm_overlay_doorpath)) != 0)
+		return (dladm_errno2status(ret));
+
+	if ((ret = libvarpd_c_instance_lookup(chdl, linkid, &varpdid)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	if ((ret = libvarpd_c_instance_target_mode(chdl, varpdid,
+	    &dest, NULL)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	/*
+	 * Mode tells us what we should expect in val. It we have more than one
+	 * thing listed, the canonical format of it right now is mac,ip:port.
+	 */
+	bzero(&vcp, sizeof (varpd_client_cache_entry_t));
+
+	if (strcasecmp(val, "drop") == 0) {
+		vcp.vcp_flags = OVERLAY_TARGET_CACHE_DROP;
+		goto send;
+	}
+
+	if (dest & OVERLAY_PLUGIN_D_ETHERNET) {
+		if (ether_aton_r(val, &vcp.vcp_mac) == NULL) {
+			libvarpd_c_destroy(chdl);
+			return (dladm_errno2status(EINVAL));
+		}
+	}
+
+	if (dest & OVERLAY_PLUGIN_D_IP) {
+		if (dest & OVERLAY_PLUGIN_D_ETHERNET) {
+			if ((ip = strchr(val, ',')) == NULL) {
+				libvarpd_c_destroy(chdl);
+				return (dladm_errno2status(ret));
+			}
+			ip++;
+		} else {
+			ip = val;
+		}
+
+		if (dest & OVERLAY_PLUGIN_D_PORT) {
+			if ((port = strchr(val, ':')) == NULL) {
+				libvarpd_c_destroy(chdl);
+				return (dladm_errno2status(ret));
+			}
+			*port = '\0';
+			port++;
+		}
+
+		/* Try v6, then fall back to v4 */
+		ret = inet_pton(AF_INET6, ip, &vcp.vcp_ip);
+		if (ret == -1)
+			abort();
+		if (ret == 0) {
+			struct in_addr v4;
+
+			ret = inet_pton(AF_INET, ip, &v4);
+			if (ret == -1)
+				abort();
+			if (ret == 0) {
+				libvarpd_c_destroy(chdl);
+				return (dladm_errno2status(ret));
+			}
+			IN6_INADDR_TO_V4MAPPED(&v4, &vcp.vcp_ip);
+		}
+	}
+
+	if (dest & OVERLAY_PLUGIN_D_PORT) {
+		char *eptr;
+		unsigned long l;
+		if (port == NULL && (dest & OVERLAY_PLUGIN_D_ETHERNET)) {
+			if ((port = strchr(val, ',')) == NULL) {
+				libvarpd_c_destroy(chdl);
+				return (dladm_errno2status(EINVAL));
+			}
+		} else if (port == NULL)
+			port = val;
+
+		errno = 0;
+		l = strtoul(port, &eptr, 10);
+		if (errno != 0 || *eptr != '\0') {
+			libvarpd_c_destroy(chdl);
+			return (dladm_errno2status(EINVAL));
+		}
+		if (l == 0 || l > UINT16_MAX) {
+			libvarpd_c_destroy(chdl);
+			return (dladm_errno2status(EINVAL));
+		}
+		vcp.vcp_port = l;
+	}
+
+send:
+	ret = libvarpd_c_instance_cache_set(chdl, varpdid, key, &vcp);
+
+	libvarpd_c_destroy(chdl);
+	return (dladm_errno2status(ret));
+}
+
+/* ARGSUSED */
+dladm_status_t
+dladm_overlay_cache_get(dladm_handle_t handle, datalink_id_t linkid,
+    const struct ether_addr *key, dladm_overlay_point_t *point)
+{
+	int ret;
+	uint_t dest, mode;
+	uint64_t varpdid;
+	varpd_client_handle_t *chdl;
+	varpd_client_cache_entry_t entry;
+
+	if ((ret = libvarpd_c_create(&chdl, dladm_overlay_doorpath)) != 0)
+		return (dladm_errno2status(ret));
+
+	if ((ret = libvarpd_c_instance_lookup(chdl, linkid, &varpdid)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	if ((ret = libvarpd_c_instance_target_mode(chdl, varpdid,
+	    &dest, &mode)) != 0) {
+		libvarpd_c_destroy(chdl);
+		return (dladm_errno2status(ret));
+	}
+
+	ret = libvarpd_c_instance_cache_get(chdl, varpdid, key, &entry);
+	if (ret == 0) {
+		point->dop_dest = dest;
+		point->dop_mac = entry.vcp_mac;
+		point->dop_flags = entry.vcp_flags;
+		point->dop_ip = entry.vcp_ip;
+		point->dop_port = entry.vcp_port;
+		if (mode == OVERLAY_TARGET_POINT)
+			point->dop_flags |= DLADM_OVERLAY_F_DEFAULT;
+	}
+
+	libvarpd_c_destroy(chdl);
+	return (dladm_errno2status(ret));
+}
+
+dladm_status_t
+dladm_overlay_status(dladm_handle_t handle, datalink_id_t linkid,
+    dladm_overlay_status_f func, void *arg)
+{
+	int ret;
+	dladm_status_t status;
+	overlay_ioc_status_t ois;
+	dladm_overlay_status_t dos;
+
+	ois.ois_linkid = linkid;
+	status = DLADM_STATUS_OK;
+	ret = ioctl(dladm_dld_fd(handle), OVERLAY_IOC_STATUS, &ois);
+	if (ret != 0)
+		status = dladm_errno2status(errno);
+	if (status != DLADM_STATUS_OK)
+		return (status);
+
+	dos.dos_degraded = ois.ois_status == OVERLAY_I_DEGRADED ? B_TRUE :
+	    B_FALSE;
+	(void) strlcpy(dos.dos_fmamsg, ois.ois_message,
+	    sizeof (dos.dos_fmamsg));
+	func(handle, linkid, &dos, arg);
+	return (DLADM_STATUS_OK);
+}
diff --git a/usr/src/lib/libdladm/common/libdloverlay.h b/usr/src/lib/libdladm/common/libdloverlay.h
new file mode 100644
index 0000000000..39b01ccae3
--- /dev/null
+++ b/usr/src/lib/libdladm/common/libdloverlay.h
@@ -0,0 +1,107 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBDLOVERLAY_H
+#define	_LIBDLOVERLAY_H
+
+/*
+ * libdladm Overlay device routines
+ */
+
+#include <libdladm.h>
+#include <libdladm_impl.h>
+#include <sys/overlay.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	DLADM_OVERLAY_F_DROP	0x0001
+#define	DLADM_OVERLAY_F_DEFAULT	0xf000
+
+typedef struct dladm_overlay_point {
+	uint_t			dop_dest;
+	struct ether_addr	dop_mac;
+	uint16_t		dop_flags;
+	struct in6_addr		dop_ip;
+	uint16_t		dop_port;
+} dladm_overlay_point_t;
+
+typedef struct dladm_overlay_status {
+	boolean_t	dos_degraded;
+	char		dos_fmamsg[256];
+} dladm_overlay_status_t;
+
+extern dladm_status_t dladm_overlay_create(dladm_handle_t, const char *,
+    const char *, const char *, uint64_t, dladm_arg_list_t *, dladm_errlist_t *,
+    uint32_t);
+extern dladm_status_t dladm_overlay_delete(dladm_handle_t, datalink_id_t);
+
+typedef void (*dladm_overlay_status_f)(dladm_handle_t, datalink_id_t,
+    dladm_overlay_status_t *, void *);
+extern dladm_status_t dladm_overlay_status(dladm_handle_t, datalink_id_t,
+    dladm_overlay_status_f, void *);
+
+extern dladm_status_t dladm_overlay_cache_flush(dladm_handle_t, datalink_id_t);
+extern dladm_status_t dladm_overlay_cache_delete(dladm_handle_t, datalink_id_t,
+    const struct ether_addr *);
+extern dladm_status_t dladm_overlay_cache_set(dladm_handle_t, datalink_id_t,
+    const struct ether_addr *, char *);
+extern dladm_status_t dladm_overlay_cache_get(dladm_handle_t, datalink_id_t,
+    const struct ether_addr *, dladm_overlay_point_t *);
+
+#define	DLADM_OVERLAY_PROP_SIZEMAX	256
+#define	DLADM_OVERLAY_PROP_NAMELEN	32
+
+typedef struct __dladm_overlay_propinfo *dladm_overlay_propinfo_handle_t;
+
+extern dladm_status_t dladm_overlay_prop_info(dladm_overlay_propinfo_handle_t,
+    const char **, uint_t *, uint_t *, const void **, uint32_t *,
+    const mac_propval_range_t **);
+extern dladm_status_t dladm_overlay_get_prop(dladm_handle_t, datalink_id_t,
+    dladm_overlay_propinfo_handle_t, void *buf, size_t *bufsize);
+
+typedef int (*dladm_overlay_prop_f)(dladm_handle_t, datalink_id_t,
+    dladm_overlay_propinfo_handle_t, void *);
+extern dladm_status_t dladm_overlay_walk_prop(dladm_handle_t, datalink_id_t,
+    dladm_overlay_prop_f, void *arg, dladm_errlist_t *);
+
+typedef int (*dladm_overlay_cache_f)(dladm_handle_t, datalink_id_t,
+    const struct ether_addr *, const dladm_overlay_point_t *, void *);
+extern dladm_status_t dladm_overlay_walk_cache(dladm_handle_t, datalink_id_t,
+    dladm_overlay_cache_f, void *);
+
+/*
+ * Some day we'll want to support being able to set properties after creation.
+ * If we do, the following strawman API might serve us well.
+ *
+ * extern dladm_status_t dladm_overlay_prop_lookup(dladm_handle_t,
+ *     datalink_id_t, const char *, dladm_overlay_propinfo_handle_t *);
+ * extern void dladm_overlay_prop_handle_free(dladm_handle_t, datalink_id_t,
+ *     dladm_overlay_propinfo_handle_t *);
+ * extern dladm_status_t dladm_overlay_set_prop(dladm_handle_t, datalink_id_t,
+ *     dladm_propinfo_handle_t, void *buf, size_t *bufsize);
+ * extern dladm_status_t dladm_overlay_str_to_buf(dladm_handle_t, datalink_id_t,
+ *     dladm_overlay_propinfo_handle_t *, const char *, void *, size_t *);
+ * extern dladm_status_t dladm_overlay_buf_to_str(dladm_handle_t, datalink_id_t,
+ *     dladm_overlay_propinfo_handle_t *, const void *, const size_t, char *,
+ *     size_t *);
+ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBDLOVERLAY_H */
diff --git a/usr/src/lib/libdladm/common/libdlvlan.c b/usr/src/lib/libdladm/common/libdlvlan.c
index 943728dc03..34c1e6682d 100644
--- a/usr/src/lib/libdladm/common/libdlvlan.c
+++ b/usr/src/lib/libdladm/common/libdlvlan.c
@@ -64,7 +64,7 @@ dladm_vlan_create(dladm_handle_t handle, const char *vlan, datalink_id_t linkid,
 {
 	return (dladm_vnic_create(handle, vlan, linkid,
 	    VNIC_MAC_ADDR_TYPE_PRIMARY, NULL, 0, NULL, 0, vid, VRRP_VRID_NONE,
-	    AF_UNSPEC, vlan_id_out, proplist, flags | DLADM_OPT_VLAN));
+	    AF_UNSPEC, vlan_id_out, proplist, NULL, flags | DLADM_OPT_VLAN));
 }
 
 /*
diff --git a/usr/src/lib/libdladm/common/libdlvnic.c b/usr/src/lib/libdladm/common/libdlvnic.c
index 44f8bb2726..47d007a1e2 100644
--- a/usr/src/lib/libdladm/common/libdlvnic.c
+++ b/usr/src/lib/libdladm/common/libdlvnic.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent Inc.
  */
 
 #include <stdio.h>
@@ -399,7 +400,7 @@ dladm_vnic_create(dladm_handle_t handle, const char *vnic, datalink_id_t linkid,
     vnic_mac_addr_type_t mac_addr_type, uchar_t *mac_addr, uint_t mac_len,
     int *mac_slot, uint_t mac_prefix_len, uint16_t vid, vrid_t vrid,
     int af, datalink_id_t *vnic_id_out, dladm_arg_list_t *proplist,
-    uint32_t flags)
+    dladm_errlist_t *errs, uint32_t flags)
 {
 	dladm_vnic_attr_t attr;
 	datalink_id_t vnic_id;
@@ -539,27 +540,40 @@ dladm_vnic_create(dladm_handle_t handle, const char *vnic, datalink_id_t linkid,
 	vnic_created = B_TRUE;
 
 	/* Save vnic configuration and its properties */
-	if (!(flags & DLADM_OPT_PERSIST))
-		goto done;
+	if (flags & DLADM_OPT_PERSIST) {
+		status = dladm_vnic_persist_conf(handle, name, &attr, class);
+		if (status == DLADM_STATUS_OK)
+			conf_set = B_TRUE;
+	}
 
-	status = dladm_vnic_persist_conf(handle, name, &attr, class);
-	if (status != DLADM_STATUS_OK)
-		goto done;
-	conf_set = B_TRUE;
+done:
+	if (status == DLADM_STATUS_OK && proplist != NULL) {
+		uint32_t flg;
+
+		flg = flags & (DLADM_OPT_PERSIST | DLADM_OPT_ACTIVE);
 
-	if (proplist != NULL) {
 		for (i = 0; i < proplist->al_count; i++) {
 			dladm_arg_info_t	*aip = &proplist->al_info[i];
 
+			if (strcmp(aip->ai_name, "zone") == 0 &&
+			    flags & DLADM_OPT_TRANSIENT)
+				flg |= DLADM_OPT_TRANSIENT;
+			else
+				flg &= ~DLADM_OPT_TRANSIENT;
+
 			status = dladm_set_linkprop(handle, vnic_id,
-			    aip->ai_name, aip->ai_val, aip->ai_count,
-			    DLADM_OPT_PERSIST);
-			if (status != DLADM_STATUS_OK)
+			    aip->ai_name, aip->ai_val, aip->ai_count, flg);
+			if (status != DLADM_STATUS_OK) {
+				char	errmsg[DLADM_STRSIZE];
+				(void) dladm_errlist_append(errs,
+				    "failed to set property %s: %s",
+				    aip->ai_name,
+				    dladm_status2str(status, errmsg));
 				break;
+			}
 		}
 	}
 
-done:
 	if (status != DLADM_STATUS_OK) {
 		if (conf_set)
 			(void) dladm_remove_conf(handle, vnic_id);
diff --git a/usr/src/lib/libdladm/common/libdlvnic.h b/usr/src/lib/libdladm/common/libdlvnic.h
index 94b656aadf..839b2de9f2 100644
--- a/usr/src/lib/libdladm/common/libdlvnic.h
+++ b/usr/src/lib/libdladm/common/libdlvnic.h
@@ -55,7 +55,8 @@ typedef struct dladm_vnic_attr {
 extern dladm_status_t	dladm_vnic_create(dladm_handle_t, const char *,
 			    datalink_id_t, vnic_mac_addr_type_t, uchar_t *,
 			    uint_t, int *, uint_t, uint16_t, vrid_t, int,
-			    datalink_id_t *, dladm_arg_list_t *, uint32_t);
+			    datalink_id_t *, dladm_arg_list_t *,
+			    dladm_errlist_t *, uint32_t);
 
 extern dladm_status_t	dladm_vnic_delete(dladm_handle_t, datalink_id_t,
 			    uint32_t);
diff --git a/usr/src/lib/libdladm/common/linkprop.c b/usr/src/lib/libdladm/common/linkprop.c
index 0684971453..0afd4d8bce 100644
--- a/usr/src/lib/libdladm/common/linkprop.c
+++ b/usr/src/lib/libdladm/common/linkprop.c
@@ -153,9 +153,9 @@ static pd_getf_t	get_zone, get_autopush, get_rate_mod, get_rate,
 			get_tagmode, get_range, get_stp, get_bridge_forward,
 			get_bridge_pvid, get_protection, get_rxrings,
 			get_txrings, get_cntavail, get_secondary_macs,
-			get_allowedips, get_allowedcids, get_pool,
-			get_rings_range, get_linkmode_prop,
-			get_promisc_filtered;
+			get_allowallcids, get_allowedips, get_allowedcids,
+			get_pool, get_rings_range, get_linkmode_prop,
+			get_promisc_filtered, get_dynamic_methods;
 
 static pd_setf_t	set_zone, set_rate, set_powermode, set_radio,
 			set_public_prop, set_resource, set_stp_prop,
@@ -451,6 +451,18 @@ static  val_desc_t	link_protect_vals[] = {
 	{ "dhcp-nospoof",	MPT_DHCPNOSPOOF	},
 };
 
+static val_desc_t	link_dynamic_method_vals[] = {
+	{ "dhcpv4",	MPT_DYN_DHCPV4	},
+	{ "dhcpv6",	MPT_DYN_DHCPV6	},
+	{ "slaac",	MPT_DYN_SLAAC	},
+	{ "addrconf",	(MPT_DYN_SLAAC | MPT_DYN_DHCPV6)	},
+};
+
+static val_desc_t	dladm_bool_vals[] = {
+	{ "false",	MPT_FALSE },
+	{ "true",	MPT_TRUE },
+};
+
 static  val_desc_t	link_promisc_filtered_vals[] = {
 	{ "off",	B_FALSE },
 	{ "on",		B_TRUE },
@@ -792,6 +804,11 @@ static prop_desc_t	prop_table[] = {
 	    set_resource, NULL, get_protection, check_prop, 0,
 	    DATALINK_CLASS_ALL, DATALINK_ANY_MEDIATYPE },
 
+	{ "dynamic-methods", { "--", RESET_VAL },
+	    link_dynamic_method_vals, VALCNT(link_dynamic_method_vals),
+	    set_resource, NULL, get_dynamic_methods, check_prop, 0,
+	    DATALINK_CLASS_ALL, DATALINK_ANY_MEDIATYPE },
+
 	{ "promisc-filtered", { "on", 1 },
 	    link_promisc_filtered_vals, VALCNT(link_promisc_filtered_vals),
 	    set_promisc_filtered, NULL, get_promisc_filtered, check_prop, 0,
@@ -808,6 +825,11 @@ static prop_desc_t	prop_table[] = {
 	    get_allowedcids, check_allowedcids, PD_CHECK_ALLOC,
 	    DATALINK_CLASS_ALL, DATALINK_ANY_MEDIATYPE },
 
+	{ "allow-all-dhcp-cids", { "false", RESET_VAL },
+	    dladm_bool_vals, VALCNT(dladm_bool_vals), set_resource, NULL,
+	    get_allowallcids, check_prop, 0,
+	    DATALINK_CLASS_ALL, DATALINK_ANY_MEDIATYPE },
+
 	{ "rxrings", { "--", RESET_VAL }, NULL, 0,
 	    set_resource, get_rings_range, get_rxrings, check_rings, 0,
 	    DATALINK_CLASS_ALL, DATALINK_ANY_MEDIATYPE },
@@ -854,8 +876,10 @@ static resource_prop_t rsrc_prop_table[] = {
 	{"pool",		extract_pool},
 	{"pool-effective",	extract_pool},
 	{"protection",		extract_protection},
+	{"dynamic-methods",	extract_dynamic_methods},
 	{"allowed-ips",		extract_allowedips},
 	{"allowed-dhcp-cids",	extract_allowedcids},
+	{"allow-all-dhcp-cids",	extract_allowallcids},
 	{"rxrings",		extract_rxrings},
 	{"rxrings-effective",	extract_rxrings},
 	{"txrings",		extract_txrings},
@@ -1651,6 +1675,9 @@ set_zone(dladm_handle_t handle, prop_desc_t *pdp, datalink_id_t linkid,
 	if (zid_new == zid_old)
 		return (DLADM_STATUS_OK);
 
+	if (flags & DLADM_OPT_TRANSIENT)
+		dzp->diz_transient = B_TRUE;
+
 	if ((status = set_public_prop(handle, pdp, linkid, vdp, val_cnt,
 	    flags, media)) != DLADM_STATUS_OK)
 		return (status);
@@ -2915,6 +2942,91 @@ dladm_str2cid(char *buf, mac_dhcpcid_t *cid)
 
 /* ARGSUSED */
 static dladm_status_t
+get_dynamic_methods(dladm_handle_t handle, prop_desc_t *pdp,
+    datalink_id_t linkid, char **prop_val, uint_t *val_cnt,
+    datalink_media_t media, uint_t flags, uint_t *perm_flags)
+{
+	mac_resource_props_t	mrp;
+	mac_protect_t		*p;
+	dladm_status_t		status;
+	uint32_t		i, cnt = 0, setbits[32];
+
+	status = i_dladm_get_public_prop(handle, linkid, "resource", flags,
+	    perm_flags, &mrp, sizeof (mrp));
+	if (status != DLADM_STATUS_OK)
+		return (status);
+
+	p = &mrp.mrp_protect;
+	dladm_find_setbits32(p->mp_dynamic, setbits, &cnt);
+	if (cnt > *val_cnt)
+		return (DLADM_STATUS_BADVALCNT);
+
+	for (i = 0; i < cnt; i++)
+		(void) dladm_dynamic2str(
+		    setbits[i], prop_val[i], DLADM_STRSIZE);
+
+	*val_cnt = cnt;
+	return (DLADM_STATUS_OK);
+}
+
+dladm_status_t
+extract_dynamic_methods(val_desc_t *vdp, uint_t cnt, void *arg)
+{
+	mac_resource_props_t	*mrp = arg;
+	uint32_t		methods = 0;
+	int			i;
+
+	for (i = 0; i < cnt; i++)
+		methods |= (uint32_t)vdp[i].vd_val;
+
+	mrp->mrp_protect.mp_dynamic = methods;
+	mrp->mrp_mask |= MRP_PROTECT;
+	return (DLADM_STATUS_OK);
+}
+
+/* ARGSUSED */
+static dladm_status_t
+get_allowallcids(dladm_handle_t handle, prop_desc_t *pdp,
+    datalink_id_t linkid, char **prop_val, uint_t *val_cnt,
+    datalink_media_t media, uint_t flags, uint_t *perm_flags)
+{
+	mac_resource_props_t	mrp;
+	mac_protect_t		*p;
+	dladm_status_t		status;
+
+	if (*val_cnt < 1)
+		return (DLADM_STATUS_BADVALCNT);
+
+	status = i_dladm_get_public_prop(handle, linkid, "resource", flags,
+	    perm_flags, &mrp, sizeof (mrp));
+	if (status != DLADM_STATUS_OK)
+		return (status);
+
+	p = &mrp.mrp_protect;
+	(void) snprintf(*prop_val, DLADM_STRSIZE,
+	    p->mp_allcids ? "true" : "false");
+	*val_cnt = 1;
+	return (DLADM_STATUS_OK);
+}
+
+/* ARGSUSED */
+dladm_status_t
+extract_allowallcids(val_desc_t *vdp, uint_t cnt, void *arg)
+{
+	mac_resource_props_t	*mrp = arg;
+	mac_protect_t		*p = &mrp->mrp_protect;
+
+	if (vdp->vd_val == RESET_VAL || vdp->vd_val == MPT_FALSE) {
+		p->mp_allcids = (boolean_t)RESET_VAL;
+	} else {
+		p->mp_allcids = (boolean_t)vdp->vd_val;
+	}
+	mrp->mrp_mask |= MRP_PROTECT;
+	return (DLADM_STATUS_OK);
+}
+
+/* ARGSUSED */
+static dladm_status_t
 get_allowedcids(dladm_handle_t handle, prop_desc_t *pdp,
     datalink_id_t linkid, char **prop_val, uint_t *val_cnt,
     datalink_media_t media, uint_t flags, uint_t *perm_flags)
diff --git a/usr/src/lib/libdladm/common/llib-ldladm b/usr/src/lib/libdladm/common/llib-ldladm
index 8e5eac0614..e5366fb92d 100644
--- a/usr/src/lib/libdladm/common/llib-ldladm
+++ b/usr/src/lib/libdladm/common/llib-ldladm
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*LINTLIBRARY*/
@@ -38,3 +39,4 @@
 #include <libdlether.h>
 #include <libdlsim.h>
 #include <libdlbridge.h>
+#include <libdloverlay.h>
diff --git a/usr/src/lib/libdladm/common/mapfile-vers b/usr/src/lib/libdladm/common/mapfile-vers
index 63a86529fc..589bbf5330 100644
--- a/usr/src/lib/libdladm/common/mapfile-vers
+++ b/usr/src/lib/libdladm/common/mapfile-vers
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015 Joyent, Inc.
 #
 
 #
@@ -134,6 +135,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	dladm_remap_datalink_id;
 	dladm_up_datalink_id;
 	dladm_name2info;
+	dladm_zname2info;
 	dladm_datalink_id2info;
 	dladm_walk_datalink_id;
 	dladm_create_conf;
@@ -269,6 +271,23 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	dladm_strs2range;
 	dladm_range2list;
 	dladm_list2range;
+
+	dladm_errlist_init;
+	dladm_errlist_reset;
+	dladm_errlist_append;
+
+	dladm_overlay_create;
+	dladm_overlay_delete;
+	dladm_overlay_status;
+	dladm_overlay_prop_info;
+	dladm_overlay_get_prop;
+	dladm_overlay_walk_prop;
+
+	dladm_overlay_cache_set;
+	dladm_overlay_cache_get;
+	dladm_overlay_cache_delete;
+	dladm_overlay_cache_flush;
+	dladm_overlay_walk_cache;
     local:
 	*;
 };
diff --git a/usr/src/lib/libdlpi/common/libdlpi.c b/usr/src/lib/libdlpi/common/libdlpi.c
index 1a639a5db9..d07eea70e7 100644
--- a/usr/src/lib/libdlpi/common/libdlpi.c
+++ b/usr/src/lib/libdlpi/common/libdlpi.c
@@ -22,6 +22,9 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
 
 /*
  * Data-Link Provider Interface (Version 2)
@@ -51,7 +54,7 @@
 
 #include "libdlpi_impl.h"
 
-static int i_dlpi_open(const char *, int *, uint_t, boolean_t);
+static int i_dlpi_open(const char *, const char *, int *, uint_t, boolean_t);
 static int i_dlpi_style1_open(dlpi_impl_t *);
 static int i_dlpi_style2_open(dlpi_impl_t *);
 static int i_dlpi_checkstyle(dlpi_impl_t *, t_uscalar_t);
@@ -130,7 +133,8 @@ dlpi_walk(dlpi_walkfunc_t *fn, void *arg, uint_t flags)
 }
 
 int
-dlpi_open(const char *linkname, dlpi_handle_t *dhp, uint_t flags)
+dlpi_open_zone(const char *linkname, const char *zonename, dlpi_handle_t *dhp,
+    uint_t flags)
 {
 	int		retval, on = 1;
 	ifspec_t	ifsp;
@@ -164,6 +168,16 @@ dlpi_open(const char *linkname, dlpi_handle_t *dhp, uint_t flags)
 	if (getenv("DLPI_DEVONLY") != NULL)
 		dip->dli_oflags |= DLPI_DEVONLY;
 
+	if (zonename == NULL) {
+		dip->dli_zonename[0] = '\0';
+	} else {
+		if (strlcpy(dip->dli_zonename, zonename,
+		    sizeof (dip->dli_zonename)) >= sizeof (dip->dli_zonename)) {
+			free(dip);
+			return (DLPI_EZONENAMEINVAL);
+		}
+	}
+
 	/* Copy linkname provided to the function. */
 	if (strlcpy(dip->dli_linkname, linkname, sizeof (dip->dli_linkname)) >=
 	    sizeof (dip->dli_linkname)) {
@@ -237,6 +251,12 @@ dlpi_open(const char *linkname, dlpi_handle_t *dhp, uint_t flags)
 	return (DLPI_SUCCESS);
 }
 
+int
+dlpi_open(const char *linkname, dlpi_handle_t *dhp, uint_t flags)
+{
+	return (dlpi_open_zone(linkname, NULL, dhp, flags));
+}
+
 void
 dlpi_close(dlpi_handle_t dh)
 {
@@ -1013,6 +1033,15 @@ dlpi_iftype(uint_t dlpitype)
  *	/dev		- if DLPI_DEVONLY is specified, or if there is no
  *			  data-link with the specified name (could be /dev/ip)
  *
+ * If a zone's name has been specified, eg. via dlpi_open_zone, then we instead
+ * will check in:
+ *
+ * 	/dev/ipnet/zone/%z/	- if DLPI_DEVIPNET is specified
+ * 	/dev/net/zone/%z/	- if a data-link with the specified name exists.
+ *
+ * When a zone name is specified, all of the fallback procedures that we opt for
+ * in the normal case are not used.
+ *
  * In particular, if DLPI_DEVIPNET is not specified, this function is used to
  * open a data-link node, or "/dev/ip" node. It is usually be called firstly
  * with style1 being B_TRUE, and if that fails and the return value is not
@@ -1040,7 +1069,8 @@ dlpi_iftype(uint_t dlpitype)
  * the second style-2 open attempt.
  */
 static int
-i_dlpi_open(const char *provider, int *fd, uint_t flags, boolean_t style1)
+i_dlpi_open(const char *provider, const char *zonename, int *fd, uint_t flags,
+    boolean_t style1)
 {
 	char		path[MAXPATHLEN];
 	int		oflags;
@@ -1051,11 +1081,19 @@ i_dlpi_open(const char *provider, int *fd, uint_t flags, boolean_t style1)
 		oflags |= O_EXCL;
 
 	if (flags & DLPI_DEVIPNET) {
-		(void) snprintf(path, sizeof (path), "/dev/ipnet/%s", provider);
-		if ((*fd = open(path, oflags)) != -1)
+		if (*zonename != '\0') {
+			(void) snprintf(path, sizeof (path),
+			    "/dev/ipnet/zone/%s/%s", zonename, provider);
+		} else {
+			(void) snprintf(path, sizeof (path), "/dev/ipnet/%s",
+			    provider);
+		}
+		if ((*fd = open(path, oflags)) != -1) {
 			return (DLPI_SUCCESS);
-		else
-			return (errno == ENOENT ? DLPI_ENOLINK : DL_SYSERR);
+		} else {
+			return (errno == ENOENT || errno == EISDIR ?
+			    DLPI_ENOLINK : DL_SYSERR);
+		}
 	} else if (style1 && !(flags & DLPI_DEVONLY)) {
 		char		driver[DLPI_LINKNAME_MAX];
 		char		device[DLPI_LINKNAME_MAX];
@@ -1070,7 +1108,13 @@ i_dlpi_open(const char *provider, int *fd, uint_t flags, boolean_t style1)
 		if (dlpi_parselink(provider, driver, &ppa) != DLPI_SUCCESS)
 			goto fallback;
 
-		(void) snprintf(path, sizeof (path), "/dev/net/%s", provider);
+		if (*zonename != '\0') {
+			(void) snprintf(path, sizeof (path),
+			    "/dev/net/zone/%s/%s", zonename, provider);
+		} else {
+			(void) snprintf(path, sizeof (path), "/dev/net/%s",
+			    provider);
+		}
 		if ((*fd = open(path, oflags)) != -1)
 			return (DLPI_SUCCESS);
 
@@ -1118,7 +1162,7 @@ fallback:
 	if ((*fd = open(path, oflags)) != -1)
 		return (DLPI_SUCCESS);
 
-	return (errno == ENOENT ? DLPI_ENOLINK : DL_SYSERR);
+	return (errno == ENOENT || errno == EISDIR ? DLPI_ENOLINK : DL_SYSERR);
 }
 
 /*
@@ -1130,7 +1174,8 @@ i_dlpi_style1_open(dlpi_impl_t *dip)
 	int		retval, save_errno;
 	int		fd;
 
-	retval = i_dlpi_open(dip->dli_linkname, &fd, dip->dli_oflags, B_TRUE);
+	retval = i_dlpi_open(dip->dli_linkname, dip->dli_zonename, &fd,
+	    dip->dli_oflags, B_TRUE);
 	if (retval != DLPI_SUCCESS)
 		return (retval);
 	dip->dli_fd = fd;
@@ -1153,7 +1198,8 @@ i_dlpi_style2_open(dlpi_impl_t *dip)
 	int 		fd;
 	int 		retval, save_errno;
 
-	retval = i_dlpi_open(dip->dli_provider, &fd, dip->dli_oflags, B_FALSE);
+	retval = i_dlpi_open(dip->dli_provider, dip->dli_zonename, &fd,
+	    dip->dli_oflags, B_FALSE);
 	if (retval != DLPI_SUCCESS)
 		return (retval);
 	dip->dli_fd = fd;
@@ -1571,7 +1617,8 @@ static const char *libdlpi_errlist[] = {
 						/* DLPI_ENOTENOTSUP */
 	"invalid DLPI notification type",	/* DLPI_ENOTEINVAL */
 	"invalid DLPI notification id",		/* DLPI_ENOTEIDINVAL */
-	"DLPI_IPNETINFO not supported"		/* DLPI_EIPNETINFONOTSUP */
+	"DLPI_IPNETINFO not supported",		/* DLPI_EIPNETINFONOTSUP */
+	"invalid zone name"			/* DLPI_EZONENAMEINVAL */
 };
 
 const char *
diff --git a/usr/src/lib/libdlpi/common/libdlpi.h b/usr/src/lib/libdlpi/common/libdlpi.h
index 993ac1b7a4..364413ee3a 100644
--- a/usr/src/lib/libdlpi/common/libdlpi.h
+++ b/usr/src/lib/libdlpi/common/libdlpi.h
@@ -93,6 +93,7 @@ enum {
 	DLPI_ENOTENOTSUP,	/* DLPI notification not supported by link */
 	DLPI_ENOTEIDINVAL,	/* invalid DLPI notification id */
 	DLPI_EIPNETINFONOTSUP,	/* DLPI_IPNETINFO not supported */
+	DLPI_EZONENAMEINVAL,	/* invalid zone name */
 	DLPI_ERRMAX		/* Highest + 1 libdlpi error code */
 };
 
@@ -184,6 +185,7 @@ typedef boolean_t dlpi_walkfunc_t(const char *, void *);
 
 extern void dlpi_walk(dlpi_walkfunc_t *, void *, uint_t);
 extern int dlpi_open(const char *, dlpi_handle_t *, uint_t);
+extern int dlpi_open_zone(const char *, const char *, dlpi_handle_t *, uint_t);
 extern void dlpi_close(dlpi_handle_t);
 extern int dlpi_info(dlpi_handle_t, dlpi_info_t *, uint_t);
 extern int dlpi_bind(dlpi_handle_t, uint_t, uint_t *);
diff --git a/usr/src/lib/libdlpi/common/libdlpi_impl.h b/usr/src/lib/libdlpi/common/libdlpi_impl.h
index 70708ff5af..8969cce7cb 100644
--- a/usr/src/lib/libdlpi/common/libdlpi_impl.h
+++ b/usr/src/lib/libdlpi/common/libdlpi_impl.h
@@ -28,6 +28,7 @@
 
 #include <libdlpi.h>
 #include <sys/sysmacros.h>
+#include <sys/zone.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -112,6 +113,8 @@ typedef struct dlpi_impl_s {
 					/* full linkname including PPA */
 	char		dli_provider[DLPI_LINKNAME_MAX];
 					/* only provider name */
+	char		dli_zonename[ZONENAME_MAX];
+					/* optionally specified zone */
 	t_uscalar_t	dli_style;	/* style 1 or 2 */
 	uint_t		dli_saplen;	/* bound SAP length */
 	uint_t		dli_sap;	/* bound SAP value */
diff --git a/usr/src/lib/libdlpi/common/mapfile-vers b/usr/src/lib/libdlpi/common/mapfile-vers
index ed3231dc92..c818e5e660 100644
--- a/usr/src/lib/libdlpi/common/mapfile-vers
+++ b/usr/src/lib/libdlpi/common/mapfile-vers
@@ -67,6 +67,11 @@ SYMBOL_VERSION SUNW_1.1 {	# first release of libdlpi, Solaris 11
 
 SYMBOL_VERSION SUNWprivate {
     global:
+	#
+	# dlpi_open_zone should be moved to a new public section once it is
+	# upstreamed into illumos-gate .
+	#
+	dlpi_open_zone;
         dlpi_parselink;
 	dlpi_makelink;
 	dlpi_style;
diff --git a/usr/src/lib/libdns_sd/java/com/apple/dnssd/DNSSDRecordRegistrar.java b/usr/src/lib/libdns_sd/java/com/apple/dnssd/DNSSDRecordRegistrar.java
index 62c5330840..569c51dd3a 100644
--- a/usr/src/lib/libdns_sd/java/com/apple/dnssd/DNSSDRecordRegistrar.java
+++ b/usr/src/lib/libdns_sd/java/com/apple/dnssd/DNSSDRecordRegistrar.java
@@ -5,9 +5,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *     http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -23,7 +23,7 @@ package	com.apple.dnssd;
 
 public interface	DNSSDRecordRegistrar extends DNSSDService
 {
-	/** Register an independent {@link DNSRecord}.<P> 
+	/** Register an independent {@link DNSRecord}.<P>
 		@param	flags
 					Possible values are SHARED or UNIQUE (see flag type definitions for details).
 		<P>
@@ -40,7 +40,7 @@ public interface	DNSSDRecordRegistrar extends DNSSDService
 					as defined in nameser.h.
 		<P>
 		@param	rrclass
-					The class of the resource record, as defined in nameser.h 
+					The class of the resource record, as defined in nameser.h
 					(usually 1 for the Internet class).
 		<P>
 		@param	rdata
@@ -54,8 +54,8 @@ public interface	DNSSDRecordRegistrar extends DNSSDService
 		@throws SecurityException If a security manager is present and denies <tt>RuntimePermission("getDNSSDInstance")</tt>.
 		@see    RuntimePermission
 	*/
-	public DNSRecord	registerRecord( int flags, int ifIndex, String fullname, int rrtype, 
+	public DNSRecord	registerRecord( int flags, int ifIndex, String fullname, int rrtype,
 									int rrclass, byte[] rdata, int ttl)
 	throws DNSSDException;
-} 
+}
 
diff --git a/usr/src/lib/libdtrace/Makefile.com b/usr/src/lib/libdtrace/Makefile.com
index dead7c1468..d8aa13e4dc 100644
--- a/usr/src/lib/libdtrace/Makefile.com
+++ b/usr/src/lib/libdtrace/Makefile.com
@@ -87,6 +87,7 @@ DLIBSRCS += \
 	io.d \
 	ip.d \
 	iscsit.d \
+	mac.d \
 	net.d \
 	nfs.d \
 	nfssrv.d \
@@ -99,7 +100,8 @@ DLIBSRCS += \
 	sysevent.d \
 	tcp.d \
 	udp.d \
-	unistd.d
+	unistd.d \
+	vnd.d
 
 include ../../Makefile.lib
 
@@ -112,6 +114,7 @@ CLEANFILES += dt_lex.c dt_grammar.c dt_grammar.h y.output
 CLEANFILES += ../common/procfs.sed ../common/procfs.d
 CLEANFILES += ../common/io.sed ../common/io.d
 CLEANFILES += ../common/ip.sed ../common/ip.d
+CLEANFILES += ../common/mac.sed ../common/mac.d
 CLEANFILES += ../common/net.sed ../common/net.d
 CLEANFILES += ../common/errno.d ../common/signal.d
 CLEANFILES += ../common/dt_errtags.c ../common/dt_names.c
@@ -133,7 +136,7 @@ CERRWARN += -_gcc=-Wno-uninitialized
 CERRWARN += -_gcc=-Wno-switch
 
 YYCFLAGS =
-LDLIBS += -lgen -lproc -lrtld_db -lnsl -lsocket -lctf -lelf -lc
+LDLIBS += -lgen -lproc -lrtld_db -lnsl -lsocket -lctf -lelf -lc -lzonecfg
 DRTILDLIBS = $(LDLIBS.lib) -lc
 LIBDAUDITLIBS = $(LDLIBS.lib) -lmapmalloc -lc -lproc
 
@@ -205,6 +208,9 @@ pics/dt_lex.o pics/dt_grammar.o := CCVERBOSE =
 ../common/ip.d: ../common/ip.sed ../common/ip.d.in
 	sed -f ../common/ip.sed < ../common/ip.d.in > $@
 
+../common/mac.d: ../common/mac.sed ../common/mac.d.in
+	sed -f ../common/mac.sed < ../common/mac.d.in > $@
+
 ../common/net.d: ../common/net.sed ../common/net.d.in
 	sed -f ../common/net.sed < ../common/net.d.in > $@
 
diff --git a/usr/src/lib/libdtrace/common/dt_cg.c b/usr/src/lib/libdtrace/common/dt_cg.c
index 28db9b2262..9f3625e6ee 100644
--- a/usr/src/lib/libdtrace/common/dt_cg.c
+++ b/usr/src/lib/libdtrace/common/dt_cg.c
@@ -27,6 +27,7 @@
 
 /*
  * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -1115,23 +1116,14 @@ dt_cg_asgn_op(dt_node_t *dnp, dt_irlist_t *dlp, dt_regset_t *drp)
 	}
 
 	/*
-	 * If we are storing to a variable, generate an stv instruction from
-	 * the variable specified by the identifier.  If we are storing to a
-	 * memory address, generate code again for the left-hand side using
-	 * DT_NF_REF to get the address, and then generate a store to it.
-	 * In both paths, we assume dnp->dn_reg already has the new value.
+	 * If we are storing to a memory address, generate code again for the
+	 * left-hand side using DT_NF_REF to get the address, and then generate
+	 * a store to it.
+	 *
+	 * Both here and the other variable-store paths, we assume dnp->dn_reg
+	 * already has the new value.
 	 */
-	if (dnp->dn_left->dn_kind == DT_NODE_VAR) {
-		idp = dt_ident_resolve(dnp->dn_left->dn_ident);
-
-		if (idp->di_kind == DT_IDENT_ARRAY)
-			dt_cg_arglist(idp, dnp->dn_left->dn_args, dlp, drp);
-
-		idp->di_flags |= DT_IDFLG_DIFW;
-		instr = DIF_INSTR_STV(dt_cg_stvar(idp),
-		    idp->di_id, dnp->dn_reg);
-		dt_irlist_append(dlp, dt_cg_node_alloc(DT_LBL_NONE, instr));
-	} else {
+	if (dnp->dn_left->dn_kind != DT_NODE_VAR) {
 		uint_t rbit = dnp->dn_left->dn_flags & DT_NF_REF;
 
 		assert(dnp->dn_left->dn_flags & DT_NF_WRITABLE);
@@ -1145,7 +1137,33 @@ dt_cg_asgn_op(dt_node_t *dnp, dt_irlist_t *dlp, dt_regset_t *drp)
 
 		dnp->dn_left->dn_flags &= ~DT_NF_REF;
 		dnp->dn_left->dn_flags |= rbit;
+		return;
 	}
+
+	idp = dt_ident_resolve(dnp->dn_left->dn_ident);
+	idp->di_flags |= DT_IDFLG_DIFW;
+
+	/*
+	 * Storing to an array variable is a special case.
+	 * Only 'uregs[]' supports this for the time being.
+	 */
+	if (idp->di_kind == DT_IDENT_ARRAY &&
+	    idp->di_id <= DIF_VAR_ARRAY_MAX) {
+		dt_node_t *idx = dnp->dn_left->dn_args;
+
+		dt_cg_node(idx, dlp, drp);
+		instr = DIF_INSTR_FMT(DIF_OP_STGA, idp->di_id, idx->dn_reg,
+		    dnp->dn_reg);
+		dt_irlist_append(dlp, dt_cg_node_alloc(DT_LBL_NONE, instr));
+		dt_regset_free(drp, idx->dn_reg);
+		return;
+	}
+
+	if (idp->di_kind == DT_IDENT_ARRAY)
+		dt_cg_arglist(idp, dnp->dn_left->dn_args, dlp, drp);
+
+	instr = DIF_INSTR_STV(dt_cg_stvar(idp), idp->di_id, dnp->dn_reg);
+	dt_irlist_append(dlp, dt_cg_node_alloc(DT_LBL_NONE, instr));
 }
 
 static void
diff --git a/usr/src/lib/libdtrace/common/dt_consume.c b/usr/src/lib/libdtrace/common/dt_consume.c
index 7f8c673dbe..549abb2e75 100644
--- a/usr/src/lib/libdtrace/common/dt_consume.c
+++ b/usr/src/lib/libdtrace/common/dt_consume.c
@@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc. All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
  */
 
@@ -3013,9 +3013,6 @@ dtrace_consume(dtrace_hdl_t *dtp, FILE *fp,
 				break;
 
 			timestamp = dt_buf_oldest(buf, dtp);
-			assert(timestamp >= dtp->dt_last_timestamp);
-			dtp->dt_last_timestamp = timestamp;
-
 			if (timestamp == buf->dtbd_timestamp) {
 				/*
 				 * We've reached the end of the time covered
@@ -3029,6 +3026,8 @@ dtrace_consume(dtrace_hdl_t *dtp, FILE *fp,
 					break;
 				continue;
 			}
+			assert(timestamp >= dtp->dt_last_timestamp);
+			dtp->dt_last_timestamp = timestamp;
 
 			if ((rval = dt_consume_cpu(dtp, fp,
 			    buf->dtbd_cpu, buf, B_TRUE, pf, rf, arg)) != 0)
diff --git a/usr/src/lib/libdtrace/common/dt_decl.c b/usr/src/lib/libdtrace/common/dt_decl.c
index bbb561d027..c9bd469ddb 100644
--- a/usr/src/lib/libdtrace/common/dt_decl.c
+++ b/usr/src/lib/libdtrace/common/dt_decl.c
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2012, 2014 by Delphix. All rights reserved.
- * Copyright (c) 2013 Joyent, Inc. All rights reserved.
+ * Copyright (c) 2015 Joyent, Inc. All rights reserved.
  */
 
 #include <strings.h>
@@ -652,7 +652,7 @@ dt_decl_member(dt_node_t *dnp)
 	}
 
 	if (ctf_add_member(dsp->ds_ctfp, dsp->ds_type,
-	    ident, dtt.dtt_type) == CTF_ERR) {
+	    ident, dtt.dtt_type, ULONG_MAX) == CTF_ERR) {
 		xyerror(D_UNKNOWN, "failed to define member '%s': %s\n",
 		    idname, ctf_errmsg(ctf_errno(dsp->ds_ctfp)));
 	}
diff --git a/usr/src/lib/libdtrace/common/dt_dis.c b/usr/src/lib/libdtrace/common/dt_dis.c
index c0af36420e..60195f3970 100644
--- a/usr/src/lib/libdtrace/common/dt_dis.c
+++ b/usr/src/lib/libdtrace/common/dt_dis.c
@@ -27,7 +27,7 @@
 
 /*
  * Copyright (c) 2013 by Delphix. All rights reserved.
- * Copyright (c) 2013 Joyent, Inc. All rights reserved.
+ * Copyright (c) 2017 Joyent, Inc.
  */
 
 #include <strings.h>
@@ -47,7 +47,7 @@ dt_dis_log(const dtrace_difo_t *dp, const char *name, dif_instr_t in, FILE *fp)
 /*ARGSUSED*/
 static void
 dt_dis_branch(const dtrace_difo_t *dp, const char *name,
-	dif_instr_t in, FILE *fp)
+    dif_instr_t in, FILE *fp)
 {
 	(void) fprintf(fp, "%-4s %u", name, DIF_INSTR_LABEL(in));
 }
@@ -63,7 +63,7 @@ dt_dis_load(const dtrace_difo_t *dp, const char *name, dif_instr_t in, FILE *fp)
 /*ARGSUSED*/
 static void
 dt_dis_store(const dtrace_difo_t *dp, const char *name,
-	dif_instr_t in, FILE *fp)
+    dif_instr_t in, FILE *fp)
 {
 	(void) fprintf(fp, "%-4s %%r%u, [%%r%u]", name,
 	    DIF_INSTR_R1(in), DIF_INSTR_RD(in));
@@ -167,6 +167,19 @@ dt_dis_stv(const dtrace_difo_t *dp, const char *name, dif_instr_t in, FILE *fp)
 }
 
 static void
+dt_dis_sta(const dtrace_difo_t *dp, const char *name, dif_instr_t in, FILE *fp)
+{
+	uint_t var = DIF_INSTR_VAR(in);
+	const char *vname;
+
+	(void) fprintf(fp, "%-4s DT_VAR(%u), %%r%u, %%r%u",
+	    name, var, DIF_INSTR_R2(in), DIF_INSTR_RD(in));
+
+	if ((vname = dt_dis_varname(dp, var, dt_dis_scope(name))) != NULL)
+		(void) fprintf(fp, "\t\t! DT_VAR(%u) = \"%s\"", var, vname);
+}
+
+static void
 dt_dis_setx(const dtrace_difo_t *dp, const char *name, dif_instr_t in, FILE *fp)
 {
 	uint_t intptr = DIF_INSTR_INTEGER(in);
@@ -428,6 +441,7 @@ dt_dis(const dtrace_difo_t *dp, FILE *fp)
 		{ "rldx", dt_dis_load },	/* DIF_OP_RLDX */
 		{ "xlate", dt_dis_xlate },	/* DIF_OP_XLATE */
 		{ "xlarg", dt_dis_xlate },	/* DIF_OP_XLARG */
+		{ "stga", dt_dis_sta },		/* DIF_OP_XLARG */
 	};
 
 	const struct opent *op;
diff --git a/usr/src/lib/libdtrace/common/dt_impl.h b/usr/src/lib/libdtrace/common/dt_impl.h
index 2681709483..6841eca4e6 100644
--- a/usr/src/lib/libdtrace/common/dt_impl.h
+++ b/usr/src/lib/libdtrace/common/dt_impl.h
@@ -267,6 +267,7 @@ struct dtrace_hdl {
 	uint_t dt_droptags;	/* boolean:  set via -xdroptags */
 	uint_t dt_active;	/* boolean:  set once tracing is active */
 	uint_t dt_stopped;	/* boolean:  set once tracing is stopped */
+	uint_t dt_optset;	/* boolean:  set once options have been set */
 	processorid_t dt_beganon; /* CPU that executed BEGIN probe (if any) */
 	processorid_t dt_endedon; /* CPU that executed END probe (if any) */
 	uint_t dt_oflags;	/* dtrace open-time options (see dtrace.h) */
diff --git a/usr/src/lib/libdtrace/common/dt_module.c b/usr/src/lib/libdtrace/common/dt_module.c
index 0288f329da..4c9a7ce66b 100644
--- a/usr/src/lib/libdtrace/common/dt_module.c
+++ b/usr/src/lib/libdtrace/common/dt_module.c
@@ -1372,6 +1372,77 @@ dtrace_lookup_by_addr(dtrace_hdl_t *dtp, GElf_Addr addr,
 	return (0);
 }
 
+/*
+ * We've been asked to look up something inside a pid related module and it has
+ * been qualified with a library name. In that case, we may have to split this
+ * up into the library and the type itself, which will be separated by an '`'
+ * character. This is complicated further by the fact that the keyword for a
+ * struct, union, or enum, will precede the library. Hence we may have something
+ * that looks like "struct libsocket.so.1`msghdr" in name and we need to
+ * transform that into "libsocket.so.1" and "struct msghdr".
+ */
+int
+dtrace_lookup_fixup_pidtype(const char *name, char **libp, char **typep)
+{
+	int len, i;
+	char *split = NULL, *lib, *buf;
+	char *base;
+	char *keywords[] = { "struct ", "union ", "enum ", NULL };
+
+	if (name == NULL)
+		return (-1);
+
+	*libp = NULL;
+	*typep = NULL;
+	buf = strdup(name);
+	if (buf == NULL)
+		return (-1);
+
+	i = 0;
+	lib = buf;
+	while (keywords[i] != NULL) {
+		base = keywords[i];
+		len = strlen(base);
+		if (strncmp(name, base, len) == 0) {
+			lib += len;
+			break;
+		}
+		i++;
+	}
+
+	split = strchr(buf, '`');
+	assert(split != NULL);
+	*split = '\0';
+	split++;
+	if (lib == buf) {
+		*libp = strdup(buf);
+		*typep = strdup(split);
+		if (*libp == NULL || *typep == NULL)
+			goto err;
+		free(buf);
+		return (0);
+	} else {
+		assert(len > 0);
+		assert(base != NULL);
+
+		*libp = strdup(lib);
+		if (*libp == NULL)
+			goto err;
+		if (asprintf(typep, "%s%s", base, split) == -1)
+			goto err;
+		free(buf);
+		return (0);
+	}
+
+err:
+	free(buf);
+	free(*libp);
+	*libp = NULL;
+	free(*typep);
+	*typep = NULL;
+	return (-1);
+}
+
 int
 dtrace_lookup_by_type(dtrace_hdl_t *dtp, const char *object, const char *name,
     dtrace_typeinfo_t *tip)
@@ -1383,7 +1454,6 @@ dtrace_lookup_by_type(dtrace_hdl_t *dtp, const char *object, const char *name,
 	uint_t n, i;
 	int justone;
 	ctf_file_t *fp;
-	char *buf, *p, *q;
 
 	uint_t mask = 0; /* mask of dt_module flags to match */
 	uint_t bits = 0; /* flag bits that must be present */
@@ -1437,19 +1507,19 @@ dtrace_lookup_by_type(dtrace_hdl_t *dtp, const char *object, const char *name,
 			id = ctf_lookup_by_name(dmp->dm_ctfp, name);
 			fp = dmp->dm_ctfp;
 		} else {
-			if ((p = strchr(name, '`')) != NULL) {
-				buf = strdup(name);
-				if (buf == NULL)
+			dt_dprintf("Trying to find userland type: %s\n", name);
+			if (strchr(name, '`') != NULL) {
+				char *lib, *type;
+				if (dtrace_lookup_fixup_pidtype(name, &lib,
+				    &type) != 0) {
 					return (dt_set_errno(dtp, EDT_NOMEM));
-				p = strchr(buf, '`');
-				if ((q = strchr(p + 1, '`')) != NULL)
-					p = q;
-				*p = '\0';
-				fp = dt_module_getctflib(dtp, dmp, buf);
+				}
+				fp = dt_module_getctflib(dtp, dmp, lib);
 				if (fp == NULL || (id = ctf_lookup_by_name(fp,
-				    p + 1)) == CTF_ERR)
+				    type)) == CTF_ERR)
 					id = CTF_ERR;
-				free(buf);
+				free(lib);
+				free(type);
 			} else {
 				for (i = 0; i < dmp->dm_nctflibs; i++) {
 					fp = dmp->dm_libctfp[i];
diff --git a/usr/src/lib/libdtrace/common/dt_open.c b/usr/src/lib/libdtrace/common/dt_open.c
index 38c8146039..3325f333ab 100644
--- a/usr/src/lib/libdtrace/common/dt_open.c
+++ b/usr/src/lib/libdtrace/common/dt_open.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
  */
 
@@ -40,6 +40,7 @@
 #include <fcntl.h>
 #include <errno.h>
 #include <assert.h>
+#include <zone.h>
 
 #define	_POSIX_PTHREAD_SEMANTICS
 #include <dirent.h>
@@ -427,8 +428,8 @@ static const dt_ident_t _dtrace_globals[] = {
 	&dt_idops_type, "uid_t" },
 { "umod", DT_IDENT_ACTFUNC, 0, DT_ACT_UMOD, DT_ATTR_STABCMN,
 	DT_VERS_1_2, &dt_idops_func, "_usymaddr(uintptr_t)" },
-{ "uregs", DT_IDENT_ARRAY, 0, DIF_VAR_UREGS, DT_ATTR_STABCMN, DT_VERS_1_0,
-	&dt_idops_regs, NULL },
+{ "uregs", DT_IDENT_ARRAY, DT_IDFLG_WRITE, DIF_VAR_UREGS, DT_ATTR_STABCMN,
+	DT_VERS_1_0, &dt_idops_regs, NULL },
 { "ustack", DT_IDENT_ACTFUNC, 0, DT_ACT_USTACK, DT_ATTR_STABCMN, DT_VERS_1_0,
 	&dt_idops_func, "stack(...)" },
 { "ustackdepth", DT_IDENT_SCALAR, 0, DIF_VAR_USTACKDEPTH,
@@ -685,8 +686,8 @@ const dtrace_pattr_t _dtrace_prvdesc = {
 { DTRACE_STABILITY_UNSTABLE, DTRACE_STABILITY_UNSTABLE, DTRACE_CLASS_COMMON },
 };
 
-const char *_dtrace_defcpp = "/usr/ccs/lib/cpp"; /* default cpp(1) to invoke */
-const char *_dtrace_defld = "/usr/ccs/bin/ld";   /* default ld(1) to invoke */
+const char *_dtrace_defcpp = "/usr/lib/cpp"; /* default cpp(1) to invoke */
+const char *_dtrace_defld = "/usr/bin/ld";   /* default ld(1) to invoke */
 
 const char *_dtrace_libdir = "/usr/lib/dtrace"; /* default library directory */
 const char *_dtrace_provdir = "/dev/dtrace/provider"; /* provider directory */
@@ -826,6 +827,8 @@ dt_vopen(int version, int flags, int *errp,
 	dt_provmod_t *provmod = NULL;
 	int i, err;
 	struct rlimit rl;
+	const char *zroot;
+	char *libpath = NULL;
 
 	const dt_intrinsic_t *dinp;
 	const dt_typedef_t *dtyp;
@@ -958,11 +961,19 @@ alloc:
 	dtp->dt_provs = calloc(dtp->dt_provbuckets, sizeof (dt_provider_t *));
 	dt_proc_init(dtp);
 	dtp->dt_vmax = DT_VERS_LATEST;
-	dtp->dt_cpp_path = strdup(_dtrace_defcpp);
+	zroot = zone_get_nroot();
+	if (zroot != NULL) {
+		(void) asprintf(&dtp->dt_ld_path, "%s/%s", zroot,
+		    _dtrace_defld);
+		(void) asprintf(&dtp->dt_cpp_path, "%s/%s", zroot,
+		    _dtrace_defcpp);
+	} else {
+		dtp->dt_ld_path = strdup(_dtrace_defld);
+		dtp->dt_cpp_path = strdup(_dtrace_defcpp);
+	}
 	dtp->dt_cpp_argv = malloc(sizeof (char *));
 	dtp->dt_cpp_argc = 1;
 	dtp->dt_cpp_args = 1;
-	dtp->dt_ld_path = strdup(_dtrace_defld);
 	dtp->dt_provmod = provmod;
 	dtp->dt_vector = vector;
 	dtp->dt_varg = arg;
@@ -1136,13 +1147,13 @@ alloc:
 	 * Add intrinsic pointer types that are needed to initialize printf
 	 * format dictionary types (see table in dt_printf.c).
 	 */
-	(void) ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT,
+	(void) ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT, NULL,
 	    ctf_lookup_by_name(dmp->dm_ctfp, "void"));
 
-	(void) ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT,
+	(void) ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT, NULL,
 	    ctf_lookup_by_name(dmp->dm_ctfp, "char"));
 
-	(void) ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT,
+	(void) ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT, NULL,
 	    ctf_lookup_by_name(dmp->dm_ctfp, "int"));
 
 	if (ctf_update(dmp->dm_ctfp) != 0) {
@@ -1202,11 +1213,11 @@ alloc:
 	ctc.ctc_argc = 0;
 	ctc.ctc_flags = 0;
 
-	dtp->dt_type_func = ctf_add_function(dmp->dm_ctfp,
+	dtp->dt_type_func = ctf_add_funcptr(dmp->dm_ctfp,
 	    CTF_ADD_ROOT, &ctc, NULL);
 
-	dtp->dt_type_fptr = ctf_add_pointer(dmp->dm_ctfp,
-	    CTF_ADD_ROOT, dtp->dt_type_func);
+	dtp->dt_type_fptr = ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT, NULL,
+	    dtp->dt_type_func);
 
 	/*
 	 * We also insert CTF definitions for the special D intrinsic types
@@ -1307,9 +1318,15 @@ alloc:
 	 * compile, and to provide better error reporting (because the full
 	 * reporting of compiler errors requires dtrace_open() to succeed).
 	 */
-	if (dtrace_setopt(dtp, "libdir", _dtrace_libdir) != 0)
+	if (zroot != NULL)
+		(void) asprintf(&libpath, "%s/%s", zroot, _dtrace_libdir);
+	if (dtrace_setopt(dtp, "libdir",
+	    libpath != NULL ? libpath : _dtrace_libdir) != 0)
 		return (set_open_errno(dtp, errp, dtp->dt_errno));
 
+	if (libpath != NULL)
+		free(libpath);
+
 	return (dtp);
 }
 
diff --git a/usr/src/lib/libdtrace/common/dt_options.c b/usr/src/lib/libdtrace/common/dt_options.c
index 201b50a177..be985d6dab 100644
--- a/usr/src/lib/libdtrace/common/dt_options.c
+++ b/usr/src/lib/libdtrace/common/dt_options.c
@@ -41,6 +41,8 @@
 #include <alloca.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <zone.h>
+#include <libzonecfg.h>
 
 #include <dt_impl.h>
 #include <dt_string.h>
@@ -854,6 +856,44 @@ dt_opt_bufresize(dtrace_hdl_t *dtp, const char *arg, uintptr_t option)
 	return (0);
 }
 
+/*ARGSUSED*/
+static int
+dt_opt_zone(dtrace_hdl_t *dtp, const char *arg, uintptr_t option)
+{
+	zoneid_t z, did;
+
+	if (arg == NULL)
+		return (dt_set_errno(dtp, EDT_BADOPTVAL));
+
+	/*
+	 * If the specified zone is currently running, we'll query the kernel
+	 * for its debugger ID.  If it doesn't appear to be running, we'll look
+	 * for it for among all installed zones (thereby allowing a zdefs
+	 * enabling against a halted zone).
+	 */
+	if ((z = getzoneidbyname(arg)) != -1) {
+		if (zone_getattr(z, ZONE_ATTR_DID, &did, sizeof (did)) < 0)
+			return (dt_set_errno(dtp, EDT_BADOPTVAL));
+	} else {
+		zone_dochandle_t handle;
+
+		if ((handle = zonecfg_init_handle()) == NULL)
+			return (dt_set_errno(dtp, errno));
+
+		if (zonecfg_get_handle(arg, handle) != Z_OK) {
+			zonecfg_fini_handle(handle);
+			return (dt_set_errno(dtp, EDT_BADOPTVAL));
+		}
+
+		did = zonecfg_get_did(handle);
+		zonecfg_fini_handle(handle);
+	}
+
+	dtp->dt_options[DTRACEOPT_ZONE] = did;
+
+	return (0);
+}
+
 int
 dt_options_load(dtrace_hdl_t *dtp)
 {
@@ -988,6 +1028,7 @@ static const dt_option_t _dtrace_rtoptions[] = {
 	{ "statusrate", dt_opt_rate, DTRACEOPT_STATUSRATE },
 	{ "strsize", dt_opt_strsize, DTRACEOPT_STRSIZE },
 	{ "ustackframes", dt_opt_runtime, DTRACEOPT_USTACKFRAMES },
+	{ "zone", dt_opt_zone, DTRACEOPT_ZONE },
 	{ "temporal", dt_opt_runtime, DTRACEOPT_TEMPORAL },
 	{ NULL }
 };
@@ -1068,9 +1109,41 @@ dtrace_setopt(dtrace_hdl_t *dtp, const char *opt, const char *val)
 			if (dtp->dt_active)
 				return (dt_set_errno(dtp, EDT_ACTIVE));
 
+			/*
+			 * If our options had been previously ioctl'd down,
+			 * clear dt_optset to indicate that a run-time option
+			 * has since been set.
+			 */
+			dtp->dt_optset = B_FALSE;
+
 			return (op->o_func(dtp, val, op->o_option));
 		}
 	}
 
 	return (dt_set_errno(dtp, EDT_BADOPTNAME));
 }
+
+int
+dtrace_setopts(dtrace_hdl_t *dtp)
+{
+	void *dof;
+	int err;
+
+	if (dtp->dt_optset)
+		return (0);
+
+	if ((dof = dtrace_getopt_dof(dtp)) == NULL)
+		return (-1); /* dt_errno has been set for us */
+
+	if ((err = dt_ioctl(dtp, DTRACEIOC_ENABLE, dof)) == -1)
+		(void) dt_set_errno(dtp, errno);
+
+	dtrace_dof_destroy(dtp, dof);
+
+	if (err == -1)
+		return (-1);
+
+	dtp->dt_optset = B_TRUE;
+
+	return (0);
+}
diff --git a/usr/src/lib/libdtrace/common/dt_parser.c b/usr/src/lib/libdtrace/common/dt_parser.c
index 7f771a8079..e652f337d9 100644
--- a/usr/src/lib/libdtrace/common/dt_parser.c
+++ b/usr/src/lib/libdtrace/common/dt_parser.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2013, Joyent Inc. All rights reserved.
+ * Copyright (c) 2015, Joyent Inc. All rights reserved.
  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
  */
 
@@ -288,7 +288,7 @@ dt_type_pointer(dtrace_typeinfo_t *tip)
 		return (dt_set_errno(dtp, EDT_CTF));
 	}
 
-	ptr = ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT, type);
+	ptr = ctf_add_pointer(dmp->dm_ctfp, CTF_ADD_ROOT, NULL, type);
 
 	if (ptr == CTF_ERR || ctf_update(dmp->dm_ctfp) == CTF_ERR) {
 		dtp->dt_ctferr = ctf_errno(dmp->dm_ctfp);
diff --git a/usr/src/lib/libdtrace/common/dt_program.c b/usr/src/lib/libdtrace/common/dt_program.c
index 7d725bd0af..e4f9d8dd1c 100644
--- a/usr/src/lib/libdtrace/common/dt_program.c
+++ b/usr/src/lib/libdtrace/common/dt_program.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent, Inc. All rights reserved.
  * Copyright (c) 2011 by Delphix. All rights reserved.
  */
 
@@ -154,6 +155,14 @@ dtrace_program_exec(dtrace_hdl_t *dtp, dtrace_prog_t *pgp,
 	void *dof;
 	int n, err;
 
+	/*
+	 * If we have not yet ioctl'd down our options DOF, we'll do that
+	 * before enabling any probes (some options will affect which probes
+	 * we match).
+	 */
+	if (dtrace_setopts(dtp) != 0)
+		return (-1);
+
 	dtrace_program_info(dtp, pgp, pip);
 
 	if ((dof = dtrace_dof_create(dtp, pgp, DTRACE_D_STRIP)) == NULL)
diff --git a/usr/src/lib/libdtrace/common/dt_work.c b/usr/src/lib/libdtrace/common/dt_work.c
index 97a7f62d69..c330394027 100644
--- a/usr/src/lib/libdtrace/common/dt_work.c
+++ b/usr/src/lib/libdtrace/common/dt_work.c
@@ -25,7 +25,9 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2011, Joyent, Inc. All rights reserved.
+ */
 
 #include <dt_impl.h>
 #include <stddef.h>
@@ -164,13 +166,22 @@ dtrace_status(dtrace_hdl_t *dtp)
 int
 dtrace_go(dtrace_hdl_t *dtp)
 {
-	void *dof;
-	int err;
-
 	if (dtp->dt_active)
 		return (dt_set_errno(dtp, EINVAL));
 
 	/*
+	 * In most cases, we will have already ioctl'd down our options DOF
+	 * by this point -- but if a libdtrace does a dtrace_setopt() after
+	 * calling dtrace_program_exec() but before calling dtrace_go(),
+	 * dt_optset will be cleared and we need to ioctl down the options
+	 * DOF now.
+	 */
+	if (dtrace_setopts(dtp) != 0 &&
+	    (dtp->dt_errno != ENOTTY || dtp->dt_vector == NULL)) {
+		return (-1);
+	}
+
+	/*
 	 * If a dtrace:::ERROR program and callback are registered, enable the
 	 * program before we start tracing.  If this fails for a vector open
 	 * with ENOTTY, we permit dtrace_go() to succeed so that vector clients
@@ -178,19 +189,10 @@ dtrace_go(dtrace_hdl_t *dtp)
 	 * though they do not provide support for the DTRACEIOC_ENABLE ioctl.
 	 */
 	if (dtp->dt_errprog != NULL &&
-	    dtrace_program_exec(dtp, dtp->dt_errprog, NULL) == -1 && (
-	    dtp->dt_errno != ENOTTY || dtp->dt_vector == NULL))
-		return (-1); /* dt_errno has been set for us */
-
-	if ((dof = dtrace_getopt_dof(dtp)) == NULL)
+	    dtrace_program_exec(dtp, dtp->dt_errprog, NULL) == -1 &&
+	    (dtp->dt_errno != ENOTTY || dtp->dt_vector == NULL))
 		return (-1); /* dt_errno has been set for us */
 
-	err = dt_ioctl(dtp, DTRACEIOC_ENABLE, dof);
-	dtrace_dof_destroy(dtp, dof);
-
-	if (err == -1 && (errno != ENOTTY || dtp->dt_vector == NULL))
-		return (dt_set_errno(dtp, errno));
-
 	if (dt_ioctl(dtp, DTRACEIOC_GO, &dtp->dt_beganon) == -1) {
 		if (errno == EACCES)
 			return (dt_set_errno(dtp, EDT_DESTRUCTIVE));
diff --git a/usr/src/lib/libdtrace/common/dtrace.h b/usr/src/lib/libdtrace/common/dtrace.h
index 293ab944af..dd591296aa 100644
--- a/usr/src/lib/libdtrace/common/dtrace.h
+++ b/usr/src/lib/libdtrace/common/dtrace.h
@@ -83,6 +83,7 @@ extern const char *dtrace_subrstr(dtrace_hdl_t *, int);
 
 extern int dtrace_setopt(dtrace_hdl_t *, const char *, const char *);
 extern int dtrace_getopt(dtrace_hdl_t *, const char *, dtrace_optval_t *);
+extern int dtrace_setopts(dtrace_hdl_t *);
 
 extern void dtrace_update(dtrace_hdl_t *);
 extern int dtrace_ctlfd(dtrace_hdl_t *);
diff --git a/usr/src/lib/libdtrace/common/mac.d.in b/usr/src/lib/libdtrace/common/mac.d.in
new file mode 100644
index 0000000000..6263d51bdd
--- /dev/null
+++ b/usr/src/lib/libdtrace/common/mac.d.in
@@ -0,0 +1,66 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#pragma D depends_on library ip.d
+
+inline int ETHERTYPE_PUP = @ETHERTYPE_PUP@; 
+inline int ETHERTYPE_802_MIN = @ETHERTYPE_802_MIN@;
+inline int ETHERTYPE_IP = @ETHERTYPE_IP@; 
+inline int ETHERTYPE_ARP = @ETHERTYPE_ARP@; 
+inline int ETHERTYPE_REVARP = @ETHERTYPE_REVARP@;
+inline int ETHERTYPE_AT = @ETHERTYPE_AT@; 
+inline int ETHERTYPE_AARP = @ETHERTYPE_AARP@;
+inline int ETHERTYPE_VLAN = @ETHERTYPE_VLAN@;
+inline int ETHERTYPE_IPV6 = @ETHERTYPE_IPV6@;
+inline int ETHERTYPE_SLOW = @ETHERTYPE_SLOW@;
+inline int ETHERTYPE_PPPOED = @ETHERTYPE_PPPOED@;
+inline int ETHERTYPE_PPPOES = @ETHERTYPE_PPPOES@;
+inline int ETHERTYPE_EAPOL = @ETHERTYPE_EAPOL@;
+inline int ETHERTYPE_RSN_PREAUTH = @ETHERTYPE_RSN_PREAUTH@;
+inline int ETHERTYPE_TRILL = @ETHERTYPE_TRILL@;
+inline int ETHERTYPE_FCOE = @ETHERTYPE_FCOE@;
+inline int ETHERTYPE_MAX = @ETHERTYPE_MAX@;
+
+
+typedef struct etherinfo {
+	uint8_t eth_dst[6];		/* Destination MAC addr */
+	uint8_t eth_src[6];		/* Source MAC addr */
+	uint16_t eth_type;		/* Ethertype */
+	boolean_t eth_istagged;		/* Is the VLAN tag present */
+	uint8_t eth_priority;		/* Priority tag */
+	uint8_t eth_dei;		/* drop eligible indicator */
+	uint16_t eth_vlanid;		/* VLAN ID */
+	uintptr_t eth_header;		/* Pointer to start of header */
+	uintptr_t eth_mblk;		/* Pointer to the mblk containing header */
+} etherinfo_t;
+
+#pragma D binding "1.12.1" translator
+translator etherinfo_t < mblk_t *mp > {
+	eth_dst = mp->b_rptr;
+	eth_src = mp->b_rptr + 6;
+	eth_type = ntohs(*(uint16_t *)(mp->b_rptr + 12)) == ETHERTYPE_VLAN ?
+	    ntohs(*(uint16_t *)(mp->b_rptr + 16)) :
+	    ntohs(*(uint16_t *)(mp->b_rptr + 12));
+	eth_istagged = ntohs(*(uint16_t *)(mp->b_rptr + 12)) == ETHERTYPE_VLAN ?
+	    1 : 0;
+	eth_priority = ntohs(*(uint16_t *)(mp->b_rptr + 12)) == ETHERTYPE_VLAN ?
+	    ntohs(*(uint16_t *)(mp->b_rptr + 14)) & 0xe000: 0;
+	eth_dei = ntohs(*(uint16_t *)(mp->b_rptr + 12)) == ETHERTYPE_VLAN ?
+	    ntohs(*(uint16_t *)(mp->b_rptr + 14)) & 0x1000: 0;
+	eth_vlanid = ntohs(*(uint16_t *)(mp->b_rptr + 12)) == ETHERTYPE_VLAN ?
+	    ntohs(*(uint16_t *)(mp->b_rptr + 14)) & 0x0fff: 0;
+	eth_header = (uintptr_t)mp->b_rptr;
+	eth_mblk = (uintptr_t)mp;
+};
diff --git a/usr/src/lib/libdtrace/common/mac.sed.in b/usr/src/lib/libdtrace/common/mac.sed.in
new file mode 100644
index 0000000000..00e149d000
--- /dev/null
+++ b/usr/src/lib/libdtrace/common/mac.sed.in
@@ -0,0 +1,45 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+
+/*
+ * This file is a sed script which is first preprocessed by cpp or cc -E to
+ * define a set of sed directives which replace #define tokens with their
+ * values.  After preprocessing, the sed script is run over vnd.d.in to
+ * replace the #define tokens listed below to create the finished vnd.d.
+ * Refer to the rules in libdtrace/Makefile.com for more information.
+ */
+
+#include <sys/ethernet.h>
+
+#define	SED_REPLACE(x)	s/#x/x/g
+
+SED_REPLACE(ETHERTYPE_PUP)
+SED_REPLACE(ETHERTYPE_802_MIN)
+SED_REPLACE(ETHERTYPE_IP)
+SED_REPLACE(ETHERTYPE_ARP)
+SED_REPLACE(ETHERTYPE_REVARP)
+SED_REPLACE(ETHERTYPE_AT)
+SED_REPLACE(ETHERTYPE_AARP)
+SED_REPLACE(ETHERTYPE_VLAN)
+SED_REPLACE(ETHERTYPE_IPV6)
+SED_REPLACE(ETHERTYPE_SLOW)
+SED_REPLACE(ETHERTYPE_PPPOED)
+SED_REPLACE(ETHERTYPE_PPPOES)
+SED_REPLACE(ETHERTYPE_EAPOL)
+SED_REPLACE(ETHERTYPE_RSN_PREAUTH)
+SED_REPLACE(ETHERTYPE_TRILL)
+SED_REPLACE(ETHERTYPE_FCOE)
+SED_REPLACE(ETHERTYPE_MAX)
diff --git a/usr/src/lib/libdtrace/common/vnd.d b/usr/src/lib/libdtrace/common/vnd.d
new file mode 100644
index 0000000000..356c412150
--- /dev/null
+++ b/usr/src/lib/libdtrace/common/vnd.d
@@ -0,0 +1,28 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+
+#pragma D depends_on module vnd
+#pragma D depends_on provider vnd
+#pragma D depends_on library ip.d
+#pragma D depends_on library mac.d
+
+#pragma D binding "1.6.3" translator
+translator ifinfo_t < vnd_str_t *vsp > {
+	if_name = vsp != NULL ? stringof(vsp->vns_dev->vdd_lname) : "<null>";
+	if_local = 0;
+	if_ipstack = vsp != NULL ? vsp->vns_nsd->vpnd_nsid : 0;
+	if_addr = (uintptr_t)vsp;
+};
diff --git a/usr/src/lib/libdwarf/Makefile b/usr/src/lib/libdwarf/Makefile
new file mode 100644
index 0000000000..6b7ff6244b
--- /dev/null
+++ b/usr/src/lib/libdwarf/Makefile
@@ -0,0 +1,40 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include		../Makefile.lib
+
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber lint install_h: $(SUBDIRS)
+
+install: install_h $(SUBDIRS)
+
+check:		$(CHECKHDRS)
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/lib/libdwarf/Makefile.com b/usr/src/lib/libdwarf/Makefile.com
new file mode 100644
index 0000000000..c737366af9
--- /dev/null
+++ b/usr/src/lib/libdwarf/Makefile.com
@@ -0,0 +1,92 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+LIBRARY=	libdwarf.a
+VERS=		.1
+
+OBJECTS=dwarf_abbrev.o		\
+	dwarf_addr_finder.o	\
+	dwarf_alloc.o		\
+	dwarf_arange.o		\
+	dwarf_die_deliv.o	\
+	dwarf_elf_access.o	\
+	dwarf_error.o		\
+	dwarf_form.o		\
+	dwarf_frame.o		\
+	dwarf_frame2.o		\
+	dwarf_frame3.o		\
+	dwarf_funcs.o		\
+	dwarf_global.o		\
+	dwarf_harmless.o	\
+	dwarf_init_finish.o	\
+	dwarf_leb.o		\
+	dwarf_line.o		\
+	dwarf_line2.o		\
+	dwarf_loc.o		\
+	dwarf_macro.o		\
+	dwarf_names.o		\
+	dwarf_original_elf_init.o	\
+	dwarf_print_lines.o	\
+	dwarf_pubtypes.o	\
+	dwarf_query.o		\
+	dwarf_ranges.o		\
+	dwarf_sort_line.o	\
+	dwarf_string.o		\
+	dwarf_stubs.o		\
+	dwarf_types.o		\
+	dwarf_util.o		\
+	dwarf_vars.o		\
+	dwarf_weaks.o		\
+	malloc_check.o		\
+	pro_alloc.o		\
+	pro_arange.o		\
+	pro_die.o		\
+	pro_encode_nm.o		\
+	pro_error.o		\
+	pro_expr.o		\
+	pro_finish.o		\
+	pro_forms.o		\
+	pro_frame.o		\
+	pro_funcs.o		\
+	pro_init.o		\
+	pro_line.o		\
+	pro_macinfo.o		\
+	pro_pubnames.o		\
+	pro_reloc.o		\
+	pro_reloc_stream.o	\
+	pro_reloc_symbolic.o	\
+	pro_section.o		\
+	pro_types.o		\
+	pro_vars.o		\
+	pro_weaks.o
+
+include ../../Makefile.lib
+include ../../Makefile.rootfs
+
+LIBS =		$(DYNLIB)
+LDLIBS +=	-lelf -lc
+
+SRCDIR =	../common
+CPPFLAGS +=	-I$(SRCDIR) -DELF_TARGET_ALL=1
+CERRWARN +=	-_gcc=-Wno-unused
+CERRWARN +=	-_gcc=-Wno-implicit-function-declaration
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../Makefile.targ
diff --git a/usr/src/tools/ctf/dwarf/THIRDPARTYLICENSE b/usr/src/lib/libdwarf/THIRDPARTYLICENSE
index b9320c2d56..b9320c2d56 100644
--- a/usr/src/tools/ctf/dwarf/THIRDPARTYLICENSE
+++ b/usr/src/lib/libdwarf/THIRDPARTYLICENSE
diff --git a/usr/src/tools/ctf/dwarf/THIRDPARTYLICENSE.descrip b/usr/src/lib/libdwarf/THIRDPARTYLICENSE.descrip
index 73abaac973..73abaac973 100644
--- a/usr/src/tools/ctf/dwarf/THIRDPARTYLICENSE.descrip
+++ b/usr/src/lib/libdwarf/THIRDPARTYLICENSE.descrip
diff --git a/usr/src/lib/libdwarf/amd64/Makefile b/usr/src/lib/libdwarf/amd64/Makefile
new file mode 100644
index 0000000000..15a899f96f
--- /dev/null
+++ b/usr/src/lib/libdwarf/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64)
diff --git a/usr/src/tools/ctf/dwarf/common/cmplrs/dwarf_addr_finder.h b/usr/src/lib/libdwarf/common/cmplrs/dwarf_addr_finder.h
index 0eda6d1c44..0eda6d1c44 100644
--- a/usr/src/tools/ctf/dwarf/common/cmplrs/dwarf_addr_finder.h
+++ b/usr/src/lib/libdwarf/common/cmplrs/dwarf_addr_finder.h
diff --git a/usr/src/tools/ctf/dwarf/common/config.h b/usr/src/lib/libdwarf/common/config.h
index 42b286cfda..42b286cfda 100644
--- a/usr/src/tools/ctf/dwarf/common/config.h
+++ b/usr/src/lib/libdwarf/common/config.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf.h b/usr/src/lib/libdwarf/common/dwarf.h
index b064c4d86b..b064c4d86b 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf.h
+++ b/usr/src/lib/libdwarf/common/dwarf.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_abbrev.c b/usr/src/lib/libdwarf/common/dwarf_abbrev.c
index c2ae361f33..c2ae361f33 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_abbrev.c
+++ b/usr/src/lib/libdwarf/common/dwarf_abbrev.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_abbrev.h b/usr/src/lib/libdwarf/common/dwarf_abbrev.h
index b525924c83..b525924c83 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_abbrev.h
+++ b/usr/src/lib/libdwarf/common/dwarf_abbrev.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_addr_finder.c b/usr/src/lib/libdwarf/common/dwarf_addr_finder.c
index 2fadefc1ea..2fadefc1ea 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_addr_finder.c
+++ b/usr/src/lib/libdwarf/common/dwarf_addr_finder.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_alloc.c b/usr/src/lib/libdwarf/common/dwarf_alloc.c
index ddb423e841..ddb423e841 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_alloc.c
+++ b/usr/src/lib/libdwarf/common/dwarf_alloc.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_alloc.h b/usr/src/lib/libdwarf/common/dwarf_alloc.h
index 3a61c692c6..3a61c692c6 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_alloc.h
+++ b/usr/src/lib/libdwarf/common/dwarf_alloc.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_arange.c b/usr/src/lib/libdwarf/common/dwarf_arange.c
index e7ad8acc5e..e7ad8acc5e 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_arange.c
+++ b/usr/src/lib/libdwarf/common/dwarf_arange.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_arange.h b/usr/src/lib/libdwarf/common/dwarf_arange.h
index d6c537c452..d6c537c452 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_arange.h
+++ b/usr/src/lib/libdwarf/common/dwarf_arange.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_base_types.h b/usr/src/lib/libdwarf/common/dwarf_base_types.h
index 00e2700a81..00e2700a81 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_base_types.h
+++ b/usr/src/lib/libdwarf/common/dwarf_base_types.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_die_deliv.c b/usr/src/lib/libdwarf/common/dwarf_die_deliv.c
index 4ba9f2aded..4ba9f2aded 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_die_deliv.c
+++ b/usr/src/lib/libdwarf/common/dwarf_die_deliv.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_die_deliv.h b/usr/src/lib/libdwarf/common/dwarf_die_deliv.h
index f1ecb153ba..f1ecb153ba 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_die_deliv.h
+++ b/usr/src/lib/libdwarf/common/dwarf_die_deliv.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_elf_access.c b/usr/src/lib/libdwarf/common/dwarf_elf_access.c
index 6caa64a758..6caa64a758 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_elf_access.c
+++ b/usr/src/lib/libdwarf/common/dwarf_elf_access.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_elf_access.h b/usr/src/lib/libdwarf/common/dwarf_elf_access.h
index fd52c17938..fd52c17938 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_elf_access.h
+++ b/usr/src/lib/libdwarf/common/dwarf_elf_access.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_error.c b/usr/src/lib/libdwarf/common/dwarf_error.c
index 7327529820..7327529820 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_error.c
+++ b/usr/src/lib/libdwarf/common/dwarf_error.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_error.h b/usr/src/lib/libdwarf/common/dwarf_error.h
index 27acf70db0..27acf70db0 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_error.h
+++ b/usr/src/lib/libdwarf/common/dwarf_error.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_form.c b/usr/src/lib/libdwarf/common/dwarf_form.c
index fcdd64230c..fcdd64230c 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_form.c
+++ b/usr/src/lib/libdwarf/common/dwarf_form.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_frame.c b/usr/src/lib/libdwarf/common/dwarf_frame.c
index 3a825ee925..3a825ee925 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_frame.c
+++ b/usr/src/lib/libdwarf/common/dwarf_frame.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_frame.h b/usr/src/lib/libdwarf/common/dwarf_frame.h
index ceb686335b..ceb686335b 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_frame.h
+++ b/usr/src/lib/libdwarf/common/dwarf_frame.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_frame2.c b/usr/src/lib/libdwarf/common/dwarf_frame2.c
index 01b9ec497b..01b9ec497b 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_frame2.c
+++ b/usr/src/lib/libdwarf/common/dwarf_frame2.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_frame3.c b/usr/src/lib/libdwarf/common/dwarf_frame3.c
index 7bd8ec86d5..7bd8ec86d5 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_frame3.c
+++ b/usr/src/lib/libdwarf/common/dwarf_frame3.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_funcs.c b/usr/src/lib/libdwarf/common/dwarf_funcs.c
index 8d725ae33f..8d725ae33f 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_funcs.c
+++ b/usr/src/lib/libdwarf/common/dwarf_funcs.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_funcs.h b/usr/src/lib/libdwarf/common/dwarf_funcs.h
index bf91c32157..bf91c32157 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_funcs.h
+++ b/usr/src/lib/libdwarf/common/dwarf_funcs.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_global.c b/usr/src/lib/libdwarf/common/dwarf_global.c
index d1c090fa43..d1c090fa43 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_global.c
+++ b/usr/src/lib/libdwarf/common/dwarf_global.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_global.h b/usr/src/lib/libdwarf/common/dwarf_global.h
index c2bc2cdcc3..c2bc2cdcc3 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_global.h
+++ b/usr/src/lib/libdwarf/common/dwarf_global.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_harmless.c b/usr/src/lib/libdwarf/common/dwarf_harmless.c
index 16dbe4bc97..16dbe4bc97 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_harmless.c
+++ b/usr/src/lib/libdwarf/common/dwarf_harmless.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_harmless.h b/usr/src/lib/libdwarf/common/dwarf_harmless.h
index 3d4d910ce9..3d4d910ce9 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_harmless.h
+++ b/usr/src/lib/libdwarf/common/dwarf_harmless.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_incl.h b/usr/src/lib/libdwarf/common/dwarf_incl.h
index df2fbf334c..df2fbf334c 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_incl.h
+++ b/usr/src/lib/libdwarf/common/dwarf_incl.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_init_finish.c b/usr/src/lib/libdwarf/common/dwarf_init_finish.c
index 1ab9d5fd38..1ab9d5fd38 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_init_finish.c
+++ b/usr/src/lib/libdwarf/common/dwarf_init_finish.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_leb.c b/usr/src/lib/libdwarf/common/dwarf_leb.c
index b3b5d262f5..b3b5d262f5 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_leb.c
+++ b/usr/src/lib/libdwarf/common/dwarf_leb.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_line.c b/usr/src/lib/libdwarf/common/dwarf_line.c
index e7e15e7c1a..e7e15e7c1a 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_line.c
+++ b/usr/src/lib/libdwarf/common/dwarf_line.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_line.h b/usr/src/lib/libdwarf/common/dwarf_line.h
index 66d6062754..66d6062754 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_line.h
+++ b/usr/src/lib/libdwarf/common/dwarf_line.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_line2.c b/usr/src/lib/libdwarf/common/dwarf_line2.c
index 634b848167..634b848167 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_line2.c
+++ b/usr/src/lib/libdwarf/common/dwarf_line2.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_loc.c b/usr/src/lib/libdwarf/common/dwarf_loc.c
index f28b27b630..f28b27b630 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_loc.c
+++ b/usr/src/lib/libdwarf/common/dwarf_loc.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_loc.h b/usr/src/lib/libdwarf/common/dwarf_loc.h
index 685d199f29..685d199f29 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_loc.h
+++ b/usr/src/lib/libdwarf/common/dwarf_loc.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_macro.c b/usr/src/lib/libdwarf/common/dwarf_macro.c
index e1ff976d8c..e1ff976d8c 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_macro.c
+++ b/usr/src/lib/libdwarf/common/dwarf_macro.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_macro.h b/usr/src/lib/libdwarf/common/dwarf_macro.h
index 31ea2e6e67..31ea2e6e67 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_macro.h
+++ b/usr/src/lib/libdwarf/common/dwarf_macro.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_names.c b/usr/src/lib/libdwarf/common/dwarf_names.c
index 417e025690..417e025690 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_names.c
+++ b/usr/src/lib/libdwarf/common/dwarf_names.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_names.h b/usr/src/lib/libdwarf/common/dwarf_names.h
index 6edafa5fdd..6edafa5fdd 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_names.h
+++ b/usr/src/lib/libdwarf/common/dwarf_names.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_opaque.h b/usr/src/lib/libdwarf/common/dwarf_opaque.h
index b235a9c7b4..b235a9c7b4 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_opaque.h
+++ b/usr/src/lib/libdwarf/common/dwarf_opaque.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_original_elf_init.c b/usr/src/lib/libdwarf/common/dwarf_original_elf_init.c
index a6d943da0a..a6d943da0a 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_original_elf_init.c
+++ b/usr/src/lib/libdwarf/common/dwarf_original_elf_init.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_print_lines.c b/usr/src/lib/libdwarf/common/dwarf_print_lines.c
index 30c4889ee5..30c4889ee5 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_print_lines.c
+++ b/usr/src/lib/libdwarf/common/dwarf_print_lines.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_pubtypes.c b/usr/src/lib/libdwarf/common/dwarf_pubtypes.c
index 330c1c6adc..330c1c6adc 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_pubtypes.c
+++ b/usr/src/lib/libdwarf/common/dwarf_pubtypes.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_query.c b/usr/src/lib/libdwarf/common/dwarf_query.c
index 3f21abd039..3f21abd039 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_query.c
+++ b/usr/src/lib/libdwarf/common/dwarf_query.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_ranges.c b/usr/src/lib/libdwarf/common/dwarf_ranges.c
index ae6d5cf9b5..ae6d5cf9b5 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_ranges.c
+++ b/usr/src/lib/libdwarf/common/dwarf_ranges.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_sort_line.c b/usr/src/lib/libdwarf/common/dwarf_sort_line.c
index 3576614129..3576614129 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_sort_line.c
+++ b/usr/src/lib/libdwarf/common/dwarf_sort_line.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_string.c b/usr/src/lib/libdwarf/common/dwarf_string.c
index fafa5a097c..fafa5a097c 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_string.c
+++ b/usr/src/lib/libdwarf/common/dwarf_string.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_stubs.c b/usr/src/lib/libdwarf/common/dwarf_stubs.c
index f2c1f7fd45..f2c1f7fd45 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_stubs.c
+++ b/usr/src/lib/libdwarf/common/dwarf_stubs.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_types.c b/usr/src/lib/libdwarf/common/dwarf_types.c
index d547805289..d547805289 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_types.c
+++ b/usr/src/lib/libdwarf/common/dwarf_types.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_types.h b/usr/src/lib/libdwarf/common/dwarf_types.h
index ebd31c6c79..ebd31c6c79 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_types.h
+++ b/usr/src/lib/libdwarf/common/dwarf_types.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_util.c b/usr/src/lib/libdwarf/common/dwarf_util.c
index 01e0dd755d..01e0dd755d 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_util.c
+++ b/usr/src/lib/libdwarf/common/dwarf_util.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_util.h b/usr/src/lib/libdwarf/common/dwarf_util.h
index 4046bb2478..4046bb2478 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_util.h
+++ b/usr/src/lib/libdwarf/common/dwarf_util.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_vars.c b/usr/src/lib/libdwarf/common/dwarf_vars.c
index 24105289ba..24105289ba 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_vars.c
+++ b/usr/src/lib/libdwarf/common/dwarf_vars.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_vars.h b/usr/src/lib/libdwarf/common/dwarf_vars.h
index bd5f967e48..bd5f967e48 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_vars.h
+++ b/usr/src/lib/libdwarf/common/dwarf_vars.h
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_weaks.c b/usr/src/lib/libdwarf/common/dwarf_weaks.c
index 425916e62e..425916e62e 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_weaks.c
+++ b/usr/src/lib/libdwarf/common/dwarf_weaks.c
diff --git a/usr/src/tools/ctf/dwarf/common/dwarf_weaks.h b/usr/src/lib/libdwarf/common/dwarf_weaks.h
index d38f5f118a..d38f5f118a 100644
--- a/usr/src/tools/ctf/dwarf/common/dwarf_weaks.h
+++ b/usr/src/lib/libdwarf/common/dwarf_weaks.h
diff --git a/usr/src/tools/ctf/dwarf/common/libdwarf.h b/usr/src/lib/libdwarf/common/libdwarf.h
index 78627a96a6..78627a96a6 100644
--- a/usr/src/tools/ctf/dwarf/common/libdwarf.h
+++ b/usr/src/lib/libdwarf/common/libdwarf.h
diff --git a/usr/src/tools/ctf/dwarf/common/libdwarfdefs.h b/usr/src/lib/libdwarf/common/libdwarfdefs.h
index a564655b23..a564655b23 100644
--- a/usr/src/tools/ctf/dwarf/common/libdwarfdefs.h
+++ b/usr/src/lib/libdwarf/common/libdwarfdefs.h
diff --git a/usr/src/tools/ctf/dwarf/common/malloc_check.c b/usr/src/lib/libdwarf/common/malloc_check.c
index 1c6e7738e4..1c6e7738e4 100644
--- a/usr/src/tools/ctf/dwarf/common/malloc_check.c
+++ b/usr/src/lib/libdwarf/common/malloc_check.c
diff --git a/usr/src/tools/ctf/dwarf/common/malloc_check.h b/usr/src/lib/libdwarf/common/malloc_check.h
index ba1ad3da71..ba1ad3da71 100644
--- a/usr/src/tools/ctf/dwarf/common/malloc_check.h
+++ b/usr/src/lib/libdwarf/common/malloc_check.h
diff --git a/usr/src/tools/ctf/dwarf/common/mapfile-vers b/usr/src/lib/libdwarf/common/mapfile-vers
index c1a652a591..c1a652a591 100644
--- a/usr/src/tools/ctf/dwarf/common/mapfile-vers
+++ b/usr/src/lib/libdwarf/common/mapfile-vers
diff --git a/usr/src/tools/ctf/dwarf/common/pro_alloc.c b/usr/src/lib/libdwarf/common/pro_alloc.c
index 1ca7806239..1ca7806239 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_alloc.c
+++ b/usr/src/lib/libdwarf/common/pro_alloc.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_alloc.h b/usr/src/lib/libdwarf/common/pro_alloc.h
index b4da65325f..b4da65325f 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_alloc.h
+++ b/usr/src/lib/libdwarf/common/pro_alloc.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_arange.c b/usr/src/lib/libdwarf/common/pro_arange.c
index 4e5c37795c..4e5c37795c 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_arange.c
+++ b/usr/src/lib/libdwarf/common/pro_arange.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_arange.h b/usr/src/lib/libdwarf/common/pro_arange.h
index f0e7e84dff..f0e7e84dff 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_arange.h
+++ b/usr/src/lib/libdwarf/common/pro_arange.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_die.c b/usr/src/lib/libdwarf/common/pro_die.c
index 948b641146..948b641146 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_die.c
+++ b/usr/src/lib/libdwarf/common/pro_die.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_die.h b/usr/src/lib/libdwarf/common/pro_die.h
index 01c00e79bd..01c00e79bd 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_die.h
+++ b/usr/src/lib/libdwarf/common/pro_die.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_encode_nm.c b/usr/src/lib/libdwarf/common/pro_encode_nm.c
index d6215dc56b..d6215dc56b 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_encode_nm.c
+++ b/usr/src/lib/libdwarf/common/pro_encode_nm.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_encode_nm.h b/usr/src/lib/libdwarf/common/pro_encode_nm.h
index d08e4d5148..d08e4d5148 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_encode_nm.h
+++ b/usr/src/lib/libdwarf/common/pro_encode_nm.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_error.c b/usr/src/lib/libdwarf/common/pro_error.c
index d408a391e2..d408a391e2 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_error.c
+++ b/usr/src/lib/libdwarf/common/pro_error.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_error.h b/usr/src/lib/libdwarf/common/pro_error.h
index c37035301b..c37035301b 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_error.h
+++ b/usr/src/lib/libdwarf/common/pro_error.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_expr.c b/usr/src/lib/libdwarf/common/pro_expr.c
index ad40eb762a..ad40eb762a 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_expr.c
+++ b/usr/src/lib/libdwarf/common/pro_expr.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_expr.h b/usr/src/lib/libdwarf/common/pro_expr.h
index 202f2d30d5..202f2d30d5 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_expr.h
+++ b/usr/src/lib/libdwarf/common/pro_expr.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_finish.c b/usr/src/lib/libdwarf/common/pro_finish.c
index bc43a5f0f4..bc43a5f0f4 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_finish.c
+++ b/usr/src/lib/libdwarf/common/pro_finish.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_forms.c b/usr/src/lib/libdwarf/common/pro_forms.c
index fec9a39c60..fec9a39c60 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_forms.c
+++ b/usr/src/lib/libdwarf/common/pro_forms.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_frame.c b/usr/src/lib/libdwarf/common/pro_frame.c
index bd1ef6a637..bd1ef6a637 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_frame.c
+++ b/usr/src/lib/libdwarf/common/pro_frame.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_frame.h b/usr/src/lib/libdwarf/common/pro_frame.h
index df60d369ed..df60d369ed 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_frame.h
+++ b/usr/src/lib/libdwarf/common/pro_frame.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_funcs.c b/usr/src/lib/libdwarf/common/pro_funcs.c
index 8ff05500bb..8ff05500bb 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_funcs.c
+++ b/usr/src/lib/libdwarf/common/pro_funcs.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_incl.h b/usr/src/lib/libdwarf/common/pro_incl.h
index 10bce470c2..10bce470c2 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_incl.h
+++ b/usr/src/lib/libdwarf/common/pro_incl.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_init.c b/usr/src/lib/libdwarf/common/pro_init.c
index d696113a67..d696113a67 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_init.c
+++ b/usr/src/lib/libdwarf/common/pro_init.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_line.c b/usr/src/lib/libdwarf/common/pro_line.c
index 69d3e339f0..69d3e339f0 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_line.c
+++ b/usr/src/lib/libdwarf/common/pro_line.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_line.h b/usr/src/lib/libdwarf/common/pro_line.h
index eed941239d..eed941239d 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_line.h
+++ b/usr/src/lib/libdwarf/common/pro_line.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_macinfo.c b/usr/src/lib/libdwarf/common/pro_macinfo.c
index cfa820aee6..cfa820aee6 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_macinfo.c
+++ b/usr/src/lib/libdwarf/common/pro_macinfo.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_macinfo.h b/usr/src/lib/libdwarf/common/pro_macinfo.h
index 852a0cec1f..852a0cec1f 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_macinfo.h
+++ b/usr/src/lib/libdwarf/common/pro_macinfo.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_opaque.h b/usr/src/lib/libdwarf/common/pro_opaque.h
index befc69faa6..befc69faa6 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_opaque.h
+++ b/usr/src/lib/libdwarf/common/pro_opaque.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_pubnames.c b/usr/src/lib/libdwarf/common/pro_pubnames.c
index e07fe35943..e07fe35943 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_pubnames.c
+++ b/usr/src/lib/libdwarf/common/pro_pubnames.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_reloc.c b/usr/src/lib/libdwarf/common/pro_reloc.c
index 66f16acbd0..66f16acbd0 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_reloc.c
+++ b/usr/src/lib/libdwarf/common/pro_reloc.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_reloc.h b/usr/src/lib/libdwarf/common/pro_reloc.h
index d2e6c67357..d2e6c67357 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_reloc.h
+++ b/usr/src/lib/libdwarf/common/pro_reloc.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_reloc_stream.c b/usr/src/lib/libdwarf/common/pro_reloc_stream.c
index 459779ceda..459779ceda 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_reloc_stream.c
+++ b/usr/src/lib/libdwarf/common/pro_reloc_stream.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_reloc_stream.h b/usr/src/lib/libdwarf/common/pro_reloc_stream.h
index 892ea5baf3..892ea5baf3 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_reloc_stream.h
+++ b/usr/src/lib/libdwarf/common/pro_reloc_stream.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_reloc_symbolic.c b/usr/src/lib/libdwarf/common/pro_reloc_symbolic.c
index 22080a00cd..22080a00cd 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_reloc_symbolic.c
+++ b/usr/src/lib/libdwarf/common/pro_reloc_symbolic.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_reloc_symbolic.h b/usr/src/lib/libdwarf/common/pro_reloc_symbolic.h
index 3d03a47863..3d03a47863 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_reloc_symbolic.h
+++ b/usr/src/lib/libdwarf/common/pro_reloc_symbolic.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_section.c b/usr/src/lib/libdwarf/common/pro_section.c
index 6503c2cf09..6503c2cf09 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_section.c
+++ b/usr/src/lib/libdwarf/common/pro_section.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_section.h b/usr/src/lib/libdwarf/common/pro_section.h
index b37ade44dc..b37ade44dc 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_section.h
+++ b/usr/src/lib/libdwarf/common/pro_section.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_types.c b/usr/src/lib/libdwarf/common/pro_types.c
index 1f3f93280c..1f3f93280c 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_types.c
+++ b/usr/src/lib/libdwarf/common/pro_types.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_types.h b/usr/src/lib/libdwarf/common/pro_types.h
index 817609215b..817609215b 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_types.h
+++ b/usr/src/lib/libdwarf/common/pro_types.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_util.h b/usr/src/lib/libdwarf/common/pro_util.h
index 56bde8bda6..56bde8bda6 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_util.h
+++ b/usr/src/lib/libdwarf/common/pro_util.h
diff --git a/usr/src/tools/ctf/dwarf/common/pro_vars.c b/usr/src/lib/libdwarf/common/pro_vars.c
index 3e75a9d9af..3e75a9d9af 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_vars.c
+++ b/usr/src/lib/libdwarf/common/pro_vars.c
diff --git a/usr/src/tools/ctf/dwarf/common/pro_weaks.c b/usr/src/lib/libdwarf/common/pro_weaks.c
index 8c74bf08ca..8c74bf08ca 100644
--- a/usr/src/tools/ctf/dwarf/common/pro_weaks.c
+++ b/usr/src/lib/libdwarf/common/pro_weaks.c
diff --git a/usr/src/lib/libdwarf/i386/Makefile b/usr/src/lib/libdwarf/i386/Makefile
new file mode 100644
index 0000000000..4398507523
--- /dev/null
+++ b/usr/src/lib/libdwarf/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS)
diff --git a/usr/src/lib/libdwarf/sparc/Makefile b/usr/src/lib/libdwarf/sparc/Makefile
new file mode 100644
index 0000000000..4398507523
--- /dev/null
+++ b/usr/src/lib/libdwarf/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS)
diff --git a/usr/src/lib/libdwarf/sparcv9/Makefile b/usr/src/lib/libdwarf/sparcv9/Makefile
new file mode 100644
index 0000000000..4e7833710f
--- /dev/null
+++ b/usr/src/lib/libdwarf/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) 
diff --git a/usr/src/lib/libfakekernel/common/mapfile-vers b/usr/src/lib/libfakekernel/common/mapfile-vers
index 42af216580..1c41dd9b58 100644
--- a/usr/src/lib/libfakekernel/common/mapfile-vers
+++ b/usr/src/lib/libfakekernel/common/mapfile-vers
@@ -11,6 +11,7 @@
 
 #
 # Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
+# Copyright (c) 2017, Joyent, Inc.
 # Copyright 2017 RackTop Systems.
 # Copyright 2018, Joyent, Inc.
 #
@@ -206,6 +207,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	taskq_dispatch_ent;
 	taskq_empty;
 	taskq_member;
+	taskq_empty;
 	taskq_wait;
 
 	thread_create;
diff --git a/usr/src/lib/libfakekernel/common/taskq.c b/usr/src/lib/libfakekernel/common/taskq.c
index 1d04326829..c445557d3f 100644
--- a/usr/src/lib/libfakekernel/common/taskq.c
+++ b/usr/src/lib/libfakekernel/common/taskq.c
@@ -25,6 +25,7 @@
 /*
  * Copyright 2012 Garrett D'Amore <garrett@damore.org>.  All rights reserved.
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  * Copyright 2017 RackTop Systems.
  * Copyright 2018, Joyent, Inc.
  */
diff --git a/usr/src/lib/libgrubmgmt/common/libgrub_fs.c b/usr/src/lib/libgrubmgmt/common/libgrub_fs.c
index aa5faa6470..92078bccee 100644
--- a/usr/src/lib/libgrubmgmt/common/libgrub_fs.c
+++ b/usr/src/lib/libgrubmgmt/common/libgrub_fs.c
@@ -21,6 +21,8 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2011 Joyent, Inc. All rights reserved.
  */
 /*
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
diff --git a/usr/src/lib/libidspace/Makefile b/usr/src/lib/libidspace/Makefile
new file mode 100644
index 0000000000..44640eeddc
--- /dev/null
+++ b/usr/src/lib/libidspace/Makefile
@@ -0,0 +1,45 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.lib
+
+HDRS = libidspace.h
+HDRDIR = common
+
+SUBDIRS = $(MACH) 
+$(BUILD64)SUBDIRS += $(MACH64)
+
+all := TARGET = all
+clean := TARGET = clean
+clobber := TARGET = clobber
+install := TARGET = install
+lint := TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+install: install_h $(SUBDIRS)
+
+install_h: $(ROOTHDRS)
+
+check: $(CHECKHDRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/lib/libidspace/Makefile.com b/usr/src/lib/libidspace/Makefile.com
new file mode 100644
index 0000000000..8cc60ffc4c
--- /dev/null
+++ b/usr/src/lib/libidspace/Makefile.com
@@ -0,0 +1,42 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+LIBRARY =	libidspace.a
+VERS =		.1
+OBJECTS =	id_space.o \
+		libidspace.o
+COMDIR =	$(SRC)/common/idspace
+
+include ../../Makefile.lib
+
+SRCDIR =	../common
+SRCS =		../../../common/idspace/id_space.c
+LIBS =		$(DYNLIB) $(LINTLIB)
+
+LDLIBS += 	-lc -lumem
+
+$(LINTLIB) := 	SRCS = $(SRCDIR)/$(LINTSRC)
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+lint: lintcheck
+
+include ../../Makefile.targ
+
+objs/%.o pics/%.o: $(COMDIR)/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
diff --git a/usr/src/lib/libidspace/amd64/Makefile b/usr/src/lib/libidspace/amd64/Makefile
new file mode 100644
index 0000000000..15d904c616
--- /dev/null
+++ b/usr/src/lib/libidspace/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libidspace/common/libidspace.c b/usr/src/lib/libidspace/common/libidspace.c
new file mode 100644
index 0000000000..7a9f8acd67
--- /dev/null
+++ b/usr/src/lib/libidspace/common/libidspace.c
@@ -0,0 +1,25 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014, Joyent, Inc.
+ */
+
+/*
+ * Wrappers around the common id_space code, for userland.
+ */
+#include <sys/id_space.h>
+
+id_t
+id_alloc_specific(id_space_t *idp, id_t id)
+{
+	return (id_alloc_specific_nosleep(idp, id));
+}
diff --git a/usr/src/lib/libidspace/common/libidspace.h b/usr/src/lib/libidspace/common/libidspace.h
new file mode 100644
index 0000000000..bb8690f19c
--- /dev/null
+++ b/usr/src/lib/libidspace/common/libidspace.h
@@ -0,0 +1,42 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _LIBIDSPACE_H
+#define	_LIBIDSPACE_H
+
+/*
+ * libidspace public header
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <sys/types.h>
+
+typedef struct id_space id_space_t;
+
+extern id_space_t *id_space_create(const char *, id_t, id_t);
+extern void id_space_destroy(id_space_t *);
+extern void id_space_extend(id_space_t *, id_t, id_t);
+extern id_t id_alloc(id_space_t *);
+extern id_t id_alloc_specific(id_space_t *, id_t);
+extern void id_free(id_space_t *, id_t);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBIDSPACE_H */
diff --git a/usr/src/lib/libidspace/common/llib-lidspace b/usr/src/lib/libidspace/common/llib-lidspace
new file mode 100644
index 0000000000..39c628da47
--- /dev/null
+++ b/usr/src/lib/libidspace/common/llib-lidspace
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+#include <libidspace.h>
diff --git a/usr/src/lib/libidspace/common/mapfile-vers b/usr/src/lib/libidspace/common/mapfile-vers
new file mode 100644
index 0000000000..61ae855ee0
--- /dev/null
+++ b/usr/src/lib/libidspace/common/mapfile-vers
@@ -0,0 +1,47 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION ILLUMOS_1.0 {    # first release of libidspace
+    global:
+        id_alloc;
+	id_alloc_specific;
+	id_free;
+        id_space_create;
+	id_space_destroy;
+        id_space_extend;
+};
+
+
+SYMBOL_VERSION ILLUMOSprivate {
+    local:
+        *;
+};
+
diff --git a/usr/src/lib/libidspace/i386/Makefile b/usr/src/lib/libidspace/i386/Makefile
new file mode 100644
index 0000000000..41e699e8f8
--- /dev/null
+++ b/usr/src/lib/libidspace/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libidspace/sparc/Makefile b/usr/src/lib/libidspace/sparc/Makefile
new file mode 100644
index 0000000000..41e699e8f8
--- /dev/null
+++ b/usr/src/lib/libidspace/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libidspace/sparcv9/Makefile b/usr/src/lib/libidspace/sparcv9/Makefile
new file mode 100644
index 0000000000..15d904c616
--- /dev/null
+++ b/usr/src/lib/libidspace/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libinetutil/common/mapfile-vers b/usr/src/lib/libinetutil/common/mapfile-vers
index a26d988990..c86fdd956d 100644
--- a/usr/src/lib/libinetutil/common/mapfile-vers
+++ b/usr/src/lib/libinetutil/common/mapfile-vers
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2017 Joyent, Inc.
 #
 
 #
diff --git a/usr/src/lib/libipadm/common/libipadm.c b/usr/src/lib/libipadm/common/libipadm.c
index e384229c29..9d57e1f16d 100644
--- a/usr/src/lib/libipadm/common/libipadm.c
+++ b/usr/src/lib/libipadm/common/libipadm.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2016, Chris Fraire <cfraire@me.com>.
  */
@@ -286,11 +287,19 @@ ipadm_close(ipadm_handle_t iph)
 boolean_t
 ipadm_check_auth(void)
 {
+	int		uid;
 	struct passwd	pwd;
 	char		buf[NSS_BUFLEN_PASSWD];
 
+	/*
+	 * Branded zones may have different kinds of auth, but root always
+	 * allowed.
+	 */
+	if ((uid = getuid()) == 0)
+		return (B_TRUE);
+
 	/* get the password entry for the given user ID */
-	if (getpwuid_r(getuid(), &pwd, buf, sizeof (buf)) == NULL)
+	if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL)
 		return (B_FALSE);
 
 	/* check for presence of given authorization */
@@ -899,9 +908,21 @@ ipadm_door_call(ipadm_handle_t iph, void *arg, size_t asize, void **rbufp,
 
 reopen:
 	(void) pthread_mutex_lock(&iph->iph_lock);
-	/* The door descriptor is opened if it isn't already */
+	/*
+	 * The door descriptor is opened if it isn't already.
+	 */
 	if (iph->iph_door_fd == -1) {
-		if ((iph->iph_door_fd = open(IPMGMT_DOOR, O_RDONLY)) < 0) {
+		char door[MAXPATHLEN];
+		const char *zroot = zone_get_nroot();
+
+		/*
+		 * If this is a branded zone, make sure we use the "/native"
+		 * prefix for the door path:
+		 */
+		(void) snprintf(door, sizeof (door), "%s%s", zroot != NULL ?
+		    zroot : "", IPMGMT_DOOR);
+
+		if ((iph->iph_door_fd = open(door, O_RDONLY)) < 0) {
 			err = errno;
 			(void) pthread_mutex_unlock(&iph->iph_lock);
 			return (err);
diff --git a/usr/src/lib/libipmi/common/ipmi_lancfg.c b/usr/src/lib/libipmi/common/ipmi_lancfg.c
index 3e3ebc6e81..b324891e3f 100644
--- a/usr/src/lib/libipmi/common/ipmi_lancfg.c
+++ b/usr/src/lib/libipmi/common/ipmi_lancfg.c
@@ -22,6 +22,9 @@
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
 
 /*
  * Query and configure LAN interfaces over IPMI.  This is done through the
@@ -34,6 +37,7 @@
 #include <strings.h>
 
 #include <libipmi.h>
+#include <netinet/in.h>
 
 #include "ipmi_impl.h"
 
@@ -65,10 +69,26 @@ typedef struct ipmi_cmd_lan_set_config {
 #define	IPMI_LAN_PARAM_SUBNET_MASK		6
 #define	IPMI_LAN_PARAM_GATEWAY_ADDR		12
 
+/* VLAN/IPv6 parameters are currently only supported for GET operations */
+#define	IPMI_LAN_PARAM_VLAN_ID			20
+#define	IPMI_LAN_PARAM_IPVX_ENABLED		51
+#define	IPMI_LAN_PARAM_IPV6_NUM_ADDRS		55
+#define	IPMI_LAN_PARAM_IPV6_SADDR		56
+#define	IPMI_LAN_PARAM_IPV6_DADDR		59
+#define	IPMI_LAN_PARAM_IPV6_ROUTER_CONFIG	64
+#define	IPMI_LAN_PARAM_IPV6_STATIC_ROUTE1	65
+#define	IPMI_LAN_PARAM_IPV6_STATIC_ROUTE2	68
+#define	IPMI_LAN_PARAM_IPV6_NUM_DYN_ROUTES	72
+#define	IPMI_LAN_PARAM_IPV6_DYN_ROUTE		73
+
 #define	IPMI_LAN_SET_COMPLETE			0x0
 #define	IPMI_LAN_SET_INPROGRESS			0x1
 #define	IPMI_LAN_SET_COMMIT			0x2
 
+/* bitfield values of IPMI_LAN_PARAM_IPV6_ROUTER_CONFIG param */
+#define	IPMI_LAN_IPV6_STATIC_ROUTES_ENABLED	0x1
+#define	IPMI_LAN_IPV6_DYNAMIC_ROUTES_ENABLED	0x2
+
 typedef struct ipmi_lan_entry {
 	int	ile_param;
 	int	ile_mask;
@@ -78,7 +98,7 @@ typedef struct ipmi_lan_entry {
 	size_t	ile_len;
 } ipmi_lan_entry_t;
 
-static ipmi_lan_entry_t ipmi_lan_table[] = {
+static ipmi_lan_entry_t ipmi_lan_ipv4_table[] = {
 	{ IPMI_LAN_PARAM_IP_ADDR, IPMI_LAN_SET_IPADDR, 0, 0,
 	    offsetof(ipmi_lan_config_t, ilc_ipaddr), sizeof (uint32_t) },
 	{ IPMI_LAN_PARAM_IP_SOURCE, IPMI_LAN_SET_IPADDR_SOURCE, 0, 0,
@@ -91,8 +111,8 @@ static ipmi_lan_entry_t ipmi_lan_table[] = {
 	    offsetof(ipmi_lan_config_t, ilc_gateway_addr), sizeof (uint32_t) }
 };
 
-#define	IPMI_LAN_NENTRIES	\
-	(sizeof (ipmi_lan_table) / sizeof (ipmi_lan_table[0]))
+#define	IPMI_LAN_IPV4_NENTRIES	\
+	(sizeof (ipmi_lan_ipv4_table) / sizeof (ipmi_lan_ipv4_table[0]))
 
 static int
 ipmi_lan_get_param(ipmi_handle_t *ihp, int channel, int param, int set,
@@ -129,15 +149,44 @@ ipmi_lan_get_param(ipmi_handle_t *ihp, int channel, int param, int set,
 	return (0);
 }
 
+struct ipmi_lan_ipv6_addr {
+	uint8_t		ipva_selector;
+	uint8_t		ipva_source;
+	uint8_t		ipva_addr[16];
+	uint8_t		ipva_prefixlen;
+	uint8_t		ipva_status;
+};
+
+struct ipmi_lan_ipv6_numaddrs {
+	uint8_t	inva_num_saddrs;
+	uint8_t inva_num_daddrs;
+	uint8_t	inva_support;
+};
+
+struct ipmi_lan_vlan_cfg {
+	uint8_t	ivla_vlanid_lower;
+	DECL_BITFIELD3(
+	    ivla_vlanid_upper	:4,
+	    __reserved		:3,
+	    ivla_vlan_enable	:1);
+};
+
 int
 ipmi_lan_get_config(ipmi_handle_t *ihp, int channel, ipmi_lan_config_t *cfgp)
 {
-	uint8_t set;
-	int i;
+	uint8_t set, enabled, route_cfg, ndynroutes = 0;
+	int i, j;
 	ipmi_lan_entry_t *lep;
+	struct ipmi_lan_ipv6_numaddrs numaddrs = { 0 };
+	struct ipmi_lan_ipv6_addr addrv6 = { 0 };
+	struct ipmi_lan_vlan_cfg vlancfg = { 0 };
+	struct in6_addr sroute1 = { 0 }, sroute2 = { 0 }, droute = { 0 };
+	boolean_t found_addr = B_FALSE;
+	boolean_t stat_routes_enabled = B_FALSE, dyn_routes_enabled = B_FALSE;
 
 	if (ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_SET_IN_PROGRESS, 0,
 	    0, &set, sizeof (set)) != 0)
+		/* errno set */
 		return (-1);
 
 	if (set & IPMI_LAN_SET_INPROGRESS)
@@ -145,14 +194,186 @@ ipmi_lan_get_config(ipmi_handle_t *ihp, int channel, ipmi_lan_config_t *cfgp)
 	else
 		cfgp->ilc_set_in_progress = B_FALSE;
 
-	for (i = 0; i < IPMI_LAN_NENTRIES; i++) {
-		lep = &ipmi_lan_table[i];
-		if (ipmi_lan_get_param(ihp, channel, lep->ile_param,
-		    lep->ile_set, lep->ile_block,
-		    (char *)cfgp + lep->ile_offset, lep->ile_len) != 0)
+	/*
+	 * First determine which IP addressing modes (IPv4/6) are enabled. On
+	 * service processors that don't support a version of IPMI that is
+	 * IPv6-aware, this parameter won't exist.  If we fail to look it up
+	 * then we'll assume that only IPv4 is enabled.
+	 */
+	if (ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_IPVX_ENABLED, 0, 0,
+	    &enabled, sizeof (enabled)) != 0) {
+		cfgp->ilc_ipv4_enabled = B_TRUE;
+		cfgp->ilc_ipv6_enabled = B_FALSE;
+	} else {
+		switch (enabled) {
+		case 0:
+			cfgp->ilc_ipv4_enabled = B_TRUE;
+			cfgp->ilc_ipv6_enabled = B_FALSE;
+			break;
+		case 1:
+			cfgp->ilc_ipv4_enabled = B_FALSE;
+			cfgp->ilc_ipv6_enabled = B_TRUE;
+			break;
+		case 2:
+			cfgp->ilc_ipv4_enabled = B_TRUE;
+			cfgp->ilc_ipv6_enabled = B_TRUE;
+			break;
+		default:
+			return (ipmi_set_error(ihp, EIPMI_BAD_RESPONSE, NULL));
+		}
+	}
+
+	/* If IPv4 support is enabled, gather the current configuration. */
+	if (cfgp->ilc_ipv4_enabled == B_TRUE) {
+		for (i = 0; i < IPMI_LAN_IPV4_NENTRIES; i++) {
+			lep = &ipmi_lan_ipv4_table[i];
+			if (ipmi_lan_get_param(ihp, channel, lep->ile_param,
+			    lep->ile_set, lep->ile_block,
+			    (char *)cfgp + lep->ile_offset, lep->ile_len) != 0)
+				/* errno set */
+				return (-1);
+		}
+	}
+
+	/* Next check if VLAN is enabled, and if so,  grab the VLAN ID. */
+	if (ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_VLAN_ID, 0,
+	    0, &vlancfg, sizeof (struct ipmi_lan_vlan_cfg)) != 0) {
+		/* errno set */
+		return (-1);
+	}
+	cfgp->ilc_vlan_enabled = vlancfg.ivla_vlan_enable;
+	if (cfgp->ilc_vlan_enabled == B_TRUE) {
+		cfgp->ilc_vlan_id = (vlancfg.ivla_vlanid_upper << 8) |
+		    vlancfg.ivla_vlanid_lower;
+	}
+
+	/* If IPv6 support isn't enabled, then we're all done here. */
+	if (cfgp->ilc_ipv6_enabled != B_TRUE)
+		return (0);
+
+	/*
+	 * First check for a static address.  If we can't find one, we'll look
+	 * for a dynamic address.  The spec allows for multiple IPv6 static and
+	 * dynamic addresses to exist in various states.  For simplicity, we
+	 * will search for the first address that is configured and active.
+	 */
+	if (ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_IPV6_NUM_ADDRS, 0,
+	    0, &numaddrs, sizeof (numaddrs)) != 0) {
+		/* errno set */
+		return (-1);
+	}
+
+	for (i = 0; i < numaddrs.inva_num_saddrs; i++) {
+		if (ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_IPV6_SADDR,
+		    i, 0, &addrv6, sizeof (addrv6)) == 0 &&
+		    addrv6.ipva_status == 0) {
+			found_addr = B_TRUE;
+			cfgp->ilc_ipv6_source = IPMI_LAN_SRC_STATIC;
+			break;
+		}
+	}
+	for (i = 0; found_addr == B_FALSE && i < numaddrs.inva_num_daddrs;
+	    i++) {
+		if (ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_IPV6_DADDR,
+		    i, 0, &addrv6, sizeof (addrv6)) == 0 &&
+		    addrv6.ipva_status == 0) {
+			found_addr = B_TRUE;
+			cfgp->ilc_ipv6_source = IPMI_LAN_SRC_DHCP;
+			break;
+		}
+	}
+
+	/*
+	 * If we didn't find any active static or dynamic addresses, then
+	 * while IPv6 support is enabled, no IPv6 interfaces have been
+	 * configured.  We reset ilc_ipv6_enabled back to false so that
+	 * callers know that the other ilc_ipv6_* fields are not valid.
+	 */
+	if (found_addr != B_TRUE) {
+		cfgp->ilc_ipv6_enabled = B_FALSE;
+		return (0);
+	}
+
+	(void) memcpy(cfgp->ilc_ipv6_addr, addrv6.ipva_addr,
+	    sizeof (addrv6.ipva_addr));
+
+	/*
+	 * For the case that static addressing was used for the SP IP then we
+	 * need to get the IPMI_LAN_PARAM_IPV6_ROUTER_CONFIG parameter to
+	 * determine if static or dynamic routes are enabled (or both).
+	 *
+	 * If DHCP was used to assign the SP IP, then only dynamic route
+	 * discovery is supported.
+	 */
+	if (cfgp->ilc_ipv6_source == IPMI_LAN_SRC_STATIC &&
+	    ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_IPV6_ROUTER_CONFIG,
+	    0, 0, &route_cfg, sizeof (route_cfg)) != 0) {
+		/* errno set */
+		return (-1);
+	}
+
+	if (cfgp->ilc_ipv6_source == IPMI_LAN_SRC_STATIC) {
+		if (route_cfg & IPMI_LAN_IPV6_STATIC_ROUTES_ENABLED)
+			stat_routes_enabled = B_TRUE;
+		if (route_cfg & IPMI_LAN_IPV6_DYNAMIC_ROUTES_ENABLED)
+			dyn_routes_enabled = B_TRUE;
+	} else {
+		dyn_routes_enabled = B_TRUE;
+	}
+
+	/*
+	 * The IPMI spec allows for a max of two static IPv6 routes to be
+	 * configured.
+	 */
+	j = cfgp->ilc_ipv6_nroutes = 0;
+	if (stat_routes_enabled == B_TRUE) {
+		cfgp->ilc_ipv6_nroutes = 2;
+		if (ipmi_lan_get_param(ihp, channel,
+		    IPMI_LAN_PARAM_IPV6_STATIC_ROUTE1, 0, 0, &sroute1,
+		    sizeof (sroute1)) != 0 ||
+		    ipmi_lan_get_param(ihp, channel,
+		    IPMI_LAN_PARAM_IPV6_STATIC_ROUTE2, 0, 0, &sroute1,
+		    sizeof (sroute2)) != 0) {
+			/* errno set */
 			return (-1);
+		}
+		if (IN6_IS_ADDR_UNSPECIFIED(&sroute1)) {
+			cfgp->ilc_ipv6_nroutes++;
+			(void) memcpy(cfgp->ilc_ipv6_routes[j++], &sroute1,
+			    sizeof (sroute1));
+		}
+		if (IN6_IS_ADDR_UNSPECIFIED(&sroute2) != B_TRUE) {
+			cfgp->ilc_ipv6_nroutes++;
+			(void) memcpy(cfgp->ilc_ipv6_routes[j++], &sroute2,
+			    sizeof (sroute2));
+		}
 	}
 
+	/*
+	 * RFC4861 states that if dynamic routing is used, a host should retain
+	 * a minimum of two routes, though more is recommended.  Retrieve the
+	 * number of dynamic routes and then iterate through them and gather
+	 * up to the first two addresses.
+	 */
+	if (dyn_routes_enabled == B_TRUE &&
+	    ipmi_lan_get_param(ihp, channel, IPMI_LAN_PARAM_IPV6_NUM_DYN_ROUTES,
+	    0, 0, &ndynroutes, sizeof (ndynroutes)) != 0) {
+		/* errno set */
+		return (-1);
+	}
+	for (i = 0; i < ndynroutes && i < 2; i++) {
+		if (ipmi_lan_get_param(ihp, channel,
+		    IPMI_LAN_PARAM_IPV6_DYN_ROUTE, i, 0, &droute,
+		    sizeof (droute)) != 0)
+			/* errno set */
+			return (-1);
+
+		if (IN6_IS_ADDR_UNSPECIFIED(&droute) != B_TRUE) {
+			(void) memcpy(cfgp->ilc_ipv6_routes[j++], &droute,
+			    sizeof (droute));
+			cfgp->ilc_ipv6_nroutes++;
+		}
+	}
 	return (0);
 }
 
@@ -220,8 +441,8 @@ ipmi_lan_set_config(ipmi_handle_t *ihp, int channel, ipmi_lan_config_t *cfgp,
 	/*
 	 * Iterate over all parameters and set them.
 	 */
-	for (i = 0; i < IPMI_LAN_NENTRIES; i++) {
-		lep = &ipmi_lan_table[i];
+	for (i = 0; i < IPMI_LAN_IPV4_NENTRIES; i++) {
+		lep = &ipmi_lan_ipv4_table[i];
 		if (!(lep->ile_mask & mask))
 			continue;
 
diff --git a/usr/src/lib/libipmi/common/libipmi.h b/usr/src/lib/libipmi/common/libipmi.h
index 1e69e57854..c3605616ed 100644
--- a/usr/src/lib/libipmi/common/libipmi.h
+++ b/usr/src/lib/libipmi/common/libipmi.h
@@ -297,6 +297,9 @@ extern ipmi_channel_info_t *ipmi_get_channel_info(ipmi_handle_t *, int);
  * This can be expanded in the future as needed.
  */
 
+/* We'll return up to a maximum of two static routee + two dynamic routes */
+#define	IPMI_LAN_IPV6_MAX_ROUTES	4
+
 typedef struct ipmi_lan_config {
 	boolean_t	ilc_set_in_progress;
 	uint32_t	ilc_ipaddr;
@@ -304,8 +307,17 @@ typedef struct ipmi_lan_config {
 	uint8_t		ilc_macaddr[6];
 	uint32_t	ilc_subnet;
 	uint32_t	ilc_gateway_addr;
+	uint8_t		ilc_ipv6_source;
+	uint8_t		ilc_ipv6_addr[16];
+	uint8_t		ilc_ipv6_routes[IPMI_LAN_IPV6_MAX_ROUTES][16];
+	uint8_t		ilc_ipv6_nroutes;
+	uint16_t	ilc_vlan_id;
+	boolean_t	ilc_ipv4_enabled;
+	boolean_t	ilc_ipv6_enabled;
+	boolean_t	ilc_vlan_enabled;
 } ipmi_lan_config_t;
 
+/* values for ilc_ipaddr_source */
 #define	IPMI_LAN_SRC_UNSPECIFIED	0x0
 #define	IPMI_LAN_SRC_STATIC		0x1
 #define	IPMI_LAN_SRC_DHCP		0x2
diff --git a/usr/src/lib/libkmf/plugins/kmf_openssl/Makefile.com b/usr/src/lib/libkmf/plugins/kmf_openssl/Makefile.com
index b5b08f175c..5c327cae00 100644
--- a/usr/src/lib/libkmf/plugins/kmf_openssl/Makefile.com
+++ b/usr/src/lib/libkmf/plugins/kmf_openssl/Makefile.com
@@ -37,8 +37,8 @@ KMFINC=		-I../../../include -I../../../ber_der/inc
 BERLIB=		-lkmf -lkmfberder
 BERLIB64=	$(BERLIB)
 
-OPENSSLLIBS=	$(BERLIB) -lcrypto -lcryptoutil -lc
-OPENSSLLIBS64=	$(BERLIB64) -lcrypto -lcryptoutil -lc
+OPENSSLLIBS=	$(BERLIB) -lsunw_crypto -lcryptoutil -lc
+OPENSSLLIBS64=	$(BERLIB64) -lsunw_crypto -lcryptoutil -lc
 
 LINTSSLLIBS	= $(BERLIB) -lcrypto -lcryptoutil -lc
 LINTSSLLIBS64	= $(BERLIB64) -lcrypto -lcryptoutil -lc
diff --git a/usr/src/lib/libnisdb/db_mindex3.cc b/usr/src/lib/libnisdb/db_mindex3.cc
index d3db240b3c..e70076f409 100644
--- a/usr/src/lib/libnisdb/db_mindex3.cc
+++ b/usr/src/lib/libnisdb/db_mindex3.cc
@@ -284,7 +284,7 @@ entriesFromLDAPthread(void *voidarg) {
 
 	/* Lock to prevent removal */
 	(void) __nis_lock_db_table(arg->tableName, 1, 0,
-					"entriesFromLDAPthread");
+					(char *)"entriesFromLDAPthread");
 
 	/*
 	 * It's possible that the db_mindex for the table has changed,
@@ -316,7 +316,7 @@ entriesFromLDAPthread(void *voidarg) {
 	(void) entriesFromLDAPreal(arg);
 
 	(void) __nis_ulock_db_table(arg->tableName, 1, 0,
-					"entriesFromLDAPthread");
+					(char *)"entriesFromLDAPthread");
 
 	freeQuery(arg->q);
 	if (arg->dirObj != 0)
diff --git a/usr/src/lib/libnisdb/db_table.cc b/usr/src/lib/libnisdb/db_table.cc
index c7cbfafcaf..bbd83fcc01 100644
--- a/usr/src/lib/libnisdb/db_table.cc
+++ b/usr/src/lib/libnisdb/db_table.cc
@@ -602,7 +602,7 @@ db_table::setEntryExp(entryp where, entry_obj *obj, int initialLoad) {
 			if (o != 0) {
 				__nis_buffer_t	b = {0, 0};
 
-				bp2buf(myself, &b, "%s.%s",
+				bp2buf(myself, &b, (char *)"%s.%s",
 					o->zo_name, o->zo_domain);
 				t = getObjMapping(b.buf, 0, 1, 0, 0);
 				sfree(b.buf);
@@ -970,7 +970,7 @@ db_table::setEnumMode(long enumNum) {
 		if (stat != DB_SUCCESS) {
 			enumMode.flag = 0;
 			enumCount.flag = 0;
-			logmsg(MSG_NOTIMECHECK, LOG_ERR,
+			logmsg(MSG_NOTIMECHECK, LOG_ERR, (char *)
 		"%s: No memory for enum check array; entry removal disabled",
 				myself);
 		}
diff --git a/usr/src/lib/libnisdb/nis_db.cc b/usr/src/lib/libnisdb/nis_db.cc
index 1007a396bf..0aa1556c33 100644
--- a/usr/src/lib/libnisdb/nis_db.cc
+++ b/usr/src/lib/libnisdb/nis_db.cc
@@ -529,7 +529,7 @@ dbFindObject(char *objName, db_status *statP) {
 	/* If not the root dir, find the directory where the entry lives */
 
 	sfree(table);
-	name = entryName(myself, objName, &table);
+	name = entryName((char *)myself, objName, &table);
 	if (name == 0 || table == 0) {
 		sfree(name);
 		RETSTAT(0, DB_MEMORY_LIMIT);
@@ -739,7 +739,7 @@ dbDeleteObj(char *objName) {
 	nod->objType = o->zo_data.zo_type;
 	nis_destroy_object(o);
 
-	nod->objName = sdup(myself, T, objName);
+	nod->objName = sdup((char *)myself, T, objName);
 	if (nod->objName == 0) {
 		sfree(nod);
 		return (DB_MEMORY_LIMIT);
@@ -791,7 +791,7 @@ dbTouchObj(char *objName) {
 
 	sfree(table);
 	table = 0;
-	ent = entryName(myself, objName, &table);
+	ent = entryName((char *)myself, objName, &table);
 	if (ent == 0 || table == 0) {
 		sfree(ent);
 		return (DB_MEMORY_LIMIT);
@@ -991,7 +991,7 @@ dbRefreshObj(char *name, nis_object *o) {
 		int		lstat;
 
 		/* Find parent */
-		ent = entryName(myself, objName, &table);
+		ent = entryName((char *)myself, objName, &table);
 		if (ent == 0 || table == 0) {
 			sfree(b.buf);
 			sfree(objTable);
diff --git a/usr/src/lib/libnsl/common/mapfile-vers b/usr/src/lib/libnsl/common/mapfile-vers
index 0b12140f41..bae1af4edc 100644
--- a/usr/src/lib/libnsl/common/mapfile-vers
+++ b/usr/src/lib/libnsl/common/mapfile-vers
@@ -21,6 +21,7 @@
 
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015 Joyent, Inc.
 # Copyright 2018 Nexenta Systems, Inc.
 #
 
diff --git a/usr/src/lib/libnsl/netselect/netselect.c b/usr/src/lib/libnsl/netselect/netselect.c
index 41dfa4909a..7790894c9e 100644
--- a/usr/src/lib/libnsl/netselect/netselect.c
+++ b/usr/src/lib/libnsl/netselect/netselect.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -32,8 +33,6 @@
  * under license from the Regents of the University of California.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include "mt.h"
 #include "../rpc/rpc_mt.h"		/* for MT declarations only */
 #include <rpc/types.h>
@@ -45,6 +44,7 @@
 #include <malloc.h>
 #include <libintl.h>
 #include <syslog.h>
+#include <zone.h>
 #include "netcspace.h"
 
 #define	FAILURE  (unsigned)(-1)
@@ -265,13 +265,22 @@ freenetconfigent(struct netconfig *netp)
 static struct netconfig **
 getnetlist(void)
 {
-	char line[BUFSIZ];	/* holds each line of NETCONFIG */
-	FILE *fp;		/* file stream for NETCONFIG */
+	FILE *fp = NULL;	/* file stream for NETCONFIG */
 	struct netconfig **listpp; /* the beginning of the netconfig list */
 	struct netconfig **tpp;	/* used to traverse the netconfig list */
 	int count;		/* the number of entries in file */
+	char nc_path[MAXPATHLEN];
+	const char *zroot = zone_get_nroot();
+	char line[BUFSIZ];	/* holds each line of NETCONFIG */
+
+	/*
+	 * If we are running in a branded zone, ensure we use the "/native"
+	 * prefix when opening the netconfig file:
+	 */
+	(void) snprintf(nc_path, sizeof (nc_path), "%s%s", zroot != NULL ?
+	    zroot : "", NETCONFIG);
 
-	if ((fp = fopen(NETCONFIG, "rF")) == NULL) {
+	if ((fp = fopen(nc_path, "rF")) == NULL) {
 		nc_error = NC_OPENFAIL;
 		return (NULL);
 	}
@@ -286,13 +295,16 @@ getnetlist(void)
 
 	if (count == 0) {
 		nc_error = NC_NOTFOUND;
-		(void) fclose(fp);
+		if (fp != NULL)
+			(void) fclose(fp);
 		return (NULL);
 	}
+
 	if ((listpp = malloc((count + 1) *
 	    sizeof (struct netconfig *))) == NULL) {
 		nc_error = NC_NOMEM;
-		(void) fclose(fp);
+		if (fp != NULL)
+			(void) fclose(fp);
 		return (NULL);
 	}
 
@@ -311,6 +323,7 @@ getnetlist(void)
 
 	if (nc_error != NC_NOMOREENTRIES) /* Something is screwed up */
 		netlist_free(&listpp);
+
 	return (listpp);
 }
 
diff --git a/usr/src/lib/libnvpair/libnvpair.h b/usr/src/lib/libnvpair/libnvpair.h
index b05669e506..197ec37f46 100644
--- a/usr/src/lib/libnvpair/libnvpair.h
+++ b/usr/src/lib/libnvpair/libnvpair.h
@@ -49,6 +49,8 @@ extern int nvpair_value_match_regex(nvpair_t *, int, char *, regex_t *,
 extern void nvlist_print(FILE *, nvlist_t *);
 extern int nvlist_print_json(FILE *, nvlist_t *);
 extern void dump_nvlist(nvlist_t *, int);
+extern int nvlist_dump_json(nvlist_t *, char **);
+extern void nvlist_dump_json_free(nvlist_t *, char *);
 
 /*
  * Private nvlist printing interface that allows the caller some control
diff --git a/usr/src/lib/libnvpair/mapfile-vers b/usr/src/lib/libnvpair/mapfile-vers
index 0403964e05..9b1f048f75 100644
--- a/usr/src/lib/libnvpair/mapfile-vers
+++ b/usr/src/lib/libnvpair/mapfile-vers
@@ -244,6 +244,8 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	dump_nvlist;
 	nvlist_add_hrtime;
 	nvlist_lookup_hrtime;
+	nvlist_dump_json;
+	nvlist_dump_json_free;
 	nvlist_print;
 	nvlist_print_json;
 	nvlist_prt;
diff --git a/usr/src/lib/libnvpair/nvpair_json.c b/usr/src/lib/libnvpair/nvpair_json.c
index 6aa3e9c01c..3205d229ab 100644
--- a/usr/src/lib/libnvpair/nvpair_json.c
+++ b/usr/src/lib/libnvpair/nvpair_json.c
@@ -18,16 +18,71 @@
 #include <strings.h>
 #include <wchar.h>
 #include <sys/debug.h>
+#include <stdarg.h>
+#include <assert.h>
 
 #include "libnvpair.h"
 
-#define	FPRINTF(fp, ...)				\
+#define	FPRINTF(bufp, blen, offp, ...)			\
 	do {						\
-		if (fprintf(fp, __VA_ARGS__) < 0)	\
+		if (nvlist_rasnprintf(bufp, blen, offp,	\
+		    __VA_ARGS__) < 0)			\
 			return (-1);			\
 	} while (0)
 
 /*
+ * A realloc-aware snprintf/asprintf like function.
+ */
+/*PRINTFLIKE4*/
+static int
+nvlist_rasnprintf(char **bufp, size_t *blen, off_t *boff, char *input, ...)
+{
+	int ret;
+	va_list ap;
+	size_t size;
+	char *b;
+
+	if (*bufp == NULL) {
+		assert(*blen == 0);
+		assert(*boff == 0);
+		/* Pick a reasonable starting point, let's say 1k */
+		*blen = 1024;
+		*bufp = malloc(*blen);
+		if (*bufp == NULL)
+			return (-1);
+	}
+
+	size = *blen - *boff;
+	va_start(ap, input);
+	/* E_SEC_PRINTF_VAR_FMT */
+	ret = vsnprintf(*bufp + *boff, size, input, ap);
+	va_end(ap);
+	if (ret < 0)
+		return (-1);
+
+	if (ret >= size) {
+		size_t asize = *blen;
+		while (ret + *boff >= asize)
+			asize += 1024;
+		if ((b = realloc(*bufp, asize)) == NULL)
+			return (-1);
+		*bufp = b;
+		*blen = asize;
+		size = *blen - *boff;
+		va_start(ap, input);
+		/* E_SEC_PRINTF_VAR_FMT */
+		ret = vsnprintf(*bufp + *boff, size, input, ap);
+		va_end(ap);
+		if (ret < 0)
+			return (-1);
+		assert(ret < size);
+	}
+	*boff += ret;
+
+	return (0);
+}
+
+/*
  * When formatting a string for JSON output we must escape certain characters,
  * as described in RFC4627.  This applies to both member names and
  * DATA_TYPE_STRING values.
@@ -44,7 +99,8 @@
  * representable Unicode characters included in their escaped numeric form.
  */
 static int
-nvlist_print_json_string(FILE *fp, const char *input)
+nvlist_print_json_string(const char *input, char **bufp, size_t *blen,
+    off_t *offp)
 {
 	mbstate_t mbr;
 	wchar_t c;
@@ -52,29 +108,29 @@ nvlist_print_json_string(FILE *fp, const char *input)
 
 	bzero(&mbr, sizeof (mbr));
 
-	FPRINTF(fp, "\"");
+	FPRINTF(bufp, blen, offp, "\"");
 	while ((sz = mbrtowc(&c, input, MB_CUR_MAX, &mbr)) > 0) {
 		switch (c) {
 		case '"':
-			FPRINTF(fp, "\\\"");
+			FPRINTF(bufp, blen, offp, "\\\"");
 			break;
 		case '\n':
-			FPRINTF(fp, "\\n");
+			FPRINTF(bufp, blen, offp, "\\n");
 			break;
 		case '\r':
-			FPRINTF(fp, "\\r");
+			FPRINTF(bufp, blen, offp, "\\r");
 			break;
 		case '\\':
-			FPRINTF(fp, "\\\\");
+			FPRINTF(bufp, blen, offp, "\\\\");
 			break;
 		case '\f':
-			FPRINTF(fp, "\\f");
+			FPRINTF(bufp, blen, offp, "\\f");
 			break;
 		case '\t':
-			FPRINTF(fp, "\\t");
+			FPRINTF(bufp, blen, offp, "\\t");
 			break;
 		case '\b':
-			FPRINTF(fp, "\\b");
+			FPRINTF(bufp, blen, offp, "\\b");
 			break;
 		default:
 			if ((c >= 0x00 && c <= 0x1f) ||
@@ -84,13 +140,15 @@ nvlist_print_json_string(FILE *fp, const char *input)
 				 * characters in the Basic Multilingual Plane
 				 * as JSON-escaped multibyte characters.
 				 */
-				FPRINTF(fp, "\\u%04x", (int)(0xffff & c));
+				FPRINTF(bufp, blen, offp, "\\u%04x",
+				    (int)(0xffff & c));
 			} else if (c >= 0x20 && c <= 0x7f) {
 				/*
 				 * Render other 7-bit ASCII characters directly
 				 * and drop other, unrepresentable characters.
 				 */
-				FPRINTF(fp, "%c", (int)(0xff & c));
+				FPRINTF(bufp, blen, offp, "%c",
+				    (int)(0xff & c));
 			}
 			break;
 		}
@@ -105,98 +163,103 @@ nvlist_print_json_string(FILE *fp, const char *input)
 		return (-1);
 	}
 
-	FPRINTF(fp, "\"");
+	FPRINTF(bufp, blen, offp, "\"");
 	return (0);
 }
 
-/*
- * Dump a JSON-formatted representation of an nvlist to the provided FILE *.
- * This routine does not output any new-lines or additional whitespace other
- * than that contained in strings, nor does it call fflush(3C).
- */
-int
-nvlist_print_json(FILE *fp, nvlist_t *nvl)
+static int
+nvlist_do_json(nvlist_t *nvl, char **bufp, size_t *blen, off_t *offp)
 {
 	nvpair_t *curr;
 	boolean_t first = B_TRUE;
 
-	FPRINTF(fp, "{");
+	FPRINTF(bufp, blen, offp, "{");
 
 	for (curr = nvlist_next_nvpair(nvl, NULL); curr;
 	    curr = nvlist_next_nvpair(nvl, curr)) {
 		data_type_t type = nvpair_type(curr);
 
 		if (!first)
-			FPRINTF(fp, ",");
+			FPRINTF(bufp, blen, offp, ",");
 		else
 			first = B_FALSE;
 
-		if (nvlist_print_json_string(fp, nvpair_name(curr)) == -1)
+		if (nvlist_print_json_string(nvpair_name(curr), bufp, blen,
+		    offp) == -1)
 			return (-1);
-		FPRINTF(fp, ":");
+		FPRINTF(bufp, blen, offp, ":");
 
 		switch (type) {
 		case DATA_TYPE_STRING: {
 			char *string = fnvpair_value_string(curr);
-			if (nvlist_print_json_string(fp, string) == -1)
+			if (nvlist_print_json_string(string, bufp, blen,
+			    offp) == -1)
 				return (-1);
 			break;
 		}
 
 		case DATA_TYPE_BOOLEAN: {
-			FPRINTF(fp, "true");
+			FPRINTF(bufp, blen, offp, "true");
 			break;
 		}
 
 		case DATA_TYPE_BOOLEAN_VALUE: {
-			FPRINTF(fp, "%s", fnvpair_value_boolean_value(curr) ==
-			    B_TRUE ? "true" : "false");
+			FPRINTF(bufp, blen, offp, "%s",
+			    fnvpair_value_boolean_value(curr) == B_TRUE ?
+			    "true" : "false");
 			break;
 		}
 
 		case DATA_TYPE_BYTE: {
-			FPRINTF(fp, "%hhu", fnvpair_value_byte(curr));
+			FPRINTF(bufp, blen, offp, "%hhu",
+			    fnvpair_value_byte(curr));
 			break;
 		}
 
 		case DATA_TYPE_INT8: {
-			FPRINTF(fp, "%hhd", fnvpair_value_int8(curr));
+			FPRINTF(bufp, blen, offp, "%hhd",
+			    fnvpair_value_int8(curr));
 			break;
 		}
 
 		case DATA_TYPE_UINT8: {
-			FPRINTF(fp, "%hhu", fnvpair_value_uint8_t(curr));
+			FPRINTF(bufp, blen, offp, "%hhu",
+			    fnvpair_value_uint8_t(curr));
 			break;
 		}
 
 		case DATA_TYPE_INT16: {
-			FPRINTF(fp, "%hd", fnvpair_value_int16(curr));
+			FPRINTF(bufp, blen, offp, "%hd",
+			    fnvpair_value_int16(curr));
 			break;
 		}
 
 		case DATA_TYPE_UINT16: {
-			FPRINTF(fp, "%hu", fnvpair_value_uint16(curr));
+			FPRINTF(bufp, blen, offp, "%hu",
+			    fnvpair_value_uint16(curr));
 			break;
 		}
 
 		case DATA_TYPE_INT32: {
-			FPRINTF(fp, "%d", fnvpair_value_int32(curr));
+			FPRINTF(bufp, blen, offp, "%d",
+			    fnvpair_value_int32(curr));
 			break;
 		}
 
 		case DATA_TYPE_UINT32: {
-			FPRINTF(fp, "%u", fnvpair_value_uint32(curr));
+			FPRINTF(bufp, blen, offp, "%u",
+			    fnvpair_value_uint32(curr));
 			break;
 		}
 
 		case DATA_TYPE_INT64: {
-			FPRINTF(fp, "%lld",
+			FPRINTF(bufp, blen, offp, "%lld",
 			    (long long)fnvpair_value_int64(curr));
 			break;
 		}
 
 		case DATA_TYPE_UINT64: {
-			FPRINTF(fp, "%llu",
+			FPRINTF(bufp, blen, offp, "%llu",
 			    (unsigned long long)fnvpair_value_uint64(curr));
 			break;
 		}
@@ -204,20 +267,21 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 		case DATA_TYPE_HRTIME: {
 			hrtime_t val;
 			VERIFY0(nvpair_value_hrtime(curr, &val));
-			FPRINTF(fp, "%llu", (unsigned long long)val);
+			FPRINTF(bufp, blen, offp, "%llu",
+			    (unsigned long long)val);
 			break;
 		}
 
 		case DATA_TYPE_DOUBLE: {
 			double val;
 			VERIFY0(nvpair_value_double(curr, &val));
-			FPRINTF(fp, "%f", val);
+			FPRINTF(bufp, blen, offp, "%f", val);
 			break;
 		}
 
 		case DATA_TYPE_NVLIST: {
-			if (nvlist_print_json(fp,
-			    fnvpair_value_nvlist(curr)) == -1)
+			if (nvlist_do_json(fnvpair_value_nvlist(curr), bufp,
+			    blen, offp) == -1)
 				return (-1);
 			break;
 		}
@@ -226,14 +290,15 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			char **val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_string_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				if (nvlist_print_json_string(fp, val[i]) == -1)
+					FPRINTF(bufp, blen, offp, ",");
+				if (nvlist_print_json_string(val[i], bufp,
+				    blen, offp) == -1)
 					return (-1);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -241,14 +306,15 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			nvlist_t **val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_nvlist_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				if (nvlist_print_json(fp, val[i]) == -1)
+					FPRINTF(bufp, blen, offp, ",");
+				if (nvlist_do_json(val[i], bufp, blen,
+				    offp) == -1)
 					return (-1);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -256,14 +322,14 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			boolean_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_boolean_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, val[i] == B_TRUE ?
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, val[i] == B_TRUE ?
 				    "true" : "false");
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -271,13 +337,13 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			uchar_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_byte_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%hhu", val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%hhu", val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -285,13 +351,13 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			uint8_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_uint8_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%hhu", val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%hhu", val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -299,13 +365,13 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			int8_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_int8_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%hd", val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%hd", val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -313,13 +379,13 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			uint16_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_uint16_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%hu", val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%hu", val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -327,13 +393,13 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			int16_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_int16_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%hd", val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%hd", val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -341,13 +407,13 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			uint32_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_uint32_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%u", val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%u", val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -355,13 +421,13 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			int32_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_int32_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%d", val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%d", val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -369,14 +435,14 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			uint64_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_uint64_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%llu",
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%llu",
 				    (unsigned long long)val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -384,13 +450,14 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 			int64_t *val;
 			uint_t valsz, i;
 			VERIFY0(nvpair_value_int64_array(curr, &val, &valsz));
-			FPRINTF(fp, "[");
+			FPRINTF(bufp, blen, offp, "[");
 			for (i = 0; i < valsz; i++) {
 				if (i > 0)
-					FPRINTF(fp, ",");
-				FPRINTF(fp, "%lld", (long long)val[i]);
+					FPRINTF(bufp, blen, offp, ",");
+				FPRINTF(bufp, blen, offp, "%lld",
+				    (long long)val[i]);
 			}
-			FPRINTF(fp, "]");
+			FPRINTF(bufp, blen, offp, "]");
 			break;
 		}
 
@@ -401,6 +468,41 @@ nvlist_print_json(FILE *fp, nvlist_t *nvl)
 
 	}
 
-	FPRINTF(fp, "}");
+	FPRINTF(bufp, blen, offp, "}");
 	return (0);
 }
+
+int
+nvlist_dump_json(nvlist_t *nvl, char **bufp)
+{
+	off_t off = 0;
+	size_t l = 0;
+
+	*bufp = NULL;
+	return (nvlist_do_json(nvl, bufp, &l, &off));
+}
+
+/* ARGSUSED */
+void
+nvlist_dump_json_free(nvlist_t *nvl, char *buf)
+{
+	free(buf);
+}
+
+/*
+ * Dump a JSON-formatted representation of an nvlist to the provided FILE *.
+ * This routine does not output any new-lines or additional whitespace other
+ * than that contained in strings, nor does it call fflush(3C).
+ */
+int
+nvlist_print_json(FILE *fp, nvlist_t *nvl)
+{
+	int ret;
+	char *buf;
+
+	if ((ret = nvlist_dump_json(nvl, &buf)) < 0)
+		return (ret);
+	ret = fprintf(fp, "%s", buf);
+	nvlist_dump_json_free(nvl, buf);
+	return (ret);
+}
diff --git a/usr/src/lib/libppt/Makefile b/usr/src/lib/libppt/Makefile
new file mode 100644
index 0000000000..21c26d447e
--- /dev/null
+++ b/usr/src/lib/libppt/Makefile
@@ -0,0 +1,44 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include $(SRC)/lib/Makefile.lib
+
+SUBDIRS = $(MACH) $(BUILD64) $(MACH64)
+
+HDRS = libppt.h
+HDRDIR = common
+
+all :=		TARGET= all
+clean :=	TARGET= clean
+clobber :=	TARGET= clobber
+install :=	TARGET= install
+lint :=		TARGET= lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+install_h: $(ROOTHDRS)
+
+all install: install_h
+
+check: $(CHECKHDRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include	$(SRC)/lib/Makefile.targ
diff --git a/usr/src/lib/libppt/Makefile.com b/usr/src/lib/libppt/Makefile.com
new file mode 100644
index 0000000000..7b2ff4885f
--- /dev/null
+++ b/usr/src/lib/libppt/Makefile.com
@@ -0,0 +1,46 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+LIBRARY = libppt.a
+VERS = .1
+
+OBJECTS = libppt.o
+
+include $(SRC)/lib/Makefile.lib
+
+SRCDIR = ../common
+
+LIBS = $(DYNLIB) $(LINTLIB)
+SRCS =	$(SRCDIR)/libppt.c
+
+CSTD=	$(CSTD_GNU99)
+C99LMODE=	-Xc99=%all
+
+#
+# lint doesn't like %4s in sscanf().
+#
+LINTFLAGS += -erroff=E_BAD_FORMAT_ARG_TYPE2
+LINTFLAGS64 += -erroff=E_BAD_FORMAT_ARG_TYPE2
+
+$(LINTLIB) := SRCS = $(SRCDIR)/$(LINTSRC)
+LDLIBS += -lpcidb -ldevinfo -lcmdutils -lnvpair -lc
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+lint: lintcheck
+
+include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/lib/libppt/amd64/Makefile b/usr/src/lib/libppt/amd64/Makefile
new file mode 100644
index 0000000000..5a304d7fe7
--- /dev/null
+++ b/usr/src/lib/libppt/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include		../Makefile.com
+include		$(SRC)/lib/Makefile.lib.64
+
+install:	all $(ROOTLIBS64) $(ROOTLINKS64)
diff --git a/usr/src/lib/libppt/common/libppt.c b/usr/src/lib/libppt/common/libppt.c
new file mode 100644
index 0000000000..7e8385da06
--- /dev/null
+++ b/usr/src/lib/libppt/common/libppt.c
@@ -0,0 +1,506 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * Convenience routines for identifying current or available devices that are
+ * suitable for PCI passthrough to a bhyve guest.
+ */
+
+#include <libdevinfo.h>
+#include <libppt.h>
+
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/list.h>
+#include <strings.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <pcidb.h>
+#include <glob.h>
+
+typedef struct node_data {
+	pcidb_hdl_t *nd_db;
+	list_t nd_matches;
+	nvlist_t *nd_nvl;
+	int nd_err;
+} node_data_t;
+
+typedef struct ppt_match {
+	list_node_t pm_list;
+	char pm_path[MAXPATHLEN];
+	char pm_vendor[5];
+	char pm_device[5];
+} ppt_match_t;
+
+static boolean_t
+is_pci(di_node_t di_node)
+{
+	char *svals;
+
+	if (di_prop_lookup_strings(DDI_DEV_T_ANY, di_parent_node(di_node),
+	    "device_type", &svals) != 1)
+		return (B_FALSE);
+
+	return (strcmp(svals, "pci") == 0 || strcmp(svals, "pciex") == 0);
+}
+
+static int
+populate_int_prop(di_node_t di_node, nvlist_t *nvl, const char *name, int *ival)
+{
+	char val[20];
+	int *ivals;
+	int err;
+
+	if (di_prop_lookup_ints(DDI_DEV_T_ANY, di_node, name, &ivals) != 1)
+		return (errno);
+
+	(void) snprintf(val, sizeof (val), "%x", ivals[0]);
+
+	err = nvlist_add_string(nvl, name, val);
+
+	if (err == 0 && ival != NULL)
+		*ival = ivals[0];
+
+	return (err);
+}
+
+static int
+dev_getlabel(pcidb_hdl_t *db, int vid, int did, char *buf, size_t buflen)
+{
+	pcidb_vendor_t *vend = NULL;
+	pcidb_device_t *dev = NULL;
+
+	if ((vend = pcidb_lookup_vendor(db, vid)) == NULL)
+		return (ENOENT);
+
+	if ((dev = pcidb_lookup_device_by_vendor(vend, did)) == NULL)
+		return (ENOENT);
+
+	(void) snprintf(buf, buflen, "%s %s", pcidb_vendor_name(vend),
+	    pcidb_device_name(dev));
+
+	return (0);
+}
+
+static nvlist_t *
+dev_getinfo(di_node_t di_node, pcidb_hdl_t *db,
+    const char *dev, const char *path)
+{
+	char label[MAXPATHLEN];
+	nvlist_t *nvl = NULL;
+	int vid, did;
+	int err;
+
+	if ((err = nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0)) != 0)
+		goto out;
+
+	if (dev != NULL && (err = nvlist_add_string(nvl, "dev", dev)) != 0)
+		goto out;
+	if ((err = nvlist_add_string(nvl, "path", path)) != 0)
+		goto out;
+	if ((err = populate_int_prop(di_node, nvl, "vendor-id", &vid)) != 0)
+		goto out;
+	if ((err = populate_int_prop(di_node, nvl, "device-id", &did)) != 0)
+		goto out;
+	if ((err = populate_int_prop(di_node, nvl,
+	    "subsystem-vendor-id", NULL)) != 0)
+		goto out;
+	if ((err = populate_int_prop(di_node, nvl, "subsystem-id", NULL)) != 0)
+		goto out;
+	if ((err = populate_int_prop(di_node, nvl, "revision-id", NULL)) != 0)
+		goto out;
+
+	err = dev_getlabel(db, vid, did, label, sizeof (label));
+
+	if (err == 0) {
+		err = nvlist_add_string(nvl, "label", label);
+	} else if (err == ENOENT) {
+		err = 0;
+	}
+
+out:
+	if (err) {
+		nvlist_free(nvl);
+		errno = err;
+		return (NULL);
+	}
+
+	return (nvl);
+}
+
+/*
+ * /devices/pci0@0/....@0,1:ppt -> /pci0@0/...@0,1
+ */
+static const char *
+fs_to_phys_path(char *fspath)
+{
+	const char prefix[] = "/devices";
+	char *c;
+
+	if ((c = strrchr(fspath, ':')) != NULL && strcmp(c, ":ppt") == 0)
+		*c = '\0';
+
+	c = fspath;
+
+	if (strncmp(c, prefix, sizeof (prefix) - 1) == 0)
+		c += sizeof (prefix) - 1;
+
+	return (c);
+}
+
+/*
+ * Return an nvlist representing the mappings of /dev/ppt* devices to physical
+ * devices.  Of the form:
+ *
+ * /pci@0,0/... {
+ *  dev: "/dev/ppt0"
+ *  path: "/pci@0,0/..."
+ *  vendor-id: "8086"
+ *  device-id: "1528"
+ *  subsystem-vendor-id: "8086"
+ *  subsystem-id: "1528"
+ *  revision-id: "1"
+ *  label: "Intel Corporation ..."
+ * },
+ * /pci@0,0/...
+ *
+ * The nvlist should be freed by the caller.
+ */
+nvlist_t *
+ppt_list_assigned(void)
+{
+	di_node_t di_root = DI_NODE_NIL;
+	pcidb_hdl_t *db = NULL;
+	nvlist_t *nvl = NULL;
+	glob_t gl;
+	int err;
+
+	bzero(&gl, sizeof (gl));
+
+	if ((di_root = di_init("/", DINFOCACHE)) == DI_NODE_NIL)
+		return (NULL);
+
+	if ((db = pcidb_open(PCIDB_VERSION)) == NULL) {
+		err = errno;
+		goto out;
+	}
+
+	if ((err = nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0)) != 0)
+		goto out;
+
+	if ((err = glob("/dev/ppt*", GLOB_KEEPSTAT | GLOB_ERR,
+	    NULL, &gl)) != 0) {
+		err = (err == GLOB_NOMATCH) ? 0 : errno;
+		goto out;
+	}
+
+	for (size_t i = 0; i < gl.gl_pathc; i++) {
+		char fspath[MAXPATHLEN];
+		nvlist_t *info_nvl;
+		di_node_t di_node;
+		const char *path;
+
+		if (!S_ISLNK(gl.gl_statv[i]->st_mode))
+			continue;
+
+		if (realpath(gl.gl_pathv[i], fspath) == NULL) {
+			err = errno;
+			goto out;
+		}
+
+		path = fs_to_phys_path(fspath);
+
+		/*
+		 * path argument is treated as const.
+		 */
+		if ((di_node = di_lookup_node(di_root, (char *)path)) == NULL) {
+			err = errno;
+			goto out;
+		}
+
+		if (!is_pci(di_node))
+			continue;
+
+		info_nvl = dev_getinfo(di_node, db, gl.gl_pathv[i], path);
+
+		if (info_nvl == NULL) {
+			err = errno;
+			goto out;
+		}
+
+		err = nvlist_add_nvlist(nvl, path, info_nvl);
+		nvlist_free(info_nvl);
+
+		if (err)
+			goto out;
+	}
+
+out:
+	if (di_root != DI_NODE_NIL)
+		di_fini(di_root);
+
+	pcidb_close(db);
+	globfree(&gl);
+
+	if (err) {
+		nvlist_free(nvl);
+		errno = err;
+		return (NULL);
+	}
+
+	return (nvl);
+}
+
+/*
+ * Read in our list of potential PPT devices.  A boot-module provided file
+ * explicitly over-rides anything delivered.
+ */
+static int
+get_matches(list_t *listp)
+{
+	int err = 0;
+	FILE *fp;
+
+	list_create(listp, sizeof (ppt_match_t),
+	    offsetof(ppt_match_t, pm_list));
+
+	if ((fp = fopen("/system/boot/etc/ppt_matches", "r")) == NULL) {
+		if (errno != ENOENT)
+			return (errno);
+
+		if ((fp = fopen("/etc/ppt_matches", "r")) == NULL) {
+			if (errno == ENOENT)
+				return (0);
+			return (errno);
+		}
+	}
+
+	for (;;) {
+		char *line = NULL;
+		ppt_match_t *pm;
+		size_t cap = 0;
+		ssize_t read;
+
+		if ((read = getline(&line, &cap, fp)) <= 0) {
+			free(line);
+			break;
+		}
+
+		if (line[read - 1] == '\n')
+			line[read - 1] = '\0';
+
+		if ((pm = malloc(sizeof (*pm))) == NULL) {
+			err = errno;
+			free(line);
+			goto out;
+		}
+
+		bzero(pm, sizeof (*pm));
+
+		if (sscanf(line, "pciex%4s,%4s", &pm->pm_vendor,
+		    &pm->pm_device) == 2 ||
+		    sscanf(line, "pci%4s,%4s", &pm->pm_vendor,
+		    &pm->pm_device) == 2 ||
+		    sscanf(line, "pciex%4s", &pm->pm_vendor) == 1 ||
+		    sscanf(line, "pci%4s", &pm->pm_vendor) == 1) {
+			list_insert_tail(listp, pm);
+		} else if (line[0] == '/') {
+			(void) strlcpy(pm->pm_path, line, sizeof (pm->pm_path));
+			list_insert_tail(listp, pm);
+		} else {
+			/*
+			 * Ignore any line we don't understand.
+			 */
+			free(pm);
+		}
+
+		free(line);
+	}
+
+out:
+	(void) fclose(fp);
+	return (err);
+}
+
+static boolean_t
+match_ppt(list_t *matches, nvlist_t *nvl)
+{
+	char *vendor;
+	char *device;
+	char *path;
+
+	if (nvlist_lookup_string(nvl, "path", &path) != 0 ||
+	    nvlist_lookup_string(nvl, "vendor-id", &vendor) != 0 ||
+	    nvlist_lookup_string(nvl, "device-id", &device) != 0)
+		return (B_FALSE);
+
+	for (ppt_match_t *pm = list_head(matches); pm != NULL;
+	    pm = list_next(matches, pm)) {
+		if (pm->pm_path[0] != '\0' && strcmp(pm->pm_path, path) == 0)
+			return (B_TRUE);
+
+		if (pm->pm_vendor[0] != '\0' &&
+		    strcmp(pm->pm_vendor, vendor) == 0) {
+			if (pm->pm_device[0] == '\0')
+				return (B_TRUE);
+			if (strcmp(pm->pm_device, device) == 0)
+				return (B_TRUE);
+		}
+	}
+
+	return (B_FALSE);
+}
+
+static int
+inspect_node(di_node_t di_node, void *arg)
+{
+	node_data_t *data = arg;
+	nvlist_t *info_nvl = NULL;
+	char *devname = NULL;
+	const char *driver;
+	char *path = NULL;
+
+	if (!is_pci(di_node))
+		return (DI_WALK_CONTINUE);
+
+	driver = di_driver_name(di_node);
+
+	if (driver != NULL && strcmp(driver, "ppt") == 0) {
+		if (asprintf(&devname, "/dev/ppt%d",
+		    di_instance(di_node)) < 0) {
+			data->nd_err = errno;
+			goto out;
+		}
+	}
+
+	if ((path = di_devfs_path(di_node)) == NULL) {
+		data->nd_err = ENOENT;
+		goto out;
+	}
+
+	info_nvl = dev_getinfo(di_node, data->nd_db, devname, path);
+
+	if (info_nvl == NULL)
+		goto out;
+
+	if (devname == NULL && !match_ppt(&data->nd_matches, info_nvl))
+		goto out;
+
+	data->nd_err = nvlist_add_nvlist(data->nd_nvl, path, info_nvl);
+
+out:
+	free(path);
+	free(devname);
+	nvlist_free(info_nvl);
+	return (data->nd_err ? DI_WALK_TERMINATE : DI_WALK_CONTINUE);
+}
+
+/*
+ * Like ppt_list_assigned() output, but includes all devices that could be used
+ * for passthrough, whether assigned or not.
+ */
+nvlist_t *
+ppt_list(void)
+{
+	node_data_t nd = { NULL, };
+	di_node_t di_root;
+	int err;
+
+	if ((di_root = di_init("/", DINFOCACHE)) == DI_NODE_NIL)
+		return (NULL);
+
+	if ((err = get_matches(&nd.nd_matches)) != 0)
+		goto out;
+
+	if ((nd.nd_db = pcidb_open(PCIDB_VERSION)) == NULL) {
+		err = errno;
+		goto out;
+	}
+
+	if ((err = nvlist_alloc(&nd.nd_nvl, NV_UNIQUE_NAME, 0)) != 0)
+		goto out;
+
+	if ((err = di_walk_node(di_root, DI_WALK_CLDFIRST,
+	    &nd, inspect_node)) != 0)
+		goto out;
+
+	err = nd.nd_err;
+
+out:
+	pcidb_close(nd.nd_db);
+
+	for (ppt_match_t *pm = list_head(&nd.nd_matches); pm != NULL; ) {
+		ppt_match_t *next = list_next(&nd.nd_matches, pm);
+		free(pm);
+		pm = next;
+	}
+
+	if (di_root != DI_NODE_NIL)
+		di_fini(di_root);
+
+	if (err) {
+		nvlist_free(nd.nd_nvl);
+		errno = err;
+		return (NULL);
+	}
+
+	return (nd.nd_nvl);
+}
+
+/*
+ * Given a physical path such as "/devices/pci0@0...", return the "/dev/pptX"
+ * that is bound to it, if any.  The "/devices/" prefix is optional.  The
+ * physical path may have the ":ppt" minor name suffix.
+ *
+ * Returns ENOENT if no such PPT device exists.
+ */
+int
+ppt_devpath_to_dev(const char *inpath, char *buf, size_t buflen)
+{
+	char fspath[MAXPATHLEN] = "";
+	nvpair_t *nvp = NULL;
+	const char *devpath;
+	int err = ENOENT;
+	nvlist_t *nvl;
+
+	if (strlcat(fspath, inpath, sizeof (fspath)) >= sizeof (fspath))
+		return (ENAMETOOLONG);
+
+	devpath = fs_to_phys_path(fspath);
+
+	if ((nvl = ppt_list_assigned()) == NULL)
+		return (errno);
+
+	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
+		const char *name = nvpair_name(nvp);
+		char *ppt = NULL;
+		nvlist_t *props;
+
+		(void) nvpair_value_nvlist(nvp, &props);
+
+		if (strcmp(name, devpath) == 0) {
+			(void) nvlist_lookup_string(props, "dev", &ppt);
+
+			err = 0;
+
+			if (strlcpy(buf, ppt, buflen) >= buflen)
+				err = ENAMETOOLONG;
+			break;
+		}
+	}
+
+	nvlist_free(nvl);
+	return (err);
+}
diff --git a/usr/src/lib/libppt/common/libppt.h b/usr/src/lib/libppt/common/libppt.h
new file mode 100644
index 0000000000..efbf2c7b8b
--- /dev/null
+++ b/usr/src/lib/libppt/common/libppt.h
@@ -0,0 +1,36 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ *
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _LIBPPT_H
+#define	_LIBPPT_H
+
+#include <sys/types.h>
+
+#include <libnvpair.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern int ppt_devpath_to_dev(const char *, char *, size_t);
+
+extern nvlist_t *ppt_list_assigned(void);
+
+extern nvlist_t *ppt_list(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBPPT_H */
diff --git a/usr/src/lib/libppt/common/llib-lppt b/usr/src/lib/libppt/common/llib-lppt
new file mode 100644
index 0000000000..dadd992a31
--- /dev/null
+++ b/usr/src/lib/libppt/common/llib-lppt
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+#include <libppt.h>
diff --git a/usr/src/lib/libppt/common/mapfile-vers b/usr/src/lib/libppt/common/mapfile-vers
new file mode 100644
index 0000000000..d9d882874b
--- /dev/null
+++ b/usr/src/lib/libppt/common/mapfile-vers
@@ -0,0 +1,40 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION ILLUMOSprivate {
+    global:
+	ppt_devpath_to_dev;
+	ppt_list_assigned;
+	ppt_list;
+
+    local:
+	*;
+};
diff --git a/usr/src/lib/libppt/i386/Makefile b/usr/src/lib/libppt/i386/Makefile
new file mode 100644
index 0000000000..3f11e556d4
--- /dev/null
+++ b/usr/src/lib/libppt/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include		../Makefile.com
+
+install:	all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libppt/sparc/Makefile b/usr/src/lib/libppt/sparc/Makefile
new file mode 100644
index 0000000000..3f11e556d4
--- /dev/null
+++ b/usr/src/lib/libppt/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include		../Makefile.com
+
+install:	all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libppt/sparcv9/Makefile b/usr/src/lib/libppt/sparcv9/Makefile
new file mode 100644
index 0000000000..5a304d7fe7
--- /dev/null
+++ b/usr/src/lib/libppt/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include		../Makefile.com
+include		$(SRC)/lib/Makefile.lib.64
+
+install:	all $(ROOTLIBS64) $(ROOTLINKS64)
diff --git a/usr/src/lib/libproc/common/Pcontrol.c b/usr/src/lib/libproc/common/Pcontrol.c
index 9af5026014..f18d4cefd8 100644
--- a/usr/src/lib/libproc/common/Pcontrol.c
+++ b/usr/src/lib/libproc/common/Pcontrol.c
@@ -347,10 +347,16 @@ static const ps_ops_t P_live_ops = {
 void
 _libproc_init(void)
 {
+	const char *root;
+
 	_libproc_debug = getenv("LIBPROC_DEBUG") != NULL;
 	_libproc_no_qsort = getenv("LIBPROC_NO_QSORT") != NULL;
 	_libproc_incore_elf = getenv("LIBPROC_INCORE_ELF") != NULL;
 
+	if ((root = zone_get_nroot()) != NULL)
+		(void) snprintf(procfs_path, sizeof (procfs_path), "%s/proc",
+		    root);
+
 	(void) sigfillset(&blockable_sigs);
 	(void) sigdelset(&blockable_sigs, SIGKILL);
 	(void) sigdelset(&blockable_sigs, SIGSTOP);
@@ -1791,6 +1797,9 @@ prldump(const char *caller, lwpstatus_t *lsp)
 	case PR_SUSPENDED:
 		dprintf("%s: SUSPENDED\n", caller);
 		break;
+	case PR_BRAND:
+		dprintf("%s: BRANDPRIVATE (%d)\n", caller, lsp->pr_what);
+		break;
 	default:
 		dprintf("%s: Unknown\n", caller);
 		break;
@@ -1970,6 +1979,7 @@ Pstopstatus(struct ps_prochandle *P,
 	case PR_FAULTED:
 	case PR_JOBCONTROL:
 	case PR_SUSPENDED:
+	case PR_BRAND:
 		break;
 	default:
 		errno = EPROTO;
@@ -3544,6 +3554,7 @@ Lstopstatus(struct ps_lwphandle *L,
 	case PR_FAULTED:
 	case PR_JOBCONTROL:
 	case PR_SUSPENDED:
+	case PR_BRAND:
 		break;
 	default:
 		errno = EPROTO;
diff --git a/usr/src/lib/libproc/common/Pcontrol.h b/usr/src/lib/libproc/common/Pcontrol.h
index ce5063f621..7e19e8777c 100644
--- a/usr/src/lib/libproc/common/Pcontrol.h
+++ b/usr/src/lib/libproc/common/Pcontrol.h
@@ -24,7 +24,7 @@
  */
 /*
  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
- * Copyright (c) 2014, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc. All rights reserved.
  * Copyright (c) 2013 by Delphix. All rights reserved.
  */
 
@@ -97,6 +97,7 @@ typedef struct file_info {	/* symbol information for a mapped file */
 	struct map_info *file_map;	/* primary (text) mapping */
 	int	file_ref;	/* references from map_info_t structures */
 	int	file_fd;	/* file descriptor for the mapped file */
+	int	file_dbgfile;	/* file descriptor for the debug file */
 	int	file_init;	/* 0: initialization yet to be performed */
 	GElf_Half file_etype;	/* ELF e_type from ehdr */
 	GElf_Half file_class;	/* ELF e_ident[EI_CLASS] from ehdr */
@@ -106,6 +107,7 @@ typedef struct file_info {	/* symbol information for a mapped file */
 	char	*file_rname;	/* resolved on-disk object pathname */
 	char	*file_rbase;	/* pointer to basename of file_rname */
 	Elf	*file_elf;	/* ELF handle so we can close */
+	Elf	*file_dbgelf;	/* Debug ELF handle so we can close */
 	void	*file_elfmem;	/* data for faked-up ELF handle */
 	sym_tbl_t file_symtab;	/* symbol table */
 	sym_tbl_t file_dynsym;	/* dynamic symbol table */
@@ -122,6 +124,7 @@ typedef struct file_info {	/* symbol information for a mapped file */
 	size_t	file_shstrsz;	/* section header string table size */
 	uintptr_t *file_saddrs; /* section header addresses */
 	uint_t  file_nsaddrs;   /* number of section header addresses */
+	boolean_t file_cvt;	/* Have we tried to convert this? */
 } file_info_t;
 
 typedef struct map_info {	/* description of an address space mapping */
diff --git a/usr/src/lib/libproc/common/Pcore.c b/usr/src/lib/libproc/common/Pcore.c
index afc5f459e7..89c5ce47fa 100644
--- a/usr/src/lib/libproc/common/Pcore.c
+++ b/usr/src/lib/libproc/common/Pcore.c
@@ -2750,6 +2750,7 @@ Pfgrab_core(int core_fd, const char *aout_path, int *perr)
 
 			fp->file_ref = 1;
 			fp->file_fd = -1;
+			fp->file_dbgfile = -1;
 
 			fp->file_lo = malloc(sizeof (rd_loadobj_t));
 			fp->file_lname = strdup(execname);
diff --git a/usr/src/lib/libproc/common/Pidle.c b/usr/src/lib/libproc/common/Pidle.c
index 5c12b6a716..db00268f9b 100644
--- a/usr/src/lib/libproc/common/Pidle.c
+++ b/usr/src/lib/libproc/common/Pidle.c
@@ -227,6 +227,7 @@ Pgrab_file(const char *fname, int *perr)
 	}
 
 	fp->file_fd = fd;
+	fp->file_dbgfile = -1;
 	fp->file_lo->rl_lmident = LM_ID_BASE;
 	if ((fp->file_lname = strdup(fp->file_pname)) == NULL) {
 		*perr = G_STRANGE;
diff --git a/usr/src/lib/libproc/common/Psymtab.c b/usr/src/lib/libproc/common/Psymtab.c
index d5482ae85b..aed64d7799 100644
--- a/usr/src/lib/libproc/common/Psymtab.c
+++ b/usr/src/lib/libproc/common/Psymtab.c
@@ -43,6 +43,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/sysmacros.h>
+#include <sys/crc32.h>
 
 #include "libproc.h"
 #include "Pcontrol.h"
@@ -61,6 +62,7 @@ static int read_ehdr32(struct ps_prochandle *, Elf32_Ehdr *, uint_t *,
 static int read_ehdr64(struct ps_prochandle *, Elf64_Ehdr *, uint_t *,
     uintptr_t);
 #endif
+static uint32_t psym_crc32[] = { CRC32_TABLE };
 
 #define	DATA_TYPES	\
 	((1 << STT_OBJECT) | (1 << STT_FUNC) | \
@@ -69,6 +71,22 @@ static int read_ehdr64(struct ps_prochandle *, Elf64_Ehdr *, uint_t *,
 
 #define	MA_RWX	(MA_READ | MA_WRITE | MA_EXEC)
 
+/*
+ * Minimum and maximum length of a build-id that we'll accept. Generally it's a
+ * 20 byte SHA1 and it's expected that the first byte (which is two ascii
+ * characters) indicates a directory and the remaining bytes become the file
+ * name. Therefore, our minimum length is at least 2 bytes (one for the
+ * directory and one for the name) and the max is a bit over the minimum -- 64,
+ * just in case folks do something odd. The string length is three times the max
+ * length. This accounts for the fact that each byte is two characters, a null
+ * terminator, and the directory '/' character.
+ */
+#define	MINBUILDID	2
+#define	MAXBUILDID	64
+#define	BUILDID_STRLEN	(3*MAXBUILDID)
+#define	BUILDID_NAME	".note.gnu.build-id"
+#define	DBGLINK_NAME	".gnu_debuglink"
+
 typedef enum {
 	PRO_NATURAL,
 	PRO_BYADDR,
@@ -184,6 +202,7 @@ file_info_new(struct ps_prochandle *P, map_info_t *mptr)
 	mptr->map_file = fptr;
 	fptr->file_ref = 1;
 	fptr->file_fd = -1;
+	fptr->file_dbgfile = -1;
 	P->num_files++;
 
 	/*
@@ -274,6 +293,10 @@ file_info_free(struct ps_prochandle *P, file_info_t *fptr)
 			free(fptr->file_elfmem);
 		if (fptr->file_fd >= 0)
 			(void) close(fptr->file_fd);
+		if (fptr->file_dbgelf)
+			(void) elf_end(fptr->file_dbgelf);
+		if (fptr->file_dbgfile >= 0)
+			(void) close(fptr->file_dbgfile);
 		if (fptr->file_ctfp) {
 			ctf_close(fptr->file_ctfp);
 			free(fptr->file_ctf_buf);
@@ -721,6 +744,58 @@ Pname_to_loadobj(struct ps_prochandle *P, const char *name)
 	return (Plmid_to_loadobj(P, PR_LMID_EVERY, name));
 }
 
+/*
+ * We've been given a file_info_t which doesn't have any CTF. However, it may
+ * have information that's in a format that we could convert if on the fly.
+ * We'll first try to convert the alternate debug file, if present, and then
+ * move onto the default file. The reason we prefer the alternate debug file is
+ * that if both exist, then it likely has any usable debugging information.
+ */
+static ctf_file_t *
+Pconvert_file_ctf(file_info_t *fptr)
+{
+	int err;
+	ctf_file_t *fp;
+	char errmsg[1024];
+
+	/*
+	 * Provide an opt in.
+	 */
+	if (getenv("LIBPROC_CTFCONVERT") == NULL)
+		return (NULL);
+
+	/*
+	 * If we've already attempted to call this, then that's it. No reason to
+	 * pretend we'll be more successful again another time.
+	 */
+	if (fptr->file_cvt == B_TRUE)
+		return (NULL);
+	fptr->file_cvt = B_TRUE;
+
+	fp = NULL;
+	if (fptr->file_dbgelf != NULL) {
+		fp = ctf_elfconvert(fptr->file_fd, fptr->file_dbgelf, NULL, 1,
+		    0, &err, errmsg, sizeof (errmsg));
+		if (fp == NULL) {
+			dprintf("failed to convert %s: %s\n", fptr->file_pname,
+			    err == ECTF_CONVBKERR ? errmsg : ctf_errmsg(err));
+		}
+	}
+	if (fp == NULL) {
+		fp = ctf_elfconvert(fptr->file_fd, fptr->file_elf, NULL, 1,
+		    0, &err, errmsg, sizeof (errmsg));
+		if (fp == NULL) {
+			dprintf("failed to convert %s: %s\n", fptr->file_pname,
+			    err == ECTF_CONVBKERR ? errmsg : ctf_errmsg(err));
+		}
+	}
+	if (fp != NULL) {
+		fptr->file_ctfp = fp;
+	}
+
+	return (NULL);
+}
+
 ctf_file_t *
 Pbuild_file_ctf(struct ps_prochandle *P, file_info_t *fptr)
 {
@@ -733,8 +808,9 @@ Pbuild_file_ctf(struct ps_prochandle *P, file_info_t *fptr)
 
 	Pbuild_file_symtab(P, fptr);
 
-	if (fptr->file_ctf_size == 0)
-		return (NULL);
+	if (fptr->file_ctf_size == 0) {
+		return (Pconvert_file_ctf(fptr));
+	}
 
 	symp = fptr->file_ctf_dyn ? &fptr->file_dynsym : &fptr->file_symtab;
 	if (symp->sym_data_pri == NULL)
@@ -1581,6 +1657,225 @@ build_fake_elf(struct ps_prochandle *P, file_info_t *fptr, GElf_Ehdr *ehdr,
 }
 
 /*
+ * Try and find the file described by path in the file system and validate that
+ * it matches our CRC before we try and process it for symbol information. If we
+ * instead have an ELF data section, then that means we're checking a build-id
+ * section instead. In that case we just need to find and bcmp the corresponding
+ * section.
+ *
+ * Before we validate if it's a valid CRC or data section, we check to ensure
+ * that it's a normal file and not anything else.
+ */
+static boolean_t
+build_alt_debug(file_info_t *fptr, const char *path, uint32_t crc,
+    Elf_Data *data)
+{
+	int fd;
+	struct stat st;
+	Elf *elf;
+	Elf_Scn *scn;
+	GElf_Shdr symshdr, strshdr;
+	Elf_Data *symdata, *strdata;
+	boolean_t valid;
+	uint32_t c = -1U;
+
+	if ((fd = open(path, O_RDONLY)) < 0)
+		return (B_FALSE);
+
+	if (fstat(fd, &st) != 0) {
+		(void) close(fd);
+		return (B_FALSE);
+	}
+
+	if (S_ISREG(st.st_mode) == 0) {
+		(void) close(fd);
+		return (B_FALSE);
+	}
+
+	/*
+	 * Only check the CRC if we've come here through a GNU debug link
+	 * section as opposed to the build id. This is indicated by having the
+	 * value of data be NULL.
+	 */
+	if (data == NULL) {
+		for (;;) {
+			char buf[4096];
+			ssize_t ret = read(fd, buf, sizeof (buf));
+			if (ret == -1) {
+				if (ret == EINTR)
+					continue;
+				(void) close(fd);
+				return (B_FALSE);
+			}
+			if (ret == 0) {
+				c = ~c;
+				if (c != crc) {
+					dprintf("crc mismatch, found: 0x%x "
+					    "expected 0x%x\n", c, crc);
+					(void) close(fd);
+					return (B_FALSE);
+				}
+				break;
+			}
+			CRC32(c, buf, ret, c, psym_crc32);
+		}
+	}
+
+	elf = elf_begin(fd, ELF_C_READ, NULL);
+	if (elf == NULL) {
+		(void) close(fd);
+		return (B_FALSE);
+	}
+
+	if (elf_kind(elf) != ELF_K_ELF) {
+		goto fail;
+	}
+
+	/*
+	 * If we have a data section, that indicates we have a build-id which
+	 * means we need to find the corresponding build-id section and compare
+	 * it.
+	 */
+	scn = NULL;
+	valid = B_FALSE;
+	for (scn = elf_nextscn(elf, scn); data != NULL && scn != NULL;
+	    scn = elf_nextscn(elf, scn)) {
+		GElf_Shdr hdr;
+		Elf_Data *ntdata;
+
+		if (gelf_getshdr(scn, &hdr) == NULL)
+			goto fail;
+
+		if (hdr.sh_type != SHT_NOTE)
+			continue;
+
+		if ((ntdata = elf_getdata(scn, NULL)) == NULL)
+			goto fail;
+
+		/*
+		 * First verify the data section sizes are equal, then the
+		 * section name. If that's all true, then we can just do a bcmp.
+		 */
+		if (data->d_size != ntdata->d_size)
+			continue;
+
+		dprintf("found corresponding section in alternate file\n");
+		if (bcmp(ntdata->d_buf, data->d_buf, data->d_size) != 0)
+			goto fail;
+
+		valid = B_TRUE;
+		break;
+	}
+	if (data != NULL && valid == B_FALSE) {
+		dprintf("failed to find a matching %s section in %s\n",
+		    BUILDID_NAME, path);
+		goto fail;
+	}
+
+
+	/*
+	 * Do two passes, first see if we have a symbol header, then see if we
+	 * can find the corresponding linked string table.
+	 */
+	scn = NULL;
+	for (scn = elf_nextscn(elf, scn); scn != NULL;
+	    scn = elf_nextscn(elf, scn)) {
+
+		if (gelf_getshdr(scn, &symshdr) == NULL)
+			goto fail;
+
+		if (symshdr.sh_type != SHT_SYMTAB)
+			continue;
+
+		if ((symdata = elf_getdata(scn, NULL)) == NULL)
+			goto fail;
+
+		break;
+	}
+	if (scn == NULL)
+		goto fail;
+
+	if ((scn = elf_getscn(elf, symshdr.sh_link)) == NULL)
+		goto fail;
+
+	if (gelf_getshdr(scn, &strshdr) == NULL)
+		goto fail;
+
+	if ((strdata = elf_getdata(scn, NULL)) == NULL)
+		goto fail;
+
+	fptr->file_symtab.sym_data_pri = symdata;
+	fptr->file_symtab.sym_symn += symshdr.sh_size / symshdr.sh_entsize;
+	fptr->file_symtab.sym_strs = strdata->d_buf;
+	fptr->file_symtab.sym_strsz = strdata->d_size;
+	fptr->file_symtab.sym_hdr_pri = symshdr;
+	fptr->file_symtab.sym_strhdr = strshdr;
+
+	dprintf("successfully loaded additional debug symbols for %s from %s\n",
+	    fptr->file_rname, path);
+
+	fptr->file_dbgfile = fd;
+	fptr->file_dbgelf = elf;
+	return (B_TRUE);
+fail:
+	(void) elf_end(elf);
+	(void) close(fd);
+	return (B_FALSE);
+}
+
+/*
+ * We're here because the object in question has no symbol information, that's a
+ * bit unfortunate. However, we've found that there's a .gnu_debuglink sitting
+ * around. By convention that means that given the current location of the
+ * object on disk, and the debug name that we found in the binary we need to
+ * search the following locations for a matching file.
+ *
+ * <dirname>/.debug/<debug-name>
+ * /usr/lib/debug/<dirname>/<debug-name>
+ *
+ * In the future, we should consider supporting looking in the prefix's
+ * lib/debug directory for a matching object or supporting an arbitrary user
+ * defined set of places to look.
+ */
+static void
+find_alt_debuglink(file_info_t *fptr, const char *name, uint32_t crc)
+{
+	boolean_t r;
+	char *dup = NULL, *path = NULL, *dname;
+
+	dprintf("find_alt_debug: looking for %s, crc 0x%x\n", name, crc);
+	if (fptr->file_rname == NULL) {
+		dprintf("find_alt_debug: encountered null file_rname\n");
+		return;
+	}
+
+	dup = strdup(fptr->file_rname);
+	if (dup == NULL)
+		return;
+
+	dname = dirname(dup);
+	if (asprintf(&path, "%s/.debug/%s", dname, name) != -1) {
+		dprintf("attempting to load alternate debug information "
+		    "from %s\n", path);
+		r = build_alt_debug(fptr, path, crc, NULL);
+		free(path);
+		if (r == B_TRUE)
+			goto out;
+	}
+
+	if (asprintf(&path, "/usr/lib/debug/%s/%s", dname, name) != -1) {
+		dprintf("attempting to load alternate debug information "
+		    "from %s\n", path);
+		r = build_alt_debug(fptr, path, crc, NULL);
+		free(path);
+		if (r == B_TRUE)
+			goto out;
+	}
+out:
+	free(dup);
+}
+
+/*
  * Build the symbol table for the given mapped file.
  */
 void
@@ -1601,7 +1896,8 @@ Pbuild_file_symtab(struct ps_prochandle *P, file_info_t *fptr)
 		GElf_Shdr c_shdr;
 		Elf_Data *c_data;
 		const char *c_name;
-	} *cp, *cache = NULL, *dyn = NULL, *plt = NULL, *ctf = NULL;
+	} *cp, *cache = NULL, *dyn = NULL, *plt = NULL, *ctf = NULL,
+	*dbglink = NULL, *buildid = NULL;
 
 	if (fptr->file_init)
 		return;	/* We've already processed this file */
@@ -1827,10 +2123,154 @@ Pbuild_file_symtab(struct ps_prochandle *P, file_info_t *fptr)
 				continue;
 			}
 			ctf = cp;
+		} else if (strcmp(cp->c_name, BUILDID_NAME) == 0) {
+			dprintf("Found a %s section for %s\n", BUILDID_NAME,
+			    fptr->file_rname);
+			/* The ElfXX_Nhdr is 32/64-bit neutral */
+			if (cp->c_shdr.sh_type == SHT_NOTE &&
+			    cp->c_data->d_buf != NULL &&
+			    cp->c_data->d_size >= sizeof (Elf32_Nhdr)) {
+				Elf32_Nhdr *hdr = cp->c_data->d_buf;
+				if (hdr->n_type != 3)
+					continue;
+				if (hdr->n_namesz != 4)
+					continue;
+				if (hdr->n_descsz < MINBUILDID)
+					continue;
+				/* Set a reasonable upper bound */
+				if (hdr->n_descsz > MAXBUILDID) {
+					dprintf("Skipped %s as too large "
+					    "(%ld)\n", BUILDID_NAME,
+					    (unsigned long)hdr->n_descsz);
+					continue;
+				}
+
+				if (cp->c_data->d_size < sizeof (hdr) +
+				    hdr->n_namesz + hdr->n_descsz)
+					continue;
+				buildid = cp;
+			}
+		} else if (strcmp(cp->c_name, DBGLINK_NAME) == 0) {
+			dprintf("found %s section for %s\n", DBGLINK_NAME,
+			    fptr->file_rname);
+			/*
+			 * Let's make sure of a few things before we do this.
+			 */
+			if (cp->c_shdr.sh_type == SHT_PROGBITS &&
+			    cp->c_data->d_buf != NULL &&
+			    cp->c_data->d_size) {
+				dbglink = cp;
+			}
 		}
 	}
 
 	/*
+	 * If we haven't found any symbol table information and we have found
+	 * either a .note.gnu.build-id or a .gnu_debuglink, it's time to try and
+	 * figure out where we might find this. Originally, GNU used the
+	 * .gnu_debuglink solely, but then they added a .note.gnu.build-id. The
+	 * build-id is some size, usually 16 or 20 bytes, often a SHA1 sum of
+	 * the old, but not present file. All that you have to do to compare
+	 * things is see if the sections are less, in theory saving you from
+	 * doing lots of expensive I/O.
+	 *
+	 * For the .note.gnu.build-id, we're going to check a few things before
+	 * using it, first that the name is 4 bytes, and is GNU and that the
+	 * type is 3, which they say is the build-id identifier.
+	 *
+	 * To verify that the elf data for the .gnu_debuglink seems somewhat
+	 * sane, eg. the elf data should be a string, so we want to verify we
+	 * have a null-terminator.
+	 */
+	if (fptr->file_symtab.sym_data_pri == NULL && buildid != NULL) {
+		int i, bo;
+		uint8_t *dp;
+		char buf[BUILDID_STRLEN], *path;
+		Elf32_Nhdr *hdr = buildid->c_data->d_buf;
+
+		/*
+		 * This was checked for validity when assigning the buildid
+		 * variable.
+		 */
+		bzero(buf, sizeof (buf));
+		dp = (uint8_t *)((uintptr_t)hdr + sizeof (*hdr) +
+		    hdr->n_namesz);
+		for (i = 0, bo = 0; i < hdr->n_descsz; i++, bo += 2, dp++) {
+			assert(sizeof (buf) - bo > 0);
+
+			/*
+			 * Recall that the build-id is structured as a series of
+			 * bytes. However, the first two characters are supposed
+			 * to represent a directory. Hence, once we reach offset
+			 * two, we insert a '/' character.
+			 */
+			if (bo == 2) {
+				buf[bo] = '/';
+				bo++;
+			}
+			(void) snprintf(buf + bo, sizeof (buf) - bo, "%2x",
+			    *dp);
+		}
+
+		if (asprintf(&path, "/usr/lib/debug/.build-id/%s.debug",
+		    buf) != -1) {
+			boolean_t r;
+			dprintf("attempting to find build id alternate debug "
+			    "file at %s\n", path);
+			r = build_alt_debug(fptr, path, 0, buildid->c_data);
+			dprintf("attempt %s\n", r == B_TRUE ?
+			    "succeeded" : "failed");
+			free(path);
+		} else {
+			dprintf("failed to construct build id path: %s\n",
+			    strerror(errno));
+		}
+	}
+
+	if (fptr->file_symtab.sym_data_pri == NULL && dbglink != NULL) {
+		char *c = dbglink->c_data->d_buf;
+		size_t i;
+		boolean_t found = B_FALSE;
+		Elf_Data *ed = dbglink->c_data;
+		uint32_t crc;
+
+		for (i = 0; i < ed->d_size; i++) {
+			if (c[i] == '\0') {
+				uintptr_t off;
+				dprintf("got .gnu_debuglink terminator at "
+				    "offset %lu\n", (unsigned long)i);
+				/*
+				 * After the null terminator, there should be
+				 * padding, followed by a 4 byte CRC of the
+				 * file. If we don't see this, we're going to
+				 * assume this is bogus.
+				 */
+				if ((i % sizeof (uint32_t)) == 0) {
+					i += 4;
+				} else {
+					i += sizeof (uint32_t) -
+					    (i % sizeof (uint32_t));
+				}
+				if (i + sizeof (uint32_t) ==
+				    dbglink->c_data->d_size) {
+					found = B_TRUE;
+					off = (uintptr_t)ed->d_buf + i;
+					crc = *(uint32_t *)off;
+				} else {
+					dprintf(".gnu_debuglink size mismatch, "
+					    "expected: %lu, found: %lu\n",
+					    (unsigned long)i,
+					    (unsigned long)ed->d_size);
+				}
+				break;
+			}
+		}
+
+		if (found == B_TRUE)
+			find_alt_debuglink(fptr, dbglink->c_data->d_buf, crc);
+	}
+
+	/*
 	 * At this point, we've found all the symbol tables we're ever going
 	 * to find: the ones in the loop above and possibly the symtab that
 	 * was included in the core file. Before we perform any lookups, we
@@ -1957,7 +2397,13 @@ bad:
 		fptr->file_elfmem = NULL;
 	}
 	(void) close(fptr->file_fd);
+	if (fptr->file_dbgelf != NULL)
+		(void) elf_end(fptr->file_dbgelf);
+	fptr->file_dbgelf = NULL;
+	if (fptr->file_dbgfile >= 0)
+		(void) close(fptr->file_dbgfile);
 	fptr->file_fd = -1;
+	fptr->file_dbgfile = -1;
 }
 
 /*
diff --git a/usr/src/lib/librename/Makefile b/usr/src/lib/librename/Makefile
new file mode 100644
index 0000000000..222523d9a1
--- /dev/null
+++ b/usr/src/lib/librename/Makefile
@@ -0,0 +1,44 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include		../Makefile.lib
+
+HDRS =		librename.h
+HDRDIR =	common
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber lint: $(SUBDIRS)
+
+install: 	$(SUBDIRS) $(VARPD_MAPFILES) install_h
+
+install_h: 	$(ROOTHDRS)
+
+check:		$(CHECKHDRS)
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/lib/librename/Makefile.com b/usr/src/lib/librename/Makefile.com
new file mode 100644
index 0000000000..f0a22f25ac
--- /dev/null
+++ b/usr/src/lib/librename/Makefile.com
@@ -0,0 +1,34 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+LIBRARY =	librename.a
+VERS =		.1
+OBJECTS =	librename.o \
+
+include ../../Makefile.lib
+
+LIBS =		$(DYNLIB) $(LINTLIB)
+LDLIBS +=	-lc
+CPPFLAGS +=	-I../common
+
+SRCDIR =	../common
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/librename/amd64/Makefile b/usr/src/lib/librename/amd64/Makefile
new file mode 100644
index 0000000000..15d904c616
--- /dev/null
+++ b/usr/src/lib/librename/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/librename/common/librename.c b/usr/src/lib/librename/common/librename.c
new file mode 100644
index 0000000000..1e198a50a3
--- /dev/null
+++ b/usr/src/lib/librename/common/librename.c
@@ -0,0 +1,229 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Implementation of librename(3RENAME) interfaces.
+ */
+
+#include <librename.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <synch.h>
+
+typedef enum librename_atomic_state {
+	LIBRENAME_ATOMIC_INITIAL = 0x0,
+	LIBRENAME_ATOMIC_FSYNC,
+	LIBRENAME_ATOMIC_RENAME,
+	LIBRENAME_ATOMIC_POSTSYNC,
+	LIBRENAME_ATOMIC_COMPLETED
+} librename_atomic_state_t;
+
+struct librename_atomic {
+	char *lra_fname;			/* RO */
+	char *lra_altname;			/* RO */
+	int lra_dirfd;				/* RO */
+	int lra_tmpfd;				/* RO */
+	mutex_t lra_lock;
+	librename_atomic_state_t lra_state;	/* lra_lock */
+};
+
+int
+librename_atomic_fdinit(int fd, const char *file, const char *prefix,
+    int mode, int flags, librename_atomic_t **outp)
+{
+	int ret;
+	int oflags;
+	librename_atomic_t *lrap;
+	struct stat st;
+
+	if (fd < 0 || file == NULL || outp == NULL)
+		return (EINVAL);
+
+	if (flags & ~(LIBRENAME_ATOMIC_NOUNLINK | LIBRENAME_ATOMIC_CLOEXEC))
+		return (EINVAL);
+
+	if (strchr(file, '/') != NULL)
+		return (EINVAL);
+
+	if (prefix != NULL && strchr(prefix, '/') != NULL)
+		return (EINVAL);
+
+	*outp = NULL;
+	lrap = malloc(sizeof (librename_atomic_t));
+	if (lrap == NULL)
+		return (errno);
+
+	if (fstat(fd, &st) != 0) {
+		ret = errno;
+		free(lrap);
+		return (ret);
+	}
+
+	if (!S_ISDIR(st.st_mode)) {
+		free(lrap);
+		return (ENOTDIR);
+	}
+
+	if ((lrap->lra_dirfd = dup(fd)) == -1) {
+		ret = errno;
+		free(lrap);
+		return (ret);
+	}
+
+
+	lrap->lra_fname = strdup(file);
+	if (lrap->lra_fname == NULL) {
+		ret = errno;
+		if (close(lrap->lra_dirfd) != 0)
+			abort();
+		free(lrap);
+		return (ret);
+	}
+
+	if (prefix == NULL) {
+		ret = asprintf(&lrap->lra_altname, ".%d.%s", (int)getpid(),
+		    file);
+	} else {
+		ret = asprintf(&lrap->lra_altname, "%s%s", prefix, file);
+	}
+	if (ret == -1) {
+		ret = errno;
+		free(lrap->lra_fname);
+		if (close(lrap->lra_dirfd) != 0)
+			abort();
+		free(lrap);
+		return (errno);
+	}
+
+	oflags = O_CREAT | O_TRUNC | O_RDWR | O_NOFOLLOW;
+	if (flags & LIBRENAME_ATOMIC_NOUNLINK)
+		oflags |= O_EXCL;
+
+	if (flags & LIBRENAME_ATOMIC_CLOEXEC)
+		oflags |= O_CLOEXEC;
+
+	lrap->lra_tmpfd = openat(lrap->lra_dirfd, lrap->lra_altname,
+	    oflags, mode);
+	if (lrap->lra_tmpfd < 0) {
+		ret = errno;
+		free(lrap->lra_altname);
+		free(lrap->lra_fname);
+		if (close(lrap->lra_dirfd) != 0)
+			abort();
+		free(lrap);
+		return (ret);
+	}
+
+	if (mutex_init(&lrap->lra_lock, USYNC_THREAD, NULL) != 0)
+		abort();
+
+	lrap->lra_state = LIBRENAME_ATOMIC_INITIAL;
+	*outp = lrap;
+	return (0);
+}
+
+int
+librename_atomic_init(const char *dir, const char *file, const char *prefix,
+    int mode, int flags, librename_atomic_t **outp)
+{
+	int fd, ret;
+
+	if ((fd = open(dir, O_RDONLY)) < 0)
+		return (errno);
+
+	ret = librename_atomic_fdinit(fd, file, prefix, mode, flags, outp);
+	if (close(fd) != 0)
+		abort();
+
+	return (ret);
+}
+
+int
+librename_atomic_fd(librename_atomic_t *lrap)
+{
+	return (lrap->lra_tmpfd);
+}
+
+/*
+ * To atomically commit a file, we need to go through and do the following:
+ *
+ *  o fsync the source
+ *  o run rename
+ *  o fsync the source again and the directory.
+ */
+int
+librename_atomic_commit(librename_atomic_t *lrap)
+{
+	int ret = 0;
+
+	if (mutex_lock(&lrap->lra_lock) != 0)
+		abort();
+	if (lrap->lra_state == LIBRENAME_ATOMIC_COMPLETED) {
+		ret = EINVAL;
+		goto out;
+	}
+
+	if (fsync(lrap->lra_tmpfd) != 0) {
+		ret = errno;
+		goto out;
+	}
+	lrap->lra_state = LIBRENAME_ATOMIC_FSYNC;
+
+	if (renameat(lrap->lra_dirfd, lrap->lra_altname, lrap->lra_dirfd,
+	    lrap->lra_fname) != 0) {
+		ret = errno;
+		goto out;
+	}
+	lrap->lra_state = LIBRENAME_ATOMIC_RENAME;
+
+	if (fsync(lrap->lra_tmpfd) != 0) {
+		ret = errno;
+		goto out;
+	}
+	lrap->lra_state = LIBRENAME_ATOMIC_POSTSYNC;
+
+	if (fsync(lrap->lra_dirfd) != 0) {
+		ret = errno;
+		goto out;
+	}
+	lrap->lra_state = LIBRENAME_ATOMIC_COMPLETED;
+
+out:
+	if (mutex_unlock(&lrap->lra_lock) != 0)
+		abort();
+	return (ret);
+}
+
+void
+librename_atomic_fini(librename_atomic_t *lrap)
+{
+
+	free(lrap->lra_altname);
+	free(lrap->lra_fname);
+	if (close(lrap->lra_tmpfd) != 0)
+		abort();
+	if (close(lrap->lra_dirfd) != 0)
+		abort();
+	if (mutex_destroy(&lrap->lra_lock) != 0)
+		abort();
+	free(lrap);
+}
diff --git a/usr/src/lib/librename/common/librename.h b/usr/src/lib/librename/common/librename.h
new file mode 100644
index 0000000000..cb344f534c
--- /dev/null
+++ b/usr/src/lib/librename/common/librename.h
@@ -0,0 +1,43 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _LIBRENAME_H
+#define	_LIBRENAME_H
+
+/*
+ * librename(3RENAME) public interfaces
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct librename_atomic librename_atomic_t;
+
+#define	LIBRENAME_ATOMIC_NOUNLINK	0x01
+#define	LIBRENAME_ATOMIC_CLOEXEC	0x02
+extern int librename_atomic_init(const char *, const char *, const char *,
+    int, int, librename_atomic_t **);
+extern int librename_atomic_fdinit(int, const char *, const char *, int, int,
+    librename_atomic_t **);
+extern int librename_atomic_fd(librename_atomic_t *);
+extern int librename_atomic_commit(librename_atomic_t *);
+extern void librename_atomic_fini(librename_atomic_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBRENAME_H */
diff --git a/usr/src/lib/librename/common/llib-lrename b/usr/src/lib/librename/common/llib-lrename
new file mode 100644
index 0000000000..6f1dd81a7b
--- /dev/null
+++ b/usr/src/lib/librename/common/llib-lrename
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+#include <librename.h>
diff --git a/usr/src/lib/librename/common/mapfile-vers b/usr/src/lib/librename/common/mapfile-vers
new file mode 100644
index 0000000000..af98188b42
--- /dev/null
+++ b/usr/src/lib/librename/common/mapfile-vers
@@ -0,0 +1,41 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION ILLUMOSprivate {
+    global:
+	librename_atomic_commit;
+	librename_atomic_fd;
+	librename_atomic_fdinit;
+	librename_atomic_fini;
+	librename_atomic_init;
+    local:
+	*;
+};
diff --git a/usr/src/lib/librename/i386/Makefile b/usr/src/lib/librename/i386/Makefile
new file mode 100644
index 0000000000..41e699e8f8
--- /dev/null
+++ b/usr/src/lib/librename/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/librename/sparc/Makefile b/usr/src/lib/librename/sparc/Makefile
new file mode 100644
index 0000000000..41e699e8f8
--- /dev/null
+++ b/usr/src/lib/librename/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/librename/sparcv9/Makefile b/usr/src/lib/librename/sparcv9/Makefile
new file mode 100644
index 0000000000..15d904c616
--- /dev/null
+++ b/usr/src/lib/librename/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libresolv2_joy/Makefile b/usr/src/lib/libresolv2_joy/Makefile
new file mode 100644
index 0000000000..052dfdd092
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/Makefile
@@ -0,0 +1,76 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+#
+
+
+include		../../Makefile.master
+include		../Makefile.lib
+
+$(ROOTSVCMETHOD) :=	FILEMODE = 0555
+
+SUBDIRS=	include $(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET= all
+clean :=	TARGET= clean
+clobber :=	TARGET= clobber
+install :=	TARGET= install
+lint :=		TARGET= lint
+_msg :=		TARGET= _msg
+
+LIBRARY= 	libresolv_joy.a
+TEXT_DOMAIN=	SUNW_OST_OSLIB
+XGETFLAGS=	-a
+POFILE=		$(LIBRARY:.a=.po)
+POFILES=	generic.po
+
+SED=	sed
+GREP=	grep
+
+.KEEP_STATE:
+
+all clean clobber lint: $(SUBDIRS)
+
+install: $(SUBDIRS)
+
+check: $(CHECKHDRS) $(CHKMANIFEST)
+
+_msg:	$(MSGDOMAIN) $(POFILE)
+	$(RM) $(MSGDOMAIN)/$(POFILE)
+	$(CP) $(POFILE) $(MSGDOMAIN)
+
+$(POFILE):	$(POFILES)
+	$(RM) $@
+	$(CAT) $(POFILES) > $@
+
+$(POFILES):
+	$(RM) messages.po
+	$(XGETTEXT) $(XGETFLAGS) *.[ch]* */*.[ch]*
+	$(SED) -e '/^# msg/d' -e '/^domain/d' messages.po > $@
+	$(RM) messages.po
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET); echo
+
+FRC:
+
diff --git a/usr/src/lib/libresolv2_joy/Makefile.com b/usr/src/lib/libresolv2_joy/Makefile.com
new file mode 100644
index 0000000000..bbabcbcede
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/Makefile.com
@@ -0,0 +1,162 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#
+
+LIBRARY= libresolv_joy.a
+VERS= .2
+
+BSDOBJS=   	daemon.o	putenv.o	strcasecmp.o	strsep.o \
+		ftruncate.o	readv.o		strdup.o	strtoul.o \
+		gettimeofday.o	setenv.o	strerror.o	utimes.o \
+		mktemp.o	setitimer.o	strpbrk.o	writev.o
+
+DSTOBJS=	dst_api.o	support.o	hmac_link.o 
+
+# inet_addr, inet_pton, inet_ntop, and inet_ntoa removed due to overlap with 
+# libnsl
+INETOBJS= 	inet_net_pton.o	inet_neta.o	inet_lnaof.o \
+		inet_netof.o 	nsap_addr.o	inet_makeaddr.o	\
+		inet_network.o	inet_net_ntop.o	inet_cidr_ntop.o \
+		inet_cidr_pton.o 		inet_data.o
+
+# build only the IRS objects that the ISC libbind's make would 
+IRSTHROBJS=	gethostent_r.o	getnetent_r.o 	getnetgrent_r.o \
+		getprotoent_r.o	getservent_r.o
+IRSOBJS=	${IRSTHROBJS} \
+		dns.o		dns_ho.o	dns_nw.o	dns_pr.o \
+		dns_sv.o	gai_strerror.o	gen.o		gen_ho.o \
+		gen_ng.o	gen_nw.o	gen_pr.o	gen_sv.o \
+		getaddrinfo.o	gethostent.o	getnameinfo.o	getnetent.o \
+		getnetgrent.o	getprotoent.o	getservent.o 	hesiod.o \
+		irp.o		irp_ho.o	irp_ng.o 	irp_nw.o \
+		irp_pr.o	irp_sv.o	irpmarshall.o	irs_data.o \
+		lcl.o		lcl_ho.o	lcl_ng.o	lcl_nw.o \
+		lcl_pr.o 	lcl_sv.o	nis.o		nul_ng.o \
+		util.o
+
+ISCOBJS=	assertions.o	base64.o	bitncmp.o	ctl_clnt.o \
+		ctl_p.o 	ctl_srvr.o	ev_connects.o	ev_files.o \
+		ev_streams.o	ev_timers.o	ev_waits.o	eventlib.o \
+		heap.o		hex.o 		logging.o	memcluster.o \
+		movefile.o	tree.o
+
+NAMESEROBJS=	ns_date.o	ns_name.o	ns_netint.o	ns_parse.o \
+		ns_print.o	ns_samedomain.o	ns_sign.o	ns_ttl.o \
+		ns_verify.o	ns_rdata.o	ns_newmsg.o
+
+RESOLVOBJS=	herror.o	mtctxres.o	res_comp.o	res_data.o \
+		res_debug.o	res_findzonecut.o		res_init.o \
+		res_mkquery.o	res_mkupdate.o	res_query.o	res_send.o \
+		res_sendsigned.o		res_update.o
+
+SUNWOBJS=	sunw_mtctxres.o	sunw_updrec.o sunw_wrappers.o
+
+OBJECTS=	$(BSDOBJS) $(DSTOBJS) $(INETOBJS) $(IRSOBJS) $(ISCOBJS) \
+		$(NAMESEROBJS) $(RESOLVOBJS) $(SUNWOBJS)
+
+# include library definitions
+include ../../Makefile.lib
+
+# install this library in the root filesystem
+include ../../Makefile.rootfs
+
+# CC -v complains about things we aren't going to change in the ISC code
+CCVERBOSE=
+
+SRCDIR =	../common
+SRCS=		$(BSDOBJS:%.o=../common/bsd/%.c) \
+		$(DSTOBJS:%.o=../common/dst/%.c) \
+		$(INETOBJS:%.o=../common/inet/%.c) \
+		$(IRSOBJS:%.o=../common/irs/%.c) \
+		$(ISCOBJS:%.o=../common/isc/%.c) \
+		$(NAMESEROBJS:%.o=../common/nameser/%.c) \
+		$(RESOLVOBJS:%.o=../common/resolv/%.c) \
+		$(SUNWOBJS:%.o=../common/sunw/%.c)
+
+LIBS =		$(DYNLIB) $(LINTLIB)
+
+$(LINTLIB):= 	SRCS = ../common/llib-lresolv_joy
+
+# Local Libresolv definitions
+
+SOLCOMPAT =	-Dsocket=_socket
+CRYPTFLAGS=	-DHMAC_MD5 -DUSE_MD5
+
+LOCFLAGS +=	$(CRYPTFLAGS)
+LOCFLAGS +=	-D_SYS_STREAM_H -D_REENTRANT -DSVR4 -DSUNW_OPTIONS \
+		$(SOLCOMPAT) -I../include -I../../common/inc
+
+CPPFLAGS +=	$(LOCFLAGS) 
+
+CERRWARN +=	-_gcc=-Wno-implicit-function-declaration
+
+DYNFLAGS +=	$(ZNODELETE)
+
+LDLIBS +=	-lsocket -lnsl -lc -lmd
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+# include library targets
+include ../../Makefile.targ
+
+pics/%.o: ../common/bsd/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/dst/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/inet/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/irs/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/isc/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/nameser/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/resolv/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/sunw/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+# install rule for lint library target
+$(ROOTLINTDIR)/%:	../common/%
+	$(INS.file)
diff --git a/usr/src/lib/libresolv2_joy/THIRDPARTYLICENSE b/usr/src/lib/libresolv2_joy/THIRDPARTYLICENSE
new file mode 100644
index 0000000000..719d77fea2
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/THIRDPARTYLICENSE
@@ -0,0 +1,185 @@
+ * Copyright (c) 1995-1999 by Internet Software Consortium.
+ *  
+ * Permission to use, copy, modify, and distribute this software for any  
+ * purpose with or without fee is hereby granted, provided that the above  
+ * copyright notice and this permission notice appear in all copies.  
+ *  
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+
+ * Portions Copyright (c) 1995 by International Business Machines, Inc.  
+ *  
+ * International Business Machines, Inc.  (hereinafter called IBM) grants  
+ * permission under its copyrights to use, copy, modify, and distribute this  
+ * Software with or without fee, provided that the above copyright notice and
+ * all paragraphs of this notice appear in all copies, and that the name of IBM
+ * not be used in connection with the marketing of any product incorporating  
+ * the Software or modifications thereof, without specific, written prior  
+ * permission.  
+ *  
+ * To the extent it has a right to do so, IBM grants an immunity from suit  
+ * under its patents, if any, for the use, sale or manufacture of products to
+ * the extent that such products are used for performing Domain Name System  
+ * dynamic updates in TCP/IP networks by means of the Software. No immunity is
+ * granted for any product per se or for any other function of any product.  
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,  
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A  
+ * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,  
+ * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+ * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.  
+
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.  
+ *  
+ * Permission to use, copy, modify, and distribute this software for any 
+ * purpose with or without fee is hereby granted, provided that the above  
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or  
+ * publicity pertaining to distribution of the document or software without  
+ * specific, written prior permission.  
+ *  
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT  
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL  
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR  
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS  
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.  
+
+ * Copyright (c) 1983, 1990, 1993  
+ * The Regents of the University of California. All rights reserved.  
+ *  
+ * Redistribution and use in source and binary forms, with or without  
+ * modification, are permitted provided that the following conditions  
+ * are met:  
+ * 1. Redistributions of source code must retain the above copyright  
+ *    notice, this list of conditions and the following disclaimer.  
+ * 2. Redistributions in binary form must reproduce the above copyright  
+ *    notice, this list of conditions and the following disclaimer in the  
+ *    documentation and/or other materials provided with the distribution.  
+ * 3. All advertising materials mentioning features or use of this software  
+ *    must display the following acknowledgement:  
+ *      This product includes software developed by the University of  
+ *      California, Berkeley and its contributors.  
+ * 4. Neither the name of the University nor the names of its contributors  
+ *    may be used to endorse or promote products derived from this software  
+ *    without specific prior written permission.  
+ *  
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND  
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE  
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS  
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)  
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY  
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF  
+ * SUCH DAMAGE.  
+
+/* Copyright (C) RSA Data Security, Inc. created 1986-1987, 1990,
+   1992-1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+                    DNSSAFE LICENSE TERMS
+
+ This BIND software includes the DNSsafe software from RSA Data
+ Security, Inc., which is copyrighted software that can only be
+ distributed under the terms of this license agreement.
+
+ The DNSsafe software cannot be used or distributed separately from the
+ BIND software.  You only have the right to use it or distribute it as
+ a bundled, integrated product.
+
+ The DNSsafe software can ONLY be used to provide authentication for
+ resource records in the Domain Name System, as specified in RFC 2065
+ and successors.  You cannot modify the BIND software to use the
+ DNSsafe software for other purposes, or to make its cryptographic
+ functions available to end-users for other uses.
+
+ If you modify the DNSsafe software itself, you cannot modify its
+ documented API, and you must grant RSA Data Security the right to use,
+ modify, and distribute your modifications, including the right to use
+ any patents or other intellectual property that your modifications
+ depend upon.
+
+ You must not remove, alter, or destroy any of RSA's copyright notices
+ or license information.  When distributing the software to the Federal
+ Government, it must be licensed to them as "commercial computer
+ software" protected under 48 CFR 12.212 of the FAR, or 48 CFR
+ 227.7202.1 of the DFARS.
+
+ You must not violate United States export control laws by distributing
+ the DNSsafe software or information about it, when such distribution
+ is prohibited by law.
+
+ THE DNSSAFE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY
+ WHATSOEVER.  RSA HAS NO OBLIGATION TO SUPPORT, CORRECT, UPDATE OR
+ MAINTAIN THE RSA SOFTWARE.  RSA DISCLAIMS ALL WARRANTIES, EXPRESS,
+ IMPLIED OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING ALL
+ IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+ PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS.
+
+ If you desire to use DNSsafe in ways that these terms do not permit,
+ please contact RSA Data Security, Inc., 100 Marine Parkway, Redwood
+ City, California 94065, USA, to discuss alternate licensing
+ arrangements.
+
+ * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
+ *
+ * Permission to use, copy modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL
+ * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
+
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    This product includes software developed by WIDE Project and
+ *    its contributors.
+ * 4. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
diff --git a/usr/src/lib/libresolv2_joy/THIRDPARTYLICENSE.descrip b/usr/src/lib/libresolv2_joy/THIRDPARTYLICENSE.descrip
new file mode 100644
index 0000000000..67315d8f33
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/THIRDPARTYLICENSE.descrip
@@ -0,0 +1 @@
+BIND SOFTWARE
diff --git a/usr/src/lib/libresolv2_joy/amd64/Makefile b/usr/src/lib/libresolv2_joy/amd64/Makefile
new file mode 100644
index 0000000000..2e8cdecf75
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/amd64/Makefile
@@ -0,0 +1,31 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64)
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/daemon.c b/usr/src/lib/libresolv2_joy/common/bsd/daemon.c
new file mode 100644
index 0000000000..54ff83b753
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/daemon.c
@@ -0,0 +1,81 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)daemon.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: daemon.c,v 1.2 2005/04/27 04:56:10 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "port_before.h"
+
+#include <fcntl.h>
+#include <paths.h>
+#include <unistd.h>
+
+#include "port_after.h"
+
+#ifndef NEED_DAEMON
+int __bind_daemon__;
+#else
+
+int
+daemon(int nochdir, int noclose) {
+	int fd;
+
+	switch (fork()) {
+	case -1:
+		return (-1);
+	case 0:
+		break;
+	default:
+		_exit(0);
+	}
+
+	if (setsid() == -1)
+		return (-1);
+
+	if (!nochdir)
+		(void)chdir("/");
+
+	if (!noclose && (fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
+		(void)dup2(fd, STDIN_FILENO);
+		(void)dup2(fd, STDOUT_FILENO);
+		(void)dup2(fd, STDERR_FILENO);
+		if (fd > 2)
+			(void)close (fd);
+	}
+	return (0);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/ftruncate.c b/usr/src/lib/libresolv2_joy/common/bsd/ftruncate.c
new file mode 100644
index 0000000000..5ac4ebac9b
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/ftruncate.c
@@ -0,0 +1,64 @@
+#ifndef LINT
+static const char rcsid[] = "$Id: ftruncate.c,v 1.3 2005/04/27 18:16:45 sra Exp $";
+#endif
+
+/*! \file
+ * \brief
+ * ftruncate - set file size, BSD Style
+ *
+ * shortens or enlarges the file as neeeded
+ * uses some undocumented locking call. It is known to work on SCO unix,
+ * other vendors should try.
+ * The #error directive prevents unsupported OSes
+ */
+
+#include "port_before.h"
+
+#if defined(M_UNIX)
+#define OWN_FTRUNCATE
+#include <stdio.h>
+#ifdef _XOPEN_SOURCE
+#undef _XOPEN_SOURCE
+#endif
+#ifdef _POSIX_SOURCE
+#undef _POSIX_SOURCE
+#endif
+
+#include <fcntl.h>
+
+#include "port_after.h"
+
+int
+__ftruncate(int fd, long wantsize) {
+	long cursize;
+
+	/* determine current file size */
+	if ((cursize = lseek(fd, 0L, 2)) == -1)
+		return (-1);
+
+	/* maybe lengthen... */
+	if (cursize < wantsize) {
+		if (lseek(fd, wantsize - 1, 0) == -1 ||
+		    write(fd, "", 1) == -1) {
+			return (-1);
+		}
+		return (0);
+	}
+
+	/* maybe shorten... */
+	if (wantsize < cursize) {
+		struct flock fl;
+
+		fl.l_whence = 0;
+		fl.l_len = 0;
+		fl.l_start = wantsize;
+		fl.l_type = F_WRLCK;
+		return (fcntl(fd, F_FREESP, &fl));
+	}
+	return (0);
+}
+#endif
+
+#ifndef OWN_FTRUNCATE
+int __bindcompat_ftruncate;
+#endif
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/gettimeofday.c b/usr/src/lib/libresolv2_joy/common/bsd/gettimeofday.c
new file mode 100644
index 0000000000..2926a3575e
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/gettimeofday.c
@@ -0,0 +1,62 @@
+#ifndef LINT
+static const char rcsid[] = "$Id: gettimeofday.c,v 1.4 2005/04/27 04:56:11 sra Exp $";
+#endif
+
+#include "port_before.h"
+#include <stdio.h>
+#include <syslog.h>
+#include <sys/time.h>
+#include "port_after.h"
+
+#if !defined(NEED_GETTIMEOFDAY)
+/*%
+ * gettimeofday() occasionally returns invalid tv_usec on some platforms.
+ */
+#define MILLION 1000000
+#undef gettimeofday
+
+int
+isc__gettimeofday(struct timeval *tp, struct timezone *tzp) {
+	int res;
+
+	res = gettimeofday(tp, tzp);
+	if (res < 0)
+		return (res);
+	if (tp == NULL)
+		return (res);
+	if (tp->tv_usec < 0) {
+		do {
+			tp->tv_usec += MILLION;
+			tp->tv_sec--;
+		} while (tp->tv_usec < 0);
+		goto log;
+	} else if (tp->tv_usec > MILLION) {
+		do {
+			tp->tv_usec -= MILLION;
+			tp->tv_sec++;
+		} while (tp->tv_usec > MILLION);
+		goto log;
+	}
+	return (res);
+ log:
+	syslog(LOG_ERR, "gettimeofday: tv_usec out of range\n");
+	return (res);
+}
+#else
+int
+gettimeofday(struct timeval *tvp, struct _TIMEZONE *tzp) {
+	time_t clock, time(time_t *);
+
+	if (time(&clock) == (time_t) -1)
+		return (-1);
+	if (tvp) {
+		tvp->tv_sec = clock;
+		tvp->tv_usec = 0;
+	}
+	if (tzp) {
+		tzp->tz_minuteswest = 0;
+		tzp->tz_dsttime = 0;
+	}
+	return (0);
+}
+#endif /*NEED_GETTIMEOFDAY*/
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/mktemp.c b/usr/src/lib/libresolv2_joy/common/bsd/mktemp.c
new file mode 100644
index 0000000000..001b24b58f
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/mktemp.c
@@ -0,0 +1,156 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)mktemp.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: mktemp.c,v 1.2 2005/04/27 04:56:11 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1987, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+
+#include "port_after.h"
+
+#if (!defined(NEED_MKTEMP)) && (!defined(NEED_MKSTEMP))
+int __mktemp_unneeded__;
+#else
+
+static int gettemp(char *path, int *doopen);
+
+#ifdef NEED_MKSTEMP
+mkstemp(char *path) {
+	int fd;
+
+	return (gettemp(path, &fd) ? fd : -1);
+}
+#endif
+
+#ifdef NEED_MKTEMP
+char *
+mktemp(char *path) {
+	return(gettemp(path, (int *)NULL) ? path : (char *)NULL);
+}
+#endif
+
+static int
+gettemp(char *path, int *doopen) {
+	char *start, *trv;
+	struct stat sbuf;
+	u_int pid;
+
+	pid = getpid();
+	for (trv = path; *trv; ++trv);		/*%< extra X's get set to 0's */
+	while (*--trv == 'X') {
+		*trv = (pid % 10) + '0';
+		pid /= 10;
+	}
+
+	/*
+	 * check the target directory; if you have six X's and it
+	 * doesn't exist this runs for a *very* long time.
+	 */
+	for (start = trv + 1;; --trv) {
+		if (trv <= path)
+			break;
+		if (*trv == '/') {
+			*trv = '\0';
+			if (stat(path, &sbuf))
+				return(0);
+			if (!S_ISDIR(sbuf.st_mode)) {
+				errno = ENOTDIR;
+				return(0);
+			}
+			*trv = '/';
+			break;
+		}
+	}
+
+	for (;;) {
+		if (doopen) {
+			if ((*doopen =
+			    open(path, O_CREAT|O_EXCL|O_RDWR, 0600)) >= 0)
+				return(1);
+			if (errno != EEXIST)
+				return(0);
+		}
+		else if (stat(path, &sbuf))
+			return(errno == ENOENT ? 1 : 0);
+
+		/* tricky little algorithm for backward compatibility */
+		for (trv = start;;) {
+			if (!*trv)
+				return(0);
+			if (*trv == 'z')
+				*trv++ = 'a';
+			else {
+				if (isdigit(*trv))
+					*trv = 'a';
+				else
+					++*trv;
+				break;
+			}
+		}
+	}
+	/*NOTREACHED*/
+}
+
+#endif /*NEED_MKTEMP*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/putenv.c b/usr/src/lib/libresolv2_joy/common/bsd/putenv.c
new file mode 100644
index 0000000000..2dcbc57e6c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/putenv.c
@@ -0,0 +1,27 @@
+#ifndef LINT
+static const char rcsid[] = "$Id: putenv.c,v 1.2 2005/04/27 04:56:11 sra Exp $";
+#endif
+
+#include "port_before.h"
+#include "port_after.h"
+
+/*%
+ * To give a little credit to Sun, SGI,
+ * and many vendors in the SysV world.
+ */
+
+#if !defined(NEED_PUTENV)
+int __bindcompat_putenv;
+#else
+int
+putenv(char *str) {
+	char *tmp;
+
+	for (tmp = str; *tmp && (*tmp != '='); tmp++)
+		;
+
+	return (setenv(str, tmp, 1));
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/readv.c b/usr/src/lib/libresolv2_joy/common/bsd/readv.c
new file mode 100644
index 0000000000..5fa691a92f
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/readv.c
@@ -0,0 +1,39 @@
+#ifndef LINT
+static const char rcsid[] = "$Id: readv.c,v 1.2 2005/04/27 04:56:11 sra Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+
+#include "port_after.h"
+
+#ifndef NEED_READV
+int __bindcompat_readv;
+#else
+
+int
+__readv(fd, vp, vpcount)
+	int fd;
+	const struct iovec *vp;
+	int vpcount;
+{
+	int count = 0;
+
+	while (vpcount-- > 0) {
+		int bytes = read(fd, vp->iov_base, vp->iov_len);
+
+		if (bytes < 0)
+			return (-1);
+		count += bytes;
+		if (bytes != vp->iov_len)
+			break;
+		vp++;
+	}
+	return (count);
+}
+#endif /* NEED_READV */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/setenv.c b/usr/src/lib/libresolv2_joy/common/bsd/setenv.c
new file mode 100644
index 0000000000..baf00f6ff2
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/setenv.c
@@ -0,0 +1,151 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)setenv.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: setenv.c,v 1.2 2005/04/27 04:56:11 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1987, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "port_before.h"
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "port_after.h"
+
+#if !defined(NEED_SETENV)
+int __bindcompat_setenv;
+#else
+
+extern char **environ;
+
+static char *findenv(const char *name, int *offset);
+
+/*%
+ * setenv --
+ *	Set the value of the environmental variable "name" to be
+ *	"value".  If rewrite is set, replace any current value.
+ */
+setenv(const char *name, const char *value, int rewrite) {
+	extern char **environ;
+	static int alloced;			/*%< if allocated space before */
+	char *c;
+	int l_value, offset;
+
+	if (*value == '=')			/*%< no `=' in value */
+		++value;
+	l_value = strlen(value);
+	if ((c = findenv(name, &offset))) {	/*%< find if already exists */
+		if (!rewrite)
+			return (0);
+		if (strlen(c) >= l_value) {	/*%< old larger; copy over */
+			while (*c++ = *value++);
+			return (0);
+		}
+	} else {					/*%< create new slot */
+		int cnt;
+		char **p;
+
+		for (p = environ, cnt = 0; *p; ++p, ++cnt);
+		if (alloced) {			/*%< just increase size */
+			environ = (char **)realloc((char *)environ,
+			    (size_t)(sizeof(char *) * (cnt + 2)));
+			if (!environ)
+				return (-1);
+		}
+		else {				/*%< get new space */
+			alloced = 1;		/*%< copy old entries into it */
+			p = malloc((size_t)(sizeof(char *) * (cnt + 2)));
+			if (!p)
+				return (-1);
+			memcpy(p, environ, cnt * sizeof(char *));
+			environ = p;
+		}
+		environ[cnt + 1] = NULL;
+		offset = cnt;
+	}
+	for (c = (char *)name; *c && *c != '='; ++c);	/*%< no `=' in name */
+	if (!(environ[offset] =			/*%< name + `=' + value */
+	    malloc((size_t)((int)(c - name) + l_value + 2))))
+		return (-1);
+	for (c = environ[offset]; (*c = *name++) && *c != '='; ++c);
+	for (*c++ = '='; *c++ = *value++;);
+	return (0);
+}
+
+/*%
+ * unsetenv(name) --
+ *	Delete environmental variable "name".
+ */
+void
+unsetenv(const char *name) {
+	char **p;
+	int offset;
+
+	while (findenv(name, &offset))	/*%< if set multiple times */
+		for (p = &environ[offset];; ++p)
+			if (!(*p = *(p + 1)))
+				break;
+}
+
+/*%
+ * findenv --
+ *	Returns pointer to value associated with name, if any, else NULL.
+ *	Sets offset to be the offset of the name/value combination in the
+ *	environmental array, for use by setenv(3) and unsetenv(3).
+ *	Explicitly removes '=' in argument name.
+ *
+ *	This routine *should* be a static; don't use it.
+ */
+static char *
+findenv(const char *name, int *offset) {
+	const char *np;
+	char **p, *c;
+	int len;
+
+	if (name == NULL || environ == NULL)
+		return (NULL);
+	for (np = name; *np && *np != '='; ++np)
+		continue;
+	len = np - name;
+	for (p = environ; (c = *p) != NULL; ++p)
+		if (strncmp(c, name, len) == 0 && c[len] == '=') {
+			*offset = p - environ;
+			return (c + len + 1);
+		}
+	return (NULL);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/setitimer.c b/usr/src/lib/libresolv2_joy/common/bsd/setitimer.c
new file mode 100644
index 0000000000..67881d7ca8
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/setitimer.c
@@ -0,0 +1,29 @@
+#ifndef LINT
+static const char rcsid[] = "$Id: setitimer.c,v 1.2 2005/04/27 04:56:12 sra Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/time.h>
+
+#include "port_after.h"
+
+/*%
+ * Setitimer emulation routine.
+ */
+#ifndef NEED_SETITIMER
+int __bindcompat_setitimer;
+#else
+
+int
+__setitimer(int which, const struct itimerval *value,
+	    struct itimerval *ovalue)
+{
+	if (alarm(value->it_value.tv_sec) >= 0)
+		return (0);
+	else
+		return (-1);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/strcasecmp.c b/usr/src/lib/libresolv2_joy/common/bsd/strcasecmp.c
new file mode 100644
index 0000000000..0c9f0dccf0
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/strcasecmp.c
@@ -0,0 +1,124 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)strcasecmp.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: strcasecmp.c,v 1.2 2005/04/27 04:56:12 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1987, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/cdefs.h>
+
+#include <string.h>
+
+#include "port_after.h"
+
+#ifndef NEED_STRCASECMP
+int __strcasecmp_unneeded__;
+#else
+
+/*%
+ * This array is designed for mapping upper and lower case letter
+ * together for a case independent comparison.  The mappings are
+ * based upon ascii character sequences.
+ */
+static const u_char charmap[] = {
+	0000, 0001, 0002, 0003, 0004, 0005, 0006, 0007,
+	0010, 0011, 0012, 0013, 0014, 0015, 0016, 0017,
+	0020, 0021, 0022, 0023, 0024, 0025, 0026, 0027,
+	0030, 0031, 0032, 0033, 0034, 0035, 0036, 0037,
+	0040, 0041, 0042, 0043, 0044, 0045, 0046, 0047,
+	0050, 0051, 0052, 0053, 0054, 0055, 0056, 0057,
+	0060, 0061, 0062, 0063, 0064, 0065, 0066, 0067,
+	0070, 0071, 0072, 0073, 0074, 0075, 0076, 0077,
+	0100, 0141, 0142, 0143, 0144, 0145, 0146, 0147,
+	0150, 0151, 0152, 0153, 0154, 0155, 0156, 0157,
+	0160, 0161, 0162, 0163, 0164, 0165, 0166, 0167,
+	0170, 0171, 0172, 0133, 0134, 0135, 0136, 0137,
+	0140, 0141, 0142, 0143, 0144, 0145, 0146, 0147,
+	0150, 0151, 0152, 0153, 0154, 0155, 0156, 0157,
+	0160, 0161, 0162, 0163, 0164, 0165, 0166, 0167,
+	0170, 0171, 0172, 0173, 0174, 0175, 0176, 0177,
+	0200, 0201, 0202, 0203, 0204, 0205, 0206, 0207,
+	0210, 0211, 0212, 0213, 0214, 0215, 0216, 0217,
+	0220, 0221, 0222, 0223, 0224, 0225, 0226, 0227,
+	0230, 0231, 0232, 0233, 0234, 0235, 0236, 0237,
+	0240, 0241, 0242, 0243, 0244, 0245, 0246, 0247,
+	0250, 0251, 0252, 0253, 0254, 0255, 0256, 0257,
+	0260, 0261, 0262, 0263, 0264, 0265, 0266, 0267,
+	0270, 0271, 0272, 0273, 0274, 0275, 0276, 0277,
+	0300, 0301, 0302, 0303, 0304, 0305, 0306, 0307,
+	0310, 0311, 0312, 0313, 0314, 0315, 0316, 0317,
+	0320, 0321, 0322, 0323, 0324, 0325, 0326, 0327,
+	0330, 0331, 0332, 0333, 0334, 0335, 0336, 0337,
+	0340, 0341, 0342, 0343, 0344, 0345, 0346, 0347,
+	0350, 0351, 0352, 0353, 0354, 0355, 0356, 0357,
+	0360, 0361, 0362, 0363, 0364, 0365, 0366, 0367,
+	0370, 0371, 0372, 0373, 0374, 0375, 0376, 0377
+};
+
+int
+strcasecmp(const char *s1, const char *s2) {
+	const u_char *cm = charmap,
+		     *us1 = (const u_char *)s1,
+		     *us2 = (const u_char *)s2;
+
+	while (cm[*us1] == cm[*us2++])
+		if (*us1++ == '\0')
+			return (0);
+	return (cm[*us1] - cm[*--us2]);
+}
+
+int
+strncasecmp(const char *s1, const char *s2, size_t n) {
+	if (n != 0) {
+		const u_char *cm = charmap,
+			     *us1 = (const u_char *)s1,
+			     *us2 = (const u_char *)s2;
+
+		do {
+			if (cm[*us1] != cm[*us2++])
+				return (cm[*us1] - cm[*--us2]);
+			if (*us1++ == '\0')
+				break;
+		} while (--n != 0);
+	}
+	return (0);
+}
+
+#endif /*NEED_STRCASECMP*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/strdup.c b/usr/src/lib/libresolv2_joy/common/bsd/strdup.c
new file mode 100644
index 0000000000..a8d31e9587
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/strdup.c
@@ -0,0 +1,20 @@
+#include "port_before.h"
+
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#ifndef NEED_STRDUP
+int __bind_strdup_unneeded;
+#else
+char *
+strdup(const char *src) {
+	char *dst = malloc(strlen(src) + 1);
+
+	if (dst)
+		strcpy(dst, src);
+	return (dst);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/strerror.c b/usr/src/lib/libresolv2_joy/common/bsd/strerror.c
new file mode 100644
index 0000000000..5973e63d5b
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/strerror.c
@@ -0,0 +1,94 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)strerror.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: strerror.c,v 1.6 2008/02/18 03:49:08 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1988, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/types.h>
+
+#include <string.h>
+
+#include "port_after.h"
+
+#ifndef NEED_STRERROR
+int __strerror_unneeded__;
+#else
+
+#ifdef USE_SYSERROR_LIST
+extern int sys_nerr;
+extern char *sys_errlist[];
+#endif
+
+const char *
+isc_strerror(int num) {
+#define	UPREFIX	"Unknown error: "
+	static char ebuf[40] = UPREFIX;		/*%< 64-bit number + slop */
+	u_int errnum;
+	char *p, *t;
+#ifndef USE_SYSERROR_LIST
+	const char *ret;
+#endif
+	char tmp[40];
+
+	errnum = num;				/*%< convert to unsigned */
+#ifdef USE_SYSERROR_LIST
+	if (errnum < (u_int)sys_nerr)
+		return (sys_errlist[errnum]);
+#else
+#undef strerror
+	ret = strerror(num);			/*%< call strerror() in libc */
+	if (ret != NULL)
+		return(ret);
+#endif
+
+	/* Do this by hand, so we don't include stdio(3). */
+	t = tmp;
+	do {
+		*t++ = "0123456789"[errnum % 10];
+	} while (errnum /= 10);
+	for (p = ebuf + sizeof(UPREFIX) - 1;;) {
+		*p++ = *--t;
+		if (t <= tmp)
+			break;
+	}
+	return (ebuf);
+}
+
+#endif /*NEED_STRERROR*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/strpbrk.c b/usr/src/lib/libresolv2_joy/common/bsd/strpbrk.c
new file mode 100644
index 0000000000..4c12d88e1c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/strpbrk.c
@@ -0,0 +1,70 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)strpbrk.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: strpbrk.c,v 1.2 2005/04/27 04:56:12 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1985, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/cdefs.h>
+
+#include <string.h>
+
+#include "port_after.h"
+
+#ifndef NEED_STRPBRK
+int __strpbrk_unneeded__;
+#else
+
+/*%
+ * Find the first occurrence in s1 of a character in s2 (excluding NUL).
+ */
+char *
+strpbrk(const char *s1, const char *s2) {
+	const char *scanp;
+	int c, sc;
+
+	while ((c = *s1++) != 0) {
+		for (scanp = s2; (sc = *scanp++) != 0;)
+			if (sc == c)
+				return ((char *)(s1 - 1));
+	}
+	return (NULL);
+}
+
+#endif /*NEED_STRPBRK*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/strsep.c b/usr/src/lib/libresolv2_joy/common/bsd/strsep.c
new file mode 100644
index 0000000000..c7969f0028
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/strsep.c
@@ -0,0 +1,88 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "strsep.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: strsep.c,v 1.2 2005/04/27 04:56:12 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "port_before.h"
+#include <sys/cdefs.h>
+#include <string.h>
+#include <stdio.h>
+#include "port_after.h"
+
+#ifndef NEED_STRSEP
+int __strsep_unneeded__;
+#else
+
+/*%
+ * Get next token from string *stringp, where tokens are possibly-empty
+ * strings separated by characters from delim.  
+ *
+ * Writes NULs into the string at *stringp to end tokens.
+ * delim need not remain constant from call to call.
+ * On return, *stringp points past the last NUL written (if there might
+ * be further tokens), or is NULL (if there are definitely no more tokens).
+ *
+ * If *stringp is NULL, strsep returns NULL.
+ */
+char *
+strsep(char **stringp, const char *delim) {
+	char *s;
+	const char *spanp;
+	int c, sc;
+	char *tok;
+
+	if ((s = *stringp) == NULL)
+		return (NULL);
+	for (tok = s;;) {
+		c = *s++;
+		spanp = delim;
+		do {
+			if ((sc = *spanp++) == c) {
+				if (c == 0)
+					s = NULL;
+				else
+					s[-1] = 0;
+				*stringp = s;
+				return (tok);
+			}
+		} while (sc != 0);
+	}
+	/* NOTREACHED */
+}
+
+#endif /*NEED_STRSEP*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/strtoul.c b/usr/src/lib/libresolv2_joy/common/bsd/strtoul.c
new file mode 100644
index 0000000000..b37ff72729
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/strtoul.c
@@ -0,0 +1,119 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)strtoul.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: strtoul.c,v 1.4 2008/02/18 03:49:08 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*
+ * Copyright (c) 1990, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#ifndef NEED_STRTOUL
+int __strtoul_unneeded__;
+#else
+
+/*%
+ * Convert a string to an unsigned long integer.
+ *
+ * Ignores `locale' stuff.  Assumes that the upper and lower case
+ * alphabets and digits are each contiguous.
+ */
+u_long
+strtoul(const char *nptr, char **endptr, int base) {
+	const char *s = nptr;
+	u_long acc, cutoff;
+	int neg, c, any, cutlim;
+
+	neg = 0;
+
+	/*
+	 * See strtol for comments as to the logic used.
+	 */
+	do {
+		c = *(const unsigned char *)s++;
+	} while (isspace(c));
+	if (c == '-') {
+		neg = 1;
+		c = *s++;
+	} else if (c == '+')
+		c = *s++;
+	if ((base == 0 || base == 16) &&
+	    c == '0' && (*s == 'x' || *s == 'X')) {
+		c = s[1];
+		s += 2;
+		base = 16;
+	}
+	if (base == 0)
+		base = c == '0' ? 8 : 10;
+	cutoff = (u_long)ULONG_MAX / (u_long)base;
+	cutlim = (u_long)ULONG_MAX % (u_long)base;
+	for (acc = 0, any = 0;; c = *(const unsigned char*)s++) {
+		if (isdigit(c))
+			c -= '0';
+		else if (isalpha(c))
+			c -= isupper(c) ? 'A' - 10 : 'a' - 10;
+		else
+			break;
+		if (c >= base)
+			break;
+		if (any < 0 || acc > cutoff || (acc == cutoff && c > cutlim))
+			any = -1;
+		else {
+			any = 1;
+			acc *= base;
+			acc += c;
+		}
+	}
+	if (any < 0) {
+		acc = ULONG_MAX;
+		errno = ERANGE;
+	} else if (neg)
+		acc = -acc;
+	if (endptr != 0)
+		DE_CONST((any ? s - 1 : nptr), *endptr);
+	return (acc);
+}
+
+#endif /*NEED_STRTOUL*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/utimes.c b/usr/src/lib/libresolv2_joy/common/bsd/utimes.c
new file mode 100644
index 0000000000..2f65cffe25
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/utimes.c
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1997,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <utime.h>
+
+#include "port_after.h"
+
+#ifndef NEED_UTIMES
+int __bind_utimes_unneeded;
+#else
+
+int
+__utimes(char *filename, struct timeval *tvp) {
+	struct utimbuf utb;
+
+	utb.actime = (time_t)tvp[0].tv_sec;
+	utb.modtime = (time_t)tvp[1].tv_sec;
+	return (utime(filename, &utb));
+}
+
+#endif /* NEED_UTIMES */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/bsd/writev.c b/usr/src/lib/libresolv2_joy/common/bsd/writev.c
new file mode 100644
index 0000000000..65baa71cfc
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/bsd/writev.c
@@ -0,0 +1,89 @@
+#ifndef LINT
+static const char rcsid[] = "$Id: writev.c,v 1.3 2005/04/27 04:56:13 sra Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+
+#include "port_after.h"
+
+#ifndef NEED_WRITEV
+int __bindcompat_writev;
+#else
+
+#ifdef _CRAY
+#define OWN_WRITEV
+int
+__writev(int fd, struct iovec *iov, int iovlen)
+{
+	struct stat statbuf;
+
+	if (fstat(fd, &statbuf) < 0)
+		return (-1);
+
+	/*
+	 * Allow for atomic writes to network.
+	 */
+	if (statbuf.st_mode & S_IFSOCK) {
+		struct msghdr   mesg;		
+
+		memset(&mesg, 0, sizeof(mesg));
+		mesg.msg_name = 0;
+		mesg.msg_namelen = 0;
+		mesg.msg_iov = iov;
+		mesg.msg_iovlen = iovlen;
+		mesg.msg_accrights = 0;
+		mesg.msg_accrightslen = 0;
+		return (sendmsg(fd, &mesg, 0));
+	} else {
+		struct iovec *tv;
+		int i, rcode = 0, count = 0;
+
+		for (i = 0, tv = iov; i <= iovlen; tv++) {
+			rcode = write(fd, tv->iov_base, tv->iov_len);
+
+			if (rcode < 0)
+				break;
+
+			count += rcode;
+		}
+
+		if (count == 0)
+			return (rcode);
+		else
+			return (count);
+	}
+}
+
+#else /*_CRAY*/
+
+int
+__writev(fd, vp, vpcount)
+	int fd;
+	const struct iovec *vp;
+	int vpcount;
+{
+	int count = 0;
+
+	while (vpcount-- > 0) {
+		int written = write(fd, vp->iov_base, vp->iov_len);
+
+		if (written < 0)
+			return (-1);
+		count += written;
+		if (written != vp->iov_len)
+			break;
+		vp++;
+	}
+	return (count);
+}
+
+#endif /*_CRAY*/
+
+#endif /*NEED_WRITEV*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/dst/dst_api.c b/usr/src/lib/libresolv2_joy/common/dst/dst_api.c
new file mode 100644
index 0000000000..a3e48077ad
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/dst/dst_api.c
@@ -0,0 +1,1048 @@
+#ifndef LINT
+static const char rcsid[] = "$Header: /proj/cvs/prod/libbind/dst/dst_api.c,v 1.17 2007/09/24 17:18:25 each Exp $";
+#endif
+
+/*
+ * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
+ *
+ * Permission to use, copy modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL
+ * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
+ */
+/*
+ * This file contains the interface between the DST API and the crypto API.
+ * This is the only file that needs to be changed if the crypto system is
+ * changed.  Exported functions are:
+ * void dst_init()	 Initialize the toolkit
+ * int  dst_check_algorithm()   Function to determines if alg is suppored.
+ * int  dst_compare_keys()      Function to compare two keys for equality.
+ * int  dst_sign_data()         Incremental signing routine.
+ * int  dst_verify_data()       Incremental verify routine.
+ * int  dst_generate_key()      Function to generate new KEY
+ * DST_KEY *dst_read_key()      Function to retrieve private/public KEY.
+ * void dst_write_key()         Function to write out a key.
+ * DST_KEY *dst_dnskey_to_key() Function to convert DNS KEY RR to a DST
+ *				KEY structure.
+ * int dst_key_to_dnskey() 	Function to return a public key in DNS 
+ *				format binary
+ * DST_KEY *dst_buffer_to_key() Converst a data in buffer to KEY
+ * int *dst_key_to_buffer()	Writes out DST_KEY key matterial in buffer
+ * void dst_free_key()       	Releases all memory referenced by key structure
+ */
+
+#include "port_before.h"
+#include <stdio.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <memory.h>
+#include <ctype.h>
+#include <time.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include "dst_internal.h"
+#include "port_after.h"
+
+/* static variables */
+static int done_init = 0;
+dst_func *dst_t_func[DST_MAX_ALGS];
+const char *key_file_fmt_str = "Private-key-format: v%s\nAlgorithm: %d (%s)\n";
+const char *dst_path = "";
+
+/* internal I/O functions */
+static DST_KEY *dst_s_read_public_key(const char *in_name, 
+				      const u_int16_t in_id, int in_alg);
+static int dst_s_read_private_key_file(char *name, DST_KEY *pk_key,
+				       u_int16_t in_id, int in_alg);
+static int dst_s_write_public_key(const DST_KEY *key);
+static int dst_s_write_private_key(const DST_KEY *key);
+
+/* internal function to set up data structure */
+static DST_KEY *dst_s_get_key_struct(const char *name, const int alg,
+				     const int flags, const int protocol,
+				     const int bits);
+
+/*%
+ *  dst_init
+ *	This function initializes the Digital Signature Toolkit.
+ *	Right now, it just checks the DSTKEYPATH environment variable.
+ *  Parameters
+ *	none
+ *  Returns
+ *	none
+ */
+void
+dst_init()
+{
+	char *s;
+	int len;
+
+	if (done_init != 0)
+		return;
+	done_init = 1;
+
+	s = getenv("DSTKEYPATH");
+	len = 0;
+	if (s) {
+		struct stat statbuf;
+
+		len = strlen(s);
+		if (len > PATH_MAX) {
+			EREPORT(("%s is longer than %d characters, ignoring\n",
+				 s, PATH_MAX));
+		} else if (stat(s, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode)) {
+			EREPORT(("%s is not a valid directory\n", s));
+		} else {
+			char *tmp;
+			tmp = (char *) malloc(len + 2);
+			memcpy(tmp, s, len + 1);
+			if (tmp[strlen(tmp) - 1] != '/') {
+				tmp[strlen(tmp) + 1] = 0;
+				tmp[strlen(tmp)] = '/';
+			}
+			dst_path = tmp;
+		}
+	}
+	memset(dst_t_func, 0, sizeof(dst_t_func));
+	/* first one is selected */
+	dst_hmac_md5_init();
+}
+
+/*%
+ *  dst_check_algorithm
+ *	This function determines if the crypto system for the specified
+ *	algorithm is present.
+ *  Parameters
+ *	alg     1       KEY_RSA
+ *		3       KEY_DSA
+ *	      157     KEY_HMAC_MD5
+ *		      future algorithms TBD and registered with IANA.
+ *  Returns
+ *	1 - The algorithm is available.
+ *	0 - The algorithm is not available.
+ */
+int
+dst_check_algorithm(const int alg)
+{
+	return (dst_t_func[alg] != NULL);
+}
+
+/*%
+ * dst_s_get_key_struct 
+ *	This function allocates key structure and fills in some of the 
+ *	fields of the structure. 
+ * Parameters: 
+ *	name:     the name of the key 
+ *	alg:      the algorithm number 
+ *	flags:    the dns flags of the key
+ *	protocol: the dns protocol of the key
+ *	bits:     the size of the key
+ * Returns:
+ *       NULL if error
+ *       valid pointer otherwise
+ */
+static DST_KEY *
+dst_s_get_key_struct(const char *name, const int alg, const int flags,
+		     const int protocol, const int bits)
+{
+	DST_KEY *new_key = NULL; 
+
+	if (dst_check_algorithm(alg)) /*%< make sure alg is available */
+		new_key = (DST_KEY *) malloc(sizeof(*new_key));
+	if (new_key == NULL)
+		return (NULL);
+
+	memset(new_key, 0, sizeof(*new_key));
+	new_key->dk_key_name = strdup(name);
+	if (new_key->dk_key_name == NULL) {
+		free(new_key);
+		return (NULL);
+	}
+	new_key->dk_alg = alg;
+	new_key->dk_flags = flags;
+	new_key->dk_proto = protocol;
+	new_key->dk_KEY_struct = NULL;
+	new_key->dk_key_size = bits;
+	new_key->dk_func = dst_t_func[alg];
+	return (new_key);
+}
+
+/*%
+ *  dst_compare_keys
+ *	Compares two keys for equality.
+ *  Parameters
+ *	key1, key2      Two keys to be compared.
+ *  Returns
+ *	0	       The keys are equal.
+ *	non-zero	The keys are not equal.
+ */
+
+int
+dst_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
+{
+	if (key1 == key2)
+		return (0);
+	if (key1 == NULL || key2 == NULL)
+		return (4);
+	if (key1->dk_alg != key2->dk_alg)
+		return (1);
+	if (key1->dk_key_size != key2->dk_key_size)
+		return (2);
+	if (key1->dk_id != key2->dk_id)
+		return (3);
+	return (key1->dk_func->compare(key1, key2));
+}
+
+/*%
+ * dst_sign_data
+ *	An incremental signing function.  Data is signed in steps.
+ *	First the context must be initialized (SIG_MODE_INIT).
+ *	Then data is hashed (SIG_MODE_UPDATE).  Finally the signature
+ *	itself is created (SIG_MODE_FINAL).  This function can be called
+ *	once with INIT, UPDATE and FINAL modes all set, or it can be
+ *	called separately with a different mode set for each step.  The
+ *	UPDATE step can be repeated.
+ * Parameters
+ *	mode    A bit mask used to specify operation(s) to be performed.
+ *		  SIG_MODE_INIT	   1   Initialize digest
+ *		  SIG_MODE_UPDATE	 2   Add data to digest
+ *		  SIG_MODE_FINAL	  4   Generate signature
+ *					      from signature
+ *		  SIG_MODE_ALL (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL
+ *	data    Data to be signed.
+ *	len     The length in bytes of data to be signed.
+ *	in_key  Contains a private key to sign with.
+ *		  KEY structures should be handled (created, converted,
+ *		  compared, stored, freed) by the DST.
+ *	signature
+ *	      The location to which the signature will be written.
+ *	sig_len Length of the signature field in bytes.
+ * Return
+ *	 0      Successfull INIT or Update operation
+ *	&gt;0      success FINAL (sign) operation
+ *	&lt;0      failure
+ */
+
+int
+dst_sign_data(const int mode, DST_KEY *in_key, void **context, 
+	      const u_char *data, const int len,
+	      u_char *signature, const int sig_len)
+{
+	DUMP(data, mode, len, "dst_sign_data()");
+
+	if (mode & SIG_MODE_FINAL &&
+	    (in_key->dk_KEY_struct == NULL || signature == NULL))
+		return (MISSING_KEY_OR_SIGNATURE);
+
+	if (in_key->dk_func && in_key->dk_func->sign)
+		return (in_key->dk_func->sign(mode, in_key, context, data, len,
+					      signature, sig_len));
+	return (UNKNOWN_KEYALG);
+}
+
+/*%
+ *  dst_verify_data
+ *	An incremental verify function.  Data is verified in steps.
+ *	First the context must be initialized (SIG_MODE_INIT).
+ *	Then data is hashed (SIG_MODE_UPDATE).  Finally the signature
+ *	is verified (SIG_MODE_FINAL).  This function can be called
+ *	once with INIT, UPDATE and FINAL modes all set, or it can be
+ *	called separately with a different mode set for each step.  The
+ *	UPDATE step can be repeated.
+ *  Parameters
+ *	mode	Operations to perform this time.
+ *		      SIG_MODE_INIT       1   Initialize digest
+ *		      SIG_MODE_UPDATE     2   add data to digest
+ *		      SIG_MODE_FINAL      4   verify signature
+ *		      SIG_MODE_ALL
+ *			  (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL)
+ *	data	Data to pass through the hash function.
+ *	len	 Length of the data in bytes.
+ *	in_key      Key for verification.
+ *	signature   Location of signature.
+ *	sig_len     Length of the signature in bytes.
+ *  Returns
+ *	0	   Verify success
+ *	Non-Zero    Verify Failure
+ */
+
+int
+dst_verify_data(const int mode, DST_KEY *in_key, void **context, 
+		const u_char *data, const int len,
+		const u_char *signature, const int sig_len)
+{
+	DUMP(data, mode, len, "dst_verify_data()");
+	if (mode & SIG_MODE_FINAL &&
+	    (in_key->dk_KEY_struct == NULL || signature == NULL))
+		return (MISSING_KEY_OR_SIGNATURE);
+
+	if (in_key->dk_func == NULL || in_key->dk_func->verify == NULL)
+		return (UNSUPPORTED_KEYALG);
+	return (in_key->dk_func->verify(mode, in_key, context, data, len,
+					signature, sig_len));
+}
+
+/*%
+ *  dst_read_private_key
+ *	Access a private key.  First the list of private keys that have
+ *	already been read in is searched, then the key accessed on disk.
+ *	If the private key can be found, it is returned.  If the key cannot
+ *	be found, a null pointer is returned.  The options specify required
+ *	key characteristics.  If the private key requested does not have
+ *	these characteristics, it will not be read.
+ *  Parameters
+ *	in_keyname  The private key name.
+ *	in_id	    The id of the private key.
+ *	options     DST_FORCE_READ  Read from disk - don't use a previously
+ *				      read key.
+ *		  DST_CAN_SIGN    The key must be useable for signing.
+ *		  DST_NO_AUTHEN   The key must be useable for authentication.
+ *		  DST_STANDARD    Return any key 
+ *  Returns
+ *	NULL	If there is no key found in the current directory or
+ *		      this key has not been loaded before.
+ *	!NULL       Success - KEY structure returned.
+ */
+
+DST_KEY *
+dst_read_key(const char *in_keyname, const u_int16_t in_id, 
+	     const int in_alg, const int type)
+{
+	char keyname[PATH_MAX];
+	DST_KEY *dg_key = NULL, *pubkey = NULL;
+
+	if (!dst_check_algorithm(in_alg)) { /*%< make sure alg is available */
+		EREPORT(("dst_read_private_key(): Algorithm %d not suppored\n",
+			 in_alg));
+		return (NULL);
+	}
+	if ((type & (DST_PUBLIC | DST_PRIVATE)) == 0) 
+		return (NULL);
+	if (in_keyname == NULL) {
+		EREPORT(("dst_read_private_key(): Null key name passed in\n"));
+		return (NULL);
+	} else if (strlen(in_keyname) >= sizeof(keyname)) {
+		EREPORT(("dst_read_private_key(): keyname too big\n"));
+		return (NULL);
+	} else 
+		strcpy(keyname, in_keyname);
+
+	/* before I read in the public key, check if it is allowed to sign */
+	if ((pubkey = dst_s_read_public_key(keyname, in_id, in_alg)) == NULL)
+		return (NULL);
+
+	if (type == DST_PUBLIC) 
+		return pubkey; 
+
+	if (!(dg_key = dst_s_get_key_struct(keyname, pubkey->dk_alg,
+					    pubkey->dk_flags, pubkey->dk_proto,
+					    0)))
+		return (dg_key);
+	/* Fill in private key and some fields in the general key structure */
+	if (dst_s_read_private_key_file(keyname, dg_key, pubkey->dk_id,
+					pubkey->dk_alg) == 0)
+		dg_key = dst_free_key(dg_key);
+
+	(void)dst_free_key(pubkey);
+	return (dg_key);
+}
+
+int 
+dst_write_key(const DST_KEY *key, const int type)
+{
+	int pub = 0, priv = 0;
+
+	if (key == NULL) 
+		return (0);
+	if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
+		EREPORT(("dst_write_key(): Algorithm %d not suppored\n", 
+			 key->dk_alg));
+		return (UNSUPPORTED_KEYALG);
+	}
+	if ((type & (DST_PRIVATE|DST_PUBLIC)) == 0)
+		return (0);
+
+	if (type & DST_PUBLIC) 
+		if ((pub = dst_s_write_public_key(key)) < 0)
+			return (pub);
+	if (type & DST_PRIVATE)
+		if ((priv = dst_s_write_private_key(key)) < 0)
+			return (priv);
+	return (priv+pub);
+}
+
+/*%
+ *  dst_write_private_key
+ *	Write a private key to disk.  The filename will be of the form:
+ *	K&lt;key-&gt;dk_name&gt;+&lt;key-&gt;dk_alg+&gt;&lt;key-d&gt;k_id.&gt;&lt;private key suffix&gt;.
+ *	If there is already a file with this name, an error is returned.
+ *
+ *  Parameters
+ *	key     A DST managed key structure that contains
+ *	      all information needed about a key.
+ *  Return
+ *	&gt;= 0    Correct behavior.  Returns length of encoded key value
+ *		  written to disk.
+ *	&lt;  0    error.
+ */
+
+static int
+dst_s_write_private_key(const DST_KEY *key)
+{
+	u_char encoded_block[RAW_KEY_SIZE];
+	char file[PATH_MAX];
+	int len;
+	FILE *fp;
+
+	/* First encode the key into the portable key format */
+	if (key == NULL)
+		return (-1);
+	if (key->dk_KEY_struct == NULL)
+		return (0);	/*%< null key has no private key */
+	if (key->dk_func == NULL || key->dk_func->to_file_fmt == NULL) {
+		EREPORT(("dst_write_private_key(): Unsupported operation %d\n",
+			 key->dk_alg));
+		return (-5);
+	} else if ((len = key->dk_func->to_file_fmt(key, (char *)encoded_block,
+					     sizeof(encoded_block))) <= 0) {
+		EREPORT(("dst_write_private_key(): Failed encoding private RSA bsafe key %d\n", len));
+		return (-8);
+	}
+	/* Now I can create the file I want to use */
+	dst_s_build_filename(file, key->dk_key_name, key->dk_id, key->dk_alg,
+			     PRIVATE_KEY, PATH_MAX);
+
+	/* Do not overwrite an existing file */
+	if ((fp = dst_s_fopen(file, "w", 0600)) != NULL) {
+		int nn;
+		if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
+			EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
+				 file, len, nn, errno));
+			fclose(fp);
+			return (-5);
+		}
+		fclose(fp);
+	} else {
+		EREPORT(("dst_write_private_key(): Can not create file %s\n"
+			 ,file));
+		return (-6);
+	}
+	memset(encoded_block, 0, len);
+	return (len);
+}
+
+/*%
+*
+ *  dst_read_public_key
+ *	Read a public key from disk and store in a DST key structure.
+ *  Parameters
+ *	in_name	 K&lt;in_name&gt;&lt;in_id&gt;.&lt;public key suffix&gt; is the
+ *		      filename of the key file to be read.
+ *  Returns
+ *	NULL	    If the key does not exist or no name is supplied.
+ *	NON-NULL	Initialized key structure if the key exists.
+ */
+
+static DST_KEY *
+dst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
+{
+	int flags, proto, alg, len, dlen;
+	int c;
+	char name[PATH_MAX], enckey[RAW_KEY_SIZE], *notspace;
+	u_char deckey[RAW_KEY_SIZE];
+	FILE *fp;
+
+	if (in_name == NULL) {
+		EREPORT(("dst_read_public_key(): No key name given\n"));
+		return (NULL);
+	}
+	if (dst_s_build_filename(name, in_name, in_id, in_alg, PUBLIC_KEY,
+				 PATH_MAX) == -1) {
+		EREPORT(("dst_read_public_key(): Cannot make filename from %s, %d, and %s\n",
+			 in_name, in_id, PUBLIC_KEY));
+		return (NULL);
+	}
+	/*
+	 * Open the file and read it's formatted contents up to key
+	 * File format:
+	 *    domain.name [ttl] [IN] KEY  &lt;flags&gt; &lt;protocol&gt; &lt;algorithm&gt; &lt;key&gt;
+	 * flags, proto, alg stored as decimal (or hex numbers FIXME).
+	 * (FIXME: handle parentheses for line continuation.)
+	 */
+	if ((fp = dst_s_fopen(name, "r", 0)) == NULL) {
+		EREPORT(("dst_read_public_key(): Public Key not found %s\n",
+			 name));
+		return (NULL);
+	}
+	/* Skip domain name, which ends at first blank */
+	while ((c = getc(fp)) != EOF)
+		if (isspace(c))
+			break;
+	/* Skip blank to get to next field */
+	while ((c = getc(fp)) != EOF)
+		if (!isspace(c))
+			break;
+
+	/* Skip optional TTL -- if initial digit, skip whole word. */
+	if (isdigit(c)) {
+		while ((c = getc(fp)) != EOF)
+			if (isspace(c))
+				break;
+		while ((c = getc(fp)) != EOF)
+			if (!isspace(c))
+				break;
+	}
+	/* Skip optional "IN" */
+	if (c == 'I' || c == 'i') {
+		while ((c = getc(fp)) != EOF)
+			if (isspace(c))
+				break;
+		while ((c = getc(fp)) != EOF)
+			if (!isspace(c))
+				break;
+	}
+	/* Locate and skip "KEY" */
+	if (c != 'K' && c != 'k') {
+		EREPORT(("\"KEY\" doesn't appear in file: %s", name));
+		return NULL;
+	}
+	while ((c = getc(fp)) != EOF)
+		if (isspace(c))
+			break;
+	while ((c = getc(fp)) != EOF)
+		if (!isspace(c))
+			break;
+	ungetc(c, fp);		/*%< return the charcter to the input field */
+	/* Handle hex!! FIXME.  */
+
+	if (fscanf(fp, "%d %d %d", &flags, &proto, &alg) != 3) {
+		EREPORT(("dst_read_public_key(): Can not read flag/proto/alg field from %s\n"
+			 ,name));
+		return (NULL);
+	}
+	/* read in the key string */
+	fgets(enckey, sizeof(enckey), fp);
+
+	/* If we aren't at end-of-file, something is wrong.  */
+	while ((c = getc(fp)) != EOF)
+		if (!isspace(c))
+			break;
+	if (!feof(fp)) {
+		EREPORT(("Key too long in file: %s", name));
+		return NULL;
+	}
+	fclose(fp);
+
+	if ((len = strlen(enckey)) <= 0)
+		return (NULL);
+
+	/* discard \n */
+	enckey[--len] = '\0';
+
+	/* remove leading spaces */
+	for (notspace = (char *) enckey; isspace((*notspace)&0xff); len--)
+		notspace++;
+
+	dlen = b64_pton(notspace, deckey, sizeof(deckey));
+	if (dlen < 0) {
+		EREPORT(("dst_read_public_key: bad return from b64_pton = %d",
+			 dlen));
+		return (NULL);
+	}
+	/* store key and info in a key structure that is returned */
+/*	return dst_store_public_key(in_name, alg, proto, 666, flags, deckey,
+				    dlen);*/
+	return dst_buffer_to_key(in_name, alg, flags, proto, deckey, dlen);
+}
+
+/*%
+ *  dst_write_public_key
+ *	Write a key to disk in DNS format.
+ *  Parameters
+ *	key     Pointer to a DST key structure.
+ *  Returns
+ *	0       Failure
+ *	1       Success
+ */
+
+static int
+dst_s_write_public_key(const DST_KEY *key)
+{
+	FILE *fp;
+	char filename[PATH_MAX];
+	u_char out_key[RAW_KEY_SIZE];
+	char enc_key[RAW_KEY_SIZE];
+	int len = 0;
+	int mode;
+
+	memset(out_key, 0, sizeof(out_key));
+	if (key == NULL) {
+		EREPORT(("dst_write_public_key(): No key specified \n"));
+		return (0);
+	} else if ((len = dst_key_to_dnskey(key, out_key, sizeof(out_key)))< 0)
+		return (0);
+
+	/* Make the filename */
+	if (dst_s_build_filename(filename, key->dk_key_name, key->dk_id,
+				 key->dk_alg, PUBLIC_KEY, PATH_MAX) == -1) {
+		EREPORT(("dst_write_public_key(): Cannot make filename from %s, %d, and %s\n",
+			 key->dk_key_name, key->dk_id, PUBLIC_KEY));
+		return (0);
+	}
+	/* XXX in general this should be a check for symmetric keys */
+	mode = (key->dk_alg == KEY_HMAC_MD5) ? 0600 : 0644;
+	/* create public key file */
+	if ((fp = dst_s_fopen(filename, "w+", mode)) == NULL) {
+		EREPORT(("DST_write_public_key: open of file:%s failed (errno=%d)\n",
+			 filename, errno));
+		return (0);
+	}
+	/*write out key first base64 the key data */
+	if (key->dk_flags & DST_EXTEND_FLAG)
+		b64_ntop(&out_key[6], len - 6, enc_key, sizeof(enc_key));
+	else
+		b64_ntop(&out_key[4], len - 4, enc_key, sizeof(enc_key));
+	fprintf(fp, "%s IN KEY %d %d %d %s\n",
+		key->dk_key_name,
+		key->dk_flags, key->dk_proto, key->dk_alg, enc_key);
+	fclose(fp);
+	return (1);
+}
+
+/*%
+ *  dst_dnskey_to_public_key
+ *	This function converts the contents of a DNS KEY RR into a DST
+ *	key structure.
+ *  Paramters
+ *	len	 Length of the RDATA of the KEY RR RDATA
+ *	rdata	 A pointer to the the KEY RR RDATA.
+ *	in_name     Key name to be stored in key structure.
+ *  Returns
+ *	NULL	    Failure
+ *	NON-NULL	Success.  Pointer to key structure.
+ *			Caller's responsibility to free() it.
+ */
+
+DST_KEY *
+dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
+{
+	DST_KEY *key_st;
+	int alg ;
+	int start = DST_KEY_START;
+
+	if (rdata == NULL || len <= DST_KEY_ALG) /*%< no data */
+		return (NULL);
+	alg = (u_int8_t) rdata[DST_KEY_ALG];
+	if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
+		EREPORT(("dst_dnskey_to_key(): Algorithm %d not suppored\n",
+			 alg));
+		return (NULL);
+	}
+
+	if (in_name == NULL)
+		return (NULL);
+
+	if ((key_st = dst_s_get_key_struct(in_name, alg, 0, 0, 0)) == NULL)
+		return (NULL);
+
+	key_st->dk_id = dst_s_dns_key_id(rdata, len);
+	key_st->dk_flags = dst_s_get_int16(rdata);
+	key_st->dk_proto = (u_int16_t) rdata[DST_KEY_PROT];
+	if (key_st->dk_flags & DST_EXTEND_FLAG) {
+		u_int32_t ext_flags;
+		ext_flags = (u_int32_t) dst_s_get_int16(&rdata[DST_EXT_FLAG]);
+		key_st->dk_flags = key_st->dk_flags | (ext_flags << 16);
+		start += 2;
+	}
+	/*
+	 * now point to the begining of the data representing the encoding
+	 * of the key
+	 */
+	if (key_st->dk_func && key_st->dk_func->from_dns_key) {
+		if (key_st->dk_func->from_dns_key(key_st, &rdata[start],
+						  len - start) > 0)
+			return (key_st);
+	} else
+		EREPORT(("dst_dnskey_to_public_key(): unsuppored alg %d\n",
+			 alg));
+
+	SAFE_FREE(key_st);
+	return (key_st);
+}
+
+/*%
+ *  dst_public_key_to_dnskey
+ *	Function to encode a public key into DNS KEY wire format 
+ *  Parameters
+ *	key	     Key structure to encode.
+ *	out_storage     Location to write the encoded key to.
+ *	out_len	 Size of the output array.
+ *  Returns
+ *	<0      Failure
+ *	>=0     Number of bytes written to out_storage
+ */
+
+int
+dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
+			 const int out_len)
+{
+	u_int16_t val;
+	int loc = 0;
+	int enc_len = 0;
+	if (key == NULL)
+		return (-1);
+
+	if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
+		EREPORT(("dst_key_to_dnskey(): Algorithm %d not suppored\n",
+			 key->dk_alg));
+		return (UNSUPPORTED_KEYALG);
+	}
+	memset(out_storage, 0, out_len);
+	val = (u_int16_t)(key->dk_flags & 0xffff);
+	dst_s_put_int16(out_storage, val);
+	loc += 2;
+
+	out_storage[loc++] = (u_char) key->dk_proto;
+	out_storage[loc++] = (u_char) key->dk_alg;
+
+	if (key->dk_flags > 0xffff) {	/*%< Extended flags */
+		val = (u_int16_t)((key->dk_flags >> 16) & 0xffff);
+		dst_s_put_int16(&out_storage[loc], val);
+		loc += 2;
+	}
+	if (key->dk_KEY_struct == NULL)
+		return (loc);
+	if (key->dk_func && key->dk_func->to_dns_key) {
+		enc_len = key->dk_func->to_dns_key(key,
+						 (u_char *) &out_storage[loc],
+						   out_len - loc);
+		if (enc_len > 0)
+			return (enc_len + loc);
+		else
+			return (-1);
+	} else
+		EREPORT(("dst_key_to_dnskey(): Unsupported ALG %d\n",
+			 key->dk_alg));
+	return (-1);
+}
+
+/*%
+ *  dst_buffer_to_key
+ *	Function to encode a string of raw data into a DST key
+ *  Parameters
+ *	alg		The algorithm (HMAC only)
+ *	key		A pointer to the data
+ *	keylen		The length of the data
+ *  Returns
+ *	NULL	    an error occurred
+ *	NON-NULL	the DST key
+ */
+DST_KEY *
+dst_buffer_to_key(const char *key_name,		/*!< name of the key  */
+		  const int alg,		/*!< algorithm  */
+		  const int flags,		/*!< dns flags  */
+		  const int protocol,		/*!< dns protocol  */
+		  const u_char *key_buf,	/*!< key in dns wire fmt  */
+		  const int key_len)		/*!< size of key  */
+{
+	
+	DST_KEY *dkey = NULL; 
+	int dnslen;
+	u_char dns[2048];
+
+	if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
+		EREPORT(("dst_buffer_to_key(): Algorithm %d not suppored\n", alg));
+		return (NULL);
+	}
+
+	dkey = dst_s_get_key_struct(key_name, alg, flags, protocol, -1);
+
+	if (dkey == NULL || dkey->dk_func == NULL ||
+	    dkey->dk_func->from_dns_key == NULL) 
+		return (dst_free_key(dkey));
+
+	if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
+		EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
+		return (dst_free_key(dkey));
+	}
+
+	dnslen = dst_key_to_dnskey(dkey, dns, sizeof(dns));
+	dkey->dk_id = dst_s_dns_key_id(dns, dnslen);
+	return (dkey);
+}
+
+int 
+dst_key_to_buffer(DST_KEY *key, u_char *out_buff, int buf_len)
+{
+	int len;
+  /* this function will extrac the secret of HMAC into a buffer */
+	if (key == NULL) 
+		return (0);
+	if (key->dk_func != NULL && key->dk_func->to_dns_key != NULL) {
+		len = key->dk_func->to_dns_key(key, out_buff, buf_len);
+		if (len < 0)
+			return (0);
+		return (len);
+	}
+	return (0);
+}
+
+/*%
+ * dst_s_read_private_key_file
+ *     Function reads in private key from a file.
+ *     Fills out the KEY structure.
+ * Parameters
+ *     name    Name of the key to be read.
+ *     pk_key  Structure that the key is returned in.
+ *     in_id   Key identifier (tag)
+ * Return
+ *     1 if everthing works
+ *     0 if there is any problem
+ */
+
+static int
+dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
+			    int in_alg)
+{
+	int cnt, alg, len, major, minor, file_major, file_minor;
+	int ret, id;
+	char filename[PATH_MAX];
+	u_char in_buff[RAW_KEY_SIZE], *p;
+	FILE *fp;
+	int dnslen;
+	u_char dns[2048];
+
+	if (name == NULL || pk_key == NULL) {
+		EREPORT(("dst_read_private_key_file(): No key name given\n"));
+		return (0);
+	}
+	/* Make the filename */
+	if (dst_s_build_filename(filename, name, in_id, in_alg, PRIVATE_KEY,
+				 PATH_MAX) == -1) {
+		EREPORT(("dst_read_private_key(): Cannot make filename from %s, %d, and %s\n",
+			 name, in_id, PRIVATE_KEY));
+		return (0);
+	}
+	/* first check if we can find the key file */
+	if ((fp = dst_s_fopen(filename, "r", 0)) == NULL) {
+		EREPORT(("dst_s_read_private_key_file: Could not open file %s in directory %s\n",
+			 filename, dst_path[0] ? dst_path :
+			 (char *) getcwd(NULL, PATH_MAX - 1)));
+		return (0);
+	}
+	/* now read the header info from the file */
+	if ((cnt = fread(in_buff, 1, sizeof(in_buff), fp)) < 5) {
+		fclose(fp);
+		EREPORT(("dst_s_read_private_key_file: error reading file %s (empty file)\n",
+			 filename));
+		return (0);
+	}
+	/* decrypt key */
+	fclose(fp);
+	if (memcmp(in_buff, "Private-key-format: v", 20) != 0)
+		goto fail;
+	len = cnt;
+	p = in_buff;
+
+	if (!dst_s_verify_str((const char **) (void *)&p,
+			       "Private-key-format: v")) {
+		EREPORT(("dst_s_read_private_key_file(): Not a Key file/Decrypt failed %s\n", name));
+		goto fail;
+	}
+	/* read in file format */
+	sscanf((char *)p, "%d.%d", &file_major, &file_minor);
+	sscanf(KEY_FILE_FORMAT, "%d.%d", &major, &minor);
+	if (file_major < 1) {
+		EREPORT(("dst_s_read_private_key_file(): Unknown keyfile %d.%d version for %s\n",
+			 file_major, file_minor, name));
+		goto fail;
+	} else if (file_major > major || file_minor > minor)
+		EREPORT((
+				"dst_s_read_private_key_file(): Keyfile %s version higher than mine %d.%d MAY FAIL\n",
+				name, file_major, file_minor));
+
+	while (*p++ != '\n') ;	/*%< skip to end of line */
+
+	if (!dst_s_verify_str((const char **) (void *)&p, "Algorithm: "))
+		goto fail;
+
+	if (sscanf((char *)p, "%d", &alg) != 1)
+		goto fail;
+	while (*p++ != '\n') ;	/*%< skip to end of line */
+
+	if (pk_key->dk_key_name && !strcmp(pk_key->dk_key_name, name))
+		SAFE_FREE2(pk_key->dk_key_name, strlen(pk_key->dk_key_name));
+	pk_key->dk_key_name = (char *) strdup(name);
+
+	/* allocate and fill in key structure */
+	if (pk_key->dk_func == NULL || pk_key->dk_func->from_file_fmt == NULL)
+		goto fail;
+
+	ret = pk_key->dk_func->from_file_fmt(pk_key, (char *)p, &in_buff[len] - p);
+	if (ret < 0)
+		goto fail;
+
+	dnslen = dst_key_to_dnskey(pk_key, dns, sizeof(dns));
+	id = dst_s_dns_key_id(dns, dnslen);
+
+	/* Make sure the actual key tag matches the input tag used in the filename
+	 */
+	if (id != in_id) {
+		EREPORT(("dst_s_read_private_key_file(): actual tag of key read %d != input tag used to build filename %d.\n", id, in_id));
+		goto fail;
+	}
+	pk_key->dk_id = (u_int16_t) id;
+	pk_key->dk_alg = alg;
+	memset(in_buff, 0, cnt);
+	return (1);
+
+ fail:
+	memset(in_buff, 0, cnt);
+	return (0);
+}
+
+/*%
+ *	Generate and store a public/private keypair.
+ *	Keys will be stored in formatted files.
+ *
+ *  Parameters
+ &
+ *\par	name    Name of the new key.  Used to create key files
+ *\li		  K&lt;name&gt;+&lt;alg&gt;+&lt;id&gt;.public and K&lt;name&gt;+&lt;alg&gt;+&lt;id&gt;.private.
+ *\par	bits    Size of the new key in bits.
+ *\par	exp     What exponent to use:
+ *\li		  0	   use exponent 3
+ *\li		  non-zero    use Fermant4
+ *\par	flags   The default value of the DNS Key flags.
+ *\li		  The DNS Key RR Flag field is defined in RFC2065,
+ *		  section 3.3.  The field has 16 bits.
+ *\par	protocol
+ *\li	      Default value of the DNS Key protocol field.
+ *\li		  The DNS Key protocol field is defined in RFC2065,
+ *		  section 3.4.  The field has 8 bits.
+ *\par	alg     What algorithm to use.  Currently defined:
+ *\li		  KEY_RSA       1
+ *\li		  KEY_DSA       3
+ *\li		  KEY_HMAC    157
+ *\par	out_id The key tag is returned.
+ *
+ *  Return
+ *\li	NULL		Failure
+ *\li	non-NULL 	the generated key pair
+ *			Caller frees the result, and its dk_name pointer.
+ */
+DST_KEY *
+dst_generate_key(const char *name, const int bits, const int exp,
+		 const int flags, const int protocol, const int alg)
+{
+	DST_KEY *new_key = NULL;
+	int dnslen;
+	u_char dns[2048];
+
+	if (name == NULL)
+		return (NULL);
+
+	if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
+		EREPORT(("dst_generate_key(): Algorithm %d not suppored\n", alg));
+		return (NULL);
+	}
+
+	new_key = dst_s_get_key_struct(name, alg, flags, protocol, bits);
+	if (new_key == NULL)
+		return (NULL);
+	if (bits == 0) /*%< null key we are done */
+		return (new_key);
+	if (new_key->dk_func == NULL || new_key->dk_func->generate == NULL) {
+		EREPORT(("dst_generate_key_pair():Unsupported algorithm %d\n",
+			 alg));
+		return (dst_free_key(new_key));
+	}
+	if (new_key->dk_func->generate(new_key, exp) <= 0) {
+		EREPORT(("dst_generate_key_pair(): Key generation failure %s %d %d %d\n",
+			 new_key->dk_key_name, new_key->dk_alg,
+			 new_key->dk_key_size, exp));
+		return (dst_free_key(new_key));
+	}
+
+	dnslen = dst_key_to_dnskey(new_key, dns, sizeof(dns));
+	if (dnslen != UNSUPPORTED_KEYALG)
+		new_key->dk_id = dst_s_dns_key_id(dns, dnslen);
+	else
+		new_key->dk_id = 0;
+
+	return (new_key);
+}
+
+/*%
+ *	Release all data structures pointed to by a key structure.
+ *
+ *  Parameters
+ *\li	f_key   Key structure to be freed.
+ */
+
+DST_KEY *
+dst_free_key(DST_KEY *f_key)
+{
+
+	if (f_key == NULL)
+		return (f_key);
+	if (f_key->dk_func && f_key->dk_func->destroy)
+		f_key->dk_KEY_struct =
+			f_key->dk_func->destroy(f_key->dk_KEY_struct);
+	else {
+		EREPORT(("dst_free_key(): Unknown key alg %d\n",
+			 f_key->dk_alg));
+	}
+	if (f_key->dk_KEY_struct) {
+		free(f_key->dk_KEY_struct);
+		f_key->dk_KEY_struct = NULL;
+	}
+	if (f_key->dk_key_name)
+		SAFE_FREE(f_key->dk_key_name);
+	SAFE_FREE(f_key);
+	return (NULL);
+}
+
+/*%
+ *	Return the maximim size of signature from the key specified in bytes
+ *
+ * Parameters
+ *\li      key 
+ *
+ * Returns
+ *  \li   bytes
+ */
+int
+dst_sig_size(DST_KEY *key) {
+	switch (key->dk_alg) {
+	    case KEY_HMAC_MD5:
+		return (16);
+	    case KEY_HMAC_SHA1:
+		return (20);
+	    case KEY_RSA:
+		return (key->dk_key_size + 7) / 8;
+	    case KEY_DSA:
+		return (40);
+	    default:
+		EREPORT(("dst_sig_size(): Unknown key alg %d\n", key->dk_alg));
+		return -1;
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/dst/dst_internal.h b/usr/src/lib/libresolv2_joy/common/dst/dst_internal.h
new file mode 100644
index 0000000000..e9bc6fc08d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/dst/dst_internal.h
@@ -0,0 +1,155 @@
+#ifndef DST_INTERNAL_H
+#define DST_INTERNAL_H
+
+/*
+ * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
+ *
+ * Permission to use, copy modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL
+ * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
+ */
+#include <limits.h>
+#include <sys/param.h>
+#if (!defined(BSD)) || (BSD < 199306)
+# include <sys/bitypes.h>
+#else
+# include <sys/types.h>
+#endif
+
+#ifndef PATH_MAX
+# ifdef POSIX_PATH_MAX
+#  define PATH_MAX POSIX_PATH_MAX
+# else
+#  define PATH_MAX 255 /*%< this is the value of POSIX_PATH_MAX */
+# endif
+#endif 
+
+typedef struct dst_key {
+	char	*dk_key_name;   /*%< name of the key */
+	int	dk_key_size;    /*%< this is the size of the key in bits */
+	int	dk_proto;       /*%< what protocols this key can be used for */
+	int	dk_alg;         /*%< algorithm number from key record */
+	u_int32_t dk_flags;     /*%< and the flags of the public key */
+	u_int16_t dk_id;        /*%< identifier of the key */
+	void	*dk_KEY_struct; /*%< pointer to key in crypto pkg fmt */
+	struct dst_func *dk_func; /*%< point to cryptto pgk specific function table */
+} DST_KEY;
+#define HAS_DST_KEY 
+
+#include <isc/dst.h>
+/* 
+ * define what crypto systems are supported for RSA, 
+ * BSAFE is prefered over RSAREF; only one can be set at any time
+ */
+#if defined(BSAFE) && defined(RSAREF)
+# error "Cannot have both BSAFE and RSAREF defined"
+#endif
+
+/* Declare dst_lib specific constants */
+#define KEY_FILE_FORMAT "1.2"
+
+/* suffixes for key file names */
+#define PRIVATE_KEY		"private"
+#define PUBLIC_KEY		"key"
+
+/* error handling */
+#ifdef REPORT_ERRORS
+#define EREPORT(str)		printf str
+#else
+#define EREPORT(str)		(void)0
+#endif
+
+/* use our own special macro to FRRE memory */
+
+#ifndef SAFE_FREE
+#define SAFE_FREE(a) \
+do{if(a != NULL){memset(a,0, sizeof(*a)); free(a); a=NULL;}} while (0)
+#define SAFE_FREE2(a,s) if (a != NULL && (long)s > 0){memset(a,0, s);free(a); a=NULL;}
+#endif
+
+typedef struct dst_func {
+	int (*sign)(const int mode, DST_KEY *key, void **context,
+		     const u_int8_t *data, const int len,
+		     u_int8_t *signature, const int sig_len);
+	int (*verify)(const int mode, DST_KEY *key, void **context,
+		       const u_int8_t *data, const int len,
+		       const u_int8_t *signature, const int sig_len);
+	int (*compare)(const DST_KEY *key1, const DST_KEY *key2);
+	int (*generate)(DST_KEY *key, int parms);
+	void *(*destroy)(void *key);
+	/* conversion functions */
+	int (*to_dns_key)(const DST_KEY *key, u_int8_t *out,
+			   const int out_len);
+	int (*from_dns_key)(DST_KEY *key, const u_int8_t *str,
+			     const int str_len);
+	int (*to_file_fmt)(const DST_KEY *key, char *out,
+			    const int out_len);
+	int (*from_file_fmt)(DST_KEY *key, const char *out,
+			      const int out_len);
+
+} dst_func;
+
+extern dst_func *dst_t_func[DST_MAX_ALGS];
+extern const char *key_file_fmt_str;
+extern const char *dst_path;
+
+#ifndef DST_HASH_SIZE
+#define DST_HASH_SIZE 20	/*%< RIPEMD160 and SHA-1 are 20 bytes MD5 is 16 */
+#endif
+
+int dst_bsafe_init(void);
+
+int dst_rsaref_init(void);
+
+int dst_hmac_md5_init(void);
+
+int dst_cylink_init(void);
+
+int dst_eay_dss_init(void);
+
+/* from higher level support routines */
+int       dst_s_calculate_bits( const u_int8_t *str, const int max_bits); 
+int       dst_s_verify_str( const char **buf, const char *str);
+
+
+/* conversion between dns names and key file names */
+size_t    dst_s_filename_length( const char *name, const char *suffix); 
+int       dst_s_build_filename(  char *filename, const char *name, 
+			         u_int16_t id, int alg, const char *suffix, 
+			         size_t filename_length);
+
+FILE      *dst_s_fopen (const char *filename, const char *mode, int perm);
+
+/*%
+ * read and write network byte order into u_int?_t  
+ *  all of these should be retired
+ */
+u_int16_t dst_s_get_int16( const u_int8_t *buf);
+void      dst_s_put_int16( u_int8_t *buf, const u_int16_t val);
+
+u_int32_t dst_s_get_int32( const u_int8_t *buf);
+void      dst_s_put_int32( u_int8_t *buf, const u_int32_t val);
+
+#ifdef DUMP
+# undef DUMP
+# define DUMP(a,b,c,d) dst_s_dump(a,b,c,d)
+#else
+# define DUMP(a,b,c,d)
+#endif
+void
+dst_s_dump(const int mode, const u_char *data, const int size,
+            const char *msg);
+
+
+
+#endif /* DST_INTERNAL_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/dst/hmac_link.c b/usr/src/lib/libresolv2_joy/common/dst/hmac_link.c
new file mode 100644
index 0000000000..23925e4269
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/dst/hmac_link.c
@@ -0,0 +1,491 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+#ifdef HMAC_MD5
+#ifndef LINT
+static const char rcsid[] = "$Header: /proj/cvs/prod/libbind/dst/hmac_link.c,v 1.8 2007/09/24 17:18:25 each Exp $";
+#endif
+/*
+ * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
+ *
+ * Permission to use, copy modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL
+ * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
+ */
+
+/*%
+ * This file contains an implementation of the HMAC-MD5 algorithm.
+ */
+#include "port_before.h"
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <memory.h>
+#include <sys/param.h>
+#include <sys/time.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include "dst_internal.h"
+
+#ifdef USE_MD5
+# ifndef HAVE_MD5
+#  include "md5.h"
+# else
+#  ifdef SOLARIS2
+#   include <sys/md5.h>
+#  endif
+# endif
+# ifndef _MD5_H_
+#  define _MD5_H_ 1	/*%< make sure we do not include rsaref md5.h file */
+# endif
+#endif
+
+#include "port_after.h"
+
+
+#define HMAC_LEN	64
+#define HMAC_IPAD	0x36
+#define HMAC_OPAD	0x5c
+#define MD5_LEN		16
+
+
+typedef struct hmackey {
+	u_char hk_ipad[64], hk_opad[64];
+} HMAC_Key;
+
+
+/************************************************************************** 
+ * dst_hmac_md5_sign
+ *     Call HMAC signing functions to sign a block of data.
+ *     There are three steps to signing, INIT (initialize structures), 
+ *     UPDATE (hash (more) data), FINAL (generate a signature).  This
+ *     routine performs one or more of these steps.
+ * Parameters
+ *     mode	SIG_MODE_INIT, SIG_MODE_UPDATE and/or SIG_MODE_FINAL.
+ *     priv_key    key to use for signing.
+ *     context   the context to be used in this digest
+ *     data	data to be signed.
+ *     len	 length in bytes of data.
+ *     signature   location to store signature.
+ *     sig_len     size of the signature location
+ * returns 
+ *	N  Success on SIG_MODE_FINAL = returns signature length in bytes
+ *	0  Success on SIG_MODE_INIT  and UPDATE
+ *	 <0  Failure
+ */
+
+static int
+dst_hmac_md5_sign(const int mode, DST_KEY *d_key, void **context, 
+		  const u_char *data, const int len, 
+		  u_char *signature, const int sig_len)
+{
+	HMAC_Key *key;
+	int sign_len = 0;
+	MD5_CTX *ctx = NULL;
+
+	if (d_key == NULL || d_key->dk_KEY_struct == NULL)
+		return (-1);
+
+	if (mode & SIG_MODE_INIT) 
+		ctx = (MD5_CTX *) malloc(sizeof(*ctx));
+	else if (context)
+		ctx = (MD5_CTX *) *context;
+	if (ctx == NULL) 
+		return (-1);
+
+	key = (HMAC_Key *) d_key->dk_KEY_struct;
+
+	if (mode & SIG_MODE_INIT) {
+		MD5Init(ctx);
+		MD5Update(ctx, key->hk_ipad, HMAC_LEN);
+	}
+
+	if ((mode & SIG_MODE_UPDATE) && (data && len > 0))
+		MD5Update(ctx, data, len);
+
+	if (mode & SIG_MODE_FINAL) {
+		if (signature == NULL || sig_len < MD5_LEN)
+			return (SIGN_FINAL_FAILURE);
+		MD5Final(signature, ctx);
+
+		/* perform outer MD5 */
+		MD5Init(ctx);
+		MD5Update(ctx, key->hk_opad, HMAC_LEN);
+		MD5Update(ctx, signature, MD5_LEN);
+		MD5Final(signature, ctx);
+		sign_len = MD5_LEN;
+		SAFE_FREE(ctx);
+	}
+	else { 
+		if (context == NULL) 
+			return (-1);
+		*context = (void *) ctx;
+	}		
+	return (sign_len);
+}
+
+
+/************************************************************************** 
+ * dst_hmac_md5_verify() 
+ *     Calls HMAC verification routines.  There are three steps to 
+ *     verification, INIT (initialize structures), UPDATE (hash (more) data), 
+ *     FINAL (generate a signature).  This routine performs one or more of 
+ *     these steps.
+ * Parameters
+ *     mode	SIG_MODE_INIT, SIG_MODE_UPDATE and/or SIG_MODE_FINAL.
+ *     dkey	key to use for verify.
+ *     data	data signed.
+ *     len	 length in bytes of data.
+ *     signature   signature.
+ *     sig_len     length in bytes of signature.
+ * returns 
+ *     0  Success 
+ *    <0  Failure
+ */
+
+static int
+dst_hmac_md5_verify(const int mode, DST_KEY *d_key, void **context,
+		const u_char *data, const int len,
+		const u_char *signature, const int sig_len)
+{
+	HMAC_Key *key;
+	MD5_CTX *ctx = NULL;
+
+	if (d_key == NULL || d_key->dk_KEY_struct == NULL)
+		return (-1);
+
+	if (mode & SIG_MODE_INIT) 
+		ctx = (MD5_CTX *) malloc(sizeof(*ctx));
+	else if (context)
+		ctx = (MD5_CTX *) *context;
+	if (ctx == NULL) 
+		return (-1);
+
+	key = (HMAC_Key *) d_key->dk_KEY_struct;
+	if (mode & SIG_MODE_INIT) {
+		MD5Init(ctx);
+		MD5Update(ctx, key->hk_ipad, HMAC_LEN);
+	}
+	if ((mode & SIG_MODE_UPDATE) && (data && len > 0))
+		MD5Update(ctx, data, len);
+
+	if (mode & SIG_MODE_FINAL) {
+		u_char digest[MD5_LEN];
+		if (signature == NULL || key == NULL || sig_len != MD5_LEN)
+			return (VERIFY_FINAL_FAILURE);
+		MD5Final(digest, ctx);
+
+		/* perform outer MD5 */
+		MD5Init(ctx);
+		MD5Update(ctx, key->hk_opad, HMAC_LEN);
+		MD5Update(ctx, digest, MD5_LEN);
+		MD5Final(digest, ctx);
+
+		SAFE_FREE(ctx);
+		if (memcmp(digest, signature, MD5_LEN) != 0)
+			return (VERIFY_FINAL_FAILURE);
+	}
+	else { 
+		if (context == NULL) 
+			return (-1);
+		*context = (void *) ctx;
+	}		
+	return (0);
+}
+
+
+/************************************************************************** 
+ * dst_buffer_to_hmac_md5
+ *     Converts key from raw data to an HMAC Key
+ *     This function gets in a pointer to the data
+ * Parameters
+ *     hkey	the HMAC key to be filled in
+ *     key	the key in raw format
+ *     keylen	the length of the key
+ * Return
+ *	0	Success
+ *	<0	Failure
+ */
+static int
+dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen)
+{
+	int i;
+	HMAC_Key *hkey = NULL;
+	MD5_CTX ctx;
+	int local_keylen = keylen;
+	u_char tk[MD5_LEN];
+
+	if (dkey == NULL || key == NULL || keylen < 0)
+		return (-1);
+
+	if ((hkey = (HMAC_Key *) malloc(sizeof(HMAC_Key))) == NULL)
+		  return (-2);
+
+	memset(hkey->hk_ipad, 0, sizeof(hkey->hk_ipad));
+	memset(hkey->hk_opad, 0, sizeof(hkey->hk_opad));
+
+	/* if key is longer than HMAC_LEN bytes reset it to key=MD5(key) */
+	if (keylen > HMAC_LEN) {
+		MD5Init(&ctx);
+		MD5Update(&ctx, key, keylen);
+		MD5Final(tk, &ctx);
+		memset((void *) &ctx, 0, sizeof(ctx));
+		key = tk;
+		local_keylen = MD5_LEN;
+	}
+	/* start out by storing key in pads */
+	memcpy(hkey->hk_ipad, key, local_keylen);
+	memcpy(hkey->hk_opad, key, local_keylen);
+
+	/* XOR key with hk_ipad and opad values */
+	for (i = 0; i < HMAC_LEN; i++) {
+		hkey->hk_ipad[i] ^= HMAC_IPAD;
+		hkey->hk_opad[i] ^= HMAC_OPAD;
+	}
+	dkey->dk_key_size = local_keylen;
+	dkey->dk_KEY_struct = (void *) hkey;
+	return (1);
+}
+
+
+/************************************************************************** 
+ *  dst_hmac_md5_key_to_file_format
+ *	Encodes an HMAC Key into the portable file format.
+ *  Parameters 
+ *	hkey      HMAC KEY structure 
+ *	buff      output buffer
+ *	buff_len  size of output buffer 
+ *  Return
+ *	0  Failure - null input hkey
+ *     -1  Failure - not enough space in output area
+ *	N  Success - Length of data returned in buff
+ */
+
+static int
+dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
+			        const int buff_len)
+{
+	char *bp;
+	int len, i, key_len;
+	u_char key[HMAC_LEN];
+	HMAC_Key *hkey;
+
+	if (dkey == NULL || dkey->dk_KEY_struct == NULL) 
+		return (0);
+	/*
+	 * Using snprintf() would be so much simpler here.
+	 */
+	if (buff == NULL ||
+	    buff_len <= (int)(strlen(key_file_fmt_str) +
+			      strlen(KEY_FILE_FORMAT) + 4))
+		return (-1);	/*%< no OR not enough space in output area */
+	hkey = (HMAC_Key *) dkey->dk_KEY_struct;
+	memset(buff, 0, buff_len);	/*%< just in case */
+	/* write file header */
+	sprintf(buff, key_file_fmt_str, KEY_FILE_FORMAT, KEY_HMAC_MD5, "HMAC");
+
+	bp = buff + strlen(buff);
+
+	memset(key, 0, HMAC_LEN);
+	for (i = 0; i < HMAC_LEN; i++)
+		key[i] = hkey->hk_ipad[i] ^ HMAC_IPAD;
+	for (i = HMAC_LEN - 1; i >= 0; i--)
+		if (key[i] != 0)
+			break;
+	key_len = i + 1;
+
+	if (buff_len - (bp - buff) < 6)
+		return (-1);
+	strcat(bp, "Key: ");
+	bp += strlen("Key: ");
+
+	len = b64_ntop(key, key_len, bp, buff_len - (bp - buff));
+	if (len < 0) 
+		return (-1);
+	bp += len;
+	if (buff_len - (bp - buff) < 2)
+		return (-1);
+	*(bp++) = '\n';
+	*bp = '\0';
+
+	return (bp - buff);
+}
+
+
+/************************************************************************** 
+ * dst_hmac_md5_key_from_file_format
+ *     Converts contents of a key file into an HMAC key. 
+ * Parameters 
+ *     hkey    structure to put key into 
+ *     buff       buffer containing the encoded key 
+ *     buff_len   the length of the buffer
+ * Return
+ *     n >= 0 Foot print of the key converted 
+ *     n <  0 Error in conversion 
+ */
+
+static int
+dst_hmac_md5_key_from_file_format(DST_KEY *dkey, const char *buff,
+			      const int buff_len)
+{
+	const char *p = buff, *eol;
+	u_char key[HMAC_LEN+1];	/* b64_pton needs more than 64 bytes do decode
+				 * it should probably be fixed rather than doing
+				 * this
+				 */
+	u_char *tmp;
+	int key_len, len;
+
+	if (dkey == NULL)
+		return (-2);
+	if (buff == NULL || buff_len < 0)
+		return (-1);
+
+	memset(key, 0, sizeof(key));
+
+	if (!dst_s_verify_str(&p, "Key: "))
+		return (-3);
+
+	eol = strchr(p, '\n');
+	if (eol == NULL)
+		return (-4);
+	len = eol - p;
+	tmp = malloc(len + 2);
+	if (tmp == NULL)
+		return (-5);
+	memcpy(tmp, p, len);
+	*(tmp + len) = 0x0;
+	key_len = b64_pton((char *)tmp, key, HMAC_LEN+1);	/*%< see above */
+	SAFE_FREE2(tmp, len + 2);
+
+	if (dst_buffer_to_hmac_md5(dkey, key, key_len) < 0) {
+		return (-6);
+	}
+	return (0);
+}
+
+/*%
+ * dst_hmac_md5_to_dns_key() 
+ *         function to extract hmac key from DST_KEY structure 
+ * intput: 
+ *      in_key:  HMAC-MD5 key 
+ * output: 
+ *	out_str: buffer to write ot
+ *      out_len: size of output buffer 
+ * returns:
+ *      number of bytes written to output buffer 
+ */
+static int
+dst_hmac_md5_to_dns_key(const DST_KEY *in_key, u_char *out_str,
+			const int out_len)
+{
+
+	HMAC_Key *hkey;
+	int i;
+	
+	if (in_key == NULL || in_key->dk_KEY_struct == NULL ||
+	    out_len <= in_key->dk_key_size || out_str == NULL)
+		return (-1);
+
+	hkey = (HMAC_Key *) in_key->dk_KEY_struct;
+	for (i = 0; i < in_key->dk_key_size; i++)
+		out_str[i] = hkey->hk_ipad[i] ^ HMAC_IPAD;
+	return (i);
+}
+
+/************************************************************************** 
+ *  dst_hmac_md5_compare_keys
+ *	Compare two keys for equality.
+ *  Return
+ *	0	  The keys are equal
+ *	NON-ZERO   The keys are not equal
+ */
+
+static int
+dst_hmac_md5_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
+{
+	HMAC_Key *hkey1 = (HMAC_Key *) key1->dk_KEY_struct;
+	HMAC_Key *hkey2 = (HMAC_Key *) key2->dk_KEY_struct;
+	return memcmp(hkey1->hk_ipad, hkey2->hk_ipad, HMAC_LEN);
+}
+
+/************************************************************************** 
+ * dst_hmac_md5_free_key_structure
+ *     Frees all (none) dynamically allocated structures in hkey
+ */
+
+static void *
+dst_hmac_md5_free_key_structure(void *key)
+{
+	HMAC_Key *hkey = key;
+	SAFE_FREE(hkey);
+	return (NULL);
+}
+
+
+/*************************************************************************** 
+ * dst_hmac_md5_generate_key
+ *     Creates a HMAC key of size size with a maximum size of 63 bytes
+ *     generating a HMAC key larger than 63 bytes makes no sense as that key 
+ *     is digested before use. 
+ */
+
+static int
+dst_hmac_md5_generate_key(DST_KEY *key, const int nothing)
+{
+	(void)key;
+	(void)nothing;
+	return (-1);
+}
+
+/*%
+ * dst_hmac_md5_init()  Function to answer set up function pointers for HMAC
+ *	   related functions 
+ */
+int
+dst_hmac_md5_init()
+{
+	if (dst_t_func[KEY_HMAC_MD5] != NULL)
+		return (1);
+	dst_t_func[KEY_HMAC_MD5] = malloc(sizeof(struct dst_func));
+	if (dst_t_func[KEY_HMAC_MD5] == NULL)
+		return (0);
+	memset(dst_t_func[KEY_HMAC_MD5], 0, sizeof(struct dst_func));
+	dst_t_func[KEY_HMAC_MD5]->sign = dst_hmac_md5_sign;
+	dst_t_func[KEY_HMAC_MD5]->verify = dst_hmac_md5_verify;
+	dst_t_func[KEY_HMAC_MD5]->compare = dst_hmac_md5_compare_keys;
+	dst_t_func[KEY_HMAC_MD5]->generate = dst_hmac_md5_generate_key;
+	dst_t_func[KEY_HMAC_MD5]->destroy = dst_hmac_md5_free_key_structure;
+	dst_t_func[KEY_HMAC_MD5]->to_dns_key = dst_hmac_md5_to_dns_key;
+	dst_t_func[KEY_HMAC_MD5]->from_dns_key = dst_buffer_to_hmac_md5;
+	dst_t_func[KEY_HMAC_MD5]->to_file_fmt = dst_hmac_md5_key_to_file_format;
+	dst_t_func[KEY_HMAC_MD5]->from_file_fmt = dst_hmac_md5_key_from_file_format;
+	return (1);
+}
+
+#else 
+#define	dst_hmac_md5_init	__dst_hmac_md5_init
+
+int
+dst_hmac_md5_init(){
+	return (0);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/dst/support.c b/usr/src/lib/libresolv2_joy/common/dst/support.c
new file mode 100644
index 0000000000..8f827667d6
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/dst/support.c
@@ -0,0 +1,342 @@
+static const char rcsid[] = "$Header: /proj/cvs/prod/libbind/dst/support.c,v 1.6 2005/10/11 00:10:13 marka Exp $";
+
+
+/*
+ * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
+ *
+ * Permission to use, copy modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL
+ * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
+ */
+
+#include "port_before.h"
+
+#include <stdio.h>
+#include <unistd.h>
+#include <memory.h>
+#include <string.h>
+#include <errno.h>
+#include <sys/stat.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include "dst_internal.h"
+
+#include "port_after.h"
+
+/*%
+ * dst_s_verify_str()
+ *     Validate that the input string(*str) is at the head of the input
+ *     buffer(**buf).  If so, move the buffer head pointer (*buf) to
+ *     the first byte of data following the string(*str).
+ * Parameters
+ *     buf     Input buffer.
+ *     str     Input string.
+ * Return
+ *	0       *str is not the head of **buff
+ *	1       *str is the head of **buff, *buf is is advanced to
+ *	the tail of **buf.
+ */
+
+int
+dst_s_verify_str(const char **buf, const char *str)
+{
+	int b, s;
+	if (*buf == NULL)	/*%< error checks */
+		return (0);
+	if (str == NULL || *str == '\0')
+		return (1);
+
+	b = strlen(*buf);	/*%< get length of strings */
+	s = strlen(str);
+	if (s > b || strncmp(*buf, str, s))	/*%< check if same */
+		return (0);	/*%< not a match */
+	(*buf) += s;		/*%< advance pointer */
+	return (1);
+}
+
+/*%
+ * dst_s_calculate_bits
+ *     Given a binary number represented in a u_char[], determine
+ *     the number of significant bits used.
+ * Parameters
+ *     str       An input character string containing a binary number.
+ *     max_bits The maximum possible significant bits.
+ * Return
+ *     N       The number of significant bits in str.
+ */
+
+int
+dst_s_calculate_bits(const u_char *str, const int max_bits)
+{
+	const u_char *p = str;
+	u_char i, j = 0x80;
+	int bits;
+	for (bits = max_bits; *p == 0x00 && bits > 0; p++)
+		bits -= 8;
+	for (i = *p; (i & j) != j; j >>= 1)
+		bits--;
+	return (bits);
+}
+
+/*%
+ * calculates a checksum used in dst for an id.
+ * takes an array of bytes and a length.
+ * returns a 16  bit checksum.
+ */
+u_int16_t
+dst_s_id_calc(const u_char *key, const int keysize)
+{
+	u_int32_t ac;
+	const u_char *kp = key;
+	int size = keysize;
+
+	if (!key || (keysize <= 0))
+		return (0xffffU);
+ 
+	for (ac = 0; size > 1; size -= 2, kp += 2)
+		ac += ((*kp) << 8) + *(kp + 1);
+
+	if (size > 0)
+		ac += ((*kp) << 8);
+	ac += (ac >> 16) & 0xffff;
+
+	return (ac & 0xffff);
+}
+
+/*%
+ * dst_s_dns_key_id() Function to calculate DNSSEC footprint from KEY record
+ *   rdata
+ * Input:
+ *	dns_key_rdata: the raw data in wire format 
+ *      rdata_len: the size of the input data 
+ * Output:
+ *      the key footprint/id calculated from the key data 
+ */ 
+u_int16_t
+dst_s_dns_key_id(const u_char *dns_key_rdata, const int rdata_len)
+{
+	if (!dns_key_rdata)
+		return 0;
+
+	/* compute id */
+	if (dns_key_rdata[3] == KEY_RSA)	/*%< Algorithm RSA */
+		return dst_s_get_int16((const u_char *)
+				       &dns_key_rdata[rdata_len - 3]);
+	else if (dns_key_rdata[3] == KEY_HMAC_MD5)
+		/* compatibility */
+		return 0;
+	else
+		/* compute a checksum on the key part of the key rr */
+		return dst_s_id_calc(dns_key_rdata, rdata_len);
+}
+
+/*%
+ * dst_s_get_int16
+ *     This routine extracts a 16 bit integer from a two byte character
+ *     string.  The character string is assumed to be in network byte
+ *     order and may be unaligned.  The number returned is in host order.
+ * Parameter
+ *     buf     A two byte character string.
+ * Return
+ *     The converted integer value.
+ */
+
+u_int16_t
+dst_s_get_int16(const u_char *buf)
+{
+	register u_int16_t a = 0;
+	a = ((u_int16_t)(buf[0] << 8)) | ((u_int16_t)(buf[1]));
+	return (a);
+}
+
+/*%
+ * dst_s_get_int32
+ *     This routine extracts a 32 bit integer from a four byte character
+ *     string.  The character string is assumed to be in network byte
+ *     order and may be unaligned.  The number returned is in host order.
+ * Parameter
+ *     buf     A four byte character string.
+ * Return
+ *     The converted integer value.
+ */
+
+u_int32_t
+dst_s_get_int32(const u_char *buf)
+{
+	register u_int32_t a = 0;
+	a = ((u_int32_t)(buf[0] << 24)) | ((u_int32_t)(buf[1] << 16)) |
+		((u_int32_t)(buf[2] << 8)) | ((u_int32_t)(buf[3]));
+	return (a);
+}
+
+/*%
+ * dst_s_put_int16
+ *     Take a 16 bit integer and store the value in a two byte
+ *     character string.  The integer is assumed to be in network
+ *     order and the string is returned in host order.
+ *
+ * Parameters
+ *     buf     Storage for a two byte character string.
+ *     val     16 bit integer.
+ */
+
+void
+dst_s_put_int16(u_int8_t *buf, const u_int16_t val)
+{
+	buf[0] = (u_int8_t)(val >> 8);
+	buf[1] = (u_int8_t)(val);
+}
+
+/*%
+ * dst_s_put_int32
+ *     Take a 32 bit integer and store the value in a four byte
+ *     character string.  The integer is assumed to be in network
+ *     order and the string is returned in host order.
+ *
+ * Parameters
+ *     buf     Storage for a four byte character string.
+ *     val     32 bit integer.
+ */
+
+void
+dst_s_put_int32(u_int8_t *buf, const u_int32_t val)
+{
+	buf[0] = (u_int8_t)(val >> 24);
+	buf[1] = (u_int8_t)(val >> 16);
+	buf[2] = (u_int8_t)(val >> 8);
+	buf[3] = (u_int8_t)(val);
+}
+
+/*%
+ *  dst_s_filename_length
+ *
+ *	This function returns the number of bytes needed to hold the
+ *	filename for a key file.  '/', '\' and ':' are not allowed.
+ *	form:  K&lt;keyname&gt;+&lt;alg&gt;+&lt;id&gt;.&lt;suffix&gt;
+ *
+ *	Returns 0 if the filename would contain either '\', '/' or ':'
+ */
+size_t
+dst_s_filename_length(const char *name, const char *suffix)
+{
+	if (name == NULL)
+		return (0);
+	if (strrchr(name, '\\'))
+		return (0);
+	if (strrchr(name, '/'))
+		return (0);
+	if (strrchr(name, ':'))
+		return (0);
+	if (suffix == NULL)
+		return (0);
+	if (strrchr(suffix, '\\'))
+		return (0);
+	if (strrchr(suffix, '/'))
+		return (0);
+	if (strrchr(suffix, ':'))
+		return (0);
+	return (1 + strlen(name) + 6 + strlen(suffix));
+}
+
+/*%
+ *  dst_s_build_filename ()
+ *	Builds a key filename from the key name, it's id, and a
+ *	suffix.  '\', '/' and ':' are not allowed. fA filename is of the
+ *	form:  K&lt;keyname&gt;&lt;id&gt;.&lt;suffix&gt;
+ *	form: K&lt;keyname&gt;+&lt;alg&gt;+&lt;id&gt;.&lt;suffix&gt;
+ *
+ *	Returns -1 if the conversion fails:
+ *	  if the filename would be too long for space allotted
+ *	  if the filename would contain a '\', '/' or ':'
+ *	Returns 0 on success
+ */
+
+int
+dst_s_build_filename(char *filename, const char *name, u_int16_t id,
+		     int alg, const char *suffix, size_t filename_length)
+{
+	u_int32_t my_id;
+	if (filename == NULL)
+		return (-1);
+	memset(filename, 0, filename_length);
+	if (name == NULL)
+		return (-1);
+	if (suffix == NULL)
+		return (-1);
+	if (filename_length < 1 + strlen(name) + 4 + 6 + 1 + strlen(suffix))
+		return (-1);
+	my_id = id;
+	sprintf(filename, "K%s+%03d+%05d.%s", name, alg, my_id,
+		(const char *) suffix);
+	if (strrchr(filename, '/'))
+		return (-1);
+	if (strrchr(filename, '\\'))
+		return (-1);
+	if (strrchr(filename, ':'))
+		return (-1);
+	return (0);
+}
+
+/*%
+ *  dst_s_fopen ()
+ *     Open a file in the dst_path directory.  If perm is specified, the
+ *     file is checked for existence first, and not opened if it exists.
+ *  Parameters
+ *     filename  File to open
+ *     mode       Mode to open the file (passed directly to fopen)
+ *     perm       File permission, if creating a new file.
+ *  Returns
+ *     NULL       Failure
+ *     NON-NULL  (FILE *) of opened file.
+ */
+FILE *
+dst_s_fopen(const char *filename, const char *mode, int perm)
+{
+	FILE *fp;
+	char pathname[PATH_MAX];
+
+	if (strlen(filename) + strlen(dst_path) >= sizeof(pathname))
+		return (NULL);
+
+	if (*dst_path != '\0') {
+		strcpy(pathname, dst_path);
+		strcat(pathname, filename);
+	} else
+		strcpy(pathname, filename);
+	
+	fp = fopen(pathname, mode);
+	if (perm)
+		chmod(pathname, perm);
+	return (fp);
+}
+
+void
+dst_s_dump(const int mode, const u_char *data, const int size, 
+	    const char *msg)
+{
+	UNUSED(data);
+
+	if (size > 0) {
+#ifdef LONG_TEST
+		static u_char scratch[1000];
+		int n ;
+		n = b64_ntop(data, scratch, size, sizeof(scratch));
+		printf("%s: %x %d %s\n", msg, mode, n, scratch);
+#else
+		printf("%s,%x %d\n", msg, mode, size);
+#endif
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_cidr_ntop.c b/usr/src/lib/libresolv2_joy/common/inet/inet_cidr_ntop.c
new file mode 100644
index 0000000000..bf960a8acc
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_cidr_ntop.c
@@ -0,0 +1,263 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: inet_cidr_ntop.c,v 1.7 2006/10/11 02:18:18 marka Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+static char *
+inet_cidr_ntop_ipv4(const u_char *src, int bits, char *dst, size_t size);
+static char *
+inet_cidr_ntop_ipv6(const u_char *src, int bits, char *dst, size_t size);
+
+/*%
+ * char *
+ * inet_cidr_ntop(af, src, bits, dst, size)
+ *	convert network address from network to presentation format.
+ *	"src"'s size is determined from its "af".
+ * return:
+ *	pointer to dst, or NULL if an error occurred (check errno).
+ * note:
+ *	192.5.5.1/28 has a nonzero host part, which means it isn't a network
+ *	as called for by inet_net_ntop() but it can be a host address with
+ *	an included netmask.
+ * author:
+ *	Paul Vixie (ISC), October 1998
+ */
+char *
+inet_cidr_ntop(int af, const void *src, int bits, char *dst, size_t size) {
+	switch (af) {
+	case AF_INET:
+		return (inet_cidr_ntop_ipv4(src, bits, dst, size));
+	case AF_INET6:
+		return (inet_cidr_ntop_ipv6(src, bits, dst, size));
+	default:
+		errno = EAFNOSUPPORT;
+		return (NULL);
+	}
+}
+
+static int
+decoct(const u_char *src, int bytes, char *dst, size_t size) {
+	char *odst = dst;
+	char *t;
+	int b;
+
+	for (b = 1; b <= bytes; b++) {
+		if (size < sizeof "255.")
+			return (0);
+		t = dst;
+		dst += SPRINTF((dst, "%u", *src++));
+		if (b != bytes) {
+			*dst++ = '.';
+			*dst = '\0';
+		}
+		size -= (size_t)(dst - t);
+	}
+	return (dst - odst);
+}
+
+/*%
+ * static char *
+ * inet_cidr_ntop_ipv4(src, bits, dst, size)
+ *	convert IPv4 network address from network to presentation format.
+ *	"src"'s size is determined from its "af".
+ * return:
+ *	pointer to dst, or NULL if an error occurred (check errno).
+ * note:
+ *	network byte order assumed.  this means 192.5.5.240/28 has
+ *	0b11110000 in its fourth octet.
+ * author:
+ *	Paul Vixie (ISC), October 1998
+ */
+static char *
+inet_cidr_ntop_ipv4(const u_char *src, int bits, char *dst, size_t size) {
+	char *odst = dst;
+	size_t len = 4;
+	size_t b;
+	size_t bytes;
+
+	if ((bits < -1) || (bits > 32)) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
+	/* Find number of significant bytes in address. */
+	if (bits == -1)
+		len = 4;
+	else
+		for (len = 1, b = 1 ; b < 4U; b++)
+			if (*(src + b))
+				len = b + 1;
+
+	/* Format whole octets plus nonzero trailing octets. */
+	bytes = (((bits <= 0) ? 1 : bits) + 7) / 8;
+	if (len > bytes)
+		bytes = len;
+	b = decoct(src, bytes, dst, size);
+	if (b == 0U)
+		goto emsgsize;
+	dst += b;
+	size -= b;
+
+	if (bits != -1) {
+		/* Format CIDR /width. */
+		if (size < sizeof "/32")
+			goto emsgsize;
+		dst += SPRINTF((dst, "/%u", bits));
+	}
+
+	return (odst);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (NULL);
+}
+ 
+static char *
+inet_cidr_ntop_ipv6(const u_char *src, int bits, char *dst, size_t size) {
+	/*
+	 * Note that int32_t and int16_t need only be "at least" large enough
+	 * to contain a value of the specified size.  On some systems, like
+	 * Crays, there is no such thing as an integer variable with 16 bits.
+	 * Keep this in mind if you think this function should have been coded
+	 * to use pointer overlays.  All the world's not a VAX.
+	 */
+	char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255/128"];
+	char *tp;
+	struct { int base, len; } best, cur;
+	u_int words[NS_IN6ADDRSZ / NS_INT16SZ];
+	int i;
+
+	if ((bits < -1) || (bits > 128)) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
+	/*
+	 * Preprocess:
+	 *	Copy the input (bytewise) array into a wordwise array.
+	 *	Find the longest run of 0x00's in src[] for :: shorthanding.
+	 */
+	memset(words, '\0', sizeof words);
+	for (i = 0; i < NS_IN6ADDRSZ; i++)
+		words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
+	best.base = -1;
+	best.len = 0;
+	cur.base = -1;
+	cur.len = 0;
+	for (i = 0; i < (NS_IN6ADDRSZ / NS_INT16SZ); i++) {
+		if (words[i] == 0) {
+			if (cur.base == -1)
+				cur.base = i, cur.len = 1;
+			else
+				cur.len++;
+		} else {
+			if (cur.base != -1) {
+				if (best.base == -1 || cur.len > best.len)
+					best = cur;
+				cur.base = -1;
+			}
+		}
+	}
+	if (cur.base != -1) {
+		if (best.base == -1 || cur.len > best.len)
+			best = cur;
+	}
+	if (best.base != -1 && best.len < 2)
+		best.base = -1;
+
+	/*
+	 * Format the result.
+	 */
+	tp = tmp;
+	for (i = 0; i < (NS_IN6ADDRSZ / NS_INT16SZ); i++) {
+		/* Are we inside the best run of 0x00's? */
+		if (best.base != -1 && i >= best.base &&
+		    i < (best.base + best.len)) {
+			if (i == best.base)
+				*tp++ = ':';
+			continue;
+		}
+		/* Are we following an initial run of 0x00s or any real hex? */
+		if (i != 0)
+			*tp++ = ':';
+		/* Is this address an encapsulated IPv4? */
+		if (i == 6 && best.base == 0 && (best.len == 6 ||
+		    (best.len == 7 && words[7] != 0x0001) ||
+		    (best.len == 5 && words[5] == 0xffff))) {
+			int n;
+
+			if (src[15] || bits == -1 || bits > 120)
+				n = 4;
+			else if (src[14] || bits > 112)
+				n = 3;
+			else
+				n = 2;
+			n = decoct(src+12, n, tp, sizeof tmp - (tp - tmp));
+			if (n == 0) {
+				errno = EMSGSIZE;
+				return (NULL);
+			}
+			tp += strlen(tp);
+			break;
+		}
+		tp += SPRINTF((tp, "%x", words[i]));
+	}
+
+	/* Was it a trailing run of 0x00's? */
+	if (best.base != -1 && (best.base + best.len) == 
+	    (NS_IN6ADDRSZ / NS_INT16SZ))
+		*tp++ = ':';
+	*tp = '\0';
+
+	if (bits != -1)
+		tp += SPRINTF((tp, "/%u", bits));
+
+	/*
+	 * Check for overflow, copy, and we're done.
+	 */
+	if ((size_t)(tp - tmp) > size) {
+		errno = EMSGSIZE;
+		return (NULL);
+	}
+	strcpy(dst, tmp);
+	return (dst);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_cidr_pton.c b/usr/src/lib/libresolv2_joy/common/inet/inet_cidr_pton.c
new file mode 100644
index 0000000000..07652af463
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_cidr_pton.c
@@ -0,0 +1,277 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: inet_cidr_pton.c,v 1.6 2005/04/27 04:56:19 sra Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <isc/assertions.h>
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+static int	inet_cidr_pton_ipv4 __P((const char *src, u_char *dst,
+					 int *bits, int ipv6));
+static int	inet_cidr_pton_ipv6 __P((const char *src, u_char *dst,
+					 int *bits));
+
+static int	getbits(const char *, int ipv6);
+
+/*%
+ * int
+ * inet_cidr_pton(af, src, dst, *bits)
+ *	convert network address from presentation to network format.
+ *	accepts inet_pton()'s input for this "af" plus trailing "/CIDR".
+ *	"dst" is assumed large enough for its "af".  "bits" is set to the
+ *	/CIDR prefix length, which can have defaults (like /32 for IPv4).
+ * return:
+ *	-1 if an error occurred (inspect errno; ENOENT means bad format).
+ *	0 if successful conversion occurred.
+ * note:
+ *	192.5.5.1/28 has a nonzero host part, which means it isn't a network
+ *	as called for by inet_net_pton() but it can be a host address with
+ *	an included netmask.
+ * author:
+ *	Paul Vixie (ISC), October 1998
+ */
+int
+inet_cidr_pton(int af, const char *src, void *dst, int *bits) {
+	switch (af) {
+	case AF_INET:
+		return (inet_cidr_pton_ipv4(src, dst, bits, 0));
+	case AF_INET6:
+		return (inet_cidr_pton_ipv6(src, dst, bits));
+	default:
+		errno = EAFNOSUPPORT;
+		return (-1);
+	}
+}
+
+static const char digits[] = "0123456789";
+
+static int
+inet_cidr_pton_ipv4(const char *src, u_char *dst, int *pbits, int ipv6) {
+	const u_char *odst = dst;
+	int n, ch, tmp, bits;
+	size_t size = 4;
+
+	/* Get the mantissa. */
+	while (ch = *src++, (isascii(ch) && isdigit(ch))) {
+		tmp = 0;
+		do {
+			n = strchr(digits, ch) - digits;
+			INSIST(n >= 0 && n <= 9);
+			tmp *= 10;
+			tmp += n;
+			if (tmp > 255)
+				goto enoent;
+		} while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch));
+		if (size-- == 0U)
+			goto emsgsize;
+		*dst++ = (u_char) tmp;
+		if (ch == '\0' || ch == '/')
+			break;
+		if (ch != '.')
+			goto enoent;
+	}
+
+	/* Get the prefix length if any. */
+	bits = -1;
+	if (ch == '/' && dst > odst) {
+		bits = getbits(src, ipv6);
+		if (bits == -2)
+			goto enoent;
+	} else if (ch != '\0')
+		goto enoent;
+
+	/* Prefix length can default to /32 only if all four octets spec'd. */
+	if (bits == -1) {
+		if (dst - odst == 4)
+			bits = ipv6 ? 128 : 32;
+		else
+			goto enoent;
+	}
+
+	/* If nothing was written to the destination, we found no address. */
+	if (dst == odst)
+		goto enoent;
+
+	/* If prefix length overspecifies mantissa, life is bad. */
+	if (((bits - (ipv6 ? 96 : 0)) / 8) > (dst - odst))
+		goto enoent;
+
+	/* Extend address to four octets. */
+	while (size-- > 0U)
+		*dst++ = 0;
+
+	*pbits = bits;
+	return (0);
+
+ enoent:
+	errno = ENOENT;
+	return (-1);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (-1);
+}
+
+static int
+inet_cidr_pton_ipv6(const char *src, u_char *dst, int *pbits) {
+	static const char xdigits_l[] = "0123456789abcdef",
+			  xdigits_u[] = "0123456789ABCDEF";
+	u_char tmp[NS_IN6ADDRSZ], *tp, *endp, *colonp;
+	const char *xdigits, *curtok;
+	int ch, saw_xdigit;
+	u_int val;
+	int bits;
+
+	memset((tp = tmp), '\0', NS_IN6ADDRSZ);
+	endp = tp + NS_IN6ADDRSZ;
+	colonp = NULL;
+	/* Leading :: requires some special handling. */
+	if (*src == ':')
+		if (*++src != ':')
+			return (0);
+	curtok = src;
+	saw_xdigit = 0;
+	val = 0;
+	bits = -1;
+	while ((ch = *src++) != '\0') {
+		const char *pch;
+
+		if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL)
+			pch = strchr((xdigits = xdigits_u), ch);
+		if (pch != NULL) {
+			val <<= 4;
+			val |= (pch - xdigits);
+			if (val > 0xffff)
+				return (0);
+			saw_xdigit = 1;
+			continue;
+		}
+		if (ch == ':') {
+			curtok = src;
+			if (!saw_xdigit) {
+				if (colonp)
+					return (0);
+				colonp = tp;
+				continue;
+			} else if (*src == '\0') {
+				return (0);
+			}
+			if (tp + NS_INT16SZ > endp)
+				return (0);
+			*tp++ = (u_char) (val >> 8) & 0xff;
+			*tp++ = (u_char) val & 0xff;
+			saw_xdigit = 0;
+			val = 0;
+			continue;
+		}
+		if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) &&
+		    inet_cidr_pton_ipv4(curtok, tp, &bits, 1) == 0) {
+			tp += NS_INADDRSZ;
+			saw_xdigit = 0;
+			break;	/*%< '\\0' was seen by inet_pton4(). */
+		}
+		if (ch == '/') {
+			bits = getbits(src, 1);
+			if (bits == -2)
+				goto enoent;
+			break;
+		}
+		goto enoent;
+	}
+	if (saw_xdigit) {
+		if (tp + NS_INT16SZ > endp)
+			goto emsgsize;
+		*tp++ = (u_char) (val >> 8) & 0xff;
+		*tp++ = (u_char) val & 0xff;
+	}
+	if (colonp != NULL) {
+		/*
+		 * Since some memmove()'s erroneously fail to handle
+		 * overlapping regions, we'll do the shift by hand.
+		 */
+		const int n = tp - colonp;
+		int i;
+
+		if (tp == endp)
+			goto enoent;
+		for (i = 1; i <= n; i++) {
+			endp[- i] = colonp[n - i];
+			colonp[n - i] = 0;
+		}
+		tp = endp;
+	}
+
+	memcpy(dst, tmp, NS_IN6ADDRSZ);
+
+	*pbits = bits;
+	return (0);
+
+ enoent:
+	errno = ENOENT;
+	return (-1);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (-1);
+}
+
+static int
+getbits(const char *src, int ipv6) {
+	int bits = 0;
+	char *cp, ch;
+	
+	if (*src == '\0')			/*%< syntax */
+		return (-2);
+	do {
+		ch = *src++;
+		cp = strchr(digits, ch);
+		if (cp == NULL)			/*%< syntax */
+			return (-2);
+		bits *= 10;
+		bits += cp - digits;
+		if (bits == 0 && *src != '\0')	/*%< no leading zeros */
+			return (-2);
+		if (bits > (ipv6 ? 128 : 32))	/*%< range error */
+			return (-2);
+	} while (*src != '\0');
+
+	return (bits);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_data.c b/usr/src/lib/libresolv2_joy/common/inet/inet_data.c
new file mode 100644
index 0000000000..58b8c4342d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_data.c
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static char rcsid[] = "$Id: inet_data.c,v 1.4 2005/04/27 04:56:19 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "port_after.h"
+
+const struct in6_addr isc_in6addr_any = IN6ADDR_ANY_INIT;
+const struct in6_addr isc_in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_lnaof.c b/usr/src/lib/libresolv2_joy/common/inet/inet_lnaof.c
new file mode 100644
index 0000000000..70ac409512
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_lnaof.c
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 1983, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)inet_lnaof.c	8.1 (Berkeley) 6/4/93";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include "port_after.h"
+
+/*%
+ * Return the local network address portion of an
+ * internet address; handles class a/b/c network
+ * number formats.
+ */
+u_long
+inet_lnaof(in)
+	struct in_addr in;
+{
+	register u_long i = ntohl(in.s_addr);
+
+	if (IN_CLASSA(i))
+		return ((i)&IN_CLASSA_HOST);
+	else if (IN_CLASSB(i))
+		return ((i)&IN_CLASSB_HOST);
+	else
+		return ((i)&IN_CLASSC_HOST);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_makeaddr.c b/usr/src/lib/libresolv2_joy/common/inet/inet_makeaddr.c
new file mode 100644
index 0000000000..c56cb3eaeb
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_makeaddr.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 1983, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)inet_makeaddr.c	8.1 (Berkeley) 6/4/93";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include "port_after.h"
+
+/*%
+ * Formulate an Internet address from network + host.  Used in
+ * building addresses stored in the ifnet structure.
+ */
+struct in_addr
+inet_makeaddr(net, host)
+	u_long net, host;
+{
+	struct in_addr a;
+
+	if (net < 128U)
+		a.s_addr = (net << IN_CLASSA_NSHIFT) | (host & IN_CLASSA_HOST);
+	else if (net < 65536U)
+		a.s_addr = (net << IN_CLASSB_NSHIFT) | (host & IN_CLASSB_HOST);
+	else if (net < 16777216L)
+		a.s_addr = (net << IN_CLASSC_NSHIFT) | (host & IN_CLASSC_HOST);
+	else
+		a.s_addr = net | host;
+	a.s_addr = htonl(a.s_addr);
+	return (a);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_net_ntop.c b/usr/src/lib/libresolv2_joy/common/inet/inet_net_ntop.c
new file mode 100644
index 0000000000..fb28e3cbe5
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_net_ntop.c
@@ -0,0 +1,279 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: inet_net_ntop.c,v 1.5 2006/06/20 02:50:14 marka Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+static char *	inet_net_ntop_ipv4 __P((const u_char *src, int bits,
+					char *dst, size_t size));
+static char *	inet_net_ntop_ipv6 __P((const u_char *src, int bits,
+					char *dst, size_t size));
+
+/*%
+ * char *
+ * inet_net_ntop(af, src, bits, dst, size)
+ *	convert network number from network to presentation format.
+ *	generates CIDR style result always.
+ * return:
+ *	pointer to dst, or NULL if an error occurred (check errno).
+ * author:
+ *	Paul Vixie (ISC), July 1996
+ */
+char *
+inet_net_ntop(af, src, bits, dst, size)
+	int af;
+	const void *src;
+	int bits;
+	char *dst;
+	size_t size;
+{
+	switch (af) {
+	case AF_INET:
+		return (inet_net_ntop_ipv4(src, bits, dst, size));
+	case AF_INET6:
+		return (inet_net_ntop_ipv6(src, bits, dst, size));
+	default:
+		errno = EAFNOSUPPORT;
+		return (NULL);
+	}
+}
+
+/*%
+ * static char *
+ * inet_net_ntop_ipv4(src, bits, dst, size)
+ *	convert IPv4 network number from network to presentation format.
+ *	generates CIDR style result always.
+ * return:
+ *	pointer to dst, or NULL if an error occurred (check errno).
+ * note:
+ *	network byte order assumed.  this means 192.5.5.240/28 has
+ *	0b11110000 in its fourth octet.
+ * author:
+ *	Paul Vixie (ISC), July 1996
+ */
+static char *
+inet_net_ntop_ipv4(src, bits, dst, size)
+	const u_char *src;
+	int bits;
+	char *dst;
+	size_t size;
+{
+	char *odst = dst;
+	char *t;
+	u_int m;
+	int b;
+
+	if (bits < 0 || bits > 32) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
+	if (bits == 0) {
+		if (size < sizeof "0")
+			goto emsgsize;
+		*dst++ = '0';
+		size--;
+		*dst = '\0';
+	}
+
+	/* Format whole octets. */
+	for (b = bits / 8; b > 0; b--) {
+		if (size <= sizeof "255.")
+			goto emsgsize;
+		t = dst;
+		dst += SPRINTF((dst, "%u", *src++));
+		if (b > 1) {
+			*dst++ = '.';
+			*dst = '\0';
+		}
+		size -= (size_t)(dst - t);
+	}
+
+	/* Format partial octet. */
+	b = bits % 8;
+	if (b > 0) {
+		if (size <= sizeof ".255")
+			goto emsgsize;
+		t = dst;
+		if (dst != odst)
+			*dst++ = '.';
+		m = ((1 << b) - 1) << (8 - b);
+		dst += SPRINTF((dst, "%u", *src & m));
+		size -= (size_t)(dst - t);
+	}
+
+	/* Format CIDR /width. */
+	if (size <= sizeof "/32")
+		goto emsgsize;
+	dst += SPRINTF((dst, "/%u", bits));
+	return (odst);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (NULL);
+}
+
+/*%
+ * static char *
+ * inet_net_ntop_ipv6(src, bits, fakebits, dst, size)
+ *	convert IPv6 network number from network to presentation format.
+ *	generates CIDR style result always. Picks the shortest representation
+ *	unless the IP is really IPv4.
+ *	always prints specified number of bits (bits).
+ * return:
+ *	pointer to dst, or NULL if an error occurred (check errno).
+ * note:
+ *	network byte order assumed.  this means 192.5.5.240/28 has
+ *	0x11110000 in its fourth octet.
+ * author:
+ *	Vadim Kogan (UCB), June 2001
+ *  Original version (IPv4) by Paul Vixie (ISC), July 1996
+ */
+
+static char *
+inet_net_ntop_ipv6(const u_char *src, int bits, char *dst, size_t size) {
+	u_int	m;
+	int	b;
+	int	p;
+	int	zero_s, zero_l, tmp_zero_s, tmp_zero_l;
+	int	i;
+	int	is_ipv4 = 0;
+	unsigned char inbuf[16];
+	char outbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255/128")];
+	char	*cp;
+	int	words;
+	u_char	*s;
+
+	if (bits < 0 || bits > 128) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
+	cp = outbuf;
+
+	if (bits == 0) {
+		*cp++ = ':';
+		*cp++ = ':';
+		*cp = '\0';
+	} else {
+		/* Copy src to private buffer.  Zero host part. */	
+		p = (bits + 7) / 8;
+		memcpy(inbuf, src, p);
+		memset(inbuf + p, 0, 16 - p);
+		b = bits % 8;
+		if (b != 0) {
+			m = ~0 << (8 - b);
+			inbuf[p-1] &= m;
+		}
+
+		s = inbuf;
+
+		/* how many words need to be displayed in output */
+		words = (bits + 15) / 16;
+		if (words == 1)
+			words = 2;
+		
+		/* Find the longest substring of zero's */
+		zero_s = zero_l = tmp_zero_s = tmp_zero_l = 0;
+		for (i = 0; i < (words * 2); i += 2) {
+			if ((s[i] | s[i+1]) == 0) {
+				if (tmp_zero_l == 0)
+					tmp_zero_s = i / 2;
+				tmp_zero_l++;
+			} else {
+				if (tmp_zero_l && zero_l < tmp_zero_l) {
+					zero_s = tmp_zero_s;
+					zero_l = tmp_zero_l;
+					tmp_zero_l = 0;
+				}
+			}
+		}
+
+		if (tmp_zero_l && zero_l < tmp_zero_l) {
+			zero_s = tmp_zero_s;
+			zero_l = tmp_zero_l;
+		}
+
+		if (zero_l != words && zero_s == 0 && ((zero_l == 6) ||
+		    ((zero_l == 5 && s[10] == 0xff && s[11] == 0xff) ||
+		    ((zero_l == 7 && s[14] != 0 && s[15] != 1)))))
+			is_ipv4 = 1;
+
+		/* Format whole words. */
+		for (p = 0; p < words; p++) {
+			if (zero_l != 0 && p >= zero_s && p < zero_s + zero_l) {
+				/* Time to skip some zeros */
+				if (p == zero_s)
+					*cp++ = ':';
+				if (p == words - 1)
+					*cp++ = ':';
+				s++;
+				s++;
+				continue;
+			}
+
+			if (is_ipv4 && p > 5 ) {
+				*cp++ = (p == 6) ? ':' : '.';
+				cp += SPRINTF((cp, "%u", *s++));
+				/* we can potentially drop the last octet */
+				if (p != 7 || bits > 120) {
+					*cp++ = '.';
+					cp += SPRINTF((cp, "%u", *s++));
+				}
+			} else {
+				if (cp != outbuf)
+					*cp++ = ':';
+				cp += SPRINTF((cp, "%x", *s * 256 + s[1]));
+				s += 2;
+			}
+		}
+	}
+	/* Format CIDR /width. */
+	sprintf(cp, "/%u", bits);
+	if (strlen(outbuf) + 1 > size)
+		goto emsgsize;
+	strcpy(dst, outbuf);
+	
+	return (dst);
+
+emsgsize:
+	errno = EMSGSIZE;
+	return (NULL);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_net_pton.c b/usr/src/lib/libresolv2_joy/common/inet/inet_net_pton.c
new file mode 100644
index 0000000000..8d8bfb1f64
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_net_pton.c
@@ -0,0 +1,407 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1996, 1998, 1999, 2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: inet_net_pton.c,v 1.10 2008/11/14 02:36:51 marka Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <isc/assertions.h>
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+/*%
+ * static int
+ * inet_net_pton_ipv4(src, dst, size)
+ *	convert IPv4 network number from presentation to network format.
+ *	accepts hex octets, hex strings, decimal octets, and /CIDR.
+ *	"size" is in bytes and describes "dst".
+ * return:
+ *	number of bits, either imputed classfully or specified with /CIDR,
+ *	or -1 if some failure occurred (check errno).  ENOENT means it was
+ *	not an IPv4 network specification.
+ * note:
+ *	network byte order assumed.  this means 192.5.5.240/28 has
+ *	0b11110000 in its fourth octet.
+ * author:
+ *	Paul Vixie (ISC), June 1996
+ */
+static int
+inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
+	static const char xdigits[] = "0123456789abcdef";
+	static const char digits[] = "0123456789";
+	int n, ch, tmp = 0, dirty, bits;
+	const u_char *odst = dst;
+
+	ch = *src++;
+	if (ch == '0' && (src[0] == 'x' || src[0] == 'X')
+	    && isascii((unsigned char)(src[1]))
+	    && isxdigit((unsigned char)(src[1]))) {
+		/* Hexadecimal: Eat nybble string. */
+		if (size <= 0U)
+			goto emsgsize;
+		dirty = 0;
+		src++;	/*%< skip x or X. */
+		while ((ch = *src++) != '\0' && isascii(ch) && isxdigit(ch)) {
+			if (isupper(ch))
+				ch = tolower(ch);
+			n = strchr(xdigits, ch) - xdigits;
+			INSIST(n >= 0 && n <= 15);
+			if (dirty == 0)
+				tmp = n;
+			else
+				tmp = (tmp << 4) | n;
+			if (++dirty == 2) {
+				if (size-- <= 0U)
+					goto emsgsize;
+				*dst++ = (u_char) tmp;
+				dirty = 0;
+			}
+		}
+		if (dirty) {  /*%< Odd trailing nybble? */
+			if (size-- <= 0U)
+				goto emsgsize;
+			*dst++ = (u_char) (tmp << 4);
+		}
+	} else if (isascii(ch) && isdigit(ch)) {
+		/* Decimal: eat dotted digit string. */
+		for (;;) {
+			tmp = 0;
+			do {
+				n = strchr(digits, ch) - digits;
+				INSIST(n >= 0 && n <= 9);
+				tmp *= 10;
+				tmp += n;
+				if (tmp > 255)
+					goto enoent;
+			} while ((ch = *src++) != '\0' &&
+				 isascii(ch) && isdigit(ch));
+			if (size-- <= 0U)
+				goto emsgsize;
+			*dst++ = (u_char) tmp;
+			if (ch == '\0' || ch == '/')
+				break;
+			if (ch != '.')
+				goto enoent;
+			ch = *src++;
+			if (!isascii(ch) || !isdigit(ch))
+				goto enoent;
+		}
+	} else
+		goto enoent;
+
+	bits = -1;
+	if (ch == '/' && isascii((unsigned char)(src[0])) &&
+	    isdigit((unsigned char)(src[0])) && dst > odst) {
+		/* CIDR width specifier.  Nothing can follow it. */
+		ch = *src++;	/*%< Skip over the /. */
+		bits = 0;
+		do {
+			n = strchr(digits, ch) - digits;
+			INSIST(n >= 0 && n <= 9);
+			bits *= 10;
+			bits += n;
+			if (bits > 32)
+				goto enoent;
+		} while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch));
+		if (ch != '\0')
+			goto enoent;
+	}
+
+	/* Firey death and destruction unless we prefetched EOS. */
+	if (ch != '\0')
+		goto enoent;
+
+	/* If nothing was written to the destination, we found no address. */
+	if (dst == odst)
+		goto enoent;
+	/* If no CIDR spec was given, infer width from net class. */
+	if (bits == -1) {
+		if (*odst >= 240)	/*%< Class E */
+			bits = 32;
+		else if (*odst >= 224)	/*%< Class D */
+			bits = 8;
+		else if (*odst >= 192)	/*%< Class C */
+			bits = 24;
+		else if (*odst >= 128)	/*%< Class B */
+			bits = 16;
+		else			/*%< Class A */
+			bits = 8;
+		/* If imputed mask is narrower than specified octets, widen. */
+		if (bits < ((dst - odst) * 8))
+			bits = (dst - odst) * 8;
+		/*
+		 * If there are no additional bits specified for a class D
+		 * address adjust bits to 4.
+		 */
+		if (bits == 8 && *odst == 224)
+			bits = 4;
+	}
+	/* Extend network to cover the actual mask. */
+	while (bits > ((dst - odst) * 8)) {
+		if (size-- <= 0U)
+			goto emsgsize;
+		*dst++ = '\0';
+	}
+	return (bits);
+
+ enoent:
+	errno = ENOENT;
+	return (-1);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (-1);
+}
+
+static int
+getbits(const char *src, int *bitsp) {
+	static const char digits[] = "0123456789";
+	int n;
+	int val;
+	char ch;
+
+	val = 0;
+	n = 0;
+	while ((ch = *src++) != '\0') {
+		const char *pch;
+
+		pch = strchr(digits, ch);
+		if (pch != NULL) {
+			if (n++ != 0 && val == 0)	/*%< no leading zeros */
+				return (0);
+			val *= 10;
+			val += (pch - digits);
+			if (val > 128)			/*%< range */
+				return (0);
+			continue;
+		}
+		return (0);
+	}
+	if (n == 0)
+		return (0);
+	*bitsp = val;
+	return (1);
+}
+
+static int
+getv4(const char *src, u_char *dst, int *bitsp) {
+	static const char digits[] = "0123456789";
+	u_char *odst = dst;
+	int n;
+	u_int val;
+	char ch;
+
+	val = 0;
+	n = 0;
+	while ((ch = *src++) != '\0') {
+		const char *pch;
+
+		pch = strchr(digits, ch);
+		if (pch != NULL) {
+			if (n++ != 0 && val == 0)	/*%< no leading zeros */
+				return (0);
+			val *= 10;
+			val += (pch - digits);
+			if (val > 255)			/*%< range */
+				return (0);
+			continue;
+		}
+		if (ch == '.' || ch == '/') {
+			if (dst - odst > 3)		/*%< too many octets? */
+				return (0);
+			*dst++ = val;
+			if (ch == '/')
+				return (getbits(src, bitsp));
+			val = 0;
+			n = 0;
+			continue;
+		}
+		return (0);
+	}
+	if (n == 0)
+		return (0);
+	if (dst - odst > 3)		/*%< too many octets? */
+		return (0);
+	*dst++ = val;
+	return (1);
+}
+
+static int
+inet_net_pton_ipv6(const char *src, u_char *dst, size_t size) {
+	static const char xdigits_l[] = "0123456789abcdef",
+			  xdigits_u[] = "0123456789ABCDEF";
+	u_char tmp[NS_IN6ADDRSZ], *tp, *endp, *colonp;
+	const char *xdigits, *curtok;
+	int ch, saw_xdigit;
+	u_int val;
+	int digits;
+	int bits;
+	size_t bytes;
+	int words;
+	int ipv4;
+
+	memset((tp = tmp), '\0', NS_IN6ADDRSZ);
+	endp = tp + NS_IN6ADDRSZ;
+	colonp = NULL;
+	/* Leading :: requires some special handling. */
+	if (*src == ':')
+		if (*++src != ':')
+			goto enoent;
+	curtok = src;
+	saw_xdigit = 0;
+	val = 0;
+	digits = 0;
+	bits = -1;
+	ipv4 = 0;
+	while ((ch = *src++) != '\0') {
+		const char *pch;
+
+		if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL)
+			pch = strchr((xdigits = xdigits_u), ch);
+		if (pch != NULL) {
+			val <<= 4;
+			val |= (pch - xdigits);
+			if (++digits > 4)
+				goto enoent;
+			saw_xdigit = 1;
+			continue;
+		}
+		if (ch == ':') {
+			curtok = src;
+			if (!saw_xdigit) {
+				if (colonp)
+					goto enoent;
+				colonp = tp;
+				continue;
+			} else if (*src == '\0')
+				goto enoent;
+			if (tp + NS_INT16SZ > endp)
+				return (0);
+			*tp++ = (u_char) (val >> 8) & 0xff;
+			*tp++ = (u_char) val & 0xff;
+			saw_xdigit = 0;
+			digits = 0;
+			val = 0;
+			continue;
+		}
+		if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) &&
+		     getv4(curtok, tp, &bits) > 0) {
+			tp += NS_INADDRSZ;
+			saw_xdigit = 0;
+			ipv4 = 1;
+			break;	/*%< '\\0' was seen by inet_pton4(). */
+		}
+		if (ch == '/' && getbits(src, &bits) > 0)
+			break;
+		goto enoent;
+	}
+	if (saw_xdigit) {
+		if (tp + NS_INT16SZ > endp)
+			goto enoent;
+		*tp++ = (u_char) (val >> 8) & 0xff;
+		*tp++ = (u_char) val & 0xff;
+	}
+	if (bits == -1)
+		bits = 128;
+
+	words = (bits + 15) / 16;
+	if (words < 2)
+		words = 2;
+	if (ipv4)
+		words = 8;
+	endp =  tmp + 2 * words;
+
+	if (colonp != NULL) {
+		/*
+		 * Since some memmove()'s erroneously fail to handle
+		 * overlapping regions, we'll do the shift by hand.
+		 */
+		const int n = tp - colonp;
+		int i;
+
+		if (tp == endp)
+			goto enoent;
+		for (i = 1; i <= n; i++) {
+			endp[- i] = colonp[n - i];
+			colonp[n - i] = 0;
+		}
+		tp = endp;
+	}
+	if (tp != endp)
+		goto enoent;
+
+	bytes = (bits + 7) / 8;
+	if (bytes > size)
+		goto emsgsize;
+	memcpy(dst, tmp, bytes);
+	return (bits);
+
+ enoent:
+	errno = ENOENT;
+	return (-1);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (-1);
+}
+
+/*%
+ * int
+ * inet_net_pton(af, src, dst, size)
+ *	convert network number from presentation to network format.
+ *	accepts hex octets, hex strings, decimal octets, and /CIDR.
+ *	"size" is in bytes and describes "dst".
+ * return:
+ *	number of bits, either imputed classfully or specified with /CIDR,
+ *	or -1 if some failure occurred (check errno).  ENOENT means it was
+ *	not a valid network specification.
+ * author:
+ *	Paul Vixie (ISC), June 1996
+ */
+int
+inet_net_pton(int af, const char *src, void *dst, size_t size) {
+	switch (af) {
+	case AF_INET:
+		return (inet_net_pton_ipv4(src, dst, size));
+	case AF_INET6:
+		return (inet_net_pton_ipv6(src, dst, size));
+	default:
+		errno = EAFNOSUPPORT;
+		return (-1);
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_neta.c b/usr/src/lib/libresolv2_joy/common/inet/inet_neta.c
new file mode 100644
index 0000000000..63a6c201a4
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_neta.c
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: inet_neta.c,v 1.3 2005/04/27 04:56:20 sra Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+/*%
+ * char *
+ * inet_neta(src, dst, size)
+ *	format a u_long network number into presentation format.
+ * return:
+ *	pointer to dst, or NULL if an error occurred (check errno).
+ * note:
+ *	format of ``src'' is as for inet_network().
+ * author:
+ *	Paul Vixie (ISC), July 1996
+ */
+char *
+inet_neta(src, dst, size)
+	u_long src;
+	char *dst;
+	size_t size;
+{
+	char *odst = dst;
+	char *tp;
+
+	while (src & 0xffffffff) {
+		u_char b = (src & 0xff000000) >> 24;
+
+		src <<= 8;
+		if (b) {
+			if (size < sizeof "255.")
+				goto emsgsize;
+			tp = dst;
+			dst += SPRINTF((dst, "%u", b));
+			if (src != 0L) {
+				*dst++ = '.';
+				*dst = '\0';
+			}
+			size -= (size_t)(dst - tp);
+		}
+	}
+	if (dst == odst) {
+		if (size < sizeof "0.0.0.0")
+			goto emsgsize;
+		strcpy(dst, "0.0.0.0");
+	}
+	return (odst);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (NULL);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_netof.c b/usr/src/lib/libresolv2_joy/common/inet/inet_netof.c
new file mode 100644
index 0000000000..c228e3d818
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_netof.c
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 1983, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)inet_netof.c	8.1 (Berkeley) 6/4/93";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include "port_after.h"
+
+/*%
+ * Return the network number from an internet
+ * address; handles class a/b/c network #'s.
+ */
+u_long
+inet_netof(in)
+	struct in_addr in;
+{
+	register u_long i = ntohl(in.s_addr);
+
+	if (IN_CLASSA(i))
+		return (((i)&IN_CLASSA_NET) >> IN_CLASSA_NSHIFT);
+	else if (IN_CLASSB(i))
+		return (((i)&IN_CLASSB_NET) >> IN_CLASSB_NSHIFT);
+	else
+		return (((i)&IN_CLASSC_NET) >> IN_CLASSC_NSHIFT);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/inet_network.c b/usr/src/lib/libresolv2_joy/common/inet/inet_network.c
new file mode 100644
index 0000000000..47976cff68
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/inet_network.c
@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 1983, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)inet_network.c	8.1 (Berkeley) 6/4/93";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <ctype.h>
+
+#include "port_after.h"
+
+/*%
+ * Internet network address interpretation routine.
+ * The library routines call this routine to interpret
+ * network numbers.
+ */
+u_long
+inet_network(cp)
+	register const char *cp;
+{
+	register u_long val, base, n, i;
+	register char c;
+	u_long parts[4], *pp = parts;
+	int digit;
+
+again:
+	val = 0; base = 10; digit = 0;
+	if (*cp == '0')
+		digit = 1, base = 8, cp++;
+	if (*cp == 'x' || *cp == 'X')
+		base = 16, cp++;
+	while ((c = *cp) != 0) {
+		if (isdigit((unsigned char)c)) {
+			if (base == 8U && (c == '8' || c == '9'))
+				return (INADDR_NONE);
+			val = (val * base) + (c - '0');
+			cp++;
+			digit = 1;
+			continue;
+		}
+		if (base == 16U && isxdigit((unsigned char)c)) {
+			val = (val << 4) +
+			      (c + 10 - (islower((unsigned char)c) ? 'a' : 'A'));
+			cp++;
+			digit = 1;
+			continue;
+		}
+		break;
+	}
+	if (!digit)
+		return (INADDR_NONE);
+	if (pp >= parts + 4 || val > 0xffU)
+		return (INADDR_NONE);
+	if (*cp == '.') {
+		*pp++ = val, cp++;
+		goto again;
+	}
+	if (*cp && !isspace(*cp&0xff))
+		return (INADDR_NONE);
+	*pp++ = val;
+	n = pp - parts;
+	if (n > 4U)
+		return (INADDR_NONE);
+	for (val = 0, i = 0; i < n; i++) {
+		val <<= 8;
+		val |= parts[i] & 0xff;
+	}
+	return (val);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/inet/nsap_addr.c b/usr/src/lib/libresolv2_joy/common/inet/nsap_addr.c
new file mode 100644
index 0000000000..a9972e6e32
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/inet/nsap_addr.c
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: nsap_addr.c,v 1.5 2005/07/28 06:51:48 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <resolv_joy.h>
+#include <resolv_mt.h>
+
+#include "port_after.h"
+
+static char
+xtob(int c) {
+	return (c - (((c >= '0') && (c <= '9')) ? '0' : '7'));
+}
+
+u_int
+inet_nsap_addr(const char *ascii, u_char *binary, int maxlen) {
+	u_char c, nib;
+	u_int len = 0;
+
+	if (ascii[0] != '0' || (ascii[1] != 'x' && ascii[1] != 'X'))
+		return (0);
+	ascii += 2;
+
+	while ((c = *ascii++) != '\0' && len < (u_int)maxlen) {
+		if (c == '.' || c == '+' || c == '/')
+			continue;
+		if (!isascii(c))
+			return (0);
+		if (islower(c))
+			c = toupper(c);
+		if (isxdigit(c)) {
+			nib = xtob(c);
+			c = *ascii++;
+			if (c != '\0') {
+				c = toupper(c);
+				if (isxdigit(c)) {
+					*binary++ = (nib << 4) | xtob(c);
+					len++;
+				} else
+					return (0);
+			}
+			else
+				return (0);
+		}
+		else
+			return (0);
+	}
+	return (len);
+}
+
+char *
+inet_nsap_ntoa(int binlen, const u_char *binary, char *ascii) {
+	int nib;
+	int i;
+	char *tmpbuf = inet_nsap_ntoa_tmpbuf;
+	char *start;
+
+	if (ascii)
+		start = ascii;
+	else {
+		ascii = tmpbuf;
+		start = tmpbuf;
+	}
+
+	*ascii++ = '0';
+	*ascii++ = 'x';
+
+	if (binlen > 255)
+		binlen = 255;
+
+	for (i = 0; i < binlen; i++) {
+		nib = *binary >> 4;
+		*ascii++ = nib + (nib < 10 ? '0' : '7');
+		nib = *binary++ & 0x0f;
+		*ascii++ = nib + (nib < 10 ? '0' : '7');
+		if (((i % 2) == 0 && (i + 1) < binlen))
+			*ascii++ = '.';
+	}
+	*ascii = '\0';
+	return (start);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/dns.c b/usr/src/lib/libresolv2_joy/common/irs/dns.c
new file mode 100644
index 0000000000..7c50320ae7
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/dns.c
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: dns.c,v 1.5 2006/03/09 23:57:56 marka Exp $";
+#endif
+
+/*! \file
+ * \brief
+ * dns.c --- this is the top-level accessor function for the dns
+ */
+
+#include "port_before.h"
+
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <resolv_joy.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "hesiod.h"
+#include "dns_p.h"
+
+/* forward */
+
+static void		dns_close(struct irs_acc *);
+static struct __res_state *	dns_res_get(struct irs_acc *);
+static void		dns_res_set(struct irs_acc *, struct __res_state *,
+				void (*)(void *));
+
+/* public */
+
+struct irs_acc *
+irs_dns_acc(const char *options) {
+	struct irs_acc *acc;
+	struct dns_p *dns;
+
+	UNUSED(options);
+
+	if (!(acc = memget(sizeof *acc))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(acc, 0x5e, sizeof *acc);
+	if (!(dns = memget(sizeof *dns))) {
+		errno = ENOMEM;
+		memput(acc, sizeof *acc);
+		return (NULL);
+	}
+	memset(dns, 0x5e, sizeof *dns);
+	dns->res = NULL;
+	dns->free_res = NULL;
+	if (hesiod_init(&dns->hes_ctx) < 0) {
+		/*
+		 * We allow the dns accessor class to initialize
+		 * despite hesiod failing to initialize correctly,
+		 * since dns host queries don't depend on hesiod.
+		 */
+		dns->hes_ctx = NULL;
+	}
+	acc->private = dns;
+#ifdef WANT_IRS_GR
+	acc->gr_map = irs_dns_gr;
+#else
+	acc->gr_map = NULL;
+#endif
+#ifdef WANT_IRS_PW
+	acc->pw_map = irs_dns_pw;
+#else
+	acc->pw_map = NULL;
+#endif
+	acc->sv_map = irs_dns_sv;
+	acc->pr_map = irs_dns_pr;
+	acc->ho_map = irs_dns_ho;
+	acc->nw_map = irs_dns_nw;
+	acc->ng_map = irs_nul_ng;
+	acc->res_get = dns_res_get;
+	acc->res_set = dns_res_set;
+	acc->close = dns_close;
+	return (acc);
+}
+
+/* methods */
+static struct __res_state *
+dns_res_get(struct irs_acc *this) {
+	struct dns_p *dns = (struct dns_p *)this->private;
+
+	if (dns->res == NULL) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (res == NULL)
+			return (NULL);
+		memset(res, 0, sizeof *res);
+		dns_res_set(this, res, free);
+	}
+
+	if ((dns->res->options & RES_INIT) == 0U &&
+	    res_ninit(dns->res) < 0)
+		return (NULL);
+
+	return (dns->res);
+}
+
+static void
+dns_res_set(struct irs_acc *this, struct __res_state *res,
+	    void (*free_res)(void *)) {
+	struct dns_p *dns = (struct dns_p *)this->private;
+
+	if (dns->res && dns->free_res) {
+		res_nclose(dns->res);
+		(*dns->free_res)(dns->res);
+	}
+	dns->res = res;
+	dns->free_res = free_res;
+}
+
+static void
+dns_close(struct irs_acc *this) {
+	struct dns_p *dns;
+
+	dns = (struct dns_p *)this->private;
+	if (dns->res && dns->free_res)
+		(*dns->free_res)(dns->res);
+	if (dns->hes_ctx)
+		hesiod_end(dns->hes_ctx);
+	memput(dns, sizeof *dns);
+	memput(this, sizeof *this);
+}
+
diff --git a/usr/src/lib/libresolv2_joy/common/irs/dns_ho.c b/usr/src/lib/libresolv2_joy/common/irs/dns_ho.c
new file mode 100644
index 0000000000..67812717fb
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/dns_ho.c
@@ -0,0 +1,1143 @@
+/*
+ * Portions Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1996-2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1985, 1988, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* from gethostnamadr.c	8.1 (Berkeley) 6/4/93 */
+/* BIND Id: gethnamaddr.c,v 8.15 1996/05/22 04:56:30 vixie Exp $ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: dns_ho.c,v 1.23 2008/11/14 02:36:51 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* Imports. */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+#include <syslog.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "dns_p.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) sprintf x
+#endif
+
+/* Definitions. */
+
+#define	MAXALIASES	35
+#define	MAXADDRS	35
+
+#define MAXPACKET (65535)	/*%< Maximum TCP message size */
+#define BOUNDS_CHECK(ptr, count) \
+	if ((ptr) + (count) > eom) { \
+		had_error++; \
+		continue; \
+	} else (void)0
+
+typedef union {
+	HEADER hdr;
+	u_char buf[MAXPACKET];
+} querybuf;
+
+struct dns_res_target {
+	struct dns_res_target *next;
+	querybuf qbuf;		/*%< query buffer */
+	u_char *answer;		/*%< buffer to put answer */
+	int anslen;		/*%< size of answer buffer */
+	int qclass, qtype;	/*%< class and type of query */
+	int action;		/*%< condition whether query is really issued */
+	char qname[MAXDNAME +1]; /*%< domain name */
+#if 0
+	int n;			/*%< result length */
+#endif
+};
+enum {RESTGT_DOALWAYS, RESTGT_AFTERFAILURE, RESTGT_IGNORE};
+enum {RESQRY_SUCCESS, RESQRY_FAIL};
+
+struct pvt {
+	struct hostent	host;
+	char *		h_addr_ptrs[MAXADDRS + 1];
+	char *		host_aliases[MAXALIASES];
+	char		hostbuf[8*1024];
+	u_char		host_addr[16];	/*%< IPv4 or IPv6 */
+	struct __res_state  *res;
+	void		(*free_res)(void *);
+};
+
+typedef union {
+	int32_t al;
+	char ac;
+} align;
+
+static const u_char mapped[] = { 0,0, 0,0, 0,0, 0,0, 0,0, 0xff,0xff };
+static const u_char tunnelled[] = { 0,0, 0,0, 0,0, 0,0, 0,0, 0,0 };
+/* Note: the IPv6 loopback address is in the "tunnel" space */
+static const u_char v6local[] = { 0,0, 0,1 }; /*%< last 4 bytes of IPv6 addr */
+/* Forwards. */
+
+static void		ho_close(struct irs_ho *this);
+static struct hostent *	ho_byname(struct irs_ho *this, const char *name);
+static struct hostent *	ho_byname2(struct irs_ho *this, const char *name,
+				   int af);
+static struct hostent *	ho_byaddr(struct irs_ho *this, const void *addr,
+				  int len, int af);
+static struct hostent *	ho_next(struct irs_ho *this);
+static void		ho_rewind(struct irs_ho *this);
+static void		ho_minimize(struct irs_ho *this);
+static struct __res_state * ho_res_get(struct irs_ho *this);
+static void		ho_res_set(struct irs_ho *this,
+				   struct __res_state *res,
+				   void (*free_res)(void *));
+static struct addrinfo * ho_addrinfo(struct irs_ho *this, const char *name,
+				     const struct addrinfo *pai);
+
+static void		map_v4v6_hostent(struct hostent *hp, char **bp,
+					 char *ep);
+static void		addrsort(res_state, char **, int);
+static struct hostent *	gethostans(struct irs_ho *this,
+				   const u_char *ansbuf, int anslen,
+				   const char *qname, int qtype,
+				   int af, int size,
+				   struct addrinfo **ret_aip,
+				   const struct addrinfo *pai);
+static int add_hostent(struct pvt *pvt, char *bp, char **hap,
+		       struct addrinfo *ai);
+static int		init(struct irs_ho *this);
+
+/* Exports. */
+
+struct irs_ho *
+irs_dns_ho(struct irs_acc *this) {
+	struct irs_ho *ho;
+	struct pvt *pvt;
+
+	UNUSED(this);
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+
+	if (!(ho = memget(sizeof *ho))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ho, 0x5e, sizeof *ho);
+	ho->private = pvt;
+	ho->close = ho_close;
+	ho->byname = ho_byname;
+	ho->byname2 = ho_byname2;
+	ho->byaddr = ho_byaddr;
+	ho->next = ho_next;
+	ho->rewind = ho_rewind;
+	ho->minimize = ho_minimize;
+	ho->res_get = ho_res_get;
+	ho->res_set = ho_res_set;
+	ho->addrinfo = ho_addrinfo;
+	return (ho);
+}
+
+/* Methods. */
+
+static void
+ho_close(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	ho_minimize(this);
+	if (pvt->res && pvt->free_res)
+		(*pvt->free_res)(pvt->res);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct hostent *
+ho_byname(struct irs_ho *this, const char *name) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *hp;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	if (pvt->res->options & RES_USE_INET6) {
+		hp = ho_byname2(this, name, AF_INET6);
+		if (hp)
+			return (hp);
+	}
+	return (ho_byname2(this, name, AF_INET));
+}
+
+static struct hostent *
+ho_byname2(struct irs_ho *this, const char *name, int af)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *hp = NULL;
+	int n, size;
+	char tmp[NS_MAXDNAME];
+	const char *cp;
+	struct addrinfo ai;
+	struct dns_res_target *q, *p;
+	int querystate = RESQRY_FAIL;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	q = memget(sizeof(*q));
+	if (q == NULL) {
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = ENOMEM;
+		goto cleanup;
+	}
+	memset(q, 0, sizeof(*q));
+
+	switch (af) {
+	case AF_INET:
+		size = INADDRSZ;
+		q->qclass = C_IN;
+		q->qtype = T_A;
+		q->answer = q->qbuf.buf;
+		q->anslen = sizeof(q->qbuf);
+		q->action = RESTGT_DOALWAYS;
+		break;
+	case AF_INET6:
+		size = IN6ADDRSZ;
+		q->qclass = C_IN;
+		q->qtype = T_AAAA;
+		q->answer = q->qbuf.buf;
+		q->anslen = sizeof(q->qbuf);
+		q->action = RESTGT_DOALWAYS;
+		break;
+	default:
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = EAFNOSUPPORT;
+		hp = NULL;
+		goto cleanup;
+	}
+
+	/*
+	 * if there aren't any dots, it could be a user-level alias.
+	 * this is also done in res_nquery() since we are not the only
+	 * function that looks up host names.
+	 */
+	if (!strchr(name, '.') && (cp = res_hostalias(pvt->res, name,
+						      tmp, sizeof tmp)))
+		name = cp;
+
+	for (p = q; p; p = p->next) {
+		switch(p->action) {
+		case RESTGT_DOALWAYS:
+			break;
+		case RESTGT_AFTERFAILURE:
+			if (querystate == RESQRY_SUCCESS)
+				continue;
+			break;
+		case RESTGT_IGNORE:
+			continue;
+		}
+
+		if ((n = res_nsearch(pvt->res, name, p->qclass, p->qtype,
+				     p->answer, p->anslen)) < 0) {
+			querystate = RESQRY_FAIL;
+			continue;
+		}
+
+		memset(&ai, 0, sizeof(ai));
+		ai.ai_family = af;
+		if ((hp = gethostans(this, p->answer, n, name, p->qtype,
+				     af, size, NULL,
+				     (const struct addrinfo *)&ai)) != NULL)
+			goto cleanup;	/*%< no more loop is necessary */
+		querystate = RESQRY_FAIL;
+		continue;
+	}
+
+ cleanup:
+	if (q != NULL)
+		memput(q, sizeof(*q));
+	return(hp);
+}
+
+static struct hostent *
+ho_byaddr(struct irs_ho *this, const void *addr, int len, int af)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	const u_char *uaddr = addr;
+	char *qp;
+	struct hostent *hp = NULL;
+	struct addrinfo ai;
+	struct dns_res_target *q, *q2, *p;
+	int n, size, i;
+	int querystate = RESQRY_FAIL;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	q = memget(sizeof(*q));
+	q2 = memget(sizeof(*q2));
+	if (q == NULL || q2 == NULL) {
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = ENOMEM;
+		goto cleanup;
+	}
+	memset(q, 0, sizeof(*q));
+	memset(q2, 0, sizeof(*q2));
+
+	if (af == AF_INET6 && len == IN6ADDRSZ &&
+	    (!memcmp(uaddr, mapped, sizeof mapped) ||
+	   (!memcmp(uaddr, tunnelled, sizeof tunnelled) &&
+	    memcmp(&uaddr[sizeof tunnelled], v6local, sizeof(v6local))))) {
+		/* Unmap. */
+		addr = (const char *)addr + sizeof mapped;
+		uaddr += sizeof mapped;
+		af = AF_INET;
+		len = INADDRSZ;
+	}
+	switch (af) {
+	case AF_INET:
+		size = INADDRSZ;
+		q->qclass = C_IN;
+		q->qtype = T_PTR;
+		q->answer = q->qbuf.buf;
+		q->anslen = sizeof(q->qbuf);
+		q->action = RESTGT_DOALWAYS;
+		break;
+	case AF_INET6:
+		size = IN6ADDRSZ;
+		q->qclass = C_IN;
+		q->qtype = T_PTR;
+		q->answer = q->qbuf.buf;
+		q->anslen = sizeof(q->qbuf);
+		q->next = q2;
+		q->action = RESTGT_DOALWAYS;
+		q2->qclass = C_IN;
+		q2->qtype = T_PTR;
+		q2->answer = q2->qbuf.buf;
+		q2->anslen = sizeof(q2->qbuf);
+		if ((pvt->res->options & RES_NO_NIBBLE2) != 0U)
+			q2->action = RESTGT_IGNORE;
+		else
+			q2->action = RESTGT_AFTERFAILURE;
+		break;
+	default:
+		errno = EAFNOSUPPORT;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		hp = NULL;
+		goto cleanup;
+	}
+	if (size > len) {
+		errno = EINVAL;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		hp = NULL;
+		goto cleanup;
+	}
+	switch (af) {
+	case AF_INET:
+		qp = q->qname;
+		(void) sprintf(qp, "%u.%u.%u.%u.in-addr.arpa",
+			       (uaddr[3] & 0xff),
+			       (uaddr[2] & 0xff),
+			       (uaddr[1] & 0xff),
+			       (uaddr[0] & 0xff));
+		break;
+	case AF_INET6:
+		if (q->action != RESTGT_IGNORE) {
+			const char *nibsuff = res_get_nibblesuffix(pvt->res);
+			qp = q->qname;
+			for (n = IN6ADDRSZ - 1; n >= 0; n--) {
+				i = SPRINTF((qp, "%x.%x.",
+					       uaddr[n] & 0xf,
+					       (uaddr[n] >> 4) & 0xf));
+				if (i != 4)
+					abort();
+				qp += i;
+			}
+			if (strlen(q->qname) + strlen(nibsuff) + 1 >
+			    sizeof q->qname) {
+				errno = ENAMETOOLONG;
+				RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+				hp = NULL;
+				goto cleanup;
+			}
+			strcpy(qp, nibsuff);	/* (checked) */
+		}
+		if (q2->action != RESTGT_IGNORE) {
+			const char *nibsuff2 = res_get_nibblesuffix2(pvt->res);
+			qp = q2->qname;
+			for (n = IN6ADDRSZ - 1; n >= 0; n--) {
+				i = SPRINTF((qp, "%x.%x.",
+					       uaddr[n] & 0xf,
+					       (uaddr[n] >> 4) & 0xf));
+				if (i != 4)
+					abort();
+				qp += i;
+			}
+			if (strlen(q2->qname) + strlen(nibsuff2) + 1 >
+			    sizeof q2->qname) {
+				errno = ENAMETOOLONG;
+				RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+				hp = NULL;
+				goto cleanup;
+			}
+			strcpy(qp, nibsuff2);	/* (checked) */
+		}
+		break;
+	default:
+		abort();
+	}
+
+	for (p = q; p; p = p->next) {
+		switch(p->action) {
+		case RESTGT_DOALWAYS:
+			break;
+		case RESTGT_AFTERFAILURE:
+			if (querystate == RESQRY_SUCCESS)
+				continue;
+			break;
+		case RESTGT_IGNORE:
+			continue;
+		}
+
+		if ((n = res_nquery(pvt->res, p->qname, p->qclass, p->qtype,
+				    p->answer, p->anslen)) < 0) {
+			querystate = RESQRY_FAIL;
+			continue;
+		}
+
+		memset(&ai, 0, sizeof(ai));
+		ai.ai_family = af;
+		hp = gethostans(this, p->answer, n, p->qname, T_PTR, af, size,
+				NULL, (const struct addrinfo *)&ai);
+		if (!hp) {
+			querystate = RESQRY_FAIL;
+			continue;
+		}
+
+		memcpy(pvt->host_addr, addr, len);
+		pvt->h_addr_ptrs[0] = (char *)pvt->host_addr;
+		pvt->h_addr_ptrs[1] = NULL;
+		if (af == AF_INET && (pvt->res->options & RES_USE_INET6)) {
+			map_v4v6_address((char*)pvt->host_addr,
+					 (char*)pvt->host_addr);
+			pvt->host.h_addrtype = AF_INET6;
+			pvt->host.h_length = IN6ADDRSZ;
+		}
+
+		RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
+		goto cleanup;	/*%< no more loop is necessary. */
+	}
+	hp = NULL; /*%< H_ERRNO was set by subroutines */
+ cleanup:
+	if (q != NULL)
+		memput(q, sizeof(*q));
+	if (q2 != NULL)
+		memput(q2, sizeof(*q2));
+	return(hp);
+}
+
+static struct hostent *
+ho_next(struct irs_ho *this) {
+
+	UNUSED(this);
+
+	return (NULL);
+}
+
+static void
+ho_rewind(struct irs_ho *this) {
+
+	UNUSED(this);
+
+	/* NOOP */
+}
+
+static void
+ho_minimize(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->res)
+		res_nclose(pvt->res);
+}
+
+static struct __res_state *
+ho_res_get(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		ho_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+/* XXX */
+extern struct addrinfo *addr2addrinfo __P((const struct addrinfo *,
+					   const char *));
+
+static struct addrinfo *
+ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	int n;
+	char tmp[NS_MAXDNAME];
+	const char *cp;
+	struct dns_res_target *q, *q2, *p;
+	struct addrinfo sentinel, *cur;
+	int querystate = RESQRY_FAIL;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	memset(&sentinel, 0, sizeof(sentinel));
+	cur = &sentinel;
+
+	q = memget(sizeof(*q));
+	q2 = memget(sizeof(*q2));
+	if (q == NULL || q2 == NULL) {
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = ENOMEM;
+		goto cleanup;
+	}
+	memset(q, 0, sizeof(*q2));
+	memset(q2, 0, sizeof(*q2));
+
+	switch (pai->ai_family) {
+	case AF_UNSPEC:
+		/* prefer IPv6 */
+		q->qclass = C_IN;
+		q->qtype = T_AAAA;
+		q->answer = q->qbuf.buf;
+		q->anslen = sizeof(q->qbuf);
+		q->next = q2;
+		q->action = RESTGT_DOALWAYS;
+		q2->qclass = C_IN;
+		q2->qtype = T_A;
+		q2->answer = q2->qbuf.buf;
+		q2->anslen = sizeof(q2->qbuf);
+		q2->action = RESTGT_DOALWAYS;
+		break;
+	case AF_INET:
+		q->qclass = C_IN;
+		q->qtype = T_A;
+		q->answer = q->qbuf.buf;
+		q->anslen = sizeof(q->qbuf);
+		q->action = RESTGT_DOALWAYS;
+		break;
+	case AF_INET6:
+		q->qclass = C_IN;
+		q->qtype = T_AAAA;
+		q->answer = q->qbuf.buf;
+		q->anslen = sizeof(q->qbuf);
+		q->action = RESTGT_DOALWAYS;
+		break;
+	default:
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /*%< better error? */
+		goto cleanup;
+	}
+
+	/*
+	 * if there aren't any dots, it could be a user-level alias.
+	 * this is also done in res_nquery() since we are not the only
+	 * function that looks up host names.
+	 */
+	if (!strchr(name, '.') && (cp = res_hostalias(pvt->res, name,
+						      tmp, sizeof tmp)))
+		name = cp;
+
+	for (p = q; p; p = p->next) {
+		struct addrinfo *ai;
+
+		switch(p->action) {
+		case RESTGT_DOALWAYS:
+			break;
+		case RESTGT_AFTERFAILURE:
+			if (querystate == RESQRY_SUCCESS)
+				continue;
+			break;
+		case RESTGT_IGNORE:
+			continue;
+		}
+
+		if ((n = res_nsearch(pvt->res, name, p->qclass, p->qtype,
+				     p->answer, p->anslen)) < 0) {
+			querystate = RESQRY_FAIL;
+			continue;
+		}
+		(void)gethostans(this, p->answer, n, name, p->qtype,
+				 pai->ai_family, /*%< XXX: meaningless */
+				 0, &ai, pai);
+		if (ai) {
+			querystate = RESQRY_SUCCESS;
+			cur->ai_next = ai;
+			while (cur->ai_next)
+				cur = cur->ai_next;
+		} else
+			querystate = RESQRY_FAIL;
+	}
+
+ cleanup:
+	if (q != NULL)
+		memput(q, sizeof(*q));
+	if (q2 != NULL)
+		memput(q2, sizeof(*q2));
+	return(sentinel.ai_next);
+}
+
+static void
+ho_res_set(struct irs_ho *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+}
+
+/* Private. */
+
+static struct hostent *
+gethostans(struct irs_ho *this,
+	   const u_char *ansbuf, int anslen, const char *qname, int qtype,
+	   int af, int size,	/*!< meaningless for addrinfo cases  */
+	   struct addrinfo **ret_aip, const struct addrinfo *pai)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	int type, class, ancount, qdcount, n, haveanswer, had_error;
+	int error = NETDB_SUCCESS;
+	int (*name_ok)(const char *);
+	const HEADER *hp;
+	const u_char *eom;
+	const u_char *eor;
+	const u_char *cp;
+	const char *tname;
+	const char *hname;
+	char *bp, *ep, **ap, **hap;
+	char tbuf[MAXDNAME+1];
+	struct addrinfo sentinel, *cur, ai;
+
+	if (pai == NULL) abort();
+	if (ret_aip != NULL)
+		*ret_aip = NULL;
+	memset(&sentinel, 0, sizeof(sentinel));
+	cur = &sentinel;
+
+	tname = qname;
+	eom = ansbuf + anslen;
+	switch (qtype) {
+	case T_A:
+	case T_AAAA:
+	case T_ANY:	/*%< use T_ANY only for T_A/T_AAAA lookup */
+		name_ok = res_hnok;
+		break;
+	case T_PTR:
+		name_ok = res_dnok;
+		break;
+	default:
+		abort();
+	}
+
+	pvt->host.h_addrtype = af;
+	pvt->host.h_length = size;
+	hname = pvt->host.h_name = NULL;
+
+	/*
+	 * Find first satisfactory answer.
+	 */
+	if (ansbuf + HFIXEDSZ > eom) {
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+		return (NULL);
+	}
+	hp = (const HEADER *)ansbuf;
+	ancount = ntohs(hp->ancount);
+	qdcount = ntohs(hp->qdcount);
+	bp = pvt->hostbuf;
+	ep = pvt->hostbuf + sizeof(pvt->hostbuf);
+	cp = ansbuf + HFIXEDSZ;
+	if (qdcount != 1) {
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+		return (NULL);
+	}
+	n = dn_expand(ansbuf, eom, cp, bp, ep - bp);
+	if (n < 0 || !maybe_ok(pvt->res, bp, name_ok)) {
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+		return (NULL);
+	}
+	cp += n + QFIXEDSZ;
+	if (cp > eom) {
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+		return (NULL);
+	}
+	if (qtype == T_A || qtype == T_AAAA || qtype == T_ANY) {
+		/* res_nsend() has already verified that the query name is the
+		 * same as the one we sent; this just gets the expanded name
+		 * (i.e., with the succeeding search-domain tacked on).
+		 */
+		n = strlen(bp) + 1;		/*%< for the \\0 */
+		if (n > MAXHOSTNAMELEN) {
+			RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+			return (NULL);
+		}
+		pvt->host.h_name = bp;
+		hname = bp;
+		bp += n;
+		/* The qname can be abbreviated, but hname is now absolute. */
+		qname = pvt->host.h_name;
+	}
+	ap = pvt->host_aliases;
+	*ap = NULL;
+	pvt->host.h_aliases = pvt->host_aliases;
+	hap = pvt->h_addr_ptrs;
+	*hap = NULL;
+	pvt->host.h_addr_list = pvt->h_addr_ptrs;
+	haveanswer = 0;
+	had_error = 0;
+	while (ancount-- > 0 && cp < eom && !had_error) {
+		n = dn_expand(ansbuf, eom, cp, bp, ep - bp);
+		if (n < 0 || !maybe_ok(pvt->res, bp, name_ok)) {
+			had_error++;
+			continue;
+		}
+		cp += n;			/*%< name */
+		BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ);
+		type = ns_get16(cp);
+		cp += INT16SZ;			/*%< type */
+		class = ns_get16(cp);
+		cp += INT16SZ + INT32SZ;	/*%< class, TTL */
+		n = ns_get16(cp);
+		cp += INT16SZ;			/*%< len */
+		BOUNDS_CHECK(cp, n);
+		if (class != C_IN) {
+			cp += n;
+			continue;
+		}
+		eor = cp + n;
+		if ((qtype == T_A || qtype == T_AAAA || qtype == T_ANY) &&
+		    type == T_CNAME) {
+			if (haveanswer) {
+				int level = LOG_CRIT;
+#ifdef LOG_SECURITY
+				level |= LOG_SECURITY;
+#endif
+				syslog(level,
+ "gethostans: possible attempt to exploit buffer overflow while looking up %s",
+					*qname ? qname : ".");
+			}
+			n = dn_expand(ansbuf, eor, cp, tbuf, sizeof tbuf);
+			if (n < 0 || !maybe_ok(pvt->res, tbuf, name_ok)) {
+				had_error++;
+				continue;
+			}
+			cp += n;
+			/* Store alias. */
+			if (ap >= &pvt->host_aliases[MAXALIASES-1])
+				continue;
+			*ap++ = bp;
+			n = strlen(bp) + 1;	/*%< for the \\0 */
+			bp += n;
+			/* Get canonical name. */
+			n = strlen(tbuf) + 1;	/*%< for the \\0 */
+			if (n > (ep - bp) || n > MAXHOSTNAMELEN) {
+				had_error++;
+				continue;
+			}
+			strcpy(bp, tbuf);	/* (checked) */
+			pvt->host.h_name = bp;
+			hname = bp;
+			bp += n;
+			continue;
+		}
+		if (qtype == T_PTR && type == T_CNAME) {
+			n = dn_expand(ansbuf, eor, cp, tbuf, sizeof tbuf);
+			if (n < 0 || !maybe_dnok(pvt->res, tbuf)) {
+				had_error++;
+				continue;
+			}
+			cp += n;
+#ifdef RES_USE_DNAME
+			if ((pvt->res->options & RES_USE_DNAME) != 0U)
+#endif
+			{
+				/*
+				 * We may be able to check this regardless
+				 * of the USE_DNAME bit, but we add the check
+				 * for now since the DNAME support is
+				 * experimental.
+				 */
+				if (ns_samename(tname, bp) != 1)
+					continue;
+			}
+			/* Get canonical name. */
+			n = strlen(tbuf) + 1;	/*%< for the \\0 */
+			if (n > (ep - bp)) {
+				had_error++;
+				continue;
+			}
+			strcpy(bp, tbuf);	/* (checked) */
+			tname = bp;
+			bp += n;
+			continue;
+		}
+		if (qtype == T_ANY) {
+			if (!(type == T_A || type == T_AAAA)) {
+				cp += n;
+				continue;
+			}
+		} else if (type != qtype) {
+			cp += n;
+			continue;
+		}
+		switch (type) {
+		case T_PTR:
+			if (ret_aip != NULL) {
+				/* addrinfo never needs T_PTR */
+				cp += n;
+				continue;
+			}
+			if (ns_samename(tname, bp) != 1) {
+				cp += n;
+				continue;
+			}
+			n = dn_expand(ansbuf, eor, cp, bp, ep - bp);
+			if (n < 0 || !maybe_hnok(pvt->res, bp) ||
+			    n >= MAXHOSTNAMELEN) {
+				had_error++;
+				break;
+			}
+			cp += n;
+			if (!haveanswer) {
+				pvt->host.h_name = bp;
+				hname = bp;
+			}
+			else if (ap < &pvt->host_aliases[MAXALIASES-1])
+				*ap++ = bp;
+			else
+				n = -1;
+			if (n != -1) {
+				n = strlen(bp) + 1;	/*%< for the \\0 */
+				bp += n;
+			}
+			break;
+		case T_A:
+		case T_AAAA:
+			if (ns_samename(hname, bp) != 1) {
+				cp += n;
+				continue;
+			}
+			if (type == T_A && n != INADDRSZ) {
+				cp += n;
+				continue;
+			}
+			if (type == T_AAAA && n != IN6ADDRSZ) {
+				cp += n;
+				continue;
+			}
+
+			/* make addrinfo. don't overwrite constant PAI */
+			ai = *pai;
+			ai.ai_family = (type == T_AAAA) ? AF_INET6 : AF_INET;
+			cur->ai_next = addr2addrinfo(
+					(const struct addrinfo *)&ai,
+					(const char *)cp);
+			if (cur->ai_next == NULL)
+				had_error++;
+
+			if (!haveanswer) {
+				int nn;
+
+				nn = strlen(bp) + 1;	/*%< for the \\0 */
+				if (nn >= MAXHOSTNAMELEN) {
+					cp += n;
+					had_error++;
+					continue;
+				}
+				pvt->host.h_name = bp;
+				hname = bp;
+				bp += nn;
+			}
+			/* Ensure alignment. */
+			bp = (char *)(((u_long)bp + (sizeof(align) - 1)) &
+				      ~(sizeof(align) - 1));
+			/* Avoid overflows. */
+			if (bp + n > &pvt->hostbuf[sizeof(pvt->hostbuf) - 1]) {
+				had_error++;
+				continue;
+			}
+			if (ret_aip) { /*%< need addrinfo. keep it. */
+				while (cur->ai_next)
+					cur = cur->ai_next;
+			} else if (cur->ai_next) { /*%< need hostent */
+				struct addrinfo *aip = cur->ai_next;
+
+				for (aip = cur->ai_next; aip;
+				     aip = aip->ai_next) {
+					int m;
+
+					m = add_hostent(pvt, bp, hap, aip);
+					if (m < 0) {
+						had_error++;
+						break;
+					}
+					if (m == 0)
+						continue;
+					if (hap < &pvt->h_addr_ptrs[MAXADDRS])
+						hap++;
+					*hap = NULL;
+					bp += m;
+				}
+
+				freeaddrinfo(cur->ai_next);
+				cur->ai_next = NULL;
+			}
+			cp += n;
+			break;
+		default:
+			abort();
+		}
+		if (!had_error)
+			haveanswer++;
+	}
+	if (haveanswer) {
+		if (ret_aip == NULL) {
+			*ap = NULL;
+			*hap = NULL;
+
+			if (pvt->res->nsort && hap != pvt->h_addr_ptrs &&
+			    qtype == T_A)
+				addrsort(pvt->res, pvt->h_addr_ptrs,
+					 hap - pvt->h_addr_ptrs);
+			if (pvt->host.h_name == NULL) {
+				n = strlen(qname) + 1;	/*%< for the \\0 */
+				if (n > (ep - bp) || n >= MAXHOSTNAMELEN)
+					goto no_recovery;
+				strcpy(bp, qname);	/* (checked) */
+				pvt->host.h_name = bp;
+				bp += n;
+			}
+			if (pvt->res->options & RES_USE_INET6)
+				map_v4v6_hostent(&pvt->host, &bp, ep);
+			RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
+			return (&pvt->host);
+		} else {
+			if ((pai->ai_flags & AI_CANONNAME) != 0) {
+				if (pvt->host.h_name == NULL) {
+					sentinel.ai_next->ai_canonname =
+						strdup(qname);
+				}
+				else {
+					sentinel.ai_next->ai_canonname =
+						strdup(pvt->host.h_name);
+				}
+			}
+			*ret_aip = sentinel.ai_next;
+			return(NULL);
+		}
+	}
+ no_recovery:
+	if (sentinel.ai_next) {
+		/* this should be impossible, but check it for safety */
+		freeaddrinfo(sentinel.ai_next);
+	}
+	if (error == NETDB_SUCCESS)
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+	else
+		RES_SET_H_ERRNO(pvt->res, error);
+	return(NULL);
+}
+
+static int
+add_hostent(struct pvt *pvt, char *bp, char **hap, struct addrinfo *ai)
+{
+	int addrlen;
+	char *addrp;
+	const char **tap;
+	char *obp = bp;
+
+	switch(ai->ai_addr->sa_family) {
+	case AF_INET6:
+		addrlen = IN6ADDRSZ;
+		addrp = (char *)&((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr;
+		break;
+	case AF_INET:
+		addrlen = INADDRSZ;
+		addrp = (char *)&((struct sockaddr_in *)ai->ai_addr)->sin_addr;
+		break;
+	default:
+		return(-1);	/*%< abort? */
+	}
+
+	/* Ensure alignment. */
+	bp = (char *)(((u_long)bp + (sizeof(align) - 1)) &
+		      ~(sizeof(align) - 1));
+	/* Avoid overflows. */
+	if (bp + addrlen > &pvt->hostbuf[sizeof(pvt->hostbuf) - 1])
+		return(-1);
+	if (hap >= &pvt->h_addr_ptrs[MAXADDRS])
+		return(0); /*%< fail, but not treat it as an error. */
+	/* Suppress duplicates. */
+	for (tap = (const char **)pvt->h_addr_ptrs;
+	     *tap != NULL;
+	     tap++)
+		if (memcmp(*tap, addrp, addrlen) == 0)
+			break;
+	if (*tap != NULL)
+		return (0);
+
+	memcpy(*hap = bp, addrp, addrlen);
+	return((bp + addrlen) - obp);
+}
+
+static void
+map_v4v6_hostent(struct hostent *hp, char **bpp, char *ep) {
+	char **ap;
+
+	if (hp->h_addrtype != AF_INET || hp->h_length != INADDRSZ)
+		return;
+	hp->h_addrtype = AF_INET6;
+	hp->h_length = IN6ADDRSZ;
+	for (ap = hp->h_addr_list; *ap; ap++) {
+		int i = (u_long)*bpp % sizeof(align);
+
+		if (i != 0)
+			i = sizeof(align) - i;
+
+		if ((ep - *bpp) < (i + IN6ADDRSZ)) {
+			/* Out of memory.  Truncate address list here. */
+			*ap = NULL;
+			return;
+		}
+		*bpp += i;
+		map_v4v6_address(*ap, *bpp);
+		*ap = *bpp;
+		*bpp += IN6ADDRSZ;
+	}
+}
+
+static void
+addrsort(res_state statp, char **ap, int num) {
+	int i, j, needsort = 0, aval[MAXADDRS];
+	char **p;
+
+	p = ap;
+	for (i = 0; i < num; i++, p++) {
+		for (j = 0 ; (unsigned)j < statp->nsort; j++)
+			if (statp->sort_list[j].addr.s_addr ==
+			    (((struct in_addr *)(*p))->s_addr &
+			     statp->sort_list[j].mask))
+				break;
+		aval[i] = j;
+		if (needsort == 0 && i > 0 && j < aval[i-1])
+			needsort = i;
+	}
+	if (!needsort)
+		return;
+
+	while (needsort < num) {
+		for (j = needsort - 1; j >= 0; j--) {
+			if (aval[j] > aval[j+1]) {
+				char *hp;
+
+				i = aval[j];
+				aval[j] = aval[j+1];
+				aval[j+1] = i;
+
+				hp = ap[j];
+				ap[j] = ap[j+1];
+				ap[j+1] = hp;
+
+			} else
+				break;
+		}
+		needsort++;
+	}
+}
+
+static int
+init(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res && !ho_res_get(this))
+		return (-1);
+	if (((pvt->res->options & RES_INIT) == 0U) &&
+	    res_ninit(pvt->res) == -1)
+		return (-1);
+	return (0);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/irs/dns_nw.c b/usr/src/lib/libresolv2_joy/common/irs/dns_nw.c
new file mode 100644
index 0000000000..e9acfd39c7
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/dns_nw.c
@@ -0,0 +1,591 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: dns_nw.c,v 1.12 2005/04/27 04:56:22 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* Imports. */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "dns_p.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) sprintf x
+#endif
+
+/* Definitions. */
+
+#define	MAXALIASES	35
+
+#define	MAXPACKET	(64*1024)
+
+struct pvt {
+	struct nwent	net;
+	char *		ali[MAXALIASES];
+	char		buf[BUFSIZ+1];
+	struct __res_state * res;
+	void		(*free_res)(void *);
+};
+
+typedef union {
+	long	al;
+	char	ac;
+} align;
+
+enum by_what { by_addr, by_name };
+
+/* Forwards. */
+
+static void		nw_close(struct irs_nw *);
+static struct nwent *	nw_byname(struct irs_nw *, const char *, int);
+static struct nwent *	nw_byaddr(struct irs_nw *, void *, int, int);
+static struct nwent *	nw_next(struct irs_nw *);
+static void		nw_rewind(struct irs_nw *);
+static void		nw_minimize(struct irs_nw *);
+static struct __res_state * nw_res_get(struct irs_nw *this);
+static void		nw_res_set(struct irs_nw *this,
+				   struct __res_state *res,
+				   void (*free_res)(void *));
+
+static struct nwent *	get1101byaddr(struct irs_nw *, u_char *, int);
+static struct nwent *	get1101byname(struct irs_nw *, const char *);
+static struct nwent *	get1101answer(struct irs_nw *,
+				      u_char *ansbuf, int anslen,
+				      enum by_what by_what,
+				      int af, const char *name,
+				      const u_char *addr, int addrlen);
+static struct nwent *	get1101mask(struct irs_nw *this, struct nwent *);
+static int		make1101inaddr(const u_char *, int, char *, int);
+static void		normalize_name(char *name);
+static int		init(struct irs_nw *this);
+
+/* Exports. */
+
+struct irs_nw *
+irs_dns_nw(struct irs_acc *this) {
+	struct irs_nw *nw;
+	struct pvt *pvt;
+
+	UNUSED(this);
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	if (!(nw = memget(sizeof *nw))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(nw, 0x5e, sizeof *nw);
+	nw->private = pvt;
+	nw->close = nw_close;
+	nw->byname = nw_byname;
+	nw->byaddr = nw_byaddr;
+	nw->next = nw_next;
+	nw->rewind = nw_rewind;
+	nw->minimize = nw_minimize;
+	nw->res_get = nw_res_get;
+	nw->res_set = nw_res_set;
+	return (nw);
+}
+
+/* Methods. */
+
+static void
+nw_close(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	nw_minimize(this);
+
+	if (pvt->res && pvt->free_res)
+		(*pvt->free_res)(pvt->res);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct nwent *
+nw_byname(struct irs_nw *this, const char *name, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	switch (af) {
+	case AF_INET:
+		return (get1101byname(this, name));
+	default:
+		(void)NULL;
+	}
+	RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+	errno = EAFNOSUPPORT;
+	return (NULL);
+}
+
+static struct nwent *
+nw_byaddr(struct irs_nw *this, void *net, int len, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	switch (af) {
+	case AF_INET:
+		return (get1101byaddr(this, net, len));
+	default:
+		(void)NULL;
+	}
+	RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+	errno = EAFNOSUPPORT;
+	return (NULL);
+}
+
+static struct nwent *
+nw_next(struct irs_nw *this) {
+
+	UNUSED(this);
+
+	return (NULL);
+}
+
+static void
+nw_rewind(struct irs_nw *this) {
+	UNUSED(this);
+	/* NOOP */
+}
+
+static void
+nw_minimize(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->res)
+		res_nclose(pvt->res);
+}
+
+static struct __res_state *
+nw_res_get(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		nw_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+static void
+nw_res_set(struct irs_nw *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+}
+
+/* Private. */
+
+static struct nwent *
+get1101byname(struct irs_nw *this, const char *name) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	u_char *ansbuf;
+	int anslen;
+	struct nwent *result;
+
+	ansbuf = memget(MAXPACKET);
+	if (ansbuf == NULL) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	anslen = res_nsearch(pvt->res, name, C_IN, T_PTR, ansbuf, MAXPACKET);
+	if (anslen < 0) {
+		memput(ansbuf, MAXPACKET);
+		return (NULL);
+	}
+	result = get1101mask(this, get1101answer(this, ansbuf, anslen, by_name,
+						 AF_INET, name, NULL, 0));
+	memput(ansbuf, MAXPACKET);
+	return (result);
+}
+
+static struct nwent *
+get1101byaddr(struct irs_nw *this, u_char *net, int len) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char qbuf[sizeof "255.255.255.255.in-addr.arpa"];
+	struct nwent *result;
+	u_char *ansbuf;
+	int anslen;
+
+	if (len < 1 || len > 32) {
+		errno = EINVAL;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	if (make1101inaddr(net, len, qbuf, sizeof qbuf) < 0)
+		return (NULL);
+	ansbuf = memget(MAXPACKET);
+	if (ansbuf == NULL) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	anslen = res_nquery(pvt->res, qbuf, C_IN, T_PTR, ansbuf, MAXPACKET);
+	if (anslen < 0) {
+		memput(ansbuf, MAXPACKET);
+		return (NULL);
+	}
+	result = get1101mask(this, get1101answer(this, ansbuf, anslen, by_addr,
+						 AF_INET, NULL, net, len));
+	memput(ansbuf, MAXPACKET);
+	return (result);
+}
+
+static struct nwent *
+get1101answer(struct irs_nw *this,
+	      u_char *ansbuf, int anslen, enum by_what by_what,
+	      int af, const char *name, const u_char *addr, int addrlen)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	int type, class, ancount, qdcount, haveanswer;
+	char *bp, *ep, **ap;
+	u_char *cp, *eom;
+	HEADER *hp;
+
+	/* Initialize, and parse header. */
+	eom = ansbuf + anslen;
+	if (ansbuf + HFIXEDSZ > eom) {
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+		return (NULL);
+	}
+	hp = (HEADER *)ansbuf;
+	cp = ansbuf + HFIXEDSZ;
+	qdcount = ntohs(hp->qdcount);
+	while (qdcount-- > 0) {
+		int n = dn_skipname(cp, eom);
+		cp += n + QFIXEDSZ;
+		if (n < 0 || cp > eom) {
+			RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+			return (NULL);
+		}
+	}
+	ancount = ntohs(hp->ancount);
+	if (!ancount) {
+		if (hp->aa)
+			RES_SET_H_ERRNO(pvt->res, HOST_NOT_FOUND);
+		else
+			RES_SET_H_ERRNO(pvt->res, TRY_AGAIN);
+		return (NULL);
+	}
+
+	/* Prepare a return structure. */
+	bp = pvt->buf;
+	ep = pvt->buf + sizeof(pvt->buf);
+	pvt->net.n_name = NULL;
+	pvt->net.n_aliases = pvt->ali;
+	pvt->net.n_addrtype = af;
+	pvt->net.n_addr = NULL;
+	pvt->net.n_length = addrlen;
+
+	/* Save input key if given. */
+	switch (by_what) {
+	case by_name:
+		if (name != NULL) {
+			int n = strlen(name) + 1;
+
+			if (n > (ep - bp)) {
+				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+				return (NULL);
+			}
+			pvt->net.n_name = strcpy(bp, name);	/* (checked) */
+			bp += n;
+		}
+		break;
+	case by_addr:
+		if (addr != NULL && addrlen != 0) {
+			int n = addrlen / 8 + ((addrlen % 8) != 0);
+
+			if (INADDRSZ > (ep - bp)) {
+				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+				return (NULL);
+			}
+			memset(bp, 0, INADDRSZ);
+			memcpy(bp, addr, n);
+			pvt->net.n_addr = bp;
+			bp += INADDRSZ;
+		}
+		break;
+	default:
+		abort();
+	}
+
+	/* Parse the answer, collect aliases. */
+	ap = pvt->ali;
+	haveanswer = 0;
+	while (--ancount >= 0 && cp < eom) {
+		int n = dn_expand(ansbuf, eom, cp, bp, ep - bp);
+
+		cp += n;		/*%< Owner */
+		if (n < 0 || !maybe_dnok(pvt->res, bp) ||
+		    cp + 3 * INT16SZ + INT32SZ > eom) {
+			RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+			return (NULL);
+		}
+		GETSHORT(type, cp);	/*%< Type */
+		GETSHORT(class, cp);	/*%< Class */
+		cp += INT32SZ;		/*%< TTL */
+		GETSHORT(n, cp);	/*%< RDLENGTH */
+		if (class == C_IN && type == T_PTR) {
+			int nn;
+
+			nn = dn_expand(ansbuf, eom, cp, bp, ep - bp);
+			if (nn < 0 || !maybe_hnok(pvt->res, bp) || nn != n) {
+				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+				return (NULL);
+			}
+			normalize_name(bp);
+			switch (by_what) {
+			case by_addr: {
+				if (pvt->net.n_name == NULL)
+					pvt->net.n_name = bp;
+				else if (ns_samename(pvt->net.n_name, bp) == 1)
+					break;
+				else
+					*ap++ = bp;
+				nn = strlen(bp) + 1;
+				bp += nn;
+				haveanswer++;
+				break;
+			    }
+			case by_name: {
+				u_int b1, b2, b3, b4;
+
+				if (pvt->net.n_addr != NULL ||
+				    sscanf(bp, "%u.%u.%u.%u.in-addr.arpa",
+					   &b1, &b2, &b3, &b4) != 4)
+					break;
+				if ((ep - bp) < INADDRSZ) {
+					RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+					return (NULL);
+				}
+				pvt->net.n_addr = bp;
+				*bp++ = b4;
+				*bp++ = b3;
+				*bp++ = b2;
+				*bp++ = b1;
+				pvt->net.n_length = INADDRSZ * 8;
+				haveanswer++;
+			    }
+			}
+		}
+		cp += n;		/*%< RDATA */
+	}
+	if (!haveanswer) {
+		RES_SET_H_ERRNO(pvt->res, TRY_AGAIN);
+		return (NULL);
+	}
+	*ap = NULL;
+
+	return (&pvt->net);
+}
+
+static struct nwent *
+get1101mask(struct irs_nw *this, struct nwent *nwent) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char qbuf[sizeof "255.255.255.255.in-addr.arpa"], owner[MAXDNAME];
+	int anslen, type, class, ancount, qdcount;
+	u_char *ansbuf, *cp, *eom;
+	HEADER *hp;
+
+	if (!nwent)
+		return (NULL);
+	if (make1101inaddr(nwent->n_addr, nwent->n_length, qbuf, sizeof qbuf)
+	    < 0) {
+		/* "First, do no harm." */
+		return (nwent);
+	}
+
+	ansbuf = memget(MAXPACKET);
+	if (ansbuf == NULL) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	/* Query for the A RR that would hold this network's mask. */
+	anslen = res_nquery(pvt->res, qbuf, C_IN, T_A, ansbuf, MAXPACKET);
+	if (anslen < HFIXEDSZ) {
+		memput(ansbuf, MAXPACKET);
+		return (nwent);
+	}
+
+	/* Initialize, and parse header. */
+	hp = (HEADER *)ansbuf;
+	cp = ansbuf + HFIXEDSZ;
+	eom = ansbuf + anslen;
+	qdcount = ntohs(hp->qdcount);
+	while (qdcount-- > 0) {
+		int n = dn_skipname(cp, eom);
+		cp += n + QFIXEDSZ;
+		if (n < 0 || cp > eom) {
+			memput(ansbuf, MAXPACKET);
+			return (nwent);
+		}
+	}
+	ancount = ntohs(hp->ancount);
+
+	/* Parse the answer, collect aliases. */
+	while (--ancount >= 0 && cp < eom) {
+		int n = dn_expand(ansbuf, eom, cp, owner, sizeof owner);
+
+		if (n < 0 || !maybe_dnok(pvt->res, owner))
+			break;
+		cp += n;		/*%< Owner */
+		if (cp + 3 * INT16SZ + INT32SZ > eom)
+			break;
+		GETSHORT(type, cp);	/*%< Type */
+		GETSHORT(class, cp);	/*%< Class */
+		cp += INT32SZ;		/*%< TTL */
+		GETSHORT(n, cp);	/*%< RDLENGTH */
+		if (cp + n > eom)
+			break;
+		if (n == INADDRSZ && class == C_IN && type == T_A &&
+		    ns_samename(qbuf, owner) == 1) {
+			/* This A RR indicates the actual netmask. */
+			int nn, mm;
+
+			nwent->n_length = 0;
+			for (nn = 0; nn < INADDRSZ; nn++)
+				for (mm = 7; mm >= 0; mm--)
+					if (cp[nn] & (1 << mm))
+						nwent->n_length++;
+					else
+						break;
+		}
+		cp += n;		/*%< RDATA */
+	}
+	memput(ansbuf, MAXPACKET);
+	return (nwent);
+}
+
+static int
+make1101inaddr(const u_char *net, int bits, char *name, int size) {
+	int n, m;
+	char *ep;
+
+	ep = name + size;
+
+	/* Zero fill any whole bytes left out of the prefix. */
+	for (n = (32 - bits) / 8; n > 0; n--) {
+		if (ep - name < (int)(sizeof "0."))
+			goto emsgsize;
+		m = SPRINTF((name, "0."));
+		name += m;
+	}
+
+	/* Format the partial byte, if any, within the prefix. */
+	if ((n = bits % 8) != 0) {
+		if (ep - name < (int)(sizeof "255."))
+			goto emsgsize;
+		m = SPRINTF((name, "%u.",
+			     net[bits / 8] & ~((1 << (8 - n)) - 1)));
+		name += m;
+	}
+
+	/* Format the whole bytes within the prefix. */
+	for (n = bits / 8; n > 0; n--) {
+		if (ep - name < (int)(sizeof "255."))
+			goto emsgsize;
+		m = SPRINTF((name, "%u.", net[n - 1]));
+		name += m;
+	}
+
+	/* Add the static text. */
+	if (ep - name < (int)(sizeof "in-addr.arpa"))
+		goto emsgsize;
+	(void) SPRINTF((name, "in-addr.arpa"));
+	return (0);
+
+ emsgsize:
+	errno = EMSGSIZE;
+	return (-1);
+}
+
+static void
+normalize_name(char *name) {
+	char *t;
+
+	/* Make lower case. */
+	for (t = name; *t; t++)
+		if (isascii((unsigned char)*t) && isupper((unsigned char)*t))
+			*t = tolower((*t)&0xff);
+
+	/* Remove trailing dots. */
+	while (t > name && t[-1] == '.')
+		*--t = '\0';
+}
+
+static int
+init(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (!pvt->res && !nw_res_get(this))
+		return (-1);
+	if (((pvt->res->options & RES_INIT) == 0U) &&
+	    res_ninit(pvt->res) == -1)
+		return (-1);
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/dns_p.h b/usr/src/lib/libresolv2_joy/common/irs/dns_p.h
new file mode 100644
index 0000000000..d85ae2a238
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/dns_p.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: dns_p.h,v 1.4 2005/04/27 04:56:22 sra Exp $
+ */
+
+#ifndef _DNS_P_H_INCLUDED
+#define	_DNS_P_H_INCLUDED
+
+#define	maybe_ok(res, nm, ok) (((res)->options & RES_NOCHECKNAME) != 0U || \
+			       (ok)(nm) != 0)
+#define maybe_hnok(res, hn) maybe_ok((res), (hn), res_hnok)
+#define maybe_dnok(res, dn) maybe_ok((res), (dn), res_dnok)
+
+/*%
+ * Object state.
+ */
+struct dns_p {
+	void			*hes_ctx;
+	struct __res_state	*res;
+	void                    (*free_res) __P((void *));
+};
+
+/*
+ * Methods.
+ */
+
+extern struct irs_gr *	irs_dns_gr __P((struct irs_acc *));
+extern struct irs_pw *	irs_dns_pw __P((struct irs_acc *));
+extern struct irs_sv *	irs_dns_sv __P((struct irs_acc *));
+extern struct irs_pr *	irs_dns_pr __P((struct irs_acc *));
+extern struct irs_ho *	irs_dns_ho __P((struct irs_acc *));
+extern struct irs_nw *	irs_dns_nw __P((struct irs_acc *));
+
+#endif /*_DNS_P_H_INCLUDED*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/dns_pr.c b/usr/src/lib/libresolv2_joy/common/irs/dns_pr.c
new file mode 100644
index 0000000000..c281be432c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/dns_pr.c
@@ -0,0 +1,268 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: dns_pr.c,v 1.5 2005/04/27 04:56:22 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <netdb.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "hesiod.h"
+#include "dns_p.h"
+
+/* Types. */
+
+struct pvt {
+	struct dns_p *		dns;
+	struct protoent		proto;
+	char *			prbuf;
+};
+
+/* Forward. */
+
+static void 			pr_close(struct irs_pr *);
+static struct protoent *	pr_byname(struct irs_pr *, const char *);
+static struct protoent *	pr_bynumber(struct irs_pr *, int);
+static struct protoent *	pr_next(struct irs_pr *);
+static void			pr_rewind(struct irs_pr *);
+static void			pr_minimize(struct irs_pr *);
+static struct __res_state *	pr_res_get(struct irs_pr *);
+static void			pr_res_set(struct irs_pr *,
+					   struct __res_state *,
+					   void (*)(void *));
+
+static struct protoent *	parse_hes_list(struct irs_pr *, char **);
+
+/* Public. */
+
+struct irs_pr *
+irs_dns_pr(struct irs_acc *this) {
+	struct dns_p *dns = (struct dns_p *)this->private;
+	struct pvt *pvt;
+	struct irs_pr *pr;
+
+	if (!dns->hes_ctx) {
+		errno = ENODEV;
+		return (NULL);
+	}
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	if (!(pr = memget(sizeof *pr))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pr, 0x5e, sizeof *pr);
+	pvt->dns = dns;
+	pr->private = pvt;
+	pr->byname = pr_byname;
+	pr->bynumber = pr_bynumber;
+	pr->next = pr_next;
+	pr->rewind = pr_rewind;
+	pr->close = pr_close;
+	pr->minimize = pr_minimize;
+	pr->res_get = pr_res_get;
+	pr->res_set = pr_res_set;
+	return (pr);
+}
+
+/* Methods. */
+
+static void
+pr_close(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->proto.p_aliases)
+		free(pvt->proto.p_aliases);
+	if (pvt->prbuf)
+		free(pvt->prbuf);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct protoent *
+pr_byname(struct irs_pr *this, const char *name) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+	struct protoent *proto;
+	char **hes_list;
+
+	if (!(hes_list = hesiod_resolve(dns->hes_ctx, name, "protocol")))
+		return (NULL);
+
+	proto = parse_hes_list(this, hes_list);
+	hesiod_free_list(dns->hes_ctx, hes_list);
+	return (proto);
+}
+
+static struct protoent *
+pr_bynumber(struct irs_pr *this, int num) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+	struct protoent *proto;
+	char numstr[16];
+	char **hes_list;
+
+	sprintf(numstr, "%d", num);
+	if (!(hes_list = hesiod_resolve(dns->hes_ctx, numstr, "protonum")))
+		return (NULL);
+	
+	proto = parse_hes_list(this, hes_list);
+	hesiod_free_list(dns->hes_ctx, hes_list);
+	return (proto);
+}
+
+static struct protoent *
+pr_next(struct irs_pr *this) {
+	UNUSED(this);
+	errno = ENODEV;
+	return (NULL);
+}
+
+static void
+pr_rewind(struct irs_pr *this) {
+	UNUSED(this);
+	/* NOOP */
+}
+
+static void
+pr_minimize(struct irs_pr *this) {
+	UNUSED(this);
+	/* NOOP */
+}
+
+static struct __res_state *
+pr_res_get(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+
+	return (__hesiod_res_get(dns->hes_ctx));
+}
+
+static void
+pr_res_set(struct irs_pr *this, struct __res_state * res,
+	   void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+
+	__hesiod_res_set(dns->hes_ctx, res, free_res);
+}
+
+/* Private. */
+
+static struct protoent *
+parse_hes_list(struct irs_pr *this, char **hes_list) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char *p, *cp, **cpp, **new;
+	int num = 0;
+	int max = 0;
+	
+	for (cpp = hes_list; *cpp; cpp++) {
+		cp = *cpp;
+
+		/* Strip away comments, if any. */
+		if ((p = strchr(cp, '#')))
+			*p = 0;
+
+		/* Skip blank lines. */
+		p = cp;
+		while (*p && !isspace((unsigned char)*p))
+			p++;
+		if (!*p)
+			continue;
+
+		/* OK, we've got a live one.  Let's parse it for real. */
+		if (pvt->prbuf)
+			free(pvt->prbuf);
+		pvt->prbuf = strdup(cp);
+
+		p = pvt->prbuf;
+		pvt->proto.p_name = p;
+		while (*p && !isspace((unsigned char)*p))
+			p++;
+		if (!*p)
+			continue;
+		*p++ = '\0';
+
+		pvt->proto.p_proto = atoi(p);
+		while (*p && !isspace((unsigned char)*p))
+			p++;
+		if (*p)
+			*p++ = '\0';
+
+		while (*p) {
+			if ((num + 1) >= max || !pvt->proto.p_aliases) {
+				max += 10;
+				new = realloc(pvt->proto.p_aliases,
+					      max * sizeof(char *));
+				if (!new) {
+					errno = ENOMEM;
+					goto cleanup;
+				}
+				pvt->proto.p_aliases = new;
+			}
+			pvt->proto.p_aliases[num++] = p;
+			while (*p && !isspace((unsigned char)*p))
+				p++;
+			if (*p)
+				*p++ = '\0';
+		}
+		if (!pvt->proto.p_aliases)
+			pvt->proto.p_aliases = malloc(sizeof(char *));
+		if (!pvt->proto.p_aliases)
+			goto cleanup;
+		pvt->proto.p_aliases[num] = NULL;
+		return (&pvt->proto);
+	}
+	
+ cleanup:
+	if (pvt->proto.p_aliases) {
+		free(pvt->proto.p_aliases);
+		pvt->proto.p_aliases = NULL;
+	}
+	if (pvt->prbuf) {
+		free(pvt->prbuf);
+		pvt->prbuf = NULL;
+	}
+	return (NULL);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/dns_sv.c b/usr/src/lib/libresolv2_joy/common/irs/dns_sv.c
new file mode 100644
index 0000000000..1001dc1051
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/dns_sv.c
@@ -0,0 +1,300 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: dns_sv.c,v 1.5 2005/04/27 04:56:23 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <netdb.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "hesiod.h"
+#include "dns_p.h"
+
+/* Definitions */
+
+struct pvt {
+	struct dns_p *		dns;
+	struct servent		serv;
+	char *			svbuf;
+	struct __res_state *	res;
+	void			(*free_res)(void *);
+};
+
+/* Forward. */
+
+static void 			sv_close(struct irs_sv *);
+static struct servent *		sv_byname(struct irs_sv *,
+					  const char *, const char *);
+static struct servent *		sv_byport(struct irs_sv *, int, const char *);
+static struct servent *		sv_next(struct irs_sv *);
+static void			sv_rewind(struct irs_sv *);
+static void			sv_minimize(struct irs_sv *);
+#ifdef SV_RES_SETGET
+static struct __res_state *	sv_res_get(struct irs_sv *);
+static void			sv_res_set(struct irs_sv *,
+					   struct __res_state *,
+					   void (*)(void *));
+#endif
+
+static struct servent *		parse_hes_list(struct irs_sv *,
+					       char **, const char *);
+
+/* Public */
+
+struct irs_sv *
+irs_dns_sv(struct irs_acc *this) {
+	struct dns_p *dns = (struct dns_p *)this->private;
+	struct irs_sv *sv;
+	struct pvt *pvt;
+
+	if (!dns || !dns->hes_ctx) {
+		errno = ENODEV;
+		return (NULL);
+	}
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->dns = dns;
+	if (!(sv = memget(sizeof *sv))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(sv, 0x5e, sizeof *sv);
+	sv->private = pvt;
+	sv->byname = sv_byname;
+	sv->byport = sv_byport;
+	sv->next = sv_next;
+	sv->rewind = sv_rewind;
+	sv->close = sv_close;
+	sv->minimize = sv_minimize;
+#ifdef SV_RES_SETGET
+	sv->res_get = sv_res_get;
+	sv->res_set = sv_res_set;
+#else
+	sv->res_get = NULL; /*%< sv_res_get; */
+	sv->res_set = NULL; /*%< sv_res_set; */
+#endif
+	return (sv);
+}
+
+/* Methods */
+
+static void
+sv_close(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->serv.s_aliases)
+		free(pvt->serv.s_aliases);
+	if (pvt->svbuf)
+		free(pvt->svbuf);
+
+	if (pvt->res && pvt->free_res)
+		(*pvt->free_res)(pvt->res);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct servent *
+sv_byname(struct irs_sv *this, const char *name, const char *proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+	struct servent *s;
+	char **hes_list;
+
+	if (!(hes_list = hesiod_resolve(dns->hes_ctx, name, "service")))
+		return (NULL);
+
+	s = parse_hes_list(this, hes_list, proto);
+	hesiod_free_list(dns->hes_ctx, hes_list);
+	return (s);
+}
+
+static struct servent *
+sv_byport(struct irs_sv *this, int port, const char *proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+	struct servent *s;
+	char portstr[16];
+	char **hes_list;
+
+	sprintf(portstr, "%d", ntohs(port));
+	if (!(hes_list = hesiod_resolve(dns->hes_ctx, portstr, "port")))
+		return (NULL);
+	
+	s = parse_hes_list(this, hes_list, proto);
+	hesiod_free_list(dns->hes_ctx, hes_list);
+	return (s);
+}
+
+static struct servent *
+sv_next(struct irs_sv *this) {
+	UNUSED(this);
+	errno = ENODEV;
+	return (NULL);
+}
+
+static void
+sv_rewind(struct irs_sv *this) {
+	UNUSED(this);
+	/* NOOP */
+}
+
+/* Private */
+
+static struct servent *
+parse_hes_list(struct irs_sv *this, char **hes_list, const char *proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char *p, *cp, **cpp, **new;
+	int proto_len;
+	int num = 0;
+	int max = 0;
+	
+	for (cpp = hes_list; *cpp; cpp++) {
+		cp = *cpp;
+
+		/* Strip away comments, if any. */
+		if ((p = strchr(cp, '#')))
+			*p = 0;
+
+		/* Check to make sure the protocol matches. */
+		p = cp;
+		while (*p && !isspace((unsigned char)*p))
+			p++;
+		if (!*p)
+			continue;
+		if (proto) {
+		     proto_len = strlen(proto);
+		     if (strncasecmp(++p, proto, proto_len) != 0)
+			  continue;
+		     if (p[proto_len] && !isspace(p[proto_len]&0xff))
+			  continue;
+		}
+		/* OK, we've got a live one.  Let's parse it for real. */
+		if (pvt->svbuf)
+			free(pvt->svbuf);
+		pvt->svbuf = strdup(cp);
+
+		p = pvt->svbuf;
+		pvt->serv.s_name = p;
+		while (*p && !isspace(*p&0xff))
+			p++;
+		if (!*p)
+			continue;
+		*p++ = '\0';
+
+		pvt->serv.s_proto = p;
+		while (*p && !isspace(*p&0xff))
+			p++;
+		if (!*p)
+			continue;
+		*p++ = '\0';
+
+		pvt->serv.s_port = htons((u_short) atoi(p));
+		while (*p && !isspace(*p&0xff))
+			p++;
+		if (*p)
+			*p++ = '\0';
+
+		while (*p) {
+			if ((num + 1) >= max || !pvt->serv.s_aliases) {
+				max += 10;
+				new = realloc(pvt->serv.s_aliases,
+					      max * sizeof(char *));
+				if (!new) {
+					errno = ENOMEM;
+					goto cleanup;
+				}
+				pvt->serv.s_aliases = new;
+			}
+			pvt->serv.s_aliases[num++] = p;
+			while (*p && !isspace(*p&0xff))
+				p++;
+			if (*p)
+				*p++ = '\0';
+		}
+		if (!pvt->serv.s_aliases)
+			pvt->serv.s_aliases = malloc(sizeof(char *));
+		if (!pvt->serv.s_aliases)
+			goto cleanup;
+		pvt->serv.s_aliases[num] = NULL;
+		return (&pvt->serv);
+	}
+	
+ cleanup:
+	if (pvt->serv.s_aliases) {
+		free(pvt->serv.s_aliases);
+		pvt->serv.s_aliases = NULL;
+	}
+	if (pvt->svbuf) {
+		free(pvt->svbuf);
+		pvt->svbuf = NULL;
+	}
+	return (NULL);
+}
+
+static void
+sv_minimize(struct irs_sv *this) {
+	UNUSED(this);
+	/* NOOP */
+}
+
+#ifdef SV_RES_SETGET
+static struct __res_state *
+sv_res_get(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+
+	return (__hesiod_res_get(dns->hes_ctx));
+}
+
+static void
+sv_res_set(struct irs_sv *this, struct __res_state * res,
+	   void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct dns_p *dns = pvt->dns;
+
+	__hesiod_res_set(dns->hes_ctx, res, free_res);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gai_strerror.c b/usr/src/lib/libresolv2_joy/common/irs/gai_strerror.c
new file mode 100644
index 0000000000..9ca1c4bfe1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gai_strerror.c
@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2001 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <port_before.h>
+#include <netdb.h>
+#include <port_after.h>
+
+#ifdef DO_PTHREADS
+#include <pthread.h>
+#include <stdlib.h>
+#endif
+
+static const char *gai_errlist[] = {
+	"no error",
+	"address family not supported for name",/*%< EAI_ADDRFAMILY */
+	"temporary failure",			/*%< EAI_AGAIN */
+	"invalid flags",			/*%< EAI_BADFLAGS */
+	"permanent failure",			/*%< EAI_FAIL */
+	"address family not supported",		/*%< EAI_FAMILY */
+	"memory failure",			/*%< EAI_MEMORY */
+	"no address",				/*%< EAI_NODATA */
+	"unknown name or service",		/*%< EAI_NONAME */
+	"service not supported for socktype",	/*%< EAI_SERVICE */
+	"socktype not supported",		/*%< EAI_SOCKTYPE */
+	"system failure",			/*%< EAI_SYSTEM */
+	"bad hints",				/*%< EAI_BADHINTS */
+	"bad protocol",				/*%< EAI_PROTOCOL */
+	"unknown error"				/*%< Must be last. */
+};
+
+static const int gai_nerr = (sizeof(gai_errlist)/sizeof(*gai_errlist));
+
+#define EAI_BUFSIZE 128
+
+const char *
+gai_strerror(int ecode) {
+#ifndef DO_PTHREADS
+	static char buf[EAI_BUFSIZE];
+#else	/* DO_PTHREADS */
+#ifndef LIBBIND_MUTEX_INITIALIZER
+#define LIBBIND_MUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER
+#endif
+	static pthread_mutex_t lock = LIBBIND_MUTEX_INITIALIZER;
+	static pthread_key_t key;
+	static int once = 0;
+	char *buf;
+#endif
+
+	if (ecode >= 0 && ecode < (gai_nerr - 1))
+		return (gai_errlist[ecode]);
+
+#ifdef DO_PTHREADS
+        if (!once) {
+                if (pthread_mutex_lock(&lock) != 0)
+			goto unknown;
+                if (!once) {
+                        if (pthread_key_create(&key, free) != 0) {
+				(void)pthread_mutex_unlock(&lock);
+				goto unknown;
+			}
+			once = 1;
+		}
+                if (pthread_mutex_unlock(&lock) != 0)
+			goto unknown;
+        }
+
+	buf = pthread_getspecific(key);
+        if (buf == NULL) {
+		buf = malloc(EAI_BUFSIZE);
+                if (buf == NULL)
+                        goto unknown;
+                if (pthread_setspecific(key, buf) != 0) {
+			free(buf);
+			goto unknown;
+		}
+        }
+#endif
+	/* 
+	 * XXX This really should be snprintf(buf, EAI_BUFSIZE, ...).
+	 * It is safe until message catalogs are used.
+	 */
+	sprintf(buf, "%s: %d", gai_errlist[gai_nerr - 1], ecode);
+	return (buf);
+
+#ifdef DO_PTHREADS
+ unknown:
+	return ("unknown error");
+#endif
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gen.c b/usr/src/lib/libresolv2_joy/common/irs/gen.c
new file mode 100644
index 0000000000..7da01f5b09
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gen.c
@@ -0,0 +1,459 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: gen.c,v 1.7 2005/04/27 04:56:23 sra Exp $";
+#endif
+
+/*! \file
+ * \brief
+ * this is the top level dispatcher
+ *
+ * The dispatcher is implemented as an accessor class; it is an
+ * accessor class that calls other accessor classes, as controlled by a
+ * configuration file.
+ * 
+ * A big difference between this accessor class and others is that the
+ * map class initializers are NULL, and the map classes are already
+ * filled in with method functions that will do the right thing.
+ */
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <isc/assertions.h>
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <sys/types.h>
+#include <netinet/in.h> 
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "gen_p.h"
+
+#ifdef SUNW_HOSTS_FALLBACK
+extern int __res_no_hosts_fallback(void);
+#endif /* SUNW_HOSTS_FALLBACK */
+
+/* Definitions */
+
+struct nameval {
+	const char *	name;
+	int		val;
+};
+
+static const struct nameval acc_names[irs_nacc+1] = {
+	{ "local", irs_lcl },
+	{ "dns", irs_dns },
+	{ "nis", irs_nis },
+	{ "irp", irs_irp },
+	{ NULL, irs_nacc }
+};
+
+typedef struct irs_acc *(*accinit) __P((const char *options));
+
+static const accinit accs[irs_nacc+1] = {
+	irs_lcl_acc,
+	irs_dns_acc,
+#ifdef WANT_IRS_NIS
+	irs_nis_acc,
+#else
+	NULL,
+#endif
+	irs_irp_acc,
+	NULL
+};
+
+static const struct nameval map_names[irs_nmap+1] = {
+	{ "group", irs_gr },
+	{ "passwd", irs_pw },
+	{ "services", irs_sv },
+	{ "protocols", irs_pr },
+	{ "hosts", irs_ho },
+	{ "networks", irs_nw },
+	{ "netgroup", irs_ng },
+	{ NULL, irs_nmap }
+};
+
+static const struct nameval option_names[] = {
+	{ "merge", IRS_MERGE },
+	{ "continue", IRS_CONTINUE },
+	{ NULL, 0 }
+};
+
+/* Forward */
+
+static void		gen_close(struct irs_acc *);
+static struct __res_state * gen_res_get(struct irs_acc *);
+static void		gen_res_set(struct irs_acc *, struct __res_state *,
+				    void (*)(void *));
+static int		find_name(const char *, const struct nameval nv[]);
+static void 		init_map_rules(struct gen_p *, const char *conf_file);
+static struct irs_rule *release_rule(struct irs_rule *);
+static int		add_rule(struct gen_p *,
+				 enum irs_map_id, enum irs_acc_id,
+				 const char *);
+
+/* Public */
+
+struct irs_acc *
+irs_gen_acc(const char *options, const char *conf_file) {
+	struct irs_acc *acc;
+	struct gen_p *irs;
+		
+	if (!(acc = memget(sizeof *acc))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(acc, 0x5e, sizeof *acc);
+	if (!(irs = memget(sizeof *irs))) {
+		errno = ENOMEM;
+		memput(acc, sizeof *acc);
+		return (NULL);
+	}
+	memset(irs, 0x5e, sizeof *irs);
+	irs->options = strdup(options);
+	irs->res = NULL;
+	irs->free_res = NULL;
+	memset(irs->accessors, 0, sizeof irs->accessors);
+	memset(irs->map_rules, 0, sizeof irs->map_rules);
+	init_map_rules(irs, conf_file);
+	acc->private = irs;
+#ifdef WANT_IRS_GR
+	acc->gr_map = irs_gen_gr;
+#else
+	acc->gr_map = NULL;
+#endif
+#ifdef WANT_IRS_PW
+	acc->pw_map = irs_gen_pw;
+#else
+	acc->pw_map = NULL;
+#endif
+	acc->sv_map = irs_gen_sv;
+	acc->pr_map = irs_gen_pr;
+	acc->ho_map = irs_gen_ho;
+	acc->nw_map = irs_gen_nw;
+	acc->ng_map = irs_gen_ng;
+	acc->res_get = gen_res_get;
+	acc->res_set = gen_res_set;
+	acc->close = gen_close;
+	return (acc);
+}
+
+/* Methods */
+
+static struct __res_state *
+gen_res_get(struct irs_acc *this) {
+	struct gen_p *irs = (struct gen_p *)this->private;
+
+	if (irs->res == NULL) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (res == NULL)
+			return (NULL);
+		memset(res, 0, sizeof *res);
+		gen_res_set(this, res, free);
+	}
+
+	if (((irs->res->options & RES_INIT) == 0U) && res_ninit(irs->res) < 0)
+		return (NULL);
+
+	return (irs->res);
+}
+
+static void
+gen_res_set(struct irs_acc *this, struct __res_state *res,
+	    void (*free_res)(void *)) {
+	struct gen_p *irs = (struct gen_p *)this->private;
+#if 0
+	struct irs_rule *rule;
+	struct irs_ho *ho;
+	struct irs_nw *nw;
+#endif
+
+	if (irs->res && irs->free_res) {
+		res_nclose(irs->res);
+		(*irs->free_res)(irs->res);
+	}
+
+	irs->res = res;
+	irs->free_res = free_res;
+
+#if 0
+	for (rule = irs->map_rules[irs_ho]; rule; rule = rule->next) {
+                ho = rule->inst->ho;
+
+                (*ho->res_set)(ho, res, NULL);
+	}
+	for (rule = irs->map_rules[irs_nw]; rule; rule = rule->next) {
+                nw = rule->inst->nw;
+
+                (*nw->res_set)(nw, res, NULL);
+	}
+#endif
+}
+
+static void
+gen_close(struct irs_acc *this) {
+	struct gen_p *irs = (struct gen_p *)this->private;
+	int n;
+	
+	/* Search rules. */
+	for (n = 0; n < irs_nmap; n++)
+		while (irs->map_rules[n] != NULL)
+			irs->map_rules[n] = release_rule(irs->map_rules[n]);
+
+	/* Access methods. */
+	for (n = 0; n < irs_nacc; n++) {
+		/* Map objects. */
+		if (irs->accessors[n].gr != NULL)
+			(*irs->accessors[n].gr->close)(irs->accessors[n].gr);
+		if (irs->accessors[n].pw != NULL)
+			(*irs->accessors[n].pw->close)(irs->accessors[n].pw);
+		if (irs->accessors[n].sv != NULL)
+			(*irs->accessors[n].sv->close)(irs->accessors[n].sv);
+		if (irs->accessors[n].pr != NULL)
+			(*irs->accessors[n].pr->close)(irs->accessors[n].pr);
+		if (irs->accessors[n].ho != NULL)
+			(*irs->accessors[n].ho->close)(irs->accessors[n].ho);
+		if (irs->accessors[n].nw != NULL)
+			(*irs->accessors[n].nw->close)(irs->accessors[n].nw);
+		if (irs->accessors[n].ng != NULL)
+			(*irs->accessors[n].ng->close)(irs->accessors[n].ng);
+		/* Enclosing accessor. */
+		if (irs->accessors[n].acc != NULL)
+			(*irs->accessors[n].acc->close)(irs->accessors[n].acc);
+	}
+
+	/* The options string was strdup'd. */
+	free((void*)irs->options);
+
+	if (irs->res && irs->free_res)
+		(*irs->free_res)(irs->res);
+
+	/* The private data container. */
+	memput(irs, sizeof *irs);
+
+	/* The object. */
+	memput(this, sizeof *this);
+}
+
+/* Private */
+
+static int
+find_name(const char *name, const struct nameval names[]) {
+	int n;
+
+	for (n = 0; names[n].name != NULL; n++)
+		if (strcmp(name, names[n].name) == 0)
+			return (names[n].val);
+	return (-1);
+}
+
+static struct irs_rule *
+release_rule(struct irs_rule *rule) {
+	struct irs_rule *next = rule->next;
+
+	memput(rule, sizeof *rule);
+	return (next);
+}
+
+static int
+add_rule(struct gen_p *irs,
+	 enum irs_map_id map, enum irs_acc_id acc,
+	 const char *options)
+{
+	struct irs_rule **rules, *last, *tmp, *new;
+	struct irs_inst *inst;
+	const char *cp;
+	int n;
+
+#ifndef WANT_IRS_GR
+	if (map == irs_gr)
+		return (-1);
+#endif
+#ifndef WANT_IRS_PW
+	if (map == irs_pw)
+		return (-1);
+#endif
+#ifndef WANT_IRS_NIS
+	if (acc == irs_nis)
+		return (-1);
+#endif
+	new = memget(sizeof *new);
+	if (new == NULL)
+		return (-1);
+	memset(new, 0x5e, sizeof *new);
+	new->next = NULL;
+
+	new->inst = &irs->accessors[acc];
+
+	new->flags = 0;
+	cp = options;
+	while (cp && *cp) {
+		char option[50], *next;
+
+		next = strchr(cp, ',');
+		if (next)
+			n = next++ - cp;
+		else
+			n = strlen(cp);
+		if ((size_t)n > sizeof option - 1)
+			n = sizeof option - 1;
+		strncpy(option, cp, n);
+		option[n] = '\0';
+
+		n = find_name(option, option_names);
+		if (n >= 0)
+			new->flags |= n;
+
+		cp = next;
+	}
+
+	rules = &irs->map_rules[map];
+	for (last = NULL, tmp = *rules;
+	     tmp != NULL;
+	     last = tmp, tmp = tmp->next)
+		(void)NULL;
+	if (last == NULL)
+		*rules = new;
+	else
+		last->next = new;
+
+	/* Try to instantiate map accessors for this if necessary & approp. */
+	inst = &irs->accessors[acc];
+	if (inst->acc == NULL && accs[acc] != NULL)
+		inst->acc = (*accs[acc])(irs->options);
+	if (inst->acc != NULL) {
+		if (inst->gr == NULL && inst->acc->gr_map != NULL)
+			inst->gr = (*inst->acc->gr_map)(inst->acc);
+		if (inst->pw == NULL && inst->acc->pw_map != NULL)
+			inst->pw = (*inst->acc->pw_map)(inst->acc);
+		if (inst->sv == NULL && inst->acc->sv_map != NULL)
+			inst->sv = (*inst->acc->sv_map)(inst->acc);
+		if (inst->pr == NULL && inst->acc->pr_map != NULL)
+			inst->pr = (*inst->acc->pr_map)(inst->acc);
+		if (inst->ho == NULL && inst->acc->ho_map != NULL)
+			inst->ho = (*inst->acc->ho_map)(inst->acc);
+		if (inst->nw == NULL && inst->acc->nw_map != NULL)
+			inst->nw = (*inst->acc->nw_map)(inst->acc);
+		if (inst->ng == NULL && inst->acc->ng_map != NULL)
+			inst->ng = (*inst->acc->ng_map)(inst->acc);
+	}
+
+	return (0);
+}
+
+static void
+default_map_rules(struct gen_p *irs) {
+	/* Install time honoured and proved BSD style rules as default. */
+	add_rule(irs, irs_gr, irs_lcl, "");
+	add_rule(irs, irs_pw, irs_lcl, "");
+	add_rule(irs, irs_sv, irs_lcl, "");
+	add_rule(irs, irs_pr, irs_lcl, "");
+#ifdef SUNW_HOSTS_FALLBACK
+	if (__res_no_hosts_fallback())
+		add_rule(irs, irs_ho, irs_dns, "");
+	else {
+		add_rule(irs, irs_ho, irs_dns, "continue");
+		add_rule(irs, irs_ho, irs_lcl, "");
+	}
+#else  /* SUNW_HOSTS_FALLBACK */
+	add_rule(irs, irs_ho, irs_dns, "continue");
+	add_rule(irs, irs_ho, irs_lcl, "");
+#endif /* SUNW_HOSTS_FALLBACK */
+	add_rule(irs, irs_nw, irs_dns, "continue");
+	add_rule(irs, irs_nw, irs_lcl, "");
+	add_rule(irs, irs_ng, irs_lcl, "");
+}
+
+static void
+init_map_rules(struct gen_p *irs, const char *conf_file) {
+	char line[1024], pattern[40], mapname[20], accname[20], options[100];
+	FILE *conf;
+
+#ifdef SUNW_HOSTS_FALLBACK
+	if (__res_no_hosts_fallback()) {
+		default_map_rules(irs);
+		return;
+	}
+#endif /* SUNW_HOSTS_FALLBACK */
+
+	if (conf_file == NULL) 
+		conf_file = _PATH_IRS_CONF ;
+
+	/* A conf file of "" means compiled in defaults. Irpd wants this */
+	if (conf_file[0] == '\0' || (conf = fopen(conf_file, "r")) == NULL) {
+		default_map_rules(irs);
+		return;
+	}
+	(void) sprintf(pattern, "%%%lus %%%lus %%%lus\n",
+		       (unsigned long)sizeof mapname,
+		       (unsigned long)sizeof accname,
+		       (unsigned long)sizeof options);
+	while (fgets(line, sizeof line, conf)) {
+		enum irs_map_id map;
+		enum irs_acc_id acc;
+		char *tmp;
+		int n;
+
+		for (tmp = line;
+		     isascii((unsigned char)*tmp) &&
+		     isspace((unsigned char)*tmp);
+		     tmp++)
+			(void)NULL;
+		if (*tmp == '#' || *tmp == '\n' || *tmp == '\0')
+			continue;
+		n = sscanf(tmp, pattern, mapname, accname, options);
+		if (n < 2)
+			continue;
+		if (n < 3)
+			options[0] = '\0';
+
+		n = find_name(mapname, map_names);
+		INSIST(n < irs_nmap);
+		if (n < 0)
+			continue;
+		map = (enum irs_map_id) n;
+
+		n = find_name(accname, acc_names);
+		INSIST(n < irs_nacc);
+		if (n < 0)
+			continue;
+		acc = (enum irs_acc_id) n;
+
+		add_rule(irs, map, acc, options);
+	}
+	fclose(conf);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gen_ho.c b/usr/src/lib/libresolv2_joy/common/irs/gen_ho.c
new file mode 100644
index 0000000000..8e41d7d610
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gen_ho.c
@@ -0,0 +1,391 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: gen_ho.c,v 1.5 2006/03/09 23:57:56 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "gen_p.h"
+
+/* Definitions */
+
+struct pvt {
+	struct irs_rule *	rules;
+	struct irs_rule *	rule;
+	struct irs_ho *		ho;
+	struct __res_state *	res;
+	void			(*free_res)(void *);
+};
+
+/* Forwards */
+
+static void		ho_close(struct irs_ho *this);
+static struct hostent *	ho_byname(struct irs_ho *this, const char *name);
+static struct hostent *	ho_byname2(struct irs_ho *this, const char *name,
+				   int af);
+static struct hostent *	ho_byaddr(struct irs_ho *this, const void *addr,
+				  int len, int af);
+static struct hostent *	ho_next(struct irs_ho *this);
+static void		ho_rewind(struct irs_ho *this);
+static void		ho_minimize(struct irs_ho *this);
+static struct __res_state * ho_res_get(struct irs_ho *this);
+static void		ho_res_set(struct irs_ho *this,
+				   struct __res_state *res,
+				   void (*free_res)(void *));
+static struct addrinfo * ho_addrinfo(struct irs_ho *this, const char *name,
+				     const struct addrinfo *pai);
+
+static int		init(struct irs_ho *this);
+
+/* Exports */
+
+struct irs_ho *
+irs_gen_ho(struct irs_acc *this) {
+	struct gen_p *accpvt = (struct gen_p *)this->private;
+	struct irs_ho *ho;
+	struct pvt *pvt;
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	if (!(ho = memget(sizeof *ho))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ho, 0x5e, sizeof *ho);
+	pvt->rules = accpvt->map_rules[irs_ho];
+	pvt->rule = pvt->rules;
+	ho->private = pvt;
+	ho->close = ho_close;
+	ho->byname = ho_byname;
+	ho->byname2 = ho_byname2;
+	ho->byaddr = ho_byaddr;
+	ho->next = ho_next;
+	ho->rewind = ho_rewind;
+	ho->minimize = ho_minimize;
+	ho->res_get = ho_res_get;
+	ho->res_set = ho_res_set;
+	ho->addrinfo = ho_addrinfo;
+	return (ho);
+}
+
+/* Methods. */
+
+static void
+ho_close(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	ho_minimize(this);
+	if (pvt->res && pvt->free_res)
+		(*pvt->free_res)(pvt->res);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct hostent *
+ho_byname(struct irs_ho *this, const char *name) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct hostent *rval;
+	struct irs_ho *ho;
+	int therrno = NETDB_INTERNAL;
+	int softerror = 0;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		ho = rule->inst->ho;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = 0;
+		rval = (*ho->byname)(ho, name);
+		if (rval != NULL)
+			return (rval);
+		if (softerror == 0 &&
+		    pvt->res->res_h_errno != HOST_NOT_FOUND &&
+		    pvt->res->res_h_errno != NETDB_INTERNAL) {
+			softerror = 1;
+			therrno = pvt->res->res_h_errno;
+		}
+		if (rule->flags & IRS_CONTINUE)
+			continue;
+		/*
+		 * The value TRY_AGAIN can mean that the service
+		 * is not available, or just that this particular name
+		 * cannot be resolved now.  We use the errno ECONNREFUSED
+		 * to distinguish.  If a lookup sets that errno when
+		 * H_ERRNO is TRY_AGAIN, we continue to try other lookup
+		 * functions, otherwise we return the TRY_AGAIN error.
+		 */
+		if (pvt->res->res_h_errno != TRY_AGAIN || errno != ECONNREFUSED)
+			break;
+	}
+	if (softerror != 0 && pvt->res->res_h_errno == HOST_NOT_FOUND)
+		RES_SET_H_ERRNO(pvt->res, therrno);
+	return (NULL);
+}
+
+static struct hostent *
+ho_byname2(struct irs_ho *this, const char *name, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct hostent *rval;
+	struct irs_ho *ho;
+	int therrno = NETDB_INTERNAL;
+	int softerror = 0;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		ho = rule->inst->ho;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = 0;
+		rval = (*ho->byname2)(ho, name, af);
+		if (rval != NULL)
+			return (rval);
+		if (softerror == 0 &&
+		    pvt->res->res_h_errno != HOST_NOT_FOUND &&
+		    pvt->res->res_h_errno != NETDB_INTERNAL) {
+			softerror = 1;
+			therrno = pvt->res->res_h_errno;
+		}
+		if (rule->flags & IRS_CONTINUE)
+			continue;
+		/*
+		 * See the comments in ho_byname() explaining
+		 * the interpretation of TRY_AGAIN and ECONNREFUSED.
+		 */
+		if (pvt->res->res_h_errno != TRY_AGAIN || errno != ECONNREFUSED)
+			break;
+	}
+	if (softerror != 0 && pvt->res->res_h_errno == HOST_NOT_FOUND)
+		RES_SET_H_ERRNO(pvt->res, therrno);
+	return (NULL);
+}
+
+static struct hostent *
+ho_byaddr(struct irs_ho *this, const void *addr, int len, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct hostent *rval;
+	struct irs_ho *ho;
+	int therrno = NETDB_INTERNAL;
+	int softerror = 0;
+
+
+	if (init(this) == -1)
+		return (NULL);
+
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		ho = rule->inst->ho;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = 0;
+		rval = (*ho->byaddr)(ho, addr, len, af);
+		if (rval != NULL)
+			return (rval);
+		if (softerror == 0 &&
+		    pvt->res->res_h_errno != HOST_NOT_FOUND &&
+		    pvt->res->res_h_errno != NETDB_INTERNAL) {
+			softerror = 1;
+			therrno = pvt->res->res_h_errno;
+		}
+
+		if (rule->flags & IRS_CONTINUE)
+			continue;
+		/*
+		 * See the comments in ho_byname() explaining
+		 * the interpretation of TRY_AGAIN and ECONNREFUSED.
+		 */
+		if (pvt->res->res_h_errno != TRY_AGAIN || errno != ECONNREFUSED)
+			break;
+	}
+	if (softerror != 0 && pvt->res->res_h_errno == HOST_NOT_FOUND)
+		RES_SET_H_ERRNO(pvt->res, therrno);
+	return (NULL);
+}
+
+static struct hostent *
+ho_next(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *rval;
+	struct irs_ho *ho;
+
+	while (pvt->rule) {
+		ho = pvt->rule->inst->ho;
+		rval = (*ho->next)(ho);
+		if (rval)
+			return (rval);
+		if (!(pvt->rule->flags & IRS_CONTINUE))
+			break;
+		pvt->rule = pvt->rule->next;
+		if (pvt->rule) {
+			ho = pvt->rule->inst->ho;
+			(*ho->rewind)(ho);
+		}
+	}
+	return (NULL);
+}
+
+static void
+ho_rewind(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_ho *ho;
+
+	pvt->rule = pvt->rules;
+	if (pvt->rule) {
+		ho = pvt->rule->inst->ho;
+		(*ho->rewind)(ho);
+	}
+}
+
+static void
+ho_minimize(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	if (pvt->res)
+		res_nclose(pvt->res);
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_ho *ho = rule->inst->ho;
+
+		(*ho->minimize)(ho);
+	}
+}
+
+static struct __res_state *
+ho_res_get(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		ho_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+static void
+ho_res_set(struct irs_ho *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_ho *ho = rule->inst->ho;
+
+		(*ho->res_set)(ho, pvt->res, NULL);
+	}
+}
+
+static struct addrinfo *
+ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct addrinfo *rval = NULL;
+	struct irs_ho *ho;
+	int therrno = NETDB_INTERNAL;
+	int softerror = 0;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		ho = rule->inst->ho;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		errno = 0;
+		if (ho->addrinfo == NULL) /*%< for safety */
+			continue;
+		rval = (*ho->addrinfo)(ho, name, pai);
+		if (rval != NULL)
+			return (rval);
+		if (softerror == 0 &&
+		    pvt->res->res_h_errno != HOST_NOT_FOUND &&
+		    pvt->res->res_h_errno != NETDB_INTERNAL) {
+			softerror = 1;
+			therrno = pvt->res->res_h_errno;
+		}
+		if (rule->flags & IRS_CONTINUE)
+			continue;
+		/*
+		 * See the comments in ho_byname() explaining
+		 * the interpretation of TRY_AGAIN and ECONNREFUSED.
+		 */
+		if (pvt->res->res_h_errno != TRY_AGAIN ||
+		    errno != ECONNREFUSED)
+			break;
+	}
+	if (softerror != 0 && pvt->res->res_h_errno == HOST_NOT_FOUND)
+		RES_SET_H_ERRNO(pvt->res, therrno);
+	return (NULL);
+}
+
+static int
+init(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+        if (!pvt->res && !ho_res_get(this))
+                return (-1);
+
+        if (((pvt->res->options & RES_INIT) == 0U) &&
+            (res_ninit(pvt->res) == -1))
+                return (-1);
+
+        return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gen_ng.c b/usr/src/lib/libresolv2_joy/common/irs/gen_ng.c
new file mode 100644
index 0000000000..e3c874ee68
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gen_ng.c
@@ -0,0 +1,174 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: gen_ng.c,v 1.3 2005/04/27 04:56:23 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "gen_p.h"
+
+/* Types */
+
+struct pvt {
+	struct irs_rule *	rules;
+	struct irs_rule *	rule;
+	char *			curgroup;
+};
+
+/* Forward */
+
+static void		ng_close(struct irs_ng *);
+static int		ng_next(struct irs_ng *, const char **,
+				const char **, const char **);
+static int 		ng_test(struct irs_ng *, const char *,
+				const char *, const char *,
+				const char *);
+static void 		ng_rewind(struct irs_ng *, const char *);
+static void		ng_minimize(struct irs_ng *);
+
+/* Public */
+
+struct irs_ng *
+irs_gen_ng(struct irs_acc *this) {
+	struct gen_p *accpvt = (struct gen_p *)this->private;
+	struct irs_ng *ng;
+	struct pvt *pvt;
+	
+	if (!(ng = memget(sizeof *ng))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ng, 0x5e, sizeof *ng);
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(ng, sizeof *ng);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->rules = accpvt->map_rules[irs_ng];
+	pvt->rule = pvt->rules;
+	ng->private = pvt;
+	ng->close = ng_close;
+	ng->next = ng_next;
+	ng->test = ng_test;
+	ng->rewind = ng_rewind;
+	ng->minimize = ng_minimize;
+	return (ng);
+}
+
+/* Methods */
+
+static void 
+ng_close(struct irs_ng *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	ng_minimize(this);
+	if (pvt->curgroup)
+		free(pvt->curgroup);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static int
+ng_next(struct irs_ng *this, const char **host, const char **user,
+	const char **domain)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_ng *ng;
+	
+	while (pvt->rule) {
+		ng = pvt->rule->inst->ng;
+		if ((*ng->next)(ng, host, user, domain) == 1)
+			return (1);
+		if (!(pvt->rule->flags & IRS_CONTINUE))
+			break;
+		pvt->rule = pvt->rule->next;
+		if (pvt->rule) {
+			ng = pvt->rule->inst->ng;
+			(*ng->rewind)(ng, pvt->curgroup);
+		}
+	}
+	return (0);
+}
+
+static int
+ng_test(struct irs_ng *this, const char *name,
+	const char *user, const char *host, const char *domain)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct irs_ng *ng;
+	int rval;
+	
+	rval = 0;
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		ng = rule->inst->ng;
+		rval = (*ng->test)(ng, name, user, host, domain);
+		if (rval || !(rule->flags & IRS_CONTINUE))
+			break;
+	}
+	return (rval);
+}
+
+static void
+ng_rewind(struct irs_ng *this, const char *group) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_ng *ng;
+	
+	pvt->rule = pvt->rules;
+	if (pvt->rule) {
+		if (pvt->curgroup)
+			free(pvt->curgroup);
+		pvt->curgroup = strdup(group);
+		ng = pvt->rule->inst->ng;
+		(*ng->rewind)(ng, pvt->curgroup);
+	}
+}
+
+static void
+ng_minimize(struct irs_ng *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_ng *ng = rule->inst->ng;
+
+		(*ng->minimize)(ng);
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gen_nw.c b/usr/src/lib/libresolv2_joy/common/irs/gen_nw.c
new file mode 100644
index 0000000000..12bd0e0f6d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gen_nw.c
@@ -0,0 +1,264 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: gen_nw.c,v 1.4 2005/04/27 04:56:23 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "gen_p.h"
+
+/* Types */
+
+struct pvt {
+	struct irs_rule *	rules;
+	struct irs_rule *	rule;
+	struct __res_state *	res;
+	void 			(*free_res)(void *);
+};
+
+/* Forward */
+
+static void		nw_close(struct irs_nw*);
+static struct nwent *	nw_next(struct irs_nw *);
+static struct nwent *	nw_byname(struct irs_nw *, const char *, int);
+static struct nwent *	nw_byaddr(struct irs_nw *, void *, int, int);
+static void    		nw_rewind(struct irs_nw *);
+static void		nw_minimize(struct irs_nw *);
+static struct __res_state * nw_res_get(struct irs_nw *this);
+static void		nw_res_set(struct irs_nw *this,
+				   struct __res_state *res,
+				   void (*free_res)(void *));
+
+static int		init(struct irs_nw *this);
+
+/* Public */
+
+struct irs_nw *
+irs_gen_nw(struct irs_acc *this) {
+	struct gen_p *accpvt = (struct gen_p *)this->private;
+	struct irs_nw *nw;
+	struct pvt *pvt;
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	if (!(nw = memget(sizeof *nw))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(nw, 0x5e, sizeof *nw);
+	pvt->rules = accpvt->map_rules[irs_nw];
+	pvt->rule = pvt->rules;
+	nw->private = pvt;
+	nw->close = nw_close;
+	nw->next = nw_next;
+	nw->byname = nw_byname;
+	nw->byaddr = nw_byaddr;
+	nw->rewind = nw_rewind;
+	nw->minimize = nw_minimize;
+	nw->res_get = nw_res_get;
+	nw->res_set = nw_res_set;
+	return (nw);
+}
+
+/* Methods */
+
+static void
+nw_close(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	nw_minimize(this);
+
+	if (pvt->res && pvt->free_res)
+		(*pvt->free_res)(pvt->res);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct nwent *
+nw_next(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct nwent *rval;
+	struct irs_nw *nw;
+
+	if (init(this) == -1)
+		return(NULL);
+
+	while (pvt->rule) {
+		nw = pvt->rule->inst->nw;
+		rval = (*nw->next)(nw);
+		if (rval)
+			return (rval);
+		if (!(pvt->rules->flags & IRS_CONTINUE))
+			break;
+		pvt->rule = pvt->rule->next;
+		if (pvt->rule) {
+			nw = pvt->rule->inst->nw;
+			(*nw->rewind)(nw);
+		}
+	}
+	return (NULL);
+}
+
+static struct nwent *
+nw_byname(struct irs_nw *this, const char *name, int type) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct nwent *rval;
+	struct irs_nw *nw;
+	
+	if (init(this) == -1)
+		return(NULL);
+
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		nw = rule->inst->nw;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		rval = (*nw->byname)(nw, name, type);
+		if (rval != NULL)
+			return (rval);
+		if (pvt->res->res_h_errno != TRY_AGAIN &&
+		    !(rule->flags & IRS_CONTINUE))
+			break;
+	}
+	return (NULL);
+}
+
+static struct nwent *
+nw_byaddr(struct irs_nw *this, void *net, int length, int type) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct nwent *rval;
+	struct irs_nw *nw;
+	
+	if (init(this) == -1)
+		return(NULL);
+
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		nw = rule->inst->nw;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		rval = (*nw->byaddr)(nw, net, length, type);
+		if (rval != NULL)
+			return (rval);
+		if (pvt->res->res_h_errno != TRY_AGAIN &&
+		    !(rule->flags & IRS_CONTINUE))
+			break;
+	}
+	return (NULL);
+}
+
+static void
+nw_rewind(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_nw *nw;
+
+	pvt->rule = pvt->rules;
+	if (pvt->rule) {
+		nw = pvt->rule->inst->nw;
+		(*nw->rewind)(nw);
+	}
+}
+
+static void
+nw_minimize(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	if (pvt->res)
+		res_nclose(pvt->res);
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_nw *nw = rule->inst->nw;
+
+		(*nw->minimize)(nw);
+	}
+}
+
+static struct __res_state *
+nw_res_get(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		nw_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+static void
+nw_res_set(struct irs_nw *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_nw *nw = rule->inst->nw;
+
+		(*nw->res_set)(nw, pvt->res, NULL);
+	}
+}
+
+static int
+init(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (!pvt->res && !nw_res_get(this))
+		return (-1);
+	if (((pvt->res->options & RES_INIT) == 0U) &&
+	    res_ninit(pvt->res) == -1)
+		return (-1);
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gen_p.h b/usr/src/lib/libresolv2_joy/common/irs/gen_p.h
new file mode 100644
index 0000000000..1adc5909bb
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gen_p.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: gen_p.h,v 1.3 2005/04/27 04:56:23 sra Exp $
+ */
+
+/*! \file
+ *  Notes:
+ *	We hope to create a complete set of thread-safe entry points someday,
+ *	which will mean a set of getXbyY() functions that take as an argument
+ *	a pointer to the map class, which will have a pointer to the private
+ *	data, which will be used preferentially to the static variables that
+ *	are necessary to support the "classic" interface.  This "classic"
+ *	interface will then be reimplemented as stubs on top of the thread
+ *	safe modules, and will keep the map class pointers as their only
+ *	static data.  HOWEVER, we are not there yet.  So while we will call
+ *	the just-barely-converted map class methods with map class pointers,
+ *	right now they probably all still use statics.  We're not fooling
+ *	anybody, and we're not trying to (yet).
+ */
+
+#ifndef _GEN_P_H_INCLUDED
+#define _GEN_P_H_INCLUDED
+
+/*%
+ * These are the access methods.
+ */
+enum irs_acc_id {
+	irs_lcl,	/*%< Local. */
+	irs_dns,	/*%< DNS or Hesiod. */
+	irs_nis,	/*%< Sun NIS ("YP"). */
+	irs_irp,	/*%< IR protocol. */
+	irs_nacc
+};
+
+/*%
+ * These are the map types.
+ */
+enum irs_map_id {
+	irs_gr,		/*%< "group" */
+	irs_pw,		/*%< "passwd" */
+	irs_sv,		/*%< "services" */
+	irs_pr,		/*%< "protocols" */
+	irs_ho,		/*%< "hosts" */
+	irs_nw,		/*%< "networks" */
+	irs_ng,		/*%< "netgroup" */
+	irs_nmap
+};
+
+/*%
+ * This is an accessor instance.
+ */
+struct irs_inst {
+	struct irs_acc *acc;
+	struct irs_gr *	gr;
+	struct irs_pw *	pw;
+	struct irs_sv *	sv;
+	struct irs_pr *	pr;
+	struct irs_ho *	ho;
+	struct irs_nw *	nw;
+	struct irs_ng *	ng;
+};
+
+/*%
+ * This is a search rule for some map type.
+ */
+struct irs_rule {
+	struct irs_rule *	next;
+	struct irs_inst *	inst;
+	int			flags;
+};
+#define IRS_MERGE		0x0001	/*%< Don't stop if acc. has data? */
+#define	IRS_CONTINUE		0x0002	/*%< Don't stop if acc. has no data? */
+/*
+ * This is the private data for a search access class.
+ */
+struct gen_p {
+	char *			options;
+	struct irs_rule *	map_rules[(int)irs_nmap];
+	struct irs_inst		accessors[(int)irs_nacc];
+	struct __res_state *	res;
+	void			(*free_res) __P((void *));
+};
+
+/*
+ * Externs.
+ */
+
+extern struct irs_acc *	irs_gen_acc __P((const char *, const char *conf_file));
+extern struct irs_gr *	irs_gen_gr __P((struct irs_acc *));
+extern struct irs_pw *	irs_gen_pw __P((struct irs_acc *));
+extern struct irs_sv *	irs_gen_sv __P((struct irs_acc *));
+extern struct irs_pr *	irs_gen_pr __P((struct irs_acc *));
+extern struct irs_ho *	irs_gen_ho __P((struct irs_acc *));
+extern struct irs_nw *	irs_gen_nw __P((struct irs_acc *));
+extern struct irs_ng *	irs_gen_ng __P((struct irs_acc *));
+
+#endif /*_IRS_P_H_INCLUDED*/
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gen_pr.c b/usr/src/lib/libresolv2_joy/common/irs/gen_pr.c
new file mode 100644
index 0000000000..9fd32c4dd9
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gen_pr.c
@@ -0,0 +1,228 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: gen_pr.c,v 1.3 2005/04/27 04:56:24 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "gen_p.h"
+
+/* Types */
+
+struct pvt {
+	struct irs_rule *	rules;
+	struct irs_rule *	rule;
+	struct __res_state *	res;
+	void			(*free_res)(void *);
+};
+
+/* Forward */
+
+static void			pr_close(struct irs_pr*);
+static struct protoent *	pr_next(struct irs_pr *);
+static struct protoent *	pr_byname(struct irs_pr *, const char *);
+static struct protoent * 	pr_bynumber(struct irs_pr *, int);
+static void 			pr_rewind(struct irs_pr *);
+static void			pr_minimize(struct irs_pr *);
+static struct __res_state *	pr_res_get(struct irs_pr *);
+static void			pr_res_set(struct irs_pr *,
+					   struct __res_state *,
+					   void (*)(void *));
+
+/* Public */
+
+struct irs_pr *
+irs_gen_pr(struct irs_acc *this) {
+	struct gen_p *accpvt = (struct gen_p *)this->private;
+	struct irs_pr *pr;
+	struct pvt *pvt;
+
+	if (!(pr = memget(sizeof *pr))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pr, 0x5e, sizeof *pr);
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(pr, sizeof *pr);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->rules = accpvt->map_rules[irs_pr];
+	pvt->rule = pvt->rules;
+	pr->private = pvt;
+	pr->close = pr_close;
+	pr->next = pr_next;
+	pr->byname = pr_byname;
+	pr->bynumber = pr_bynumber;
+	pr->rewind = pr_rewind;
+	pr->minimize = pr_minimize;
+	pr->res_get = pr_res_get;
+	pr->res_set = pr_res_set;
+	return (pr);
+}
+
+/* Methods */
+
+static void
+pr_close(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct protoent *
+pr_next(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct protoent *rval;
+	struct irs_pr *pr;
+
+	while (pvt->rule) {
+		pr = pvt->rule->inst->pr;
+		rval = (*pr->next)(pr);
+		if (rval)
+			return (rval);
+		if (!(pvt->rules->flags & IRS_CONTINUE))
+			break;
+		pvt->rule = pvt->rule->next;
+		if (pvt->rule) {
+			pr = pvt->rule->inst->pr;
+			(*pr->rewind)(pr);
+		}
+	}
+	return (NULL);
+}
+
+static struct protoent *
+pr_byname(struct irs_pr *this, const char *name) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct protoent *rval;
+	struct irs_pr *pr;
+	
+	rval = NULL;
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		pr = rule->inst->pr;
+		rval = (*pr->byname)(pr, name);
+		if (rval || !(rule->flags & IRS_CONTINUE))
+			break;
+	}
+	return (rval);
+}
+
+static struct protoent *
+pr_bynumber(struct irs_pr *this, int proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct protoent *rval;
+	struct irs_pr *pr;
+	
+	rval = NULL;
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		pr = rule->inst->pr;
+		rval = (*pr->bynumber)(pr, proto);
+		if (rval || !(rule->flags & IRS_CONTINUE))
+			break;
+	}
+	return (rval);
+}
+
+static void
+pr_rewind(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_pr *pr;
+
+	pvt->rule = pvt->rules;
+	if (pvt->rule) {
+		pr = pvt->rule->inst->pr;
+		(*pr->rewind)(pr);
+	}
+}
+
+static void
+pr_minimize(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_pr *pr = rule->inst->pr;
+
+		(*pr->minimize)(pr);
+	}
+}
+
+static struct __res_state *
+pr_res_get(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		pr_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+static void
+pr_res_set(struct irs_pr *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_pr *pr = rule->inst->pr;
+
+		if (pr->res_set)
+			(*pr->res_set)(pr, pvt->res, NULL);
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gen_sv.c b/usr/src/lib/libresolv2_joy/common/irs/gen_sv.c
new file mode 100644
index 0000000000..93b70e57ec
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gen_sv.c
@@ -0,0 +1,229 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: gen_sv.c,v 1.3 2005/04/27 04:56:24 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "gen_p.h"
+
+/* Types */
+
+struct pvt {
+	struct irs_rule *	rules;
+	struct irs_rule *	rule;
+	struct __res_state *	res;
+	void			(*free_res)(void *);
+};
+
+/* Forward */
+
+static void			sv_close(struct irs_sv*);
+static struct servent *		sv_next(struct irs_sv *);
+static struct servent *		sv_byname(struct irs_sv *, const char *,
+					  const char *);
+static struct servent *		sv_byport(struct irs_sv *, int, const char *);
+static void			sv_rewind(struct irs_sv *);
+static void			sv_minimize(struct irs_sv *);
+static struct __res_state *	sv_res_get(struct irs_sv *);
+static void			sv_res_set(struct irs_sv *,
+					      struct __res_state *,
+					      void (*)(void *));
+
+/* Public */
+
+struct irs_sv *
+irs_gen_sv(struct irs_acc *this) {
+	struct gen_p *accpvt = (struct gen_p *)this->private;
+	struct irs_sv *sv;
+	struct pvt *pvt;
+
+	if (!(sv = memget(sizeof *sv))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(sv, 0x5e, sizeof *sv);
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(sv, sizeof *sv);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->rules = accpvt->map_rules[irs_sv];
+	pvt->rule = pvt->rules;
+	sv->private = pvt;
+	sv->close = sv_close;
+	sv->next = sv_next;
+	sv->byname = sv_byname;
+	sv->byport = sv_byport;
+	sv->rewind = sv_rewind;
+	sv->minimize = sv_minimize;
+	sv->res_get = sv_res_get;
+	sv->res_set = sv_res_set;
+	return (sv);
+}
+
+/* Methods */
+
+static void
+sv_close(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct servent *
+sv_next(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct servent *rval;
+	struct irs_sv *sv;
+	
+	while (pvt->rule) {
+		sv = pvt->rule->inst->sv;
+		rval = (*sv->next)(sv);
+		if (rval)
+			return (rval);
+		if (!(pvt->rule->flags & IRS_CONTINUE))
+			break;
+		pvt->rule = pvt->rule->next;
+		if (pvt->rule) {
+			sv = pvt->rule->inst->sv;
+			(*sv->rewind)(sv);
+		}
+	}
+	return (NULL);
+}
+
+static struct servent *
+sv_byname(struct irs_sv *this, const char *name, const char *proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct servent *rval;
+	struct irs_sv *sv;
+	
+	rval = NULL;
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		sv = rule->inst->sv;
+		rval = (*sv->byname)(sv, name, proto);
+		if (rval || !(rule->flags & IRS_CONTINUE))
+			break;
+	}
+	return (rval);
+}
+
+static struct servent *
+sv_byport(struct irs_sv *this, int port, const char *proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+	struct servent *rval;
+	struct irs_sv *sv;
+	
+	rval = NULL;
+	for (rule = pvt->rules; rule; rule = rule->next) {
+		sv = rule->inst->sv;
+		rval = (*sv->byport)(sv, port, proto);
+		if (rval || !(rule->flags & IRS_CONTINUE))
+			break;
+	}
+	return (rval);
+}
+
+static void
+sv_rewind(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_sv *sv;
+
+	pvt->rule = pvt->rules;
+	if (pvt->rule) {
+		sv = pvt->rule->inst->sv;
+		(*sv->rewind)(sv);
+	}
+}
+
+static void
+sv_minimize(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_sv *sv = rule->inst->sv;
+
+		(*sv->minimize)(sv);
+	}
+}
+
+static struct __res_state *
+sv_res_get(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		sv_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+static void
+sv_res_set(struct irs_sv *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct irs_rule *rule;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+
+	for (rule = pvt->rules; rule != NULL; rule = rule->next) {
+		struct irs_sv *sv = rule->inst->sv;
+
+		if (sv->res_set)
+			(*sv->res_set)(sv, pvt->res, NULL);
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getaddrinfo.c b/usr/src/lib/libresolv2_joy/common/irs/getaddrinfo.c
new file mode 100644
index 0000000000..19bbbea854
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getaddrinfo.c
@@ -0,0 +1,1253 @@
+/*	$KAME: getaddrinfo.c,v 1.14 2001/01/06 09:41:15 jinmei Exp $	*/
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*! \file
+ * Issues to be discussed:
+ *\li  Thread safe-ness must be checked.
+ *\li  Return values.  There are nonstandard return values defined and used
+ *   in the source code.  This is because RFC2553 is silent about which error
+ *   code must be returned for which situation.
+ *\li  IPv4 classful (shortened) form.  RFC2553 is silent about it.  XNET 5.2
+ *   says to use inet_aton() to convert IPv4 numeric to binary (allows
+ *   classful form as a result).
+ *   current code - disallow classful form for IPv4 (due to use of inet_pton).
+ *\li  freeaddrinfo(NULL).  RFC2553 is silent about it.  XNET 5.2 says it is
+ *   invalid.
+ *   current code - SEGV on freeaddrinfo(NULL)
+ * Note:
+ *\li  We use getipnodebyname() just for thread-safeness.  There's no intent
+ *   to let it do PF_UNSPEC (actually we never pass PF_UNSPEC to
+ *   getipnodebyname().
+ *\li  The code filters out AFs that are not supported by the kernel,
+ *   when globbing NULL hostname (to loopback, or wildcard).  Is it the right
+ *   thing to do?  What is the relationship with post-RFC2553 AI_ADDRCONFIG
+ *   in ai_flags?
+ *\li  (post-2553) semantics of AI_ADDRCONFIG itself is too vague.
+ *   (1) what should we do against numeric hostname (2) what should we do
+ *   against NULL hostname (3) what is AI_ADDRCONFIG itself.  AF not ready?
+ *   non-loopback address configured?  global address configured?
+ * \par Additional Issue:
+ *  To avoid search order issue, we have a big amount of code duplicate
+ *   from gethnamaddr.c and some other places.  The issues that there's no
+ *   lower layer function to lookup "IPv4 or IPv6" record.  Calling
+ *   gethostbyname2 from getaddrinfo will end up in wrong search order, as
+ *   follows:
+ *	\li The code makes use of following calls when asked to resolver with
+ *	  ai_family  = PF_UNSPEC:
+ *\code		getipnodebyname(host, AF_INET6);
+ *		getipnodebyname(host, AF_INET);
+ *\endcode
+ *	\li  This will result in the following queries if the node is configure to
+ *	  prefer /etc/hosts than DNS:
+ *\code
+ *		lookup /etc/hosts for IPv6 address
+ *		lookup DNS for IPv6 address
+ *		lookup /etc/hosts for IPv4 address
+ *		lookup DNS for IPv4 address
+ *\endcode
+ *	  which may not meet people's requirement.
+ *	 \li The right thing to happen is to have underlying layer which does
+ *	  PF_UNSPEC lookup (lookup both) and return chain of addrinfos.
+ *	  This would result in a bit of code duplicate with _dns_ghbyname() and
+ *	  friends.
+ */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <netinet/in.h>
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stddef.h>
+#include <ctype.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include <stdarg.h>
+
+#include <irs.h>
+#include <isc/assertions.h>
+
+#include "port_after.h"
+
+#include "irs_data.h"
+
+#define SUCCESS 0
+#define ANY 0
+#define YES 1
+#define NO  0
+
+static const char in_addrany[] = { 0, 0, 0, 0 };
+static const char in6_addrany[] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+static const char in_loopback[] = { 127, 0, 0, 1 };
+static const char in6_loopback[] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1
+};
+
+static const struct afd {
+	int a_af;
+	int a_addrlen;
+	int a_socklen;
+	int a_off;
+	const char *a_addrany;
+	const char *a_loopback;
+	int a_scoped;
+} afdl [] = {
+	{PF_INET6, sizeof(struct in6_addr),
+	 sizeof(struct sockaddr_in6),
+	 offsetof(struct sockaddr_in6, sin6_addr),
+	 in6_addrany, in6_loopback, 1},
+	{PF_INET, sizeof(struct in_addr),
+	 sizeof(struct sockaddr_in),
+	 offsetof(struct sockaddr_in, sin_addr),
+	 in_addrany, in_loopback, 0},
+	{0, 0, 0, 0, NULL, NULL, 0},
+};
+
+struct explore {
+	int e_af;
+	int e_socktype;
+	int e_protocol;
+	const char *e_protostr;
+	int e_wild;
+#define WILD_AF(ex)		((ex)->e_wild & 0x01)
+#define WILD_SOCKTYPE(ex)	((ex)->e_wild & 0x02)
+#define WILD_PROTOCOL(ex)	((ex)->e_wild & 0x04)
+};
+
+static const struct explore explore[] = {
+#if 0
+	{ PF_LOCAL, 0, ANY, ANY, NULL, 0x01 },
+#endif
+	{ PF_INET6, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07 },
+	{ PF_INET6, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07 },
+	{ PF_INET6, SOCK_RAW, ANY, NULL, 0x05 },
+	{ PF_INET, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07 },
+	{ PF_INET, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07 },
+	{ PF_INET, SOCK_RAW, ANY, NULL, 0x05 },
+	{ -1, 0, 0, NULL, 0 },
+};
+
+#define PTON_MAX	16
+
+static int str_isnumber __P((const char *));
+static int explore_fqdn __P((const struct addrinfo *, const char *,
+	const char *, struct addrinfo **));
+static int explore_copy __P((const struct addrinfo *, const struct addrinfo *,
+	struct addrinfo **));
+static int explore_null __P((const struct addrinfo *,
+	const char *, struct addrinfo **));
+static int explore_numeric __P((const struct addrinfo *, const char *,
+	const char *, struct addrinfo **));
+static int explore_numeric_scope __P((const struct addrinfo *, const char *,
+	const char *, struct addrinfo **));
+static int get_canonname __P((const struct addrinfo *,
+	struct addrinfo *, const char *));
+static struct addrinfo *get_ai __P((const struct addrinfo *,
+	const struct afd *, const char *));
+static struct addrinfo *copy_ai __P((const struct addrinfo *));
+static int get_portmatch __P((const struct addrinfo *, const char *));
+static int get_port __P((const struct addrinfo *, const char *, int));
+static const struct afd *find_afd __P((int));
+static int addrconfig __P((int));
+static int ip6_str2scopeid __P((char *, struct sockaddr_in6 *,
+				u_int32_t *scopeidp));
+static struct net_data *init __P((void));
+
+struct addrinfo *hostent2addrinfo __P((struct hostent *,
+				       const struct addrinfo *));
+struct addrinfo *addr2addrinfo __P((const struct addrinfo *,
+				    const char *));
+
+#if 0
+static const char *ai_errlist[] = {
+	"Success",
+	"Address family for hostname not supported",	/*%< EAI_ADDRFAMILY */
+	"Temporary failure in name resolution",		/*%< EAI_AGAIN */
+	"Invalid value for ai_flags",		       	/*%< EAI_BADFLAGS */
+	"Non-recoverable failure in name resolution", 	/*%< EAI_FAIL */
+	"ai_family not supported",			/*%< EAI_FAMILY */
+	"Memory allocation failure", 			/*%< EAI_MEMORY */
+	"No address associated with hostname", 		/*%< EAI_NODATA */
+	"hostname nor servname provided, or not known",	/*%< EAI_NONAME */
+	"servname not supported for ai_socktype",	/*%< EAI_SERVICE */
+	"ai_socktype not supported", 			/*%< EAI_SOCKTYPE */
+	"System error returned in errno", 		/*%< EAI_SYSTEM */
+	"Invalid value for hints",			/*%< EAI_BADHINTS */
+	"Resolved protocol is unknown",			/*%< EAI_PROTOCOL */
+	"Unknown error", 				/*%< EAI_MAX */
+};
+#endif
+
+/* XXX macros that make external reference is BAD. */
+
+#define GET_AI(ai, afd, addr) \
+do { \
+	/* external reference: pai, error, and label free */ \
+	(ai) = get_ai(pai, (afd), (addr)); \
+	if ((ai) == NULL) { \
+		error = EAI_MEMORY; \
+		goto free; \
+	} \
+} while (/*CONSTCOND*/0)
+
+#define GET_PORT(ai, serv) \
+do { \
+	/* external reference: error and label free */ \
+	error = get_port((ai), (serv), 0); \
+	if (error != 0) \
+		goto free; \
+} while (/*CONSTCOND*/0)
+
+#define GET_CANONNAME(ai, str) \
+do { \
+	/* external reference: pai, error and label free */ \
+	error = get_canonname(pai, (ai), (str)); \
+	if (error != 0) \
+		goto free; \
+} while (/*CONSTCOND*/0)
+
+#ifndef SOLARIS2
+#define SETERROR(err) \
+do { \
+	/* external reference: error, and label bad */ \
+	error = (err); \
+	goto bad; \
+	/*NOTREACHED*/ \
+} while (/*CONSTCOND*/0)
+#else
+#define SETERROR(err) \
+do { \
+	/* external reference: error, and label bad */ \
+	error = (err); \
+	if (error == error) \
+		goto bad; \
+} while (/*CONSTCOND*/0)
+#endif
+
+
+#define MATCH_FAMILY(x, y, w) \
+	((x) == (y) || (/*CONSTCOND*/(w) && ((x) == PF_UNSPEC || (y) == PF_UNSPEC)))
+#define MATCH(x, y, w) \
+	((x) == (y) || (/*CONSTCOND*/(w) && ((x) == ANY || (y) == ANY)))
+
+#if 0				/*%< bind8 has its own version */
+char *
+gai_strerror(ecode)
+	int ecode;
+{
+	if (ecode < 0 || ecode > EAI_MAX)
+		ecode = EAI_MAX;
+	return ai_errlist[ecode];
+}
+#endif
+
+void
+freeaddrinfo(ai)
+	struct addrinfo *ai;
+{
+	struct addrinfo *next;
+
+	do {
+		next = ai->ai_next;
+		if (ai->ai_canonname)
+			free(ai->ai_canonname);
+		/* no need to free(ai->ai_addr) */
+		free(ai);
+		ai = next;
+	} while (ai);
+}
+
+static int
+str_isnumber(p)
+	const char *p;
+{
+	char *ep;
+
+	if (*p == '\0')
+		return NO;
+	ep = NULL;
+	errno = 0;
+	(void)strtoul(p, &ep, 10);
+	if (errno == 0 && ep && *ep == '\0')
+		return YES;
+	else
+		return NO;
+}
+
+int
+getaddrinfo(hostname, servname, hints, res)
+	const char *hostname, *servname;
+	const struct addrinfo *hints;
+	struct addrinfo **res;
+{
+	struct addrinfo sentinel;
+	struct addrinfo *cur;
+	int error = 0;
+	struct addrinfo ai, ai0, *afai = NULL;
+	struct addrinfo *pai;
+	const struct explore *ex;
+
+	memset(&sentinel, 0, sizeof(sentinel));
+	cur = &sentinel;
+	pai = &ai;
+	pai->ai_flags = 0;
+	pai->ai_family = PF_UNSPEC;
+	pai->ai_socktype = ANY;
+	pai->ai_protocol = ANY;
+#if defined(sun) && defined(_SOCKLEN_T) && defined(__sparcv9)
+	/*
+	 * clear _ai_pad to preserve binary
+	 * compatibility with previously compiled 64-bit
+	 * applications in a pre-SUSv3 environment by
+	 * guaranteeing the upper 32-bits are empty.
+	 */
+	pai->_ai_pad = 0;
+#endif
+	pai->ai_addrlen = 0;
+	pai->ai_canonname = NULL;
+	pai->ai_addr = NULL;
+	pai->ai_next = NULL;
+
+	if (hostname == NULL && servname == NULL)
+		return EAI_NONAME;
+	if (hints) {
+		/* error check for hints */
+		if (hints->ai_addrlen || hints->ai_canonname ||
+		    hints->ai_addr || hints->ai_next)
+			SETERROR(EAI_BADHINTS); /*%< xxx */
+		if (hints->ai_flags & ~AI_MASK)
+			SETERROR(EAI_BADFLAGS);
+		switch (hints->ai_family) {
+		case PF_UNSPEC:
+		case PF_INET:
+		case PF_INET6:
+			break;
+		default:
+			SETERROR(EAI_FAMILY);
+		}
+		memcpy(pai, hints, sizeof(*pai));
+
+#if defined(sun) && defined(_SOCKLEN_T) && defined(__sparcv9)
+		/*
+		 * We need to clear _ai_pad to preserve binary
+		 * compatibility.  See prior comment.
+		 */
+		pai->_ai_pad = 0;
+#endif
+		/*
+		 * if both socktype/protocol are specified, check if they
+		 * are meaningful combination.
+		 */
+		if (pai->ai_socktype != ANY && pai->ai_protocol != ANY) {
+			for (ex = explore; ex->e_af >= 0; ex++) {
+				if (pai->ai_family != ex->e_af)
+					continue;
+				if (ex->e_socktype == ANY)
+					continue;
+				if (ex->e_protocol == ANY)
+					continue;
+				if (pai->ai_socktype == ex->e_socktype &&
+				    pai->ai_protocol != ex->e_protocol) {
+					SETERROR(EAI_BADHINTS);
+				}
+			}
+		}
+	}
+
+	/*
+	 * post-2553: AI_ALL and AI_V4MAPPED are effective only against
+	 * AF_INET6 query.  They needs to be ignored if specified in other
+	 * occassions.
+	 */
+	switch (pai->ai_flags & (AI_ALL | AI_V4MAPPED)) {
+	case AI_V4MAPPED:
+	case AI_ALL | AI_V4MAPPED:
+		if (pai->ai_family != AF_INET6)
+			pai->ai_flags &= ~(AI_ALL | AI_V4MAPPED);
+		break;
+	case AI_ALL:
+#if 1
+		/* illegal */
+		SETERROR(EAI_BADFLAGS);
+#else
+		pai->ai_flags &= ~(AI_ALL | AI_V4MAPPED);
+		break;
+#endif
+	}
+
+	/*
+	 * check for special cases.  (1) numeric servname is disallowed if
+	 * socktype/protocol are left unspecified. (2) servname is disallowed
+	 * for raw and other inet{,6} sockets.
+	 */
+	if (MATCH_FAMILY(pai->ai_family, PF_INET, 1)
+#ifdef PF_INET6
+	 || MATCH_FAMILY(pai->ai_family, PF_INET6, 1)
+#endif
+	    ) {
+		ai0 = *pai;	/* backup *pai */
+
+		if (pai->ai_family == PF_UNSPEC) {
+#ifdef PF_INET6
+			pai->ai_family = PF_INET6;
+#else
+			pai->ai_family = PF_INET;
+#endif
+		}
+		error = get_portmatch(pai, servname);
+		if (error)
+			SETERROR(error);
+
+		*pai = ai0;
+	}
+
+	ai0 = *pai;
+
+	/* NULL hostname, or numeric hostname */
+	for (ex = explore; ex->e_af >= 0; ex++) {
+		*pai = ai0;
+
+		if (!MATCH_FAMILY(pai->ai_family, ex->e_af, WILD_AF(ex)))
+			continue;
+		if (!MATCH(pai->ai_socktype, ex->e_socktype, WILD_SOCKTYPE(ex)))
+			continue;
+		if (!MATCH(pai->ai_protocol, ex->e_protocol, WILD_PROTOCOL(ex)))
+			continue;
+
+		if (pai->ai_family == PF_UNSPEC)
+			pai->ai_family = ex->e_af;
+		if (pai->ai_socktype == ANY && ex->e_socktype != ANY)
+			pai->ai_socktype = ex->e_socktype;
+		if (pai->ai_protocol == ANY && ex->e_protocol != ANY)
+			pai->ai_protocol = ex->e_protocol;
+
+		/*
+		 * if the servname does not match socktype/protocol, ignore it.
+		 */
+		if (get_portmatch(pai, servname) != 0)
+			continue;
+
+		if (hostname == NULL) {
+			/*
+			 * filter out AFs that are not supported by the kernel
+			 * XXX errno?
+			 */
+			if (!addrconfig(pai->ai_family))
+				continue;
+			error = explore_null(pai, servname, &cur->ai_next);
+		} else
+			error = explore_numeric_scope(pai, hostname, servname,
+			    &cur->ai_next);
+
+		if (error)
+			goto free;
+
+		while (cur && cur->ai_next)
+			cur = cur->ai_next;
+	}
+
+	/*
+	 * XXX
+	 * If numreic representation of AF1 can be interpreted as FQDN
+	 * representation of AF2, we need to think again about the code below.
+	 */
+	if (sentinel.ai_next)
+		goto good;
+
+	if (pai->ai_flags & AI_NUMERICHOST)
+		SETERROR(EAI_NONAME);
+	if (hostname == NULL)
+		SETERROR(EAI_NONAME);
+
+	/*
+	 * hostname as alphabetical name.
+	 * We'll make sure that
+	 * - if returning addrinfo list is empty, return non-zero error
+	 *   value (already known one or EAI_NONAME).
+	 * - otherwise, 
+	 *   + if we haven't had any errors, return 0 (i.e. success).
+	 *   + if we've had an error, free the list and return the error.
+	 * without any assumption on the behavior of explore_fqdn().
+	 */
+
+	/* first, try to query DNS for all possible address families. */
+	*pai = ai0;
+	error = explore_fqdn(pai, hostname, servname, &afai);
+	if (error) {
+		if (afai != NULL)
+			freeaddrinfo(afai);
+		goto free;
+	}
+	if (afai == NULL) {
+		error = EAI_NONAME; /*%< we've had no errors. */
+		goto free;
+	}
+
+	/*
+	 * we would like to prefer AF_INET6 than AF_INET, so we'll make an
+	 * outer loop by AFs.
+	 */
+	for (ex = explore; ex->e_af >= 0; ex++) {
+		*pai = ai0;
+
+		if (pai->ai_family == PF_UNSPEC)
+			pai->ai_family = ex->e_af;
+
+		if (!MATCH_FAMILY(pai->ai_family, ex->e_af, WILD_AF(ex)))
+			continue;
+		if (!MATCH(pai->ai_socktype, ex->e_socktype,
+			   WILD_SOCKTYPE(ex))) {
+			continue;
+		}
+		if (!MATCH(pai->ai_protocol, ex->e_protocol,
+			   WILD_PROTOCOL(ex))) {
+			continue;
+		}
+
+#ifdef AI_ADDRCONFIG
+		/*
+		 * If AI_ADDRCONFIG is specified, check if we are
+		 * expected to return the address family or not.
+		 */
+		if ((pai->ai_flags & AI_ADDRCONFIG) != 0 &&
+		    !addrconfig(pai->ai_family))
+			continue;
+#endif
+
+		if (pai->ai_family == PF_UNSPEC)
+			pai->ai_family = ex->e_af;
+		if (pai->ai_socktype == ANY && ex->e_socktype != ANY)
+			pai->ai_socktype = ex->e_socktype;
+		if (pai->ai_protocol == ANY && ex->e_protocol != ANY)
+			pai->ai_protocol = ex->e_protocol;
+
+		/*
+		 * if the servname does not match socktype/protocol, ignore it.
+		 */
+		if (get_portmatch(pai, servname) != 0)
+			continue;
+
+		if ((error = explore_copy(pai, afai, &cur->ai_next)) != 0) {
+			freeaddrinfo(afai);
+			goto free;
+		}
+
+		while (cur && cur->ai_next)
+			cur = cur->ai_next;
+	}
+
+	freeaddrinfo(afai);	/*%< afai must not be NULL at this point. */
+
+	if (sentinel.ai_next) {
+good:
+		*res = sentinel.ai_next;
+		return(SUCCESS);
+	} else {
+		/*
+		 * All the process succeeded, but we've had an empty list. 
+		 * This can happen if the given hints do not match our
+		 * candidates.
+		 */
+		error = EAI_NONAME;
+	}
+
+free:
+bad:
+	if (sentinel.ai_next)
+		freeaddrinfo(sentinel.ai_next);
+	*res = NULL;
+	return(error);
+}
+
+/*%
+ * FQDN hostname, DNS lookup
+ */
+static int
+explore_fqdn(pai, hostname, servname, res)
+	const struct addrinfo *pai;
+	const char *hostname;
+	const char *servname;
+	struct addrinfo **res;
+{
+	struct addrinfo *result;
+	struct addrinfo *cur;
+	struct net_data *net_data = init();
+	struct irs_ho *ho;
+	int error = 0;
+	char tmp[NS_MAXDNAME];
+	const char *cp;
+
+	INSIST(res != NULL && *res == NULL);
+
+	/*
+	 * if the servname does not match socktype/protocol, ignore it.
+	 */
+	if (get_portmatch(pai, servname) != 0)
+		return(0);
+
+	if (!net_data || !(ho = net_data->ho))
+		return(0);
+#if 0				/*%< XXX (notyet) */
+	if (net_data->ho_stayopen && net_data->ho_last &&
+	    net_data->ho_last->h_addrtype == af) {
+		if (ns_samename(name, net_data->ho_last->h_name) == 1)
+			return (net_data->ho_last);
+		for (hap = net_data->ho_last->h_aliases; hap && *hap; hap++)
+			if (ns_samename(name, *hap) == 1)
+				return (net_data->ho_last);
+	}
+#endif
+	if (!strchr(hostname, '.') &&
+	    (cp = res_hostalias(net_data->res, hostname,
+				tmp, sizeof(tmp))))
+		hostname = cp;
+	result = (*ho->addrinfo)(ho, hostname, pai);
+	if (!net_data->ho_stayopen) {
+		(*ho->minimize)(ho);
+	}
+	if (result == NULL) {
+		int e = h_errno;
+
+		switch(e) {
+		case NETDB_INTERNAL:
+			error = EAI_SYSTEM;
+			break;
+		case TRY_AGAIN:
+			error = EAI_AGAIN;
+			break;
+		case NO_RECOVERY:
+			error = EAI_FAIL;
+			break;
+		case HOST_NOT_FOUND:
+		case NO_DATA:
+			error = EAI_NONAME;
+			break;
+		default:
+		case NETDB_SUCCESS: /*%< should be impossible... */
+			error = EAI_NONAME;
+			break;
+		}
+		goto free;
+	}
+
+	for (cur = result; cur; cur = cur->ai_next) {
+		GET_PORT(cur, servname); /*%< XXX: redundant lookups... */
+		/* canonname should already be filled. */
+	}
+
+	*res = result;
+
+	return(0);
+
+free:
+	if (result)
+		freeaddrinfo(result);
+	return error;
+}
+
+static int
+explore_copy(pai, src0, res)
+	const struct addrinfo *pai;	/*%< seed */
+	const struct addrinfo *src0;	/*%< source */
+	struct addrinfo **res;
+{
+	int error;
+	struct addrinfo sentinel, *cur;
+	const struct addrinfo *src;
+
+	error = 0;
+	sentinel.ai_next = NULL;
+	cur = &sentinel;
+
+	for (src = src0; src != NULL; src = src->ai_next) {
+		if (src->ai_family != pai->ai_family)
+			continue;
+
+		cur->ai_next = copy_ai(src);
+		if (!cur->ai_next) {
+			error = EAI_MEMORY;
+			goto fail;
+		}
+
+		cur->ai_next->ai_socktype = pai->ai_socktype;
+		cur->ai_next->ai_protocol = pai->ai_protocol;
+		cur = cur->ai_next;
+	}
+
+	*res = sentinel.ai_next;
+	return 0;
+
+fail:
+	freeaddrinfo(sentinel.ai_next);
+	return error;
+}
+
+/*%
+ * hostname == NULL.
+ * passive socket -> anyaddr (0.0.0.0 or ::)
+ * non-passive socket -> localhost (127.0.0.1 or ::1)
+ */
+static int
+explore_null(pai, servname, res)
+	const struct addrinfo *pai;
+	const char *servname;
+	struct addrinfo **res;
+{
+	const struct afd *afd;
+	struct addrinfo *cur;
+	struct addrinfo sentinel;
+	int error;
+
+	*res = NULL;
+	sentinel.ai_next = NULL;
+	cur = &sentinel;
+
+	afd = find_afd(pai->ai_family);
+	if (afd == NULL)
+		return 0;
+
+	if (pai->ai_flags & AI_PASSIVE) {
+		GET_AI(cur->ai_next, afd, afd->a_addrany);
+		/* xxx meaningless?
+		 * GET_CANONNAME(cur->ai_next, "anyaddr");
+		 */
+		GET_PORT(cur->ai_next, servname);
+	} else {
+		GET_AI(cur->ai_next, afd, afd->a_loopback);
+		/* xxx meaningless?
+		 * GET_CANONNAME(cur->ai_next, "localhost");
+		 */
+		GET_PORT(cur->ai_next, servname);
+	}
+	cur = cur->ai_next;
+
+	*res = sentinel.ai_next;
+	return 0;
+
+free:
+	if (sentinel.ai_next)
+		freeaddrinfo(sentinel.ai_next);
+	return error;
+}
+
+/*%
+ * numeric hostname
+ */
+static int
+explore_numeric(pai, hostname, servname, res)
+	const struct addrinfo *pai;
+	const char *hostname;
+	const char *servname;
+	struct addrinfo **res;
+{
+	const struct afd *afd;
+	struct addrinfo *cur;
+	struct addrinfo sentinel;
+	int error;
+	char pton[PTON_MAX];
+
+	*res = NULL;
+	sentinel.ai_next = NULL;
+	cur = &sentinel;
+
+	afd = find_afd(pai->ai_family);
+	if (afd == NULL)
+		return 0;
+
+	switch (afd->a_af) {
+#if 0 /*X/Open spec*/
+	case AF_INET:
+		if (inet_aton(hostname, (struct in_addr *)pton) == 1) {
+			if (pai->ai_family == afd->a_af ||
+			    pai->ai_family == PF_UNSPEC /*?*/) {
+				GET_AI(cur->ai_next, afd, pton);
+				GET_PORT(cur->ai_next, servname);
+				while (cur->ai_next)
+					cur = cur->ai_next;
+			} else
+				SETERROR(EAI_FAMILY);	/*xxx*/
+		}
+		break;
+#endif
+	default:
+		if (inet_pton(afd->a_af, hostname, pton) == 1) {
+			if (pai->ai_family == afd->a_af ||
+			    pai->ai_family == PF_UNSPEC /*?*/) {
+				GET_AI(cur->ai_next, afd, pton);
+				GET_PORT(cur->ai_next, servname);
+				while (cur->ai_next)
+					cur = cur->ai_next;
+			} else
+				SETERROR(EAI_FAMILY);	/*xxx*/
+		}
+		break;
+	}
+
+	*res = sentinel.ai_next;
+	return 0;
+
+free:
+bad:
+	if (sentinel.ai_next)
+		freeaddrinfo(sentinel.ai_next);
+	return error;
+}
+
+/*%
+ * numeric hostname with scope
+ */
+static int
+explore_numeric_scope(pai, hostname, servname, res)
+	const struct addrinfo *pai;
+	const char *hostname;
+	const char *servname;
+	struct addrinfo **res;
+{
+#ifndef SCOPE_DELIMITER
+	return explore_numeric(pai, hostname, servname, res);
+#else
+	const struct afd *afd;
+	struct addrinfo *cur;
+	int error;
+	char *cp, *hostname2 = NULL, *scope, *addr;
+	struct sockaddr_in6 *sin6;
+
+	afd = find_afd(pai->ai_family);
+	if (afd == NULL)
+		return 0;
+
+	if (!afd->a_scoped)
+		return explore_numeric(pai, hostname, servname, res);
+
+	cp = strchr(hostname, SCOPE_DELIMITER);
+	if (cp == NULL)
+		return explore_numeric(pai, hostname, servname, res);
+
+	/*
+	 * Handle special case of <scoped_address><delimiter><scope id>
+	 */
+	hostname2 = strdup(hostname);
+	if (hostname2 == NULL)
+		return EAI_MEMORY;
+	/* terminate at the delimiter */
+	hostname2[cp - hostname] = '\0';
+	addr = hostname2;
+	scope = cp + 1;
+
+	error = explore_numeric(pai, addr, servname, res);
+	if (error == 0) {
+		u_int32_t scopeid = 0;
+
+		for (cur = *res; cur; cur = cur->ai_next) {
+			if (cur->ai_family != AF_INET6)
+				continue;
+			sin6 = (struct sockaddr_in6 *)(void *)cur->ai_addr;
+			if (!ip6_str2scopeid(scope, sin6, &scopeid)) {
+				free(hostname2);
+				return(EAI_NONAME); /*%< XXX: is return OK? */
+			}
+#ifdef HAVE_SIN6_SCOPE_ID
+			sin6->sin6_scope_id = scopeid;
+#endif
+		}
+	}
+
+	free(hostname2);
+
+	return error;
+#endif
+}
+
+static int
+get_canonname(pai, ai, str)
+	const struct addrinfo *pai;
+	struct addrinfo *ai;
+	const char *str;
+{
+	if ((pai->ai_flags & AI_CANONNAME) != 0) {
+		ai->ai_canonname = (char *)malloc(strlen(str) + 1);
+		if (ai->ai_canonname == NULL)
+			return EAI_MEMORY;
+		strcpy(ai->ai_canonname, str);
+	}
+	return 0;
+}
+
+static struct addrinfo *
+get_ai(pai, afd, addr)
+	const struct addrinfo *pai;
+	const struct afd *afd;
+	const char *addr;
+{
+	char *p;
+	struct addrinfo *ai;
+
+	ai = (struct addrinfo *)malloc(sizeof(struct addrinfo)
+		+ (afd->a_socklen));
+	if (ai == NULL)
+		return NULL;
+
+	memcpy(ai, pai, sizeof(struct addrinfo));
+	ai->ai_addr = (struct sockaddr *)(void *)(ai + 1);
+	memset(ai->ai_addr, 0, (size_t)afd->a_socklen);
+#ifdef HAVE_SA_LEN
+	ai->ai_addr->sa_len = afd->a_socklen;
+#endif
+	ai->ai_addrlen = afd->a_socklen;
+	ai->ai_addr->sa_family = ai->ai_family = afd->a_af;
+	p = (char *)(void *)(ai->ai_addr);
+	memcpy(p + afd->a_off, addr, (size_t)afd->a_addrlen);
+	return ai;
+}
+
+/* XXX need to malloc() the same way we do from other functions! */
+static struct addrinfo *
+copy_ai(pai)
+	const struct addrinfo *pai;
+{
+	struct addrinfo *ai;
+	size_t l;
+
+	l = sizeof(*ai) + pai->ai_addrlen;
+	if ((ai = (struct addrinfo *)malloc(l)) == NULL)
+		return NULL;
+	memset(ai, 0, l);
+	memcpy(ai, pai, sizeof(*ai));
+	ai->ai_addr = (struct sockaddr *)(void *)(ai + 1);
+	memcpy(ai->ai_addr, pai->ai_addr, pai->ai_addrlen);
+
+	if (pai->ai_canonname) {
+		l = strlen(pai->ai_canonname) + 1;
+		if ((ai->ai_canonname = malloc(l)) == NULL) {
+			free(ai);
+			return NULL;
+		}
+		strcpy(ai->ai_canonname, pai->ai_canonname);	/* (checked) */
+	} else {
+		/* just to make sure */
+		ai->ai_canonname = NULL;
+	}
+
+	ai->ai_next = NULL;
+
+	return ai;
+}
+
+static int
+get_portmatch(const struct addrinfo *ai, const char *servname) {
+
+	/* get_port does not touch first argument. when matchonly == 1. */
+	/* LINTED const cast */
+	return get_port((const struct addrinfo *)ai, servname, 1);
+}
+
+static int
+get_port(const struct addrinfo *ai, const char *servname, int matchonly) {
+	const char *proto;
+	struct servent *sp;
+	int port;
+	int allownumeric;
+
+	if (servname == NULL)
+		return 0;
+	switch (ai->ai_family) {
+	case AF_INET:
+#ifdef AF_INET6
+	case AF_INET6:
+#endif
+		break;
+	default:
+		return 0;
+	}
+
+	switch (ai->ai_socktype) {
+	case SOCK_RAW:
+		return EAI_SERVICE;
+	case SOCK_DGRAM:
+	case SOCK_STREAM:
+		allownumeric = 1;
+		break;
+	case ANY:
+		switch (ai->ai_family) {
+		case AF_INET:
+#ifdef AF_INET6
+		case AF_INET6:
+#endif
+			allownumeric = 1;
+			break;
+		default:
+			allownumeric = 0;
+			break;
+		}
+		break;
+	default:
+		return EAI_SOCKTYPE;
+	}
+
+	if (str_isnumber(servname)) {
+		if (!allownumeric)
+			return EAI_SERVICE;
+		port = atoi(servname);
+		if (port < 0 || port > 65535)
+			return EAI_SERVICE;
+		port = htons(port);
+	} else {
+		switch (ai->ai_socktype) {
+		case SOCK_DGRAM:
+			proto = "udp";
+			break;
+		case SOCK_STREAM:
+			proto = "tcp";
+			break;
+		default:
+			proto = NULL;
+			break;
+		}
+
+		if ((sp = getservbyname(servname, proto)) == NULL)
+			return EAI_SERVICE;
+		port = sp->s_port;
+	}
+
+	if (!matchonly) {
+		switch (ai->ai_family) {
+		case AF_INET:
+			((struct sockaddr_in *)(void *)
+			    ai->ai_addr)->sin_port = port;
+			break;
+		case AF_INET6:
+			((struct sockaddr_in6 *)(void *)
+			    ai->ai_addr)->sin6_port = port;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static const struct afd *
+find_afd(af)
+	int af;
+{
+	const struct afd *afd;
+
+	if (af == PF_UNSPEC)
+		return NULL;
+	for (afd = afdl; afd->a_af; afd++) {
+		if (afd->a_af == af)
+			return afd;
+	}
+	return NULL;
+}
+
+/*%
+ * post-2553: AI_ADDRCONFIG check.  if we use getipnodeby* as backend, backend
+ * will take care of it.
+ * the semantics of AI_ADDRCONFIG is not defined well.  we are not sure
+ * if the code is right or not.
+ */
+static int
+addrconfig(af)
+	int af;
+{
+	int s;
+
+	/* XXX errno */
+	s = socket(af, SOCK_DGRAM, 0);
+	if (s < 0) {
+		if (errno != EMFILE)
+			return 0;
+	} else
+		close(s);
+	return 1;
+}
+
+/* convert a string to a scope identifier. XXX: IPv6 specific */
+static int
+ip6_str2scopeid(char *scope, struct sockaddr_in6 *sin6,
+		u_int32_t *scopeidp)
+{
+	u_int32_t scopeid;
+	u_long lscopeid;
+	struct in6_addr *a6 = &sin6->sin6_addr;
+	char *ep;
+	
+	/* empty scopeid portion is invalid */
+	if (*scope == '\0')
+		return (0);
+
+#ifdef USE_IFNAMELINKID
+	if (IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6) ||
+	    IN6_IS_ADDR_MC_NODELOCAL(a6)) {
+		/*
+		 * Using interface names as link indices can be allowed
+		 * only when we can assume a one-to-one mappings between
+		 * links and interfaces.  See comments in getnameinfo.c.
+		 */
+		scopeid = if_nametoindex(scope);
+		if (scopeid == 0)
+			goto trynumeric;
+		*scopeidp = scopeid;
+		return (1);
+	}
+#endif
+
+	/* still unclear about literal, allow numeric only - placeholder */
+	if (IN6_IS_ADDR_SITELOCAL(a6) || IN6_IS_ADDR_MC_SITELOCAL(a6))
+		goto trynumeric;
+	if (IN6_IS_ADDR_MC_ORGLOCAL(a6))
+		goto trynumeric;
+	else
+		goto trynumeric;	/*%< global */
+	/* try to convert to a numeric id as a last resort */
+trynumeric:
+	errno = 0;
+	lscopeid = strtoul(scope, &ep, 10);
+	scopeid = lscopeid & 0xffffffff;
+	if (errno == 0 && ep && *ep == '\0' && scopeid == lscopeid) {
+		*scopeidp = scopeid;
+		return (1);
+	} else
+		return (0);
+}
+
+struct addrinfo *
+hostent2addrinfo(hp, pai)
+	struct hostent *hp;
+	const struct addrinfo *pai;
+{
+	int i, af, error = 0;
+	char **aplist = NULL, *ap;
+	struct addrinfo sentinel, *cur;
+	const struct afd *afd;
+
+	af = hp->h_addrtype;
+	if (pai->ai_family != AF_UNSPEC && af != pai->ai_family)
+		return(NULL);
+
+	afd = find_afd(af);
+	if (afd == NULL)
+		return(NULL);
+
+	aplist = hp->h_addr_list;
+
+	memset(&sentinel, 0, sizeof(sentinel));
+	cur = &sentinel;
+
+	for (i = 0; (ap = aplist[i]) != NULL; i++) {
+#if 0				/*%< the trick seems too much */
+		af = hp->h_addr_list;
+		if (af == AF_INET6 &&
+		    IN6_IS_ADDR_V4MAPPED((struct in6_addr *)ap)) {
+			af = AF_INET;
+			ap = ap + sizeof(struct in6_addr)
+				- sizeof(struct in_addr);
+		}
+		afd = find_afd(af);
+		if (afd == NULL)
+			continue;
+#endif /* 0 */
+
+		GET_AI(cur->ai_next, afd, ap);
+
+		/* GET_PORT(cur->ai_next, servname); */
+		if ((pai->ai_flags & AI_CANONNAME) != 0) {
+			/*
+			 * RFC2553 says that ai_canonname will be set only for
+			 * the first element.  we do it for all the elements,
+			 * just for convenience.
+			 */
+			GET_CANONNAME(cur->ai_next, hp->h_name);
+		}
+		while (cur->ai_next) /*%< no need to loop, actually. */
+			cur = cur->ai_next;
+		continue;
+
+	free:
+		if (cur->ai_next)
+			freeaddrinfo(cur->ai_next);
+		cur->ai_next = NULL;
+		/* continue, without tht pointer CUR advanced. */
+	}
+
+	return(sentinel.ai_next);
+}
+
+struct addrinfo *
+addr2addrinfo(pai, cp)
+	const struct addrinfo *pai;
+	const char *cp;
+{
+	const struct afd *afd;
+
+	afd = find_afd(pai->ai_family);
+	if (afd == NULL)
+		return(NULL);
+
+	return(get_ai(pai, afd, cp));
+}
+
+static struct net_data *
+init()
+{
+	struct net_data *net_data;
+
+	if (!(net_data = net_data_init(NULL)))
+		goto error;
+	if (!net_data->ho) {
+		net_data->ho = (*net_data->irs->ho_map)(net_data->irs);
+		if (!net_data->ho || !net_data->res) {
+error:
+			errno = EIO;
+			if (net_data && net_data->res)
+				RES_SET_H_ERRNO(net_data->res, NETDB_INTERNAL);
+			return (NULL);
+		}
+
+		(*net_data->ho->res_set)(net_data->ho, net_data->res, NULL);
+	}
+
+	return (net_data);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gethostent.c b/usr/src/lib/libresolv2_joy/common/irs/gethostent.c
new file mode 100644
index 0000000000..c4751c2c80
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gethostent.c
@@ -0,0 +1,1096 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: gethostent.c,v 1.8 2006/01/10 05:06:00 marka Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#if !defined(__BIND_NOSTATIC)
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <netinet/in.h>
+#include <net/if.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "irs_data.h"
+
+/* Definitions */
+
+struct pvt {
+	char *		aliases[1];
+	char *		addrs[2];
+	char		addr[NS_IN6ADDRSZ];
+	char		name[NS_MAXDNAME + 1];
+	struct hostent	host;
+};
+
+/* Forward */
+
+static struct net_data *init(void);
+static void		freepvt(struct net_data *);
+static struct hostent  *fakeaddr(const char *, int, struct net_data *);
+
+#ifdef	SUNW_OVERRIDE_RETRY
+extern int	__res_retry(int);
+extern int	__res_retry_reset(void);
+#endif	/* SUNW_OVERRIDE_RETRY */
+
+
+/* Public */
+
+struct hostent *
+gethostbyname(const char *name) {
+	struct net_data *net_data = init();
+
+	return (gethostbyname_p(name, net_data));
+}
+
+struct hostent *
+gethostbyname2(const char *name, int af) {
+	struct net_data *net_data = init();
+
+	return (gethostbyname2_p(name, af, net_data));
+}
+
+struct hostent *
+gethostbyaddr(const char *addr, int len, int af) {
+	struct net_data *net_data = init();
+
+	return (gethostbyaddr_p(addr, len, af, net_data));
+}
+
+struct hostent *
+gethostent() {
+	struct net_data *net_data = init();
+
+	return (gethostent_p(net_data));
+}
+
+void
+sethostent(int stayopen) {
+	struct net_data *net_data = init();
+	sethostent_p(stayopen, net_data);
+}
+
+
+void
+endhostent() {
+	struct net_data *net_data = init();
+	endhostent_p(net_data);
+}
+
+/* Shared private. */
+
+struct hostent *
+gethostbyname_p(const char *name, struct net_data *net_data) {
+	struct hostent *hp;
+
+	if (!net_data)
+		return (NULL);
+
+	if (net_data->res->options & RES_USE_INET6) {
+		hp = gethostbyname2_p(name, AF_INET6, net_data);
+		if (hp)
+			return (hp);
+	}
+	return (gethostbyname2_p(name, AF_INET, net_data));
+}
+
+struct hostent *
+gethostbyname2_p(const char *name, int af, struct net_data *net_data) {
+	struct irs_ho *ho;
+	char tmp[NS_MAXDNAME];
+	struct hostent *hp;
+	const char *cp;
+	char **hap;
+
+	if (!net_data || !(ho = net_data->ho))
+		return (NULL);
+	if (net_data->ho_stayopen && net_data->ho_last &&
+	    net_data->ho_last->h_addrtype == af) {
+		if (ns_samename(name, net_data->ho_last->h_name) == 1)
+			return (net_data->ho_last);
+		for (hap = net_data->ho_last->h_aliases; hap && *hap; hap++)
+			if (ns_samename(name, *hap) == 1)
+				return (net_data->ho_last);
+	}
+	if (!strchr(name, '.') && (cp = res_hostalias(net_data->res, name,
+						      tmp, sizeof tmp)))
+		name = cp;
+	if ((hp = fakeaddr(name, af, net_data)) != NULL)
+		return (hp);
+#ifdef	SUNW_OVERRIDE_RETRY
+	net_data->res->retry = __res_retry(net_data->res->retry);
+#endif	/* SUNW_OVERRIDE_RETRY */
+	net_data->ho_last = (*ho->byname2)(ho, name, af);
+#ifdef	SUNW_OVERRIDE_RETRY
+	net_data->res->retry = __res_retry_reset();
+#endif	/* SUNW_OVERRIDE_RETRY */
+	if (!net_data->ho_stayopen)
+		endhostent();
+	return (net_data->ho_last);
+}
+
+struct hostent *
+gethostbyaddr_p(const char *addr, int len, int af, struct net_data *net_data) {
+	struct irs_ho *ho;
+	char **hap;
+
+	if (!net_data || !(ho = net_data->ho))
+		return (NULL);
+	if (net_data->ho_stayopen && net_data->ho_last &&
+	    net_data->ho_last->h_length == len)
+		for (hap = net_data->ho_last->h_addr_list;
+		     hap && *hap;
+		     hap++)
+			if (!memcmp(addr, *hap, len))
+				return (net_data->ho_last);
+	net_data->ho_last = (*ho->byaddr)(ho, addr, len, af);
+	if (!net_data->ho_stayopen)
+		endhostent();
+	return (net_data->ho_last);
+}
+
+
+struct hostent *
+gethostent_p(struct net_data *net_data) {
+	struct irs_ho *ho;
+	struct hostent *hp;
+
+	if (!net_data || !(ho = net_data->ho))
+		return (NULL);
+	while ((hp = (*ho->next)(ho)) != NULL &&
+	       hp->h_addrtype == AF_INET6 &&
+	       (net_data->res->options & RES_USE_INET6) == 0U)
+		continue;
+	net_data->ho_last = hp;
+	return (net_data->ho_last);
+}
+
+
+void
+sethostent_p(int stayopen, struct net_data *net_data) {
+	struct irs_ho *ho;
+
+	if (!net_data || !(ho = net_data->ho))
+		return;
+	freepvt(net_data);
+	(*ho->rewind)(ho);
+	net_data->ho_stayopen = (stayopen != 0);
+	if (stayopen == 0)
+		net_data_minimize(net_data);
+}
+
+void
+endhostent_p(struct net_data *net_data) {
+	struct irs_ho *ho;
+
+	if ((net_data != NULL) && ((ho = net_data->ho) != NULL))
+		(*ho->minimize)(ho);
+}
+
+#ifndef IN6_IS_ADDR_V4COMPAT
+static const unsigned char in6addr_compat[12] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
+#define IN6_IS_ADDR_V4COMPAT(x) (!memcmp((x)->s6_addr, in6addr_compat, 12) && \
+				 ((x)->s6_addr[12] != 0 || \
+				  (x)->s6_addr[13] != 0 || \
+				  (x)->s6_addr[14] != 0 || \
+				   ((x)->s6_addr[15] != 0 && \
+				    (x)->s6_addr[15] != 1)))
+#endif
+#ifndef IN6_IS_ADDR_V4MAPPED
+#define IN6_IS_ADDR_V4MAPPED(x) (!memcmp((x)->s6_addr, in6addr_mapped, 12))
+#endif
+
+static const unsigned char in6addr_mapped[12] = {
+	0, 0, 0, 0,  0, 0, 0, 0,  0, 0, 0xff, 0xff };
+
+static int scan_interfaces(int *, int *);
+static struct hostent *copyandmerge(struct hostent *, struct hostent *, int, int *);
+
+/*%
+ *	Public functions
+ */
+
+/*%
+ *	AI_V4MAPPED + AF_INET6
+ *	If no IPv6 address then a query for IPv4 and map returned values.
+ *
+ *	AI_ALL + AI_V4MAPPED + AF_INET6
+ *	Return IPv6 and IPv4 mapped.
+ *
+ *	AI_ADDRCONFIG
+ *	Only return IPv6 / IPv4 address if there is an interface of that
+ *	type active.
+ */
+
+struct hostent *
+getipnodebyname(const char *name, int af, int flags, int *error_num) {
+	int have_v4 = 1, have_v6 = 1;
+	struct in_addr in4;
+	struct in6_addr in6;
+	struct hostent he, *he1 = NULL, *he2 = NULL, *he3;
+	int v4 = 0, v6 = 0;
+	struct net_data *net_data = init();
+	u_long options;
+	int tmp_err;
+
+	if (net_data == NULL) {
+		*error_num = NO_RECOVERY;
+		return (NULL);
+	}
+
+	/* If we care about active interfaces then check. */
+	if ((flags & AI_ADDRCONFIG) != 0)
+		if (scan_interfaces(&have_v4, &have_v6) == -1) {
+			*error_num = NO_RECOVERY;
+			return (NULL);
+		}
+
+	/* Check for literal address. */
+	if ((v4 = inet_pton(AF_INET, name, &in4)) != 1)
+		v6 = inet_pton(AF_INET6, name, &in6);
+
+	/* Impossible combination? */
+	 
+	if ((af == AF_INET6 && (flags & AI_V4MAPPED) == 0 && v4 == 1) ||
+	    (af == AF_INET && v6 == 1) ||
+	    (have_v4 == 0 && v4 == 1) ||
+	    (have_v6 == 0 && v6 == 1) ||
+	    (have_v4 == 0 && af == AF_INET) ||
+	    (have_v6 == 0 && af == AF_INET6)) {
+		*error_num = HOST_NOT_FOUND;
+		return (NULL);
+	}
+
+	/* Literal address? */
+	if (v4 == 1 || v6 == 1) {
+		char *addr_list[2];
+		char *aliases[1];
+
+		DE_CONST(name, he.h_name);
+		he.h_addr_list = addr_list;
+		he.h_addr_list[0] = (v4 == 1) ? (char *)&in4 : (char *)&in6;
+		he.h_addr_list[1] = NULL;
+		he.h_aliases = aliases;
+		he.h_aliases[0] = NULL;
+		he.h_length = (v4 == 1) ? INADDRSZ : IN6ADDRSZ;
+		he.h_addrtype = (v4 == 1) ? AF_INET : AF_INET6;
+		return (copyandmerge(&he, NULL, af, error_num));
+	}
+
+	options = net_data->res->options;
+	net_data->res->options &= ~RES_USE_INET6;
+
+	tmp_err = NO_RECOVERY;
+	if (have_v6 && af == AF_INET6) {
+		he2 = gethostbyname2_p(name, AF_INET6, net_data);
+		if (he2 != NULL) {
+			he1 = copyandmerge(he2, NULL, af, error_num);
+			if (he1 == NULL)
+				return (NULL);
+			he2 = NULL;
+		} else {
+			tmp_err = net_data->res->res_h_errno;
+		}
+	}
+
+	if (have_v4 &&
+	    ((af == AF_INET) ||
+	     (af == AF_INET6 && (flags & AI_V4MAPPED) != 0 &&
+	      (he1 == NULL || (flags & AI_ALL) != 0)))) {
+		he2 = gethostbyname2_p(name, AF_INET, net_data);
+		if (he1 == NULL && he2 == NULL) {
+			*error_num = net_data->res->res_h_errno;
+			return (NULL);
+		} 
+	} else
+		*error_num = tmp_err;
+
+	net_data->res->options = options;
+
+	he3 = copyandmerge(he1, he2, af, error_num);
+
+	if (he1 != NULL)
+		freehostent(he1);
+	return (he3);
+}
+
+struct hostent *
+getipnodebyaddr(const void *src, size_t len, int af, int *error_num) {
+	struct hostent *he1, *he2;
+	struct net_data *net_data = init();
+
+	/* Sanity Checks. */
+#ifdef       ORIGINAL_ISC_CODE
+	if (src == NULL) {
+#else
+	/* this change was added circa May 2009, but not in ISC libbind 6.0 */
+	if (src == NULL|| net_data == NULL) {
+#endif       /* ORIGINAL_ISC_CODE */
+		*error_num = NO_RECOVERY;
+		return (NULL);
+	}
+	
+	switch (af) {
+	case AF_INET:
+		if (len != (size_t)INADDRSZ) {
+			*error_num = NO_RECOVERY;
+			return (NULL);
+		}
+		break;
+	case AF_INET6:
+		if (len != (size_t)IN6ADDRSZ) {
+			*error_num = NO_RECOVERY;
+			return (NULL);
+		}
+		break;
+	default:
+		*error_num = NO_RECOVERY;
+		return (NULL);
+	}
+
+	/*
+	 * Lookup IPv4 and IPv4 mapped/compatible addresses
+	 */
+	if ((af == AF_INET6 &&
+	     IN6_IS_ADDR_V4COMPAT((const struct in6_addr *)src)) ||
+	    (af == AF_INET6 &&
+	     IN6_IS_ADDR_V4MAPPED((const struct in6_addr *)src)) ||
+	    (af == AF_INET)) {
+		const char *cp = src;
+
+		if (af == AF_INET6)
+			cp += 12;
+		he1 = gethostbyaddr_p(cp, 4, AF_INET, net_data);
+		if (he1 == NULL) {
+			*error_num = net_data->res->res_h_errno;
+			return (NULL);
+		}
+		he2 = copyandmerge(he1, NULL, af, error_num);
+		if (he2 == NULL)
+			return (NULL);
+		/*
+		 * Restore original address if mapped/compatible.
+		 */
+		if (af == AF_INET6)
+			memcpy(he1->h_addr, src, len);
+		return (he2);
+	}
+
+	/*
+	 * Lookup IPv6 address.
+	 */
+	if (memcmp((const struct in6_addr *)src, &in6addr_any, 16) == 0) {
+		*error_num = HOST_NOT_FOUND;
+		return (NULL);
+	}
+
+	he1 = gethostbyaddr_p(src, 16, AF_INET6, net_data);
+	if (he1 == NULL) {
+		*error_num = net_data->res->res_h_errno;
+		return (NULL);
+	}
+	return (copyandmerge(he1, NULL, af, error_num));
+}
+
+void
+freehostent(struct hostent *he) {
+	char **cpp;
+	int names = 1;
+	int addresses = 1;
+
+	memput(he->h_name, strlen(he->h_name) + 1);
+
+	cpp = he->h_addr_list;
+	while (*cpp != NULL) {
+		memput(*cpp, (he->h_addrtype == AF_INET) ?
+			     INADDRSZ : IN6ADDRSZ);
+		*cpp = NULL;
+		cpp++;
+		addresses++;
+	}
+
+	cpp = he->h_aliases;
+	while (*cpp != NULL) {
+		memput(*cpp, strlen(*cpp) + 1);
+		cpp++;
+		names++;
+	}
+
+	memput(he->h_aliases, sizeof(char *) * (names));
+	memput(he->h_addr_list, sizeof(char *) * (addresses));
+	memput(he, sizeof *he);
+}
+
+/*%
+ * Private
+ */
+
+/*%
+ * Scan the interface table and set have_v4 and have_v6 depending
+ * upon whether there are IPv4 and IPv6 interface addresses.
+ *
+ * Returns:
+ *	0 on success
+ *	-1 on failure.
+ */
+
+#if defined(SIOCGLIFCONF) && defined(SIOCGLIFADDR) && \
+    !defined(IRIX_EMUL_IOCTL_SIOCGIFCONF) 
+
+#ifdef __hpux
+#define lifc_len iflc_len
+#define lifc_buf iflc_buf
+#define lifc_req iflc_req
+#define LIFCONF if_laddrconf
+#else
+#define SETFAMILYFLAGS
+#define LIFCONF lifconf
+#endif
+ 
+#ifdef __hpux
+#define lifr_addr iflr_addr
+#define lifr_name iflr_name
+#define lifr_dstaddr iflr_dstaddr
+#define lifr_flags iflr_flags
+#define ss_family sa_family
+#define LIFREQ if_laddrreq
+#else
+#define LIFREQ lifreq
+#endif
+
+static void
+scan_interfaces6(int *have_v4, int *have_v6) {
+	struct LIFCONF lifc;
+	struct LIFREQ lifreq;
+	struct in_addr in4;
+	struct in6_addr in6;
+	char *buf = NULL, *cp, *cplim;
+	static unsigned int bufsiz = 4095;
+	int s, cpsize, n;
+
+	/* Get interface list from system. */
+	if ((s = socket(AF_INET6, SOCK_DGRAM, 0)) == -1)
+		goto cleanup;
+
+	/*
+	 * Grow buffer until large enough to contain all interface
+	 * descriptions.
+	 */
+	for (;;) {
+		buf = memget(bufsiz);
+		if (buf == NULL)
+			goto cleanup;
+#ifdef SETFAMILYFLAGS
+		lifc.lifc_family = AF_UNSPEC;	/*%< request all families */
+		lifc.lifc_flags = 0;
+#endif
+		lifc.lifc_len = bufsiz;
+		lifc.lifc_buf = buf;
+		if ((n = ioctl(s, SIOCGLIFCONF, (char *)&lifc)) != -1) {
+			/*
+			 * Some OS's just return what will fit rather
+			 * than set EINVAL if the buffer is too small
+			 * to fit all the interfaces in.  If 
+			 * lifc.lifc_len is too near to the end of the
+			 * buffer we will grow it just in case and
+			 * retry.
+			 */
+			if (lifc.lifc_len + 2 * sizeof(lifreq) < bufsiz)
+				break;
+		}
+		if ((n == -1) && errno != EINVAL)
+			goto cleanup;
+
+		if (bufsiz > 1000000)
+			goto cleanup;
+
+		memput(buf, bufsiz);
+		bufsiz += 4096;
+	}
+
+	/* Parse system's interface list. */
+	cplim = buf + lifc.lifc_len;    /*%< skip over if's with big ifr_addr's */
+	for (cp = buf;
+	     (*have_v4 == 0 || *have_v6 == 0) && cp < cplim;
+	     cp += cpsize) {
+		memcpy(&lifreq, cp, sizeof lifreq);
+#ifdef HAVE_SA_LEN
+#ifdef FIX_ZERO_SA_LEN
+		if (lifreq.lifr_addr.sa_len == 0)
+			lifreq.lifr_addr.sa_len = 16;
+#endif
+#ifdef HAVE_MINIMUM_IFREQ
+		cpsize = sizeof lifreq;
+		if (lifreq.lifr_addr.sa_len > sizeof (struct sockaddr))
+			cpsize += (int)lifreq.lifr_addr.sa_len -
+				(int)(sizeof (struct sockaddr));
+#else
+		cpsize = sizeof lifreq.lifr_name + lifreq.lifr_addr.sa_len;
+#endif /* HAVE_MINIMUM_IFREQ */
+#elif defined SIOCGIFCONF_ADDR
+		cpsize = sizeof lifreq;
+#else
+		cpsize = sizeof lifreq.lifr_name;
+		/* XXX maybe this should be a hard error? */
+		if (ioctl(s, SIOCGLIFADDR, (char *)&lifreq) < 0)
+			continue;
+#endif
+		switch (lifreq.lifr_addr.ss_family) {
+		case AF_INET:
+			if (*have_v4 == 0) {
+				memcpy(&in4,
+				       &((struct sockaddr_in *)
+				       &lifreq.lifr_addr)->sin_addr,
+				       sizeof in4);
+				if (in4.s_addr == INADDR_ANY)
+					break;
+				n = ioctl(s, SIOCGLIFFLAGS, (char *)&lifreq);
+				if (n < 0)
+					break;
+				if ((lifreq.lifr_flags & IFF_UP) == 0)
+					break;
+				*have_v4 = 1;
+			} 
+			break;
+		case AF_INET6:
+			if (*have_v6 == 0) {
+				memcpy(&in6,
+				       &((struct sockaddr_in6 *)
+				       &lifreq.lifr_addr)->sin6_addr, sizeof in6);
+				if (memcmp(&in6, &in6addr_any, sizeof in6) == 0)
+					break;
+				n = ioctl(s, SIOCGLIFFLAGS, (char *)&lifreq);
+				if (n < 0)
+					break;
+				if ((lifreq.lifr_flags & IFF_UP) == 0)
+					break;
+				*have_v6 = 1;
+			}
+			break;
+		}
+	}
+	if (buf != NULL)
+		memput(buf, bufsiz);
+	close(s);
+	/* printf("scan interface -> 4=%d 6=%d\n", *have_v4, *have_v6); */
+	return;
+ cleanup:
+	if (buf != NULL)
+		memput(buf, bufsiz);
+	if (s != -1)
+		close(s);
+	/* printf("scan interface -> 4=%d 6=%d\n", *have_v4, *have_v6); */
+	return;
+}
+#endif
+
+#if ( defined(__linux__) || defined(__linux) || defined(LINUX) )
+#ifndef IF_NAMESIZE
+# ifdef IFNAMSIZ
+#  define IF_NAMESIZE  IFNAMSIZ
+# else
+#  define IF_NAMESIZE 16
+# endif
+#endif
+static void
+scan_linux6(int *have_v6) {
+	FILE *proc = NULL;
+	char address[33];
+	char name[IF_NAMESIZE+1];
+	int ifindex, prefix, flag3, flag4;
+	
+	proc = fopen("/proc/net/if_inet6", "r");
+	if (proc == NULL)
+		return;
+
+	if (fscanf(proc, "%32[a-f0-9] %x %x %x %x %16s\n",
+		   address, &ifindex, &prefix, &flag3, &flag4, name) == 6)
+		*have_v6 = 1;
+	fclose(proc);
+	return;
+}
+#endif
+
+static int
+scan_interfaces(int *have_v4, int *have_v6) {
+	struct ifconf ifc;
+	union {
+		char _pad[256];		/*%< leave space for IPv6 addresses */
+		struct ifreq ifreq;
+	} u;
+	struct in_addr in4;
+	struct in6_addr in6;
+	char *buf = NULL, *cp, *cplim;
+	static unsigned int bufsiz = 4095;
+	int s, n;
+	size_t cpsize;
+
+	/* Set to zero.  Used as loop terminators below. */
+	*have_v4 = *have_v6 = 0;
+
+#if defined(SIOCGLIFCONF) && defined(SIOCGLIFADDR) && \
+    !defined(IRIX_EMUL_IOCTL_SIOCGIFCONF) 
+	/*
+	 * Try to scan the interfaces using IPv6 ioctls().
+	 */
+	scan_interfaces6(have_v4, have_v6);
+	if (*have_v4 != 0 && *have_v6 != 0)
+		return (0);
+#endif
+#ifdef __linux
+	scan_linux6(have_v6);
+#endif
+
+	/* Get interface list from system. */
+	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
+		goto err_ret;
+
+	/*
+	 * Grow buffer until large enough to contain all interface
+	 * descriptions.
+	 */
+	for (;;) {
+		buf = memget(bufsiz);
+		if (buf == NULL)
+			goto err_ret;
+		ifc.ifc_len = bufsiz;
+		ifc.ifc_buf = buf;
+#ifdef IRIX_EMUL_IOCTL_SIOCGIFCONF
+		/*
+		 * This is a fix for IRIX OS in which the call to ioctl with
+		 * the flag SIOCGIFCONF may not return an entry for all the
+		 * interfaces like most flavors of Unix.
+		 */
+		if (emul_ioctl(&ifc) >= 0)
+			break;
+#else
+		if ((n = ioctl(s, SIOCGIFCONF, (char *)&ifc)) != -1) {
+			/*
+			 * Some OS's just return what will fit rather
+			 * than set EINVAL if the buffer is too small
+			 * to fit all the interfaces in.  If 
+			 * ifc.ifc_len is too near to the end of the
+			 * buffer we will grow it just in case and
+			 * retry.
+			 */
+			if (ifc.ifc_len + 2 * sizeof(u.ifreq) < bufsiz)
+				break;
+		}
+#endif
+		if ((n == -1) && errno != EINVAL)
+			goto err_ret;
+
+		if (bufsiz > 1000000)
+			goto err_ret;
+
+		memput(buf, bufsiz);
+		bufsiz += 4096;
+	}
+
+	/* Parse system's interface list. */
+	cplim = buf + ifc.ifc_len;    /*%< skip over if's with big ifr_addr's */
+	for (cp = buf;
+	     (*have_v4 == 0 || *have_v6 == 0) && cp < cplim;
+	     cp += cpsize) {
+		memcpy(&u.ifreq, cp, sizeof u.ifreq);
+#ifdef HAVE_SA_LEN
+#ifdef FIX_ZERO_SA_LEN
+		if (u.ifreq.ifr_addr.sa_len == 0)
+			u.ifreq.ifr_addr.sa_len = 16;
+#endif
+#ifdef HAVE_MINIMUM_IFREQ
+		cpsize = sizeof u.ifreq;
+		if (u.ifreq.ifr_addr.sa_len > sizeof (struct sockaddr))
+			cpsize += (int)u.ifreq.ifr_addr.sa_len -
+				(int)(sizeof (struct sockaddr));
+#else
+		cpsize = sizeof u.ifreq.ifr_name + u.ifreq.ifr_addr.sa_len;
+#endif /* HAVE_MINIMUM_IFREQ */
+		if (cpsize > sizeof u.ifreq && cpsize <= sizeof u)
+			memcpy(&u.ifreq, cp, cpsize);
+#elif defined SIOCGIFCONF_ADDR
+		cpsize = sizeof u.ifreq;
+#else
+		cpsize = sizeof u.ifreq.ifr_name;
+		/* XXX maybe this should be a hard error? */
+		if (ioctl(s, SIOCGIFADDR, (char *)&u.ifreq) < 0)
+			continue;
+#endif
+		switch (u.ifreq.ifr_addr.sa_family) {
+		case AF_INET:
+			if (*have_v4 == 0) {
+				memcpy(&in4,
+				       &((struct sockaddr_in *)
+				       &u.ifreq.ifr_addr)->sin_addr,
+				       sizeof in4);
+				if (in4.s_addr == INADDR_ANY)
+					break;
+				n = ioctl(s, SIOCGIFFLAGS, (char *)&u.ifreq);
+				if (n < 0)
+					break;
+				if ((u.ifreq.ifr_flags & IFF_UP) == 0)
+					break;
+				*have_v4 = 1;
+			} 
+			break;
+		case AF_INET6:
+			if (*have_v6 == 0) {
+				memcpy(&in6,
+				       &((struct sockaddr_in6 *)
+				       &u.ifreq.ifr_addr)->sin6_addr,
+				       sizeof in6);
+				if (memcmp(&in6, &in6addr_any, sizeof in6) == 0)
+					break;
+				n = ioctl(s, SIOCGIFFLAGS, (char *)&u.ifreq);
+				if (n < 0)
+					break;
+				if ((u.ifreq.ifr_flags & IFF_UP) == 0)
+					break;
+				*have_v6 = 1;
+			}
+			break;
+		}
+	}
+	if (buf != NULL)
+		memput(buf, bufsiz);
+	close(s);
+	/* printf("scan interface -> 4=%d 6=%d\n", *have_v4, *have_v6); */
+	return (0);
+ err_ret:
+	if (buf != NULL)
+		memput(buf, bufsiz);
+	if (s != -1)
+		close(s);
+	/* printf("scan interface -> 4=%d 6=%d\n", *have_v4, *have_v6); */
+	return (-1);
+}
+
+static struct hostent *
+copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num) {
+	struct hostent *he = NULL;
+	int addresses = 1;	/*%< NULL terminator */
+	int names = 1;		/*%< NULL terminator */
+	int len = 0;
+	char **cpp, **npp;
+
+	/*
+	 * Work out array sizes;
+	 */
+	if (he1 != NULL) {
+		cpp = he1->h_addr_list;
+		while (*cpp != NULL) {
+			addresses++;
+			cpp++;
+		}
+		cpp = he1->h_aliases;
+		while (*cpp != NULL) {
+			names++;
+			cpp++;
+		}
+	}
+
+	if (he2 != NULL) {
+		cpp = he2->h_addr_list;
+		while (*cpp != NULL) {
+			addresses++;
+			cpp++;
+		}
+		if (he1 == NULL) {
+			cpp = he2->h_aliases;
+			while (*cpp != NULL) {
+				names++;
+				cpp++;
+			}
+		}
+	}
+
+	if (addresses == 1) {
+		*error_num = NO_ADDRESS;
+		return (NULL);
+	}
+
+	he = memget(sizeof *he);
+	if (he == NULL)
+		goto no_recovery;
+
+	he->h_addr_list = memget(sizeof(char *) * (addresses));
+	if (he->h_addr_list == NULL)
+		goto cleanup0;
+	memset(he->h_addr_list, 0, sizeof(char *) * (addresses));
+
+	/* copy addresses */
+	npp = he->h_addr_list;
+	if (he1 != NULL) {
+		cpp = he1->h_addr_list;
+		while (*cpp != NULL) {
+			*npp = memget((af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
+			if (*npp == NULL)
+				goto cleanup1;
+			/* convert to mapped if required */
+			if (af == AF_INET6 && he1->h_addrtype == AF_INET) {
+				memcpy(*npp, in6addr_mapped,
+				       sizeof in6addr_mapped);
+				memcpy(*npp + sizeof in6addr_mapped, *cpp,
+				       INADDRSZ);
+			} else {
+				memcpy(*npp, *cpp,
+				       (af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
+			}
+			cpp++;
+			npp++;
+		}
+	}
+
+	if (he2 != NULL) {
+		cpp = he2->h_addr_list;
+		while (*cpp != NULL) {
+			*npp = memget((af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
+			if (*npp == NULL)
+				goto cleanup1;
+			/* convert to mapped if required */
+			if (af == AF_INET6 && he2->h_addrtype == AF_INET) {
+				memcpy(*npp, in6addr_mapped,
+				       sizeof in6addr_mapped);
+				memcpy(*npp + sizeof in6addr_mapped, *cpp,
+				       INADDRSZ);
+			} else {
+				memcpy(*npp, *cpp,
+				       (af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
+			}
+			cpp++;
+			npp++;
+		}
+	}
+
+	he->h_aliases = memget(sizeof(char *) * (names));
+	if (he->h_aliases == NULL)
+		goto cleanup1;
+	memset(he->h_aliases, 0, sizeof(char *) * (names));
+
+	/* copy aliases */
+	npp = he->h_aliases;
+	cpp = (he1 != NULL) ? he1->h_aliases : he2->h_aliases;
+	while (*cpp != NULL) {
+		len = strlen (*cpp) + 1;
+		*npp = memget(len);
+		if (*npp == NULL)
+			goto cleanup2;
+		strcpy(*npp, *cpp);
+		npp++;
+		cpp++;
+	}
+
+	/* copy hostname */
+	he->h_name = memget(strlen((he1 != NULL) ?
+			    he1->h_name : he2->h_name) + 1);
+	if (he->h_name == NULL)
+		goto cleanup2;
+	strcpy(he->h_name, (he1 != NULL) ? he1->h_name : he2->h_name);
+
+	/* set address type and length */
+	he->h_addrtype = af;
+	he->h_length = (af == AF_INET) ? INADDRSZ : IN6ADDRSZ;
+	return(he);
+
+ cleanup2:
+	cpp = he->h_aliases;
+	while (*cpp != NULL) {
+		memput(*cpp, strlen(*cpp) + 1);
+		cpp++;
+	}
+	memput(he->h_aliases, sizeof(char *) * (names));
+
+ cleanup1:
+	cpp = he->h_addr_list;
+	while (*cpp != NULL) {
+		memput(*cpp, (af == AF_INET) ? INADDRSZ : IN6ADDRSZ);
+		*cpp = NULL;
+		cpp++;
+	}
+	memput(he->h_addr_list, sizeof(char *) * (addresses));
+
+ cleanup0:
+	memput(he, sizeof *he);
+
+ no_recovery:
+	*error_num = NO_RECOVERY;
+	return (NULL);
+}
+
+static struct net_data *
+init() {
+	struct net_data *net_data;
+
+	if (!(net_data = net_data_init(NULL)))
+		goto error;
+	if (!net_data->ho) {
+		net_data->ho = (*net_data->irs->ho_map)(net_data->irs);
+		if (!net_data->ho || !net_data->res) {
+  error:
+			errno = EIO;
+
+#ifdef	SUNW_SETHERRNO
+			h_errno = NETDB_INTERNAL;
+#endif	/* SUNW_SETHERRNO */
+			if (net_data && net_data->res)
+				RES_SET_H_ERRNO(net_data->res, NETDB_INTERNAL);
+			return (NULL);
+		}
+	
+		(*net_data->ho->res_set)(net_data->ho, net_data->res, NULL);
+	}
+	
+	return (net_data);
+}
+
+static void
+freepvt(struct net_data *net_data) {
+	if (net_data->ho_data) {
+		free(net_data->ho_data);
+		net_data->ho_data = NULL;
+	}
+}
+
+static struct hostent *
+fakeaddr(const char *name, int af, struct net_data *net_data) {
+	struct pvt *pvt;
+
+	freepvt(net_data);
+	net_data->ho_data = malloc(sizeof (struct pvt));
+	if (!net_data->ho_data) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(net_data->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	pvt = net_data->ho_data;
+#ifndef __bsdi__
+	/*
+	 * Unlike its forebear(inet_aton), our friendly inet_pton() is strict
+	 * in its interpretation of its input, and it will only return "1" if
+	 * the input string is a formally valid(and thus unambiguous with
+	 * respect to host names) internet address specification for this AF.
+	 *
+	 * This means "telnet 0xdeadbeef" and "telnet 127.1" are dead now.
+	 */
+	if (inet_pton(af, name, pvt->addr) != 1) {
+#else
+	/* BSDI XXX
+	 * We put this back to inet_aton -- we really want the old behavior
+	 * Long live 127.1...
+	 */
+	if ((af != AF_INET ||
+	    inet_aton(name, (struct in_addr *)pvt->addr) != 1) &&
+	    inet_pton(af, name, pvt->addr) != 1) {
+#endif
+		RES_SET_H_ERRNO(net_data->res, HOST_NOT_FOUND);
+		return (NULL);
+	}
+	strncpy(pvt->name, name, NS_MAXDNAME);
+	pvt->name[NS_MAXDNAME] = '\0';
+	if (af == AF_INET && (net_data->res->options & RES_USE_INET6) != 0U) {
+		map_v4v6_address(pvt->addr, pvt->addr);
+		af = AF_INET6;
+	}
+	pvt->host.h_addrtype = af;
+	switch(af) {
+	case AF_INET:
+		pvt->host.h_length = NS_INADDRSZ;
+		break;
+	case AF_INET6:
+		pvt->host.h_length = NS_IN6ADDRSZ;
+		break;
+	default:
+		errno = EAFNOSUPPORT;
+		RES_SET_H_ERRNO(net_data->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	pvt->host.h_name = pvt->name;
+	pvt->host.h_aliases = pvt->aliases;
+	pvt->aliases[0] = NULL;
+	pvt->addrs[0] = (char *)pvt->addr;
+	pvt->addrs[1] = NULL;
+	pvt->host.h_addr_list = pvt->addrs;
+	RES_SET_H_ERRNO(net_data->res, NETDB_SUCCESS);
+	return (&pvt->host);
+}
+
+#ifdef grot	/*%< for future use in gethostbyaddr(), for "SUNSECURITY" */
+	struct hostent *rhp;
+	char **haddr;
+	u_long old_options;
+	char hname2[MAXDNAME+1];
+
+	if (af == AF_INET) {
+	    /*
+	     * turn off search as the name should be absolute,
+	     * 'localhost' should be matched by defnames
+	     */
+	    strncpy(hname2, hp->h_name, MAXDNAME);
+	    hname2[MAXDNAME] = '\0';
+	    old_options = net_data->res->options;
+	    net_data->res->options &= ~RES_DNSRCH;
+	    net_data->res->options |= RES_DEFNAMES;
+	    if (!(rhp = gethostbyname(hname2))) {
+		net_data->res->options = old_options;
+		RES_SET_H_ERRNO(net_data->res, HOST_NOT_FOUND);
+		return (NULL);
+	    }
+	    net_data->res->options = old_options;
+	    for (haddr = rhp->h_addr_list; *haddr; haddr++)
+		if (!memcmp(*haddr, addr, INADDRSZ))
+			break;
+	    if (!*haddr) {
+		RES_SET_H_ERRNO(net_data->res, HOST_NOT_FOUND);
+		return (NULL);
+	    }
+	}
+#endif /* grot */
+#endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/gethostent_r.c b/usr/src/lib/libresolv2_joy/common/irs/gethostent_r.c
new file mode 100644
index 0000000000..1971677c5d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/gethostent_r.c
@@ -0,0 +1,278 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: gethostent_r.c,v 1.9 2005/09/03 12:41:37 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <port_before.h>
+#if !defined(_REENTRANT) || !defined(DO_PTHREADS)
+	static int gethostent_r_not_required = 0;
+#else
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <sys/param.h>
+#include <port_after.h>
+
+#pragma redefine extname res_gethostbyname joy_res_gethostbyname
+#pragma redefine extname res_gethostbyaddr joy_res_gethostbyaddr
+
+#ifdef HOST_R_RETURN
+
+static HOST_R_RETURN 
+copy_hostent(struct hostent *, struct hostent *, HOST_R_COPY_ARGS);
+
+HOST_R_RETURN
+gethostbyname_r(const char *name,  struct hostent *hptr, HOST_R_ARGS) {
+	struct hostent *he = gethostbyname(name);
+#ifdef HOST_R_SETANSWER
+	int n = 0;
+#endif
+
+#ifdef HOST_R_ERRNO
+	HOST_R_ERRNO;
+#endif
+
+#ifdef HOST_R_SETANSWER
+	if (he == NULL || (n = copy_hostent(he, hptr, HOST_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = hptr;
+	
+	return (n);
+#else
+	if (he == NULL)
+		return (HOST_R_BAD);
+
+	return (copy_hostent(he, hptr, HOST_R_COPY));
+#endif
+}
+
+HOST_R_RETURN
+gethostbyaddr_r(const char *addr, int len, int type,
+		struct hostent *hptr, HOST_R_ARGS) {
+	struct hostent *he = gethostbyaddr(addr, len, type);
+#ifdef HOST_R_SETANSWER
+	int n = 0;
+#endif
+
+#ifdef HOST_R_ERRNO
+	HOST_R_ERRNO;
+#endif
+
+#ifdef HOST_R_SETANSWER
+	if (he == NULL || (n = copy_hostent(he, hptr, HOST_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = hptr;
+	
+	return (n);
+#else
+	if (he == NULL)
+		return (HOST_R_BAD);
+
+	return (copy_hostent(he, hptr, HOST_R_COPY));
+#endif
+}
+
+/*%
+ *	These assume a single context is in operation per thread.
+ *	If this is not the case we will need to call irs directly
+ *	rather than through the base functions.
+ */
+
+HOST_R_RETURN
+gethostent_r(struct hostent *hptr, HOST_R_ARGS) {
+	struct hostent *he = gethostent();
+#ifdef HOST_R_SETANSWER
+	int n = 0;
+#endif
+
+#ifdef HOST_R_ERRNO
+	HOST_R_ERRNO;
+#endif
+
+#ifdef HOST_R_SETANSWER
+	if (he == NULL || (n = copy_hostent(he, hptr, HOST_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = hptr;
+	
+	return (n);
+#else
+	if (he == NULL)
+		return (HOST_R_BAD);
+
+	return (copy_hostent(he, hptr, HOST_R_COPY));
+#endif
+}
+
+HOST_R_SET_RETURN
+#ifdef HOST_R_ENT_ARGS
+sethostent_r(int stay_open, HOST_R_ENT_ARGS)
+#else
+sethostent_r(int stay_open)
+#endif
+{
+#ifdef HOST_R_ENT_ARGS
+	UNUSED(hdptr);
+#endif
+	sethostent(stay_open);
+#ifdef	HOST_R_SET_RESULT
+	return (HOST_R_SET_RESULT);
+#endif
+}
+
+HOST_R_END_RETURN
+#ifdef HOST_R_ENT_ARGS
+endhostent_r(HOST_R_ENT_ARGS)
+#else
+endhostent_r(void)
+#endif
+{
+#ifdef HOST_R_ENT_ARGS
+	UNUSED(hdptr);
+#endif
+	endhostent();
+	HOST_R_END_RESULT(HOST_R_OK);
+}
+
+/* Private */
+
+#ifndef HOSTENT_DATA
+static HOST_R_RETURN
+copy_hostent(struct hostent *he, struct hostent *hptr, HOST_R_COPY_ARGS) {
+	char *cp;
+	char **ptr;
+	int i, n;
+	int nptr, len;
+
+	/* Find out the amount of space required to store the answer. */
+	nptr = 2; /*%< NULL ptrs */
+	len = (char *)ALIGN(buf) - buf;
+	for (i = 0; he->h_addr_list[i]; i++, nptr++) {
+		len += he->h_length;
+	}
+	for (i = 0; he->h_aliases[i]; i++, nptr++) {
+		len += strlen(he->h_aliases[i]) + 1;
+	}
+	len += strlen(he->h_name) + 1;
+	len += nptr * sizeof(char*);
+	
+	if (len > buflen) {
+		errno = ERANGE;
+		return (HOST_R_BAD);
+	}
+
+	/* copy address size and type */
+	hptr->h_addrtype = he->h_addrtype;
+	n = hptr->h_length = he->h_length;
+
+	ptr = (char **)ALIGN(buf);
+	cp = (char *)ALIGN(buf) + nptr * sizeof(char *);
+
+	/* copy address list */
+	hptr->h_addr_list = ptr;
+	for (i = 0; he->h_addr_list[i]; i++ , ptr++) {
+		memcpy(cp, he->h_addr_list[i], n);
+		hptr->h_addr_list[i] = cp;
+		cp += n;
+	}
+	hptr->h_addr_list[i] = NULL;
+	ptr++;
+
+	/* copy official name */
+	n = strlen(he->h_name) + 1;
+	strcpy(cp, he->h_name);
+	hptr->h_name = cp;
+	cp += n;
+
+	/* copy aliases */
+	hptr->h_aliases = ptr;
+	for (i = 0 ; he->h_aliases[i]; i++) {
+		n = strlen(he->h_aliases[i]) + 1;
+		strcpy(cp, he->h_aliases[i]);
+		hptr->h_aliases[i] = cp;
+		cp += n;
+	}
+	hptr->h_aliases[i] = NULL;
+
+	return (HOST_R_OK);
+}
+#else /* !HOSTENT_DATA */
+static int
+copy_hostent(struct hostent *he, struct hostent *hptr, HOST_R_COPY_ARGS) {
+	char *cp, *eob;
+	int i, n;
+
+	/* copy address size and type */
+	hptr->h_addrtype = he->h_addrtype;
+	n = hptr->h_length = he->h_length;
+
+	/* copy up to first 35 addresses */
+	i = 0;
+	cp = hdptr->hostbuf;
+	eob = hdptr->hostbuf + sizeof(hdptr->hostbuf);
+	hptr->h_addr_list = hdptr->h_addr_ptrs;
+	while (he->h_addr_list[i] && i < (_MAXADDRS)) {
+		if (n < (eob - cp)) {
+			memcpy(cp, he->h_addr_list[i], n);
+			hptr->h_addr_list[i] = cp;
+			cp += n;
+		} else {
+			break;
+		}
+		i++;
+	}
+	hptr->h_addr_list[i] = NULL;
+
+	/* copy official name */
+	if ((n = strlen(he->h_name) + 1) < (eob - cp)) {
+		strcpy(cp, he->h_name);
+		hptr->h_name = cp;
+		cp += n;
+	} else {
+		return (-1);
+	}
+
+	/* copy aliases */
+	i = 0;
+	hptr->h_aliases = hdptr->host_aliases;
+	while (he->h_aliases[i] && i < (_MAXALIASES-1)) {
+		if ((n = strlen(he->h_aliases[i]) + 1) < (eob - cp)) {
+			strcpy(cp, he->h_aliases[i]);
+			hptr->h_aliases[i] = cp;
+			cp += n;
+		} else {
+			break;
+		}
+		i++;
+	}
+	hptr->h_aliases[i] = NULL;
+
+	return (HOST_R_OK);
+}
+#endif /* !HOSTENT_DATA */
+#else /* HOST_R_RETURN */
+	static int gethostent_r_unknown_system = 0;
+#endif /* HOST_R_RETURN */
+#endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getnameinfo.c b/usr/src/lib/libresolv2_joy/common/irs/getnameinfo.c
new file mode 100644
index 0000000000..360bda8bfe
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getnameinfo.c
@@ -0,0 +1,334 @@
+/*
+ * Issues to be discussed:
+ * - Thread safe-ness must be checked
+ */
+
+#if ( defined(__linux__) || defined(__linux) || defined(LINUX) )
+#ifndef IF_NAMESIZE
+# ifdef IFNAMSIZ
+#  define IF_NAMESIZE  IFNAMSIZ
+# else
+#  define IF_NAMESIZE 16
+# endif
+#endif
+#endif
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    This product includes software developed by WIDE Project and
+ *    its contributors.
+ * 4. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <port_before.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+#include <net/if.h>
+
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <string.h>
+#include <stddef.h>
+
+#include <port_after.h>
+
+/*%
+ * Note that a_off will be dynamically adjusted so that to be consistent
+ * with the definition of sockaddr_in{,6}.
+ * The value presented below is just a guess.
+ */
+static struct afd {
+	int a_af;
+	int a_addrlen;
+	size_t a_socklen;
+	int a_off;
+} afdl [] = {
+	/* first entry is linked last... */
+	{PF_INET, sizeof(struct in_addr), sizeof(struct sockaddr_in),
+	 offsetof(struct sockaddr_in, sin_addr)},
+	{PF_INET6, sizeof(struct in6_addr), sizeof(struct sockaddr_in6),
+	 offsetof(struct sockaddr_in6, sin6_addr)},
+	{0, 0, 0, 0},
+};
+
+struct sockinet {
+#ifdef HAVE_SA_LEN
+	u_char	si_len;
+#endif
+	u_char	si_family;
+	u_short	si_port;
+};
+
+static int ip6_parsenumeric __P((const struct sockaddr *, const char *, char *,
+				 size_t, int));
+#ifdef HAVE_SIN6_SCOPE_ID
+static int ip6_sa2str __P((const struct sockaddr_in6 *, char *, size_t, int));
+#endif
+
+int
+getnameinfo(sa, salen, host, hostlen, serv, servlen, flags)
+	const struct sockaddr *sa;
+	size_t salen;
+	char *host;
+	size_t hostlen;
+	char *serv;
+	size_t servlen;
+	int flags;
+{
+	struct afd *afd;
+	struct servent *sp;
+	struct hostent *hp;
+	u_short port;
+#ifdef HAVE_SA_LEN
+	size_t len;
+#endif
+	int family, i;
+	const char *addr;
+	char *p;
+	char numserv[512];
+	char numaddr[512];
+	const struct sockaddr_in6 *sin6;
+
+	if (sa == NULL)
+		return EAI_FAIL;
+
+#ifdef HAVE_SA_LEN
+	len = sa->sa_len;
+	if (len != salen) return EAI_FAIL;
+#endif
+
+	family = sa->sa_family;
+	for (i = 0; afdl[i].a_af; i++)
+		if (afdl[i].a_af == family) {
+			afd = &afdl[i];
+			goto found;
+		}
+	return EAI_FAMILY;
+
+ found:
+	if (salen != afd->a_socklen) return EAI_FAIL;
+
+	port = ((const struct sockinet *)sa)->si_port; /*%< network byte order */
+	addr = (const char *)sa + afd->a_off;
+
+	if (serv == NULL || servlen == 0U) {
+		/*
+		 * rfc2553bis says that serv == NULL or servlen == 0 means that
+		 * the caller does not want the result.
+		 */
+	} else if (flags & NI_NUMERICSERV) {
+		sprintf(numserv, "%d", ntohs(port));
+		if (strlen(numserv) > servlen)
+			return EAI_MEMORY;
+		strcpy(serv, numserv);
+	} else {
+		sp = getservbyport(port, (flags & NI_DGRAM) ? "udp" : "tcp");
+		if (sp) {
+			if (strlen(sp->s_name) + 1 > servlen)
+				return EAI_MEMORY;
+			strcpy(serv, sp->s_name);
+		} else
+			return EAI_NONAME;
+	}
+
+	switch (sa->sa_family) {
+	case AF_INET:
+		if (ntohl(*(const u_int32_t *)addr) >> IN_CLASSA_NSHIFT == 0)
+			flags |= NI_NUMERICHOST;			
+		break;
+	case AF_INET6:
+		sin6 = (const struct sockaddr_in6 *)sa;
+		switch (sin6->sin6_addr.s6_addr[0]) {
+		case 0x00:
+			if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
+				;
+			else if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))
+				;
+			else
+				flags |= NI_NUMERICHOST;
+			break;
+		default:
+			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
+				flags |= NI_NUMERICHOST;
+			else if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr))
+				flags |= NI_NUMERICHOST;
+			break;
+		}
+		break;
+	}
+	if (host == NULL || hostlen == 0U) {
+		/*
+		 * rfc2553bis says that host == NULL or hostlen == 0 means that
+		 * the caller does not want the result.
+		 */
+	} else if (flags & NI_NUMERICHOST) {
+		goto numeric;
+	} else {
+		hp = gethostbyaddr(addr, afd->a_addrlen, afd->a_af);
+
+		if (hp) {
+			if (flags & NI_NOFQDN) {
+				p = strchr(hp->h_name, '.');
+				if (p) *p = '\0';
+			}
+			if (strlen(hp->h_name) + 1 > hostlen)
+				return EAI_MEMORY;
+			strcpy(host, hp->h_name);
+		} else {
+			if (flags & NI_NAMEREQD)
+				return EAI_NONAME;
+		  numeric:
+			switch(afd->a_af) {
+			case AF_INET6:
+			{
+				int error;
+
+				if ((error = ip6_parsenumeric(sa, addr, host,
+							      hostlen,
+							      flags)) != 0)
+					return(error);
+				break;
+			}
+
+			default:
+				if (inet_ntop(afd->a_af, addr, numaddr,
+					      sizeof(numaddr)) == NULL)
+					return EAI_NONAME;
+				if (strlen(numaddr) + 1 > hostlen)
+					return EAI_MEMORY;
+				strcpy(host, numaddr);
+			}
+		}
+	}
+	return(0);
+}
+
+static int
+ip6_parsenumeric(const struct sockaddr *sa, const char *addr, char *host,
+		 size_t hostlen, int flags)
+{
+	size_t numaddrlen;
+	char numaddr[512];
+
+#ifndef HAVE_SIN6_SCOPE_ID
+	UNUSED(sa);
+	UNUSED(flags);
+#endif
+
+	if (inet_ntop(AF_INET6, addr, numaddr, sizeof(numaddr))
+	    == NULL)
+		return EAI_SYSTEM;
+
+	numaddrlen = strlen(numaddr);
+	if (numaddrlen + 1 > hostlen) /*%< don't forget terminator */
+		return EAI_MEMORY;
+	strcpy(host, numaddr);
+
+#ifdef HAVE_SIN6_SCOPE_ID
+	if (((const struct sockaddr_in6 *)sa)->sin6_scope_id) {
+		char scopebuf[MAXHOSTNAMELEN]; /*%< XXX */
+		int scopelen;
+
+		/* ip6_sa2str never fails */
+		scopelen = ip6_sa2str((const struct sockaddr_in6 *)sa,
+				      scopebuf, sizeof(scopebuf), flags);
+
+		if (scopelen + 1 + numaddrlen + 1 > hostlen)
+			return EAI_MEMORY;
+
+		/* construct <numeric-addr><delim><scopeid> */
+		memcpy(host + numaddrlen + 1, scopebuf,
+		       scopelen);
+		host[numaddrlen] = SCOPE_DELIMITER;
+		host[numaddrlen + 1 + scopelen] = '\0';
+	}
+#endif
+
+	return 0;
+}
+
+#ifdef HAVE_SIN6_SCOPE_ID
+/* ARGSUSED */
+static int
+ip6_sa2str(const struct sockaddr_in6 *sa6, char *buf,
+	   size_t bufsiz, int flags)
+{
+#ifdef USE_IFNAMELINKID
+	unsigned int ifindex = (unsigned int)sa6->sin6_scope_id;
+	const struct in6_addr *a6 = &sa6->sin6_addr;
+#endif
+	char tmp[64];
+
+#ifdef NI_NUMERICSCOPE
+	if (flags & NI_NUMERICSCOPE) {
+		sprintf(tmp, "%u", sa6->sin6_scope_id);
+		if (bufsiz != 0U) {
+			strncpy(buf, tmp, bufsiz - 1);
+			buf[bufsiz - 1] = '\0';
+		}
+		return(strlen(tmp));
+	}
+#endif
+
+#ifdef USE_IFNAMELINKID
+	/*
+	 * For a link-local address, convert the index to an interface
+	 * name, assuming a one-to-one mapping between links and interfaces.
+	 * Note, however, that this assumption is stronger than the
+	 * specification of the scoped address architecture;  the
+	 * specficication says that more than one interfaces can belong to
+	 * a single link.
+	 */
+
+	/* if_indextoname() does not take buffer size.  not a good api... */
+	if ((IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6)) &&
+	    bufsiz >= IF_NAMESIZE) {
+		char *p = if_indextoname(ifindex, buf);
+		if (p) {
+			return(strlen(p));
+		}
+	}
+#endif
+
+	/* last resort */
+	sprintf(tmp, "%u", sa6->sin6_scope_id);
+	if (bufsiz != 0U) {
+		strncpy(buf, tmp, bufsiz - 1);
+		buf[bufsiz - 1] = '\0';
+	}
+	return(strlen(tmp));
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getnetent.c b/usr/src/lib/libresolv2_joy/common/irs/getnetent.c
new file mode 100644
index 0000000000..0d00699e81
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getnetent.c
@@ -0,0 +1,345 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: getnetent.c,v 1.7 2005/04/27 04:56:25 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#if !defined(__BIND_NOSTATIC)
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "irs_data.h"
+
+/* Definitions */
+
+struct pvt {
+	struct netent	netent;
+	char *		aliases[1];
+	char		name[MAXDNAME + 1];
+};
+
+/* Forward */
+
+static struct net_data *init(void);
+static struct netent   *nw_to_net(struct nwent *, struct net_data *);
+static void		freepvt(struct net_data *);
+static struct netent   *fakeaddr(const char *, int af, struct net_data *);
+
+/* Portability */
+
+#ifndef INADDR_NONE
+# define INADDR_NONE 0xffffffff
+#endif
+
+/* Public */
+
+struct netent *
+getnetent() {
+	struct net_data *net_data = init();
+
+	return (getnetent_p(net_data));
+}
+
+struct netent *
+getnetbyname(const char *name) {
+	struct net_data *net_data = init();
+
+	return (getnetbyname_p(name, net_data));
+}
+
+struct netent *
+getnetbyaddr(unsigned long net, int type) {
+	struct net_data *net_data = init();
+
+	return (getnetbyaddr_p(net, type, net_data));
+}
+
+void
+setnetent(int stayopen) {
+	struct net_data *net_data = init();
+
+	setnetent_p(stayopen, net_data);
+}
+
+
+void
+endnetent() {
+	struct net_data *net_data = init();
+
+	endnetent_p(net_data);
+}
+
+/* Shared private. */
+
+struct netent *
+getnetent_p(struct net_data *net_data) {
+	struct irs_nw *nw;
+
+	if (!net_data || !(nw = net_data->nw))
+		return (NULL);
+	net_data->nww_last = (*nw->next)(nw);
+	net_data->nw_last = nw_to_net(net_data->nww_last, net_data);
+	return (net_data->nw_last);
+}
+
+struct netent *
+getnetbyname_p(const char *name, struct net_data *net_data) {
+	struct irs_nw *nw;
+	struct netent *np;
+	char **nap;
+
+	if (!net_data || !(nw = net_data->nw))
+		return (NULL);
+	if (net_data->nw_stayopen && net_data->nw_last) {
+		if (!strcmp(net_data->nw_last->n_name, name))
+			return (net_data->nw_last);
+		for (nap = net_data->nw_last->n_aliases; nap && *nap; nap++)
+			if (!strcmp(name, *nap))
+				return (net_data->nw_last);
+	}
+	if ((np = fakeaddr(name, AF_INET, net_data)) != NULL)
+		return (np);
+	net_data->nww_last = (*nw->byname)(nw, name, AF_INET);
+	net_data->nw_last = nw_to_net(net_data->nww_last, net_data);
+	if (!net_data->nw_stayopen)
+		endnetent();
+	return (net_data->nw_last);
+}
+
+struct netent *
+getnetbyaddr_p(unsigned long net, int type, struct net_data *net_data) {
+	struct irs_nw *nw;
+	u_char addr[4];
+	int bits;
+
+	if (!net_data || !(nw = net_data->nw))
+		return (NULL);
+	if (net_data->nw_stayopen && net_data->nw_last)
+		if (type == net_data->nw_last->n_addrtype &&
+		    net == net_data->nw_last->n_net)
+			return (net_data->nw_last);
+
+	/* cannonize net(host order) */
+	if (net < 256UL) {
+		net <<= 24;
+		bits = 8;
+	} else if (net < 65536UL) {
+		net <<= 16;
+		bits = 16;
+	} else if (net < 16777216UL) {
+		net <<= 8;
+		bits = 24;
+	} else
+		bits = 32;
+
+	/* convert to net order */
+	addr[0] = (0xFF000000 & net) >> 24;
+	addr[1] = (0x00FF0000 & net) >> 16;
+	addr[2] = (0x0000FF00 & net) >> 8;
+	addr[3] = (0x000000FF & net);
+
+	/* reduce bits to as close to natural number as possible */
+	if ((bits == 32) && (addr[0] < 224) && (addr[3] == 0)) {
+		if ((addr[0] < 192) && (addr[2] == 0)) {
+			if ((addr[0] < 128) && (addr[1] == 0))
+				bits = 8;
+			else
+				bits = 16;
+		} else {
+			bits = 24;
+		}
+	}
+
+	net_data->nww_last = (*nw->byaddr)(nw, addr, bits, AF_INET);
+	net_data->nw_last = nw_to_net(net_data->nww_last, net_data);
+	if (!net_data->nw_stayopen)
+		endnetent();
+	return (net_data->nw_last);
+}
+
+
+
+
+void
+setnetent_p(int stayopen, struct net_data *net_data) {
+	struct irs_nw *nw;
+
+	if (!net_data || !(nw = net_data->nw))
+		return;
+	freepvt(net_data);
+	(*nw->rewind)(nw);
+	net_data->nw_stayopen = (stayopen != 0);
+	if (stayopen == 0)
+		net_data_minimize(net_data);
+}
+
+void
+endnetent_p(struct net_data *net_data) {
+	struct irs_nw *nw;
+
+	if ((net_data != NULL) && ((nw	= net_data->nw) != NULL))
+		(*nw->minimize)(nw);
+}
+
+/* Private */
+
+static struct net_data *
+init() {
+	struct net_data *net_data;
+
+	if (!(net_data = net_data_init(NULL)))
+		goto error;
+	if (!net_data->nw) {
+		net_data->nw = (*net_data->irs->nw_map)(net_data->irs);
+
+		if (!net_data->nw || !net_data->res) {
+ error:		
+			errno = EIO;
+			return (NULL);
+		}
+		(*net_data->nw->res_set)(net_data->nw, net_data->res, NULL);
+	}
+	
+	return (net_data);
+}
+
+static void
+freepvt(struct net_data *net_data) {
+	if (net_data->nw_data) {
+		free(net_data->nw_data);
+		net_data->nw_data = NULL;
+	}
+}
+
+static struct netent *
+fakeaddr(const char *name, int af, struct net_data *net_data) {
+	struct pvt *pvt;
+	const char *cp;
+	u_long tmp;
+
+	if (af != AF_INET) {
+		/* XXX should support IPv6 some day */
+		errno = EAFNOSUPPORT;
+		RES_SET_H_ERRNO(net_data->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	if (!isascii((unsigned char)(name[0])) ||
+	    !isdigit((unsigned char)(name[0])))
+		return (NULL);
+	for (cp = name; *cp; ++cp)
+		if (!isascii(*cp) || (!isdigit((unsigned char)*cp) && *cp != '.'))
+			return (NULL);
+	if (*--cp == '.')
+		return (NULL);
+
+	/* All-numeric, no dot at the end. */
+
+	tmp = inet_network(name);
+	if (tmp == INADDR_NONE) {
+		RES_SET_H_ERRNO(net_data->res, HOST_NOT_FOUND);
+		return (NULL);
+	}
+
+	/* Valid network number specified.
+	 * Fake up a netent as if we'd actually
+	 * done a lookup.
+	 */
+	freepvt(net_data);
+	net_data->nw_data = malloc(sizeof (struct pvt));
+	if (!net_data->nw_data) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(net_data->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	pvt = net_data->nw_data;
+
+	strncpy(pvt->name, name, MAXDNAME);
+	pvt->name[MAXDNAME] = '\0';
+	pvt->netent.n_name = pvt->name;
+	pvt->netent.n_addrtype = AF_INET;
+	pvt->netent.n_aliases = pvt->aliases;
+	pvt->aliases[0] = NULL;
+	pvt->netent.n_net = tmp;
+
+	return (&pvt->netent);
+}
+
+static struct netent *
+nw_to_net(struct nwent *nwent, struct net_data *net_data) {
+	struct pvt *pvt;
+	u_long addr = 0;
+	int i;
+	int msbyte;
+
+	if (!nwent || nwent->n_addrtype != AF_INET)
+		return (NULL);
+	freepvt(net_data);
+	net_data->nw_data = malloc(sizeof (struct pvt));
+	if (!net_data->nw_data) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(net_data->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	pvt = net_data->nw_data;
+	pvt->netent.n_name = nwent->n_name;
+	pvt->netent.n_aliases = nwent->n_aliases;
+	pvt->netent.n_addrtype = nwent->n_addrtype;
+
+/*%
+ * What this code does: Converts net addresses from network to host form.
+ *
+ * msbyte: the index of the most significant byte in the n_addr array.
+ *
+ * Shift bytes in significant order into addr. When all signicant
+ * bytes are in, zero out bits in the LSB that are not part of the network.
+ */
+	msbyte = nwent->n_length / 8 +
+		((nwent->n_length % 8) != 0 ? 1 : 0) - 1;
+	for (i = 0; i <= msbyte; i++)
+		addr = (addr << 8) | ((unsigned char *)nwent->n_addr)[i];
+	i = (32 - nwent->n_length) % 8;
+	if (i != 0)
+		addr &= ~((1 << (i + 1)) - 1);
+	pvt->netent.n_net = addr;
+	return (&pvt->netent);
+}
+
+#endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getnetent_r.c b/usr/src/lib/libresolv2_joy/common/irs/getnetent_r.c
new file mode 100644
index 0000000000..9fb52bc394
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getnetent_r.c
@@ -0,0 +1,234 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: getnetent_r.c,v 1.6 2005/09/03 12:41:38 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <port_before.h>
+#if !defined(_REENTRANT) || !defined(DO_PTHREADS)
+	static int getnetent_r_not_required = 0;
+#else
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <sys/param.h>
+#include <port_after.h>
+
+#ifdef NET_R_RETURN
+
+static NET_R_RETURN 
+copy_netent(struct netent *, struct netent *, NET_R_COPY_ARGS);
+
+NET_R_RETURN
+getnetbyname_r(const char *name,  struct netent *nptr, NET_R_ARGS) {
+	struct netent *ne = getnetbyname(name);
+#ifdef NET_R_SETANSWER
+	int n = 0;
+
+	if (ne == NULL || (n = copy_netent(ne, nptr, NET_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = ne;
+	if (ne == NULL)
+		*h_errnop = h_errno;
+	return (n);
+#else
+	if (ne == NULL)
+		return (NET_R_BAD);
+
+	return (copy_netent(ne, nptr, NET_R_COPY));
+#endif
+}
+
+#ifndef GETNETBYADDR_ADDR_T
+#define GETNETBYADDR_ADDR_T long
+#endif
+NET_R_RETURN
+getnetbyaddr_r(GETNETBYADDR_ADDR_T addr, int type, struct netent *nptr, NET_R_ARGS) {
+	struct netent *ne = getnetbyaddr(addr, type);
+#ifdef NET_R_SETANSWER
+	int n = 0;
+
+	if (ne == NULL || (n = copy_netent(ne, nptr, NET_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = ne;
+	if (ne == NULL)
+		*h_errnop = h_errno;
+	return (n);
+#else
+
+	if (ne == NULL)
+		return (NET_R_BAD);
+
+	return (copy_netent(ne, nptr, NET_R_COPY));
+#endif
+}
+
+/*%
+ *	These assume a single context is in operation per thread.
+ *	If this is not the case we will need to call irs directly
+ *	rather than through the base functions.
+ */
+
+NET_R_RETURN
+getnetent_r(struct netent *nptr, NET_R_ARGS) {
+	struct netent *ne = getnetent();
+#ifdef NET_R_SETANSWER
+	int n = 0;
+
+	if (ne == NULL || (n = copy_netent(ne, nptr, NET_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = ne;
+	if (ne == NULL)
+		*h_errnop = h_errno;
+	return (n);
+#else
+
+	if (ne == NULL)
+		return (NET_R_BAD);
+
+	return (copy_netent(ne, nptr, NET_R_COPY));
+#endif
+}
+
+NET_R_SET_RETURN
+#ifdef NET_R_ENT_ARGS
+setnetent_r(int stay_open, NET_R_ENT_ARGS)
+#else
+setnetent_r(int stay_open)
+#endif
+{
+#ifdef NET_R_ENT_ARGS
+	UNUSED(ndptr);
+#endif
+	setnetent(stay_open);
+#ifdef NET_R_SET_RESULT
+	return (NET_R_SET_RESULT);
+#endif
+}
+
+NET_R_END_RETURN
+#ifdef NET_R_ENT_ARGS
+endnetent_r(NET_R_ENT_ARGS)
+#else
+endnetent_r()
+#endif
+{
+#ifdef NET_R_ENT_ARGS
+	UNUSED(ndptr);
+#endif
+	endnetent();
+	NET_R_END_RESULT(NET_R_OK);
+}
+
+/* Private */
+
+#ifndef NETENT_DATA
+static NET_R_RETURN
+copy_netent(struct netent *ne, struct netent *nptr, NET_R_COPY_ARGS) {
+	char *cp;
+	int i, n;
+	int numptr, len;
+
+	/* Find out the amount of space required to store the answer. */
+	numptr = 1; /*%< NULL ptr */
+	len = (char *)ALIGN(buf) - buf;
+	for (i = 0; ne->n_aliases[i]; i++, numptr++) {
+		len += strlen(ne->n_aliases[i]) + 1;
+	}
+	len += strlen(ne->n_name) + 1;
+	len += numptr * sizeof(char*);
+	
+	if (len > (int)buflen) {
+		errno = ERANGE;
+		return (NET_R_BAD);
+	}
+
+	/* copy net value and type */
+	nptr->n_addrtype = ne->n_addrtype;
+	nptr->n_net = ne->n_net;
+
+	cp = (char *)ALIGN(buf) + numptr * sizeof(char *);
+
+	/* copy official name */
+	n = strlen(ne->n_name) + 1;
+	strcpy(cp, ne->n_name);
+	nptr->n_name = cp;
+	cp += n;
+
+	/* copy aliases */
+	nptr->n_aliases = (char **)ALIGN(buf);
+	for (i = 0 ; ne->n_aliases[i]; i++) {
+		n = strlen(ne->n_aliases[i]) + 1;
+		strcpy(cp, ne->n_aliases[i]);
+		nptr->n_aliases[i] = cp;
+		cp += n;
+	}
+	nptr->n_aliases[i] = NULL;
+
+	return (NET_R_OK);
+}
+#else /* !NETENT_DATA */
+static int
+copy_netent(struct netent *ne, struct netent *nptr, NET_R_COPY_ARGS) {
+	char *cp, *eob;
+	int i, n;
+
+	/* copy net value and type */
+	nptr->n_addrtype = ne->n_addrtype;
+	nptr->n_net = ne->n_net;
+
+	/* copy official name */
+	cp = ndptr->line;
+	eob = ndptr->line + sizeof(ndptr->line);
+	if ((n = strlen(ne->n_name) + 1) < (eob - cp)) {
+		strcpy(cp, ne->n_name);
+		nptr->n_name = cp;
+		cp += n;
+	} else {
+		return (-1);
+	}
+
+	/* copy aliases */
+	i = 0;
+	nptr->n_aliases = ndptr->net_aliases;
+	while (ne->n_aliases[i] && i < (_MAXALIASES-1)) {
+		if ((n = strlen(ne->n_aliases[i]) + 1) < (eob - cp)) {
+			strcpy(cp, ne->n_aliases[i]);
+			nptr->n_aliases[i] = cp;
+			cp += n;
+		} else {
+			break;
+		}
+		i++;
+	}
+	nptr->n_aliases[i] = NULL;
+
+	return (NET_R_OK);
+}
+#endif /* !NETENT_DATA */
+#else /* NET_R_RETURN */
+	static int getnetent_r_unknown_system = 0;
+#endif /* NET_R_RETURN */
+#endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getnetgrent.c b/usr/src/lib/libresolv2_joy/common/irs/getnetgrent.c
new file mode 100644
index 0000000000..40b3e5a8ad
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getnetgrent.c
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1996-1999, 2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: getnetgrent.c,v 1.6 2008/11/14 02:36:51 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* Imports */
+
+#include "port_before.h"
+
+#if !defined(__BIND_NOSTATIC)
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_data.h"
+
+/* Forward */
+
+static struct net_data *init(void);
+
+
+/* Public */
+
+#ifndef SETNETGRENT_ARGS
+#define SETNETGRENT_ARGS const char *netgroup
+#endif
+void
+setnetgrent(SETNETGRENT_ARGS) {
+	struct net_data *net_data = init();
+
+	setnetgrent_p(netgroup, net_data);
+}
+
+void
+endnetgrent(void) {
+	struct net_data *net_data = init();
+
+	endnetgrent_p(net_data);
+}
+
+#ifndef INNETGR_ARGS
+#define INNETGR_ARGS const char *netgroup, const char *host, \
+		     const char *user, const char *domain
+#endif
+int
+innetgr(INNETGR_ARGS) {
+	struct net_data *net_data = init();
+
+	return (innetgr_p(netgroup, host, user, domain, net_data));
+}
+
+int
+getnetgrent(NGR_R_CONST char **host, NGR_R_CONST char **user,
+	    NGR_R_CONST char **domain)
+{
+	struct net_data *net_data = init();
+	const char *ch, *cu, *cd;
+	int ret;
+
+	ret = getnetgrent_p(&ch, &cu, &cd, net_data);
+	if (ret != 1)
+		return (ret);
+
+	DE_CONST(ch, *host);
+	DE_CONST(cu, *user);
+	DE_CONST(cd, *domain);
+	return (ret);
+}
+
+/* Shared private. */
+
+void
+setnetgrent_p(const char *netgroup, struct net_data *net_data) {
+	struct irs_ng *ng;
+
+	if ((net_data != NULL) && ((ng = net_data->ng) != NULL))
+		(*ng->rewind)(ng, netgroup);
+}
+
+void
+endnetgrent_p(struct net_data *net_data) {
+	struct irs_ng *ng;
+
+	if (!net_data)
+		return;
+	if ((ng = net_data->ng) != NULL)
+		(*ng->close)(ng);
+	net_data->ng = NULL;
+}
+
+int
+innetgr_p(const char *netgroup, const char *host,
+	  const char *user, const char *domain,
+	  struct net_data *net_data) {
+	struct irs_ng *ng;
+
+	if (!net_data || !(ng = net_data->ng))
+		return (0);
+	return ((*ng->test)(ng, netgroup, host, user, domain));
+}
+
+int
+getnetgrent_p(const char **host, const char **user, const char **domain,
+	      struct net_data *net_data ) {
+	struct irs_ng *ng;
+
+	if (!net_data || !(ng = net_data->ng))
+		return (0);
+	return ((*ng->next)(ng, host, user, domain));
+}
+
+/* Private */
+
+static struct net_data *
+init(void) {
+	struct net_data *net_data;
+
+	if (!(net_data = net_data_init(NULL)))
+		goto error;
+	if (!net_data->ng) {
+		net_data->ng = (*net_data->irs->ng_map)(net_data->irs);
+		if (!net_data->ng) {
+  error:
+			errno = EIO;
+			return (NULL);
+		}
+	}
+
+	return (net_data);
+}
+
+#endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getnetgrent_r.c b/usr/src/lib/libresolv2_joy/common/irs/getnetgrent_r.c
new file mode 100644
index 0000000000..aa8810320d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getnetgrent_r.c
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1998, 1999, 2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: getnetgrent_r.c,v 1.14 2008/11/14 02:36:51 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <port_before.h>
+#if !defined(_REENTRANT) || !defined(DO_PTHREADS)
+	static int getnetgrent_r_not_required = 0;
+#else
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <stdlib.h>
+#include <port_after.h>
+
+#ifdef NGR_R_RETURN
+#ifndef NGR_R_PRIVATE
+#define NGR_R_PRIVATE 0
+#endif
+
+static NGR_R_RETURN
+copy_protoent(NGR_R_CONST char **, NGR_R_CONST char **, NGR_R_CONST char **,
+	      const char *, const char *, const char *, NGR_R_COPY_ARGS);
+
+NGR_R_RETURN
+innetgr_r(const char *netgroup, const char *host, const char *user,
+	  const char *domain) {
+	char *ng, *ho, *us, *dom;
+
+	DE_CONST(netgroup, ng);
+	DE_CONST(host, ho);
+	DE_CONST(user, us);
+	DE_CONST(domain, dom);
+
+	return (innetgr(ng, ho, us, dom));
+}
+
+/*%
+ *	These assume a single context is in operation per thread.
+ *	If this is not the case we will need to call irs directly
+ *	rather than through the base functions.
+ */
+
+NGR_R_RETURN
+getnetgrent_r(NGR_R_CONST char **machinep, NGR_R_CONST char **userp,
+	      NGR_R_CONST char **domainp, NGR_R_ARGS)
+{
+	NGR_R_CONST char *mp, *up, *dp;
+	int res = getnetgrent(&mp, &up, &dp);
+
+	if (res != 1)
+		return (res);
+
+	return (copy_protoent(machinep, userp, domainp,
+				mp, up, dp, NGR_R_COPY));
+}
+
+#if NGR_R_PRIVATE == 2
+struct private {
+	char *buf;
+};
+
+#endif
+NGR_R_SET_RETURN
+#ifdef NGR_R_SET_ARGS
+setnetgrent_r(NGR_R_SET_CONST char *netgroup, NGR_R_SET_ARGS)
+#else
+setnetgrent_r(NGR_R_SET_CONST char *netgroup)
+#endif
+{
+#if NGR_R_PRIVATE == 2
+	struct private *p;
+#endif
+	char *tmp;
+#if defined(NGR_R_SET_ARGS) && NGR_R_PRIVATE == 0
+	UNUSED(buf);
+	UNUSED(buflen);
+#endif
+
+	DE_CONST(netgroup, tmp);
+	setnetgrent(tmp);
+
+#if NGR_R_PRIVATE == 1
+	*buf = NULL;
+#elif NGR_R_PRIVATE == 2
+	*buf = p = malloc(sizeof(struct private));
+	if (p == NULL)
+#ifdef NGR_R_SET_RESULT
+		return (NGR_R_BAD);
+#else
+		return;
+#endif
+	p->buf = NULL;
+#endif
+#ifdef NGR_R_SET_RESULT
+	return (NGR_R_SET_RESULT);
+#endif
+}
+
+NGR_R_END_RETURN
+#ifdef NGR_R_END_ARGS
+endnetgrent_r(NGR_R_END_ARGS)
+#else
+endnetgrent_r(void)
+#endif
+{
+#if NGR_R_PRIVATE == 2
+	struct private *p = buf;
+#endif
+#if defined(NGR_R_SET_ARGS) && NGR_R_PRIVATE == 0
+	UNUSED(buf);
+	UNUSED(buflen);
+#endif
+
+	endnetgrent();
+#if NGR_R_PRIVATE == 1
+	if (*buf != NULL)
+		free(*buf);
+	*buf = NULL;
+#elif NGR_R_PRIVATE == 2
+	if (p->buf != NULL)
+		free(p->buf);
+	free(p);
+#endif
+	NGR_R_END_RESULT(NGR_R_OK);
+}
+
+/* Private */
+
+static int
+copy_protoent(NGR_R_CONST char **machinep, NGR_R_CONST char **userp,
+	      NGR_R_CONST char **domainp, const char *mp, const char *up,
+	      const char *dp, NGR_R_COPY_ARGS)
+{
+#if NGR_R_PRIVATE == 2
+	struct private *p = buf;
+#endif
+	char *cp;
+	int n;
+	int len;
+
+	/* Find out the amount of space required to store the answer. */
+	len = 0;
+	if (mp != NULL) len += strlen(mp) + 1;
+	if (up != NULL) len += strlen(up) + 1;
+	if (dp != NULL) len += strlen(dp) + 1;
+
+#if NGR_R_PRIVATE == 1
+	if (*buf != NULL)
+		free(*buf);
+	*buf = malloc(len);
+	if (*buf == NULL)
+		return(NGR_R_BAD);
+	cp = *buf;
+#elif NGR_R_PRIVATE == 2
+	if (p->buf)
+		free(p->buf);
+	p->buf = malloc(len);
+	if (p->buf == NULL)
+		return(NGR_R_BAD);
+	cp = p->buf;
+#else
+	if (len > (int)buflen) {
+		errno = ERANGE;
+		return (NGR_R_BAD);
+	}
+	cp = buf;
+#endif
+
+	if (mp != NULL) {
+		n = strlen(mp) + 1;
+		strcpy(cp, mp);
+		*machinep = cp;
+		cp += n;
+	} else
+		*machinep = NULL;
+
+	if (up != NULL) {
+		n = strlen(up) + 1;
+		strcpy(cp, up);
+		*userp = cp;
+		cp += n;
+	} else
+		*userp = NULL;
+
+	if (dp != NULL) {
+		n = strlen(dp) + 1;
+		strcpy(cp, dp);
+		*domainp = cp;
+		cp += n;
+	} else
+		*domainp = NULL;
+
+	return (NGR_R_OK);
+}
+#else /* NGR_R_RETURN */
+	static int getnetgrent_r_unknown_system = 0;
+#endif /* NGR_R_RETURN */
+#endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getprotoent.c b/usr/src/lib/libresolv2_joy/common/irs/getprotoent.c
new file mode 100644
index 0000000000..32a1040916
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getprotoent.c
@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: getprotoent.c,v 1.4 2005/04/27 04:56:26 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#if !defined(__BIND_NOSTATIC)
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_data.h"
+
+/* Forward */
+
+static struct net_data *init(void);
+
+/* Public */
+
+struct protoent *
+getprotoent() {
+	struct net_data *net_data = init();
+
+	return (getprotoent_p(net_data));
+}
+
+struct protoent *
+getprotobyname(const char *name) {
+	struct net_data *net_data = init();
+
+	return (getprotobyname_p(name, net_data));
+}
+
+struct protoent *
+getprotobynumber(int proto) {
+	struct net_data *net_data = init();
+
+	return (getprotobynumber_p(proto, net_data));
+}
+
+void
+setprotoent(int stayopen) {
+	struct net_data *net_data = init();
+
+	setprotoent_p(stayopen, net_data);
+}
+
+void
+endprotoent() {
+	struct net_data *net_data = init();
+
+	endprotoent_p(net_data);
+}
+
+/* Shared private. */
+
+struct protoent *
+getprotoent_p(struct net_data *net_data) {
+	struct irs_pr *pr;
+
+	if (!net_data || !(pr = net_data->pr))
+		return (NULL);
+	net_data->pr_last = (*pr->next)(pr);
+	return (net_data->pr_last);
+}
+
+struct protoent *
+getprotobyname_p(const char *name, struct net_data *net_data) {
+	struct irs_pr *pr;
+	char **pap;
+
+	if (!net_data || !(pr = net_data->pr))
+		return (NULL);
+	if (net_data->pr_stayopen && net_data->pr_last) {
+		if (!strcmp(net_data->pr_last->p_name, name))
+			return (net_data->pr_last);
+		for (pap = net_data->pr_last->p_aliases; pap && *pap; pap++)
+			if (!strcmp(name, *pap))
+				return (net_data->pr_last);
+	}
+	net_data->pr_last = (*pr->byname)(pr, name);
+	if (!net_data->pr_stayopen)
+		endprotoent();
+	return (net_data->pr_last);
+}
+
+struct protoent *
+getprotobynumber_p(int proto, struct net_data *net_data) {
+	struct irs_pr *pr;
+
+	if (!net_data || !(pr = net_data->pr))
+		return (NULL);
+	if (net_data->pr_stayopen && net_data->pr_last)
+		if (net_data->pr_last->p_proto == proto)
+			return (net_data->pr_last);
+	net_data->pr_last = (*pr->bynumber)(pr, proto);
+	if (!net_data->pr_stayopen)
+		endprotoent();
+	return (net_data->pr_last);
+}
+
+void
+setprotoent_p(int stayopen, struct net_data *net_data) {
+	struct irs_pr *pr;
+
+	if (!net_data || !(pr = net_data->pr))
+		return;
+	(*pr->rewind)(pr);
+	net_data->pr_stayopen = (stayopen != 0);
+	if (stayopen == 0)
+		net_data_minimize(net_data);
+}
+
+void
+endprotoent_p(struct net_data *net_data) {
+	struct irs_pr *pr;
+
+	if ((net_data != NULL) && ((pr = net_data->pr) != NULL))
+		(*pr->minimize)(pr);
+}
+
+/* Private */
+
+static struct net_data *
+init() {
+	struct net_data *net_data;
+
+	if (!(net_data = net_data_init(NULL)))
+		goto error;
+	if (!net_data->pr) {
+		net_data->pr = (*net_data->irs->pr_map)(net_data->irs);
+
+		if (!net_data->pr || !net_data->res) {
+ error:		
+			errno = EIO;
+			return (NULL);
+		}
+		(*net_data->pr->res_set)(net_data->pr, net_data->res, NULL);
+	}
+	
+	return (net_data);
+}
+
+#endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getprotoent_r.c b/usr/src/lib/libresolv2_joy/common/irs/getprotoent_r.c
new file mode 100644
index 0000000000..d5d9ae53b6
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getprotoent_r.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: getprotoent_r.c,v 1.6 2006/08/01 01:14:16 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <port_before.h>
+#if !defined(_REENTRANT) || !defined(DO_PTHREADS)
+	static int getprotoent_r_not_required = 0;
+#else
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <port_after.h>
+
+#ifdef PROTO_R_RETURN
+
+static PROTO_R_RETURN 
+copy_protoent(struct protoent *, struct protoent *, PROTO_R_COPY_ARGS);
+
+PROTO_R_RETURN
+getprotobyname_r(const char *name, struct protoent *pptr, PROTO_R_ARGS) {
+	struct protoent *pe = getprotobyname(name);
+#ifdef PROTO_R_SETANSWER
+	int n = 0;
+
+	if (pe == NULL || (n = copy_protoent(pe, pptr, PROTO_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = pptr;
+	
+	return (n);
+#else
+	if (pe == NULL)
+		return (PROTO_R_BAD);
+
+	return (copy_protoent(pe, pptr, PROTO_R_COPY));
+#endif
+}
+
+PROTO_R_RETURN
+getprotobynumber_r(int proto, struct protoent *pptr, PROTO_R_ARGS) {
+	struct protoent *pe = getprotobynumber(proto);
+#ifdef PROTO_R_SETANSWER
+	int n = 0;
+
+	if (pe == NULL || (n = copy_protoent(pe, pptr, PROTO_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = pptr;
+	
+	return (n);
+#else
+	if (pe == NULL)
+		return (PROTO_R_BAD);
+
+	return (copy_protoent(pe, pptr, PROTO_R_COPY));
+#endif
+}
+
+/*%
+ *	These assume a single context is in operation per thread.
+ *	If this is not the case we will need to call irs directly
+ *	rather than through the base functions.
+ */
+
+PROTO_R_RETURN
+getprotoent_r(struct protoent *pptr, PROTO_R_ARGS) {
+	struct protoent *pe = getprotoent();
+#ifdef PROTO_R_SETANSWER
+	int n = 0;
+
+	if (pe == NULL || (n = copy_protoent(pe, pptr, PROTO_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = pptr;
+	
+	return (n);
+#else
+	if (pe == NULL)
+		return (PROTO_R_BAD);
+
+	return (copy_protoent(pe, pptr, PROTO_R_COPY));
+#endif
+}
+
+PROTO_R_SET_RETURN
+#ifdef PROTO_R_ENT_ARGS
+setprotoent_r(int stay_open, PROTO_R_ENT_ARGS)
+#else
+setprotoent_r(int stay_open)
+#endif
+{
+#ifdef PROTO_R_ENT_UNUSED
+        PROTO_R_ENT_UNUSED;
+#endif
+	setprotoent(stay_open);
+#ifdef PROTO_R_SET_RESULT
+	return (PROTO_R_SET_RESULT);
+#endif
+}
+
+PROTO_R_END_RETURN
+#ifdef PROTO_R_ENT_ARGS
+endprotoent_r(PROTO_R_ENT_ARGS)
+#else
+endprotoent_r()
+#endif
+{
+#ifdef PROTO_R_ENT_UNUSED
+        PROTO_R_ENT_UNUSED;
+#endif
+	endprotoent();
+	PROTO_R_END_RESULT(PROTO_R_OK);
+}
+
+/* Private */
+
+#ifndef PROTOENT_DATA
+static PROTO_R_RETURN
+copy_protoent(struct protoent *pe, struct protoent *pptr, PROTO_R_COPY_ARGS) {
+	char *cp;
+	int i, n;
+	int numptr, len;
+
+	/* Find out the amount of space required to store the answer. */
+	numptr = 1; /*%< NULL ptr */
+	len = (char *)ALIGN(buf) - buf;
+	for (i = 0; pe->p_aliases[i]; i++, numptr++) {
+		len += strlen(pe->p_aliases[i]) + 1;
+	}
+	len += strlen(pe->p_name) + 1;
+	len += numptr * sizeof(char*);
+	
+	if (len > (int)buflen) {
+		errno = ERANGE;
+		return (PROTO_R_BAD);
+	}
+
+	/* copy protocol value*/
+	pptr->p_proto = pe->p_proto;
+
+	cp = (char *)ALIGN(buf) + numptr * sizeof(char *);
+
+	/* copy official name */
+	n = strlen(pe->p_name) + 1;
+	strcpy(cp, pe->p_name);
+	pptr->p_name = cp;
+	cp += n;
+
+	/* copy aliases */
+	pptr->p_aliases = (char **)ALIGN(buf);
+	for (i = 0 ; pe->p_aliases[i]; i++) {
+		n = strlen(pe->p_aliases[i]) + 1;
+		strcpy(cp, pe->p_aliases[i]);
+		pptr->p_aliases[i] = cp;
+		cp += n;
+	}
+	pptr->p_aliases[i] = NULL;
+
+	return (PROTO_R_OK);
+}
+#else /* !PROTOENT_DATA */
+static int
+copy_protoent(struct protoent *pe, struct protoent *pptr, PROTO_R_COPY_ARGS) {
+	char *cp, *eob;
+	int i, n;
+
+	/* copy protocol value */
+	pptr->p_proto = pe->p_proto;
+
+	/* copy official name */
+	cp = pdptr->line;
+	eob = pdptr->line + sizeof(pdptr->line);
+	if ((n = strlen(pe->p_name) + 1) < (eob - cp)) {
+		strcpy(cp, pe->p_name);
+		pptr->p_name = cp;
+		cp += n;
+	} else {
+		return (-1);
+	}
+
+	/* copy aliases */
+	i = 0;
+	pptr->p_aliases = pdptr->proto_aliases;
+	while (pe->p_aliases[i] && i < (_MAXALIASES-1)) {
+		if ((n = strlen(pe->p_aliases[i]) + 1) < (eob - cp)) {
+			strcpy(cp, pe->p_aliases[i]);
+			pptr->p_aliases[i] = cp;
+			cp += n;
+		} else {
+			break;
+		}
+		i++;
+	}
+	pptr->p_aliases[i] = NULL;
+
+	return (PROTO_R_OK);
+}
+#endif /* PROTOENT_DATA */
+#else /* PROTO_R_RETURN */
+	static int getprotoent_r_unknown_system = 0;
+#endif /* PROTO_R_RETURN */
+#endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getservent.c b/usr/src/lib/libresolv2_joy/common/irs/getservent.c
new file mode 100644
index 0000000000..31af67e659
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getservent.c
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: getservent.c,v 1.4 2005/04/27 04:56:26 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#if !defined(__BIND_NOSTATIC)
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_data.h"
+
+/* Forward */
+
+static struct net_data *init(void);
+
+/* Public */
+
+struct servent *
+getservent(void) {
+	struct net_data *net_data = init();
+
+	return (getservent_p(net_data));
+}
+
+struct servent *
+getservbyname(const char *name, const char *proto) {
+	struct net_data *net_data = init();
+
+	return (getservbyname_p(name, proto, net_data));
+}
+
+struct servent *
+getservbyport(int port, const char *proto) {
+	struct net_data *net_data = init();
+
+	return (getservbyport_p(port, proto, net_data));
+}
+
+void
+setservent(int stayopen) {
+	struct net_data *net_data = init();
+
+	setservent_p(stayopen, net_data);
+}
+
+void
+endservent() {
+	struct net_data *net_data = init();
+
+	endservent_p(net_data);
+}
+
+/* Shared private. */
+
+struct servent *
+getservent_p(struct net_data *net_data) {
+	struct irs_sv *sv;
+
+	if (!net_data || !(sv = net_data->sv))
+		return (NULL);
+	net_data->sv_last = (*sv->next)(sv);
+	return (net_data->sv_last);
+}
+
+struct servent *
+getservbyname_p(const char *name, const char *proto,
+		struct net_data *net_data) {
+	struct irs_sv *sv;
+	char **sap;
+
+	if (!net_data || !(sv = net_data->sv))
+		return (NULL);
+	if (net_data->sv_stayopen && net_data->sv_last)
+		if (!proto || !strcmp(net_data->sv_last->s_proto, proto)) {
+			if (!strcmp(net_data->sv_last->s_name, name))
+				return (net_data->sv_last);
+			for (sap = net_data->sv_last->s_aliases;
+			     sap && *sap; sap++)
+				if (!strcmp(name, *sap))
+					return (net_data->sv_last);
+		}
+	net_data->sv_last = (*sv->byname)(sv, name, proto);
+	if (!net_data->sv_stayopen)
+		endservent();
+	return (net_data->sv_last);
+}
+
+struct servent *
+getservbyport_p(int port, const char *proto, struct net_data *net_data) {
+	struct irs_sv *sv;
+
+	if (!net_data || !(sv = net_data->sv))
+		return (NULL);
+	if (net_data->sv_stayopen && net_data->sv_last)
+		if (port == net_data->sv_last->s_port &&
+		    ( !proto ||
+		     !strcmp(net_data->sv_last->s_proto, proto)))
+			return (net_data->sv_last);
+	net_data->sv_last = (*sv->byport)(sv, port, proto);
+	return (net_data->sv_last);
+}
+
+void
+setservent_p(int stayopen, struct net_data *net_data) {
+	struct irs_sv *sv;
+
+	if (!net_data || !(sv = net_data->sv))
+		return;
+	(*sv->rewind)(sv);
+	net_data->sv_stayopen = (stayopen != 0);
+	if (stayopen == 0)
+		net_data_minimize(net_data);
+}
+
+void
+endservent_p(struct net_data *net_data) {
+	struct irs_sv *sv;
+
+	if ((net_data != NULL) && ((sv = net_data->sv) != NULL))
+		(*sv->minimize)(sv);
+}
+
+/* Private */
+
+static struct net_data *
+init() {
+	struct net_data *net_data;
+
+	if (!(net_data = net_data_init(NULL)))
+		goto error;
+	if (!net_data->sv) {
+		net_data->sv = (*net_data->irs->sv_map)(net_data->irs);
+
+		if (!net_data->sv || !net_data->res) {
+ error:		
+			errno = EIO;
+			return (NULL);
+		}
+		(*net_data->sv->res_set)(net_data->sv, net_data->res, NULL);
+	}
+	
+	return (net_data);
+}
+
+#endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/getservent_r.c b/usr/src/lib/libresolv2_joy/common/irs/getservent_r.c
new file mode 100644
index 0000000000..42d1e46163
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/getservent_r.c
@@ -0,0 +1,242 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: getservent_r.c,v 1.6 2006/08/01 01:14:16 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <port_before.h>
+#if !defined(_REENTRANT) || !defined(DO_PTHREADS)
+	static int getservent_r_not_required = 0;
+#else
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <sys/param.h>
+#include <port_after.h>
+
+#ifdef SERV_R_RETURN
+
+static SERV_R_RETURN 
+copy_servent(struct servent *, struct servent *, SERV_R_COPY_ARGS);
+
+SERV_R_RETURN
+getservbyname_r(const char *name, const char *proto,
+		struct servent *sptr, SERV_R_ARGS) {
+	struct servent *se = getservbyname(name, proto);
+#ifdef SERV_R_SETANSWER
+	int n = 0;
+	
+	if (se == NULL || (n = copy_servent(se, sptr, SERV_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = sptr;
+
+	return (n);
+#else
+	if (se == NULL)
+		return (SERV_R_BAD);
+
+	return (copy_servent(se, sptr, SERV_R_COPY));
+#endif
+}
+
+SERV_R_RETURN
+getservbyport_r(int port, const char *proto,
+		struct servent *sptr, SERV_R_ARGS) {
+	struct servent *se = getservbyport(port, proto);
+#ifdef SERV_R_SETANSWER
+	int n = 0;
+	
+	if (se == NULL || (n = copy_servent(se, sptr, SERV_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = sptr;
+
+	return (n);
+#else
+	if (se == NULL)
+		return (SERV_R_BAD);
+
+	return (copy_servent(se, sptr, SERV_R_COPY));
+#endif
+}
+
+/*%
+ *	These assume a single context is in operation per thread.
+ *	If this is not the case we will need to call irs directly
+ *	rather than through the base functions.
+ */
+
+SERV_R_RETURN
+getservent_r(struct servent *sptr, SERV_R_ARGS) {
+	struct servent *se = getservent();
+#ifdef SERV_R_SETANSWER
+	int n = 0;
+	
+	if (se == NULL || (n = copy_servent(se, sptr, SERV_R_COPY)) != 0)
+		*answerp = NULL;
+	else
+		*answerp = sptr;
+
+	return (n);
+#else
+	if (se == NULL)
+		return (SERV_R_BAD);
+
+	return (copy_servent(se, sptr, SERV_R_COPY));
+#endif
+}
+
+SERV_R_SET_RETURN
+#ifdef SERV_R_ENT_ARGS
+setservent_r(int stay_open, SERV_R_ENT_ARGS)
+#else
+setservent_r(int stay_open)
+#endif
+{
+#ifdef SERV_R_ENT_UNUSED
+	SERV_R_ENT_UNUSED;
+#endif
+	setservent(stay_open);
+#ifdef SERV_R_SET_RESULT
+	return (SERV_R_SET_RESULT);
+#endif
+}
+
+SERV_R_END_RETURN
+#ifdef SERV_R_ENT_ARGS
+endservent_r(SERV_R_ENT_ARGS)
+#else
+endservent_r()
+#endif
+{
+#ifdef SERV_R_ENT_UNUSED
+	SERV_R_ENT_UNUSED;
+#endif
+	endservent();
+	SERV_R_END_RESULT(SERV_R_OK);
+}
+
+/* Private */
+
+#ifndef SERVENT_DATA
+static SERV_R_RETURN
+copy_servent(struct servent *se, struct servent *sptr, SERV_R_COPY_ARGS) {
+	char *cp;
+	int i, n;
+	int numptr, len;
+
+	/* Find out the amount of space required to store the answer. */
+	numptr = 1; /*%< NULL ptr */
+	len = (char *)ALIGN(buf) - buf;
+	for (i = 0; se->s_aliases[i]; i++, numptr++) {
+		len += strlen(se->s_aliases[i]) + 1;
+	}
+	len += strlen(se->s_name) + 1;
+	len += strlen(se->s_proto) + 1;
+	len += numptr * sizeof(char*);
+	
+	if (len > (int)buflen) {
+		errno = ERANGE;
+		return (SERV_R_BAD);
+	}
+
+	/* copy port value */
+	sptr->s_port = se->s_port;
+
+	cp = (char *)ALIGN(buf) + numptr * sizeof(char *);
+
+	/* copy official name */
+	n = strlen(se->s_name) + 1;
+	strcpy(cp, se->s_name);
+	sptr->s_name = cp;
+	cp += n;
+
+	/* copy aliases */
+	sptr->s_aliases = (char **)ALIGN(buf);
+	for (i = 0 ; se->s_aliases[i]; i++) {
+		n = strlen(se->s_aliases[i]) + 1;
+		strcpy(cp, se->s_aliases[i]);
+		sptr->s_aliases[i] = cp;
+		cp += n;
+	}
+	sptr->s_aliases[i] = NULL;
+
+	/* copy proto */
+	n = strlen(se->s_proto) + 1;
+	strcpy(cp, se->s_proto);
+	sptr->s_proto = cp;
+	cp += n;
+
+	return (SERV_R_OK);
+}
+#else /* !SERVENT_DATA */
+static int
+copy_servent(struct servent *se, struct servent *sptr, SERV_R_COPY_ARGS) {
+	char *cp, *eob;
+	int i, n;
+
+	/* copy port value */
+	sptr->s_port = se->s_port;
+
+	/* copy official name */
+	cp = sdptr->line;
+	eob = sdptr->line + sizeof(sdptr->line);
+	if ((n = strlen(se->s_name) + 1) < (eob - cp)) {
+		strcpy(cp, se->s_name);
+		sptr->s_name = cp;
+		cp += n;
+	} else {
+		return (-1);
+	}
+
+	/* copy aliases */
+	i = 0;
+	sptr->s_aliases = sdptr->serv_aliases;
+	while (se->s_aliases[i] && i < (_MAXALIASES-1)) {
+		if ((n = strlen(se->s_aliases[i]) + 1) < (eob - cp)) {
+			strcpy(cp, se->s_aliases[i]);
+			sptr->s_aliases[i] = cp;
+			cp += n;
+		} else {
+			break;
+		}
+		i++;
+	}
+	sptr->s_aliases[i] = NULL;
+
+	/* copy proto */
+	if ((n = strlen(se->s_proto) + 1) < (eob - cp)) {
+		strcpy(cp, se->s_proto);
+		sptr->s_proto = cp;
+		cp += n;
+	} else {
+		return (-1);
+	}
+
+	return (SERV_R_OK);
+}
+#endif /* !SERVENT_DATA */
+#else /*SERV_R_RETURN */
+	static int getservent_r_unknown_system = 0;
+#endif /*SERV_R_RETURN */
+#endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/hesiod.c b/usr/src/lib/libresolv2_joy/common/irs/hesiod.c
new file mode 100644
index 0000000000..7641bf80ac
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/hesiod.c
@@ -0,0 +1,505 @@
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: hesiod.c,v 1.7 2005/07/28 06:51:48 marka Exp $";
+#endif
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+/*! \file
+ * \brief
+ * hesiod.c --- the core portion of the hesiod resolver.
+ *
+ * This file is derived from the hesiod library from Project Athena;
+ * It has been extensively rewritten by Theodore Ts'o to have a more
+ * thread-safe interface.
+ * \author
+ * This file is primarily maintained by &lt;tytso@mit.edu&gt; and &lt;ghudson@mit.edu&gt;.
+ */
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "port_after.h"
+
+#include "pathnames.h"
+#include "hesiod.h"
+#include "hesiod_p.h"
+
+/* Forward */
+
+int		hesiod_init(void **context);
+void		hesiod_end(void *context);
+char *		hesiod_to_bind(void *context, const char *name,
+			       const char *type);
+char **		hesiod_resolve(void *context, const char *name,
+			       const char *type);
+void		hesiod_free_list(void *context, char **list);
+
+static int	parse_config_file(struct hesiod_p *ctx, const char *filename);
+static char **	get_txt_records(struct hesiod_p *ctx, int class,
+				const char *name);
+static int	init(struct hesiod_p *ctx);
+
+/* Public */
+
+/*%
+ * This function is called to initialize a hesiod_p.
+ */
+int
+hesiod_init(void **context) {
+	struct hesiod_p *ctx;
+	char *cp;
+
+	ctx = malloc(sizeof(struct hesiod_p));
+	if (ctx == 0) {
+		errno = ENOMEM;
+		return (-1);
+	}
+
+	memset(ctx, 0, sizeof (*ctx));
+
+	if (parse_config_file(ctx, _PATH_HESIOD_CONF) < 0) {
+#ifdef DEF_RHS
+		/*
+		 * Use compiled in defaults.
+		 */
+		ctx->LHS = malloc(strlen(DEF_LHS) + 1);
+		ctx->RHS = malloc(strlen(DEF_RHS) + 1);
+		if (ctx->LHS == NULL || ctx->RHS == NULL) {
+			errno = ENOMEM;
+			goto cleanup;
+		}
+		strcpy(ctx->LHS, DEF_LHS);	/* (checked) */
+		strcpy(ctx->RHS, DEF_RHS);	/* (checked) */
+#else
+		goto cleanup;
+#endif
+	}
+	/*
+	 * The default RHS can be overridden by an environment
+	 * variable.
+	 */
+	if ((cp = getenv("HES_DOMAIN")) != NULL) {
+		size_t RHSlen = strlen(cp) + 2;
+		if (ctx->RHS)
+			free(ctx->RHS);
+		ctx->RHS = malloc(RHSlen);
+		if (!ctx->RHS) {
+			errno = ENOMEM;
+			goto cleanup;
+		}
+		if (cp[0] == '.') {
+			strcpy(ctx->RHS, cp);	/* (checked) */
+		} else {
+			strcpy(ctx->RHS, ".");	/* (checked) */
+			strcat(ctx->RHS, cp);	/* (checked) */
+		}
+	}
+
+	/*
+	 * If there is no default hesiod realm set, we return an
+	 * error.
+	 */
+	if (!ctx->RHS) {
+		errno = ENOEXEC;
+		goto cleanup;
+	}
+	
+#if 0
+	if (res_ninit(ctx->res) < 0)
+		goto cleanup;
+#endif
+
+	*context = ctx;
+	return (0);
+
+ cleanup:
+	hesiod_end(ctx);
+	return (-1);
+}
+
+/*%
+ * This function deallocates the hesiod_p
+ */
+void
+hesiod_end(void *context) {
+	struct hesiod_p *ctx = (struct hesiod_p *) context;
+	int save_errno = errno;
+
+	if (ctx->res)
+		res_nclose(ctx->res);
+	if (ctx->RHS)
+		free(ctx->RHS);
+	if (ctx->LHS)
+		free(ctx->LHS);
+	if (ctx->res && ctx->free_res)
+		(*ctx->free_res)(ctx->res);
+	free(ctx);
+	errno = save_errno;
+}
+
+/*%
+ * This function takes a hesiod (name, type) and returns a DNS
+ * name which is to be resolved.
+ */
+char *
+hesiod_to_bind(void *context, const char *name, const char *type) {
+	struct hesiod_p *ctx = (struct hesiod_p *) context;
+	char *bindname;
+	char **rhs_list = NULL;
+	const char *RHS, *cp;
+
+	/* Decide what our RHS is, and set cp to the end of the actual name. */
+	if ((cp = strchr(name, '@')) != NULL) {
+		if (strchr(cp + 1, '.'))
+			RHS = cp + 1;
+		else if ((rhs_list = hesiod_resolve(context, cp + 1,
+		    "rhs-extension")) != NULL)
+			RHS = *rhs_list;
+		else {
+			errno = ENOENT;
+			return (NULL);
+		}
+	} else {
+		RHS = ctx->RHS;
+		cp = name + strlen(name);
+	}
+
+	/*
+	 * Allocate the space we need, including up to three periods and
+	 * the terminating NUL.
+	 */
+	if ((bindname = malloc((cp - name) + strlen(type) + strlen(RHS) +
+	    (ctx->LHS ? strlen(ctx->LHS) : 0) + 4)) == NULL) {
+		errno = ENOMEM;
+		if (rhs_list)
+			hesiod_free_list(context, rhs_list);
+		return NULL;
+	}
+
+	/* Now put together the DNS name. */
+	memcpy(bindname, name, cp - name);
+	bindname[cp - name] = '\0';
+	strcat(bindname, ".");
+	strcat(bindname, type);
+	if (ctx->LHS) {
+		if (ctx->LHS[0] != '.')
+			strcat(bindname, ".");
+		strcat(bindname, ctx->LHS);
+	}
+	if (RHS[0] != '.')
+		strcat(bindname, ".");
+	strcat(bindname, RHS);
+
+	if (rhs_list)
+		hesiod_free_list(context, rhs_list);
+
+	return (bindname);
+}
+
+/*%
+ * This is the core function.  Given a hesiod (name, type), it
+ * returns an array of strings returned by the resolver.
+ */
+char **
+hesiod_resolve(void *context, const char *name, const char *type) {
+	struct hesiod_p *ctx = (struct hesiod_p *) context;
+	char *bindname = hesiod_to_bind(context, name, type);
+	char **retvec;
+
+	if (bindname == NULL)
+		return (NULL);
+	if (init(ctx) == -1) {
+		free(bindname);
+		return (NULL);
+	}
+
+	if ((retvec = get_txt_records(ctx, C_IN, bindname))) {
+		free(bindname);
+		return (retvec);
+	}
+	
+	if (errno != ENOENT)
+		return (NULL);
+
+	retvec = get_txt_records(ctx, C_HS, bindname);
+	free(bindname);
+	return (retvec);
+}
+
+void
+hesiod_free_list(void *context, char **list) {
+	char **p;
+
+	UNUSED(context);
+
+	for (p = list; *p; p++)
+		free(*p);
+	free(list);
+}
+
+/*%
+ * This function parses the /etc/hesiod.conf file
+ */
+static int
+parse_config_file(struct hesiod_p *ctx, const char *filename) {
+	char *key, *data, *cp, **cpp;
+	char buf[MAXDNAME+7];
+	FILE *fp;
+
+	/*
+	 * Clear the existing configuration variable, just in case
+	 * they're set.
+	 */
+	if (ctx->RHS)
+		free(ctx->RHS);
+	if (ctx->LHS)
+		free(ctx->LHS);
+	ctx->RHS = ctx->LHS = 0;
+
+	/*
+	 * Now open and parse the file...
+	 */
+	if (!(fp = fopen(filename, "r")))
+		return (-1);
+	
+	while (fgets(buf, sizeof(buf), fp) != NULL) {
+		cp = buf;
+		if (*cp == '#' || *cp == '\n' || *cp == '\r')
+			continue;
+		while(*cp == ' ' || *cp == '\t')
+			cp++;
+		key = cp;
+		while(*cp != ' ' && *cp != '\t' && *cp != '=')
+			cp++;
+		*cp++ = '\0';
+		
+		while(*cp == ' ' || *cp == '\t' || *cp == '=')
+			cp++;
+		data = cp;
+		while(*cp != ' ' && *cp != '\n' && *cp != '\r')
+			cp++;
+		*cp++ = '\0';
+
+		if (strcmp(key, "lhs") == 0)
+			cpp = &ctx->LHS;
+		else if (strcmp(key, "rhs") == 0)
+			cpp = &ctx->RHS;
+		else
+			continue;
+
+		*cpp = malloc(strlen(data) + 1);
+		if (!*cpp) {
+			errno = ENOMEM;
+			goto cleanup;
+		}
+		strcpy(*cpp, data);
+	}
+	fclose(fp);
+	return (0);
+	
+ cleanup:
+	fclose(fp);
+	if (ctx->RHS)
+		free(ctx->RHS);
+	if (ctx->LHS)
+		free(ctx->LHS);
+	ctx->RHS = ctx->LHS = 0;
+	return (-1);
+}
+
+/*%
+ * Given a DNS class and a DNS name, do a lookup for TXT records, and
+ * return a list of them.
+ */
+static char **
+get_txt_records(struct hesiod_p *ctx, int class, const char *name) {
+	struct {
+		int type;		/*%< RR type */
+		int class;		/*%< RR class */
+		int dlen;		/*%< len of data section */
+		u_char *data;		/*%< pointer to data */
+	} rr;
+	HEADER *hp;
+	u_char qbuf[MAX_HESRESP], abuf[MAX_HESRESP];
+	u_char *cp, *erdata, *eom;
+	char *dst, *edst, **list;
+	int ancount, qdcount;
+	int i, j, n, skip;
+
+	/*
+	 * Construct the query and send it.
+	 */
+	n = res_nmkquery(ctx->res, QUERY, name, class, T_TXT, NULL, 0,
+			 NULL, qbuf, MAX_HESRESP);
+	if (n < 0) {
+		errno = EMSGSIZE;
+		return (NULL);
+	}
+	n = res_nsend(ctx->res, qbuf, n, abuf, MAX_HESRESP);
+	if (n < 0) {
+		errno = ECONNREFUSED;
+		return (NULL);
+	}
+	if (n < HFIXEDSZ) {
+		errno = EMSGSIZE;
+		return (NULL);
+	}
+
+	/*
+	 * OK, parse the result.
+	 */
+	hp = (HEADER *) abuf;
+	ancount = ntohs(hp->ancount);
+	qdcount = ntohs(hp->qdcount);
+	cp = abuf + sizeof(HEADER);
+	eom = abuf + n;
+
+	/* Skip query, trying to get to the answer section which follows. */
+	for (i = 0; i < qdcount; i++) {
+		skip = dn_skipname(cp, eom);
+		if (skip < 0 || cp + skip + QFIXEDSZ > eom) {
+			errno = EMSGSIZE;
+			return (NULL);
+		}
+		cp += skip + QFIXEDSZ;
+	}
+
+	list = malloc((ancount + 1) * sizeof(char *));
+	if (!list) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	j = 0;
+	for (i = 0; i < ancount; i++) {
+		skip = dn_skipname(cp, eom);
+		if (skip < 0) {
+			errno = EMSGSIZE;
+			goto cleanup;
+		}
+		cp += skip;
+		if (cp + 3 * INT16SZ + INT32SZ > eom) {
+			errno = EMSGSIZE;
+			goto cleanup;
+		}
+		rr.type = ns_get16(cp);
+		cp += INT16SZ;
+		rr.class = ns_get16(cp);
+		cp += INT16SZ + INT32SZ;	/*%< skip the ttl, too */
+		rr.dlen = ns_get16(cp);
+		cp += INT16SZ;
+		if (cp + rr.dlen > eom) {
+			errno = EMSGSIZE;
+			goto cleanup;
+		}
+		rr.data = cp;
+		cp += rr.dlen;
+		if (rr.class != class || rr.type != T_TXT)
+			continue;
+		if (!(list[j] = malloc(rr.dlen)))
+			goto cleanup;
+		dst = list[j++];
+		edst = dst + rr.dlen;
+		erdata = rr.data + rr.dlen;
+		cp = rr.data;
+		while (cp < erdata) {
+			n = (unsigned char) *cp++;
+			if (cp + n > eom || dst + n > edst) {
+				errno = EMSGSIZE;
+				goto cleanup;
+			}
+			memcpy(dst, cp, n);
+			cp += n;
+			dst += n;
+		}
+		if (cp != erdata) {
+			errno = EMSGSIZE;
+			goto cleanup;
+		}
+		*dst = '\0';
+	}
+	list[j] = NULL;
+	if (j == 0) {
+		errno = ENOENT;
+		goto cleanup;
+	}
+	return (list);
+
+ cleanup:
+	for (i = 0; i < j; i++)
+		free(list[i]);
+	free(list);
+	return (NULL);
+}
+
+struct __res_state *
+__hesiod_res_get(void *context) {
+	struct hesiod_p *ctx = context;
+
+	if (!ctx->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (res == NULL) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		__hesiod_res_set(ctx, res, free);
+	}
+
+	return (ctx->res);
+}
+
+void
+__hesiod_res_set(void *context, struct __res_state *res,
+	         void (*free_res)(void *)) {
+	struct hesiod_p *ctx = context;
+
+	if (ctx->res && ctx->free_res) {
+		res_nclose(ctx->res);
+		(*ctx->free_res)(ctx->res);
+	}
+
+	ctx->res = res;
+	ctx->free_res = free_res;
+}
+
+static int
+init(struct hesiod_p *ctx) {
+	
+	if (!ctx->res && !__hesiod_res_get(ctx))
+		return (-1);
+
+	if (((ctx->res->options & RES_INIT) == 0U) &&
+	    (res_ninit(ctx->res) == -1))
+		return (-1);
+
+	return (0);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/irs/hesiod_p.h b/usr/src/lib/libresolv2_joy/common/irs/hesiod_p.h
new file mode 100644
index 0000000000..99da15d0cd
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/hesiod_p.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: hesiod_p.h,v 1.3 2005/04/27 04:56:27 sra Exp $
+ */
+
+#ifndef _HESIOD_P_H_INCLUDED
+#define _HESIOD_P_H_INCLUDED
+
+/** \file
+ * \brief
+ * hesiod_p.h -- private definitions for the hesiod library.
+ *
+ * \author
+ * This file is primarily maintained by tytso@mit.edu and ghudson@mit.edu.
+ */
+
+#define DEF_RHS		".Athena.MIT.EDU"	/*%< Defaults if HESIOD_CONF */
+#define DEF_LHS		".ns"			/*%<    file is not */
+						/*%<    present. */
+struct hesiod_p {
+	char *		LHS;		/*%< normally ".ns" */
+	char *		RHS;		/*%< AKA the default hesiod domain */
+	struct __res_state * res;	/*%< resolver context */
+	void		(*free_res)(void *);
+	void		(*res_set)(struct hesiod_p *, struct __res_state *,
+				   void (*)(void *));
+	struct __res_state * (*res_get)(struct hesiod_p *);
+};
+
+#define MAX_HESRESP	1024
+
+#endif /*_HESIOD_P_H_INCLUDED*/
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irp.c b/usr/src/lib/libresolv2_joy/common/irs/irp.c
new file mode 100644
index 0000000000..ef10631c22
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irp.c
@@ -0,0 +1,583 @@
+/*
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1996, 1998-2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: irp.c,v 1.12 2008/11/14 02:36:51 marka Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <syslog.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <string.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <syslog.h>
+#include <ctype.h>
+#include <unistd.h>
+
+#include <isc/memcluster.h>
+
+#include <irs.h>
+#include <irp.h>
+
+#include "irs_p.h"
+#include "irp_p.h"
+
+#include "port_after.h"
+
+/* Forward. */
+
+static void		irp_close(struct irs_acc *);
+
+#define LINEINCR 128
+
+#if !defined(SUN_LEN)
+#define SUN_LEN(su) \
+	(sizeof (*(su)) - sizeof ((su)->sun_path) + strlen((su)->sun_path))
+#endif
+
+
+/* Public */
+
+
+/* send errors to syslog if true. */
+int irp_log_errors = 1;
+
+/*%
+ * This module handles the irp module connection to irpd.
+ *
+ * The client expects a synchronous interface to functions like
+ * getpwnam(3), so we can't use the ctl_* i/o library on this end of
+ * the wire (it's used in the server).
+ */
+
+/*%
+ * irs_acc *irs_irp_acc(const char *options);
+ *
+ *	Initialize the irp module.
+ */
+struct irs_acc *
+irs_irp_acc(const char *options) {
+	struct irs_acc *acc;
+	struct irp_p *irp;
+
+	UNUSED(options);
+
+	if (!(acc = memget(sizeof *acc))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(acc, 0x5e, sizeof *acc);
+	if (!(irp = memget(sizeof *irp))) {
+		errno = ENOMEM;
+		free(acc);
+		return (NULL);
+	}
+	irp->inlast = 0;
+	irp->incurr = 0;
+	irp->fdCxn = -1;
+	acc->private = irp;
+
+#ifdef WANT_IRS_GR
+	acc->gr_map = irs_irp_gr;
+#else
+	acc->gr_map = NULL;
+#endif
+#ifdef WANT_IRS_PW
+	acc->pw_map = irs_irp_pw;
+#else
+	acc->pw_map = NULL;
+#endif
+	acc->sv_map = irs_irp_sv;
+	acc->pr_map = irs_irp_pr;
+	acc->ho_map = irs_irp_ho;
+	acc->nw_map = irs_irp_nw;
+	acc->ng_map = irs_irp_ng;
+	acc->close = irp_close;
+	return (acc);
+}
+
+
+int
+irs_irp_connection_setup(struct irp_p *cxndata, int *warned) {
+	if (irs_irp_is_connected(cxndata)) {
+		return (0);
+	} else if (irs_irp_connect(cxndata) != 0) {
+		if (warned != NULL && !*warned) {
+			syslog(LOG_ERR, "irpd connection failed: %m\n");
+			(*warned)++;
+		}
+
+		return (-1);
+	}
+
+	return (0);
+}
+
+/*%
+ * int irs_irp_connect(void);
+ *
+ *	Sets up the connection to the remote irpd server.
+ *
+ * Returns:
+ *
+ *	0 on success, -1 on failure.
+ *
+ */
+int
+irs_irp_connect(struct irp_p *pvt) {
+	int flags;
+	struct sockaddr *addr;
+	struct sockaddr_in iaddr;
+#ifndef NO_SOCKADDR_UN
+	struct sockaddr_un uaddr;
+#endif
+	long ipaddr;
+	const char *irphost;
+	int code;
+	char text[256];
+	int socklen = 0;
+
+	if (pvt->fdCxn != -1) {
+		perror("fd != 1");
+		return (-1);
+	}
+
+#ifndef NO_SOCKADDR_UN
+	memset(&uaddr, 0, sizeof uaddr);
+#endif
+	memset(&iaddr, 0, sizeof iaddr);
+
+	irphost = getenv(IRPD_HOST_ENV);
+	if (irphost == NULL) {
+		irphost = "127.0.0.1";
+	}
+
+#ifndef NO_SOCKADDR_UN
+	if (irphost[0] == '/') {
+		addr = (struct sockaddr *)&uaddr;
+		strncpy(uaddr.sun_path, irphost, sizeof uaddr.sun_path);
+		uaddr.sun_family = AF_UNIX;
+		socklen = SUN_LEN(&uaddr);
+#ifdef HAVE_SA_LEN
+		uaddr.sun_len = socklen;
+#endif
+	} else
+#endif
+	{
+		if (inet_pton(AF_INET, irphost, &ipaddr) != 1) {
+			errno = EADDRNOTAVAIL;
+			perror("inet_pton");
+			return (-1);
+		}
+
+		addr = (struct sockaddr *)&iaddr;
+		socklen = sizeof iaddr;
+#ifdef HAVE_SA_LEN
+		iaddr.sin_len = socklen;
+#endif
+		iaddr.sin_family = AF_INET;
+		iaddr.sin_port = htons(IRPD_PORT);
+		iaddr.sin_addr.s_addr = ipaddr;
+	}
+
+
+	pvt->fdCxn = socket(addr->sa_family, SOCK_STREAM, PF_UNSPEC);
+	if (pvt->fdCxn < 0) {
+		perror("socket");
+		return (-1);
+	}
+
+	if (connect(pvt->fdCxn, addr, socklen) != 0) {
+		perror("connect");
+		return (-1);
+	}
+
+	flags = fcntl(pvt->fdCxn, F_GETFL, 0);
+	if (flags < 0) {
+		close(pvt->fdCxn);
+		perror("close");
+		return (-1);
+	}
+
+#if 0
+	flags |= O_NONBLOCK;
+	if (fcntl(pvt->fdCxn, F_SETFL, flags) < 0) {
+		close(pvt->fdCxn);
+		perror("fcntl");
+		return (-1);
+	}
+#endif
+
+	code = irs_irp_read_response(pvt, text, sizeof text);
+	if (code != IRPD_WELCOME_CODE) {
+		if (irp_log_errors) {
+			syslog(LOG_WARNING, "Connection failed: %s", text);
+		}
+		irs_irp_disconnect(pvt);
+		return (-1);
+	}
+
+	return (0);
+}
+
+/*%
+ * int	irs_irp_is_connected(struct irp_p *pvt);
+ *
+ * Returns:
+ *
+ *	Non-zero if streams are setup to remote.
+ *
+ */
+
+int
+irs_irp_is_connected(struct irp_p *pvt) {
+	return (pvt->fdCxn >= 0);
+}
+
+/*%
+ * void
+ * irs_irp_disconnect(struct irp_p *pvt);
+ *
+ *	Closes streams to remote.
+ */
+
+void
+irs_irp_disconnect(struct irp_p *pvt) {
+	if (pvt->fdCxn != -1) {
+		close(pvt->fdCxn);
+		pvt->fdCxn = -1;
+	}
+}
+
+
+
+int
+irs_irp_read_line(struct irp_p *pvt, char *buffer, int len) {
+	char *realstart = &pvt->inbuffer[0];
+	char *p, *start, *end;
+	int spare;
+	int i;
+	int buffpos = 0;
+	int left = len - 1;
+
+	while (left > 0) {
+		start = p = &pvt->inbuffer[pvt->incurr];
+		end = &pvt->inbuffer[pvt->inlast];
+
+		while (p != end && *p != '\n')
+			p++;
+
+		if (p == end) {
+			/* Found no newline so shift data down if necessary
+			 * and append new data to buffer
+			 */
+			if (start > realstart) {
+				memmove(realstart, start, end - start);
+				pvt->inlast = end - start;
+				start = realstart;
+				pvt->incurr = 0;
+				end = &pvt->inbuffer[pvt->inlast];
+			}
+
+			spare = sizeof (pvt->inbuffer) - pvt->inlast;
+
+			p = end;
+			i = read(pvt->fdCxn, end, spare);
+			if (i < 0) {
+				close(pvt->fdCxn);
+				pvt->fdCxn = -1;
+				return (buffpos > 0 ? buffpos : -1);
+			} else if (i == 0) {
+				return (buffpos);
+			}
+
+			end += i;
+			pvt->inlast += i;
+
+			while (p != end && *p != '\n')
+				p++;
+		}
+
+		if (p == end) {
+			/* full buffer and still no newline */
+			i = sizeof pvt->inbuffer;
+		} else {
+			/* include newline */
+			i = p - start + 1;
+		}
+
+		if (i > left)
+			i = left;
+		memcpy(buffer + buffpos, start, i);
+		pvt->incurr += i;
+		buffpos += i;
+		buffer[buffpos] = '\0';
+
+		if (p != end) {
+			left = 0;
+		} else {
+			left -= i;
+		}
+	}
+
+#if 0
+	fprintf(stderr, "read line: %s\n", buffer);
+#endif
+	return (buffpos);
+}
+
+/*%
+ * int irp_read_response(struct irp_p *pvt);
+ *
+ * Returns:
+ *
+ *	The number found at the beginning of the line read from
+ *	FP. 0 on failure(0 is not a legal response code). The
+ *	rest of the line is discarded.
+ *
+ */
+
+int
+irs_irp_read_response(struct irp_p *pvt, char *text, size_t textlen) {
+	char line[1024];
+	int code;
+	char *p;
+
+	if (irs_irp_read_line(pvt, line, sizeof line) <= 0) {
+		return (0);
+	}
+
+	p = strchr(line, '\n');
+	if (p == NULL) {
+		return (0);
+	}
+
+	if (sscanf(line, "%d", &code) != 1) {
+		code = 0;
+	} else if (text != NULL && textlen > 0U) {
+		p = line;
+		while (isspace((unsigned char)*p)) p++;
+		while (isdigit((unsigned char)*p)) p++;
+		while (isspace((unsigned char)*p)) p++;
+		strncpy(text, p, textlen - 1);
+		p[textlen - 1] = '\0';
+	}
+
+	return (code);
+}
+
+/*%
+ * char *irp_read_body(struct irp_p *pvt, size_t *size);
+ *
+ *	Read in the body of a response. Terminated by a line with
+ *	just a dot on it. Lines should be terminated with a CR-LF
+ *	sequence, but we're nt piccky if the CR is missing.
+ *	No leading dot escaping is done as the protcol doesn't
+ *	use leading dots anywhere.
+ *
+ * Returns:
+ *
+ *	Pointer to null-terminated buffer allocated by memget.
+ *	*SIZE is set to the length of the buffer.
+ *
+ */
+
+char *
+irs_irp_read_body(struct irp_p *pvt, size_t *size) {
+	char line[1024];
+	u_int linelen;
+	size_t len = LINEINCR;
+	char *buffer = memget(len);
+	int idx = 0;
+
+	if (buffer == NULL)
+		return (NULL);
+
+	for (;;) {
+		if (irs_irp_read_line(pvt, line, sizeof line) <= 0 ||
+		    strchr(line, '\n') == NULL)
+			goto death;
+
+		linelen = strlen(line);
+
+		if (line[linelen - 1] != '\n')
+			goto death;
+
+		/* We're not strict about missing \r. Should we be??  */
+		if (linelen > 2 && line[linelen - 2] == '\r') {
+			line[linelen - 2] = '\n';
+			line[linelen - 1] = '\0';
+			linelen--;
+		}
+
+		if (linelen == 2 && line[0] == '.') {
+			*size = len;
+			buffer[idx] = '\0';
+
+			return (buffer);
+		}
+
+		if (linelen > (len - (idx + 1))) {
+			char *p = memget(len + LINEINCR);
+
+			if (p == NULL)
+				goto death;
+			memcpy(p, buffer, len);
+			memput(buffer, len);
+			buffer = p;
+			len += LINEINCR;
+		}
+
+		memcpy(buffer + idx, line, linelen);
+		idx += linelen;
+	}
+ death:
+	memput(buffer, len);
+	return (NULL);
+}
+
+/*%
+ * int irs_irp_get_full_response(struct irp_p *pvt, int *code,
+ *			char **body, size_t *bodylen);
+ *
+ *	Gets the response to a command. If the response indicates
+ *	there's a body to follow(code % 10 == 1), then the
+ *	body buffer is allcoated with memget and stored in
+ *	*BODY. The length of the allocated body buffer is stored
+ *	in *BODY. The caller must give the body buffer back to
+ *	memput when done. The results code is stored in *CODE.
+ *
+ * Returns:
+ *
+ *	0 if a result was read. -1 on some sort of failure.
+ *
+ */
+
+int
+irs_irp_get_full_response(struct irp_p *pvt, int *code, char *text,
+			  size_t textlen, char **body, size_t *bodylen) {
+	int result = irs_irp_read_response(pvt, text, textlen);
+
+	*body = NULL;
+
+	if (result == 0) {
+		return (-1);
+	}
+
+	*code = result;
+
+	/* Code that matches 2xx is a good result code.
+	 * Code that matches xx1 means there's a response body coming.
+	 */
+	if ((result / 100) == 2 && (result % 10) == 1) {
+		*body = irs_irp_read_body(pvt, bodylen);
+		if (*body == NULL) {
+			return (-1);
+		}
+	}
+
+	return (0);
+}
+
+/*%
+ * int irs_irp_send_command(struct irp_p *pvt, const char *fmt, ...);
+ *
+ *	Sends command to remote connected via the PVT
+ *	structure. FMT and args after it are fprintf-like
+ *	arguments for formatting.
+ *
+ * Returns:
+ *
+ *	0 on success, -1 on failure.
+ */
+
+int
+irs_irp_send_command(struct irp_p *pvt, const char *fmt, ...) {
+	va_list ap;
+	char buffer[1024];
+	int pos = 0;
+	int i, todo;
+
+
+	if (pvt->fdCxn < 0) {
+		return (-1);
+	}
+
+	va_start(ap, fmt);
+	(void) vsprintf(buffer, fmt, ap);
+	todo = strlen(buffer);
+	va_end(ap);
+	if (todo > (int)sizeof(buffer) - 3) {
+		syslog(LOG_CRIT, "memory overrun in irs_irp_send_command()");
+		exit(1);
+	}
+	strcat(buffer, "\r\n");
+	todo = strlen(buffer);
+
+	while (todo > 0) {
+		i = write(pvt->fdCxn, buffer + pos, todo);
+#if 0
+		/* XXX brister */
+		fprintf(stderr, "Wrote: \"");
+		fwrite(buffer + pos, sizeof (char), todo, stderr);
+		fprintf(stderr, "\"\n");
+#endif
+		if (i < 0) {
+			close(pvt->fdCxn);
+			pvt->fdCxn = -1;
+			return (-1);
+		}
+		todo -= i;
+	}
+
+	return (0);
+}
+
+
+/* Methods */
+
+/*%
+ * void irp_close(struct irs_acc *this)
+ *
+ */
+
+static void
+irp_close(struct irs_acc *this) {
+	struct irp_p *irp = (struct irp_p *)this->private;
+
+	if (irp != NULL) {
+		irs_irp_disconnect(irp);
+		memput(irp, sizeof *irp);
+	}
+
+	memput(this, sizeof *this);
+}
+
+
+
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irp_ho.c b/usr/src/lib/libresolv2_joy/common/irs/irp_ho.c
new file mode 100644
index 0000000000..b0de31dc89
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irp_ho.c
@@ -0,0 +1,405 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996,1998 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: irp_ho.c,v 1.3 2005/04/27 04:56:28 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* Imports. */
+
+#include "port_before.h"
+
+#include <syslog.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+
+#include <irs.h>
+#include <irp.h>
+#include <isc/irpmarshall.h>
+#include <isc/memcluster.h>
+
+#include "irs_p.h"
+#include "dns_p.h"
+#include "irp_p.h"
+
+#include "port_after.h"
+
+/* Definitions. */
+
+#define	MAXALIASES	35
+#define	MAXADDRS	35
+#define	Max(a,b)	((a) > (b) ? (a) : (b))
+
+
+struct pvt {
+	struct irp_p	       *girpdata;
+	int			warned;
+	struct hostent		host;
+};
+
+/* Forward. */
+
+static void		ho_close(struct irs_ho *this);
+static struct hostent *	ho_byname(struct irs_ho *this, const char *name);
+static struct hostent *	ho_byname2(struct irs_ho *this, const char *name,
+				   int af);
+static struct hostent *	ho_byaddr(struct irs_ho *this, const void *addr,
+				  int len, int af);
+static struct hostent *	ho_next(struct irs_ho *this);
+static void		ho_rewind(struct irs_ho *this);
+static void		ho_minimize(struct irs_ho *this);
+
+static void		free_host(struct hostent *ho);
+static struct addrinfo * ho_addrinfo(struct irs_ho *this, const char *name,
+				     const struct addrinfo *pai);
+
+/* Public. */
+
+/*%
+ * struct irs_ho * irs_irp_ho(struct irs_acc *this)
+ *
+ * Notes:
+ *
+ *	Initializes the irp_ho module.
+ *
+ */
+
+struct irs_ho *
+irs_irp_ho(struct irs_acc *this) {
+	struct irs_ho *ho;
+	struct pvt *pvt;
+
+	if (!(ho = memget(sizeof *ho))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ho, 0x0, sizeof *ho);
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(ho, sizeof *ho);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->girpdata = this->private;
+
+	ho->private = pvt;
+	ho->close = ho_close;
+	ho->byname = ho_byname;
+	ho->byname2 = ho_byname2;
+	ho->byaddr = ho_byaddr;
+	ho->next = ho_next;
+	ho->rewind = ho_rewind;
+	ho->minimize = ho_minimize;
+	ho->addrinfo = ho_addrinfo;
+
+	return (ho);
+}
+
+/* Methods. */
+
+/*%
+ *	Closes down the module.
+ *
+ */
+
+static void
+ho_close(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	ho_minimize(this);
+
+	free_host(&pvt->host);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+
+
+/*
+ * struct hostent * ho_byname(struct irs_ho *this, const char *name)
+ *
+ */
+
+static struct hostent *
+ho_byname(struct irs_ho *this, const char *name) {
+	return (ho_byname2(this, name, AF_INET));
+}
+
+
+
+
+
+/*
+ * struct hostent * ho_byname2(struct irs_ho *this, const char *name, int af)
+ *
+ */
+
+static struct hostent *
+ho_byname2(struct irs_ho *this, const char *name, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *ho = &pvt->host;
+	char *body = NULL;
+	size_t bodylen;
+	int code;
+	char text[256];
+
+	if (ho->h_name != NULL &&
+	    strcmp(name, ho->h_name) == 0 &&
+	    af == ho->h_addrtype) {
+		return (ho);
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "gethostbyname2 %s %s",
+				 name, ADDR_T_STR(af)) != 0)
+		return (NULL);
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETHOST_OK) {
+		free_host(ho);
+		if (irp_unmarshall_ho(ho, body) != 0) {
+			ho = NULL;
+		}
+	} else {
+		ho = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (ho);
+}
+
+
+
+/*
+ * struct hostent * ho_byaddr(struct irs_ho *this, const void *addr,
+ *			   int len, int af)
+ *
+ */
+
+static struct hostent *
+ho_byaddr(struct irs_ho *this, const void *addr, int len, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *ho = &pvt->host;
+	char *body = NULL;
+	size_t bodylen;
+	int code;
+	char **p;
+	char paddr[MAXPADDRSIZE];
+	char text[256];
+
+	if (ho->h_name != NULL &&
+	    af == ho->h_addrtype &&
+	    len == ho->h_length) {
+		for (p = ho->h_addr_list ; *p != NULL ; p++) {
+			if (memcmp(*p, addr, len) == 0)
+				return (ho);
+		}
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (inet_ntop(af, addr, paddr, sizeof paddr) == NULL) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "gethostbyaddr %s %s",
+				 paddr, ADDR_T_STR(af)) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETHOST_OK) {
+		free_host(ho);
+		if (irp_unmarshall_ho(ho, body) != 0) {
+			ho = NULL;
+		}
+	} else {
+		ho = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (ho);
+}
+
+/*%
+ *	The implementation for gethostent(3). The first time it's
+ *	called all the data is pulled from the remote(i.e. what
+ *	the maximum number of gethostent(3) calls would return)
+ *	and that data is cached.
+ *
+ */
+
+static struct hostent *
+ho_next(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *ho = &pvt->host;
+	char *body;
+	size_t bodylen;
+	int code;
+	char text[256];
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "gethostent") != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETHOST_OK) {
+		free_host(ho);
+		if (irp_unmarshall_ho(ho, body) != 0) {
+			ho = NULL;
+		}
+	} else {
+		ho = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (ho);
+}
+
+/*%
+ * void ho_rewind(struct irs_ho *this)
+ *
+ */
+
+static void
+ho_rewind(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char text[256];
+	int code;
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return;
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "sethostent") != 0) {
+		return;
+	}
+
+	code = irs_irp_read_response(pvt->girpdata, text, sizeof text);
+	if (code != IRPD_GETHOST_SETOK) {
+		if (irp_log_errors) {
+			syslog(LOG_WARNING, "sethostent failed: %s", text);
+		}
+	}
+
+	return;
+}
+
+/*%
+ * void ho_minimize(struct irs_ho *this)
+ *
+ */
+
+static void
+ho_minimize(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	free_host(&pvt->host);
+
+	irs_irp_disconnect(pvt->girpdata);
+}
+
+/*%
+ * void free_host(struct hostent *ho)
+ *
+ */
+
+static void
+free_host(struct hostent *ho) {
+	char **p;
+
+	if (ho == NULL) {
+		return;
+	}
+
+	if (ho->h_name != NULL)
+		free(ho->h_name);
+
+	if (ho->h_aliases != NULL) {
+		for (p = ho->h_aliases ; *p != NULL ; p++)
+			free(*p);
+		free(ho->h_aliases);
+	}
+
+	if (ho->h_addr_list != NULL) {
+		for (p = ho->h_addr_list ; *p != NULL ; p++)
+			free(*p);
+		free(ho->h_addr_list);
+	}
+}
+
+/* dummy */
+static struct addrinfo *
+ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
+{
+	UNUSED(this);
+	UNUSED(name);
+	UNUSED(pai);
+	return(NULL);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irp_ng.c b/usr/src/lib/libresolv2_joy/common/irs/irp_ng.c
new file mode 100644
index 0000000000..1af862cab4
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irp_ng.c
@@ -0,0 +1,253 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996, 1998 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: irp_ng.c,v 1.4 2006/12/07 04:46:27 marka Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <syslog.h>
+
+#include <irs.h>
+#include <irp.h>
+#include <isc/memcluster.h>
+#include <isc/irpmarshall.h>
+
+#include "irs_p.h"
+#include "irp_p.h"
+
+#include "port_after.h"
+
+/* Definitions */
+
+struct pvt {
+	struct irp_p	       *girpdata;
+	int			warned;
+};
+
+
+/* Forward */
+
+static void		ng_rewind(struct irs_ng *, const char*);
+static void		ng_close(struct irs_ng *);
+static int		ng_next(struct irs_ng *, const char **, const char **,
+				const char **);
+static int		ng_test(struct irs_ng *, const char *,
+				const char *, const char *,
+				const char *);
+static void		ng_minimize(struct irs_ng *);
+
+
+/* Public */
+
+/*%
+ *	Intialize the irp netgroup module.
+ *
+ */
+
+struct irs_ng *
+irs_irp_ng(struct irs_acc *this) {
+	struct irs_ng *ng;
+	struct pvt *pvt;
+
+	if (!(ng = memget(sizeof *ng))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ng, 0x5e, sizeof *ng);
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(ng, sizeof *ng);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->girpdata = this->private;
+
+	ng->private = pvt;
+	ng->close = ng_close;
+	ng->next = ng_next;
+	ng->test = ng_test;
+	ng->rewind = ng_rewind;
+	ng->minimize = ng_minimize;
+	return (ng);
+}
+
+/* Methods */
+
+
+
+/*
+ * void ng_close(struct irs_ng *this)
+ *
+ */
+
+static void
+ng_close(struct irs_ng *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	ng_minimize(this);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+
+
+
+/*
+ * void ng_rewind(struct irs_ng *this, const char *group)
+ *
+ *
+ */
+
+static void
+ng_rewind(struct irs_ng *this, const char *group) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char text[256];
+	int code;
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return;
+	}
+
+	if (irs_irp_send_command(pvt->girpdata,
+				 "setnetgrent %s", group) != 0) {
+		return;
+	}
+
+	code = irs_irp_read_response(pvt->girpdata, text, sizeof text);
+	if (code != IRPD_GETNETGR_SETOK) {
+		if (irp_log_errors) {
+			syslog(LOG_WARNING, "setnetgrent(%s) failed: %s",
+			       group, text);
+		}
+	}
+
+	return;
+}
+
+/*
+ *	Get the next netgroup item from the cache.
+ *
+ */
+
+static int
+ng_next(struct irs_ng *this, const char **host, const char **user,
+        const char **domain)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	int code;
+	char *body = NULL;
+	size_t bodylen;
+	int rval = 0;
+	char text[256];
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (0);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getnetgrent") != 0)
+		return (0);
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (0);
+	}
+
+	if (code == IRPD_GETNETGR_OK) {
+		if (irp_unmarshall_ng(host, user, domain, body) == 0) {
+			rval = 1;
+		}
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (rval);
+}
+
+/*
+ *	Search for a match in a netgroup.
+ *
+ */
+
+static int
+ng_test(struct irs_ng *this, const char *name,
+	const char *host, const char *user, const char *domain)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	char *body = NULL;
+	size_t bodylen = 0;
+	int code;
+	char text[256];
+	int rval = 0;
+
+	UNUSED(name);
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (0);
+	}
+
+	if (irp_marshall_ng(host, user, domain, &body, &bodylen) != 0) {
+		return (0);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "innetgr %s", body) == 0) {
+		code = irs_irp_read_response(pvt->girpdata, text, sizeof text);
+		if (code == IRPD_GETNETGR_MATCHES) {
+			rval = 1;
+		}
+	}
+
+	memput(body, bodylen);
+
+	return (rval);
+}
+
+
+
+
+/*
+ * void ng_minimize(struct irs_ng *this)
+ *
+ */
+
+static void
+ng_minimize(struct irs_ng *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	irs_irp_disconnect(pvt->girpdata);
+}
+
+
+
+
+/* Private */
+
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irp_nw.c b/usr/src/lib/libresolv2_joy/common/irs/irp_nw.c
new file mode 100644
index 0000000000..3f2381f95d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irp_nw.c
@@ -0,0 +1,348 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996,1998 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: irp_nw.c,v 1.4 2006/03/09 23:57:56 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#if 0
+
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <syslog.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+
+#include <irs.h>
+#include <irp.h>
+#include <isc/irpmarshall.h>
+
+#include <isc/memcluster.h>
+#include <isc/misc.h>
+
+#include "irs_p.h"
+#include "lcl_p.h"
+#include "irp_p.h"
+
+#include "port_after.h"
+
+#define MAXALIASES 35
+#define MAXADDRSIZE 4
+
+struct pvt {
+	struct irp_p	       *girpdata;
+	int			warned;
+	struct nwent		net;
+};
+
+/* Forward */
+
+static void		nw_close(struct irs_nw *);
+static struct nwent *	nw_byname(struct irs_nw *, const char *, int);
+static struct nwent *	nw_byaddr(struct irs_nw *, void *, int, int);
+static struct nwent *	nw_next(struct irs_nw *);
+static void		nw_rewind(struct irs_nw *);
+static void		nw_minimize(struct irs_nw *);
+
+static void		free_nw(struct nwent *nw);
+
+
+/* Public */
+
+/*%
+ * struct irs_nw * irs_irp_nw(struct irs_acc *this) 
+ *
+ */
+
+struct irs_nw *
+irs_irp_nw(struct irs_acc *this) {
+	struct irs_nw *nw;
+	struct pvt *pvt;
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+
+	if (!(nw = memget(sizeof *nw))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(nw, 0x0, sizeof *nw);
+	pvt->girpdata = this->private;
+
+	nw->private = pvt;
+	nw->close = nw_close;
+	nw->byname = nw_byname;
+	nw->byaddr = nw_byaddr;
+	nw->next = nw_next;
+	nw->rewind = nw_rewind;
+	nw->minimize = nw_minimize;
+	return (nw);
+}
+
+/* Methods */
+
+/*%
+ * void nw_close(struct irs_nw *this) 
+ *
+ */
+
+static void
+nw_close(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	nw_minimize(this);
+
+	free_nw(&pvt->net);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+/*%
+ * struct nwent * nw_byaddr(struct irs_nw *this, void *net, 
+ * 				int length, int type) 
+ *
+ */
+
+static struct nwent *
+nw_byaddr(struct irs_nw *this, void *net, int length, int type) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct nwent *nw = &pvt->net;
+	char *body = NULL;
+	size_t bodylen;
+	int code;
+	char paddr[24];			/*%< bigenough for ip4 w/ cidr spec. */
+	char text[256];
+
+	if (inet_net_ntop(type, net, length, paddr, sizeof paddr) == NULL) {
+		return (NULL);
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getnetbyaddr %s %s",
+				 paddr, ADDR_T_STR(type)) != 0)
+		return (NULL);
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETNET_OK) {
+		free_nw(nw);
+		if (irp_unmarshall_nw(nw, body) != 0) {
+			nw = NULL;
+		}
+	} else {
+		nw = NULL;
+	}
+		
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+	
+	return (nw);
+}
+
+/*%
+ * struct nwent * nw_byname(struct irs_nw *this, const char *name, int type) 
+ *
+ */
+
+static struct nwent *
+nw_byname(struct irs_nw *this, const char *name, int type) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct nwent *nw = &pvt->net;
+	char *body = NULL;
+	size_t bodylen;
+	int code;
+	char text[256];
+
+	if (nw->n_name != NULL &&
+	    strcmp(name, nw->n_name) == 0 &&
+	    nw->n_addrtype == type) {
+		return (nw);
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getnetbyname %s", name) != 0)
+		return (NULL);
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETNET_OK) {
+		free_nw(nw);
+		if (irp_unmarshall_nw(nw, body) != 0) {
+			nw = NULL;
+		}
+	} else {
+		nw = NULL;
+	}
+	
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+	
+	return (nw);
+}
+
+/*%
+ * void nw_rewind(struct irs_nw *this) 
+ *
+ */
+
+static void
+nw_rewind(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char text[256];
+	int code;
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return;
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "setnetent") != 0) {
+		return;
+	}
+
+	code = irs_irp_read_response(pvt->girpdata, text, sizeof text);
+	if (code != IRPD_GETNET_SETOK) {
+		if (irp_log_errors) {
+			syslog(LOG_WARNING, "setnetent failed: %s", text);
+		}
+	}
+	
+	return;
+}
+
+/*%
+ * 	Prepares the cache if necessary and returns the first, or 
+ * 	next item from it.
+ */
+
+static struct nwent *
+nw_next(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct nwent *nw = &pvt->net;
+	char *body;
+	size_t bodylen;
+	int code;
+	char text[256];
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getnetent") != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETNET_OK) {
+		free_nw(nw);
+		if (irp_unmarshall_nw(nw, body) != 0) {
+			nw = NULL;
+		}
+	} else {
+		nw = NULL;
+	}
+
+	if (body != NULL)
+		memput(body, bodylen);
+	return (nw);
+}
+
+/*%
+ * void nw_minimize(struct irs_nw *this) 
+ *
+ */
+
+static void
+nw_minimize(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	irs_irp_disconnect(pvt->girpdata);
+}
+
+
+
+
+/* private. */
+
+/*%
+ *	deallocate all the memory irp_unmarshall_pw allocated.
+ *
+ */
+
+static void
+free_nw(struct nwent *nw) {
+	char **p;
+
+	if (nw == NULL)
+		return;
+
+	if (nw->n_name != NULL)
+		free(nw->n_name);
+
+	if (nw->n_aliases != NULL) {
+		for (p = nw->n_aliases ; *p != NULL ; p++) {
+			free(*p);
+		}
+		free(nw->n_aliases);
+	}
+
+	if (nw->n_addr != NULL)
+		free(nw->n_addr);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irp_p.h b/usr/src/lib/libresolv2_joy/common/irs/irp_p.h
new file mode 100644
index 0000000000..4f943f81bd
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irp_p.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: irp_p.h,v 1.5 2005/04/27 04:56:28 sra Exp $
+ */
+
+#ifndef _IRP_P_H_INCLUDED
+#define _IRP_P_H_INCLUDED
+
+#include <stdio.h>
+
+struct irp_p {
+	char inbuffer[1024];
+	int inlast; /*%< index of one past the last char in buffer */
+	int incurr; /*%< index of the next char to be read from buffer */
+	int fdCxn;
+};
+
+/*
+ * Externs.
+ */
+
+extern struct irs_acc *	irs_irp_acc __P((const char *));
+extern struct irs_gr *	irs_irp_gr __P((struct irs_acc *));
+extern struct irs_pw *	irs_irp_pw __P((struct irs_acc *));
+extern struct irs_sv *	irs_irp_sv __P((struct irs_acc *));
+extern struct irs_pr *	irs_irp_pr __P((struct irs_acc *));
+extern struct irs_ho *	irs_irp_ho __P((struct irs_acc *));
+extern struct irs_nw *	irs_irp_nw __P((struct irs_acc *));
+extern struct irs_ng *	irs_irp_ng __P((struct irs_acc *));
+
+int irs_irp_connect(struct irp_p *pvt);
+int irs_irp_is_connected(struct irp_p *pvt);
+void irs_irp_disconnect(struct irp_p *pvt);
+int irs_irp_read_response(struct irp_p *pvt, char *text, size_t textlen);
+char *irs_irp_read_body(struct irp_p *pvt, size_t *size);
+int irs_irp_get_full_response(struct irp_p *pvt, int *code,
+			      char *text, size_t textlen,
+			      char **body, size_t *bodylen);
+
+extern int irp_log_errors;
+
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irp_pr.c b/usr/src/lib/libresolv2_joy/common/irs/irp_pr.c
new file mode 100644
index 0000000000..ea876e8281
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irp_pr.c
@@ -0,0 +1,327 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: irp_pr.c,v 1.3 2005/04/27 04:56:29 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* extern */
+
+#include "port_before.h"
+
+#include <syslog.h>
+#include <sys/types.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <netdb.h>
+#include <syslog.h>
+
+#include <irs.h>
+#include <irp.h>
+#include <isc/memcluster.h>
+#include <isc/irpmarshall.h>
+
+#include "irs_p.h"
+#include "lcl_p.h"
+#include "irp_p.h"
+
+#include "port_after.h"
+
+
+#define MAXALIASES	35
+
+/* Types */
+
+struct pvt {
+	struct irp_p	       *girpdata;
+	int			warned;
+	struct protoent		proto;
+};
+
+/* Forward */
+
+static void			pr_close(struct irs_pr *);
+static struct protoent *	pr_next(struct irs_pr *);
+static struct protoent *	pr_byname(struct irs_pr *, const char *);
+static struct protoent *	pr_bynumber(struct irs_pr *, int);
+static void			pr_rewind(struct irs_pr *);
+static void			pr_minimize(struct irs_pr *);
+
+static void			free_proto(struct protoent *pr);
+
+/* Public */
+
+/*%
+ * struct irs_pr * irs_irp_pr(struct irs_acc *this)
+ *
+ */
+
+struct irs_pr *
+irs_irp_pr(struct irs_acc *this) {
+	struct irs_pr *pr;
+	struct pvt *pvt;
+
+	if (!(pr = memget(sizeof *pr))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pr, 0x0, sizeof *pr);
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(pr, sizeof *pr);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->girpdata = this->private;
+
+	pr->private = pvt;
+	pr->close = pr_close;
+	pr->byname = pr_byname;
+	pr->bynumber = pr_bynumber;
+	pr->next = pr_next;
+	pr->rewind = pr_rewind;
+	pr->minimize = pr_minimize;
+	return (pr);
+}
+
+/* Methods */
+
+/*%
+ * void pr_close(struct irs_pr *this)
+ *
+ */
+
+static void
+pr_close(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	pr_minimize(this);
+
+	free_proto(&pvt->proto);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+/*%
+ * struct protoent * pr_byname(struct irs_pr *this, const char *name)
+ *
+ */
+
+static struct protoent *
+pr_byname(struct irs_pr *this, const char *name) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct protoent *pr = &pvt->proto;
+	char *body = NULL;
+	size_t bodylen;
+	int code;
+	int i;
+	char text[256];
+
+	if (pr->p_name != NULL && strcmp(name, pr->p_name) == 0) {
+		return (pr);
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	i = irs_irp_send_command(pvt->girpdata, "getprotobyname %s", name);
+	if (i != 0)
+		return (NULL);
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETPROTO_OK) {
+		free_proto(pr);
+		if (irp_unmarshall_pr(pr, body) != 0) {
+			pr = NULL;
+		}
+	} else {
+		pr = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (pr);
+}
+
+/*%
+ * struct protoent * pr_bynumber(struct irs_pr *this, int proto)
+ *
+ */
+
+static struct protoent *
+pr_bynumber(struct irs_pr *this, int proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct protoent *pr = &pvt->proto;
+	char *body = NULL;
+	size_t bodylen;
+	int code;
+	int i;
+	char text[256];
+
+	if (pr->p_name != NULL && proto == pr->p_proto) {
+		return (pr);
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	i = irs_irp_send_command(pvt->girpdata, "getprotobynumber %d", proto);
+	if (i != 0)
+		return (NULL);
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETPROTO_OK) {
+		free_proto(pr);
+		if (irp_unmarshall_pr(pr, body) != 0) {
+			pr = NULL;
+		}
+	} else {
+		pr = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (pr);
+}
+
+/*%
+ * void pr_rewind(struct irs_pr *this)
+ *
+ */
+
+static void
+pr_rewind(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char text[256];
+	int code;
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return;
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "setprotoent") != 0) {
+		return;
+	}
+
+	code = irs_irp_read_response(pvt->girpdata, text, sizeof text);
+	if (code != IRPD_GETPROTO_SETOK) {
+		if (irp_log_errors) {
+			syslog(LOG_WARNING, "setprotoent failed: %s", text);
+		}
+	}
+
+	return;
+}
+
+/*%
+ *	Prepares the cache if necessary and returns the next item in it.
+ *
+ */
+
+static struct protoent *
+pr_next(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct protoent *pr = &pvt->proto;
+	char *body;
+	size_t bodylen;
+	int code;
+	char text[256];
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getprotoent") != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETPROTO_OK) {
+		free_proto(pr);
+		if (irp_unmarshall_pr(pr, body) != 0) {
+			pr = NULL;
+		}
+	} else {
+		pr = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (pr);
+}
+
+/*%
+ * void pr_minimize(struct irs_pr *this)
+ *
+ */
+
+static void
+pr_minimize(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	irs_irp_disconnect(pvt->girpdata);
+}
+
+/*%
+ *	Deallocate all the memory irp_unmarshall_pr allocated.
+ *
+ */
+
+static void
+free_proto(struct protoent *pr) {
+	char **p;
+
+	if (pr == NULL)
+		return;
+
+	if (pr->p_name != NULL)
+		free(pr->p_name);
+
+	for (p = pr->p_aliases ; p != NULL && *p != NULL ; p++)
+		free(*p);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irp_sv.c b/usr/src/lib/libresolv2_joy/common/irs/irp_sv.c
new file mode 100644
index 0000000000..577e697fe6
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irp_sv.c
@@ -0,0 +1,346 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996,1998 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: irp_sv.c,v 1.3 2005/04/27 04:56:29 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* extern */
+
+#include "port_before.h"
+
+#include <syslog.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#ifdef IRS_LCL_SV_DB
+#include <db.h>
+#endif
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <syslog.h>
+
+#include <irs.h>
+#include <irp.h>
+#include <isc/irpmarshall.h>
+#include <isc/memcluster.h>
+
+#include "irs_p.h"
+#include "lcl_p.h"
+#include "irp_p.h"
+
+#include "port_after.h"
+
+/* Types */
+
+struct pvt {
+	struct irp_p	       *girpdata;
+	int			warned;
+	struct servent		service;
+};
+
+/* Forward */
+
+static void			sv_close(struct irs_sv*);
+static struct servent *		sv_next(struct irs_sv *);
+static struct servent *		sv_byname(struct irs_sv *, const char *,
+					  const char *);
+static struct servent *		sv_byport(struct irs_sv *, int, const char *);
+static void			sv_rewind(struct irs_sv *);
+static void			sv_minimize(struct irs_sv *);
+
+static void			free_service(struct servent *sv);
+
+
+
+/* Public */
+
+/*%
+ * struct irs_sv * irs_irp_sv(struct irs_acc *this)
+ *
+ */
+
+struct irs_sv *
+irs_irp_sv(struct irs_acc *this) {
+	struct irs_sv *sv;
+	struct pvt *pvt;
+
+	if ((sv = memget(sizeof *sv)) == NULL) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(sv, 0x0, sizeof *sv);
+
+	if ((pvt = memget(sizeof *pvt)) == NULL) {
+		memput(sv, sizeof *sv);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pvt->girpdata = this->private;
+
+	sv->private = pvt;
+	sv->close = sv_close;
+	sv->next = sv_next;
+	sv->byname = sv_byname;
+	sv->byport = sv_byport;
+	sv->rewind = sv_rewind;
+	sv->minimize = sv_minimize;
+
+	return (sv);
+}
+
+/* Methods */
+
+/*%
+ * void sv_close(struct irs_sv *this)
+ *
+ */
+
+static void
+sv_close(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	sv_minimize(this);
+
+	free_service(&pvt->service);
+
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+/*%
+ *	Fills the cache if necessary and returns the next item from it.
+ *
+ */
+
+static struct servent *
+sv_next(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct servent *sv = &pvt->service;
+	char *body;
+	size_t bodylen;
+	int code;
+	char text[256];
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getservent") != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETSERVICE_OK) {
+		free_service(sv);
+		if (irp_unmarshall_sv(sv, body) != 0) {
+			sv = NULL;
+		}
+	} else {
+		sv = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (sv);
+}
+
+/*%
+ * struct servent * sv_byname(struct irs_sv *this, const char *name,
+ *				const char *proto)
+ *
+ */
+
+static struct servent *
+sv_byname(struct irs_sv *this, const char *name, const char *proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct servent *sv = &pvt->service;
+	char *body;
+	char text[256];
+	size_t bodylen;
+	int code;
+
+	if (sv->s_name != NULL &&
+	    strcmp(name, sv->s_name) == 0 &&
+	    strcasecmp(proto, sv->s_proto) == 0) {
+		return (sv);
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getservbyname %s %s",
+				 name, proto) != 0)
+		return (NULL);
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETSERVICE_OK) {
+		free_service(sv);
+		if (irp_unmarshall_sv(sv, body) != 0) {
+			sv = NULL;
+		}
+	} else {
+		sv = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (sv);
+}
+
+/*%
+ * struct servent * sv_byport(struct irs_sv *this, int port,
+ *				const char *proto)
+ *
+ */
+
+static struct servent *
+sv_byport(struct irs_sv *this, int port, const char *proto) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct servent *sv = &pvt->service;
+	char *body;
+	size_t bodylen;
+	char text[256];
+	int code;
+
+	if (sv->s_name != NULL &&
+	    port == sv->s_port &&
+	    strcasecmp(proto, sv->s_proto) == 0) {
+		return (sv);
+	}
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "getservbyport %d %s",
+				 ntohs((short)port), proto) != 0) {
+		return (NULL);
+	}
+
+	if (irs_irp_get_full_response(pvt->girpdata, &code,
+				      text, sizeof text,
+				      &body, &bodylen) != 0) {
+		return (NULL);
+	}
+
+	if (code == IRPD_GETSERVICE_OK) {
+		free_service(sv);
+		if (irp_unmarshall_sv(sv, body) != 0) {
+			sv = NULL;
+		}
+	} else {
+		sv = NULL;
+	}
+
+	if (body != NULL) {
+		memput(body, bodylen);
+	}
+
+	return (sv);
+}
+
+/*%
+ * void sv_rewind(struct irs_sv *this)
+ *
+ */
+
+static void
+sv_rewind(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char text[256];
+	int code;
+
+	if (irs_irp_connection_setup(pvt->girpdata, &pvt->warned) != 0) {
+		return;
+	}
+
+	if (irs_irp_send_command(pvt->girpdata, "setservent") != 0) {
+		return;
+	}
+
+	code = irs_irp_read_response(pvt->girpdata, text, sizeof text);
+	if (code != IRPD_GETSERVICE_SETOK) {
+		if (irp_log_errors) {
+			syslog(LOG_WARNING, "setservent failed: %s", text);
+		}
+	}
+
+	return;
+}
+
+/*%
+ * void sv_minimize(struct irs_sv *this)
+ *
+ */
+
+static void
+sv_minimize(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	irs_irp_disconnect(pvt->girpdata);
+}
+
+
+
+
+
+
+static void
+free_service(struct servent *sv) {
+	char **p;
+
+	if (sv == NULL) {
+		return;
+	}
+
+	if (sv->s_name != NULL) {
+		free(sv->s_name);
+	}
+
+	for (p = sv->s_aliases ; p != NULL && *p != NULL ; p++) {
+		free(*p);
+	}
+
+	if (sv->s_proto != NULL) {
+		free(sv->s_proto);
+	}
+}
+
+
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irpmarshall.c b/usr/src/lib/libresolv2_joy/common/irs/irpmarshall.c
new file mode 100644
index 0000000000..85ffff1866
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irpmarshall.c
@@ -0,0 +1,2301 @@
+/*
+ * Copyright(c) 1989, 1993, 1995
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: irpmarshall.c,v 1.7 2006/03/09 23:57:56 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#if 0
+
+Check values are in approrpriate endian order.
+
+Double check memory allocations on unmarhsalling
+
+#endif
+
+
+/* Extern */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <stdio.h>
+#include <ctype.h>
+#include <pwd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+#include <utmp.h>
+#include <unistd.h>
+#include <assert.h>
+#include <errno.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+#include <isc/irpmarshall.h>
+
+#include "port_after.h"
+
+
+#ifndef HAVE_STRNDUP
+static char    *strndup(const char *str, size_t len);
+#endif
+
+static char   **splitarray(const char *buffer, const char *buffend, char delim);
+static int	joinarray(char * const * argv, char *buffer, char delim);
+static char    *getfield(char **res, size_t reslen, char **buffer, char delim);
+static size_t	joinlength(char * const *argv);
+static void	free_array(char **argv, size_t entries);
+
+#define ADDR_T_STR(x) (x == AF_INET ? "AF_INET" :\
+		       (x == AF_INET6 ? "AF_INET6" : "UNKNOWN"))
+
+#define MAXPADDRSIZE (sizeof "255.255.255.255" + 1)
+
+static char COMMA = ',';
+
+static const char *COMMASTR = ",";
+static const char *COLONSTR = ":";
+
+
+
+/* See big comment at bottom of irpmarshall.h for description. */
+
+
+#ifdef WANT_IRS_PW
+/* +++++++++++++++++++++++++ struct passwd +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_pw(const struct passwd *pw, char **buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h
+ *
+ * return: \li
+ *
+ *	0 on sucess, -1 on failure.
+ *
+ */
+
+int
+irp_marshall_pw(const struct passwd *pw, char **buffer, size_t *len) {
+	size_t need = 1 ;		/*%< for null byte */
+	char pwUid[24];
+	char pwGid[24];
+	char pwChange[24];
+	char pwExpire[24];
+	const char *pwClass;
+	const char *fieldsep = COLONSTR;
+
+	if (pw == NULL || len == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	sprintf(pwUid, "%ld", (long)pw->pw_uid);
+	sprintf(pwGid, "%ld", (long)pw->pw_gid);
+
+#ifdef HAVE_PW_CHANGE
+	sprintf(pwChange, "%ld", (long)pw->pw_change);
+#else
+	pwChange[0] = '0';
+	pwChange[1] = '\0';
+#endif
+
+#ifdef HAVE_PW_EXPIRE
+	sprintf(pwExpire, "%ld", (long)pw->pw_expire);
+#else
+	pwExpire[0] = '0';
+	pwExpire[1] = '\0';
+#endif
+
+#ifdef HAVE_PW_CLASS
+	pwClass = pw->pw_class;
+#else
+	pwClass = "";
+#endif
+
+	need += strlen(pw->pw_name)	+ 1; /*%< one for fieldsep */
+	need += strlen(pw->pw_passwd)	+ 1;
+	need += strlen(pwUid)		+ 1;
+	need += strlen(pwGid)		+ 1;
+	need += strlen(pwClass)		+ 1;
+	need += strlen(pwChange)	+ 1;
+	need += strlen(pwExpire)	+ 1;
+	need += strlen(pw->pw_gecos)	+ 1;
+	need += strlen(pw->pw_dir)	+ 1;
+	need += strlen(pw->pw_shell)	+ 1;
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	}
+
+	if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+	}
+
+	strcpy(*buffer, pw->pw_name);		strcat(*buffer, fieldsep);
+	strcat(*buffer, pw->pw_passwd);		strcat(*buffer, fieldsep);
+	strcat(*buffer, pwUid);			strcat(*buffer, fieldsep);
+	strcat(*buffer, pwGid);			strcat(*buffer, fieldsep);
+	strcat(*buffer, pwClass);		strcat(*buffer, fieldsep);
+	strcat(*buffer, pwChange);		strcat(*buffer, fieldsep);
+	strcat(*buffer, pwExpire);		strcat(*buffer, fieldsep);
+	strcat(*buffer, pw->pw_gecos);		strcat(*buffer, fieldsep);
+	strcat(*buffer, pw->pw_dir);		strcat(*buffer, fieldsep);
+	strcat(*buffer, pw->pw_shell);		strcat(*buffer, fieldsep);
+
+	return (0);
+}
+
+/*%
+ * int irp_unmarshall_pw(struct passwd *pw, char *buffer)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h
+ *
+ * return: \li
+ *
+ *	0 on success, -1 on failure
+ *
+ */
+
+int
+irp_unmarshall_pw(struct passwd *pw, char *buffer) {
+	char *name, *pass, *class, *gecos, *dir, *shell;
+	uid_t pwuid;
+	gid_t pwgid;
+	time_t pwchange;
+	time_t pwexpire;
+	char *p;
+	long t;
+	char tmpbuf[24];
+	char *tb = &tmpbuf[0];
+	char fieldsep = ':';
+	int myerrno = EINVAL;
+
+	name = pass = class = gecos = dir = shell = NULL;
+	p = buffer;
+
+	/* pw_name field */
+	name = NULL;
+	if (getfield(&name, 0, &p, fieldsep) == NULL || strlen(name) == 0) {
+		goto error;
+	}
+
+	/* pw_passwd field */
+	pass = NULL;
+	if (getfield(&pass, 0, &p, fieldsep) == NULL) { /*%< field can be empty */
+		goto error;
+	}
+
+
+	/* pw_uid field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	pwuid = (uid_t)t;
+	if ((long) pwuid != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+
+
+
+	/* pw_gid field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	pwgid = (gid_t)t;
+	if ((long)pwgid != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+
+
+
+	/* pw_class field */
+	class = NULL;
+	if (getfield(&class, 0, &p, fieldsep) == NULL) {
+		goto error;
+	}
+
+
+
+	/* pw_change field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	pwchange = (time_t)t;
+	if ((long)pwchange != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+
+
+
+	/* pw_expire field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	pwexpire = (time_t)t;
+	if ((long) pwexpire != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+
+
+
+	/* pw_gecos field */
+	gecos = NULL;
+	if (getfield(&gecos, 0, &p, fieldsep) == NULL) {
+		goto error;
+	}
+
+
+
+	/* pw_dir field */
+	dir = NULL;
+	if (getfield(&dir, 0, &p, fieldsep) == NULL) {
+		goto error;
+	}
+
+
+
+	/* pw_shell field */
+	shell = NULL;
+	if (getfield(&shell, 0, &p, fieldsep) == NULL) {
+		goto error;
+	}
+
+
+
+	pw->pw_name = name;
+	pw->pw_passwd = pass;
+	pw->pw_uid = pwuid;
+	pw->pw_gid = pwgid;
+	pw->pw_gecos = gecos;
+	pw->pw_dir = dir;
+	pw->pw_shell = shell;
+
+#ifdef HAVE_PW_CHANGE
+	pw->pw_change = pwchange;
+#endif
+#ifdef HAVE_PW_CLASS
+	pw->pw_class = class;
+#endif
+#ifdef HAVE_PW_EXPIRE
+	pw->pw_expire = pwexpire;
+#endif
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (name != NULL) free(name);
+	if (pass != NULL) free(pass);
+	if (gecos != NULL) free(gecos);
+	if (dir != NULL) free(dir);
+	if (shell != NULL) free(shell);
+
+	return (-1);
+}
+
+/* ------------------------- struct passwd ------------------------- */
+#endif /* WANT_IRS_PW */
+/* +++++++++++++++++++++++++ struct group +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_gr(const struct group *gr, char **buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h.
+ *
+ * return: \li
+ *
+ *	0 on success, -1 on failure
+ */
+
+int
+irp_marshall_gr(const struct group *gr, char **buffer, size_t *len) {
+	size_t need = 1;	/*%< for null byte */
+	char grGid[24];
+	const char *fieldsep = COLONSTR;
+
+	if (gr == NULL || len == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	sprintf(grGid, "%ld", (long)gr->gr_gid);
+
+	need += strlen(gr->gr_name) + 1;
+#ifndef MISSING_GR_PASSWD
+	need += strlen(gr->gr_passwd) + 1;
+#else
+	need++;
+#endif
+	need += strlen(grGid) + 1;
+	need += joinlength(gr->gr_mem) + 1;
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	}
+
+	if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+	}
+
+	strcpy(*buffer, gr->gr_name);		strcat(*buffer, fieldsep);
+#ifndef MISSING_GR_PASSWD
+	strcat(*buffer, gr->gr_passwd);
+#endif
+	strcat(*buffer, fieldsep);
+	strcat(*buffer, grGid);			strcat(*buffer, fieldsep);
+	joinarray(gr->gr_mem, *buffer, COMMA) ;	strcat(*buffer, fieldsep);
+
+	return (0);
+}
+
+/*%
+ * int irp_unmarshall_gr(struct group *gr, char *buffer)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h
+ *
+ * return: \li
+ *
+ *	0 on success and -1 on failure.
+ *
+ */
+
+int
+irp_unmarshall_gr(struct group *gr, char *buffer) {
+	char *p, *q;
+	gid_t grgid;
+	long t;
+	char *name = NULL;
+	char *pass = NULL;
+	char **members = NULL;
+	char tmpbuf[24];
+	char *tb;
+	char fieldsep = ':';
+	int myerrno = EINVAL;
+
+	if (gr == NULL || buffer == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	p = buffer;
+
+	/* gr_name field */
+	name = NULL;
+	if (getfield(&name, 0, &p, fieldsep) == NULL || strlen(name) == 0U) {
+		goto error;
+	}
+
+
+	/* gr_passwd field */
+	pass = NULL;
+	if (getfield(&pass, 0, &p, fieldsep) == NULL) {
+		goto error;
+	}
+
+
+	/* gr_gid field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	grgid = (gid_t)t;
+	if ((long) grgid != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+
+
+	/* gr_mem field. Member names are separated by commas */
+	q = strchr(p, fieldsep);
+	if (q == NULL) {
+		goto error;
+	}
+	members = splitarray(p, q, COMMA);
+	if (members == NULL) {
+		myerrno = errno;
+		goto error;
+	}
+	p = q + 1;
+
+
+	gr->gr_name = name;
+#ifndef MISSING_GR_PASSWD
+	gr->gr_passwd = pass;
+#endif
+	gr->gr_gid = grgid;
+	gr->gr_mem = members;
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (name != NULL) free(name);
+	if (pass != NULL) free(pass);
+
+	return (-1);
+}
+
+
+/* ------------------------- struct group ------------------------- */
+
+
+
+
+/* +++++++++++++++++++++++++ struct servent +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_sv(const struct servent *sv, char **buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h
+ *
+ * return: \li
+ *
+ *	0 on success, -1 on failure.
+ *
+ */
+
+int
+irp_marshall_sv(const struct servent *sv, char **buffer, size_t *len) {
+	size_t need = 1;	/*%< for null byte */
+	char svPort[24];
+	const char *fieldsep = COLONSTR;
+	short realport;
+
+	if (sv == NULL || len == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	/* the int s_port field is actually a short in network order. We
+	   want host order to make the marshalled data look correct */
+	realport = ntohs((short)sv->s_port);
+	sprintf(svPort, "%d", realport);
+
+	need += strlen(sv->s_name) + 1;
+	need += joinlength(sv->s_aliases) + 1;
+	need += strlen(svPort) + 1;
+	need += strlen(sv->s_proto) + 1;
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	}
+
+	if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+	}
+
+	strcpy(*buffer, sv->s_name);		strcat(*buffer, fieldsep);
+	joinarray(sv->s_aliases, *buffer, COMMA); strcat(*buffer, fieldsep);
+	strcat(*buffer, svPort);		strcat(*buffer, fieldsep);
+	strcat(*buffer, sv->s_proto);		strcat(*buffer, fieldsep);
+
+	return (0);
+}
+
+/*%
+ * int irp_unmarshall_sv(struct servent *sv, char *buffer)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h
+ *
+ * return: \li
+ *
+ *	0 on success, -1 on failure.
+ *
+ */
+
+int
+irp_unmarshall_sv(struct servent *sv, char *buffer) {
+	char *p, *q;
+	short svport;
+	long t;
+	char *name = NULL;
+	char *proto = NULL;
+	char **aliases = NULL;
+	char tmpbuf[24];
+	char *tb;
+	char fieldsep = ':';
+	int myerrno = EINVAL;
+
+	if (sv == NULL || buffer == NULL)
+		return (-1);
+
+	p = buffer;
+
+
+	/* s_name field */
+	name = NULL;
+	if (getfield(&name, 0, &p, fieldsep) == NULL || strlen(name) == 0U) {
+		goto error;
+	}
+
+
+	/* s_aliases field */
+	q = strchr(p, fieldsep);
+	if (q == NULL) {
+		goto error;
+	}
+	aliases = splitarray(p, q, COMMA);
+	if (aliases == NULL) {
+		myerrno = errno;
+		goto error;
+	}
+	p = q + 1;
+
+
+	/* s_port field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	svport = (short)t;
+	if ((long) svport != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+	svport = htons(svport);
+
+	/* s_proto field */
+	proto = NULL;
+	if (getfield(&proto, 0, &p, fieldsep) == NULL) {
+		goto error;
+	}
+
+	sv->s_name = name;
+	sv->s_aliases = aliases;
+	sv->s_port = svport;
+	sv->s_proto = proto;
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (name != NULL) free(name);
+	if (proto != NULL) free(proto);
+	free_array(aliases, 0);
+
+	return (-1);
+}
+
+
+/* ------------------------- struct servent ------------------------- */
+
+/* +++++++++++++++++++++++++ struct protoent +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_pr(struct protoent *pr, char **buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h
+ *
+ * return: \li
+ *
+ *	0 on success and -1 on failure.
+ *
+ */
+
+int
+irp_marshall_pr(struct protoent *pr, char **buffer, size_t *len) {
+	size_t need = 1;	/*%< for null byte */
+	char prProto[24];
+	const char *fieldsep = COLONSTR;
+
+	if (pr == NULL || len == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	sprintf(prProto, "%d", (int)pr->p_proto);
+
+	need += strlen(pr->p_name) + 1;
+	need += joinlength(pr->p_aliases) + 1;
+	need += strlen(prProto) + 1;
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	}
+
+	if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+	}
+
+	strcpy(*buffer, pr->p_name);		strcat(*buffer, fieldsep);
+	joinarray(pr->p_aliases, *buffer, COMMA); strcat(*buffer, fieldsep);
+	strcat(*buffer, prProto);		strcat(*buffer, fieldsep);
+
+	return (0);
+
+}
+
+/*%
+ * int irp_unmarshall_pr(struct protoent *pr, char *buffer)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h
+ *
+ * return: \li
+ *
+ *	0 on success, -1 on failure
+ *
+ */
+
+int irp_unmarshall_pr(struct protoent *pr, char *buffer) {
+	char *p, *q;
+	int prproto;
+	long t;
+	char *name = NULL;
+	char **aliases = NULL;
+	char tmpbuf[24];
+	char *tb;
+	char fieldsep = ':';
+	int myerrno = EINVAL;
+
+	if (pr == NULL || buffer == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	p = buffer;
+
+	/* p_name field */
+	name = NULL;
+	if (getfield(&name, 0, &p, fieldsep) == NULL || strlen(name) == 0U) {
+		goto error;
+	}
+
+
+	/* p_aliases field */
+	q = strchr(p, fieldsep);
+	if (q == NULL) {
+		goto error;
+	}
+	aliases = splitarray(p, q, COMMA);
+	if (aliases == NULL) {
+		myerrno = errno;
+		goto error;
+	}
+	p = q + 1;
+
+
+	/* p_proto field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	prproto = (int)t;
+	if ((long) prproto != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+
+	pr->p_name = name;
+	pr->p_aliases = aliases;
+	pr->p_proto = prproto;
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (name != NULL) free(name);
+	free_array(aliases, 0);
+
+	return (-1);
+}
+
+/* ------------------------- struct protoent ------------------------- */
+
+
+
+/* +++++++++++++++++++++++++ struct hostent +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_ho(struct hostent *ho, char **buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h.
+ *
+ * return: \li
+ *
+ *	0 on success, -1 on failure.
+ *
+ */
+
+int
+irp_marshall_ho(struct hostent *ho, char **buffer, size_t *len) {
+	size_t need = 1;	/*%< for null byte */
+	char hoaddrtype[24];
+	char holength[24];
+	char **av;
+	char *p;
+	int addrlen;
+	int malloced = 0;
+	size_t remlen;
+	const char *fieldsep = "@";
+
+	if (ho == NULL || len == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	switch(ho->h_addrtype) {
+	case AF_INET:
+		strcpy(hoaddrtype, "AF_INET");
+		break;
+
+	case AF_INET6:
+		strcpy(hoaddrtype, "AF_INET6");
+		break;
+
+	default:
+		errno = EINVAL;
+		return (-1);
+	}
+
+	sprintf(holength, "%d", ho->h_length);
+
+	need += strlen(ho->h_name) + 1;
+	need += joinlength(ho->h_aliases) + 1;
+	need += strlen(hoaddrtype) + 1;
+	need += strlen(holength) + 1;
+
+	/* we determine an upper bound on the string length needed, not an
+	   exact length. */
+	addrlen = (ho->h_addrtype == AF_INET ? 16 : 46) ; /*%< XX other AF's?? */
+	for (av = ho->h_addr_list; av != NULL && *av != NULL ; av++)
+		need += addrlen;
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	}
+
+	if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+		malloced = 1;
+	}
+
+	strcpy(*buffer, ho->h_name);		strcat(*buffer, fieldsep);
+	joinarray(ho->h_aliases, *buffer, COMMA); strcat(*buffer, fieldsep);
+	strcat(*buffer, hoaddrtype);		strcat(*buffer, fieldsep);
+	strcat(*buffer, holength);		strcat(*buffer, fieldsep);
+
+	p = *buffer + strlen(*buffer);
+	remlen = need - strlen(*buffer);
+	for (av = ho->h_addr_list ; av != NULL && *av != NULL ; av++) {
+		if (inet_ntop(ho->h_addrtype, *av, p, remlen) == NULL) {
+			goto error;
+		}
+		if (*(av + 1) != NULL)
+			strcat(p, COMMASTR);
+		remlen -= strlen(p);
+		p += strlen(p);
+	}
+	strcat(*buffer, fieldsep);
+
+	return (0);
+
+ error:
+	if (malloced) {
+		memput(*buffer, need);
+	}
+
+	return (-1);
+}
+
+/*%
+ * int irp_unmarshall_ho(struct hostent *ho, char *buffer)
+ *
+ * notes: \li
+ *
+ *	See irpmarshall.h.
+ *
+ * return: \li
+ *
+ *	0 on success, -1 on failure.
+ *
+ */
+
+int
+irp_unmarshall_ho(struct hostent *ho, char *buffer) {
+	char *p, *q, *r;
+	int hoaddrtype;
+	int holength;
+	long t;
+	char *name;
+	char **aliases = NULL;
+	char **hohaddrlist = NULL;
+	size_t hoaddrsize;
+	char tmpbuf[24];
+	char *tb;
+	char **alist;
+	int addrcount;
+	char fieldsep = '@';
+	int myerrno = EINVAL;
+
+	if (ho == NULL || buffer == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	p = buffer;
+
+	/* h_name field */
+	name = NULL;
+	if (getfield(&name, 0, &p, fieldsep) == NULL || strlen(name) == 0U) {
+		goto error;
+	}
+
+
+	/* h_aliases field */
+	q = strchr(p, fieldsep);
+	if (q == NULL) {
+		goto error;
+	}
+	aliases = splitarray(p, q, COMMA);
+	if (aliases == NULL) {
+		myerrno = errno;
+		goto error;
+	}
+	p = q + 1;
+
+
+	/* h_addrtype field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	if (strcmp(tmpbuf, "AF_INET") == 0)
+		hoaddrtype = AF_INET;
+	else if (strcmp(tmpbuf, "AF_INET6") == 0)
+		hoaddrtype = AF_INET6;
+	else
+		goto error;
+
+
+	/* h_length field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	t = strtol(tmpbuf, &tb, 10);
+	if (*tb) {
+		goto error;	/*%< junk in value */
+	}
+	holength = (int)t;
+	if ((long) holength != t) {	/*%< value must have been too big. */
+		goto error;
+	}
+
+
+	/* h_addr_list field */
+	q = strchr(p, fieldsep);
+	if (q == NULL)
+		goto error;
+
+	/* count how many addresss are in there */
+	if (q > p + 1) {
+		for (addrcount = 1, r = p ; r != q ; r++) {
+			if (*r == COMMA)
+				addrcount++;
+		}
+	} else {
+		addrcount = 0;
+	}
+
+	hoaddrsize = (addrcount + 1) * sizeof (char *);
+	hohaddrlist = malloc(hoaddrsize);
+	if (hohaddrlist == NULL) {
+		myerrno = ENOMEM;
+		goto error;
+	}
+
+	memset(hohaddrlist, 0x0, hoaddrsize);
+
+	alist = hohaddrlist;
+	for (t = 0, r = p ; r != q ; p = r + 1, t++) {
+		char saved;
+		while (r != q && *r != COMMA) r++;
+		saved = *r;
+		*r = 0x0;
+
+		alist[t] = malloc(hoaddrtype == AF_INET ? 4 : 16);
+		if (alist[t] == NULL) {
+			myerrno = ENOMEM;
+			goto error;
+		}
+
+		if (inet_pton(hoaddrtype, p, alist[t]) == -1)
+			goto error;
+		*r = saved;
+	}
+	alist[t] = NULL;
+
+	ho->h_name = name;
+	ho->h_aliases = aliases;
+	ho->h_addrtype = hoaddrtype;
+	ho->h_length = holength;
+	ho->h_addr_list = hohaddrlist;
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (name != NULL) free(name);
+	free_array(hohaddrlist, 0);
+	free_array(aliases, 0);
+
+	return (-1);
+}
+
+/* ------------------------- struct hostent------------------------- */
+
+
+
+/* +++++++++++++++++++++++++ struct netgrp +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_ng(const char *host, const char *user,
+ *		       const char *domain, char *buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See note for irp_marshall_ng_start
+ *
+ * return: \li
+ *
+ *	0 on success, 0 on failure.
+ *
+ */
+
+int
+irp_marshall_ng(const char *host, const char *user, const char *domain,
+		char **buffer, size_t *len) {
+	size_t need = 1; /*%< for nul byte */
+	const char *fieldsep = ",";
+
+	if (len == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	need += 4;		       /*%< two parens and two commas */
+	need += (host == NULL ? 0 : strlen(host));
+	need += (user == NULL ? 0 : strlen(user));
+	need += (domain == NULL ? 0 : strlen(domain));
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	} else if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+	}
+
+	(*buffer)[0] = '(';
+	(*buffer)[1] = '\0';
+
+	if (host != NULL)
+		strcat(*buffer, host);
+	strcat(*buffer, fieldsep);
+
+	if (user != NULL)
+		strcat(*buffer, user);
+	strcat(*buffer, fieldsep);
+
+	if (domain != NULL)
+		strcat(*buffer, domain);
+	strcat(*buffer, ")");
+
+	return (0);
+}
+
+
+
+/* ---------- */
+
+/*%
+ * int irp_unmarshall_ng(const char **host, const char **user,
+ *			 const char **domain, char *buffer)
+ *
+ * notes: \li
+ *
+ *	Unpacks the BUFFER into 3 character arrays it allocates and assigns
+ *	to *HOST, *USER and *DOMAIN. If any field of the value is empty,
+ *	then the corresponding paramater value will be set to NULL.
+ *
+ * return: \li
+ *
+ *	0 on success and -1 on failure.
+ */
+
+int
+irp_unmarshall_ng(const char **hostp, const char **userp, const char **domainp,
+		  char *buffer)
+{
+	char *p, *q;
+	char fieldsep = ',';
+	int myerrno = EINVAL;
+	char *host, *user, *domain;
+
+	if (userp == NULL || hostp == NULL ||
+	    domainp == NULL || buffer == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	host = user = domain = NULL;
+
+	p = buffer;
+	while (isspace((unsigned char)*p)) {
+		p++;
+	}
+	if (*p != '(') {
+		goto error;
+	}
+
+	q = p + 1;
+	while (*q && *q != fieldsep)
+		q++;
+	if (!*q) {
+		goto error;
+	} else if (q > p + 1) {
+		host = strndup(p, q - p);
+	}
+
+	p = q + 1;
+	if (!*p) {
+		goto error;
+	} else if (*p != fieldsep) {
+		q = p + 1;
+		while (*q && *q != fieldsep)
+			q++;
+		if (!*q) {
+			goto error;
+		}
+		user = strndup(p, q - p);
+	} else {
+		p++;
+	}
+
+	if (!*p) {
+		goto error;
+	} else if (*p != ')') {
+		q = p + 1;
+		while (*q && *q != ')')
+			q++;
+		if (!*q) {
+			goto error;
+		}
+		domain = strndup(p, q - p);
+	}
+	*hostp = host;
+	*userp = user;
+	*domainp = domain;
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (host != NULL) free(host);
+	if (user != NULL) free(user);
+
+	return (-1);
+}
+
+/* ------------------------- struct netgrp ------------------------- */
+
+
+
+
+/* +++++++++++++++++++++++++ struct nwent +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_nw(struct nwent *ne, char **buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See at top.
+ *
+ * return: \li
+ *
+ *	0 on success and -1 on failure.
+ *
+ */
+
+int
+irp_marshall_nw(struct nwent *ne, char **buffer, size_t *len) {
+	size_t need = 1;	/*%< for null byte */
+	char nAddrType[24];
+	char nNet[MAXPADDRSIZE];
+	const char *fieldsep = COLONSTR;
+
+	if (ne == NULL || len == NULL) {
+		return (-1);
+	}
+
+	strcpy(nAddrType, ADDR_T_STR(ne->n_addrtype));
+
+	if (inet_net_ntop(ne->n_addrtype, ne->n_addr, ne->n_length,
+			  nNet, sizeof nNet) == NULL) {
+		return (-1);
+	}
+
+
+	need += strlen(ne->n_name) + 1;
+	need += joinlength(ne->n_aliases) + 1;
+	need += strlen(nAddrType) + 1;
+	need += strlen(nNet) + 1;
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	}
+
+	if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+	}
+
+	strcpy(*buffer, ne->n_name);		strcat(*buffer, fieldsep);
+	joinarray(ne->n_aliases, *buffer, COMMA) ; strcat(*buffer, fieldsep);
+	strcat(*buffer, nAddrType);		strcat(*buffer, fieldsep);
+	strcat(*buffer, nNet);			strcat(*buffer, fieldsep);
+
+	return (0);
+}
+
+/*%
+ * int irp_unmarshall_nw(struct nwent *ne, char *buffer)
+ *
+ * notes: \li
+ *
+ *	See note up top.
+ *
+ * return: \li
+ *
+ *	0 on success and -1 on failure.
+ *
+ */
+
+int
+irp_unmarshall_nw(struct nwent *ne, char *buffer) {
+	char *p, *q;
+	int naddrtype;
+	long nnet;
+	int bits;
+	char *name = NULL;
+	char **aliases = NULL;
+	char tmpbuf[24];
+	char *tb;
+	char fieldsep = ':';
+	int myerrno = EINVAL;
+
+	if (ne == NULL || buffer == NULL) {
+		goto error;
+	}
+
+	p = buffer;
+
+	/* n_name field */
+	name = NULL;
+	if (getfield(&name, 0, &p, fieldsep) == NULL || strlen(name) == 0U) {
+		goto error;
+	}
+
+
+	/* n_aliases field. Aliases are separated by commas */
+	q = strchr(p, fieldsep);
+	if (q == NULL) {
+		goto error;
+	}
+	aliases = splitarray(p, q, COMMA);
+	if (aliases == NULL) {
+		myerrno = errno;
+		goto error;
+	}
+	p = q + 1;
+
+
+	/* h_addrtype field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	if (strcmp(tmpbuf, "AF_INET") == 0)
+		naddrtype = AF_INET;
+	else if (strcmp(tmpbuf, "AF_INET6") == 0)
+		naddrtype = AF_INET6;
+	else
+		goto error;
+
+
+	/* n_net field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	nnet = 0;
+	bits = inet_net_pton(naddrtype, tmpbuf, &nnet, sizeof nnet);
+	if (bits < 0) {
+		goto error;
+	}
+
+	/* nnet = ntohl(nnet); */ /* keep in network order for nwent */
+
+	ne->n_name = name;
+	ne->n_aliases = aliases;
+	ne->n_addrtype = naddrtype;
+	ne->n_length = bits;
+	ne->n_addr = malloc(sizeof nnet);
+	if (ne->n_addr == NULL) {
+		goto error;
+	}
+
+	memcpy(ne->n_addr, &nnet, sizeof nnet);
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (name != NULL) free(name);
+	free_array(aliases, 0);
+
+	return (-1);
+}
+
+
+/* ------------------------- struct nwent ------------------------- */
+
+
+/* +++++++++++++++++++++++++ struct netent +++++++++++++++++++++++++ */
+
+/*%
+ * int irp_marshall_ne(struct netent *ne, char **buffer, size_t *len)
+ *
+ * notes: \li
+ *
+ *	See at top.
+ *
+ * return: \li
+ *
+ *	0 on success and -1 on failure.
+ *
+ */
+
+int
+irp_marshall_ne(struct netent *ne, char **buffer, size_t *len) {
+	size_t need = 1;	/*%< for null byte */
+	char nAddrType[24];
+	char nNet[MAXPADDRSIZE];
+	const char *fieldsep = COLONSTR;
+	long nval;
+
+	if (ne == NULL || len == NULL) {
+		return (-1);
+	}
+
+	strcpy(nAddrType, ADDR_T_STR(ne->n_addrtype));
+
+	nval = htonl(ne->n_net);
+	if (inet_ntop(ne->n_addrtype, &nval, nNet, sizeof nNet) == NULL) {
+		return (-1);
+	}
+
+	need += strlen(ne->n_name) + 1;
+	need += joinlength(ne->n_aliases) + 1;
+	need += strlen(nAddrType) + 1;
+	need += strlen(nNet) + 1;
+
+	if (buffer == NULL) {
+		*len = need;
+		return (0);
+	}
+
+	if (*buffer != NULL && need > *len) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (*buffer == NULL) {
+		need += 2;		/*%< for CRLF */
+		*buffer = memget(need);
+		if (*buffer == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+
+		*len = need;
+	}
+
+	strcpy(*buffer, ne->n_name);		strcat(*buffer, fieldsep);
+	joinarray(ne->n_aliases, *buffer, COMMA) ; strcat(*buffer, fieldsep);
+	strcat(*buffer, nAddrType);		strcat(*buffer, fieldsep);
+	strcat(*buffer, nNet);			strcat(*buffer, fieldsep);
+
+	return (0);
+}
+
+/*%
+ * int irp_unmarshall_ne(struct netent *ne, char *buffer)
+ *
+ * notes: \li
+ *
+ *	See note up top.
+ *
+ * return: \li
+ *
+ *	0 on success and -1 on failure.
+ *
+ */
+
+int
+irp_unmarshall_ne(struct netent *ne, char *buffer) {
+	char *p, *q;
+	int naddrtype;
+	long nnet;
+	int bits;
+	char *name = NULL;
+	char **aliases = NULL;
+	char tmpbuf[24];
+	char *tb;
+	char fieldsep = ':';
+	int myerrno = EINVAL;
+
+	if (ne == NULL || buffer == NULL) {
+		goto error;
+	}
+
+	p = buffer;
+
+	/* n_name field */
+	name = NULL;
+	if (getfield(&name, 0, &p, fieldsep) == NULL || strlen(name) == 0U) {
+		goto error;
+	}
+
+
+	/* n_aliases field. Aliases are separated by commas */
+	q = strchr(p, fieldsep);
+	if (q == NULL) {
+		goto error;
+	}
+	aliases = splitarray(p, q, COMMA);
+	if (aliases == NULL) {
+		myerrno = errno;
+		goto error;
+	}
+	p = q + 1;
+
+
+	/* h_addrtype field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	if (strcmp(tmpbuf, "AF_INET") == 0)
+		naddrtype = AF_INET;
+	else if (strcmp(tmpbuf, "AF_INET6") == 0)
+		naddrtype = AF_INET6;
+	else
+		goto error;
+
+
+	/* n_net field */
+	tb = tmpbuf;
+	if (getfield(&tb, sizeof tmpbuf, &p, fieldsep) == NULL ||
+	    strlen(tb) == 0U) {
+		goto error;
+	}
+	bits = inet_net_pton(naddrtype, tmpbuf, &nnet, sizeof nnet);
+	if (bits < 0) {
+		goto error;
+	}
+	nnet = ntohl(nnet);
+
+	ne->n_name = name;
+	ne->n_aliases = aliases;
+	ne->n_addrtype = naddrtype;
+	ne->n_net = nnet;
+
+	return (0);
+
+ error:
+	errno = myerrno;
+
+	if (name != NULL) free(name);
+	free_array(aliases, 0);
+
+	return (-1);
+}
+
+
+/* ------------------------- struct netent ------------------------- */
+
+
+/* =========================================================================== */
+
+/*%
+ * static char ** splitarray(const char *buffer, const char *buffend, char delim)
+ *
+ * notes: \li
+ *
+ *	Split a delim separated astring. Not allowed
+ *	to have two delims next to each other. BUFFER points to begining of
+ *	string, BUFFEND points to one past the end of the string
+ *	(i.e. points at where the null byte would be if null
+ *	terminated).
+ *
+ * return: \li
+ *
+ *	Returns a malloced array of pointers, each pointer pointing to a
+ *	malloced string. If BUFEER is an empty string, then return values is
+ *	array of 1 pointer that is NULL. Returns NULL on failure.
+ *
+ */
+
+static char **
+splitarray(const char *buffer, const char *buffend, char delim) {
+	const char *p, *q;
+	int count = 0;
+	char **arr = NULL;
+	char **aptr;
+
+	if (buffend < buffer)
+		return (NULL);
+	else if (buffend > buffer && *buffer == delim)
+		return (NULL);
+	else if (buffend > buffer && *(buffend - 1) == delim)
+		return (NULL);
+
+	/* count the number of field and make sure none are empty */
+	if (buffend > buffer + 1) {
+		for (count = 1, q = buffer ; q != buffend ; q++) {
+			if (*q == delim) {
+				if (q > buffer && (*(q - 1) == delim)) {
+					errno = EINVAL;
+					return (NULL);
+				}
+				count++;
+			}
+		}
+	}
+
+	if (count > 0) {
+		count++ ;		/*%< for NULL at end */
+		aptr = arr = malloc(count * sizeof (char *));
+		if (aptr == NULL) {
+			 errno = ENOMEM;
+			 return (NULL);
+		 }
+
+		memset(arr, 0x0, count * sizeof (char *));
+		for (p = buffer ; p < buffend ; p++) {
+			for (q = p ; *q != delim && q != buffend ; q++)
+				/* nothing */;
+			*aptr = strndup(p, q - p);
+
+			p = q;
+			aptr++;
+		}
+		*aptr = NULL;
+	} else {
+		arr = malloc(sizeof (char *));
+		if (arr == NULL) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+
+		*arr = NULL;
+	}
+
+	return (arr);
+}
+
+/*%
+ * static size_t joinlength(char * const *argv)
+ *
+ * return: \li
+ *
+ *	the number of bytes in all the arrays pointed at
+ *	by argv, including their null bytes(which will usually be turned
+ *	into commas).
+ *
+ *
+ */
+
+static size_t
+joinlength(char * const *argv) {
+	int len = 0;
+
+	while (argv && *argv) {
+		len += (strlen(*argv) + 1);
+		argv++;
+	}
+
+	return (len);
+}
+
+/*%
+ * int joinarray(char * const *argv, char *buffer, char delim)
+ *
+ * notes: \li
+ *
+ *	Copy all the ARGV strings into the end of BUFFER
+ *	separating them with DELIM.  BUFFER is assumed to have
+ *	enough space to hold everything and to be already null-terminated.
+ *
+ * return: \li
+ *
+ *	0 unless argv or buffer is NULL.
+ *
+ *
+ */
+
+static int
+joinarray(char * const *argv, char *buffer, char delim) {
+	char * const *p;
+	char sep[2];
+
+	if (argv == NULL || buffer == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	sep[0] = delim;
+	sep[1] = 0x0;
+
+	for (p = argv ; *p != NULL ; p++) {
+		strcat(buffer, *p);
+		if (*(p + 1) != NULL) {
+			strcat(buffer, sep);
+		}
+	}
+
+	return (0);
+}
+
+/*%
+ * static char * getfield(char **res, size_t reslen, char **ptr, char delim)
+ *
+ * notes: \li
+ *
+ *	Stores in *RES, which is a buffer of length RESLEN, a
+ *	copy of the bytes from *PTR up to and including the first
+ *	instance of DELIM. If *RES is NULL, then it will be
+ *	assigned a malloced buffer to hold the copy. *PTR is
+ *	modified to point at the found delimiter.
+ *
+ * return: \li
+ *
+ *	If there was no delimiter, then NULL is returned,
+ *	otherewise *RES is returned.
+ *
+ */
+
+static char *
+getfield(char **res, size_t reslen, char **ptr, char delim) {
+	char *q;
+
+	if (res == NULL || ptr == NULL || *ptr == NULL) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
+	q = strchr(*ptr, delim);
+
+	if (q == NULL) {
+		errno = EINVAL;
+		return (NULL);
+	} else {
+		if (*res == NULL) {
+			*res = strndup(*ptr, q - *ptr);
+		} else {
+			if ((size_t)(q - *ptr + 1) > reslen) { /*%< to big for res */
+				errno = EINVAL;
+				return (NULL);
+			} else {
+				strncpy(*res, *ptr, q - *ptr);
+				(*res)[q - *ptr] = 0x0;
+			}
+		}
+		*ptr = q + 1;
+	}
+
+	return (*res);
+}
+
+
+
+
+
+#ifndef HAVE_STRNDUP
+/*
+ * static char * strndup(const char *str, size_t len)
+ *
+ * notes: \li
+ *
+ *	like strdup, except do len bytes instead of the whole string. Always
+ *	null-terminates.
+ *
+ * return: \li
+ *
+ *	The newly malloced string.
+ *
+ */
+
+static char *
+strndup(const char *str, size_t len) {
+	char *p = malloc(len + 1);
+
+	if (p == NULL)
+		return (NULL);
+	strncpy(p, str, len);
+	p[len] = 0x0;
+	return (p);
+}
+#endif
+
+#if WANT_MAIN
+
+/*%
+ * static int strcmp_nws(const char *a, const char *b)
+ *
+ * notes: \li
+ *
+ *	do a strcmp, except uneven lengths of whitespace compare the same
+ *
+ * return: \li
+ *
+ */
+
+static int
+strcmp_nws(const char *a, const char *b) {
+	while (*a && *b) {
+		if (isspace(*a) && isspace(*b)) {
+			do {
+				a++;
+			} while (isspace(*a));
+			do {
+				b++;
+			} while (isspace(*b));
+		}
+		if (*a < *b)
+			return (-1);
+		else if (*a > *b)
+			return (1);
+
+		a++;
+		b++;;
+	}
+
+	if (*a == *b)
+		return (0);
+	else if (*a > *b)
+		return (1);
+	else
+		return (-1);
+}
+
+#endif
+
+/*%
+ * static void free_array(char **argv, size_t entries)
+ *
+ * notes: \li
+ *
+ *	Free argv and each of the pointers inside it. The end of
+ *	the array is when a NULL pointer is found inside. If
+ *	entries is > 0, then NULL pointers inside the array do
+ *	not indicate the end of the array.
+ *
+ */
+
+static void
+free_array(char **argv, size_t entries) {
+	char **p = argv;
+	int useEntries = (entries > 0U);
+
+	if (argv == NULL)
+		return;
+
+	while ((useEntries && entries > 0U) || *p) {
+		if (*p)
+			free(*p);
+		p++;
+		if (useEntries)
+			entries--;
+	}
+	free(argv);
+}
+
+
+
+
+
+/* ************************************************** */
+
+#if WANT_MAIN
+
+/*% takes an option to indicate what sort of marshalling(read the code) and
+   an argument. If the argument looks like a marshalled buffer(has a ':'
+   embedded) then it's unmarshalled and the remarshalled and the new string
+   is compared to the old one.
+*/
+
+int
+main(int argc, char **argv) {
+	char buffer[1024];
+	char *b = &buffer[0];
+	size_t len = sizeof buffer;
+	char option;
+
+	if (argc < 2 || argv[1][0] != '-')
+		exit(1);
+
+	option = argv[1][1];
+	argv++;
+	argc--;
+
+
+#if 0
+	{
+		char buff[10];
+		char *p = argv[1], *q = &buff[0];
+
+		while (getfield(&q, sizeof buff, &p, ':') != NULL) {
+			printf("field: \"%s\"\n", q);
+			p++;
+		}
+		printf("p is now \"%s\"\n", p);
+	}
+#endif
+
+#if 0
+	{
+		char **x = splitarray(argv[1], argv[1] + strlen(argv[1]),
+				      argv[2][0]);
+		char **p;
+
+		if (x == NULL)
+			printf("split failed\n");
+
+		for (p = x ; p != NULL && *p != NULL ; p++) {
+			printf("\"%s\"\n", *p);
+		}
+	}
+#endif
+
+#if 1
+	switch(option) {
+	case 'n': {
+		struct nwent ne;
+		int i;
+
+		if (strchr(argv[1], ':') != NULL) {
+			if (irp_unmarshall_nw(&ne, argv[1]) != 0) {
+				printf("Unmarhsalling failed\n");
+				exit(1);
+			}
+
+			printf("Name: \"%s\"\n", ne.n_name);
+			printf("Aliases:");
+			for (i = 0 ; ne.n_aliases[i] != NULL ; i++)
+				printf("\n\t\"%s\"", ne.n_aliases[i]);
+			printf("\nAddrtype: %s\n", ADDR_T_STR(ne.n_addrtype));
+			inet_net_ntop(ne.n_addrtype, ne.n_addr, ne.n_length,
+				      buffer, sizeof buffer);
+			printf("Net: \"%s\"\n", buffer);
+			*((long*)ne.n_addr) = htonl(*((long*)ne.n_addr));
+			inet_net_ntop(ne.n_addrtype, ne.n_addr, ne.n_length,
+				      buffer, sizeof buffer);
+			printf("Corrected Net: \"%s\"\n", buffer);
+		} else {
+			struct netent *np1 = getnetbyname(argv[1]);
+			ne.n_name = np1->n_name;
+			ne.n_aliases = np1->n_aliases;
+			ne.n_addrtype = np1->n_addrtype;
+			ne.n_addr = &np1->n_net;
+			ne.n_length = (IN_CLASSA(np1->n_net) ?
+				       8 :
+				       (IN_CLASSB(np1->n_net) ?
+					16 :
+					(IN_CLASSC(np1->n_net) ?
+					 24 : -1)));
+			np1->n_net = htonl(np1->n_net);
+			if (irp_marshall_nw(&ne, &b, &len) != 0) {
+				printf("Marshalling failed\n");
+			}
+			printf("%s\n", b);
+		}
+		break;
+	}
+
+
+	case 'r': {
+		char **hosts, **users, **domains;
+		size_t entries;
+		int i;
+		char *buff;
+		size_t size;
+		char *ngname;
+
+		if (strchr(argv[1], '(') != NULL) {
+			if (irp_unmarshall_ng(&ngname, &entries,
+					      &hosts, &users, &domains,
+					      argv[1]) != 0) {
+				printf("unmarshall failed\n");
+				exit(1);
+			}
+
+#define STRVAL(x) (x == NULL ? "*" : x)
+
+			printf("%s {\n", ngname);
+			for (i = 0 ; i < entries ; i++)
+				printf("\t\"%s\" : \"%s\" : \"%s\"\n",
+				       STRVAL(hosts[i]),
+				       STRVAL(users[i]),
+				       STRVAL(domains[i]));
+			printf("}\n\n\n");
+
+
+			irp_marshall_ng_start(ngname, NULL, &size);
+			for (i = 0 ; i < entries ; i++)
+				irp_marshall_ng_next(hosts[i], users[i],
+						     domains[i], NULL, &size);
+			irp_marshall_ng_end(NULL, &size);
+
+			buff = malloc(size);
+
+			irp_marshall_ng_start(ngname, buff, &size);
+			for (i = 0 ; i < entries ; i++) {
+				if (irp_marshall_ng_next(hosts[i], users[i],
+							 domains[i], buff,
+							 &size) != 0)
+					printf("next marshalling failed.\n");
+			}
+			irp_marshall_ng_end(buff, &size);
+
+			if (strcmp_nws(argv[1], buff) != 0) {
+				printf("compare failed:\n\t%s\n\t%s\n",
+				       buffer, argv[1]);
+			} else {
+				printf("compare ok\n");
+			}
+		} else {
+			char *h, *u, *d, *buff;
+			size_t size;
+
+			/* run through two times. First to figure out how
+			   much of a buffer we need. Second to do the
+			   actual marshalling */
+
+			setnetgrent(argv[1]);
+			irp_marshall_ng_start(argv[1], NULL, &size);
+			while (getnetgrent(&h, &u, &d) == 1)
+				irp_marshall_ng_next(h, u, d, NULL, &size);
+			irp_marshall_ng_end(NULL, &size);
+			endnetgrent(argv[1]);
+
+			buff = malloc(size);
+
+			setnetgrent(argv[1]);
+			if (irp_marshall_ng_start(argv[1], buff, &size) != 0)
+				printf("Marshalling start failed\n");
+
+			while (getnetgrent(&h, &u, &d) == 1) {
+				if (irp_marshall_ng_next(h, u, d, buff, &size)
+				    != 0) {
+					printf("Marshalling failed\n");
+				}
+			}
+
+			irp_marshall_ng_end(buff, &size);
+			endnetgrent();
+
+			printf("success: %s\n", buff);
+		}
+		break;
+	}
+
+
+
+	case 'h': {
+		struct hostent he, *hp;
+		int i;
+
+
+		if (strchr(argv[1], '@') != NULL) {
+			if (irp_unmarshall_ho(&he, argv[1]) != 0) {
+				printf("unmarshall failed\n");
+				exit(1);
+			}
+
+			printf("Host: \"%s\"\nAliases:", he.h_name);
+			for (i = 0 ; he.h_aliases[i] != NULL ; i++)
+				printf("\n\t\t\"%s\"", he.h_aliases[i]);
+			printf("\nAddr Type: \"%s\"\n",
+			       ADDR_T_STR(he.h_addrtype));
+			printf("Length: %d\nAddresses:", he.h_length);
+			for (i = 0 ; he.h_addr_list[i] != 0 ; i++) {
+				inet_ntop(he.h_addrtype, he.h_addr_list[i],
+					  buffer, sizeof buffer);
+				printf("\n\t\"%s\"\n", buffer);
+			}
+			printf("\n\n");
+
+			irp_marshall_ho(&he, &b, &len);
+			if (strcmp(argv[1], buffer) != 0) {
+				printf("compare failed:\n\t\"%s\"\n\t\"%s\"\n",
+				       buffer, argv[1]);
+			} else {
+				printf("compare ok\n");
+			}
+		} else {
+			if ((hp = gethostbyname(argv[1])) == NULL) {
+				perror("gethostbyname");
+				printf("\"%s\"\n", argv[1]);
+				exit(1);
+			}
+
+			if (irp_marshall_ho(hp, &b, &len) != 0) {
+				printf("irp_marshall_ho failed\n");
+				exit(1);
+			}
+
+			printf("success: \"%s\"\n", buffer);
+		}
+		break;
+	}
+
+
+	case 's': {
+		struct servent *sv;
+		struct servent sv1;
+
+		if (strchr(argv[1], ':') != NULL) {
+			sv = &sv1;
+			memset(sv, 0xef, sizeof (struct servent));
+			if (irp_unmarshall_sv(sv, argv[1]) != 0) {
+				printf("unmarshall failed\n");
+
+			}
+
+			irp_marshall_sv(sv, &b, &len);
+			if (strcmp(argv[1], buffer) != 0) {
+				printf("compare failed:\n\t\"%s\"\n\t\"%s\"\n",
+				       buffer, argv[1]);
+			} else {
+				printf("compare ok\n");
+			}
+		} else {
+			if ((sv = getservbyname(argv[1], argv[2])) == NULL) {
+				perror("getservent");
+				exit(1);
+			}
+
+			if (irp_marshall_sv(sv, &b, &len) != 0) {
+				printf("irp_marshall_sv failed\n");
+				exit(1);
+			}
+
+			printf("success: \"%s\"\n", buffer);
+		}
+		break;
+	}
+
+	case 'g': {
+		struct group *gr;
+		struct group gr1;
+
+		if (strchr(argv[1], ':') != NULL) {
+			gr = &gr1;
+			memset(gr, 0xef, sizeof (struct group));
+			if (irp_unmarshall_gr(gr, argv[1]) != 0) {
+				printf("unmarshall failed\n");
+
+			}
+
+			irp_marshall_gr(gr, &b, &len);
+			if (strcmp(argv[1], buffer) != 0) {
+				printf("compare failed:\n\t\"%s\"\n\t\"%s\"\n",
+				       buffer, argv[1]);
+			} else {
+				printf("compare ok\n");
+			}
+		} else {
+			if ((gr = getgrnam(argv[1])) == NULL) {
+				perror("getgrnam");
+				exit(1);
+			}
+
+			if (irp_marshall_gr(gr, &b, &len) != 0) {
+				printf("irp_marshall_gr failed\n");
+				exit(1);
+			}
+
+			printf("success: \"%s\"\n", buffer);
+		}
+		break;
+	}
+
+
+	case 'p': {
+		struct passwd *pw;
+		struct passwd pw1;
+
+		if (strchr(argv[1], ':') != NULL) {
+			pw = &pw1;
+			memset(pw, 0xef, sizeof (*pw));
+			if (irp_unmarshall_pw(pw, argv[1]) != 0) {
+				printf("unmarshall failed\n");
+				exit(1);
+			}
+
+			printf("User: \"%s\"\nPasswd: \"%s\"\nUid: %ld\nGid: %ld\n",
+			       pw->pw_name, pw->pw_passwd, (long)pw->pw_uid,
+			       (long)pw->pw_gid);
+			printf("Class: \"%s\"\nChange: %ld\nGecos: \"%s\"\n",
+			       pw->pw_class, (long)pw->pw_change, pw->pw_gecos);
+			printf("Shell: \"%s\"\nDirectory: \"%s\"\n",
+			       pw->pw_shell, pw->pw_dir);
+
+			pw = getpwnam(pw->pw_name);
+			irp_marshall_pw(pw, &b, &len);
+			if (strcmp(argv[1], buffer) != 0) {
+				printf("compare failed:\n\t\"%s\"\n\t\"%s\"\n",
+				       buffer, argv[1]);
+			} else {
+				printf("compare ok\n");
+			}
+		} else {
+			if ((pw = getpwnam(argv[1])) == NULL) {
+				perror("getpwnam");
+				exit(1);
+			}
+
+			if (irp_marshall_pw(pw, &b, &len) != 0) {
+				printf("irp_marshall_pw failed\n");
+				exit(1);
+			}
+
+			printf("success: \"%s\"\n", buffer);
+		}
+		break;
+	}
+
+	default:
+		printf("Wrong option: %c\n", option);
+		break;
+	}
+
+#endif
+
+	return (0);
+}
+
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irs_data.c b/usr/src/lib/libresolv2_joy/common/irs/irs_data.c
new file mode 100644
index 0000000000..f12ca20f38
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irs_data.c
@@ -0,0 +1,254 @@
+/*
+ * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: irs_data.c,v 1.12 2007/08/27 03:32:26 marka Exp $";
+#endif
+
+#include "port_before.h"
+
+#ifndef __BIND_NOSTATIC
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+#include <isc/memcluster.h>
+
+#ifdef DO_PTHREADS
+#include <pthread.h>
+#endif
+
+#include <irs.h>
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#include "irs_data.h"
+#undef _res
+#if !(__GLIBC__ > 2 || __GLIBC__ == 2 &&  __GLIBC_MINOR__ >= 3)
+#undef h_errno
+extern int h_errno;
+#endif
+
+extern struct __res_state _res;
+
+#ifdef	DO_PTHREADS
+static pthread_key_t	key;
+static int		once = 0;
+#else
+static struct net_data	*net_data;
+#endif
+
+void
+irs_destroy(void) {
+#ifndef DO_PTHREADS
+	if (net_data != NULL)
+		net_data_destroy(net_data);
+	net_data = NULL;
+#endif
+}
+
+void
+net_data_destroy(void *p) {
+	struct net_data *net_data = p;
+
+	res_ndestroy(net_data->res);
+	if (net_data->gr != NULL) {
+		(*net_data->gr->close)(net_data->gr);
+		net_data->gr = NULL;
+	}
+	if (net_data->pw != NULL) {
+		(*net_data->pw->close)(net_data->pw);
+		net_data->pw = NULL;
+	}
+	if (net_data->sv != NULL) {
+		(*net_data->sv->close)(net_data->sv);
+		net_data->sv = NULL;
+	}
+	if (net_data->pr != NULL) {
+		(*net_data->pr->close)(net_data->pr);
+		net_data->pr = NULL;
+	}
+	if (net_data->ho != NULL) {
+		(*net_data->ho->close)(net_data->ho);
+		net_data->ho = NULL;
+	}
+	if (net_data->nw != NULL) {
+		(*net_data->nw->close)(net_data->nw);
+		net_data->nw = NULL;
+	}
+	if (net_data->ng != NULL) {
+		(*net_data->ng->close)(net_data->ng);
+		net_data->ng = NULL;
+	}
+	if (net_data->ho_data != NULL) {
+		free(net_data->ho_data);
+		net_data->ho_data = NULL;
+	}
+	if (net_data->nw_data != NULL) {
+		free(net_data->nw_data);
+		net_data->nw_data = NULL;
+	}
+
+	(*net_data->irs->close)(net_data->irs);
+	memput(net_data, sizeof *net_data);
+}
+
+/*%
+ *  applications that need a specific config file other than
+ * _PATH_IRS_CONF should call net_data_init directly rather than letting
+ *   the various wrapper functions make the first call. - brister
+ */
+
+struct net_data *
+net_data_init(const char *conf_file) {
+#ifdef	DO_PTHREADS
+#ifndef LIBBIND_MUTEX_INITIALIZER
+#define LIBBIND_MUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER
+#endif
+	static pthread_mutex_t keylock = LIBBIND_MUTEX_INITIALIZER;
+	struct net_data *net_data;
+
+	if (!once) {
+		if (pthread_mutex_lock(&keylock) != 0)
+			return (NULL);
+		if (!once) {
+			if (pthread_key_create(&key, net_data_destroy) != 0) {
+				(void)pthread_mutex_unlock(&keylock);
+				return (NULL);
+			}
+			once = 1;
+		}
+		if (pthread_mutex_unlock(&keylock) != 0)
+			return (NULL);
+	}
+	net_data = pthread_getspecific(key);
+#endif
+
+	if (net_data == NULL) {
+		net_data = net_data_create(conf_file);
+		if (net_data == NULL)
+			return (NULL);
+#ifdef	DO_PTHREADS
+		if (pthread_setspecific(key, net_data) != 0) {
+			net_data_destroy(net_data);
+			return (NULL);
+		}
+#endif
+	}
+
+	return (net_data);
+}
+
+struct net_data *
+net_data_create(const char *conf_file) {
+	struct net_data *net_data;
+
+	net_data = memget(sizeof (struct net_data));
+	if (net_data == NULL)
+		return (NULL);
+	memset(net_data, 0, sizeof (struct net_data));
+
+	if ((net_data->irs = irs_gen_acc("", conf_file)) == NULL) {
+		memput(net_data, sizeof (struct net_data));
+		return (NULL);
+	}
+#ifndef DO_PTHREADS
+	(*net_data->irs->res_set)(net_data->irs, &_res, NULL);
+#endif
+
+	net_data->res = (*net_data->irs->res_get)(net_data->irs);
+	if (net_data->res == NULL) {
+		(*net_data->irs->close)(net_data->irs);
+		memput(net_data, sizeof (struct net_data));
+		return (NULL);
+	}
+
+	if ((net_data->res->options & RES_INIT) == 0U &&
+	    res_ninit(net_data->res) == -1) {
+		(*net_data->irs->close)(net_data->irs);
+		memput(net_data, sizeof (struct net_data));
+		return (NULL);
+	}
+
+	return (net_data);
+}
+
+void
+net_data_minimize(struct net_data *net_data) {
+	res_nclose(net_data->res);
+}
+
+#ifdef _REENTRANT
+struct __res_state *
+__res_state(void) {
+	/* NULL param here means use the default config file. */
+	struct net_data *net_data = net_data_init(NULL);
+	if (net_data && net_data->res)
+		return (net_data->res);
+
+	return (&_res);
+}
+#else
+#ifdef __linux
+struct __res_state *
+__res_state(void) {
+	return (&_res);
+}
+#endif
+#endif
+
+int *
+__h_errno(void) {
+	/* NULL param here means use the default config file. */
+	struct net_data *net_data = net_data_init(NULL);
+	if (net_data && net_data->res)
+		return (&net_data->res->res_h_errno);
+#ifdef	ORIGINAL_ISC_CODE
+#if !(__GLIBC__ > 2 || __GLIBC__ == 2 &&  __GLIBC_MINOR__ >= 3)
+	return(&_res.res_h_errno);
+#else
+	return (&h_errno);
+#endif
+#else
+	return (&h_errno);
+#endif	/* ORIGINAL_ISC_CODE */
+}
+
+void
+__h_errno_set(struct __res_state *res, int err) {
+
+
+#if (__GLIBC__ > 2 || __GLIBC__ == 2 &&  __GLIBC_MINOR__ >= 3)
+	res->res_h_errno = err;
+#else
+	h_errno = res->res_h_errno = err;
+#endif
+}
+
+#endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irs_data.h b/usr/src/lib/libresolv2_joy/common/irs/irs_data.h
new file mode 100644
index 0000000000..cb814fd8b1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irs_data.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: irs_data.h,v 1.3 2005/04/27 04:56:30 sra Exp $
+ */
+
+#ifndef __BIND_NOSTATIC
+
+#define	net_data_init		__net_data_init
+
+struct net_data {
+	struct irs_acc *	irs;
+
+	struct irs_gr *		gr;
+	struct irs_pw *		pw;
+	struct irs_sv *		sv;
+	struct irs_pr *		pr;
+	struct irs_ho *		ho;
+	struct irs_nw *		nw;
+	struct irs_ng *		ng;
+
+	struct group *		gr_last;
+	struct passwd *		pw_last;
+	struct servent *	sv_last;
+	struct protoent *	pr_last;
+	struct netent *		nw_last; /*%< should have been ne_last */
+	struct nwent *		nww_last;
+	struct hostent *	ho_last;
+
+	unsigned int		gr_stayopen :1;
+	unsigned int		pw_stayopen :1;
+	unsigned int		sv_stayopen :1;
+	unsigned int		pr_stayopen :1;
+	unsigned int		ho_stayopen :1;
+	unsigned int		nw_stayopen :1;
+
+	void *			nw_data;
+	void *			ho_data;
+
+	struct __res_state *	res;	/*%< for gethostent.c */
+};
+
+extern struct net_data *	net_data_init(const char *conf_file);
+extern void			net_data_minimize(struct net_data *);
+
+#endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/irs_p.h b/usr/src/lib/libresolv2_joy/common/irs/irs_p.h
new file mode 100644
index 0000000000..2a0a933fce
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/irs_p.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: irs_p.h,v 1.3 2005/04/27 04:56:30 sra Exp $
+ */
+
+#ifndef _IRS_P_H_INCLUDED
+#define _IRS_P_H_INCLUDED
+
+#include <stdio.h>
+
+#include "pathnames.h"
+
+#define IRS_SV_MAXALIASES	35
+
+struct lcl_sv {
+	FILE *		fp;
+	char		line[BUFSIZ+1];
+	struct servent	serv;
+	char *		serv_aliases[IRS_SV_MAXALIASES];
+};
+
+#define	irs_nul_ng	__irs_nul_ng
+#define	map_v4v6_address __map_v4v6_address
+#define	make_group_list	__make_group_list
+#define	irs_lclsv_fnxt	__irs_lclsv_fnxt
+
+extern void		map_v4v6_address(const char *src, char *dst);
+extern int		make_group_list(struct irs_gr *, const char *,
+					gid_t, gid_t *, int *);
+extern struct irs_ng *	irs_nul_ng(struct irs_acc *);
+extern struct servent * irs_lclsv_fnxt(struct lcl_sv *);
+
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/lcl.c b/usr/src/lib/libresolv2_joy/common/irs/lcl.c
new file mode 100644
index 0000000000..9dd6967b87
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/lcl.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: lcl.c,v 1.4 2005/04/27 04:56:30 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <stdlib.h>
+#include <errno.h>
+#include <string.h>
+
+#include <sys/types.h>
+#include <netinet/in.h> 
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <isc/memcluster.h>
+
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "lcl_p.h"
+
+/* Forward. */
+
+static void		lcl_close(struct irs_acc *);
+static struct __res_state *	lcl_res_get(struct irs_acc *);
+static void		lcl_res_set(struct irs_acc *, struct __res_state *,
+				void (*)(void *));
+
+/* Public */
+
+struct irs_acc *
+irs_lcl_acc(const char *options) {
+	struct irs_acc *acc;
+	struct lcl_p *lcl;
+
+	UNUSED(options);
+
+	if (!(acc = memget(sizeof *acc))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(acc, 0x5e, sizeof *acc);
+	if (!(lcl = memget(sizeof *lcl))) {
+		errno = ENOMEM;
+		free(acc);
+		return (NULL);
+	}
+	memset(lcl, 0x5e, sizeof *lcl);
+	lcl->res = NULL;
+	lcl->free_res = NULL;
+	acc->private = lcl;
+#ifdef WANT_IRS_GR
+	acc->gr_map = irs_lcl_gr;
+#else
+	acc->gr_map = NULL;
+#endif
+#ifdef WANT_IRS_PW
+	acc->pw_map = irs_lcl_pw;
+#else
+	acc->pw_map = NULL;
+#endif
+	acc->sv_map = irs_lcl_sv;
+	acc->pr_map = irs_lcl_pr;
+	acc->ho_map = irs_lcl_ho;
+	acc->nw_map = irs_lcl_nw;
+	acc->ng_map = irs_lcl_ng;
+	acc->res_get = lcl_res_get;
+	acc->res_set = lcl_res_set;
+	acc->close = lcl_close;
+	return (acc);
+}
+
+/* Methods */
+static struct __res_state *
+lcl_res_get(struct irs_acc *this) {
+	struct lcl_p *lcl = (struct lcl_p *)this->private;
+
+	if (lcl->res == NULL) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (res == NULL)
+			return (NULL);
+		memset(res, 0, sizeof *res);
+		lcl_res_set(this, res, free);
+	}
+
+	if ((lcl->res->options & RES_INIT) == 0U &&
+	    res_ninit(lcl->res) < 0)
+		return (NULL);
+
+	return (lcl->res);
+}
+
+static void
+lcl_res_set(struct irs_acc *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct lcl_p *lcl = (struct lcl_p *)this->private;
+
+	if (lcl->res && lcl->free_res) {
+		res_nclose(lcl->res);
+		(*lcl->free_res)(lcl->res);
+	}
+
+	lcl->res = res;
+	lcl->free_res = free_res;
+}
+
+static void
+lcl_close(struct irs_acc *this) {
+	struct lcl_p *lcl = (struct lcl_p *)this->private;
+
+	if (lcl) {
+		if (lcl->free_res)
+			(*lcl->free_res)(lcl->res);
+		memput(lcl, sizeof *lcl);
+	}
+	memput(this, sizeof *this);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/lcl_ho.c b/usr/src/lib/libresolv2_joy/common/irs/lcl_ho.c
new file mode 100644
index 0000000000..17c9a5e725
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/lcl_ho.c
@@ -0,0 +1,578 @@
+/*
+ * Copyright (c) 1985, 1988, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* from gethostnamadr.c	8.1 (Berkeley) 6/4/93 */
+/* BIND Id: gethnamaddr.c,v 8.15 1996/05/22 04:56:30 vixie Exp $ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: lcl_ho.c,v 1.5 2006/03/09 23:57:56 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* Imports. */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "dns_p.h"
+#include "lcl_p.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) sprintf x
+#endif
+
+/* Definitions. */
+
+#define	MAXALIASES	35
+#define	MAXADDRS	35
+#define	Max(a,b)	((a) > (b) ? (a) : (b))
+
+#if PACKETSZ > 1024
+#define	MAXPACKET	PACKETSZ
+#else
+#define	MAXPACKET	1024
+#endif
+
+struct pvt {
+	FILE *		fp;
+	struct hostent	host;
+	char *		h_addr_ptrs[MAXADDRS + 1];
+	char *		host_aliases[MAXALIASES];
+	char		hostbuf[8*1024];
+	u_char		host_addr[16];	/*%< IPv4 or IPv6 */
+	struct __res_state  *res;
+	void		(*free_res)(void *);
+};
+
+typedef union {
+	int32_t al;
+	char ac;
+} align;
+
+static const u_char mapped[] = { 0,0, 0,0, 0,0, 0,0, 0,0, 0xff,0xff };
+static const u_char tunnelled[] = { 0,0, 0,0, 0,0, 0,0, 0,0, 0,0 };
+
+/* Forward. */
+
+static void		ho_close(struct irs_ho *this);
+static struct hostent *	ho_byname(struct irs_ho *this, const char *name);
+static struct hostent *	ho_byname2(struct irs_ho *this, const char *name,
+				   int af);
+static struct hostent *	ho_byaddr(struct irs_ho *this, const void *addr,
+				  int len, int af);
+static struct hostent *	ho_next(struct irs_ho *this);
+static void		ho_rewind(struct irs_ho *this);
+static void		ho_minimize(struct irs_ho *this);
+static struct __res_state * ho_res_get(struct irs_ho *this);
+static void		ho_res_set(struct irs_ho *this,
+				   struct __res_state *res,
+				   void (*free_res)(void *));
+static struct addrinfo * ho_addrinfo(struct irs_ho *this, const char *name,
+				     const struct addrinfo *pai);
+
+static size_t		ns_namelen(const char *);
+static int		init(struct irs_ho *this);
+
+/* Portability. */
+
+#ifndef SEEK_SET
+# define SEEK_SET 0
+#endif
+
+/* Public. */
+
+struct irs_ho *
+irs_lcl_ho(struct irs_acc *this) {
+	struct irs_ho *ho;
+	struct pvt *pvt;
+
+	UNUSED(this);
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	if (!(ho = memget(sizeof *ho))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ho, 0x5e, sizeof *ho);
+	ho->private = pvt;
+	ho->close = ho_close;
+	ho->byname = ho_byname;
+	ho->byname2 = ho_byname2;
+	ho->byaddr = ho_byaddr;
+	ho->next = ho_next;
+	ho->rewind = ho_rewind;
+	ho->minimize = ho_minimize;
+	ho->res_get = ho_res_get;
+	ho->res_set = ho_res_set;
+	ho->addrinfo = ho_addrinfo;
+	return (ho);
+}
+
+/* Methods. */
+
+static void
+ho_close(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	ho_minimize(this);
+	if (pvt->fp)
+		(void) fclose(pvt->fp);
+	if (pvt->res && pvt->free_res)
+		(*pvt->free_res)(pvt->res);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct hostent *
+ho_byname(struct irs_ho *this, const char *name) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *hp;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	if (pvt->res->options & RES_USE_INET6) {
+		hp = ho_byname2(this, name, AF_INET6);
+		if (hp)
+			return (hp);
+	}
+	return (ho_byname2(this, name, AF_INET));
+}
+
+static struct hostent *
+ho_byname2(struct irs_ho *this, const char *name, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *hp;
+	char **hap;
+	size_t n;
+	
+	if (init(this) == -1)
+		return (NULL);
+
+	ho_rewind(this);
+	n = ns_namelen(name);
+	while ((hp = ho_next(this)) != NULL) {
+		size_t nn;
+
+		if (hp->h_addrtype != af)
+			continue;
+		nn = ns_namelen(hp->h_name);
+		if (strncasecmp(hp->h_name, name, Max(n, nn)) == 0)
+			goto found;
+		for (hap = hp->h_aliases; *hap; hap++) {
+			nn = ns_namelen(*hap);
+			if (strncasecmp(*hap, name, Max(n, nn)) == 0)
+				goto found;
+		}
+	}
+ found:
+	if (!hp) {
+		RES_SET_H_ERRNO(pvt->res, HOST_NOT_FOUND);
+		return (NULL);
+	}
+	RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
+	return (hp);
+}
+
+static struct hostent *
+ho_byaddr(struct irs_ho *this, const void *addr, int len, int af) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	const u_char *uaddr = addr;
+	struct hostent *hp;
+	int size;
+	
+	if (init(this) == -1)
+		return (NULL);
+
+	if (af == AF_INET6 && len == IN6ADDRSZ &&
+	    (!memcmp(uaddr, mapped, sizeof mapped) ||
+	     !memcmp(uaddr, tunnelled, sizeof tunnelled))) {
+		/* Unmap. */
+		addr = (const u_char *)addr + sizeof mapped;
+		uaddr += sizeof mapped;
+		af = AF_INET;
+		len = INADDRSZ;
+	}
+	switch (af) {
+	case AF_INET:
+		size = INADDRSZ;
+		break;
+	case AF_INET6:
+		size = IN6ADDRSZ;
+		break;
+	default:
+		errno = EAFNOSUPPORT;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	if (size > len) {
+		errno = EINVAL;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+
+	/*
+	 * Do the search.
+	 */
+	ho_rewind(this);
+	while ((hp = ho_next(this)) != NULL) {
+		char **hap;
+
+		for (hap = hp->h_addr_list; *hap; hap++) {
+			const u_char *taddr = (const u_char *)*hap;
+			int taf = hp->h_addrtype;
+			int tlen = hp->h_length;
+
+			if (taf == AF_INET6 && tlen == IN6ADDRSZ &&
+			    (!memcmp(taddr, mapped, sizeof mapped) ||
+			     !memcmp(taddr, tunnelled, sizeof tunnelled))) {
+				/* Unmap. */
+				taddr += sizeof mapped;
+				taf = AF_INET;
+				tlen = INADDRSZ;
+			}
+			if (taf == af && tlen == len &&
+			    !memcmp(taddr, uaddr, tlen))
+				goto found;
+		}
+	}
+ found:
+	if (!hp) {
+		RES_SET_H_ERRNO(pvt->res, HOST_NOT_FOUND);
+		return (NULL);
+	}
+	RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
+	return (hp);
+}
+
+static struct hostent *
+ho_next(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char *cp, **q, *p;
+	char *bufp, *ndbuf, *dbuf = NULL;
+	int c, af, len, bufsiz, offset;
+
+	if (init(this) == -1)
+		return (NULL);
+
+	if (!pvt->fp)
+		ho_rewind(this);
+	if (!pvt->fp) {
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	bufp = pvt->hostbuf;
+	bufsiz = sizeof pvt->hostbuf;
+	offset = 0;
+ again:
+	if (!(p = fgets(bufp + offset, bufsiz - offset, pvt->fp))) {
+		RES_SET_H_ERRNO(pvt->res, HOST_NOT_FOUND);
+		if (dbuf)
+			free(dbuf);
+		return (NULL);
+	}
+	if (!strchr(p, '\n') && !feof(pvt->fp)) {
+#define GROWBUF 1024
+		/* allocate space for longer line */
+		if (dbuf == NULL) {
+			if ((ndbuf = malloc(bufsiz + GROWBUF)) != NULL)
+				strcpy(ndbuf, bufp);
+		} else
+			ndbuf = realloc(dbuf, bufsiz + GROWBUF);
+		if (ndbuf) {
+			dbuf = ndbuf;
+			bufp = dbuf;
+			bufsiz += GROWBUF;
+			offset = strlen(dbuf);
+		} else {
+			/* allocation failed; skip this long line */
+			while ((c = getc(pvt->fp)) != EOF)
+				if (c == '\n')
+					break;
+			if (c != EOF)
+				ungetc(c, pvt->fp);
+		}
+		goto again;
+	}
+
+	p -= offset;
+	offset = 0;
+
+	if (*p == '#')
+		goto again;
+	if ((cp = strpbrk(p, "#\n")) != NULL)
+		*cp = '\0';
+	if (!(cp = strpbrk(p, " \t")))
+		goto again;
+	*cp++ = '\0';
+	if (inet_pton(AF_INET6, p, pvt->host_addr) > 0) {
+		af = AF_INET6;
+		len = IN6ADDRSZ;
+	} else if (inet_aton(p, (struct in_addr *)pvt->host_addr) > 0) {
+		if (pvt->res->options & RES_USE_INET6) {
+			map_v4v6_address((char*)pvt->host_addr,
+					 (char*)pvt->host_addr);
+			af = AF_INET6;
+			len = IN6ADDRSZ;
+		} else {
+			af = AF_INET;
+			len = INADDRSZ;
+		}
+	} else {
+		goto again;
+	}
+	pvt->h_addr_ptrs[0] = (char *)pvt->host_addr;
+	pvt->h_addr_ptrs[1] = NULL;
+	pvt->host.h_addr_list = pvt->h_addr_ptrs;
+	pvt->host.h_length = len;
+	pvt->host.h_addrtype = af;
+	while (*cp == ' ' || *cp == '\t')
+		cp++;
+	pvt->host.h_name = cp;
+	q = pvt->host.h_aliases = pvt->host_aliases;
+	if ((cp = strpbrk(cp, " \t")) != NULL)
+		*cp++ = '\0';
+	while (cp && *cp) {
+		if (*cp == ' ' || *cp == '\t') {
+			cp++;
+			continue;
+		}
+		if (q < &pvt->host_aliases[MAXALIASES - 1])
+			*q++ = cp;
+		if ((cp = strpbrk(cp, " \t")) != NULL)
+			*cp++ = '\0';
+	}
+	*q = NULL;
+	if (dbuf)
+		free(dbuf);
+	RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
+	return (&pvt->host);
+}
+
+static void
+ho_rewind(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->fp) {
+		if (fseek(pvt->fp, 0L, SEEK_SET) == 0)
+			return;
+		(void)fclose(pvt->fp);
+	}
+	if (!(pvt->fp = fopen(_PATH_HOSTS, "r")))
+		return;
+	if (fcntl(fileno(pvt->fp), F_SETFD, 1) < 0) {
+		(void)fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+}
+
+static void
+ho_minimize(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->fp != NULL) {
+		(void)fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+	if (pvt->res)
+		res_nclose(pvt->res);
+} 
+
+static struct __res_state *
+ho_res_get(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		ho_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+static void
+ho_res_set(struct irs_ho *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+}
+
+struct lcl_res_target {
+	struct lcl_res_target *next;
+	int family;
+};
+
+/* XXX */
+extern struct addrinfo *hostent2addrinfo __P((struct hostent *,
+					      const struct addrinfo *pai));
+
+static struct addrinfo *
+ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct hostent *hp;
+	struct lcl_res_target q, q2, *p;
+	struct addrinfo sentinel, *cur;
+
+	memset(&q, 0, sizeof(q2));
+	memset(&q2, 0, sizeof(q2));
+	memset(&sentinel, 0, sizeof(sentinel));
+	cur = &sentinel;
+
+	switch(pai->ai_family) {
+	case AF_UNSPEC:		/*%< INET6 then INET4 */
+		q.family = AF_INET6;
+		q.next = &q2;
+		q2.family = AF_INET;
+		break;
+	case AF_INET6:
+		q.family = AF_INET6;
+		break;
+	case AF_INET:
+		q.family = AF_INET;
+		break;
+	default:
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /*%< ??? */
+		return(NULL);
+	}
+
+	for (p = &q; p; p = p->next) {
+		struct addrinfo *ai;
+
+		hp = (*this->byname2)(this, name, p->family);
+		if (hp == NULL) {
+			/* byname2 should've set an appropriate error */
+			continue;
+		}
+		if ((hp->h_name == NULL) || (hp->h_name[0] == 0) ||
+		    (hp->h_addr_list[0] == NULL)) {
+			RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
+			continue;
+		}
+
+		ai = hostent2addrinfo(hp, pai);
+		if (ai) {
+			cur->ai_next = ai;
+			while (cur->ai_next)
+				cur = cur->ai_next;
+		}
+	}
+
+	if (sentinel.ai_next == NULL)
+		RES_SET_H_ERRNO(pvt->res, HOST_NOT_FOUND);
+
+	return(sentinel.ai_next);
+}
+
+/* Private. */
+
+static size_t
+ns_namelen(const char *s) {
+	int i;
+
+	for (i = strlen(s); i > 0 && s[i-1] == '.'; i--)
+		(void)NULL;
+	return ((size_t) i);
+}
+
+static int
+init(struct irs_ho *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (!pvt->res && !ho_res_get(this))
+		return (-1);
+	if (((pvt->res->options & RES_INIT) == 0U) &&
+	    res_ninit(pvt->res) == -1)
+		return (-1);
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/lcl_ng.c b/usr/src/lib/libresolv2_joy/common/irs/lcl_ng.c
new file mode 100644
index 0000000000..319725ce70
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/lcl_ng.c
@@ -0,0 +1,446 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: lcl_ng.c,v 1.3 2005/04/27 04:56:31 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "lcl_p.h"
+
+/* Definitions */
+
+#define NG_HOST         0       /*%< Host name */
+#define NG_USER         1       /*%< User name */
+#define NG_DOM          2       /*%< and Domain name */
+#define LINSIZ		1024    /*%< Length of netgroup file line */
+/*
+ * XXX Warning XXX
+ * This code is a hack-and-slash special.  It realy needs to be
+ * rewritten with things like strdup, and realloc in mind.
+ * More reasonable data structures would not be a bad thing.
+ */
+
+/*%
+ * Static Variables and functions used by setnetgrent(), getnetgrent() and
+ * endnetgrent().
+ *
+ * There are two linked lists:
+ * \li linelist is just used by setnetgrent() to parse the net group file via.
+ *   parse_netgrp()
+ * \li netgrp is the list of entries for the current netgroup
+ */
+struct linelist {
+	struct linelist *l_next;	/*%< Chain ptr. */
+	int		l_parsed;	/*%< Flag for cycles */
+	char *		l_groupname;	/*%< Name of netgroup */
+	char *		l_line;		/*%< Netgroup entrie(s) to be parsed */
+};
+
+struct ng_old_struct {
+	struct ng_old_struct *ng_next;	/*%< Chain ptr */
+	char *		ng_str[3];	/*%< Field pointers, see below */
+};
+
+struct pvt {
+	FILE			*fp;
+	struct linelist		*linehead;
+	struct ng_old_struct    *nextgrp;
+	struct {
+		struct ng_old_struct	*gr;
+		char			*grname;
+	} grouphead;
+};
+
+/* Forward */
+
+static void 		ng_rewind(struct irs_ng *, const char*);
+static void 		ng_close(struct irs_ng *);
+static int		ng_next(struct irs_ng *, const char **,
+				const char **, const char **);
+static int 		ng_test(struct irs_ng *, const char *,
+				const char *, const char *,
+				const char *);
+static void		ng_minimize(struct irs_ng *);
+
+static int 		parse_netgrp(struct irs_ng *, const char*);
+static struct linelist *read_for_group(struct irs_ng *, const char *);
+static void		freelists(struct irs_ng *);
+
+/* Public */
+
+struct irs_ng *
+irs_lcl_ng(struct irs_acc *this) {
+	struct irs_ng *ng;
+	struct pvt *pvt;
+
+	UNUSED(this);
+	
+	if (!(ng = memget(sizeof *ng))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ng, 0x5e, sizeof *ng);
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(ng, sizeof *ng);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	ng->private = pvt;
+	ng->close = ng_close;
+	ng->next = ng_next;
+	ng->test = ng_test;
+	ng->rewind = ng_rewind;
+	ng->minimize = ng_minimize;
+	return (ng);
+}
+
+/* Methods */
+
+static void
+ng_close(struct irs_ng *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (pvt->fp != NULL)
+		fclose(pvt->fp);
+	freelists(this);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+	
+/*%
+ * Parse the netgroup file looking for the netgroup and build the list
+ * of netgrp structures. Let parse_netgrp() and read_for_group() do
+ * most of the work.
+ */
+static void
+ng_rewind(struct irs_ng *this, const char *group) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (pvt->fp != NULL && fseek(pvt->fp, SEEK_CUR, 0L) == -1) {
+		fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+
+	if (pvt->fp == NULL || pvt->grouphead.gr == NULL || 
+	    strcmp(group, pvt->grouphead.grname)) {
+		freelists(this);
+		if (pvt->fp != NULL)
+			fclose(pvt->fp);
+		pvt->fp = fopen(_PATH_NETGROUP, "r");
+		if (pvt->fp != NULL) {
+			if (parse_netgrp(this, group))
+				freelists(this);
+			if (!(pvt->grouphead.grname = strdup(group)))
+				freelists(this);
+			fclose(pvt->fp);
+			pvt->fp = NULL;
+		}
+	}
+	pvt->nextgrp = pvt->grouphead.gr;
+}
+
+/*%
+ * Get the next netgroup off the list.
+ */
+static int
+ng_next(struct irs_ng *this, const char **host, const char **user,
+	const char **domain)
+{
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (pvt->nextgrp) {
+		*host = pvt->nextgrp->ng_str[NG_HOST];
+		*user = pvt->nextgrp->ng_str[NG_USER];
+		*domain = pvt->nextgrp->ng_str[NG_DOM];
+		pvt->nextgrp = pvt->nextgrp->ng_next;
+		return (1);
+	}
+	return (0);
+}
+
+/*%
+ * Search for a match in a netgroup.
+ */
+static int
+ng_test(struct irs_ng *this, const char *name,
+	const char *host, const char *user, const char *domain)
+{
+	const char *ng_host, *ng_user, *ng_domain;
+
+	ng_rewind(this, name);
+	while (ng_next(this, &ng_host, &ng_user, &ng_domain))
+		if ((host == NULL || ng_host == NULL || 
+		     !strcmp(host, ng_host)) &&
+		    (user ==  NULL || ng_user == NULL || 
+		     !strcmp(user, ng_user)) &&
+		    (domain == NULL || ng_domain == NULL ||
+		     !strcmp(domain, ng_domain))) {
+			freelists(this);
+			return (1);
+		}
+	freelists(this);
+	return (0);
+}
+
+static void
+ng_minimize(struct irs_ng *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->fp != NULL) {
+		(void)fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+}
+
+/* Private */
+
+/*%
+ * endnetgrent() - cleanup
+ */
+static void
+freelists(struct irs_ng *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct linelist *lp, *olp;
+	struct ng_old_struct *gp, *ogp;
+
+	lp = pvt->linehead;
+	while (lp) {
+		olp = lp;
+		lp = lp->l_next;
+		free(olp->l_groupname);
+		free(olp->l_line);
+		free((char *)olp);
+	}
+	pvt->linehead = NULL;
+	if (pvt->grouphead.grname) {
+		free(pvt->grouphead.grname);
+		pvt->grouphead.grname = NULL;
+	}
+	gp = pvt->grouphead.gr;
+	while (gp) {
+		ogp = gp;
+		gp = gp->ng_next;
+		if (ogp->ng_str[NG_HOST])
+			free(ogp->ng_str[NG_HOST]);
+		if (ogp->ng_str[NG_USER])
+			free(ogp->ng_str[NG_USER]);
+		if (ogp->ng_str[NG_DOM])
+			free(ogp->ng_str[NG_DOM]);
+		free((char *)ogp);
+	}
+	pvt->grouphead.gr = NULL;
+}
+
+/*%
+ * Parse the netgroup file setting up the linked lists.
+ */
+static int
+parse_netgrp(struct irs_ng *this, const char *group) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char *spos, *epos;
+	int len, strpos;
+	char *pos, *gpos;
+	struct ng_old_struct *grp;
+	struct linelist *lp = pvt->linehead;
+
+        /*
+         * First, see if the line has already been read in.
+         */
+	while (lp) {
+		if (!strcmp(group, lp->l_groupname))
+			break;
+		lp = lp->l_next;
+	}
+	if (lp == NULL &&
+	    (lp = read_for_group(this, group)) == NULL)
+		return (1);
+	if (lp->l_parsed) {
+		/*fprintf(stderr, "Cycle in netgroup %s\n", lp->l_groupname);*/
+		return (1);
+	} else
+		lp->l_parsed = 1;
+	pos = lp->l_line;
+	while (*pos != '\0') {
+		if (*pos == '(') {
+			if (!(grp = malloc(sizeof (struct ng_old_struct)))) {
+				freelists(this);
+				errno = ENOMEM;
+				return (1);
+			}
+			memset(grp, 0, sizeof (struct ng_old_struct));
+			grp->ng_next = pvt->grouphead.gr;
+			pvt->grouphead.gr = grp;
+			pos++;
+			gpos = strsep(&pos, ")");
+			for (strpos = 0; strpos < 3; strpos++) {
+				if ((spos = strsep(&gpos, ","))) {
+					while (*spos == ' ' || *spos == '\t')
+						spos++;
+					if ((epos = strpbrk(spos, " \t"))) {
+						*epos = '\0';
+						len = epos - spos;
+					} else
+						len = strlen(spos);
+					if (len > 0) {
+						if(!(grp->ng_str[strpos] 
+						   =  (char *)
+						   malloc(len + 1))) {
+							freelists(this);
+							return (1);
+						}
+						memcpy(grp->ng_str[strpos],
+						       spos,
+						       len + 1);
+					}
+				} else
+					goto errout;
+			}
+		} else {
+			spos = strsep(&pos, ", \t");
+			if (spos != NULL && parse_netgrp(this, spos)) {
+				freelists(this);
+				return (1);
+			}
+		}
+		if (pos == NULL)
+			break;
+		while (*pos == ' ' || *pos == ',' || *pos == '\t')
+			pos++;
+	}
+	return (0);
+ errout:
+	/*fprintf(stderr, "Bad netgroup %s at ..%s\n", lp->l_groupname,
+		  spos);*/
+	return (1);
+}
+
+/*%
+ * Read the netgroup file and save lines until the line for the netgroup
+ * is found. Return 1 if eof is encountered.
+ */
+static struct linelist *
+read_for_group(struct irs_ng *this, const char *group) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char *pos, *spos, *linep = NULL, *olinep;
+	int len, olen, cont;
+	struct linelist *lp;
+	char line[LINSIZ + 1];
+	
+	while (fgets(line, LINSIZ, pvt->fp) != NULL) {
+		pos = line;
+		if (*pos == '#')
+			continue;
+		while (*pos == ' ' || *pos == '\t')
+			pos++;
+		spos = pos;
+		while (*pos != ' ' && *pos != '\t' && *pos != '\n' &&
+			*pos != '\0')
+			pos++;
+		len = pos - spos;
+		while (*pos == ' ' || *pos == '\t')
+			pos++;
+		if (*pos != '\n' && *pos != '\0') {
+			if (!(lp = malloc(sizeof (*lp)))) {
+				freelists(this);
+				return (NULL);
+			}
+			lp->l_parsed = 0;
+			if (!(lp->l_groupname = malloc(len + 1))) {
+				free(lp);
+				freelists(this);
+				return (NULL);
+			}
+			memcpy(lp->l_groupname, spos,  len);
+			*(lp->l_groupname + len) = '\0';
+			len = strlen(pos);
+			olen = 0;
+			olinep = NULL;
+
+			/*
+			 * Loop around handling line continuations.
+			 */
+			do {
+				if (*(pos + len - 1) == '\n')
+					len--;
+				if (*(pos + len - 1) == '\\') {
+					len--;
+					cont = 1;
+				} else
+					cont = 0;
+				if (len > 0) {
+					if (!(linep = malloc(olen + len + 1))){
+						if (olen > 0)
+							free(olinep);
+						free(lp->l_groupname);
+						free(lp);
+						freelists(this);
+						errno = ENOMEM;
+						return (NULL);
+					}
+					if (olen > 0) {
+						memcpy(linep, olinep, olen);
+						free(olinep);
+					}
+					memcpy(linep + olen, pos, len);
+					olen += len;
+					*(linep + olen) = '\0';
+					olinep = linep;
+				}
+				if (cont) {
+					if (fgets(line, LINSIZ, pvt->fp)) {
+						pos = line;
+						len = strlen(pos);
+					} else
+						cont = 0;
+				}
+			} while (cont);
+			lp->l_line = linep;
+			lp->l_next = pvt->linehead;
+			pvt->linehead = lp;
+			
+			/*
+			 * If this is the one we wanted, we are done.
+			 */
+			if (!strcmp(lp->l_groupname, group))
+				return (lp);
+		}
+	}
+	return (NULL);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/lcl_nw.c b/usr/src/lib/libresolv2_joy/common/irs/lcl_nw.c
new file mode 100644
index 0000000000..2e5cd55a6c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/lcl_nw.c
@@ -0,0 +1,373 @@
+/*
+ * Copyright (c) 1989, 1993, 1995
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: lcl_nw.c,v 1.4 2005/04/27 04:56:31 sra Exp $";
+/* from getgrent.c 8.2 (Berkeley) 3/21/94"; */
+/* from BSDI Id: getgrent.c,v 2.8 1996/05/28 18:15:14 bostic Exp $	*/
+#endif /* LIBC_SCCS and not lint */
+
+/* Imports */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+
+#include "port_after.h"
+
+#include <isc/misc.h>
+#include "irs_p.h"
+#include "lcl_p.h"
+
+#define MAXALIASES 35
+#define MAXADDRSIZE 4
+
+struct pvt {
+	FILE *		fp;
+	char 		line[BUFSIZ+1];
+	struct nwent 	net;
+	char *		aliases[MAXALIASES];
+	char		addr[MAXADDRSIZE];
+	struct __res_state *  res;
+	void		(*free_res)(void *);
+};
+
+/* Forward */
+
+static void 		nw_close(struct irs_nw *);
+static struct nwent *	nw_byname(struct irs_nw *, const char *, int);
+static struct nwent *	nw_byaddr(struct irs_nw *, void *, int, int);
+static struct nwent *	nw_next(struct irs_nw *);
+static void		nw_rewind(struct irs_nw *);
+static void		nw_minimize(struct irs_nw *);
+static struct __res_state * nw_res_get(struct irs_nw *this);
+static void		nw_res_set(struct irs_nw *this,
+				   struct __res_state *res,
+				   void (*free_res)(void *));
+
+static int		init(struct irs_nw *this);
+
+/* Portability. */
+
+#ifndef SEEK_SET
+# define SEEK_SET 0
+#endif
+
+/* Public */
+
+struct irs_nw *
+irs_lcl_nw(struct irs_acc *this) {
+	struct irs_nw *nw;
+	struct pvt *pvt;
+
+	UNUSED(this);
+
+	if (!(pvt = memget(sizeof *pvt))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	if (!(nw = memget(sizeof *nw))) {
+		memput(pvt, sizeof *pvt);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(nw, 0x5e, sizeof *nw);
+	nw->private = pvt;
+	nw->close = nw_close;
+	nw->byname = nw_byname;
+	nw->byaddr = nw_byaddr;
+	nw->next = nw_next;
+	nw->rewind = nw_rewind;
+	nw->minimize = nw_minimize;
+	nw->res_get = nw_res_get;
+	nw->res_set = nw_res_set;
+	return (nw);
+}
+
+/* Methods */
+
+static void
+nw_close(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	nw_minimize(this);
+	if (pvt->res && pvt->free_res)
+		(*pvt->free_res)(pvt->res);
+	if (pvt->fp)
+		(void)fclose(pvt->fp);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct nwent *
+nw_byaddr(struct irs_nw *this, void *net, int length, int type) {
+	struct nwent *p;
+	
+	if (init(this) == -1)
+		return(NULL);
+
+	nw_rewind(this);
+	while ((p = nw_next(this)) != NULL)
+		if (p->n_addrtype == type && p->n_length == length)
+			if (bitncmp(p->n_addr, net, length) == 0)
+				break;
+	return (p);
+}
+
+static struct nwent *
+nw_byname(struct irs_nw *this, const char *name, int type) {
+	struct nwent *p;
+	char **ap;
+	
+	if (init(this) == -1)
+		return(NULL);
+
+	nw_rewind(this);
+	while ((p = nw_next(this)) != NULL) {
+		if (ns_samename(p->n_name, name) == 1 &&
+		    p->n_addrtype == type)
+			break;
+		for (ap = p->n_aliases; *ap; ap++)
+			if ((ns_samename(*ap, name) == 1) &&
+			    (p->n_addrtype == type))
+				goto found;
+	}
+ found:
+	return (p);
+}
+
+static void
+nw_rewind(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (pvt->fp) {
+		if (fseek(pvt->fp, 0L, SEEK_SET) == 0)
+			return;
+		(void)fclose(pvt->fp);
+	}
+	if (!(pvt->fp = fopen(_PATH_NETWORKS, "r")))
+		return;
+	if (fcntl(fileno(pvt->fp), F_SETFD, 1) < 0) {
+		(void)fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+}
+
+static struct nwent *
+nw_next(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	struct nwent *ret = NULL;
+	char *p, *cp, **q;
+	char *bufp, *ndbuf, *dbuf = NULL;
+	int c, bufsiz, offset = 0;
+
+	if (init(this) == -1)
+		return(NULL);
+
+	if (pvt->fp == NULL)
+		nw_rewind(this);
+	if (pvt->fp == NULL) {
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	bufp = pvt->line;
+	bufsiz = sizeof(pvt->line);
+
+ again:
+	p = fgets(bufp + offset, bufsiz - offset, pvt->fp);
+	if (p == NULL)
+		goto cleanup;
+	if (!strchr(p, '\n') && !feof(pvt->fp)) {
+#define GROWBUF 1024
+		/* allocate space for longer line */
+	  	if (dbuf == NULL) {
+			if ((ndbuf = malloc(bufsiz + GROWBUF)) != NULL)
+				strcpy(ndbuf, bufp);
+		} else
+			ndbuf = realloc(dbuf, bufsiz + GROWBUF);
+		if (ndbuf) {
+			dbuf = ndbuf;
+			bufp = dbuf;
+			bufsiz += GROWBUF;
+			offset = strlen(dbuf);
+		} else {
+			/* allocation failed; skip this long line */
+			while ((c = getc(pvt->fp)) != EOF)
+				if (c == '\n')
+					break;
+			if (c != EOF)
+				ungetc(c, pvt->fp);
+		}
+		goto again;
+	}
+
+	p -= offset;
+	offset = 0;
+
+	if (*p == '#')
+		goto again;
+
+	cp = strpbrk(p, "#\n");
+	if (cp != NULL)
+		*cp = '\0';
+	pvt->net.n_name = p;
+	cp = strpbrk(p, " \t");
+	if (cp == NULL)
+		goto again;
+	*cp++ = '\0';
+	while (*cp == ' ' || *cp == '\t')
+		cp++;
+	p = strpbrk(cp, " \t");
+	if (p != NULL)
+		*p++ = '\0';
+	pvt->net.n_length = inet_net_pton(AF_INET, cp, pvt->addr,
+					  sizeof pvt->addr);
+	if (pvt->net.n_length < 0)
+		goto again;
+	pvt->net.n_addrtype = AF_INET;
+	pvt->net.n_addr = pvt->addr;
+	q = pvt->net.n_aliases = pvt->aliases;
+	if (p != NULL) {
+		cp = p;
+		while (cp && *cp) {
+			if (*cp == ' ' || *cp == '\t') {
+				cp++;
+				continue;
+			}
+			if (q < &pvt->aliases[MAXALIASES - 1])
+				*q++ = cp;
+			cp = strpbrk(cp, " \t");
+			if (cp != NULL)
+				*cp++ = '\0';
+		}
+	}
+	*q = NULL;
+	ret = &pvt->net;
+
+ cleanup:
+	if (dbuf)
+		free(dbuf);
+
+	return (ret);
+}
+
+static void
+nw_minimize(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->res)
+		res_nclose(pvt->res);
+	if (pvt->fp != NULL) {
+		(void)fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+}
+
+static struct __res_state *
+nw_res_get(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (!pvt->res) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (!res) {
+			errno = ENOMEM;
+			return (NULL);
+		}
+		memset(res, 0, sizeof *res);
+		nw_res_set(this, res, free);
+	}
+
+	return (pvt->res);
+}
+
+static void
+nw_res_set(struct irs_nw *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->res && pvt->free_res) {
+		res_nclose(pvt->res);
+		(*pvt->free_res)(pvt->res);
+	}
+
+	pvt->res = res;
+	pvt->free_res = free_res;
+}
+
+static int
+init(struct irs_nw *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (!pvt->res && !nw_res_get(this))
+		return (-1);
+	if (((pvt->res->options & RES_INIT) == 0U) &&
+	    res_ninit(pvt->res) == -1)
+		return (-1);
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/lcl_p.h b/usr/src/lib/libresolv2_joy/common/irs/lcl_p.h
new file mode 100644
index 0000000000..e3f4f009cb
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/lcl_p.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: lcl_p.h,v 1.3 2005/04/27 04:56:31 sra Exp $
+ */
+
+/*! \file
+ * \brief
+ * lcl_p.h - private include file for the local accessor functions.
+ */
+
+#ifndef _LCL_P_H_INCLUDED
+#define _LCL_P_H_INCLUDED
+
+/*%
+ * Object state.
+ */
+struct lcl_p {
+	struct __res_state *	res;
+	void                    (*free_res) __P((void *));
+};
+
+/*
+ * Externs.
+ */
+
+extern struct irs_acc *	irs_lcl_acc __P((const char *));
+extern struct irs_gr *	irs_lcl_gr __P((struct irs_acc *));
+extern struct irs_pw *	irs_lcl_pw __P((struct irs_acc *));
+extern struct irs_sv *	irs_lcl_sv __P((struct irs_acc *));
+extern struct irs_pr *	irs_lcl_pr __P((struct irs_acc *));
+extern struct irs_ho *	irs_lcl_ho __P((struct irs_acc *));
+extern struct irs_nw *	irs_lcl_nw __P((struct irs_acc *));
+extern struct irs_ng *	irs_lcl_ng __P((struct irs_acc *));
+
+#endif /*_LCL_P_H_INCLUDED*/
diff --git a/usr/src/lib/libresolv2_joy/common/irs/lcl_pr.c b/usr/src/lib/libresolv2_joy/common/irs/lcl_pr.c
new file mode 100644
index 0000000000..e1538530eb
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/lcl_pr.c
@@ -0,0 +1,294 @@
+/*
+ * Copyright (c) 1989, 1993, 1995
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: lcl_pr.c,v 1.4 2006/03/09 23:57:56 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* extern */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "lcl_p.h"
+
+#ifndef _PATH_PROTOCOLS
+#define _PATH_PROTOCOLS "/etc/protocols"
+#endif
+#define MAXALIASES      35
+
+/* Types */
+
+struct pvt {
+	FILE *		fp;
+	char		line[BUFSIZ+1];
+	char *		dbuf;
+	struct protoent	proto;
+	char *		proto_aliases[MAXALIASES];
+};
+
+/* Forward */
+
+static void			pr_close(struct irs_pr *);
+static struct protoent *	pr_next(struct irs_pr *);
+static struct protoent *	pr_byname(struct irs_pr *, const char *);
+static struct protoent *	pr_bynumber(struct irs_pr *, int);
+static void			pr_rewind(struct irs_pr *);
+static void			pr_minimize(struct irs_pr *);
+
+/* Portability. */
+
+#ifndef SEEK_SET
+# define SEEK_SET 0
+#endif
+
+/* Public */
+
+struct irs_pr *
+irs_lcl_pr(struct irs_acc *this) {
+	struct irs_pr *pr;
+	struct pvt *pvt;
+	
+	if (!(pr = memget(sizeof *pr))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	if (!(pvt = memget(sizeof *pvt))) {
+		memput(pr, sizeof *this);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	pr->private = pvt;
+	pr->close = pr_close;
+	pr->byname = pr_byname;
+	pr->bynumber = pr_bynumber;
+	pr->next = pr_next;
+	pr->rewind = pr_rewind;
+	pr->minimize = pr_minimize;
+	pr->res_get = NULL;
+	pr->res_set = NULL;
+	return (pr);
+}
+
+/* Methods */
+
+static void
+pr_close(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->fp)
+		(void) fclose(pvt->fp);
+	if (pvt->dbuf)
+		free(pvt->dbuf);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct protoent *
+pr_byname(struct irs_pr *this, const char *name) {
+		
+	struct protoent *p;
+	char **cp;
+
+	pr_rewind(this);
+	while ((p = pr_next(this))) {
+		if (!strcmp(p->p_name, name))
+			goto found;
+		for (cp = p->p_aliases; *cp; cp++)
+			if (!strcmp(*cp, name))
+				goto found;
+	}
+ found:
+	return (p);
+}
+
+static struct protoent *
+pr_bynumber(struct irs_pr *this, int proto) {
+	struct protoent *p;
+
+	pr_rewind(this);
+	while ((p = pr_next(this)))
+		if (p->p_proto == proto)
+			break;
+	return (p);
+}
+
+static void
+pr_rewind(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+	if (pvt->fp) {
+		if (fseek(pvt->fp, 0L, SEEK_SET) == 0)
+			return;
+		(void)fclose(pvt->fp);
+	}
+	if (!(pvt->fp = fopen(_PATH_PROTOCOLS, "r" )))
+		return;
+	if (fcntl(fileno(pvt->fp), F_SETFD, 1) < 0) {
+		(void)fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+}
+
+static struct protoent *
+pr_next(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	char *p, *cp, **q;
+	char *bufp, *ndbuf, *dbuf = NULL;
+	int c, bufsiz, offset;
+
+	if (!pvt->fp)
+		pr_rewind(this);
+	if (!pvt->fp)
+		return (NULL);
+	if (pvt->dbuf) {
+		free(pvt->dbuf);
+		pvt->dbuf = NULL;
+	}
+	bufp = pvt->line;
+	bufsiz = BUFSIZ;
+	offset = 0;
+ again:
+	if ((p = fgets(bufp + offset, bufsiz - offset, pvt->fp)) == NULL) {
+		if (dbuf)
+			free(dbuf);
+		return (NULL);
+	}
+	if (!strchr(p, '\n') && !feof(pvt->fp)) {
+#define GROWBUF 1024
+		/* allocate space for longer line */
+		if (dbuf == NULL) {
+			if ((ndbuf = malloc(bufsiz + GROWBUF)) != NULL)
+				strcpy(ndbuf, bufp);
+		} else
+			ndbuf = realloc(dbuf, bufsiz + GROWBUF);
+		if (ndbuf) {
+			dbuf = ndbuf;
+			bufp = dbuf;
+			bufsiz += GROWBUF;
+			offset = strlen(dbuf);
+		} else {
+			/* allocation failed; skip this long line */
+			while ((c = getc(pvt->fp)) != EOF)
+				if (c == '\n')
+					break;
+			if (c != EOF)
+				ungetc(c, pvt->fp);
+		}
+		goto again;
+	}
+
+	p -= offset;
+	offset = 0;
+
+	if (*p == '#')
+		goto again;
+	cp = strpbrk(p, "#\n");
+	if (cp != NULL)
+		*cp = '\0';
+	pvt->proto.p_name = p;
+	cp = strpbrk(p, " \t");
+	if (cp == NULL)
+		goto again;
+	*cp++ = '\0';
+	while (*cp == ' ' || *cp == '\t')
+		cp++;
+	p = strpbrk(cp, " \t");
+	if (p != NULL)
+		*p++ = '\0';
+	pvt->proto.p_proto = atoi(cp);
+	q = pvt->proto.p_aliases = pvt->proto_aliases;
+	if (p != NULL) {
+		cp = p;
+		while (cp && *cp) {
+			if (*cp == ' ' || *cp == '\t') {
+				cp++;
+				continue;
+			}
+			if (q < &pvt->proto_aliases[MAXALIASES - 1])
+				*q++ = cp;
+			cp = strpbrk(cp, " \t");
+			if (cp != NULL)
+				*cp++ = '\0';
+		}
+	}
+	*q = NULL;
+	pvt->dbuf = dbuf;
+	return (&pvt->proto);
+}
+
+static void
+pr_minimize(struct irs_pr *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->fp != NULL) {
+		(void)fclose(pvt->fp);
+		pvt->fp = NULL;
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/lcl_sv.c b/usr/src/lib/libresolv2_joy/common/irs/lcl_sv.c
new file mode 100644
index 0000000000..ad6526430c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/lcl_sv.c
@@ -0,0 +1,432 @@
+/*
+ * Copyright (c) 1989, 1993, 1995
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: lcl_sv.c,v 1.4 2005/04/27 04:56:31 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/* extern */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#ifdef IRS_LCL_SV_DB
+#include <db.h>
+#endif
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "lcl_p.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+/* Types */
+
+struct pvt {
+#ifdef IRS_LCL_SV_DB
+	DB *		dbh;
+	int		dbf;
+#endif
+	struct lcl_sv	sv;
+};
+
+/* Forward */
+
+static void			sv_close(struct irs_sv*);
+static struct servent *		sv_next(struct irs_sv *);
+static struct servent *		sv_byname(struct irs_sv *, const char *,
+					  const char *);
+static struct servent *		sv_byport(struct irs_sv *, int, const char *);
+static void			sv_rewind(struct irs_sv *);
+static void			sv_minimize(struct irs_sv *);
+/*global*/ struct servent *	irs_lclsv_fnxt(struct lcl_sv *);
+#ifdef IRS_LCL_SV_DB
+static struct servent *		sv_db_rec(struct lcl_sv *, DBT *, DBT *);
+#endif
+
+/* Portability */
+
+#ifndef SEEK_SET
+# define SEEK_SET 0
+#endif
+
+/* Public */
+
+struct irs_sv *
+irs_lcl_sv(struct irs_acc *this) {
+	struct irs_sv *sv;
+	struct pvt *pvt;
+
+	UNUSED(this);
+	
+	if ((sv = memget(sizeof *sv)) == NULL) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(sv, 0x5e, sizeof *sv);
+	if ((pvt = memget(sizeof *pvt)) == NULL) {
+		memput(sv, sizeof *sv);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(pvt, 0, sizeof *pvt);
+	sv->private = pvt;
+	sv->close = sv_close;
+	sv->next = sv_next;
+	sv->byname = sv_byname;
+	sv->byport = sv_byport;
+	sv->rewind = sv_rewind;
+	sv->minimize = sv_minimize;
+	sv->res_get = NULL;
+	sv->res_set = NULL;
+#ifdef IRS_LCL_SV_DB
+	pvt->dbf = R_FIRST;
+#endif
+	return (sv);
+}
+
+/* Methods */
+
+static void
+sv_close(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+	
+#ifdef IRS_LCL_SV_DB
+	if (pvt->dbh != NULL)
+		(*pvt->dbh->close)(pvt->dbh);
+#endif
+	if (pvt->sv.fp)
+		fclose(pvt->sv.fp);
+	memput(pvt, sizeof *pvt);
+	memput(this, sizeof *this);
+}
+
+static struct servent *
+sv_byname(struct irs_sv *this, const char *name, const char *proto) {
+#ifdef IRS_LCL_SV_DB
+	struct pvt *pvt = (struct pvt *)this->private;
+#endif
+	struct servent *p;
+	char **cp;
+
+	sv_rewind(this);
+#ifdef IRS_LCL_SV_DB
+	if (pvt->dbh != NULL) {
+		DBT key, data;
+
+		/* Note that (sizeof "/") == 2. */
+		if ((strlen(name) + sizeof "/" + proto ? strlen(proto) : 0)
+		    > sizeof pvt->sv.line)
+			goto try_local;
+		key.data = pvt->sv.line;
+		key.size = SPRINTF((pvt->sv.line, "%s/%s", name,
+				    proto ? proto : "")) + 1;
+		if (proto != NULL) {
+			if ((*pvt->dbh->get)(pvt->dbh, &key, &data, 0) != 0)
+				return (NULL);
+		} else if ((*pvt->dbh->seq)(pvt->dbh, &key, &data, R_CURSOR)
+			   != 0)
+			return (NULL);
+		return (sv_db_rec(&pvt->sv, &key, &data));
+	}
+ try_local:
+#endif
+
+	while ((p = sv_next(this))) {
+		if (strcmp(name, p->s_name) == 0)
+			goto gotname;
+		for (cp = p->s_aliases; *cp; cp++)
+			if (strcmp(name, *cp) == 0)
+				goto gotname;
+		continue;
+ gotname:
+		if (proto == NULL || strcmp(p->s_proto, proto) == 0)
+			break;
+	}
+	return (p);
+}
+
+static struct servent *
+sv_byport(struct irs_sv *this, int port, const char *proto) {
+#ifdef IRS_LCL_SV_DB
+	struct pvt *pvt = (struct pvt *)this->private;
+#endif
+	struct servent *p;
+
+	sv_rewind(this);
+#ifdef IRS_LCL_SV_DB
+	if (pvt->dbh != NULL) {
+		DBT key, data;
+		u_short *ports;
+
+		ports = (u_short *)pvt->sv.line;
+		ports[0] = 0;
+		ports[1] = port;
+		key.data = ports;
+		key.size = sizeof(u_short) * 2;
+		if (proto && *proto) {
+			strncpy((char *)ports + key.size, proto,
+				BUFSIZ - key.size);
+			key.size += strlen((char *)ports + key.size) + 1;
+			if ((*pvt->dbh->get)(pvt->dbh, &key, &data, 0) != 0)
+				return (NULL);
+		} else {
+			if ((*pvt->dbh->seq)(pvt->dbh, &key, &data, R_CURSOR)
+			    != 0)
+				return (NULL);
+		}
+		return (sv_db_rec(&pvt->sv, &key, &data));
+	}
+#endif
+	while ((p = sv_next(this))) {
+		if (p->s_port != port)
+			continue;
+		if (proto == NULL || strcmp(p->s_proto, proto) == 0)
+			break;
+	}
+	return (p);
+}
+
+static void
+sv_rewind(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+	if (pvt->sv.fp) {
+		if (fseek(pvt->sv.fp, 0L, SEEK_SET) == 0)
+			return;
+		(void)fclose(pvt->sv.fp);
+		pvt->sv.fp = NULL;
+	}
+#ifdef IRS_LCL_SV_DB
+	pvt->dbf = R_FIRST;
+	if (pvt->dbh != NULL)
+		return;
+	pvt->dbh = dbopen(_PATH_SERVICES_DB, O_RDONLY,O_RDONLY,DB_BTREE, NULL);
+	if (pvt->dbh != NULL) {
+		if (fcntl((*pvt->dbh->fd)(pvt->dbh), F_SETFD, 1) < 0) {
+			(*pvt->dbh->close)(pvt->dbh);
+			pvt->dbh = NULL;
+		}
+		return;
+	}
+#endif
+	if ((pvt->sv.fp = fopen(_PATH_SERVICES, "r")) == NULL)
+		return;
+	if (fcntl(fileno(pvt->sv.fp), F_SETFD, 1) < 0) {
+		(void)fclose(pvt->sv.fp);
+		pvt->sv.fp = NULL;
+	}
+}
+
+static struct servent *
+sv_next(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+#ifdef IRS_LCL_SV_DB
+	if (pvt->dbh == NULL && pvt->sv.fp == NULL)
+#else
+	if (pvt->sv.fp == NULL)
+#endif
+		sv_rewind(this);
+
+#ifdef IRS_LCL_SV_DB
+	if (pvt->dbh != NULL) {
+		DBT key, data;
+
+		while ((*pvt->dbh->seq)(pvt->dbh, &key, &data, pvt->dbf) == 0){
+			pvt->dbf = R_NEXT;
+			if (((char *)key.data)[0])
+				continue;
+			return (sv_db_rec(&pvt->sv, &key, &data));
+		}
+	}
+#endif
+
+	if (pvt->sv.fp == NULL)
+		return (NULL);
+	return (irs_lclsv_fnxt(&pvt->sv));
+}
+
+static void
+sv_minimize(struct irs_sv *this) {
+	struct pvt *pvt = (struct pvt *)this->private;
+
+#ifdef IRS_LCL_SV_DB
+	if (pvt->dbh != NULL) {
+		(*pvt->dbh->close)(pvt->dbh);
+		pvt->dbh = NULL;
+	}
+#endif
+	if (pvt->sv.fp != NULL) {
+		(void)fclose(pvt->sv.fp);
+		pvt->sv.fp = NULL;
+	}
+}
+
+/* Quasipublic. */
+
+struct servent *
+irs_lclsv_fnxt(struct lcl_sv *sv) {
+	char *p, *cp, **q;
+
+ again:
+	if ((p = fgets(sv->line, BUFSIZ, sv->fp)) == NULL)
+		return (NULL);
+	if (*p == '#')
+		goto again;
+	sv->serv.s_name = p;
+	while (*p && *p != '\n' && *p != ' ' && *p != '\t' && *p != '#')
+		++p;
+	if (*p == '\0' || *p == '#' || *p == '\n')
+		goto again;
+	*p++ = '\0';
+	while (*p == ' ' || *p == '\t')
+		p++;
+	if (*p == '\0' || *p == '#' || *p == '\n')
+		goto again;
+	sv->serv.s_port = htons((u_short)strtol(p, &cp, 10));
+	if (cp == p || (*cp != '/' && *cp != ','))
+		goto again;
+	p = cp + 1;
+	sv->serv.s_proto = p;
+
+	q = sv->serv.s_aliases = sv->serv_aliases;
+
+	while (*p && *p != '\n' && *p != ' ' && *p != '\t' && *p != '#')
+		++p;
+
+	while (*p == ' ' || *p == '\t') {
+		*p++ = '\0';
+		while (*p == ' ' || *p == '\t')
+			++p;
+		if (*p == '\0' || *p == '#' || *p == '\n')
+			break;
+		if (q < &sv->serv_aliases[IRS_SV_MAXALIASES - 1])
+			*q++ = p;
+		while (*p && *p != '\n' && *p != ' ' && *p != '\t' && *p != '#')
+			++p;
+	}
+		
+	*p = '\0';
+	*q = NULL;
+	return (&sv->serv);
+}
+
+/* Private. */
+
+#ifdef IRS_LCL_SV_DB
+static struct servent *
+sv_db_rec(struct lcl_sv *sv, DBT *key, DBT *data) {
+	char *p, **q;
+	int n;
+
+	p = data->data;
+	p[data->size - 1] = '\0';	/*%< should be, but we depend on it */
+	if (((char *)key->data)[0] == '\0') {
+		if (key->size < sizeof(u_short)*2 || data->size < 2)
+			return (NULL);
+		sv->serv.s_port = ((u_short *)key->data)[1];
+		n = strlen(p) + 1;
+		if ((size_t)n > sizeof(sv->line)) {
+			n = sizeof(sv->line);
+		}
+		memcpy(sv->line, p, n);
+		sv->serv.s_name = sv->line;
+		if ((sv->serv.s_proto = strchr(sv->line, '/')) != NULL)
+			*(sv->serv.s_proto)++ = '\0';
+		p += n;
+		data->size -= n;
+	} else {
+		if (data->size < sizeof(u_short) + 1)
+			return (NULL);
+		if (key->size > sizeof(sv->line))
+			key->size = sizeof(sv->line);
+		((char *)key->data)[key->size - 1] = '\0';
+		memcpy(sv->line, key->data, key->size);
+		sv->serv.s_name = sv->line;
+		if ((sv->serv.s_proto = strchr(sv->line, '/')) != NULL)
+			*(sv->serv.s_proto)++ = '\0';
+		sv->serv.s_port = *(u_short *)data->data;
+		p += sizeof(u_short);
+		data->size -= sizeof(u_short);
+	}
+	q = sv->serv.s_aliases = sv->serv_aliases;
+	while (data->size > 0 && q < &sv->serv_aliases[IRS_SV_MAXALIASES - 1]) {
+
+		*q++ = p;
+		n = strlen(p) + 1;
+		data->size -= n;
+		p += n;
+	}
+	*q = NULL;
+	return (&sv->serv);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/nis.c b/usr/src/lib/libresolv2_joy/common/irs/nis.c
new file mode 100644
index 0000000000..ac1796543c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/nis.c
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: nis.c,v 1.3 2005/04/27 04:56:32 sra Exp $";
+#endif
+
+/* Imports */
+
+#include "port_before.h"
+
+#ifdef WANT_IRS_NIS
+
+#include <rpc/rpc.h>
+#include <rpc/xdr.h>
+#include <rpcsvc/yp_prot.h>
+#include <rpcsvc/ypclnt.h>
+
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+#include <sys/types.h>
+#include <netinet/in.h> 
+#ifdef T_NULL
+#undef T_NULL			/* Silence re-definition warning of T_NULL. */
+#endif
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <isc/memcluster.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "hesiod.h"
+#include "nis_p.h"
+
+/* Forward */
+
+static void		nis_close(struct irs_acc *);
+static struct __res_state * nis_res_get(struct irs_acc *);
+static void		nis_res_set(struct irs_acc *, struct __res_state *,
+				void (*)(void *));
+
+/* Public */
+
+struct irs_acc *
+irs_nis_acc(const char *options) {
+	struct nis_p *nis;
+	struct irs_acc *acc;
+	char *domain;
+
+	UNUSED(options);
+
+	if (yp_get_default_domain(&domain) != 0)
+		return (NULL);
+	if (!(nis = memget(sizeof *nis))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(nis, 0, sizeof *nis);
+	if (!(acc = memget(sizeof *acc))) {
+		memput(nis, sizeof *nis);
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(acc, 0x5e, sizeof *acc);
+	acc->private = nis;
+	nis->domain = strdup(domain);
+#ifdef WANT_IRS_GR
+	acc->gr_map = irs_nis_gr;
+#else
+	acc->gr_map = NULL;
+#endif
+#ifdef WANT_IRS_PW
+	acc->pw_map = irs_nis_pw;
+#else
+	acc->pw_map = NULL;
+#endif
+	acc->sv_map = irs_nis_sv;
+	acc->pr_map = irs_nis_pr;
+	acc->ho_map = irs_nis_ho;
+	acc->nw_map = irs_nis_nw;
+	acc->ng_map = irs_nis_ng;
+	acc->res_get = nis_res_get;
+	acc->res_set = nis_res_set;
+	acc->close = nis_close;
+	return (acc);
+}
+
+/* Methods */
+
+static struct __res_state *
+nis_res_get(struct irs_acc *this) {
+	struct nis_p *nis = (struct nis_p *)this->private;
+
+	if (nis->res == NULL) {
+		struct __res_state *res;
+		res = (struct __res_state *)malloc(sizeof *res);
+		if (res == NULL)
+			return (NULL);
+		memset(res, 0, sizeof *res);
+		nis_res_set(this, res, free);
+	}
+
+	if ((nis->res->options & RES_INIT) == 0 &&
+	    res_ninit(nis->res) < 0)
+		return (NULL);
+
+	return (nis->res);
+}
+
+static void
+nis_res_set(struct irs_acc *this, struct __res_state *res,
+		void (*free_res)(void *)) {
+	struct nis_p *nis = (struct nis_p *)this->private;
+
+	if (nis->res && nis->free_res) {
+		res_nclose(nis->res);
+		(*nis->free_res)(nis->res);
+	}
+
+	nis->res = res;
+	nis->free_res = free_res;
+}
+
+static void
+nis_close(struct irs_acc *this) {
+	struct nis_p *nis = (struct nis_p *)this->private;
+
+	if (nis->res && nis->free_res)
+		(*nis->free_res)(nis->res);
+	free(nis->domain);
+	memput(nis, sizeof *nis);
+	memput(this, sizeof *this);
+}
+
+#endif /*WANT_IRS_NIS*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/nis_p.h b/usr/src/lib/libresolv2_joy/common/irs/nis_p.h
new file mode 100644
index 0000000000..70e2948d67
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/nis_p.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: nis_p.h,v 1.3 2005/04/27 04:56:33 sra Exp $
+ */
+
+/*! \file
+ * \brief
+ * nis_p.h - private include file for the NIS functions.
+ */
+
+/*%
+ * Object state.
+ */
+struct nis_p {
+	char *			domain;
+	struct __res_state *	res;
+	void                    (*free_res) __P((void *));
+};
+
+
+/*
+ * Methods.
+ */
+
+extern struct irs_gr *	irs_nis_gr __P((struct irs_acc *));
+extern struct irs_pw *	irs_nis_pw __P((struct irs_acc *));
+extern struct irs_sv *	irs_nis_sv __P((struct irs_acc *));
+extern struct irs_pr *	irs_nis_pr __P((struct irs_acc *));
+extern struct irs_ho *	irs_nis_ho __P((struct irs_acc *));
+extern struct irs_nw *	irs_nis_nw __P((struct irs_acc *));
+extern struct irs_ng *	irs_nis_ng __P((struct irs_acc *));
diff --git a/usr/src/lib/libresolv2_joy/common/irs/nul_ng.c b/usr/src/lib/libresolv2_joy/common/irs/nul_ng.c
new file mode 100644
index 0000000000..504813bde1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/nul_ng.c
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: nul_ng.c,v 1.3 2005/04/27 04:56:34 sra Exp $";
+#endif
+
+/*! \file
+ * \brief
+ * nul_ng.c - the netgroup accessor null map
+ */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <netdb.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include <irs.h>
+#include <isc/memcluster.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+#include "hesiod.h"
+#include "dns_p.h"
+
+/* Forward. */
+
+static void 		ng_close(struct irs_ng *);
+static int		ng_next(struct irs_ng *, const char **,
+				const char **, const char **);
+static int		ng_test(struct irs_ng *,
+ 				const char *, const char *,
+				const char *, const char *);
+static void		ng_rewind(struct irs_ng *, const char *);
+static void		ng_minimize(struct irs_ng *);
+
+/* Public. */
+
+struct irs_ng *
+irs_nul_ng(struct irs_acc *this) {
+	struct irs_ng *ng;
+
+	UNUSED(this);
+
+	if (!(ng = memget(sizeof *ng))) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	memset(ng, 0x5e, sizeof *ng);
+	ng->private = NULL;
+	ng->close = ng_close;
+	ng->next = ng_next;
+	ng->test = ng_test;
+	ng->rewind = ng_rewind;
+	ng->minimize = ng_minimize;
+	return (ng);
+}
+
+/* Methods. */
+
+static void
+ng_close(struct irs_ng *this) {
+	memput(this, sizeof *this);
+}
+
+/* ARGSUSED */
+static int
+ng_next(struct irs_ng *this, const char **host, const char **user,
+	const char **domain)
+{
+	UNUSED(this);
+	UNUSED(host);
+	UNUSED(user);
+	UNUSED(domain);
+	errno = ENOENT;
+	return (-1);
+}
+
+static int
+ng_test(struct irs_ng *this, const char *name,
+	const char *user, const char *host, const char *domain)
+{
+	UNUSED(this);
+	UNUSED(name);
+	UNUSED(user);
+	UNUSED(host);
+	UNUSED(domain);
+	errno = ENODEV;
+	return (-1);
+}
+
+static void
+ng_rewind(struct irs_ng *this, const char *netgroup) {
+	UNUSED(this);
+	UNUSED(netgroup);
+	/* NOOP */
+}
+
+static void
+ng_minimize(struct irs_ng *this) {
+	UNUSED(this);
+	/* NOOP */
+}
diff --git a/usr/src/lib/libresolv2_joy/common/irs/pathnames.h b/usr/src/lib/libresolv2_joy/common/irs/pathnames.h
new file mode 100644
index 0000000000..1646842155
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/pathnames.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: pathnames.h,v 1.3 2005/04/27 04:56:34 sra Exp $
+ */
+
+#ifndef _PATH_IRS_CONF
+#define	_PATH_IRS_CONF "/etc/irs.conf"
+#endif
+
+#ifndef _PATH_NETWORKS 
+#define _PATH_NETWORKS  "/etc/networks"
+#endif
+
+#ifndef _PATH_GROUP
+#define _PATH_GROUP "/etc/group"
+#endif
+
+#ifndef _PATH_NETGROUP
+#define _PATH_NETGROUP "/etc/netgroup"
+#endif
+
+#ifndef _PATH_SERVICES 
+#define _PATH_SERVICES "/etc/services"
+#endif
+
+#ifdef IRS_LCL_SV_DB
+#ifndef _PATH_SERVICES_DB
+#define	_PATH_SERVICES_DB _PATH_SERVICES ".db"
+#endif
+#endif
+
+#ifndef _PATH_HESIOD_CONF
+#define _PATH_HESIOD_CONF "/etc/hesiod.conf"
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/irs/util.c b/usr/src/lib/libresolv2_joy/common/irs/util.c
new file mode 100644
index 0000000000..9c70eabddc
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/irs/util.c
@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: util.c,v 1.3 2005/04/27 04:56:34 sra Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <irs.h>
+
+#include "port_after.h"
+
+#include "irs_p.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) sprintf x
+#endif
+
+void
+map_v4v6_address(const char *src, char *dst) {
+	u_char *p = (u_char *)dst;
+	char tmp[NS_INADDRSZ];
+	int i;
+
+	/* Stash a temporary copy so our caller can update in place. */
+	memcpy(tmp, src, NS_INADDRSZ);
+	/* Mark this ipv6 addr as a mapped ipv4. */
+	for (i = 0; i < 10; i++)
+		*p++ = 0x00;
+	*p++ = 0xff;
+	*p++ = 0xff;
+	/* Retrieve the saved copy and we're done. */
+	memcpy((void*)p, tmp, NS_INADDRSZ);
+}
+
+int
+make_group_list(struct irs_gr *this, const char *name,
+	gid_t basegid, gid_t *groups, int *ngroups)
+{
+	struct group *grp;
+	int i, ng;
+	int ret, maxgroups;
+
+	ret = -1;
+	ng = 0;
+	maxgroups = *ngroups;
+	/*
+	 * When installing primary group, duplicate it;
+	 * the first element of groups is the effective gid
+	 * and will be overwritten when a setgid file is executed.
+	 */
+	if (ng >= maxgroups)
+		goto done;
+	groups[ng++] = basegid;
+	if (ng >= maxgroups)
+		goto done;
+	groups[ng++] = basegid;
+	/*
+	 * Scan the group file to find additional groups.
+	 */
+	(*this->rewind)(this);
+	while ((grp = (*this->next)(this)) != NULL) {
+		if ((gid_t)grp->gr_gid == basegid)
+			continue;
+		for (i = 0; grp->gr_mem[i]; i++) {
+			if (!strcmp(grp->gr_mem[i], name)) {
+				if (ng >= maxgroups)
+					goto done;
+				groups[ng++] = grp->gr_gid;
+				break;
+			}
+		}
+	}
+	ret = 0;
+ done:
+	*ngroups = ng;
+	return (ret);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/assertions.c b/usr/src/lib/libresolv2_joy/common/isc/assertions.c
new file mode 100644
index 0000000000..b71e5a32d3
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/assertions.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1997, 1999, 2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: assertions.c,v 1.5 2008/11/14 02:36:51 marka Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/assertions.h>
+
+#include "port_after.h"
+
+/*
+ * Forward.
+ */
+
+static void default_assertion_failed(const char *, int, assertion_type,
+				     const char *, int);
+
+/*
+ * Public.
+ */
+
+assertion_failure_callback __assertion_failed = default_assertion_failed;
+
+void
+set_assertion_failure_callback(assertion_failure_callback f) {
+	if (f == NULL)
+		__assertion_failed = default_assertion_failed;
+	else
+		__assertion_failed = f;
+}
+
+const char *
+assertion_type_to_text(assertion_type type) {
+	const char *result;
+
+	switch (type) {
+	case assert_require:
+		result = "REQUIRE";
+		break;
+	case assert_ensure:
+		result = "ENSURE";
+		break;
+	case assert_insist:
+		result = "INSIST";
+		break;
+	case assert_invariant:
+		result = "INVARIANT";
+		break;
+	default:
+		result = NULL;
+	}
+	return (result);
+}
+
+/*
+ * Private.
+ */
+
+/* coverity[+kill] */
+static void
+default_assertion_failed(const char *file, int line, assertion_type type,
+			 const char *cond, int print_errno)
+{
+	fprintf(stderr, "%s:%d: %s(%s)%s%s failed.\n",
+		file, line, assertion_type_to_text(type), cond,
+		(print_errno) ? ": " : "",
+		(print_errno) ? strerror(errno) : "");
+	abort();
+	/* NOTREACHED */
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/base64.c b/usr/src/lib/libresolv2_joy/common/isc/base64.c
new file mode 100644
index 0000000000..79c35722b1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/base64.c
@@ -0,0 +1,333 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Portions Copyright (c) 1995 by International Business Machines, Inc.
+ *
+ * International Business Machines, Inc. (hereinafter called IBM) grants
+ * permission under its copyrights to use, copy, modify, and distribute this
+ * Software with or without fee, provided that the above copyright notice and
+ * all paragraphs of this notice appear in all copies, and that the name of IBM
+ * not be used in connection with the marketing of any product incorporating
+ * the Software or modifications thereof, without specific, written prior
+ * permission.
+ *
+ * To the extent it has a right to do so, IBM grants an immunity from suit
+ * under its patents, if any, for the use, sale or manufacture of products to
+ * the extent that such products are used for performing Domain Name System
+ * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
+ * granted for any product per se or for any other function of any product.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
+ * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+ * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: base64.c,v 1.4 2005/04/27 04:56:34 sra Exp $";
+#endif /* not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "port_after.h"
+
+#ifndef	ORIGINAL_ISC_CODE
+#pragma weak	__b64_ntop	=	b64_ntop
+#pragma weak	__b64_pton	=	b64_pton
+#endif	/* ORIGINAL_ISC_CODE */
+
+#define Assert(Cond) if (!(Cond)) abort()
+
+static const char Base64[] =
+	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+static const char Pad64 = '=';
+
+/* (From RFC1521 and draft-ietf-dnssec-secext-03.txt)
+   The following encoding technique is taken from RFC1521 by Borenstein
+   and Freed.  It is reproduced here in a slightly edited form for
+   convenience.
+
+   A 65-character subset of US-ASCII is used, enabling 6 bits to be
+   represented per printable character. (The extra 65th character, "=",
+   is used to signify a special processing function.)
+
+   The encoding process represents 24-bit groups of input bits as output
+   strings of 4 encoded characters. Proceeding from left to right, a
+   24-bit input group is formed by concatenating 3 8-bit input groups.
+   These 24 bits are then treated as 4 concatenated 6-bit groups, each
+   of which is translated into a single digit in the base64 alphabet.
+
+   Each 6-bit group is used as an index into an array of 64 printable
+   characters. The character referenced by the index is placed in the
+   output string.
+
+                         Table 1: The Base64 Alphabet
+
+      Value Encoding  Value Encoding  Value Encoding  Value Encoding
+          0 A            17 R            34 i            51 z
+          1 B            18 S            35 j            52 0
+          2 C            19 T            36 k            53 1
+          3 D            20 U            37 l            54 2
+          4 E            21 V            38 m            55 3
+          5 F            22 W            39 n            56 4
+          6 G            23 X            40 o            57 5
+          7 H            24 Y            41 p            58 6
+          8 I            25 Z            42 q            59 7
+          9 J            26 a            43 r            60 8
+         10 K            27 b            44 s            61 9
+         11 L            28 c            45 t            62 +
+         12 M            29 d            46 u            63 /
+         13 N            30 e            47 v
+         14 O            31 f            48 w         (pad) =
+         15 P            32 g            49 x
+         16 Q            33 h            50 y
+
+   Special processing is performed if fewer than 24 bits are available
+   at the end of the data being encoded.  A full encoding quantum is
+   always completed at the end of a quantity.  When fewer than 24 input
+   bits are available in an input group, zero bits are added (on the
+   right) to form an integral number of 6-bit groups.  Padding at the
+   end of the data is performed using the '=' character.
+
+   Since all base64 input is an integral number of octets, only the
+         -------------------------------------------------                       
+   following cases can arise:
+   
+       (1) the final quantum of encoding input is an integral
+           multiple of 24 bits; here, the final unit of encoded
+	   output will be an integral multiple of 4 characters
+	   with no "=" padding,
+       (2) the final quantum of encoding input is exactly 8 bits;
+           here, the final unit of encoded output will be two
+	   characters followed by two "=" padding characters, or
+       (3) the final quantum of encoding input is exactly 16 bits;
+           here, the final unit of encoded output will be three
+	   characters followed by one "=" padding character.
+   */
+
+int
+b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize) {
+	size_t datalength = 0;
+	u_char input[3];
+	u_char output[4];
+	size_t i;
+
+	while (2U < srclength) {
+		input[0] = *src++;
+		input[1] = *src++;
+		input[2] = *src++;
+		srclength -= 3;
+
+		output[0] = input[0] >> 2;
+		output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4);
+		output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6);
+		output[3] = input[2] & 0x3f;
+		Assert(output[0] < 64);
+		Assert(output[1] < 64);
+		Assert(output[2] < 64);
+		Assert(output[3] < 64);
+
+		if (datalength + 4 > targsize)
+			return (-1);
+		target[datalength++] = Base64[output[0]];
+		target[datalength++] = Base64[output[1]];
+		target[datalength++] = Base64[output[2]];
+		target[datalength++] = Base64[output[3]];
+	}
+    
+	/* Now we worry about padding. */
+	if (0U != srclength) {
+		/* Get what's left. */
+		input[0] = input[1] = input[2] = '\0';
+		for (i = 0; i < srclength; i++)
+			input[i] = *src++;
+	
+		output[0] = input[0] >> 2;
+		output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4);
+		output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6);
+		Assert(output[0] < 64);
+		Assert(output[1] < 64);
+		Assert(output[2] < 64);
+
+		if (datalength + 4 > targsize)
+			return (-1);
+		target[datalength++] = Base64[output[0]];
+		target[datalength++] = Base64[output[1]];
+		if (srclength == 1U)
+			target[datalength++] = Pad64;
+		else
+			target[datalength++] = Base64[output[2]];
+		target[datalength++] = Pad64;
+	}
+	if (datalength >= targsize)
+		return (-1);
+	target[datalength] = '\0';	/*%< Returned value doesn't count \\0. */
+	return (datalength);
+}
+
+/* skips all whitespace anywhere.
+   converts characters, four at a time, starting at (or after)
+   src from base - 64 numbers into three 8 bit bytes in the target area.
+   it returns the number of data bytes stored at the target, or -1 on error.
+ */
+
+int
+b64_pton(src, target, targsize)
+	char const *src;
+	u_char *target;
+	size_t targsize;
+{
+	int tarindex, state, ch;
+	char *pos;
+
+	state = 0;
+	tarindex = 0;
+
+	while ((ch = *src++) != '\0') {
+		if (isspace(ch))	/*%< Skip whitespace anywhere. */
+			continue;
+
+		if (ch == Pad64)
+			break;
+
+		pos = strchr(Base64, ch);
+		if (pos == 0) 		/*%< A non-base64 character. */
+			return (-1);
+
+		switch (state) {
+		case 0:
+			if (target) {
+				if ((size_t)tarindex >= targsize)
+					return (-1);
+				target[tarindex] = (pos - Base64) << 2;
+			}
+			state = 1;
+			break;
+		case 1:
+			if (target) {
+				if ((size_t)tarindex + 1 >= targsize)
+					return (-1);
+				target[tarindex]   |=  (pos - Base64) >> 4;
+				target[tarindex+1]  = ((pos - Base64) & 0x0f)
+							<< 4 ;
+			}
+			tarindex++;
+			state = 2;
+			break;
+		case 2:
+			if (target) {
+				if ((size_t)tarindex + 1 >= targsize)
+					return (-1);
+				target[tarindex]   |=  (pos - Base64) >> 2;
+				target[tarindex+1]  = ((pos - Base64) & 0x03)
+							<< 6;
+			}
+			tarindex++;
+			state = 3;
+			break;
+		case 3:
+			if (target) {
+				if ((size_t)tarindex >= targsize)
+					return (-1);
+				target[tarindex] |= (pos - Base64);
+			}
+			tarindex++;
+			state = 0;
+			break;
+		default:
+			abort();
+		}
+	}
+
+	/*
+	 * We are done decoding Base-64 chars.  Let's see if we ended
+	 * on a byte boundary, and/or with erroneous trailing characters.
+	 */
+
+	if (ch == Pad64) {		/*%< We got a pad char. */
+		ch = *src++;		/*%< Skip it, get next. */
+		switch (state) {
+		case 0:		/*%< Invalid = in first position */
+		case 1:		/*%< Invalid = in second position */
+			return (-1);
+
+		case 2:		/*%< Valid, means one byte of info */
+			/* Skip any number of spaces. */
+			for ((void)NULL; ch != '\0'; ch = *src++)
+				if (!isspace(ch))
+					break;
+			/* Make sure there is another trailing = sign. */
+			if (ch != Pad64)
+				return (-1);
+			ch = *src++;		/*%< Skip the = */
+			/* Fall through to "single trailing =" case. */
+			/* FALLTHROUGH */
+
+		case 3:		/*%< Valid, means two bytes of info */
+			/*
+			 * We know this char is an =.  Is there anything but
+			 * whitespace after it?
+			 */
+			for ((void)NULL; ch != '\0'; ch = *src++)
+				if (!isspace(ch))
+					return (-1);
+
+			/*
+			 * Now make sure for cases 2 and 3 that the "extra"
+			 * bits that slopped past the last full byte were
+			 * zeros.  If we don't check them, they become a
+			 * subliminal channel.
+			 */
+			if (target && target[tarindex] != 0)
+				return (-1);
+		}
+	} else {
+		/*
+		 * We ended by seeing the end of the string.  Make sure we
+		 * have no partial bytes lying around.
+		 */
+		if (state != 0)
+			return (-1);
+	}
+
+	return (tarindex);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/bitncmp.c b/usr/src/lib/libresolv2_joy/common/isc/bitncmp.c
new file mode 100644
index 0000000000..efe5009292
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/bitncmp.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1996, 1999, 2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: bitncmp.c,v 1.5 2008/11/14 02:36:51 marka Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+
+#include <string.h>
+
+#include "port_after.h"
+
+#include <isc/misc.h>
+
+/*%
+ * int
+ * bitncmp(l, r, n)
+ *	compare bit masks l and r, for n bits.
+ * return:
+ *	-1, 1, or 0 in the libc tradition.
+ * note:
+ *	network byte order assumed.  this means 192.5.5.240/28 has
+ *	0x11110000 in its fourth octet.
+ * author:
+ *	Paul Vixie (ISC), June 1996
+ */
+int
+bitncmp(const void *l, const void *r, int n) {
+	u_int lb, rb;
+	int x, b;
+
+	b = n / 8;
+	x = memcmp(l, r, b);
+	if (x || (n % 8) == 0)
+		return (x);
+
+	lb = ((const u_char *)l)[b];
+	rb = ((const u_char *)r)[b];
+	for (b = n % 8; b > 0; b--) {
+		if ((lb & 0x80) != (rb & 0x80)) {
+			if (lb & 0x80)
+				return (1);
+			return (-1);
+		}
+		lb <<= 1;
+		rb <<= 1;
+	}
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ctl_clnt.c b/usr/src/lib/libresolv2_joy/common/isc/ctl_clnt.c
new file mode 100644
index 0000000000..f71001a6d4
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ctl_clnt.c
@@ -0,0 +1,620 @@
+/*
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1998-2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(lint) && !defined(SABER)
+static const char rcsid[] = "$Id: ctl_clnt.c,v 1.11 2008/11/14 02:36:51 marka Exp $";
+#endif /* not lint */
+
+/* Extern. */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#ifdef HAVE_MEMORY_H
+#include <memory.h>
+#endif
+
+#include <isc/assertions.h>
+#include <isc/ctl.h>
+#include <isc/eventlib.h>
+#include <isc/list.h>
+#include <isc/memcluster.h>
+
+#include "ctl_p.h"
+
+#include "port_after.h"
+
+/* Constants. */
+
+
+/* Macros. */
+
+#define donefunc_p(ctx) ((ctx).donefunc != NULL)
+#define arpacode_p(line) (isdigit((unsigned char)(line[0])) && \
+			  isdigit((unsigned char)(line[1])) && \
+			  isdigit((unsigned char)(line[2])))
+#define arpacont_p(line) (line[3] == '-')
+#define arpadone_p(line) (line[3] == ' ' || line[3] == '\t' || \
+			  line[3] == '\r' || line[3] == '\0')
+
+/* Types. */
+
+enum state {
+	initializing = 0, connecting, connected, destroyed
+};
+
+struct ctl_tran {
+	LINK(struct ctl_tran)	link;
+	LINK(struct ctl_tran)	wlink;
+	struct ctl_cctx *	ctx;
+	struct ctl_buf		outbuf;
+	ctl_clntdone		donefunc;
+	void *			uap;
+};
+
+struct ctl_cctx {
+	enum state		state;
+	evContext		ev;
+	int			sock;
+	ctl_logfunc		logger;
+	ctl_clntdone		donefunc;
+	void *			uap;
+	evConnID		coID;
+	evTimerID		tiID;
+	evFileID		rdID;
+	evStreamID		wrID;
+	struct ctl_buf		inbuf;
+	struct timespec		timeout;
+	LIST(struct ctl_tran)	tran;
+	LIST(struct ctl_tran)	wtran;
+};
+
+/* Forward. */
+
+static struct ctl_tran *new_tran(struct ctl_cctx *, ctl_clntdone, void *, int);
+static void		start_write(struct ctl_cctx *);
+static void		destroy(struct ctl_cctx *, int);
+static void		error(struct ctl_cctx *);
+static void		new_state(struct ctl_cctx *, enum state);
+static void		conn_done(evContext, void *, int,
+				  const void *, int,
+				  const void *, int);
+static void		write_done(evContext, void *, int, int);
+static void		start_read(struct ctl_cctx *);
+static void		stop_read(struct ctl_cctx *);
+static void		readable(evContext, void *, int, int);
+static void		start_timer(struct ctl_cctx *);
+static void		stop_timer(struct ctl_cctx *);
+static void		touch_timer(struct ctl_cctx *);
+static void		timer(evContext, void *,
+			      struct timespec, struct timespec);
+
+#ifndef HAVE_MEMCHR
+static void *
+memchr(const void *b, int c, size_t len) {
+	const unsigned char *p = b;
+	size_t i;
+
+	for (i = 0; i < len; i++, p++)
+		if (*p == (unsigned char)c)
+			return ((void *)p);
+	return (NULL);
+}
+#endif
+
+/* Private data. */
+
+static const char * const state_names[] = {
+	"initializing", "connecting", "connected", "destroyed"
+};
+
+/* Public. */
+
+/*%
+ * void
+ * ctl_client()
+ *	create, condition, and connect to a listener on the control port.
+ */
+struct ctl_cctx *
+ctl_client(evContext lev, const struct sockaddr *cap, size_t cap_len,
+	   const struct sockaddr *sap, size_t sap_len,
+	   ctl_clntdone donefunc, void *uap,
+	   u_int timeout, ctl_logfunc logger)
+{
+	static const char me[] = "ctl_client";
+	static const int on = 1;
+	struct ctl_cctx *ctx;
+	struct sockaddr *captmp;
+
+	if (logger == NULL)
+		logger = ctl_logger;
+	ctx = memget(sizeof *ctx);
+	if (ctx == NULL) {
+		(*logger)(ctl_error, "%s: getmem: %s", me, strerror(errno));
+		goto fatal;
+	}
+	ctx->state = initializing;
+	ctx->ev = lev;
+	ctx->logger = logger;
+	ctx->timeout = evConsTime(timeout, 0);
+	ctx->donefunc = donefunc;
+	ctx->uap = uap;
+	ctx->coID.opaque = NULL;
+	ctx->tiID.opaque = NULL;
+	ctx->rdID.opaque = NULL;
+	ctx->wrID.opaque = NULL;
+	buffer_init(ctx->inbuf);
+	INIT_LIST(ctx->tran);
+	INIT_LIST(ctx->wtran);
+	ctx->sock = socket(sap->sa_family, SOCK_STREAM, PF_UNSPEC);
+	if (ctx->sock > evHighestFD(ctx->ev)) {
+		ctx->sock = -1;
+		errno = ENOTSOCK;
+	}
+	if (ctx->sock < 0) {
+		(*ctx->logger)(ctl_error, "%s: socket: %s",
+			       me, strerror(errno));
+		goto fatal;
+	}
+	if (cap != NULL) {
+		if (setsockopt(ctx->sock, SOL_SOCKET, SO_REUSEADDR,
+			       (const char *)&on, sizeof on) != 0) {
+			(*ctx->logger)(ctl_warning,
+				       "%s: setsockopt(REUSEADDR): %s",
+				       me, strerror(errno));
+		}
+		DE_CONST(cap, captmp);
+		if (bind(ctx->sock, captmp, cap_len) < 0) {
+			(*ctx->logger)(ctl_error, "%s: bind: %s", me,
+				       strerror(errno));
+			goto fatal;
+		}
+	}
+	if (evConnect(lev, ctx->sock, (const struct sockaddr *)sap, sap_len,
+		      conn_done, ctx, &ctx->coID) < 0) {
+		(*ctx->logger)(ctl_error, "%s: evConnect(fd %d): %s",
+			       me, ctx->sock, strerror(errno));
+ fatal:
+		if (ctx != NULL) {
+			if (ctx->sock >= 0)
+				close(ctx->sock);
+			memput(ctx, sizeof *ctx);
+		}
+		return (NULL);
+	}
+	new_state(ctx, connecting);
+	return (ctx);
+}
+
+/*%
+ * void
+ * ctl_endclient(ctx)
+ *	close a client and release all of its resources.
+ */
+void
+ctl_endclient(struct ctl_cctx *ctx) {
+	if (ctx->state != destroyed)
+		destroy(ctx, 0);
+	memput(ctx, sizeof *ctx);
+}
+
+/*%
+ * int
+ * ctl_command(ctx, cmd, len, donefunc, uap)
+ *	Queue a transaction, which will begin with sending cmd
+ *	and complete by calling donefunc with the answer.
+ */
+int
+ctl_command(struct ctl_cctx *ctx, const char *cmd, size_t len,
+	    ctl_clntdone donefunc, void *uap)
+{
+	struct ctl_tran *tran;
+	char *pc;
+	unsigned int n;
+
+	switch (ctx->state) {
+	case destroyed:
+		errno = ENOTCONN;
+		return (-1);
+	case connecting:
+	case connected:
+		break;
+	default:
+		abort();
+	}
+	if (len >= (size_t)MAX_LINELEN) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	tran = new_tran(ctx, donefunc, uap, 1);
+	if (tran == NULL)
+		return (-1);
+	if (ctl_bufget(&tran->outbuf, ctx->logger) < 0)
+		return (-1);
+	memcpy(tran->outbuf.text, cmd, len);
+	tran->outbuf.used = len;
+	for (pc = tran->outbuf.text, n = 0; n < tran->outbuf.used; pc++, n++)
+		if (!isascii((unsigned char)*pc) ||
+		    !isprint((unsigned char)*pc))
+			*pc = '\040';
+	start_write(ctx);
+	return (0);
+}
+
+/* Private. */
+
+static struct ctl_tran *
+new_tran(struct ctl_cctx *ctx, ctl_clntdone donefunc, void *uap, int w) {
+	struct ctl_tran *new = memget(sizeof *new);
+
+	if (new == NULL)
+		return (NULL);
+	new->ctx = ctx;
+	buffer_init(new->outbuf);
+	new->donefunc = donefunc;
+	new->uap = uap;
+	INIT_LINK(new, link);
+	INIT_LINK(new, wlink);
+	APPEND(ctx->tran, new, link);
+	if (w)
+		APPEND(ctx->wtran, new, wlink);
+	return (new);
+}
+
+static void
+start_write(struct ctl_cctx *ctx) {
+	static const char me[] = "isc/ctl_clnt::start_write";
+	struct ctl_tran *tran;
+	struct iovec iov[2], *iovp = iov;
+	char * tmp;
+
+	REQUIRE(ctx->state == connecting || ctx->state == connected);
+	/* If there is a write in progress, don't try to write more yet. */
+	if (ctx->wrID.opaque != NULL)
+		return;
+	/* If there are no trans, make sure timer is off, and we're done. */
+	if (EMPTY(ctx->wtran)) {
+		if (ctx->tiID.opaque != NULL)
+			stop_timer(ctx);
+		return;
+	}
+	/* Pull it off the head of the write queue. */
+	tran = HEAD(ctx->wtran);
+	UNLINK(ctx->wtran, tran, wlink);
+	/* Since there are some trans, make sure timer is successfully "on". */
+	if (ctx->tiID.opaque != NULL)
+		touch_timer(ctx);
+	else
+		start_timer(ctx);
+	if (ctx->state == destroyed)
+		return;
+	/* Marshall a newline-terminated message and clock it out. */
+	*iovp++ = evConsIovec(tran->outbuf.text, tran->outbuf.used);
+	DE_CONST("\r\n", tmp);
+	*iovp++ = evConsIovec(tmp, 2);
+	if (evWrite(ctx->ev, ctx->sock, iov, iovp - iov,
+		    write_done, tran, &ctx->wrID) < 0) {
+		(*ctx->logger)(ctl_error, "%s: evWrite: %s", me,
+			       strerror(errno));
+		error(ctx);
+		return;
+	}
+	if (evTimeRW(ctx->ev, ctx->wrID, ctx->tiID) < 0) {
+		(*ctx->logger)(ctl_error, "%s: evTimeRW: %s", me,
+			       strerror(errno));
+		error(ctx);
+		return;
+	}
+}
+
+static void
+destroy(struct ctl_cctx *ctx, int notify) {
+	struct ctl_tran *this, *next;
+
+	if (ctx->sock != -1) {
+		(void) close(ctx->sock);
+		ctx->sock = -1;
+	}
+	switch (ctx->state) {
+	case connecting:
+		REQUIRE(ctx->wrID.opaque == NULL);
+		REQUIRE(EMPTY(ctx->tran));
+		/*
+		 * This test is nec'y since destroy() can be called from
+		 * start_read() while the state is still "connecting".
+		 */
+		if (ctx->coID.opaque != NULL) {
+			(void)evCancelConn(ctx->ev, ctx->coID);
+			ctx->coID.opaque = NULL;
+		}
+		break;
+	case connected:
+		REQUIRE(ctx->coID.opaque == NULL);
+		if (ctx->wrID.opaque != NULL) {
+			(void)evCancelRW(ctx->ev, ctx->wrID);
+			ctx->wrID.opaque = NULL;
+		}
+		if (ctx->rdID.opaque != NULL)
+			stop_read(ctx);
+		break;
+	case destroyed:
+		break;
+	default:
+		abort();
+	}
+	if (allocated_p(ctx->inbuf))
+		ctl_bufput(&ctx->inbuf);
+	for (this = HEAD(ctx->tran); this != NULL; this = next) {
+		next = NEXT(this, link);
+		if (allocated_p(this->outbuf))
+			ctl_bufput(&this->outbuf);
+		if (notify && this->donefunc != NULL)
+			(*this->donefunc)(ctx, this->uap, NULL, 0);
+		memput(this, sizeof *this);
+	}
+	if (ctx->tiID.opaque != NULL)
+		stop_timer(ctx);
+	new_state(ctx, destroyed);
+}
+
+static void
+error(struct ctl_cctx *ctx) {
+	REQUIRE(ctx->state != destroyed);
+	destroy(ctx, 1);
+}
+
+static void
+new_state(struct ctl_cctx *ctx, enum state new_state) {
+	static const char me[] = "isc/ctl_clnt::new_state";
+
+	(*ctx->logger)(ctl_debug, "%s: %s -> %s", me,
+		       state_names[ctx->state], state_names[new_state]);
+	ctx->state = new_state;
+}
+
+static void
+conn_done(evContext ev, void *uap, int fd,
+	  const void *la, int lalen,
+	  const void *ra, int ralen)
+{
+	static const char me[] = "isc/ctl_clnt::conn_done";
+	struct ctl_cctx *ctx = uap;
+	struct ctl_tran *tran;
+
+	UNUSED(ev);
+	UNUSED(la);
+	UNUSED(lalen);
+	UNUSED(ra);
+	UNUSED(ralen);
+
+	ctx->coID.opaque = NULL;
+	if (fd < 0) {
+		(*ctx->logger)(ctl_error, "%s: evConnect: %s", me,
+			       strerror(errno));
+		error(ctx);
+		return;
+	}
+	new_state(ctx, connected);
+	tran = new_tran(ctx, ctx->donefunc, ctx->uap, 0);
+	if (tran == NULL) {
+		(*ctx->logger)(ctl_error, "%s: new_tran failed: %s", me,
+			       strerror(errno));
+		error(ctx);
+		return;
+	}
+	start_read(ctx);
+	if (ctx->state == destroyed) {
+		(*ctx->logger)(ctl_error, "%s: start_read failed: %s",
+			       me, strerror(errno));
+		error(ctx);
+		return;
+	}
+}
+
+static void
+write_done(evContext lev, void *uap, int fd, int bytes) {
+	struct ctl_tran *tran = (struct ctl_tran *)uap;
+	struct ctl_cctx *ctx = tran->ctx;
+
+	UNUSED(lev);
+	UNUSED(fd);
+
+	ctx->wrID.opaque = NULL;
+	if (ctx->tiID.opaque != NULL)
+		touch_timer(ctx);
+	ctl_bufput(&tran->outbuf);
+	start_write(ctx);
+	if (bytes < 0)
+		destroy(ctx, 1);
+	else
+		start_read(ctx);
+}
+
+static void
+start_read(struct ctl_cctx *ctx) {
+	static const char me[] = "isc/ctl_clnt::start_read";
+
+	REQUIRE(ctx->state == connecting || ctx->state == connected);
+	REQUIRE(ctx->rdID.opaque == NULL);
+	if (evSelectFD(ctx->ev, ctx->sock, EV_READ, readable, ctx,
+		       &ctx->rdID) < 0)
+	{
+		(*ctx->logger)(ctl_error, "%s: evSelect(fd %d): %s", me,
+			       ctx->sock, strerror(errno));
+		error(ctx);
+		return;
+	}
+}
+
+static void
+stop_read(struct ctl_cctx *ctx) {
+	REQUIRE(ctx->coID.opaque == NULL);
+	REQUIRE(ctx->rdID.opaque != NULL);
+	(void)evDeselectFD(ctx->ev, ctx->rdID);
+	ctx->rdID.opaque = NULL;
+}
+
+static void
+readable(evContext ev, void *uap, int fd, int evmask) {
+	static const char me[] = "isc/ctl_clnt::readable";
+	struct ctl_cctx *ctx = uap;
+	struct ctl_tran *tran;
+	ssize_t n;
+	char *eos;
+
+	UNUSED(ev);
+
+	REQUIRE(ctx != NULL);
+	REQUIRE(fd >= 0);
+	REQUIRE(evmask == EV_READ);
+	REQUIRE(ctx->state == connected);
+	REQUIRE(!EMPTY(ctx->tran));
+	tran = HEAD(ctx->tran);
+	if (!allocated_p(ctx->inbuf) &&
+	    ctl_bufget(&ctx->inbuf, ctx->logger) < 0) {
+		(*ctx->logger)(ctl_error, "%s: can't get an input buffer", me);
+		error(ctx);
+		return;
+	}
+	n = read(ctx->sock, ctx->inbuf.text + ctx->inbuf.used,
+		 MAX_LINELEN - ctx->inbuf.used);
+	if (n <= 0) {
+		(*ctx->logger)(ctl_warning, "%s: read: %s", me,
+			       (n == 0) ? "Unexpected EOF" : strerror(errno));
+		error(ctx);
+		return;
+	}
+	if (ctx->tiID.opaque != NULL)
+		touch_timer(ctx);
+	ctx->inbuf.used += n;
+	(*ctx->logger)(ctl_debug, "%s: read %d, used %d", me,
+		       n, ctx->inbuf.used);
+ again:
+	eos = memchr(ctx->inbuf.text, '\n', ctx->inbuf.used);
+	if (eos != NULL && eos != ctx->inbuf.text && eos[-1] == '\r') {
+		int done = 0;
+
+		eos[-1] = '\0';
+		if (!arpacode_p(ctx->inbuf.text)) {
+			/* XXX Doesn't FTP do this sometimes? Is it legal? */
+			(*ctx->logger)(ctl_error, "%s: no arpa code (%s)", me,
+				       ctx->inbuf.text);
+			error(ctx);
+			return;
+		}
+		if (arpadone_p(ctx->inbuf.text))
+			done = 1;
+		else if (arpacont_p(ctx->inbuf.text))
+			done = 0;
+		else {
+			/* XXX Doesn't FTP do this sometimes? Is it legal? */
+			(*ctx->logger)(ctl_error, "%s: no arpa flag (%s)", me,
+				       ctx->inbuf.text);
+			error(ctx);
+			return;
+		}
+		(*tran->donefunc)(ctx, tran->uap, ctx->inbuf.text,
+				  (done ? 0 : CTL_MORE));
+		ctx->inbuf.used -= ((eos - ctx->inbuf.text) + 1);
+		if (ctx->inbuf.used == 0U)
+			ctl_bufput(&ctx->inbuf);
+		else
+			memmove(ctx->inbuf.text, eos + 1, ctx->inbuf.used);
+		if (done) {
+			UNLINK(ctx->tran, tran, link);
+			memput(tran, sizeof *tran);
+			stop_read(ctx);
+			start_write(ctx);
+			return;
+		}
+		if (allocated_p(ctx->inbuf))
+			goto again;
+		return;
+	}
+	if (ctx->inbuf.used == (size_t)MAX_LINELEN) {
+		(*ctx->logger)(ctl_error, "%s: line too long (%-10s...)", me,
+			       ctx->inbuf.text);
+		error(ctx);
+	}
+}
+
+/* Timer related stuff. */
+
+static void
+start_timer(struct ctl_cctx *ctx) {
+	static const char me[] = "isc/ctl_clnt::start_timer";
+
+	REQUIRE(ctx->tiID.opaque == NULL);
+	if (evSetIdleTimer(ctx->ev, timer, ctx, ctx->timeout, &ctx->tiID) < 0){
+		(*ctx->logger)(ctl_error, "%s: evSetIdleTimer: %s", me,
+			       strerror(errno));
+		error(ctx);
+		return;
+	}
+}
+
+static void
+stop_timer(struct ctl_cctx *ctx) {
+	static const char me[] = "isc/ctl_clnt::stop_timer";
+
+	REQUIRE(ctx->tiID.opaque != NULL);
+	if (evClearIdleTimer(ctx->ev, ctx->tiID) < 0) {
+		(*ctx->logger)(ctl_error, "%s: evClearIdleTimer: %s", me,
+			       strerror(errno));
+		error(ctx);
+		return;
+	}
+	ctx->tiID.opaque = NULL;
+}
+
+static void
+touch_timer(struct ctl_cctx *ctx) {
+	REQUIRE(ctx->tiID.opaque != NULL);
+
+	evTouchIdleTimer(ctx->ev, ctx->tiID);
+}
+
+static void
+timer(evContext ev, void *uap, struct timespec due, struct timespec itv) {
+	static const char me[] = "isc/ctl_clnt::timer";
+	struct ctl_cctx *ctx = uap;
+
+	UNUSED(ev);
+	UNUSED(due);
+	UNUSED(itv);
+
+	ctx->tiID.opaque = NULL;
+	(*ctx->logger)(ctl_error, "%s: timeout after %u seconds while %s", me,
+		       ctx->timeout.tv_sec, state_names[ctx->state]);
+	error(ctx);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ctl_p.c b/usr/src/lib/libresolv2_joy/common/isc/ctl_p.c
new file mode 100644
index 0000000000..7ab719a5e6
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ctl_p.c
@@ -0,0 +1,188 @@
+#if !defined(lint) && !defined(SABER)
+static const char rcsid[] = "$Id: ctl_p.c,v 1.4 2005/04/27 04:56:35 sra Exp $";
+#endif /* not lint */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Extern. */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include <isc/assertions.h>
+#include <isc/eventlib.h>
+#include <isc/logging.h>
+#include <isc/memcluster.h>
+#include <isc/ctl.h>
+
+#include "ctl_p.h"
+
+#include "port_after.h"
+
+/* Constants. */
+
+const char * const ctl_sevnames[] = {
+	"debug", "warning", "error"
+};
+
+/* Public. */
+
+/*%
+ * ctl_logger()
+ *	if ctl_startup()'s caller didn't specify a logger, this one
+ *	is used.  this pollutes stderr with all kinds of trash so it will
+ *	probably never be used in real applications.
+ */
+void
+ctl_logger(enum ctl_severity severity, const char *format, ...) {
+	va_list ap;
+	static const char me[] = "ctl_logger";
+
+	fprintf(stderr, "%s(%s): ", me, ctl_sevnames[severity]);
+	va_start(ap, format);
+	vfprintf(stderr, format, ap);
+	va_end(ap);
+	fputc('\n', stderr);
+}
+
+int
+ctl_bufget(struct ctl_buf *buf, ctl_logfunc logger) {
+	static const char me[] = "ctl_bufget";
+
+	REQUIRE(!allocated_p(*buf) && buf->used == 0U);
+	buf->text = memget(MAX_LINELEN);
+	if (!allocated_p(*buf)) {
+		(*logger)(ctl_error, "%s: getmem: %s", me, strerror(errno));
+		return (-1);
+	}
+	buf->used = 0;
+	return (0);
+}
+
+void
+ctl_bufput(struct ctl_buf *buf) {
+
+	REQUIRE(allocated_p(*buf));
+	memput(buf->text, MAX_LINELEN);
+	buf->text = NULL;
+	buf->used = 0;
+}
+
+const char *
+ctl_sa_ntop(const struct sockaddr *sa,
+	    char *buf, size_t size,
+	    ctl_logfunc logger)
+{
+	static const char me[] = "ctl_sa_ntop";
+	static const char punt[] = "[0].-1";
+	char tmp[INET6_ADDRSTRLEN];
+
+	switch (sa->sa_family) {
+	case AF_INET6: {
+		const struct sockaddr_in6 *in6 =
+					(const struct sockaddr_in6 *) sa;
+
+		if (inet_ntop(in6->sin6_family, &in6->sin6_addr, tmp, sizeof tmp)
+		    == NULL) {
+			(*logger)(ctl_error, "%s: inet_ntop(%u %04x): %s",
+				  me, in6->sin6_family,
+				  in6->sin6_port, strerror(errno));
+			return (punt);
+		}
+		if (strlen(tmp) + sizeof "[].65535" > size) {
+			(*logger)(ctl_error, "%s: buffer overflow", me);
+			return (punt);
+		}
+		(void) sprintf(buf, "[%s].%u", tmp, ntohs(in6->sin6_port));
+		return (buf);
+	    }
+	case AF_INET: {
+		const struct sockaddr_in *in =
+					      (const struct sockaddr_in *) sa;
+
+		if (inet_ntop(in->sin_family, &in->sin_addr, tmp, sizeof tmp)
+		    == NULL) {
+			(*logger)(ctl_error, "%s: inet_ntop(%u %04x %08x): %s",
+				  me, in->sin_family,
+				  in->sin_port, in->sin_addr.s_addr,
+				  strerror(errno));
+			return (punt);
+		}
+		if (strlen(tmp) + sizeof "[].65535" > size) {
+			(*logger)(ctl_error, "%s: buffer overflow", me);
+			return (punt);
+		}
+		(void) sprintf(buf, "[%s].%u", tmp, ntohs(in->sin_port));
+		return (buf);
+	    }
+#ifndef NO_SOCKADDR_UN
+	case AF_UNIX: {
+		const struct sockaddr_un *un = 
+					      (const struct sockaddr_un *) sa;
+		unsigned int x = sizeof un->sun_path;
+
+		if (x > size)
+			x = size;
+		strncpy(buf, un->sun_path, x - 1);
+		buf[x - 1] = '\0';
+		return (buf);
+	    }
+#endif
+	default:
+		return (punt);
+	}
+}
+
+void
+ctl_sa_copy(const struct sockaddr *src, struct sockaddr *dst) {
+	switch (src->sa_family) {
+	case AF_INET6:
+		*((struct sockaddr_in6 *)dst) =
+					 *((const struct sockaddr_in6 *)src);
+		break;
+	case AF_INET:
+		*((struct sockaddr_in *)dst) =
+					  *((const struct sockaddr_in *)src);
+		break;
+#ifndef NO_SOCKADDR_UN
+	case AF_UNIX:
+		*((struct sockaddr_un *)dst) =
+					  *((const struct sockaddr_un *)src);
+		break;
+#endif
+	default:
+		*dst = *src;
+		break;
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ctl_p.h b/usr/src/lib/libresolv2_joy/common/isc/ctl_p.h
new file mode 100644
index 0000000000..18a52ae39c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ctl_p.h
@@ -0,0 +1,28 @@
+struct ctl_buf {
+	char *			text;
+	size_t			used;
+};
+
+#define	MAX_LINELEN		990	/*%< Like SMTP. */
+#ifndef NO_SOCKADDR_UN
+#define MAX_NTOP			PATH_MAX
+#else
+#define	MAX_NTOP		(sizeof "[255.255.255.255].65535")
+#endif
+
+#define	allocated_p(Buf) ((Buf).text != NULL)
+#define	buffer_init(Buf) ((Buf).text = 0, (Buf.used) = 0)
+
+#define	ctl_bufget	__ctl_bufget
+#define	ctl_bufput	__ctl_bufput
+#define	ctl_sa_ntop	__ctl_sa_ntop
+#define	ctl_sa_copy	__ctl_sa_copy
+
+int			ctl_bufget(struct ctl_buf *, ctl_logfunc);
+void			ctl_bufput(struct ctl_buf *);
+const char *		ctl_sa_ntop(const struct sockaddr *, char *, size_t,
+				    ctl_logfunc);
+void			ctl_sa_copy(const struct sockaddr *,
+				    struct sockaddr *);
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ctl_srvr.c b/usr/src/lib/libresolv2_joy/common/isc/ctl_srvr.c
new file mode 100644
index 0000000000..8fd7a21ffa
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ctl_srvr.c
@@ -0,0 +1,787 @@
+/*
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1998-2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(lint) && !defined(SABER)
+static const char rcsid[] = "$Id: ctl_srvr.c,v 1.10 2008/11/14 02:36:51 marka Exp $";
+#endif /* not lint */
+
+/* Extern. */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#include <fcntl.h>
+#ifdef HAVE_MEMORY_H
+#include <memory.h>
+#endif
+
+#include <isc/assertions.h>
+#include <isc/ctl.h>
+#include <isc/eventlib.h>
+#include <isc/list.h>
+#include <isc/logging.h>
+#include <isc/memcluster.h>
+
+#include "ctl_p.h"
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+/* Macros. */
+
+#define	lastverb_p(verb)	(verb->name == NULL || verb->func == NULL)
+#define	address_expr		ctl_sa_ntop((struct sockaddr *)&sess->sa, \
+					    tmp, sizeof tmp, ctx->logger)
+
+/* Types. */
+
+enum state {
+	available = 0, initializing, writing, reading, reading_data,
+	processing, idling, quitting, closing
+};
+
+union sa_un {
+	struct sockaddr_in in;
+#ifndef NO_SOCKADDR_UN
+	struct sockaddr_un un;
+#endif
+};
+
+struct ctl_sess {
+	LINK(struct ctl_sess)	link;
+	struct ctl_sctx *	ctx;
+	enum state		state;
+	int			sock;
+	union sa_un		sa;
+	evFileID		rdID;
+	evStreamID		wrID;
+	evTimerID		rdtiID;
+	evTimerID		wrtiID;
+	struct ctl_buf		inbuf;
+	struct ctl_buf		outbuf;
+	const struct ctl_verb *	verb;
+	u_int			helpcode;
+	const void *		respctx;
+	u_int			respflags;
+	ctl_srvrdone		donefunc;
+	void *			uap;
+	void *			csctx;
+};
+
+struct ctl_sctx {
+	evContext		ev;
+	void *			uctx;
+	u_int			unkncode;
+	u_int			timeoutcode;
+	const struct ctl_verb *	verbs;
+	const struct ctl_verb *	connverb;
+	int			sock;
+	int			max_sess;
+	int			cur_sess;
+	struct timespec		timeout;
+	ctl_logfunc		logger;
+	evConnID		acID;
+	LIST(struct ctl_sess)	sess;
+};
+
+/* Forward. */
+
+static void			ctl_accept(evContext, void *, int,
+					   const void *, int,
+					   const void *, int);
+static void			ctl_close(struct ctl_sess *);
+static void			ctl_new_state(struct ctl_sess *,
+					      enum state,
+					      const char *);
+static void			ctl_start_read(struct ctl_sess *);
+static void			ctl_stop_read(struct ctl_sess *);
+static void			ctl_readable(evContext, void *, int, int);
+static void			ctl_rdtimeout(evContext, void *,
+					      struct timespec,
+					      struct timespec);
+static void			ctl_wrtimeout(evContext, void *,
+					      struct timespec,
+					      struct timespec);
+static void			ctl_docommand(struct ctl_sess *);
+static void			ctl_writedone(evContext, void *, int, int);
+static void			ctl_morehelp(struct ctl_sctx *,
+					     struct ctl_sess *,
+					     const struct ctl_verb *,
+					     const char *,
+					     u_int, const void *, void *);
+static void			ctl_signal_done(struct ctl_sctx *,
+						struct ctl_sess *);
+
+/* Private data. */
+
+static const char *		state_names[] = {
+	"available", "initializing", "writing", "reading",
+	"reading_data", "processing", "idling", "quitting", "closing"
+};
+
+static const char		space[] = " ";
+
+static const struct ctl_verb	fakehelpverb = {
+	"fakehelp", ctl_morehelp , NULL
+};
+
+/* Public. */
+
+/*%
+ * void
+ * ctl_server()
+ *	create, condition, and start a listener on the control port.
+ */
+struct ctl_sctx *
+ctl_server(evContext lev, const struct sockaddr *sap, size_t sap_len,
+	   const struct ctl_verb *verbs,
+	   u_int unkncode, u_int timeoutcode,
+	   u_int timeout, int backlog, int max_sess,
+	   ctl_logfunc logger, void *uctx)
+{
+	static const char me[] = "ctl_server";
+	static const int on = 1;
+	const struct ctl_verb *connverb;
+	struct ctl_sctx *ctx;
+	int save_errno;
+
+	if (logger == NULL)
+		logger = ctl_logger;
+	for (connverb = verbs;
+	     connverb->name != NULL && connverb->func != NULL;
+	     connverb++)
+		if (connverb->name[0] == '\0')
+			break;
+	if (connverb->func == NULL) {
+		(*logger)(ctl_error, "%s: no connection verb found", me);
+		return (NULL);
+	}
+	ctx = memget(sizeof *ctx);
+	if (ctx == NULL) {
+		(*logger)(ctl_error, "%s: getmem: %s", me, strerror(errno));
+		return (NULL);
+	}
+	ctx->ev = lev;
+	ctx->uctx = uctx;
+	ctx->unkncode = unkncode;
+	ctx->timeoutcode = timeoutcode;
+	ctx->verbs = verbs;
+	ctx->timeout = evConsTime(timeout, 0);
+	ctx->logger = logger;
+	ctx->connverb = connverb;
+	ctx->max_sess = max_sess;
+	ctx->cur_sess = 0;
+	INIT_LIST(ctx->sess);
+	ctx->sock = socket(sap->sa_family, SOCK_STREAM, PF_UNSPEC);
+	if (ctx->sock > evHighestFD(ctx->ev)) {
+		ctx->sock = -1;
+		errno = ENOTSOCK;
+	}
+	if (ctx->sock < 0) {
+		save_errno = errno;
+		(*ctx->logger)(ctl_error, "%s: socket: %s",
+			       me, strerror(errno));
+		memput(ctx, sizeof *ctx);
+		errno = save_errno;
+		return (NULL);
+	}
+	if (ctx->sock > evHighestFD(lev)) {
+		close(ctx->sock);
+		(*ctx->logger)(ctl_error, "%s: file descriptor > evHighestFD");
+		errno = ENFILE;
+		memput(ctx, sizeof *ctx);
+		return (NULL);
+	}
+#ifdef NO_UNIX_REUSEADDR
+	if (sap->sa_family != AF_UNIX)
+#endif
+		if (setsockopt(ctx->sock, SOL_SOCKET, SO_REUSEADDR,
+			       (const char *)&on, sizeof on) != 0) {
+			(*ctx->logger)(ctl_warning,
+				       "%s: setsockopt(REUSEADDR): %s",
+				       me, strerror(errno));
+		}
+	if (bind(ctx->sock, sap, sap_len) < 0) {
+		char tmp[MAX_NTOP];
+		save_errno = errno;
+		(*ctx->logger)(ctl_error, "%s: bind: %s: %s",
+			       me, ctl_sa_ntop((const struct sockaddr *)sap,
+			       tmp, sizeof tmp, ctx->logger),
+			       strerror(save_errno));
+		close(ctx->sock);
+		memput(ctx, sizeof *ctx);
+		errno = save_errno;
+		return (NULL);
+	}
+	if (fcntl(ctx->sock, F_SETFD, 1) < 0) {
+		(*ctx->logger)(ctl_warning, "%s: fcntl: %s", me,
+			       strerror(errno));
+	}
+	if (evListen(lev, ctx->sock, backlog, ctl_accept, ctx,
+		     &ctx->acID) < 0) {
+		save_errno = errno;
+		(*ctx->logger)(ctl_error, "%s: evListen(fd %d): %s",
+			       me, ctx->sock, strerror(errno));
+		close(ctx->sock);
+		memput(ctx, sizeof *ctx);
+		errno = save_errno;
+		return (NULL);
+	}
+	(*ctx->logger)(ctl_debug, "%s: new ctx %p, sock %d",
+		       me, ctx, ctx->sock);
+	return (ctx);
+}
+
+/*%
+ * void
+ * ctl_endserver(ctx)
+ *	if the control listener is open, close it.  clean out all eventlib
+ *	stuff.  close all active sessions.
+ */
+void
+ctl_endserver(struct ctl_sctx *ctx) {
+	static const char me[] = "ctl_endserver";
+	struct ctl_sess *this, *next;
+
+	(*ctx->logger)(ctl_debug, "%s: ctx %p, sock %d, acID %p, sess %p",
+		       me, ctx, ctx->sock, ctx->acID.opaque, ctx->sess);
+	if (ctx->acID.opaque != NULL) {
+		(void)evCancelConn(ctx->ev, ctx->acID);
+		ctx->acID.opaque = NULL;
+	}
+	if (ctx->sock != -1) {
+		(void) close(ctx->sock);
+		ctx->sock = -1;
+	}
+	for (this = HEAD(ctx->sess); this != NULL; this = next) {
+		next = NEXT(this, link);
+		ctl_close(this);
+	}
+	memput(ctx, sizeof *ctx);
+}
+
+/*%
+ * If body is non-NULL then it we add a "." line after it.
+ * Caller must have  escaped lines with leading ".".
+ */
+void
+ctl_response(struct ctl_sess *sess, u_int code, const char *text,
+	     u_int flags, const void *respctx, ctl_srvrdone donefunc,
+	     void *uap, const char *body, size_t bodylen)
+{
+	static const char me[] = "ctl_response";
+	struct iovec iov[3], *iovp = iov;
+	struct ctl_sctx *ctx = sess->ctx;
+	char tmp[MAX_NTOP], *pc;
+	int n;
+
+	REQUIRE(sess->state == initializing ||
+		sess->state == processing ||
+		sess->state == reading_data ||
+		sess->state == writing);
+	REQUIRE(sess->wrtiID.opaque == NULL);
+	REQUIRE(sess->wrID.opaque == NULL);
+	ctl_new_state(sess, writing, me);
+	sess->donefunc = donefunc;
+	sess->uap = uap;
+	if (!allocated_p(sess->outbuf) &&
+	    ctl_bufget(&sess->outbuf, ctx->logger) < 0) {
+		(*ctx->logger)(ctl_error, "%s: %s: cant get an output buffer",
+			       me, address_expr);
+		goto untimely;
+	}
+	if (sizeof "000-\r\n" + strlen(text) > (size_t)MAX_LINELEN) {
+		(*ctx->logger)(ctl_error, "%s: %s: output buffer ovf, closing",
+			       me, address_expr);
+		goto untimely;
+	}
+	sess->outbuf.used = SPRINTF((sess->outbuf.text, "%03d%c%s\r\n",
+				     code, (flags & CTL_MORE) != 0 ? '-' : ' ',
+				     text));
+	for (pc = sess->outbuf.text, n = 0;
+	     n < (int)sess->outbuf.used-2; pc++, n++)
+		if (!isascii((unsigned char)*pc) ||
+		    !isprint((unsigned char)*pc))
+			*pc = '\040';
+	*iovp++ = evConsIovec(sess->outbuf.text, sess->outbuf.used);
+	if (body != NULL) {
+		char *tmp;
+		DE_CONST(body, tmp);
+		*iovp++ = evConsIovec(tmp, bodylen);
+		DE_CONST(".\r\n", tmp);
+		*iovp++ = evConsIovec(tmp, 3);
+	}
+	(*ctx->logger)(ctl_debug, "%s: [%d] %s", me,
+		       sess->outbuf.used, sess->outbuf.text);
+	if (evWrite(ctx->ev, sess->sock, iov, iovp - iov,
+		    ctl_writedone, sess, &sess->wrID) < 0) {
+		(*ctx->logger)(ctl_error, "%s: %s: evWrite: %s", me,
+			       address_expr, strerror(errno));
+		goto untimely;
+	}
+	if (evSetIdleTimer(ctx->ev, ctl_wrtimeout, sess, ctx->timeout,
+			   &sess->wrtiID) < 0)
+	{
+		(*ctx->logger)(ctl_error, "%s: %s: evSetIdleTimer: %s", me,
+			       address_expr, strerror(errno));
+		goto untimely;
+	}
+	if (evTimeRW(ctx->ev, sess->wrID, sess->wrtiID) < 0) {
+		(*ctx->logger)(ctl_error, "%s: %s: evTimeRW: %s", me,
+			       address_expr, strerror(errno));
+ untimely:
+		ctl_signal_done(ctx, sess);
+		ctl_close(sess);
+		return;
+	}
+	sess->respctx = respctx;
+	sess->respflags = flags;
+}
+
+void
+ctl_sendhelp(struct ctl_sess *sess, u_int code) {
+	static const char me[] = "ctl_sendhelp";
+	struct ctl_sctx *ctx = sess->ctx;
+
+	sess->helpcode = code;
+	sess->verb = &fakehelpverb;
+	ctl_morehelp(ctx, sess, NULL, me, CTL_MORE,
+		     (const void *)ctx->verbs, NULL);
+}
+
+void *
+ctl_getcsctx(struct ctl_sess *sess) {
+	return (sess->csctx);
+}
+
+void *
+ctl_setcsctx(struct ctl_sess *sess, void *csctx) {
+	void *old = sess->csctx;
+
+	sess->csctx = csctx;
+	return (old);
+}
+
+/* Private functions. */
+
+static void
+ctl_accept(evContext lev, void *uap, int fd,
+	   const void *lav, int lalen,
+	   const void *rav, int ralen)
+{
+	static const char me[] = "ctl_accept";
+	struct ctl_sctx *ctx = uap;
+	struct ctl_sess *sess = NULL;
+	char tmp[MAX_NTOP];
+
+	UNUSED(lev);
+	UNUSED(lalen);
+	UNUSED(ralen);
+
+	if (fd < 0) {
+		(*ctx->logger)(ctl_error, "%s: accept: %s",
+			       me, strerror(errno));
+		return;
+	}
+	if (ctx->cur_sess == ctx->max_sess) {
+		(*ctx->logger)(ctl_error, "%s: %s: too many control sessions",
+			       me, ctl_sa_ntop((const struct sockaddr *)rav,
+					       tmp, sizeof tmp,
+					       ctx->logger));
+		(void) close(fd);
+		return;
+	}
+	sess = memget(sizeof *sess);
+	if (sess == NULL) {
+		(*ctx->logger)(ctl_error, "%s: memget: %s", me,
+			       strerror(errno));
+		(void) close(fd);
+		return;
+	}
+	if (fcntl(fd, F_SETFD, 1) < 0) {
+		(*ctx->logger)(ctl_warning, "%s: fcntl: %s", me,
+			       strerror(errno));
+	}
+	ctx->cur_sess++;
+	INIT_LINK(sess, link);
+	APPEND(ctx->sess, sess, link);
+	sess->ctx = ctx;
+	sess->sock = fd;
+	sess->wrID.opaque = NULL;
+	sess->rdID.opaque = NULL;
+	sess->wrtiID.opaque = NULL;
+	sess->rdtiID.opaque = NULL;
+	sess->respctx = NULL;
+	sess->csctx = NULL;
+	if (((const struct sockaddr *)rav)->sa_family == AF_UNIX)
+		ctl_sa_copy((const struct sockaddr *)lav,
+			    (struct sockaddr *)&sess->sa);
+	else
+		ctl_sa_copy((const struct sockaddr *)rav,
+			    (struct sockaddr *)&sess->sa);
+	sess->donefunc = NULL;
+	buffer_init(sess->inbuf);
+	buffer_init(sess->outbuf);
+	sess->state = available;
+	ctl_new_state(sess, initializing, me);
+	sess->verb = ctx->connverb;
+	(*ctx->logger)(ctl_debug, "%s: %s: accepting (fd %d)",
+		       me, address_expr, sess->sock);
+	(*ctx->connverb->func)(ctx, sess, ctx->connverb, "", 0,
+			       (const struct sockaddr *)rav, ctx->uctx);
+}
+
+static void
+ctl_new_state(struct ctl_sess *sess, enum state new_state, const char *reason)
+{
+	static const char me[] = "ctl_new_state";
+	struct ctl_sctx *ctx = sess->ctx;
+	char tmp[MAX_NTOP];
+
+	(*ctx->logger)(ctl_debug, "%s: %s: %s -> %s (%s)",
+		       me, address_expr,
+		       state_names[sess->state],
+		       state_names[new_state], reason);
+	sess->state = new_state;
+}
+
+static void
+ctl_close(struct ctl_sess *sess) {
+	static const char me[] = "ctl_close";
+	struct ctl_sctx *ctx = sess->ctx;
+	char tmp[MAX_NTOP];
+
+	REQUIRE(sess->state == initializing ||
+		sess->state == writing ||
+		sess->state == reading ||
+		sess->state == processing ||
+		sess->state == reading_data ||
+		sess->state == idling);
+	REQUIRE(sess->sock != -1);
+	if (sess->state == reading || sess->state == reading_data)
+		ctl_stop_read(sess);
+	else if (sess->state == writing) {
+		if (sess->wrID.opaque != NULL) {
+			(void) evCancelRW(ctx->ev, sess->wrID);
+			sess->wrID.opaque = NULL;
+		}
+		if (sess->wrtiID.opaque != NULL) {
+			(void) evClearIdleTimer(ctx->ev, sess->wrtiID);
+			sess->wrtiID.opaque = NULL;
+		}
+	}
+	ctl_new_state(sess, closing, me);
+	(void) close(sess->sock);
+	if (allocated_p(sess->inbuf))
+		ctl_bufput(&sess->inbuf);
+	if (allocated_p(sess->outbuf))
+		ctl_bufput(&sess->outbuf);
+	(*ctx->logger)(ctl_debug, "%s: %s: closed (fd %d)",
+		       me, address_expr, sess->sock);
+	UNLINK(ctx->sess, sess, link);
+	memput(sess, sizeof *sess);
+	ctx->cur_sess--;
+}
+
+static void
+ctl_start_read(struct ctl_sess *sess) {
+	static const char me[] = "ctl_start_read";
+	struct ctl_sctx *ctx = sess->ctx;
+	char tmp[MAX_NTOP];
+
+	REQUIRE(sess->state == initializing ||
+		sess->state == writing ||
+		sess->state == processing ||
+		sess->state == idling);
+	REQUIRE(sess->rdtiID.opaque == NULL);
+	REQUIRE(sess->rdID.opaque == NULL);
+	sess->inbuf.used = 0;
+	if (evSetIdleTimer(ctx->ev, ctl_rdtimeout, sess, ctx->timeout,
+			   &sess->rdtiID) < 0)
+	{
+		(*ctx->logger)(ctl_error, "%s: %s: evSetIdleTimer: %s", me,
+			       address_expr, strerror(errno));
+		ctl_close(sess);
+		return;
+	}
+	if (evSelectFD(ctx->ev, sess->sock, EV_READ,
+		       ctl_readable, sess, &sess->rdID) < 0) {
+		(*ctx->logger)(ctl_error, "%s: %s: evSelectFD: %s", me,
+			       address_expr, strerror(errno));
+		return;
+	}
+	ctl_new_state(sess, reading, me);
+}
+
+static void
+ctl_stop_read(struct ctl_sess *sess) {
+	static const char me[] = "ctl_stop_read";
+	struct ctl_sctx *ctx = sess->ctx;
+
+	REQUIRE(sess->state == reading || sess->state == reading_data);
+	REQUIRE(sess->rdID.opaque != NULL);
+	(void) evDeselectFD(ctx->ev, sess->rdID);
+	sess->rdID.opaque = NULL;
+	if (sess->rdtiID.opaque != NULL) {
+		(void) evClearIdleTimer(ctx->ev, sess->rdtiID);
+		sess->rdtiID.opaque = NULL;
+	}
+	ctl_new_state(sess, idling, me);
+}
+
+static void
+ctl_readable(evContext lev, void *uap, int fd, int evmask) {
+	static const char me[] = "ctl_readable";
+	struct ctl_sess *sess = uap;
+	struct ctl_sctx *ctx;
+	char *eos, tmp[MAX_NTOP];
+	ssize_t n;
+
+	REQUIRE(sess != NULL);
+	REQUIRE(fd >= 0);
+	REQUIRE(evmask == EV_READ);
+	REQUIRE(sess->state == reading || sess->state == reading_data);
+
+	ctx = sess->ctx;
+	evTouchIdleTimer(lev, sess->rdtiID);
+	if (!allocated_p(sess->inbuf) &&
+	    ctl_bufget(&sess->inbuf, ctx->logger) < 0) {
+		(*ctx->logger)(ctl_error, "%s: %s: cant get an input buffer",
+			       me, address_expr);
+		ctl_close(sess);
+		return;
+	}
+	n = read(sess->sock, sess->inbuf.text + sess->inbuf.used,
+		 MAX_LINELEN - sess->inbuf.used);
+	if (n <= 0) {
+		(*ctx->logger)(ctl_debug, "%s: %s: read: %s",
+			       me, address_expr,
+			       (n == 0) ? "Unexpected EOF" : strerror(errno));
+		ctl_close(sess);
+		return;
+	}
+	sess->inbuf.used += n;
+	eos = memchr(sess->inbuf.text, '\n', sess->inbuf.used);
+	if (eos != NULL && eos != sess->inbuf.text && eos[-1] == '\r') {
+		eos[-1] = '\0';
+		if ((sess->respflags & CTL_DATA) != 0) {
+			INSIST(sess->verb != NULL);
+			(*sess->verb->func)(sess->ctx, sess, sess->verb,
+					    sess->inbuf.text,
+					    CTL_DATA, sess->respctx,
+					    sess->ctx->uctx);
+		} else {
+			ctl_stop_read(sess);
+			ctl_docommand(sess);
+		}
+		sess->inbuf.used -= ((eos - sess->inbuf.text) + 1);
+		if (sess->inbuf.used == 0U)
+			ctl_bufput(&sess->inbuf);
+		else
+			memmove(sess->inbuf.text, eos + 1, sess->inbuf.used);
+		return;
+	}
+	if (sess->inbuf.used == (size_t)MAX_LINELEN) {
+		(*ctx->logger)(ctl_error, "%s: %s: line too long, closing",
+			       me, address_expr);
+		ctl_close(sess);
+	}
+}
+
+static void
+ctl_wrtimeout(evContext lev, void *uap,
+	      struct timespec due,
+	      struct timespec itv)
+{
+	static const char me[] = "ctl_wrtimeout";
+	struct ctl_sess *sess = uap;
+	struct ctl_sctx *ctx = sess->ctx;
+	char tmp[MAX_NTOP];
+
+	UNUSED(lev);
+	UNUSED(due);
+	UNUSED(itv);
+
+	REQUIRE(sess->state == writing);
+	sess->wrtiID.opaque = NULL;
+	(*ctx->logger)(ctl_warning, "%s: %s: write timeout, closing",
+		       me, address_expr);
+	if (sess->wrID.opaque != NULL) {
+		(void) evCancelRW(ctx->ev, sess->wrID);
+		sess->wrID.opaque = NULL;
+	}
+	ctl_signal_done(ctx, sess);
+	ctl_new_state(sess, processing, me);
+	ctl_close(sess);
+}
+
+static void
+ctl_rdtimeout(evContext lev, void *uap,
+	      struct timespec due,
+	      struct timespec itv)
+{
+	static const char me[] = "ctl_rdtimeout";
+	struct ctl_sess *sess = uap;
+	struct ctl_sctx *ctx = sess->ctx;
+	char tmp[MAX_NTOP];
+
+	UNUSED(lev);
+	UNUSED(due);
+	UNUSED(itv);
+
+	REQUIRE(sess->state == reading);
+	sess->rdtiID.opaque = NULL;
+	(*ctx->logger)(ctl_warning, "%s: %s: timeout, closing",
+		       me, address_expr);
+	if (sess->state == reading || sess->state == reading_data)
+		ctl_stop_read(sess);
+	ctl_signal_done(ctx, sess);
+	ctl_new_state(sess, processing, me);
+	ctl_response(sess, ctx->timeoutcode, "Timeout.", CTL_EXIT, NULL,
+		     NULL, NULL, NULL, 0);
+}
+
+static void
+ctl_docommand(struct ctl_sess *sess) {
+	static const char me[] = "ctl_docommand";
+	char *name, *rest, tmp[MAX_NTOP];
+	struct ctl_sctx *ctx = sess->ctx;
+	const struct ctl_verb *verb;
+
+	REQUIRE(allocated_p(sess->inbuf));
+	(*ctx->logger)(ctl_debug, "%s: %s: \"%s\" [%u]",
+		       me, address_expr,
+		       sess->inbuf.text, (u_int)sess->inbuf.used);
+	ctl_new_state(sess, processing, me);
+	name = sess->inbuf.text + strspn(sess->inbuf.text, space);
+	rest = name + strcspn(name, space);
+	if (*rest != '\0') {
+		*rest++ = '\0';
+		rest += strspn(rest, space);
+	}
+	for (verb = ctx->verbs;
+	     verb != NULL && verb->name != NULL && verb->func != NULL;
+	     verb++)
+		if (verb->name[0] != '\0' && strcasecmp(name, verb->name) == 0)
+			break;
+	if (verb != NULL && verb->name != NULL && verb->func != NULL) {
+		sess->verb = verb;
+		(*verb->func)(ctx, sess, verb, rest, 0, NULL, ctx->uctx);
+	} else {
+		char buf[1100];
+
+		if (sizeof "Unrecognized command \"\" (args \"\")" +
+		    strlen(name) + strlen(rest) > sizeof buf)
+			strcpy(buf, "Unrecognized command (buf ovf)");
+		else
+			sprintf(buf,
+				"Unrecognized command \"%s\" (args \"%s\")",
+				name, rest);
+		ctl_response(sess, ctx->unkncode, buf, 0, NULL, NULL, NULL,
+			     NULL, 0);
+	}
+}
+
+static void
+ctl_writedone(evContext lev, void *uap, int fd, int bytes) {
+	static const char me[] = "ctl_writedone";
+	struct ctl_sess *sess = uap;
+	struct ctl_sctx *ctx = sess->ctx;
+	char tmp[MAX_NTOP];
+	int save_errno = errno;
+
+	UNUSED(lev);
+	UNUSED(uap);
+
+	REQUIRE(sess->state == writing);
+	REQUIRE(fd == sess->sock);
+	REQUIRE(sess->wrtiID.opaque != NULL);
+	sess->wrID.opaque = NULL;
+	(void) evClearIdleTimer(ctx->ev, sess->wrtiID);
+	sess->wrtiID.opaque = NULL;
+	if (bytes < 0) {
+		(*ctx->logger)(ctl_error, "%s: %s: %s",
+			       me, address_expr, strerror(save_errno));
+		ctl_close(sess);
+		return;
+	}
+
+	INSIST(allocated_p(sess->outbuf));
+	ctl_bufput(&sess->outbuf);
+	if ((sess->respflags & CTL_EXIT) != 0) {
+		ctl_signal_done(ctx, sess);
+		ctl_close(sess);
+		return;
+	} else if ((sess->respflags & CTL_MORE) != 0) {
+		INSIST(sess->verb != NULL);
+		(*sess->verb->func)(sess->ctx, sess, sess->verb, "",
+				    CTL_MORE, sess->respctx, sess->ctx->uctx);
+	} else {
+		ctl_signal_done(ctx, sess);
+		ctl_start_read(sess);
+	}
+}
+
+static void
+ctl_morehelp(struct ctl_sctx *ctx, struct ctl_sess *sess,
+	     const struct ctl_verb *verb, const char *text,
+	     u_int respflags, const void *respctx, void *uctx)
+{
+	const struct ctl_verb *this = respctx, *next = this + 1;
+
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(text);
+	UNUSED(uctx);
+
+	REQUIRE(!lastverb_p(this));
+	REQUIRE((respflags & CTL_MORE) != 0);
+	if (lastverb_p(next))
+		respflags &= ~CTL_MORE;
+	ctl_response(sess, sess->helpcode, this->help, respflags, next,
+		     NULL, NULL, NULL, 0);
+}
+
+static void
+ctl_signal_done(struct ctl_sctx *ctx, struct ctl_sess *sess) {
+	if (sess->donefunc != NULL) {
+		(*sess->donefunc)(ctx, sess, sess->uap);
+		sess->donefunc = NULL;
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ev_connects.c b/usr/src/lib/libresolv2_joy/common/isc/ev_connects.c
new file mode 100644
index 0000000000..38dfdbe512
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ev_connects.c
@@ -0,0 +1,369 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995-1999 by Internet Software Consortium
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* ev_connects.c - implement asynch connect/accept for the eventlib
+ * vix 16sep96 [initial]
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: ev_connects.c,v 1.8 2006/03/09 23:57:56 marka Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+
+#include <unistd.h>
+
+#include <isc/eventlib.h>
+#include <isc/assertions.h>
+#include "eventlib_p.h"
+
+#include "port_after.h"
+
+/* Macros. */
+
+#define GETXXXNAME(f, s, sa, len) ( \
+	(f((s), (&sa), (&len)) >= 0) ? 0 : \
+		(errno != EAFNOSUPPORT && errno != EOPNOTSUPP) ? -1 : ( \
+			memset(&(sa), 0, sizeof (sa)), \
+			(len) = sizeof (sa), \
+			(sa).sa_family = AF_UNIX, \
+			0 \
+		) \
+	)
+
+/* Forward. */
+
+static void	listener(evContext ctx, void *uap, int fd, int evmask);
+static void	connector(evContext ctx, void *uap, int fd, int evmask);
+
+/* Public. */
+
+int
+evListen(evContext opaqueCtx, int fd, int maxconn,
+	 evConnFunc func, void *uap, evConnID *id)
+{
+	evContext_p *ctx = opaqueCtx.opaque;
+	evConn *new;
+	int mode;
+
+	OKNEW(new);
+	new->flags = EV_CONN_LISTEN;
+	OKFREE(mode = fcntl(fd, F_GETFL, NULL), new);	/*%< side effect: validate fd. */
+	/*
+	 * Remember the nonblocking status.  We assume that either evSelectFD
+	 * has not been done to this fd, or that if it has then the caller
+	 * will evCancelConn before they evDeselectFD.  If our assumptions
+	 * are not met, then we might restore the old nonblocking status
+	 * incorrectly.
+	 */
+	if ((mode & PORT_NONBLOCK) == 0) {
+#ifdef USE_FIONBIO_IOCTL
+		int on = 1;
+		OKFREE(ioctl(fd, FIONBIO, (char *)&on), new);
+#else
+		OKFREE(fcntl(fd, F_SETFL, mode | PORT_NONBLOCK), new);
+#endif
+		new->flags |= EV_CONN_BLOCK;
+	}
+	OKFREE(listen(fd, maxconn), new);
+	if (evSelectFD(opaqueCtx, fd, EV_READ, listener, new, &new->file) < 0){
+		int save = errno;
+
+		FREE(new);
+		errno = save;
+		return (-1);
+	}
+	new->flags |= EV_CONN_SELECTED;
+	new->func = func;
+	new->uap = uap;
+	new->fd = fd;
+	if (ctx->conns != NULL)
+		ctx->conns->prev = new;
+	new->prev = NULL;
+	new->next = ctx->conns;
+	ctx->conns = new;
+	if (id)
+		id->opaque = new;
+	return (0);
+}
+
+int
+evConnect(evContext opaqueCtx, int fd, const void *ra, int ralen,
+	  evConnFunc func, void *uap, evConnID *id)
+{
+	evContext_p *ctx = opaqueCtx.opaque;
+	evConn *new;
+
+	OKNEW(new);
+	new->flags = 0;
+	/* Do the select() first to get the socket into nonblocking mode. */
+	if (evSelectFD(opaqueCtx, fd, EV_MASK_ALL,
+		       connector, new, &new->file) < 0) {
+		int save = errno;
+
+		FREE(new);
+		errno = save;
+		return (-1);
+	}
+	new->flags |= EV_CONN_SELECTED;
+	if (connect(fd, ra, ralen) < 0 &&
+	    errno != EWOULDBLOCK &&
+	    errno != EAGAIN &&
+	    errno != EINPROGRESS) {
+		int save = errno;
+
+		(void) evDeselectFD(opaqueCtx, new->file);
+		FREE(new);
+		errno = save;
+		return (-1);
+	}
+	/* No error, or EWOULDBLOCK.  select() tells when it's ready. */
+	new->func = func;
+	new->uap = uap;
+	new->fd = fd;
+	if (ctx->conns != NULL)
+		ctx->conns->prev = new;
+	new->prev = NULL;
+	new->next = ctx->conns;
+	ctx->conns = new;
+	if (id)
+		id->opaque = new;
+	return (0);
+}
+
+int
+evCancelConn(evContext opaqueCtx, evConnID id) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evConn *this = id.opaque;
+	evAccept *acc, *nxtacc;
+	int mode;
+
+	if ((this->flags & EV_CONN_SELECTED) != 0)
+		(void) evDeselectFD(opaqueCtx, this->file);
+	if ((this->flags & EV_CONN_BLOCK) != 0) {
+		mode = fcntl(this->fd, F_GETFL, NULL);
+		if (mode == -1) {
+			if (errno != EBADF)
+				return (-1);
+		} else {
+#ifdef USE_FIONBIO_IOCTL
+			int off = 0;
+			OK(ioctl(this->fd, FIONBIO, (char *)&off));
+#else
+			OK(fcntl(this->fd, F_SETFL, mode & ~PORT_NONBLOCK));
+#endif
+		}
+	}
+	
+	/* Unlink from ctx->conns. */
+	if (this->prev != NULL)
+		this->prev->next = this->next;
+	else
+		ctx->conns = this->next;
+	if (this->next != NULL)
+		this->next->prev = this->prev;
+
+	/*
+	 * Remove `this' from the ctx->accepts list (zero or more times).
+	 */
+	for (acc = HEAD(ctx->accepts), nxtacc = NULL;
+	     acc != NULL;
+	     acc = nxtacc)
+	{
+		nxtacc = NEXT(acc, link);
+		if (acc->conn == this) {
+			UNLINK(ctx->accepts, acc, link);
+			close(acc->fd);
+			FREE(acc);
+		}
+	}
+
+	/* Wrap up and get out. */
+	FREE(this);
+	return (0);
+}
+
+int evHold(evContext opaqueCtx, evConnID id) {
+	evConn *this = id.opaque;
+
+	if ((this->flags & EV_CONN_LISTEN) == 0) {
+		errno = EINVAL;
+		return (-1);
+	}
+	if ((this->flags & EV_CONN_SELECTED) == 0)
+		return (0);
+	this->flags &= ~EV_CONN_SELECTED;
+	return (evDeselectFD(opaqueCtx, this->file));
+}
+
+int evUnhold(evContext opaqueCtx, evConnID id) {
+	evConn *this = id.opaque;
+	int ret;
+
+	if ((this->flags & EV_CONN_LISTEN) == 0) {
+		errno = EINVAL;
+		return (-1);
+	}
+	if ((this->flags & EV_CONN_SELECTED) != 0)
+		return (0);
+	ret = evSelectFD(opaqueCtx, this->fd, EV_READ, listener, this,
+			 &this->file);
+	if (ret == 0)
+		this->flags |= EV_CONN_SELECTED;
+	return (ret);
+}
+
+int
+evTryAccept(evContext opaqueCtx, evConnID id, int *sys_errno) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evConn *conn = id.opaque;
+	evAccept *new;
+
+	if ((conn->flags & EV_CONN_LISTEN) == 0) {
+		errno = EINVAL;
+		return (-1);
+	}
+	OKNEW(new);
+	new->conn = conn;
+	new->ralen = sizeof new->ra;
+	new->fd = accept(conn->fd, &new->ra.sa, &new->ralen);
+	if (new->fd > ctx->highestFD) {
+		close(new->fd);
+		new->fd = -1;
+		new->ioErrno = ENOTSOCK;
+	}
+	if (new->fd >= 0) {
+		new->lalen = sizeof new->la;
+		if (GETXXXNAME(getsockname, new->fd, new->la.sa, new->lalen) < 0) {
+			new->ioErrno = errno;
+			(void) close(new->fd);
+			new->fd = -1;
+		} else
+			new->ioErrno = 0;
+	} else {
+		new->ioErrno = errno;
+		if (errno == EAGAIN || errno == EWOULDBLOCK) {
+			FREE(new);
+			return (-1);
+		}
+	}
+	INIT_LINK(new, link);
+	APPEND(ctx->accepts, new, link);
+	*sys_errno = new->ioErrno;
+	return (0);
+}
+
+/* Private. */
+
+static void
+listener(evContext opaqueCtx, void *uap, int fd, int evmask) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evConn *conn = uap;
+	union {
+		struct sockaddr    sa;
+		struct sockaddr_in in;
+#ifndef NO_SOCKADDR_UN
+		struct sockaddr_un un;
+#endif
+	} la, ra;
+	int new; 
+	ISC_SOCKLEN_T lalen = 0, ralen;
+
+	REQUIRE((evmask & EV_READ) != 0);
+	ralen = sizeof ra;
+	new = accept(fd, &ra.sa, &ralen);
+	if (new > ctx->highestFD) {
+		close(new);
+		new = -1;
+		errno = ENOTSOCK;
+	}
+	if (new >= 0) {
+		lalen = sizeof la;
+		if (GETXXXNAME(getsockname, new, la.sa, lalen) < 0) {
+			int save = errno;
+
+			(void) close(new);
+			errno = save;
+			new = -1;
+		}
+	} else if (errno == EAGAIN || errno == EWOULDBLOCK)
+		return;
+	(*conn->func)(opaqueCtx, conn->uap, new, &la.sa, lalen, &ra.sa, ralen);
+}
+
+static void
+connector(evContext opaqueCtx, void *uap, int fd, int evmask) {
+	evConn *conn = uap;
+	union {
+		struct sockaddr    sa;
+		struct sockaddr_in in;
+#ifndef NO_SOCKADDR_UN
+		struct sockaddr_un un;
+#endif
+	} la, ra;
+	ISC_SOCKLEN_T lalen, ralen;
+#ifndef NETREAD_BROKEN
+	char buf[1];
+#endif
+	void *conn_uap;
+	evConnFunc conn_func;
+	evConnID id;
+	int socket_errno = 0;
+	ISC_SOCKLEN_T optlen;
+
+	UNUSED(evmask);
+
+	lalen = sizeof la;
+	ralen = sizeof ra;
+	conn_uap = conn->uap;
+	conn_func = conn->func;
+	id.opaque = conn;
+#ifdef SO_ERROR
+	optlen = sizeof socket_errno;
+	if (fd < 0 &&
+	    getsockopt(conn->fd, SOL_SOCKET, SO_ERROR, (char *)&socket_errno,
+		       &optlen) < 0)
+		socket_errno = errno;
+	else
+		errno = socket_errno;
+#endif
+	if (evCancelConn(opaqueCtx, id) < 0 ||
+	    socket_errno ||
+#ifdef NETREAD_BROKEN
+	    0 ||
+#else
+	    read(fd, buf, 0) < 0 ||
+#endif
+	    GETXXXNAME(getsockname, fd, la.sa, lalen) < 0 ||
+	    GETXXXNAME(getpeername, fd, ra.sa, ralen) < 0) {
+		int save = errno;
+
+		(void) close(fd);	/*%< XXX closing caller's fd */
+		errno = save;
+		fd = -1;
+	}
+	(*conn_func)(opaqueCtx, conn_uap, fd, &la.sa, lalen, &ra.sa, ralen);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ev_files.c b/usr/src/lib/libresolv2_joy/common/isc/ev_files.c
new file mode 100644
index 0000000000..b12baf1aaa
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ev_files.c
@@ -0,0 +1,277 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995-1999 by Internet Software Consortium
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* ev_files.c - implement asynch file IO for the eventlib
+ * vix 11sep95 [initial]
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: ev_files.c,v 1.8 2005/07/28 06:51:48 marka Exp $";
+#endif
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <isc/eventlib.h>
+#include "eventlib_p.h"
+
+#include "port_after.h"
+
+static evFile *FindFD(const evContext_p *ctx, int fd, int eventmask);
+
+int
+evSelectFD(evContext opaqueCtx,
+	   int fd,
+	   int eventmask,
+	   evFileFunc func,
+	   void *uap,
+	   evFileID *opaqueID
+) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evFile *id;
+	int mode;
+
+	evPrintf(ctx, 1,
+		 "evSelectFD(ctx %p, fd %d, mask 0x%x, func %p, uap %p)\n",
+		 ctx, fd, eventmask, func, uap);
+	if (eventmask == 0 || (eventmask & ~EV_MASK_ALL) != 0)
+		EV_ERR(EINVAL);
+#ifndef USE_POLL
+	if (fd > ctx->highestFD)
+		EV_ERR(EINVAL);
+#endif
+	OK(mode = fcntl(fd, F_GETFL, NULL));	/*%< side effect: validate fd. */
+	/*
+	 * The first time we touch a file descriptor, we need to check to see
+	 * if the application already had it in O_NONBLOCK mode and if so, all
+	 * of our deselect()'s have to leave it in O_NONBLOCK.  If not, then
+	 * all but our last deselect() has to leave it in O_NONBLOCK.
+	 */
+#ifdef USE_POLL
+	/* Make sure both ctx->pollfds[] and ctx->fdTable[] are large enough */
+	if (fd >= ctx->maxnfds && evPollfdRealloc(ctx, 1, fd) != 0)
+		EV_ERR(ENOMEM);
+#endif /* USE_POLL */
+	id = FindFD(ctx, fd, EV_MASK_ALL);
+	if (id == NULL) {
+		if (mode & PORT_NONBLOCK)
+			FD_SET(fd, &ctx->nonblockBefore);
+		else {
+#ifdef USE_FIONBIO_IOCTL
+			int on = 1;
+			OK(ioctl(fd, FIONBIO, (char *)&on));
+#else
+			OK(fcntl(fd, F_SETFL, mode | PORT_NONBLOCK));
+#endif
+			FD_CLR(fd, &ctx->nonblockBefore);
+		}
+	}
+
+	/*
+	 * If this descriptor is already in use, search for it again to see
+	 * if any of the eventmask bits we want to set are already captured.
+	 * We cannot usefully capture the same fd event more than once in the
+	 * same context.
+	 */
+	if (id != NULL && FindFD(ctx, fd, eventmask) != NULL)
+		EV_ERR(ETOOMANYREFS);
+
+	/* Allocate and fill. */
+	OKNEW(id);
+	id->func = func;
+	id->uap = uap;
+	id->fd = fd;
+	id->eventmask = eventmask;
+
+	/*
+	 * Insert at head.  Order could be important for performance if we
+	 * believe that evGetNext()'s accesses to the fd_sets will be more
+	 * serial and therefore more cache-lucky if the list is ordered by
+	 * ``fd.''  We do not believe these things, so we don't do it.
+	 *
+	 * The interesting sequence is where GetNext() has cached a select()
+	 * result and the caller decides to evSelectFD() on some descriptor.
+	 * Since GetNext() starts at the head, it can miss new entries we add
+	 * at the head.  This is not a serious problem since the event being
+	 * evSelectFD()'d for has to occur before evSelectFD() is called for
+	 * the file event to be considered "missed" -- a real corner case.
+	 * Maintaining a "tail" pointer for ctx->files would fix this, but I'm
+	 * not sure it would be ``more correct.''
+	 */
+	if (ctx->files != NULL)
+		ctx->files->prev = id;
+	id->prev = NULL;
+	id->next = ctx->files;
+	ctx->files = id;
+
+	/* Insert into fd table. */
+	if (ctx->fdTable[fd] != NULL)
+		ctx->fdTable[fd]->fdprev = id;
+	id->fdprev = NULL;
+	id->fdnext = ctx->fdTable[fd];
+	ctx->fdTable[fd] = id;
+
+	/* Turn on the appropriate bits in the {rd,wr,ex}Next fd_set's. */
+	if (eventmask & EV_READ)
+		FD_SET(fd, &ctx->rdNext);
+	if (eventmask & EV_WRITE)
+		FD_SET(fd, &ctx->wrNext);
+	if (eventmask & EV_EXCEPT)
+		FD_SET(fd, &ctx->exNext);
+
+	/* Update fdMax. */
+	if (fd > ctx->fdMax)
+		ctx->fdMax = fd;
+
+	/* Remember the ID if the caller provided us a place for it. */
+	if (opaqueID)
+		opaqueID->opaque = id;
+
+	return (0);
+}
+
+int
+evDeselectFD(evContext opaqueCtx, evFileID opaqueID) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evFile *del = opaqueID.opaque;
+	evFile *cur;
+	int mode, eventmask;
+
+	if (!del) {
+		evPrintf(ctx, 11, "evDeselectFD(NULL) ignored\n");
+		errno = EINVAL;
+		return (-1);
+	}
+
+	evPrintf(ctx, 1, "evDeselectFD(fd %d, mask 0x%x)\n",
+		 del->fd, del->eventmask);
+
+	/* Get the mode.  Unless the file has been closed, errors are bad. */
+	mode = fcntl(del->fd, F_GETFL, NULL);
+	if (mode == -1 && errno != EBADF)
+		EV_ERR(errno);
+
+	/* Remove from the list of files. */
+	if (del->prev != NULL)
+		del->prev->next = del->next;
+	else
+		ctx->files = del->next;
+	if (del->next != NULL)
+		del->next->prev = del->prev;
+
+	/* Remove from the fd table. */
+	if (del->fdprev != NULL)
+		del->fdprev->fdnext = del->fdnext;
+	else
+		ctx->fdTable[del->fd] = del->fdnext;
+	if (del->fdnext != NULL)
+		del->fdnext->fdprev = del->fdprev;
+
+	/*
+	 * If the file descriptor does not appear in any other select() entry,
+	 * and if !EV_WASNONBLOCK, and if we got no EBADF when we got the mode
+	 * earlier, then: restore the fd to blocking status.
+	 */
+	if (!(cur = FindFD(ctx, del->fd, EV_MASK_ALL)) &&
+	    !FD_ISSET(del->fd, &ctx->nonblockBefore) &&
+	    mode != -1) {
+		/*
+		 * Note that we won't return an error status to the caller if
+		 * this fcntl() fails since (a) we've already done the work
+		 * and (b) the caller didn't ask us anything about O_NONBLOCK.
+		 */
+#ifdef USE_FIONBIO_IOCTL
+		int off = 0;
+		(void) ioctl(del->fd, FIONBIO, (char *)&off);
+#else
+		(void) fcntl(del->fd, F_SETFL, mode & ~PORT_NONBLOCK);
+#endif
+	}
+
+	/*
+	 * Now find all other uses of this descriptor and OR together an event
+	 * mask so that we don't turn off {rd,wr,ex}Next bits that some other
+	 * file event is using.  As an optimization, stop if the event mask
+	 * fills.
+	 */
+	eventmask = 0;
+	for ((void)NULL;
+	     cur != NULL && eventmask != EV_MASK_ALL;
+	     cur = cur->next)
+		if (cur->fd == del->fd)
+			eventmask |= cur->eventmask;
+
+	/* OK, now we know which bits we can clear out. */
+	if (!(eventmask & EV_READ)) {
+		FD_CLR(del->fd, &ctx->rdNext);
+		if (FD_ISSET(del->fd, &ctx->rdLast)) {
+			FD_CLR(del->fd, &ctx->rdLast);
+			ctx->fdCount--;
+		}
+	}
+	if (!(eventmask & EV_WRITE)) {
+		FD_CLR(del->fd, &ctx->wrNext);
+		if (FD_ISSET(del->fd, &ctx->wrLast)) {
+			FD_CLR(del->fd, &ctx->wrLast);
+			ctx->fdCount--;
+		}
+	}
+	if (!(eventmask & EV_EXCEPT)) {
+		FD_CLR(del->fd, &ctx->exNext);
+		if (FD_ISSET(del->fd, &ctx->exLast)) {
+			FD_CLR(del->fd, &ctx->exLast);
+			ctx->fdCount--;
+		}
+	}
+
+	/* If this was the maxFD, find the new one. */
+	if (del->fd == ctx->fdMax) {
+		ctx->fdMax = -1;
+		for (cur = ctx->files; cur; cur = cur->next)
+			if (cur->fd > ctx->fdMax)
+				ctx->fdMax = cur->fd;
+	}
+
+	/* If this was the fdNext, cycle that to the next entry. */
+	if (del == ctx->fdNext)
+		ctx->fdNext = del->next;
+
+	/* Couldn't free it before now since we were using fields out of it. */
+	FREE(del);
+
+	return (0);
+}
+
+static evFile *
+FindFD(const evContext_p *ctx, int fd, int eventmask) {
+	evFile *id;
+
+	for (id = ctx->fdTable[fd]; id != NULL; id = id->fdnext)
+		if (id->fd == fd && (id->eventmask & eventmask) != 0)
+			break;
+	return (id);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ev_streams.c b/usr/src/lib/libresolv2_joy/common/isc/ev_streams.c
new file mode 100644
index 0000000000..5dad36d04a
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ev_streams.c
@@ -0,0 +1,308 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* ev_streams.c - implement asynch stream file IO for the eventlib
+ * vix 04mar96 [initial]
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: ev_streams.c,v 1.5 2005/04/27 04:56:36 sra Exp $";
+#endif
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/uio.h>
+
+#include <errno.h>
+
+#include <isc/eventlib.h>
+#include <isc/assertions.h>
+#include "eventlib_p.h"
+
+#include "port_after.h"
+
+static int	copyvec(evStream *str, const struct iovec *iov, int iocnt);
+static void	consume(evStream *str, size_t bytes);
+static void	done(evContext opaqueCtx, evStream *str);
+static void	writable(evContext opaqueCtx, void *uap, int fd, int evmask);
+static void	readable(evContext opaqueCtx, void *uap, int fd, int evmask);
+
+struct iovec
+evConsIovec(void *buf, size_t cnt) {
+	struct iovec ret;
+
+	memset(&ret, 0xf5, sizeof ret);
+	ret.iov_base = buf;
+	ret.iov_len = cnt;
+	return (ret);
+}
+
+int
+evWrite(evContext opaqueCtx, int fd, const struct iovec *iov, int iocnt,
+	evStreamFunc func, void *uap, evStreamID *id)
+{
+	evContext_p *ctx = opaqueCtx.opaque;
+	evStream *new;
+	int save;
+
+	OKNEW(new);
+	new->func = func;
+	new->uap = uap;
+	new->fd = fd;
+	new->flags = 0;
+	if (evSelectFD(opaqueCtx, fd, EV_WRITE, writable, new, &new->file) < 0)
+		goto free;
+	if (copyvec(new, iov, iocnt) < 0)
+		goto free;
+	new->prevDone = NULL;
+	new->nextDone = NULL;
+	if (ctx->streams != NULL)
+		ctx->streams->prev = new;
+	new->prev = NULL;
+	new->next = ctx->streams;
+	ctx->streams = new;
+	if (id != NULL)
+		id->opaque = new;
+	return (0);
+ free:
+	save = errno;
+	FREE(new);
+	errno = save;
+	return (-1);
+}
+
+int
+evRead(evContext opaqueCtx, int fd, const struct iovec *iov, int iocnt,
+       evStreamFunc func, void *uap, evStreamID *id)
+{
+	evContext_p *ctx = opaqueCtx.opaque;
+	evStream *new;
+	int save;
+
+	OKNEW(new);
+	new->func = func;
+	new->uap = uap;
+	new->fd = fd;
+	new->flags = 0;
+	if (evSelectFD(opaqueCtx, fd, EV_READ, readable, new, &new->file) < 0)
+		goto free;
+	if (copyvec(new, iov, iocnt) < 0)
+		goto free;
+	new->prevDone = NULL;
+	new->nextDone = NULL;
+	if (ctx->streams != NULL)
+		ctx->streams->prev = new;
+	new->prev = NULL;
+	new->next = ctx->streams;
+	ctx->streams = new;
+	if (id)
+		id->opaque = new;
+	return (0);
+ free:
+	save = errno;
+	FREE(new);
+	errno = save;
+	return (-1);
+}
+
+int
+evTimeRW(evContext opaqueCtx, evStreamID id, evTimerID timer) /*ARGSUSED*/ {
+	evStream *str = id.opaque;
+
+	UNUSED(opaqueCtx);
+
+	str->timer = timer;
+	str->flags |= EV_STR_TIMEROK;
+	return (0);
+}
+
+int
+evUntimeRW(evContext opaqueCtx, evStreamID id) /*ARGSUSED*/ {
+	evStream *str = id.opaque;
+
+	UNUSED(opaqueCtx);
+
+	str->flags &= ~EV_STR_TIMEROK;
+	return (0);
+}
+
+int
+evCancelRW(evContext opaqueCtx, evStreamID id) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evStream *old = id.opaque;
+
+	/*
+	 * The streams list is doubly threaded.  First, there's ctx->streams
+	 * that's used by evDestroy() to find and cancel all streams.  Second,
+	 * there's ctx->strDone (head) and ctx->strLast (tail) which thread
+	 * through the potentially smaller number of "IO completed" streams,
+	 * used in evGetNext() to avoid scanning the entire list.
+	 */
+
+	/* Unlink from ctx->streams. */
+	if (old->prev != NULL)
+		old->prev->next = old->next;
+	else
+		ctx->streams = old->next;
+	if (old->next != NULL)
+		old->next->prev = old->prev;
+
+	/*
+	 * If 'old' is on the ctx->strDone list, remove it.  Update
+	 * ctx->strLast if necessary.
+	 */
+	if (old->prevDone == NULL && old->nextDone == NULL) {
+		/*
+		 * Either 'old' is the only item on the done list, or it's
+		 * not on the done list.  If the former, then we unlink it
+		 * from the list.  If the latter, we leave the list alone.
+		 */
+		if (ctx->strDone == old) {
+			ctx->strDone = NULL;
+			ctx->strLast = NULL;
+		}
+	} else {
+		if (old->prevDone != NULL)
+			old->prevDone->nextDone = old->nextDone;
+		else
+			ctx->strDone = old->nextDone;
+		if (old->nextDone != NULL)
+			old->nextDone->prevDone = old->prevDone;
+		else
+			ctx->strLast = old->prevDone;
+	}
+
+	/* Deallocate the stream. */
+	if (old->file.opaque)
+		evDeselectFD(opaqueCtx, old->file);
+	memput(old->iovOrig, sizeof (struct iovec) * old->iovOrigCount);
+	FREE(old);
+	return (0);
+}
+
+/* Copy a scatter/gather vector and initialize a stream handler's IO. */
+static int
+copyvec(evStream *str, const struct iovec *iov, int iocnt) {
+	int i;
+
+	str->iovOrig = (struct iovec *)memget(sizeof(struct iovec) * iocnt);
+	if (str->iovOrig == NULL) {
+		errno = ENOMEM;
+		return (-1);
+	}
+	str->ioTotal = 0;
+	for (i = 0; i < iocnt; i++) {
+		str->iovOrig[i] = iov[i];
+		str->ioTotal += iov[i].iov_len;
+	}
+	str->iovOrigCount = iocnt;
+	str->iovCur = str->iovOrig;
+	str->iovCurCount = str->iovOrigCount;
+	str->ioDone = 0;
+	return (0);
+}
+
+/* Pull off or truncate lead iovec(s). */
+static void
+consume(evStream *str, size_t bytes) {
+	while (bytes > 0U) {
+		if (bytes < (size_t)str->iovCur->iov_len) {
+			str->iovCur->iov_len -= bytes;
+			str->iovCur->iov_base = (void *)
+				((u_char *)str->iovCur->iov_base + bytes);
+			str->ioDone += bytes;
+			bytes = 0;
+		} else {
+			bytes -= str->iovCur->iov_len;
+			str->ioDone += str->iovCur->iov_len;
+			str->iovCur++;
+			str->iovCurCount--;
+		}
+	}
+}
+
+/* Add a stream to Done list and deselect the FD. */
+static void
+done(evContext opaqueCtx, evStream *str) {
+	evContext_p *ctx = opaqueCtx.opaque;
+
+	if (ctx->strLast != NULL) {
+		str->prevDone = ctx->strLast;
+		ctx->strLast->nextDone = str;
+		ctx->strLast = str;
+	} else {
+		INSIST(ctx->strDone == NULL);
+		ctx->strDone = ctx->strLast = str;
+	}
+	evDeselectFD(opaqueCtx, str->file);
+	str->file.opaque = NULL;
+	/* evDrop() will call evCancelRW() on us. */
+}
+
+/* Dribble out some bytes on the stream.  (Called by evDispatch().) */
+static void
+writable(evContext opaqueCtx, void *uap, int fd, int evmask) {
+	evStream *str = uap;
+	int bytes;
+
+	UNUSED(evmask);
+
+	bytes = writev(fd, str->iovCur, str->iovCurCount);
+	if (bytes > 0) {
+		if ((str->flags & EV_STR_TIMEROK) != 0)
+			evTouchIdleTimer(opaqueCtx, str->timer);
+		consume(str, bytes);
+	} else {
+		if (bytes < 0 && errno != EINTR) {
+			str->ioDone = -1;
+			str->ioErrno = errno;
+		}
+	}
+	if (str->ioDone == -1 || str->ioDone == str->ioTotal)
+		done(opaqueCtx, str);
+}
+
+/* Scoop up some bytes from the stream.  (Called by evDispatch().) */
+static void
+readable(evContext opaqueCtx, void *uap, int fd, int evmask) {
+	evStream *str = uap;
+	int bytes;
+
+	UNUSED(evmask);
+
+	bytes = readv(fd, str->iovCur, str->iovCurCount);
+	if (bytes > 0) {
+		if ((str->flags & EV_STR_TIMEROK) != 0)
+			evTouchIdleTimer(opaqueCtx, str->timer);
+		consume(str, bytes);
+	} else {
+		if (bytes == 0)
+			str->ioDone = 0;
+		else {
+			if (errno != EINTR) {
+				str->ioDone = -1;
+				str->ioErrno = errno;
+			}
+		}
+	}
+	if (str->ioDone <= 0 || str->ioDone == str->ioTotal)
+		done(opaqueCtx, str);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ev_timers.c b/usr/src/lib/libresolv2_joy/common/isc/ev_timers.c
new file mode 100644
index 0000000000..12ac2cebca
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ev_timers.c
@@ -0,0 +1,499 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995-1999 by Internet Software Consortium
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* ev_timers.c - implement timers for the eventlib
+ * vix 09sep95 [initial]
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: ev_timers.c,v 1.6 2005/04/27 04:56:36 sra Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <errno.h>
+
+#include <isc/assertions.h>
+#include <isc/eventlib.h>
+#include "eventlib_p.h"
+
+#include "port_after.h"
+
+/* Constants. */
+
+#define	MILLION 1000000
+#define BILLION 1000000000
+
+/* Forward. */
+
+static int due_sooner(void *, void *);
+static void set_index(void *, int);
+static void free_timer(void *, void *);
+static void print_timer(void *, void *);
+static void idle_timeout(evContext, void *, struct timespec, struct timespec);
+
+/* Private type. */
+
+typedef struct {
+	evTimerFunc	func;
+	void *		uap;
+	struct timespec	lastTouched;
+	struct timespec	max_idle;
+	evTimer *	timer;
+} idle_timer;
+
+/* Public. */
+
+struct timespec
+evConsTime(time_t sec, long nsec) {
+	struct timespec x;
+
+	x.tv_sec = sec;
+	x.tv_nsec = nsec;
+	return (x);
+}
+
+struct timespec
+evAddTime(struct timespec addend1, struct timespec addend2) {
+	struct timespec x;
+
+	x.tv_sec = addend1.tv_sec + addend2.tv_sec;
+	x.tv_nsec = addend1.tv_nsec + addend2.tv_nsec;
+	if (x.tv_nsec >= BILLION) {
+		x.tv_sec++;
+		x.tv_nsec -= BILLION;
+	}
+	return (x);
+}
+
+struct timespec
+evSubTime(struct timespec minuend, struct timespec subtrahend) {
+	struct timespec x;
+
+	x.tv_sec = minuend.tv_sec - subtrahend.tv_sec;
+	if (minuend.tv_nsec >= subtrahend.tv_nsec)
+		x.tv_nsec = minuend.tv_nsec - subtrahend.tv_nsec;
+	else {
+		x.tv_nsec = BILLION - subtrahend.tv_nsec + minuend.tv_nsec;
+		x.tv_sec--;
+	}
+	return (x);
+}
+
+int
+evCmpTime(struct timespec a, struct timespec b) {
+	long x = a.tv_sec - b.tv_sec;
+
+	if (x == 0L)
+		x = a.tv_nsec - b.tv_nsec;
+	return (x < 0L ? (-1) : x > 0L ? (1) : (0));
+}
+
+struct timespec
+evNowTime() {
+	struct timeval now;
+#ifdef CLOCK_REALTIME
+	struct timespec tsnow;
+	int m = CLOCK_REALTIME;
+
+#ifdef CLOCK_MONOTONIC
+	if (__evOptMonoTime)
+		m = CLOCK_MONOTONIC;
+#endif
+	if (clock_gettime(m, &tsnow) == 0)
+		return (tsnow);
+#endif
+	if (gettimeofday(&now, NULL) < 0)
+		return (evConsTime(0, 0));
+	return (evTimeSpec(now));
+}
+
+struct timespec
+evUTCTime() {
+	struct timeval now;
+#ifdef CLOCK_REALTIME
+	struct timespec tsnow;
+	if (clock_gettime(CLOCK_REALTIME, &tsnow) == 0)
+		return (tsnow);
+#endif
+	if (gettimeofday(&now, NULL) < 0)
+		return (evConsTime(0, 0));
+	return (evTimeSpec(now));
+}
+
+struct timespec
+evLastEventTime(evContext opaqueCtx) {
+	evContext_p *ctx = opaqueCtx.opaque;
+
+	return (ctx->lastEventTime);
+}
+
+struct timespec
+evTimeSpec(struct timeval tv) {
+	struct timespec ts;
+
+	ts.tv_sec = tv.tv_sec;
+	ts.tv_nsec = tv.tv_usec * 1000;
+	return (ts);
+}
+
+struct timeval
+evTimeVal(struct timespec ts) {
+	struct timeval tv;
+
+	tv.tv_sec = ts.tv_sec;
+	tv.tv_usec = ts.tv_nsec / 1000;
+	return (tv);
+}
+
+int
+evSetTimer(evContext opaqueCtx,
+	   evTimerFunc func,
+	   void *uap,
+	   struct timespec due,
+	   struct timespec inter,
+	   evTimerID *opaqueID
+) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evTimer *id;
+
+	evPrintf(ctx, 1,
+"evSetTimer(ctx %p, func %p, uap %p, due %ld.%09ld, inter %ld.%09ld)\n",
+		 ctx, func, uap,
+		 (long)due.tv_sec, due.tv_nsec,
+		 (long)inter.tv_sec, inter.tv_nsec);
+
+#ifdef __hpux
+	/*
+	 * tv_sec and tv_nsec are unsigned.
+	 */
+	if (due.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+
+	if (inter.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+#else
+	if (due.tv_sec < 0 || due.tv_nsec < 0 || due.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+
+	if (inter.tv_sec < 0 || inter.tv_nsec < 0 || inter.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+#endif
+
+	/* due={0,0} is a magic cookie meaning "now." */
+	if (due.tv_sec == (time_t)0 && due.tv_nsec == 0L)
+		due = evNowTime();
+
+	/* Allocate and fill. */
+	OKNEW(id);
+	id->func = func;
+	id->uap = uap;
+	id->due = due;
+	id->inter = inter;
+
+	if (heap_insert(ctx->timers, id) < 0)
+		return (-1);
+
+	/* Remember the ID if the caller provided us a place for it. */
+	if (opaqueID)
+		opaqueID->opaque = id;
+
+	if (ctx->debug > 7) {
+		evPrintf(ctx, 7, "timers after evSetTimer:\n");
+		(void) heap_for_each(ctx->timers, print_timer, (void *)ctx);
+	}
+
+	return (0);
+}
+
+int
+evClearTimer(evContext opaqueCtx, evTimerID id) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evTimer *del = id.opaque;
+
+	if (ctx->cur != NULL &&
+	    ctx->cur->type == Timer &&
+	    ctx->cur->u.timer.this == del) {
+		evPrintf(ctx, 8, "deferring delete of timer (executing)\n");
+		/*
+		 * Setting the interval to zero ensures that evDrop() will
+		 * clean up the timer.
+		 */
+		del->inter = evConsTime(0, 0);
+		return (0);
+	}
+
+	if (heap_element(ctx->timers, del->index) != del)
+		EV_ERR(ENOENT);
+
+	if (heap_delete(ctx->timers, del->index) < 0)
+		return (-1);
+	FREE(del);
+
+	if (ctx->debug > 7) {
+		evPrintf(ctx, 7, "timers after evClearTimer:\n");
+		(void) heap_for_each(ctx->timers, print_timer, (void *)ctx);
+	}
+
+	return (0);
+}
+
+int
+evConfigTimer(evContext opaqueCtx,
+	     evTimerID id,
+	     const char *param,
+	     int value
+) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evTimer *timer = id.opaque;
+	int result=0;
+
+	UNUSED(value);
+
+	if (heap_element(ctx->timers, timer->index) != timer)
+		EV_ERR(ENOENT);
+
+	if (strcmp(param, "rate") == 0)
+		timer->mode |= EV_TMR_RATE;
+	else if (strcmp(param, "interval") == 0)
+		timer->mode &= ~EV_TMR_RATE;
+	else
+		EV_ERR(EINVAL);
+
+	return (result);
+}
+
+int
+evResetTimer(evContext opaqueCtx,
+	     evTimerID id,
+	     evTimerFunc func,
+	     void *uap,
+	     struct timespec due,
+	     struct timespec inter
+) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evTimer *timer = id.opaque;
+	struct timespec old_due;
+	int result=0;
+
+	if (heap_element(ctx->timers, timer->index) != timer)
+		EV_ERR(ENOENT);
+
+#ifdef __hpux
+	/*
+	 * tv_sec and tv_nsec are unsigned.
+	 */
+	if (due.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+
+	if (inter.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+#else
+	if (due.tv_sec < 0 || due.tv_nsec < 0 || due.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+
+	if (inter.tv_sec < 0 || inter.tv_nsec < 0 || inter.tv_nsec >= BILLION)
+		EV_ERR(EINVAL);
+#endif
+
+	old_due = timer->due;
+
+	timer->func = func;
+	timer->uap = uap;
+	timer->due = due;
+	timer->inter = inter;
+
+	switch (evCmpTime(due, old_due)) {
+	case -1:
+		result = heap_increased(ctx->timers, timer->index);
+		break;
+	case 0:
+		result = 0;
+		break;
+	case 1:
+		result = heap_decreased(ctx->timers, timer->index);
+		break;
+	}
+
+	if (ctx->debug > 7) {
+		evPrintf(ctx, 7, "timers after evResetTimer:\n");
+		(void) heap_for_each(ctx->timers, print_timer, (void *)ctx);
+	}
+
+	return (result);
+}
+
+int
+evSetIdleTimer(evContext opaqueCtx,
+		evTimerFunc func,
+		void *uap,
+		struct timespec max_idle,
+		evTimerID *opaqueID
+) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	idle_timer *tt;
+
+	/* Allocate and fill. */
+	OKNEW(tt);
+	tt->func = func;
+	tt->uap = uap;
+	tt->lastTouched = ctx->lastEventTime;
+	tt->max_idle = max_idle;
+
+	if (evSetTimer(opaqueCtx, idle_timeout, tt,
+		       evAddTime(ctx->lastEventTime, max_idle),
+		       max_idle, opaqueID) < 0) {
+		FREE(tt);
+		return (-1);
+	}
+
+	tt->timer = opaqueID->opaque;
+
+	return (0);
+}
+
+int
+evClearIdleTimer(evContext opaqueCtx, evTimerID id) {
+	evTimer *del = id.opaque;
+	idle_timer *tt = del->uap;
+
+	FREE(tt);
+	return (evClearTimer(opaqueCtx, id));
+}
+
+int
+evResetIdleTimer(evContext opaqueCtx,
+		 evTimerID opaqueID,
+		 evTimerFunc func,
+		 void *uap,
+		 struct timespec max_idle
+) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evTimer *timer = opaqueID.opaque;
+	idle_timer *tt = timer->uap;
+
+	tt->func = func;
+	tt->uap = uap;
+	tt->lastTouched = ctx->lastEventTime;
+	tt->max_idle = max_idle;
+
+	return (evResetTimer(opaqueCtx, opaqueID, idle_timeout, tt,
+			     evAddTime(ctx->lastEventTime, max_idle),
+			     max_idle));
+}
+
+int
+evTouchIdleTimer(evContext opaqueCtx, evTimerID id) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evTimer *t = id.opaque;
+	idle_timer *tt = t->uap;
+
+	tt->lastTouched = ctx->lastEventTime;
+
+	return (0);
+}
+
+/* Public to the rest of eventlib. */
+
+heap_context
+evCreateTimers(const evContext_p *ctx) {
+
+	UNUSED(ctx);
+
+	return (heap_new(due_sooner, set_index, 2048));
+}
+
+void
+evDestroyTimers(const evContext_p *ctx) {
+	(void) heap_for_each(ctx->timers, free_timer, NULL);
+	(void) heap_free(ctx->timers);
+}
+
+/* Private. */
+
+static int
+due_sooner(void *a, void *b) {
+	evTimer *a_timer, *b_timer;
+
+	a_timer = a;
+	b_timer = b;
+	return (evCmpTime(a_timer->due, b_timer->due) < 0);
+}
+
+static void
+set_index(void *what, int index) {
+	evTimer *timer;
+
+	timer = what;
+	timer->index = index;
+}
+
+static void
+free_timer(void *what, void *uap) {
+	evTimer *t = what;
+
+	UNUSED(uap);
+
+	FREE(t);
+}
+
+static void
+print_timer(void *what, void *uap) {
+	evTimer *cur = what;
+	evContext_p *ctx = uap;
+
+	cur = what;
+	evPrintf(ctx, 7,
+	    "  func %p, uap %p, due %ld.%09ld, inter %ld.%09ld\n",
+		 cur->func, cur->uap,
+		 (long)cur->due.tv_sec, cur->due.tv_nsec,
+		 (long)cur->inter.tv_sec, cur->inter.tv_nsec);
+}
+
+static void
+idle_timeout(evContext opaqueCtx,
+	     void *uap,
+	     struct timespec due,
+	     struct timespec inter
+) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	idle_timer *this = uap;
+	struct timespec idle;
+
+	UNUSED(due);
+	UNUSED(inter);
+	
+	idle = evSubTime(ctx->lastEventTime, this->lastTouched);
+	if (evCmpTime(idle, this->max_idle) >= 0) {
+		(this->func)(opaqueCtx, this->uap, this->timer->due,
+			     this->max_idle);
+		/*
+		 * Setting the interval to zero will cause the timer to
+		 * be cleaned up in evDrop().
+		 */
+		this->timer->inter = evConsTime(0, 0);
+		FREE(this);
+	} else {
+		/* evDrop() will reschedule the timer. */
+		this->timer->inter = evSubTime(this->max_idle, idle);
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/ev_waits.c b/usr/src/lib/libresolv2_joy/common/isc/ev_waits.c
new file mode 100644
index 0000000000..99da1526c7
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/ev_waits.c
@@ -0,0 +1,247 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* ev_waits.c - implement deferred function calls for the eventlib
+ * vix 05dec95 [initial]
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: ev_waits.c,v 1.4 2005/04/27 04:56:36 sra Exp $";
+#endif
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <errno.h>
+
+#include <isc/eventlib.h>
+#include <isc/assertions.h>
+#include "eventlib_p.h"
+
+#include "port_after.h"
+
+/* Forward. */
+
+static void		print_waits(evContext_p *ctx);
+static evWaitList *	evNewWaitList(evContext_p *);
+static void		evFreeWaitList(evContext_p *, evWaitList *);
+static evWaitList *	evGetWaitList(evContext_p *, const void *, int);
+
+
+/* Public. */
+
+/*%
+ * Enter a new wait function on the queue.
+ */
+int
+evWaitFor(evContext opaqueCtx, const void *tag,
+	  evWaitFunc func, void *uap, evWaitID *id)
+{
+	evContext_p *ctx = opaqueCtx.opaque;
+	evWait *new;
+	evWaitList *wl = evGetWaitList(ctx, tag, 1);
+
+	OKNEW(new);
+	new->func = func;
+	new->uap = uap;
+	new->tag = tag;
+	new->next = NULL;
+	if (wl->last != NULL)
+		wl->last->next = new;
+	else
+		wl->first = new;
+	wl->last = new;
+	if (id != NULL)
+		id->opaque = new;
+	if (ctx->debug >= 9)
+		print_waits(ctx);
+	return (0);
+}
+
+/*%
+ * Mark runnable all waiting functions having a certain tag.
+ */
+int
+evDo(evContext opaqueCtx, const void *tag) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evWaitList *wl = evGetWaitList(ctx, tag, 0);
+	evWait *first;
+
+	if (!wl) {
+		errno = ENOENT;
+		return (-1);
+	}
+
+	first = wl->first;
+	INSIST(first != NULL);
+
+	if (ctx->waitDone.last != NULL)
+		ctx->waitDone.last->next = first;
+	else
+		ctx->waitDone.first = first;
+	ctx->waitDone.last = wl->last;
+	evFreeWaitList(ctx, wl);
+
+	return (0);
+}
+
+/*%
+ * Remove a waiting (or ready to run) function from the queue.
+ */
+int
+evUnwait(evContext opaqueCtx, evWaitID id) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evWait *this, *prev;
+	evWaitList *wl;
+	int found = 0;
+
+	this = id.opaque;
+	INSIST(this != NULL);
+	wl = evGetWaitList(ctx, this->tag, 0);
+	if (wl != NULL) {
+		for (prev = NULL, this = wl->first;
+		     this != NULL;
+		     prev = this, this = this->next)
+			if (this == (evWait *)id.opaque) {
+				found = 1;
+				if (prev != NULL)
+					prev->next = this->next;
+				else
+					wl->first = this->next;
+				if (wl->last == this)
+					wl->last = prev;
+				if (wl->first == NULL)
+					evFreeWaitList(ctx, wl);
+				break;
+			}
+	}
+
+	if (!found) {
+		/* Maybe it's done */
+		for (prev = NULL, this = ctx->waitDone.first;
+		     this != NULL;
+		     prev = this, this = this->next)
+			if (this == (evWait *)id.opaque) {
+				found = 1;
+				if (prev != NULL)
+					prev->next = this->next;
+				else
+					ctx->waitDone.first = this->next;
+				if (ctx->waitDone.last == this)
+					ctx->waitDone.last = prev;
+				break;
+			}
+	}
+
+	if (!found) {
+		errno = ENOENT;
+		return (-1);
+	}
+
+	FREE(this);
+
+	if (ctx->debug >= 9)
+		print_waits(ctx);
+
+	return (0);
+}
+
+int
+evDefer(evContext opaqueCtx, evWaitFunc func, void *uap) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evWait *new;
+
+	OKNEW(new);
+	new->func = func;
+	new->uap = uap;
+	new->tag = NULL;
+	new->next = NULL;
+	if (ctx->waitDone.last != NULL)
+		ctx->waitDone.last->next = new;
+	else
+		ctx->waitDone.first = new;
+	ctx->waitDone.last = new;
+	if (ctx->debug >= 9)
+		print_waits(ctx);
+	return (0);
+}
+
+/* Private. */
+
+static void
+print_waits(evContext_p *ctx) {
+	evWaitList *wl;
+	evWait *this;
+
+	evPrintf(ctx, 9, "wait waiting:\n");
+	for (wl = ctx->waitLists; wl != NULL; wl = wl->next) {
+		INSIST(wl->first != NULL);
+		evPrintf(ctx, 9, "  tag %p:", wl->first->tag);
+		for (this = wl->first; this != NULL; this = this->next)
+			evPrintf(ctx, 9, " %p", this);
+		evPrintf(ctx, 9, "\n");
+	}
+	evPrintf(ctx, 9, "wait done:");
+	for (this = ctx->waitDone.first; this != NULL; this = this->next)
+		evPrintf(ctx, 9, " %p", this);
+	evPrintf(ctx, 9, "\n");
+}
+
+static evWaitList *
+evNewWaitList(evContext_p *ctx) {
+	evWaitList *new;
+
+	NEW(new);
+	if (new == NULL)
+		return (NULL);
+	new->first = new->last = NULL;
+	new->prev = NULL;
+	new->next = ctx->waitLists;
+	if (new->next != NULL)
+		new->next->prev = new;
+	ctx->waitLists = new;
+	return (new);
+}
+
+static void
+evFreeWaitList(evContext_p *ctx, evWaitList *this) {
+
+	INSIST(this != NULL);
+
+	if (this->prev != NULL)
+		this->prev->next = this->next;
+	else
+		ctx->waitLists = this->next;
+	if (this->next != NULL)
+		this->next->prev = this->prev;
+	FREE(this);
+}
+
+static evWaitList *
+evGetWaitList(evContext_p *ctx, const void *tag, int should_create) {
+	evWaitList *this;
+
+	for (this = ctx->waitLists; this != NULL; this = this->next) {
+		if (this->first != NULL && this->first->tag == tag)
+			break;
+	}
+	if (this == NULL && should_create)
+		this = evNewWaitList(ctx);
+	return (this);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/eventlib.c b/usr/src/lib/libresolv2_joy/common/isc/eventlib.c
new file mode 100644
index 0000000000..be4a7848b9
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/eventlib.c
@@ -0,0 +1,933 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995-1999 by Internet Software Consortium
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* eventlib.c - implement glue for the eventlib
+ * vix 09sep95 [initial]
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: eventlib.c,v 1.10 2006/03/09 23:57:56 marka Exp $";
+#endif
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/stat.h>
+#ifdef	SOLARIS2
+#include <limits.h>
+#endif	/* SOLARIS2 */
+
+#include <errno.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <isc/eventlib.h>
+#include <isc/assertions.h>
+#include "eventlib_p.h"
+
+#include "port_after.h"
+
+int      __evOptMonoTime;
+
+#ifdef USE_POLL
+#define	pselect Pselect
+#endif /* USE_POLL */
+
+/* Forward. */
+
+#if defined(NEED_PSELECT) || defined(USE_POLL)
+static int		pselect(int, void *, void *, void *,
+				struct timespec *,
+				const sigset_t *);
+#endif
+
+int    __evOptMonoTime;
+
+/* Public. */
+
+int
+evCreate(evContext *opaqueCtx) {
+	evContext_p *ctx;
+
+	/* Make sure the memory heap is initialized. */
+	if (meminit(0, 0) < 0 && errno != EEXIST)
+		return (-1);
+
+	OKNEW(ctx);
+
+	/* Global. */
+	ctx->cur = NULL;
+
+	/* Debugging. */
+	ctx->debug = 0;
+	ctx->output = NULL;
+
+	/* Connections. */
+	ctx->conns = NULL;
+	INIT_LIST(ctx->accepts);
+
+	/* Files. */
+	ctx->files = NULL;
+#ifdef USE_POLL
+        ctx->pollfds = NULL;
+	ctx->maxnfds = 0;
+	ctx->firstfd = 0;
+	emulMaskInit(ctx, rdLast, EV_READ, 1);
+	emulMaskInit(ctx, rdNext, EV_READ, 0);
+	emulMaskInit(ctx, wrLast, EV_WRITE, 1);
+	emulMaskInit(ctx, wrNext, EV_WRITE, 0);
+	emulMaskInit(ctx, exLast, EV_EXCEPT, 1);
+	emulMaskInit(ctx, exNext, EV_EXCEPT, 0);
+	emulMaskInit(ctx, nonblockBefore, EV_WASNONBLOCKING, 0);
+#endif /* USE_POLL */
+	FD_ZERO(&ctx->rdNext);
+	FD_ZERO(&ctx->wrNext);
+	FD_ZERO(&ctx->exNext);
+	FD_ZERO(&ctx->nonblockBefore);
+	ctx->fdMax = -1;
+	ctx->fdNext = NULL;
+	ctx->fdCount = 0;	/*%< Invalidate {rd,wr,ex}Last. */
+#ifndef USE_POLL
+	ctx->highestFD = FD_SETSIZE - 1;
+	memset(ctx->fdTable, 0, sizeof ctx->fdTable);
+#else   
+	ctx->highestFD = INT_MAX / sizeof(struct pollfd);
+	ctx->fdTable = NULL;
+#endif /* USE_POLL */
+#ifdef EVENTLIB_TIME_CHECKS
+	ctx->lastFdCount = 0;
+#endif
+
+	/* Streams. */
+	ctx->streams = NULL;
+	ctx->strDone = NULL;
+	ctx->strLast = NULL;
+
+	/* Timers. */
+	ctx->lastEventTime = evNowTime();
+#ifdef EVENTLIB_TIME_CHECKS
+	ctx->lastSelectTime = ctx->lastEventTime;
+#endif
+	ctx->timers = evCreateTimers(ctx);
+	if (ctx->timers == NULL)
+		return (-1);
+
+	/* Waits. */
+	ctx->waitLists = NULL;
+	ctx->waitDone.first = ctx->waitDone.last = NULL;
+	ctx->waitDone.prev = ctx->waitDone.next = NULL;
+
+	opaqueCtx->opaque = ctx;
+	return (0);
+}
+
+void
+evSetDebug(evContext opaqueCtx, int level, FILE *output) {
+	evContext_p *ctx = opaqueCtx.opaque;
+
+	ctx->debug = level;
+	ctx->output = output;
+}
+
+int
+evDestroy(evContext opaqueCtx) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	int revs = 424242;	/*%< Doug Adams. */
+	evWaitList *this_wl, *next_wl;
+	evWait *this_wait, *next_wait;
+
+	/* Connections. */
+	while (revs-- > 0 && ctx->conns != NULL) {
+		evConnID id;
+
+		id.opaque = ctx->conns;
+		(void) evCancelConn(opaqueCtx, id);
+	}
+	INSIST(revs >= 0);
+
+	/* Streams. */
+	while (revs-- > 0 && ctx->streams != NULL) {
+		evStreamID id;
+
+		id.opaque = ctx->streams;
+		(void) evCancelRW(opaqueCtx, id);
+	}
+
+	/* Files. */
+	while (revs-- > 0 && ctx->files != NULL) {
+		evFileID id;
+
+		id.opaque = ctx->files;
+		(void) evDeselectFD(opaqueCtx, id);
+	}
+	INSIST(revs >= 0);
+
+	/* Timers. */
+	evDestroyTimers(ctx);
+
+	/* Waits. */
+	for (this_wl = ctx->waitLists;
+	     revs-- > 0 && this_wl != NULL;
+	     this_wl = next_wl) {
+		next_wl = this_wl->next;
+		for (this_wait = this_wl->first;
+		     revs-- > 0 && this_wait != NULL;
+		     this_wait = next_wait) {
+			next_wait = this_wait->next;
+			FREE(this_wait);
+		}
+		FREE(this_wl);
+	}
+	for (this_wait = ctx->waitDone.first;
+	     revs-- > 0 && this_wait != NULL;
+	     this_wait = next_wait) {
+		next_wait = this_wait->next;
+		FREE(this_wait);
+	}
+
+	FREE(ctx);
+	return (0);
+}
+
+int
+evGetNext(evContext opaqueCtx, evEvent *opaqueEv, int options) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	struct timespec nextTime;
+	evTimer *nextTimer;
+	evEvent_p *new;
+	int x, pselect_errno, timerPast;
+#ifdef EVENTLIB_TIME_CHECKS
+	struct timespec interval;
+#endif
+
+	/* Ensure that exactly one of EV_POLL or EV_WAIT was specified. */
+	x = ((options & EV_POLL) != 0) + ((options & EV_WAIT) != 0);
+	if (x != 1)
+		EV_ERR(EINVAL);
+
+	/* Get the time of day.  We'll do this again after select() blocks. */
+	ctx->lastEventTime = evNowTime();
+
+ again:
+	/* Finished accept()'s do not require a select(). */
+	if (!EMPTY(ctx->accepts)) {
+		OKNEW(new);
+		new->type = Accept;
+		new->u.accept.this = HEAD(ctx->accepts);
+		UNLINK(ctx->accepts, HEAD(ctx->accepts), link);
+		opaqueEv->opaque = new;
+		return (0);
+	}
+
+	/* Stream IO does not require a select(). */
+	if (ctx->strDone != NULL) {
+		OKNEW(new);
+		new->type = Stream;
+		new->u.stream.this = ctx->strDone;
+		ctx->strDone = ctx->strDone->nextDone;
+		if (ctx->strDone == NULL)
+			ctx->strLast = NULL;
+		opaqueEv->opaque = new;
+		return (0);
+	}
+
+	/* Waits do not require a select(). */
+	if (ctx->waitDone.first != NULL) {
+		OKNEW(new);
+		new->type = Wait;
+		new->u.wait.this = ctx->waitDone.first;
+		ctx->waitDone.first = ctx->waitDone.first->next;
+		if (ctx->waitDone.first == NULL)
+			ctx->waitDone.last = NULL;
+		opaqueEv->opaque = new;
+		return (0);
+	}
+
+	/* Get the status and content of the next timer. */
+	if ((nextTimer = heap_element(ctx->timers, 1)) != NULL) {
+		nextTime = nextTimer->due;
+		timerPast = (evCmpTime(nextTime, ctx->lastEventTime) <= 0);
+	} else
+		timerPast = 0;	/*%< Make gcc happy. */
+	evPrintf(ctx, 9, "evGetNext: fdCount %d\n", ctx->fdCount);
+	if (ctx->fdCount == 0) {
+		static const struct timespec NoTime = {0, 0L};
+		enum { JustPoll, Block, Timer } m;
+		struct timespec t, *tp;
+
+		/* Are there any events at all? */
+		if ((options & EV_WAIT) != 0 && !nextTimer && ctx->fdMax == -1)
+			EV_ERR(ENOENT);
+
+		/* Figure out what select()'s timeout parameter should be. */
+		if ((options & EV_POLL) != 0) {
+			m = JustPoll;
+			t = NoTime;
+			tp = &t;
+		} else if (nextTimer == NULL) {
+			m = Block;
+			/* ``t'' unused. */
+			tp = NULL;
+		} else if (timerPast) {
+			m = JustPoll;
+			t = NoTime;
+			tp = &t;
+		} else {
+			m = Timer;
+			/* ``t'' filled in later. */
+			tp = &t;
+		}
+#ifdef EVENTLIB_TIME_CHECKS
+		if (ctx->debug > 0) {
+			interval = evSubTime(ctx->lastEventTime,
+					     ctx->lastSelectTime);
+			if (interval.tv_sec > 0 || interval.tv_nsec > 0)
+				evPrintf(ctx, 1,
+				   "time between pselect() %u.%09u count %d\n",
+					 interval.tv_sec, interval.tv_nsec,
+					 ctx->lastFdCount);
+		}
+#endif
+		do {
+#ifndef USE_POLL
+			 /* XXX need to copy only the bits we are using. */
+			 ctx->rdLast = ctx->rdNext;
+			 ctx->wrLast = ctx->wrNext;
+			 ctx->exLast = ctx->exNext;
+#else
+			/*
+			 * The pollfd structure uses separate fields for
+			 * the input and output events (corresponding to
+			 * the ??Next and ??Last fd sets), so there's no
+			 * need to copy one to the other.
+			 */
+#endif /* USE_POLL */
+			if (m == Timer) {
+				INSIST(tp == &t);
+				t = evSubTime(nextTime, ctx->lastEventTime);
+			}
+
+			/* XXX should predict system's earliness and adjust. */
+			x = pselect(ctx->fdMax+1,
+				    &ctx->rdLast, &ctx->wrLast, &ctx->exLast,
+				    tp, NULL);
+			pselect_errno = errno;
+
+#ifndef USE_POLL
+			evPrintf(ctx, 4, "select() returns %d (err: %s)\n",
+				 x, (x == -1) ? strerror(errno) : "none");
+#else
+			evPrintf(ctx, 4, "poll() returns %d (err: %s)\n",
+				x, (x == -1) ? strerror(errno) : "none");
+#endif /* USE_POLL */
+			/* Anything but a poll can change the time. */
+			if (m != JustPoll)
+				ctx->lastEventTime = evNowTime();
+
+			/* Select() likes to finish about 10ms early. */
+		} while (x == 0 && m == Timer &&
+			 evCmpTime(ctx->lastEventTime, nextTime) < 0);
+#ifdef EVENTLIB_TIME_CHECKS
+		ctx->lastSelectTime = ctx->lastEventTime;
+#endif
+		if (x < 0) {
+			if (pselect_errno == EINTR) {
+				if ((options & EV_NULL) != 0)
+					goto again;
+				OKNEW(new);
+				new->type = Null;
+				/* No data. */
+				opaqueEv->opaque = new;
+				return (0);
+			}
+			if (pselect_errno == EBADF) {
+				for (x = 0; x <= ctx->fdMax; x++) {
+					struct stat sb;
+
+					if (FD_ISSET(x, &ctx->rdNext) == 0 &&
+					    FD_ISSET(x, &ctx->wrNext) == 0 &&
+					    FD_ISSET(x, &ctx->exNext) == 0)
+						continue;
+					if (fstat(x, &sb) == -1 &&
+					    errno == EBADF)
+						evPrintf(ctx, 1, "EBADF: %d\n",
+							 x);
+				}
+				abort();
+			}
+			EV_ERR(pselect_errno);
+		}
+		if (x == 0 && (nextTimer == NULL || !timerPast) &&
+		    (options & EV_POLL))
+			EV_ERR(EWOULDBLOCK);
+		ctx->fdCount = x;
+#ifdef EVENTLIB_TIME_CHECKS
+		ctx->lastFdCount = x;
+#endif
+	}
+	INSIST(nextTimer || ctx->fdCount);
+
+	/* Timers go first since we'd like them to be accurate. */
+	if (nextTimer && !timerPast) {
+		/* Has anything happened since we blocked? */
+		timerPast = (evCmpTime(nextTime, ctx->lastEventTime) <= 0);
+	}
+	if (nextTimer && timerPast) {
+		OKNEW(new);
+		new->type = Timer;
+		new->u.timer.this = nextTimer;
+		opaqueEv->opaque = new;
+		return (0);
+	}
+
+	/* No timers, so there should be a ready file descriptor. */
+	x = 0;
+	while (ctx->fdCount > 0) {
+		evFile *fid;
+		int fd, eventmask;
+
+		if (ctx->fdNext == NULL) {
+			if (++x == 2) {
+				/*
+				 * Hitting the end twice means that the last
+				 * select() found some FD's which have since
+				 * been deselected.
+				 *
+				 * On some systems, the count returned by
+				 * selects is the total number of bits in
+				 * all masks that are set, and on others it's
+				 * the number of fd's that have some bit set,
+				 * and on others, it's just broken.  We 
+				 * always assume that it's the number of
+				 * bits set in all masks, because that's what
+				 * the man page says it should do, and
+				 * the worst that can happen is we do an
+				 * extra select().
+				 */
+				ctx->fdCount = 0;
+				break;
+			}
+			ctx->fdNext = ctx->files;
+		}
+		fid = ctx->fdNext;
+		ctx->fdNext = fid->next;
+
+		fd = fid->fd;
+		eventmask = 0;
+		if (FD_ISSET(fd, &ctx->rdLast))
+			eventmask |= EV_READ;
+		if (FD_ISSET(fd, &ctx->wrLast))
+			eventmask |= EV_WRITE;
+		if (FD_ISSET(fd, &ctx->exLast))
+			eventmask |= EV_EXCEPT;
+		eventmask &= fid->eventmask;
+		if (eventmask != 0) {
+			if ((eventmask & EV_READ) != 0) {
+				FD_CLR(fd, &ctx->rdLast);
+				ctx->fdCount--;
+			}
+			if ((eventmask & EV_WRITE) != 0) {
+				FD_CLR(fd, &ctx->wrLast);
+				ctx->fdCount--;
+			}
+			if ((eventmask & EV_EXCEPT) != 0) {
+				FD_CLR(fd, &ctx->exLast);
+				ctx->fdCount--;
+			}
+			OKNEW(new);
+			new->type = File;
+			new->u.file.this = fid;
+			new->u.file.eventmask = eventmask;
+			opaqueEv->opaque = new;
+			return (0);
+		}
+	}
+	if (ctx->fdCount < 0) {
+		/*
+		 * select()'s count is off on a number of systems, and
+		 * can result in fdCount < 0.
+		 */
+		evPrintf(ctx, 4, "fdCount < 0 (%d)\n", ctx->fdCount);
+		ctx->fdCount = 0;
+	}
+
+	/* We get here if the caller deselect()'s an FD. Gag me with a goto. */
+	goto again;
+}
+
+int
+evDispatch(evContext opaqueCtx, evEvent opaqueEv) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evEvent_p *ev = opaqueEv.opaque;
+#ifdef EVENTLIB_TIME_CHECKS
+	void *func;
+	struct timespec start_time;
+	struct timespec interval;
+#endif
+
+#ifdef EVENTLIB_TIME_CHECKS
+	if (ctx->debug > 0)
+		start_time = evNowTime();
+#endif
+	ctx->cur = ev;
+	switch (ev->type) {
+	    case Accept: {
+		evAccept *this = ev->u.accept.this;
+
+		evPrintf(ctx, 5,
+			"Dispatch.Accept: fd %d -> %d, func %p, uap %p\n",
+			 this->conn->fd, this->fd,
+			 this->conn->func, this->conn->uap);
+		errno = this->ioErrno;
+		(this->conn->func)(opaqueCtx, this->conn->uap, this->fd,
+				   &this->la, this->lalen,
+				   &this->ra, this->ralen);
+#ifdef EVENTLIB_TIME_CHECKS
+		func = this->conn->func;
+#endif
+		break;
+	    }
+	    case File: {
+		evFile *this = ev->u.file.this;
+		int eventmask = ev->u.file.eventmask;
+
+		evPrintf(ctx, 5,
+			"Dispatch.File: fd %d, mask 0x%x, func %p, uap %p\n",
+			 this->fd, this->eventmask, this->func, this->uap);
+		(this->func)(opaqueCtx, this->uap, this->fd, eventmask);
+#ifdef EVENTLIB_TIME_CHECKS
+		func = this->func;
+#endif
+		break;
+	    }
+	    case Stream: {
+		evStream *this = ev->u.stream.this;
+
+		evPrintf(ctx, 5,
+			 "Dispatch.Stream: fd %d, func %p, uap %p\n",
+			 this->fd, this->func, this->uap);
+		errno = this->ioErrno;
+		(this->func)(opaqueCtx, this->uap, this->fd, this->ioDone);
+#ifdef EVENTLIB_TIME_CHECKS
+		func = this->func;
+#endif
+		break;
+	    }
+	    case Timer: {
+		evTimer *this = ev->u.timer.this;
+
+		evPrintf(ctx, 5, "Dispatch.Timer: func %p, uap %p\n",
+			 this->func, this->uap);
+		(this->func)(opaqueCtx, this->uap, this->due, this->inter);
+#ifdef EVENTLIB_TIME_CHECKS
+		func = this->func;
+#endif
+		break;
+	    }
+	    case Wait: {
+		evWait *this = ev->u.wait.this;
+
+		evPrintf(ctx, 5,
+			 "Dispatch.Wait: tag %p, func %p, uap %p\n",
+			 this->tag, this->func, this->uap);
+		(this->func)(opaqueCtx, this->uap, this->tag);
+#ifdef EVENTLIB_TIME_CHECKS
+		func = this->func;
+#endif
+		break;
+	    }
+	    case Null: {
+		/* No work. */
+#ifdef EVENTLIB_TIME_CHECKS
+		func = NULL;
+#endif
+		break;
+	    }
+	    default: {
+		abort();
+	    }
+	}
+#ifdef EVENTLIB_TIME_CHECKS
+	if (ctx->debug > 0) {
+		interval = evSubTime(evNowTime(), start_time);
+		/* 
+		 * Complain if it took longer than 50 milliseconds.
+		 *
+		 * We call getuid() to make an easy to find mark in a kernel
+		 * trace.
+		 */
+		if (interval.tv_sec > 0 || interval.tv_nsec > 50000000)
+			evPrintf(ctx, 1,
+			 "dispatch interval %u.%09u uid %d type %d func %p\n",
+				 interval.tv_sec, interval.tv_nsec,
+				 getuid(), ev->type, func);
+	}
+#endif
+	ctx->cur = NULL;
+	evDrop(opaqueCtx, opaqueEv);
+	return (0);
+}
+
+void
+evDrop(evContext opaqueCtx, evEvent opaqueEv) {
+	evContext_p *ctx = opaqueCtx.opaque;
+	evEvent_p *ev = opaqueEv.opaque;
+
+	switch (ev->type) {
+	    case Accept: {
+		FREE(ev->u.accept.this);
+		break;
+	    }
+	    case File: {
+		/* No work. */
+		break;
+	    }
+	    case Stream: {
+		evStreamID id;
+
+		id.opaque = ev->u.stream.this;
+		(void) evCancelRW(opaqueCtx, id);
+		break;
+	    }
+	    case Timer: {
+		evTimer *this = ev->u.timer.this;
+		evTimerID opaque;
+
+		/* Check to see whether the user func cleared the timer. */
+		if (heap_element(ctx->timers, this->index) != this) {
+			evPrintf(ctx, 5, "Dispatch.Timer: timer rm'd?\n");
+			break;
+		}
+		/*
+		 * Timer is still there.  Delete it if it has expired,
+		 * otherwise set it according to its next interval.
+		 */
+		if (this->inter.tv_sec == (time_t)0 &&
+		    this->inter.tv_nsec == 0L) {
+			opaque.opaque = this;			
+			(void) evClearTimer(opaqueCtx, opaque);
+		} else {
+			opaque.opaque = this;
+			(void) evResetTimer(opaqueCtx, opaque, this->func,
+					    this->uap,
+					    evAddTime((this->mode & EV_TMR_RATE) ?
+						      this->due :
+						      ctx->lastEventTime,
+						      this->inter),
+					    this->inter);
+		}
+		break;
+	    }
+	    case Wait: {
+		FREE(ev->u.wait.this);
+		break;
+	    }
+	    case Null: {
+		/* No work. */
+		break;
+	    }
+	    default: {
+		abort();
+	    }
+	}
+	FREE(ev);
+}
+
+int
+evMainLoop(evContext opaqueCtx) {
+	evEvent event;
+	int x;
+
+	while ((x = evGetNext(opaqueCtx, &event, EV_WAIT)) == 0)
+		if ((x = evDispatch(opaqueCtx, event)) < 0)
+			break;
+	return (x);
+}
+
+int
+evHighestFD(evContext opaqueCtx) {
+	evContext_p *ctx = opaqueCtx.opaque;
+
+	return (ctx->highestFD);
+}
+
+void
+evPrintf(const evContext_p *ctx, int level, const char *fmt, ...) {
+	va_list ap;
+
+	va_start(ap, fmt);
+	if (ctx->output != NULL && ctx->debug >= level) {
+		vfprintf(ctx->output, fmt, ap);
+		fflush(ctx->output);
+	}
+	va_end(ap);
+}
+
+int
+evSetOption(evContext *opaqueCtx, const char *option, int value) {
+	/* evContext_p *ctx = opaqueCtx->opaque; */
+
+	UNUSED(opaqueCtx);
+	UNUSED(value);
+#ifndef CLOCK_MONOTONIC
+	UNUSED(option);
+#endif 
+
+#ifdef CLOCK_MONOTONIC
+	if (strcmp(option, "monotime") == 0) {
+		if (opaqueCtx  != NULL)
+			errno = EINVAL;
+		if (value == 0 || value == 1) {
+			__evOptMonoTime = value;
+			return (0);
+		} else {
+			errno = EINVAL;
+			return (-1);
+		}
+	} 
+#endif
+	errno = ENOENT;
+	return (-1);
+}
+
+int
+evGetOption(evContext *opaqueCtx, const char *option, int *value) {
+	/* evContext_p *ctx = opaqueCtx->opaque; */
+
+	UNUSED(opaqueCtx);
+#ifndef CLOCK_MONOTONIC
+	UNUSED(value);
+	UNUSED(option);
+#endif 
+
+#ifdef CLOCK_MONOTONIC
+	if (strcmp(option, "monotime") == 0) {
+		if (opaqueCtx  != NULL)
+			errno = EINVAL;
+		*value = __evOptMonoTime;
+		return (0);
+	}
+#endif
+	errno = ENOENT;
+	return (-1);
+}
+
+#if defined(NEED_PSELECT) || defined(USE_POLL)
+/* XXX needs to move to the porting library. */
+static int
+pselect(int nfds, void *rfds, void *wfds, void *efds,
+	struct timespec *tsp,
+	const sigset_t *sigmask)
+{
+	struct timeval tv, *tvp;
+	sigset_t sigs;
+	int n;
+#ifdef USE_POLL
+	int	polltimeout = INFTIM;
+	evContext_p	*ctx;
+	struct pollfd	*fds;
+	nfds_t		pnfds;
+
+	UNUSED(nfds);
+#endif /* USE_POLL */
+
+	if (tsp) {
+		tvp = &tv;
+		tv = evTimeVal(*tsp);
+#ifdef USE_POLL
+		polltimeout = 1000 * tv.tv_sec + tv.tv_usec / 1000;
+#endif /* USE_POLL */
+	} else
+		tvp = NULL;
+	if (sigmask)
+		sigprocmask(SIG_SETMASK, sigmask, &sigs);
+#ifndef USE_POLL
+	 n = select(nfds, rfds, wfds, efds, tvp);
+#else
+        /*
+	 * rfds, wfds, and efds should all be from the same evContext_p,
+	 * so any of them will do. If they're all NULL, the caller is
+	 * presumably calling us to block.
+	 */
+	if (rfds != NULL)
+		ctx = ((__evEmulMask *)rfds)->ctx;
+	else if (wfds != NULL)
+		ctx = ((__evEmulMask *)wfds)->ctx;
+	else if (efds != NULL)
+		ctx = ((__evEmulMask *)efds)->ctx;
+	else
+		ctx = NULL;
+	if (ctx != NULL && ctx->fdMax != -1) {
+		fds = &(ctx->pollfds[ctx->firstfd]);
+		pnfds = ctx->fdMax - ctx->firstfd + 1;
+	} else {
+		fds = NULL;
+		pnfds = 0;
+	}
+	n = poll(fds, pnfds, polltimeout);
+	if (n > 0) {
+		int     i, e;
+
+		INSIST(ctx != NULL);
+		for (e = 0, i = ctx->firstfd; i <= ctx->fdMax; i++) {
+			if (ctx->pollfds[i].fd < 0)
+				continue;
+			if (FD_ISSET(i, &ctx->rdLast))
+				e++;
+			if (FD_ISSET(i, &ctx->wrLast))
+				e++;
+			if (FD_ISSET(i, &ctx->exLast))
+				e++;
+		}
+		n = e;
+	}
+#endif /* USE_POLL */
+	if (sigmask)
+		sigprocmask(SIG_SETMASK, &sigs, NULL);
+	if (tsp)
+		*tsp = evTimeSpec(tv);
+	return (n);
+}
+#endif
+
+#ifdef USE_POLL
+int
+evPollfdRealloc(evContext_p *ctx, int pollfd_chunk_size, int fd) {
+ 
+	int     i, maxnfds;
+	void	*pollfds, *fdTable;
+ 
+	if (fd < ctx->maxnfds)
+		return (0);
+ 
+	/* Don't allow ridiculously small values for pollfd_chunk_size */
+	if (pollfd_chunk_size < 20)
+		pollfd_chunk_size = 20;
+ 
+	maxnfds = (1 + (fd/pollfd_chunk_size)) * pollfd_chunk_size;
+ 
+	pollfds = realloc(ctx->pollfds, maxnfds * sizeof(*ctx->pollfds));
+	if (pollfds != NULL)
+		ctx->pollfds = pollfds;
+	fdTable = realloc(ctx->fdTable, maxnfds * sizeof(*ctx->fdTable));
+	if (fdTable != NULL)
+		ctx->fdTable = fdTable;
+ 
+	if (pollfds == NULL || fdTable == NULL) {
+		evPrintf(ctx, 2, "pollfd() realloc (%ld) failed\n",
+			 (long)maxnfds*sizeof(struct pollfd));
+		return (-1);
+	}
+ 
+	for (i = ctx->maxnfds; i < maxnfds; i++) {
+		ctx->pollfds[i].fd = -1;
+		ctx->pollfds[i].events = 0;
+		ctx->fdTable[i] = 0;
+	}
+
+	ctx->maxnfds = maxnfds;
+
+	return (0);
+}
+ 
+/* Find the appropriate 'events' or 'revents' field in the pollfds array */
+short *
+__fd_eventfield(int fd, __evEmulMask *maskp) {
+ 
+	evContext_p     *ctx = (evContext_p *)maskp->ctx;
+ 
+	if (!maskp->result || maskp->type == EV_WASNONBLOCKING)
+		return (&(ctx->pollfds[fd].events));
+	else
+		return (&(ctx->pollfds[fd].revents));
+}
+ 
+/* Translate to poll(2) event */
+short
+__poll_event(__evEmulMask *maskp) {
+ 
+	switch ((maskp)->type) {
+	case EV_READ:
+		return (POLLRDNORM);
+	case EV_WRITE:
+		return (POLLWRNORM);
+	case EV_EXCEPT:
+		return (POLLRDBAND | POLLPRI | POLLWRBAND);
+	case EV_WASNONBLOCKING:
+		return (POLLHUP);
+	default:
+		return (0);
+	}
+}
+ 
+/*
+ * Clear the events corresponding to the specified mask. If this leaves
+ * the events mask empty (apart from the POLLHUP bit), set the fd field
+ * to -1 so that poll(2) will ignore this fd.
+ */
+void
+__fd_clr(int fd, __evEmulMask *maskp) {
+ 
+	evContext_p     *ctx = maskp->ctx;
+ 
+	*__fd_eventfield(fd, maskp) &= ~__poll_event(maskp);
+	if ((ctx->pollfds[fd].events & ~POLLHUP) == 0) {
+		ctx->pollfds[fd].fd = -1;
+		if (fd == ctx->fdMax)
+			while (ctx->fdMax > ctx->firstfd &&
+			       ctx->pollfds[ctx->fdMax].fd < 0)
+				ctx->fdMax--;
+		if (fd == ctx->firstfd)
+			while (ctx->firstfd <= ctx->fdMax &&
+			       ctx->pollfds[ctx->firstfd].fd < 0)
+				ctx->firstfd++;
+		/*
+		 * Do we have a empty set of descriptors?
+		 */
+		if (ctx->firstfd > ctx->fdMax) {
+			ctx->fdMax = -1;
+			ctx->firstfd = 0;
+		}
+	}
+}
+ 
+/*
+ * Set the events bit(s) corresponding to the specified mask. If the events
+ * field has any other bits than POLLHUP set, also set the fd field so that
+ * poll(2) will watch this fd.
+ */
+void
+__fd_set(int fd, __evEmulMask *maskp) {
+ 
+	evContext_p     *ctx = maskp->ctx;
+
+	*__fd_eventfield(fd, maskp) |= __poll_event(maskp);
+	if ((ctx->pollfds[fd].events & ~POLLHUP) != 0) {
+		ctx->pollfds[fd].fd = fd;
+		if (fd < ctx->firstfd || ctx->fdMax == -1)
+			ctx->firstfd = fd;
+		if (fd > ctx->fdMax)
+			ctx->fdMax = fd;
+	}
+}
+#endif /* USE_POLL */
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/eventlib_p.h b/usr/src/lib/libresolv2_joy/common/isc/eventlib_p.h
new file mode 100644
index 0000000000..0a3614ab23
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/eventlib_p.h
@@ -0,0 +1,281 @@
+/*
+ * Copyright (c) 2005 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995-1999 by Internet Software Consortium
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*! \file 
+ * \brief private interfaces for eventlib
+ * \author vix 09sep95 [initial]
+ *
+ * $Id: eventlib_p.h,v 1.9 2006/03/09 23:57:56 marka Exp $
+ */
+
+#ifndef _EVENTLIB_P_H
+#define _EVENTLIB_P_H
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <sys/un.h>
+
+#define EVENTLIB_DEBUG 1
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/heap.h>
+#include <isc/list.h>
+#include <isc/memcluster.h>
+
+#define	EV_MASK_ALL	(EV_READ | EV_WRITE | EV_EXCEPT)
+#define EV_ERR(e)		return (errno = (e), -1)
+#define OK(x)		if ((x) < 0) EV_ERR(errno); else (void)NULL
+#define OKFREE(x, y)	if ((x) < 0) { FREE((y)); EV_ERR(errno); } \
+			else (void)NULL
+
+#define	NEW(p)		if (((p) = memget(sizeof *(p))) != NULL) \
+				FILL(p); \
+			else \
+				(void)NULL;
+#define OKNEW(p)	if (!((p) = memget(sizeof *(p)))) { \
+				errno = ENOMEM; \
+				return (-1); \
+			} else \
+				FILL(p)
+#define FREE(p)		memput((p), sizeof *(p))
+
+#if EVENTLIB_DEBUG
+#define FILL(p)		memset((p), 0xF5, sizeof *(p))
+#else
+#define FILL(p)
+#endif
+
+#ifdef USE_POLL
+#ifdef HAVE_STROPTS_H
+#include <stropts.h>
+#endif
+#include <poll.h>
+#endif /* USE_POLL */
+
+typedef struct evConn {
+	evConnFunc	func;
+	void *		uap;
+	int		fd;
+	int		flags;
+#define EV_CONN_LISTEN		0x0001		/*%< Connection is a listener. */
+#define EV_CONN_SELECTED	0x0002		/*%< evSelectFD(conn->file). */
+#define EV_CONN_BLOCK		0x0004		/*%< Listener fd was blocking. */
+	evFileID	file;
+	struct evConn *	prev;
+	struct evConn *	next;
+} evConn;
+
+typedef struct evAccept {
+	int		fd;
+	union {
+		struct sockaddr		sa;
+		struct sockaddr_in	in;
+#ifndef NO_SOCKADDR_UN
+		struct sockaddr_un	un;
+#endif
+	}		la;
+	ISC_SOCKLEN_T	lalen;
+	union {
+		struct sockaddr		sa;
+		struct sockaddr_in	in;
+#ifndef NO_SOCKADDR_UN
+		struct sockaddr_un	un;
+#endif
+	}		ra;
+	ISC_SOCKLEN_T	ralen;
+	int		ioErrno;
+	evConn *	conn;
+	LINK(struct evAccept) link;
+} evAccept;
+
+typedef struct evFile {
+	evFileFunc	func;
+	void *		uap;
+	int		fd;
+	int		eventmask;
+	int		preemptive;
+	struct evFile *	prev;
+	struct evFile *	next;
+	struct evFile *	fdprev;
+	struct evFile *	fdnext;
+} evFile;
+
+typedef struct evStream {
+	evStreamFunc	func;
+	void *		uap;
+	evFileID	file;
+	evTimerID	timer;
+	int		flags;
+#define EV_STR_TIMEROK	0x0001	/*%< IFF timer valid. */
+	int		fd;
+	struct iovec *	iovOrig;
+	int		iovOrigCount;
+	struct iovec *	iovCur;
+	int		iovCurCount;
+	int		ioTotal;
+	int		ioDone;
+	int		ioErrno;
+	struct evStream	*prevDone, *nextDone;
+	struct evStream	*prev, *next;
+} evStream;
+
+typedef struct evTimer {
+	evTimerFunc	func;
+	void *		uap;
+	struct timespec	due, inter;
+	int		index;
+	int		mode;
+#define EV_TMR_RATE	1
+} evTimer;
+
+typedef struct evWait {
+	evWaitFunc	func;
+	void *		uap;
+	const void *	tag;
+	struct evWait *	next;
+} evWait;
+
+typedef struct evWaitList {
+	evWait *		first;
+	evWait *		last;
+	struct evWaitList *	prev;
+	struct evWaitList *	next;
+} evWaitList;
+
+typedef struct evEvent_p {
+	enum {  Accept, File, Stream, Timer, Wait, Free, Null  } type;
+	union {
+		struct {  evAccept *this;  }			accept;
+		struct {  evFile *this; int eventmask;  }	file;
+		struct {  evStream *this;  }			stream;
+		struct {  evTimer *this;  }			timer;
+		struct {  evWait *this;  }			wait;
+		struct {  struct evEvent_p *next;  }		free;
+		struct {  const void *placeholder;  }		null;
+	} u;
+} evEvent_p;
+
+#ifdef USE_POLL
+typedef struct { 
+	void		*ctx;	/* pointer to the evContext_p   */ 
+	uint32_t	type;	/* READ, WRITE, EXCEPT, nonblk  */ 
+	uint32_t	result;	/* 1 => revents, 0 => events    */ 
+} __evEmulMask; 
+
+#define emulMaskInit(ctx, field, ev, lastnext) \
+	ctx->field.ctx = ctx; \
+	ctx->field.type = ev; \
+	ctx->field.result = lastnext; 
+  
+extern short	*__fd_eventfield(int fd, __evEmulMask *maskp); 
+extern short	__poll_event(__evEmulMask *maskp); 
+extern void		__fd_clr(int fd, __evEmulMask *maskp); 
+extern void		__fd_set(int fd, __evEmulMask *maskp); 
+
+#undef  FD_ZERO 
+#define FD_ZERO(maskp) 
+  
+#undef  FD_SET 
+#define FD_SET(fd, maskp) \
+	__fd_set(fd, maskp) 
+
+#undef  FD_CLR 
+#define FD_CLR(fd, maskp) \
+	__fd_clr(fd, maskp) 
+
+#undef  FD_ISSET 
+#define FD_ISSET(fd, maskp) \
+	((*__fd_eventfield(fd, maskp) & __poll_event(maskp)) != 0) 
+
+#endif /* USE_POLL */
+
+typedef struct {
+	/* Global. */
+	const evEvent_p	*cur;
+	/* Debugging. */
+	int		debug;
+	FILE		*output;
+	/* Connections. */
+	evConn		*conns;
+	LIST(evAccept)	accepts;
+	/* Files. */
+	evFile		*files, *fdNext;
+#ifndef USE_POLL
+	fd_set		rdLast, rdNext;
+	fd_set		wrLast, wrNext;
+	fd_set		exLast, exNext;
+	fd_set		nonblockBefore;
+	int		fdMax, fdCount, highestFD;
+	evFile		*fdTable[FD_SETSIZE];
+#else
+	struct pollfd	*pollfds;	/* Allocated as needed  */ 
+	evFile		**fdTable;	/* Ditto                */ 
+	int		maxnfds;	/* # elements in above  */ 
+	int		firstfd;	/* First active fd      */ 
+	int		fdMax;		/* Last active fd       */ 
+	int		fdCount;	/* # fd:s with I/O      */ 
+	int		highestFD;	/* max fd allowed by OS */ 
+	__evEmulMask	rdLast, rdNext; 
+	__evEmulMask	wrLast, wrNext; 
+	__evEmulMask	exLast, exNext; 
+	__evEmulMask	nonblockBefore; 
+#endif /* USE_POLL */
+#ifdef EVENTLIB_TIME_CHECKS
+	struct timespec	lastSelectTime;
+	int		lastFdCount;
+#endif
+	/* Streams. */
+	evStream	*streams;
+	evStream	*strDone, *strLast;
+	/* Timers. */
+	struct timespec	lastEventTime;
+	heap_context	timers;
+	/* Waits. */
+	evWaitList	*waitLists;
+	evWaitList	waitDone;
+} evContext_p;
+
+/* eventlib.c */
+#define evPrintf __evPrintf
+void evPrintf(const evContext_p *ctx, int level, const char *fmt, ...)
+     ISC_FORMAT_PRINTF(3, 4);
+
+#ifdef USE_POLL
+extern int evPollfdRealloc(evContext_p *ctx, int pollfd_chunk_size, int fd);
+#endif /* USE_POLL */
+
+/* ev_timers.c */
+#define evCreateTimers __evCreateTimers
+heap_context evCreateTimers(const evContext_p *);
+#define evDestroyTimers __evDestroyTimers
+void evDestroyTimers(const evContext_p *);
+
+/* ev_waits.c */
+#define evFreeWait __evFreeWait
+evWait *evFreeWait(evContext_p *ctx, evWait *old);
+
+/* Global options */
+extern int	__evOptMonoTime;
+
+#endif /*_EVENTLIB_P_H*/
diff --git a/usr/src/lib/libresolv2_joy/common/isc/heap.c b/usr/src/lib/libresolv2_joy/common/isc/heap.c
new file mode 100644
index 0000000000..3d22b6fc71
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/heap.c
@@ -0,0 +1,236 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1997,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*%
+ * Heap implementation of priority queues adapted from the following:
+ *
+ *	_Introduction to Algorithms_, Cormen, Leiserson, and Rivest,
+ *	MIT Press / McGraw Hill, 1990, ISBN 0-262-03141-8, chapter 7.
+ *
+ *	_Algorithms_, Second Edition, Sedgewick, Addison-Wesley, 1988,
+ *	ISBN 0-201-06673-4, chapter 11.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: heap.c,v 1.4 2006/03/09 23:57:56 marka Exp $";
+#endif /* not lint */
+
+#include "port_before.h"
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include "port_after.h"
+
+#include <isc/heap.h>
+
+/*%
+ * Note: to make heap_parent and heap_left easy to compute, the first
+ * element of the heap array is not used; i.e. heap subscripts are 1-based,
+ * not 0-based.
+ */
+#define heap_parent(i) ((i) >> 1)
+#define heap_left(i) ((i) << 1)
+
+#define ARRAY_SIZE_INCREMENT 512
+
+heap_context
+heap_new(heap_higher_priority_func higher_priority, heap_index_func index,
+	 int array_size_increment) {
+	heap_context ctx;
+
+	if (higher_priority == NULL)
+		return (NULL);
+
+	ctx = (heap_context)malloc(sizeof (struct heap_context));
+	if (ctx == NULL)
+		return (NULL);
+
+	ctx->array_size = 0;
+	if (array_size_increment == 0)
+		ctx->array_size_increment = ARRAY_SIZE_INCREMENT;
+	else
+		ctx->array_size_increment = array_size_increment;
+	ctx->heap_size = 0;
+	ctx->heap = NULL;
+	ctx->higher_priority = higher_priority;
+	ctx->index = index;
+	return (ctx);
+}
+
+int
+heap_free(heap_context ctx) {
+	if (ctx == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (ctx->heap != NULL)
+		free(ctx->heap);
+	free(ctx);
+
+	return (0);
+}
+
+static int
+heap_resize(heap_context ctx) {
+	void **new_heap;
+
+	ctx->array_size += ctx->array_size_increment;
+	new_heap = (void **)realloc(ctx->heap,
+				    (ctx->array_size) * (sizeof (void *)));
+	if (new_heap == NULL) {
+		errno = ENOMEM;
+		return (-1);
+	}
+	ctx->heap = new_heap;
+	return (0);
+}
+
+static void
+float_up(heap_context ctx, int i, void *elt) {
+	int p;
+
+	for ( p = heap_parent(i); 
+	      i > 1 && ctx->higher_priority(elt, ctx->heap[p]);
+	      i = p, p = heap_parent(i) ) {
+		ctx->heap[i] = ctx->heap[p];
+		if (ctx->index != NULL)
+			(ctx->index)(ctx->heap[i], i);
+	}
+	ctx->heap[i] = elt;
+	if (ctx->index != NULL)
+		(ctx->index)(ctx->heap[i], i);
+}
+
+static void
+sink_down(heap_context ctx, int i, void *elt) {
+	int j, size, half_size;
+
+	size = ctx->heap_size;
+	half_size = size / 2;
+	while (i <= half_size) {
+		/* find smallest of the (at most) two children */
+		j = heap_left(i);
+		if (j < size && ctx->higher_priority(ctx->heap[j+1],
+						     ctx->heap[j]))
+			j++;
+		if (ctx->higher_priority(elt, ctx->heap[j]))
+			break;
+		ctx->heap[i] = ctx->heap[j];
+		if (ctx->index != NULL)
+			(ctx->index)(ctx->heap[i], i);
+		i = j;
+	}
+	ctx->heap[i] = elt;
+	if (ctx->index != NULL)
+		(ctx->index)(ctx->heap[i], i);
+}
+
+int
+heap_insert(heap_context ctx, void *elt) {
+	int i;
+
+	if (ctx == NULL || elt == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	i = ++ctx->heap_size;
+	if (ctx->heap_size >= ctx->array_size && heap_resize(ctx) < 0)
+		return (-1);
+	
+	float_up(ctx, i, elt);
+
+	return (0);
+}
+
+int
+heap_delete(heap_context ctx, int i) {
+	void *elt;
+	int less;
+
+	if (ctx == NULL || i < 1 || i > ctx->heap_size) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	if (i == ctx->heap_size) {
+		ctx->heap_size--;
+	} else {
+		elt = ctx->heap[ctx->heap_size--];
+		less = ctx->higher_priority(elt, ctx->heap[i]);
+		ctx->heap[i] = elt;
+		if (less)
+			float_up(ctx, i, ctx->heap[i]);
+		else
+			sink_down(ctx, i, ctx->heap[i]);
+	}
+
+	return (0);
+}
+
+int
+heap_increased(heap_context ctx, int i) {
+     	if (ctx == NULL || i < 1 || i > ctx->heap_size) {
+		errno = EINVAL;
+		return (-1);
+	}
+	
+	float_up(ctx, i, ctx->heap[i]);
+
+	return (0);
+}
+
+int
+heap_decreased(heap_context ctx, int i) {
+     	if (ctx == NULL || i < 1 || i > ctx->heap_size) {
+		errno = EINVAL;
+		return (-1);
+	}
+	
+	sink_down(ctx, i, ctx->heap[i]);
+
+	return (0);
+}
+
+void *
+heap_element(heap_context ctx, int i) {
+	if (ctx == NULL || i < 1 || i > ctx->heap_size) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
+	return (ctx->heap[i]);
+}
+
+int
+heap_for_each(heap_context ctx, heap_for_each_func action, void *uap) {
+	int i;
+
+	if (ctx == NULL || action == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	for (i = 1; i <= ctx->heap_size; i++)
+		(action)(ctx->heap[i], uap);
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/hex.c b/usr/src/lib/libresolv2_joy/common/isc/hex.c
new file mode 100644
index 0000000000..e43be4f3b5
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/hex.c
@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2001 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <port_before.h>
+#include <ctype.h>
+#include <stdio.h>
+#include <string.h>
+#include <isc/misc.h>
+#include <port_after.h>
+
+static const char hex[17] = "0123456789abcdef";
+
+int
+isc_gethexstring(unsigned char *buf, size_t len, int count, FILE *fp,
+		 int *multiline)
+{
+	int c, n;
+	unsigned char x;
+	char *s;
+	int result = count;
+	
+	x = 0; /*%< silence compiler */
+	n = 0;
+	while (count > 0) {
+		c = fgetc(fp);
+
+		if ((c == EOF) ||
+		    (c == '\n' && !*multiline) ||
+		    (c == '(' && *multiline) ||
+		    (c == ')' && !*multiline))
+			goto formerr;
+		/* comment */
+		if (c == ';') {
+			do {
+				c = fgetc(fp);
+			} while (c != EOF && c != '\n');
+			if (c == '\n' && *multiline)
+				continue;
+			goto formerr;
+		}
+		/* white space */
+		if (c == ' ' || c == '\t' || c == '\n' || c == '\r')
+			continue;
+		/* multiline */
+		if ('(' == c || c == ')') {
+			*multiline = (c == '(' /*)*/);
+			continue;
+		}
+		if ((s = strchr(hex, tolower(c))) == NULL)
+			goto formerr;
+		x = (x<<4) | (s - hex);
+		if (++n == 2) {
+			if (len > 0U) {
+				*buf++ = x;
+				len--;
+			} else
+				result = -1;
+			count--;
+			n = 0;
+		}
+	}
+	return (result);
+
+ formerr:
+	if (c == '\n')
+		ungetc(c, fp);
+	return (-1);
+}
+
+void
+isc_puthexstring(FILE *fp, const unsigned char *buf, size_t buflen,
+		 size_t len1, size_t len2, const char *sep)
+{
+	size_t i = 0;
+
+	if (len1 < 4U)
+		len1 = 4;
+	if (len2 < 4U)
+		len2 = 4;
+	while (buflen > 0U) {
+		fputc(hex[(buf[0]>>4)&0xf], fp);
+		fputc(hex[buf[0]&0xf], fp);
+		i += 2;
+		buflen--;
+		buf++;
+		if (i >= len1 && sep != NULL) {
+			fputs(sep, fp);
+			i = 0;
+			len1 = len2;
+		}
+	}
+}
+
+void
+isc_tohex(const unsigned char *buf, size_t buflen, char *t) {
+	while (buflen > 0U) {
+		*t++ = hex[(buf[0]>>4)&0xf];
+		*t++ = hex[buf[0]&0xf];
+		buf++;
+		buflen--;
+	}
+	*t = '\0';
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/logging.c b/usr/src/lib/libresolv2_joy/common/isc/logging.c
new file mode 100644
index 0000000000..8c2af2b9e3
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/logging.c
@@ -0,0 +1,716 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1996-1999, 2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: logging.c,v 1.9 2008/11/14 02:36:51 marka Exp $";
+#endif /* not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/stat.h>
+
+#include <fcntl.h>
+#include <limits.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <syslog.h>
+#include <errno.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <isc/assertions.h>
+#include <isc/logging.h>
+#include <isc/memcluster.h>
+#include <isc/misc.h>
+
+#include "port_after.h"
+
+#include "logging_p.h"
+
+static const int syslog_priority[] = { LOG_DEBUG, LOG_INFO, LOG_NOTICE,
+				       LOG_WARNING, LOG_ERR, LOG_CRIT };
+
+static const char *months[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+				"Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
+
+static const char *level_text[] = {
+	"info: ", "notice: ", "warning: ", "error: ", "critical: "
+};
+
+static void
+version_rename(log_channel chan) {
+	unsigned int ver;
+	char old_name[PATH_MAX+1];
+	char new_name[PATH_MAX+1];
+
+	ver = chan->out.file.versions;
+	if (ver < 1)
+		return;
+	if (ver > LOG_MAX_VERSIONS)
+		ver = LOG_MAX_VERSIONS;
+	/*
+	 * Need to have room for '.nn' (XXX assumes LOG_MAX_VERSIONS < 100)
+	 */
+	if (strlen(chan->out.file.name) > (size_t)(PATH_MAX-3))
+		return;
+	for (ver--; ver > 0; ver--) {
+		sprintf(old_name, "%s.%d", chan->out.file.name, ver-1);
+		sprintf(new_name, "%s.%d", chan->out.file.name, ver);
+		(void)isc_movefile(old_name, new_name);
+	}
+	sprintf(new_name, "%s.0", chan->out.file.name);
+	(void)isc_movefile(chan->out.file.name, new_name);
+}
+
+FILE *
+log_open_stream(log_channel chan) {
+	FILE *stream;
+	int fd, flags;
+	struct stat sb;
+	int regular;
+
+	if (chan == NULL || chan->type != log_file) {
+		errno = EINVAL;
+		return (NULL);
+	}
+
+	/*
+	 * Don't open already open streams
+	 */
+	if (chan->out.file.stream != NULL)
+		return (chan->out.file.stream);
+
+	if (stat(chan->out.file.name, &sb) < 0) {
+		if (errno != ENOENT) {
+			syslog(LOG_ERR,
+			       "log_open_stream: stat of %s failed: %s",
+			       chan->out.file.name, strerror(errno));
+			chan->flags |= LOG_CHANNEL_BROKEN;
+			return (NULL);
+		}
+		regular = 1;
+	} else
+		regular = (sb.st_mode & S_IFREG);
+
+	if (chan->out.file.versions) {
+		if (!regular) {
+			syslog(LOG_ERR,
+       "log_open_stream: want versions but %s isn't a regular file",
+			       chan->out.file.name);
+			chan->flags |= LOG_CHANNEL_BROKEN;
+			errno = EINVAL;
+			return (NULL);
+		}
+	}
+
+	flags = O_WRONLY|O_CREAT|O_APPEND;
+
+	if ((chan->flags & LOG_TRUNCATE) != 0) {
+		if (regular) {
+			(void)unlink(chan->out.file.name);
+			flags |= O_EXCL;
+		} else {
+			syslog(LOG_ERR,
+       "log_open_stream: want truncation but %s isn't a regular file",
+			       chan->out.file.name);
+			chan->flags |= LOG_CHANNEL_BROKEN;
+			errno = EINVAL;
+			return (NULL);
+		}
+	}
+
+	fd = open(chan->out.file.name, flags,
+		  S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+	if (fd < 0) {
+		syslog(LOG_ERR, "log_open_stream: open(%s) failed: %s",
+		       chan->out.file.name, strerror(errno));
+		chan->flags |= LOG_CHANNEL_BROKEN;
+		return (NULL);
+	}
+	stream = fdopen(fd, "a");
+	if (stream == NULL) {
+		syslog(LOG_ERR, "log_open_stream: fdopen() failed");
+		chan->flags |= LOG_CHANNEL_BROKEN;
+		return (NULL);
+	}
+	(void) fchown(fd, chan->out.file.owner, chan->out.file.group);
+
+	chan->out.file.stream = stream;
+	return (stream);
+}
+
+int
+log_close_stream(log_channel chan) {
+	FILE *stream;
+
+	if (chan == NULL || chan->type != log_file) {
+		errno = EINVAL;
+		return (0);
+	}
+	stream = chan->out.file.stream;
+	chan->out.file.stream = NULL;
+	if (stream != NULL && fclose(stream) == EOF)
+		return (-1);
+	return (0);
+}
+
+void
+log_close_debug_channels(log_context lc) {
+	log_channel_list lcl;
+	int i;
+
+	for (i = 0; i < lc->num_categories; i++)
+		for (lcl = lc->categories[i]; lcl != NULL; lcl = lcl->next)
+			if (lcl->channel->type == log_file &&
+			    lcl->channel->out.file.stream != NULL &&
+			    lcl->channel->flags & LOG_REQUIRE_DEBUG)
+				(void)log_close_stream(lcl->channel);
+}
+
+FILE *
+log_get_stream(log_channel chan) {
+	if (chan == NULL || chan->type != log_file) {
+		errno = EINVAL;
+		return (NULL);
+	}
+	return (chan->out.file.stream);
+}
+
+char *
+log_get_filename(log_channel chan) {
+	if (chan == NULL || chan->type != log_file) {
+		errno = EINVAL;
+		return (NULL);
+	}
+	return (chan->out.file.name);
+}
+
+int
+log_check_channel(log_context lc, int level, log_channel chan) {
+	int debugging, chan_level;
+
+	REQUIRE(lc != NULL);
+
+	debugging = ((lc->flags & LOG_OPTION_DEBUG) != 0);
+
+	/*
+	 * If not debugging, short circuit debugging messages very early.
+	 */
+	if (level > 0 && !debugging)
+		return (0);
+
+	if ((chan->flags & (LOG_CHANNEL_BROKEN|LOG_CHANNEL_OFF)) != 0)
+		return (0);
+
+	/* Some channels only log when debugging is on. */
+	if ((chan->flags & LOG_REQUIRE_DEBUG) && !debugging)
+		return (0);
+
+	/* Some channels use the global level. */
+	if ((chan->flags & LOG_USE_CONTEXT_LEVEL) != 0) {
+		chan_level = lc->level;
+	} else
+		chan_level = chan->level;
+
+	if (level > chan_level)
+		return (0);
+
+	return (1);
+}
+
+int
+log_check(log_context lc, int category, int level) {
+	log_channel_list lcl;
+	int debugging;
+
+	REQUIRE(lc != NULL);
+
+	debugging = ((lc->flags & LOG_OPTION_DEBUG) != 0);
+
+	/*
+	 * If not debugging, short circuit debugging messages very early.
+	 */
+	if (level > 0 && !debugging)
+		return (0);
+
+	if (category < 0 || category > lc->num_categories)
+		category = 0;		/*%< use default */
+	lcl = lc->categories[category];
+	if (lcl == NULL) {
+		category = 0;
+		lcl = lc->categories[0];
+	}
+
+	for ( /* nothing */; lcl != NULL; lcl = lcl->next) {
+		if (log_check_channel(lc, level, lcl->channel))
+			return (1);
+	}
+	return (0);
+}
+
+void
+log_vwrite(log_context lc, int category, int level, const char *format,
+	   va_list args) {
+	log_channel_list lcl;
+	int pri, debugging, did_vsprintf = 0;
+	int original_category;
+	FILE *stream;
+	log_channel chan;
+	struct timeval tv;
+	struct tm *local_tm;
+#ifdef HAVE_TIME_R
+	struct tm tm_tmp;
+#endif
+	time_t tt;
+	const char *category_name;
+	const char *level_str;
+	char time_buf[256];
+	char level_buf[256];
+
+	REQUIRE(lc != NULL);
+
+	debugging = (lc->flags & LOG_OPTION_DEBUG);
+
+	/*
+	 * If not debugging, short circuit debugging messages very early.
+	 */
+	if (level > 0 && !debugging)
+		return;
+
+	if (category < 0 || category > lc->num_categories)
+		category = 0;		/*%< use default */
+	original_category = category;
+	lcl = lc->categories[category];
+	if (lcl == NULL) {
+		category = 0;
+		lcl = lc->categories[0];
+	}
+
+	/*
+	 * Get the current time and format it.
+	 */
+	time_buf[0]='\0';
+	if (gettimeofday(&tv, NULL) < 0) {
+		syslog(LOG_INFO, "gettimeofday failed in log_vwrite()");
+	} else {
+		tt = tv.tv_sec;
+#ifdef HAVE_TIME_R
+		local_tm = localtime_r(&tt, &tm_tmp);
+#else
+		local_tm = localtime(&tt);
+#endif
+		if (local_tm != NULL) {
+			sprintf(time_buf, "%02d-%s-%4d %02d:%02d:%02d.%03ld ",
+				local_tm->tm_mday, months[local_tm->tm_mon],
+				local_tm->tm_year+1900, local_tm->tm_hour,
+				local_tm->tm_min, local_tm->tm_sec,
+				(long)tv.tv_usec/1000);
+		}
+	}
+
+	/*
+	 * Make a string representation of the current category and level
+	 */
+
+	if (lc->category_names != NULL &&
+	    lc->category_names[original_category] != NULL)
+		category_name = lc->category_names[original_category];
+	else
+		category_name = "";
+
+	if (level >= log_critical) {
+		if (level >= 0) {
+			sprintf(level_buf, "debug %d: ", level);
+			level_str = level_buf;
+		} else
+			level_str = level_text[-level-1];
+	} else {
+		sprintf(level_buf, "level %d: ", level);
+		level_str = level_buf;
+	}
+
+	/*
+	 * Write the message to channels.
+	 */
+	for ( /* nothing */; lcl != NULL; lcl = lcl->next) {
+		chan = lcl->channel;
+
+		if (!log_check_channel(lc, level, chan))
+			continue;
+
+		if (!did_vsprintf) {
+			(void)vsprintf(lc->buffer, format, args);
+			if (strlen(lc->buffer) > (size_t)LOG_BUFFER_SIZE) {
+				syslog(LOG_CRIT,
+				       "memory overrun in log_vwrite()");
+				exit(1);
+			}
+			did_vsprintf = 1;
+		}
+
+		switch (chan->type) {
+		case log_syslog:
+			if (level >= log_critical)
+				pri = (level >= 0) ? 0 : -level;
+			else
+				pri = -log_critical;
+			syslog(chan->out.facility|syslog_priority[pri],
+			       "%s%s%s%s",
+			       (chan->flags & LOG_TIMESTAMP) ?	time_buf : "",
+			       (chan->flags & LOG_PRINT_CATEGORY) ?
+			       category_name : "",
+			       (chan->flags & LOG_PRINT_LEVEL) ?
+			       level_str : "",
+			       lc->buffer);
+			break;
+		case log_file:
+			stream = chan->out.file.stream;
+			if (stream == NULL) {
+				stream = log_open_stream(chan);
+				if (stream == NULL)
+					break;
+			}
+			if (chan->out.file.max_size != ULONG_MAX) {
+				long pos;
+
+				pos = ftell(stream);
+				if (pos >= 0 &&
+				    (unsigned long)pos >
+				    chan->out.file.max_size) {
+					/*
+					 * try to roll over the log files,
+					 * ignoring all all return codes
+					 * except the open (we don't want
+					 * to write any more anyway)
+					 */
+					log_close_stream(chan);
+					version_rename(chan);
+					stream = log_open_stream(chan);
+					if (stream == NULL)
+						break;
+				}
+			}
+			fprintf(stream, "%s%s%s%s\n",
+				(chan->flags & LOG_TIMESTAMP) ?	time_buf : "",
+				(chan->flags & LOG_PRINT_CATEGORY) ?
+				category_name : "",
+				(chan->flags & LOG_PRINT_LEVEL) ?
+				level_str : "",
+				lc->buffer);
+			fflush(stream);
+			break;
+		case log_null:
+			break;
+		default:
+			syslog(LOG_ERR,
+			       "unknown channel type in log_vwrite()");
+		}
+	}
+}
+
+void
+log_write(log_context lc, int category, int level, const char *format, ...) {
+	va_list args;
+
+	va_start(args, format);
+	log_vwrite(lc, category, level, format, args);
+	va_end(args);
+}
+
+/*%
+ * Functions to create, set, or destroy contexts
+ */
+
+int
+log_new_context(int num_categories, char **category_names, log_context *lc) {
+	log_context nlc;
+
+	nlc = memget(sizeof (struct log_context));
+	if (nlc == NULL) {
+		errno = ENOMEM;
+		return (-1);
+	}
+	nlc->num_categories = num_categories;
+	nlc->category_names = category_names;
+	nlc->categories = memget(num_categories * sizeof (log_channel_list));
+	if (nlc->categories == NULL) {
+		memput(nlc, sizeof (struct log_context));
+		errno = ENOMEM;
+		return (-1);
+	}
+	memset(nlc->categories, '\0',
+	       num_categories * sizeof (log_channel_list));
+	nlc->flags = 0U;
+	nlc->level = 0;
+	*lc = nlc;
+	return (0);
+}
+
+void
+log_free_context(log_context lc) {
+	log_channel_list lcl, lcl_next;
+	log_channel chan;
+	int i;
+
+	REQUIRE(lc != NULL);
+
+	for (i = 0; i < lc->num_categories; i++)
+		for (lcl = lc->categories[i]; lcl != NULL; lcl = lcl_next) {
+			lcl_next = lcl->next;
+			chan = lcl->channel;
+			(void)log_free_channel(chan);
+			memput(lcl, sizeof (struct log_channel_list));
+		}
+	memput(lc->categories,
+	       lc->num_categories * sizeof (log_channel_list));
+	memput(lc, sizeof (struct log_context));
+}
+
+int
+log_add_channel(log_context lc, int category, log_channel chan) {
+	log_channel_list lcl;
+
+	if (lc == NULL || category < 0 || category >= lc->num_categories) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	lcl = memget(sizeof (struct log_channel_list));
+	if (lcl == NULL) {
+		errno = ENOMEM;
+		return(-1);
+	}
+	lcl->channel = chan;
+	lcl->next = lc->categories[category];
+	lc->categories[category] = lcl;
+	chan->references++;
+	return (0);
+}
+
+int
+log_remove_channel(log_context lc, int category, log_channel chan) {
+	log_channel_list lcl, prev_lcl, next_lcl;
+	int found = 0;
+
+	if (lc == NULL || category < 0 || category >= lc->num_categories) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	for (prev_lcl = NULL, lcl = lc->categories[category];
+	     lcl != NULL;
+	     lcl = next_lcl) {
+		next_lcl = lcl->next;
+		if (lcl->channel == chan) {
+			log_free_channel(chan);
+			if (prev_lcl != NULL)
+				prev_lcl->next = next_lcl;
+			else
+				lc->categories[category] = next_lcl;
+			memput(lcl, sizeof (struct log_channel_list));
+			/*
+			 * We just set found instead of returning because
+			 * the channel might be on the list more than once.
+			 */
+			found = 1;
+		} else
+			prev_lcl = lcl;
+	}
+	if (!found) {
+		errno = ENOENT;
+		return (-1);
+	}
+	return (0);
+}
+
+int
+log_option(log_context lc, int option, int value) {
+	if (lc == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+	switch (option) {
+	case LOG_OPTION_DEBUG:
+		if (value)
+			lc->flags |= option;
+		else
+			lc->flags &= ~option;
+		break;
+	case LOG_OPTION_LEVEL:
+		lc->level = value;
+		break;
+	default:
+		errno = EINVAL;
+		return (-1);
+	}
+	return (0);
+}
+
+int
+log_category_is_active(log_context lc, int category) {
+	if (lc == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+	if (category >= 0 && category < lc->num_categories &&
+	    lc->categories[category] != NULL)
+		return (1);
+	return (0);
+}
+
+log_channel
+log_new_syslog_channel(unsigned int flags, int level, int facility) {
+	log_channel chan;
+
+	chan = memget(sizeof (struct log_channel));
+	if (chan == NULL) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	chan->type = log_syslog;
+	chan->flags = flags;
+	chan->level = level;
+	chan->out.facility = facility;
+	chan->references = 0;
+	return (chan);
+}
+
+log_channel
+log_new_file_channel(unsigned int flags, int level,
+		     const char *name, FILE *stream, unsigned int versions,
+		     unsigned long max_size) {
+	log_channel chan;
+
+	chan = memget(sizeof (struct log_channel));
+	if (chan == NULL) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	chan->type = log_file;
+	chan->flags = flags;
+	chan->level = level;
+	if (name != NULL) {
+		size_t len;
+
+		len = strlen(name);
+		/*
+		 * Quantize length to a multiple of 256.  There's space for the
+		 * NUL, since if len is a multiple of 256, the size chosen will
+		 * be the next multiple.
+		 */
+		chan->out.file.name_size = ((len / 256) + 1) * 256;
+		chan->out.file.name = memget(chan->out.file.name_size);
+		if (chan->out.file.name == NULL) {
+			memput(chan, sizeof (struct log_channel));
+			errno = ENOMEM;
+			return (NULL);
+		}
+		/* This is safe. */
+		strcpy(chan->out.file.name, name);
+	} else {
+		chan->out.file.name_size = 0;
+		chan->out.file.name = NULL;
+	}
+	chan->out.file.stream = stream;
+	chan->out.file.versions = versions;
+	chan->out.file.max_size = max_size;
+	chan->out.file.owner = getuid();
+	chan->out.file.group = getgid();
+	chan->references = 0;
+	return (chan);
+}
+
+int
+log_set_file_owner(log_channel chan, uid_t owner, gid_t group) {
+	if (chan->type != log_file) {
+		errno = EBADF;
+		return (-1);
+	}
+	chan->out.file.owner = owner;
+	chan->out.file.group = group;
+	return (0);
+}
+
+log_channel
+log_new_null_channel() {
+	log_channel chan;
+
+	chan = memget(sizeof (struct log_channel));
+	if (chan == NULL) {
+		errno = ENOMEM;
+		return (NULL);
+	}
+	chan->type = log_null;
+	chan->flags = LOG_CHANNEL_OFF;
+	chan->level = log_info;
+	chan->references = 0;
+	return (chan);
+}
+
+int
+log_inc_references(log_channel chan) {
+	if (chan == NULL) {
+		errno = EINVAL;
+		return (-1);
+	}
+	chan->references++;
+	return (0);
+}
+
+int
+log_dec_references(log_channel chan) {
+	if (chan == NULL || chan->references <= 0) {
+		errno = EINVAL;
+		return (-1);
+	}
+	chan->references--;
+	return (0);
+}
+
+log_channel_type
+log_get_channel_type(log_channel chan) {
+	REQUIRE(chan != NULL);
+
+	return (chan->type);
+}
+
+int
+log_free_channel(log_channel chan) {
+	if (chan == NULL || chan->references <= 0) {
+		errno = EINVAL;
+		return (-1);
+	}
+	chan->references--;
+	if (chan->references == 0) {
+		if (chan->type == log_file) {
+			if ((chan->flags & LOG_CLOSE_STREAM) &&
+			    chan->out.file.stream != NULL)
+				(void)fclose(chan->out.file.stream);
+			if (chan->out.file.name != NULL)
+				memput(chan->out.file.name,
+				       chan->out.file.name_size);
+		}
+		memput(chan, sizeof (struct log_channel));
+	}
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/logging_p.h b/usr/src/lib/libresolv2_joy/common/isc/logging_p.h
new file mode 100644
index 0000000000..5e6314f190
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/logging_p.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef LOGGING_P_H
+#define LOGGING_P_H
+
+typedef struct log_file_desc {
+	char *name;
+	size_t name_size;
+	FILE *stream;
+	unsigned int versions;
+	unsigned long max_size;
+	uid_t owner;
+	gid_t group;
+} log_file_desc;
+
+typedef union log_output {
+	int facility;
+	log_file_desc file;
+} log_output;
+
+struct log_channel {
+	int level;			/*%< don't log messages > level */
+	log_channel_type type;
+	log_output out;
+	unsigned int flags;
+	int references;
+};
+
+typedef struct log_channel_list {
+	log_channel channel;
+	struct log_channel_list *next;
+} *log_channel_list;
+
+#define LOG_BUFFER_SIZE 20480
+
+struct log_context {
+	int num_categories;
+	char **category_names;
+	log_channel_list *categories;
+	int flags;
+	int level;
+	char buffer[LOG_BUFFER_SIZE];
+};
+
+#endif /* !LOGGING_P_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/memcluster.c b/usr/src/lib/libresolv2_joy/common/isc/memcluster.c
new file mode 100644
index 0000000000..515793fd6a
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/memcluster.c
@@ -0,0 +1,588 @@
+/*
+ * Copyright (c) 2005 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1997,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+/* When this symbol is defined allocations via memget are made slightly 
+   bigger and some debugging info stuck before and after the region given 
+   back to the caller. */
+/* #define DEBUGGING_MEMCLUSTER */
+#define MEMCLUSTER_ATEND
+
+
+#if !defined(LINT) && !defined(CODECENTER)
+static const char rcsid[] = "$Id: memcluster.c,v 1.11 2006/08/30 23:34:38 marka Exp $";
+#endif /* not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include <isc/memcluster.h>
+#include <isc/assertions.h>
+
+#include "port_after.h"
+
+#ifdef MEMCLUSTER_RECORD
+#ifndef DEBUGGING_MEMCLUSTER
+#define DEBUGGING_MEMCLUSTER
+#endif
+#endif
+
+#define DEF_MAX_SIZE		1100
+#define DEF_MEM_TARGET		4096
+
+typedef u_int32_t fence_t;
+
+typedef struct {
+	void *			next;
+#if defined(DEBUGGING_MEMCLUSTER)
+#if defined(MEMCLUSTER_RECORD)
+	const char *		file;
+	int			line;
+#endif
+	size_t			size;
+	fence_t			fencepost;
+#endif
+} memcluster_element;
+
+#define SMALL_SIZE_LIMIT sizeof(memcluster_element)
+#define P_SIZE sizeof(void *)
+#define FRONT_FENCEPOST 0xfebafeba
+#define BACK_FENCEPOST 0xabefabef
+#define FENCEPOST_SIZE 4
+
+#ifndef MEMCLUSTER_LITTLE_MALLOC
+#define MEMCLUSTER_BIG_MALLOC 1
+#define NUM_BASIC_BLOCKS 64
+#endif
+
+struct stats {
+	u_long			gets;
+	u_long			totalgets;
+	u_long			blocks;
+	u_long			freefrags;
+};
+
+#ifdef DO_PTHREADS
+#include <pthread.h>
+static pthread_mutex_t	memlock = PTHREAD_MUTEX_INITIALIZER;
+#define MEMLOCK		(void)pthread_mutex_lock(&memlock)
+#define MEMUNLOCK	(void)pthread_mutex_unlock(&memlock)
+#else
+/*
+ * Catch bad lock usage in non threaded build.
+ */
+static unsigned int	memlock = 0;
+#define MEMLOCK		do { INSIST(memlock == 0); memlock = 1; } while (0)
+#define MEMUNLOCK	do { INSIST(memlock == 1); memlock = 0; } while (0)
+#endif  /* DO_PTHEADS */
+
+/* Private data. */
+
+static size_t			max_size;
+static size_t			mem_target;
+#ifndef MEMCLUSTER_BIG_MALLOC
+static size_t			mem_target_half;
+static size_t			mem_target_fudge;
+#endif
+static memcluster_element **	freelists;
+#ifdef MEMCLUSTER_RECORD
+static memcluster_element **	activelists;
+#endif
+#ifdef MEMCLUSTER_BIG_MALLOC
+static memcluster_element *	basic_blocks;
+#endif
+static struct stats *		stats;
+
+/* Forward. */
+
+static size_t			quantize(size_t);
+#if defined(DEBUGGING_MEMCLUSTER)
+static void			check(unsigned char *, int, size_t);
+#endif
+
+/* Public. */
+
+int
+meminit(size_t init_max_size, size_t target_size) {
+
+#if defined(DEBUGGING_MEMCLUSTER)
+	INSIST(sizeof(fence_t) == FENCEPOST_SIZE);
+#endif
+	if (freelists != NULL) {
+		errno = EEXIST;
+		return (-1);
+	}
+	if (init_max_size == 0U)
+		max_size = DEF_MAX_SIZE;
+	else
+		max_size = init_max_size;
+	if (target_size == 0U)
+		mem_target = DEF_MEM_TARGET;
+	else
+		mem_target = target_size;
+#ifndef MEMCLUSTER_BIG_MALLOC
+	mem_target_half = mem_target / 2;
+	mem_target_fudge = mem_target + mem_target / 4;
+#endif
+	freelists = malloc(max_size * sizeof (memcluster_element *));
+	stats = malloc((max_size+1) * sizeof (struct stats));
+	if (freelists == NULL || stats == NULL) {
+		errno = ENOMEM;
+		return (-1);
+	}
+	memset(freelists, 0,
+	       max_size * sizeof (memcluster_element *));
+	memset(stats, 0, (max_size + 1) * sizeof (struct stats));
+#ifdef MEMCLUSTER_RECORD
+	activelists = malloc((max_size + 1) * sizeof (memcluster_element *));
+	if (activelists == NULL) {
+		errno = ENOMEM;
+		return (-1);
+	}
+	memset(activelists, 0,
+	       (max_size + 1) * sizeof (memcluster_element *));
+#endif
+#ifdef MEMCLUSTER_BIG_MALLOC
+	basic_blocks = NULL;
+#endif
+	return (0);
+}
+
+void *
+__memget(size_t size) {
+	return (__memget_record(size, NULL, 0));
+}
+
+void *
+__memget_record(size_t size, const char *file, int line) {
+	size_t new_size = quantize(size);
+#if defined(DEBUGGING_MEMCLUSTER)
+	memcluster_element *e;
+	char *p;
+	fence_t fp = BACK_FENCEPOST;
+#endif
+	void *ret;
+
+	MEMLOCK;
+
+#if !defined(MEMCLUSTER_RECORD)
+	UNUSED(file);
+	UNUSED(line);
+#endif
+	if (freelists == NULL) {
+		if (meminit(0, 0) == -1) {
+			MEMUNLOCK;
+			return (NULL);
+		}
+	}
+	if (size == 0U) {
+		MEMUNLOCK;
+		errno = EINVAL;
+		return (NULL);
+	}
+	if (size >= max_size || new_size >= max_size) {
+		/* memget() was called on something beyond our upper limit. */
+		stats[max_size].gets++;
+		stats[max_size].totalgets++;
+#if defined(DEBUGGING_MEMCLUSTER)
+		e = malloc(new_size);
+		if (e == NULL) {
+			MEMUNLOCK;
+			errno = ENOMEM;
+			return (NULL);
+		}
+		e->next = NULL;
+		e->size = size;
+#ifdef MEMCLUSTER_RECORD
+		e->file = file;
+		e->line = line;
+		e->next = activelists[max_size];
+		activelists[max_size] = e;
+#endif
+		MEMUNLOCK;
+		e->fencepost = FRONT_FENCEPOST;
+		p = (char *)e + sizeof *e + size;
+		memcpy(p, &fp, sizeof fp);
+		return ((char *)e + sizeof *e);
+#else
+		MEMUNLOCK;
+		return (malloc(size));
+#endif
+	}
+
+	/* 
+	 * If there are no blocks in the free list for this size, get a chunk
+	 * of memory and then break it up into "new_size"-sized blocks, adding
+	 * them to the free list.
+	 */
+	if (freelists[new_size] == NULL) {
+		int i, frags;
+		size_t total_size;
+		void *new;
+		char *curr, *next;
+
+#ifdef MEMCLUSTER_BIG_MALLOC
+		if (basic_blocks == NULL) {
+			new = malloc(NUM_BASIC_BLOCKS * mem_target);
+			if (new == NULL) {
+				MEMUNLOCK;
+				errno = ENOMEM;
+				return (NULL);
+			}
+			curr = new;
+			next = curr + mem_target;
+			for (i = 0; i < (NUM_BASIC_BLOCKS - 1); i++) {
+				((memcluster_element *)curr)->next = next;
+				curr = next;
+				next += mem_target;
+			}
+			/*
+			 * curr is now pointing at the last block in the
+			 * array.
+			 */
+			((memcluster_element *)curr)->next = NULL;
+			basic_blocks = new;
+		}
+		total_size = mem_target;
+		new = basic_blocks;
+		basic_blocks = basic_blocks->next;
+#else
+		if (new_size > mem_target_half)
+			total_size = mem_target_fudge;
+		else
+			total_size = mem_target;
+		new = malloc(total_size);
+		if (new == NULL) {
+			MEMUNLOCK;
+			errno = ENOMEM;
+			return (NULL);
+		}
+#endif
+		frags = total_size / new_size;
+		stats[new_size].blocks++;
+		stats[new_size].freefrags += frags;
+		/* Set up a linked-list of blocks of size "new_size". */
+		curr = new;
+		next = curr + new_size;
+		for (i = 0; i < (frags - 1); i++) {
+#if defined (DEBUGGING_MEMCLUSTER)
+			memset(curr, 0xa5, new_size);
+#endif
+			((memcluster_element *)curr)->next = next;
+			curr = next;
+			next += new_size;
+		}
+		/* curr is now pointing at the last block in the array. */
+#if defined (DEBUGGING_MEMCLUSTER)
+		memset(curr, 0xa5, new_size);
+#endif
+		((memcluster_element *)curr)->next = freelists[new_size];
+		freelists[new_size] = new;
+	}
+
+	/* The free list uses the "rounded-up" size "new_size". */
+#if defined (DEBUGGING_MEMCLUSTER)
+	e = freelists[new_size];
+	ret = (char *)e + sizeof *e;
+	/*
+	 * Check to see if this buffer has been written to while on free list.
+	 */
+	check(ret, 0xa5, new_size - sizeof *e);
+	/*
+	 * Mark memory we are returning.
+	 */
+	memset(ret, 0xe5, size);
+#else
+	ret = freelists[new_size];
+#endif
+	freelists[new_size] = freelists[new_size]->next;
+#if defined(DEBUGGING_MEMCLUSTER)
+	e->next = NULL;
+	e->size = size;
+	e->fencepost = FRONT_FENCEPOST;
+#ifdef MEMCLUSTER_RECORD
+	e->file = file;
+	e->line = line;
+	e->next = activelists[size];
+	activelists[size] = e;
+#endif
+	p = (char *)e + sizeof *e + size;
+	memcpy(p, &fp, sizeof fp);
+#endif
+
+	/* 
+	 * The stats[] uses the _actual_ "size" requested by the
+	 * caller, with the caveat (in the code above) that "size" >= the
+	 * max. size (max_size) ends up getting recorded as a call to
+	 * max_size.
+	 */
+	stats[size].gets++;
+	stats[size].totalgets++;
+	stats[new_size].freefrags--;
+	MEMUNLOCK;
+#if defined(DEBUGGING_MEMCLUSTER)
+	return ((char *)e + sizeof *e);
+#else
+	return (ret);
+#endif
+}
+
+/*%
+ * This is a call from an external caller, 
+ * so we want to count this as a user "put". 
+ */
+void
+__memput(void *mem, size_t size) {
+	__memput_record(mem, size, NULL, 0);
+}
+
+void
+__memput_record(void *mem, size_t size, const char *file, int line) {
+	size_t new_size = quantize(size);
+#if defined (DEBUGGING_MEMCLUSTER)
+	memcluster_element *e;
+	memcluster_element *el;
+#ifdef MEMCLUSTER_RECORD
+	memcluster_element *prev;
+#endif
+	fence_t fp;
+	char *p;
+#endif
+
+	MEMLOCK;
+
+#if !defined (MEMCLUSTER_RECORD)
+	UNUSED(file);
+	UNUSED(line);
+#endif
+
+	REQUIRE(freelists != NULL);
+
+	if (size == 0U) {
+		MEMUNLOCK;
+		errno = EINVAL;
+		return;
+	}
+
+#if defined (DEBUGGING_MEMCLUSTER)
+	e = (memcluster_element *) ((char *)mem - sizeof *e);
+	INSIST(e->fencepost == FRONT_FENCEPOST);
+	INSIST(e->size == size);
+	p = (char *)e + sizeof *e + size;
+	memcpy(&fp, p, sizeof fp);
+	INSIST(fp == BACK_FENCEPOST);
+	INSIST(((u_long)mem % 4) == 0);
+#ifdef MEMCLUSTER_RECORD
+	prev = NULL;
+	if (size == max_size || new_size >= max_size)
+		el = activelists[max_size];
+	else
+		el = activelists[size];
+	while (el != NULL && el != e) {
+		prev = el;
+		el = el->next;
+	}
+	INSIST(el != NULL);	/*%< double free */
+	if (prev == NULL) {
+		if (size == max_size || new_size >= max_size)
+			activelists[max_size] = el->next;
+		else
+			activelists[size] = el->next;
+	} else
+		prev->next = el->next;
+#endif
+#endif
+
+	if (size == max_size || new_size >= max_size) {
+		/* memput() called on something beyond our upper limit */
+#if defined(DEBUGGING_MEMCLUSTER)
+		free(e);
+#else
+		free(mem);
+#endif
+
+		INSIST(stats[max_size].gets != 0U);
+		stats[max_size].gets--;
+		MEMUNLOCK;
+		return;
+	}
+
+	/* The free list uses the "rounded-up" size "new_size": */
+#if defined(DEBUGGING_MEMCLUSTER)
+	memset(mem, 0xa5, new_size - sizeof *e); /*%< catch write after free */
+	e->size = 0;	/*%< catch double memput() */
+#ifdef MEMCLUSTER_RECORD
+	e->file = file;
+	e->line = line;
+#endif
+#ifdef MEMCLUSTER_ATEND
+	e->next = NULL;
+	el = freelists[new_size];
+	while (el != NULL && el->next != NULL)
+		el = el->next;
+	if (el)
+		el->next = e;
+	else
+		freelists[new_size] = e;
+#else
+	e->next = freelists[new_size];
+	freelists[new_size] = (void *)e;
+#endif
+#else
+	((memcluster_element *)mem)->next = freelists[new_size];
+	freelists[new_size] = (memcluster_element *)mem;
+#endif
+
+	/* 
+	 * The stats[] uses the _actual_ "size" requested by the
+	 * caller, with the caveat (in the code above) that "size" >= the
+	 * max. size (max_size) ends up getting recorded as a call to
+	 * max_size.
+	 */
+	INSIST(stats[size].gets != 0U);
+	stats[size].gets--;
+	stats[new_size].freefrags++;
+	MEMUNLOCK;
+}
+
+void *
+__memget_debug(size_t size, const char *file, int line) {
+	void *ptr;
+	ptr = __memget_record(size, file, line);
+	fprintf(stderr, "%s:%d: memget(%lu) -> %p\n", file, line,
+		(u_long)size, ptr);
+	return (ptr);
+}
+
+void
+__memput_debug(void *ptr, size_t size, const char *file, int line) {
+	fprintf(stderr, "%s:%d: memput(%p, %lu)\n", file, line, ptr,
+		(u_long)size);
+	__memput_record(ptr, size, file, line);
+}
+
+/*%
+ * Print the stats[] on the stream "out" with suitable formatting.
+ */
+void
+memstats(FILE *out) {
+	size_t i;
+#ifdef MEMCLUSTER_RECORD
+	memcluster_element *e;
+#endif
+
+	MEMLOCK;
+
+	if (freelists == NULL) {
+		MEMUNLOCK;
+		return;
+	}
+	for (i = 1; i <= max_size; i++) {
+		const struct stats *s = &stats[i];
+
+		if (s->totalgets == 0U && s->gets == 0U)
+			continue;
+		fprintf(out, "%s%5lu: %11lu gets, %11lu rem",
+			(i == max_size) ? ">=" : "  ",
+			(unsigned long)i, s->totalgets, s->gets);
+		if (s->blocks != 0U)
+			fprintf(out, " (%lu bl, %lu ff)",
+				s->blocks, s->freefrags);
+		fputc('\n', out);
+	}
+#ifdef MEMCLUSTER_RECORD
+	fprintf(out, "Active Memory:\n");
+	for (i = 1; i <= max_size; i++) {
+		if ((e = activelists[i]) != NULL)
+			while (e != NULL) {
+				fprintf(out, "%s:%d %p:%lu\n",
+				        e->file != NULL ? e->file :
+						"<UNKNOWN>", e->line,
+					(char *)e + sizeof *e,
+					(u_long)e->size);
+				e = e->next;
+			}
+	}
+#endif
+	MEMUNLOCK;
+}
+
+int
+memactive(void) {
+	size_t i;
+
+	if (stats == NULL)
+		return (0);
+	for (i = 1; i <= max_size; i++)
+		if (stats[i].gets != 0U)
+			return (1);
+	return (0);
+}
+
+/* Private. */
+
+/*%
+ * Round up size to a multiple of sizeof(void *).  This guarantees that a
+ * block is at least sizeof void *, and that we won't violate alignment
+ * restrictions, both of which are needed to make lists of blocks.
+ */
+static size_t
+quantize(size_t size) {
+	int remainder;
+	/*
+	 * If there is no remainder for the integer division of 
+	 *
+	 *	(rightsize/P_SIZE)
+	 *
+	 * then we already have a good size; if not, then we need
+	 * to round up the result in order to get a size big
+	 * enough to satisfy the request _and_ aligned on P_SIZE boundaries.
+	 */
+	remainder = size % P_SIZE;
+	if (remainder != 0)
+		size += P_SIZE - remainder;
+#if defined(DEBUGGING_MEMCLUSTER)
+	return (size + SMALL_SIZE_LIMIT + sizeof (int));
+#else
+	return (size);
+#endif
+}
+
+#if defined(DEBUGGING_MEMCLUSTER)
+static void
+check(unsigned char *a, int value, size_t len) {
+	size_t i;
+	for (i = 0; i < len; i++)
+		INSIST(a[i] == value);
+}
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/movefile.c b/usr/src/lib/libresolv2_joy/common/isc/movefile.c
new file mode 100644
index 0000000000..0ffc7047e2
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/movefile.c
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2000 by Internet Software Consortium, Inc.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#include <port_before.h>
+#include <stdio.h>
+#include <isc/misc.h>
+#include <port_after.h>
+#ifndef HAVE_MOVEFILE
+/*
+ * rename() is lame (can't overwrite an existing file) on some systems.
+ * use movefile() instead, and let lame OS ports do what they need to.
+ */
+
+int
+isc_movefile(const char *oldname, const char *newname) {
+	return (rename(oldname, newname));
+}
+#else
+	static int os_port_has_isc_movefile = 1;
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/isc/tree.c b/usr/src/lib/libresolv2_joy/common/isc/tree.c
new file mode 100644
index 0000000000..8ba675fbe8
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/isc/tree.c
@@ -0,0 +1,534 @@
+#ifndef LINT
+static const char rcsid[] = "$Id: tree.c,v 1.4 2005/04/27 04:56:39 sra Exp $";
+#endif
+
+/*%
+ * tree - balanced binary tree library
+ *
+ * vix 05apr94 [removed vixie.h dependencies; cleaned up formatting, names]
+ * vix 22jan93 [revisited; uses RCS, ANSI, POSIX; has bug fixes]
+ * vix 23jun86 [added delete uar to add for replaced nodes]
+ * vix 20jun86 [added tree_delete per wirth a+ds (mod2 v.) p. 224]
+ * vix 06feb86 [added tree_mung()]
+ * vix 02feb86 [added tree balancing from wirth "a+ds=p" p. 220-221]
+ * vix 14dec85 [written]
+ */
+
+/*%
+ * This program text was created by Paul Vixie using examples from the book:
+ * "Algorithms & Data Structures," Niklaus Wirth, Prentice-Hall, 1986, ISBN
+ * 0-13-022005-1.  Any errors in the conversion from Modula-2 to C are Paul
+ * Vixie's.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*#define		DEBUG	"tree"*/
+
+#include "port_before.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "port_after.h"
+
+#include <isc/memcluster.h>
+#include <isc/tree.h>
+
+#ifdef DEBUG
+static int	debugDepth = 0;
+static char	*debugFuncs[256];
+# define ENTER(proc) { \
+			debugFuncs[debugDepth] = proc; \
+			fprintf(stderr, "ENTER(%d:%s.%s)\n", \
+				debugDepth, DEBUG, \
+				debugFuncs[debugDepth]); \
+			debugDepth++; \
+		}
+# define RET(value) { \
+			debugDepth--; \
+			fprintf(stderr, "RET(%d:%s.%s)\n", \
+				debugDepth, DEBUG, \
+				debugFuncs[debugDepth]); \
+			return (value); \
+		}
+# define RETV { \
+			debugDepth--; \
+			fprintf(stderr, "RETV(%d:%s.%s)\n", \
+				debugDepth, DEBUG, \
+				debugFuncs[debugDepth]); \
+			return; \
+		}
+# define MSG(msg)	fprintf(stderr, "MSG(%s)\n", msg);
+#else
+# define ENTER(proc)	;
+# define RET(value)	return (value);
+# define RETV		return;
+# define MSG(msg)	;
+#endif
+
+#ifndef TRUE
+# define TRUE		1
+# define FALSE		0
+#endif
+
+static tree *	sprout(tree **, tree_t, int *, int (*)(), void (*)());
+static int	delete(tree **, int (*)(), tree_t, void (*)(), int *, int *);
+static void	del(tree **, int *, tree **, void (*)(), int *);
+static void	bal_L(tree **, int *);
+static void	bal_R(tree **, int *);
+
+void
+tree_init(tree **ppr_tree) {
+	ENTER("tree_init")
+	*ppr_tree = NULL;
+	RETV
+}
+	
+tree_t
+tree_srch(tree **ppr_tree, int (*pfi_compare)(tree_t, tree_t), tree_t	p_user) {
+	ENTER("tree_srch")
+
+	if (*ppr_tree) {
+		int i_comp = (*pfi_compare)(p_user, (**ppr_tree).data);
+
+		if (i_comp > 0)
+			RET(tree_srch(&(**ppr_tree).right,
+				      pfi_compare,
+				      p_user))
+
+		if (i_comp < 0)
+			RET(tree_srch(&(**ppr_tree).left,
+				      pfi_compare,
+				      p_user))
+
+		/* not higher, not lower... this must be the one.
+		 */
+		RET((**ppr_tree).data)
+	}
+
+	/* grounded. NOT found.
+	 */
+	RET(NULL)
+}
+
+tree_t
+tree_add(tree **ppr_tree, int (*pfi_compare)(tree_t, tree_t),
+	 tree_t p_user, void (*pfv_uar)())
+{
+	int i_balance = FALSE;
+
+	ENTER("tree_add")
+	if (!sprout(ppr_tree, p_user, &i_balance, pfi_compare, pfv_uar))
+		RET(NULL)
+	RET(p_user)
+}
+
+int
+tree_delete(tree **ppr_p, int (*pfi_compare)(tree_t, tree_t),
+	    tree_t p_user, void	(*pfv_uar)())
+{
+	int i_balance = FALSE, i_uar_called = FALSE;
+
+	ENTER("tree_delete");
+	RET(delete(ppr_p, pfi_compare, p_user, pfv_uar,
+		   &i_balance, &i_uar_called))
+}
+
+int
+tree_trav(tree **ppr_tree, int (*pfi_uar)(tree_t)) {
+	ENTER("tree_trav")
+
+	if (!*ppr_tree)
+		RET(TRUE)
+
+	if (!tree_trav(&(**ppr_tree).left, pfi_uar))
+		RET(FALSE)
+	if (!(*pfi_uar)((**ppr_tree).data))
+		RET(FALSE)
+	if (!tree_trav(&(**ppr_tree).right, pfi_uar))
+		RET(FALSE)
+	RET(TRUE)
+}
+
+void
+tree_mung(tree **ppr_tree, void	(*pfv_uar)(tree_t)) {
+	ENTER("tree_mung")
+	if (*ppr_tree) {
+		tree_mung(&(**ppr_tree).left, pfv_uar);
+		tree_mung(&(**ppr_tree).right, pfv_uar);
+		if (pfv_uar)
+			(*pfv_uar)((**ppr_tree).data);
+		memput(*ppr_tree, sizeof(tree));
+		*ppr_tree = NULL;
+	}
+	RETV
+}
+
+static tree *
+sprout(tree **ppr, tree_t p_data, int *pi_balance,
+       int (*pfi_compare)(tree_t, tree_t), void (*pfv_delete)(tree_t))
+{
+	tree *p1, *p2, *sub;
+	int cmp;
+
+	ENTER("sprout")
+
+	/* are we grounded?  if so, add the node "here" and set the rebalance
+	 * flag, then exit.
+	 */
+	if (!*ppr) {
+		MSG("grounded. adding new node, setting h=true")
+		*ppr = (tree *) memget(sizeof(tree));
+		if (*ppr) {
+			(*ppr)->left = NULL;
+			(*ppr)->right = NULL;
+			(*ppr)->bal = 0;
+			(*ppr)->data = p_data;
+			*pi_balance = TRUE;
+		}
+		RET(*ppr);
+	}
+
+	/* compare the data using routine passed by caller.
+	 */
+	cmp = (*pfi_compare)(p_data, (*ppr)->data);
+
+	/* if LESS, prepare to move to the left.
+	 */
+	if (cmp < 0) {
+		MSG("LESS. sprouting left.")
+		sub = sprout(&(*ppr)->left, p_data, pi_balance,
+			     pfi_compare, pfv_delete);
+		if (sub && *pi_balance) {	/*%< left branch has grown */
+			MSG("LESS: left branch has grown")
+			switch ((*ppr)->bal) {
+			case 1:
+				/* right branch WAS longer; bal is ok now */
+				MSG("LESS: case 1.. bal restored implicitly")
+				(*ppr)->bal = 0;
+				*pi_balance = FALSE;
+				break;
+			case 0:
+				/* balance WAS okay; now left branch longer */
+				MSG("LESS: case 0.. balnce bad but still ok")
+				(*ppr)->bal = -1;
+				break;
+			case -1:
+				/* left branch was already too long. rebal */
+				MSG("LESS: case -1: rebalancing")
+				p1 = (*ppr)->left;
+				if (p1->bal == -1) {		/*%< LL */
+					MSG("LESS: single LL")
+					(*ppr)->left = p1->right;
+					p1->right = *ppr;
+					(*ppr)->bal = 0;
+					*ppr = p1;
+				} else {			/*%< double LR */
+					MSG("LESS: double LR")
+
+					p2 = p1->right;
+					p1->right = p2->left;
+					p2->left = p1;
+
+					(*ppr)->left = p2->right;
+					p2->right = *ppr;
+
+					if (p2->bal == -1)
+						(*ppr)->bal = 1;
+					else
+						(*ppr)->bal = 0;
+
+					if (p2->bal == 1)
+						p1->bal = -1;
+					else
+						p1->bal = 0;
+					*ppr = p2;
+				} /*else*/
+				(*ppr)->bal = 0;
+				*pi_balance = FALSE;
+			} /*switch*/
+		} /*if*/
+		RET(sub)
+	} /*if*/
+
+	/* if MORE, prepare to move to the right.
+	 */
+	if (cmp > 0) {
+		MSG("MORE: sprouting to the right")
+		sub = sprout(&(*ppr)->right, p_data, pi_balance,
+			     pfi_compare, pfv_delete);
+		if (sub && *pi_balance) {
+			MSG("MORE: right branch has grown")
+
+			switch ((*ppr)->bal) {
+			case -1:
+				MSG("MORE: balance was off, fixed implicitly")
+				(*ppr)->bal = 0;
+				*pi_balance = FALSE;
+				break;
+			case 0:
+				MSG("MORE: balance was okay, now off but ok")
+				(*ppr)->bal = 1;
+				break;
+			case 1:
+				MSG("MORE: balance was off, need to rebalance")
+				p1 = (*ppr)->right;
+				if (p1->bal == 1) {		/*%< RR */
+					MSG("MORE: single RR")
+					(*ppr)->right = p1->left;
+					p1->left = *ppr;
+					(*ppr)->bal = 0;
+					*ppr = p1;
+				} else {			/*%< double RL */
+					MSG("MORE: double RL")
+
+					p2 = p1->left;
+					p1->left = p2->right;
+					p2->right = p1;
+
+					(*ppr)->right = p2->left;
+					p2->left = *ppr;
+
+					if (p2->bal == 1)
+						(*ppr)->bal = -1;
+					else
+						(*ppr)->bal = 0;
+
+					if (p2->bal == -1)
+						p1->bal = 1;
+					else
+						p1->bal = 0;
+
+					*ppr = p2;
+				} /*else*/
+				(*ppr)->bal = 0;
+				*pi_balance = FALSE;
+			} /*switch*/
+		} /*if*/
+		RET(sub)
+	} /*if*/
+
+	/* not less, not more: this is the same key!  replace...
+	 */
+	MSG("FOUND: Replacing data value")
+	*pi_balance = FALSE;
+	if (pfv_delete)
+		(*pfv_delete)((*ppr)->data);
+	(*ppr)->data = p_data;
+	RET(*ppr)
+}
+
+static int
+delete(tree **ppr_p, int (*pfi_compare)(tree_t, tree_t), tree_t p_user,
+       void (*pfv_uar)(tree_t), int *pi_balance, int *pi_uar_called)
+{
+	tree *pr_q;
+	int i_comp, i_ret;
+
+	ENTER("delete")
+
+	if (*ppr_p == NULL) {
+		MSG("key not in tree")
+		RET(FALSE)
+	}
+
+	i_comp = (*pfi_compare)((*ppr_p)->data, p_user);
+	if (i_comp > 0) {
+		MSG("too high - scan left")
+		i_ret = delete(&(*ppr_p)->left, pfi_compare, p_user, pfv_uar,
+			       pi_balance, pi_uar_called);
+		if (*pi_balance)
+			bal_L(ppr_p, pi_balance);
+	} else if (i_comp < 0) {
+		MSG("too low - scan right")
+		i_ret = delete(&(*ppr_p)->right, pfi_compare, p_user, pfv_uar,
+			       pi_balance, pi_uar_called);
+		if (*pi_balance)
+			bal_R(ppr_p, pi_balance);
+	} else {
+		MSG("equal")
+		pr_q = *ppr_p;
+		if (pr_q->right == NULL) {
+			MSG("right subtree null")
+			*ppr_p = pr_q->left;
+			*pi_balance = TRUE;
+		} else if (pr_q->left == NULL) {
+			MSG("right subtree non-null, left subtree null")
+			*ppr_p = pr_q->right;
+			*pi_balance = TRUE;
+		} else {
+			MSG("neither subtree null")
+			del(&pr_q->left, pi_balance, &pr_q,
+			    pfv_uar, pi_uar_called);
+			if (*pi_balance)
+				bal_L(ppr_p, pi_balance);
+		}
+		if (!*pi_uar_called && pfv_uar)
+			(*pfv_uar)(pr_q->data);
+		/* Thanks to wuth@castrov.cuc.ab.ca for the following stmt. */
+		memput(pr_q, sizeof(tree));
+		i_ret = TRUE;
+	}
+	RET(i_ret)
+}
+
+static void
+del(tree **ppr_r, int *pi_balance, tree **ppr_q,
+    void (*pfv_uar)(tree_t), int *pi_uar_called)
+{
+	ENTER("del")
+
+	if ((*ppr_r)->right != NULL) {
+		del(&(*ppr_r)->right, pi_balance, ppr_q,
+		    pfv_uar, pi_uar_called);
+		if (*pi_balance)
+			bal_R(ppr_r, pi_balance);
+	} else {
+		if (pfv_uar)
+			(*pfv_uar)((*ppr_q)->data);
+		*pi_uar_called = TRUE;
+		(*ppr_q)->data = (*ppr_r)->data;
+		*ppr_q = *ppr_r;
+		*ppr_r = (*ppr_r)->left;
+		*pi_balance = TRUE;
+	}
+
+	RETV
+}
+
+static void
+bal_L(tree **ppr_p, int *pi_balance) {
+	tree *p1, *p2;
+	int b1, b2;
+
+	ENTER("bal_L")
+	MSG("left branch has shrunk")
+
+	switch ((*ppr_p)->bal) {
+	case -1:
+		MSG("was imbalanced, fixed implicitly")
+		(*ppr_p)->bal = 0;
+		break;
+	case 0:
+		MSG("was okay, is now one off")
+		(*ppr_p)->bal = 1;
+		*pi_balance = FALSE;
+		break;
+	case 1:
+		MSG("was already off, this is too much")
+		p1 = (*ppr_p)->right;
+		b1 = p1->bal;
+		if (b1 >= 0) {
+			MSG("single RR")
+			(*ppr_p)->right = p1->left;
+			p1->left = *ppr_p;
+			if (b1 == 0) {
+				MSG("b1 == 0")
+				(*ppr_p)->bal = 1;
+				p1->bal = -1;
+				*pi_balance = FALSE;
+			} else {
+				MSG("b1 != 0")
+				(*ppr_p)->bal = 0;
+				p1->bal = 0;
+			}
+			*ppr_p = p1;
+		} else {
+			MSG("double RL")
+			p2 = p1->left;
+			b2 = p2->bal;
+			p1->left = p2->right;
+			p2->right = p1;
+			(*ppr_p)->right = p2->left;
+			p2->left = *ppr_p;
+			if (b2 == 1)
+				(*ppr_p)->bal = -1;
+			else
+				(*ppr_p)->bal = 0;
+			if (b2 == -1)
+				p1->bal = 1;
+			else
+				p1->bal = 0;
+			*ppr_p = p2;
+			p2->bal = 0;
+		}
+	}
+	RETV
+}
+
+static void
+bal_R(tree **ppr_p, int *pi_balance) {
+	tree *p1, *p2;
+	int b1, b2;
+
+	ENTER("bal_R")
+	MSG("right branch has shrunk")
+	switch ((*ppr_p)->bal) {
+	case 1:
+		MSG("was imbalanced, fixed implicitly")
+		(*ppr_p)->bal = 0;
+		break;
+	case 0:
+		MSG("was okay, is now one off")
+		(*ppr_p)->bal = -1;
+		*pi_balance = FALSE;
+		break;
+	case -1:
+		MSG("was already off, this is too much")
+		p1 = (*ppr_p)->left;
+		b1 = p1->bal;
+		if (b1 <= 0) {
+			MSG("single LL")
+			(*ppr_p)->left = p1->right;
+			p1->right = *ppr_p;
+			if (b1 == 0) {
+				MSG("b1 == 0")
+				(*ppr_p)->bal = -1;
+				p1->bal = 1;
+				*pi_balance = FALSE;
+			} else {
+				MSG("b1 != 0")
+				(*ppr_p)->bal = 0;
+				p1->bal = 0;
+			}
+			*ppr_p = p1;
+		} else {
+			MSG("double LR")
+			p2 = p1->right;
+			b2 = p2->bal;
+			p1->right = p2->left;
+			p2->left = p1;
+			(*ppr_p)->left = p2->right;
+			p2->right = *ppr_p;
+			if (b2 == -1)
+				(*ppr_p)->bal = 1;
+			else
+				(*ppr_p)->bal = 0;
+			if (b2 == 1)
+				p1->bal = -1;
+			else
+				p1->bal = 0;
+			*ppr_p = p2;
+			p2->bal = 0;
+		}
+	}
+	RETV
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/llib-lresolv_joy b/usr/src/lib/libresolv2_joy/common/llib-lresolv_joy
new file mode 100644
index 0000000000..aedd06a0fa
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/llib-lresolv_joy
@@ -0,0 +1,59 @@
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+/*
+ * Copyright (c) 1997-1999 by Sun Microsystems, Inc. 
+ * All rights reserved. 
+ */ 
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#include <stdio.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+/*
+ * usr/src/lib/libresolv2 routines
+ */
+
+int		dn_skipname(const uchar_t *, const uchar_t *);
+void		fp_query(const u_char *, FILE *);
+const uchar_t *	p_cdname(const uchar_t *, const uchar_t *, FILE *);
+const char *	p_class(int);
+void		p_query(const u_char *);
+const char *	p_time(unsigned int);
+const char *	p_type(int);
+void		putlong(unsigned int, uchar_t *);
+uint32_t	_getlong(const u_char *);
+uint16_t	_getshort(const u_char *);
+const char *	hstrerror(int);
+int		res_init(void);
+int		res_mkquery(int, const char *, int, int, const u_char *,
+				int, const u_char *, u_char *, int);
+int		res_query(const char *, int, int, u_char *, int);
+int		res_querydomain(const char *, const char *, int, int,
+				u_char *, int);
+int		res_search(const char *, int, int, u_char *, int);
+int		res_send(const u_char *, int, u_char *, int);
+int		res_update(ns_updrec *);
+int		res_ninit(res_state);
+void		fp_resstat(const res_state, FILE *);
+const char *	res_hostalias(const res_state, const char *, char *, size_t);
+int		res_nquery(res_state, const char *, int, int, u_char *, int);
+int		res_nsearch(res_state, const char *, int, int, u_char *, int);
+int		res_nquerydomain(res_state, const char *, const char *,
+				int, int, u_char *, int);
+int		res_nmkquery(res_state, int, const char *, int, int,
+				const u_char *, int, const u_char *,
+				u_char *, int);
+int		res_nsend(res_state, const u_char *, int, u_char *, int);
+int		res_nmkupdate(res_state, ns_updrec *, u_char *, int);
+void		res_nclose(res_state);
+int		res_nsendsigned(res_state, const u_char *, int, ns_tsig_key *,
+				u_char *, int);
+int		dn_comp(const char *, u_char *, int, u_char **, u_char **);
+int		dn_expand(const u_char *, const u_char *, const u_char *,
+				char *, int);
diff --git a/usr/src/lib/libresolv2_joy/common/mapfile-vers b/usr/src/lib/libresolv2_joy/common/mapfile-vers
new file mode 100644
index 0000000000..e0c66a1c96
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/mapfile-vers
@@ -0,0 +1,60 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate {
+    global:
+	joy_dn_expand;
+	joy_res_nsearch;
+	joy_res_ninit;
+	joy_res_ndestroy;
+	joy_res_gethostbyaddr;
+	joy_res_gethostbyname;
+	joy_res_gethostbyname2;
+	joy_res_sethostent;
+	joy_res_endhostent;
+	__joy_res_override_retry;
+	__joy_res_unset_no_hosts_fallback;
+	__joy_res_set_no_hosts_fallback;
+	__joy_h_errno;
+	__joy_ns_get16;
+	__joy_ns_get32;
+    local:
+	*;
+};
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_date.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_date.c
new file mode 100644
index 0000000000..292375af63
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_date.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_date.c,v 1.6 2005/04/27 04:56:39 sra Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+/* Forward. */
+
+static int	datepart(const char *, int, int, int, int *);
+
+/* Public. */
+
+/*%
+ * Convert a date in ASCII into the number of seconds since
+ * 1 January 1970 (GMT assumed).  Format is yyyymmddhhmmss, all
+ * digits required, no spaces allowed.
+ */
+
+u_int32_t
+ns_datetosecs(const char *cp, int *errp) {
+	struct tm time;
+	u_int32_t result;
+	int mdays, i;
+	static const int days_per_month[12] =
+		{31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
+
+	if (strlen(cp) != 14U) {
+		*errp = 1;
+		return (0);
+	}
+	*errp = 0;
+
+	memset(&time, 0, sizeof time);
+	time.tm_year  = datepart(cp +  0, 4, 1990, 9999, errp) - 1900;
+	time.tm_mon   = datepart(cp +  4, 2,   01,   12, errp) - 1;
+	time.tm_mday  = datepart(cp +  6, 2,   01,   31, errp);
+	time.tm_hour  = datepart(cp +  8, 2,   00,   23, errp);
+	time.tm_min   = datepart(cp + 10, 2,   00,   59, errp);
+	time.tm_sec   = datepart(cp + 12, 2,   00,   59, errp);
+	if (*errp)		/*%< Any parse errors? */
+		return (0);
+
+	/* 
+	 * OK, now because timegm() is not available in all environments,
+	 * we will do it by hand.  Roll up sleeves, curse the gods, begin!
+	 */
+
+#define SECS_PER_DAY    ((u_int32_t)24*60*60)
+#define isleap(y) ((((y) % 4) == 0 && ((y) % 100) != 0) || ((y) % 400) == 0)
+
+	result  = time.tm_sec;				/*%< Seconds */
+	result += time.tm_min * 60;			/*%< Minutes */
+	result += time.tm_hour * (60*60);		/*%< Hours */
+	result += (time.tm_mday - 1) * SECS_PER_DAY;	/*%< Days */
+	/* Months are trickier.  Look without leaping, then leap */
+	mdays = 0;
+	for (i = 0; i < time.tm_mon; i++)
+		mdays += days_per_month[i];
+	result += mdays * SECS_PER_DAY;			/*%< Months */
+	if (time.tm_mon > 1 && isleap(1900+time.tm_year))
+		result += SECS_PER_DAY;		/*%< Add leapday for this year */
+	/* First figure years without leapdays, then add them in.  */
+	/* The loop is slow, FIXME, but simple and accurate.  */
+	result += (time.tm_year - 70) * (SECS_PER_DAY*365); /*%< Years */
+	for (i = 70; i < time.tm_year; i++)
+		if (isleap(1900+i))
+			result += SECS_PER_DAY; /*%< Add leapday for prev year */
+	return (result);
+}
+
+/* Private. */
+
+/*%
+ * Parse part of a date.  Set error flag if any error.
+ * Don't reset the flag if there is no error.
+ */
+static int
+datepart(const char *buf, int size, int min, int max, int *errp) {
+	int result = 0;
+	int i;
+
+	for (i = 0; i < size; i++) {
+		if (!isdigit((unsigned char)(buf[i])))
+			*errp = 1;
+		result = (result * 10) + buf[i] - '0';
+	}
+	if (result < min)
+		*errp = 1;
+	if (result > max)
+		*errp = 1;
+	return (result);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_name.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_name.c
new file mode 100644
index 0000000000..f6b0accef1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_name.c
@@ -0,0 +1,1153 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_name.c,v 1.11 2009/01/23 19:59:16 each Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <string.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <limits.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+#define NS_TYPE_ELT			0x40 /*%< EDNS0 extended label type */
+#define DNS_LABELTYPE_BITSTRING		0x41
+
+/* Data. */
+
+static const char	digits[] = "0123456789";
+
+static const char digitvalue[256] = {
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,	/*16*/
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*32*/
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*48*/
+	 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, -1, -1, -1, -1, -1, -1, /*64*/
+	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*80*/
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*96*/
+	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*112*/
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*128*/
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*256*/
+};
+
+/* Forward. */
+
+static int		special(int);
+static int		printable(int);
+static int		dn_find(const u_char *, const u_char *,
+				const u_char * const *,
+				const u_char * const *);
+static int		encode_bitsring(const char **, const char *,
+					unsigned char **, unsigned char **,
+					unsigned const char *);
+static int		labellen(const u_char *);
+static int		decode_bitstring(const unsigned char **,
+					 char *, const char *);
+
+/* Public. */
+
+/*%
+ *	Convert an encoded domain name to printable ascii as per RFC1035.
+
+ * return:
+ *\li	Number of bytes written to buffer, or -1 (with errno set)
+ *
+ * notes:
+ *\li	The root is returned as "."
+ *\li	All other domains are returned in non absolute form
+ */
+int
+ns_name_ntop(const u_char *src, char *dst, size_t dstsiz)
+{
+	const u_char *cp;
+	char *dn, *eom;
+	u_char c;
+	u_int n;
+	int l;
+
+	cp = src;
+	dn = dst;
+	eom = dst + dstsiz;
+
+	while ((n = *cp++) != 0) {
+		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
+			/* Some kind of compression pointer. */
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		if (dn != dst) {
+			if (dn >= eom) {
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			*dn++ = '.';
+		}
+		if ((l = labellen(cp - 1)) < 0) {
+			errno = EMSGSIZE; /*%< XXX */
+			return (-1);
+		}
+		if (dn + l >= eom) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		if ((n & NS_CMPRSFLGS) == NS_TYPE_ELT) {
+			int m;
+
+			if (n != DNS_LABELTYPE_BITSTRING) {
+				/* XXX: labellen should reject this case */
+				errno = EINVAL;
+				return (-1);
+			}
+			if ((m = decode_bitstring(&cp, dn, eom)) < 0)
+			{
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			dn += m; 
+			continue;
+		}
+		for ((void)NULL; l > 0; l--) {
+			c = *cp++;
+			if (special(c)) {
+				if (dn + 1 >= eom) {
+					errno = EMSGSIZE;
+					return (-1);
+				}
+				*dn++ = '\\';
+				*dn++ = (char)c;
+			} else if (!printable(c)) {
+				if (dn + 3 >= eom) {
+					errno = EMSGSIZE;
+					return (-1);
+				}
+				*dn++ = '\\';
+				*dn++ = digits[c / 100];
+				*dn++ = digits[(c % 100) / 10];
+				*dn++ = digits[c % 10];
+			} else {
+				if (dn >= eom) {
+					errno = EMSGSIZE;
+					return (-1);
+				}
+				*dn++ = (char)c;
+			}
+		}
+	}
+	if (dn == dst) {
+		if (dn >= eom) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		*dn++ = '.';
+	}
+	if (dn >= eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	*dn++ = '\0';
+	return (dn - dst);
+}
+
+/*%
+ *	Convert a ascii string into an encoded domain name as per RFC1035.
+ *
+ * return:
+ *
+ *\li	-1 if it fails
+ *\li	1 if string was fully qualified
+ *\li	0 is string was not fully qualified
+ *
+ * notes:
+ *\li	Enforces label and domain length limits.
+ */
+int
+ns_name_pton(const char *src, u_char *dst, size_t dstsiz) {
+	return (ns_name_pton2(src, dst, dstsiz, NULL));
+}
+
+/*
+ * ns_name_pton2(src, dst, dstsiz, *dstlen)
+ *	Convert a ascii string into an encoded domain name as per RFC1035.
+ * return:
+ *	-1 if it fails
+ *	1 if string was fully qualified
+ *	0 is string was not fully qualified
+ * side effects:
+ *	fills in *dstlen (if non-NULL)
+ * notes:
+ *	Enforces label and domain length limits.
+ */
+int
+ns_name_pton2(const char *src, u_char *dst, size_t dstsiz, size_t *dstlen) {
+	u_char *label, *bp, *eom;
+	int c, n, escaped, e = 0;
+	char *cp;
+
+	escaped = 0;
+	bp = dst;
+	eom = dst + dstsiz;
+	label = bp++;
+
+	while ((c = *src++) != 0) {
+		if (escaped) {
+			if (c == '[') { /*%< start a bit string label */
+				if ((cp = strchr(src, ']')) == NULL) {
+					errno = EINVAL; /*%< ??? */
+					return (-1);
+				}
+				if ((e = encode_bitsring(&src, cp + 2,
+							 &label, &bp, eom))
+				    != 0) {
+					errno = e;
+					return (-1);
+				}
+				escaped = 0;
+				label = bp++;
+				if ((c = *src++) == 0)
+					goto done;
+				else if (c != '.') {
+					errno = EINVAL;
+					return	(-1);
+				}
+				continue;
+			}
+			else if ((cp = strchr(digits, c)) != NULL) {
+				n = (cp - digits) * 100;
+				if ((c = *src++) == 0 ||
+				    (cp = strchr(digits, c)) == NULL) {
+					errno = EMSGSIZE;
+					return (-1);
+				}
+				n += (cp - digits) * 10;
+				if ((c = *src++) == 0 ||
+				    (cp = strchr(digits, c)) == NULL) {
+					errno = EMSGSIZE;
+					return (-1);
+				}
+				n += (cp - digits);
+				if (n > 255) {
+					errno = EMSGSIZE;
+					return (-1);
+				}
+				c = n;
+			}
+			escaped = 0;
+		} else if (c == '\\') {
+			escaped = 1;
+			continue;
+		} else if (c == '.') {
+			c = (bp - label - 1);
+			if ((c & NS_CMPRSFLGS) != 0) {	/*%< Label too big. */
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			if (label >= eom) {
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			*label = c;
+			/* Fully qualified ? */
+			if (*src == '\0') {
+				if (c != 0) {
+					if (bp >= eom) {
+						errno = EMSGSIZE;
+						return (-1);
+					}
+					*bp++ = '\0';
+				}
+				if ((bp - dst) > MAXCDNAME) {
+					errno = EMSGSIZE;
+					return (-1);
+				}
+				if (dstlen != NULL)
+					*dstlen = (bp - dst);
+				return (1);
+			}
+			if (c == 0 || *src == '.') {
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			label = bp++;
+			continue;
+		}
+		if (bp >= eom) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		*bp++ = (u_char)c;
+	}
+	c = (bp - label - 1);
+	if ((c & NS_CMPRSFLGS) != 0) {		/*%< Label too big. */
+		errno = EMSGSIZE;
+		return (-1);
+	}
+  done:
+	if (label >= eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	*label = c;
+	if (c != 0) {
+		if (bp >= eom) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		*bp++ = 0;
+	}
+	if ((bp - dst) > MAXCDNAME) {	/*%< src too big */
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	if (dstlen != NULL)
+		*dstlen = (bp - dst);
+	return (0);
+}
+
+/*%
+ *	Convert a network strings labels into all lowercase.
+ *
+ * return:
+ *\li	Number of bytes written to buffer, or -1 (with errno set)
+ *
+ * notes:
+ *\li	Enforces label and domain length limits.
+ */
+
+int
+ns_name_ntol(const u_char *src, u_char *dst, size_t dstsiz)
+{
+	const u_char *cp;
+	u_char *dn, *eom;
+	u_char c;
+	u_int n;
+	int l;
+
+	cp = src;
+	dn = dst;
+	eom = dst + dstsiz;
+
+	if (dn >= eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	while ((n = *cp++) != 0) {
+		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
+			/* Some kind of compression pointer. */
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		*dn++ = n;
+		if ((l = labellen(cp - 1)) < 0) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		if (dn + l >= eom) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		for ((void)NULL; l > 0; l--) {
+			c = *cp++;
+			if (isascii(c) && isupper(c))
+				*dn++ = tolower(c);
+			else
+				*dn++ = c;
+		}
+	}
+	*dn++ = '\0';
+	return (dn - dst);
+}
+
+/*%
+ *	Unpack a domain name from a message, source may be compressed.
+ *
+ * return:
+ *\li	-1 if it fails, or consumed octets if it succeeds.
+ */
+int
+ns_name_unpack(const u_char *msg, const u_char *eom, const u_char *src,
+	       u_char *dst, size_t dstsiz)
+{
+	return (ns_name_unpack2(msg, eom, src, dst, dstsiz, NULL));
+}
+
+/*
+ * ns_name_unpack2(msg, eom, src, dst, dstsiz, *dstlen)
+ *	Unpack a domain name from a message, source may be compressed.
+ * return:
+ *	-1 if it fails, or consumed octets if it succeeds.
+ * side effect:
+ *	fills in *dstlen (if non-NULL).
+ */
+int
+ns_name_unpack2(const u_char *msg, const u_char *eom, const u_char *src,
+		u_char *dst, size_t dstsiz, size_t *dstlen)
+{
+	const u_char *srcp, *dstlim;
+	u_char *dstp;
+	int n, len, checked, l;
+
+	len = -1;
+	checked = 0;
+	dstp = dst;
+	srcp = src;
+	dstlim = dst + dstsiz;
+	if (srcp < msg || srcp >= eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	/* Fetch next label in domain name. */
+	while ((n = *srcp++) != 0) {
+		/* Check for indirection. */
+		switch (n & NS_CMPRSFLGS) {
+		case 0:
+		case NS_TYPE_ELT:
+			/* Limit checks. */
+			if ((l = labellen(srcp - 1)) < 0) {
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			if (dstp + l + 1 >= dstlim || srcp + l >= eom) {
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			checked += l + 1;
+			*dstp++ = n;
+			memcpy(dstp, srcp, l);
+			dstp += l;
+			srcp += l;
+			break;
+
+		case NS_CMPRSFLGS:
+			if (srcp >= eom) {
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			if (len < 0)
+				len = srcp - src + 1;
+			srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff));
+			if (srcp < msg || srcp >= eom) {  /*%< Out of range. */
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			checked += 2;
+			/*
+			 * Check for loops in the compressed name;
+			 * if we've looked at the whole message,
+			 * there must be a loop.
+			 */
+			if (checked >= eom - msg) {
+				errno = EMSGSIZE;
+				return (-1);
+			}
+			break;
+
+		default:
+			errno = EMSGSIZE;
+			return (-1);			/*%< flag error */
+		}
+	}
+	*dstp++ = 0;
+	if (dstlen != NULL)
+		*dstlen = dstp - dst;
+	if (len < 0)
+		len = srcp - src;
+	return (len);
+}
+
+/*%
+ *	Pack domain name 'domain' into 'comp_dn'.
+ *
+ * return:
+ *\li	Size of the compressed name, or -1.
+ *
+ * notes:
+ *\li	'dnptrs' is an array of pointers to previous compressed names.
+ *\li	dnptrs[0] is a pointer to the beginning of the message. The array
+ *	ends with NULL.
+ *\li	'lastdnptr' is a pointer to the end of the array pointed to
+ *	by 'dnptrs'.
+ *
+ * Side effects:
+ *\li	The list of pointers in dnptrs is updated for labels inserted into
+ *	the message as we compress the name.  If 'dnptr' is NULL, we don't
+ *	try to compress names. If 'lastdnptr' is NULL, we don't update the
+ *	list.
+ */
+int
+ns_name_pack(const u_char *src, u_char *dst, int dstsiz,
+	     const u_char **dnptrs, const u_char **lastdnptr)
+{
+	u_char *dstp;
+	const u_char **cpp, **lpp, *eob, *msg;
+	const u_char *srcp;
+	int n, l, first = 1;
+
+	srcp = src;
+	dstp = dst;
+	eob = dstp + dstsiz;
+	lpp = cpp = NULL;
+	if (dnptrs != NULL) {
+		if ((msg = *dnptrs++) != NULL) {
+			for (cpp = dnptrs; *cpp != NULL; cpp++)
+				(void)NULL;
+			lpp = cpp;	/*%< end of list to search */
+		}
+	} else
+		msg = NULL;
+
+	/* make sure the domain we are about to add is legal */
+	l = 0;
+	do {
+		int l0;
+
+		n = *srcp;
+		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		if ((l0 = labellen(srcp)) < 0) {
+			errno = EINVAL;
+			return (-1);
+		}
+		l += l0 + 1;
+		if (l > MAXCDNAME) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		srcp += l0 + 1;
+	} while (n != 0);
+
+	/* from here on we need to reset compression pointer array on error */
+	srcp = src;
+	do {
+		/* Look to see if we can use pointers. */
+		n = *srcp;
+		if (n != 0 && msg != NULL) {
+			l = dn_find(srcp, msg, (const u_char * const *)dnptrs,
+				    (const u_char * const *)lpp);
+			if (l >= 0) {
+				if (dstp + 1 >= eob) {
+					goto cleanup;
+				}
+				*dstp++ = (l >> 8) | NS_CMPRSFLGS;
+				*dstp++ = l % 256;
+				return (dstp - dst);
+			}
+			/* Not found, save it. */
+			if (lastdnptr != NULL && cpp < lastdnptr - 1 &&
+			    (dstp - msg) < 0x4000 && first) {
+				*cpp++ = dstp;
+				*cpp = NULL;
+				first = 0;
+			}
+		}
+		/* copy label to buffer */
+		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
+			/* Should not happen. */
+			goto cleanup;
+		}
+		n = labellen(srcp);
+		if (dstp + 1 + n >= eob) {
+			goto cleanup;
+		}
+		memcpy(dstp, srcp, n + 1);
+		srcp += n + 1;
+		dstp += n + 1;
+	} while (n != 0);
+
+	if (dstp > eob) {
+cleanup:
+		if (msg != NULL)
+			*lpp = NULL;
+		errno = EMSGSIZE;
+		return (-1);
+	} 
+	return (dstp - dst);
+}
+
+/*%
+ *	Expand compressed domain name to presentation format.
+ *
+ * return:
+ *\li	Number of bytes read out of `src', or -1 (with errno set).
+ *
+ * note:
+ *\li	Root domain returns as "." not "".
+ */
+int
+ns_name_uncompress(const u_char *msg, const u_char *eom, const u_char *src,
+		   char *dst, size_t dstsiz)
+{
+	u_char tmp[NS_MAXCDNAME];
+	int n;
+	
+	if ((n = ns_name_unpack(msg, eom, src, tmp, sizeof tmp)) == -1)
+		return (-1);
+	if (ns_name_ntop(tmp, dst, dstsiz) == -1)
+		return (-1);
+	return (n);
+}
+
+/*%
+ *	Compress a domain name into wire format, using compression pointers.
+ *
+ * return:
+ *\li	Number of bytes consumed in `dst' or -1 (with errno set).
+ *
+ * notes:
+ *\li	'dnptrs' is an array of pointers to previous compressed names.
+ *\li	dnptrs[0] is a pointer to the beginning of the message.
+ *\li	The list ends with NULL.  'lastdnptr' is a pointer to the end of the
+ *	array pointed to by 'dnptrs'. Side effect is to update the list of
+ *	pointers for labels inserted into the message as we compress the name.
+ *\li	If 'dnptr' is NULL, we don't try to compress names. If 'lastdnptr'
+ *	is NULL, we don't update the list.
+ */
+int
+ns_name_compress(const char *src, u_char *dst, size_t dstsiz,
+		 const u_char **dnptrs, const u_char **lastdnptr)
+{
+	u_char tmp[NS_MAXCDNAME];
+
+	if (ns_name_pton(src, tmp, sizeof tmp) == -1)
+		return (-1);
+	return (ns_name_pack(tmp, dst, dstsiz, dnptrs, lastdnptr));
+}
+
+/*%
+ * Reset dnptrs so that there are no active references to pointers at or
+ * after src.
+ */
+void
+ns_name_rollback(const u_char *src, const u_char **dnptrs,
+		 const u_char **lastdnptr)
+{
+	while (dnptrs < lastdnptr && *dnptrs != NULL) {
+		if (*dnptrs >= src) {
+			*dnptrs = NULL;
+			break;
+		}
+		dnptrs++;
+	}
+}
+
+/*%
+ *	Advance *ptrptr to skip over the compressed name it points at.
+ *
+ * return:
+ *\li	0 on success, -1 (with errno set) on failure.
+ */
+int
+ns_name_skip(const u_char **ptrptr, const u_char *eom)
+{
+	const u_char *cp;
+	u_int n;
+	int l;
+
+	cp = *ptrptr;
+	while (cp < eom && (n = *cp++) != 0) {
+		/* Check for indirection. */
+		switch (n & NS_CMPRSFLGS) {
+		case 0:			/*%< normal case, n == len */
+			cp += n;
+			continue;
+		case NS_TYPE_ELT: /*%< EDNS0 extended label */
+			if ((l = labellen(cp - 1)) < 0) {
+				errno = EMSGSIZE; /*%< XXX */
+				return (-1);
+			}
+			cp += l;
+			continue;
+		case NS_CMPRSFLGS:	/*%< indirection */
+			cp++;
+			break;
+		default:		/*%< illegal type */
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		break;
+	}
+	if (cp > eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	*ptrptr = cp;
+	return (0);
+}
+
+/* Find the number of octets an nname takes up, including the root label.
+ * (This is basically ns_name_skip() without compression-pointer support.)
+ * ((NOTE: can only return zero if passed-in namesiz argument is zero.))
+ */
+ssize_t
+ns_name_length(ns_nname_ct nname, size_t namesiz) {
+	ns_nname_ct orig = nname;
+	u_int n;
+
+	while (namesiz-- > 0 && (n = *nname++) != 0) {
+		if ((n & NS_CMPRSFLGS) != 0) {
+			errno = EISDIR;
+			return (-1);
+		}
+		if (n > namesiz) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		nname += n;
+		namesiz -= n;
+	}
+	return (nname - orig);
+}
+
+/* Compare two nname's for equality.  Return -1 on error (setting errno).
+ */
+int
+ns_name_eq(ns_nname_ct a, size_t as, ns_nname_ct b, size_t bs) {
+	ns_nname_ct ae = a + as, be = b + bs;
+	int ac, bc;
+
+	while (ac = *a, bc = *b, ac != 0 && bc != 0) {
+		if ((ac & NS_CMPRSFLGS) != 0 || (bc & NS_CMPRSFLGS) != 0) {
+			errno = EISDIR;
+			return (-1);
+		}
+		if (a + ac >= ae || b + bc >= be) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		if (ac != bc || strncasecmp((const char *) ++a,
+					    (const char *) ++b, ac) != 0)
+			return (0);
+		a += ac, b += bc;
+	}
+	return (ac == 0 && bc == 0);
+}
+
+/* Is domain "A" owned by (at or below) domain "B"?
+ */
+int
+ns_name_owned(ns_namemap_ct a, int an, ns_namemap_ct b, int bn) {
+	/* If A is shorter, it cannot be owned by B. */
+	if (an < bn)
+		return (0);
+
+	/* If they are unequal before the length of the shorter, A cannot... */
+	while (bn > 0) {
+		if (a->len != b->len ||
+		    strncasecmp((const char *) a->base,
+				(const char *) b->base, a->len) != 0)
+			return (0);
+		a++, an--;
+		b++, bn--;
+	}
+
+	/* A might be longer or not, but either way, B owns it. */
+	return (1);
+}
+
+/* Build an array of <base,len> tuples from an nname, top-down order.
+ * Return the number of tuples (labels) thus discovered.
+ */
+int
+ns_name_map(ns_nname_ct nname, size_t namelen, ns_namemap_t map, int mapsize) {
+	u_int n;
+	int l;
+
+	n = *nname++;
+	namelen--;
+
+	/* Root zone? */
+	if (n == 0) {
+		/* Extra data follows name? */
+		if (namelen > 0) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		return (0);
+	}
+
+	/* Compression pointer? */
+	if ((n & NS_CMPRSFLGS) != 0) {
+		errno = EISDIR;
+		return (-1);
+	}
+
+	/* Label too long? */
+	if (n > namelen) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+
+	/* Recurse to get rest of name done first. */
+	l = ns_name_map(nname + n, namelen - n, map, mapsize);
+	if (l < 0)
+		return (-1);
+
+	/* Too many labels? */
+	if (l >= mapsize) {
+		errno = ENAMETOOLONG;
+		return (-1);
+	}
+
+	/* We're on our way back up-stack, store current map data. */
+	map[l].base = nname;
+	map[l].len = n;
+	return (l + 1);
+}
+
+/* Count the labels in a domain name.  Root counts, so COM. has two.  This
+ * is to make the result comparable to the result of ns_name_map().
+ */
+int
+ns_name_labels(ns_nname_ct nname, size_t namesiz) {
+	int ret = 0;
+	u_int n;
+
+	while (namesiz-- > 0 && (n = *nname++) != 0) {
+		if ((n & NS_CMPRSFLGS) != 0) {
+			errno = EISDIR;
+			return (-1);
+		}
+		if (n > namesiz) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		nname += n;
+		namesiz -= n;
+		ret++;
+	}
+	return (ret + 1);
+}
+
+/* Private. */
+
+/*%
+ *	Thinking in noninternationalized USASCII (per the DNS spec),
+ *	is this characted special ("in need of quoting") ?
+ *
+ * return:
+ *\li	boolean.
+ */
+static int
+special(int ch) {
+	switch (ch) {
+	case 0x22: /*%< '"' */
+	case 0x2E: /*%< '.' */
+	case 0x3B: /*%< ';' */
+	case 0x5C: /*%< '\\' */
+	case 0x28: /*%< '(' */
+	case 0x29: /*%< ')' */
+	/* Special modifiers in zone files. */
+	case 0x40: /*%< '@' */
+	case 0x24: /*%< '$' */
+		return (1);
+	default:
+		return (0);
+	}
+}
+
+/*%
+ *	Thinking in noninternationalized USASCII (per the DNS spec),
+ *	is this character visible and not a space when printed ?
+ *
+ * return:
+ *\li	boolean.
+ */
+static int
+printable(int ch) {
+	return (ch > 0x20 && ch < 0x7f);
+}
+
+/*%
+ *	Thinking in noninternationalized USASCII (per the DNS spec),
+ *	convert this character to lower case if it's upper case.
+ */
+static int
+mklower(int ch) {
+	if (ch >= 0x41 && ch <= 0x5A)
+		return (ch + 0x20);
+	return (ch);
+}
+
+/*%
+ *	Search for the counted-label name in an array of compressed names.
+ *
+ * return:
+ *\li	offset from msg if found, or -1.
+ *
+ * notes:
+ *\li	dnptrs is the pointer to the first name on the list,
+ *\li	not the pointer to the start of the message.
+ */
+static int
+dn_find(const u_char *domain, const u_char *msg,
+	const u_char * const *dnptrs,
+	const u_char * const *lastdnptr)
+{
+	const u_char *dn, *cp, *sp;
+	const u_char * const *cpp;
+	u_int n;
+
+	for (cpp = dnptrs; cpp < lastdnptr; cpp++) {
+		sp = *cpp;
+		/*
+		 * terminate search on:
+		 * root label
+		 * compression pointer
+		 * unusable offset
+		 */
+		while (*sp != 0 && (*sp & NS_CMPRSFLGS) == 0 &&
+		       (sp - msg) < 0x4000) {
+			dn = domain;
+			cp = sp;
+			while ((n = *cp++) != 0) {
+				/*
+				 * check for indirection
+				 */
+				switch (n & NS_CMPRSFLGS) {
+				case 0:		/*%< normal case, n == len */
+					n = labellen(cp - 1); /*%< XXX */
+					if (n != *dn++)
+						goto next;
+
+					for ((void)NULL; n > 0; n--)
+						if (mklower(*dn++) !=
+						    mklower(*cp++))
+							goto next;
+					/* Is next root for both ? */
+					if (*dn == '\0' && *cp == '\0')
+						return (sp - msg);
+					if (*dn)
+						continue;
+					goto next;
+				case NS_CMPRSFLGS:	/*%< indirection */
+					cp = msg + (((n & 0x3f) << 8) | *cp);
+					break;
+
+				default:	/*%< illegal type */
+					errno = EMSGSIZE;
+					return (-1);
+				}
+			}
+ next: ;
+			sp += *sp + 1;
+		}
+	}
+	errno = ENOENT;
+	return (-1);
+}
+
+static int
+decode_bitstring(const unsigned char **cpp, char *dn, const char *eom)
+{
+	const unsigned char *cp = *cpp;
+	char *beg = dn, tc;
+	int b, blen, plen, i;
+
+	if ((blen = (*cp & 0xff)) == 0)
+		blen = 256;
+	plen = (blen + 3) / 4;
+	plen += sizeof("\\[x/]") + (blen > 99 ? 3 : (blen > 9) ? 2 : 1);
+	if (dn + plen >= eom)
+		return (-1);
+
+	cp++;
+	i = SPRINTF((dn, "\\[x"));
+	if (i < 0)
+		return (-1);
+	dn += i;
+	for (b = blen; b > 7; b -= 8, cp++) {
+		i = SPRINTF((dn, "%02x", *cp & 0xff));
+		if (i < 0)
+			return (-1);
+		dn += i;
+	}
+	if (b > 4) {
+		tc = *cp++;
+		i = SPRINTF((dn, "%02x", tc & (0xff << (8 - b))));
+		if (i < 0)
+			return (-1);
+		dn += i;
+	} else if (b > 0) {
+		tc = *cp++;
+		i = SPRINTF((dn, "%1x",
+			       ((tc >> 4) & 0x0f) & (0x0f << (4 - b)))); 
+		if (i < 0)
+			return (-1);
+		dn += i;
+	}
+	i = SPRINTF((dn, "/%d]", blen));
+	if (i < 0)
+		return (-1);
+	dn += i;
+
+	*cpp = cp;
+	return (dn - beg);
+}
+
+static int
+encode_bitsring(const char **bp, const char *end, unsigned char **labelp,
+		unsigned char ** dst, unsigned const char *eom)
+{
+	int afterslash = 0;
+	const char *cp = *bp;
+	unsigned char *tp;
+	char c;
+	const char *beg_blen;
+	char *end_blen = NULL;
+	int value = 0, count = 0, tbcount = 0, blen = 0;
+
+	beg_blen = end_blen = NULL;
+
+	/* a bitstring must contain at least 2 characters */
+	if (end - cp < 2)
+		return (EINVAL);
+
+	/* XXX: currently, only hex strings are supported */
+	if (*cp++ != 'x')
+		return (EINVAL);
+	if (!isxdigit((*cp) & 0xff)) /*%< reject '\[x/BLEN]' */
+		return (EINVAL);
+
+	for (tp = *dst + 1; cp < end && tp < eom; cp++) {
+		switch((c = *cp)) {
+		case ']':	/*%< end of the bitstring */
+			if (afterslash) {
+				if (beg_blen == NULL)
+					return (EINVAL);
+				blen = (int)strtol(beg_blen, &end_blen, 10);
+				if (*end_blen != ']')
+					return (EINVAL);
+			}
+			if (count)
+				*tp++ = ((value << 4) & 0xff);
+			cp++;	/*%< skip ']' */
+			goto done;
+		case '/':
+			afterslash = 1;
+			break;
+		default:
+			if (afterslash) {
+				if (!isdigit(c&0xff))
+					return (EINVAL);
+				if (beg_blen == NULL) {
+					
+					if (c == '0') {
+						/* blen never begings with 0 */
+						return (EINVAL);
+					}
+					beg_blen = cp;
+				}
+			} else {
+				if (!isxdigit(c&0xff))
+					return (EINVAL);
+				value <<= 4;
+				value += digitvalue[(int)c];
+				count += 4;
+				tbcount += 4;
+				if (tbcount > 256)
+					return (EINVAL);
+				if (count == 8) {
+					*tp++ = value;
+					count = 0;
+				}
+			}
+			break;
+		}
+	}
+  done:
+	if (cp >= end || tp >= eom)
+		return (EMSGSIZE);
+
+	/*
+	 * bit length validation:
+	 * If a <length> is present, the number of digits in the <bit-data>
+	 * MUST be just sufficient to contain the number of bits specified
+	 * by the <length>. If there are insignificant bits in a final
+	 * hexadecimal or octal digit, they MUST be zero.
+	 * RFC2673, Section 3.2.
+	 */
+	if (blen > 0) {
+		int traillen;
+
+		if (((blen + 3) & ~3) != tbcount)
+			return (EINVAL);
+		traillen = tbcount - blen; /*%< between 0 and 3 */
+		if (((value << (8 - traillen)) & 0xff) != 0)
+			return (EINVAL);
+	}
+	else
+		blen = tbcount;
+	if (blen == 256)
+		blen = 0;
+
+	/* encode the type and the significant bit fields */
+	**labelp = DNS_LABELTYPE_BITSTRING;
+	**dst = blen;
+
+	*bp = cp;
+	*dst = tp;
+
+	return (0);
+}
+
+static int
+labellen(const u_char *lp)
+{
+	int bitlen;
+	u_char l = *lp;
+
+	if ((l & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
+		/* should be avoided by the caller */
+		return (-1);
+	}
+
+	if ((l & NS_CMPRSFLGS) == NS_TYPE_ELT) {
+		if (l == DNS_LABELTYPE_BITSTRING) {
+			if ((bitlen = *(lp + 1)) == 0)
+				bitlen = 256;
+			return ((bitlen + 7 ) / 8 + 1);
+		}
+		return (-1);	/*%< unknwon ELT */
+	}
+	return (l);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_netint.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_netint.c
new file mode 100644
index 0000000000..e196217f9b
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_netint.c
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_netint.c,v 1.3 2005/04/27 04:56:40 sra Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+
+#include <arpa/nameser.h>
+
+#include "port_after.h"
+
+#pragma redefine_extname __ns_get16 __joy_ns_get16
+#pragma redefine_extname __ns_get32 __joy_ns_get32
+
+/* Public. */
+
+u_int
+ns_get16(const u_char *src) {
+	u_int dst;
+
+	NS_GET16(dst, src);
+	return (dst);
+}
+
+u_long
+ns_get32(const u_char *src) {
+	u_long dst;
+
+	NS_GET32(dst, src);
+	return (dst);
+}
+
+void
+ns_put16(u_int src, u_char *dst) {
+	NS_PUT16(src, dst);
+}
+
+void
+ns_put32(u_long src, u_char *dst) {
+	NS_PUT32(src, dst);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_newmsg.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_newmsg.c
new file mode 100644
index 0000000000..c18dd060e1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_newmsg.c
@@ -0,0 +1,273 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_newmsg.c,v 1.3 2009/02/26 10:48:57 marka Exp $";
+#endif
+
+#include <port_before.h>
+
+#include <arpa/nameser.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <string.h>
+
+#include <port_after.h>
+
+static int	rdcpy(ns_newmsg *, ns_type, const u_char *, size_t);
+
+/* Initialize a "newmsg" object to empty.
+ */
+int
+ns_newmsg_init(u_char *buffer, size_t bufsiz, ns_newmsg *handle) {
+	ns_msg *msg = &handle->msg;
+
+	memset(handle, 0, sizeof *handle);
+	msg->_msg = buffer;
+	msg->_eom = buffer + bufsiz;
+	msg->_sect = ns_s_qd;
+	msg->_rrnum = 0;
+	msg->_msg_ptr = buffer + NS_HFIXEDSZ;
+	handle->dnptrs[0] = msg->_msg;
+	handle->dnptrs[1] = NULL;
+	handle->lastdnptr = &handle->dnptrs[sizeof handle->dnptrs /
+					    sizeof handle->dnptrs[0] - 1];
+	return (0);
+}
+
+/* Initialize a "newmsg" object by copying an existing parsed message.
+ */
+int
+ns_newmsg_copy(ns_newmsg *handle, ns_msg *msg) {
+	ns_flag flag;
+	ns_sect sect;
+
+	ns_newmsg_id(handle, ns_msg_id(*msg));
+	for (flag = ns_f_qr; flag < ns_f_max; flag++)
+		ns_newmsg_flag(handle, flag, ns_msg_getflag(*msg, flag));
+	for (sect = ns_s_qd; sect < ns_s_max; sect++) {
+		int i, count;
+
+		count = ns_msg_count(*msg, sect);
+		for (i = 0; i < count; i++) {
+			ns_rr2 rr;
+			int x;
+
+			if (ns_parserr2(msg, sect, i, &rr) < 0)
+				return (-1);
+			if (sect == ns_s_qd)
+				x = ns_newmsg_q(handle,
+						ns_rr_nname(rr),
+						ns_rr_type(rr),
+						ns_rr_class(rr));
+			else
+				x = ns_newmsg_rr(handle, sect,
+						 ns_rr_nname(rr),
+						 ns_rr_type(rr),
+						 ns_rr_class(rr),
+						 ns_rr_ttl(rr),
+						 ns_rr_rdlen(rr),
+						 ns_rr_rdata(rr));
+			if (x < 0)
+				return (-1);
+		}
+	}
+	return (0);
+}
+
+/* Set the message-ID in a "newmsg" object.
+ */
+void
+ns_newmsg_id(ns_newmsg *handle, u_int16_t id) {
+	ns_msg *msg = &handle->msg;
+
+	msg->_id = id;
+}
+
+/* Set a flag (including rcode or opcode) in a "newmsg" object.
+ */
+void
+ns_newmsg_flag(ns_newmsg *handle, ns_flag flag, u_int value) {
+	extern struct _ns_flagdata _ns_flagdata[16];
+	struct _ns_flagdata *fd = &_ns_flagdata[flag];
+	ns_msg *msg = &handle->msg;
+
+	assert(flag < ns_f_max);
+	msg->_flags &= (~fd->mask);
+	msg->_flags |= (value << fd->shift);
+}
+
+/* Add a question (or zone, if it's an update) to a "newmsg" object.
+ */
+int
+ns_newmsg_q(ns_newmsg *handle, ns_nname_ct qname,
+	    ns_type qtype, ns_class qclass)
+{
+	ns_msg *msg = &handle->msg;
+	u_char *t;
+	int n;
+
+	if (msg->_sect != ns_s_qd) {
+		errno = ENODEV;
+		return (-1);
+	}
+	t = (u_char *) (unsigned long) msg->_msg_ptr;
+	if (msg->_rrnum == 0)
+		msg->_sections[ns_s_qd] = t;
+	n = ns_name_pack(qname, t, msg->_eom - t,
+			 handle->dnptrs, handle->lastdnptr);
+	if (n < 0)
+		return (-1);
+	t += n;
+	if (t + QFIXEDSZ >= msg->_eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	NS_PUT16(qtype, t);
+	NS_PUT16(qclass, t);
+	msg->_msg_ptr = t;
+	msg->_counts[ns_s_qd] = ++msg->_rrnum;
+	return (0);
+}
+
+/* Add an RR to a "newmsg" object.
+ */
+int
+ns_newmsg_rr(ns_newmsg *handle, ns_sect sect,
+	     ns_nname_ct name, ns_type type,
+	     ns_class rr_class, u_int32_t ttl,
+	     u_int16_t rdlen, const u_char *rdata)
+{
+	ns_msg *msg = &handle->msg;
+	u_char *t;
+	int n;
+
+	if (sect < msg->_sect) {
+		errno = ENODEV;
+		return (-1);
+	}
+	t = (u_char *) (unsigned long) msg->_msg_ptr;
+	if (sect > msg->_sect) {
+		msg->_sect = sect;
+		msg->_sections[sect] = t;
+		msg->_rrnum = 0;
+	}
+	n = ns_name_pack(name, t, msg->_eom - t,
+			 handle->dnptrs, handle->lastdnptr);
+	if (n < 0)
+		return (-1);
+	t += n;
+	if (t + RRFIXEDSZ + rdlen >= msg->_eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	NS_PUT16(type, t);
+	NS_PUT16(rr_class, t);
+	NS_PUT32(ttl, t);
+	msg->_msg_ptr = t;
+	if (rdcpy(handle, type, rdata, rdlen) < 0)
+		return (-1);
+	msg->_counts[sect] = ++msg->_rrnum;
+	return (0);
+}
+
+/* Complete a "newmsg" object and return its size for use in write().
+ * (Note: the "newmsg" object is also made ready for ns_parserr() etc.)
+ */
+size_t
+ns_newmsg_done(ns_newmsg *handle) {
+	ns_msg *msg = &handle->msg;
+	ns_sect sect;
+	u_char *t;
+
+	t = (u_char *) (unsigned long) msg->_msg;
+	NS_PUT16(msg->_id, t);
+	NS_PUT16(msg->_flags, t);
+	for (sect = 0; sect < ns_s_max; sect++)
+		NS_PUT16(msg->_counts[sect], t);
+	msg->_eom = msg->_msg_ptr;
+	msg->_sect = ns_s_max;
+	msg->_rrnum = -1;
+	msg->_msg_ptr = NULL;
+	return (msg->_eom - msg->_msg);
+}
+
+/* Private. */
+
+/* Copy an RDATA, using compression pointers where RFC1035 permits.
+ */
+static int
+rdcpy(ns_newmsg *handle, ns_type type, const u_char *rdata, size_t rdlen) {
+	ns_msg *msg = &handle->msg;
+	u_char *p = (u_char *) (unsigned long) msg->_msg_ptr;
+	u_char *t = p + NS_INT16SZ;
+	u_char *s = t;
+	int n;
+
+	switch (type) {
+	case ns_t_soa:
+		/* MNAME. */
+		n = ns_name_pack(rdata, t, msg->_eom - t,
+				 handle->dnptrs, handle->lastdnptr);
+		if (n < 0)
+			return (-1);
+		t += n;
+		if (ns_name_skip(&rdata, msg->_eom) < 0)
+			return (-1);
+
+		/* ANAME. */
+		n = ns_name_pack(rdata, t, msg->_eom - t,
+				 handle->dnptrs, handle->lastdnptr);
+		if (n < 0)
+			return (-1);
+		t += n;
+		if (ns_name_skip(&rdata, msg->_eom) < 0)
+			return (-1);
+
+		/* Serial, Refresh, Retry, Expiry, and Minimum. */
+		if ((msg->_eom - t) < (NS_INT32SZ * 5)) {
+			errno = EMSGSIZE;
+			return (-1);
+		}
+		memcpy(t, rdata, NS_INT32SZ * 5);
+		t += (NS_INT32SZ * 5);
+		break;
+	case ns_t_ptr:
+	case ns_t_cname:
+	case ns_t_ns:
+		/* PTRDNAME, CNAME, or NSDNAME. */
+		n = ns_name_pack(rdata, t, msg->_eom - t,
+				 handle->dnptrs, handle->lastdnptr);
+		if (n < 0)
+			return (-1);
+		t += n;
+		break;
+	default:
+		memcpy(t, rdata, rdlen);
+		t += rdlen;
+	}
+	NS_PUT16(t - s, p);
+	msg->_msg_ptr = t;
+	return (0);
+}
+
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_parse.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_parse.c
new file mode 100644
index 0000000000..ba11eea707
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_parse.c
@@ -0,0 +1,275 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_parse.c,v 1.10 2009/01/23 19:59:16 each Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <string.h>
+
+#include "port_after.h"
+
+/* Forward. */
+
+static void	setsection(ns_msg *msg, ns_sect sect);
+
+/* Macros. */
+
+#if !defined(SOLARIS2) || defined(__COVERITY__)
+#define RETERR(err) do { errno = (err); return (-1); } while (0)
+#else
+#define RETERR(err) \
+	do { errno = (err); if (errno == errno) return (-1); } while (0)
+#endif
+
+#define PARSE_FMT_PRESO 0	/* Parse using presentation-format names */
+#define PARSE_FMT_WIRE 1	/* Parse using network-format names */
+
+/* Public. */
+
+/* These need to be in the same order as the nres.h:ns_flag enum. */
+struct _ns_flagdata _ns_flagdata[16] = {
+	{ 0x8000, 15 },		/*%< qr. */
+	{ 0x7800, 11 },		/*%< opcode. */
+	{ 0x0400, 10 },		/*%< aa. */
+	{ 0x0200, 9 },		/*%< tc. */
+	{ 0x0100, 8 },		/*%< rd. */
+	{ 0x0080, 7 },		/*%< ra. */
+	{ 0x0040, 6 },		/*%< z. */
+	{ 0x0020, 5 },		/*%< ad. */
+	{ 0x0010, 4 },		/*%< cd. */
+	{ 0x000f, 0 },		/*%< rcode. */
+	{ 0x0000, 0 },		/*%< expansion (1/6). */
+	{ 0x0000, 0 },		/*%< expansion (2/6). */
+	{ 0x0000, 0 },		/*%< expansion (3/6). */
+	{ 0x0000, 0 },		/*%< expansion (4/6). */
+	{ 0x0000, 0 },		/*%< expansion (5/6). */
+	{ 0x0000, 0 },		/*%< expansion (6/6). */
+};
+
+int ns_msg_getflag(ns_msg handle, int flag) {
+	return(((handle)._flags & _ns_flagdata[flag].mask) >> _ns_flagdata[flag].shift);
+}
+
+int
+ns_skiprr(const u_char *ptr, const u_char *eom, ns_sect section, int count) {
+	const u_char *optr = ptr;
+
+	for ((void)NULL; count > 0; count--) {
+		int b, rdlength;
+
+		b = dn_skipname(ptr, eom);
+		if (b < 0)
+			RETERR(EMSGSIZE);
+		ptr += b/*Name*/ + NS_INT16SZ/*Type*/ + NS_INT16SZ/*Class*/;
+		if (section != ns_s_qd) {
+			if (ptr + NS_INT32SZ + NS_INT16SZ > eom)
+				RETERR(EMSGSIZE);
+			ptr += NS_INT32SZ/*TTL*/;
+			NS_GET16(rdlength, ptr);
+			ptr += rdlength/*RData*/;
+		}
+	}
+	if (ptr > eom)
+		RETERR(EMSGSIZE);
+	return (ptr - optr);
+}
+
+int
+ns_initparse(const u_char *msg, int msglen, ns_msg *handle) {
+	const u_char *eom = msg + msglen;
+	int i;
+
+	handle->_msg = msg;
+	handle->_eom = eom;
+	if (msg + NS_INT16SZ > eom)
+		RETERR(EMSGSIZE);
+	NS_GET16(handle->_id, msg);
+	if (msg + NS_INT16SZ > eom)
+		RETERR(EMSGSIZE);
+	NS_GET16(handle->_flags, msg);
+	for (i = 0; i < ns_s_max; i++) {
+		if (msg + NS_INT16SZ > eom)
+			RETERR(EMSGSIZE);
+		NS_GET16(handle->_counts[i], msg);
+	}
+	for (i = 0; i < ns_s_max; i++)
+		if (handle->_counts[i] == 0)
+			handle->_sections[i] = NULL;
+		else {
+			int b = ns_skiprr(msg, eom, (ns_sect)i,
+					  handle->_counts[i]);
+
+			if (b < 0)
+				return (-1);
+			handle->_sections[i] = msg;
+			msg += b;
+		}
+	if (msg != eom)
+		RETERR(EMSGSIZE);
+	setsection(handle, ns_s_max);
+	return (0);
+}
+
+int
+ns_parserr(ns_msg *handle, ns_sect section, int rrnum, ns_rr *rr) {
+	int b;
+	int tmp;
+
+	/* Make section right. */
+	tmp = section;
+	if (tmp < 0 || section >= ns_s_max)
+		RETERR(ENODEV);
+	if (section != handle->_sect)
+		setsection(handle, section);
+
+	/* Make rrnum right. */
+	if (rrnum == -1)
+		rrnum = handle->_rrnum;
+	if (rrnum < 0 || rrnum >= handle->_counts[(int)section])
+		RETERR(ENODEV);
+	if (rrnum < handle->_rrnum)
+		setsection(handle, section);
+	if (rrnum > handle->_rrnum) {
+		b = ns_skiprr(handle->_msg_ptr, handle->_eom, section,
+			      rrnum - handle->_rrnum);
+
+		if (b < 0)
+			return (-1);
+		handle->_msg_ptr += b;
+		handle->_rrnum = rrnum;
+	}
+
+	/* Do the parse. */
+	b = dn_expand(handle->_msg, handle->_eom,
+		      handle->_msg_ptr, rr->name, NS_MAXDNAME);
+	if (b < 0)
+		return (-1);
+	handle->_msg_ptr += b;
+	if (handle->_msg_ptr + NS_INT16SZ + NS_INT16SZ > handle->_eom)
+		RETERR(EMSGSIZE);
+	NS_GET16(rr->type, handle->_msg_ptr);
+	NS_GET16(rr->rr_class, handle->_msg_ptr);
+	if (section == ns_s_qd) {
+		rr->ttl = 0;
+		rr->rdlength = 0;
+		rr->rdata = NULL;
+	} else {
+		if (handle->_msg_ptr + NS_INT32SZ + NS_INT16SZ > handle->_eom)
+			RETERR(EMSGSIZE);
+		NS_GET32(rr->ttl, handle->_msg_ptr);
+		NS_GET16(rr->rdlength, handle->_msg_ptr);
+		if (handle->_msg_ptr + rr->rdlength > handle->_eom)
+			RETERR(EMSGSIZE);
+		rr->rdata = handle->_msg_ptr;
+		handle->_msg_ptr += rr->rdlength;
+	}
+	if (++handle->_rrnum > handle->_counts[(int)section])
+		setsection(handle, (ns_sect)((int)section + 1));
+
+	/* All done. */
+	return (0);
+}
+
+/*
+ * This is identical to the above but uses network-format (uncompressed) names.
+ */
+int
+ns_parserr2(ns_msg *handle, ns_sect section, int rrnum, ns_rr2 *rr) {
+	int b;
+	int tmp;
+
+	/* Make section right. */
+	if ((tmp = section) < 0 || section >= ns_s_max)
+		RETERR(ENODEV);
+	if (section != handle->_sect)
+		setsection(handle, section);
+
+	/* Make rrnum right. */
+	if (rrnum == -1)
+		rrnum = handle->_rrnum;
+	if (rrnum < 0 || rrnum >= handle->_counts[(int)section])
+		RETERR(ENODEV);
+	if (rrnum < handle->_rrnum)
+		setsection(handle, section);
+	if (rrnum > handle->_rrnum) {
+		b = ns_skiprr(handle->_msg_ptr, handle->_eom, section,
+			      rrnum - handle->_rrnum);
+
+		if (b < 0)
+			return (-1);
+		handle->_msg_ptr += b;
+		handle->_rrnum = rrnum;
+	}
+
+	/* Do the parse. */
+	b = ns_name_unpack2(handle->_msg, handle->_eom, handle->_msg_ptr,
+			    rr->nname, NS_MAXNNAME, &rr->nnamel);
+	if (b < 0)
+		return (-1);
+	handle->_msg_ptr += b;
+	if (handle->_msg_ptr + NS_INT16SZ + NS_INT16SZ > handle->_eom)
+		RETERR(EMSGSIZE);
+	NS_GET16(rr->type, handle->_msg_ptr);
+	NS_GET16(rr->rr_class, handle->_msg_ptr);
+	if (section == ns_s_qd) {
+		rr->ttl = 0;
+		rr->rdlength = 0;
+		rr->rdata = NULL;
+	} else {
+		if (handle->_msg_ptr + NS_INT32SZ + NS_INT16SZ > handle->_eom)
+			RETERR(EMSGSIZE);
+		NS_GET32(rr->ttl, handle->_msg_ptr);
+		NS_GET16(rr->rdlength, handle->_msg_ptr);
+		if (handle->_msg_ptr + rr->rdlength > handle->_eom)
+			RETERR(EMSGSIZE);
+		rr->rdata = handle->_msg_ptr;
+		handle->_msg_ptr += rr->rdlength;
+	}
+	if (++handle->_rrnum > handle->_counts[(int)section])
+		setsection(handle, (ns_sect)((int)section + 1));
+
+	/* All done. */
+	return (0);
+}
+
+/* Private. */
+
+static void
+setsection(ns_msg *msg, ns_sect sect) {
+	msg->_sect = sect;
+	if (sect == ns_s_max) {
+		msg->_rrnum = -1;
+		msg->_msg_ptr = NULL;
+	} else {
+		msg->_rrnum = 0;
+		msg->_msg_ptr = msg->_sections[(int)sect];
+	}
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_print.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_print.c
new file mode 100644
index 0000000000..e70df376c1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_print.c
@@ -0,0 +1,1242 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_print.c,v 1.12 2009/03/03 05:29:58 each Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <isc/assertions.h>
+#include <isc/dst.h>
+#include <errno.h>
+#include <resolv_joy.h>
+#include <string.h>
+#include <ctype.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+/* Forward. */
+
+static size_t	prune_origin(const char *name, const char *origin);
+static int	charstr(const u_char *rdata, const u_char *edata,
+			char **buf, size_t *buflen);
+static int	addname(const u_char *msg, size_t msglen,
+			const u_char **p, const char *origin,
+			char **buf, size_t *buflen);
+static void	addlen(size_t len, char **buf, size_t *buflen);
+static int	addstr(const char *src, size_t len,
+		       char **buf, size_t *buflen);
+static int	addtab(size_t len, size_t target, int spaced,
+		       char **buf, size_t *buflen);
+
+/* Macros. */
+
+#define	T(x) \
+	do { \
+		if ((x) < 0) \
+			return (-1); \
+	} while (0)
+
+static const char base32hex[] =
+        "0123456789ABCDEFGHIJKLMNOPQRSTUV=0123456789abcdefghijklmnopqrstuv";
+
+/* Public. */
+
+/*%
+ *	Convert an RR to presentation format.
+ *
+ * return:
+ *\li	Number of characters written to buf, or -1 (check errno).
+ */
+int
+ns_sprintrr(const ns_msg *handle, const ns_rr *rr,
+	    const char *name_ctx, const char *origin,
+	    char *buf, size_t buflen)
+{
+	int n;
+
+	n = ns_sprintrrf(ns_msg_base(*handle), ns_msg_size(*handle),
+			 ns_rr_name(*rr), ns_rr_class(*rr), ns_rr_type(*rr),
+			 ns_rr_ttl(*rr), ns_rr_rdata(*rr), ns_rr_rdlen(*rr),
+			 name_ctx, origin, buf, buflen);
+	return (n);
+}
+
+/*%
+ *	Convert the fields of an RR into presentation format.
+ *
+ * return:
+ *\li	Number of characters written to buf, or -1 (check errno).
+ */
+int
+ns_sprintrrf(const u_char *msg, size_t msglen,
+	    const char *name, ns_class class, ns_type type,
+	    u_long ttl, const u_char *rdata, size_t rdlen,
+	    const char *name_ctx, const char *origin,
+	    char *buf, size_t buflen)
+{
+	const char *obuf = buf;
+	const u_char *edata = rdata + rdlen;
+	int spaced = 0;
+
+	const char *comment;
+	char tmp[100];
+	int len, x;
+
+	/*
+	 * Owner.
+	 */
+	if (name_ctx != NULL && ns_samename(name_ctx, name) == 1) {
+		T(addstr("\t\t\t", 3, &buf, &buflen));
+	} else {
+		len = prune_origin(name, origin);
+		if (*name == '\0') {
+			goto root;
+		} else if (len == 0) {
+			T(addstr("@\t\t\t", 4, &buf, &buflen));
+		} else {
+			T(addstr(name, len, &buf, &buflen));
+			/* Origin not used or not root, and no trailing dot? */
+			if (((origin == NULL || origin[0] == '\0') ||
+			    (origin[0] != '.' && origin[1] != '\0' &&
+			    name[len] == '\0')) && name[len - 1] != '.') {
+ root:
+				T(addstr(".", 1, &buf, &buflen));
+				len++;
+			}
+			T(spaced = addtab(len, 24, spaced, &buf, &buflen));
+		}
+	}
+
+	/*
+	 * TTL, Class, Type.
+	 */
+	T(x = ns_format_ttl(ttl, buf, buflen));
+	addlen(x, &buf, &buflen);
+	len = SPRINTF((tmp, " %s %s", p_class(class), p_type(type)));
+	T(addstr(tmp, len, &buf, &buflen));
+	T(spaced = addtab(x + len, 16, spaced, &buf, &buflen));
+
+	/*
+	 * RData.
+	 */
+	switch (type) {
+	case ns_t_a:
+		if (rdlen != (size_t)NS_INADDRSZ)
+			goto formerr;
+		(void) inet_ntop(AF_INET, rdata, buf, buflen);
+		addlen(strlen(buf), &buf, &buflen);
+		break;
+
+	case ns_t_cname:
+	case ns_t_mb:
+	case ns_t_mg:
+	case ns_t_mr:
+	case ns_t_ns:
+	case ns_t_ptr:
+	case ns_t_dname:
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		break;
+
+	case ns_t_hinfo:
+	case ns_t_isdn:
+		/* First word. */
+		T(len = charstr(rdata, edata, &buf, &buflen));
+		if (len == 0)
+			goto formerr;
+		rdata += len;
+		T(addstr(" ", 1, &buf, &buflen));
+
+		    
+		/* Second word, optional in ISDN records. */
+		if (type == ns_t_isdn && rdata == edata)
+			break;
+		    
+		T(len = charstr(rdata, edata, &buf, &buflen));
+		if (len == 0)
+			goto formerr;
+		rdata += len;
+		break;
+
+	case ns_t_soa: {
+		u_long t;
+
+		/* Server name. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		T(addstr(" ", 1, &buf, &buflen));
+
+		/* Administrator name. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		T(addstr(" (\n", 3, &buf, &buflen));
+		spaced = 0;
+
+		if ((edata - rdata) != 5*NS_INT32SZ)
+			goto formerr;
+
+		/* Serial number. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		T(addstr("\t\t\t\t\t", 5, &buf, &buflen));
+		len = SPRINTF((tmp, "%lu", t));
+		T(addstr(tmp, len, &buf, &buflen));
+		T(spaced = addtab(len, 16, spaced, &buf, &buflen));
+		T(addstr("; serial\n", 9, &buf, &buflen));
+		spaced = 0;
+
+		/* Refresh interval. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		T(addstr("\t\t\t\t\t", 5, &buf, &buflen));
+		T(len = ns_format_ttl(t, buf, buflen));
+		addlen(len, &buf, &buflen);
+		T(spaced = addtab(len, 16, spaced, &buf, &buflen));
+		T(addstr("; refresh\n", 10, &buf, &buflen));
+		spaced = 0;
+
+		/* Retry interval. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		T(addstr("\t\t\t\t\t", 5, &buf, &buflen));
+		T(len = ns_format_ttl(t, buf, buflen));
+		addlen(len, &buf, &buflen);
+		T(spaced = addtab(len, 16, spaced, &buf, &buflen));
+		T(addstr("; retry\n", 8, &buf, &buflen));
+		spaced = 0;
+
+		/* Expiry. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		T(addstr("\t\t\t\t\t", 5, &buf, &buflen));
+		T(len = ns_format_ttl(t, buf, buflen));
+		addlen(len, &buf, &buflen);
+		T(spaced = addtab(len, 16, spaced, &buf, &buflen));
+		T(addstr("; expiry\n", 9, &buf, &buflen));
+		spaced = 0;
+
+		/* Minimum TTL. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		T(addstr("\t\t\t\t\t", 5, &buf, &buflen));
+		T(len = ns_format_ttl(t, buf, buflen));
+		addlen(len, &buf, &buflen);
+		T(addstr(" )", 2, &buf, &buflen));
+		T(spaced = addtab(len, 16, spaced, &buf, &buflen));
+		T(addstr("; minimum\n", 10, &buf, &buflen));
+
+		break;
+	    }
+
+	case ns_t_mx:
+	case ns_t_afsdb:
+	case ns_t_rt:
+	case ns_t_kx: {
+		u_int t;
+
+		if (rdlen < (size_t)NS_INT16SZ)
+			goto formerr;
+
+		/* Priority. */
+		t = ns_get16(rdata);
+		rdata += NS_INT16SZ;
+		len = SPRINTF((tmp, "%u ", t));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Target. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+
+		break;
+	    }
+
+	case ns_t_px: {
+		u_int t;
+
+		if (rdlen < (size_t)NS_INT16SZ)
+			goto formerr;
+
+		/* Priority. */
+		t = ns_get16(rdata);
+		rdata += NS_INT16SZ;
+		len = SPRINTF((tmp, "%u ", t));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Name1. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		T(addstr(" ", 1, &buf, &buflen));
+
+		/* Name2. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+
+		break;
+	    }
+
+	case ns_t_x25:
+		T(len = charstr(rdata, edata, &buf, &buflen));
+		if (len == 0)
+			goto formerr;
+		rdata += len;
+		break;
+
+	case ns_t_txt:
+	case ns_t_spf:
+		while (rdata < edata) {
+			T(len = charstr(rdata, edata, &buf, &buflen));
+			if (len == 0)
+				goto formerr;
+			rdata += len;
+			if (rdata < edata)
+				T(addstr(" ", 1, &buf, &buflen));
+		}
+		break;
+
+	case ns_t_nsap: {
+		char t[2+255*3];
+
+		(void) inet_nsap_ntoa(rdlen, rdata, t);
+		T(addstr(t, strlen(t), &buf, &buflen));
+		break;
+	    }
+
+	case ns_t_aaaa:
+		if (rdlen != (size_t)NS_IN6ADDRSZ)
+			goto formerr;
+		(void) inet_ntop(AF_INET6, rdata, buf, buflen);
+		addlen(strlen(buf), &buf, &buflen);
+		break;
+
+	case ns_t_loc: {
+		char t[255];
+
+		/* XXX protocol format checking? */
+		(void) loc_ntoa(rdata, t);
+		T(addstr(t, strlen(t), &buf, &buflen));
+		break;
+	    }
+
+	case ns_t_naptr: {
+		u_int order, preference;
+		char t[50];
+
+		if (rdlen < 2U*NS_INT16SZ)
+			goto formerr;
+
+		/* Order, Precedence. */
+		order = ns_get16(rdata);	rdata += NS_INT16SZ;
+		preference = ns_get16(rdata);	rdata += NS_INT16SZ;
+		len = SPRINTF((t, "%u %u ", order, preference));
+		T(addstr(t, len, &buf, &buflen));
+
+		/* Flags. */
+		T(len = charstr(rdata, edata, &buf, &buflen));
+		if (len == 0)
+			goto formerr;
+		rdata += len;
+		T(addstr(" ", 1, &buf, &buflen));
+
+		/* Service. */
+		T(len = charstr(rdata, edata, &buf, &buflen));
+		if (len == 0)
+			goto formerr;
+		rdata += len;
+		T(addstr(" ", 1, &buf, &buflen));
+
+		/* Regexp. */
+		T(len = charstr(rdata, edata, &buf, &buflen));
+		if (len < 0)
+			return (-1);
+		if (len == 0)
+			goto formerr;
+		rdata += len;
+		T(addstr(" ", 1, &buf, &buflen));
+
+		/* Server. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		break;
+	    }
+
+	case ns_t_srv: {
+		u_int priority, weight, port;
+		char t[50];
+
+		if (rdlen < 3U*NS_INT16SZ)
+			goto formerr;
+
+		/* Priority, Weight, Port. */
+		priority = ns_get16(rdata);  rdata += NS_INT16SZ;
+		weight   = ns_get16(rdata);  rdata += NS_INT16SZ;
+		port     = ns_get16(rdata);  rdata += NS_INT16SZ;
+		len = SPRINTF((t, "%u %u %u ", priority, weight, port));
+		T(addstr(t, len, &buf, &buflen));
+
+		/* Server. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		break;
+	    }
+
+	case ns_t_minfo:
+	case ns_t_rp:
+		/* Name1. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		T(addstr(" ", 1, &buf, &buflen));
+
+		/* Name2. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+
+		break;
+
+	case ns_t_wks: {
+		int n, lcnt;
+
+		if (rdlen < 1U + NS_INT32SZ)
+			goto formerr;
+
+		/* Address. */
+		(void) inet_ntop(AF_INET, rdata, buf, buflen);
+		addlen(strlen(buf), &buf, &buflen);
+		rdata += NS_INADDRSZ;
+
+		/* Protocol. */
+		len = SPRINTF((tmp, " %u ( ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata += NS_INT8SZ;
+
+		/* Bit map. */
+		n = 0;
+		lcnt = 0;
+		while (rdata < edata) {
+			u_int c = *rdata++;
+			do {
+				if (c & 0200) {
+					if (lcnt == 0) {
+						T(addstr("\n\t\t\t\t", 5,
+							 &buf, &buflen));
+						lcnt = 10;
+						spaced = 0;
+					}
+					len = SPRINTF((tmp, "%d ", n));
+					T(addstr(tmp, len, &buf, &buflen));
+					lcnt--;
+				}
+				c <<= 1;
+			} while (++n & 07);
+		}
+		T(addstr(")", 1, &buf, &buflen));
+
+		break;
+	    }
+
+	case ns_t_key:
+	case ns_t_dnskey: {
+		char base64_key[NS_MD5RSA_MAX_BASE64];
+		u_int keyflags, protocol, algorithm, key_id;
+		const char *leader;
+		int n;
+
+		if (rdlen < 0U + NS_INT16SZ + NS_INT8SZ + NS_INT8SZ)
+			goto formerr;
+
+		/* Key flags, Protocol, Algorithm. */
+		key_id = dst_s_dns_key_id(rdata, edata-rdata);
+		keyflags = ns_get16(rdata);  rdata += NS_INT16SZ;
+		protocol = *rdata++;
+		algorithm = *rdata++;
+		len = SPRINTF((tmp, "0x%04x %u %u",
+			       keyflags, protocol, algorithm));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Public key data. */
+		len = b64_ntop(rdata, edata - rdata,
+			       base64_key, sizeof base64_key);
+		if (len < 0)
+			goto formerr;
+		if (len > 15) {
+			T(addstr(" (", 2, &buf, &buflen));
+			leader = "\n\t\t";
+			spaced = 0;
+		} else
+			leader = " ";
+		for (n = 0; n < len; n += 48) {
+			T(addstr(leader, strlen(leader), &buf, &buflen));
+			T(addstr(base64_key + n, MIN(len - n, 48),
+				 &buf, &buflen));
+		}
+		if (len > 15)
+			T(addstr(" )", 2, &buf, &buflen));
+		n = SPRINTF((tmp, " ; key_tag= %u", key_id));
+		T(addstr(tmp, n, &buf, &buflen));
+
+		break;
+	    }
+
+	case ns_t_sig:
+	case ns_t_rrsig: {
+		char base64_key[NS_MD5RSA_MAX_BASE64];
+		u_int type, algorithm, labels, footprint;
+		const char *leader;
+		u_long t;
+		int n;
+
+		if (rdlen < 22U)
+			goto formerr;
+
+		/* Type covered, Algorithm, Label count, Original TTL. */
+		type = ns_get16(rdata);  rdata += NS_INT16SZ;
+		algorithm = *rdata++;
+		labels = *rdata++;
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		len = SPRINTF((tmp, "%s %d %d %lu ",
+			       p_type(type), algorithm, labels, t));
+		T(addstr(tmp, len, &buf, &buflen));
+		if (labels > (u_int)dn_count_labels(name))
+			goto formerr;
+
+		/* Signature expiry. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Time signed. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Signature Footprint. */
+		footprint = ns_get16(rdata);  rdata += NS_INT16SZ;
+		len = SPRINTF((tmp, "%u ", footprint));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Signer's name. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+
+		/* Signature. */
+		len = b64_ntop(rdata, edata - rdata,
+			       base64_key, sizeof base64_key);
+		if (len > 15) {
+			T(addstr(" (", 2, &buf, &buflen));
+			leader = "\n\t\t";
+			spaced = 0;
+		} else
+			leader = " ";
+		if (len < 0)
+			goto formerr;
+		for (n = 0; n < len; n += 48) {
+			T(addstr(leader, strlen(leader), &buf, &buflen));
+			T(addstr(base64_key + n, MIN(len - n, 48),
+				 &buf, &buflen));
+		}
+		if (len > 15)
+			T(addstr(" )", 2, &buf, &buflen));
+		break;
+	    }
+
+	case ns_t_nxt: {
+		int n, c;
+
+		/* Next domain name. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+
+		/* Type bit map. */
+		n = edata - rdata;
+		for (c = 0; c < n*8; c++)
+			if (NS_NXT_BIT_ISSET(c, rdata)) {
+				len = SPRINTF((tmp, " %s", p_type(c)));
+				T(addstr(tmp, len, &buf, &buflen));
+			}
+		break;
+	    }
+
+	case ns_t_cert: {
+		u_int c_type, key_tag, alg;
+		int n;
+		unsigned int siz;
+		char base64_cert[8192], tmp[40];
+		const char *leader;
+
+		c_type  = ns_get16(rdata); rdata += NS_INT16SZ;
+		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
+		alg = (u_int) *rdata++;
+
+		len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
+		T(addstr(tmp, len, &buf, &buflen));
+		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+		if (siz > sizeof(base64_cert) * 3/4) {
+			const char *str = "record too long to print";
+			T(addstr(str, strlen(str), &buf, &buflen));
+		}
+		else {
+			len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
+
+			if (len < 0)
+				goto formerr;
+			else if (len > 15) {
+				T(addstr(" (", 2, &buf, &buflen));
+				leader = "\n\t\t";
+				spaced = 0;
+			}
+			else
+				leader = " ";
+	
+			for (n = 0; n < len; n += 48) {
+				T(addstr(leader, strlen(leader),
+					 &buf, &buflen));
+				T(addstr(base64_cert + n, MIN(len - n, 48),
+					 &buf, &buflen));
+			}
+			if (len > 15)
+				T(addstr(" )", 2, &buf, &buflen));
+		}
+		break;
+	    }
+
+	case ns_t_tkey: {
+		/* KJD - need to complete this */
+		u_long t;
+		int mode, err, keysize;
+
+		/* Algorithm name. */
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		T(addstr(" ", 1, &buf, &buflen));
+
+		/* Inception. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Experation. */
+		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* Mode , Error, Key Size. */
+		/* Priority, Weight, Port. */
+		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
+		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
+		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
+		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		/* XXX need to dump key, print otherdata length & other data */
+		break;
+	    }
+
+	case ns_t_tsig: {
+		/* BEW - need to complete this */
+		int n;
+
+		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		T(addstr(" ", 1, &buf, &buflen));
+		rdata += 8; /*%< time */
+		n = ns_get16(rdata); rdata += INT16SZ;
+		rdata += n; /*%< sig */
+		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
+		sprintf(buf, "%d", ns_get16(rdata));
+		rdata += INT16SZ;
+		addlen(strlen(buf), &buf, &buflen);
+		break;
+	    }
+
+	case ns_t_a6: {
+		struct in6_addr a;
+		int pbyte, pbit;
+
+		/* prefix length */
+		if (rdlen == 0U) goto formerr;
+		len = SPRINTF((tmp, "%d ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		pbit = *rdata;
+		if (pbit > 128) goto formerr;
+		pbyte = (pbit & ~7) / 8;
+		rdata++;
+
+		/* address suffix: provided only when prefix len != 128 */
+		if (pbit < 128) {
+			if (rdata + pbyte >= edata) goto formerr;
+			memset(&a, 0, sizeof(a));
+			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
+			(void) inet_ntop(AF_INET6, &a, buf, buflen);
+			addlen(strlen(buf), &buf, &buflen);
+			rdata += sizeof(a) - pbyte;
+		}
+
+		/* prefix name: provided only when prefix len > 0 */
+		if (pbit == 0)
+			break;
+		if (rdata >= edata) goto formerr;
+		T(addstr(" ", 1, &buf, &buflen));
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+		
+		break;
+	    }
+
+	case ns_t_opt: {
+		len = SPRINTF((tmp, "%u bytes", class));
+		T(addstr(tmp, len, &buf, &buflen));
+		break;
+	    }
+
+	case ns_t_ds:
+	case ns_t_dlv:
+	case ns_t_sshfp: {
+		u_int t;
+
+		if (type == ns_t_ds || type == ns_t_dlv) {
+			if (rdlen < 4U) goto formerr;
+			t = ns_get16(rdata);
+			rdata += NS_INT16SZ;
+			len = SPRINTF((tmp, "%u ", t));
+			T(addstr(tmp, len, &buf, &buflen));
+		} else
+			if (rdlen < 2U) goto formerr;
+
+		len = SPRINTF((tmp, "%u ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata++;
+
+		len = SPRINTF((tmp, "%u ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata++;
+
+		while (rdata < edata) {
+			len = SPRINTF((tmp, "%02X", *rdata));
+			T(addstr(tmp, len, &buf, &buflen));
+			rdata++;
+		}
+		break;
+	    }
+
+	case ns_t_nsec3:
+	case ns_t_nsec3param: {
+		u_int t, w, l, j, k, c;
+		
+		len = SPRINTF((tmp, "%u ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata++;
+
+		len = SPRINTF((tmp, "%u ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata++;
+
+		t = ns_get16(rdata);
+		rdata += NS_INT16SZ;
+		len = SPRINTF((tmp, "%u ", t));
+		T(addstr(tmp, len, &buf, &buflen));
+
+		t = *rdata++;
+		if (t == 0) {
+			T(addstr("-", 1, &buf, &buflen));
+		} else {
+			while (t-- > 0) {
+				len = SPRINTF((tmp, "%02X", *rdata));
+				T(addstr(tmp, len, &buf, &buflen));
+				rdata++;
+			}
+		}
+		if (type == ns_t_nsec3param)
+			break;
+		T(addstr(" ", 1, &buf, &buflen));
+
+		t = *rdata++;
+		while (t > 0) {
+			switch (t) {
+			case 1:
+				tmp[0] = base32hex[((rdata[0]>>3)&0x1f)];
+				tmp[1] = base32hex[((rdata[0]<<2)&0x1c)];
+				tmp[2] = tmp[3] = tmp[4] = '=';
+				tmp[5] = tmp[6] = tmp[7] = '=';
+				break;
+			case 2:
+				tmp[0] = base32hex[((rdata[0]>>3)&0x1f)];
+				tmp[1] = base32hex[((rdata[0]<<2)&0x1c)|
+						   ((rdata[1]>>6)&0x03)];
+				tmp[2] = base32hex[((rdata[1]>>1)&0x1f)];
+				tmp[3] = base32hex[((rdata[1]<<4)&0x10)];
+				tmp[4] = tmp[5] = tmp[6] = tmp[7] = '=';
+				break;
+			case 3:
+				tmp[0] = base32hex[((rdata[0]>>3)&0x1f)];
+				tmp[1] = base32hex[((rdata[0]<<2)&0x1c)|
+						   ((rdata[1]>>6)&0x03)];
+				tmp[2] = base32hex[((rdata[1]>>1)&0x1f)];
+				tmp[3] = base32hex[((rdata[1]<<4)&0x10)|
+						   ((rdata[2]>>4)&0x0f)];
+				tmp[4] = base32hex[((rdata[2]<<1)&0x1e)];
+				tmp[5] = tmp[6] = tmp[7] = '=';
+				break;
+			case 4:
+				tmp[0] = base32hex[((rdata[0]>>3)&0x1f)];
+				tmp[1] = base32hex[((rdata[0]<<2)&0x1c)|
+						   ((rdata[1]>>6)&0x03)];
+				tmp[2] = base32hex[((rdata[1]>>1)&0x1f)];
+				tmp[3] = base32hex[((rdata[1]<<4)&0x10)|
+						   ((rdata[2]>>4)&0x0f)];
+				tmp[4] = base32hex[((rdata[2]<<1)&0x1e)|
+						   ((rdata[3]>>7)&0x01)];
+				tmp[5] = base32hex[((rdata[3]>>2)&0x1f)];
+				tmp[6] = base32hex[(rdata[3]<<3)&0x18];
+				tmp[7] = '=';
+				break;
+			default:
+				tmp[0] = base32hex[((rdata[0]>>3)&0x1f)];
+				tmp[1] = base32hex[((rdata[0]<<2)&0x1c)|
+						   ((rdata[1]>>6)&0x03)];
+				tmp[2] = base32hex[((rdata[1]>>1)&0x1f)];
+				tmp[3] = base32hex[((rdata[1]<<4)&0x10)|
+						   ((rdata[2]>>4)&0x0f)];
+				tmp[4] = base32hex[((rdata[2]<<1)&0x1e)|
+						   ((rdata[3]>>7)&0x01)];
+				tmp[5] = base32hex[((rdata[3]>>2)&0x1f)];
+				tmp[6] = base32hex[((rdata[3]<<3)&0x18)|
+						   ((rdata[4]>>5)&0x07)];
+				tmp[7] = base32hex[(rdata[4]&0x1f)];
+				break;
+			}
+			T(addstr(tmp, 8, &buf, &buflen));
+			if (t >= 5) {
+				rdata += 5;
+				t -= 5;
+			} else {
+				rdata += t;
+				t -= t;
+			}
+		}
+
+		while (rdata < edata) {
+			w = *rdata++;
+			l = *rdata++;
+			for (j = 0; j < l; j++) {
+				if (rdata[j] == 0)
+					continue;
+				for (k = 0; k < 8; k++) {
+					if ((rdata[j] & (0x80 >> k)) == 0)
+						continue;
+					c = w * 256 + j * 8 + k;
+					len = SPRINTF((tmp, " %s", p_type(c)));
+					T(addstr(tmp, len, &buf, &buflen));
+				}
+			}
+			rdata += l;
+		}
+		break;
+	    }
+
+	case ns_t_nsec: {
+		u_int w, l, j, k, c;
+
+		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+
+		while (rdata < edata) {
+			w = *rdata++;
+			l = *rdata++;
+			for (j = 0; j < l; j++) {
+				if (rdata[j] == 0)
+					continue;
+				for (k = 0; k < 8; k++) {
+					if ((rdata[j] & (0x80 >> k)) == 0)
+						continue;
+					c = w * 256 + j * 8 + k;
+					len = SPRINTF((tmp, " %s", p_type(c)));
+					T(addstr(tmp, len, &buf, &buflen));
+				}
+			}
+			rdata += l;
+		}
+		break;
+	    }
+
+	case ns_t_dhcid: {
+		int n;
+		unsigned int siz;
+		char base64_dhcid[8192];
+		const char *leader;
+
+		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+		if (siz > sizeof(base64_dhcid) * 3/4) {
+			const char *str = "record too long to print";
+			T(addstr(str, strlen(str), &buf, &buflen));
+		} else {
+			len = b64_ntop(rdata, edata-rdata, base64_dhcid, siz);
+		
+			if (len < 0)
+				goto formerr;
+
+			else if (len > 15) {
+				T(addstr(" (", 2, &buf, &buflen));
+				leader = "\n\t\t";
+				spaced = 0;
+			}
+			else
+				leader = " ";
+
+			for (n = 0; n < len; n += 48) {
+				T(addstr(leader, strlen(leader),
+					 &buf, &buflen));
+				T(addstr(base64_dhcid + n, MIN(len - n, 48),
+					 &buf, &buflen));
+			}
+			if (len > 15)
+				T(addstr(" )", 2, &buf, &buflen));
+		}
+	}
+
+	case ns_t_ipseckey: {
+		int n;
+		unsigned int siz;
+		char base64_key[8192];
+		const char *leader;
+	
+		if (rdlen < 2)
+			goto formerr;
+
+		switch (rdata[1]) {
+		case 0:
+		case 3:
+			if (rdlen < 3)
+				goto formerr;
+			break;
+		case 1:
+			if (rdlen < 7)
+				goto formerr;
+			break;
+		case 2:
+			if (rdlen < 19)
+				goto formerr;
+			break;
+		default:
+			comment = "unknown IPSECKEY gateway type";
+			goto hexify;
+		}
+
+		len = SPRINTF((tmp, "%u ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata++;
+
+		len = SPRINTF((tmp, "%u ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata++;
+		
+		len = SPRINTF((tmp, "%u ", *rdata));
+		T(addstr(tmp, len, &buf, &buflen));
+		rdata++;
+
+		switch (rdata[-2]) {
+		case 0:
+			T(addstr(".", 1, &buf, &buflen));
+			break;
+		case 1:
+			(void) inet_ntop(AF_INET, rdata, buf, buflen);
+			addlen(strlen(buf), &buf, &buflen);
+			rdata += 4;
+			break;
+		case 2:
+			(void) inet_ntop(AF_INET6, rdata, buf, buflen);
+			addlen(strlen(buf), &buf, &buflen);
+			rdata += 16;
+			break;
+		case 3:
+			T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+			break;
+		}
+
+		if (rdata >= edata)
+			break;
+
+		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+		if (siz > sizeof(base64_key) * 3/4) {
+			const char *str = "record too long to print";
+			T(addstr(str, strlen(str), &buf, &buflen));
+		} else {
+			len = b64_ntop(rdata, edata-rdata, base64_key, siz);
+
+			if (len < 0)
+				goto formerr;
+
+			else if (len > 15) {
+				T(addstr(" (", 2, &buf, &buflen));
+				leader = "\n\t\t";
+				spaced = 0;
+			}
+			else
+				leader = " ";
+
+			for (n = 0; n < len; n += 48) {
+				T(addstr(leader, strlen(leader),
+					 &buf, &buflen));
+				T(addstr(base64_key + n, MIN(len - n, 48),
+					 &buf, &buflen));
+			}
+			if (len > 15)
+				T(addstr(" )", 2, &buf, &buflen));
+		}
+	}
+
+	case ns_t_hip: {
+		unsigned int i, hip_len, algorithm, key_len;
+		char base64_key[NS_MD5RSA_MAX_BASE64];
+		unsigned int siz;
+		const char *leader = "\n\t\t\t\t\t";
+		
+		hip_len = *rdata++;
+		algorithm = *rdata++;
+		key_len = ns_get16(rdata);
+		rdata += NS_INT16SZ;
+
+		siz = key_len*4/3 + 4; /* "+4" accounts for trailing \0 */
+		if (siz > sizeof(base64_key) * 3/4) {
+			const char *str = "record too long to print";
+			T(addstr(str, strlen(str), &buf, &buflen));
+		} else {
+			len = sprintf(tmp, "( %u ", algorithm);
+			T(addstr(tmp, len, &buf, &buflen));
+
+			for (i = 0; i < hip_len; i++) {
+				len = sprintf(tmp, "%02X", *rdata);
+				T(addstr(tmp, len, &buf, &buflen));
+				rdata++;
+			}
+			T(addstr(leader, strlen(leader), &buf, &buflen));
+
+			len = b64_ntop(rdata, key_len, base64_key, siz);
+			if (len < 0)
+				goto formerr;
+
+			T(addstr(base64_key, len, &buf, &buflen));
+				
+			rdata += key_len;
+			while (rdata < edata) {
+				T(addstr(leader, strlen(leader), &buf, &buflen));
+				T(addname(msg, msglen, &rdata, origin,
+					  &buf, &buflen));
+			}
+			T(addstr(" )", 2, &buf, &buflen));
+		}
+		break;
+	}
+
+	default:
+		comment = "unknown RR type";
+		goto hexify;
+	}
+	return (buf - obuf);
+ formerr:
+	comment = "RR format error";
+ hexify: {
+	int n, m;
+	char *p;
+
+	len = SPRINTF((tmp, "\\# %u%s\t; %s", (unsigned)(edata - rdata),
+		       rdlen != 0U ? " (" : "", comment));
+	T(addstr(tmp, len, &buf, &buflen));
+	while (rdata < edata) {
+		p = tmp;
+		p += SPRINTF((p, "\n\t"));
+		spaced = 0;
+		n = MIN(16, edata - rdata);
+		for (m = 0; m < n; m++)
+			p += SPRINTF((p, "%02x ", rdata[m]));
+		T(addstr(tmp, p - tmp, &buf, &buflen));
+		if (n < 16) {
+			T(addstr(")", 1, &buf, &buflen));
+			T(addtab(p - tmp + 1, 48, spaced, &buf, &buflen));
+		}
+		p = tmp;
+		p += SPRINTF((p, "; "));
+		for (m = 0; m < n; m++)
+			*p++ = (isascii(rdata[m]) && isprint(rdata[m]))
+				? rdata[m]
+				: '.';
+		T(addstr(tmp, p - tmp, &buf, &buflen));
+		rdata += n;
+	}
+	return (buf - obuf);
+    }
+}
+
+/* Private. */
+
+/*%
+ * size_t
+ * prune_origin(name, origin)
+ *	Find out if the name is at or under the current origin.
+ * return:
+ *	Number of characters in name before start of origin,
+ *	or length of name if origin does not match.
+ * notes:
+ *	This function should share code with samedomain().
+ */
+static size_t
+prune_origin(const char *name, const char *origin) {
+	const char *oname = name;
+
+	while (*name != '\0') {
+		if (origin != NULL && ns_samename(name, origin) == 1)
+			return (name - oname - (name > oname));
+		while (*name != '\0') {
+			if (*name == '\\') {
+				name++;
+				/* XXX need to handle \nnn form. */
+				if (*name == '\0')
+					break;
+			} else if (*name == '.') {
+				name++;
+				break;
+			}
+			name++;
+		}
+	}
+	return (name - oname);
+}
+
+/*%
+ * int
+ * charstr(rdata, edata, buf, buflen)
+ *	Format a <character-string> into the presentation buffer.
+ * return:
+ *	Number of rdata octets consumed
+ *	0 for protocol format error
+ *	-1 for output buffer error
+ * side effects:
+ *	buffer is advanced on success.
+ */
+static int
+charstr(const u_char *rdata, const u_char *edata, char **buf, size_t *buflen) {
+	const u_char *odata = rdata;
+	size_t save_buflen = *buflen;
+	char *save_buf = *buf;
+
+	if (addstr("\"", 1, buf, buflen) < 0)
+		goto enospc;
+	if (rdata < edata) {
+		int n = *rdata;
+
+		if (rdata + 1 + n <= edata) {
+			rdata++;
+			while (n-- > 0) {
+				if (strchr("\n\"\\", *rdata) != NULL)
+					if (addstr("\\", 1, buf, buflen) < 0)
+						goto enospc;
+				if (addstr((const char *)rdata, 1,
+					   buf, buflen) < 0)
+					goto enospc;
+				rdata++;
+			}
+		}
+	}
+	if (addstr("\"", 1, buf, buflen) < 0)
+		goto enospc;
+	return (rdata - odata);
+ enospc:
+	errno = ENOSPC;
+	*buf = save_buf;
+	*buflen = save_buflen;
+	return (-1);
+}
+
+static int
+addname(const u_char *msg, size_t msglen,
+	const u_char **pp, const char *origin,
+	char **buf, size_t *buflen)
+{
+	size_t newlen, save_buflen = *buflen;
+	char *save_buf = *buf;
+	int n;
+
+	n = dn_expand(msg, msg + msglen, *pp, *buf, *buflen);
+	if (n < 0)
+		goto enospc;	/*%< Guess. */
+	newlen = prune_origin(*buf, origin);
+	if (**buf == '\0') {
+		goto root;
+	} else if (newlen == 0U) {
+		/* Use "@" instead of name. */
+		if (newlen + 2 > *buflen)
+			goto enospc;        /* No room for "@\0". */
+		(*buf)[newlen++] = '@';
+		(*buf)[newlen] = '\0';
+	} else {
+		if (((origin == NULL || origin[0] == '\0') ||
+		    (origin[0] != '.' && origin[1] != '\0' &&
+		    (*buf)[newlen] == '\0')) && (*buf)[newlen - 1] != '.') {
+			/* No trailing dot. */
+ root:
+			if (newlen + 2 > *buflen)
+				goto enospc;	/* No room for ".\0". */
+			(*buf)[newlen++] = '.';
+			(*buf)[newlen] = '\0';
+		}
+	}
+	*pp += n;
+	addlen(newlen, buf, buflen);
+	**buf = '\0';
+	return (newlen);
+ enospc:
+	errno = ENOSPC;
+	*buf = save_buf;
+	*buflen = save_buflen;
+	return (-1);
+}
+
+static void
+addlen(size_t len, char **buf, size_t *buflen) {
+	INSIST(len <= *buflen);
+	*buf += len;
+	*buflen -= len;
+}
+
+static int
+addstr(const char *src, size_t len, char **buf, size_t *buflen) {
+	if (len >= *buflen) {
+		errno = ENOSPC;
+		return (-1);
+	}
+	memcpy(*buf, src, len);
+	addlen(len, buf, buflen);
+	**buf = '\0';
+	return (0);
+}
+
+static int
+addtab(size_t len, size_t target, int spaced, char **buf, size_t *buflen) {
+	size_t save_buflen = *buflen;
+	char *save_buf = *buf;
+	int t;
+
+	if (spaced || len >= target - 1) {
+		T(addstr("  ", 2, buf, buflen));
+		spaced = 1;
+	} else {
+		for (t = (target - len - 1) / 8; t >= 0; t--)
+			if (addstr("\t", 1, buf, buflen) < 0) {
+				*buflen = save_buflen;
+				*buf = save_buf;
+				return (-1);
+			}
+		spaced = 0;
+	}
+	return (spaced);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_rdata.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_rdata.c
new file mode 100644
index 0000000000..eac4052278
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_rdata.c
@@ -0,0 +1,300 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_rdata.c,v 1.2 2009/01/23 23:49:15 tbox Exp $";
+#endif
+
+#include "port_before.h"
+
+#if __OpenBSD__
+#include <sys/types.h>
+#endif
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <resolv_joy.h>
+#include <string.h>
+
+#include "port_after.h"
+
+#define CONSUME_SRC \
+	do { \
+		rdata += n, rdlen -= n; \
+	} while (0)
+
+#define CONSUME_DST \
+	do { \
+		nrdata += n, nrdsiz -= n, nrdlen += n; \
+	} while (0)
+
+#define UNPACK_DNAME \
+	do { \
+		size_t t; \
+		\
+		if ((n = ns_name_unpack2(msg,eom,rdata,nrdata,nrdsiz,&t))<0) {\
+			errno = EMSGSIZE; \
+			return (-1); \
+		} \
+		CONSUME_SRC; \
+		n = t; \
+		CONSUME_DST; \
+	} while (0)
+
+#define UNPACK_SOME(x) \
+	do { \
+		n = (x); \
+		if ((size_t)n > rdlen || (size_t)n > nrdsiz) { \
+			errno = EMSGSIZE; \
+			return (-1); \
+		} \
+		memcpy(nrdata, rdata, n); \
+		CONSUME_SRC; CONSUME_DST; \
+	} while (0)
+
+#define	UNPACK_REST(x) \
+	do { \
+		n = (x); \
+		if ((size_t)n != rdlen) { \
+			errno = EMSGSIZE; \
+			return (-1); \
+		} \
+		memcpy(nrdata, rdata, n); \
+		CONSUME_SRC; CONSUME_DST; \
+	} while (0)
+
+ssize_t
+ns_rdata_unpack(const u_char *msg, const u_char *eom,
+		ns_type type, const u_char *rdata, size_t rdlen,
+		u_char *nrdata, size_t nrdsiz)
+{
+	size_t nrdlen = 0;
+	int n;
+
+	switch (type) {
+	case ns_t_a:
+		UNPACK_REST(NS_INADDRSZ);
+		break;
+	case ns_t_aaaa:
+		UNPACK_REST(NS_IN6ADDRSZ);
+		break;
+	case ns_t_cname:
+	case ns_t_mb:
+	case ns_t_mg:
+	case ns_t_mr:
+	case ns_t_ns:
+	case ns_t_ptr:
+	case ns_t_dname:
+		UNPACK_DNAME;
+		break;
+	case ns_t_soa:
+		UNPACK_DNAME;
+		UNPACK_DNAME;
+		UNPACK_SOME(NS_INT32SZ * 5);
+		break;
+	case ns_t_mx:
+	case ns_t_afsdb:
+	case ns_t_rt:
+		UNPACK_SOME(NS_INT16SZ);
+		UNPACK_DNAME;
+		break;
+	case ns_t_px:
+		UNPACK_SOME(NS_INT16SZ);
+		UNPACK_DNAME;
+		UNPACK_DNAME;
+		break;
+	case ns_t_srv:
+		UNPACK_SOME(NS_INT16SZ * 3);
+		UNPACK_DNAME;
+		break;
+	case ns_t_minfo:
+	case ns_t_rp:
+		UNPACK_DNAME;
+		UNPACK_DNAME;
+		break;
+	default:
+		UNPACK_SOME(rdlen);
+		break;
+	}
+	if (rdlen > 0) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	return (nrdlen);
+}
+
+#define	EQUAL_CONSUME \
+	do { \
+		rdata1 += n, rdlen1 -= n; \
+		rdata2 += n, rdlen2 -= n; \
+	} while (0)
+
+#define	EQUAL_DNAME \
+	do { \
+		ssize_t n; \
+		\
+		if (rdlen1 != rdlen2) \
+			return (0); \
+		n = ns_name_eq(rdata1, rdlen1, rdata2, rdlen2); \
+		if (n <= 0) \
+			return (n); \
+		n = rdlen1; \
+		EQUAL_CONSUME; \
+	} while (0)
+
+#define	EQUAL_SOME(x) \
+	do { \
+		size_t n = (x); \
+		\
+		if (n > rdlen1 || n > rdlen2) { \
+			errno = EMSGSIZE; \
+			return (-1); \
+		} \
+		if (memcmp(rdata1, rdata2, n) != 0) \
+			return (0); \
+		EQUAL_CONSUME; \
+	} while (0)
+
+int
+ns_rdata_equal(ns_type type,
+	       const u_char *rdata1, size_t rdlen1,
+	       const u_char *rdata2, size_t rdlen2)
+{
+	switch (type) {
+	case ns_t_cname:
+	case ns_t_mb:
+	case ns_t_mg:
+	case ns_t_mr:
+	case ns_t_ns:
+	case ns_t_ptr:
+	case ns_t_dname:
+		EQUAL_DNAME;
+		break;
+	case ns_t_soa:
+		/* "There can be only one." --Highlander */
+		break;
+	case ns_t_mx:
+	case ns_t_afsdb:
+	case ns_t_rt:
+		EQUAL_SOME(NS_INT16SZ);
+		EQUAL_DNAME;
+		break;
+	case ns_t_px:
+		EQUAL_SOME(NS_INT16SZ);
+		EQUAL_DNAME;
+		EQUAL_DNAME;
+		break;
+	case ns_t_srv:
+		EQUAL_SOME(NS_INT16SZ * 3);
+		EQUAL_DNAME;
+		break;
+	case ns_t_minfo:
+	case ns_t_rp:
+		EQUAL_DNAME;
+		EQUAL_DNAME;
+		break;
+	default:
+		EQUAL_SOME(rdlen1);
+		break;
+	}
+	if (rdlen1 != 0 || rdlen2 != 0)
+		return (0);
+	return (1);
+}
+
+#define REFERS_DNAME \
+	do { \
+		int n; \
+		\
+		n = ns_name_eq(rdata, rdlen, nname, NS_MAXNNAME); \
+		if (n < 0) \
+			return (-1); \
+		if (n > 0) \
+			return (1); \
+		n = dn_skipname(rdata, rdata + rdlen); \
+		if (n < 0) \
+			return (-1); \
+		CONSUME_SRC; \
+	} while (0)
+
+#define	REFERS_SOME(x) \
+	do { \
+		size_t n = (x); \
+		\
+		if (n > rdlen) { \
+			errno = EMSGSIZE; \
+			return (-1); \
+		} \
+		CONSUME_SRC; \
+	} while (0)
+
+int
+ns_rdata_refers(ns_type type,
+		const u_char *rdata, size_t rdlen,
+		const u_char *nname)
+{
+	switch (type) {
+	case ns_t_cname:
+	case ns_t_mb:
+	case ns_t_mg:
+	case ns_t_mr:
+	case ns_t_ns:
+	case ns_t_ptr:
+	case ns_t_dname:
+		REFERS_DNAME;
+		break;
+	case ns_t_soa:
+		REFERS_DNAME;
+		REFERS_DNAME;
+		REFERS_SOME(NS_INT32SZ * 5);
+		break;
+	case ns_t_mx:
+	case ns_t_afsdb:
+	case ns_t_rt:
+		REFERS_SOME(NS_INT16SZ);
+		REFERS_DNAME;
+		break;
+	case ns_t_px:
+		REFERS_SOME(NS_INT16SZ);
+		REFERS_DNAME;
+		REFERS_DNAME;
+		break;
+	case ns_t_srv:
+		REFERS_SOME(NS_INT16SZ * 3);
+		REFERS_DNAME;
+		break;
+	case ns_t_minfo:
+	case ns_t_rp:
+		REFERS_DNAME;
+		REFERS_DNAME;
+		break;
+	default:
+		REFERS_SOME(rdlen);
+		break;
+	}
+	if (rdlen != 0) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	return (0);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_samedomain.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_samedomain.c
new file mode 100644
index 0000000000..5e9f5cab54
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_samedomain.c
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_samedomain.c,v 1.6 2005/04/27 04:56:40 sra Exp $";
+#endif
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <arpa/nameser.h>
+#include <errno.h>
+#include <string.h>
+
+#include "port_after.h"
+
+/*%
+ *	Check whether a name belongs to a domain.
+ *
+ * Inputs:
+ *\li	a - the domain whose ancestory is being verified
+ *\li	b - the potential ancestor we're checking against
+ *
+ * Return:
+ *\li	boolean - is a at or below b?
+ *
+ * Notes:
+ *\li	Trailing dots are first removed from name and domain.
+ *	Always compare complete subdomains, not only whether the
+ *	domain name is the trailing string of the given name.
+ *
+ *\li	"host.foobar.top" lies in "foobar.top" and in "top" and in ""
+ *	but NOT in "bar.top"
+ */
+
+int
+ns_samedomain(const char *a, const char *b) {
+	size_t la, lb;
+	int diff, i, escaped;
+	const char *cp;
+
+	la = strlen(a);
+	lb = strlen(b);
+
+	/* Ignore a trailing label separator (i.e. an unescaped dot) in 'a'. */
+	if (la != 0U && a[la - 1] == '.') {
+		escaped = 0;
+		/* Note this loop doesn't get executed if la==1. */
+		for (i = la - 2; i >= 0; i--)
+			if (a[i] == '\\') {
+				if (escaped)
+					escaped = 0;
+				else
+					escaped = 1;
+			} else
+				break;
+		if (!escaped)
+			la--;
+	}
+
+	/* Ignore a trailing label separator (i.e. an unescaped dot) in 'b'. */
+	if (lb != 0U && b[lb - 1] == '.') {
+		escaped = 0;
+		/* note this loop doesn't get executed if lb==1 */
+		for (i = lb - 2; i >= 0; i--)
+			if (b[i] == '\\') {
+				if (escaped)
+					escaped = 0;
+				else
+					escaped = 1;
+			} else
+				break;
+		if (!escaped)
+			lb--;
+	}
+
+	/* lb == 0 means 'b' is the root domain, so 'a' must be in 'b'. */
+	if (lb == 0U)
+		return (1);
+
+	/* 'b' longer than 'a' means 'a' can't be in 'b'. */
+	if (lb > la)
+		return (0);
+
+	/* 'a' and 'b' being equal at this point indicates sameness. */
+	if (lb == la)
+		return (strncasecmp(a, b, lb) == 0);
+
+	/* Ok, we know la > lb. */
+
+	diff = la - lb;
+
+	/*
+	 * If 'a' is only 1 character longer than 'b', then it can't be
+	 * a subdomain of 'b' (because of the need for the '.' label
+	 * separator).
+	 */
+	if (diff < 2)
+		return (0);
+
+	/*
+	 * If the character before the last 'lb' characters of 'b'
+	 * isn't '.', then it can't be a match (this lets us avoid
+	 * having "foobar.com" match "bar.com").
+	 */
+	if (a[diff - 1] != '.')
+		return (0);
+
+	/*
+	 * We're not sure about that '.', however.  It could be escaped
+         * and thus not a really a label separator.
+	 */
+	escaped = 0;
+	for (i = diff - 2; i >= 0; i--)
+		if (a[i] == '\\') {
+			if (escaped)
+				escaped = 0;
+			else
+				escaped = 1;
+		} else
+			break;
+	if (escaped)
+		return (0);
+	  
+	/* Now compare aligned trailing substring. */
+	cp = a + diff;
+	return (strncasecmp(cp, b, lb) == 0);
+}
+
+/*%
+ *	is "a" a subdomain of "b"?
+ */
+int
+ns_subdomain(const char *a, const char *b) {
+	return (ns_samename(a, b) != 1 && ns_samedomain(a, b));
+}
+
+/*%
+ *	make a canonical copy of domain name "src"
+ *
+ * notes:
+ * \code
+ *	foo -> foo.
+ *	foo. -> foo.
+ *	foo.. -> foo.
+ *	foo\. -> foo\..
+ *	foo\\. -> foo\\.
+ * \endcode
+ */
+
+int
+ns_makecanon(const char *src, char *dst, size_t dstsize) {
+	size_t n = strlen(src);
+
+	if (n + sizeof "." > dstsize) {			/*%< Note: sizeof == 2 */
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	strcpy(dst, src);
+	while (n >= 1U && dst[n - 1] == '.')		/*%< Ends in "." */
+		if (n >= 2U && dst[n - 2] == '\\' &&	/*%< Ends in "\." */
+		    (n < 3U || dst[n - 3] != '\\'))	/*%< But not "\\." */
+			break;
+		else
+			dst[--n] = '\0';
+	dst[n++] = '.';
+	dst[n] = '\0';
+	return (0);
+}
+
+/*%
+ *	determine whether domain name "a" is the same as domain name "b"
+ *
+ * return:
+ *\li	-1 on error
+ *\li	0 if names differ
+ *\li	1 if names are the same
+ */
+
+int
+ns_samename(const char *a, const char *b) {
+	char ta[NS_MAXDNAME], tb[NS_MAXDNAME];
+
+	if (ns_makecanon(a, ta, sizeof ta) < 0 ||
+	    ns_makecanon(b, tb, sizeof tb) < 0)
+		return (-1);
+	if (strcasecmp(ta, tb) == 0)
+		return (1);
+	else
+		return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_sign.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_sign.c
new file mode 100644
index 0000000000..fc7dd19f7b
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_sign.c
@@ -0,0 +1,387 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium, Inc.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_sign.c,v 1.6 2006/03/09 23:57:56 marka Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <isc/dst.h>
+#include <isc/assertions.h>
+
+#include "port_after.h"
+
+#define BOUNDS_CHECK(ptr, count) \
+	do { \
+		if ((ptr) + (count) > eob) { \
+			errno = EMSGSIZE; \
+			return(NS_TSIG_ERROR_NO_SPACE); \
+		} \
+	} while (0)
+
+/*%
+ *  ns_sign
+ *
+ * Parameters:
+ *\li	msg		message to be sent
+ *\li	msglen		input - length of message
+ *			output - length of signed message
+ *\li	msgsize		length of buffer containing message
+ *\li	error		value to put in the error field
+ *\li	key		tsig key used for signing
+ *\li	querysig	(response), the signature in the query
+ *\li	querysiglen	(response), the length of the signature in the query
+ *\li	sig		a buffer to hold the generated signature
+ *\li	siglen		input - length of signature buffer
+ *			output - length of signature
+ *
+ * Errors:
+ *\li	- bad input data (-1)
+ *\li	- bad key / sign failed (-BADKEY)
+ *\li	- not enough space (NS_TSIG_ERROR_NO_SPACE)
+ */
+int
+ns_sign(u_char *msg, int *msglen, int msgsize, int error, void *k,
+	const u_char *querysig, int querysiglen, u_char *sig, int *siglen,
+	time_t in_timesigned)
+{
+	return(ns_sign2(msg, msglen, msgsize, error, k,
+			querysig, querysiglen, sig, siglen,
+			in_timesigned, NULL, NULL));
+}
+
+int
+ns_sign2(u_char *msg, int *msglen, int msgsize, int error, void *k,
+	 const u_char *querysig, int querysiglen, u_char *sig, int *siglen,
+	 time_t in_timesigned, u_char **dnptrs, u_char **lastdnptr)
+{
+	HEADER *hp = (HEADER *)msg;
+	DST_KEY *key = (DST_KEY *)k;
+	u_char *cp, *eob;
+	u_char *lenp;
+	u_char *alg;
+	int n;
+	time_t timesigned;
+        u_char name[NS_MAXCDNAME];
+
+	dst_init();
+	if (msg == NULL || msglen == NULL || sig == NULL || siglen == NULL)
+		return (-1);
+
+	cp = msg + *msglen;
+	eob = msg + msgsize;
+
+	/* Name. */
+	if (key != NULL && error != ns_r_badsig && error != ns_r_badkey) {
+		n = ns_name_pton(key->dk_key_name, name, sizeof name);
+		if (n != -1)
+			n = ns_name_pack(name, cp, eob - cp,
+					 (const u_char **)dnptrs,
+					 (const u_char **)lastdnptr);
+
+	} else {
+		n = ns_name_pton("", name, sizeof name);
+		if (n != -1)
+			n = ns_name_pack(name, cp, eob - cp, NULL, NULL);
+	}
+	if (n < 0)
+		return (NS_TSIG_ERROR_NO_SPACE);
+	cp += n;
+
+	/* Type, class, ttl, length (not filled in yet). */
+	BOUNDS_CHECK(cp, INT16SZ + INT16SZ + INT32SZ + INT16SZ);
+	PUTSHORT(ns_t_tsig, cp);
+	PUTSHORT(ns_c_any, cp);
+	PUTLONG(0, cp);		/*%< TTL */
+	lenp = cp;
+	cp += 2;
+
+	/* Alg. */
+	if (key != NULL && error != ns_r_badsig && error != ns_r_badkey) {
+		if (key->dk_alg != KEY_HMAC_MD5)
+			return (-ns_r_badkey);
+		n = dn_comp(NS_TSIG_ALG_HMAC_MD5, cp, eob - cp, NULL, NULL);
+	}
+	else
+		n = dn_comp("", cp, eob - cp, NULL, NULL);
+	if (n < 0)
+		return (NS_TSIG_ERROR_NO_SPACE);
+	alg = cp;
+	cp += n;
+	
+	/* Time. */
+	BOUNDS_CHECK(cp, INT16SZ + INT32SZ + INT16SZ);
+	PUTSHORT(0, cp);
+	timesigned = time(NULL);
+	if (error != ns_r_badtime)
+		PUTLONG(timesigned, cp);
+	else
+		PUTLONG(in_timesigned, cp);
+	PUTSHORT(NS_TSIG_FUDGE, cp);
+
+	/* Compute the signature. */
+	if (key != NULL && error != ns_r_badsig && error != ns_r_badkey) {
+		void *ctx;
+		u_char buf[NS_MAXCDNAME], *cp2;
+		int n;
+
+		dst_sign_data(SIG_MODE_INIT, key, &ctx, NULL, 0, NULL, 0);
+
+		/* Digest the query signature, if this is a response. */
+		if (querysiglen > 0 && querysig != NULL) {
+			u_int16_t len_n = htons(querysiglen);
+			dst_sign_data(SIG_MODE_UPDATE, key, &ctx,
+				      (u_char *)&len_n, INT16SZ, NULL, 0);
+			dst_sign_data(SIG_MODE_UPDATE, key, &ctx,
+				      querysig, querysiglen, NULL, 0);
+		}
+
+		/* Digest the message. */
+		dst_sign_data(SIG_MODE_UPDATE, key, &ctx, msg, *msglen,
+			      NULL, 0);
+
+		/* Digest the key name. */
+		n = ns_name_ntol(name, buf, sizeof(buf));
+		INSIST(n > 0);
+		dst_sign_data(SIG_MODE_UPDATE, key, &ctx, buf, n, NULL, 0);
+
+		/* Digest the class and TTL. */
+		cp2 = buf;
+		PUTSHORT(ns_c_any, cp2);
+		PUTLONG(0, cp2);
+		dst_sign_data(SIG_MODE_UPDATE, key, &ctx, buf, cp2-buf,
+			      NULL, 0);
+
+		/* Digest the algorithm. */
+		n = ns_name_ntol(alg, buf, sizeof(buf));
+		INSIST(n > 0);
+		dst_sign_data(SIG_MODE_UPDATE, key, &ctx, buf, n, NULL, 0);
+
+		/* Digest the time signed, fudge, error, and other data */
+		cp2 = buf;
+		PUTSHORT(0, cp2);	/*%< Top 16 bits of time */
+		if (error != ns_r_badtime)
+			PUTLONG(timesigned, cp2);
+		else
+			PUTLONG(in_timesigned, cp2);
+		PUTSHORT(NS_TSIG_FUDGE, cp2);
+		PUTSHORT(error, cp2);	/*%< Error */
+		if (error != ns_r_badtime)
+			PUTSHORT(0, cp2);	/*%< Other data length */
+		else {
+			PUTSHORT(INT16SZ+INT32SZ, cp2);	/*%< Other data length */
+			PUTSHORT(0, cp2);	/*%< Top 16 bits of time */
+			PUTLONG(timesigned, cp2);
+		}
+		dst_sign_data(SIG_MODE_UPDATE, key, &ctx, buf, cp2-buf,
+			      NULL, 0);
+
+		n = dst_sign_data(SIG_MODE_FINAL, key, &ctx, NULL, 0,
+				  sig, *siglen);
+		if (n < 0)
+			return (-ns_r_badkey);
+		*siglen = n;
+	} else
+		*siglen = 0;
+
+	/* Add the signature. */
+	BOUNDS_CHECK(cp, INT16SZ + (*siglen));
+	PUTSHORT(*siglen, cp);
+	memcpy(cp, sig, *siglen);
+	cp += (*siglen);
+
+	/* The original message ID & error. */
+	BOUNDS_CHECK(cp, INT16SZ + INT16SZ);
+	PUTSHORT(ntohs(hp->id), cp);	/*%< already in network order */
+	PUTSHORT(error, cp);
+
+	/* Other data. */
+	BOUNDS_CHECK(cp, INT16SZ);
+	if (error != ns_r_badtime)
+		PUTSHORT(0, cp);	/*%< Other data length */
+	else {
+		PUTSHORT(INT16SZ+INT32SZ, cp);	/*%< Other data length */
+		BOUNDS_CHECK(cp, INT32SZ+INT16SZ);
+		PUTSHORT(0, cp);	/*%< Top 16 bits of time */
+		PUTLONG(timesigned, cp);
+	}
+
+	/* Go back and fill in the length. */
+	PUTSHORT(cp - lenp - INT16SZ, lenp);
+
+	hp->arcount = htons(ntohs(hp->arcount) + 1);
+	*msglen = (cp - msg);
+	return (0);
+}
+
+int
+ns_sign_tcp_init(void *k, const u_char *querysig, int querysiglen,
+		 ns_tcp_tsig_state *state)
+{
+	dst_init();
+	if (state == NULL || k == NULL || querysig == NULL || querysiglen < 0)
+		return (-1);
+	state->counter = -1;
+	state->key = k;
+	if (state->key->dk_alg != KEY_HMAC_MD5)
+		return (-ns_r_badkey);
+	if (querysiglen > (int)sizeof(state->sig))
+		return (-1);
+	memcpy(state->sig, querysig, querysiglen);
+	state->siglen = querysiglen;
+	return (0);
+}
+
+int
+ns_sign_tcp(u_char *msg, int *msglen, int msgsize, int error,
+	    ns_tcp_tsig_state *state, int done)
+{
+	return (ns_sign_tcp2(msg, msglen, msgsize, error, state,
+			     done, NULL, NULL));
+}
+
+int
+ns_sign_tcp2(u_char *msg, int *msglen, int msgsize, int error,
+	     ns_tcp_tsig_state *state, int done,
+	     u_char **dnptrs, u_char **lastdnptr)
+{
+	u_char *cp, *eob, *lenp;
+	u_char buf[MAXDNAME], *cp2;
+	HEADER *hp = (HEADER *)msg;
+	time_t timesigned;
+	int n;
+
+	if (msg == NULL || msglen == NULL || state == NULL)
+		return (-1);
+
+	state->counter++;
+	if (state->counter == 0)
+		return (ns_sign2(msg, msglen, msgsize, error, state->key,
+				 state->sig, state->siglen,
+				 state->sig, &state->siglen, 0,
+				 dnptrs, lastdnptr));
+
+	if (state->siglen > 0) {
+		u_int16_t siglen_n = htons(state->siglen);
+		dst_sign_data(SIG_MODE_INIT, state->key, &state->ctx,
+			      NULL, 0, NULL, 0);
+		dst_sign_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+			      (u_char *)&siglen_n, INT16SZ, NULL, 0);
+		dst_sign_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+			      state->sig, state->siglen, NULL, 0);
+		state->siglen = 0;
+	}
+
+	dst_sign_data(SIG_MODE_UPDATE, state->key, &state->ctx, msg, *msglen,
+		      NULL, 0);
+
+	if (done == 0 && (state->counter % 100 != 0))
+		return (0);
+
+	cp = msg + *msglen;
+	eob = msg + msgsize;
+
+	/* Name. */
+	n = dn_comp(state->key->dk_key_name, cp, eob - cp, dnptrs, lastdnptr);
+	if (n < 0)
+		return (NS_TSIG_ERROR_NO_SPACE);
+	cp += n;
+
+	/* Type, class, ttl, length (not filled in yet). */
+	BOUNDS_CHECK(cp, INT16SZ + INT16SZ + INT32SZ + INT16SZ);
+	PUTSHORT(ns_t_tsig, cp);
+	PUTSHORT(ns_c_any, cp);
+	PUTLONG(0, cp);		/*%< TTL */
+	lenp = cp;
+	cp += 2;
+
+	/* Alg. */
+	n = dn_comp(NS_TSIG_ALG_HMAC_MD5, cp, eob - cp, NULL, NULL);
+	if (n < 0)
+		return (NS_TSIG_ERROR_NO_SPACE);
+	cp += n;
+	
+	/* Time. */
+	BOUNDS_CHECK(cp, INT16SZ + INT32SZ + INT16SZ);
+	PUTSHORT(0, cp);
+	timesigned = time(NULL);
+	PUTLONG(timesigned, cp);
+	PUTSHORT(NS_TSIG_FUDGE, cp);
+
+	/*
+	 * Compute the signature.
+	 */
+
+	/* Digest the time signed and fudge. */
+	cp2 = buf;
+	PUTSHORT(0, cp2);	/*%< Top 16 bits of time */
+	PUTLONG(timesigned, cp2);
+	PUTSHORT(NS_TSIG_FUDGE, cp2);
+
+	dst_sign_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+		      buf, cp2 - buf, NULL, 0);
+
+	n = dst_sign_data(SIG_MODE_FINAL, state->key, &state->ctx, NULL, 0,
+			  state->sig, sizeof(state->sig));
+	if (n < 0)
+		return (-ns_r_badkey);
+	state->siglen = n;
+
+	/* Add the signature. */
+	BOUNDS_CHECK(cp, INT16SZ + state->siglen);
+	PUTSHORT(state->siglen, cp);
+	memcpy(cp, state->sig, state->siglen);
+	cp += state->siglen;
+
+	/* The original message ID & error. */
+	BOUNDS_CHECK(cp, INT16SZ + INT16SZ);
+	PUTSHORT(ntohs(hp->id), cp);	/*%< already in network order */
+	PUTSHORT(error, cp);
+
+	/* Other data. */
+	BOUNDS_CHECK(cp, INT16SZ);
+	PUTSHORT(0, cp);
+
+	/* Go back and fill in the length. */
+	PUTSHORT(cp - lenp - INT16SZ, lenp);
+
+	hp->arcount = htons(ntohs(hp->arcount) + 1);
+	*msglen = (cp - msg);
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_ttl.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_ttl.c
new file mode 100644
index 0000000000..69c2f83f57
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_ttl.c
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_ttl.c,v 1.4 2005/07/28 06:51:49 marka Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) ((size_t)sprintf x)
+#endif
+
+/* Forward. */
+
+static int	fmt1(int t, char s, char **buf, size_t *buflen);
+
+/* Macros. */
+
+#define T(x) if ((x) < 0) return (-1); else (void)NULL
+
+/* Public. */
+
+int
+ns_format_ttl(u_long src, char *dst, size_t dstlen) {
+	char *odst = dst;
+	int secs, mins, hours, days, weeks, x;
+	char *p;
+
+	secs = src % 60;   src /= 60;
+	mins = src % 60;   src /= 60;
+	hours = src % 24;  src /= 24;
+	days = src % 7;    src /= 7;
+	weeks = src;       src = 0;
+
+	x = 0;
+	if (weeks) {
+		T(fmt1(weeks, 'W', &dst, &dstlen));
+		x++;
+	}
+	if (days) {
+		T(fmt1(days, 'D', &dst, &dstlen));
+		x++;
+	}
+	if (hours) {
+		T(fmt1(hours, 'H', &dst, &dstlen));
+		x++;
+	}
+	if (mins) {
+		T(fmt1(mins, 'M', &dst, &dstlen));
+		x++;
+	}
+	if (secs || !(weeks || days || hours || mins)) {
+		T(fmt1(secs, 'S', &dst, &dstlen));
+		x++;
+	}
+
+	if (x > 1) {
+		int ch;
+
+		for (p = odst; (ch = *p) != '\0'; p++)
+			if (isascii(ch) && isupper(ch))
+				*p = tolower(ch);
+	}
+
+	return (dst - odst);
+}
+
+int
+ns_parse_ttl(const char *src, u_long *dst) {
+	u_long ttl, tmp;
+	int ch, digits, dirty;
+
+	ttl = 0;
+	tmp = 0;
+	digits = 0;
+	dirty = 0;
+	while ((ch = *src++) != '\0') {
+		if (!isascii(ch) || !isprint(ch))
+			goto einval;
+		if (isdigit(ch)) {
+			tmp *= 10;
+			tmp += (ch - '0');
+			digits++;
+			continue;
+		}
+		if (digits == 0)
+			goto einval;
+		if (islower(ch))
+			ch = toupper(ch);
+		switch (ch) {
+		case 'W':  tmp *= 7;
+		case 'D':  tmp *= 24;
+		case 'H':  tmp *= 60;
+		case 'M':  tmp *= 60;
+		case 'S':  break;
+		default:   goto einval;
+		}
+		ttl += tmp;
+		tmp = 0;
+		digits = 0;
+		dirty = 1;
+	}
+	if (digits > 0) {
+		if (dirty)
+			goto einval;
+		else
+			ttl += tmp;
+	} else if (!dirty)
+		goto einval;
+	*dst = ttl;
+	return (0);
+
+ einval:
+	errno = EINVAL;
+	return (-1);
+}
+
+/* Private. */
+
+static int
+fmt1(int t, char s, char **buf, size_t *buflen) {
+	char tmp[50];
+	size_t len;
+
+	len = SPRINTF((tmp, "%d%c", t, s));
+	if (len + 1 > *buflen)
+		return (-1);
+	strcpy(*buf, tmp);
+	*buf += len;
+	*buflen -= len;
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/nameser/ns_verify.c b/usr/src/lib/libresolv2_joy/common/nameser/ns_verify.c
new file mode 100644
index 0000000000..b4b63d4641
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/nameser/ns_verify.c
@@ -0,0 +1,484 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium, Inc.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef lint
+static const char rcsid[] = "$Id: ns_verify.c,v 1.5 2006/03/09 23:57:56 marka Exp $";
+#endif
+
+/* Import. */
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <isc/dst.h>
+
+#include "port_after.h"
+
+/* Private. */
+
+#define BOUNDS_CHECK(ptr, count) \
+	do { \
+		if ((ptr) + (count) > eom) { \
+			return (NS_TSIG_ERROR_FORMERR); \
+		} \
+	} while (0)
+
+/* Public. */
+
+u_char *
+ns_find_tsig(u_char *msg, u_char *eom) {
+	HEADER *hp = (HEADER *)msg;
+	int n, type;
+	u_char *cp = msg, *start;
+
+	if (msg == NULL || eom == NULL || msg > eom)
+		return (NULL);
+
+	if (cp + HFIXEDSZ >= eom)
+		return (NULL);
+
+	if (hp->arcount == 0)
+		return (NULL);
+
+	cp += HFIXEDSZ;
+
+	n = ns_skiprr(cp, eom, ns_s_qd, ntohs(hp->qdcount));
+	if (n < 0)
+		return (NULL);
+	cp += n;
+
+	n = ns_skiprr(cp, eom, ns_s_an, ntohs(hp->ancount));
+	if (n < 0)
+		return (NULL);
+	cp += n;
+
+	n = ns_skiprr(cp, eom, ns_s_ns, ntohs(hp->nscount));
+	if (n < 0)
+		return (NULL);
+	cp += n;
+
+	n = ns_skiprr(cp, eom, ns_s_ar, ntohs(hp->arcount) - 1);
+	if (n < 0)
+		return (NULL);
+	cp += n;
+
+	start = cp;
+	n = dn_skipname(cp, eom);
+	if (n < 0)
+		return (NULL);
+	cp += n;
+	if (cp + INT16SZ >= eom)
+		return (NULL);
+
+	GETSHORT(type, cp);
+	if (type != ns_t_tsig)
+		return (NULL);
+	return (start);
+}
+
+/* ns_verify
+ *
+ * Parameters:
+ *\li	statp		res stuff
+ *\li	msg		received message
+ *\li	msglen		length of message
+ *\li	key		tsig key used for verifying.
+ *\li	querysig	(response), the signature in the query
+ *\li	querysiglen	(response), the length of the signature in the query
+ *\li	sig		(query), a buffer to hold the signature
+ *\li	siglen		(query), input - length of signature buffer
+ *				 output - length of signature
+ *
+ * Errors:
+ *\li	- bad input (-1)
+ *\li	- invalid dns message (NS_TSIG_ERROR_FORMERR)
+ *\li	- TSIG is not present (NS_TSIG_ERROR_NO_TSIG)
+ *\li	- key doesn't match (-ns_r_badkey)
+ *\li	- TSIG verification fails with BADKEY (-ns_r_badkey)
+ *\li	- TSIG verification fails with BADSIG (-ns_r_badsig)
+ *\li	- TSIG verification fails with BADTIME (-ns_r_badtime)
+ *\li	- TSIG verification succeeds, error set to BAKEY (ns_r_badkey)
+ *\li	- TSIG verification succeeds, error set to BADSIG (ns_r_badsig)
+ *\li	- TSIG verification succeeds, error set to BADTIME (ns_r_badtime)
+ */
+int
+ns_verify(u_char *msg, int *msglen, void *k,
+	  const u_char *querysig, int querysiglen, u_char *sig, int *siglen,
+	  time_t *timesigned, int nostrip)
+{
+	HEADER *hp = (HEADER *)msg;
+	DST_KEY *key = (DST_KEY *)k;
+	u_char *cp = msg, *eom;
+	char name[MAXDNAME], alg[MAXDNAME];
+	u_char *recstart, *rdatastart;
+	u_char *sigstart, *otherstart;
+	int n;
+	int error;
+	u_int16_t type, length;
+	u_int16_t fudge, sigfieldlen, otherfieldlen;
+
+	dst_init();
+	if (msg == NULL || msglen == NULL || *msglen < 0)
+		return (-1);
+
+	eom = msg + *msglen;
+
+	recstart = ns_find_tsig(msg, eom);
+	if (recstart == NULL)
+		return (NS_TSIG_ERROR_NO_TSIG);
+
+	cp = recstart;
+
+	/* Read the key name. */
+	n = dn_expand(msg, eom, cp, name, MAXDNAME);
+	if (n < 0)
+		return (NS_TSIG_ERROR_FORMERR);
+	cp += n;
+
+	/* Read the type. */
+	BOUNDS_CHECK(cp, 2*INT16SZ + INT32SZ + INT16SZ);
+	GETSHORT(type, cp);
+	if (type != ns_t_tsig)
+		return (NS_TSIG_ERROR_NO_TSIG);
+
+	/* Skip the class and TTL, save the length. */
+	cp += INT16SZ + INT32SZ;
+	GETSHORT(length, cp);
+	if (eom - cp != length)
+		return (NS_TSIG_ERROR_FORMERR);
+
+	/* Read the algorithm name. */
+	rdatastart = cp;
+	n = dn_expand(msg, eom, cp, alg, MAXDNAME);
+	if (n < 0)
+		return (NS_TSIG_ERROR_FORMERR);
+	if (ns_samename(alg, NS_TSIG_ALG_HMAC_MD5) != 1)
+		return (-ns_r_badkey);
+	cp += n;
+
+	/* Read the time signed and fudge. */
+	BOUNDS_CHECK(cp, INT16SZ + INT32SZ + INT16SZ);
+	cp += INT16SZ;
+	GETLONG((*timesigned), cp);
+	GETSHORT(fudge, cp);
+
+	/* Read the signature. */
+	BOUNDS_CHECK(cp, INT16SZ);
+	GETSHORT(sigfieldlen, cp);
+	BOUNDS_CHECK(cp, sigfieldlen);
+	sigstart = cp;
+	cp += sigfieldlen;
+
+	/* Skip id and read error. */
+	BOUNDS_CHECK(cp, 2*INT16SZ);
+	cp += INT16SZ;
+	GETSHORT(error, cp);
+
+	/* Parse the other data. */
+	BOUNDS_CHECK(cp, INT16SZ);
+	GETSHORT(otherfieldlen, cp);
+	BOUNDS_CHECK(cp, otherfieldlen);
+	otherstart = cp;
+	cp += otherfieldlen;
+
+	if (cp != eom)
+		return (NS_TSIG_ERROR_FORMERR);
+
+	/* Verify that the key used is OK. */
+	if (key != NULL) {
+		if (key->dk_alg != KEY_HMAC_MD5)
+			return (-ns_r_badkey);
+		if (error != ns_r_badsig && error != ns_r_badkey) {
+			if (ns_samename(key->dk_key_name, name) != 1)
+				return (-ns_r_badkey);
+		}
+	}
+
+	hp->arcount = htons(ntohs(hp->arcount) - 1);
+
+	/*
+	 * Do the verification.
+	 */
+
+	if (key != NULL && error != ns_r_badsig && error != ns_r_badkey) {
+		void *ctx;
+		u_char buf[MAXDNAME];
+		u_char buf2[MAXDNAME];
+
+		/* Digest the query signature, if this is a response. */
+		dst_verify_data(SIG_MODE_INIT, key, &ctx, NULL, 0, NULL, 0);
+		if (querysiglen > 0 && querysig != NULL) {
+			u_int16_t len_n = htons(querysiglen);
+			dst_verify_data(SIG_MODE_UPDATE, key, &ctx,
+					(u_char *)&len_n, INT16SZ, NULL, 0);
+			dst_verify_data(SIG_MODE_UPDATE, key, &ctx,
+					querysig, querysiglen, NULL, 0);
+		}
+		
+ 		/* Digest the message. */
+		dst_verify_data(SIG_MODE_UPDATE, key, &ctx, msg, recstart - msg,
+				NULL, 0);
+
+		/* Digest the key name. */
+		n = ns_name_pton(name, buf2, sizeof(buf2));
+		if (n < 0)
+			return (-1);
+		n = ns_name_ntol(buf2, buf, sizeof(buf));
+		if (n < 0)
+			return (-1);
+		dst_verify_data(SIG_MODE_UPDATE, key, &ctx, buf, n, NULL, 0);
+
+		/* Digest the class and TTL. */
+		dst_verify_data(SIG_MODE_UPDATE, key, &ctx,
+				recstart + dn_skipname(recstart, eom) + INT16SZ,
+				INT16SZ + INT32SZ, NULL, 0);
+
+		/* Digest the algorithm. */
+		n = ns_name_pton(alg, buf2, sizeof(buf2));
+		if (n < 0)
+			return (-1);
+		n = ns_name_ntol(buf2, buf, sizeof(buf));
+		if (n < 0)
+			return (-1);
+		dst_verify_data(SIG_MODE_UPDATE, key, &ctx, buf, n, NULL, 0);
+
+		/* Digest the time signed and fudge. */
+		dst_verify_data(SIG_MODE_UPDATE, key, &ctx,
+				rdatastart + dn_skipname(rdatastart, eom),
+				INT16SZ + INT32SZ + INT16SZ, NULL, 0);
+
+		/* Digest the error and other data. */
+		dst_verify_data(SIG_MODE_UPDATE, key, &ctx,
+				otherstart - INT16SZ - INT16SZ,
+				otherfieldlen + INT16SZ + INT16SZ, NULL, 0);
+
+		n = dst_verify_data(SIG_MODE_FINAL, key, &ctx, NULL, 0,
+				    sigstart, sigfieldlen);
+
+		if (n < 0)
+			return (-ns_r_badsig);
+
+		if (sig != NULL && siglen != NULL) {
+			if (*siglen < sigfieldlen)
+				return (NS_TSIG_ERROR_NO_SPACE);
+			memcpy(sig, sigstart, sigfieldlen);
+			*siglen = sigfieldlen;
+		}
+	} else {
+		if (sigfieldlen > 0)
+			return (NS_TSIG_ERROR_FORMERR);
+		if (sig != NULL && siglen != NULL)
+			*siglen = 0;
+	}
+
+	/* Reset the counter, since we still need to check for badtime. */
+	hp->arcount = htons(ntohs(hp->arcount) + 1);
+
+	/* Verify the time. */
+	if (abs((*timesigned) - time(NULL)) > fudge)
+		return (-ns_r_badtime);
+
+	if (nostrip == 0) {
+		*msglen = recstart - msg;
+		hp->arcount = htons(ntohs(hp->arcount) - 1);
+	}
+
+	if (error != NOERROR)
+		return (error);
+
+	return (0);
+}
+
+int
+ns_verify_tcp_init(void *k, const u_char *querysig, int querysiglen,
+		   ns_tcp_tsig_state *state)
+{
+	dst_init();
+	if (state == NULL || k == NULL || querysig == NULL || querysiglen < 0)
+		return (-1);
+	state->counter = -1;
+	state->key = k;
+	if (state->key->dk_alg != KEY_HMAC_MD5)
+		return (-ns_r_badkey);
+	if (querysiglen > (int)sizeof(state->sig))
+		return (-1);
+	memcpy(state->sig, querysig, querysiglen);
+	state->siglen = querysiglen;
+	return (0);
+}
+
+int
+ns_verify_tcp(u_char *msg, int *msglen, ns_tcp_tsig_state *state,
+	      int required)
+{
+	HEADER *hp = (HEADER *)msg;
+	u_char *recstart, *sigstart;
+	unsigned int sigfieldlen, otherfieldlen;
+	u_char *cp, *eom, *cp2;
+	char name[MAXDNAME], alg[MAXDNAME];
+	u_char buf[MAXDNAME];
+	int n, type, length, fudge, error;
+	time_t timesigned;
+
+	if (msg == NULL || msglen == NULL || state == NULL)
+		return (-1);
+
+	eom = msg + *msglen;
+
+	state->counter++;
+	if (state->counter == 0)
+		return (ns_verify(msg, msglen, state->key,
+				  state->sig, state->siglen,
+				  state->sig, &state->siglen, &timesigned, 0));
+
+	if (state->siglen > 0) {
+		u_int16_t siglen_n = htons(state->siglen);
+
+		dst_verify_data(SIG_MODE_INIT, state->key, &state->ctx,
+				NULL, 0, NULL, 0);
+		dst_verify_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+				(u_char *)&siglen_n, INT16SZ, NULL, 0);
+		dst_verify_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+				state->sig, state->siglen, NULL, 0);
+		state->siglen = 0;
+	}
+
+	cp = recstart = ns_find_tsig(msg, eom);
+
+	if (recstart == NULL) {
+		if (required)
+			return (NS_TSIG_ERROR_NO_TSIG);
+		dst_verify_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+				msg, *msglen, NULL, 0);
+		return (0);
+	}
+
+	hp->arcount = htons(ntohs(hp->arcount) - 1);
+	dst_verify_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+			msg, recstart - msg, NULL, 0);
+	
+	/* Read the key name. */
+	n = dn_expand(msg, eom, cp, name, MAXDNAME);
+	if (n < 0)
+		return (NS_TSIG_ERROR_FORMERR);
+	cp += n;
+
+	/* Read the type. */
+	BOUNDS_CHECK(cp, 2*INT16SZ + INT32SZ + INT16SZ);
+	GETSHORT(type, cp);
+	if (type != ns_t_tsig)
+		return (NS_TSIG_ERROR_NO_TSIG);
+
+	/* Skip the class and TTL, save the length. */
+	cp += INT16SZ + INT32SZ;
+	GETSHORT(length, cp);
+	if (eom - cp != length)
+		return (NS_TSIG_ERROR_FORMERR);
+
+	/* Read the algorithm name. */
+	n = dn_expand(msg, eom, cp, alg, MAXDNAME);
+	if (n < 0)
+		return (NS_TSIG_ERROR_FORMERR);
+	if (ns_samename(alg, NS_TSIG_ALG_HMAC_MD5) != 1)
+		return (-ns_r_badkey);
+	cp += n;
+
+	/* Verify that the key used is OK. */
+	if ((ns_samename(state->key->dk_key_name, name) != 1 ||
+	     state->key->dk_alg != KEY_HMAC_MD5))
+		return (-ns_r_badkey);
+
+	/* Read the time signed and fudge. */
+	BOUNDS_CHECK(cp, INT16SZ + INT32SZ + INT16SZ);
+	cp += INT16SZ;
+	GETLONG(timesigned, cp);
+	GETSHORT(fudge, cp);
+
+	/* Read the signature. */
+	BOUNDS_CHECK(cp, INT16SZ);
+	GETSHORT(sigfieldlen, cp);
+	BOUNDS_CHECK(cp, sigfieldlen);
+	sigstart = cp;
+	cp += sigfieldlen;
+
+	/* Skip id and read error. */
+	BOUNDS_CHECK(cp, 2*INT16SZ);
+	cp += INT16SZ;
+	GETSHORT(error, cp);
+
+	/* Parse the other data. */
+	BOUNDS_CHECK(cp, INT16SZ);
+	GETSHORT(otherfieldlen, cp);
+	BOUNDS_CHECK(cp, otherfieldlen);
+	cp += otherfieldlen;
+
+	if (cp != eom)
+		return (NS_TSIG_ERROR_FORMERR);
+
+	/*
+	 * Do the verification.
+	 */
+
+	/* Digest the time signed and fudge. */
+	cp2 = buf;
+	PUTSHORT(0, cp2);       /*%< Top 16 bits of time. */
+	PUTLONG(timesigned, cp2);
+	PUTSHORT(NS_TSIG_FUDGE, cp2);
+
+	dst_verify_data(SIG_MODE_UPDATE, state->key, &state->ctx,
+			buf, cp2 - buf, NULL, 0);
+
+	n = dst_verify_data(SIG_MODE_FINAL, state->key, &state->ctx, NULL, 0,
+			    sigstart, sigfieldlen);
+	if (n < 0)
+		return (-ns_r_badsig);
+
+	if (sigfieldlen > sizeof(state->sig))
+		return (NS_TSIG_ERROR_NO_SPACE);
+
+	memcpy(state->sig, sigstart, sigfieldlen);
+	state->siglen = sigfieldlen;
+
+	/* Verify the time. */
+	if (abs(timesigned - time(NULL)) > fudge)
+		return (-ns_r_badtime);
+
+	*msglen = recstart - msg;
+
+	if (error != NOERROR)
+		return (error);
+
+	return (0);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/herror.c b/usr/src/lib/libresolv2_joy/common/resolv/herror.c
new file mode 100644
index 0000000000..568ce3ce68
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/herror.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 1987, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)herror.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: herror.c,v 1.4 2005/04/27 04:56:41 sra Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/uio.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <string.h>
+#include <unistd.h>
+#include <irs.h>
+
+#include "port_after.h"
+
+const char *h_errlist[] = {
+	"Resolver Error 0 (no error)",
+	"Unknown host",				/*%< 1 HOST_NOT_FOUND */
+	"Host name lookup failure",		/*%< 2 TRY_AGAIN */
+	"Unknown server error",			/*%< 3 NO_RECOVERY */
+	"No address associated with name",	/*%< 4 NO_ADDRESS */
+};
+int	h_nerr = { sizeof h_errlist / sizeof h_errlist[0] };
+
+#if !(__GLIBC__ > 2 || __GLIBC__ == 2 &&  __GLIBC_MINOR__ >= 3)
+#undef	h_errno
+int	h_errno;
+#endif
+
+/*%
+ * herror --
+ *	print the error indicated by the h_errno value.
+ */
+void
+herror(const char *s) {
+	struct iovec iov[4], *v = iov;
+	char *t;
+
+	if (s != NULL && *s != '\0') {
+		DE_CONST(s, t);
+		v->iov_base = t;
+		v->iov_len = strlen(t);
+		v++;
+		DE_CONST(": ", t);
+		v->iov_base = t;
+		v->iov_len = 2;
+		v++;
+	}
+	DE_CONST(hstrerror(*__h_errno()), t);
+	v->iov_base = t;
+	v->iov_len = strlen(v->iov_base);
+	v++;
+	DE_CONST("\n", t);
+	v->iov_base = t;
+	v->iov_len = 1;
+	writev(STDERR_FILENO, iov, (v - iov) + 1);
+}
+
+/*%
+ * hstrerror --
+ *	return the string associated with a given "host" errno value.
+ */
+const char *
+hstrerror(int err) {
+	if (err < 0)
+		return ("Resolver internal error");
+	else if (err < h_nerr)
+		return (h_errlist[err]);
+	return ("Unknown resolver error");
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/mtctxres.c b/usr/src/lib/libresolv2_joy/common/resolv/mtctxres.c
new file mode 100644
index 0000000000..2e79b1e7b4
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/mtctxres.c
@@ -0,0 +1,135 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+#include <port_before.h>
+#ifdef DO_PTHREADS
+#include <pthread.h>
+#endif
+#include <errno.h>
+#include <netdb.h>
+#include <stdlib.h>
+#include <string.h>
+#include <resolv_mt.h>
+#include <irs.h>
+#include <port_after.h>
+
+#ifdef DO_PTHREADS
+static pthread_key_t	key;
+static int		mt_key_initialized = 0;
+
+static int		__res_init_ctx(void);
+static void		__res_destroy_ctx(void *);
+
+#if defined(sun) && !defined(__GNUC__)
+#pragma init	(_mtctxres_init)
+#endif
+#endif
+
+static mtctxres_t	sharedctx;
+
+#ifdef DO_PTHREADS
+/*
+ * Initialize the TSD key. By doing this at library load time, we're
+ * implicitly running without interference from other threads, so there's
+ * no need for locking.
+ */
+static void
+_mtctxres_init(void) {
+	int pthread_keycreate_ret;
+
+	pthread_keycreate_ret = pthread_key_create(&key, __res_destroy_ctx);
+	if (pthread_keycreate_ret == 0)
+		mt_key_initialized = 1;
+}
+#endif
+
+/*
+ * To support binaries that used the private MT-safe interface in
+ * Solaris 8, we still need to provide the __res_enable_mt()
+ * and __res_disable_mt() entry points. They're do-nothing routines.
+ */
+int
+__res_enable_mt(void) {
+	return (-1);
+}
+
+int
+__res_disable_mt(void) {
+	return (0);
+}
+
+#ifdef DO_PTHREADS
+static int
+__res_init_ctx(void) {
+
+	mtctxres_t	*mt;
+	int		ret;
+
+
+	if (pthread_getspecific(key) != 0) {
+		/* Already exists */
+		return (0);
+	}
+
+	if ((mt = malloc(sizeof (mtctxres_t))) == 0) {
+		errno = ENOMEM;
+		return (-1);
+	}
+
+	memset(mt, 0, sizeof (mtctxres_t));
+
+	if ((ret = pthread_setspecific(key, mt)) != 0) {
+		free(mt);
+		errno = ret;
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+__res_destroy_ctx(void *value) {
+
+	mtctxres_t	*mt = (mtctxres_t *)value;
+
+	if (mt != 0)
+		free(mt);
+}
+#endif
+
+mtctxres_t *
+___mtctxres(void) {
+#ifdef DO_PTHREADS
+	mtctxres_t	*mt;
+
+	/*
+	 * This if clause should only be executed if we are linking
+	 * statically.  When linked dynamically _mtctxres_init() should
+	 * be called at binding time due the #pragma above.
+	 */
+	if (!mt_key_initialized) {
+		static pthread_mutex_t keylock = PTHREAD_MUTEX_INITIALIZER;
+                if (pthread_mutex_lock(&keylock) == 0) {
+			_mtctxres_init();
+			(void) pthread_mutex_unlock(&keylock);
+		}
+	}
+
+	/*
+	 * If we have already been called in this thread return the existing
+	 * context.  Otherwise recreat a new context and return it.  If
+	 * that fails return a global context.
+	 */
+	if (mt_key_initialized) {
+		if (((mt = pthread_getspecific(key)) != 0) ||
+		    (__res_init_ctx() == 0 &&
+		     (mt = pthread_getspecific(key)) != 0)) {
+			return (mt);
+		}
+	}
+#endif
+	return (&sharedctx);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_comp.c b/usr/src/lib/libresolv2_joy/common/resolv/res_comp.c
new file mode 100644
index 0000000000..c82bf01eb8
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_comp.c
@@ -0,0 +1,287 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (c) 1985, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)res_comp.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: res_comp.c,v 1.5 2005/07/28 06:51:50 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+#include <sys/types.h>
+#include <sys/param.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <ctype.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include "port_after.h"
+
+#ifndef	ORIGINAL_ISC_CODE
+#pragma weak	__dn_skipname	=	dn_skipname
+#pragma weak	__res_dnok	=	res_dnok
+#pragma weak	__res_hnok	=	res_hnok
+#pragma weak	__res_mailok	=	res_mailok
+#pragma weak	__res_ownok	=	res_ownok
+#endif	/* ORIGINAL_ISC_CODE */
+
+/*%
+ * Expand compressed domain name 'src' to full domain name.
+ *
+ * \li 'msg' is a pointer to the begining of the message,
+ * \li 'eom' points to the first location after the message,
+ * \li 'dst' is a pointer to a buffer of size 'dstsiz' for the result.
+ * \li Return size of compressed name or -1 if there was an error.
+ */
+int
+dn_expand(const u_char *msg, const u_char *eom, const u_char *src,
+	  char *dst, int dstsiz)
+{
+	int n = ns_name_uncompress(msg, eom, src, dst, (size_t)dstsiz);
+
+	if (n > 0 && dst[0] == '.')
+		dst[0] = '\0';
+	return (n);
+}
+
+/*%
+ * Pack domain name 'exp_dn' in presentation form into 'comp_dn'.
+ *
+ * \li Return the size of the compressed name or -1.
+ * \li 'length' is the size of the array pointed to by 'comp_dn'.
+ */
+int
+dn_comp(const char *src, u_char *dst, int dstsiz,
+	u_char **dnptrs, u_char **lastdnptr)
+{
+	return (ns_name_compress(src, dst, (size_t)dstsiz,
+				 (const u_char **)dnptrs,
+				 (const u_char **)lastdnptr));
+}
+
+
+/*%
+ * Skip over a compressed domain name. Return the size or -1.
+ */
+int
+dn_skipname(const u_char *ptr, const u_char *eom) {
+	const u_char *saveptr = ptr;
+
+	if (ns_name_skip(&ptr, eom) == -1)
+		return (-1);
+	return (ptr - saveptr);
+}
+
+/*%
+ * Verify that a domain name uses an acceptable character set.
+ *
+ * Note the conspicuous absence of ctype macros in these definitions.  On
+ * non-ASCII hosts, we can't depend on string literals or ctype macros to
+ * tell us anything about network-format data.  The rest of the BIND system
+ * is not careful about this, but for some reason, we're doing it right here.
+ */
+#define PERIOD 0x2e
+#define	hyphenchar(c) ((c) == 0x2d)
+#define bslashchar(c) ((c) == 0x5c)
+#ifdef	SUNW_HNOK_UNDERSCORE
+#define	underscorechar(c)	((c) == 0x5f)
+#endif	/* SUNW_HNOK_UNDERSCORE */
+#define periodchar(c) ((c) == PERIOD)
+#define asterchar(c) ((c) == 0x2a)
+#define alphachar(c) (((c) >= 0x41 && (c) <= 0x5a) \
+		   || ((c) >= 0x61 && (c) <= 0x7a))
+#define digitchar(c) ((c) >= 0x30 && (c) <= 0x39)
+
+#define borderchar(c) (alphachar(c) || digitchar(c))
+#ifdef	SUNW_HNOK_UNDERSCORE
+#define middlechar(c) (borderchar(c) || hyphenchar(c) || underscorechar(c))
+#else
+#define middlechar(c) (borderchar(c) || hyphenchar(c))
+#endif	/* SUNW_HNOK_UNDERSCORE */
+#define	domainchar(c) ((c) > 0x20 && (c) < 0x7f)
+
+int
+res_hnok(const char *dn) {
+	int pch = PERIOD, ch = *dn++;
+
+	while (ch != '\0') {
+		int nch = *dn++;
+
+		if (periodchar(ch)) {
+			(void)NULL;
+		} else if (periodchar(pch)) {
+			if (!borderchar(ch))
+				return (0);
+		} else if (periodchar(nch) || nch == '\0') {
+			if (!borderchar(ch))
+				return (0);
+		} else {
+			if (!middlechar(ch))
+				return (0);
+		}
+		pch = ch, ch = nch;
+	}
+	return (1);
+}
+
+/*%
+ * hostname-like (A, MX, WKS) owners can have "*" as their first label
+ * but must otherwise be as a host name.
+ */
+int
+res_ownok(const char *dn) {
+	if (asterchar(dn[0])) {
+		if (periodchar(dn[1]))
+			return (res_hnok(dn+2));
+		if (dn[1] == '\0')
+			return (1);
+	}
+	return (res_hnok(dn));
+}
+
+/*%
+ * SOA RNAMEs and RP RNAMEs can have any printable character in their first
+ * label, but the rest of the name has to look like a host name.
+ */
+int
+res_mailok(const char *dn) {
+	int ch, escaped = 0;
+
+	/* "." is a valid missing representation */
+	if (*dn == '\0')
+		return (1);
+
+	/* otherwise <label>.<hostname> */
+	while ((ch = *dn++) != '\0') {
+		if (!domainchar(ch))
+			return (0);
+		if (!escaped && periodchar(ch))
+			break;
+		if (escaped)
+			escaped = 0;
+		else if (bslashchar(ch))
+			escaped = 1;
+	}
+	if (periodchar(ch))
+		return (res_hnok(dn));
+	return (0);
+}
+
+/*%
+ * This function is quite liberal, since RFC1034's character sets are only
+ * recommendations.
+ */
+int
+res_dnok(const char *dn) {
+	int ch;
+
+	while ((ch = *dn++) != '\0')
+		if (!domainchar(ch))
+			return (0);
+	return (1);
+}
+
+#ifdef BIND_4_COMPAT
+/*%
+ * This module must export the following externally-visible symbols:
+ *	___putlong
+ *	___putshort
+ *	__getlong
+ *	__getshort
+ * Note that one _ comes from C and the others come from us.
+ */
+
+#ifdef SOLARIS2
+#ifdef  __putlong
+#undef  __putlong
+#endif
+#ifdef  __putshort
+#undef  __putshort
+#endif
+#pragma weak    putlong         =       __putlong
+#pragma weak    putshort        =       __putshort
+#endif /* SOLARIS2 */
+
+void __putlong(u_int32_t src, u_char *dst) { ns_put32(src, dst); }
+void __putshort(u_int16_t src, u_char *dst) { ns_put16(src, dst); }
+#ifndef __ultrix__
+u_int32_t _getlong(const u_char *src) { return (ns_get32(src)); }
+u_int16_t _getshort(const u_char *src) { return (ns_get16(src)); }
+#endif /*__ultrix__*/
+#endif /*BIND_4_COMPAT*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_data.c b/usr/src/lib/libresolv2_joy/common/resolv/res_data.c
new file mode 100644
index 0000000000..f1e0dd030b
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_data.c
@@ -0,0 +1,322 @@
+/*
+ * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ */
+
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1995-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$Id: res_data.c,v 1.7 2008/12/11 09:59:00 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <res_update.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "port_after.h"
+
+#ifndef	ORIGINAL_ISC_CODE
+#pragma weak	__fp_nquery	=	fp_nquery
+#pragma weak	__fp_query	=	fp_query
+#pragma weak	__p_query	=	p_query
+#pragma weak	__hostalias	=	hostalias
+#pragma weak	__res_randomid	=	res_randomid
+#endif
+
+const char *_res_opcodes[] = {
+	"QUERY",
+	"IQUERY",
+	"CQUERYM",
+	"CQUERYU",	/*%< experimental */
+	"NOTIFY",	/*%< experimental */
+	"UPDATE",
+	"6",
+	"7",
+	"8",
+	"9",
+	"10",
+	"11",
+	"12",
+	"13",
+	"ZONEINIT",
+	"ZONEREF",
+};
+
+#ifdef BIND_UPDATE
+const char *_res_sectioncodes[] = {
+	"ZONE",
+	"PREREQUISITES",
+	"UPDATE",
+	"ADDITIONAL",
+};
+#endif
+
+#undef _res
+#ifndef __BIND_NOSTATIC
+struct __res_state _res
+# if defined(__BIND_RES_TEXT)
+	= { RES_TIMEOUT, }	/*%< Motorola, et al. */
+# endif
+        ;
+
+#ifdef	ORIGINAL_ISC_CODE
+#if defined(DO_PTHREADS) || defined(__linux)
+#define _res (*__res_state())
+#endif
+#endif
+
+/* Proto. */
+
+int  res_ourserver_p(const res_state, const struct sockaddr_in *);
+
+int
+res_init(void) {
+	extern int __res_vinit(res_state, int);
+
+	/*
+	 * These three fields used to be statically initialized.  This made
+	 * it hard to use this code in a shared library.  It is necessary,
+	 * now that we're doing dynamic initialization here, that we preserve
+	 * the old semantics: if an application modifies one of these three
+	 * fields of _res before res_init() is called, res_init() will not
+	 * alter them.  Of course, if an application is setting them to
+	 * _zero_ before calling res_init(), hoping to override what used
+	 * to be the static default, we can't detect it and unexpected results
+	 * will follow.  Zero for any of these fields would make no sense,
+	 * so one can safely assume that the applications were already getting
+	 * unexpected results.
+	 *
+	 * _res.options is tricky since some apps were known to diddle the bits
+	 * before res_init() was first called. We can't replicate that semantic
+	 * with dynamic initialization (they may have turned bits off that are
+	 * set in RES_DEFAULT).  Our solution is to declare such applications
+	 * "broken".  They could fool us by setting RES_INIT but none do (yet).
+	 */
+	if (!_res.retrans)
+		_res.retrans = RES_TIMEOUT;
+	if (!_res.retry)
+		_res.retry = 4;
+	if (!(_res.options & RES_INIT))
+		_res.options = RES_DEFAULT;
+
+	/*
+	 * This one used to initialize implicitly to zero, so unless the app
+	 * has set it to something in particular, we can randomize it now.
+	 */
+	if (!_res.id)
+		_res.id = res_nrandomid(&_res);
+
+	return (__res_vinit(&_res, 1));
+}
+
+void
+p_query(const u_char *msg) {
+	fp_query(msg, stdout);
+}
+
+void
+fp_query(const u_char *msg, FILE *file) {
+	fp_nquery(msg, PACKETSZ, file);
+}
+
+void
+fp_nquery(const u_char *msg, int len, FILE *file) {
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1)
+		return;
+
+	res_pquery(&_res, msg, len, file);
+}
+
+int
+res_mkquery(int op,			/*!< opcode of query  */
+	    const char *dname,		/*!< domain name  */
+	    int class, int type,	/*!< class and type of query  */
+	    const u_char *data,		/*!< resource record data  */
+	    int datalen,		/*!< length of data  */
+	    const u_char *newrr_in,	/*!< new rr for modify or append  */
+	    u_char *buf,		/*!< buffer to put query  */
+	    int buflen)			/*!< size of buffer  */
+{
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
+		return (-1);
+	}
+	return (res_nmkquery(&_res, op, dname, class, type,
+			     data, datalen,
+			     newrr_in, buf, buflen));
+}
+
+int
+res_mkupdate(ns_updrec *rrecp_in, u_char *buf, int buflen) {
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
+		return (-1);
+	}
+
+	return (res_nmkupdate(&_res, rrecp_in, buf, buflen));
+}
+
+int
+res_query(const char *name,	/*!< domain name  */
+	  int class, int type,	/*!< class and type of query  */
+	  u_char *answer,	/*!< buffer to put answer  */
+	  int anslen)		/*!< size of answer buffer  */
+{
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
+		return (-1);
+	}
+	return (res_nquery(&_res, name, class, type, answer, anslen));
+}
+
+void
+res_send_setqhook(res_send_qhook hook) {
+	_res.qhook = hook;
+}
+
+void
+res_send_setrhook(res_send_rhook hook) {
+	_res.rhook = hook;
+}
+
+int
+res_isourserver(const struct sockaddr_in *inp) {
+	return (res_ourserver_p(&_res, inp));
+}
+
+int
+res_send(const u_char *buf, int buflen, u_char *ans, int anssiz) {
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		/* errno should have been set by res_init() in this case. */
+		return (-1);
+	}
+
+	return (res_nsend(&_res, buf, buflen, ans, anssiz));
+}
+
+int
+res_sendsigned(const u_char *buf, int buflen, ns_tsig_key *key,
+	       u_char *ans, int anssiz)
+{
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		/* errno should have been set by res_init() in this case. */
+		return (-1);
+	}
+
+	return (res_nsendsigned(&_res, buf, buflen, key, ans, anssiz));
+}
+
+void
+res_close(void) {
+	res_nclose(&_res);
+}
+
+int
+res_update(ns_updrec *rrecp_in) {
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
+		return (-1);
+	}
+
+	return (res_nupdate(&_res, rrecp_in, NULL));
+}
+
+int
+res_search(const char *name,	/*!< domain name  */
+	   int class, int type,	/*!< class and type of query  */
+	   u_char *answer,	/*!< buffer to put answer  */
+	   int anslen)		/*!< size of answer  */
+{
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
+		return (-1);
+	}
+
+	return (res_nsearch(&_res, name, class, type, answer, anslen));
+}
+
+int
+res_querydomain(const char *name,
+		const char *domain,
+		int class, int type,	/*!< class and type of query  */
+		u_char *answer,		/*!< buffer to put answer  */
+		int anslen)		/*!< size of answer  */
+{
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
+		return (-1);
+	}
+
+	return (res_nquerydomain(&_res, name, domain,
+				 class, type,
+				 answer, anslen));
+}
+
+u_int
+res_randomid(void) {
+	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
+		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
+		return (-1);
+	}
+
+	return (res_nrandomid(&_res));
+}
+
+const char *
+hostalias(const char *name) {
+	static char abuf[MAXDNAME];
+
+	return (res_hostalias(&_res, name, abuf, sizeof abuf));
+}
+
+#ifdef ultrix
+int
+local_hostname_length(const char *hostname) {
+	int len_host, len_domain;
+
+	if (!*_res.defdname)
+		res_init();
+	len_host = strlen(hostname);
+	len_domain = strlen(_res.defdname);
+	if (len_host > len_domain &&
+	    !strcasecmp(hostname + len_host - len_domain, _res.defdname) &&
+	    hostname[len_host - len_domain - 1] == '.')
+		return (len_host - len_domain - 1);
+	return (0);
+}
+#endif /*ultrix*/
+
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_debug.c b/usr/src/lib/libresolv2_joy/common/resolv/res_debug.c
new file mode 100644
index 0000000000..e11fb29612
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_debug.c
@@ -0,0 +1,1252 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Portions Copyright (C) 2004, 2005, 2008, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1996-2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1985
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Portions Copyright (c) 1995 by International Business Machines, Inc.
+ *
+ * International Business Machines, Inc. (hereinafter called IBM) grants
+ * permission under its copyrights to use, copy, modify, and distribute this
+ * Software with or without fee, provided that the above copyright notice and
+ * all paragraphs of this notice appear in all copies, and that the name of IBM
+ * not be used in connection with the marketing of any product incorporating
+ * the Software or modifications thereof, without specific, written prior
+ * permission.
+ *
+ * To the extent it has a right to do so, IBM grants an immunity from suit
+ * under its patents, if any, for the use, sale or manufacture of products to
+ * the extent that such products are used for performing Domain Name System
+ * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
+ * granted for any product per se or for any other function of any product.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
+ * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+ * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)res_debug.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: res_debug.c,v 1.19 2009/02/26 11:20:20 tbox Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <math.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <resolv_mt.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include "port_after.h"
+
+#ifdef SPRINTF_CHAR
+# define SPRINTF(x) strlen(sprintf/**/x)
+#else
+# define SPRINTF(x) sprintf x
+#endif
+
+extern const char *_res_opcodes[];
+extern const char *_res_sectioncodes[];
+
+#ifndef	ORIGINAL_ISC_CODE
+#pragma weak	__dn_count_labels	=	dn_count_labels
+#pragma weak	__fp_resstat		=	fp_resstat
+#pragma weak	__loc_aton		=	loc_aton
+#pragma weak	__loc_ntoa		=	loc_ntoa
+#pragma weak	__p_cdname		=	p_cdname
+#pragma weak	__p_class		=	p_class
+#pragma weak	__p_section		=	p_section
+#pragma weak	__p_time		=	p_time
+#pragma weak	__p_type		=	p_type
+#pragma weak	__sym_ntop		=	sym_ntop
+#pragma weak	__sym_ntos		=	sym_ntos
+#pragma weak	__sym_ston		=	sym_ston
+#endif	/* ORIGINAL_ISC_CODE */
+
+/*%
+ * Print the current options.
+ */
+void
+fp_resstat(const res_state statp, FILE *file) {
+	u_long mask;
+
+	fprintf(file, ";; res options:");
+	for (mask = 1;  mask != 0U;  mask <<= 1)
+		if (statp->options & mask)
+			fprintf(file, " %s", p_option(mask));
+	putc('\n', file);
+}
+
+static void
+do_section(const res_state statp,
+	   ns_msg *handle, ns_sect section,
+	   int pflag, FILE *file)
+{
+	int n, sflag, rrnum;
+	static int buflen = 2048;
+	char *buf;
+	ns_opcode opcode;
+	ns_rr rr;
+
+	/*
+	 * Print answer records.
+	 */
+	sflag = (statp->pfcode & pflag);
+	if (statp->pfcode && !sflag)
+		return;
+
+	buf = malloc(buflen);
+	if (buf == NULL) {
+		fprintf(file, ";; memory allocation failure\n");
+		return;
+	}
+
+	opcode = (ns_opcode) ns_msg_getflag(*handle, ns_f_opcode);
+	rrnum = 0;
+	for (;;) {
+		if (ns_parserr(handle, section, rrnum, &rr)) {
+			if (errno != ENODEV)
+				fprintf(file, ";; ns_parserr: %s\n",
+					strerror(errno));
+			else if (rrnum > 0 && sflag != 0 &&
+				 (statp->pfcode & RES_PRF_HEAD1))
+				putc('\n', file);
+			goto cleanup;
+		}
+		if (rrnum == 0 && sflag != 0 && (statp->pfcode & RES_PRF_HEAD1))
+			fprintf(file, ";; %s SECTION:\n",
+				p_section(section, opcode));
+		if (section == ns_s_qd)
+			fprintf(file, ";;\t%s, type = %s, class = %s\n",
+				ns_rr_name(rr),
+				p_type(ns_rr_type(rr)),
+				p_class(ns_rr_class(rr)));
+		else if (section == ns_s_ar && ns_rr_type(rr) == ns_t_opt) {
+			u_int16_t optcode, optlen, rdatalen = ns_rr_rdlen(rr);
+			u_int32_t ttl = ns_rr_ttl(rr);
+
+			fprintf(file,
+				"; EDNS: version: %u, udp=%u, flags=%04x\n",
+				(ttl>>16)&0xff, ns_rr_class(rr), ttl&0xffff);
+
+			while (rdatalen >= 4) {
+				const u_char *cp = ns_rr_rdata(rr);
+				int i;
+
+				GETSHORT(optcode, cp);
+				GETSHORT(optlen, cp);
+
+				if (optcode == NS_OPT_NSID) {
+					fputs("; NSID: ", file);
+					if (optlen == 0) {
+						fputs("; NSID\n", file);
+					} else {
+						fputs("; NSID: ", file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%02x ",
+								cp[i]);
+						fputs(" (",file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%c",
+								isprint(cp[i])?
+								cp[i] : '.');
+						fputs(")\n", file);
+					}
+				} else {
+					if (optlen == 0) {
+						fprintf(file, "; OPT=%u\n",
+							optcode);
+					} else {
+						fprintf(file, "; OPT=%u: ",
+							optcode);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%02x ",
+								cp[i]);
+						fputs(" (",file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%c",
+								isprint(cp[i]) ?
+									cp[i] : '.');
+						fputs(")\n", file);
+					}
+				}
+				rdatalen -= 4 + optlen;
+			}
+		} else {
+			n = ns_sprintrr(handle, &rr, NULL, NULL,
+					buf, buflen);
+			if (n < 0) {
+				if (errno == ENOSPC) {
+					free(buf);
+					buf = NULL;
+					if (buflen < 131072)
+						buf = malloc(buflen += 1024);
+					if (buf == NULL) {
+						fprintf(file,
+					      ";; memory allocation failure\n");
+					      return;
+					}
+					continue;
+				}
+				fprintf(file, ";; ns_sprintrr: %s\n",
+					strerror(errno));
+				goto cleanup;
+			}
+			fputs(buf, file);
+			fputc('\n', file);
+		}
+		rrnum++;
+	}
+ cleanup:
+	if (buf != NULL)
+		free(buf);
+}
+
+/*%
+ * Print the contents of a query.
+ * This is intended to be primarily a debugging routine.
+ */
+void
+res_pquery(const res_state statp, const u_char *msg, int len, FILE *file) {
+	ns_msg handle;
+	int qdcount, ancount, nscount, arcount;
+	u_int opcode, rcode, id;
+
+	if (ns_initparse(msg, len, &handle) < 0) {
+		fprintf(file, ";; ns_initparse: %s\n", strerror(errno));
+		return;
+	}
+	opcode = ns_msg_getflag(handle, ns_f_opcode);
+	rcode = ns_msg_getflag(handle, ns_f_rcode);
+	id = ns_msg_id(handle);
+	qdcount = ns_msg_count(handle, ns_s_qd);
+	ancount = ns_msg_count(handle, ns_s_an);
+	nscount = ns_msg_count(handle, ns_s_ns);
+	arcount = ns_msg_count(handle, ns_s_ar);
+
+	/*
+	 * Print header fields.
+	 */
+	if ((!statp->pfcode) || (statp->pfcode & RES_PRF_HEADX) || rcode)
+		fprintf(file,
+			";; ->>HEADER<<- opcode: %s, status: %s, id: %d\n",
+			_res_opcodes[opcode], p_rcode(rcode), id);
+	if ((!statp->pfcode) || (statp->pfcode & RES_PRF_HEADX))
+		putc(';', file);
+	if ((!statp->pfcode) || (statp->pfcode & RES_PRF_HEAD2)) {
+		fprintf(file, "; flags:");
+		if (ns_msg_getflag(handle, ns_f_qr))
+			fprintf(file, " qr");
+		if (ns_msg_getflag(handle, ns_f_aa))
+			fprintf(file, " aa");
+		if (ns_msg_getflag(handle, ns_f_tc))
+			fprintf(file, " tc");
+		if (ns_msg_getflag(handle, ns_f_rd))
+			fprintf(file, " rd");
+		if (ns_msg_getflag(handle, ns_f_ra))
+			fprintf(file, " ra");
+		if (ns_msg_getflag(handle, ns_f_z))
+			fprintf(file, " ??");
+		if (ns_msg_getflag(handle, ns_f_ad))
+			fprintf(file, " ad");
+		if (ns_msg_getflag(handle, ns_f_cd))
+			fprintf(file, " cd");
+	}
+	if ((!statp->pfcode) || (statp->pfcode & RES_PRF_HEAD1)) {
+		fprintf(file, "; %s: %d",
+			p_section(ns_s_qd, opcode), qdcount);
+		fprintf(file, ", %s: %d",
+			p_section(ns_s_an, opcode), ancount);
+		fprintf(file, ", %s: %d",
+			p_section(ns_s_ns, opcode), nscount);
+		fprintf(file, ", %s: %d",
+			p_section(ns_s_ar, opcode), arcount);
+	}
+	if ((!statp->pfcode) || (statp->pfcode &
+		(RES_PRF_HEADX | RES_PRF_HEAD2 | RES_PRF_HEAD1))) {
+		putc('\n',file);
+	}
+	/*
+	 * Print the various sections.
+	 */
+	do_section(statp, &handle, ns_s_qd, RES_PRF_QUES, file);
+	do_section(statp, &handle, ns_s_an, RES_PRF_ANS, file);
+	do_section(statp, &handle, ns_s_ns, RES_PRF_AUTH, file);
+	do_section(statp, &handle, ns_s_ar, RES_PRF_ADD, file);
+	if (qdcount == 0 && ancount == 0 &&
+	    nscount == 0 && arcount == 0)
+		putc('\n', file);
+}
+
+const u_char *
+p_cdnname(const u_char *cp, const u_char *msg, int len, FILE *file) {
+	char name[MAXDNAME];
+	int n;
+
+	if ((n = dn_expand(msg, msg + len, cp, name, sizeof name)) < 0)
+		return (NULL);
+	if (name[0] == '\0')
+		putc('.', file);
+	else
+		fputs(name, file);
+	return (cp + n);
+}
+
+const u_char *
+p_cdname(const u_char *cp, const u_char *msg, FILE *file) {
+	return (p_cdnname(cp, msg, PACKETSZ, file));
+}
+
+/*%
+ * Return a fully-qualified domain name from a compressed name (with
+   length supplied).  */
+
+const u_char *
+p_fqnname(cp, msg, msglen, name, namelen)
+	const u_char *cp, *msg;
+	int msglen;
+	char *name;
+	int namelen;
+{
+	int n, newlen;
+
+	if ((n = dn_expand(msg, cp + msglen, cp, name, namelen)) < 0)
+		return (NULL);
+	newlen = strlen(name);
+	if (newlen == 0 || name[newlen - 1] != '.') {
+		if (newlen + 1 >= namelen)	/*%< Lack space for final dot */
+			return (NULL);
+		else
+			strcpy(name + newlen, ".");
+	}
+	return (cp + n);
+}
+
+/* XXX:	the rest of these functions need to become length-limited, too. */
+
+const u_char *
+p_fqname(const u_char *cp, const u_char *msg, FILE *file) {
+	char name[MAXDNAME];
+	const u_char *n;
+
+	n = p_fqnname(cp, msg, MAXCDNAME, name, sizeof name);
+	if (n == NULL)
+		return (NULL);
+	fputs(name, file);
+	return (n);
+}
+
+/*%
+ * Names of RR classes and qclasses.  Classes and qclasses are the same, except
+ * that C_ANY is a qclass but not a class.  (You can ask for records of class
+ * C_ANY, but you can't have any records of that class in the database.)
+ */
+const struct res_sym __p_class_syms[] = {
+	{C_IN,		"IN",		(char *)0},
+	{C_CHAOS,	"CH",		(char *)0},
+	{C_CHAOS,	"CHAOS",	(char *)0},
+	{C_HS,		"HS",		(char *)0},
+	{C_HS,		"HESIOD",	(char *)0},
+	{C_ANY,		"ANY",		(char *)0},
+	{C_NONE,	"NONE",		(char *)0},
+	{C_IN, 		(char *)0,	(char *)0}
+};
+
+/*%
+ * Names of message sections.
+ */
+const struct res_sym __p_default_section_syms[] = {
+	{ns_s_qd,	"QUERY",	(char *)0},
+	{ns_s_an,	"ANSWER",	(char *)0},
+	{ns_s_ns,	"AUTHORITY",	(char *)0},
+	{ns_s_ar,	"ADDITIONAL",	(char *)0},
+	{0,		(char *)0,	(char *)0}
+};
+
+const struct res_sym __p_update_section_syms[] = {
+	{S_ZONE,	"ZONE",		(char *)0},
+	{S_PREREQ,	"PREREQUISITE",	(char *)0},
+	{S_UPDATE,	"UPDATE",	(char *)0},
+	{S_ADDT,	"ADDITIONAL",	(char *)0},
+	{0,		(char *)0,	(char *)0}
+};
+
+const struct res_sym __p_key_syms[] = {
+	{NS_ALG_MD5RSA,		"RSA",		"RSA KEY with MD5 hash"},
+	{NS_ALG_DH,		"DH",		"Diffie Hellman"},
+	{NS_ALG_DSA,		"DSA",		"Digital Signature Algorithm"},
+	{NS_ALG_EXPIRE_ONLY,	"EXPIREONLY",	"No algorithm"},
+	{NS_ALG_PRIVATE_OID,	"PRIVATE",	"Algorithm obtained from OID"},
+	{0,			NULL,		NULL}
+};
+
+const struct res_sym __p_cert_syms[] = {
+	{cert_t_pkix,	"PKIX",		"PKIX (X.509v3) Certificate"},
+	{cert_t_spki,	"SPKI",		"SPKI certificate"},
+	{cert_t_pgp,	"PGP",		"PGP certificate"},
+	{cert_t_url,	"URL",		"URL Private"},
+	{cert_t_oid,	"OID",		"OID Private"},
+	{0,		NULL,		NULL}
+};
+
+/*%
+ * Names of RR types and qtypes.  Types and qtypes are the same, except
+ * that T_ANY is a qtype but not a type.  (You can ask for records of type
+ * T_ANY, but you can't have any records of that type in the database.)
+ */
+const struct res_sym __p_type_syms[] = {
+	{ns_t_a,	"A",		"address"},
+	{ns_t_ns,	"NS",		"name server"},
+	{ns_t_md,	"MD",		"mail destination (deprecated)"},
+	{ns_t_mf,	"MF",		"mail forwarder (deprecated)"},
+	{ns_t_cname,	"CNAME",	"canonical name"},
+	{ns_t_soa,	"SOA",		"start of authority"},
+	{ns_t_mb,	"MB",		"mailbox"},
+	{ns_t_mg,	"MG",		"mail group member"},
+	{ns_t_mr,	"MR",		"mail rename"},
+	{ns_t_null,	"NULL",		"null"},
+	{ns_t_wks,	"WKS",		"well-known service (deprecated)"},
+	{ns_t_ptr,	"PTR",		"domain name pointer"},
+	{ns_t_hinfo,	"HINFO",	"host information"},
+	{ns_t_minfo,	"MINFO",	"mailbox information"},
+	{ns_t_mx,	"MX",		"mail exchanger"},
+	{ns_t_txt,	"TXT",		"text"},
+	{ns_t_rp,	"RP",		"responsible person"},
+	{ns_t_afsdb,	"AFSDB",	"DCE or AFS server"},
+	{ns_t_x25,	"X25",		"X25 address"},
+	{ns_t_isdn,	"ISDN",		"ISDN address"},
+	{ns_t_rt,	"RT",		"router"},
+	{ns_t_nsap,	"NSAP",		"nsap address"},
+	{ns_t_nsap_ptr,	"NSAP_PTR",	"domain name pointer"},
+	{ns_t_sig,	"SIG",		"signature"},
+	{ns_t_key,	"KEY",		"key"},
+	{ns_t_px,	"PX",		"mapping information"},
+	{ns_t_gpos,	"GPOS",		"geographical position (withdrawn)"},
+	{ns_t_aaaa,	"AAAA",		"IPv6 address"},
+	{ns_t_loc,	"LOC",		"location"},
+	{ns_t_nxt,	"NXT",		"next valid name (unimplemented)"},
+	{ns_t_eid,	"EID",		"endpoint identifier (unimplemented)"},
+	{ns_t_nimloc,	"NIMLOC",	"NIMROD locator (unimplemented)"},
+	{ns_t_srv,	"SRV",		"server selection"},
+	{ns_t_atma,	"ATMA",		"ATM address (unimplemented)"},
+	{ns_t_naptr,	"NAPTR",	"naptr"},
+	{ns_t_kx,	"KX",		"key exchange"},
+	{ns_t_cert,	"CERT",		"certificate"},
+	{ns_t_a6,	"A",		"IPv6 address (experminental)"},
+	{ns_t_dname,	"DNAME",	"non-terminal redirection"},
+	{ns_t_opt,	"OPT",		"opt"},
+	{ns_t_apl,	"apl",		"apl"},
+	{ns_t_ds,	"DS",		"delegation signer"},
+	{ns_t_sshfp,	"SSFP",		"SSH fingerprint"},
+	{ns_t_ipseckey,	"IPSECKEY",	"IPSEC key"},
+	{ns_t_rrsig,	"RRSIG",	"rrsig"},
+	{ns_t_nsec,	"NSEC",		"nsec"},
+	{ns_t_dnskey,	"DNSKEY",	"DNS key"},
+	{ns_t_dhcid,	"DHCID",       "dynamic host configuration identifier"},
+	{ns_t_nsec3,	"NSEC3",	"nsec3"},
+	{ns_t_nsec3param, "NSEC3PARAM", "NSEC3 parameters"},
+	{ns_t_hip,	"HIP",		"host identity protocol"},
+	{ns_t_spf,	"SPF",		"sender policy framework"},
+	{ns_t_tkey,	"TKEY",		"tkey"},
+	{ns_t_tsig,	"TSIG",		"transaction signature"},
+	{ns_t_ixfr,	"IXFR",		"incremental zone transfer"},
+	{ns_t_axfr,	"AXFR",		"zone transfer"},
+	{ns_t_zxfr,	"ZXFR",		"compressed zone transfer"},
+	{ns_t_mailb,	"MAILB",	"mailbox-related data (deprecated)"},
+	{ns_t_maila,	"MAILA",	"mail agent (deprecated)"},
+	{ns_t_naptr,	"NAPTR",	"URN Naming Authority"},
+	{ns_t_kx,	"KX",		"Key Exchange"},
+	{ns_t_cert,	"CERT",		"Certificate"},
+	{ns_t_a6,	"A6",		"IPv6 Address"},
+	{ns_t_dname,	"DNAME",	"dname"},
+	{ns_t_sink,	"SINK",		"Kitchen Sink (experimental)"},
+	{ns_t_opt,	"OPT",		"EDNS Options"},
+	{ns_t_any,	"ANY",		"\"any\""},
+	{ns_t_dlv,	"DLV",		"DNSSEC look-aside validation"},
+	{0, 		NULL,		NULL}
+};
+
+/*%
+ * Names of DNS rcodes.
+ */
+const struct res_sym __p_rcode_syms[] = {
+	{ns_r_noerror,	"NOERROR",		"no error"},
+	{ns_r_formerr,	"FORMERR",		"format error"},
+	{ns_r_servfail,	"SERVFAIL",		"server failed"},
+	{ns_r_nxdomain,	"NXDOMAIN",		"no such domain name"},
+	{ns_r_notimpl,	"NOTIMP",		"not implemented"},
+	{ns_r_refused,	"REFUSED",		"refused"},
+	{ns_r_yxdomain,	"YXDOMAIN",		"domain name exists"},
+	{ns_r_yxrrset,	"YXRRSET",		"rrset exists"},
+	{ns_r_nxrrset,	"NXRRSET",		"rrset doesn't exist"},
+	{ns_r_notauth,	"NOTAUTH",		"not authoritative"},
+	{ns_r_notzone,	"NOTZONE",		"Not in zone"},
+	{ns_r_max,	"",			""},
+	{ns_r_badsig,	"BADSIG",		"bad signature"},
+	{ns_r_badkey,	"BADKEY",		"bad key"},
+	{ns_r_badtime,	"BADTIME",		"bad time"},
+	{0, 		NULL,			NULL}
+};
+
+int
+sym_ston(const struct res_sym *syms, const char *name, int *success) {
+	for ((void)NULL; syms->name != 0; syms++) {
+		if (strcasecmp (name, syms->name) == 0) {
+			if (success)
+				*success = 1;
+			return (syms->number);
+		}
+	}
+	if (success)
+		*success = 0;
+	return (syms->number);		/*%< The default value. */
+}
+
+const char *
+sym_ntos(const struct res_sym *syms, int number, int *success) {
+	char *unname = sym_ntos_unname;
+
+	for ((void)NULL; syms->name != 0; syms++) {
+		if (number == syms->number) {
+			if (success)
+				*success = 1;
+			return (syms->name);
+		}
+	}
+
+	sprintf(unname, "%d", number);		/*%< XXX nonreentrant */
+	if (success)
+		*success = 0;
+	return (unname);
+}
+
+const char *
+sym_ntop(const struct res_sym *syms, int number, int *success) {
+	char *unname = sym_ntop_unname;
+
+	for ((void)NULL; syms->name != 0; syms++) {
+		if (number == syms->number) {
+			if (success)
+				*success = 1;
+			return (syms->humanname);
+		}
+	}
+	sprintf(unname, "%d", number);		/*%< XXX nonreentrant */
+	if (success)
+		*success = 0;
+	return (unname);
+}
+
+/*%
+ * Return a string for the type.
+ */
+const char *
+p_type(int type) {
+	int success;
+	const char *result;
+	static char typebuf[20];
+
+	result = sym_ntos(__p_type_syms, type, &success);
+	if (success)
+		return (result);
+	if (type < 0 || type > 0xffff)
+		return ("BADTYPE");
+	sprintf(typebuf, "TYPE%d", type);
+	return (typebuf);
+}
+
+/*%
+ * Return a string for the type.
+ */
+const char *
+p_section(int section, int opcode) {
+	const struct res_sym *symbols;
+
+	switch (opcode) {
+	case ns_o_update:
+		symbols = __p_update_section_syms;
+		break;
+	default:
+		symbols = __p_default_section_syms;
+		break;
+	}
+	return (sym_ntos(symbols, section, (int *)0));
+}
+
+/*%
+ * Return a mnemonic for class.
+ */
+const char *
+p_class(int class) {
+	int success;
+	const char *result;
+	static char classbuf[20];
+
+	result = sym_ntos(__p_class_syms, class, &success);
+	if (success)
+		return (result);
+	if (class < 0 || class > 0xffff)
+		return ("BADCLASS");
+	sprintf(classbuf, "CLASS%d", class);
+	return (classbuf);
+}
+
+/*%
+ * Return a mnemonic for an option
+ */
+const char *
+p_option(u_long option) {
+	char *nbuf = p_option_nbuf;
+
+	switch (option) {
+	case RES_INIT:		return "init";
+	case RES_DEBUG:		return "debug";
+	case RES_AAONLY:	return "aaonly(unimpl)";
+	case RES_USEVC:		return "usevc";
+	case RES_PRIMARY:	return "primry(unimpl)";
+	case RES_IGNTC:		return "igntc";
+	case RES_RECURSE:	return "recurs";
+	case RES_DEFNAMES:	return "defnam";
+	case RES_STAYOPEN:	return "styopn";
+	case RES_DNSRCH:	return "dnsrch";
+	case RES_INSECURE1:	return "insecure1";
+	case RES_INSECURE2:	return "insecure2";
+	case RES_NOALIASES:	return "noaliases";
+	case RES_USE_INET6:	return "inet6";
+#ifdef RES_USE_EDNS0	/*%< KAME extension */
+	case RES_USE_EDNS0:	return "edns0";
+	case RES_NSID:		return "nsid";
+#endif
+#ifdef RES_USE_DNAME
+	case RES_USE_DNAME:	return "dname";
+#endif
+#ifdef RES_USE_DNSSEC
+	case RES_USE_DNSSEC:	return "dnssec";
+#endif
+#ifdef RES_NOTLDQUERY
+	case RES_NOTLDQUERY:	return "no-tld-query";
+#endif
+#ifdef RES_NO_NIBBLE2
+	case RES_NO_NIBBLE2:	return "no-nibble2";
+#endif
+				/* XXX nonreentrant */
+	default:		sprintf(nbuf, "?0x%lx?", (u_long)option);
+				return (nbuf);
+	}
+}
+
+/*%
+ * Return a mnemonic for a time to live.
+ */
+const char *
+p_time(u_int32_t value) {
+	char *nbuf = p_time_nbuf;
+
+	if (ns_format_ttl(value, nbuf, sizeof nbuf) < 0)
+		sprintf(nbuf, "%u", value);
+	return (nbuf);
+}
+
+/*%
+ * Return a string for the rcode.
+ */
+const char *
+p_rcode(int rcode) {
+	return (sym_ntos(__p_rcode_syms, rcode, (int *)0));
+}
+
+/*%
+ * Return a string for a res_sockaddr_union.
+ */
+const char *
+p_sockun(union res_sockaddr_union u, char *buf, size_t size) {
+	char ret[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:123.123.123.123"];
+
+	switch (u.sin.sin_family) {
+	case AF_INET:
+		inet_ntop(AF_INET, &u.sin.sin_addr, ret, sizeof ret);
+		break;
+#ifdef HAS_INET6_STRUCTS
+	case AF_INET6:
+		inet_ntop(AF_INET6, &u.sin6.sin6_addr, ret, sizeof ret);
+		break;
+#endif
+	default:
+		sprintf(ret, "[af%d]", u.sin.sin_family);
+		break;
+	}
+	if (size > 0U) {
+		strncpy(buf, ret, size - 1);
+		buf[size - 1] = '0';
+	}
+	return (buf);
+}
+
+/*%
+ * routines to convert between on-the-wire RR format and zone file format.
+ * Does not contain conversion to/from decimal degrees; divide or multiply
+ * by 60*60*1000 for that.
+ */
+
+static unsigned int poweroften[10] = {1, 10, 100, 1000, 10000, 100000,
+				      1000000,10000000,100000000,1000000000};
+
+/*% takes an XeY precision/size value, returns a string representation. */
+static const char *
+precsize_ntoa(prec)
+	u_int8_t prec;
+{
+	char *retbuf = precsize_ntoa_retbuf;
+	unsigned long val;
+	int mantissa, exponent;
+
+	mantissa = (int)((prec >> 4) & 0x0f) % 10;
+	exponent = (int)((prec >> 0) & 0x0f) % 10;
+
+	val = mantissa * poweroften[exponent];
+
+	(void) sprintf(retbuf, "%lu.%.2lu", val/100, val%100);
+	return (retbuf);
+}
+
+/*% converts ascii size/precision X * 10**Y(cm) to 0xXY.  moves pointer.  */
+static u_int8_t
+precsize_aton(const char **strptr) {
+	unsigned int mval = 0, cmval = 0;
+	u_int8_t retval = 0;
+	const char *cp;
+	int exponent;
+	int mantissa;
+
+	cp = *strptr;
+
+	while (isdigit((unsigned char)*cp))
+		mval = mval * 10 + (*cp++ - '0');
+
+	if (*cp == '.') {		/*%< centimeters */
+		cp++;
+		if (isdigit((unsigned char)*cp)) {
+			cmval = (*cp++ - '0') * 10;
+			if (isdigit((unsigned char)*cp)) {
+				cmval += (*cp++ - '0');
+			}
+		}
+	}
+	cmval = (mval * 100) + cmval;
+
+	for (exponent = 0; exponent < 9; exponent++)
+		if (cmval < poweroften[exponent+1])
+			break;
+
+	mantissa = cmval / poweroften[exponent];
+	if (mantissa > 9)
+		mantissa = 9;
+
+	retval = (mantissa << 4) | exponent;
+
+	*strptr = cp;
+
+	return (retval);
+}
+
+/*% converts ascii lat/lon to unsigned encoded 32-bit number.  moves pointer. */
+static u_int32_t
+latlon2ul(const char **latlonstrptr, int *which) {
+	const char *cp;
+	u_int32_t retval;
+	int deg = 0, min = 0, secs = 0, secsfrac = 0;
+
+	cp = *latlonstrptr;
+
+	while (isdigit((unsigned char)*cp))
+		deg = deg * 10 + (*cp++ - '0');
+
+	while (isspace((unsigned char)*cp))
+		cp++;
+
+	if (!(isdigit((unsigned char)*cp)))
+		goto fndhemi;
+
+	while (isdigit((unsigned char)*cp))
+		min = min * 10 + (*cp++ - '0');
+
+	while (isspace((unsigned char)*cp))
+		cp++;
+
+	if (!(isdigit((unsigned char)*cp)))
+		goto fndhemi;
+
+	while (isdigit((unsigned char)*cp))
+		secs = secs * 10 + (*cp++ - '0');
+
+	if (*cp == '.') {		/*%< decimal seconds */
+		cp++;
+		if (isdigit((unsigned char)*cp)) {
+			secsfrac = (*cp++ - '0') * 100;
+			if (isdigit((unsigned char)*cp)) {
+				secsfrac += (*cp++ - '0') * 10;
+				if (isdigit((unsigned char)*cp)) {
+					secsfrac += (*cp++ - '0');
+				}
+			}
+		}
+	}
+
+	while (!isspace((unsigned char)*cp))	/*%< if any trailing garbage */
+		cp++;
+
+	while (isspace((unsigned char)*cp))
+		cp++;
+
+ fndhemi:
+	switch (*cp) {
+	case 'N': case 'n':
+	case 'E': case 'e':
+		retval = ((unsigned)1<<31)
+			+ (((((deg * 60) + min) * 60) + secs) * 1000)
+			+ secsfrac;
+		break;
+	case 'S': case 's':
+	case 'W': case 'w':
+		retval = ((unsigned)1<<31)
+			- (((((deg * 60) + min) * 60) + secs) * 1000)
+			- secsfrac;
+		break;
+	default:
+		retval = 0;	/*%< invalid value -- indicates error */
+		break;
+	}
+
+	switch (*cp) {
+	case 'N': case 'n':
+	case 'S': case 's':
+		*which = 1;	/*%< latitude */
+		break;
+	case 'E': case 'e':
+	case 'W': case 'w':
+		*which = 2;	/*%< longitude */
+		break;
+	default:
+		*which = 0;	/*%< error */
+		break;
+	}
+
+	cp++;			/*%< skip the hemisphere */
+	while (!isspace((unsigned char)*cp))	/*%< if any trailing garbage */
+		cp++;
+
+	while (isspace((unsigned char)*cp))	/*%< move to next field */
+		cp++;
+
+	*latlonstrptr = cp;
+
+	return (retval);
+}
+
+/*%
+ * converts a zone file representation in a string to an RDATA on-the-wire
+ * representation. */
+int
+loc_aton(ascii, binary)
+	const char *ascii;
+	u_char *binary;
+{
+	const char *cp, *maxcp;
+	u_char *bcp;
+
+	u_int32_t latit = 0, longit = 0, alt = 0;
+	u_int32_t lltemp1 = 0, lltemp2 = 0;
+	int altmeters = 0, altfrac = 0, altsign = 1;
+	u_int8_t hp = 0x16;	/*%< default = 1e6 cm = 10000.00m = 10km */
+	u_int8_t vp = 0x13;	/*%< default = 1e3 cm = 10.00m */
+	u_int8_t siz = 0x12;	/*%< default = 1e2 cm = 1.00m */
+	int which1 = 0, which2 = 0;
+
+	cp = ascii;
+	maxcp = cp + strlen(ascii);
+
+	lltemp1 = latlon2ul(&cp, &which1);
+
+	lltemp2 = latlon2ul(&cp, &which2);
+
+	switch (which1 + which2) {
+	case 3:			/*%< 1 + 2, the only valid combination */
+		if ((which1 == 1) && (which2 == 2)) { /*%< normal case */
+			latit = lltemp1;
+			longit = lltemp2;
+		} else if ((which1 == 2) && (which2 == 1)) { /*%< reversed */
+			longit = lltemp1;
+			latit = lltemp2;
+		} else {	/*%< some kind of brokenness */
+			return (0);
+		}
+		break;
+	default:		/*%< we didn't get one of each */
+		return (0);
+	}
+
+	/* altitude */
+	if (*cp == '-') {
+		altsign = -1;
+		cp++;
+	}
+
+	if (*cp == '+')
+		cp++;
+
+	while (isdigit((unsigned char)*cp))
+		altmeters = altmeters * 10 + (*cp++ - '0');
+
+	if (*cp == '.') {		/*%< decimal meters */
+		cp++;
+		if (isdigit((unsigned char)*cp)) {
+			altfrac = (*cp++ - '0') * 10;
+			if (isdigit((unsigned char)*cp)) {
+				altfrac += (*cp++ - '0');
+			}
+		}
+	}
+
+	alt = (10000000 + (altsign * (altmeters * 100 + altfrac)));
+
+	while (!isspace((unsigned char)*cp) && (cp < maxcp)) /*%< if trailing garbage or m */
+		cp++;
+
+	while (isspace((unsigned char)*cp) && (cp < maxcp))
+		cp++;
+
+	if (cp >= maxcp)
+		goto defaults;
+
+	siz = precsize_aton(&cp);
+
+	while (!isspace((unsigned char)*cp) && (cp < maxcp))	/*%< if trailing garbage or m */
+		cp++;
+
+	while (isspace((unsigned char)*cp) && (cp < maxcp))
+		cp++;
+
+	if (cp >= maxcp)
+		goto defaults;
+
+	hp = precsize_aton(&cp);
+
+	while (!isspace((unsigned char)*cp) && (cp < maxcp))	/*%< if trailing garbage or m */
+		cp++;
+
+	while (isspace((unsigned char)*cp) && (cp < maxcp))
+		cp++;
+
+	if (cp >= maxcp)
+		goto defaults;
+
+	vp = precsize_aton(&cp);
+
+ defaults:
+
+	bcp = binary;
+	*bcp++ = (u_int8_t) 0;	/*%< version byte */
+	*bcp++ = siz;
+	*bcp++ = hp;
+	*bcp++ = vp;
+	PUTLONG(latit,bcp);
+	PUTLONG(longit,bcp);
+	PUTLONG(alt,bcp);
+
+	return (16);		/*%< size of RR in octets */
+}
+
+/*% takes an on-the-wire LOC RR and formats it in a human readable format. */
+const char *
+loc_ntoa(binary, ascii)
+	const u_char *binary;
+	char *ascii;
+{
+	static const char *error = "?";
+	static char tmpbuf[sizeof
+"1000 60 60.000 N 1000 60 60.000 W -12345678.00m 90000000.00m 90000000.00m 90000000.00m"];
+	const u_char *cp = binary;
+
+	int latdeg, latmin, latsec, latsecfrac;
+	int longdeg, longmin, longsec, longsecfrac;
+	char northsouth, eastwest;
+	const char *altsign;
+	int altmeters, altfrac;
+
+	const u_int32_t referencealt = 100000 * 100;
+
+	int32_t latval, longval, altval;
+	u_int32_t templ;
+	u_int8_t sizeval, hpval, vpval, versionval;
+
+	char *sizestr, *hpstr, *vpstr;
+
+	versionval = *cp++;
+
+	if (ascii == NULL)
+		ascii = tmpbuf;
+
+	if (versionval) {
+		(void) sprintf(ascii, "; error: unknown LOC RR version");
+		return (ascii);
+	}
+
+	sizeval = *cp++;
+
+	hpval = *cp++;
+	vpval = *cp++;
+
+	GETLONG(templ, cp);
+	latval = (templ - ((unsigned)1<<31));
+
+	GETLONG(templ, cp);
+	longval = (templ - ((unsigned)1<<31));
+
+	GETLONG(templ, cp);
+	if (templ < referencealt) { /*%< below WGS 84 spheroid */
+		altval = referencealt - templ;
+		altsign = "-";
+	} else {
+		altval = templ - referencealt;
+		altsign = "";
+	}
+
+	if (latval < 0) {
+		northsouth = 'S';
+		latval = -latval;
+	} else
+		northsouth = 'N';
+
+	latsecfrac = latval % 1000;
+	latval = latval / 1000;
+	latsec = latval % 60;
+	latval = latval / 60;
+	latmin = latval % 60;
+	latval = latval / 60;
+	latdeg = latval;
+
+	if (longval < 0) {
+		eastwest = 'W';
+		longval = -longval;
+	} else
+		eastwest = 'E';
+
+	longsecfrac = longval % 1000;
+	longval = longval / 1000;
+	longsec = longval % 60;
+	longval = longval / 60;
+	longmin = longval % 60;
+	longval = longval / 60;
+	longdeg = longval;
+
+	altfrac = altval % 100;
+	altmeters = (altval / 100);
+
+	sizestr = strdup(precsize_ntoa(sizeval));
+	hpstr = strdup(precsize_ntoa(hpval));
+	vpstr = strdup(precsize_ntoa(vpval));
+
+	sprintf(ascii,
+	    "%d %.2d %.2d.%.3d %c %d %.2d %.2d.%.3d %c %s%d.%.2dm %sm %sm %sm",
+		latdeg, latmin, latsec, latsecfrac, northsouth,
+		longdeg, longmin, longsec, longsecfrac, eastwest,
+		altsign, altmeters, altfrac,
+		(sizestr != NULL) ? sizestr : error,
+		(hpstr != NULL) ? hpstr : error,
+		(vpstr != NULL) ? vpstr : error);
+
+	if (sizestr != NULL)
+		free(sizestr);
+	if (hpstr != NULL)
+		free(hpstr);
+	if (vpstr != NULL)
+		free(vpstr);
+
+	return (ascii);
+}
+
+
+/*% Return the number of DNS hierarchy levels in the name. */
+int
+dn_count_labels(const char *name) {
+	int i, len, count;
+
+	len = strlen(name);
+	for (i = 0, count = 0; i < len; i++) {
+		/* XXX need to check for \. or use named's nlabels(). */
+		if (name[i] == '.')
+			count++;
+	}
+
+	/* don't count initial wildcard */
+	if (name[0] == '*')
+		if (count)
+			count--;
+
+	/* don't count the null label for root. */
+	/* if terminating '.' not found, must adjust */
+	/* count to include last label */
+	if (len > 0 && name[len-1] != '.')
+		count++;
+	return (count);
+}
+
+/*%
+ * Make dates expressed in seconds-since-Jan-1-1970 easy to read.
+ * SIG records are required to be printed like this, by the Secure DNS RFC.
+ */
+char *
+p_secstodate (u_long secs) {
+	char *output = p_secstodate_output;
+	time_t clock = secs;
+	struct tm *time;
+#ifdef HAVE_TIME_R
+	struct tm res;
+
+	time = gmtime_r(&clock, &res);
+#else
+	time = gmtime(&clock);
+#endif
+	time->tm_year += 1900;
+	time->tm_mon += 1;
+	sprintf(output, "%04d%02d%02d%02d%02d%02d",
+		time->tm_year, time->tm_mon, time->tm_mday,
+		time->tm_hour, time->tm_min, time->tm_sec);
+	return (output);
+}
+
+u_int16_t
+res_nametoclass(const char *buf, int *successp) {
+	unsigned long result;
+	char *endptr;
+	int success;
+
+	result = sym_ston(__p_class_syms, buf, &success);
+	if (success)
+		goto done;
+
+	if (strncasecmp(buf, "CLASS", 5) != 0 ||
+	    !isdigit((unsigned char)buf[5]))
+		goto done;
+	errno = 0;
+	result = strtoul(buf + 5, &endptr, 10);
+	if (errno == 0 && *endptr == '\0' && result <= 0xffffU)
+		success = 1;
+ done:
+	if (successp)
+		*successp = success;
+	return (result);
+}
+
+u_int16_t
+res_nametotype(const char *buf, int *successp) {
+	unsigned long result;
+	char *endptr;
+	int success;
+
+	result = sym_ston(__p_type_syms, buf, &success);
+	if (success)
+		goto done;
+
+	if (strncasecmp(buf, "type", 4) != 0 ||
+	    !isdigit((unsigned char)buf[4]))
+		goto done;
+	errno = 0;
+	result = strtoul(buf + 4, &endptr, 10);
+	if (errno == 0 && *endptr == '\0' && result <= 0xffffU)
+		success = 1;
+ done:
+	if (successp)
+		*successp = success;
+	return (result);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_debug.h b/usr/src/lib/libresolv2_joy/common/resolv/res_debug.h
new file mode 100644
index 0000000000..c28171d7c8
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_debug.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _RES_DEBUG_H_
+#define _RES_DEBUG_H_
+
+#ifndef DEBUG
+#   define Dprint(cond, args) /*empty*/
+#   define DprintQ(cond, args, query, size) /*empty*/
+#   define Aerror(statp, file, string, error, address) /*empty*/
+#   define Perror(statp, file, string, error) /*empty*/
+#else
+#   define Dprint(cond, args) if (cond) {fprintf args;} else {}
+#   define DprintQ(cond, args, query, size) if (cond) {\
+			fprintf args;\
+			res_pquery(statp, query, size, stdout);\
+		} else {}
+#endif
+
+#endif /* _RES_DEBUG_H_ */ 
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_findzonecut.c b/usr/src/lib/libresolv2_joy/common/resolv/res_findzonecut.c
new file mode 100644
index 0000000000..431c0262c1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_findzonecut.c
@@ -0,0 +1,722 @@
+#if !defined(lint) && !defined(SABER)
+static const char rcsid[] = "$Id: res_findzonecut.c,v 1.10 2005/10/11 00:10:16 marka Exp $";
+#endif /* not lint */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Import. */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <limits.h>
+#include <netdb.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/list.h>
+
+#include "port_after.h"
+
+#include <resolv_joy.h>
+
+/* Data structures. */
+
+typedef struct rr_a {
+	LINK(struct rr_a)	link;
+	union res_sockaddr_union addr;
+} rr_a;
+typedef LIST(rr_a) rrset_a;
+
+typedef struct rr_ns {
+	LINK(struct rr_ns)	link;
+	const char *		name;
+	unsigned int		flags;
+	rrset_a			addrs;
+} rr_ns;
+typedef LIST(rr_ns) rrset_ns;
+
+#define	RR_NS_HAVE_V4		0x01
+#define	RR_NS_HAVE_V6		0x02
+
+/* Forward. */
+
+static int	satisfy(res_state, const char *, rrset_ns *,
+			union res_sockaddr_union *, int);
+static int	add_addrs(res_state, rr_ns *,
+			  union res_sockaddr_union *, int);
+static int	get_soa(res_state, const char *, ns_class, int,
+			char *, size_t, char *, size_t,
+			rrset_ns *);
+static int	get_ns(res_state, const char *, ns_class, int, rrset_ns *);
+static int	get_glue(res_state, ns_class, int, rrset_ns *);
+static int	save_ns(res_state, ns_msg *, ns_sect,
+			const char *, ns_class, int, rrset_ns *);
+static int	save_a(res_state, ns_msg *, ns_sect,
+		       const char *, ns_class, int, rr_ns *);
+static void	free_nsrrset(rrset_ns *);
+static void	free_nsrr(rrset_ns *, rr_ns *);
+static rr_ns *	find_ns(rrset_ns *, const char *);
+static int	do_query(res_state, const char *, ns_class, ns_type,
+			 u_char *, ns_msg *);
+static void	res_dprintf(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
+
+/* Macros. */
+
+#define DPRINTF(x) do {\
+		int save_errno = errno; \
+		if ((statp->options & RES_DEBUG) != 0U) res_dprintf x; \
+		errno = save_errno; \
+	} while (0)
+
+/* Public. */
+
+/*%
+ *	find enclosing zone for a <dname,class>, and some server addresses
+ *
+ * parameters:
+ *\li	res - resolver context to work within (is modified)
+ *\li	dname - domain name whose enclosing zone is desired
+ *\li	class - class of dname (and its enclosing zone)
+ *\li	zname - found zone name
+ *\li	zsize - allocated size of zname
+ *\li	addrs - found server addresses
+ *\li	naddrs - max number of addrs
+ *
+ * return values:
+ *\li	< 0 - an error occurred (check errno)
+ *\li	= 0 - zname is now valid, but addrs[] wasn't changed
+ *\li	> 0 - zname is now valid, and return value is number of addrs[] found
+ *
+ * notes:
+ *\li	this function calls res_nsend() which means it depends on correctly
+ *	functioning recursive nameservers (usually defined in /etc/resolv.conf
+ *	or its local equivilent).
+ *
+ *\li	we start by asking for an SOA<dname,class>.  if we get one as an
+ *	answer, that just means <dname,class> is a zone top, which is fine.
+ *	more than likely we'll be told to go pound sand, in the form of a
+ *	negative answer.
+ *
+ *\li	note that we are not prepared to deal with referrals since that would
+ *	only come from authority servers and our correctly functioning local
+ *	recursive server would have followed the referral and got us something
+ *	more definite.
+ *
+ *\li	if the authority section contains an SOA, this SOA should also be the
+ *	closest enclosing zone, since any intermediary zone cuts would've been
+ *	returned as referrals and dealt with by our correctly functioning local
+ *	recursive name server.  but an SOA in the authority section should NOT
+ *	match our dname (since that would have been returned in the answer
+ *	section).  an authority section SOA has to be "above" our dname.
+ *
+ *\li	however, since authority section SOA's were once optional, it's
+ *	possible that we'll have to go hunting for the enclosing SOA by
+ *	ripping labels off the front of our dname -- this is known as "doing
+ *	it the hard way."
+ *
+ *\li	ultimately we want some server addresses, which are ideally the ones
+ *	pertaining to the SOA.MNAME, but only if there is a matching NS RR.
+ *	so the second phase (after we find an SOA) is to go looking for the
+ *	NS RRset for that SOA's zone.
+ *
+ *\li	no answer section processed by this code is allowed to contain CNAME
+ *	or DNAME RR's.  for the SOA query this means we strip a label and
+ *	keep going.  for the NS and A queries this means we just give up.
+ */
+
+int
+res_findzonecut(res_state statp, const char *dname, ns_class class, int opts,
+		char *zname, size_t zsize, struct in_addr *addrs, int naddrs)
+{
+	int result, i;
+	union res_sockaddr_union *u;
+
+	
+	opts |= RES_IPV4ONLY;
+	opts &= ~RES_IPV6ONLY;
+
+	u = calloc(naddrs, sizeof(*u));
+	if (u == NULL)
+		return(-1);
+
+	result = res_findzonecut2(statp, dname, class, opts, zname, zsize,
+				  u, naddrs);
+
+	for (i = 0; i < result; i++) {
+		addrs[i] = u[i].sin.sin_addr;
+	}
+	free(u);
+	return (result);
+}
+
+int
+res_findzonecut2(res_state statp, const char *dname, ns_class class, int opts,
+		 char *zname, size_t zsize, union res_sockaddr_union *addrs,
+		 int naddrs)
+{
+	char mname[NS_MAXDNAME];
+	u_long save_pfcode;
+	rrset_ns nsrrs;
+	int n;
+
+	DPRINTF(("START dname='%s' class=%s, zsize=%ld, naddrs=%d",
+		 dname, p_class(class), (long)zsize, naddrs));
+	save_pfcode = statp->pfcode;
+	statp->pfcode |= RES_PRF_HEAD2 | RES_PRF_HEAD1 | RES_PRF_HEADX |
+			 RES_PRF_QUES | RES_PRF_ANS |
+			 RES_PRF_AUTH | RES_PRF_ADD;
+	INIT_LIST(nsrrs);
+
+	DPRINTF(("get the soa, and see if it has enough glue"));
+	if ((n = get_soa(statp, dname, class, opts, zname, zsize,
+			 mname, sizeof mname, &nsrrs)) < 0 ||
+	    ((opts & RES_EXHAUSTIVE) == 0 &&
+	     (n = satisfy(statp, mname, &nsrrs, addrs, naddrs)) > 0))
+		goto done;
+
+	DPRINTF(("get the ns rrset and see if it has enough glue"));
+	if ((n = get_ns(statp, zname, class, opts, &nsrrs)) < 0 ||
+	    ((opts & RES_EXHAUSTIVE) == 0 &&
+	     (n = satisfy(statp, mname, &nsrrs, addrs, naddrs)) > 0))
+		goto done;
+
+	DPRINTF(("get the missing glue and see if it's finally enough"));
+	if ((n = get_glue(statp, class, opts, &nsrrs)) >= 0)
+		n = satisfy(statp, mname, &nsrrs, addrs, naddrs);
+
+ done:
+	DPRINTF(("FINISH n=%d (%s)", n, (n < 0) ? strerror(errno) : "OK"));
+	free_nsrrset(&nsrrs);
+	statp->pfcode = save_pfcode;
+	return (n);
+}
+
+/* Private. */
+
+static int
+satisfy(res_state statp, const char *mname, rrset_ns *nsrrsp,
+	union res_sockaddr_union *addrs, int naddrs)
+{
+	rr_ns *nsrr;
+	int n, x;
+
+	n = 0;
+	nsrr = find_ns(nsrrsp, mname);
+	if (nsrr != NULL) {
+		x = add_addrs(statp, nsrr, addrs, naddrs);
+		addrs += x;
+		naddrs -= x;
+		n += x;
+	}
+	for (nsrr = HEAD(*nsrrsp);
+	     nsrr != NULL && naddrs > 0;
+	     nsrr = NEXT(nsrr, link))
+		if (ns_samename(nsrr->name, mname) != 1) {
+			x = add_addrs(statp, nsrr, addrs, naddrs);
+			addrs += x;
+			naddrs -= x;
+			n += x;
+		}
+	DPRINTF(("satisfy(%s): %d", mname, n));
+	return (n);
+}
+
+static int
+add_addrs(res_state statp, rr_ns *nsrr,
+	  union res_sockaddr_union *addrs, int naddrs)
+{
+	rr_a *arr;
+	int n = 0;
+
+	for (arr = HEAD(nsrr->addrs); arr != NULL; arr = NEXT(arr, link)) {
+		if (naddrs <= 0)
+			return (0);
+		*addrs++ = arr->addr;
+		naddrs--;
+		n++;
+	}
+	DPRINTF(("add_addrs: %d", n));
+	return (n);
+}
+
+static int
+get_soa(res_state statp, const char *dname, ns_class class, int opts,
+	char *zname, size_t zsize, char *mname, size_t msize,
+	rrset_ns *nsrrsp)
+{
+	char tname[NS_MAXDNAME];
+	u_char *resp = NULL;
+	int n, i, ancount, nscount;
+	ns_sect sect;
+	ns_msg msg;
+	u_int rcode;
+
+	/*
+	 * Find closest enclosing SOA, even if it's for the root zone.
+	 */
+
+	/* First canonicalize dname (exactly one unescaped trailing "."). */
+	if (ns_makecanon(dname, tname, sizeof tname) < 0)
+		goto cleanup;
+	dname = tname;
+
+	resp = malloc(NS_MAXMSG);
+	if (resp == NULL)
+		goto cleanup;
+
+	/* Now grovel the subdomains, hunting for an SOA answer or auth. */
+	for (;;) {
+		/* Leading or inter-label '.' are skipped here. */
+		while (*dname == '.')
+			dname++;
+
+		/* Is there an SOA? */
+		n = do_query(statp, dname, class, ns_t_soa, resp, &msg);
+		if (n < 0) {
+			DPRINTF(("get_soa: do_query('%s', %s) failed (%d)",
+				 dname, p_class(class), n));
+			goto cleanup;
+		}
+		if (n > 0) {
+			DPRINTF(("get_soa: CNAME or DNAME found"));
+			sect = ns_s_max, n = 0;
+		} else {
+			rcode = ns_msg_getflag(msg, ns_f_rcode);
+			ancount = ns_msg_count(msg, ns_s_an);
+			nscount = ns_msg_count(msg, ns_s_ns);
+			if (ancount > 0 && rcode == ns_r_noerror)
+				sect = ns_s_an, n = ancount;
+			else if (nscount > 0)
+				sect = ns_s_ns, n = nscount;
+			else
+				sect = ns_s_max, n = 0;
+		}
+		for (i = 0; i < n; i++) {
+			const char *t;
+			const u_char *rdata;
+			ns_rr rr;
+
+			if (ns_parserr(&msg, sect, i, &rr) < 0) {
+				DPRINTF(("get_soa: ns_parserr(%s, %d) failed",
+					 p_section(sect, ns_o_query), i));
+				goto cleanup;
+			}
+			if (ns_rr_type(rr) == ns_t_cname ||
+			    ns_rr_type(rr) == ns_t_dname)
+				break;
+			if (ns_rr_type(rr) != ns_t_soa ||
+			    ns_rr_class(rr) != class)
+				continue;
+			t = ns_rr_name(rr);
+			switch (sect) {
+			case ns_s_an:
+				if (ns_samedomain(dname, t) == 0) {
+					DPRINTF(
+				    ("get_soa: ns_samedomain('%s', '%s') == 0",
+						dname, t)
+						);
+					errno = EPROTOTYPE;
+					goto cleanup;
+				}
+				break;
+			case ns_s_ns:
+				if (ns_samename(dname, t) == 1 ||
+				    ns_samedomain(dname, t) == 0) {
+					DPRINTF(
+		       ("get_soa: ns_samename() || !ns_samedomain('%s', '%s')",
+						dname, t)
+						);
+					errno = EPROTOTYPE;
+					goto cleanup;
+				}
+				break;
+			default:
+				abort();
+			}
+			if (strlen(t) + 1 > zsize) {
+				DPRINTF(("get_soa: zname(%lu) too small (%lu)",
+					 (unsigned long)zsize,
+					 (unsigned long)strlen(t) + 1));
+				errno = EMSGSIZE;
+				goto cleanup;
+			}
+			strcpy(zname, t);
+			rdata = ns_rr_rdata(rr);
+			if (ns_name_uncompress(resp, ns_msg_end(msg), rdata,
+					       mname, msize) < 0) {
+				DPRINTF(("get_soa: ns_name_uncompress failed")
+					);
+				goto cleanup;
+			}
+			if (save_ns(statp, &msg, ns_s_ns,
+				    zname, class, opts, nsrrsp) < 0) {
+				DPRINTF(("get_soa: save_ns failed"));
+				goto cleanup;
+			}
+			free(resp);
+			return (0);
+		}
+
+		/* If we're out of labels, then not even "." has an SOA! */
+		if (*dname == '\0')
+			break;
+
+		/* Find label-terminating "."; top of loop will skip it. */
+		while (*dname != '.') {
+			if (*dname == '\\')
+				if (*++dname == '\0') {
+					errno = EMSGSIZE;
+					goto cleanup;
+				}
+			dname++;
+		}
+	}
+	DPRINTF(("get_soa: out of labels"));
+	errno = EDESTADDRREQ;
+ cleanup:
+	if (resp != NULL)
+		free(resp);
+	return (-1);
+}
+
+static int
+get_ns(res_state statp, const char *zname, ns_class class, int opts,
+      rrset_ns *nsrrsp)
+{
+	u_char *resp;
+	ns_msg msg;
+	int n;
+
+	resp = malloc(NS_MAXMSG);
+	if (resp == NULL)
+		return (-1);
+
+	/* Go and get the NS RRs for this zone. */
+	n = do_query(statp, zname, class, ns_t_ns, resp, &msg);
+	if (n != 0) {
+		DPRINTF(("get_ns: do_query('%s', %s) failed (%d)",
+			 zname, p_class(class), n));
+		free(resp);
+		return (-1);
+	}
+
+	/* Remember the NS RRs and associated A RRs that came back. */
+	if (save_ns(statp, &msg, ns_s_an, zname, class, opts, nsrrsp) < 0) {
+		DPRINTF(("get_ns save_ns('%s', %s) failed",
+			 zname, p_class(class)));
+		free(resp);
+		return (-1);
+	}
+
+	free(resp);
+	return (0);
+}
+
+static int
+get_glue(res_state statp, ns_class class, int opts, rrset_ns *nsrrsp) {
+	rr_ns *nsrr, *nsrr_n;
+	u_char *resp;
+
+	resp = malloc(NS_MAXMSG);
+	if (resp == NULL)
+		return(-1);
+
+	/* Go and get the A RRs for each empty NS RR on our list. */
+	for (nsrr = HEAD(*nsrrsp); nsrr != NULL; nsrr = nsrr_n) {
+		ns_msg msg;
+		int n;
+
+		nsrr_n = NEXT(nsrr, link);
+
+		if ((nsrr->flags & RR_NS_HAVE_V4) == 0) {
+			n = do_query(statp, nsrr->name, class, ns_t_a,
+				     resp, &msg);
+			if (n < 0) {
+				DPRINTF(
+				       ("get_glue: do_query('%s', %s') failed",
+					nsrr->name, p_class(class)));
+				goto cleanup;
+			}
+			if (n > 0) {
+				DPRINTF((
+			"get_glue: do_query('%s', %s') CNAME or DNAME found",
+					 nsrr->name, p_class(class)));
+			}
+			if (save_a(statp, &msg, ns_s_an, nsrr->name, class,
+				   opts, nsrr) < 0) {
+				DPRINTF(("get_glue: save_r('%s', %s) failed",
+					 nsrr->name, p_class(class)));
+				goto cleanup;
+			}
+		}
+
+		if ((nsrr->flags & RR_NS_HAVE_V6) == 0) {
+			n = do_query(statp, nsrr->name, class, ns_t_aaaa,
+				     resp, &msg);
+			if (n < 0) {
+				DPRINTF(
+				       ("get_glue: do_query('%s', %s') failed",
+					nsrr->name, p_class(class)));
+				goto cleanup;
+			}
+			if (n > 0) {
+				DPRINTF((
+			"get_glue: do_query('%s', %s') CNAME or DNAME found",
+					 nsrr->name, p_class(class)));
+			}
+			if (save_a(statp, &msg, ns_s_an, nsrr->name, class,
+				   opts, nsrr) < 0) {
+				DPRINTF(("get_glue: save_r('%s', %s) failed",
+					 nsrr->name, p_class(class)));
+				goto cleanup;
+			}
+		}
+
+		/* If it's still empty, it's just chaff. */
+		if (EMPTY(nsrr->addrs)) {
+			DPRINTF(("get_glue: removing empty '%s' NS",
+				 nsrr->name));
+			free_nsrr(nsrrsp, nsrr);
+		}
+	}
+	free(resp);
+	return (0);
+
+ cleanup:
+	free(resp);
+	return (-1);
+}
+
+static int
+save_ns(res_state statp, ns_msg *msg, ns_sect sect,
+	const char *owner, ns_class class, int opts,
+	rrset_ns *nsrrsp)
+{
+	int i;
+
+	for (i = 0; i < ns_msg_count(*msg, sect); i++) {
+		char tname[MAXDNAME];
+		const u_char *rdata;
+		rr_ns *nsrr;
+		ns_rr rr;
+
+		if (ns_parserr(msg, sect, i, &rr) < 0) {
+			DPRINTF(("save_ns: ns_parserr(%s, %d) failed",
+				 p_section(sect, ns_o_query), i));
+			return (-1);
+		}
+		if (ns_rr_type(rr) != ns_t_ns ||
+		    ns_rr_class(rr) != class ||
+		    ns_samename(ns_rr_name(rr), owner) != 1)
+			continue;
+		nsrr = find_ns(nsrrsp, ns_rr_name(rr));
+		if (nsrr == NULL) {
+			nsrr = malloc(sizeof *nsrr);
+			if (nsrr == NULL) {
+				DPRINTF(("save_ns: malloc failed"));
+				return (-1);
+			}
+			rdata = ns_rr_rdata(rr);
+			if (ns_name_uncompress(ns_msg_base(*msg),
+					       ns_msg_end(*msg), rdata,
+					       tname, sizeof tname) < 0) {
+				DPRINTF(("save_ns: ns_name_uncompress failed")
+					);
+				free(nsrr);
+				return (-1);
+			}
+			nsrr->name = strdup(tname);
+			if (nsrr->name == NULL) {
+				DPRINTF(("save_ns: strdup failed"));
+				free(nsrr);
+				return (-1);
+			}
+			INIT_LINK(nsrr, link);
+			INIT_LIST(nsrr->addrs);
+			nsrr->flags = 0;
+			APPEND(*nsrrsp, nsrr, link);
+		}
+		if (save_a(statp, msg, ns_s_ar,
+			   nsrr->name, class, opts, nsrr) < 0) {
+			DPRINTF(("save_ns: save_r('%s', %s) failed",
+				 nsrr->name, p_class(class)));
+			return (-1);
+		}
+	}
+	return (0);
+}
+
+static int
+save_a(res_state statp, ns_msg *msg, ns_sect sect,
+       const char *owner, ns_class class, int opts,
+       rr_ns *nsrr)
+{
+	int i;
+
+	for (i = 0; i < ns_msg_count(*msg, sect); i++) {
+		ns_rr rr;
+		rr_a *arr;
+
+		if (ns_parserr(msg, sect, i, &rr) < 0) {
+			DPRINTF(("save_a: ns_parserr(%s, %d) failed",
+				 p_section(sect, ns_o_query), i));
+			return (-1);
+		}
+		if ((ns_rr_type(rr) != ns_t_a &&
+		     ns_rr_type(rr) != ns_t_aaaa) ||
+		    ns_rr_class(rr) != class ||
+		    ns_samename(ns_rr_name(rr), owner) != 1 ||
+		    ns_rr_rdlen(rr) != NS_INADDRSZ)
+			continue;
+		if ((opts & RES_IPV6ONLY) != 0 && ns_rr_type(rr) != ns_t_aaaa)
+			continue;
+		if ((opts & RES_IPV4ONLY) != 0 && ns_rr_type(rr) != ns_t_a)
+			continue;
+		arr = malloc(sizeof *arr);
+		if (arr == NULL) {
+			DPRINTF(("save_a: malloc failed"));
+			return (-1);
+		}
+		INIT_LINK(arr, link);
+		memset(&arr->addr, 0, sizeof(arr->addr));
+		switch (ns_rr_type(rr)) {
+		case ns_t_a:
+			arr->addr.sin.sin_family = AF_INET;
+#ifdef HAVE_SA_LEN
+			arr->addr.sin.sin_len = sizeof(arr->addr.sin);
+#endif
+			memcpy(&arr->addr.sin.sin_addr, ns_rr_rdata(rr),
+			       NS_INADDRSZ);
+			arr->addr.sin.sin_port = htons(NAMESERVER_PORT);
+			nsrr->flags |= RR_NS_HAVE_V4;
+			break;
+		case ns_t_aaaa:
+			arr->addr.sin6.sin6_family = AF_INET6;
+#ifdef HAVE_SA_LEN
+			arr->addr.sin6.sin6_len = sizeof(arr->addr.sin6);
+#endif
+			memcpy(&arr->addr.sin6.sin6_addr, ns_rr_rdata(rr), 16);
+			arr->addr.sin.sin_port = htons(NAMESERVER_PORT);
+			nsrr->flags |= RR_NS_HAVE_V6;
+			break;
+		default:
+			abort();
+		}
+		APPEND(nsrr->addrs, arr, link);
+	}
+	return (0);
+}
+
+static void
+free_nsrrset(rrset_ns *nsrrsp) {
+	rr_ns *nsrr;
+
+	while ((nsrr = HEAD(*nsrrsp)) != NULL)
+		free_nsrr(nsrrsp, nsrr);
+}
+
+static void
+free_nsrr(rrset_ns *nsrrsp, rr_ns *nsrr) {
+	rr_a *arr;
+	char *tmp;
+
+	while ((arr = HEAD(nsrr->addrs)) != NULL) {
+		UNLINK(nsrr->addrs, arr, link);
+		free(arr);
+	}
+	DE_CONST(nsrr->name, tmp);
+	free(tmp);
+	UNLINK(*nsrrsp, nsrr, link);
+	free(nsrr);
+}
+
+static rr_ns *
+find_ns(rrset_ns *nsrrsp, const char *dname) {
+	rr_ns *nsrr;
+
+	for (nsrr = HEAD(*nsrrsp); nsrr != NULL; nsrr = NEXT(nsrr, link))
+		if (ns_samename(nsrr->name, dname) == 1)
+			return (nsrr);
+	return (NULL);
+}
+
+static int
+do_query(res_state statp, const char *dname, ns_class class, ns_type qtype,
+	 u_char *resp, ns_msg *msg)
+{
+	u_char req[NS_PACKETSZ];
+	int i, n;
+
+	n = res_nmkquery(statp, ns_o_query, dname, class, qtype,
+			 NULL, 0, NULL, req, NS_PACKETSZ);
+	if (n < 0) {
+		DPRINTF(("do_query: res_nmkquery failed"));
+		return (-1);
+	}
+	n = res_nsend(statp, req, n, resp, NS_MAXMSG);
+	if (n < 0) {
+		DPRINTF(("do_query: res_nsend failed"));
+		return (-1);
+	}
+	if (n == 0) {
+		DPRINTF(("do_query: res_nsend returned 0"));
+		errno = EMSGSIZE;
+		return (-1);
+	}
+	if (ns_initparse(resp, n, msg) < 0) {
+		DPRINTF(("do_query: ns_initparse failed"));
+		return (-1);
+	}
+	n = 0;
+	for (i = 0; i < ns_msg_count(*msg, ns_s_an); i++) {
+		ns_rr rr;
+
+		if (ns_parserr(msg, ns_s_an, i, &rr) < 0) {
+			DPRINTF(("do_query: ns_parserr failed"));
+			return (-1);
+		}
+		n += (ns_rr_class(rr) == class &&
+		      (ns_rr_type(rr) == ns_t_cname ||
+		       ns_rr_type(rr) == ns_t_dname));
+	}
+	return (n);
+}
+
+static void
+res_dprintf(const char *fmt, ...) {
+	va_list ap;
+
+	va_start(ap, fmt);
+	fputs(";; res_findzonecut: ", stderr);
+	vfprintf(stderr, fmt, ap);
+	fputc('\n', stderr);
+	va_end(ap);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_init.c b/usr/src/lib/libresolv2_joy/common/resolv/res_init.c
new file mode 100644
index 0000000000..10254d1931
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_init.c
@@ -0,0 +1,958 @@
+/*
+ * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ */
+
+
+/*
+ * Copyright (c) 1985, 1989, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)res_init.c	8.1 (Berkeley) 6/7/93";
+static const char rcsid[] = "$Id: res_init.c,v 1.26 2008/12/11 09:59:00 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <netdb.h>
+
+#ifndef HAVE_MD5
+# include "../dst/md5.h"
+#else
+# ifdef SOLARIS2
+#  include <sys/md5.h>
+# endif
+#endif
+#ifndef _MD5_H_
+# define _MD5_H_ 1	/*%< make sure we do not include rsaref md5.h file */
+#endif
+
+
+#include "port_after.h"
+
+/* ensure that sockaddr_in6 and IN6ADDR_ANY_INIT are declared / defined */
+#include <resolv_joy.h>
+
+/* ISC purposely put port_after.h before <resolv.h> to force in6 stuff
+ * (above) so we explicitly include port_resolv.h here */
+#include "port_resolv.h"
+
+#include "res_private.h"
+
+/*% Options.  Should all be left alone. */
+#define RESOLVSORT
+#define DEBUG
+
+#ifdef  SUNW_INITCHKIF
+#include <net/if.h>
+#include <netinet/if_ether.h>
+#include <sys/sockio.h>
+#define MAXIFS  8192
+#endif  /* SUNW_INITCHKIF */
+
+#ifdef SOLARIS2
+#include <sys/systeminfo.h>
+#endif
+
+static void res_setoptions __P((res_state, const char *, const char *));
+
+#ifdef RESOLVSORT
+static const char sort_mask[] = "/&";
+#define ISSORTMASK(ch) (strchr(sort_mask, ch) != NULL)
+static u_int32_t net_mask __P((struct in_addr));
+#endif
+
+#if !defined(isascii)	/*%< XXX - could be a function */
+# define isascii(c) (!(c & 0200))
+#endif
+
+/*
+ * Resolver state default settings.
+ */
+
+/*%
+ * Set up default settings.  If the configuration file exist, the values
+ * there will have precedence.  Otherwise, the server address is set to
+ * INADDR_ANY and the default domain name comes from the gethostname().
+ *
+ * An interrim version of this code (BIND 4.9, pre-4.4BSD) used 127.0.0.1
+ * rather than INADDR_ANY ("0.0.0.0") as the default name server address
+ * since it was noted that INADDR_ANY actually meant ``the first interface
+ * you "ifconfig"'d at boot time'' and if this was a SLIP or PPP interface,
+ * it had to be "up" in order for you to reach your own name server.  It
+ * was later decided that since the recommended practice is to always 
+ * install local static routes through 127.0.0.1 for all your network
+ * interfaces, that we could solve this problem without a code change.
+ *
+ * The configuration file should always be used, since it is the only way
+ * to specify a default domain.  If you are running a server on your local
+ * machine, you should say "nameserver 0.0.0.0" or "nameserver 127.0.0.1"
+ * in the configuration file.
+ *
+ * Return 0 if completes successfully, -1 on error
+ */
+int
+res_ninit(res_state statp) {
+	extern int __res_vinit(res_state, int);
+	return (__res_vinit(statp, 0));
+}
+
+/*% This function has to be reachable by res_data.c but not publically. */
+int
+__res_vinit(res_state statp, int preinit) {
+	register FILE *fp;
+	register char *cp, **pp;
+	register int n;
+	char buf[BUFSIZ];
+	int nserv = 0;    /*%< number of nameserver records read from file */
+	int haveenv = 0;
+	int havesearch = 0;
+#ifdef RESOLVSORT
+	int nsort = 0;
+	char *net;
+#endif
+	int dots;
+	union res_sockaddr_union u[2];
+	int maxns = MAXNS;
+
+	RES_SET_H_ERRNO(statp, 0);
+	if (statp->_u._ext.ext != NULL)
+		res_ndestroy(statp);
+
+	if (!preinit) {
+		statp->retrans = RES_TIMEOUT;
+		statp->retry = RES_DFLRETRY;
+		statp->options = RES_DEFAULT;
+		res_rndinit(statp);
+		statp->id = res_nrandomid(statp);
+	}
+
+	memset(u, 0, sizeof(u));
+#ifdef USELOOPBACK
+	u[nserv].sin.sin_addr = inet_makeaddr(IN_LOOPBACKNET, 1);
+#else
+	u[nserv].sin.sin_addr.s_addr = INADDR_ANY;
+#endif
+	u[nserv].sin.sin_family = AF_INET;
+	u[nserv].sin.sin_port = htons(NAMESERVER_PORT);
+#ifdef HAVE_SA_LEN
+	u[nserv].sin.sin_len = sizeof(struct sockaddr_in);
+#endif
+	nserv++;
+#ifdef HAS_INET6_STRUCTS
+#ifdef USELOOPBACK
+	u[nserv].sin6.sin6_addr = in6addr_loopback;
+#else
+	u[nserv].sin6.sin6_addr = in6addr_any;
+#endif
+	u[nserv].sin6.sin6_family = AF_INET6;
+	u[nserv].sin6.sin6_port = htons(NAMESERVER_PORT);
+#ifdef HAVE_SA_LEN
+	u[nserv].sin6.sin6_len = sizeof(struct sockaddr_in6);
+#endif
+	nserv++;
+#endif
+	statp->nscount = 0;
+	statp->ndots = 1;
+	statp->pfcode = 0;
+	statp->_vcsock = -1;
+	statp->_flags = 0;
+	statp->qhook = NULL;
+	statp->rhook = NULL;
+	statp->_u._ext.nscount = 0;
+	statp->_u._ext.ext = malloc(sizeof(*statp->_u._ext.ext));
+	if (statp->_u._ext.ext != NULL) {
+	        memset(statp->_u._ext.ext, 0, sizeof(*statp->_u._ext.ext));
+		statp->_u._ext.ext->nsaddrs[0].sin = statp->nsaddr;
+		strcpy(statp->_u._ext.ext->nsuffix, "ip6.arpa");
+		strcpy(statp->_u._ext.ext->nsuffix2, "ip6.int");
+	} else {
+		/*
+		 * Historically res_init() rarely, if at all, failed.
+		 * Examples and applications exist which do not check
+		 * our return code.  Furthermore several applications
+		 * simply call us to get the systems domainname.  So
+		 * rather then immediately fail here we store the
+		 * failure, which is returned later, in h_errno.  And
+		 * prevent the collection of 'nameserver' information
+		 * by setting maxns to 0.  Thus applications that fail
+		 * to check our return code wont be able to make
+		 * queries anyhow.
+		 */
+		RES_SET_H_ERRNO(statp, NETDB_INTERNAL);
+		maxns = 0;
+	}
+#ifdef RESOLVSORT
+	statp->nsort = 0;
+#endif
+	res_setservers(statp, u, nserv);
+
+#ifdef  SUNW_INITCHKIF
+/*
+ * Short circuit res_init() if no non-loopback interfaces are up. This is
+ * done to avoid boot delays if "dns" comes before "files" in nsswitch.conf.
+ * An additional fix has been added to this code, to count all external
+ * interfaces, which includes the IPv6 interfaces. If no external interfaces
+ * are found, an additional check is carried out to determine if any deprecated
+ * interfaces are up.
+ */
+	{
+		int s;
+		struct lifnum lifn;
+
+		if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
+			perror("res_init: socket");
+			goto freedata;
+		}
+		lifn.lifn_family = AF_UNSPEC;
+		lifn.lifn_flags = LIFC_EXTERNAL_SOURCE;
+		if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
+			close(s);
+			goto freedata;
+		}
+		if (lifn.lifn_count == 0) {
+			/*
+			 * Check if there are any deprecated interfaces up
+			 */
+			struct lifconf lifc;
+			uchar_t *buf;
+			int buflen, i, int_up = 0;
+
+			lifn.lifn_flags = 0;
+			if ((ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) ||
+					(lifn.lifn_count < 1)) {
+				close(s);
+				goto freedata;
+			}
+
+			buflen = lifn.lifn_count * sizeof (struct lifreq);
+			buf = (uchar_t *)malloc(buflen);
+			if (buf == NULL) {
+				close(s);
+				goto freedata;
+			}
+
+			lifc.lifc_family = AF_UNSPEC;
+			lifc.lifc_flags = 0;
+			lifc.lifc_len = buflen;
+			lifc.lifc_lifcu.lifcu_buf = (caddr_t)buf;
+			if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
+				close(s);
+				free(buf);
+				goto freedata;
+			}
+
+			for (i = 0; i < lifn.lifn_count; ++i) {
+				struct lifreq *lreqp, lreq;
+
+				lreqp = (struct lifreq *)&lifc.lifc_req[i];
+				strlcpy(lreq.lifr_name, lreqp->lifr_name,
+						sizeof (lreq.lifr_name));
+				if (ioctl(s, SIOCGLIFFLAGS, &lreq) < 0) {
+					close(s);
+					free(buf);
+					goto freedata;
+				}
+				if ((lreq.lifr_flags & IFF_UP) &&
+					!(lreq.lifr_flags & IFF_NOLOCAL) &&
+					!(lreq.lifr_flags & IFF_NOXMIT) &&
+					!(lreq.lifr_flags & IFF_LOOPBACK)) {
+					int_up = 1;
+					break;
+				}
+			}
+			free(buf);
+
+			if (!int_up) {
+				close(s);
+				goto freedata;
+			}
+		}
+		close(s);
+	}
+#endif  /* SUNW_INITCHKIF */
+
+#ifdef	SOLARIS2
+	/*
+	 * The old libresolv derived the defaultdomain from NIS/NIS+.
+	 * We want to keep this behaviour
+	 */
+	{
+		char buf[sizeof(statp->defdname)], *cp;
+		int ret;
+
+		if ((ret = sysinfo(SI_SRPC_DOMAIN, buf, sizeof(buf))) > 0 &&
+			(unsigned int)ret <= sizeof(buf)) {
+			if (buf[0] == '+')
+				buf[0] = '.';
+			cp = strchr(buf, '.');
+			cp = (cp == NULL) ? buf : (cp + 1);
+			strncpy(statp->defdname, cp,
+				sizeof(statp->defdname) - 1);
+			statp->defdname[sizeof(statp->defdname) - 1] = '\0';
+		}
+	}
+#endif	/* SOLARIS2 */
+
+	/* Allow user to override the local domain definition */
+	if ((cp = getenv("LOCALDOMAIN")) != NULL) {
+		(void)strncpy(statp->defdname, cp, sizeof(statp->defdname) - 1);
+		statp->defdname[sizeof(statp->defdname) - 1] = '\0';
+		haveenv++;
+
+		/*
+		 * Set search list to be blank-separated strings
+		 * from rest of env value.  Permits users of LOCALDOMAIN
+		 * to still have a search list, and anyone to set the
+		 * one that they want to use as an individual (even more
+		 * important now that the rfc1535 stuff restricts searches)
+		 */
+		cp = statp->defdname;
+		pp = statp->dnsrch;
+		*pp++ = cp;
+		for (n = 0; *cp && pp < statp->dnsrch + MAXDNSRCH; cp++) {
+			if (*cp == '\n')	/*%< silly backwards compat */
+				break;
+			else if (*cp == ' ' || *cp == '\t') {
+				*cp = 0;
+				n = 1;
+			} else if (n) {
+				*pp++ = cp;
+				n = 0;
+				havesearch = 1;
+			}
+		}
+		/* null terminate last domain if there are excess */
+		while (*cp != '\0' && *cp != ' ' && *cp != '\t' && *cp != '\n')
+			cp++;
+		*cp = '\0';
+		*pp++ = 0;
+	}
+
+#define	MATCH(line, name) \
+	(!strncmp(line, name, sizeof(name) - 1) && \
+	(line[sizeof(name) - 1] == ' ' || \
+	 line[sizeof(name) - 1] == '\t'))
+
+	nserv = 0;
+	if ((fp = fopen(_PATH_RESCONF, "r")) != NULL) {
+	    /* read the config file */
+	    while (fgets(buf, sizeof(buf), fp) != NULL) {
+		/* skip comments */
+		if (*buf == ';' || *buf == '#')
+			continue;
+		/* read default domain name */
+		if (MATCH(buf, "domain")) {
+		    if (haveenv)	/*%< skip if have from environ */
+			    continue;
+		    cp = buf + sizeof("domain") - 1;
+		    while (*cp == ' ' || *cp == '\t')
+			    cp++;
+		    if ((*cp == '\0') || (*cp == '\n'))
+			    continue;
+		    strncpy(statp->defdname, cp, sizeof(statp->defdname) - 1);
+		    statp->defdname[sizeof(statp->defdname) - 1] = '\0';
+		    if ((cp = strpbrk(statp->defdname, " \t\n")) != NULL)
+			    *cp = '\0';
+		    havesearch = 0;
+		    continue;
+		}
+		/* set search list */
+		if (MATCH(buf, "search")) {
+		    if (haveenv)	/*%< skip if have from environ */
+			    continue;
+		    cp = buf + sizeof("search") - 1;
+		    while (*cp == ' ' || *cp == '\t')
+			    cp++;
+		    if ((*cp == '\0') || (*cp == '\n'))
+			    continue;
+		    strncpy(statp->defdname, cp, sizeof(statp->defdname) - 1);
+		    statp->defdname[sizeof(statp->defdname) - 1] = '\0';
+		    if ((cp = strchr(statp->defdname, '\n')) != NULL)
+			    *cp = '\0';
+		    /*
+		     * Set search list to be blank-separated strings
+		     * on rest of line.
+		     */
+		    cp = statp->defdname;
+		    pp = statp->dnsrch;
+		    *pp++ = cp;
+		    for (n = 0; *cp && pp < statp->dnsrch + MAXDNSRCH; cp++) {
+			    if (*cp == ' ' || *cp == '\t') {
+				    *cp = 0;
+				    n = 1;
+			    } else if (n) {
+				    *pp++ = cp;
+				    n = 0;
+			    }
+		    }
+		    /* null terminate last domain if there are excess */
+		    while (*cp != '\0' && *cp != ' ' && *cp != '\t')
+			    cp++;
+		    *cp = '\0';
+		    *pp++ = 0;
+		    havesearch = 1;
+		    continue;
+		}
+		/* read nameservers to query */
+		if (MATCH(buf, "nameserver") && nserv < maxns) {
+		    struct addrinfo hints, *ai;
+		    char sbuf[NI_MAXSERV];
+		    const size_t minsiz =
+		        sizeof(statp->_u._ext.ext->nsaddrs[0]);
+
+		    cp = buf + sizeof("nameserver") - 1;
+		    while (*cp == ' ' || *cp == '\t')
+			cp++;
+		    cp[strcspn(cp, ";# \t\n")] = '\0';
+		    if ((*cp != '\0') && (*cp != '\n')) {
+			memset(&hints, 0, sizeof(hints));
+			hints.ai_family = PF_UNSPEC;
+			hints.ai_socktype = SOCK_DGRAM;	/*dummy*/
+			hints.ai_flags = AI_NUMERICHOST;
+			sprintf(sbuf, "%u", NAMESERVER_PORT);
+			if (getaddrinfo(cp, sbuf, &hints, &ai) == 0 &&
+			    ai->ai_addrlen <= minsiz) {
+			    if (statp->_u._ext.ext != NULL) {
+				memcpy(&statp->_u._ext.ext->nsaddrs[nserv],
+				    ai->ai_addr, ai->ai_addrlen);
+			    }
+			    if (ai->ai_addrlen <=
+			        sizeof(statp->nsaddr_list[nserv])) {
+				memcpy(&statp->nsaddr_list[nserv],
+				    ai->ai_addr, ai->ai_addrlen);
+			    } else
+				statp->nsaddr_list[nserv].sin_family = 0;
+			    freeaddrinfo(ai);
+			    nserv++;
+			}
+		    }
+		    continue;
+		}
+#ifdef RESOLVSORT
+		if (MATCH(buf, "sortlist")) {
+		    struct in_addr a;
+
+		    cp = buf + sizeof("sortlist") - 1;
+		    while (nsort < MAXRESOLVSORT) {
+			while (*cp == ' ' || *cp == '\t')
+			    cp++;
+			if (*cp == '\0' || *cp == '\n' || *cp == ';')
+			    break;
+			net = cp;
+			while (*cp && !ISSORTMASK(*cp) && *cp != ';' &&
+			       isascii(*cp) && !isspace((unsigned char)*cp))
+				cp++;
+			n = *cp;
+			*cp = 0;
+			if (inet_aton(net, &a)) {
+			    statp->sort_list[nsort].addr = a;
+			    if (ISSORTMASK(n)) {
+				*cp++ = n;
+				net = cp;
+				while (*cp && *cp != ';' &&
+					isascii(*cp) &&
+					!isspace((unsigned char)*cp))
+				    cp++;
+				n = *cp;
+				*cp = 0;
+				if (inet_aton(net, &a)) {
+				    statp->sort_list[nsort].mask = a.s_addr;
+				} else {
+				    statp->sort_list[nsort].mask = 
+					net_mask(statp->sort_list[nsort].addr);
+				}
+			    } else {
+				statp->sort_list[nsort].mask = 
+				    net_mask(statp->sort_list[nsort].addr);
+			    }
+			    nsort++;
+			}
+			*cp = n;
+		    }
+		    continue;
+		}
+#endif
+		if (MATCH(buf, "options")) {
+		    res_setoptions(statp, buf + sizeof("options") - 1, "conf");
+		    continue;
+		}
+	    }
+	    if (nserv > 0) 
+		statp->nscount = nserv;
+#ifdef RESOLVSORT
+	    statp->nsort = nsort;
+#endif
+	    (void) fclose(fp);
+	}
+/*
+ * Last chance to get a nameserver.  This should not normally
+ * be necessary
+ */
+#ifdef NO_RESOLV_CONF
+	if(nserv == 0)
+		nserv = get_nameservers(statp);
+#endif
+
+	if (statp->defdname[0] == 0 &&
+	    gethostname(buf, sizeof(statp->defdname) - 1) == 0 &&
+	    (cp = strchr(buf, '.')) != NULL)
+		strcpy(statp->defdname, cp + 1);
+
+	/* find components of local domain that might be searched */
+	if (havesearch == 0) {
+		pp = statp->dnsrch;
+		*pp++ = statp->defdname;
+		*pp = NULL;
+
+		dots = 0;
+		for (cp = statp->defdname; *cp; cp++)
+			dots += (*cp == '.');
+
+		cp = statp->defdname;
+		while (pp < statp->dnsrch + MAXDFLSRCH) {
+			if (dots < LOCALDOMAINPARTS)
+				break;
+			cp = strchr(cp, '.') + 1;    /*%< we know there is one */
+			*pp++ = cp;
+			dots--;
+		}
+		*pp = NULL;
+#ifdef DEBUG
+		if (statp->options & RES_DEBUG) {
+			printf(";; res_init()... default dnsrch list:\n");
+			for (pp = statp->dnsrch; *pp; pp++)
+				printf(";;\t%s\n", *pp);
+			printf(";;\t..END..\n");
+		}
+#endif
+	}
+
+	if ((cp = getenv("RES_OPTIONS")) != NULL)
+		res_setoptions(statp, cp, "env");
+	statp->options |= RES_INIT;
+	return (statp->res_h_errno);
+#ifdef  SUNW_INITCHKIF
+freedata:
+	RES_SET_H_ERRNO(statp, NETDB_INTERNAL);
+	if (statp->_u._ext.ext != NULL) {
+		free(statp->_u._ext.ext);
+		statp->_u._ext.ext = NULL;
+	}
+	return (-1);
+#endif  /* SUNW_INITCHKIF */
+
+}
+
+static void
+res_setoptions(res_state statp, const char *options, const char *source)
+{
+	const char *cp = options;
+	int i;
+	struct __res_state_ext *ext = statp->_u._ext.ext;
+
+#ifdef DEBUG
+	if (statp->options & RES_DEBUG)
+		printf(";; res_setoptions(\"%s\", \"%s\")...\n",
+		       options, source);
+#endif
+	while (*cp) {
+		/* skip leading and inner runs of spaces */
+		while (*cp == ' ' || *cp == '\t')
+			cp++;
+		/* search for and process individual options */
+		if (!strncmp(cp, "ndots:", sizeof("ndots:") - 1)) {
+			i = atoi(cp + sizeof("ndots:") - 1);
+			if (i <= RES_MAXNDOTS)
+				statp->ndots = i;
+			else
+				statp->ndots = RES_MAXNDOTS;
+#ifdef DEBUG
+			if (statp->options & RES_DEBUG)
+				printf(";;\tndots=%d\n", statp->ndots);
+#endif
+		} else if (!strncmp(cp, "timeout:", sizeof("timeout:") - 1)) {
+			i = atoi(cp + sizeof("timeout:") - 1);
+			if (i <= RES_MAXRETRANS)
+				statp->retrans = i;
+			else
+				statp->retrans = RES_MAXRETRANS;
+#ifdef DEBUG
+			if (statp->options & RES_DEBUG)
+				printf(";;\ttimeout=%d\n", statp->retrans);
+#endif
+#ifdef	SOLARIS2
+		} else if (!strncmp(cp, "retrans:", sizeof("retrans:") - 1)) {
+			/*
+		 	 * For backward compatibility, 'retrans' is
+		 	 * supported as an alias for 'timeout', though
+		 	 * without an imposed maximum.
+		 	 */
+			statp->retrans = atoi(cp + sizeof("retrans:") - 1);
+		} else if (!strncmp(cp, "retry:", sizeof("retry:") - 1)){
+			/*
+			 * For backward compatibility, 'retry' is
+			 * supported as an alias for 'attempts', though
+			 * without an imposed maximum.
+			 */
+			statp->retry = atoi(cp + sizeof("retry:") - 1);
+#endif	/* SOLARIS2 */
+		} else if (!strncmp(cp, "attempts:", sizeof("attempts:") - 1)){
+			i = atoi(cp + sizeof("attempts:") - 1);
+			if (i <= RES_MAXRETRY)
+				statp->retry = i;
+			else
+				statp->retry = RES_MAXRETRY;
+#ifdef DEBUG
+			if (statp->options & RES_DEBUG)
+				printf(";;\tattempts=%d\n", statp->retry);
+#endif
+		} else if (!strncmp(cp, "debug", sizeof("debug") - 1)) {
+#ifdef DEBUG
+			if (!(statp->options & RES_DEBUG)) {
+				printf(";; res_setoptions(\"%s\", \"%s\")..\n",
+				       options, source);
+				statp->options |= RES_DEBUG;
+			}
+			printf(";;\tdebug\n");
+#endif
+		} else if (!strncmp(cp, "no_tld_query",
+				    sizeof("no_tld_query") - 1) ||
+			   !strncmp(cp, "no-tld-query",
+				    sizeof("no-tld-query") - 1)) {
+			statp->options |= RES_NOTLDQUERY;
+		} else if (!strncmp(cp, "inet6", sizeof("inet6") - 1)) {
+			statp->options |= RES_USE_INET6;
+		} else if (!strncmp(cp, "rotate", sizeof("rotate") - 1)) {
+			statp->options |= RES_ROTATE;
+		} else if (!strncmp(cp, "no-check-names",
+				    sizeof("no-check-names") - 1)) {
+			statp->options |= RES_NOCHECKNAME;
+		}
+#ifdef RES_USE_EDNS0
+		else if (!strncmp(cp, "edns0", sizeof("edns0") - 1)) {
+			statp->options |= RES_USE_EDNS0;
+		}
+#endif
+		else if (!strncmp(cp, "dname", sizeof("dname") - 1)) {
+			statp->options |= RES_USE_DNAME;
+		}
+		else if (!strncmp(cp, "nibble:", sizeof("nibble:") - 1)) {
+			if (ext == NULL)
+				goto skip;
+			cp += sizeof("nibble:") - 1;
+			i = MIN(strcspn(cp, " \t"), sizeof(ext->nsuffix) - 1);
+			strncpy(ext->nsuffix, cp, i);
+			ext->nsuffix[i] = '\0';
+		}
+		else if (!strncmp(cp, "nibble2:", sizeof("nibble2:") - 1)) {
+			if (ext == NULL)
+				goto skip;
+			cp += sizeof("nibble2:") - 1;
+			i = MIN(strcspn(cp, " \t"), sizeof(ext->nsuffix2) - 1);
+			strncpy(ext->nsuffix2, cp, i);
+			ext->nsuffix2[i] = '\0';
+		}
+		else if (!strncmp(cp, "v6revmode:", sizeof("v6revmode:") - 1)) {
+			cp += sizeof("v6revmode:") - 1;
+			/* "nibble" and "bitstring" used to be valid */
+			if (!strncmp(cp, "single", sizeof("single") - 1)) {
+				statp->options |= RES_NO_NIBBLE2;
+			} else if (!strncmp(cp, "both", sizeof("both") - 1)) {
+				statp->options &=
+					 ~RES_NO_NIBBLE2;
+			}
+		}
+		else {
+			/* XXX - print a warning here? */
+		}
+   skip:
+		/* skip to next run of spaces */
+		while (*cp && *cp != ' ' && *cp != '\t')
+			cp++;
+	}
+}
+
+#ifdef RESOLVSORT
+/* XXX - should really support CIDR which means explicit masks always. */
+static u_int32_t
+net_mask(in)		/*!< XXX - should really use system's version of this  */
+	struct in_addr in;
+{
+	register u_int32_t i = ntohl(in.s_addr);
+
+	if (IN_CLASSA(i))
+		return (htonl(IN_CLASSA_NET));
+	else if (IN_CLASSB(i))
+		return (htonl(IN_CLASSB_NET));
+	return (htonl(IN_CLASSC_NET));
+}
+#endif
+
+void
+res_rndinit(res_state statp)
+{
+	struct timeval now;
+	u_int32_t u32;
+	u_int16_t u16;
+
+	gettimeofday(&now, NULL);
+	u32 = now.tv_sec;
+	memcpy(statp->_u._ext._rnd, &u32, 4);
+	u32 = now.tv_usec;
+	memcpy(statp->_u._ext._rnd + 4, &u32, 4);
+	u32 += now.tv_sec;
+	memcpy(statp->_u._ext._rnd + 8, &u32, 4);
+	u16 = getpid();
+	memcpy(statp->_u._ext._rnd + 12, &u16, 2);
+
+}
+
+u_int
+res_nrandomid(res_state statp) {
+	struct timeval now;
+	u_int16_t u16;
+	MD5_CTX ctx;
+
+	gettimeofday(&now, NULL);
+	u16 = (u_int16_t) (now.tv_sec ^ now.tv_usec);
+
+	memcpy(statp->_u._ext._rnd + 14, &u16, 2);
+#ifndef HAVE_MD5
+	MD5_Init(&ctx);
+	MD5_Update(&ctx, statp->_u._ext._rnd, 16);
+	MD5_Final(statp->_u._ext._rnd, &ctx);
+#else
+	MD5Init(&ctx);
+	MD5Update(&ctx, statp->_u._ext._rnd, 16);
+	MD5Final(statp->_u._ext._rnd, &ctx);
+#endif
+	memcpy(&u16, statp->_u._ext._rnd + 14, 2);
+	return ((u_int) u16);
+}
+
+/*%
+ * This routine is for closing the socket if a virtual circuit is used and
+ * the program wants to close it.  This provides support for endhostent()
+ * which expects to close the socket.
+ *
+ * This routine is not expected to be user visible.
+ */
+void
+res_nclose(res_state statp) {
+	int ns;
+
+	if (statp->_vcsock >= 0) { 
+		(void) close(statp->_vcsock);
+		statp->_vcsock = -1;
+		statp->_flags &= ~(RES_F_VC | RES_F_CONN);
+	}
+	for (ns = 0; ns < statp->_u._ext.nscount; ns++) {
+		if (statp->_u._ext.nssocks[ns] != -1) {
+			(void) close(statp->_u._ext.nssocks[ns]);
+			statp->_u._ext.nssocks[ns] = -1;
+		}
+	}
+}
+
+void
+res_ndestroy(res_state statp) {
+	res_nclose(statp);
+	if (statp->_u._ext.ext != NULL)
+		free(statp->_u._ext.ext);
+	statp->options &= ~RES_INIT;
+	statp->_u._ext.ext = NULL;
+}
+
+const char *
+res_get_nibblesuffix(res_state statp) {
+	if (statp->_u._ext.ext)
+		return (statp->_u._ext.ext->nsuffix);
+	return ("ip6.arpa");
+}
+
+const char *
+res_get_nibblesuffix2(res_state statp) {
+	if (statp->_u._ext.ext)
+		return (statp->_u._ext.ext->nsuffix2);
+	return ("ip6.int");
+}
+
+void
+res_setservers(res_state statp, const union res_sockaddr_union *set, int cnt) {
+	int i, nserv;
+	size_t size;
+
+	/* close open servers */
+	res_nclose(statp);
+
+	/* cause rtt times to be forgotten */
+	statp->_u._ext.nscount = 0;
+
+	nserv = 0;
+	for (i = 0; i < cnt && nserv < MAXNS; i++) {
+		switch (set->sin.sin_family) {
+		case AF_INET:
+			size = sizeof(set->sin);
+			if (statp->_u._ext.ext)
+				memcpy(&statp->_u._ext.ext->nsaddrs[nserv],
+					&set->sin, size);
+			if (size <= sizeof(statp->nsaddr_list[nserv]))
+				memcpy(&statp->nsaddr_list[nserv],
+					&set->sin, size);
+			else
+				statp->nsaddr_list[nserv].sin_family = 0;
+			nserv++;
+			break;
+
+#ifdef HAS_INET6_STRUCTS
+		case AF_INET6:
+			size = sizeof(set->sin6);
+			if (statp->_u._ext.ext)
+				memcpy(&statp->_u._ext.ext->nsaddrs[nserv],
+					&set->sin6, size);
+			if (size <= sizeof(statp->nsaddr_list[nserv]))
+				memcpy(&statp->nsaddr_list[nserv],
+					&set->sin6, size);
+			else
+				statp->nsaddr_list[nserv].sin_family = 0;
+			nserv++;
+			break;
+#endif
+
+		default:
+			break;
+		}
+		set++;
+	}
+	statp->nscount = nserv;
+	
+}
+
+int
+res_getservers(res_state statp, union res_sockaddr_union *set, int cnt) {
+	int i;
+	size_t size;
+	u_int16_t family;
+
+	for (i = 0; i < statp->nscount && i < cnt; i++) {
+		if (statp->_u._ext.ext)
+			family = statp->_u._ext.ext->nsaddrs[i].sin.sin_family;
+		else 
+			family = statp->nsaddr_list[i].sin_family;
+
+		switch (family) {
+		case AF_INET:
+			size = sizeof(set->sin);
+			if (statp->_u._ext.ext)
+				memcpy(&set->sin,
+				       &statp->_u._ext.ext->nsaddrs[i],
+				       size);
+			else
+				memcpy(&set->sin, &statp->nsaddr_list[i],
+				       size);
+			break;
+
+#ifdef HAS_INET6_STRUCTS
+		case AF_INET6:
+			size = sizeof(set->sin6);
+			if (statp->_u._ext.ext)
+				memcpy(&set->sin6,
+				       &statp->_u._ext.ext->nsaddrs[i],
+				       size);
+			else
+				memcpy(&set->sin6, &statp->nsaddr_list[i],
+				       size);
+			break;
+#endif
+
+		default:
+			set->sin.sin_family = 0;
+			break;
+		}
+		set++;
+	}
+	return (statp->nscount);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_mkquery.c b/usr/src/lib/libresolv2_joy/common/resolv/res_mkquery.c
new file mode 100644
index 0000000000..cf36855e9d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_mkquery.c
@@ -0,0 +1,386 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Portions Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1996, 1997, 1988, 1999, 2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1985, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)res_mkquery.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: res_mkquery.c,v 1.10 2008/12/11 09:59:00 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+#include <sys/types.h>
+#include <sys/param.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#ifdef SUNW_CONFCHECK
+#include <sys/socket.h>
+#include <errno.h>
+#include <sys/stat.h>
+#endif /* SUNW_CONFCHECK */
+
+
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <string.h>
+#include "port_after.h"
+
+/* Options.  Leave them on. */
+#define DEBUG
+
+extern const char *_res_opcodes[];
+
+#ifdef SUNW_CONFCHECK
+static int      _confcheck(res_state statp);
+#endif /* SUNW_CONFCHECK */
+
+
+/*%
+ * Form all types of queries.
+ * Returns the size of the result or -1.
+ */
+int
+res_nmkquery(res_state statp,
+	     int op,			/*!< opcode of query  */
+	     const char *dname,		/*!< domain name  */
+	     int class, int type,	/*!< class and type of query  */
+	     const u_char *data,	/*!< resource record data  */
+	     int datalen,		/*!< length of data  */
+	     const u_char *newrr_in,	/*!< new rr for modify or append  */
+	     u_char *buf,		/*!< buffer to put query  */
+	     int buflen)		/*!< size of buffer  */
+{
+	register HEADER *hp;
+	register u_char *cp, *ep;
+	register int n;
+	u_char *dnptrs[20], **dpp, **lastdnptr;
+
+	UNUSED(newrr_in);
+
+#ifdef DEBUG
+	if (statp->options & RES_DEBUG)
+		printf(";; res_nmkquery(%s, %s, %s, %s)\n",
+		       _res_opcodes[op], dname, p_class(class), p_type(type));
+#endif
+
+#ifdef SUNW_CONFCHECK
+        /*
+         * 1247019, 1265838, and 4034368: Check to see if we can
+         * bailout quickly.
+         */
+        if (_confcheck(statp) == -1) {
+                RES_SET_H_ERRNO(statp, NO_RECOVERY);
+                return(-1);
+        }
+#endif /* SUNW_CONFCHECK */
+
+	/*
+	 * Initialize header fields.
+	 */
+	if ((buf == NULL) || (buflen < HFIXEDSZ))
+		return (-1);
+	memset(buf, 0, HFIXEDSZ);
+	hp = (HEADER *) buf;
+	statp->id = res_nrandomid(statp);
+	hp->id = htons(statp->id);
+	hp->opcode = op;
+	hp->rd = (statp->options & RES_RECURSE) != 0U;
+	hp->rcode = NOERROR;
+	cp = buf + HFIXEDSZ;
+	ep = buf + buflen;
+	dpp = dnptrs;
+	*dpp++ = buf;
+	*dpp++ = NULL;
+	lastdnptr = dnptrs + sizeof dnptrs / sizeof dnptrs[0];
+	/*
+	 * perform opcode specific processing
+	 */
+	switch (op) {
+	case QUERY:	/*FALLTHROUGH*/
+	case NS_NOTIFY_OP:
+		if (ep - cp < QFIXEDSZ)
+			return (-1);
+		if ((n = dn_comp(dname, cp, ep - cp - QFIXEDSZ, dnptrs,
+		    lastdnptr)) < 0)
+			return (-1);
+		cp += n;
+		ns_put16(type, cp);
+		cp += INT16SZ;
+		ns_put16(class, cp);
+		cp += INT16SZ;
+		hp->qdcount = htons(1);
+		if (op == QUERY || data == NULL)
+			break;
+		/*
+		 * Make an additional record for completion domain.
+		 */
+		if ((ep - cp) < RRFIXEDSZ)
+			return (-1);
+		n = dn_comp((const char *)data, cp, ep - cp - RRFIXEDSZ,
+			    dnptrs, lastdnptr);
+		if (n < 0)
+			return (-1);
+		cp += n;
+		ns_put16(T_NULL, cp);
+		cp += INT16SZ;
+		ns_put16(class, cp);
+		cp += INT16SZ;
+		ns_put32(0, cp);
+		cp += INT32SZ;
+		ns_put16(0, cp);
+		cp += INT16SZ;
+		hp->arcount = htons(1);
+		break;
+
+	case IQUERY:
+		/*
+		 * Initialize answer section
+		 */
+		if (ep - cp < 1 + RRFIXEDSZ + datalen)
+			return (-1);
+		*cp++ = '\0';	/*%< no domain name */
+		ns_put16(type, cp);
+		cp += INT16SZ;
+		ns_put16(class, cp);
+		cp += INT16SZ;
+		ns_put32(0, cp);
+		cp += INT32SZ;
+		ns_put16(datalen, cp);
+		cp += INT16SZ;
+		if (datalen) {
+			memcpy(cp, data, datalen);
+			cp += datalen;
+		}
+		hp->ancount = htons(1);
+		break;
+
+	default:
+		return (-1);
+	}
+	return (cp - buf);
+}
+
+#ifdef RES_USE_EDNS0
+/* attach OPT pseudo-RR, as documented in RFC2671 (EDNS0). */
+
+int
+res_nopt(res_state statp,
+	 int n0,		/*%< current offset in buffer */
+	 u_char *buf,		/*%< buffer to put query */
+	 int buflen,		/*%< size of buffer */
+	 int anslen)		/*%< UDP answer buffer size */
+{
+	register HEADER *hp;
+	register u_char *cp, *ep;
+	u_int16_t flags = 0;
+
+#ifdef DEBUG
+	if ((statp->options & RES_DEBUG) != 0U)
+		printf(";; res_nopt()\n");
+#endif
+
+	hp = (HEADER *) buf;
+	cp = buf + n0;
+	ep = buf + buflen;
+
+	if ((ep - cp) < 1 + RRFIXEDSZ)
+		return (-1);
+
+	*cp++ = 0;				/*%< "." */
+	ns_put16(ns_t_opt, cp);			/*%< TYPE */
+	cp += INT16SZ;
+	ns_put16(anslen & 0xffff, cp);		/*%< CLASS = UDP payload size */
+	cp += INT16SZ;
+	*cp++ = NOERROR;			/*%< extended RCODE */
+	*cp++ = 0;				/*%< EDNS version */
+
+	if (statp->options & RES_USE_DNSSEC) {
+#ifdef DEBUG
+		if (statp->options & RES_DEBUG)
+			printf(";; res_opt()... ENDS0 DNSSEC\n");
+#endif
+		flags |= NS_OPT_DNSSEC_OK;
+	}
+	ns_put16(flags, cp);
+	cp += INT16SZ;
+
+	ns_put16(0U, cp);			/*%< RDLEN */
+	cp += INT16SZ;
+
+	hp->arcount = htons(ntohs(hp->arcount) + 1);
+
+	return (cp - buf);
+}
+
+/*
+ * Construct variable data (RDATA) block for OPT psuedo-RR, append it
+ * to the buffer, then update the RDLEN field (previously set to zero by
+ * res_nopt()) with the new RDATA length.
+ */
+int
+res_nopt_rdata(res_state statp,
+	  int n0,	 	/*%< current offset in buffer */
+	  u_char *buf,	 	/*%< buffer to put query */
+	  int buflen,		/*%< size of buffer */
+	  u_char *rdata,	/*%< ptr to start of opt rdata */
+	  u_short code,		/*%< OPTION-CODE */
+	  u_short len,		/*%< OPTION-LENGTH */
+	  u_char *data)		/*%< OPTION_DATA */
+{
+	register u_char *cp, *ep;
+
+#ifdef DEBUG
+	if ((statp->options & RES_DEBUG) != 0U)
+		printf(";; res_nopt_rdata()\n");
+#endif
+
+	cp = buf + n0;
+	ep = buf + buflen;
+
+	if ((ep - cp) < (4 + len))
+		return (-1);
+
+	if (rdata < (buf + 2) || rdata >= ep)
+		return (-1);
+
+	ns_put16(code, cp);
+	cp += INT16SZ;
+
+	ns_put16(len, cp);
+	cp += INT16SZ;
+
+	memcpy(cp, data, len);
+	cp += len;
+
+	len = cp - rdata;
+	ns_put16(len, rdata - 2);	/* Update RDLEN field */
+
+	return (cp - buf);
+}
+#endif
+
+#ifdef SUNW_CONFCHECK
+
+/*
+ * Time out quickly if there is no /etc/resolv.conf and a TCP connection 
+ * to the local DNS server fails.
+ */
+static int _confcheck(res_state statp)
+{
+        int ns;
+        struct stat rc_stat;
+        struct sockaddr_in ns_sin;
+
+        /* First, we check to see if /etc/resolv.conf exists.
+         * If it doesn't, then it is likely that the localhost is
+         * the nameserver.
+         */
+        if (stat(_PATH_RESCONF, &rc_stat) == -1 && errno == ENOENT) {
+
+                /* Next, we check to see if _res.nsaddr is set to loopback.
+                 * If it isn't, it has been altered by the application
+                 * explicitly and we then want to bail with success.
+                 */
+                if (statp->nsaddr.sin_addr.S_un.S_addr ==
+				htonl(INADDR_LOOPBACK)) {
+
+                        /* Lastly, we try to connect to the TCP port of the
+                         * nameserver.  If this fails, then we know that
+                         * DNS is misconfigured and we can quickly exit.
+                         */
+                        ns = socket(AF_INET, SOCK_STREAM, 0);
+                        IN_SET_LOOPBACK_ADDR(&ns_sin);
+                        ns_sin.sin_port = htons(NAMESERVER_PORT);
+                        if (connect(ns, (struct sockaddr *) &ns_sin,
+                                    sizeof ns_sin) == -1) {
+                                close(ns);
+                                return(-1);
+                        }
+                        else {
+                                close(ns);
+
+                                return(0);
+                        }
+                }
+
+                return(0);
+        }
+
+        return (0);
+}
+#endif /* SUNW_CONFCHECK */
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_mkupdate.c b/usr/src/lib/libresolv2_joy/common/resolv/res_mkupdate.c
new file mode 100644
index 0000000000..8f73e281d0
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_mkupdate.c
@@ -0,0 +1,1163 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*! \file
+ * \brief
+ * Based on the Dynamic DNS reference implementation by Viraj Bais
+ * &lt;viraj_bais@ccm.fm.intel.com>
+ */
+
+#if !defined(lint) && !defined(SABER)
+static const char rcsid[] = "$Id: res_mkupdate.c,v 1.10 2008/12/11 09:59:00 marka Exp $";
+#endif /* not lint */
+
+#include "port_before.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <limits.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <res_update.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <ctype.h>
+
+#include "port_after.h"
+
+/* Options.  Leave them on. */
+#define DEBUG
+#define MAXPORT 1024
+
+static int getnum_str(u_char **, u_char *);
+static int gethexnum_str(u_char **, u_char *);
+static int getword_str(char *, int, u_char **, u_char *);
+static int getstr_str(char *, int, u_char **, u_char *);
+
+#define ShrinkBuffer(x)  if ((buflen -= x) < 0) return (-2);
+
+/* Forward. */
+
+int res_protocolnumber(const char *);
+int res_servicenumber(const char *);
+
+/*%
+ * Form update packets.
+ * Returns the size of the resulting packet if no error
+ *
+ * On error,
+ *	returns 
+ *\li              -1 if error in reading a word/number in rdata
+ *		   portion for update packets
+ *\li		-2 if length of buffer passed is insufficient
+ *\li		-3 if zone section is not the first section in
+ *		   the linked list, or section order has a problem
+ *\li		-4 on a number overflow
+ *\li		-5 unknown operation or no records
+ */
+int
+res_nmkupdate(res_state statp, ns_updrec *rrecp_in, u_char *buf, int buflen) {
+	ns_updrec *rrecp_start = rrecp_in;
+	HEADER *hp;
+	u_char *cp, *sp2, *startp, *endp;
+	int n, i, soanum, multiline;
+	ns_updrec *rrecp;
+	struct in_addr ina;
+	struct in6_addr in6a;
+        char buf2[MAXDNAME];
+	u_char buf3[MAXDNAME];
+	int section, numrrs = 0, counts[ns_s_max];
+	u_int16_t rtype, rclass;
+	u_int32_t n1, rttl;
+	u_char *dnptrs[20], **dpp, **lastdnptr;
+	int siglen, keylen, certlen;
+
+	/*
+	 * Initialize header fields.
+	 */
+	if ((buf == NULL) || (buflen < HFIXEDSZ))
+		return (-1);
+	memset(buf, 0, HFIXEDSZ);
+	hp = (HEADER *) buf;
+	statp->id = res_nrandomid(statp);
+	hp->id = htons(statp->id);
+	hp->opcode = ns_o_update;
+	hp->rcode = NOERROR;
+	cp = buf + HFIXEDSZ;
+	buflen -= HFIXEDSZ;
+	dpp = dnptrs;
+	*dpp++ = buf;
+	*dpp++ = NULL;
+	lastdnptr = dnptrs + sizeof dnptrs / sizeof dnptrs[0];
+
+	if (rrecp_start == NULL)
+		return (-5);
+	else if (rrecp_start->r_section != S_ZONE)
+		return (-3);
+
+	memset(counts, 0, sizeof counts);
+	for (rrecp = rrecp_start; rrecp; rrecp = NEXT(rrecp, r_glink)) {
+		numrrs++;
+                section = rrecp->r_section;
+		if (section < 0 || section >= ns_s_max)
+			return (-1);
+		counts[section]++;
+		for (i = section + 1; i < ns_s_max; i++)
+			if (counts[i])
+				return (-3);
+		rtype = rrecp->r_type;
+		rclass = rrecp->r_class;
+		rttl = rrecp->r_ttl;
+		/* overload class and type */
+		if (section == S_PREREQ) {
+			rttl = 0;
+			switch (rrecp->r_opcode) {
+			case YXDOMAIN:
+				rclass = C_ANY;
+				rtype = T_ANY;
+				rrecp->r_size = 0;
+				break;
+			case NXDOMAIN:
+				rclass = C_NONE;
+				rtype = T_ANY;
+				rrecp->r_size = 0;
+				break;
+			case NXRRSET:
+				rclass = C_NONE;
+				rrecp->r_size = 0;
+				break;
+			case YXRRSET:
+				if (rrecp->r_size == 0)
+					rclass = C_ANY;
+				break;
+			default:
+				fprintf(stderr,
+					"res_mkupdate: incorrect opcode: %d\n",
+					rrecp->r_opcode);
+				fflush(stderr);
+				return (-1);
+			}
+		} else if (section == S_UPDATE) {
+			switch (rrecp->r_opcode) {
+			case DELETE:
+				rclass = rrecp->r_size == 0 ? C_ANY : C_NONE;
+				break;
+			case ADD:
+				break;
+			default:
+				fprintf(stderr,
+					"res_mkupdate: incorrect opcode: %d\n",
+					rrecp->r_opcode);
+				fflush(stderr);
+				return (-1);
+			}
+		}
+
+		/*
+		 * XXX	appending default domain to owner name is omitted,
+		 *	fqdn must be provided
+		 */
+		if ((n = dn_comp(rrecp->r_dname, cp, buflen, dnptrs,
+				 lastdnptr)) < 0)
+			return (-1);
+		cp += n;
+		ShrinkBuffer(n + 2*INT16SZ);
+		PUTSHORT(rtype, cp);
+		PUTSHORT(rclass, cp);
+		if (section == S_ZONE) {
+			if (numrrs != 1 || rrecp->r_type != T_SOA)
+				return (-3);
+			continue;
+		}
+		ShrinkBuffer(INT32SZ + INT16SZ);
+		PUTLONG(rttl, cp);
+		sp2 = cp;  /*%< save pointer to length byte */
+		cp += INT16SZ;
+		if (rrecp->r_size == 0) {
+			if (section == S_UPDATE && rclass != C_ANY)
+				return (-1);
+			else {
+				PUTSHORT(0, sp2);
+				continue;
+			}
+		}
+		startp = rrecp->r_data;
+		endp = startp + rrecp->r_size - 1;
+		/* XXX this should be done centrally. */
+		switch (rrecp->r_type) {
+		case T_A:
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			if (!inet_aton(buf2, &ina))
+				return (-1);
+			n1 = ntohl(ina.s_addr);
+			ShrinkBuffer(INT32SZ);
+			PUTLONG(n1, cp);
+			break;
+		case T_CNAME:
+		case T_MB:
+		case T_MG:
+		case T_MR:
+		case T_NS:
+		case T_PTR:
+		case ns_t_dname:
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			n = dn_comp(buf2, cp, buflen, dnptrs, lastdnptr);
+			if (n < 0)
+				return (-1);
+			cp += n;
+			ShrinkBuffer(n);
+			break;
+		case T_MINFO:
+		case T_SOA:
+		case T_RP:
+			for (i = 0; i < 2; i++) {
+				if (!getword_str(buf2, sizeof buf2, &startp,
+						 endp))
+				return (-1);
+				n = dn_comp(buf2, cp, buflen,
+					    dnptrs, lastdnptr);
+				if (n < 0)
+					return (-1);
+				cp += n;
+				ShrinkBuffer(n);
+			}
+			if (rrecp->r_type == T_SOA) {
+				ShrinkBuffer(5 * INT32SZ);
+				while (isspace(*startp) || !*startp)
+					startp++;
+				if (*startp == '(') {
+					multiline = 1;
+					startp++;
+				} else
+					multiline = 0;
+				/* serial, refresh, retry, expire, minimum */
+				for (i = 0; i < 5; i++) {
+					soanum = getnum_str(&startp, endp);
+					if (soanum < 0)
+						return (-1);
+					PUTLONG(soanum, cp);
+				}
+				if (multiline) {
+					while (isspace(*startp) || !*startp)
+						startp++;
+					if (*startp != ')')
+						return (-1);
+				}
+			}
+			break;
+		case T_MX:
+		case T_AFSDB:
+		case T_RT:
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			n = dn_comp(buf2, cp, buflen, dnptrs, lastdnptr);
+			if (n < 0)
+				return (-1);
+			cp += n;
+			ShrinkBuffer(n);
+			break;
+		case T_SRV:
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			n = dn_comp(buf2, cp, buflen, NULL, NULL);
+			if (n < 0)
+				return (-1);
+			cp += n;
+			ShrinkBuffer(n);
+			break;
+		case T_PX:
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			PUTSHORT(n, cp);
+			ShrinkBuffer(INT16SZ);
+			for (i = 0; i < 2; i++) {
+				if (!getword_str(buf2, sizeof buf2, &startp,
+						 endp))
+					return (-1);
+				n = dn_comp(buf2, cp, buflen, dnptrs,
+					    lastdnptr);
+				if (n < 0)
+					return (-1);
+				cp += n;
+				ShrinkBuffer(n);
+			}
+			break;
+		case T_WKS: {
+			char bm[MAXPORT/8];
+			unsigned int maxbm = 0;
+
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			if (!inet_aton(buf2, &ina))
+				return (-1);
+			n1 = ntohl(ina.s_addr);
+			ShrinkBuffer(INT32SZ);
+			PUTLONG(n1, cp);
+
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			if ((i = res_protocolnumber(buf2)) < 0)
+				return (-1);
+			ShrinkBuffer(1);
+			*cp++ = i & 0xff;
+			 
+			for (i = 0; i < MAXPORT/8 ; i++)
+				bm[i] = 0;
+
+			while (getword_str(buf2, sizeof buf2, &startp, endp)) {
+				if ((n = res_servicenumber(buf2)) <= 0)
+					return (-1);
+
+				if (n < MAXPORT) {
+					bm[n/8] |= (0x80>>(n%8));
+					if ((unsigned)n > maxbm)
+						maxbm = n;
+				} else
+					return (-1);
+			}
+			maxbm = maxbm/8 + 1;
+			ShrinkBuffer(maxbm);
+			memcpy(cp, bm, maxbm);
+			cp += maxbm;
+			break;
+		}
+		case T_HINFO:
+			for (i = 0; i < 2; i++) {
+				if ((n = getstr_str(buf2, sizeof buf2,
+						&startp, endp)) < 0)
+					return (-1);
+				if (n > 255)
+					return (-1);
+				ShrinkBuffer(n+1);
+				*cp++ = n;
+				memcpy(cp, buf2, n);
+				cp += n;
+			}
+			break;
+		case T_TXT:
+			for (;;) {
+				if ((n = getstr_str(buf2, sizeof buf2,
+						&startp, endp)) < 0) {
+					if (cp != (sp2 + INT16SZ))
+						break;
+					return (-1);
+				}
+				if (n > 255)
+					return (-1);
+				ShrinkBuffer(n+1);
+				*cp++ = n;
+				memcpy(cp, buf2, n);
+				cp += n;
+			}
+			break;
+		case T_X25:
+			/* RFC1183 */
+			if ((n = getstr_str(buf2, sizeof buf2, &startp,
+					 endp)) < 0)
+				return (-1);
+			if (n > 255)
+				return (-1);
+			ShrinkBuffer(n+1);
+			*cp++ = n;
+			memcpy(cp, buf2, n);
+			cp += n;
+			break;
+		case T_ISDN:
+			/* RFC1183 */
+			if ((n = getstr_str(buf2, sizeof buf2, &startp,
+					 endp)) < 0)
+				return (-1);
+			if ((n > 255) || (n == 0))
+				return (-1);
+			ShrinkBuffer(n+1);
+			*cp++ = n;
+			memcpy(cp, buf2, n);
+			cp += n;
+			if ((n = getstr_str(buf2, sizeof buf2, &startp,
+					 endp)) < 0)
+				n = 0;
+			if (n > 255)
+				return (-1);
+			ShrinkBuffer(n+1);
+			*cp++ = n;
+			memcpy(cp, buf2, n);
+			cp += n;
+			break;
+		case T_NSAP:
+			if ((n = inet_nsap_addr((char *)startp, (u_char *)buf2, sizeof(buf2))) != 0) {
+				ShrinkBuffer(n);
+				memcpy(cp, buf2, n);
+				cp += n;
+			} else {
+				return (-1);
+			}
+			break;
+		case T_LOC:
+			if ((n = loc_aton((char *)startp, (u_char *)buf2)) != 0) {
+				ShrinkBuffer(n);
+				memcpy(cp, buf2, n);
+				cp += n;
+			} else
+				return (-1);
+			break;
+		case ns_t_sig:
+		    {
+			int sig_type, success, dateerror;
+			u_int32_t exptime, timesigned;
+
+			/* type */
+			if ((n = getword_str(buf2, sizeof buf2,
+					     &startp, endp)) < 0)
+				return (-1);
+			sig_type = sym_ston(__p_type_syms, buf2, &success);
+			if (!success || sig_type == ns_t_any)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(sig_type, cp);
+			/* alg */
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(1);
+			*cp++ = n;
+			/* labels */
+			n = getnum_str(&startp, endp);
+			if (n <= 0 || n > 255)
+				return (-1);
+			ShrinkBuffer(1);
+			*cp++ = n;
+			/* ottl  & expire */
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			exptime = ns_datetosecs(buf2, &dateerror);
+			if (!dateerror) {
+				ShrinkBuffer(INT32SZ);
+				PUTLONG(rttl, cp);
+			}
+			else {
+				char *ulendp;
+				u_int32_t ottl;
+
+				errno = 0;
+				ottl = strtoul(buf2, &ulendp, 10);
+				if (errno != 0 ||
+				    (ulendp != NULL && *ulendp != '\0'))
+					return (-1);
+				ShrinkBuffer(INT32SZ);
+				PUTLONG(ottl, cp);
+				if (!getword_str(buf2, sizeof buf2, &startp,
+						 endp))
+					return (-1);
+				exptime = ns_datetosecs(buf2, &dateerror);
+				if (dateerror)
+					return (-1);
+			}
+			/* expire */
+			ShrinkBuffer(INT32SZ);
+			PUTLONG(exptime, cp);
+			/* timesigned */
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			timesigned = ns_datetosecs(buf2, &dateerror);
+			if (!dateerror) {
+				ShrinkBuffer(INT32SZ);
+				PUTLONG(timesigned, cp);
+			}
+			else
+				return (-1);
+			/* footprint */
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+			/* signer name */
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			n = dn_comp(buf2, cp, buflen, dnptrs, lastdnptr);
+			if (n < 0)
+				return (-1);
+			cp += n;
+			ShrinkBuffer(n);
+			/* sig */
+			if ((n = getword_str(buf2, sizeof buf2,
+					     &startp, endp)) < 0)
+				return (-1);
+			siglen = b64_pton(buf2, buf3, sizeof(buf3));
+			if (siglen < 0)
+				return (-1);
+			ShrinkBuffer(siglen);
+			memcpy(cp, buf3, siglen);
+			cp += siglen;
+			break;
+		    }
+		case ns_t_key:
+			/* flags */
+			n = gethexnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+			/* proto */
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(1);
+			*cp++ = n;
+			/* alg */
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(1);
+			*cp++ = n;
+			/* key */
+			if ((n = getword_str(buf2, sizeof buf2,
+					     &startp, endp)) < 0)
+				return (-1);
+			keylen = b64_pton(buf2, buf3, sizeof(buf3));
+			if (keylen < 0)
+				return (-1);
+			ShrinkBuffer(keylen);
+			memcpy(cp, buf3, keylen);
+			cp += keylen;
+			break;
+		case ns_t_nxt:
+		    {
+			int success, nxt_type;
+			u_char data[32];
+			int maxtype;
+
+			/* next name */
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			n = dn_comp(buf2, cp, buflen, NULL, NULL);
+			if (n < 0)
+				return (-1);
+			cp += n;
+			ShrinkBuffer(n);
+			maxtype = 0;
+			memset(data, 0, sizeof data);
+			for (;;) {
+				if (!getword_str(buf2, sizeof buf2, &startp,
+						 endp))
+					break;
+				nxt_type = sym_ston(__p_type_syms, buf2,
+						    &success);
+				if (!success || !ns_t_rr_p(nxt_type))
+					return (-1);
+				NS_NXT_BIT_SET(nxt_type, data);
+				if (nxt_type > maxtype)
+					maxtype = nxt_type;
+			}
+			n = maxtype/NS_NXT_BITS+1;
+			ShrinkBuffer(n);
+			memcpy(cp, data, n);
+			cp += n;
+			break;
+		    }
+		case ns_t_cert:
+			/* type */
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+			/* key tag */
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+			/* alg */
+			n = getnum_str(&startp, endp);
+			if (n < 0)
+				return (-1);
+			ShrinkBuffer(1);
+			*cp++ = n;
+			/* cert */
+			if ((n = getword_str(buf2, sizeof buf2,
+					     &startp, endp)) < 0)
+				return (-1);
+			certlen = b64_pton(buf2, buf3, sizeof(buf3));
+			if (certlen < 0)
+				return (-1);
+			ShrinkBuffer(certlen);
+			memcpy(cp, buf3, certlen);
+			cp += certlen;
+			break;
+		case ns_t_aaaa:
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			if (inet_pton(AF_INET6, buf2, &in6a) <= 0)
+				return (-1);
+			ShrinkBuffer(NS_IN6ADDRSZ);
+			memcpy(cp, &in6a, NS_IN6ADDRSZ);
+			cp += NS_IN6ADDRSZ;
+			break;
+		case ns_t_naptr:
+			/* Order Preference Flags Service Replacement Regexp */
+			/* Order */
+			n = getnum_str(&startp, endp);
+			if (n < 0 || n > 65535)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+			/* Preference */
+			n = getnum_str(&startp, endp);
+			if (n < 0 || n > 65535)
+				return (-1);
+			ShrinkBuffer(INT16SZ);
+			PUTSHORT(n, cp);
+			/* Flags */
+			if ((n = getstr_str(buf2, sizeof buf2,
+					&startp, endp)) < 0) {
+				return (-1);
+			}
+			if (n > 255)
+				return (-1);
+			ShrinkBuffer(n+1);
+			*cp++ = n;
+			memcpy(cp, buf2, n);
+			cp += n;
+			/* Service Classes */
+			if ((n = getstr_str(buf2, sizeof buf2,
+					&startp, endp)) < 0) {
+				return (-1);
+			}
+			if (n > 255)
+				return (-1);
+			ShrinkBuffer(n+1);
+			*cp++ = n;
+			memcpy(cp, buf2, n);
+			cp += n;
+			/* Pattern */
+			if ((n = getstr_str(buf2, sizeof buf2,
+					&startp, endp)) < 0) {
+				return (-1);
+			}
+			if (n > 255)
+				return (-1);
+			ShrinkBuffer(n+1);
+			*cp++ = n;
+			memcpy(cp, buf2, n);
+			cp += n;
+			/* Replacement */
+			if (!getword_str(buf2, sizeof buf2, &startp, endp))
+				return (-1);
+			n = dn_comp(buf2, cp, buflen, NULL, NULL);
+			if (n < 0)
+				return (-1);
+			cp += n;
+			ShrinkBuffer(n);
+			break;
+		default:
+			return (-1);
+		} /*switch*/
+		n = (u_int16_t)((cp - sp2) - INT16SZ);
+		PUTSHORT(n, sp2);
+	} /*for*/
+		
+	hp->qdcount = htons(counts[0]);
+	hp->ancount = htons(counts[1]);
+	hp->nscount = htons(counts[2]);
+	hp->arcount = htons(counts[3]);
+	return (cp - buf);
+}
+
+/*%
+ * Get a whitespace delimited word from a string (not file)
+ * into buf. modify the start pointer to point after the
+ * word in the string.
+ */
+static int
+getword_str(char *buf, int size, u_char **startpp, u_char *endp) {
+        char *cp;
+        int c;
+ 
+        for (cp = buf; *startpp <= endp; ) {
+                c = **startpp;
+                if (isspace(c) || c == '\0') {
+                        if (cp != buf) /*%< trailing whitespace */
+                                break;
+                        else { /*%< leading whitespace */
+                                (*startpp)++;
+                                continue;
+                        }
+                }
+                (*startpp)++;
+                if (cp >= buf+size-1)
+                        break;
+                *cp++ = (u_char)c;
+        }
+        *cp = '\0';
+        return (cp != buf);
+}
+
+/*%
+ * get a white spae delimited string from memory.  Process quoted strings
+ * and \\DDD escapes.  Return length or -1 on error.  Returned string may
+ * contain nulls.
+ */
+static char digits[] = "0123456789";
+static int
+getstr_str(char *buf, int size, u_char **startpp, u_char *endp) {
+        char *cp;
+        int c, c1 = 0;
+	int inquote = 0;
+	int seen_quote = 0;
+	int escape = 0;
+	int dig = 0;
+ 
+	for (cp = buf; *startpp <= endp; ) {
+                if ((c = **startpp) == '\0')
+			break;
+		/* leading white space */
+		if ((cp == buf) && !seen_quote && isspace(c)) {
+			(*startpp)++;
+			continue;
+		}
+
+		switch (c) {
+		case '\\':
+			if (!escape)  {
+				escape = 1;
+				dig = 0;
+				c1 = 0;
+				(*startpp)++;
+				continue;
+			} 
+			goto do_escape;
+		case '"':
+			if (!escape) {
+				inquote = !inquote;
+				seen_quote = 1;
+				(*startpp)++;
+				continue;
+			}
+			/* fall through */
+		default:
+		do_escape:
+			if (escape) {
+				switch (c) {
+				case '0':
+				case '1':
+				case '2':
+				case '3':
+				case '4':
+				case '5':
+				case '6':
+				case '7':
+				case '8':
+				case '9':
+					c1 = c1 * 10 + 
+						(strchr(digits, c) - digits);
+
+					if (++dig == 3) {
+						c = c1 &0xff;
+						break;
+					}
+					(*startpp)++;
+					continue;
+				}
+				escape = 0;
+			} else if (!inquote && isspace(c))
+				goto done;
+			if (cp >= buf+size-1)
+				goto done;
+			*cp++ = (u_char)c;
+			(*startpp)++;
+		}
+	}
+ done:
+	*cp = '\0';
+	return ((cp == buf)?  (seen_quote? 0: -1): (cp - buf));
+}
+
+/*%
+ * Get a whitespace delimited base 16 number from a string (not file) into buf
+ * update the start pointer to point after the number in the string.
+ */
+static int
+gethexnum_str(u_char **startpp, u_char *endp) {
+        int c, n;
+        int seendigit = 0;
+        int m = 0;
+
+	if (*startpp + 2 >= endp || strncasecmp((char *)*startpp, "0x", 2) != 0)
+		return getnum_str(startpp, endp);
+	(*startpp)+=2;
+        for (n = 0; *startpp <= endp; ) {
+                c = **startpp;
+                if (isspace(c) || c == '\0') {
+                        if (seendigit) /*%< trailing whitespace */
+                                break;
+                        else { /*%< leading whitespace */
+                                (*startpp)++;
+                                continue;
+                        }
+                }
+                if (c == ';') {
+                        while ((*startpp <= endp) &&
+			       ((c = **startpp) != '\n'))
+					(*startpp)++;
+                        if (seendigit)
+                                break;
+                        continue;
+                }
+                if (!isxdigit(c)) {
+                        if (c == ')' && seendigit) {
+                                (*startpp)--;
+                                break;
+                        }
+			return (-1);
+                }        
+                (*startpp)++;
+		if (isdigit(c))
+	                n = n * 16 + (c - '0');
+		else
+			n = n * 16 + (tolower(c) - 'a' + 10);
+                seendigit = 1;
+        }
+        return (n + m);
+}
+
+/*%
+ * Get a whitespace delimited base 10 number from a string (not file) into buf
+ * update the start pointer to point after the number in the string.
+ */
+static int
+getnum_str(u_char **startpp, u_char *endp) {
+        int c, n;
+        int seendigit = 0;
+        int m = 0;
+
+        for (n = 0; *startpp <= endp; ) {
+                c = **startpp;
+                if (isspace(c) || c == '\0') {
+                        if (seendigit) /*%< trailing whitespace */
+                                break;
+                        else { /*%< leading whitespace */
+                                (*startpp)++;
+                                continue;
+                        }
+                }
+                if (c == ';') {
+                        while ((*startpp <= endp) &&
+			       ((c = **startpp) != '\n'))
+					(*startpp)++;
+                        if (seendigit)
+                                break;
+                        continue;
+                }
+                if (!isdigit(c)) {
+                        if (c == ')' && seendigit) {
+                                (*startpp)--;
+                                break;
+                        }
+			return (-1);
+                }        
+                (*startpp)++;
+                n = n * 10 + (c - '0');
+                seendigit = 1;
+        }
+        return (n + m);
+}
+
+/*%
+ * Allocate a resource record buffer & save rr info.
+ */
+ns_updrec *
+res_mkupdrec(int section, const char *dname,
+	     u_int class, u_int type, u_long ttl) {
+	ns_updrec *rrecp = (ns_updrec *)calloc(1, sizeof(ns_updrec));
+
+	if (!rrecp || !(rrecp->r_dname = strdup(dname))) {
+		if (rrecp)
+			free((char *)rrecp);
+		return (NULL);
+	}
+	INIT_LINK(rrecp, r_link);
+	INIT_LINK(rrecp, r_glink);
+ 	rrecp->r_class = (ns_class)class;
+	rrecp->r_type = (ns_type)type;
+	rrecp->r_ttl = ttl;
+	rrecp->r_section = (ns_sect)section;
+	return (rrecp);
+}
+
+/*%
+ * Free a resource record buffer created by res_mkupdrec.
+ */
+void
+res_freeupdrec(ns_updrec *rrecp) {
+	/* Note: freeing r_dp is the caller's responsibility. */
+	if (rrecp->r_dname != NULL)
+		free(rrecp->r_dname);
+	free(rrecp);
+}
+
+struct valuelist {
+	struct valuelist *	next;
+	struct valuelist *	prev;
+	char *			name;
+	char *			proto;
+	int			port;
+};
+static struct valuelist *servicelist, *protolist;
+
+static void
+res_buildservicelist() {
+	struct servent *sp;
+	struct valuelist *slp;
+
+#ifdef MAYBE_HESIOD
+	setservent(0);
+#else
+	setservent(1);
+#endif
+	while ((sp = getservent()) != NULL) {
+		slp = (struct valuelist *)malloc(sizeof(struct valuelist));
+		if (!slp)
+			break;
+		slp->name = strdup(sp->s_name);
+		slp->proto = strdup(sp->s_proto);
+		if ((slp->name == NULL) || (slp->proto == NULL)) {
+			if (slp->name) free(slp->name);
+			if (slp->proto) free(slp->proto);
+			free(slp);
+			break;
+		}
+		slp->port = ntohs((u_int16_t)sp->s_port);  /*%< host byt order */
+		slp->next = servicelist;
+		slp->prev = NULL;
+		if (servicelist)
+			servicelist->prev = slp;
+		servicelist = slp;
+	}
+	endservent();
+}
+
+void
+res_destroyservicelist() {
+	struct valuelist *slp, *slp_next;
+
+	for (slp = servicelist; slp != NULL; slp = slp_next) {
+		slp_next = slp->next;
+		free(slp->name);
+		free(slp->proto);
+		free(slp);
+	}
+	servicelist = (struct valuelist *)0;
+}
+
+void
+res_buildprotolist(void) {
+	struct protoent *pp;
+	struct valuelist *slp;
+
+#ifdef MAYBE_HESIOD
+	setprotoent(0);
+#else
+	setprotoent(1);
+#endif
+	while ((pp = getprotoent()) != NULL) {
+		slp = (struct valuelist *)malloc(sizeof(struct valuelist));
+		if (!slp)
+			break;
+		slp->name = strdup(pp->p_name);
+		if (slp->name == NULL) {
+			free(slp);
+			break;
+		}
+		slp->port = pp->p_proto;	/*%< host byte order */
+		slp->next = protolist;
+		slp->prev = NULL;
+		if (protolist)
+			protolist->prev = slp;
+		protolist = slp;
+	}
+	endprotoent();
+}
+
+void
+res_destroyprotolist(void) {
+	struct valuelist *plp, *plp_next;
+
+	for (plp = protolist; plp != NULL; plp = plp_next) {
+		plp_next = plp->next;
+		free(plp->name);
+		free(plp);
+	}
+	protolist = (struct valuelist *)0;
+}
+
+static int
+findservice(const char *s, struct valuelist **list) {
+	struct valuelist *lp = *list;
+	int n;
+
+	for (; lp != NULL; lp = lp->next)
+		if (strcasecmp(lp->name, s) == 0) {
+			if (lp != *list) {
+				lp->prev->next = lp->next;
+				if (lp->next)
+					lp->next->prev = lp->prev;
+				(*list)->prev = lp;
+				lp->next = *list;
+				*list = lp;
+			}
+			return (lp->port);	/*%< host byte order */
+		}
+	if (sscanf(s, "%d", &n) != 1 || n <= 0)
+		n = -1;
+	return (n);
+}
+
+/*%
+ * Convert service name or (ascii) number to int.
+ */
+int
+res_servicenumber(const char *p) {
+	if (servicelist == (struct valuelist *)0)
+		res_buildservicelist();
+	return (findservice(p, &servicelist));
+}
+
+/*%
+ * Convert protocol name or (ascii) number to int.
+ */
+int
+res_protocolnumber(const char *p) {
+	if (protolist == (struct valuelist *)0)
+		res_buildprotolist();
+	return (findservice(p, &protolist));
+}
+
+static struct servent *
+cgetservbyport(u_int16_t port, const char *proto) {	/*%< Host byte order. */
+	struct valuelist **list = &servicelist;
+	struct valuelist *lp = *list;
+	static struct servent serv;
+
+	port = ntohs(port);
+	for (; lp != NULL; lp = lp->next) {
+		if (port != (u_int16_t)lp->port)	/*%< Host byte order. */
+			continue;
+		if (strcasecmp(lp->proto, proto) == 0) {
+			if (lp != *list) {
+				lp->prev->next = lp->next;
+				if (lp->next)
+					lp->next->prev = lp->prev;
+				(*list)->prev = lp;
+				lp->next = *list;
+				*list = lp;
+			}
+			serv.s_name = lp->name;
+			serv.s_port = htons((u_int16_t)lp->port);
+			serv.s_proto = lp->proto;
+			return (&serv);
+		}
+	}
+	return (0);
+}
+
+static struct protoent *
+cgetprotobynumber(int proto) {				/*%< Host byte order. */
+	struct valuelist **list = &protolist;
+	struct valuelist *lp = *list;
+	static struct protoent prot;
+
+	for (; lp != NULL; lp = lp->next)
+		if (lp->port == proto) {		/*%< Host byte order. */
+			if (lp != *list) {
+				lp->prev->next = lp->next;
+				if (lp->next)
+					lp->next->prev = lp->prev;
+				(*list)->prev = lp;
+				lp->next = *list;
+				*list = lp;
+			}
+			prot.p_name = lp->name;
+			prot.p_proto = lp->port;	/*%< Host byte order. */
+			return (&prot);
+		}
+	return (0);
+}
+
+const char *
+res_protocolname(int num) {
+	static char number[8];
+	struct protoent *pp;
+
+	if (protolist == (struct valuelist *)0)
+		res_buildprotolist();
+	pp = cgetprotobynumber(num);
+	if (pp == 0)  {
+		(void) sprintf(number, "%d", num);
+		return (number);
+	}
+	return (pp->p_name);
+}
+
+const char *
+res_servicename(u_int16_t port, const char *proto) {	/*%< Host byte order. */
+	static char number[8];
+	struct servent *ss;
+
+	if (servicelist == (struct valuelist *)0)
+		res_buildservicelist();
+	ss = cgetservbyport(htons(port), proto);
+	if (ss == 0)  {
+		(void) sprintf(number, "%d", port);
+		return (number);
+	}
+	return (ss->s_name);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_mkupdate.h b/usr/src/lib/libresolv2_joy/common/resolv/res_mkupdate.h
new file mode 100644
index 0000000000..96c452d89e
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_mkupdate.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _RES_MKUPDATE_H_
+#define _RES_MKUPDATE_H_
+
+__BEGIN_DECLS
+__END_DECLS
+
+#endif /* _RES_MKUPDATE_H_ */ 
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_private.h b/usr/src/lib/libresolv2_joy/common/resolv/res_private.h
new file mode 100644
index 0000000000..4e98157ced
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_private.h
@@ -0,0 +1,22 @@
+#ifndef res_private_h
+#define res_private_h
+
+struct __res_state_ext {
+	union res_sockaddr_union nsaddrs[MAXNS];
+	struct sort_list {
+		int     af;
+		union {
+			struct in_addr  ina;
+			struct in6_addr in6a;
+		} addr, mask;
+	} sort_list[MAXRESOLVSORT];
+	char nsuffix[64];
+	char nsuffix2[64];
+};
+
+extern int
+res_ourserver_p(const res_state statp, const struct sockaddr *sa);
+
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_query.c b/usr/src/lib/libresolv2_joy/common/resolv/res_query.c
new file mode 100644
index 0000000000..09df3da1fc
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_query.c
@@ -0,0 +1,440 @@
+/*
+ * Portions Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1996-2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1988, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)res_query.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: res_query.c,v 1.11 2008/11/14 02:36:51 marka Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include "port_before.h"
+#include <sys/types.h>
+#include <sys/param.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <ctype.h>
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "port_after.h"
+
+/* Options.  Leave them on. */
+#define DEBUG
+
+#if PACKETSZ > 1024
+#define MAXPACKET	PACKETSZ
+#else
+#define MAXPACKET	1024
+#endif
+
+/*%
+ * Formulate a normal query, send, and await answer.
+ * Returned answer is placed in supplied buffer "answer".
+ * Perform preliminary check of answer, returning success only
+ * if no error is indicated and the answer count is nonzero.
+ * Return the size of the response on success, -1 on error.
+ * Error number is left in H_ERRNO.
+ *
+ * Caller must parse answer and determine whether it answers the question.
+ */
+int
+res_nquery(res_state statp,
+	   const char *name,	/*%< domain name */
+	   int class, int type,	/*%< class and type of query */
+	   u_char *answer,	/*%< buffer to put answer */
+	   int anslen)		/*%< size of answer buffer */
+{
+	u_char buf[MAXPACKET];
+	HEADER *hp = (HEADER *) answer;
+	u_int oflags;
+	u_char *rdata;
+	int n;
+
+	oflags = statp->_flags;
+
+again:
+	hp->rcode = NOERROR;	/*%< default */
+#ifdef DEBUG
+	if (statp->options & RES_DEBUG)
+		printf(";; res_query(%s, %d, %d)\n", name, class, type);
+#endif
+
+	n = res_nmkquery(statp, QUERY, name, class, type, NULL, 0, NULL,
+			 buf, sizeof(buf));
+#ifdef RES_USE_EDNS0
+	if (n > 0 && (statp->_flags & RES_F_EDNS0ERR) == 0 &&
+	    (statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC|RES_NSID))) {
+		n = res_nopt(statp, n, buf, sizeof(buf), anslen);
+		rdata = &buf[n];
+		if (n > 0 && (statp->options & RES_NSID) != 0U) {
+			n = res_nopt_rdata(statp, n, buf, sizeof(buf), rdata,
+					   NS_OPT_NSID, 0, NULL);
+		}
+	}
+#endif
+	if (n <= 0) {
+#ifdef DEBUG
+		if (statp->options & RES_DEBUG)
+			printf(";; res_query: mkquery failed\n");
+#endif
+		RES_SET_H_ERRNO(statp, NO_RECOVERY);
+		return (n);
+	}
+
+	n = res_nsend(statp, buf, n, answer, anslen);
+	if (n < 0) {
+#ifdef RES_USE_EDNS0
+		/* if the query choked with EDNS0, retry without EDNS0 */
+		if ((statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC)) != 0U &&
+		    ((oflags ^ statp->_flags) & RES_F_EDNS0ERR) != 0) {
+			statp->_flags |= RES_F_EDNS0ERR;
+			if (statp->options & RES_DEBUG)
+				printf(";; res_nquery: retry without EDNS0\n");
+			goto again;
+		}
+#endif
+#ifdef DEBUG
+		if (statp->options & RES_DEBUG)
+			printf(";; res_query: send error\n");
+#endif
+		RES_SET_H_ERRNO(statp, TRY_AGAIN);
+		return (n);
+	}
+
+	if (hp->rcode != NOERROR || ntohs(hp->ancount) == 0) {
+#ifdef DEBUG
+		if (statp->options & RES_DEBUG)
+			printf(";; rcode = (%s), counts = an:%d ns:%d ar:%d\n",
+			       p_rcode(hp->rcode),
+			       ntohs(hp->ancount),
+			       ntohs(hp->nscount),
+			       ntohs(hp->arcount));
+#endif
+		switch (hp->rcode) {
+		case NXDOMAIN:
+			RES_SET_H_ERRNO(statp, HOST_NOT_FOUND);
+			break;
+		case SERVFAIL:
+			RES_SET_H_ERRNO(statp, TRY_AGAIN);
+			break;
+		case NOERROR:
+			RES_SET_H_ERRNO(statp, NO_DATA);
+			break;
+		case FORMERR:
+		case NOTIMP:
+		case REFUSED:
+		default:
+			RES_SET_H_ERRNO(statp, NO_RECOVERY);
+			break;
+		}
+		return (-1);
+	}
+	return (n);
+}
+
+/*%
+ * Formulate a normal query, send, and retrieve answer in supplied buffer.
+ * Return the size of the response on success, -1 on error.
+ * If enabled, implement search rules until answer or unrecoverable failure
+ * is detected.  Error code, if any, is left in H_ERRNO.
+ */
+int
+res_nsearch(res_state statp,
+	    const char *name,	/*%< domain name */
+	    int class, int type,	/*%< class and type of query */
+	    u_char *answer,	/*%< buffer to put answer */
+	    int anslen)		/*%< size of answer */
+{
+	const char *cp, * const *domain;
+	HEADER *hp = (HEADER *) answer;
+	char tmp[NS_MAXDNAME];
+	u_int dots;
+	int trailing_dot, ret, saved_herrno;
+	int got_nodata = 0, got_servfail = 0, root_on_list = 0;
+	int tried_as_is = 0;
+	int searched = 0;
+
+	errno = 0;
+	RES_SET_H_ERRNO(statp, HOST_NOT_FOUND);  /*%< True if we never query. */
+	dots = 0;
+	for (cp = name; *cp != '\0'; cp++)
+		dots += (*cp == '.');
+	trailing_dot = 0;
+	if (cp > name && *--cp == '.')
+		trailing_dot++;
+
+	/* If there aren't any dots, it could be a user-level alias. */
+	if (!dots && (cp = res_hostalias(statp, name, tmp, sizeof tmp))!= NULL)
+		return (res_nquery(statp, cp, class, type, answer, anslen));
+
+	/*
+	 * If there are enough dots in the name, let's just give it a
+	 * try 'as is'. The threshold can be set with the "ndots" option.
+	 * Also, query 'as is', if there is a trailing dot in the name.
+	 */
+	saved_herrno = -1;
+	if (dots >= statp->ndots || trailing_dot) {
+		ret = res_nquerydomain(statp, name, NULL, class, type,
+					 answer, anslen);
+		if (ret > 0 || trailing_dot)
+			return (ret);
+		saved_herrno = statp->res_h_errno;
+		tried_as_is++;
+	}
+
+	/*
+	 * We do at least one level of search if
+	 *	- there is no dot and RES_DEFNAME is set, or
+	 *	- there is at least one dot, there is no trailing dot,
+	 *	  and RES_DNSRCH is set.
+	 */
+	if ((!dots && (statp->options & RES_DEFNAMES) != 0U) ||
+	    (dots && !trailing_dot && (statp->options & RES_DNSRCH) != 0U)) {
+		int done = 0;
+
+		for (domain = (const char * const *)statp->dnsrch;
+		     *domain && !done;
+		     domain++) {
+			searched = 1;
+
+			if (domain[0][0] == '\0' ||
+			    (domain[0][0] == '.' && domain[0][1] == '\0'))
+				root_on_list++;
+
+			ret = res_nquerydomain(statp, name, *domain,
+					       class, type,
+					       answer, anslen);
+			if (ret > 0)
+				return (ret);
+
+			/*
+			 * If no server present, give up.
+			 * If name isn't found in this domain,
+			 * keep trying higher domains in the search list
+			 * (if that's enabled).
+			 * On a NO_DATA error, keep trying, otherwise
+			 * a wildcard entry of another type could keep us
+			 * from finding this entry higher in the domain.
+			 * If we get some other error (negative answer or
+			 * server failure), then stop searching up,
+			 * but try the input name below in case it's
+			 * fully-qualified.
+			 */
+			if (errno == ECONNREFUSED) {
+				RES_SET_H_ERRNO(statp, TRY_AGAIN);
+				return (-1);
+			}
+
+			switch (statp->res_h_errno) {
+			case NO_DATA:
+				got_nodata++;
+				/* FALLTHROUGH */
+			case HOST_NOT_FOUND:
+				/* keep trying */
+				break;
+			case TRY_AGAIN:
+				if (hp->rcode == SERVFAIL) {
+					/* try next search element, if any */
+					got_servfail++;
+					break;
+				}
+				/* FALLTHROUGH */
+			default:
+				/* anything else implies that we're done */
+				done++;
+			}
+
+			/* if we got here for some reason other than DNSRCH,
+			 * we only wanted one iteration of the loop, so stop.
+			 */
+			if ((statp->options & RES_DNSRCH) == 0U)
+				done++;
+		}
+	}
+
+	/*
+	 * If the query has not already been tried as is then try it
+	 * unless RES_NOTLDQUERY is set and there were no dots.
+	 */
+	if ((dots || !searched || (statp->options & RES_NOTLDQUERY) == 0U) &&
+	    !(tried_as_is || root_on_list)) {
+		ret = res_nquerydomain(statp, name, NULL, class, type,
+				       answer, anslen);
+		if (ret > 0)
+			return (ret);
+	}
+
+	/* if we got here, we didn't satisfy the search.
+	 * if we did an initial full query, return that query's H_ERRNO
+	 * (note that we wouldn't be here if that query had succeeded).
+	 * else if we ever got a nodata, send that back as the reason.
+	 * else send back meaningless H_ERRNO, that being the one from
+	 * the last DNSRCH we did.
+	 */
+	if (saved_herrno != -1)
+		RES_SET_H_ERRNO(statp, saved_herrno);
+	else if (got_nodata)
+		RES_SET_H_ERRNO(statp, NO_DATA);
+	else if (got_servfail)
+		RES_SET_H_ERRNO(statp, TRY_AGAIN);
+	return (-1);
+}
+
+/*%
+ * Perform a call on res_query on the concatenation of name and domain,
+ * removing a trailing dot from name if domain is NULL.
+ */
+int
+res_nquerydomain(res_state statp,
+	    const char *name,
+	    const char *domain,
+	    int class, int type,	/*%< class and type of query */
+	    u_char *answer,		/*%< buffer to put answer */
+	    int anslen)		/*%< size of answer */
+{
+	char nbuf[MAXDNAME];
+	const char *longname = nbuf;
+	int n, d;
+
+#ifdef DEBUG
+	if (statp->options & RES_DEBUG)
+		printf(";; res_nquerydomain(%s, %s, %d, %d)\n",
+		       name, domain?domain:"<Nil>", class, type);
+#endif
+	if (domain == NULL) {
+		/*
+		 * Check for trailing '.';
+		 * copy without '.' if present.
+		 */
+		n = strlen(name);
+		if (n >= MAXDNAME) {
+			RES_SET_H_ERRNO(statp, NO_RECOVERY);
+			return (-1);
+		}
+		n--;
+		if (n >= 0 && name[n] == '.') {
+			strncpy(nbuf, name, n);
+			nbuf[n] = '\0';
+		} else
+			longname = name;
+	} else {
+		n = strlen(name);
+		d = strlen(domain);
+		if (n + d + 1 >= MAXDNAME) {
+			RES_SET_H_ERRNO(statp, NO_RECOVERY);
+			return (-1);
+		}
+		sprintf(nbuf, "%s.%s", name, domain);
+	}
+	return (res_nquery(statp, longname, class, type, answer, anslen));
+}
+
+const char *
+res_hostalias(const res_state statp, const char *name, char *dst, size_t siz) {
+	char *file, *cp1, *cp2;
+	char buf[BUFSIZ];
+	FILE *fp;
+
+	if (statp->options & RES_NOALIASES)
+		return (NULL);
+	file = getenv("HOSTALIASES");
+	if (file == NULL || (fp = fopen(file, "r")) == NULL)
+		return (NULL);
+	setbuf(fp, NULL);
+	buf[sizeof(buf) - 1] = '\0';
+	while (fgets(buf, sizeof(buf), fp)) {
+		for (cp1 = buf; *cp1 && !isspace((unsigned char)*cp1); ++cp1)
+			;
+		if (!*cp1)
+			break;
+		*cp1 = '\0';
+		if (ns_samename(buf, name) == 1) {
+			while (isspace((unsigned char)*++cp1))
+				;
+			if (!*cp1)
+				break;
+			for (cp2 = cp1 + 1; *cp2 &&
+			     !isspace((unsigned char)*cp2); ++cp2)
+				;
+			*cp2 = '\0';
+			strncpy(dst, cp1, siz - 1);
+			dst[siz - 1] = '\0';
+			fclose(fp);
+			return (dst);
+		}
+	}
+	fclose(fp);
+	return (NULL);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_send.c b/usr/src/lib/libresolv2_joy/common/resolv/res_send.c
new file mode 100644
index 0000000000..289db4e77d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_send.c
@@ -0,0 +1,1120 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Portions Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1996-2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1985, 1989, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)res_send.c	8.1 (Berkeley) 6/4/93";
+static const char rcsid[] = "$Id: res_send.c,v 1.22 2009/01/22 23:49:23 tbox Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+/*! \file
+ * \brief
+ * Send query to name server and wait for reply.
+ */
+
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <sys/uio.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <isc/eventlib.h>
+
+#include "port_after.h"
+
+#ifdef USE_POLL
+#ifdef HAVE_STROPTS_H
+#include <stropts.h>
+#endif
+#include <poll.h>
+#endif /* USE_POLL */
+
+/* Options.  Leave them on. */
+#define DEBUG
+#include "res_debug.h"
+#include "res_private.h"
+
+#define EXT(res) ((res)->_u._ext)
+
+#ifndef USE_POLL
+static const int highestFD = FD_SETSIZE - 1;
+#else
+static int highestFD = 0;
+#endif
+
+/* Forward. */
+
+static int		get_salen __P((const struct sockaddr *));
+static struct sockaddr * get_nsaddr __P((res_state, size_t));
+static int		send_vc(res_state, const u_char *, int,
+				u_char *, int, int *, int);
+static int		send_dg(res_state, const u_char *, int,
+				u_char *, int, int *, int, int,
+				int *, int *);
+static void		Aerror(const res_state, FILE *, const char *, int,
+			       const struct sockaddr *, int);
+static void		Perror(const res_state, FILE *, const char *, int);
+static int		sock_eq(struct sockaddr *, struct sockaddr *);
+#if defined(NEED_PSELECT) && !defined(USE_POLL)
+static int		pselect(int, void *, void *, void *,
+				struct timespec *,
+				const sigset_t *);
+#endif
+void res_pquery(const res_state, const u_char *, int, FILE *);
+
+#ifndef	ORIGINAL_ISC_CODE
+#pragma weak	__res_nameinquery	=	res_nameinquery
+#pragma weak	__res_queriesmatch	=	res_queriesmatch
+#pragma weak	res_nisourserver	=	res_ourserver_p
+#endif	/* ORIGINAL_ISC_CODE */
+
+static const int niflags = NI_NUMERICHOST | NI_NUMERICSERV;
+
+/* Public. */
+
+/*%
+ *	looks up "ina" in _res.ns_addr_list[]
+ *
+ * returns:
+ *\li	0  : not found
+ *\li	>0 : found
+ *
+ * author:
+ *\li	paul vixie, 29may94
+ */
+int
+res_ourserver_p(const res_state statp, const struct sockaddr *sa) {
+	const struct sockaddr_in *inp, *srv;
+	const struct sockaddr_in6 *in6p, *srv6;
+	int ns;
+
+	switch (sa->sa_family) {
+	case AF_INET:
+		inp = (const struct sockaddr_in *)sa;
+		for (ns = 0;  ns < statp->nscount;  ns++) {
+			srv = (struct sockaddr_in *)get_nsaddr(statp, ns);
+			if (srv->sin_family == inp->sin_family &&
+			    srv->sin_port == inp->sin_port &&
+			    (srv->sin_addr.s_addr == INADDR_ANY ||
+			     srv->sin_addr.s_addr == inp->sin_addr.s_addr))
+				return (1);
+		}
+		break;
+	case AF_INET6:
+		if (EXT(statp).ext == NULL)
+			break;
+		in6p = (const struct sockaddr_in6 *)sa;
+		for (ns = 0;  ns < statp->nscount;  ns++) {
+			srv6 = (struct sockaddr_in6 *)get_nsaddr(statp, ns);
+			if (srv6->sin6_family == in6p->sin6_family &&
+			    srv6->sin6_port == in6p->sin6_port &&
+#ifdef HAVE_SIN6_SCOPE_ID
+			    (srv6->sin6_scope_id == 0 ||
+			     srv6->sin6_scope_id == in6p->sin6_scope_id) &&
+#endif
+			    (IN6_IS_ADDR_UNSPECIFIED(&srv6->sin6_addr) ||
+			     IN6_ARE_ADDR_EQUAL(&srv6->sin6_addr, &in6p->sin6_addr)))
+				return (1);
+		}
+		break;
+	default:
+		break;
+	}
+	return (0);
+}
+
+/*%
+ *	look for (name,type,class) in the query section of packet (buf,eom)
+ *
+ * requires:
+ *\li	buf + HFIXEDSZ <= eom
+ *
+ * returns:
+ *\li	-1 : format error
+ *\li	0  : not found
+ *\li	>0 : found
+ *
+ * author:
+ *\li	paul vixie, 29may94
+ */
+int
+res_nameinquery(const char *name, int type, int class,
+		const u_char *buf, const u_char *eom)
+{
+	const u_char *cp = buf + HFIXEDSZ;
+	int qdcount = ntohs(((const HEADER*)buf)->qdcount);
+
+	while (qdcount-- > 0) {
+		char tname[MAXDNAME+1];
+		int n, ttype, tclass;
+
+		n = dn_expand(buf, eom, cp, tname, sizeof tname);
+		if (n < 0)
+			return (-1);
+		cp += n;
+		if (cp + 2 * INT16SZ > eom)
+			return (-1);
+		ttype = ns_get16(cp); cp += INT16SZ;
+		tclass = ns_get16(cp); cp += INT16SZ;
+		if (ttype == type && tclass == class &&
+		    ns_samename(tname, name) == 1)
+			return (1);
+	}
+	return (0);
+}
+
+/*%
+ *	is there a 1:1 mapping of (name,type,class)
+ *	in (buf1,eom1) and (buf2,eom2)?
+ *
+ * returns:
+ *\li	-1 : format error
+ *\li	0  : not a 1:1 mapping
+ *\li	>0 : is a 1:1 mapping
+ *
+ * author:
+ *\li	paul vixie, 29may94
+ */
+int
+res_queriesmatch(const u_char *buf1, const u_char *eom1,
+		 const u_char *buf2, const u_char *eom2)
+{
+	const u_char *cp = buf1 + HFIXEDSZ;
+	int qdcount = ntohs(((const HEADER*)buf1)->qdcount);
+
+	if (buf1 + HFIXEDSZ > eom1 || buf2 + HFIXEDSZ > eom2)
+		return (-1);
+
+	/*
+	 * Only header section present in replies to
+	 * dynamic update packets.
+	 */
+	if ((((const HEADER *)buf1)->opcode == ns_o_update) &&
+	    (((const HEADER *)buf2)->opcode == ns_o_update))
+		return (1);
+
+	if (qdcount != ntohs(((const HEADER*)buf2)->qdcount))
+		return (0);
+	while (qdcount-- > 0) {
+		char tname[MAXDNAME+1];
+		int n, ttype, tclass;
+
+		n = dn_expand(buf1, eom1, cp, tname, sizeof tname);
+		if (n < 0)
+			return (-1);
+		cp += n;
+		if (cp + 2 * INT16SZ > eom1)
+			return (-1);
+		ttype = ns_get16(cp);	cp += INT16SZ;
+		tclass = ns_get16(cp); cp += INT16SZ;
+		if (!res_nameinquery(tname, ttype, tclass, buf2, eom2))
+			return (0);
+	}
+	return (1);
+}
+
+int
+res_nsend(res_state statp,
+	  const u_char *buf, int buflen, u_char *ans, int anssiz)
+{
+	int gotsomewhere, terrno, tries, v_circuit, resplen, ns, n;
+	char abuf[NI_MAXHOST];
+
+#ifdef USE_POLL
+	highestFD = sysconf(_SC_OPEN_MAX) - 1;
+#endif
+
+	/* No name servers or res_init() failure */
+	if (statp->nscount == 0 || EXT(statp).ext == NULL) {
+		errno = ESRCH;
+		return (-1);
+	}
+	if (anssiz < HFIXEDSZ) {
+		errno = EINVAL;
+		return (-1);
+	}
+	DprintQ((statp->options & RES_DEBUG) || (statp->pfcode & RES_PRF_QUERY),
+		(stdout, ";; res_send()\n"), buf, buflen);
+	v_circuit = (statp->options & RES_USEVC) || buflen > PACKETSZ;
+	gotsomewhere = 0;
+	terrno = ETIMEDOUT;
+
+	/*
+	 * If the ns_addr_list in the resolver context has changed, then
+	 * invalidate our cached copy and the associated timing data.
+	 */
+	if (EXT(statp).nscount != 0) {
+		int needclose = 0;
+		struct sockaddr_storage peer;
+		ISC_SOCKLEN_T peerlen;
+
+		if (EXT(statp).nscount != statp->nscount)
+			needclose++;
+		else
+			for (ns = 0; ns < statp->nscount; ns++) {
+				if (statp->nsaddr_list[ns].sin_family &&
+				    !sock_eq((struct sockaddr *)&statp->nsaddr_list[ns],
+					     (struct sockaddr *)&EXT(statp).ext->nsaddrs[ns])) {
+					needclose++;
+					break;
+				}
+
+				if (EXT(statp).nssocks[ns] == -1)
+					continue;
+				peerlen = sizeof(peer);
+				if (getpeername(EXT(statp).nssocks[ns],
+				    (struct sockaddr *)&peer, &peerlen) < 0) {
+					needclose++;
+					break;
+				}
+				if (!sock_eq((struct sockaddr *)&peer,
+				    get_nsaddr(statp, ns))) {
+					needclose++;
+					break;
+				}
+			}
+		if (needclose) {
+			res_nclose(statp);
+			EXT(statp).nscount = 0;
+		}
+	}
+
+	/*
+	 * Maybe initialize our private copy of the ns_addr_list.
+	 */
+	if (EXT(statp).nscount == 0) {
+		for (ns = 0; ns < statp->nscount; ns++) {
+			EXT(statp).nstimes[ns] = RES_MAXTIME;
+			EXT(statp).nssocks[ns] = -1;
+			if (!statp->nsaddr_list[ns].sin_family)
+				continue;
+			EXT(statp).ext->nsaddrs[ns].sin =
+				 statp->nsaddr_list[ns];
+		}
+		EXT(statp).nscount = statp->nscount;
+	}
+
+	/*
+	 * Some resolvers want to even out the load on their nameservers.
+	 * Note that RES_BLAST overrides RES_ROTATE.
+	 */
+	if ((statp->options & RES_ROTATE) != 0U &&
+	    (statp->options & RES_BLAST) == 0U) {
+		union res_sockaddr_union inu;
+		struct sockaddr_in ina;
+		int lastns = statp->nscount - 1;
+		int fd;
+		u_int16_t nstime;
+
+		if (EXT(statp).ext != NULL)
+			inu = EXT(statp).ext->nsaddrs[0];
+		ina = statp->nsaddr_list[0];
+		fd = EXT(statp).nssocks[0];
+		nstime = EXT(statp).nstimes[0];
+		for (ns = 0; ns < lastns; ns++) {
+			if (EXT(statp).ext != NULL)
+				EXT(statp).ext->nsaddrs[ns] =
+					EXT(statp).ext->nsaddrs[ns + 1];
+			statp->nsaddr_list[ns] = statp->nsaddr_list[ns + 1];
+			EXT(statp).nssocks[ns] = EXT(statp).nssocks[ns + 1];
+			EXT(statp).nstimes[ns] = EXT(statp).nstimes[ns + 1];
+		}
+		if (EXT(statp).ext != NULL)
+			EXT(statp).ext->nsaddrs[lastns] = inu;
+		statp->nsaddr_list[lastns] = ina;
+		EXT(statp).nssocks[lastns] = fd;
+		EXT(statp).nstimes[lastns] = nstime;
+	}
+
+	/*
+	 * Send request, RETRY times, or until successful.
+	 */
+	for (tries = 0; tries < statp->retry; tries++) {
+	    for (ns = 0; ns < statp->nscount; ns++) {
+		struct sockaddr *nsap;
+		int nsaplen;
+		nsap = get_nsaddr(statp, ns);
+		nsaplen = get_salen(nsap);
+		statp->_flags &= ~RES_F_LASTMASK;
+		statp->_flags |= (ns << RES_F_LASTSHIFT);
+ same_ns:
+		if (statp->qhook) {
+			int done = 0, loops = 0;
+
+			do {
+				res_sendhookact act;
+
+				act = (*statp->qhook)(&nsap, &buf, &buflen,
+						      ans, anssiz, &resplen);
+				switch (act) {
+				case res_goahead:
+					done = 1;
+					break;
+				case res_nextns:
+					res_nclose(statp);
+					goto next_ns;
+				case res_done:
+					return (resplen);
+				case res_modified:
+					/* give the hook another try */
+					if (++loops < 42) /*doug adams*/
+						break;
+					/*FALLTHROUGH*/
+				case res_error:
+					/*FALLTHROUGH*/
+				default:
+					goto fail;
+				}
+			} while (!done);
+		}
+
+		Dprint(((statp->options & RES_DEBUG) &&
+			getnameinfo(nsap, nsaplen, abuf, sizeof(abuf),
+				    NULL, 0, niflags) == 0),
+		       (stdout, ";; Querying server (# %d) address = %s\n",
+			ns + 1, abuf));
+
+
+		if (v_circuit) {
+			/* Use VC; at most one attempt per server. */
+			tries = statp->retry;
+			n = send_vc(statp, buf, buflen, ans, anssiz, &terrno,
+				    ns);
+			if (n < 0)
+				goto fail;
+			if (n == 0)
+				goto next_ns;
+			resplen = n;
+		} else {
+			/* Use datagrams. */
+			n = send_dg(statp, buf, buflen, ans, anssiz, &terrno,
+				    ns, tries, &v_circuit, &gotsomewhere);
+			if (n < 0)
+				goto fail;
+			if (n == 0)
+				goto next_ns;
+			if (v_circuit)
+				goto same_ns;
+			resplen = n;
+		}
+
+		Dprint((statp->options & RES_DEBUG) ||
+		       ((statp->pfcode & RES_PRF_REPLY) &&
+			(statp->pfcode & RES_PRF_HEAD1)),
+		       (stdout, ";; got answer:\n"));
+
+		DprintQ((statp->options & RES_DEBUG) ||
+			(statp->pfcode & RES_PRF_REPLY),
+			(stdout, "%s", ""),
+			ans, (resplen > anssiz) ? anssiz : resplen);
+
+		/*
+		 * If we have temporarily opened a virtual circuit,
+		 * or if we haven't been asked to keep a socket open,
+		 * close the socket.
+		 */
+		if ((v_circuit && (statp->options & RES_USEVC) == 0U) ||
+		    (statp->options & RES_STAYOPEN) == 0U) {
+			res_nclose(statp);
+		}
+		if (statp->rhook) {
+			int done = 0, loops = 0;
+
+			do {
+				res_sendhookact act;
+
+				act = (*statp->rhook)(nsap, buf, buflen,
+						      ans, anssiz, &resplen);
+				switch (act) {
+				case res_goahead:
+				case res_done:
+					done = 1;
+					break;
+				case res_nextns:
+					res_nclose(statp);
+					goto next_ns;
+				case res_modified:
+					/* give the hook another try */
+					if (++loops < 42) /*doug adams*/
+						break;
+					/*FALLTHROUGH*/
+				case res_error:
+					/*FALLTHROUGH*/
+				default:
+					goto fail;
+				}
+			} while (!done);
+
+		}
+		return (resplen);
+ next_ns: ;
+	   } /*foreach ns*/
+	} /*foreach retry*/
+	res_nclose(statp);
+	if (!v_circuit) {
+		if (!gotsomewhere)
+			errno = ECONNREFUSED;	/*%< no nameservers found */
+		else
+			errno = ETIMEDOUT;	/*%< no answer obtained */
+	} else
+		errno = terrno;
+	return (-1);
+ fail:
+	res_nclose(statp);
+	return (-1);
+}
+
+/* Private */
+
+static int
+get_salen(sa)
+	const struct sockaddr *sa;
+{
+
+#ifdef HAVE_SA_LEN
+	/* There are people do not set sa_len.  Be forgiving to them. */
+	if (sa->sa_len)
+		return (sa->sa_len);
+#endif
+
+	if (sa->sa_family == AF_INET)
+		return (sizeof(struct sockaddr_in));
+	else if (sa->sa_family == AF_INET6)
+		return (sizeof(struct sockaddr_in6));
+	else
+		return (0);	/*%< unknown, die on connect */
+}
+
+/*%
+ * pick appropriate nsaddr_list for use.  see res_init() for initialization.
+ */
+static struct sockaddr *
+get_nsaddr(statp, n)
+	res_state statp;
+	size_t n;
+{
+
+	if (!statp->nsaddr_list[n].sin_family && EXT(statp).ext) {
+		/*
+		 * - EXT(statp).ext->nsaddrs[n] holds an address that is larger
+		 *   than struct sockaddr, and
+		 * - user code did not update statp->nsaddr_list[n].
+		 */
+		return (struct sockaddr *)(void *)&EXT(statp).ext->nsaddrs[n];
+	} else {
+		/*
+		 * - user code updated statp->nsaddr_list[n], or
+		 * - statp->nsaddr_list[n] has the same content as
+		 *   EXT(statp).ext->nsaddrs[n].
+		 */
+		return (struct sockaddr *)(void *)&statp->nsaddr_list[n];
+	}
+}
+
+static int
+send_vc(res_state statp,
+	const u_char *buf, int buflen, u_char *ans, int anssiz,
+	int *terrno, int ns)
+{
+	const HEADER *hp = (const HEADER *) buf;
+	HEADER *anhp = (HEADER *) ans;
+	struct sockaddr *nsap;
+	int nsaplen;
+	int truncating, connreset, resplen, n;
+	struct iovec iov[2];
+	u_short len;
+	u_char *cp;
+	void *tmp;
+#ifdef SO_NOSIGPIPE
+	int on = 1;
+#endif
+
+	nsap = get_nsaddr(statp, ns);
+	nsaplen = get_salen(nsap);
+
+	connreset = 0;
+ same_ns:
+	truncating = 0;
+
+	/* Are we still talking to whom we want to talk to? */
+	if (statp->_vcsock >= 0 && (statp->_flags & RES_F_VC) != 0) {
+		struct sockaddr_storage peer;
+		ISC_SOCKLEN_T size = sizeof peer;
+
+		if (getpeername(statp->_vcsock,
+				(struct sockaddr *)&peer, &size) < 0 ||
+		    !sock_eq((struct sockaddr *)&peer, nsap)) {
+			res_nclose(statp);
+			statp->_flags &= ~RES_F_VC;
+		}
+	}
+
+	if (statp->_vcsock < 0 || (statp->_flags & RES_F_VC) == 0) {
+		if (statp->_vcsock >= 0)
+			res_nclose(statp);
+
+		statp->_vcsock = socket(nsap->sa_family, SOCK_STREAM, 0);
+		if (statp->_vcsock > highestFD) {
+			res_nclose(statp);
+			errno = ENOTSOCK;
+		}
+		if (statp->_vcsock < 0) {
+			switch (errno) {
+			case EPROTONOSUPPORT:
+#ifdef EPFNOSUPPORT
+			case EPFNOSUPPORT:
+#endif
+			case EAFNOSUPPORT:
+				Perror(statp, stderr, "socket(vc)", errno);
+				return (0);
+			default:
+				*terrno = errno;
+				Perror(statp, stderr, "socket(vc)", errno);
+				return (-1);
+			}
+		}
+#ifdef SO_NOSIGPIPE
+		/*
+		 * Disable generation of SIGPIPE when writing to a closed
+		 * socket.  Write should return -1 and set errno to EPIPE
+		 * instead.
+		 *
+		 * Push on even if setsockopt(SO_NOSIGPIPE) fails.
+		 */
+		(void)setsockopt(statp->_vcsock, SOL_SOCKET, SO_NOSIGPIPE, &on,
+				 sizeof(on));
+#endif
+		errno = 0;
+		if (connect(statp->_vcsock, nsap, nsaplen) < 0) {
+			*terrno = errno;
+			Aerror(statp, stderr, "connect/vc", errno, nsap,
+			    nsaplen);
+			res_nclose(statp);
+			return (0);
+		}
+		statp->_flags |= RES_F_VC;
+	}
+
+	/*
+	 * Send length & message
+	 */
+	ns_put16((u_short)buflen, (u_char*)&len);
+	iov[0] = evConsIovec(&len, INT16SZ);
+	DE_CONST(buf, tmp);
+	iov[1] = evConsIovec(tmp, buflen);
+	if (writev(statp->_vcsock, iov, 2) != (INT16SZ + buflen)) {
+		*terrno = errno;
+		Perror(statp, stderr, "write failed", errno);
+		res_nclose(statp);
+		return (0);
+	}
+	/*
+	 * Receive length & response
+	 */
+ read_len:
+	cp = ans;
+	len = INT16SZ;
+	while ((n = read(statp->_vcsock, (char *)cp, (int)len)) > 0) {
+		cp += n;
+		if ((len -= n) == 0)
+			break;
+	}
+	if (n <= 0) {
+		*terrno = errno;
+		Perror(statp, stderr, "read failed", errno);
+		res_nclose(statp);
+		/*
+		 * A long running process might get its TCP
+		 * connection reset if the remote server was
+		 * restarted.  Requery the server instead of
+		 * trying a new one.  When there is only one
+		 * server, this means that a query might work
+		 * instead of failing.  We only allow one reset
+		 * per query to prevent looping.
+		 */
+		if (*terrno == ECONNRESET && !connreset) {
+			connreset = 1;
+			res_nclose(statp);
+			goto same_ns;
+		}
+		res_nclose(statp);
+		return (0);
+	}
+	resplen = ns_get16(ans);
+	if (resplen > anssiz) {
+		Dprint(statp->options & RES_DEBUG,
+		       (stdout, ";; response truncated\n")
+		       );
+		truncating = 1;
+		len = anssiz;
+	} else
+		len = resplen;
+	if (len < HFIXEDSZ) {
+		/*
+		 * Undersized message.
+		 */
+		Dprint(statp->options & RES_DEBUG,
+		       (stdout, ";; undersized: %d\n", len));
+		*terrno = EMSGSIZE;
+		res_nclose(statp);
+		return (0);
+	}
+	cp = ans;
+	while (len != 0 && (n = read(statp->_vcsock, (char *)cp, (int)len)) > 0){
+		cp += n;
+		len -= n;
+	}
+	if (n <= 0) {
+		*terrno = errno;
+		Perror(statp, stderr, "read(vc)", errno);
+		res_nclose(statp);
+		return (0);
+	}
+	if (truncating) {
+		/*
+		 * Flush rest of answer so connection stays in synch.
+		 */
+		anhp->tc = 1;
+		len = resplen - anssiz;
+		while (len != 0) {
+			char junk[PACKETSZ];
+
+			n = read(statp->_vcsock, junk,
+				 (len > sizeof junk) ? sizeof junk : len);
+			if (n > 0)
+				len -= n;
+			else
+				break;
+		}
+	}
+	/*
+	 * If the calling applicating has bailed out of
+	 * a previous call and failed to arrange to have
+	 * the circuit closed or the server has got
+	 * itself confused, then drop the packet and
+	 * wait for the correct one.
+	 */
+	if (hp->id != anhp->id) {
+		DprintQ((statp->options & RES_DEBUG) ||
+			(statp->pfcode & RES_PRF_REPLY),
+			(stdout, ";; old answer (unexpected):\n"),
+			ans, (resplen > anssiz) ? anssiz: resplen);
+		goto read_len;
+	}
+
+	/*
+	 * All is well, or the error is fatal.  Signal that the
+	 * next nameserver ought not be tried.
+	 */
+	return (resplen);
+}
+
+static int
+send_dg(res_state statp, const u_char *buf, int buflen, u_char *ans,
+	int anssiz, int *terrno, int ns, int tries, int *v_circuit,
+	int *gotsomewhere)
+{
+	const HEADER *hp = (const HEADER *) buf;
+	HEADER *anhp = (HEADER *) ans;
+	const struct sockaddr *nsap;
+	int nsaplen;
+	struct timespec now, timeout, finish;
+	struct sockaddr_storage from;
+	ISC_SOCKLEN_T fromlen;
+	int resplen, seconds, n, s;
+#ifdef USE_POLL
+	int     polltimeout;
+	struct pollfd   pollfd;
+#else
+	fd_set dsmask;
+#endif
+
+	nsap = get_nsaddr(statp, ns);
+	nsaplen = get_salen(nsap);
+	if (EXT(statp).nssocks[ns] == -1) {
+		EXT(statp).nssocks[ns] = socket(nsap->sa_family, SOCK_DGRAM, 0);
+		if (EXT(statp).nssocks[ns] > highestFD) {
+			res_nclose(statp);
+			errno = ENOTSOCK;
+		}
+		if (EXT(statp).nssocks[ns] < 0) {
+			switch (errno) {
+			case EPROTONOSUPPORT:
+#ifdef EPFNOSUPPORT
+			case EPFNOSUPPORT:
+#endif
+			case EAFNOSUPPORT:
+				Perror(statp, stderr, "socket(dg)", errno);
+				return (0);
+			default:
+				*terrno = errno;
+				Perror(statp, stderr, "socket(dg)", errno);
+				return (-1);
+			}
+		}
+#ifndef CANNOT_CONNECT_DGRAM
+		/*
+		 * On a 4.3BSD+ machine (client and server,
+		 * actually), sending to a nameserver datagram
+		 * port with no nameserver will cause an
+		 * ICMP port unreachable message to be returned.
+		 * If our datagram socket is "connected" to the
+		 * server, we get an ECONNREFUSED error on the next
+		 * socket operation, and select returns if the
+		 * error message is received.  We can thus detect
+		 * the absence of a nameserver without timing out.
+		 */
+		if (connect(EXT(statp).nssocks[ns], nsap, nsaplen) < 0) {
+			Aerror(statp, stderr, "connect(dg)", errno, nsap,
+			    nsaplen);
+			res_nclose(statp);
+			return (0);
+		}
+#endif /* !CANNOT_CONNECT_DGRAM */
+		Dprint(statp->options & RES_DEBUG,
+		       (stdout, ";; new DG socket\n"))
+	}
+	s = EXT(statp).nssocks[ns];
+#ifndef CANNOT_CONNECT_DGRAM
+	if (send(s, (const char*)buf, buflen, 0) != buflen) {
+		Perror(statp, stderr, "send", errno);
+		res_nclose(statp);
+		return (0);
+	}
+#else /* !CANNOT_CONNECT_DGRAM */
+	if (sendto(s, (const char*)buf, buflen, 0, nsap, nsaplen) != buflen)
+	{
+		Aerror(statp, stderr, "sendto", errno, nsap, nsaplen);
+		res_nclose(statp);
+		return (0);
+	}
+#endif /* !CANNOT_CONNECT_DGRAM */
+
+	/*
+	 * Wait for reply.
+	 */
+	seconds = (statp->retrans << tries);
+	if (ns > 0)
+		seconds /= statp->nscount;
+	if (seconds <= 0)
+		seconds = 1;
+	now = evNowTime();
+	timeout = evConsTime(seconds, 0);
+	finish = evAddTime(now, timeout);
+	goto nonow;
+ wait:
+	now = evNowTime();
+ nonow:
+#ifndef USE_POLL
+	FD_ZERO(&dsmask);
+	FD_SET(s, &dsmask);
+	if (evCmpTime(finish, now) > 0)
+		timeout = evSubTime(finish, now);
+	else
+		timeout = evConsTime(0, 0);
+	n = pselect(s + 1, &dsmask, NULL, NULL, &timeout, NULL);
+#else
+	timeout = evSubTime(finish, now);
+	if (timeout.tv_sec < 0)
+		timeout = evConsTime(0, 0);
+	polltimeout = 1000*timeout.tv_sec +
+		timeout.tv_nsec/1000000;
+	pollfd.fd = s;
+	pollfd.events = POLLRDNORM;
+	n = poll(&pollfd, 1, polltimeout);
+#endif /* USE_POLL */
+
+	if (n == 0) {
+		Dprint(statp->options & RES_DEBUG, (stdout, ";; timeout\n"));
+		*gotsomewhere = 1;
+		return (0);
+	}
+	if (n < 0) {
+		if (errno == EINTR)
+			goto wait;
+#ifndef USE_POLL
+		Perror(statp, stderr, "select", errno);
+#else
+		Perror(statp, stderr, "poll", errno);
+#endif /* USE_POLL */
+		res_nclose(statp);
+		return (0);
+	}
+	errno = 0;
+	fromlen = sizeof(from);
+	resplen = recvfrom(s, (char*)ans, anssiz,0,
+			   (struct sockaddr *)&from, &fromlen);
+	if (resplen <= 0) {
+		Perror(statp, stderr, "recvfrom", errno);
+		res_nclose(statp);
+		return (0);
+	}
+	*gotsomewhere = 1;
+	if (resplen < HFIXEDSZ) {
+		/*
+		 * Undersized message.
+		 */
+		Dprint(statp->options & RES_DEBUG,
+		       (stdout, ";; undersized: %d\n",
+			resplen));
+		*terrno = EMSGSIZE;
+		res_nclose(statp);
+		return (0);
+	}
+	if (hp->id != anhp->id) {
+		/*
+		 * response from old query, ignore it.
+		 * XXX - potential security hazard could
+		 *	 be detected here.
+		 */
+		DprintQ((statp->options & RES_DEBUG) ||
+			(statp->pfcode & RES_PRF_REPLY),
+			(stdout, ";; old answer:\n"),
+			ans, (resplen > anssiz) ? anssiz : resplen);
+		goto wait;
+	}
+	if (!(statp->options & RES_INSECURE1) &&
+	    !res_ourserver_p(statp, (struct sockaddr *)&from)) {
+		/*
+		 * response from wrong server? ignore it.
+		 * XXX - potential security hazard could
+		 *	 be detected here.
+		 */
+		DprintQ((statp->options & RES_DEBUG) ||
+			(statp->pfcode & RES_PRF_REPLY),
+			(stdout, ";; not our server:\n"),
+			ans, (resplen > anssiz) ? anssiz : resplen);
+		goto wait;
+	}
+#ifdef RES_USE_EDNS0
+	if (anhp->rcode == FORMERR && (statp->options & RES_USE_EDNS0) != 0U) {
+		/*
+		 * Do not retry if the server do not understand EDNS0.
+		 * The case has to be captured here, as FORMERR packet do not
+		 * carry query section, hence res_queriesmatch() returns 0.
+		 */
+		DprintQ(statp->options & RES_DEBUG,
+			(stdout, "server rejected query with EDNS0:\n"),
+			ans, (resplen > anssiz) ? anssiz : resplen);
+		/* record the error */
+		statp->_flags |= RES_F_EDNS0ERR;
+		res_nclose(statp);
+		return (0);
+	}
+#endif
+	if (!(statp->options & RES_INSECURE2) &&
+	    !res_queriesmatch(buf, buf + buflen,
+			      ans, ans + anssiz)) {
+		/*
+		 * response contains wrong query? ignore it.
+		 * XXX - potential security hazard could
+		 *	 be detected here.
+		 */
+		DprintQ((statp->options & RES_DEBUG) ||
+			(statp->pfcode & RES_PRF_REPLY),
+			(stdout, ";; wrong query name:\n"),
+			ans, (resplen > anssiz) ? anssiz : resplen);
+		goto wait;
+	}
+	if (anhp->rcode == SERVFAIL ||
+	    anhp->rcode == NOTIMP ||
+	    anhp->rcode == REFUSED) {
+		DprintQ(statp->options & RES_DEBUG,
+			(stdout, "server rejected query:\n"),
+			ans, (resplen > anssiz) ? anssiz : resplen);
+		res_nclose(statp);
+		/* don't retry if called from dig */
+		if (!statp->pfcode)
+			return (0);
+	}
+	if (!(statp->options & RES_IGNTC) && anhp->tc) {
+		/*
+		 * To get the rest of answer,
+		 * use TCP with same server.
+		 */
+		Dprint(statp->options & RES_DEBUG,
+		       (stdout, ";; truncated answer\n"));
+		*v_circuit = 1;
+		res_nclose(statp);
+		return (1);
+	}
+	/*
+	 * All is well, or the error is fatal.  Signal that the
+	 * next nameserver ought not be tried.
+	 */
+	return (resplen);
+}
+
+static void
+Aerror(const res_state statp, FILE *file, const char *string, int error,
+       const struct sockaddr *address, int alen)
+{
+	int save = errno;
+	char hbuf[NI_MAXHOST];
+	char sbuf[NI_MAXSERV];
+
+	alen = alen;
+
+	if ((statp->options & RES_DEBUG) != 0U) {
+		if (getnameinfo(address, alen, hbuf, sizeof(hbuf),
+		    sbuf, sizeof(sbuf), niflags)) {
+			strncpy(hbuf, "?", sizeof(hbuf) - 1);
+			hbuf[sizeof(hbuf) - 1] = '\0';
+			strncpy(sbuf, "?", sizeof(sbuf) - 1);
+			sbuf[sizeof(sbuf) - 1] = '\0';
+		}
+		fprintf(file, "res_send: %s ([%s].%s): %s\n",
+			string, hbuf, sbuf, strerror(error));
+	}
+	errno = save;
+}
+
+static void
+Perror(const res_state statp, FILE *file, const char *string, int error) {
+	int save = errno;
+
+	if ((statp->options & RES_DEBUG) != 0U)
+		fprintf(file, "res_send: %s: %s\n",
+			string, strerror(error));
+	errno = save;
+}
+
+static int
+sock_eq(struct sockaddr *a, struct sockaddr *b) {
+	struct sockaddr_in *a4, *b4;
+	struct sockaddr_in6 *a6, *b6;
+
+	if (a->sa_family != b->sa_family)
+		return 0;
+	switch (a->sa_family) {
+	case AF_INET:
+		a4 = (struct sockaddr_in *)a;
+		b4 = (struct sockaddr_in *)b;
+		return a4->sin_port == b4->sin_port &&
+		    a4->sin_addr.s_addr == b4->sin_addr.s_addr;
+	case AF_INET6:
+		a6 = (struct sockaddr_in6 *)a;
+		b6 = (struct sockaddr_in6 *)b;
+		return a6->sin6_port == b6->sin6_port &&
+#ifdef HAVE_SIN6_SCOPE_ID
+		    a6->sin6_scope_id == b6->sin6_scope_id &&
+#endif
+		    IN6_ARE_ADDR_EQUAL(&a6->sin6_addr, &b6->sin6_addr);
+	default:
+		return 0;
+	}
+}
+
+#if defined(NEED_PSELECT) && !defined(USE_POLL)
+/* XXX needs to move to the porting library. */
+static int
+pselect(int nfds, void *rfds, void *wfds, void *efds,
+	struct timespec *tsp, const sigset_t *sigmask)
+{
+	struct timeval tv, *tvp;
+	sigset_t sigs;
+	int n;
+
+	if (tsp) {
+		tvp = &tv;
+		tv = evTimeVal(*tsp);
+	} else
+		tvp = NULL;
+	if (sigmask)
+		sigprocmask(SIG_SETMASK, sigmask, &sigs);
+	n = select(nfds, rfds, wfds, efds, tvp);
+	if (sigmask)
+		sigprocmask(SIG_SETMASK, &sigs, NULL);
+	if (tsp)
+		*tsp = evTimeSpec(tv);
+	return (n);
+}
+#endif
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_sendsigned.c b/usr/src/lib/libresolv2_joy/common/resolv/res_sendsigned.c
new file mode 100644
index 0000000000..5ebc1a70eb
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_sendsigned.c
@@ -0,0 +1,170 @@
+#include "port_before.h"
+#include "fd_setsize.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+
+#include <isc/dst.h>
+
+#include <errno.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "port_after.h"
+
+#define DEBUG
+#include "res_debug.h"
+
+
+/*% res_nsendsigned */
+int
+res_nsendsigned(res_state statp, const u_char *msg, int msglen,
+		ns_tsig_key *key, u_char *answer, int anslen)
+{
+	res_state nstatp;
+	DST_KEY *dstkey;
+	int usingTCP = 0;
+	u_char *newmsg;
+	int newmsglen, bufsize, siglen;
+	u_char sig[64];
+	HEADER *hp;
+	time_t tsig_time;
+	int ret;
+	int len;
+
+	dst_init();
+
+	nstatp = (res_state) malloc(sizeof(*statp));
+	if (nstatp == NULL) {
+		errno = ENOMEM;
+		return (-1);
+	}
+	memcpy(nstatp, statp, sizeof(*statp));
+
+	bufsize = msglen + 1024;
+	newmsg = (u_char *) malloc(bufsize);
+	if (newmsg == NULL) {
+		free(nstatp);
+		errno = ENOMEM;
+		return (-1);
+	}
+	memcpy(newmsg, msg, msglen);
+	newmsglen = msglen;
+
+	if (ns_samename(key->alg, NS_TSIG_ALG_HMAC_MD5) != 1)
+		dstkey = NULL;
+	else
+		dstkey = dst_buffer_to_key(key->name, KEY_HMAC_MD5,
+					   NS_KEY_TYPE_AUTH_ONLY,
+					   NS_KEY_PROT_ANY,
+					   key->data, key->len);
+	if (dstkey == NULL) {
+		errno = EINVAL;
+		free(nstatp);
+		free(newmsg);
+		return (-1);
+	}
+
+	nstatp->nscount = 1;
+	siglen = sizeof(sig);
+	ret = ns_sign(newmsg, &newmsglen, bufsize, NOERROR, dstkey, NULL, 0,
+		      sig, &siglen, 0);
+	if (ret < 0) {
+		free (nstatp);
+		free (newmsg);
+		dst_free_key(dstkey);
+		if (ret == NS_TSIG_ERROR_NO_SPACE)
+			errno  = EMSGSIZE;
+		else if (ret == -1)
+			errno  = EINVAL;
+		return (ret);
+	}
+
+	if (newmsglen > PACKETSZ || nstatp->options & RES_USEVC)
+		usingTCP = 1;
+	if (usingTCP == 0)
+		nstatp->options |= RES_IGNTC;
+	else
+		nstatp->options |= RES_USEVC;
+	/*
+	 * Stop res_send printing the answer.
+	 */
+	nstatp->options &= ~RES_DEBUG;
+	nstatp->pfcode &= ~RES_PRF_REPLY;
+
+retry:
+
+	len = res_nsend(nstatp, newmsg, newmsglen, answer, anslen);
+	if (len < 0) {
+		free (nstatp);
+		free (newmsg);
+		dst_free_key(dstkey);
+		return (len);
+	}
+
+	ret = ns_verify(answer, &len, dstkey, sig, siglen,
+			NULL, NULL, &tsig_time, nstatp->options & RES_KEEPTSIG);
+	if (ret != 0) {
+		Dprint((statp->options & RES_DEBUG) ||
+		       ((statp->pfcode & RES_PRF_REPLY) &&
+			(statp->pfcode & RES_PRF_HEAD1)),
+		       (stdout, ";; got answer:\n"));
+
+		DprintQ((statp->options & RES_DEBUG) ||
+			(statp->pfcode & RES_PRF_REPLY),
+			(stdout, "%s", ""),
+			answer, (anslen > len) ? len : anslen);
+
+		if (ret > 0) {
+			Dprint(statp->pfcode & RES_PRF_REPLY,
+			       (stdout, ";; server rejected TSIG (%s)\n",
+				p_rcode(ret)));
+		} else {
+			Dprint(statp->pfcode & RES_PRF_REPLY,
+			       (stdout, ";; TSIG invalid (%s)\n",
+				p_rcode(-ret)));
+		}
+
+		free (nstatp);
+		free (newmsg);
+		dst_free_key(dstkey);
+		if (ret == -1)
+			errno = EINVAL;
+		else
+			errno = ENOTTY;
+		return (-1);
+	}
+
+	hp = (HEADER *) answer;
+	if (hp->tc && !usingTCP && (statp->options & RES_IGNTC) == 0U) {
+		nstatp->options &= ~RES_IGNTC;
+		usingTCP = 1;
+		goto retry;
+	}
+	Dprint((statp->options & RES_DEBUG) ||
+	       ((statp->pfcode & RES_PRF_REPLY) &&
+		(statp->pfcode & RES_PRF_HEAD1)),
+	       (stdout, ";; got answer:\n"));
+
+	DprintQ((statp->options & RES_DEBUG) ||
+		(statp->pfcode & RES_PRF_REPLY),
+		(stdout, "%s", ""),
+		answer, (anslen > len) ? len : anslen);
+
+	Dprint(statp->pfcode & RES_PRF_REPLY, (stdout, ";; TSIG ok\n"));
+
+	free (nstatp);
+	free (newmsg);
+	dst_free_key(dstkey);
+	return (len);
+}
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/common/resolv/res_update.c b/usr/src/lib/libresolv2_joy/common/resolv/res_update.c
new file mode 100644
index 0000000000..df24aee3bd
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/resolv/res_update.c
@@ -0,0 +1,213 @@
+#if !defined(lint) && !defined(SABER)
+static const char rcsid[] = "$Id: res_update.c,v 1.13 2005/04/27 04:56:43 sra Exp $";
+#endif /* not lint */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*! \file
+ * \brief
+ * Based on the Dynamic DNS reference implementation by Viraj Bais
+ * &lt;viraj_bais@ccm.fm.intel.com>
+ */
+
+#include "port_before.h"
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <errno.h>
+#include <limits.h>
+#include <netdb.h>
+#include <res_update.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/list.h>
+#include <resolv_joy.h>
+
+#include "port_after.h"
+#include "res_private.h"
+
+/*%
+ * Separate a linked list of records into groups so that all records
+ * in a group will belong to a single zone on the nameserver.
+ * Create a dynamic update packet for each zone and send it to the
+ * nameservers for that zone, and await answer.
+ * Abort if error occurs in updating any zone.
+ * Return the number of zones updated on success, < 0 on error.
+ *
+ * On error, caller must deal with the unsynchronized zones
+ * eg. an A record might have been successfully added to the forward
+ * zone but the corresponding PTR record would be missing if error
+ * was encountered while updating the reverse zone.
+ */
+
+struct zonegrp {
+	char			z_origin[MAXDNAME];
+	ns_class		z_class;
+	union res_sockaddr_union z_nsaddrs[MAXNS];
+	int			z_nscount;
+	int			z_flags;
+	LIST(ns_updrec)		z_rrlist;
+	LINK(struct zonegrp)	z_link;
+};
+
+#define ZG_F_ZONESECTADDED	0x0001
+
+/* Forward. */
+
+static void	res_dprintf(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
+
+/* Macros. */
+
+#define DPRINTF(x) do {\
+		int save_errno = errno; \
+		if ((statp->options & RES_DEBUG) != 0U) res_dprintf x; \
+		errno = save_errno; \
+	} while (0)
+
+/* Public. */
+
+int
+res_nupdate(res_state statp, ns_updrec *rrecp_in, ns_tsig_key *key) {
+	ns_updrec *rrecp;
+	u_char answer[PACKETSZ];
+	u_char *packet;
+	struct zonegrp *zptr, tgrp;
+	LIST(struct zonegrp) zgrps;
+	int nzones = 0, nscount = 0, n;
+	union res_sockaddr_union nsaddrs[MAXNS];
+
+	packet = malloc(NS_MAXMSG);
+	if (packet == NULL) {
+		DPRINTF(("malloc failed"));
+		return (0);
+	}
+	/* Thread all of the updates onto a list of groups. */
+	INIT_LIST(zgrps);
+	memset(&tgrp, 0, sizeof (tgrp));
+	for (rrecp = rrecp_in; rrecp;
+	     rrecp = LINKED(rrecp, r_link) ? NEXT(rrecp, r_link) : NULL) {
+		int nscnt;
+		/* Find the origin for it if there is one. */
+		tgrp.z_class = rrecp->r_class;
+		nscnt = res_findzonecut2(statp, rrecp->r_dname, tgrp.z_class,
+					 RES_EXHAUSTIVE, tgrp.z_origin,
+					 sizeof tgrp.z_origin, 
+					 tgrp.z_nsaddrs, MAXNS);
+		if (nscnt <= 0) {
+			DPRINTF(("res_findzonecut failed (%d)", nscnt));
+			goto done;
+		}
+		tgrp.z_nscount = nscnt;
+		/* Find the group for it if there is one. */
+		for (zptr = HEAD(zgrps); zptr != NULL; zptr = NEXT(zptr, z_link))
+			if (ns_samename(tgrp.z_origin, zptr->z_origin) == 1 &&
+			    tgrp.z_class == zptr->z_class)
+				break;
+		/* Make a group for it if there isn't one. */
+		if (zptr == NULL) {
+			zptr = malloc(sizeof *zptr);
+			if (zptr == NULL) {
+				DPRINTF(("malloc failed"));
+				goto done;
+			}
+			*zptr = tgrp;
+			zptr->z_flags = 0;
+			INIT_LINK(zptr, z_link);
+			INIT_LIST(zptr->z_rrlist);
+			APPEND(zgrps, zptr, z_link);
+		}
+		/* Thread this rrecp onto the right group. */
+		APPEND(zptr->z_rrlist, rrecp, r_glink);
+	}
+
+	for (zptr = HEAD(zgrps); zptr != NULL; zptr = NEXT(zptr, z_link)) {
+		/* Construct zone section and prepend it. */
+		rrecp = res_mkupdrec(ns_s_zn, zptr->z_origin,
+				     zptr->z_class, ns_t_soa, 0);
+		if (rrecp == NULL) {
+			DPRINTF(("res_mkupdrec failed"));
+			goto done;
+		}
+		PREPEND(zptr->z_rrlist, rrecp, r_glink);
+		zptr->z_flags |= ZG_F_ZONESECTADDED;
+
+		/* Marshall the update message. */
+		n = res_nmkupdate(statp, HEAD(zptr->z_rrlist),
+				  packet, NS_MAXMSG);
+		DPRINTF(("res_mkupdate -> %d", n));
+		if (n < 0)
+			goto done;
+
+		/* Temporarily replace the resolver's nameserver set. */
+		nscount = res_getservers(statp, nsaddrs, MAXNS);
+		res_setservers(statp, zptr->z_nsaddrs, zptr->z_nscount);
+
+		/* Send the update and remember the result. */
+		if (key != NULL)
+			n = res_nsendsigned(statp, packet, n, key,
+					    answer, sizeof answer);
+		else
+			n = res_nsend(statp, packet, n, answer, sizeof answer);
+		if (n < 0) {
+			DPRINTF(("res_nsend: send error, n=%d (%s)\n",
+				 n, strerror(errno)));
+			goto done;
+		}
+		if (((HEADER *)answer)->rcode == NOERROR)
+			nzones++;
+
+		/* Restore resolver's nameserver set. */
+		res_setservers(statp, nsaddrs, nscount);
+		nscount = 0;
+	}
+ done:
+	while (!EMPTY(zgrps)) {
+		zptr = HEAD(zgrps);
+		if ((zptr->z_flags & ZG_F_ZONESECTADDED) != 0)
+			res_freeupdrec(HEAD(zptr->z_rrlist));
+		UNLINK(zgrps, zptr, z_link);
+		free(zptr);
+	}
+	if (nscount != 0)
+		res_setservers(statp, nsaddrs, nscount);
+
+	free(packet);
+	return (nzones);
+}
+
+/* Private. */
+
+static void
+res_dprintf(const char *fmt, ...) {
+	va_list ap;
+
+	va_start(ap, fmt);
+	fputs(";; res_nupdate: ", stderr);
+	vfprintf(stderr, fmt, ap);
+	fputc('\n', stderr);
+	va_end(ap);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/sunw/sunw_mtctxres.c b/usr/src/lib/libresolv2_joy/common/sunw/sunw_mtctxres.c
new file mode 100644
index 0000000000..cc2a485ede
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/sunw/sunw_mtctxres.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#include <port_before.h>
+#include <thread.h>
+#include <errno.h>
+#include <netdb.h>
+#include <malloc.h>
+#include <string.h>
+#include <resolv_mt.h>
+#include <irs.h>
+#include <port_after.h>
+
+#pragma redefine_extname __h_errno __joy_h_errno
+
+/*
+ * much of the original version of sunw_mtxtxres.c was incorporated into
+ * ISC libbind as resolv/mtctxres.c. The following bits have not yet made
+ * it into ISC libbind.
+ */
+
+/*
+ * There used to be a private, MT-safe resolver interface that used TSD
+ * to store per-thread _res, h_errno, etc. We continue to provide the
+ * access functions __res_get_res() and __res_get_h_errno() so that binaries
+ * that used the private interface will continue to work.
+ */
+
+#ifdef	_res
+#undef	_res
+#endif
+
+extern struct __res_state	*__res_state(void);
+
+struct __res_state *
+__res_get_res(void) {
+	return (__res_state());
+}
+
+
+#ifdef	h_errno
+#undef	h_errno
+#endif
+
+extern int			*__h_errno(void);
+
+int *
+__res_get_h_errno(void) {
+	return (__h_errno());
+}
+
+
+#ifdef SUNW_HOSTS_FALLBACK
+
+/*
+ * When the name service switch calls libresolv, it doesn't want fallback
+ * to /etc/hosts, so we provide a method to turn it off.
+ */
+
+void
+__joy_res_set_no_hosts_fallback(void) {
+	___mtctxres()->no_hosts_fallback_private = 1;
+}
+
+void
+__joy_res_unset_no_hosts_fallback(void) {
+	___mtctxres()->no_hosts_fallback_private = 0;
+}
+
+int
+__res_no_hosts_fallback(void) {
+	return (___mtctxres()->no_hosts_fallback_private);
+}
+
+#endif  /* SUNW_HOSTS_FALLBACK */
+
+#ifdef	SUNW_OVERRIDE_RETRY
+
+/*
+ * The NS switch wants to be able to override the number of retries.
+ */
+
+int
+__joy_res_override_retry(int retry) {
+	___mtctxres()->retry_private = retry;
+	/*
+	 * This function doesn't really need a return value; saving the
+	 * old retry setting, and restoring it, is handled by __res_retry()
+	 * and __res_retry_reset() below. However, the nss_dns library
+	 * must have a private version of this function to be used when
+	 * running with an old libresolv. That private nss_dns function
+	 * needs a return value, and a function pointer is used to select
+	 * the right function at runtime. Thus, __res_override_retry
+	 * must have a function prototype consistent with the private
+	 * nss_dns function, i.e., one that returns an int.
+	 *
+	 * Given that we do have a return value, that value must be zero.
+	 * That's because retry_private == 0 is used to indicate that
+	 * no override retry value is in effect, and the way we expect
+	 * nss_dns to call us is:
+	 *
+	 *	int oldretry = __res_override_retry(N);
+	 *	<whatever>
+	 *	(void)__res_override_retry(old_retry);
+	 */
+	return (0);
+}
+
+int
+__res_retry(int retry) {
+	mtctxres_t	*mt = ___mtctxres();
+
+	mt->retry_save = retry;
+	return ((mt->retry_private != 0) ? mt->retry_private : retry);
+}
+
+int
+__res_retry_reset(void) {
+	mtctxres_t	*mt = ___mtctxres();
+
+	return (mt->retry_save);
+}
+
+#endif	/* SUNW_OVERRIDE_RETRY */
diff --git a/usr/src/lib/libresolv2_joy/common/sunw/sunw_updrec.c b/usr/src/lib/libresolv2_joy/common/sunw/sunw_updrec.c
new file mode 100644
index 0000000000..3b0ffc49df
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/sunw/sunw_updrec.c
@@ -0,0 +1,249 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * As of BIND 8.2.2, ISC (a) removed res_mkupdate(), res_update(), and
+ * res_mkupdrec() from what they consider the supported interface. The
+ * functions still exist, but their calling interface has changed, since
+ * the ns_updrec structure has changed.
+ *
+ * It seems probable that res_mkupdate()  etc. will return, though possibly
+ * with other changes, in some future BIND release. In order to avoid
+ * going to PSARC twice (once to remove the functions, and then again to
+ * add them back), we retain the old interface as a wrapper around the
+ * new one.
+ */
+
+#include <port_before.h>
+
+#include <malloc.h>
+#include <strings.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+
+/* get the Solaris ns_updrec before any renaming happens */
+#include <arpa/nameser.h>
+
+/* get the __ISC_ns_updrec */
+#include <res_update.h>
+
+#include <port_after.h>
+
+/* un-rename ns_updrec and res_* functions so we can wrap them */
+#undef	ns_updrec
+#undef	res_mkupdate
+#undef	res_update
+#undef	res_mkupdrec
+#undef	res_freeupdrec
+#undef	res_nmkupdate
+#undef	res_nupdate
+
+void	res_freeupdrec(ns_updrec *);
+
+static int
+old2new(ns_updrec *old, __ISC_ns_updrec *new) {
+
+	if (old->r_dname != 0) {
+		if ((new->r_dname = strdup(old->r_dname)) == 0)
+			return (-1);
+	} else {
+		new->r_dname = 0;
+	}
+
+	new->r_glink.prev =
+	new->r_glink.next =
+	new->r_link.prev  =
+	new->r_link.next  = 0;
+
+	new->r_section	= old->r_section;
+	new->r_class	= old->r_class;
+	new->r_type	= old->r_type;
+	new->r_ttl	= old->r_ttl;
+	new->r_data	= old->r_data;
+	new->r_size	= old->r_size;
+	new->r_opcode	= old->r_opcode;
+	new->r_dp	= old->r_dp;
+	new->r_deldp	= old->r_deldp;
+	new->r_zone	= old->r_zone;
+
+	return (0);
+}
+
+
+static int
+new2old(__ISC_ns_updrec *new, ns_updrec *old) {
+	/* XXX r_prev and r_next unchanged */
+	if (new->r_dname != 0) {
+		if ((old->r_dname = strdup(new->r_dname)) == 0)
+			return (-1);
+	} else {
+		old->r_dname = 0;
+	}
+	old->r_section	= new->r_section;
+	old->r_class	= new->r_class;
+	old->r_type	= new->r_type;
+	old->r_ttl	= new->r_ttl;
+	old->r_data	= new->r_data;
+	old->r_size	= new->r_size;
+	old->r_opcode	= new->r_opcode;
+	old->r_grpnext	= 0;			/* XXX */
+	old->r_dp	= new->r_dp;
+	old->r_deldp	= new->r_deldp;
+	old->r_zone	= new->r_zone;
+
+	return (0);
+}
+
+
+static void
+delete_list(__ISC_ns_updrec *list) {
+
+	__ISC_ns_updrec	*next;
+
+	for (; list != 0; list = next) {
+		next = list->r_link.next;
+		__ISC_res_freeupdrec(list);
+	}
+}
+
+
+static __ISC_ns_updrec *
+copy_list(ns_updrec *old, int do_glink) {
+
+	__ISC_ns_updrec *list = 0, *r, *p;
+
+	if (old == 0)
+		return (0);
+
+	for (p = 0; old != 0; old = old->r_next, p = r) {
+		if ((r = calloc(1, sizeof (*r))) == 0 ||
+			old2new(old, r) != 0) {
+			free(r);
+			delete_list(list);
+			return (0);
+		}
+		r->r_link.prev = p;
+		r->r_link.next = 0;
+		/* res_update and res_nupdate want r_glink set up like this */
+		if (do_glink) {
+			r->r_glink.prev = p;
+			r->r_glink.next = 0;
+		} else {
+			r->r_glink.prev = (void *)-1;
+			r->r_glink.next = (void *)-1;
+		}
+		if (p != 0) {
+			p->r_link.next = r;
+			if (do_glink) {
+				p->r_glink.next = r;
+			}
+		} else {
+			list = r;
+		}
+	}
+	return (list);
+}
+
+
+int
+res_mkupdate(ns_updrec  *rrecp_in, uchar_t *buf, int length) {
+
+	__ISC_ns_updrec	*r;
+	int		ret;
+
+	if ((r = copy_list(rrecp_in, 1)) == 0)
+		return (-1);
+
+	ret = __ISC_res_mkupdate(r, buf, length);
+
+	delete_list(r);
+
+	return (ret);
+}
+
+int
+res_nmkupdate(res_state statp, ns_updrec  *rrecp_in, uchar_t *buf, int length) {
+
+	__ISC_ns_updrec	*r;
+	int		ret;
+
+	if ((r = copy_list(rrecp_in, 1)) == 0)
+		return (-1);
+
+	ret = __ISC_res_nmkupdate(statp, r, buf, length);
+
+	delete_list(r);
+
+	return (ret);
+}
+
+
+int
+res_update(ns_updrec *rrecp_in) {
+
+	__ISC_ns_updrec	*r;
+	int		ret;
+
+	if ((r = copy_list(rrecp_in, 0)) == 0)
+		return (-1);
+
+	ret = __ISC_res_update(r);
+
+	delete_list(r);
+
+	return (ret);
+}
+
+int
+res_nupdate(res_state statp, ns_updrec *rrecp_in, ns_tsig_key *key) {
+
+	__ISC_ns_updrec	*r;
+	int		ret;
+
+	if ((r = copy_list(rrecp_in, 0)) == 0)
+		return (-1);
+
+	ret = __ISC_res_nupdate(statp, r, key);
+
+	delete_list(r);
+
+	return (ret);
+}
+
+
+
+ns_updrec *
+res_mkupdrec(int section, const char *dname, uint_t class, uint_t type,
+		uint_t ttl) {
+
+	__ISC_ns_updrec	*n;
+	ns_updrec	*o;
+
+	n = __ISC_res_mkupdrec(section, dname, class, type, ttl);
+	if (n == 0)
+		return (0);
+
+	if ((o = calloc(1, sizeof (*o))) != 0) {
+		if (new2old(n, o) != 0) {
+			res_freeupdrec(o);
+			o = 0;
+		}
+	}
+
+	__ISC_res_freeupdrec(n);
+
+	return (o);
+}
+
+
+void
+res_freeupdrec(ns_updrec *rrecp) {
+	if (rrecp == 0)
+		return;
+	/* Note: freeing r_dp is the caller's responsibility. */
+	if (rrecp->r_dname != NULL)
+		free(rrecp->r_dname);
+	free(rrecp);
+}
diff --git a/usr/src/lib/libresolv2_joy/common/sunw/sunw_wrappers.c b/usr/src/lib/libresolv2_joy/common/sunw/sunw_wrappers.c
new file mode 100644
index 0000000000..55bbe07024
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/common/sunw/sunw_wrappers.c
@@ -0,0 +1,23 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#include <port_before.h>
+#include <resolv_joy.h>
+#include <arpa/inet.h>
+#include <port_after.h>
+
+#undef p_option
+/* extern const char * isc_p_option(); */
+const char *p_option(uint_t option) {
+	return (isc_p_option((ulong_t)option));
+}
+#pragma weak	__p_option		=	p_option
+
+#undef p_secstodate
+/* extern char * isc_p_secstodate (); */
+char *p_secstodate(uint_t secs) {
+	return (isc_p_secstodate((ulong_t)secs));
+}
+#pragma weak	__p_secstodate		=	p_secstodate
diff --git a/usr/src/lib/libresolv2_joy/i386/Makefile b/usr/src/lib/libresolv2_joy/i386/Makefile
new file mode 100644
index 0000000000..a333224278
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/i386/Makefile
@@ -0,0 +1,30 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libresolv2_joy/include/Makefile b/usr/src/lib/libresolv2_joy/include/Makefile
new file mode 100644
index 0000000000..8bff3c3188
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/Makefile
@@ -0,0 +1,60 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include		../../../Makefile.master
+
+HDRS=		os_version.h port_ipv6.h
+TMPHDRS=	new_os_version.h new_port_ipv6.h
+
+all :=		TARGET= all
+clean :=	TARGET= clean
+clobber :=	TARGET= clobber
+install :=	TARGET= install
+
+.KEEP_STATE:
+
+all lint: $(HDRS)
+
+install: all
+
+clean:
+	$(RM) $(HDRS) $(TMPHDRS)
+
+clobber: clean
+
+# os_version.h and port_ipv6.h should be rebuilt when you change OS
+# revision. Since that's not easily expressed as a dependency, we
+# rebuild them every time.
+
+os_version.h: make_os_version FRC
+	./make_os_version
+
+port_ipv6.h: probe_ipv6 FRC
+	CC="$(CC)" ./probe_ipv6
+
+FRC:
diff --git a/usr/src/lib/libresolv2_joy/include/arpa/port_inet.h b/usr/src/lib/libresolv2_joy/include/arpa/port_inet.h
new file mode 100644
index 0000000000..5eb1787f56
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/arpa/port_inet.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ *
+ * All rights reserved.
+ */
+
+#ifndef _ARPA_PORT_INET_H
+#define	_ARPA_PORT_INET_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * these are libresolv2 functions that were made local in previous versions
+ * we rename them res_* because they conflict with libnsl or libsocket
+ */
+
+#define	inet_lnaof res_inet_lnaof  /* libsocket */
+ulong_t inet_lnaof(struct in_addr in);
+
+#define	inet_makeaddr res_inet_makeaddr  /* libsocket */
+struct in_addr inet_makeaddr(ulong_t net, ulong_t host);
+
+#define	inet_netof res_inet_netof  /* libnsl */
+ulong_t inet_netof(struct in_addr in);
+
+#define	inet_network res_inet_network  /* libsocket */
+ulong_t inet_network(register const char *cp);
+
+#ifdef	__cplusplus
+}
+#endif
+
+
+
+#endif /* _ARPA_PORT_INET_H */
diff --git a/usr/src/lib/libresolv2_joy/include/arpa/port_nameser.h b/usr/src/lib/libresolv2_joy/include/arpa/port_nameser.h
new file mode 100644
index 0000000000..b40ea0d163
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/arpa/port_nameser.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef _ARPA_PORT_NAMESER_H
+#define	_ARPA_PORT_NAMESER_H
+
+/*
+ * ISC changed the ns_updrec structure. However, it's a public interface
+ * in Solaris, so we rename it here and wrap in sunw_updrec.c
+ */
+#define	ns_updrec	__ISC_ns_updrec
+
+
+/*
+ * Due to the above, the following functions need to be renamed and
+ * wrapped in sunw_updrec.c.
+ *
+ * For BIND 8.2.2, ISC removed the dynamic update functions, and the
+ * definition of the ns_updrec structure, from the public include files
+ * (<resolv.h>, <arpa/nameser.h>. However, res_update(), res_mkupdate(),
+ * and res_mkupdrec() are in the public libresolv interface in Solaris,
+ * so we can't easily remove them. Thus, ISC's new versions of res_mkupdate()
+ * etc. can't be exposed under their original names.
+ *
+ * res_nmkupdate() and res_nupdate are new. We could either change them
+ * to accept the <arpa/nameser.h> ns_updrec, or leave them unchanged and
+ * undocumented. Since ISC may change ns_updrec again, we pick the latter
+ * solution for now.
+ */
+#define	res_mkupdate	__ISC_res_mkupdate
+#define	res_update	__ISC_res_update
+#define	res_mkupdrec	__ISC_res_mkupdrec
+#define	res_freeupdrec	__ISC_res_freeupdrec
+#define	res_nmkupdate	__ISC_res_nmkupdate
+#define	res_nupdate	__ISC_res_nupdate
+
+
+#endif /* _ARPA_PORT_NAMESER_H */
diff --git a/usr/src/lib/libresolv2_joy/include/conf/sunoptions.h b/usr/src/lib/libresolv2_joy/include/conf/sunoptions.h
new file mode 100644
index 0000000000..b75ff9d878
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/conf/sunoptions.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef	_SUNOPTIONS_H
+#define	_SUNOPTIONS_H
+
+#define	USELOOPBACK	/* Resolver library defaults to 127.0.0.1 */
+
+/* Additions for Solaris 2 */
+
+#define	SUNW_INITCHKIF		/* Check if any non-loopback interface is up */
+#define	SUNW_CONFCHECK		/* Abort quickly if no /etc/resolv.conf or */
+				/* local named */
+#define	SUNW_HOSTS_FALLBACK	/* Configurable /etc/hosts fallback */
+#define	SUNW_HNOK_UNDERSCORE	/* Allow underscore in hostnames (libresolv) */
+#define	SUNW_MT_RESOLVER	/* MT hot extensions (libresolv) */
+#define	SUNW_SETHERRNO		/* ISC does not set h_errno in gethostbyname */
+#define	SUNW_OVERRIDE_RETRY	/* Allow NS switch to override res->retry */
+#define	SUNW_LIBMD5	/* Use md5(3EXT) instead of internal implementation */
+
+/* If compiling an MT warm libresolv, we also need reentrancy */
+#if	defined(SUNW_MT_RESOLVER) && !defined(_REENTRANT)
+#define	_REENTRANT
+#endif
+
+/* End additions for Solaris 2 */
+
+#endif /* _SUNOPTIONS_H */
diff --git a/usr/src/lib/libresolv2_joy/include/config.h b/usr/src/lib/libresolv2_joy/include/config.h
new file mode 100644
index 0000000000..35fb115a0f
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/config.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/* config.h.  Generated from config.h.in by configure.  */
+/* #undef _SOCKADDR_LEN */
+#define HAVE_FCNTL_H 1
+/* #undef HAVE_PATHS_H */
+#define HAVE_INTTYPES_H 1
+#define HAVE_STROPTS_H 1
+/* #undef HAVE_SYS_TIMERS_H */
+#define HAVE_SYS_SELECT_H 1
+#define HAVE_MEMORY_H 1
+/* #undef SYS_CDEFS_H */
+#define _POSIX_PTHREAD_SEMANTICS 1
+#define POSIX_GETPWUID_R 1
+#define POSIX_GETPWNAM_R 1
+#define POSIX_GETGRGID_R 1
+#define POSIX_GETGRNAM_R 1
+#define HAVE_MEMMOVE 1
+#define HAVE_MEMCHR 1
+/* #undef SPRINTF_CHAR */
+/* #undef VSPRINTF_CHAR */
+#define USE_SYSERROR_LIST 1
+/* #undef NEED_STRTOUL */
+/* #undef NEED_SUN4PROTOS */
+/* #undef REENABLE_SEND */
+
+#define NEED_SETGROUPENT 1
+#define NEED_GETGROUPLIST 1
+
+/* define if prototype for getgrnam_r() is required */
+/* #undef NEED_GETGRNAM_R  */
+/* #undef NEED_GETGRGID_R  */
+/* #undef NEED_GETGRENT_R  */
+#define NEED_SETGRENT_R 1
+#define NEED_ENDGRENT_R 1
+
+#define NEED_INNETGR_R 1
+/* #undef NEED_SETNETGRENT_R */
+#define NEED_ENDNETGRENT_R 1
+
+/* #undef NEED_GETPWNAM_R */
+/* #undef NEED_GETPWUID_R */
+#define NEED_SETPWENT_R 1
+#define NEED_SETPASSENT_R 1
+#define NEED_SETPWENT_R 1
+/* #undef NEED_GETPWENT_R */
+#define NEED_ENDPWENT_R 1
+
+#define NEED_SETPASSENT 1
+
+/* #undef HAS_PW_CLASS */
+
+/* #undef ssize_t */
+/* #undef uintptr_t */
+
+/* Shut up warnings about sputaux in stdio.h on BSD/OS pre-4.1 */ 
+/* #undef SHUTUP_SPUTAUX */
+#ifdef SHUTUP_SPUTAUX
+struct __sFILE;
+extern __inline int __sputaux(int _c, struct __sFILE *_p);
+#endif
+#define BROKEN_IN6ADDR_INIT_MACROS 1
+#define HAVE_STRLCAT 1
+/* Shut up warnings about missing braces */
+/* #undef SHUTUP_MUTEX_INITIALIZER */
+#ifdef SHUTUP_MUTEX_INITIALIZER
+#define LIBBIND_MUTEX_INITIALIZER { PTHREAD_MUTEX_INITIALIZER }
+#else
+#define LIBBIND_MUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER
+#endif
+
diff --git a/usr/src/lib/libresolv2_joy/include/err.h b/usr/src/lib/libresolv2_joy/include/err.h
new file mode 100644
index 0000000000..45992ea336
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/err.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2001 by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+/*-
+ * Copyright (c) 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	@(#)err.h	8.1 (Berkeley) 6/2/93
+ */
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#ifndef _ERR_H_
+#define	_ERR_H_
+
+#include <sys/cdefs.h>
+#include <stdarg.h>
+
+__BEGIN_DECLS
+__dead void	err __P((int, const char *, ...)) __attribute__((__volatile));
+__dead void	verr __P((int, const char *, va_list))
+		    __attribute__((__volatile));
+__dead void	errx __P((int, const char *, ...)) __attribute__((__volatile));
+__dead void	verrx __P((int, const char *, va_list))
+		    __attribute__((__volatile));
+void		warn __P((const char *, ...));
+void		vwarn __P((const char *, va_list));
+void		warnx __P((const char *, ...));
+void		vwarnx __P((const char *, va_list));
+__END_DECLS
+
+#endif /* !_ERR_H_ */
diff --git a/usr/src/lib/libresolv2_joy/include/fd_setsize.h b/usr/src/lib/libresolv2_joy/include/fd_setsize.h
new file mode 100644
index 0000000000..0e21049742
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/fd_setsize.h
@@ -0,0 +1,10 @@
+#ifndef _FD_SETSIZE_H
+#define _FD_SETSIZE_H
+
+/*%
+ * If you need a bigger FD_SETSIZE, this is NOT the place to set it.
+ * This file is a fallback for BIND ports which don't specify their own.
+ */
+
+#endif /* _FD_SETSIZE_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/hesiod.h b/usr/src/lib/libresolv2_joy/include/hesiod.h
new file mode 100644
index 0000000000..d64c0c5e80
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/hesiod.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*! \file 
+ * \brief
+ * This file is primarily maintained by <tytso@mit.edu> and <ghudson@mit.edu>.
+ */
+
+/*
+ * $Id: hesiod.h,v 1.4 2005/04/27 04:56:14 sra Exp $
+ */
+
+#ifndef _HESIOD_H_INCLUDED
+#define _HESIOD_H_INCLUDED
+
+int		hesiod_init __P((void **));
+void		hesiod_end __P((void *));
+char *		hesiod_to_bind __P((void *, const char *, const char *));
+char **		hesiod_resolve __P((void *, const char *, const char *));
+void		hesiod_free_list __P((void *, char **));
+struct __res_state * __hesiod_res_get __P((void *));
+void		__hesiod_res_set __P((void *, struct __res_state *,
+				      void (*)(void *)));
+
+#endif /*_HESIOD_H_INCLUDED*/
diff --git a/usr/src/lib/libresolv2_joy/include/irp.h b/usr/src/lib/libresolv2_joy/include/irp.h
new file mode 100644
index 0000000000..1290bd068f
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/irp.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: irp.h,v 1.4 2005/04/27 04:56:15 sra Exp $
+ */
+
+#ifndef _IRP_H_INCLUDED
+#define _IRP_H_INCLUDED
+
+/*! \file */
+
+#define IRPD_TIMEOUT 30			/*%< seconds */
+#define IRPD_MAXSESS 50			/*%< number of simultaneous sessions. */
+#define IRPD_PORT 6660			/*%< 10 times the number of the beast. */
+#define IRPD_PATH "/var/run/irpd"	/*%< af_unix socket path */
+
+/* If sets the environment variable IRPDSERVER to an IP address
+   (e.g. "192.5.5.1"), then that's the host the client expects irpd to be
+   running on. */
+#define IRPD_HOST_ENV "IRPDSERVER"
+
+/* Protocol response codes.  */
+#define IRPD_WELCOME_CODE 200
+#define IRPD_NOT_WELCOME_CODE 500
+
+#define IRPD_GETHOST_ERROR 510
+#define IRPD_GETHOST_NONE 210
+#define IRPD_GETHOST_OK 211
+#define IRPD_GETHOST_SETOK 212
+
+#define IRPD_GETNET_ERROR 520
+#define IRPD_GETNET_NONE 220
+#define IRPD_GETNET_OK 221
+#define IRPD_GETNET_SETOK 222
+
+#define IRPD_GETUSER_ERROR 530
+#define IRPD_GETUSER_NONE 230
+#define IRPD_GETUSER_OK 231
+#define IRPD_GETUSER_SETOK 232
+
+#define IRPD_GETGROUP_ERROR 540
+#define IRPD_GETGROUP_NONE 240
+#define IRPD_GETGROUP_OK 241
+#define IRPD_GETGROUP_SETOK 242
+
+#define IRPD_GETSERVICE_ERROR 550
+#define IRPD_GETSERVICE_NONE 250
+#define IRPD_GETSERVICE_OK 251
+#define IRPD_GETSERVICE_SETOK 252
+
+#define IRPD_GETPROTO_ERROR 560
+#define IRPD_GETPROTO_NONE 260
+#define IRPD_GETPROTO_OK 261
+#define IRPD_GETPROTO_SETOK 262
+
+#define IRPD_GETNETGR_ERROR 570
+#define IRPD_GETNETGR_NONE 270
+#define IRPD_GETNETGR_OK 271
+#define IRPD_GETNETGR_NOMORE 272
+#define IRPD_GETNETGR_MATCHES 273
+#define IRPD_GETNETGR_NOMATCH 274
+#define IRPD_GETNETGR_SETOK 275
+#define IRPD_GETNETGR_SETERR 276
+
+#define	irs_irp_read_body __irs_irp_read_body
+#define irs_irp_read_response __irs_irp_read_response
+#define irs_irp_disconnect __irs_irp_disconnect
+#define irs_irp_connect __irs_irp_connect
+#define irs_irp_connection_setup __irs_irp_connection_setup
+#define irs_irp_send_command __irs_irp_send_command
+
+struct irp_p;
+
+char   *irs_irp_read_body(struct irp_p *, size_t *);
+int	irs_irp_read_response(struct irp_p *, char *, size_t);
+void	irs_irp_disconnect(struct irp_p *);
+int	irs_irp_connect(struct irp_p *);
+int	irs_irp_is_connected(struct irp_p *);
+int	irs_irp_connection_setup(struct irp_p *, int *);
+#ifdef __GNUC__
+int	irs_irp_send_command(struct irp_p *, const char *, ...)
+			     __attribute__((__format__(__printf__, 2, 3)));
+#else
+int	irs_irp_send_command(struct irp_p *, const char *, ...);
+#endif
+int	irs_irp_get_full_response(struct irp_p *, int *, char *, size_t,
+				  char **, size_t *);
+int	irs_irp_read_line(struct irp_p *, char *, int);
+
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/irs.h b/usr/src/lib/libresolv2_joy/include/irs.h
new file mode 100644
index 0000000000..386e3cb3f6
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/irs.h
@@ -0,0 +1,348 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: irs.h,v 1.5 2005/04/27 04:56:15 sra Exp $
+ */
+
+#ifndef _IRS_H_INCLUDED
+#define _IRS_H_INCLUDED
+
+/*! \file */
+
+#include <sys/types.h>
+
+#include <arpa/nameser.h>
+
+#include <grp.h>
+#include <netdb.h>
+#include <resolv_joy.h>
+#include <pwd.h>
+
+/*%
+ * This is the group map class.
+ */
+struct irs_gr {
+	void *		private;
+	void		(*close) __P((struct irs_gr *));
+	struct group *	(*next) __P((struct irs_gr *));
+	struct group *	(*byname) __P((struct irs_gr *, const char *));
+	struct group *	(*bygid) __P((struct irs_gr *, gid_t));
+	int		(*list) __P((struct irs_gr *, const char *,
+				     gid_t, gid_t *, int *));
+	void		(*rewind) __P((struct irs_gr *));
+	void		(*minimize) __P((struct irs_gr *));
+	struct __res_state * (*res_get) __P((struct irs_gr *));
+	void		(*res_set) __P((struct irs_gr *, res_state,
+					void (*)(void *)));
+};
+
+/*%
+ * This is the password map class.
+ */
+struct irs_pw {
+	void *		private;
+	void		(*close) __P((struct irs_pw *));
+	struct passwd *	(*next) __P((struct irs_pw *));
+	struct passwd *	(*byname) __P((struct irs_pw *, const char *));
+	struct passwd *	(*byuid) __P((struct irs_pw *, uid_t));
+	void		(*rewind) __P((struct irs_pw *));
+	void		(*minimize) __P((struct irs_pw *));
+	struct __res_state * (*res_get) __P((struct irs_pw *));
+	void		(*res_set) __P((struct irs_pw *, res_state,
+					void (*)(void *)));
+};
+
+/*%
+ * This is the service map class.
+ */
+struct irs_sv {
+	void *		private;
+	void		(*close) __P((struct irs_sv *));
+	struct servent *(*byname) __P((struct irs_sv *,
+				       const char *, const char *));
+	struct servent *(*byport) __P((struct irs_sv *, int, const char *));
+	struct servent *(*next) __P((struct irs_sv *));
+	void		(*rewind) __P((struct irs_sv *));
+	void		(*minimize) __P((struct irs_sv *));
+	struct __res_state * (*res_get) __P((struct irs_sv *));
+	void		(*res_set) __P((struct irs_sv *, res_state,
+					void (*)(void *)));
+};
+
+/*%
+ * This is the protocols map class.
+ */
+struct irs_pr {
+	void *		private;
+	void		(*close) __P((struct irs_pr *));
+	struct protoent	*(*byname) __P((struct irs_pr *, const char *));
+	struct protoent	*(*bynumber) __P((struct irs_pr *, int));
+	struct protoent	*(*next) __P((struct irs_pr *));
+	void		(*rewind) __P((struct irs_pr *));
+	void		(*minimize) __P((struct irs_pr *));
+	struct __res_state * (*res_get) __P((struct irs_pr *));
+	void		(*res_set) __P((struct irs_pr *, res_state,
+					void (*)(void *)));
+};
+
+/*%
+ * This is the hosts map class.
+ */
+struct irs_ho {
+	void *		private;
+	void		(*close) __P((struct irs_ho *));
+	struct hostent *(*byname) __P((struct irs_ho *, const char *));
+	struct hostent *(*byname2) __P((struct irs_ho *, const char *, int));
+	struct hostent *(*byaddr) __P((struct irs_ho *,
+				       const void *, int, int));
+	struct hostent *(*next) __P((struct irs_ho *));
+	void		(*rewind) __P((struct irs_ho *));
+	void		(*minimize) __P((struct irs_ho *));
+	struct __res_state * (*res_get) __P((struct irs_ho *));
+	void		(*res_set) __P((struct irs_ho *, res_state,
+					void (*)(void *)));
+	struct addrinfo *(*addrinfo) __P((struct irs_ho *, const char *,
+					  const struct addrinfo *));
+};
+
+/*%
+ * This is the networks map class.
+ */
+struct irs_nw {
+	void *		private;
+	void		(*close) __P((struct irs_nw *));
+	struct nwent *	(*byname) __P((struct irs_nw *, const char *, int));
+	struct nwent *	(*byaddr) __P((struct irs_nw *, void *, int, int));
+	struct nwent *	(*next) __P((struct irs_nw *));
+	void		(*rewind) __P((struct irs_nw *));
+	void		(*minimize) __P((struct irs_nw *));
+	struct __res_state * (*res_get) __P((struct irs_nw *));
+	void		(*res_set) __P((struct irs_nw *, res_state,
+					void (*)(void *)));
+};
+
+/*%
+ * This is the netgroups map class.
+ */
+struct irs_ng {
+	void *		private;
+	void		(*close) __P((struct irs_ng *));
+	int		(*next) __P((struct irs_ng *, const char **,
+				     const char **, const char **));
+	int		(*test) __P((struct irs_ng *, const char *,
+				     const char *, const char *,
+				     const char *));
+	void		(*rewind) __P((struct irs_ng *, const char *));
+	void		(*minimize) __P((struct irs_ng *));
+};
+
+/*%
+ * This is the generic map class, which copies the front of all others.
+ */
+struct irs_map {
+	void *		private;
+	void		(*close) __P((void *));
+};
+
+/*%
+ * This is the accessor class.  It contains pointers to all of the
+ * initializers for the map classes for a particular accessor.
+ */
+struct irs_acc {
+	void *		private;
+	void		(*close) __P((struct irs_acc *));
+	struct irs_gr *	(*gr_map) __P((struct irs_acc *));
+	struct irs_pw *	(*pw_map) __P((struct irs_acc *));
+	struct irs_sv *	(*sv_map) __P((struct irs_acc *));
+	struct irs_pr *	(*pr_map) __P((struct irs_acc *));
+	struct irs_ho *	(*ho_map) __P((struct irs_acc *));
+	struct irs_nw *	(*nw_map) __P((struct irs_acc *));
+	struct irs_ng *	(*ng_map) __P((struct irs_acc *));
+	struct __res_state * (*res_get) __P((struct irs_acc *));
+	void		(*res_set) __P((struct irs_acc *, res_state,
+					void (*)(void *)));
+};
+
+/*%
+ * This is because the official definition of "struct netent" has no
+ * concept of CIDR even though it allows variant address families (on
+ * output but not input).  The compatibility stubs convert the structs
+ * below into "struct netent"'s.
+ */
+struct nwent {
+	char		*n_name;	/*%< official name of net */
+	char		**n_aliases;	/*%< alias list */
+	int		n_addrtype;	/*%< net address type */
+	void		*n_addr;	/*%< network address */
+	int		n_length;	/*%< address length, in bits */
+};
+
+/*%
+ * Hide external function names from POSIX.
+ */
+#define	irs_gen_acc	__irs_gen_acc
+#define	irs_lcl_acc	__irs_lcl_acc
+#define	irs_dns_acc	__irs_dns_acc
+#define	irs_nis_acc	__irs_nis_acc
+#define	irs_irp_acc	__irs_irp_acc
+#define	irs_destroy	__irs_destroy
+#define	irs_dns_gr	__irs_dns_gr
+#define	irs_dns_ho	__irs_dns_ho
+#define	irs_dns_nw	__irs_dns_nw
+#define	irs_dns_pr	__irs_dns_pr
+#define	irs_dns_pw	__irs_dns_pw
+#define	irs_dns_sv	__irs_dns_sv
+#define	irs_gen_gr	__irs_gen_gr
+#define	irs_gen_ho	__irs_gen_ho
+#define	irs_gen_ng	__irs_gen_ng
+#define	irs_gen_nw	__irs_gen_nw
+#define	irs_gen_pr	__irs_gen_pr
+#define	irs_gen_pw	__irs_gen_pw
+#define	irs_gen_sv	__irs_gen_sv
+#define	irs_irp_get_full_response	__irs_irp_get_full_response
+#define	irs_irp_gr	__irs_irp_gr
+#define	irs_irp_ho	__irs_irp_ho
+#define	irs_irp_is_connected	__irs_irp_is_connected
+#define	irs_irp_ng	__irs_irp_ng
+#define	irs_irp_nw	__irs_irp_nw
+#define	irs_irp_pr	__irs_irp_pr
+#define	irs_irp_pw	__irs_irp_pw
+#define	irs_irp_read_line	__irs_irp_read_line
+#define	irs_irp_sv	__irs_irp_sv
+#define	irs_lcl_gr	__irs_lcl_gr
+#define	irs_lcl_ho	__irs_lcl_ho
+#define	irs_lcl_ng	__irs_lcl_ng
+#define	irs_lcl_nw	__irs_lcl_nw
+#define	irs_lcl_pr	__irs_lcl_pr
+#define	irs_lcl_pw	__irs_lcl_pw
+#define	irs_lcl_sv	__irs_lcl_sv
+#define	irs_nis_gr	__irs_nis_gr
+#define	irs_nis_ho	__irs_nis_ho
+#define	irs_nis_ng	__irs_nis_ng
+#define	irs_nis_nw	__irs_nis_nw
+#define	irs_nis_pr	__irs_nis_pr
+#define	irs_nis_pw	__irs_nis_pw
+#define	irs_nis_sv	__irs_nis_sv
+#define	net_data_create	__net_data_create
+#define	net_data_destroy	__net_data_destroy
+#define	net_data_minimize	__net_data_minimize
+
+/*%
+ * Externs.
+ */
+extern struct irs_acc *	irs_gen_acc __P((const char *, const char *));
+extern struct irs_acc *	irs_lcl_acc __P((const char *));
+extern struct irs_acc *	irs_dns_acc __P((const char *));
+extern struct irs_acc *	irs_nis_acc __P((const char *));
+extern struct irs_acc *	irs_irp_acc __P((const char *));
+
+extern void		irs_destroy __P((void));
+
+/*%
+ * These forward declarations are for the semi-private functions in
+ * the get*.c files. Each of these funcs implements the real get*
+ * functionality and the standard versions are just wrappers that
+ * call these. Apart from the wrappers, only irpd is expected to
+ * call these directly, hence these decls are put here and not in
+ * the /usr/include replacements.
+ */
+
+struct net_data;			/*%< forward */
+/*
+ * net_data_create gets a singleton net_data object.  net_data_init
+ * creates as many net_data objects as times it is called.  Clients using
+ * the default interface will use net_data_create by default.  Servers will
+ * probably want net_data_init (one call per client)
+ */
+struct net_data *net_data_create __P((const char *));
+struct net_data *net_data_init __P((const char *));
+void		net_data_destroy __P((void *));
+	
+extern struct group    *getgrent_p __P((struct net_data *));
+extern struct group    *getgrnam_p __P((const char *, struct net_data *));
+extern struct group    *getgrgid_p __P((gid_t, struct net_data *));
+extern int 		setgroupent_p __P((int, struct net_data *));
+extern void 		endgrent_p __P((struct net_data *));
+extern int		getgrouplist_p __P((const char *, gid_t, gid_t *, int *,
+					    struct net_data *));
+
+#ifdef SETGRENT_VOID
+extern void 		setgrent_p __P((struct net_data *));
+#else
+extern int 		setgrent_p __P((struct net_data *));
+#endif
+
+extern struct hostent 	*gethostbyname_p __P((const char *,
+					      struct net_data *));
+extern struct hostent 	*gethostbyname2_p __P((const char *, int,
+					       struct net_data *));
+extern struct hostent 	*gethostbyaddr_p __P((const char *, int, int,
+					      struct net_data *));
+extern struct hostent 	*gethostent_p __P((struct net_data *));
+extern void 		sethostent_p __P((int, struct net_data *));
+extern void 		endhostent_p __P((struct net_data *));
+extern struct hostent 	*getipnodebyname_p __P((const char *, int, int, int *,
+					       struct net_data *));
+extern struct hostent 	*getipnodebyaddr_p __P((const void *, size_t,
+					      int, int *, struct net_data *));
+
+extern struct netent 	*getnetent_p __P((struct net_data *));
+extern struct netent 	*getnetbyname_p __P((const char *, struct net_data *));
+extern struct netent 	*getnetbyaddr_p __P((unsigned long, int,
+					     struct net_data *));
+extern void		setnetent_p __P((int, struct net_data *));
+extern void		endnetent_p __P((struct net_data *));
+
+extern void		setnetgrent_p __P((const char *, struct net_data *));
+extern void		endnetgrent_p __P((struct net_data *));
+extern int		innetgr_p __P((const char *, const char *, const char *,
+				       const char *, struct net_data *));
+extern int		getnetgrent_p __P((const char **, const char **,
+					   const char **, struct net_data *));
+
+extern struct protoent  *getprotoent_p __P((struct net_data *));
+extern struct protoent  *getprotobyname_p __P((const char *,
+					       struct net_data *));
+extern struct protoent	*getprotobynumber_p __P((int, struct net_data *));
+extern void		setprotoent_p __P((int, struct net_data *));
+extern void		endprotoent_p __P((struct net_data *));
+
+
+extern struct passwd 	*getpwent_p __P((struct net_data *));
+extern struct passwd 	*getpwnam_p __P((const char *, struct net_data *));
+extern struct passwd 	*getpwuid_p __P((uid_t, struct net_data *));
+extern int		setpassent_p __P((int, struct net_data *));
+extern void		endpwent_p __P((struct net_data *));
+
+#ifdef SETPWENT_VOID
+extern void		setpwent_p __P((struct net_data *));
+#else
+extern int		setpwent_p __P((struct net_data *));
+#endif
+
+extern struct servent 	*getservent_p __P((struct net_data *));
+extern struct servent 	*getservbyname_p __P((const char *, const char *,
+					      struct net_data *));
+extern struct servent 	*getservbyport_p __P((int, const char *,
+					      struct net_data *));
+extern void		setservent_p __P((int, struct net_data *));
+extern void		endservent_p __P((struct net_data *));
+
+#endif /*_IRS_H_INCLUDED*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/assertions.h b/usr/src/lib/libresolv2_joy/include/isc/assertions.h
new file mode 100644
index 0000000000..68925e73b3
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/assertions.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1997-2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: assertions.h,v 1.5 2008/11/14 02:36:51 marka Exp $
+ */
+
+#ifndef ASSERTIONS_H
+#define ASSERTIONS_H		1
+
+typedef enum {
+	assert_require, assert_ensure, assert_insist, assert_invariant
+} assertion_type;
+
+typedef void (*assertion_failure_callback)(const char *, int, assertion_type,
+					   const char *, int);
+
+/* coverity[+kill] */
+extern assertion_failure_callback __assertion_failed;
+void set_assertion_failure_callback(assertion_failure_callback f);
+const char *assertion_type_to_text(assertion_type type);
+
+#if defined(CHECK_ALL) || defined(__COVERITY__)
+#define CHECK_REQUIRE		1
+#define CHECK_ENSURE		1
+#define CHECK_INSIST		1
+#define CHECK_INVARIANT		1
+#endif
+
+#if defined(CHECK_NONE) && !defined(__COVERITY__)
+#define CHECK_REQUIRE		0
+#define CHECK_ENSURE		0
+#define CHECK_INSIST		0
+#define CHECK_INVARIANT		0
+#endif
+
+#ifndef CHECK_REQUIRE
+#define CHECK_REQUIRE		1
+#endif
+
+#ifndef CHECK_ENSURE
+#define CHECK_ENSURE		1
+#endif
+
+#ifndef CHECK_INSIST
+#define CHECK_INSIST		1
+#endif
+
+#ifndef CHECK_INVARIANT
+#define CHECK_INVARIANT		1
+#endif
+
+#if CHECK_REQUIRE != 0
+#define REQUIRE(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_require, \
+				       #cond, 0), 0)))
+#define REQUIRE_ERR(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_require, \
+				       #cond, 1), 0)))
+#else
+#define REQUIRE(cond)		((void) (cond))
+#define REQUIRE_ERR(cond)	((void) (cond))
+#endif /* CHECK_REQUIRE */
+
+#if CHECK_ENSURE != 0
+#define ENSURE(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_ensure, \
+				       #cond, 0), 0)))
+#define ENSURE_ERR(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_ensure, \
+				       #cond, 1), 0)))
+#else
+#define ENSURE(cond)		((void) (cond))
+#define ENSURE_ERR(cond)	((void) (cond))
+#endif /* CHECK_ENSURE */
+
+#if CHECK_INSIST != 0
+#define INSIST(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_insist, \
+				       #cond, 0), 0)))
+#define INSIST_ERR(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_insist, \
+				       #cond, 1), 0)))
+#else
+#define INSIST(cond)		((void) (cond))
+#define INSIST_ERR(cond)	((void) (cond))
+#endif /* CHECK_INSIST */
+
+#if CHECK_INVARIANT != 0
+#define INVARIANT(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_invariant, \
+				       #cond, 0), 0)))
+#define INVARIANT_ERR(cond) \
+	((void) ((cond) || \
+		 ((__assertion_failed)(__FILE__, __LINE__, assert_invariant, \
+				       #cond, 1), 0)))
+#else
+#define INVARIANT(cond)		((void) (cond))
+#define INVARIANT_ERR(cond)	((void) (cond))
+#endif /* CHECK_INVARIANT */
+#endif /* ASSERTIONS_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/ctl.h b/usr/src/lib/libresolv2_joy/include/isc/ctl.h
new file mode 100644
index 0000000000..e2ba20201d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/ctl.h
@@ -0,0 +1,112 @@
+#ifndef ISC_CTL_H
+#define ISC_CTL_H
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1998,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: ctl.h,v 1.5 2005/04/27 04:56:17 sra Exp $
+ */
+
+/*! \file */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <isc/eventlib.h>
+
+/* Macros. */
+
+#define	CTL_MORE	0x0001	/*%< More will be / should be sent. */
+#define	CTL_EXIT	0x0002	/*%< Close connection after this. */
+#define	CTL_DATA	0x0004	/*%< Go into / this is DATA mode. */
+/* Types. */
+
+struct ctl_cctx;
+struct ctl_sctx;
+struct ctl_sess;
+struct ctl_verb;
+
+enum ctl_severity { ctl_debug, ctl_warning, ctl_error };
+
+typedef void (*ctl_logfunc)(enum ctl_severity, const char *, ...);
+
+typedef void (*ctl_verbfunc)(struct ctl_sctx *, struct ctl_sess *,
+			     const struct ctl_verb *, const char *,
+			     u_int, const void *, void *);
+
+typedef void (*ctl_srvrdone)(struct ctl_sctx *, struct ctl_sess *, void *);
+
+typedef void (*ctl_clntdone)(struct ctl_cctx *, void *, const char *, u_int);
+
+struct ctl_verb {
+	const char *	name;
+	ctl_verbfunc	func;
+	const char *	help;
+};
+
+/* General symbols. */
+
+#define	ctl_logger	__ctl_logger
+
+#ifdef __GNUC__
+void			ctl_logger(enum ctl_severity, const char *, ...)
+				__attribute__((__format__(__printf__, 2, 3)));
+#else
+void			ctl_logger(enum ctl_severity, const char *, ...);
+#endif
+
+/* Client symbols. */
+
+#define	ctl_client	__ctl_client
+#define	ctl_endclient	__ctl_endclient
+#define	ctl_command	__ctl_command
+
+struct ctl_cctx *	ctl_client(evContext, const struct sockaddr *, size_t,
+				   const struct sockaddr *, size_t,
+				   ctl_clntdone, void *,
+				   u_int, ctl_logfunc);
+void			ctl_endclient(struct ctl_cctx *);
+int			ctl_command(struct ctl_cctx *, const char *, size_t,
+				    ctl_clntdone, void *);
+
+/* Server symbols. */
+
+#define	ctl_server	__ctl_server
+#define	ctl_endserver	__ctl_endserver
+#define	ctl_response	__ctl_response
+#define	ctl_sendhelp	__ctl_sendhelp
+#define ctl_getcsctx	__ctl_getcsctx
+#define ctl_setcsctx	__ctl_setcsctx
+
+struct ctl_sctx *	ctl_server(evContext, const struct sockaddr *, size_t,
+				   const struct ctl_verb *,
+				   u_int, u_int,
+				   u_int, int, int,
+				   ctl_logfunc, void *);
+void			ctl_endserver(struct ctl_sctx *);
+void			ctl_response(struct ctl_sess *, u_int,
+				     const char *, u_int, const void *,
+				     ctl_srvrdone, void *,
+				     const char *, size_t);
+void			ctl_sendhelp(struct ctl_sess *, u_int);
+void *			ctl_getcsctx(struct ctl_sess *);
+void *			ctl_setcsctx(struct ctl_sess *, void *);
+
+#endif /*ISC_CTL_H*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/dst.h b/usr/src/lib/libresolv2_joy/include/isc/dst.h
new file mode 100644
index 0000000000..90a9e67468
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/dst.h
@@ -0,0 +1,168 @@
+#ifndef DST_H
+#define DST_H
+
+#ifndef HAS_DST_KEY
+typedef struct dst_key {
+	char	*dk_key_name;   /*%< name of the key */
+	int	dk_key_size;    /*%< this is the size of the key in bits */
+	int	dk_proto;       /*%< what protocols this key can be used for */
+	int	dk_alg;         /*%< algorithm number from key record */
+	u_int32_t dk_flags;     /*%< and the flags of the public key */
+	u_int16_t dk_id;        /*%< identifier of the key */
+} DST_KEY;
+#endif /* HAS_DST_KEY */
+/*
+ * do not taint namespace
+ */
+#define	dst_bsafe_init		__dst_bsafe_init
+#define	dst_buffer_to_key	__dst_buffer_to_key
+#define	dst_check_algorithm	__dst_check_algorithm
+#define	dst_compare_keys	__dst_compare_keys
+#define	dst_cylink_init		__dst_cylink_init
+#define	dst_dnskey_to_key	__dst_dnskey_to_key
+#define	dst_eay_dss_init	__dst_eay_dss_init
+#define	dst_free_key		__dst_free_key
+#define	dst_generate_key	__dst_generate_key
+#define	dst_hmac_md5_init	__dst_hmac_md5_init
+#define	dst_init		__dst_init
+#define	dst_key_to_buffer	__dst_key_to_buffer
+#define	dst_key_to_dnskey	__dst_key_to_dnskey
+#define	dst_read_key		__dst_read_key
+#define	dst_rsaref_init		__dst_rsaref_init
+#define	dst_s_build_filename	__dst_s_build_filename
+#define	dst_s_calculate_bits	__dst_s_calculate_bits
+#define	dst_s_conv_bignum_b64_to_u8	__dst_s_conv_bignum_b64_to_u8
+#define	dst_s_conv_bignum_u8_to_b64	__dst_s_conv_bignum_u8_to_b64
+#define	dst_s_dns_key_id	__dst_s_dns_key_id
+#define	dst_s_dump		__dst_s_dump
+#define	dst_s_filename_length	__dst_s_filename_length
+#define	dst_s_fopen		__dst_s_fopen
+#define	dst_s_get_int16		__dst_s_get_int16
+#define	dst_s_get_int32		__dst_s_get_int32
+#define	dst_s_id_calc		__dst_s_id_calc
+#define	dst_s_put_int16		__dst_s_put_int16
+#define	dst_s_put_int32		__dst_s_put_int32
+#define	dst_s_quick_random	__dst_s_quick_random
+#define	dst_s_quick_random_set	__dst_s_quick_random_set
+#define	dst_s_random		__dst_s_random
+#define	dst_s_semi_random	__dst_s_semi_random
+#define	dst_s_verify_str	__dst_s_verify_str
+#define	dst_sig_size		__dst_sig_size
+#define	dst_sign_data		__dst_sign_data
+#define	dst_verify_data		__dst_verify_data
+#define	dst_write_key		__dst_write_key
+
+/* 
+ * DST Crypto API defintions 
+ */
+void     dst_init(void);
+int      dst_check_algorithm(const int);
+
+
+int dst_sign_data(const int,	 	/*!<   specifies INIT/UPDATE/FINAL/ALL  */
+		  DST_KEY *,	 	/*!<   the key to use  */
+		  void **,	 	/*!<   pointer to state structure  */
+		  const u_char *,	/*!<   data to be signed  */
+		  const int,	 	/*!<   length of input data  */
+		  u_char *,	 	/*!<   buffer to write signature to  */
+		  const int);	 	/*!<   size of output buffer  */
+int dst_verify_data(const int,	 	/*!<   specifies INIT/UPDATE/FINAL/ALL  */
+		    DST_KEY *,	 	/*!<   the key to use  */
+		    void **,	 	/*!<   pointer to state structure  */
+		    const u_char *,	/*!<   data to be verified  */
+		    const int,	 	/*!<   length of input data  */
+		    const u_char *,	/*!<   buffer containing signature  */
+		    const int);	 	/*!<   length of signature  */
+DST_KEY *dst_read_key(const char *,	/*!<   name of key  */
+		      const u_int16_t,	/*!<   key tag identifier  */
+		      const int,	/*!<   key algorithm  */
+		      const int);	/*!<   Private/PublicKey wanted */
+int      dst_write_key(const DST_KEY *,	/*!<   key to write out  */
+		       const int); 	/*!<   Public/Private  */
+DST_KEY *dst_dnskey_to_key(const char *,	/*!<   KEY record name  */
+			   const u_char *,	/*!<   KEY RDATA  */
+			   const int);		/*!<   size of input buffer */
+int      dst_key_to_dnskey(const DST_KEY *,	/*!<   key to translate  */
+			   u_char *,		/*!<   output buffer  */
+			   const int);		/*!<   size of out_storage */
+DST_KEY *dst_buffer_to_key(const char *,  	/*!<   name of the key  */
+			   const int,	  	/*!<   algorithm  */
+			   const int,	  	/*!<   dns flags  */
+			   const int,	  	/*!<   dns protocol  */
+			   const u_char *, 	/*!<   key in dns wire fmt  */
+			   const int);	  	/*!<   size of key  */
+int     dst_key_to_buffer(DST_KEY *, u_char *, int);
+
+DST_KEY *dst_generate_key(const char *,    	/*!<   name of new key  */
+			  const int,       	/*!<   key algorithm to generate  */
+			  const int,      	/*!<   size of new key  */
+			  const int,       	/*!<   alg dependent parameter */
+			  const int,     	/*!<   key DNS flags  */
+			  const int);		/*!<   key DNS protocol  */
+DST_KEY *dst_free_key(DST_KEY *);
+int      dst_compare_keys(const DST_KEY *, const DST_KEY *);
+
+int	dst_sig_size(DST_KEY *);
+
+
+/* support for dns key tags/ids */
+u_int16_t dst_s_dns_key_id(const u_char *, const int);
+u_int16_t dst_s_id_calc(const u_char *, const int);
+
+/* Used by callers as well as by the library.  */
+#define RAW_KEY_SIZE    8192        /*%< large enough to store any key */
+/* DST_API control flags */
+/* These are used used in functions dst_sign_data and dst_verify_data */
+#define SIG_MODE_INIT		1  /*%< initialize digest */
+#define SIG_MODE_UPDATE		2  /*%< add data to digest */
+#define SIG_MODE_FINAL		4  /*%< generate/verify signature */
+#define SIG_MODE_ALL		(SIG_MODE_INIT|SIG_MODE_UPDATE|SIG_MODE_FINAL)
+
+/* Flags for dst_read_private_key()  */
+#define DST_FORCE_READ		0x1000000
+#define DST_CAN_SIGN		0x010F
+#define DST_NO_AUTHEN		0x8000
+#define DST_EXTEND_FLAG         0x1000
+#define DST_STANDARD		0
+#define DST_PRIVATE             0x2000000
+#define DST_PUBLIC              0x4000000
+#define DST_RAND_SEMI           1
+#define DST_RAND_STD            2
+#define DST_RAND_KEY            3
+#define DST_RAND_DSS            4
+
+
+/* DST algorithm codes */
+#define KEY_RSA			1
+#define KEY_DH			2
+#define KEY_DSA			3
+#define KEY_PRIVATE		254
+#define KEY_EXPAND		255
+#define KEY_HMAC_MD5		157
+#define KEY_HMAC_SHA1		158
+#define UNKNOWN_KEYALG		0
+#define DST_MAX_ALGS            KEY_HMAC_SHA1
+
+/* DST constants to locations in KEY record  changes in new KEY record */
+#define DST_FLAGS_SIZE		2
+#define DST_KEY_PROT		2
+#define DST_KEY_ALG		3
+#define DST_EXT_FLAG            4
+#define DST_KEY_START		4
+
+#ifndef SIGN_F_NOKEY 
+#define SIGN_F_NOKEY		0xC000
+#endif
+
+/* error codes from dst routines */
+#define SIGN_INIT_FAILURE	(-23)
+#define SIGN_UPDATE_FAILURE	(-24)
+#define SIGN_FINAL_FAILURE	(-25)
+#define VERIFY_INIT_FAILURE	(-26)
+#define VERIFY_UPDATE_FAILURE	(-27)
+#define VERIFY_FINAL_FAILURE	(-28)
+#define MISSING_KEY_OR_SIGNATURE (-30)
+#define UNSUPPORTED_KEYALG	(-31)
+
+#endif /* DST_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/eventlib.h b/usr/src/lib/libresolv2_joy/include/isc/eventlib.h
new file mode 100644
index 0000000000..a4cfdf9092
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/eventlib.h
@@ -0,0 +1,206 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1995-1999, 2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* eventlib.h - exported interfaces for eventlib
+ * vix 09sep95 [initial]
+ *
+ * $Id: eventlib.h,v 1.7 2008/11/14 02:36:51 marka Exp $
+ */
+
+#ifndef _EVENTLIB_H
+#define _EVENTLIB_H
+
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <sys/time.h>
+#include <stdio.h>
+
+#include <isc/platform.h>
+
+#ifndef __P
+# define __EVENTLIB_P_DEFINED
+# ifdef __STDC__
+#  define __P(x) x
+# else
+#  define __P(x) ()
+# endif
+#endif
+
+/* In the absence of branded types... */
+typedef struct { void *opaque; } evConnID;
+typedef struct { void *opaque; } evFileID;
+typedef struct { void *opaque; } evStreamID;
+typedef struct { void *opaque; } evTimerID;
+typedef struct { void *opaque; } evWaitID;
+typedef struct { void *opaque; } evContext;
+typedef struct { void *opaque; } evEvent;
+
+#define	evInitID(id) ((id)->opaque = NULL)
+#define	evTestID(id) ((id).opaque != NULL)
+
+typedef void (*evConnFunc)__P((evContext, void *, int, const void *, int,
+			       const void *, int));
+typedef void (*evFileFunc)__P((evContext, void *, int, int));
+typedef	void (*evStreamFunc)__P((evContext, void *, int, int));
+typedef void (*evTimerFunc)__P((evContext, void *,
+				struct timespec, struct timespec));
+typedef	void (*evWaitFunc)__P((evContext, void *, const void *));
+
+typedef	struct { unsigned char mask[256/8]; } evByteMask;
+#define	EV_BYTEMASK_BYTE(b) ((b) / 8)
+#define	EV_BYTEMASK_MASK(b) (1 << ((b) % 8))
+#define	EV_BYTEMASK_SET(bm, b) \
+	((bm).mask[EV_BYTEMASK_BYTE(b)] |= EV_BYTEMASK_MASK(b))
+#define	EV_BYTEMASK_CLR(bm, b) \
+	((bm).mask[EV_BYTEMASK_BYTE(b)] &= ~EV_BYTEMASK_MASK(b))
+#define	EV_BYTEMASK_TST(bm, b) \
+	((bm).mask[EV_BYTEMASK_BYTE(b)] & EV_BYTEMASK_MASK(b))
+
+#define	EV_POLL		1
+#define	EV_WAIT		2
+#define	EV_NULL		4
+
+#define	EV_READ		1
+#define	EV_WRITE	2
+#define	EV_EXCEPT	4
+
+#define EV_WASNONBLOCKING 8	/* Internal library use. */
+
+/* eventlib.c */
+#define evCreate	__evCreate
+#define evSetDebug	__evSetDebug
+#define evDestroy	__evDestroy
+#define evGetNext	__evGetNext
+#define evDispatch	__evDispatch
+#define evDrop		__evDrop
+#define evMainLoop	__evMainLoop
+#define evHighestFD	__evHighestFD
+#define evGetOption	__evGetOption
+#define evSetOption	__evSetOption
+
+int  evCreate __P((evContext *));
+void evSetDebug __P((evContext, int, FILE *));
+int  evDestroy __P((evContext));
+int  evGetNext __P((evContext, evEvent *, int));
+int  evDispatch __P((evContext, evEvent));
+void evDrop __P((evContext, evEvent));
+int  evMainLoop __P((evContext));
+int  evHighestFD __P((evContext));
+int  evGetOption __P((evContext *, const char *, int *));
+int  evSetOption __P((evContext *, const char *, int));
+
+/* ev_connects.c */
+#define evListen	__evListen
+#define evConnect	__evConnect
+#define evCancelConn	__evCancelConn
+#define evHold		__evHold
+#define evUnhold	__evUnhold
+#define evTryAccept	__evTryAccept
+
+int evListen __P((evContext, int, int, evConnFunc, void *, evConnID *));
+int evConnect __P((evContext, int, const void *, int,
+		   evConnFunc, void *, evConnID *));
+int evCancelConn __P((evContext, evConnID));
+int evHold __P((evContext, evConnID));
+int evUnhold __P((evContext, evConnID));
+int evTryAccept __P((evContext, evConnID, int *));
+
+/* ev_files.c */
+#define evSelectFD	__evSelectFD
+#define evDeselectFD	__evDeselectFD
+
+int evSelectFD __P((evContext, int, int, evFileFunc, void *, evFileID *));
+int evDeselectFD __P((evContext, evFileID));
+
+/* ev_streams.c */
+#define evConsIovec	__evConsIovec
+#define evWrite		__evWrite
+#define evRead		__evRead
+#define evTimeRW	__evTimeRW
+#define evUntimeRW	__evUntimeRW
+#define	evCancelRW	__evCancelRW
+
+struct iovec evConsIovec __P((void *, size_t));
+int evWrite __P((evContext, int, const struct iovec *, int,
+		 evStreamFunc func, void *, evStreamID *));
+int evRead __P((evContext, int, const struct iovec *, int,
+		evStreamFunc func, void *, evStreamID *));
+int evTimeRW __P((evContext, evStreamID, evTimerID timer));
+int evUntimeRW __P((evContext, evStreamID));
+int evCancelRW __P((evContext, evStreamID));
+
+/* ev_timers.c */
+#define evConsTime	__evConsTime
+#define evAddTime	__evAddTime
+#define evSubTime	__evSubTime
+#define evCmpTime	__evCmpTime
+#define	evTimeSpec	__evTimeSpec
+#define	evTimeVal	__evTimeVal
+
+#define evNowTime		__evNowTime
+#define evUTCTime		__evUTCTime
+#define evLastEventTime		__evLastEventTime
+#define evSetTimer		__evSetTimer
+#define evClearTimer		__evClearTimer
+#define evConfigTimer		__evConfigTimer
+#define evResetTimer		__evResetTimer
+#define evSetIdleTimer		__evSetIdleTimer
+#define evClearIdleTimer	__evClearIdleTimer
+#define evResetIdleTimer	__evResetIdleTimer
+#define evTouchIdleTimer	__evTouchIdleTimer
+
+struct timespec evConsTime __P((time_t sec, long nsec));
+struct timespec evAddTime __P((struct timespec, struct timespec));
+struct timespec evSubTime __P((struct timespec, struct timespec));
+struct timespec evNowTime __P((void));
+struct timespec evUTCTime __P((void));
+struct timespec evLastEventTime __P((evContext));
+struct timespec evTimeSpec __P((struct timeval));
+struct timeval evTimeVal __P((struct timespec));
+int evCmpTime __P((struct timespec, struct timespec));
+int evSetTimer __P((evContext, evTimerFunc, void *, struct timespec,
+		    struct timespec, evTimerID *));
+int evClearTimer __P((evContext, evTimerID));
+int evConfigTimer __P((evContext, evTimerID, const char *param,
+		      int value));
+int evResetTimer __P((evContext, evTimerID, evTimerFunc, void *,
+		      struct timespec, struct timespec));
+int evSetIdleTimer __P((evContext, evTimerFunc, void *, struct timespec,
+			evTimerID *));
+int evClearIdleTimer __P((evContext, evTimerID));
+int evResetIdleTimer __P((evContext, evTimerID, evTimerFunc, void *,
+			  struct timespec));
+int evTouchIdleTimer __P((evContext, evTimerID));
+
+/* ev_waits.c */
+#define evWaitFor	__evWaitFor
+#define evDo		__evDo
+#define evUnwait	__evUnwait
+#define evDefer		__evDefer
+
+int evWaitFor __P((evContext, const void *, evWaitFunc, void *, evWaitID *));
+int evDo __P((evContext, const void *));
+int evUnwait __P((evContext, evWaitID));
+int evDefer __P((evContext, evWaitFunc, void *));
+
+#ifdef __EVENTLIB_P_DEFINED
+# undef __P
+#endif
+
+#endif /*_EVENTLIB_H*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/heap.h b/usr/src/lib/libresolv2_joy/include/isc/heap.h
new file mode 100644
index 0000000000..384d507cf5
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/heap.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1997,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+typedef int (*heap_higher_priority_func)(void *, void *);
+typedef void (*heap_index_func)(void *, int);
+typedef void (*heap_for_each_func)(void *, void *);
+
+typedef struct heap_context {
+	int array_size;
+	int array_size_increment;
+	int heap_size;
+	void **heap;
+	heap_higher_priority_func higher_priority;
+	heap_index_func index;
+} *heap_context;
+
+#define heap_new	__heap_new
+#define heap_free	__heap_free
+#define heap_insert	__heap_insert
+#define heap_delete	__heap_delete
+#define heap_increased	__heap_increased
+#define heap_decreased	__heap_decreased
+#define heap_element	__heap_element
+#define heap_for_each	__heap_for_each
+
+heap_context	heap_new(heap_higher_priority_func, heap_index_func, int);
+int		heap_free(heap_context);
+int		heap_insert(heap_context, void *);
+int		heap_delete(heap_context, int);
+int		heap_increased(heap_context, int);
+int		heap_decreased(heap_context, int);
+void *		heap_element(heap_context, int);
+int		heap_for_each(heap_context, heap_for_each_func, void *);
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/irpmarshall.h b/usr/src/lib/libresolv2_joy/include/isc/irpmarshall.h
new file mode 100644
index 0000000000..244b3e3460
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/irpmarshall.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: irpmarshall.h,v 1.4 2005/04/27 04:56:17 sra Exp $
+ */
+
+#ifndef _IRPMARSHALL_H_INCLUDED
+#define _IRPMARSHALL_H_INCLUDED
+
+/* Hide function names */
+#define irp_marshall_gr __irp_marshall_gr
+#define irp_marshall_ho __irp_marshall_ho
+#define irp_marshall_ne __irp_marshall_ne
+#define irp_marshall_ng __irp_marshall_ng
+#define irp_marshall_nw __irp_marshall_nw
+#define irp_marshall_pr __irp_marshall_pr
+#define irp_marshall_pw __irp_marshall_pw
+#define irp_marshall_sv __irp_marshall_sv
+#define irp_unmarshall_gr __irp_unmarshall_gr
+#define irp_unmarshall_ho __irp_unmarshall_ho
+#define irp_unmarshall_ne __irp_unmarshall_ne
+#define irp_unmarshall_ng __irp_unmarshall_ng
+#define irp_unmarshall_nw __irp_unmarshall_nw
+#define irp_unmarshall_pr __irp_unmarshall_pr
+#define irp_unmarshall_pw __irp_unmarshall_pw
+#define irp_unmarshall_sv __irp_unmarshall_sv
+
+#define MAXPADDRSIZE (sizeof "255.255.255.255" + 1)
+#define ADDR_T_STR(x) (x == AF_INET ? "AF_INET" :\
+		       (x == AF_INET6 ? "AF_INET6" : "UNKNOWN"))
+
+/* See comment below on usage */
+int irp_marshall_pw(const struct passwd *, char **, size_t *);
+int irp_unmarshall_pw(struct passwd *, char *);
+int irp_marshall_gr(const struct group *, char **, size_t *);
+int irp_unmarshall_gr(struct group *, char *);
+int irp_marshall_sv(const struct servent *, char **, size_t *);
+int irp_unmarshall_sv(struct servent *, char *);
+int irp_marshall_pr(struct protoent *, char **, size_t *);
+int irp_unmarshall_pr(struct protoent *, char *);
+int irp_marshall_ho(struct hostent *, char **, size_t *);
+int irp_unmarshall_ho(struct hostent *, char *);
+int irp_marshall_ng(const char *, const char *, const char *,
+		    char **, size_t *);
+int irp_unmarshall_ng(const char **, const char **, const char **, char *);
+int irp_marshall_nw(struct nwent *, char **, size_t *);
+int irp_unmarshall_nw(struct nwent *, char *);
+int irp_marshall_ne(struct netent *, char **, size_t *);
+int irp_unmarshall_ne(struct netent *, char *);
+
+/*! \file
+ * \brief
+ * Functions to marshall and unmarshall various system data structures. We
+ * use a printable ascii format that is as close to various system config
+ * files as reasonable (e.g. /etc/passwd format).
+ *
+ * We are not forgiving with unmarhsalling misformatted buffers. In
+ * particular whitespace in fields is not ignored. So a formatted password
+ * entry "brister  :1364:100:...." will yield a username of "brister   "
+ *
+ * We potentially do a lot of mallocs to fill fields that are of type
+ * (char **) like a hostent h_addr field. Building (for example) the
+ * h_addr field and its associated addresses all in one buffer is
+ * certainly possible, but not done here.
+ *
+ * The following description is true for all the marshalling functions:
+ *
+ * int irp_marshall_XX(struct yyyy *XX, char **buffer, size_t *len);
+ *
+ * The argument XX (of type struct passwd for example) is marshalled in the
+ * buffer pointed at by *BUFFER, which is of length *LEN. Returns 0
+ * on success and -1 on failure. Failure will occur if *LEN is
+ * smaller than needed.
+ *
+ * If BUFFER is NULL, then *LEN is set to the size of the buffer
+ * needed to marshall the data and no marshalling is actually done.
+ *
+ * If *BUFFER is NULL, then a buffer large enough will be allocated
+ * with memget() and the size allocated will be stored in *LEN. An extra 2
+ * bytes will be allocated for the client to append CRLF if wanted. The
+ * value of *LEN will include these two bytes.
+ *
+ * All the marshalling functions produce a buffer with the fields
+ * separated by colons (except for the hostent marshalling, which uses '@'
+ * to separate fields). Fields that have multiple subfields (like the
+ * gr_mem field in struct group) have their subparts separated by
+ * commas.
+ *
+ * int irp_unmarshall_XX(struct YYYYY *XX, char *buffer);
+ *
+ * The unmashalling functions break apart the buffer and store the
+ * values in the struct pointed to by XX. All pointer values inside
+ * XX are allocated with malloc. All arrays of pointers have a NULL
+ * as the last element.
+ */
+
+#endif
diff --git a/usr/src/lib/libresolv2_joy/include/isc/list.h b/usr/src/lib/libresolv2_joy/include/isc/list.h
new file mode 100644
index 0000000000..5fe9031141
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/list.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1997,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef LIST_H
+#define LIST_H 1
+#include <isc/assertions.h>
+
+#define LIST(type) struct { type *head, *tail; }
+#define INIT_LIST(list) \
+	do { (list).head = NULL; (list).tail = NULL; } while (0)
+
+#define LINK(type) struct { type *prev, *next; }
+#define INIT_LINK_TYPE(elt, link, type) \
+	do { \
+		(elt)->link.prev = (type *)(-1); \
+		(elt)->link.next = (type *)(-1); \
+	} while (0)
+#define INIT_LINK(elt, link) \
+	INIT_LINK_TYPE(elt, link, void)
+#define LINKED(elt, link) ((void *)((elt)->link.prev) != (void *)(-1) && \
+			   (void *)((elt)->link.next) != (void *)(-1))
+
+#define HEAD(list) ((list).head)
+#define TAIL(list) ((list).tail)
+#define EMPTY(list) ((list).head == NULL)
+
+#define PREPEND(list, elt, link) \
+	do { \
+		INSIST(!LINKED(elt, link));\
+		if ((list).head != NULL) \
+			(list).head->link.prev = (elt); \
+		else \
+			(list).tail = (elt); \
+		(elt)->link.prev = NULL; \
+		(elt)->link.next = (list).head; \
+		(list).head = (elt); \
+	} while (0)
+
+#define APPEND(list, elt, link) \
+	do { \
+		INSIST(!LINKED(elt, link));\
+		if ((list).tail != NULL) \
+			(list).tail->link.next = (elt); \
+		else \
+			(list).head = (elt); \
+		(elt)->link.prev = (list).tail; \
+		(elt)->link.next = NULL; \
+		(list).tail = (elt); \
+	} while (0)
+
+#define UNLINK_TYPE(list, elt, link, type) \
+	do { \
+		INSIST(LINKED(elt, link));\
+		if ((elt)->link.next != NULL) \
+			(elt)->link.next->link.prev = (elt)->link.prev; \
+		else { \
+			INSIST((list).tail == (elt)); \
+			(list).tail = (elt)->link.prev; \
+		} \
+		if ((elt)->link.prev != NULL) \
+			(elt)->link.prev->link.next = (elt)->link.next; \
+		else { \
+			INSIST((list).head == (elt)); \
+			(list).head = (elt)->link.next; \
+		} \
+		INIT_LINK_TYPE(elt, link, type); \
+	} while (0)
+#define UNLINK(list, elt, link) \
+	UNLINK_TYPE(list, elt, link, void)
+
+#define PREV(elt, link) ((elt)->link.prev)
+#define NEXT(elt, link) ((elt)->link.next)
+
+#define INSERT_BEFORE(list, before, elt, link) \
+	do { \
+		INSIST(!LINKED(elt, link));\
+		if ((before)->link.prev == NULL) \
+			PREPEND(list, elt, link); \
+		else { \
+			(elt)->link.prev = (before)->link.prev; \
+			(before)->link.prev = (elt); \
+			(elt)->link.prev->link.next = (elt); \
+			(elt)->link.next = (before); \
+		} \
+	} while (0)
+
+#define INSERT_AFTER(list, after, elt, link) \
+	do { \
+		INSIST(!LINKED(elt, link));\
+		if ((after)->link.next == NULL) \
+			APPEND(list, elt, link); \
+		else { \
+			(elt)->link.next = (after)->link.next; \
+			(after)->link.next = (elt); \
+			(elt)->link.next->link.prev = (elt); \
+			(elt)->link.prev = (after); \
+		} \
+	} while (0)
+
+#define ENQUEUE(list, elt, link) APPEND(list, elt, link)
+#define DEQUEUE(list, elt, link) UNLINK(list, elt, link)
+
+#endif /* LIST_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/logging.h b/usr/src/lib/libresolv2_joy/include/isc/logging.h
new file mode 100644
index 0000000000..c539443ff8
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/logging.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef LOGGING_H
+#define LOGGING_H
+
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <unistd.h>
+
+#define log_critical		(-5)
+#define log_error   		(-4)
+#define log_warning 		(-3)
+#define log_notice  		(-2)
+#define log_info  		(-1)
+#define log_debug(level)	(level)
+
+typedef enum { log_syslog, log_file, log_null } log_channel_type;
+
+#define LOG_MAX_VERSIONS 99
+
+#define LOG_CLOSE_STREAM		0x0001
+#define LOG_TIMESTAMP			0x0002
+#define LOG_TRUNCATE			0x0004
+#define LOG_USE_CONTEXT_LEVEL		0x0008
+#define LOG_PRINT_LEVEL			0x0010
+#define LOG_REQUIRE_DEBUG		0x0020
+#define LOG_CHANNEL_BROKEN		0x0040
+#define LOG_PRINT_CATEGORY		0x0080
+#define LOG_CHANNEL_OFF			0x0100
+
+typedef struct log_context *log_context;
+typedef struct log_channel *log_channel;
+
+#define LOG_OPTION_DEBUG		0x01
+#define LOG_OPTION_LEVEL		0x02
+
+#define log_open_stream		__log_open_stream
+#define log_close_stream	__log_close_stream
+#define log_get_stream		__log_get_stream
+#define log_get_filename	__log_get_filename
+#define log_check_channel	__log_check_channel
+#define log_check		__log_check
+#define log_vwrite		__log_vwrite
+#define log_write		__log_write
+#define log_new_context		__log_new_context
+#define log_free_context	__log_free_context
+#define log_add_channel		__log_add_channel
+#define log_remove_channel	__log_remove_channel
+#define log_option		__log_option
+#define log_category_is_active	__log_category_is_active
+#define log_new_syslog_channel	__log_new_syslog_channel
+#define log_new_file_channel	__log_new_file_channel
+#define log_set_file_owner	__log_set_file_owner
+#define log_new_null_channel	__log_new_null_channel
+#define log_inc_references	__log_inc_references
+#define log_dec_references	__log_dec_references
+#define log_get_channel_type	__log_get_channel_type
+#define log_free_channel	__log_free_channel
+#define log_close_debug_channels	__log_close_debug_channels
+
+FILE *			log_open_stream(log_channel);
+int			log_close_stream(log_channel);
+FILE *			log_get_stream(log_channel);
+char *			log_get_filename(log_channel);
+int			log_check_channel(log_context, int, log_channel);
+int			log_check(log_context, int, int);
+#ifdef __GNUC__
+void			log_vwrite(log_context, int, int, const char *, 
+				   va_list args)
+				__attribute__((__format__(__printf__, 4, 0)));
+void			log_write(log_context, int, int, const char *, ...)
+				__attribute__((__format__(__printf__, 4, 5)));
+#else
+void			log_vwrite(log_context, int, int, const char *, 
+				   va_list args);
+void			log_write(log_context, int, int, const char *, ...);
+#endif
+int			log_new_context(int, char **, log_context *);
+void			log_free_context(log_context);
+int			log_add_channel(log_context, int, log_channel);
+int			log_remove_channel(log_context, int, log_channel);
+int			log_option(log_context, int, int);
+int			log_category_is_active(log_context, int);
+log_channel		log_new_syslog_channel(unsigned int, int, int);
+log_channel		log_new_file_channel(unsigned int, int, const char *,
+					     FILE *, unsigned int,
+					     unsigned long);
+int			log_set_file_owner(log_channel, uid_t, gid_t);
+log_channel		log_new_null_channel(void);
+int			log_inc_references(log_channel);
+int			log_dec_references(log_channel);
+log_channel_type	log_get_channel_type(log_channel);
+int			log_free_channel(log_channel);
+void			log_close_debug_channels(log_context);
+
+#endif /* !LOGGING_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/memcluster.h b/usr/src/lib/libresolv2_joy/include/isc/memcluster.h
new file mode 100644
index 0000000000..0923deb5e7
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/memcluster.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1997,1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef MEMCLUSTER_H
+#define MEMCLUSTER_H
+
+#include <stdio.h>
+
+#define meminit		__meminit
+#ifdef MEMCLUSTER_DEBUG
+#define memget(s)	__memget_debug(s, __FILE__, __LINE__)
+#define memput(p, s)	__memput_debug(p, s, __FILE__, __LINE__)
+#else /*MEMCLUSTER_DEBUG*/
+#ifdef MEMCLUSTER_RECORD
+#define memget(s)	__memget_record(s, __FILE__, __LINE__)
+#define memput(p, s)	__memput_record(p, s, __FILE__, __LINE__)
+#else /*MEMCLUSTER_RECORD*/
+#define memget		__memget
+#define memput		__memput
+#endif /*MEMCLUSTER_RECORD*/
+#endif /*MEMCLUSTER_DEBUG*/
+#define memstats	__memstats
+#define memactive	__memactive
+
+int	meminit(size_t, size_t);
+void *	__memget(size_t);
+void 	__memput(void *, size_t);
+void *	__memget_debug(size_t, const char *, int);
+void 	__memput_debug(void *, size_t, const char *, int);
+void *	__memget_record(size_t, const char *, int);
+void 	__memput_record(void *, size_t, const char *, int);
+void 	memstats(FILE *);
+int	memactive(void);
+
+#endif /* MEMCLUSTER_H */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/misc.h b/usr/src/lib/libresolv2_joy/include/isc/misc.h
new file mode 100644
index 0000000000..b54f4ee6ed
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/misc.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1995-2001, 2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * $Id: misc.h,v 1.7 2008/11/14 02:36:51 marka Exp $
+ */
+
+#ifndef _ISC_MISC_H
+#define _ISC_MISC_H
+
+/*! \file */
+
+#include <stdio.h>
+#include <sys/types.h>
+
+#define	bitncmp		__bitncmp
+/*#define isc_movefile	__isc_movefile */
+
+extern int		bitncmp(const void *, const void *, int);
+extern int		isc_movefile(const char *, const char *);
+
+extern int		isc_gethexstring(unsigned char *, size_t, int, FILE *,
+					 int *);
+extern void		isc_puthexstring(FILE *, const unsigned char *, size_t,
+					 size_t, size_t, const char *);
+extern void		isc_tohex(const unsigned char *, size_t, char *);
+
+#endif /*_ISC_MISC_H*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/isc/platform.h b/usr/src/lib/libresolv2_joy/include/isc/platform.h
new file mode 100644
index 0000000000..2fc59b61a8
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/platform.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: platform.h.in,v 1.3 2008/01/23 02:15:56 tbox Exp $ */
+
+/*! \file */
+
+#ifndef ISC_PLATFORM_H
+#define ISC_PLATFORM_H
+
+/*
+ * Define if the OS does not define struct timespec.
+ */
+#undef ISC_PLATFORM_NEEDTIMESPEC
+#ifdef ISC_PLATFORM_NEEDTIMESPEC
+#include <time.h>               /* For time_t */
+struct timespec {
+	time_t  tv_sec;         /* seconds */
+	long    tv_nsec;        /* nanoseconds */
+};
+#endif
+
+#endif
diff --git a/usr/src/lib/libresolv2_joy/include/isc/tree.h b/usr/src/lib/libresolv2_joy/include/isc/tree.h
new file mode 100644
index 0000000000..96feaca68d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/isc/tree.h
@@ -0,0 +1,59 @@
+/* tree.h - declare structures used by tree library
+ *
+ * vix 22jan93 [revisited; uses RCS, ANSI, POSIX; has bug fixes]
+ * vix 27jun86 [broken out of tree.c]
+ *
+ * $Id: tree.h,v 1.3 2005/04/27 04:56:18 sra Exp $
+ */
+
+
+#ifndef	_TREE_H_INCLUDED
+#define	_TREE_H_INCLUDED
+
+
+#ifndef __P
+# if defined(__STDC__) || defined(__GNUC__)
+#  define __P(x) x
+# else
+#  define __P(x) ()
+# endif
+#endif
+
+/*%
+ * tree_t is our package-specific anonymous pointer.
+ */
+#if defined(__STDC__) || defined(__GNUC__)
+typedef	void *tree_t;
+#else
+typedef	char *tree_t;
+#endif
+
+/*%
+ * Do not taint namespace
+ */
+#define	tree_add	__tree_add
+#define	tree_delete	__tree_delete
+#define	tree_init	__tree_init
+#define	tree_mung	__tree_mung
+#define	tree_srch	__tree_srch
+#define	tree_trav	__tree_trav
+
+
+typedef	struct tree_s {
+		tree_t		data;
+		struct tree_s	*left, *right;
+		short		bal;
+	}
+	tree;
+
+
+void	tree_init	__P((tree **));
+tree_t	tree_srch	__P((tree **, int (*)(), tree_t));
+tree_t	tree_add	__P((tree **, int (*)(), tree_t, void (*)()));
+int	tree_delete	__P((tree **, int (*)(), tree_t, void (*)()));
+int	tree_trav	__P((tree **, int (*)()));
+void	tree_mung	__P((tree **, void (*)()));
+
+
+#endif	/* _TREE_H_INCLUDED */
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/make_os_version b/usr/src/lib/libresolv2_joy/include/make_os_version
new file mode 100755
index 0000000000..3654490fee
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/make_os_version
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+# Copyright (c) 1999 by Sun Microsystems, Inc.
+# All rights reserved.
+#
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+UNAME_R=`/usr/bin/uname -r`
+
+OS_MAJOR=`echo $UNAME_R | /usr/bin/sed -e 's/^\([^.]*\).*/\1/'`
+OS_MINOR=`echo $UNAME_R | /usr/bin/sed -e 's/^[^.]*\.\([^.]*\).*/\1/'`
+OS_VERSION=`echo $UNAME_R | tr '.' '_'`
+
+cat <<EOF > new_os_version.h
+#ifndef OS_VERSION_H
+#define OS_VERSION_H
+
+#define SUNOS_$OS_VERSION
+#define OS_MAJOR $OS_MAJOR
+#define OS_MINOR $OS_MINOR
+
+#endif
+EOF
+
+if [ -f os_version.h ]; then
+	if /usr/bin/cmp -s new_os_version.h os_version.h; then
+		/usr/bin/rm -f new_os_version.h
+	else
+		/usr/bin/rm -f os_version.h
+		/usr/bin/mv new_os_version.h os_version.h
+	fi
+else
+	/usr/bin/mv new_os_version.h os_version.h
+fi
diff --git a/usr/src/lib/libresolv2_joy/include/make_os_version.sh b/usr/src/lib/libresolv2_joy/include/make_os_version.sh
new file mode 100644
index 0000000000..3654490fee
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/make_os_version.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+# Copyright (c) 1999 by Sun Microsystems, Inc.
+# All rights reserved.
+#
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+UNAME_R=`/usr/bin/uname -r`
+
+OS_MAJOR=`echo $UNAME_R | /usr/bin/sed -e 's/^\([^.]*\).*/\1/'`
+OS_MINOR=`echo $UNAME_R | /usr/bin/sed -e 's/^[^.]*\.\([^.]*\).*/\1/'`
+OS_VERSION=`echo $UNAME_R | tr '.' '_'`
+
+cat <<EOF > new_os_version.h
+#ifndef OS_VERSION_H
+#define OS_VERSION_H
+
+#define SUNOS_$OS_VERSION
+#define OS_MAJOR $OS_MAJOR
+#define OS_MINOR $OS_MINOR
+
+#endif
+EOF
+
+if [ -f os_version.h ]; then
+	if /usr/bin/cmp -s new_os_version.h os_version.h; then
+		/usr/bin/rm -f new_os_version.h
+	else
+		/usr/bin/rm -f os_version.h
+		/usr/bin/mv new_os_version.h os_version.h
+	fi
+else
+	/usr/bin/mv new_os_version.h os_version.h
+fi
diff --git a/usr/src/lib/libresolv2_joy/include/port_after.h b/usr/src/lib/libresolv2_joy/include/port_after.h
new file mode 100644
index 0000000000..c3abf4b334
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/port_after.h
@@ -0,0 +1,539 @@
+/*
+ * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
+ */
+
+/*
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001-2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: port_after.h.in,v 1.60 2008/02/28 05:34:17 marka Exp $ */
+
+#ifndef port_after_h
+#define port_after_h
+
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/param.h>
+#include <sys/time.h>
+#if (!defined(BSD)) || (BSD < 199306)
+#include <sys/bitypes.h>
+#endif
+#ifdef HAVE_INTTYPES_H
+#include <inttypes.h>
+#endif
+#ifdef HAVE_SYS_SELECT_H
+#include <sys/select.h>
+#endif /* HAVE_SYS_SELECT_H */
+
+#ifdef REENABLE_SEND
+#undef send
+#endif
+
+#undef NEED_PSELECT
+#undef HAVE_SA_LEN
+#undef HAVE_MINIMUM_IFREQ
+#define NEED_DAEMON 1
+#undef NEED_STRSEP
+#undef NEED_STRERROR
+#ifdef NEED_STRERROR
+const char *isc_strerror(int);
+#define strerror isc_strerror
+#endif
+/* HAS_INET6_STRUCTS and HAVE_SIN6_SCOPE_ID are defined by port_ipv6.h
+ * #define HAS_INET6_STRUCTS 1
+ * #define HAVE_SIN6_SCOPE_ID 1
+ */
+#include <port_ipv6.h>
+
+#undef NEED_IN6ADDR_ANY
+#undef HAS_IN_ADDR6
+#define HAVE_SOCKADDR_STORAGE 1
+#undef NEED_GETTIMEOFDAY
+#define HAVE_STRNDUP
+#undef USE_FIONBIO_IOCTL
+#undef INNETGR_ARGS
+
+#undef USE_IFNAMELINKID
+#define PORT_NONBLOCK O_NONBLOCK
+
+#ifndef _POSIX_PATH_MAX
+#define _POSIX_PATH_MAX 255
+#endif
+#ifndef PATH_MAX
+#define PATH_MAX _POSIX_PATH_MAX
+#endif
+
+/*
+ * We need to know the IPv6 address family number even on IPv4-only systems.
+ * Note that this is NOT a protocol constant, and that if the system has its
+ * own AF_INET6, different from ours below, all of BIND's libraries and
+ * executables will need to be recompiled after the system <sys/socket.h>
+ * has had this type added.  The type number below is correct on most BSD-
+ * derived systems for which AF_INET6 is defined.
+ */
+#ifndef AF_INET6
+#define AF_INET6        24
+#endif
+
+#ifndef PF_INET6
+#define PF_INET6        AF_INET6
+#endif
+
+#ifdef HAS_IN_ADDR6
+/* Map to pre-RFC structure. */
+#define in6_addr in_addr6
+#endif
+
+#ifndef HAS_INET6_STRUCTS
+/* Replace with structure from later rev of O/S if known. */
+struct in6_addr {
+	u_int8_t        s6_addr[16];
+};
+
+#define IN6ADDR_ANY_INIT \
+	{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }}
+
+#define IN6ADDR_LOOPBACK_INIT \
+	{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }}
+
+/* Replace with structure from later rev of O/S if known. */
+struct sockaddr_in6 {
+#ifdef  HAVE_SA_LEN
+	u_int8_t        sin6_len;       /* length of this struct */
+	u_int8_t        sin6_family;    /* AF_INET6 */
+#else
+	u_int16_t       sin6_family;    /* AF_INET6 */
+#endif
+	u_int16_t       sin6_port;      /* transport layer port # */
+	u_int32_t       sin6_flowinfo;  /* IPv6 flow information */
+	struct in6_addr sin6_addr;      /* IPv6 address */
+	u_int32_t       sin6_scope_id;  /* set of interfaces for a scope */
+};
+#endif  /* HAS_INET6_STRUCTS */
+
+#ifdef BROKEN_IN6ADDR_INIT_MACROS
+#undef IN6ADDR_ANY_INIT
+#undef IN6ADDR_LOOPBACK_INIT
+#endif
+
+#ifdef _AIX
+#ifndef IN6ADDR_ANY_INIT
+#define IN6ADDR_ANY_INIT {{{ 0, 0, 0, 0 }}}
+#endif
+#ifndef IN6ADDR_LOOPBACK_INIT
+#if BYTE_ORDER == BIG_ENDIAN
+#define IN6ADDR_LOOPBACK_INIT {{{ 0, 0, 0, 1 }}}
+#else
+#define IN6ADDR_LOOPBACK_INIT {{{0, 0, 0, 0x01000000}}}
+#endif
+#endif
+#endif
+
+#ifndef IN6ADDR_ANY_INIT
+#ifdef s6_addr
+#define IN6ADDR_ANY_INIT \
+	{{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
+	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }}}
+#else
+#define IN6ADDR_ANY_INIT \
+	{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }}
+#endif
+
+#endif
+#ifndef IN6ADDR_LOOPBACK_INIT
+#ifdef s6_addr
+#define IN6ADDR_LOOPBACK_INIT \
+	{{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
+	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }}}
+#else
+#define IN6ADDR_LOOPBACK_INIT \
+	{{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }}
+#endif
+#endif
+
+#ifndef HAVE_SOCKADDR_STORAGE
+#define __SS_MAXSIZE 128
+#define __SS_ALLIGSIZE (sizeof (long))
+
+struct sockaddr_storage {
+#ifdef  HAVE_SA_LEN
+	u_int8_t        ss_len;       /* address length */
+	u_int8_t        ss_family;    /* address family */
+	char            __ss_pad1[__SS_ALLIGSIZE - 2 * sizeof(u_int8_t)];
+	long            __ss_align;
+	char            __ss_pad2[__SS_MAXSIZE - 2 * __SS_ALLIGSIZE];
+#else
+	u_int16_t       ss_family;    /* address family */
+	char            __ss_pad1[__SS_ALLIGSIZE - sizeof(u_int16_t)];
+	long            __ss_align;
+	char            __ss_pad2[__SS_MAXSIZE - 2 * __SS_ALLIGSIZE];
+#endif
+};
+#endif
+
+
+#if !defined(HAS_INET6_STRUCTS) || defined(NEED_IN6ADDR_ANY)
+#define in6addr_any isc_in6addr_any
+extern const struct in6_addr in6addr_any;
+#endif
+
+/*
+ * IN6_ARE_ADDR_EQUAL, IN6_IS_ADDR_UNSPECIFIED, IN6_IS_ADDR_V4COMPAT and
+ * IN6_IS_ADDR_V4MAPPED are broken in glibc 2.1.
+ */
+#ifdef __GLIBC__
+#if __GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ < 2)
+#undef IN6_ARE_ADDR_EQUAL
+#undef IN6_IS_ADDR_UNSPECIFIED
+#undef IN6_IS_ADDR_V4COMPAT
+#undef IN6_IS_ADDR_V4MAPPED
+#endif
+#endif
+
+#ifndef IN6_ARE_ADDR_EQUAL
+#define IN6_ARE_ADDR_EQUAL(a,b) \
+   (memcmp(&(a)->s6_addr[0], &(b)->s6_addr[0], sizeof(struct in6_addr)) == 0)
+#endif
+
+#ifndef IN6_IS_ADDR_UNSPECIFIED
+#define IN6_IS_ADDR_UNSPECIFIED(a)      \
+	IN6_ARE_ADDR_EQUAL(a, &in6addr_any)
+#endif
+
+#ifndef IN6_IS_ADDR_LOOPBACK
+extern const struct in6_addr isc_in6addr_loopback;
+#define IN6_IS_ADDR_LOOPBACK(a) \
+	IN6_ARE_ADDR_EQUAL(a, &isc_in6addr_loopback)
+#endif
+
+#ifndef IN6_IS_ADDR_V4MAPPED
+#define IN6_IS_ADDR_V4MAPPED(a)	\
+	((a)->s6_addr[0] == 0x00 && (a)->s6_addr[1] == 0x00 && \
+	(a)->s6_addr[2] == 0x00 && (a)->s6_addr[3] == 0x00 && \
+	(a)->s6_addr[4] == 0x00 && (a)->s6_addr[5] == 0x00 && \
+	(a)->s6_addr[6] == 0x00 && (a)->s6_addr[9] == 0x00 && \
+	(a)->s6_addr[8] == 0x00 && (a)->s6_addr[9] == 0x00 && \
+	(a)->s6_addr[10] == 0xff && (a)->s6_addr[11] == 0xff)
+#endif
+
+#ifndef IN6_IS_ADDR_SITELOCAL
+#define IN6_IS_ADDR_SITELOCAL(a)        \
+	(((a)->s6_addr[0] == 0xfe) && (((a)->s6_addr[1] & 0xc0) == 0xc0))
+#endif
+
+#ifndef IN6_IS_ADDR_LINKLOCAL
+#define IN6_IS_ADDR_LINKLOCAL(a)        \
+	(((a)->s6_addr[0] == 0xfe) && (((a)->s6_addr[1] & 0xc0) == 0x80))
+#endif
+
+#ifndef IN6_IS_ADDR_MULTICAST
+#define IN6_IS_ADDR_MULTICAST(a)        ((a)->s6_addr[0] == 0xff)
+#endif
+
+#ifndef __IPV6_ADDR_MC_SCOPE
+#define __IPV6_ADDR_MC_SCOPE(a)         ((a)->s6_addr[1] & 0x0f)
+#endif
+
+#ifndef __IPV6_ADDR_SCOPE_SITELOCAL
+#define __IPV6_ADDR_SCOPE_SITELOCAL 0x05
+#endif
+#ifndef __IPV6_ADDR_SCOPE_ORGLOCAL
+#define __IPV6_ADDR_SCOPE_ORGLOCAL  0x08
+#endif
+
+#ifndef IN6_IS_ADDR_MC_SITELOCAL
+#define IN6_IS_ADDR_MC_SITELOCAL(a)     \
+	(IN6_IS_ADDR_MULTICAST(a) &&    \
+	 (__IPV6_ADDR_MC_SCOPE(a) == __IPV6_ADDR_SCOPE_SITELOCAL))
+#endif
+
+#ifndef IN6_IS_ADDR_MC_ORGLOCAL
+#define IN6_IS_ADDR_MC_ORGLOCAL(a)      \
+	(IN6_IS_ADDR_MULTICAST(a) &&    \
+	 (__IPV6_ADDR_MC_SCOPE(a) == __IPV6_ADDR_SCOPE_ORGLOCAL))
+#endif
+
+#ifndef INADDR_NONE
+#define INADDR_NONE 0xffffffff
+#endif
+
+#ifndef MAXHOSTNAMELEN
+#define MAXHOSTNAMELEN 256
+#endif
+
+#ifndef INET6_ADDRSTRLEN
+/* sizeof("aaaa:bbbb:cccc:dddd:eeee:ffff:123.123.123.123") */
+#define INET6_ADDRSTRLEN 46
+#endif
+
+#ifndef MIN
+#define MIN(x,y) (((x) <= (y)) ? (x) : (y))
+#endif
+
+#ifndef MAX
+#define MAX(x,y) (((x) >= (y)) ? (x) : (y))
+#endif
+
+#ifdef NEED_DAEMON
+int daemon(int nochdir, int noclose);
+#endif
+
+#ifdef NEED_STRSEP
+char * strsep(char **stringp, const char *delim);
+#endif
+
+#ifndef ALIGN
+#define ALIGN(p) (((uintptr_t)(p) + (sizeof(long) - 1)) & ~(sizeof(long) - 1))
+#endif
+
+#ifdef NEED_SETGROUPENT
+int setgroupent(int stayopen);
+#endif
+
+#ifdef NEED_GETGROUPLIST
+int getgrouplist(GETGROUPLIST_ARGS);
+#endif
+
+#ifdef POSIX_GETGRNAM_R
+int
+__posix_getgrnam_r(const char *, struct group *, char *, int, struct group **);
+#endif
+
+#ifdef NEED_GETGRNAM_R
+int
+getgrnam_r(const char *,  struct group *, char *, size_t, struct group **);
+#endif
+
+#ifdef POSIX_GETGRGID_R
+int
+__posix_getgrgid_r(gid_t, struct group *, char *, int, struct group **) ;
+#endif
+
+#ifdef NEED_GETGRGID_R
+int
+getgrgid_r(gid_t, struct group *, char *, size_t, struct group **);
+#endif
+
+#ifdef NEED_GETGRENT_R
+GROUP_R_RETURN getgrent_r(struct group *gptr, GROUP_R_ARGS);
+#endif
+
+#ifdef NEED_SETGRENT_R
+GROUP_R_SET_RETURN setgrent_r(GROUP_R_ENT_ARGS);
+#endif
+
+#ifdef NEED_ENDGRENT_R
+GROUP_R_END_RETURN endgrent_r(GROUP_R_ENT_ARGS);
+#endif
+
+#if defined(NEED_INNETGR_R) && defined(NGR_R_RETURN)
+NGR_R_RETURN
+innetgr_r(const char *, const char *, const char *, const char *);
+#endif
+
+#ifdef NEED_SETNETGRENT_R
+#ifdef NGR_R_SET_ARGS
+NGR_R_SET_RETURN setnetgrent_r(NGR_R_SET_CONST char *netgroup, NGR_R_SET_ARGS);
+#else
+NGR_R_SET_RETURN setnetgrent_r(NGR_R_SET_CONST char *netgroup);
+#endif
+#endif
+
+#ifdef NEED_ENDNETGRENT_R
+#ifdef NGR_R_END_ARGS
+NGR_R_END_RETURN endnetgrent_r(NGR_R_END_ARGS);
+#else
+NGR_R_END_RETURN endnetgrent_r(void);
+#endif
+#endif
+
+#ifdef POSIX_GETPWNAM_R
+int
+__posix_getpwnam_r(const char *login,  struct passwd *pwptr,
+		char *buf, size_t buflen, struct passwd **result);
+#endif
+
+#ifdef NEED_GETPWNAM_R
+int
+getpwnam_r(const char *login,  struct passwd *pwptr,
+		char *buf, size_t buflen, struct passwd **result);
+#endif
+
+#ifdef POSIX_GETPWUID_R
+int
+__posix_getpwuid_r(uid_t uid, struct passwd *pwptr,
+		char *buf, int buflen, struct passwd **result);
+#endif
+
+#ifdef NEED_GETPWUID_R
+int
+getpwuid_r(uid_t uid, struct passwd *pwptr,
+		char *buf, size_t buflen, struct passwd **result);
+#endif
+
+#ifdef NEED_SETPWENT_R
+#ifdef PASS_R_ENT_ARGS
+PASS_R_SET_RETURN setpwent_r(PASS_R_ENT_ARGS);
+#else
+PASS_R_SET_RETURN setpwent_r(void);
+#endif
+
+#endif
+
+#ifdef NEED_SETPASSENT_R
+#ifdef PASS_R_ENT_ARGS
+PASS_R_SET_RETURN setpassent_r(int stayopen, PASS_R_ENT_ARGS);
+#else
+PASS_R_SET_RETURN setpassent_r(int stayopen);
+#endif
+#endif
+
+#ifdef NEED_GETPWENT_R
+PASS_R_RETURN getpwent_r(struct passwd *pwptr, PASS_R_ARGS);
+#endif
+
+#ifdef NEED_ENDPWENT_R
+void endpwent_r(void);
+#endif
+
+#ifdef NEED_SETPASSENT
+int setpassent(int stayopen);
+#endif
+
+#define gettimeofday isc__gettimeofday
+#ifdef NEED_GETTIMEOFDAY
+int isc__gettimeofday(struct timeval *tvp, struct _TIMEZONE *tzp);
+#else
+int isc__gettimeofday(struct timeval *tp, struct timezone *tzp);
+#endif
+
+int getnetgrent(NGR_R_CONST char **machinep, NGR_R_CONST char **userp,
+		NGR_R_CONST char **domainp);
+
+#ifdef NGR_R_ARGS
+int getnetgrent_r(NGR_R_CONST char **machinep, NGR_R_CONST char **userp,
+		  NGR_R_CONST char **domainp, NGR_R_ARGS);
+#endif
+
+/* setnetgrent and endnetgrent are defined in sunw_port_after.h 
+#ifdef SETNETGRENT_ARGS
+void setnetgrent(SETNETGRENT_ARGS);
+#else
+void setnetgrent(const char *netgroup);
+#endif
+
+void endnetgrent(void);
+*/
+
+#ifdef INNETGR_ARGS
+int innetgr(INNETGR_ARGS);
+#else
+int innetgr(const char *netgroup, const char *machine,
+	    const char *user, const char *domain);
+#endif
+
+#ifdef NGR_R_SET_ARGS
+NGR_R_SET_RETURN
+setnetgrent_r(NGR_R_SET_CONST char *netgroup, NGR_R_SET_ARGS);
+#else
+NGR_R_SET_RETURN
+setnetgrent_r(NGR_R_SET_CONST char *netgroup);
+#endif
+
+#ifdef NEED_STRTOUL
+unsigned long strtoul(const char *, char **, int);
+#endif
+
+#ifdef NEED_SUN4PROTOS
+#include <stdarg.h>
+#ifndef __SIZE_TYPE__
+#define __SIZE_TYPE__ int
+#endif
+struct sockaddr;
+struct iovec;
+struct timeval;
+struct timezone;
+int fprintf(FILE *, const char *, ...);
+int getsockname(int, struct sockaddr *, int *);
+int getpeername(int, struct sockaddr *, int *);
+int socket(int, int, int);
+int connect(int, const struct sockaddr *, int);
+int writev(int, struct iovec *, int);
+int readv(int, struct iovec *, int);
+int send(int, const char *, int, int);
+void bzero(char *, int);
+int recvfrom(int, char *, int, int, struct sockaddr *, int *);
+int syslog(int, const char *, ... );
+int printf(const char *, ...);
+__SIZE_TYPE__ fread(void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *);
+__SIZE_TYPE__ fwrite(const void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *);
+int fclose(FILE *);
+int ungetc(int, FILE *);
+int scanf(const char *, ...);
+int sscanf(const char *, const char *, ... );
+int tolower(int);
+int toupper(int);
+int strcasecmp(const char *, const char *);
+int strncasecmp(const char *, const char *, int);
+int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
+#ifdef gettimeofday
+#undef gettimeofday
+int gettimeofday(struct timeval *, struct timezone *);
+#define gettimeofday isc__gettimeofday
+#else
+int gettimeofday(struct timeval *, struct timezone *);
+#endif
+long strtol(const char*, char **, int);
+int fseek(FILE *, long, int);
+int setsockopt(int, int, int, const char *, int);
+int bind(int, const struct sockaddr *, int);
+void bcopy(char *, char *, int);
+int fputc(char, FILE *);
+int listen(int, int);
+int accept(int, struct sockaddr *, int *);
+int getsockopt(int, int, int, char *, int *);
+int vfprintf(FILE *, const char *, va_list);
+int fflush(FILE *);
+int fgetc(FILE *);
+int fputs(const char *, FILE *);
+int fchown(int, int, int);
+void setbuf(FILE *, char *);
+int gethostname(char *, int);
+int rename(const char *, const char *);
+time_t time(time_t *);
+int fscanf(FILE *, const char *, ...);
+int sscanf(const char *, const char *, ...);
+int ioctl(int, int, caddr_t);
+void perror(const char *);
+
+#if !defined(__USE_FIXED_PROTOTYPES__) && !defined(__cplusplus) && !defined(__STRICT_ANSI__)
+/*
+ * 'gcc -ansi' changes the prototype for vsprintf().
+ * Use this prototype when 'gcc -ansi' is not in effect.
+ */
+char *vsprintf(char *, const char *, va_list);
+#endif
+#endif
+
+/* Solaris-specific changes */
+#include "sunw_port_after.h"
+
+#endif	/* port_after_h */
diff --git a/usr/src/lib/libresolv2_joy/include/port_before.h b/usr/src/lib/libresolv2_joy/include/port_before.h
new file mode 100644
index 0000000000..2801139223
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/port_before.h
@@ -0,0 +1,201 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (C) 2005-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: port_before.h.in,v 1.31 2008/02/28 05:36:10 marka Exp $ */
+
+#ifndef port_before_h
+#define port_before_h
+/* Solaris-specific changes */
+#include "sunw_port_before.h"
+#include <config.h>
+
+#ifdef NEED_SUN4PROTOS
+#define _PARAMS(x) x
+#endif
+
+struct group;           /* silence warning */
+struct passwd;          /* silence warning */
+struct timeval;         /* silence warning */
+struct timezone;        /* silence warning */
+
+#ifdef HAVE_SYS_TIMERS_H
+#include <sys/timers.h>
+#endif
+#include <limits.h>
+
+#ifdef ISC_PLATFORM_NEEDTIMESPEC
+#include <time.h>		/* For time_t */
+struct timespec {
+	time_t  tv_sec;         /* seconds */
+	long    tv_nsec;        /* nanoseconds */
+};
+#endif
+#ifndef HAVE_MEMMOVE
+#define memmove(a,b,c) bcopy(b,a,c)
+#endif
+
+#undef WANT_IRS_GR
+#undef WANT_IRS_NIS
+#undef WANT_IRS_PW
+
+#define BSD_COMP 1
+#define USE_POLL 1
+#define HAVE_MD5 1
+#define SOLARIS2 1
+
+/* DO_PTHREADS is conditionally defined in sunw_port_before.h 
+ * #define DO_PTHREADS 1 */
+#define GETGROUPLIST_ARGS const char *name, gid_t basegid, gid_t *groups, int *ngroups
+#define GETNETBYADDR_ADDR_T long
+#define SETPWENT_VOID 1
+#define SETGRENT_VOID 1
+
+#define NET_R_ARGS char *buf, int buflen
+#define NET_R_BAD NULL
+#define NET_R_COPY buf, buflen
+#define NET_R_COPY_ARGS NET_R_ARGS
+#define NET_R_END_RESULT(x) /*empty*/
+#define NET_R_END_RETURN void
+#undef NET_R_ENT_ARGS /*empty*/
+#define NET_R_OK nptr
+#define NET_R_RETURN struct netent *
+#undef NET_R_SET_RESULT /*empty*/
+#undef NET_R_SETANSWER
+#define NET_R_SET_RETURN void
+#undef NETENT_DATA
+
+#define GROUP_R_RETURN struct group *
+#define GROUP_R_SET_RETURN void
+#undef GROUP_R_SET_RESULT /*empty*/
+#define GROUP_R_END_RETURN void
+#define GROUP_R_END_RESULT(x) /*empty*/
+#define GROUP_R_ARGS char *buf, int buflen
+#define GROUP_R_ENT_ARGS void
+#define GROUP_R_OK gptr
+#define GROUP_R_BAD NULL
+
+#define HOST_R_ARGS char *buf, int buflen, int *h_errnop
+#define HOST_R_BAD NULL
+#define HOST_R_COPY buf, buflen
+#define HOST_R_COPY_ARGS char *buf, int buflen
+#define HOST_R_END_RESULT(x) /*empty*/
+#define HOST_R_END_RETURN void
+#undef HOST_R_ENT_ARGS /*empty*/
+#define HOST_R_ERRNO *h_errnop = h_errno
+#define HOST_R_OK hptr
+#define HOST_R_RETURN struct hostent *
+#undef HOST_R_SETANSWER
+#undef HOST_R_SET_RESULT
+#define HOST_R_SET_RETURN void
+#undef HOSTENT_DATA
+
+#define NGR_R_ARGS char *buf, int buflen
+#define NGR_R_BAD (0)
+#define NGR_R_COPY buf, buflen
+#define NGR_R_COPY_ARGS NGR_R_ARGS
+#define NGR_R_CONST
+#define NGR_R_END_RESULT(x)  /*empty*/
+#define NGR_R_END_RETURN void
+#undef NGR_R_END_ARGS /*empty*/
+#define NGR_R_OK 1
+#define NGR_R_RETURN int
+#define NGR_R_SET_CONST const
+#undef NGR_R_SET_RESULT /*empty*/
+#define NGR_R_SET_RETURN void
+#undef NGR_R_SET_ARGS
+
+
+#if !defined(NGR_R_SET_ARGS) && defined(NGR_R_END_ARGS)
+#define NGR_R_SET_ARGS NGR_R_END_ARGS
+#endif
+
+#define PROTO_R_ARGS char *buf, int buflen
+#define PROTO_R_BAD NULL
+#define PROTO_R_COPY buf, buflen
+#define PROTO_R_COPY_ARGS PROTO_R_ARGS
+#define PROTO_R_END_RESULT(x) /*empty*/
+#define PROTO_R_END_RETURN void
+#undef PROTO_R_ENT_ARGS /*empty*/
+#undef PROTO_R_ENT_UNUSED
+#define PROTO_R_OK pptr
+#undef PROTO_R_SETANSWER
+#define PROTO_R_RETURN struct protoent *
+#undef PROTO_R_SET_RESULT
+#define PROTO_R_SET_RETURN void
+#undef PROTOENT_DATA
+
+#define PASS_R_ARGS char *buf, int buflen
+#define PASS_R_BAD NULL
+#define PASS_R_COPY buf, buflen
+#define PASS_R_COPY_ARGS PASS_R_ARGS
+#define PASS_R_END_RESULT(x) /*empty*/
+#define PASS_R_END_RETURN void
+#undef PASS_R_ENT_ARGS
+#define PASS_R_OK pwptr
+#define PASS_R_RETURN struct passwd *
+#undef PASS_R_SET_RESULT /*empty*/
+#define PASS_R_SET_RETURN void
+
+#define SERV_R_ARGS char *buf, int buflen
+#define SERV_R_BAD NULL
+#define SERV_R_COPY buf, buflen
+#define SERV_R_COPY_ARGS SERV_R_ARGS
+#define SERV_R_END_RESULT(x) /*empty*/
+#define SERV_R_END_RETURN void 
+#undef SERV_R_ENT_ARGS /*empty*/
+#undef SERV_R_ENT_UNUSED /*empty*/
+#define SERV_R_OK sptr
+#undef SERV_R_SETANSWER
+#define SERV_R_RETURN struct servent *
+#undef SERV_R_SET_RESULT
+#define SERV_R_SET_RETURN void
+
+
+
+#define DE_CONST(konst, var) \
+	do { \
+		union { const void *k; void *v; } _u; \
+		_u.k = konst; \
+		var = _u.v; \
+	} while (0)
+
+#define UNUSED(x) (x) = (x)
+
+#undef NEED_SOLARIS_BITTYPES
+#define ISC_SOCKLEN_T int
+
+#ifdef __GNUC__
+#define ISC_FORMAT_PRINTF(fmt, args) \
+	__attribute__((__format__(__printf__, fmt, args)))
+#else
+#define ISC_FORMAT_PRINTF(fmt, args)
+#endif
+
+/* Pull in host order macros when _XOPEN_SOURCE_EXTENDED is defined. */
+#if defined(__hpux) && defined(_XOPEN_SOURCE_EXTENDED)
+#include <sys/byteorder.h>
+#endif
+
+#endif
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/port_netdb.h b/usr/src/lib/libresolv2_joy/include/port_netdb.h
new file mode 100644
index 0000000000..a308cc7efa
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/port_netdb.h
@@ -0,0 +1,188 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+#ifndef _PORT_NETDB_H
+#define	_PORT_NETDB_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/* AI_NUMERICSERV is not a valid flag for getaddrinfo */
+#define	AI_MASK		0x0038	/* mask of valid flags */
+
+/* EAI_OVERFLOW was removed from ISC */
+#define	EAI_BADHINTS  12
+
+/*
+ * these are libresolv2 functions that were renamed in previous versions to
+ * res_* because they conflict with libnsl or libsocket
+ */
+
+#define	endhostent joy_res_endhostent /* libnsl */
+void endhostent __P((void));
+#define	endnetent res_endnetent  /* libsocket */
+void endnetent __P((void));
+#define	freeaddrinfo res_freeaddrinfo /* libsocket */
+void freeaddrinfo __P((struct addrinfo *));
+#define	freehostent res_freehostent  /* libsocket and libnsl */
+void freehostent __P((struct hostent *));
+#define	getaddrinfo res_getaddrinfo  /* libsocket */
+int getaddrinfo __P((const char *, const char *,
+				const struct addrinfo *, struct addrinfo **));
+#define	gethostbyaddr joy_res_gethostbyaddr /* libnsl */
+struct hostent *gethostbyaddr __P((const char *, int, int));
+#define	gethostbyname joy_res_gethostbyname /* libnsl */
+struct hostent *gethostbyname __P((const char *));
+#define	gethostbyname2 joy_res_gethostbyname2 /* lib/nsswitch/dns */
+struct hostent *gethostbyname2 __P((const char *, int));
+#define	gethostent res_gethostent  /* libnsl */
+struct hostent *gethostent __P((void));
+#define	getipnodebyaddr res_getipnodebyaddr  /* libnsl and libsocket */
+struct hostent *getipnodebyaddr __P((const void *, size_t, int, int *));
+#define	getipnodebyname res_getipnodebyname  /* libnsl and libsocket */
+struct hostent *getipnodebyname __P((const char *, int, int, int *));
+
+#define	getnetbyaddr res_getnetbyaddr /* libsocket */
+struct netent *getnetbyaddr __P((unsigned long, int));
+#define	getnetbyname res_getnetbyname /* libsocket */
+struct netent *getnetbyname __P((const char *));
+#define	getnetent res_getnetent /* libsocket */
+struct netent *getnetent __P((void));
+#define	sethostent joy_res_sethostent /* libnsl */
+void sethostent __P((int));
+#define	setnetent res_setnetent /* libsocket */
+void setnetent __P((int));
+
+/*
+ * these are other irs functions now included in libresolv.so.2. We rename the
+ * ones that overlap with libsocket or libnsl
+ */
+
+/* endprotoent is in libsocket.so.1 */
+#define	endprotoent res_endprotoent
+void		endprotoent __P((void));
+
+/* endservent is in libsocket.so.1 */
+#define	endservent res_endservent
+void		endservent __P((void));
+
+/* note: the next two symbols are variables, not functions */
+
+/* gai_errlist is in libsocket.so.1 */
+#define	gai_errlist res_gai_errlist
+
+/* gai_nerr is in libsocket.so.1 */
+#define	gai_nerr res_gai_nerr
+
+/* gai_strerror is in libsocket.so.1 */
+#define	gai_strerror res_gai_strerror
+const char *gai_strerror __P((int ecode));
+
+/* gethostbyaddr_r is in libnsl.so.1 */
+#define	gethostbyaddr_r res_gethostbyaddr_r
+struct hostent *gethostbyaddr_r __P((const char *addr, int len, int type,
+				struct hostent *hptr, char *buf,
+				int buflen, int *h_errnop));
+
+/* gethostbyname_r is in libnsl.so.1 */
+#define	gethostbyname_r res_gethostbyname_r
+struct hostent *gethostbyname_r __P((const char *name,	 struct hostent *hptr,
+				char *buf, int buflen, int *h_errnop));
+
+/* gethostent_r is in libnsl.so.1 */
+#define	gethostent_r res_gethostent_r
+struct hostent *gethostent_r __P((struct hostent *hptr, char *buf, int buflen,
+				int *h_errnop));
+
+/* getnameinfo is in libsocket.so.1 */
+#define	getnameinfo res_getnameinfo
+int getnameinfo __P((const struct sockaddr *, size_t, char *,
+				size_t, char *, size_t, int));
+
+/* getnetbyaddr_r is in libsocket.so.1 */
+#define	getnetbyaddr_r res_getnetbyaddr_r
+struct netent *getnetbyaddr_r __P((long, int, struct netent *, char *, int));
+
+/* getnetbyname_r is in libsocket.so.1 */
+#define	getnetbyname_r res_getnetbyname_r
+struct netent *getnetbyname_r __P((const char *, struct netent *, char *, int));
+
+/* getnetent_r is in libsocket.so.1 */
+#define	getnetent_r res_getnetent_r
+struct netent *getnetent_r __P((struct netent *, char *, int));
+
+/* getprotobyname is in libsocket.so.1 */
+#define	getprotobyname res_getprotobyname
+struct protoent	*getprotobyname __P((const char *));
+
+/* getprotobyname_r is in libsocket.so.1 */
+#define	getprotobyname_r res_getprotobyname_r
+struct protoent	*getprotobyname_r __P((const char *, struct protoent *,
+				char *, int));
+
+/* getprotobynumber is in libsocket.so.1 */
+#define	getprotobynumber res_getprotobynumber
+struct protoent	*getprotobynumber __P((int));
+
+/* getprotobynumber_r is in libsocket.so.1 */
+#define	getprotobynumber_r res_getprotobynumber_r
+struct protoent	*getprotobynumber_r __P((int,
+				struct protoent *, char *, int));
+
+/* getprotoent is in libsocket.so.1 */
+#define	getprotoent res_getprotoent
+struct protoent	*getprotoent __P((void));
+
+/* getprotoent_r is in libsocket.so.1 */
+#define	getprotoent_r res_getprotoent_r
+struct protoent	*getprotoent_r __P((struct protoent *, char *, int));
+
+/* getservbyname is in libsocket.so.1 and libnsl.so.1 */
+#define	getservbyname res_getservbyname
+struct servent *getservbyname __P((const char *, const char *));
+
+/* getservbyname_r is in libsocket.so.1 and libnsl.so.1 */
+#define	getservbyname_r res_getservbyname_r
+struct servent *getservbyname_r __P((const char *name, const char *,
+				struct servent *, char *, int));
+
+/* getservbyport is in libsocket.so.1 and libnsl.so.1 */
+#define	getservbyport res_getservbyport
+struct servent *getservbyport __P((int, const char *));
+
+/* getservbyport_r is in libsocket.so.1 and libnsl.so.1 */
+#define	getservbyport_r res_getservbyport_r
+struct servent *getservbyport_r __P((int port, const char *,
+				struct servent *, char *, int));
+
+/* getservent is in libsocket.so.1 */
+#define	getservent res_getservent
+struct servent *getservent __P((void));
+
+/* getservent_r is in libsocket.so.1 */
+#define	getservent_r res_getservent_r
+struct servent *getservent_r __P((struct servent *, char *, int));
+
+/* innetgr is in libsocket.so.1 */
+#define	innetgr res_innetgr
+int innetgr __P((const char *, const char *, const char *, const char *));
+
+/* setprotoent is in libsocket.so.1 */
+#define	setprotoent res_setprotoent
+void setprotoent __P((int));
+
+/* setservent is in libsocket.so.1 */
+#define	setservent res_setservent
+void setservent __P((int));
+
+
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _PORT_NETDB_H */
diff --git a/usr/src/lib/libresolv2_joy/include/port_resolv.h b/usr/src/lib/libresolv2_joy/include/port_resolv.h
new file mode 100644
index 0000000000..cd1a97d40c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/port_resolv.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef _PORT_RESOLV_H
+#define	_PORT_RESOLV_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/* RES_NSID has the same value as RES_NO_NIBBLE, which has been deleted  */
+#define	RES_NSID	0x00040000	/* request name server ID */
+
+/* RES_DEFAULT has a new value in libbind-6.0 */
+#undef RES_DEFAULT
+#define	RES_DEFAULT	(RES_RECURSE | RES_DEFNAMES | \
+	RES_DNSRCH | RES_NO_NIBBLE2)
+
+#ifndef __ultrix__
+u_int16_t	_getshort __P((const uchar_t *));
+u_int32_t	_getlong __P((const uchar_t *));
+#endif
+
+/* rename functions so they can be wrapped (see sunw/sunw_wrappers.c */
+#define	p_option isc_p_option
+const char *p_option(ulong_t option);
+#define	p_secstodate isc_p_secstodate
+char *p_secstodate(ulong_t secs);
+
+/* prevent namespace pollution */
+#define	res_protocolnumber	__res_protocolnumber
+#define	res_servicenumber	__res_servicenumber
+
+
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _PORT_RESOLV_H */
diff --git a/usr/src/lib/libresolv2_joy/include/probe_ipv6 b/usr/src/lib/libresolv2_joy/include/probe_ipv6
new file mode 100755
index 0000000000..371ac96c55
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/probe_ipv6
@@ -0,0 +1,73 @@
+#!/bin/sh
+
+# Copyright 2003 by Sun Microsystems, Inc. All rights reserved.
+# Use is subject to license terms.
+#
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+set -e
+PATH=/bin:/usr/bin:$PATH; export PATH
+trap "rm -f tmp$$[abc].[oc]" 0
+target=port_ipv6
+new=new_${target}.h
+old=${target}.h
+
+cat > tmp$$a.c <<EOF
+#include <sys/types.h>
+#include <netinet/in.h>
+struct sockaddr_in6 xx;
+EOF
+
+cat > tmp$$b.c <<EOF
+#include <sys/types.h>
+#include <netinet/in.h>
+struct in6_addr xx;
+EOF
+
+cat > tmp$$c.c <<EOF
+#include <sys/types.h>
+#include <netinet/in.h>
+struct sockaddr_in6 xx;
+main() { xx.sin6_scope_id = 0; }
+EOF
+
+cat > ${new} <<EOF
+
+/* This file is automatically generated. Do Not Edit. */
+
+#ifndef ${target}_h
+#define ${target}_h
+
+EOF
+
+if ${CC} -c tmp$$a.c > /dev/null 2>&1
+then
+        echo "#define HAS_INET6_STRUCTS" >> ${new}
+        if ${CC} -c tmp$$b.c > /dev/null 2>&1
+        then
+		:
+	else
+                echo "#define in6_addr in_addr6" >> ${new}
+        fi
+	if ${CC} -c tmp$$c.c > /dev/null 2>&1
+	then
+		echo "#define HAVE_SIN6_SCOPE_ID" >> ${new}
+	else
+		echo "#undef HAVE_SIN6_SCOPE_ID" >> ${new}
+	fi
+else
+        echo "#undef HAS_INET6_STRUCTS" >> ${new}
+fi
+echo  >> ${new}
+echo "#endif" >> ${new}
+if [ -f ${old} ]; then
+        if cmp -s ${new} ${old} ; then
+                rm -f ${new}
+        else
+                rm -f ${old}
+                mv ${new} ${old}
+        fi
+else
+        mv ${new} ${old}
+fi
+exit 0
diff --git a/usr/src/lib/libresolv2_joy/include/probe_ipv6.sh b/usr/src/lib/libresolv2_joy/include/probe_ipv6.sh
new file mode 100644
index 0000000000..371ac96c55
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/probe_ipv6.sh
@@ -0,0 +1,73 @@
+#!/bin/sh
+
+# Copyright 2003 by Sun Microsystems, Inc. All rights reserved.
+# Use is subject to license terms.
+#
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+set -e
+PATH=/bin:/usr/bin:$PATH; export PATH
+trap "rm -f tmp$$[abc].[oc]" 0
+target=port_ipv6
+new=new_${target}.h
+old=${target}.h
+
+cat > tmp$$a.c <<EOF
+#include <sys/types.h>
+#include <netinet/in.h>
+struct sockaddr_in6 xx;
+EOF
+
+cat > tmp$$b.c <<EOF
+#include <sys/types.h>
+#include <netinet/in.h>
+struct in6_addr xx;
+EOF
+
+cat > tmp$$c.c <<EOF
+#include <sys/types.h>
+#include <netinet/in.h>
+struct sockaddr_in6 xx;
+main() { xx.sin6_scope_id = 0; }
+EOF
+
+cat > ${new} <<EOF
+
+/* This file is automatically generated. Do Not Edit. */
+
+#ifndef ${target}_h
+#define ${target}_h
+
+EOF
+
+if ${CC} -c tmp$$a.c > /dev/null 2>&1
+then
+        echo "#define HAS_INET6_STRUCTS" >> ${new}
+        if ${CC} -c tmp$$b.c > /dev/null 2>&1
+        then
+		:
+	else
+                echo "#define in6_addr in_addr6" >> ${new}
+        fi
+	if ${CC} -c tmp$$c.c > /dev/null 2>&1
+	then
+		echo "#define HAVE_SIN6_SCOPE_ID" >> ${new}
+	else
+		echo "#undef HAVE_SIN6_SCOPE_ID" >> ${new}
+	fi
+else
+        echo "#undef HAS_INET6_STRUCTS" >> ${new}
+fi
+echo  >> ${new}
+echo "#endif" >> ${new}
+if [ -f ${old} ]; then
+        if cmp -s ${new} ${old} ; then
+                rm -f ${new}
+        else
+                rm -f ${old}
+                mv ${new} ${old}
+        fi
+else
+        mv ${new} ${old}
+fi
+exit 0
diff --git a/usr/src/lib/libresolv2_joy/include/res_update.h b/usr/src/lib/libresolv2_joy/include/res_update.h
new file mode 100644
index 0000000000..0c6967db56
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/res_update.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 1999 by Internet Software Consortium, Inc.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ *	$Id: res_update.h,v 1.3 2005/04/27 04:56:15 sra Exp $
+ */
+
+#ifndef __RES_UPDATE_H
+#define __RES_UPDATE_H
+
+/*! \file */
+
+#include <sys/types.h>
+#include <arpa/nameser.h>
+#include <isc/list.h>
+#include <resolv_joy.h>
+
+#ifndef	ORIGINAL_ISC_CODE
+/* definition of u_int32_t needed on Solaris */
+#include <sys/bitypes.h>
+/* need to rename ns_updrec before we define it here */
+#include "arpa/port_nameser.h"
+#endif	/* ORIGINAL_ISC_CODE */
+
+
+/*%
+ * This RR-like structure is particular to UPDATE.
+ */
+struct ns_updrec {
+	LINK(struct ns_updrec) r_link, r_glink;
+	ns_sect		r_section;	/*%< ZONE/PREREQUISITE/UPDATE */
+	char *		r_dname;	/*%< owner of the RR */
+	ns_class	r_class;	/*%< class number */
+	ns_type		r_type;		/*%< type number */
+	u_int32_t	r_ttl;		/*%< time to live */
+	u_char *	r_data;		/*%< rdata fields as text string */
+	u_int		r_size;		/*%< size of r_data field */
+	int		r_opcode;	/*%< type of operation */
+	/* following fields for private use by the resolver/server routines */
+	struct databuf *r_dp;		/*%< databuf to process */
+	struct databuf *r_deldp;	/*%< databuf's deleted/overwritten */
+	u_int		r_zone;		/*%< zone number on server */
+};
+typedef struct ns_updrec ns_updrec;
+typedef	LIST(ns_updrec)	ns_updque;
+
+#ifdef	ORIGINAL_ISC_CODE
+#define res_mkupdate		__res_mkupdate
+#define res_update		__res_update
+#define res_mkupdrec		__res_mkupdrec
+#define res_freeupdrec		__res_freeupdrec
+#define res_nmkupdate		__res_nmkupdate
+#define res_nupdate		__res_nupdate
+#else
+/* these are renamed in "port_nameser.h" */
+#endif	/* ORIGINAL_ISC_CODE */
+
+
+int		res_mkupdate __P((ns_updrec *, u_char *, int));
+int		res_update __P((ns_updrec *));
+ns_updrec *	res_mkupdrec __P((int, const char *, u_int, u_int, u_long));
+void		res_freeupdrec __P((ns_updrec *));
+int		res_nmkupdate __P((res_state, ns_updrec *, u_char *, int));
+int		res_nupdate __P((res_state, ns_updrec *, ns_tsig_key *));
+
+#endif /*__RES_UPDATE_H*/
+
+/*! \file */
diff --git a/usr/src/lib/libresolv2_joy/include/resolv_mt.h b/usr/src/lib/libresolv2_joy/include/resolv_mt.h
new file mode 100644
index 0000000000..500d4d764c
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/resolv_mt.h
@@ -0,0 +1,47 @@
+#ifndef _RESOLV_MT_H
+#define _RESOLV_MT_H
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv_joy.h>
+
+/* Access functions for the libresolv private interface */
+
+int	__res_enable_mt(void);
+int	__res_disable_mt(void);
+
+/* Per-thread context */
+
+typedef struct {
+int	no_hosts_fallback_private;
+int	retry_save;
+int	retry_private;
+char	inet_nsap_ntoa_tmpbuf[255*3];
+char	sym_ntos_unname[20];
+char	sym_ntop_unname[20];
+char	p_option_nbuf[40];
+char	p_time_nbuf[40];
+char	precsize_ntoa_retbuf[sizeof "90000000.00"];
+char	loc_ntoa_tmpbuf[sizeof
+"1000 60 60.000 N 1000 60 60.000 W -12345678.00m 90000000.00m 90000000.00m 90000000.00m"];
+char	p_secstodate_output[15];
+} mtctxres_t;
+
+/* Thread-specific data (TSD) */
+
+mtctxres_t	*___mtctxres(void);
+#define mtctxres	(___mtctxres())
+
+/* Various static data that should be TSD */
+
+#define sym_ntos_unname		(mtctxres->sym_ntos_unname)
+#define sym_ntop_unname		(mtctxres->sym_ntop_unname)
+#define inet_nsap_ntoa_tmpbuf	(mtctxres->inet_nsap_ntoa_tmpbuf)
+#define p_option_nbuf		(mtctxres->p_option_nbuf)
+#define p_time_nbuf		(mtctxres->p_time_nbuf)
+#define precsize_ntoa_retbuf	(mtctxres->precsize_ntoa_retbuf)
+#define loc_ntoa_tmpbuf		(mtctxres->loc_ntoa_tmpbuf)
+#define p_secstodate_output	(mtctxres->p_secstodate_output)
+
+#endif /* _RESOLV_MT_H */
diff --git a/usr/src/lib/libresolv2_joy/include/sunw_port_after.h b/usr/src/lib/libresolv2_joy/include/sunw_port_after.h
new file mode 100644
index 0000000000..bff64a74c1
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/sunw_port_after.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef	_SUNW_PORT_AFTER_H
+#define	_SUNW_PORT_AFTER_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * rename setnetgrent and endnetgrent which were formerly in a separate irs
+ * shared library.  These functions should come from libc.so
+ */
+#define	setnetgrent res_setnetgrent
+#ifdef SETNETGRENT_ARGS
+void setnetgrent(SETNETGRENT_ARGS);
+#else
+void setnetgrent(const char *netgroup);
+#endif
+
+#define	endnetgrent res_endnetgrent
+void endnetgrent(void);
+
+
+/*
+ * include ports for the public header files. ISC's versions are quite different
+ * from those currently in OpenSolaris.
+ */
+
+#ifdef _RESOLV_JOY_H
+#include <port_resolv.h>
+#endif /* _RESOLV_JOY_H */
+
+#ifdef _NETDB_H
+#include <port_netdb.h>
+#endif /* _NETDB_H */
+
+#ifdef _ARPA_INET_H
+#include <arpa/port_inet.h>
+#endif /* _ARPA_INET_H */
+
+#ifdef _ARPA_NAMESER_H
+#include <arpa/port_nameser.h>
+#endif /* _ARPA_NAMESER_H */
+
+
+#ifdef _ARPA_NAMESER_COMPAT_H
+/* no changes */
+#endif /* _ARPA_NAMESER_COMPAT_H */
+
+/* version-specific defines */
+#include <os_version.h>
+
+/*
+ * Prior to 2.6, Solaris needs a prototype for gethostname().
+ */
+#if (OS_MAJOR == 5 && OS_MINOR < 6)
+extern int gethostname(char *, size_t);
+#endif
+/*
+ * gethostid() was not available until 2.5
+ * setsockopt(SO_REUSEADDR) fails on unix domain sockets before 2.5
+ * use ioctl(FIONBIO) rather than fcntl() calls to set/clear non-blocking i/o.
+ */
+#if (OS_MAJOR == 5 && OS_MINOR < 5)
+#define	GET_HOST_ID_MISSING
+#define	NO_UNIX_REUSEADDR
+#define	USE_FIONBIO_IOCTL
+#endif
+
+#if (OS_MAJOR == 5 && OS_MINOR < 11)
+#define	NEED_STRSEP
+extern char *strsep(char **, const char *);
+#endif
+
+
+/*
+ * Solaris 2.5 and later have getrlimit(), setrlimit() and getrusage().
+ */
+#if (OS_MAJOR > 5 || (OS_MAJOR == 5 && OS_MINOR >= 5))
+#include <sys/resource.h>
+#define	HAVE_GETRUSAGE
+#define	RLIMIT_TYPE rlim_t
+#define	RLIMIT_FILE_INFINITY
+#endif
+
+/* the default syslog facility of named/lwresd. */
+#ifndef ISC_FACILITY
+#define	ISC_FACILITY LOG_DAEMON
+#endif
+
+
+/*
+ * Solaris 8 has if_nametoindex().
+ */
+#if (OS_MAJOR > 5 || (OS_MAJOR == 5 && OS_MINOR >= 8))
+#define	USE_IFNAMELINKID
+#endif
+
+#undef ALIGN
+#if (OS_MAJOR == 5 && OS_MINOR > 8)
+#define	ALIGN(x) (((uintptr_t)(x) + (sizeof (char *) - 1UL)) & \
+		~(sizeof (char *) - 1UL))
+#else
+#define	ALIGN(x) (((unsigned long)(x) + (sizeof (char *) - 1UL)) & \
+		~(sizeof (char *) - 1UL))
+#endif
+
+#if (OS_MAJOR == 5 && OS_MINOR < 5)
+#ifndef USE_FIONBIO_IOCTL
+#define	USE_FIONBIO_IOCTL 1
+#endif
+#endif
+
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SUNW_PORT_AFTER_H */
diff --git a/usr/src/lib/libresolv2_joy/include/sunw_port_before.h b/usr/src/lib/libresolv2_joy/include/sunw_port_before.h
new file mode 100644
index 0000000000..776e311fcc
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/sunw_port_before.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef	_SUNW_PORT_BEFORE_H
+#define	_SUNW_PORT_BEFORE_H
+
+#ifdef SUNW_OPTIONS
+#include <conf/sunoptions.h>
+#endif
+
+/* version-specific defines */
+#include <os_version.h>
+#if (OS_MAJOR == 5 && OS_MINOR < 6)
+#ifndef SOLARIS_BITTYPES
+#define	NEED_SOLARIS_BITTYPES 1
+#endif
+#endif
+
+#if (OS_MAJOR == 5 && OS_MINOR < 5)
+#undef HAS_PTHREADS
+#else
+#define	HAS_PTHREADS
+#endif
+
+#if defined(HAS_PTHREADS) && defined(_REENTRANT)
+#define DO_PTHREADS
+#endif
+
+/*
+ * need these if we are using public versions of nameser.h, resolv.h, and
+ * inet.h
+ */
+#include <sys/param.h>
+#if (!defined(BSD)) || (BSD < 199306)
+#include <sys/bitypes.h>
+#else
+#include <sys/types.h>
+#endif
+#include <sys/cdefs.h>
+
+#endif	/* _SUNW_PORT_BEFORE_H */
diff --git a/usr/src/lib/libresolv2_joy/include/sys/bitypes.h b/usr/src/lib/libresolv2_joy/include/sys/bitypes.h
new file mode 100644
index 0000000000..54fb42bad7
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/sys/bitypes.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1998, 1999, 2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: bitypes.h,v 1.7 2008/11/14 02:54:35 tbox Exp $ */
+
+#ifndef __BIT_TYPES_DEFINED__
+#define __BIT_TYPES_DEFINED__
+
+	/*
+	 * Basic integral types.  Omit the typedef if
+	 * not possible for a machine/compiler combination.
+	 */
+
+#ifdef NEED_SOLARIS_BITTYPES
+	typedef /*signed*/ char            int8_t;
+	typedef short                     int16_t;
+	typedef int                       int32_t;
+#endif
+	typedef unsigned char            u_int8_t;
+	typedef unsigned short          u_int16_t;
+	typedef unsigned int            u_int32_t;
+
+#endif	/* __BIT_TYPES_DEFINED__ */
diff --git a/usr/src/lib/libresolv2_joy/include/sys/cdefs.h b/usr/src/lib/libresolv2_joy/include/sys/cdefs.h
new file mode 100644
index 0000000000..67aac00cc7
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/include/sys/cdefs.h
@@ -0,0 +1,144 @@
+/*
+ * ++Copyright++ 1991, 1993
+ * -
+ * Copyright (c) 1991, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * -
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ * -
+ * --Copyright--
+ */
+
+/*
+ *	@(#)cdefs.h	8.1 (Berkeley) 6/2/93
+ *	$Id: cdefs.h,v 1.2 2004/07/19 05:54:07 marka Exp $
+ */
+
+#ifndef	_CDEFS_H_
+#define	_CDEFS_H_
+
+#if defined(__cplusplus)
+#define	__BEGIN_DECLS	extern "C" {
+#define	__END_DECLS	};
+#else
+#define	__BEGIN_DECLS
+#define	__END_DECLS
+#endif
+
+/*
+ * The __CONCAT macro is used to concatenate parts of symbol names, e.g.
+ * with "#define OLD(foo) __CONCAT(old,foo)", OLD(foo) produces oldfoo.
+ * The __CONCAT macro is a bit tricky -- make sure you don't put spaces
+ * in between its arguments.  __CONCAT can also concatenate double-quoted
+ * strings produced by the __STRING macro, but this only works with ANSI C.
+ */
+#if defined(__STDC__) || defined(__cplusplus)
+#define	__P(protos)	protos		/* full-blown ANSI C */
+#define	__CONCAT(x,y)	x ## y
+#define	__STRING(x)	#x
+
+#define	__const		const		/* define reserved names to standard */
+#define	__signed	signed
+#define	__volatile	volatile
+#if defined(__cplusplus)
+#define	__inline	inline		/* convert to C++ keyword */
+#else
+#ifndef __GNUC__
+#define	__inline			/* delete GCC keyword */
+#endif /* !__GNUC__ */
+#endif /* !__cplusplus */
+
+#else	/* !(__STDC__ || __cplusplus) */
+#define	__P(protos)	()		/* traditional C preprocessor */
+#define	__CONCAT(x,y)	x/**/y
+#define	__STRING(x)	"x"
+
+#ifndef __GNUC__
+#define	__const				/* delete pseudo-ANSI C keywords */
+#define	__inline
+#define	__signed
+#define	__volatile
+/*
+ * In non-ANSI C environments, new programs will want ANSI-only C keywords
+ * deleted from the program and old programs will want them left alone.
+ * When using a compiler other than gcc, programs using the ANSI C keywords
+ * const, inline etc. as normal identifiers should define -DNO_ANSI_KEYWORDS.
+ * When using "gcc -traditional", we assume that this is the intent; if
+ * __GNUC__ is defined but __STDC__ is not, we leave the new keywords alone.
+ */
+#ifndef	NO_ANSI_KEYWORDS
+#define	const				/* delete ANSI C keywords */
+#define	inline
+#define	signed
+#define	volatile
+#endif
+#endif	/* !__GNUC__ */
+#endif	/* !(__STDC__ || __cplusplus) */
+
+/*
+ * GCC1 and some versions of GCC2 declare dead (non-returning) and
+ * pure (no side effects) functions using "volatile" and "const";
+ * unfortunately, these then cause warnings under "-ansi -pedantic".
+ * GCC2 uses a new, peculiar __attribute__((attrs)) style.  All of
+ * these work for GNU C++ (modulo a slight glitch in the C++ grammar
+ * in the distribution version of 2.5.5).
+ */
+#if !defined(__GNUC__) || __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 5)
+#define	__attribute__(x)	/* delete __attribute__ if non-gcc or gcc1 */
+#if defined(__GNUC__) && !defined(__STRICT_ANSI__)
+#define	__dead		__volatile
+#define	__pure		__const
+#endif
+#endif
+
+/* Delete pseudo-keywords wherever they are not available or needed. */
+#ifndef __dead
+#define	__dead
+#define	__pure
+#endif
+
+#endif /* !_CDEFS_H_ */
diff --git a/usr/src/lib/libresolv2_joy/sparc/Makefile b/usr/src/lib/libresolv2_joy/sparc/Makefile
new file mode 100644
index 0000000000..a333224278
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/sparc/Makefile
@@ -0,0 +1,30 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libresolv2_joy/sparcv9/Makefile b/usr/src/lib/libresolv2_joy/sparcv9/Makefile
new file mode 100644
index 0000000000..ceed393e0d
--- /dev/null
+++ b/usr/src/lib/libresolv2_joy/sparcv9/Makefile
@@ -0,0 +1,38 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+# With the adition of BIND 8.3.3, the symbol table for 64 bit went over
+# the limit for Kpic, so we've added -KPIC here, for just the 64 bit 
+# library. This avoids compiling the 32-bit library with PIC unnecessarily.
+
+sparcv9_C_PICFLAGS = -K PIC
+sparcv9_CC_PICFLAGS = -KPIC
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64)
diff --git a/usr/src/lib/libscf/inc/libscf.h b/usr/src/lib/libscf/inc/libscf.h
index c72c1b479c..f4502b7f14 100644
--- a/usr/src/lib/libscf/inc/libscf.h
+++ b/usr/src/lib/libscf/inc/libscf.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright 2016 RackTop Systems.
  */
 
@@ -862,8 +863,13 @@ int smf_notify_del_params(const char *, const char *, int32_t);
 
 /*
  * SMF exit status definitions
+ *
+ * The SMF_EXIT_NODAEMON exit status should be used when a method does not
+ * need to run any persistent process. This indicates success, abandons the
+ * contract, and allows dependencies to be met.
  */
 #define	SMF_EXIT_OK		  0
+#define	SMF_EXIT_NODAEMON	 94
 #define	SMF_EXIT_ERR_FATAL	 95
 #define	SMF_EXIT_ERR_CONFIG	 96
 #define	SMF_EXIT_MON_DEGRADE	 97
diff --git a/usr/src/lib/libshare/nfs/libshare_nfs.c b/usr/src/lib/libshare/nfs/libshare_nfs.c
index 8f1bf6cddf..c2d95210c7 100644
--- a/usr/src/lib/libshare/nfs/libshare_nfs.c
+++ b/usr/src/lib/libshare/nfs/libshare_nfs.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright 2016 Nexenta Systems, Inc.
  * Copyright (c) 2014, 2016 by Delphix. All rights reserved.
  */
@@ -2835,9 +2836,16 @@ nfs_init()
 
 	ret = initprotofromsmf();
 	if (ret != SA_OK) {
-		(void) printf(dgettext(TEXT_DOMAIN,
-		    "NFS plugin problem with SMF repository: %s\n"),
-		    sa_errorstr(ret));
+		/*
+		 * This is a workaround.  See the comment in
+		 * cmd/fs.d/nfs/lib/smfcfg.c for an explanation.
+		 */
+		if (getzoneid() == GLOBAL_ZONEID ||
+		    ret != SCF_ERROR_NOT_FOUND) {
+			(void) printf(dgettext(TEXT_DOMAIN,
+			    "NFS plugin problem with SMF repository: %s\n"),
+			    sa_errorstr(ret));
+		}
 		ret = SA_OK;
 	}
 	add_defaults();
diff --git a/usr/src/lib/libshell/Makefile b/usr/src/lib/libshell/Makefile
index b584728d5f..1cce2316f0 100644
--- a/usr/src/lib/libshell/Makefile
+++ b/usr/src/lib/libshell/Makefile
@@ -64,6 +64,5 @@ $(SUBDIRS):	FRC
 FRC:
 
 include Makefile.demo
-include Makefile.doc
 
 include ../Makefile.targ
diff --git a/usr/src/lib/libshell/Makefile.doc b/usr/src/lib/libshell/Makefile.doc
deleted file mode 100644
index 5f507d28d9..0000000000
--- a/usr/src/lib/libshell/Makefile.doc
+++ /dev/null
@@ -1,77 +0,0 @@
-#
-# CDDL HEADER START
-#
-# The contents of this file are subject to the terms of the
-# Common Development and Distribution License (the "License").
-# You may not use this file except in compliance with the License.
-#
-# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
-# or http://www.opensolaris.org/os/licensing.
-# See the License for the specific language governing permissions
-# and limitations under the License.
-#
-# When distributing Covered Code, include this CDDL HEADER in each
-# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
-# If applicable, add the following below this CDDL HEADER, with the
-# fields enclosed by brackets "[]" replaced with your own identifying
-# information: Portions Copyright [yyyy] [name of copyright owner]
-#
-# CDDL HEADER END
-#
-
-#
-# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
-# Use is subject to license terms.
-#
-
-ROOTDOCDIRBASE=	$(ROOT)/usr/share/doc/ksh
-
-DOCFILES= \
-	RELEASE \
-	README \
-	TYPES \
-	DESIGN \
-	COMPATIBILITY \
-	OBSOLETE \
-	shell_styleguide.docbook \
-	images/tag_bourne.png \
-	images/tag_i18n.png \
-	images/tag_ksh88.png \
-	images/tag_ksh93.png \
-	images/tag_ksh.png \
-	images/tag_l10n.png \
-	images/tag_perf.png \
-	images/callouts/1.png \
-	images/callouts/2.png \
-	images/callouts/3.png \
-	images/callouts/4.png \
-	images/callouts/5.png \
-	images/callouts/6.png \
-	images/callouts/7.png \
-	images/callouts/8.png \
-	images/callouts/9.png \
-	images/callouts/10.png
-
-# Documentation rules
-$(ROOTDOCDIRBASE)/%: common/%
-	$(INS.file)
-
-$(ROOTDOCDIRBASE)/%: misc/%
-	$(INS.file)
-
-ROOTDOCDIRS=	\
-	$(ROOTDOCDIRBASE) .WAIT \
-	$(ROOTDOCDIRBASE)/images .WAIT \
-	$(ROOTDOCDIRBASE)/images/callouts
-
-# Generic documentation rules
-DOCFILESRCDIR=         common
-ROOTDOCFILES=  $(DOCFILES:%=$(ROOTDOCDIRBASE)/%)
-$(ROOTDOCDIRS) :=      OWNER =         root
-$(ROOTDOCDIRS) :=      GROUP =         bin
-$(ROOTDOCDIRS) :=      DIRMODE =       755
-
-$(ROOTDOCDIRS):
-	$(INS.dir)
-
-install: $(ROOTDOCDIRS) .WAIT $(ROOTDOCFILES)
diff --git a/usr/src/lib/libshell/common/COMPATIBILITY b/usr/src/lib/libshell/common/COMPATIBILITY
deleted file mode 100644
index d4d645a99a..0000000000
--- a/usr/src/lib/libshell/common/COMPATIBILITY
+++ /dev/null
@@ -1,134 +0,0 @@
-
-			KSH-93 VS. KSH-88
-
-
-The following is a list of known incompatibilities between ksh-93 and ksh-88.
-I have not include cases that are clearly bugs in ksh-88.  I also have
-omitted features that are completely upward compatible.
-
-1.	Functions, defined with name() with ksh-93 are compatible with
-	the POSIX standard, not with ksh-88.  No local variables are
-	permitted, and there is no separate scope.  Functions defined
-	with the function name syntax, maintain compatibility.
-	This also affects function traces.
-
-2.	! is now a reserved word.  As a result, any command by that
-	name will no longer work with ksh-93.
-
-3.	The -x attribute of alias and typeset -f is no longer
-	effective and the ENV file is only read for interactive
-	shells.  You need to use FPATH to make function definitions
-	visible to scripts.
-
-4.	A built-in command named command has been added which is
-	always found before the PATH search.  Any script which uses
-	this name as the name of a command (or function) will not
-	be compatible.
-
-5.	The output format for some built-ins has changed.  In particular
-	the output format for set, typeset and alias now have single
-	quotes around values that have special characters.  The output
-	for trap without arguments has a format that can be used as input.
-
-6.	With ksh-88, a dollar sign ($') followed by a single quote was
-	interpreted literally.  Now it is an ANSI-C string.  You
-	must quote the dollar sign to get the previous behavior.
-	Also, a $ in front of a " indicates that the string needs
-	to be translated for locales other than C or POSIX.  The $ 
-	is ignored in the C and POSIX locale.
-
-7.	With ksh-88, tilde expansion did not take place inside ${...}.
-	with ksh-93, ${foo-~} will cause tilde expansion if foo is
-	not set.  You need to escape the ~ for the previous behavior.
-
-8.      Some changes in the tokenizing rules where made that might
-	cause some scripts with previously ambiguous use of quoting
-	to produce syntax errors.
-
-9.	Programs that rely on specific exit values for the shell,
-	(rather than 0 or non-zero) may not be compatible.  The
-	exit status for many shell failures has been changed.
-
-10.	Built-ins in ksh-88 were always executed before looking for
-	the command in the PATH variable.  This is no longer true.
-	Thus, with ksh-93, if you have the current directory first
-	in your PATH, and you have a program named test in your
-	directory, it will be executed when you type test; the
-	built-in version will be run at the point /bin is found
-	in your PATH. 
-
-11.	Some undocumented combinations of argument passing to ksh
-	builtins no longer works since ksh-93 is getopts conforming
-	with respect to its built-ins.  For example, typeset -8i
-	previously would work as a synonym for typeset -i8.
-
-12.	Command substitution and arithmetic expansion are now performed
-	on PS1, PS3, and ENV when they are expanded.  Thus,  ` and $(
-	as part of the value of these variables must be preceded by a \
-	to preserve their previous behavior.
-
-13.	The ERRNO variable has been dropped.
-
-14.	If the file name following a redirection symbol contain pattern
-	characters they will only be expanded for interactive shells.
-
-15.	The arguments to a dot script will be restored when it completes. 
-
-16.	The list of tracked aliases is not displayed with alias unless
-	the -t option is specified.
-
-17.	The POSIX standard requires that test "$arg" have exit status
-	of 0, if and only if $arg is null.  However, since this breaks
-	programs that use test -t, ksh93 treats an explicit test -t
-	as if the user had entered test -t 1.
-
-18.	The ^T directive of emacs mode has been changed to work the
-	way it does in gnu-emacs.
-
-19.	ksh-88 allowed unbalanced parenthes within ${name op val} whereas
-	ksh-93 does not.  Thus, ${foo-(} needs to be written as ${foo-\(}
-	which works with both versions.
-
-20.     kill -l in ksh-93 lists only the signal names, not their numerical
-	values.
-
-21.	Local variables defined by typeset are statically scoped in
-	ksh93.  In ksh88 they were dynamically scoped although this
-	behavior was never documented.
-
-22.	The value of the variable given to getopts is set to ? when
-	the end-of-options is reached to conform to the POSIX standard.
-
-23.	Since the POSIX standard requires that octal constants be
-	recongnized, doing arithmetic on typeset -Z variables can
-	yield different results that with ksh88.  Most of these
-	differences were eliminated in ksh93o.
-
-24.	Starting after ksh93l, If you run ksh name, where name does
-	not contain a /, the current directory will be searched
-	before doing a path search on name as required by the POSIX
-	shell standard.  
-
-25.	In ksh93, cd - will output the directory that it changes
-	to on standard output as required by X/Open.  With ksh88,
-	this only happened for interactive shells.
-
-26.	As an undocumented feature of ksh-88, a leading 0 to an
-	assignment of an integer variable caused that variable
-	to be treated as unsigned.  This behavior was removed
-	starting in ksh93p.
-
-27.	The getopts builtin in ksh93 requires that optstring contain
-	a leading + to allow options to begin with a +.
-
-28.	In emacs/gmacs mode, control-v will not display the version when
-	the stty lnext character is set to control-v or is unset.
-	The sequence escape control-v will display the shell version.
-
-29.	In ksh88, DEBUG traps were executed. after each command.  In ksh93
-	DEBUG traps are exeucted before each command.
-
-30.	In ksh88, a redirection to a file name given by an empty string was
-	ignored.  In ksh93, this is an error.
-I am interested in expanding this list so please let me know if you
-uncover any others.
diff --git a/usr/src/lib/libshell/common/DESIGN b/usr/src/lib/libshell/common/DESIGN
deleted file mode 100644
index c11c0aff1e..0000000000
--- a/usr/src/lib/libshell/common/DESIGN
+++ /dev/null
@@ -1,170 +0,0 @@
-Here is an overview of the source code organization for ksh93.
-
-Directory layout:
-
-	The directory include contains header files for ksh93.
-	The files nval.h and shell.h are intended to be public
-	headers and can be used to add runtime builtin command.
-	The remainder are private.
-
-	The directory data contains readonly data files for ksh93.
-	The man pages for built-ins are in builtins.c rather
-	than included as statics with the implementations in the
-	bltins directory because some systems don't make static const
-	data readonly and we want these to be shared by all running
-	shells.
-
-	The directory edit contains the code for command line
-	editing and history.
-
-	The fun directory contains some shell function such as
-	pushd, popd, and dirs.
-
-	The directory features contains files that are used to generate
-	header files in the FEATURE directory.  Most of these files
-	are in a format that is processed by iffe.
-
-	The directory bltins contains code for most of the built-in
-	commands.  Additional built-in commands are part of libcmd.
-
-	The directory sh contains most of the code for ksh93.
-
-	The directory tests contains a number of regression tests.
-	In most cases, when a bug gets fixed, a test is added to
-	one of these files.  The regression tests can be run by
-	going to this directory and running
-		SHELL=shell_path shell_path shtests
-	where shell_path is an absolute pathname for the shell to
-	be tested.
-
-	The top level directory contains the nmake Makefile, a README,
-	and several documentation files.  The RELEASE file contains
-	the list of bug fixes and new features since the original
-	ksh93 release.  The file COMPATIBILITY is a list of all
-	known incompatibilities with ksh88.
-
-	The  bash_pre_rc.sh is a startup script used when emulating
-	bash if the shell is compiled with SHOPT_BASH and the shell
-	is invoked as bash.  The bash emulation is not complete.
- 
-Include directory:
-	1.	argnod.h contains the type definitions for command
-		nodes, io nodes, argument nodes, and for positional
-		parameters.a  It defines the prototypes for
-		all the positional parameters functions.
-	2.	builtins.h contains prototypes for builtins as well
-		as symbolic constants that refer to the name-pairs
-		that are associated with some of the built-ins.
-		It also contains prototypes for many of the strings.
-	3.	defs.h is the catch all for all definitions that
-		don't fit elsewhere and it includes several other
-		headers.  It defines a strucuture that contains ksh
-		global data, sh, and a structure that contains per
-		function data, sh.st. 
-	4.	edit.h contains definitions that are common to both
-		vi and emacs edit modes.
-	5.	env.h contains interfaces for creating and modifying
-		environment variables. 
-	6.	fault.h contains prototypes for signal related
-		functions and trap and fault handling.
-	7.	fcin.h contains macro and function definitions for
-		reading from a file or string.
-	8.	history.h contains macros and functions definitions
-		related to history file processing.
-	9.	jobs.h contains the definitions relating to job
-		processing and control.
-	10.	lexstates.h contains the states associated with
-		lexical processing.
-	11.	name.h contains the internal definitions related
-		to name-value pair processing.
-	12.	national.h contains a few I18N definitions, mostly
-		obsolete.
-	13.	nval.h is the public interface to the name-value
-		pair library that is documented with nval.3.
-	14.	path.h contains the interface for pathname processing
-		and pathname searching.
-	15.	shell.h is the public interface for shell functions
-		that are documented int shell.3.
-	16.	shlex.h contains the lexical token definitions and
-		interfaces for lexical analysis.
-	17.	shnodes.h contains the definition of the structures
-		for each of the parse nodes and flags for the attributes.
-	18.	shtable.h contains some interfaces and functions for
-		table lookup.
-	19.	streval.h contains the interface to the arithmetic
-		functions.
-	20.	terminal.h is a header file that includes the appropriate
-		terminal include.
-	21.	test.h contains the definitions for the test and [[...]]
-		commands.
-	22.	timeout.h contains the define constant for the maximum
-		shell timeout.
-	23.	ulimit.h includes the appropriate resource header.
-	24.	variables.h contains symbolic constants for the built-in
-		shell variables.
-
-sh directory:
-	1.	args.c contains functions for parsing shell options
-		and for processing positional parameters.
-	2.	arith.c contains callback functions for the streval.c
-		library and the interface to shell arithmetic.
-	3.	array.c contains the code for indexed and associative
-		arrays.
-	4.      bash.h contains code used when compiling with SHOPT_BASH
-		to add bash specific features such as shopt.
-	5.	defs.c contains the data definitions for global symbols.
-	6.	deparse.c contains code to generate shell script from
-		a parse tree.
-	7.	env.c contains code to add and delete environment variables
-		to an environment list.
-	8.	expand.c contains code for file name expansion and
-		file name generation.
-	9.	fault.c contains code for signal processing, trap
-		handling and termination.
-	10.	fcin.c contains code for reading and writing a character
-		at a time from a file or string.
-	11.	init.c contains initialization code and callbacks
-		for get and set functions for built-in variables.	
-	12.	io.o contains code for redirections and managing file
-		descriptors and file streams.
-	13.	jobs.c contains the code for job management.
-	14.	lex.c contains the code for the lexical analyzer.
-	15.	macro.c contains code for the $ macro expansions, including
-		here-documents.
-	16.	main.c contains the calls to initialization, profile
-		processing and the main evaluation loop as well as
-		mail processing.
-	17.	name.c contains the name-value pair routines that are
-		built on the hash library in libast.
-	18.	nvdisc.c contains code related to name-value pair disciplines.
-	19.	nvtree.c contains code for compound variables and for
-		walking the namespace.
-	20.	nvtype.c contains most of the code related to types that
-		are created with typeset -T.
-	21.	parse.c contains the code for the shell parser.
-	22.	path.c contains the code for pathname lookup and
-		some path functions.  It also contains the code
-		that executes commands and scripts.
-	23.	pmain.c is just a calls sh_main() so that all of the
-		rest of the shell can be in a shared library.
-	24.	shcomp.c contains the main program to the shell
-		compiler.  This program parses a script and creates
-		a file that the shell can read containing the parse tree.
-	25.	streval.c is an C arithmetic evaluator.
-	26.	string.c contains some string related functions.
-	27.	subshell.c contains the code to save and restore
-		environments so that subshells can run without creating
-		a new process.
-	28.	suid_exec.c contains the program from running execute
-		only and/or setuid/setgid scripts.
-	29.	tdump.c contains the code to dump a parse tree into
-		a file.
-	30.	timers.c contains code for multiple event timeouts.
-	31.	trestore contians the code for restoring the parse
-		tree from the file created by tdump.
-	32.	userinit.c contains a dummy userinit() function.
-		This is now obsolete with the new version of sh_main().
-	33.	waitevent.c contains the sh_waitnotify function so
-		that builtins can handle processing events when the
-		shell is waiting for input or for process completion.
-	34.	xec.c is the main shell executuion loop.
diff --git a/usr/src/lib/libshell/common/OBSOLETE b/usr/src/lib/libshell/common/OBSOLETE
deleted file mode 100644
index c29cb8bb63..0000000000
--- a/usr/src/lib/libshell/common/OBSOLETE
+++ /dev/null
@@ -1,152 +0,0 @@
-.sp 3
-.tl ''Ksh Features That Are Obsolete in Ksh93''
-.sp 2
-.AL 1
-.LI
-Using a pair of grave accents \^\fB\(ga\fR ... \fB\(ga\fR\^
-for command substition.  Use \fB$(\fR ... \fB)\fR instead.
-.LI
-.B FCEDIT
-is an obsolete name for
-the default editor name for the
-.B hist
-command.
-.B FCEDIT
-is not used when
-.B HISTEDIT
-is set.  Use
-.B HISTEDIT
-instead.
-.LI
-The newtest (\fB[[\fR ... \fB]]\fR) operator
-\fB\-a\fP \fIfile\fP
-is obsolete.  Use
-\fB\-e\fP instead.
-.LI
-The newtest (\fB[[\fR ... \fB]]\fR) operator
-.BR = ,
-as used in
-\fIstring\fP \fB=\fP \fIpattern\fP
-is obsolete.  Use
-\fB==\fP instead.
-.LI
-The following obsolete arithmetic comparisons are also permitted:
-.in +5
-.VL 20
-.LI "\fIexp1\fP \fB\-eq\fP \fIexp2\fP"
-True, if
-.I exp1
-is equal to
-.IR exp2 .
-.LI "\fIexp1\fP \fB\-ne\fP \fIexp2\fP"
-True, if
-.I exp1
-is not equal to
-.IR exp2 .
-.LI "\fIexp1\fP \fB\-lt\fP \fIexp2\fP"
-True, if
-.I exp1
-is less than
-.IR exp2 .
-.LI "\fIexp1\fP \fB\-gt\fP \fIexp2\fP"
-True, if
-.I exp1
-is greater than
-.IR exp2 .
-.LI "\fIexp1\fP \fB\-le\fP \fIexp2\fP"
-True, if
-.I exp1
-is less than or equal to
-.IR exp2 .
-.LI "\fIexp1\fP \fB\-ge\fP \fIexp2\fP"
-True, if
-.I exp1
-is greater than or equal to
-.IR exp2 .
-.LE		\"	End .VL
-.in -5
-.LI
-Using test -t or [ -t ] without specifying the file unit number.
-.LI
-The
-.B \-k
-option to the \fBset\fR builtin is obsolete.  It causes
-.I all\^
-variable assignment arguments are placed in the environment,
-even if they occur after the command name.
-The following
-first prints
-.B "a=b c"
-and then
-.BR c :
-There is no alternative.
-.LI
-The obsolete
-.B \-xf
-option of the
-.B typeset
-command allows a function to be exported
-to scripts that are executed without a separate
-invocation of the shell.
-Functions that need to be defined across separate
-invocations of the shell should
-be placed in a directory and the
-.B FPATH
-variable should contains the name of this directory.
-They may also
-be specified in the
-.B ENV
-file with the 
-.B \-xf
-option of
-.BR typeset .
-.LI
-The shell environment variable
-.B FCEDIT
-is obsolete.  Use
-.B HISTEDIT
-instead.
-.LI
-In the
-.B \-s
-option
-(to \fBfc\fR or \fBhist\fR command???)
-(
-and in obsolete versions, the editor name
-.B \-
-)
-is used to skip the editing phase and
-to re-execute the command.
-.LI
-The
-.B \-t
-option to \fBalias\fR builtin is is obsolete.  It
-is used to set and list tracked aliases.
-There is no replacement.
-.LI
-The shell command line option
-.B \-t
-is obsolete.  This option cause the shell to exit after reading
-and executing one command.  The is no replacement (although ending
-\&"command" with the exit builtin should have the same effect).
-.LI
-As an obsolete feature of the "set" builtin,
-if the first
-.I arg\^
-is
-.B \-
-then the
-.B \-x
-and
-.B \-v
-options are turned off and the next
-.I arg
-is treated as the first argument.
-Using
-.B \+
-rather than
-.B \-
-causes these options to be turned off.
-These options can also be used upon invocation of the shell.
-.LE
-
diff --git a/usr/src/lib/libshell/common/README b/usr/src/lib/libshell/common/README
deleted file mode 100644
index 3a953df356..0000000000
--- a/usr/src/lib/libshell/common/README
+++ /dev/null
@@ -1,232 +0,0 @@
-This directory, and its subdirectories contain the source code
-for ksh-93; the language described in the second addition of
-the book, "The KornShell Command and Programming Language," by
-Morris Bolsky and David Korn which is published by Prentice Hall.
-ksh-93 has been compiled and run on several machines with several
-operating systems.  The end of this file contains a partial list of
-operating systems and machines that ksh-93 has been known to run on.
-
-The layout of files for ksh-93 has changed somewhat since ksh-88,
-the last major release.  Most of the source code for ksh remains in
-the sh directory.  However, the shell editing and history routines
-are in the edit sub-directory.  The code for shell built-ins is
-in the bltins directory.  The data directory contains read-only
-data tables and messages that are used by the shell.  The include
-files remain in the include directory and the shlib directory
-is gone.  The features directory replaces the older install
-directory. The method for generating systems specific feature
-information has changed substantially.
-
-The Makefile file contains several compilation options that can be set
-before compiling ksh.  Options are of the form SHOPT_option and become
-#define inside the code.  These options are set to their recommended
-value and some of these may disappear as options in future releases.
-A value of 0, or no value  represents off, 1 represents on.
-Note that == is needed, not =, because these are nmake state variables
-and changing their value will cause all modules that could be affected
-by this change to be recompiled.
-The options have the following defaults and meanings:
-    ACCT         off Shell accounting.
-    ACCTFILE     off Enable per user accounting info.
-    AUDIT	 off For auditing specific users
-    AUDITFILE	 "/etc/ksh_audit"
-    APPEND       on  Allows var+=val string and array append.
-    BASH         off Bash compatibility mode.  It is not fully implemented
-                     and is experimental.
-    BRACEPAT     on  C-shell type abc{d,e}f style file generation
-    CMDLIB_BLTIN off Makes all commands in libcmd.a builtins.  The
-                     SH_CMDLIB_DIR nmake state variable can be used to
-		     specify a directory. 
-    CMDLIB_DIR   off Sets CMDLIB_BLTIN=1 and provides a default value
-                     of "/opt/ast/bin" for SH_CMDLIB_DIR.
-    COMPOUND_ARRAY
-                 on  Allows all components of compound variables except the
-                     first to be any string by enclosing in [...].  It also
-                     allows components other than the last to be arrays.
-                     This is experimental and only partially complete.
-    CRNL         off <cr><nl> treated as <nl> in shell grammar.
-    DYNAMIC      on  Dynamic loading of builtins. (Requires dlopen() interface.)
-    ECHOPRINT    off Make echo equivalent to print.
-    ESH          on  Compile with emacs command line editing.  The original
-                     emacs line editor code was provided by Mike Veach at IH.
-    FILESCAN     on  Experimental option that allows fast reading of files
-                     using while < file;do ...; done and allowing fields in
-                     each line to be accessed as positional parameters.
-    FS_3D        off For use with 3-D file system.  Enabled automatically for
-                     systems with dynamic linking.
-    KIA          off Allow generation of shell cross reference database with -I.
-    MULTIBYTE    on  Multibyte character handling.  Requires mblen() and
-                     mbctowc().
-    NAMESPACE    on  Allows namespaces.  This is experimental, incomplete
-                     and undocumented.
-    OLDTERMIO    off Use either termios or termio at runtime.
-    OO           on  Experimental object oriented extension.  This option
-                     should disappear soon.
-    OPTIMIZE     on  Optimize loop invariants for with for and while loops.
-    P_SUID       off If set, all real uids, greater than or equal to this
-                     value will require the -p flag to run suid/sgid scripts.
-    PFSH         off Compile with support for profile shell.
-    RAWONLY      off Turn on if the vi line mode doesn't work right unless
-                     you do a set -o viraw.
-    SEVENBIT     off Strip the eigth bit from characters.
-    SPAWN        off Use spawn as combined fork/exec.  May improve speed on
-                     some systems.
-    STATS	 on  Add .sh.stats compound variable.
-    SUID_EXEC    on  Execute /etc/suid_exec for setuid, setgid script.
-    TIMEOUT      off Set this to the number of seconds for timing out and
-                     exiting the shell when you don't enter a command.  If
-                     non-zero, TMOUT can not be set larger than this value.
-    TYPEDEF	 on  Enable typeset type definitions.
-    VSH          on  Compile with vi command line editing.  The original vi
-                     line editor code was provided by Pat Sullivan at CB.
-
-The following compile options are set automatically by the feature testing:
-    DEVFD   Set when /dev/fd is a directory that names open files.
-    SHELLMAGIC
-            Set on systems that recognize script beginning with #! specially.
-    VPIX    Set on systems the have /usr/bin/vpix program for running MS-DOS.
-
-
-In most instances, you will generate ksh from a higher level directory
-which also generates libcmd and libast libraries on which ksh depends.
-However, it is possible to generate ksh, with by running make -f ksh.mk
-in this directory.  The ksh.mk file was generated from the nmake Makefile.
-If you do not have make or nmake, but do have a Version 7 UNIX compatible
-shell, then you can run the script mamexec < Mamfile to build ksh.
-If you have nmake, version 2.3 or later, you can use it without the -f ksh.mk.
-In either case, ksh relies on libraries libast and libcmd which must be
-built first.  The binary for ksh becomes the file named ./ksh which can
-be copied to where ever you install it.
-
-If you use old make or the Mamfile, and you system has dynamic shared
-libraries, then you should define the variables mam_cc_static and
-mam_cc_dynanamic as the compiler options that request static linking
-and dynamic linking respectively.  This will decrease the number of
-shared libraries that ksh need and cut startup time substantially.
-
-The makefile should also generate shcomp, a program that will precompile
-a script.  ksh93 is able to recognize files in this format and process
-them as scripts.  You can use shcomp to send out scripts when you
-don't want to give away the original script source.
-
-It is advisable that you put the line PWD=$HOME;export PWD into the
-/etc/profile file to reduce initialization time for ksh.
-
-To be able to run setuid/setgid shell scripts, or scripts without read
-permission, the SUID_EXEC compile option must be on, and ksh must be installed
-in the /bin directory, the /usr/bin directory, the /usr/lbin directory,
-or the /usr/local/bin directory and the name must end in sh. The program
-suid_exec must be installed in the /etc directory, must be owned by root,
-and must be a suid program.  If you must install ksh in some other directory
-and want to be able to run setuid/setgid and execute only scripts, then
-you will have to change the source code file sh/suid_exec.c explicitly.
-If you do not have ksh in one of these secure locations, /bin/sh will
-be invoked with the -p options and will fail when you execute a setuid/setgid
-and/or execute only script.  Note, that ksh does not read the .profile
-or $ENV file when it the real and effective user/group id's are not
-equal.
-
-The tests sub-directory contains a number of regression tests for ksh.
-To run all these tests with the shell you just built, go to the tests
-directory and run the command
-        SHELL=$dir/ksh $dir/ksh shtests
-where dir is the directory of the ksh you want to test.
-
-The file PROMO.mm is an advertisement that extolls the virtues of ksh.
-The file sh.1 contains the troff (man) description of this Shell.
-The file nval.3 contains the troff (man) description of the name-value
-pair library that is needed for writing built-ins that need to
-access shell variables.
-
-The file sh.memo contains a draft troff (mm) memo describing ksh.  The
-file RELEASE88 contains the changes made for ksh88.  The file RELEASE93
-contains the changes made in this release since ksh-88.  The file
-RELEASE contains bug fixes made in this release since ksh-88.  The file
-COMPATIBILITY contains a list of incompatibilities with ksh-88.  The
-file bltins.mm is a draft troff (mm) memo describing how to write
-built-in commands that can be loaded at run time.
-
-Most of the work for internationalization has been done with ksh93.
-The file ksh.msg is a generated file that contains error messages
-that need to be translated.  In addition, the function translate()
-in sh/init.c has to be completed to interface with the dictionary
-lookup.  The translate function takes two argument, the string
-that is to be translated and a type which is
-    0 when a library string needs translation.
-    1 when one of the error messages in ksh.msg needs translation.
-    2 when a string in a script needs translation.  You use a $ in front
-      of a double quoted string in a script to indicate that it
-      needs translation.  The -D option for ksh builds the dictionary.
-The translate routine needs to return the translated message.
-For dictionaries that need to use a numeric key, it should be
-possible to use the strhash() function to generate numbers to
-go along with each of the messages and to use this number both
-when generating the dictionary and when converting strings.
-If you encounter error messages of type 1 that are not be translated via
-this translate() function send mail to the address below.
-
-Please report any problems or suggestions to:
-
-dgk@research.att.com
-
-
-ksh93 has been compiled and alpha tested on the following.  An asterisk
-signifies that ksh has been installed as /bin/sh on this machine.
-
-*    Sun OS 4.1.[123] on sparc.
-     Sun OS 4.1.1 on sun.
-     Solaris 2.[1-9] on sparc.
-     Solaris 2.[4-8] on X86.
-     HP/UX 8 on HP-9000/730.
-     HP/UX 9 on HP-9000/730.
-     HP/UX 10 on HP-9000/857.
-     HP/UX 11 on pa-risc.
-     System V Release 3 on Counterpoint C19
-     System V Release  4 on AT&T Intel 486.
-     System V Release  4 on NCR 4850 Intel 486.
-     IRIX Release 4.0.? System V on SGI-MIPS.
-     IRIX Release 5.1 System V on SGI-MIPS.
-     IRIX Release 6.[1-5] System V on SGI-MIPS.
-     System V Release 3.2 on 3B2. 
-     UTS 5.2.6 on Amdahl 3090,5990,580.
-     System V Release 3.2 on i386.
-     SMP_DC.OSx olivetti dcosx MIServer-S 2/128.
-     SMP_DC.OSx Pyramid dcosx MIServer-S 2/160 r3000.
-     4.3BSD on Vax 8650.
-     AIX release 2 on RS6000.
-     AIX 3.2 on RS6000.
-     Linux 1.X on Intel
-     Linux 2.X on Intel
-     Linux 2.X on Alpha
-     Linux 2.X on Alpha
-     Linux 2.X on OS/390
-     Linux 2.X on sparc
-     Linux 2.4 on intel itanium 64
-     Linux Slackware on sparc64
-*    Linux ARM on i-PAQ 
-     OSF1 on DEC alpha.
-     OSF4 on DEC alpha.
-     UMIPS 4.52 on mips.
-     BSD-i [2-4] on X86.
-     OpenBSD on X86
-     NetBSD on X86
-     FreeBSD on X86
-     NeXT on Intel X86.
-     NeXT on HP.
-*    Windows NT using UWIN on X86
-*    Windows NT using UWIN on alpha
-     Windows NT using Cygwin on X86
-     Windows NT with NutCracker libraries.
-     Windows NT with Portage libraries.
-     Windows 3.1 using custom C library.
-     OpenEdition on MVS
-     Darwin OS X on PPC
-     MVS on OS 390
-     SCO Openserver 3.2 on X86
-     Unixware 7 on X86
-
-Good luck!!
-
-David Korn
-dgk@research.att.com
-
diff --git a/usr/src/lib/libshell/common/RELEASE b/usr/src/lib/libshell/common/RELEASE
deleted file mode 100644
index b8fc92511a..0000000000
--- a/usr/src/lib/libshell/common/RELEASE
+++ /dev/null
@@ -1,2204 +0,0 @@
-10-03-05  --- Release ksh93t+  ---
-10-03-05  A varibale unset memory leak has been fixed and tests/leaks.sh
-	  has been added to verify the fix.
-10-03-04  Documentation, comment, and disgnostic spelling typos corrected.
-10-02-14  Fix sh_getenv() initialization to cooperate with the 3d fs.
-10-02-12  A bug in which the get discipline function was not invoked for
-	  associative array subscripts for unset array elements has been fixed.
-10-02-12  A bug which could occur if the last line of a script was an eval
-	  that executed multiple commands has been fixed.
-10-02-02  A buffer overflow in read and another in binary type base64
-	  encoding were fixed.
-10-01-20  A bug in the evaluation of arithmetic expression in which the
-	  subscript was evaluated twice for $((foo[x++]++)) has been fixed.
-10-01-19  A workaround for a double-free of a trap in both a subshell and its
-	  parent has been added.
-10-01-18  A bug in type handling of typeset -H has been fixed.
-10-01-15  The "adding empty subscript" warning now only emitted with -x set.
-10-01-01  A bug in the parser in which '$((case i in i):;esac);:))' was not
-	  parsed correctly was fixed.
-10-01-01  A bug in the parser in which '$(( 2 , 3.6 ))' dumped core for locales
-	  with radix char , and thousands separator . has been fixed.
-09-12-28  A bug in the handling of SIGCLD on systems that generated SIGCLD
-	  while blocked waiting for process to complete has been fixed.
-09-12-24  ast setlocale() reworked to differentiate env var changes from user
-	  override.
-09-12-18  A bug with the SHOPT_BGX option set which disabled traps for signals
-	  < SIGCHLD when a trap for a signal > SIGCHLD was set has been fixed.
-09-12-18  A bug where [[ -v var ]] was incorrect for some variables (including
-	  LC_* vars) has been fixed.
-09-12-15  A bug that produced a syntax error when a multibyte character
-	  straddled a buffer boundary has been fixed.
-09-12-11  A bug where the subscript of an unset variable was not evaluated has
-	  been fixed.
-09-12-09  A bug where shcomp dumped core on certain syntax errors has been fixed.
-09-12-07  A bug where a parent shell environment var reset in a subshell removed
-	  the value in subsequent children of the parent shell has been fixed.
-09-12-04  A bug in which in some cases a trap in a function executed in
-	  a subshell could trigger twice has been fixed.
-09-12-03  A bug in which SHLVL exported with some attributes could cause
-	  the shell to abort at startup has been fixed.
-09-12-02  A bug with pipefail in which the shell could hang waiting for the
-	  writer to complete before the last reader command has been fixed.
-09-11-30  A bug in which a trap could be inherited by the first element of
-	  a pipeline when the command had more than 63 arguments that did
-	  not contain any macro expansions has been fixed.
-09-11-19  When read from a terminal was called from with a while or foo loop,
-	  and an edit mode was on, a backspace or erase no longer will
-	  overwrite the prompt.
-09-11-17  Change .paths parse to handle BUILTIN_LIB=foo BUILTIN_LIB=foo-1.2.
-09-11-17  Inside a function, typeset foo.bar will bind foo to global variable
-	  foo if local variable foo does not exist, instead of creating a 
-	  local variable.
-09-11-17  "read -n1" from the terminal has been fixed to read exactly one character.
-09-11-11  Job control now works for subshell commands, (...).
-09-11-11  If set -e is on for an interactive shell errors in special builtins
-	  now cause the shell to exit.
-09-11-11  A bug in which an interrupt handler processed during the read builtin
-	  when IFS did not contain a new line has been fixed.
-09-11-09  A bug in which a variable that has been unset in a subshell and then
-	  exported from that subshell does not show up in the environment
-	  has been fixed.
-09-11-02  ``,2'' is now a valid numeric constant for locales with
-	  decimal_point=','.
-09-11-02  A bug where "return" in .profile did not restore the shell state
-	  has been fixed.
-09-10-31  A bug that corrupted saved exit status when pids wrapped around has
-	  been fixed.
-09-10-26  A bug in { LANG LC_ALL LC_category } ordering has been fixed in -last.
-09-10-16  A bug where notification to libast that the environment has changed
-          has been fixed.
-09-10-12  A bug in which a function loaded in a subshell could leave side
-	  effects in the parent shell has been fixed.
-09-10-12  A bug in converting a printf %d operand to a number when the operand
-	  contains multiple subscripts for the same variable has been fixed.
-09-10-09  A bug in the handling of the escape character \ in directory prefixes
-	  in command completion has been fixed.
-09-10-09  $PATH processing has been changed to delay dir stat() and .paths
-	  lookup until the directory is needed in the path search.
-09-09-28  Call the ast setlocale() intercept on unset too.
-09-09-24  A bug in which LANG=foo; LC_ALL=foo; unset LC_ALL; did not revert
-	  LC_CTYPE etc. to the LANG value has been fixed.
-09-09-17  A bug in which unsetting SVLVL could cause a script invoked by
-	  name without #! to core dump has been fixed.
-09-09-16  A bug in which a pipeline in a here-document could hang when the
-	  pipefail option was on has been fixed. 
-09-09-09  A bug in the processing of line joining in here documents which
-	  occurred when a buffer began with <escape><new-line> has been fixed.
-09-09-09  A leading ; with commands in a brace group or parenthesis group
-	  no longer causes an error.  It now is used for the "showme" option.
-09-09-09  A bug in which a subshell containing a background process could
-	  block until the background process completed has been fixed.
-09-09-04  A bug in handing ${var[sub]}, where var is a nameref has been fixed.
-09-09-03  A bug which caused an index array to have the wrong number of elements
-	  when it was converted from a compound variable by adding an another
-	  element has been fixed.
-09-09-03  Specifying export for a compound variable now generates an error.
-09-09-02  $"..." localizations strings are no longer recognized inside `...`.
-09-09-01  A bug in the for loop optimizer in the handling of type static
-	  variables has been fixed.
-09-09-01  An error message is not displayed when * and @ are used as subscripts.
-09-09-01  Several bugs in the processing for types that included an associative
-	  array of another type has been fixed.
-09-09-01  A bug in the tracing of [[ a < b ]] and [[ a > b ]] has been fixed.
-09-08-26  The .sh.file variable was not being set for a script that was run
-	  by name and didn't start with #! and this has been fixed.
-09-08-25  A bug in which a function called to deeply from command substitution
-	  did not display an error message has been fixed.
-09-08-24  When processing profiles, ksh93 now violates the POSIX standard and
-	  treats &> as a redirection operator similar to bash.
-09-08-23  A bug in the handling of the trap on SIGPIPE that could lead to a
-	  memory fault has been fixed.
-09-08-21  A bug in the handling of the comma operator in arithmetic expressions
-	  that could cause a core dump on some systems has been fixed.
-09-08-20  A bug in which a compound variable containing an array of a type
-	  that doesn't have any elements now expands correctly.
-09-08-19  A bug which disabled function tracing inside a function after
-	  a call to another function has been fixed.
-09-08-19  A bug in which initializing a compound variable instance to another
-	  compound variable by name has been fixed.
-09-08-18  A bug in which compound variable instances could be lost after
-	  an instance that invoked a type method discipline has been fixed.
-09-08-18  A bug in which a discipline function for a type applied to an
-	  array instance when invoked in a function ignored the subscript
-	  has been fixed.
-09-08-18  A scoping error with variables in arithmetic expression with
-	  type variables when reference with a name reference has been fixed.
-09-08-10  Several memory leaks were fixed primarily related to subshells.
-09-08-06  A bug in which setting the trap on CHLD to ignore could cause
-	  a script to hang has been fixed. 
-09-07-08  A bug in the processing of name reference assignments when it
-	  contained pattern expansions with quoting has been fixed.
-09-06-22  The default width for typeset -X has been changed so that there
-	  should be no loss of precision when converting to a string.
-09-06-19  A bug in the printing of array elements for binary variables with
-	  printf %B has been fixed.
-09-06-19  A bug which caused a core dump with trap DEBUG set with an array
-	  assignment with no elements has been fixed.
-09-06-19  A bug with read with typeset -b -Z<num> has been fixed.
-09-06-19  Two bugs related to read -b for array variables has been fixed.
-09-06-19  A bug with typeset for compound variables containing arrays of
-	  compound variables has been fixed.
-09-06-18  A bug in appending a compound variable to a an indexed array of
-	  compound variables has been fixed.
-09-06-18  A bug which occurs when appending a compound variable to an indexed
-	  array element has been fixed.
-09-06-18  Setting VISUAL to a value other than one ending in vi or emacs will
-	  no longer unset the edit mode.
-09-06-17  A bug in typeset -m when moving a local compound variable to a
-	  global compound variable via a name reference has been fixed.
-09-06-17  A bug in appending to nodes of an array of compound variables when
-	  addressing them via nameref has been fixed.
-09-06-17  A bug in typeset -p var, when var is an array of compound variables
-	  in which the output only contained on array element has been fixed.
-09-06-17  The prefix expansion ${!y.@} now works when y is a name
-	  reference to an element of an array.
-09-06-16  Traps on signals that are ignored when the shell is invoked
-	  no longer display.  Previously they were ignored as required but
-	  would be listed with trap -p.
-09-06-12  A bug in vi edit mode in which hitting the up arrow key at the
-	  end of a line longer than 40 characters which caused a core dump
-	  has been fixed. 
-09-06-11  A bug in which "eval non-builtin &" would create two processes,
-	  one for the & and another for non-builtin has been fixed.
-09-06-08  When var is an identifier and is unset, ${var} no longer tries to
-	  run command substitution on the command var.
-09-06-08  Process substitution arguments of the form <(command) can now be
-	  used following the < redirection operator to redirect from command.
-09-05-13  A bug in which redirections of the form 2>&1 1>&5 inside command
-	  substitution could cause the command substitution to hang has been
-	  fixed.
-09-05-12  To conform with POSIX, the -u option only checks for unset variables
-	  and subscript elements rather than checking for all parameters.
-09-05-12  A bug which could cause a core dump when a variable whose name
-	  begins with a . was referenced as part of a name reference inside
-	  a function has been fixed.
-09-05-01  A bug that caused a core dump when SIGWINCH was received and
-	  both vi and emacs mode were off has been fixed.
-09-04-22  Default alias compound='typeset -C' added.
-09-04-15  A bug that caused ${...;} to hang for large files has been fixed.
-09-04-08  A change was made in the -n option which printed out an incorrect
-	  warning with <>.
-09-04-07  The emacs edit command M-_ and M_. and the vi command _ was fixed
-	  to handle the case there there is no history file.
-09-04-05  A bug in handling new-lines with read -n has been fixed.
-09-04-05  The ENV variable defaults the the file named by $HOME/.kshrc rather
-	  then to the string $HOME/.kshrc.
-09-03-31  A bug in which a nested command substitution with redirections could
-	  leave a file descriptor open has been fixed.
-09-03-24  ksh now only uses the value of the _ variable on startup if it can
-	  verify that it was set by the invoking process rather than being
-	  inherited by some other ancestor.
-09-03-24  When ksh is invoked without -p and ruid!=euid, and the shell is
-	  compiled without SHOPT_P_UID or ruid<SHOPT_P_UID, the shell now
-	  enables the -p option.  The previous version instead set the
-	  euid to the ruid as it does for set +p.
-09-03-24  When SHOPT_P_UID is defined at compile time and the shell is started
-	  without -p and ruid!=euid and ruid>=SHOPT_P_UID then euid is set
-	  to ruid. A bug that did the wrong test (ruid<SHOPT_P_UID) was fixed.
-09-03-17  The sleep(1) builtin now accept and ISO 8601 PnYnMnDTnHnMnS
-	  duration or date(1) compatible date/time operand.
-09-03-10  If a variable that was left or right justified or zero-filled was
-	  changed with a typeset statement that was left or right justified
-	  or zero-filled, then the original justification no longer affects
-	  the result.
-09-03-10  A bug in the handling of traps when the last command in a script
-	  is a subshell grouping command has been fixed.
-09-03-03  A bug in which an expansion of the form ${!prefix@} could generate
-	  an exception after the return from a function has been fixed.
-09-02-02  A bug in restricted mode in which the value of ENV could be
-	  changed from within a function has been fixed.
-09-02-02  A bug in which an erroneous message indicating that a process
-	  terminated with a coredump has been fixed.
-09-02-02  The exit status when exit was called without an argument from
-	  a signal handler was incorrect and has been fixed.
-09-02-02  A bug in which a function autoloaded in a subshell could cause
-	  a core dump when the subshell completed has been fixed.
-09-02-02  A bug in which 2>&1 inside a command substitution wasn't working
-	  correctly has been fixed.
-09-02-02  A bug in the call stack of arithmetic function with 2 args
-	  returning int has been fixed.
-09-01-30  A bug in which 'eval print \$0' inside a function was giving the
-	  wrong value for $0 has been fixed.
-09-01-28  A bug in which a command substitution could return an exit status
-	  of 127 when the pipefail option is enabled has been fixed.
-09-01-26  ksh93 now generates an error message if you attempt to create
-	  a global name reference to a local variable.
-09-01-26  The [[ -v var ]] operator was modified to test for array elements.
-09-01-23  The redirection operator <>; was added.  It is similar to <>
-	  except that if the command it is applied to succeeds, the file
-	  is truncated to the offset at the command completion.
-09-01-23  The default file descriptor for <> was changed to 1.
-09-01-20  A bug in which the exit status specified in an exit trap was
-	  not used when a process terminated with a signal has been fixed.
-09-01-19  A bug in which a signal whose default action is to terminate
-	  a process could be ignored when the process is running a sub-shell
-	  has been fixed.
-09-01-19  A bug in which sending SIGWINCH to a process that reads from a pipe
-	  could cause a memory fault has been fixed.
-09-01-16  The -R unary operator was added to [[...]] and test to check whether
-	  a variable is a  name reference.
-09-01-16  The -v unary operator was added to [[...]] and test to check whether
-	  a variable is set.
-09-01-14  The unset built-in was modified to return 0 exit status when
-	  unsetting a variable that was unset to conform with the POSIX
-	  standard.
-09-01-14  The unset built-in was modified to continue to unset variables
-	  after encountering a variable that it could not unset to
-	  conform to the POSIX standard.
-09-01-14  The parameter expansion ${x+value} no longer expands the value of
-	  the variable x when determining whether x is set or not.
-09-01-13  A bug in which background jobs and pipelines that were not waited
-	  for could, in rare instances, cause the shell to go into an infinite
-	  loop or fail has been fixed.
-09-01-06  A bug in indexed arrays of compound variables in which referencing
-	  non-existent sub-variable in an arithmetic expression could cause
-	  the sub-variable to be created has been fixed.
-09-01-05  A bug in which the \ character did not escape extended regular
-	  expression pattern characters has been fixed.
-08-12-24  A bug in which killing the last element of a pipe did not cause
-	  a write to the pipe to generate a SIGPIPE has been fixed.
-08-12-19  A bug which could cause command substitution to hang when the
-	  last element of a pipeline in a command substitution was a built-in
-	  and the output was more that PIPE_BUFF.
-08-12-18  A bug which occurs when a here documented marker embedded in a
-	  command substitution occurs on a buffer boundary has been fixed.
-08-12-17  A bug in the output of typeset -p for variables that had attributes
-	  but did not have a value has been fixed.
-08-12-16  A bug in which a name reference to a name reference variable that
-	  references an array element has been fixed.
-08-12-16  A bug in which a variable given both the -A and -C attribute along
-	  with an initial assignment didn't work correctly has been fixed.
-08-12-10  The [[ -t fd ]] test was fixed to handle fd>9.
-08-12-10  A bug where function stack misalignment could cause a bus error
-	  has been fixed.
-08-12-09  Command completion was changed to use \ to quote special characters
-	  instead of quoting the argument in single quotes.
-08-12-07  A bug in typeset -m which occurred when the target node was an
-	  associative array element has been fixed.
-08-12-07  A timing bug on some systems (for example darwin), that could
-	  cause the last process of a pipeline entered interactively to fail
-	  with an "Exec format error" has been fixed.
-08-12-04  SHOPT_BGX enables background job extensions. Noted by "J" in
-	  the version string when enabled. (1) JOBMAX=n limits the number
-	  of concurrent & jobs to n; the n+1 & job will block until a
-	  running background job completes. (2) SIGCHLD traps are queued
-	  so that each completing background job gets its own trap; $! is
-	  set to the job pid and $? is set to the job exit status at the
-	  beginning of the trap. (3) sleep -s added to sleep until the time
-	  expires or until a signal is delivered.
-08-12-04  The sign of floating point zero is preserved across arithmetic
-	  function calls.
-08-12-04  A bug that caused print(1) to produce garbled stdout/stderr
-	  output has been fixed.
-08-12-04  A bug in which printf "%d\n" "'<euro>'" did not output the
-          numerical value of the EURO symbol, 8354, has been fixed.
-08-11-24  /dev/fd* and /dev/std* redirections are first attempted with
-	  open() to preserve seek semantics; failing that the corresponding
-	  file descriptors are dup()'d.
-08-11-20  A bug which could cause a core dump if a function compiled with
-	  shcomp was found has been fixed.
-08-11-20  A bug in which jobs were not cleared from the jobs table for
-	  interactive shells when the pipefail option is on has been fixed.
-08-11-11  A bug in which a field that was unset in a type definition and later
-	  set for an instance could appear twice when displaying the variable
-	  has been fixed.
-08-11-11  A bug in which running a simple command & inside a function would
-	  not return the correct process id has been fixed.
-08=11-10  A bug in which the exit status of a command could be lost if the pid
-	  was that of the most recent command substitution that had completed
-	  has been fixed.
-08-11-10  The maximum depth for subshells has been increased from 256 to 65536.
-08-11-06  A bug which could cause a core dump when the _ reference variable was
-          used as an embedded type with a compound assignment has been fixed.
-
-08-10-31  --- Release ksh93t  ---
-08-10-31  Variable scoping/initialization bugs that could dump core were fixed.
-08-10-24  The lexer now accepts all RE characters for patterns prefixed
-	  with a ksh ~(...) option expression.
-08-10-24  For ${var/pat/sub} \0 in sub expands to the text matched by pat.
-08-10-18  A bug in array scoping that could dump core has been fixed.
-08-10-10  read -n and -N fixed to count characters in multibyte locales.
-08-10-10  A bug that mishandled _.array[] type references has been fixed.
-08-10-09  ${.sh.version} now contains a concatenation of the following (after
-	  'Version') denoting compile time features:
-		A	SHOPT_AUDIT
-		B	SHOPT_BASH
-		L	SHOPT_ACCT
-		M	SHOPT_MULTIBYTE
-08-10-09  A bug that caused subshell command substitution with redirection
-	  to hang has been fixed.
-08-10-08  Output errors, other than to stderr, now result in a diagnostic.
-08-10-08  ksh93 now supports types that contain arrays of other types as
-	  members.  Earlier versions core dumped in this case.
-08-10-05  A bug which caused the shell to emit a syntax error for an arithmetic
-	  statement of the form (( var.name[sub] = value)) has been fixed.
-08-10-01  A bug that caused subshell command substitution to hang has
-	  been fixed.
-08-09-29  When the -p export option of typeset is used with other options,
-	  only those variables matching the specified options are displayed.
-08-09-29  When the shell reads the environment and finds variables that are
-	  not valid shell assignments, it now passes these on to subsequent
-	  commands rather than deleting them.
-08-09-29  A bug in the display of compound variables containing an indexed
-	  array of compound variables has been fixed.
-08-09-29  A bug in the display of compound variables containing an associative
-	  array with a subscript containing a . in the name has been fixed.
-08-09-26  A core dump in the subshell environment restore has been fixed.
-08-09-24  $(...) has been fixed to properly set the exit status in $?.
-08-09-23  $(<...) with IFS=$'\n\n' has been fixed to retain all but the last
-	  of multiple trailing newlines.
-08-09-23  The -p option to typeset when used with other attributes, restricts
-	  the output to variables with the specified attributes.
-08-09-22  A bug that sometimes lost the exit status of a job has been fixed.
-08-09-21  A bug that retained trailing command substitution newlines in
-	  cases where the command caused the shell to fork has been fixed.
-08-09-19  type, whence -v, and command -v were fixed to comply with POSIX
-	  by writing 'not found' diagnostics to the standard error.
-08-09-18  test and [...] were fixed to comply with POSIX in the case
-	  of test '(' binop ')' where binop is a valid binary test operator.
-08-09-16  If a method discipline named create is specified when defining a
-	  type, this function will be called when an instance is created.
-08-09-15  The variable _ is now set as a reference to the compound variable
-	  when defining a compound variable or a type.
-08-09-10  The shell now prints an error message when the type name specified
-	  for an indexed array subscript is not an enumeration type.
-08-09-10  A bug in which a subshell that spawned a background process could
-	  loose output that was produced after the foreground completed
-	  has been fixed.
-08-09-10  A timing bug on some systems that could cause coprocesses started by a
-	  subshell to not clean up and prevent other coprocesses has been fixed.
-08-09-09  The typeset -m option is now able to rename array elements from
-	  the same array.
-08-09-09  The exit status of 2 from the DEBUG trap causes the next command
-	  to be skipped.  An exit value of 255 from a DEBUG trap called from
-	  a function causes the function to return. 
-08-09-08  A bug in which a coprocess created in a subshell that did not
-	  complete when the subshell terminated could prevent a coprocess
-	  from being created in the parent shell has been fixed.
-08-09-05  An assignment of the form name1=name2 where name1 and name2
-	  are both compound variables causes name1 to get a copy of name2.
-	  name1+=name2 causes name2 sub-variables to be appended to name1.
-08-09-05  A bug in which unsetting a compound variable did not unset all
-	  the sub-variables has been fixed.
-08-09-01  A bug in the subshell cleanup code that could cause SIGSEGV has
-	  been fixed.
-06-08-26  The SHLVL variable which is an environment variable used by bash
-          and zsh that gets incremented when the shell starts.
-08-08-25  For an indexed array, a negative subscript now refers to offsets
-	  from the end so that -1 refers to the last element.
-08-08-24  An alignment error for shorts on 64 bit architectures has been fixed.
-08-08-22  If oldvar is a compound variable, typeset -C newvar=oldvar creates 
-	  newvar as a copy of oldvar.
-08-08-19  The ALRM signal no longer cause the sleep builtin to terminate.
-08-08-13  When used in an arithmetic expression, the .sh.version variable  
-	  now produces a number that will be increasing for each release.
-08-08-11  A bug in which type instantiation with a compound assignment in
-	  a dot script in which the type is defined has been fixed. 
-08-08-07  The -m option has been added to typeset to move or rename a
-	  variable.  Not documented yet.
-08-08-06  A bug in read when used in a loop when a prompt was specified
-	  when reading from a terminal has been fixed.
-08-08-01  A bug with the pipefail option in which a nested pipeline could
-	  cause an asynchronous command to block has been fixed.
-08-08-01  A for loop optimizer bug that treats .sh.lineno as an invariant
-	  has been fixed.
-08-07-30  A bug in which expanding compound variable that had a get discipline
-	  from with a here document could cause a syntax error has been fixed.
-08-07-18  A bug in which a nameref caused a local variable to be created
-	  rather than binding to an existing variable in the global scope
-	  has been fixed.
-08-07-17  A bug which occurred when a nameref was created from within a
-	  function that was  part of a pipeline has been fixed.
-08-07-14  The compile option SHOPT_STATS was added. With this option the
-	  compound variable .sh.stats keeps usage statistics that could help
-	  with performance tuning.
-08-07-10  The output of set now always uses a single line for each variable.
-	  For array variables, the complete set of values is now displayed.
-08-07-09  The typeset -C option can be used with arrays to indicate that
-	  each element should default to a compound variable.
-08-07-08  The %B format now outputs compound variables and arrays.  The
-	  alternate flag # can be used to cause output into a single line.
-08-07-03  When the window change signal, WINCH, is received, the current
-	  edit line is redrawn in place. 
-08-07-01  A bug in the handling of shared variables when inside an embedded
-	  type has been fixed.
-08-06-29  A bug in multiline edit mode which occurred when the prompt length
-	  was three characters or less has been fixed.
-08-06-23  A bug in which the SIGCLD was not be triggered when background
-	  jobs completed has been fixed.
-08-06-23  KSH_VERSION added as a name reference to .sh.version.
-08-06-20  type now outputs 'special builtin' for special builtins.
-08-06-19  A couple of bugs in multi-dimensional arrays have been fixed.
-08-06-19  A bug in which a syntax error in a dot script could generated
-	  a syntax error in the next subsequent command has been fixed.
-08-06-17  Reduced the maximum function call depth to 2048 to avoid exceptions
-	  on some architectures.
-08-06-16  A bug in which printf "%B" could generate an exception when the
-	  specified variable was not set has been fixed.
-08-06-16  When typeset -p is followed by variable names, it now displays
-	  the attributes names and values for the specific names.
-08-06-14  A bug that could effect the drawing of the screen from multiline
-	  emacs or gmacs mode when walking up the history file has been fixed.
-08-06-13  A bug in which a compound variable defined in a subshell could
-	  have side effects into the parent shell has been fixed.
-08-06-13  A number of bugs related to using .sh.level to set the stack from
-	  for DEBUG traps have been fixed.
-08-06-13  The .sh.lineno variable has been added.  When .sh.level is changed
-	  inside a DEBUG trap, the .sh.lineno contains the calling line number
-	  for the specified stack frame.
-08-06-13  The .sh.level variable has been documented and now works.
-08-06-11  The -C option has been added to read for reading compound command
-	  definitions from a file.
-08-06-11  The . command is now permitted inside a compound command definition.
-	  The dot script can contain declaration commands and dot commands.
-08-06-09  Add -C option to typeset so that typeset -C foo, is equivalent
-	  to foo=().
-08-06-09  Added -n warning message for typeset option orderings that are valid
-	  with ksh88 but not valid with ksh93, for example Lx5.
-08-06-09  A bug in which the return value for an assignment command containing
-	  a command substitution with that failed was zero when the assignment
-	  contained redirections has been fixed.
-08-06-09  A bug in the quoting of $ inside a ERE pattern ~(E)(pattern)
-	  has been fixed.
-08-06-06  A bug when processing `` command substitution with the character
-	  sequence \$' has been fixed.
-08-06-02  When defining a type, the typeset -r attribute causes this field
-	  to be required to be specified for each instance of the type and
-	  does not allow a default value.
-08-06-02  Several bugs in which compound variables were modified by
-	  subshells have been fixed.
-08-05-22  The ceil function has been added to the math functions.
-08-05-21  A bug in which a name reference defined in a function and passed
-	  as an argument to another function could cause an incorrect binding.
-08-05-21  A bug in freeing compound variables that are local to functions
-	  has been fixed.
-08-05-19  The array expansions ${array[sub1..sub2]} and ${!array[sub1..sub2]}
-	  to expand to the value (or subscripts) for array between sub1 and
-	  sub2 inclusive.  For associative arrays, the range is based on
-	  location in the POSIX locale.  The .. must be explicit and cannot
-	  result from an expansion.
-08-05-15  The trap on SIGCLD is no longer triggered by the completion of
-	  the foreground job as with ksh88.
-08-05-14  A bug in the implementation of the editing feature added on 
-	  07-09-19 in emacs mode has been fixed.
-08-05-12  A bug in processing the test built-in with parenthesis has been
-	  fixed.
-08-05-12  The unset built-in now returns non-zero when deleting an array
-	  subscript that is not set.
-08-05-08  Changing the value of HISTFILE or HISTSIZE will cause the old
-	  history file to be close and reopened with the new name or size.
-08-05-08  When FPATH is changed functions that were found via a path search
-	  will be searched for again.
-08-05-08  A parser bug in which reserved words and labels were recognized
-	  inside compound indexed array assignment after a new-line has
-	  been fixed.
-08-05-07  A bug in getopts when handling numerical option arguments has
-	  been fixed.
-08-05-07  The typeset -S option was added for variables outside type
-	  definitions to provide a storage class similar to C static
-	  inside a function defined with function name.  When outside
-	  type definitions and outside a function, the -S option cause
-	  the specified variable so be unset before the assignment and
-	  before the remaining attributes are supplied.
-08-05-07  A bug that affected the cursor movement in multiline mode when
-	  a character was deleted from near the beginning of the any
-	  line other than the first.
-08-05-01  In multiline edit mode, the refresh operation will now clear
-	  the remaining portion of the last line.
-08-05-01  A bug in computing prompt widths for the edit modes for prompts
-	  with multibyte characters has been fixed.
-08-05-01  A bug in the multiline edit mode which could cause the current
-	  line to be displayed incorrectly when moving backwards from third
-	  or higher line to the previous line has been fixed.
-08-05-01  A bug in which options set in functions declared with the function
-	  name syntax were carried across into functions invoked by these
-	  functions has been fixed.
-08-04-30  A bug which could cause a coprocess to hang when the read end
-	  is a builtin command has been fixed.
-08-04-30  The emacs and vi editors have been modified to handle window
-	  change commands as soon as they happen rather than waiting for
-	  the next command.
-08-04-28  A bug in which ${!x} did not expand to x when x was unset has been
-	  fixed.
-08-04-27  A bug in which the assignment x=(typeset -a foo=([0]=abc)) created
-	  x.foo as an associative array has been fixed.
-08-04-25  A bug in which $# did not report correctly when there were more
-	  than 32K positional parameters has been fixed.
-08-04-04  Choose the name _ as the sub-variable that holds type or instance
-	  specific data used by discipline functions.
-08-03-27  A bug in which the terminal group was not given back to the parent
-	  shell when the last part of a pipeline was handled by the parent shell
-	  and the other parts of the pipeline complete has been fixed. 
-	  The symptom was that the pipeline became uninterruptable.
-08-03-25  A bug in restricted mode introduced in ksh93s that caused scripts
-	  that did not use #! to executed in restricted mode has been fixed.
-08-03-25  A bug in which the pipefail option did not work for a pipeline
-	  within a pipeline has been fixed.
-08-03-24  A bug in which OPTIND was not set correctly in subshells has
-	  been fixed.
-08-03-24  A bug which could cause a memory exception when a compound variable
-	  containing an indexed array with only element 0 defined was expanded.
-08-03-20  A bug in which ${!var[sub].*} was treated as an error has been fixed.
-08-03-20  Associative array assignments of the form ([name]=value ...)
-	  now allow ; as well as space tab and new line to separate elements.
-08-03-18  A buffering problem in which standard error was sometimes
-	  not flushed before sleep has been fixed.
-08-03-17  A bug in which a signal sent to $$ while in a subshell would be
-	  sent to the subshell rather than the parent has been fixed.
-08-03-17  --default option added to set(1) to handle set +o POSIX semantics.
-	  set --state added as a long name alias for set +o.
-08-03-14  A bug in which using monitor mode from within a script could
-	  cause the terminal group to change has been fixed.
-08-03-10  The new ${...} command substitution will treat the trailing }
-	  as a reserved word even if it is not at the beginning of a command,
-	  for example, ${ date }.
-08-03-10  If the name of the ENV begins with /./ or ././ then the
-	  /etc/ksh.kshrc file will not be executed on systems that support
-	  this interactive initialization file.
-08-03-07  A bug in which ksh -i did not run the ENV file has been fixed.
-08-03-07  A bug in which ulimit did not always produce the same output as
-	  ulimit -fS has been fixed.
-08-03-04  A bug in multiline mode in emacs and vi mode which could cause the
-	  cursor to be on the wrong line when interrupt was hit has been fixed.
-08-03-03  The change made in ksh93s+ on 07-06-18 in which braces became
-	  optional for ${a[i]} inside  [[...]] was restored in the case
-	  where the argument can be a pattern.
-08-03-03  A bug in which creating a name reference to an associative array
-	  instance would fail when the subscript contained characters [ or
-	  ] has been fixed.
-08-02-29  The redirection operator >; has been added which for non-special
-	  files, generates the output in a temporary file and writes the
-	  specified file only of the command has completed successfully.
-08-02-15  A bug in ${var/pattern/string} for patterns of the form ?(*) and +(*)
-	  has bee fixed.
-08-02-07  A bug in which test \( ! -e \) produced an error has been fixed.
-08-02-14  The typeset -a option can now optionally be followed by the name
-	  of an enumeration type which allows subscripts to be enumerations.
-08-02-14  The enum builtin which creates enumeration types has been added.
-08-02-12  The backoff logic when there are no more processes has been fixed.
-08-02-07  The -X option has been added to typeset.  The -X option creates
-	  a double precision number that gets displayed using the C99 %a
-	  format.  It can be used along with -l for long double.
-08-01-31  The -T option to typeset has been added for creating typed
-	  variables.  Also the -h and -S options have been added to
-	  typeset that are only applicable when defining a type.
-08-01-31  The prefix expansion operator @ has been added.  ${@name}
-	  expands to the type of name or yields the attributes.
-07-11-15  A bug in the macro expander for multibyte characters in which
-	  part of the character contains a file pattern byte has been fixed. 
-07-10-03  A bug in which : was not allowed as part of an alias name has been
-	  fixed.
-07-09-26  A bug in which appending a compound variable to a compound variable
-	  or to an index array didn't work has been fixed.
-07-09-19  In both emacs and vi edit mode, the escape sequence \E[A (usually
-	  cursor up, when the cursor is at the end of the line will fetch
-	  the most recent line starting with the current line.
-07-09-18  The value of ${!var} was correct when var was a reference to an
-	  array instance.
-07-09-18  The value of ${!var[sub]} was not expanding to var[sub] and this
-	  was fixed.  It also fixed ${name} where name is a name reference
-	  to var[sub].
-07-09-18  It is now legal to create a name reference without an initialization.
-	  It will be bound to a variable on the first assignment.
-07-08-30  A discipline function can be invoked as ${x.foo} and is equivalent
-	  to ${ x.foo;} and can be invoked as x.foo inside ((...)).
-07-07-09  A bug in which typeset -a did not list indexed arrays has been
-	  fixed.
-07-07-03  The command substitution ${ command;} has been added.  It behaves
-	  like $(command) except that command is executed in the current
-	  shell environment.  The ${ must be followed by a blank or an
-	  operator.
-
-08-04-17  --- Release ksh93s+  ---
-08-04-17  A bug in which umask was not being restored correctly after a
-          subshell has been fixed.
-08-04-15  A bug in which sending a STOP signal to a job control shell started
-	  from within a shell function caused cause the invoking shell to
-	  terminate has been fixed.
-08-04-11  A bug which caused $(exec > /dev/null) to go into an infinite loop
-	  has been fixed.
-08-03-27  A bug in which typeset -LZ was being treated as -RZ has been fixed.
-08-03-06  A bug with ksh -P on systems that support the the profile shell,
-          in which it would exit after running a non-builtin has been fixed.
-08-01-31  A bug in which command substitution inside ((...)) could cause
-	  syntax errors or lead to core dumps has been fixed.
-08-01-17  A bug in which discipline functions could be deleted when invoked
-	  from a subshell has been fixed.
-08-01-17  A bug in which a command substitution consisting only of
-	  assignments was treated as a noop has been fixed.
-08-01-17  A bug in which discipline functions invoked from withing a
-	  compound assignment could fail has been fixed.
-08-01-16  Incomplete arithmetic assignments, for example ((x += )), now
-	  generate an error message.
-08-01-16  A bug in which a set discipline defined for a variable before
-	  an array assignment could cause a core dump has been fixed. 
-08-01-03  A bug in on some systems in which exit status 0 is incorrectly
-	  returned by a process that catches the SIGCONT signal is stopped 
-	  and then continued.
-07-12-13  A race condition in which a program that has been stopped and then
-	  continued could loose the exit status has been fixed.
-07-12-12  Code to check for file system out of space write errors for all
-	  writes has been added.
-07-12-11  A bug in the macro expander for multibyte characters in which
-	  part of the character contains a file pattern byte has been fixed. 
-07-12-06  A bug in the emacs edit mode when multiline was set that output
-	  a backspace before the newline to the screen has been fixed.
-07-12-04  A bug in which using <n>TAB after a variable name listing expansion
-	  in the edit modes would cause the $ to disappear has been fixed.
-07-11-28  A bug in which setting IFS to readonly could cause a subsequent
-	  command substitution to fail has been fixed.
-07-11-27  A work around for a gcc 4.* C99 "feature" that could cause a job
-	  control shell to go into an infinite loop by adding the volatile
-	  attribute to some auto vars in functions that call setjmp().
-07-11-27  A bug in which the shell could read ahead on a pipe causing the
-	  standard input to be incorrectly positioned has been fixed.
-07-11-27  A bug in which compound variable UTF-8 multibyte values were not
-	  expanded or traced properly has been fixed.
-07-11-21  A bug where an unbalanced '[' in a command argument was not treated
-	  properly has been fixed.
-07-11-15  A bug in which compatibility mode (no long option names) getopts(1)
-	  incorrectly set the value of OPTARG for flag options has been fixed.
-07-11-15  A bug in which "hash -- name" treated "--" as an invalid name operand
-	  has been fixed.
-07-11-15  typeset now handles "-t -- [-r] [--]" for s5r4 hash(1) compatibility.
-07-11-15  A bug in which the umask builtin mis-handled symbolic mode operands
-	  has been fixed.
-07-11-15  Bugs in which shell arithmetic and the printf builtin mis-handled the
-	  signs of { -NaN -Inf -0.0 } have been fixed.
-07-11-15  The full { SIGRTMIN SIGRTMIN+1 ... SIGRTMAX-1 SIGRTMAX } range
-	  of signals, determined at runtime, are now supported.
-07-11-15  A bug in which creating an index array with only subscript 0 created
-	  only a simple variable has been fixed.
-07-11-14  A bug in which appending to an indexed array using the form
-	  name+=([sub]=value) could cause the array to become an associative
-	  array has been fixed.
-07-11-14  A bug in which typeset without arguments could coredump if a
-	  variable is declared as in indexed array and  has no elements has
-	  been fixed.
-07-11-14  A bug in which creating a local SECONDS variable with typeset in
-	  a function could corrupt memory has been fixed.
-07-11-14  A bug which could cause a core dump when a script invoked by name
-	  from a function used compound variables has been fixed.
-07-11-05  A bug in which printf %d "'AB" did not diagnose unconverted characters
-	  has been fixed.
-07-11-05  printf %g "'A" support added for all floating point formats.
-07-11-01  A bug in which typeset -f fun did not display the function definition
-          when invoked in a subshell has been fixed.
-07-10-29  The sleep builtin was fixed so that all floating point constants
-	  are valid operands.
-07-10-10  A bug in which the locale was not being restored after
-          LANG=value command has been fixed.
-07-09-20  A bug in which a nameref to a compound variable that was local
-	  to the calling function would not expand correctly when displaying
-	  is value has been fixed.
-07-09-19  A bug which cause cause a core dump if .sh.edchar returned
-	  80 characters or more from a keyboard trap has been fixed.
-07-09-14  A bug in which could cause a core dump when more than 8 file
-	  descriptors were in use has been fixed.
-07-09-10  A bug in which creating a name reference to an instance of
-	  an array when the array name is itself a reference has been fixed.
-07-09-10  The file completion code has been modified so that after an = in
-	  any word, each : will be considered a path delimiter.
-07-09-06  A bug in which subprocess cleanup could corrupt the malloc() heap
-          has been fixed.
-07-08-26  A bug in which a name reference to an associative array instance
-	  could cause the subscript to be evaluated as an arithmetic expression
-	  has been fixed.
-07-08-22  A bug in which the value of an array instance was of a compound
-	  variable was not expanded correctly has been fixed.
-07-08-14  A bug which could cause a core dump when a compound assignment was
-	  made to a compound variable element with a typeset -a attribute
-	  has been fixed.
-07-08-08  A bug in which a trap ignored in a subshell caused it to be
-	  ignored by the parent has been fixed.
-07-08-07  A bug in which the set command would generated erroneous output
-	  for a variable with the -RZ attribute if the variable name had been
-	  passed to a function has been fixed.
-07-08-02  A bug in which read x[1] could core dump has been fixed.
-07-08-02  A second bug in which after read x[sub] into an associative array
-	  of an element that hasn't been assigned could lead to a core dump
-	  has been fixed.
-07-07-31  A bug in which a pipeline that completed correctly could have
-	  an exit status of 127 when pipefail was enabled has been fixed.
-07-07-09  The SHOPT_AUDIT compile option has been added for keyboard logging.
-07-06-25  In vi insert mode, ksh no longer emits a backspace character
-	  before the carriage return when the newline is entered. 
-07-06-25  A bug in which pipefail would cause a command to return 0
-	  when the pipeline was the last command and the failure happened
-	  on a component other than the last has been fixed.
-07-06-25  A bug in the expansion of ${var/pattern/rep} when pattern or rep
-	  contained a left parenthesis in single quotes has been fixed.
-07-06-18  The braces for a subscripted variable with ${var[sub]} are now
-	  optional when inside [[...]], ((...)) or as a subscript.
-07-05-28  A bug in brace expansion in which single and double quotes did
-          not treat the comma as a literal character has been fixed.
-07-05-24  The -p option of whence now disables -v.
-07-05-23  Several bug fixes in compound variables and arrays of arrays
-	  have been made.
-07-05-15  A bug in which the %B format of printf was affected  by the
-	  locale has been fixed.
-07-05-14  A bug in which \ was not removed in the replacement pattern with
-	  ${var/pattern/rep} when it was not followed by \ or a digit has
-	  been fixed.
-07-05-10  A bug in which ksh -R file core dumped if no script was specified
-	  has been fixed.  it not displays an error message.
-07-05-07  Added additional Solaris signals to signal table.
-07-04-30  A bug in which a pipeline with command substitution inside a
-	  function could cause a pipeline that invokes this function to
-	  hang when the pipefail option is on has been fixed.
-07-04-30  Added -q to whence.
-07-04-18  A small memory leak with each redirection of a non-builtin has
-	  been fixed.
-07-03-08  A bug in which set +o output command line options has been fixed.
-07-03-08  A bug in which an error in read (for example, an invalid variable
-	  name), could leave the terminal in raw mode has been fixed.
-07-03-06  A bug in which read could core dump when specified with an array
-	  variable with a subscript that is an arithmetic expression has
-	  been fixed.
-07-03-06  Several serious bugs with the restricted shell were reported and
-	  fixed.
-07-03-02  If a job is stopped, and subsequently restarted with a CONT
-	  signal and exits normally, ksh93 was incorrectly exiting with
-	  the exit status of the stop signal number.
-07-02-26  M-^L added to emacs mode to clear the screen.
-07-02-26  A bug in which setting a variable readonly in a subshell would
-	  cause an unset error when the subshell completed has been fixed. 
-07-02-19  The format with printf uses the new = flag to center the output.
-07-02-19  A bug in which ksh93 did not allow multibyte characters in
-	  identifier names has been fixed.
-07-02-19  A bug introduced in ksh93 that causes global compound variable
-	  definitions inside functions to exit with "no parent" has been fixed.
-07-02-19  A bug in which using compound commands in process redirection
-	  arguments would give syntax errors <(...) and >(...) has been fixed.
-07-01-29  A bug which caused the shell to core dump which can occur when a
-	  built-in exits without closing files that it opens has been fixed.
-07-01-26  A bug in which ~(E) in patterns containing \ that are not inside ()
-	  has been fixed.
-
-06-12-29  --- Release ksh93s  ---
-06-12-29  A bug in which the value of IFS could be changed after a command
-	  substitution has been fixed. 
-06-12-22  /dev/(tcp|udp|sctp)/HOST/SEVRICE now handles IPv6 addresses on
-	  systems that provide getaddrinfo(3).
-06-12-19  A -v option was added to read.  With this option the value of
-	  the first variable name argument will become the default value
-	  when read from a terminal device. 
-06-11-20  A bug in which "${foo[@]:1}}" expands a null argument (instead of
-	  no argument), when foo[0] is not empty has been fixed. 
-06-11-16  The discipline functions have been modified to allow each subscript
-	  to act independently.  Currently the discipline function will not
-	  be called when called from a discipline function of the same variable.
-06-11-14  A bug which could cause a core dump if a file descriptor for
-	  an internal file was closed from with a subshell has been fixed.
-06-10-30  The redirections <# pattern, and <## pattern have been added.
-	  Both seek forward to the beginning of the next line that contains
-	  the pattern.  The <## form copies the skipped portion to standard
-	  output.
-06-10-26  On systems that support stream control transport, the virtual file
-	  name /dev/sctp/host/port can now be used to establish connections.
-06-10-26  The printf modifier # when used with d produces units in thousands
-	  with a single letter suffix added.  The modifier # when used with
-	  the i specification provides units of 1024 with a two letter suffix.
-06-10-24  The value of $! is now set to the process id of a job put
-	  into the background with the bg command as required by POSIX.
-06-10-23  A bug in which the value of $! was affected by a background
-	  job started from a subshell has been fixed.
-06-10-23  A bug in ${var:offset:len} in multibyte locales has been fixed.
-06-10-15  The remaining math functions from C99 were added for any system
-	  that supports them.
-06-10-13  The klockwork.com software detected a few coding errors that
-	  have been fixed.
-06-10-12  A bug when skipping over `...` with ${x:=`...`} when x is set
-	  has been fixed.
-06-10-11  A bug in process floating constants produced by the %a format
-	  of printf has been fixed.
-06-10-06  A bug in which IFS was not being restored correctly in some
-	  cases after a subshell has been fixed.
-06-10-06  A bug in which pipefail was not detecting some failures in
-	  pipelines with 3 or more states has been fixed.
-06-10-03  A bug in the processing of >(...) with builtins which could
-	  cause the builtin to hang has been fixed.
-06-10-03  A bug in the for loop optimizer which causes >(...) process
-	  substitution to be ignored has been fixed.
-06-09-17  The -a option was added to typeset for indexed arrays.  This
-	  is only needed when using the ([subscript]=value ...) form.
-06-09-06  The showme option was added.  Each simple command not beginning
-	  with a redirection and not occurring with in the while, until, if,
-	  select condition can be preceded by a semi-colon which will
-	  be ignored when showme is off.  When showme is on, any command
-	  preceded by a colon will be traced but not executed.
-06-08-16  As a new feature, a leading ~(N) on a pattern has no effect 
-	  except when used for file expansion.  In this case if not
-	  matches are found, the pattern is replaced by nothing rather
-	  than itself.
-06-08-11  A bug in the expansion of ${.sh.match[i]:${#.shmatch[i]}} has
-	  been fixed.
-06-08-10  The read builtin options -n and -N have been modified to treat
-          the size as characters rather than bytes unless storing into a
-	  binary (typeset -B) variable.
-06-07-27  When the here document operator << is followed directly by a #
-	  rather than a -, the first line of the here-document determines
-	  how much whitespace is removed for each line.
-06-07-26  A bug in the C-shell history (enabled with set -H) in which the
-	  history event !$ was not processed has been fixed.
-06-07-21  A bug on some systems in which assigning PATH on a command line
-	  would not take effect has been fixed.
-06-07-20  Add ksh93 and rksh93 as allowable names for ksh binaries.
-06-07-20  Removed the SHOPT_OO compilation option which was only partially
-	  implemented.
-06-07-20  The ability to use egrep, grep, and fgrep expressions within
-	  shell patterns has been documented.
-06-07-17  A bug with arithmetic command expressions for locales in which
-	  the comma is a thousands separator has been fixed. 
-06-07-13  The default HISTSIZE was increased from 128 to 512.
-06-07-13  A multibyte problem with locales that use shift codes has been fixed.
-06-06-23  A number of bug fixes for command, file, and variable completion
-	  have been mode.
-06-06-20  Floating point division by zero now yields the constant Inf or -Inf
-	  and floating functions with invalid arguments yield NaN. 
-06-06-20  The floating point constants Inf and NaN can be used in arithmetic
-	  expressions.
-06-06-20  The functions isinf(), isnan(), tanhl() have been added for
-	  arithmetic expressions.
-06-06-13  Internal change to use ordering for variables instead of hashing
-	  to speed up prefix matching.
-06-06-13  A window between fork/exec in which a signal could get lost
-	  and cause a program to hang has been eliminated
-06-06-13  A bug in edit completion with quoted strings has been fixed.
-06-06-07  The restricted options can now be enabled by set as well as on
-	  the command line.  Once set, it can not be disabled.
-06-06-04  Modified built-in binding so that for systems for which /bin
-          and /usr/bin are the same, a builtin bound to /bin will get
-	  selected when either /bin or /usr/bin is scanned.
-06-06-04  Added literal-next character processing for emacs/gmacs mode. 
-	  This change is not compatible with earlier versions of ksh93
-          and ksh88 when the stty lnext is control-v.  The sequence
-	  escape-control-v will display the shell version.
-06-05-31  Modified emacs and vi mode so that entering a TAB after a partial
-	  TAB completion, generates a listing of possible completions.
-	  After the second TAB, a number followed by a TAB will perform
-	  the completion with the corresponding item.
-06-05-19  Modified arithmetic so that conversions to strings default to
-	  the maximum number of precision digits.
-06-05-16  Bug fixes for multibyte locales. 
-06-05-10  The =~ operator was added to [[...]] and  [[ string ~= ERE ]]
-	  is equivalent to [[ string == ~(E)ERE ]].
-06-04-25  A bug in the vi edit mode which could cause the shell to core dump
-	  when switching from emacs mode.
-06-04-17  A bug in which using LANG or LC_ in assignment lists with builtins
-	  did not restore the localed correctly has been fixed.
-06-04-04  A bug in which discipline functions could not be added to variables
-	  whose names started with .sh has been fixed.
-06-03-28  The -s option to typeset was added to modify -i to indicate short
-	  integers.
-06-03-28  A bug in which variables assignment lists before functions
-	  defined with function name were not passed on the functions
-	  invoked by this function has been fixed. 
-06-03-28  A bug in which name references defined within a function defined
-	  with function  name could not be used with compound variables has
-	  been fixed.
-06-03-27  A bug in which read <&p (print >&p) would cause the coprocess input
-	  (output) pipe to close before reading from (after writing to)
-          it has been fixed.
-06-02-28  A bug in which stopping a job created with the hist builtin command
-	  would create a job that could not be restarted has been fixed.  
-
-06-01-24  --- Release ksh93r  ---
-06-01-24  A bug in which running commands with standard output closed would
-	  not work as expected has been fixed.
-06-01-23  A bug in which print -u<n> could fail when file descriptor <n> was
-	  open for writing has been fixed.
-06-01-19  The ?: arithmetic operator fixed to work when the operation after
-	  the colon was an assignment.
-05-12-24  A bug which could lead to a core dump when elements of a compound
-	  variable were array elements, i.e. foo=(bar=(1 2)), has been fixed.
-05-12-13  An arithmetic bug in which x+=y+=z was not working has been fixed. 
-05-12-13  An arithmetic bug in which x||y was returning x when x was non-zero
-	  rather than 1 has been fixed.
-05-12-07  The aliases for integer and float have been changed to use attributes
-	  -li and -lE to handle long long and long double types.
-05-12-07  The histexpand (-H) option has been added which allows C-shell
-	  style history expansions using the history character !.
-05-12-07  The multiline option was added which changes that way the edit
-	  modes handle lines longer than the window width.  Instead of
-	  horizontal scrolling, multiple lines on the screen are used.
-05-12-05  The whence builtin now returns an absolute pathname when the
-          command is found in the current directory.
-05-11-29  A bug which caused ksh -c '[[ ! ((' to core dump rather than
-	  report a syntax error has been fixed.
-05-11-29  A bug when reading fixed length records into typeset -b variables
-	  which caused a zero byte to terminate the value has been fixed.
-05-11-22  The ability to seek to an offset within a file has been added
-	  with the new I/O redirection operators, <#  and >#.  Currently,
-	  these redirection operators must be followed by ((expr))
-	  but in a future release, it should be able to used to seek forward
-	  to the specified shell pattern.  In addition $(n<#) expands to the
-	  current byte offset for file descriptor n.
-05-11-22  The .sh.match array variable is now set after each [[ ... ]]
-	  pattern match.  Previously it was only set for substring matches.
-05-10-17  A bug in which the library path variable could be prefixed
-          with a directory when a .path file was not encountered in
-	  the directory of the executable has been fixed.
-05-09-15  A for/while loop optimizer bug in which $OPTIND was not
-	  correctly expanded has been fixed.
-05-09-05  A bug in which a history command that invoked a history
-	  command could go into an infinite loop has been fixed.
-05-08-31  In the case that IFS contains to adjacent new-lines so that
-	  new-line is not treated as a space delimiter, only a single
-	  new-line is deleted at the end of a command substitution.
-05-08-19  When a tilde substitution expands to the / directory and is
-	  followed by a /, it is replaced by the empty string.
-05-08-16  A bug in which n<&m did not synchronize m has been fixed.
-05-08-16  A bug in which process substitution  ( <() and >() ) was not
-	  working within for and while loops has been fixed.
-05-07-24  A bug in which the pattern ~(E)(foo|bar) was treated as a syntax
-	  error has been fixed.
-05-07-24  A bug in completion with <n>=, where n was the one of the
-	  previous selection choices has been fixed.
-05-07-21  A bug with multibyte input when no edit mode was specified which
-	  caused the input line to shift left/right has been fixed.
-05-06-24  A race condition which could cause the exit status to get lost
-	  on some fast systems has been fixed.
-05-06-21  A bug in which nested patterns of the form {m,n}(pat) would cause
-	  syntax errors has been fixed.
-05-06-21  A bug in the macro expander has been fixed which could cause a
-          syntax error for an expansion of the form ${x-$(...)} when
-	  x is set and the command substitution contained certain strings.
-05-06-08  On systems for which echo does not do System V style \ expansions,
-	  the -e option was added to enable these expansion.
-05-06-08  A bug in which ${var op pattern} to not work when inside an
-	  arithmetic expression has been fixed.
-05-05-23  An extension to shell patterns that allows matching of nested
-	  groups while skipping over quoted strings has been added.
-05-05-18  A bug in which the line number for errors was not correct for
-          functions loaded from FPATH has been fixed.
-05-04-18  A bug in which the exit status $? is not set when a trap triggered
-	  by the [[...]] command is executed has been fixed.
-05-04-08  Redirection operators can be directly preceded with {varname}
-	  with no intervening space, where varname is a variable name which
-	  allows the shell to select a file descriptor > 10 and store it
-	  into varname.
-05-04-08  SHOPT_CMDLIB_BLTIN=1 now includes <cmdlist.h> generated table.
-05-04-07  [[ -o ?option ]] is true if "option" is a supported option.
-05-04-05  A bug in handling file completion with spaces in the names
-          has been fixed.
-05-03-25  The SIGWINCH signal is caught by default to keeps the LINES and
-	  COLUMNS variables in sync with the actual window size.
-05-03-25  Building ksh with SHOPT_REMOTE=1 causes ksh to set --rc if stdin is
-	  a socket (presumably part of a remote shell invocation.)
-05-03-25  Building ksh with SHOPT_SYSRC=1 causes interactive ksh to source
-	  /etc/ksh.kshrc (if it exists) before sourcing the $ENV file.
-05-03-25  {first..last[..incr][%fmt]} sequences added to brace expansions
-	  when braceexpand is enabled.
-05-03-03  A bug where a SIGCHLD interrupt could cause a fifo open to fail has
-	  been fixed.
-05-02-25  A bug in which a builtin command run in the background could
-	  keep a file descriptor open which could cause a foreground
-	  process to hang has been fixed.
-05-02-24  A bug where builtin library commands (e.g., date and TZ) failed to
-	  detect environment variable changes has been fixed.
-05-02-22  The read builtin and word splitting are now consistent with respect
-	  to IFS -- both treat IFS as field delimiters.
-05-02-22  The read builtin no longer strips off trailing delimiters that
-	  are not space characters when there are fewer variables than fields.
-05-02-17  A builtin bug on systems where dlsym(libcmd) returns link-time
-	  bindings has been fixed.
-05-02-12  A bug in which the lib_init() function for .paths BUILTIN_LIB
-	  libraries was not called has been fixed.
-05-02-06  A bug on some systems in which moving the write end of a co-process
-	  to a numbered file descriptor could cause it to close has been fixed. 
-05-02-06  A bug in the vi-edit mode in which the character under the cursor
-	  was not deleted in some cases with the d% directive has been fixed.
-05-02-06  A bug where external builtin stdout/stderr redirection corrupted
-          stdout has been fixed.
-05-02-04  A bug where times formatting assumed CLK_TCK==60 has been fixed.
-
-05-01-11  --- Release ksh93q  ---
-05-01-11  A bug in the integral divide by zero check has been fixed.
-05-01-11  The -l option has been added to read /etc/profile and
-	  $HOME/.profile, if they exist, before the first command.
-05-01-11  An argument parsing bug that caused `kill -s x -- n' to fail has
-	  been fixed.
-05-01-11  The .paths file, introduced in ksh93m, which can appear in
-	  any directory in PATH, now allows a line of the form 'BUILTIN_LIB=.'
-	  When a command is searched for this directory, and the full path
-	  matches the path of the built-in version of the command (listed
-	  by the 'builtin' command) then the built-in version of the command
-	  is used.  When ksh is built with SHOPT_CMDLIB_DIR=1 then all libcmd
-	  functions become builtins with the '/opt/ast/bin/' directory prefix.
-05-01-10  A bug in which a nameref to a compound name caused a core dump has
-	  been fixed.
-05-01-09  A bug in which some SIGCHLD interrupts (from child processes exiting)
-	  caused a fatal print/echo error diagnostic has been fixed.
-04-12-24  A bug in which some SIGCHLD interrupts (from child processes exiting)
-          corrupted the internal process/job list, sometimes causing the shell
-	  to hang, has been fixed.
-04-12-01  A bug in which typeset -Fn truncated less than n digits for large
-	  numbers has been fixed.
-04-11-25  A bug in which standard error could be closed after a redirection
-	  to /dev/stderr has been fixed.
-04-11-17  A bug in which an expansion of the form ${array[@]:3} could expand
-          to ${array[0]} when ${array[3]} was not set has been fixed.
-04-10-22  The -E or -orc command line option reads ${ENV-$HOME/.kshrc} file.
-04-10-22  `-o foo' equivalent to `+o nofoo', `-o nobar' equivalent to `+o bar'.
-          `--foo' equivalent to `-o foo', `--nofoo' equivalent to `+o foo'
-04-10-05  The .paths file, introduced in ksh93m, which can appear in
-	  any directory in PATH, now allows a line of the form
-	  'BUILTIN_LIB=libname'.  When a command is searched for this directory,
-	  the shared library named by libname will first be searched for a
-	  built-in version of the command.
-04-09-03  <<< here documents now handle quotes in the word token correctly. 
-04-08-08  The maximum size for read -n and and read -N was increased from
-	  4095 to 32M.
-04-08-04  printf %q was modified so that if an no operand was supplied, no
-	  no output would be generated rather than a quoted empty string.
-04-08-01  The -n and -N options of the read builtin has been modified
-	  when reading variables with the binary attribute so that the
-	  data is stored directly rather than through assignment.
-04-08-01  The shcomp command has been modified to process alias commands
-	  under some conditions.
-04-07-31  The .sh.match variable added in ksh93l, now works like other
-	  indexed arrays.
-04-07-08  A loop optimizer bug which occurs when typeset is used in
-	  a for or while loop inside a function has been fixed.
-04-06-24  The number of subexpressions in a pattern was increased to 64
-	  from the current number of 20.
-04-06-17  The -t option to read was modified to allow seconds to be
-	  specified as any arithmetic expression rather than just
-	  an integral number of seconds, for example even -t 'sin(.5)'
-	  is now valid.
-04-06-16  Two small memory leak problems were fixed.
-04-06-15  A bug in ${var/pattern/"string"} which occurred when string
-	  contained pattern matching characters has been fixed.
-04-05-08  printf $'%d\n' produced an erroneous error message and has
-	  been fixed.
-04-05-24  A bug in which an associative array without any elements could
-	  cause a core dump when a script with an associative array with
-	  the same name was declared in a script invoked by name has
-	  been fixed.
-04-05-11  A bug in which an exec statement could close the script that
-	  is being processed in a script that is run by name causing
-	  a failure has been fixed.
-04-04-28  If the first character of assignment to an integer variable was 0,
-          the variable had been treated as unsigned.  This behavior was
-          undocumented and has been removed.
-04-04-05  A bug in which the positioning of standard input could be incorrect
-	  after reading from standard input from a subshell has been fixed.
-04-03-30  A bug in the for loop optimizer which in rare cases could cause
-	  memory corruption has been fixed.
-04-03-29  The preset alias source='command .' has been added.
-04-03-29  A bug introduced in ksh93p on some systems in which invoked by
-	  name with #! on the first line would not get the signals handling
-	  initialized correctly has been fixed. 
-04-03-29  A bug introduced in ksh93p in which a HUP signal received by
-	  a shell that is a session group leader was not passed down to
-	  its children has been fixed.
-
-04-02-28  --- Release ksh93p  ---
-04-02-28  The ability to apply an append discipline to any variable has
-	  been added.
-04-02-14  A bug in which the exportall option (set -a) would cause incorrect
-	  results for arrays has been fixed.
-04-02-02  A bug in which an exported array would pass more than
-	  the first element to a script invoked by name has been fixed.
-04-02-02  A bug on some systems in which name=value pairs preceding a script
-	  invoked by name was not getting passed to the script has been fixed.
-04-01-20  A bug in which an unset discipline function could cause a core
-	  dump on some systems has been fixed.
-04-01-12  A bug in which a continue or break called outside a loop from
-	  inside a function defined with name() syntax could affect 
-	  the invoking function has been fixed.
-04-01-08  If a command name begins with ~, only filename completion will be
-	  attempted rather than pathname completion using the builtin editors. 
-04-01-08  A bug in the vi edit mode in which the wrong repeat count on
-	  multiple word replacements with the . directive has been fixed.
-04-01-06  Backspace characters are now handled correctly in prompt strings.
-04-01-06  The getopts builtin has been modified to accept numerical
-	  arguments of size long long on systems that support this.
-04-01-06  A bug in which unsetting all elements of an associative array
-	  would cause it to be treated as an indexed array has been fixed.
-03-12-15  A bug in which a quoted string ending with an unescaped $ would
-	  delete the ending $ in certain cases has been fixed.
-03-12-05  A bug in which the shell could hang when set -x tracing a command
-	  when an invalid multibyte character is encountered has been fixed. 
-03-12-05  On some systems, if the KEYBD trap is set, then commands that use
-	  the meta key were not processed until return was hit.  This
-	  has been fixed.
-03-12-05  A problem which occurred when the login shell was not a group
-	  leader that could cause it to fail has been fixed.
-03-12-05  A problem in which a shell could core dump after receiving a signal
-	  that should cause it to terminate while it was in the process
-	  of acquiring more space has been fixed.
-03-12-05  If ENV is not specified, the shell will default to $HOME/.kshrc
-	  for interactive shells.
-03-11-21  A bug introduced in ksh93o in which the DEBUG trap could get
-	  disabled after it triggered has been fixed. 
-03-11-04  A bug in which using arithmetic prefix operators ++ or -- on a
-	  non-lvalue could cause a core dump has been fixed.
-03-11-04  A bug in which leading zeros were stripped from variable
-	  expansions within arithmetic computation to avoid being treated
-	  as octal constants when they should not have, has been fixed.
-03-10-08  A bug introduced in ksh93o in which a large here document inside
-	  a function definition could get corrupted has been fixed.
-03-09-22  A bug in which the .get discipline function was not being
-	  called when a string variable was implicitly referenced from
-	  within a numerical expression has been fixed.
-03-09-22  A bug in which a script without a leading #! could get executed
-	  by /bin/sh rather than the current shell on some systems has
-	  been fixed.
-03-09-12  To improve conformance with ksh88, leading zeros will be ignored
-	  when getting the numerical value of a string variable so that
-	  they will not be treated as octal constants.
-03-09-03  The builtin kill command now processes obsolete invocations
-	  such as kill -1 -pid.
-03-09-02  The restriction on modifying FPATH in a restricted shell (sh -r)
-	  has been documented.
-03-09-02  The restricted shell (sh -r) has been modified to disallow
-	  executing command -p.
-03-08-07  A bug in which the KEYBD trap was not being invoked when
-	  characters with the 8th bit set has been fixed.
-03-08-02  A parser bug introduced in ksh93o which caused the character
-	  after () in a Posix function definition to be skipped 
-	  when reading from standard input has been fixed.
-03-08-01  A bug in which "${foo#pattern}(x)" treated (x) as if it were
-	  part of the pattern has been fixed.
-03-08-01  The command -x option has been modified so that any trailing
-	  arguments that do expand to a single word will be included
-	  on each invocation, so that commands like command -x mv * dir
-	  work as expected.
-
-03-07-20  --- Release ksh93o+  ---
-03-07-20  A bug in which could cause memory corruption when a posix
-	  function invoked another one has been fixed.
-03-07-15  A bug in which a file descriptor>2 could be closed before
-	  executing a script has been fixed.
-03-07-15  A parsing error for <() and >() process substitutions inside
-	  command substitution has been fixed.
-03-07-15  A parsing error for patterns of the form {...}(...) when
-	  used inside ${...} has been fixed.
-03-07-15  An error in which expanding an indexed array inside a compound
-	  variable could cause a core dump has been fixed.
-03-07-15  A bug in which on rare occasions a job completion interrupt
-	  could cause to core dump has been fixed.
-03-06-26  A bug in which process substitution embedded within command
-	  substitution would generate a syntax error has been fixed.
-03-96-23  A bug in which ${@:offset:len} could core dump when there
-	  were no arguments has been fixed.
-03-96-23  A bug in which ${X[@]:offset:len} could core dump when X
-	  was unset has been fixed.
-03-06-22  The -x option was added to the command builtin.  If this
-	  option is on, and the number of arguments would exceed ARG_MAX,
-	  the command will be invoked multiple times with a subset of
-	  the arguments.  For example, with alias grep='command -x grep,
-	  any number of arguments can be specified.
-03-06-14  A bug in which could cause a core dump on some systems with
-	  vi and emacs editors with the MULTIBYTE option has been fixed.
-03-06-06  A bug in which the shell could core dump when a script was
-	  run from its directory, and the script name a symlink to a file
-	  beginning with .., has been fixed.
-03-06-05  A bug in which the shell could core dump when a child process
-	  that it is unaware of terminates while it is calling malloc()
-	  has been fixed.
-03-06-02  An option named globstar (set -G) has been added.  When enabled,
-	  during pathname expansion, any component that consists only of ** is
-	  matches all files and any number of directory levels.
-03-05-30  A bug in which the PATH search could give incorrect results when
-	  run from directory foo and PATH contained .:foo:xxx has been fixed.
-03-05-29  Some changes were made to the code that displays the prompt in edit 
-	  mode to better handle escape sequences in the prompt.
-03-05-27  I added = to the list of characters that mark the beginning of
-	  a word for edit completion so that filenames in assignments
-	  can be completed.
-03-05-20  A bug in which read -N could hang on some systems when reading
-	  from a terminal or a pipe has been fixed.
-03-05-19  A bug in which the output of uname from a command substitution
-	  would go to the standard output of the invoking command when
-	  uname was invoked with a non-standard option has been fixed.
-03-05-19  A job control bug which would cause the shell to exit because 
-	  it hadn't take back the terminal has been fixed.  The bug
-	  could occur when running a function that contained a pipeline
-	  whose last element was a function.
-03-05-19  A job control timing bug introduced in ksh93o on some systems
-	  which could cause a pipeline to hang if the first component
-	  completed quickly has been fixed.
-03-05-13  The read builtin has been modified so that the builtin editors
-	  will not overwrite output from a previous incomplete line. 
-03-05-13  A bug in which the name of an identifier could have the string
-	  .sh. prefixed to it after expanding a variable whose name begins
-	  with .sh. has been fixed.
-03-05-13  A bug in the expansion of $var for compound variables in which
-	  some elements would not be output when the name was a prefix
-	  of another name in the compound variable has been fixed.
-03-05-08  The last item in the ksh93o release on 03-01-02 has been
-	  altered slightly to preserve the leading 0's when the
-	  preceding character is a digit.  Thus, with typeset -LZ3 x=10,
-	  $(( 1$x)) will be 1010 whereas $(( $x) will be 10.
-03-04-25  A bug in which if x is a name reference, then nameref y=x.foo
-	  did not follow x has been fixed.
-
-03-03-18  --- Release ksh93o  ---
-03-03-18  A -N unary operator was added to test and [[...]] which returns
-	  true if the file exists and the file has been modified since it
-	  was last read.
-03-03-18  The TIMEFORMAT variable was added to control the format for
-	  the time compound command.  The formatting description is
-	  described in the man page.
-03-03-06  A -N n option was added to read which causes exactly n bytes
-	  to be read unlike -n n which causes at most n bytes to be read.
-03-03-03  Three new shell variables were added.  The variable .sh.file
-	  stores the full pathname of the file that the current command
-	  was found in.  The variable .sh.fun names the current function
-	  that is running.  The variable .sh.subshell contains the depth
-	  of the current subshell or command substitution.
-03-03-03  When the DEBUG trap is executed, the current command line after
-	  expansions is placed in the variable .sh.command.  The trap
-	  is also now triggered before each iteration of a for, select,
-	  and case command and before each assignment and redirection.
-03-02-28  Function definitions are no longer stored in the history file so
-	  that set -o nolog no longer has any meaning.
-03-02-28  All function definitions can be displayed with typeset -f not
-	  just those stored in the history file.  In addition, typeset +f
-	  displays the function name followed by a comment containing the
-	  line number and the path name for the file that defined this function.
-03-02-28  A bug in which the value of $LINENO was not correct when executing
-	  command contained inside mult-line command substitutions has been
-	  fixed.
-03-02-19  Since some existing ksh88 scripts use the undocumented and
-	  unintended ability to insert a : in front of the % and # parameter
-	  expansion operators, ksh93 was modified to accept :% as equivalent
-	  to % and :# as equivalent to # with ${name op word}.
-03-02-14  A bug which could cause a core dump when reading from standard
-	  error when standard error was a pty has been fixed.
-03-02-14  The shell arithmetic was modified to use long double on systems
-	  that provide this data type.
-03-02-09  A bug in which a function located in the first directory in FPATH
-	  would not be found when the last component of PATH was . and the
-	  current directory was one of the directories in PATH has been fixed.
-03-02-07  The trap and kill builtin commands now accept a leading SIG prefix
-	  on the signal names as documented.
-03-02-05  A bug in the expansion of ${var/$pattern}, when pattern contained
-	  \[ has been fixed.
-03-02-05  A bug in which .sh.match[n], n>0, was not being set for substring
-	  matches with % and %% has been fixed.
-03-01-15  A bug in which getopts did not work for numerical arguments specified
-	  as n#var in the getopts string has been fixed.
-03-01-09  A bug in which using ${.sh.match} multiple times could lead to
-	  a memory exception has been fixed.
-03-01-06  A bug in the expansion of ${var/pattern/$string} in the case that
-	  $string contains \digit has been fixed. 
-03-01-02  A -P option was added for systems such as Solaris 8 that support
-	  profile shell.
-03-01-02  For backward compatibility with ksh88, arithmetic expansion
-	  with ((...)) and let has been modified so that if x is a zero-filled
-	  variable, $x will not be treated as an octal constant.
-
-02-12-05  --- Release ksh93n+  ---
-02-11-30  A bug that can show up in evaluating arithmetic statements that
-	  are in an autoloaded function when the function is autoload from
-	  another function has been fixed.
-02-11-30  An optimization bug in which an expansion of the form ${!name.@},
-	  which occurred inside a for or a while loop, when name is a name
-	  reference, has been fixed.
-02-11-18  A bug in which modifying array variables in a subshell could leave
-	  side effects in the parent shell environment has been fixed.
-02-11-18  A memory leak when unsetting an associative array has been fixed.
-02-11-14  The code to display compound objects was rewritten to make
-	  it easier for runtime extensions to reuse this code.
-02-11-14  A change was made to allow runtime builtins to be notified when
-	  a signal is received so that cleanup can be performed.
-02-10-31  User applications can now trap the ALRM signal.  Previously,
-	  the ALRM signal was used internally and could not be used
-	  by applications. 
-02-10-31  A bug in which signals received while reading from a coprocess
-	  for which traps were set was not handled correctly has been fixed.
-02-10-31  A bug in which a file opened with exec inside a subshell could
-	  be closed before the subshell completed has been fixed.
-02-10-21  A bug in which setting PATH or FPATH inside a function might not
-	  take effect has been fixed.
-02-10-21  A bug which could cause a core dump when a local SECONDS variable
-	  is defined in a function has been fixed.
-02-10-15  A bug in which the associate array name operator ${!array[@]}
-	  could return the same name multiple times has been fixed.
-02-10-15  A bug in which the zero'th element of an associative array was
-	  not getting set when an assignment was made without a subscript
-	  specified has been fixed.
-
-02-09-30  --- Release ksh93n  ---
-02-09-30  The maximum indexed array size was increased to 16Megs.
-02-09-30  A bug which could cause a core dump when changing attributes
-	  of associative array has been fixed.
-02-09-30  A bug in which exporting an array variable would not export the
-	  0-th element has been fixed.
-02-09-30  A bug in which an array assignment of the form a=($a ...) would unset
-	  'a' before the right hand side was evaluated has been fixed.
-02-09-27  A bug in which the error message for ${var?message} when var was
-	  null or unset did not contain the variable name var has been fixed.
-02-09-27  A bug in which closing file descriptors 0 through 2 could
-	  cause a subsequent here document to fail has been fixed. 
-02-09-14  A bug in whence which occurs when the specified name contained
-	  a / has been fixed.
-02-09-14  A bug in the parser for strings of the form name$((expr))=value
-	  has been fixed.
-02-09-14  A for loop optimization bug in which the number of elements in
-	  an array was treated as an invariant has been fixed.
-02-09-09  A bug in which redirection or closing of a file descriptor between
-	  3 and 9 could cause a subsequent here document to fail has been
-	  fixed. 
-02-09-09  A bug in which a background job was not removed from the job list
-	  when a subshell completed has been fixed, for example (prog&). 
-02-09-03  A bug in which an assignment of the form name=(integer x=3)
-	  could be interpretted as an array assignment rather than a
-	  compound variable assignment has been fixed.
-02-08-19  A command completion bug which occurred on file systems that
-	  are case insensitive has been fixed.
-02-08-19  A bug which could lead to an exception on some systems (for
-	  example FREEBSD) which occurred when setting PATH has been fixed.
-02-08-11  A bug in arithmetic rounding in which a value input as a decimal
-	  string would output as a rounded version of the string has
-	  been fixed.
-02-08-11  A bug in which the last character could be deleted from shell
-	  traces and from whence when called from a multibyte locale
-	  has been fixed.
-02-08-01  A bug which could cause a core dump to occur when a shell script
-	  is executed while a coprocess is running that has closed the
-	  output pipe has been fixed.
-02-08-01  A bug in which command completion in multibyte mode could
-	  corrupt memory for long command lines has been fixed.
-
-02-06-17  --- Release ksh93n-  ---
-02-06-17  A bug in which user defined macros could cause a core dump in
-	  with MULTIBYTE mode has been fixed.
-02-06-17  A bug in which printf format specifiers of the form %2$s were causing
-	  a core dump has been fixed.
-02-06-17  A bug in which setting stty to noecho mode did not prevent the
-	  echoing of characters by ksh when emacs or viraw mode
-	  was enabled has been fixed.
-02-06-17  A bug in which background job completion could cause the sleep
-	  builtin to terminate prematurely has been fixed.
-02-06-17  A bug in which the shell could core dump if getopts was called
-	  when the OPTIND variable contained a negative value has been fixed. 
-02-06-10  The edit mode prompt has been modified to handle escape sequences.  
-02-06-10  A bug which occurred for interactive shells in which the builtin
-	  cat command was used in command substitution on a file whose
-	  size was larger than PIPE_BUF has been fixed.
-02-06-10  A bug in which the trap on ERR was not being processed when
-	  set inside a function has been fixed.
-02-06-07  A bug in which function definitions could cause the history count
-	  to be decremented by one (and even become negative) has been fixed.
-02-06-05  A bug in read in which share mode could be enabled has been fixed.
-02-05-28  A bug which could occur when the last command of a script was
-	  a case statement and the action selected ended in ;& instead of ;;
-	  has been fixed.
-02-05-23  A bug with unary + introduced in ksh93k has been fixed.
-02-05-07  A bug in substitutions of the form ${var/pattern/string} in which
-	  a backslash was inserted in the replacement string when it contained
-	  a special pattern character has been fixed.
-02-05-01  A bug in the emacs edit mode which occurred in versions compiled
-	  for multibyte character sets which occurred when a repeated search
-	  was requested after a long line had been returned for the previous
-	  search has been fixed.
-02-04-02  vi and emacs edit modes were modified so that tab completion is
-	  disabled when invoked from the read built-in.
-
-02-03-26  --- Release ksh93m+  ---
-02-03-26  A bug in which \ was not handled correctly when used in file
-	  expansion has been fixed.
-02-02-18  A bug in which lines beginning with a # were deleted from here
-	  documents when the here-document delimiter was followed by
-	  a comment has been fixed.
-02-12-06  An optimization bug in which ${!x[@]) was treated as invariant in
-	  a for loop has been fixed.
-02-02-06  A bug in which the ERR trap is not cleared for a script invoked
-	  by name from within a function has been fixed.
-02-01-08  A bug in which a shell script executed from within a subshell
-	  could cause this script to have an invalid pointer leading
-	  to a memory fault has been fixed. 
-02-01-07  Added here documents of the form <<< word (as per zsh) which
-	  is equivalent to << delim\nword\ndelim.
-02-01-07  A bug in which the first word of a compound assignment,
-	  x=(word ...), was treated as a reserved word has been fixed.
-02-01-07  A bug in the handling of \ when noglob was enabled and a
-	  substitution of the form ${word op pattern} occurred in the
-	  same word has been fixed.
-02-01-07  A compilation option, CMDLIB_BLTIN in the file OPTION, has
-	  been added.  When this options is set, all commands implemented
-	  in libcmd become shell builtin commands by default.
-02-01-07  A bug in which builtin foo, where foo is already a builtin
-	  would result in the builtin foo getting removed has been fixed. 
-02-01-07  A bug which the shell executed a command found in the current
-	  directory when PATH have no valid directories has been fixed.
-01-11-28  The value of $? was not being set when called with exit.
-01-11-28  If the last command was of the form (...) and a trap on EXIT or
-	  ERR was set, and the command inside () modified the trap, then
-	  the original trap wasn't executed.
-01-11-26  The value for 0 is now preceded by the base number when
-	  the base was not 10.
-01-11-26  The default has compilation mode has been changes so that
-	  viraw mode will always be on.
-
-01-10-31  --- Release ksh93m  ---
-01-10-31  A for loop optimizer bug for subshells contained withing for
-	  loops has been fixed.
-01-10-16  typeset without arguments no longer outputs variable names
-	  that do not have any attributes that are set.
-01-10-16  A bug introduced in ksh93l in which assignments specified with
-	  the exec built-in were not being expanded properly has been
-	  fixed.
-01-10-11  An optimization bug in which ${!x) was treated as invariant in
-	  a for loop has been fixed.
-01-10-11  Unsigned integer variables in bases other than 10 are printed now
-	  expand in that base with the base prefix.
-01-10-10  A number of typos in the self generating man pages for shell
-	  built-ins have been fixed.
-01-10-04  The self generated man pages for hist and fc were not working
-	  correctly and have been fixed.
-01-10-03  Yet another optimizer bug in which shell patterns were
-	  treated as invariants has been fixed.
-01-09-27  Two bugs relating to multibyte history searches and to find
-	  have been fixed.
-01-09-27  A bug introduced in ksh93k in which the PATH searching was
-	  not restored after running a command with an assignment list 
-	  has been fixed.
-01-09-26  A bug in which a zero filled field was treated as octal when
-	  converted to integer has been fixed.
-01-09-26  Yet another bug in the optimization of for loops related to
-	  recursive functions with break or continue statements has been fixed.
-01-09-25  The exponentiation operator ** was added to the shell arithmetic
-	  evaluation.  It has higher precedence than * and is left
-	  associative.
-01-09-25  The code was modified to use the ast multibyte macros
-	  and functions for handing multibyte locales.
-01-09-25  The expansion ${parameter:offset:length} now handles negative
-	  offsets which cause offsets to be measured from the end.
-01-09-25  Some spelling errors in the documentation were corrected.
-01-09-24  The /dev/tcp/host/port and /dev/udp/host/port now allow
-	  the ports to be specified by service name. 
-01-09-24  The change staring with ksh93g in which the the appropriate
-	  library path variable is prepended with a corresponding library
-	  directory has been modified.  With the new method, only the
-	  library path defined in the file named .paths in the directory
-	  where the executable is found will be modified.  See the
-	  man page for more details.
-01-09-23  The .fpath file (see ksh93h) is no longer looked for in each
-	  directory on the path to locate function directories.  The
-	  file named .paths is used instead.
-01-09-23  A bug in which IFS was not being restored after being changed in
-	  a subshell has been fixed.
-01-09-16  With the vi and emacs edit modes, after a list of command
-	  or functions is generated with = or M-= respectively,
-	  any element from the list can be pasted on the command line
-	  by preceding the = or M-= with a numeric parameter specifying
-	  the position on the list.
-01-09-16  A bug in ksh93l caused command completion not to find aliases
-	  and functions.  Command listing from the edit mode was presented
-	  in reverse order.  This has been fixed.
-01-09-13  Another bug in the optimization of for loops related to subshells
-	  when traps were set has been fixed.
-01-09-07  A change in ksh93l caused brace expansion to stop working
-	  and this has been fixed.
-01-09-04  A bug introduced in ksh93k in which an arithmetic statement
-	  within a function that used name references did not follow the
-	  reference has been fixed.
-01-09-04  A bug introduced in ksh93l in which export -p did not prefix
-	  each export with the word export has been fixed.
-01-08-29  A bug in multibyte input which occurred when a partial multibyte
-	  character was received has been fixed.
-01-08-29  A bug introduced in ksh93l which could cause a core dump
-	  when an assignment list containing PATH is specified inside
-	  command substitution has been fixed.
-01-08-09  Another bug in the optimization of for loops in ksh93l caused
-	  errors in recursive functions using local variables that
-	  contained for loops has been fixed.
-01-07-27  A bug in which IFS would be unset after a command substitution
-	  inside a here document has been fixed.
-01-07-26  To conform to the POSIX standard, if you invoked ksh name,
-	  and name does not contain a /,  it will first try to run
-	  one in the current directory whether it is executable or not
-	  before doing a path search for an executable script.  Earlier
-	  versions first checked for an executable script using the
-	  PATH variable.
-01-07-23  A bug in which unset -f invoked in a subshell could unset a
-	  function defined in the parent has been fixed.
-01-07-16  A bug in the optimization of for loops in ksh93l caused
-	  name references to be treated as invariants has been fixed.
-01-07-09  A bug in which a discipline function applied to a local variable
-	  could cause a shell exception has been fixed.  Discipline
-	  functions can only be specified for global variables. 
-
-01-06-18  --- Release ksh93l  ---
-01-06-18  A bug in assigning integers larger than can be represented as
-	  long integers to floating point variables has been fixed.
-01-06-18  A bug in the handling of unsigned integers (typeset -ui) has
-	  been fixed.
-01-06-04  The evaluation of the PS1 prompt no longer effects the value
-	  of the $? variable.
-01-06-01  A small memory leak from subshells has been fixed.
-01-05-22  A bug in which attributes for variables that did not have
-	  values would be lost after a subshell has been fixed.
-01-05-22  The %R format has been added to convert a shell pattern into
-	  an extended regular expression.
-01-05-22  The escape sequences \e, \cX, \C[.collating-element.], and
-	  \x{hex} have been added to ASCII-C strings and to printf format
-	  strings.
-01-05-20  Patterns of the form {n}(pattern) and {m,n}(pattern) are now
-	  recognized.  The first form matches exactly n of pattern whereas,
-	  the second form matches from m to n instances of pattern.
-01-05-20  The shell allows *-(pattern), +-(pattern),  ?-(pattern),
-	  {m,n}-(pattern}, and @-(pattern) to cause the minimal
-	  match of pattern to be selected whenever possible rather
-	  than the maximal (greedy) match. 
-01-05-20  The character class [:word:] has been added to patterns.
-	  The word class is the union of [:alnum:] and the character _.
-01-05-20  Inside (...) pattern groups, the \ character is now treated
-	  specially even when in an enclosing character class.  The
-	  sequences, \w, \d, \s are equivalent to the character classes
-	  word, digit, and space respectively.  The sequences \W, \D,
-	  and \S are their complement sets. 
-01-05-20  The shell now recognizes pattern groups of the form
-	  ~(options:pattern) where options or :pattern can be omitted.
-	  Options use the letters + and - to enable and disable options
-	  respectively.  The option letters g (greedy), i (ignore case)
-	  are used to cause maximal matching and to cause case
-	  insensitive matching respectively.  If :pattern is also
-	  specified, these options are only in effect while this
-	  pattern is being processed.  Otherwise, these options remain
-	  in effect until the end of the pattern group that they are contained
-	  in or until another ~(...) is encountered.  These pattern groups
-	  are not counted with respect to group numbering.
-01-05-14  When edit completion, expansion, or listing occurs in the
-	  middle of a quoted string, the leading quote is ignored when
-	  performing the completion, expansion, or listing.
-01-05-14  A small memory leak from subshells has been fixed.
-01-05-10  A bug in which open files were not restored after a subshell
-	  that had used exec to replace a file has been fixed. 
-01-05-10  Redirection to a null file name now generates an error message. 
-01-05-09  The shell now rejects some invalid parameter substitutions that
-	  were previously processed in undefined ways.
-01-05-09  A bug in which the output of select was not flushed before the
-	  read when input did not come from the terminal has been fixed. 
-01-05-08  A bug in which job ids would not be freed for interactive shells
-	  when subshells ran built-ins in the background has been fixed.
-01-05-08  The FPATH variable now requires an explicit . to cause the
-	  current directory to be treated as a function directory. 
-01-05-08  A bug in read -n when echo mode was disabled has been fixed.
-01-05-07  A bug in which function definitions could be listed as part
-	  of the history has been fixed.
-01-04-30  This release uses a new and often much faster pattern matcher than
-	  earlier releases.
-01-04-30  An optimizer now eliminates invariant parameter expansions from
-	  for while and until loops.
-01-04-30  The variable .sh.match is set after each pattern match (# % or /)
-	  in a variable substitution.  The variable .sh.match is an
-	  indexed array with element 0 being the complete match. 
-	  The array is only valid until the next subsequent pattern
-	  match or until the value of the variable changes which ever
-	  comes first.
-01-04-30  A self generating man page has been added to shcomp.  Also,
-	  shcomp now stops compiling when it finds an exit or exec
-	  command and copies the remainder so that it can be used
-	  for standard input.
-01-04-30  The shcomp command was modified so that it can work in an
-	  EBCIDIC environment and that binary scripts are portable
-	  across environments.
-01-04-30  A bug in the handling of a trailing : in PATH has been fixed.
-01-04-30  A bug in which the builtin version of a command would get invoked
-	  even though the full pathname for the command was specified
-	  has been fixed.
-01-04-30  A bug in which read would loose the last character when
-	  reading the last line of a file that did not contain a new-line
-	  character has been fixed.
-01-04-23  A bug on some systems in which in vi mode the end of file
-	  character and end of line character could be swapped has
-	  been fixed.
-01-04-23  A bug on some systems in which invoking a shell script that
-	  did not have execute permission could set the exit value to
-	  127 rather than 126 has been fixed.
-01-04-20  A bug in which read -n from a pipe would block if fewer than
-	  n characters was received has been fixed.
-01-04-09  A bug in which invalid patterns, for example, ) by itself,
-	  was not treated as a string has been fixed so that if i=')',
-	  then [[ $i == $i ]] is true.
-01-04-09  The shell arithmetic now interprets C character constants.
-01-04-09  A bug in which a non-zero return from a function defined
-	  with the function reserved word did not trigger the ERR
-	  trap or exit with set -e has been fixed.
-01-04-02  A bug on some systems, in which characters above 127 were
-	  not displayed correctly in vi or emacs edit mode has been fixed.
-01-04-02  A bug on some systems, introduced in the 'k' point release, in
-	  which the erase character in viraw mode was moving the cursor
-	  to the left without erasing the character has been fixed.
-01-04-02  On some systems the wcwith() function was returning a wrong
-	  value for characters and caused characters to be displayed
-	  incorrectly from the shell edit modes.  A work around for
-	  this problem has been added. 
-01-03-26  A bug in which valid scripts could produce syntax errors
-	  when run with locales that considered characters such as "'"
-	  to be space characters has been fixed.
-01-03-20  A bug in which an syntax error in an arithmetic expression
-	  entered interactively could cause the shell to go into
-	  an infinite loop outputting the error message has been fixed.
-01-03-10  ksh93 accepts -l as a synonym for -L in test on systems for
-	  which /bin/test -l tests for symbolic links.
-01-03-10  A bug in parsing scripts in which { and } are used in place of
-	  in and esac in case statements embedded in compound commands
-	  has been fixed.  Use of { and } for in and esac is obsolete.
-01-03-06  A bug in which an argument of the form foo=bar was not
-	  being passed correctly to a traced function whose name
-	  was foo has been fixed.
-01-03-02  Using $(trap -p name) did not print the name of the current
-	  trap setting for trap name.
-01-02-26  Exported floating point variables gave incorrect results
-	  when passing them to ksh88.  This has been fixed.
-01-02-25  A race condition in which a coprocess which completed too quickly
-	  would not allow subsequent coprocesses to start has been fixed.
-01-02-25  The 'g' format specifier is now handled by printf.  It had
-	  inadvertently been omitted.
-01-02-20  The + was not being displayed during an execution trace
-	  with the += assignment operator.
-01-02-19  The error message which occurs when the interpreter name
-	  defined on the #! line does not exist is more informative.
-01-02-19  A bug in which $0 would not be set correctly when a
-	  script with #! was invoked by full pathname from the
-	  directory of the script has been fixed.
-01-02-19  A shell script did not always pick up tty mode changes
-	  made by external commands such as stty which could
-	  effect the behavior of read.
-01-02-19  The -u, -g, and -k unary tests did not give the correct
-	  results when used with negation and this has been fixed.
-
-01-02-05  --- Release ksh93k+  ---
-01-02-05  The sequence \<newline> inside $'...' was not incrementing
-	  the line count and this has been fixed.
-01-02-05  Modified expansion of "${@-}" so that if no arguments are set
-	  it results in null string rather than nothing.
-01-02-02  memory leak problem with local variables in functions fixed.
-01-01-25  allow arithmetic expressions with float%int and treat them
-	  as ((int)float)%int rather than as an error. 
-01-01-19  read -n1 was not working and has been fixed.
-01-01-17  ksh now handles the case in which a here document in command
-	  substitution $() is terminated by the trailing ).  Previously,
-	  a new-line was needed at the end of the delimiter word. 
-01-01-02  A bug in which a KEYBD trap would cause a multi-line token
-	  to be processed incorrectly has been fixed.
-00-12-10  Arithmetic integer constants can now have L and U suffices. 
-00-12-10  A bug in the processing of arithmetic expressions with compound
-	  variables when the -n option is on has been fixed.
-00-12-08  A bug in M-f and M-b from emacs mode has been fixed.  This
-	  bug only occurs when ksh93 is compiled without MULTIBYTE enabled.
-00-11-29  A bug in which jobs -p would yield 0 for background
-	  jobs run in a script has been fixed.
-00-11-21  A bug in integer arrays in which the number of elements is
-	  incorrect when the ++ operator is applied to a non-existing
-	  element has been fixed.  For example, integer x; ((x[3]++)).
-00-11-20  A timing bug in which the shell could reset the terminal
-	  group to the wrong value in the case that the a new process
-	  changes the terminal group during startup has been fixed.
-
-00-10-27  --- Release ksh93k  ---
-00-10-27  Using tab for completion now works only when applied
-	  after a non-blank character at the end of the current line.
-	  In other case a tab is inserted.
-00-10-27  A bug in the emacs edit mode for ^X^E has been fixed.
-	  The ^X^E sequence is supposed to invoke the full editor
-	  on the current command.
-00-10-18  A bug in which expansions of the form ${var//pattern/string}
-	  did not work correctly when pattern was '/' or "/" has
-	  been fixed.
-00-10-18  The output format for indexed arrays in compound variables
-	  has been modified so that it can be used as input.
-00-10-18  Assignments with name references (typeset -n) will now
-	  implicitly unreference an existing name reference.
-00-10-17  A bug the += append operator when a single array element
-	  is appended to a variable that is not an array has been fixed.
-00-10-16  A bug in which the SIGCONT signal was being sent to
-	  each process will kill -0 or kill -n 0 has been fixed.
-00-10-12  The arithmetic evaluation portion has been rewritten to
-	  perform a number of optimizations.
-00-10-10  A bug in which name prefix matching ${!name.*} was not
-	  checking name to see if it was a name reference has been fixed.
-00-09-26  A bug in the multibyte version in which the width of for
-	  non-printing characters was not correct has been fixed.
-00-09-12  Made changes to get multibyte editing work on UWIN for windows
-00-09-12  A bug in which multibyte characters would be displayed incorrectly
-	  has been fixed.
-00-08-08  Removed build dependency on iswprint() and iswalph().
-00-07-20  In some cases the read builtin would read more than a single
-	  line from a pipe on standard input and therefore leave the seek
-	  position in the wrong location.
-00-07-05  If the directory / is on the path, a / will not be inserted
-	  between the directory and the file name during path searching
-	  to avoid searching // for systems that treat this specially.
-00-06-26  A bug in which on rare occasions wait could return before all
-	  jobs have completed has been fixed.
-00-06-21  A bug in which backspace did not work correctly during the
-	  R replace directive in vi-mode has been fixed.
-00-06-12  Added variable name completion/expansion/listing  to the set of
-	  completions.  Variable name completions begin with $ or "$ followed
-	  by a letter. 
-00-05-09  --- Release ksh93j  ---
-00-05-09  Modified command substitution to avoid using /tmp files when
-          run on read-only file systems. 
-00-04-17  Modified printf to handle '%..Xc' and '%..Xs' options where X
-	  is not an alpha character.  Previous versions core dumped with this.
-00-04-10  Changes to multibyte editing code were made to use standard
-	  ISO C functions rather than methods devised before the standard.
-00-04-09  Add %H options to printf to output strings with <"'&\t> properly
-	  converted for use in HTML and XML documents.
-00-04-07  Modified getopts builtin to handle \f...\f in usage string
-	  by invoking specified function.
-00-04-04  Added self generating man pages for bg, fc, fg, disown, jobs,
-	  hist, let, ., and ulimit.
-00-03-30  The append operator += has been added and can be used
-	  for all assignments, strings, arrays, and compound variables.
-00-03-30  Code was modified in several places to support automatic
-	  generation of C locale dictionaries.
-00-03-28  A bug in which the set and trap commands invoked with --name
-	  type arguments would terminate the invoking script  has
-	  been fixed.
-00-03-27  A bug in which the library path variable was not updated  
-	  correctly on some systems as described in the 'g' point
-	  release has been fixed. 
-00-03-07  printf now returns a non-zero exit status when one of
-          its arguments cannot be converted to the given type. 
-00-03-05  The return value and error message for a command that
-          was found on the path but was not executable was set
-          incorrectly.
-00-03-05  A prototype for ioctl() was removed from the vi edit mode.
-
-00-01-28  --- Release ksh93i  ---
-00-01-28  Most of the built-in commands and ksh itself are now
-          self documenting.  Running command --man will produce
-          screen output.  Running command --html produces the
-          man page in html format.
-00-01-28  The getopts builtin can process command description
-          strings to produce man pages.
-00-01-28  A bug in which a script could terminate when getopts
-          encountered an error when invoked inside a function
-          has been fixed.
-00-01-28  When a symbolic link was specified as the name of
-          the script to invoke by name, the value of $0 was
-          set to the real file name rather than the link name
-          in some cases and this has been fixed.
-00-01-28  A bug in which the precision given as an argument
-	  to printf was not working has been fixed.
-
-99-03-31  --- Release ksh93h  ---
-99-03-31  The PATH search algorithm has been modified to look
-	  for a file named .fpath in each bin directory and if
-	  found, to search for functions in this directory if
-	  it cannot find the command in that directory.
-99-03-31  When performing pathname expansion, the shell checks
-	  to see whether each directory it reads is case sensitive
-	  or not, and performs the matching accordingly.
-99-03-31  The %T format for printing formatted date/time.
-99-03-31  The emacs and vi modes now handle arrow keys when
-          they use standard ANSI escape sequences.
-99-03-31  The TAB key can be used for completion in emacs and viraw mode.
-99-03-31  A bug in setting .sh.editchar during the KEYBD trap
-	  for the MULTIBYTE option was fixed in release ksh93h.
-99-03-31  A bug in shcomp for compilation of unary operators with [[...]]
-	  has been fixed.
-99-03-31  A bug in which the value of $? was changed when executing
-	  a keyboard trap has been fixed. 
-99-03-31  The handling of SIGCHLD has been changed so that the
-	  trap is not triggered while executing trap commands
-	  to avoid recursive trap calls.
-99-03-31  A bug in which a local variable in a function declared readonly
-	  would generated an error when the function went out of
-	  scope has been fixed.
-99-03-31  A bug in which \<new_line> entered from the keyboard
-	  with the KEYBD trap enabled has been fixed.
-99-03-31  The error message for a misplaced ((, for example print ((3),
-	  was often garbled and has been fixed.
-99-03-31  A bug in the KEYBD trap in which escape sequences of the form
-	  <ESC>[#~ were not being handled as a unit has been fixed.
-99-03-31  A bug in which ksh would consider expressions like [[ (a) ]]
-	  as syntax errors has been fixed.
-99-03-31  A function defined as foo() without a function body
-	  was not reported as a syntax error.
-99-03-31  A bug in which ksh could run out of file descriptors when
-	  a stream was repeatedly opened with exec and read from
-	  has been fixed.
-
-98-04-30  --- Release ksh93g  ---
-98-04-30  The pipefail option has been added.  With pipefail
-	  enabled, a pipeline will not complete until all
-	  commands are complete, and the return value will
-	  be that of the last command to fail, or zero if
-	  all complete successfully.
-98-04-30  The name-value pair library uses the cdt library rather
-	  than the hash library.  This change should be transparent
-	  to applications.
-98-04-30  On the U/WIN version for Window 95 and Windows NT,
-          when a directory beginning with a letter followed by
-          a colon is given to cd, it is assumed to be an absolute
-          directory
-98-04-30  When an executable is found on a given path,
-	  the appropriate library path variable is prepended
-	  with a corresponding library directory.
-98-04-30  A bug in which a name reference could be created to
-	  itself and later cause the shell to get into an infinite
-	  loop has been fixed.
-98-04-30  A bug in shcomp relating to compound variables was fixed.
-98-04-30  A bug introduced in ksh93e in which leading 0's in -Z
-	  fields caused the value to be treated as octal for arithmetic
-	  evaluation has been fixed.
-98-04-30  A bug when a name reference with a shorter name than
-          the variable it references was the subject of a compound
-	  assignment has been fixed. 
-98-04-30  A bug which in which assignment to array variables in
-	  a subshell could effect the parent shell has been
-	  fixed.
-98-04-30  read name?prompt was putting a 0 byte at the end of the
-	  prompt on standard error.
-98-04-30  A bug in [[ string1 > string2 ]] when ksh was run with -x
-	  has been fixed.
-98-04-30  A bug in which the escape character was not processed
-	  correctly inside {...} when brace expansion is enabled
-	  has been fixed, for example {\$foo}.
-98-04-30  A bug in line continuation in here-documents has been
-	  fixed.
-98-04-30  The default base when not specified with typeset -i is
-	  10 in accordance with the documentation.  Previously,
-	  the value was determined by the first assignment.   
-98-04-30  A parsing bug in which a # preceded alphanumeric
-	  characters inside a command substitution caused
-	  a syntax error to be reported has been fixed.
-98-04-30  A bug in which a decimal constant represented as 10#ddd
-	  where ddd was more than five digits generated a syntax
-	  error has been fixed.
-98-04-30  A bug in here document expansion in which ${...} expansions
-	  were split across buffer boundaries has been fixed.
-98-04-30  The sh_fun() function now takes third argument which
-	  is an argument list for the invoked discipline function
-	  or built-in.
-98-04-30  A callback function can be installed which will give
-          notification of file duplications and file closes.
-98-04-30  When ksh is compiled on systems that do not use fork()
-	  current option settings where not propagated to sub-shells.
-
-97-06-30  --- Release ksh93f  ---
-97-06-30  Hostnames in addition to host addresses can be given in
-	  /dev/tcp/host/port virtual file names.
-97-06-30  File name completion and expansion now quotes special
-	  characters in file names from both emacs and vi edit modes.
-97-06-30  An empty for list behave like a for list with null expansions.
-	  It produces a warning message with sh -n.
-97-06-30  The code has been modified to work with EBCDIC as well as ASCII.
-97-06-30  A bug which would cause the secondary prompt to be
-	  displayed when a user entered a literal carriage
-	  return has been fixed.
-97-06-30  A bug which caused ksh read -s name to core dump was
-	  fixed.
-97-06-30  A bug with the expansion of \} and \] inside double
-	  quoted strings that also contained variable expansions
-	  has been fixed
-97-06-30  Changes in the ksh93e point release caused autoload
-	  functions invoked from within command substitution
-	  to fail.  This has been fixed.
-97-06-30  A bug in the processing of here-documents that could
-	  prevent variable substitution to occur after $(...) command
-	  substitution for long here documents has been fixed.
-97-06-30  A bug caused by a race condition that could cause SIGTERM
-	  to be ignored by a child process has been fixed.
-97-06-30  A bug which prevented the startup of a coprocess immediately
-	  after killing a running coprocess has been fixed.
-97-06-30  ulimit foobar, where foobar is not an arithmetic
-	  expression, now gives an error message as it did with ksh88
-	  instead of setting the file size limit to 0.
-97-06-30  A bug which could cause an interactive shell to terminate when
-	  the last process of a pipeline was a POSIX function was fixed.
-97-06-30  A bug which could cause command substitution of a shell script
-	  to core dump has been fixed.
-97-06-30  A security hole was fixed in suid_exec.
-97-06-30  Arithmetic functions such as pow() that take more than
-	  one argument, did not work if arguments other than the
-	  first contained parenthesized sub-expression.
-97-06-30  The error message from a script containing an incomplete
-	  arithmetic expression has been corrected.
-97-06-30  A bug which caused a core dump on some machines when
-	  the value of a name reference contained a positional
-	  parameter and the name reference was not defined inside
-	  a function has been fixed.
-97-06-30  Arithmetic expressions now correctly handle hexadecimal
-	  constants.
-97-06-30  A bug in which integer variables could be expanded
-	  with a leading 10# when declared with typeset -i
-	  multiple times has been corrected.
-97-06-30  A bug in which IFS wasn't correctly restored when
-	  set within command substitution has been fixed.
-97-06-30  The _ character is now considered as part of a word
-	  with the M-f and M-b emacs directives as it was in ksh88.
-97-06-30  A bug in brace pattern expansions that caused expressions
-          such as {foo\,bar,bam} to expand incorrectly have been fixed.
-
-
-96-07-31  --- Release ksh93e  ---
-96-07-31  The math functions, atan2, hypot, fmod, and pow were added.
-96-07-31  When a shared library is loaded, if the function lib_init()
-	  is defined in the library, it is invoked the first time that
-	  the library is loaded with builtin -f library.
-96-07-31  The k-shell information abstraction database option, KIA,
-          has been revamped.
-96-07-31  Empty command substitutions of the form $() now work.
-	  whence -v foo now gives the correct result after calling
-	  builtin -d foo. 
-96-07-31  A bug in right to left arithmetic assignment for which
-	  the arithmetic expression (( y = x = 1.5 )) did not
-	  yield 1 for y when x was declared typeset -i was fixed.
-96-07-31  printf has been fixed to handle format  containing \0
-	  and/or \0145 correctly.  In addition, characters following
-	  %b in the format string are no longer displayed when
-	  the operand contains \c.
-96-07-31  A bug in printf that could cause the %E format to
-	  produce unnormalized results has been fixed.
-96-07-31  A bug which causes some arithmetic expressions to be
-	  incorrectly evaluated as integer expressions rather
-	  that floating point has been fixed.
-96-07-31  Functions defined inside a subshell no longer remain
-	  defined when the subshell completes.
-96-07-31  The error message from sh -c ';echo foo' has been
-	  corrected.
-96-07-31  The format for umask -S has been changed to agree
-	  with the specification in the POSIX standard.
-96-07-31  A bug that caused side effects in subscript evaluation
-	  when tracing was enabled for subscripts using ++ or --
-	  has been fixed.
-96-07-31  To conform to the Posix standard getopts has been changed
-	  so that the option char is set to ? when it returns with
-	  a non-zero exit status.
-96-07-31  The handling of \} inside ${name...} has been fixed so
-	  that the \ quotes the }.
-96-07-31  A bug that caused the read builtin to resume execution
-	  after processing a trap has been fixed.
-96-07-31  [[ -s file ]] has been fixed so that if file is open
-	  by ksh, it is flushed first.
-96-07-31  In some cases attributes and sizes for non exported
-	  variables weren't being reset before running a script.
-96-07-31  The value of TMOUT was affected by changes make to
-	  it in a subshell.
-96-07-31  The jobs command did not reflect changes make by
-	  sending the CONT signal to a command.
-96-07-31  The error message for ksh -o unknown was incorrect.
-96-07-31  Functions invoked as name=value name, did not use
-	  values from the calling scope when evaluating value.
-96-07-31  A bug in which the shell would reexecute previously
-	  executed code when a shell script or coprocess was
-	  run in the background has been fixed.
-96-07-31  A bug in which an empty here-document would leave
-	  a file descriptor open has been fixed.
-96-07-31  A bug in which $(set -A array ...) would leave a
-	  side effect has been fixed.
-96-07-31  A discipline function for a global variable defined
-	  within a function defined with the function keyword,
-	  incorrectly created a local variable of the same name
-	  and applied the discipline to it.
-
-95-08-28  --- Release ksh93d  ---
-95-08-28  The \ character was not handled correctly in replacement
-	  patterns with ${x/pattern/replace}.
-95-08-28  A bug with read in which the line did not end with
-	  a new-line has been fixed.
-95-08-28  A bug in file name generation which sometimes
-	  appended a . for filenames that ended in / has
-	  been fixed.
-95-08-28  If a process is waited for after a status has
-	  been returned by a previous wait, wait now
-	  returns 127.
-95-08-28  A bug with hist (fc) -e which prevented a command
-	  to re-executed after it had been edited has been fixed.
-95-08-28  A bug which prevented quoting from removing the meaning
-	  of unary test operators has been fixed.
-95-08-28  A bug with typeahead and KEYBOARD traps with the
-          MULTIBYTE option set has been fixed.
-95-08-28  Builtin functions can take a third argument which is
-          a void*.
-95-08-28  The nv_scan() function can restrict the scope of a walk
-          to the top scope.
-
-95-04-31  --- Release ksh93c  ---
-95-04-31  The expansion of "$@" was incorrect when $1 was the null
-	  string.
-95-04-31  A bug which could incorrectly report a syntax error in
-	  a backquoted expression when a $ was preceded by \\
-	  has been fixed.
-95-04-31  A bug which prevented the shell from exiting after
-	  reporting an error when failing to open a script
-	  has been fixed.
-95-04-31  A bug that could lead to memory corruption when a
-	  large here document that required parameter or command
-	  substitution was expanded has been fixed.
-95-04-31  A bug that could cause a core dump on some systems
-	  after ksh detected an error when reading a function
-	  has been fixed.
-95-04-31  A bug which could cause a coprocess to hang when
-	  reading from a process that has terminated has been fixed.
-95-04-31  A bug which caused a script to terminate when set -e
-	  was on and the first command of and && or || list
-	  failed has been fixed.
-95-04-31  A bug with here documents inside $(...) when the delimiter
-	  word is an identifier has been fixed.
-95-04-31  A bug which caused $0 to display the wrong value when
-	  a script was invoked as an argument to the . command
-	  and the eval command has been fixed.
-95-04-31  A bug that could cause the built-in sleep to hang
-	  has been fixed.
-95-04-31  A bug introduces in 12/28/93b which caused the backslash
-	  to be removed when it was followed by digit inside double
-	  quotes in some instances has been fixed.
-95-04-31  A bug which could cause a core dump if ksh was invoked with
-	  standard input closed has been fixed.
-95-04-31  A bug which could cause a core dump if typeset -A was
-	  specified for an existing variable has been fixed.
-95-04-31  Variables that were unset but had attributes such as readonly
-	  and export were not listed with readonly, export and typeset.
-95-04-31  Several problems with signals have been fixed.
-95-04-31  A bug which prevented ulimit -t from working has been fixed. 
-	  Also, a bug in which failed ulimits could cause a core dump
-	  has also been fixed.
-95-04-31  A bug in expansion of the form ${name/#pattern/string} and
-	  ${name/%pattern/string} has been fixed.
-95-04-31  A bug which caused read -r on a line that contained only
-	  blanks to get a non-null value has been fixed.
-95-04-31  A bug introduced in the 'a' point release in which
-	  ${x='\\'} expanded to \ when x was unset has been fixed.
-95-04-31  A bug which prevented a trap on EXIT from being executed
-	  when the last command in a script was a function invocation
-	  has been fixed.
-95-04-31  A bug which caused an interactive shell ignore input when
-	  standard error was redirected to a file with exec,
-	  and then restored with exec 2>&1 has been fixed.
-95-04-31  An interactive shell turns on monitor mode even when
-	  standard error has been redirected to a file.
-95-04-31  A bug which could cause standard input to be incorrectly
-	  positioned for the last command of a script has been fixed.
-95-04-31  A bug in the edit modes which allowed walking back in
-	  the history file for more than HISTSIZE commands has
-	  been fixed.
-95-04-31  A bug which could cause a core dump if variable TMPDIR was
-	  changed between two command substitutions has been fixed.
-95-04-31. A bug which prevented a trap on EXIT from being cleared
-	  has been fixed.
-95-04-31  A bug fixed for the v directive in vi MULTIBYTE has been
-          fixed.
-95-04-31  Code to for IFS handling of multibyte characters has
-          been added.
-95-04-31  The displaying of multibyte strings in export, readonly,
-          typeset, and execution traces has been fixed.
-95-04-31  Variables inside functions are now statically scoped.
-	  The previous behavior was never documented.
-95-04-31  Variables inside functions are now statically scoped.
-          The previous behavior was never documented.
-95-04-31  A few changes have been made to the name-value library
-          that affect built-ins that use disciplines.  The
-          changes allow disciplines to be shared by variables
-          and should make it possible to add new disciplines
-          without recompilation.
-95-04-31  The name-value library interface has undergone significant
-          change for this revision.  See the new nval.3 man page.
-
-94-12-31  --- Release ksh93b  ---
-94-12-31  Variables inside functions are now statically scoped.
-          The previous behavior was never documented.
-94-12-31  If IFS contains two consecutive identical characters belonging
-	  to the [:space:] class, then this character is treated as
-	  a non-space delimiter so that each instance will delimit
-	  a field.  For example, IFS=$'\t\t' will cause two consecutive
-	  tabs to delimit a null field.
-94-12-31  The getopts command has a -a name option that specifies a
-	  name that will be used for usage messages.
-94-12-31  A bug which caused unset RANDOM to dump core has been
-	  fixed.
-94-12-31  A bug which prevented return for terminating a profile
-	  or ENV file has been fixed.
-94-12-31  A bug which prevented standard input from being
-	  directed to /dev/null for background jobs when
-	  monitor mode was turned off has been fixed.
-94-12-31  Statements of the form typeset -options var[expr]=value
-	  did not perform substitutions on expr as expected.
-94-12-31  A bug which prevented the shell from sending a HUP
-	  signal to some background jobs that were not disowned
-	  has been fixed.
-94-12-31  A bug which allowed a script to trap signals that are
-	  ignored at the time that the shell was invoked by exec
-	  has been fixed.
-94-12-31  A bug which could cause a core dump when a discipline
-	  function was unset within a discipline was fixed.
-94-12-31  The typeset builtin now accepts a first argument of
-	  + or - for compatibility with ksh88.
-94-12-31  For compatibility with ksh88, the results of expansions
-	  of command arguments will treat the extended character
-	  match characters ()|& as ordinary characters.
-94-12-31  A bug which caused read to fail on a file that was
-	  open for read/write with <> when the first operation
-	  was print or printf has been fixed.
-94-12-31  When a job is suspended, it is put on the top of
-	  the job list as required by the POSIX standard.
-94-12-31  The value of OPTARG when an option that required
-	  an argument but didn't have one was incorrect in the
-	  case the the option string began with a :.
-94-12-31  A bug which caused the terminal to get into a bad
-	  state with some KEYBD traps in vi-mode has been fixed.
-94-12-31  A bug which caused an invalid trap to cause a script
-	  to terminate, rather than just return an error, has
-	  been fixed.
-94-12-31  Backreferencing sub-expressions in patterns and replacement
-	  strings now works.
-94-12-31  A bug in chmod which caused the -R option to fail has
-	  been fixed.
-94-12-31  More signal names have been added for Solaris
-
-94-06-30  --- Release ksh93a  ---
-94-06-30  An expansion bug which causes portions of a word after
-	  a $((...)) expansion that contains a nested $var expansion
-	  to be lost has been fixed.
-94-06-30  A bug that caused a core dump when a script that did not
-	  have PWD set and did a cd inside command substitution
-	  has been fixed.
-94-06-30  A bug which caused a core dump on some machines when
-	  the LANG variable was assigned to has been fixed.
-94-06-30  A bug which incorrectly handled set disciplines that
-	  performed arithmetic evaluation when the discipline
-	  was called from the arithmetic evaluator has been fixed.
-94-06-30  A bug caused by an EXIT trap inside a function that
-	  was executed in a subshell was fixed.
-94-06-30  If foo is a function, and not a program, then command foo
-	  now reports that foo isn't found rather than invoking foo.
-94-06-30  The previous version incorrectly listed -A as an
-	  invocation option.  The -A option is only for set. 
-94-06-30  A bug was fixed which caused ksh to loop when execution trace
-	  was enabled and the PS4 prompt required command substitution.
-94-06-30  A bug which could cause the job control switch character
-	  to be disabled when a script that enabled monitor mode
-	  terminated was fixed.
-94-06-30  A bug in the macro expansion global replacement operator //,
-	  when the pattern began with a [ or +( has been fixed.
-94-06-30  A bug which prevented ~ expansion from occurring when
-	  it was terminated with a colon inside an assignment
-	  has been fixed.
-94-06-30  A bug in the dot command which prevented autoload functions
-	  from working has been fixed.
-94-06-30  A bug which caused a variable to be unset if the
-	  its value were expanded inside a set discipline has
-	  been fixed.
-94-06-30  Whence -a now longer reports that a defined function
-	  is undefined.
-94-06-30  A bug on some systems in which $0 would be incorrect
-	  in scripts invoked by name has been fixed.
-94-06-30  Here documents with an empty body now work.
-94-06-30  A bug which disabled argument passing and resetting
-	  of options for a script invoked by name inside a
-	  function has been fixed.
-94-06-30  A bug in which an EXIT trap set the caller of a function
-	  would be executed if a command called inside a function
-	  was not found has been fixed.
-94-06-30  A bug which allowed a script to trap signals that are
-	  ignored at the time that the shell was invoked has
-	  been fixed.
-94-06-30  A bug which caused 2<&1- when applied to a shell built-in
-	  to leave standard input closed has been fixed.
-94-06-30  A bug which caused the shell to incorrectly parse
-	  $() command substitutions with nested case statements
-	  has been fixed.
-
diff --git a/usr/src/lib/libshell/common/TYPES b/usr/src/lib/libshell/common/TYPES
deleted file mode 100644
index 6eb6f41b5e..0000000000
--- a/usr/src/lib/libshell/common/TYPES
+++ /dev/null
@@ -1,182 +0,0 @@
-
-The ability for users to define types has been added to ksh93t.
-Here is a quick summary of how types are defined and used in ksh93t.
-This is still a work in progress so some changes and additions
-are likely.
-
-A type can be defined either by a shared library or by using the new
-typeset -T option to the shell.  The method for defining types via
-a shared library is not described here.  However, the source file
-bltins/enum.c is an example of a builtin that creates enumeration types.
-
-By convention, typenames begin with a capitol letter and end in _t.
-To define a type, use
-	typeset -T Type_t=(
-		definition
-	)
-where definition contains assignment commands, declaration commands,
-and function definitions.  A declaration command (for example typeset,
-readonly, and export), is a built-in that differs from other builtins in
-that tilde substitution is performed on arguments after an =, assignments
-do not have to precede the command name, and field splitting and pathname
-expansion is not performed on the arguments.
-For example,
-	typeset -T Pt_t=(
-		float -h 'length in inches' x=1
-		float -h 'width in inches' y=0
-		integer -S count=0
-		len()
-		{
-			print -r $((sqrt(_.x*_.x + _.y*_.y)))
-		}
-		set()
-		{
-			(( _.count++))
-		}
-	)
-
-defines a type Pt_t that has three variables x, y, and count defined as well
-as the discipline functions len and set.  The variable x has an initial value
-of 1 and the variable y has an initial value of 0.  The new -h option argument,
-is used for documentations purposes as described later and is ignored outside
-of a type definition.
-
-
-The variable count has the new -S attribute which means that it is shared
-between all instances of the type.  The -S option to typeset is ignored
-outside of a type definition.  Note the variable named _ that is used inside
-the function definition for len and set.  It will be a reference to the
-instance of Pt_t that invoked the function.  The functions len and set
-could also have been defined with function len and function set, but
-since there are no local variables, the len() and set() form are more
-efficient since they don't need to set up a context for local variables
-and for saving and restoring traps.
-
-If the discipline function named create is defined it will be
-invoked when creating each instance for that type. A function named
-create cannot be defined by any instance.
-
-When a type is defined, a declaration built-in command by this name
-is added to ksh.  As with other shell builtins, you can get the man page
-for this newly added command by invoking Pt_t --man.  The information from
-the -h options will be embedded in this man page.  Any functions that
-use getopts to process arguments will be cross referenced on the generated
-man page.
-
-Since Pt_t is now a declaration command it can be used in the definition
-of other types, for example
-	typeset -T Rect_t=( Pt_t ur ll)
-
-Because a type definition is a command, it can be loaded on first reference
-by putting the definition into a file that is found on FPATH.
-Thus, if this definition is in a file named Pt_t on FPATH, then
-a program can create instances of Pt_t without first including
-the definition.
-
-A type definition is readonly and cannot be unset.  Unsetting non-shared
-elements of a type restores them to their default value.  Unsetting a
-shared element has no effect.
-
-The Pt_t command is used to create an instance of Pt_t.
-	Pt_t p1
-creates an instance named p1 with the initial value for p1.x set to 1
-and the initial value of p1.y set to 0.
-	Pt_t p2=(x=3 y=4)
-creates an instance with the specified initial values.  The len function
-gives the distance of the point to the origin.  Thus, p1.len will output
-1 and p2.len will output 5.
-
-ksh93t also introduces a more efficient command substitution mechanism.
-Instead of $(command), the new command substitution ${ command;}
-can be used.  Unlike (and ) which are always special, the { and } are
-reserved words and require the space after { and a newline or ; before }.
-Unlike $(), the ${ ;} command substitution executes the command in
-the current shell context saving the need to save and restore
-changes, therefore also allowing side effects. 
-
-When trying to expand an element of a type, if the element does not exist,
-ksh will look for a discipline function with that name and treat this as if
-it were the ${ ;} command substitution.  Thus, ${p1.len} is equivalent to
-${ p1.len;} and within an arithmetic expression, p1.len will be expanded
-via the new command substitution method.
-
-The type of any variable can be obtained from the new prefix
-operator @.  Thus, ${@p1} will output Pt_t.
-
-By default, each instance inherits all the discipline functions defined
-by the type definition other than create.  However, each instance can define
-a function by the same name that will override this definition.
-However, only discipline functions with the same name as those defined
-by the type or the standard get, set, append, and unset disciplines
-can be defined by each instance.
-
-Each instance of the type Pt_t behaves like a compound variable except
-that only the variables defined by the type can be referenced or set.
-Thus, p2.x=9 is valid, but p2.z=9 is not.  Unless a set discipline function
-does otherwise, the value of $p1 will be expanded to the form of a compound
-variable that can be used for reinput into ksh.
-
-If the variables var1 and var2 are of the same type, then the assignment
-	var2=var1
-will create a copy of the variable var1 into var2.  This is equivalent to
-	eval var2="$var1"
-but is faster since the variable does not need to get expanded or reparsed.
-
-The type Pt_t can be referenced as if it were a variable using the name
-.sh.type.Pt_t.  To change the default point location for subsequent
-instances of Pt_t, you can do
-	.sh.type.Pt_t=(x=5 y=12)
-so that
-	Pt_t p3
-	p3.len
-would be 13.
-
-Types can be defined for simple variables as well as for compound
-objects such as Pt_t.  In this case, the variable named . inside
-the definition refers to the real value for the variable.  For example,
-the type definition
-	typeset -T Time_t=(
-		integer .=0
-		_='%H:%M:%S'
-		get()
-		{
-			.sh.value=$(printf "%(${_._})T" "#$((_))" )
-		}
-		set()
-		{
-			.sh.value=$(printf "%(%#)T" "${.sh.value}")
-
-		}
-	)
-
-The sub-variable name _ is reserved for data used by discipline functions
-and will not be included with data written with the %B option to printf.
-In this case it is used to specify a date format.
-
-In this case
-	Time_t t1 t2=now
-will define t1 as the time at the beginning of the epoch and t2
-as the current time.  Unlike the previous case, $t2 will output
-the current time in the date format specified by the value t2._.
-However, the value of ${t2.} will expand the instance to a form
-that can be used as input to the shell.
-
-Finally, types can be derived from an existing type.  If the first
-element in a type definition is named _, then the new type
-consists of all the elements and discipline functions from the
-type of _ extended by elements and discipline functions defined
-by new type definition.  For example,
-
-	typeset -T Pq_t=(
-		Pt_t _
-		float z=0.
-		len()
-		{
-			print -r $((sqrt(_.x*_.x + _.y*_.y + _.z*_.z)))
-		}
-	)
-
-defines a new type Pq_t which is based on Pq_t and contains an additional
-field z and a different len discipline function.  It is also possible
-to create a new type Pt_t based on the original Pt_t.  In this case
-the original Pt_t is no longer accessible.
diff --git a/usr/src/lib/libshell/misc/images/callouts/1.png b/usr/src/lib/libshell/misc/images/callouts/1.png
deleted file mode 100644
index 608fad3596..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/1.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/10.png b/usr/src/lib/libshell/misc/images/callouts/10.png
deleted file mode 100644
index 39e55197cf..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/10.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/2.png b/usr/src/lib/libshell/misc/images/callouts/2.png
deleted file mode 100644
index 5444738841..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/2.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/3.png b/usr/src/lib/libshell/misc/images/callouts/3.png
deleted file mode 100644
index 64b87c7151..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/3.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/4.png b/usr/src/lib/libshell/misc/images/callouts/4.png
deleted file mode 100644
index c308193ac4..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/4.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/5.png b/usr/src/lib/libshell/misc/images/callouts/5.png
deleted file mode 100644
index 24799f0a43..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/5.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/6.png b/usr/src/lib/libshell/misc/images/callouts/6.png
deleted file mode 100644
index 8919a670cd..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/6.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/7.png b/usr/src/lib/libshell/misc/images/callouts/7.png
deleted file mode 100644
index e30e8a70cb..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/7.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/8.png b/usr/src/lib/libshell/misc/images/callouts/8.png
deleted file mode 100644
index 3e35c8827c..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/8.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/callouts/9.png b/usr/src/lib/libshell/misc/images/callouts/9.png
deleted file mode 100644
index ed2f14b4eb..0000000000
--- a/usr/src/lib/libshell/misc/images/callouts/9.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/tag_bourne.png b/usr/src/lib/libshell/misc/images/tag_bourne.png
deleted file mode 100644
index f1f78e3a25..0000000000
--- a/usr/src/lib/libshell/misc/images/tag_bourne.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/tag_i18n.png b/usr/src/lib/libshell/misc/images/tag_i18n.png
deleted file mode 100644
index 559929df2a..0000000000
--- a/usr/src/lib/libshell/misc/images/tag_i18n.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/tag_ksh.png b/usr/src/lib/libshell/misc/images/tag_ksh.png
deleted file mode 100644
index b33d5a7aa1..0000000000
--- a/usr/src/lib/libshell/misc/images/tag_ksh.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/tag_ksh88.png b/usr/src/lib/libshell/misc/images/tag_ksh88.png
deleted file mode 100644
index d36dc0f5f5..0000000000
--- a/usr/src/lib/libshell/misc/images/tag_ksh88.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/tag_ksh93.png b/usr/src/lib/libshell/misc/images/tag_ksh93.png
deleted file mode 100644
index 357ee3c50a..0000000000
--- a/usr/src/lib/libshell/misc/images/tag_ksh93.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/tag_l10n.png b/usr/src/lib/libshell/misc/images/tag_l10n.png
deleted file mode 100644
index be89f7a163..0000000000
--- a/usr/src/lib/libshell/misc/images/tag_l10n.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/images/tag_perf.png b/usr/src/lib/libshell/misc/images/tag_perf.png
deleted file mode 100644
index fcb2960852..0000000000
--- a/usr/src/lib/libshell/misc/images/tag_perf.png
+++ /dev/null
diff --git a/usr/src/lib/libshell/misc/shell_styleguide.docbook b/usr/src/lib/libshell/misc/shell_styleguide.docbook
deleted file mode 100644
index 74bc7501b5..0000000000
--- a/usr/src/lib/libshell/misc/shell_styleguide.docbook
+++ /dev/null
@@ -1,1464 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.oasis-open.org/docbook/xml/5.0b5/dtd/docbook.dtd" [
-    <!ENTITY tag_bourneonly   '<inlinemediaobject><imageobject><imagedata fileref="images/tag_bourne.png"></imagedata></imageobject><textobject><phrase>[Bourne]</phrase></textobject></inlinemediaobject> '>
-    <!ENTITY tag_kshonly      '<inlinemediaobject><imageobject><imagedata fileref="images/tag_ksh.png"></imagedata></imageobject><textobject><phrase>[ksh]</phrase></textobject></inlinemediaobject> '>
-    <!ENTITY tag_ksh88only    '<inlinemediaobject><imageobject><imagedata fileref="images/tag_ksh88.png"></imagedata></imageobject><textobject><phrase>[ksh88]</phrase></textobject></inlinemediaobject> '>
-    <!ENTITY tag_ksh93only    '<inlinemediaobject><imageobject><imagedata fileref="images/tag_ksh93.png"></imagedata></imageobject><textobject><phrase>[ksh93]</phrase></textobject></inlinemediaobject> '>
-    <!ENTITY tag_performance  '<inlinemediaobject><imageobject><imagedata fileref="images/tag_perf.png"></imagedata></imageobject><textobject><phrase>[perf]</phrase></textobject></inlinemediaobject> '>
-    <!ENTITY tag_i18n         '<inlinemediaobject><imageobject><imagedata fileref="images/tag_i18n.png"></imagedata></imageobject><textobject><phrase>[i18n]</phrase></textobject></inlinemediaobject> '>
-    <!ENTITY tag_l10n         '<inlinemediaobject><imageobject><imagedata fileref="images/tag_l10n.png"></imagedata></imageobject><textobject><phrase>[l10n]</phrase></textobject></inlinemediaobject> '>
-]>
-<!--
-
- CDDL HEADER START
-
- The contents of this file are subject to the terms of the
- Common Development and Distribution License (the "License").
- You may not use this file except in compliance with the License.
-
- You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- or http://www.opensolaris.org/os/licensing.
- See the License for the specific language governing permissions
- and limitations under the License.
-
- When distributing Covered Code, include this CDDL HEADER in each
- file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- If applicable, add the following below this CDDL HEADER, with the
- fields enclosed by brackets "[]" replaced with your own identifying
- information: Portions Copyright [yyyy] [name of copyright owner]
-
- CDDL HEADER END
-
--->
-
-<!--
-
- Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
- Use is subject to license terms.
-
--->
-
-<!-- tag images were created like this:
-$ (text="perf" ;
-   pbmtext -nomargins -lspace 0 -builtin fixed "${text}" |
-       pbmtopgm 1 1 |
-       pgmtoppm 1.0,1.0,1.0-0,0,0 /dev/stdin |
-       ppmtogif |
-       giftopnm |
-       pnmtopng >"tag_${text}.png")
--->
-
-<!-- compile with:
-xsltproc &minus;&minus;stringparam generate.section.toc.level 0 \
-         &minus;&minus;stringparam toc.max.depth 3 \
-         &minus;&minus;stringparam toc.section.depth 12 \
-         &minus;&minus;xinclude -o opensolaris_shell_styleguide.html /usr/share/sgml/docbook/docbook-xsl-stylesheets-1.69.1/html/docbook.xsl opensolaris_shell_styleguide.docbook
--->
-
-<article
-    xmlns:xlink="http://www.w3.org/1999/xlink"
-    xmlns="http://docbook.org/ns/docbook"
-    xml:lang="en">
-    <!-- xmlns:xi="http://www.w3.org/2001/XInclude" -->
-
-  <info>
-    <title><emphasis>[DRAFT]</emphasis> Bourne/Korn Shell Coding Conventions</title>
-
-    <!-- subtitle abuse -->
-    <subtitle>
-      This page is currently work-in-progress until it is approved by the OS/Net community. Please send any comments to
-      <email>shell-discuss@opensolaris.org</email>.
-    </subtitle>
-
-
-    <authorgroup>
-<!--
-        <author><personname>David G. Korn</personname><email>dgk@research.att.com</email></author>
-        <author><personname>Roland Mainz</personname><email>roland.mainz@nrubsig.org</email></author>
-        <author><personname>Mike Shapiro</personname><email>mike.shapiro@sun.com</email></author>
--->
-        <author><orgname>OpenSolaris.org</orgname></author>
-    </authorgroup>
-  </info>
-
-<section xml:id="intro">
-  <title>Intro</title>
-  <para>This document describes the shell coding style used for all the SMF script changes integrated into (Open)Solaris.</para>
-  <para>All new SMF shell code should conform to this coding standard, which is intended to match our existing C coding standard.</para>
-  <para>When in doubt, think "what would be the C-Style equivalent ?" and "What does the POSIX (shell) standard say ?"</para>   
-</section><!-- end of intro -->
-
-
-<section xml:id="rules">
-  <title>Rules</title>
-  
-  
-  
-  <section xml:id="general">
-  <title>General</title>
-
-      <section xml:id="basic_format">
-          <title>Basic Format</title>
-          <para>Similar to <literal>cstyle</literal>, the basic format is that all
-          lines are indented by TABs or eight spaces, and continuation lines (which
-          in the shell end with "\") are indented by an equivalent number of TABs
-          and then an additional four spaces, e.g.
-<programlisting>
-cp foo bar
-cp some_realllllllllllllllly_realllllllllllllly_long_path \
-   to_another_really_long_path
-</programlisting>
-          </para>
-          <para>The encoding used for the shell scripts is either <literal>ASCII</literal>
-          or <literal>UTF-8</literal>, alternative encodings are only allowed when the
-          application requires this.</para>
-      </section>
-
-
-      <section xml:id="commenting">
-          <title>Commenting</title>
-          <para>Shell comments are preceded by the '<literal>#</literal>' character. Place
-          single-line comments in the right-hand margin. Use an extra '<literal>#</literal>'
-          above and below the comment in the case of multi-line comments:
-<programlisting>
-cp foo bar		# Copy foo to bar
-
-#
-# Modify the permissions on bar.  We need to set them to root/sys
-# in order to match the package prototype.
-#
-chown root bar
-chgrp sys bar
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="interpreter_magic">
-          <title>Interpreter magic</title>
-          <para>The proper interpreter magic for your shell script should be one of these:
-<programlisting>
-#!/bin/sh        Standard Bourne shell script
-#!/bin/ksh -p    Standard Korn shell 88 script.  You should always write ksh
-                 scripts with -p so that ${ENV} (if set by the user) is not
-                 sourced into your script by the shell.
-#!/bin/ksh93     Standard Korn shell 93 script (-p is not needed since ${ENV} is
-                 only used for interactive shell sessions).
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="harden_your_script_against_unexpected_input">
-          <title>Harden the script against unexpected (user) input</title>
-          <para>Harden your script against unexpected (user) input, including
-          command line options, filenames with blanks (or other special
-          characters) in the name, or file input</para>
-      </section>
-
-
-      <section xml:id="use_builtin_commands">
-          <title>&tag_kshonly;&tag_performance;Use builtin commands if the shell provides them</title>
-          <para>
-          Use builtin commands if the shell provides them. For example ksh93s+
-          (ksh93, version 's+') delivered with Solaris (as defined by PSARC 2006/550)
-          supports the following builtins:
-          <simplelist type="inline">
-          <member>basename</member>
-          <member>cat</member>
-          <member>chgrp</member>
-          <member>chmod</member>
-          <member>chown</member>
-          <member>cmp</member>
-          <member>comm</member>
-          <member>cp</member>
-          <member>cut</member>
-          <member>date</member>
-          <member>dirname</member>
-          <member>expr</member>
-          <member>fds</member>
-          <member>fmt</member>
-          <member>fold</member>
-          <member>getconf</member>
-          <member>head</member>
-          <member>id</member>
-          <member>join</member>
-          <member>ln</member>
-          <member>logname</member>
-          <member>mkdir</member>
-          <member>mkfifo</member>
-          <member>mv</member>
-          <member>paste</member>
-          <member>pathchk</member>
-          <member>rev</member>
-          <member>rm</member>
-          <member>rmdir</member>
-          <member>stty</member>
-          <member>tail</member>
-          <member>tee</member>
-          <member>tty</member>
-          <member>uname</member>
-          <member>uniq</member>
-          <member>wc</member>
-          <member>sync</member>
-          </simplelist>
-          Those builtins can be enabled via <literal>$ builtin name_of_builtin #</literal> in shell
-          scripts (note that ksh93 builtins implement exact POSIX behaviour - some
-          commands in Solaris <filename>/usr/bin/</filename> directory implement pre-POSIX behaviour.
-          Add <literal>/usr/xpg6/bin/:/usr/xpg4/bin</literal> before
-          <filename>/usr/bin/</filename> in <envar>${PATH}</envar> to test whether your script works with
-          the XPG6/POSIX versions)
-          </para>
-      </section>
-
-
-      <section xml:id="use_blocks_not_subshells">
-          <title>&tag_performance;Use blocks and not subshells if possible</title>
-          <para>Use blocks and not subshells if possible, e.g. use
-          <literal>$ { print "foo" ; print "bar" ; }</literal> instead of
-          <literal>$ (print "foo" ; print "bar") #</literal> - blocks are
-          faster since they do not require to save the subshell context (ksh93) or
-          trigger a shell child process (Bourne shell, bash, ksh88 etc.)
-          </para>
-      </section>
-
-
-      <section xml:id="use_long_options_for_set_builtin">
-           <title>&tag_kshonly; use long options for "<literal>set</literal>"</title>
-           <para>use long options for "<literal>set</literal>", for example instead of <literal>$ set -x #</literal>
-           use <literal>$ set -o xtrace #</literal> to make the code more readable.</para>
-      </section>
-
-
-      <section xml:id="use_posix_command_substitutions_syntax">
-          <title>&tag_kshonly; Use <literal>$(...)</literal> instead of <literal>`...`</literal> command substitutions</title>
-          <para>Use <literal>$(...)</literal> instead of <literal>`...`</literal> - <literal>`...`</literal>
-          is an obsolete construct in ksh+POSIX sh scripts and <literal>$(...)</literal>.is a cleaner design,
-          requires no escaping rules, allows easy nesting etc.</para>
-
-          <note><title>&tag_ksh93only; <literal>${ ...;}</literal>-style command substitutions</title>
-          <para>ksh93 has support for an alternative version of command substitutions with the
-          syntax <literal>${ ...;}</literal> which do not run in a subshell.
-          </para></note>
-      </section>
-
-
-      <section xml:id="put_command_substitution_result_in_quotes">
-          <title>&tag_kshonly; Always put the result of a <literal>$(...)</literal> or
-          <literal>$( ...;)</literal> command substitution in quotes</title>
-          <para>Always put the result of <literal>$( ... )</literal> or <literal>$( ...;)</literal> in
-          quotes (e.g. <literal>foo="$( ... )"</literal> or <literal>foo="$( ...;)"</literal>) unless
-          there is a very good reason for not doing it</para>
-      </section>
-
-
-      <section xml:id="always_set_path">
-          <title>Scripts should always set their <envar>PATH</envar></title>
-          <para>Scripts should always set their <envar>PATH</envar> to make sure they do not use
-          alternative commands by accident (unless the value of <envar>PATH</envar> is well-known
-          and guaranteed to be set by the caller)</para>
-      </section>
-
-
-      <section xml:id="make_sure_commands_are_available">
-          <title>Make sure that commands from other packages/applications are really installed on the machine</title>
-          <para>Scripts should make sure that commands in optional packages are really
-          there, e.g. add a "precheck" block in scipts to avoid later failure when
-          doing the main job</para>
-      </section>
-
-
-      <section xml:id="check_usage_of_boolean_variables">
-          <title>Check how boolean values are used/implemented in your application</title>
-          <para>Check how boolean values are used in your application.</para>
-          <para>For example:
-<programlisting>
-mybool=0
-# do something
-if [ $mybool -eq 1 ] ; then do_something_1 ; fi
-</programlisting>
-could be rewritten like this:
-<programlisting>
-mybool=false # (valid values are "true" or "false", pointing
-# to the builtin equivalents of /bin/true or /bin/false)
-# do something
-if ${mybool} ; then do_something_1 ; fi
-</programlisting>
-or
-<programlisting>
-integer mybool=0 # values are 0 or 1
-# do something
-if (( mybool==1 )) ; then do_something_1 ; fi
-</programlisting>
-          </para>
-      </section>
-
-      <section xml:id="shell_uses_characters_not_bytes">
-          <title>&tag_i18n;The shell always operates on <emphasis>characters</emphasis> not bytes</title>
-          <para>Shell scripts operate on characters and <emphasis>not</emphasis> bytes.
-          Some locales use multiple bytes (called "multibyte locales") to represent one character</para>
-
-          <note><para>ksh93 has support for binary variables which explicitly
-          operate on bytes, not characters. This is the <emphasis>only</emphasis> allowed
-          exception.</para></note>
-      </section>
-
-
-      <section xml:id="multibyte_locale_input">
-          <title>&tag_i18n;Multibyte locales and input</title>
-          <para>Think about whether your application has to handle file names or
-          variables in multibyte locales and make sure all commands used in your
-          script can handle such characters (e.g. lots of commands in Solaris's
-          <filename>/usr/bin/</filename> are <emphasis>not</emphasis> able to handle such values - either use ksh93
-          builtin constructs (which are guaranteed to be multibyte-aware) or
-          commands from <filename>/usr/xpg4/bin/</filename> and/or <filename>/usr/xpg6/bin</filename>)
-          </para>
-      </section>
-
-
-      <section xml:id="use_external_filters_only_for_large_datasets">
-          <title>&tag_performance;Only use external filters like <literal>grep</literal>/<literal>sed</literal>/<literal>awk</literal>/etc.
-          if you want to process lots of data with them</title>
-          <para>Only use external filters like <literal>grep</literal>/<literal>sed</literal>/<literal>awk</literal>/etc.
-          if a significant amount of data is processed by the filter or if
-          benchmarking shows that the use of builtin commands is significantly slower
-          (otherwise the time and resources needed to start the filter are
-          far greater then the amount of data being processed,
-          creating a performance problem).</para>
-          <para>For example:
-<programlisting>
-if [ "$(echo "$x" | egrep '.*foo.*')" != "" ] ; then
-    do_something ;
-done
-</programlisting>
-can be re-written using ksh93 builtin constructs, saving several
-<literal>|fork()|+|exec()|</literal>'s:
-<programlisting>
-if [[ "${x}" == ~(E).*foo.* ]] ; then
-    do_something ;
-done
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="use_dashdash_if_first_arg_is_variable">
-          <title>If the first operand of a command is a variable, use <literal>--</literal></title>
-          <para>If the first operand of a command is a variable, use <literal>--</literal>
-          for any command that accepts this as end of argument to
-          avoid problems if the variable expands to a value starting with <literal>-</literal>.
-          </para>
-          <note><para>
-          At least
-          <simplelist type="inline">
-              <member>print</member>
-              <member>/usr/bin/fgrep</member>
-              <member>/usr/bin/grep</member>
-              <member>/usr/bin/egrep</member>
-          </simplelist>
-          support <literal>--</literal> as "end of arguments"-terminator.
-          </para></note>
-      </section>
-
-      <section xml:id="use_export">
-          <title>&tag_kshonly;&tag_performance;Use <literal>$ export FOOBAR=val #</literal> instead of
-          <literal>$ FOOBAR=val ; export FOOBAR #</literal></title>
-          <para>Use <literal>$ export FOOBAR=val # instead of $ FOOBAR=val ; export FOOBAR #</literal> -
-          this is much faster.</para>
-      </section>
-
-
-      <section xml:id="use_subshell_around_set_dashdash_usage">
-          <title>Use a subshell (e.g. <literal>$ ( mycmd ) #</literal>) around places which use
-              <literal>set -- $(mycmd)</literal> and/or <literal>shift</literal></title>
-          <para>Use a subshell (e.g. <literal>$ ( mycmd ) #</literal>) around places which use
-          <literal>set -- $(mycmd)</literal> and/or <literal>shift</literal> unless the variable
-          affected is either a local one or if it's guaranteed that this variable will no longer be used
-          (be careful for loadable functions, e.g. ksh/ksh93's <literal>autoload</literal> !!!!)
-          </para>
-      </section>
-
-
-      <section xml:id="be_careful_with_tabs_in_script_code">
-          <title>Be careful with using TABS in script code, they are not portable
-          between editors or platforms</title>
-          <para>Be careful with using TABS in script code, they are not portable
-          between editors or platforms.</para>
-          <para>If you use ksh93 use <literal>$'\t'</literal> to include TABs in sources, not the TAB character itself.</para>
-      </section>
-
-
-      <section xml:id="centralise_error_exit">
-           <title>If you have multiple points where your application exits with an error
-           message create a central function for this purpose</title>
-           <para>If you have multiple points where your application exits with an error
-           message create a central function for this, e.g.
-<programlisting>
-if [ -z "$tmpdir" ] ; then
-        print -u2 "mktemp failed to produce output; aborting."
-        exit 1
-fi
-if [ ! -d $tmpdir ] ; then
-        print -u2 "mktemp failed to create a directory; aborting."
-        exit 1
-fi
-</programlisting>
-should be replaced with
-<programlisting>
-function fatal_error
-{
-    print -u2 "${progname}: $*"
-    exit 1
-}
-# do something (and save ARGV[0] to variable "progname")
-if [ -z "$tmpdir" ] ; then
-        fatal_error "mktemp failed to produce output; aborting."
-fi
-if [ ! -d "$tmpdir" ] ; then
-        fatal_error "mktemp failed to create a directory; aborting."
-fi
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="use_set_o_nounset">
-          <title>&tag_kshonly; Think about using <literal>$ set -o nounset #</literal> by default</title>
-          <para>Think about using <literal>$ set -o nounset #</literal> by default (or at least during the
-    script's development phase) to catch errors where variables are used
-    when they are not set (yet), e.g.
-<screen>
-$ <userinput>(set -o nounset ; print ${foonotset})</userinput>
-<computeroutput>/bin/ksh93: foonotset: parameter not set</computeroutput>
-</screen>
-           </para>
-      </section>
-
-
-      <section xml:id="avoid_eval_builtin">
-          <title>Avoid using <literal>eval</literal> unless absolutely necessary</title>
-          <para>Avoid using <literal>eval</literal> unless absolutely necessary.  Subtle things
-          can happen when a string is passed back through the shell
-          parser.  You can use name references to avoid uses such as
-          <literal>eval $name="$value"</literal>.
-          </para>
-      </section>
-
-
-      <section xml:id="use_concatenation_operator">
-          <title>&tag_ksh93only;Use the string/array concatenation operator <literal>+=</literal></title>
-          <para>Use <literal>+=</literal> instead of manually adding strings/array elements, e.g.
-<programlisting>
-foo=""
-foo="${foo}a"
-foo="${foo}b"
-foo="${foo}c"
-</programlisting>
-should be replaced with
-<programlisting>
-foo=""
-foo+="a"
-foo+="b"
-foo+="c"
-</programlisting>
-          </para>
-      </section>
- 
-      <section xml:id="use_source_not_dot">
-          <title>&tag_ksh93only;Use <literal>source</literal> instead of '<literal>.</literal> '(dot)
-          to include other shell script fragments</title>
-          <para>Use <literal>source</literal> instead of '<literal>.</literal>'
-          (dot) to include other shell script fragments - the new form is much
-          more readable than the tiny dot and a failure can be caught within the script.</para>
-      </section>
-
-
-      <section xml:id="use_builtin_localisation_support">
-          <title>&tag_ksh93only;&tag_performance;&tag_l10n;Use <literal>$"..."</literal> instead of
-          <literal>gettext ... "..."</literal> for strings that need to be localized for different locales</title>
-          <para>Use $"..." instead of <literal>gettext ... "..."</literal> for strings that need to be
-          localized for different locales. <literal>gettext</literal> will require a
-          <literal>fork()+exec()</literal> and
-          reads the whole catalog each time it's called, creating a huge overhead for localisation
-          (and the  <literal>$"..."</literal> is easier to use, e.g. you only have to put a
-          <literal>$</literal> in front of the catalog and the string will be localised).
-          </para>
-      </section>
-
-
-      <section xml:id="use_set_o_noglob">
-          <title>&tag_kshonly;&tag_performance;Use <literal>set -o noglob</literal> if you do not need to expand files</title>
-          <para>If you don't expect to expand files, you can do set <literal>-f</literal>
-          (<literal>set -o noglob</literal>) as well.  This way the need to use <literal>""</literal> is
-          greatly reduced.</para>
-      </section>
-
-
-      <section xml:id="use_empty_ifs_to_handle_spaces">
-          <title>&tag_ksh93only;Use <literal>IFS=</literal> to avoid problems with spaces in filenames</title>
-          <para>Unless you want to do word splitting, put <literal>IFS=</literal>
-          at the beginning of a command.  This way spaces in
-          file names won't be a problem.  You can do
-          <literal>IFS='delims' read -r</literal> line
-          to override <envar>IFS</envar> just for the <literal>read</literal> command.  However,
-          you can't do this for the <literal>set</literal> builtin.</para>
-      </section>
-
-
-      <section xml:id="set_locale_when_comparing_against_localised_output">
-          <title>Set the message locale if you process output of tools which may be localised</title>
-          <para>Set the message locale (<envar>LC_MESSAGES</envar>) if you process output of tools which may be localised</para>
-          <example><title>Set <envar>LC_MESSAGES</envar> when testing for specific outout of the <filename>/usr/bin/file</filename> utility:</title>
-<programlisting>
-# set french as default message locale
-export LC_MESSAGES=fr_FR.UTF-8
-
-...
-
-# test whether the file "/tmp" has the filetype "directory" or not
-# we set LC_MESSAGES to "C" to ensure the returned message is in english
-if [[ "$(LC_MESSAGES=C file /tmp)" = *directory ]] ; then
-    print "is a directory"
-fi
-</programlisting>
-          <note><para>The environment variable <envar>LC_ALL</envar> always
-          overrides any other <envar>LC_*</envar> environment variables
-          (and <envar>LANG</envar>, too),
-          including <envar>LC_MESSAGES</envar>.
-          if there is the chance that <envar>LC_ALL</envar> may be set
-          replace <envar>LC_MESSAGES</envar> with <envar>LC_ALL</envar>
-          in the example above.</para></note>
-          </example>
-      </section>
-      
-      <section xml:id="cleanup_after_yourself">
-          <title>Cleanup after yourself.</title>
-          <para>Cleanup after yourself. For example ksh/ksh93 have an <literal>EXIT</literal> trap which
-          is very useful for this.
-          </para>
-          <note><para>
-          Note that the <literal>EXIT</literal> trap is executed for a subshell and each subshell
-          level can run it's own <literal>EXIT</literal> trap, for example
-<screen>
-$ <userinput>(trap "print bam" EXIT ; (trap "print snap" EXIT ; print "foo"))</userinput>
-<computeroutput>foo
-snap
-bam</computeroutput>
-</screen>
-          </para></note>
-      </section>
-
-      <section xml:id="use_proper_exit_code">
-          <title>Use a proper <literal>exit</literal> code</title>
-          <para>Explicitly set the exit code of a script, otherwise the exit code
-          from the last command executed will be used which may trigger problems
-          if the value is unexpected.</para>
-      </section>
-
-
-      <section xml:id="shell_lint">
-          <title>&tag_ksh93only;Use <literal>shcomp -n scriptname.sh /dev/null</literal> to check for common errors</title>
-          <para>Use <literal>shcomp -n scriptname.sh /dev/null</literal> to
-          check for common problems (such as insecure, depreciated or ambiguous constructs) in shell scripts.</para>
-      </section>
-  </section><!-- end of general -->
-
-
-
-
-
-  <section xml:id="functions">
-      <title>Functions</title>
-
-      <section xml:id="use_functions">
-          <title>Use functions to break up your code</title>
-          <para>Use functions to break up your code into smaller, logical blocks.</para>
-      </section>
-
-      <section xml:id="do_not_reserved_keywords_for_function_names">
-          <title>Do not use function names which are reserved keywords in C/C++/JAVA or the POSIX shell standard</title>
-          <para>Do not use function names which are reserved keywords (or function names) in C/C++/JAVA or the POSIX shell standard
-          (to avoid confusion and/or future changes/updates to the shell language).
-          </para>
-      </section> 
-      
-      <section xml:id="use_ksh_style_function_syntax">
-          <title>&tag_kshonly;&tag_performance;Use ksh-style <literal>function</literal></title>
-          <para>It is <emphasis>highly</emphasis> recommended to use ksh style functions
-          (<literal>function foo { ... }</literal>) instead
-          of Bourne-style functions (<literal>foo() { ... }</literal>) if possible
-          (and local variables instead of spamming the global namespace).</para>
-
-          <warning><para>
-          The difference between old-style Bourne functions and ksh functions is one of the major differences
-          between ksh88 and ksh93 - ksh88 allowed variables to be local for Bourne-style functions while ksh93
-          conforms to the POSIX standard and will use a function-local scope for variables declared in
-          Bourne-style functions.</para>
-          <para>Example (note that "<literal>integer</literal>" is an alias for "<literal>typeset -li</literal>"):
-<programlisting>
-# new style function with local variable
-$ ksh93 -c 'integer x=2 ; function foo { integer x=5 ; } ; print "x=$x"
-; foo ; print "x=$x" ;'
-x=2
-x=2
-# old style function with an attempt to create a local variable
-$ ksh93 -c 'integer x=2 ; foo() { integer x=5 ; } ; print "x=$x" ; foo ;
-print "x=$x" ;'       
-x=2
-x=5
-</programlisting>
-
-          <uri xlink:href="http://www.opensolaris.org/os/project/ksh93-integration/docs/ksh93r/general/compatibility/">usr/src/lib/libshell/common/COMPATIBILITY</uri>
-          says about this issue:
-<blockquote><para>
-Functions, defined with name() with ksh-93 are compatible with
-the POSIX standard, not with ksh-88.  No local variables are
-permitted, and there is no separate scope.  Functions defined
-with the function name syntax, maintain compatibility.
-This also affects function traces.
-</para></blockquote>
-(this issue also affects <filename>/usr/xpg4/bin/sh</filename> in Solaris 10 because it is based on ksh88. This is a bug.).          
-          </para></warning>
-
-      </section>
-
-
-      <section xml:id="use_proper_return_code">
-          <title>Use a proper <literal>return</literal> code</title>
-          <para>Explicitly set the return code of a function - otherwise the exit code
-          from the last command executed will be used which may trigger problems
-          if the value is unexpected.</para>
-          <para>The only allowed exception is if a function uses the shell's <literal>errexit</literal> mode to leave
-          a function, subshell or the script if a command returns a non-zero exit code.
-          </para>
-      </section>
-
-      <section xml:id="use_fpath_to_load_common_code">
-          <title>&tag_kshonly;Use <envar>FPATH</envar> to load common functions, not <literal>source</literal></title>
-          <para>
-          Use the ksh <envar>FPATH</envar> (function path) feature to load functions which are shared between scripts
-          and not <literal>source</literal> - this allows to load such a function on demand and not all at once.</para>
-      </section>
- 
-  </section><!-- end of functions -->
-
-
-
-
-  <section xml:id="if_for_while">
-      <title><literal>if</literal>, <literal>for</literal> and <literal>while</literal></title>
-
-      <section xml:id="if_for_while_format">
-          <title>Format</title>
-          <para>To match <literal>cstyle</literal>, the shell token equivalent to the <literal>C</literal>
-          "<literal>{</literal>" should appear on the same line, separated by a
-          "<literal>;</literal>", as in:
-<programlisting>
-if [ "$x" = "hello" ] ; then
-    echo $x
-fi
-
-if [[ "$x" = "hello" ]] ; then
-    print $x
-fi
-
-for i in 1 2 3; do
-    echo $i
-done
-
-for ((i=0 ; i &lt; 3 ; i++)); do
-    print $i
-done
-
-while [ $# -gt 0 ]; do
-    echo $1
-    shift
-done
-
-while (( $# &gt; 0 )); do
-  print $1
-  shift
-done
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="test_builtin">
-          <title><literal>test</literal> Builtin</title>
-          <para>DO NOT use the test builtin. Sorry, executive decision.</para>
-          <para>In our Bourne shell, the <literal>test</literal> built-in is the same as the "["
-          builtin (if you don't believe me, try "type test" or refer to <filename>usr/src/cmd/sh/msg.c</filename>).</para>
-          <para>
-          So please do not write:
-<programlisting>
-if test $# -gt 0 ; then
-</programlisting>         
-instead use:
-<programlisting>
-if [ $# -gt 0 ] ; then
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="use_ksh_test_syntax">
-           <title>&tag_kshonly;&tag_performance;Use "<literal>[[ expr ]]</literal>" instead of "<literal>[ expr ]</literal>"</title>
-           <para>Use "<literal>[[ expr ]]</literal>" instead of "<literal>[ expr ]</literal>" if possible
-           since it avoids going through the whole pattern expansion/etc. machinery and
-           adds additional operators not available in the Bourne shell, such as short-circuit
-           <literal>&amp;&amp;</literal> and <literal>||</literal>.
-           </para>
-      </section>
-
-      
-      <section xml:id="use_posix_arithmetic_expressions">
-          <title>&tag_kshonly; Use "<literal>(( ... ))</literal>" for arithmetic expressions</title>
-          <para>Use "<literal>(( ... ))</literal>" instead of "<literal>[ expr ]</literal>"
-          or "<literal>[[ expr ]]</literal>" expressions.
-          </para>
-          <para>
-          Example: Replace
-<programlisting>
-i=5
-# do something
-if [ $i -gt 5 ] ; then
-</programlisting>
-with
-<programlisting>
-i=5
-# do something
-if (( i &gt; 5 )) ; then
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="compare_exit_code_using_math">
-          <title>&tag_kshonly;&tag_performance;Compare exit code using arithmetic expressions expressions</title>
-          <para>Use POSIX arithmetic expressions to test for exit/return codes of commands and functions.
-          For example turn
-<programlisting>
-if [ $? -gt 0 ] ; then
-</programlisting>
-into
-<programlisting>
-if (( $? &gt; 0 )) ; then
-</programlisting>
-         </para>
-      </section>
-      
-
-      <section xml:id="use_builtin_commands_in_loops">
-         <title>&tag_bourneonly; Use builtin commands in conditions for <literal>while</literal> endless loops</title>
-         <para>Make sure that your shell has a "<literal>true</literal>" builtin (like ksh93) when
-         executing endless loops like <literal>$ while true ; do do_something ; done #</literal> -
-         otherwise each loop cycle runs a <literal>|fork()|+|exec()|</literal>-cycle to run
-         <filename>/bin/true</filename>
-         </para>
-      </section>
-
-
-      <section xml:id="single_line_if_statements">
-         <title>Single-line if-statements</title>
-         <para>It is permissible to use <literal>&amp;&amp;</literal> and <literal>||</literal> to construct
-         shorthand for an "<literal>if</literal>" statement in the case where the if statement has a
-         single consequent line:
-<programlisting>
-[ $# -eq 0 ] &amp;&amp; exit 0
-</programlisting>
-instead of the longer:
-<programlisting>
-if [ $# -eq 0 ]; then
-  exit 0
-fi
-</programlisting>
-         </para>
-      </section>
-
-
-      <section xml:id="exit_status_and_if_for_while">
-         <title>Exit Status and <literal>if</literal>/<literal>while</literal> statements</title>
-         <para>Recall that "<literal>if</literal>" and "<literal>while</literal>"
-         operate on the exit status of the statement
-         to be executed. In the shell, zero (0) means true and non-zero means false.
-         The exit status of the last command which was executed is available in the $?
-         variable. When using "<literal>if</literal>" and "<literal>while</literal>",
-         it is typically not necessary to use
-         <literal>$?</literal> explicitly, as in:
-<programlisting>
-grep foo /etc/passwd &gt;/dev/null 2>&amp;1
-if [ $? -eq 0 ]; then
-  echo "found"
-fi
-</programlisting>
-Instead, you can more concisely write:
-<programlisting>
-if grep foo /etc/passwd &gt;/dev/null 2>&amp;1; then
-  echo "found"
-fi
-</programlisting>
-Or, when appropriate:
-<programlisting>
-grep foo /etc/passwd &gt;/dev/null 2>&amp;1 &amp;&amp; echo "found"
-</programlisting>
-         </para>
-      </section>
-
-  </section><!-- end of if/for/while -->
-
-
-
-
-
-
-  <section xml:id="variables">
-  <title>Variable types, naming and usage</title>
-
-      <section xml:id="names_should_be_lowercase">
-          <title>Names of local, non-environment, non-constant variables should be lowercase</title>
-          <para>Names of variables local to the current script which are not exported to the environment
-          should be lowercase while variable names which are exported to the
-          environment should be uppercase.</para>
-          <para>The only exception are global constants (=global readonly variables,
-          e.g. <literal>$ float -r M_PI=3.14159265358979323846 #</literal> (taken from &lt;math.h&gt;))
-          which may be allowed to use uppercase names, too.
-          </para>
-
-          <warning><para>
-              Uppercase variable names should be avoided because there is a good chance
-              of naming collisions with either special variable names used by the shell
-              (e.g.  <literal>PWD</literal>, <literal>SECONDS</literal> etc.).
-          </para></warning>
-      </section>
-
-      <section xml:id="do_not_reserved_keywords_for_variable_names">
-          <title>Do not use variable names which are reserved keywords/variable names in C/C++/JAVA or the POSIX shell standard</title>
-          <para>Do not use variable names which are reserved keywords in C/C++/JAVA or the POSIX shell standard
-          (to avoid confusion and/or future changes/updates to the shell language).
-          </para>
-          <note>
-            <para>The Korn Shell and the POSIX shell standard have many more
-            reserved variable names than the original Bourne shell. All
-            these reserved variable names are spelled uppercase.           
-            </para>
-          </note>
-      </section> 
-           
-      <section xml:id="use_brackets_around_long_names">
-          <title>Always use <literal>'{'</literal>+<literal>'}'</literal> when using variable
-          names longer than one character</title>
-          <para>Always use <literal>'{'</literal>+<literal>'}'</literal> when using
-          variable names longer than one character unless a simple variable name is
-          followed by a blank, <literal>/</literal>, <literal>;</literal>, or <literal>$</literal>
-          character (to avoid problems with array,
-          compound variables or accidental misinterpretation by users/shell)
-<programlisting>
-print "$foo=info"
-</programlisting>
-should be rewritten to
-<programlisting>
-print "${foo}=info"
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="quote_variables_containing_filenames_or_userinput">
-          <title><emphasis>Always</emphasis> put variables into quotes when handling filenames or user input</title>
-          <para><emphasis>Always</emphasis> put variables into quotes when handling filenames or user input, even if
-          the values are hardcoded or the values appear to be fixed. Otherwise at
-          least two things may go wrong:
-          <itemizedlist>
-          <listitem><para>a malicious user may be able to exploit a script's inner working to
-          infect his/her own code</para></listitem>
-          <listitem><para>a script may (fatally) misbehave for unexpected input (e.g. file names
-          with blanks and/or special symbols which are interpreted by the shell)</para></listitem>
-          </itemizedlist>
-          </para>
-
-          <note><para>
-          As alternative a script may set <literal>IFS='' ; set -o noglob</literal> to turn off the
-          interpretation of any field seperators and the pattern globbing.
-          </para></note>
-      </section>
-
-   
-   
-      <section xml:id="use_typed_variables">
-          <title>&tag_kshonly;&tag_performance;Use typed variables if possible.</title>
-          <para>For example the following is very
-          inefficient since it transforms the integer values to strings and back
-          several times:
-<programlisting>
-a=0
-b=1
-c=2
-# more code
-if [ $a -lt 5 -o $b -gt c ] ; then do_something ; fi
-</programlisting>
-This could be rewritten using ksh constructs:
-<programlisting>
-integer a=0
-integer b=1
-integer c=2
-# more code
-if (( a &lt; 5 || b &gt; c )) ; then do_something ; fi
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="store_lists_in_arrays">
-          <title>&tag_ksh93only; Store lists in arrays or associative arrays</title>
-          <para>Store lists in arrays or associative arrays - this is usually easier
-          to manage.</para>
-          <para>
-    For example:
-<programlisting>
-x="
-/etc/foo
-/etc/bar
-/etc/baz
-"
-echo $x
-</programlisting>
-can be replaced with
-<programlisting>
-typeset -a mylist
-mylist[0]="/etc/foo"
-mylist[1]="/etc/bar"
-mylist[2]="/etc/baz"
-print "${mylist[@]}"
-</programlisting>
-or (ksh93-style append entries to a normal (non-associative) array)
-<programlisting>
-typeset -a mylist
-mylist+=( "/etc/foo" )
-mylist+=( "/etc/bar" )
-mylist+=( "/etc/baz" )
-print "${mylist[@]}"
-</programlisting>
-          </para>
-          <note>
-              <title>Difference between expanding arrays with mylist[@] and mylist[*] subscript operators</title>
-              <para>
-              Arrays may be expanded using two similar subscript operators, @ and *. These subscripts
-              differ only when the variable expansion appears within double quotes. If the variable expansion
-              is between double-quotes, "${mylist[*]}" expands to a single string with the value of each array
-              member separated by the first character of the <envar>IFS</envar> variable, and "${mylist[@]}"
-              expands each element of name to a separate string.
-              </para>
-              <example><title>Difference between [@] and [*] when expanding arrays</title>
-<programlisting>
-typeset -a mylist
-mylist+=( "/etc/foo" )
-mylist+=( "/etc/bar" )
-mylist+=( "/etc/baz" )
-IFS=","
-printf "mylist[*]={ 0=|%s| 1=|%s| 2=|%s| 3=|%s| }\n" "${mylist[*]}"
-printf "mylist[@]={ 0=|%s| 1=|%s| 2=|%s| 3=|%s| }\n" "${mylist[@]}"
-</programlisting>
-<para>will print:</para>
-<screen>
-<computeroutput>mylist[*]={ 0=|/etc/foo,/etc/bar,/etc/baz| 1=|| 2=|| 3=|| }
-mylist[@]={ 0=|/etc/foo| 1=|/etc/bar| 2=|/etc/baz| 3=|| }
-</computeroutput>
-</screen>
-              </example>
-          </note>
-      </section>
-
-
-      <section xml:id="use_compound_variables_or_lists_for_grouping">
-          <title>&tag_ksh93only; Use compound variables or associative arrays to group similar variables together</title>
-          <para>Use compound variables or associative arrays to group similar variables together.</para>
-          <para>
-    For example:
-<programlisting>
-box_width=56
-box_height=10
-box_depth=19
-echo "${box_width} ${box_height} ${box_depth}"
-</programlisting>
-could be rewritten to ("associative array"-style)
-<programlisting>
-typeset -A -E box=( [width]=56 [height]=10 [depth]=19 )
-print -- "${box[width]} ${box[height]} ${box[depth]}"
-</programlisting>
-or ("compound variable"-style
-<programlisting>
-box=(
-    float width=56
-    float height=10
-    float depth=19
-    )
-print -- "${box.width} ${box.height} ${box.depth}"
-</programlisting>
-          </para>
-      </section>    
-  </section><!-- end of variables -->
-
-
-
-
-
-
-
-  <section xml:id="io">
-  <title>I/O</title>
-
-      <section xml:id="avoid_echo">
-          <title>Avoid using the "<literal>echo</literal>" command for output</title>
-          <para>The behaviour of "<literal>echo</literal>" is not portable
-          (e.g. System V, BSD, UCB and ksh93/bash shell builtin versions all
-          slightly differ in functionality) and should be avoided if possible.
-          POSIX defines the "<literal>printf</literal>" command as replacement
-          which provides more flexible and portable behaviour.</para>
-
-          <note>
-              <title>&tag_kshonly;Use "<literal>print</literal>" and not "<literal>echo</literal>" in Korn Shell scripts</title>
-              <para>Korn shell scripts should prefer the "<literal>print</literal>"
-              builtin which was introduced as replacement for "<literal>echo</literal>".</para>
-              <caution>
-                  <para>Use <literal>$ print -- ${varname}" #</literal> when there is the slightest chance that the
-                  variable "<literal>varname</literal>" may contain symbols like "-". Or better use "<literal>printf</literal>"
-                  instead, for example
-<programlisting>
-integer fx
-# do something
-print $fx
-</programlisting>
-may fail if "f" contains a negative value. A better way may be to use
-<programlisting>
-integer fx
-# do something
-printf "%d\n" fx
-</programlisting>
-                  </para>
-              </caution>
-          </note>
-      </section>
-      
-      <section xml:id="use_redirect_not_exec_to_open_files">
-          <title>&tag_ksh93only;Use <literal>redirect</literal> and not <literal>exec</literal> to open files</title>
-          <para>Use <literal>redirect</literal> and not <literal>exec</literal> to open files - <literal>exec</literal>
-          will terminate the current function or script if an error occurs while <literal>redirect</literal>
-          just returns a non-zero exit code which can be caught.</para>
-<para>Example:
-<programlisting>
-if redirect 5&lt;/etc/profile ; then
-    print "file open ok"
-    head &lt;&amp;5
-else
-    print "could not open file"
-fi
-</programlisting>
-           </para>
-      </section>
-      
-      <section xml:id="group_identical_redirections_together">
-          <title>&tag_performance;Avoid redirections per command when the output goes into the same file,
-          e.g. <literal>$ echo "foo" &gt;xxx ; echo "bar" &gt;&gt;xxx ; echo "baz" &gt;&gt;xxx #</literal></title>
-          <para>Each of the redirections above trigger an
-          <literal>|open()|,|write()|,|close()|</literal>-sequence. It is much
-          more efficient (and faster) to group the rediction into a block,
-          e.g. <literal>{ echo "foo" ; echo "bar" ; echo "baz" } &gt;xxx #</literal></para>
-      </section>
-
-
-      <section xml:id="avoid_using_temporary_files">
-          <title>&tag_performance;Avoid the creation of temporary files and store the values in variables instead</title>
-          <para>Avoid the creation of temporary files and store the values in variables instead if possible</para>
-          <para>
-    Example:
-<programlisting>
-ls -1 &gt;xxx
-for i in $(cat xxx) ; do
-    do_something ;
-done
-</programlisting>
-can be replaced with
-<programlisting>
-x="$(ls -1)"
-for i in ${x} ; do
-    do_something ;
-done
-</programlisting>
-           </para>
-           <note><para>ksh93 supports binary variables (e.g. <literal>typeset -b varname</literal>) which can hold any value.</para></note>
-      </section>  
-
-
-      <section xml:id="create_subdirs_for_multiple_temporary_files">
-          <title>If you create more than one temporary file create an unique subdir</title>
-          <para>If you create more than one temporary file create an unique subdir for
-          these files and make sure the dir is writable. Make sure you cleanup
-          after yourself (unless you are debugging).
-          </para>
-      </section>           
-
-
-      <section xml:id="use_dynamic_file_descriptors">
-          <title>&tag_ksh93only;Use {n}&lt;file instead of fixed file descriptor numbers</title>
-          <para>When opening a file use {n}&lt;file, where <envar>n</envar> is an
-          integer variable rather than specifying a fixed descriptor number.</para>
-          <para>This is highly recommended in functions to avoid that fixed file
-          descriptor numbers interfere with the calling script.</para>
-<example><title>Open a network connection and store the file descriptor number in a variable</title>
-<programlisting>
-function cat_http
-{
-    integer netfd
-
-...
-
-    # open TCP channel
-    redirect {netfd}&lt;&gt;"/dev/tcp/${host}/${port}"
-
-    # send HTTP request    
-    request="GET /${path} HTTP/1.1\n"
-    request+="Host: ${host}\n"
-    request+="User-Agent: demo code/ksh93 (2007-08-30; $(uname -s -r -p))\n"
-    request+="Connection: close\n"
-    print "${request}\n" &gt;&amp;${netfd}
-    
-    # collect response and send it to stdout
-    cat &lt;&amp;${netfd}
-    
-    # close connection
-    exec {netfd}&lt;&amp;-
-
-...
-
-}
-</programlisting>
-</example>
-      </section>           
-
-
-      <section xml:id="use_inline_here_documents">
-          <title>&tag_ksh93only;&tag_performance;Use inline here documents
-          instead of <literal>echo "$x" | command</literal></title>
-          <para>Use inline here documents, for example
-<programlisting>
-command &lt;&lt;&lt; $x
-</programlisting>
-       rather than
-<programlisting>
-print -r -- "$x" | command
-</programlisting>
-          </para>
-      </section>           
-
-
-      <section xml:id="use_read_r">
-          <title>&tag_ksh93only;Use the <literal>-r</literal> option of <literal>read</literal> to read a line</title>
-          <para>Use the <literal>-r</literal> option of <literal>read</literal> to read a line.
-          You never know when a line will end in <literal>\</literal> and without a
-          <literal>-r</literal> multiple
-          lines can be read.</para>
-      </section>
-
-
-      <section xml:id="print_compound_variables_using_print_C">
-          <title>&tag_ksh93only;Print compound variables using <literal>print -C varname</literal> or <literal>print -v varname</literal></title>
-          <para>Print compound variables using <literal>print -C varname</literal> or
-          <literal>print -v varname</literal> to make sure that non-printable characters
-          are correctly encoded.</para>
-<example><title>Print compound variable with non-printable characters</title>
-<programlisting>
-compound x=(
-    a=5
-    b="hello"
-    c=(
-        d=9
-        e="$(printf "1\v3")" <co xml:id="co.vertical_tab1" />
-    )
-)
-print -v x
-</programlisting>
-<para>will print:</para>
-<screen>
-<computeroutput>(
-        a=5
-        b=hello
-        c=(
-                d=9
-                e=$'1\0133' <co xml:id="co.vertical_tab2" />
-        )
-)</computeroutput>
-</screen>
-<calloutlist>
-  <callout arearefs="co.vertical_tab1 co.vertical_tab2">
-    <para>vertical tab, <literal>\v</literal>, octal=<literal>\013</literal>.</para>
-  </callout>
-</calloutlist>
-</example>
-      </section>
-
-      <section xml:id="command_name_before_redirections">
-          <title>Put the command name and arguments before redirections</title>
-          <para>Put the command name and arguments before redirections.
-          You can legally do <literal>$ &gt; file date</literal> instead of <literal>date &gt; file</literal>
-          but don't do it.</para>
-      </section>           
-
-      <section xml:id="enable_gmacs_editor_mode_for_user_prompts">
-          <title>&tag_ksh93only;Enable the <literal>gmacs</literal> editor
-          mode when reading user input using the <literal>read</literal> builtin</title>
-          <para>Enable the <literal>gmacs</literal>editor mode before reading user
-          input using the <literal>read</literal> builtin to enable the use of
-          cursor+backspace+delete keys in the edit line</para>
-<example><title>Prompt user for a string with gmacs editor mode enabled</title>
-<programlisting>
-set -o gmacs <co xml:id="co.enable_gmacs" />
-typeset inputstring="default value"
-...
-read -v<co xml:id="co.read_v" /> inputstring<co xml:id="co.readvar" />?"Please enter a string: "<co xml:id="co.prompt" />
-...
-printf "The user entered the following string: '%s'\n" "${inputstring}"
-
-...
-</programlisting>
-<calloutlist>
-  <callout arearefs="co.enable_gmacs">
-    <para>Enable gmacs editor mode.</para>
-  </callout>
-  <callout arearefs="co.read_v">
-    <para>The value of the variable is displayed and used as a default value.</para>
-  </callout>  
-  <callout arearefs="co.readvar">
-    <para>Variable used to store the result.</para>
-  </callout> 
-  <callout arearefs="co.prompt">
-    <para>Prompt string which is displayed in stderr.</para>
-  </callout> 
-</calloutlist>
-</example>
-      </section>        
-  </section><!-- end of I/O -->
-
-
-
-
-
-
-  <section xml:id="math">
-  <title>Math</title>
-
-      <section xml:id="use_builtin_arithmetic_expressions">
-          <title>&tag_kshonly;&tag_performance;Use builtin arithmetic expressions instead of external applications</title>
-          <para>Use builtin (POSIX shell) arithmetic expressions instead of
-          <filename>expr</filename>,
-          <filename>bc</filename>,
-          <filename>dc</filename>,
-          <filename>awk</filename>,
-          <filename>nawk</filename> or
-          <filename>perl</filename>.
-          </para>
-          <note>
-              <para>ksh93 supports C99-like floating-point arithmetic including special values
-              such as
-              <simplelist type="inline">
-              <member>+Inf</member>
-              <member>-Inf</member>
-              <member>+NaN</member>
-              <member>-NaN</member>
-              </simplelist>.
-              </para>
-          </note>
-      </section>
-
-
-      <section xml:id="use_floating_point_arithmetic_expressions">
-          <title>&tag_ksh93only; Use floating-point arithmetic expressions if
-          calculations may trigger a division by zero or other exceptions</title>
-          <para>Use floating-point arithmetic expressions if calculations may
-          trigger a division by zero or other exceptions - floating point arithmetic expressions in
-          ksh93 support special values such as <literal>+Inf</literal>/<literal>-Inf</literal> and
-          <literal>+NaN</literal>/<literal>-NaN</literal> which can greatly simplify testing for
-          error conditions, e.g. instead of a <literal>trap</literal> or explicit
-          <literal>if ... then... else</literal> checks for every sub-expression
-          you can check the results for such special values.
-          </para>
-          <para>Example:
-<screen>
-$ <userinput>ksh93 -c 'integer i=0 j=5 ; print -- "x=$((j/i)) "'</userinput>
-<computeroutput>ksh93: line 1: j/i: divide by zero</computeroutput>
-$ <userinput>ksh93 -c 'float i=0 j=-5 ; print -- "x=$((j/i)) "'</userinput>
-<computeroutput>x=-Inf</computeroutput>
-</screen>
-          </para>
-      </section>
-
-
-      <section xml:id="use_printf_a_for_passing_float_values">
-          <title>&tag_ksh93only; Use <literal>printf "%a"</literal> when passing floating-point values</title>
-          <para>Use <literal>printf "%a"</literal> when passing floating-point values between scripts or
-          as output of a function to avoid rounding errors when converting between
-          bases.</para>
-          <para>
-    Example:
-<programlisting>
-function xxx
-{
-    float val
-
-    (( val=sin(5.) ))
-    printf "%a\n" val
-}
-float out
-(( out=$(xxx) ))
-xxx
-print -- $out
-</programlisting>
-This will print:
-<programlisting>
--0.9589242747
--0x1.eaf81f5e09933226af13e5563bc6p-01
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="put_constants_into_readonly_variables">
-         <title>&tag_kshonly;&tag_performance;Put constant values into readonly variables</title>
-         <para>Put constant values into readonly variables</para>
-         <para>For example:
-<programlisting>
-float -r M_PI=3.14159265358979323846
-</programlisting>
-or
-<programlisting>
-float M_PI=3.14159265358979323846
-readonly M_PI
-</programlisting>
-          </para>
-      </section>
-
-
-      <section xml:id="avoid_unnecessary_string_number_conversions">
-         <title>&tag_kshonly;&tag_performance;Avoid string to number
-         (and/or number to string) conversions in arithmetic expressions
-         expressions</title>
-         <para>Avoid string to number and/or number to string conversions in
-         arithmetic expressions expressions to avoid performance degradation
-         and rounding errors.</para>
-         <example><title>(( x=$x*2 )) vs. (( x=x*2 ))</title>
-<programlisting>
-float x
-...
-(( x=$x*2 ))
-</programlisting>
-<para>
-will convert the variable "x" (stored in the machine's native
-<literal>|long double|</literal> datatype) to a string value in base10 format,
-apply pattern expansion (globbing), then insert this string into the
-arithmetic expressions and parse the value which converts it into the internal |long double| datatype format again.
-This is both slow and generates rounding errors when converting the floating-point value between
-the internal base2 and the base10 representation of the string.
-</para>
-<para>
-The correct usage would be:
-</para>
-<programlisting>
-float x
-...
-(( x=x*2 ))
-</programlisting>
-<para>
-e.g. omit the '$' because it's (at least) redundant within arithmetic expressions.
-</para>
-         </example>
-
-
-         <example><title>x=$(( y+5.5 )) vs. (( x=y+5.5 ))</title>
-<programlisting>
-float x
-float y=7.1
-...
-x=$(( y+5.5 ))
-</programlisting>
-<para>
-will calculate the value of <literal>y+5.5</literal>, convert it to a
-base-10 string value amd assign the value to the floating-point variable
-<literal>x</literal> again which will convert the string value back to the
-internal |long double| datatype format again.
-</para>
-<para>
-The correct usage would be:
-</para>
-<programlisting>
-float x
-float y=7.1
-...
-(( x=y+5.5 ))
-</programlisting>
-<para>
-i.e. this will save the string conversions and avoid any base2--&gt;base10--&gt;base2-conversions.
-</para>
-          </example>
-      </section>
-
-
-      <section xml:id="set_lc_numeric_when_using_floating_point">
-         <title>&tag_ksh93only;Set <envar>LC_NUMERIC</envar> when using floating-point constants</title>
-         <para>Set <envar>LC_NUMERIC</envar> when using floating-point constants to avoid problems with radix-point
-         representations which differ from the representation used in the script, for example the <literal>de_DE.*</literal> locale
-         use ',' instead of '.' as default radix point symbol.</para>
-         <para>For example:
-<programlisting>
-# Make sure all math stuff runs in the "C" locale to avoid problems with alternative
-# radix point representations (e.g. ',' instead of '.' in de_DE.*-locales). This
-# needs to be set _before_ any floating-point constants are defined in this script)
-if [[ "${LC_ALL}" != "" ]] ; then
-    export \
-        LC_MONETARY="${LC_ALL}" \
-        LC_MESSAGES="${LC_ALL}" \
-        LC_COLLATE="${LC_ALL}" \
-        LC_CTYPE="${LC_ALL}"
-        unset LC_ALL
-fi
-export LC_NUMERIC=C
-...
-float -r M_PI=3.14159265358979323846
-</programlisting>
-          </para>
-
-          <note><para>The environment variable <envar>LC_ALL</envar> always overrides all other <envar>LC_*</envar> variables,
-          including <envar>LC_NUMERIC</envar>. The script should always protect itself against custom <envar>LC_NUMERIC</envar> and
-          <envar>LC_ALL</envar> values as shown in the example above.
-          </para></note>
-      </section>
-
-
-
-  </section><!-- end of math -->
-    
-  
-
-
-
-
-  <section xml:id="misc">
-  <title>Misc</title>
-
-      <section xml:id="debug_use_lineno_in_ps4">
-          <title>Put <literal>[${LINENO}]</literal> in your <envar>PS4</envar></title>
-          <para>Put <literal>[${LINENO}]</literal> in your <envar>PS4</envar> prompt so that you will get line
-          numbers with you run with <literal>-x</literal>. If you are looking at performance
-          issues put <literal>$SECONDS</literal> in the <envar>PS4</envar> prompt as well.</para>
-      </section>
-
-  </section><!-- end of misc -->
-
-
-
-
-</section><!-- end of RULES -->
-
-
-
-  
-</article>
diff --git a/usr/src/lib/libsmartsshd/Makefile b/usr/src/lib/libsmartsshd/Makefile
new file mode 100644
index 0000000000..50d9545ef1
--- /dev/null
+++ b/usr/src/lib/libsmartsshd/Makefile
@@ -0,0 +1,48 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2011 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+include		../Makefile.lib
+
+SUBDIRS=	$(MACH)
+$(BUILD64)SUBDIRS += $(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+_msg:
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/lib/libsmartsshd/Makefile.com b/usr/src/lib/libsmartsshd/Makefile.com
new file mode 100644
index 0000000000..1c189a88d8
--- /dev/null
+++ b/usr/src/lib/libsmartsshd/Makefile.com
@@ -0,0 +1,46 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+LIBRARY=	libsmartsshd.a
+VERS=		.1
+OBJECTS=	sshd-plugin.o
+
+include ../../Makefile.lib
+include	../../Makefile.rootfs
+
+SRCDIR =	../common
+SRCS =	$(OBJECTS:%.o=$(SRCDIR)/%.c)
+
+CPPFLAGS +=	-I$(SRCDIR) -D_REENTRANT -D_FILE_OFFSET_BITS=64
+LIBS =		$(DYNLIB) $(LINTLIB)
+LDLIBS +=	-lc -ldoor -lmd5
+
+$(LINTLIB) :=	SRCS=	$(SRCDIR)/$(LINTSRC)
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/libsmartsshd/amd64/Makefile b/usr/src/lib/libsmartsshd/amd64/Makefile
new file mode 100644
index 0000000000..31be0ef7e6
--- /dev/null
+++ b/usr/src/lib/libsmartsshd/amd64/Makefile
@@ -0,0 +1,32 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2011 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libsmartsshd/common/llib-lsmartsshd b/usr/src/lib/libsmartsshd/common/llib-lsmartsshd
new file mode 100644
index 0000000000..ace7017d41
--- /dev/null
+++ b/usr/src/lib/libsmartsshd/common/llib-lsmartsshd
@@ -0,0 +1,32 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License, Version 1.0 only
+ * (the "License").  You may not use this file except in compliance
+ * with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*LINTLIBRARY*/
+/*PROTOLIB1*/
+/*
+ *
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ *
+ */
+
+#pragma ident   "%Z%%M% %I%     %E% SMI"
+
diff --git a/usr/src/lib/libsmartsshd/common/mapfile-vers b/usr/src/lib/libsmartsshd/common/mapfile-vers
new file mode 100644
index 0000000000..c3c6fe4946
--- /dev/null
+++ b/usr/src/lib/libsmartsshd/common/mapfile-vers
@@ -0,0 +1,48 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate_1.1 {
+    global:
+	sshd_user_rsa_key_allowed;
+	sshd_user_dsa_key_allowed;
+	sshd_user_ecdsa_key_allowed;
+	sshd_user_key_allowed;
+    local:
+	*;
+};
diff --git a/usr/src/lib/libsmartsshd/common/sshd-plugin.c b/usr/src/lib/libsmartsshd/common/sshd-plugin.c
new file mode 100644
index 0000000000..a6463cea12
--- /dev/null
+++ b/usr/src/lib/libsmartsshd/common/sshd-plugin.c
@@ -0,0 +1,193 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <alloca.h>
+#include <door.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pwd.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/rsa.h>
+
+#include <md5.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	LOG_OOM(SZ)	(void) fprintf(stderr, "Cannot alloca %d bytes\n", SZ)
+
+static const char *DOOR = "/var/tmp/._joyent_sshd_key_is_authorized";
+static const char *REQ_FMT_STR = "%s %d %s"; /* name uid fp */
+static const int RETURN_SZ = 2;
+
+static const int MAX_ATTEMPTS = 2;
+static const int SLEEP_PERIOD = 1;
+
+static int
+sshd_allowed_in_capi(struct passwd *pw, const char *fp)
+{
+	int allowed = 0;
+	int fd = -1;
+	int blen = 0;
+	int attempts = 0;
+	char *buf = NULL;
+	door_arg_t door_args = {0};
+
+	if (pw == NULL || fp == NULL)
+		return (0);
+
+	blen = snprintf(NULL, 0, REQ_FMT_STR, pw->pw_name, pw->pw_uid, fp) + 1;
+
+	buf = (char *)alloca(blen);
+	if (buf == NULL) {
+		LOG_OOM(blen);
+		return (0);
+	}
+
+	(void) snprintf(buf, blen, REQ_FMT_STR, pw->pw_name, pw->pw_uid, fp);
+	door_args.data_ptr = buf;
+	door_args.data_size = blen;
+
+	door_args.rsize = RETURN_SZ;
+	door_args.rbuf = alloca(RETURN_SZ);
+	if (door_args.rbuf == NULL) {
+		LOG_OOM(RETURN_SZ);
+		return (0);
+	}
+	(void) memset(door_args.rbuf, 0, RETURN_SZ);
+
+	do {
+		fd = open(DOOR, O_RDWR);
+		if (fd < 0) {
+			if (errno == ENOENT) {
+				/*
+				 * On systems which are not running SmartLogin,
+				 * such as vanilla SmartOS, the door will be
+				 * completely absent.  The sleep/retry loop is
+				 * skipped in this case to keep the login
+				 * process more lively.
+				 */
+				perror("smartplugin: door does not exist");
+				return (0);
+			}
+			perror("smartplugin: open (of door FD) failed");
+		} else if (door_call(fd, &door_args) < 0) {
+			perror("smartplugin: door_call failed");
+		} else {
+			allowed = atoi(door_args.rbuf);
+			if (door_args.rsize > RETURN_SZ) {
+				/*
+				 * Given what we know about the SmartLogin
+				 * daemon on the other end of the door, this
+				 * should never occur.  An assert might be
+				 * preferable, but that is avoided since the
+				 * error can be handled.
+				 */
+				(void) munmap(door_args.rbuf, door_args.rsize);
+			}
+			return (allowed);
+		}
+		if (++attempts < MAX_ATTEMPTS) {
+			(void) sleep(SLEEP_PERIOD);
+		}
+	} while (attempts < MAX_ATTEMPTS);
+
+	return (0);
+}
+
+static int
+tohexstr(uchar_t *bytes, size_t blen, char *hexstr, size_t hexlen)
+{
+	size_t i, j;
+	const char hexlist[] = "0123456789abcdef";
+
+	if (hexlen < 1)
+		return (-1);
+	for (i = 0, j = 0; i < blen; i++) {
+		/*
+		 * We need 3 bytes output per input byte -- the third byte is
+		 * either for a : or the \0 at the end.
+		 */
+		if (hexlen < (j + 3))
+			return (-1);
+		hexstr[j++] = hexlist[(bytes[i] >> 4) & 0xf];
+		hexstr[j++] = hexlist[bytes[i] & 0xf];
+		if (i + 1 < blen)
+			hexstr[j++] = ':';
+	}
+	hexstr[j] = '\0';
+	return (0);
+}
+
+/* ARGSUSED */
+int
+sshd_user_key_allowed(struct passwd *pw, const char *type,
+    const unsigned char *buf, size_t size)
+{
+	unsigned char md5buf[MD5_DIGEST_LENGTH];
+	/*
+	 * Will contain the fingerprint MD5 in colonhex format. Need 3 bytes
+	 * per MD5 byte: two for hex digits, plus one for either ':' or '\0'.
+	 */
+	char hex[MD5_DIGEST_LENGTH * 3];
+
+	md5_calc(md5buf, buf, size);
+	if (tohexstr(md5buf, sizeof (md5buf), hex, sizeof (hex)) != 0)
+		return (0);
+	return (sshd_allowed_in_capi(pw, hex));
+}
+
+/* ARGSUSED */
+int
+sshd_user_rsa_key_allowed(struct passwd *pw, RSA *key, const char *fp)
+{
+	return (sshd_allowed_in_capi(pw, fp));
+}
+
+/* ARGSUSED */
+int
+sshd_user_dsa_key_allowed(struct passwd *pw, DSA *key, const char *fp)
+{
+	return (sshd_allowed_in_capi(pw, fp));
+}
+
+/* ARGSUSED */
+int
+sshd_user_ecdsa_key_allowed(struct passwd *pw, DSA *key, const char *fp)
+{
+	return (sshd_allowed_in_capi(pw, fp));
+}
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/usr/src/lib/libsmartsshd/i386/Makefile b/usr/src/lib/libsmartsshd/i386/Makefile
new file mode 100644
index 0000000000..2bfe8001d9
--- /dev/null
+++ b/usr/src/lib/libsmartsshd/i386/Makefile
@@ -0,0 +1,31 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2011 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libumem/amd64/umem_genasm.c b/usr/src/lib/libumem/amd64/umem_genasm.c
index 00cc18ab67..ba68cb2d37 100644
--- a/usr/src/lib/libumem/amd64/umem_genasm.c
+++ b/usr/src/lib/libumem/amd64/umem_genasm.c
@@ -69,8 +69,6 @@
 #include <umem_impl.h>
 #include "umem_base.h"
 
-#include <stdio.h>
-
 const int umem_genasm_supported = 1;
 static uintptr_t umem_genasm_mptr = (uintptr_t)&_malloc;
 static size_t umem_genasm_msize = 576;
diff --git a/usr/src/lib/libvmmapi/Makefile b/usr/src/lib/libvmmapi/Makefile
new file mode 100644
index 0000000000..233fcd5edb
--- /dev/null
+++ b/usr/src/lib/libvmmapi/Makefile
@@ -0,0 +1,51 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+#
+
+include		../Makefile.lib
+
+HDRS =		vmmapi.h
+
+HDRDIR =	common
+
+CHECKHDRS =
+
+$(BUILD64)SUBDIRS += $(MACH64)
+
+all:=		TARGET= all
+install:=	TARGET= install
+clean:=	TARGET= clean
+clobber:=	TARGET= clobber
+lint:=		TARGET= lint
+_msg:=		TARGET= _msg
+
+.KEEP_STATE:
+
+all install clean clobber lint: $(SUBDIRS)
+
+# install rule for install_h target
+
+install_h: $(ROOTHDRS)
+
+check: $(CHECKHDRS)
+
+_msg: $(MSGSUBDIRS)
+
+$(SUBDIRS): FRC
+	cd $@; pwd; $(MAKE) CW_NO_SHADOW=true __GNUC= $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
+include ../../Makefile.msg.targ
diff --git a/usr/src/lib/libvmmapi/Makefile.com b/usr/src/lib/libvmmapi/Makefile.com
new file mode 100644
index 0000000000..f975b1775f
--- /dev/null
+++ b/usr/src/lib/libvmmapi/Makefile.com
@@ -0,0 +1,53 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+#
+
+LIBRARY	= libvmmapi.a
+VERS		= .1
+
+OBJECTS	= vmmapi.o expand_number.o
+
+# include library definitions
+include ../../Makefile.lib
+
+# install this library in the root filesystem
+include ../../Makefile.rootfs
+
+SRCDIR		= ../common
+
+LIBS		= $(DYNLIB) $(LINTLIB)
+
+CPPFLAGS	= -I$(COMPAT)/freebsd -I$(CONTRIB)/freebsd \
+	$(CPPFLAGS.master) -I$(SRC)/uts/i86pc
+
+$(LINTLIB) :=	SRCS = $(SRCDIR)/$(LINTSRC)
+
+LDLIBS		+= -lc
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+lint: lintcheck
+
+pics/%.o: $(CONTRIB)/freebsd/lib/libutil/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+pics/%.o: ../common/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
+# include library targets
+include ../../Makefile.targ
diff --git a/usr/src/lib/libvmmapi/amd64/Makefile b/usr/src/lib/libvmmapi/amd64/Makefile
new file mode 100644
index 0000000000..b5cac1ffce
--- /dev/null
+++ b/usr/src/lib/libvmmapi/amd64/Makefile
@@ -0,0 +1,21 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+CPPFLAGS += -I$(COMPAT)/freebsd/amd64 -I$(CONTRIB)/freebsd/amd64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libvmmapi/common/llib-lvmmapi b/usr/src/lib/libvmmapi/common/llib-lvmmapi
new file mode 100644
index 0000000000..221ed3a23e
--- /dev/null
+++ b/usr/src/lib/libvmmapi/common/llib-lvmmapi
@@ -0,0 +1,2 @@
+/* LINTLIBRARY */
+/* PROTOLIB1 */
diff --git a/usr/src/lib/libvmmapi/common/mapfile-vers b/usr/src/lib/libvmmapi/common/mapfile-vers
new file mode 100644
index 0000000000..ad47407281
--- /dev/null
+++ b/usr/src/lib/libvmmapi/common/mapfile-vers
@@ -0,0 +1,123 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+# Copyright 2018 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION ILLUMOSprivate {
+	global:
+		vcpu_reset;
+		vm_active_cpus;
+		vm_activate_cpu;
+		vm_active_cpus;
+		vm_apicid2vcpu;
+		vm_assign_pptdev;
+		vm_capability_name2type;
+		vm_capability_type2name;
+		vm_copy_setup;
+		vm_copy_teardown;
+		vm_copyin;
+		vm_copyout;
+		vm_create_devmem;
+		vm_create;
+		vm_create_devmem;
+		vm_debug_cpus;
+		vm_destroy;
+		vm_destroy;
+		vm_get_capability;
+		vm_get_desc;
+		vm_get_device_fd;
+		vm_get_gpa_pmap;
+		vm_get_hpet_capabilities;
+		vm_get_highmem_size;
+		vm_get_intinfo;
+		vm_get_lowmem_limit;
+		vm_get_lowmem_size;
+		vm_get_memflags;
+		vm_get_memseg;
+		vm_get_pptdev_limits;
+		vm_get_register;
+		vm_get_register_set;
+		vm_get_seg_desc;
+		vm_get_stat_desc;
+		vm_get_stats;
+		vm_get_topology;
+		vm_get_x2apic_state;
+		vm_gla2gpa;
+		vm_gla2gpa_nofault;
+		vm_inject_exception;
+		vm_inject_nmi;
+		vm_isa_assert_irq;
+		vm_isa_deassert_irq;
+		vm_isa_pulse_irq;
+		vm_isa_set_irq_trigger;
+		vm_ioapic_assert_irq;
+		vm_ioapic_deassert_irq;
+		vm_ioapic_pincount;
+		vm_ioapic_pulse_irq;
+		vm_isa_assert_irq;
+		vm_isa_deassert_irq;
+		vm_isa_pulse_irq;
+		vm_isa_set_irq_trigger;
+		vm_lapic_irq;
+		vm_lapic_local_irq;
+		vm_lapic_msi;
+		vm_map_gpa;
+		vm_map_pptdev_mmio;
+		vm_mmap_getnext;
+		vm_mmap_memseg;
+		vm_open;
+		vm_parse_memsize;
+		vm_reinit;
+		vm_restart_instruction;
+		vm_rtc_gettime;
+		vm_rtc_read;
+		vm_rtc_settime;
+		vm_rtc_write;
+		vm_run;
+		vm_set_capability;
+		vm_set_desc;
+		vm_set_intinfo;
+		vm_set_memflags;
+		vm_set_register;
+		vm_set_register_set;
+		vm_set_topology;
+		vm_set_x2apic_state;
+		vm_setup_memory;
+		vm_setup_pptdev_msi;
+		vm_setup_pptdev_msix;
+		vm_suspend;
+		vm_suspend_cpu;
+		vm_suspended_cpus;
+		vm_resume_cpu;
+		vm_unassign_pptdev;
+
+	local:
+		*;
+};
diff --git a/usr/src/lib/libvmmapi/common/vmmapi.c b/usr/src/lib/libvmmapi/common/vmmapi.c
new file mode 100644
index 0000000000..c34bb60de6
--- /dev/null
+++ b/usr/src/lib/libvmmapi/common/vmmapi.c
@@ -0,0 +1,1804 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/sysctl.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/_iovec.h>
+#include <sys/cpuset.h>
+
+#include <x86/segments.h>
+#include <machine/specialreg.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <libutil.h>
+
+#include <machine/vmm.h>
+#include <machine/vmm_dev.h>
+#ifndef	__FreeBSD__
+#include <sys/vmm_impl.h>
+#endif
+
+#include "vmmapi.h"
+
+#define	MB	(1024 * 1024UL)
+#define	GB	(1024 * 1024 * 1024UL)
+
+#ifndef __FreeBSD__
+/* shim to no-op for now */
+#define MAP_NOCORE 0
+#define MAP_ALIGNED_SUPER 0
+#endif
+
+/*
+ * Size of the guard region before and after the virtual address space
+ * mapping the guest physical memory. This must be a multiple of the
+ * superpage size for performance reasons.
+ */
+#define	VM_MMAP_GUARD_SIZE	(4 * MB)
+
+#define	PROT_RW		(PROT_READ | PROT_WRITE)
+#define	PROT_ALL	(PROT_READ | PROT_WRITE | PROT_EXEC)
+
+struct vmctx {
+	int	fd;
+	uint32_t lowmem_limit;
+	int	memflags;
+	size_t	lowmem;
+	size_t	highmem;
+	char	*baseaddr;
+	char	*name;
+};
+
+#ifdef	__FreeBSD__
+#define	CREATE(x)  sysctlbyname("hw.vmm.create", NULL, NULL, (x), strlen((x)))
+#define	DESTROY(x) sysctlbyname("hw.vmm.destroy", NULL, NULL, (x), strlen((x)))
+#else
+#define	CREATE(x)	vm_do_ctl(VMM_CREATE_VM, (x))
+#define	DESTROY(x)	vm_do_ctl(VMM_DESTROY_VM, (x))
+
+static int
+vm_do_ctl(int cmd, const char *name)
+{
+	int ctl_fd;
+
+	ctl_fd = open(VMM_CTL_DEV, O_EXCL | O_RDWR);
+	if (ctl_fd < 0) {
+		return (-1);
+	}
+
+	if (ioctl(ctl_fd, cmd, name) == -1) {
+		int err = errno;
+
+		/* Do not lose ioctl errno through the close(2) */
+		(void) close(ctl_fd);
+		errno = err;
+		return (-1);
+	}
+	(void) close(ctl_fd);
+
+	return (0);
+}
+#endif
+
+static int
+vm_device_open(const char *name)
+{
+        int fd, len;
+        char *vmfile;
+
+	len = strlen("/dev/vmm/") + strlen(name) + 1;
+	vmfile = malloc(len);
+	assert(vmfile != NULL);
+	snprintf(vmfile, len, "/dev/vmm/%s", name);
+
+        /* Open the device file */
+        fd = open(vmfile, O_RDWR, 0);
+
+	free(vmfile);
+        return (fd);
+}
+
+int
+vm_create(const char *name)
+{
+
+	return (CREATE((char *)name));
+}
+
+struct vmctx *
+vm_open(const char *name)
+{
+	struct vmctx *vm;
+
+	vm = malloc(sizeof(struct vmctx) + strlen(name) + 1);
+	assert(vm != NULL);
+
+	vm->fd = -1;
+	vm->memflags = 0;
+	vm->lowmem_limit = 3 * GB;
+	vm->name = (char *)(vm + 1);
+	strcpy(vm->name, name);
+
+	if ((vm->fd = vm_device_open(vm->name)) < 0)
+		goto err;
+
+	return (vm);
+err:
+	vm_destroy(vm);
+	return (NULL);
+}
+
+void
+vm_destroy(struct vmctx *vm)
+{
+	assert(vm != NULL);
+
+	if (vm->fd >= 0)
+		close(vm->fd);
+	DESTROY(vm->name);
+
+	free(vm);
+}
+
+int
+vm_parse_memsize(const char *optarg, size_t *ret_memsize)
+{
+	char *endptr;
+	size_t optval;
+	int error;
+
+	optval = strtoul(optarg, &endptr, 0);
+	if (*optarg != '\0' && *endptr == '\0') {
+		/*
+		 * For the sake of backward compatibility if the memory size
+		 * specified on the command line is less than a megabyte then
+		 * it is interpreted as being in units of MB.
+		 */
+		if (optval < MB)
+			optval *= MB;
+		*ret_memsize = optval;
+		error = 0;
+	} else
+		error = expand_number(optarg, ret_memsize);
+
+	return (error);
+}
+
+uint32_t
+vm_get_lowmem_limit(struct vmctx *ctx)
+{
+
+	return (ctx->lowmem_limit);
+}
+
+void
+vm_set_lowmem_limit(struct vmctx *ctx, uint32_t limit)
+{
+
+	ctx->lowmem_limit = limit;
+}
+
+void
+vm_set_memflags(struct vmctx *ctx, int flags)
+{
+
+	ctx->memflags = flags;
+}
+
+int
+vm_get_memflags(struct vmctx *ctx)
+{
+
+	return (ctx->memflags);
+}
+
+/*
+ * Map segment 'segid' starting at 'off' into guest address range [gpa,gpa+len).
+ */
+int
+vm_mmap_memseg(struct vmctx *ctx, vm_paddr_t gpa, int segid, vm_ooffset_t off,
+    size_t len, int prot)
+{
+	struct vm_memmap memmap;
+	int error, flags;
+
+	memmap.gpa = gpa;
+	memmap.segid = segid;
+	memmap.segoff = off;
+	memmap.len = len;
+	memmap.prot = prot;
+	memmap.flags = 0;
+
+	if (ctx->memflags & VM_MEM_F_WIRED)
+		memmap.flags |= VM_MEMMAP_F_WIRED;
+
+	/*
+	 * If this mapping already exists then don't create it again. This
+	 * is the common case for SYSMEM mappings created by bhyveload(8).
+	 */
+	error = vm_mmap_getnext(ctx, &gpa, &segid, &off, &len, &prot, &flags);
+	if (error == 0 && gpa == memmap.gpa) {
+		if (segid != memmap.segid || off != memmap.segoff ||
+		    prot != memmap.prot || flags != memmap.flags) {
+			errno = EEXIST;
+			return (-1);
+		} else {
+			return (0);
+		}
+	}
+
+	error = ioctl(ctx->fd, VM_MMAP_MEMSEG, &memmap);
+	return (error);
+}
+
+int
+vm_mmap_getnext(struct vmctx *ctx, vm_paddr_t *gpa, int *segid,
+    vm_ooffset_t *segoff, size_t *len, int *prot, int *flags)
+{
+	struct vm_memmap memmap;
+	int error;
+
+	bzero(&memmap, sizeof(struct vm_memmap));
+	memmap.gpa = *gpa;
+	error = ioctl(ctx->fd, VM_MMAP_GETNEXT, &memmap);
+	if (error == 0) {
+		*gpa = memmap.gpa;
+		*segid = memmap.segid;
+		*segoff = memmap.segoff;
+		*len = memmap.len;
+		*prot = memmap.prot;
+		*flags = memmap.flags;
+	}
+	return (error);
+}
+
+/*
+ * Return 0 if the segments are identical and non-zero otherwise.
+ *
+ * This is slightly complicated by the fact that only device memory segments
+ * are named.
+ */
+static int
+cmpseg(size_t len, const char *str, size_t len2, const char *str2)
+{
+
+	if (len == len2) {
+		if ((!str && !str2) || (str && str2 && !strcmp(str, str2)))
+			return (0);
+	}
+	return (-1);
+}
+
+static int
+vm_alloc_memseg(struct vmctx *ctx, int segid, size_t len, const char *name)
+{
+	struct vm_memseg memseg;
+	size_t n;
+	int error;
+
+	/*
+	 * If the memory segment has already been created then just return.
+	 * This is the usual case for the SYSMEM segment created by userspace
+	 * loaders like bhyveload(8).
+	 */
+	error = vm_get_memseg(ctx, segid, &memseg.len, memseg.name,
+	    sizeof(memseg.name));
+	if (error)
+		return (error);
+
+	if (memseg.len != 0) {
+		if (cmpseg(len, name, memseg.len, VM_MEMSEG_NAME(&memseg))) {
+			errno = EINVAL;
+			return (-1);
+		} else {
+			return (0);
+		}
+	}
+
+	bzero(&memseg, sizeof(struct vm_memseg));
+	memseg.segid = segid;
+	memseg.len = len;
+	if (name != NULL) {
+		n = strlcpy(memseg.name, name, sizeof(memseg.name));
+		if (n >= sizeof(memseg.name)) {
+			errno = ENAMETOOLONG;
+			return (-1);
+		}
+	}
+
+	error = ioctl(ctx->fd, VM_ALLOC_MEMSEG, &memseg);
+	return (error);
+}
+
+int
+vm_get_memseg(struct vmctx *ctx, int segid, size_t *lenp, char *namebuf,
+    size_t bufsize)
+{
+	struct vm_memseg memseg;
+	size_t n;
+	int error;
+
+	memseg.segid = segid;
+	error = ioctl(ctx->fd, VM_GET_MEMSEG, &memseg);
+	if (error == 0) {
+		*lenp = memseg.len;
+		n = strlcpy(namebuf, memseg.name, bufsize);
+		if (n >= bufsize) {
+			errno = ENAMETOOLONG;
+			error = -1;
+		}
+	}
+	return (error);
+}
+
+static int
+#ifdef __FreeBSD__
+setup_memory_segment(struct vmctx *ctx, vm_paddr_t gpa, size_t len, char *base)
+#else
+setup_memory_segment(struct vmctx *ctx, int segid, vm_paddr_t gpa, size_t len,
+    char *base)
+#endif
+{
+	char *ptr;
+	int error, flags;
+
+	/* Map 'len' bytes starting at 'gpa' in the guest address space */
+#ifdef __FreeBSD__
+	error = vm_mmap_memseg(ctx, gpa, VM_SYSMEM, gpa, len, PROT_ALL);
+#else
+	/*
+	 * As we use two segments for lowmem/highmem the offset within the
+	 * segment is 0 on illumos.
+	 */
+	error = vm_mmap_memseg(ctx, gpa, segid, 0, len, PROT_ALL);
+#endif
+	if (error)
+		return (error);
+
+	flags = MAP_SHARED | MAP_FIXED;
+	if ((ctx->memflags & VM_MEM_F_INCORE) == 0)
+		flags |= MAP_NOCORE;
+
+	/* mmap into the process address space on the host */
+	ptr = mmap(base + gpa, len, PROT_RW, flags, ctx->fd, gpa);
+	if (ptr == MAP_FAILED)
+		return (-1);
+
+	return (0);
+}
+
+int
+vm_setup_memory(struct vmctx *ctx, size_t memsize, enum vm_mmap_style vms)
+{
+	size_t objsize, len;
+	vm_paddr_t gpa;
+	char *baseaddr, *ptr;
+	int error, flags;
+
+	assert(vms == VM_MMAP_ALL);
+
+	/*
+	 * If 'memsize' cannot fit entirely in the 'lowmem' segment then
+	 * create another 'highmem' segment above 4GB for the remainder.
+	 */
+	if (memsize > ctx->lowmem_limit) {
+		ctx->lowmem = ctx->lowmem_limit;
+		ctx->highmem = memsize - ctx->lowmem_limit;
+		objsize = 4*GB + ctx->highmem;
+	} else {
+		ctx->lowmem = memsize;
+		ctx->highmem = 0;
+		objsize = ctx->lowmem;
+	}
+
+#ifdef __FreeBSD__
+	error = vm_alloc_memseg(ctx, VM_SYSMEM, objsize, NULL);
+	if (error)
+		return (error);
+#endif
+
+	/*
+	 * Stake out a contiguous region covering the guest physical memory
+	 * and the adjoining guard regions.
+	 */
+	len = VM_MMAP_GUARD_SIZE + objsize + VM_MMAP_GUARD_SIZE;
+	flags = MAP_PRIVATE | MAP_ANON | MAP_NOCORE | MAP_ALIGNED_SUPER;
+#ifndef __FreeBSD__
+	/*
+	 * There is no need to reserve swap for the guest physical memory and
+	 * guard regions. Actual memory is allocated and mapped later through
+	 * vm_alloc_memseg() and setup_memory_segment().
+	 */
+	flags |= MAP_NORESERVE;
+#endif
+	ptr = mmap(NULL, len, PROT_NONE, flags, -1, 0);
+	if (ptr == MAP_FAILED)
+		return (-1);
+
+	baseaddr = ptr + VM_MMAP_GUARD_SIZE;
+
+#ifdef __FreeBSD__
+	if (ctx->highmem > 0) {
+		gpa = 4*GB;
+		len = ctx->highmem;
+		error = setup_memory_segment(ctx, gpa, len, baseaddr);
+		if (error)
+			return (error);
+	}
+
+	if (ctx->lowmem > 0) {
+		gpa = 0;
+		len = ctx->lowmem;
+		error = setup_memory_segment(ctx, gpa, len, baseaddr);
+		if (error)
+			return (error);
+	}
+#else
+	if (ctx->highmem > 0) {
+		error = vm_alloc_memseg(ctx, VM_HIGHMEM, ctx->highmem, NULL);
+		if (error)
+			return (error);
+		gpa = 4*GB;
+		len = ctx->highmem;
+		error = setup_memory_segment(ctx, VM_HIGHMEM, gpa, len, baseaddr);
+		if (error)
+			return (error);
+	}
+
+	if (ctx->lowmem > 0) {
+		error = vm_alloc_memseg(ctx, VM_LOWMEM, ctx->lowmem, NULL);
+		if (error)
+			return (error);
+		gpa = 0;
+		len = ctx->lowmem;
+		error = setup_memory_segment(ctx, VM_LOWMEM, gpa, len, baseaddr);
+		if (error)
+			return (error);
+	}
+#endif
+
+	ctx->baseaddr = baseaddr;
+
+	return (0);
+}
+
+/*
+ * Returns a non-NULL pointer if [gaddr, gaddr+len) is entirely contained in
+ * the lowmem or highmem regions.
+ *
+ * In particular return NULL if [gaddr, gaddr+len) falls in guest MMIO region.
+ * The instruction emulation code depends on this behavior.
+ */
+void *
+vm_map_gpa(struct vmctx *ctx, vm_paddr_t gaddr, size_t len)
+{
+
+	if (ctx->lowmem > 0) {
+		if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
+		    gaddr + len <= ctx->lowmem)
+			return (ctx->baseaddr + gaddr);
+	}
+
+	if (ctx->highmem > 0) {
+                if (gaddr >= 4*GB) {
+			if (gaddr < 4*GB + ctx->highmem &&
+			    len <= ctx->highmem &&
+			    gaddr + len <= 4*GB + ctx->highmem)
+				return (ctx->baseaddr + gaddr);
+		}
+	}
+
+	return (NULL);
+}
+
+size_t
+vm_get_lowmem_size(struct vmctx *ctx)
+{
+
+	return (ctx->lowmem);
+}
+
+size_t
+vm_get_highmem_size(struct vmctx *ctx)
+{
+
+	return (ctx->highmem);
+}
+
+void *
+vm_create_devmem(struct vmctx *ctx, int segid, const char *name, size_t len)
+{
+#ifdef	__FreeBSD__
+	char pathname[MAXPATHLEN];
+#endif
+	size_t len2;
+	char *base, *ptr;
+	int fd, error, flags;
+	off_t mapoff;
+
+	fd = -1;
+	ptr = MAP_FAILED;
+	if (name == NULL || strlen(name) == 0) {
+		errno = EINVAL;
+		goto done;
+	}
+
+	error = vm_alloc_memseg(ctx, segid, len, name);
+	if (error)
+		goto done;
+
+#ifdef	__FreeBSD__
+	strlcpy(pathname, "/dev/vmm.io/", sizeof(pathname));
+	strlcat(pathname, ctx->name, sizeof(pathname));
+	strlcat(pathname, ".", sizeof(pathname));
+	strlcat(pathname, name, sizeof(pathname));
+
+	fd = open(pathname, O_RDWR);
+	if (fd < 0)
+		goto done;
+#else
+	{
+		struct vm_devmem_offset vdo;
+
+		vdo.segid = segid;
+		error = ioctl(ctx->fd, VM_DEVMEM_GETOFFSET, &vdo);
+		if (error == 0) {
+			mapoff = vdo.offset;
+		} else {
+			goto done;
+		}
+	}
+#endif
+
+	/*
+	 * Stake out a contiguous region covering the device memory and the
+	 * adjoining guard regions.
+	 */
+	len2 = VM_MMAP_GUARD_SIZE + len + VM_MMAP_GUARD_SIZE;
+	flags = MAP_PRIVATE | MAP_ANON | MAP_NOCORE | MAP_ALIGNED_SUPER;
+	base = mmap(NULL, len2, PROT_NONE, flags, -1, 0);
+	if (base == MAP_FAILED)
+		goto done;
+
+	flags = MAP_SHARED | MAP_FIXED;
+	if ((ctx->memflags & VM_MEM_F_INCORE) == 0)
+		flags |= MAP_NOCORE;
+
+#ifdef	__FreeBSD__
+	/* mmap the devmem region in the host address space */
+	ptr = mmap(base + VM_MMAP_GUARD_SIZE, len, PROT_RW, flags, fd, 0);
+#else
+	/* mmap the devmem region in the host address space */
+	ptr = mmap(base + VM_MMAP_GUARD_SIZE, len, PROT_RW, flags, ctx->fd,
+	    mapoff);
+#endif
+done:
+	if (fd >= 0)
+		close(fd);
+	return (ptr);
+}
+
+int
+vm_set_desc(struct vmctx *ctx, int vcpu, int reg,
+	    uint64_t base, uint32_t limit, uint32_t access)
+{
+	int error;
+	struct vm_seg_desc vmsegdesc;
+
+	bzero(&vmsegdesc, sizeof(vmsegdesc));
+	vmsegdesc.cpuid = vcpu;
+	vmsegdesc.regnum = reg;
+	vmsegdesc.desc.base = base;
+	vmsegdesc.desc.limit = limit;
+	vmsegdesc.desc.access = access;
+
+	error = ioctl(ctx->fd, VM_SET_SEGMENT_DESCRIPTOR, &vmsegdesc);
+	return (error);
+}
+
+int
+vm_get_desc(struct vmctx *ctx, int vcpu, int reg,
+	    uint64_t *base, uint32_t *limit, uint32_t *access)
+{
+	int error;
+	struct vm_seg_desc vmsegdesc;
+
+	bzero(&vmsegdesc, sizeof(vmsegdesc));
+	vmsegdesc.cpuid = vcpu;
+	vmsegdesc.regnum = reg;
+
+	error = ioctl(ctx->fd, VM_GET_SEGMENT_DESCRIPTOR, &vmsegdesc);
+	if (error == 0) {
+		*base = vmsegdesc.desc.base;
+		*limit = vmsegdesc.desc.limit;
+		*access = vmsegdesc.desc.access;
+	}
+	return (error);
+}
+
+int
+vm_get_seg_desc(struct vmctx *ctx, int vcpu, int reg, struct seg_desc *seg_desc)
+{
+	int error;
+
+	error = vm_get_desc(ctx, vcpu, reg, &seg_desc->base, &seg_desc->limit,
+	    &seg_desc->access);
+	return (error);
+}
+
+int
+vm_set_register(struct vmctx *ctx, int vcpu, int reg, uint64_t val)
+{
+	int error;
+	struct vm_register vmreg;
+
+	bzero(&vmreg, sizeof(vmreg));
+	vmreg.cpuid = vcpu;
+	vmreg.regnum = reg;
+	vmreg.regval = val;
+
+	error = ioctl(ctx->fd, VM_SET_REGISTER, &vmreg);
+	return (error);
+}
+
+int
+vm_get_register(struct vmctx *ctx, int vcpu, int reg, uint64_t *ret_val)
+{
+	int error;
+	struct vm_register vmreg;
+
+	bzero(&vmreg, sizeof(vmreg));
+	vmreg.cpuid = vcpu;
+	vmreg.regnum = reg;
+
+	error = ioctl(ctx->fd, VM_GET_REGISTER, &vmreg);
+	*ret_val = vmreg.regval;
+	return (error);
+}
+
+int
+vm_set_register_set(struct vmctx *ctx, int vcpu, unsigned int count,
+    const int *regnums, uint64_t *regvals)
+{
+	int error;
+	struct vm_register_set vmregset;
+
+	bzero(&vmregset, sizeof(vmregset));
+	vmregset.cpuid = vcpu;
+	vmregset.count = count;
+	vmregset.regnums = regnums;
+	vmregset.regvals = regvals;
+
+	error = ioctl(ctx->fd, VM_SET_REGISTER_SET, &vmregset);
+	return (error);
+}
+
+int
+vm_get_register_set(struct vmctx *ctx, int vcpu, unsigned int count,
+    const int *regnums, uint64_t *regvals)
+{
+	int error;
+	struct vm_register_set vmregset;
+
+	bzero(&vmregset, sizeof(vmregset));
+	vmregset.cpuid = vcpu;
+	vmregset.count = count;
+	vmregset.regnums = regnums;
+	vmregset.regvals = regvals;
+
+	error = ioctl(ctx->fd, VM_GET_REGISTER_SET, &vmregset);
+	return (error);
+}
+
+int
+vm_run(struct vmctx *ctx, int vcpu, struct vm_exit *vmexit)
+{
+	int error;
+	struct vm_run vmrun;
+
+	bzero(&vmrun, sizeof(vmrun));
+	vmrun.cpuid = vcpu;
+
+	error = ioctl(ctx->fd, VM_RUN, &vmrun);
+	bcopy(&vmrun.vm_exit, vmexit, sizeof(struct vm_exit));
+	return (error);
+}
+
+int
+vm_suspend(struct vmctx *ctx, enum vm_suspend_how how)
+{
+	struct vm_suspend vmsuspend;
+
+	bzero(&vmsuspend, sizeof(vmsuspend));
+	vmsuspend.how = how;
+	return (ioctl(ctx->fd, VM_SUSPEND, &vmsuspend));
+}
+
+int
+vm_reinit(struct vmctx *ctx)
+{
+
+	return (ioctl(ctx->fd, VM_REINIT, 0));
+}
+
+int
+vm_inject_exception(struct vmctx *ctx, int vcpu, int vector, int errcode_valid,
+    uint32_t errcode, int restart_instruction)
+{
+	struct vm_exception exc;
+
+	exc.cpuid = vcpu;
+	exc.vector = vector;
+	exc.error_code = errcode;
+	exc.error_code_valid = errcode_valid;
+	exc.restart_instruction = restart_instruction;
+
+	return (ioctl(ctx->fd, VM_INJECT_EXCEPTION, &exc));
+}
+
+int
+vm_apicid2vcpu(struct vmctx *ctx, int apicid)
+{
+	/*
+	 * The apic id associated with the 'vcpu' has the same numerical value
+	 * as the 'vcpu' itself.
+	 */
+	return (apicid);
+}
+
+int
+vm_lapic_irq(struct vmctx *ctx, int vcpu, int vector)
+{
+	struct vm_lapic_irq vmirq;
+
+	bzero(&vmirq, sizeof(vmirq));
+	vmirq.cpuid = vcpu;
+	vmirq.vector = vector;
+
+	return (ioctl(ctx->fd, VM_LAPIC_IRQ, &vmirq));
+}
+
+int
+vm_lapic_local_irq(struct vmctx *ctx, int vcpu, int vector)
+{
+	struct vm_lapic_irq vmirq;
+
+	bzero(&vmirq, sizeof(vmirq));
+	vmirq.cpuid = vcpu;
+	vmirq.vector = vector;
+
+	return (ioctl(ctx->fd, VM_LAPIC_LOCAL_IRQ, &vmirq));
+}
+
+int
+vm_lapic_msi(struct vmctx *ctx, uint64_t addr, uint64_t msg)
+{
+	struct vm_lapic_msi vmmsi;
+
+	bzero(&vmmsi, sizeof(vmmsi));
+	vmmsi.addr = addr;
+	vmmsi.msg = msg;
+
+	return (ioctl(ctx->fd, VM_LAPIC_MSI, &vmmsi));
+}
+
+int
+vm_ioapic_assert_irq(struct vmctx *ctx, int irq)
+{
+	struct vm_ioapic_irq ioapic_irq;
+
+	bzero(&ioapic_irq, sizeof(struct vm_ioapic_irq));
+	ioapic_irq.irq = irq;
+
+	return (ioctl(ctx->fd, VM_IOAPIC_ASSERT_IRQ, &ioapic_irq));
+}
+
+int
+vm_ioapic_deassert_irq(struct vmctx *ctx, int irq)
+{
+	struct vm_ioapic_irq ioapic_irq;
+
+	bzero(&ioapic_irq, sizeof(struct vm_ioapic_irq));
+	ioapic_irq.irq = irq;
+
+	return (ioctl(ctx->fd, VM_IOAPIC_DEASSERT_IRQ, &ioapic_irq));
+}
+
+int
+vm_ioapic_pulse_irq(struct vmctx *ctx, int irq)
+{
+	struct vm_ioapic_irq ioapic_irq;
+
+	bzero(&ioapic_irq, sizeof(struct vm_ioapic_irq));
+	ioapic_irq.irq = irq;
+
+	return (ioctl(ctx->fd, VM_IOAPIC_PULSE_IRQ, &ioapic_irq));
+}
+
+int
+vm_ioapic_pincount(struct vmctx *ctx, int *pincount)
+{
+
+	return (ioctl(ctx->fd, VM_IOAPIC_PINCOUNT, pincount));
+}
+
+int
+vm_isa_assert_irq(struct vmctx *ctx, int atpic_irq, int ioapic_irq)
+{
+	struct vm_isa_irq isa_irq;
+
+	bzero(&isa_irq, sizeof(struct vm_isa_irq));
+	isa_irq.atpic_irq = atpic_irq;
+	isa_irq.ioapic_irq = ioapic_irq;
+
+	return (ioctl(ctx->fd, VM_ISA_ASSERT_IRQ, &isa_irq));
+}
+
+int
+vm_isa_deassert_irq(struct vmctx *ctx, int atpic_irq, int ioapic_irq)
+{
+	struct vm_isa_irq isa_irq;
+
+	bzero(&isa_irq, sizeof(struct vm_isa_irq));
+	isa_irq.atpic_irq = atpic_irq;
+	isa_irq.ioapic_irq = ioapic_irq;
+
+	return (ioctl(ctx->fd, VM_ISA_DEASSERT_IRQ, &isa_irq));
+}
+
+int
+vm_isa_pulse_irq(struct vmctx *ctx, int atpic_irq, int ioapic_irq)
+{
+	struct vm_isa_irq isa_irq;
+
+	bzero(&isa_irq, sizeof(struct vm_isa_irq));
+	isa_irq.atpic_irq = atpic_irq;
+	isa_irq.ioapic_irq = ioapic_irq;
+
+	return (ioctl(ctx->fd, VM_ISA_PULSE_IRQ, &isa_irq));
+}
+
+int
+vm_isa_set_irq_trigger(struct vmctx *ctx, int atpic_irq,
+    enum vm_intr_trigger trigger)
+{
+	struct vm_isa_irq_trigger isa_irq_trigger;
+
+	bzero(&isa_irq_trigger, sizeof(struct vm_isa_irq_trigger));
+	isa_irq_trigger.atpic_irq = atpic_irq;
+	isa_irq_trigger.trigger = trigger;
+
+	return (ioctl(ctx->fd, VM_ISA_SET_IRQ_TRIGGER, &isa_irq_trigger));
+}
+
+int
+vm_inject_nmi(struct vmctx *ctx, int vcpu)
+{
+	struct vm_nmi vmnmi;
+
+	bzero(&vmnmi, sizeof(vmnmi));
+	vmnmi.cpuid = vcpu;
+
+	return (ioctl(ctx->fd, VM_INJECT_NMI, &vmnmi));
+}
+
+static struct {
+	const char	*name;
+	int		type;
+} capstrmap[] = {
+	{ "hlt_exit",		VM_CAP_HALT_EXIT },
+	{ "mtrap_exit",		VM_CAP_MTRAP_EXIT },
+	{ "pause_exit",		VM_CAP_PAUSE_EXIT },
+	{ "unrestricted_guest",	VM_CAP_UNRESTRICTED_GUEST },
+	{ "enable_invpcid",	VM_CAP_ENABLE_INVPCID },
+	{ 0 }
+};
+
+int
+vm_capability_name2type(const char *capname)
+{
+	int i;
+
+	for (i = 0; capstrmap[i].name != NULL && capname != NULL; i++) {
+		if (strcmp(capstrmap[i].name, capname) == 0)
+			return (capstrmap[i].type);
+	}
+
+	return (-1);
+}
+
+const char *
+vm_capability_type2name(int type)
+{
+	int i;
+
+	for (i = 0; capstrmap[i].name != NULL; i++) {
+		if (capstrmap[i].type == type)
+			return (capstrmap[i].name);
+	}
+
+	return (NULL);
+}
+
+int
+vm_get_capability(struct vmctx *ctx, int vcpu, enum vm_cap_type cap,
+		  int *retval)
+{
+	int error;
+	struct vm_capability vmcap;
+
+	bzero(&vmcap, sizeof(vmcap));
+	vmcap.cpuid = vcpu;
+	vmcap.captype = cap;
+
+	error = ioctl(ctx->fd, VM_GET_CAPABILITY, &vmcap);
+	*retval = vmcap.capval;
+	return (error);
+}
+
+int
+vm_set_capability(struct vmctx *ctx, int vcpu, enum vm_cap_type cap, int val)
+{
+	struct vm_capability vmcap;
+
+	bzero(&vmcap, sizeof(vmcap));
+	vmcap.cpuid = vcpu;
+	vmcap.captype = cap;
+	vmcap.capval = val;
+	
+	return (ioctl(ctx->fd, VM_SET_CAPABILITY, &vmcap));
+}
+
+#ifdef __FreeBSD__
+int
+vm_assign_pptdev(struct vmctx *ctx, int bus, int slot, int func)
+{
+	struct vm_pptdev pptdev;
+
+	bzero(&pptdev, sizeof(pptdev));
+	pptdev.bus = bus;
+	pptdev.slot = slot;
+	pptdev.func = func;
+
+	return (ioctl(ctx->fd, VM_BIND_PPTDEV, &pptdev));
+}
+
+int
+vm_unassign_pptdev(struct vmctx *ctx, int bus, int slot, int func)
+{
+	struct vm_pptdev pptdev;
+
+	bzero(&pptdev, sizeof(pptdev));
+	pptdev.bus = bus;
+	pptdev.slot = slot;
+	pptdev.func = func;
+
+	return (ioctl(ctx->fd, VM_UNBIND_PPTDEV, &pptdev));
+}
+
+int
+vm_map_pptdev_mmio(struct vmctx *ctx, int bus, int slot, int func,
+		   vm_paddr_t gpa, size_t len, vm_paddr_t hpa)
+{
+	struct vm_pptdev_mmio pptmmio;
+
+	bzero(&pptmmio, sizeof(pptmmio));
+	pptmmio.bus = bus;
+	pptmmio.slot = slot;
+	pptmmio.func = func;
+	pptmmio.gpa = gpa;
+	pptmmio.len = len;
+	pptmmio.hpa = hpa;
+
+	return (ioctl(ctx->fd, VM_MAP_PPTDEV_MMIO, &pptmmio));
+}
+
+int
+vm_setup_pptdev_msi(struct vmctx *ctx, int vcpu, int bus, int slot, int func,
+    uint64_t addr, uint64_t msg, int numvec)
+{
+	struct vm_pptdev_msi pptmsi;
+
+	bzero(&pptmsi, sizeof(pptmsi));
+	pptmsi.vcpu = vcpu;
+	pptmsi.bus = bus;
+	pptmsi.slot = slot;
+	pptmsi.func = func;
+	pptmsi.msg = msg;
+	pptmsi.addr = addr;
+	pptmsi.numvec = numvec;
+
+	return (ioctl(ctx->fd, VM_PPTDEV_MSI, &pptmsi));
+}
+
+int
+vm_setup_pptdev_msix(struct vmctx *ctx, int vcpu, int bus, int slot, int func,
+    int idx, uint64_t addr, uint64_t msg, uint32_t vector_control)
+{
+	struct vm_pptdev_msix pptmsix;
+
+	bzero(&pptmsix, sizeof(pptmsix));
+	pptmsix.vcpu = vcpu;
+	pptmsix.bus = bus;
+	pptmsix.slot = slot;
+	pptmsix.func = func;
+	pptmsix.idx = idx;
+	pptmsix.msg = msg;
+	pptmsix.addr = addr;
+	pptmsix.vector_control = vector_control;
+
+	return ioctl(ctx->fd, VM_PPTDEV_MSIX, &pptmsix);
+}
+
+int
+vm_get_pptdev_limits(struct vmctx *ctx, int bus, int slot, int func,
+    int *msi_limit, int *msix_limit)
+{
+	struct vm_pptdev_limits pptlimits;
+	int error;
+
+	bzero(&pptlimits, sizeof (pptlimits));
+	pptlimits.bus = bus;
+	pptlimits.slot = slot;
+	pptlimits.func = func;
+
+	error = ioctl(ctx->fd, VM_GET_PPTDEV_LIMITS, &pptlimits);
+
+	*msi_limit = pptlimits.msi_limit;
+	*msix_limit = pptlimits.msix_limit;
+
+	return (error);
+}
+#else /* __FreeBSD__ */
+int
+vm_assign_pptdev(struct vmctx *ctx, int pptfd)
+{
+	struct vm_pptdev pptdev;
+
+	pptdev.pptfd = pptfd;
+	return (ioctl(ctx->fd, VM_BIND_PPTDEV, &pptdev));
+}
+
+int
+vm_unassign_pptdev(struct vmctx *ctx, int pptfd)
+{
+	struct vm_pptdev pptdev;
+
+	pptdev.pptfd = pptfd;
+	return (ioctl(ctx->fd, VM_UNBIND_PPTDEV, &pptdev));
+}
+
+int
+vm_map_pptdev_mmio(struct vmctx *ctx, int pptfd, vm_paddr_t gpa, size_t len,
+    vm_paddr_t hpa)
+{
+	struct vm_pptdev_mmio pptmmio;
+
+	pptmmio.pptfd = pptfd;
+	pptmmio.gpa = gpa;
+	pptmmio.len = len;
+	pptmmio.hpa = hpa;
+	return (ioctl(ctx->fd, VM_MAP_PPTDEV_MMIO, &pptmmio));
+}
+
+int
+vm_setup_pptdev_msi(struct vmctx *ctx, int vcpu, int pptfd, uint64_t addr,
+    uint64_t msg, int numvec)
+{
+	struct vm_pptdev_msi pptmsi;
+
+	pptmsi.vcpu = vcpu;
+	pptmsi.pptfd = pptfd;
+	pptmsi.msg = msg;
+	pptmsi.addr = addr;
+	pptmsi.numvec = numvec;
+	return (ioctl(ctx->fd, VM_PPTDEV_MSI, &pptmsi));
+}
+
+int
+vm_setup_pptdev_msix(struct vmctx *ctx, int vcpu, int pptfd, int idx,
+    uint64_t addr, uint64_t msg, uint32_t vector_control)
+{
+	struct vm_pptdev_msix pptmsix;
+
+	pptmsix.vcpu = vcpu;
+	pptmsix.pptfd = pptfd;
+	pptmsix.idx = idx;
+	pptmsix.msg = msg;
+	pptmsix.addr = addr;
+	pptmsix.vector_control = vector_control;
+	return ioctl(ctx->fd, VM_PPTDEV_MSIX, &pptmsix);
+}
+
+int
+vm_get_pptdev_limits(struct vmctx *ctx, int pptfd, int *msi_limit,
+    int *msix_limit)
+{
+	struct vm_pptdev_limits pptlimits;
+	int error;
+
+	bzero(&pptlimits, sizeof (pptlimits));
+	pptlimits.pptfd = pptfd;
+	error = ioctl(ctx->fd, VM_GET_PPTDEV_LIMITS, &pptlimits);
+
+	*msi_limit = pptlimits.msi_limit;
+	*msix_limit = pptlimits.msix_limit;
+	return (error);
+}
+#endif /* __FreeBSD__ */
+
+uint64_t *
+vm_get_stats(struct vmctx *ctx, int vcpu, struct timeval *ret_tv,
+	     int *ret_entries)
+{
+	int error;
+
+	static struct vm_stats vmstats;
+
+	vmstats.cpuid = vcpu;
+
+	error = ioctl(ctx->fd, VM_STATS_IOC, &vmstats);
+	if (error == 0) {
+		if (ret_entries)
+			*ret_entries = vmstats.num_entries;
+		if (ret_tv)
+			*ret_tv = vmstats.tv;
+		return (vmstats.statbuf);
+	} else
+		return (NULL);
+}
+
+const char *
+vm_get_stat_desc(struct vmctx *ctx, int index)
+{
+	static struct vm_stat_desc statdesc;
+
+	statdesc.index = index;
+	if (ioctl(ctx->fd, VM_STAT_DESC, &statdesc) == 0)
+		return (statdesc.desc);
+	else
+		return (NULL);
+}
+
+int
+vm_get_x2apic_state(struct vmctx *ctx, int vcpu, enum x2apic_state *state)
+{
+	int error;
+	struct vm_x2apic x2apic;
+
+	bzero(&x2apic, sizeof(x2apic));
+	x2apic.cpuid = vcpu;
+
+	error = ioctl(ctx->fd, VM_GET_X2APIC_STATE, &x2apic);
+	*state = x2apic.state;
+	return (error);
+}
+
+int
+vm_set_x2apic_state(struct vmctx *ctx, int vcpu, enum x2apic_state state)
+{
+	int error;
+	struct vm_x2apic x2apic;
+
+	bzero(&x2apic, sizeof(x2apic));
+	x2apic.cpuid = vcpu;
+	x2apic.state = state;
+
+	error = ioctl(ctx->fd, VM_SET_X2APIC_STATE, &x2apic);
+
+	return (error);
+}
+
+/*
+ * From Intel Vol 3a:
+ * Table 9-1. IA-32 Processor States Following Power-up, Reset or INIT
+ */
+int
+vcpu_reset(struct vmctx *vmctx, int vcpu)
+{
+	int error;
+	uint64_t rflags, rip, cr0, cr4, zero, desc_base, rdx;
+	uint32_t desc_access, desc_limit;
+	uint16_t sel;
+
+	zero = 0;
+
+	rflags = 0x2;
+	error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RFLAGS, rflags);
+	if (error)
+		goto done;
+
+	rip = 0xfff0;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RIP, rip)) != 0)
+		goto done;
+
+	cr0 = CR0_NE;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_CR0, cr0)) != 0)
+		goto done;
+
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_CR3, zero)) != 0)
+		goto done;
+	
+	cr4 = 0;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_CR4, cr4)) != 0)
+		goto done;
+
+	/*
+	 * CS: present, r/w, accessed, 16-bit, byte granularity, usable
+	 */
+	desc_base = 0xffff0000;
+	desc_limit = 0xffff;
+	desc_access = 0x0093;
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_CS,
+			    desc_base, desc_limit, desc_access);
+	if (error)
+		goto done;
+
+	sel = 0xf000;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_CS, sel)) != 0)
+		goto done;
+
+	/*
+	 * SS,DS,ES,FS,GS: present, r/w, accessed, 16-bit, byte granularity
+	 */
+	desc_base = 0;
+	desc_limit = 0xffff;
+	desc_access = 0x0093;
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_SS,
+			    desc_base, desc_limit, desc_access);
+	if (error)
+		goto done;
+
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_DS,
+			    desc_base, desc_limit, desc_access);
+	if (error)
+		goto done;
+
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_ES,
+			    desc_base, desc_limit, desc_access);
+	if (error)
+		goto done;
+
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_FS,
+			    desc_base, desc_limit, desc_access);
+	if (error)
+		goto done;
+
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_GS,
+			    desc_base, desc_limit, desc_access);
+	if (error)
+		goto done;
+
+	sel = 0;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_SS, sel)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_DS, sel)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_ES, sel)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_FS, sel)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_GS, sel)) != 0)
+		goto done;
+
+	/* General purpose registers */
+	rdx = 0xf00;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RAX, zero)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RBX, zero)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RCX, zero)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RDX, rdx)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RSI, zero)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RDI, zero)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RBP, zero)) != 0)
+		goto done;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_RSP, zero)) != 0)
+		goto done;
+
+	/* GDTR, IDTR */
+	desc_base = 0;
+	desc_limit = 0xffff;
+	desc_access = 0;
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_GDTR,
+			    desc_base, desc_limit, desc_access);
+	if (error != 0)
+		goto done;
+
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_IDTR,
+			    desc_base, desc_limit, desc_access);
+	if (error != 0)
+		goto done;
+
+	/* TR */
+	desc_base = 0;
+	desc_limit = 0xffff;
+	desc_access = 0x0000008b;
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_TR, 0, 0, desc_access);
+	if (error)
+		goto done;
+
+	sel = 0;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_TR, sel)) != 0)
+		goto done;
+
+	/* LDTR */
+	desc_base = 0;
+	desc_limit = 0xffff;
+	desc_access = 0x00000082;
+	error = vm_set_desc(vmctx, vcpu, VM_REG_GUEST_LDTR, desc_base,
+			    desc_limit, desc_access);
+	if (error)
+		goto done;
+
+	sel = 0;
+	if ((error = vm_set_register(vmctx, vcpu, VM_REG_GUEST_LDTR, 0)) != 0)
+		goto done;
+
+	/* XXX cr2, debug registers */
+
+	error = 0;
+done:
+	return (error);
+}
+
+int
+vm_get_gpa_pmap(struct vmctx *ctx, uint64_t gpa, uint64_t *pte, int *num)
+{
+	int error, i;
+	struct vm_gpa_pte gpapte;
+
+	bzero(&gpapte, sizeof(gpapte));
+	gpapte.gpa = gpa;
+
+	error = ioctl(ctx->fd, VM_GET_GPA_PMAP, &gpapte);
+
+	if (error == 0) {
+		*num = gpapte.ptenum;
+		for (i = 0; i < gpapte.ptenum; i++)
+			pte[i] = gpapte.pte[i];
+	}
+
+	return (error);
+}
+
+int
+vm_get_hpet_capabilities(struct vmctx *ctx, uint32_t *capabilities)
+{
+	int error;
+	struct vm_hpet_cap cap;
+
+	bzero(&cap, sizeof(struct vm_hpet_cap));
+	error = ioctl(ctx->fd, VM_GET_HPET_CAPABILITIES, &cap);
+	if (capabilities != NULL)
+		*capabilities = cap.capabilities;
+	return (error);
+}
+
+int
+vm_gla2gpa(struct vmctx *ctx, int vcpu, struct vm_guest_paging *paging,
+    uint64_t gla, int prot, uint64_t *gpa, int *fault)
+{
+	struct vm_gla2gpa gg;
+	int error;
+
+	bzero(&gg, sizeof(struct vm_gla2gpa));
+	gg.vcpuid = vcpu;
+	gg.prot = prot;
+	gg.gla = gla;
+	gg.paging = *paging;
+
+	error = ioctl(ctx->fd, VM_GLA2GPA, &gg);
+	if (error == 0) {
+		*fault = gg.fault;
+		*gpa = gg.gpa;
+	}
+	return (error);
+}
+
+int
+vm_gla2gpa_nofault(struct vmctx *ctx, int vcpu, struct vm_guest_paging *paging,
+    uint64_t gla, int prot, uint64_t *gpa, int *fault)
+{
+	struct vm_gla2gpa gg;
+	int error;
+
+	bzero(&gg, sizeof(struct vm_gla2gpa));
+	gg.vcpuid = vcpu;
+	gg.prot = prot;
+	gg.gla = gla;
+	gg.paging = *paging;
+
+	error = ioctl(ctx->fd, VM_GLA2GPA_NOFAULT, &gg);
+	if (error == 0) {
+		*fault = gg.fault;
+		*gpa = gg.gpa;
+	}
+	return (error);
+}
+
+#ifndef min
+#define	min(a,b)	(((a) < (b)) ? (a) : (b))
+#endif
+
+int
+vm_copy_setup(struct vmctx *ctx, int vcpu, struct vm_guest_paging *paging,
+    uint64_t gla, size_t len, int prot, struct iovec *iov, int iovcnt,
+    int *fault)
+{
+	void *va;
+	uint64_t gpa;
+	int error, i, n, off;
+
+	for (i = 0; i < iovcnt; i++) {
+		iov[i].iov_base = 0;
+		iov[i].iov_len = 0;
+	}
+
+	while (len) {
+		assert(iovcnt > 0);
+		error = vm_gla2gpa(ctx, vcpu, paging, gla, prot, &gpa, fault);
+		if (error || *fault)
+			return (error);
+
+		off = gpa & PAGE_MASK;
+		n = min(len, PAGE_SIZE - off);
+
+		va = vm_map_gpa(ctx, gpa, n);
+		if (va == NULL)
+			return (EFAULT);
+
+		iov->iov_base = va;
+		iov->iov_len = n;
+		iov++;
+		iovcnt--;
+
+		gla += n;
+		len -= n;
+	}
+	return (0);
+}
+
+void
+vm_copy_teardown(struct vmctx *ctx, int vcpu, struct iovec *iov, int iovcnt)
+{
+
+	return;
+}
+
+void
+vm_copyin(struct vmctx *ctx, int vcpu, struct iovec *iov, void *vp, size_t len)
+{
+	const char *src;
+	char *dst;
+	size_t n;
+
+	dst = vp;
+	while (len) {
+		assert(iov->iov_len);
+		n = min(len, iov->iov_len);
+		src = iov->iov_base;
+		bcopy(src, dst, n);
+
+		iov++;
+		dst += n;
+		len -= n;
+	}
+}
+
+void
+vm_copyout(struct vmctx *ctx, int vcpu, const void *vp, struct iovec *iov,
+    size_t len)
+{
+	const char *src;
+	char *dst;
+	size_t n;
+
+	src = vp;
+	while (len) {
+		assert(iov->iov_len);
+		n = min(len, iov->iov_len);
+		dst = iov->iov_base;
+		bcopy(src, dst, n);
+
+		iov++;
+		src += n;
+		len -= n;
+	}
+}
+
+static int
+vm_get_cpus(struct vmctx *ctx, int which, cpuset_t *cpus)
+{
+	struct vm_cpuset vm_cpuset;
+	int error;
+
+	bzero(&vm_cpuset, sizeof(struct vm_cpuset));
+	vm_cpuset.which = which;
+	vm_cpuset.cpusetsize = sizeof(cpuset_t);
+	vm_cpuset.cpus = cpus;
+
+	error = ioctl(ctx->fd, VM_GET_CPUS, &vm_cpuset);
+	return (error);
+}
+
+int
+vm_active_cpus(struct vmctx *ctx, cpuset_t *cpus)
+{
+
+	return (vm_get_cpus(ctx, VM_ACTIVE_CPUS, cpus));
+}
+
+int
+vm_suspended_cpus(struct vmctx *ctx, cpuset_t *cpus)
+{
+
+	return (vm_get_cpus(ctx, VM_SUSPENDED_CPUS, cpus));
+}
+
+int
+vm_debug_cpus(struct vmctx *ctx, cpuset_t *cpus)
+{
+
+	return (vm_get_cpus(ctx, VM_DEBUG_CPUS, cpus));
+}
+
+int
+vm_activate_cpu(struct vmctx *ctx, int vcpu)
+{
+	struct vm_activate_cpu ac;
+	int error;
+
+	bzero(&ac, sizeof(struct vm_activate_cpu));
+	ac.vcpuid = vcpu;
+	error = ioctl(ctx->fd, VM_ACTIVATE_CPU, &ac);
+	return (error);
+}
+
+int
+vm_suspend_cpu(struct vmctx *ctx, int vcpu)
+{
+	struct vm_activate_cpu ac;
+	int error;
+
+	bzero(&ac, sizeof(struct vm_activate_cpu));
+	ac.vcpuid = vcpu;
+	error = ioctl(ctx->fd, VM_SUSPEND_CPU, &ac);
+	return (error);
+}
+
+int
+vm_resume_cpu(struct vmctx *ctx, int vcpu)
+{
+	struct vm_activate_cpu ac;
+	int error;
+
+	bzero(&ac, sizeof(struct vm_activate_cpu));
+	ac.vcpuid = vcpu;
+	error = ioctl(ctx->fd, VM_RESUME_CPU, &ac);
+	return (error);
+}
+
+int
+vm_get_intinfo(struct vmctx *ctx, int vcpu, uint64_t *info1, uint64_t *info2)
+{
+	struct vm_intinfo vmii;
+	int error;
+
+	bzero(&vmii, sizeof(struct vm_intinfo));
+	vmii.vcpuid = vcpu;
+	error = ioctl(ctx->fd, VM_GET_INTINFO, &vmii);
+	if (error == 0) {
+		*info1 = vmii.info1;
+		*info2 = vmii.info2;
+	}
+	return (error);
+}
+
+int
+vm_set_intinfo(struct vmctx *ctx, int vcpu, uint64_t info1)
+{
+	struct vm_intinfo vmii;
+	int error;
+
+	bzero(&vmii, sizeof(struct vm_intinfo));
+	vmii.vcpuid = vcpu;
+	vmii.info1 = info1;
+	error = ioctl(ctx->fd, VM_SET_INTINFO, &vmii);
+	return (error);
+}
+
+int
+vm_rtc_write(struct vmctx *ctx, int offset, uint8_t value)
+{
+	struct vm_rtc_data rtcdata;
+	int error;
+
+	bzero(&rtcdata, sizeof(struct vm_rtc_data));
+	rtcdata.offset = offset;
+	rtcdata.value = value;
+	error = ioctl(ctx->fd, VM_RTC_WRITE, &rtcdata);
+	return (error);
+}
+
+int
+vm_rtc_read(struct vmctx *ctx, int offset, uint8_t *retval)
+{
+	struct vm_rtc_data rtcdata;
+	int error;
+
+	bzero(&rtcdata, sizeof(struct vm_rtc_data));
+	rtcdata.offset = offset;
+	error = ioctl(ctx->fd, VM_RTC_READ, &rtcdata);
+	if (error == 0)
+		*retval = rtcdata.value;
+	return (error);
+}
+
+int
+vm_rtc_settime(struct vmctx *ctx, time_t secs)
+{
+	struct vm_rtc_time rtctime;
+	int error;
+
+	bzero(&rtctime, sizeof(struct vm_rtc_time));
+	rtctime.secs = secs;
+	error = ioctl(ctx->fd, VM_RTC_SETTIME, &rtctime);
+	return (error);
+}
+
+int
+vm_rtc_gettime(struct vmctx *ctx, time_t *secs)
+{
+	struct vm_rtc_time rtctime;
+	int error;
+
+	bzero(&rtctime, sizeof(struct vm_rtc_time));
+	error = ioctl(ctx->fd, VM_RTC_GETTIME, &rtctime);
+	if (error == 0)
+		*secs = rtctime.secs;
+	return (error);
+}
+
+int
+vm_restart_instruction(void *arg, int vcpu)
+{
+	struct vmctx *ctx = arg;
+
+	return (ioctl(ctx->fd, VM_RESTART_INSTRUCTION, &vcpu));
+}
+
+int
+vm_set_topology(struct vmctx *ctx,
+    uint16_t sockets, uint16_t cores, uint16_t threads, uint16_t maxcpus)
+{
+	struct vm_cpu_topology topology;
+
+	bzero(&topology, sizeof (struct vm_cpu_topology));
+	topology.sockets = sockets;
+	topology.cores = cores;
+	topology.threads = threads;
+	topology.maxcpus = maxcpus;
+	return (ioctl(ctx->fd, VM_SET_TOPOLOGY, &topology));
+}
+
+int
+vm_get_topology(struct vmctx *ctx,
+    uint16_t *sockets, uint16_t *cores, uint16_t *threads, uint16_t *maxcpus)
+{
+	struct vm_cpu_topology topology;
+	int error;
+
+	bzero(&topology, sizeof (struct vm_cpu_topology));
+	error = ioctl(ctx->fd, VM_GET_TOPOLOGY, &topology);
+	if (error == 0) {
+		*sockets = topology.sockets;
+		*cores = topology.cores;
+		*threads = topology.threads;
+		*maxcpus = topology.maxcpus;
+	}
+	return (error);
+}
+
+int
+vm_get_device_fd(struct vmctx *ctx)
+{
+
+	return (ctx->fd);
+}
+
+#ifdef __FreeBSD__
+const cap_ioctl_t *
+vm_get_ioctls(size_t *len)
+{
+	cap_ioctl_t *cmds;
+	/* keep in sync with machine/vmm_dev.h */
+	static const cap_ioctl_t vm_ioctl_cmds[] = { VM_RUN, VM_SUSPEND, VM_REINIT,
+	    VM_ALLOC_MEMSEG, VM_GET_MEMSEG, VM_MMAP_MEMSEG, VM_MMAP_MEMSEG,
+	    VM_MMAP_GETNEXT, VM_SET_REGISTER, VM_GET_REGISTER,
+	    VM_SET_SEGMENT_DESCRIPTOR, VM_GET_SEGMENT_DESCRIPTOR,
+	    VM_SET_REGISTER_SET, VM_GET_REGISTER_SET,
+	    VM_INJECT_EXCEPTION, VM_LAPIC_IRQ, VM_LAPIC_LOCAL_IRQ,
+	    VM_LAPIC_MSI, VM_IOAPIC_ASSERT_IRQ, VM_IOAPIC_DEASSERT_IRQ,
+	    VM_IOAPIC_PULSE_IRQ, VM_IOAPIC_PINCOUNT, VM_ISA_ASSERT_IRQ,
+	    VM_ISA_DEASSERT_IRQ, VM_ISA_PULSE_IRQ, VM_ISA_SET_IRQ_TRIGGER,
+	    VM_SET_CAPABILITY, VM_GET_CAPABILITY, VM_BIND_PPTDEV,
+	    VM_UNBIND_PPTDEV, VM_MAP_PPTDEV_MMIO, VM_PPTDEV_MSI,
+	    VM_PPTDEV_MSIX, VM_INJECT_NMI, VM_STATS, VM_STAT_DESC,
+	    VM_SET_X2APIC_STATE, VM_GET_X2APIC_STATE,
+	    VM_GET_HPET_CAPABILITIES, VM_GET_GPA_PMAP, VM_GLA2GPA,
+	    VM_GLA2GPA_NOFAULT,
+	    VM_ACTIVATE_CPU, VM_GET_CPUS, VM_SUSPEND_CPU, VM_RESUME_CPU,
+	    VM_SET_INTINFO, VM_GET_INTINFO,
+	    VM_RTC_WRITE, VM_RTC_READ, VM_RTC_SETTIME, VM_RTC_GETTIME,
+	    VM_RESTART_INSTRUCTION, VM_SET_TOPOLOGY, VM_GET_TOPOLOGY };
+
+	if (len == NULL) {
+		cmds = malloc(sizeof(vm_ioctl_cmds));
+		if (cmds == NULL)
+			return (NULL);
+		bcopy(vm_ioctl_cmds, cmds, sizeof(vm_ioctl_cmds));
+		return (cmds);
+	}
+
+	*len = nitems(vm_ioctl_cmds);
+	return (NULL);
+}
+#endif /* __FreeBSD__ */
+
diff --git a/usr/src/lib/libvmmapi/common/vmmapi.h b/usr/src/lib/libvmmapi/common/vmmapi.h
new file mode 100644
index 0000000000..43481fefbe
--- /dev/null
+++ b/usr/src/lib/libvmmapi/common/vmmapi.h
@@ -0,0 +1,276 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ */
+
+#ifndef _VMMAPI_H_
+#define	_VMMAPI_H_
+
+#include <sys/param.h>
+#include <sys/cpuset.h>
+
+/*
+ * API version for out-of-tree consumers like grub-bhyve for making compile
+ * time decisions.
+ */
+#define	VMMAPI_VERSION	0103	/* 2 digit major followed by 2 digit minor */
+
+struct iovec;
+struct vmctx;
+enum x2apic_state;
+
+/*
+ * Different styles of mapping the memory assigned to a VM into the address
+ * space of the controlling process.
+ */
+enum vm_mmap_style {
+	VM_MMAP_NONE,		/* no mapping */
+	VM_MMAP_ALL,		/* fully and statically mapped */
+	VM_MMAP_SPARSE,		/* mappings created on-demand */
+};
+
+/*
+ * 'flags' value passed to 'vm_set_memflags()'.
+ */
+#define	VM_MEM_F_INCORE	0x01	/* include guest memory in core file */
+#define	VM_MEM_F_WIRED	0x02	/* guest memory is wired */
+
+/*
+ * Identifiers for memory segments:
+ * - vm_setup_memory() uses VM_SYSMEM for the system memory segment.
+ * - the remaining identifiers can be used to create devmem segments.
+ */
+enum {
+#ifdef __FreeBSD__
+	VM_SYSMEM,
+#else
+	VM_LOWMEM,
+	VM_HIGHMEM,
+#endif
+	VM_BOOTROM,
+	VM_FRAMEBUFFER,
+};
+
+/*
+ * Get the length and name of the memory segment identified by 'segid'.
+ * Note that system memory segments are identified with a nul name.
+ *
+ * Returns 0 on success and non-zero otherwise.
+ */
+int	vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name,
+	    size_t namesiz);
+
+/*
+ * Iterate over the guest address space. This function finds an address range
+ * that starts at an address >= *gpa.
+ *
+ * Returns 0 if the next address range was found and non-zero otherwise.
+ */
+int	vm_mmap_getnext(struct vmctx *ctx, vm_paddr_t *gpa, int *segid,
+	    vm_ooffset_t *segoff, size_t *len, int *prot, int *flags);
+/*
+ * Create a device memory segment identified by 'segid'.
+ *
+ * Returns a pointer to the memory segment on success and MAP_FAILED otherwise.
+ */
+void	*vm_create_devmem(struct vmctx *ctx, int segid, const char *name,
+	    size_t len);
+
+/*
+ * Map the memory segment identified by 'segid' into the guest address space
+ * at [gpa,gpa+len) with protection 'prot'.
+ */
+int	vm_mmap_memseg(struct vmctx *ctx, vm_paddr_t gpa, int segid,
+	    vm_ooffset_t segoff, size_t len, int prot);
+
+int	vm_create(const char *name);
+int	vm_get_device_fd(struct vmctx *ctx);
+struct vmctx *vm_open(const char *name);
+void	vm_destroy(struct vmctx *ctx);
+int	vm_parse_memsize(const char *optarg, size_t *memsize);
+int	vm_setup_memory(struct vmctx *ctx, size_t len, enum vm_mmap_style s);
+void	*vm_map_gpa(struct vmctx *ctx, vm_paddr_t gaddr, size_t len);
+int	vm_get_gpa_pmap(struct vmctx *, uint64_t gpa, uint64_t *pte, int *num);
+int	vm_gla2gpa(struct vmctx *, int vcpuid, struct vm_guest_paging *paging,
+		   uint64_t gla, int prot, uint64_t *gpa, int *fault);
+int	vm_gla2gpa_nofault(struct vmctx *, int vcpuid,
+		   struct vm_guest_paging *paging, uint64_t gla, int prot,
+		   uint64_t *gpa, int *fault);
+uint32_t vm_get_lowmem_limit(struct vmctx *ctx);
+void	vm_set_lowmem_limit(struct vmctx *ctx, uint32_t limit);
+void	vm_set_memflags(struct vmctx *ctx, int flags);
+int	vm_get_memflags(struct vmctx *ctx);
+size_t	vm_get_lowmem_size(struct vmctx *ctx);
+size_t	vm_get_highmem_size(struct vmctx *ctx);
+int	vm_set_desc(struct vmctx *ctx, int vcpu, int reg,
+		    uint64_t base, uint32_t limit, uint32_t access);
+int	vm_get_desc(struct vmctx *ctx, int vcpu, int reg,
+		    uint64_t *base, uint32_t *limit, uint32_t *access);
+int	vm_get_seg_desc(struct vmctx *ctx, int vcpu, int reg,
+			struct seg_desc *seg_desc);
+int	vm_set_register(struct vmctx *ctx, int vcpu, int reg, uint64_t val);
+int	vm_get_register(struct vmctx *ctx, int vcpu, int reg, uint64_t *retval);
+int	vm_set_register_set(struct vmctx *ctx, int vcpu, unsigned int count,
+    const int *regnums, uint64_t *regvals);
+int	vm_get_register_set(struct vmctx *ctx, int vcpu, unsigned int count,
+    const int *regnums, uint64_t *regvals);
+int	vm_run(struct vmctx *ctx, int vcpu, struct vm_exit *ret_vmexit);
+int	vm_suspend(struct vmctx *ctx, enum vm_suspend_how how);
+int	vm_reinit(struct vmctx *ctx);
+int	vm_apicid2vcpu(struct vmctx *ctx, int apicid);
+int	vm_inject_exception(struct vmctx *ctx, int vcpu, int vector,
+    int errcode_valid, uint32_t errcode, int restart_instruction);
+int	vm_lapic_irq(struct vmctx *ctx, int vcpu, int vector);
+int	vm_lapic_local_irq(struct vmctx *ctx, int vcpu, int vector);
+int	vm_lapic_msi(struct vmctx *ctx, uint64_t addr, uint64_t msg);
+int	vm_ioapic_assert_irq(struct vmctx *ctx, int irq);
+int	vm_ioapic_deassert_irq(struct vmctx *ctx, int irq);
+int	vm_ioapic_pulse_irq(struct vmctx *ctx, int irq);
+int	vm_ioapic_pincount(struct vmctx *ctx, int *pincount);
+int	vm_isa_assert_irq(struct vmctx *ctx, int atpic_irq, int ioapic_irq);
+int	vm_isa_deassert_irq(struct vmctx *ctx, int atpic_irq, int ioapic_irq);
+int	vm_isa_pulse_irq(struct vmctx *ctx, int atpic_irq, int ioapic_irq);
+int	vm_isa_set_irq_trigger(struct vmctx *ctx, int atpic_irq,
+	    enum vm_intr_trigger trigger);
+int	vm_inject_nmi(struct vmctx *ctx, int vcpu);
+int	vm_capability_name2type(const char *capname);
+const char *vm_capability_type2name(int type);
+int	vm_get_capability(struct vmctx *ctx, int vcpu, enum vm_cap_type cap,
+			  int *retval);
+int	vm_set_capability(struct vmctx *ctx, int vcpu, enum vm_cap_type cap,
+			  int val);
+#ifdef __FreeBSD__
+int	vm_assign_pptdev(struct vmctx *ctx, int bus, int slot, int func);
+int	vm_unassign_pptdev(struct vmctx *ctx, int bus, int slot, int func);
+int	vm_map_pptdev_mmio(struct vmctx *ctx, int bus, int slot, int func,
+			   vm_paddr_t gpa, size_t len, vm_paddr_t hpa);
+int	vm_setup_pptdev_msi(struct vmctx *ctx, int vcpu, int bus, int slot,
+	    int func, uint64_t addr, uint64_t msg, int numvec);
+int	vm_setup_pptdev_msix(struct vmctx *ctx, int vcpu, int bus, int slot,
+	    int func, int idx, uint64_t addr, uint64_t msg,
+	    uint32_t vector_control);
+int	vm_get_pptdev_limits(struct vmctx *ctx, int bus, int slot, int func,
+    int *msi_limit, int *msix_limit);
+#else /* __FreeBSD__ */
+int	vm_assign_pptdev(struct vmctx *ctx, int pptfd);
+int	vm_unassign_pptdev(struct vmctx *ctx, int pptfd);
+int	vm_map_pptdev_mmio(struct vmctx *ctx, int pptfd, vm_paddr_t gpa,
+    size_t len, vm_paddr_t hpa);
+int	vm_setup_pptdev_msi(struct vmctx *ctx, int vcpu, int pptfd,
+    uint64_t addr, uint64_t msg, int numvec);
+int	vm_setup_pptdev_msix(struct vmctx *ctx, int vcpu, int pptfd,
+    int idx, uint64_t addr, uint64_t msg, uint32_t vector_control);
+int	vm_get_pptdev_limits(struct vmctx *ctx, int pptfd, int *msi_limit,
+    int *msix_limit);
+#endif /* __FreeBSD__ */
+
+int	vm_get_intinfo(struct vmctx *ctx, int vcpu, uint64_t *i1, uint64_t *i2);
+int	vm_set_intinfo(struct vmctx *ctx, int vcpu, uint64_t exit_intinfo);
+
+#ifdef __FreeBSD__
+const cap_ioctl_t *vm_get_ioctls(size_t *len);
+#endif
+
+/*
+ * Return a pointer to the statistics buffer. Note that this is not MT-safe.
+ */
+uint64_t *vm_get_stats(struct vmctx *ctx, int vcpu, struct timeval *ret_tv,
+		       int *ret_entries);
+const char *vm_get_stat_desc(struct vmctx *ctx, int index);
+
+int	vm_get_x2apic_state(struct vmctx *ctx, int vcpu, enum x2apic_state *s);
+int	vm_set_x2apic_state(struct vmctx *ctx, int vcpu, enum x2apic_state s);
+
+int	vm_get_hpet_capabilities(struct vmctx *ctx, uint32_t *capabilities);
+
+/*
+ * Translate the GLA range [gla,gla+len) into GPA segments in 'iov'.
+ * The 'iovcnt' should be big enough to accommodate all GPA segments.
+ *
+ * retval	fault		Interpretation
+ *   0		  0		Success
+ *   0		  1		An exception was injected into the guest
+ * EFAULT	 N/A		Error
+ */
+int	vm_copy_setup(struct vmctx *ctx, int vcpu, struct vm_guest_paging *pg,
+	    uint64_t gla, size_t len, int prot, struct iovec *iov, int iovcnt,
+	    int *fault);
+void	vm_copyin(struct vmctx *ctx, int vcpu, struct iovec *guest_iov,
+	    void *host_dst, size_t len);
+void	vm_copyout(struct vmctx *ctx, int vcpu, const void *host_src,
+	    struct iovec *guest_iov, size_t len);
+void	vm_copy_teardown(struct vmctx *ctx, int vcpu, struct iovec *iov,
+	    int iovcnt);
+
+/* RTC */
+int	vm_rtc_write(struct vmctx *ctx, int offset, uint8_t value);
+int	vm_rtc_read(struct vmctx *ctx, int offset, uint8_t *retval);
+int	vm_rtc_settime(struct vmctx *ctx, time_t secs);
+int	vm_rtc_gettime(struct vmctx *ctx, time_t *secs);
+
+/* Reset vcpu register state */
+int	vcpu_reset(struct vmctx *ctx, int vcpu);
+
+int	vm_active_cpus(struct vmctx *ctx, cpuset_t *cpus);
+int	vm_suspended_cpus(struct vmctx *ctx, cpuset_t *cpus);
+int	vm_debug_cpus(struct vmctx *ctx, cpuset_t *cpus);
+int	vm_activate_cpu(struct vmctx *ctx, int vcpu);
+int	vm_suspend_cpu(struct vmctx *ctx, int vcpu);
+int	vm_resume_cpu(struct vmctx *ctx, int vcpu);
+
+/* CPU topology */
+int	vm_set_topology(struct vmctx *ctx, uint16_t sockets, uint16_t cores,
+	    uint16_t threads, uint16_t maxcpus);
+int	vm_get_topology(struct vmctx *ctx, uint16_t *sockets, uint16_t *cores,
+	    uint16_t *threads, uint16_t *maxcpus);
+
+#ifdef	__FreeBSD__
+/*
+ * FreeBSD specific APIs
+ */
+int	vm_setup_freebsd_registers(struct vmctx *ctx, int vcpu,
+				uint64_t rip, uint64_t cr3, uint64_t gdtbase,
+				uint64_t rsp);
+int	vm_setup_freebsd_registers_i386(struct vmctx *vmctx, int vcpu,
+					uint32_t eip, uint32_t gdtbase,
+					uint32_t esp);
+void	vm_setup_freebsd_gdt(uint64_t *gdtr);
+#endif
+#endif	/* _VMMAPI_H_ */
diff --git a/usr/src/lib/libvnd/Makefile b/usr/src/lib/libvnd/Makefile
new file mode 100644
index 0000000000..1352adb8e4
--- /dev/null
+++ b/usr/src/lib/libvnd/Makefile
@@ -0,0 +1,50 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include		../Makefile.lib
+
+HDRS =		libvnd.h
+HDRDIR =	common
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+TYPECHECK_LIB = libvnd.so.1
+TYPELIST = \
+	vnd_ioc_attach_t \
+	vnd_ioc_link_t \
+	vnd_ioc_unlink_t \
+	vnd_ioc_buf_t \
+	vnd_ioc_info_t	
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+install_h: 	$(ROOTHDRS)
+
+check:		$(CHECKHDRS) $(TYPECHECK)
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/lib/libvnd/Makefile.com b/usr/src/lib/libvnd/Makefile.com
new file mode 100644
index 0000000000..3c6896de11
--- /dev/null
+++ b/usr/src/lib/libvnd/Makefile.com
@@ -0,0 +1,39 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc. All rights reserved.
+#
+
+include		../../Makefile.lib
+
+LIBRARY =	libvnd.a
+VERS =		.1
+OBJECTS =	libvnd.o
+
+include ../../Makefile.lib
+
+LIBS =		$(DYNLIB) $(LINTLIB)
+LDLIBS +=	-lc
+CPPFLAGS +=	-I../common
+
+SRCDIR =	../common
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/libvnd/amd64/Makefile b/usr/src/lib/libvnd/amd64/Makefile
new file mode 100644
index 0000000000..15d904c616
--- /dev/null
+++ b/usr/src/lib/libvnd/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libvnd/common/libvnd.c b/usr/src/lib/libvnd/common/libvnd.c
new file mode 100644
index 0000000000..8972f6cf5a
--- /dev/null
+++ b/usr/src/lib/libvnd/common/libvnd.c
@@ -0,0 +1,550 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <stdio.h>
+#include <zone.h>
+#include <assert.h>
+#include <sys/sysmacros.h>
+
+#include <sys/vnd.h>
+#include <libvnd.h>
+
+struct vnd_handle {
+	int vh_fd;
+	uint32_t vh_errno;
+	int vh_syserr;
+};
+
+static const char *vnd_strerror_tbl[] = {
+	"no error",					/* VND_E_SUCCESS */
+	"not enough memory available",			/* VND_E_NOMEM */
+	"no such datalink",				/* VND_E_NODATALINK */
+	"datalink not of type DL_ETHER",		/* VND_E_NOTETHER */
+	"unknown dlpi failure",				/* VND_E_DLPIINVAL */
+	"DL_ATTACH_REQ failed",				/* VND_E_ATTACHFAIL */
+	"DL_BIND_REQ failed",				/* VND_E_PROMISCFAIL */
+	"DL_PROMISCON_REQ failed",			/* VND_E_PROMISCFAIL */
+	"DLD_CAPAB_DIRECT enable failed",		/* VND_E_DIRECTFAIL */
+	"bad datalink capability",			/* VND_E_CAPACKINVAL */
+	"bad datalink subcapability",			/* VND_E_SUBCAPINVAL */
+	"bad dld version",				/* VND_E_DLDBADVERS */
+	"failed to create kstats",			/* VND_E_KSTATCREATE */
+	"no such vnd link",				/* VND_E_NODEV */
+	"netstack doesn't exist",			/* VND_E_NONETSTACK */
+	"device already associated",			/* VND_E_ASSOCIATED */
+	"device already attached",			/* VND_E_ATTACHED */
+	"device already linked",			/* VND_E_LINKED */
+	"invalid name",					/* VND_E_BADNAME */
+	"permission denied",				/* VND_E_PERM */
+	"no such zone",					/* VND_E_NOZONE */
+	"failed to initialize vnd stream module",	/* VND_E_STRINIT */
+	"device not attached",				/* VND_E_NOTATTACHED */
+	"device not linked",				/* VND_E_NOTLINKED */
+	"another device has the same link name",	/* VND_E_LINKEXISTS */
+	"failed to create minor node",			/* VND_E_MINORNODE */
+	"requested buffer size is too large",		/* VND_E_BUFTOOBIG */
+	"requested buffer size is too small",		/* VND_E_TOOSMALL */
+	"unable to obtain exclusive access to dlpi link, link busy",
+							/* VND_E_DLEXCL */
+	"DLD direct capability not supported over data link",
+							/* VND_E_DIRECTNOTSUP */
+	"invalid property size",			/* VND_E_BADPROPSIZE */
+	"invalid property",				/* VND_E_BADPROP */
+	"property is read only",			/* VND_E_PROPRDONLY */
+	"unexpected system error",			/* VND_E_SYS */
+	"capabilities invalid, pass-through module detected",
+							/* VND_E_CAPABPASS */
+	"unknown error"					/* VND_E_UNKNOWN */
+};
+
+vnd_errno_t
+vnd_errno(vnd_handle_t *vhp)
+{
+	return (vhp->vh_errno);
+}
+
+const char *
+vnd_strerror(vnd_errno_t err)
+{
+	if (err >= VND_E_UNKNOWN)
+		err = VND_E_UNKNOWN;
+	return (vnd_strerror_tbl[err]);
+}
+
+int
+vnd_syserrno(vnd_handle_t *vhp)
+{
+	return (vhp->vh_syserr);
+}
+
+const char *
+vnd_strsyserror(int err)
+{
+	return (strerror(err));
+}
+
+static int
+vnd_ioc_return(vnd_handle_t *vhp, uint32_t err)
+{
+	if (err != VND_E_SUCCESS) {
+		vhp->vh_errno = err;
+		vhp->vh_syserr = 0;
+	} else {
+		if (errno == EFAULT)
+			abort();
+		vhp->vh_errno = VND_E_SYS;
+		vhp->vh_syserr = errno;
+	}
+	return (-1);
+}
+
+void
+vnd_close(vnd_handle_t *vhp)
+{
+	int ret;
+
+	if (vhp->vh_fd >= 0) {
+		ret = close(vhp->vh_fd);
+		assert(ret == 0);
+	}
+	free(vhp);
+}
+
+static int
+vnd_link(vnd_handle_t *vhp, const char *name)
+{
+	vnd_ioc_link_t vil;
+
+	if (strlen(name) >= VND_NAMELEN) {
+		errno = ENAMETOOLONG;
+		return (-1);
+	}
+
+	(void) strlcpy(vil.vil_name, name, sizeof (vil.vil_name));
+	vil.vil_errno = VND_E_SUCCESS;
+	if (ioctl(vhp->vh_fd, VND_IOC_LINK, &vil) != 0)
+		return (vnd_ioc_return(vhp, vil.vil_errno));
+
+	return (0);
+}
+
+static vnd_handle_t *
+vnd_open_ctl(vnd_errno_t *vnderr, int *syserr)
+{
+	int fd;
+	vnd_handle_t *vhp;
+
+	vhp = malloc(sizeof (vnd_handle_t));
+	if (vhp == NULL) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_NOMEM;
+		if (syserr != NULL)
+			*syserr = 0;
+		return (NULL);
+	}
+	bzero(vhp, sizeof (vnd_handle_t));
+
+	fd = open("/dev/vnd/ctl", O_RDWR);
+	if (fd < 0) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_SYS;
+		if (syserr != NULL)
+			*syserr = errno;
+		free(vhp);
+		return (NULL);
+	}
+
+	vhp->vh_fd = fd;
+	return (vhp);
+}
+
+vnd_handle_t *
+vnd_create(const char *zonename, const char *datalink, const char *linkname,
+    vnd_errno_t *vnderr, int *syserr)
+{
+	int ret;
+	vnd_handle_t *vhp;
+	vnd_ioc_attach_t via;
+	zoneid_t zid;
+
+	if (strlen(datalink) >= VND_NAMELEN) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_BADNAME;
+		if (syserr != NULL)
+			*syserr = 0;
+		return (NULL);
+	}
+
+	vhp = vnd_open_ctl(vnderr, syserr);
+	if (vhp == NULL)
+		return (NULL);	/* errno set for us */
+
+	if (zonename != NULL) {
+		zid = getzoneidbyname(zonename);
+		if (zid == -1) {
+			vnd_close(vhp);
+			if (vnderr != NULL)
+				*vnderr = VND_E_NOZONE;
+			if (syserr != NULL)
+				*syserr = 0;
+			return (NULL);
+		}
+		via.via_zoneid = zid;
+	} else {
+		via.via_zoneid = -1;
+	}
+
+	(void) strlcpy(via.via_name, datalink, sizeof (via.via_name));
+	via.via_errno = VND_E_SUCCESS;
+	if (ioctl(vhp->vh_fd, VND_IOC_ATTACH, &via) != 0) {
+		if (via.via_errno != VND_E_SUCCESS) {
+			if (vnderr != NULL)
+				*vnderr = via.via_errno;
+			if (syserr != NULL)
+				*syserr = 0;
+		} else {
+			if (vnderr != NULL)
+				*vnderr = VND_E_SYS;
+			if (syserr != NULL)
+				*syserr = errno;
+		}
+		vnd_close(vhp);
+		return (NULL);
+	}
+
+	ret = vnd_link(vhp, linkname);
+	if (ret != 0) {
+		if (vnderr != NULL)
+			*vnderr = vhp->vh_errno;
+		if (syserr != NULL)
+			*syserr = vhp->vh_syserr;
+		vnd_close(vhp);
+		return (NULL);
+	}
+
+	if (vnderr != NULL)
+		*vnderr = VND_E_SUCCESS;
+	if (syserr != NULL)
+		*syserr = 0;
+
+	return (vhp);
+}
+
+vnd_handle_t *
+vnd_open(const char *zone, const char *link, vnd_errno_t *vnderr, int *syserr)
+{
+	int fd, ret;
+	char path[MAXPATHLEN];
+	vnd_handle_t *vhp;
+
+	if (zone != NULL)
+		ret = snprintf(path, sizeof (path), "/dev/vnd/zone/%s/%s",
+		    zone, link);
+	else
+		ret = snprintf(path, sizeof (path), "/dev/vnd/%s", link);
+
+	if (ret >= sizeof (path)) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_BADNAME;
+		if (syserr != NULL)
+			*syserr = 0;
+		return (NULL);
+	}
+
+	fd = open(path, O_RDWR);
+	if (fd < 0) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_SYS;
+		if (syserr != NULL)
+			*syserr = errno;
+		return (NULL);
+	}
+
+	vhp = malloc(sizeof (vnd_handle_t));
+	if (vhp == NULL) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_NOMEM;
+		if (syserr != NULL)
+			*syserr = 0;
+		ret = close(fd);
+		assert(ret == 0);
+		return (NULL);
+	}
+
+	bzero(vhp, sizeof (vnd_handle_t));
+	vhp->vh_fd = fd;
+
+	return (vhp);
+}
+
+int
+vnd_unlink(vnd_handle_t *vhp)
+{
+	vnd_ioc_unlink_t viu;
+	viu.viu_errno = VND_E_SUCCESS;
+
+	if (ioctl(vhp->vh_fd, VND_IOC_UNLINK, &viu) != 0)
+		return (vnd_ioc_return(vhp, viu.viu_errno));
+
+	return (0);
+}
+
+int
+vnd_pollfd(vnd_handle_t *vhp)
+{
+	return (vhp->vh_fd);
+}
+
+int
+vnd_walk(vnd_walk_cb_t func, void *arg, vnd_errno_t *vnderr, int *syserr)
+{
+	vnd_handle_t *vhp;
+	vnd_ioc_list_t vl;
+	vnd_ioc_info_t *viip;
+	int i, ret;
+
+	vl.vl_nents = 0;
+	vl.vl_ents = NULL;
+
+	vhp = vnd_open_ctl(vnderr, syserr);
+	if (vhp == NULL)
+		return (-1);	/* errno is set for us */
+
+	/* VND_IOC_LIST only returns generic errnos */
+	if (ioctl(vhp->vh_fd, VND_IOC_LIST, &vl) != 0) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_SYS;
+		if (syserr != NULL)
+			*syserr = errno;
+		(void) vnd_ioc_return(vhp, VND_E_SUCCESS);
+		vnd_close(vhp);
+
+		return (-1);
+	}
+
+	if (vl.vl_actents == 0) {
+		vnd_close(vhp);
+		return (0);
+	}
+
+	viip = malloc(sizeof (vnd_ioc_info_t) * vl.vl_actents);
+	if (viip == NULL) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_NOMEM;
+		if (syserr != NULL)
+			*syserr = 0;
+		vnd_close(vhp);
+		return (-1);
+	}
+
+	vl.vl_nents = vl.vl_actents;
+	vl.vl_ents = viip;
+
+	if (ioctl(vhp->vh_fd, VND_IOC_LIST, &vl) != 0) {
+		if (vnderr != NULL)
+			*vnderr = VND_E_SYS;
+		if (syserr != NULL)
+			*syserr = errno;
+		(void) vnd_ioc_return(vhp, VND_E_SUCCESS);
+		free(viip);
+		vnd_close(vhp);
+		return (-1);
+	}
+
+	ret = 0;
+	for (i = 0; i < MIN(vl.vl_nents, vl.vl_actents); i++) {
+		if (func((vnd_info_t *)(viip + i), arg) != 0) {
+			ret = 1;
+			break;
+		}
+	}
+
+	free(viip);
+	vnd_close(vhp);
+
+	return (ret);
+}
+
+static int
+vnd_prop_readonly(vnd_handle_t *vhp)
+{
+	vhp->vh_syserr = 0;
+	vhp->vh_errno = VND_E_PROPRDONLY;
+	return (-1);
+}
+
+/*ARGSUSED*/
+static int
+vnd_prop_getbuf(vnd_handle_t *vhp, int cmd, void *buf, size_t len)
+{
+	vnd_ioc_buf_t vib;
+	vnd_prop_buf_t *vpbp = (vnd_prop_buf_t *)buf;
+	vib.vib_errno = 0;
+
+	if (ioctl(vhp->vh_fd, cmd, &vib) != 0)
+		return (vnd_ioc_return(vhp, vib.vib_errno));
+
+	vpbp->vpb_size = vib.vib_size;
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+vnd_prop_setbuf(vnd_handle_t *vhp, int cmd, void *buf, size_t len)
+{
+	vnd_ioc_buf_t vib;
+	vnd_prop_buf_t *vpbp = (vnd_prop_buf_t *)buf;
+
+	vib.vib_errno = 0;
+	vib.vib_size = vpbp->vpb_size;
+	if (ioctl(vhp->vh_fd, cmd, &vib) != 0)
+		return (vnd_ioc_return(vhp, vib.vib_errno));
+
+	return (0);
+}
+
+typedef int (*vpt_prop_f)(vnd_handle_t *, int, void *, size_t);
+typedef struct vnd_prop_tab {
+	vnd_prop_t vpt_prop;
+	size_t vpt_size;
+	int vpt_ioctl_get;
+	int vpt_ioctl_set;
+	vpt_prop_f vpt_get;
+	vpt_prop_f vpt_set;
+} vnd_prop_tab_t;
+
+static vnd_prop_tab_t vnd_props[] = {
+	{ VND_PROP_RXBUF, sizeof (vnd_prop_buf_t), VND_IOC_GETRXBUF,
+		VND_IOC_SETRXBUF, vnd_prop_getbuf, vnd_prop_setbuf},
+	{ VND_PROP_TXBUF, sizeof (vnd_prop_buf_t), VND_IOC_GETTXBUF,
+		VND_IOC_SETTXBUF, vnd_prop_getbuf, vnd_prop_setbuf },
+	{ VND_PROP_MAXBUF, sizeof (vnd_prop_buf_t), VND_IOC_GETMAXBUF,
+		-1, vnd_prop_getbuf, NULL },
+	{ VND_PROP_MINTU, sizeof (vnd_prop_buf_t), VND_IOC_GETMINTU,
+		-1, vnd_prop_getbuf, NULL },
+	{ VND_PROP_MAXTU, sizeof (vnd_prop_buf_t), VND_IOC_GETMAXTU,
+		-1, vnd_prop_getbuf, NULL },
+	{ VND_PROP_MAX }
+};
+
+static int
+vnd_prop(vnd_handle_t *vhp, vnd_prop_t prop, void *buf, size_t len,
+    boolean_t get)
+{
+	vnd_prop_tab_t *vpt;
+
+	for (vpt = vnd_props; vpt->vpt_prop != VND_PROP_MAX; vpt++) {
+		if (vpt->vpt_prop != prop)
+			continue;
+
+		if (len != vpt->vpt_size) {
+			vhp->vh_errno = VND_E_BADPROPSIZE;
+			vhp->vh_syserr = 0;
+			return (-1);
+		}
+
+		if (get == B_TRUE) {
+			return (vpt->vpt_get(vhp, vpt->vpt_ioctl_get, buf,
+			    len));
+		} else {
+			if (vpt->vpt_set == NULL)
+				return (vnd_prop_readonly(vhp));
+			return (vpt->vpt_set(vhp, vpt->vpt_ioctl_set, buf,
+			    len));
+		}
+	}
+
+	vhp->vh_errno = VND_E_BADPROP;
+	vhp->vh_syserr = 0;
+	return (-1);
+}
+
+int
+vnd_prop_get(vnd_handle_t *vhp, vnd_prop_t prop, void *buf, size_t len)
+{
+	return (vnd_prop(vhp, prop, buf, len, B_TRUE));
+}
+
+int
+vnd_prop_set(vnd_handle_t *vhp, vnd_prop_t prop, void *buf, size_t len)
+{
+	return (vnd_prop(vhp, prop, buf, len, B_FALSE));
+}
+
+int
+vnd_prop_writeable(vnd_prop_t prop, boolean_t *write)
+{
+	vnd_prop_tab_t *vpt;
+
+	for (vpt = vnd_props; vpt->vpt_prop != VND_PROP_MAX; vpt++) {
+		if (vpt->vpt_prop != prop)
+			continue;
+
+		*write = (vpt->vpt_set != NULL);
+		return (0);
+	}
+
+	return (-1);
+}
+
+int
+vnd_prop_iter(vnd_handle_t *vhp, vnd_prop_iter_f func, void *arg)
+{
+	int i;
+
+	for (i = 0; i < VND_PROP_MAX; i++) {
+		if (func(vhp, i, arg) != 0)
+			return (1);
+	}
+
+	return (0);
+}
+
+int
+vnd_frameio_read(vnd_handle_t *vhp, frameio_t *fiop)
+{
+	int ret;
+
+	ret = ioctl(vhp->vh_fd, VND_IOC_FRAMEIO_READ, fiop);
+	if (ret == -1) {
+		vhp->vh_errno = VND_E_SYS;
+		vhp->vh_syserr = errno;
+	}
+
+	return (ret);
+}
+
+int
+vnd_frameio_write(vnd_handle_t *vhp, frameio_t *fiop)
+{
+	int ret;
+
+	ret = ioctl(vhp->vh_fd, VND_IOC_FRAMEIO_WRITE, fiop);
+	if (ret == -1) {
+		vhp->vh_errno = VND_E_SYS;
+		vhp->vh_syserr = errno;
+	}
+
+	return (ret);
+}
diff --git a/usr/src/lib/libvnd/common/libvnd.h b/usr/src/lib/libvnd/common/libvnd.h
new file mode 100644
index 0000000000..ea92f113b6
--- /dev/null
+++ b/usr/src/lib/libvnd/common/libvnd.h
@@ -0,0 +1,84 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _LIBVND_H
+#define	_LIBVND_H
+
+/*
+ * libvnd interfaces
+ */
+
+#include <stdint.h>
+#include <sys/vnd_errno.h>
+#include <sys/frameio.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	LIBVND_NAMELEN	32
+
+typedef struct vnd_handle vnd_handle_t;
+
+extern vnd_handle_t *vnd_create(const char *, const char *, const char *,
+    vnd_errno_t *, int *);
+extern vnd_handle_t *vnd_open(const char *, const char *, vnd_errno_t *, int *);
+extern int vnd_unlink(vnd_handle_t *);
+extern void vnd_close(vnd_handle_t *);
+extern vnd_errno_t vnd_errno(vnd_handle_t *);
+extern int vnd_syserrno(vnd_handle_t *);
+extern const char *vnd_strerror(vnd_errno_t);
+extern const char *vnd_strsyserror(int);
+
+extern int vnd_pollfd(vnd_handle_t *);
+
+typedef struct vnd_info {
+	uint32_t vi_version;
+	zoneid_t vi_zone;
+	char vi_name[LIBVND_NAMELEN];
+	char vi_datalink[LIBVND_NAMELEN];
+} vnd_info_t;
+
+typedef int (*vnd_walk_cb_t)(vnd_info_t *, void *);
+extern int vnd_walk(vnd_walk_cb_t, void *, vnd_errno_t *, int *);
+
+typedef enum vnd_prop {
+	VND_PROP_RXBUF = 0,
+	VND_PROP_TXBUF,
+	VND_PROP_MAXBUF,
+	VND_PROP_MINTU,
+	VND_PROP_MAXTU,
+	VND_PROP_MAX
+} vnd_prop_t;
+
+typedef struct vnd_prop_buf {
+	uint64_t vpb_size;
+} vnd_prop_buf_t;
+
+extern int vnd_prop_get(vnd_handle_t *, vnd_prop_t, void *, size_t);
+extern int vnd_prop_set(vnd_handle_t *, vnd_prop_t, void *, size_t);
+extern int vnd_prop_writeable(vnd_prop_t, boolean_t *);
+
+typedef int (*vnd_prop_iter_f)(vnd_handle_t *, vnd_prop_t, void *);
+extern int vnd_prop_iter(vnd_handle_t *, vnd_prop_iter_f, void *);
+
+extern int vnd_frameio_read(vnd_handle_t *, frameio_t *);
+extern int vnd_frameio_write(vnd_handle_t *, frameio_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBVND_H */
diff --git a/usr/src/lib/libvnd/common/llib-lvnd b/usr/src/lib/libvnd/common/llib-lvnd
new file mode 100644
index 0000000000..80a4229e32
--- /dev/null
+++ b/usr/src/lib/libvnd/common/llib-lvnd
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+#include <libvnd.h>
diff --git a/usr/src/lib/libvnd/common/mapfile-vers b/usr/src/lib/libvnd/common/mapfile-vers
new file mode 100644
index 0000000000..0eb862ab60
--- /dev/null
+++ b/usr/src/lib/libvnd/common/mapfile-vers
@@ -0,0 +1,55 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+#
+# TODO When this makes it into illumos we should make it a public interface
+#
+SYMBOL_VERSION ILLUMOSprivate {
+	global:
+		vnd_create;
+		vnd_close;
+		vnd_errno;
+		vnd_frameio_read;
+		vnd_frameio_write;
+		vnd_open;
+		vnd_pollfd;
+		vnd_prop_get;
+		vnd_prop_iter;
+		vnd_prop_set;
+		vnd_prop_writeable;
+		vnd_strerror;
+		vnd_strsyserror;
+		vnd_syserrno;
+		vnd_unlink;
+		vnd_walk;
+	local:
+		*;
+};
diff --git a/usr/src/lib/libvnd/i386/Makefile b/usr/src/lib/libvnd/i386/Makefile
new file mode 100644
index 0000000000..41e699e8f8
--- /dev/null
+++ b/usr/src/lib/libvnd/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libzdoor/Makefile b/usr/src/lib/libzdoor/Makefile
new file mode 100644
index 0000000000..50d9545ef1
--- /dev/null
+++ b/usr/src/lib/libzdoor/Makefile
@@ -0,0 +1,48 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2011 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+include		../Makefile.lib
+
+SUBDIRS=	$(MACH)
+$(BUILD64)SUBDIRS += $(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+_msg:
+
+FRC:
+
+include ../Makefile.targ
diff --git a/usr/src/lib/libzdoor/Makefile.com b/usr/src/lib/libzdoor/Makefile.com
new file mode 100644
index 0000000000..09bde0f1b4
--- /dev/null
+++ b/usr/src/lib/libzdoor/Makefile.com
@@ -0,0 +1,50 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright 2011 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+LIBRARY=	libzdoor.a
+VERS=		.1
+OBJECTS=	zdoor.o		\
+		zdoor-int.o	\
+		ztree.o		\
+		zerror.o
+
+include ../../Makefile.lib
+include	../../Makefile.rootfs
+
+SRCDIR =	../common
+SRCS =	$(OBJECTS:%.o=$(SRCDIR)/%.c)
+
+CPPFLAGS +=	-I$(SRCDIR) -D_REENTRANT -D_FILE_OFFSET_BITS=64
+LIBS =		$(DYNLIB) $(LINTLIB)
+LDLIBS +=	-lc -lzonecfg -lcontract
+
+$(LINTLIB) :=	SRCS=	$(SRCDIR)/$(LINTSRC)
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/libzdoor/amd64/Makefile b/usr/src/lib/libzdoor/amd64/Makefile
new file mode 100644
index 0000000000..31be0ef7e6
--- /dev/null
+++ b/usr/src/lib/libzdoor/amd64/Makefile
@@ -0,0 +1,32 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2011 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/libzdoor/common/llib-lzdoor b/usr/src/lib/libzdoor/common/llib-lzdoor
new file mode 100644
index 0000000000..a21a904b11
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/llib-lzdoor
@@ -0,0 +1,34 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License, Version 1.0 only
+ * (the "License").  You may not use this file except in compliance
+ * with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*LINTLIBRARY*/
+/*PROTOLIB1*/
+/*
+ *
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ *
+ */
+
+#pragma ident   "%Z%%M% %I%     %E% SMI"
+
+#include <sys/types.h>
+#include <zdoor.h>
diff --git a/usr/src/lib/libzdoor/common/mapfile-vers b/usr/src/lib/libzdoor/common/mapfile-vers
new file mode 100644
index 0000000000..38eba57ee2
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/mapfile-vers
@@ -0,0 +1,48 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2011, Joyent Inc. All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate_1.1 {
+    global:
+	zdoor_handle_init;
+	zdoor_handle_destroy;
+	zdoor_open;
+	zdoor_close;
+    local:
+	*;
+};
diff --git a/usr/src/lib/libzdoor/common/zdoor-int.c b/usr/src/lib/libzdoor/common/zdoor-int.c
new file mode 100644
index 0000000000..f77c1453d4
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/zdoor-int.c
@@ -0,0 +1,324 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2012 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/fork.h>
+#include <libcontract.h>
+#include <libzonecfg.h>
+#include <sys/contract/process.h>
+#include <sys/ctfs.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "zdoor-int.h"
+#include "zerror.h"
+
+#define	ZDOOR_FMT_STR	"/var/tmp/.%s"
+
+
+static int
+init_template(void)
+{
+	int fd = 0;
+	int err = 0;
+
+	fd = open64(CTFS_ROOT "/process/template", O_RDWR);
+	if (fd == -1)
+		return (-1);
+
+	err |= ct_tmpl_set_critical(fd, 0);
+	err |= ct_tmpl_set_informative(fd, 0);
+	err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR);
+	err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT);
+	if (err || ct_tmpl_activate(fd)) {
+		(void) close(fd);
+		return (-1);
+	}
+
+	return (fd);
+}
+
+static int
+contract_latest(ctid_t *id)
+{
+	int cfd = 0;
+	int r = 0;
+	ct_stathdl_t st = {0};
+	ctid_t result = {0};
+
+	if ((cfd = open64(CTFS_ROOT "/process/latest", O_RDONLY)) == -1)
+		return (errno);
+	if ((r = ct_status_read(cfd, CTD_COMMON, &st)) != 0) {
+		(void) close(cfd);
+		return (r);
+	}
+
+	result = ct_status_get_id(st);
+	ct_status_free(st);
+	(void) close(cfd);
+
+	*id = result;
+	return (0);
+}
+
+static int
+close_on_exec(int fd)
+{
+	int flags = fcntl(fd, F_GETFD, 0);
+	if ((flags != -1) && (fcntl(fd, F_SETFD, flags | FD_CLOEXEC) != -1))
+		return (0);
+	return (-1);
+}
+
+static int
+contract_open(ctid_t ctid, const char *type, const char *file, int oflag)
+{
+	char path[PATH_MAX];
+	int n = 0;
+	int fd = 0;
+
+	if (type == NULL)
+		type = "all";
+
+	n = snprintf(path, PATH_MAX, CTFS_ROOT "/%s/%ld/%s", type, ctid, file);
+	if (n >= sizeof (path)) {
+		errno = ENAMETOOLONG;
+		return (-1);
+	}
+
+	fd = open64(path, oflag);
+	if (fd != -1) {
+		if (close_on_exec(fd) == -1) {
+			int err = errno;
+			(void) close(fd);
+			errno = err;
+			return (-1);
+		}
+	}
+	return (fd);
+}
+
+static int
+contract_abandon_id(ctid_t ctid)
+{
+	int fd = 0;
+	int err = 0;
+
+	fd = contract_open(ctid, "all", "ctl", O_WRONLY);
+	if (fd == -1)
+		return (errno);
+
+	err = ct_ctl_abandon(fd);
+	(void) close(fd);
+
+	return (err);
+}
+
+/*
+ * zdoor_fattach(zone,service,door,detach_only) is heavily borrowed from
+ * zonestatd.  Basically this forks, zone_enter's the targeted zone,
+ * fattaches to /var/tmp/.<service> with the door you've opened.
+ * detach_only gets passed in on door_stop to fdetach in the targeted zone.
+ * Note that this code really does require all the contract calls, which are
+ * all the static functions preceding this (have a look at zone_enter; without
+ * that code zone_enter will kick back EINVAL).
+ */
+int
+zdoor_fattach(zoneid_t zoneid, const char *service, int door, int detach_only)
+{
+	int fd = 0;
+	int len = 0;
+	int pid = 0;
+	int stat = 0;
+	int tmpl_fd = 0;
+	char path[MAXPATHLEN] = {0};
+	ctid_t ct = -1;
+
+	if (zoneid < 0) {
+		zdoor_debug("zdoor_fattach: zoneid < 0");
+		return (ZDOOR_ARGS_ERROR);
+	}
+
+	if (service == NULL) {
+		zdoor_debug("zdoor_fattach: NULL service");
+		return (ZDOOR_ARGS_ERROR);
+	}
+
+	if ((tmpl_fd = init_template()) < 0) {
+		zdoor_warn("zdoor_fattach: init contract for %d:%s failed",
+		    zoneid, service);
+		return (ZDOOR_ERROR);
+	}
+
+	len = snprintf(NULL, 0, ZDOOR_FMT_STR, service) + 1;
+	if (len > MAXPATHLEN)
+		return (ZDOOR_ARGS_ERROR);
+	(void) snprintf(path, len, ZDOOR_FMT_STR, service);
+
+	zdoor_info("zdoor_fattach: ensuring %s", path);
+
+	pid = fork();
+	if (pid < 0) {
+		(void) ct_tmpl_clear(tmpl_fd);
+		zdoor_error("zdoor_fattach: unable to fork for zone_enter: %s",
+		    strerror(errno));
+		return (ZDOOR_OK);
+	}
+
+	if (pid == 0) {
+		zdoor_debug("zdoor_fattach(CHILD): starting");
+		(void) ct_tmpl_clear(tmpl_fd);
+		(void) close(tmpl_fd);
+		if (zone_enter(zoneid) != 0) {
+			zdoor_debug("zdoor_fattach(CHILD): zone_enter fail %s",
+			    strerror(errno));
+			if (errno == EINVAL) {
+				_exit(0);
+			}
+			_exit(1);
+		}
+		(void) fdetach(path);
+		(void) unlink(path);
+		if (detach_only) {
+			zdoor_debug("zdoor_fattach(CHILD): detach only, done");
+			_exit(0);
+		}
+		fd = open(path, O_CREAT|O_RDWR, 0644);
+		if (fd < 0) {
+			zdoor_debug("zdoor_fattach(CHILD): open failed: %s",
+			    strerror(errno));
+			_exit(2);
+		}
+		if (fattach(door, path) != 0) {
+			zdoor_debug("zdoor_fattach(CHILD): fattach failed: %s",
+			    strerror(errno));
+			_exit(3);
+		}
+		_exit(0);
+	}
+	if (contract_latest(&ct) == -1)
+		ct = -1;
+	(void) ct_tmpl_clear(tmpl_fd);
+	(void) close(tmpl_fd);
+	(void) contract_abandon_id(ct);
+
+	zdoor_debug("zdoor_fattach: waiting for child...");
+	while (waitpid(pid, &stat, 0) != pid)
+		;
+	if (WIFEXITED(stat) && WEXITSTATUS(stat) == 0) {
+		zdoor_debug("   child exited with success");
+		zdoor_debug("zdoor_fattach: returning ZDOOR_OK");
+		return (ZDOOR_OK);
+	}
+
+	zdoor_debug("   child exited with %d", WEXITSTATUS(stat));
+	zdoor_debug("zdoor_fattach: returning ZDOOR_ERROR");
+	return (ZDOOR_ERROR);
+}
+
+/*
+ * zdoor_zone_is_running(zone) returns 1 if the specified zone is running, or 0
+ * if it is any other state. It additionally eats any other errors it
+ * encounters and returns 0 upon encountering them.
+ */
+boolean_t
+zdoor_zone_is_running(zoneid_t zoneid)
+{
+	zone_state_t state;
+	char zone[ZONENAME_MAX];
+	if (zoneid < 0)
+		return (B_FALSE);
+
+	if (getzonenamebyid(zoneid, zone, ZONENAME_MAX) < 0)
+		return (B_FALSE);
+
+	if (!zone_get_state((char *)zone, &state) == Z_OK)
+		return (B_FALSE);
+
+	return (state == ZONE_STATE_RUNNING);
+}
+
+/*
+ * zdoor_cookie_create simply allocates and initializes
+ * memory.  Returns NULL on any error.
+ */
+zdoor_cookie_t *
+zdoor_cookie_create(const char *zonename, const char *service,
+const void *biscuit)
+{
+	zdoor_cookie_t *cookie = NULL;
+
+	if (zonename == NULL || service == NULL)
+		return (NULL);
+
+	cookie = (zdoor_cookie_t *)calloc(1, sizeof (zdoor_cookie_t));
+	if (cookie == NULL) {
+		OUT_OF_MEMORY();
+		return (NULL);
+	}
+	cookie->zdc_biscuit = (void *)biscuit;
+	cookie->zdc_zonename = strdup((char *)zonename);
+	if (cookie->zdc_zonename == NULL) {
+		zdoor_cookie_free(cookie);
+		OUT_OF_MEMORY();
+		return (NULL);
+	}
+	cookie->zdc_service = strdup((char *)service);
+	if (cookie->zdc_service == NULL) {
+		zdoor_cookie_free(cookie);
+		OUT_OF_MEMORY();
+		return (NULL);
+	}
+
+	return (cookie);
+}
+
+/*
+ * zdoor_cookie_free(cookie) cleans up any memory associated with the
+ * specified cookie.
+ */
+void
+zdoor_cookie_free(zdoor_cookie_t *cookie)
+{
+	if (cookie == NULL)
+		return;
+
+	if (cookie->zdc_zonename != NULL) {
+		free(cookie->zdc_zonename);
+		cookie->zdc_zonename = NULL;
+	}
+
+	if (cookie->zdc_service != NULL) {
+		free(cookie->zdc_service);
+		cookie->zdc_service = NULL;
+	}
+
+	free(cookie);
+}
diff --git a/usr/src/lib/libzdoor/common/zdoor-int.h b/usr/src/lib/libzdoor/common/zdoor-int.h
new file mode 100644
index 0000000000..782452c426
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/zdoor-int.h
@@ -0,0 +1,64 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef _ZDOOR_INT_H
+#define	_ZDOOR_INT_H
+
+#pragma ident "%Z%%M% %I% %E% SMI"
+
+#include <pthread.h>
+#include <zdoor.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum zdoor_action_t {
+	ZDOOR_ACTION_NOOP,
+	ZDOOR_ACTION_STOP,
+	ZDOOR_ACTION_START
+} zdoor_action_t;
+
+struct zdoor_handle {
+	pthread_mutex_t zdh_lock;
+	void *zdh_zonecfg_handle;
+	void *zdh_ztree;
+};
+
+zdoor_cookie_t *zdoor_cookie_create(const char *zonename, const char *service,
+	const void *biscuit);
+
+void zdoor_cookie_free(zdoor_cookie_t *cookie);
+
+boolean_t zdoor_zone_is_running(zoneid_t zoneid);
+
+int zdoor_fattach(zoneid_t zoneid, const char *service, int door,
+	int detach_only);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _ZDOOR_INT_H */
diff --git a/usr/src/lib/libzdoor/common/zdoor.c b/usr/src/lib/libzdoor/common/zdoor.c
new file mode 100644
index 0000000000..f2996b4e2d
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/zdoor.c
@@ -0,0 +1,437 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#pragma ident "%Z%%M% %I% %E% SMI"
+
+#include <alloca.h>
+#include <door.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <libzonecfg.h>
+#include <pthread.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <syslog.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stropts.h>
+#include <unistd.h>
+#include <zdoor.h>
+#include <zone.h>
+
+#include "zdoor-int.h"
+#include "zerror.h"
+#include "ztree.h"
+
+extern void *
+zonecfg_notify_bind(int(*func)(const char *zonename, zoneid_t zid,
+		    const char *newstate, const char *oldstate,
+		    hrtime_t when, void *p), void *p);
+
+extern void
+zonecfg_notify_unbind(void *handle);
+
+/*
+ * _callback(cookie, door_args...) is our private function that we tell
+ * the Solaris door API about.  This function does some sanity checking on
+ * arguments and issues a callback to the owner of this door.  That API
+ * will return us memory that needs to be sent back to the client on the
+ * other end of the door, but since the door_return API never gives you
+ * back control of the function, this does a simple alloca/memcpy and
+ * frees up the memory pointed to by the parent.  While this really doesn't
+ * let a client do much other than pass a simple struct of primitives (or
+ * more likely more common a char *), that's the way the door API works,
+ * and so this isn't really imposing any restriction that didn't already
+ * need to be dealt with by someone.  This is why the zdoor_result structure
+ * takes a char *, rather than a void * for the data pointer.
+ */
+static void
+_callback(void *cookie, char *argp, size_t arg_size, door_desc_t *dp,
+	uint_t n_desc)
+{
+	zdoor_result_t *result = NULL;
+	void *door_response = NULL;
+	int size = 0;
+	dtree_entry_t *entry = (dtree_entry_t *)cookie;
+
+	if (entry == NULL) {
+		zdoor_warn("_callback: NULL cookie? door_returning");
+		(void) door_return(NULL, 0, NULL, 0);
+	}
+
+	(void) pthread_mutex_lock(&entry->dte_parent->zte_parent->zdh_lock);
+	zdoor_debug("_callback: calling back with %p", entry->dte_cookie);
+	result = entry->dte_callback(entry->dte_cookie, argp, arg_size);
+	zdoor_debug("_callback: app callback returned %p", result);
+	(void) pthread_mutex_unlock(&entry->dte_parent->zte_parent->zdh_lock);
+
+	if (result == NULL) {
+		zdoor_debug("_callback: door_returning NULL");
+		(void) door_return(NULL, 0, NULL, 0);
+	}
+
+	if (result->zdr_data != NULL && result->zdr_size > 0) {
+		door_response = alloca(result->zdr_size);
+		if (door_response != NULL) {
+			size = result->zdr_size;
+			(void) memcpy(door_response,
+				(void *) result->zdr_data, size);
+		}
+	}
+
+	if (result->zdr_data != NULL)
+		free(result->zdr_data);
+	free(result);
+
+	zdoor_debug("_callback: door_returning %p, %d", door_response, size);
+	(void) door_return(door_response, size, NULL, 0);
+}
+
+static void
+zdoor_stop(dtree_entry_t *entry)
+{
+	zoneid_t zid = -1;
+
+	if (entry == NULL) {
+		zdoor_debug("zdoor_stop: NULL arguments");
+		return;
+	}
+
+	zdoor_debug("zdoor_stop: entry=%p, zone=%s, service=%s",
+	    entry, entry->dte_parent->zte_zonename, entry->dte_service);
+
+	zid = getzoneidbyname(entry->dte_parent->zte_zonename);
+	(void) zdoor_fattach(zid, entry->dte_service, entry->dte_door, 1);
+	(void) door_revoke(entry->dte_door);
+	entry->dte_door = -1;
+
+	zdoor_debug("zdoor_stop returning");
+}
+
+/*
+ * zdoor_create is called both by the main API
+ * call zdoor_open, as well as by the zone_monitor code upon a zone restart
+ * (assuming it already has a door in it).  This code assumes that the
+ * permissions were correct (e.g., the target door is not a GZ, that this
+ * program is being run out of the GZ), but does not assume that the target
+ * door file has not changed out from under us, so that is explicitly rechecked.
+ *
+ * This also assumes the parent has already locked handle.
+ */
+static int
+zdoor_create(dtree_entry_t *entry)
+{
+	int status = ZDOOR_OK;
+	zoneid_t zid = -1;
+	zdoor_handle_t handle = NULL;
+
+	if (entry == NULL) {
+		zdoor_debug("zdoor_create: NULL arguments");
+		return (ZDOOR_ARGS_ERROR);
+	}
+
+	zdoor_debug("zdoor_create: entry=%p, zone=%s, service=%s",
+	    entry, entry->dte_parent->zte_zonename, entry->dte_service);
+
+	handle = entry->dte_parent->zte_parent;
+
+	zid = getzoneidbyname(entry->dte_parent->zte_zonename);
+	if (zid < 0) {
+		zdoor_info("zdoor_create: %s is a non-existient zone",
+		    entry->dte_parent->zte_zonename);
+		return (ZDOOR_ERROR);
+	}
+	if (!zdoor_zone_is_running(zid)) {
+		zdoor_debug("zdoor_create: %s is not running",
+		    entry->dte_parent->zte_zonename);
+		return (ZDOOR_ZONE_NOT_RUNNING);
+	}
+
+	entry->dte_door = door_create(_callback, entry, 0);
+	zdoor_info("zdoor_create: door_create returned %d", entry->dte_door);
+	if (entry->dte_door < 0) {
+		zdoor_stop(entry);
+		return (ZDOOR_ERROR);
+	}
+
+	status = zdoor_fattach(zid, entry->dte_service, entry->dte_door, 0);
+
+	zdoor_debug("zdoor_create: returning %d", status);
+	return (status);
+}
+
+
+/*
+ * door_visitor(entry) is a callback from the ztree code that checks whether
+ * or not we should be taking some action on a given door.  Note that the
+ * callpath to this API is:
+ *  SYSTEM ->
+ *    zone_monitor ->
+ *      ztree_walk ->
+ *        door_visitor
+ *
+ * Which is important to note that this API assumes that all things needing
+ * locking are locked by a parent caller (which is the zone_monitor).
+ */
+static void
+zdoor_visitor(dtree_entry_t *entry)
+{
+	if (entry == NULL) {
+		zdoor_info("zdoor_visitor: entered with NULL entry");
+		return;
+	}
+
+	zdoor_debug("zdoor_visitor: entered for entry=%p, service=%s",
+	    entry, entry->dte_service);
+
+	if (entry->dte_parent->zte_action == ZDOOR_ACTION_STOP) {
+		zdoor_debug("  stopping zdoor");
+		zdoor_stop(entry);
+	} else if (entry->dte_parent->zte_action == ZDOOR_ACTION_START) {
+		zdoor_debug("  starting zdoor");
+		if (zdoor_create(entry) != ZDOOR_OK) {
+			zdoor_error("door_visitor: Unable to restart zdoor\n");
+		}
+	}
+}
+
+/*
+ * zone_monitor(zonename, zid, newstate, oldstate, when, cookie) is our
+ * registered callback with libzonecfg to notify us of any changes to a
+ * given zone.  This activates a walk on all doors for a zone iff the state
+ * is changing from running or into running.
+ */
+static int
+zone_monitor(const char *zonename, zoneid_t zid, const char *newstate,
+	const char *oldstate, hrtime_t when, void *p)
+{
+	zdoor_handle_t handle = (zdoor_handle_t)p;
+	ztree_entry_t *entry = NULL;
+
+	if (handle == NULL) {
+		zdoor_warn("zone_monitor: entered with NULL handle?");
+		return (-1);
+	}
+
+	zdoor_info("zone_monitor: zone=%s, zid=%d, newst=%s, oldst=%s, p=%p",
+	    zonename, zid, newstate, oldstate, p);
+
+	(void) pthread_mutex_lock(&(handle->zdh_lock));
+	entry = ztree_zone_find(handle, zonename);
+	if (entry != NULL) {
+		zdoor_debug("  found entry in ztree");
+		entry->zte_action = ZDOOR_ACTION_NOOP;
+		if (strcmp("running", newstate) == 0) {
+			if (strcmp("ready", oldstate) == 0)
+				entry->zte_action = ZDOOR_ACTION_START;
+		} else if (strcmp("shutting_down", newstate) == 0) {
+			if (strcmp("running", oldstate) == 0)
+				entry->zte_action = ZDOOR_ACTION_STOP;
+		}
+		zdoor_debug("    set state to: %d", entry->zte_action);
+		if (entry->zte_action != ZDOOR_ACTION_NOOP)
+			ztree_walk_doors(handle, zonename);
+	}
+	(void) pthread_mutex_unlock(&(handle->zdh_lock));
+
+	zdoor_info("zone_monitor: returning");
+	return (0);
+}
+
+zdoor_handle_t
+zdoor_handle_init()
+{
+	zdoor_handle_t handle = NULL;
+
+	zdoor_debug("zdoor_handle_init entered");
+
+	handle = (zdoor_handle_t)calloc(1, sizeof (struct zdoor_handle));
+	if (handle == NULL) {
+		OUT_OF_MEMORY();
+		return (NULL);
+	}
+
+	(void) pthread_mutex_init(&(handle->zdh_lock), NULL);
+	handle->zdh_zonecfg_handle = zonecfg_notify_bind(zone_monitor, handle);
+	if (handle->zdh_zonecfg_handle == NULL) {
+		zdoor_error("zonecfg_notify_bind failure: %s", strerror(errno));
+		return (NULL);
+	}
+
+	zdoor_debug("zdoor_handle_init returning %p", handle);
+	return (handle);
+}
+
+void
+zdoor_handle_destroy(zdoor_handle_t handle)
+{
+	if (handle == NULL) {
+		zdoor_debug("zdoor_handle_destroy: NULL arguments");
+		return;
+	}
+
+	zdoor_debug("zdoor_handle_destroy: handle=%p", handle);
+
+	(void) pthread_mutex_lock(&(handle->zdh_lock));
+	zonecfg_notify_unbind(handle->zdh_zonecfg_handle);
+	(void) pthread_mutex_unlock(&(handle->zdh_lock));
+	(void) pthread_mutex_destroy(&(handle->zdh_lock));
+	free(handle);
+}
+
+/*
+ * zdoor_open(zone, service, biscuit, callback) is the main public facing API in
+ * libzdoor.  It will open a door with the name .[service] under
+ * [zonepath]/root/var/tmp, where [zonepath] is resolved on the fly.  Note this
+ * API can only be invoked from the global zone, and will not allow you to open
+ * a zdoor in the global zone.
+ */
+int
+zdoor_open(zdoor_handle_t handle, const char *zonename, const char *service,
+	void *biscuit, zdoor_callback callback)
+{
+	zdoor_cookie_t *zdoor_cookie = NULL;
+	int rc = -1;
+	int status = ZDOOR_OK;
+	zoneid_t zid = -1;
+	dtree_entry_t *entry = NULL;
+
+	if (handle == NULL || zonename == NULL ||
+	    service == NULL || callback == NULL) {
+		zdoor_debug("zdoor_open: NULL arguments");
+		return (ZDOOR_ARGS_ERROR);
+	}
+	zdoor_debug("zdoor_open: entered: handle=%p, zone=%s, service=%s",
+	    handle, zonename, service);
+
+	if (getzoneid() != GLOBAL_ZONEID) {
+		zdoor_warn("zdoor_open: not invoked from global zone");
+		return (ZDOOR_NOT_GLOBAL_ZONE);
+	}
+
+
+	zid = getzoneidbyname(zonename);
+	if (zid < 0) {
+		zdoor_info("zdoor_open: %s is a non-existent zone", zonename);
+		return (ZDOOR_ARGS_ERROR);
+	}
+
+	if (zid == GLOBAL_ZONEID) {
+		zdoor_warn("zdoor_open: zdoors not allowed in global zone");
+		return (ZDOOR_ZONE_FORBIDDEN);
+	}
+
+	if (!zdoor_zone_is_running(zid)) {
+		zdoor_info("zdoor_open: %s is not running", zonename);
+		return (ZDOOR_ZONE_NOT_RUNNING);
+	}
+
+	zdoor_cookie = zdoor_cookie_create(zonename, service, biscuit);
+	if (zdoor_cookie == NULL) {
+		OUT_OF_MEMORY();
+		return (ZDOOR_OUT_OF_MEMORY);
+	}
+
+	(void) pthread_mutex_lock(&(handle->zdh_lock));
+	rc = ztree_zone_add(handle, zonename, zdoor_visitor);
+	if (rc != ZTREE_SUCCESS && rc != ZTREE_ALREADY_EXISTS) {
+		zdoor_debug("zdoor_open: unable to add zone to ztree: %d", rc);
+		status = ZDOOR_ERROR;
+		goto out;
+	}
+	rc = ztree_door_add(handle, zonename, service, callback,
+	    zdoor_cookie);
+	if (rc != ZTREE_SUCCESS) {
+		zdoor_debug("zdoor_open: unable to add door to ztree: %d", rc);
+		if (rc == ZTREE_ALREADY_EXISTS) {
+			zdoor_warn("service %s already has a zdoor", service);
+		}
+		status = ZDOOR_ERROR;
+		goto out;
+	}
+
+	entry = ztree_door_find(handle, zonename, service);
+	if (entry == NULL) {
+		zdoor_debug("zdoor_open: unable to find door in ztree?");
+		status = ZDOOR_ERROR;
+		goto out;
+	}
+	if (zdoor_create(entry) != ZDOOR_OK) {
+		zdoor_info("zdoor_open: zdoor_create failed.");
+		status = ZDOOR_ERROR;
+		goto out;
+	}
+out:
+	if (status != ZDOOR_OK) {
+		zdoor_debug("zdoor_open: status not ok, stopping and cleaning");
+		zdoor_stop(entry);
+		ztree_door_remove(handle, entry);
+		zdoor_cookie_free(zdoor_cookie);
+	}
+	(void) pthread_mutex_unlock(&(handle->zdh_lock));
+	zdoor_debug("zdoor_open: returning %d", status);
+	return (status);
+}
+
+/*
+ * zdoor_close(zone, service) unregisters a previously created zdoor, and
+ * returns the biscuit provided at creation time, so the caller can free it.
+ * Returns NULL on any error.
+ */
+void *
+zdoor_close(zdoor_handle_t handle, const char *zonename, const char *service)
+{
+	dtree_entry_t *entry = NULL;
+	zdoor_cookie_t *cookie = NULL;
+	void *biscuit = NULL;
+
+	if (handle == NULL || zonename == NULL || service == NULL) {
+		zdoor_debug("zdoor_close: NULL arguments");
+		return (NULL);
+	}
+
+	zdoor_debug("zdoor_close: entered handle=%p, zone=%s, service=%s",
+	    handle, zonename, service);
+
+	(void) pthread_mutex_lock(&(handle->zdh_lock));
+
+	entry = ztree_door_find(handle, zonename, service);
+	if (entry != NULL) {
+		zdoor_debug("zdoor_close: found door in ztree, stopping");
+		zdoor_stop(entry);
+		cookie = ztree_door_remove(handle, entry);
+		if (cookie != NULL) {
+			biscuit = cookie->zdc_biscuit;
+			zdoor_cookie_free(cookie);
+		}
+	} else {
+		zdoor_debug("zdoor_close: didn't find door in ztree");
+	}
+
+	(void) pthread_mutex_unlock(&(handle->zdh_lock));
+
+	zdoor_debug("zdoor_close: returning %p", biscuit);
+	return (biscuit);
+}
diff --git a/usr/src/lib/libzdoor/common/zerror.c b/usr/src/lib/libzdoor/common/zerror.c
new file mode 100644
index 0000000000..5ccb449e1b
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/zerror.c
@@ -0,0 +1,117 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#include <pthread.h>
+#include <sys/types.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "zerror.h"
+
+static const char *PREFIX = "%s ZDOOR:%s:T(%d): ";
+
+static const char *DEBUG_ENV_VAR = "ZDOOR_TRACE";
+
+static boolean_t
+is_debug_enabled()
+{
+	boolean_t enabled = B_FALSE;
+	const char *_envp = getenv(DEBUG_ENV_VAR);
+	if (_envp != NULL && atoi(_envp) >= 2)
+		enabled = B_TRUE;
+
+	return (enabled);
+}
+
+static boolean_t
+is_info_enabled()
+{
+	boolean_t enabled = B_FALSE;
+	const char *_envp = getenv(DEBUG_ENV_VAR);
+	if (_envp != NULL && atoi(_envp) >= 1)
+		enabled = B_TRUE;
+
+	return (enabled);
+}
+
+void
+zdoor_debug(const char *fmt, ...)
+{
+	va_list alist;
+
+	if (!is_debug_enabled())
+		return;
+
+	va_start(alist, fmt);
+
+	(void) fprintf(stderr, PREFIX, __TIME__, "DEBUG", pthread_self());
+	(void) vfprintf(stderr, fmt, alist);
+	(void) fprintf(stderr, "\n");
+	va_end(alist);
+}
+
+void
+zdoor_info(const char *fmt, ...)
+{
+	va_list alist;
+
+	if (!is_info_enabled())
+		return;
+
+	va_start(alist, fmt);
+
+	(void) fprintf(stderr, PREFIX, __TIME__, "INFO", pthread_self());
+	(void) vfprintf(stderr, fmt, alist);
+	(void) fprintf(stderr, "\n");
+	va_end(alist);
+}
+
+void
+zdoor_warn(const char *fmt, ...)
+{
+	va_list alist;
+
+	va_start(alist, fmt);
+
+	(void) fprintf(stderr, PREFIX, __TIME__, "WARN", pthread_self());
+	(void) vfprintf(stderr, fmt, alist);
+	(void) fprintf(stderr, "\n");
+	va_end(alist);
+}
+
+void
+zdoor_error(const char *fmt, ...)
+{
+	va_list alist;
+
+	va_start(alist, fmt);
+
+	(void) fprintf(stderr, PREFIX, __TIME__, "ERROR", pthread_self());
+	(void) vfprintf(stderr, fmt, alist);
+	(void) fprintf(stderr, "\n");
+	va_end(alist);
+}
diff --git a/usr/src/lib/libzdoor/common/zerror.h b/usr/src/lib/libzdoor/common/zerror.h
new file mode 100644
index 0000000000..afc848fcea
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/zerror.h
@@ -0,0 +1,48 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef _ZERROR_H
+#define	_ZERROR_H
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern void zdoor_debug(const char *fmt, ...);
+extern void zdoor_info(const char *fmt, ...);
+extern void zdoor_warn(const char *fmt, ...);
+extern void zdoor_error(const char *fmt, ...);
+
+#define	OUT_OF_MEMORY()	\
+	zdoor_error("Out of Memory at %s:%d", __FILE__, __LINE__)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _ZERROR_H */
diff --git a/usr/src/lib/libzdoor/common/ztree.c b/usr/src/lib/libzdoor/common/ztree.c
new file mode 100644
index 0000000000..25c67f62fb
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/ztree.c
@@ -0,0 +1,344 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#include <search.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "zerror.h"
+#include "ztree.h"
+
+
+/*
+ * ztree is just a helpful wrapper over a tsearch binary tree that deals with
+ * all of the libzdoor types.
+ *
+ * So what this ztree actually is is a tree of trees.  The outer tree is a tree
+ * of zones, and each node holds a tree of doors.
+ */
+
+/*
+ * _ztree_compare(p1, p2) is the tsearch callback for comparing the "outer"
+ * tree (e.g., the one of zones).
+ */
+static int
+_ztree_compare(const void *p1, const void *p2)
+{
+	ztree_entry_t *z1 = (ztree_entry_t *)p1;
+	ztree_entry_t *z2 = (ztree_entry_t *)p2;
+
+	if (z1 == NULL && z2 == NULL)
+		return (0);
+	if (z1 == NULL && z2 != NULL)
+		return (-1);
+	if (z1 != NULL && z2 == NULL)
+		return (1);
+
+	return (strcmp(z1->zte_zonename, z2->zte_zonename));
+}
+
+/*
+ * _dtree_compare(p1, p2) is the tsearch callback for comparing the "inner"
+ * tree (e.g., the one of doors).
+ */
+static int
+_dtree_compare(const void *p1, const void *p2)
+{
+	dtree_entry_t *d1 = (dtree_entry_t *)p1;
+	dtree_entry_t *d2 = (dtree_entry_t *)p2;
+
+	if (d1 == NULL && d2 == NULL)
+		return (0);
+	if (d1 == NULL && d2 != NULL)
+		return (-1);
+	if (d1 != NULL && d2 == NULL)
+		return (1);
+
+	return (strcmp(d1->dte_service, d2->dte_service));
+}
+
+static void
+ztree_entry_free(ztree_entry_t *entry)
+{
+	if (entry == NULL)
+		return;
+
+	if (entry->zte_zonename != NULL)
+		free(entry->zte_zonename);
+
+	free(entry);
+}
+
+static void
+dtree_entry_free(dtree_entry_t *entry)
+{
+	if (entry == NULL)
+		return;
+
+	if (entry->dte_service)
+		free(entry->dte_service);
+
+	free(entry);
+}
+
+
+/*
+ * ztree_zone_add inserts a new zone into the tree iff
+ * there is not already an entry for that zone.  This method returns one of
+ * four possible return codes, ZTREE_SUCCESS on :), ZTREE_ARGUMENT_ERROR if
+ * zone is NULL, ZTREE_ERROR if there is internal failure (e.g., OOM), and
+ * ZTREE_ALREADY_EXISTS if the zone is already in the tree.
+ */
+int
+ztree_zone_add(struct zdoor_handle *handle, const char *zonename,
+ztree_door_visitor visitor)
+{
+	ztree_entry_t *entry = NULL;
+	void *ret = NULL;
+	int status = ZTREE_SUCCESS;
+
+	if (handle == NULL || zonename == NULL)
+		return (ZTREE_ARGUMENT_ERROR);
+
+	entry = (ztree_entry_t *)calloc(1, sizeof (ztree_entry_t));
+	if (entry == NULL) {
+		OUT_OF_MEMORY();
+		return (ZTREE_ERROR);
+	}
+	entry->zte_zonename = strdup(zonename);
+	if (entry->zte_zonename == NULL) {
+		ztree_entry_free(entry);
+		OUT_OF_MEMORY();
+		return (ZTREE_ERROR);
+	}
+	entry->zte_action = ZDOOR_ACTION_NOOP;
+	entry->zte_parent = handle;
+	entry->zte_visitor = visitor;
+
+	ret = tsearch(entry, &(handle->zdh_ztree), _ztree_compare);
+	if (ret == NULL) {
+		ztree_entry_free(entry);
+		status = ZTREE_ERROR;
+		OUT_OF_MEMORY();
+	} else if ((*(ztree_entry_t **)ret) != entry) {
+		ztree_entry_free(entry);
+		status = ZTREE_ALREADY_EXISTS;
+	}
+
+	return (status);
+}
+
+
+/*
+ * ztree_zone_find returns the entry in the "outer" tree representing
+ * this zone, if it exists, NULL otherwise.
+ */
+ztree_entry_t *
+ztree_zone_find(struct zdoor_handle *handle, const char *zonename)
+{
+	ztree_entry_t key = {0};
+	void *ret = NULL;
+
+	if (handle == NULL || zonename == NULL)
+		return (NULL);
+
+	key.zte_zonename = (char *)zonename;
+	ret = tfind(&key, &(handle->zdh_ztree), _ztree_compare);
+
+	return (ret != NULL ? *(ztree_entry_t **)ret : NULL);
+}
+
+
+/*
+ * ztree_zone_remove removes an entry from the "outer" zone iff the
+ * zone exists.  The cookie set by the creator is returned.
+ */
+void
+ztree_zone_remove(struct zdoor_handle *handle, ztree_entry_t *entry)
+{
+	if (handle == NULL || entry == NULL)
+		return;
+
+	tdelete(entry, &(handle->zdh_ztree), _ztree_compare);
+	ztree_entry_free(entry);
+}
+
+
+/*
+ * ztree_door_add inserts a new door into the inner tree iff
+ * there is not already an entry for that door.  This method returns one of
+ * four possible return codes, ZTREE_SUCCESS on :), ZTREE_ARGUMENT_ERROR if
+ * zone is NULL, ZTREE_ERROR if there is internal failure (e.g., OOM), and
+ * ZTREE_ALREADY_EXISTS if the door is already in the tree.
+ */
+int
+ztree_door_add(struct zdoor_handle *handle, const char *zonename,
+const char *service, zdoor_callback callback, zdoor_cookie_t *cookie)
+{
+	dtree_entry_t *entry = NULL;
+	ztree_entry_t *znode = NULL;
+	void *ret = NULL;
+	int status = ZTREE_SUCCESS;
+
+	if (handle == NULL || zonename == NULL || service == NULL)
+		return (ZTREE_ARGUMENT_ERROR);
+
+	znode = ztree_zone_find(handle, zonename);
+	if (znode == NULL)
+		return (ZTREE_NOT_FOUND);
+
+	entry = (dtree_entry_t *)calloc(1, sizeof (dtree_entry_t));
+	if (entry == NULL) {
+		OUT_OF_MEMORY();
+		return (ZTREE_ERROR);
+	}
+	entry->dte_parent = znode;
+	entry->dte_callback = callback;
+	entry->dte_cookie = cookie;
+	entry->dte_service = strdup(service);
+	if (entry->dte_service == NULL) {
+		free(entry);
+		OUT_OF_MEMORY();
+		return (ZTREE_ERROR);
+	}
+
+	ret = tsearch(entry, &(znode->zte_door_tree), _dtree_compare);
+	if (ret == NULL) {
+		dtree_entry_free(entry);
+		OUT_OF_MEMORY();
+		status = ZTREE_ERROR;
+	} else if ((*(dtree_entry_t **)ret) != entry) {
+		dtree_entry_free(entry);
+		status = ZTREE_ALREADY_EXISTS;
+	} else {
+		znode->zte_num_doors++;
+	}
+
+	return (status);
+}
+
+
+/*
+ * ztree_door_find returns the entry in the "inner" tree
+ * representing this zone, if it exists, NULL otherwise.
+ */
+dtree_entry_t *
+ztree_door_find(struct zdoor_handle *handle, const char *zonename,
+const char *service)
+{
+	dtree_entry_t key = {0};
+	ztree_entry_t *znode = NULL;
+	void *ret = NULL;
+
+	if (handle == NULL || zonename == NULL || service == NULL)
+		return (NULL);
+
+	znode = ztree_zone_find(handle, zonename);
+	if (znode == NULL)
+		return (NULL);
+
+	key.dte_service = (char *)service;
+	ret = tfind(&key, &(znode->zte_door_tree), _dtree_compare);
+
+	return (ret != NULL ? *(dtree_entry_t **)ret : NULL);
+}
+
+
+/*
+ * ztree_door_remove(zone, door) removes a node from the inner tree iff
+ * both the door and zone exist.  Note this frees the node as well. The
+ * cookie set by the creator is returned.
+ */
+zdoor_cookie_t *
+ztree_door_remove(struct zdoor_handle *handle, dtree_entry_t *entry)
+{
+	zdoor_cookie_t *cookie = NULL;
+	ztree_entry_t *znode = NULL;
+
+	if (handle == NULL || entry == NULL)
+		return (NULL);
+
+	znode = entry->dte_parent;
+	cookie = entry->dte_cookie;
+
+	tdelete(entry, &(znode->zte_door_tree), _dtree_compare);
+	dtree_entry_free(entry);
+
+	znode->zte_num_doors--;
+	if (znode->zte_num_doors == 0) {
+		zdoor_debug("ztree: zone %s has no doors left, removing",
+		    znode->zte_zonename);
+		ztree_zone_remove(handle, znode);
+	}
+
+	return (cookie);
+}
+
+
+/*
+ * _ztree_door_visitor(nodep, which, depth) is the private function we use
+ * to wrap up tsearch's goofy API.  We're really just using this to ensure
+ * zdoor doesn't get called > 1 times for a given entity in the ztree.
+ */
+static void
+_ztree_door_visitor(const void *nodep, const VISIT which, const int depth)
+{
+	dtree_entry_t *entry = *(dtree_entry_t **)nodep;
+
+	if (entry == NULL)
+		return;
+
+	switch (which) {
+	case preorder:
+	case endorder:
+		break;
+	case postorder:
+	case leaf:
+		if (entry->dte_parent->zte_visitor != NULL)
+			entry->dte_parent->zte_visitor(entry);
+		break;
+	}
+}
+
+
+/*
+ * ztree_walk_doors(zone) will proceed to visit every node in the "inner" tree
+ * for this zone, and callback the visitor that was registered on tree creation.
+ */
+void
+ztree_walk_doors(struct zdoor_handle *handle, const char *zonename)
+{
+	ztree_entry_t *znode = NULL;
+
+	if (handle == NULL || zonename == NULL)
+		return;
+
+	znode = ztree_zone_find(handle, zonename);
+	if (znode == NULL)
+		return;
+
+	twalk(znode->zte_door_tree, _ztree_door_visitor);
+}
diff --git a/usr/src/lib/libzdoor/common/ztree.h b/usr/src/lib/libzdoor/common/ztree.h
new file mode 100644
index 0000000000..b46dace287
--- /dev/null
+++ b/usr/src/lib/libzdoor/common/ztree.h
@@ -0,0 +1,88 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef _ZTREE_H
+#define	_ZTREE_H
+
+#include <zdoor.h>
+#include <zone.h>
+#include "zdoor-int.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct dtree_entry;
+
+typedef void (*ztree_door_visitor)(struct dtree_entry *entry);
+
+typedef struct ztree_entry {
+	char *zte_zonename;
+	zdoor_action_t zte_action;
+	int zte_num_doors;
+	void *zte_door_tree;
+	ztree_door_visitor zte_visitor;
+	struct zdoor_handle *zte_parent;
+} ztree_entry_t;
+
+typedef struct dtree_entry {
+	char *dte_service;
+	int dte_door;
+	zdoor_callback dte_callback;
+	zdoor_cookie_t *dte_cookie;
+	ztree_entry_t *dte_parent;
+} dtree_entry_t;
+
+#define	ZTREE_SUCCESS		0
+#define	ZTREE_ERROR		-1
+#define	ZTREE_ARGUMENT_ERROR	-2
+#define	ZTREE_ALREADY_EXISTS	-3
+#define	ZTREE_NOT_FOUND		-4
+
+extern int ztree_zone_add(struct zdoor_handle *handle,
+	const char *zonename, ztree_door_visitor visitor);
+
+extern ztree_entry_t *ztree_zone_find(struct zdoor_handle *handle,
+	const char *zonename);
+
+extern void ztree_zone_remove(struct zdoor_handle *handle,
+	ztree_entry_t *entry);
+
+extern int ztree_door_add(struct zdoor_handle *handle, const char *zonename,
+	const char *service, zdoor_callback callback, zdoor_cookie_t *cookie);
+
+extern dtree_entry_t *ztree_door_find(struct zdoor_handle *handle,
+	const char *zonename, const char *service);
+
+extern zdoor_cookie_t *ztree_door_remove(struct zdoor_handle *handle,
+	dtree_entry_t *entry);
+
+extern void ztree_walk_doors(struct zdoor_handle *handle, const char *zonename);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _ZTREE_H */
diff --git a/usr/src/lib/libzdoor/i386/Makefile b/usr/src/lib/libzdoor/i386/Makefile
new file mode 100644
index 0000000000..2bfe8001d9
--- /dev/null
+++ b/usr/src/lib/libzdoor/i386/Makefile
@@ -0,0 +1,31 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2011 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/libzfs/common/libzfs.h b/usr/src/lib/libzfs/common/libzfs.h
index d296fed59f..92594c59a0 100644
--- a/usr/src/lib/libzfs/common/libzfs.h
+++ b/usr/src/lib/libzfs/common/libzfs.h
@@ -65,6 +65,7 @@ typedef enum zfs_error {
 	EZFS_PROPTYPE,		/* property does not apply to dataset type */
 	EZFS_PROPNONINHERIT,	/* property is not inheritable */
 	EZFS_PROPSPACE,		/* bad quota or reservation */
+	EZFS_PROPCACHED,	/* prop unavail since cachedprops flag set */
 	EZFS_BADTYPE,		/* dataset is not of appropriate type */
 	EZFS_BUSY,		/* pool or dataset is busy */
 	EZFS_EXISTS,		/* pool or dataset already exists */
@@ -207,6 +208,7 @@ extern libzfs_handle_t *zpool_get_handle(zpool_handle_t *);
 extern libzfs_handle_t *zfs_get_handle(zfs_handle_t *);
 
 extern void libzfs_print_on_error(libzfs_handle_t *, boolean_t);
+extern void libzfs_set_cachedprops(libzfs_handle_t *, boolean_t);
 
 extern void zfs_save_arguments(int argc, char **, char *, int);
 extern int zpool_log_history(libzfs_handle_t *, const char *);
diff --git a/usr/src/lib/libzfs/common/libzfs_dataset.c b/usr/src/lib/libzfs/common/libzfs_dataset.c
index 243565f463..9eeaa6a528 100644
--- a/usr/src/lib/libzfs/common/libzfs_dataset.c
+++ b/usr/src/lib/libzfs/common/libzfs_dataset.c
@@ -316,6 +316,10 @@ get_stats_ioctl(zfs_handle_t *zhp, zfs_cmd_t *zc)
 {
 	libzfs_handle_t *hdl = zhp->zfs_hdl;
 
+	if (hdl->libzfs_cachedprops &&
+	    libzfs_cmd_set_cachedprops(hdl, zc) != 0)
+		return (-1);
+
 	(void) strlcpy(zc->zc_name, zhp->zfs_name, sizeof (zc->zc_name));
 
 	while (ioctl(hdl->libzfs_fd, ZFS_IOC_OBJSET_STATS, zc) != 0) {
@@ -2177,6 +2181,11 @@ get_numeric_property(zfs_handle_t *zhp, zfs_prop_t prop, zprop_source_t *src,
 	case ZFS_PROP_NORMALIZE:
 	case ZFS_PROP_UTF8ONLY:
 	case ZFS_PROP_CASE:
+		if (zhp->zfs_hdl->libzfs_cachedprops) {
+			return (zfs_error(zhp->zfs_hdl, EZFS_PROPCACHED,
+			    "property unavailable since not cached"));
+		}
+
 		if (!zfs_prop_valid_for_type(prop, zhp->zfs_head_type) ||
 		    zcmd_alloc_dst_nvlist(zhp->zfs_hdl, &zc, 0) != 0)
 			return (-1);
@@ -2488,6 +2497,7 @@ zfs_prop_get(zfs_handle_t *zhp, zfs_prop_t prop, char *propbuf, size_t proplen,
 	const char *str;
 	const char *strval;
 	boolean_t received = zfs_is_recvd_props_mode(zhp);
+	boolean_t printerr;
 
 	/*
 	 * Check to see if this property applies to our object
@@ -2498,6 +2508,16 @@ zfs_prop_get(zfs_handle_t *zhp, zfs_prop_t prop, char *propbuf, size_t proplen,
 	if (received && zfs_prop_readonly(prop))
 		return (-1);
 
+	if (zhp->zfs_hdl->libzfs_cachedprops &&
+	    zfs_prop_cacheable(prop)) {
+		printerr = zhp->zfs_hdl->libzfs_printerr;
+		libzfs_print_on_error(zhp->zfs_hdl, B_FALSE);
+		(void) zfs_error(zhp->zfs_hdl, EZFS_PROPCACHED,
+		    "property unavailable since not cached");
+		libzfs_print_on_error(zhp->zfs_hdl, printerr);
+		return (-1);
+	}
+
 	if (src)
 		*src = ZPROP_SRC_NONE;
 
diff --git a/usr/src/lib/libzfs/common/libzfs_diff.c b/usr/src/lib/libzfs/common/libzfs_diff.c
index b47b669e80..d6cf32714d 100644
--- a/usr/src/lib/libzfs/common/libzfs_diff.c
+++ b/usr/src/lib/libzfs/common/libzfs_diff.c
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
- * Copyright (c) 2015, 2017 by Delphix. All rights reserved.
+ * Copyright (c) 2015 by Delphix. All rights reserved.
  * Copyright 2016 Joyent, Inc.
  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
  */
@@ -103,10 +103,7 @@ get_stats_for_obj(differ_info_t *di, const char *dsname, uint64_t obj,
 		return (0);
 	}
 
-	if (di->zerr == ESTALE) {
-		(void) snprintf(pn, maxlen, "(on_delete_queue)");
-		return (0);
-	} else if (di->zerr == EPERM) {
+	if (di->zerr == EPERM) {
 		(void) snprintf(di->errbuf, sizeof (di->errbuf),
 		    dgettext(TEXT_DOMAIN,
 		    "The sys_config privilege or diff delegated permission "
diff --git a/usr/src/lib/libzfs/common/libzfs_impl.h b/usr/src/lib/libzfs/common/libzfs_impl.h
index cd9a53d91f..4c0c89e989 100644
--- a/usr/src/lib/libzfs/common/libzfs_impl.h
+++ b/usr/src/lib/libzfs/common/libzfs_impl.h
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2011 Pawel Jakub Dawidek. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
  */
 
@@ -87,6 +88,7 @@ struct libzfs_handle {
 	libzfs_fru_t **libzfs_fru_hash;
 	libzfs_fru_t *libzfs_fru_list;
 	char libzfs_chassis_id[256];
+	boolean_t libzfs_cachedprops;
 	boolean_t libzfs_prop_debug;
 };
 
@@ -159,6 +161,7 @@ int get_dependents(libzfs_handle_t *, boolean_t, const char *, char ***,
     size_t *);
 zfs_handle_t *make_dataset_handle_zc(libzfs_handle_t *, zfs_cmd_t *);
 zfs_handle_t *make_dataset_simple_handle_zc(zfs_handle_t *, zfs_cmd_t *);
+int libzfs_cmd_set_cachedprops(libzfs_handle_t *, zfs_cmd_t *);
 
 int zprop_parse_value(libzfs_handle_t *, nvpair_t *, int, zfs_type_t,
     nvlist_t *, char **, uint64_t *, const char *);
diff --git a/usr/src/lib/libzfs/common/libzfs_iter.c b/usr/src/lib/libzfs/common/libzfs_iter.c
index b0cb1ff186..59eb50fef0 100644
--- a/usr/src/lib/libzfs/common/libzfs_iter.c
+++ b/usr/src/lib/libzfs/common/libzfs_iter.c
@@ -24,6 +24,7 @@
  * Copyright (c) 2013, 2015 by Delphix. All rights reserved.
  * Copyright (c) 2012 Pawel Jakub Dawidek. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  */
 
 #include <stdio.h>
@@ -111,6 +112,10 @@ zfs_iter_filesystems(zfs_handle_t *zhp, zfs_iter_f func, void *data)
 	if (zhp->zfs_type != ZFS_TYPE_FILESYSTEM)
 		return (0);
 
+	if (zhp->zfs_hdl->libzfs_cachedprops &&
+	    libzfs_cmd_set_cachedprops(zhp->zfs_hdl, &zc) != 0)
+		return (-1);
+
 	if (zcmd_alloc_dst_nvlist(zhp->zfs_hdl, &zc, 0) != 0)
 		return (-1);
 
@@ -121,9 +126,8 @@ zfs_iter_filesystems(zfs_handle_t *zhp, zfs_iter_f func, void *data)
 		 * that the pool has since been removed.
 		 */
 		if ((nzhp = make_dataset_handle_zc(zhp->zfs_hdl,
-		    &zc)) == NULL) {
+		    &zc)) == NULL)
 			continue;
-		}
 
 		if ((ret = func(nzhp, data)) != 0) {
 			zcmd_free_nvlists(&zc);
@@ -149,10 +153,17 @@ zfs_iter_snapshots(zfs_handle_t *zhp, boolean_t simple, zfs_iter_f func,
 	    zhp->zfs_type == ZFS_TYPE_BOOKMARK)
 		return (0);
 
+
+	if (zhp->zfs_hdl->libzfs_cachedprops &&
+	    libzfs_cmd_set_cachedprops(zhp->zfs_hdl, &zc) != 0)
+		return (-1);
+
 	zc.zc_simple = simple;
 
+
 	if (zcmd_alloc_dst_nvlist(zhp->zfs_hdl, &zc, 0) != 0)
 		return (-1);
+
 	while ((ret = zfs_do_list_ioctl(zhp, ZFS_IOC_SNAPSHOT_LIST_NEXT,
 	    &zc)) == 0) {
 
diff --git a/usr/src/lib/libzfs/common/libzfs_pool.c b/usr/src/lib/libzfs/common/libzfs_pool.c
index e5b3ce02dc..ae23e06184 100644
--- a/usr/src/lib/libzfs/common/libzfs_pool.c
+++ b/usr/src/lib/libzfs/common/libzfs_pool.c
@@ -368,6 +368,7 @@ zpool_get_prop(zpool_handle_t *zhp, zpool_prop_t prop, char *buf, size_t len,
 		default:
 			(void) snprintf(buf, len, "%llu", intval);
 		}
+
 		break;
 
 	case PROP_TYPE_INDEX:
diff --git a/usr/src/lib/libzfs/common/libzfs_util.c b/usr/src/lib/libzfs/common/libzfs_util.c
index aa74189cc8..3c00b33b02 100644
--- a/usr/src/lib/libzfs/common/libzfs_util.c
+++ b/usr/src/lib/libzfs/common/libzfs_util.c
@@ -86,6 +86,9 @@ libzfs_error_description(libzfs_handle_t *hdl)
 		return (dgettext(TEXT_DOMAIN, "property cannot be inherited"));
 	case EZFS_PROPSPACE:
 		return (dgettext(TEXT_DOMAIN, "invalid quota or reservation"));
+	case EZFS_PROPCACHED:
+		return (dgettext(TEXT_DOMAIN, "property unavailable since "
+		    "cachedprops flag set"));
 	case EZFS_BADTYPE:
 		return (dgettext(TEXT_DOMAIN, "operation not applicable to "
 		    "datasets of this type"));
@@ -621,6 +624,42 @@ libzfs_print_on_error(libzfs_handle_t *hdl, boolean_t printerr)
 	hdl->libzfs_printerr = printerr;
 }
 
+/*
+ * Set the value of the cachedprops flag.  If the cachedprops flag is set,
+ * operations which get ZFS properties will only retrieve a property if the
+ * property is cached somewhere in memory.
+ *
+ * Consumers of libzfs should take care when setting this flag, as they will
+ * prevent themselves from listing the full set of ZFS properties.
+ *
+ * ZFS properties which always require disk I/O are ZPL properties (utf8only,
+ * normalization, etc.) and the volsize and volblocksize properties for volumes.
+ */
+void
+libzfs_set_cachedprops(libzfs_handle_t *hdl, boolean_t cachedprops)
+{
+	hdl->libzfs_cachedprops = cachedprops;
+}
+
+/*
+ * Adds a src nvlist to a zfs_cmd_t which specifies that only cached (i.e., will
+ * not require a disk access) properties should be retrieved.
+ */
+int
+libzfs_cmd_set_cachedprops(libzfs_handle_t *hdl, zfs_cmd_t *zc)
+{
+	nvlist_t *nvl;
+	int ret;
+
+	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0 ||
+	    nvlist_add_boolean_value(nvl, "cachedpropsonly", B_TRUE) != 0)
+		return (no_memory(hdl));
+
+	ret = zcmd_write_src_nvlist(hdl, zc, nvl);
+	nvlist_free(nvl);
+	return (ret);
+}
+
 libzfs_handle_t *
 libzfs_init(void)
 {
@@ -656,6 +695,7 @@ libzfs_init(void)
 	zpool_feature_init();
 	libzfs_mnttab_init(hdl);
 
+	hdl->libzfs_cachedprops = B_FALSE;
 	if (getenv("ZFS_PROP_DEBUG") != NULL) {
 		hdl->libzfs_prop_debug = B_TRUE;
 	}
diff --git a/usr/src/lib/libzfs/common/mapfile-vers b/usr/src/lib/libzfs/common/mapfile-vers
index 21b308b5bc..17a60e830d 100644
--- a/usr/src/lib/libzfs/common/mapfile-vers
+++ b/usr/src/lib/libzfs/common/mapfile-vers
@@ -21,6 +21,7 @@
 
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2012, Joyent, Inc. All rights reserved.
 # Copyright (c) 2011, 2017 by Delphix. All rights reserved.
 # Copyright 2016 Nexenta Systems, Inc.
 #
@@ -62,6 +63,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	libzfs_init;
 	libzfs_mnttab_cache;
 	libzfs_print_on_error;
+	libzfs_set_cachedprops;
 	spa_feature_table;
 	zfs_allocatable_devs;
 	zfs_asprintf;
@@ -110,6 +112,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zfs_path_to_zhandle;
 	zfs_promote;
 	zfs_prop_align_right;
+	zfs_prop_cacheable;
 	zfs_prop_column_name;
 	zfs_prop_default_numeric;
 	zfs_prop_default_string;
diff --git a/usr/src/lib/libzonecfg/Makefile.com b/usr/src/lib/libzonecfg/Makefile.com
index 880abfcc97..de53f975e3 100644
--- a/usr/src/lib/libzonecfg/Makefile.com
+++ b/usr/src/lib/libzonecfg/Makefile.com
@@ -20,11 +20,14 @@
 #
 #
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015 Joyent, Inc.
 #
 
 LIBRARY=	libzonecfg.a
 VERS=		.1
-OBJECTS=	libzonecfg.o getzoneent.o scratchops.o
+LIB_OBJS=	libzonecfg.o getzoneent.o scratchops.o
+XML_OBJS=	os_dtd.o
+OBJECTS=	$(LIB_OBJS) $(XML_OBJS)
 
 include ../../Makefile.lib
 
@@ -35,15 +38,27 @@ LDLIBS +=	-lc -lsocket -luuid -lnvpair -lsysevent -lsec -lbrand \
 $(DYNLIB) :=	LDLIBS += -lxml2
 
 SRCDIR =	../common
+
+XMLDIR =	$(SRC)/lib/xml
+SRCS = \
+		$(LIB_OBJS:%.o=$(SRCDIR)/%.c) \
+		$(XML_OBJS:%.o=$(XMLDIR)/%.c) \
+
 CPPFLAGS +=	-I$(ADJUNCT_PROTO)/usr/include/libxml2 -I$(SRCDIR) -D_REENTRANT
 CERRWARN +=	-_gcc=-Wno-uninitialized
 CERRWARN +=	-_gcc=-Wno-parentheses
 $(LINTLIB) := SRCS=	$(SRCDIR)/$(LINTSRC)
 
+CPPFLAGS +=	-I$(XMLDIR)
+
 .KEEP_STATE:
 
 all:	$(LIBS)
 
 lint:	lintcheck
 
+pics/%.o: $(XMLDIR)/%.c
+	$(COMPILE.c) -o $@ $<
+	$(POST_PROCESS_O)
+
 include ../../Makefile.targ
diff --git a/usr/src/lib/libzonecfg/common/getzoneent.c b/usr/src/lib/libzonecfg/common/getzoneent.c
index 8155f7272a..c9f1c12bcf 100644
--- a/usr/src/lib/libzonecfg/common/getzoneent.c
+++ b/usr/src/lib/libzonecfg/common/getzoneent.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 
@@ -127,6 +128,8 @@ getzoneent_private(FILE *cookie)
 			/* skip comment lines */
 			continue;
 		}
+
+		/* zonename */
 		p = gettok(&cp);
 		if (*p == '\0' || strlen(p) >= ZONENAME_MAX) {
 			/*
@@ -136,6 +139,7 @@ getzoneent_private(FILE *cookie)
 		}
 		(void) strlcpy(ze->zone_name, p, ZONENAME_MAX);
 
+		/* state */
 		p = gettok(&cp);
 		if (*p == '\0') {
 			/* state field should not be empty */
@@ -152,6 +156,7 @@ getzoneent_private(FILE *cookie)
 			continue;
 		}
 
+		/* zonepath */
 		p = gettok(&cp);
 		if (strlen(p) >= MAXPATHLEN) {
 			/* very long paths are not allowed */
@@ -159,10 +164,35 @@ getzoneent_private(FILE *cookie)
 		}
 		(void) strlcpy(ze->zone_path, p, MAXPATHLEN);
 
+		/* uuid */
 		p = gettok(&cp);
 		if (uuid_parse(p, ze->zone_uuid) == -1)
 			uuid_clear(ze->zone_uuid);
 
+		/* brand [optional] */
+		p = gettok(&cp);
+		if (strlen(p) >= MAXNAMELEN) {
+			/* very long names are not allowed */
+			continue;
+		}
+		(void) strlcpy(ze->zone_brand, p, MAXNAMELEN);
+
+		/* IP type [optional] */
+		p = gettok(&cp);
+		if (strlen(p) >= MAXNAMELEN) {
+			/* very long names are not allowed */
+			continue;
+		}
+		ze->zone_iptype = ZS_SHARED;
+		if (*p == 'e') {
+			ze->zone_iptype = ZS_EXCLUSIVE;
+		}
+
+		/* debug ID [optional] */
+		p = gettok(&cp);
+		if (*p != '\0')
+			ze->zone_did = atoi(p);
+
 		break;
 	}
 
@@ -170,10 +200,32 @@ getzoneent_private(FILE *cookie)
 }
 
 static boolean_t
-get_index_path(char *path)
+path_common(char *path, size_t path_size, const char *stem)
 {
-	return (snprintf(path, MAXPATHLEN, "%s%s", zonecfg_root,
-	    ZONE_INDEX_FILE) < MAXPATHLEN);
+	const char *native_root = zone_get_nroot();
+
+	if (native_root == NULL || zonecfg_in_alt_root()) {
+		/*
+		 * Do not prepend the native system root (e.g. "/native") if an
+		 * alternative configuration root has been selected.
+		 */
+		native_root = "";
+	}
+
+	return (snprintf(path, path_size, "%s%s%s", native_root, zonecfg_root,
+	    stem) < path_size);
+}
+
+static boolean_t
+get_index_path(char *path, size_t path_size)
+{
+	return (path_common(path, path_size, ZONE_INDEX_FILE));
+}
+
+static boolean_t
+get_temp_path(char *path, size_t path_size)
+{
+	return (path_common(path, path_size, _PATH_TMPFILE));
 }
 
 FILE *
@@ -181,7 +233,7 @@ setzoneent(void)
 {
 	char path[MAXPATHLEN];
 
-	if (!get_index_path(path)) {
+	if (!get_index_path(path, sizeof (path))) {
 		errno = EINVAL;
 		return (NULL);
 	}
@@ -202,8 +254,7 @@ lock_index_file(void)
 	struct flock lock;
 	char path[MAXPATHLEN];
 
-	if (snprintf(path, sizeof (path), "%s%s", zonecfg_root,
-	    ZONE_INDEX_LOCK_DIR) >= sizeof (path))
+	if (!path_common(path, sizeof (path), ZONE_INDEX_LOCK_DIR))
 		return (-1);
 	if ((mkdir(path, S_IRWXU) == -1) && errno != EEXIST)
 		return (-1);
@@ -269,14 +320,17 @@ int
 putzoneent(struct zoneent *ze, zoneent_op_t operation)
 {
 	FILE *index_file, *tmp_file;
-	char *tmp_file_name, buf[MAX_INDEX_LEN];
+	char buf[MAX_INDEX_LEN];
 	int tmp_file_desc, lock_fd, err;
 	boolean_t exist, need_quotes;
-	char *cp;
+	char *cp, *tmpp;
+	char tmp_path[MAXPATHLEN];
 	char path[MAXPATHLEN];
 	char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
-	size_t tlen, namelen;
-	const char *zone_name, *zone_state, *zone_path, *zone_uuid;
+	size_t namelen;
+	const char *zone_name, *zone_state, *zone_path, *zone_uuid,
+	    *zone_brand = "", *zone_iptype;
+	zoneid_t zone_did;
 
 	assert(ze != NULL);
 
@@ -299,20 +353,14 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 	if ((lock_fd = lock_index_file()) == -1)
 		return (Z_LOCKING_FILE);
 
-	/* using sizeof gives us room for the terminating NUL byte as well */
-	tlen = sizeof (_PATH_TMPFILE) + strlen(zonecfg_root);
-	tmp_file_name = malloc(tlen);
-	if (tmp_file_name == NULL) {
+	if (!get_temp_path(tmp_path, sizeof (tmp_path))) {
 		(void) unlock_index_file(lock_fd);
 		return (Z_NOMEM);
 	}
-	(void) snprintf(tmp_file_name, tlen, "%s%s", zonecfg_root,
-	    _PATH_TMPFILE);
 
-	tmp_file_desc = mkstemp(tmp_file_name);
+	tmp_file_desc = mkstemp(tmp_path);
 	if (tmp_file_desc == -1) {
-		(void) unlink(tmp_file_name);
-		free(tmp_file_name);
+		(void) unlink(tmp_path);
 		(void) unlock_index_file(lock_fd);
 		return (Z_TEMP_FILE);
 	}
@@ -323,7 +371,7 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 		err = Z_MISC_FS;
 		goto error;
 	}
-	if (!get_index_path(path)) {
+	if (!get_index_path(path, sizeof (path))) {
 		err = Z_MISC_FS;
 		goto error;
 	}
@@ -335,6 +383,9 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 	exist = B_FALSE;
 	zone_name = ze->zone_name;
 	namelen = strlen(zone_name);
+	zone_brand = ze->zone_brand;
+	zone_iptype = (ze->zone_iptype == ZS_SHARED ? "sh" : "ex");
+	zone_did = ze->zone_did;
 	for (;;) {
 		if (fgets(buf, sizeof (buf), index_file) == NULL) {
 			if (operation == PZE_ADD && !exist) {
@@ -389,6 +440,11 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 		}
 		zone_path = gettok(&cp);
 		zone_uuid = gettok(&cp);
+		zone_brand = gettok(&cp);
+		zone_iptype = gettok(&cp);
+		tmpp = gettok(&cp);
+		if (*tmpp != '\0')
+			zone_did = atoi(tmpp);
 
 		switch (operation) {
 		case PZE_ADD:
@@ -403,14 +459,6 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 			 */
 			if (ze->zone_state >= 0) {
 				zone_state = zone_state_str(ze->zone_state);
-
-				/*
-				 * If the caller is uninstalling this zone,
-				 * then wipe out the uuid.  The zone's contents
-				 * are no longer known.
-				 */
-				if (ze->zone_state < ZONE_STATE_INSTALLED)
-					zone_uuid = "";
 			}
 
 			/* If a new name is supplied, use it. */
@@ -419,6 +467,27 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 
 			if (ze->zone_path[0] != '\0')
 				zone_path = ze->zone_path;
+
+			/* If new UUID provided, replace it */
+			if (!uuid_is_null(ze->zone_uuid)) {
+				uuid_unparse(ze->zone_uuid, uuidstr);
+				zone_uuid = uuidstr;
+			}
+
+			/* If a brand is supplied, use it. */
+			if (ze->zone_brand[0] != '\0') {
+				zone_brand = ze->zone_brand;
+
+				/*
+				 * Since the brand, iptype and did are optional,
+				 * we we only reset the iptype and did if the
+				 * brand is provided.
+				 */
+				zone_iptype = (ze->zone_iptype == ZS_SHARED ?
+				    "sh" : "ex");
+				zone_did = ze->zone_did;
+			}
+
 			break;
 
 		case PZE_REMOVE:
@@ -450,9 +519,17 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 		 * method for escaping them.
 		 */
 		need_quotes = (strchr(zone_path, ':') != NULL);
-		(void) fprintf(tmp_file, "%s:%s:%s%s%s:%s\n", zone_name,
-		    zone_state, need_quotes ? "\"" : "", zone_path,
-		    need_quotes ? "\"" : "", zone_uuid);
+
+		if (*zone_brand != '\0') {
+			(void) fprintf(tmp_file, "%s:%s:%s%s%s:%s:%s:%s:%d\n",
+			    zone_name, zone_state, need_quotes ? "\"" : "",
+			    zone_path, need_quotes ? "\"" : "", zone_uuid,
+			    zone_brand, zone_iptype, zone_did);
+		} else {
+			(void) fprintf(tmp_file, "%s:%s:%s%s%s:%s\n", zone_name,
+			    zone_state, need_quotes ? "\"" : "", zone_path,
+			    need_quotes ? "\"" : "", zone_uuid);
+		}
 		exist = B_TRUE;
 	}
 
@@ -464,11 +541,10 @@ putzoneent(struct zoneent *ze, zoneent_op_t operation)
 		goto error;
 	}
 	tmp_file = NULL;
-	if (rename(tmp_file_name, path) == -1) {
+	if (rename(tmp_path, path) == -1) {
 		err = errno == EACCES ? Z_ACCES : Z_MISC_FS;
 		goto error;
 	}
-	free(tmp_file_name);
 	if (unlock_index_file(lock_fd) != Z_OK)
 		return (Z_UNLOCKING_FILE);
 	return (Z_OK);
@@ -478,8 +554,7 @@ error:
 		(void) fclose(index_file);
 	if (tmp_file != NULL)
 		(void) fclose(tmp_file);
-	(void) unlink(tmp_file_name);
-	free(tmp_file_name);
+	(void) unlink(tmp_path);
 	(void) unlock_index_file(lock_fd);
 	return (err);
 }
diff --git a/usr/src/lib/libzonecfg/common/libzonecfg.c b/usr/src/lib/libzonecfg/common/libzonecfg.c
index 29327525e2..c524901d48 100644
--- a/usr/src/lib/libzonecfg/common/libzonecfg.c
+++ b/usr/src/lib/libzonecfg/common/libzonecfg.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2014 Gary Mills
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent Inc.
  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
  */
 
@@ -59,6 +60,8 @@
 #include <secdb.h>
 #include <user_attr.h>
 #include <prof_attr.h>
+#include <sys/debug.h>
+#include <os_dtd.h>
 
 #include <arpa/inet.h>
 #include <netdb.h>
@@ -79,6 +82,8 @@
 #define	ZONE_EVENT_PING_SUBCLASS	"ping"
 #define	ZONE_EVENT_PING_PUBLISHER	"solaris"
 
+#define	DEBUGID_FILE	"/etc/zones/did.txt"
+
 /* Hard-code the DTD element/attribute/entity names just once, here. */
 #define	DTD_ELEM_ATTR		(const xmlChar *) "attr"
 #define	DTD_ELEM_COMMENT	(const xmlChar *) "comment"
@@ -86,6 +91,7 @@
 #define	DTD_ELEM_FS		(const xmlChar *) "filesystem"
 #define	DTD_ELEM_FSOPTION	(const xmlChar *) "fsoption"
 #define	DTD_ELEM_NET		(const xmlChar *) "network"
+#define	DTD_ELEM_NETATTR	(const xmlChar *) "net-attr"
 #define	DTD_ELEM_RCTL		(const xmlChar *) "rctl"
 #define	DTD_ELEM_RCTLVALUE	(const xmlChar *) "rctl-value"
 #define	DTD_ELEM_ZONE		(const xmlChar *) "zone"
@@ -106,10 +112,12 @@
 #define	DTD_ATTR_IPTYPE		(const xmlChar *) "ip-type"
 #define	DTD_ATTR_DEFROUTER	(const xmlChar *) "defrouter"
 #define	DTD_ATTR_DIR		(const xmlChar *) "directory"
+#define	DTD_ATTR_GNIC		(const xmlChar *) "global-nic"
 #define	DTD_ATTR_LIMIT		(const xmlChar *) "limit"
 #define	DTD_ATTR_LIMITPRIV	(const xmlChar *) "limitpriv"
 #define	DTD_ATTR_BOOTARGS	(const xmlChar *) "bootargs"
 #define	DTD_ATTR_SCHED		(const xmlChar *) "scheduling-class"
+#define	DTD_ATTR_MAC		(const xmlChar *) "mac-addr"
 #define	DTD_ATTR_MATCH		(const xmlChar *) "match"
 #define	DTD_ATTR_NAME		(const xmlChar *) "name"
 #define	DTD_ATTR_PHYSICAL	(const xmlChar *) "physical"
@@ -119,6 +127,7 @@
 #define	DTD_ATTR_SPECIAL	(const xmlChar *) "special"
 #define	DTD_ATTR_TYPE		(const xmlChar *) "type"
 #define	DTD_ATTR_VALUE		(const xmlChar *) "value"
+#define	DTD_ATTR_VLANID		(const xmlChar *) "vlan-id"
 #define	DTD_ATTR_ZONEPATH	(const xmlChar *) "zonepath"
 #define	DTD_ATTR_NCPU_MIN	(const xmlChar *) "ncpu_min"
 #define	DTD_ATTR_NCPU_MAX	(const xmlChar *) "ncpu_max"
@@ -131,6 +140,7 @@
 #define	DTD_ATTR_MODE		(const xmlChar *) "mode"
 #define	DTD_ATTR_ACL		(const xmlChar *) "acl"
 #define	DTD_ATTR_BRAND		(const xmlChar *) "brand"
+#define	DTD_ATTR_DID		(const xmlChar *) "debugid"
 #define	DTD_ATTR_HOSTID		(const xmlChar *) "hostid"
 #define	DTD_ATTR_USER		(const xmlChar *) "user"
 #define	DTD_ATTR_AUTHS		(const xmlChar *) "auths"
@@ -181,9 +191,12 @@ static struct alias {
 	{ALIAS_MAXSEMIDS, "zone.max-sem-ids", "privileged", "deny", 0},
 	{ALIAS_MAXLOCKEDMEM, "zone.max-locked-memory", "privileged", "deny", 0},
 	{ALIAS_MAXSWAP, "zone.max-swap", "privileged", "deny", 0},
+	{ALIAS_MAXPHYSMEM, "zone.max-physical-memory", "privileged", "deny",
+	    1048576},
 	{ALIAS_SHARES, "zone.cpu-shares", "privileged", "none", 0},
 	{ALIAS_CPUCAP, "zone.cpu-cap", "privileged", "deny", 0},
 	{ALIAS_MAXPROCS, "zone.max-processes", "privileged", "deny", 100},
+	{ALIAS_ZFSPRI, "zone.zfs-io-priority", "privileged", "none", 0},
 	{NULL, NULL, NULL, NULL, 0}
 };
 
@@ -231,6 +244,8 @@ static int zone_lock_cnt = 0;
 static char zoneadm_lock_held[] = LOCK_ENV_VAR"=1";
 static char zoneadm_lock_not_held[] = LOCK_ENV_VAR"=0";
 
+static void zonecfg_notify_delete(const char *);
+
 char *zonecfg_root = "";
 
 /*
@@ -274,17 +289,35 @@ zonecfg_in_alt_root(void)
  */
 
 static boolean_t
-config_file_path(const char *zonename, char *answer)
+file_path_common(const char *zonename, const char *subdir, const char *stem,
+    char *answer, size_t answer_size)
 {
-	return (snprintf(answer, MAXPATHLEN, "%s%s/%s.xml", zonecfg_root,
-	    ZONE_CONFIG_ROOT, zonename) < MAXPATHLEN);
+	const char *native_root = zone_get_nroot();
+
+	if (native_root == NULL || zonecfg_in_alt_root()) {
+		/*
+		 * Do not prepend the native system root (e.g. "/native") if an
+		 * alternative configuration root has been selected.
+		 */
+		native_root = "";
+	}
+
+	return (snprintf(answer, answer_size, "%s%s%s/%s.%s", native_root,
+	    zonecfg_root, subdir, zonename, stem) < answer_size);
 }
 
 static boolean_t
-snap_file_path(const char *zonename, char *answer)
+config_file_path(const char *zonename, char *answer, size_t answer_size)
 {
-	return (snprintf(answer, MAXPATHLEN, "%s%s/%s.snapshot.xml",
-	    zonecfg_root, ZONE_SNAPSHOT_ROOT, zonename) < MAXPATHLEN);
+	return (file_path_common(zonename, ZONE_CONFIG_ROOT, "xml", answer,
+	    answer_size));
+}
+
+static boolean_t
+snap_file_path(const char *zonename, char *answer, size_t answer_size)
+{
+	return (file_path_common(zonename, ZONE_SNAPSHOT_ROOT, "snapshot.xml",
+	    answer, answer_size));
 }
 
 /*ARGSUSED*/
@@ -355,7 +388,7 @@ zonecfg_destroy(const char *zonename, boolean_t force)
 	int err, state_err;
 	zone_state_t state;
 
-	if (!config_file_path(zonename, path))
+	if (!config_file_path(zonename, path, sizeof (path)))
 		return (Z_MISC_FS);
 
 	state_err = zone_get_state((char *)zonename, &state);
@@ -402,8 +435,10 @@ zonecfg_destroy(const char *zonename, boolean_t force)
 	 * Treat failure to find the XML file silently, since, well, it's
 	 * gone, and with the index file cleaned up, we're done.
 	 */
-	if (err == Z_OK || err == Z_NO_ZONE)
+	if (err == Z_OK || err == Z_NO_ZONE) {
+		zonecfg_notify_delete(zonename);
 		return (Z_OK);
+	}
 	return (err);
 }
 
@@ -412,7 +447,7 @@ zonecfg_destroy_snapshot(const char *zonename)
 {
 	char path[MAXPATHLEN];
 
-	if (!snap_file_path(zonename, path))
+	if (!snap_file_path(zonename, path, sizeof (path)))
 		return (Z_MISC_FS);
 	return (zonecfg_destroy_impl(path));
 }
@@ -579,9 +614,8 @@ static int
 zonecfg_get_handle_impl(const char *zonename, const char *filename,
     zone_dochandle_t handle)
 {
-	xmlValidCtxtPtr cvp;
 	struct stat statbuf;
-	int valid;
+	boolean_t valid;
 
 	if (zonename == NULL)
 		return (Z_NO_ZONE);
@@ -592,14 +626,13 @@ zonecfg_get_handle_impl(const char *zonename, const char *filename,
 			return (Z_INVALID_DOCUMENT);
 		return (Z_NO_ZONE);
 	}
-	if ((cvp = xmlNewValidCtxt()) == NULL)
+
+	if (os_dtd_validate(handle->zone_dh_doc, B_FALSE, &valid) != 0) {
 		return (Z_NOMEM);
-	cvp->error = zonecfg_error_func;
-	cvp->warning = zonecfg_error_func;
-	valid = xmlValidateDocument(cvp, handle->zone_dh_doc);
-	xmlFreeValidCtxt(cvp);
-	if (valid == 0)
+	}
+	if (!valid) {
 		return (Z_INVALID_DOCUMENT);
+	}
 
 	/* delete any comments such as inherited Sun copyright / ident str */
 	stripcomments(handle);
@@ -611,7 +644,7 @@ zonecfg_get_handle(const char *zonename, zone_dochandle_t handle)
 {
 	char path[MAXPATHLEN];
 
-	if (!config_file_path(zonename, path))
+	if (!config_file_path(zonename, path, sizeof (path)))
 		return (Z_MISC_FS);
 	handle->zone_dh_newzone = B_FALSE;
 
@@ -655,7 +688,7 @@ zonecfg_get_snapshot_handle(const char *zonename, zone_dochandle_t handle)
 {
 	char path[MAXPATHLEN];
 
-	if (!snap_file_path(zonename, path))
+	if (!snap_file_path(zonename, path, sizeof (path)))
 		return (Z_MISC_FS);
 	handle->zone_dh_newzone = B_FALSE;
 	return (zonecfg_get_handle_impl(zonename, path, handle));
@@ -668,7 +701,7 @@ zonecfg_get_template_handle(const char *template, const char *zonename,
 	char path[MAXPATHLEN];
 	int err;
 
-	if (!config_file_path(template, path))
+	if (!config_file_path(template, path, sizeof (path)))
 		return (Z_MISC_FS);
 
 	if ((err = zonecfg_get_handle_impl(template, path, handle)) != Z_OK)
@@ -702,21 +735,19 @@ int
 zonecfg_attach_manifest(int fd, zone_dochandle_t local_handle,
     zone_dochandle_t rem_handle)
 {
-	xmlValidCtxtPtr cvp;
-	int valid;
+	boolean_t valid;
 
 	/* load the manifest into the handle for the remote system */
 	if ((rem_handle->zone_dh_doc = xmlReadFd(fd, NULL, NULL, 0)) == NULL) {
 		return (Z_INVALID_DOCUMENT);
 	}
-	if ((cvp = xmlNewValidCtxt()) == NULL)
+
+	if (os_dtd_validate(rem_handle->zone_dh_doc, B_FALSE, &valid) != 0) {
 		return (Z_NOMEM);
-	cvp->error = zonecfg_error_func;
-	cvp->warning = zonecfg_error_func;
-	valid = xmlValidateDocument(cvp, rem_handle->zone_dh_doc);
-	xmlFreeValidCtxt(cvp);
-	if (valid == 0)
+	}
+	if (!valid) {
 		return (Z_INVALID_DOCUMENT);
+	}
 
 	/* delete any comments such as inherited Sun copyright / ident str */
 	stripcomments(rem_handle);
@@ -737,14 +768,12 @@ zonecfg_attach_manifest(int fd, zone_dochandle_t local_handle,
 	 * We need to re-run xmlValidateDocument on local_handle to properly
 	 * update the in-core representation of the configuration.
 	 */
-	if ((cvp = xmlNewValidCtxt()) == NULL)
+	if (os_dtd_validate(local_handle->zone_dh_doc, B_FALSE, &valid) != 0) {
 		return (Z_NOMEM);
-	cvp->error = zonecfg_error_func;
-	cvp->warning = zonecfg_error_func;
-	valid = xmlValidateDocument(cvp, local_handle->zone_dh_doc);
-	xmlFreeValidCtxt(cvp);
-	if (valid == 0)
+	}
+	if (!valid) {
 		return (Z_INVALID_DOCUMENT);
+	}
 
 	strip_sw_inv(local_handle);
 
@@ -1106,7 +1135,7 @@ zonecfg_set_sched(zone_dochandle_t handle, char *sched)
  * In general, the operation of this function should succeed or fail as
  * a unit.
  */
-int
+static int
 zonecfg_refresh_index_file(zone_dochandle_t handle)
 {
 	char name[ZONENAME_MAX], zonepath[MAXPATHLEN];
@@ -1128,6 +1157,15 @@ zonecfg_refresh_index_file(zone_dochandle_t handle)
 	(void) strlcpy(ze.zone_path, zonepath + strlen(zonecfg_root),
 	    sizeof (ze.zone_path));
 
+	if ((err = zonecfg_get_brand(handle, ze.zone_brand,
+	    sizeof (ze.zone_brand))) != 0)
+		return (err);
+
+	if ((err = zonecfg_get_iptype(handle, &ze.zone_iptype)) != Z_OK)
+		return (err);
+
+	ze.zone_did = zonecfg_get_did(handle);
+
 	if (is_renaming(handle)) {
 		opcode = PZE_MODIFY;
 		(void) strlcpy(ze.zone_name, handle->zone_dh_delete_name,
@@ -1198,9 +1236,9 @@ zonecfg_save_impl(zone_dochandle_t handle, char *filename)
 {
 	char tmpfile[MAXPATHLEN];
 	char bakdir[MAXPATHLEN], bakbase[MAXPATHLEN], bakfile[MAXPATHLEN];
-	int tmpfd, err, valid;
-	xmlValidCtxt cvp = { NULL };
+	int tmpfd, err;
 	boolean_t backup;
+	boolean_t valid;
 
 	(void) strlcpy(tmpfile, filename, sizeof (tmpfile));
 	(void) dirname(tmpfile);
@@ -1213,16 +1251,13 @@ zonecfg_save_impl(zone_dochandle_t handle, char *filename)
 	}
 	(void) close(tmpfd);
 
-	cvp.error = zonecfg_error_func;
-	cvp.warning = zonecfg_error_func;
-
 	/*
 	 * We do a final validation of the document.  Since the library has
 	 * malfunctioned if it fails to validate, we follow-up with an
 	 * assert() that the doc is valid.
 	 */
-	valid = xmlValidateDocument(&cvp, handle->zone_dh_doc);
-	assert(valid != 0);
+	VERIFY0(os_dtd_validate(handle->zone_dh_doc, B_FALSE, &valid));
+	VERIFY(valid == B_TRUE);
 
 	if (xmlSaveFormatFile(tmpfile, handle->zone_dh_doc, 1) <= 0)
 		goto err;
@@ -1277,7 +1312,6 @@ zonecfg_save_impl(zone_dochandle_t handle, char *filename)
 			/*
 			 * Try to restore from our backup.
 			 */
-			(void) unlink(filename);
 			(void) rename(bakfile, filename);
 		} else {
 			/*
@@ -1320,7 +1354,7 @@ zonecfg_save(zone_dochandle_t handle)
 	if ((err = zonecfg_get_name(handle, zname, sizeof (zname))) != Z_OK)
 		return (err);
 
-	if (!config_file_path(zname, path))
+	if (!config_file_path(zname, path, sizeof (path)))
 		return (Z_MISC_FS);
 
 	addcomment(handle, "\n    DO NOT EDIT THIS "
@@ -1341,8 +1375,10 @@ zonecfg_save(zone_dochandle_t handle)
 	handle->zone_dh_newzone = B_FALSE;
 
 	if (is_renaming(handle)) {
-		if (config_file_path(handle->zone_dh_delete_name, delpath))
+		if (config_file_path(handle->zone_dh_delete_name, delpath,
+		    sizeof (delpath))) {
 			(void) unlink(delpath);
+		}
 		handle->zone_dh_delete_name[0] = '\0';
 	}
 
@@ -1352,23 +1388,18 @@ zonecfg_save(zone_dochandle_t handle)
 int
 zonecfg_verify_save(zone_dochandle_t handle, char *filename)
 {
-	int valid;
-
-	xmlValidCtxt cvp = { NULL };
+	boolean_t valid;
 
 	if (zonecfg_check_handle(handle) != Z_OK)
 		return (Z_BAD_HANDLE);
 
-	cvp.error = zonecfg_error_func;
-	cvp.warning = zonecfg_error_func;
-
 	/*
 	 * We do a final validation of the document.  Since the library has
 	 * malfunctioned if it fails to validate, we follow-up with an
 	 * assert() that the doc is valid.
 	 */
-	valid = xmlValidateDocument(&cvp, handle->zone_dh_doc);
-	assert(valid != 0);
+	VERIFY0(os_dtd_validate(handle->zone_dh_doc, B_FALSE, &valid));
+	VERIFY(valid == B_TRUE);
 
 	if (xmlSaveFormatFile(filename, handle->zone_dh_doc, 1) <= 0)
 		return (Z_SAVING_FILE);
@@ -1382,9 +1413,8 @@ zonecfg_detach_save(zone_dochandle_t handle, uint_t flags)
 	char zname[ZONENAME_MAX];
 	char path[MAXPATHLEN];
 	char migpath[MAXPATHLEN];
-	xmlValidCtxt cvp = { NULL };
 	int err = Z_SAVING_FILE;
-	int valid;
+	boolean_t valid;
 
 	if (zonecfg_check_handle(handle) != Z_OK)
 		return (Z_BAD_HANDLE);
@@ -1411,16 +1441,13 @@ zonecfg_detach_save(zone_dochandle_t handle, uint_t flags)
 	addcomment(handle, "\n    DO NOT EDIT THIS FILE.  "
 	    "Use zonecfg(1M) and zoneadm(1M) attach.\n");
 
-	cvp.error = zonecfg_error_func;
-	cvp.warning = zonecfg_error_func;
-
 	/*
 	 * We do a final validation of the document.  Since the library has
 	 * malfunctioned if it fails to validate, we follow-up with an
 	 * assert() that the doc is valid.
 	 */
-	valid = xmlValidateDocument(&cvp, handle->zone_dh_doc);
-	assert(valid != 0);
+	VERIFY0(os_dtd_validate(handle->zone_dh_doc, B_FALSE, &valid));
+	VERIFY(valid == B_TRUE);
 
 	if (xmlSaveFormatFile(migpath, handle->zone_dh_doc, 1) <= 0)
 		return (Z_SAVING_FILE);
@@ -1481,6 +1508,56 @@ zonecfg_rm_detached(zone_dochandle_t handle, boolean_t forced)
 	}
 }
 
+static void
+zonecfg_notify_conf_change(const char *zname, char *os, char *ns)
+{
+	evchan_t *ze_chan;
+	struct timeval now;
+	uint64_t t;
+	nvlist_t *nvl = NULL;
+
+	if (sysevent_evc_bind(ZONE_EVENT_CHANNEL, &ze_chan, 0) != 0)
+		return;
+
+	/* Current time since Jan 1 1970 but consumers expect NS */
+	gettimeofday(&now, NULL);
+	t = (now.tv_sec * NANOSEC) + (now.tv_usec * 1000);
+
+	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0 &&
+	    nvlist_add_string(nvl, ZONE_CB_NAME, zname) == 0 &&
+	    nvlist_add_string(nvl, ZONE_CB_NEWSTATE, ns) == 0 &&
+	    nvlist_add_string(nvl, ZONE_CB_OLDSTATE, os) == 0 &&
+	    nvlist_add_int32(nvl, ZONE_CB_ZONEID, -1) == 0 &&
+	    nvlist_add_uint64(nvl, ZONE_CB_TIMESTAMP, t) == 0) {
+		(void) sysevent_evc_publish(ze_chan, ZONE_EVENT_STATUS_CLASS,
+		    ZONE_EVENT_STATUS_SUBCLASS, "sun.com", "zonecfg", nvl,
+		    EVCH_SLEEP);
+	}
+
+	nvlist_free(nvl);
+	(void) sysevent_evc_unbind(ze_chan);
+}
+
+void
+zonecfg_notify_create(zone_dochandle_t handle)
+{
+	char zname[ZONENAME_MAX];
+
+	if (zonecfg_check_handle(handle) != Z_OK)
+		return;
+
+	if (zonecfg_get_name(handle, zname, sizeof (zname)) != Z_OK)
+		return;
+
+	zonecfg_notify_conf_change(zname, "", ZONE_STATE_STR_CONFIGURED);
+}
+
+static void
+zonecfg_notify_delete(const char *zname)
+{
+	zonecfg_notify_conf_change(zname, ZONE_STATE_STR_CONFIGURED, "");
+}
+
 /*
  * Special case: if access(2) fails with ENOENT, then try again using
  * ZONE_CONFIG_ROOT instead of config_file_path(zonename).  This is how we
@@ -1493,7 +1570,7 @@ zonecfg_access(const char *zonename, int amode)
 {
 	char path[MAXPATHLEN];
 
-	if (!config_file_path(zonename, path))
+	if (!config_file_path(zonename, path, sizeof (path)))
 		return (Z_INVAL);
 	if (access(path, amode) == 0)
 		return (Z_OK);
@@ -1558,7 +1635,7 @@ zonecfg_create_snapshot(const char *zonename)
 		goto out;
 	}
 
-	if (!snap_file_path(zonename, path)) {
+	if (!snap_file_path(zonename, path, sizeof (path))) {
 		error = Z_MISC_FS;
 		goto out;
 	}
@@ -2071,6 +2148,32 @@ zonecfg_ifname_exists(sa_family_t af, char *ifname)
 }
 
 /*
+ * Turn an addr that looks like f:2:0:44:5:6C into 0f:02:00:44:05:6c
+ * We're expecting a dst of at least MAXMACADDRLEN size here.
+ */
+static void
+normalize_mac_addr(char *dst, const char *src, int len)
+{
+	char *p, *e, *sep = "";
+	long n;
+	char buf[MAXMACADDRLEN], tmp[4];
+
+	*dst = '\0';
+	(void) strlcpy(buf, src, sizeof (buf));
+	p = strtok(buf, ":");
+	while (p != NULL) {
+		n = strtol(p, &e, 16);
+		if (*e != NULL || n > 0xff)
+			return;
+		(void) snprintf(tmp, sizeof (tmp), "%s%02x", sep, n);
+		(void) strlcat(dst, tmp, len);
+
+		sep = ":";
+		p = strtok(NULL, ":");
+	}
+}
+
+/*
  * Determines whether there is a net resource with the physical interface, IP
  * address, and default router specified by 'tabptr' in the zone configuration
  * to which 'handle' refers.  'tabptr' must have an interface, an address, a
@@ -2089,13 +2192,18 @@ zonecfg_ifname_exists(sa_family_t af, char *ifname)
 int
 zonecfg_lookup_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 {
-	xmlNodePtr cur;
+	xmlNodePtr cur, val;
 	xmlNodePtr firstmatch;
 	int err;
 	char address[INET6_ADDRSTRLEN];
 	char physical[LIFNAMSIZ];
+	char mac[MAXMACADDRLEN];
+	char norm_mac[MAXMACADDRLEN];
+	char gnic[LIFNAMSIZ];
 	size_t addrspec;		/* nonzero if tabptr has IP addr */
 	size_t physspec;		/* nonzero if tabptr has interface */
+	size_t macspec;			/* nonzero if tabptr has mac addr */
+	size_t gnicspec;		/* nonzero if tabptr has gnic */
 	size_t defrouterspec;		/* nonzero if tabptr has def. router */
 	size_t allowed_addrspec;
 	zone_iptype_t iptype;
@@ -2107,17 +2215,20 @@ zonecfg_lookup_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 	 * Determine the fields that will be searched.  There must be at least
 	 * one.
 	 *
-	 * zone_nwif_address, zone_nwif_physical, and zone_nwif_defrouter are
+	 * zone_nwif_address, zone_nwif_physical, zone_nwif_defrouter,
+	 * zone_nwif_mac, zone_nwif_vlan_id and zone_nwif_gnic  are
 	 * arrays, so no NULL checks are necessary.
 	 */
 	addrspec = strlen(tabptr->zone_nwif_address);
 	physspec = strlen(tabptr->zone_nwif_physical);
+	macspec = strlen(tabptr->zone_nwif_mac);
+	gnicspec = strlen(tabptr->zone_nwif_gnic);
 	defrouterspec = strlen(tabptr->zone_nwif_defrouter);
 	allowed_addrspec = strlen(tabptr->zone_nwif_allowed_address);
 	if (addrspec != 0 && allowed_addrspec != 0)
 		return (Z_INVAL); /* can't specify both */
 	if (addrspec == 0 && physspec == 0 && defrouterspec == 0 &&
-	    allowed_addrspec == 0)
+	    allowed_addrspec == 0 && macspec == 0 && gnicspec == 0)
 		return (Z_INSUFFICIENT_SPEC);
 
 	if ((err = operation_prep(handle)) != Z_OK)
@@ -2144,6 +2255,19 @@ zonecfg_lookup_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 		    physical, sizeof (physical)) != Z_OK ||
 		    strcmp(tabptr->zone_nwif_physical, physical) != 0))
 			continue;
+		if (iptype == ZS_EXCLUSIVE && macspec != 0) {
+			if (fetchprop(cur, DTD_ATTR_MAC, mac, sizeof (mac)) !=
+			    Z_OK)
+				continue;
+			normalize_mac_addr(norm_mac, mac, sizeof (norm_mac));
+			if (strcmp(tabptr->zone_nwif_mac, norm_mac) != 0)
+				continue;
+		}
+		if (iptype == ZS_EXCLUSIVE && gnicspec != 0 &&
+		    (fetchprop(cur, DTD_ATTR_GNIC, gnic,
+		    sizeof (gnic)) != Z_OK ||
+		    strcmp(tabptr->zone_nwif_gnic, gnic) != 0))
+			continue;
 		if (iptype == ZS_SHARED && addrspec != 0 &&
 		    (fetchprop(cur, DTD_ATTR_ADDRESS, address,
 		    sizeof (address)) != Z_OK ||
@@ -2186,6 +2310,21 @@ zonecfg_lookup_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 		return (err);
 
 	if (iptype == ZS_EXCLUSIVE &&
+	    (err = fetchprop(cur, DTD_ATTR_MAC, tabptr->zone_nwif_mac,
+	    sizeof (tabptr->zone_nwif_mac))) != Z_OK)
+		return (err);
+
+	if (iptype == ZS_EXCLUSIVE &&
+	    (err = fetchprop(cur, DTD_ATTR_VLANID, tabptr->zone_nwif_vlan_id,
+	    sizeof (tabptr->zone_nwif_vlan_id))) != Z_OK)
+		return (err);
+
+	if (iptype == ZS_EXCLUSIVE &&
+	    (err = fetchprop(cur, DTD_ATTR_GNIC, tabptr->zone_nwif_gnic,
+	    sizeof (tabptr->zone_nwif_gnic))) != Z_OK)
+		return (err);
+
+	if (iptype == ZS_EXCLUSIVE &&
 	    (err = fetchprop(cur, DTD_ATTR_ALLOWED_ADDRESS,
 	    tabptr->zone_nwif_allowed_address,
 	    sizeof (tabptr->zone_nwif_allowed_address))) != Z_OK)
@@ -2196,13 +2335,40 @@ zonecfg_lookup_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 	    sizeof (tabptr->zone_nwif_defrouter))) != Z_OK)
 		return (err);
 
+	tabptr->zone_nwif_attrp = NULL;
+	for (val = cur->xmlChildrenNode; val != NULL; val = val->next) {
+		struct zone_res_attrtab *valptr;
+
+		valptr = (struct zone_res_attrtab *)malloc(
+		    sizeof (struct zone_res_attrtab));
+		if (valptr == NULL)
+			return (Z_NOMEM);
+
+		valptr->zone_res_attr_name[0] =
+		    valptr->zone_res_attr_value[0] = '\0';
+		if (zonecfg_add_res_attr(&(tabptr->zone_nwif_attrp), valptr)
+		    != Z_OK) {
+			free(valptr);
+			break;
+		}
+
+		if ((fetchprop(val, DTD_ATTR_NAME, valptr->zone_res_attr_name,
+		    sizeof (valptr->zone_res_attr_name)) != Z_OK))
+			break;
+		if ((fetchprop(val, DTD_ATTR_VALUE,
+		    valptr->zone_res_attr_value,
+		    sizeof (valptr->zone_res_attr_value)) != Z_OK))
+			break;
+	}
+
 	return (Z_OK);
 }
 
 static int
 zonecfg_add_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 {
-	xmlNodePtr newnode, cur = handle->zone_dh_cur;
+	xmlNodePtr newnode, cur = handle->zone_dh_cur, valnode;
+	struct zone_res_attrtab *valptr;
 	int err;
 
 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_NET, NULL);
@@ -2218,13 +2384,40 @@ zonecfg_add_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 	    tabptr->zone_nwif_physical)) != Z_OK)
 		return (err);
 	/*
-	 * Do not add this property when it is not set, for backwards
-	 * compatibility and because it is optional.
+	 * Do not add these properties when they are not set, for backwards
+	 * compatibility and because they are optional.
 	 */
 	if ((strlen(tabptr->zone_nwif_defrouter) > 0) &&
 	    ((err = newprop(newnode, DTD_ATTR_DEFROUTER,
 	    tabptr->zone_nwif_defrouter)) != Z_OK))
 		return (err);
+	if (strlen(tabptr->zone_nwif_mac) > 0 &&
+	    (err = newprop(newnode, DTD_ATTR_MAC,
+	    tabptr->zone_nwif_mac)) != Z_OK)
+		return (err);
+	if (strlen(tabptr->zone_nwif_vlan_id) > 0 &&
+	    (err = newprop(newnode, DTD_ATTR_VLANID,
+	    tabptr->zone_nwif_vlan_id)) != Z_OK)
+		return (err);
+	if (strlen(tabptr->zone_nwif_gnic) > 0 &&
+	    (err = newprop(newnode, DTD_ATTR_GNIC,
+	    tabptr->zone_nwif_gnic)) != Z_OK)
+		return (err);
+
+	for (valptr = tabptr->zone_nwif_attrp; valptr != NULL;
+	    valptr = valptr->zone_res_attr_next) {
+		valnode = xmlNewTextChild(newnode, NULL, DTD_ELEM_NETATTR,
+		    NULL);
+		err = newprop(valnode, DTD_ATTR_NAME,
+		    valptr->zone_res_attr_name);
+		if (err != Z_OK)
+			return (err);
+		err = newprop(valnode, DTD_ATTR_VALUE,
+		    valptr->zone_res_attr_value);
+		if (err != Z_OK)
+			return (err);
+	}
+
 	return (Z_OK);
 }
 
@@ -2249,7 +2442,8 @@ static int
 zonecfg_delete_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 {
 	xmlNodePtr cur = handle->zone_dh_cur;
-	boolean_t addr_match, phys_match, allowed_addr_match;
+	boolean_t addr_match, phys_match, allowed_addr_match, mac_match,
+	    gnic_match;
 
 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
 		if (xmlStrcmp(cur->name, DTD_ELEM_NET))
@@ -2261,8 +2455,13 @@ zonecfg_delete_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 		    tabptr->zone_nwif_allowed_address);
 		phys_match = match_prop(cur, DTD_ATTR_PHYSICAL,
 		    tabptr->zone_nwif_physical);
+		mac_match = match_prop(cur, DTD_ATTR_MAC,
+		    tabptr->zone_nwif_mac);
+		gnic_match = match_prop(cur, DTD_ATTR_GNIC,
+		    tabptr->zone_nwif_gnic);
 
-		if (addr_match && allowed_addr_match && phys_match) {
+		if (((addr_match && allowed_addr_match) || mac_match ||
+		    gnic_match) && phys_match) {
 			xmlUnlinkNode(cur);
 			xmlFreeNode(cur);
 			return (Z_OK);
@@ -2311,6 +2510,58 @@ zonecfg_modify_nwif(
 	return (Z_OK);
 }
 
+void
+zonecfg_free_res_attr_list(struct zone_res_attrtab *valtab)
+{
+	if (valtab == NULL)
+		return;
+	zonecfg_free_res_attr_list(valtab->zone_res_attr_next);
+	free(valtab);
+}
+
+int
+zonecfg_add_res_attr(struct zone_res_attrtab **headptr,
+    struct zone_res_attrtab *valtabptr)
+{
+	struct zone_res_attrtab *last, *old, *new;
+
+	last = *headptr;
+	for (old = last; old != NULL; old = old->zone_res_attr_next)
+		last = old;	/* walk to the end of the list */
+	new = valtabptr;	/* alloc'd by caller */
+	new->zone_res_attr_next = NULL;
+	if (last == NULL)
+		*headptr = new;
+	else
+		last->zone_res_attr_next = new;
+	return (Z_OK);
+}
+
+int
+zonecfg_remove_res_attr(struct zone_res_attrtab **headptr,
+    struct zone_res_attrtab *valtabptr)
+{
+	struct zone_res_attrtab *last, *this, *next;
+
+	last = *headptr;
+	for (this = last; this != NULL; this = this->zone_res_attr_next) {
+		if (strcmp(this->zone_res_attr_name,
+		    valtabptr->zone_res_attr_name) == 0 &&
+		    strcmp(this->zone_res_attr_value,
+		    valtabptr->zone_res_attr_value) == 0) {
+			next = this->zone_res_attr_next;
+			if (this == *headptr)
+				*headptr = next;
+			else
+				last->zone_res_attr_next = next;
+			free(this);
+			return (Z_OK);
+		} else
+			last = this;
+	}
+	return (Z_NO_PROPERTY_ID);
+}
+
 /*
  * Must be a comma-separated list of alpha-numeric file system names.
  */
@@ -2460,7 +2711,7 @@ zonecfg_set_hostid(zone_dochandle_t handle, const char *hostidp)
 int
 zonecfg_lookup_dev(zone_dochandle_t handle, struct zone_devtab *tabptr)
 {
-	xmlNodePtr cur, firstmatch;
+	xmlNodePtr cur, val, firstmatch;
 	int err;
 	char match[MAXPATHLEN];
 
@@ -2505,13 +2756,40 @@ zonecfg_lookup_dev(zone_dochandle_t handle, struct zone_devtab *tabptr)
 	    sizeof (tabptr->zone_dev_match))) != Z_OK)
 		return (err);
 
+	tabptr->zone_dev_attrp = NULL;
+	for (val = cur->xmlChildrenNode; val != NULL; val = val->next) {
+		struct zone_res_attrtab *valptr;
+
+		valptr = (struct zone_res_attrtab *)malloc(
+		    sizeof (struct zone_res_attrtab));
+		if (valptr == NULL)
+			return (Z_NOMEM);
+
+		valptr->zone_res_attr_name[0] =
+		    valptr->zone_res_attr_value[0] = '\0';
+		if (zonecfg_add_res_attr(&(tabptr->zone_dev_attrp), valptr)
+		    != Z_OK) {
+			free(valptr);
+			break;
+		}
+
+		if ((fetchprop(val, DTD_ATTR_NAME, valptr->zone_res_attr_name,
+		    sizeof (valptr->zone_res_attr_name)) != Z_OK))
+			break;
+		if ((fetchprop(val, DTD_ATTR_VALUE,
+		    valptr->zone_res_attr_value,
+		    sizeof (valptr->zone_res_attr_value)) != Z_OK))
+			break;
+	}
+
 	return (Z_OK);
 }
 
 static int
 zonecfg_add_dev_core(zone_dochandle_t handle, struct zone_devtab *tabptr)
 {
-	xmlNodePtr newnode, cur = handle->zone_dh_cur;
+	xmlNodePtr newnode, cur = handle->zone_dh_cur, valnode;
+	struct zone_res_attrtab *valptr;
 	int err;
 
 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_DEVICE, NULL);
@@ -2520,6 +2798,21 @@ zonecfg_add_dev_core(zone_dochandle_t handle, struct zone_devtab *tabptr)
 	    tabptr->zone_dev_match)) != Z_OK)
 		return (err);
 
+	for (valptr = tabptr->zone_dev_attrp; valptr != NULL;
+	    valptr = valptr->zone_res_attr_next) {
+		valnode = xmlNewTextChild(newnode, NULL, DTD_ELEM_NETATTR,
+		    NULL);
+		err = newprop(valnode, DTD_ATTR_NAME,
+		    valptr->zone_res_attr_name);
+		if (err != Z_OK)
+			return (err);
+		err = newprop(valnode, DTD_ATTR_VALUE,
+		    valptr->zone_res_attr_value);
+		if (err != Z_OK)
+			return (err);
+	}
+
+
 	return (Z_OK);
 }
 
@@ -4734,7 +5027,7 @@ get_pool_sched_class(char *poolname, char *class, int clsize)
 	pool_conf_t *poolconf;
 	pool_t *pool;
 	pool_elem_t *pe;
-	pool_value_t *pv = pool_value_alloc();
+	pool_value_t *pv;
 	const char *sched_str;
 
 	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED)
@@ -4755,15 +5048,23 @@ get_pool_sched_class(char *poolname, char *class, int clsize)
 		return (Z_NO_POOL);
 	}
 
+	if ((pv = pool_value_alloc()) == NULL) {
+		(void) pool_conf_close(poolconf);
+		pool_conf_free(poolconf);
+		return (Z_NO_POOL);
+	}
+
 	pe = pool_to_elem(poolconf, pool);
 	if (pool_get_property(poolconf, pe, "pool.scheduler", pv) !=
 	    POC_STRING) {
 		(void) pool_conf_close(poolconf);
+		pool_value_free(pv);
 		pool_conf_free(poolconf);
 		return (Z_NO_ENTRY);
 	}
 	(void) pool_value_get_string(pv, &sched_str);
 	(void) pool_conf_close(poolconf);
+	pool_value_free(pv);
 	pool_conf_free(poolconf);
 	if (strlcpy(class, sched_str, clsize) >= clsize)
 		return (Z_TOO_BIG);
@@ -4872,7 +5173,8 @@ zonecfg_setnwifent(zone_dochandle_t handle)
 int
 zonecfg_getnwifent(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 {
-	xmlNodePtr cur;
+	xmlNodePtr cur, val;
+	struct zone_res_attrtab *valptr;
 	int err;
 
 	if (handle == NULL)
@@ -4908,6 +5210,24 @@ zonecfg_getnwifent(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 		return (err);
 	}
 
+	if ((err = fetchprop(cur, DTD_ATTR_MAC, tabptr->zone_nwif_mac,
+	    sizeof (tabptr->zone_nwif_mac))) != Z_OK) {
+		handle->zone_dh_cur = handle->zone_dh_top;
+		return (err);
+	}
+
+	if ((err = fetchprop(cur, DTD_ATTR_VLANID, tabptr->zone_nwif_vlan_id,
+	    sizeof (tabptr->zone_nwif_vlan_id))) != Z_OK) {
+		handle->zone_dh_cur = handle->zone_dh_top;
+		return (err);
+	}
+
+	if ((err = fetchprop(cur, DTD_ATTR_GNIC, tabptr->zone_nwif_gnic,
+	    sizeof (tabptr->zone_nwif_gnic))) != Z_OK) {
+		handle->zone_dh_cur = handle->zone_dh_top;
+		return (err);
+	}
+
 	if ((err = fetchprop(cur, DTD_ATTR_DEFROUTER,
 	    tabptr->zone_nwif_defrouter,
 	    sizeof (tabptr->zone_nwif_defrouter))) != Z_OK) {
@@ -4915,6 +5235,29 @@ zonecfg_getnwifent(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
 		return (err);
 	}
 
+	tabptr->zone_nwif_attrp = NULL;
+	for (val = cur->xmlChildrenNode; val != NULL; val = val->next) {
+		valptr = (struct zone_res_attrtab *)malloc(
+		    sizeof (struct zone_res_attrtab));
+		if (valptr == NULL)
+			return (Z_NOMEM);
+
+		valptr->zone_res_attr_name[0] =
+		    valptr->zone_res_attr_value[0] = '\0';
+		if (zonecfg_add_res_attr(&(tabptr->zone_nwif_attrp), valptr)
+		    != Z_OK) {
+			free(valptr);
+			break;
+		}
+
+		if (fetchprop(val, DTD_ATTR_NAME, valptr->zone_res_attr_name,
+		    sizeof (valptr->zone_res_attr_name)) != Z_OK)
+			break;
+		if (fetchprop(val, DTD_ATTR_VALUE, valptr->zone_res_attr_value,
+		    sizeof (valptr->zone_res_attr_value)) != Z_OK)
+			break;
+	}
+
 	handle->zone_dh_cur = cur->next;
 	return (Z_OK);
 }
@@ -4934,7 +5277,7 @@ zonecfg_setdevent(zone_dochandle_t handle)
 int
 zonecfg_getdevent(zone_dochandle_t handle, struct zone_devtab *tabptr)
 {
-	xmlNodePtr cur;
+	xmlNodePtr cur, val;
 	int err;
 
 	if (handle == NULL)
@@ -4957,6 +5300,31 @@ zonecfg_getdevent(zone_dochandle_t handle, struct zone_devtab *tabptr)
 		return (err);
 	}
 
+	tabptr->zone_dev_attrp = NULL;
+	for (val = cur->xmlChildrenNode; val != NULL; val = val->next) {
+		struct zone_res_attrtab *valptr;
+
+		valptr = (struct zone_res_attrtab *)malloc(
+		    sizeof (struct zone_res_attrtab));
+		if (valptr == NULL)
+			return (Z_NOMEM);
+
+		valptr->zone_res_attr_name[0] =
+		    valptr->zone_res_attr_value[0] = '\0';
+		if (zonecfg_add_res_attr(&(tabptr->zone_dev_attrp), valptr)
+		    != Z_OK) {
+			free(valptr);
+			break;
+		}
+
+		if ((fetchprop(val, DTD_ATTR_NAME, valptr->zone_res_attr_name,
+		    sizeof (valptr->zone_res_attr_name)) != Z_OK))
+			break;
+		if ((fetchprop(val, DTD_ATTR_VALUE, valptr->zone_res_attr_value,
+		    sizeof (valptr->zone_res_attr_value)) != Z_OK))
+			break;
+	}
+
 	handle->zone_dh_cur = cur->next;
 	return (Z_OK);
 }
@@ -5685,6 +6053,164 @@ zone_get_brand(char *zone_name, char *brandname, size_t rp_sz)
 }
 
 /*
+ * Atomically get a new zone_did value.  The currently allocated value
+ * is stored in /etc/zones/did.txt.  Lock the file, read the current value,
+ * increment, save the new value and unlock the file.  Return the new value
+ * or -1 if there was an error.  The ID namespace is large enough that we
+ * don't worry about recycling an ID when a zone is deleted.
+ */
+static zoneid_t
+new_zone_did()
+{
+	int fd;
+	int len;
+	int val;
+	struct flock lck;
+	char buf[80];
+
+	if ((fd = open(DEBUGID_FILE, O_RDWR | O_CREAT,
+	    S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) < 0) {
+		perror("new_zone_did open failed");
+		return (-1);
+	}
+
+	/* Initialize the lock. */
+	lck.l_whence = SEEK_SET;
+	lck.l_start = 0;
+	lck.l_len = 0;
+
+	/* Wait until we acquire an exclusive lock on the file. */
+	lck.l_type = F_WRLCK;
+	if (fcntl(fd, F_SETLKW, &lck) == -1) {
+		perror("new_zone_did lock failed");
+		(void) close(fd);
+		return (-1);
+	}
+
+	/* Get currently allocated value */
+	len = read(fd, buf, sizeof (buf));
+	if (len == -1) {
+		perror("new_zone_did read failed");
+		val = -1;
+	} else {
+		if (lseek(fd, 0L, SEEK_SET) == -1) {
+			perror("new_zone_did seek failed");
+			val = -1;
+		} else {
+			if (len == 0) {
+				/* Just created the file, initialize at 1 */
+				val = 1;
+			} else {
+				val = atoi(buf);
+				val++;
+			}
+
+			(void) snprintf(buf, sizeof (buf), "%d\n", val);
+			len = strlen(buf);
+
+			/* Save newly allocated value */
+			if (write(fd, buf, len) == -1) {
+				perror("new_zone_did write failed");
+				val = -1;
+			}
+		}
+	}
+
+	/* Release the file lock. */
+	lck.l_type = F_UNLCK;
+	if (fcntl(fd, F_SETLK, &lck) == -1) {
+		perror("new_zone_did unlock failed");
+		val = -1;
+	}
+
+	if (close(fd) != 0)
+		perror("new_zone_did close failed");
+
+	return (val);
+}
+
+/*
+ * Called by zoneadmd to get the zone's debug ID.
+ * If the zone doesn't already have an ID, a new one is generated and
+ * persistently saved onto the zone.  Normally either zoneadm or zonecfg
+ * will assign a new ID for the zone, so zoneadmd should never have to
+ * generate one, but we also handle that here just to be paranoid.
+ */
+zoneid_t
+zone_get_did(char *zone_name)
+{
+	int res;
+	zoneid_t new_did;
+	zone_dochandle_t handle;
+	char did_str[80];
+
+	if ((handle = zonecfg_init_handle()) == NULL)
+		return (getpid());
+
+	if (zonecfg_get_handle((char *)zone_name, handle) != Z_OK)
+		return (getpid());
+
+	res = getrootattr(handle, DTD_ATTR_DID, did_str, sizeof (did_str));
+
+	/* If the zone already has an assigned debug ID, return it. */
+	if (res == Z_OK && did_str[0] != '\0') {
+		zonecfg_fini_handle(handle);
+		return (atoi(did_str));
+	}
+
+	/*
+	 * The zone doesn't have an assigned debug ID yet, generate one and
+	 * save it as part of the zone definition.
+	 */
+	if ((new_did = new_zone_did()) == -1) {
+		/*
+		 * We should really never hit this block of code.
+		 * Generating a new ID failed for some reason.  Use the current
+		 * pid as a temporary ID so that the zone can continue to boot
+		 * but we don't persistently save this temporary ID on the zone.
+		 */
+		zonecfg_fini_handle(handle);
+		return (getpid());
+	}
+
+	/* Now persistently save this new ID onto the zone. */
+	(void) snprintf(did_str, sizeof (did_str), "%d", new_did);
+	(void) setrootattr(handle, DTD_ATTR_DID, did_str);
+	(void) zonecfg_save(handle);
+
+	zonecfg_fini_handle(handle);
+	return (new_did);
+}
+
+zoneid_t
+zonecfg_get_did(zone_dochandle_t handle)
+{
+	char did_str[80];
+	int err;
+	zoneid_t did;
+
+	err = getrootattr(handle, DTD_ATTR_DID, did_str, sizeof (did_str));
+	if (err == Z_OK && did_str[0] != '\0')
+		did = atoi(did_str);
+	else
+		did = -1;
+
+	return (did);
+}
+
+void
+zonecfg_set_did(zone_dochandle_t handle)
+{
+	zoneid_t new_did;
+	char did_str[80];
+
+	if ((new_did = new_zone_did()) == -1)
+		return;
+	(void) snprintf(did_str, sizeof (did_str), "%d", new_did);
+	(void) setrootattr(handle, DTD_ATTR_DID, did_str);
+}
+
+/*
  * Return the appropriate root for the active /dev.
  * For normal zone, the path is $ZONEPATH/root;
  * for scratch zone, the dev path is $ZONEPATH/lu.
@@ -5808,16 +6334,27 @@ int
 zone_set_state(char *zone, zone_state_t state)
 {
 	struct zoneent ze;
+	int res;
+	zone_state_t oldst = (zone_state_t)-1;
 
 	if (state != ZONE_STATE_CONFIGURED && state != ZONE_STATE_INSTALLED &&
 	    state != ZONE_STATE_INCOMPLETE)
 		return (Z_INVAL);
 
+	(void) zone_get_state(zone, &oldst);
+
 	bzero(&ze, sizeof (ze));
 	(void) strlcpy(ze.zone_name, zone, sizeof (ze.zone_name));
 	ze.zone_state = state;
 	(void) strlcpy(ze.zone_path, "", sizeof (ze.zone_path));
-	return (putzoneent(&ze, PZE_MODIFY));
+	res = putzoneent(&ze, PZE_MODIFY);
+
+	if (res == Z_OK) {
+		zonecfg_notify_conf_change(zone, zone_state_str(oldst),
+		    zone_state_str(state));
+	}
+
+	return (res);
 }
 
 /*
@@ -5967,6 +6504,30 @@ zonecfg_get_uuid(const char *zonename, uuid_t uuid)
 }
 
 /*
+ * Changes a zone's UUID to the given value. Returns an error if the UUID is
+ * malformed or if the zone cannot be located.
+ */
+int
+zonecfg_set_uuid(const char *zonename, const char *zonepath,
+    const char *uuid)
+{
+	int err;
+	struct zoneent ze;
+
+	bzero(&ze, sizeof (ze));
+	ze.zone_state = -1;	/* Preserve existing state in index */
+	(void) strlcpy(ze.zone_name, zonename, sizeof (ze.zone_name));
+	(void) strlcpy(ze.zone_path, zonepath, sizeof (ze.zone_path));
+	if (uuid_parse((char *)uuid, ze.zone_uuid) == -1)
+		return (Z_INVALID_PROPERTY);
+
+	if ((err = putzoneent(&ze, PZE_MODIFY)) != Z_OK)
+		return (err);
+
+	return (Z_OK);
+}
+
+/*
  * File-system convenience functions.
  */
 boolean_t
@@ -6999,86 +7560,49 @@ zonecfg_getpsetent(zone_dochandle_t handle, struct zone_psettab *tabptr)
 	return (err);
 }
 
-static int
-add_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
-{
-	xmlNodePtr newnode, cur = handle->zone_dh_cur;
-	int err;
-
-	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_MCAP, NULL);
-	if ((err = newprop(newnode, DTD_ATTR_PHYSCAP, tabptr->zone_physmem_cap))
-	    != Z_OK)
-		return (err);
-
-	return (Z_OK);
-}
-
+/*
+ * Cleanup obsolete constructs in the configuration.
+ * Return true of the config has been updated and must be commited.
+ */
 int
-zonecfg_delete_mcap(zone_dochandle_t handle)
+zonecfg_fix_obsolete(zone_dochandle_t handle)
 {
-	int err;
-	xmlNodePtr cur = handle->zone_dh_cur;
+	int res = 0;
+	int add_physmem_rctl = 0;
+	xmlNodePtr cur;
+	char	zone_physmem_cap[MAXNAMELEN];
 
-	if ((err = operation_prep(handle)) != Z_OK)
-		return (err);
+	if (operation_prep(handle) != Z_OK)
+		return (res);
 
+	/*
+	 * If an obsolete mcap entry exists, convert it to the rctl.
+	 */
+	cur = handle->zone_dh_cur;
 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
 		if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) != 0)
 			continue;
 
+		if (fetchprop(cur, DTD_ATTR_PHYSCAP,
+		    zone_physmem_cap, sizeof (zone_physmem_cap)) == Z_OK) {
+			res = 1;
+			add_physmem_rctl = 1;
+		}
+
 		xmlUnlinkNode(cur);
 		xmlFreeNode(cur);
-		return (Z_OK);
+		break;
 	}
-	return (Z_NO_RESOURCE_ID);
-}
 
-int
-zonecfg_modify_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
-{
-	int err;
+	if (add_physmem_rctl) {
+		uint64_t cap;
+		char *endp;
 
-	if (tabptr == NULL)
-		return (Z_INVAL);
-
-	err = zonecfg_delete_mcap(handle);
-	/* it is ok if there is no mcap entry */
-	if (err != Z_OK && err != Z_NO_RESOURCE_ID)
-		return (err);
-
-	if ((err = add_mcap(handle, tabptr)) != Z_OK)
-		return (err);
-
-	return (Z_OK);
-}
-
-int
-zonecfg_lookup_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
-{
-	xmlNodePtr cur;
-	int err;
-
-	if (tabptr == NULL)
-		return (Z_INVAL);
-
-	if ((err = operation_prep(handle)) != Z_OK)
-		return (err);
-
-	cur = handle->zone_dh_cur;
-	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
-		if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) != 0)
-			continue;
-		if ((err = fetchprop(cur, DTD_ATTR_PHYSCAP,
-		    tabptr->zone_physmem_cap,
-		    sizeof (tabptr->zone_physmem_cap))) != Z_OK) {
-			handle->zone_dh_cur = handle->zone_dh_top;
-			return (err);
-		}
-
-		return (Z_OK);
+		cap = strtoull(zone_physmem_cap, &endp, 10);
+		(void) zonecfg_set_aliased_rctl(handle, ALIAS_MAXPHYSMEM, cap);
 	}
 
-	return (Z_NO_ENTRY);
+	return (res);
 }
 
 int
@@ -7136,51 +7660,6 @@ zonecfg_getsecflagsent(zone_dochandle_t handle,
 	return (err);
 }
 
-static int
-getmcapent_core(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
-{
-	xmlNodePtr cur;
-	int err;
-
-	if (handle == NULL)
-		return (Z_INVAL);
-
-	if ((cur = handle->zone_dh_cur) == NULL)
-		return (Z_NO_ENTRY);
-
-	for (; cur != NULL; cur = cur->next)
-		if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) == 0)
-			break;
-	if (cur == NULL) {
-		handle->zone_dh_cur = handle->zone_dh_top;
-		return (Z_NO_ENTRY);
-	}
-
-	if ((err = fetchprop(cur, DTD_ATTR_PHYSCAP, tabptr->zone_physmem_cap,
-	    sizeof (tabptr->zone_physmem_cap))) != Z_OK) {
-		handle->zone_dh_cur = handle->zone_dh_top;
-		return (err);
-	}
-
-	handle->zone_dh_cur = cur->next;
-	return (Z_OK);
-}
-
-int
-zonecfg_getmcapent(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
-{
-	int err;
-
-	if ((err = zonecfg_setent(handle)) != Z_OK)
-		return (err);
-
-	err = getmcapent_core(handle, tabptr);
-
-	(void) zonecfg_endent(handle);
-
-	return (err);
-}
-
 /*
  * Get the full tree of pkg metadata in a set of nested AVL trees.
  * pkgs_avl is an AVL tree of pkgs.
@@ -7846,7 +8325,7 @@ zonecfg_update_userauths(zone_dochandle_t handle, char *zonename)
 		(void) fclose(uaf);
 		return (Z_MISC_FS);
 	}
-	if (!config_file_path(zonename, config_file)) {
+	if (!config_file_path(zonename, config_file, sizeof (config_file))) {
 		(void) fclose(uaf);
 		return (Z_MISC_FS);
 	}
diff --git a/usr/src/lib/libzonecfg/common/mapfile-vers b/usr/src/lib/libzonecfg/common/mapfile-vers
index c73533b97f..da4009d2fa 100644
--- a/usr/src/lib/libzonecfg/common/mapfile-vers
+++ b/usr/src/lib/libzonecfg/common/mapfile-vers
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015, Joyent Inc.
 #
 
 #
@@ -53,6 +54,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_add_fs_option;
 	zonecfg_add_admin;
 	zonecfg_add_nwif;
+	zonecfg_add_res_attr;
 	zonecfg_add_pkg;
 	zonecfg_add_pset;
 	zonecfg_add_rctl;
@@ -80,7 +82,6 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_delete_dev;
 	zonecfg_delete_ds;
 	zonecfg_delete_filesystem;
-	zonecfg_delete_mcap;
 	zonecfg_delete_nwif;
 	zonecfg_delete_pset;
 	zonecfg_delete_rctl;
@@ -106,7 +107,9 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_find_mounts;
 	zonecfg_find_scratch;
 	zonecfg_fini_handle;
+	zonecfg_fix_obsolete;
 	zonecfg_free_fs_option_list;
+	zonecfg_free_res_attr_list;
 	zonecfg_free_rctl_value_list;
 	zonecfg_get_aliased_rctl;
 	zonecfg_get_attach_handle;
@@ -120,6 +123,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_get_bootargs;
 	zonecfg_get_brand;
 	zonecfg_get_dflt_sched_class;
+	zonecfg_get_did;
 	zonecfg_getdevent;
 	zonecfg_getdevperment;
 	zonecfg_getdsent;
@@ -129,7 +133,6 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_get_hostid;
 	zonecfg_get_iptype;
 	zonecfg_get_limitpriv;
-	zonecfg_getmcapent;
 	zonecfg_get_name;
 	zonecfg_get_name_by_uuid;
 	zonecfg_getnwifent;
@@ -163,7 +166,6 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_lookup_dev;
 	zonecfg_lookup_ds;
 	zonecfg_lookup_filesystem;
-	zonecfg_lookup_mcap;
 	zonecfg_lookup_nwif;
 	zonecfg_lookup_pset;
 	zonecfg_lookup_rctl;
@@ -173,12 +175,12 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_modify_dev;
 	zonecfg_modify_ds;
 	zonecfg_modify_filesystem;
-	zonecfg_modify_mcap;
 	zonecfg_modify_nwif;
 	zonecfg_modify_pset;
 	zonecfg_modify_rctl;
 	zonecfg_modify_secflags;
 	zonecfg_notify_bind;
+	zonecfg_notify_create;
 	zonecfg_notify_critical_abort;
 	zonecfg_notify_critical_enter;
 	zonecfg_notify_critical_exit;
@@ -188,6 +190,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_ping_zoneadmd;
 	zonecfg_release_lock_file;
 	zonecfg_remove_fs_option;
+	zonecfg_remove_res_attr;
 	zonecfg_remove_rctl_value;
 	zonecfg_remove_userauths;
 	zonecfg_reverse_scratch;
@@ -201,6 +204,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_set_autoboot;
 	zonecfg_set_bootargs;
 	zonecfg_set_brand;
+	zonecfg_set_did;
 	zonecfg_setdevent;
 	zonecfg_setdevperment;
 	zonecfg_setdsent;
@@ -216,6 +220,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_set_root;
 	zonecfg_set_sched;
 	zonecfg_set_swinv;
+	zonecfg_set_uuid;
 	zonecfg_set_zonepath;
 	zonecfg_strerror;
 	zonecfg_str_to_bytes;
@@ -234,6 +239,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	zonecfg_verify_save;
 	zonecfg_warn_poold;
 	zone_get_brand;
+	zone_get_did;
 	zone_get_devroot;
 	zone_get_id;
 	zone_get_rootpath;
diff --git a/usr/src/lib/libzonecfg/dtd/zonecfg.dtd.1 b/usr/src/lib/libzonecfg/dtd/zonecfg.dtd.1
index 03be1a2bf5..228bb8ace2 100644
--- a/usr/src/lib/libzonecfg/dtd/zonecfg.dtd.1
+++ b/usr/src/lib/libzonecfg/dtd/zonecfg.dtd.1
@@ -21,6 +21,7 @@
  CDDL HEADER END
 
  Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ Copyright (c) 2011, Joyent Inc. All rights reserved.
 
 -->
 
@@ -46,14 +47,21 @@
 
 <!ATTLIST inherited-pkg-dir	directory	CDATA #REQUIRED>
 
-<!ELEMENT network	EMPTY>
+<!ELEMENT net-attr	EMPTY>
+<!ATTLIST net-attr	name		CDATA #REQUIRED
+			value		CDATA #REQUIRED>
+
+<!ELEMENT network	(net-attr)*>
 
 <!ATTLIST network	address		CDATA ""
 			allowed-address	CDATA ""
 			defrouter	CDATA ""
-			physical	CDATA #REQUIRED>
+			global-nic	CDATA ""
+			mac-addr	CDATA ""
+			physical	CDATA #REQUIRED
+			vlan-id		CDATA "">
 
-<!ELEMENT device	EMPTY>
+<!ELEMENT device	(net-attr)*>
 
 <!ATTLIST device	match		CDATA #REQUIRED>
 
@@ -162,6 +170,7 @@
 			limitpriv	CDATA ""
 			bootargs	CDATA ""
 			brand		CDATA ""
+			debugid		CDATA ""
 			scheduling-class	CDATA ""
 			fs-allowed	CDATA ""
 			version		NMTOKEN #FIXED '1'>
diff --git a/usr/src/lib/libzpool/Makefile.com b/usr/src/lib/libzpool/Makefile.com
index ae65fc5887..1faef17cd7 100644
--- a/usr/src/lib/libzpool/Makefile.com
+++ b/usr/src/lib/libzpool/Makefile.com
@@ -21,7 +21,7 @@
 #
 # Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright (c) 2013, 2016 by Delphix. All rights reserved.
-# Copyright 2017 Joyent, Inc.
+# Copyright 2018 Joyent, Inc.
 #
 
 LIBRARY= libzpool.a
@@ -76,6 +76,11 @@ CPPFLAGS +=	$(INCS)	-DDEBUG -D_FAKE_KERNEL
 LINTFLAGS +=	-erroff=E_STATIC_UNUSED $(INCS)
 LINTFLAGS64 +=	-erroff=E_STATIC_UNUSED $(INCS)
 
+# The following is needed to fix the SmartOS build; see OS-6582. We cannot do
+# a conditional appendage to INCS, since that breaks the lint build.
+CFLAGS += -isystem $(ROOT)/usr/include
+CFLAGS64 += -isystem $(ROOT)/usr/include
+
 CERRWARN +=	-_gcc=-Wno-parentheses
 CERRWARN +=	-_gcc=-Wno-switch
 CERRWARN +=	-_gcc=-Wno-type-limits
diff --git a/usr/src/lib/libzpool/common/sys/zfs_context.h b/usr/src/lib/libzpool/common/sys/zfs_context.h
index d1dce80196..199f7203c9 100644
--- a/usr/src/lib/libzpool/common/sys/zfs_context.h
+++ b/usr/src/lib/libzpool/common/sys/zfs_context.h
@@ -21,8 +21,8 @@
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright 2017 RackTop Systems.
  */
 
diff --git a/usr/src/lib/mergeq/mergeq.c b/usr/src/lib/mergeq/mergeq.c
new file mode 100644
index 0000000000..fd9a9c32ea
--- /dev/null
+++ b/usr/src/lib/mergeq/mergeq.c
@@ -0,0 +1,606 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Merge queue
+ *
+ * A multi-threaded merging queue.
+ *
+ * The general constraint of the merge queue is that if a set of items are
+ * inserted into the queue in the same order, then no matter how many threads
+ * are on the scene, we will always process the items in the same order. The
+ * secondary constraint is that to support environments that must be
+ * single-threaded, we explicitly *must not* create a thread in the case where
+ * the number of requested threads is just one.
+ *
+ * To that end, we've designed our queue as a circular buffer. We will grow that
+ * buffer to contain enough space for all the input items, after which we'll
+ * then treat it as a circular buffer.
+ *
+ * Items will be issued to a processing function two at a time, until there is
+ * only one item remaining in the queue, at which point we will be doing doing
+ * any merging work.
+ *
+ * A given queue has three different entries that we care about tracking:
+ *
+ * o mq_nproc   - What is the slot of the next item to process for something
+ *                looking for work.
+ *
+ * o mq_next    - What is the slot of the next item that should be inserted into
+ *                the queue.
+ *
+ * o mq_ncommit - What is the slot of the next item that should be committed.
+ *
+ * When a thread comes and looks for work, we pop entries off of the queue based
+ * on the index provided by mq_nproc. At the same time, it also gets the slot
+ * that it should place the result in, which is mq_next. However, because we
+ * have multiple threads that are operating on the system, we want to make sure
+ * that we push things onto the queue in order. We do that by allocating a slot
+ * to each task and when it completes, it waits for its slot to be ready based
+ * on it being the value of mq_ncommit.
+ *
+ * In addition, we keep track of the number of items in the queue as well as the
+ * number of active workers. There's also a generation count that is used to
+ * figure out when the various values might lap one another.
+ *
+ * The following images show what happens when we have a queue with six items
+ * and whose capacity has been shrunk to six, to better fit in the screen.
+ *
+ *
+ * 1) This is the initial configuration of the queue right before any processing
+ * is done in the context of mergeq_merge(). Every box has an initial item for
+ * merging in it (represented by an 'x'). Here, the mq_nproc, mq_next, and
+ * mq_ncommit will all point at the initial entry. However, the mq_next has
+ * already lapped around the array and thus has a generation count of one.
+ *
+ * The '+' characters indicate which bucket the corresponding value of mq_nproc,
+ * mq_ncommit, and mq_nproc.
+ *
+ *                     +---++---++---++---++---++---+
+ *                     | X || X || X || X || X || X |
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)   +
+ *     mq_ncommit (g0)   +
+ *       mq_nproc (g0)   +
+ *
+ * 2) This shows the state right as the first thread begins to process an entry.
+ * Note in this example we will have two threads processing this queue. Note,
+ * mq_ncommit has not advanced. This is because the first thread has started
+ * processing entries, but it has not finished, and thus we can't commit it.
+ * We've incremented mq_next by one because it has gone ahead and assigned a
+ * single entry. We've incremented mq_nproc by two, because we have removed two
+ * entries and thus will have another set available.
+ *
+ *                     +---++---++---++---++---++---+     t1 - slot 0
+ *                     |   ||   || X || X || X || X |     t2 - idle
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)        +
+ *     mq_ncommit (g0)   +
+ *       mq_nproc (g0)             +
+ *
+ *
+ * 3) This shows the state right after the second thread begins to process an
+ * entry, note that the first thread has not finished. The changes are very
+ * similar to the previous state, we've advanced, mq_nproc and mq_next, but not
+ * mq_ncommit.
+ *
+ *                     +---++---++---++---++---++---+     t1 - slot 0
+ *                     |   ||   ||   ||   || X || X |     t2 - slot 1
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)             +
+ *     mq_ncommit (g0)   +
+ *       mq_nproc (g0)                       +
+ *
+ * 4) This shows the state after thread one has finished processing an item, but
+ * before it does anything else. Note that even if thread two finishes early, it
+ * cannot commit its item until thread one finishes. Here 'Y' refers to the
+ * result of merging the first two 'X's.
+ *
+ *                     +---++---++---++---++---++---+     t1 - idle
+ *                     | Y ||   ||   ||   || X || X |     t2 - slot 1
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)             +
+ *     mq_ncommit (g0)        +
+ *       mq_nproc (g0)                       +
+ *
+ * 5) This shows the state after thread one has begun to process the next round
+ * and after thread two has committed, but before it begins processing the next
+ * item. Note that mq_nproc has wrapped around and we've bumped its generation
+ * counter.
+ *
+ *                     +---++---++---++---++---++---+     t1 - slot 2
+ *                     | Y || Y ||   ||   ||   ||   |     t2 - idle
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)                  +
+ *     mq_ncommit (g0)             +
+ *       mq_nproc (g0)   +
+ *
+ * 6) Here, thread two, will take the next two Y values and thread 1 will commit
+ * its 'Y'. Thread one now must wait until thread two finishes such that it can
+ * do additional work.
+ *
+ *                     +---++---++---++---++---++---+     t1 - waiting
+ *                     |   ||   || Y ||   ||   ||   |     t2 - slot 3
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)                       +
+ *     mq_ncommit (g0)                  +
+ *       mq_nproc (g0)             +
+ *
+ * 7) Here, thread two has committed and thread one is about to go process the
+ * final entry. The character 'Z' represents the results of merging two 'Y's.
+ *
+ *                     +---++---++---++---++---++---+     t1 - idle
+ *                     |   ||   || Y || Z ||   ||   |     t2 - idle
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)                       +
+ *     mq_ncommit (g0)                       +
+ *       mq_nproc (g0)             +
+ *
+ * 8) Here, thread one is processing the final item. Thread two is waiting in
+ * mergeq_pop() for enough items to be available. In this case, it will never
+ * happen; however, once all threads have finished it will break out.
+ *
+ *                     +---++---++---++---++---++---+     t1 - slot 4
+ *                     |   ||   ||   ||   ||   ||   |     t2 - idle
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)                            +
+ *     mq_ncommit (g0)                       +
+ *       mq_nproc (g0)                       +
+ *
+ * 9) This is the final state of the queue, it has a single '*' item which is
+ * the final merge result. At this point, both thread one and thread two would
+ * stop processing and we'll return the result to the user.
+ *
+ *                     +---++---++---++---++---++---+     t1 - slot 4
+ *                     |   ||   ||   ||   || * ||   |     t2 - idle
+ *                     +---++---++---++---++---++---+
+ *        mq_next (g1)                            +
+ *     mq_ncommit (g0)                       +
+ *       mq_nproc (g0)                       +
+ *
+ *
+ * Note, that if at any point in time the processing function fails, then all
+ * the merges will quiesce and that error will be propagated back to the user.
+ */
+
+#include <strings.h>
+#include <sys/debug.h>
+#include <thread.h>
+#include <synch.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+
+#include "mergeq.h"
+
+struct mergeq {
+	mutex_t mq_lock;	/* Protects items below */
+	cond_t	mq_cond;	/* Condition variable */
+	void **mq_items;	/* Array of items to process */
+	size_t mq_nitems;	/* Number of items in the queue */
+	size_t mq_cap;		/* Capacity of the items */
+	size_t mq_next;		/* Place to put next entry */
+	size_t mq_gnext;	/* Generation for next */
+	size_t mq_nproc;	/* Index of next thing to process */
+	size_t mq_gnproc;	/* Generation for next proc */
+	size_t mq_ncommit;	/* Index of the next thing to commit */
+	size_t mq_gncommit;	/* Commit generation */
+	uint_t mq_nactthrs;	/* Number of active threads */
+	uint_t mq_ndthreads;	/* Desired number of threads */
+	thread_t *mq_thrs;	/* Actual threads */
+	mergeq_proc_f *mq_func;	/* Processing function */
+	void *mq_arg;		/* Argument for processing */
+	boolean_t mq_working;	/* Are we working on processing */
+	boolean_t mq_iserror;	/* Have we encountered an error? */
+	int mq_error;
+};
+
+#define	MERGEQ_DEFAULT_CAP	64
+
+static int
+mergeq_error(int err)
+{
+	errno = err;
+	return (MERGEQ_ERROR);
+}
+
+void
+mergeq_fini(mergeq_t *mqp)
+{
+	if (mqp == NULL)
+		return;
+
+	VERIFY(mqp->mq_working != B_TRUE);
+
+	if (mqp->mq_items != NULL)
+		mergeq_free(mqp->mq_items, sizeof (void *) * mqp->mq_cap);
+	if (mqp->mq_ndthreads > 0) {
+		mergeq_free(mqp->mq_thrs, sizeof (thread_t) *
+		    mqp->mq_ndthreads);
+	}
+	VERIFY0(cond_destroy(&mqp->mq_cond));
+	VERIFY0(mutex_destroy(&mqp->mq_lock));
+	mergeq_free(mqp, sizeof (mergeq_t));
+}
+
+int
+mergeq_init(mergeq_t **outp, uint_t nthrs)
+{
+	int ret;
+	mergeq_t *mqp;
+
+	mqp = mergeq_alloc(sizeof (mergeq_t));
+	if (mqp == NULL)
+		return (mergeq_error(ENOMEM));
+
+	bzero(mqp, sizeof (mergeq_t));
+	mqp->mq_items = mergeq_alloc(sizeof (void *) * MERGEQ_DEFAULT_CAP);
+	if (mqp->mq_items == NULL) {
+		mergeq_free(mqp, sizeof (mergeq_t));
+		return (mergeq_error(ENOMEM));
+	}
+	bzero(mqp->mq_items, sizeof (void *) * MERGEQ_DEFAULT_CAP);
+
+	mqp->mq_ndthreads = nthrs - 1;
+	if (mqp->mq_ndthreads > 0) {
+		mqp->mq_thrs = mergeq_alloc(sizeof (thread_t) *
+		    mqp->mq_ndthreads);
+		if (mqp->mq_thrs == NULL) {
+			mergeq_free(mqp->mq_items, sizeof (void *) *
+			    MERGEQ_DEFAULT_CAP);
+			mergeq_free(mqp, sizeof (mergeq_t));
+			return (mergeq_error(ENOMEM));
+		}
+	}
+
+	if ((ret = mutex_init(&mqp->mq_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL)) != 0) {
+		if (mqp->mq_ndthreads > 0) {
+			mergeq_free(mqp->mq_thrs,
+			    sizeof (thread_t) * mqp->mq_ndthreads);
+		}
+		mergeq_free(mqp->mq_items, sizeof (void *) *
+		    MERGEQ_DEFAULT_CAP);
+		mergeq_free(mqp, sizeof (mergeq_t));
+		return (mergeq_error(ret));
+	}
+
+	if ((ret = cond_init(&mqp->mq_cond, USYNC_THREAD, NULL)) != 0) {
+		VERIFY0(mutex_destroy(&mqp->mq_lock));
+		if (mqp->mq_ndthreads > 0) {
+			mergeq_free(mqp->mq_thrs,
+			    sizeof (thread_t) * mqp->mq_ndthreads);
+		}
+		mergeq_free(mqp->mq_items, sizeof (void *) *
+		    MERGEQ_DEFAULT_CAP);
+		mergeq_free(mqp, sizeof (mergeq_t));
+		return (mergeq_error(ret));
+	}
+
+	mqp->mq_cap = MERGEQ_DEFAULT_CAP;
+	*outp = mqp;
+	return (0);
+}
+
+static void
+mergeq_reset(mergeq_t *mqp)
+{
+	VERIFY(MUTEX_HELD(&mqp->mq_lock));
+	VERIFY(mqp->mq_working == B_FALSE);
+	if (mqp->mq_cap != 0)
+		bzero(mqp->mq_items, sizeof (void *) * mqp->mq_cap);
+	mqp->mq_nitems = 0;
+	mqp->mq_next = 0;
+	mqp->mq_gnext = 0;
+	mqp->mq_nproc = 0;
+	mqp->mq_gnproc = 0;
+	mqp->mq_ncommit = 0;
+	mqp->mq_gncommit = 0;
+	mqp->mq_func = NULL;
+	mqp->mq_arg = NULL;
+	mqp->mq_iserror = B_FALSE;
+	mqp->mq_error = 0;
+}
+
+static int
+mergeq_grow(mergeq_t *mqp)
+{
+	size_t ncap;
+	void **items;
+
+	VERIFY(MUTEX_HELD(&mqp->mq_lock));
+	VERIFY(mqp->mq_working == B_FALSE);
+
+	if (SIZE_MAX - mqp->mq_cap < MERGEQ_DEFAULT_CAP)
+		return (ENOSPC);
+
+	ncap = mqp->mq_cap + MERGEQ_DEFAULT_CAP;
+	items = mergeq_alloc(ncap * sizeof (void *));
+	if (items == NULL)
+		return (ENOMEM);
+
+	bzero(items, ncap * sizeof (void *));
+	bcopy(mqp->mq_items, items, mqp->mq_cap * sizeof (void *));
+	mergeq_free(mqp->mq_items, sizeof (mqp->mq_cap) * sizeof (void *));
+	mqp->mq_items = items;
+	mqp->mq_cap = ncap;
+	return (0);
+}
+
+int
+mergeq_add(mergeq_t *mqp, void *item)
+{
+	VERIFY0(mutex_lock(&mqp->mq_lock));
+	if (mqp->mq_working == B_TRUE) {
+		VERIFY0(mutex_unlock(&mqp->mq_lock));
+		return (mergeq_error(ENXIO));
+	}
+
+	if (mqp->mq_next == mqp->mq_cap) {
+		int ret;
+
+		if ((ret = mergeq_grow(mqp)) != 0) {
+			VERIFY0(mutex_unlock(&mqp->mq_lock));
+			return (mergeq_error(ret));
+		}
+	}
+	mqp->mq_items[mqp->mq_next] = item;
+	mqp->mq_next++;
+	mqp->mq_nitems++;
+
+	VERIFY0(mutex_unlock(&mqp->mq_lock));
+	return (0);
+}
+
+static size_t
+mergeq_slot(mergeq_t *mqp)
+{
+	size_t s;
+
+	VERIFY(MUTEX_HELD(&mqp->mq_lock));
+	VERIFY(mqp->mq_next < mqp->mq_cap);
+
+	/*
+	 * This probably should be a cv / wait thing.
+	 */
+	VERIFY(mqp->mq_nproc != (mqp->mq_next + 1) % mqp->mq_cap);
+
+	s = mqp->mq_next;
+	mqp->mq_next++;
+	if (mqp->mq_next == mqp->mq_cap) {
+		mqp->mq_next %= mqp->mq_cap;
+		mqp->mq_gnext++;
+	}
+
+	return (s);
+}
+
+/*
+ * Internal function to push items onto the queue which is now a circular
+ * buffer. This should only be used once we begin working on the queue.
+ */
+static void
+mergeq_push(mergeq_t *mqp, size_t slot, void *item)
+{
+	VERIFY(MUTEX_HELD(&mqp->mq_lock));
+	VERIFY(slot < mqp->mq_cap);
+
+	/*
+	 * We need to verify that we don't push over something that exists.
+	 * Based on the design, this should never happen. However, in the face
+	 * of bugs, anything is possible.
+	 */
+	while (mqp->mq_ncommit != slot && mqp->mq_iserror == B_FALSE)
+		(void) cond_wait(&mqp->mq_cond, &mqp->mq_lock);
+
+	if (mqp->mq_iserror == B_TRUE)
+		return;
+
+	mqp->mq_items[slot] = item;
+	mqp->mq_nitems++;
+	mqp->mq_ncommit++;
+	if (mqp->mq_ncommit == mqp->mq_cap) {
+		mqp->mq_ncommit %= mqp->mq_cap;
+		mqp->mq_gncommit++;
+	}
+	cond_broadcast(&mqp->mq_cond);
+}
+
+static void *
+mergeq_pop_one(mergeq_t *mqp)
+{
+	void *out;
+
+	/*
+	 * We can't move mq_nproc beyond mq_next if they're on the same
+	 * generation.
+	 */
+	VERIFY(mqp->mq_gnext != mqp->mq_gnproc ||
+	    mqp->mq_nproc != mqp->mq_next);
+
+	out = mqp->mq_items[mqp->mq_nproc];
+
+	mqp->mq_items[mqp->mq_nproc] = NULL;
+	mqp->mq_nproc++;
+	if (mqp->mq_nproc == mqp->mq_cap) {
+		mqp->mq_nproc %= mqp->mq_cap;
+		mqp->mq_gnproc++;
+	}
+	mqp->mq_nitems--;
+
+	return (out);
+}
+
+/*
+ * Pop a set of two entries from the queue. We may not have anything to process
+ * at the moment, eg. be waiting for someone to add something. In which case,
+ * we'll be sitting and waiting.
+ */
+static boolean_t
+mergeq_pop(mergeq_t *mqp, void **first, void **second)
+{
+	VERIFY(MUTEX_HELD(&mqp->mq_lock));
+	VERIFY(mqp->mq_nproc < mqp->mq_cap);
+
+	while (mqp->mq_nitems < 2 && mqp->mq_nactthrs > 0 &&
+	    mqp->mq_iserror == B_FALSE)
+		(void) cond_wait(&mqp->mq_cond, &mqp->mq_lock);
+
+	if (mqp->mq_iserror == B_TRUE)
+		return (B_FALSE);
+
+	if (mqp->mq_nitems < 2 && mqp->mq_nactthrs == 0) {
+		VERIFY(mqp->mq_iserror == B_TRUE || mqp->mq_nitems == 1);
+		return (B_FALSE);
+	}
+	VERIFY(mqp->mq_nitems >= 2);
+
+	*first = mergeq_pop_one(mqp);
+	*second = mergeq_pop_one(mqp);
+
+	return (B_TRUE);
+}
+
+static void *
+mergeq_thr_merge(void *arg)
+{
+	mergeq_t *mqp = arg;
+
+	VERIFY0(mutex_lock(&mqp->mq_lock));
+
+	/*
+	 * Check to make sure creation worked and if not, fail fast.
+	 */
+	if (mqp->mq_iserror == B_TRUE) {
+		VERIFY0(mutex_unlock(&mqp->mq_lock));
+		return (NULL);
+	}
+
+	for (;;) {
+		void *first, *second, *out;
+		int ret;
+		size_t slot;
+
+		if (mqp->mq_nitems == 1 && mqp->mq_nactthrs == 0) {
+			VERIFY0(mutex_unlock(&mqp->mq_lock));
+			return (NULL);
+		}
+
+		if (mergeq_pop(mqp, &first, &second) == B_FALSE) {
+			VERIFY0(mutex_unlock(&mqp->mq_lock));
+			return (NULL);
+		}
+		slot = mergeq_slot(mqp);
+
+		mqp->mq_nactthrs++;
+
+		VERIFY0(mutex_unlock(&mqp->mq_lock));
+		ret = mqp->mq_func(first, second, &out, mqp->mq_arg);
+		VERIFY0(mutex_lock(&mqp->mq_lock));
+
+		if (ret != 0) {
+			if (mqp->mq_iserror == B_FALSE) {
+				mqp->mq_iserror = B_TRUE;
+				mqp->mq_error = ret;
+				cond_broadcast(&mqp->mq_cond);
+			}
+			mqp->mq_nactthrs--;
+			VERIFY0(mutex_unlock(&mqp->mq_lock));
+			return (NULL);
+		}
+		mergeq_push(mqp, slot, out);
+		mqp->mq_nactthrs--;
+	}
+}
+
+int
+mergeq_merge(mergeq_t *mqp, mergeq_proc_f *func, void *arg, void **outp,
+    int *errp)
+{
+	int ret, i;
+	boolean_t seterr = B_FALSE;
+
+	if (mqp == NULL || func == NULL || outp == NULL) {
+		return (mergeq_error(EINVAL));
+	}
+
+	VERIFY0(mutex_lock(&mqp->mq_lock));
+	if (mqp->mq_working == B_TRUE) {
+		VERIFY0(mutex_unlock(&mqp->mq_lock));
+		return (mergeq_error(EBUSY));
+	}
+
+	if (mqp->mq_nitems == 0) {
+		*outp = NULL;
+		mergeq_reset(mqp);
+		VERIFY0(mutex_unlock(&mqp->mq_lock));
+		return (0);
+	}
+
+	/*
+	 * Now that we've finished adding items to the queue, turn it into a
+	 * circular buffer.
+	 */
+	mqp->mq_func = func;
+	mqp->mq_arg = arg;
+	mqp->mq_nproc = 0;
+	mqp->mq_working = B_TRUE;
+	if (mqp->mq_next == mqp->mq_cap) {
+		mqp->mq_next %= mqp->mq_cap;
+		mqp->mq_gnext++;
+	}
+	mqp->mq_ncommit = mqp->mq_next;
+
+	ret = 0;
+	for (i = 0; i < mqp->mq_ndthreads; i++) {
+		ret = thr_create(NULL, 0, mergeq_thr_merge, mqp, 0,
+		    &mqp->mq_thrs[i]);
+		if (ret != 0) {
+			mqp->mq_iserror = B_TRUE;
+			break;
+		}
+	}
+
+	VERIFY0(mutex_unlock(&mqp->mq_lock));
+	if (ret == 0)
+		(void) mergeq_thr_merge(mqp);
+
+	for (i = 0; i < mqp->mq_ndthreads; i++) {
+		VERIFY0(thr_join(mqp->mq_thrs[i], NULL, NULL));
+	}
+
+	VERIFY0(mutex_lock(&mqp->mq_lock));
+
+	VERIFY(mqp->mq_nactthrs == 0);
+	mqp->mq_working = B_FALSE;
+	if (ret == 0 && mqp->mq_iserror == B_FALSE) {
+		VERIFY(mqp->mq_nitems == 1);
+		*outp = mergeq_pop_one(mqp);
+	} else if (ret == 0 && mqp->mq_iserror == B_TRUE) {
+		ret = MERGEQ_UERROR;
+		if (errp != NULL)
+			*errp = mqp->mq_error;
+	} else {
+		seterr = B_TRUE;
+	}
+
+	mergeq_reset(mqp);
+	VERIFY0(mutex_unlock(&mqp->mq_lock));
+
+	if (seterr == B_TRUE)
+		return (mergeq_error(ret));
+
+	return (ret);
+}
diff --git a/usr/src/lib/mergeq/mergeq.h b/usr/src/lib/mergeq/mergeq.h
new file mode 100644
index 0000000000..4c1a21d696
--- /dev/null
+++ b/usr/src/lib/mergeq/mergeq.h
@@ -0,0 +1,52 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _MERGEQ_H
+#define	_MERGEQ_H
+
+/*
+ * mergeq library routines
+ */
+
+#include <sys/types.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct mergeq mergeq_t;
+typedef int (mergeq_proc_f)(void *, void *, void **, void *);
+
+extern int mergeq_init(mergeq_t **, uint_t);
+extern void mergeq_fini(mergeq_t *);
+
+extern int mergeq_add(mergeq_t *, void *);
+
+#define	MERGEQ_ERROR	-1
+#define	MERGEQ_UERROR	-2
+extern int mergeq_merge(mergeq_t *, mergeq_proc_f *, void *, void **, int *);
+
+/*
+ * Routines consumers need to implement
+ */
+extern void *mergeq_alloc(size_t);
+extern void mergeq_free(void *, size_t);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _MERGEQ_H */
diff --git a/usr/src/lib/mergeq/workq.c b/usr/src/lib/mergeq/workq.c
new file mode 100644
index 0000000000..b9f1f2aa1c
--- /dev/null
+++ b/usr/src/lib/mergeq/workq.c
@@ -0,0 +1,311 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Work queue
+ *
+ * A multi-threaded work queue.
+ *
+ * The general design of this is to add a fixed number of items to the queue and
+ * then drain them with the specified number of threads.
+ */
+
+#include <strings.h>
+#include <sys/debug.h>
+#include <thread.h>
+#include <synch.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+
+#include "workq.h"
+
+struct workq {
+	mutex_t wq_lock;	/* Protects below items */
+	cond_t wq_cond;		/* Condition variable */
+	void **wq_items;	/* Array of items to process */
+	size_t wq_nitems;	/* Number of items in queue */
+	size_t wq_cap;		/* Queue capacity */
+	size_t wq_next;		/* Next item to process */
+	uint_t wq_ndthreads;	/* Desired number of threads */
+	thread_t *wq_thrs;	/* Actual threads */
+	workq_proc_f *wq_func;	/* Processing function */
+	void *wq_arg;		/* Argument for processing */
+	boolean_t wq_working;	/* Are we actively using it? */
+	boolean_t wq_iserror;	/* Have we encountered an error? */
+	int wq_error;		/* Error value, if any */
+};
+
+#define	WORKQ_DEFAULT_CAP	64
+
+static int
+workq_error(int err)
+{
+	VERIFY(err != 0);
+	errno = err;
+	return (WORKQ_ERROR);
+}
+
+void
+workq_fini(workq_t *wqp)
+{
+	if (wqp == NULL)
+		return;
+
+	VERIFY(wqp->wq_working != B_TRUE);
+	VERIFY0(mutex_destroy(&wqp->wq_lock));
+	VERIFY0(cond_destroy(&wqp->wq_cond));
+	if (wqp->wq_cap > 0)
+		workq_free(wqp->wq_items, sizeof (void *) * wqp->wq_cap);
+	if (wqp->wq_ndthreads > 0)
+		workq_free(wqp->wq_thrs, sizeof (thread_t) * wqp->wq_ndthreads);
+	workq_free(wqp, sizeof (workq_t));
+}
+
+int
+workq_init(workq_t **outp, uint_t nthrs)
+{
+	int ret;
+	workq_t *wqp;
+
+	wqp = workq_alloc(sizeof (workq_t));
+	if (wqp == NULL)
+		return (workq_error(ENOMEM));
+
+	bzero(wqp, sizeof (workq_t));
+	wqp->wq_items = workq_alloc(sizeof (void *) * WORKQ_DEFAULT_CAP);
+	if (wqp->wq_items == NULL) {
+		workq_free(wqp, sizeof (workq_t));
+		return (workq_error(ENOMEM));
+	}
+	bzero(wqp->wq_items, sizeof (void *) * WORKQ_DEFAULT_CAP);
+
+	wqp->wq_ndthreads = nthrs - 1;
+	if (wqp->wq_ndthreads > 0) {
+		wqp->wq_thrs = workq_alloc(sizeof (thread_t) *
+		    wqp->wq_ndthreads);
+		if (wqp->wq_thrs == NULL) {
+			workq_free(wqp->wq_items, sizeof (void *) *
+			    WORKQ_DEFAULT_CAP);
+			workq_free(wqp, sizeof (workq_t));
+			return (workq_error(ENOMEM));
+		}
+	}
+
+	if ((ret = mutex_init(&wqp->wq_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL)) != 0) {
+		if (wqp->wq_ndthreads > 0) {
+			workq_free(wqp->wq_thrs,
+			    sizeof (thread_t) * wqp->wq_ndthreads);
+		}
+		workq_free(wqp->wq_items, sizeof (void *) * WORKQ_DEFAULT_CAP);
+		workq_free(wqp, sizeof (workq_t));
+		return (workq_error(ret));
+	}
+
+	if ((ret = cond_init(&wqp->wq_cond, USYNC_THREAD, NULL)) != 0) {
+		VERIFY0(mutex_destroy(&wqp->wq_lock));
+		if (wqp->wq_ndthreads > 0) {
+			workq_free(wqp->wq_thrs,
+			    sizeof (thread_t) * wqp->wq_ndthreads);
+		}
+		workq_free(wqp->wq_items, sizeof (void *) * WORKQ_DEFAULT_CAP);
+		workq_free(wqp, sizeof (workq_t));
+		return (workq_error(ret));
+	}
+
+	wqp->wq_cap = WORKQ_DEFAULT_CAP;
+	*outp = wqp;
+	return (0);
+}
+
+static void
+workq_reset(workq_t *wqp)
+{
+	VERIFY(MUTEX_HELD(&wqp->wq_lock));
+	VERIFY(wqp->wq_working == B_FALSE);
+	if (wqp->wq_cap > 0)
+		bzero(wqp->wq_items, sizeof (void *) * wqp->wq_cap);
+	wqp->wq_nitems = 0;
+	wqp->wq_next = 0;
+	wqp->wq_func = NULL;
+	wqp->wq_arg = NULL;
+	wqp->wq_iserror = B_FALSE;
+	wqp->wq_error = 0;
+}
+
+static int
+workq_grow(workq_t *wqp)
+{
+	size_t ncap;
+	void **items;
+
+	VERIFY(MUTEX_HELD(&wqp->wq_lock));
+	VERIFY(wqp->wq_working == B_FALSE);
+
+	if (SIZE_MAX - wqp->wq_cap < WORKQ_DEFAULT_CAP)
+		return (ENOSPC);
+
+	ncap = wqp->wq_cap + WORKQ_DEFAULT_CAP;
+	items = workq_alloc(ncap * sizeof (void *));
+	if (items == NULL)
+		return (ENOMEM);
+
+	bzero(items, ncap * sizeof (void *));
+	bcopy(wqp->wq_items, items, wqp->wq_cap * sizeof (void *));
+	workq_free(wqp->wq_items, sizeof (void *) * wqp->wq_cap);
+	wqp->wq_items = items;
+	wqp->wq_cap = ncap;
+	return (0);
+}
+
+int
+workq_add(workq_t *wqp, void *item)
+{
+	VERIFY0(mutex_lock(&wqp->wq_lock));
+	if (wqp->wq_working == B_TRUE) {
+		VERIFY0(mutex_unlock(&wqp->wq_lock));
+		return (workq_error(ENXIO));
+	}
+
+	if (wqp->wq_nitems == wqp->wq_cap) {
+		int ret;
+
+		if ((ret = workq_grow(wqp)) != 0) {
+			VERIFY0(mutex_unlock(&wqp->wq_lock));
+			return (workq_error(ret));
+		}
+	}
+
+	wqp->wq_items[wqp->wq_nitems] = item;
+	wqp->wq_nitems++;
+
+	VERIFY0(mutex_unlock(&wqp->wq_lock));
+
+	return (0);
+}
+
+static void *
+workq_pop(workq_t *wqp)
+{
+	void *out;
+
+	VERIFY(MUTEX_HELD(&wqp->wq_lock));
+	VERIFY(wqp->wq_next < wqp->wq_nitems);
+
+	out = wqp->wq_items[wqp->wq_next];
+	wqp->wq_items[wqp->wq_next] = NULL;
+	wqp->wq_next++;
+
+	return (out);
+}
+
+static void *
+workq_thr_work(void *arg)
+{
+	workq_t *wqp = arg;
+
+	VERIFY0(mutex_lock(&wqp->wq_lock));
+	VERIFY(wqp->wq_working == B_TRUE);
+
+	for (;;) {
+		int ret;
+		void *item;
+
+		if (wqp->wq_iserror == B_TRUE ||
+		    wqp->wq_next == wqp->wq_nitems) {
+			VERIFY0(mutex_unlock(&wqp->wq_lock));
+			return (NULL);
+		}
+
+		item = workq_pop(wqp);
+
+		VERIFY0(mutex_unlock(&wqp->wq_lock));
+		ret = wqp->wq_func(item, wqp->wq_arg);
+		VERIFY0(mutex_lock(&wqp->wq_lock));
+
+		if (ret != 0) {
+			if (wqp->wq_iserror == B_FALSE) {
+				wqp->wq_iserror = B_TRUE;
+				wqp->wq_error = ret;
+			}
+			VERIFY0(mutex_unlock(&wqp->wq_lock));
+			return (NULL);
+		}
+	}
+}
+
+int
+workq_work(workq_t *wqp, workq_proc_f *func, void *arg, int *errp)
+{
+	int i, ret;
+	boolean_t seterr = B_FALSE;
+
+	if (wqp == NULL || func == NULL)
+		return (workq_error(EINVAL));
+
+	VERIFY0(mutex_lock(&wqp->wq_lock));
+	if (wqp->wq_working == B_TRUE) {
+		VERIFY0(mutex_unlock(&wqp->wq_lock));
+		return (workq_error(EBUSY));
+	}
+
+	if (wqp->wq_nitems == 0) {
+		workq_reset(wqp);
+		VERIFY0(mutex_unlock(&wqp->wq_lock));
+		return (0);
+	}
+
+	wqp->wq_func = func;
+	wqp->wq_arg = arg;
+	wqp->wq_next = 0;
+	wqp->wq_working = B_TRUE;
+
+	ret = 0;
+	for (i = 0; i < wqp->wq_ndthreads; i++) {
+		ret = thr_create(NULL, 0, workq_thr_work, wqp, 0,
+		    &wqp->wq_thrs[i]);
+		if (ret != 0) {
+			wqp->wq_iserror = B_TRUE;
+		}
+	}
+
+	VERIFY0(mutex_unlock(&wqp->wq_lock));
+	if (ret == 0)
+		(void) workq_thr_work(wqp);
+
+	for (i = 0; i < wqp->wq_ndthreads; i++) {
+		VERIFY0(thr_join(wqp->wq_thrs[i], NULL, NULL));
+	}
+
+	VERIFY0(mutex_lock(&wqp->wq_lock));
+	wqp->wq_working = B_FALSE;
+	if (ret == 0 && wqp->wq_iserror == B_TRUE) {
+		ret = WORKQ_UERROR;
+		if (errp != NULL)
+			*errp = wqp->wq_error;
+	} else if (ret != 0) {
+		VERIFY(wqp->wq_iserror == B_FALSE);
+		seterr = B_TRUE;
+	}
+
+	workq_reset(wqp);
+	VERIFY0(mutex_unlock(&wqp->wq_lock));
+
+	if (seterr == B_TRUE)
+		return (workq_error(ret));
+
+	return (ret);
+}
diff --git a/usr/src/lib/mergeq/workq.h b/usr/src/lib/mergeq/workq.h
new file mode 100644
index 0000000000..20cfec4a95
--- /dev/null
+++ b/usr/src/lib/mergeq/workq.h
@@ -0,0 +1,52 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _WORKQ_H
+#define	_WORKQ_H
+
+/*
+ * workq library routines
+ */
+
+#include <sys/types.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct workq workq_t;
+typedef int (workq_proc_f)(void *, void *);
+
+extern int workq_init(workq_t **, uint_t);
+extern void workq_fini(workq_t *);
+
+extern int workq_add(workq_t *, void *);
+
+#define	WORKQ_ERROR	(-1)
+#define	WORKQ_UERROR	(-2)
+extern int workq_work(workq_t *, workq_proc_f *, void *, int *);
+
+/*
+ * Routines consumers need to implement
+ */
+extern void *workq_alloc(size_t);
+extern void workq_free(void *, size_t);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WORKQ_H */
diff --git a/usr/src/lib/nsswitch/dns/Makefile.com b/usr/src/lib/nsswitch/dns/Makefile.com
index 60716d843d..0366633c0c 100644
--- a/usr/src/lib/nsswitch/dns/Makefile.com
+++ b/usr/src/lib/nsswitch/dns/Makefile.com
@@ -44,5 +44,5 @@ CPPFLAGS +=	-DNSS_DNS_LIBRESOLV=\"libresolv.so.2\"
 
 LINTFLAGS +=	-erroff=E_GLOBAL_COULD_BE_STATIC2
 
-LDLIBS +=	-lnsl -lsocket
+LDLIBS +=	-lnsl -lresolv_joy -lsocket
 DYNLIB1 =	nss_dns.so$(VERS)
diff --git a/usr/src/lib/nsswitch/dns/common/dns_common.h b/usr/src/lib/nsswitch/dns/common/dns_common.h
index 717f56d70f..83d486cf57 100644
--- a/usr/src/lib/nsswitch/dns/common/dns_common.h
+++ b/usr/src/lib/nsswitch/dns/common/dns_common.h
@@ -31,8 +31,6 @@
 #ifndef _DNS_COMMON_H
 #define	_DNS_COMMON_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdio.h>
 #include <ctype.h>
 #include <sys/types.h>
@@ -43,7 +41,7 @@
 #include <thread.h>
 #include <arpa/inet.h>
 #include <arpa/nameser.h>
-#include <resolv.h>
+#include <resolv_joy.h>
 #include <syslog.h>
 #include <nsswitch.h>
 #include <nss_common.h>
diff --git a/usr/src/lib/nsswitch/dns/common/dns_mt.c b/usr/src/lib/nsswitch/dns/common/dns_mt.c
index 128b1bde75..4af3f671c0 100644
--- a/usr/src/lib/nsswitch/dns/common/dns_mt.c
+++ b/usr/src/lib/nsswitch/dns/common/dns_mt.c
@@ -23,8 +23,9 @@
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
-
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ */
 
 /*
  * dns_mt.c
@@ -49,52 +50,41 @@
 static void	_nss_dns_init(void);
 
 extern struct hostent *res_gethostbyname(const char *);
-#pragma weak	res_gethostbyname
 
-#define		RES_SET_NO_HOSTS_FALLBACK	"__res_set_no_hosts_fallback"
-extern void	__res_set_no_hosts_fallback(void);
-#pragma weak	__res_set_no_hosts_fallback
+#define	RES_SET_NO_HOSTS_FALLBACK	"__joy_res_set_no_hosts_fallback"
+extern void	__joy_res_set_no_hosts_fallback(void);
 
-#define		RES_UNSET_NO_HOSTS_FALLBACK	"__res_unset_no_hosts_fallback"
-extern void	__res_unset_no_hosts_fallback(void);
-#pragma weak	__res_unset_no_hosts_fallback
+#define	RES_UNSET_NO_HOSTS_FALLBACK	"__joy_res_unset_no_hosts_fallback"
+extern void	__joy_res_unset_no_hosts_fallback(void);
 
 #define		RES_GET_RES	"__res_get_res"
 extern struct __res_state	*__res_get_res(void);
-#pragma weak	__res_get_res
 
 #define		RES_ENABLE_MT			"__res_enable_mt"
 extern int	__res_enable_mt(void);
-#pragma weak	__res_enable_mt
 
 #define		RES_DISABLE_MT			"__res_disable_mt"
 extern int	__res_disable_mt(void);
-#pragma weak	__res_disable_mt
 
 #define		RES_GET_H_ERRNO			"__res_get_h_errno"
 extern int	*__res_get_h_errno();
-#pragma weak	__res_get_h_errno
 
-#define		__H_ERRNO			"__h_errno"
-extern int	*__h_errno(void);
-#pragma weak	__h_errno
+#define		__H_ERRNO			"__joy_h_errno"
+extern int	*__joy_h_errno(void);
 
-#define		RES_OVERRIDE_RETRY		"__res_override_retry"
-extern int	__res_override_retry(int);
-#pragma weak	__res_override_retry
+#define		RES_OVERRIDE_RETRY		"__joy_res_override_retry"
+extern int	__joy_res_override_retry(int);
 
 static void	__fallback_set_no_hosts(void);
-static int	*__fallback_h_errno(void);
-static int	__fallback_override_retry(int);
 static int	__is_mt_safe(void);
 
 void	(*set_no_hosts_fallback)(void) = __fallback_set_no_hosts;
 void	(*unset_no_hosts_fallback)(void) = __fallback_set_no_hosts;
 struct __res_state	*(*set_res_retry)() = 0;
-int	(*enable_mt)() = 0;
-int	(*disable_mt)() = 0;
-int	*(*get_h_errno)(void) = 0;
-int	(*override_retry)(int) = 0;
+int	(*enable_mt)() = __is_mt_safe;
+int	(*disable_mt)() = __is_mt_safe;
+int	*(*get_h_errno)(void) = __joy_h_errno;
+int	(*override_retry)(int) = __joy_res_override_retry;
 
 /* Usually set from the Makefile */
 #ifndef	NSS_DNS_LIBRESOLV
@@ -106,91 +96,12 @@ extern	int	h_errno;
 
 mutex_t	one_lane = DEFAULTMUTEX;
 
+/* Because we link against libresolv_joy.so.2, this is relatively easy. */
 void
 _nss_dns_init(void)
 {
-	void		*reslib, (*f_void_ptr)();
-
-	/* If no libresolv library, then load one */
-	if (res_gethostbyname == 0) {
-		if ((reslib =
-		    dlopen(NSS_DNS_LIBRESOLV, RTLD_LAZY|RTLD_GLOBAL)) != 0) {
-			/* Turn off /etc/hosts fall back in libresolv */
-			if ((f_void_ptr = (void (*)(void))dlsym(reslib,
-			    RES_SET_NO_HOSTS_FALLBACK)) != 0) {
-				set_no_hosts_fallback = f_void_ptr;
-			}
-			if ((f_void_ptr = (void (*)(void))dlsym(reslib,
-			    RES_SET_NO_HOSTS_FALLBACK)) != 0) {
-				unset_no_hosts_fallback = f_void_ptr;
-			}
-			/* Set number of resolver retries */
-			if ((override_retry = (int (*)(int))dlsym(reslib,
-			    RES_OVERRIDE_RETRY)) == 0) {
-				set_res_retry =
-				    (struct __res_state *(*)(void))dlsym(reslib,
-				    RES_GET_RES);
-				override_retry = __fallback_override_retry;
-			}
-			/*
-			 * Select h_errno retrieval function. A BIND 8.2.2
-			 * libresolv.so.2 will have __h_errno, a BIND 8.1.2
-			 * one will have __res_get_h_errno, and other
-			 * versions may have nothing at all.
-			 *
-			 * Also try to bind to the relevant MT enable/disable
-			 * functions which are also dependent on the version
-			 * of the BIND libresolv.so.2 being used.
-			 */
-			if ((get_h_errno = (int *(*)(void))dlsym(reslib,
-			    __H_ERRNO)) != 0) {
-				/* BIND 8.2.2 libresolv.so.2 is MT safe. */
-				enable_mt = __is_mt_safe;
-				disable_mt = __is_mt_safe;
-			} else {
-				if ((get_h_errno =
-				    (int *(*)(void))dlsym(reslib,
-				    RES_GET_H_ERRNO)) == 0) {
-					get_h_errno = __fallback_h_errno;
-				}
-				/*
-				 * Pre-BIND 8.2.2 was not MT safe.  Try to
-				 * bind the MT enable/disable functions.
-				 */
-				if ((enable_mt = (int (*)(void))dlsym(reslib,
-				    RES_ENABLE_MT)) != 0 &&
-				    (disable_mt = (int (*)(void))dlsym(reslib,
-				    RES_DISABLE_MT)) == 0) {
-					enable_mt = 0;
-				}
-			}
-		}
-	} else {
-		/* Libresolv already loaded */
-		if ((f_void_ptr = __res_set_no_hosts_fallback) != 0) {
-			set_no_hosts_fallback = f_void_ptr;
-		}
-		if ((f_void_ptr = __res_unset_no_hosts_fallback) != 0) {
-			unset_no_hosts_fallback = f_void_ptr;
-		}
-		if ((override_retry = __res_override_retry) == 0) {
-			set_res_retry = __res_get_res;
-			override_retry = __fallback_override_retry;
-		}
-		if ((get_h_errno = __h_errno) == 0 &&
-		    (get_h_errno = __res_get_h_errno) == 0) {
-			get_h_errno = __fallback_h_errno;
-		}
-		if (get_h_errno == __h_errno) {
-			enable_mt = __is_mt_safe;
-			disable_mt = __is_mt_safe;
-		} else {
-			if ((enable_mt = __res_enable_mt) != 0 &&
-			    (disable_mt = __res_disable_mt) == 0) {
-				enable_mt = 0;
-			}
-		}
-	}
+	enable_mt = __is_mt_safe;
+	disable_mt = __is_mt_safe;
 }
 
 
@@ -228,36 +139,6 @@ __is_mt_safe(void) {
 }
 
 
-/*
- * Return pointer to the global h_errno variable
- */
-static int *
-__fallback_h_errno(void) {
-	return (&h_errno);
-}
-
-
-/*
- * This function is called when the resolver library doesn't provide its
- * own function to establish an override retry. If we can get a pointer
- * to the per-thread _res (i.e., set_res_retry != 0), we set the retries
- * directly, and return the previous number of retries. Otherwise, there's
- * nothing to do.
- */
-static int
-__fallback_override_retry(int retry) {
-	struct __res_state	*res;
-	int			old_retry = 0;
-
-	if (set_res_retry != 0) {
-		res = set_res_retry();
-		old_retry = res->retry;
-		res->retry = retry;
-	}
-	return (old_retry);
-}
-
-
 static void
 __fallback_set_no_hosts(void) {
 }
diff --git a/usr/src/lib/nsswitch/dns/common/gethostent.c b/usr/src/lib/nsswitch/dns/common/gethostent.c
index 648ea8ba01..d321dd24c6 100644
--- a/usr/src/lib/nsswitch/dns/common/gethostent.c
+++ b/usr/src/lib/nsswitch/dns/common/gethostent.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * gethostent.c
  *
@@ -53,12 +51,6 @@ static struct hostent *_gethostbyaddr(int *h_errnop, const char *addr,
     int len, int type);
 struct hostent *_nss_dns_gethostbyname2(int *h_errnop, const char *name);
 
-#pragma weak	res_gethostbyname
-#pragma weak	res_gethostbyname2
-#pragma weak	res_gethostbyaddr
-#pragma weak	res_sethostent
-#pragma weak	res_endhostent
-
 nss_backend_t *_nss_dns_constr(dns_backend_op_t ops[], int n_ops);
 nss_status_t __nss_dns_getbyaddr(dns_backend_ptr_t, void *);
 
diff --git a/usr/src/lib/nsswitch/dns/common/gethostent6.c b/usr/src/lib/nsswitch/dns/common/gethostent6.c
index ee85832073..f3efc4eae6 100644
--- a/usr/src/lib/nsswitch/dns/common/gethostent6.c
+++ b/usr/src/lib/nsswitch/dns/common/gethostent6.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * This is the DNS backend for IPv6 addresses.
  * getbyname() is a local routine, but getbyaddr() actually shares the
@@ -50,8 +48,6 @@
  */
 
 
-#pragma weak	res_endhostent
-
 extern struct hostent *_gethostbyname(int *, const char *);
 extern struct hostent *_nss_dns_gethostbyname2(int *, const char *);
 
diff --git a/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelGlobal.h b/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelGlobal.h
index 3211018730..8cad200b83 100644
--- a/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelGlobal.h
+++ b/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelGlobal.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018, Joyent, Inc.
  */
 
 #ifndef _KERNELGLOBAL_H
@@ -33,6 +34,7 @@ extern "C" {
 #include <sys/crypto/common.h>
 #include <security/cryptoki.h>
 #include <security/pkcs11t.h>
+#include <cryptoutil.h>
 #include "kernelObject.h"
 
 typedef struct kmh_elem {
@@ -70,7 +72,6 @@ extern int kernel_fd;
 	(m) == CKM_DES3_ECB || (m) == CKM_DES3_CBC || (m) == CKM_AES_ECB || \
 	(m) == CKM_AES_CBC || (m) == CKM_RC4 || (m) == CKM_BLOWFISH_CBC)
 
-CK_RV crypto2pkcs11_error_number(uint_t);
 CK_RV kernel_mech(CK_MECHANISM_TYPE, crypto_mech_type_t *);
 unsigned char *get_symmetric_key_value(kernel_object_t *);
 CK_RV get_rsa_public_key(kernel_object_t *, crypto_key_t *);
diff --git a/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelUtil.c b/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelUtil.c
index b9921e6d18..670a6c7666 100644
--- a/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelUtil.c
+++ b/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelUtil.c
@@ -44,115 +44,6 @@
 	cur_attr++;				\
 }
 
-/*
- * In order to fit everything on one line, the 'CRYPTO_' prefix
- * has been dropped from the KCF #defines, e.g.
- * CRYPTO_SUCCESS becomes SUCCESS.
- */
-
-static CK_RV error_number_table[CRYPTO_LAST_ERROR+1] = {
-CKR_OK,					/* SUCCESS */
-CKR_CANCEL,				/* CANCEL */
-CKR_HOST_MEMORY,			/* HOST_MEMORY */
-CKR_GENERAL_ERROR,			/* GENERAL_ERROR */
-CKR_FUNCTION_FAILED,			/* FAILED */
-CKR_ARGUMENTS_BAD,			/* ARGUMENTS_BAD */
-CKR_ATTRIBUTE_READ_ONLY,		/* ATTRIBUTE_READ_ONLY */
-CKR_ATTRIBUTE_SENSITIVE,		/* ATTRIBUTE_SENSITIVE */
-CKR_ATTRIBUTE_TYPE_INVALID,		/* ATTRIBUTE_TYPE_INVALID */
-CKR_ATTRIBUTE_VALUE_INVALID,		/* ATTRIBUTE_VALUE_INVALID */
-CKR_FUNCTION_FAILED,			/* CANCELED */
-CKR_DATA_INVALID,			/* DATA_INVALID */
-CKR_DATA_LEN_RANGE,			/* DATA_LEN_RANGE */
-CKR_DEVICE_ERROR,			/* DEVICE_ERROR */
-CKR_DEVICE_MEMORY,			/* DEVICE_MEMORY */
-CKR_DEVICE_REMOVED,			/* DEVICE_REMOVED */
-CKR_ENCRYPTED_DATA_INVALID,		/* ENCRYPTED_DATA_INVALID */
-CKR_ENCRYPTED_DATA_LEN_RANGE,		/* ENCRYPTED_DATA_LEN_RANGE */
-CKR_KEY_HANDLE_INVALID,			/* KEY_HANDLE_INVALID */
-CKR_KEY_SIZE_RANGE,			/* KEY_SIZE_RANGE */
-CKR_KEY_TYPE_INCONSISTENT,		/* KEY_TYPE_INCONSISTENT */
-CKR_KEY_NOT_NEEDED,			/* KEY_NOT_NEEDED */
-CKR_KEY_CHANGED,			/* KEY_CHANGED */
-CKR_KEY_NEEDED,				/* KEY_NEEDED */
-CKR_KEY_INDIGESTIBLE,			/* KEY_INDIGESTIBLE */
-CKR_KEY_FUNCTION_NOT_PERMITTED,		/* KEY_FUNCTION_NOT_PERMITTED */
-CKR_KEY_NOT_WRAPPABLE,			/* KEY_NOT_WRAPPABLE */
-CKR_KEY_UNEXTRACTABLE,			/* KEY_UNEXTRACTABLE */
-CKR_MECHANISM_INVALID,			/* MECHANISM_INVALID */
-CKR_MECHANISM_PARAM_INVALID,		/* MECHANISM_PARAM_INVALID */
-CKR_OBJECT_HANDLE_INVALID,		/* OBJECT_HANDLE_INVALID */
-CKR_OPERATION_ACTIVE,			/* OPERATION_ACTIVE */
-CKR_OPERATION_NOT_INITIALIZED,		/* OPERATION_NOT_INITIALIZED */
-CKR_PIN_INCORRECT,			/* PIN_INCORRECT */
-CKR_PIN_INVALID,			/* PIN_INVALID */
-CKR_PIN_LEN_RANGE,			/* PIN_LEN_RANGE */
-CKR_PIN_EXPIRED,			/* PIN_EXPIRED */
-CKR_PIN_LOCKED,				/* PIN_LOCKED */
-CKR_SESSION_CLOSED,			/* SESSION_CLOSED */
-CKR_SESSION_COUNT,			/* SESSION_COUNT */
-CKR_SESSION_HANDLE_INVALID,		/* SESSION_HANDLE_INVALID */
-CKR_SESSION_READ_ONLY,			/* SESSION_READ_ONLY */
-CKR_SESSION_EXISTS,			/* SESSION_EXISTS */
-CKR_SESSION_READ_ONLY_EXISTS,		/* SESSION_READ_ONLY_EXISTS */
-CKR_SESSION_READ_WRITE_SO_EXISTS,	/* SESSION_READ_WRITE_SO_EXISTS */
-CKR_SIGNATURE_INVALID,			/* SIGNATURE_INVALID */
-CKR_SIGNATURE_LEN_RANGE,		/* SIGNATURE_LEN_RANGE */
-CKR_TEMPLATE_INCOMPLETE,		/* TEMPLATE_INCOMPLETE */
-CKR_TEMPLATE_INCONSISTENT,		/* TEMPLATE_INCONSISTENT */
-CKR_UNWRAPPING_KEY_HANDLE_INVALID,	/* UNWRAPPING_KEY_HANDLE_INVALID */
-CKR_UNWRAPPING_KEY_SIZE_RANGE,		/* UNWRAPPING_KEY_SIZE_RANGE */
-CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT,	/* UNWRAPPING_KEY_TYPE_INCONSISTENT */
-CKR_USER_ALREADY_LOGGED_IN,		/* USER_ALREADY_LOGGED_IN */
-CKR_USER_NOT_LOGGED_IN,			/* USER_NOT_LOGGED_IN */
-CKR_USER_PIN_NOT_INITIALIZED,		/* USER_PIN_NOT_INITIALIZED */
-CKR_USER_TYPE_INVALID,			/* USER_TYPE_INVALID */
-CKR_USER_ANOTHER_ALREADY_LOGGED_IN,	/* USER_ANOTHER_ALREADY_LOGGED_IN */
-CKR_USER_TOO_MANY_TYPES,		/* USER_TOO_MANY_TYPES */
-CKR_WRAPPED_KEY_INVALID,		/* WRAPPED_KEY_INVALID */
-CKR_WRAPPED_KEY_LEN_RANGE,		/* WRAPPED_KEY_LEN_RANGE */
-CKR_WRAPPING_KEY_HANDLE_INVALID,	/* WRAPPING_KEY_HANDLE_INVALID */
-CKR_WRAPPING_KEY_SIZE_RANGE,		/* WRAPPING_KEY_SIZE_RANGE */
-CKR_WRAPPING_KEY_TYPE_INCONSISTENT,	/* WRAPPING_KEY_TYPE_INCONSISTENT */
-CKR_RANDOM_SEED_NOT_SUPPORTED,		/* RANDOM_SEED_NOT_SUPPORTED */
-CKR_RANDOM_NO_RNG,			/* RANDOM_NO_RNG */
-CKR_DOMAIN_PARAMS_INVALID,		/* DOMAIN_PARAMS_INVALID */
-CKR_BUFFER_TOO_SMALL,			/* BUFFER_TOO_SMALL */
-CKR_INFORMATION_SENSITIVE,		/* INFORMATION_SENSITIVE */
-CKR_FUNCTION_NOT_SUPPORTED,		/* NOT_SUPPORTED */
-CKR_GENERAL_ERROR,			/* QUEUED */
-CKR_GENERAL_ERROR,			/* BUFFER_TOO_BIG */
-CKR_OPERATION_NOT_INITIALIZED,		/* INVALID_CONTEXT */
-CKR_GENERAL_ERROR,			/* INVALID_MAC */
-CKR_GENERAL_ERROR,			/* MECH_NOT_SUPPORTED */
-CKR_GENERAL_ERROR,			/* INCONSISTENT_ATTRIBUTE */
-CKR_GENERAL_ERROR,			/* NO_PERMISSION */
-CKR_SLOT_ID_INVALID,			/* INVALID_PROVIDER_ID */
-CKR_GENERAL_ERROR,			/* VERSION_MISMATCH */
-CKR_GENERAL_ERROR,			/* BUSY */
-CKR_GENERAL_ERROR,			/* UNKNOWN_PROVIDER */
-CKR_GENERAL_ERROR,			/* MODVERIFICATION_FAILED */
-CKR_GENERAL_ERROR,			/* OLD_CTX_TEMPLATE */
-CKR_GENERAL_ERROR,			/* WEAK_KEY */
-CKR_GENERAL_ERROR			/* FIPS140_ERROR */
-};
-
-#if CRYPTO_LAST_ERROR != CRYPTO_FIPS140_ERROR
-#error "Crypto to PKCS11 error mapping table needs to be updated!"
-#endif
-
-/*
- * Map KCF error codes into PKCS11 error codes.
- */
-CK_RV
-crypto2pkcs11_error_number(uint_t n)
-{
-	if (n >= sizeof (error_number_table) / sizeof (error_number_table[0]))
-		return (CKR_GENERAL_ERROR);
-
-	return (error_number_table[n]);
-}
-
 #define	MECH_HASH(type)	(((uintptr_t)type) % KMECH_HASHTABLE_SIZE)
 /*
  * Serialize writes to the hash table. We don't need a per bucket lock as
diff --git a/usr/src/lib/pysolaris/Makefile.com b/usr/src/lib/pysolaris/Makefile.com
index 82bf87d09b..4a70113ab4 100644
--- a/usr/src/lib/pysolaris/Makefile.com
+++ b/usr/src/lib/pysolaris/Makefile.com
@@ -43,6 +43,7 @@ C99LMODE=       -Xc99=%all
 LIBS =		$(DYNLIB)
 LDLIBS +=	-lc -lsec -lidmap -lpython$(PYTHON_VERSION)
 CFLAGS +=	$(CCVERBOSE)
+CPPFLAGS +=	-I$(ADJUNCT_PROTO)/usr/include/python2.6
 CERRWARN +=	-_gcc=-Wno-unused-variable
 CPPFLAGS +=	-I$(ADJUNCT_PROTO)/usr/include/python$(PYTHON_VERSION)
 
diff --git a/usr/src/lib/scsi/libscsi/common/libscsi.h b/usr/src/lib/scsi/libscsi/common/libscsi.h
index 4d57d1299c..5904217fc1 100644
--- a/usr/src/lib/scsi/libscsi/common/libscsi.h
+++ b/usr/src/lib/scsi/libscsi/common/libscsi.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 #ifndef	_LIBSCSI_H
@@ -97,6 +98,7 @@ typedef struct libscsi_engine_ops {
 	void (*lseo_close)(libscsi_hdl_t *, void *);
 	int (*lseo_exec)(libscsi_hdl_t *, void *, libscsi_action_t *);
 	void (*lseo_target_name)(libscsi_hdl_t *, void *, char *, size_t);
+	int (*lseo_max_transfer)(libscsi_hdl_t *, void *, size_t *);
 } libscsi_engine_ops_t;
 
 typedef struct libscsi_engine {
@@ -116,6 +118,7 @@ extern libscsi_hdl_t *libscsi_get_handle(libscsi_target_t *);
 extern const char *libscsi_vendor(libscsi_target_t *);
 extern const char *libscsi_product(libscsi_target_t *);
 extern const char *libscsi_revision(libscsi_target_t *);
+extern int libscsi_max_transfer(libscsi_target_t *, size_t *);
 
 extern libscsi_errno_t libscsi_errno(libscsi_hdl_t *);
 extern const char *libscsi_errmsg(libscsi_hdl_t *);
@@ -125,8 +128,11 @@ extern libscsi_errno_t libscsi_errcode(const char *);
 
 extern libscsi_action_t *libscsi_action_alloc(libscsi_hdl_t *, spc3_cmd_t,
     uint_t, void *, size_t);
+extern libscsi_action_t *libscsi_action_alloc_vendor(libscsi_hdl_t *,
+    spc3_cmd_t, size_t, uint_t, void *, size_t);
 extern sam4_status_t libscsi_action_get_status(const libscsi_action_t *);
 extern void libscsi_action_set_timeout(libscsi_action_t *, uint32_t);
+extern size_t libscsi_action_get_cdblen(const libscsi_action_t *);
 extern uint32_t libscsi_action_get_timeout(const libscsi_action_t *);
 extern uint_t libscsi_action_get_flags(const libscsi_action_t *);
 extern uint8_t *libscsi_action_get_cdb(const libscsi_action_t *);
diff --git a/usr/src/lib/scsi/libscsi/common/scsi_engine.c b/usr/src/lib/scsi/libscsi/common/scsi_engine.c
index 3c6d5ecee9..dc7a7af5c1 100644
--- a/usr/src/lib/scsi/libscsi/common/scsi_engine.c
+++ b/usr/src/lib/scsi/libscsi/common/scsi_engine.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -265,6 +266,18 @@ libscsi_action_get_flags(const libscsi_action_t *ap)
 }
 
 /*
+ * Return the length of the CDB buffer associated with this action.  Never
+ * fails.
+ */
+size_t
+libscsi_action_get_cdblen(const libscsi_action_t *ap)
+{
+	const libscsi_action_impl_t *aip = (const libscsi_action_impl_t *)ap;
+
+	return (aip->lsai_cdb_len);
+}
+
+/*
  * Returns the address of the action's CDB.  The CDB buffer is guaranteed to
  * be large enough to hold the complete CDB for the command specified when the
  * action was allocated.  Therefore, changing the command/opcode portion of
@@ -469,11 +482,11 @@ libscsi_action_set_senselen(libscsi_action_t *ap, size_t len)
  * If cmd is SPC3_CMD_REQUEST_SENSE, this flag must be clear.
  */
 libscsi_action_t *
-libscsi_action_alloc(libscsi_hdl_t *hp, spc3_cmd_t cmd, uint_t flags,
-    void *buf, size_t buflen)
+libscsi_action_alloc_vendor(libscsi_hdl_t *hp, spc3_cmd_t cmd, size_t cdbsz,
+    uint_t flags, void *buf, size_t buflen)
 {
 	libscsi_action_impl_t *aip;
-	size_t cdbsz, sz;
+	size_t sz;
 	ptrdiff_t off;
 
 	/*
@@ -492,14 +505,14 @@ libscsi_action_alloc(libscsi_hdl_t *hp, spc3_cmd_t cmd, uint_t flags,
 		    "in order to use a buffer");
 		return (NULL);
 	}
-	if (cmd == SPC3_CMD_REQUEST_SENSE && (flags & LIBSCSI_AF_RQSENSE)) {
-		(void) libscsi_error(hp, ESCSI_BADFLAGS, "request sense "
-		    "flag not allowed for request sense command");
+
+	if (cdbsz == 0) {
+		(void) libscsi_error(hp, ESCSI_BADLENGTH, "the supplied CDB "
+		    "buffer size has an invalid length, it must be non-zero.");
 		return (NULL);
 	}
 
-	if ((sz = cdbsz = libscsi_cmd_cdblen(hp, cmd)) == 0)
-		return (NULL);
+	sz = cdbsz;
 
 	/*
 	 * If the caller has asked for a buffer but has not provided one, we
@@ -549,6 +562,25 @@ libscsi_action_alloc(libscsi_hdl_t *hp, spc3_cmd_t cmd, uint_t flags,
 	return ((libscsi_action_t *)aip);
 }
 
+libscsi_action_t *
+libscsi_action_alloc(libscsi_hdl_t *hp, spc3_cmd_t cmd, uint_t flags,
+    void *buf, size_t buflen)
+{
+	size_t cdbsz;
+
+	if (cmd == SPC3_CMD_REQUEST_SENSE && (flags & LIBSCSI_AF_RQSENSE)) {
+		(void) libscsi_error(hp, ESCSI_BADFLAGS, "request sense "
+		    "flag not allowed for request sense command");
+		return (NULL);
+	}
+
+	if ((cdbsz = libscsi_cmd_cdblen(hp, cmd)) == 0)
+		return (NULL);
+
+	return (libscsi_action_alloc_vendor(hp, cmd, cdbsz, flags, buf,
+	    buflen));
+}
+
 void
 libscsi_action_free(libscsi_action_t *ap)
 {
@@ -616,3 +648,16 @@ libscsi_exec(libscsi_action_t *ap, libscsi_target_t *tp)
 
 	return (ret);
 }
+
+int
+libscsi_max_transfer(libscsi_target_t *tp, size_t *sizep)
+{
+	libscsi_hdl_t *hp = tp->lst_hdl;
+	if (tp->lst_engine->lse_ops->lseo_max_transfer == NULL) {
+		return (libscsi_error(hp, ESCSI_NOTSUP, "max transfer "
+		    "request not supported by engine"));
+	}
+
+	return (tp->lst_engine->lse_ops->lseo_max_transfer(hp, tp->lst_priv,
+	    sizep));
+}
diff --git a/usr/src/lib/scsi/libscsi/libscsi_api.map b/usr/src/lib/scsi/libscsi/libscsi_api.map
index 72efb3a2de..b44e80c611 100644
--- a/usr/src/lib/scsi/libscsi/libscsi_api.map
+++ b/usr/src/lib/scsi/libscsi/libscsi_api.map
@@ -21,6 +21,7 @@
 
 #
 # Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2017, Joyent, Inc.
 #
 
 $mapfile_version 2
@@ -40,6 +41,7 @@ SYMBOL_SCOPE {
 	libscsi_action_get_timeout	{ TYPE	= FUNCTION; FLAGS = extern };
 	libscsi_action_get_flags	{ TYPE	= FUNCTION; FLAGS = extern };
 	libscsi_action_get_cdb		{ TYPE	= FUNCTION; FLAGS = extern };
+	libscsi_action_get_cdblen	{ TYPE	= FUNCTION; FLAGS = extern };
 	libscsi_action_get_buffer	{ TYPE	= FUNCTION; FLAGS = extern };
 	libscsi_action_get_sense	{ TYPE	= FUNCTION; FLAGS = extern };
 	libscsi_action_set_status	{ TYPE	= FUNCTION; FLAGS = extern };
diff --git a/usr/src/lib/scsi/libscsi/mapfile-vers b/usr/src/lib/scsi/libscsi/mapfile-vers
index 7e0d8e251c..0b92a7412c 100644
--- a/usr/src/lib/scsi/libscsi/mapfile-vers
+++ b/usr/src/lib/scsi/libscsi/mapfile-vers
@@ -21,6 +21,7 @@
 
 #
 # Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2017, Joyent, Inc.
 #
 
 #
@@ -46,11 +47,13 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 		libscsi_open;
 		libscsi_close;
 		libscsi_action_alloc;
+		libscsi_action_alloc_vendor;
 		libscsi_action_get_status;
 		libscsi_action_set_status;
 		libscsi_action_get_timeout;
 		libscsi_action_set_timeout;
 		libscsi_action_get_cdb;
+		libscsi_action_get_cdblen;
 		libscsi_action_get_flags;
 		libscsi_action_get_buffer;
 		libscsi_action_get_sense;
@@ -71,6 +74,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 		libscsi_vendor;
 		libscsi_product;
 		libscsi_revision;
+		libscsi_max_transfer;
 		libscsi_get_handle;
 
 		libscsi_alloc;
diff --git a/usr/src/lib/scsi/plugins/scsi/engines/uscsi/uscsi.c b/usr/src/lib/scsi/plugins/scsi/engines/uscsi/uscsi.c
index 06cdb0b339..bd24c0fbfb 100644
--- a/usr/src/lib/scsi/plugins/scsi/engines/uscsi/uscsi.c
+++ b/usr/src/lib/scsi/plugins/scsi/engines/uscsi/uscsi.c
@@ -22,10 +22,10 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <sys/scsi/impl/uscsi.h>
 #include <sys/scsi/generic/commands.h>
@@ -111,10 +111,10 @@ xlate_flags(libscsi_hdl_t *hp, uint_t flags, int *uf)
 			f |= USCSI_DIAGNOSE;
 			break;
 		case LIBSCSI_AF_ISOLATE:
-			f = USCSI_ISOLATE;
+			f |= USCSI_ISOLATE;
 			break;
 		case LIBSCSI_AF_RQSENSE:
-			f = USCSI_RQENABLE;
+			f |= USCSI_RQENABLE;
 			break;
 		default:
 			return (libscsi_error(hp, ESCSI_BOGUSFLAGS,
@@ -150,7 +150,7 @@ uscsi_exec(libscsi_hdl_t *hp, void *private, libscsi_action_t *ap)
 	cmd.uscsi_timeout = (short)libscsi_action_get_timeout(ap);
 
 	cmd.uscsi_cdb = (caddr_t)cp;
-	cmd.uscsi_cdblen = libscsi_cmd_cdblen(hp, *cp);
+	cmd.uscsi_cdblen = libscsi_action_get_cdblen(ap);
 	if (cmd.uscsi_cdblen == 0)
 		return (-1);
 
@@ -214,11 +214,43 @@ uscsi_target_name(libscsi_hdl_t *hp, void *private, char *buf, size_t len)
 	(void) snprintf(buf, len, "%s", dp->dev);
 }
 
+static int
+uscsi_max_transfer(libscsi_hdl_t *hp, void *private, size_t *sizep)
+{
+	uscsi_xfer_t xfer;
+	struct uscsi_dev *dp = (struct uscsi_dev *)private;
+
+	if (ioctl(dp->fd, USCSIMAXXFER, &xfer) < 0) {
+		ASSERT(errno != EFAULT);
+		switch (errno) {
+		case EINVAL:
+			return (libscsi_error(hp, ESCSI_BADCMD, "internal "
+			    "uscsi error"));
+		case EPERM:
+			return (libscsi_error(hp, ESCSI_PERM, "insufficient "
+			    "privileges "));
+		case ENOTTY:
+			return (libscsi_error(hp, ESCSI_NOTSUP, "max transfer "
+			    "request not supported on device"));
+		default:
+			return (libscsi_error(hp, ESCSI_SYS, "uscsi ioctl "
+			    "failed: %s", strerror(errno)));
+		}
+	}
+
+	if (xfer > SIZE_MAX)
+		xfer = SIZE_MAX;
+
+	*sizep = (size_t)xfer;
+	return (0);
+}
+
 static const libscsi_engine_ops_t uscsi_ops = {
 	.lseo_open = uscsi_open,
 	.lseo_close = uscsi_close,
 	.lseo_exec = uscsi_exec,
-	.lseo_target_name = uscsi_target_name
+	.lseo_target_name = uscsi_target_name,
+	.lseo_max_transfer = uscsi_max_transfer
 };
 
 static const libscsi_engine_t uscsi_engine = {
diff --git a/usr/src/lib/varpd/Makefile b/usr/src/lib/varpd/Makefile
new file mode 100644
index 0000000000..a0e4537ab9
--- /dev/null
+++ b/usr/src/lib/varpd/Makefile
@@ -0,0 +1,34 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+SUBDIRS = libvarpd direct files svp
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+check :=	TARGET = check
+install :=	TARGET = install
+install_h :=	TARGET = install_h
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install install_h check lint: $(SUBDIRS)
+direct files svp: libvarpd
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/lib/varpd/Makefile.plugin b/usr/src/lib/varpd/Makefile.plugin
new file mode 100644
index 0000000000..48f188500c
--- /dev/null
+++ b/usr/src/lib/varpd/Makefile.plugin
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+ROOTLIBDIR = $(ROOT)/usr/lib/varpd
+ROOTLIBDIR64 = $(ROOT)/usr/lib/varpd/$(MACH64)
+
+MAPFILES += ../../libvarpd/common/mapfile-plugin
diff --git a/usr/src/lib/varpd/direct/Makefile b/usr/src/lib/varpd/direct/Makefile
new file mode 100644
index 0000000000..275f07bf8b
--- /dev/null
+++ b/usr/src/lib/varpd/direct/Makefile
@@ -0,0 +1,40 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include		../../Makefile.lib
+
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+install_h:
+
+check:
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/varpd/direct/Makefile.com b/usr/src/lib/varpd/direct/Makefile.com
new file mode 100644
index 0000000000..4072c9a0ab
--- /dev/null
+++ b/usr/src/lib/varpd/direct/Makefile.com
@@ -0,0 +1,38 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+LIBRARY =	libvarpd_direct.a
+VERS =		.1
+OBJECTS =	libvarpd_direct.o
+
+include ../../../Makefile.lib
+include ../../Makefile.plugin
+
+LIBS =		$(DYNLIB)
+LDLIBS +=	-lc -lumem -lnvpair -lnsl
+CPPFLAGS +=	-I../common
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+SRCDIR =	../common
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../../Makefile.targ
diff --git a/usr/src/lib/varpd/direct/amd64/Makefile b/usr/src/lib/varpd/direct/amd64/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/direct/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/varpd/direct/common/libvarpd_direct.c b/usr/src/lib/varpd/direct/common/libvarpd_direct.c
new file mode 100644
index 0000000000..018cdf641c
--- /dev/null
+++ b/usr/src/lib/varpd/direct/common/libvarpd_direct.c
@@ -0,0 +1,411 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Point to point plug-in for varpd.
+ *
+ * This plugin implements a simple point to point plugin for a packet. It
+ * represents the traditional tunnel, just in overlay form. As such, the only
+ * properties it needs are those to determine where to send everything. At this
+ * time, we don't allow a mulicast address; however, there's no reason that the
+ * direct plugin shouldn't in theory support multicast, though when implementing
+ * it the best path will become clear.
+ *
+ * In general this module has been designed to make it easy to support a
+ * destination of either IP or IP and port; however, we restrict it to the
+ * latter as we don't currently have an implementation that would allow us to
+ * test that.
+ */
+
+#include <libvarpd_provider.h>
+#include <umem.h>
+#include <errno.h>
+#include <thread.h>
+#include <synch.h>
+#include <strings.h>
+#include <assert.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <libnvpair.h>
+
+typedef struct varpd_direct {
+	overlay_plugin_dest_t	vad_dest;	/* RO */
+	mutex_t			vad_lock;	/* Protects the rest */
+	boolean_t		vad_hip;
+	boolean_t		vad_hport;
+	struct in6_addr 	vad_ip;
+	uint16_t		vad_port;
+} varpd_direct_t;
+
+static const char *varpd_direct_props[] = {
+	"direct/dest_ip",
+	"direct/dest_port"
+};
+
+static boolean_t
+varpd_direct_valid_dest(overlay_plugin_dest_t dest)
+{
+	if (dest & ~(OVERLAY_PLUGIN_D_IP | OVERLAY_PLUGIN_D_PORT))
+		return (B_FALSE);
+
+	if (!(dest & (OVERLAY_PLUGIN_D_IP | OVERLAY_PLUGIN_D_PORT)))
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
+
+/* ARGSUSED */
+static int
+varpd_direct_create(varpd_provider_handle_t *hdl, void **outp,
+    overlay_plugin_dest_t dest)
+{
+	int ret;
+	varpd_direct_t *vdp;
+
+	if (varpd_direct_valid_dest(dest) == B_FALSE)
+		return (ENOTSUP);
+
+	vdp = umem_alloc(sizeof (varpd_direct_t), UMEM_DEFAULT);
+	if (vdp == NULL)
+		return (ENOMEM);
+
+	if ((ret = mutex_init(&vdp->vad_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL)) != 0) {
+		umem_free(vdp, sizeof (varpd_direct_t));
+		return (ret);
+	}
+
+	vdp->vad_dest = dest;
+	vdp->vad_hip = B_FALSE;
+	vdp->vad_hport = B_FALSE;
+	*outp = vdp;
+	return (0);
+}
+
+static int
+varpd_direct_start(void *arg)
+{
+	varpd_direct_t *vdp = arg;
+
+	mutex_enter(&vdp->vad_lock);
+	if (vdp->vad_hip == B_FALSE ||((vdp->vad_dest & OVERLAY_PLUGIN_D_IP) &&
+	    vdp->vad_hport == B_FALSE)) {
+		mutex_exit(&vdp->vad_lock);
+		return (EAGAIN);
+	}
+	mutex_exit(&vdp->vad_lock);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+varpd_direct_stop(void *arg)
+{
+}
+
+static void
+varpd_direct_destroy(void *arg)
+{
+	varpd_direct_t *vdp = arg;
+
+	if (mutex_destroy(&vdp->vad_lock) != 0)
+		abort();
+	umem_free(vdp, sizeof (varpd_direct_t));
+}
+
+static int
+varpd_direct_default(void *arg, overlay_target_point_t *otp)
+{
+	varpd_direct_t *vdp = arg;
+
+	mutex_enter(&vdp->vad_lock);
+	bcopy(&vdp->vad_ip, &otp->otp_ip, sizeof (struct in6_addr));
+	otp->otp_port = vdp->vad_port;
+	mutex_exit(&vdp->vad_lock);
+
+	return (VARPD_LOOKUP_OK);
+}
+
+static int
+varpd_direct_nprops(void *arg, uint_t *nprops)
+{
+	const varpd_direct_t *vdp = arg;
+
+	*nprops = 0;
+	if (vdp->vad_dest & OVERLAY_PLUGIN_D_ETHERNET)
+		*nprops += 1;
+
+	if (vdp->vad_dest & OVERLAY_PLUGIN_D_IP)
+		*nprops += 1;
+
+	if (vdp->vad_dest & OVERLAY_PLUGIN_D_PORT)
+		*nprops += 1;
+
+	assert(*nprops == 1 || *nprops == 2);
+
+	return (0);
+}
+
+static int
+varpd_direct_propinfo(void *arg, uint_t propid, varpd_prop_handle_t *vph)
+{
+	varpd_direct_t *vdp = arg;
+
+	/*
+	 * Because we only support IP + port combos right now, prop 0 should
+	 * always be the IP. We don't support a port without an IP.
+	 */
+	assert(vdp->vad_dest & OVERLAY_PLUGIN_D_IP);
+	if (propid == 0) {
+		libvarpd_prop_set_name(vph, varpd_direct_props[0]);
+		libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_RRW);
+		libvarpd_prop_set_type(vph, OVERLAY_PROP_T_IP);
+		libvarpd_prop_set_nodefault(vph);
+		return (0);
+	}
+
+	if (propid == 1 && vdp->vad_dest & OVERLAY_PLUGIN_D_PORT) {
+		libvarpd_prop_set_name(vph, varpd_direct_props[1]);
+		libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_RRW);
+		libvarpd_prop_set_type(vph, OVERLAY_PROP_T_UINT);
+		libvarpd_prop_set_nodefault(vph);
+		libvarpd_prop_set_range_uint32(vph, 1, UINT16_MAX);
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+static int
+varpd_direct_getprop(void *arg, const char *pname, void *buf, uint32_t *sizep)
+{
+	varpd_direct_t *vdp = arg;
+
+	/* direct/dest_ip */
+	if (strcmp(pname, varpd_direct_props[0]) == 0) {
+		if (*sizep < sizeof (struct in6_addr))
+			return (EOVERFLOW);
+		mutex_enter(&vdp->vad_lock);
+		if (vdp->vad_hip == B_FALSE) {
+			*sizep = 0;
+		} else {
+			bcopy(&vdp->vad_ip, buf, sizeof (struct in6_addr));
+			*sizep = sizeof (struct in6_addr);
+		}
+		mutex_exit(&vdp->vad_lock);
+		return (0);
+	}
+
+	/* direct/dest_port */
+	if (strcmp(pname, varpd_direct_props[1]) == 0) {
+		uint64_t val;
+
+		if (*sizep < sizeof (uint64_t))
+			return (EOVERFLOW);
+		mutex_enter(&vdp->vad_lock);
+		if (vdp->vad_hport == B_FALSE) {
+			*sizep = 0;
+		} else {
+			val = vdp->vad_port;
+			bcopy(&val, buf, sizeof (uint64_t));
+			*sizep = sizeof (uint64_t);
+		}
+		mutex_exit(&vdp->vad_lock);
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+static int
+varpd_direct_setprop(void *arg, const char *pname, const void *buf,
+    const uint32_t size)
+{
+	varpd_direct_t *vdp = arg;
+
+	/* direct/dest_ip */
+	if (strcmp(pname, varpd_direct_props[0]) == 0) {
+		const struct in6_addr *ipv6 = buf;
+
+		if (size < sizeof (struct in6_addr))
+			return (EOVERFLOW);
+
+		if (IN6_IS_ADDR_V4COMPAT(ipv6))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_6TO4(ipv6))
+			return (EINVAL);
+
+		mutex_enter(&vdp->vad_lock);
+		bcopy(buf, &vdp->vad_ip, sizeof (struct in6_addr));
+		vdp->vad_hip = B_TRUE;
+		mutex_exit(&vdp->vad_lock);
+		return (0);
+	}
+
+	/* direct/dest_port */
+	if (strcmp(pname, varpd_direct_props[1]) == 0) {
+		const uint64_t *valp = buf;
+		if (size < sizeof (uint64_t))
+			return (EOVERFLOW);
+
+		if (*valp == 0 || *valp > UINT16_MAX)
+			return (EINVAL);
+
+		mutex_enter(&vdp->vad_lock);
+		vdp->vad_port = (uint16_t)*valp;
+		vdp->vad_hport = B_TRUE;
+		mutex_exit(&vdp->vad_lock);
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+static int
+varpd_direct_save(void *arg, nvlist_t *nvp)
+{
+	int ret;
+	varpd_direct_t *vdp = arg;
+
+	mutex_enter(&vdp->vad_lock);
+	if (vdp->vad_hport == B_TRUE) {
+		if ((ret = nvlist_add_uint16(nvp, varpd_direct_props[1],
+		    vdp->vad_port)) != 0) {
+			mutex_exit(&vdp->vad_lock);
+			return (ret);
+		}
+	}
+
+	if (vdp->vad_hip == B_TRUE) {
+		char buf[INET6_ADDRSTRLEN];
+
+		if (inet_ntop(AF_INET6, &vdp->vad_ip, buf, sizeof (buf)) ==
+		    NULL)
+			abort();
+		if ((ret = nvlist_add_string(nvp, varpd_direct_props[0],
+		    buf)) != 0) {
+			mutex_exit(&vdp->vad_lock);
+			return (ret);
+		}
+	}
+	mutex_exit(&vdp->vad_lock);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+varpd_direct_restore(nvlist_t *nvp, varpd_provider_handle_t *hdl,
+    overlay_plugin_dest_t dest, void **outp)
+{
+	int ret;
+	char *ipstr;
+	varpd_direct_t *vdp;
+
+	if (varpd_direct_valid_dest(dest) == B_FALSE)
+		return (ENOTSUP);
+
+	vdp = umem_alloc(sizeof (varpd_direct_t), UMEM_DEFAULT);
+	if (vdp == NULL)
+		return (ENOMEM);
+
+	if ((ret = mutex_init(&vdp->vad_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL)) != 0) {
+		umem_free(vdp, sizeof (varpd_direct_t));
+		return (ret);
+	}
+
+	if ((ret = nvlist_lookup_uint16(nvp, varpd_direct_props[1],
+	    &vdp->vad_port)) != 0) {
+		if (ret != ENOENT) {
+			if (mutex_destroy(&vdp->vad_lock) != 0)
+				abort();
+			umem_free(vdp, sizeof (varpd_direct_t));
+			return (ret);
+		}
+		vdp->vad_hport = B_FALSE;
+	} else {
+		vdp->vad_hport = B_TRUE;
+	}
+
+	if ((ret = nvlist_lookup_string(nvp, varpd_direct_props[0],
+	    &ipstr)) != 0) {
+		if (ret != ENOENT) {
+			if (mutex_destroy(&vdp->vad_lock) != 0)
+				abort();
+			umem_free(vdp, sizeof (varpd_direct_t));
+			return (ret);
+		}
+		vdp->vad_hip = B_FALSE;
+	} else {
+		ret = inet_pton(AF_INET6, ipstr, &vdp->vad_ip);
+		/*
+		 * inet_pton is only defined to return -1 with errno set to
+		 * EAFNOSUPPORT, which really, shouldn't happen.
+		 */
+		if (ret == -1) {
+			assert(errno == EAFNOSUPPORT);
+			abort();
+		}
+		if (ret == 0) {
+			if (mutex_destroy(&vdp->vad_lock) != 0)
+				abort();
+			umem_free(vdp, sizeof (varpd_direct_t));
+			return (EINVAL);
+		}
+	}
+
+	*outp = vdp;
+	return (0);
+}
+
+static const varpd_plugin_ops_t varpd_direct_ops = {
+	0,
+	varpd_direct_create,
+	varpd_direct_start,
+	varpd_direct_stop,
+	varpd_direct_destroy,
+	varpd_direct_default,
+	NULL,
+	varpd_direct_nprops,
+	varpd_direct_propinfo,
+	varpd_direct_getprop,
+	varpd_direct_setprop,
+	varpd_direct_save,
+	varpd_direct_restore
+};
+
+#pragma init(varpd_direct_init)
+static void
+varpd_direct_init(void)
+{
+	int err;
+	varpd_plugin_register_t *vpr;
+
+	vpr = libvarpd_plugin_alloc(VARPD_CURRENT_VERSION, &err);
+	if (vpr == NULL)
+		return;
+
+	vpr->vpr_mode = OVERLAY_TARGET_POINT;
+	vpr->vpr_name = "direct";
+	vpr->vpr_ops = &varpd_direct_ops;
+	(void) libvarpd_plugin_register(vpr);
+	libvarpd_plugin_free(vpr);
+}
diff --git a/usr/src/lib/varpd/direct/common/llib-lvarpd_direct b/usr/src/lib/varpd/direct/common/llib-lvarpd_direct
new file mode 100644
index 0000000000..03c34f4fcb
--- /dev/null
+++ b/usr/src/lib/varpd/direct/common/llib-lvarpd_direct
@@ -0,0 +1,18 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
diff --git a/usr/src/lib/varpd/direct/common/mapfile-vers b/usr/src/lib/varpd/direct/common/mapfile-vers
new file mode 100644
index 0000000000..6b7c5a5067
--- /dev/null
+++ b/usr/src/lib/varpd/direct/common/mapfile-vers
@@ -0,0 +1,35 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate {
+    local:
+	*;
+};
diff --git a/usr/src/lib/varpd/direct/i386/Makefile b/usr/src/lib/varpd/direct/i386/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/direct/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/direct/sparc/Makefile b/usr/src/lib/varpd/direct/sparc/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/direct/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/direct/sparcv9/Makefile b/usr/src/lib/varpd/direct/sparcv9/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/direct/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/varpd/files/Makefile b/usr/src/lib/varpd/files/Makefile
new file mode 100644
index 0000000000..275f07bf8b
--- /dev/null
+++ b/usr/src/lib/varpd/files/Makefile
@@ -0,0 +1,40 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include		../../Makefile.lib
+
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+install_h:
+
+check:
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/varpd/files/Makefile.com b/usr/src/lib/varpd/files/Makefile.com
new file mode 100644
index 0000000000..cdd4d019a4
--- /dev/null
+++ b/usr/src/lib/varpd/files/Makefile.com
@@ -0,0 +1,42 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+LIBRARY =	libvarpd_files.a
+VERS =		.1
+OBJECTS =	libvarpd_files.o \
+		libvarpd_files_json.o
+
+include ../../../Makefile.lib
+include ../../Makefile.plugin
+
+LIBS =		$(DYNLIB)
+LDLIBS +=	-lc -lumem -lnvpair -lsocket -lnsl -lcustr
+CPPFLAGS +=	-I../common
+
+LINTFLAGS +=	-erroff=E_BAD_PTR_CAST_ALIGN
+LINTFLAGS64 +=	-erroff=E_BAD_PTR_CAST_ALIGN
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+SRCDIR =	../common
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../../Makefile.targ
diff --git a/usr/src/lib/varpd/files/amd64/Makefile b/usr/src/lib/varpd/files/amd64/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/files/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/varpd/files/common/libvarpd_files.c b/usr/src/lib/varpd/files/common/libvarpd_files.c
new file mode 100644
index 0000000000..812919a07d
--- /dev/null
+++ b/usr/src/lib/varpd/files/common/libvarpd_files.c
@@ -0,0 +1,605 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+/*
+ * Files based plug-in for varpd
+ *
+ * This is a dynamic varpd plug-in that has a static backing store. It's really
+ * nothing more than a glorified version of /etc/ethers, though it facilitiates
+ * a bit more. The files module allows for the full set of mappings to be fixed
+ * at creation time. In addition, it also provides support for proxying ARP,
+ * NDP, and DHCP.
+ *
+ * At this time, the plugin requires that the destination type involve both an
+ * IP address and a port; however, there's no reason that this cannot be made
+ * more flexible as we have additional encapsulation algorithms that support it.
+ * The plug-in only has a single property, which is the location of the JSON
+ * file. The JSON file itself looks something like:
+ *
+ * 	{
+ *		"aa:bb:cc:dd:ee:ff": {
+ *			"arp": "10.23.69.1",
+ *			"ndp": "2600:3c00::f03c:91ff:fe96:a264",
+ *			"ip": "192.168.1.1",
+ *			"port": 8080
+ *		},
+ *		...
+ *	}
+ */
+
+#include <libvarpd_provider.h>
+#include <umem.h>
+#include <errno.h>
+#include <thread.h>
+#include <synch.h>
+#include <strings.h>
+#include <assert.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <libnvpair.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <sys/ethernet.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <libvarpd_files_json.h>
+
+typedef struct varpd_files {
+	overlay_plugin_dest_t	vaf_dest;	/* RO */
+	varpd_provider_handle_t	*vaf_hdl;	/* RO */
+	char			*vaf_path;	/* WO */
+	nvlist_t		*vaf_nvl;	/* WO */
+	uint64_t		vaf_nmisses;	/* Atomic */
+	uint64_t		vaf_narp;	/* Atomic */
+} varpd_files_t;
+
+static const char *varpd_files_props[] = {
+	"files/config"
+};
+
+static boolean_t
+varpd_files_valid_dest(overlay_plugin_dest_t dest)
+{
+	if (dest & ~(OVERLAY_PLUGIN_D_IP | OVERLAY_PLUGIN_D_PORT))
+		return (B_FALSE);
+
+	if (!(dest & (OVERLAY_PLUGIN_D_IP | OVERLAY_PLUGIN_D_PORT)))
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
+
+static int
+varpd_files_create(varpd_provider_handle_t *hdl, void **outp,
+    overlay_plugin_dest_t dest)
+{
+	varpd_files_t *vaf;
+
+	if (varpd_files_valid_dest(dest) == B_FALSE)
+		return (ENOTSUP);
+
+	vaf = umem_alloc(sizeof (varpd_files_t), UMEM_DEFAULT);
+	if (vaf == NULL)
+		return (ENOMEM);
+
+	bzero(vaf, sizeof (varpd_files_t));
+	vaf->vaf_dest = dest;
+	vaf->vaf_path = NULL;
+	vaf->vaf_nvl = NULL;
+	vaf->vaf_hdl = hdl;
+	*outp = vaf;
+	return (0);
+}
+
+static int
+varpd_files_normalize_nvlist(varpd_files_t *vaf, nvlist_t *nvl)
+{
+	int ret;
+	nvlist_t *out;
+	nvpair_t *pair;
+
+	if ((ret = nvlist_alloc(&out, NV_UNIQUE_NAME, 0)) != 0)
+		return (ret);
+
+	for (pair = nvlist_next_nvpair(nvl, NULL); pair != NULL;
+	    pair = nvlist_next_nvpair(nvl, pair)) {
+		char *name, fname[ETHERADDRSTRL];
+		nvlist_t *data;
+		struct ether_addr ether, *e;
+		e = &ether;
+
+		if (nvpair_type(pair) != DATA_TYPE_NVLIST) {
+			nvlist_free(out);
+			return (EINVAL);
+		}
+
+		name = nvpair_name(pair);
+		if ((ret = nvpair_value_nvlist(pair, &data)) != 0) {
+			nvlist_free(out);
+			return (EINVAL);
+		}
+
+		if (ether_aton_r(name, e) == NULL) {
+			nvlist_free(out);
+			return (EINVAL);
+		}
+
+		if (ether_ntoa_r(e, fname) == NULL) {
+			nvlist_free(out);
+			return (ENOMEM);
+		}
+
+		if ((ret = nvlist_add_nvlist(out, fname, data)) != 0) {
+			nvlist_free(out);
+			return (EINVAL);
+		}
+	}
+
+	vaf->vaf_nvl = out;
+	return (0);
+}
+
+static int
+varpd_files_start(void *arg)
+{
+	int fd, ret;
+	void *maddr;
+	struct stat st;
+	nvlist_t *nvl;
+	varpd_files_t *vaf = arg;
+
+	if (vaf->vaf_path == NULL)
+		return (EAGAIN);
+
+	if ((fd = open(vaf->vaf_path, O_RDONLY)) < 0)
+		return (errno);
+
+	if (fstat(fd, &st) != 0) {
+		ret = errno;
+		if (close(fd) != 0)
+			abort();
+		return (ret);
+	}
+
+	maddr = mmap(NULL, st.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE,
+	    fd, 0);
+	if (maddr == NULL) {
+		ret = errno;
+		if (close(fd) != 0)
+			abort();
+		return (ret);
+	}
+
+	ret = nvlist_parse_json(maddr, st.st_size, &nvl,
+	    NVJSON_FORCE_INTEGER, NULL);
+	if (ret == 0) {
+		ret = varpd_files_normalize_nvlist(vaf, nvl);
+		nvlist_free(nvl);
+	}
+	if (munmap(maddr, st.st_size) != 0)
+		abort();
+	if (close(fd) != 0)
+		abort();
+
+	return (ret);
+}
+
+static void
+varpd_files_stop(void *arg)
+{
+	varpd_files_t *vaf = arg;
+
+	nvlist_free(vaf->vaf_nvl);
+	vaf->vaf_nvl = NULL;
+}
+
+static void
+varpd_files_destroy(void *arg)
+{
+	varpd_files_t *vaf = arg;
+
+	assert(vaf->vaf_nvl == NULL);
+	if (vaf->vaf_path != NULL) {
+		umem_free(vaf->vaf_path, strlen(vaf->vaf_path) + 1);
+		vaf->vaf_path = NULL;
+	}
+	umem_free(vaf, sizeof (varpd_files_t));
+}
+
+static void
+varpd_files_lookup(void *arg, varpd_query_handle_t *qh,
+    const overlay_targ_lookup_t *otl, overlay_target_point_t *otp)
+{
+	char macstr[ETHERADDRSTRL], *ipstr;
+	nvlist_t *nvl;
+	varpd_files_t *vaf = arg;
+	int32_t port;
+	static const uint8_t bcast[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+	/* We don't support a default */
+	if (otl == NULL) {
+		libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (otl->otl_sap == ETHERTYPE_ARP) {
+		libvarpd_plugin_proxy_arp(vaf->vaf_hdl, qh, otl);
+		return;
+	}
+
+	if (otl->otl_sap == ETHERTYPE_IPV6 &&
+	    otl->otl_dstaddr[0] == 0x33 &&
+	    otl->otl_dstaddr[1] == 0x33) {
+		libvarpd_plugin_proxy_ndp(vaf->vaf_hdl, qh, otl);
+		return;
+	}
+
+	if (otl->otl_sap == ETHERTYPE_IP &&
+	    bcmp(otl->otl_dstaddr, bcast, ETHERADDRL) == 0) {
+		char *mac;
+		struct ether_addr a, *addr;
+
+		addr = &a;
+		if (ether_ntoa_r((struct ether_addr *)otl->otl_srcaddr,
+		    macstr) == NULL) {
+			libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+			return;
+		}
+
+		if (nvlist_lookup_nvlist(vaf->vaf_nvl, macstr, &nvl) != 0) {
+			libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+			return;
+		}
+
+		if (nvlist_lookup_string(nvl, "dhcp-proxy", &mac) != 0) {
+			libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+			return;
+		}
+
+		if (ether_aton_r(mac, addr) == NULL) {
+			libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+			return;
+		}
+
+		libvarpd_plugin_proxy_dhcp(vaf->vaf_hdl, qh, otl);
+		return;
+	}
+
+	if (ether_ntoa_r((struct ether_addr *)otl->otl_dstaddr,
+	    macstr) == NULL) {
+		libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (nvlist_lookup_nvlist(vaf->vaf_nvl, macstr, &nvl) != 0) {
+		libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (nvlist_lookup_int32(nvl, "port", &port) != 0) {
+		libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (port <= 0 || port > UINT16_MAX) {
+		libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+		return;
+	}
+	otp->otp_port = port;
+
+	if (nvlist_lookup_string(nvl, "ip", &ipstr) != 0) {
+		libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	/*
+	 * Try to parse it as a v6 address and then if it's not, try to
+	 * transform it into a v4 address which we'll then wrap it into a v4
+	 * mapped address.
+	 */
+	if (inet_pton(AF_INET6, ipstr, &otp->otp_ip) != 1) {
+		uint32_t v4;
+		if (inet_pton(AF_INET, ipstr, &v4) != 1) {
+			libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_DROP);
+			return;
+		}
+		IN6_IPADDR_TO_V4MAPPED(v4, &otp->otp_ip);
+	}
+
+	libvarpd_plugin_query_reply(qh, VARPD_LOOKUP_OK);
+}
+
+/* ARGSUSED */
+static int
+varpd_files_nprops(void *arg, uint_t *nprops)
+{
+	*nprops = 1;
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+varpd_files_propinfo(void *arg, uint_t propid, varpd_prop_handle_t *vph)
+{
+	if (propid != 0)
+		return (EINVAL);
+
+	libvarpd_prop_set_name(vph, varpd_files_props[0]);
+	libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_RRW);
+	libvarpd_prop_set_type(vph, OVERLAY_PROP_T_STRING);
+	libvarpd_prop_set_nodefault(vph);
+	return (0);
+}
+
+static int
+varpd_files_getprop(void *arg, const char *pname, void *buf, uint32_t *sizep)
+{
+	varpd_files_t *vaf = arg;
+
+	if (strcmp(pname, varpd_files_props[0]) != 0)
+		return (EINVAL);
+
+	if (vaf->vaf_path != NULL) {
+		size_t len = strlen(vaf->vaf_path) + 1;
+		if (*sizep < len)
+			return (EOVERFLOW);
+		*sizep = len;
+		(void) strlcpy(buf, vaf->vaf_path, *sizep);
+
+	} else {
+		*sizep = 0;
+	}
+
+	return (0);
+}
+
+static int
+varpd_files_setprop(void *arg, const char *pname, const void *buf,
+    const uint32_t size)
+{
+	varpd_files_t *vaf = arg;
+
+	if (strcmp(pname, varpd_files_props[0]) != 0)
+		return (EINVAL);
+
+	if (vaf->vaf_path != NULL)
+		umem_free(vaf->vaf_path, strlen(vaf->vaf_path) + 1);
+
+	vaf->vaf_path = umem_alloc(size, UMEM_DEFAULT);
+	if (vaf->vaf_path == NULL)
+		return (ENOMEM);
+	(void) strlcpy(vaf->vaf_path, buf, size);
+	return (0);
+}
+
+static int
+varpd_files_save(void *arg, nvlist_t *nvp)
+{
+	int ret;
+	varpd_files_t *vaf = arg;
+
+	if (vaf->vaf_path == NULL)
+		return (0);
+
+	if ((ret = nvlist_add_string(nvp, varpd_files_props[0],
+	    vaf->vaf_path)) != 0)
+		return (ret);
+
+	if ((ret = nvlist_add_uint64(nvp, "files/vaf_nmisses",
+	    vaf->vaf_nmisses)) != 0)
+		return (ret);
+
+	if ((ret = nvlist_add_uint64(nvp, "files/vaf_narp",
+	    vaf->vaf_narp)) != 0)
+		return (ret);
+	return (0);
+}
+
+static int
+varpd_files_restore(nvlist_t *nvp, varpd_provider_handle_t *hdl,
+    overlay_plugin_dest_t dest, void **outp)
+{
+	varpd_files_t *vaf;
+	char *str;
+	int ret;
+	uint64_t nmisses, narp;
+
+	if (varpd_files_valid_dest(dest) == B_FALSE)
+		return (EINVAL);
+
+	ret = nvlist_lookup_string(nvp, varpd_files_props[0], &str);
+	if (ret != 0 && ret != ENOENT)
+		return (ret);
+	else if (ret == ENOENT)
+		str = NULL;
+
+	if (nvlist_lookup_uint64(nvp, "files/vaf_nmisses", &nmisses) != 0)
+		return (EINVAL);
+	if (nvlist_lookup_uint64(nvp, "files/vaf_narp", &narp) != 0)
+		return (EINVAL);
+
+	vaf = umem_alloc(sizeof (varpd_files_t), UMEM_DEFAULT);
+	if (vaf == NULL)
+		return (ENOMEM);
+
+	bzero(vaf, sizeof (varpd_files_t));
+	vaf->vaf_dest = dest;
+	if (str != NULL) {
+		size_t len = strlen(str) + 1;
+		vaf->vaf_path = umem_alloc(len, UMEM_DEFAULT);
+		if (vaf->vaf_path == NULL) {
+			umem_free(vaf, sizeof (varpd_files_t));
+			return (ENOMEM);
+		}
+		(void) strlcpy(vaf->vaf_path, str, len);
+	}
+
+	vaf->vaf_hdl = hdl;
+	*outp = vaf;
+	return (0);
+}
+
+static void
+varpd_files_proxy_arp(void *arg, varpd_arp_handle_t *vah, int kind,
+    const struct sockaddr *sock, uint8_t *out)
+{
+	varpd_files_t *vaf = arg;
+	const struct sockaddr_in *ip;
+	const struct sockaddr_in6 *ip6;
+	nvpair_t *pair;
+
+	if (kind != VARPD_QTYPE_ETHERNET) {
+		libvarpd_plugin_arp_reply(vah, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (sock->sa_family != AF_INET && sock->sa_family != AF_INET6) {
+		libvarpd_plugin_arp_reply(vah, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	ip = (const struct sockaddr_in *)sock;
+	ip6 = (const struct sockaddr_in6 *)sock;
+	for (pair = nvlist_next_nvpair(vaf->vaf_nvl, NULL); pair != NULL;
+	    pair = nvlist_next_nvpair(vaf->vaf_nvl, pair)) {
+		char *mac, *ipstr;
+		nvlist_t *data;
+		struct in_addr ia;
+		struct in6_addr ia6;
+		struct ether_addr ether, *e;
+		e = &ether;
+
+		if (nvpair_type(pair) != DATA_TYPE_NVLIST)
+			continue;
+
+		mac = nvpair_name(pair);
+		if (nvpair_value_nvlist(pair, &data) != 0)
+			continue;
+
+
+		if (sock->sa_family == AF_INET) {
+			if (nvlist_lookup_string(data, "arp", &ipstr) != 0)
+				continue;
+
+			if (inet_pton(AF_INET, ipstr, &ia) != 1)
+				continue;
+
+			if (bcmp(&ia, &ip->sin_addr,
+			    sizeof (struct in_addr)) != 0)
+				continue;
+		} else {
+			if (nvlist_lookup_string(data, "ndp", &ipstr) != 0)
+				continue;
+
+			if (inet_pton(AF_INET6, ipstr, &ia6) != 1)
+				continue;
+
+			if (bcmp(&ia6, &ip6->sin6_addr,
+			    sizeof (struct in6_addr)) != 0)
+				continue;
+		}
+
+		if (ether_aton_r(mac, e) == NULL) {
+			libvarpd_plugin_arp_reply(vah, VARPD_LOOKUP_DROP);
+			return;
+		}
+
+		bcopy(e, out, ETHERADDRL);
+		libvarpd_plugin_arp_reply(vah, VARPD_LOOKUP_OK);
+		return;
+	}
+
+	libvarpd_plugin_arp_reply(vah, VARPD_LOOKUP_DROP);
+}
+
+static void
+varpd_files_proxy_dhcp(void *arg, varpd_dhcp_handle_t *vdh, int type,
+    const overlay_targ_lookup_t *otl, uint8_t *out)
+{
+	varpd_files_t *vaf = arg;
+	nvlist_t *nvl;
+	char macstr[ETHERADDRSTRL], *mac;
+	struct ether_addr a, *addr;
+
+	addr = &a;
+	if (type != VARPD_QTYPE_ETHERNET) {
+		libvarpd_plugin_dhcp_reply(vdh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (ether_ntoa_r((struct ether_addr *)otl->otl_srcaddr,
+	    macstr) == NULL) {
+		libvarpd_plugin_dhcp_reply(vdh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (nvlist_lookup_nvlist(vaf->vaf_nvl, macstr, &nvl) != 0) {
+		libvarpd_plugin_dhcp_reply(vdh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (nvlist_lookup_string(nvl, "dhcp-proxy", &mac) != 0) {
+		libvarpd_plugin_dhcp_reply(vdh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	if (ether_aton_r(mac, addr) == NULL) {
+		libvarpd_plugin_dhcp_reply(vdh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	bcopy(addr, out, ETHERADDRL);
+	libvarpd_plugin_dhcp_reply(vdh, VARPD_LOOKUP_OK);
+}
+
+static const varpd_plugin_ops_t varpd_files_ops = {
+	0,
+	varpd_files_create,
+	varpd_files_start,
+	varpd_files_stop,
+	varpd_files_destroy,
+	NULL,
+	varpd_files_lookup,
+	varpd_files_nprops,
+	varpd_files_propinfo,
+	varpd_files_getprop,
+	varpd_files_setprop,
+	varpd_files_save,
+	varpd_files_restore,
+	varpd_files_proxy_arp,
+	varpd_files_proxy_dhcp
+};
+
+#pragma init(varpd_files_init)
+static void
+varpd_files_init(void)
+{
+	int err;
+	varpd_plugin_register_t *vpr;
+
+	vpr = libvarpd_plugin_alloc(VARPD_CURRENT_VERSION, &err);
+	if (vpr == NULL)
+		return;
+
+	vpr->vpr_mode = OVERLAY_TARGET_DYNAMIC;
+	vpr->vpr_name = "files";
+	vpr->vpr_ops = &varpd_files_ops;
+	(void) libvarpd_plugin_register(vpr);
+	libvarpd_plugin_free(vpr);
+}
diff --git a/usr/src/lib/varpd/files/common/libvarpd_files_json.c b/usr/src/lib/varpd/files/common/libvarpd_files_json.c
new file mode 100644
index 0000000000..53e63c6244
--- /dev/null
+++ b/usr/src/lib/varpd/files/common/libvarpd_files_json.c
@@ -0,0 +1,936 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include <strings.h>
+#include <errno.h>
+#include <libnvpair.h>
+#include <sys/ccompile.h>
+
+#include "libvarpd_files_json.h"
+
+typedef enum json_type {
+	JSON_TYPE_NOTHING = 0,
+	JSON_TYPE_STRING = 1,
+	JSON_TYPE_INTEGER,
+	JSON_TYPE_DOUBLE,
+	JSON_TYPE_BOOLEAN,
+	JSON_TYPE_NULL,
+	JSON_TYPE_OBJECT,
+	JSON_TYPE_ARRAY
+} json_type_t;
+
+typedef enum parse_state {
+	PARSE_ERROR = -1,
+	PARSE_DONE = 0,
+	PARSE_REST,
+	PARSE_OBJECT,
+	PARSE_KEY_STRING,
+	PARSE_COLON,
+	PARSE_STRING,
+	PARSE_OBJECT_COMMA,
+	PARSE_ARRAY,
+	PARSE_BAREWORD,
+	PARSE_NUMBER,
+	PARSE_ARRAY_VALUE,
+	PARSE_ARRAY_COMMA
+} parse_state_t;
+
+#define	JSON_MARKER		".__json_"
+#define	JSON_MARKER_ARRAY	JSON_MARKER "array"
+
+typedef struct parse_frame {
+	parse_state_t pf_ps;
+	nvlist_t *pf_nvl;
+
+	char *pf_key;
+	void *pf_value;
+	json_type_t pf_value_type;
+	int pf_array_index;
+
+	struct parse_frame *pf_next;
+} parse_frame_t;
+
+typedef struct state {
+	const char *s_in;
+	unsigned long s_pos;
+	unsigned long s_len;
+
+	parse_frame_t *s_top;
+
+	nvlist_parse_json_flags_t s_flags;
+
+	/*
+	 * This string buffer is used for temporary storage by the
+	 * "collect_*()" family of functions.
+	 */
+	custr_t *s_collect;
+
+	int s_errno;
+	custr_t *s_errstr;
+} state_t;
+
+typedef void (*parse_handler_t)(state_t *);
+
+static void
+movestate(state_t *s, parse_state_t ps)
+{
+	if (s->s_flags & NVJSON_DEBUG) {
+		(void) fprintf(stderr, "nvjson: move state %d -> %d\n",
+		    s->s_top->pf_ps, ps);
+	}
+	s->s_top->pf_ps = ps;
+}
+
+static void
+posterror(state_t *s, int erno, const char *error)
+{
+	/*
+	 * If the caller wants error messages printed to stderr, do that
+	 * first.
+	 */
+	if (s->s_flags & NVJSON_ERRORS_TO_STDERR) {
+		(void) fprintf(stderr, "nvjson error (pos %ld, errno %d): %s\n",
+		    s->s_pos, erno, error);
+	}
+
+	/*
+	 * Try and store the error message for the caller.  This may fail if
+	 * the error was related to memory pressure, and that condition still
+	 * exists.
+	 */
+	s->s_errno = erno;
+	if (s->s_errstr != NULL) {
+		(void) custr_append(s->s_errstr, error);
+	}
+
+	movestate(s, PARSE_ERROR);
+}
+
+static int
+pushstate(state_t *s, parse_state_t ps, parse_state_t retps)
+{
+	parse_frame_t *n;
+
+	if (s->s_flags & NVJSON_DEBUG) {
+		(void) fprintf(stderr, "nvjson: push state %d -> %d (ret %d)\n",
+		    s->s_top->pf_ps, ps, retps);
+	}
+
+	if ((n = calloc(1, sizeof (*n))) == NULL) {
+		posterror(s, errno, "pushstate calloc failure");
+		return (-1);
+	}
+
+	/*
+	 * Store the state we'll return to when popping this
+	 * frame:
+	 */
+	s->s_top->pf_ps = retps;
+
+	/*
+	 * Store the initial state for the new frame, and
+	 * put it on top of the stack:
+	 */
+	n->pf_ps = ps;
+	n->pf_value_type = JSON_TYPE_NOTHING;
+
+	n->pf_next = s->s_top;
+	s->s_top = n;
+
+	return (0);
+}
+
+static char
+popchar(state_t *s)
+{
+	if (s->s_pos > s->s_len) {
+		return (0);
+	}
+	return (s->s_in[s->s_pos++]);
+}
+
+static char
+peekchar(state_t *s)
+{
+	if (s->s_pos > s->s_len) {
+		return (0);
+	}
+	return (s->s_in[s->s_pos]);
+}
+
+static void
+discard_whitespace(state_t *s)
+{
+	while (isspace(peekchar(s))) {
+		(void) popchar(s);
+	}
+}
+
+static char *escape_pairs[] = {
+	"\"\"", "\\\\", "//", "b\b", "f\f", "n\n", "r\r", "t\t", NULL
+};
+
+static char
+collect_string_escape(state_t *s)
+{
+	int i;
+	char c = popchar(s);
+
+	if (c == '\0') {
+		posterror(s, EPROTO, "EOF mid-escape sequence");
+		return (-1);
+	}
+
+	/*
+	 * Handle four-digit Unicode escapes up to and including \u007f.
+	 * Strings that cannot be represented as 7-bit clean ASCII are not
+	 * currently supported.
+	 */
+	if (c == 'u') {
+		int res;
+		int ndigs = 0;
+		char digs[5];
+
+		/*
+		 * Deal with 4-digit unicode escape.
+		 */
+		while (ndigs < 4) {
+			if ((digs[ndigs++] = popchar(s)) == '\0') {
+				posterror(s, EPROTO, "EOF mid-escape "
+				    "sequence");
+				return (-1);
+			}
+		}
+		digs[4] = '\0';
+		if ((res = atoi(digs)) > 127) {
+			posterror(s, EPROTO, "unicode escape above 0x7f");
+			return (-1);
+		}
+
+		if (custr_appendc(s->s_collect, res) != 0) {
+			posterror(s, errno, "custr_appendc failure");
+			return (-1);
+		}
+		return (0);
+	}
+
+	/*
+	 * See if this is a C-style escape character we recognise.
+	 */
+	for (i = 0; escape_pairs[i] != NULL; i++) {
+		char *ep = escape_pairs[i];
+		if (ep[0] == c) {
+			if (custr_appendc(s->s_collect, ep[1]) != 0) {
+				posterror(s, errno, "custr_appendc failure");
+				return (-1);
+			}
+			return (0);
+		}
+	}
+
+	posterror(s, EPROTO, "unrecognised escape sequence");
+	return (-1);
+}
+
+static int
+collect_string(state_t *s)
+{
+	custr_reset(s->s_collect);
+
+	for (;;) {
+		char c;
+
+		switch (c = popchar(s)) {
+		case '"':
+			/*
+			 * Legal End of String.
+			 */
+			return (0);
+
+		case '\0':
+			posterror(s, EPROTO, "EOF mid-string");
+			return (-1);
+
+		case '\\':
+			/*
+			 * Escape Characters and Sequences.
+			 */
+			if (collect_string_escape(s) != 0) {
+				return (-1);
+			}
+			break;
+
+		default:
+			if (custr_appendc(s->s_collect, c) != 0) {
+				posterror(s, errno, "custr_appendc failure");
+				return (-1);
+			}
+			break;
+		}
+	}
+}
+
+static int
+collect_bareword(state_t *s)
+{
+	custr_reset(s->s_collect);
+
+	for (;;) {
+		if (!islower(peekchar(s))) {
+			return (0);
+		}
+
+		if (custr_appendc(s->s_collect, popchar(s)) != 0) {
+			posterror(s, errno, "custr_appendc failure");
+			return (-1);
+		}
+	}
+}
+
+static void
+hdlr_bareword(state_t *s)
+{
+	const char *str;
+
+	if (collect_bareword(s) != 0) {
+		return;
+	}
+
+	str = custr_cstr(s->s_collect);
+	if (strcmp(str, "true") == 0) {
+		s->s_top->pf_value_type = JSON_TYPE_BOOLEAN;
+		s->s_top->pf_value = (void *)B_TRUE;
+	} else if (strcmp(str, "false") == 0) {
+		s->s_top->pf_value_type = JSON_TYPE_BOOLEAN;
+		s->s_top->pf_value = (void *)B_FALSE;
+	} else if (strcmp(str, "null") == 0) {
+		s->s_top->pf_value_type = JSON_TYPE_NULL;
+	} else {
+		posterror(s, EPROTO, "expected 'true', 'false' or 'null'");
+		return;
+	}
+
+	movestate(s, PARSE_DONE);
+}
+
+/* ARGSUSED */
+static int
+collect_number(state_t *s, boolean_t *isint, int32_t *result,
+    double *fresult __unused)
+{
+	boolean_t neg = B_FALSE;
+	int t;
+
+	custr_reset(s->s_collect);
+
+	if (peekchar(s) == '-') {
+		neg = B_TRUE;
+		(void) popchar(s);
+	}
+	/*
+	 * Read the 'int' portion:
+	 */
+	if (!isdigit(peekchar(s))) {
+		posterror(s, EPROTO, "malformed number: expected digit (0-9)");
+		return (-1);
+	}
+	for (;;) {
+		if (!isdigit(peekchar(s))) {
+			break;
+		}
+		if (custr_appendc(s->s_collect, popchar(s)) != 0) {
+			posterror(s, errno, "custr_append failure");
+			return (-1);
+		}
+	}
+	if (peekchar(s) == '.' || peekchar(s) == 'e' || peekchar(s) == 'E') {
+		posterror(s, ENOTSUP, "do not yet support FRACs or EXPs");
+		return (-1);
+	}
+
+	t = atoi(custr_cstr(s->s_collect));
+
+	*isint = B_TRUE;
+	*result = (neg == B_TRUE) ? (-t) : t;
+	return (0);
+}
+
+static void
+hdlr_number(state_t *s)
+{
+	boolean_t isint;
+	int32_t result;
+	double fresult;
+
+	if (collect_number(s, &isint, &result, &fresult) != 0) {
+		return;
+	}
+
+	if (isint == B_TRUE) {
+		s->s_top->pf_value = (void *)(uintptr_t)result;
+		s->s_top->pf_value_type = JSON_TYPE_INTEGER;
+	} else {
+		s->s_top->pf_value = malloc(sizeof (fresult));
+		bcopy(&fresult, s->s_top->pf_value, sizeof (fresult));
+		s->s_top->pf_value_type = JSON_TYPE_DOUBLE;
+	}
+
+	movestate(s, PARSE_DONE);
+}
+
+static void
+hdlr_rest(state_t *s)
+{
+	char c;
+	discard_whitespace(s);
+	c = popchar(s);
+	switch (c) {
+	case '{':
+		movestate(s, PARSE_OBJECT);
+		return;
+
+	case '[':
+		movestate(s, PARSE_ARRAY);
+		return;
+
+	default:
+		posterror(s, EPROTO, "EOF before object or array");
+		return;
+	}
+}
+
+static int
+add_empty_child(state_t *s)
+{
+	/*
+	 * Here, we create an empty nvlist to represent this object
+	 * or array:
+	 */
+	nvlist_t *empty;
+	if (nvlist_alloc(&empty, NV_UNIQUE_NAME, 0) != 0) {
+		posterror(s, errno, "nvlist_alloc failure");
+		return (-1);
+	}
+	if (s->s_top->pf_next != NULL) {
+		/*
+		 * If we're a child of the frame above, we store ourselves in
+		 * that frame's nvlist:
+		 */
+		nvlist_t *nvl = s->s_top->pf_next->pf_nvl;
+		char *key = s->s_top->pf_next->pf_key;
+
+		if (nvlist_add_nvlist(nvl, key, empty) != 0) {
+			posterror(s, errno, "nvlist_add_nvlist failure");
+			nvlist_free(empty);
+			return (-1);
+		}
+		nvlist_free(empty);
+		if (nvlist_lookup_nvlist(nvl, key, &empty) != 0) {
+			posterror(s, errno, "nvlist_lookup_nvlist failure");
+			return (-1);
+		}
+	}
+	s->s_top->pf_nvl = empty;
+	return (0);
+}
+
+static int
+decorate_array(state_t *s)
+{
+	int idx = s->s_top->pf_array_index;
+	/*
+	 * When we are done creating an array, we store a 'length'
+	 * property on it, as well as an internal-use marker value.
+	 */
+	if (nvlist_add_boolean(s->s_top->pf_nvl, JSON_MARKER_ARRAY) != 0 ||
+	    nvlist_add_uint32(s->s_top->pf_nvl, "length", idx) != 0) {
+		posterror(s, errno, "nvlist_add failure");
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+hdlr_array(state_t *s)
+{
+	s->s_top->pf_value_type = JSON_TYPE_ARRAY;
+
+	if (add_empty_child(s) != 0) {
+		return;
+	}
+
+	discard_whitespace(s);
+
+	switch (peekchar(s)) {
+	case ']':
+		(void) popchar(s);
+
+		if (decorate_array(s) != 0) {
+			return;
+		}
+
+		movestate(s, PARSE_DONE);
+		return;
+
+	default:
+		movestate(s, PARSE_ARRAY_VALUE);
+		return;
+	}
+}
+
+static void
+hdlr_array_comma(state_t *s)
+{
+	discard_whitespace(s);
+
+	switch (popchar(s)) {
+	case ']':
+		if (decorate_array(s) != 0) {
+			return;
+		}
+
+		movestate(s, PARSE_DONE);
+		return;
+	case ',':
+		movestate(s, PARSE_ARRAY_VALUE);
+		return;
+	default:
+		posterror(s, EPROTO, "expected ',' or ']'");
+		return;
+	}
+}
+
+static void
+hdlr_array_value(state_t *s)
+{
+	char c;
+
+	/*
+	 * Generate keyname from the next array index:
+	 */
+	if (s->s_top->pf_key != NULL) {
+		(void) fprintf(stderr, "pf_key not null! was %s\n",
+		    s->s_top->pf_key);
+		abort();
+	}
+
+	if (asprintf(&s->s_top->pf_key, "%d", s->s_top->pf_array_index++) < 0) {
+		posterror(s, errno, "asprintf failure");
+		return;
+	}
+
+	discard_whitespace(s);
+
+	/*
+	 * Select which type handler we need for the next value:
+	 */
+	switch (c = peekchar(s)) {
+	case '"':
+		(void) popchar(s);
+		(void) pushstate(s, PARSE_STRING, PARSE_ARRAY_COMMA);
+		return;
+
+	case '{':
+		(void) popchar(s);
+		(void) pushstate(s, PARSE_OBJECT, PARSE_ARRAY_COMMA);
+		return;
+
+	case '[':
+		(void) popchar(s);
+		(void) pushstate(s, PARSE_ARRAY, PARSE_ARRAY_COMMA);
+		return;
+
+	default:
+		if (islower(c)) {
+			(void) pushstate(s, PARSE_BAREWORD,
+			    PARSE_ARRAY_COMMA);
+			return;
+		} else if (c == '-' || isdigit(c)) {
+			(void) pushstate(s, PARSE_NUMBER, PARSE_ARRAY_COMMA);
+			return;
+		} else {
+			posterror(s, EPROTO, "unexpected character at start "
+			    "of value");
+			return;
+		}
+	}
+}
+
+static void
+hdlr_object(state_t *s)
+{
+	s->s_top->pf_value_type = JSON_TYPE_OBJECT;
+
+	if (add_empty_child(s) != 0) {
+		return;
+	}
+
+	discard_whitespace(s);
+
+	switch (popchar(s)) {
+	case '}':
+		movestate(s, PARSE_DONE);
+		return;
+
+	case '"':
+		movestate(s, PARSE_KEY_STRING);
+		return;
+
+	default:
+		posterror(s, EPROTO, "expected key or '}'");
+		return;
+	}
+}
+
+static void
+hdlr_key_string(state_t *s)
+{
+	if (collect_string(s) != 0) {
+		return;
+	}
+
+	/*
+	 * Record the key name of the next value.
+	 */
+	if ((s->s_top->pf_key = strdup(custr_cstr(s->s_collect))) == NULL) {
+		posterror(s, errno, "strdup failure");
+		return;
+	}
+
+	movestate(s, PARSE_COLON);
+}
+
+static void
+hdlr_colon(state_t *s)
+{
+	char c;
+	discard_whitespace(s);
+
+	if ((c = popchar(s)) != ':') {
+		posterror(s, EPROTO, "expected ':'");
+		return;
+	}
+
+	discard_whitespace(s);
+
+	/*
+	 * Select which type handler we need for the value after the colon:
+	 */
+	switch (c = peekchar(s)) {
+	case '"':
+		(void) popchar(s);
+		(void) pushstate(s, PARSE_STRING, PARSE_OBJECT_COMMA);
+		return;
+
+	case '{':
+		(void) popchar(s);
+		(void) pushstate(s, PARSE_OBJECT, PARSE_OBJECT_COMMA);
+		return;
+
+	case '[':
+		(void) popchar(s);
+		(void) pushstate(s, PARSE_ARRAY, PARSE_OBJECT_COMMA);
+		return;
+
+	default:
+		if (islower(c)) {
+			(void) pushstate(s, PARSE_BAREWORD, PARSE_OBJECT_COMMA);
+			return;
+		} else if (c == '-' || isdigit(c)) {
+			(void) pushstate(s, PARSE_NUMBER, PARSE_OBJECT_COMMA);
+			return;
+		} else {
+			(void) posterror(s, EPROTO, "unexpected character at "
+			    "start of value");
+			return;
+		}
+	}
+}
+
+static void
+hdlr_object_comma(state_t *s)
+{
+	discard_whitespace(s);
+
+	switch (popchar(s)) {
+	case '}':
+		movestate(s, PARSE_DONE);
+		return;
+
+	case ',':
+		discard_whitespace(s);
+		if (popchar(s) != '"') {
+			posterror(s, EPROTO, "expected '\"'");
+			return;
+		}
+		movestate(s, PARSE_KEY_STRING);
+		return;
+
+	default:
+		posterror(s, EPROTO, "expected ',' or '}'");
+		return;
+	}
+}
+
+static void
+hdlr_string(state_t *s)
+{
+	if (collect_string(s) != 0) {
+		return;
+	}
+
+	s->s_top->pf_value_type = JSON_TYPE_STRING;
+	if ((s->s_top->pf_value = strdup(custr_cstr(s->s_collect))) == NULL) {
+		posterror(s, errno, "strdup failure");
+		return;
+	}
+
+	movestate(s, PARSE_DONE);
+}
+
+static int
+store_value(state_t *s)
+{
+	nvlist_t *targ = s->s_top->pf_next->pf_nvl;
+	char *key = s->s_top->pf_next->pf_key;
+	json_type_t type = s->s_top->pf_value_type;
+	int ret = 0;
+
+	switch (type) {
+	case JSON_TYPE_STRING:
+		if (nvlist_add_string(targ, key, s->s_top->pf_value) != 0) {
+			posterror(s, errno, "nvlist_add_string failure");
+			ret = -1;
+		}
+		free(s->s_top->pf_value);
+		break;
+
+	case JSON_TYPE_BOOLEAN:
+		if (nvlist_add_boolean_value(targ, key,
+		    (boolean_t)s->s_top->pf_value) != 0) {
+			posterror(s, errno, "nvlist_add_boolean_value "
+			    "failure");
+			ret = -1;
+		}
+		break;
+
+	case JSON_TYPE_NULL:
+		if (nvlist_add_boolean(targ, key) != 0) {
+			posterror(s, errno, "nvlist_add_boolean failure");
+			ret = -1;
+		}
+		break;
+
+	case JSON_TYPE_INTEGER:
+		if (nvlist_add_int32(targ, key,
+		    (int32_t)(uintptr_t)s->s_top->pf_value) != 0) {
+			posterror(s, errno, "nvlist_add_int32 failure");
+			ret = -1;
+		}
+		break;
+
+	case JSON_TYPE_ARRAY:
+	case JSON_TYPE_OBJECT:
+		/*
+		 * Objects and arrays are already 'stored' in their target
+		 * nvlist on creation. See: hdlr_object, hdlr_array.
+		 */
+		break;
+
+	default:
+		(void) fprintf(stderr, "ERROR: could not store unknown "
+		    "type %d\n", type);
+		abort();
+	}
+
+	s->s_top->pf_value = NULL;
+	free(s->s_top->pf_next->pf_key);
+	s->s_top->pf_next->pf_key = NULL;
+	return (ret);
+}
+
+static parse_frame_t *
+parse_frame_free(parse_frame_t *pf, boolean_t free_nvl)
+{
+	parse_frame_t *next = pf->pf_next;
+	if (pf->pf_key != NULL) {
+		free(pf->pf_key);
+	}
+	if (pf->pf_value != NULL) {
+		abort();
+	}
+	if (free_nvl && pf->pf_nvl != NULL) {
+		nvlist_free(pf->pf_nvl);
+	}
+	free(pf);
+	return (next);
+}
+
+static parse_handler_t hdlrs[] = {
+	NULL,				/* PARSE_DONE */
+	hdlr_rest,			/* PARSE_REST */
+	hdlr_object,			/* PARSE_OBJECT */
+	hdlr_key_string,		/* PARSE_KEY_STRING */
+	hdlr_colon,			/* PARSE_COLON */
+	hdlr_string,			/* PARSE_STRING */
+	hdlr_object_comma,		/* PARSE_OBJECT_COMMA */
+	hdlr_array,			/* PARSE_ARRAY */
+	hdlr_bareword,			/* PARSE_BAREWORD */
+	hdlr_number,			/* PARSE_NUMBER */
+	hdlr_array_value,		/* PARSE_ARRAY_VALUE */
+	hdlr_array_comma		/* PARSE_ARRAY_COMMA */
+};
+#define	NUM_PARSE_HANDLERS	(int)(sizeof (hdlrs) / sizeof (hdlrs[0]))
+
+int
+nvlist_parse_json(const char *buf, size_t buflen, nvlist_t **nvlp,
+    nvlist_parse_json_flags_t flag, nvlist_parse_json_error_t *errout)
+{
+	state_t s;
+
+	/*
+	 * Check for valid flags:
+	 */
+	if ((flag & NVJSON_FORCE_INTEGER) && (flag & NVJSON_FORCE_DOUBLE)) {
+		errno = EINVAL;
+		return (-1);
+	}
+	if ((flag & ~NVJSON_ALL) != 0) {
+		errno = EINVAL;
+		return (-1);
+	}
+
+	/*
+	 * Initialise parsing state structure:
+	 */
+	bzero(&s, sizeof (s));
+	s.s_in = buf;
+	s.s_pos = 0;
+	s.s_len = buflen;
+	s.s_flags = flag;
+
+	/*
+	 * Allocate the collect buffer string.
+	 */
+	if (custr_alloc(&s.s_collect) != 0) {
+		s.s_errno = errno;
+		if (errout != NULL) {
+			(void) snprintf(errout->nje_message,
+			    sizeof (errout->nje_message),
+			    "custr alloc failure: %s",
+			    strerror(errno));
+		}
+		goto out;
+	}
+
+	/*
+	 * If the caller has requested error information, allocate the error
+	 * string now.
+	 */
+	if (errout != NULL) {
+		if (custr_alloc_buf(&s.s_errstr, errout->nje_message,
+		    sizeof (errout->nje_message)) != 0) {
+			s.s_errno = errno;
+			(void) snprintf(errout->nje_message,
+			    sizeof (errout->nje_message),
+			    "custr alloc failure: %s",
+			    strerror(errno));
+			goto out;
+		}
+		custr_reset(s.s_errstr);
+	}
+
+	/*
+	 * Allocate top-most stack frame:
+	 */
+	if ((s.s_top = calloc(1, sizeof (*s.s_top))) == NULL) {
+		s.s_errno = errno;
+		goto out;
+	}
+
+	s.s_top->pf_ps = PARSE_REST;
+	for (;;) {
+		if (s.s_top->pf_ps < 0) {
+			/*
+			 * The parser reported an error.
+			 */
+			goto out;
+		}
+
+		if (s.s_top->pf_ps == PARSE_DONE) {
+			if (s.s_top->pf_next == NULL) {
+				/*
+				 * Last frame, so we're really
+				 * done.
+				 */
+				*nvlp = s.s_top->pf_nvl;
+				goto out;
+			} else {
+				/*
+				 * Otherwise, pop a frame and continue in
+				 * previous state.  Copy out the value we
+				 * created in the old frame:
+				 */
+				if (store_value(&s) != 0) {
+					goto out;
+				}
+
+				/*
+				 * Free old frame:
+				 */
+				s.s_top = parse_frame_free(s.s_top, B_FALSE);
+			}
+		}
+
+		/*
+		 * Dispatch to parser handler routine for this state:
+		 */
+		if (s.s_top->pf_ps >= NUM_PARSE_HANDLERS ||
+		    hdlrs[s.s_top->pf_ps] == NULL) {
+			(void) fprintf(stderr, "no handler for state %d\n",
+			    s.s_top->pf_ps);
+			abort();
+		}
+		hdlrs[s.s_top->pf_ps](&s);
+	}
+
+out:
+	if (errout != NULL) {
+		/*
+		 * Copy out error number and parse position.  The custr_t for
+		 * the error message was backed by the buffer in the error
+		 * object, so no copying is required.
+		 */
+		errout->nje_errno = s.s_errno;
+		errout->nje_pos = s.s_pos;
+	}
+
+	/*
+	 * Free resources:
+	 */
+	while (s.s_top != NULL) {
+		s.s_top = parse_frame_free(s.s_top, s.s_errno == 0 ? B_FALSE :
+		    B_TRUE);
+	}
+	custr_free(s.s_collect);
+	custr_free(s.s_errstr);
+
+	errno = s.s_errno;
+	return (s.s_errno == 0 ? 0 : -1);
+}
diff --git a/usr/src/lib/varpd/files/common/libvarpd_files_json.h b/usr/src/lib/varpd/files/common/libvarpd_files_json.h
new file mode 100644
index 0000000000..9fe765741b
--- /dev/null
+++ b/usr/src/lib/varpd/files/common/libvarpd_files_json.h
@@ -0,0 +1,52 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef	_LIBVARPD_FILES_JSON_H
+#define	_LIBVARPD_FILES_JSON_H
+
+#include <libnvpair.h>
+#include <libcustr.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum nvlist_parse_json_flags {
+	NVJSON_FORCE_INTEGER = 0x01,
+	NVJSON_FORCE_DOUBLE = 0x02,
+	NVJSON_ERRORS_TO_STDERR = 0x04,
+	NVJSON_DEBUG = 0x08
+} nvlist_parse_json_flags_t;
+
+typedef struct nvlist_parse_json_error {
+	int nje_errno;
+	long nje_pos;
+	char nje_message[512];
+} nvlist_parse_json_error_t;
+
+#define	NVJSON_ALL						\
+	(NVJSON_FORCE_INTEGER |					\
+	NVJSON_FORCE_DOUBLE |					\
+	NVJSON_ERRORS_TO_STDERR |				\
+	NVJSON_DEBUG)
+
+extern int nvlist_parse_json(const char *, size_t, nvlist_t **,
+    nvlist_parse_json_flags_t, nvlist_parse_json_error_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _LIBVARPD_FILES_JSON_H */
diff --git a/usr/src/lib/varpd/files/common/llib-lvarpd_files b/usr/src/lib/varpd/files/common/llib-lvarpd_files
new file mode 100644
index 0000000000..03c34f4fcb
--- /dev/null
+++ b/usr/src/lib/varpd/files/common/llib-lvarpd_files
@@ -0,0 +1,18 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
diff --git a/usr/src/lib/varpd/files/common/mapfile-vers b/usr/src/lib/varpd/files/common/mapfile-vers
new file mode 100644
index 0000000000..6b7c5a5067
--- /dev/null
+++ b/usr/src/lib/varpd/files/common/mapfile-vers
@@ -0,0 +1,35 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate {
+    local:
+	*;
+};
diff --git a/usr/src/lib/varpd/files/i386/Makefile b/usr/src/lib/varpd/files/i386/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/files/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/files/sparc/Makefile b/usr/src/lib/varpd/files/sparc/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/files/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/files/sparcv9/Makefile b/usr/src/lib/varpd/files/sparcv9/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/files/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/varpd/libvarpd/Makefile b/usr/src/lib/varpd/libvarpd/Makefile
new file mode 100644
index 0000000000..2a4f8f070c
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/Makefile
@@ -0,0 +1,55 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include		../../Makefile.lib
+
+HDRS =		libvarpd.h libvarpd_client.h libvarpd_provider.h
+HDRDIR =	common
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+TYPECHECK_LIB =	libvarpd.so.1
+TYPELIST = \
+	varpd_client_instance_arg_t \
+	varpd_client_nprops_arg_t \
+	varpd_client_propinfo_arg_t \
+	varpd_client_eresp_t \
+	varpd_persist_header_t \
+	overlay_targ_cache_entry_t \
+	overlay_targ_cache_t \
+	overlay_targ_cache_iter_t
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber lint: $(SUBDIRS)
+
+install: 	$(SUBDIRS) $(VARPD_MAPFILES) install_h
+
+install_h: 	$(ROOTHDRS)
+
+check:		$(CHECKHDRS) $(TYPECHECK)
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/varpd/libvarpd/Makefile.com b/usr/src/lib/varpd/libvarpd/Makefile.com
new file mode 100644
index 0000000000..1521f83f8f
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/Makefile.com
@@ -0,0 +1,53 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+LIBRARY =	libvarpd.a
+VERS =		.1
+OBJECTS =	libvarpd.o \
+		libvarpd_arp.o \
+		libvarpd_client.o \
+		libvarpd_door.o \
+		libvarpd_overlay.o \
+		libvarpd_panic.o \
+		libvarpd_persist.o \
+		libvarpd_prop.o \
+		libvarpd_plugin.o \
+		libvarpd_util.o
+
+include ../../../Makefile.lib
+
+LIBS =		$(DYNLIB) $(LINTLIB)
+LDLIBS +=	-lc -lavl -lumem -lidspace -lnvpair -lmd5 -lrename \
+		-lbunyan
+CPPFLAGS +=	-I../common
+
+CERRWARN +=	-erroff=E_STRUCT_DERIVED_FROM_FLEX_MBR
+LINTFLAGS +=	-erroff=E_STRUCT_DERIVED_FROM_FLEX_MBR \
+		-erroff=E_BAD_PTR_CAST_ALIGN
+LINTFLAGS64  +=	-erroff=E_STRUCT_DERIVED_FROM_FLEX_MBR \
+		-erroff=E_BAD_PTR_CAST_ALIGN
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+SRCDIR =	../common
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../../Makefile.targ
diff --git a/usr/src/lib/varpd/libvarpd/amd64/Makefile b/usr/src/lib/varpd/libvarpd/amd64/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd.c b/usr/src/lib/varpd/libvarpd/common/libvarpd.c
new file mode 100644
index 0000000000..e4460089cc
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd.c
@@ -0,0 +1,360 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * varpd library
+ */
+
+#include <stdlib.h>
+#include <errno.h>
+#include <umem.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/avl.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <strings.h>
+
+#include <libvarpd_impl.h>
+
+static int
+libvarpd_instance_comparator(const void *lp, const void *rp)
+{
+	const varpd_instance_t *lpp, *rpp;
+	lpp = lp;
+	rpp = rp;
+
+	if (lpp->vri_id > rpp->vri_id)
+		return (1);
+	if (lpp->vri_id < rpp->vri_id)
+		return (-1);
+	return (0);
+}
+
+static int
+libvarpd_instance_lcomparator(const void *lp, const void *rp)
+{
+	const varpd_instance_t *lpp, *rpp;
+	lpp = lp;
+	rpp = rp;
+
+	if (lpp->vri_linkid > rpp->vri_linkid)
+		return (1);
+	if (lpp->vri_linkid < rpp->vri_linkid)
+		return (-1);
+	return (0);
+}
+
+int
+libvarpd_create(varpd_handle_t **vphp)
+{
+	int ret;
+	varpd_impl_t *vip;
+	char buf[32];
+
+	if (vphp == NULL)
+		return (EINVAL);
+
+	*vphp = NULL;
+	vip = umem_alloc(sizeof (varpd_impl_t), UMEM_DEFAULT);
+	if (vip == NULL)
+		return (errno);
+
+	bzero(vip, sizeof (varpd_impl_t));
+	(void) snprintf(buf, sizeof (buf), "varpd_%p", vip);
+	vip->vdi_idspace = id_space_create(buf, LIBVARPD_ID_MIN,
+	    LIBVARPD_ID_MAX);
+	if (vip->vdi_idspace == NULL) {
+		int ret = errno;
+		umem_free(vip, sizeof (varpd_impl_t));
+		return (ret);
+	}
+
+	vip->vdi_qcache = umem_cache_create("query", sizeof (varpd_query_t), 0,
+	    NULL, NULL, NULL, NULL, NULL, 0);
+	if (vip->vdi_qcache == NULL) {
+		int ret = errno;
+		id_space_destroy(vip->vdi_idspace);
+		umem_free(vip, sizeof (varpd_impl_t));
+		return (ret);
+	}
+
+	if ((ret = libvarpd_overlay_init(vip)) != 0) {
+		umem_cache_destroy(vip->vdi_qcache);
+		id_space_destroy(vip->vdi_idspace);
+		umem_free(vip, sizeof (varpd_impl_t));
+		return (ret);
+	}
+
+	if ((ret = bunyan_init("varpd", &vip->vdi_bunyan)) != 0) {
+		libvarpd_overlay_fini(vip);
+		umem_cache_destroy(vip->vdi_qcache);
+		id_space_destroy(vip->vdi_idspace);
+		umem_free(vip, sizeof (varpd_impl_t));
+		return (ret);
+	}
+
+	libvarpd_persist_init(vip);
+
+	avl_create(&vip->vdi_plugins, libvarpd_plugin_comparator,
+	    sizeof (varpd_plugin_t), offsetof(varpd_plugin_t, vpp_node));
+
+	avl_create(&vip->vdi_instances, libvarpd_instance_comparator,
+	    sizeof (varpd_instance_t), offsetof(varpd_instance_t, vri_inode));
+	avl_create(&vip->vdi_linstances, libvarpd_instance_lcomparator,
+	    sizeof (varpd_instance_t), offsetof(varpd_instance_t, vri_lnode));
+
+	if (mutex_init(&vip->vdi_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL) != 0)
+		libvarpd_panic("failed to create mutex: %d", errno);
+
+	vip->vdi_doorfd = -1;
+	*vphp = (varpd_handle_t *)vip;
+	return (0);
+}
+
+void
+libvarpd_destroy(varpd_handle_t *vhp)
+{
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	libvarpd_overlay_lookup_quiesce(vhp);
+	if (mutex_destroy(&vip->vdi_lock) != 0)
+		libvarpd_panic("failed to destroy mutex: %d", errno);
+	libvarpd_persist_fini(vip);
+	libvarpd_overlay_fini(vip);
+	umem_cache_destroy(vip->vdi_qcache);
+	id_space_destroy(vip->vdi_idspace);
+	umem_free(vip, sizeof (varpd_impl_t));
+}
+
+int
+libvarpd_instance_create(varpd_handle_t *vhp, datalink_id_t linkid,
+    const char *pname, varpd_instance_handle_t **outp)
+{
+	int ret;
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+	varpd_plugin_t *plugin;
+	varpd_instance_t *inst, lookup;
+	overlay_plugin_dest_t dest;
+	uint64_t vid;
+
+	/*
+	 * We should really have our own errnos.
+	 */
+	plugin = libvarpd_plugin_lookup(vip, pname);
+	if (plugin == NULL)
+		return (ENOENT);
+
+	if ((ret = libvarpd_overlay_info(vip, linkid, &dest, NULL, &vid)) != 0)
+		return (ret);
+
+	inst = umem_alloc(sizeof (varpd_instance_t), UMEM_DEFAULT);
+	if (inst == NULL)
+		return (ENOMEM);
+
+	inst->vri_id = id_alloc(vip->vdi_idspace);
+	if (inst->vri_id == -1)
+		libvarpd_panic("failed to allocate id from vdi_idspace: %d",
+		    errno);
+	inst->vri_linkid = linkid;
+	inst->vri_vnetid = vid;
+	inst->vri_mode = plugin->vpp_mode;
+	inst->vri_dest = dest;
+	inst->vri_plugin = plugin;
+	inst->vri_impl = vip;
+	inst->vri_flags = 0;
+	if ((ret = plugin->vpp_ops->vpo_create((varpd_provider_handle_t *)inst,
+	    &inst->vri_private, dest)) != 0) {
+		id_free(vip->vdi_idspace, inst->vri_id);
+		umem_free(inst, sizeof (varpd_instance_t));
+		return (ret);
+	}
+
+	if (mutex_init(&inst->vri_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL) != 0)
+		libvarpd_panic("failed to create mutex: %d", errno);
+
+	mutex_enter(&vip->vdi_lock);
+	lookup.vri_id = inst->vri_id;
+	if (avl_find(&vip->vdi_instances, &lookup, NULL) != NULL)
+		libvarpd_panic("found duplicate instance with id %d",
+		    lookup.vri_id);
+	avl_add(&vip->vdi_instances, inst);
+	lookup.vri_linkid = inst->vri_linkid;
+	if (avl_find(&vip->vdi_linstances, &lookup, NULL) != NULL)
+		libvarpd_panic("found duplicate linstance with id %d",
+		    lookup.vri_linkid);
+	avl_add(&vip->vdi_linstances, inst);
+	mutex_exit(&vip->vdi_lock);
+	*outp = (varpd_instance_handle_t *)inst;
+	return (0);
+}
+
+uint64_t
+libvarpd_instance_id(varpd_instance_handle_t *ihp)
+{
+	varpd_instance_t *inst = (varpd_instance_t *)ihp;
+	return (inst->vri_id);
+}
+
+uint64_t
+libvarpd_plugin_vnetid(varpd_provider_handle_t *vhp)
+{
+	varpd_instance_t *inst = (varpd_instance_t *)vhp;
+	return (inst->vri_vnetid);
+}
+
+varpd_instance_handle_t *
+libvarpd_instance_lookup(varpd_handle_t *vhp, uint64_t id)
+{
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+	varpd_instance_t lookup, *retp;
+
+	lookup.vri_id = id;
+	mutex_enter(&vip->vdi_lock);
+	retp = avl_find(&vip->vdi_instances, &lookup, NULL);
+	mutex_exit(&vip->vdi_lock);
+	return ((varpd_instance_handle_t *)retp);
+}
+
+/*
+ * If this function becomes external to varpd, we need to change it to return a
+ * varpd_instance_handle_t.
+ */
+varpd_instance_t *
+libvarpd_instance_lookup_by_dlid(varpd_impl_t *vip, datalink_id_t linkid)
+{
+	varpd_instance_t lookup, *retp;
+
+	lookup.vri_linkid = linkid;
+	mutex_enter(&vip->vdi_lock);
+	retp = avl_find(&vip->vdi_linstances, &lookup, NULL);
+	mutex_exit(&vip->vdi_lock);
+	return (retp);
+}
+
+/*
+ * When an instance is being destroyed, that means we should deactivate it, as
+ * well as clean it up. That means here, the proper order is calling the plug-in
+ * stop and then the destroy function.
+ */
+void
+libvarpd_instance_destroy(varpd_instance_handle_t *ihp)
+{
+	varpd_instance_t *inst = (varpd_instance_t *)ihp;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	/*
+	 * First things first, remove it from global visibility.
+	 */
+	mutex_enter(&vip->vdi_lock);
+	avl_remove(&vip->vdi_instances, inst);
+	avl_remove(&vip->vdi_linstances, inst);
+	mutex_exit(&vip->vdi_lock);
+
+	mutex_enter(&inst->vri_lock);
+
+	/*
+	 * We need to clean up this instance, that means remove it from
+	 * persistence and stopping it. Then finally we'll have to clean it up
+	 * entirely.
+	 */
+	if (inst->vri_flags & VARPD_INSTANCE_F_ACTIVATED) {
+		inst->vri_flags &= ~VARPD_INSTANCE_F_ACTIVATED;
+		libvarpd_torch_instance(vip, inst);
+		inst->vri_plugin->vpp_ops->vpo_stop(inst->vri_private);
+		inst->vri_plugin->vpp_ops->vpo_destroy(inst->vri_private);
+		inst->vri_private = NULL;
+	}
+	mutex_exit(&inst->vri_lock);
+
+	/* Do the full clean up of the instance */
+	if (mutex_destroy(&inst->vri_lock) != 0)
+		libvarpd_panic("failed to destroy instance vri_lock");
+	id_free(vip->vdi_idspace, inst->vri_id);
+	umem_free(inst, sizeof (varpd_instance_t));
+}
+
+int
+libvarpd_instance_activate(varpd_instance_handle_t *ihp)
+{
+	int ret;
+	varpd_instance_t *inst = (varpd_instance_t *)ihp;
+
+	mutex_enter(&inst->vri_lock);
+
+	if (inst->vri_flags & VARPD_INSTANCE_F_ACTIVATED) {
+		ret = EEXIST;
+		goto out;
+	}
+
+	if ((ret = inst->vri_plugin->vpp_ops->vpo_start(inst->vri_private)) !=
+	    0)
+		goto out;
+
+	if ((ret = libvarpd_persist_instance(inst->vri_impl, inst)) != 0)
+		goto out;
+
+	/*
+	 * If this fails, we don't need to call stop, as the caller should end
+	 * up calling destroy on the instance, which takes care of calling stop
+	 * and destroy.
+	 */
+	if ((ret = libvarpd_overlay_associate(inst)) != 0)
+		goto out;
+
+	inst->vri_flags |= VARPD_INSTANCE_F_ACTIVATED;
+
+out:
+	mutex_exit(&inst->vri_lock);
+	return (ret);
+}
+
+const bunyan_logger_t *
+libvarpd_plugin_bunyan(varpd_provider_handle_t *vhp)
+{
+	varpd_instance_t *inst = (varpd_instance_t *)vhp;
+	return (inst->vri_impl->vdi_bunyan);
+}
+
+static void
+libvarpd_prefork(void)
+{
+	libvarpd_plugin_prefork();
+}
+
+static void
+libvarpd_postfork(void)
+{
+	libvarpd_plugin_postfork();
+}
+
+#pragma init(libvarpd_init)
+static void
+libvarpd_init(void)
+{
+	libvarpd_plugin_init();
+	if (pthread_atfork(libvarpd_prefork, libvarpd_postfork,
+	    libvarpd_postfork) != 0)
+		libvarpd_panic("failed to create varpd atfork: %d", errno);
+}
+
+#pragma fini(libvarpd_fini)
+static void
+libvarpd_fini(void)
+{
+	libvarpd_plugin_fini();
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd.h b/usr/src/lib/varpd/libvarpd/common/libvarpd.h
new file mode 100644
index 0000000000..aaf78e2ca6
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd.h
@@ -0,0 +1,77 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBVARPD_H
+#define	_LIBVARPD_H
+
+/*
+ * varpd interfaces
+ */
+
+#include <sys/types.h>
+#include <stdint.h>
+#include <sys/mac.h>
+#include <libvarpd_client.h>
+#include <stdio.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct __varpd_handle varpd_handle_t;
+typedef struct __varpd_prop_handle varpd_prop_handle_t;
+typedef struct __varpd_instance_handle varpd_instance_handle_t;
+
+extern int libvarpd_create(varpd_handle_t **);
+extern void libvarpd_destroy(varpd_handle_t *);
+
+extern int libvarpd_persist_enable(varpd_handle_t *, const char *);
+extern int libvarpd_persist_restore(varpd_handle_t *);
+extern int libvarpd_persist_disable(varpd_handle_t *);
+
+extern int libvarpd_instance_create(varpd_handle_t *, datalink_id_t,
+    const char *, varpd_instance_handle_t **);
+extern uint64_t libvarpd_instance_id(varpd_instance_handle_t *);
+extern varpd_instance_handle_t *libvarpd_instance_lookup(varpd_handle_t *,
+    uint64_t);
+extern void libvarpd_instance_destroy(varpd_instance_handle_t *);
+extern int libvarpd_instance_activate(varpd_instance_handle_t *);
+
+extern int libvarpd_plugin_load(varpd_handle_t *, const char *);
+typedef int (*libvarpd_plugin_walk_f)(varpd_handle_t *, const char *, void *);
+extern int libvarpd_plugin_walk(varpd_handle_t *, libvarpd_plugin_walk_f,
+    void *);
+
+extern int libvarpd_prop_handle_alloc(varpd_handle_t *,
+    varpd_instance_handle_t *, varpd_prop_handle_t **);
+extern void libvarpd_prop_handle_free(varpd_prop_handle_t *);
+extern int libvarpd_prop_nprops(varpd_instance_handle_t *, uint_t *);
+extern int libvarpd_prop_info_fill(varpd_prop_handle_t *, uint_t);
+extern int libvarpd_prop_info(varpd_prop_handle_t *, const char **, uint_t *,
+    uint_t *, const void **, uint32_t *, const mac_propval_range_t **);
+extern int libvarpd_prop_get(varpd_prop_handle_t *, void *, uint32_t *);
+extern int libvarpd_prop_set(varpd_prop_handle_t *, const void *, uint32_t);
+
+extern int libvarpd_door_server_create(varpd_handle_t *, const char *);
+extern void libvarpd_door_server_destroy(varpd_handle_t *);
+
+extern void libvarpd_overlay_lookup_run(varpd_handle_t *);
+extern void libvarpd_overlay_lookup_quiesce(varpd_handle_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBVARPD_H */
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_arp.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_arp.c
new file mode 100644
index 0000000000..df69207fe0
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_arp.c
@@ -0,0 +1,650 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Common routines for implmeenting proxy arp
+ */
+
+#include <sys/types.h>
+#include <net/if.h>
+#include <netinet/if_ether.h>
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+#include <netinet/icmp6.h>
+#include <netinet/udp.h>
+#include <netinet/dhcp.h>
+#include <libvarpd_impl.h>
+#include <sys/vlan.h>
+#include <strings.h>
+#include <assert.h>
+
+#define	IPV6_VERSION	6
+
+typedef struct varpd_arp_query {
+	int				vaq_type;
+	char				vaq_buf[ETHERMAX + VLAN_TAGSZ];
+	size_t				vaq_bsize;
+	uint8_t				vaq_lookup[ETHERADDRL];
+	struct sockaddr_storage		vaq_sock;
+	varpd_instance_t		*vaq_inst;
+	struct ether_arp		*vaq_ea;
+	varpd_query_handle_t		*vaq_query;
+	const overlay_targ_lookup_t	*vaq_otl;
+	ip6_t				*vaq_ip6;
+	nd_neighbor_solicit_t 		*vaq_ns;
+} varpd_arp_query_t;
+
+typedef struct varpd_dhcp_query {
+	char				vdq_buf[ETHERMAX + VLAN_TAGSZ];
+	size_t				vdq_bsize;
+	uint8_t				vdq_lookup[ETHERADDRL];
+	const overlay_targ_lookup_t	*vdq_otl;
+	varpd_instance_t		*vdq_inst;
+	varpd_query_handle_t		*vdq_query;
+	struct ether_header		*vdq_ether;
+} varpd_dhcp_query_t;
+
+static const uint8_t libvarpd_arp_bcast[6] = { 0xff, 0xff, 0xff, 0xff, 0xff,
+	    0xff };
+
+void
+libvarpd_plugin_proxy_arp(varpd_provider_handle_t *hdl,
+    varpd_query_handle_t *vqh, const overlay_targ_lookup_t *otl)
+{
+	varpd_arp_query_t *vaq;
+	varpd_instance_t *inst = (varpd_instance_t *)hdl;
+	struct ether_arp *ea;
+	struct sockaddr_in *ip;
+
+	vaq = umem_alloc(sizeof (varpd_arp_query_t), UMEM_DEFAULT);
+	if (vaq == NULL) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		return;
+	}
+	vaq->vaq_bsize = sizeof (vaq->vaq_buf);
+
+	if (otl->otl_sap != ETHERTYPE_ARP) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	/*
+	 * An ARP packet should not be very large because it's definited to only
+	 * be allowed to have a single entry at a given time. But our data must
+	 * be at least as large as an ether_arp and our header must be at least
+	 * as large as a standard ethernet header.
+	 */
+	if (otl->otl_hdrsize + otl->otl_pktsize > vaq->vaq_bsize ||
+	    otl->otl_pktsize < sizeof (struct ether_arp) ||
+	    otl->otl_hdrsize < sizeof (struct ether_header)) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	if (libvarpd_overlay_packet(inst->vri_impl, otl, vaq->vaq_buf,
+	    &vaq->vaq_bsize) != 0) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	if (otl->otl_hdrsize + otl->otl_pktsize < vaq->vaq_bsize) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	ea = (void *)((uintptr_t)vaq->vaq_buf + (uintptr_t)otl->otl_hdrsize);
+
+	/*
+	 * Make sure it matches something that we know about.
+	 */
+	if (ntohs(ea->ea_hdr.ar_hrd) != ARPHRD_ETHER ||
+	    ntohs(ea->ea_hdr.ar_pro) != ETHERTYPE_IP ||
+	    ea->ea_hdr.ar_hln != ETHERADDRL ||
+	    ea->ea_hdr.ar_pln != sizeof (ea->arp_spa) ||
+	    ntohs(ea->ea_hdr.ar_op) != ARPOP_REQUEST) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	/*
+	 * Now that we've verified that our data is sane, see if we're doing a
+	 * gratuitous arp and if so, drop it. Otherwise, we may end up
+	 * triggering duplicate address detection.
+	 */
+	if (bcmp(ea->arp_spa, ea->arp_tpa, sizeof (ea->arp_spa)) == 0) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	bzero(&vaq->vaq_sock, sizeof (struct sockaddr_storage));
+	ip = (struct sockaddr_in *)&vaq->vaq_sock;
+	ip->sin_family = AF_INET;
+	bcopy(ea->arp_tpa, &ip->sin_addr, sizeof (ea->arp_tpa));
+
+	vaq->vaq_type = AF_INET;
+	vaq->vaq_inst = inst;
+	vaq->vaq_ea = ea;
+	vaq->vaq_query = vqh;
+	vaq->vaq_otl = otl;
+
+	if (inst->vri_plugin->vpp_ops->vpo_arp == NULL)
+		libvarpd_panic("%s plugin asked to do arp, but has no method",
+		    inst->vri_plugin->vpp_name);
+
+	inst->vri_plugin->vpp_ops->vpo_arp(inst->vri_private,
+	    (varpd_arp_handle_t *)vaq, VARPD_QTYPE_ETHERNET,
+	    (struct sockaddr *)ip, vaq->vaq_lookup);
+}
+
+static void
+libvarpd_proxy_arp_fini(varpd_arp_query_t *vaq)
+{
+	struct ether_header *ether;
+	struct sockaddr_in *ip;
+
+	ip = (struct sockaddr_in *)&vaq->vaq_sock;
+	/*
+	 * Modify our packet in place for a reply. We need to swap around the
+	 * sender and target addresses.
+	 */
+	vaq->vaq_ea->ea_hdr.ar_op = htons(ARPOP_REPLY);
+	bcopy(vaq->vaq_ea->arp_sha, vaq->vaq_ea->arp_tha, ETHERADDRL);
+	bcopy(vaq->vaq_lookup, vaq->vaq_ea->arp_sha, ETHERADDRL);
+	bcopy(vaq->vaq_ea->arp_spa, &ip->sin_addr,
+	    sizeof (vaq->vaq_ea->arp_spa));
+	bcopy(vaq->vaq_ea->arp_tpa, vaq->vaq_ea->arp_spa,
+	    sizeof (vaq->vaq_ea->arp_spa));
+	bcopy(&ip->sin_addr, vaq->vaq_ea->arp_tpa,
+	    sizeof (vaq->vaq_ea->arp_spa));
+
+	/*
+	 * Finally go ahead and fix up the mac header and reply to the sender
+	 * explicitly.
+	 */
+	ether = (struct ether_header *)vaq->vaq_buf;
+	bcopy(&ether->ether_shost, &ether->ether_dhost, ETHERADDRL);
+	bcopy(vaq->vaq_lookup, &ether->ether_shost, ETHERADDRL);
+
+	(void) libvarpd_overlay_inject(vaq->vaq_inst->vri_impl, vaq->vaq_otl,
+	    vaq->vaq_buf, vaq->vaq_bsize);
+
+	libvarpd_plugin_query_reply(vaq->vaq_query, VARPD_LOOKUP_DROP);
+	umem_free(vaq, sizeof (varpd_arp_query_t));
+}
+
+static uint16_t
+libvarpd_icmpv6_checksum(const ip6_t *v6hdr, const uint16_t *buf, uint16_t mlen)
+{
+	int i;
+	uint16_t *v;
+	uint32_t sum = 0;
+
+	assert(mlen % 2 == 0);
+	v = (uint16_t *)&v6hdr->ip6_src;
+	for (i = 0; i < sizeof (struct in6_addr); i += 2, v++)
+		sum += *v;
+	v = (uint16_t *)&v6hdr->ip6_dst;
+	for (i = 0; i < sizeof (struct in6_addr); i += 2, v++)
+		sum += *v;
+	sum += htons(mlen);
+#ifdef _BIG_ENDIAN
+	sum += IPPROTO_ICMPV6;
+#else
+	sum += IPPROTO_ICMPV6 << 8;
+#endif	/* _BIG_ENDIAN */
+
+	for (i = 0; i < mlen; i += 2, buf++)
+		sum += *buf;
+
+	while ((sum >> 16) != 0)
+		sum = (sum & 0xffff) + (sum >> 16);
+
+	return (sum & 0xffff);
+}
+
+/*
+ * Proxying NDP is much more involved than proxying ARP. For starters, NDP
+ * neighbor solicitations are implemented in terms of IPv6 ICMP as opposed to
+ * its own Ethertype. Therefore, we're going to have to grab a packet if it's a
+ * multicast packet and then determine if we actually want to do anything with
+ * it.
+ */
+void
+libvarpd_plugin_proxy_ndp(varpd_provider_handle_t *hdl,
+    varpd_query_handle_t *vqh, const overlay_targ_lookup_t *otl)
+{
+	size_t bsize, plen;
+	varpd_arp_query_t *vaq;
+	ip6_t *v6hdr;
+	nd_neighbor_solicit_t *ns;
+	nd_opt_hdr_t *opt;
+	struct sockaddr_in6 *s6;
+
+	varpd_instance_t *inst = (varpd_instance_t *)hdl;
+	uint8_t *eth = NULL;
+
+	vaq = umem_alloc(sizeof (varpd_arp_query_t), UMEM_DEFAULT);
+	if (vaq == NULL) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		return;
+	}
+	vaq->vaq_bsize = sizeof (vaq->vaq_buf);
+
+	if (otl->otl_dstaddr[0] != 0x33 ||
+	    otl->otl_dstaddr[1] != 0x33) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	/*
+	 * If we have more than a standard frame size for the ICMP neighbor
+	 * solicitation, drop it. Similarly if there isn't enough data present
+	 * for us, drop it.
+	 */
+	if (otl->otl_hdrsize + otl->otl_pktsize > vaq->vaq_bsize) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	if (otl->otl_pktsize < sizeof (ip6_t) +
+	    sizeof (nd_neighbor_solicit_t)) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	if (libvarpd_overlay_packet(inst->vri_impl, otl, vaq->vaq_buf,
+	    &vaq->vaq_bsize) != 0) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	bsize = vaq->vaq_bsize;
+	bsize -= otl->otl_hdrsize;
+	assert(bsize > sizeof (ip6_t));
+
+	v6hdr = (ip6_t *)(vaq->vaq_buf + otl->otl_hdrsize);
+	if (((v6hdr->ip6_vfc & 0xf0) >> 4) != IPV6_VERSION) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	if (v6hdr->ip6_nxt != IPPROTO_ICMPV6) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	/*
+	 * In addition to getting these requests on the multicast address for
+	 * node solicitation, we may also end up getting them on a generic
+	 * multicast address due to timeouts or other choices by various OSes.
+	 * We should fairly liberal and accept both, even though the standard
+	 * wants them to a solicitation address.
+	 */
+	if (!IN6_IS_ADDR_MC_SOLICITEDNODE(&v6hdr->ip6_dst) &&
+	    !IN6_IS_ADDR_MC_LINKLOCAL(&v6hdr->ip6_dst)) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	bsize -= sizeof (ip6_t);
+	plen = ntohs(v6hdr->ip6_plen);
+	if (bsize < plen) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	/*
+	 * Now we know that this is an ICMPv6 request targetting the right
+	 * IPv6 multicast prefix. Let's go through and verify that ICMPv6
+	 * indicates that we have the real thing and ensure that per RFC 4861
+	 * the target address is not a multicast address. Further, because this
+	 * is a multicast on Ethernet, we must have a source link-layer address.
+	 *
+	 * We should probably enforce that we have a valid ICMP checksum at some
+	 * point.
+	 */
+	ns = (nd_neighbor_solicit_t *)(vaq->vaq_buf + otl->otl_hdrsize +
+	    sizeof (ip6_t));
+	if (ns->nd_ns_type != ND_NEIGHBOR_SOLICIT && ns->nd_ns_code != 0) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	if (IN6_IS_ADDR_MULTICAST(&ns->nd_ns_target) ||
+	    IN6_IS_ADDR_V4MAPPED(&ns->nd_ns_target) ||
+	    IN6_IS_ADDR_LOOPBACK(&ns->nd_ns_target)) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	plen -= sizeof (nd_neighbor_solicit_t);
+	opt = (nd_opt_hdr_t *)(ns+1);
+	while (plen >= sizeof (struct nd_opt_hdr)) {
+		/* If we have an option with no lenght, that's clear bogus */
+		if (opt->nd_opt_len == 0) {
+			libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+			umem_free(vaq, sizeof (varpd_arp_query_t));
+			return;
+		}
+
+		if (opt->nd_opt_type == ND_OPT_SOURCE_LINKADDR) {
+			eth = (uint8_t *)((uintptr_t)opt +
+			    sizeof (nd_opt_hdr_t));
+		}
+		plen -= opt->nd_opt_len * 8;
+		opt = (nd_opt_hdr_t *)((uintptr_t)opt +
+		    opt->nd_opt_len * 8);
+	}
+
+	if (eth == NULL) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	}
+
+	bzero(&vaq->vaq_sock, sizeof (struct sockaddr_storage));
+	s6 = (struct sockaddr_in6 *)&vaq->vaq_sock;
+	s6->sin6_family = AF_INET6;
+	bcopy(&ns->nd_ns_target, &s6->sin6_addr, sizeof (s6->sin6_addr));
+
+	if (inst->vri_plugin->vpp_ops->vpo_arp == NULL)
+		libvarpd_panic("%s plugin asked to do arp, but has no method",
+		    inst->vri_plugin->vpp_name);
+
+	vaq->vaq_type = AF_INET6;
+	vaq->vaq_inst = inst;
+	vaq->vaq_ea = NULL;
+	vaq->vaq_query = vqh;
+	vaq->vaq_otl = otl;
+	vaq->vaq_ns = ns;
+	vaq->vaq_ip6 = v6hdr;
+	inst->vri_plugin->vpp_ops->vpo_arp(inst->vri_private,
+	    (varpd_arp_handle_t *)vaq,  VARPD_QTYPE_ETHERNET,
+	    (struct sockaddr *)s6, vaq->vaq_lookup);
+}
+
+static void
+libvarpd_proxy_ndp_fini(varpd_arp_query_t *vaq)
+{
+	char resp[ETHERMAX + VLAN_TAGSZ];
+	struct ether_header *ether;
+	nd_neighbor_advert_t *na;
+	nd_opt_hdr_t *opt;
+	ip6_t *v6hdr;
+	size_t roff = 0;
+
+	/*
+	 * Now we need to assemble an RA as a response. Unlike with arp, we opt
+	 * to use a new packet just to make things a bit simpler saner here.
+	 */
+	v6hdr = vaq->vaq_ip6;
+	bcopy(vaq->vaq_buf, resp, vaq->vaq_otl->otl_hdrsize);
+	ether = (struct ether_header *)resp;
+	bcopy(&ether->ether_shost, &ether->ether_dhost, ETHERADDRL);
+	bcopy(vaq->vaq_lookup, &ether->ether_shost, ETHERADDRL);
+	roff += vaq->vaq_otl->otl_hdrsize;
+	bcopy(v6hdr, resp + roff, sizeof (ip6_t));
+	v6hdr = (ip6_t *)(resp + roff);
+	bcopy(&v6hdr->ip6_src, &v6hdr->ip6_dst, sizeof (struct in6_addr));
+	bcopy(&vaq->vaq_ns->nd_ns_target, &v6hdr->ip6_src,
+	    sizeof (struct in6_addr));
+	roff += sizeof (ip6_t);
+	na = (nd_neighbor_advert_t *)(resp + roff);
+	na->nd_na_type = ND_NEIGHBOR_ADVERT;
+	na->nd_na_code = 0;
+	/*
+	 * RFC 4443 defines that we should set the checksum to zero before we
+	 * calculate the checksumat we should set the checksum to zero before we
+	 * calculate it.
+	 */
+	na->nd_na_cksum = 0;
+	/*
+	 * Nota bene, the header <netinet/icmp6.h> has already transformed this
+	 * into the appropriate host order. Don't use htonl.
+	 */
+	na->nd_na_flags_reserved = ND_NA_FLAG_SOLICITED | ND_NA_FLAG_OVERRIDE;
+	bcopy(&vaq->vaq_ns->nd_ns_target, &na->nd_na_target,
+	    sizeof (struct in6_addr));
+	roff += sizeof (nd_neighbor_advert_t);
+
+	opt = (nd_opt_hdr_t *)(resp + roff);
+	opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
+	opt->nd_opt_len = 1;
+	roff += sizeof (nd_opt_hdr_t);
+	bcopy(vaq->vaq_lookup, resp + roff, ETHERADDRL);
+	roff += ETHERADDRL;
+
+	/*
+	 * Now that we've filled in the packet, go back and compute the checksum
+	 * and fill in the IPv6 payload size.
+	 */
+	v6hdr->ip6_plen = htons(roff - sizeof (ip6_t) -
+	    vaq->vaq_otl->otl_hdrsize);
+	na->nd_na_cksum = ~libvarpd_icmpv6_checksum(v6hdr, (uint16_t *)na,
+	    ntohs(v6hdr->ip6_plen)) & 0xffff;
+
+	(void) libvarpd_overlay_inject(vaq->vaq_inst->vri_impl, vaq->vaq_otl,
+	    resp, roff);
+
+	libvarpd_plugin_query_reply(vaq->vaq_query, VARPD_LOOKUP_DROP);
+	umem_free(vaq, sizeof (varpd_arp_query_t));
+}
+
+void
+libvarpd_plugin_arp_reply(varpd_arp_handle_t *vah, int action)
+{
+	varpd_arp_query_t *vaq = (varpd_arp_query_t *)vah;
+
+	if (vaq == NULL)
+		libvarpd_panic("unknown plugin passed invalid "
+		    "varpd_arp_handle_t");
+
+	if (action == VARPD_LOOKUP_DROP) {
+		libvarpd_plugin_query_reply(vaq->vaq_query, VARPD_LOOKUP_DROP);
+		umem_free(vaq, sizeof (varpd_arp_query_t));
+		return;
+	} else if (action != VARPD_LOOKUP_OK)
+		libvarpd_panic("%s plugin returned invalid action %d",
+		    vaq->vaq_inst->vri_plugin->vpp_name, action);
+
+	switch (vaq->vaq_type) {
+	case AF_INET:
+		libvarpd_proxy_arp_fini(vaq);
+		break;
+	case AF_INET6:
+		libvarpd_proxy_ndp_fini(vaq);
+		break;
+	default:
+		libvarpd_panic("encountered unknown vaq_type: %d",
+		    vaq->vaq_type);
+	}
+}
+
+void
+libvarpd_plugin_proxy_dhcp(varpd_provider_handle_t *hdl,
+    varpd_query_handle_t *vqh, const overlay_targ_lookup_t *otl)
+{
+	varpd_dhcp_query_t *vdq;
+	struct ether_header *ether;
+	struct ip *ip;
+	struct udphdr *udp;
+	varpd_instance_t *inst = (varpd_instance_t *)hdl;
+
+	vdq = umem_alloc(sizeof (varpd_dhcp_query_t), UMEM_DEFAULT);
+	if (vdq == NULL) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		return;
+	}
+	vdq->vdq_bsize = sizeof (vdq->vdq_buf);
+
+	if (otl->otl_sap != ETHERTYPE_IP) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	if (bcmp(otl->otl_dstaddr, libvarpd_arp_bcast, ETHERADDRL) != 0) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	if (otl->otl_hdrsize + otl->otl_pktsize > vdq->vdq_bsize ||
+	    otl->otl_pktsize < sizeof (struct ip) + sizeof (struct udphdr) +
+	    sizeof (struct dhcp) ||
+	    otl->otl_hdrsize < sizeof (struct ether_header)) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	if (libvarpd_overlay_packet(inst->vri_impl, otl, vdq->vdq_buf,
+	    &vdq->vdq_bsize) != 0) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	if (vdq->vdq_bsize != otl->otl_hdrsize + otl->otl_pktsize) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	ether = (struct ether_header *)vdq->vdq_buf;
+	ip = (struct ip *)(vdq->vdq_buf + otl->otl_hdrsize);
+
+	if (ip->ip_v != IPVERSION && ip->ip_p != IPPROTO_UDP) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	if (otl->otl_hdrsize + ip->ip_hl * 4 + sizeof (struct udphdr) >
+	    vdq->vdq_bsize) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	udp = (struct udphdr *)(vdq->vdq_buf + otl->otl_hdrsize +
+	    ip->ip_hl * 4);
+
+	if (ntohs(udp->uh_sport) != IPPORT_BOOTPC ||
+	    ntohs(udp->uh_dport) != IPPORT_BOOTPS) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	}
+
+	vdq->vdq_ether = ether;
+	vdq->vdq_inst = inst;
+	vdq->vdq_query = vqh;
+	vdq->vdq_otl = otl;
+
+	if (inst->vri_plugin->vpp_ops->vpo_dhcp == NULL)
+		libvarpd_panic("%s plugin asked to do dhcp, but has no method",
+		    inst->vri_plugin->vpp_name);
+
+	inst->vri_plugin->vpp_ops->vpo_dhcp(inst->vri_private,
+	    (varpd_dhcp_handle_t *)vdq, VARPD_QTYPE_ETHERNET, otl,
+	    vdq->vdq_lookup);
+}
+
+void
+libvarpd_plugin_dhcp_reply(varpd_dhcp_handle_t *vdh, int action)
+{
+	varpd_dhcp_query_t *vdq = (varpd_dhcp_query_t *)vdh;
+
+	if (vdq == NULL)
+		libvarpd_panic("unknown plugin passed invalid "
+		    "varpd_dhcp_handle_t");
+
+	if (action == VARPD_LOOKUP_DROP) {
+		libvarpd_plugin_query_reply(vdq->vdq_query, VARPD_LOOKUP_DROP);
+		umem_free(vdq, sizeof (varpd_dhcp_query_t));
+		return;
+	} else if (action != VARPD_LOOKUP_OK)
+		libvarpd_panic("%s plugin returned invalid action %d",
+		    vdq->vdq_inst->vri_plugin->vpp_name, action);
+
+	bcopy(vdq->vdq_lookup, &vdq->vdq_ether->ether_dhost, ETHERADDRL);
+	(void) libvarpd_overlay_resend(vdq->vdq_inst->vri_impl, vdq->vdq_otl,
+	    vdq->vdq_buf, vdq->vdq_bsize);
+
+	libvarpd_plugin_query_reply(vdq->vdq_query, VARPD_LOOKUP_DROP);
+	umem_free(vdq, sizeof (varpd_dhcp_query_t));
+}
+
+/*
+ * Inject a gratuitious ARP packet to the specified mac address.
+ */
+void
+libvarpd_inject_arp(varpd_provider_handle_t *vph, const uint16_t vlan,
+    const uint8_t *srcmac, const struct in_addr *srcip, const uint8_t *dstmac)
+{
+	char buf[500];
+	size_t bsize = 0;
+	struct ether_arp *ea;
+	varpd_instance_t *inst = (varpd_instance_t *)vph;
+
+	if (vlan != 0) {
+		struct ether_vlan_header *eh;
+		eh = (struct ether_vlan_header *)(buf + bsize);
+		bsize += sizeof (struct ether_vlan_header);
+		bcopy(dstmac, &eh->ether_dhost, ETHERADDRL);
+		bcopy(srcmac, &eh->ether_shost, ETHERADDRL);
+		eh->ether_tpid = htons(ETHERTYPE_VLAN);
+		eh->ether_tci = htons(VLAN_TCI(0, ETHER_CFI, vlan));
+		eh->ether_type = htons(ETHERTYPE_ARP);
+	} else {
+		struct ether_header *eh;
+		eh = (struct ether_header *)(buf + bsize);
+		bsize += sizeof (struct ether_header);
+		bcopy(dstmac, &eh->ether_dhost, ETHERADDRL);
+		bcopy(srcmac, &eh->ether_shost, ETHERADDRL);
+		eh->ether_type = htons(ETHERTYPE_ARP);
+	}
+
+	ea = (struct ether_arp *)(buf + bsize);
+	bsize += sizeof (struct ether_arp);
+	ea->ea_hdr.ar_hrd = htons(ARPHRD_ETHER);
+	ea->ea_hdr.ar_pro = htons(ETHERTYPE_IP);
+	ea->ea_hdr.ar_hln = ETHERADDRL;
+	ea->ea_hdr.ar_pln = sizeof (struct in_addr);
+	ea->ea_hdr.ar_op = htons(ARPOP_REQUEST);
+	bcopy(srcmac, ea->arp_sha, ETHERADDRL);
+	bcopy(srcip, ea->arp_spa, sizeof (struct in_addr));
+	bcopy(libvarpd_arp_bcast, ea->arp_tha, ETHERADDRL);
+	bcopy(srcip, ea->arp_tpa, sizeof (struct in_addr));
+
+	(void) libvarpd_overlay_instance_inject(inst, buf, bsize);
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_client.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_client.c
new file mode 100644
index 0000000000..b0fa907386
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_client.c
@@ -0,0 +1,626 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * varpd client interfaces
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <umem.h>
+#include <unistd.h>
+#include <string.h>
+#include <strings.h>
+#include <door.h>
+
+#include <libvarpd_impl.h>
+
+typedef struct varpd_client {
+	int vcl_doorfd;
+} varpd_client_t;
+
+typedef struct varpd_client_prop_info {
+	varpd_client_t		*vcprop_client;
+	uint64_t		vcprop_instance;
+	uint_t			vcprop_propid;
+	uint_t			vcprop_type;
+	uint_t			vcprop_prot;
+	uint32_t		vcprop_defsize;
+	uint32_t		vcprop_psize;
+	char			vcprop_name[LIBVARPD_PROP_NAMELEN];
+	uint8_t			vcprop_default[LIBVARPD_PROP_SIZEMAX];
+	uint8_t			vcprop_poss[LIBVARPD_PROP_SIZEMAX];
+} varpd_client_prop_info_t;
+
+static int
+libvarpd_c_door_call(varpd_client_t *client, varpd_client_arg_t *argp,
+    size_t altsize)
+{
+	int ret;
+	door_arg_t darg;
+
+	darg.data_ptr = (char *)argp;
+	darg.desc_ptr = NULL;
+	darg.desc_num = 0;
+	darg.rbuf = (char *)argp;
+	if (altsize != 0) {
+		darg.data_size = altsize;
+		darg.rsize = altsize;
+	} else {
+		darg.data_size = sizeof (varpd_client_arg_t);
+		darg.rsize = sizeof (varpd_client_arg_t);
+	}
+
+	do {
+		ret = door_call(client->vcl_doorfd, &darg);
+	} while (ret != 0 && errno == EINTR);
+	if (ret != 0) {
+		switch (errno) {
+		case E2BIG:
+		case EFAULT:
+		case EINVAL:
+		case ENOTSUP:
+		case EOVERFLOW:
+		case ENFILE:
+			libvarpd_panic("unhandalable errno from door_call: %d",
+			    errno);
+		}
+		ret = errno;
+	}
+
+	return (ret);
+}
+
+int
+libvarpd_c_create(varpd_client_handle_t **chpp, const char *doorname)
+{
+	varpd_client_t *client;
+
+	client = umem_alloc(sizeof (varpd_client_t), UMEM_DEFAULT);
+	if (client == NULL)
+		return (ENOMEM);
+
+	client->vcl_doorfd = open(doorname, O_RDWR);
+	if (client->vcl_doorfd < 0) {
+		int ret = errno;
+		umem_free(client, sizeof (varpd_client_t));
+		return (ret);
+	}
+
+	*chpp = (varpd_client_handle_t *)client;
+	return (0);
+}
+
+void
+libvarpd_c_destroy(varpd_client_handle_t *chp)
+{
+	varpd_client_t *client = (varpd_client_t *)chp;
+	if (close(client->vcl_doorfd) != 0)
+		libvarpd_panic("failed to close door fd %d: %d",
+		    client->vcl_doorfd, errno);
+
+	umem_free(chp, sizeof (varpd_client_handle_t *));
+}
+
+int
+libvarpd_c_instance_create(varpd_client_handle_t *chp, datalink_id_t linkid,
+    const char *search, uint64_t *cidp)
+{
+	int ret;
+	varpd_client_t *client = (varpd_client_t *)chp;
+	varpd_client_arg_t carg;
+	varpd_client_create_arg_t *cap = &carg.vca_un.vca_create;
+
+	if (strlen(search) >= LIBVARPD_PROP_NAMELEN)
+		return (EINVAL);
+	carg.vca_command = VARPD_CLIENT_CREATE;
+	carg.vca_errno = 0;
+	cap->vcca_linkid = linkid;
+	(void) strlcpy(cap->vcca_plugin, search, LIBVARPD_PROP_NAMELEN);
+
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	*cidp = cap->vcca_id;
+
+	return (0);
+}
+
+int
+libvarpd_c_instance_activate(varpd_client_handle_t *chp, uint64_t cid)
+{
+	int ret;
+	varpd_client_t *client = (varpd_client_t *)chp;
+	varpd_client_arg_t carg;
+	varpd_client_instance_arg_t *vciap = &carg.vca_un.vca_instance;
+
+	carg.vca_command = VARPD_CLIENT_ACTIVATE;
+	carg.vca_errno = 0;
+	vciap->vcia_id = cid;
+
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	return (0);
+}
+
+int
+libvarpd_c_instance_destroy(varpd_client_handle_t *chp, uint64_t cid)
+{
+	int ret;
+	varpd_client_t *client = (varpd_client_t *)chp;
+	varpd_client_arg_t carg;
+	varpd_client_instance_arg_t *vciap = &carg.vca_un.vca_instance;
+
+	carg.vca_command = VARPD_CLIENT_DESTROY;
+	carg.vca_errno = 0;
+	vciap->vcia_id = cid;
+
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	return (0);
+}
+
+int
+libvarpd_c_prop_nprops(varpd_client_handle_t *chp, uint64_t cid, uint_t *nprops)
+{
+	int ret;
+	varpd_client_t *client = (varpd_client_t *)chp;
+	varpd_client_arg_t carg;
+	varpd_client_nprops_arg_t *vcnap = &carg.vca_un.vca_nprops;
+
+	carg.vca_command = VARPD_CLIENT_NPROPS;
+	carg.vca_errno = 0;
+	vcnap->vcna_id = cid;
+	vcnap->vcna_nprops = 0;
+
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+	*nprops = vcnap->vcna_nprops;
+	return (0);
+}
+
+int
+libvarpd_c_prop_handle_alloc(varpd_client_handle_t *chp, uint64_t cid,
+    varpd_client_prop_handle_t **phdlp)
+{
+	varpd_client_prop_info_t *infop;
+
+	infop = umem_alloc(sizeof (varpd_client_prop_info_t), UMEM_DEFAULT);
+	if (infop == NULL)
+		return (ENOMEM);
+
+	bzero(infop, sizeof (varpd_client_prop_info_t));
+	infop->vcprop_client = (varpd_client_t *)chp;
+	infop->vcprop_instance = cid;
+	infop->vcprop_propid = UINT_MAX;
+	*phdlp = (varpd_client_prop_handle_t *)infop;
+	return (0);
+}
+
+void
+libvarpd_c_prop_handle_free(varpd_client_prop_handle_t *phdl)
+{
+	umem_free(phdl, sizeof (varpd_client_prop_info_t));
+	phdl = NULL;
+}
+
+static void
+libvarpd_c_prop_info_from_door(varpd_client_prop_info_t *infop,
+    const varpd_client_propinfo_arg_t *vcfap)
+{
+	infop->vcprop_propid = vcfap->vcfa_propid;
+	infop->vcprop_type = vcfap->vcfa_type;
+	infop->vcprop_prot = vcfap->vcfa_prot;
+	infop->vcprop_defsize = vcfap->vcfa_defsize;
+	infop->vcprop_psize = vcfap->vcfa_psize;
+	bcopy(vcfap->vcfa_name, infop->vcprop_name, LIBVARPD_PROP_NAMELEN);
+	bcopy(vcfap->vcfa_default, infop->vcprop_default,
+	    LIBVARPD_PROP_SIZEMAX);
+	bcopy(vcfap->vcfa_poss, infop->vcprop_poss, LIBVARPD_PROP_SIZEMAX);
+}
+
+int
+libvarpd_c_prop_info_fill_by_name(varpd_client_prop_handle_t *phdl,
+    const char *name)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_propinfo_arg_t *vcfap = &carg.vca_un.vca_info;
+	varpd_client_prop_info_t *infop = (varpd_client_prop_info_t *)phdl;
+
+	if (strlen(name) >= LIBVARPD_PROP_NAMELEN)
+		return (EINVAL);
+	bzero(&carg, sizeof (varpd_client_arg_t));
+	carg.vca_command = VARPD_CLIENT_PROPINFO;
+	carg.vca_errno = 0;
+	vcfap->vcfa_id = infop->vcprop_instance;
+	vcfap->vcfa_propid = UINT_MAX;
+	(void) strlcpy(vcfap->vcfa_name, name, LIBVARPD_PROP_NAMELEN);
+
+	ret = libvarpd_c_door_call(infop->vcprop_client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	libvarpd_c_prop_info_from_door(infop, vcfap);
+	return (0);
+}
+
+int
+libvarpd_c_prop_info_fill(varpd_client_prop_handle_t *phdl, uint_t propid)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_propinfo_arg_t *vcfap = &carg.vca_un.vca_info;
+	varpd_client_prop_info_t *infop = (varpd_client_prop_info_t *)phdl;
+
+	bzero(&carg, sizeof (varpd_client_arg_t));
+	carg.vca_command = VARPD_CLIENT_PROPINFO;
+	carg.vca_errno = 0;
+	vcfap->vcfa_id = infop->vcprop_instance;
+	vcfap->vcfa_propid = propid;
+
+	ret = libvarpd_c_door_call(infop->vcprop_client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	libvarpd_c_prop_info_from_door(infop, vcfap);
+	return (0);
+}
+
+int
+libvarpd_c_prop_info(varpd_client_prop_handle_t *phdl, const char **namep,
+    uint_t *typep, uint_t *protp, const void **defp, uint32_t *defsizep,
+    const mac_propval_range_t **possp)
+{
+	varpd_client_prop_info_t *infop = (varpd_client_prop_info_t *)phdl;
+	if (infop->vcprop_propid == UINT_MAX)
+		return (EINVAL);
+
+	if (namep != NULL)
+		*namep = infop->vcprop_name;
+	if (typep != NULL)
+		*typep = infop->vcprop_type;
+	if (protp != NULL)
+		*protp = infop->vcprop_prot;
+	if (defp != NULL)
+		*defp = infop->vcprop_default;
+	if (defsizep != NULL)
+		*defsizep = infop->vcprop_defsize;
+	if (possp != NULL)
+		*possp = (const mac_propval_range_t *)infop->vcprop_poss;
+	return (0);
+}
+
+int
+libvarpd_c_prop_get(varpd_client_prop_handle_t *phdl, void *buf, uint32_t *len)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_prop_arg_t *vcpap = &carg.vca_un.vca_prop;
+	varpd_client_prop_info_t *infop = (varpd_client_prop_info_t *)phdl;
+
+	if (len == NULL || buf == NULL || infop->vcprop_propid == UINT_MAX)
+		return (EINVAL);
+	if (*len < LIBVARPD_PROP_SIZEMAX)
+		return (EOVERFLOW);
+
+	bzero(&carg, sizeof (varpd_client_arg_t));
+	carg.vca_command = VARPD_CLIENT_GETPROP;
+	carg.vca_errno = 0;
+	vcpap->vcpa_id = infop->vcprop_instance;
+	vcpap->vcpa_propid = infop->vcprop_propid;
+
+	ret = libvarpd_c_door_call(infop->vcprop_client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	/*
+	 * If the buffer size is too large then something odd has certainly
+	 * happened here, it means that varpd has gone rogue. In such a case we
+	 * return a rather odd errror, though we don't believe that this should
+	 * generally happen.
+	 */
+	if (vcpap->vcpa_bufsize > LIBVARPD_PROP_SIZEMAX)
+		return (E2BIG);
+
+	bcopy(vcpap->vcpa_buf, buf, vcpap->vcpa_bufsize);
+	*len = vcpap->vcpa_bufsize;
+	return (0);
+}
+
+int
+libvarpd_c_prop_set(varpd_client_prop_handle_t *phdl, const void *buf,
+    uint32_t len)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_prop_arg_t *vcpap = &carg.vca_un.vca_prop;
+	varpd_client_prop_info_t *infop = (varpd_client_prop_info_t *)phdl;
+
+	if (len == NULL || buf == NULL || infop->vcprop_propid == UINT_MAX)
+		return (EINVAL);
+	if (len > LIBVARPD_PROP_SIZEMAX)
+		return (EOVERFLOW);
+
+	carg.vca_command = VARPD_CLIENT_SETPROP;
+	carg.vca_errno = 0;
+	vcpap->vcpa_id = infop->vcprop_instance;
+	vcpap->vcpa_propid = infop->vcprop_propid;
+	vcpap->vcpa_bufsize = len;
+	bcopy(buf, vcpap->vcpa_buf, len);
+
+	ret = libvarpd_c_door_call(infop->vcprop_client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	return (0);
+}
+
+int
+libvarpd_c_instance_lookup(varpd_client_handle_t *chp, datalink_id_t linkid,
+    uint64_t *instp)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_lookup_arg_t *vclap = &carg.vca_un.vca_lookup;
+	varpd_client_t *client = (varpd_client_t *)chp;
+
+	carg.vca_command = VARPD_CLIENT_LOOKUP;
+	carg.vca_errno = 0;
+	vclap->vcla_linkid = linkid;
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+	if (instp != NULL)
+		*instp = vclap->vcla_id;
+
+	return (0);
+}
+
+int
+libvarpd_c_instance_target_mode(varpd_client_handle_t *chp, uint64_t cid,
+    uint_t *dtype, uint_t *mtype)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_target_mode_arg_t *vctmap = &carg.vca_un.vca_mode;
+	varpd_client_t *client = (varpd_client_t *)chp;
+
+	carg.vca_command = VARPD_CLIENT_TARGET_MODE;
+	carg.vca_errno = 0;
+	vctmap->vtma_id = cid;
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+	if (ret == 0) {
+		if (mtype != NULL)
+			*mtype = vctmap->vtma_mode;
+		if (dtype != NULL)
+			*dtype = vctmap->vtma_dest;
+	}
+
+	return (ret);
+}
+
+int
+libvarpd_c_instance_cache_flush(varpd_client_handle_t *chp, uint64_t cid)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_target_cache_arg_t *vctcap = &carg.vca_un.vca_cache;
+	varpd_client_t *client = (varpd_client_t *)chp;
+
+	carg.vca_command = VARPD_CLIENT_CACHE_FLUSH;
+	carg.vca_errno = 0;
+
+	vctcap->vtca_id = cid;
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	return (0);
+}
+
+int
+libvarpd_c_instance_cache_delete(varpd_client_handle_t *chp, uint64_t cid,
+    const struct ether_addr *key)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_target_cache_arg_t *vctcap = &carg.vca_un.vca_cache;
+	varpd_client_t *client = (varpd_client_t *)chp;
+
+	if (key == NULL)
+		return (EINVAL);
+
+	carg.vca_command = VARPD_CLIENT_CACHE_DELETE;
+	carg.vca_errno = 0;
+	vctcap->vtca_id = cid;
+	bcopy(key, vctcap->vtca_key, ETHERADDRL);
+
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	return (0);
+}
+
+int
+libvarpd_c_instance_cache_get(varpd_client_handle_t *chp, uint64_t cid,
+    const struct ether_addr *key, varpd_client_cache_entry_t *entry)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_target_cache_arg_t *vctcap = &carg.vca_un.vca_cache;
+	varpd_client_t *client = (varpd_client_t *)chp;
+
+	if (key == NULL || entry == NULL)
+		return (EINVAL);
+
+	carg.vca_command = VARPD_CLIENT_CACHE_GET;
+	carg.vca_errno = 0;
+	vctcap->vtca_id = cid;
+	bcopy(key, vctcap->vtca_key, ETHERADDRL);
+	bzero(&vctcap->vtca_entry, sizeof (varpd_client_cache_entry_t));
+
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	bcopy(&vctcap->vtca_entry, entry, sizeof (varpd_client_cache_entry_t));
+	return (0);
+}
+
+int
+libvarpd_c_instance_cache_set(varpd_client_handle_t *chp, uint64_t cid,
+    const struct ether_addr *key, const varpd_client_cache_entry_t *entry)
+{
+	int ret;
+	varpd_client_arg_t carg;
+	varpd_client_target_cache_arg_t *vctcap = &carg.vca_un.vca_cache;
+	varpd_client_t *client = (varpd_client_t *)chp;
+
+	if (key == NULL || entry == NULL)
+		return (EINVAL);
+
+	carg.vca_command = VARPD_CLIENT_CACHE_SET;
+	carg.vca_errno = 0;
+	vctcap->vtca_id = cid;
+	bcopy(key, vctcap->vtca_key, ETHERADDRL);
+	bcopy(entry, &vctcap->vtca_entry, sizeof (varpd_client_cache_entry_t));
+
+	ret = libvarpd_c_door_call(client, &carg, 0);
+	if (ret != 0)
+		return (ret);
+
+	if (carg.vca_errno != 0)
+		return (carg.vca_errno);
+
+	return (0);
+}
+
+int
+libvarpd_c_instance_cache_walk(varpd_client_handle_t *chp, uint64_t cid,
+    varpd_client_cache_f func, void *arg)
+{
+	int ret = 0;
+	size_t bufsize = sizeof (varpd_client_arg_t) +
+	    100 * sizeof (varpd_client_cache_entry_t);
+	varpd_client_t *client = (varpd_client_t *)chp;
+	varpd_client_arg_t *cargp;
+	varpd_client_target_walk_arg_t *vctwap;
+
+	/*
+	 * Because the number of entries involved in a walk may be large, we
+	 * dynamically allocate a number of queries to make at a single time.
+	 * This also means that the average door request doesn't inflate by the
+	 * number of entries we want. For now, let's always grab 100 entries in
+	 * a request.
+	 */
+	cargp = umem_zalloc(bufsize, UMEM_DEFAULT);
+	if (cargp == NULL)
+		return (errno);
+	vctwap = &cargp->vca_un.vca_walk;
+	for (;;) {
+		int i;
+
+		cargp->vca_command = VARPD_CLIENT_CACHE_WALK;
+		cargp->vca_errno = 0;
+		vctwap->vtcw_id = cid;
+		vctwap->vtcw_count = 100;
+
+		ret = libvarpd_c_door_call(client, cargp, bufsize);
+		if (ret != 0)
+			break;
+
+		if (cargp->vca_errno != 0) {
+			ret = cargp->vca_errno;
+			break;
+		}
+
+		if (vctwap->vtcw_count == 0) {
+			ret = 0;
+			break;
+		}
+
+		for (i = 0; i < vctwap->vtcw_count; i++) {
+			varpd_client_cache_entry_t ent;
+
+			ent.vcp_flags = vctwap->vtcw_ents[i].otce_flags;
+			bcopy(vctwap->vtcw_ents[i].otce_dest.otp_mac,
+			    &ent.vcp_mac, ETHERADDRL);
+			ent.vcp_ip = vctwap->vtcw_ents[i].otce_dest.otp_ip;
+			ent.vcp_port = vctwap->vtcw_ents[i].otce_dest.otp_port;
+			ret = func(chp, cid,
+			    (struct ether_addr *)vctwap->vtcw_ents[i].otce_mac,
+			    &ent, arg);
+			if (ret != 0) {
+				ret = 0;
+				goto done;
+			}
+		}
+	}
+
+done:
+	umem_free(cargp, bufsize);
+	return (ret);
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_client.h b/usr/src/lib/varpd/libvarpd/common/libvarpd_client.h
new file mode 100644
index 0000000000..459711b385
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_client.h
@@ -0,0 +1,92 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBVARPD_CLIENT_H
+#define	_LIBVARPD_CLIENT_H
+
+/*
+ * varpd interfaces
+ */
+
+#include <sys/types.h>
+#include <stdint.h>
+#include <sys/mac.h>
+#include <sys/overlay_target.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct __varpd_client_handle varpd_client_handle_t;
+typedef struct __varpd_client_prop_handle varpd_client_prop_handle_t;
+
+typedef struct varpd_client_cache_entry {
+	struct ether_addr	vcp_mac;
+	uint16_t		vcp_flags;
+	struct in6_addr		vcp_ip;
+	uint16_t		vcp_port;
+} varpd_client_cache_entry_t;
+
+/*
+ * We just use the values from the kernel for now.
+ */
+#define	LIBVARPD_PROP_SIZEMAX	OVERLAY_PROP_SIZEMAX
+#define	LIBVARPD_PROP_NAMELEN	OVERLAY_PROP_NAMELEN
+
+extern int libvarpd_c_create(varpd_client_handle_t **, const char *);
+extern void libvarpd_c_destroy(varpd_client_handle_t *);
+extern int libvarpd_c_instance_create(varpd_client_handle_t *, datalink_id_t,
+    const char *, uint64_t *);
+extern int libvarpd_c_instance_activate(varpd_client_handle_t *, uint64_t);
+extern int libvarpd_c_instance_destroy(varpd_client_handle_t *, uint64_t);
+
+extern int libvarpd_c_prop_nprops(varpd_client_handle_t *, uint64_t, uint_t *);
+extern int libvarpd_c_prop_handle_alloc(varpd_client_handle_t *, uint64_t,
+    varpd_client_prop_handle_t **);
+extern void libvarpd_c_prop_handle_free(varpd_client_prop_handle_t *);
+extern int libvarpd_c_prop_info_fill(varpd_client_prop_handle_t *, uint_t);
+extern int libvarpd_c_prop_info_fill_by_name(varpd_client_prop_handle_t *,
+    const char *);
+extern int libvarpd_c_prop_info(varpd_client_prop_handle_t *, const char **,
+    uint_t *, uint_t *, const void **, uint32_t *,
+    const mac_propval_range_t **);
+extern int libvarpd_c_prop_get(varpd_client_prop_handle_t *, void *,
+    uint32_t *);
+extern int libvarpd_c_prop_set(varpd_client_prop_handle_t *, const void *,
+    uint32_t);
+
+extern int libvarpd_c_instance_lookup(varpd_client_handle_t *, datalink_id_t,
+    uint64_t *);
+extern int libvarpd_c_instance_target_mode(varpd_client_handle_t *, uint64_t,
+    uint_t *, uint_t *);
+extern int libvarpd_c_instance_cache_flush(varpd_client_handle_t *, uint64_t);
+extern int libvarpd_c_instance_cache_delete(varpd_client_handle_t *, uint64_t,
+    const struct ether_addr *);
+extern int libvarpd_c_instance_cache_get(varpd_client_handle_t *, uint64_t,
+    const struct ether_addr *, varpd_client_cache_entry_t *);
+extern int libvarpd_c_instance_cache_set(varpd_client_handle_t *, uint64_t,
+    const struct ether_addr *, const varpd_client_cache_entry_t *);
+
+typedef int (*varpd_client_cache_f)(varpd_client_handle_t *, uint64_t,
+    const struct ether_addr *, const varpd_client_cache_entry_t *, void *);
+extern int libvarpd_c_instance_cache_walk(varpd_client_handle_t *, uint64_t,
+    varpd_client_cache_f, void *);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBVARPD_CLIENT_H */
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_door.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_door.c
new file mode 100644
index 0000000000..f684e031a8
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_door.c
@@ -0,0 +1,469 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * varpd door server logic
+ */
+
+#include <door.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <priv.h>
+#include <libvarpd_impl.h>
+
+typedef int (libvarpd_door_f)(varpd_impl_t *, varpd_client_arg_t *, ucred_t *);
+
+static boolean_t
+libvarpd_door_privileged(ucred_t *credp)
+{
+	const priv_set_t *ps;
+
+	ps = ucred_getprivset(credp, PRIV_EFFECTIVE);
+	if (ps == NULL)
+		return (B_FALSE);
+
+	return (priv_ismember(ps, PRIV_SYS_NET_CONFIG));
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_create(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	int ret;
+	varpd_instance_handle_t *ihdl;
+	varpd_client_create_arg_t *vccap = &vcap->vca_un.vca_create;
+
+	vccap->vcca_plugin[LIBVARPD_PROP_NAMELEN-1] = '\0';
+	ret = libvarpd_instance_create((varpd_handle_t *)vip,
+	    vccap->vcca_linkid, vccap->vcca_plugin, &ihdl);
+	if (ret == 0)
+		vccap->vcca_id = libvarpd_instance_id(ihdl);
+
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_activate(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_instance_arg_t *vciap = &vcap->vca_un.vca_instance;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vciap->vcia_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	return (libvarpd_instance_activate(ihp));
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_destroy(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_instance_arg_t *vciap = &vcap->vca_un.vca_instance;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vciap->vcia_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	libvarpd_instance_destroy(ihp);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_nprops(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_nprops_arg_t *vcnap = &vcap->vca_un.vca_nprops;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vcnap->vcna_id);
+	if (ihp == NULL)
+		return (ENOENT);
+
+	return (libvarpd_prop_nprops(ihp, &vcnap->vcna_nprops));
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_propinfo(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	int ret;
+	varpd_instance_handle_t *ihp;
+	varpd_prop_handle_t *phdl;
+	varpd_client_propinfo_arg_t *vcfap = &vcap->vca_un.vca_info;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vcfap->vcfa_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	ret = libvarpd_prop_handle_alloc((varpd_handle_t *)vip, ihp, &phdl);
+	if (ret != 0)
+		return (ret);
+
+	if (vcfap->vcfa_propid != UINT_MAX) {
+		ret = libvarpd_prop_info_fill(phdl, vcfap->vcfa_propid);
+		if (ret != 0) {
+			libvarpd_prop_handle_free(phdl);
+			return (ret);
+		}
+	} else {
+		uint_t i, nprop;
+		const char *name;
+
+		vcfap->vcfa_name[LIBVARPD_PROP_NAMELEN-1] = '\0';
+		ret = libvarpd_prop_nprops(ihp, &nprop);
+		if (ret != 0) {
+			libvarpd_prop_handle_free(phdl);
+			return (ret);
+		}
+		for (i = 0; i < nprop; i++) {
+			ret = libvarpd_prop_info_fill(phdl, i);
+			if (ret != 0) {
+				libvarpd_prop_handle_free(phdl);
+				return (ret);
+			}
+			ret = libvarpd_prop_info(phdl, &name, NULL, NULL, NULL,
+			    NULL, NULL);
+			if (ret != 0) {
+				libvarpd_prop_handle_free(phdl);
+				return (ret);
+			}
+			if (strcmp(vcfap->vcfa_name, name) == 0)
+				break;
+		}
+
+		if (i == nprop) {
+			libvarpd_prop_handle_free(phdl);
+			return (ENOENT);
+		}
+		vcfap->vcfa_propid = i;
+	}
+	libvarpd_prop_door_convert(phdl, vcfap);
+	libvarpd_prop_handle_free(phdl);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_getprop(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	int ret;
+	uint32_t size;
+	varpd_instance_handle_t *ihp;
+	varpd_prop_handle_t *phdl;
+	varpd_client_prop_arg_t *vcpap = &vcap->vca_un.vca_prop;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vcpap->vcpa_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	ret = libvarpd_prop_handle_alloc((varpd_handle_t *)vip, ihp, &phdl);
+	if (ret != 0)
+		return (ret);
+
+	ret = libvarpd_prop_info_fill(phdl, vcpap->vcpa_propid);
+	if (ret != 0) {
+		libvarpd_prop_handle_free(phdl);
+		return (ret);
+	}
+
+	ret = libvarpd_prop_get(phdl, vcpap->vcpa_buf, &size);
+	if (ret == 0)
+		vcpap->vcpa_bufsize = size;
+	libvarpd_prop_handle_free(phdl);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_setprop(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	int ret;
+	varpd_instance_handle_t *ihp;
+	varpd_prop_handle_t *phdl;
+	varpd_client_prop_arg_t *vcpap = &vcap->vca_un.vca_prop;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vcpap->vcpa_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	ret = libvarpd_prop_handle_alloc((varpd_handle_t *)vip, ihp, &phdl);
+	if (ret != 0)
+		return (ret);
+
+	ret = libvarpd_prop_info_fill(phdl, vcpap->vcpa_propid);
+	if (ret != 0) {
+		libvarpd_prop_handle_free(phdl);
+		return (ret);
+	}
+
+	ret = libvarpd_prop_set(phdl, vcpap->vcpa_buf, vcpap->vcpa_bufsize);
+	libvarpd_prop_handle_free(phdl);
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_lookup(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_t *inst;
+	varpd_client_lookup_arg_t *vclap = &vcap->vca_un.vca_lookup;
+
+	inst = libvarpd_instance_lookup_by_dlid(vip, vclap->vcla_linkid);
+	if (inst == NULL)
+		return (ENOENT);
+
+	vclap->vcla_id = inst->vri_id;
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_target(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_instance_t *inst;
+	varpd_client_target_mode_arg_t *vtmap = &vcap->vca_un.vca_mode;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vtmap->vtma_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	inst = (varpd_instance_t *)ihp;
+	vtmap->vtma_dest = inst->vri_dest;
+	vtmap->vtma_mode = inst->vri_mode;
+	return (0);
+}
+
+static int
+libvarpd_door_f_flush(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_target_cache_arg_t *vtcap = &vcap->vca_un.vca_cache;
+
+	if (libvarpd_door_privileged(credp) == B_FALSE)
+		return (EPERM);
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vtcap->vtca_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	return (libvarpd_overlay_cache_flush((varpd_instance_t *)ihp));
+}
+
+static int
+libvarpd_door_f_delete(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_target_cache_arg_t *vtcap = &vcap->vca_un.vca_cache;
+
+	if (libvarpd_door_privileged(credp) == B_FALSE)
+		return (EPERM);
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vtcap->vtca_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	return (libvarpd_overlay_cache_delete((varpd_instance_t *)ihp,
+	    vtcap->vtca_key));
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_get(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_target_cache_arg_t *vtcap = &vcap->vca_un.vca_cache;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vtcap->vtca_id);
+	if (ihp == NULL)
+		return (ENOENT);
+	return (libvarpd_overlay_cache_get((varpd_instance_t *)ihp,
+	    vtcap->vtca_key, &vtcap->vtca_entry));
+}
+
+static int
+libvarpd_door_f_set(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_target_cache_arg_t *vtcap = &vcap->vca_un.vca_cache;
+
+	if (libvarpd_door_privileged(credp) == B_FALSE)
+		return (EPERM);
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vtcap->vtca_id);
+	if (ihp == NULL)
+		return (ENOENT);
+
+	return (libvarpd_overlay_cache_set((varpd_instance_t *)ihp,
+	    vtcap->vtca_key, &vtcap->vtca_entry));
+}
+
+/* ARGSUSED */
+static int
+libvarpd_door_f_walk(varpd_impl_t *vip, varpd_client_arg_t *vcap,
+    ucred_t *credp)
+{
+	varpd_instance_handle_t *ihp;
+	varpd_client_target_walk_arg_t *vctwp = &vcap->vca_un.vca_walk;
+
+	ihp = libvarpd_instance_lookup((varpd_handle_t *)vip, vctwp->vtcw_id);
+	if (ihp == NULL)
+		return (ENOENT);
+
+	return (libvarpd_overlay_cache_walk_fill((varpd_instance_t *)ihp,
+	    &vctwp->vtcw_marker, &vctwp->vtcw_count, vctwp->vtcw_ents));
+}
+
+static libvarpd_door_f *libvarpd_door_table[] = {
+	libvarpd_door_f_create,
+	libvarpd_door_f_activate,
+	libvarpd_door_f_destroy,
+	libvarpd_door_f_nprops,
+	libvarpd_door_f_propinfo,
+	libvarpd_door_f_getprop,
+	libvarpd_door_f_setprop,
+	libvarpd_door_f_lookup,
+	libvarpd_door_f_target,
+	libvarpd_door_f_flush,
+	libvarpd_door_f_delete,
+	libvarpd_door_f_get,
+	libvarpd_door_f_set,
+	libvarpd_door_f_walk
+};
+
+/* ARGSUSED */
+static void
+libvarpd_door_server(void *cookie, char *argp, size_t argsz, door_desc_t *dp,
+    uint_t ndesc)
+{
+	int ret;
+	varpd_client_eresp_t err;
+	ucred_t *credp = NULL;
+	varpd_impl_t *vip = cookie;
+	varpd_client_arg_t *vcap = (varpd_client_arg_t *)argp;
+
+	err.vce_command = VARPD_CLIENT_INVALID;
+	if (argsz < sizeof (varpd_client_arg_t)) {
+		err.vce_errno = EINVAL;
+		goto errout;
+	}
+
+	if ((ret = door_ucred(&credp)) != 0) {
+		err.vce_errno = ret;
+		goto errout;
+	}
+
+	if (vcap->vca_command == VARPD_CLIENT_INVALID ||
+	    vcap->vca_command >= VARPD_CLIENT_MAX) {
+		err.vce_errno = EINVAL;
+		goto errout;
+	}
+
+	vcap->vca_errno = 0;
+	ret = libvarpd_door_table[vcap->vca_command - 1](vip, vcap, credp);
+	if (ret != 0)
+		vcap->vca_errno = ret;
+
+	ucred_free(credp);
+	(void) door_return(argp, argsz, NULL, 0);
+	return;
+
+errout:
+	ucred_free(credp);
+	(void) door_return((char *)&err, sizeof (err), NULL, 0);
+}
+
+int
+libvarpd_door_server_create(varpd_handle_t *vhp, const char *path)
+{
+	int fd, ret;
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	mutex_enter(&vip->vdi_lock);
+	if (vip->vdi_doorfd >= 0) {
+		mutex_exit(&vip->vdi_lock);
+		return (EEXIST);
+	}
+
+	vip->vdi_doorfd = door_create(libvarpd_door_server, vip,
+	    DOOR_REFUSE_DESC | DOOR_NO_CANCEL);
+	if (vip->vdi_doorfd == -1) {
+		mutex_exit(&vip->vdi_lock);
+		return (errno);
+	}
+
+	if ((fd = open(path, O_CREAT | O_RDWR, 0666)) == -1) {
+		ret = errno;
+		if (door_revoke(vip->vdi_doorfd) != 0)
+			libvarpd_panic("failed to revoke door: %d",
+			    errno);
+		mutex_exit(&vip->vdi_lock);
+		return (errno);
+	}
+
+	if (fchown(fd, UID_NETADM, GID_NETADM) != 0) {
+		ret = errno;
+		if (door_revoke(vip->vdi_doorfd) != 0)
+			libvarpd_panic("failed to revoke door: %d",
+			    errno);
+		mutex_exit(&vip->vdi_lock);
+		return (ret);
+	}
+
+	if (close(fd) != 0)
+		libvarpd_panic("failed to close door fd %d: %d",
+		    fd, errno);
+	(void) fdetach(path);
+	if (fattach(vip->vdi_doorfd, path) != 0) {
+		ret = errno;
+		if (door_revoke(vip->vdi_doorfd) != 0)
+			libvarpd_panic("failed to revoke door: %d",
+			    errno);
+		mutex_exit(&vip->vdi_lock);
+		return (ret);
+	}
+
+	mutex_exit(&vip->vdi_lock);
+	return (0);
+}
+
+void
+libvarpd_door_server_destroy(varpd_handle_t *vhp)
+{
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	mutex_enter(&vip->vdi_lock);
+	if (vip->vdi_doorfd != 0) {
+		if (door_revoke(vip->vdi_doorfd) != 0)
+			libvarpd_panic("failed to revoke door: %d",
+			    errno);
+		vip->vdi_doorfd = -1;
+	}
+	mutex_exit(&vip->vdi_lock);
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_impl.h b/usr/src/lib/varpd/libvarpd/common/libvarpd_impl.h
new file mode 100644
index 0000000000..60f0dc5fff
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_impl.h
@@ -0,0 +1,249 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBVARPD_IMPL_H
+#define	_LIBVARPD_IMPL_H
+
+/*
+ * varpd internal interfaces
+ */
+
+#include <libvarpd.h>
+#include <libvarpd_provider.h>
+#include <sys/avl.h>
+#include <thread.h>
+#include <synch.h>
+#include <limits.h>
+#include <libidspace.h>
+#include <umem.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	LIBVARPD_ID_MIN	1
+#define	LIBVARPD_ID_MAX	INT32_MAX
+
+typedef struct varpd_plugin {
+	avl_node_t		vpp_node;
+	const char		*vpp_name;
+	overlay_target_mode_t	vpp_mode;
+	const varpd_plugin_ops_t *vpp_ops;
+	mutex_t			vpp_lock;
+	uint_t			vpp_active;
+} varpd_plugin_t;
+
+typedef struct varpd_impl {
+	mutex_t		vdi_lock;
+	rwlock_t	vdi_pfdlock;
+	avl_tree_t	vdi_plugins;	/* vdi_lock */
+	avl_tree_t	vdi_instances;	/* vdi_lock */
+	avl_tree_t	vdi_linstances;	/* vdi_lock */
+	id_space_t	*vdi_idspace;	/* RO */
+	umem_cache_t	*vdi_qcache;	/* RO */
+	bunyan_logger_t	*vdi_bunyan;	/* RO */
+	int		vdi_overlayfd;	/* RO */
+	int		vdi_doorfd;	/* vdi_lock */
+	int		vdi_persistfd;	/* vdi_plock */
+	cond_t		vdi_lthr_cv;	/* vdi_lock */
+	boolean_t	vdi_lthr_quiesce;	/* vdi_lock */
+	uint_t		vdi_lthr_count;	/* vdi_lock */
+} varpd_impl_t;
+
+typedef enum varpd_instance_flags {
+	VARPD_INSTANCE_F_ACTIVATED = 0x01
+} varpd_instance_flags_t;
+
+typedef struct varpd_instance {
+	avl_node_t	vri_inode;
+	avl_node_t	vri_lnode;
+	uint64_t	vri_id;			/* RO */
+	uint64_t	vri_vnetid;		/* RO */
+	datalink_id_t	vri_linkid;		/* RO */
+	overlay_target_mode_t vri_mode;		/* RO */
+	overlay_plugin_dest_t vri_dest;		/* RO */
+	varpd_impl_t	*vri_impl;		/* RO */
+	varpd_plugin_t	*vri_plugin;		/* RO */
+	void		*vri_private;		/* RO */
+	mutex_t		vri_lock;
+	varpd_instance_flags_t vri_flags;	/* vri_lock */
+} varpd_instance_t;
+
+typedef struct varpd_query {
+	overlay_targ_lookup_t	vq_lookup;
+	overlay_targ_resp_t	vq_response;
+	varpd_instance_t	*vq_instance;
+} varpd_query_t;
+
+typedef struct varpd_client_create_arg {
+	datalink_id_t	vcca_linkid;
+	uint64_t	vcca_id;
+	char		vcca_plugin[LIBVARPD_PROP_NAMELEN];
+} varpd_client_create_arg_t;
+
+typedef struct varpd_client_instance_arg {
+	uint64_t	vcia_id;
+} varpd_client_instance_arg_t;
+
+typedef struct varpd_client_nprops_arg {
+	uint64_t	vcna_id;
+	uint_t		vcna_nprops;
+	uint8_t		vcna_pad[4];
+} varpd_client_nprops_arg_t;
+
+typedef struct varpd_client_propinfo_arg {
+	uint64_t	vcfa_id;
+	uint_t		vcfa_propid;
+	uint_t		vcfa_type;
+	uint_t		vcfa_prot;
+	uint32_t	vcfa_defsize;
+	uint32_t	vcfa_psize;
+	uint8_t		vcfa_pad[4];
+	char		vcfa_name[LIBVARPD_PROP_NAMELEN];
+	uint8_t		vcfa_default[LIBVARPD_PROP_SIZEMAX];
+	uint8_t		vcfa_poss[LIBVARPD_PROP_SIZEMAX];
+} varpd_client_propinfo_arg_t;
+
+typedef struct varpd_client_prop_arg {
+	uint64_t	vcpa_id;
+	uint_t		vcpa_propid;
+	uint8_t		vcpa_buf[LIBVARPD_PROP_SIZEMAX];
+	size_t		vcpa_bufsize;
+} varpd_client_prop_arg_t;
+
+typedef struct varpd_client_lookup_arg {
+	datalink_id_t	vcla_linkid;
+	uint32_t	vcla_pad;
+	uint64_t	vcla_id;
+} varpd_client_lookup_arg_t;
+
+typedef struct varpd_client_target_mode_arg {
+	uint64_t	vtma_id;
+	uint32_t	vtma_dest;
+	uint32_t	vtma_mode;
+} varpd_client_target_mode_arg_t;
+
+typedef struct varpd_client_target_cache_arg {
+	uint64_t	vtca_id;
+	uint8_t		vtca_key[ETHERADDRL];
+	uint8_t		vtca_pad[2];
+	varpd_client_cache_entry_t vtca_entry;
+} varpd_client_target_cache_arg_t;
+
+typedef struct varpd_client_target_walk_arg {
+	uint64_t	vtcw_id;
+	uint64_t	vtcw_marker;
+	uint64_t	vtcw_count;
+	overlay_targ_cache_entry_t vtcw_ents[];
+} varpd_client_target_walk_arg_t;
+
+typedef enum varpd_client_command {
+	VARPD_CLIENT_INVALID = 0x0,
+	VARPD_CLIENT_CREATE,
+	VARPD_CLIENT_ACTIVATE,
+	VARPD_CLIENT_DESTROY,
+	VARPD_CLIENT_NPROPS,
+	VARPD_CLIENT_PROPINFO,
+	VARPD_CLIENT_GETPROP,
+	VARPD_CLIENT_SETPROP,
+	VARPD_CLIENT_LOOKUP,
+	VARPD_CLIENT_TARGET_MODE,
+	VARPD_CLIENT_CACHE_FLUSH,
+	VARPD_CLIENT_CACHE_DELETE,
+	VARPD_CLIENT_CACHE_GET,
+	VARPD_CLIENT_CACHE_SET,
+	VARPD_CLIENT_CACHE_WALK,
+	VARPD_CLIENT_MAX
+} varpd_client_command_t;
+
+typedef struct varpd_client_arg {
+	uint_t	vca_command;
+	uint_t	vca_errno;
+	union {
+		varpd_client_create_arg_t vca_create;
+		varpd_client_instance_arg_t vca_instance;
+		varpd_client_nprops_arg_t vca_nprops;
+		varpd_client_propinfo_arg_t vca_info;
+		varpd_client_prop_arg_t vca_prop;
+		varpd_client_lookup_arg_t vca_lookup;
+		varpd_client_target_mode_arg_t vca_mode;
+		varpd_client_target_cache_arg_t vca_cache;
+		varpd_client_target_walk_arg_t vca_walk;
+	} vca_un;
+} varpd_client_arg_t;
+
+typedef struct varpd_client_eresp {
+	uint_t vce_command;
+	uint_t vce_errno;
+} varpd_client_eresp_t;
+
+extern void libvarpd_plugin_init(void);
+extern void libvarpd_plugin_prefork(void);
+extern void libvarpd_plugin_postfork(void);
+extern void libvarpd_plugin_fini(void);
+extern int libvarpd_plugin_comparator(const void *, const void *);
+extern varpd_plugin_t *libvarpd_plugin_lookup(varpd_impl_t *, const char *);
+
+extern varpd_instance_t *libvarpd_instance_lookup_by_dlid(varpd_impl_t *,
+    datalink_id_t);
+
+extern void libvarpd_prop_door_convert(const varpd_prop_handle_t *,
+    varpd_client_propinfo_arg_t *);
+
+extern const char *libvarpd_isaext(void);
+typedef int (*libvarpd_dirwalk_f)(varpd_impl_t *, const char *, void *);
+extern int libvarpd_dirwalk(varpd_impl_t *, const char *, const char *,
+    libvarpd_dirwalk_f, void *);
+
+extern int libvarpd_overlay_init(varpd_impl_t *);
+extern void libvarpd_overlay_fini(varpd_impl_t *);
+extern int libvarpd_overlay_info(varpd_impl_t *, datalink_id_t,
+    overlay_plugin_dest_t *, uint64_t *, uint64_t *);
+extern int libvarpd_overlay_associate(varpd_instance_t *);
+extern int libvarpd_overlay_disassociate(varpd_instance_t *);
+extern int libvarpd_overlay_degrade(varpd_instance_t *, const char *);
+extern int libvarpd_overlay_degrade_datalink(varpd_impl_t *, datalink_id_t,
+    const char *);
+extern int libvarpd_overlay_restore(varpd_instance_t *);
+extern int libvarpd_overlay_packet(varpd_impl_t *,
+    const overlay_targ_lookup_t *, void *, size_t *);
+extern int libvarpd_overlay_inject(varpd_impl_t *,
+    const overlay_targ_lookup_t *, void *, size_t);
+extern int libvarpd_overlay_instance_inject(varpd_instance_t *, void *, size_t);
+extern int libvarpd_overlay_resend(varpd_impl_t *,
+    const overlay_targ_lookup_t *, void *, size_t);
+typedef int (*libvarpd_overlay_iter_f)(varpd_impl_t *, datalink_id_t, void *);
+extern int libvarpd_overlay_iter(varpd_impl_t *, libvarpd_overlay_iter_f,
+    void *);
+extern int libvarpd_overlay_cache_flush(varpd_instance_t *);
+extern int libvarpd_overlay_cache_delete(varpd_instance_t *, const uint8_t *);
+extern int libvarpd_overlay_cache_delete(varpd_instance_t *, const uint8_t *);
+extern int libvarpd_overlay_cache_get(varpd_instance_t *, const uint8_t *,
+    varpd_client_cache_entry_t *);
+extern int libvarpd_overlay_cache_set(varpd_instance_t *, const uint8_t *,
+    const varpd_client_cache_entry_t *);
+extern int libvarpd_overlay_cache_walk_fill(varpd_instance_t *, uint64_t *,
+    uint64_t *, overlay_targ_cache_entry_t *);
+
+extern void libvarpd_persist_init(varpd_impl_t *);
+extern void libvarpd_persist_fini(varpd_impl_t *);
+extern int libvarpd_persist_instance(varpd_impl_t *, varpd_instance_t *);
+extern void libvarpd_torch_instance(varpd_impl_t *,  varpd_instance_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBVARPD_IMPL_H */
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_overlay.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_overlay.c
new file mode 100644
index 0000000000..124e3c5791
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_overlay.c
@@ -0,0 +1,586 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Interactions with /dev/overlay
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <assert.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stropts.h>
+#include <strings.h>
+#include <umem.h>
+
+#include <libvarpd_impl.h>
+#include <sys/overlay_target.h>
+
+#define	OVERLAY_PATH	"/dev/overlay"
+
+int
+libvarpd_overlay_init(varpd_impl_t *vip)
+{
+	vip->vdi_overlayfd = open(OVERLAY_PATH, O_RDWR | O_EXCL);
+	if (vip->vdi_overlayfd == -1)
+		return (errno);
+	return (0);
+}
+
+void
+libvarpd_overlay_fini(varpd_impl_t *vip)
+{
+	assert(vip->vdi_overlayfd > 0);
+	if (close(vip->vdi_overlayfd) != 0)
+		libvarpd_panic("failed to close /dev/overlay fd %d: %d",
+		    vip->vdi_overlayfd, errno);
+}
+
+int
+libvarpd_overlay_info(varpd_impl_t *vip, datalink_id_t linkid,
+    overlay_plugin_dest_t *destp, uint64_t *flags, uint64_t *vnetid)
+{
+	overlay_targ_info_t oti;
+
+	oti.oti_linkid = linkid;
+	if (ioctl(vip->vdi_overlayfd, OVERLAY_TARG_INFO, &oti) != 0)
+		return (errno);
+
+	if (destp != NULL)
+		*destp = oti.oti_needs;
+	if (flags != NULL)
+		*flags = oti.oti_flags;
+	if (vnetid != NULL)
+		*vnetid = oti.oti_vnetid;
+	return (0);
+}
+
+int
+libvarpd_overlay_associate(varpd_instance_t *inst)
+{
+	overlay_targ_associate_t ota;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	bzero(&ota, sizeof (overlay_targ_associate_t));
+	ota.ota_linkid = inst->vri_linkid;
+	ota.ota_mode = inst->vri_mode;
+	ota.ota_id = inst->vri_id;
+	ota.ota_provides = inst->vri_dest;
+
+	if (ota.ota_mode == OVERLAY_TARGET_POINT) {
+		int ret;
+		ret = inst->vri_plugin->vpp_ops->vpo_default(inst->vri_private,
+		    &ota.ota_point);
+		if (ret != VARPD_LOOKUP_OK)
+			return (ret);
+	}
+
+	if (ioctl(vip->vdi_overlayfd, OVERLAY_TARG_ASSOCIATE, &ota) != 0)
+		return (errno);
+
+	return (0);
+}
+
+int
+libvarpd_overlay_disassociate(varpd_instance_t *inst)
+{
+	overlay_targ_id_t otid;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	otid.otid_linkid = inst->vri_linkid;
+	if (ioctl(vip->vdi_overlayfd, OVERLAY_TARG_DISASSOCIATE, &otid) != 0)
+		return (errno);
+	return (0);
+}
+
+int
+libvarpd_overlay_degrade_datalink(varpd_impl_t *vip, datalink_id_t linkid,
+    const char *msg)
+{
+	overlay_targ_degrade_t otd;
+
+	otd.otd_linkid = linkid;
+	(void) strlcpy(otd.otd_buf, msg, OVERLAY_STATUS_BUFLEN);
+	if (ioctl(vip->vdi_overlayfd, OVERLAY_TARG_DEGRADE, &otd) != 0)
+		return (errno);
+	return (0);
+
+}
+
+int
+libvarpd_overlay_degrade(varpd_instance_t *inst, const char *msg)
+{
+	return (libvarpd_overlay_degrade_datalink(inst->vri_impl,
+	    inst->vri_linkid, msg));
+}
+
+int
+libvarpd_overlay_restore(varpd_instance_t *inst)
+{
+	overlay_targ_id_t otid;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	otid.otid_linkid = inst->vri_linkid;
+	if (ioctl(vip->vdi_overlayfd, OVERLAY_TARG_RESTORE, &otid) != 0)
+		return (errno);
+	return (0);
+}
+
+int
+libvarpd_overlay_packet(varpd_impl_t *vip, const overlay_targ_lookup_t *otl,
+    void *buf, size_t *buflen)
+{
+	int ret;
+	overlay_targ_pkt_t otp;
+
+	otp.otp_linkid = UINT64_MAX;
+	otp.otp_reqid = otl->otl_reqid;
+	otp.otp_size = *buflen;
+	otp.otp_buf = buf;
+
+	do {
+		ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_PKT, &otp);
+	} while (ret != 0 && errno == EINTR);
+	if (ret != 0 && errno == EFAULT)
+		libvarpd_panic("OVERLAY_TARG_PKT ioctl efault");
+	else if (ret != 0)
+		ret = errno;
+
+	if (ret == 0)
+		*buflen = otp.otp_size;
+
+	return (ret);
+}
+
+static int
+libvarpd_overlay_inject_common(varpd_impl_t *vip, varpd_instance_t *inst,
+    const overlay_targ_lookup_t *otl, void *buf, size_t buflen, int cmd)
+{
+	int ret;
+	overlay_targ_pkt_t otp;
+
+	if (otl == NULL) {
+		otp.otp_linkid = inst->vri_linkid;
+		otp.otp_reqid = 0;
+	} else {
+		otp.otp_linkid = UINT64_MAX;
+		otp.otp_reqid = otl->otl_reqid;
+	}
+	otp.otp_size = buflen;
+	otp.otp_buf = buf;
+
+	do {
+		ret = ioctl(vip->vdi_overlayfd, cmd, &otp);
+	} while (ret != 0 && errno == EINTR);
+	if (ret != 0 && errno == EFAULT)
+		libvarpd_panic("overlay_inject_common ioctl EFAULT");
+	else if (ret != 0)
+		ret = errno;
+
+	return (ret);
+}
+
+int
+libvarpd_overlay_inject(varpd_impl_t *vip, const overlay_targ_lookup_t *otl,
+    void *buf, size_t buflen)
+{
+	return (libvarpd_overlay_inject_common(vip, NULL, otl, buf, buflen,
+	    OVERLAY_TARG_INJECT));
+}
+
+int
+libvarpd_overlay_instance_inject(varpd_instance_t *inst, void *buf,
+    size_t buflen)
+{
+	return (libvarpd_overlay_inject_common(inst->vri_impl, inst, NULL, buf,
+	    buflen, OVERLAY_TARG_INJECT));
+}
+
+int
+libvarpd_overlay_resend(varpd_impl_t *vip, const overlay_targ_lookup_t *otl,
+    void *buf, size_t buflen)
+{
+	return (libvarpd_overlay_inject_common(vip, NULL, otl, buf, buflen,
+	    OVERLAY_TARG_RESEND));
+}
+
+static void
+libvarpd_overlay_lookup_reply(varpd_impl_t *vip,
+    const overlay_targ_lookup_t *otl, overlay_targ_resp_t *otr, int cmd)
+{
+	int ret;
+
+	otr->otr_reqid = otl->otl_reqid;
+	do {
+		ret = ioctl(vip->vdi_overlayfd, cmd, otr);
+	} while (ret != 0 && errno == EINTR);
+
+	/*
+	 * The only errors that should cause us to end up here are due to
+	 * programmer errors. Aruably the EINAVL case indicates that something
+	 * is a bit off; however, at this time we don't opt to kill varpd.
+	 */
+	if (ret != 0 && errno != EINVAL)
+		libvarpd_panic("receieved bad errno from lookup_reply "
+		    "(cmd %d): %d\n", cmd, errno);
+}
+
+static void
+libvarpd_overlay_lookup_handle(varpd_impl_t *vip)
+{
+	int ret;
+	varpd_query_t *vqp;
+	overlay_targ_lookup_t *otl;
+	overlay_targ_resp_t *otr;
+	varpd_instance_t *inst;
+
+	vqp = umem_cache_alloc(vip->vdi_qcache, UMEM_DEFAULT);
+	otl = &vqp->vq_lookup;
+	otr = &vqp->vq_response;
+	/*
+	 * abort doesn't really help here that much, maybe we can instead try
+	 * and for a reap or something?
+	 */
+	if (vqp == NULL)
+		libvarpd_panic("failed to allocate memory for lookup "
+		    "handle..., we should not panic()");
+	ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_LOOKUP, otl);
+	if (ret != 0 && errno != ETIME && errno != EINTR)
+		libvarpd_panic("received bad errno from OVERLAY_TARG_LOOKUP: "
+		    "%d", errno);
+
+	if (ret != 0) {
+		umem_cache_free(vip->vdi_qcache, vqp);
+		return;
+	}
+
+	inst = (varpd_instance_t *)libvarpd_instance_lookup(
+	    (varpd_handle_t *)vip, otl->otl_varpdid);
+	if (inst == NULL) {
+		libvarpd_overlay_lookup_reply(vip, otl, otr,
+		    OVERLAY_TARG_DROP);
+		umem_cache_free(vip->vdi_qcache, vqp);
+		return;
+	}
+	vqp->vq_instance = inst;
+
+	inst->vri_plugin->vpp_ops->vpo_lookup(inst->vri_private,
+	    (varpd_query_handle_t *)vqp, otl, &otr->otr_answer);
+}
+
+void
+libvarpd_overlay_lookup_run(varpd_handle_t *vhp)
+{
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	mutex_enter(&vip->vdi_lock);
+	if (vip->vdi_lthr_quiesce == B_TRUE) {
+		mutex_exit(&vip->vdi_lock);
+		return;
+	}
+	vip->vdi_lthr_count++;
+
+	for (;;) {
+		mutex_exit(&vip->vdi_lock);
+		libvarpd_overlay_lookup_handle(vip);
+		mutex_enter(&vip->vdi_lock);
+		if (vip->vdi_lthr_quiesce == B_TRUE)
+			break;
+	}
+	assert(vip->vdi_lthr_count > 0);
+	vip->vdi_lthr_count--;
+	(void) cond_signal(&vip->vdi_lthr_cv);
+	mutex_exit(&vip->vdi_lock);
+}
+
+void
+libvarpd_overlay_lookup_quiesce(varpd_handle_t *vhp)
+{
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	mutex_enter(&vip->vdi_lock);
+	if (vip->vdi_lthr_count == 0) {
+		mutex_exit(&vip->vdi_lock);
+		return;
+	}
+	vip->vdi_lthr_quiesce = B_TRUE;
+	while (vip->vdi_lthr_count > 0)
+		(void) cond_wait(&vip->vdi_lthr_cv, &vip->vdi_lock);
+	vip->vdi_lthr_quiesce = B_FALSE;
+	mutex_exit(&vip->vdi_lock);
+}
+
+int
+libvarpd_overlay_iter(varpd_impl_t *vip, libvarpd_overlay_iter_f func,
+    void *arg)
+{
+	uint32_t curents = 0, i;
+	size_t size;
+	overlay_targ_list_t *otl;
+
+	for (;;) {
+		size = sizeof (overlay_targ_list_t) +
+		    sizeof (uint32_t) * curents;
+		otl = umem_alloc(size, UMEM_DEFAULT);
+		if (otl == NULL)
+			return (ENOMEM);
+
+		otl->otl_nents = curents;
+		if (ioctl(vip->vdi_overlayfd, OVERLAY_TARG_LIST, otl) != 0) {
+			if (errno == EFAULT)
+				libvarpd_panic("OVERLAY_TARG_LIST ioctl "
+				    "efault");
+			umem_free(otl, size);
+			if (errno == EINTR)
+				continue;
+			else
+				return (errno);
+		}
+
+		if (otl->otl_nents == curents)
+			break;
+
+		curents = otl->otl_nents;
+		umem_free(otl, size);
+	}
+
+	for (i = 0; i < otl->otl_nents; i++) {
+		if (func(vip, otl->otl_ents[i], arg) != 0)
+			break;
+	}
+	umem_free(otl, size);
+	return (0);
+}
+
+int
+libvarpd_overlay_cache_flush(varpd_instance_t *inst)
+{
+	int ret;
+	overlay_targ_cache_t cache;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	bzero(&cache, sizeof (overlay_targ_cache_t));
+	cache.otc_linkid = inst->vri_linkid;
+
+	ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_CACHE_FLUSH, &cache);
+	if (ret != 0 && errno == EFAULT)
+		libvarpd_panic("OVERLAY_TARG_CACHE_FLUSH ioctl efault");
+	else if (ret != 0)
+		ret = errno;
+
+	return (ret);
+}
+
+int
+libvarpd_overlay_cache_delete(varpd_instance_t *inst, const uint8_t *key)
+{
+	int ret;
+	overlay_targ_cache_t cache;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	bzero(&cache, sizeof (overlay_targ_cache_t));
+	cache.otc_linkid = inst->vri_linkid;
+	bcopy(key, cache.otc_entry.otce_mac, ETHERADDRL);
+
+	ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_CACHE_REMOVE, &cache);
+	if (ret != 0 && errno == EFAULT)
+		libvarpd_panic("OVERLAY_TARG_CACHE_REMOVE ioctl efault");
+	else if (ret != 0)
+		ret = errno;
+
+	return (ret);
+
+}
+
+int
+libvarpd_overlay_cache_get(varpd_instance_t *inst, const uint8_t *key,
+    varpd_client_cache_entry_t *entry)
+{
+	int ret;
+	overlay_targ_cache_t cache;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	bzero(&cache, sizeof (overlay_targ_cache_t));
+	cache.otc_linkid = inst->vri_linkid;
+	bcopy(key, cache.otc_entry.otce_mac, ETHERADDRL);
+
+	ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_CACHE_GET, &cache);
+	if (ret != 0 && errno == EFAULT)
+		libvarpd_panic("OVERLAY_TARG_CACHE_GET ioctl efault");
+	else if (ret != 0)
+		return (errno);
+
+	bcopy(cache.otc_entry.otce_dest.otp_mac, &entry->vcp_mac, ETHERADDRL);
+	entry->vcp_flags = cache.otc_entry.otce_flags;
+	entry->vcp_ip = cache.otc_entry.otce_dest.otp_ip;
+	entry->vcp_port = cache.otc_entry.otce_dest.otp_port;
+
+	return (0);
+}
+
+int
+libvarpd_overlay_cache_set(varpd_instance_t *inst, const uint8_t *key,
+    const varpd_client_cache_entry_t *entry)
+{
+	int ret;
+	overlay_targ_cache_t cache;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	bzero(&cache, sizeof (overlay_targ_cache_t));
+	cache.otc_linkid = inst->vri_linkid;
+	bcopy(key, cache.otc_entry.otce_mac, ETHERADDRL);
+	bcopy(&entry->vcp_mac, cache.otc_entry.otce_dest.otp_mac, ETHERADDRL);
+	cache.otc_entry.otce_flags = entry->vcp_flags;
+	cache.otc_entry.otce_dest.otp_ip = entry->vcp_ip;
+	cache.otc_entry.otce_dest.otp_port = entry->vcp_port;
+
+	ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_CACHE_SET, &cache);
+	if (ret != 0 && errno == EFAULT)
+		libvarpd_panic("OVERLAY_TARG_CACHE_SET ioctl efault");
+	else if (ret != 0)
+		return (errno);
+
+	return (0);
+}
+
+int
+libvarpd_overlay_cache_walk_fill(varpd_instance_t *inst, uint64_t *markerp,
+    uint64_t *countp, overlay_targ_cache_entry_t *ents)
+{
+	int ret;
+	size_t asize;
+	overlay_targ_cache_iter_t *iter;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	if (*countp > 200)
+		return (E2BIG);
+
+	asize = sizeof (overlay_targ_cache_iter_t) +
+	    *countp * sizeof (overlay_targ_cache_entry_t);
+	iter = umem_alloc(asize, UMEM_DEFAULT);
+	if (iter == NULL)
+		return (ENOMEM);
+
+	iter->otci_linkid = inst->vri_linkid;
+	iter->otci_marker = *markerp;
+	iter->otci_count = *countp;
+	ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_CACHE_ITER, iter);
+	if (ret != 0 && errno == EFAULT)
+		libvarpd_panic("OVERLAY_TARG_CACHE_ITER ioctl efault");
+	else if (ret != 0) {
+		ret = errno;
+		goto out;
+	}
+
+	*markerp = iter->otci_marker;
+	*countp = iter->otci_count;
+	bcopy(iter->otci_ents, ents,
+	    *countp * sizeof (overlay_targ_cache_entry_t));
+out:
+	umem_free(iter, asize);
+	return (ret);
+}
+
+void
+libvarpd_plugin_query_reply(varpd_query_handle_t *vqh, int action)
+{
+	varpd_query_t *vqp = (varpd_query_t *)vqh;
+
+	if (vqp == NULL)
+		libvarpd_panic("unkonwn plugin passed invalid "
+		    "varpd_query_handle_t");
+
+	if (action == VARPD_LOOKUP_DROP)
+		libvarpd_overlay_lookup_reply(vqp->vq_instance->vri_impl,
+		    &vqp->vq_lookup, &vqp->vq_response, OVERLAY_TARG_DROP);
+	else if (action == VARPD_LOOKUP_OK)
+		libvarpd_overlay_lookup_reply(vqp->vq_instance->vri_impl,
+		    &vqp->vq_lookup, &vqp->vq_response, OVERLAY_TARG_RESPOND);
+	else
+		libvarpd_panic("plugin %s passed in an invalid action: %d",
+		    vqp->vq_instance->vri_plugin->vpp_name, action);
+
+	umem_cache_free(vqp->vq_instance->vri_impl->vdi_qcache, vqp);
+}
+
+void
+libvarpd_inject_varp(varpd_provider_handle_t *vph, const uint8_t *mac,
+    const overlay_target_point_t *otp)
+{
+	int ret;
+	overlay_targ_cache_t otc;
+	varpd_instance_t *inst = (varpd_instance_t *)vph;
+	varpd_impl_t *vip = inst->vri_impl;
+
+	if (otp == NULL) {
+		(void) libvarpd_overlay_cache_delete(inst, mac);
+		return;
+	}
+
+	otc.otc_linkid = inst->vri_linkid;
+	otc.otc_entry.otce_flags = 0;
+	bcopy(mac, otc.otc_entry.otce_mac, ETHERADDRL);
+	bcopy(otp, &otc.otc_entry.otce_dest, sizeof (overlay_target_point_t));
+
+	ret = ioctl(vip->vdi_overlayfd, OVERLAY_TARG_CACHE_SET, &otc);
+	if (ret != 0) {
+		switch (errno) {
+		case EBADF:
+		case EFAULT:
+		case ENOTSUP:
+			libvarpd_panic("received bad errno from "
+			    "OVERLAY_TARG_CACHE_SET: %d", errno);
+		default:
+			break;
+		}
+	}
+}
+
+void
+libvarpd_fma_degrade(varpd_provider_handle_t *vph, const char *msg)
+{
+	int ret;
+	varpd_instance_t *inst = (varpd_instance_t *)vph;
+
+	ret = libvarpd_overlay_degrade(inst, msg);
+	switch (ret) {
+	case ENOENT:
+	case EFAULT:
+		libvarpd_panic("received bad errno from degrade ioctl: %d",
+		    errno);
+	default:
+		break;
+	}
+}
+
+void
+libvarpd_fma_restore(varpd_provider_handle_t *vph)
+{
+	int ret;
+	varpd_instance_t *inst = (varpd_instance_t *)vph;
+
+	ret = libvarpd_overlay_restore(inst);
+	switch (ret) {
+	case ENOENT:
+	case EFAULT:
+		libvarpd_panic("received bad errno from restore ioctl: %d",
+		    errno);
+	default:
+		break;
+	}
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_panic.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_panic.c
new file mode 100644
index 0000000000..6728d79d6e
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_panic.c
@@ -0,0 +1,53 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+/*
+ * No, 'tis not so deep as a well, nor so wide as a church door; but 'tis
+ * enough,'twill serve. Ask for me tomorrow, and you shall find me a grave man.
+ *
+ * This file maintains various routines for handling when we die.
+ */
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <errno.h>
+#include <thread.h>
+#include <stdlib.h>
+
+/*
+ * Normally these would be static, but if they're static, that throws off lint
+ * because it thinks we never use them, which is kind of the point, because we
+ * only read them in the core...
+ */
+int varpd_panic_errno;
+char varpd_panic_buf[1024];
+thread_t varpd_panic_thread;
+
+void
+libvarpd_panic(const char *fmt, ...)
+{
+	va_list ap;
+
+	/* Always save errno first! */
+	varpd_panic_errno = errno;
+	varpd_panic_thread = thr_self();
+
+	if (fmt != NULL) {
+		va_start(ap, fmt);
+		(void) vsnprintf(varpd_panic_buf, sizeof (varpd_panic_buf), fmt,
+		    ap);
+	}
+	abort();
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_persist.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_persist.c
new file mode 100644
index 0000000000..27cc802a9c
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_persist.c
@@ -0,0 +1,586 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * varpd persistence backend
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <strings.h>
+#include <librename.h>
+#include <md5.h>
+#include <sys/sysmacros.h>
+#include <dirent.h>
+#include <sys/mman.h>
+#include <umem.h>
+#include <sys/debug.h>
+
+#include <libvarpd_impl.h>
+
+static uint8_t varpd_persist_magic[4] = {
+	'v',
+	'a',
+	'r',
+	'p',
+};
+
+#define	VARPD_PERSIST_MAXWRITE		4096
+#define	VARPD_PERSIST_VERSION_ONE	1
+#define	VARPD_PERSIST_SUFFIX		".varpd"
+
+typedef struct varpd_persist_header {
+	uint8_t		vph_magic[4];
+	uint32_t	vph_version;
+	uint8_t		vph_md5[16];
+} varpd_persist_header_t;
+
+void
+libvarpd_persist_init(varpd_impl_t *vip)
+{
+	vip->vdi_persistfd = -1;
+	if (rwlock_init(&vip->vdi_pfdlock, USYNC_THREAD, NULL) != 0)
+		libvarpd_panic("failed to create rw vdi_pfdlock");
+}
+
+void
+libvarpd_persist_fini(varpd_impl_t *vip)
+{
+	/*
+	 * Clean up for someone that left something behind.
+	 */
+	if (vip->vdi_persistfd != -1) {
+		if (close(vip->vdi_persistfd) != 0)
+			libvarpd_panic("failed to close persist fd %d: %d",
+			    vip->vdi_persistfd, errno);
+		vip->vdi_persistfd = -1;
+	}
+	if (rwlock_destroy(&vip->vdi_pfdlock) != 0)
+		libvarpd_panic("failed to destroy rw vdi_pfdlock");
+}
+
+int
+libvarpd_persist_enable(varpd_handle_t *vhp, const char *rootdir)
+{
+	int fd;
+	struct stat st;
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	fd = open(rootdir, O_RDONLY);
+	if (fd < 0)
+		return (errno);
+
+	if (fstat(fd, &st) != 0) {
+		int ret = errno;
+		if (close(fd) != 0)
+			libvarpd_panic("failed to close rootdir fd (%s) %d: %d",
+			    rootdir, fd, errno);
+		return (ret);
+	}
+
+	if (!S_ISDIR(st.st_mode)) {
+		if (close(fd) != 0)
+			libvarpd_panic("failed to close rootdir fd (%s) %d: %d",
+			    rootdir, fd, errno);
+		return (EINVAL);
+	}
+
+
+	VERIFY0(rw_wrlock(&vip->vdi_pfdlock));
+	if (vip->vdi_persistfd != -1) {
+		VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+		if (close(fd) != 0)
+			libvarpd_panic("failed to close rootdir fd (%s) %d: %d",
+			    rootdir, fd, errno);
+		return (EEXIST);
+	}
+	vip->vdi_persistfd = fd;
+	VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+
+	return (0);
+}
+
+static int
+libvarpd_persist_write(int fd, const void *buf, size_t buflen)
+{
+	ssize_t ret;
+	off_t off = 0;
+
+	while (buflen > 0) {
+		ret = write(fd, (void *)((uintptr_t)buf + off),
+		    MIN(buflen, VARPD_PERSIST_MAXWRITE));
+		if (ret == -1 && errno == EINTR)
+			continue;
+		if (ret == -1)
+			return (errno);
+
+		off += ret;
+		buflen -= ret;
+	}
+
+	return (0);
+}
+
+static int
+libvarpd_persist_nvlist(int dirfd, uint64_t id, nvlist_t *nvl)
+{
+	int err, fd;
+	size_t size;
+	varpd_persist_header_t hdr;
+	librename_atomic_t *lrap;
+	char *buf = NULL, *name;
+
+	if ((err = nvlist_pack(nvl, &buf, &size, NV_ENCODE_XDR, 0)) != 0)
+		return (err);
+
+	if (asprintf(&name, "%llu%s", (unsigned long long)id, ".varpd") == -1) {
+		err = errno;
+		free(buf);
+		return (err);
+	}
+
+	if ((err = librename_atomic_fdinit(dirfd, name, NULL, 0600, 0,
+	    &lrap)) != 0) {
+		free(name);
+		free(buf);
+		return (err);
+	}
+
+	fd = librename_atomic_fd(lrap);
+
+	bzero(&hdr, sizeof (varpd_persist_header_t));
+	bcopy(varpd_persist_magic, hdr.vph_magic, sizeof (varpd_persist_magic));
+	hdr.vph_version = VARPD_PERSIST_VERSION_ONE;
+	md5_calc(hdr.vph_md5, buf, size);
+
+	if ((err = libvarpd_persist_write(fd, &hdr,
+	    sizeof (varpd_persist_header_t))) != 0) {
+		librename_atomic_fini(lrap);
+		free(name);
+		free(buf);
+		return (err);
+	}
+
+	if ((err = libvarpd_persist_write(fd, buf, size)) != 0) {
+		librename_atomic_fini(lrap);
+		free(name);
+		free(buf);
+		return (err);
+	}
+
+	do {
+		err = librename_atomic_commit(lrap);
+	} while (err == EINTR);
+
+	librename_atomic_fini(lrap);
+	free(name);
+	free(buf);
+	return (err);
+}
+
+int
+libvarpd_persist_instance(varpd_impl_t *vip, varpd_instance_t *inst)
+{
+	int err = 0;
+	nvlist_t *nvl = NULL, *cvl = NULL;
+
+	VERIFY0(rw_rdlock(&vip->vdi_pfdlock));
+	/* Check if persistence exists */
+	if (vip->vdi_persistfd == -1)
+		goto out;
+
+	if ((err = nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0)) != 0)
+		goto out;
+
+	if ((err = nvlist_alloc(&cvl, NV_UNIQUE_NAME, 0)) != 0)
+		goto out;
+
+	if ((err = nvlist_add_uint64(nvl, "vri_id", inst->vri_id)) != 0)
+		goto out;
+
+	if ((err = nvlist_add_uint32(nvl, "vri_linkid", inst->vri_linkid)) != 0)
+		goto out;
+
+	if ((err = nvlist_add_uint32(nvl, "vri_dest",
+	    (uint32_t)inst->vri_dest)) != 0)
+		goto out;
+	if ((err = nvlist_add_uint32(nvl, "vri_mode",
+	    (uint32_t)inst->vri_mode)) != 0)
+		goto out;
+
+	if ((err = nvlist_add_string(nvl, "vri_plugin",
+	    inst->vri_plugin->vpp_name)) != 0)
+		goto out;
+
+	err = inst->vri_plugin->vpp_ops->vpo_save(inst->vri_private, cvl);
+	if (err != 0)
+		goto out;
+
+	if ((err = nvlist_add_nvlist(nvl, "vri_private", cvl)) != 0)
+		goto out;
+
+	err = libvarpd_persist_nvlist(vip->vdi_persistfd, inst->vri_id, nvl);
+out:
+	nvlist_free(nvl);
+	nvlist_free(cvl);
+	VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+	return (err);
+}
+
+void
+libvarpd_torch_instance(varpd_impl_t *vip, varpd_instance_t *inst)
+{
+	char buf[32];
+	int ret;
+
+	VERIFY0(rw_rdlock(&vip->vdi_pfdlock));
+	if (vip->vdi_persistfd == -1) {
+		VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+		return;
+	}
+
+	if (snprintf(buf, sizeof (buf), "%lld.varpd", inst->vri_id) >= 32)
+		libvarpd_panic("somehow exceeded static value for "
+		    "libvarpd_torch_instance buffer");
+
+	do {
+		ret = unlinkat(vip->vdi_persistfd, buf, 0);
+	} while (ret == -1 && errno == EINTR);
+	if (ret != 0) {
+		switch (errno) {
+		case ENOENT:
+			break;
+		default:
+			libvarpd_panic("failed to unlinkat %d`%s: %s",
+			    vip->vdi_persistfd, buf, strerror(errno));
+		}
+	}
+
+	VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+}
+
+static int
+libvarpd_persist_restore_instance(varpd_impl_t *vip, nvlist_t *nvl)
+{
+	int err;
+	nvlist_t *pvl;
+	uint64_t id, flags, vid;
+	uint32_t linkid, dest, mode;
+	char *pluginstr;
+	varpd_plugin_t *plugin;
+	overlay_plugin_dest_t adest;
+	varpd_instance_t *inst, lookup;
+
+	if (nvlist_lookup_uint64(nvl, "vri_id", &id) != 0)
+		return (EINVAL);
+
+	if (nvlist_lookup_uint32(nvl, "vri_linkid", &linkid) != 0)
+		return (EINVAL);
+
+	if (nvlist_lookup_uint32(nvl, "vri_dest", &dest) != 0)
+		return (EINVAL);
+
+	if (nvlist_lookup_uint32(nvl, "vri_mode", &mode) != 0)
+		return (EINVAL);
+
+	if (nvlist_lookup_string(nvl, "vri_plugin", &pluginstr) != 0)
+		return (EINVAL);
+
+	if (nvlist_lookup_nvlist(nvl, "vri_private", &pvl) != 0)
+		return (EINVAL);
+
+	plugin = libvarpd_plugin_lookup(vip, pluginstr);
+	if (plugin == NULL)
+		return (EINVAL);
+
+	if (plugin->vpp_mode != mode)
+		return (EINVAL);
+
+	if (libvarpd_overlay_info(vip, linkid, &adest, &flags, &vid) != 0)
+		return (EINVAL);
+
+	if (dest != adest)
+		return (EINVAL);
+
+	inst = umem_alloc(sizeof (varpd_instance_t), UMEM_DEFAULT);
+	if (inst == NULL)
+		libvarpd_panic("failed to allocate instance for restore");
+
+	inst->vri_id = id_alloc_specific(vip->vdi_idspace, id);
+	if (inst->vri_id != id) {
+		umem_free(inst, sizeof (varpd_instance_t));
+		return (EINVAL);
+	}
+
+	inst->vri_linkid = linkid;
+	inst->vri_vnetid = vid;
+	inst->vri_mode = plugin->vpp_mode;
+	inst->vri_dest = dest;
+	inst->vri_plugin = plugin;
+	inst->vri_impl = vip;
+	inst->vri_flags = 0;
+	if (plugin->vpp_ops->vpo_restore(pvl, (varpd_provider_handle_t *)inst,
+	    dest, &inst->vri_private) != 0) {
+		id_free(vip->vdi_idspace, id);
+		umem_free(inst, sizeof (varpd_instance_t));
+		return (EINVAL);
+	}
+
+	if (mutex_init(&inst->vri_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL) != 0)
+		libvarpd_panic("failed to create vri_lock mutex");
+
+	mutex_enter(&vip->vdi_lock);
+	lookup.vri_id = inst->vri_id;
+	if (avl_find(&vip->vdi_instances, &lookup, NULL) != NULL)
+		libvarpd_panic("found duplicate instance with id %d",
+		    lookup.vri_id);
+	avl_add(&vip->vdi_instances, inst);
+	lookup.vri_linkid = inst->vri_linkid;
+	if (avl_find(&vip->vdi_linstances, &lookup, NULL) != NULL)
+		libvarpd_panic("found duplicate linstance with id %d",
+		    lookup.vri_linkid);
+	avl_add(&vip->vdi_linstances, inst);
+	mutex_exit(&vip->vdi_lock);
+
+	if (plugin->vpp_ops->vpo_start(inst->vri_private) != 0) {
+		libvarpd_instance_destroy((varpd_instance_handle_t *)inst);
+		return (EINVAL);
+	}
+
+	if (flags & OVERLAY_TARG_INFO_F_ACTIVE)
+		(void) libvarpd_overlay_disassociate(inst);
+
+	if (libvarpd_overlay_associate(inst) != 0) {
+		libvarpd_instance_destroy((varpd_instance_handle_t *)inst);
+		return (EINVAL);
+	}
+
+	if (flags & OVERLAY_TARG_INFO_F_DEGRADED) {
+		if ((err = libvarpd_overlay_restore(inst)) != 0) {
+			libvarpd_panic("failed to restore instance %p: %d\n",
+			    inst, err);
+		}
+	}
+
+	mutex_enter(&inst->vri_lock);
+	inst->vri_flags |= VARPD_INSTANCE_F_ACTIVATED;
+	mutex_exit(&inst->vri_lock);
+
+	return (0);
+}
+
+static int
+libvarpd_persist_restore_one(varpd_impl_t *vip, int fd)
+{
+	int err;
+	size_t fsize;
+	struct stat st;
+	void *buf, *datap;
+	varpd_persist_header_t *hdr;
+	uint8_t md5[16];
+	nvlist_t *nvl;
+
+	if (fstat(fd, &st) != 0)
+		return (errno);
+
+	if (st.st_size <= sizeof (varpd_persist_header_t))
+		return (EINVAL);
+	fsize = st.st_size - sizeof (varpd_persist_header_t);
+
+	buf = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+	if (buf == MAP_FAILED)
+		return (errno);
+
+	hdr = buf;
+	if (bcmp(varpd_persist_magic, hdr->vph_magic,
+	    sizeof (varpd_persist_magic)) != 0) {
+		if (munmap(buf, st.st_size) != 0)
+			libvarpd_panic("failed to munmap %p: %d", buf, errno);
+		return (EINVAL);
+	}
+
+	if (hdr->vph_version != VARPD_PERSIST_VERSION_ONE) {
+		if (munmap(buf, st.st_size) != 0)
+			libvarpd_panic("failed to munmap %p: %d", buf, errno);
+		return (EINVAL);
+	}
+
+	datap = (void *)((uintptr_t)buf + sizeof (varpd_persist_header_t));
+	md5_calc(md5, datap, fsize);
+	if (bcmp(md5, hdr->vph_md5, sizeof (uint8_t) * 16) != 0) {
+		if (munmap(buf, st.st_size) != 0)
+			libvarpd_panic("failed to munmap %p: %d", buf, errno);
+		return (EINVAL);
+	}
+
+	err = nvlist_unpack(datap, fsize, &nvl, 0);
+	if (munmap(buf, st.st_size) != 0)
+		libvarpd_panic("failed to munmap %p: %d", buf, errno);
+
+	if (err != 0)
+		return (EINVAL);
+
+	err = libvarpd_persist_restore_instance(vip, nvl);
+	nvlist_free(nvl);
+	return (err);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_check_degrade_cb(varpd_impl_t *vip, datalink_id_t linkid, void *arg)
+{
+	varpd_instance_t *inst;
+
+	mutex_enter(&vip->vdi_lock);
+	for (inst = avl_first(&vip->vdi_instances); inst != NULL;
+	    inst = AVL_NEXT(&vip->vdi_instances, inst)) {
+		if (inst->vri_linkid == linkid) {
+			mutex_exit(&vip->vdi_lock);
+			return (0);
+		}
+	}
+
+	mutex_exit(&vip->vdi_lock);
+
+	(void) libvarpd_overlay_degrade_datalink(vip, linkid,
+	    "no varpd instance exists");
+	return (0);
+}
+
+static void
+libvarpd_check_degrade(varpd_impl_t *vip)
+{
+	(void) libvarpd_overlay_iter(vip, libvarpd_check_degrade_cb, NULL);
+}
+
+int
+libvarpd_persist_restore(varpd_handle_t *vhp)
+{
+	int dirfd;
+	int ret = 0;
+	DIR *dirp = NULL;
+	struct dirent *dp;
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	VERIFY0(rw_rdlock(&vip->vdi_pfdlock));
+	if ((dirfd = dup(vip->vdi_persistfd)) < 0) {
+		ret = errno;
+		goto out;
+	}
+
+	if ((dirp = fdopendir(dirfd)) == NULL) {
+		ret = errno;
+		if (close(dirfd) != 0)
+			libvarpd_panic("failed to close dirfd %d: %d",
+			    dirfd, errno);
+		goto out;
+	}
+
+	for (;;) {
+		int fd;
+		uint64_t id;
+		char *eptr;
+		struct stat st;
+
+		errno = 0;
+		dp = readdir(dirp);
+		if (dp == NULL) {
+			ret = errno;
+			break;
+		}
+
+		if (strcmp(dp->d_name, ".") == 0 ||
+		    strcmp(dp->d_name, "..") == 0)
+			continue;
+
+		/*
+		 * Leave files that we don't recognize alone. A valid file has
+		 * the format `%llu.varpd`.
+		 */
+		errno = 0;
+		id = strtoull(dp->d_name, &eptr, 10);
+		if ((id == 0 && errno == EINVAL) ||
+		    (id == ULLONG_MAX && errno == ERANGE))
+			continue;
+
+		if (strcmp(eptr, VARPD_PERSIST_SUFFIX) != 0)
+			continue;
+
+		fd = openat(vip->vdi_persistfd, dp->d_name, O_RDONLY);
+		if (fd < 0) {
+			ret = errno;
+			break;
+		}
+
+		if (fstat(fd, &st) != 0) {
+			ret = errno;
+			break;
+		}
+
+		if (!S_ISREG(st.st_mode)) {
+			if (close(fd) != 0)
+				libvarpd_panic("failed to close fd (%s) %d: "
+				    "%d\n", dp->d_name, fd, errno);
+			continue;
+		}
+
+		ret = libvarpd_persist_restore_one(vip, fd);
+		if (close(fd) != 0)
+			libvarpd_panic("failed to close fd (%s) %d: "
+			    "%d\n", dp->d_name, fd, errno);
+		/*
+		 * This is an invalid file. We'll unlink it to save us this
+		 * trouble in the future.
+		 */
+		if (ret != 0) {
+			if (unlinkat(vip->vdi_persistfd, dp->d_name, 0) != 0) {
+				ret = errno;
+				break;
+			}
+		}
+	}
+
+	libvarpd_check_degrade(vip);
+
+out:
+	if (dirp != NULL)
+		(void) closedir(dirp);
+	VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+	return (ret);
+}
+
+int
+libvarpd_persist_disable(varpd_handle_t *vhp)
+{
+	varpd_impl_t *vip = (varpd_impl_t *)vhp;
+
+	VERIFY0(rw_wrlock(&vip->vdi_pfdlock));
+	if (vip->vdi_persistfd == -1) {
+		mutex_exit(&vip->vdi_lock);
+		VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+		return (ENOENT);
+	}
+	if (close(vip->vdi_persistfd) != 0)
+		libvarpd_panic("failed to close persist fd %d: %d",
+		    vip->vdi_persistfd, errno);
+	vip->vdi_persistfd = -1;
+	VERIFY0(rw_unlock(&vip->vdi_pfdlock));
+	return (0);
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_plugin.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_plugin.c
new file mode 100644
index 0000000000..ac73286fdd
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_plugin.c
@@ -0,0 +1,269 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * varpd plugin management
+ */
+
+#include <libvarpd_impl.h>
+#include <errno.h>
+#include <umem.h>
+#include <assert.h>
+#include <strings.h>
+#include <dlfcn.h>
+#include <link.h>
+#include <stdio.h>
+#include <bunyan.h>
+
+static varpd_impl_t *varpd_load_handle;
+static const char *varpd_load_path;
+static mutex_t varpd_load_lock;
+static cond_t varpd_load_cv;
+
+int
+libvarpd_plugin_comparator(const void *lp, const void *rp)
+{
+	int ret;
+	const varpd_plugin_t *lpp, *rpp;
+
+	lpp = lp;
+	rpp = rp;
+
+	ret = strcmp(lpp->vpp_name, rpp->vpp_name);
+	if (ret > 0)
+		return (1);
+	if (ret < 0)
+		return (-1);
+	return (0);
+}
+
+varpd_plugin_register_t *
+libvarpd_plugin_alloc(uint_t version, int *errp)
+{
+	int err;
+	varpd_plugin_register_t *vprp;
+
+	if (errp == NULL)
+		errp = &err;
+
+	if (version != VARPD_VERSION_ONE) {
+		(void) bunyan_warn(varpd_load_handle->vdi_bunyan,
+		    "unsupported registration version",
+		    BUNYAN_T_STRING, "module_path", varpd_load_path,
+		    BUNYAN_T_INT32, "module_version", version,
+		    BUNYAN_T_END);
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	vprp = umem_alloc(sizeof (varpd_plugin_register_t), UMEM_DEFAULT);
+	if (vprp == NULL) {
+		(void) bunyan_warn(varpd_load_handle->vdi_bunyan,
+		    "failed to allocate registration handle",
+		    BUNYAN_T_STRING, "module_path", varpd_load_path,
+		    BUNYAN_T_END);
+		*errp = ENOMEM;
+		return (NULL);
+	}
+
+	vprp->vpr_version = VARPD_VERSION_ONE;
+
+	return (vprp);
+}
+
+void
+libvarpd_plugin_free(varpd_plugin_register_t *vprp)
+{
+	umem_free(vprp, sizeof (varpd_plugin_register_t));
+}
+
+int
+libvarpd_plugin_register(varpd_plugin_register_t *vprp)
+{
+	varpd_plugin_t *vpp;
+	varpd_plugin_t lookup;
+
+	vpp = umem_alloc(sizeof (varpd_plugin_t), UMEM_DEFAULT);
+	if (vpp == NULL) {
+		(void) bunyan_warn(varpd_load_handle->vdi_bunyan,
+		    "failed to allocate memory for the varpd_plugin_t",
+		    BUNYAN_T_STRING, "module_path", varpd_load_path,
+		    BUNYAN_T_END);
+		return (ENOMEM);
+	}
+
+	/* Watch out for an evil plugin */
+	if (vprp->vpr_version != VARPD_VERSION_ONE) {
+		(void) bunyan_warn(varpd_load_handle->vdi_bunyan,
+		    "unsupported registration version",
+		    BUNYAN_T_STRING, "module_path", varpd_load_path,
+		    BUNYAN_T_INT32, "module_version", vprp->vpr_version,
+		    BUNYAN_T_END);
+		return (EINVAL);
+	}
+
+	mutex_enter(&varpd_load_lock);
+	if (varpd_load_handle == NULL)
+		libvarpd_panic("varpd_load_handle was unexpectedly null");
+
+	mutex_enter(&varpd_load_handle->vdi_lock);
+	lookup.vpp_name = vprp->vpr_name;
+	if (avl_find(&varpd_load_handle->vdi_plugins, &lookup, NULL) != NULL) {
+		(void) bunyan_warn(varpd_load_handle->vdi_bunyan,
+		    "module already exists with requested name",
+		    BUNYAN_T_STRING, "module_path", varpd_load_path,
+		    BUNYAN_T_STRING, "name", vprp->vpr_name,
+		    BUNYAN_T_END);
+		mutex_exit(&varpd_load_handle->vdi_lock);
+		mutex_exit(&varpd_load_lock);
+		umem_free(vpp, sizeof (varpd_plugin_t));
+		return (EEXIST);
+	}
+	vpp->vpp_name = strdup(vprp->vpr_name);
+	if (vpp->vpp_name == NULL) {
+		(void) bunyan_warn(varpd_load_handle->vdi_bunyan,
+		    "failed to allocate memory to duplicate name",
+		    BUNYAN_T_STRING, "module_path", varpd_load_path,
+		    BUNYAN_T_END);
+		mutex_exit(&varpd_load_handle->vdi_lock);
+		mutex_exit(&varpd_load_lock);
+		umem_free(vpp, sizeof (varpd_plugin_t));
+		return (ENOMEM);
+	}
+
+	vpp->vpp_mode = vprp->vpr_mode;
+	vpp->vpp_ops = vprp->vpr_ops;
+	if (mutex_init(&vpp->vpp_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL) != 0)
+		libvarpd_panic("failed to create plugin's vpp_lock");
+	vpp->vpp_active = 0;
+	avl_add(&varpd_load_handle->vdi_plugins, vpp);
+	mutex_exit(&varpd_load_handle->vdi_lock);
+	mutex_exit(&varpd_load_lock);
+
+	return (0);
+}
+
+varpd_plugin_t *
+libvarpd_plugin_lookup(varpd_impl_t *vip, const char *name)
+{
+	varpd_plugin_t lookup, *ret;
+
+	lookup.vpp_name = name;
+	mutex_enter(&vip->vdi_lock);
+	ret = avl_find(&vip->vdi_plugins, &lookup, NULL);
+	mutex_exit(&vip->vdi_lock);
+
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+libvarpd_plugin_load_cb(varpd_impl_t *vip, const char *path, void *unused)
+{
+	void *dlp;
+
+	varpd_load_path = path;
+	dlp = dlopen(path, RTLD_LOCAL | RTLD_NOW);
+	if (dlp == NULL) {
+		(void) bunyan_error(vip->vdi_bunyan, "dlopen failed",
+		    BUNYAN_T_STRING, "module path", path,
+		    BUNYAN_T_END);
+	}
+	path = NULL;
+
+	return (0);
+}
+
+int
+libvarpd_plugin_load(varpd_handle_t *vph, const char *path)
+{
+	int ret = 0;
+	varpd_impl_t *vip = (varpd_impl_t *)vph;
+
+	if (vip == NULL || path == NULL)
+		return (EINVAL);
+	mutex_enter(&varpd_load_lock);
+	while (varpd_load_handle != NULL)
+		(void) cond_wait(&varpd_load_cv, &varpd_load_lock);
+	varpd_load_handle = vip;
+	mutex_exit(&varpd_load_lock);
+
+	ret = libvarpd_dirwalk(vip, path, ".so", libvarpd_plugin_load_cb, NULL);
+
+	mutex_enter(&varpd_load_lock);
+	varpd_load_handle = NULL;
+	(void) cond_signal(&varpd_load_cv);
+	mutex_exit(&varpd_load_lock);
+
+	return (ret);
+}
+
+int
+libvarpd_plugin_walk(varpd_handle_t *vph, libvarpd_plugin_walk_f func,
+    void *arg)
+{
+	varpd_impl_t *vip = (varpd_impl_t *)vph;
+	varpd_plugin_t *vpp;
+
+	mutex_enter(&vip->vdi_lock);
+	for (vpp = avl_first(&vip->vdi_plugins); vpp != NULL;
+	    vpp = AVL_NEXT(&vip->vdi_plugins, vpp)) {
+		if (func(vph, vpp->vpp_name, arg) != 0) {
+			mutex_exit(&vip->vdi_lock);
+			return (1);
+		}
+	}
+	mutex_exit(&vip->vdi_lock);
+	return (0);
+}
+
+void
+libvarpd_plugin_init(void)
+{
+	if (mutex_init(&varpd_load_lock, USYNC_THREAD | LOCK_RECURSIVE |
+	    LOCK_ERRORCHECK, NULL) != 0)
+		libvarpd_panic("failed to create varpd_load_lock");
+
+	if (cond_init(&varpd_load_cv, USYNC_THREAD, NULL) != 0)
+		libvarpd_panic("failed to create varpd_load_cv");
+
+	varpd_load_handle = NULL;
+}
+
+void
+libvarpd_plugin_fini(void)
+{
+	assert(varpd_load_handle == NULL);
+	if (mutex_destroy(&varpd_load_lock) != 0)
+		libvarpd_panic("failed to destroy varpd_load_lock");
+	if (cond_destroy(&varpd_load_cv) != 0)
+		libvarpd_panic("failed to destroy varpd_load_cv");
+}
+
+void
+libvarpd_plugin_prefork(void)
+{
+	mutex_enter(&varpd_load_lock);
+	while (varpd_load_handle != NULL)
+		(void) cond_wait(&varpd_load_cv, &varpd_load_lock);
+}
+
+void
+libvarpd_plugin_postfork(void)
+{
+	(void) cond_signal(&varpd_load_cv);
+	mutex_exit(&varpd_load_lock);
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_prop.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_prop.c
new file mode 100644
index 0000000000..abe65a8c5d
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_prop.c
@@ -0,0 +1,299 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * varpd property management
+ */
+
+#include <libvarpd_impl.h>
+#include <errno.h>
+#include <strings.h>
+#include <sys/mac.h>
+#include <umem.h>
+
+typedef struct varpd_prop_info {
+	varpd_impl_t		*vprop_vip;
+	varpd_instance_t	*vprop_instance;
+	uint_t			vprop_type;
+	uint_t			vprop_prot;
+	uint32_t		vprop_defsize;
+	uint32_t		vprop_psize;
+	char			vprop_name[LIBVARPD_PROP_NAMELEN];
+	uint8_t			vprop_default[LIBVARPD_PROP_SIZEMAX];
+	uint8_t			vprop_poss[LIBVARPD_PROP_SIZEMAX];
+} varpd_prop_info_t;
+
+/* Internal Properties */
+static int varpd_nintprops = 1;
+static const char *varpd_intprops[] = {
+	"search"
+};
+
+static int
+libvarpd_prop_get_search(varpd_prop_info_t *infop, void *buf, uint32_t *sizep)
+{
+	varpd_plugin_t *vpp = infop->vprop_instance->vri_plugin;
+	size_t nlen;
+
+	nlen = strlen(vpp->vpp_name) + 1;
+	if (nlen > *sizep)
+		return (EOVERFLOW);
+	*sizep = nlen;
+	(void) strlcpy(buf, vpp->vpp_name, *sizep);
+	return (0);
+}
+
+void
+libvarpd_prop_set_name(varpd_prop_handle_t *phdl, const char *name)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	(void) strlcpy(infop->vprop_name, name, OVERLAY_PROP_NAMELEN);
+}
+
+void
+libvarpd_prop_set_prot(varpd_prop_handle_t *phdl, overlay_prop_prot_t perm)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	infop->vprop_prot = perm;
+}
+
+void
+libvarpd_prop_set_type(varpd_prop_handle_t *phdl, overlay_prop_type_t type)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	infop->vprop_type = type;
+}
+
+int
+libvarpd_prop_set_default(varpd_prop_handle_t *phdl, void *buf, ssize_t len)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+
+	if (len > LIBVARPD_PROP_SIZEMAX)
+		return (E2BIG);
+
+	if (len < 0)
+		return (EOVERFLOW);
+
+	bcopy(buf, infop->vprop_default, len);
+	infop->vprop_defsize = len;
+	return (0);
+}
+
+void
+libvarpd_prop_set_nodefault(varpd_prop_handle_t *phdl)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+
+	infop->vprop_default[0] = '\0';
+	infop->vprop_defsize = 0;
+}
+
+void
+libvarpd_prop_set_range_uint32(varpd_prop_handle_t *phdl, uint32_t min,
+    uint32_t max)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	mac_propval_range_t *rangep = (mac_propval_range_t *)infop->vprop_poss;
+
+	if (rangep->mpr_count != 0 && rangep->mpr_type != MAC_PROPVAL_UINT32)
+		return;
+
+	if (infop->vprop_psize + sizeof (mac_propval_uint32_range_t) >
+	    sizeof (infop->vprop_poss))
+		return;
+
+	infop->vprop_psize += sizeof (mac_propval_uint32_range_t);
+	rangep->mpr_count++;
+	rangep->mpr_type = MAC_PROPVAL_UINT32;
+	rangep->u.mpr_uint32[rangep->mpr_count-1].mpur_min = min;
+	rangep->u.mpr_uint32[rangep->mpr_count-1].mpur_max = max;
+}
+
+void
+libvarpd_prop_set_range_str(varpd_prop_handle_t *phdl, const char *str)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	size_t len = strlen(str) + 1; /* Account for a null terminator */
+	mac_propval_range_t *rangep = (mac_propval_range_t *)infop->vprop_poss;
+	mac_propval_str_range_t *pstr = &rangep->u.mpr_str;
+
+	if (rangep->mpr_count != 0 && rangep->mpr_type != MAC_PROPVAL_STR)
+		return;
+
+	if (infop->vprop_psize + len > sizeof (infop->vprop_poss))
+		return;
+
+	rangep->mpr_count++;
+	rangep->mpr_type = MAC_PROPVAL_STR;
+	(void) strlcpy((char *)&pstr->mpur_data[pstr->mpur_nextbyte], str,
+	    sizeof (infop->vprop_poss) - infop->vprop_psize);
+	pstr->mpur_nextbyte += len;
+	infop->vprop_psize += len;
+}
+
+int
+libvarpd_prop_handle_alloc(varpd_handle_t *vph, varpd_instance_handle_t *inst,
+    varpd_prop_handle_t **phdlp)
+{
+	varpd_prop_info_t *infop;
+
+	infop = umem_alloc(sizeof (varpd_prop_info_t), UMEM_DEFAULT);
+	if (infop == NULL)
+		return (ENOMEM);
+
+	bzero(infop, sizeof (varpd_prop_info_t));
+	infop->vprop_vip = (varpd_impl_t *)vph;
+	infop->vprop_instance = (varpd_instance_t *)inst;
+
+	*phdlp = (varpd_prop_handle_t *)infop;
+	return (0);
+}
+
+void
+libvarpd_prop_handle_free(varpd_prop_handle_t *phdl)
+{
+	umem_free(phdl, sizeof (varpd_prop_info_t));
+}
+
+int
+libvarpd_prop_nprops(varpd_instance_handle_t *ihdl, uint_t *np)
+{
+	int ret;
+	varpd_instance_t *instp = (varpd_instance_t *)ihdl;
+
+	ret = instp->vri_plugin->vpp_ops->vpo_nprops(instp->vri_private, np);
+	if (ret != 0)
+		return (ret);
+	*np += varpd_nintprops;
+	return (0);
+}
+
+static int
+libvarpd_prop_info_fill_int_cb(varpd_handle_t *handle, const char *name,
+    void *arg)
+{
+	varpd_prop_handle_t *vph = arg;
+	libvarpd_prop_set_range_str(vph, name);
+	return (0);
+}
+
+static int
+libvarpd_prop_info_fill_int(varpd_prop_handle_t *vph, uint_t propid)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)vph;
+	if (propid >= varpd_nintprops)
+		abort();
+	libvarpd_prop_set_name(vph, varpd_intprops[0]);
+	libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_READ);
+	libvarpd_prop_set_type(vph, OVERLAY_PROP_T_STRING);
+	libvarpd_prop_set_nodefault(vph);
+	libvarpd_plugin_walk((varpd_handle_t *)infop->vprop_instance->vri_impl,
+	    libvarpd_prop_info_fill_int_cb, vph);
+	return (0);
+}
+
+int
+libvarpd_prop_info_fill(varpd_prop_handle_t *phdl, uint_t propid)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	varpd_instance_t *instp = infop->vprop_instance;
+	mac_propval_range_t *rangep = (mac_propval_range_t *)infop->vprop_poss;
+
+	infop->vprop_psize = sizeof (mac_propval_range_t);
+
+	bzero(rangep, sizeof (mac_propval_range_t));
+	if (propid < varpd_nintprops) {
+		return (libvarpd_prop_info_fill_int(phdl, propid));
+	} else {
+		varpd_plugin_t *vpp = instp->vri_plugin;
+		return (vpp->vpp_ops->vpo_propinfo(instp->vri_private,
+		    propid - varpd_nintprops, phdl));
+	}
+}
+
+int
+libvarpd_prop_info(varpd_prop_handle_t *phdl, const char **namep,
+    uint_t *typep, uint_t *protp, const void **defp, uint32_t *sizep,
+    const mac_propval_range_t **possp)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	if (namep != NULL)
+		*namep = infop->vprop_name;
+	if (typep != NULL)
+		*typep = infop->vprop_type;
+	if (protp != NULL)
+		*protp = infop->vprop_prot;
+	if (defp != NULL)
+		*defp = infop->vprop_default;
+	if (sizep != NULL)
+		*sizep = infop->vprop_psize;
+	if (possp != NULL)
+		*possp = (mac_propval_range_t *)infop->vprop_poss;
+	return (0);
+}
+
+int
+libvarpd_prop_get(varpd_prop_handle_t *phdl, void *buf, uint32_t *sizep)
+{
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	varpd_instance_t *instp = infop->vprop_instance;
+
+	if (infop->vprop_name[0] == '\0')
+		return (EINVAL);
+
+	if (strcmp(varpd_intprops[0], infop->vprop_name) == 0) {
+		/* search property */
+		return (libvarpd_prop_get_search(infop, buf, sizep));
+	}
+
+	return (instp->vri_plugin->vpp_ops->vpo_getprop(instp->vri_private,
+	    infop->vprop_name, buf, sizep));
+}
+
+int
+libvarpd_prop_set(varpd_prop_handle_t *phdl, const void *buf, uint32_t size)
+{
+	int i;
+	varpd_prop_info_t *infop = (varpd_prop_info_t *)phdl;
+	varpd_instance_t *instp = infop->vprop_instance;
+
+	if (infop->vprop_name[0] == '\0')
+		return (EINVAL);
+
+	for (i = 0; i < varpd_nintprops; i++) {
+		if (strcmp(infop->vprop_name, varpd_intprops[i]) == 0) {
+			return (EPERM);
+		}
+	}
+
+	return (instp->vri_plugin->vpp_ops->vpo_setprop(instp->vri_private,
+	    infop->vprop_name, buf, size));
+}
+
+void
+libvarpd_prop_door_convert(const varpd_prop_handle_t *phdl,
+    varpd_client_propinfo_arg_t *vcfap)
+{
+	const varpd_prop_info_t *infop = (const varpd_prop_info_t *)phdl;
+
+	vcfap->vcfa_type = infop->vprop_type;
+	vcfap->vcfa_prot = infop->vprop_prot;
+	vcfap->vcfa_defsize = infop->vprop_defsize;
+	vcfap->vcfa_psize = infop->vprop_psize;
+	bcopy(infop->vprop_name, vcfap->vcfa_name, LIBVARPD_PROP_NAMELEN);
+	bcopy(infop->vprop_default, vcfap->vcfa_default, LIBVARPD_PROP_SIZEMAX);
+	bcopy(infop->vprop_poss, vcfap->vcfa_poss, LIBVARPD_PROP_SIZEMAX);
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_provider.h b/usr/src/lib/varpd/libvarpd/common/libvarpd_provider.h
new file mode 100644
index 0000000000..64fa99d308
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_provider.h
@@ -0,0 +1,419 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBVARPD_PROVIDER_H
+#define	_LIBVARPD_PROVIDER_H
+
+/*
+ * varpd provider interface for lookup modules
+ *
+ * This header file defines all the structures and functions that a given lookup
+ * module needs to implement and perform its purpose. At this time, all of these
+ * interfaces are considered private to illumos and therefore are subject to
+ * change. At some point we will move to more broadly stabilize these interfaces
+ * and commit to them. Until such time, expect breakage for out of gate
+ * consumers.
+ *
+ * A plugin is a dynamic shared object that is placed inside of varpd's default
+ * module.
+ *
+ * The shared object must define an initializer, such as with #pragma init. This
+ * function will be run with the module is dlopened by libvarpd. In that init
+ * function, the function must allocate a varpd_plugin_register by calling
+ * libvarpd_plugin_alloc() and specifying VARPD_CURRENT_VERSION. If that
+ * succeeds, then it should proceed to fill out the registration and then call,
+ * libvarpd_plugin_register() with it. Regardless of whether it succeeds or
+ * fails, it should call libvarpd_plugin_free(). In the case of failure, there
+ * is not much that the module should do, other than log some message to the
+ * standard bunyan logger that exists.
+ *
+ * Once libvarpd_plugin_register() returns, the module should assume that any
+ * of the operations it defined in the operation vector may be called and
+ * therefore it is recommended that any other required initialization should be
+ * performed at that time.
+ *
+ * At this time, once a plugin is loaded, it will not be unloaded. Therefore,
+ * there is no corresponding requirement to unregister, though that may come in
+ * a future version.
+ *
+ * -----------------------------
+ * Plugin Types and Destinations
+ * -----------------------------
+ *
+ * There are two different kinds of plugins in this world, there are point to
+ * point plugins and there are dynamic plugins. The key difference is in how
+ * packets are routed through the system. In a point to point plugin, a single
+ * destination is used when the instance is started. In dynamic plugins,
+ * destinations are looked up as they are required and an instance of a plugin
+ * is required to provide that.
+ *
+ * These point to point plugins define a type of OVERLAY_TARGET_POINT and the
+ * dynamic plugins instead define a type of OVERLAY_TARGET_DYNAMIC.
+ *
+ * Encapsulation plugins have multiple types of destinations. They may require
+ * an Ethernet address (OVERLAY_PLUGIN_D_ETHERNET), IP address
+ * (OVERLAY_PLUGIN_D_IP), and a port (OVERLAY_PLUGIN_D_PORT). For example,
+ * consider vxlan, it requires an IP and a port; while a hypothetical nvgre,
+ * would only require an IP.
+ *
+ * A plugin is allowed to describe which of these fields that it supports and
+ * given which encapsulation plugin it is paired with, it can support a varying
+ * degree of properties. For example, consider the example of the direct plugin.
+ * It has a notion of a destination port and a destination IP. If it is paired
+ * with a plugin that only requires an IP, then it wouldn't need to show a
+ * property that's related to a destination port.
+ *
+ * ------------------
+ * Plugin Definitions
+ * ------------------
+ *
+ * A plugin is required to fill in both an operations vector and a series of
+ * additional metadata that it passed in to libvarpd_plugin_register(). The
+ * following lists all of the routines and their purposes. The full signatures
+ * are available in the body of the header file.
+ *
+ *   varpd_plugin_create_f
+ *
+ *   	Create a new instance of a plugin. Each instance refers to a different
+ *   	overlay device and thus a different overlay identifier. Each instance
+ *   	has its own property space and is unique. This function gives the chance
+ *   	for the plugin to create and provide any private data that it will
+ *   	require.
+ *
+ *   	In addition, the plugin is given the type of destination that is
+ *   	required and it is its job to determine whether or not it supports it.
+ *
+ *   varpd_plugin_destory_f
+ *
+ *   	This is the opposite of varpd_plugin_create_f. It is called to allow the
+ *   	plugin to reclaim any resources with the private argument that it passed
+ *   	out as part of the destroy function.
+ *
+ *   varpd_plugin_start_f
+ *
+ *   	This routine is called to indicate that an instance should be started.
+ *   	This is a plugin's chance to verify that it has all of its required
+ *   	properties set and to take care of any action that needs to be handled
+ *   	to begin the plugin. After this point it will be legal to have the
+ *   	varpd_plugin_default_f, varpd_plugin_lookup_f, varpd_plugin_arp_f and
+ *   	varpd_plugin_dhcp_f endpoints called.
+ *
+ *   varpd_plugin_stop_f
+ *
+ *   	This routine is called to indicate that an instance is stopping, it is
+ *   	the opposite of varpd_plugin_start_f. This is a chance to clean up
+ *   	resources that are a side effect of having started the instance.
+ *
+ *   varpd_plugin_default_f
+ *
+ *   	This routine is defined by plugins of type OVERLAY_TARGET_POINT. It is
+ *   	used to answer the question of where should all traffic for this
+ *   	instance be destined. Plugins of type OVERLAY_TARGET_DYNAMIC should
+ *   	leave this entry set to NULL.
+ *
+ *   	On success, the default routine should return VARPD_LOOKUP_OK. On
+ *   	failure, it should return the macro VARPD_LOOKUP_DROP.
+ *
+ *   varpd_plugin_lookup_f
+ *
+ *   	This routine must be defined by plugins of type OVERLAY_TARGET_DYNAMIC.
+ *   	It is used to lookup the destination for a given request. Each request
+ *   	comes in with its own MAC address this allows a plugin to direct it to
+ *   	any remote location.
+ *
+ *   	This is designed as an asynchronous API. Once a lookup is completed it
+ *   	should call libvarpd_plugin_query_reply() and pass as the second
+ *   	argument either VARPD_LOOKUP_OK to indicate that it went alright or it
+ *   	should reply VARPD_LOOKUP_DROP to indicate that the packet should be
+ *   	dropped.
+ *
+ *   	In addition, there are several utility routines that can take care of
+ *   	various kinds of traffic automatically. For example, if an ARP, NDP, or
+ *   	DHCP packet comes in, there are utilities such as
+ *   	libvarpd_plugin_proxy_arp(), libvarpd_plugin_proxy_ndp() and
+ *   	libvarpd_plugin_proxy_dhcp(), which allows the system to do the heavy
+ *   	lifting of validating the packet once it finds that it matches certain
+ *   	properties.
+ *
+ *   varpd_plugin_arp_f
+ *
+ *   	This is an optional entry for plugins of type OVERLAY_TARGET_DYNAMIC.
+ *   	This is called after a plugin calls libvarpd_plugin_proxy_arp() and is
+ *   	used to ask the plugin to perform an ARP or NDP query. The type of query
+ *   	is passed in in the third argument, the only valid value for which will
+ *   	be VARPD_QTYPE_ETHERNET, to indicate we're doing an Ethernet lookup.
+ *
+ *   	The layer three IP address that is being looked up will be included in
+ *   	the struct sockaddr. The sockaddr(3SOCKET)'s sa_family will be set to
+ *   	indicate the type, eg. AF_INET or AF_INET6 and that will indicate the
+ *   	kind of sockaddr that will be used. For more information see
+ *   	sockaddr(3SOCKET). The implementation ensures that enough space for the
+ *   	link layer address will exist.
+ *
+ *   	This is an asynchronous lookup. Once the answer has been written, a
+ *   	plugin should call libvarpd_plugin_arp_reply and if it was successful,
+ *   	VARPD_LOOKUP_OK should be passed in and if it failed, VARPD_LOOKUP_DROP
+ *   	should be passed in instead.
+ *
+ *   varpd_plugin_dhcp_f
+ *
+ *   	This is an optional entry for plugins of type OVERLAY_TARGET_DYNAMIC.
+ *   	This is called after a plugin calls the libvarpd_plugin_proxy_dhcp() and
+ *   	is used to ask the plugin to determine where is the DHCP server that
+ *   	this packet should actually be sent to. What is happening here is that
+ *   	rather than broadcast the initial DHCP request, we instead unicast it to
+ *   	a specified DHCP server that this operation vector indicates.
+ *
+ *   	The plugin is given a type, the same as the ARP plugin which indicates
+ *   	the kind of link layer address, the only valid type is
+ *   	VARPD_QTYPE_ETHERNET, other types should be rejected. Then, like the arp
+ *   	entry point, the dhcp entry point should determine the link layer
+ *   	address of the DHCP server and write that out in the appropriate memory
+ *   	and call libvarpd_plugin_dhcp_reply() when done. Similar to the arp
+ *   	entry point, it should use VARPD_LOOKUP_OK to indicate that it was
+ *   	filled in and VARPD_LOOKUP_DROP to indicate that it was not.
+ *
+ *   varpd_plugin_nprops_f
+ *
+ *   	This is used by a plugin to indicate the number of properties that
+ *   	should exist for this instance. Recall from the section that Plugin
+ *   	types and Destinations, that the number of entries here may vary. As
+ *   	such, the plugin should return the number that is appropriate for the
+ *   	instance.
+ *
+ *   	This number will be used to obtain information about a property via the
+ *   	propinfo functions. However, the getprop and setprop interfaces will
+ *   	always use names to indicate the property it is getting and setting.
+ *   	This difference is structured this way to deal with property discovery
+ *   	and to make the getprop and setprop interfaces slightly easier for other
+ *   	parts of the broader varpd/dladm infrastructure.
+ *
+ *   varpd_plugin_propinfo_f
+ *
+ *   	This interface is used to get information about a property, the property
+ *   	that information is being requested for is being passed in via the
+ *   	second argument. Here, callers should set properties such as the name,
+ *   	the protection, whether or not the property is required, set any default
+ *   	value, if it exist, and if relevant, set the valid range of values.
+ *
+ *   varpd_plugin_getprop_f
+ *
+ *   	This is used to get the value of a property, if it is set. The passed in
+ *   	length indicates the length of the buffer that is used for updating
+ *   	properties. If it is not of sufficient size, the function should return
+ *   	an error and not update the buffer. Otherwise, it should update the size
+ *   	pointer with the valid size.
+ *
+ *   varpd_plugin_setprop_f
+ *
+ *   	This is used to set the value of a property. An endpoint should validate
+ *   	that the property is valid before updating it. In addition, it should
+ *   	update its state as appropriate.
+ *
+ *   varpd_plugin_save_f
+ *
+ *   	This is used to serialize the state of a given instance of a plugin such
+ *   	that if varpd crashes, it can be recovered. The plugin should write all
+ *   	state into the nvlist that it is passed in, it may use any keys and
+ *   	values that it wants. The only consumer of that nvlist will be the
+ *   	plugin itself when the restore endpoint is called.
+ *
+ *   varpd_plugin_restore_f
+ *
+ *   	This is called by the server to restore an instance that used to exist,
+ *   	but was lost due to a crash. This is a combination of calling create and
+ *   	setting properties. The plugin should restore any private state that it
+ *   	can find recorded from the nvlist. The only items in the nvlist will be
+ *   	those that were written out during a previous call to
+ *   	varpd_plugin_save_f.
+ *
+ *
+ * Once all of these interfaces are implemented, the plugin should define the
+ * following members in the varpd_plugin_register_t.
+ *
+ *   vpr_version
+ *
+ *   	This indicates the version of the plugin. Plugins should set this to the
+ *   	macro VARPD_CURRENT_VERSION.
+ *
+ *   vpr_mode
+ *
+ *   	This indicates the mode of the plugin. The plugin's mode should be one
+ *   	of OVERLAY_TARGET_POINT and OVERLAY_TARGET_DYNAMIC. For more discussion
+ *   	of these types and the differences, see the section on Plugin Types and
+ *   	Destinations.
+ *
+ *   vpr_name
+ *
+ *   	This is the name of the plugin. This is how users will refer to it in
+ *   	the context of running dladm(1M) commands. Note, this name must be
+ *   	unique across the different plugins, as it will cause others with the
+ *   	same name not to be registered.
+ *
+ *   vpr_ops
+ *
+ *   	This is the operations vector as described above. Importantly, the
+ *   	member vpo_callbacks must be set to zero, this is being used for future
+ *   	expansion of the structure.
+ *
+ *
+ * --------------------------------------------------
+ * Downcalls, Upcalls, and Synchronization Guarantees
+ * --------------------------------------------------
+ *
+ * Every instance of a plugin is independent. Calls into a plugin may be made
+ * for different instances in parallel. Any necessary locking is left to the
+ * plugin module. Within an instance, various calls may come in parallel.
+ *
+ * The primary guarantees are that none of the varpd_plugin_save_f,
+ * varpd_plugin_lookup_f, varpd_default_f, varpd_plugin_arp_f, and
+ * varpd_plugin_dhcp_f will be called until after a call to varpd_plugin_start_f
+ * has been called. Similarly, they will not be called after a call to
+ * vardp_plugin_stop_f.
+ *
+ * The functions documented in this header may be called back into from any
+ * context, including from the operation vectors.
+ */
+
+#include <bunyan.h>
+#include <libvarpd.h>
+#include <libnvpair.h>
+#include <sys/socket.h>
+#include <sys/overlay_target.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	VARPD_VERSION_ONE	1
+#define	VARPD_CURRENT_VERSION	VARPD_VERSION_ONE
+
+typedef struct __varpd_provier_handle varpd_provider_handle_t;
+typedef struct __varpd_query_handle varpd_query_handle_t;
+typedef struct __varpd_arp_handle varpd_arp_handle_t;
+typedef struct __varpd_dhcp_handle varpd_dhcp_handle_t;
+
+typedef int (*varpd_plugin_create_f)(varpd_provider_handle_t *, void **,
+    overlay_plugin_dest_t);
+typedef int (*varpd_plugin_start_f)(void *);
+typedef void (*varpd_plugin_stop_f)(void *);
+typedef void (*varpd_plugin_destroy_f)(void *);
+
+#define	VARPD_LOOKUP_OK		(0)
+#define	VARPD_LOOKUP_DROP	(-1)
+typedef int (*varpd_plugin_default_f)(void *, overlay_target_point_t *);
+typedef void (*varpd_plugin_lookup_f)(void *, varpd_query_handle_t *,
+    const overlay_targ_lookup_t *, overlay_target_point_t *);
+
+#define	VARPD_QTYPE_ETHERNET	0x0
+typedef void (*varpd_plugin_arp_f)(void *, varpd_arp_handle_t *, int,
+    const struct sockaddr *, uint8_t *);
+typedef void (*varpd_plugin_dhcp_f)(void *, varpd_dhcp_handle_t *, int,
+    const overlay_targ_lookup_t *, uint8_t *);
+
+typedef int (*varpd_plugin_nprops_f)(void *, uint_t *);
+typedef int (*varpd_plugin_propinfo_f)(void *, const uint_t,
+    varpd_prop_handle_t *);
+typedef int (*varpd_plugin_getprop_f)(void *, const char *, void *, uint32_t *);
+typedef int (*varpd_plugin_setprop_f)(void *, const char *, const void *,
+    const uint32_t);
+
+typedef int (*varpd_plugin_save_f)(void *, nvlist_t *);
+typedef int (*varpd_plugin_restore_f)(nvlist_t *, varpd_provider_handle_t *,
+    overlay_plugin_dest_t, void **);
+
+typedef struct varpd_plugin_ops {
+	uint_t			vpo_callbacks;
+	varpd_plugin_create_f	vpo_create;
+	varpd_plugin_start_f	vpo_start;
+	varpd_plugin_stop_f	vpo_stop;
+	varpd_plugin_destroy_f	vpo_destroy;
+	varpd_plugin_default_f	vpo_default;
+	varpd_plugin_lookup_f	vpo_lookup;
+	varpd_plugin_nprops_f	vpo_nprops;
+	varpd_plugin_propinfo_f	vpo_propinfo;
+	varpd_plugin_getprop_f	vpo_getprop;
+	varpd_plugin_setprop_f	vpo_setprop;
+	varpd_plugin_save_f	vpo_save;
+	varpd_plugin_restore_f	vpo_restore;
+	varpd_plugin_arp_f	vpo_arp;
+	varpd_plugin_dhcp_f	vpo_dhcp;
+} varpd_plugin_ops_t;
+
+typedef struct varpd_plugin_register {
+	uint_t		vpr_version;
+	uint_t		vpr_mode;
+	const char	*vpr_name;
+	const varpd_plugin_ops_t *vpr_ops;
+} varpd_plugin_register_t;
+
+extern varpd_plugin_register_t *libvarpd_plugin_alloc(uint_t, int *);
+extern void libvarpd_plugin_free(varpd_plugin_register_t *);
+extern int libvarpd_plugin_register(varpd_plugin_register_t *);
+
+/*
+ * Blowing up and logging
+ */
+extern void libvarpd_panic(const char *, ...) __NORETURN;
+extern const bunyan_logger_t *libvarpd_plugin_bunyan(varpd_provider_handle_t *);
+
+/*
+ * Misc. Information APIs
+ */
+extern uint64_t libvarpd_plugin_vnetid(varpd_provider_handle_t *);
+
+/*
+ * Lookup Replying query and proxying
+ */
+extern void libvarpd_plugin_query_reply(varpd_query_handle_t *, int);
+
+extern void libvarpd_plugin_proxy_arp(varpd_provider_handle_t *,
+    varpd_query_handle_t *, const overlay_targ_lookup_t *);
+extern void libvarpd_plugin_proxy_ndp(varpd_provider_handle_t *,
+    varpd_query_handle_t *, const overlay_targ_lookup_t *);
+extern void libvarpd_plugin_arp_reply(varpd_arp_handle_t *, int);
+
+extern void libvarpd_plugin_proxy_dhcp(varpd_provider_handle_t *,
+    varpd_query_handle_t *, const overlay_targ_lookup_t *);
+extern void libvarpd_plugin_dhcp_reply(varpd_dhcp_handle_t *, int);
+
+
+/*
+ * Property information callbacks
+ */
+extern void libvarpd_prop_set_name(varpd_prop_handle_t *, const char *);
+extern void libvarpd_prop_set_prot(varpd_prop_handle_t *, overlay_prop_prot_t);
+extern void libvarpd_prop_set_type(varpd_prop_handle_t *, overlay_prop_type_t);
+extern int libvarpd_prop_set_default(varpd_prop_handle_t *, void *, ssize_t);
+extern void libvarpd_prop_set_nodefault(varpd_prop_handle_t *);
+extern void libvarpd_prop_set_range_uint32(varpd_prop_handle_t *, uint32_t,
+    uint32_t);
+extern void libvarpd_prop_set_range_str(varpd_prop_handle_t *, const char *);
+
+/*
+ * Various injecting and invalidation routines
+ */
+extern void libvarpd_inject_varp(varpd_provider_handle_t *, const uint8_t *,
+    const overlay_target_point_t *);
+extern void libvarpd_inject_arp(varpd_provider_handle_t *, const uint16_t,
+    const uint8_t *, const struct in_addr *, const uint8_t *);
+extern void libvarpd_fma_degrade(varpd_provider_handle_t *, const char *);
+extern void libvarpd_fma_restore(varpd_provider_handle_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBVARPD_PROVIDER_H */
diff --git a/usr/src/lib/varpd/libvarpd/common/libvarpd_util.c b/usr/src/lib/varpd/libvarpd/common/libvarpd_util.c
new file mode 100644
index 0000000000..e21fed2126
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/libvarpd_util.c
@@ -0,0 +1,97 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <libvarpd_impl.h>
+#include <assert.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <dirent.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+const char *
+libvarpd_isaext(void)
+{
+#if defined(__sparc)
+#if defined(__sparcv9)
+	return ("64");
+#else	/* __sparcv9 */
+	return ("");
+#endif /* __sparvc9 */
+#elif defined(__amd64)
+	return ("64");
+#elif defined(__i386)
+	return ("");
+#else
+#error	"unkonwn ISA"
+#endif
+}
+
+int
+libvarpd_dirwalk(varpd_impl_t *vip, const char *path, const char *suffix,
+    libvarpd_dirwalk_f func, void *arg)
+{
+	int ret;
+	size_t slen;
+	char *dirpath, *filepath;
+	DIR *dirp;
+	struct dirent *dp;
+	assert(vip != NULL && path != NULL);
+
+	if (asprintf(&dirpath, "%s/%s", path, libvarpd_isaext()) == -1)
+		return (errno);
+
+	if ((dirp = opendir(dirpath)) == NULL) {
+		ret = errno;
+		return (ret);
+	}
+
+	slen = strlen(suffix);
+	for (;;) {
+		size_t len;
+
+		errno = 0;
+		dp = readdir(dirp);
+		if (dp == NULL) {
+			ret = errno;
+			break;
+		}
+
+		len = strlen(dp->d_name);
+		if (len <= slen)
+			continue;
+
+		if (strcmp(suffix, dp->d_name + (len - slen)) != 0)
+			continue;
+
+		if (asprintf(&filepath, "%s/%s", dirpath, dp->d_name) == -1) {
+			ret = errno;
+			break;
+		}
+
+		if (func(vip, filepath, arg) != 0) {
+			free(filepath);
+			ret = 0;
+			break;
+		}
+
+		free(filepath);
+	}
+
+	(void) closedir(dirp);
+	free(dirpath);
+	return (ret);
+}
diff --git a/usr/src/lib/varpd/libvarpd/common/llib-lvarpd b/usr/src/lib/varpd/libvarpd/common/llib-lvarpd
new file mode 100644
index 0000000000..85150d3463
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/llib-lvarpd
@@ -0,0 +1,19 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+#include <libvarpd.h>
diff --git a/usr/src/lib/varpd/libvarpd/common/mapfile-plugin b/usr/src/lib/varpd/libvarpd/common/mapfile-plugin
new file mode 100644
index 0000000000..8cef7f669f
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/mapfile-plugin
@@ -0,0 +1,57 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_SCOPE {
+    global:
+	libvarpd_fma_degrade		{ FLAGS = EXTERN };
+	libvarpd_inject_arp		{ FLAGS = EXTERN };
+	libvarpd_inject_ndp		{ FLAGS = EXTERN };
+	libvarpd_inject_varp		{ FLAGS = EXTERN };
+	libvarpd_fma_restore		{ FLAGS = EXTERN };
+	libvarpd_panic			{ FLAGS = EXTERN };
+	libvarpd_plugin_alloc		{ FLAGS = EXTERN };
+	libvarpd_plugin_arp_reply	{ FLAGS = EXTERN };
+	libvarpd_plugin_dhcp_reply	{ FLAGS = EXTERN };
+	libvarpd_plugin_free		{ FLAGS = EXTERN };
+	libvarpd_plugin_proxy_arp	{ FLAGS = EXTERN };
+	libvarpd_plugin_proxy_dhcp	{ FLAGS = EXTERN };
+	libvarpd_plugin_proxy_ndp	{ FLAGS = EXTERN };
+	libvarpd_plugin_query_reply	{ FLAGS = EXTERN };
+	libvarpd_plugin_register	{ FLAGS = EXTERN };
+	libvarpd_plugin_vnetid		{ FLAGS = EXTERN };
+	libvarpd_prop_set_name		{ FLAGS = EXTERN };
+	libvarpd_prop_set_prot		{ FLAGS = EXTERN };
+	libvarpd_prop_set_type		{ FLAGS = EXTERN };
+	libvarpd_prop_set_default	{ FLAGS = EXTERN };
+	libvarpd_prop_set_nodefault	{ FLAGS = EXTERN };
+	libvarpd_prop_set_range_uint32	{ FLAGS = EXTERN };
+	libvarpd_prop_set_rangestr	{ FLAGS = EXTERN };
+};
diff --git a/usr/src/lib/varpd/libvarpd/common/mapfile-vers b/usr/src/lib/varpd/libvarpd/common/mapfile-vers
new file mode 100644
index 0000000000..7aa930cb54
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/common/mapfile-vers
@@ -0,0 +1,113 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate {
+    global:
+	libvarpd_c_create;
+	libvarpd_c_destroy;
+	libvarpd_c_instance_activate;
+	libvarpd_c_instance_create;
+	libvarpd_c_instance_destroy;
+	libvarpd_c_prop_nprops;
+	libvarpd_c_prop_handle_alloc;
+	libvarpd_c_prop_handle_free;
+	libvarpd_c_prop_info_fill;
+	libvarpd_c_prop_info_fill_by_name;
+	libvarpd_c_prop_info;
+	libvarpd_c_prop_get;
+	libvarpd_c_prop_set;
+
+	libvarpd_c_instance_lookup;
+	libvarpd_c_instance_target_mode;
+	libvarpd_c_instance_cache_flush;
+	libvarpd_c_instance_cache_delete;
+	libvarpd_c_instance_cache_get;
+	libvarpd_c_instance_cache_set;
+	libvarpd_c_instance_cache_walk;
+
+	libvarpd_create;
+	libvarpd_destroy;
+
+	libvarpd_door_server_create;
+	libvarpd_door_server_destroy;
+
+	libvarpd_fma_degrade;
+	libvarpd_fma_restore;
+
+	libvarpd_inject_varp;
+	libvarpd_inject_arp;
+
+	libvarpd_instance_activate;
+	libvarpd_instance_create;
+	libvarpd_instance_destroy;
+	libvarpd_instance_lookup;
+	libvarpd_instance_id;
+
+	libvarpd_panic;
+
+	libvarpd_persist_disable;
+	libvarpd_persist_enable;
+	libvarpd_persist_restore;
+
+	libvarpd_plugin_alloc;
+	libvarpd_plugin_load;
+	libvarpd_plugin_free;
+	libvarpd_plugin_arp_reply;
+	libvarpd_plugin_dhcp_reply;
+	libvarpd_plugin_query_reply;
+	libvarpd_plugin_proxy_arp;
+	libvarpd_plugin_proxy_dhcp;
+	libvarpd_plugin_proxy_ndp;
+	libvarpd_plugin_register;
+	libvarpd_plugin_walk;
+	libvarpd_plugin_vnetid;
+
+	libvarpd_prop_set_default;
+	libvarpd_prop_set_nodefault;
+	libvarpd_prop_set_name;
+	libvarpd_prop_set_prot;
+	libvarpd_prop_set_range_uint32;
+	libvarpd_prop_set_range_str;
+	libvarpd_prop_set_type;
+
+	libvarpd_prop_handle_alloc;
+	libvarpd_prop_handle_free;
+	libvarpd_prop_nprops;
+	libvarpd_prop_info_fill;
+	libvarpd_prop_info;
+	libvarpd_prop_get;
+	libvarpd_prop_set;
+
+	libvarpd_overlay_lookup_quiesce;
+	libvarpd_overlay_lookup_run;
+    local:
+	*;
+};
diff --git a/usr/src/lib/varpd/libvarpd/i386/Makefile b/usr/src/lib/varpd/libvarpd/i386/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/libvarpd/sparc/Makefile b/usr/src/lib/varpd/libvarpd/sparc/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/libvarpd/sparcv9/Makefile b/usr/src/lib/varpd/libvarpd/sparcv9/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/libvarpd/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/varpd/svp/Makefile b/usr/src/lib/varpd/svp/Makefile
new file mode 100644
index 0000000000..275f07bf8b
--- /dev/null
+++ b/usr/src/lib/varpd/svp/Makefile
@@ -0,0 +1,40 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include		../../Makefile.lib
+
+SUBDIRS =	$(MACH)
+$(BUILD64)SUBDIRS +=	$(MACH64)
+
+all :=		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install :=	TARGET = install
+lint :=		TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+install_h:
+
+check:
+
+$(SUBDIRS):  FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../../Makefile.targ
diff --git a/usr/src/lib/varpd/svp/Makefile.com b/usr/src/lib/varpd/svp/Makefile.com
new file mode 100644
index 0000000000..15b6540e74
--- /dev/null
+++ b/usr/src/lib/varpd/svp/Makefile.com
@@ -0,0 +1,54 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+LIBRARY =	libvarpd_svp.a
+VERS =		.1
+OBJECTS =	libvarpd_svp.o \
+		libvarpd_svp_conn.o \
+		libvarpd_svp_crc.o \
+		libvarpd_svp_host.o \
+		libvarpd_svp_loop.o \
+		libvarpd_svp_remote.o \
+		libvarpd_svp_shootdown.o \
+		libvarpd_svp_timer.o
+
+include ../../../Makefile.lib
+include ../../Makefile.plugin
+
+LIBS =		$(DYNLIB)
+
+#
+# Yes, this isn't a command, but libcmdutils does have the list(9F)
+# functions and better to use that then compile list.o yet again
+# ourselves... probably.
+#
+LDLIBS +=	-lc -lumem -lnvpair -lsocket -lnsl -lavl \
+		-lcmdutils -lidspace -lbunyan
+CPPFLAGS +=	-I../common
+
+LINTFLAGS +=	-erroff=E_BAD_PTR_CAST_ALIGN
+LINTFLAGS64 +=	-erroff=E_BAD_PTR_CAST_ALIGN
+SRCDIR =	../common
+
+C99MODE=	-xc99=%all
+C99LMODE=	-Xc99=%all
+
+.KEEP_STATE:
+
+all:	$(LIBS)
+
+lint:	lintcheck
+
+include ../../../Makefile.targ
diff --git a/usr/src/lib/varpd/svp/amd64/Makefile b/usr/src/lib/varpd/svp/amd64/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/svp/amd64/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp.c b/usr/src/lib/varpd/svp/common/libvarpd_svp.c
new file mode 100644
index 0000000000..58828065a1
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp.c
@@ -0,0 +1,1138 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+/*
+ * This plugin implements the SDC VXLAN Protocol (SVP).
+ *
+ * This plugin is designed to work with a broader distributed system that
+ * mainains a database of mappings and provides a means of looking up data and
+ * provides a stream of updates. While it is named after VXLAN, there isn't
+ * anything specific to VXLAN baked into the protocol at this time, other than
+ * that it requires both an IP address and a port; however, if there's a good
+ * reason to support others here, we can modify that.
+ *
+ * -----------
+ * Terminology
+ * -----------
+ *
+ * Throughout this module we refer to a few different kinds of addresses:
+ *
+ *    VL3
+ *
+ * 	A VL3 address, or virtual layer 3, refers to the layer three addreses
+ * 	that are used by entities on an overlay network. As far as we're
+ * 	concerned that means that this is the IP address of an interface on an
+ * 	overlay network.
+ *
+ *    VL2
+ *
+ *    	A VL2 address, or a virtual layer 2, referes to the link-layer addresses
+ *    	that are used by entities on an overlay network. As far as we're
+ *    	concerned that means that this is the MAC addresses of an interface on
+ *    	an overlay network.
+ *
+ *    UL3
+ *
+ *    	A UL3, or underlay layer 3, refers to the layer three (IP) address on
+ *    	the underlay network.
+ *
+ * The svp plugin provides lookups from VL3->VL2, eg. the equivalent of an ARP
+ * or NDP query, and then also provides VL2->UL3 lookups.
+ *
+ * -------------------
+ * Protocol Operations
+ * -------------------
+ *
+ * The svp protocol is defined in lib/varpd/svp/common/libvarpd_svp_prot.h. It
+ * defines the basic TCP protocol that we use to communicate to hosts. At this
+ * time, it is not quite 100% implemented in both this plug-in and our primary
+ * server, sdc-portolan (see https://github.com/joyent/sdc-portolan).
+ *
+ * At this time, we don't quite support everything that we need to. Including
+ * the SVP_R_BULK_REQ and SVP_R_SHOOTDOWN.
+ *
+ * ---------------------------------
+ * General Design and Considerations
+ * ---------------------------------
+ *
+ * Every instance of the svp plugin requires the hostname and port of a server
+ * to contact. Though, we have co-opted the port 1296 (the year of the oldest
+ * extant portolan) as our default port.
+ *
+ * Each of the different instance of the plugins has a corresponding remote
+ * backend. The remote backend represents the tuple of the [ host, port ].
+ * Different instances that share the same host and port tuple will use the same
+ * backend.
+ *
+ * The backend is actually in charge of performing lookups, resolving and
+ * updating the set of remote hosts based on the DNS resolution we've been
+ * provided, and taking care of things like shootdowns.
+ *
+ * The whole plugin itself maintains an event loop and a number of threads to
+ * service that event loop. On top of that event loop, we have a simple timer
+ * backend that ticks at one second intervals and performs various callbacks,
+ * such as idle query timers, DNS resolution, connection backoff, etc. Each of
+ * the remote hosts that we obtain is wrapped up in an svp_conn_t, which manages
+ * the connection state, reconnecting, etc.
+ *
+ * All in all, the general way that this all looks like is:
+ *
+ *  +----------------------------+
+ *  | Plugin Instance            |
+ *  | svp_t                      |
+ *  |                            |
+ *  | varpd_provider_handle_t * -+-> varpd handle
+ *  | uint64_t               ----+-> varpd ID
+ *  | char *                 ----+-> remote host
+ *  | uint16_t               ----+-> remote port
+ *  | svp_remote_t *   ---+------+-> remote backend
+ *  +---------------------+------+
+ *                        |
+ *                        v
+ *   +----------------------+                   +----------------+
+ *   | Remote backend       |------------------>| Remove Backend |---> ...
+ *   | svp_remote_t         |                   | svp_remote_t   |
+ *   |                      |                   +----------------+
+ *   | svp_remote_state_t --+-> state flags
+ *   | svp_degrade_state_t -+-> degraded reason
+ *   | struct addrinfo *  --+-> resolved hosts
+ *   | uint_t            ---+-> active hosts
+ *   | uint_t            ---+-> DNS generation
+ *   | uint_t            ---+-> Reference count
+ *   | uint_t            ---+-> active conns
+ *   | uint_t            ---+-> degraded conns
+ *   | list_t        ---+---+-> connection list
+ *   +------------------+---+
+ *                      |
+ *                      +------------------------------+-----------------+
+ *                      |                              |                 |
+ *                      v                              v                 v
+ *   +-------------------+                       +----------------
+ *   | SVP Connection    |                       | SVP connection |     ...
+ *   | svp_conn_t        |                       | svp_conn_t     |
+ *   |                   |                       +----------------+
+ *   | svp_event_t   ----+-> event loop handle
+ *   | svp_timer_t   ----+-> backoff timer
+ *   | svp_timer_t   ----+-> query timer
+ *   | int           ----+-> socket fd
+ *   | uint_t        ----+-> generation
+ *   | uint_t        ----+-> current backoff
+ *   | svp_conn_flags_t -+-> connection flags
+ *   | svp_conn_state_t -+-> connection state
+ *   | svp_conn_error_t -+-> connection error
+ *   | int            ---+-> last errrno
+ *   | hrtime_t       ---+-> activity timestamp
+ *   | svp_conn_out_t ---+-> outgoing data state
+ *   | svp_conn_in_t  ---+-> incoming data state
+ *   | list_t      ---+--+-> active queries
+ *   +----------------+--+
+ *                    |
+ *                    +----------------------------------+-----------------+
+ *                    |                                  |                 |
+ *                    v                                  v                 v
+ *   +--------------------+                       +-------------+
+ *   | SVP Query          |                       | SVP Query   |         ...
+ *   | svp_query_t        |                       | svp_query_t |
+ *   |                    |                       +-------------+
+ *   | svp_query_f     ---+-> callback function
+ *   | void *          ---+-> callback arg
+ *   | svp_query_state_t -+-> state flags
+ *   | svp_req_t       ---+-> svp prot. header
+ *   | svp_query_data_t --+-> read data
+ *   | svp_query_data_t --+-> write data
+ *   | svp_status_t    ---+-> request status
+ *   +--------------------+
+ *
+ * The svp_t is the instance that we assoicate with varpd. The instance itself
+ * maintains properties and then when it's started associates with an
+ * svp_remote_t, which is the remote backend. The remote backend itself,
+ * maintains the DNS state and spins up and downs connections based on the
+ * results from DNS. By default, we query DNS every 30 seconds. For more on the
+ * connection life cycle, see the next section.
+ *
+ * By default, each connection maintains its own back off timer and list of
+ * queries it's servicing. Only one request is generally outstanding at a time
+ * and requests are round robined across the various connections.
+ *
+ * The query itself represents the svp request that's going on and keep track of
+ * its state and is a place for data that's read and written to as part of the
+ * request.
+ *
+ * Connections maintain a query timer such that if we have not received data on
+ * a socket for a certain amount of time, we kill that socket and begin a
+ * reconnection cycle with backoff.
+ *
+ * ------------------------
+ * Connection State Machine
+ * ------------------------
+ *
+ * We have a connection pool that's built upon DNS records. DNS describes the
+ * membership of the set of remote peers that make up our pool and we maintain
+ * one connection to each of them.  In addition, we maintain an exponential
+ * backoff for each peer and will attempt to reconect immediately before backing
+ * off. The following are the valid states that a connection can be in:
+ *
+ * 	SVP_CS_ERROR		An OS error has occurred on this connection,
+ * 				such as failure to create a socket or associate
+ * 				the socket with an event port. We also
+ * 				transition all connections to this state before
+ * 				we destroy them.
+ *
+ *	SVP_CS_INITIAL		This is the initial state of a connection, all
+ *				that should exist is an unbound socket.
+ *
+ *	SVP_CS_CONNECTING	A call to connect has been made and we are
+ *				polling for it to complete.
+ *
+ *	SVP_CS_BACKOFF		A connect attempt has failed and we are
+ *				currently backing off, waiting to try again.
+ *
+ *	SVP_CS_ACTIVE		We have successfully connected to the remote
+ *				system.
+ *
+ *	SVP_CS_WINDDOWN		This connection is going to valhalla. In other
+ *				words, a previously active connection is no
+ *				longer valid in DNS, so we should curb our use
+ *				of it, and reap it as soon as we have other
+ *				active connections.
+ *
+ * The following diagram attempts to describe our state transition scheme, and
+ * when we transition from one state to the next.
+ *
+ *                               |
+ *                               * New remote IP from DNS resolution,
+ *                               | not currently active in the system.
+ *                               |
+ *                               v                                Socket Error,
+ *                       +----------------+                       still in DNS
+ *  +----------------<---| SVP_CS_INITIAL |<----------------------*-----+
+ *  |                    +----------------+                             |
+ *  |                            System  |                              |
+ *  | Connection . . . . .       success *               Successful     |
+ *  | failed             .               |               connect()      |
+ *  |               +----*---------+     |        +-----------*--+      |
+ *  |               |              |     |        |              |      |
+ *  |               V              ^     v        ^              V      ^
+ *  |  +----------------+         +-------------------+     +---------------+
+ *  +<-| SVP_CS_BACKOFF |         | SVP_CS_CONNECTING |     | SVP_CS_ACTIVE |
+ *  |  +----------------+         +-------------------+     +---------------+
+ *  |               V              ^  V                       V  V
+ *  | Backoff wait  *              |  |                       |  * Removed
+ *  v interval      +--------------+  +-----------------<-----+  | from DNS
+ *  | finished                        |                          |
+ *  |                                 V                          |
+ *  |                                 |                          V
+ *  |                                 |            +-----------------+
+ *  +----------------+----------<-----+-------<----| SVP_CS_WINDDOWN |
+ *                   |                             +-----------------+
+ *                   * . . .   Fatal system, not
+ *                   |         socket error or
+ *                   V         quiesced after
+ *           +--------------+  removal from DNS
+ *           | SVP_CS_ERROR |
+ *           +--------------+
+ *                   |
+ *                   * . . . Removed from DNS
+ *                   v
+ *            +------------+
+ *            | Connection |
+ *            | Destroyed  |
+ *            +------------+
+ *
+ * --------------------------
+ * Connection Event Injection
+ * --------------------------
+ *
+ * For each connection that exists in the system, we have a timer in place that
+ * is in charge of performing timeout activity. It fires once every thirty
+ * seconds or so for a given connection and checks to ensure that we have had
+ * activity for the most recent query on the connection. If not, it terminates
+ * the connection. This is important as if we have sent all our data and are
+ * waiting for the remote end to reply, without enabling something like TCP
+ * keep-alive, we will not be notified that anything that has happened to the
+ * remote connection, for example a panic. In addition, this also protects
+ * against a server that is up, but a portolan that is not making forward
+ * progress.
+ *
+ * When a timeout occurs, we first try to disassociate any active events, which
+ * by definition must exist. Once that's done, we inject a port source user
+ * event. Now, there is a small gotcha. Let's assume for a moment that we have a
+ * pathological portolan. That means that it knows to inject activity right at
+ * the time out window. That means, that the event may be disassociated before
+ * we could get to it. If that's the case, we must _not_ inject the user event
+ * and instead, we'll let the pending event take care of it. We know that the
+ * pending event hasn't hit the main part of the loop yet, otherwise, it would
+ * have released the lock protecting our state and associated the event.
+ *
+ * ------------
+ * Notes on DNS
+ * ------------
+ *
+ * Unfortunately, doing host name resolution in a way that allows us to leverage
+ * the system's resolvers and the system's caching, require us to make blocking
+ * calls in libc via getaddrinfo(3SOCKET). If we can't reach a given server,
+ * that will tie up a thread for quite some time. To work around that fact,
+ * we're going to create a fixed number of threads and we'll use them to service
+ * our DNS requests. While this isn't ideal, until we have a sane means of
+ * integrating a DNS resolution into an event loop with say portfs, it's not
+ * going to be a fun day no matter what we do.
+ *
+ * ------
+ * Timers
+ * ------
+ *
+ * We maintain a single timer based on CLOCK_REALTIME. It's designed to fire
+ * every second. While we'd rather use CLOCK_HIGHRES just to alleviate ourselves
+ * from timer drift; however, as zones may not actually have CLOCK_HIGHRES
+ * access, we don't want them to end up in there. The timer itself is just a
+ * simple avl tree sorted by expiration time, which is stored as a tick in the
+ * future, a tick is just one second.
+ *
+ * ----------
+ * Shootdowns
+ * ----------
+ *
+ * As part of the protocol, we need to be able to handle shootdowns that inform
+ * us some of the information in the system is out of date. This information
+ * needs to be processed promptly; however, the information is hopefully going
+ * to be relatively infrequent relative to the normal flow of information.
+ *
+ * The shoot down information needs to be done on a per-backend basis. The
+ * general design is that we'll have a single query for this which can fire on a
+ * 5-10s period, we randmoize the latter part to give us a bit more load
+ * spreading. If we complete because there's no work to do, then we wait the
+ * normal period. If we complete, but there's still work to do, we'll go again
+ * after a second.
+ *
+ * A shootdown has a few different parts. We first receive a list of items to
+ * shootdown. After performing all of those, we need to acknowledge them. When
+ * that's been done successfully, we can move onto the next part. From a
+ * protocol perspective, we make a SVP_R_LOG_REQ, we get a reply, and then after
+ * processing them, send an SVP_R_LOG_RM. Only once that's been acked do we
+ * continue.
+ *
+ * However, one of the challenges that we have is that these invalidations are
+ * just that, an invalidation. For a virtual layer two request, that's fine,
+ * because the kernel supports that. However, for virtual layer three
+ * invalidations, we have a bit more work to do. These protocols, ARP and NDP,
+ * don't really support a notion of just an invalidation, instead you have to
+ * inject the new data in a gratuitous fashion.
+ *
+ * To that end, what we instead do is when we receive a VL3 invalidation, we
+ * turn that info a VL3 request. We hold the general request as outstanding
+ * until we receive all of the callbacks for the VL3 invalidations, at which
+ * point we go through and do the log removal request.
+ */
+
+#include <umem.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <libnvpair.h>
+#include <strings.h>
+#include <string.h>
+#include <assert.h>
+#include <unistd.h>
+
+#include <libvarpd_provider.h>
+#include "libvarpd_svp.h"
+
+bunyan_logger_t *svp_bunyan;
+static int svp_defport = 1296;
+static int svp_defuport = 1339;
+static umem_cache_t *svp_lookup_cache;
+
+typedef enum svp_lookup_type {
+	SVP_L_UNKNOWN	= 0x0,
+	SVP_L_VL2	= 0x1,
+	SVP_L_VL3	= 0x2
+} svp_lookup_type_t;
+
+typedef struct svp_lookup {
+	int svl_type;
+	union {
+		struct svl_lookup_vl2 {
+			varpd_query_handle_t	*svl_handle;
+			overlay_target_point_t	*svl_point;
+		} svl_vl2;
+		struct svl_lookup_vl3 {
+			varpd_arp_handle_t	*svl_vah;
+			uint8_t			*svl_out;
+		} svl_vl3;
+	} svl_u;
+	svp_query_t				svl_query;
+} svp_lookup_t;
+
+static const char *varpd_svp_props[] = {
+	"svp/host",
+	"svp/port",
+	"svp/underlay_ip",
+	"svp/underlay_port"
+};
+
+static const uint8_t svp_bcast[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+int
+svp_comparator(const void *l, const void *r)
+{
+	const svp_t *ls = l;
+	const svp_t *rs = r;
+
+	if (ls->svp_vid > rs->svp_vid)
+		return (1);
+	if (ls->svp_vid < rs->svp_vid)
+		return (-1);
+	return (0);
+}
+
+static void
+svp_vl2_lookup_cb(svp_t *svp, svp_status_t status, const struct in6_addr *uip,
+    const uint16_t uport, void *arg)
+{
+	svp_lookup_t *svl = arg;
+	overlay_target_point_t *otp;
+
+	assert(svp != NULL);
+	assert(arg != NULL);
+
+	if (status != SVP_S_OK) {
+		libvarpd_plugin_query_reply(svl->svl_u.svl_vl2.svl_handle,
+		    VARPD_LOOKUP_DROP);
+		umem_cache_free(svp_lookup_cache, svl);
+		return;
+	}
+
+	otp = svl->svl_u.svl_vl2.svl_point;
+	bcopy(uip, &otp->otp_ip, sizeof (struct in6_addr));
+	otp->otp_port = uport;
+	libvarpd_plugin_query_reply(svl->svl_u.svl_vl2.svl_handle,
+	    VARPD_LOOKUP_OK);
+	umem_cache_free(svp_lookup_cache, svl);
+}
+
+static void
+svp_vl3_lookup_cb(svp_t *svp, svp_status_t status, const uint8_t *vl2mac,
+    const struct in6_addr *uip, const uint16_t uport, void *arg)
+{
+	overlay_target_point_t point;
+	svp_lookup_t *svl = arg;
+
+	assert(svp != NULL);
+	assert(svl != NULL);
+
+	if (status != SVP_S_OK) {
+		libvarpd_plugin_arp_reply(svl->svl_u.svl_vl3.svl_vah,
+		    VARPD_LOOKUP_DROP);
+		umem_cache_free(svp_lookup_cache, svl);
+		return;
+	}
+
+	/* Inject the L2 mapping before the L3 */
+	bcopy(uip, &point.otp_ip, sizeof (struct in6_addr));
+	point.otp_port = uport;
+	libvarpd_inject_varp(svp->svp_hdl, vl2mac, &point);
+
+	bcopy(vl2mac, svl->svl_u.svl_vl3.svl_out, ETHERADDRL);
+	libvarpd_plugin_arp_reply(svl->svl_u.svl_vl3.svl_vah,
+	    VARPD_LOOKUP_OK);
+	umem_cache_free(svp_lookup_cache, svl);
+}
+
+static void
+svp_vl2_invalidate_cb(svp_t *svp, const uint8_t *vl2mac)
+{
+	libvarpd_inject_varp(svp->svp_hdl, vl2mac, NULL);
+}
+
+static void
+svp_vl3_inject_cb(svp_t *svp, const uint16_t vlan, const struct in6_addr *vl3ip,
+    const uint8_t *vl2mac, const uint8_t *targmac)
+{
+	struct in_addr v4;
+
+	/*
+	 * At the moment we don't support any IPv6 related log entries, this
+	 * will change soon as we develop a bit more of the IPv6 related
+	 * infrastructure so we can properly test the injection.
+	 */
+	if (IN6_IS_ADDR_V4MAPPED(vl3ip) == 0) {
+		return;
+	} else {
+		IN6_V4MAPPED_TO_INADDR(vl3ip, &v4);
+		if (targmac == NULL)
+			targmac = svp_bcast;
+		libvarpd_inject_arp(svp->svp_hdl, vlan, vl2mac, &v4, targmac);
+	}
+}
+
+/* ARGSUSED */
+static void
+svp_shootdown_cb(svp_t *svp, const uint8_t *vl2mac, const struct in6_addr *uip,
+    const uint16_t uport)
+{
+	/*
+	 * We should probably do a conditional invlaidation here.
+	 */
+	libvarpd_inject_varp(svp->svp_hdl, vl2mac, NULL);
+}
+
+static svp_cb_t svp_defops = {
+	svp_vl2_lookup_cb,
+	svp_vl3_lookup_cb,
+	svp_vl2_invalidate_cb,
+	svp_vl3_inject_cb,
+	svp_shootdown_cb
+};
+
+static boolean_t
+varpd_svp_valid_dest(overlay_plugin_dest_t dest)
+{
+	if (dest != (OVERLAY_PLUGIN_D_IP | OVERLAY_PLUGIN_D_PORT))
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
+
+static int
+varpd_svp_create(varpd_provider_handle_t *hdl, void **outp,
+    overlay_plugin_dest_t dest)
+{
+	int ret;
+	svp_t *svp;
+
+	if (varpd_svp_valid_dest(dest) == B_FALSE)
+		return (ENOTSUP);
+
+	svp = umem_zalloc(sizeof (svp_t), UMEM_DEFAULT);
+	if (svp == NULL)
+		return (ENOMEM);
+
+	if ((ret = mutex_init(&svp->svp_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL)) != 0) {
+		umem_free(svp, sizeof (svp_t));
+		return (ret);
+	}
+
+	svp->svp_port = svp_defport;
+	svp->svp_uport = svp_defuport;
+	svp->svp_cb = svp_defops;
+	svp->svp_hdl = hdl;
+	svp->svp_vid = libvarpd_plugin_vnetid(svp->svp_hdl);
+	*outp = svp;
+	return (0);
+}
+
+static int
+varpd_svp_start(void *arg)
+{
+	int ret;
+	svp_remote_t *srp;
+	svp_t *svp = arg;
+
+	mutex_enter(&svp->svp_lock);
+	if (svp->svp_host == NULL || svp->svp_port == 0 ||
+	    svp->svp_huip == B_FALSE || svp->svp_uport == 0) {
+		mutex_exit(&svp->svp_lock);
+		return (EAGAIN);
+	}
+	mutex_exit(&svp->svp_lock);
+
+	if ((ret = svp_remote_find(svp->svp_host, svp->svp_port, &svp->svp_uip,
+	    &srp)) != 0)
+		return (ret);
+
+	if ((ret = svp_remote_attach(srp, svp)) != 0) {
+		svp_remote_release(srp);
+		return (ret);
+	}
+
+	return (0);
+}
+
+static void
+varpd_svp_stop(void *arg)
+{
+	svp_t *svp = arg;
+
+	svp_remote_detach(svp);
+}
+
+static void
+varpd_svp_destroy(void *arg)
+{
+	svp_t *svp = arg;
+
+	if (svp->svp_host != NULL)
+		umem_free(svp->svp_host, strlen(svp->svp_host) + 1);
+
+	if (mutex_destroy(&svp->svp_lock) != 0)
+		libvarpd_panic("failed to destroy svp_t`svp_lock");
+
+	umem_free(svp, sizeof (svp_t));
+}
+
+static void
+varpd_svp_lookup(void *arg, varpd_query_handle_t *vqh,
+    const overlay_targ_lookup_t *otl, overlay_target_point_t *otp)
+{
+	svp_lookup_t *slp;
+	svp_t *svp = arg;
+
+	/*
+	 * Check if this is something that we need to proxy, eg. arp or ndp.
+	 */
+	if (otl->otl_sap == ETHERTYPE_ARP) {
+		libvarpd_plugin_proxy_arp(svp->svp_hdl, vqh, otl);
+		return;
+	}
+
+	if (otl->otl_dstaddr[0] == 0x33 &&
+	    otl->otl_dstaddr[1] == 0x33) {
+		if (otl->otl_sap == ETHERTYPE_IPV6) {
+			libvarpd_plugin_proxy_ndp(svp->svp_hdl, vqh, otl);
+		} else {
+			libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		}
+		return;
+	}
+
+	/*
+	 * Watch out for various multicast and broadcast addresses. We've
+	 * already taken care of the IPv6 range above. Now we just need to
+	 * handle broadcast and if the multicast bit is set, lowest bit of the
+	 * first octet of the MAC, then we drop it now.
+	 */
+	if (bcmp(otl->otl_dstaddr, svp_bcast, ETHERADDRL) == 0 ||
+	    (otl->otl_dstaddr[0] & 0x01) == 0x01) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	/*
+	 * If we have a failure to allocate memory for this, that's not good.
+	 * However, telling the kernel to just drop this packet is much better
+	 * than the alternative at this moment. At least we'll try again and we
+	 * may have something more available to us in a little bit.
+	 */
+	slp = umem_cache_alloc(svp_lookup_cache, UMEM_DEFAULT);
+	if (slp == NULL) {
+		libvarpd_plugin_query_reply(vqh, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	slp->svl_type = SVP_L_VL2;
+	slp->svl_u.svl_vl2.svl_handle = vqh;
+	slp->svl_u.svl_vl2.svl_point = otp;
+
+	svp_remote_vl2_lookup(svp, &slp->svl_query, otl->otl_dstaddr, slp);
+}
+
+/* ARGSUSED */
+static int
+varpd_svp_nprops(void *arg, uint_t *nprops)
+{
+	*nprops = sizeof (varpd_svp_props) / sizeof (char *);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+varpd_svp_propinfo(void *arg, uint_t propid, varpd_prop_handle_t *vph)
+{
+	switch (propid) {
+	case 0:
+		/* svp/host */
+		libvarpd_prop_set_name(vph, varpd_svp_props[0]);
+		libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_RRW);
+		libvarpd_prop_set_type(vph, OVERLAY_PROP_T_STRING);
+		libvarpd_prop_set_nodefault(vph);
+		break;
+	case 1:
+		/* svp/port */
+		libvarpd_prop_set_name(vph, varpd_svp_props[1]);
+		libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_RRW);
+		libvarpd_prop_set_type(vph, OVERLAY_PROP_T_UINT);
+		(void) libvarpd_prop_set_default(vph, &svp_defport,
+		    sizeof (svp_defport));
+		libvarpd_prop_set_range_uint32(vph, 1, UINT16_MAX);
+		break;
+	case 2:
+		/* svp/underlay_ip */
+		libvarpd_prop_set_name(vph, varpd_svp_props[2]);
+		libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_RRW);
+		libvarpd_prop_set_type(vph, OVERLAY_PROP_T_IP);
+		libvarpd_prop_set_nodefault(vph);
+		break;
+	case 3:
+		/* svp/underlay_port */
+		libvarpd_prop_set_name(vph, varpd_svp_props[3]);
+		libvarpd_prop_set_prot(vph, OVERLAY_PROP_PERM_RRW);
+		libvarpd_prop_set_type(vph, OVERLAY_PROP_T_UINT);
+		(void) libvarpd_prop_set_default(vph, &svp_defuport,
+		    sizeof (svp_defuport));
+		libvarpd_prop_set_range_uint32(vph, 1, UINT16_MAX);
+		break;
+	default:
+		return (EINVAL);
+	}
+	return (0);
+}
+
+static int
+varpd_svp_getprop(void *arg, const char *pname, void *buf, uint32_t *sizep)
+{
+	svp_t *svp = arg;
+
+	/* svp/host */
+	if (strcmp(pname, varpd_svp_props[0]) == 0) {
+		size_t len;
+
+		mutex_enter(&svp->svp_lock);
+		if (svp->svp_host == NULL) {
+			*sizep = 0;
+		} else {
+			len = strlen(svp->svp_host) + 1;
+			if (*sizep < len) {
+				mutex_exit(&svp->svp_lock);
+				return (EOVERFLOW);
+			}
+			*sizep = len;
+			(void) strlcpy(buf, svp->svp_host, *sizep);
+		}
+		mutex_exit(&svp->svp_lock);
+		return (0);
+	}
+
+	/* svp/port */
+	if (strcmp(pname, varpd_svp_props[1]) == 0) {
+		uint64_t val;
+
+		if (*sizep < sizeof (uint64_t))
+			return (EOVERFLOW);
+
+		mutex_enter(&svp->svp_lock);
+		if (svp->svp_port == 0) {
+			*sizep = 0;
+		} else {
+			val = svp->svp_port;
+			bcopy(&val, buf, sizeof (uint64_t));
+			*sizep = sizeof (uint64_t);
+		}
+
+		mutex_exit(&svp->svp_lock);
+		return (0);
+	}
+
+	/* svp/underlay_ip */
+	if (strcmp(pname, varpd_svp_props[2]) == 0) {
+		if (*sizep > sizeof (struct in6_addr))
+			return (EOVERFLOW);
+		mutex_enter(&svp->svp_lock);
+		if (svp->svp_huip == B_FALSE) {
+			*sizep = 0;
+		} else {
+			bcopy(&svp->svp_uip, buf, sizeof (struct in6_addr));
+			*sizep = sizeof (struct in6_addr);
+		}
+		return (0);
+	}
+
+	/* svp/underlay_port */
+	if (strcmp(pname, varpd_svp_props[3]) == 0) {
+		uint64_t val;
+
+		if (*sizep < sizeof (uint64_t))
+			return (EOVERFLOW);
+
+		mutex_enter(&svp->svp_lock);
+		if (svp->svp_uport == 0) {
+			*sizep = 0;
+		} else {
+			val = svp->svp_uport;
+			bcopy(&val, buf, sizeof (uint64_t));
+			*sizep = sizeof (uint64_t);
+		}
+
+		mutex_exit(&svp->svp_lock);
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+static int
+varpd_svp_setprop(void *arg, const char *pname, const void *buf,
+    const uint32_t size)
+{
+	svp_t *svp = arg;
+
+	/* svp/host */
+	if (strcmp(pname, varpd_svp_props[0]) == 0) {
+		char *dup;
+		dup = umem_alloc(size, UMEM_DEFAULT);
+		(void) strlcpy(dup, buf, size);
+		if (dup == NULL)
+			return (ENOMEM);
+		mutex_enter(&svp->svp_lock);
+		if (svp->svp_host != NULL)
+			umem_free(svp->svp_host, strlen(svp->svp_host) + 1);
+		svp->svp_host = dup;
+		mutex_exit(&svp->svp_lock);
+		return (0);
+	}
+
+	/* svp/port */
+	if (strcmp(pname, varpd_svp_props[1]) == 0) {
+		const uint64_t *valp = buf;
+		if (size < sizeof (uint64_t))
+			return (EOVERFLOW);
+
+		if (*valp == 0 || *valp > UINT16_MAX)
+			return (EINVAL);
+
+		mutex_enter(&svp->svp_lock);
+		svp->svp_port = (uint16_t)*valp;
+		mutex_exit(&svp->svp_lock);
+		return (0);
+	}
+
+	/* svp/underlay_ip */
+	if (strcmp(pname, varpd_svp_props[2]) == 0) {
+		const struct in6_addr *ipv6 = buf;
+
+		if (size < sizeof (struct in6_addr))
+			return (EOVERFLOW);
+
+		if (IN6_IS_ADDR_V4COMPAT(ipv6))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_MULTICAST(ipv6))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_6TO4(ipv6))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_V4MAPPED(ipv6)) {
+			ipaddr_t v4;
+			IN6_V4MAPPED_TO_IPADDR(ipv6, v4);
+			if (IN_MULTICAST(v4))
+				return (EINVAL);
+		}
+
+		mutex_enter(&svp->svp_lock);
+		bcopy(buf, &svp->svp_uip, sizeof (struct in6_addr));
+		svp->svp_huip = B_TRUE;
+		mutex_exit(&svp->svp_lock);
+		return (0);
+	}
+
+	/* svp/underlay_port */
+	if (strcmp(pname, varpd_svp_props[3]) == 0) {
+		const uint64_t *valp = buf;
+		if (size < sizeof (uint64_t))
+			return (EOVERFLOW);
+
+		if (*valp == 0 || *valp > UINT16_MAX)
+			return (EINVAL);
+
+		mutex_enter(&svp->svp_lock);
+		svp->svp_uport = (uint16_t)*valp;
+		mutex_exit(&svp->svp_lock);
+
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+static int
+varpd_svp_save(void *arg, nvlist_t *nvp)
+{
+	int ret;
+	svp_t *svp = arg;
+
+	mutex_enter(&svp->svp_lock);
+	if (svp->svp_host != NULL) {
+		if ((ret = nvlist_add_string(nvp, varpd_svp_props[0],
+		    svp->svp_host)) != 0) {
+			mutex_exit(&svp->svp_lock);
+			return (ret);
+		}
+	}
+
+	if (svp->svp_port != 0) {
+		if ((ret = nvlist_add_uint16(nvp, varpd_svp_props[1],
+		    svp->svp_port)) != 0) {
+			mutex_exit(&svp->svp_lock);
+			return (ret);
+		}
+	}
+
+	if (svp->svp_huip == B_TRUE) {
+		char buf[INET6_ADDRSTRLEN];
+
+		if (inet_ntop(AF_INET6, &svp->svp_uip, buf, sizeof (buf)) ==
+		    NULL)
+			libvarpd_panic("unexpected inet_ntop failure: %d",
+			    errno);
+
+		if ((ret = nvlist_add_string(nvp, varpd_svp_props[2],
+		    buf)) != 0) {
+			mutex_exit(&svp->svp_lock);
+			return (ret);
+		}
+	}
+
+	if (svp->svp_uport != 0) {
+		if ((ret = nvlist_add_uint16(nvp, varpd_svp_props[3],
+		    svp->svp_uport)) != 0) {
+			mutex_exit(&svp->svp_lock);
+			return (ret);
+		}
+	}
+
+	mutex_exit(&svp->svp_lock);
+	return (0);
+}
+
+static int
+varpd_svp_restore(nvlist_t *nvp, varpd_provider_handle_t *hdl,
+    overlay_plugin_dest_t dest, void **outp)
+{
+	int ret;
+	svp_t *svp;
+	char *ipstr, *hstr;
+
+	if (varpd_svp_valid_dest(dest) == B_FALSE)
+		return (ENOTSUP);
+
+	if ((ret = varpd_svp_create(hdl, (void **)&svp, dest)) != 0)
+		return (ret);
+
+	if ((ret = nvlist_lookup_string(nvp, varpd_svp_props[0],
+	    &hstr)) != 0) {
+		if (ret != ENOENT) {
+			varpd_svp_destroy(svp);
+			return (ret);
+		}
+		svp->svp_host = NULL;
+	} else {
+		size_t blen = strlen(hstr) + 1;
+		svp->svp_host = umem_alloc(blen, UMEM_DEFAULT);
+		(void) strlcpy(svp->svp_host, hstr, blen);
+	}
+
+	if ((ret = nvlist_lookup_uint16(nvp, varpd_svp_props[1],
+	    &svp->svp_port)) != 0) {
+		if (ret != ENOENT) {
+			varpd_svp_destroy(svp);
+			return (ret);
+		}
+		svp->svp_port = 0;
+	}
+
+	if ((ret = nvlist_lookup_string(nvp, varpd_svp_props[2],
+	    &ipstr)) != 0) {
+		if (ret != ENOENT) {
+			varpd_svp_destroy(svp);
+			return (ret);
+		}
+		svp->svp_huip = B_FALSE;
+	} else {
+		ret = inet_pton(AF_INET6, ipstr, &svp->svp_uip);
+		if (ret == -1) {
+			assert(errno == EAFNOSUPPORT);
+			libvarpd_panic("unexpected inet_pton failure: %d",
+			    errno);
+		}
+
+		if (ret == 0) {
+			varpd_svp_destroy(svp);
+			return (EINVAL);
+		}
+		svp->svp_huip = B_TRUE;
+	}
+
+	if ((ret = nvlist_lookup_uint16(nvp, varpd_svp_props[3],
+	    &svp->svp_uport)) != 0) {
+		if (ret != ENOENT) {
+			varpd_svp_destroy(svp);
+			return (ret);
+		}
+		svp->svp_uport = 0;
+	}
+
+	svp->svp_hdl = hdl;
+	*outp = svp;
+	return (0);
+}
+
+static void
+varpd_svp_arp(void *arg, varpd_arp_handle_t *vah, int type,
+    const struct sockaddr *sock, uint8_t *out)
+{
+	svp_t *svp = arg;
+	svp_lookup_t *svl;
+
+	if (type != VARPD_QTYPE_ETHERNET) {
+		libvarpd_plugin_arp_reply(vah, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	svl = umem_cache_alloc(svp_lookup_cache, UMEM_DEFAULT);
+	if (svl == NULL) {
+		libvarpd_plugin_arp_reply(vah, VARPD_LOOKUP_DROP);
+		return;
+	}
+
+	svl->svl_type = SVP_L_VL3;
+	svl->svl_u.svl_vl3.svl_vah = vah;
+	svl->svl_u.svl_vl3.svl_out = out;
+	svp_remote_vl3_lookup(svp, &svl->svl_query, sock, svl);
+}
+
+static const varpd_plugin_ops_t varpd_svp_ops = {
+	0,
+	varpd_svp_create,
+	varpd_svp_start,
+	varpd_svp_stop,
+	varpd_svp_destroy,
+	NULL,
+	varpd_svp_lookup,
+	varpd_svp_nprops,
+	varpd_svp_propinfo,
+	varpd_svp_getprop,
+	varpd_svp_setprop,
+	varpd_svp_save,
+	varpd_svp_restore,
+	varpd_svp_arp,
+	NULL
+};
+
+static int
+svp_bunyan_init(void)
+{
+	int ret;
+
+	if ((ret = bunyan_init("svp", &svp_bunyan)) != 0)
+		return (ret);
+	ret = bunyan_stream_add(svp_bunyan, "stderr", BUNYAN_L_INFO,
+	    bunyan_stream_fd, (void *)STDERR_FILENO);
+	if (ret != 0)
+		bunyan_fini(svp_bunyan);
+	return (ret);
+}
+
+static void
+svp_bunyan_fini(void)
+{
+	if (svp_bunyan != NULL)
+		bunyan_fini(svp_bunyan);
+}
+
+#pragma init(varpd_svp_init)
+static void
+varpd_svp_init(void)
+{
+	int err;
+	varpd_plugin_register_t *vpr;
+
+	if (svp_bunyan_init() != 0)
+		return;
+
+	if ((err = svp_host_init()) != 0) {
+		(void) bunyan_error(svp_bunyan, "failed to init host subsystem",
+		    BUNYAN_T_INT32, "error", err,
+		    BUNYAN_T_END);
+		svp_bunyan_fini();
+		return;
+	}
+
+	svp_lookup_cache = umem_cache_create("svp_lookup",
+	    sizeof (svp_lookup_t),  0, NULL, NULL, NULL, NULL, NULL, 0);
+	if (svp_lookup_cache == NULL) {
+		(void) bunyan_error(svp_bunyan,
+		    "failed to create svp_lookup cache",
+		    BUNYAN_T_INT32, "error", errno,
+		    BUNYAN_T_END);
+		svp_bunyan_fini();
+		return;
+	}
+
+	if ((err = svp_event_init()) != 0) {
+		(void) bunyan_error(svp_bunyan,
+		    "failed to init event subsystem",
+		    BUNYAN_T_INT32, "error", err,
+		    BUNYAN_T_END);
+		svp_bunyan_fini();
+		umem_cache_destroy(svp_lookup_cache);
+		return;
+	}
+
+	if ((err = svp_timer_init()) != 0) {
+		(void) bunyan_error(svp_bunyan,
+		    "failed to init timer subsystem",
+		    BUNYAN_T_INT32, "error", err,
+		    BUNYAN_T_END);
+		svp_event_fini();
+		umem_cache_destroy(svp_lookup_cache);
+		svp_bunyan_fini();
+		return;
+	}
+
+	if ((err = svp_remote_init()) != 0) {
+		(void) bunyan_error(svp_bunyan,
+		    "failed to init remote subsystem",
+		    BUNYAN_T_INT32, "error", err,
+		    BUNYAN_T_END);
+		svp_event_fini();
+		umem_cache_destroy(svp_lookup_cache);
+		svp_bunyan_fini();
+		return;
+	}
+
+	vpr = libvarpd_plugin_alloc(VARPD_CURRENT_VERSION, &err);
+	if (vpr == NULL) {
+		(void) bunyan_error(svp_bunyan,
+		    "failed to alloc varpd plugin",
+		    BUNYAN_T_INT32, "error", err,
+		    BUNYAN_T_END);
+		svp_remote_fini();
+		svp_event_fini();
+		umem_cache_destroy(svp_lookup_cache);
+		svp_bunyan_fini();
+		return;
+	}
+
+	vpr->vpr_mode = OVERLAY_TARGET_DYNAMIC;
+	vpr->vpr_name = "svp";
+	vpr->vpr_ops = &varpd_svp_ops;
+
+	if ((err = libvarpd_plugin_register(vpr)) != 0) {
+		(void) bunyan_error(svp_bunyan,
+		    "failed to register varpd plugin",
+		    BUNYAN_T_INT32, "error", err,
+		    BUNYAN_T_END);
+		svp_remote_fini();
+		svp_event_fini();
+		umem_cache_destroy(svp_lookup_cache);
+		svp_bunyan_fini();
+
+	}
+	libvarpd_plugin_free(vpr);
+}
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp.h b/usr/src/lib/varpd/svp/common/libvarpd_svp.h
new file mode 100644
index 0000000000..8192b842ce
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp.h
@@ -0,0 +1,357 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBVARPD_SVP_H
+#define	_LIBVARPD_SVP_H
+
+/*
+ * Implementation details of the SVP plugin and the SVP protocol.
+ */
+
+#include <netinet/in.h>
+#include <sys/ethernet.h>
+#include <thread.h>
+#include <synch.h>
+#include <libvarpd_provider.h>
+#include <sys/avl.h>
+#include <port.h>
+#include <sys/list.h>
+#include <bunyan.h>
+
+#include <libvarpd_svp_prot.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct svp svp_t;
+typedef struct svp_remote svp_remote_t;
+typedef struct svp_conn svp_conn_t;
+typedef struct svp_query svp_query_t;
+
+typedef void (*svp_event_f)(port_event_t *, void *);
+
+typedef struct svp_event {
+	svp_event_f	se_func;
+	void		*se_arg;
+	int		se_events;
+} svp_event_t;
+
+typedef void (*svp_timer_f)(void *);
+
+typedef struct svp_timer {
+	svp_timer_f	st_func;	/* Timer callback function */
+	void		*st_arg;	/* Timer callback arg */
+	boolean_t	st_oneshot;	/* Is timer a one shot? */
+	uint32_t	st_value;	/* periodic or one-shot time */
+	/* Fields below here are private to the svp_timer implementaiton */
+	uint64_t	st_expire;	/* Next expiration */
+	boolean_t	st_delivering;	/* Are we currently delivering this */
+	avl_node_t	st_link;
+} svp_timer_t;
+
+/*
+ * Note, both the svp_log_ack_t and svp_lrm_req_t are not part of this structure
+ * as they are rather variable sized data and we don't want to constrain their
+ * size. Instead, the rdata and wdata members must be set appropriately.
+ */
+typedef union svp_query_data {
+	svp_vl2_req_t	sqd_vl2r;
+	svp_vl2_ack_t	sqd_vl2a;
+	svp_vl3_req_t	sdq_vl3r;
+	svp_vl3_ack_t	sdq_vl3a;
+	svp_log_req_t	sdq_logr;
+	svp_lrm_ack_t	sdq_lrma;
+} svp_query_data_t;
+
+typedef void (*svp_query_f)(svp_query_t *, void *);
+
+typedef enum svp_query_state {
+	SVP_QUERY_INIT		= 0x00,
+	SVP_QUERY_WRITING	= 0x01,
+	SVP_QUERY_READING	= 0x02,
+	SVP_QUERY_FINISHED	= 0x03
+} svp_query_state_t;
+
+/*
+ * The query structure is usable for all forms of svp queries that end up
+ * getting passed across. Right now it's optimized for the fixed size data
+ * requests as opposed to requests whose responses will always be streaming in
+ * nature. Though, the streaming requests are the less common ones we have. We
+ * may need to make additional changes for those.
+ */
+struct svp_query {
+	list_node_t		sq_lnode;	/* List entry */
+	svp_query_f		sq_func;	/* Callback function */
+	svp_query_state_t	sq_state;	/* Query state */
+	void			*sq_arg;	/* Callback function arg */
+	svp_t			*sq_svp;	/* Pointer back to svp_t */
+	svp_req_t		sq_header;	/* Header for the query */
+	svp_query_data_t	sq_rdun;	/* Union for read data */
+	svp_query_data_t	sq_wdun;	/* Union for write data */
+	svp_status_t		sq_status;	/* Query response status */
+	size_t			sq_size;	/* Query response size */
+	void			*sq_rdata;	/* Read data pointer */
+	size_t			sq_rsize;	/* Read data size */
+	void			*sq_wdata;	/* Write data pointer */
+	size_t			sq_wsize;	/* Write data size */
+	hrtime_t		sq_acttime;	/* Last I/O activity time */
+};
+
+typedef enum svp_conn_state {
+	SVP_CS_ERROR		= 0x00,
+	SVP_CS_INITIAL		= 0x01,
+	SVP_CS_CONNECTING	= 0x02,
+	SVP_CS_BACKOFF		= 0x03,
+	SVP_CS_ACTIVE		= 0x04,
+	SVP_CS_WINDDOWN		= 0x05
+} svp_conn_state_t;
+
+typedef enum svp_conn_error {
+	SVP_CE_NONE		= 0x00,
+	SVP_CE_ASSOCIATE	= 0x01,
+	SVP_CE_NOPOLLOUT	= 0x02,
+	SVP_CE_SOCKET		= 0x03
+} svp_conn_error_t;
+
+typedef enum svp_conn_flags {
+	SVP_CF_ADDED		= 0x01,
+	SVP_CF_DEGRADED		= 0x02,
+	SVP_CF_REAP		= 0x04,
+	SVP_CF_TEARDOWN		= 0x08,
+	SVP_CF_UFLAG		= 0x0c,
+	SVP_CF_USER		= 0x10
+} svp_conn_flags_t;
+
+typedef struct svp_conn_out {
+	svp_query_t		*sco_query;
+	size_t			sco_offset;
+} svp_conn_out_t;
+
+typedef struct svp_conn_in {
+	svp_query_t 		*sci_query;
+	svp_req_t		sci_req;
+	size_t			sci_offset;
+} svp_conn_in_t;
+
+struct svp_conn {
+	svp_remote_t		*sc_remote;	/* RO */
+	struct in6_addr		sc_addr;	/* RO */
+	list_node_t		sc_rlist;	/* svp_remote_t`sr_lock */
+	mutex_t			sc_lock;
+	svp_event_t		sc_event;
+	svp_timer_t		sc_btimer;
+	svp_timer_t		sc_qtimer;
+	int			sc_socket;
+	uint_t			sc_gen;
+	uint_t			sc_nbackoff;
+	svp_conn_flags_t	sc_flags;
+	svp_conn_state_t	sc_cstate;
+	svp_conn_error_t	sc_error;
+	int			sc_errno;
+	list_t			sc_queries;
+	svp_conn_out_t		sc_output;
+	svp_conn_in_t		sc_input;
+};
+
+typedef enum svp_remote_state {
+	SVP_RS_LOOKUP_SCHEDULED		= 0x01,	/* On the DNS Queue */
+	SVP_RS_LOOKUP_INPROGRESS 	= 0x02,	/* Doing a DNS lookup */
+	SVP_RS_LOOKUP_VALID		= 0x04	/* addrinfo valid */
+} svp_remote_state_t;
+
+/*
+ * These series of bit-based flags should be ordered such that the most severe
+ * is first. We only can set one message that user land can see, so if more than
+ * one is set we want to make sure that one is there.
+ */
+typedef enum svp_degrade_state {
+	SVP_RD_DNS_FAIL		= 0x01,	/* DNS Resolution Failure */
+	SVP_RD_REMOTE_FAIL	= 0x02,	/* cannot reach any remote peers */
+	SVP_RD_ALL		= 0x03	/* Only suitable for restore */
+} svp_degrade_state_t;
+
+typedef enum svp_shootdown_flags {
+	SVP_SD_RUNNING		= 0x01,
+	SVP_SD_QUIESCE		= 0x02,
+	SVP_SD_DORM		= 0x04
+} svp_shootdown_flags_t;
+
+/*
+ * There is a single svp_sdlog_t per svp_remote_t. It maintains its own lock and
+ * condition variables. See the big theory statement for more information on how
+ * it's used.
+ */
+typedef struct svp_sdlog {
+	mutex_t			sdl_lock;
+	cond_t			sdl_cond;
+	uint_t			sdl_ref;
+	svp_timer_t		sdl_timer;
+	svp_shootdown_flags_t	sdl_flags;
+	svp_query_t		sdl_query;
+	void			*sdl_logack;
+	void			*sdl_logrm;
+	void			*sdl_remote;
+} svp_sdlog_t;
+
+struct svp_remote {
+	char			*sr_hostname;	/* RO */
+	uint16_t		sr_rport;	/* RO */
+	struct in6_addr		sr_uip;		/* RO */
+	avl_node_t		sr_gnode;	/* svp_remote_lock */
+	svp_remote_t		*sr_nexthost;	/* svp_host_lock */
+	mutex_t			sr_lock;
+	cond_t			sr_cond;
+	svp_remote_state_t	sr_state;
+	svp_degrade_state_t	sr_degrade;
+	struct addrinfo 	*sr_addrinfo;
+	avl_tree_t		sr_tree;
+	uint_t			sr_count;	/* active count */
+	uint_t			sr_gen;
+	uint_t			sr_tconns;	/* total conns + dconns */
+	uint_t			sr_ndconns;	/* number of degraded conns */
+	list_t			sr_conns;	/* all conns */
+	svp_sdlog_t		sr_shoot;
+};
+
+/*
+ * We have a bunch of different things that we get back from the API at the
+ * plug-in layer. These include:
+ *
+ *   o OOB Shootdowns
+ *   o VL3->VL2 Lookups
+ *   o VL2->UL3 Lookups
+ *   o VL2 Log invalidations
+ *   o VL3 Log injections
+ */
+typedef void (*svp_vl2_lookup_f)(svp_t *, svp_status_t, const struct in6_addr *,
+    const uint16_t, void *);
+typedef void (*svp_vl3_lookup_f)(svp_t *, svp_status_t, const uint8_t *,
+    const struct in6_addr *, const uint16_t, void *);
+typedef void (*svp_vl2_invalidation_f)(svp_t *, const uint8_t *);
+typedef void (*svp_vl3_inject_f)(svp_t *, const uint16_t,
+    const struct in6_addr *, const uint8_t *, const uint8_t *);
+typedef void (*svp_shootdown_f)(svp_t *, const uint8_t *,
+    const struct in6_addr *, const uint16_t uport);
+
+typedef struct svp_cb {
+	svp_vl2_lookup_f	scb_vl2_lookup;
+	svp_vl3_lookup_f	scb_vl3_lookup;
+	svp_vl2_invalidation_f	scb_vl2_invalidate;
+	svp_vl3_inject_f	scb_vl3_inject;
+	svp_shootdown_f		scb_shootdown;
+} svp_cb_t;
+
+/*
+ * Core implementation structure.
+ */
+struct svp {
+	overlay_plugin_dest_t	svp_dest;	/* RO */
+	varpd_provider_handle_t	*svp_hdl;	/* RO */
+	svp_cb_t		svp_cb;		/* RO */
+	uint64_t		svp_vid;	/* RO */
+	avl_node_t 		svp_rlink;	/* Owned by svp_remote */
+	svp_remote_t		*svp_remote;	/* RO iff started */
+	mutex_t			svp_lock;
+	char			*svp_host;	/* svp_lock */
+	uint16_t		svp_port;	/* svp_lock */
+	uint16_t		svp_uport;	/* svp_lock */
+	boolean_t		svp_huip;	/* svp_lock */
+	struct in6_addr		svp_uip;	/* svp_lock */
+};
+
+extern bunyan_logger_t *svp_bunyan;
+
+extern int svp_remote_find(char *, uint16_t, struct in6_addr *,
+    svp_remote_t **);
+extern int svp_remote_attach(svp_remote_t *, svp_t *);
+extern void svp_remote_detach(svp_t *);
+extern void svp_remote_release(svp_remote_t *);
+extern void svp_remote_vl3_lookup(svp_t *, svp_query_t *,
+    const struct sockaddr *, void *);
+extern void svp_remote_vl2_lookup(svp_t *, svp_query_t *, const uint8_t *,
+    void *);
+
+/*
+ * Init functions
+ */
+extern int svp_remote_init(void);
+extern void svp_remote_fini(void);
+extern int svp_event_init(void);
+extern int svp_event_timer_init(svp_event_t *);
+extern void svp_event_fini(void);
+extern int svp_host_init(void);
+extern int svp_timer_init(void);
+
+/*
+ * Timers
+ */
+extern int svp_tickrate;
+extern void svp_timer_add(svp_timer_t *);
+extern void svp_timer_remove(svp_timer_t *);
+
+/*
+ * Event loop management
+ */
+extern int svp_event_associate(svp_event_t *, int);
+extern int svp_event_dissociate(svp_event_t *, int);
+extern int svp_event_inject(svp_event_t *);
+
+/*
+ * Connection manager
+ */
+extern int svp_conn_create(svp_remote_t *, const struct in6_addr *);
+extern void svp_conn_destroy(svp_conn_t *);
+extern void svp_conn_fallout(svp_conn_t *);
+extern void svp_conn_queue(svp_conn_t *, svp_query_t *);
+
+/*
+ * FMA related
+ */
+extern void svp_remote_degrade(svp_remote_t *, svp_degrade_state_t);
+extern void svp_remote_restore(svp_remote_t *, svp_degrade_state_t);
+
+/*
+ * Misc.
+ */
+extern int svp_comparator(const void *, const void *);
+extern void svp_remote_reassign(svp_remote_t *, svp_conn_t *);
+extern void svp_remote_resolved(svp_remote_t *, struct addrinfo *);
+extern void svp_host_queue(svp_remote_t *);
+extern void svp_query_release(svp_query_t *);
+extern void svp_query_crc32(svp_req_t *, void *, size_t);
+
+/*
+ * Shootdown related
+ */
+extern void svp_remote_shootdown_vl3(svp_remote_t *, svp_log_vl3_t *,
+    svp_sdlog_t *);
+extern void svp_remote_shootdown_vl2(svp_remote_t *, svp_log_vl2_t *);
+extern void svp_remote_log_request(svp_remote_t *, svp_query_t *, void *,
+    size_t);
+extern void svp_remote_lrm_request(svp_remote_t *, svp_query_t *, void *,
+    size_t);
+extern void svp_shootdown_logr_cb(svp_remote_t *, svp_status_t, void *, size_t);
+extern void svp_shootdown_lrm_cb(svp_remote_t *, svp_status_t);
+extern void svp_shootdown_vl3_cb(svp_status_t, svp_log_vl3_t *, svp_sdlog_t *);
+extern int svp_shootdown_init(svp_remote_t *);
+extern void svp_shootdown_fini(svp_remote_t *);
+extern void svp_shootdown_start(svp_remote_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBVARPD_SVP_H */
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_conn.c b/usr/src/lib/varpd/svp/common/libvarpd_svp_conn.c
new file mode 100644
index 0000000000..5d19f8a388
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_conn.c
@@ -0,0 +1,1031 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Logic to manage an individual connection to a remote host.
+ *
+ * For more information, see the big theory statement in
+ * lib/varpd/svp/common/libvarpd_svp.c.
+ */
+
+#include <assert.h>
+#include <umem.h>
+#include <errno.h>
+#include <strings.h>
+#include <unistd.h>
+#include <stddef.h>
+#include <sys/uio.h>
+#include <sys/debug.h>
+
+#include <libvarpd_svp.h>
+
+int svp_conn_query_timeout = 30;
+static int svp_conn_backoff_tbl[] = { 1, 2, 4, 8, 16, 32 };
+static int svp_conn_nbackoff = sizeof (svp_conn_backoff_tbl) / sizeof (int);
+
+typedef enum svp_conn_act {
+	SVP_RA_NONE	= 0x00,
+	SVP_RA_DEGRADE	= 0x01,
+	SVP_RA_RESTORE	= 0x02,
+	SVP_RA_ERROR	= 0x03,
+	SVP_RA_CLEANUP	= 0x04
+} svp_conn_act_t;
+
+static void
+svp_conn_inject(svp_conn_t *scp)
+{
+	int ret;
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	if (scp->sc_flags & SVP_CF_USER)
+		return;
+	scp->sc_flags |= SVP_CF_USER;
+	if ((ret = svp_event_inject(&scp->sc_event)) != 0)
+		libvarpd_panic("failed to inject event: %d\n", ret);
+}
+
+static void
+svp_conn_degrade(svp_conn_t *scp)
+{
+	svp_remote_t *srp = scp->sc_remote;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	if (scp->sc_flags & SVP_CF_DEGRADED)
+		return;
+
+	scp->sc_flags |= SVP_CF_DEGRADED;
+	srp->sr_ndconns++;
+	if (srp->sr_ndconns == srp->sr_tconns)
+		svp_remote_degrade(srp, SVP_RD_REMOTE_FAIL);
+}
+
+static void
+svp_conn_restore(svp_conn_t *scp)
+{
+	svp_remote_t *srp = scp->sc_remote;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	if (!(scp->sc_flags & SVP_CF_DEGRADED))
+		return;
+
+	scp->sc_flags &= ~SVP_CF_DEGRADED;
+	if (srp->sr_ndconns == srp->sr_tconns)
+		svp_remote_restore(srp, SVP_RD_REMOTE_FAIL);
+	srp->sr_ndconns--;
+}
+
+static void
+svp_conn_add(svp_conn_t *scp)
+{
+	svp_remote_t *srp = scp->sc_remote;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	if (scp->sc_flags & SVP_CF_ADDED)
+		return;
+
+	list_insert_tail(&srp->sr_conns, scp);
+	scp->sc_flags |= SVP_CF_ADDED;
+	srp->sr_tconns++;
+}
+
+static void
+svp_conn_remove(svp_conn_t *scp)
+{
+	svp_remote_t *srp = scp->sc_remote;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	if (!(scp->sc_flags & SVP_CF_ADDED))
+		return;
+
+	scp->sc_flags &= ~SVP_CF_ADDED;
+	if (scp->sc_flags & SVP_CF_DEGRADED)
+		srp->sr_ndconns--;
+	srp->sr_tconns--;
+	if (srp->sr_tconns == srp->sr_ndconns)
+		svp_remote_degrade(srp, SVP_RD_REMOTE_FAIL);
+}
+
+static svp_query_t *
+svp_conn_query_find(svp_conn_t *scp, uint32_t id)
+{
+	svp_query_t *sqp;
+
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	for (sqp = list_head(&scp->sc_queries); sqp != NULL;
+	    sqp = list_next(&scp->sc_queries, sqp)) {
+		if (sqp->sq_header.svp_id == id)
+			break;
+	}
+
+	return (sqp);
+}
+
+static svp_conn_act_t
+svp_conn_backoff(svp_conn_t *scp)
+{
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	if (close(scp->sc_socket) != 0)
+		libvarpd_panic("failed to close socket %d: %d\n",
+		    scp->sc_socket, errno);
+	scp->sc_socket = -1;
+
+	scp->sc_cstate = SVP_CS_BACKOFF;
+	scp->sc_nbackoff++;
+	if (scp->sc_nbackoff >= svp_conn_nbackoff) {
+		scp->sc_btimer.st_value =
+		    svp_conn_backoff_tbl[svp_conn_nbackoff - 1];
+	} else {
+		scp->sc_btimer.st_value =
+		    svp_conn_backoff_tbl[scp->sc_nbackoff - 1];
+	}
+	svp_timer_add(&scp->sc_btimer);
+
+	if (scp->sc_nbackoff > svp_conn_nbackoff)
+		return (SVP_RA_DEGRADE);
+	return (SVP_RA_NONE);
+}
+
+static svp_conn_act_t
+svp_conn_connect(svp_conn_t *scp)
+{
+	int ret;
+	struct sockaddr_in6 in6;
+
+	assert(MUTEX_HELD(&scp->sc_lock));
+	assert(scp->sc_cstate == SVP_CS_BACKOFF ||
+	    scp->sc_cstate == SVP_CS_INITIAL);
+	assert(scp->sc_socket == -1);
+	if (scp->sc_cstate == SVP_CS_INITIAL)
+		scp->sc_nbackoff = 0;
+
+	scp->sc_socket = socket(AF_INET6, SOCK_STREAM | SOCK_NONBLOCK, 0);
+	if (scp->sc_socket == -1) {
+		scp->sc_error = SVP_CE_SOCKET;
+		scp->sc_errno = errno;
+		scp->sc_cstate = SVP_CS_ERROR;
+		return (SVP_RA_DEGRADE);
+	}
+
+	bzero(&in6, sizeof (struct sockaddr_in6));
+	in6.sin6_family = AF_INET6;
+	in6.sin6_port = htons(scp->sc_remote->sr_rport);
+	bcopy(&scp->sc_addr, &in6.sin6_addr,  sizeof (struct in6_addr));
+	ret = connect(scp->sc_socket, (struct sockaddr *)&in6,
+	    sizeof (struct sockaddr_in6));
+	if (ret != 0) {
+		boolean_t async = B_FALSE;
+
+		switch (errno) {
+		case EACCES:
+		case EADDRINUSE:
+		case EAFNOSUPPORT:
+		case EALREADY:
+		case EBADF:
+		case EISCONN:
+		case ELOOP:
+		case ENOENT:
+		case ENOSR:
+		case EWOULDBLOCK:
+			libvarpd_panic("unanticipated connect errno %d", errno);
+			break;
+		case EINPROGRESS:
+		case EINTR:
+			async = B_TRUE;
+		default:
+			break;
+		}
+
+		/*
+		 * So, we will be connecting to this in the future, advance our
+		 * state and make sure that we poll for the next round.
+		 */
+		if (async == B_TRUE) {
+			scp->sc_cstate = SVP_CS_CONNECTING;
+			scp->sc_event.se_events = POLLOUT | POLLHUP;
+			ret = svp_event_associate(&scp->sc_event,
+			    scp->sc_socket);
+			if (ret == 0)
+				return (SVP_RA_NONE);
+			scp->sc_error = SVP_CE_ASSOCIATE;
+			scp->sc_errno = ret;
+			scp->sc_cstate = SVP_CS_ERROR;
+			return (SVP_RA_DEGRADE);
+		} else {
+			/*
+			 * This call failed, which means that we obtained one of
+			 * the following:
+			 *
+			 * EADDRNOTAVAIL
+			 * ECONNREFUSED
+			 * EIO
+			 * ENETUNREACH
+			 * EHOSTUNREACH
+			 * ENXIO
+			 * ETIMEDOUT
+			 *
+			 * Therefore we need to set ourselves into backoff and
+			 * wait for that to clear up.
+			 */
+			return (svp_conn_backoff(scp));
+		}
+	}
+
+	/*
+	 * We've connected. Successfully move ourselves to the bound
+	 * state and start polling.
+	 */
+	scp->sc_cstate = SVP_CS_ACTIVE;
+	scp->sc_event.se_events = POLLIN | POLLRDNORM | POLLHUP;
+	ret = svp_event_associate(&scp->sc_event, scp->sc_socket);
+	if (ret == 0)
+		return (SVP_RA_RESTORE);
+	scp->sc_error = SVP_CE_ASSOCIATE;
+	scp->sc_cstate = SVP_CS_ERROR;
+
+	return (SVP_RA_DEGRADE);
+}
+
+/*
+ * This should be the first call we get after a connect. If we have successfully
+ * connected, we should see a writeable event. We may also see an error or a
+ * hang up. In either of these cases, we transition to error mode. If there is
+ * also a readable event, we ignore it at the moment and just let a
+ * reassociation pick it up so we can simplify the set of state transitions that
+ * we have.
+ */
+static svp_conn_act_t
+svp_conn_poll_connect(port_event_t *pe, svp_conn_t *scp)
+{
+	int ret, err;
+	socklen_t sl = sizeof (err);
+	if (!(pe->portev_events & POLLOUT)) {
+		scp->sc_errno = 0;
+		scp->sc_error = SVP_CE_NOPOLLOUT;
+		scp->sc_cstate = SVP_CS_ERROR;
+		return (SVP_RA_DEGRADE);
+	}
+
+	ret = getsockopt(scp->sc_socket, SOL_SOCKET, SO_ERROR, &err, &sl);
+	if (ret != 0)
+		libvarpd_panic("unanticipated getsockopt error");
+	if (err != 0) {
+		return (svp_conn_backoff(scp));
+	}
+
+	scp->sc_cstate = SVP_CS_ACTIVE;
+	scp->sc_event.se_events = POLLIN | POLLRDNORM | POLLHUP;
+	ret = svp_event_associate(&scp->sc_event, scp->sc_socket);
+	if (ret == 0)
+		return (SVP_RA_RESTORE);
+	scp->sc_error = SVP_CE_ASSOCIATE;
+	scp->sc_errno = ret;
+	scp->sc_cstate = SVP_CS_ERROR;
+	return (SVP_RA_DEGRADE);
+}
+
+static svp_conn_act_t
+svp_conn_pollout(svp_conn_t *scp)
+{
+	svp_query_t *sqp;
+	svp_req_t *req;
+	size_t off;
+	struct iovec iov[2];
+	int nvecs = 0;
+	ssize_t ret;
+
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	/*
+	 * We need to find a query and start writing it out.
+	 */
+	if (scp->sc_output.sco_query == NULL) {
+		for (sqp = list_head(&scp->sc_queries); sqp != NULL;
+		    sqp = list_next(&scp->sc_queries, sqp)) {
+			if (sqp->sq_state != SVP_QUERY_INIT)
+				continue;
+			break;
+		}
+
+		if (sqp == NULL) {
+			scp->sc_event.se_events &= ~POLLOUT;
+			return (SVP_RA_NONE);
+		}
+
+		scp->sc_output.sco_query = sqp;
+		scp->sc_output.sco_offset = 0;
+		sqp->sq_state = SVP_QUERY_WRITING;
+		svp_query_crc32(&sqp->sq_header, sqp->sq_rdata, sqp->sq_rsize);
+	}
+
+	sqp = scp->sc_output.sco_query;
+	req = &sqp->sq_header;
+	off = scp->sc_output.sco_offset;
+	if (off < sizeof (svp_req_t)) {
+		iov[nvecs].iov_base = (void *)((uintptr_t)req + off);
+		iov[nvecs].iov_len = sizeof (svp_req_t) - off;
+		nvecs++;
+		off = 0;
+	} else {
+		off -= sizeof (svp_req_t);
+	}
+
+	iov[nvecs].iov_base = (void *)((uintptr_t)sqp->sq_rdata + off);
+	iov[nvecs].iov_len = sqp->sq_rsize - off;
+	nvecs++;
+
+	do {
+		ret = writev(scp->sc_socket, iov, nvecs);
+	} while (ret == -1 && errno == EAGAIN);
+	if (ret == -1) {
+		switch (errno) {
+		case EAGAIN:
+			scp->sc_event.se_events |= POLLOUT;
+			return (SVP_RA_NONE);
+		case EIO:
+		case ENXIO:
+		case ECONNRESET:
+			return (SVP_RA_ERROR);
+		default:
+			libvarpd_panic("unexpected errno: %d", errno);
+		}
+	}
+
+	sqp->sq_acttime = gethrtime();
+	scp->sc_output.sco_offset += ret;
+	if (ret >= sizeof (svp_req_t) + sqp->sq_rsize) {
+		sqp->sq_state = SVP_QUERY_READING;
+		scp->sc_output.sco_query = NULL;
+		scp->sc_output.sco_offset = 0;
+		scp->sc_event.se_events |= POLLOUT;
+	}
+	return (SVP_RA_NONE);
+}
+
+static boolean_t
+svp_conn_pollin_validate(svp_conn_t *scp)
+{
+	svp_query_t *sqp;
+	uint32_t nsize;
+	uint16_t nvers, nop;
+	svp_req_t *resp = &scp->sc_input.sci_req;
+
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	nvers = ntohs(resp->svp_ver);
+	nop = ntohs(resp->svp_op);
+	nsize = ntohl(resp->svp_size);
+
+	if (nvers != SVP_CURRENT_VERSION) {
+		(void) bunyan_warn(svp_bunyan, "unsupported version",
+		    BUNYAN_T_IP, "remote_ip", &scp->sc_addr,
+		    BUNYAN_T_INT32, "remote_port", scp->sc_remote->sr_rport,
+		    BUNYAN_T_INT32, "version", nvers,
+		    BUNYAN_T_INT32, "operation", nop,
+		    BUNYAN_T_INT32, "response_id", resp->svp_id,
+		    BUNYAN_T_END);
+		return (B_FALSE);
+	}
+
+	if (nop != SVP_R_VL2_ACK && nop != SVP_R_VL3_ACK &&
+	    nop != SVP_R_LOG_ACK && nop != SVP_R_LOG_RM_ACK) {
+		(void) bunyan_warn(svp_bunyan, "unsupported operation",
+		    BUNYAN_T_IP, "remote_ip", &scp->sc_addr,
+		    BUNYAN_T_INT32, "remote_port", scp->sc_remote->sr_rport,
+		    BUNYAN_T_INT32, "version", nvers,
+		    BUNYAN_T_INT32, "operation", nop,
+		    BUNYAN_T_INT32, "response_id", resp->svp_id,
+		    BUNYAN_T_END);
+		return (B_FALSE);
+	}
+
+	sqp = svp_conn_query_find(scp, resp->svp_id);
+	if (sqp == NULL) {
+		(void) bunyan_warn(svp_bunyan, "unknown response id",
+		    BUNYAN_T_IP, "remote_ip", &scp->sc_addr,
+		    BUNYAN_T_INT32, "remote_port", scp->sc_remote->sr_rport,
+		    BUNYAN_T_INT32, "version", nvers,
+		    BUNYAN_T_INT32, "operation", nop,
+		    BUNYAN_T_INT32, "response_id", resp->svp_id,
+		    BUNYAN_T_END);
+		return (B_FALSE);
+	}
+
+	if (sqp->sq_state != SVP_QUERY_READING) {
+		(void) bunyan_warn(svp_bunyan,
+		    "got response for unexpecting query",
+		    BUNYAN_T_IP, "remote_ip", &scp->sc_addr,
+		    BUNYAN_T_INT32, "remote_port", scp->sc_remote->sr_rport,
+		    BUNYAN_T_INT32, "version", nvers,
+		    BUNYAN_T_INT32, "operation", nop,
+		    BUNYAN_T_INT32, "response_id", resp->svp_id,
+		    BUNYAN_T_INT32, "query_state", sqp->sq_state,
+		    BUNYAN_T_END);
+		return (B_FALSE);
+	}
+
+	if ((nop == SVP_R_VL2_ACK && nsize != sizeof (svp_vl2_ack_t)) ||
+	    (nop == SVP_R_VL3_ACK && nsize != sizeof (svp_vl3_ack_t)) ||
+	    (nop == SVP_R_LOG_RM_ACK && nsize != sizeof (svp_lrm_ack_t))) {
+		(void) bunyan_warn(svp_bunyan, "response size too large",
+		    BUNYAN_T_IP, "remote_ip", &scp->sc_addr,
+		    BUNYAN_T_INT32, "remote_port", scp->sc_remote->sr_rport,
+		    BUNYAN_T_INT32, "version", nvers,
+		    BUNYAN_T_INT32, "operation", nop,
+		    BUNYAN_T_INT32, "response_id", resp->svp_id,
+		    BUNYAN_T_INT32, "response_size", nsize,
+		    BUNYAN_T_INT32, "expected_size", nop == SVP_R_VL2_ACK ?
+		    sizeof (svp_vl2_ack_t) : sizeof (svp_vl3_ack_t),
+		    BUNYAN_T_INT32, "query_state", sqp->sq_state,
+		    BUNYAN_T_END);
+		return (B_FALSE);
+	}
+
+	/*
+	 * The valid size is anything <= to what the user requested, but at
+	 * least svp_log_ack_t bytes large.
+	 */
+	if (nop == SVP_R_LOG_ACK) {
+		const char *msg = NULL;
+		if (nsize < sizeof (svp_log_ack_t))
+			msg = "response size too small";
+		else if (nsize > ((svp_log_req_t *)sqp->sq_rdata)->svlr_count)
+			msg = "response size too large";
+		if (msg != NULL) {
+			(void) bunyan_warn(svp_bunyan, msg,
+			    BUNYAN_T_IP, "remote_ip", &scp->sc_addr,
+			    BUNYAN_T_INT32, "remote_port",
+			    scp->sc_remote->sr_rport,
+			    BUNYAN_T_INT32, "version", nvers,
+			    BUNYAN_T_INT32, "operation", nop,
+			    BUNYAN_T_INT32, "response_id", resp->svp_id,
+			    BUNYAN_T_INT32, "response_size", nsize,
+			    BUNYAN_T_INT32, "expected_size",
+			    ((svp_log_req_t *)sqp->sq_rdata)->svlr_count,
+			    BUNYAN_T_INT32, "query_state", sqp->sq_state,
+			    BUNYAN_T_END);
+			return (B_FALSE);
+		}
+	}
+
+	sqp->sq_size = nsize;
+	scp->sc_input.sci_query = sqp;
+	if (nop == SVP_R_VL2_ACK || nop == SVP_R_VL3_ACK ||
+	    nop == SVP_R_LOG_RM_ACK) {
+		sqp->sq_wdata = &sqp->sq_wdun;
+		sqp->sq_wsize = sizeof (svp_query_data_t);
+	} else {
+		VERIFY(nop == SVP_R_LOG_ACK);
+		assert(sqp->sq_wdata != NULL);
+		assert(sqp->sq_wsize != 0);
+	}
+
+	return (B_TRUE);
+}
+
+static svp_conn_act_t
+svp_conn_pollin(svp_conn_t *scp)
+{
+	size_t off, total;
+	ssize_t ret;
+	svp_query_t *sqp;
+	uint32_t crc;
+	uint16_t nop;
+
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	/*
+	 * No query implies that we're reading in the header and that the offset
+	 * is associted with it.
+	 */
+	off = scp->sc_input.sci_offset;
+	sqp = scp->sc_input.sci_query;
+	if (scp->sc_input.sci_query == NULL) {
+		svp_req_t *resp = &scp->sc_input.sci_req;
+
+		assert(off < sizeof (svp_req_t));
+
+		do {
+			ret = read(scp->sc_socket,
+			    (void *)((uintptr_t)resp + off),
+			    sizeof (svp_req_t) - off);
+		} while (ret == -1 && errno == EINTR);
+		if (ret == -1) {
+			switch (errno) {
+			case EAGAIN:
+				scp->sc_event.se_events |= POLLIN | POLLRDNORM;
+				return (SVP_RA_NONE);
+			case EIO:
+			case ECONNRESET:
+				return (SVP_RA_ERROR);
+				break;
+			default:
+				libvarpd_panic("unexpeted read errno: %d",
+				    errno);
+			}
+		} else if (ret == 0) {
+			/* Try to reconnect to the remote host */
+			return (SVP_RA_ERROR);
+		}
+
+		/* Didn't get all the data we need */
+		if (off + ret < sizeof (svp_req_t)) {
+			scp->sc_input.sci_offset += ret;
+			scp->sc_event.se_events |= POLLIN | POLLRDNORM;
+			return (SVP_RA_NONE);
+		}
+
+		if (svp_conn_pollin_validate(scp) != B_TRUE)
+			return (SVP_RA_ERROR);
+	}
+
+	sqp = scp->sc_input.sci_query;
+	assert(sqp != NULL);
+	sqp->sq_acttime = gethrtime();
+	total = ntohl(scp->sc_input.sci_req.svp_size);
+	do {
+		ret = read(scp->sc_socket,
+		    (void *)((uintptr_t)sqp->sq_wdata + off),
+		    total - off);
+	} while (ret == -1 && errno == EINTR);
+
+	if (ret == -1) {
+		switch (errno) {
+		case EAGAIN:
+			scp->sc_event.se_events |= POLLIN | POLLRDNORM;
+			return (SVP_RA_NONE);
+		case EIO:
+		case ECONNRESET:
+			return (SVP_RA_ERROR);
+			break;
+		default:
+			libvarpd_panic("unexpeted read errno: %d", errno);
+		}
+	} else if (ret == 0) {
+		/* Try to reconnect to the remote host */
+		return (SVP_RA_ERROR);
+	}
+
+	if (ret + off < total) {
+		scp->sc_input.sci_offset += ret;
+		return (SVP_RA_NONE);
+	}
+
+	nop = ntohs(scp->sc_input.sci_req.svp_op);
+	crc = scp->sc_input.sci_req.svp_crc32;
+	svp_query_crc32(&scp->sc_input.sci_req, sqp->sq_wdata, total);
+	if (crc != scp->sc_input.sci_req.svp_crc32) {
+		(void) bunyan_info(svp_bunyan, "crc32 mismatch",
+		    BUNYAN_T_IP, "remote ip", &scp->sc_addr,
+		    BUNYAN_T_INT32, "remote port", scp->sc_remote->sr_rport,
+		    BUNYAN_T_INT32, "version",
+		    ntohs(scp->sc_input.sci_req.svp_ver),
+		    BUNYAN_T_INT32, "operation", nop,
+		    BUNYAN_T_INT32, "response id",
+		    ntohl(scp->sc_input.sci_req.svp_id),
+		    BUNYAN_T_INT32, "query state", sqp->sq_state,
+		    BUNYAN_T_UINT32, "msg_crc", ntohl(crc),
+		    BUNYAN_T_UINT32, "calc_crc",
+		    ntohl(scp->sc_input.sci_req.svp_crc32),
+		    BUNYAN_T_END);
+		return (SVP_RA_ERROR);
+	}
+	scp->sc_input.sci_query = NULL;
+	scp->sc_input.sci_offset = 0;
+
+	if (nop == SVP_R_VL2_ACK) {
+		svp_vl2_ack_t *sl2a = sqp->sq_wdata;
+		sqp->sq_status = ntohl(sl2a->sl2a_status);
+	} else if (nop == SVP_R_VL3_ACK) {
+		svp_vl3_ack_t *sl3a = sqp->sq_wdata;
+		sqp->sq_status = ntohl(sl3a->sl3a_status);
+	} else if (nop == SVP_R_LOG_ACK) {
+		svp_log_ack_t *svla = sqp->sq_wdata;
+		sqp->sq_status = ntohl(svla->svla_status);
+	} else if (nop == SVP_R_LOG_RM_ACK) {
+		svp_lrm_ack_t *svra = sqp->sq_wdata;
+		sqp->sq_status = ntohl(svra->svra_status);
+	} else {
+		libvarpd_panic("unhandled nop: %d", nop);
+	}
+
+	list_remove(&scp->sc_queries, sqp);
+	mutex_exit(&scp->sc_lock);
+
+	/*
+	 * We have to release all of our resources associated with this entry
+	 * before we call the callback. After we call it, the memory will be
+	 * lost to time.
+	 */
+	svp_query_release(sqp);
+	sqp->sq_func(sqp, sqp->sq_arg);
+	mutex_enter(&scp->sc_lock);
+	scp->sc_event.se_events |= POLLIN | POLLRDNORM;
+
+	return (SVP_RA_NONE);
+}
+
+static svp_conn_act_t
+svp_conn_reset(svp_conn_t *scp)
+{
+	svp_remote_t *srp = scp->sc_remote;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	assert(MUTEX_HELD(&scp->sc_lock));
+
+	assert(svp_event_dissociate(&scp->sc_event, scp->sc_socket) ==
+	    ENOENT);
+	if (close(scp->sc_socket) != 0)
+		libvarpd_panic("failed to close socket %d: %d", scp->sc_socket,
+		    errno);
+	scp->sc_flags &= ~SVP_CF_TEARDOWN;
+	scp->sc_socket = -1;
+	scp->sc_cstate = SVP_CS_INITIAL;
+	scp->sc_input.sci_query = NULL;
+	scp->sc_output.sco_query = NULL;
+
+	svp_remote_reassign(srp, scp);
+
+	return (svp_conn_connect(scp));
+}
+
+/*
+ * This is our general state transition function. We're called here when we want
+ * to advance part of our state machine as well as to re-arm ourselves. We can
+ * also end up here from the standard event loop as a result of having a user
+ * event posted.
+ */
+static void
+svp_conn_handler(port_event_t *pe, void *arg)
+{
+	svp_conn_t *scp = arg;
+	svp_remote_t *srp = scp->sc_remote;
+	svp_conn_act_t ret = SVP_RA_NONE;
+	svp_conn_state_t oldstate;
+
+	mutex_enter(&scp->sc_lock);
+
+	/*
+	 * Check if one of our event interrupts is set. An event interrupt, such
+	 * as having to be reaped or be torndown is notified by a
+	 * PORT_SOURCE_USER event that tries to take care of this. However,
+	 * because of the fact that the event loop can be ongoing despite this,
+	 * we may get here before the PORT_SOURCE_USER has casued us to get
+	 * here. In such a case, if the PORT_SOURCE_USER event is tagged, then
+	 * we're going to opt to do nothing here and wait for it to come and
+	 * tear us down. That will also indicate to us that we have nothing to
+	 * worry about as far as general timing and the like goes.
+	 */
+	if ((scp->sc_flags & SVP_CF_UFLAG) != 0 &&
+	    (scp->sc_flags & SVP_CF_USER) != 0 &&
+	    pe != NULL &&
+	    pe->portev_source != PORT_SOURCE_USER) {
+		mutex_exit(&scp->sc_lock);
+		return;
+	}
+
+	if (pe != NULL && pe->portev_source == PORT_SOURCE_USER) {
+		scp->sc_flags &= ~SVP_CF_USER;
+		if ((scp->sc_flags & SVP_CF_UFLAG) == 0) {
+			mutex_exit(&scp->sc_lock);
+			return;
+		}
+	}
+
+	/* Check if this needs to be freed */
+	if (scp->sc_flags & SVP_CF_REAP) {
+		mutex_exit(&scp->sc_lock);
+		svp_conn_destroy(scp);
+		return;
+	}
+
+	/* Check if this needs to be reset */
+	if (scp->sc_flags & SVP_CF_TEARDOWN) {
+		/* Make sure any other users of this are disassociated */
+		ret = SVP_RA_ERROR;
+		goto out;
+	}
+
+	switch (scp->sc_cstate) {
+	case SVP_CS_INITIAL:
+	case SVP_CS_BACKOFF:
+		assert(pe == NULL);
+		ret = svp_conn_connect(scp);
+		break;
+	case SVP_CS_CONNECTING:
+		assert(pe != NULL);
+		ret = svp_conn_poll_connect(pe, scp);
+		break;
+	case SVP_CS_ACTIVE:
+	case SVP_CS_WINDDOWN:
+		assert(pe != NULL);
+		oldstate = scp->sc_cstate;
+		if (pe->portev_events & POLLOUT)
+			ret = svp_conn_pollout(scp);
+		if (ret == SVP_RA_NONE && (pe->portev_events & POLLIN))
+			ret = svp_conn_pollin(scp);
+
+		if (oldstate == SVP_CS_WINDDOWN &&
+		    (list_is_empty(&scp->sc_queries) || ret != SVP_RA_NONE)) {
+			ret = SVP_RA_CLEANUP;
+		}
+
+		if (ret == SVP_RA_NONE) {
+			int err;
+			if ((err = svp_event_associate(&scp->sc_event,
+			    scp->sc_socket)) != 0) {
+				scp->sc_error = SVP_CE_ASSOCIATE;
+				scp->sc_errno = err;
+				scp->sc_cstate = SVP_CS_ERROR;
+				ret = SVP_RA_DEGRADE;
+			}
+		}
+		break;
+	default:
+		libvarpd_panic("svp_conn_handler encountered unexpected "
+		    "state: %d", scp->sc_cstate);
+	}
+out:
+	mutex_exit(&scp->sc_lock);
+
+	if (ret == SVP_RA_NONE)
+		return;
+
+	mutex_enter(&srp->sr_lock);
+	mutex_enter(&scp->sc_lock);
+	if (ret == SVP_RA_ERROR)
+		ret = svp_conn_reset(scp);
+
+	if (ret == SVP_RA_DEGRADE)
+		svp_conn_degrade(scp);
+	if (ret == SVP_RA_RESTORE)
+		svp_conn_restore(scp);
+
+	if (ret == SVP_RA_CLEANUP) {
+		svp_conn_remove(scp);
+		scp->sc_flags |= SVP_CF_REAP;
+		svp_conn_inject(scp);
+	}
+	mutex_exit(&scp->sc_lock);
+	mutex_exit(&srp->sr_lock);
+}
+
+static void
+svp_conn_backtimer(void *arg)
+{
+	svp_conn_t *scp = arg;
+
+	svp_conn_handler(NULL, scp);
+}
+
+/*
+ * This fires every svp_conn_query_timeout seconds. Its purpos is to determine
+ * if we haven't heard back on a request with in svp_conn_query_timeout seconds.
+ * If any of the svp_conn_query_t's that have been started (indicated by
+ * svp_query_t`sq_acttime != -1), and more than svp_conn_query_timeout seconds
+ * have passed, we basically tear this connection down and reassign outstanding
+ * queries.
+ */
+static void
+svp_conn_querytimer(void *arg)
+{
+	int ret;
+	svp_query_t *sqp;
+	svp_conn_t *scp = arg;
+	hrtime_t now = gethrtime();
+
+	mutex_enter(&scp->sc_lock);
+
+	/*
+	 * If we're not in the active state, then we don't care about this as
+	 * we're already either going to die or we have no connections to worry
+	 * about.
+	 */
+	if (scp->sc_cstate != SVP_CS_ACTIVE) {
+		mutex_exit(&scp->sc_lock);
+		return;
+	}
+
+	for (sqp = list_head(&scp->sc_queries); sqp != NULL;
+	    sqp = list_next(&scp->sc_queries, sqp)) {
+		if (sqp->sq_acttime == -1)
+			continue;
+		if ((now - sqp->sq_acttime) / NANOSEC > svp_conn_query_timeout)
+			break;
+	}
+
+	/* Nothing timed out, we're good here */
+	if (sqp == NULL) {
+		mutex_exit(&scp->sc_lock);
+		return;
+	}
+
+	(void) bunyan_warn(svp_bunyan, "query timed out on connection",
+	    BUNYAN_T_IP, "remote_ip", &scp->sc_addr,
+	    BUNYAN_T_INT32, "remote_port", scp->sc_remote->sr_rport,
+	    BUNYAN_T_INT32, "operation", ntohs(sqp->sq_header.svp_op),
+	    BUNYAN_T_END);
+
+	/*
+	 * Begin the tear down process for this connect. If we lose the
+	 * disassociate, then we don't inject an event. See the big theory
+	 * statement in libvarpd_svp.c for more information.
+	 */
+	scp->sc_flags |= SVP_CF_TEARDOWN;
+
+	ret = svp_event_dissociate(&scp->sc_event, scp->sc_socket);
+	if (ret == 0)
+		svp_conn_inject(scp);
+	else
+		VERIFY(ret == ENOENT);
+
+	mutex_exit(&scp->sc_lock);
+}
+
+/*
+ * This connection has fallen out of DNS, figure out what we need to do with it.
+ */
+void
+svp_conn_fallout(svp_conn_t *scp)
+{
+	svp_remote_t *srp = scp->sc_remote;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+
+	mutex_enter(&scp->sc_lock);
+	switch (scp->sc_cstate) {
+	case SVP_CS_ERROR:
+		/*
+		 * Connection is already inactive, so it's safe to tear down.
+		 * Fire it off through the state machine to tear down via the
+		 * backoff timer.
+		 */
+		svp_conn_remove(scp);
+		scp->sc_flags |= SVP_CF_REAP;
+		svp_conn_inject(scp);
+		break;
+	case SVP_CS_INITIAL:
+	case SVP_CS_BACKOFF:
+	case SVP_CS_CONNECTING:
+		/*
+		 * Here, we have something actively going on, so we'll let it be
+		 * clean up the next time we hit the event loop by the event
+		 * loop itself. As it has no connections, there isn't much to
+		 * really do, though we'll take this chance to go ahead and
+		 * remove it from the remote.
+		 */
+		svp_conn_remove(scp);
+		scp->sc_flags |= SVP_CF_REAP;
+		svp_conn_inject(scp);
+		break;
+	case SVP_CS_ACTIVE:
+	case SVP_CS_WINDDOWN:
+		/*
+		 * If there are no outstanding queries, then we should simply
+		 * clean this up now,t he same way we would with the others.
+		 * Othewrise, as we know the event loop is ongoing, we'll make
+		 * sure that these entries get cleaned up once they're done.
+		 */
+		scp->sc_cstate = SVP_CS_WINDDOWN;
+		if (list_is_empty(&scp->sc_queries)) {
+			svp_conn_remove(scp);
+			scp->sc_flags |= SVP_CF_REAP;
+			svp_conn_inject(scp);
+		}
+		break;
+	default:
+		libvarpd_panic("svp_conn_fallout encountered"
+		    "unkonwn state");
+	}
+	mutex_exit(&scp->sc_lock);
+	mutex_exit(&srp->sr_lock);
+}
+
+int
+svp_conn_create(svp_remote_t *srp, const struct in6_addr *addr)
+{
+	int ret;
+	svp_conn_t *scp;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	scp = umem_zalloc(sizeof (svp_conn_t), UMEM_DEFAULT);
+	if (scp == NULL)
+		return (ENOMEM);
+
+	if ((ret = mutex_init(&scp->sc_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL)) != 0) {
+		umem_free(scp, sizeof (svp_conn_t));
+		return (ret);
+	}
+
+	scp->sc_remote = srp;
+	scp->sc_event.se_func = svp_conn_handler;
+	scp->sc_event.se_arg = scp;
+	scp->sc_btimer.st_func = svp_conn_backtimer;
+	scp->sc_btimer.st_arg = scp;
+	scp->sc_btimer.st_oneshot = B_TRUE;
+	scp->sc_btimer.st_value = 1;
+
+	scp->sc_qtimer.st_func = svp_conn_querytimer;
+	scp->sc_qtimer.st_arg = scp;
+	scp->sc_qtimer.st_oneshot = B_FALSE;
+	scp->sc_qtimer.st_value = svp_conn_query_timeout;
+
+	scp->sc_socket = -1;
+
+	list_create(&scp->sc_queries, sizeof (svp_query_t),
+	    offsetof(svp_query_t, sq_lnode));
+	scp->sc_gen = srp->sr_gen;
+	bcopy(addr, &scp->sc_addr, sizeof (struct in6_addr));
+	scp->sc_cstate = SVP_CS_INITIAL;
+	mutex_enter(&scp->sc_lock);
+	svp_conn_add(scp);
+	mutex_exit(&scp->sc_lock);
+
+	/* Now that we're locked and loaded, add our timers */
+	svp_timer_add(&scp->sc_qtimer);
+	svp_timer_add(&scp->sc_btimer);
+
+	return (0);
+}
+
+/*
+ * At the time of calling, the entry has been removed from all lists. In
+ * addition, the entries state should be SVP_CS_ERROR, therefore, we know that
+ * the fd should not be associated with the event loop. We'll double check that
+ * just in case. We should also have already been removed from the remote's
+ * list.
+ */
+void
+svp_conn_destroy(svp_conn_t *scp)
+{
+	int ret;
+
+	mutex_enter(&scp->sc_lock);
+	if (scp->sc_cstate != SVP_CS_ERROR)
+		libvarpd_panic("asked to tear down an active connection");
+	if (scp->sc_flags & SVP_CF_ADDED)
+		libvarpd_panic("asked to remove a connection still in "
+		    "the remote list\n");
+	if (!list_is_empty(&scp->sc_queries))
+		libvarpd_panic("asked to remove a connection with non-empty "
+		    "query list");
+
+	if ((ret = svp_event_dissociate(&scp->sc_event, scp->sc_socket)) !=
+	    ENOENT) {
+		libvarpd_panic("dissociate failed or was actually "
+		    "associated: %d", ret);
+	}
+	mutex_exit(&scp->sc_lock);
+
+	/* Verify our timers are killed */
+	svp_timer_remove(&scp->sc_btimer);
+	svp_timer_remove(&scp->sc_qtimer);
+
+	if (scp->sc_socket != -1 && close(scp->sc_socket) != 0)
+		libvarpd_panic("failed to close svp_conn_t`scp_socket fd "
+		    "%d: %d", scp->sc_socket, errno);
+
+	list_destroy(&scp->sc_queries);
+	umem_free(scp, sizeof (svp_conn_t));
+}
+
+void
+svp_conn_queue(svp_conn_t *scp, svp_query_t *sqp)
+{
+	assert(MUTEX_HELD(&scp->sc_lock));
+	assert(scp->sc_cstate == SVP_CS_ACTIVE);
+
+	sqp->sq_acttime = -1;
+	list_insert_tail(&scp->sc_queries, sqp);
+	if (!(scp->sc_event.se_events & POLLOUT)) {
+		scp->sc_event.se_events |= POLLOUT;
+		/*
+		 * If this becomes frequent, we should instead give up on this
+		 * set of connections instead of aborting.
+		 */
+		if (svp_event_associate(&scp->sc_event, scp->sc_socket) != 0)
+			libvarpd_panic("svp_event_associate failed somehow");
+	}
+}
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_crc.c b/usr/src/lib/varpd/svp/common/libvarpd_svp_crc.c
new file mode 100644
index 0000000000..ade47ff998
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_crc.c
@@ -0,0 +1,53 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+/*
+ * Perform standard crc32 functions.
+ *
+ * For more information, see the big theory statement in
+ * lib/varpd/svp/common/libvarpd_svp.c.
+ *
+ * Really, this should just be a libcrc.
+ */
+
+#include <sys/crc32.h>
+#include <stdint.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <inttypes.h>
+#include <libvarpd_svp.h>
+
+static uint32_t svp_crc32_tab[] = { CRC32_TABLE };
+
+static uint32_t
+svp_crc32(uint32_t old, const uint8_t *buf, size_t len)
+{
+	uint32_t out;
+
+	CRC32(out, buf, len, old, svp_crc32_tab);
+	return (out);
+}
+
+void
+svp_query_crc32(svp_req_t *shp, void *buf, size_t data)
+{
+	uint32_t crc = -1U;
+
+	shp->svp_crc32 = 0;
+	crc = svp_crc32(crc, (uint8_t *)shp, sizeof (svp_req_t));
+	crc = svp_crc32(crc, buf, data);
+	crc = ~crc;
+	shp->svp_crc32 = htonl(crc);
+}
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_host.c b/usr/src/lib/varpd/svp/common/libvarpd_svp_host.c
new file mode 100644
index 0000000000..e91cc30e9d
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_host.c
@@ -0,0 +1,171 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * DNS Host-name related functions.
+ *
+ * For more information, see the big theory statement in
+ * lib/varpd/svp/common/libvarpd_svp.c.
+ */
+
+#include <sys/socket.h>
+#include <netdb.h>
+#include <thread.h>
+#include <synch.h>
+#include <assert.h>
+#include <errno.h>
+
+#include <libvarpd_svp.h>
+
+int svp_host_nthreads = 8;
+
+static mutex_t svp_host_lock = ERRORCHECKMUTEX;
+static cond_t svp_host_cv = DEFAULTCV;
+static svp_remote_t *svp_host_head;
+
+/* ARGSUSED */
+static void *
+svp_host_loop(void *unused)
+{
+	for (;;) {
+		int err;
+		svp_remote_t *srp;
+		struct addrinfo *addrs;
+
+		mutex_enter(&svp_host_lock);
+		while (svp_host_head == NULL)
+			(void) cond_wait(&svp_host_cv, &svp_host_lock);
+		srp = svp_host_head;
+		svp_host_head = srp->sr_nexthost;
+		if (svp_host_head != NULL)
+			(void) cond_signal(&svp_host_cv);
+		mutex_exit(&svp_host_lock);
+
+		mutex_enter(&srp->sr_lock);
+		assert(srp->sr_state & SVP_RS_LOOKUP_SCHEDULED);
+		srp->sr_state &= ~SVP_RS_LOOKUP_SCHEDULED;
+		if (srp->sr_state & SVP_RS_LOOKUP_INPROGRESS) {
+			mutex_exit(&srp->sr_lock);
+			continue;
+		}
+		srp->sr_state |= SVP_RS_LOOKUP_INPROGRESS;
+		mutex_exit(&srp->sr_lock);
+
+		for (;;) {
+			err = getaddrinfo(srp->sr_hostname, NULL, NULL, &addrs);
+			if (err == 0)
+				break;
+			if (err != 0) {
+				switch (err) {
+				case EAI_ADDRFAMILY:
+				case EAI_BADFLAGS:
+				case EAI_FAMILY:
+				case EAI_SERVICE:
+				case EAI_SOCKTYPE:
+				case EAI_OVERFLOW:
+				default:
+					libvarpd_panic("unexpected getaddrinfo "
+					    "failure: %d", err);
+					break;
+				case EAI_AGAIN:
+				case EAI_MEMORY:
+				case EAI_SYSTEM:
+					continue;
+				case EAI_FAIL:
+				case EAI_NODATA:
+				case EAI_NONAME:
+					/*
+					 * At this point in time we have
+					 * something which isn't very good. This
+					 * may have been a typo or something may
+					 * have been destroyed. We should go
+					 * ahead and degrade this overall
+					 * instance, because we're not going to
+					 * make much forward progress... It'd be
+					 * great if we could actually issue more
+					 * of an EREPORT to describe what
+					 * happened, some day.
+					 */
+					mutex_enter(&srp->sr_lock);
+					svp_remote_degrade(srp,
+					    SVP_RD_DNS_FAIL);
+					mutex_exit(&srp->sr_lock);
+					break;
+				}
+			}
+			break;
+		}
+
+		if (err == 0) {
+			/*
+			 * We've successfully resolved something, mark this
+			 * degredation over for now.
+			 */
+			mutex_enter(&srp->sr_lock);
+			svp_remote_restore(srp, SVP_RD_DNS_FAIL);
+			mutex_exit(&srp->sr_lock);
+			svp_remote_resolved(srp, addrs);
+		}
+
+		mutex_enter(&srp->sr_lock);
+		srp->sr_state &= ~SVP_RS_LOOKUP_INPROGRESS;
+		(void) cond_broadcast(&srp->sr_cond);
+		mutex_exit(&srp->sr_lock);
+	}
+
+	/* LINTED: E_STMT_NOT_REACHED */
+	return (NULL);
+}
+
+void
+svp_host_queue(svp_remote_t *srp)
+{
+	svp_remote_t *s;
+	mutex_enter(&svp_host_lock);
+	mutex_enter(&srp->sr_lock);
+	if (srp->sr_state & SVP_RS_LOOKUP_SCHEDULED) {
+		mutex_exit(&srp->sr_lock);
+		mutex_exit(&svp_host_lock);
+		return;
+	}
+	srp->sr_state |= SVP_RS_LOOKUP_SCHEDULED;
+	s = svp_host_head;
+	while (s != NULL && s->sr_nexthost != NULL)
+		s = s->sr_nexthost;
+	if (s == NULL) {
+		assert(s == svp_host_head);
+		svp_host_head = srp;
+	} else {
+		s->sr_nexthost = srp;
+	}
+	srp->sr_nexthost = NULL;
+	(void) cond_signal(&svp_host_cv);
+	mutex_exit(&srp->sr_lock);
+	mutex_exit(&svp_host_lock);
+}
+
+int
+svp_host_init(void)
+{
+	int i;
+
+	for (i = 0; i < svp_host_nthreads; i++) {
+		if (thr_create(NULL, 0, svp_host_loop, NULL,
+		    THR_DETACHED | THR_DAEMON, NULL) != 0)
+			return (errno);
+	}
+
+	return (0);
+}
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_loop.c b/usr/src/lib/varpd/svp/common/libvarpd_svp_loop.c
new file mode 100644
index 0000000000..18a79b9dff
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_loop.c
@@ -0,0 +1,210 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Event loop mechanism for our backend.
+ *
+ * For more information, see the big theory statement in
+ * lib/varpd/svp/common/libvarpd_svp.c.
+ */
+
+#include <unistd.h>
+#include <thread.h>
+#include <port.h>
+#include <signal.h>
+#include <time.h>
+#include <errno.h>
+#include <umem.h>
+
+#include <libvarpd_svp.h>
+
+typedef struct svp_event_loop {
+	int		sel_port;	/* RO */
+	int		sel_nthread;	/* RO */
+	thread_t	*sel_threads;	/* RO */
+	boolean_t	sel_stop;	/* svp_elock */
+	timer_t		sel_hosttimer;
+} svp_event_loop_t;
+
+static svp_event_loop_t svp_event;
+static mutex_t svp_elock = ERRORCHECKMUTEX;
+
+/* ARGSUSED */
+static void *
+svp_event_thr(void *arg)
+{
+	for (;;) {
+		int ret;
+		port_event_t pe;
+		svp_event_t *sep;
+
+		mutex_enter(&svp_elock);
+		if (svp_event.sel_stop == B_TRUE) {
+			mutex_exit(&svp_elock);
+			break;
+		}
+		mutex_exit(&svp_elock);
+
+		ret = port_get(svp_event.sel_port, &pe, NULL);
+		if (ret != 0) {
+			switch (errno) {
+			case EFAULT:
+			case EBADF:
+			case EINVAL:
+				libvarpd_panic("unexpected port_get errno: %d",
+				    errno);
+			default:
+				break;
+			}
+		}
+
+		if (pe.portev_user == NULL)
+			libvarpd_panic("received event (%p) without "
+			    "protev_user set", &pe);
+		sep = (svp_event_t *)pe.portev_user;
+		sep->se_func(&pe, sep->se_arg);
+	}
+
+	return (NULL);
+}
+
+int
+svp_event_associate(svp_event_t *sep, int fd)
+{
+	int ret;
+
+	ret = port_associate(svp_event.sel_port, PORT_SOURCE_FD, fd,
+	    sep->se_events, sep);
+	if (ret != 0) {
+		switch (errno) {
+		case EBADF:
+		case EBADFD:
+		case EINVAL:
+		case EAGAIN:
+			libvarpd_panic("unexpected port_associate error: %d",
+			    errno);
+		default:
+			ret = errno;
+			break;
+		}
+	}
+
+	return (ret);
+}
+
+/* ARGSUSED */
+int
+svp_event_dissociate(svp_event_t *sep, int fd)
+{
+	int ret;
+
+	ret = port_dissociate(svp_event.sel_port, PORT_SOURCE_FD, fd);
+	if (ret != 0) {
+		if (errno != ENOENT)
+			libvarpd_panic("unexpected port_dissociate error: %d",
+			    errno);
+		ret = errno;
+	}
+	return (ret);
+}
+
+int
+svp_event_inject(svp_event_t *user)
+{
+	return (port_send(svp_event.sel_port, 0, user));
+}
+
+int
+svp_event_timer_init(svp_event_t *sep)
+{
+	port_notify_t pn;
+	struct sigevent evp;
+	struct itimerspec ts;
+
+	pn.portnfy_port = svp_event.sel_port;
+	pn.portnfy_user = sep;
+	evp.sigev_notify = SIGEV_PORT;
+	evp.sigev_value.sival_ptr = &pn;
+
+	if (timer_create(CLOCK_REALTIME, &evp, &svp_event.sel_hosttimer) != 0)
+		return (errno);
+
+	ts.it_value.tv_sec = svp_tickrate;
+	ts.it_value.tv_nsec = 0;
+	ts.it_interval.tv_sec = svp_tickrate;
+	ts.it_interval.tv_nsec = 0;
+
+	if (timer_settime(svp_event.sel_hosttimer, TIMER_RELTIME, &ts,
+	    NULL) != 0) {
+		int ret = errno;
+		(void) timer_delete(svp_event.sel_hosttimer);
+		return (ret);
+	}
+
+	return (0);
+}
+
+int
+svp_event_init(void)
+{
+	long i, ncpus;
+
+	svp_event.sel_port = port_create();
+	if (svp_event.sel_port == -1)
+		return (errno);
+
+	ncpus = sysconf(_SC_NPROCESSORS_ONLN) * 2 + 1;
+	if (ncpus <= 0)
+		libvarpd_panic("sysconf for nprocs failed... %d/%d",
+		    ncpus, errno);
+
+	svp_event.sel_threads = umem_alloc(sizeof (thread_t) * ncpus,
+	    UMEM_DEFAULT);
+	if (svp_event.sel_threads == NULL) {
+		int ret = errno;
+		(void) timer_delete(svp_event.sel_hosttimer);
+		(void) close(svp_event.sel_port);
+		svp_event.sel_port = -1;
+		return (ret);
+	}
+
+	for (i = 0; i < ncpus; i++) {
+		int ret;
+		thread_t *thr = &svp_event.sel_threads[i];
+
+		ret = thr_create(NULL, 0, svp_event_thr, NULL,
+		    THR_DETACHED | THR_DAEMON, thr);
+		if (ret != 0) {
+			ret = errno;
+			(void) timer_delete(svp_event.sel_hosttimer);
+			(void) close(svp_event.sel_port);
+			svp_event.sel_port = -1;
+			return (errno);
+		}
+	}
+
+	return (0);
+}
+
+void
+svp_event_fini(void)
+{
+	mutex_enter(&svp_elock);
+	svp_event.sel_stop = B_TRUE;
+	mutex_exit(&svp_elock);
+
+	(void) timer_delete(svp_event.sel_hosttimer);
+	(void) close(svp_event.sel_port);
+}
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_prot.h b/usr/src/lib/varpd/svp/common/libvarpd_svp_prot.h
new file mode 100644
index 0000000000..16dbdbec05
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_prot.h
@@ -0,0 +1,236 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LIBVARPD_SVP_PROT_H
+#define	_LIBVARPD_SVP_PROT_H
+
+/*
+ * SVP protocol Definitions
+ */
+
+#include <sys/types.h>
+#include <inttypes.h>
+#include <sys/ethernet.h>
+#include <netinet/in.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * SDC VXLAN Protocol Definitions
+ */
+
+#define	SVP_VERSION_ONE	1
+#define	SVP_CURRENT_VERSION	SVP_VERSION_ONE
+
+typedef struct svp_req {
+	uint16_t	svp_ver;
+	uint16_t	svp_op;
+	uint32_t	svp_size;
+	uint32_t	svp_id;
+	uint32_t	svp_crc32;
+} svp_req_t;
+
+typedef enum svp_op {
+	SVP_R_UNKNOWN		= 0x00,
+	SVP_R_PING		= 0x01,
+	SVP_R_PONG		= 0x02,
+	SVP_R_VL2_REQ		= 0x03,
+	SVP_R_VL2_ACK		= 0x04,
+	SVP_R_VL3_REQ		= 0x05,
+	SVP_R_VL3_ACK		= 0x06,
+	SVP_R_BULK_REQ		= 0x07,
+	SVP_R_BULK_ACK		= 0x08,
+	SVP_R_LOG_REQ		= 0x09,
+	SVP_R_LOG_ACK		= 0x0A,
+	SVP_R_LOG_RM		= 0x0B,
+	SVP_R_LOG_RM_ACK	= 0x0C,
+	SVP_R_SHOOTDOWN		= 0x0D
+} svp_op_t;
+
+typedef enum svp_status {
+	SVP_S_OK	= 0x00,	/* Everything OK */
+	SVP_S_FATAL	= 0x01,	/* Fatal error, close connection */
+	SVP_S_NOTFOUND	= 0x02,	/* Entry not found */
+	SVP_S_BADL3TYPE	= 0x03,	/* Unknown svp_vl3_type_t */
+	SVP_S_BADBULK	= 0x04	/* Unknown svp_bulk_type_t */
+} svp_status_t;
+
+/*
+ * A client issues the SVP_R_VL2_REQ whenever it needs to perform a VLS->UL3
+ * lookup. Requests have the following structure:
+ */
+typedef struct svp_vl2_req {
+	uint8_t		sl2r_mac[ETHERADDRL];
+	uint8_t		sl2r_pad[2];
+	uint32_t	sl2r_vnetid;
+} svp_vl2_req_t;
+
+/*
+ * This is the message a server uses to reply to the SVP_R_VL2_REQ.  If the
+ * destination on the underlay is an IPv4 address, it should be encoded as an
+ * IPv4-mapped IPv6 address.
+ */
+typedef struct svp_vl2_ack {
+	uint16_t	sl2a_status;
+	uint16_t	sl2a_port;
+	uint8_t		sl2a_addr[16];
+} svp_vl2_ack_t;
+
+
+/*
+ * A client issues the SVP_R_VL3_REQ request whenever it needs to perform a
+ * VL3->VL2 lookup.  Note, that this also implicitly performs a VL2->UL3 lookup
+ * as well. The sl3r_type member is used to indicate the kind of lookup type
+ * that we're performing, eg. is it a L3 or L2.
+ */
+typedef enum svp_vl3_type {
+	SVP_VL3_IP	= 0x01,
+	SVP_VL3_IPV6	= 0x02
+} svp_vl3_type_t;
+
+typedef struct svp_vl3_req {
+	uint8_t		sl3r_ip[16];
+	uint32_t	sl3r_type;
+	uint32_t	sl3r_vnetid;
+} svp_vl3_req_t;
+
+/*
+ * This response, corresponding to the SVP_R_VL3_ACK, includes an answer to both
+ * the VL3->VL2 and the VL2->UL3 requests.
+ */
+typedef struct svp_vl3_ack {
+	uint32_t	sl3a_status;
+	uint8_t		sl3a_mac[ETHERADDRL];
+	uint16_t	sl3a_uport;
+	uint8_t		sl3a_uip[16];
+} svp_vl3_ack_t;
+
+/*
+ * SVP_R_BULK_REQ requests a bulk dump of data. Currently we have two kinds of
+ * data tables that we need to dump: VL3->VL2 mappings and VL2->UL3 mappings.
+ * The kind that we want is indicated using the svbr_type member.
+ */
+typedef enum svp_bulk_type {
+	SVP_BULK_VL2	= 0x01,
+	SVP_BULK_VL3	= 0x02
+} svp_bulk_type_t;
+
+typedef struct svp_bulk_req {
+	uint32_t	svbr_type;
+} svp_bulk_req_t;
+
+/*
+ * When replying to a bulk request (SVP_R_BULK_ACK), data is streamed back
+ * across.  The format of the data is currently undefined and as we work on the
+ * system, we'll get a better understanding of what this should look like. A
+ * client may need to stream such a request to disk, or the format will need to
+ * be in a streamable format that allows the client to construct data.
+ */
+typedef struct svp_bulk_ack {
+	uint32_t	svba_status;
+	uint32_t	svba_type;
+	uint8_t		svba_data[];
+} svp_bulk_ack_t;
+
+/*
+ * SVP_R_LOG_REQ requests a log entries from the specified log from the server.
+ * The total number of bytes that the user is ready to receive is in svlr_count.
+ * However, the server should not block for data if none is available and thus
+ * may return less than svlr_count bytes back. We identify the IP address of the
+ * underlay to use here explicitly.
+ */
+typedef struct svp_log_req {
+	uint32_t	svlr_count;
+	uint8_t		svlr_ip[16];
+} svp_log_req_t;
+
+/*
+ * The server replies to a log request by sending a series of log entries.
+ * These log entries may be a mixture of both vl2 and vl3 records. The reply is
+ * a stream of bytes after the status message whose length is determined baseed
+ * on the header itself. Each entry begins with a uint32_t that describes its
+ * type and then is followed by the remaining data payload. The next entry
+ * follows immediately which again begins with the uint32_t word that describes
+ * what it should be.
+ */
+typedef enum svp_log_type {
+	SVP_LOG_VL2	= 0x01,
+	SVP_LOG_VL3	= 0x02
+} svp_log_type_t;
+
+typedef struct svp_log_vl2 {
+	uint32_t	svl2_type;	/* Should be SVP_LOG_VL2 */
+	uint8_t		svl2_id[16];	/* 16-byte UUID */
+	uint8_t		svl2_mac[ETHERADDRL];
+	uint8_t		svl2_pad[2];
+	uint32_t	svl2_vnetid;
+} svp_log_vl2_t;
+
+typedef struct svp_log_vl3 {
+	uint32_t	svl3_type;	/* Should be SVP_LOG_VL3 */
+	uint8_t		svl3_id[16];	/* 16-byte UUID */
+	uint8_t		svl3_ip[16];
+	uint8_t		svl3_pad[2];
+	uint16_t	svl3_vlan;
+	uint32_t	svl3_vnetid;
+} svp_log_vl3_t;
+
+typedef struct svp_log_ack {
+	uint32_t	svla_status;
+	uint8_t		svla_data[];
+} svp_log_ack_t;
+
+/*
+ * SVP_R_LOG_RM is used after the client successfully processes a series of the
+ * log stream. It replies to tell the server that it can remove those IDs from
+ * processing. The IDs used are the same IDs that were in the individual
+ * SVP_R_LOG_ACK entries.
+ */
+typedef struct svp_lrm_req {
+	uint32_t	svrr_count;
+	uint8_t		svrr_ids[];
+} svp_lrm_req_t;
+
+/*
+ * SVP_R_LOG_RM_ACK is used to indicate that a log entry has been successfully
+ * deleted and at this point it makes sense to go and ask for another
+ * SVP_R_LOG_REQ.
+ */
+typedef struct svp_lrm_ack {
+	uint32_t	svra_status;
+} svp_lrm_ack_t;
+
+/*
+ * A shootdown (SVP_R_SHOOTDOWN) is used by a CN to reply to another CN that it
+ * sent an invalid entry that could not be processed. This should be a
+ * relatively infrequent occurrence. Unlike the rest of the messages, there is
+ * no reply to it. It's a single request to try and help get us out there. When
+ * a node receives this, it will issue a conditional revocation ioctl, that
+ * removes the entry if and only if, it matches the IP. That way if we've
+ * already gotten an updated entry for this, we don't remove it again.
+ */
+typedef struct svp_shootdown {
+	uint8_t		svsd_mac[ETHERADDRL];
+	uint8_t		svsd_pad[2];
+	uint32_t	svsd_vnetid;
+} svp_shootdown_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LIBVARPD_SVP_PROT_H */
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_remote.c b/usr/src/lib/varpd/svp/common/libvarpd_svp_remote.c
new file mode 100644
index 0000000000..8d482e4a12
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_remote.c
@@ -0,0 +1,821 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Remote backend management
+ *
+ * For more information, see the big theory statement in
+ * lib/varpd/svp/common/libvarpd_svp.c.
+ */
+
+#include <umem.h>
+#include <strings.h>
+#include <string.h>
+#include <stddef.h>
+#include <thread.h>
+#include <synch.h>
+#include <assert.h>
+#include <sys/socket.h>
+#include <netdb.h>
+#include <errno.h>
+#include <libidspace.h>
+
+#include <libvarpd_provider.h>
+#include <libvarpd_svp.h>
+
+typedef struct svp_shoot_vl3 {
+	svp_query_t		ssv_query;
+	struct sockaddr_in6	ssv_sock;
+	svp_log_vl3_t 		*ssv_vl3;
+	svp_sdlog_t		*ssv_log;
+} svp_shoot_vl3_t;
+
+static mutex_t svp_remote_lock = ERRORCHECKMUTEX;
+static avl_tree_t svp_remote_tree;
+static svp_timer_t svp_dns_timer;
+static id_space_t *svp_idspace;
+static int svp_dns_timer_rate = 30;	/* seconds */
+
+static void
+svp_remote_mkfmamsg(svp_remote_t *srp, svp_degrade_state_t state, char *buf,
+    size_t buflen)
+{
+	switch (state) {
+	case SVP_RD_DNS_FAIL:
+		(void) snprintf(buf, buflen, "failed to resolve or find "
+		    "entries for hostname %s", srp->sr_hostname);
+		break;
+	case SVP_RD_REMOTE_FAIL:
+		(void) snprintf(buf, buflen, "cannot reach any remote peers");
+		break;
+	default:
+		(void) snprintf(buf, buflen, "unkonwn error state: %d", state);
+	}
+}
+
+static int
+svp_remote_comparator(const void *l, const void *r)
+{
+	int ret;
+	const svp_remote_t *lr = l, *rr = r;
+
+	ret = strcmp(lr->sr_hostname, rr->sr_hostname);
+	if (ret > 0)
+		return (1);
+	else if (ret < 0)
+		return (-1);
+
+	if (lr->sr_rport > rr->sr_rport)
+		return (1);
+	else if (lr->sr_rport < rr->sr_rport)
+		return (-1);
+
+	return (memcmp(&lr->sr_uip, &rr->sr_uip, sizeof (struct in6_addr)));
+}
+
+void
+svp_query_release(svp_query_t *sqp)
+{
+	id_free(svp_idspace, sqp->sq_header.svp_id);
+}
+
+static void
+svp_remote_destroy(svp_remote_t *srp)
+{
+	size_t len;
+
+	/*
+	 * Clean up any unrelated DNS information. At this point we know that
+	 * we're not in the remote tree. That means, that svp_remote_dns_timer
+	 * cannot queue us. However, if any of our DNS related state flags are
+	 * set, we have to hang out.
+	 */
+	mutex_enter(&srp->sr_lock);
+	while (srp->sr_state &
+	    (SVP_RS_LOOKUP_SCHEDULED | SVP_RS_LOOKUP_INPROGRESS)) {
+		(void) cond_wait(&srp->sr_cond, &srp->sr_lock);
+	}
+	mutex_exit(&srp->sr_lock);
+	svp_shootdown_fini(srp);
+
+	if (cond_destroy(&srp->sr_cond) != 0)
+		libvarpd_panic("failed to destroy cond sr_cond");
+
+	if (mutex_destroy(&srp->sr_lock) != 0)
+		libvarpd_panic("failed to destroy mutex sr_lock");
+
+	if (srp->sr_addrinfo != NULL)
+		freeaddrinfo(srp->sr_addrinfo);
+	len = strlen(srp->sr_hostname) + 1;
+	umem_free(srp->sr_hostname, len);
+	umem_free(srp, sizeof (svp_remote_t));
+}
+
+static int
+svp_remote_create(const char *host, uint16_t port, struct in6_addr *uip,
+    svp_remote_t **outp)
+{
+	size_t hlen;
+	svp_remote_t *remote;
+
+	assert(MUTEX_HELD(&svp_remote_lock));
+
+	remote = umem_zalloc(sizeof (svp_remote_t), UMEM_DEFAULT);
+	if (remote == NULL) {
+		mutex_exit(&svp_remote_lock);
+		return (ENOMEM);
+	}
+
+	if (svp_shootdown_init(remote) != 0) {
+		umem_free(remote, sizeof (svp_remote_t));
+		mutex_exit(&svp_remote_lock);
+		return (ENOMEM);
+	}
+
+	hlen = strlen(host) + 1;
+	remote->sr_hostname = umem_alloc(hlen, UMEM_DEFAULT);
+	if (remote->sr_hostname == NULL) {
+		svp_shootdown_fini(remote);
+		umem_free(remote, sizeof (svp_remote_t));
+		mutex_exit(&svp_remote_lock);
+		return (ENOMEM);
+	}
+	remote->sr_rport = port;
+	if (mutex_init(&remote->sr_lock,
+	    USYNC_THREAD | LOCK_ERRORCHECK, NULL) != 0)
+		libvarpd_panic("failed to create mutex sr_lock");
+	if (cond_init(&remote->sr_cond, USYNC_PROCESS, NULL) != 0)
+		libvarpd_panic("failed to create cond sr_cond");
+	list_create(&remote->sr_conns, sizeof (svp_conn_t),
+	    offsetof(svp_conn_t, sc_rlist));
+	avl_create(&remote->sr_tree, svp_comparator, sizeof (svp_t),
+	    offsetof(svp_t, svp_rlink));
+	(void) strlcpy(remote->sr_hostname, host, hlen);
+	remote->sr_count = 1;
+	remote->sr_uip = *uip;
+
+	svp_shootdown_start(remote);
+
+	*outp = remote;
+	return (0);
+}
+
+int
+svp_remote_find(char *host, uint16_t port, struct in6_addr *uip,
+    svp_remote_t **outp)
+{
+	int ret;
+	svp_remote_t lookup, *remote;
+
+	lookup.sr_hostname = host;
+	lookup.sr_rport = port;
+	lookup.sr_uip = *uip;
+	mutex_enter(&svp_remote_lock);
+	remote = avl_find(&svp_remote_tree, &lookup, NULL);
+	if (remote != NULL) {
+		assert(remote->sr_count > 0);
+		remote->sr_count++;
+		*outp = remote;
+		mutex_exit(&svp_remote_lock);
+		return (0);
+	}
+
+	if ((ret = svp_remote_create(host, port, uip, outp)) != 0) {
+		mutex_exit(&svp_remote_lock);
+		return (ret);
+	}
+
+	avl_add(&svp_remote_tree, *outp);
+	mutex_exit(&svp_remote_lock);
+
+	/* Make sure DNS is up to date */
+	svp_host_queue(*outp);
+
+	return (0);
+}
+
+void
+svp_remote_release(svp_remote_t *srp)
+{
+	mutex_enter(&svp_remote_lock);
+	mutex_enter(&srp->sr_lock);
+	srp->sr_count--;
+	if (srp->sr_count != 0) {
+		mutex_exit(&srp->sr_lock);
+		mutex_exit(&svp_remote_lock);
+		return;
+	}
+	mutex_exit(&srp->sr_lock);
+
+	avl_remove(&svp_remote_tree, srp);
+	mutex_exit(&svp_remote_lock);
+	svp_remote_destroy(srp);
+}
+
+int
+svp_remote_attach(svp_remote_t *srp, svp_t *svp)
+{
+	svp_t check;
+	avl_index_t where;
+
+	mutex_enter(&srp->sr_lock);
+	if (svp->svp_remote != NULL)
+		libvarpd_panic("failed to create mutex sr_lock");
+
+	/*
+	 * We require everything except shootdowns
+	 */
+	if (svp->svp_cb.scb_vl2_lookup == NULL)
+		libvarpd_panic("missing callback scb_vl2_lookup");
+	if (svp->svp_cb.scb_vl3_lookup == NULL)
+		libvarpd_panic("missing callback scb_vl3_lookup");
+	if (svp->svp_cb.scb_vl2_invalidate == NULL)
+		libvarpd_panic("missing callback scb_vl2_invalidate");
+	if (svp->svp_cb.scb_vl3_inject == NULL)
+		libvarpd_panic("missing callback scb_vl3_inject");
+
+	check.svp_vid = svp->svp_vid;
+	if (avl_find(&srp->sr_tree, &check, &where) != NULL)
+		libvarpd_panic("found duplicate entry with vid %ld",
+		    svp->svp_vid);
+	avl_insert(&srp->sr_tree, svp, where);
+	svp->svp_remote = srp;
+	mutex_exit(&srp->sr_lock);
+
+	return (0);
+}
+
+void
+svp_remote_detach(svp_t *svp)
+{
+	svp_t *lookup;
+	svp_remote_t *srp = svp->svp_remote;
+
+	if (srp == NULL)
+		libvarpd_panic("trying to detach remote when none exists");
+
+	mutex_enter(&srp->sr_lock);
+	lookup = avl_find(&srp->sr_tree, svp, NULL);
+	if (lookup == NULL || lookup != svp)
+		libvarpd_panic("inconsitent remote avl tree...");
+	avl_remove(&srp->sr_tree, svp);
+	svp->svp_remote = NULL;
+	mutex_exit(&srp->sr_lock);
+	svp_remote_release(srp);
+}
+
+/*
+ * Walk the list of connections and find the first one that's available, the
+ * move it to the back of the list so it's less likely to be used again.
+ */
+static boolean_t
+svp_remote_conn_queue(svp_remote_t *srp, svp_query_t *sqp)
+{
+	svp_conn_t *scp;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	for (scp = list_head(&srp->sr_conns); scp != NULL;
+	    scp = list_next(&srp->sr_conns, scp)) {
+		mutex_enter(&scp->sc_lock);
+		if (scp->sc_cstate != SVP_CS_ACTIVE) {
+			mutex_exit(&scp->sc_lock);
+			continue;
+		}
+		svp_conn_queue(scp, sqp);
+		mutex_exit(&scp->sc_lock);
+		list_remove(&srp->sr_conns, scp);
+		list_insert_tail(&srp->sr_conns, scp);
+		return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+static void
+svp_remote_vl2_lookup_cb(svp_query_t *sqp, void *arg)
+{
+	svp_t *svp = sqp->sq_svp;
+	svp_vl2_ack_t *vl2a = (svp_vl2_ack_t *)sqp->sq_wdata;
+
+	if (sqp->sq_status == SVP_S_OK)
+		svp->svp_cb.scb_vl2_lookup(svp, sqp->sq_status,
+		    (struct in6_addr *)vl2a->sl2a_addr, ntohs(vl2a->sl2a_port),
+		    arg);
+	else
+		svp->svp_cb.scb_vl2_lookup(svp, sqp->sq_status, NULL, 0, arg);
+}
+
+void
+svp_remote_vl2_lookup(svp_t *svp, svp_query_t *sqp, const uint8_t *mac,
+    void *arg)
+{
+	svp_remote_t *srp;
+	svp_vl2_req_t *vl2r = &sqp->sq_rdun.sqd_vl2r;
+
+	srp = svp->svp_remote;
+	sqp->sq_func = svp_remote_vl2_lookup_cb;
+	sqp->sq_arg = arg;
+	sqp->sq_svp = svp;
+	sqp->sq_state = SVP_QUERY_INIT;
+	sqp->sq_header.svp_ver = htons(SVP_CURRENT_VERSION);
+	sqp->sq_header.svp_op = htons(SVP_R_VL2_REQ);
+	sqp->sq_header.svp_size = htonl(sizeof (svp_vl2_req_t));
+	sqp->sq_header.svp_id = id_alloc(svp_idspace);
+	if (sqp->sq_header.svp_id == (id_t)-1)
+		libvarpd_panic("failed to allcoate from svp_idspace: %d",
+		    errno);
+	sqp->sq_header.svp_crc32 = htonl(0);
+	sqp->sq_rdata = vl2r;
+	sqp->sq_rsize = sizeof (svp_vl2_req_t);
+	sqp->sq_wdata = NULL;
+	sqp->sq_wsize = 0;
+
+	bcopy(mac, vl2r->sl2r_mac, ETHERADDRL);
+	vl2r->sl2r_vnetid = ntohl(svp->svp_vid);
+
+	mutex_enter(&srp->sr_lock);
+	if (svp_remote_conn_queue(srp, sqp) == B_FALSE)
+		svp->svp_cb.scb_vl2_lookup(svp, SVP_S_FATAL, NULL, NULL, arg);
+	mutex_exit(&srp->sr_lock);
+}
+
+static void
+svp_remote_vl3_lookup_cb(svp_query_t *sqp, void *arg)
+{
+	svp_t *svp = sqp->sq_svp;
+	svp_vl3_ack_t *vl3a = (svp_vl3_ack_t *)sqp->sq_wdata;
+
+	if (sqp->sq_status == SVP_S_OK)
+		svp->svp_cb.scb_vl3_lookup(svp, sqp->sq_status, vl3a->sl3a_mac,
+		    (struct in6_addr *)vl3a->sl3a_uip, ntohs(vl3a->sl3a_uport),
+		    arg);
+	else
+		svp->svp_cb.scb_vl3_lookup(svp, sqp->sq_status, NULL, NULL, 0,
+		    arg);
+}
+
+static void
+svp_remote_vl3_common(svp_remote_t *srp, svp_query_t *sqp,
+    const struct sockaddr *addr,  svp_query_f func, void *arg, uint32_t vid)
+{
+	svp_vl3_req_t *vl3r = &sqp->sq_rdun.sdq_vl3r;
+
+	if (addr->sa_family != AF_INET && addr->sa_family != AF_INET6)
+		libvarpd_panic("unexpected sa_family for the vl3 lookup");
+
+	sqp->sq_func = func;
+	sqp->sq_arg = arg;
+	sqp->sq_state = SVP_QUERY_INIT;
+	sqp->sq_header.svp_ver = htons(SVP_CURRENT_VERSION);
+	sqp->sq_header.svp_op = htons(SVP_R_VL3_REQ);
+	sqp->sq_header.svp_size = htonl(sizeof (svp_vl3_req_t));
+	sqp->sq_header.svp_id = id_alloc(svp_idspace);
+	if (sqp->sq_header.svp_id == (id_t)-1)
+		libvarpd_panic("failed to allcoate from svp_idspace: %d",
+		    errno);
+	sqp->sq_header.svp_crc32 = htonl(0);
+	sqp->sq_rdata = vl3r;
+	sqp->sq_rsize = sizeof (svp_vl3_req_t);
+	sqp->sq_wdata = NULL;
+	sqp->sq_wsize = 0;
+
+	if (addr->sa_family == AF_INET6) {
+		struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)addr;
+		vl3r->sl3r_type = htonl(SVP_VL3_IPV6);
+		bcopy(&s6->sin6_addr, vl3r->sl3r_ip,
+		    sizeof (struct in6_addr));
+	} else {
+		struct sockaddr_in *s4 = (struct sockaddr_in *)addr;
+		struct in6_addr v6;
+
+		vl3r->sl3r_type = htonl(SVP_VL3_IP);
+		IN6_INADDR_TO_V4MAPPED(&s4->sin_addr, &v6);
+		bcopy(&v6, vl3r->sl3r_ip, sizeof (struct in6_addr));
+	}
+	vl3r->sl3r_vnetid = htonl(vid);
+
+	mutex_enter(&srp->sr_lock);
+	if (svp_remote_conn_queue(srp, sqp) == B_FALSE) {
+		sqp->sq_status = SVP_S_FATAL;
+		sqp->sq_func(sqp, arg);
+	}
+	mutex_exit(&srp->sr_lock);
+}
+
+/*
+ * This is a request to do a VL3 look-up that originated internally as opposed
+ * to coming from varpd. As such we need a slightly different query callback
+ * function upon completion and don't go through the normal path with the svp_t.
+ */
+void
+svp_remote_vl3_logreq(svp_remote_t *srp, svp_query_t *sqp, uint32_t vid,
+    const struct sockaddr *addr, svp_query_f func, void *arg)
+{
+	svp_remote_vl3_common(srp, sqp, addr, func, arg, vid);
+}
+
+void
+svp_remote_vl3_lookup(svp_t *svp, svp_query_t *sqp,
+    const struct sockaddr *addr, void *arg)
+{
+	svp_remote_t *srp = svp->svp_remote;
+
+	sqp->sq_svp = svp;
+	svp_remote_vl3_common(srp, sqp, addr, svp_remote_vl3_lookup_cb,
+	    arg, svp->svp_vid);
+}
+
+static void
+svp_remote_log_request_cb(svp_query_t *sqp, void *arg)
+{
+	svp_remote_t *srp = sqp->sq_arg;
+
+	assert(sqp->sq_wdata != NULL);
+	if (sqp->sq_status == SVP_S_OK)
+		svp_shootdown_logr_cb(srp, sqp->sq_status, sqp->sq_wdata,
+		    sqp->sq_size);
+	else
+		svp_shootdown_logr_cb(srp, sqp->sq_status, NULL, 0);
+}
+
+void
+svp_remote_log_request(svp_remote_t *srp, svp_query_t *sqp, void *buf,
+    size_t buflen)
+{
+	svp_log_req_t *logr = &sqp->sq_rdun.sdq_logr;
+	boolean_t queued;
+
+	sqp->sq_func = svp_remote_log_request_cb;
+	sqp->sq_state = SVP_QUERY_INIT;
+	sqp->sq_arg = srp;
+	sqp->sq_header.svp_ver = htons(SVP_CURRENT_VERSION);
+	sqp->sq_header.svp_op = htons(SVP_R_LOG_REQ);
+	sqp->sq_header.svp_size = htonl(sizeof (svp_log_req_t));
+	sqp->sq_header.svp_id = id_alloc(svp_idspace);
+	if (sqp->sq_header.svp_id == (id_t)-1)
+		libvarpd_panic("failed to allcoate from svp_idspace: %d",
+		    errno);
+	sqp->sq_header.svp_crc32 = htonl(0);
+	sqp->sq_rdata = logr;
+	sqp->sq_rsize = sizeof (svp_log_req_t);
+	sqp->sq_wdata = buf;
+	sqp->sq_wsize = buflen;
+
+	logr->svlr_count = htonl(buflen);
+	bcopy(&srp->sr_uip, logr->svlr_ip, sizeof (struct in6_addr));
+
+	/*
+	 * If this fails, there isn't much that we can't do. Give the callback
+	 * with a fatal status.
+	 */
+	mutex_enter(&srp->sr_lock);
+	queued = svp_remote_conn_queue(srp, sqp);
+	mutex_exit(&srp->sr_lock);
+
+	if (queued == B_FALSE)
+		svp_shootdown_logr_cb(srp, SVP_S_FATAL, NULL, 0);
+}
+
+static void
+svp_remote_lrm_request_cb(svp_query_t *sqp, void *arg)
+{
+	svp_remote_t *srp = arg;
+
+	svp_shootdown_lrm_cb(srp, sqp->sq_status);
+}
+
+void
+svp_remote_lrm_request(svp_remote_t *srp, svp_query_t *sqp, void *buf,
+    size_t buflen)
+{
+	boolean_t queued;
+	svp_lrm_req_t *svrr = buf;
+
+	sqp->sq_func = svp_remote_lrm_request_cb;
+	sqp->sq_state = SVP_QUERY_INIT;
+	sqp->sq_arg = srp;
+	sqp->sq_header.svp_ver = htons(SVP_CURRENT_VERSION);
+	sqp->sq_header.svp_op = htons(SVP_R_LOG_RM);
+	sqp->sq_header.svp_size = htonl(buflen);
+	sqp->sq_header.svp_id = id_alloc(svp_idspace);
+	if (sqp->sq_header.svp_id == (id_t)-1)
+		libvarpd_panic("failed to allcoate from svp_idspace: %d",
+		    errno);
+	sqp->sq_header.svp_crc32 = htonl(0);
+	sqp->sq_rdata = buf;
+	sqp->sq_rsize = buflen;
+	sqp->sq_wdata = NULL;
+	sqp->sq_wsize = 0;
+
+	/*
+	 * We need to fix up the count to be in proper network order.
+	 */
+	svrr->svrr_count = htonl(svrr->svrr_count);
+
+	/*
+	 * If this fails, there isn't much that we can't do. Give the callback
+	 * with a fatal status.
+	 */
+	mutex_enter(&srp->sr_lock);
+	queued = svp_remote_conn_queue(srp, sqp);
+	mutex_exit(&srp->sr_lock);
+
+	if (queued == B_FALSE)
+		svp_shootdown_logr_cb(srp, SVP_S_FATAL, NULL, 0);
+}
+
+/* ARGSUSED */
+void
+svp_remote_dns_timer(void *unused)
+{
+	svp_remote_t *s;
+	mutex_enter(&svp_remote_lock);
+	for (s = avl_first(&svp_remote_tree); s != NULL;
+	    s = AVL_NEXT(&svp_remote_tree, s)) {
+		svp_host_queue(s);
+	}
+	mutex_exit(&svp_remote_lock);
+}
+
+void
+svp_remote_resolved(svp_remote_t *srp, struct addrinfo *newaddrs)
+{
+	struct addrinfo *a;
+	svp_conn_t *scp;
+	int ngen;
+
+	mutex_enter(&srp->sr_lock);
+	srp->sr_gen++;
+	ngen = srp->sr_gen;
+	mutex_exit(&srp->sr_lock);
+
+	for (a = newaddrs; a != NULL; a = a->ai_next) {
+		struct in6_addr in6;
+		struct in6_addr *addrp;
+
+		if (a->ai_family != AF_INET && a->ai_family != AF_INET6)
+			continue;
+
+		if (a->ai_family == AF_INET) {
+			struct sockaddr_in *v4;
+			v4 = (struct sockaddr_in *)a->ai_addr;
+			addrp = &in6;
+			IN6_INADDR_TO_V4MAPPED(&v4->sin_addr, addrp);
+		} else {
+			struct sockaddr_in6 *v6;
+			v6 = (struct sockaddr_in6 *)a->ai_addr;
+			addrp = &v6->sin6_addr;
+		}
+
+		mutex_enter(&srp->sr_lock);
+		for (scp = list_head(&srp->sr_conns); scp != NULL;
+		    scp = list_next(&srp->sr_conns, scp)) {
+			mutex_enter(&scp->sc_lock);
+			if (bcmp(addrp, &scp->sc_addr,
+			    sizeof (struct in6_addr)) == 0) {
+				scp->sc_gen = ngen;
+				mutex_exit(&scp->sc_lock);
+				break;
+			}
+			mutex_exit(&scp->sc_lock);
+		}
+
+		/*
+		 * We need to be careful in the assumptions that we make here,
+		 * as there's a good chance that svp_conn_create will
+		 * drop the svp_remote_t`sr_lock to kick off its effective event
+		 * loop.
+		 */
+		if (scp == NULL)
+			(void) svp_conn_create(srp, addrp);
+		mutex_exit(&srp->sr_lock);
+	}
+
+	/*
+	 * Now it's time to clean things up. We do not actively clean up the
+	 * current connections that we have, instead allowing them to stay
+	 * around assuming that they're still useful. Instead, we go through and
+	 * purge the degraded list for anything that's from an older generation.
+	 */
+	mutex_enter(&srp->sr_lock);
+	for (scp = list_head(&srp->sr_conns); scp != NULL;
+	    scp = list_next(&srp->sr_conns, scp)) {
+		boolean_t fall = B_FALSE;
+		mutex_enter(&scp->sc_lock);
+		if (scp->sc_gen < srp->sr_gen)
+			fall = B_TRUE;
+		mutex_exit(&scp->sc_lock);
+		if (fall == B_TRUE)
+			svp_conn_fallout(scp);
+	}
+	mutex_exit(&srp->sr_lock);
+}
+
+/*
+ * This connection is in the process of being reset, we need to reassign all of
+ * its queries to other places or mark them as fatal. Note that the first
+ * connection was the one in flight when this failed. We always mark it as
+ * failed to avoid trying to reset its state.
+ */
+void
+svp_remote_reassign(svp_remote_t *srp, svp_conn_t *scp)
+{
+	boolean_t first = B_TRUE;
+	assert(MUTEX_HELD(&srp->sr_lock));
+	assert(MUTEX_HELD(&srp->sr_lock));
+	svp_query_t *sqp;
+
+	/*
+	 * As we try to reassigning all of its queries, remove it from the list.
+	 */
+	list_remove(&srp->sr_conns, scp);
+
+	while ((sqp = list_remove_head(&scp->sc_queries)) != NULL) {
+
+		if (first == B_TRUE) {
+			sqp->sq_status = SVP_S_FATAL;
+			sqp->sq_func(sqp, sqp->sq_arg);
+			continue;
+		}
+
+		sqp->sq_acttime = -1;
+
+		/*
+		 * We may want to maintain a queue of these for some time rather
+		 * than just failing them all.
+		 */
+		if (svp_remote_conn_queue(srp, sqp) == B_FALSE) {
+			sqp->sq_status = SVP_S_FATAL;
+			sqp->sq_func(sqp, sqp->sq_arg);
+		}
+	}
+
+	/*
+	 * Now that we're done, go ahead and re-insert.
+	 */
+	list_insert_tail(&srp->sr_conns, scp);
+}
+
+void
+svp_remote_degrade(svp_remote_t *srp, svp_degrade_state_t flag)
+{
+	int sf, nf;
+	char buf[256];
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+
+	if (flag == SVP_RD_ALL || flag == 0)
+		libvarpd_panic("invalid flag passed to degrade");
+
+	if ((flag & srp->sr_degrade) != 0) {
+		return;
+	}
+
+	sf = ffs(srp->sr_degrade);
+	nf = ffs(flag);
+	srp->sr_degrade |= flag;
+	if (sf == 0 || sf > nf) {
+		svp_t *svp;
+		svp_remote_mkfmamsg(srp, flag, buf, sizeof (buf));
+
+		for (svp = avl_first(&srp->sr_tree); svp != NULL;
+		    svp = AVL_NEXT(&srp->sr_tree, svp)) {
+			libvarpd_fma_degrade(svp->svp_hdl, buf);
+		}
+	}
+}
+
+void
+svp_remote_restore(svp_remote_t *srp, svp_degrade_state_t flag)
+{
+	int sf, nf;
+
+	assert(MUTEX_HELD(&srp->sr_lock));
+	sf = ffs(srp->sr_degrade);
+	if ((srp->sr_degrade & flag) != flag)
+		return;
+	srp->sr_degrade &= ~flag;
+	nf = ffs(srp->sr_degrade);
+
+	/*
+	 * If we're now empty, restore the device. If we still are degraded, but
+	 * we now have a higher base than we used to, change the message.
+	 */
+	if (srp->sr_degrade == 0) {
+		svp_t *svp;
+		for (svp = avl_first(&srp->sr_tree); svp != NULL;
+		    svp = AVL_NEXT(&srp->sr_tree, svp)) {
+			libvarpd_fma_restore(svp->svp_hdl);
+		}
+	} else if (nf != sf) {
+		svp_t *svp;
+		char buf[256];
+
+		svp_remote_mkfmamsg(srp, 1U << (nf - 1), buf, sizeof (buf));
+		for (svp = avl_first(&srp->sr_tree); svp != NULL;
+		    svp = AVL_NEXT(&srp->sr_tree, svp)) {
+			libvarpd_fma_degrade(svp->svp_hdl, buf);
+		}
+	}
+}
+
+void
+svp_remote_shootdown_vl3_cb(svp_query_t *sqp, void *arg)
+{
+	svp_shoot_vl3_t *squery = arg;
+	svp_log_vl3_t *svl3 = squery->ssv_vl3;
+	svp_sdlog_t *sdl = squery->ssv_log;
+
+	if (sqp->sq_status == SVP_S_OK) {
+		svp_t *svp, lookup;
+
+		svp_remote_t *srp = sdl->sdl_remote;
+		svp_vl3_ack_t *vl3a = (svp_vl3_ack_t *)sqp->sq_wdata;
+
+		lookup.svp_vid = ntohl(svl3->svl3_vnetid);
+		mutex_enter(&srp->sr_lock);
+		if ((svp = avl_find(&srp->sr_tree, &lookup, NULL)) != NULL) {
+			svp->svp_cb.scb_vl3_inject(svp, ntohs(svl3->svl3_vlan),
+			    (struct in6_addr *)svl3->svl3_ip, vl3a->sl3a_mac,
+			    NULL);
+		}
+		mutex_exit(&srp->sr_lock);
+
+	}
+
+	svp_shootdown_vl3_cb(sqp->sq_status, svl3, sdl);
+
+	umem_free(squery, sizeof (svp_shoot_vl3_t));
+}
+
+void
+svp_remote_shootdown_vl3(svp_remote_t *srp, svp_log_vl3_t *svl3,
+    svp_sdlog_t *sdl)
+{
+	svp_shoot_vl3_t *squery;
+
+	squery = umem_zalloc(sizeof (svp_shoot_vl3_t), UMEM_DEFAULT);
+	if (squery == NULL) {
+		svp_shootdown_vl3_cb(SVP_S_FATAL, svl3, sdl);
+		return;
+	}
+
+	squery->ssv_vl3 = svl3;
+	squery->ssv_log = sdl;
+	squery->ssv_sock.sin6_family = AF_INET6;
+	bcopy(svl3->svl3_ip, &squery->ssv_sock.sin6_addr,
+	    sizeof (svl3->svl3_ip));
+	svp_remote_vl3_logreq(srp, &squery->ssv_query, ntohl(svl3->svl3_vnetid),
+	    (struct sockaddr *)&squery->ssv_sock, svp_remote_shootdown_vl3_cb,
+	    squery);
+}
+
+void
+svp_remote_shootdown_vl2(svp_remote_t *srp, svp_log_vl2_t *svl2)
+{
+	svp_t *svp, lookup;
+
+	lookup.svp_vid = ntohl(svl2->svl2_vnetid);
+	mutex_enter(&srp->sr_lock);
+	if ((svp = avl_find(&srp->sr_tree, &lookup, NULL)) != NULL) {
+		svp->svp_cb.scb_vl2_invalidate(svp, svl2->svl2_mac);
+	}
+	mutex_exit(&srp->sr_lock);
+}
+
+int
+svp_remote_init(void)
+{
+	svp_idspace = id_space_create("svp_req_ids", 1, INT32_MAX);
+	if (svp_idspace == NULL)
+		return (errno);
+	avl_create(&svp_remote_tree, svp_remote_comparator,
+	    sizeof (svp_remote_t), offsetof(svp_remote_t, sr_gnode));
+	svp_dns_timer.st_func = svp_remote_dns_timer;
+	svp_dns_timer.st_arg = NULL;
+	svp_dns_timer.st_oneshot = B_FALSE;
+	svp_dns_timer.st_value = svp_dns_timer_rate;
+	svp_timer_add(&svp_dns_timer);
+	return (0);
+}
+
+void
+svp_remote_fini(void)
+{
+	svp_timer_remove(&svp_dns_timer);
+	avl_destroy(&svp_remote_tree);
+	if (svp_idspace == NULL)
+		id_space_destroy(svp_idspace);
+}
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_shootdown.c b/usr/src/lib/varpd/svp/common/libvarpd_svp_shootdown.c
new file mode 100644
index 0000000000..76afb2519f
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_shootdown.c
@@ -0,0 +1,474 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Shootdown processing logic.
+ *
+ * For more information, see the big theory statement in
+ * lib/varpd/svp/common/libvarpd_svp.c.
+ */
+
+#include <umem.h>
+#include <sys/uuid.h>
+#include <assert.h>
+#include <strings.h>
+#include <errno.h>
+#include <sys/debug.h>
+
+#include <libvarpd_provider.h>
+#include <libvarpd_svp.h>
+
+/*
+ * When we've determined that there's nothing left for us to do, then we go
+ * ahead and wait svp_shootdown_base seconds + up to an additional
+ * svp_shootdown_base seconds before asking again. However, if there is actually
+ * some work going on, just use the svp_shootdown_cont time.
+ */
+static int svp_shootdown_base = 5;
+static int svp_shootdown_cont = 1;
+
+/*
+ * These are sizes for our logack and logrm buffers. The sizing of the shootdown
+ * buffere would give us approximately 18 or so VL3 entries and 32 VL2 entries
+ * or some combination thereof. While it's a bit of overkill, we just use the
+ * same sized buffer for the list of uuids that we pass to remove log entries
+ * that we've acted upon.
+ */
+static int svp_shootdown_buf = 1024;
+
+static void
+svp_shootdown_schedule(svp_sdlog_t *sdl, boolean_t cont)
+{
+	assert(MUTEX_HELD(&sdl->sdl_lock));
+
+	if (cont == B_TRUE) {
+		sdl->sdl_timer.st_value = svp_shootdown_cont;
+	} else {
+		sdl->sdl_timer.st_value = svp_shootdown_base +
+		    arc4random_uniform(svp_shootdown_base + 1);
+	}
+	svp_timer_add(&sdl->sdl_timer);
+}
+
+void
+svp_shootdown_lrm_cb(svp_remote_t *srp, svp_status_t status)
+{
+	svp_sdlog_t *sdl = &srp->sr_shoot;
+
+	mutex_enter(&sdl->sdl_lock);
+	sdl->sdl_flags &= ~SVP_SD_RUNNING;
+	svp_shootdown_schedule(sdl, B_TRUE);
+	mutex_exit(&sdl->sdl_lock);
+
+	if (status != SVP_S_OK) {
+		(void) bunyan_warn(svp_bunyan, "SVP_R_LOG_RM failed",
+		    BUNYAN_T_STRING, "remote_host", srp->sr_hostname,
+		    BUNYAN_T_INT32, "remote_port", srp->sr_rport,
+		    BUNYAN_T_INT32, "status", status,
+		    BUNYAN_T_END);
+	}
+}
+
+static void
+svp_shootdown_ref(svp_sdlog_t *sdl)
+{
+	mutex_enter(&sdl->sdl_lock);
+	sdl->sdl_ref++;
+	mutex_exit(&sdl->sdl_lock);
+}
+
+static void
+svp_shootdown_rele(svp_sdlog_t *sdl)
+{
+	svp_lrm_req_t *svrr = sdl->sdl_logrm;
+	boolean_t next;
+
+	mutex_enter(&sdl->sdl_lock);
+	VERIFY(sdl->sdl_ref > 0);
+	sdl->sdl_ref--;
+	if (sdl->sdl_ref > 0) {
+		mutex_exit(&sdl->sdl_lock);
+		return;
+	}
+
+	/*
+	 * At this point we know that we hold the last reference, therefore it's
+	 * safe for us to go ahead and clean up and move on and attempt to
+	 * deliver the reply. We always deliver the reply by going through the
+	 * timer. This can be rather important as the final reference may be
+	 * coming through a failed query and it's not always safe for us to
+	 * callback into the remote routines from this context.
+	 *
+	 * We should only do this if we have a non-zero number of entries to
+	 * take down.
+	 */
+	sdl->sdl_flags &= ~SVP_SD_RUNNING;
+	if (svrr->svrr_count > 0) {
+		sdl->sdl_flags |= SVP_SD_DORM;
+		next = B_TRUE;
+	} else {
+		next = B_FALSE;
+	}
+	svp_shootdown_schedule(sdl, next);
+	mutex_exit(&sdl->sdl_lock);
+}
+
+/*
+ * This is a callback used to indicate that the VL3 lookup has completed and an
+ * entry, if any, has been injected. If the command succeeded, eg. we got that
+ * the status was OK or that it was not found, then we will add it to he list to
+ * shoot down. Otherwise, there's nothing else for us to really do here.
+ */
+void
+svp_shootdown_vl3_cb(svp_status_t status, svp_log_vl3_t *vl3, svp_sdlog_t *sdl)
+{
+	svp_lrm_req_t *svrr = sdl->sdl_logrm;
+
+	mutex_enter(&sdl->sdl_lock);
+	if (status == SVP_S_OK || status == SVP_S_NOTFOUND) {
+		bcopy(vl3->svl3_id, &svrr->svrr_ids[svrr->svrr_count * 16],
+		    UUID_LEN);
+		svrr->svrr_count++;
+	}
+	mutex_exit(&sdl->sdl_lock);
+
+	svp_shootdown_rele(sdl);
+}
+
+static int
+svp_shootdown_logr_shoot(void *data, svp_log_type_t type, void *arg)
+{
+	svp_sdlog_t *sdl = arg;
+	svp_remote_t *srp = sdl->sdl_remote;
+	svp_lrm_req_t *svrr = sdl->sdl_logrm;
+
+	if (type != SVP_LOG_VL2 && type != SVP_LOG_VL3)
+		libvarpd_panic("encountered unknown type: %d\n", type);
+
+	if (type == SVP_LOG_VL2) {
+		svp_log_vl2_t *svl2 = data;
+		svp_remote_shootdown_vl2(srp, svl2);
+		mutex_enter(&sdl->sdl_lock);
+		bcopy(svl2->svl2_id, &svrr->svrr_ids[svrr->svrr_count * 16],
+		    UUID_LEN);
+		svrr->svrr_count++;
+		mutex_exit(&sdl->sdl_lock);
+	} else {
+		svp_log_vl3_t *svl3 = data;
+
+		/* Take a hold for the duration of this request */
+		svp_shootdown_ref(sdl);
+		svp_remote_shootdown_vl3(srp, svl3, sdl);
+	}
+
+	return (0);
+}
+
+static int
+svp_shootdown_logr_count(void *data, svp_log_type_t type, void *arg)
+{
+	uint_t *u = arg;
+	*u = *u + 1;
+	return (0);
+}
+
+
+static int
+svp_shootdown_logr_iter(svp_remote_t *srp, void *buf, size_t len,
+    int (*cb)(void *, svp_log_type_t, void *), void *arg)
+{
+	int ret;
+	off_t cboff = 0;
+	uint32_t *typep, type;
+	svp_log_vl2_t *svl2;
+	svp_log_vl3_t *svl3;
+
+	/* Adjust for initial status word */
+	assert(len >= sizeof (uint32_t));
+	len -= sizeof (uint32_t);
+	cboff += sizeof (uint32_t);
+
+	while (len > 0) {
+		size_t opsz;
+
+		if (len < sizeof (uint32_t)) {
+			(void) bunyan_warn(svp_bunyan,
+			    "failed to get initial shootdown tag",
+			    BUNYAN_T_STRING, "remote_host", srp->sr_hostname,
+			    BUNYAN_T_INT32, "remote_port", srp->sr_rport,
+			    BUNYAN_T_INT32, "response_size", cboff + len,
+			    BUNYAN_T_INT32, "response_offset", cboff,
+			    BUNYAN_T_END);
+			return (-1);
+		}
+
+		typep = buf + cboff;
+		type = ntohl(*typep);
+		if (type == SVP_LOG_VL2) {
+			opsz = sizeof (svp_log_vl2_t);
+			if (len < opsz) {
+				(void) bunyan_warn(svp_bunyan,
+				    "not enough data for svp_log_vl2_t",
+				    BUNYAN_T_STRING, "remote_host",
+				    srp->sr_hostname,
+				    BUNYAN_T_INT32, "remote_port",
+				    srp->sr_rport,
+				    BUNYAN_T_INT32, "response_size",
+				    cboff + len,
+				    BUNYAN_T_INT32, "response_offset", cboff,
+				    BUNYAN_T_END);
+				return (-1);
+			}
+			svl2 = (void *)typep;
+			if ((ret = cb(svl2, type, arg)) != 0)
+				return (ret);
+		} else if (type == SVP_LOG_VL3) {
+
+			opsz = sizeof (svp_log_vl3_t);
+			if (len < opsz) {
+				(void) bunyan_warn(svp_bunyan,
+				    "not enough data for svp_log_vl3_t",
+				    BUNYAN_T_STRING, "remote_host",
+				    srp->sr_hostname,
+				    BUNYAN_T_INT32, "remote_port",
+				    srp->sr_rport,
+				    BUNYAN_T_INT32, "response_size",
+				    cboff + len,
+				    BUNYAN_T_INT32, "response_offset", cboff,
+				    BUNYAN_T_END);
+				return (-1);
+			}
+			svl3 = (void *)typep;
+			if ((ret = cb(svl3, type, arg)) != 0)
+				return (ret);
+		} else {
+			(void) bunyan_warn(svp_bunyan,
+			    "unknown log structure type",
+			    BUNYAN_T_STRING, "remote_host",
+			    srp->sr_hostname,
+			    BUNYAN_T_INT32, "remote_port", srp->sr_rport,
+			    BUNYAN_T_INT32, "response_size", cboff + len,
+			    BUNYAN_T_INT32, "response_offset", cboff,
+			    BUNYAN_T_INT32, "structure_type", type,
+			    BUNYAN_T_END);
+			return (-1);
+		}
+		len -= opsz;
+		cboff += opsz;
+	}
+
+	return (0);
+}
+
+void
+svp_shootdown_logr_cb(svp_remote_t *srp, svp_status_t status, void *cbdata,
+    size_t cbsize)
+{
+	uint_t count;
+	svp_sdlog_t *sdl = &srp->sr_shoot;
+
+	if (status != SVP_S_OK) {
+		(void) bunyan_warn(svp_bunyan,
+		    "log request not OK",
+		    BUNYAN_T_STRING, "remote_host", srp->sr_hostname,
+		    BUNYAN_T_INT32, "remote_port", srp->sr_rport,
+		    BUNYAN_T_INT32, "response_size", cbsize,
+		    BUNYAN_T_INT32, "status", status,
+		    BUNYAN_T_END);
+		mutex_enter(&sdl->sdl_lock);
+		sdl->sdl_flags &= ~SVP_SD_RUNNING;
+		svp_shootdown_schedule(sdl, B_FALSE);
+		mutex_exit(&sdl->sdl_lock);
+		return;
+	}
+
+	/*
+	 * First go ahead and count the number of entries. This effectively
+	 * allows us to validate that all the data is valid, if this fails, then
+	 * we fail the request.
+	 */
+	count = 0;
+	if ((svp_shootdown_logr_iter(srp, cbdata, cbsize,
+	    svp_shootdown_logr_count, &count)) != 0) {
+		mutex_enter(&sdl->sdl_lock);
+		sdl->sdl_flags &= ~SVP_SD_RUNNING;
+		svp_shootdown_schedule(sdl, B_FALSE);
+		mutex_exit(&sdl->sdl_lock);
+		return;
+	}
+
+	/*
+	 * If we have no entries, then we're also done.
+	 */
+	if (count == 0) {
+		mutex_enter(&sdl->sdl_lock);
+		sdl->sdl_flags &= ~SVP_SD_RUNNING;
+		svp_shootdown_schedule(sdl, B_FALSE);
+		mutex_exit(&sdl->sdl_lock);
+		return;
+	}
+
+	/*
+	 * We have work to do. Because we may have asynchronous VL3 tasks, we're
+	 * going to first grab a reference before we do the iteration. Then, for
+	 * each asynchronous VL3 request we make, that'll also grab a hold. Once
+	 * we're done with the iteration, we'll drop our hold. If that's the
+	 * last one, it'll move on accordingly.
+	 */
+	svp_shootdown_ref(sdl);
+	bzero(sdl->sdl_logrm, svp_shootdown_buf);
+
+	/*
+	 * If this fails, we're going to determine what to do next based on the
+	 * number of entries that were entered into the log removal. At this
+	 * point success or failure don't really look different, all it changes
+	 * is how many entries we have to remove.
+	 */
+	(void) svp_shootdown_logr_iter(srp, cbdata, cbsize,
+	    svp_shootdown_logr_shoot, sdl);
+
+	/*
+	 * Now that we're done with our work, release the hold. If we don't have
+	 * any vl3 tasks outstanding, this'll trigger the next phase of the log
+	 * removals.
+	 */
+	svp_shootdown_rele(sdl);
+}
+
+static void
+svp_shootdown_timer(void *arg)
+{
+	svp_sdlog_t *sdl = arg;
+	svp_remote_t *srp = sdl->sdl_remote;
+	boolean_t init = B_TRUE;
+
+	mutex_enter(&sdl->sdl_lock);
+
+	/*
+	 * If we've been asked to quiesce, we're done.
+	 */
+	if ((sdl->sdl_flags & SVP_SD_QUIESCE) != 0) {
+		mutex_exit(&sdl->sdl_lock);
+		return;
+	}
+
+	/*
+	 * We shouldn't be able to have ourselves currently be running and reach
+	 * here. If that's the case, we should immediately panic.
+	 */
+	if ((sdl->sdl_flags & SVP_SD_RUNNING) != 0) {
+		libvarpd_panic("remote %p shootdown timer fired while still "
+		    "running", srp);
+	}
+
+	if ((sdl->sdl_flags & SVP_SD_DORM) != 0) {
+		sdl->sdl_flags &= ~SVP_SD_DORM;
+		init = B_FALSE;
+	}
+
+	sdl->sdl_flags |= SVP_SD_RUNNING;
+	mutex_exit(&sdl->sdl_lock);
+
+	if (init == B_FALSE) {
+		svp_lrm_req_t *svrr = sdl->sdl_logrm;
+
+		bzero(&sdl->sdl_query, sizeof (svp_query_t));
+		svp_remote_lrm_request(sdl->sdl_remote, &sdl->sdl_query, svrr,
+		    sizeof (*svrr) + 16 * svrr->svrr_count);
+	} else {
+		bzero(&sdl->sdl_query, sizeof (svp_query_t));
+		svp_remote_log_request(srp, &sdl->sdl_query, sdl->sdl_logack,
+		    svp_shootdown_buf);
+	}
+}
+
+void
+svp_shootdown_fini(svp_remote_t *srp)
+{
+	svp_sdlog_t *sdl = &srp->sr_shoot;
+
+	mutex_enter(&sdl->sdl_lock);
+	sdl->sdl_flags |= SVP_SD_QUIESCE;
+	mutex_exit(&sdl->sdl_lock);
+
+	svp_timer_remove(&sdl->sdl_timer);
+
+	mutex_enter(&sdl->sdl_lock);
+
+	/*
+	 * Normally svp_timer_remove would be enough. However, the query could
+	 * have been put out again outside of the svp_timer interface. Therefore
+	 * we still need to check for SVP_SD_RUNNING.
+	 */
+	while (sdl->sdl_flags & SVP_SD_RUNNING)
+		(void) cond_wait(&sdl->sdl_cond, &sdl->sdl_lock);
+	mutex_exit(&sdl->sdl_lock);
+
+	umem_free(sdl->sdl_logack, svp_shootdown_buf);
+	umem_free(sdl->sdl_logrm, svp_shootdown_buf);
+	sdl->sdl_logack = NULL;
+	sdl->sdl_logrm = NULL;
+	(void) cond_destroy(&sdl->sdl_cond);
+	(void) mutex_destroy(&sdl->sdl_lock);
+}
+
+void
+svp_shootdown_start(svp_remote_t *srp)
+{
+	svp_sdlog_t *sdl = &srp->sr_shoot;
+
+	mutex_enter(&sdl->sdl_lock);
+	svp_shootdown_schedule(sdl, B_FALSE);
+	mutex_exit(&sdl->sdl_lock);
+}
+
+int
+svp_shootdown_init(svp_remote_t *srp)
+{
+	int ret;
+	svp_sdlog_t *sdl = &srp->sr_shoot;
+	if ((ret = mutex_init(&sdl->sdl_lock, USYNC_THREAD | LOCK_ERRORCHECK,
+	    NULL)) != 0)
+		return (ret);
+
+	if ((ret = cond_init(&sdl->sdl_cond, USYNC_THREAD, NULL)) != 0) {
+		(void) mutex_destroy(&sdl->sdl_lock);
+		return (ret);
+	}
+
+	if ((sdl->sdl_logack = umem_alloc(svp_shootdown_buf, UMEM_DEFAULT)) ==
+	    NULL) {
+		ret = errno;
+		(void) cond_destroy(&sdl->sdl_cond);
+		(void) mutex_destroy(&sdl->sdl_lock);
+		return (ret);
+	}
+
+	if ((sdl->sdl_logrm = umem_alloc(svp_shootdown_buf, UMEM_DEFAULT)) ==
+	    NULL) {
+		ret = errno;
+		umem_free(sdl->sdl_logack, svp_shootdown_buf);
+		(void) cond_destroy(&sdl->sdl_cond);
+		(void) mutex_destroy(&sdl->sdl_lock);
+		return (ret);
+	}
+
+	sdl->sdl_remote = srp;
+	sdl->sdl_timer.st_oneshot = B_TRUE;
+	sdl->sdl_timer.st_func = svp_shootdown_timer;
+	sdl->sdl_timer.st_arg = sdl;
+
+	return (0);
+}
diff --git a/usr/src/lib/varpd/svp/common/libvarpd_svp_timer.c b/usr/src/lib/varpd/svp/common/libvarpd_svp_timer.c
new file mode 100644
index 0000000000..10b02748f3
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/libvarpd_svp_timer.c
@@ -0,0 +1,150 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+#include <stddef.h>
+#include <libvarpd_svp.h>
+
+/*
+ * svp timer backend
+ *
+ * This implements all of the logic of maintaining a timer for the svp backend.
+ * We have a timer that fires at a one second tick. We maintain all of our
+ * events in avl tree, sorted by the tick that they need to be processed at.
+ *
+ * For more information, see the big theory statement in
+ * lib/varpd/svp/common/libvarpd_svp.c.
+ */
+
+int svp_tickrate = 1;
+static svp_event_t svp_timer_event;
+static mutex_t svp_timer_lock = ERRORCHECKMUTEX;
+static cond_t svp_timer_cv = DEFAULTCV;
+static avl_tree_t svp_timer_tree;
+static uint64_t svp_timer_nticks;
+
+static int
+svp_timer_comparator(const void *l, const void *r)
+{
+	const svp_timer_t *lt, *rt;
+
+	lt = l;
+	rt = r;
+
+	if (lt->st_expire > rt->st_expire)
+		return (1);
+	else if (lt->st_expire < rt->st_expire)
+		return (-1);
+
+	/*
+	 * Multiple timers can have the same delivery time, so sort within that
+	 * by the address of the timer itself.
+	 */
+	if ((uintptr_t)lt > (uintptr_t)rt)
+		return (1);
+	else if ((uintptr_t)lt < (uintptr_t)rt)
+		return (-1);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+svp_timer_tick(port_event_t *pe, void *arg)
+{
+	mutex_enter(&svp_timer_lock);
+	svp_timer_nticks++;
+
+	for (;;) {
+		svp_timer_t *t;
+
+		t = avl_first(&svp_timer_tree);
+		if (t == NULL || t->st_expire > svp_timer_nticks)
+			break;
+
+		avl_remove(&svp_timer_tree, t);
+
+		/*
+		 * We drop this while performing an operation so that way state
+		 * can advance in the face of a long-running callback.
+		 */
+		t->st_delivering = B_TRUE;
+		mutex_exit(&svp_timer_lock);
+		t->st_func(t->st_arg);
+		mutex_enter(&svp_timer_lock);
+		t->st_delivering = B_FALSE;
+		(void) cond_broadcast(&svp_timer_cv);
+		if (t->st_oneshot == B_FALSE) {
+			t->st_expire += t->st_value;
+			avl_add(&svp_timer_tree, t);
+		}
+	}
+	mutex_exit(&svp_timer_lock);
+}
+
+void
+svp_timer_add(svp_timer_t *stp)
+{
+	if (stp->st_value == 0)
+		libvarpd_panic("tried to add svp timer with zero value");
+
+	mutex_enter(&svp_timer_lock);
+	stp->st_delivering = B_FALSE;
+	stp->st_expire = svp_timer_nticks + stp->st_value;
+	avl_add(&svp_timer_tree, stp);
+	mutex_exit(&svp_timer_lock);
+}
+
+void
+svp_timer_remove(svp_timer_t *stp)
+{
+	mutex_enter(&svp_timer_lock);
+
+	/*
+	 * If the event in question is not currently being delivered, then we
+	 * can stop it before it next fires. If it is currently being delivered,
+	 * we need to wait for that to finish. Because we hold the timer lock,
+	 * we know that it cannot be rearmed. Therefore, we make sure the one
+	 * shot is set to zero, and wait until it's no longer set to delivering.
+	 */
+	if (stp->st_delivering == B_FALSE) {
+		avl_remove(&svp_timer_tree, stp);
+		mutex_exit(&svp_timer_lock);
+		return;
+	}
+
+	stp->st_oneshot = B_TRUE;
+	while (stp->st_delivering == B_TRUE)
+		(void) cond_wait(&svp_timer_cv, &svp_timer_lock);
+
+	mutex_exit(&svp_timer_lock);
+}
+
+int
+svp_timer_init(void)
+{
+	int ret;
+
+	svp_timer_event.se_func = svp_timer_tick;
+	svp_timer_event.se_arg = NULL;
+
+	avl_create(&svp_timer_tree, svp_timer_comparator, sizeof (svp_timer_t),
+	    offsetof(svp_timer_t, st_link));
+
+	if ((ret = svp_event_timer_init(&svp_timer_event)) != 0) {
+		avl_destroy(&svp_timer_tree);
+	}
+
+	return (ret);
+}
diff --git a/usr/src/lib/varpd/svp/common/llib-lvarpd_svp b/usr/src/lib/varpd/svp/common/llib-lvarpd_svp
new file mode 100644
index 0000000000..03c34f4fcb
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/llib-lvarpd_svp
@@ -0,0 +1,18 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
diff --git a/usr/src/lib/varpd/svp/common/mapfile-vers b/usr/src/lib/varpd/svp/common/mapfile-vers
new file mode 100644
index 0000000000..6b7c5a5067
--- /dev/null
+++ b/usr/src/lib/varpd/svp/common/mapfile-vers
@@ -0,0 +1,35 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate {
+    local:
+	*;
+};
diff --git a/usr/src/lib/varpd/svp/i386/Makefile b/usr/src/lib/varpd/svp/i386/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/svp/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/svp/sparc/Makefile b/usr/src/lib/varpd/svp/sparc/Makefile
new file mode 100644
index 0000000000..f2b4f63da5
--- /dev/null
+++ b/usr/src/lib/varpd/svp/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
diff --git a/usr/src/lib/varpd/svp/sparcv9/Makefile b/usr/src/lib/varpd/svp/sparcv9/Makefile
new file mode 100644
index 0000000000..d552642882
--- /dev/null
+++ b/usr/src/lib/varpd/svp/sparcv9/Makefile
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include ../Makefile.com
+include ../../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64) $(ROOTLINT64)
diff --git a/usr/src/lib/xml/os_dtd.c b/usr/src/lib/xml/os_dtd.c
new file mode 100644
index 0000000000..579e99ba3c
--- /dev/null
+++ b/usr/src/lib/xml/os_dtd.c
@@ -0,0 +1,238 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Utility functions for working with XML documents that are validated against
+ * Document Type Definitions (DTD) shipped in the operating system.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <strings.h>
+#include <errno.h>
+#include <zone.h>
+
+#include <libxml/parser.h>
+#include <libxml/xmlmemory.h>
+
+#include "os_dtd.h"
+
+struct os_dtd_path {
+	os_dtd_id_t odp_id;
+	const char *odp_name;
+	const char *odp_public_ident;
+	const char *odp_path;
+};
+
+static os_dtd_path_t os_dtd_paths[] = {
+	/*
+	 * DTDs for Zones infrastructure:
+	 */
+	{ OS_DTD_ZONES_BRAND, "brand",
+	    "-//Sun Microsystems Inc//DTD Brands//EN",
+	    "/usr/share/lib/xml/dtd/brand.dtd.1" },
+	{ OS_DTD_ZONES_ZONE, "zone",
+	    "-//Sun Microsystems Inc//DTD Zones//EN",
+	    "/usr/share/lib/xml/dtd/zonecfg.dtd.1" },
+	{ OS_DTD_ZONES_PLATFORM, "platform",
+	    "-//Sun Microsystems Inc//Zones Platform//EN",
+	    "/usr/share/lib/xml/dtd/zone_platform.dtd.1" },
+
+	/*
+	 * DTDs for smf(5):
+	 */
+	{ OS_DTD_SMF_SERVICE_BUNDLE, "service_bundle",
+	    NULL,
+	    "/usr/share/lib/xml/dtd/service_bundle.dtd.1" },
+
+	{ OS_DTD_UNKNOWN, NULL, NULL, NULL }
+};
+
+/*
+ * Check this document to see if it references the public identifier of a
+ * well-known DTD that we ship with the operating system.  If there is no DTD,
+ * or the public identifier is unknown to us, return OS_DTD_UNKNOWN.
+ */
+os_dtd_id_t
+os_dtd_identify(xmlDocPtr doc)
+{
+	xmlDtdPtr dp;
+	int i;
+
+	if ((dp = xmlGetIntSubset(doc)) == NULL) {
+		/*
+		 * This document does not have an internal subset pointing
+		 * to a DTD.
+		 */
+		errno = EIO;
+		return (OS_DTD_UNKNOWN);
+	}
+
+	/*
+	 * The use of a symbolic name via the public identifier is preferred.
+	 * Check to see if the document refers to a public identifier for any
+	 * well-known DTD:
+	 */
+	for (i = 0; os_dtd_paths[i].odp_id != OS_DTD_UNKNOWN; i++) {
+		os_dtd_path_t *odp = &os_dtd_paths[i];
+		const xmlChar *pubid = (const xmlChar *)odp->odp_public_ident;
+
+		if (dp->ExternalID == NULL || odp->odp_public_ident == NULL) {
+			continue;
+		}
+
+		if (xmlStrEqual(pubid, dp->ExternalID)) {
+			return (odp->odp_id);
+		}
+	}
+
+	/*
+	 * If a public identifier is not present, or does not match any known
+	 * DTD, fall back to inspecting the system identifier.
+	 */
+	for (i = 0; os_dtd_paths[i].odp_id != OS_DTD_UNKNOWN; i++) {
+		os_dtd_path_t *odp = &os_dtd_paths[i];
+		char uri[sizeof ("file://") + MAXPATHLEN];
+		const xmlChar *path = (const xmlChar *)odp->odp_path;
+
+		if (dp->SystemID == NULL || odp->odp_path == NULL) {
+			continue;
+		}
+
+		/*
+		 * The system identifier may be a regular path.
+		 */
+		if (xmlStrEqual(path, dp->SystemID)) {
+			return (odp->odp_id);
+		}
+
+		/*
+		 * The system identifier may also be a "file://"
+		 * URI referring to a path:
+		 */
+		(void) snprintf(uri, sizeof (uri), "file://%s", odp->odp_path);
+		if (xmlStrEqual((const xmlChar *)uri, dp->SystemID)) {
+			return (odp->odp_id);
+		}
+	}
+
+	errno = ENOENT;
+	return (OS_DTD_UNKNOWN);
+}
+
+static os_dtd_path_t *
+os_dtd_lookup(os_dtd_id_t id)
+{
+	int i;
+
+	for (i = 0; os_dtd_paths[i].odp_id != OS_DTD_UNKNOWN; i++) {
+		os_dtd_path_t *odp = &os_dtd_paths[i];
+
+		if (odp->odp_id == id) {
+			return (odp);
+		}
+	}
+
+	errno = ENOENT;
+	return (NULL);
+}
+
+/*
+ * If this document references a DTD, remove that reference (the "internal
+ * subset").  Install a new internal subset reference to the well-known
+ * operating system DTD passed by the caller.  The URI in this reference will
+ * respect the current native system prefix (e.g. "/native") if there is one,
+ * such as when running in a branded zone.
+ */
+int
+os_dtd_attach(xmlDocPtr doc, os_dtd_id_t id)
+{
+	xmlDtdPtr dp;
+	os_dtd_path_t *odp;
+	const char *zroot = zone_get_nroot();
+	char uri[sizeof ("file://") + MAXPATHLEN];
+
+	if ((odp = os_dtd_lookup(id)) == NULL) {
+		return (-1);
+	}
+
+	if ((dp = xmlGetIntSubset(doc)) != NULL) {
+		/*
+		 * This document already has an internal subset.  Remove it
+		 * before attaching the new one.
+		 */
+		xmlUnlinkNode((xmlNodePtr)dp);
+		xmlFreeNode((xmlNodePtr)dp);
+	}
+
+	/*
+	 * The "system identifier" of this internal subset must refer to the
+	 * path in the filesystem where the DTD file (the external subset) is
+	 * stored.  If we are running in a branded zone, that file may be at a
+	 * different path (e.g. under "/native").
+	 */
+	(void) snprintf(uri, sizeof (uri), "file://%s%s", zroot != NULL ?
+	    zroot : "", odp->odp_path);
+
+	if (xmlCreateIntSubset(doc, (const xmlChar *)odp->odp_name,
+	    (const xmlChar *)odp->odp_public_ident,
+	    (const xmlChar *)uri) == NULL) {
+		errno = EIO;
+		return (-1);
+	}
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static void
+os_dtd_print_nothing(void *ctx, const char *msg, ...)
+{
+}
+
+int
+os_dtd_validate(xmlDocPtr doc, boolean_t emit_messages, boolean_t *valid)
+{
+	int ret;
+	xmlValidCtxtPtr cvp;
+	os_dtd_id_t dtdid;
+
+	if ((dtdid = os_dtd_identify(doc)) != OS_DTD_UNKNOWN) {
+		/*
+		 * This document refers to a well-known DTD shipped with
+		 * the operating system.  Ensure that it points to the
+		 * correct local path for validation in the current context.
+		 */
+		if (os_dtd_attach(doc, dtdid) != 0) {
+			return (-1);
+		}
+	}
+
+	if ((cvp = xmlNewValidCtxt()) == NULL) {
+		return (-1);
+	}
+
+	if (!emit_messages) {
+		cvp->error = os_dtd_print_nothing;
+		cvp->warning = os_dtd_print_nothing;
+	}
+
+	ret = xmlValidateDocument(cvp, doc);
+	xmlFreeValidCtxt(cvp);
+
+	*valid = (ret == 1 ? B_TRUE : B_FALSE);
+	return (0);
+}
diff --git a/usr/src/lib/xml/os_dtd.h b/usr/src/lib/xml/os_dtd.h
new file mode 100644
index 0000000000..c6fe24a293
--- /dev/null
+++ b/usr/src/lib/xml/os_dtd.h
@@ -0,0 +1,49 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _OS_DTD_H
+#define	_OS_DTD_H
+
+/*
+ * Utility functions for working with XML documents that are validated against
+ * Document Type Definitions (DTD) shipped in the operating system.
+ */
+
+#include <libxml/parser.h>
+#include <libxml/xmlmemory.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum os_dtd_id {
+	OS_DTD_UNKNOWN = 0,
+	OS_DTD_ZONES_BRAND,
+	OS_DTD_ZONES_ZONE,
+	OS_DTD_ZONES_PLATFORM,
+	OS_DTD_SMF_SERVICE_BUNDLE
+} os_dtd_id_t;
+
+typedef struct os_dtd_path os_dtd_path_t;
+
+extern os_dtd_id_t os_dtd_identify(xmlDocPtr);
+extern int os_dtd_attach(xmlDocPtr, os_dtd_id_t);
+extern int os_dtd_validate(xmlDocPtr, boolean_t, boolean_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _OS_DTD_H */
diff --git a/usr/src/man/Makefile b/usr/src/man/Makefile
index 7bfd356b32..a948d1256c 100644
--- a/usr/src/man/Makefile
+++ b/usr/src/man/Makefile
@@ -85,6 +85,7 @@ SUBDIRS=	man1		\
 		man3tsol	\
 		man3uuid	\
 		man3volmgt	\
+		man3vnd		\
 		man3xcurses	\
 		man3xnet	\
 		man4		\
diff --git a/usr/src/man/man1/Makefile b/usr/src/man/man1/Makefile
index fb16e3462d..50fcbfc385 100644
--- a/usr/src/man/man1/Makefile
+++ b/usr/src/man/man1/Makefile
@@ -72,6 +72,7 @@ MANFILES=	acctcom.1			\
 		clear.1				\
 		cmp.1				\
 		col.1				\
+		column.1			\
 		comm.1				\
 		command.1			\
 		compress.1			\
@@ -84,6 +85,8 @@ MANFILES=	acctcom.1			\
 		csh.1				\
 		csplit.1			\
 		ctags.1				\
+		ctfdiff.1			\
+		ctfdump.1			\
 		ctrun.1				\
 		ctstat.1			\
 		ctwatch.1			\
@@ -215,6 +218,7 @@ MANFILES=	acctcom.1			\
 		m4.1				\
 		mac.1				\
 		mach.1				\
+		machid.1			\
 		madv.so.1.1			\
 		mail.1				\
 		mailcompat.1			\
@@ -466,6 +470,9 @@ MANLINKS=	batch.1		\
 		helpuid.1	\
 		helpyorn.1	\
 		hist.1		\
+		i286.1		\
+		i386.1		\
+		i486.1		\
 		if.1		\
 		intro.1		\
 		jsh.1		\
@@ -476,8 +483,10 @@ MANLINKS=	batch.1		\
 		notify.1	\
 		onintr.1	\
 		page.1		\
+		pauxv.1		\
 		pcat.1		\
 		pcred.1		\
+		penv.1		\
 		pfcsh.1		\
 		pfiles.1	\
 		pfksh.1		\
@@ -511,9 +520,11 @@ MANLINKS=	batch.1		\
 		sh.1		\
 		snca.1		\
 		source.1	\
+		sparc.1		\
 		spellin.1	\
 		stop.1		\
 		strconf.1	\
+		sun.1		\
 		switch.1	\
 		ulimit.1	\
 		unalias.1	\
@@ -648,6 +659,12 @@ unlimit.1	:= LINKSRC = limit.1
 
 dumpkeys.1	:= LINKSRC = loadkeys.1
 
+i286.1		:= LINKSRC = machid.1
+i386.1		:= LINKSRC = machid.1
+i486.1		:= LINKSRC = machid.1
+sparc.1		:= LINKSRC = machid.1
+sun.1		:= LINKSRC = machid.1
+
 rmail.1		:= LINKSRC = mail.1
 
 page.1		:= LINKSRC = more.1
@@ -657,6 +674,9 @@ snca.1		:= LINKSRC = nca.1
 pcat.1		:= LINKSRC = pack.1
 unpack.1	:= LINKSRC = pack.1
 
+pauxv.1		:= LINKSRC = pargs.1
+penv.1		:= LINKSRC = pargs.1
+
 pfcsh.1		:= LINKSRC = pfexec.1
 pfksh.1		:= LINKSRC = pfexec.1
 pfsh.1		:= LINKSRC = pfexec.1
@@ -702,7 +722,6 @@ hashcheck.1	:= LINKSRC = spell.1
 hashmake.1	:= LINKSRC = spell.1
 spellin.1	:= LINKSRC = spell.1
 
-
 strconf.1	:= LINKSRC = strchg.1
 
 settime.1	:= LINKSRC = touch.1
diff --git a/usr/src/man/man1/column.1 b/usr/src/man/man1/column.1
new file mode 100644
index 0000000000..a8c23310ba
--- /dev/null
+++ b/usr/src/man/man1/column.1
@@ -0,0 +1,129 @@
+.\" Copyright (c) 1989, 1990, 1993
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 4. Neither the name of the University nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\"     @(#)column.1	8.1 (Berkeley) 6/6/93
+.\" $FreeBSD$
+.\"
+.\" Portions Copyright (c) 2013 Joyent, Inc.  All rights reserved.
+.\"
+.TH COLUMN 1 "Jan 10, 2013"
+.SH NAME
+column \- columnate lists
+.SH SYNOPSIS
+.LP
+.nf
+\fBcolumn\fR [\fB-tx\fR] [\fB-c\fR \fIcolumns\fR] [\fB-s\fR \fIsep\fR] [\fIfile\fR ... ]
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+The \fBcolumn\fR
+utility formats its input into multiple columns.
+Rows are filled before columns.
+Input is taken from
+\fIfile\fR
+operands, or, by default, from the standard input.
+Empty lines are ignored.
+.SH OPTIONS
+.sp
+.LP
+The options are as follows:
+.sp
+.ne 2
+.na
+\fB\fB-c\fR \fIcolumns\fR\fR
+.ad
+.RS 17n
+Output is formatted for a display \fIcolumns\fR
+wide.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-s\fR \fIsep\fR\fR
+.ad
+.RS 17n
+Specify a set of characters to be used to delimit columns for the
+\fB-t\fR option.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-t\fR\fR
+.ad
+.RS 17n
+Determine the number of columns the input contains and create a table.
+Columns are delimited with whitespace, by default, or with the characters
+supplied using the \fBs\fR
+option.
+Useful for pretty-printing displays.
+.RE
+
+.sp
+.ne 2
+.na
+\fB-x\fR
+.ad
+.RS 17n
+Fill columns before filling rows.
+.RE
+
+.SH ENVIRONMENT
+The COLUMNS , LANG , LC_ALL
+and
+LC_CTYPE
+environment variables affect the execution of
+\fBcolumn\fR
+as described in
+\fBenviron\fR(5).
+
+.SH EXIT STATUS
+The \fBcolumn\fR utility exits 0 on success and >0 if an error occurs.
+
+.SH EXAMPLES
+.sp
+.in +2
+.nf
+(printf \&"PERM LINKS OWNER GROUP SIZE MONTH DAY \&"\ \&;\ \&\e
+printf \&"HH:MM/YEAR NAME\en\&"\ \&;\ \&\e
+ls -l \&| sed 1d) \&| column -t
+.fi
+.in -2
+.sp
+
+
+.SH SEE ALSO
+\fBls\fR(1), \fBpaste\fR(1), \fBsort\fR(1)
+
+.SH HISTORY
+The \fBcolumn\fR command appeared in 4.3BSD-Reno.
+
+.SH BUGS
+Input lines are limited to LINE_MAX bytes in length.
diff --git a/usr/src/man/man1/crontab.1 b/usr/src/man/man1/crontab.1
index df6c3a8619..5a83c44530 100644
--- a/usr/src/man/man1/crontab.1
+++ b/usr/src/man/man1/crontab.1
@@ -41,6 +41,8 @@
 .\"
 .\"
 .\" Copyright 1989 AT&T
+.\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
+.\" Copyright (c) 2011, Joyent, Inc. All Rights Reserved
 .\" Portions Copyright (c) 1992, X/Open Company Limited All Rights Reserved
 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
 .\"
@@ -60,7 +62,7 @@ crontab \- user crontab file
 
 .LP
 .nf
-\fB/usr/bin/crontab\fR \fB-l\fR [\fIusername\fR]
+\fB/usr/bin/crontab\fR \fB-l\fR [\fB-g\fR] [\fIusername\fR]
 .fi
 
 .LP
@@ -80,7 +82,7 @@ crontab \- user crontab file
 
 .LP
 .nf
-\fB/usr/xpg4/bin/crontab\fR \fB-l\fR [\fIusername\fR]
+\fB/usr/xpg4/bin/crontab\fR \fB-l\fR [\fB-g\fR] [\fIusername\fR]
 .fi
 
 .LP
@@ -100,7 +102,7 @@ crontab \- user crontab file
 
 .LP
 .nf
-\fB/usr/xpg6/bin/crontab\fR \fB-l\fR [\fIusername\fR]
+\fB/usr/xpg6/bin/crontab\fR \fB-l\fR [\fB-g\fR] [\fIusername\fR]
 .fi
 
 .LP
@@ -119,6 +121,17 @@ users' crontabs.
 .LP
 If \fBcrontab\fR is invoked with \fIfilename\fR, this overwrites an existing
 \fBcrontab\fR entry for the user that invokes it.
+.sp
+.LP
+Cron supports a merged crontab with entries coming from either the user's
+\fB/var/spool/cron/crontabs\fR file or from the user's
+\fB/etc/cron.d/crontabs\fR file.  The entries in the user's
+\fB/var/spool/cron/crontabs\fR file are editable whereas those in
+\fB/etc/cron.d/crontabs\fR are system-defined entries which may not
+be customized by the user.  The dual set of crontab entries is only
+of interest to system-defined users such as \fBroot\fR.  Except where
+otherwise explicitly indicated, all variants of the \fBcrontab\fR command
+act only on the editable crontab files found in \fB/var/spool/cron/crontabs\fR.
 .SS "\fBcrontab\fR Access Control"
 .LP
 Users: Access to \fBcrontab\fR is allowed:
@@ -371,6 +384,9 @@ file using the \fB-r\fR option.
 If \fIusername\fR is specified, the specified user's \fBcrontab\fR file is
 edited, rather than the current user's \fBcrontab\fR file. This can only be
 done by root or by a user with the \fBsolaris.jobs.admin\fR authorization.
+.sp
+Only the entries in the user's \fB/var/spool/cron/crontabs\fR file are
+editable.
 .RE
 
 .sp
@@ -382,6 +398,22 @@ done by root or by a user with the \fBsolaris.jobs.admin\fR authorization.
 Lists the \fBcrontab\fR file for the invoking user. Only root or a user with
 the \fBsolaris.jobs.admin\fR authorization can specify a username following the
 \fB-l\fR option to list the \fBcrontab\fR file of the specified user.
+.sp
+Entries from the user's \fB/var/spool/cron/crontabs\fR file are listed, unless
+the \fB-g\fR option is given, in which case only entries from the user's
+\fB/etc/cron.d/crontabs\fR file are listed.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-g\fR\fR
+.ad
+.RS 6n
+In conjunction with the \fB-l\fR option, lists the global \fBcrontab\fR file
+for the invoking or specified user (if authorized) instead of the editable
+\fBcrontab\fR file.  This option is not valid unless the \fB-l\fR option is
+also given.
 .RE
 
 .sp
@@ -605,6 +637,15 @@ list of denied users
 .sp
 .ne 2
 .na
+\fB\fB/etc/cron.d/crontabs\fR\fR
+.ad
+.RS 28n
+system spool area for \fBcrontab\fR
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fB/var/cron/log\fR\fR
 .ad
 .RS 28n
diff --git a/usr/src/man/man1/ctfdiff.1 b/usr/src/man/man1/ctfdiff.1
new file mode 100644
index 0000000000..c0e59436fa
--- /dev/null
+++ b/usr/src/man/man1/ctfdiff.1
@@ -0,0 +1,347 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2015, Joyent, Inc.
+.\"
+.Dd Oct 4, 2014
+.Dt CTFDIFF 1
+.Os
+.Sh NAME
+.Nm ctfdiff
+.Nd compare two CTF containers
+.Sh SYNOPSIS
+.Nm ctfdiff
+.Op Fl afIloqt
+.Op Fl F Ar function
+.Op Fl O Ar object
+.Op Fl p Ar parent1
+.Op Fl p Ar parent2
+.Op Fl T Ar type
+.Ar file1 file2
+.Sh DESCRIPTION
+The
+.Nm
+utility identifies differences between the contents of the
+.Sy CTF
+containers found in
+.Em file1
+and
+.Em file2 .
+.Lp
+.Nm
+can find differences between two
+.Sy CTF
+container's
+.Sy labels ,
+.Sy functions ,
+.Sy objects ,
+and
+.Sy types .
+When no options are specified,
+.Nm
+will only consider
+.Sy functions ,
+.Sy objects,
+and
+.Sy types .
+.Lp
+Two
+.Sy labels
+are considered the same, if they have the same name.
+Two
+.Sy objects
+are considered the same if they have the same name and the type of the
+object is the same.
+Two
+.Sy functions
+are considered the same if they have the same, the same return type, the
+same number of arguments, and the types of their arguments are the same.
+.Lp
+Two
+.Sy types
+are considered the same if they have the same, they represent the same
+kind of thing, and the contents of the type are the same.
+This varies for each specific kind, for example, two structs are the
+same if they have the same members whose types, offsets, and names are
+all the same.
+For more information on the specifics for what we look at
+for each kind of type, and the kinds themselves, see the information we
+use to encode them in
+.Xr ctf 4 .
+If the option
+.Fl I
+is specified, then the names of basic integer types are ignored.
+For an example of where this makes sense, see
+.Sy Example 4 .
+.Lp
+If the
+.Sy CTF
+container found inside of either
+.Em file1
+or
+.Em file2
+has been uniquified (see
+.Xr ctf 4
+for more on uniquification), then the parent
+.Sy CTF
+container is also required for the diff to complete.
+.Sh OPTIONS
+The following options are supported:
+.Bl -hang -width Ds
+.It Fl a
+.Bd -filled -compact
+Diff
+.Sy labels ,
+.Sy types ,
+.Sy objects ,
+and
+.Sy functions .
+.Ed
+.It Fl f
+.Bd -filled -compact
+Diff
+.Sy function
+type argument information.
+.Ed
+.It Fl F Ar function
+.Bd -filled -compact
+When diffing
+.Sy functions ,
+only consider the function
+.Em function .
+This option requires that the option
+.Fl -f
+be specified and can be repeated multiple times.
+.Ed
+.It Fl I
+.Bd -filled -compact
+Ignore the names of integral types.
+This option is useful when comparing types between two
+.Sy CTF
+containers that have different programming models.
+In this case, when comparing integers, the name of the type is not
+considered.
+This means that the ILP32 type long which is a 32-bit wide signed
+integer is the same as the LP64 type int which is a 32-bit wide signed
+integer, even though they have different names.
+.Ed
+.It Fl l
+.Bd -filled -compact
+Diff the
+.Sy labels
+contained inside the
+.Sy CTF
+containers.
+.Ed
+.It Fl o
+.Bd -filled -compact
+Diff type information for
+.Sy objects .
+.Ed
+.It Fl O Ar object
+.Bd -filled -compact
+When diffing type information for
+.Sy objects ,
+only compare if the object is name
+.Em object .
+This option requires
+.Fl o
+to be specified and can be repeated multiple times.
+.Ed
+.It Fl p Ar parent1
+.Bd -filled -compact
+Specifies the path of file that is the parent of the
+.Sy CTF
+container inside of
+.Em file1
+is
+.Em parent1 .
+This option is required if
+.Em file1
+has been uniquified.
+For more information on uniquification, see
+.Xr ctf 4 .
+.Ed
+.It Fl P Ar parent2
+.Bd -filled -compact
+Specifies the path of file that is the parent of the
+.Sy CTF
+container inside of
+.Em file2 is
+.Em parent2 .
+This option is required if
+.Em file1
+has been uniquified.
+For more information on uniquification, see
+.Xr ctf 4 .
+.Ed
+.It Fl q
+.Bd -filled -compact
+Enables quiet mode.
+Standard output from the diff will not be emitted.
+However, diagnostics messages will still be emitted to standard error.
+.Ed
+.It Fl t
+.Bd -filled -compact
+Diff the
+.Sy type
+information sections in the
+.Sy CTF
+containers.
+.Ed
+.It Fl T Ar type
+.Bd -filled -compact
+When diffing the
+.Sy types
+section, only consider it if the type is name
+.Em type .
+Types specified here do not impact the diffing of
+.Sy objects
+or
+.Sy functions .
+Even with
+.Fl -T
+specified, other types will be diffed as necessary for the evaluation of
+the named types; however, the results of those intermediate differences
+will not impact the results of
+.Nm ,
+only named types are considered when evaluating the exit status of
+.Nm .
+.Ed
+.El
+.Sh EXIT STATUS
+.Bl -inset
+.It Sy 0
+.Bd -filled -offset indent -compact
+Execution completed successfully, no differences were detected
+between
+.Em file1
+and
+.Em file2 .
+.Ed
+.It Sy 1
+.Bd -filled -offset indent -compact
+Execution completed successfully, but differences were detected
+between
+.Em file1
+and
+.Em file2 .
+.Ed
+.It Sy 2
+.D1 Invalid command line options were specified.
+.It Sy 3
+.D1 A fatal error occurred.
+.El
+.Sh EXAMPLES
+.Sy Example 1
+Diffing Two
+.Sy CTF
+Containers
+.Lp
+The following example compares two
+.Sy CTF
+containers using the default set
+of comparisons:
+.Sy objects ,
+.Sy functions ,
+and
+.Sy types .
+.Bd -literal -offset 6n
+$ ctfdiff /usr/lib/libc.so.1 /usr/lib/libdtrace.so.1
+ctf container /usr/lib/libc.so.1 type 37 is different
+ctf container /usr/lib/libc.so.1 type 38 is different
+ctf container /usr/lib/libc.so.1 type 39 is different
+ctf container /usr/lib/libc.so.1 type 40 is different
+ctf container /usr/lib/libc.so.1 type 41 is different
+ctf container /usr/lib/libc.so.1 type 42 is different
+ctf container /usr/lib/libc.so.1 type 43 is different
+ctf container /usr/lib/libc.so.1 type 47 is different
+ctf container /usr/lib/libc.so.1 type 48 is different
+ctf container /usr/lib/libc.so.1 type 49 is different
+\&...
+.Ed
+.Sy Example 2
+Diffing Types Between Two
+.Sy CTF
+Containers with Parents
+.Lp
+The following example compares two
+.Sy CTF
+containers
+.Sy /ws/rm/zlan/proto/kernel/drv/amd64/vnd
+and
+.Sy /ws/rm/zlan/proto/kernel/drv/amd64/overlay
+that have been uniquified against the same container
+.Sy /ws/rm/zlan/proto/kernel/amd64/genunix .
+.Bd -literal -offset 6n
+$ ctfdiff -t -p /ws/rm/zlan/proto/kernel/amd64/genunix \\
+    -P /ws/rm/zlan/proto/kernel/amd64/genunix \\
+    /ws/rm/zlan/proto/kernel/drv/amd64/vnd  \\
+    /ws/rm/zlan/proto/kernel/drv/amd64/overlay
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32769 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32770 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32771 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32772 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32774 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32775 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32776 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32777 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32778 is different
+ctf container /ws/rm/zlan/proto/kernel/drv/amd64/vnd type 32779 is different
+\&...
+.Ed
+.Lp
+.Sy Example 3
+Diffing a Specific Function in Two
+.Sy CTF
+Containers
+.Lp
+This example shows us looking for differences in the function
+.Sy libzfs_core_init
+in two different version of the library
+.Sy libzfs_core.so.1 .
+.Bd -literal -offset 6n
+$ ctfdiff -f -F libzfs_core_init /usr/lib/libzfs_core.so.1 \\
+    /ws/rm/ctf/proto/usr/lib/libzfs_core.so.1
+$ echo $?
+.Ed
+.Lp
+.Sy Example 4
+Diffing Types to Find Differences Between Different Data Models.
+.Lp
+This example looks for differences between structures used in an ioctl
+that the kernel wants to be bitness neutral by comparing a 32-bit and
+64-bit library that consumes it.
+In this example, we'll use the library
+.Sy libvnd.so.1
+and the types
+.Sy vnd_ioc_attach_t ,
+.Sy vnd_ioc_link_t ,
+.Sy vnd_ioc_unlink_t ,
+.Sy vnd_ioc_buf_t ,
+and
+.Sy vnd_ioc_info_t .
+.Bd -literal -offset 6n
+$ ctfdiff -t -I -T vnd_ioc_attach_t  -T vnd_ioc_link_t  \\
+    -T vnd_ioc_unlink_t -T vnd_ioc_buf_t  -T vnd_ioc_info_t \\
+    i386/libvnd.so.1 amd64/libvnd.so.1
+$ echo $?
+0
+.Ed
+.Sh INTERFACE STABILITY
+The command syntax is
+.Sy Committed .
+The output format is
+.Sy Uncommitted .
+.Sh SEE ALSO
+.Xr ctfdump 1 ,
+.Xr diff 1 ,
+.Xr ctf 4
diff --git a/usr/src/man/man1/ctfdump.1 b/usr/src/man/man1/ctfdump.1
new file mode 100644
index 0000000000..eb0fd10165
--- /dev/null
+++ b/usr/src/man/man1/ctfdump.1
@@ -0,0 +1,420 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2015, Joyent, Inc.
+.\"
+.Dd Oct 4, 2014
+.Dt CTFDUMP 1
+.Os
+.Sh NAME
+.Nm ctfdump
+.Nd dump parts of ctf data from files
+.Sh SYNOPSIS
+.Nm ctfdump
+.Op Fl dfhlsSt
+.Op Fl p Ar parent
+.Op Fl u Ar outfile
+.Ar file
+.Sh DESCRIPTION
+The
+.Nm
+utility dumps and decodes the
+.Sy CTF
+data contained inside of
+.Sy ELF
+objects and raw
+.Sy CTF
+files.
+.Lp
+.Nm
+can dump information about the
+.Sy CTF header ,
+the
+.Sy labels
+encoded in the
+.Sy CTF
+container,
+the types of
+.Sy data objects ,
+the internal
+.Sy string
+table,
+the types of the return function and the arguments for
+.Sy functions ,
+and of course, it displays information about the
+.Sy types
+defined in the
+.Sy CTF
+container.
+.Lp
+.Nm
+can also be used to dump out the raw
+.Sy CTF
+data and send it to another file.
+When writing out data, it always ensures that the
+.Sy CTF
+data is decompressed.
+In this form, the
+.Sy CTF
+data can be inspected using
+.Nm
+and other tools such as
+.Xr mdb 1 .
+.Lp
+When no options are specified,
+.Nm
+displays all information.
+However, when the
+.Fl u
+option is used, then no information is displayed by default, unless
+requested through the appropriate option.
+.Sh OPTIONS
+The following options are supported:
+.Bl -hang -width Ds
+.It Fl d
+.Bd -filled -compact
+Dump the types of symbols that correspond to objects.
+.Ed
+.It Fl f
+.Bd -filled -compact
+Dump the types of the return values and arguments of the functions.
+.Ed
+.It Fl h
+.Bd -filled -compact
+Dump the
+.Sy CTF
+header
+.Ed
+.It Fl l
+.Bd -filled -compact
+Dump all
+.Sy CTF
+labels associated with the file.
+.Ed
+.It Fl p Ar parent
+.Bd -filled -compact
+Use the type information in
+.Em parent
+to supplement output.
+This is useful when a
+.Nm CTF
+container has been
+.Sy uniquified
+against
+.Em parent .
+This allows
+.Nm
+to use the names of types when used with
+.Fl t .
+.Ed
+.It Fl s
+.Bd -filled -compact
+Dump the internal
+.Sy CTF
+string table
+.Ed
+.It Fl S
+.Bd -filled -compact
+Displays statistics about the
+.Sy CTF
+container.
+.Ed
+.It Fl t
+.Bd -filled -compact
+Dump the type information contained in the
+.Sy CTF
+conatiner.
+.Ed
+.It Fl u Ar outfile
+.Bd -filled -compact
+Copies the uncompressed
+.Sy CTF
+data to the file specified by
+.Em outfile .
+This can be used to make it easier to inspect the raw
+.Sy CTF
+data.
+.Ed
+.El
+.Sh OUTPUT
+When the
+.Nm
+utility is executed with its default options, it prints out a textual
+representation of the
+.Sy CTF
+information.
+Note, the output format of
+.Nm
+is subject to change at any time and should not be relied upon as a
+stable format to be used for parsing.
+.Ss CTF Header
+This section describes the values in the
+.Sy CTF
+header.
+Each line in the section describes the value of one of the
+members of the header.
+For more information on the meaning and interpretation of these members,
+see
+.Xr ctf 4 .
+.Ss Label Table
+This section describes information about the labels present in the
+.Sy CTF
+information.
+Each entry in this section, if present, starts with a
+number and is followed by a string.
+An example entry in the label section might look like:
+.Bd -literal
+\&...
+   2270 joyent_20151001T070028Z
+\&...
+.Ed
+.Pp
+The number,
+.Em 2270 ,
+represents the last type that the label applies to.
+The string,
+.Em joyent_20151001T070028Z ,
+is the name of the label.
+In this case, if there were no other labels,
+it would indicate that the label applied to all types up to, and
+including, the type number 2270.
+For more information on how labels are used with
+.Sy CTF
+information, see the section
+.Em The Label Section
+in
+.Xr ctf 4 .
+.Ss Data Objects
+This section describes the type information relating to data objects
+from the symbol table.
+An entry for a data object consists of four columns.
+The first column is just a monotonic ID.
+The second number is the type id of the object.
+The third column is the name of the symbol and the fourth column is the
+corresponding index from the symbol table.
+.Pp
+Take for example, the following couple of entries:
+.Bd -literal
+\&...
+  [0] 13        hz (48)
+  [1] 78        _nd (49)
+  [2] 1656      __pfmt_label (56)
+  [3] 926       _aio_hash (68)
+  [4] 13        _lio_free (70)
+  [5] 1321      u8_number_of_bytes (73)
+\&...
+.Ed
+.Pp
+Let's take the first entry in the list above.
+The symbol is named
+.Sy hz .
+It is the first data object, as indicated by the number zero in
+brackets.
+It has a type id of 13 and in this case, it has a symbol table index of
+48.
+.Ss Functions
+This section describes the type information for functions.
+For each function present in the symbol table with type information, the
+function's entry into the function section, the function's name, the
+function's symbol table index, the function's return type, and the types
+of the function's arguments are printed.
+If a function is a variadic function, then the variadic argument is
+printed as the string
+.Sy '...' .
+.Pp
+Take for example, the following couple of entries:
+.Bd -literal
+\&...
+  [687] pfprint_stack (3110) returns: 11 args: (385, 115, 29, 1704, 223, 116, 2)
+  [688] pfprint_stddev (3111) returns: 11 args: (385, 115, 29, 1704, 223, 116, 2)
+  [689] pfprint_quantize (3112) returns: 11 args: (385, 115, 29, 1704, 223, 116, 2)
+  [690] pfprint_lquantize (3113) returns: 11 args: (385, 115, 29, 1704, 223, 116, 2)
+  [691] pfprint_llquantize (3114) returns: 11 args: (385, 115, 29, 1704, 223, 116, 2)
+\&...
+.Ed
+.Pp
+The first column is the function's entry number in the function type
+information section.
+It is enclosed in brackets.
+The next column is the function's name and it is followed in parenthesis
+by the its index in the
+symbol table.
+The following portions of this entry describe the return
+type and then all of the arguments, in positional order.
+.Ss Types
+The types section gives information about each type in the
+.Sy CTF
+container.
+Each entry begins with its type identifier.
+The type identifier may either be in square brackets or in angle
+brackets.
+If the type identifier is enclosed in angle brackets, then that
+represents that it is a root type or top-level type.
+If it is square brackets, then it is not.
+For more information on root types, see
+.Xr ctf 4 .
+.Pp
+Next, the type will have its name and kind.
+If it is an array, it will be followed with a subscript that describes
+the number of entries in the array.
+If it is a pointer, it will followed by the
+.Sy *
+symbol to indicate that it is a pointer.
+If the type has the
+.Sy const ,
+.Sy volatile ,
+.Sy typedef ,
+or
+.Sy restrict
+keyword applied to it, that will precede the name.
+All of these reference types, including pointer, will then be followed
+with an example of the type that they refer to.
+.Pp
+Types which are an integral or floating point value will be followed by
+information about their encoding and the number of bits represented in
+the type.
+.Pp
+Arrays will be followed by two different entries, the contents and
+index.
+The contents member contains the type id of the array's contents
+and the index member describes a type which can represent the array's
+index.
+.Pp
+Structures and unions will be preceded with the corresponding C keyword,
+.Sy struct
+or
+.Sy union .
+After that, the size in bytes of the structure will be indicated.
+ON each subsequent line, a single member will be listed.
+That line will contain the member's name, it's type identifier, and the
+offset into the structure that it can be found in, in bits.
+.Pp
+The following show examples of type information for all of these
+different types:
+.Bd -literal
+\&...
+  [5] char [12] contents: 1, index: 2
+  [6] short encoding=SIGNED offset=0 bits=16
+  <7> struct exit_status (4 bytes)
+        e_termination type=6 off=0
+        e_exit type=6 off=16
+
+  <8> typedef time_t refers to 2
+  <9> struct utmp (36 bytes)
+        ut_user type=3 off=0
+        ut_id type=4 off=64
+        ut_line type=5 off=96
+        ut_pid type=6 off=192
+        ut_type type=6 off=208
+        ut_exit type=7 off=224
+        ut_time type=8 off=256
+
+  <10> struct utmp * refers to 9
+  [11] const struct utmp refers to 9
+  [12] const struct utmp * refers to 11
+  <13> int encoding=SIGNED offset=0 bits=32
+  <14> typedef int32_t refers to 13
+\&...
+.Ed
+.Ss String Table
+This section describes all of the strings that are present in the
+.Sy CTF
+container.
+Each line represents an entry in the string table.
+First the byte offset into the string table is shown in brackets and
+then the
+string's value is displayed.
+Note the following examples:
+.Bd -literal
+  [0] \0
+  [1] joyent_20151001T070028Z
+  [25] char
+  [30] long
+  [35] short
+.Ed
+.Ss Statistics
+This section contains miscellaneous statistics about the
+.Sy CTF
+data present.
+Each line contains a single statistic.
+A brief explanation of the statistic is placed first, followed by an
+equals sign, and then finally the value.
+.Sh EXIT STATUS
+.Bl -inset
+.It Sy 0
+.Dl Execution completed successfully.
+.It Sy 1
+.Dl A fatal error occurred.
+.It Sy 2
+.Dl Invalid command line options were specified.
+.El
+.Sh EXAMPLES
+.Sy Example 1
+Displaying the Type Section of a Single File
+.Lp
+The following example dumps the type section of the file
+.Sy /usr/lib/libc.so.1 .
+.Bd -literal -offset 6n
+$ ctfdump -t /usr/lib/libc.so.1
+- Types ----------------------------------------------------
+
+  <1> int encoding=SIGNED offset=0 bits=32
+  <2> long encoding=SIGNED offset=0 bits=32
+  <3> typedef pid_t refers to 2
+  <4> unsigned int encoding=0x0 offset=0 bits=32
+  <5> typedef uid_t refers to 4
+  <6> typedef gid_t refers to 5
+  <7> typedef uintptr_t refers to 4
+\&...
+.Ed
+.Lp
+.Sy Example 2
+Dumping the CTF data to Another File
+.Lp
+The following example dumps the entire CTF data from the file
+.Sy /usr/lib/libc.so.1
+and places it into the file
+.Sy ctf.out .
+This then shows how you can use the
+.Xr mdb 1
+to inspect its contents.
+.Bd -literal -offset 6n
+$ ctfdump -u ctf.out /usr/lib/libc.so.1
+$ mdb ./ctf.out
+> ::typedef -r /usr/lib/libctf.so.1
+> 0::print ctf_header_t
+{
+    cth_preamble = {
+        ctp_magic = 0xcff1
+        ctp_version = 0x2
+        ctp_flags = 0
+    }
+    cth_parlabel = 0
+    cth_parname = 0
+    cth_lbloff = 0
+    cth_objtoff = 0x8
+    cth_funcoff = 0x5e0
+    cth_typeoff = 0x7178
+    cth_stroff = 0x12964
+    cth_strlen = 0x7c9c
+}
+.Ed
+.Sh INTERFACE STABILITY
+The command syntax is
+.Sy Committed .
+The output format is
+.Sy Uncommitted .
+.Sh SEE ALSO
+.Xr ctfdiff 1 ,
+.Xr dump 1 ,
+.Xr elfdump 1 ,
+.Xr mdb 1 ,
+.Xr ctf 4
diff --git a/usr/src/man/man1/hostname.1 b/usr/src/man/man1/hostname.1
index 8d81482755..74e9c16938 100644
--- a/usr/src/man/man1/hostname.1
+++ b/usr/src/man/man1/hostname.1
@@ -1,8 +1,9 @@
 .\" Copyright (c) 1992, Sun Microsystems, Inc.
+.\" Copyright 2016 Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.Dd May 12, 2016
+.Dd Aug 26, 2016
 .Dt HOSTNAME 1
 .Os
 .Sh NAME
@@ -20,6 +21,19 @@ command prints the name of the current host, as given before the
 prompt.
 The super-user can set the hostname by giving
 .Ar name-of-host .
+.Pp
+While setting the hostname changes the hostname for the running system,
+it does not persist the change.
+The proper way to update the hostname will vary depending on how the
+system is configured.
+For most systems, the persistent hostname is stored in the file
+.Pa /etc/nodename .
+See
+.Xr nodename 4
+for more information on how to update it.
+Note, the
+.Pa /etc/nodename
+file may be ignored in cases where the system is configured to use DHCP.
 .Sh OPTIONS
 .Bl -tag -width Ds
 .It Fl s
@@ -27,4 +41,5 @@ Prints only the part of the hostname preceding the first dot.
 .El
 .Sh SEE ALSO
 .Xr uname 1 ,
+.Xr nodename 4 ,
 .Xr attributes 5
diff --git a/usr/src/man/man1/ld.1 b/usr/src/man/man1/ld.1
index 5d26bbb556..d44c1e1139 100644
--- a/usr/src/man/man1/ld.1
+++ b/usr/src/man/man1/ld.1
@@ -24,7 +24,7 @@ ld \- link-editor for object files
 [\fB-z\fR combreloc | nocombreloc ] [\fB-z\fR defs | nodefs]
 [\fB-z\fR direct | nodirect] [\fB-z\fR endfiltee]
 [\fB-z\fR fatal-warnings | nofatal-warnings ] [\fB-z\fR finiarray=\fIfunction\fR]
-[\fB-z\fR globalaudit] [\fB-z\fR groupperm | nogroupperm] 
+[\fB-z\fR globalaudit] [\fB-z\fR groupperm | nogroupperm]
 [\fB-z\fR guidance[=\fIid1\fR,\fIid2\fR...] [\fB-z\fR help ]
 [\fB-z\fR ignore | record] [\fB-z\fR initarray=\fIfunction\fR] [\fB-z\fR initfirst]
 [\fB-z\fR interpose] [\fB-z\fR lazyload | nolazyload]
diff --git a/usr/src/man/man1/ld.so.1.1 b/usr/src/man/man1/ld.so.1.1
index 4b14ca4f1a..19afbbf3d6 100644
--- a/usr/src/man/man1/ld.so.1.1
+++ b/usr/src/man/man1/ld.so.1.1
@@ -1,9 +1,10 @@
 '\"
 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
+.\" Copyright (c) 2014, Joyent, Inc.  All Rights Reserved
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
 .\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH LD.SO.1 1 "Oct 5, 2012"
+.TH LD.SO.1 1 "May 8, 2014"
 .SH NAME
 ld.so.1 \- runtime linker for dynamic objects
 .SH SYNOPSIS
@@ -574,6 +575,24 @@ aid debugging. See also the \fBRTLD_DI_SETSIGNAL\fR request to
 .RE
 
 .sp
+.ne 2
+.na
+.BR LD_TOXIC_PATH,
+.BR LD_TOXIC_PATH_32,
+.BR LD_TOXIC_PATH_64,
+.ad
+.sp .6
+.RS 4n
+The toxic path refers to a set of paths where by, if
+.B ld.so.1
+were to load a dependency on that path, rather than loading it, it
+should kill the process. This is useful when having built libraries that
+while matching the native architecture of the system, are not suitable
+to be used, for example, libraries that that correspond to an alternate
+release of an operating system.
+.RE
+
+.sp
 .LP
 Notice that environment variable names beginning with the
 characters '\fBLD_\fR' are reserved for possible future enhancements to \fBld\fR(1) and
diff --git a/usr/src/man/man1/machid.1 b/usr/src/man/man1/machid.1
new file mode 100644
index 0000000000..cb95fa36b6
--- /dev/null
+++ b/usr/src/man/man1/machid.1
@@ -0,0 +1,25 @@
+'\" te
+.\"  Copyright 1989 AT&T
+.\" Copyright (c) 1999, Sun Microsystems, Inc.
+.\"  All Rights Reserved
+.\" Copyright 2015, Joyent, Inc.
+.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
+.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
+.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
+.TH MACHID 1 "Feb 27, 2015"
+.SH NAME
+machid, sun, i286, i386, i486, sparc \- get processor type truth value
+
+.SH DESCRIPTION
+.sp
+.LP
+These commands are obsolete and may be removed in a future version of the
+software.
+.sp
+.ne 2
+.na
+.SH NOTES
+.sp
+.LP
+The \fBmachid\fR family of commands is obsolete. Use \fBuname\fR \fB-p\fR and
+\fBuname\fR \fB-m\fR instead.
diff --git a/usr/src/man/man1/mdb.1 b/usr/src/man/man1/mdb.1
index 653404dc77..55640c5fab 100644
--- a/usr/src/man/man1/mdb.1
+++ b/usr/src/man/man1/mdb.1
@@ -1,6 +1,6 @@
 '\" te
 .\" Copyright (c) 2005, Sun Microsystems, Inc. All Rights Reserved.
-.\" Copyright (c) 2012, Joyent, Inc. All Rights Reserved.
+.\" Copyright (c) 2017, Joyent, Inc. All Rights Reserved.
 .\" Copyright (c) 2014, 2017 by Delphix. All rights reserved.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
@@ -3931,6 +3931,17 @@ default.
 .sp
 .ne 2
 .na
+\fB\fBautowrap\fR\fR
+.ad
+.RS 25n
+Forces output to be autowrapped at the terminal width. When this option
+is enabled, \fBmdb\fR will autowrap output, making some attempt to inject
+newlines at word boundaries. This option is disabled by default.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBfollow_exec_mode=\fR\fImode\fR\fR
 .ad
 .RS 25n
diff --git a/usr/src/man/man1/nawk.1 b/usr/src/man/man1/nawk.1
index 4b321c6bd6..457884e5ac 100644
--- a/usr/src/man/man1/nawk.1
+++ b/usr/src/man/man1/nawk.1
@@ -50,6 +50,12 @@ nawk \- pattern scanning and processing language
 .SH SYNOPSIS
 .LP
 .nf
+\fB/usr/bin/awk\fR [\fB-F\fR \fIERE\fR] [\fB-v\fR \fIassignment\fR] \fI\&'program'\fR | \fB-f\fR \fIprogfile\fR...
+     [\fIargument\fR]...
+.fi
+
+.LP
+.nf
 \fB/usr/bin/nawk\fR [\fB-F\fR \fIERE\fR] [\fB-v\fR \fIassignment\fR] \fI\&'program'\fR | \fB-f\fR \fIprogfile\fR...
      [\fIargument\fR]...
 .fi
@@ -63,7 +69,8 @@ nawk \- pattern scanning and processing language
 .SH DESCRIPTION
 .sp
 .LP
-The \fB/usr/bin/nawk\fR and \fB/usr/xpg4/bin/awk\fR utilities execute
+The \fB/usr/bin/awk\fR, \fB/usr/bin/nawk\fR and \fB/usr/xpg4/bin/awk\fR
+utilities execute
 \fIprogram\fRs written in the \fBnawk\fR programming language, which is
 specialized for textual data manipulation. A \fBnawk\fR \fIprogram\fR is a
 sequence of patterns and corresponding actions. The string specifying
diff --git a/usr/src/man/man1/pargs.1 b/usr/src/man/man1/pargs.1
index 3f8e2bae8c..58b7bfc7f9 100644
--- a/usr/src/man/man1/pargs.1
+++ b/usr/src/man/man1/pargs.1
@@ -1,20 +1,22 @@
 '\" te
 .\"  Copyright (c) 2006, Sun Microsystems, Inc. All Rights Reserved
+.\"  Copyright 2015 Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH PARGS 1 "Jun 19, 2006"
+.TH PARGS 1 "Oct 5, 2015"
 .SH NAME
-pargs \- print  process  arguments,  environment  variables,  or auxiliary
+pargs, penv, pauxv \- print  process  arguments,  environment  variables,  or auxiliary
 vector
 .SH SYNOPSIS
 .LP
 .nf
 \fBpargs\fR [\fB-aceFlx\fR] [\fIpid\fR | \fIcore\fR]...
+\fBpauxv\fR [\fB-cF\fR] [\fIpid\fR | \fIcore\fR]...
+\fBpenv\fR [\fB-cF\fR] [\fIpid\fR | \fIcore\fR]...
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBpargs\fR utility examines a target process or process core file and
 prints arguments, environment variables and values, or the process auxiliary
@@ -32,10 +34,18 @@ the target process and the \fBpargs\fR process do not share a common character
 encoding, \fBpargs\fR attempts to employ the \fBiconv\fR(3C) facility to
 generate a printable version of the extracted  strings. In the event that such
 a conversion is impossible, strings are displayed as 7-bit \fBASCII\fR.
-.SH OPTIONS
 .sp
 .LP
-The following options are supported:
+The \fBpauxv\fR command is equivalent to running \fBpargs\fR with the
+\fB-x\fR option.
+.sp
+.LP
+The \fBpenv\fR command is equivalent to running \fBpargs\fR with the
+\fB-e\fR option.
+.SH OPTIONS
+.LP
+The following options are supported by \fBpargs\fR. Only the \fB-c\fR
+and \fB-F\fR options are supported by \fBpauxv\fR and \fBpenv\fR:
 .sp
 .ne 2
 .na
@@ -98,7 +108,6 @@ Prints process auxiliary vector.
 .RE
 
 .SH OPERANDS
-.sp
 .LP
 The following operands are supported:
 .sp
@@ -120,7 +129,6 @@ Process core file.
 .RE
 
 .SH USAGE
-.sp
 .LP
 Caution should be exercised when using the \fB-F\fR flag. Imposing two
 controlling processes on one victim process can lead to chaos. Safety is
@@ -128,7 +136,6 @@ assured only if the primary controlling process, typically a debugger, has
 stopped the victim process and the primary controlling process is doing nothing
 at the moment of application of the \fBproc\fR tool in question.
 .SH EXIT STATUS
-.sp
 .LP
 The following exit values are returned:
 .sp
@@ -151,7 +158,6 @@ option).
 .RE
 
 .SH FILES
-.sp
 .ne 2
 .na
 \fB\fB/proc/pid/*\fR\fR
@@ -161,7 +167,6 @@ Process information and control files.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -177,7 +182,6 @@ Interface Stability	Evolving
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBproc\fR(1), \fBiconv\fR(3C), \fBproc\fR(4), \fBascii\fR(5),
 \fBattributes\fR(5), \fBenviron\fR(5), \fBformats\fR(5)
diff --git a/usr/src/man/man1/pfexec.1 b/usr/src/man/man1/pfexec.1
index 66e5e08420..5d5c9048ed 100644
--- a/usr/src/man/man1/pfexec.1
+++ b/usr/src/man/man1/pfexec.1
@@ -58,6 +58,12 @@ For \fBpfexec\fR to function correctly, the \fBpfexecd\fR daemon must be running
 in the current zone. This is normally managed by the
 "\fBsvc:/system/pfexec:default\fR" SMF service (see \fBsmf\fR(5)).
 .SH USAGE
+.sp
+.LP
+For \fBpfexec\fR to function correctly, the \fBpfexecd\fR daemon must be running
+in the current zone. This is normally managed by the
+"\fBsvc:/system/pfexec:default\fR" SMF service (see \fBsmf\fR(5)).
+.SH USAGE
 .LP
 \fBpfexec\fR is used to execute commands with predefined process attributes,
 such as specific user or group \fBID\fRs.
diff --git a/usr/src/man/man1/proc.1 b/usr/src/man/man1/proc.1
index 4a428e55fd..e61ae1d714 100644
--- a/usr/src/man/man1/proc.1
+++ b/usr/src/man/man1/proc.1
@@ -539,12 +539,12 @@ Interface Stability	See below.
 The human readable output is Uncommitted. The options are Committed.
 .SH SEE ALSO
 .LP
-\fBgcore\fR(1), \fBldd\fR(1), \fBpargs\fR(1), \fBpgrep\fR(1), \fBpkill\fR(1),
-\fBplimit\fR(1), \fBpmap\fR(1), \fBpreap\fR(1), \fBps\fR(1), \fBptree\fR(1),
-\fBppgsz\fR(1), \fBpwd\fR(1), \fBrlogin\fR(1), \fBtime\fR(1), \fBtruss\fR(1),
-\fBwait\fR(1), \fBfcntl\fR(2), \fBfstat\fR(2), \fBsetuid\fR(2),
-\fBdlopen\fR(3C), \fBsignal.h\fR(3HEAD), \fBcore\fR(4), \fBproc\fR(4),
-\fBprocess\fR(4), \fBattributes\fR(5), \fBzones\fR(5)
+\fBgcore\fR(1), \fBldd\fR(1), \fBpargs\fR(1), \fBpauxv\fR(1), \fBpenv\fR(1),
+\fBpgrep\fR(1), \fBpkill\fR(1), \fBplimit\fR(1), \fBpmap\fR(1), \fBpreap\fR(1),
+\fBps\fR(1), \fBptree\fR(1), \fBppgsz\fR(1), \fBpwd\fR(1), \fBrlogin\fR(1),
+\fBtime\fR(1), \fBtruss\fR(1), \fBwait\fR(1), \fBfcntl\fR(2), \fBfstat\fR(2),
+\fBsetuid\fR(2), \fBdlopen\fR(3C), \fBsignal.h\fR(3HEAD), \fBcore\fR(4),
+\fBproc\fR(4), \fBprocess\fR(4), \fBattributes\fR(5), \fBzones\fR(5)
 .SH WARNINGS
 .LP
 The following \fBproc\fR tools stop their target processes while inspecting
diff --git a/usr/src/man/man1/ps.1 b/usr/src/man/man1/ps.1
index f0f01d4c54..afdda2f8ef 100644
--- a/usr/src/man/man1/ps.1
+++ b/usr/src/man/man1/ps.1
@@ -71,6 +71,9 @@ displayed is controlled by the options.
 Some options accept lists as arguments. Items in a list can be either separated
 by commas or else enclosed in quotes and separated by commas or spaces. Values
 for \fIproclist\fR and \fIgrplist\fR must be numeric.
+.sp
+.LP
+The \fBps\fR command also accepts BSD-style options.  See \fBps\fR(1b).
 .SH OPTIONS
 .LP
 The following options are supported:
@@ -1356,7 +1359,8 @@ Standard	See \fBstandards\fR(5).
 .SH SEE ALSO
 .LP
 \fBkill\fR(1), \fBlgrpinfo\fR(1), \fBnice\fR(1), \fBpagesize\fR(1),
-\fBpmap\fR(1), \fBpriocntl\fR(1), \fBwho\fR(1), \fBgetty\fR(1M), \fBproc\fR(4),
+\fBpmap\fR(1), \fBpriocntl\fR(1), \fBps\fR(1b), \fBwho\fR(1), \fBgetty\fR(1M),
+\fBproc\fR(4),
 \fBttysrch\fR(4), \fBattributes\fR(5), \fBenviron\fR(5),
 \fBresource_controls\fR(5), \fBstandards\fR(5), \fBzones\fR(5)
 .SH NOTES
diff --git a/usr/src/man/man1/sed.1 b/usr/src/man/man1/sed.1
index 126402343c..cd805bd841 100644
--- a/usr/src/man/man1/sed.1
+++ b/usr/src/man/man1/sed.1
@@ -1,8 +1,6 @@
 .\" Copyright (c) 1992, 1993
 .\"     The Regents of the University of California.  All rights reserved.
 .\"
-.\" Copyright 2011 Nexenta Systems, Inc. All rights reserved.
-.\"
 .\" This code is derived from software contributed to Berkeley by
 .\" the Institute of Electrical and Electronics Engineers, Inc.
 .\"
@@ -44,7 +42,8 @@
 [\fB\-Ealnr\fP]
 [\fB\-e\fP \fIcommand\fP]
 [\fB\-f\fP \fIcommand_file\fP]
-[\fB\-I\fP[\fIextension\fP] | \fB\-i\fP[\fIextension\fP]]
+[\fB\-I\fP \fIextension\fP]
+[\fB\-i\fP \fIextension\fP]
 [\fIfile ...\fP]
 .SH DESCRIPTION
 The
@@ -97,11 +96,16 @@ Append the editing commands found in the file
 to the list of commands.
 The editing commands should each be listed on a separate line.
 .TP
-\fB\-I\fP[\fIextension\fP]
-Edit files in-place, saving backups if \fIextension\fP was specified.
-It is not recommended to omit saving backups when in-place editing files,
-as you risk corruption or partial content in situations where disk
-space is exhausted, etc.
+\fB\-I\fP \fIextension\fP
+Edit files in-place, saving backups with the specified
+\fIextension\fP.
+If a zero-length
+\fIextension\fP
+is given, no backup will be saved.
+It is not recommended to give a zero-length
+\fIextension\fP
+when in-place editing files, as you risk corruption or partial content
+in situations where disk space is exhausted, etc.
 
 Note that in-place editing with
 \fB\-I\fP
@@ -119,7 +123,7 @@ where using
 \fB\-i\fP
 is desired.
 .TP
-\fB\-i\fP[\fIextension\fP]
+\fB\-i\fP \fIextension\fP
 Edit files in-place similarly to
 \fB\-I\fP,
 but treat each file independently from other files.
diff --git a/usr/src/man/man1/zlogin.1 b/usr/src/man/man1/zlogin.1
index 7c99eb6cb1..476faab86f 100644
--- a/usr/src/man/man1/zlogin.1
+++ b/usr/src/man/man1/zlogin.1
@@ -13,43 +13,43 @@
 .\" Portions Copyright [yyyy] [name of copyright owner]
 .\" Copyright 2013 DEY Storage Systems, Inc.
 .\" Copyright (c) 2014 Gary Mills
+.\" Copyright (c) 2015, Joyent, Inc. All Rights Reserved
 .\" Copyright 2015 Nexenta Systems, Inc. All rights reserved.
-.TH ZLOGIN 1 "Mar 17, 2015"
+.TH ZLOGIN 1 "Mar 30, 2015"
 .SH NAME
 zlogin \- enter a zone
 .SH SYNOPSIS
 .LP
 .nf
-\fBzlogin\fR [\fB-dCEQ\fR] [\fB-e\fR \fIc\fR] [\fB-l\fR \fIusername\fR] \fIzonename\fR
+\fBzlogin\fR [\fB-dCEINQ\fR] [\fB-e\fR \fIc\fR] [\fB-l\fR \fIusername\fR] \fIzonename\fR
 .fi
 
 .LP
 .nf
-\fBzlogin\fR [\fB-nEQS\fR] [\fB-e\fR \fIc\fR] [\fB-l\fR \fIusername\fR] \fIzonename\fR \fIutility\fR
+\fBzlogin\fR [\fB-inEQS\fR] [\fB-e\fR \fIc\fR] [\fB-l\fR \fIusername\fR] \fIzonename\fR \fIutility\fR
      [\fIargument\fR]...
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBzlogin\fR utility is used by the administrator to enter an operating
 system zone. Only a superuser operating in the global system zone can use this
 utility.
 .sp
 .LP
-\fBzlogin\fR operates in one of three modes:
+\fBzlogin\fR operates in one of four modes:
 .sp
 .ne 2
 .na
 \fBInteractive Mode\fR
 .ad
 .RS 24n
-If no utility argument is given and the stdin file descriptor for the
-\fBzlogin\fR process is a tty device, \fBzlogin\fR operates in \fBinteractive
-mode\fR. In this mode, \fBzlogin\fR creates a new pseudo terminal for use
-within the login session. Programs requiring a tty device, for example,
-\fBvi\fR(1), work properly in this mode. In this mode, \fBzlogin\fR invokes
-\fBlogin\fR(1) to provide a suitable login session.
+If no utility argument is given or if the \fB-i\fR option is specified, and the
+stdin file descriptor for the \fBzlogin\fR process is a tty device, \fBzlogin\fR
+operates in \fBinteractive mode\fR. In this mode, \fBzlogin\fR creates a new
+pseudo terminal for use within the login session. Programs requiring a tty
+device, for example, \fBvi\fR(1), work properly in this mode. In this mode,
+\fBzlogin\fR invokes \fBlogin\fR(1) to provide a suitable login session.
 .RE
 
 .sp
@@ -58,11 +58,12 @@ within the login session. Programs requiring a tty device, for example,
 \fBNon-Interactive Mode\fR
 .ad
 .RS 24n
-If a utility is specified, \fBzlogin\fR operates in \fBnon-interactive mode\fR.
-This mode can be useful for script authors since stdin, stdout, and stderr are
-preserved and the exit status of \fIutility\fR is returned upon termination. In
-this mode, \fBzlogin\fR invokes \fBsu\fR(1M) in order to set up the user's
-environment and to provide a login environment.
+If a utility is specified and the \fB-i\fR option is not specified, \fBzlogin\fR
+operates in \fBnon-interactive mode\fR.  This mode can be useful for script
+authors since stdin, stdout, and stderr are preserved and the exit status of
+\fIutility\fR is returned upon termination. In this mode, \fBzlogin\fR invokes
+\fBsu\fR(1M) in order to set up the user's environment and to provide a login
+environment.
 .sp
 The specified command is passed as a string and interpreted by a shell running
 in the non-global zone. See \fBrsh\fR(1).
@@ -80,8 +81,17 @@ available once the zone is in the installed  state. Connections to the console
 are persistent across reboot of the zone.
 .RE
 
-.SH OPTIONS
 .sp
+.ne 2
+.na
+\fBStandalone-processs Interactive Mode\fR
+.ad
+.RS 24n
+If the \fB-I\fR option is specified the user is connected to the zone's stdin,
+stdout and stderr \fBzfd(7D)\fR devices.
+.RE
+
+.SH OPTIONS
 .LP
 The following options are supported:
 .sp
@@ -127,6 +137,25 @@ login by using the escape sequence character.
 .sp
 .ne 2
 .na
+\fB\fB-i\fR\fR
+.ad
+.RS 15n
+Forces interactive mode when a utility argument is specified.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-I\fR\fR
+.ad
+.RS 15n
+Connects to the zone's \fBzfd(7D)\fR devices.
+.RE
+
+.sp
+.sp
+.ne 2
+.na
 \fB\fB-l\fR \fIusername\fR\fR
 .ad
 .RS 15n
@@ -149,6 +178,17 @@ and the shell which invokes \fBzlogin\fR both read from standard input.
 .sp
 .ne 2
 .na
+\fB-N\fR
+.ad
+.RS 15n
+Nohup. This may only be used with the -I option to avoid sending EOF to the zfd
+device when zlogin's stdin receives EOF. It can also be toggled by sending
+\fBSIGUSR1\fR to an attached zlogin process.
+.RE
+
+.sp
+.ne 2
+.na
 \fB-Q\fR
 .ad
 .RS 15n
@@ -172,7 +212,6 @@ other forms of login have become impossible.
 .RE
 
 .SS "Escape Sequences"
-.sp
 .LP
 Lines that you type that start with the tilde character (\fB~\fR) are "escape
 sequences". The escape character can be changed using the \fB-e\fR option.
@@ -187,12 +226,10 @@ host breaks the connection with no warning to the zone's end.
 .RE
 
 .SH SECURITY
-.sp
 .LP
 Once a process has been placed in a zone other than the global zone, the
 process cannot change zone again, nor can any of its children.
 .SH OPERANDS
-.sp
 .LP
 The following operands are supported:
 .sp
@@ -223,7 +260,6 @@ Arguments passed to the utility.
 .RE
 
 .SH EXIT STATUS
-.sp
 .LP
 In interactive and non-interactive modes, the \fBzlogin\fR utility exits when
 the command or shell in the non-global zone exits. In non-interactive mode, the
@@ -268,7 +304,6 @@ mode.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -284,12 +319,10 @@ Interface Stability	Evolving
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBlogin\fR(1), \fBrsh\fR(1), \fBvi\fR(1), \fBsu\fR(1M), \fBzoneadm\fR(1M),
 \fBzonecfg\fR(1M), \fBattributes\fR(5), \fBzones\fR(5)
 .SH NOTES
-.sp
 .LP
 \fBzlogin\fR fails if its open files or any portion of its address space
 corresponds to an NFS file. This includes the executable itself or the shared
diff --git a/usr/src/man/man1m/Makefile b/usr/src/man/man1m/Makefile
index 625ae224d4..66926a9e08 100644
--- a/usr/src/man/man1m/Makefile
+++ b/usr/src/man/man1m/Makefile
@@ -19,7 +19,7 @@
 # Copyright (c) 2017, Chris Fraire <cfraire@me.com>.
 #
 
-include		$(SRC)//Makefile.master
+include	$(SRC)//Makefile.master
 
 MANSECT=	1m
 
@@ -506,7 +506,10 @@ _MANFILES=	6to4relay.1m		\
 		uucleanup.1m		\
 		uusched.1m		\
 		uuxqt.1m		\
+		vfsstat.1m		\
 		vmstat.1m		\
+		vndadm.1m		\
+		vndstat.1m		\
 		volcopy.1m		\
 		volcopy_ufs.1m		\
 		vscanadm.1m		\
@@ -540,7 +543,8 @@ _MANFILES=	6to4relay.1m		\
 i386_MANFILES=				\
 		acpidump.1m		\
 		acpixtract.1m		\
-		nvmeadm.1m
+		nvmeadm.1m		\
+		pptadm.1m
 
 sparc_MANFILES=	cvcd.1m			\
 		dcs.1m			\
@@ -678,7 +682,6 @@ hal-set-property.1m		:= LINKSRC = hal-get-property.1m
 
 poweroff.1m			:= LINKSRC = halt.1m
 
-
 comsat.1m			:= LINKSRC = in.comsat.1m
 fingerd.1m			:= LINKSRC = in.fingerd.1m
 rarpd.1m			:= LINKSRC = in.rarpd.1m
diff --git a/usr/src/man/man1m/dladm.1m b/usr/src/man/man1m/dladm.1m
index f84c147caf..ffe36dfa07 100644
--- a/usr/src/man/man1m/dladm.1m
+++ b/usr/src/man/man1m/dladm.1m
@@ -41,16 +41,16 @@
 .\"
 .\"
 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
-.\" Copyright 2016 Joyent, Inc.
+.\" Copyright 2017 Joyent, Inc.
 .\"
-.TH DLADM 1M "Dec 16, 2016"
+.TH DLADM 1M "Dec 6, 2017"
 .SH NAME
 dladm \- administer data links
 .SH SYNOPSIS
 .LP
 .nf
 \fBdladm show-link\fR [\fB-P\fR] [\fB-s\fR [\fB-i\fR \fIinterval\fR]] [[\fB-p\fR] \fB-o\fR \fIfield\fR[,...]] [\fIlink\fR]
-\fBdladm rename-link\fR [\fB-R\fR \fIroot-dir\fR] \fIlink\fR \fInew-link\fR
+\fBdladm rename-link\fR [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fIlink\fR \fInew-link\fR
 .fi
 
 .LP
@@ -133,9 +133,11 @@ dladm \- administer data links
 
 .LP
 .nf
-\fBdladm set-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] \fB-p\fR \fIprop\fR=\fIvalue\fR[,...] \fIlink\fR
-\fBdladm reset-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-p\fR \fIprop\fR[,...]] \fIlink\fR
-\fBdladm show-linkprop\fR [\fB-P\fR] [[\fB-c\fR] \fB-o\fR \fIfield\fR[,...]] [\fB-p\fR \fIprop\fR[,...]] [\fIlink\fR]
+\fBdladm set-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fB-p\fR \fIprop\fR=\fIvalue\fR[,...]
+     \fIlink\fR
+\fBdladm reset-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] [\fB-p\fR \fIprop\fR[,...]] \fIlink\fR
+\fBdladm show-linkprop\fR [\fB-P\fR] [\fB-z\fR \fIzonename\fR] [[\fB-c\fR] \fB-o\fR \fIfield\fR[,...]]
+     [\fB-p\fR \fIprop\fR[,...]] [\fIlink\fR]
 .fi
 
 .LP
@@ -150,9 +152,9 @@ dladm \- administer data links
 \fBdladm create-vnic\fR [\fB-t\fR] \fB-l\fR \fIlink\fR [\fB-R\fR \fIroot-dir\fR] [\fB-m\fR \fIvalue\fR | auto |
      {factory \fB-n\fR \fIslot-identifier\fR]} | {random [\fB-r\fR \fIprefix\fR]}]
      [\fB-v\fR \fIvlan-id\fR] [\fB-p\fR \fIprop\fR=\fIvalue\fR[,...]] \fIvnic-link\fR
-\fBdladm delete-vnic\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] \fIvnic-link\fR
+\fBdladm delete-vnic\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fIvnic-link\fR
 \fBdladm show-vnic\fR [\fB-pP\fR] [\fB-s\fR [\fB-i\fR \fIinterval\fR]] [\fB-o\fR \fIfield\fR[,...]]
-     [\fB-l\fR \fIlink\fR] [\fIvnic-link\fR]
+     [\fB-l\fR \fIlink\fR] [\fB-z\fR \fIzonename\fR] [\fIvnic-link\fR]
 .fi
 
 .LP
@@ -174,6 +176,14 @@ dladm \- administer data links
 
 .LP
 .nf
+\fBdladm create-overlay\fR [\fB-t\fR] \fB-e\fR \fIencap\fR \fB-s\fR \fIsearch\fR \fB-v\fR \fIvnetid\fR [\fB-p\fR \fIprop\fR=\fIvalue\fR[,...]] \fIoverlay\fR
+\fBdladm delete-overlay\fR \fIoverlay\fR
+\fBdladm modify-overlay\fR \fB-d\fR \fImac\fR | \fB-f\fR | \fB-s\fR \fImac=ip:port\fR \fIoverlay\fR
+\fBdladm show-overlay\fR [ \fB-f\fR | \fB-t\fR ] [[\fB-p\fR] \fB-o\fR \fIfield\fR[,...]] [\fIoverlay\fR]
+.fi
+
+.LP
+.nf
 \fBdladm show-usage\fR [\fB-a\fR] \fB-f\fR \fIfilename\fR [\fB-p\fR \fIplotfile\fR \fB-F\fR \fIformat\fR] [\fB-s\fR \fItime\fR]
      [\fB-e\fR \fItime\fR] [\fIlink\fR]
 .fi
@@ -261,9 +271,9 @@ A WiFi datalink.
 .ad
 .sp .6
 .RS 4n
-A virtual network interface created on a link or an \fBetherstub\fR. It is a
-pseudo device that can be treated as if it were an network interface card on a
-machine.
+A virtual network interface created on a link, an \fBetherstub\fR, or \fBan
+overlay\fR. It is a pseudo device that can be treated as if it were an network
+interface card on a machine.
 .RE
 
 .sp
@@ -331,6 +341,20 @@ use any alphanumeric characters, as well as underscore (\fB_\fR), period
 characters.
 .RE
 
+.sp
+.ne 2
+.na
+.B overlay
+.ad
+.sp .6
+.RS 4n
+An overlay instance, identified by an administratively-chosen name. An overlay
+can be used to create or join an existing software defined network.
+VNICs created on an overlay will appear to be connected by a local virtual
+switch and will also be connected to interfaces on matching overlays provided by
+other hosts. For more information on overlay devices, see \fBoverlay\fR(5).
+.RE
+
 .SS "Options"
 .LP
 Each \fBdladm\fR subcommand has its own set of options. However, many of the
@@ -434,6 +458,19 @@ A virtual network interface. The \fBshow-vnic\fR subcommand displays more
 detail for this class of datalink.
 .RE
 
+.sp
+.ne 2
+.na
+\fB\fBoverlay\fR\fR
+.ad
+.sp .6
+.RS 4n
+A virtual device that is used to create or join a software defined
+network. The \fBshow-overlay\fR subcommand displays more detail for this
+class of datalink.
+.RE
+
+
 .RE
 
 .sp
@@ -603,8 +640,7 @@ will be displayed only once.
 .sp
 .ne 2
 .na
-\fB\fBdladm rename-link\fR [\fB-R\fR \fIroot-dir\fR] \fIlink\fR
-\fInew-link\fR\fR
+\fB\fBdladm rename-link\fR [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fIlink\fR \fInew-link\fR\fR
 .ad
 .sp .6
 .RS 4n
@@ -622,6 +658,16 @@ examples of how this subcommand is used.
 See "Options," above.
 .RE
 
+.sp
+.ne 2
+.na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+A link assigned to a zone can only be renamed while the zone is in the ready state.
+.RE
+
 .RE
 
 .sp
@@ -3227,8 +3273,7 @@ Extended output is displayed for \fBPTYPE\fR values of \fBcurrent\fR,
 .sp
 .ne 2
 .na
-\fB\fBdladm set-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] \fB-p\fR
-\fIprop\fR=\fIvalue\fR[,...] \fIlink\fR\fR
+\fB\fBdladm set-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fB-p\fR \fIprop\fR=\fIvalue\fR[,...] \fIlink\fR\fR
 .ad
 .sp .6
 .RS 4n
@@ -3260,6 +3305,16 @@ See "Options," above.
 .sp
 .ne 2
 .na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fB-p\fR \fIprop\fR=\fIvalue\fR[,...], \fB--prop\fR
 \fIprop\fR=\fIvalue\fR[,...]\fR
 .ad
@@ -3279,8 +3334,7 @@ same value.
 .sp
 .ne 2
 .na
-\fB\fBdladm reset-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-p\fR
-\fIprop\fR,...] \fIlink\fR\fR
+\fB\fBdladm reset-linkprop\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] [\fB-p\fR \fIprop\fR,...] \fIlink\fR\fR
 .ad
 .sp .6
 .RS 4n
@@ -3312,6 +3366,16 @@ See "Options," above.
 .sp
 .ne 2
 .na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fB-p\fR \fIprop, ...\fR, \fB--prop\fR=\fIprop, ...\fR\fR
 .ad
 .sp .6
@@ -3326,8 +3390,7 @@ the same value.
 .sp
 .ne 2
 .na
-\fB\fBdladm show-linkprop\fR [\fB-P\fR] [[\fB-c\fR] \fB-o\fR
-\fIfield\fR[,...]][\fB-p\fR \fIprop\fR[,...]] [\fIlink\fR]\fR
+\fB\fBdladm show-linkprop\fR [\fB-P\fR] [\fB-z\fR \fIzonename\fR] [[\fB-c\fR] \fB-o\fR \fIfield\fR[,...]][\fB-p\fR \fIprop\fR[,...]] [\fIlink\fR]\fR
 .ad
 .sp .6
 .RS 4n
@@ -3445,6 +3508,16 @@ Display persistent link property information
 .sp
 .ne 2
 .na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fB-p\fR \fIprop, ...\fR, \fB--prop\fR=\fIprop, ...\fR\fR
 .ad
 .sp .6
@@ -3762,8 +3835,7 @@ A comma-separated list of properties to set to the specified values.
 .sp
 .ne 2
 .na
-\fB\fBdladm delete-vnic\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR]
-\fIvnic-link\fR\fR
+\fB\fBdladm delete-vnic\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fIvnic-link\fR\fR
 .ad
 .sp .6
 .RS 4n
@@ -3789,13 +3861,22 @@ next reboot.
 See "Options," above.
 .RE
 
+.sp
+.ne 2
+.na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
 .RE
 
 .sp
 .ne 2
 .na
-\fB\fBdladm show-vnic\fR [\fB-pP\fR] [\fB-s\fR [\fB-i\fR \fIinterval\fR]]
-[\fB-o\fR \fIfield\fR[,...]] [\fB-l\fR \fIlink\fR] [\fIvnic-link\fR]\fR
+\fB\fBdladm show-vnic\fR [\fB-pP\fR] [\fB-s\fR [\fB-i\fR \fIinterval\fR]] [\fB-o\fR \fIfield\fR[,...]] [\fB-l\fR \fIlink\fR] [\fB-z\fR \fIzonename\fR] [\fIvnic-link\fR]\fR
 .ad
 .sp .6
 .RS 4n
@@ -3938,6 +4019,16 @@ will be displayed only once.
 Display information for all VNICs on the named link.
 .RE
 
+.sp
+.ne 2
+.na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
 .RE
 
 .sp
@@ -4355,6 +4446,349 @@ The tunnel destination address.
 .sp
 .ne 2
 .na
+\fBdladm create-overlay\fR \fB-e\fR \fIencap\fR \fB-s\fR \fIsearch\fR
+\fB-v\fR \fIvnetid\fR [\fB-p\fR \fIprop\fR=\fIvalue\fR[,...]] \fIoverlay\fR
+.ad
+.sp .6
+.RS 4n
+Create an overlay device named \fIoverlay\fR.
+.sp
+Overlay devices are similar to etherstubs. VNICs can be created on top
+of them. However, unlike an etherstub which is local to the system, an
+overlay device can be configured to communicate to remote hosts,
+providing a means for network virtualization. The way in which it does
+this is described by the encapsulation module and the search plugin. For
+more information on these, see \fBoverlay\fR(5).
+.sp
+An overlay device has a series of required and optional properties.  These
+properties vary based upon the search and encapsulation modules and are fully
+specified in \fBoverlay\fR(5). Not every property needs to be specified - some
+have default values which will be used if nothing specific is specified. For
+example, the default port for VXLAN comes from its IANA standard. If a
+required property is missing, the command will fail and inform you of the
+missing properties.
+.sp
+.ne 2
+.na
+\fB\fB-t\fR, \fB--temporary\fR\fR
+.ad
+.sp .6
+.RS 4n
+Specifies that the overlay is temporary. Temporary overlays last until
+the next reboot.
+.RE
+
+.sp
+.ne 2
+.na
+\fB-e\fR \fIencap\fR, \fB--encap\fR=\fIencap\fR
+.ad
+.sp .6
+.RS 4n
+Use \fIencap\fR as the encapsulation plugin for the overlay device
+\fIoverlay\fR. The encapsulation plugin determines how packets are transformed
+before being put on the wire.
+.RE
+
+.sp
+.ne 2
+.na
+\fB-s\fR \fIsearch\fR, \fB--search\fR=\fIsearch\fR
+.ad
+.sp .6
+.RS 4n
+Use \fIsearch\fR as the search plugin for \fIoverlay\fR. The search plugin
+determines how non-local targets are found and where packets are directed to.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-p\fR \fIprop\fR=\fIvalue\fR,..., \fB--prop\fR
+\fIprop\fR=\fIvalue\fR,...\fR
+.ad
+.sp .6
+.RS 4n
+A comma-separated list of properties to set to the specified values.
+.RE
+
+.sp
+.ne 2
+.na
+\fB-v\fR \fIvnetid\fR, \fB--vnetid\fR=\fIvnetid\fR
+.ad
+.sp .6
+.RS 4n
+Sets the virtual networking identifier to \fIvnetid\fR. A virtual network
+identifier determines is similar to a VLAN identifier, in that it identifies a
+unique virtual network. All overlay devices on the system share the same space
+for the virtual network identifier. However, the valid range of identifiers is
+determined by the encapsulation plugin specified by \fB-e\fR.
+.RE
+
+.RE
+
+.sp
+.ne 2
+.na
+\fBdladm delete-overlay\fR \fIoverlay\fR
+.ad
+.sp .6
+.RS 4n
+Delete the specified overlay. This will fail if there are VNICs on top of the
+device.
+.RE
+
+.sp
+.ne 2
+.na
+\fBdladm modify-overlay\fR \fB-d\fR \fImac\fR | \fB-f\fR | \fB-s\fR \fImac=ip:port\fR \fIoverlay\fR
+.ad
+.sp .6
+.RS 4n
+Modifies the target tables for the specified overlay.
+.sp
+The different options allow for different ways of modifying the target table.
+One of \fB-d\fR, \fB-f\fR, and \fB-s\fR is required. This is not applicable for
+all kinds of overlay devices. For more information, see \fBoverlay\fR(5).
+.sp
+.ne 2
+.na
+\fB-d\fR \fImac\fR, \fB--delete-entry\fR=\fImac\fR
+.ad
+.sp .6
+.RS 4n
+Deletes the entry for \fImac\fR from the target table for \fIoverlay\fR. Note,
+if a lookup is pending or outstanding, this does not cancel it or stop it from
+updating the value.
+.RE
+
+.sp
+.ne 2
+.na
+\fB-f\fR, \fB--flush-table\fR
+.ad
+.sp .6
+.RS 4n
+Flushes all values in the target table for \fIoverlay\fR.
+.RE
+
+.sp
+.ne 2
+.na
+\fB-s\fR \fImac\fR=\fIvalue\fR, \fB--set-entry\fR=\fImac\fR=\fIvalue\fR
+.ad
+.sp .6
+.RS 4n
+Sets the value of \fIoverlay\fR's target table entry for \fImac\fR to
+the specified value. The specified value varies upon the encapsulation
+plugin. The value may be a combination of a MAC address, IP address,
+and port. Generally, this looks like
+[\fImac\fR,][\fIIP\fR:][\fIport\fR]. If a component is the last one,
+then there is no need for a separator. eg. if just the MAC address or
+IP is needed, it would look like \fImac\fR and \fIIP\fR respectively.
+.RE
+
+.RE
+
+.sp
+.ne 2
+.na
+\fBdladm show-overlay\fR [ \fB-f\fR | \fB-t\fR ] [[\fB-p\fR] \fB-o\fR \fIfield\fR[,...]] [\fIoverlay\fR]
+.ad
+.sp .6
+.RS 4n
+Shows overlay configuration (the default), internal target tables (\fB-t\fR), or
+the FMA state (\fB-f\fR), either for all overlays or the specified overlay.
+.sp
+By default (with neither \fB-f\fR or \fB-t\fR specified), the following fields
+will be displayed:
+.sp
+.ne 2
+.na
+\fB\fBLINK\fR\fR
+.ad
+.sp .6
+.RS 4n
+The name of the overlay.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBPROPERTY\fR\fR
+.ad
+.sp .6
+.RS 4n
+The name of the property.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBPERM\fR\fR
+.ad
+.sp .6
+.RS 4n
+The read/write permissions of the property. The value shown is one of \fBr-\fR
+or \fBrw\fR.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBVALUE\fR\fR
+.ad
+.sp .6
+.RS 4n
+The current  property value. If the value is not set, it is shown as \fB--\fR.
+If it is unknown, the value is shown as \fB?\fR.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBDEFAULT\fR\fR
+.ad
+.sp .6
+.RS 4n
+The default value of the property. If the property has no default value,
+\fB--\fR is shown.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBPOSSIBLE\fR\fR
+.ad
+.sp .6
+.RS 4n
+A comma-separated list of the values the property can have. If the values span
+a numeric range, \fImin\fR - \fImax\fR might be shown as shorthand. If the
+possible values are unknown or unbounded, \fB--\fR is shown.
+.RE
+
+.sp
+When the \fB-f\fR option is displayed, the following fields will be displayed:
+.sp
+.ne 2
+.na
+\fB\fBLINK\fR\fR
+.ad
+.sp .6
+.RS 4n
+The name of the overlay.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBSTATUS\fR\fR
+.ad
+.sp .6
+.RS 4n
+Either \fBONLINE\fR or \fBDEGRADED\fR.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBDETAILS\fR\fR
+.ad
+.sp .6
+.RS 4n
+When the \fBoverlay\fR's status is \fBONLINE\fR, then this has the value
+\fB--\fR. Otherwise, when it is \fBDEGRADED\fR, this field provides a more
+detailed explanation as to why it's degraded.
+.RE
+
+.sp
+When the \fB-t\fR option is displayed, the following fields will be displayed:
+.sp
+.ne 2
+.na
+\fB\fBLINK\fR\fR
+.ad
+.sp .6
+.RS 4n
+The name of the overlay.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBTARGET\fR\fR
+.ad
+.sp .6
+.RS 4n
+The target MAC address of a table entry.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBDESTINATION\fR\fR
+.ad
+.sp .6
+.RS 4n
+The address that an encapsulated packet will be sent to when a packet has the
+address specified by \fBTARGET\fR.
+.RE
+
+The \fBshow-overlay\fR command supports the following options:
+
+.sp
+.ne 2
+.na
+\fB-f\fR, \fB--fma\fR
+.ad
+.sp .6
+.RS 4n
+Displays information about an overlay device's FMA state. For more
+information on the target table, see \fBoverlay\fR(5).
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-o\fR \fIfield\fR[,...], \fB--output\fR=\fIfield\fR\fR
+.ad
+.sp .6
+.RS 4n
+A case-insensitive, comma-separated list of output fields to display. The field
+name must be one of the fields listed above, or the special value \fBall\fR, to
+display all fields. The fields applicable to the \fB-o\fR option are limited to
+those listed under each output mode. For example, if using \fB-L\fR, only the
+fields listed under \fB-L\fR, above, can be used with \fB-o\fR.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-p\fR, \fB--parsable\fR\fR
+.ad
+.sp .6
+.RS 4n
+Display using a stable machine-parsable format. The \fB-o\fR option is
+required with \fB-p\fR. See "Parsable Output Format", below.
+.RE
+
+.sp
+.ne 2
+.na
+\fB-t\fR, \fB--target\fR
+.ad
+.sp .6
+.RS 4n
+Displays information about an overlay device's target table. For more
+information on the target table, see \fBoverlay\fR(5).
+.RE
+
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBdladm show-usage\fR [\fB-a\fR] \fB-f\fR \fIfilename\fR [\fB-p\fR
 \fIplotfile\fR \fB-F\fR \fIformat\fR] [\fB-s\fR \fItime\fR] [\fB-e\fR
 \fItime\fR] [\fIlink\fR]\fR
@@ -4459,6 +4893,43 @@ The following general link properties are supported:
 .sp
 .ne 2
 .na
+\fB\fBallow-all-dhcp-cids\fR\fR
+.ad
+.sp .6
+.RS 4n
+One of \fBtrue\fR or \fBfalse\fR, to indicate whether or not all DHCP Client
+Identifiers should be permitted on this interface when DHCP spoofing protection
+is being used. This can be useful in cases where a DHCP client is using RFC
+4361-style Client Identifiers, which are based on a value that is opaque to the
+Global Zone, but enforcement of MAC addresses in DHCP packets is still desired.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBallowed-dhcp-cids\fR\fR
+.ad
+.sp .6
+.RS 4n
+A comma-separated list of DHCP Client Identifiers that are allowed on the
+interface.
+.sp
+Client identifiers can be written in three different formats: a string of
+hexadecimal characters prefixed by \fB0x\fR, indicating the exact bytes used in
+the Client Identifier; an RFC 3315 DUID of the form
+"1.<hardware\ type>.<time>.<link-layer\ address>" (DUID-LLT),
+"2.<enterprise\ number>.<hex\ string>" (DUID-EN), or
+"3.<hardware\ type>.<link-layer\ address>" (DUID-LL); or a string of characters
+whose byte values should be used as the Client Identifier.
+.sp
+When specifying a string of hexadecimal characters prefixed by \fB0x\fR or as
+part of a DUID-EN string, an even number of hexadecimal characters must be
+provided in order to fully specify each byte.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBallowed-ips\fR\fR
 .ad
 .sp .6
@@ -4520,6 +4991,24 @@ is not bound to any specific processor or processor set.
 .sp
 .ne 2
 .na
+\fB\fBdynamic-methods\fR\fR
+.ad
+.sp .6
+.RS 4n
+When using IP spoofing protection (see \fBprotection\fR), addresses can be
+learned dynamically by monitoring certain network traffic, like DHCP
+transactions or IPv6 Stateless Address Autoconfiguration (SLAAC). By default,
+all learning methods are permitted, but if \fBallowed-ips\fR contains any
+addresses, then all methods are disabled, and any packets sent from addresses
+previously learned will be dropped. This property allows selecting which ones
+are re-enabled, where valid options are \fBdhcpv4\fR, \fBdhcpv6\fR, and
+\fBslaac\fR. \fBaddrconf\fR is available as an alias for enabling both
+\fBdhcpv6\fR and \fBslaac\fR.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBlearn_limit\fR\fR
 .ad
 .sp .6
@@ -4572,6 +5061,67 @@ tokens \fBhigh\fR, \fBmedium\fR, or \fBlow\fR. The default is \fBhigh\fR.
 .sp
 .ne 2
 .na
+\fB\fBprotection\fR\fR
+.ad
+.sp .6
+.RS 4n
+This property enables various forms of link protections, which prevent sending
+applicable traffic out of this link. Note that since this enforcement happens
+late in the networking stack, some observability tools like \fBsnoop\fR(1M) may
+still see dropped outbound packets.
+
+This property should be set to a comma-separated list of protections to enable
+on this link, where available protections are:
+.sp
+.ne 2
+.na
+\fBip-nospoof\fR
+.ad
+.sp .6
+.RS 4n
+Prevents sending from IPv4 and IPv6 addresses that have not been permitted
+over the NIC. Addresses can be learned dynamically (see \fBdynamic-methods\fR)
+or specified explicitly (see \fBallowed-ips\fR).
+.RE
+.sp
+.ne 2
+.na
+\fBdhcp-nospoof\fR
+.ad
+.sp .6
+.RS 4n
+Prevents sending DHCP packets whose client hardware address
+(CHADDR) field differs from the link-layer address, or from using a Client
+Identifier whose value cannot be confirmed to be derived from the link-layer
+address. Additional Client Identifiers can be permitted through the
+\fBallowed-dhcp-cids\fR and \fBallow-all-dhcp-cids\fR link properties.
+.RE
+.sp
+.ne 2
+.na
+\fBmac-nospoof\fR
+.ad
+.sp .6
+.RS 4n
+Prevents sending packets with a link-layer address that differs from the one
+associated with the NIC. Additional addresses to allow can be added using the
+\fBseconday-macs\fR property.
+.RE
+.sp
+.ne 2
+.na
+\fBrestricted\fR
+.ad
+.sp .6
+.RS 4n
+Prevents using a VLAN ID not associated with the NIC and sending packets that
+are not IPv4, IPv6 or ARP.
+.RE
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBstp\fR\fR
 .ad
 .sp .6
@@ -5530,7 +6080,17 @@ Interface Stability	Committed
 .LP
 \fBacctadm\fR(1M), \fBautopush\fR(1M), \fBifconfig\fR(1M), \fBipsecconf\fR(1M),
 \fBndd\fR(1M), \fBpsrset\fR(1M), \fBwpad\fR(1M), \fBzonecfg\fR(1M),
-\fBattributes\fR(5), \fBieee802.3\fR(5), \fBdlpi\fR(7P)
+\fBattributes\fR(5), \fBieee802.3\fR(5), \fBoverlay\fR(5), \fBdlpi\fR(7P)
+.sp
+.LP
+R. Droms, Ed., J. Bound, B. Volz, T. Lemon, C. Perkins, M. Carney. \fIRFC 3315:
+Dynamic Host Configuration Protocol for IPv6 (DHCPv6)\fR. The Internet Society.
+July 2003.
+.sp
+.LP
+T. Lemon, B. Sommerfeld. February 2006. \fIRFC 4361: Node-specific Client
+Identifiers for Dynamic Host Configuration Protocol Version Four (DHCPv4)\fR.
+The Internet Society. January 2006.
 .SH NOTES
 .LP
 The preferred method of referring to an aggregation in the aggregation
diff --git a/usr/src/man/man1m/flowadm.1m b/usr/src/man/man1m/flowadm.1m
index 5eca181426..860d5f1faa 100644
--- a/usr/src/man/man1m/flowadm.1m
+++ b/usr/src/man/man1m/flowadm.1m
@@ -1,5 +1,6 @@
 '\" te
 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
+.\" Copyright (c) 2011, Joyent, Inc. All Rights Reserved
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
@@ -11,14 +12,14 @@ services, containers, and virtual machines
 .LP
 .nf
 \fBflowadm show-flow\fR [\fB-pP\fR] [\fB-S\fR] [\fB-s\fR [\fB-i\fR \fIinterval\fR]] [\fB-l\fR \fIlink\fR]
-     [\fB-o\fR \fIfield\fR[,...]] [\fIflow\fR]
+     [\fB-o\fR \fIfield\fR[,...]] [\fB-z\fR \fIzonename\fR] [\fIflow\fR]
 .fi
 
 .LP
 .nf
-\fBflowadm add-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] \fB-l\fR \fIlink\fR \fB-a\fR \fIattr\fR=\fIvalue\fR[,...]
-     \fB-p\fR \fIprop\fR=\fIvalue\fR[,...] \fIflow\fR
-\fBflowadm remove-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] {\fB-l\fR \fIlink\fR | \fIflow\fR}
+\fBflowadm add-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fB-l\fR \fIlink\fR
+     \fB-a\fR \fIattr\fR=\fIvalue\fR[,...] \fB-p\fR \fIprop\fR=\fIvalue\fR[,...] \fIflow\fR
+\fBflowadm remove-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] {\fB-l\fR \fIlink\fR | \fIflow\fR}
 .fi
 
 .LP
@@ -75,8 +76,7 @@ The following subcommands are supported:
 .sp
 .ne 2
 .na
-\fB\fBflowadm show-flow\fR [\fB-pP\fR] [\fB-s\fR [\fB-i\fR \fIinterval\fR]]
-[\fB-o\fR \fIfield\fR[,...]] [\fB-l\fR \fIlink\fR] [\fIflow\fR]\fR
+\fB\fBflowadm show-flow\fR [\fB-pP\fR] [\fB-s\fR [\fB-i\fR \fIinterval\fR]] [\fB-o\fR \fIfield\fR[,...]] [\fB-l\fR \fIlink\fR] [\fB-z\fR \fIzonename\fR] [\fIflow\fR]\fR
 .ad
 .sp .6
 .RS 4n
@@ -221,14 +221,22 @@ Display information for all flows on the named link or information for the
 named flow.
 .RE
 
+.sp
+.ne 2
+.na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
 .RE
 
 .sp
 .ne 2
 .na
-\fB\fBflowadm add-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] \fB-l\fR
-\fIlink\fR \fB-a\fR \fIattr\fR=\fIvalue\fR[,...] \fB-p\fR
-\fIprop\fR=\fIvalue\fR[,...] \fIflow\fR\fR
+\fB\fBflowadm add-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fB-l\fR \fIlink\fR \fB-a\fR \fIattr\fR=\fIvalue\fR[,...] \fB-p\fR \fIprop\fR=\fIvalue\fR[,...] \fIflow\fR\fR
 .ad
 .sp .6
 .RS 4n
@@ -266,6 +274,16 @@ persistent creation.
 .sp
 .ne 2
 .na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fB-l\fR \fIlink\fR, \fB--link\fR=\fIlink\fR\fR
 .ad
 .sp .6
@@ -298,8 +316,7 @@ A comma-separated list of properties to be set to the specified values.
 .sp
 .ne 2
 .na
-\fB\fBflowadm remove-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] \fB-l\fR
-{\fIlink\fR | \fIflow\fR}\fR
+\fB\fBflowadm remove-flow\fR [\fB-t\fR] [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzonename\fR] \fB-l\fR {\fIlink\fR | \fIflow\fR}\fR
 .ad
 .sp .6
 .RS 4n
@@ -329,6 +346,16 @@ persistent removal.
 .sp
 .ne 2
 .na
+\fB\fB-z\fR \fIzonename\fR
+.ad
+.sp .6
+.RS 4n
+Operate on a link that has been delegated to the specified zone.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fB-l\fR \fIlink\fR | \fIflow\fR, \fB--link\fR=\fIlink\fR | \fIflow\fR\fR
 .ad
 .sp .6
diff --git a/usr/src/man/man1m/pptadm.1m b/usr/src/man/man1m/pptadm.1m
new file mode 100644
index 0000000000..f13a5e32a4
--- /dev/null
+++ b/usr/src/man/man1m/pptadm.1m
@@ -0,0 +1,74 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\" Copyright 2018 Joyent, Inc.
+.\"
+.Dd April 10, 2018
+.Dt PPTADM 1M
+.Os
+.Sh NAME
+.Nm pptadm
+.Nd PPT administration utility
+.Sh SYNOPSIS
+.Nm
+.Cm list -j
+.Op Fl a
+.Nm
+.Cm list
+.Op Fl ap Op Fl o Ar fields
+.Sh DESCRIPTION
+The
+.Nm
+utility can enumerate passthrough devices for use by a virtualized guest.
+.Sh OPTIONS
+The following options to the
+.Cm list
+command are supported:
+.Bl -tag -width Ds
+.It Fl a
+Show all PPT devices, both available and assigned.
+.It Fl j
+Output JSON.
+.It Fl o
+Specify fields to output, or "all". Available fields are
+dev,path,vendor,device,subvendor,subdevice,rev,label
+.It Fl p
+Output in a parsable format; this requires the -o option to be specified.
+.El
+.Sh JSON OUTPUT
+The JSON output consists of an array under the key "devices" with the fields:
+.Bl -tag -width Ds
+.It dev
+The PPT /dev path, if assigned and bound.
+.It path
+The physical /devices path.
+.It vendor-id
+The PCI vendor ID.
+.It device-id
+The PCI device ID.
+.It subsystem-vendor-id
+The PCI subsystem vendor ID.
+.It subsystem-id
+The PCI subsystem ID.
+.It revision-id
+The PCI device revision.
+.It label
+Human-readable description from the PCI database.
+.El
+.Sh FILES
+.Bl -tag -width Ds
+.It /etc/ppt_aliases
+Containts the bindings of PPT devices in the same format as /etc/driver_aliases
+.It /etc/ppt_matches
+Identifies devices that PPT could be bound to, either by physical path, or by
+PCI ID.
+.El
+.Sh EXIT STATUS
+.Ex -std
diff --git a/usr/src/man/man1m/prstat.1m b/usr/src/man/man1m/prstat.1m
index a5f02621cf..35cb6fbf24 100644
--- a/usr/src/man/man1m/prstat.1m
+++ b/usr/src/man/man1m/prstat.1m
@@ -1,10 +1,11 @@
 '\" te
 .\" Copyright (c) 2013 Gary Mills
 .\" Copyright (c) 2006, 2009 Sun Microsystems, Inc. All Rights Reserved.
+.\" Copyright (c) 2017, Joyent, Inc. All Rights Reserved.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
 .\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with
 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH PRSTAT 1M "Nov 14, 2014"
+.TH PRSTAT 1M "Oct 13, 2017"
 .SH NAME
 prstat \- report active process statistics
 .SH SYNOPSIS
@@ -13,7 +14,7 @@ prstat \- report active process statistics
 \fBprstat\fR [\fB-acHJLmRrtTvWZ\fR] [\fB-d\fR u | d] [\fB-C\fR \fIpsrsetlist\fR] [\fB-h\fR \fIlgrplist\fR]
      [\fB-j\fR \fIprojlist\fR] [\fB-k\fR \fItasklist\fR] [\fB-n\fR \fIntop\fR[,\fInbottom\fR]]
      [\fB-p\fR \fIpidlist\fR] [\fB-P\fR \fIcpulist\fR] [\fB-s\fR \fIkey\fR | \fB-S\fR \fIkey\fR ]
-     [\fB-u\fR \fIeuidlist\fR] [\fB-U\fR \fIuidlist\fR] [\fB-z\fR \fIzoneidlist\fR]
+     [\fB-u\fR \fIeuidlist\fR] [\fB-U\fR \fIuidlist\fR] [\fB-z\fR \fIzoneidlist\fR] [\fB-Z\fR]
      [\fIinterval\fR [\fIcount\fR]]
 .fi
 
@@ -447,9 +448,11 @@ devices, in kilobytes (\fBK\fR), megabytes (\fBM\fR), or gigabytes (\fBG\fR).
 .RS 4n
 The resident set size of the process (\fBRSS\fR), in kilobytes (\fBK\fR),
 megabytes (\fBM\fR), or gigabytes (\fBG\fR). The RSS value is an estimate
-provided by \fBproc\fR(4) that might underestimate the actual resident set
-size. Users who want to get more accurate usage information for capacity
-planning should use the \fB-x\fR option to \fBpmap\fR(1) instead.
+provided by \fBproc\fR(4) that might underestimate the actual
+per-process resident set size, but is generally accurate for the aggregated
+resident set size. Users who want to get more accurate usage information for
+capacity planning should use the \fB-x\fR option to \fBpmap\fR(1) for
+per-process results instead.
 .RE
 
 .sp
diff --git a/usr/src/man/man1m/reboot.1m b/usr/src/man/man1m/reboot.1m
index 87f4bd892b..a4bdebd496 100644
--- a/usr/src/man/man1m/reboot.1m
+++ b/usr/src/man/man1m/reboot.1m
@@ -142,8 +142,7 @@ This option is currently available only on x86 systems. The \fB-p\fR and
 .ad
 .sp .6
 .RS 4n
-Quick. Reboot quickly and ungracefully, without shutting down running processes
-first.
+Quick. Reboot quickly without halting running zones first.
 .RE
 
 .SH OPERANDS
diff --git a/usr/src/man/man1m/route.1m b/usr/src/man/man1m/route.1m
index 6cd5a20cd1..2f2bff558a 100644
--- a/usr/src/man/man1m/route.1m
+++ b/usr/src/man/man1m/route.1m
@@ -3,40 +3,40 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH ROUTE 1M "May 13, 2017"
+.TH ROUTE 1M "Mar 26, 2018"
 .SH NAME
 route \- manually manipulate the routing tables
 .SH SYNOPSIS
 .LP
 .nf
-\fBroute\fR [\fB-fnvq\fR] \fIsub-command\fR [ [\fImodifiers\fR] \fIargs\fR]
+\fBroute\fR [\fB-fnvq\fR] [\fB-z\fR \fIzone\fR] \fIsub-command\fR [ [\fImodifiers\fR] \fIargs\fR]
 .fi
 
 .LP
 .nf
-\fBroute\fR [\fB-fnvq\fR] [\fB-p\fR [\fB-R\fR \fIroot-dir\fR]] add | delete [\fImodifiers\fR] \fIdestination\fR \fIgateway\fR
+\fBroute\fR [\fB-fnvq\fR] [\fB-z\fR \fIzone\fR] [\fB-p\fR [\fB-R\fR \fIroot-dir\fR]] add | delete [\fImodifiers\fR] \fIdestination\fR \fIgateway\fR
      [\fIargs\fR]
 .fi
 
 .LP
 .nf
-\fBroute\fR [\fB-fnvq\fR] change | get [\fImodifiers\fR] \fIdestination\fR
+\fBroute\fR [\fB-fnvq\fR] [\fB-z\fR \fIzone\fR] change | get [\fImodifiers\fR] \fIdestination\fR
      [\fIgateway\fR [\fIargs\fR]]
 .fi
 
 .LP
 .nf
-\fBroute\fR [\fB-fn\fR] monitor [\fImodifiers\fR]
+\fBroute\fR [\fB-fn\fR] [\fB-z\fR \fIzone\fR] monitor [\fImodifiers\fR]
 .fi
 
 .LP
 .nf
-\fBroute\fR [\fB-fnvq\fR] flush [\fImodifiers\fR]
+\fBroute\fR [\fB-fnvq\fR] [\fB-z\fR \fIzone\fR] flush [\fImodifiers\fR]
 .fi
 
 .LP
 .nf
-\fBroute\fR \fB-p\fR [\fB-R\fR \fIroot-dir\fR] show
+\fBroute\fR \fB-p\fR [\fB-R\fR \fIroot-dir\fR] [\fB-z\fR \fIzone\fR] show
 .fi
 
 .SH DESCRIPTION
@@ -126,6 +126,16 @@ addition, certain checks, such as the existence of network interfaces used with
 Print additional details in verbose mode.
 .RE
 
+.sp
+.ne 2
+.na
+\fB\fB-z\fR \fIzone\fR\fR
+.ad
+.RS 15n
+Apply commands to the zone \fIzone\fR.  The zone must be running and must not
+be a shared-\fBIP\fR zone.
+.RE
+
 .SS "Subcommands"
 .LP
 The following subcommands are supported:
@@ -752,7 +762,7 @@ process does not have appropriate privileges.
 
 .SH NOTES
 .LP
-Specifying that destinations are local (with the \fB-interface\fRmodifier)
+Specifying that destinations are local (with the \fB-interface\fR modifier)
 assumes that the routers implement \fBproxy ARP\fR, meaning that they respond
 to ARP queries for all reachable destinations. Normally, using either router
 discovery or RIP is more reliable and scalable than using proxy ARP. See
diff --git a/usr/src/man/man1m/smbios.1m b/usr/src/man/man1m/smbios.1m
index 8c71627966..813c317a43 100644
--- a/usr/src/man/man1m/smbios.1m
+++ b/usr/src/man/man1m/smbios.1m
@@ -1,9 +1,10 @@
 '\" te
 .\" Copyright (c) 2005, Sun Microsystems, Inc. All Rights Reserved.
+.\" Copyright 2018 Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH SMBIOS 1M "Aug 31, 2005"
+.TH SMBIOS 1M "March 29, 2018"
 .SH NAME
 smbios \- display the contents of a System Management BIOS image
 .SH SYNOPSIS
@@ -13,7 +14,6 @@ smbios \- display the contents of a System Management BIOS image
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBsmbios\fR utility displays the contents of the System Management BIOS
 (SMBIOS) image exported by the current system or stored in a file. SMBIOS is an
@@ -37,7 +37,6 @@ applied to the resulting file to display its content.
 readable fashion. If \fBsmbios\fR does not recognize a structure's type or
 content, the raw hexadecimal data for the structure is displayed.
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
@@ -131,7 +130,6 @@ human-readable output for the selected structures.
 .RE
 
 .SH OPERANDS
-.sp
 .LP
 The following operands are supported:
 .sp
@@ -145,7 +143,6 @@ SMBIOS image.
 .RE
 
 .SH EXIT STATUS
-.sp
 .LP
 The following exit values are returned:
 .sp
@@ -178,7 +175,6 @@ Invalid command-line options were specified.
 .RE
 
 .SH FILES
-.sp
 .ne 2
 .na
 \fB\fB/dev/smbios\fR \fR
@@ -189,7 +185,6 @@ snapshot of the current system SMBIOS image.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -208,14 +203,12 @@ Interface Stability	See below.
 .LP
 The command-line options are Evolving. The human-readable output is Unstable.
 .SH SEE ALSO
-.sp
 .LP
 \fBprtdiag\fR(1M), \fBattributes\fR(5), \fBsmbios\fR(7D)
 .sp
 .LP
 \fISystem Management BIOS Reference Specification\fR (see http://www.dmtf.org)
 .SH NOTES
-.sp
 .LP
 The implementation of a System Management BIOS image is entirely at the
 discretion of the system and BIOS vendors. Not all systems export an SMBIOS.
@@ -223,3 +216,8 @@ The SMBIOS structure content varies widely between systems and BIOS vendors and
 frequently does not comply with the guidelines included in the specification.
 Some structure fields might not be filled in by the BIOS at all, and others
 might be filled inwith non-conforming values.
+.sp
+.LP
+This utility incorrectly interprets the first three fields of the system
+information UUID field as network-endian; the SMBIOS specification defines them
+as little-endian. The "UUID (Endian-corrected)" field has the correct value.
diff --git a/usr/src/man/man1m/snoop.1m b/usr/src/man/man1m/snoop.1m
index c599a52271..f85f71089e 100644
--- a/usr/src/man/man1m/snoop.1m
+++ b/usr/src/man/man1m/snoop.1m
@@ -1,5 +1,6 @@
 '\" te
 .\" Copyright (C) 2009, Sun Microsystems, Inc. All Rights Reserved
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
@@ -12,7 +13,7 @@ snoop \- capture and inspect network packets
 \fBsnoop\fR  [\fB-aqrCDINPSvV\fR] [\fB-t\fR [r |  a |  d]] [\fB-c\fR \fImaxcount\fR]
  [\fB-d\fR \fIdevice\fR] [\fB-i\fR \fIfilename\fR] [\fB-n\fR \fIfilename\fR] [\fB-o\fR \fIfilename\fR]
  [\fB-p\fR \fIfirst\fR [, \fIlast\fR]] [\fB-s\fR \fIsnaplen\fR] [\fB-x\fR \fIoffset\fR [, \fIlength\fR]]
- [\fIexpression\fR]
+ [\fB-z\fR \fIzonename\fR] [\fIexpression\fR]
 .fi
 
 .SH DESCRIPTION
@@ -296,6 +297,22 @@ the whole packet, use an \fIoffset\fR of 0. If a \fIlength\fR value is not
 provided, the rest of the packet is displayed.
 .RE
 
+.sp
+.ne 2
+.na
+.BI -z zonename
+.ad
+.sp .6
+.RS 4n
+Open an earlier datalink specified via
+.B -d
+or
+.B -I
+in the specified zone \fIzonename\fR.
+This option is only meaningful in the global zone and
+allows the global zone to inspect datalinks of non-global zones.
+.RE
+
 .SH OPERANDS
 .ne 2
 .na
diff --git a/usr/src/man/man1m/svc.startd.1m b/usr/src/man/man1m/svc.startd.1m
index 7c80c35e23..103c6b5fec 100644
--- a/usr/src/man/man1m/svc.startd.1m
+++ b/usr/src/man/man1m/svc.startd.1m
@@ -4,7 +4,7 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH SVC.STARTD 1M "Mar 18, 2011"
+.TH SVC.STARTD 1M "Aug 23, 2012"
 .SH NAME
 svc.startd \- Service Management Facility master restarter
 .SH SYNOPSIS
@@ -372,10 +372,13 @@ properties listed below in the \fBstartd\fR property group.
 .RS 4n
 The \fBcritical_failure_count\fR and \fBcritical_failure_period\fR properties
 together specify the maximum number of service failures allowed in a given
-time interval before \fBsvc.startd\fR transitions the service to maintenance.
+number of seconds before \fBsvc.startd\fR transitions the service to
+maintenance.
 If the number of failures exceeds \fBcritical_failure_count\fR in any period of
 \fBcritical_failure_period\fR seconds, \fBsvc.startd\fR will transition the
-service to maintenance.
+service to maintenance. The \fBcritical_failure_count\fR value is limited
+to the range 1-10 and defaults to 10.  The \fBcritical_failure_period\fR
+defaults to 600 seconds.
 .RE
 
 .sp
diff --git a/usr/src/man/man1m/tunefs.1m b/usr/src/man/man1m/tunefs.1m
index 7f522f43fa..0b849f2dd7 100644
--- a/usr/src/man/man1m/tunefs.1m
+++ b/usr/src/man/man1m/tunefs.1m
@@ -3,7 +3,7 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH TUNEFS 1M "Dec 5, 2003"
+.TH TUNEFS 1M "Sep 19, 2013"
 .SH NAME
 tunefs \- tune an existing UFS file system
 .SH SYNOPSIS
@@ -120,3 +120,9 @@ encountering files greater than or equal to 2 Gbyte ( 2^31 bytes).
 .sp
 .LP
 \fBmkfs_ufs\fR(1M), \fBnewfs\fR(1M), \fBattributes\fR(5), \fBlargefile\fR(5)
+
+.\" Take this out and a Unix Demon will dog your steps from now until
+.\" the time_t's wrap around.
+.SH BUGS
+.sp
+You can tune a file system, but you can't tune a fish.
diff --git a/usr/src/man/man1m/vfsstat.1m b/usr/src/man/man1m/vfsstat.1m
new file mode 100644
index 0000000000..aef8431a09
--- /dev/null
+++ b/usr/src/man/man1m/vfsstat.1m
@@ -0,0 +1,213 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\" 
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\" Copyright 2014 Joyent, Inc. All rights reserved.
+.\"
+.TH "VFSSTAT" "1m" "May 1, 2014" "" ""
+.
+.SH "NAME"
+\fBvfsstat\fR \-\- Report VFS read and write activity
+.
+.SH "SYNOPSIS"
+.
+.nf
+vfsstat [\-hIMrzZ] [interval [count]]
+.
+.fi
+.
+.SH "DESCRIPTION"
+The vfsstat utility reports a summary of VFS read and write
+activity per zone\.  It first prints all activity since boot, then
+reports activity over a specified interval\.
+.
+.P
+When run from a non\-global zone (NGZ), only activity from that NGZ
+can be observed\.  When run from a the global zone (GZ), activity
+from the GZ and all other NGZs can be observed\.
+.
+.P
+This tool is convenient for examining I/O performance as
+experienced by a particular zone or application\.  Other tools
+which examine solely disk I/O do not report reads and writes which
+may use the filesystem\'s cache\.  Since all read and write system
+calls pass through the VFS layer, even those which are satisfied
+by the filesystem cache, this tool is a useful starting point when
+looking at a potential I/O performance problem\.  The vfsstat
+command reports the most accurate reading of I/O performance as
+experienced by an application or zone\.
+.
+.P
+One additional feature is that ZFS zvol performance is also reported
+by this tool, even though zvol I/O does not go through the VFS
+layer\. This is done so that this single tool can be used to monitor
+I/O performance and because its not unreasonable to think of zvols
+as being included along with other ZFS filesystems\.
+.
+.P
+The calculations and output fields emulate those from iostat(1m)
+as closely as possible\.  When only one zone is actively performing
+disk I/O, the results from iostat(1m) in the global zone and
+vfsstat in the local zone should be almost identical\.  Note that
+many VFS read operations may be handled by the filesystem cache,
+so vfsstat and iostat(1m) will be similar only when most
+operations require a disk access\.
+.
+.P
+As with iostat(1m), a result of 100% for VFS read and write
+utilization does not mean that the VFS layer is fully saturated\.
+Instead, that measurement just shows that at least one operation
+was pending over the last interval of time examined\.  Since the
+VFS layer can process more than one operation concurrently, this
+measurement will frequently be 100% but the VFS layer can still
+accept additional requests\.
+.
+.SH "OUTPUT"
+The vfsstat utility reports the following information:
+.
+.IP "" 4
+.
+.nf
+r/s
+.RS
+reads per second
+.RE
+
+w/s
+.RS
+writes per second
+.RE
+
+kr/s
+.RS
+kilobytes read per second
+.RE
+
+kw/s
+.RS
+kilobytes written per second
+.RE
+
+ractv
+.RS
+average number of read operations actively being serviced by the VFS layer
+.RE
+
+wactv
+.RS
+average number of write operations actively being serviced by the VFS layer
+.RE
+
+read_t
+.RS
+average VFS read latency, in microseconds
+.RE
+
+writ_t
+.RS
+average VFS write latency, in microseconds
+.RE
+
+%r
+.RS
+percent of time there is a VFS read operation pending
+.RE
+
+%w
+.RS
+percent of time there is a VFS write operation pending
+.RE
+
+d/s
+.RS
+VFS operations per second delayed by the ZFS I/O throttle
+.RE
+
+del_t
+.RS
+average ZFS I/O throttle delay, in microseconds
+.RE
+.
+.fi
+.
+.IP "" 0
+.
+.SH "OPTIONS"
+The following options are supported:
+.
+.P
+\-h
+.RS
+Show help message and exit
+.RE
+.
+.P
+\-I
+.RS
+Print results per interval, rather than per second (where applicable)
+.RE
+.
+.P
+\-M
+.RS
+Print results in MB/s instead of KB/s
+.RE
+.
+.P
+\-r
+.RS
+Show results in a comma\-separated format
+.RE
+.
+.P
+\-z
+.RS
+Hide zones with no VFS activity
+.RE
+.
+.P
+\-Z
+.RS
+Print results for all zones, not just the current zone
+.RE
+.
+.SH "OPERANDS"
+interval
+.
+.P
+Specifies the length in seconds to pause between each interval
+report\.  If not specified, vfsstat will print a summary since boot
+and exit\.
+.
+.P
+count
+.
+.P
+Specifies the number of intervals to report\.  Defaults to
+unlimited if not specified\.
+.
+.SH "SEE ALSO"
+.
+.nf
+iostat(1m), ziostat(1m), mpstat(1m)
+.
+.fi
+.
+.SH "NOTES"
+This command does not examine readdir or any other VFS operations,
+only read and write operations\.
+.
+.P
+This command does not look at network I/O, only I/O operations to
+or from a file\.
+.
+.P
+The output format from vfsstat may change over time; use the
+comma\-separated output for a stable output format\.
diff --git a/usr/src/man/man1m/vndadm.1m b/usr/src/man/man1m/vndadm.1m
new file mode 100644
index 0000000000..253518a88a
--- /dev/null
+++ b/usr/src/man/man1m/vndadm.1m
@@ -0,0 +1,651 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VNDADM 1M "Mar 06, 2014"
+.SH NAME
+vndadm \- administer vnd devices
+
+.SH SYNOPSIS
+
+.nf
+vndadm create [-z zonename] [-l datalink] device
+vndadm destroy [-z zonename] device...
+vndadm list [-p] [-d delim] [-o field,...] [-z zonename] [device]...
+vndadm get [-p] [-d delim] [-z zonename] device [prop]...
+vndadm set [-z zonename] device prop=val...
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+The vndadm command is used to administer vnd devices. A vnd device is
+similar to an IP network interface, except that the vnd device operates
+at layer two. A vnd device is created over a data link (see dladm(1M))
+and its address is that of the underlying data link. For ethernet based
+devices, that address would be the MAC address of the data link. vnd
+devices are character devices which may be used to send and receive
+layer two packets. When reading or writing to a vnd device, the full
+frame must be present. This is useful for working with virtual machines,
+or other environments where you need to manipulate the entire layer two
+frame.
+
+.sp
+.LP
+Every command takes a device as an argument. To specify a vnd device,
+you just use the name of the device. Devices are scoped to zones. If no
+zone is specified, the current zone is assumed. A device name can be any
+series of alphanumeric ascii characters which typically match the name
+of the underlying data link. A given vnd device name must be unique in a
+given zone, but the same name can be used across zones.
+.sp
+.SH OPTIONS
+.sp
+.LP
+All vndadm subcommands have the following common option:
+.sp
+.ne 2
+.na
+-z zonename
+.ad
+.sp .6
+.RS 4n
+Operate in the context of the specified zone. When creating a vnd
+device, the named device is created in the specified zone. All other
+operations scope the device lookup to the specified zone. If the user is
+not in the global zone, the use of -z will not work.
+
+.sp
+.LP
+When -z is used and multiple devices are specified, then
+the use of -z applies to all of the devices.
+.RE
+
+.SH SUBCOMMANDS
+.sp
+.ne 2
+.na
+vndadm create [-z zonename] [-l datalink] device
+.ad
+.sp
+.RS 4n
+Creates a vnd device with the specified name device. If -l datalink is
+not specified, it is assumed that the data link and the device share the
+same name. The created device will exist for as long as the zone exists
+or until a call to vndadm destroy. vnd devices do not persist across
+system reboots. Note, if an IP interface or another libdlpi(3LIB)
+consumer is already using the data link, then vnd will fail.
+
+.sp
+The maximum length of the name of device is 31 characters. The allowed
+set of characters is alphanumberic characters, ':', \'-', and \'_'. The
+names 'zone' and 'ctl' are reserved and may not be used.
+
+.sp
+.ne 2
+.na
+-l datalink
+.ad
+.sp .6
+.RS 4n
+Specifies the name of the data link to create the device over. This
+allows the vnd device name to be different from the data link's name.
+.RE
+.sp
+.ne 2
+.na
+-z zonename
+.ad
+.sp .6
+.RS 4n
+See OPTIONS above.
+.RE
+
+.RE
+
+.sp
+.ne 2
+.na
+vndadm destroy [-z zonename] device...
+.ad
+.sp
+.RS 4n
+Destroys the specified device. The destruction is analogous to
+unlink(2). If the device is still open and used by applications, the
+device will continue to exist, but it will no longer be accessible by
+the name device.
+.sp
+.ne 2
+.na
+-z zonename
+.ad
+.sp .6
+.RS 4n
+See OPTIONS above.
+.RE
+.RE
+
+.sp
+.ne 2
+.na
+vndadm list [-p] [-d delim] [-o field,...] [-z zonename] [device]...
+.ad
+.sp
+.RS 4n
+Lists active vnd devices. By default, vnadm list lists all devices in
+every zone that the caller is allowed to see; the current zone if in the
+non-global zone, and all zones in the global zone. If device is
+specified one or more times, then output will be limited to the
+specified devices.
+.sp
+.ne 2
+.na
+-o field[,...]
+.ad
+.sp .6
+.RS 4n
+A case-insensitive, comma-separated list of output fields. When -o is
+not used, all of the fields listed below are shown. The field name must
+be one of the following fields:
+
+.sp
+.ne 2
+.na
+NAME
+.ad
+.sp .6
+.RS 4n
+The name of the vnd device.
+.RE
+
+.sp
+.ne 2
+.na
+DATALINK
+.ad
+.sp .6
+.RS 4n
+The name of the data link the vnd device was created over.
+.RE
+
+.sp
+.ne 2
+.na
+ZONENAME
+.ad
+.sp .6
+.RS 4n
+The name of the zone that the vnd device exists in.
+.RE
+.RE
+
+.sp
+.ne 2
+.na
+-p
+.ad
+.sp .6
+.RS 4n
+Display the output in a stable machine parseable format. The -o option
+is required with the -p option. See "Parseable Output Format" below.
+.RE
+
+.sp
+.ne 2
+.na
+-d delim
+.ad
+.sp .6
+.RS 4n
+Change the delimiter used in conjunction with generating parseable
+output. This option may only be specified when -p is also specified.
+.RE
+
+.sp
+.ne 2
+.na
+-z zonename
+.ad
+.sp .6
+.RS 4n
+See OPTIONS above.
+.RE
+
+.RE
+
+
+.sp
+.ne 2
+.na
+vndadm get [-p] [-d delim] [-z zonename] device [prop]...
+.ad
+.sp
+.RS 4n
+Displays the properties for the specified device. By default, all
+properties of a given device are displayed. If prop is specified one or
+more times, then only the specified properties will be displayed for
+device. For a list of properties, see the section "Properties" below.
+The property output consists of the following four columns:
+.sp
+.ne 2
+.na
+LINK
+.ad
+.sp .6
+.RS 4n
+The name of the device
+.RE
+
+.sp
+.ne 2
+.na
+PROPERTY
+.ad
+.sp .6
+.RS 4n
+The name of the property. Note that some properties that are private to
+the implementation may be displayed. Those properties begin with a
+leading underscore.
+.RE
+
+.sp
+.ne 2
+.na
+PERM
+.ad
+.sp .6
+.RS 4n
+Describes whether the property is read-only or
+if it is read-write. This field does not
+indicate if the current user has permission, but
+lists permissions for a privileged user.
+.RE
+
+.sp
+.ne 2
+.na
+VALUE
+.ad
+.sp .6
+.RS 4n
+The value of the property.
+.RE
+
+.sp
+.ne 2
+.na
+-p
+.ad
+.sp .6
+.RS 4n
+Display the output in a stable machine parseable format.  See "Parseable
+Output Format" below.
+.RE
+
+.sp
+.ne 2
+.na
+-d delim
+.ad
+.sp .6
+.RS 4n
+Change the delimiter used in conjunction with generating parseable
+output. This option may only be specified when -p is also specified.
+.RE
+
+.sp
+.ne 2
+.na
+-z zonename
+.ad
+.sp .6
+.RS 4n
+See OPTIONS above.
+.RE
+.RE
+
+.sp
+.ne 2
+.na
+vndadm set [-z zonename] device prop=val...
+.ad
+.sp
+.RS 4n
+Sets properties on the named device. Setting a property takes effect for
+all operations on the device, after the program returns. Multiple
+properties can be set at once; however, properties are applied one at a
+time to the device.  Property names and values must be separated with an
+equals sign.  Additional property and value pairs should be separated by
+white space.  For a list of properties, see the section "Properties"
+below.
+
+.sp
+.ne 2
+.na
+-z zonename
+.ad
+.sp .6
+.RS 4n
+See OPTIONS above.
+.RE
+.RE
+
+.SS Parseable Output Format
+.sp
+.LP
+The default output for parseable data is to be separated with a single
+ascii space character. The delimiter may be changed with the -d
+option. When parseable output is requested, no numbers that represent
+sizes will be displayed in human readable form, they will be fully
+expanded. eg. the number 42K will instead be 43008.
+
+.SS Properties
+.sp
+.LP
+The following are supported and stable properties. Note that any
+properties that starts with a leading underscore are not a stable
+property and may be removed at any time.
+
+.sp
+.ne 2
+.na
+rxbuf
+.ad
+.sp .6
+.RS 4n
+A read/write property that controls the size of the receive buffer for
+the device. All received data enters the receive buffer until a consumer
+consumes it. If adding a received frame would exceed the size of the
+receive buffer, then that frame will be dropped. The maximum size of the
+buffer is limited by the 'maxsize' property. The minimum size of the
+buffer is the value of the 'maxtu' property. The property's value may be
+anything between that maximum and minimum. When setting this property,
+standard size suffixes such as 'K' and 'M' may be used.
+.RE
+
+.sp
+.ne 2
+.na
+txbuf
+.ad
+.sp .6
+.RS 4n
+A read/write property that controls the size of the transmit buffer. All
+in-flight transmitted data must be able to fit into the transmit buffer
+to account for potential flow control events. If there is not enough
+space in the transmit buffer, transmit related I/O operations will
+either block or fail based on whether the file has been put into
+non-blocking mode by setting O_NONBLOCK or O_NDELAY with fcntl(2). The
+maximum size of the buffer is limited by the 'maxsize' property. The
+minimum size of the buffer is the value of the 'maxtu' property. The
+property's value may be anything between that maximum and minimum. When
+setting this property, standard size suffixes such as 'K' and 'M' may be
+used.
+
+.RE
+
+.sp
+.ne 2
+.na
+maxsize
+.ad
+.sp .6
+.RS 4n
+A read-only property that describes the maximum size of buffers in the
+system. Properties such as rxbuf and txbuf cannot be set beyond this.
+.RE
+
+.sp
+.ne 2
+.na
+mintu
+.ad
+.sp .6
+.RS 4n
+A read-only property that describes the minimum size of a frame
+transmitted to the underlying data link. Note that the minimum listed
+here may be less than the size of a valid layer two frame and therefore
+may be dropped. A frame smaller than this value will be rejected by vnd.
+.RE
+
+.sp
+.ne 2
+.na
+maxtu
+.ad
+.sp .6
+.RS 4n
+A read-only property that describes the maximum size of a frame
+transmitted to the underlying data link. A frame larger than this value
+will be rejected by vnd.
+.RE
+
+.SH EXAMPLES
+.LP
+Example 1 Creating a vnd device
+.sp
+.LP
+To create a vnd device over the VNIC named net0, enter the following
+command:
+
+.sp
+.in +2
+.nf
+# vndadm create net0
+.fi
+.in -2
+.sp
+
+.LP
+Example 2 Creating a vnd device in another zone
+.sp
+.LP
+
+To create a vnd device over the VNIC named net1 in the zone
+1b7155a4-aef9-e7f0-d33c-9705e4b8b525, enter the following command:
+
+.sp
+.in +2
+.nf
+# vndadm create -z 1b7155a4-aef9-e7f0-d33c-9705e4b8b525 net1
+.fi
+.in -2
+.sp
+
+.LP
+Example 3 Destroying a vnd device
+.sp
+.LP
+
+To destroy the vnd device named net0, enter the following command:
+
+.sp
+.in +2
+.nf
+# vndadm destroy net0
+.fi
+.in -2
+.sp
+
+.LP
+Example 4 Destroying a vnd device in another zone
+.sp
+.LP
+
+To destroy the vnd device named net1 in the zone
+1b7155a4-aef9-e7f0-d33c-9705e4b8b525, enter the following command:
+
+.sp
+.in +2
+.nf
+# vndadm destroy -z 1b7155a4-aef9-e7f0-d33c-9705e4b8b525 net1
+.fi
+.in -2
+.sp
+
+.LP
+Example 5 List all vnd devices
+.sp
+.LP
+
+To list all devices, run the following command:
+
+.sp
+.in +2
+.nf
+# vndadm list
+NAME             DATALINK         ZONENAME
+net0             net0             global                           
+net0             net0             1b7155a4-aef9-e7f0-d33c-9705e4b8b525 
+.fi
+.in -2
+.sp
+
+.LP
+Example 6 Listing devices in a specific zone
+.sp
+.LP
+
+To list devices in a specific zone, run the following command:
+
+.sp
+.in +2
+.nf
+# vndadm list -z 1b7155a4-aef9-e7f0-d33c-9705e4b8b525
+
+NAME             DATALINK         ZONENAME
+net0             net0             1b7155a4-aef9-e7f0-d33c-9705e4b8b525 
+.fi
+.in -2
+.sp
+
+.LP
+Example 7 List all devices in a parseable format
+.sp
+.LP
+
+To list all devices in a parseable format with the delimiter of ':', run
+the following command:
+
+.sp
+.in +2
+.nf
+# vndadm list -p -d: -o name,datalink,zone
+net0:net0:global
+net0:net0:1b7155a4-aef9-e7f0-d33c-9705e4b8b525
+.fi
+.in -2
+.sp
+
+.LP
+Example 8 Retrieving all properties for a device
+.sp
+.LP
+
+To retrieve all of the properties for the vnd device foo0, run the
+following command:
+
+.sp
+.in +2
+.nf
+# vndadm get foo0
+LINK          PROPERTY         PERM  VALUE
+foo0          rxbuf            rw    65536
+foo0          txbuf            rw    65536
+foo0          maxsize          r-    4194304
+foo0          mintu            r-    0
+foo0          maxtu            r-    1518
+foo0          _nflush          rw    10
+foo0          _burstsz         rw    10
+.fi
+.in -2
+.sp
+
+.LP
+Example 9 Retrieving specific properties for a device
+.sp
+.LP
+
+To retrieve just the rxbuf and txbuf properties for the vnd device foo0,
+run the following command:
+
+.sp
+.in +2
+.nf
+# vndadm get foo0 rxbuf txbuf
+LINK          PROPERTY         PERM  VALUE
+foo0          rxbuf            rw    65536
+foo0          txbuf            rw    65536
+.fi
+.in -2
+.sp
+
+.LP
+Example 10 Retrieving properties for a device in a parseable format
+.sp
+.LP
+
+To retrieve all properties for the vnd device foo0 in a parseable
+format, run the following command:
+
+.sp
+.in +2
+.nf
+# vndadm get -p foo0
+foo0 rxbuf rw 65536
+foo0 txbuf rw 65536
+foo0 maxsize r- 4194304
+foo0 mintu r- 0
+foo0 maxtu r- 1518
+foo0 _nflush rw 10
+foo0 _burstsz rw 10
+.fi
+.in -2
+.sp
+
+.LP
+Example 11 Setting a property on a device
+.sp
+.LP
+
+To set the receive buffer size to one megabyte on the device foo0, run
+the following command:
+
+.sp
+.in +2
+.nf
+# vndadm set foo0 rxbuf=1M
+.fi
+.in -2
+.sp
+
+.LP
+Example 12 Setting multiple properties on a device
+.sp
+.LP
+
+To set the transmit buffer to 300 Kb and the receive buffer to 1 Mb, run
+the following command:
+
+.sp
+.in +2
+.nf
+# vndadm set foo0 rxbuf=300K txbuf=1M
+.fi
+.in -2
+.sp
+
+.SH SEE ALSO
+
+dladm(1M), ipadm(1M), fcntl(2), fcntl.h(3HEAD), libvnd(3LIB),
+vndstat(1M), vnd(7D)
diff --git a/usr/src/man/man1m/vndstat.1m b/usr/src/man/man1m/vndstat.1m
new file mode 100644
index 0000000000..a7f843e228
--- /dev/null
+++ b/usr/src/man/man1m/vndstat.1m
@@ -0,0 +1,163 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VNDSTAT 1M "Mar 06, 2014"
+.SH NAME
+vndstat \- report vnd activity
+
+.SH SYNOPSIS
+
+vndstat [interval [count]]
+
+.SH DESCRIPTION
+.sp
+.LP
+The vndstat command reports a summary of per-device vnd
+activity. Once per interval it prints a table of statistics per
+device. In the global zone, vndstat reports on all devices in the
+system. From the non-global zone, it only reports on devices that are
+present in that zone. vndstat reports on all vnd devices
+that exist, including anonymous devices which are not linked into the
+file system.
+.sp
+.LP
+The vndstat command's output includes the following information:
+.sp
+.ne 2
+.na
+.B name
+.ad
+.RS 14n
+The name of the device, if bound. If a given vnd device is not
+bound into the file system, hence considered anonymous, then there will
+be no name for the device.
+.RE
+
+.sp
+.ne 2
+.na
+.B rx B/s
+.ad
+.RS 14n
+The number of bytes received by the device during interval.
+.RE
+
+.sp
+.ne 2
+.na
+.B tx B/s
+.ad
+.RS 14n
+The number of bytes transmitted by the device during interval.
+.RE
+
+.sp
+.ne 2
+.na
+.B drops
+.ad
+.RS 14n
+The number of packets and messages which have been dropped. This
+includes all drops due to insufficient buffer space, IP hooks, and
+unknown or malformed DLPI messages.
+.RE
+
+.sp
+.ne 2
+.na
+.B txfc
+.ad
+.RS 14n
+The number of flow control events that have occurred. A flow control
+event occurs when the layers below vnd request that all transmits
+be paused until a future call resumes the flow. This statistic is
+incremented when the flow is resumed. It is not incremented when it is
+first paused.
+.RE
+
+.sp
+.ne 2
+.na
+.B zone
+.ad
+.RS 14n
+The name of the zone the device is located in.
+.RE
+
+.SH OPTIONS
+
+.sp
+.ne 2
+.na
+interval
+.ad
+.RS 13n
+Report once each interval seconds. interval may not be
+fractional.
+.RE
+
+.sp
+.ne 2
+.na
+count
+.ad
+.RS 13n
+Only print count reports, then exit.
+.RE
+.sp
+.LP
+When no arguments are given to vndstat, it will always print at an
+interval of one second. Reports will continue until vndstat
+is terminated.
+
+.SH EXAMPLES
+.LP
+Example 1 Print five seconds of data
+
+.sp
+.in +2
+.nf
+example% vndstat 1 5
+  name |   rx B/s |   tx B/s | drops txfc | zone
+  net0 | 1.45MB/s | 14.1KB/s |     0    0 | 1b7155a4-aef9-e7f0-d33c-9705e4b8b525
+  net0 | 3.50MB/s | 19.5KB/s |     0    0 | 1b7155a4-aef9-e7f0-d33c-9705e4b8b525
+  net0 | 2.83MB/s | 30.8KB/s |     0    0 | 1b7155a4-aef9-e7f0-d33c-9705e4b8b525
+  net0 | 3.08MB/s | 30.6KB/s |     0    0 | 1b7155a4-aef9-e7f0-d33c-9705e4b8b525
+  net0 | 3.21MB/s | 30.6KB/s |     0    0 | 1b7155a4-aef9-e7f0-d33c-9705e4b8b525
+.fi
+.in -2
+.sp
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+.sp
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Interface Stability	See below.
+.TE
+
+.sp
+.LP
+Invocation is evolving. Human readable output is unstable.
+.SH SEE ALSO
+
+dlstat(1M), nicstat(1M), vndadm(1M), vnd(7M)
diff --git a/usr/src/man/man1m/zfs.1m b/usr/src/man/man1m/zfs.1m
index 4ce0ddcad7..9703b0d54a 100644
--- a/usr/src/man/man1m/zfs.1m
+++ b/usr/src/man/man1m/zfs.1m
@@ -23,7 +23,7 @@
 .\" Copyright 2011 Joshua M. Clulow <josh@sysmgr.org>
 .\" Copyright (c) 2011, 2016 by Delphix. All rights reserved.
 .\" Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
-.\" Copyright (c) 2014, Joyent, Inc. All rights reserved.
+.\" Copyright (c) 2015, Joyent, Inc. All rights reserved.
 .\" Copyright (c) 2014 by Adam Stevko. All rights reserved.
 .\" Copyright (c) 2014 Integros [integros.com]
 .\" Copyright 2017 Nexenta Systems, Inc.
diff --git a/usr/src/man/man1m/zoneadm.1m b/usr/src/man/man1m/zoneadm.1m
index 145e6cc893..2dc87a6178 100644
--- a/usr/src/man/man1m/zoneadm.1m
+++ b/usr/src/man/man1m/zoneadm.1m
@@ -1,6 +1,7 @@
 '\" te
 .\" Copyright 2015 Nexenta Systems, Inc. All rights reserved.
 .\" Copyright (c) 2009 Sun Microsystems, Inc. All Rights Reserved.
+.\" Copyright (c) 2011 Joyent, Inc. All Rights Reserved.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
@@ -128,12 +129,14 @@ Use the following command to attach a zone:
 .sp
 .ne 2
 .na
-\fB\fBboot\fR [\fB--\fR \fIboot_options\fR]\fR
+\fB\fBboot\fR [\fB-X\fR] [\fB--\fR \fIboot_options\fR]\fR
 .ad
 .sp .6
 .RS 4n
 Boot (or activate) the specified zones.
 .sp
+The \fI-X\fR option enables debug for the zone's brand while booting.
+.sp
 The following \fIboot_options\fR are supported:
 .sp
 .ne 2
@@ -248,12 +251,25 @@ The source zone must be halted before this subcommand can be used.
 .sp
 .ne 2
 .na
-\fB\fBhalt\fR\fR
+\fB\fBhalt [\fB-X\fR]\fR\fR
 .ad
 .sp .6
 .RS 4n
 Halt the specified zones. \fBhalt\fR bypasses running the shutdown scripts
 inside the zone. It also removes run time resources of the zone.
+.sp
+The \fI-X\fR option enables debug for the zone's brand while halting.
+.sp
+Use:
+.sp
+.in +2
+.nf
+zlogin \fIzone\fR shutdown
+.fi
+.in -2
+.sp
+
+to cleanly shutdown the zone by running the shutdown scripts.
 .RE
 
 .sp
@@ -403,24 +419,28 @@ and normal restrictions for \fIzonepath\fR apply.
 .sp
 .ne 2
 .na
-\fB\fBready\fR\fR
+\fB\fBready [\fB-X\fR]\fR\fR
 .ad
 .sp .6
 .RS 4n
 Prepares a zone for running applications but does not start any user processes
 in the zone.
+.sp
+The \fI-X\fR option enables debug for the zone's brand while readying.
 .RE
 
 .sp
 .ne 2
 .na
-\fB\fBreboot\fR\ [\fB--\fR \fIboot_options\fR]]\fR
+\fB\fBreboot\fR\ [\fB-X\fR] [\fB--\fR \fIboot_options\fR]]\fR
 .ad
 .sp .6
 .RS 4n
 Restart the zones. This is equivalent to a \fBhalt\fR \fBboot\fR sequence. This
 subcommand fails if the specified zones are not active. See \fIboot\fR subcommand
 for the boot options.
+.sp
+The \fI-X\fR option enables debug for the zone's brand while rebooting.
 .RE
 
 .sp
diff --git a/usr/src/man/man1m/zonecfg.1m b/usr/src/man/man1m/zonecfg.1m
index 32285e1fc3..bb1b72ac37 100644
--- a/usr/src/man/man1m/zonecfg.1m
+++ b/usr/src/man/man1m/zonecfg.1m
@@ -1,6 +1,6 @@
 '\" te
 .\" Copyright (c) 2004, 2009 Sun Microsystems, Inc. All Rights Reserved.
-.\" Copyright 2013 Joyent, Inc. All Rights Reserved.
+.\" Copyright 2015 Joyent, Inc.
 .\" Copyright 2017 Peter Tribble
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
@@ -11,17 +11,17 @@ zonecfg \- set up zone configuration
 .SH SYNOPSIS
 .LP
 .nf
-\fBzonecfg\fR \fB-z\fR \fIzonename\fR
+\fBzonecfg\fR {\fB-z\fR \fIzonename\fR | \fB-u\fR \fIuuid\fR}
 .fi
 
 .LP
 .nf
-\fBzonecfg\fR \fB-z\fR \fIzonename\fR \fIsubcommand\fR
+\fBzonecfg\fR {\fB-z\fR \fIzonename\fR | \fB-u\fR \fIuuid\fR} \fIsubcommand\fR
 .fi
 
 .LP
 .nf
-\fBzonecfg\fR \fB-z\fR \fIzonename\fR \fB-f\fR \fIcommand_file\fR
+\fBzonecfg\fR {\fB-z\fR \fIzonename\fR | \fB-u\fR \fIuuid\fR} \fB-f\fR \fIcommand_file\fR
 .fi
 
 .LP
@@ -43,7 +43,8 @@ The following synopsis of the \fBzonecfg\fR command is for interactive usage:
 .sp
 .in +2
 .nf
-zonecfg \fB-z\fR \fIzonename subcommand\fR
+{\fB-z\fR \fIzonename\fR | \fB-u\fR \fIuuid\fR}
+zonecfg {\fB-z\fR \fIzonename | \fB-u\fR \fIuuid} subcommand\fR
 .fi
 .in -2
 .sp
@@ -355,6 +356,16 @@ The following properties are supported:
 .sp
 .ne 2
 .na
+\fB(global)\fR
+.ad
+.sp .6
+.RS 4n
+\fBzfs-io-priority\fR
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBfs\fR\fR
 .ad
 .sp .6
@@ -369,7 +380,7 @@ The following properties are supported:
 .ad
 .sp .6
 .RS 4n
-\fBaddress\fR, \fBallowed-address\fR, \fBphysical\fR, \fBdefrouter\fR
+\fBaddress\fR, \fBallowed-address\fR, \fBdefrouter\fR, \fBglobal-nic\fR, \fBmac-addr\fR, \fBphysical\fR, \fBproperty\fR, \fBvlan-id\fR
 .RE
 
 .sp
@@ -652,7 +663,17 @@ Values needed to determine how, where, and so forth to mount file systems. See
 .sp
 .ne 2
 .na
-\fB\fBnet\fR: address, allowed-address, physical, defrouter\fR
+\fB\fBinherit-pkg-dir\fR: dir\fR
+.ad
+.sp .6
+.RS 4n
+The directory path.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBnet\fR: address, allowed-address, defrouter, global-nic, mac-addr, physical, property, vlan-id\fR
 .ad
 .sp .6
 .RS 4n
@@ -691,6 +712,10 @@ zone. However, if the interface is not used by the global zone, it should be
 configured \fBdown\fR in the global zone, and the default router for the
 interface should be specified here.
 .sp
+The global-nic is used for exclusive stack zones which will use a VNIC on-demand.  When the zone boots, a VNIC named using the physical property will be created on the global NIC.  If provided, the mac-addr and vlan-id will be set on this VNIC.
+.sp
+The \fBproperty\fR setting is a resource which can be used to set arbitrary name/value pairs on the network.  These name/value pairs are made available to the zone's brand, which can use them as needed to set up the network interface.
+.sp
 For an exclusive-IP zone, the physical property must be set and the address and
 default router properties cannot be set.
 .sp
@@ -828,7 +853,7 @@ property is not specified, the scheduling class is established as follows:
 .ie t \(bu
 .el o
 If the \fBcpu-shares\fR property or equivalent rctl is set, the scheduling
-class FSS is used.
+class \fBFSS\fR is used.
 .RE
 .RS +4
 .TP
@@ -844,10 +869,15 @@ used.
 .el o
 Under any other conditions, the system default scheduling class is used.
 .RE
+.sp
+If the \fBFX\fR scheduling class is specified, then the optional
+\fBfixed-hi-pri\fR attribute can be set to \fBtrue\fR. This causes all of the
+processes in the zone to run at the highest \fBFX\fR priority. By default
+processes under \fBFX\fR run at the lowest priority. See \fBpriocntl\fR(2)
+for details on each scheduling class.
 .RE
 
 
-
 .sp
 .ne 2
 .na
@@ -957,6 +987,16 @@ is not supported.
 .RE
 
 .sp
+.ne 2
+.na
+\fBglobal: \fBzfs-io-priority\fR\fR
+.ad
+.sp .6
+.RS 4n
+Specifies a priority for this zone's ZFS I/O. The priority is used by the ZFS I/O scheduler as in input to determine how to schedule I/O across zones. By default all zones have a priority of 1. The value can be increased for zones whose I/O is more critical. This property is the preferred way to set the \fBzone.zfs-io-priority\fR rctl.
+.RE
+
+.sp
 .LP
 The following table summarizes resources, property-names, and types:
 .sp
@@ -979,13 +1019,22 @@ resource          property-name   type
 (global)          max-shm-ids     simple
 (global)          max-shm-memory  simple
 (global)          scheduling-class simple
+(global)          zfs-io-priority simple
 fs                dir             simple
                    special         simple
                    raw             simple
                    type            simple
                    options         list of simple
 net               address         simple
+                   allowed-address simple
+                   defrouter       simple
+                   global-nic      simple
+                   mac-addr        simple
                    physical        simple
+                   property        list of complex
+                    name            simple
+                    value           simple
+                   vlan-id         simple
 device            match           simple
 rctl              name            simple
                    value           list of complex
@@ -1201,6 +1250,16 @@ name \fBglobal\fR and all names beginning with \fBSUNW\fR are reserved and
 cannot be used.
 .RE
 
+.sp
+.ne 2
+.na
+\fB\fB-u\fR \fIuuid\fR\fR
+.ad
+.sp .6
+.RS 4n
+Specify the uuid of a zone instead of the Zone name.
+.RE
+
 .SH SUBCOMMANDS
 .LP
 You can use the \fBadd\fR and \fBselect\fR subcommands to select a specific
@@ -1290,8 +1349,7 @@ correct to be committed, this operation automatically does a verify.
 .sp
 .ne 2
 .na
-\fB\fBcreate [\fR\fB-F\fR\fB] [\fR \fB-a\fR \fIpath\fR |\fB-b\fR \fB|\fR
-\fB-t\fR \fItemplate\fR\fB]\fR\fR
+\fB\fBcreate [\fR\fB-F\fR\fB] [\fR \fB-a\fR \fIpath\fR |\fB-b\fR \fB|\fR \fB-t\fR \fItemplate\fR\fB] [\fR\fB-X\fR\fB]\fR\fR
 .ad
 .sp .6
 .RS 4n
@@ -1313,6 +1371,8 @@ configured, it should be installed using the "\fBzoneadm attach\fR" command
 .sp
 Use the \fB-b\fR option to create a blank configuration. Without arguments,
 \fBcreate\fR applies the Sun default settings.
+.sp
+Use the \fB-X\fR option to facilitate creating a zone whose XML definition already exists on the host. The zone will be atomically added to the zone index file.
 .RE
 
 .sp
@@ -1392,18 +1452,21 @@ which is currently being added or modified.
 .sp
 .ne 2
 .na
-\fB\fBremove\fR \fIresource-type\fR\fB{\fR\fIproperty-name\fR\fB=\fR\fIproperty
--value\fR\fB}\fR(global scope)\fR
+\fB\fBremove\fR [\fR\fB-F\fR\fB] \fIresource-type\fR\fB [\fR\fIproperty-name\fR\fB=\fR\fIproperty-value\fR\fB]* \fR(global scope)\fR
+.br
+\fB\fBremove\fR \fR\fIproperty-name\fR\fB \fR\fIproperty-value\fR\fB \fR(resource scope)\fR
 .ad
 .sp .6
 .RS 4n
 In the global scope, removes the specified resource. The \fB[]\fR syntax means
-0 or more of whatever is inside the square braces. If you want only to remove a
+0 or more property name-value pairs. If you want to only remove a
 single instance of the resource, you must specify enough property name-value
 pairs for the resource to be uniquely identified. If no property name-value
 pairs are specified, all instances will be removed. If there is more than one
-pair is specified, a confirmation is required, unless you use the \fB-F\fR
-option.
+pair specified, a confirmation is required, unless you use the \fB-F\fR
+option. Likewise, the \fB-F\fR option can be used to remove a resource that
+does not exist (that is, no error will occur). In the resource scope, remove
+the specified name-value pair.
 .RE
 
 .sp
diff --git a/usr/src/man/man1m/zpool.1m b/usr/src/man/man1m/zpool.1m
index 7d7e3f552e..1e7b2b8cfc 100644
--- a/usr/src/man/man1m/zpool.1m
+++ b/usr/src/man/man1m/zpool.1m
@@ -20,6 +20,7 @@
 .\"
 .\"
 .\" Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved.
+.\" Copyright (c) 2013, Joyent, Inc. All Rights Reserved.
 .\" Copyright (c) 2012, 2017 by Delphix. All rights reserved.
 .\" Copyright 2017 Nexenta Systems, Inc.
 .\" Copyright (c) 2017 Datto Inc.
diff --git a/usr/src/man/man3c/Makefile b/usr/src/man/man3c/Makefile
index 79f54e15dc..a64bda079a 100644
--- a/usr/src/man/man3c/Makefile
+++ b/usr/src/man/man3c/Makefile
@@ -213,6 +213,9 @@ MANFILES=	__fbufsize.3c					\
 		index.3c					\
 		inet.3c						\
 		initgroups.3c					\
+		inotify_init.3c					\
+		inotify_add_watch.3c				\
+		inotify_rm_watch.3c				\
 		insque.3c					\
 		is_system_labeled.3c				\
 		isaexec.3c					\
diff --git a/usr/src/man/man3c/inotify_add_watch.3c b/usr/src/man/man3c/inotify_add_watch.3c
new file mode 100644
index 0000000000..4f79e03c82
--- /dev/null
+++ b/usr/src/man/man3c/inotify_add_watch.3c
@@ -0,0 +1,120 @@
+'\" te
+.\"  Copyright (c) 2014, Joyent, Inc. All Rights Reserved.
+.\"  This file and its contents are supplied under the terms of the
+.\"  Common Development and Distribution License ("CDDL"), version 1.0.
+.\"  You may only use this file in accordance with the terms of version
+.\"  1.0 of the CDDL.
+.\" 
+.\"  A full copy of the text of the CDDL should have accompanied this
+.\"  source.  A copy of the CDDL is also available via the Internet at
+.\"  http://www.illumos.org/license/CDDL.
+.TH INOTIFY_ADD_WATCH 3C "Sep 17, 2014"
+.SH NAME
+inotify_add_watch \- add a watch to an inotify instance
+.SH SYNOPSIS
+
+.LP
+.nf
+#include <sys/inotify.h>
+
+\fBint\fR \fBinotify_add_watch\fR(\fBint\fR \fIfd\fR, \fBconst char *\fR\fIpathname\fR, \fBuint32_t\fR \fImask\fR);
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+The \fBinotify_add_watch()\fR function adds a watch for the file or
+directory specified by \fIpathname\fR to the inotify instance 
+specified by \fIfd\fR for the events specified by \fImask\fR.  See
+\fBinotify\fR(5) for details on the meaning of \fImask\fR, how
+it affects the interpretation of \fIpathname\fR, and how 
+events for the watched file or directory are subsequently 
+retrieved via \fBread\fR(2).
+
+.SH RETURN VALUES
+.sp
+.LP
+Upon succesful completion, \fBinotify_add_watch()\fR returns the
+watch descriptor associated with the new watch.
+If an error occurs, -1 is returned and errno is set to indicate
+the error.
+
+.SH ERRORS
+.sp
+.LP
+\fBinotify_add_watch()\fR will fail if:
+.sp
+.ne 2
+.na
+\fB\fBEACCES\fR\fR
+.ad
+.RS 10n
+\fIpathname\fR could not be opened for reading.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBEBADF\fR\fR
+.ad
+.RS 10n
+The \fIfd\fR argument is not a valid open file descriptor.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBEFAULT\fR\fR
+.ad
+.RS 10n
+The memory associated with \fIpathname\fR was not mapped.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBEINVAL\fR\fR
+.ad
+.RS 10n
+The \fIfd\fR argument does not correspond to an
+\fBinotify\fR(5) instance as initialized with 
+\fBinotify_init\fR(3C) or \fBinotify_init1\fR(3C).
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBENOSPC\fR\fR
+.ad
+.RS 10n
+The number of watches on the specified instance would exceed the
+maximum number of watches per \fBinotify\fR(5) instance.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBENOTDIR\fR\fR
+.ad
+.RS 10n
+\fIpathname\fR does not correspond to a directory and 
+\fBIN_ONLYDIR\fR was specified in \fImask\fR.
+.RE
+
+.sp
+.SH NOTES
+.sp
+.LP
+
+While the \fBinotify\fR(5) facility is implemented for purposes of
+offering compatibility for Linux-borne applications, native
+applications may opt to use it instead of (or in addition to) the 
+\fBPORT_SOURCE_FILE\fR capability of event ports.  See
+\fBinotify\fR(5) for details and restrictions.
+
+.SH SEE ALSO
+.sp
+.LP
+\fBinotify_init\fR(3C), \fBinotify_init1\fR(3C),
+\fBport_create\fR(3C), \fBport_associate\fR(3C), \fBport_get\fR(3C),
+\fBinotify\fR(5)
diff --git a/usr/src/man/man3c/inotify_init.3c b/usr/src/man/man3c/inotify_init.3c
new file mode 100644
index 0000000000..551a2ca798
--- /dev/null
+++ b/usr/src/man/man3c/inotify_init.3c
@@ -0,0 +1,107 @@
+'\" te
+.\"  Copyright (c) 2014, Joyent, Inc. All Rights Reserved.
+.\"  This file and its contents are supplied under the terms of the
+.\"  Common Development and Distribution License ("CDDL"), version 1.0.
+.\"  You may only use this file in accordance with the terms of version
+.\"  1.0 of the CDDL.
+.\" 
+.\"  A full copy of the text of the CDDL should have accompanied this
+.\"  source.  A copy of the CDDL is also available via the Internet at
+.\"  http://www.illumos.org/license/CDDL.
+.TH INOTIFY_INIT 3C "Sep 17, 2014"
+.SH NAME
+inotify_init, inotify_init1 \- initialize an inotify instance
+.SH SYNOPSIS
+
+.LP
+.nf
+#include <sys/inotify.h>
+
+\fBint\fR \fBinotify_init\fR(\fBvoid\fR);
+.fi
+
+.LP
+.nf
+\fBint\fR \fBinotify_init1\fR(\fBint\fR \fIflags\fR);
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+The \fBinotify_init()\fR and \fBinotify_init1()\fR functions both create an
+\fBinotify\fR(5) instance that can be operated upon via
+\fBinotify_add_watch\fR(3C), \fBinotify_rm_watch\fR(3C) and \fBread\fR(2).
+\fBinotify\fR instances are
+represented as file descriptors, and should be closed via \fBclose\fR(2).
+
+The only difference between the two functions is their signature;
+\fBinotify_init()\fR takes no arguments,
+while \fBinotify_init1()\fR takes a \fIflags\fR argument that can have
+any of the following values:
+
+.sp
+.ne 2
+.na
+\fBIN_CLOEXEC\fR
+.ad
+.RS 12n
+Instance should be closed upon an
+\fBexec\fR(2); see \fBopen\fR(2)'s description of \fBO_CLOEXEC\fR.
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_NONBLOCK\fR
+.ad
+.RS 12n
+Instance will be set to be non-blocking.  A \fBread\fR(2) on an
+\fBinotify\fR instance that has been initialized with
+\fBIN_NONBLOCK\fR will return \fBEAGAIN\fR if there are
+no events enqueued in lieu of blocking.
+.RE
+
+.SH RETURN VALUES
+.sp
+.LP
+Upon succesful completion, 0 is returned. Otherwise, -1 is returned and errno
+is set to indicate the error.
+.SH ERRORS
+.sp
+.LP
+The \fBinotify_init()\fR and \fBinotify_init1()\fR functions will fail if:
+.sp
+.ne 2
+.na
+\fB\fBEINVAL\fR\fR
+.ad
+.RS 10n
+The \fIflags\fR are invalid (\fBinotify_init1()\fR).
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBEMFILE\fR\fR
+.ad
+.RS 10n
+There are currently {\fBOPEN_MAX\fR} file descriptors open in the calling
+process, or the maximum number of \fBinotify\fR instances for the user 
+would be exceeded.
+.RE
+
+.sp
+.SH NOTES
+.sp
+.LP
+
+While the \fBinotify\fR(5) facility is implemented for purposes of
+offering compatibility for Linux-borne applications, native
+applications may opt to use it instead of (or in addition to) the 
+\fBPORT_SOURCE_FILE\fR capability of event ports.  See
+\fBinotify\fR(5) for details and restrictions.
+
+.SH SEE ALSO
+.sp
+.LP
+\fBinotiy_add_watch\fR(3C), \fBinotify_rm_watch\fR(3C), \fBinotify\fR(5)
diff --git a/usr/src/man/man3c/inotify_rm_watch.3c b/usr/src/man/man3c/inotify_rm_watch.3c
new file mode 100644
index 0000000000..de568f8e24
--- /dev/null
+++ b/usr/src/man/man3c/inotify_rm_watch.3c
@@ -0,0 +1,81 @@
+'\" te
+.\"  Copyright (c) 2014, Joyent, Inc. All Rights Reserved.
+.\"  This file and its contents are supplied under the terms of the
+.\"  Common Development and Distribution License ("CDDL"), version 1.0.
+.\"  You may only use this file in accordance with the terms of version
+.\"  1.0 of the CDDL.
+.\" 
+.\"  A full copy of the text of the CDDL should have accompanied this
+.\"  source.  A copy of the CDDL is also available via the Internet at
+.\"  http://www.illumos.org/license/CDDL.
+.TH INOTIFY_RM_WATCH 3C "Sep 17, 2014"
+.SH NAME
+inotify_rm_watch \- remove a watch from an inotify instance
+.SH SYNOPSIS
+
+.LP
+.nf
+#include <sys/inotify.h>
+
+\fBint\fR \fBinotify_rm_watch\fR(\fBint\fR \fIfd\fR, \fBint\fR \fIwd\fR);
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+The \fBinotify_rm_watch()\fR function removes the watch specified
+by \fIwd\fR from the inotify instance associated with \fIfd\fR.
+Removing a watch will induce an \fBIN_IGNORED\fR event; see
+\fBinotify\fR(5) for details.
+
+.SH RETURN VALUES
+.sp
+.LP
+Upon succesful completion, \fBinotify_add_watch()\fR returns the
+watch descriptor associated with the new watch.
+If an error occurs, -1 is returned and errno is set to indicate
+the error.
+
+.SH ERRORS
+.sp
+.LP
+\fBinotify_rm_watch()\fR will fail if:
+.sp
+.ne 2
+.na
+\fB\fBEBADF\fR\fR
+.ad
+.RS 10n
+The \fIfd\fR argument is not a valid open file descriptor.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBEINVAL\fR\fR
+.ad
+.RS 10n
+The \fIfd\fR argument does not correspond to an
+\fBinotify\fR(5) instance as initialized with 
+\fBinotify_init\fR(3C) or \fBinotify_init1\fR(3C), or
+\fIwd\fR is not a valid watch for the specified inotify
+instance.
+.RE
+
+.sp
+.SH NOTES
+.sp
+.LP
+
+While the \fBinotify\fR(5) facility is implemented for purposes of
+offering compatibility for Linux-borne applications, native
+applications may opt to use it instead of (or in addition to) the 
+\fBPORT_SOURCE_FILE\fR capability of event ports.  See
+\fBinotify\fR(5) for details and restrictions.
+
+.SH SEE ALSO
+.sp
+.LP
+\fBinotify_init\fR(3C), \fBinotify_init1\fR(3C),
+\fBport_create\fR(3C), \fBport_associate\fR(3C), \fBport_get\fR(3C),
+\fBinotify\fR(5)
diff --git a/usr/src/man/man3c/psignal.3c b/usr/src/man/man3c/psignal.3c
index 20653e1f98..a977fb6df4 100644
--- a/usr/src/man/man3c/psignal.3c
+++ b/usr/src/man/man3c/psignal.3c
@@ -11,7 +11,7 @@ psignal, psiginfo \- system signal messages
 .SH SYNOPSIS
 .LP
 .nf
-#include <siginfo.h>
+#include <signal.h>
 
 \fBvoid\fR \fBpsignal\fR(\fBint\fR \fIsig\fR, \fBconst char *\fR\fIs\fR);
 .fi
diff --git a/usr/src/man/man3c/timer_create.3c b/usr/src/man/man3c/timer_create.3c
index 36b115c94d..08b8351755 100644
--- a/usr/src/man/man3c/timer_create.3c
+++ b/usr/src/man/man3c/timer_create.3c
@@ -44,7 +44,7 @@
 .\" Portions Copyright (c) 1992, X/Open Company Limited.  All Rights Reserved.
 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
 .\"
-.TH TIMER_CREATE 3C "Sep 15, 2015"
+.TH TIMER_CREATE 3C "Mar 24, 2016"
 .SH NAME
 timer_create \- create a timer
 .SH SYNOPSIS
@@ -160,17 +160,6 @@ system.
 The specified clock \fBID\fR, \fIclock_id\fR, is not defined.
 .RE
 
-.sp
-.ne 2
-.na
-\fB\fBEPERM\fR\fR
-.ad
-.RS 10n
-The specified clock \fBID\fR, \fIclock_id\fR, is \fBCLOCK_HIGHRES\fR and the
-{\fBPRIV_PROC_CLOCK_HIGHRES\fR} is not asserted in the effective set of the
-calling process.
-.RE
-
 .SH ATTRIBUTES
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
@@ -194,5 +183,4 @@ Standard	See \fBstandards\fR(5).
 .LP
 \fBexec\fR(2), \fBfork\fR(2), \fBtime\fR(2), \fBclock_settime\fR(3C),
 \fBsignal\fR(3C), \fBsignal.h\fR(3HEAD), \fBtimer_delete\fR(3C),
-\fBtimer_settime\fR(3C), \fBattributes\fR(5), \fBprivileges\fR(5),
-\fBstandards\fR(5)
+\fBtimer_settime\fR(3C), \fBattributes\fR(5), \fBstandards\fR(5)
diff --git a/usr/src/man/man3c/timer_settime.3c b/usr/src/man/man3c/timer_settime.3c
index de4c0599a2..ca07bfdb63 100644
--- a/usr/src/man/man3c/timer_settime.3c
+++ b/usr/src/man/man3c/timer_settime.3c
@@ -43,8 +43,9 @@
 .\" Copyright 1989 AT&T
 .\" Portions Copyright (c) 1992, X/Open Company Limited.  All Rights Reserved.
 .\" Copyright (c) 2008, Sun Microsystems, Inc.  All Rights Reserved.
+.\" Copyright 2016, Joyent, Inc.
 .\"
-.TH TIMER_SETTIME 3C "Feb 5, 2008"
+.TH TIMER_SETTIME 3C "Mar 24, 2016"
 .SH NAME
 timer_settime, timer_gettime, timer_getoverrun \- per-process timers
 .SH SYNOPSIS
@@ -138,6 +139,12 @@ set to \fBDELAYTIMER_MAX\fR. The value returned by \fBtimer_getoverrun()\fR
 applies to the most recent expiration signal delivery or acceptance for the
 timer. If no expiration signal has been delivered for the timer, the meaning of
 the overrun count returned is undefined.
+.sp
+.LP
+If the specified timer is of type \fBCLOCK_HIGHRES\fR and the time value is
+smaller than a system defined threshold, then {\fBPRIV_PROC_CLOCK_HIGHRES\fR}
+must be asserted in the effective set of the calling process or the time values
+will be adjusted up to the threshold value.
 .SH RETURN VALUES
 .sp
 .LP
@@ -206,4 +213,5 @@ Standard	See \fBstandards\fR(5).
 .sp
 .LP
 \fBtime.h\fR(3HEAD), \fBclock_settime\fR(3C), \fBtimer_create\fR(3C),
-\fBtimer_delete\fR(3C), \fBattributes\fR(5), \fBstandards\fR(5)
+\fBtimer_delete\fR(3C), \fBattributes\fR(5), \fBprivileges\fR(5),
+\fBstandards\fR(5)
diff --git a/usr/src/man/man3dlpi/Makefile b/usr/src/man/man3dlpi/Makefile
index cdd24216bd..4c5448f0be 100644
--- a/usr/src/man/man3dlpi/Makefile
+++ b/usr/src/man/man3dlpi/Makefile
@@ -41,10 +41,12 @@ MANFILES= 	dlpi_arptype.3dlpi	\
 		dlpi_walk.3dlpi
 
 MANLINKS=	dlpi_disabmulti.3dlpi	\
+		dlpi_open_zone.3dlpi	\
 		dlpi_promiscoff.3dlpi
 
 dlpi_disabmulti.3dlpi	:= LINKSRC = dlpi_enabmulti.3dlpi
 
+dlpi_open_zone.3dlpi	:= LINKSRC = man3dlpi/dlpi_open.3dlpi
 dlpi_promiscoff.3dlpi	:= LINKSRC = dlpi_promiscon.3dlpi
 
 .KEEP_STATE:
diff --git a/usr/src/man/man3dlpi/dlpi_open.3dlpi b/usr/src/man/man3dlpi/dlpi_open.3dlpi
index 8129a75404..489f66066a 100644
--- a/usr/src/man/man3dlpi/dlpi_open.3dlpi
+++ b/usr/src/man/man3dlpi/dlpi_open.3dlpi
@@ -1,9 +1,10 @@
 '\" te
 .\" Copyright (c) 2008, Sun Microsystems, Inc.  All Rights Reserved
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH DLPI_OPEN 3DLPI "Nov 17, 2008"
+.TH DLPI_OPEN 3DLPI "Feb 24, 2014"
 .SH NAME
 dlpi_open \- open DLPI link
 .SH SYNOPSIS
@@ -14,6 +15,9 @@ dlpi_open \- open DLPI link
 
 \fBint\fR \fBdlpi_open\fR(\fBconst char *\fR\fIlinkname\fR, \fBdlpi_handle_t *\fR\fIdhp\fR,
      \fBuint_t\fR \fIflags\fR);
+
+\fBint\fR \fBdlpi_open_zone\fR(\fBconst char *\fR\fIlinkname\fR, \fBconst char *\fR
+     \fIzonename\fR, \fBdlpi_handle_t *\fR\fIdhp\fR, \fBuint_t\fR \fIflags\fR);
 .fi
 
 .SH DESCRIPTION
@@ -114,6 +118,18 @@ value ensures that \fBDLPI_ETIMEDOUT\fR is returned from a \fBlibdlpi\fR
 operation only in the event that the \fBDLPI\fR link becomes unresponsive. The
 timeout value can be changed with \fBdlpi_set_timeout\fR(3DLPI), although this
 should seldom be necessary.
+
+.sp
+.LP
+The \fBdlpi_open_zone()\fR function behaves as \fBdlpi_open()\fR, except that it
+looks for the link specified by \fBlinkname\fR in the specified zone
+\fBzonename\fR as opposed to the current zone. This function is only meaningful
+from the global zone. Instead of scanning \fB/dev/net\fR, \fBdlpi_open_zone()\fR
+scans \fB/dev/net/zone/<\fIzonename\fR> for the data link and
+\fB/dev/ipnet/zone/<\fIzonename\fR> when DLPI_DEVIPNET is present in
+\fBflags\fR. If a NULL or empty string is passed into \fBdlpi_open_zone()\fR, it
+will behave as though \fBdlpi_open\fR has been called.
+
 .SH RETURN VALUES
 .sp
 .LP
@@ -124,7 +140,7 @@ section is returned.
 .SH ERRORS
 .sp
 .LP
-The \fBdlpi_open()\fR function will fail if:
+The \fBdlpi_open()\fR and \fBdlpi_open_zone()\fR function will fail if:
 .sp
 .ne 2
 .na
@@ -195,6 +211,17 @@ DLPI operation failed
 See \fBattributes\fR(5) for description of the following attributes:
 .sp
 
+.LP
+The \fBdlpi_open_zone()\fR function will fail if:
+.sp
+.ne 2
+.na
+\fB\fBDLPI_EZONENAMEINVAL\fR\fR
+.ad
+.RS 25n
+Invalid \fIzonename\fR argument
+.RE
+
 .sp
 .TS
 box;
diff --git a/usr/src/man/man3lib/Makefile b/usr/src/man/man3lib/Makefile
index 220ed2ae3e..a470f408fa 100644
--- a/usr/src/man/man3lib/Makefile
+++ b/usr/src/man/man3lib/Makefile
@@ -105,6 +105,7 @@ MANFILES= 	libMPAPI.3lib		\
 	 	libumem.3lib		\
 	 	libuuid.3lib		\
 	 	libvolmgt.3lib		\
+		libvnd.3lib		\
 	 	libw.3lib		\
 	 	libxnet.3lib		\
 	 	liby.3lib
diff --git a/usr/src/man/man3lib/libvnd.3lib b/usr/src/man/man3lib/libvnd.3lib
new file mode 100644
index 0000000000..ead69ff82e
--- /dev/null
+++ b/usr/src/man/man3lib/libvnd.3lib
@@ -0,0 +1,690 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH LIBVND 3LIB "Mar 06, 2014"
+.SH NAME
+libvnd \- vnd library
+
+.SH SYNOPSIS
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+.fi
+
+.SH DESCRIPTION
+.LP
+The libvnd library provides a stable and programmatic interface to
+vnd(7D) devices. vnd devices provide the means for creating a layer two
+interface over a data link, similar to the use of libdlpi(3LIB) and
+IP(7P). In dlpi parlance, a vnd device obtains data from all service
+attachment points (SAP). For ethernet devices, this means that a vnd
+device sends and receives traffic for all ethertypes. It is intended to
+be used for services such as virtual machines which emulate layer two
+devices.
+
+.LP
+Handles to vnd(7D) devices are obtained through the use of vnd_create
+and vnd_open. With a handle, I/O can be performed and properties on the
+device can be set and retrieved. I/O on devices should be performed
+through the vnd_frameio_read and vnd_frameio_write functions. A file
+descriptor suitable for use with event ports and polling may be obtained
+through vnd_pollfd. Handles are relinquished through calls to vnd_close;
+however, devices will persist until vnd_unlink has been called.
+
+.LP
+The rest of this manual documents the interfaces, properties, errors,
+and threading model for libvnd. The in-depth description of individual
+interfaces, their arguments, and examples, are in manual pages for each
+provided interface.
+
+
+.SH INTERFACES
+.sp
+.LP
+
+The shared object libvnd.so.1 provides the public interfaces defined
+below. See Intro(3) for additional information on shared object
+interfaces. Individual functions are documented in their own manual
+pages.
+
+.sp
+.TS
+l l
+l l .
+vnd_create	vnd_errno
+vnd_open	vnd_syserrno
+vnd_unlink	vnd_strerror
+vnd_close	vnd_strsyserror
+vnd_pollfd	vnd_walk
+vnd_prop_get	vnd_prop_set
+vnd_prop_iter	vnd_prop_writeable
+vnd_frameio_read	vnd_frameio_write
+.TE
+
+.SH PROPERTIES
+
+.LP
+The following table summarizes properties of a vnd device. The
+properties can be retrieved and set with the functions
+vnd_prop_get(3VND) and vnd_prop_set(3VND). Following the table, the
+structures and properties are described in greater detail.
+
+.nf
+    +-------------------+---------------------+-------+
+    | PROPERTY          |  STRUCTURE          |  PERM |
+    +-------------------+---------------------+-------+
+    | VND_PROP_RXBUF    | vnd_prop_buf_t      |  R/W  |
+    +-------------------+---------------------+-------+
+    | VND_PROP_TXBUF    | vnd_prop_buf_t      |  R/W  |
+    +-------------------+---------------------+-------+
+    | VND_PROP_MAXBUF   | vnd_prop_buf_t      |  R/-  |
+    +-------------------+---------------------+-------+
+    | VND_PROP_MINTU    | vnd_prop_buf_t      |  R/-  |
+    +-------------------+---------------------+-------+
+    | VND_PROP_MAXTU    | vnd_prop_buf_t      |  R/-  |
+    +-------------------+---------------------+-------+
+.fi
+
+.SS Structures
+
+.LP
+The vnd_prop_buf_t structure has the following members:
+
+.in +2
+.nf
+uint64_t	vpb_size;
+.fi
+.in -2
+
+.LP
+The vpb_size member refers to a size in bytes. When getting a property,
+it represents the size of that property, when setting a property, it is
+the size to set the property to.
+
+
+.SS Property Descriptions
+.sp
+.ne 2
+.na
+rxbuf
+.ad
+.sp .6
+.RS 4n
+A read/write property that controls the size of the receive buffer for
+the device. All received data enters the receive buffer until a consumer
+consumes it. If adding a received frame would exceed the size of the
+receive buffer, then that frame will be dropped. The maximum size of the
+buffer is limited by the 'maxsize' property.
+.RE
+
+.sp
+.ne 2
+.na
+txbuf
+.ad
+.sp .6
+.RS 4n
+A read/write property that controls the size of the transmit buffer. All
+in-flight transmitted data must be able to fix into the transmit buffer
+to deal with potential flow control events. If there is not enough space
+in the transmit buffer, transmit related I/O operations will either
+block or fail based on whether or not O_NONBLOCK or O_NDELAY were set
+with fcntl(2).
+.RE
+
+.sp
+.ne 2
+.na
+maxsize
+.ad
+.sp .6
+.RS 4n
+A read only property that describes the maximum size of buffers in the
+system. Properties such as rxbuf and txbuf cannot be set beyond this.
+.RE
+
+.sp
+.ne 2
+.na
+mintu
+.ad
+.sp .6
+.RS 4n
+A read only property that describes the minimum size of a frame
+transmitted to the underlying data link. Note that the minimum listed
+here may be less than the size of a valid layer two frame and therefore
+may be dropped. A frame smaller than this value will be rejected by vnd.
+.RE
+
+.sp
+.ne 2
+.na
+maxtu
+.ad
+.sp .6
+.RS 4n
+A read only property that describes the maximum size of
+a frame transmitted to the underlying data link. A frame
+larger than this value will be rejected by vnd.
+.RE
+
+
+.SH ERRORS
+.sp
+.LP
+Most interfaces provided by libvnd provide a means to retrieve a
+vnd_errno_t that describes an error that has occurred. The manuals for
+individual interfaces describe whether or not this additional error
+information is available and how to retrieve it. The following is a
+complete list of the error numbers and their names as defined in
+<sys/vnd_errno.h>. Any entries not listed here are private to the
+implementation and may change at any time.
+
+.sp
+.ne 2
+.na
+0 VND_E_SUCCESS
+.ad
+.RS 23n
+no error
+.sp
+This indicates that the operation completed successfully.
+.RE
+
+.sp
+.ne 2
+.na
+1 VND_E_NOMEM
+.ad
+.RS 23n
+not enough memory available
+.sp
+Insufficient memory was available. This is the equivalent of the
+standard system errno ENOMEM.
+.RE
+
+.sp
+.ne 2
+.na
+2 VND_E_NODATALINK
+.ad
+.RS 23n
+no such datalink
+.sp
+The data link requested to be used as part of vnd_create does not exist
+in the requested zone.
+.RE
+
+.sp
+.ne 2
+.na
+3 VND_E_NOTETHER
+.ad
+.RS 23n
+datalink not of type DL_ETHER
+.sp
+The data link used as part of a call to vnd_create is not an Ethernet
+device.  vnd_create only works with Ethernet devices at this time.
+.RE
+
+.sp
+.ne 2
+.na
+4 VND_E_DLPIINVAL
+.ad
+.RS 23n
+unknown dlpi failure
+.sp
+An unexpected DLPI message was received during vnd device
+initialization.
+.RE
+
+.sp
+.ne 2
+.na
+5 VND_E_ATTACHFAIL
+.ad
+.RS 23n
+DL_ATTACH_REQ failed
+.sp
+During vnd device initialization, the dlpi call to attach to the
+requested data link failed.
+.RE
+
+.sp
+.ne 2
+.na
+6 VND_E_BINDFAIL
+.ad
+.RS 23n
+DL_BIND_REQ failed
+.sp
+
+During vnd device initialization, the dlpi call to bind to a service
+attachment point on the data link failed.
+.RE
+
+.sp
+.ne 2
+.na
+7 VND_E_PROMISCFAIL
+.ad
+.RS 23n
+DL_PROMISCON_REQ failed
+.sp
+
+During vnd device initialization, the dlpi call to enable promiscuous
+mode on the underlying device failed.
+.RE
+
+.sp
+.ne 2
+.na
+8 VND_E_DIRECTFAIL
+.ad
+.RS 23n
+DLD_CAPAB_DIRECT enable failed
+.sp
+During vnd device initialization, the dlpi call to enable the DLD fast
+path failed.
+.RE
+
+.sp
+.ne 2
+.na
+9 VND_E_CAPACKINVAL
+.ad
+.RS 23n
+bad datalink capability
+.sp
+During vnd device initialization, the kernel responded with an invalid
+capability acknowledgement.
+.RE
+
+.sp
+.ne 2
+.na
+10 VND_E_SUBCAPINVAL
+.ad
+.RS 23n
+bad datalink subcapability
+.sp
+During vnd device initialization, the kernel responded with an invalid
+sub-capability.
+.RE
+
+.sp
+.ne 2
+.na
+11 VND_E_DLDBADVERS
+.ad
+.RS 23n
+bad dld version
+.sp
+The vnd(7D) module does not support the version of the dld capability
+that the kernel sent. As such, the data path could not be brought up and
+the device could not be fully initialized.
+.RE
+
+.sp
+.ne 2
+.na
+12 VND_E_KSTATCREATE
+.ad
+.RS 23n
+failed to create kstats
+.sp
+During vnd device initialization, the necessary kstats could not be
+created.
+.RE
+
+.sp
+.ne 2
+.na
+13 VND_E_NODEV
+.ad
+.RS 23n
+no such vnd link
+.sp
+During device initialization, the requested character device did not
+exist.
+.RE
+
+.sp
+.ne 2
+.na
+14 VND_E_NONETSTACK
+.ad
+.RS 23n
+netstack doesn't exist
+.sp
+During device initialization, the networking stack for the device did
+not exist.
+.RE
+
+.sp
+.ne 2
+.na
+15 VND_E_ASSOCIATED
+.ad
+.RS 23n
+device already associated
+.sp
+During vnd device initialization, the vnd STREAMS device was already
+associated with another vnd device.
+.RE
+
+.sp
+.ne 2
+.na
+16 VND_E_ATTACHED
+.ad
+.RS 23n
+device already attached
+.sp
+The given vnd device has already been created over a data link and
+cannot be created over another one.
+.RE
+
+.sp
+.ne 2
+.na
+17 VND_E_LINKED
+.ad
+.RS 23n
+device already linked
+.sp
+The given vnd device has already been given a name and bound into the
+file system name space.
+.RE
+
+.sp
+.ne 2
+.na
+18 VND_E_BADNAME
+.ad
+.RS 23n
+invalid name
+.sp
+The requested name is not a valid name.  Valid names are alphanumeric
+ascii names, along with the following ascii characters: ':', '\-', and
+\'_'. Names must be less than LIBVND_NAMELEN bytes including the null
+terminator.
+.RE
+
+.sp
+.ne 2
+.na
+19 VND_E_PERM
+.ad
+.RS 23n
+permission denied
+.sp
+A request was made from a non-global zone to manipulate a vnd device
+that belongs to a different zone.
+.RE
+
+.sp
+.ne 2
+.na
+20 VND_E_NOZONE
+.ad
+.RS 23n
+no such zone
+.sp
+A request was made which targeted a zone that did not exist.
+.RE
+
+.sp
+.ne 2
+.na
+21 VND_E_STRINIT
+.ad
+.RS 23n
+failed to initialize vnd stream module
+.sp
+During vnd device initialization, the vnd STREAMS module could not be
+pushed onto the data link's stream head.
+.RE
+
+.sp
+.ne 2
+.na
+22 VND_E_NOTATTACHED
+.ad
+.RS 23n
+device not attached
+.sp
+A request was made that requires a vnd device be attached to a data
+link, such as a call to change a property. The device was not attached
+to a data link.
+.RE
+
+.sp
+.ne 2
+.na
+23 VND_E_NOTLINKED
+.ad
+.RS 23n
+device not linked
+.sp
+A request was made to a vnd device that requires the vnd device to be
+named and present in /dev. The given device was not linked into /dev at
+the time of the call.
+.RE
+
+.sp
+.ne 2
+.na
+24 VND_E_LINKEXISTS
+.ad
+.RS 23n
+another device has the same link name
+.sp
+When trying to link a given vnd device into a zones /dev name space,
+another device already exists with the same name.
+.RE
+
+.sp
+.ne 2
+.na
+25 VND_E_MINORNODE
+.ad
+.RS 23n
+failed to create minor node
+.sp
+While trying to link a vnd device into the /devices and /dev name space,
+the call to ddi_create_minor_node() failed.
+.RE
+
+.sp
+.ne 2
+.na
+26 VND_E_BUFTOOBIG
+.ad
+.RS 23n
+requested buffer size is too large
+.sp
+The requested buffer size exceeds the maximum valid value for the given
+property.
+.RE
+
+.sp
+.ne 2
+.na
+27 VND_E_BUFTOOSMALL
+.ad
+.RS 23n
+requested buffer size is too small
+.sp
+The requested buffer size is less than the minimum buffer size. This
+generally occurs when making the buffer size less than the maximum
+transmission unit.
+.RE
+
+.sp
+.ne 2
+.na
+28 VND_E_DLEXCL
+.ad
+.RS 23n
+unable to obtain exclusive access to dlpi link, link busy
+.sp
+When a vnd device is created, it expects exclusive active access to the
+device.  If any other active dlpi consumers, such as IP, are already
+using the device, then the vnd device will not be created.  Passive
+consumers, such as snoop, can still use a device that has been
+exclusively opened.
+.RE
+
+.sp
+.ne 2
+.na
+28 VND_E_DIRECTNOTSUP
+.ad
+.RS 23n
+DLD direct capability not supported over data link
+.sp
+The data link that the vnd device was created over does not supported
+the DLD Direct capability. As such, the data path could not be
+initialized.
+.RE
+
+.sp
+.ne 2
+.na
+30 VND_E_BADPROPSIZE
+.ad
+.RS 23n
+invalid property size
+.sp
+The size of the data passed into vnd_prop_get or vnd_prop_set is
+incorrect and does not match the expected data size.
+.RE
+
+.sp
+.ne 2
+.na
+31 VND_E_BADPROP
+.ad
+.RS 23n
+invalid property
+.sp
+An unknown property identifier was specified. For a list of valid
+properties, see the section above entitled "PROPERTIES".
+.RE
+
+.sp
+.ne 2
+.na
+32 VND_E_PROPRDONLY
+.ad
+.RS 23n
+property is read only
+.sp
+An operation tried to update the value of a read only property. For a
+list of which properties are read only and which are readable and
+writeable, see the section above entitled "PROPERTIES".
+.RE
+
+.sp
+.ne 2
+.na
+33 VND_E_SYS
+.ad
+.RS 23n
+unexpected system error
+.sp
+This indicates that there is no vnd specific error available and that
+the system errno is valid. The system errno can be obtained and printed
+through vnd_syserrno and vnd_strsyserror. The possible values and their
+meanings are documented in Intro(2).
+.RE
+
+.sp
+.ne 2
+.na
+34 VND_E_CAPABPASS
+.ad
+.RS 23n
+capabilities invalid, pass-through module detected
+.sp
+While negotiating capabilities, a pass-through module was detected and
+the capability had to be discarded. Because of this, the data path could
+not be initialized.
+.RE
+
+
+.SH THREADING
+
+.LP
+The libvnd library is not truly MT-safe. MT-safety is provided on
+the granularity of a given vnd_handle_t. Operations on a single
+vnd_handle_t are unsafe; however, operations on different handles are
+MT-safe. If a single vnd_handle_t is used by multiple threads, it
+is the caller's responsibility to provide locking to ensure that
+multiple threads aren't simultaneously calling into libvnd on a
+single handle.
+
+
+.SH FILES
+.sp
+.ne 2
+.na
+/usr/lib/libvnd.so.1
+.ad
+.RS 27n
+shared object
+.RE
+
+.sp
+.ne 2
+.na
+/usr/lib/64/libvnd.so.1
+.ad
+.RS 27n
+64-bit shared object
+.RE
+
+.SH ATTRIBUTES
+
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	See "THREADING"
+.TE
+
+.SH SEE ALSO
+
+.sp
+.LP
+attributes(5), Intro(2), fcntl(2), Intro(3), fcntl.h(3HEAD), libdlpi(3LIB), port_create(3C), vnd(7D)
+.sp
+.LP
+vnd_close(3VND), vnd_create(3VND), vnd_errno(3VND),
+vnd_frameio_read(3VND), vnd_frameio_write(3VND), vnd_open(3VND)
+vnd_pollfd(3VND), vnd_prop_get(3VND), vnd_prop_iter(3VND),
+vnd_prop_set(3VND),
+vnd_prop_writeable(3VND), vnd_walk(3VND)
diff --git a/usr/src/man/man3nsl/t_bind.3nsl b/usr/src/man/man3nsl/t_bind.3nsl
index 698995e5eb..baa5d8a112 100644
--- a/usr/src/man/man3nsl/t_bind.3nsl
+++ b/usr/src/man/man3nsl/t_bind.3nsl
@@ -43,6 +43,7 @@
 .\" Portions Copyright 1989 AT&T
 .\" Copyright 1994, The X/Open Company Ltd.  All Rights Reserved.
 .\" Portions Copyright (c) 1998, Sun Microsystems, Inc.  All Rights Reserved.
+.\" Copyright 2017 Joyent, Inc.
 .\"
 .TH T_BIND 3NSL "Dec 27, 2013"
 .SH NAME
@@ -68,284 +69,381 @@ using a \fBTLI\fR routine that has the same name as an \fBXTI\fR routine, the
 \fBtiuser.h\fR header file must be used.  Refer to the  \fBTLI\fR
 \fBCOMPATIBILITY\fR section for a description of differences between the two
 interfaces.
-.sp
-.LP
+.Sy XTI
+represents the future evolution of these
+interfaces.
+However,
+.Sy TLI
+interfaces are supported for compatibility.
+When using a
+.Sy TLI
+routine that has the same name as an
+.Sy XTI
+routine, the
+.In tiuser.h
+header file must be used.
+Refer to the
+.Sx "TLI COMPATIBILITY"
+section for a description of differences between the two interfaces.
+.Pp
 This function associates a protocol address with the transport endpoint
-specified by \fIfd\fR and activates that transport endpoint. In connection
-mode, the transport provider may begin enqueuing incoming connect indications,
-or servicing a connection request on the transport endpoint. In
-connectionless-mode, the transport user may send or receive data units through
+specified by
+.Fa fd
+and activates that transport endpoint.
+In connection mode, the transport provider may begin enqueuing incoming
+connect indications, or servicing a connection request on the transport
+endpoint.
+In connectionless-mode, the transport user may send or receive data units
+through the transport endpoint.
+.Pp
+The
+.Fa req
+and
+.Fa ret
+arguments point to a
+.Vt t_bind
+structure containing the following members:
+.Pp
+.Bl -item -offset indent -compact
+.It
+struct netbuf addr;
+.It
+unsigned qlen;
+.El
+.Pp
+The
+.Sy addr
+field of the
+.Vt t_bind
+structure specifies a protocol address, and the
+.Sy qlen
+field is used to indicate the maximum number of outstanding connection
+indications.
+.Pp
+The parameter
+.Fa req
+is used to request that an address, represented by the
+.Vt netbuf
+structure, be bound to the given transport endpoint.
+The parameter
+.Sy len
+specifies the number of bytes in the address, and
+.Sy buf
+points to the address buffer.
+For
+.Xr tcp 7P
+and
+.Xr udp 7P
+transports,
+.Sy buf
+points to a
+.Xr sockaddr 3SOCKET
+buffer \(em either
+.Vt "struct sockaddr_in"
+or
+.Vt "struct sockaddr_in6"
+(depending on if IPv4 or IPv6 is being used).
+The parameter
+.Sy maxlen
+has no meaning for the
+.Fa req
+argument.
+.Pp
+On return,
+.Fa ret
+contains an encoding for the address that the transport provider actually
+bound to the transport endpoint; if an address was specified in
+.Fa req ,
+this will be an encoding of the same address.
+In
+.Fa ret ,
+the user specifies
+.Sy maxlen ,
+which is the maximum size of the address buffer, and
+.Sy buf
+which points to the buffer where the address is to be placed.
+On return,
+.Sy len
+specifies the number of bytes in the bound address, and
+.Sy buf
+points to the bound address.
+If
+.Sy maxlen
+equals zero, no address is returned.
+If
+.Sy maxlen
+is greater than zero and less than the length of the address,
+.Fn t_bind
+fails with
+.Va t_errno
+set to
+.Er TBUFOVFLW .
+.Pp
+If the requested address is not available,
+.Fn t_bind
+will return  -1 with
+.Va t_errno
+set as appropriate.
+If no address is specified in
+.Fa req
+(the
+.Sy len
+field of
+.Sy addr
+in
+.Fa req
+is zero or
+.Fa req
+is
+.Sy NULL ) ,
+the transport provider will assign an appropriate address to be
+bound, and will return that address in the
+.Sy addr
+field of
+.Fa ret .
+If the transport provider could not allocate an address,
+.Fn t_bind
+will fail
+with
+.Va t_errno
+set to
+.Er TNOADDR .
+.Pp
+The parameter
+.Fa req
+may be a null pointer if the user does not wish to
+specify an address to be bound.
+Here, the value of
+.Sy qlen
+is assumed to be zero, and the transport provider will assign an address to
 the transport endpoint.
-.sp
-.LP
-The \fIreq\fR and \fIret\fR arguments point to a \fBt_bind\fR structure
-containing the following members:
-.sp
-.in +2
-.nf
-struct netbuf	addr;
-unsigned	qlen;
-.fi
-.in -2
-
-.sp
-.LP
-The \fIaddr\fR field of the \fBt_bind\fR structure specifies a protocol
-address, and the \fIqlen\fR field is used to indicate the maximum number of
-outstanding connection indications.
-.sp
-.LP
-The parameter \fIreq\fR is used to request that an address, represented by the
-\fBnetbuf\fR structure, be bound to the given transport endpoint. The parameter
-\fIlen\fR specifies the number of bytes in the address, and \fIbuf\fR points to
-the address buffer. The parameter \fImaxlen\fR has no meaning for the \fIreq\fR
-argument. On return, \fIret\fR contains an encoding for the address that the
-transport provider actually bound to the transport endpoint; if an address was
-specified in  \fIreq\fR, this will be an encoding of the same address. In
-\fIret\fR, the user specifies \fImaxlen,\fR which is the maximum size of the
-address buffer, and \fIbuf\fR which points to the buffer where the address is
-to be placed. On return, \fIlen\fR specifies the number of bytes in the bound
-address, and \fIbuf\fR points to the bound address. If \fImaxlen\fR equals
-zero, no address is returned. If  \fImaxlen\fR is greater than zero and less
-than the length of the address,  \fBt_bind()\fR fails with \fBt_errno\fR set to
-\fBTBUFOVFLW\fR.
-.sp
-.LP
-If the requested address is not available, \fBt_bind()\fR will return  -1 with
-\fBt_errno\fR set as appropriate. If no address is specified in \fIreq\fR (the
-\fIlen\fR field of \fIaddr\fR in \fIreq\fR is zero or \fIreq\fR is
-\fBNULL),\fR the transport provider will assign an appropriate address to be
-bound, and will return that address in the \fIaddr\fR field of \fIret\fR. If
-the transport provider could not allocate an address, \fBt_bind()\fR will fail
-with \fBt_errno\fR set to \fBTNOADDR\fR.
-.sp
-.LP
-The parameter \fIreq\fR may be a null pointer if the user does not wish to
-specify an address to be bound. Here, the value of \fIqlen\fR is assumed to be
-zero, and the transport provider will assign an address to the transport
-endpoint. Similarly, \fIret\fR may be a null pointer if the user does not care
+Similarly,
+.Fa ret
+may be a null pointer if the user does not care
 what address was bound by the provider and is not interested in the negotiated
-value of \fIqlen\fR. It is valid to set \fIreq\fR and \fIret\fR to the null
-pointer for the same call, in which case the provider chooses the address to
-bind to the transport endpoint and does not return that information to the
-user.
-.sp
-.LP
-The \fIqlen\fR field has meaning only when initializing a connection-mode
-service. It specifies the number of outstanding connection indications that the
-transport provider should support for the given transport endpoint. An
-outstanding connection indication is one that has been passed to the transport
-user by the transport provider but which has not been accepted or rejected. A
-value of \fIqlen\fR greater than zero is only meaningful when issued by a
-passive transport user that expects other users to call it. The value of
-\fIqlen\fR will be negotiated by the transport provider and may be changed if
+value of
+.Sy qlen .
+It is valid to set
+.Fa req
+and
+.Fa ret
+to the null pointer for the same call, in which case the provider chooses the
+address to bind to the transport endpoint and does not return that information
+to the user.
+.Pp
+The
+.Sy qlen
+field has meaning only when initializing a connection-mode
+service.
+It specifies the number of outstanding connection indications that the
+transport provider should support for the given transport endpoint.
+An outstanding connection indication is one that has been passed to the
+transport user by the transport provider but which has not been accepted or
+rejected.
+A value of
+.Sy qlen
+greater than zero is only meaningful when issued by a
+passive transport user that expects other users to call it.
+The value of
+.Sy qlen
+will be negotiated by the transport provider and may be changed if
 the transport provider cannot support the specified number of outstanding
-connection indications. However, this value of \fIqlen\fR will never be
-negotiated from a requested value greater than zero to zero. This is a
-requirement on transport providers; see \fBWARNINGS\fR below. On return, the
-\fIqlen\fR field in \fIret\fR will contain the negotiated value.
-.sp
-.LP
-If \fIfd\fR refers to a connection-mode service, this function allows more than
-one transport endpoint to be bound to the same protocol address.  It is not
+connection indications.
+However, this value of
+.Sy qlen
+will never be negotiated from a requested value greater than zero to zero.
+This is a requirement on transport providers; see
+.Sx WARNINGS
+below.
+On return, the
+.Sy qlen
+field in
+.Fa ret
+will contain the negotiated value.
+.Pp
+If
+.Fa fd
+refers to a connection-mode service, this function allows more than
+one transport endpoint to be bound to the same protocol address.
+It is not
 possible to bind more than one protocol address to the same transport endpoint.
-However, the transport provider must also support this capability. If a user
-binds more than one transport endpoint to the same protocol address, only one
-endpoint can be used to listen for connection indications associated with that
-protocol address. In other words, only one \fBt_bind()\fR for a given protocol
-address may specify a value of \fIqlen\fR greater than zero. In this way, the
+However, the transport provider must also support this capability.
+If a user binds more than one transport endpoint to the same protocol address,
+only one endpoint can be used to listen for connection indications associated
+with that protocol address.
+In other words, only one
+.Fn t_bind
+for a given protocol address may specify a value of
+.Sy qlen
+greater than zero.
+In this way, the
 transport provider can identify which transport endpoint should be notified of
-an incoming connection indication. If a user attempts to bind a protocol
-address to a second transport endpoint with a value of \fIqlen\fR greater than
-zero, \fBt_bind()\fR will return  -1 and set \fBt_errno\fR to \fBTADDRBUSY\fR.
+an incoming connection indication.
+If a user attempts to bind a protocol address to a second transport endpoint
+with a value of
+.Sy qlen
+greater than zero,
+.Fn t_bind
+will return  -1 and set
+.Va t_errno
+to
+.Er TADDRBUSY .
 When a user accepts a connection on the transport endpoint that is being used
 as the listening endpoint, the bound protocol address will be found to be busy
-for the duration of the connection, until a \fBt_unbind\fR(3NSL) or
-\fBt_close\fR(3NSL) call has been issued. No other transport endpoints may be
-bound for listening on that same protocol address while that initial listening
-endpoint is active (in the data transfer phase or in the  \fBT_IDLE\fR state).
-This will prevent more than one transport endpoint bound to the same protocol
-address from accepting connection indications.
-.sp
-.LP
-If  \fIfd\fR refers to connectionless mode service, this function allows for
+for the duration of the connection, until a
+.Xr t_unbind 3NSL
+or
+.Xr t_close 3NSL
+call has been issued.
+No other transport endpoints may be bound for listening on that same protocol
+address while that initial listening endpoint is active (in the data transfer
+phase or in the
+.Sy T_IDLE
+state).
+This will prevent more than one transport endpoint bound to the same
+protocol address from accepting connection indications.
+.Pp
+If
+.Fa fd
+refers to connectionless mode service, this function allows for
 more than one transport endpoint to be associated with a protocol address,
 where the underlying transport provider supports this capability (often in
-conjunction with value of a protocol-specific option). If a user attempts to
-bind a second transport endpoint to an already bound protocol address when such
-capability is not supported for a transport provider, \fBt_bind()\fR will
-return  -1 and set \fBt_errno\fR to \fBTADDRBUSY\fR.
-.SH RETURN VALUES
-.sp
-.LP
-Upon successful completion, a value of 0 is returned.  Otherwise, a value of
--1 is returned and \fBt_errno\fR is set to indicate an error.
-.SH VALID STATES
-.sp
-.LP
-\fBT_UNBND\fR
-.SH ERRORS
-.sp
-.LP
-On failure, \fBt_errno\fR is set to one of the following:
-.sp
-.ne 2
-.na
-\fB\fBTACCES\fR\fR
-.ad
-.RS 13n
+conjunction with value of a protocol-specific option).
+If a user attempts to bind a second transport endpoint to an already bound
+protocol address when such capability is not supported for a transport provider,
+.Fn t_bind
+will
+return  -1 and set
+.Va t_errno
+to
+.Er TADDRBUSY .
+.Sh RETURN VALUES
+Upon successful completion, a value of 0 is returned.
+Otherwise, a value of
+-1 is returned and
+.Va t_errno
+is set to indicate an error.
+.Sh VALID STATES
+.Sy T_UNBND
+.Sh ERRORS
+On failure,
+.Va t_errno
+is set to one of the following:
+.Bl -tag -width Er
+.It Er TACCES
 The user does not have permission to use the specified address.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTADDRBUSY\fR\fR
-.ad
-.RS 13n
+.It Er TADDRBUSY
 The requested address is in use.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTBADADDR\fR\fR
-.ad
-.RS 13n
+.It Er TBADADDR
 The specified protocol address was in an incorrect format or contained illegal
 information.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTBADF\fR\fR
-.ad
-.RS 13n
+.It Er TBADF
 The specified file descriptor does not refer to a transport endpoint.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTBUFOVFLW\fR\fR
-.ad
-.RS 13n
-The number of bytes allowed for an incoming argument \fI(maxlen)\fR is greater
-than 0 but not sufficient to store the value of that argument. The provider's
-state will change to  \fBT_IDLE\fR and the information to be returned in
-\fIret\fR will be discarded.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTOUTSTATE\fR\fR
-.ad
-.RS 13n
-The communications endpoint referenced by  \fIfd\fR is not in one of the states
-in which a call to this function is valid.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTNOADDR\fR\fR
-.ad
-.RS 13n
+.It Er TBUFOVFLW
+The number of bytes allowed for an incoming argument
+.Pa Sy maxlen
+is greater than 0 but not sufficient to store the value of that argument.
+The provider's state will change to
+.Sy T_IDLE
+and the information to be returned in
+.Fa ret
+will be discarded.
+.It Er TOUTSTATE
+The communications endpoint referenced by
+.Fa fd
+is not in one of the states in which a call to this function is valid.
+.It Er TNOADDR
 The transport provider could not allocate an address.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTPROTO\fR\fR
-.ad
-.RS 13n
+.It Er TPROTO
 This error indicates that a communication problem has been detected between XTI
 and the transport provider for which there is no other suitable XTI error
-\fB(t_errno)\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTSYSERR\fR\fR
-.ad
-.RS 13n
+.Pq Va t_errno .
+.It Er TSYSERR
 A system error has occurred during execution of this function.
-.RE
-
-.SH TLI COMPATIBILITY
-.sp
-.LP
-The \fBXTI\fR and \fBTLI\fR interface definitions have common names but use
-different header files. This, and other semantic differences between the two
-interfaces are described in the subsections below.
-.SS "Interface Header"
-.sp
-.LP
-The \fBXTI\fR interfaces use the header file, \fBxti.h\fR. \fBTLI\fR interfaces
-should \fInot\fR use this header.  They should use the header:
-.sp
-.LP
-\fB#include\fR \fB<tiuser.h>\fR
-.SS "Address Bound"
-.sp
-.LP
-The user can compare the addresses in \fIreq\fR and \fIret\fR to determine
-whether the transport provider bound the transport endpoint to a different
-address than that requested.
-.SS "Error Description Values"
-.sp
-.LP
-The \fBt_errno\fR values \fBTPROTO\fR and \fBTADDRBUSY\fR can be set by the
-\fBXTI\fR interface but cannot be set by the \fBTLI\fR interface.
-.sp
-.LP
-A \fBt_errno\fR value that this routine can return under different
-circumstances than its \fBXTI\fR counterpart is \fBTBUFOVFLW\fR. It can be
-returned even when the \fBmaxlen\fR field of the corresponding buffer has been
-set to zero.
-.SH ATTRIBUTES
-.sp
-.LP
-See \fBattributes\fR(5)  for descriptions of the following attributes:
-.sp
-
-.sp
-.TS
-box;
-c | c
-l | l .
-ATTRIBUTE TYPE	ATTRIBUTE VALUE
-_
-MT Level	Safe
-.TE
-
-.SH SEE ALSO
-.sp
-.LP
-\fBt_accept\fR(3NSL), \fBt_alloc\fR(3NSL), \fBt_close\fR(3NSL),
-\fBt_connect\fR(3NSL), \fBt_unbind\fR(3NSL), \fBattributes\fR(5)
-.SH WARNINGS
-.sp
-.LP
-The requirement that the value of \fIqlen\fR never be negotiated from a
-requested value greater than zero to zero implies that transport providers,
-rather than the XTI implementation itself, accept this restriction.
-.sp
-.LP
+.El
+.Sh TLI COMPATIBILITY
+The
+.Sy XTI
+and
+.Sy TLI
+interface definitions have common names but use different header files.
+This, and other semantic differences between the two interfaces are described
+in the subsections below.
+.Ss "Interface Header"
+The
+.Sy XTI
+interfaces use the header file,
+.In xti.h .
+.Sy TLI
+interfaces should
+.Em not
+use this header.
+They should use the header:
+.In tiuser.h
+.Ss "Address Bound"
+The user can compare the addresses in
+.Fa req
+and
+.Fa ret
+to determine whether the transport provider bound the transport endpoint to a
+different address than that requested.
+.Ss "Error Description Values"
+The
+.Va t_errno
+values
+.Er TPROTO
+and
+.Er TADDRBUSY
+can be set by the
+.Sy XTI
+interface but cannot be set by the
+.Sy TLI
+interface.
+.Pp
+A
+.Va t_errno
+value that this routine can return under different circumstances than its
+.Sy XTI
+counterpart is
+.Er TBUFOVFLW .
+It can be returned even when the
+.Sy maxlen
+field of the corresponding buffer has been set to zero.
+.Sh MT-LEVEL
+Safe
+.Sh SEE ALSO
+.Xr t_accept 3NSL ,
+.Xr t_alloc 3NSL ,
+.Xr t_close 3NSL ,
+.Xr t_connect 3NSL ,
+.Xr t_unbind 3NSL ,
+.Xr sockaddr 3SOCKET ,
+.Xr attributes 5
+.Sh WARNINGS
+The requirement that the value of
+.Sy qlen
+never be negotiated from a requested value greater than zero to zero implies
+that transport providers, rather than the XTI implementation itself, accept
+this restriction.
+.Pp
 An implementation need not allow an application explicitly to bind more than
 one communications endpoint to a single protocol address, while permitting more
-than one connection to be accepted to the same protocol address. That means
-that although an attempt to bind a communications endpoint to some address with
-\fIqlen=0\fR might be rejected with \fBTADDRBUSY\fR, the user may nevertheless
+than one connection to be accepted to the same protocol address.
+That means that although an attempt to bind a communications endpoint to some
+address with
+.Sy qlen=0
+might be rejected with
+.Er TADDRBUSY ,
+the user may nevertheless
 use this (unbound) endpoint as a responding endpoint in a call to
-\fBt_accept\fR(3NSL). To become independent of such implementation differences,
-the user should supply unbound responding endpoints to  \fBt_accept\fR(3NSL).
-.sp
-.LP
+.Xr t_accept 3NSL .
+To become independent of such implementation differences,
+the user should supply unbound responding endpoints to
+.Xr t_accept 3NSL .
+.Pp
 The local address bound to an endpoint may change as result of a
-\fBt_accept\fR(3NSL) or  \fBt_connect\fR(3NSL) call. Such changes are not
-necessarily reversed when the connection is released.
+.Xr t_accept 3NSL
+or
+.Xr t_connect 3NSL
+call.
+Such changes are not necessarily reversed when the connection is released.
diff --git a/usr/src/man/man3vnd/Makefile b/usr/src/man/man3vnd/Makefile
new file mode 100644
index 0000000000..64abf9dcd6
--- /dev/null
+++ b/usr/src/man/man3vnd/Makefile
@@ -0,0 +1,70 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet
+# at http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+#
+
+include		$(SRC)/Makefile.master
+
+MANSECT=	3vnd
+
+MANFILES=	vnd_create.3vnd 	\
+		vnd_errno.3vnd 		\
+		vnd_frameio_read.3vnd 	\
+		vnd_pollfd.3vnd 	\
+		vnd_prop_get.3vnd 	\
+		vnd_prop_iter.3vnd 	\
+		vnd_prop_writeable.3vnd	\
+		vnd_walk.3vnd
+
+MANLINKS=	frameio_t.3vnd		\
+		framevec_t.3vnd		\
+		vnd_close.3vnd		\
+		vnd_frameio_write.3vnd	\
+		vnd_open.3vnd 		\
+		vnd_prop_set.3vnd	\
+		vnd_prop_iter_f.3vnd	\
+		vnd_strerror.3vnd	\
+		vnd_strsyserror.3vnd	\
+		vnd_syserrno.3vnd	\
+		vnd_unlink.3vnd 	\
+		vnd_walk_cb_f.3vnd
+
+# vnd_create.3vnd
+vnd_open.3vnd		:= LINKSRC = vnd_create.3vnd
+vnd_unlink.3vnd		:= LINKSRC = vnd_create.3vnd
+vnd_close.3vnd		:= LINKSRC = vnd_create.3vnd
+
+# vnd_errno.3vnd
+vnd_strerror.3vnd	:= LINKSRC = vnd_errno.3vnd
+vnd_syserrno.3vnd	:= LINKSRC = vnd_errno.3vnd 
+vnd_strsyserror.3vnd	:= LINKSRC = vnd_errno.3vnd 
+
+# vnd_frameio_read.3vnd
+vnd_frameio_write.3vnd	:= LINKSRC = vnd_frameio_read.3vnd 
+framevec_t.3vnd		:= LINKSRC = vnd_frameio_read.3vnd
+frameio_t.3vnd		:= LINKSRC = vnd_frameio_read.3vnd
+
+# vnd_prop_get.3vnd
+vnd_prop_set.3vnd	:= LINKSRC = vnd_prop_get.3vnd
+
+# vnd_prop_iter.3vnd
+vnd_prop_iter_f.3vnd	:= LINKSRC = vnd_prop_iter.3vnd
+
+# vnd_walk.3vnd
+vnd_walk_cb_f.3vnd	:= LINKSRC = vnd_walk.3vnd
+
+.KEEP_STATE:
+
+include		$(SRC)/man/Makefile.man
+
+install:	$(ROOTMANFILES) $(ROOTMANLINKS)
diff --git a/usr/src/man/man3vnd/vnd_create.3vnd b/usr/src/man/man3vnd/vnd_create.3vnd
new file mode 100644
index 0000000000..d29237a60c
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_create.3vnd
@@ -0,0 +1,280 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_CREATE 3VND "Feb 21, 2014"
+
+.SH NAME
+
+vnd_create, vnd_open, vnd_unlink, vnd_close \- create, open, and destroy
+vnd devices
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+vnd_handle_t *vnd_create(const char *zonename, const char *datalink,
+    const char *linkname, vnd_errno_t *vnderr, int *syserr);
+
+vnd_handle_t *vnd_open(const char *zonename, const char *linkname,
+    vnd_errno_t *vnderr, int *syserr);
+
+int vnd_unlink(vnd_handle_t *vhp);
+
+void vnd_close(vnd_handle_t *vhp);
+.fi
+
+
+.SH DESCRIPTION
+.LP
+These functions create vnd devices, obtain handles to extant vnd
+devices, and close handles to vnd devices, for use with the rest of
+libvnd(3LIB).
+
+.LP
+The vnd_create function creates a new vnd device in the zone specified
+by zonename. The zone name argument may be null, in which case the
+caller's current zone is used instead. The vnd device and data link it
+is created over must both be in the same zone. The datalink argument
+indicates the name of the DLPI data link to create the vnd device over.
+The linkname argument indicates the name of the new vnd device.  The
+linkname argument must be less than VND_NAMELEN characters long,
+excluding the null terminator. It should be an alphanumeric string.  The
+only non-alphanumeric characters allowed are ':', '-', and \'_'.
+Neither the datalink argument nor linkname argument may be NULL. A
+handle to the created device is returned to the caller. Once the
+vnd_create function returns, the device can be subsequently opened with
+a call to vnd_open. The named device persists until a call to vnd_unlink
+or the containing zone is halted. Creating a vnd device requires
+PRIV_SYS_NET_CONFIG as well as PRIV_RAWACCESS. The arguments vnderr and
+syserr are used to obtain errors in the cases where the call to
+vnd_create fails. Both arguments may be NULL pointers, in which case the
+more detailed error information is discarded.
+
+.LP
+The vnd_open function opens an existing vnd device and returns a
+unique handle to that device. The vnd device to open is specified by
+both zonename and linkname. The zonename argument specifies what zone
+to look for the vnd device in. The linkname specifies the name of the
+link. The zonename argument may be NULL. If it is, the current zone is
+used. Similar to vnd_create, the integer values pointed to by the
+arguments vnderr and syserr will be filled in with additional error
+information in the cases where a call to vnd_open fails. Both
+arguments may be NULL to indicate that the error information is not
+requested, though this is not recommended.
+
+.LP
+The vnd_unlink function unlinks the vnd device specified by the vnd
+handle vhp. This unlink is similar to the use of unlink in a file
+system. After a call to unlink, the vnd device will no longer be
+accessible by callers to vnd_open and the name will be available for
+use in vnd_create. However, the device will continue to exist until
+all handles to the device have been closed.
+
+.LP
+The vnd_close function relinquishes the vnd device referenced by the
+handle vhp. After a call to vnd_close, the handle is invalidated and
+must not be used by the consumer again. The act of calling vnd_close
+on a handle does not remove the device. The device is persisted as
+long as vnd_unlink has not been called on the device or the containing
+zone has not been destroyed.
+
+.SH RETURN VALUES
+
+.LP
+Upon successful completion, the functions vnd_create and vnd_open
+return a pointer to a vnd_handle_t. This handle is used for all
+subsequent library operations. If either function fails, then a NULL
+pointer is returned and more detailed error information is filled into
+the integers pointed to by vnderr and syserr. The vnderr and syserr
+correspond to the values that would normally be returned by a call to
+vnd_errno(3VND) and vnd_syserrno(3VND). For the full list of possible
+errors see libvnd(3LIB).
+
+.LP
+The vnd_unlink function returns zero on success and -1 on failure. On
+failure, the vnd and system errnos are updated and available through
+the vnd_errno(3VND) and vnd_syserrno(3VND) functions.
+
+.LP
+The vnd_close function does not return any values nor does it set
+vnderr or syserr. The handle passed to vnd_close can no longer be
+used.
+
+.SH EXAMPLES
+.LP
+Example 1  Creating a device
+.sp
+.LP
+
+The following sample C program shows how to create a vnd device over
+an existing datalink named "net0" that other applications can open
+and use as "vnd0".
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr;
+
+	/* Errors are considered fatal */
+	vhp = vnd_create(NULL, "net0", "vnd0", &vnderr, &syserr);
+
+	if (vhp == NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to create device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to create device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	(void) printf("successfully created vnd0\n");
+	vnd_close(vhp);	
+	return (0);
+}
+.fi
+.in -2
+
+.LP
+Example 2  Opening an existing device in another zone
+.sp
+.LP
+
+The following sample C program opens the device named "vnd1" in the zone
+named "turin" for further use.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr, ret;
+
+	vhp = vnd_open("turin", "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	/*
+	 * Use the device vnd1 with the handle vhp with any of
+	 * the other interfaces documented in libvnd(3LIB) here.
+	 *
+	 * After an arbitrary amount of code, the program will
+	 * set the variable ret with the exit code for the
+	 * program and should execute the following code before
+	 * returning.
+	 */
+	vnd_close(vhp);
+	return (ret);
+}
+.fi
+.in -2
+
+
+.LP
+Example 3  Removing a device
+.sp
+.LP
+
+The following sample C program removes a vnd device named vnd0. This
+program makes it so no additional programs can access the device.
+However, if anyone is actively using it, it will still exist,
+similar to calling unlink(2).
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr, ret;
+
+	vhp = vnd_open(NULL, "vnd0", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	if (vnd_unlink(vhp) != 0) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to unlink device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to unlink device: %s",
+			    vnd_strerror(vnderr));
+		ret = 1;
+	} else {
+		(void) printf("successfully unlinked vnd0!\n");
+		ret = 0;
+	}
+
+	vnd_close(vhp);
+	return (ret);
+}
+.fi
+.in -2
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	See "THREADING" in libvnd(3LIB)
+.TE
+
+.SH SEE ALSO
+
+libvnd(3LIB), vnd_errno(3VND), vnd_syserrno(3VND), attributes(5), privileges(5)
diff --git a/usr/src/man/man3vnd/vnd_errno.3vnd b/usr/src/man/man3vnd/vnd_errno.3vnd
new file mode 100644
index 0000000000..ddd6126dd1
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_errno.3vnd
@@ -0,0 +1,170 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_ERRNO 3VND "Feb 21, 2014"
+
+.SH NAME
+
+vnd_errno, vnd_syserrno, vnd_strerror, vnd_strsyserror \- obtain and
+translate vnd errors
+
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+uint32_t vnd_errno(vnd_handle_t *vhp);
+
+const char *vnd_strerror(vnd_errno_t err);
+
+int vnd_syserrno(vnd_handle_t *vhp);
+
+const char *vnd_strsyserror(int syserr);
+.fi
+
+.SH DESCRIPTION
+
+.LP
+The libvnd(3LIB) library supports a complementary array of errors that
+give more specific error information than the traditional set of
+system errors available via errno(3C). When an error occurs, consumers
+should call the vnd_errno function first and check its value. If the
+value of the vnd_errno_t is VND_E_SYS, then the system errno should be
+checked. If the vnd_errno_t is not VND_E_SYS, then the contents of the
+system errno returned from vnd_syserrno are undefined. Both the vnd
+and system errors are only valid for a given handle after a libvnd
+library function returned an error and before another libvnd library
+function is called on the same handle. The act of making an additional
+function call with the same vnd_handle_t invalidates any prior vnd or
+system error numbers. For the full list of valid vnd errors see
+libvnd(3LIB). For the full list of valid system errors, see Intro(2).
+
+.LP
+The vnd_errno and vnd_syserrno functions retrieve the most recent vnd
+and syserr error number respectively from a vnd handle vhp.
+
+.LP
+The vnd_strerror function translates a vnd_errno_t err to a
+corresponding string and returns a pointer to that constant string.
+
+.LP
+The vnd_syserrno function is analogous to the vnd_strerror function,
+except that it translates a system error back to a string.
+
+
+.SH RETURN VALUES
+
+.LP
+The vnd_errno function returns a vnd_errno_t which contains the vnd
+error information.
+
+.LP
+The vnd_syserror function returns an integer which contains the system
+error information. These values are the same as those returned by
+errno(3C).
+
+.LP
+The vnd_strerror function returns a pointer to a constant string. If
+the error passed in is unknown, the string "unknown error" is
+returned.
+
+.LP
+The vnd_strsyserror function returns a pointer to the translated
+constant string. If an unknown error number is passed, it returns the
+string "Unknown error". If an error occurs, it returns a NULL pointer.
+
+.SH EXAMPLES
+
+.LP
+Example 1  Obtaining errors from a vnd_handle_t
+
+.sp
+.LP
+The following sample C function, which can be incorporated into a larger
+program, shows how to obtain the vnd and system errors from a
+vnd_handle_t after a vnd interface on a handle failed.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+
+static void
+print_errnos(vnd_handle_t *vhp)
+{
+	vnd_errno_t vnderr;
+	int syserr;
+
+	vnderr = vnd_errno(vhp);
+	syserr = vnd_syserrno(vhp);
+
+	(void) printf("vnd err: %d, sys err: %d\n",
+	    vnderr, syserr);
+}
+.fi
+.in -2
+
+.LP
+Example 2   A perror-like function
+
+.sp
+.LP
+The following sample C function which can be incorporated into a
+larger program shows how to write a perror-like function to print
+out error messages for a vnd device.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+
+static void
+sample_perror(const char *msg, vnd_error_t vnderr, int syserr)
+{
+	(void) fprintf(stderr, "%s: %s", msg,
+	    vnderr != VND_E_SYS ? vnd_strerror(vnderr) :
+	    vnd_strsyserror(syserr));
+}
+.fi
+.in -2
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	See below
+.TE
+
+.LP
+The MT-Level of the functions vnd_strerror and vnd_strsyserror is
+MT-Safe. See "THREADING" in libvnd(3LIB) for a discussion of the
+MT-Level of vnd_errno and vnd_syserrno.
+
+
+.SH SEE ALSO
+
+Intro(2), errno(3C), libvnd(3LIB), attributes(5)
diff --git a/usr/src/man/man3vnd/vnd_frameio_read.3vnd b/usr/src/man/man3vnd/vnd_frameio_read.3vnd
new file mode 100644
index 0000000000..5fc65c96a3
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_frameio_read.3vnd
@@ -0,0 +1,705 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_FRAMEIO_READ 3VND "Mar 06, 2014"
+
+.SH NAME
+
+vnd_frameio_read, vnd_frameio_write \- perform framed I/O to a vnd device
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+int vnd_frameio_read(vnd_handle_t *vhp, frameio_t *fiop);
+
+int vnd_frameio_write(vnd_handle_t *vhp, frameio_t *fiop);
+.fi
+
+.SH DESCRIPTION
+.LP
+Framed I/O is a general means to manipulate data that is inherently
+framed, meaning that there is a maximum frame size, but the data may
+often be less than that size. As an example, an Ethernet device's MTU
+describes the maximum frame size, but the size of an individual frame
+is often much less. You can read a single frame at a time, or you can
+read multiple frames in a single call.
+
+In addition, framed I/O allows the consumer to break individual frames
+into a series of vectors. This is analogous to the use of an iovec(9S)
+with readv(2) and writev(2).
+
+vnd_frameio_read performs a framed I/O read of the device represented by
+the handle vhp, with the framed I/O data described by fiop.
+vnd_frameio_write works in the same manner, except performing a write
+instead of a read.
+
+.LP
+The basic vector component of the frameio_t is the framevec_t. Each
+framevec_t represents a single vector entry. An array of these is
+present in the frameio_t. The framevec_t structure has the following
+members:
+
+.in +2
+.nf
+void		*fv_buf		/* data buffer */
+size_t	fv_buflen;	/* total size of buffer */
+size_t	fv_actlen;	/* amount of buffer consumed */
+.fi
+.in -2
+
+.LP
+The fv_buf member points to a buffer which contains the data for this
+individual vector. When reading, data is consumed from fv_buf. When
+writing, data is written into fv_buf.
+
+The fv_buflen should indicate the total amount of data that is in the
+buffer. When reading, it indicates the size of the buffer. It must be
+set prior to calling vnd_frameio_read(). When writing, it indicates the
+amount of data that is valid in the buffer.
+
+The fv_actlen is a read-only member. It is set on successful return of
+the functions vnd_frameio_read and vnd_frameio_write. When reading, it
+is updated with the amount of data that was read into fv_buf. When
+writing, it is instead updated with the amount of data from fv_buf that
+was actually consumed. Generally when writing data, a framevec_t will
+either be entirely consumed or it will not be consumed at all.
+
+
+.LP
+A series of framevec_t's is encapsulated in a frameio_t. The frameio_t
+structure has the following members:
+
+.in +2
+.nf
+uint_t		fio_version;	/* current version */
+uint_t		fio_nvpf;		/* number of vectors in one frame */
+uint_t		fio_nvecs;	/* The total number of vectors */
+framevec_t	fio_vecs[];	/* vectors */
+.fi
+.in -2
+
+.LP
+The fio_version member represents the current version of the frameio_t.
+The fio_version should be set to the macro FRAMEIO_CURRENT_VERSION,
+which is currently 1.
+
+The members fio_nvpf and fio_nvecs describe the number of frames that
+exist. fio_nvecs describes the total number of vectors that are present
+in fio_vecs.  The upper bound on this is described by FRAMEIO_NVECS_MAX
+which is currently 32. fio_nvpf describe the number of vectors that
+should be used to make up each frame. By setting fio_vecs to be an even
+multiple of fio_nvpf, multiple frames can be read or written in a single
+call.
+
+After a call to vnd_frameio_read or vnd_frameio_write fio_nvecs is
+updated with total number of vectors read or written to. This value can
+be divided by fio_nvpf to determine the total number of frames that were
+written or read.
+
+.LP
+Each frame can be broken down into a series of multiple vectors. As an
+example, someone might want to break Ethernet frames into mac headers
+and payloads. The value of fio_nvpf would be set to two, to indicate
+that a single frame consists of two different vector components. The
+member fio_nvecs describes the total number of frames. As such, the
+value of fio_vecs divided by fio_nvpf describes the total number of
+frames that can be consumed in one call. As a result of this, fio_nvpf
+must evenly divide fio_vecs. If fio_nvpf is set to two and
+fio_nvecs is set to ten, then a total of five frames can be processed
+at once, each frame being broken down into two different vector
+components.
+
+A given frame will never overflow the number of vectors described by
+fio_nvpf. Consider the case where each vector component has a buffer
+sized to 1518 bytes, fio_nvpf is set to one, and fio_nvecs is set to
+three. If a call to vnd_frameio_read is made and four 500 byte Ethernet
+frames come in, then each frame will be mapped to a single vector. The
+500 bytes will be copied into fio_nvecs[i]->fio_buf and
+fio_nvecs[i]->fio_actlen will be set to 500. To contrast this, if
+readv(2) had been called, the first three frames would all be in the
+first iov and the fourth frame's first eight bytes would be in the first
+iov and the remaining in the second.
+
+.LP
+The user must properly initialize fio_nvecs framevec_t's worth of the
+fio_vecs array. When multiple vectors comprise a frame, fv_buflen data
+is consumed before moving onto the next vector. Consider the case
+where the user wants to break a vector into three different
+components, an 18 byte vector for an Ethernet VLAN header, a 20 byte
+vector for an IPv4 header, and a third 1500 byte vector for the
+remaining payload. If a frame was received that only had 30 bytes,
+then the first 18 bytes would fill up the first vector, the remaining
+12 bytes would fill up the IPv4 header. If instead a 524 byte frame
+came in, then the first 18 bytes would be placed in the first vector,
+the next 24 bytes would be placed in the next vector, and the remaining
+500 bytes in the third.
+
+.LP
+The functions vnd_frameio_read and vnd_frameio_write operate in both
+blocking and non-blocking mode. If either O_NONBLOCK or O_NDELAY have
+been set on the file descriptor, then the I/O will behave in
+non-blocking mode. When in non-blocking mode, if no data is available
+when vnd_frameio_read is called, EAGAIN is returned. When
+vnd_frameio_write is called in non-blocking mode, if sufficient buffer
+space to hold all of the output frames is not available, then
+vnd_frameio_write will return EAGAIN. To know when the given vnd device
+has sufficient space, the device fires POLLIN/POLLRDNORM when data is
+available for read and POLLOUT/POLLRDOUT when space in the buffer has
+opened up for write. These events can be watched for through
+port_associate(3C) and similar routines with a file descriptor returned
+from vnd_polfd(3VND).
+
+.LP
+When non-blocking mode is disabled, calls to vnd_frameio_read will
+block until some amount of data is available. Calls to
+vnd_frameio_write will block until sufficient buffer space is
+available.
+
+.LP
+Similar to read(2) and write(2), vnd_frameio_read and
+vnd_frameio_write make no guarantees about the ordering of data when
+multiple threads simultaneously call the interface. While the data
+itself will be atomic, the ordering of multiple simultaneous calls is
+not defined.
+
+.SH RETURN VALUES
+
+.LP
+The vnd_frameio_read function returns zero on success. The member
+fio_nvecs of fiop is updated with the total number of vectors that had
+data read into them. Each updated framevec_t will have the buffer
+pointed to by fv_buf filled in with data, and fv_actlen will be
+updated with the amount of valid data in fv_buf.
+
+.LP
+The vnd_frameio_write function returns zero on success. The member
+fio_nvecs of fiop is updated with the total number of vectors that
+were written out to the underlying datalink. The fv_actlen of each
+vector is updated to indicate the amount of data that was written from
+that buffer.
+
+.LP
+On failure, both vnd_frameio_read and vnd_frameio_write return -1. The
+vnd and system error numbers are updated and available via
+vnd_errno(3VND) and vnd_syserrno(3VND). See ERRORS below for a list of
+errors and their meaning.
+
+
+.SH ERRORS
+.LP
+The functions vnd_frameio_read and vnd_frameio_write always set the
+vnd error to VND_E_SYS. The following system errors will be
+encountered:
+
+.sp
+.ne 2
+.na
+EAGAIN
+.ad
+.RS 10n
+Insufficient system memory was available for the operation.
+.sp
+Non-blocking mode was enabled and during the call to vnd_frameio_read,
+no data was available. Non-blocking mode was enabled and during the call
+to vnd_frameio_write, insufficient buffer space was available.
+.RE
+
+.sp
+.ne 2
+.na
+ENXIO
+.ad
+.RS 10n
+The vnd device referred to by vhp is not currently attached to an
+underlying data link and cannot send data.
+.RE
+
+.sp
+.ne 2
+.na
+EFAULT
+.ad
+.RS 10n
+The fiop argument points to an illegal address or the fv_buf members of
+the framevec_t's associated with the fiop member fio_vecs point to
+illegal addresses.
+.RE
+
+.sp
+.ne 2
+.na
+EINVAL
+.ad
+.RS 10n
+The fio_version member of fiop was unknown, the number of vectors
+specified by fio_nvecs is zero or greater than FRAMEIO_NVECS_MAX,
+fio_nvpf equals zero, fio_nvecs is not evenly divisible by fio_nvpf, or
+a buffer in fio_vecs[] has set fv_buf or fv_buflen to zero.
+.RE
+
+
+.sp
+.ne 2
+.na
+EINTR
+.ad
+.RS 10n
+A signal was caught during vnd_frameio_read or vnd_frameio_write, and no
+data was transferred.
+.RE
+
+
+.sp
+.ne 2
+.na
+EOVERFLOW
+.ad
+.RS 10n
+During vnd_frameio_read, the size of a frame specified by fiop->fio_nvpf
+and fiop->fio_vecs[].fv_buflen cannot contain a frame.
+.sp
+In a ILP32 environment, more data than UINT_MAX would be set in
+fv_actlen.
+.RE
+
+
+.sp
+.ne 2
+.na
+ERANGE
+.ad
+.RS 10n
+During vnd_frameio_write, the size of a frame is less than the device's
+minimum transmission unit or it is larger than the size of the maximum
+transmission unit.
+.RE
+
+
+.SH EXAMPLES
+
+.LP
+Example 1    Read a single frame with a single vector
+
+.sp
+.LP
+The following sample C program opens an existing vnd device named
+"vnd0" in the current zone and performs a blocking read of a single
+frame from it.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr, i;
+	frameio_t *fiop;
+
+	fiop = malloc(sizeof (frameio_t) + sizeof (framevec_t));
+	if (fiop == NULL) {
+		perror("malloc frameio_t");
+		return (1);
+	}
+	fiop->fio_version = FRAMEIO_CURRENT_VERSION;
+	fiop->fio_nvpf = 1;
+	fiop->fio_nvecs = 1;
+	fiop->fio_vecs[0].fv_buf = malloc(1518);
+	fiop->fio_vecs[0].fv_buflen = 1518;
+	if (fiop->fio_vecs[0].fv_buf == NULL) {
+		perror("malloc framevec_t.fv_buf");
+		free(fiop);
+		return (1);
+	}
+
+	vhp = vnd_open(NULL, "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		free(fiop->fio_vecs[0].fv_buf);
+		free(fiop);
+		return (1);
+	}
+
+	if (frameio_read(vhp, fiop) != 0) {
+		vnd_errno_t vnderr = vnd_errno(vhp);
+		int syserr = vnd_syserrno(vhp);
+
+		/* Most consumers should retry on EINTR */
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to read: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to read: %s",
+			    vnd_strerror(vnderr));
+		vnd_close(vhp);
+		free(fiop->fio_vecs[0].fv_buf);
+		free(fiop);
+		return (1);
+	}
+
+	
+	/* Consume the data however it's desired */
+	(void) printf("received %d bytes\n", fiop->fio_vecs[0].fv_actlen);
+	for (i = 0; i < fiop->fio_vecs[0].fv_actlen)
+		(void) printf("%x ", fiop->fio_vecs[0].fv_buf[i]);
+
+	vnd_close(vhp);
+	free(fiop->fio_vecs[0].fv_buf);
+	free(viop);
+	return (0);
+}
+.fi
+.in -2
+
+.LP
+Example 2    Write a single frame with a single vector
+.sp
+.LP
+The following sample C program opens an existing vnd device named
+"vnd0" in the current zone and performs a blocking write of a single
+frame to it.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+#include <string.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr;
+	frameio_t *fiop;
+
+	fiop = malloc(sizeof (frameio_t) + sizeof (framevec_t));
+	if (fiop == NULL) {
+		perror("malloc frameio_t");
+		return (1);
+	}
+	fiop->fio_version = FRAMEIO_CURRENT_VERSION;
+	fiop->fio_nvpf = 1;
+	fiop->fio_nvecs = 1;
+	fiop->fio_vecs[0].fv_buf = malloc(1518);
+	if (fiop->fio_vecs[0].fv_buf == NULL) {
+		perror("malloc framevec_t.fv_buf");
+		free(fiop);
+		return (1);
+	}
+
+	/*
+	 * Fill in your data however you desire. This is an entirely
+	 * invalid frame and while the frameio write may succeed, the
+	 * networking stack will almost certainly drop it.
+	 */
+	(void) memset(fiop->fio_vecs[0].fv_buf, 'r', 1518);
+	fiop->fio_vecs[0].fv_buflen = 1518;
+
+	vhp = vnd_open(NULL, "vnd0", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		free(fiop->fio_vecs[0].fv_buf);
+		free(fiop);
+		return (1);
+	}
+
+	if (frameio_write(vhp, fiop) != 0) {
+		/* Most consumers should retry on EINTR */
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to write: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to write: %s",
+			    vnd_strerror(vnderr));
+		vnd_close(vhp);
+		free(fiop->fio_vecs[0].fv_buf);
+		free(fiop);
+		return (1);
+	}
+
+	
+	(void) printf("wrote %d bytes\n", fiop->fio_vecs[0].fv_actlen);
+
+	vnd_close(vhp);
+	free(fiop->fio_vecs[0].fv_buf);
+	free(viop);
+	return (0);
+}
+.fi
+.in -2
+
+.LP
+Example 3    Read frames comprised of multiple vectors
+.sp
+.LP
+The following sample C program is similar to example 1, except instead
+of reading a single frame consisting of a single vector it reads
+multiple frames consisting of two vectors. The first vector has room for
+an 18 byte VLAN enabled Ethernet header and the second vector has room
+for a 1500 byte payload.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr, i, nframes;
+	frameio_t *fiop;
+
+	/* Allocate enough framevec_t's for 5 frames */
+	fiop = malloc(sizeof (frameio_t) + sizeof (framevec_t) * 10);
+	if (fiop == NULL) {
+		perror("malloc frameio_t");
+		return (1);
+	}
+	fiop->fio_version = FRAMEIO_CURRENT_VERSION;
+	fiop->fio_nvpf = 2;
+	fiop->fio_nvecs = 10;
+	for (i = 0; i < 10; i += 2) {
+		fiop->fio_vecs[i].fv_buf = malloc(18);
+		fiop->fio_vecs[i].fv_buflen = 18;
+		if (fiop->fio_vecs[i].fv_buf == NULL) {
+			perror("malloc framevec_t.fv_buf");
+			/* Perform appropriate memory cleanup */
+			return (1);
+		}
+		fiop->fio_vecs[i+1].fv_buf = malloc(1500);
+		fiop->fio_vecs[i+1].fv_buflen = 1500;
+		if (fiop->fio_vecs[i+1].fv_buf == NULL) {
+			perror("malloc framevec_t.fv_buf");
+			/* Perform appropriate memory cleanup */
+			return (1);
+		}
+	}
+
+	vhp = vnd_open(NULL, "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		/* Perform appropriate memory cleanup */
+		return (1);
+	}
+
+	if (frameio_read(vhp, fiop) != 0) {
+		/* Most consumers should retry on EINTR */
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to read: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to read: %s",
+			    vnd_strerror(vnderr));
+		vnd_close(vhp);
+		/* Perform appropriate memory cleanup */
+		return (1);
+	}
+
+	/* Consume the data however it's desired */
+	nframes = fiop->fio_nvecs / fiop->fio_nvpf;
+	(void) printf("consumed %d frames!\n", nframes);
+	for (i = 0; i < nframes; i++) {
+		(void) printf("received %d bytes of Ethernet Header\n",
+		    fiop->fio_vecs[i].fv_actlen);
+		(void) printf("received %d bytes of payload\n",
+		    fiop->fio_vecs[i+1].fv_actlen);
+	}
+
+	vnd_close(vhp);
+	/* Do proper memory cleanup */
+	return (0);
+}
+.fi
+.in -2
+
+.LP
+Example 4    Perform non-blocking reads of multiple frames with a
+single vector
+.sp
+.LP
+In this sample C program, opens an existing vnd device named "vnd0" in
+the current zone, ensures that it is in non-blocking mode, and uses
+event ports to do device reads.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+#include <port.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/tpyes.h>
+#include <fcntl.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr, i, nframes, port, vfd;
+	frameio_t *fiop;
+
+	port = port_create();
+	if (port < 0) {
+		perror("port_create");
+		return (1);
+	}
+	/* Allocate enough framevec_t's for 10 frames */
+	fiop = malloc(sizeof (frameio_t) + sizeof (framevec_t) * 10);
+	if (fiop == NULL) {
+		perror("malloc frameio_t");
+		(void) close(port);
+		return (1);
+	}
+	fiop->fio_version = FRAMEIO_CURRENT_VERSION;
+	fiop->fio_nvpf = 1;
+	fiop->fio_nvecs = 10;
+	for (i = 0; i < 10; i++) {
+		fiop->fio_vecs[i].fv_buf = malloc(1518);
+		fiop->fio_vecs[i].fv_buflen = 1518;
+		if (fiop->fio_vecs[i].fv_buf == NULL) {
+			perror("malloc framevec_t.fv_buf");
+			/* Perform appropriate memory cleanup */
+			(void) close(port);
+			return (1);
+		}
+	}
+
+	vhp = vnd_open(NULL, "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		/* Perform appropriate memory cleanup */
+		(void) close(port);
+		return (1);
+	}
+	vfd = vnd_pollfd(vhp);
+	if (fcntl(fd, F_SETFL, O_NONBLOCK) != 0) {
+		(void) fprintf(stderr, "failed to enable non-blocking mode: %s",
+		    strerrror(errno));
+	}
+
+	for (;;) {
+		port_event_t pe;
+
+		if (port_associate(port, PORT_SOURCE_FD, vfd, POLLIN,
+		    vhp) != 0) {
+			perror("port_associate");
+			vnd_close(vhp);
+			/* Perform appropriate memory cleanup */
+			(void) close(port);
+			return (1);
+		}
+
+		if (port_get(port, &pe, NULL) != 0) {
+			if (errno == EINTR)
+				continue;
+			perror("port_associate");
+			vnd_close(vhp);
+			/* Perform appropriate memory cleanup */
+			(void) close(port);
+			return (1);
+		}
+
+		/*
+		 * Most real applications will need to compare the file
+		 * descriptor and switch on it. In this case, assume
+		 * that the fd in question that is readable is 'vfd'.
+		 */
+		if (frameio_read(pe.portev_user, fiop) != 0) {
+			vnd_errno_t vnderr = vnd_errno(vhp);
+			int syserr = vnd_syserrno(vhp);
+
+			if (vnderr == VND_E_SYS && (syserr == EINTR ||
+			    syserr == EAGAIN))
+				continue;
+			(void) fprintf(stderr, "failed to get read: %s",
+			    vnd_strsyserror(vnderr));
+			vnd_close(vhp);
+			/* Perform appropriate memory cleanup */
+			(void) close(port);
+			return (1);
+		}
+
+		/* Consume the data however it's desired */
+		nframes = fiop->fio_nvecs / fiop->fio_nvpf;
+		for (i = 0; i < nframes; i++) {
+			(void) printf("frame %d is %d bytes large\n", i,
+			    fiop->fio_vecs[i].fv_actlen);
+		}
+
+	}
+
+	vnd_close(vhp);
+	/* Do proper memory cleanup */
+	return (0);
+}
+.fi
+.in -2
+
+.SH ATTRIBUTES
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	See "THREADING" in libvnd(3LIB)
+.TE
+
+
+.SH SEE ALSO
+
+Intro(2), getmsg(2), read(2), readv(2), write(2), writev(2),
+libvnd(3VND), vnd_errno(3VND), vnd_pollfd(3VND), vnd_syserrno(3VND),
+iovec(9S)
diff --git a/usr/src/man/man3vnd/vnd_pollfd.3vnd b/usr/src/man/man3vnd/vnd_pollfd.3vnd
new file mode 100644
index 0000000000..500d3bac99
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_pollfd.3vnd
@@ -0,0 +1,155 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_POLLFD 3VND "Feb 21, 2014"
+
+.SH NAME
+
+vnd_pollfd \- get file descriptor for polling
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+int vnd_pollfd(vnd_handle_t *vhp);
+.fi
+
+.SH DESCRIPTION
+.LP
+The vnd_pollfd() function returns an integer id which corresponds to
+the file descriptor that represents the underlying device that is
+associated with the vnd handle vhp. This file descriptor is suitable
+for use with port_associate(3C) and similar polling techniques such as
+poll(2). Use of the file descriptor outside of these uses may cause
+undocumented behavior from the rest of the library.
+
+.LP
+The file descriptor in question is still managed by libvnd. The caller
+must not call close(2) on it. Once vnd_close(3VND) has been called,
+any further use of the file descriptor is undefined behavior.
+
+
+.SH RETURN VALUES
+.LP
+The function returns the integer id of the file descriptor that
+corresponds to the underlying vnd device.
+
+.SH EXAMPLES
+
+.LP
+Example 1   Use event ports for vnd notifications
+.sp
+.LP
+The following sample C program shows how to use the vnd_pollfd
+function with event ports to be notified whenever there is data
+available to be read. This program assumes that a vnd device named
+"vnd0" exists in the current zone. For an example of creating the
+device, see Example 1 in vnd_create(3VND).
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <port.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <fcntl.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int port, syserr, vfd, ret;
+
+	port = port_create();
+	if (port < 0) {
+		perror("port_create");
+		return (1);	
+	}
+
+	vhp = vnd_open(NULL, "vnd0", &vnderr, &syserr);
+	if (vhp == NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		(void) close(port);
+		return (1);
+	}
+
+	vfd = vnd_pollfd(vhp);
+	if (fcntl(vfd, F_SETFL, O_NONBLOCK) != 0) {
+		perror("fcntl");
+		vnd_close(vhp);
+		(void) close(port);
+		return (1);
+	}
+
+	if (port_associate(port, PORT_SOURCE_FD, vfd, POLLIN, NULL) != 0) {
+		perror("port_associate");
+		vnd_close(vhp);
+		(void) close(port);
+		return (1);
+	}
+
+	for (;;) {
+		port_event_t pe;
+
+
+		if (port_get(port, &pe, NULL) != 0) {
+			if (errno == EINTR)
+				continue;
+			perror("port_get");
+			vnd_close(vhp);
+			(void) close(port);
+			return (1);
+		}
+
+		/*
+		 * Read the data with vnd_frameio_read(3VND) and
+		 * optionally break out of the loop or continue to the
+		 * next iteration and reassociate vfd with the event
+		 * port.
+		 */
+	}	
+}
+.fi
+.in -2
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	See "THREADING" in libvnd(3LIB)
+.TE
+
+.SH SEE ALSO
+
+close(2), poll(2), port_create(3C), libvnd(3LIB), vnd_close(3VND)
diff --git a/usr/src/man/man3vnd/vnd_prop_get.3vnd b/usr/src/man/man3vnd/vnd_prop_get.3vnd
new file mode 100644
index 0000000000..e47698c85e
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_prop_get.3vnd
@@ -0,0 +1,242 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_PROP_GET 3VND "Feb 21, 2014"
+
+.SH NAME
+
+vnd_prop_get, vnd_prop_set \- get and set vnd properties
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+int vnd_prop_get(vnd_handle_t *vhp, vnd_prop_t prop, void *buf, size_t len);
+
+int vnd_prop_set(vnd_handle_t *vhp, vnd_prop_t prop, void *buf, size_t len);
+.fi
+
+.SH DESCRIPTION
+.LP
+The vnd_prop_get and vnd_prop_set functions are used to retrieve
+and set property values on the vnd_handle_t referred to by vhp. The
+property to get or set is specified by the argument prop. The
+argument buf and the size of buf, in len, should be a pointer to the
+appropriate structure for the property as defined in libvnd(3LIB).
+
+.LP
+All of the supported properties are listed and described in the
+libvnd(3LIB) manual page.
+
+
+.SH RETURN VALUES
+.LP
+On success, the vnd_prop_get and vnd_prop_set functions return zero.
+On failure, they return -1 and additional error information is
+available through vnd_errno(3VND) and vnd_syserrno(3VND).
+
+.LP
+When vnd_prop_get returns successfully, the contents of buf are
+filled in with the value of the corresponding property. The contents
+of buf should not change across a call to vnd_prop_set.
+
+.SH EXAMPLES
+
+.LP
+Example 1   Getting the value of the rxbuf property
+.LP
+The following sample C program retrieves the value of the
+rxbuf property and prints it to standard out.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr;
+	vnd_prop_buf_t vpb;
+
+	vhp = vnd_open(NULL, "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	if (vnd_prop_get(vhp, VND_PROP_RXBUF, &vpn, sizeof (vpn)) != 0) {
+		vnderr = vnd_errno(vhp);
+		syserr = vnd_syserrno(vhp);
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to get VND_PROP_RXBUF: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to get VND_PROP_RXBUF: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	(void) printf("recieve buffer size is %d bytes\n", vpb.vpb_size);
+
+	vnd_close(vnd);
+	return (0);
+}
+.fi
+.in -2
+
+.LP
+EXAMPLE 2    Setting a property
+.LP
+This sample C program sets the property VND_PROP_RXBUF to the value of
+4200 bytes.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr;
+	vnd_prop_buf_t vpb;
+
+	vhp = vnd_open(NULL, "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	vpb.vpb_size = 4200;
+	if (vnd_prop_set(vhp, VND_PROP_RXBUF, &vpb, sizeof (vpb)) != 0) {
+		vnderr = vnd_errno(vhp);
+		syserr = vnd_syserrno(vhp);
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to set VND_PROP_RXBUF: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to set VND_PROP_RXBUF: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	(void) printf("successfully set VND_PROP_RXBUF to 4200\n");
+
+	vnd_close(vnd);
+	return (0);
+}
+.fi
+.in -2
+
+.LP
+Example 3    Setting a property to the value of another.
+.LP
+In this sample C program, we set the VND_PROP_TXBUF to the maximum
+allowable size as determined by the read-only property VND_PROP_MAXBUF.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr;
+	vnd_prop_buf_t vpb;
+
+	vhp = vnd_open(NULL, "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	if (vnd_prop_get(vhp, VND_PROP_MAXBUF, &vpb, sizeof (vpb)) != 0) {
+		vnderr = vnd_errno(vhp);
+		syserr = vnd_syserrno(vhp);
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to get VND_PROP_MAXBUF: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to get VND_PROP_MAXBUF: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	if (vnd_prop_set(vhp, VND_PROP_TXBUF, &vpb, sizeof (vpb)) != 0) {
+		vnderr = vnd_errno(vhp);
+		syserr = vnd_syserrno(vhp);
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to set VND_PROP_TXBUF: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to set VND_PROP_TXBUF: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	(void) printf("successfully set VND_PROP_TXBUF to %d\n", vpb.vpb_size);
+
+	vnd_close(vnd);
+	return (0);
+}
+.fi
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	See "THREADING" in libvnd(3LIB)
+.TE
+
+.SH SEE ALSO
+libvnd(3VND), vnd_errno(3VND, vnd_syserrno(3VND)
diff --git a/usr/src/man/man3vnd/vnd_prop_iter.3vnd b/usr/src/man/man3vnd/vnd_prop_iter.3vnd
new file mode 100644
index 0000000000..29221734c5
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_prop_iter.3vnd
@@ -0,0 +1,148 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_PROP_ITER 3VND "Feb 21, 2014"
+
+.SH NAME
+
+vnd_prop_iter \- iterate vnd properties
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+typedef int (vnd_prop_iter_f)(vnd_handle_t *vhp, vnd_prop_t prop,
+    void *cbarg);
+
+int vnd_prop_iter(vnd_handle_t *vhp, vnd_prop_iter_f cb,
+    void *arg);
+.fi
+
+.SH DESCRIPTION
+.LP
+The vnd_prop_iter function iterates over all the available properties
+for the vnd handle vhp and calls the user supplied callback function
+cb. The argument arg is passed directly to the callback function.
+
+.LP
+The function specified by cb receives three arguments. The first, vhp,
+is the same vnd library handle that was passed to vnd_prop_iter. During
+the callback, the consumer should not call vnd_close(3VND). Doing so
+will lead to undefined and undocumented behavior. The second argument,
+prop, is the current property. While vnd_prop_iter guarantees that all
+properties will be recieved, it does not guarantee the order of them.
+The final argument, cbarg, is the same argument that the caller passed
+in during arg.
+
+.LP
+The return value of the callback function cb indicates whether or not
+property iteration should continue. To continue iteration, the
+function cb should return zero. Otherwise, to stop property iteration
+it should return non-zero.
+
+.SH RETURN VALUES
+
+.LP
+On success, the function vnd_prop_iter returns zero. If the callback
+function returned non-zero to terminate iteration, vnd_prop_iter will
+instead return one. In the case of library failure, vnd_prop_iter will
+return -1. In such cases, the vnd and system errors will be updated
+and available via vnd_errno(3VND) and vnd_syserrno(3VND).
+
+.SH EXAMPLES
+
+.LP
+Example 1    Print writeable properties
+
+.LP
+The following sample C program walks over every vnd property and
+prints out whether the property is read-only or read-write for the
+vnd device "vnd1" in the current zone.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static int
+print_prop(vnd_handle_t *vhp, vnd_prop_t prop, void *unused)
+{
+	boolean_t canwrite;
+
+	if (vnd_prop_writeable(vhp, &canwrite) != 0)
+		abort();
+
+	(void) printf("prop %d is %s", prop, canwrite == B_TRUE ? "rw" : "r-");
+	return (0);
+}
+
+int
+main(void)
+{
+	vnd_handle_t *vhp;
+	vnd_errno_t vnderr;
+	int syserr;
+
+	vhp = vnd_open(NULL, "vnd1", &vnderr, &syserr);
+	if (vhp != NULL) {
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	if (vnd_prop_iter(vhp, print_prop, NULL) != 0) {
+		vnderr = vnd_errno(vhp);
+		syserr = vnd_syserrno(vhp);
+		if (vnderr == VND_E_SYS)
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strsyserror(syserr));
+		else
+			(void) fprintf(stderr, "failed to open device: %s",
+			    vnd_strerror(vnderr));
+		return (1);
+	}
+
+	vnd_close(vnd);
+	return (0);
+}
+.fi
+.in -2
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	See "THREADING" in libvnd(3LIB)
+.TE
+
+libvnd(3LIB), vnd_close(3VND), vnd_errno(3VND), vnd_syserrno(3VND)
diff --git a/usr/src/man/man3vnd/vnd_prop_writeable.3vnd b/usr/src/man/man3vnd/vnd_prop_writeable.3vnd
new file mode 100644
index 0000000000..c23414718b
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_prop_writeable.3vnd
@@ -0,0 +1,101 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_PROP_WRITEABLE 3VND "Feb 21, 2014"
+
+.SH NAME
+
+vnd_prop_writeable \- determine if a vnd property can be updated
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+int vnd_prop_writeable(vnd_prop_t prop, boolean_t *wp);
+.fi
+
+
+.SH DESCRIPTION
+.LP
+The vnd_prop_writeable function is used as a programmatic means to
+determine whether a given vnd property is writeable or not. The
+property to check is specified in prop and should be from the list
+described in libvnd(3VND). The argument wp is a pointer to a boolean_t
+which will be updated upon the successful completion of the function.
+The argument wp must be a valid pointer. If a property is writeable
+than the value pointed to by wp is set to B_TRUE. If the property is
+read-only, then the value is set to B_FALSE.
+
+
+.SH RETURN VALUES
+.LP
+On success, vnd_prop_writeable returns zero and the value pointed to
+by wp is updated with whether the property is writeable. If the
+property prop does not exist, then vnd_prop_writeable will return -1.
+
+.SH EXAMPLES
+.LP
+Example 1    Check whether the property VND_PROP_TXBUF is writable
+.LP
+The following sample C program checks whether the vnd property
+VND_PROP_TXBUF is writeable or not.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int
+main(void)
+{
+	boolean_t canwrite;
+
+	if (vnd_prop_writeable(VND_PROP_TXBUF, &prop) != 0)
+		abort();
+
+	if (canwrite == B_TRUE)
+		(void) printf("VND_PROP_TXBUF is writeable\n");
+	else
+		(void) printf("VND_PROP_TXBUF is read only\n");
+
+	return (0);
+}
+.fi
+.in -2
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	MT-Safe
+.TE
+
+.SH SEE ALSO
+
+vndadm(1M), libvnd(3VND)
diff --git a/usr/src/man/man3vnd/vnd_walk.3vnd b/usr/src/man/man3vnd/vnd_walk.3vnd
new file mode 100644
index 0000000000..bed53130d3
--- /dev/null
+++ b/usr/src/man/man3vnd/vnd_walk.3vnd
@@ -0,0 +1,155 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND_CREATE 3VND "Feb 21, 2014"
+
+.SH NAME
+
+vnd_walk \- walk all vnd devices
+
+
+.SH SYNOPSIS
+
+.LP
+.nf
+cc [ flag... ] file... -lvnd [ library... ]
+#include <libvnd.h>
+
+typedef int (*vnd_walk_cb_f)(vnd_info_t *viip, void *cbarg);
+
+int vnd_walk(vnd_walk_cb_t cb, void *arg, vnd_errno_t *vnderr, int *syserr);
+.fi
+
+
+.SH DESCRIPTION
+.LP
+The vnd_walk() function fires the callback function cb once for every
+vnd device that is visible in the current zone. If the caller is in
+the global zone, then all vnd devices in all zones will be walked. If
+the caller is in a non-global zone, then only the devices in that zone
+will be visible.
+
+.LP
+The function cb will be called with two arguments. The first argument,
+viip, is a pointer to a structure that contains information about the
+link. The second argument to the function cb, cbarg, is the same
+argument that is passed to the function vnd_walk as arg. To continue
+the function cb should return zero. If the function cb returns
+non-zero the walk will terminate.
+
+.LP
+As the vnd_walk function does not have a handle, errors are returned
+in vnderr and syserr. Both vnderr and syserr are allowed to be NULL
+pointers. If either one is a NULL pointer, then error information for
+that class of error will not be returned. It is not recommended that
+consumers supply NULL pointers.
+
+.LP
+The vnd_info_t structure contains the following members:
+
+.in +2
+.nf
+uint32_t	vi_version
+zoneid_t	vi_zone
+char		vi_name[LIBVND_NAMELEN];
+char		vi_datalink[LIBVND_NAMELEN];
+.fi
+.in -2
+
+.LP
+The member vi_version is guaranteed to be the first member of the
+structure. This number indicates the current revision of the structure
+and is set to the integer value 1. More properties may be added in
+future releases. Those properties will be tied to a greater version
+number so software knows whether or not it is legal to access them.
+
+.LP
+The vi_zone field indicates the zone id that the vnd device exists in.
+The vi_name field is the name of the vnd device. If the vnd_device is
+not linked, the name field is set to "<unknown>". The vi_datalink
+field is filled in with the name of the data link the vnd device is on
+top of.
+
+
+.SH RETURN VALUES
+
+.LP
+The vnd_walk function will return zero on success. If the consumer
+supplied callback function returned non-zero, then the vnd_walk
+function will return 1. If an error occurred, -1 is returned, and if
+vnderr and syserr are non-null, they are filled in with their
+respective error values. See vnd_errno(3VND) for more information on
+these errors.
+
+.SH EXAMPLES
+
+.LP
+Example 1  Walk all devices and print information about them
+
+.LP
+The following sample C program walks every vnd device and prints out
+information about them.
+
+.sp
+.in +2
+.nf
+#include <libvnd.h>
+#include <stdio.h>
+
+static int
+print_entry(vnd_info_t *viip, void *unused)
+{
+	(void) printf("device %s over data link %s in zone %d\n",
+	    viip->vi_name, viip->vi_datalink, viip->vi_zone);
+	return (0);
+}
+
+int
+main(void)
+{
+	vnd_errno_t vnderr;
+	int syserr;
+
+	if (vnd_walk(print_entry, NULL, &vnderr, &syserr) != 0) {
+		(void) fprintf(stderr, "failed to walk vnd devices: %s\n",
+		    vnderr != VND_E_SYS ? vnd_strerror(vnderr) :
+		    vnd_strsyserror(syserr));
+		return (1);
+	}
+
+	return (0);
+}
+.fi
+.in -2
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Stability	Committed
+_
+MT-Level	MT-Safe
+.TE
+
+.SH SEE ALSO
+
+libvnd(3VND), vnd_errno(3VND), attributes(5), zones(5)
diff --git a/usr/src/man/man3xnet/Makefile b/usr/src/man/man3xnet/Makefile
index 81cd96cba3..cc231f60c4 100644
--- a/usr/src/man/man3xnet/Makefile
+++ b/usr/src/man/man3xnet/Makefile
@@ -62,6 +62,7 @@ MANLINKS=	getaddrinfo.3xnet	\
 		getservbyname.3xnet	\
 		getservbyport.3xnet	\
 		getservent.3xnet	\
+		htonll.3xnet		\
 		htons.3xnet		\
 		if_freenameindex.3xnet	\
 		if_indextoname.3xnet	\
@@ -73,6 +74,7 @@ MANLINKS=	getaddrinfo.3xnet	\
 		inet_ntoa.3xnet		\
 		inet_pton.3xnet		\
 		ntohl.3xnet		\
+		ntohll.3xnet		\
 		ntohs.3xnet		\
 		sethostent.3xnet	\
 		setnetent.3xnet		\
@@ -97,6 +99,7 @@ getservbyname.3xnet	:= LINKSRC = endservent.3xnet
 getservbyport.3xnet	:= LINKSRC = endservent.3xnet
 getservent.3xnet	:= LINKSRC = endservent.3xnet
 
+htonll.3xnet		:= LINKSRC = htonl.3xnet
 htons.3xnet		:= LINKSRC = htonl.3xnet
 
 if_freenameindex.3xnet	:= LINKSRC = if_nametoindex.3xnet
@@ -112,6 +115,7 @@ inet_ntoa.3xnet		:= LINKSRC = inet_addr.3xnet
 inet_pton.3xnet		:= LINKSRC = inet_ntop.3xnet
 
 ntohl.3xnet		:= LINKSRC = htonl.3xnet
+ntohll.3xnet		:= LINKSRC = htonl.3xnet
 ntohs.3xnet		:= LINKSRC = htonl.3xnet
 
 sethostent.3xnet	:= LINKSRC = endhostent.3xnet
diff --git a/usr/src/man/man3xnet/htonl.3xnet b/usr/src/man/man3xnet/htonl.3xnet
index 1bd44c6075..53eb87e687 100644
--- a/usr/src/man/man3xnet/htonl.3xnet
+++ b/usr/src/man/man3xnet/htonl.3xnet
@@ -58,6 +58,11 @@ order
 
 .LP
 .nf
+\fBuint64_t\fR \fBhtonll\fR(\fBuint64_t\fR \fIhostlonglong\fR);
+.fi
+
+.LP
+.nf
 \fBuint16_t\fR \fBhtons\fR(\fBuint16_t\fR \fIhostshort\fR);
 .fi
 
@@ -68,18 +73,23 @@ order
 
 .LP
 .nf
+\fBuint64_t\fR \fBntohll\fR(\fBuint64_t\fR \fInetlonglong\fR);
+.fi
+
+.LP
+.nf
 \fBuint16_t\fR  \fBntohs\fR(\fBuint16_t\fR \fI netshort\fR);
 .fi
 
 .SH DESCRIPTION
 .sp
 .LP
-These functions convert 16-bit and 32-bit quantities between network byte order
-and host byte order.
+These functions convert 16-bit, 32-bit, and 64-bit quantities between network
+byte order and host byte order.
 .sp
 .LP
-The  \fBuint32_t\fR and  \fBuint16_t\fR types are made available by inclusion
-of \fB<inttypes.h>\fR\&.
+The \fBuint32_t\fR, \fBuint16_t\fR, and \fBuint64_t\fR types are made available
+by inclusion of \fB<inttypes.h>\fR\&.
 .SH USAGE
 .sp
 .LP
@@ -92,12 +102,12 @@ value of their argument.
 .SH RETURN VALUES
 .sp
 .LP
-The \fBhtonl()\fR and \fBhtons()\fR functions return the argument value
-converted from host to network byte order.
+The \fBhtonl()\fR, \fBhtonll()\fR, and \fBhtons()\fR functions return the
+argument value converted from host to network byte order.
 .sp
 .LP
-The \fBntohl()\fR and \fBntohs()\fR functions return the argument value
-converted from network to host byte order.
+The \fBntohl()\fR, \fBntohll()\fR, and \fBntohs()\fR functions return the
+argument value converted from network to host byte order.
 .SH ERRORS
 .sp
 .LP
diff --git a/usr/src/man/man4/Makefile b/usr/src/man/man4/Makefile
index 2008cfee3b..6a792597c2 100644
--- a/usr/src/man/man4/Makefile
+++ b/usr/src/man/man4/Makefile
@@ -132,6 +132,7 @@ _MANFILES=	Intro.4				\
 		nsmbrc.4			\
 		nss.4				\
 		nsswitch.conf.4			\
+		overlay_files.4			\
 		packingrules.4			\
 		pam.conf.4			\
 		passwd.4			\
diff --git a/usr/src/man/man4/overlay_files.4 b/usr/src/man/man4/overlay_files.4
new file mode 100644
index 0000000000..b9e5387871
--- /dev/null
+++ b/usr/src/man/man4/overlay_files.4
@@ -0,0 +1,187 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2015, Joyent, Inc.
+.\"
+.Dd Apr 13, 2015
+.Dt OVERLAY_FILES 4
+.Os
+.Sh NAME
+.Nm overlay_files
+.Nd Overlay files plugin file format
+.Sh DESCRIPTION
+The
+.Sy files
+plugin provides a means for a dynamic overlay where the destinations are
+determined based on a static description contained in a
+.Sy JSON
+file.
+This manual describes the format of the file used by the
+.Sy files/config
+property.
+To create and manage overlays with the
+.Sy files
+plugin, use
+.Xr dladm 1M .
+For more information on overlays, see
+.Xr overlay 5 .
+.Pp
+Using the
+.Sy files
+module, a static and simple overlay network can be created.
+This network does not support the use of
+.Em broadcast
+or
+.Em multicast
+traffic.
+Both ARP and NDP traffic are proxied by the plugin itself.
+In addition, the plugin allows for DHCP.
+Instead of providing a traditional DHCP proxy, when an initial DHCP broadcast
+goes out to a broadcast address, it will get rewritten to target a specific MAC
+address.
+The
+.Sy files
+plugin is useful as proof of concept and for simple static networks
+where addresses do not need to be reconfigured.
+If more advanced topologies or more streamlined updates are required, consider
+a different plugin.
+.Pp
+The file format is encoded as a series of
+.Sy JSON
+objects.
+Each object has a key, which is a MAC address on the
+.Sy overlay
+network.
+It has multiple values, some required, some optional, which describe various
+properties.
+The valid properties are:
+.Bl -hang -width Ds
+.It Sy ip
+.Bd -filled -compact
+The
+.Sy ip
+key indicates the IP address on the
+.Sy underlay
+network that houses the MAC address in question.
+Packets directed for the MAC address will be encapsulated and set to this
+address.
+This field is required.
+.Pp
+The value is a
+.Em JSON String .
+Both IPv4 and IPv6 addresses are supported and should be written out in their
+traditional forms.
+Follow the guidelines for writing addresses in
+.Xr inet_aton 3SOCKET .
+.Ed
+.It Sy port
+.Bd -filled -compact
+The
+.Sy port
+key indicates the port on the
+.Sy underlay
+network that houses the MAC address in question.
+This property is required if the encapsulation module requires a port for its
+destination.
+The value is a
+.Em JSON Number .
+.Ed
+.It Sy arp
+.Bd -filled -compact
+The
+.Sy arp
+key stores the IPv4 address that corresponds to this MAC address on the
+.Sy overlay
+network.
+This will be used to respond to ARP queries that would traditionally have been
+received by the OS kernel.
+If this address is not present, no IPv4 packets directed to this IP address will
+be received by the network interface that has this MAC address, regardless of
+what is configured on top of it.
+.Pp
+The value is a
+.Em JSON String
+and should be written out following the guidelines for IPv4 addresses in
+.Xr inet_aton 3SOCKET .
+.Ed
+.It Sy ndp
+.Bd -filled -compact
+The
+.Sy ndp
+key stores the IPv6 address that corresponds to this MAC address on the
+.Sy overlay
+network.
+This will be used to respond to NDP queries that would traditionally have been
+received by the OS kernel.
+If this address is not present, no IPv6 packets directed to this IP address will
+be received by the network interface that has this MAC address, regardless of
+what is configured on top of it.
+.Pp
+The value is a
+.Em JSON String
+and should be written out following the guidelines for IPv6 addresses in
+.Xr inet_aton 3SOCKET .
+.Ed
+.It Sy dhcp-proxy
+.Bd -filled -compact
+The
+.Sy dhcp-proxy
+key stores a MAC address that DHCP messages directed to a broadcast address get
+rewritten to be sent to.
+This can be viewed as a form of proxy DHCP, but is different in mechanism from a
+traditional proxy.
+The value is a
+.Em JSON String
+and should be written as a traditional MAC address string as described by
+.Xr ether_aton 3SOCKET .
+.Ed
+.El
+.Sh EXAMPLES
+.Sy Example 1
+Sample configuration file
+.Pp
+This configuration file provides information for three different MAC
+addresses.
+Each MAC address has an entry which describes what its IPv4
+and IPv6 address is, as well as the IP address and port of the host on
+the underlay network.
+Finally, one host has a DHCP proxy entry to demonstrate how one might
+configure DHCP.
+.Bd -literal -offset indent
+{
+	"de:ad:be:ef:00:00": {
+		"arp": "10.55.55.2",
+		"ip": "10.88.88.69",
+		"ndp": "fe80::3",
+		"port": 4789
+	},
+	"de:ad:be:ef:00:01": {
+		"arp": "10.55.55.3",
+		"dhcp-proxy": "de:ad:be:ef:00:00",
+		"ip": "10.88.88.70",
+		"ndp": "fe80::4",
+		"port": 4789
+	},
+	"de:ad:be:ef:00:02": {
+		"arp": "10.55.55.4",
+		"ip": "10.88.88.71",
+		"ndp": "fe80::5",
+		"port": 4789
+	}
+}
+.Ed
+.Sh STABILITY
+This file format is
+.Sy committed ;
+however, keys that are not listed here are reserved for future use.
+.Sh SEE ALSO
+.Xr dladm 1M ,
+.Xr overlay 5
diff --git a/usr/src/man/man4/proc.4 b/usr/src/man/man4/proc.4
index 59fd43f9a0..3e5a9bb95f 100644
--- a/usr/src/man/man4/proc.4
+++ b/usr/src/man/man4/proc.4
@@ -1,241 +1,394 @@
 '\" te
 .\" Copyright 1989 AT&T
 .\" Copyright (c) 2006, Sun Microsystems, Inc. All Rights Reserved.
-.\" Copyright (c) 2013, Joyent, Inc. All rights reserved.
+.\" Copyright 2017, Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH PROC 4 "Jun 6, 2016"
-.SH NAME
-proc \- /proc, the process file system
-.SH DESCRIPTION
-.LP
-\fB/proc\fR is a file system that provides access to the state of each process
-and light-weight process (lwp) in the system. The name of each entry in the
-\fB/proc\fR directory is a decimal number corresponding to a process-ID. These
-entries are themselves subdirectories. Access to process state is provided by
-additional files contained within each subdirectory; the hierarchy is described
-more completely below. In this document, ``\fB/proc\fR file'' refers to a
-non-directory file within the hierarchy rooted at \fB/proc\fR. The owner of
-each \fB/proc\fR file and subdirectory is determined by the user-ID of the
-process.
-.sp
-.LP
-\fB/proc\fR can be mounted on any mount point, in addition to the standard
-\fB/proc\fR mount point, and can be mounted several places at once. Such
-additional mounts are allowed in order to facilitate the confinement of
-processes to subtrees of the file system via \fBchroot\fR(1M) and yet allow
-such processes access to commands like \fBps\fR(1).
-.sp
-.LP
-Standard system calls are used to access \fB/proc\fR files: \fBopen\fR(2),
-\fBclose\fR(2), \fBread\fR(2), and \fBwrite\fR(2) (including \fBreadv\fR(2),
-\fBwritev\fR(2), \fBpread\fR(2), and \fBpwrite\fR(2)). Most files describe
-process state and can only be opened for reading. \fBctl\fR and \fBlwpctl\fR
+.Dd Jun 24, 2016
+.Dt PROC 4
+.Os
+.Sh NAME
+.Nm proc
+.Nd /proc, the process file system
+.Sh DESCRIPTION
+.Pa /proc
+is a file system that provides access to the state of each process
+and light-weight process (lwp) in the system.
+The name of each entry in the
+.Pa /proc
+directory is a decimal number corresponding to a process-ID.
+These entries are themselves subdirectories.
+Access to process state is provided by additional files contained within each
+subdirectory; the hierarchy is described more completely below.
+In this document,
+.Dq Pa /proc file
+refers to a non-directory file within the hierarchy rooted at
+.Pa /proc .
+The owner of each
+.Pa /proc
+file and subdirectory is determined by the user-ID of the process.
+.Pp
+.Pa /proc
+can be mounted on any mount point, in addition to the standard
+.Pa /proc
+mount point, and can be mounted several places at once.
+Such additional mounts are allowed in order to facilitate the confinement of
+processes to subtrees of the file system via
+.Xr chroot 2
+and yet allow such processes access to commands like
+.Xr ps 1 .
+.Pp
+Standard system calls are used to access
+.Pa /proc
+files:
+.Xr open 2 ,
+.Xr close 2 ,
+.Xr read 2 ,
+and
+.Xr write 2
+(including
+.Xr readv 2 ,
+.Xr writev 2 ,
+.Xr pread 2 ,
+and
+.Xr pwrite 2 ) .
+Most files describe process state and can only be opened for reading.
+.Pa ctl
+and
+.Pa lwpctl
 (control) files permit manipulation of process state and can only be opened for
-writing. \fBas\fR (address space) files contain the image of the running
-process and can be opened for both reading and writing. An open for writing
-allows process control; a read-only open allows inspection but not control. In
-this document, we refer to the process as open for reading or writing if any of
-its associated \fB/proc\fR files is open for reading or writing.
-.sp
-.LP
-In general, more than one process can open the same \fB/proc\fR file at the
-same time. \fIExclusive\fR \fIopen\fR is an advisory mechanism provided to
-allow controlling processes to avoid collisions with each other. A process can
-obtain exclusive control of a target process, with respect to other cooperating
-processes, if it successfully opens any \fB/proc\fR file in the target process
-for writing (the \fBas\fR or \fBctl\fR files, or the \fBlwpctl\fR file of any
-lwp) while specifying \fBO_EXCL\fR in the \fBopen\fR(2). Such an open will fail
-if the target process is already open for writing (that is, if an \fBas\fR,
-\fBctl\fR, or \fBlwpctl\fR file is already open for writing). There can be any
-number of concurrent read-only opens; \fBO_EXCL\fR is ignored on opens for
-reading. It is recommended that the first open for writing by a controlling
-process use the \fBO_EXCL\fR flag; multiple controlling processes usually
-result in chaos.
-.sp
-.LP
-If a process opens one of its own \fB/proc\fR files for writing, the open
-succeeds regardless of \fBO_EXCL\fR and regardless of whether some other
-process has the process open for writing. Self-opens do not count when another
-process attempts an exclusive open. (A process cannot exclude a debugger by
-opening itself for writing and the application of a debugger cannot prevent a
-process from opening itself.) All self-opens for writing are forced to be
-close-on-exec (see the \fBF_SETFD\fR operation of \fBfcntl\fR(2)).
-.sp
-.LP
+writing.
+.Pa as
+(address space) files contain the image of the running process and can be
+opened for both reading and writing.
+An open for writing allows process control; a read-only open allows inspection
+but not control.
+In this document, we refer to the process as open for reading or writing if
+any of its associated
+.Pa /proc
+files is open for reading or writing.
+.Pp
+In general, more than one process can open the same
+.Pa /proc
+file at the same time. \fIExclusive\fR \fIopen\fR is an advisory mechanism provided to
+allow controlling processes to avoid collisions with each other.
+A process can obtain exclusive control of a target process, with respect to
+other cooperating processes, if it successfully opens any
+.Pa /proc
+file in the target process for writing (the
+.Pa as
+or
+.Pa ctl
+files, or the
+.Pa lwpctl
+file of any lwp) while specifying
+.Sy O_EXCL
+in the
+.Xr open 2 .
+Such an open will fail if the target process is already open for writing (that
+is, if an
+.Pa as ,
+.Pa ctl ,
+or
+.Pa lwpctl
+file is already open for writing).
+There can be any number of concurrent read-only opens;
+.Sy O_EXCL
+is ignored on opens for reading.
+It is recommended that the first open for writing by a controlling
+process use the
+.Sy O_EXCL
+flag; multiple controlling processes usually result in chaos.
+.Pp
+If a process opens one of its own
+.Pa /proc
+files for writing, the open
+succeeds regardless of
+.Sy O_EXCL
+and regardless of whether some other process has the process open for writing.
+Self-opens do not count when another process attempts an exclusive open.
+(A process cannot exclude a debugger by opening itself for writing and the
+application of a debugger cannot prevent a process from opening itself.)
+All self-opens for writing are forced to be close-on-exec (see the
+.Sy F_SETFD
+operation of
+.Xr fcntl 2 ) .
+.Pp
 Data may be transferred from or to any locations in the address space of the
-traced process by applying \fBlseek\fR(2) to position the \fBas\fR file at the
-virtual address of interest followed by \fBread\fR(2) or \fBwrite\fR(2) (or by
-using \fBpread\fR(2) or \fBpwrite\fR(2) for the combined operation). The
-address-map files \fB/proc/\fR\fIpid\fR\fB/map\fR and
-\fB/proc/\fR\fIpid\fR\fB/xmap\fR can be read to determine the accessible areas
-(mappings) of the address space. \fBI/O\fR transfers may span contiguous
-mappings. An \fBI/O\fR request extending into an unmapped area is truncated at
-the boundary. A write request beginning at an unmapped virtual address fails
-with \fBEIO\fR; a read request beginning at an unmapped virtual address returns
-zero (an end-of-file indication).
-.sp
-.LP
+traced process by applying
+.Xr lseek 2
+to position the
+.Pa as
+file at the virtual address of interest followed by
+.Xr read 2
+or
+.Xr write 2
+(or by using
+.Xr pread 2
+or
+.Xr pwrite 2
+for the combined operation).
+The address-map files
+.Pa /proc/ Ns Em pid Ns Pa /map
+and
+.Pa /proc/ Ns Em pid Ns Pa /xmap
+can be read to determine the accessible areas (mappings) of the address space.
+.Sy I/O
+transfers may span contiguous mappings.
+An
+.Sy I/O
+request extending into an unmapped area is truncated at the boundary.
+A write request beginning at an unmapped virtual address fails with
+.Er EIO ;
+a read request beginning at an unmapped virtual address returns zero (an
+end-of-file indication).
+.Pp
 Information and control operations are provided through additional files.
-\fB<procfs.h>\fR contains definitions of data structures and message formats
-used with these files. Some of these definitions involve the use of sets of
-flags. The set types \fBsigset_t\fR, \fBfltset_t\fR, and \fBsysset_t\fR
+.In procfs.h
+contains definitions of data structures and message formats
+used with these files.
+Some of these definitions involve the use of sets of flags.
+The set types
+.Sy sigset_t ,
+.Sy fltset_t ,
+and
+.Sy sysset_t
 correspond, respectively, to signal, fault, and system call enumerations
-defined in \fB<sys/signal.h>\fR, \fB<sys/fault.h>\fR, and
-\fB<sys/syscall.h>\fR\&. Each set type is large enough to hold flags for its
-own enumeration. Although they are of different sizes, they have a common
+defined in
+.In sys/signal.h ,
+.In sys/fault.h ,
+and
+.In sys/syscall.h .
+Each set type is large enough to hold flags for its own enumeration.
+Although they are of different sizes, they have a common
 structure and can be manipulated by these macros:
-.sp
-.in +2
-.nf
+.Bd -literal -offset indent
 prfillset(&set);             /* turn on all flags in set */
 premptyset(&set);            /* turn off all flags in set */
 praddset(&set, flag);        /* turn on the specified flag */
 prdelset(&set, flag);        /* turn off the specified flag */
 r = prismember(&set, flag);  /* != 0 iff flag is turned on */
-.fi
-.in -2
-
-.sp
-.LP
-One of \fBprfillset()\fR or \fBpremptyset()\fR must be used to initialize
-\fBset\fR before it is used in any other operation. \fBflag\fR must be a member
-of the enumeration corresponding to \fBset\fR.
-.sp
-.LP
-Every process contains at least one \fIlight-weight process\fR, or \fIlwp\fR.
+.Ed
+.Pp
+One of
+.Fn prfillset
+or
+.Fn premptyset
+must be used to initialize
+.Fa set
+before it is used in any other operation.
+.Fa flag
+must be a member of the enumeration corresponding to
+.Fa set .
+.Pp
+Every process contains at least one
+.Em light-weight process ,
+or
+.Sy lwp .
 Each lwp represents a flow of execution that is independently scheduled by the
-operating system. All lwps in a process share its address space as well as many
-other attributes. Through the use of \fBlwpctl\fR and \fBctl\fR files as
-described below, it is possible to affect individual lwps in a process or to
-affect all of them at once, depending on the operation.
-.sp
-.LP
+operating system.
+All lwps in a process share its address space as well as many other attributes.
+Through the use of
+.Pa lwpctl
+and
+.Pa ctl
+files as described below, it is possible to affect individual lwps in a
+process or to affect all of them at once, depending on the operation.
+.Pp
 When the process has more than one lwp, a representative lwp is chosen by the
-system for certain process status files and control operations. The
-representative lwp is a stopped lwp only if all of the process's lwps are
+system for certain process status files and control operations.
+The representative lwp is a stopped lwp only if all of the process's lwps are
 stopped; is stopped on an event of interest only if all of the lwps are so
-stopped (excluding \fBPR_SUSPENDED\fR lwps); is in a \fBPR_REQUESTED\fR stop
-only if there are no other events of interest to be found; or, failing
-everything else, is in a \fBPR_SUSPENDED\fR stop (implying that the process is
-deadlocked). See the description of the \fBstatus\fR file for definitions of
-stopped states. See the \fBPCSTOP\fR control operation for the definition of
-``event of interest''.
-.sp
-.LP
+stopped (excluding
+.Sy PR_SUSPENDED
+lwps); is in a
+.Sy PR_REQUESTED
+stop only if there are no other events of interest to be found; or, failing
+everything else, is in a
+.Sy PR_SUSPENDED
+stop (implying that the process is deadlocked).
+See the description of the
+.Pa status
+file for definitions of stopped states.
+See the
+.Sy PCSTOP
+control operation for the definition of
+.Dq event of interest .
+.Pp
 The representative lwp remains fixed (it will be chosen again on the next
 operation) as long as all of the lwps are stopped on events of interest or are
-in a \fBPR_SUSPENDED\fR stop and the \fBPCRUN\fR control operation is not
-applied to any of them.
-.sp
-.LP
-When applied to the process control file, every \fB/proc\fR control operation
+in a
+.Sy PR_SUSPENDED
+stop and the
+.Sy PCRUN
+control operation is not applied to any of them.
+.Pp
+When applied to the process control file, every
+.Pa /proc
+control operation
 that must act on an lwp uses the same algorithm to choose which lwp to act
-upon. Together with synchronous stopping (see \fBPCSET\fR), this enables a
-debugger to control a multiple-lwp process using only the process-level status
-and control files if it so chooses. More fine-grained control can be achieved
-using the lwp-specific files.
-.sp
-.LP
+upon.
+Together with synchronous stopping (see
+.Sy PCSET ) ,
+this enables a debugger to control a multiple-lwp process using only the
+process-level status and control files if it so chooses.
+More fine-grained control can be achieved using the lwp-specific files.
+.Pp
 The system supports two process data models, the traditional 32-bit data model
 in which ints, longs and pointers are all 32 bits wide (the ILP32 data model),
 and on some platforms the 64-bit data model in which longs and pointers, but
-not ints, are 64 bits in width (the LP64 data model). In the LP64 data model
-some system data types, notably \fBsize_t\fR, \fBoff_t\fR, \fBtime_t\fR and
-\fBdev_t\fR, grow from 32 bits to 64 bits as well.
-.sp
-.LP
-The \fB/proc\fR interfaces described here are available to both 32-bit and
-64-bit controlling processes. However, many operations attempted by a 32-bit
-controlling process on a 64-bit target process will fail with \fBEOVERFLOW\fR
+not ints, are 64 bits in width (the LP64 data model).
+In the LP64 data model some system data types, notably
+.Sy size_t ,
+.Sy off_t ,
+.Sy time_t
+and
+.Sy dev_t ,
+grow from 32 bits to 64 bits as well.
+.Pp
+The
+.Pa /proc
+interfaces described here are available to both 32-bit and
+64-bit controlling processes.
+However, many operations attempted by a 32-bit
+controlling process on a 64-bit target process will fail with
+.Er EOVERFLOW
 because the address space range of a 32-bit process cannot encompass a 64-bit
 process or because the data in some 64-bit system data type cannot be
 compressed to fit into the corresponding 32-bit type without loss of
-information. Operations that fail in this circumstance include reading and
+information.
+Operations that fail in this circumstance include reading and
 writing the address space, reading the address-map files, and setting the
-target process's registers. There is no restriction on operations applied by a
+target process's registers.
+There is no restriction on operations applied by a
 64-bit process to either a 32-bit or a 64-bit target processes.
-.sp
-.LP
-The format of the contents of any \fB/proc\fR file depends on the data model of
-the observer (the controlling process), not on the data model of the target
-process. A 64-bit debugger does not have to translate the information it reads
-from a \fB/proc\fR file for a 32-bit process from 32-bit format to 64-bit
-format. However, it usually has to be aware of the data model of the target
-process. The \fBpr_dmodel\fR field of the \fBstatus\fR files indicates the
-target process's data model.
-.sp
-.LP
+.Pp
+The format of the contents of any
+.Pa /proc
+file depends on the data model of the observer (the controlling process), not
+on the data model of the target process.
+A 64-bit debugger does not have to translate the information it reads from a
+.Pa /proc
+file for a 32-bit process from 32-bit format to 64-bit format.
+However, it usually has to be aware of the data model of the target process.
+The
+.Sy pr_dmodel
+field of the
+.Pa status
+files indicates the target process's data model.
+.Pp
 To help deal with system data structures that are read from 32-bit processes, a
 64-bit controlling program can be compiled with the C preprocessor symbol
-\fB_SYSCALL32\fR defined before system header files are included. This makes
-explicit 32-bit fixed-width data structures (like \fBcstruct stat32\fR) visible
-to the 64-bit program. See \fBtypes32.h\fR(3HEAD).
-.SH DIRECTORY STRUCTURE
-.LP
-At the top level, the directory \fB/proc\fR contains entries each of which
-names an existing process in the system. These entries are themselves
-directories. Except where otherwise noted, the files described below can be
-opened for reading only. In addition, if a process becomes a \fIzombie\fR (one
-that has exited but whose parent has not yet performed a \fBwait\fR(3C) upon
-it), most of its associated \fB/proc\fR files disappear from the hierarchy;
-subsequent attempts to open them, or to read or write files opened before the
-process exited, will elicit the error \fBENOENT\fR.
-.sp
-.LP
-Although process state and consequently the contents of \fB/proc\fR files can
-change from instant to instant, a single \fBread\fR(2) of a \fB/proc\fR file is
-guaranteed to return a sane representation of state; that is, the read will be
-atomic with respect to the state of the process. No such guarantee applies to
-successive reads applied to a \fB/proc\fR file for a running process. In
-addition, atomicity is not guaranteed for \fBI/O\fR applied to the \fBas\fR
+.Dv _SYSCALL32
+defined before system header files are included.
+This makes explicit 32-bit fixed-width data structures (like
+.Sy struct stat32 )
+visible to the 64-bit program.
+See
+.Xr types32.h 3HEAD .
+.Sh DIRECTORY STRUCTURE
+At the top level, the directory
+.Pa /proc
+contains entries each of which names an existing process in the system.
+These entries are themselves directories.
+Except where otherwise noted, the files described below can be
+opened for reading only.
+In addition, if a process becomes a
+.Em zombie
+(one that has exited but whose parent has not yet performed a
+.Xr wait 3C
+upon it), most of its associated
+.Pa /proc
+files disappear from the hierarchy; subsequent attempts to open them, or to
+read or write files opened before the process exited, will elicit the error
+.Er ENOENT .
+.Pp
+Although process state and consequently the contents of
+.Pa /proc
+files can change from instant to instant, a single
+.Xr read 2
+of a
+.Pa /proc
+file is guaranteed to return a sane representation of state; that is, the read
+will be atomic with respect to the state of the process.
+No such guarantee applies to successive reads applied to a
+.Pa /proc
+file for a running process.
+In addition, atomicity is not guaranteed for
+.Sy I/O
+applied to the
+.Pa as
 (address-space) file for a running process or for a process whose address space
 contains memory shared by another running process.
-.sp
-.LP
-A number of structure definitions are used to describe the files. These
-structures may grow by the addition of elements at the end in future releases
-of the system and it is not legitimate for a program to assume that they will
-not.
-.SH STRUCTURE OF \fB/proc/\fR\fIpid\fR
-.LP
-A given directory \fB/proc/\fR\fIpid\fR contains the following entries. A
-process can use the invisible alias \fB/proc/self\fR if it wishes to open one
-of its own \fB/proc\fR files (invisible in the sense that the name ``self''
-does not appear in a directory listing of \fB/proc\fR obtained from
-\fBls\fR(1), \fBgetdents\fR(2), or \fBreaddir\fR(3C)).
-.SS "contracts"
-.LP
-A directory containing references to the contracts held by the process. Each
-entry is a symlink to the contract's directory under \fB/system/contract\fR.
-See \fBcontract\fR(4).
-.SS "as"
-.LP
+.Pp
+A number of structure definitions are used to describe the files.
+These structures may grow by the addition of elements at the end in future
+releases of the system and it is not legitimate for a program to assume that
+they will not.
+.Sh STRUCTURE OF Pa /proc/ Ns Em pid
+A given directory
+.Pa /proc/ Ns Em pid
+contains the following entries.
+A process can use the invisible alias
+.Pa /proc/self
+if it wishes to open one of its own
+.Pa /proc
+files (invisible in the sense that the name
+.Dq self
+does not appear in a directory listing of
+.Pa /proc
+obtained from
+.Xr ls 1 ,
+.Xr getdents 2 ,
+or
+.Xr readdir 3C ) .
+.Ss contracts
+A directory containing references to the contracts held by the process.
+Each entry is a symlink to the contract's directory under
+.Pa /system/contract .
+See
+.Xr contract 4 .
+.Ss as
 Contains the address-space image of the process; it can be opened for both
-reading and writing. \fBlseek\fR(2) is used to position the file at the virtual
-address of interest and then the address space can be examined or changed
-through \fBread\fR(2) or \fBwrite\fR(2) (or by using \fBpread\fR(2) or
-\fBpwrite\fR(2) for the combined operation).
-.SS "ctl"
-.LP
+reading and writing.
+.Xr lseek 2
+is used to position the file at the virtual address of interest and then the
+address space can be examined or changed through
+.Xr read 2
+or
+.Xr write 2
+(or by using
+.Xr pread 2
+or
+.Xr pwrite 2
+for the combined operation).
+.Ss ctl
 A write-only file to which structured messages are written directing the system
 to change some aspect of the process's state or control its behavior in some
-way. The seek offset is not relevant when writing to this file. Individual lwps
-also have associated \fBlwpctl\fR files in the lwp subdirectories. A control
-message may be written either to the process's \fBctl\fR file or to a specific
-\fBlwpctl\fR file with operation-specific effects. The effect of a control
-message is immediately reflected in the state of the process visible through
-appropriate status and information files. The types of control messages are
-described in detail later. See \fBCONTROL MESSAGES\fR.
-.SS "status"
-.LP
-Contains state information about the process and the representative lwp. The
-file contains a \fBpstatus\fR structure which contains an embedded
-\fBlwpstatus\fR structure for the representative lwp, as follows:
-.sp
-.in +2
-.nf
+way.
+The seek offset is not relevant when writing to this file.
+Individual lwps also have associated
+.Pa lwpctl
+files in the lwp subdirectories.
+A control message may be written either to the process's
+.Pa ctl
+file or to a specific
+.Pa lwpctl
+file with operation-specific effects.
+The effect of a control message is immediately reflected in the state of the
+process visible through appropriate status and information files.
+The types of control messages are described in detail later.
+See
+.Sx CONTROL MESSAGES .
+.Ss status
+Contains state information about the process and the representative lwp.
+The file contains a
+.Sy pstatus
+structure which contains an embedded
+.Sy lwpstatus
+structure for the representative lwp, as follows:
+.Bd -literal -offset 2
 typedef struct pstatus {
      int pr_flags;            /* flags (see below) */
      int pr_nlwp;             /* number of active lwps in the process */
@@ -265,204 +418,166 @@ typedef struct pstatus {
      zoneid_t pr_zoneid;      /* zone id */
      lwpstatus_t pr_lwp;      /* status of the representative lwp */
 } pstatus_t;
-.fi
-.in -2
-
-.sp
-.LP
-\fBpr_flags\fR is a bit-mask holding the following process flags. For
-convenience, it also contains the lwp flags for the representative lwp,
+.Ed
+.Pp
+.Sy pr_flags
+is a bit-mask holding the following process flags.
+For convenience, it also contains the lwp flags for the representative lwp,
 described later.
-.sp
-.ne 2
-.na
-\fB\fBPR_ISSYS\fR\fR
-.ad
-.RS 13n
-process is a system process (see \fBPCSTOP\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_VFORKP\fR\fR
-.ad
-.RS 13n
-process is the parent of a vforked child (see \fBPCWATCH\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_FORK\fR\fR
-.ad
-.RS 13n
-process has its inherit-on-fork mode set (see \fBPCSET\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_RLC\fR\fR
-.ad
-.RS 13n
-process has its run-on-last-close mode set (see \fBPCSET\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_KLC\fR\fR
-.ad
-.RS 13n
-process has its kill-on-last-close mode set (see \fBPCSET\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_ASYNC\fR\fR
-.ad
-.RS 13n
-process has its asynchronous-stop mode set (see \fBPCSET\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_MSACCT\fR\fR
-.ad
-.RS 13n
+.Bl -tag -width "PR_MSACCT" -offset indent
+.It Sy PR_ISSYS
+process is a system process (see
+.Sx PCSTOP ) .
+.It Sy PR_VFORKP
+process is the parent of a vforked child (see
+.Sx PCWATCH ) .
+.It Sy PR_FORK
+process has its inherit-on-fork mode set (see
+.Sx PCSET ) .
+.It Sy PR_RLC
+process has its run-on-last-close mode set (see
+.Sx PCSET ) .
+.It Sy PR_KLC
+process has its kill-on-last-close mode set (see
+.Sx PCSET ) .
+.It Sy PR_ASYNC
+process has its asynchronous-stop mode set (see
+.Sx PCSET ) .
+.It Sy PR_MSACCT
 Set by default in all processes to indicate that microstate accounting is
-enabled. However, this flag has been deprecated and no longer has any effect.
+enabled.
+However, this flag has been deprecated and no longer has any effect.
 Microstate accounting may not be disabled; however, it is still possible to
 toggle the flag.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_MSFORK\fR\fR
-.ad
-.RS 13n
+.It Sy PR_MSFORK
 Set by default in all processes to indicate that microstate accounting will be
-enabled for processes that this parent forks(). However, this flag has been
-deprecated and no longer has any effect. It is possible to toggle this flag;
-however, it is not possible to disable microstate accounting.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_BPTADJ\fR\fR
-.ad
-.RS 13n
-process has its breakpoint adjustment mode set (see \fBPCSET\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_PTRACE\fR\fR
-.ad
-.RS 13n
-process has its ptrace-compatibility mode set (see \fBPCSET\fR).
-.RE
-
-.sp
-.LP
-\fBpr_nlwp\fR is the total number of active lwps in the process. pr_nzomb is
-the total number of zombie lwps in the process. A zombie lwp is a non-detached
-lwp that has terminated but has not been reaped with \fBthr_join\fR(3C) or
-\fBpthread_join\fR(3C).
-.sp
-.LP
-\fBpr_pid\fR, \fBpr_ppid\fR, \fBpr_pgid\fR, and \fBpr_sid\fR are, respectively,
-the process ID, the ID of the process's parent, the process's process group ID,
-and the process's session ID.
-.sp
-.LP
-\fBpr_aslwpid\fR is obsolete and is always zero.
-.sp
-.LP
-\fBpr_agentid\fR is the lwp-ID for the \fB/proc\fR agent lwp (see the
-\fBPCAGENT\fR control operation). It is zero if there is no agent lwp in the
-process.
-.sp
-.LP
-\fBpr_sigpend\fR identifies asynchronous signals pending for the process.
-.sp
-.LP
-\fBpr_brkbase\fR is the virtual address of the process heap and
-\fBpr_brksize\fR is its size in bytes. The address formed by the sum of these
-values is the process \fBbreak\fR (see \fBbrk\fR(2)). \fBpr_stkbase\fR and
-\fBpr_stksize\fR are, respectively, the virtual address of the process stack
-and its size in bytes. (Each lwp runs on a separate stack; the distinguishing
-characteristic of the process stack is that the operating system will grow it
-when necessary.)
-.sp
-.LP
-\fBpr_utime\fR, \fBpr_stime\fR, \fBpr_cutime\fR, and \fBpr_cstime\fR are,
-respectively, the user \fBCPU\fR and system \fBCPU\fR time consumed by the
-process, and the cumulative user \fBCPU\fR and system \fBCPU\fR time consumed
-by the process's children, in seconds and nanoseconds.
-.sp
-.LP
-\fBpr_sigtrace\fR and \fBpr_flttrace\fR contain, respectively, the set of
-signals and the set of hardware faults that are being traced (see
-\fBPCSTRACE\fR and \fBPCSFAULT\fR).
-.sp
-.LP
-\fBpr_sysentry\fR and \fBpr_sysexit\fR contain, respectively, the sets of
-system calls being traced on entry and exit (see \fBPCSENTRY\fR and
-\fBPCSEXIT\fR).
-.sp
-.LP
-\fBpr_dmodel\fR indicates the data model of the process. Possible values are:
-.sp
-.ne 2
-.na
-\fB\fBPR_MODEL_ILP32\fR\fR
-.ad
-.RS 19n
+enabled for processes that this parent forks().
+However, this flag has been deprecated and no longer has any effect.
+It is possible to toggle this flag; however, it is not possible to disable
+microstate accounting.
+.It Sy PR_BPTADJ
+process has its breakpoint adjustment mode set (see
+.Sx PCSET ) .
+.It Sy PR_PTRACE
+process has its ptrace-compatibility mode set (see
+.Sx PCSET ) .
+.El
+.Pp
+.Sy pr_nlwp
+is the total number of active lwps in the process.
+.Sy pr_nzomb
+is the total number of zombie lwps in the process.
+A zombie lwp is a non-detached lwp that has terminated but has not been reaped
+with
+.Xr thr_join 3
+or
+.Xr pthread_join 3C .
+.Pp
+.Sy pr_pid ,
+.Sy pr_ppi ,
+.Sy pr_pgid ,
+and
+.Sy pr_sid
+are, respectively, the process ID, the ID of the process's parent, the
+process's process group ID, and the process's session ID.
+.Pp
+.Sy pr_aslwpid
+is obsolete and is always zero.
+.Pp
+.Sy pr_agentid
+is the lwp-ID for the
+.Pa /proc
+agent lwp (see the
+.Sx PCAGENT
+control operation).
+It is zero if there is no agent lwp in the process.
+.Pp
+.Sy pr_sigpend
+identifies asynchronous signals pending for the process.
+.Pp
+.Sy pr_brkbase
+is the virtual address of the process heap and
+.Sy pr_brksize
+is its size in bytes.
+The address formed by the sum of these values is the process
+.Sy break
+(see
+.Xr brk 2 ) .
+.Sy pr_stkbase
+and
+.Sy pr_stksize
+are, respectively, the virtual address of the process stack and its size in
+bytes.
+(Each lwp runs on a separate stack; the distinguishing characteristic of the
+process stack is that the operating system will grow it when necessary.)
+.Pp
+.Sy pr_utime ,
+.Sy pr_stime ,
+.Sy pr_cutime ,
+.Sy and pr_cstime
+are, respectively, the user
+.Sy CPU
+and system
+.Sy CPU
+time consumed by the process, and the cumulative user
+.Sy CPU
+and system
+.Sy CPU
+time consumed by the process's children, in seconds and nanoseconds.
+.Pp
+.Sy pr_sigtrace
+and
+.Sy pr_flttrace
+contain, respectively, the set of signals and the set of hardware faults that
+are being traced (see
+.Sx PCSTRACE
+and
+.Sx PCSFAULT ) .
+.Pp
+.Sy pr_sysentry
+and
+.Sy pr_sysexit
+contain, respectively, the sets of system calls being traced on entry and exit
+(see
+.Sx PCSENTRY
+and
+.Sx PCSEXIT ) .
+.Pp
+.Sy pr_dmodel
+indicates the data model of the process.
+Possible values are:
+.Bl -tag -width "PR_MODEL_NATIVE" -offset indent
+.It Sy PR_MODEL_ILP32
 process data model is ILP32.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_MODEL_LP64\fR\fR
-.ad
-.RS 19n
+.It Sy PR_MODEL_LP64
 process data model is LP64.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_MODEL_NATIVE\fR\fR
-.ad
-.RS 19n
+.It Sy PR_MODEL_NATIVE
 process data model is native.
-.RE
-
-.sp
-.LP
-The \fBpr_taskid\fR, \fBpr_projid\fR, and \fBpr_zoneid\fR fields contain
-respectively, the numeric \fBID\fRs of the task, project, and zone in which the
-process was running.
-.sp
-.LP
-The constant \fBPR_MODEL_NATIVE\fR reflects the data model of the controlling
-process, \fIthat is\fR, its value is \fBPR_MODEL_ILP32\fR or
-\fBPR_MODEL_LP64\fR according to whether the controlling process has been
+.El
+.Pp
+The
+.Sy pr_taskid ,
+.Sy pr_projid ,
+and
+.Sy pr_zoneid
+fields contain respectively, the numeric
+.Sy ID Ns s
+of the task, project, and zone in which the process was running.
+.Pp
+The constant
+.Sy PR_MODEL_NATIVE
+reflects the data model of the controlling process,
+.Em that is ,
+its value is
+.Sy PR_MODEL_ILP32
+or
+.Sy PR_MODEL_LP64
+according to whether the controlling process has been
 compiled as a 32-bit program or a 64-bit program, respectively.
-.sp
-.LP
-\fBpr_lwp\fR contains the status information for the representative lwp:
-.sp
-.in +2
-.nf
+.Pp
+.Sy pr_lwp
+contains the status information for the representative lwp:
+.Bd -literal -offset 2
 typedef struct lwpstatus {
   int pr_flags;              /* flags (see below) */
   id_t pr_lwpid;             /* specific lwp identifier */
@@ -490,382 +605,355 @@ typedef struct lwpstatus {
   prgregset_t pr_reg;        /* general registers */
   prfpregset_t pr_fpreg;     /* floating-point registers */
 } lwpstatus_t;
-.fi
-.in -2
-
-.sp
-.LP
-\fBpr_flags\fR is a bit-mask holding the following lwp flags. For convenience,
-it also contains the process flags, described previously.
-.sp
-.ne 2
-.na
-\fB\fBPR_STOPPED\fR\fR
-.ad
-.RS 14n
+.Ed
+.Pp
+.Sy pr_flags
+is a bit-mask holding the following lwp flags.
+For convenience, it also contains the process flags, described previously.
+.Bl -tag -width "PR_STOPPED" -offset indent
+.It Sy PR_STOPPED
 The lwp is stopped.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_ISTOP\fR\fR
-.ad
-.RS 14n
-The lwp is stopped on an event of interest (see \fBPCSTOP\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_DSTOP\fR\fR
-.ad
-.RS 14n
-The lwp has a stop directive in effect (see \fBPCSTOP\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_STEP\fR\fR
-.ad
-.RS 14n
-The lwp has a single-step directive in effect (see \fBPCRUN\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_ASLEEP\fR\fR
-.ad
-.RS 14n
+.It Sy PR_ISTOP
+The lwp is stopped on an event of interest (see
+.Sx PCSTOP ) .
+.It Sy PR_DSTOP
+The lwp has a stop directive in effect (see
+.Sx PCSTOP ) .
+.It Sy PR_STEP
+The lwp has a single-step directive in effect (see
+.Sx PCRUN ) .
+.It Sy PR_ASLEEP
 The lwp is in an interruptible sleep within a system call.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_PCINVAL\fR\fR
-.ad
-.RS 14n
-The lwp's current instruction (\fBpr_instr\fR) is undefined.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_DETACH\fR\fR
-.ad
-.RS 14n
-This is a detached lwp (see \fBpthread_create\fR(3C) and
-\fBpthread_join\fR(3C)).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_DAEMON\fR\fR
-.ad
-.RS 14n
-This is a daemon lwp (see \fBpthread_create\fR(3C)).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_ASLWP\fR\fR
-.ad
-.RS 14n
+.It Sy PR_PCINVAL
+The lwp's current instruction
+.Pq Sy pr_instr
+is undefined.
+.It Sy PR_DETACH
+This is a detached lwp (see
+.Xr pthread_create 3C
+and
+.Xr pthread_join 3C ) .
+.It Sy PR_DAEMON
+This is a daemon lwp (see
+.Xr pthread_create 3C ) .
+.It Sy PR_ASLWP
 This flag is obsolete and is never set.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_AGENT\fR\fR
-.ad
-.RS 14n
-This is the \fB/proc\fR agent lwp for the process.
-.RE
-
-.sp
-.LP
-\fBpr_lwpid\fR names the specific lwp.
-.sp
-.LP
-\fBpr_why\fR and \fBpr_what\fR together describe, for a stopped lwp, the reason
-for the stop. Possible values of \fBpr_why\fR and the associated \fBpr_what\fR
+.It Sy PR_AGENT
+This is the
+.Pa /proc
+agent lwp for the process.
+.El
+.Pp
+.Sy pr_lwpid
+names the specific lwp.
+.Pp
+.Sy pr_why
+.Sy and
+pr_what
+together describe, for a stopped lwp, the reason for the stop.
+Possible values of
+.Sy pr_why
+and the associated
+.Sy pr_what
 are:
-.sp
-.ne 2
-.na
-\fB\fBPR_REQUESTED\fR\fR
-.ad
-.RS 17n
+.Bl -tag -width "PR_JOBCONTROL" -offset left
+.It Sy PR_REQUESTED
 indicates that the stop occurred in response to a stop directive, normally
-because \fBPCSTOP\fR was applied or because another lwp stopped on an event of
-interest and the asynchronous-stop flag (see \fBPCSET\fR) was not set for the
-process. \fBpr_what\fR is unused in this case.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_SIGNALLED\fR\fR
-.ad
-.RS 17n
-indicates that the lwp stopped on receipt of a signal (see \fBPCSTRACE\fR);
-\fBpr_what\fR holds the signal number that caused the stop (for a newly-stopped
-lwp, the same value is in \fBpr_cursig\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_FAULTED\fR\fR
-.ad
-.RS 17n
+because
+.Sy PCSTOP
+was applied or because another lwp stopped on an event of interest and the
+asynchronous-stop flag (see
+.Sx PCSET )
+was not set for the process.
+.Sy pr_what
+is unused in this case.
+.It Sy PR_SIGNALLED
+indicates that the lwp stopped on receipt of a signal (see
+.Sx PCSTRACE ) ;
+.Sy pr_what
+holds the signal number that caused the stop (for a newly-stopped
+lwp, the same value is in
+.Sy pr_cursig ) .
+.It Sy PR_FAULTED
 indicates that the lwp stopped on incurring a hardware fault (see
-\fBPCSFAULT\fR); \fBpr_what\fR holds the fault number that caused the stop.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_SYSENTRY\fR\fR
-.ad
-.br
-.na
-\fB\fBPR_SYSEXIT\fR\fR
-.ad
-.RS 17n
-indicate a stop on entry to or exit from a system call (see \fBPCSENTRY\fR and
-\fBPCSEXIT\fR); \fBpr_what\fR holds the system call number.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_JOBCONTROL\fR\fR
-.ad
-.RS 17n
+.Sx PCSFAULT ) ;
+.Sy pr_what
+holds the fault number that caused the stop.
+.It Sy PR_SYSENTRY
+.It Sy PR_SYSEXIT
+indicate a stop on entry to or exit from a system call (see
+.Sx PCSENTRY
+and
+.Sx PCSEXIT ) ;
+.Sy pr_what
+holds the system call number.
+.It Sy PR_JOBCONTROL
 indicates that the lwp stopped due to the default action of a job control stop
-signal (see \fBsigaction\fR(2)); \fBpr_what\fR holds the stopping signal
-number.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_SUSPENDED\fR\fR
-.ad
-.RS 17n
+signal (see
+.Xr sigaction 2 ) ;
+.Sy pr_what
+holds the stopping signal number.
+.It Sy PR_SUSPENDED
 indicates that the lwp stopped due to internal synchronization of lwps within
-the process. \fBpr_what\fR is unused in this case.
-.RE
-
-.sp
-.LP
-\fBpr_cursig\fR names the current signal, that is, the next signal to be
-delivered to the lwp, if any. \fBpr_info\fR, when the lwp is in a
-\fBPR_SIGNALLED\fR or \fBPR_FAULTED\fR stop, contains additional information
-pertinent to the particular signal or fault (see \fB<sys/siginfo.h>\fR).
-.sp
-.LP
-\fBpr_lwppend\fR identifies any synchronous or directed signals pending for the
-lwp. \fBpr_lwphold\fR identifies those signals whose delivery is being blocked
-by the lwp (the signal mask).
-.sp
-.LP
-\fBpr_action\fR contains the signal action information pertaining to the
-current signal (see \fBsigaction\fR(2)); it is undefined if \fBpr_cursig\fR is
-zero. \fBpr_altstack\fR contains the alternate signal stack information for the
-lwp (see \fBsigaltstack\fR(2)).
-.sp
-.LP
-\fBpr_oldcontext\fR, if not zero, contains the address on the lwp stack of a
-\fBucontext\fR structure describing the previous user-level context (see
-\fBucontext.h\fR(3HEAD)). It is non-zero only if the lwp is executing in the
-context of a signal handler.
-.sp
-.LP
-\fBpr_syscall\fR is the number of the system call, if any, being executed by
-the lwp; it is non-zero if and only if the lwp is stopped on \fBPR_SYSENTRY\fR
-or \fBPR_SYSEXIT\fR, or is asleep within a system call ( \fBPR_ASLEEP\fR is
-set). If \fBpr_syscall\fR is non-zero, \fBpr_nsysarg\fR is the number of
-arguments to the system call and \fBpr_sysarg\fR contains the actual arguments.
-.sp
-.LP
-\fBpr_rval1\fR, \fBpr_rval2\fR, and \fBpr_errno\fR are defined only if the lwp
-is stopped on \fBPR_SYSEXIT\fR or if the \fBPR_VFORKP\fR flag is set. If
-\fBpr_errno\fR is zero, \fBpr_rval1\fR and \fBpr_rval2\fR contain the return
-values from the system call. Otherwise, \fBpr_errno\fR contains the error
-number for the failing system call (see \fB<sys/errno.h>\fR).
-.sp
-.LP
-\fBpr_clname\fR contains the name of the lwp's scheduling class.
-.sp
-.LP
-\fBpr_tstamp\fR, if the lwp is stopped, contains a time stamp marking when the
+the process.
+.Sy pr_what
+is unused in this case.
+.It Sy PR_BRAND
+indicates that the lwp stopped for a brand-specific reason.
+Interpretation of the value of
+.Sy pr_what
+depends on which zone brand is in use.
+It is not generally expected that an lwp stopped in this state will be
+restarted by native
+.\" mandoc(1) doesn't like .Xr macros referring to itself, so this is
+.\" a bit of a hack.
+.Nm Ns Pq 4
+consumers.
+.El
+.Pp
+.Sy pr_cursig
+names the current signal, that is, the next signal to be delivered to the lwp,
+if any.
+.Sy pr_info ,
+when the lwp is in a
+.Sy PR_SIGNALLED
+or
+.Sy PR_FAULTED
+stop, contains additional information pertinent to the particular signal or
+fault (see
+.In sys/siginfo.h ) .
+.Pp
+.Sy pr_lwppend
+identifies any synchronous or directed signals pending for the lwp.
+.Sy pr_lwphold
+identifies those signals whose delivery is being blocked by the lwp (the
+signal mask).
+.Pp
+.Sy pr_action
+contains the signal action information pertaining to the current signal (see
+.Xr sigaction 2 ) ;
+it is undefined if
+.Sy pr_cursig
+is zero.
+.Sy pr_altstack
+contains the alternate signal stack information for the lwp (see
+.Xr sigaltstack 2 ) .
+.Pp
+.Sy pr_oldcontext ,
+if not zero, contains the address on the lwp stack of a
+.Sy ucontext
+structure describing the previous user-level context (see
+.Xr ucontext.h 3HEAD ) .
+It is non-zero only if the lwp is executing in the context of a signal handler.
+.Pp
+.Sy pr_syscall
+is the number of the system call, if any, being executed by
+the lwp; it is non-zero if and only if the lwp is stopped on
+.Sy PR_SYSENTRY
+or
+.Sy PR_SYSEXIT ,
+or is asleep within a system call
+.Pf ( Sy PR_ASLEEP
+is set).
+If
+.Sy pr_syscall
+is non-zero,
+.Sy pr_nsysarg
+is the number of arguments to the system call and
+.Sy pr_sysarg
+contains the actual arguments.
+.Pp
+.Sy pr_rval1 ,
+.Sy pr_rval2 ,
+and
+.Sy pr_errno
+are defined only if the lwp
+is stopped on
+.Sy PR_SYSEXIT
+or if the
+.Sy PR_VFORKP
+flag is set.
+If
+.Sy pr_errno
+is zero,
+.Sy pr_rval1
+and
+.Sy pr_rval2
+contain the return values from the system call.
+Otherwise,
+.Sy pr_errno
+contains the error number for the failing system call (see
+.In sys/errno.h ) .
+.Pp
+.Sy pr_clname
+contains the name of the lwp's scheduling class.
+.Pp
+.Sy pr_tstamp ,
+if the lwp is stopped, contains a time stamp marking when the
 lwp stopped, in real time seconds and nanoseconds since an arbitrary time in
 the past.
-.sp
-.LP
-\fBpr_utime\fR is the amount of user level CPU time used by this LWP.
-.sp
-.LP
-\fBpr_stime\fR is the amount of system level CPU time used by this LWP.
-.sp
-.LP
-\fBpr_ustack\fR is the virtual address of the \fBstack_t\fR that contains the
-stack boundaries for this LWP. See \fBgetustack\fR(2) and
-\fB_stack_grow\fR(3C).
-.sp
-.LP
-\fBpr_instr\fR contains the machine instruction to which the lwp's program
-counter refers. The amount of data retrieved from the process is
-machine-dependent. On SPARC based machines, it is a 32-bit word. On x86-based
-machines, it is a single byte. In general, the size is that of the machine's
-smallest instruction. If \fBPR_PCINVAL\fR is set, \fBpr_instr\fR is undefined;
-this occurs whenever the lwp is not stopped or when the program counter refers
-to an invalid virtual address.
-.sp
-.LP
-\fBpr_reg\fR is an array holding the contents of a stopped lwp's general
-registers.
-.sp
-.ne 2
-.na
-\fBSPARC\fR
-.ad
-.RS 21n
-On SPARC-based machines, the predefined constants \fBR_G0\fR ... \fBR_G7\fR,
-\fBR_O0\fR ... \fBR_O7\fR, \fBR_L0\fR ... \fBR_L7\fR, \fBR_I0\fR ...
-\fBR_I7\fR, \fBR_PC\fR, \fBR_nPC\fR, and \fBR_Y\fR can be used as indices to
-refer to the corresponding registers; previous register windows can be read
-from their overflow locations on the stack (however, see the \fBgwindows\fR
-file in the \fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwpid\fR subdirectory).
-.RE
-
-.sp
-.ne 2
-.na
-\fBSPARC V8 (32-bit)\fR
-.ad
-.RS 21n
+.Pp
+.Sy pr_utime
+is the amount of user level CPU time used by this LWP.
+.Pp
+.Sy pr_stime
+is the amount of system level CPU time used by this LWP.
+.Pp
+.Sy pr_ustack
+is the virtual address of the
+.Sy stack_t
+that contains the stack boundaries for this LWP.
+See
+.Xr getustack 2
+and
+.Xr _stack_grow 3C .
+.Pp
+.Sy pr_instr
+contains the machine instruction to which the lwp's program counter refers.
+The amount of data retrieved from the process is machine-dependent.
+On SPARC based machines, it is a 32-bit word.
+On x86-based machines, it is a single byte.
+In general, the size is that of the machine's smallest instruction.
+If
+.Sy PR_PCINVAL
+is set,
+.Sy pr_instr
+is undefined; this occurs whenever the lwp is not stopped or when the program
+counter refers to an invalid virtual address.
+.Pp
+.Sy pr_reg
+is an array holding the contents of a stopped lwp's general registers.
+.Bl -tag -offset left -width "SPARC V8 (32-bit)"
+.It Sy SPARC
+On SPARC-based machines, the predefined constants
+.Sy R_G0
+\&.\&.\&.
+.Sy R_G7 ,
+.Sy R_O0
+\&.\&.\&.
+.Sy R_O7 ,
+.Sy R_L0
+\&.\&.\&.
+.Sy R_L7 ,
+.Sy R_I0
+\&.\&.\&.
+.Sy R_I7 ,
+.Sy R_PC ,
+.Sy R_nPC ,
+and
+.Sy R_Y
+can be used as indices to refer to the corresponding registers; previous
+register windows can be read from their overflow locations on the stack
+(however, see the
+.Pa gwindows
+file in the
+.Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid
+subdirectory).
+.It Sy SPARC V8 (32-bit)
 For SPARC V8 (32-bit) controlling processes, the predefined constants
-\fBR_PSR\fR, \fBR_WIM\fR, and \fBR_TBR\fR can be used as indices to refer to
-the corresponding special registers. For SPARC V9 (64-bit) controlling
-processes, the predefined constants \fBR_CCR\fR, \fBR_ASI\fR, and \fBR_FPRS\fR
+.Sy R_PSR ,
+.Sy R_WIM ,
+and
+.Sy R_TBR
 can be used as indices to refer to the corresponding special registers.
-.RE
-
-.sp
-.ne 2
-.na
-\fBx86 (32-bit)\fR
-.ad
-.RS 21n
+For SPARC V9 (64-bit) controlling processes, the predefined constants
+.Sy R_CCR ,
+.Sy R_ASI ,
+and
+.Sy R_FPRS
+can be used as indices to refer to the corresponding special registers.
+.It Sy x86 (32-bit)
 For 32-bit x86 processes, the predefined constants listed belowcan be used as
 indices to refer to the corresponding registers.
-.sp
-.in +2
-.nf
-SS
-UESP
-EFL
-CS
-EIP
-ERR
-TRAPNO
-EAX
-ECX
-EDX
-EBX
-ESP
-EBP
-ESI
-EDI
-DS
-ES
-GS
-.fi
-.in -2
-
-The preceding constants are listed in \fB<sys/regset.h>\fR\&.
-.sp
+.Bl -tag -width "TRAPNO" -offset indent -compact
+.It SS
+.It UESP
+.It EFL
+.It CS
+.It EIP
+.It ERR
+.It TRAPNO
+.It EAX
+.It ECX
+.It EDX
+.It EBX
+.It ESP
+.It EBP
+.It ESI
+.It EDI
+.It DS
+.It ES
+.It GS
+.El
+.Pp
+The preceding constants are listed in
+.In sys/regset.h .
+.Pp
 Note that a 32-bit process can run on an x86 64-bit system, using the constants
 listed above.
-.RE
-
-.sp
-.ne 2
-.na
-\fBx86 (64-bit)\fR
-.ad
-.RS 21n
-To read the registers of a 32- \fBor\fR a 64-bit process, a 64-bit x86 process
-should use the predefined constants listed below.
-.sp
-.in +2
-.nf
-REG_GSBASE
-REG_FSBASE
-REG_DS
-REG_ES
-REG_GS
-REG_FS
-REG_SS
-REG_RSP
-REG_RFL
-REG_CS
-REG_RIP
-REG_ERR
-REG_TRAPNO
-REG_RAX
-REG_RCX
-REG_RDX
-REG_RBX
-REG_RBP
-REG_RSI
-REG_RDI
-REG_R8
-REG_R9
-REG_R10
-REG_R11
-REG_R12
-REG_R13
-REG_R14
-REG_R15
-.fi
-.in -2
-
-The preceding constants are listed in \fB<sys/regset.h>\fR\&.
-.RE
-
-.sp
-.LP
-\fBpr_fpreg\fR is a structure holding the contents of the floating-point
-registers.
-.sp
-.LP
+.It Sy x86 (64-bit)
+To read the registers of a 32-
+.Em or
+a 64-bit process, a 64-bit x86 process should use the predefined constants
+listed below.
+.Bl -tag -width "REG_TRAPNO" -offset indent -compact
+.It REG_GSBASE
+.It REG_FSBASE
+.It REG_DS
+.It REG_ES
+.It REG_GS
+.It REG_FS
+.It REG_SS
+.It REG_RSP
+.It REG_RFL
+.It REG_CS
+.It REG_RIP
+.It REG_ERR
+.It REG_TRAPNO
+.It REG_RAX
+.It REG_RCX
+.It REG_RDX
+.It REG_RBX
+.It REG_RBP
+.It REG_RSI
+.It REG_RDI
+.It REG_R8
+.It REG_R9
+.It REG_R10
+.It REG_R11
+.It REG_R12
+.It REG_R13
+.It REG_R14
+.It REG_R15
+.El
+.Pp
+The preceding constants are listed in
+.In sys/regset.h .
+.El
+.Pp
+.Sy pr_fpreg
+is a structure holding the contents of the floating-point registers.
+.Pp
 SPARC registers, both general and floating-point, as seen by a 64-bit
 controlling process are the V9 versions of the registers, even if the target
-process is a 32-bit (V8) process. V8 registers are a subset of the V9
-registers.
-.sp
-.LP
+process is a 32-bit (V8) process.
+V8 registers are a subset of the V9 registers.
+.Pp
 If the lwp is not stopped, all register values are undefined.
-.SS "psinfo"
-.LP
+.Ss psinfo
 Contains miscellaneous information about the process and the representative lwp
-needed by the \fBps\fR(1) command. \fBpsinfo\fR remains accessible after a
-process becomes a \fIzombie\fR. The file contains a \fBpsinfo\fR structure
-which contains an embedded \fBlwpsinfo\fR structure for the representative lwp,
-as follows:
-.sp
-.in +2
-.nf
+needed by the
+.Xr ps 1
+command.
+.Sy psinfo
+remains accessible after a process becomes a
+.Em zombie .
+The file contains a
+.Sy psinfo
+structure which contains an embedded
+.Sy lwpsinfo
+structure for the representative lwp, as follows:
+.Bd -literal -offset 2
 typedef struct psinfo {
     int pr_flag;             /* process flags (DEPRECATED: see below) */
     int pr_nlwp;             /* number of active lwps in the process */
@@ -901,34 +989,65 @@ typedef struct psinfo {
     zoneid_t pr_zoneid;      /* zone id */
     ctid_t pr_contract;      /* process contract id */
 } psinfo_t;
-.fi
-.in -2
-
-.sp
-.LP
-Some of the entries in \fBpsinfo\fR, such as \fBpr_addr\fR, refer to internal
-kernel data structures and should not be expected to retain their meanings
-across different versions of the operating system.
-.sp
-.LP
-\fBpsinfo_t.pr_flag\fR is a deprecated interface that should no longer be used.
-Applications currently relying on the \fBSSYS\fR bit in \fBpr_flag\fR should
-migrate to checking \fBPR_ISSYS\fR in the \fBpstatus\fR structure's
-\fBpr_flags\fR field.
-.sp
-.LP
-\fBpr_pctcpu\fR and \fBpr_pctmem\fR are 16-bit binary fractions in the range
-0.0 to 1.0 with the binary point to the right of the high-order bit (1.0 ==
-0x8000). \fBpr_pctcpu\fR is the summation over all lwps in the process.
-.sp
-.LP
-\fBpr_lwp\fR contains the \fBps\fR(1) information for the representative lwp.
-If the process is a \fIzombie\fR, \fBpr_nlwp\fR, \fBpr_nzomb\fR, and
-\fBpr_lwp.pr_lwpid\fR are zero and the other fields of \fBpr_lwp\fR are
-undefined:
-.sp
-.in +2
-.nf
+.Ed
+.Pp
+Some of the entries in
+.Sy psinfo ,
+such as
+.Sy pr_addr ,
+refer to internal kernel data structures and should not be expected to retain
+their meanings across different versions of the operating system.
+.Pp
+.Sy psinfo_t.pr_flag
+is a deprecated interface that should no longer be used.
+Applications currently relying on the
+.Sy SSYS
+bit in
+.Sy pr_flag
+should migrate to checking
+.Sy PR_ISSYS
+in the
+.Sy pstatus
+structure's
+.Sy pr_flags
+field.
+.Pp
+.Sy pr_pctcpu
+and
+.Sy pr_pctmem
+are 16-bit binary fractions in the range 0.0 to 1.0 with the binary point to
+the right of the high-order bit (1.0 == 0x8000).
+.Sy pr_pctcpu
+is the summation over all lwps in the process.
+.Pp
+The
+.Sy pr_fname
+and
+.Sy pr_psargs
+are writable by the owner of the process.
+To write to them, the
+.Sy psinfo
+file should be open for writing and the desired value for the field should be
+written at the file offset that corresponds to the member of structure.
+No other entry may be written to; if a write is attempted to an offset that
+does not represent one of these two memers, or if the size of the write is not
+exactly the size of the member being written, no bytes will be written and
+zero will be returned.
+.Pp
+.Sy pr_lwp
+contains the
+.Xr ps 1
+information for the representative lwp.
+If the process is a
+.Em zombie ,
+.Sy pr_nlwp ,
+.Sy pr_nzomb ,
+and
+.Sy pr_lwp.pr_lwpid
+are zero and the other fields of
+.Sy pr_lwp
+are undefined:
+.Bd -literal -offset 2
 typedef struct lwpsinfo {
     int pr_flag;             /* lwp flags (DEPRECATED: see below) */
     id_t pr_lwpid;           /* lwp id */
@@ -952,34 +1071,41 @@ typedef struct lwpsinfo {
     psetid_t pr_bindpset;    /* processor set to which lwp is bound */
     lgrp_id_t pr_lgrp	      /* home lgroup */
 } lwpsinfo_t;
-.fi
-.in -2
-
-.sp
-.LP
-Some of the entries in \fBlwpsinfo\fR, such as \fBpr_addr\fR, \fBpr_wchan\fR,
-\fBpr_stype\fR, \fBpr_state\fR, and \fBpr_name\fR, refer to internal kernel
-data structures and should not be expected to retain their meanings across
-different versions of the operating system.
-.sp
-.LP
-\fBlwpsinfo_t.pr_flag\fR is a deprecated interface that should no longer be
-used.
-.sp
-.LP
-\fBpr_pctcpu\fR is a 16-bit binary fraction, as described above. It represents
-the \fBCPU\fR time used by the specific lwp. On a multi-processor machine, the
-maximum value is 1/N, where N is the number of \fBCPU\fRs.
-.sp
-.LP
-\fBpr_contract\fR is the id of the process contract of which the process is a
-member. See \fBcontract\fR(4) and \fBprocess\fR(4).
-.SS "cred"
-.LP
+.Ed
+.Pp
+Some of the entries in
+.Sy lwpsinfo ,
+such as
+.Sy pr_addr ,
+.Sy pr_wchan ,
+.Sy pr_stype ,
+.Sy pr_state ,
+and
+.Sy pr_name ,
+refer to internal kernel data structures and should not be expected to retain
+their meanings across different versions of the operating system.
+.Pp
+.Sy lwpsinfo_t.pr_flag
+is a deprecated interface that should no longer be used.
+.Pp
+.Sy pr_pctcpu
+is a 16-bit binary fraction, as described above.
+It represents the
+.Sy CPU
+time used by the specific lwp.
+On a multi-processor machine, the maximum value is 1/N, where N is the number
+of
+.Sy CPU Ns s .
+.Pp
+.Sy pr_contract
+is the id of the process contract of which the process is a member.
+See
+.Xr contract 4
+and
+.Xr process 4 .
+.Ss cred
 Contains a description of the credentials associated with the process:
-.sp
-.in +2
-.nf
+.Bd -literal -offset 2
 typedef struct prcred {
 	uid_t pr_euid;      /* effective user id */
 	uid_t pr_ruid;      /* real user id */
@@ -990,56 +1116,46 @@ typedef struct prcred {
 	int pr_ngroups;     /* number of supplementary groups */
 	gid_t pr_groups[1]; /* array of supplementary groups */
 } prcred_t;
-.fi
-.in -2
-.sp
-
-.sp
-.LP
-The array of associated supplementary groups in \fBpr_groups\fR is of variable
-length; the \fBcred\fR file contains all of the supplementary groups.
-\fBpr_ngroups\fR indicates the number of supplementary groups. (See also the
-\fBPCSCRED\fR and \fBPCSCREDX\fR control operations.)
-.SS "priv"
-.LP
+.Ed
+.Pp
+The array of associated supplementary groups in
+.Sy pr_groups
+ is of variable
+length; the
+.Sy cred
+file contains all of the supplementary groups.
+.Sy pr_ngroups
+indicates the number of supplementary groups. (See also the
+.Sy PCSCRED
+and
+.Sy PCSCREDX
+control operations.)
+.Ss priv
 Contains a description of the privileges associated with the process:
-.sp
-.in +2
-.nf
+.Bd -literal -offset 2
 typedef struct prpriv {
      uint32_t        pr_nsets;      /* number of privilege set */
      uint32_t        pr_setsize;    /* size of privilege set */
      uint32_t        pr_infosize;   /* size of supplementary data */
      priv_chunk_t    pr_sets[1];    /* array of sets */
 } prpriv_t;
-.fi
-.in -2
-
-.sp
-.LP
-The actual dimension of the \fBpr_sets\fR[] field is
-.sp
-.in +2
-.nf
-pr_sets[pr_nsets][pr_setsize]
-.fi
-.in -2
-
-.sp
-.LP
+.Ed
+.Pp
+The actual dimension of the
+.Sy pr_sets Ns []
+field is
+.D1 pr_sets[pr_nsets][pr_setsize]
+.Pp
 which is followed by additional information about the process state
-\fBpr_infosize\fR bytes in size.
-.sp
-.LP
+.Sy pr_infosize
+bytes in size.
+.Pp
 The full size of the structure can be computed using
-\fBPRIV_PRPRIV_SIZE\fR(\fBprpriv_t *\fR).
-.SS "secflags"
-.LP
-This file contains the security-flags of the process.  It contains a
-description of the security flags associated with the process.
-.sp
-.in +2
-.nf
+.Fn PRIV_PRPRIV_SIZE "prpriv_t *" .
+.Ss secflags
+This file contains the security-flags of the process.
+It contains a description of the security flags associated with the process.
+.Bd -literal -offset 2
 typedef struct prsecflags {
 	uint32_t pr_version;		/* ABI Versioning of this structure */
 	secflagset_t pr_effective;	/* Effective flags */
@@ -1047,41 +1163,64 @@ typedef struct prsecflags {
 	secflagset_t pr_lower;		/* Lower flags */
 	secflagset_t pr_upper;		/* Upper flags */
 } prsecflags_t;
-.in -2
-
-.sp
-.LP
-The \fBpr_version\fR field is a version number for the structure, currently
-\fBPRSECFLAGS_VERSION_1\fR.
-.SS "sigact"
-.LP
-Contains an array of \fBsigaction structures\fR describing the current
-dispositions of all signals associated with the traced process (see
-\fBsigaction\fR(2)). Signal numbers are displaced by 1 from array indices, so
-that the action for signal number \fIn\fR appears in position \fIn\fR-1 of the
-array.
-.SS "auxv"
-.LP
+.Ed
+.Pp
+The
+.Sy pr_version
+field is a version number for the structure, currently
+.Sy PRSECFLAGS_VERSION_1 .
+.Ss sigact
+Contains an array of
+.Sy sigaction structures
+describing the current dispositions of all signals associated with the traced
+process (see
+.Xr sigaction 2 ) .
+Signal numbers are displaced by 1 from array indices, so that the action for
+signal number
+.Va n
+appears in position
+.Va n Ns -1
+of the array.
+.Ss auxv
 Contains the initial values of the process's aux vector in an array of
-\fBauxv_t\fR structures (see \fB<sys/auxv.h>\fR). The values are those that
-were passed by the operating system as startup information to the dynamic
-linker.
-.SS "ldt"
-.LP
-This file exists only on x86-based machines. It is non-empty only if the
-process has established a local descriptor table (\fBLDT\fR). If non-empty, the
-file contains the array of currently active \fBLDT\fR entries in an array of
-elements of type \fBstruct ssd\fR, defined in \fB<sys/sysi86.h>\fR, one element
-for each active \fBLDT\fR entry.
-.SS "map, xmap"
-.LP
-Contain information about the virtual address map of the process. The map file
-contains an array of \fBprmap\fR structures while the xmap file contains an
-array of \fBprxmap\fR structures. Each structure describes a contiguous virtual
+.Sy auxv_t
+structures (see
+.In sys/auxv.h ) .
+The values are those that were passed by the operating system as startup
+information to the dynamic linker.
+.Ss argv
+Contains the concatenation of each of the argument strings, including their
+.Sy NUL
+terminators, in the argument vector
+.Pq Va argv
+for the process.
+If the process has modified either its argument vector, or the contents of
+any of the strings referenced by that vector, those changes will be visible
+here.
+.Ss ldt
+This file exists only on x86-based machines.
+It is non-empty only if the process has established a local descriptor table
+.Pq Sy LDT .
+If non-empty, the file contains the array of currently active
+.Sy LDT
+entries in an array of elements of type
+.Vt struct ssd ,
+defined in
+.In sys/sysi86.h ,
+one element for each active
+.Sy LDT
+entry.
+.Ss map, xmap
+Contain information about the virtual address map of the process.
+The map file contains an array of
+.Sy prmap
+structures while the xmap file contains an
+array of
+.Sy prxmap
+structures.
+Each structure describes a contiguous virtual
 address region in the address space of the traced process:
-.sp
-.in +2
-.nf
+.Bd -literal -offset 2
 typedef struct prmap {
 	uintptr_tpr_vaddr;         /* virtual address of mapping */
 	size_t pr_size;            /* size of mapping in bytes */
@@ -1091,13 +1230,8 @@ typedef struct prmap {
 	int pr_pagesize;           /* pagesize for this mapping in bytes */
 	int pr_shmid;              /* SysV shared memory identifier */
 } prmap_t;
-.fi
-.in -2
-.sp
-
-.sp
-.in +2
-.nf
+.Ed
+.Bd -literal -offset 2
 typedef struct prxmap {
 	uintptr_t pr_vaddr;        /* virtual address of mapping */
 	size_t pr_size;            /* size of mapping in bytes */
@@ -1113,222 +1247,229 @@ typedef struct prxmap {
 	size_t pr_locked;          /* pages of locked memory */
 	uint64_t pr_hatpagesize;   /* pagesize of mapping */
 } prxmap_t;
-.fi
-.in -2
-.sp
-
-.sp
-.LP
-\fBpr_vaddr\fR is the virtual address of the mapping within the traced process
-and \fBpr_size\fR is its size in bytes. \fBpr_mapname\fR, if it does not
-contain a null string, contains the name of a file in the \fBobject\fR
+.Ed
+.Pp
+.Sy pr_vaddr
+is the virtual address of the mapping within the traced process and
+.Sy pr_size
+is its size in bytes.
+.Sy pr_mapname ,
+if it does not contain a null string, contains the name of a file in the
+.Sy object
 directory (see below) that can be opened read-only to obtain a file descriptor
-for the mapped file associated with the mapping. This enables a debugger to
-find object file symbol tables without having to know the real path names of
-the executable file and shared libraries of the process. \fBpr_offset\fR is the
-64-bit offset within the mapped file (if any) to which the virtual address is
-mapped.
-.sp
-.LP
-\fBpr_mflags\fR is a bit-mask of protection and attribute flags:
-.sp
-.ne 2
-.na
-\fB\fBMA_READ\fR\fR
-.ad
-.RS 17n
+for the mapped file associated with the mapping.
+This enables a debugger to find object file symbol tables without having to
+know the real path names of the executable file and shared libraries of
+the process.
+.Sy pr_offset
+is the 64-bit offset within the mapped file (if any) to which the virtual
+address is mapped.
+.Pp
+.Sy pr_mflags
+is a bit-mask of protection and attribute flags:
+.Bl -tag -width "MA_NORESERVE" -offset left
+.It Sy MA_READ
 mapping is readable by the traced process.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBMA_WRITE\fR\fR
-.ad
-.RS 17n
+.It Sy MA_WRITE
 mapping is writable by the traced process.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBMA_EXEC\fR\fR
-.ad
-.RS 17n
+.It Sy MA_EXEC
 mapping is executable by the traced process.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBMA_SHARED\fR\fR
-.ad
-.RS 17n
+.It Sy MA_SHARED
 mapping changes are shared by the mapped object.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBMA_ISM\fR\fR
-.ad
-.RS 17n
+.It Sy MA_ISM
 mapping is intimate shared memory (shared MMU resources)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBMAP_NORESERVE\fR\fR
-.ad
-.RS 17n
+.It Sy MAP_NORESERVE
 mapping does not have swap space reserved (mapped with MAP_NORESERVE)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBMA_SHM\fR\fR
-.ad
-.RS 17n
+.It Sy MA_SHM
 mapping System V shared memory
-.RE
-
-.sp
-.LP
+.El
+.Pp
 A contiguous area of the address space having the same underlying mapped object
 may appear as multiple mappings due to varying read, write, and execute
-attributes. The underlying mapped object does not change over the range of a
-single mapping. An \fBI/O\fR operation to a mapping marked \fBMA_SHARED\fR
+attributes.
+The underlying mapped object does not change over the range of a
+single mapping.
+An
+.Sy I/O
+operation to a mapping marked
+.Sy MA_SHARED
 fails if applied at a virtual address not corresponding to a valid page in the
-underlying mapped object. A write to a \fBMA_SHARED\fR mapping that is not
-marked \fBMA_WRITE\fR fails. Reads and writes to private mappings always
-succeed. Reads and writes to unmapped addresses fail.
-.sp
-.LP
-\fBpr_pagesize\fR is the page size for the mapping, currently always the system
-pagesize.
-.sp
-.LP
-\fBpr_shmid\fR is the shared memory identifier, if any, for the mapping. Its
-value is \fB\(mi1\fR if the mapping is not System V shared memory. See
-\fBshmget\fR(2).
-.sp
-.LP
-\fBpr_dev\fR is the device of the mapped object, if any, for the mapping. Its
-value is \fBPRNODEV\fR (-1) if the mapping does not have a device.
-.sp
-.LP
-\fBpr_ino\fR is the inode of the mapped object, if any, for the mapping. Its
-contents are only valid if \fBpr_dev\fR is not \fBPRNODEV.\fR
-.sp
-.LP
-\fBpr_rss\fR is the number of resident pages of memory for the mapping. The
-number of resident bytes for the mapping may be determined by multiplying
-\fBpr_rss\fR by the page size given by \fBpr_pagesize.\fR
-.sp
-.LP
-\fBpr_anon\fR is the number of resident anonymous memory pages (pages which are
+underlying mapped object.
+A write to a
+.Sy MA_SHARED
+mapping that is not marked
+.Sy MA_WRITE
+fails.
+Reads and writes to private mappings always succeed.
+Reads and writes to unmapped addresses fail.
+.Pp
+.Sy pr_pagesize
+is the page size for the mapping, currently always the system pagesize.
+.Pp
+.Sy pr_shmid
+is the shared memory identifier, if any, for the mapping.
+Its value is \-1
+if the mapping is not System V shared memory.
+See
+.Xr shmget 2 .
+.Pp
+.Sy pr_dev
+is the device of the mapped object, if any, for the mapping.
+Its value is
+.Sy PRNODEV
+.Pq \-1
+if the mapping does not have a device.
+.Pp
+.Sy pr_ino
+is the inode of the mapped object, if any, for the mapping.
+Its contents are only valid if
+.Sy pr_dev
+is not
+.Sy PRNODEV .
+.Pp
+.Sy pr_rss
+is the number of resident pages of memory for the mapping.
+The number of resident bytes for the mapping may be determined by multiplying
+.Sy pr_rss
+by the page size given by
+.Sy pr_pagesize .
+.Pp
+.Sy pr_anon
+is the number of resident anonymous memory pages (pages which are
 private to this process) for the mapping.
-.sp
-.LP
-\fBpr_locked\fR is the number of locked pages for the mapping. Pages which are
-locked are always resident in memory.
-.sp
-.LP
-\fBpr_hatpagesize\fR is the size, in bytes, of the \fBHAT\fR (\fBMMU\fR)
-translation for the mapping. \fBpr_hatpagesize\fR may be different than
-\fBpr_pagesize.\fR The possible values are hardware architecture specific, and
+.Pp
+.Sy pr_locked
+is the number of locked pages for the mapping.
+Pages which are locked are always resident in memory.
+.Pp
+.Sy pr_hatpagesize
+is the size, in bytes, of the
+.Sy HAT
+.Pq Sy MMU
+translation for the mapping.
+.Sy pr_hatpagesize
+may be different than
+.Sy pr_pagesize .
+The possible values are hardware architecture specific, and
 may change over a mapping's lifetime.
-.SS "rmap"
-.LP
-Contains information about the reserved address ranges of the process. The file
-contains an array of \fBprmap\fR structures, as defined above for the \fBmap\fR
-file. Each structure describes a contiguous virtual address region in the
+.Ss rmap
+Contains information about the reserved address ranges of the process.
+The file contains an array of
+.Sy prmap
+structures, as defined above for the
+.Sy map
+file.
+Each structure describes a contiguous virtual address region in the
 address space of the traced process that is reserved by the system in the sense
-that an \fBmmap\fR(2) system call that does not specify \fBMAP_FIXED\fR will
-not use any part of it for the new mapping. Examples of such reservations
-include the address ranges reserved for the process stack and the individual
-thread stacks of a multi-threaded process.
-.SS "cwd"
-.LP
-A symbolic link to the process's current working directory. See \fBchdir\fR(2).
-A \fBreadlink\fR(2) of \fB/proc/\fIpid\fR/cwd\fR yields a null string. However,
-it can be opened, listed, and searched as a directory, and can be the target of
-\fBchdir\fR(2).
-.SS "root"
-.LP
+that an
+.Xr mmap 2
+system call that does not specify
+.Sy MAP_FIXED
+will not use any part of it for the new mapping.
+Examples of such reservations include the address ranges reserved for the
+process stack and the individual thread stacks of a multi-threaded process.
+.Ss cwd
+A symbolic link to the process's current working directory.
+See
+.Xr chdir 2 .
+A
+.Xr readlink 2
+of
+.Pa /proc/ Ns Em pid Ns Pa /cwd
+yields a null string.
+However, it can be opened, listed, and searched as a directory, and can be the
+target of
+.Xr chdir 2 .
+.Ss root
 A symbolic link to the process's root directory.
-\fB/proc/\fR\fIpid\fR\fB/root\fR can differ from the system root directory if
-the process or one of its ancestors executed \fBchroot\fR(2) as super user. It
-has the same semantics as \fB/proc/\fR\fIpid\fR\fB/cwd\fR.
-.SS "fd"
-.LP
-A directory containing references to the open files of the process. Each entry
-is a decimal number corresponding to an open file descriptor in the process.
-.sp
-.LP
+.Pa /proc/ Ns Em pid Ns Pa /root
+can differ from the system root directory if the process or one of its
+ancestors executed
+.Xr chroot 2
+as super user.
+It has the same semantics as
+.Pa /proc/ Ns Em pid Ns Pa /cwd .
+.Ss fd
+A directory containing references to the open files of the process.
+Each entry is a decimal number corresponding to an open file descriptor in the
+process.
+.Pp
 If an entry refers to a regular file, it can be opened with normal file system
 semantics but, to ensure that the controlling process cannot gain greater
 access than the controlled process, with no file access modes other than its
-read/write open modes in the controlled process. If an entry refers to a
-directory, it can be accessed with the same semantics as
-\fB/proc/\fIpid\fR/cwd\fR. An attempt to open any other type of entry fails
-with \fBEACCES\fR.
-.SS "object"
-.LP
+read/write open modes in the controlled process.
+If an entry refers to a directory, it can be accessed with the same semantics
+as
+.Pa /proc/ Ns Em pid Ns Pa /cwd .
+An attempt to open any other type of entry fails with
+.Er EACCES .
+.Ss object
 A directory containing read-only files with names corresponding to the
-\fBpr_mapname\fR entries in the \fBmap\fR and \fBpagedata\fR files. Opening
-such a file yields a file descriptor for the underlying mapped file associated
-with an address-space mapping in the process. The file name \fBa.out\fR appears
-in the directory as an alias for the process's executable file.
-.sp
-.LP
-The \fBobject\fR directory makes it possible for a controlling process to gain
+.Sy pr_mapname
+entries in the
+.Sy map
+and
+.Sy pagedata
+files.
+Opening such a file yields a file descriptor for the underlying mapped file
+associated with an address-space mapping in the process.
+The file name
+.Pa a.out
+appears in the directory as an alias for the process's executable file.
+.Pp
+The
+.Pa object
+directory makes it possible for a controlling process to gain
 access to the object file and any shared libraries (and consequently the symbol
 tables) without having to know the actual path names of the executable files.
-.SS "path"
-.LP
-A directory containing symbolic links to files opened by the process. The
-directory includes one entry for \fBcwd\fR and \fBroot\fR. The directory also
-contains a numerical entry for each file descriptor in the \fBfd\fR directory,
-and entries matching those in the \fBobject\fR directory. If this information
-is not available, any attempt to read the contents of the symbolic link will
-fail. This is most common for files that do not exist in the filesystem
-namespace (such as \fBFIFO\fRs and sockets), but can also happen for regular
-files. For the file descriptor entries, the path may be different from the one
+.Ss path
+A directory containing symbolic links to files opened by the process.
+The directory includes one entry for
+.Pa cwd
+and
+.Pa root .
+The directory also contains a numerical entry for each file descriptor in the
+.Pa fd
+directory, and entries matching those in the
+.Pa object
+directory.
+If this information is not available, any attempt to read the contents of the
+symbolic link will fail.
+This is most common for files that do not exist in the filesystem namespace
+(such as
+.Sy FIFO Ns s
+and sockets), but can also happen for regular files.
+For the file descriptor entries, the path may be different from the one
 used by the process to open the file.
-.SS "pagedata"
-.LP
+.Ss pagedata
 Opening the page data file enables tracking of address space references and
 modifications on a per-page basis.
-.sp
-.LP
-A \fBread\fR(2) of the page data file descriptor returns structured page data
-and atomically clears the page data maintained for the file by the system. That
-is to say, each read returns data collected since the last read; the first read
-returns data collected since the file was opened. When the call completes, the
-read buffer contains the following structure as its header and thereafter
-contains a number of section header structures and associated byte arrays that
-must be accessed by walking linearly through the buffer.
-.sp
-.in +2
-.nf
+.Pp
+A
+.Xr read 2
+of the page data file descriptor returns structured page data
+and atomically clears the page data maintained for the file by the system.
+That is to say, each read returns data collected since the last read; the
+first read returns data collected since the file was opened.
+When the call completes, the read buffer contains the following structure as
+its header and thereafter contains a number of section header structures and
+associated byte arrays that must be accessed by walking linearly through the
+buffer.
+.Bd -literal -offset 2
 typedef struct prpageheader {
     timestruc_t pr_tstamp; /* real time stamp, time of read() */
     ulong_t pr_nmap;       /* number of address space mappings */
     ulong_t pr_npage;      /* total number of pages */
 } prpageheader_t;
-.fi
-.in -2
-
-.sp
-.LP
-The header is followed by \fBpr_nmap prasmap\fR structures and associated data
-arrays. The \fBprasmap\fR structure contains the following elements:
-.sp
-.in +2
-.nf
+.Ed
+.Pp
+The header is followed by
+.Sy "pr_nmap prasmap"
+structures and associated data arrays.
+The
+.Sy prasmap
+structure contains the following elements:
+.Bd -literal -offset 2
 typedef struct prasmap {
     uintptr_t pr_vaddr;        /* virtual address of mapping */
     ulong_t pr_npage;          /* number of pages in mapping */
@@ -1338,59 +1479,56 @@ typedef struct prasmap {
     int pr_pagesize;           /* pagesize for this mapping in bytes */
     int pr_shmid;              /* SysV shared memory identifier */
 } prasmap_t;
-.fi
-.in -2
-
-.sp
-.LP
-Each section header is followed by \fBpr_npage\fR bytes, one byte for each page
-in the mapping, plus 0-7 null bytes at the end so that the next \fBprasmap\fR
-structure begins on an eight-byte aligned boundary. Each data byte may contain
-these flags:
-.sp
-.ne 2
-.na
-\fB\fBPG_REFERENCED\fR\fR
-.ad
-.RS 17n
+.Ed
+.Pp
+Each section header is followed by
+.Sy pr_npage
+bytes, one byte for each page in the mapping, plus 0-7 null bytes at the end
+so that the next
+.Sy prasmap
+structure begins on an eight-byte aligned boundary.
+Each data byte may contain these flags:
+.Bl -tag -width "PG_REFERENCED" -offset 2
+.It Sy PG_REFERENCED
 page has been referenced.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPG_MODIFIED\fR\fR
-.ad
-.RS 17n
+.It Sy PG_MODIFIED
 page has been modified.
-.RE
-
-.sp
-.LP
+.El
+.Pp
 If the read buffer is not large enough to contain all of the page data, the
-read fails with \fBE2BIG\fR and the page data is not cleared. The required size
-of the read buffer can be determined through \fBfstat\fR(2). Application of
-\fBlseek\fR(2) to the page data file descriptor is ineffective; every read
-starts from the beginning of the file. Closing the page data file descriptor
+read fails with
+.Er E2BIG
+and the page data is not cleared.
+The required size of the read buffer can be determined through
+.Xr fstat 2 .
+Application of
+.Xr lseek 2
+to the page data file descriptor is ineffective; every read
+starts from the beginning of the file.
+Closing the page data file descriptor
 terminates the system overhead associated with collecting the data.
-.sp
-.LP
+.Pp
 More than one page data file descriptor for the same process can be opened, up
-to a system-imposed limit per traced process. A read of one does not affect the
-data being collected by the system for the others. An open of the page data
-file will fail with \fBENOMEM\fR if the system-imposed limit would be exceeded.
-.SS "watch"
-.LP
-Contains an array of \fBprwatch\fR structures, one for each watched area
-established by the \fBPCWATCH\fR control operation. See \fBPCWATCH\fR for
-details.
-.SS "usage"
-.LP
-Contains process usage information described by a \fBprusage\fR structure which
-contains at least the following fields:
-.sp
-.in +2
-.nf
+to a system-imposed limit per traced process.
+A read of one does not affect the data being collected by the system for the
+others.
+An open of the page data file will fail with
+.Er ENOMEM
+if the system-imposed limit would be exceeded.
+.Ss watch
+Contains an array of
+.Vt prwatch
+structures, one for each watched area established by the
+.Sy PCWATCH
+control operation.
+See
+.Sx PCWATCH
+for details.
+.Ss usage
+Contains process usage information described by a
+.Vt prusage
+structure which contains at least the following fields:
+.Bd -literal -offset 2
 typedef struct prusage {
     id_t pr_lwpid;           /* lwp id.  0: process or defunct */
     int pr_count;            /* number of contributing lwps */
@@ -1421,1548 +1559,1529 @@ typedef struct prusage {
     ulong_t pr_sysc;         /* system calls */
     ulong_t pr_ioch;         /* chars read and written */
 } prusage_t;
-.fi
-.in -2
-
-.sp
-.LP
-Microstate accounting is now continuously enabled. While this information was
+.Ed
+.Pp
+Microstate accounting is now continuously enabled.
+While this information was
 previously an estimate, if microstate accounting were not enabled, the current
 information is now never an estimate represents time the process has spent in
 various states.
-.SS "lstatus"
-.LP
-Contains a \fBprheader\fR structure followed by an array of \fBlwpstatus\fR
+.Ss lstatus
+Contains a
+.Vt prheader
+structure followed by an array of
+.Vt lwpstatus
 structures, one for each active lwp in the process (see also
-\fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwpid\fR/\fBlwpstatus\fR, below). The
-\fBprheader\fR structure describes the number and size of the array entries
-that follow.
-.sp
-.in +2
-.nf
+.Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /lwpstatus ,
+below).
+The
+.Vt prheader
+structure describes the number and size of the array entries that follow.
+.Bd -literal -offset 2
 typedef struct prheader {
     long pr_nent;        /* number of entries */
     size_t pr_entsize;   /* size of each entry, in bytes */
 } prheader_t;
-.fi
-.in -2
-
-.sp
-.LP
-The \fBlwpstatus\fR structure may grow by the addition of elements at the end
-in future releases of the system. Programs must use \fBpr_entsize\fR in the
-file header to index through the array. These comments apply to all \fB/proc\fR
-files that include a \fBprheader\fR structure (\fBlpsinfo\fR and \fBlusage\fR,
+.Ed
+.Pp
+The
+.Vt lwpstatus
+structure may grow by the addition of elements at the end in future releases
+of the system.
+Programs must use
+.Sy pr_entsize
+in the file header to index through the array.
+These comments apply to all
+.Pa /proc
+files that include a
+.Vt prheader
+structure
+.Pf ( Pa lpsinfo
+and
+.Pa lusage ,
 below).
-.SS "lpsinfo"
-.LP
-Contains a \fBprheader\fR structure followed by an array of \fBlwpsinfo\fR
-structures, one for eachactive and zombie lwp in the process. See also
-\fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwpid\fR/\fBlwpsinfo\fR, below.
-.SS "lusage"
-.LP
-Contains a \fBprheader\fR structure followed by an array of \fBprusage\fR
+.Ss lpsinfo
+Contains a
+.Vt prheader
+structure followed by an array of
+.Vt lwpsinfo
+structures, one for eachactive and zombie lwp in the process.
+See also
+.Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /lwpsinfo ,
+below.
+.Ss lusage
+Contains a
+.Vt prheader
+structure followed by an array of
+.Vt prusage
 structures, one for each active lwp in the process, plus an additional element
 at the beginning that contains the summation over all defunct lwps (lwps that
-once existed but no longer exist in the process). Excluding the \fBpr_lwpid\fR,
-\fBpr_tstamp\fR, \fBpr_create\fR, and \fBpr_term\fR entries, the entry-by-entry
-summation over all these structures is the definition of the process usage
-information obtained from the \fBusage\fR file. (See also
-\fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwpid\fR/\fBlwpusage\fR, below.)
-.SS "lwp"
-.LP
+once existed but no longer exist in the process).
+Excluding the
+.Sy pr_lwpid ,
+.Sy pr_tstamp ,
+.Sy pr_create ,
+and
+.Sy pr_term
+entries, the entry-by-entry summation over all these structures is the
+definition of the process usage information obtained from the
+.Pa usage
+file. (See also
+.Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /lwpusage ,
+below.)
+.Ss lwp
 A directory containing entries each of which names an active or zombie lwp
-within the process. These entries are themselves directories containing
-additional files as described below. Only the \fBlwpsinfo\fR file exists in the
-directory of a zombie lwp.
-.SH STRUCTURE OF \fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwpid\fR
-.LP
-A given directory \fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwpid\fR contains the
-following entries:
-.SS "lwpctl"
-.LP
-Write-only control file. The messages written to this file affect the specific
+within the process.
+These entries are themselves directories containing additional files as
+described below.
+Only the
+.Pa lwpsinfo
+file exists in the directory of a zombie lwp.
+.Sh "STRUCTURE OF" Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid
+A given directory
+.Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid
+contains the following entries:
+.Ss lwpctl
+Write-only control file.
+The messages written to this file affect the specific
 lwp rather than the representative lwp, as is the case for the process's
-\fBctl\fR file.
-.SS "lwpstatus"
-.LP
-lwp-specific state information. This file contains the \fBlwpstatus\fR
+.Pa ctl
+file.
+.Ss lwpstatus
+lwp-specific state information.
+This file contains the
+.Vt lwpstatus
 structure for the specific lwp as described above for the representative lwp in
-the process's \fBstatus\fR file.
-.SS "lwpsinfo"
-.LP
-lwp-specific \fBps\fR(1) information. This file contains the \fBlwpsinfo\fR
+the process's
+.Pa status
+file.
+.Ss lwpsinfo
+lwp-specific
+.Xr ps 1
+information.
+This file contains the
+.Vt lwpsinfo
 structure for the specific lwp as described above for the representative lwp in
-the process's \fBpsinfo\fR file. The \fBlwpsinfo\fR file remains accessible
-after an lwp becomes a zombie.
-.SS "lwpusage"
-.LP
-This file contains the \fBprusage\fR structure for the specific lwp as
-described above for the process's \fBusage\fR file.
-.SS "gwindows"
-.LP
-This file exists only on SPARC based machines. If it is non-empty, it contains
-a \fBgwindows_t\fR structure, defined in \fB<sys/regset.h>\fR, with the values
-of those SPARC register windows that could not be stored on the stack when the
-lwp stopped. Conditions under which register windows are not stored on the
+the process's
+.Pa psinfo
+file.
+The
+.Pa lwpsinfo
+file remains accessible after an lwp becomes a zombie.
+.Ss lwpusage
+This file contains the
+.Vt prusage
+structure for the specific lwp as described above for the process's
+.Pa usage
+file.
+.Ss gwindows
+This file exists only on SPARC based machines.
+If it is non-empty, it contains a
+.Vt gwindows_t
+structure, defined in
+.In sys/regset.h ,
+with the values of those SPARC register windows that could not be stored on
+the stack when the lwp stopped.
+Conditions under which register windows are not stored on the
 stack are: the stack pointer refers to nonexistent process memory or the stack
-pointer is improperly aligned. If the lwp is not stopped or if there are no
+pointer is improperly aligned.
+If the lwp is not stopped or if there are no
 register windows that could not be stored on the stack, the file is empty (the
 usual case).
-.SS "xregs"
-.LP
-Extra state registers. The extra state register set is architecture dependent;
-this file is empty if the system does not support extra state registers. If the
-file is non-empty, it contains an architecture dependent structure of type
-\fBprxregset_t\fR, defined in \fB<procfs.h>\fR, with the values of the lwp's
-extra state registers. If the lwp is not stopped, all register values are
-undefined. See also the \fBPCSXREG\fR control operation, below.
-.SS "asrs"
-.LP
-This file exists only for 64-bit SPARC V9 processes. It contains an
-\fBasrset_t\fR structure, defined in <\fBsys/regset.h\fR>, containing the
-values of the lwp's platform-dependent ancillary state registers. If the lwp is
-not stopped, all register values are undefined. See also the \fBPCSASRS\fR
+.Ss xregs
+Extra state registers.
+The extra state register set is architecture dependent;
+this file is empty if the system does not support extra state registers.
+If the file is non-empty, it contains an architecture dependent structure of
+type
+.Vt prxregset_t ,
+defined in
+.In procfs.h ,
+with the values of the lwp's extra state registers.
+If the lwp is not stopped, all register values are undefined.
+See also the
+.Sx PCSXREG
+control operation, below.
+.Ss asrs
+This file exists only for 64-bit SPARC V9 processes.
+It contains an
+.Vt asrset_t
+structure, defined in
+.In sys/regset.h ,
+containing the values of the lwp's platform-dependent ancillary state registers.
+If the lwp is not stopped, all register values are undefined.
+See also the
+.Sx PCSASRS
 control operation, below.
-.SS "spymaster"
-.LP
-For an agent lwp (see \fBPCAGENT\fR), this file contains a \fBpsinfo_t\fR
+.Ss spymaster
+For an agent lwp (see
+.Sx PCAGENT ) ,
+this file contains a
+.Vt psinfo_t
 structure that corresponds to the process that created the agent lwp at the
-time the agent was created. This structure is identical to that retrieved via
-the \fBpsinfo\fR file, with one modification: the \fBpr_time\fR field does not
-correspond to the CPU time for the process, but rather to the creation time of
-the agent lwp.
-.SS "templates"
-.LP
+time the agent was created.
+This structure is identical to that retrieved via the
+.Pa psinfo
+file, with one modification: the
+.Sy pr_time
+field does not correspond to the CPU time for the process, but rather to the
+creation time of the agent lwp.
+.Ss templates
 A directory which contains references to the active templates for the lwp,
-named by the contract type. Changes made to an active template descriptor do
+named by the contract type.
+Changes made to an active template descriptor do
 not affect the original template which was activated, though they do affect the
-active template. It is not possible to activate an active template descriptor.
-See \fBcontract\fR(4).
-.SH CONTROL MESSAGES
-.LP
+active template.
+It is not possible to activate an active template descriptor.
+See
+.Xr contract 4 .
+.Sh CONTROL MESSAGES
 Process state changes are effected through messages written to a process's
-\fBctl\fR file or to an individual lwp's \fBlwpctl\fR file. All control
-messages consist of a \fBlong\fR that names the specific operation followed by
+.Sy ctl
+file or to an individual lwp's
+.Sy lwpctl
+file.
+All control messages consist of a
+.Sy long
+that names the specific operation followed by
 additional data containing the operand, if any.
-.sp
-.LP
-Multiple control messages may be combined in a single \fBwrite\fR(2) (or
-\fBwritev\fR(2)) to a control file, but no partial writes are permitted. That
-is, each control message, operation code plus operand, if any, must be
-presented in its entirety to the \fBwrite\fR(2) and not in pieces over several
-system calls. If a control operation fails, no subsequent operations contained
-in the same \fBwrite\fR(2) are attempted.
-.sp
-.LP
-Descriptions of the allowable control messages follow. In all cases, writing a
-message to a control file for a process or lwp that has terminated elicits the
-error \fBENOENT\fR.
-.SS "PCSTOP PCDSTOP PCWSTOP PCTWSTOP"
-.LP
-When applied to the process control file, \fBPCSTOP\fR directs all lwps to stop
-and waits for them to stop, \fBPCDSTOP\fR directs all lwps to stop without
-waiting for them to stop, and \fBPCWSTOP\fR simply waits for all lwps to stop.
-When applied to an lwp control file, \fBPCSTOP\fR directs the specific lwp to
-stop and waits until it has stopped, \fBPCDSTOP\fR directs the specific lwp to
-stop without waiting for it to stop, and \fBPCWSTOP\fR simply waits for the
-specific lwp to stop. When applied to an lwp control file, \fBPCSTOP\fR and
-\fBPCWSTOP\fR complete when the lwp stops on an event of interest, immediately
+.Pp
+Multiple control messages may be combined in a single
+.Xr write 2
+(or
+.Xr writev 2 )
+to a control file, but no partial writes are permitted.
+That is, each control message, operation code plus operand, if any, must be
+presented in its entirety to the
+.Xr write 2
+and not in pieces over several system calls.
+If a control operation fails, no subsequent operations contained in the same
+.Xr write 2
+are attempted.
+.Pp
+Descriptions of the allowable control messages follow.
+In all cases, writing a message to a control file for a process or lwp that
+has terminated elicits the error
+.Er ENOENT .
+.Ss PCSTOP PCDSTOP PCWSTOP PCTWSTOP
+When applied to the process control file,
+.Sy PCSTOP
+directs all lwps to stop and waits for them to stop,
+.Sy PCDSTOP
+directs all lwps to stop without waiting for them to stop, and
+.Sy PCWSTOP
+simply waits for all lwps to stop.
+When applied to an lwp control file,
+.Sy PCSTOP
+directs the specific lwp to stop and waits until it has stopped,
+.Sy PCDSTOP
+directs the specific lwp to stop without waiting for it to stop, and
+.Sy PCWSTOP
+ simply waits for the specific lwp to stop.
+When applied to an lwp control file,
+.Sy PCSTOP
+and
+.Sy PCWSTOP
+complete when the lwp stops on an event of interest, immediately
 if already so stopped; when applied to the process control file, they complete
 when every lwp has stopped either on an event of interest or on a
-\fBPR_SUSPENDED\fR stop.
-.sp
-.LP
-\fBPCTWSTOP\fR is identical to \fBPCWSTOP\fR except that it enables the
-operation to time out, to avoid waiting forever for a process or lwp that may
-never stop on an event of interest. \fBPCTWSTOP\fR takes a \fBlong\fR operand
-specifying a number of milliseconds; the wait will terminate successfully after
-the specified number of milliseconds even if the process or lwp has not
-stopped; a timeout value of zero makes the operation identical to
-\fBPCWSTOP\fR.
-.sp
-.LP
-An ``event of interest'' is either a \fBPR_REQUESTED\fR stop or a stop that has
-been specified in the process's tracing flags (set by \fBPCSTRACE\fR,
-\fBPCSFAULT\fR, \fBPCSENTRY\fR, and \fBPCSEXIT\fR). \fBPR_JOBCONTROL\fR and
-\fBPR_SUSPENDED\fR stops are specifically not events of interest. (An lwp may
-stop twice due to a stop signal, first showing \fBPR_SIGNALLED\fR if the signal
-is traced and again showing \fBPR_JOBCONTROL\fR if the lwp is set running
-without clearing the signal.) If \fBPCSTOP\fR or \fBPCDSTOP\fR is applied to an
+.Sy PR_SUSPENDED
+stop.
+.Pp
+.Sy PCTWSTOP
+is identical to
+.Sy PCWSTOP
+except that it enables the operation to time out, to avoid waiting forever for
+a process or lwp that may never stop on an event of interest.
+.Sy PCTWSTOP
+takes a
+.Sy long
+operand specifying a number of milliseconds; the wait will terminate
+successfully after the specified number of milliseconds even if the process or
+lwp has not stopped; a timeout value of zero makes the operation identical to
+.Sy PCWSTOP .
+.Pp
+An
+.Dq event of interest
+is either a
+.Sy PR_REQUESTED
+stop or a stop that has been specified in the process's tracing flags (set by
+.Sy PCSTRACE ,
+.Sy PCSFAULT ,
+.Sy PCSENTRY ,
+and
+.Sy PCSEXIT ) .
+.Sy PR_JOBCONTROL
+ and
+.Sy PR_SUSPENDED
+stops are specifically not events of interest.
+(An lwp may stop twice due to a stop signal, first showing
+.Sy PR_SIGNALLED
+if the signal is traced and again showing
+.Sy PR_JOBCONTROL
+if the lwp is set running without clearing the signal.)
+If
+.Sy PCSTOP
+or
+.Sy PCDSTOP
+is applied to an
 lwp that is stopped, but not on an event of interest, the stop directive takes
-effect when the lwp is restarted by the competing mechanism. At that time, the
-lwp enters a \fBPR_REQUESTED\fR stop before executing any user-level code.
-.sp
-.LP
+effect when the lwp is restarted by the competing mechanism.
+At that time, the lwp enters a
+.Sy PR_REQUESTED
+stop before executing any user-level code.
+.Pp
 A write of a control message that blocks is interruptible by a signal so that,
-for example, an \fBalarm\fR(2) can be set to avoid waiting forever for a
-process or lwp that may never stop on an event of interest. If \fBPCSTOP\fR is
-interrupted, the lwp stop directives remain in effect even though the
-\fBwrite\fR(2) returns an error. (Use of \fBPCTWSTOP\fR with a non-zero timeout
-is recommended over \fBPCWSTOP\fR with an \fBalarm\fR(2).)
-.sp
-.LP
-A system process (indicated by the \fBPR_ISSYS\fR flag) never executes at user
-level, has no user-level address space visible through \fB/proc\fR, and cannot
-be stopped. Applying one of these operations to a system process or any of its
-lwps elicits the error \fBEBUSY\fR.
-.SS "PCRUN"
-.LP
-Make an lwp runnable again after a stop. This operation takes a \fBlong\fR
+for example, an
+.Xr alarm 2
+can be set to avoid waiting forever for a
+process or lwp that may never stop on an event of interest.
+If
+.Sy PCSTOP
+is interrupted, the lwp stop directives remain in effect even though the
+.Xr write 2
+returns an error.
+(Use of
+.Sy PCTWSTOP
+with a non-zero timeout is recommended over
+.Sy PCWSTOP
+with an
+.Xr alarm 2 . )
+.Pp
+A system process (indicated by the
+.Sy PR_ISSYS
+flag) never executes at user level, has no user-level address space visible
+through
+.Pa /proc ,
+and cannot be stopped.
+Applying one of these operations to a system process or any of its
+lwps elicits the error
+.Er EBUSY .
+.Ss PCRUN
+Make an lwp runnable again after a stop.
+This operation takes a
+.Vt long
 operand containing zero or more of the following flags:
-.sp
-.ne 2
-.na
-\fB\fBPRCSIG\fR\fR
-.ad
-.RS 12n
-clears the current signal, if any (see \fBPCCSIG\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPRCFAULT\fR\fR
-.ad
-.RS 12n
-clears the current fault, if any (see \fBPCCFAULT\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPRSTEP\fR\fR
-.ad
-.RS 12n
-directs the lwp to execute a single machine instruction. On completion of the
-instruction, a trace trap occurs. If \fBFLTTRACE\fR is being traced, the lwp
-stops; otherwise, it is sent \fBSIGTRAP\fR. If \fBSIGTRAP\fR is being traced
-and is not blocked, the lwp stops. When the lwp stops on an event of interest,
+.Bl -tag -width "PRSABORT" -offset left
+.It Sy PRCSIG
+clears the current signal, if any (see
+.Sx PCCSIG ) .
+.It Sy PRCFAULT
+clears the current fault, if any (see
+.Sx PCCFAULT ) .
+.It Sy PRSTEP
+directs the lwp to execute a single machine instruction.
+On completion of the instruction, a trace trap occurs.
+If
+.Sy FLTTRACE
+is being traced, the lwp stops; otherwise, it is sent
+.Sy SIGTRAP .
+If
+.Sy SIGTRAP
+is being traced and is not blocked, the lwp stops.
+When the lwp stops on an event of interest,
 the single-step directive is cancelled, even if the stop occurs before the
-instruction is executed. This operation requires hardware and operating system
-support and may not be implemented on all processors. It is implemented on
-SPARC and x86-based machines.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPRSABORT\fR\fR
-.ad
-.RS 12n
-is meaningful only if the lwp is in a \fBPR_SYSENTRY\fR stop or is marked
-\fBPR_ASLEEP\fR; it instructs the lwp to abort execution of the system call
-(see \fBPCSENTRY\fR and \fBPCSEXIT\fR).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPRSTOP\fR\fR
-.ad
-.RS 12n
+instruction is executed.
+This operation requires hardware and operating system
+support and may not be implemented on all processors.
+It is implemented on SPARC and x86-based machines.
+.It Sy PRSABORT
+is meaningful only if the lwp is in a
+.Sy PR_SYSENTRY
+stop or is marked
+.Sy PR_ASLEEP ;
+it instructs the lwp to abort execution of the system call (see
+.Sx PCSENTRY
+and
+.Sx PCSEXIT ) .
+.It Sy PRSTOP
 directs the lwp to stop again as soon as possible after resuming execution (see
-\fBPCDSTOP\fR). In particular, if the lwp is stopped on \fBPR_SIGNALLED\fR or
-\fBPR_FAULTED\fR, the next stop will show \fBPR_REQUESTED\fR, no other stop
+.Sx PCDSTOP ) .
+In particular, if the lwp is stopped on
+.Sy PR_SIGNALLED
+or
+.Sy PR_FAULTED ,
+the next stop will show
+.Sy PR_REQUESTED ,
+no other stop
 will have intervened, and the lwp will not have executed any user-level code.
-.RE
-
-.sp
-.LP
-When applied to an lwp control file, \fBPCRUN\fR clears any outstanding
-directed-stop request and makes the specific lwp runnable. The operation fails
-with \fBEBUSY\fR if the specific lwp is not stopped on an event of interest or
+.El
+.Pp
+When applied to an lwp control file,
+.Sy PCRUN
+clears any outstanding
+directed-stop request and makes the specific lwp runnable.
+The operation fails with
+.Er EBUSY
+if the specific lwp is not stopped on an event of interest or
 has not been directed to stop or if the agent lwp exists and this is not the
-agent lwp (see \fBPCAGENT\fR).
-.sp
-.LP
+agent lwp (see
+.Sx PCAGENT ) .
+.Pp
 When applied to the process control file, a representative lwp is chosen for
-the operation as described for \fB/proc/\fR\fIpid\fR\fB/status\fR. The
-operation fails with \fBEBUSY\fR if the representative lwp is not stopped on an
+the operation as described for
+.Pa /proc/ Ns Em pid Ns Pa /status .
+The operation fails with
+.Er EBUSY
+if the representative lwp is not stopped on an
 event of interest or has not been directed to stop or if the agent lwp exists.
-If \fBPRSTEP\fR or \fBPRSTOP\fR was requested, the representative lwp is made
+If
+.Sy PRSTEP
+or
+.Sy PRSTOP
+was requested, the representative lwp is made
 runnable and its outstanding directed-stop request is cleared; otherwise all
 outstanding directed-stop requests are cleared and, if it was stopped on an
-event of interest, the representative lwp is marked \fBPR_REQUESTED\fR. If, as
-a consequence, all lwps are in the \fBPR_REQUESTED\fR or \fBPR_SUSPENDED\fR
-stop state, all lwps showing \fBPR_REQUESTED\fR are made runnable.
-.SS "PCSTRACE"
-.LP
-Define a set of signals to be traced in the process. The receipt of one of
-these signals by an lwp causes the lwp to stop. The set of signals is defined
-using an operand \fBsigset_t\fR contained in the control message. Receipt of
-\fBSIGKILL\fR cannot be traced; if specified, it is silently ignored.
-.sp
-.LP
+event of interest, the representative lwp is marked
+.Sy PR_REQUESTED .
+If, as a consequence, all lwps are in the
+.Sy PR_REQUESTED
+or
+.Sy PR_SUSPENDED
+stop state, all lwps showing
+.Sy PR_REQUESTED
+are made runnable.
+.Ss PCSTRACE
+Define a set of signals to be traced in the process.
+The receipt of one of these signals by an lwp causes the lwp to stop.
+The set of signals is defined using an operand
+.Sy sigset_t
+contained in the control message.
+Receipt of
+.Sy SIGKILL
+cannot be traced; if specified, it is silently ignored.
+.Pp
 If a signal that is included in an lwp's held signal set (the signal mask) is
 sent to the lwp, the signal is not received and does not cause a stop until it
 is removed from the held signal set, either by the lwp itself or by setting the
-held signal set with \fBPCSHOLD\fR.
-.SS "PCCSIG"
-.LP
+held signal set with
+.Sy PCSHOLD .
+.Ss PCCSIG
 The current signal, if any, is cleared from the specific or representative lwp.
-.SS "PCSSIG"
-.LP
+.Ss PCSSIG
 The current signal and its associated signal information for the specific or
 representative lwp are set according to the contents of the operand
-\fBsiginfo\fR structure (see \fB<sys/siginfo.h>\fR). If the specified signal
-number is zero, the current signal is cleared. The semantics of this operation
-are different from those of \fBkill\fR(2) in that the signal is delivered to
-the lwp immediately after execution is resumed (even if it is being blocked)
-and an additional \fBPR_SIGNALLED\fR stop does not intervene even if the signal
-is traced. Setting the current signal to \fBSIGKILL\fR terminates the process
-immediately.
-.SS "PCKILL"
-.LP
+.Vt siginfo
+structure (see
+.In sys/siginfo.h ) .
+If the specified signal number is zero, the current signal is cleared.
+The semantics of this operation are different from those of
+.Xr kill 2
+in that the signal is delivered to the lwp immediately after execution is
+resumed (even if it is being blocked) and an additional
+.Sy PR_SIGNALLED
+stop does not intervene even if the signal is traced.
+Setting the current signal to
+.Sy SIGKILL
+terminates the process immediately.
+.Ss PCKILL
 If applied to the process control file, a signal is sent to the process with
-semantics identical to those of \fBkill\fR(2). If applied to an lwp control
-file, a directed signal is sent to the specific lwp. The signal is named in a
-\fBlong\fR operand contained in the message. Sending \fBSIGKILL\fR terminates
-the process immediately.
-.SS "PCUNKILL"
-.LP
-A signal is deleted, that is, it is removed from the set of pending signals. If
-applied to the process control file, the signal is deleted from the process's
-pending signals. If applied to an lwp control file, the signal is deleted from
-the lwp's pending signals. The current signal (if any) is unaffected. The
-signal is named in a \fBlong\fR operand in the control message. It is an error
-(\fBEINVAL\fR) to attempt to delete \fBSIGKILL\fR.
-.SS "PCSHOLD"
-.LP
+semantics identical to those of
+.Xr kill 2
+If applied to an lwp control file, a directed signal is sent to the specific
+lwp.
+The signal is named in a
+.Vt long
+operand contained in the message.
+Sending
+.Sy SIGKILL
+terminates the process immediately.
+.Ss PCUNKILL
+A signal is deleted, that is, it is removed from the set of pending signals.
+If applied to the process control file, the signal is deleted from the process's
+pending signals.
+If applied to an lwp control file, the signal is deleted from
+the lwp's pending signals.
+The current signal (if any) is unaffected.
+The signal is named in a
+.Sy long
+operand in the control message.
+It is an error
+.Pq Er EINVAL
+to attempt to delete
+.Sy SIGKILL .
+.Ss PCSHOLD
 Set the set of held signals for the specific or representative lwp (signals
-whose delivery will be blocked if sent to the lwp). The set of signals is
-specified with a \fBsigset_t\fR operand. \fBSIGKILL\fR and \fBSIGSTOP\fR cannot
-be held; if specified, they are silently ignored.
-.SS "PCSFAULT"
-.LP
-Define a set of hardware faults to be traced in the process. On incurring one
-of these faults, an lwp stops. The set is defined via the operand
-\fBfltset_t\fR structure. Fault names are defined in \fB<sys/fault.h>\fR and
-include the following. Some of these may not occur on all processors; there may
+whose delivery will be blocked if sent to the lwp).
+The set of signals is specified with a
+.Vt sigset_t
+operand.
+.Sy SIGKILL
+and
+.Sy SIGSTOP
+cannot be held; if specified, they are silently ignored.
+.Ss PCSFAULT
+Define a set of hardware faults to be traced in the process.
+On incurring one of these faults, an lwp stops.
+The set is defined via the operand
+.Vt fltset_t
+structure.
+Fault names are defined in
+.In sys/fault.h
+and include the following.
+Some of these may not occur on all processors; there may
 be processor-specific faults in addition to these.
-.sp
-.ne 2
-.na
-\fB\fBFLTILL\fR\fR
-.ad
-.RS 13n
+.Bl -tag -width "FLTACCESS" -offset indent
+.It Sy FLTILL
 illegal instruction
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTPRIV\fR\fR
-.ad
-.RS 13n
+.It Sy FLTPRIV
 privileged instruction
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTBPT\fR\fR
-.ad
-.RS 13n
+.It Sy FLTBPT
 breakpoint trap
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTTRACE\fR\fR
-.ad
-.RS 13n
+.It Sy FLTTRACE
 trace trap (single-step)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTWATCH\fR\fR
-.ad
-.RS 13n
+.It Sy FLTWATCH
 watchpoint trap
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTACCESS\fR\fR
-.ad
-.RS 13n
+.It Sy FLTACCESS
 memory access fault (bus error)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTBOUNDS\fR\fR
-.ad
-.RS 13n
+.It Sy FLTBOUNDS
 memory bounds violation
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTIOVF\fR\fR
-.ad
-.RS 13n
+.It Sy FLTIOVF
 integer overflow
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTIZDIV\fR\fR
-.ad
-.RS 13n
+.It Sy FLTIZDIV
 integer zero divide
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTFPE\fR\fR
-.ad
-.RS 13n
+.It Sy FLTFPE
 floating-point exception
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTSTACK\fR\fR
-.ad
-.RS 13n
+.It Sy FLTSTACK
 unrecoverable stack fault
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBFLTPAGE\fR\fR
-.ad
-.RS 13n
+.It Sy FLTPAGE
 recoverable page fault
-.RE
-
-.sp
-.LP
+.El
+.Pp
 When not traced, a fault normally results in the posting of a signal to the lwp
-that incurred the fault. If an lwp stops on a fault, the signal is posted to
-the lwp when execution is resumed unless the fault is cleared by \fBPCCFAULT\fR
-or by the \fBPRCFAULT\fR option of \fBPCRUN\fR. \fBFLTPAGE\fR is an exception;
-no signal is posted. The \fBpr_info\fR field in the \fBlwpstatus\fR structure
-identifies the signal to be sent and contains machine-specific information
-about the fault.
-.SS "PCCFAULT"
-.LP
+that incurred the fault.
+If an lwp stops on a fault, the signal is posted to
+the lwp when execution is resumed unless the fault is cleared by
+.Sy PCCFAULT
+or by the
+.Sy PRCFAULT
+option of
+.Sy PCRUN .
+.Sy FLTPAGE
+is an exception; no signal is posted.
+The
+.Sy pr_info
+field in the
+.Vt lwpstatus
+structure identifies the signal to be sent and contains machine-specific
+information about the fault.
+.Ss PCCFAULT
 The current fault, if any, is cleared; the associated signal will not be sent
 to the specific or representative lwp.
-.SS "PCSENTRY PCSEXIT"
-.LP
+.Ss PCSENTRY PCSEXIT
 These control operations instruct the process's lwps to stop on entry to or
-exit from specified system calls. The set of system calls to be traced is
-defined via an operand \fBsysset_t\fR structure.
-.sp
-.LP
+exit from specified system calls.
+The set of system calls to be traced is defined via an operand
+.Vt sysset_t
+structure.
+.Pp
 When entry to a system call is being traced, an lwp stops after having begun
 the call to the system but before the system call arguments have been fetched
-from the lwp. When exit from a system call is being traced, an lwp stops on
-completion of the system call just prior to checking for signals and returning
-to user level. At this point, all return values have been stored into the lwp's
-registers.
-.sp
-.LP
-If an lwp is stopped on entry to a system call (\fBPR_SYSENTRY\fR) or when
-sleeping in an interruptible system call (\fBPR_ASLEEP\fR is set), it may be
-instructed to go directly to system call exit by specifying the \fBPRSABORT\fR
-flag in a \fBPCRUN\fR control message. Unless exit from the system call is
-being traced, the lwp returns to user level showing \fBEINTR\fR.
-.SS "PCWATCH"
-.LP
-Set or clear a watched area in the controlled process from a \fBprwatch\fR
+from the lwp.
+When exit from a system call is being traced, an lwp stops on completion of
+the system call just prior to checking for signals and returning to user level.
+At this point, all return values have been stored into the lwp's registers.
+.Pp
+If an lwp is stopped on entry to a system call
+.Pq Sy PR_SYSENTRY
+or when sleeping in an interruptible system call
+.Pf ( Sy PR_ASLEEP
+is set), it may be instructed to go directly to system call exit by specifying
+the
+.Sy PRSABORT
+flag in a
+.Sy PCRUN
+control message.
+Unless exit from the system call is being traced, the lwp returns to user
+level showing
+.Er EINTR .
+.Ss PCWATCH
+Set or clear a watched area in the controlled process from a
+.Vt prwatch
 structure operand:
-.sp
-.in +2
-.nf
+.Bd -literal -offset 2
 typedef struct prwatch {
     uintptr_t pr_vaddr;  /* virtual address of watched area */
     size_t pr_size;      /* size of watched area in bytes */
     int pr_wflags;       /* watch type flags */
 } prwatch_t;
-.fi
-.in -2
-
-.sp
-.LP
-\fBpr_vaddr\fR specifies the virtual address of an area of memory to be watched
-in the controlled process. \fBpr_size\fR specifies the size of the area, in
-bytes. \fBpr_wflags\fR specifies the type of memory access to be monitored as a
+.Ed
+.Pp
+.Sy pr_vaddr
+specifies the virtual address of an area of memory to be watched
+in the controlled process.
+.Sy pr_size
+specifies the size of the area, in bytes.
+.Sy pr_wflags
+specifies the type of memory access to be monitored as a
 bit-mask of the following flags:
-.sp
-.ne 2
-.na
-\fB\fBWA_READ\fR\fR
-.ad
-.RS 16n
+.Bl -tag -width "WA_TRAPAFTER" -offset indent
+.It Sy WA_READ
 read access
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBWA_WRITE\fR\fR
-.ad
-.RS 16n
+.It Sy WA_WRITE
 write access
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBWA_EXEC\fR\fR
-.ad
-.RS 16n
+.It Sy WA_EXEC
 execution access
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBWA_TRAPAFTER\fR\fR
-.ad
-.RS 16n
+.It Sy WA_TRAPAFTER
 trap after the instruction completes
-.RE
-
-.sp
-.LP
-If \fBpr_wflags\fR is non-empty, a watched area is established for the virtual
-address range specified by \fBpr_vaddr\fR and \fBpr_size\fR. If \fBpr_wflags\fR
+.El
+.Pp
+If
+.Sy pr_wflags
+is non-empty, a watched area is established for the virtual
+address range specified by
+.Sy pr_vaddr
+and
+.Sy pr_size .
+If
+.Sy pr_wflags
 is empty, any previously-established watched area starting at the specified
-virtual address is cleared; \fBpr_size\fR is ignored.
-.sp
-.LP
+virtual address is cleared;
+.Sy pr_size
+is ignored.
+.Pp
 A watchpoint is triggered when an lwp in the traced process makes a memory
 reference that covers at least one byte of a watched area and the memory
-reference is as specified in \fBpr_wflags\fR. When an lwp triggers a
-watchpoint, it incurs a watchpoint trap. If \fBFLTWATCH\fR is being traced, the
-lwp stops; otherwise, it is sent a \fBSIGTRAP\fR signal; if \fBSIGTRAP\fR is
-being traced and is not blocked, the lwp stops.
-.sp
-.LP
+reference is as specified in
+.Sy pr_wflags .
+When an lwp triggers a watchpoint, it incurs a watchpoint trap.
+If
+.Sy FLTWATCH
+is being traced, the lwp stops; otherwise, it is sent a
+.Sy SIGTRAP
+signal; if
+.Sy SIGTRAP
+is being traced and is not blocked, the lwp stops.
+.Pp
 The watchpoint trap occurs before the instruction completes unless
-\fBWA_TRAPAFTER\fR was specified, in which case it occurs after the instruction
-completes. If it occurs before completion, the memory is not modified. If it
-occurs after completion, the memory is modified (if the access is a write
+.Sy WA_TRAPAFTER
+was specified, in which case it occurs after the instruction completes.
+If it occurs before completion, the memory is not modified.
+If it occurs after completion, the memory is modified (if the access is a write
 access).
-.sp
-.LP
-Physical i/o is an exception for watchpoint traps. In this instance, there is
-no guarantee that memory before the watched area has already been modified (or
-in the case of \fBWA_TRAPAFTER\fR, that the memory following the watched area
+.Pp
+Physical i/o is an exception for watchpoint traps.
+In this instance, there is no guarantee that memory before the watched area
+has already been modified (or in the case of
+.Sy WA_TRAPAFTER ,
+that the memory following the watched area
 has not been modified) when the watchpoint trap occurs and the lwp stops.
-.sp
-.LP
-\fBpr_info\fR in the \fBlwpstatus\fR structure contains information pertinent
-to the watchpoint trap. In particular, the \fBsi_addr\fR field contains the
+.Pp
+.Sy pr_info
+in the
+.Vt lwpstatus
+structure contains information pertinent to the watchpoint trap.
+In particular, the
+.Sy si_addr
+field contains the
 virtual address of the memory reference that triggered the watchpoint, and the
-\fBsi_code\fR field contains one of \fBTRAP_RWATCH\fR, \fBTRAP_WWATCH\fR, or
-\fBTRAP_XWATCH\fR, indicating read, write, or execute access, respectively. The
-\fBsi_trapafter\fR field is zero unless \fBWA_TRAPAFTER\fR is in effect for
-this watched area; non-zero indicates that the current instruction is not the
-instruction that incurred the watchpoint trap. The \fBsi_pc\fR field contains
-the virtual address of the instruction that incurred the trap.
-.sp
-.LP
+.Sy si_code
+field contains one of
+.Sy TRAP_RWATCH ,
+.Sy TRAP_WWATCH ,
+or
+.Sy TRAP_XWATCH ,
+indicating read, write, or execute access, respectively.
+The
+.Sy si_trapafter
+field is zero unless
+.Sy WA_TRAPAFTER
+is in effect for this watched area; non-zero indicates that the current
+instruction is not the instruction that incurred the watchpoint trap.
+The
+.Sy si_pc
+field contains the virtual address of the instruction that incurred the trap.
+.Pp
 A watchpoint trap may be triggered while executing a system call that makes
-reference to the traced process's memory. The lwp that is executing the system
-call incurs the watchpoint trap while still in the system call. If it stops as
-a result, the \fBlwpstatus\fR structure contains the system call number and its
-arguments. If the lwp does not stop, or if it is set running again without
-clearing the signal or fault, the system call fails with \fBEFAULT\fR. If
-\fBWA_TRAPAFTER\fR was specified, the memory reference will have completed and
+reference to the traced process's memory.
+The lwp that is executing the system call incurs the watchpoint trap while
+still in the system call.
+If it stops as a result, the
+.Vt lwpstatus
+structure contains the system call number and its arguments.
+If the lwp does not stop, or if it is set running again without
+clearing the signal or fault, the system call fails with
+.Er EFAULT .
+If
+.Sy WA_TRAPAFTER
+was specified, the memory reference will have completed and
 the memory will have been modified (if the access was a write access) when the
 watchpoint trap occurs.
-.sp
-.LP
-If more than one of \fBWA_READ\fR, \fBWA_WRITE\fR, and \fBWA_EXEC\fR is
-specified for a watched area, and a single instruction incurs more than one of
-the specified types, only one is reported when the watchpoint trap occurs. The
-precedence is \fBWA_EXEC\fR, \fBWA_READ\fR, \fBWA_WRITE\fR (\fBWA_EXEC\fR and
-\fBWA_READ\fR take precedence over \fBWA_WRITE\fR), unless \fBWA_TRAPAFTER\fR
-was specified, in which case it is \fBWA_WRITE\fR, \fBWA_READ\fR, \fBWA_EXEC\fR
-(\fBWA_WRITE\fR takes precedence).
-.sp
-.LP
-\fBPCWATCH\fR fails with \fBEINVAL\fR if an attempt is made to specify
-overlapping watched areas or if \fBpr_wflags\fR contains flags other than those
-specified above. It fails with \fBENOMEM\fR if an attempt is made to establish
-more watched areas than the system can support (the system can support
-thousands).
-.sp
-.LP
-The child of a \fBvfork\fR(2) borrows the parent's address space. When a
-\fBvfork\fR(2) is executed by a traced process, all watched areas established
+.Pp
+If more than one of
+.Sy WA_READ ,
+.Sy WA_WRITE ,
+and
+.Sy WA_EXEC
+is specified for a watched area, and a single instruction incurs more than one
+of the specified types, only one is reported when the watchpoint trap occurs.
+The precedence is
+.Sy WA_EXEC ,
+.Sy WA_READ ,
+.Sy WA_WRITE
+.Pf ( Sy WA_EXEC
+and
+.Sy WA_READ
+take precedence over
+.Sy WA_WRITE ) ,
+unless
+.Sy WA_TRAPAFTER
+was specified, in which case it is
+.Sy WA_WRITE ,
+.Sy WA_READ ,
+.Sy WA_EXEC
+.Pf ( Sy WA_WRITE
+takes precedence).
+.Pp
+.Sy PCWATCH
+fails with
+.Er EINVAL
+if an attempt is made to specify overlapping watched areas or if
+.Sy pr_wflags
+contains flags other than those specified above.
+It fails with
+.Er ENOMEM
+if an attempt is made to establish more watched areas than the system can
+support (the system can support thousands).
+.Pp
+The child of a
+.Xr vfork 2
+borrows the parent's address space.
+When a
+.Xr vfork 2
+is executed by a traced process, all watched areas established
 for the parent are suspended until the child terminates or performs an
-\fBexec\fR(2). Any watched areas established independently in the child are
+.Xr exec 2 .
+Any watched areas established independently in the child are
 cancelled when the parent resumes after the child's termination or
-\fBexec\fR(2). \fBPCWATCH\fR fails with \fBEBUSY\fR if applied to the parent of
-a \fBvfork\fR(2) before the child has terminated or performed an \fBexec\fR(2).
-The \fBPR_VFORKP\fR flag is set in the \fBpstatus\fR structure for such a
-parent process.
-.sp
-.LP
+.Xr exec 2 .
+.Sy PCWATCH
+fails with
+.Er EBUSY
+if applied to the parent of a
+.Xr vfork 2
+before the child has terminated or performed an
+.Xr exec 2 .
+The
+.Sy PR_VFORKP
+flag is set in the
+.Sy pstatus
+structure for such a parent process.
+.Pp
 Certain accesses of the traced process's address space by the operating system
-are immune to watchpoints. The initial construction of a signal stack frame
-when a signal is delivered to an lwp will not trigger a watchpoint trap even if
-the new frame covers watched areas of the stack. Once the signal handler is
-entered, watchpoint traps occur normally. On SPARC based machines, register
-window overflow and underflow will not trigger watchpoint traps, even if the
-register window save areas cover watched areas of the stack.
-.sp
-.LP
+are immune to watchpoints.
+The initial construction of a signal stack frame when a signal is delivered to
+an lwp will not trigger a watchpoint trap even if the new frame covers watched
+areas of the stack.
+Once the signal handler is entered, watchpoint traps occur normally.
+On SPARC based machines, register window overflow and underflow will not
+trigger watchpoint traps, even if the register window save areas cover watched
+areas of the stack.
+.Pp
 Watched areas are not inherited by child processes, even if the traced
-process's inherit-on-fork mode, \fBPR_FORK\fR, is set (see \fBPCSET\fR, below).
+process's inherit-on-fork mode,
+.Sy PR_FORK ,
+is set (see
+.Sy PCSET ,
+below).
 All watched areas are cancelled when the traced process performs a successful
-\fBexec\fR(2).
-.SS "PCSET PCUNSET"
-.LP
-\fBPCSET\fR sets one or more modes of operation for the traced process.
-\fBPCUNSET\fR unsets these modes. The modes to be set or unset are specified by
-flags in an operand \fBlong\fR in the control message:
-.sp
-.ne 2
-.na
-\fB\fBPR_FORK\fR\fR
-.ad
-.RS 13n
+.Xr exec 2 .
+.Ss PCSET PCUNSET
+.Sy PCSET
+sets one or more modes of operation for the traced process.
+.Sy PCUNSET
+unsets these modes.
+The modes to be set or unset are specified by flags in an operand
+.Sy long
+in the control message:
+.Bl -tag -offset left -width "PR_MSFORK"
+.It Sy PR_FORK
 (inherit-on-fork): When set, the process's tracing flags and its
-inherit-on-fork mode are inherited by the child of a \fBfork\fR(2),
-\fBfork1\fR(2), or \fBvfork\fR(2). When unset, child processes start with all
-tracing flags cleared.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_RLC\fR\fR
-.ad
-.RS 13n
-(run-on-last-close): When set and the last writable \fB/proc\fR file descriptor
-referring to the traced process or any of its lwps is closed, all of the
-process's tracing flags and watched areas are cleared, any outstanding stop
-directives are canceled, and if any lwps are stopped on events of interest,
-they are set running as though \fBPCRUN\fR had been applied to them. When
-unset, the process's tracing flags and watched areas are retained and lwps are
-not set running on last close.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_KLC\fR\fR
-.ad
-.RS 13n
-(kill-on-last-close): When set and the last writable \fB/proc\fR file
-descriptor referring to the traced process or any of its lwps is closed, the
-process is terminated with \fBSIGKILL\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_ASYNC\fR\fR
-.ad
-.RS 13n
+inherit-on-fork mode are inherited by the child of a
+.Xr fork 2 ,
+.Xr fork1 2 ,
+or
+.Xr vfork 2 .
+When unset, child processes start with all tracing flags cleared.
+.It Sy PR_RLC
+(run-on-last-close): When set and the last writable
+.Pa /proc
+file descriptor referring to the traced process or any of its lwps is closed,
+all of the process's tracing flags and watched areas are cleared, any
+outstanding stop directives are canceled, and if any lwps are stopped on
+events of interest, they are set running as though
+.Sy PCRUN
+had been applied to them.
+When unset, the process's tracing flags and watched areas are retained and
+lwps are not set running on last close.
+.It Sy PR_KLC
+(kill-on-last-close): When set and the last writable
+.Pa /proc
+file descriptor referring to the traced process or any of its lwps is closed,
+the process is terminated with
+.Sy SIGKILL .
+.It Sy PR_ASYNC
 (asynchronous-stop): When set, a stop on an event of interest by one lwp does
-not directly affect any other lwp in the process. When unset and an lwp stops
-on an event of interest other than \fBPR_REQUESTED\fR, all other lwps in the
-process are directed to stop.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_MSACCT\fR\fR
-.ad
-.RS 13n
+not directly affect any other lwp in the process.
+When unset and an lwp stops on an event of interest other than
+.Sy PR_REQUESTED ,
+all other lwps in the process are directed to stop.
+.It Sy PR_MSACCT
 (microstate accounting): Microstate accounting is now continuously enabled.
 This flag is deprecated and no longer has any effect upon microstate
-accounting. Applications may toggle this flag; however, microstate accounting
+accounting.
+Applications may toggle this flag; however, microstate accounting
 will remain enabled regardless.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_MSFORK\fR\fR
-.ad
-.RS 13n
+.It Sy PR_MSFORK
 (inherit microstate accounting): All processes now inherit microstate
-accounting, as it is continuously enabled. This flag has been deprecated and
-its use no longer has any effect upon the behavior of microstate accounting.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_BPTADJ\fR\fR
-.ad
-.RS 13n
+accounting, as it is continuously enabled.
+This flag has been deprecated and its use no longer has any effect upon the
+behavior of microstate accounting.
+.It Sy PR_BPTADJ
 (breakpoint trap pc adjustment): On x86-based machines, a breakpoint trap
-leaves the program counter (the \fBEIP\fR) referring to the breakpointed
-instruction plus one byte. When \fBPR_BPTADJ\fR is set, the system will adjust
-the program counter back to the location of the breakpointed instruction when
-the lwp stops on a breakpoint. This flag has no effect on SPARC based machines,
-where breakpoint traps leave the program counter referring to the breakpointed
-instruction.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPR_PTRACE\fR\fR
-.ad
-.RS 13n
+leaves the program counter (the
+.Sy EIP )
+referring to the breakpointed instruction plus one byte.
+When
+.Sy PR_BPTADJ
+is set, the system will adjust the program counter back to the location of the
+breakpointed instruction when the lwp stops on a breakpoint.
+This flag has no effect on SPARC based machines, where breakpoint traps leave
+the program counter referring to the breakpointed instruction.
+.It Sy PR_PTRACE
 (ptrace-compatibility): When set, a stop on an event of interest by the traced
-process is reported to the parent of the traced process by \fBwait\fR(3C),
-\fBSIGTRAP\fR is sent to the traced process when it executes a successful
-\fBexec\fR(2), setuid/setgid flags are not honored for execs performed by the
+process is reported to the parent of the traced process by
+.Xr wait 3C ,
+.Sy SIGTRAP
+is sent to the traced process when it executes a successful
+.Xr exec 2 ,
+setuid/setgid flags are not honored for execs performed by the
 traced process, any exec of an object file that the traced process cannot read
-fails, and the process dies when its parent dies. This mode is deprecated; it
-is provided only to allow \fBptrace\fR(3C) to be implemented as a library
-function using \fB/proc\fR.
-.RE
-
-.sp
-.LP
-It is an error (\fBEINVAL\fR) to specify flags other than those described above
-or to apply these operations to a system process. The current modes are
-reported in the \fBpr_flags\fR field of \fB/proc/\fR\fIpid\fR\fB/status\fR and
-\fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwp\fR\fB/lwpstatus\fR.
-.SS "PCSREG"
-.LP
+fails, and the process dies when its parent dies.
+This mode is deprecated; it is provided only to allow
+.Xr ptrace 3C
+to be implemented as a library function using
+.Pa /proc .
+.El
+.Pp
+It is an error
+.Pq Er EINVAL
+to specify flags other than those described above
+or to apply these operations to a system process.
+The current modes are reported in the
+.Sy pr_flags
+field of
+.Pa /proc/ Ns Em pid Ns Pa /status
+and
+.Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwp Ns Pa /lwpstatus .
+.Ss PCSREG
 Set the general registers for the specific or representative lwp according to
-the operand \fBprgregset_t\fR structure.
-.sp
-.LP
+the operand
+.Vt prgregset_t
+structure.
+.Pp
 On SPARC based systems, only the condition-code bits of the processor-status
 register (R_PSR) of SPARC V8 (32-bit) processes can be modified by
-\fBPCSREG\fR. Other privileged registers cannot be modified at all.
-.sp
-.LP
+.Sy PCSREG .
+Other privileged registers cannot be modified at all.
+.Pp
 On x86-based systems, only certain bits of the flags register (EFL) can be
-modified by \fBPCSREG\fR: these include the condition codes, direction-bit, and
-overflow-bit.
-.sp
-.LP
-\fBPCSREG\fR fails with \fBEBUSY\fR if the lwp is not stopped on an event of
-interest.
-.SS "PCSVADDR"
-.LP
+modified by
+.Sy PCSREG :
+these include the condition codes, direction-bit, and overflow-bit.
+.Pp
+.Sy PCSREG
+fails with
+.Er EBUSY
+if the lwp is not stopped on an event of interest.
+.Ss PCSVADDR
 Set the address at which execution will resume for the specific or
-representative lwp from the operand \fBlong\fR. On SPARC based systems, both
-%pc and %npc are set, with %npc set to the instruction following the virtual
-address. On x86-based systems, only %eip is set. \fBPCSVADDR\fR fails with
-\fBEBUSY\fR if the lwp is not stopped on an event of interest.
-.SS "PCSFPREG"
-.LP
+representative lwp from the operand
+.Vt long .
+On SPARC based systems, both %pc and %npc are set, with %npc set to the
+instruction following the virtual address.
+On x86-based systems, only %eip is set.
+.Sy PCSVADDR
+fails with
+.Er EBUSY
+if the lwp is not stopped on an event of interest.
+.Ss PCSFPREG
 Set the floating-point registers for the specific or representative lwp
-according to the operand \fBprfpregset_t\fR structure. An error (\fBEINVAL\fR)
+according to the operand
+.Vt prfpregset_t
+structure.
+An error
+.Pq Er EINVAL
 is returned if the system does not support floating-point operations (no
 floating-point hardware and the system does not emulate floating-point machine
-instructions). \fBPCSFPREG\fR fails with \fBEBUSY\fR if the lwp is not stopped
-on an event of interest.
-.SS "PCSXREG"
-.LP
+instructions).
+.Sy PCSFPREG
+fails with
+.Er EBUSY
+if the lwp is not stopped on an event of interest.
+.Ss PCSXREG
 Set the extra state registers for the specific or representative lwp according
-to the architecture-dependent operand \fBprxregset_t\fR structure. An error
-(\fBEINVAL\fR) is returned if the system does not support extra state
-registers. \fBPCSXREG\fR fails with \fBEBUSY\fR if the lwp is not stopped on an
-event of interest.
-.SS "PCSASRS"
-.LP
+to the architecture-dependent operand
+.Vt prxregset_t
+structure.
+An error
+.Pq Er EINVAL
+is returned if the system does not support extra state registers.
+.Sy PCSXREG
+fails with
+.Er EBUSY
+if the lwp is not stopped on an event of interest.
+.Ss PCSASRS
 Set the ancillary state registers for the specific or representative lwp
-according to the SPARC V9 platform-dependent operand \fBasrset_t\fR structure.
-An error (\fBEINVAL\fR) is returned if either the target process or the
-controlling process is not a 64-bit SPARC V9 process. Most of the ancillary
-state registers are privileged registers that cannot be modified. Only those
-that can be modified are set; all others are silently ignored. \fBPCSASRS\fR
-fails with \fBEBUSY\fR if the lwp is not stopped on an event of interest.
-.SS "PCAGENT"
-.LP
+according to the SPARC V9 platform-dependent operand
+.Vt asrset_t
+structure.
+An error
+.Pq Er EINVAL
+is returned if either the target process or the
+controlling process is not a 64-bit SPARC V9 process.
+Most of the ancillary state registers are privileged registers that cannot be
+modified.
+Only those that can be modified are set; all others are silently ignored.
+.Sy PCSASRS
+fails with
+.Er EBUSY
+if the lwp is not stopped on an event of interest.
+.Ss PCAGENT
 Create an agent lwp in the controlled process with register values from the
-operand \fBprgregset_t\fR structure (see \fBPCSREG\fR, above). The agent lwp is
-created in the stopped state showing \fBPR_REQUESTED\fR and with its held
-signal set (the signal mask) having all signals except \fBSIGKILL\fR and
-\fBSIGSTOP\fR blocked.
-.sp
-.LP
-The \fBPCAGENT\fR operation fails with \fBEBUSY\fR unless the process is fully
-stopped via \fB/proc\fR, that is, unless all of the lwps in the process are
-stopped either on events of interest or on \fBPR_SUSPENDED\fR, or are stopped
-on \fBPR_JOBCONTROL\fR and have been directed to stop via \fBPCDSTOP\fR.  It
-fails with \fBEBUSY\fR if an agent lwp already exists. It fails with
-\fBENOMEM\fR if system resources for creating new lwps have been exhausted.
-.sp
-.LP
-Any \fBPCRUN\fR operation applied to the process control file or to the control
-file of an lwp other than the agent lwp fails with \fBEBUSY\fR as long as the
-agent lwp exists. The agent lwp must be caused to terminate by executing the
-\fBSYS_lwp_exit\fR system call trap before the process can be restarted.
-.sp
-.LP
+operand
+.Vt prgregset_t
+structure (see
+.Sy PCSREG ,
+above).
+The agent lwp is created in the stopped state showing
+.Sy PR_REQUESTED
+and with its held signal set (the signal mask) having all signals except
+.Sy SIGKILL
+and
+.Sy SIGSTOP
+blocked.
+.Pp
+The
+.Sy PCAGENT
+operation fails with
+.Er EBUSY
+unless the process is fully stopped via
+.Pa /proc ,
+that is, unless all of the lwps in the process are
+stopped either on events of interest or on
+.Sy PR_SUSPENDED ,
+or are stopped on
+.Sy PR_JOBCONTROL
+and have been directed to stop via
+.Sy PCDSTOP .
+It fails with
+.Er EBUSY
+if an agent lwp already exists.
+It fails with
+.Er ENOMEM
+if system resources for creating new lwps have been exhausted.
+.Pp
+Any
+.Sy PCRUN
+operation applied to the process control file or to the control
+file of an lwp other than the agent lwp fails with
+.Er EBUSY
+as long as the agent lwp exists.
+The agent lwp must be caused to terminate by executing the
+.Sy SYS_lwp_exit
+system call trap before the process can be restarted.
+.Pp
 Once the agent lwp is created, its lwp-ID can be found by reading the process
-status file. To facilitate opening the agent lwp's control and status files,
-the directory name \fB/propc/\fR\fIpid\fR\fB/lwp/agent\fR is accepted for
-lookup operations as an invisible alias for
-\fB/proc/\fR\fIpid\fR\fB/lwp/\fR\fIlwpid,\fR \fIlwpid\fR being the lwp-ID of
-the agent lwp (invisible in the sense that the name ``agent'' does not appear
-in a directory listing of \fB/proc/\fR\fIpid\fR\fB/lwp\fR obtained from
-\fBls\fR(1), \fBgetdents\fR(2), or \fBreaddir\fR(3C)).
-.sp
-.LP
+status file.
+To facilitate opening the agent lwp's control and status files,
+the directory name
+.Pa /proc/ Ns Em pid Ns Pa /lwp/agent
+is accepted for lookup operations as an invisible alias for
+.Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid ,
+.Em lwpid
+being the lwp-ID of the agent lwp (invisible in the sense that the name
+.Dq agent
+does not appear in a directory listing of
+.Pa /proc/ Ns Em pid Ns Pa /lwp
+obtained from
+.Xr ls 1 ,
+.Xr getdents 2 ,
+or
+.Xr readdir 3C .
+.Pp
 The purpose of the agent lwp is to perform operations in the controlled process
 on behalf of the controlling process: to gather information not directly
-available via \fB/proc\fR files, or in general to make the process change state
-in ways not directly available via \fB/proc\fR control operations. To make use
-of an agent lwp, the controlling process must be capable of making it execute
-system calls (specifically, the \fBSYS_lwp_exit\fR system call trap). The
-register values given to the agent lwp on creation are typically the registers
-of the representative lwp, so that the agent lwp can use its stack.
-.sp
-.LP
+available via
+.Pa /proc
+files, or in general to make the process change state
+in ways not directly available via
+.Pa /proc
+control operations.
+To make use of an agent lwp, the controlling process must be capable of making
+it execute system calls (specifically, the
+.Sy SYS_lwp_exit
+system call trap).
+The register values given to the agent lwp on creation are typically the
+registers of the representative lwp, so that the agent lwp can use its stack.
+.Pp
 If the controlling process neglects to force the agent lwp to execute the
-\fBSYS_lwp_exit\fR system call (due to either logic error or fatal failure on
+.Sy SYS_lwp_exit
+system call (due to either logic error or fatal failure on
 the part of the controlling process), the agent lwp will remain in the target
-process.  For purposes of being able to debug these otherwise rogue agents,
+process.
+For purposes of being able to debug these otherwise rogue agents,
 information as to the creator of the agent lwp is reflected in that lwp's
-\fBspymaster\fR file in \fB/proc\fR. Should the target process generate a core
+.Pa spymaster
+file in
+.Pa /proc .
+Should the target process generate a core
 dump with the agent lwp in place, this information will be available via the
-\fBNT_SPYMASTER\fR note in the core file (see \fBcore\fR(4)).
-.sp
-.LP
-The agent lwp is not allowed to execute any variation of the \fBSYS_fork\fR or
-\fBSYS_exec\fR system call traps. Attempts to do so yield \fBENOTSUP\fR to the
-agent lwp.
-.sp
-.LP
-Symbolic constants for system call trap numbers like \fBSYS_lwp_exit\fR and
-\fBSYS_lwp_create\fR can be found in the header file <\fBsys/syscall.h\fR>.
-.SS "PCREAD PCWRITE"
-.LP
-Read or write the target process's address space via a \fBpriovec\fR structure
-operand:
-.sp
-.in +2
-.nf
+.Sy NT_SPYMASTER
+note in the core file (see
+.Xr core 4 ) .
+.Pp
+The agent lwp is not allowed to execute any variation of the
+.Sy SYS_fork
+or
+.Sy SYS_exec
+system call traps.
+Attempts to do so yield
+.Er ENOTSUP
+to the agent lwp.
+.Pp
+Symbolic constants for system call trap numbers like
+.Sy SYS_lwp_exit
+and
+.Sy SYS_lwp_create
+can be found in the header file
+.In sys/syscall.h .
+.Ss PCREAD PCWRITE
+Read or write the target process's address space via a
+.Vt priovec
+structure operand:
+.Bd -literal -offset 2
 typedef struct priovec {
     void *pio_base;      /* buffer in controlling process */
     size_t pio_len;      /* size of read/write request in bytes */
     off_t pio_offset;    /* virtual address in target process */
 } priovec_t;
-.fi
-.in -2
-
-.sp
-.LP
-These operations have the same effect as \fBpread\fR(2) and \fBpwrite\fR(2),
-respectively, of the target process's address space file. The difference is
-that more than one \fBPCREAD\fR or \fBPCWRITE\fR control operation can be
+.Ed
+.Pp
+These operations have the same effect as
+.Xr pread 2
+and
+.Xr pwrite 2 ,
+respectively, of the target process's address space file.
+The difference is that more than one
+.Sy PCREAD
+or
+.Sy PCWRITE
+control operation can be
 written to the control file at once, and they can be interspersed with other
-control operations in a single write to the control file. This is useful, for
-example, when planting many breakpoint instructions in the process's address
-space, or when stepping over a breakpointed instruction. Unlike \fBpread\fR(2)
-and \fBpwrite\fR(2), no provision is made for partial reads or writes; if the
-operation cannot be performed completely, it fails with \fBEIO\fR.
-.SS "PCNICE"
-.LP
-The traced process's \fBnice\fR(2) value is incremented by the amount in the
-operand \fBlong\fR. Only a process with the {\fBPRIV_PROC_PRIOCNTL\fR}
+control operations in a single write to the control file.
+This is useful, for example, when planting many breakpoint instructions in
+the process's address space, or when stepping over a breakpointed instruction.
+Unlike
+.Xr pread 2
+and
+.Xr pwrite 2 ,
+no provision is made for partial reads or writes; if the
+operation cannot be performed completely, it fails with
+.Er EIO .
+.Ss PCNICE
+The traced process's
+.Xr nice 2
+value is incremented by the amount in the
+operand
+.Vt long .
+Only a process with the
+.Brq Sy PRIV_PROC_PRIOCNTL
 privilege asserted in its effective set can better a process's priority in this
-way, but any user may lower the priority. This operation is not meaningful for
-all scheduling classes.
-.SS "PCSCRED"
-.LP
+way, but any user may lower the priority.
+This operation is not meaningful for all scheduling classes.
+.Ss PCSCRED
 Set the target process credentials to the values contained in the
-\fBprcred_t\fR structure operand (see \fB/proc/\fR\fIpid\fR\fB/cred\fR). The
+.Vt prcred_t
+structure operand (see
+.Pa /proc/ Ns Em pid Ns Pa /cred ) .
+The
 effective, real, and saved user-IDs and group-IDs of the target process are
-set. The target process's supplementary groups are not changed; the
-\fBpr_ngroups\fR and \fBpr_groups\fR members of the structure operand are
-ignored. Only the privileged processes can perform this operation; for all
-others it fails with \fBEPERM\fR.
-.SS "PCSCREDX"
-.LP
-Operates like \fBPCSCRED\fR but also sets the supplementary groups; the length
+set.
+The target process's supplementary groups are not changed; the
+.Sy pr_ngroups
+and
+.Sy pr_groups
+members of the structure operand are ignored.
+Only the privileged processes can perform this operation; for all
+others it fails with
+.Er EPERM .
+.Ss PCSCREDX
+Operates like
+.Sy PCSCRED
+but also sets the supplementary groups; the length
 of the data written with this control operation should be "sizeof
-(\fBprcred_t\fR) + sizeof (\fBgid_t)\fR * (#groups - 1)".
-.SS "PCSPRIV"
-.LP
-Set the target process privilege to the values contained in the \fBprpriv_t\fR
-operand (see \fB/proc/pid/priv\fR). The effective, permitted, inheritable, and
-limit sets are all changed. Privilege flags can also be set. The process is
-made privilege aware unless it can relinquish privilege awareness. See
-\fBprivileges\fR(5).
-.sp
-.LP
-The limit set of the target process cannot be grown. The other privilege sets
-must be subsets of the intersection of the effective set of the calling process
-with the new limit set of the target process or subsets of the original values
-of the sets in the target process.
-.sp
-.LP
-If any of the above restrictions are not met, \fBEPERM\fR is returned. If the
-structure written is improperly formatted, \fBEINVAL\fR is returned.
-.SH PROGRAMMING NOTES
-.LP
-For security reasons, except for the \fBpsinfo\fR, \fBusage\fR, \fBlpsinfo\fR,
-\fBlusage\fR, \fBlwpsinfo\fR, and \fBlwpusage\fR files, which are
-world-readable, and except for privileged processes, an open of a \fB/proc\fR
+.Pq Vt prcred_t
++ sizeof
+.Pq Vt gid_t
+* (#groups - 1)".
+.Ss PCSPRIV
+Set the target process privilege to the values contained in the
+.Vt prpriv_t
+operand (see
+.Pa /proc/pid/priv ) .
+The effective, permitted, inheritable, and
+limit sets are all changed.
+Privilege flags can also be set.
+The process is made privilege aware unless it can relinquish privilege awareness.
+See
+.Xr privileges 5 .
+.Pp
+The limit set of the target process cannot be grown.
+The other privilege sets must be subsets of the intersection of the effective set
+of the calling process with the new limit set of the target process or subsets of
+the original values of the sets in the target process.
+.Pp
+If any of the above restrictions are not met,
+.Er EPERM
+is returned.
+If the structure written is improperly formatted,
+.Er EINVAL
+is returned.
+.Sh PROGRAMMING NOTES
+For security reasons, except for the
+.Sy psinfo ,
+.Sy usage ,
+.Sy lpsinfo ,
+.Sy lusage ,
+.Sy lwpsinfo ,
+and
+.Sy lwpusage
+files, which are world-readable, and except for privileged processes, an open
+of a
+.Pa /proc
 file fails unless both the user-ID and group-ID of the caller match those of
-the traced process and the process's object file is readable by the caller. The
-effective set of the caller is a superset of both the inheritable and the
-permitted set of the target process. The limit set of the caller is a superset
-of the limit set of the target process. Except for the world-readable files
-just mentioned, files corresponding to setuid and setgid processes can be
-opened only by the appropriately privileged process.
-.sp
-.LP
-A process that is missing the basic privilege {\fBPRIV_PROC_INFO\fR} cannot see
-any processes under \fB/proc\fR that it cannot send a signal to.
-.sp
-.LP
-A process that has {\fBPRIV_PROC_OWNER\fR} asserted in its effective set can
-open any file for reading. To manipulate or control a process, the controlling
-process must have at least as many privileges in its effective set as the
-target process has in its effective, inheritable, and permitted sets. The limit
-set of the controlling process must be a superset of the limit set of the
-target process. Additional restrictions apply if any of the uids of the target
-process are 0. See \fBprivileges\fR(5).
-.sp
-.LP
+the traced process and the process's object file is readable by the caller.
+The effective set of the caller is a superset of both the inheritable and the
+permitted set of the target process.
+The limit set of the caller is a superset of the limit set of the target
+process.
+Except for the world-readable files just mentioned, files corresponding to
+setuid and setgid processes can be opened only by the appropriately privileged
+process.
+.Pp
+A process that is missing the basic privilege
+.Brq Sy PRIV_PROC_INFO
+cannot see any processes under
+.Pa /proc
+that it cannot send a signal to.
+.Pp
+A process that has
+.Brq Sy PRIV_PROC_OWNER
+asserted in its effective set can open any file for reading.
+To manipulate or control a process, the controlling process must have at least
+as many privileges in its effective set as the target process has in its
+effective, inheritable, and permitted sets.
+The limit set of the controlling process must be a superset of the limit set
+of the target process.
+Additional restrictions apply if any of the uids of the target process are 0.
+See
+.Xr privileges 5 .
+.Pp
 Even if held by a privileged process, an open process or lwp file descriptor
 (other than file descriptors for the world-readable files) becomes invalid if
-the traced process performs an \fBexec\fR(2) of a setuid/setgid object file or
-an object file that the traced process cannot read. Any operation performed on
-an invalid file descriptor, except \fBclose\fR(2), fails with \fBEAGAIN\fR. In
-this situation, if any tracing flags are set and the process or any lwp file
-descriptor is open for writing, the process will have been directed to stop and
-its run-on-last-close flag will have been set (see \fBPCSET\fR). This enables a
-controlling process (if it has permission) to reopen the \fB/proc\fR files to
-get new valid file descriptors, close the invalid file descriptors, unset the
-run-on-last-close flag (if desired), and proceed. Just closing the invalid file
-descriptors causes the traced process to resume execution with all tracing
-flags cleared. Any process not currently open for writing via \fB/proc\fR, but
-that has left-over tracing flags from a previous open, and that executes a
-setuid/setgid or unreadable object file, will not be stopped but will have all
-its tracing flags cleared.
-.sp
-.LP
+the traced process performs an
+.Xr exec 2
+of a setuid/setgid object file or
+an object file that the traced process cannot read.
+Any operation performed on an invalid file descriptor, except
+.Xr close 2 ,
+fails with
+.Er EAGAIN .
+In this situation, if any tracing flags are set and the process or any lwp
+file descriptor is open for writing, the process will have been directed to
+stop and its run-on-last-close flag will have been set (see
+.Sx PCSET ) .
+This enables a controlling process (if it has permission) to reopen the
+.Pa /proc
+files to get new valid file descriptors, close the invalid file descriptors,
+unset the run-on-last-close flag (if desired), and proceed.
+Just closing the invalid file descriptors causes the traced process to resume
+execution with all tracing flags cleared.
+Any process not currently open for writing via
+.Pa /proc ,
+but that has left-over tracing flags from a previous open, and that executes
+a setuid/setgid or unreadable object file, will not be stopped but will have
+all its tracing flags cleared.
+.Pp
 To wait for one or more of a set of processes or lwps to stop or terminate,
-\fB/proc\fR file descriptors (other than those obtained by opening the
-\fBcwd\fR or \fBroot\fR directories or by opening files in the \fBfd\fR or
-\fBobject\fR directories) can be used in a \fBpoll\fR(2) system call. When
-requested and returned, either of the polling events \fBPOLLPRI\fR or
-\fBPOLLWRNORM\fR indicates that the process or lwp stopped on an event of
-interest. Although they cannot be requested, the polling events \fBPOLLHUP\fR,
-\fBPOLLERR\fR, and \fBPOLLNVAL\fR may be returned. \fBPOLLHUP\fR indicates that
-the process or lwp has terminated. \fBPOLLERR\fR indicates that the file
-descriptor has become invalid. \fBPOLLNVAL\fR is returned immediately if
-\fBPOLLPRI\fR or \fBPOLLWRNORM\fR is requested on a file descriptor referring
-to a system process (see \fBPCSTOP\fR). The requested events may be empty to
-wait simply for termination.
-.SH FILES
-.ne 2
-.na
-\fB\fB/proc\fR\fR
-.ad
-.sp .6
-.RS 4n
+.Pa /proc
+file descriptors (other than those obtained by opening the
+.Pa cwd
+or
+.Pa root
+directories or by opening files in the
+.Pa fd
+or
+.Pa object
+directories) can be used in a
+.Xr poll 2
+system call.
+When requested and returned, either of the polling events
+.Sy POLLPRI
+or
+.Sy POLLWRNORM
+indicates that the process or lwp stopped on an event of
+interest.
+Although they cannot be requested, the polling events
+.Sy POLLHUP ,
+.Sy POLLERR ,
+and
+.Sy POLLNVAL
+may be returned.
+.Sy POLLHUP
+indicates that the process or lwp has terminated.
+.Sy POLLERR
+indicates that the file descriptor has become invalid.
+.Sy POLLNVAL
+is returned immediately if
+.Sy POLLPRI
+or
+.Sy POLLWRNORM
+is requested on a file descriptor referring to a system process (see
+.Sx  PCSTOP ) .
+The requested events may be empty to wait simply for termination.
+.Sh FILES
+.Bl -tag -compact -width Ds
+.It Pa /proc
 directory (list of processes)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid
 specific process directory
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/self\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/self
 alias for a process's own directory
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/as\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /as
 address space file
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/ctl\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /ctl
 process control file
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/status\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /status
 process status
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lstatus\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lstatus
 array of lwp status structs
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/psinfo\fR\fR
-.ad
-.sp .6
-.RS 4n
-process \fBps\fR(1) info
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lpsinfo\fR\fR
-.ad
-.sp .6
-.RS 4n
-array of lwp \fBps\fR(1) info structs
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/map\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /psinfo
+process
+.Xr ps 1
+info
+.It Pa /proc/ Ns Em pid Ns Pa /lpsinfo
+array of lwp
+.Xr ps 1
+info structs
+.It Pa /proc/ Ns Em pid Ns Pa /map
 address space map
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/xmap\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /xmap
 extended address space map
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/rmap\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /rmap
 reserved address map
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/cred\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /cred
 process credentials
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/priv\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /priv
 process privileges
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/sigact\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /sigact
 process signal actions
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/auxv\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /auxv
 process aux vector
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/ldt\fR\fR
-.ad
-.sp .6
-.RS 4n
-process \fBLDT\fR (x86 only)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/usage\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /argv
+process argument vector
+.It Pa /proc/ Ns Em pid Ns Pa /ldt
+process
+.Sy LDT
+(x86 only)
+.It Pa /proc/ Ns Em pid Ns Pa /usage
 process usage
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lusage\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lusage
 array of lwp usage structs
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/path\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /path
 symbolic links to process open files
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/pagedata\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /pagedata
 process page data
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/watch\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /watch
 active watchpoints
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/cwd\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /cwd
 alias for the current working directory
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/root\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /root
 alias for the root directory
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/fd\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /fd
 directory (list of open files)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/fd/*\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /fd/*
 aliases for process's open files
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/object\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /object
 directory (list of mapped files)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/object/a.out\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /object/a.out
 alias for process's executable file
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/object/*\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /object/*
 aliases for other mapped files
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp
 directory (list of lwps)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid
 specific lwp directory
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/agent\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/agent
 alias for the agent lwp directory
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/lwpctl\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /lwpctl
 lwp control file
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/lwpstatus\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /lwpstatus
 lwp status
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/lwpsinfo\fR\fR
-.ad
-.sp .6
-.RS 4n
-lwp \fBps\fR(1) info
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/lwpusage\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /lwpsinfo
+lwp
+.Xr ps 1
+info
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /lwpusage
 lwp usage
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/gwindows\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /gwindows
 register windows (SPARC only)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/xregs\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /xregs
 extra state registers
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/asrs\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /asrs
 ancillary state registers (SPARC V9 only)
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/proc/\fIpid\fR/lwp/\fIlwpid\fR/spymaster\fR\fR
-.ad
-.sp .6
-.RS 4n
+.It Pa /proc/ Ns Em pid Ns Pa /lwp/ Ns Em lwpid Ns Pa /spymaster
 For an agent LWP, the controlling process
-.RE
-
-.SH SEE ALSO
-.LP
-\fBls\fR(1), \fBps\fR(1), \fBchroot\fR(1M), \fBalarm\fR(2), \fBbrk\fR(2),
-\fBchdir\fR(2), \fBchroot\fR(2), \fBclose\fR(2), \fBcreat\fR(2), \fBdup\fR(2),
-\fBexec\fR(2), \fBfcntl\fR(2), \fBfork\fR(2), \fBfork1\fR(2), \fBfstat\fR(2),
-\fBgetdents\fR(2), \fBgetustack\fR(2), \fBkill\fR(2), \fBlseek\fR(2),
-\fBmmap\fR(2), \fBnice\fR(2), \fBopen\fR(2), \fBpoll\fR(2), \fBpread\fR(2),
-\fBptrace\fR(3C), \fBpwrite\fR(2), \fBread\fR(2), \fBreadlink\fR(2),
-\fBreadv\fR(2), \fBshmget\fR(2), \fBsigaction\fR(2), \fBsigaltstack\fR(2),
-\fBvfork\fR(2), \fBwrite\fR(2), \fBwritev\fR(2), \fB_stack_grow\fR(3C),
-\fBreaddir\fR(3C), \fBpthread_create\fR(3C), \fBpthread_join\fR(3C),
-\fBsiginfo.h\fR(3HEAD), \fBsignal.h\fR(3HEAD), \fBthr_create\fR(3C),
-\fBthr_join\fR(3C), \fBtypes32.h\fR(3HEAD), \fBucontext.h\fR(3HEAD),
-\fBwait\fR(3C), \fBcontract\fR(4), \fBcore\fR(4), \fBprocess\fR(4),
-\fBlfcompile\fR(5), \fBprivileges\fR(5), \fBsecurity-flags\fR(5)
-.SH DIAGNOSTICS
-.LP
+.El
+.Sh DIAGNOSTICS
 Errors that can occur in addition to the errors normally associated with file
 system access:
-.sp
-.ne 2
-.na
-\fB\fBE2BIG\fR\fR
-.ad
-.RS 13n
-Data to be returned in a \fBread\fR(2) of the page data file exceeds the size
-of the read buffer provided by the caller.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEACCES\fR\fR
-.ad
-.RS 13n
+.Bl -tag -width "EOVERFLOW" -offset left
+.It Er E2BIG
+Data to be returned in a
+.Xr read 2
+of the page data file exceeds the size of the read buffer provided by the
+caller.
+.It Er EACCES
 An attempt was made to examine a process that ran under a different uid than
-the controlling process and {\fBPRIV_PROC_OWNER\fR} was not asserted in the
-effective set.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEAGAIN\fR\fR
-.ad
-.RS 13n
-The traced process has performed an \fBexec\fR(2) of a setuid/setgid object
+the controlling process and
+.Brq Sy PRIV_PROC_OWNER
+was not asserted in the effective set.
+.It Er EAGAIN
+The traced process has performed an
+.Xr exec 2
+of a setuid/setgid object
 file or of an object file that it cannot read; all further operations on the
-process or lwp file descriptor (except \fBclose\fR(2)) elicit this error.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEBUSY\fR\fR
-.ad
-.RS 13n
-\fBPCSTOP\fR, \fBPCDSTOP\fR, \fBPCWSTOP\fR, or \fBPCTWSTOP\fR was applied to a
-system process; an exclusive \fBopen\fR(2) was attempted on a \fB/proc\fR file
-for a process already open for writing; \fBPCRUN\fR, \fBPCSREG\fR,
-\fBPCSVADDR\fR, \fBPCSFPREG\fR, or \fBPCSXREG\fR was applied to a process or
+process or lwp file descriptor (except
+.Xr close 2 )
+elicit this error.
+.It Er EBUSY
+.Sy PCSTOP ,
+.Sy PCDSTOP ,
+.Sy PCWSTOP , or
+.Sy PCTWSTOP
+was applied to a system process; an exclusive
+.Xr open 2
+was attempted on a
+.Pa /proc
+file for a process already open for writing;
+.Sy PCRUN ,
+.Sy PCSREG ,
+.Sy PCSVADDR ,
+.Sy PCSFPREG ,
+or
+.Sy PCSXREG
+was applied to a process or
 lwp not stopped on an event of interest; an attempt was made to mount
-\fB/proc\fR when it was already mounted; \fBPCAGENT\fR was applied to a process
+.Pa /proc
+when it was already mounted;
+.Sy PCAGENT
+was applied to a process
 that was not fully stopped or that already had an agent lwp.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEINVAL\fR\fR
-.ad
-.RS 13n
+.It Er EINVAL
 In general, this means that some invalid argument was supplied to a system
-call. A non-exhaustive list of conditions eliciting this error includes: a
+call.
+A non-exhaustive list of conditions eliciting this error includes: a
 control message operation code is undefined; an out-of-range signal number was
-specified with \fBPCSSIG\fR, \fBPCKILL\fR, or \fBPCUNKILL\fR; \fBSIGKILL\fR was
-specified with \fBPCUNKILL\fR; \fBPCSFPREG\fR was applied on a system that does
-not support floating-point operations; \fBPCSXREG\fR was applied on a system
-that does not support extra state registers.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEINTR\fR\fR
-.ad
-.RS 13n
+specified with
+.Sy PCSSIG ,
+.Sy PCKILL ,
+or
+.Sy PCUNKILL ;
+.Sy SIGKILL
+was specified with
+.Sy PCUNKILL ;
+.Sy PCSFPREG
+was applied on a system that does not support floating-point operations;
+.Sy PCSXREG
+was applied on a system that does not support extra state registers.
+.It Er EINTR
 A signal was received by the controlling process while waiting for the traced
-process or lwp to stop via \fBPCSTOP\fR, \fBPCWSTOP\fR, or \fBPCTWSTOP\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEIO\fR\fR
-.ad
-.RS 13n
-A \fBwrite\fR(2) was attempted at an illegal address in the traced process.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBENOENT\fR\fR
-.ad
-.RS 13n
-The traced process or lwp has terminated after being opened. The basic
-privilege {\fBPRIV_PROC_INFO\fR} is not asserted in the effective set of the
-calling process and the calling process cannot send a signal to the target
-process.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBENOMEM\fR\fR
-.ad
-.RS 13n
+process or lwp to stop via
+.Sy PCSTOP ,
+.Sy PCWSTOP ,
+or
+.Sy PCTWSTOP .
+.It Er EIO
+A
+.Xr write 2
+was attempted at an illegal address in the traced process.
+.It Er ENOENT
+The traced process or lwp has terminated after being opened.
+The basic privilege
+.Brq Sy PRIV_PROC_INFO
+is not asserted in the effective set of the calling process and the calling
+process cannot send a signal to the target process.
+.It Er ENOMEM
 The system-imposed limit on the number of page data file descriptors was
-reached on an open of \fB/proc/\fR\fIpid\fR\fB/pagedata\fR; an attempt was made
-with \fBPCWATCH\fR to establish more watched areas than the system can support;
-the \fBPCAGENT\fR operation was issued when the system was out of resources for
+reached on an open of
+.Pa /proc/ Ns Em pid Ns Pa /pagedata ;
+an attempt was made
+with
+.Sy PCWATCH
+to establish more watched areas than the system can support;
+the
+.Sy PCAGENT
+operation was issued when the system was out of resources for
 creating lwps.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBENOSYS\fR\fR
-.ad
-.RS 13n
+.It Er ENOSYS
 An attempt was made to perform an unsupported operation (such as
-\fBcreat\fR(2), \fBlink\fR(2), or \fBunlink\fR(2)) on an entry in \fB/proc\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEOVERFLOW\fR\fR
-.ad
-.RS 13n
-A 32-bit controlling process attempted to read or write the \fBas\fR file or
-attempted to read the \fBmap\fR, \fBrmap\fR, or \fBpagedata\fR file of a 64-bit
-target process. A 32-bit controlling process attempted to apply one of the
-control operations \fBPCSREG\fR, \fBPCSXREG\fR, \fBPCSVADDR\fR, \fBPCWATCH\fR,
-\fBPCAGENT\fR, \fBPCREAD\fR, \fBPCWRITE\fR to a 64-bit target process.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBEPERM\fR\fR
-.ad
-.RS 13n
-The process that issued the \fBPCSCRED\fR or \fBPCSCREDX\fR operation did not
-have the {\fBPRIV_PROC_SETID\fR} privilege asserted in its effective set, or
-the process that issued the \fBPCNICE\fR operation did not have the
-{\fBPRIV_PROC_PRIOCNTL\fR} in its effective set.
-.sp
+.Xr creat 2 ,
+.Xr link 2 ,
+or
+.Xr unlink 2 )
+on an entry in
+.Pa /proc .
+.It Er EOVERFLOW
+A 32-bit controlling process attempted to read or write the
+.Pa as
+file or attempted to read the
+.Pa map ,
+.Pa rmap ,
+or
+.Pa pagedata
+file of a 64-bit target process.
+A 32-bit controlling process attempted to apply one of the
+control operations
+.Sy PCSREG ,
+.Sy PCSXREG ,
+.Sy PCSVADDR ,
+.Sy PCWATCH ,
+.Sy PCAGENT ,
+.Sy PCREAD ,
+.Sy PCWRITE
+to a 64-bit target process.
+.It Er EPERM
+The process that issued the
+.Sy PCSCRED
+or
+.Sy PCSCREDX
+operation did not have the
+.Brq Sy PRIV_PROC_SETID
+privilege asserted in its effective set, or
+the process that issued the
+.Sy PCNICE
+operation did not have the
+.Brq Sy PRIV_PROC_PRIOCNTL
+in its effective set.
+.Pp
 An attempt was made to control a process of which the E, P, and I privilege
 sets were not a subset of the effective set of the controlling process or the
 limit set of the controlling process is not a superset of limit set of the
 controlled process.
-.sp
-Any of the uids of the target process are 0 or an attempt was made to change
-any of the uids to 0 using PCSCRED and the security policy imposed additional
-restrictions. See \fBprivileges\fR(5).
-.RE
-
-.SH NOTES
-.LP
+.Pp
+Any of the uids of the target process are
+.Sy 0
+or an attempt was made to change any of the uids to
+.Sy 0
+using
+.Sy PCSCRED
+and the security policy imposed additional restrictions.
+See
+.Xr privileges 5 .
+.El
+.Sh SEE ALSO
+.Xr ls 1 ,
+.Xr ps 1 ,
+.Xr chroot 1M ,
+.Xr alarm 2 ,
+.Xr brk 2 ,
+.Xr chdir 2 ,
+.Xr chroot 2 ,
+.Xr close 2 ,
+.Xr creat 2 ,
+.Xr dup 2 ,
+.Xr exec 2 ,
+.Xr fcntl 2 ,
+.Xr fork 2 ,
+.Xr fork1 2 ,
+.Xr fstat 2 ,
+.Xr getdents 2 ,
+.Xr getustack 2 ,
+.Xr kill 2 ,
+.Xr lseek 2 ,
+.Xr mmap 2 ,
+.Xr nice 2 ,
+.Xr open 2 ,
+.Xr poll 2 ,
+.Xr pread 2 ,
+.Xr pwrite 2 ,
+.Xr read 2 ,
+.Xr readlink 2 ,
+.Xr readv 2 ,
+.Xr shmget 2 ,
+.Xr sigaction 2 ,
+.Xr sigaltstack 2 ,
+.Xr vfork 2 ,
+.Xr write 2 ,
+.Xr writev 2 ,
+.Xr _stack_grow 3C ,
+.Xr pthread_create 3C ,
+.Xr pthread_join 3C ,
+.Xr ptrace 3C ,
+.Xr readdir 3C ,
+.Xr thr_create 3C ,
+.Xr thr_join 3C ,
+.Xr wait 3C ,
+.Xr siginfo.h 3HEAD ,
+.Xr signal.h 3HEAD ,
+.Xr types32.h 3HEAD ,
+.Xr ucontext.h 3HEAD ,
+.Xr contract 4 ,
+.Xr core 4 ,
+.Xr process 4 ,
+.Xr lfcompile 5 ,
+.Xr privileges 5 ,
+.Xr security-flags 5
+.Sh NOTES
 Descriptions of structures in this document include only interesting structure
 elements, not filler and padding fields, and may show elements out of order for
-descriptive clarity. The actual structure definitions are contained in
-\fB<procfs.h>\fR\&.
-.SH BUGS
-.LP
-Because the old \fBioctl\fR(2)-based version of \fB/proc\fR is currently
-supported for binary compatibility with old applications, the top-level
-directory for a process, \fB/proc/\fR\fIpid\fR, is not world-readable, but it
-is world-searchable. Thus, anyone can open \fB/proc/\fR\fIpid\fR\fB/psinfo\fR
-even though \fBls\fR(1) applied to \fB/proc/\fR\fIpid\fR will fail for anyone
-but the owner or an appropriately privileged process. Support for the old
-\fBioctl\fR(2)-based version of \fB/proc\fR will be dropped in a future
-release, at which time the top-level directory for a process will be made
-world-readable.
-.sp
-.LP
-On SPARC based machines, the types \fBgregset_t\fR and \fBfpregset_t\fR defined
-in <\fBsys/regset.h\fR> are similar to but not the same as the types
-\fBprgregset_t\fR and \fBprfpregset_t\fR defined in <\fBprocfs.h\fR>.
+descriptive clarity.
+The actual structure definitions are contained in
+.In procfs.h .
+.Sh BUGS
+Because the old
+.Xr ioctl 2 Ns -based
+version of
+.Pa /proc
+is currently supported for binary compatibility with old applications, the
+top-level directory for a process,
+.Pa /proc/ Ns Em pid ,
+is not world-readable, but it is world-searchable.
+Thus, anyone can open
+.Pa /proc/ Ns Em pid Ns Pa /psinfo
+even though
+.Xr ls 1
+applied to
+.Pa /proc/ Ns Em pid
+will fail for anyone but the owner or an appropriately privileged process.
+Support for the old
+.Xr ioctl 2 Ns -based
+version of
+.Pa /proc
+will be dropped in a future release, at which time the top-level directory for
+a process will be made world-readable.
+.Pp
+On SPARC based machines, the types
+.Sy gregset_t
+and
+.Sy fpregset_t
+defined in
+.In sys/regset.h
+are similar to but not the same as the types
+.Sy prgregset_t
+and
+.Sy prfpregset_t
+defined in
+.In procfs.h .
diff --git a/usr/src/man/man4/process.4 b/usr/src/man/man4/process.4
index 50f80efca2..d709decfce 100644
--- a/usr/src/man/man4/process.4
+++ b/usr/src/man/man4/process.4
@@ -1,9 +1,10 @@
 '\" te
 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
+.\" Copyright 2016, Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH PROCESS 4 "Mar 25, 2008"
+.TH PROCESS 4 "Sept 6, 2016"
 .SH NAME
 process \- process contract type
 .SH SYNOPSIS
@@ -205,6 +206,21 @@ exits.
 .sp
 .ne 2
 .na
+\fB\fBCT_PR_KEEP_EXEC\fR\fR
+.ad
+.sp .6
+.RS 4n
+If set, the process contract template remains active across \fBexec\fR(2).
+This can be used to setup a contract for children of an application which
+is not contract-aware. If this is not set then the system clears the active
+template when the process execs. Because this option is intended for an
+application which is not contract-aware, new child process contracts will be
+automatically abandoned by the parent.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBCT_PR_NOORPHAN\fR\fR
 .ad
 .sp .6
diff --git a/usr/src/man/man5/Makefile b/usr/src/man/man5/Makefile
index dfc6b26a92..60aedf95cb 100644
--- a/usr/src/man/man5/Makefile
+++ b/usr/src/man/man5/Makefile
@@ -14,7 +14,7 @@
 # Copyright (c) 2012 by Delphix. All rights reserved.
 # Copyright 2014 Nexenta Systems, Inc.
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
-# Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+# Copyright 2016, Joyent, Inc.
 # Copyright 2018 Gary Mills
 #
 
@@ -60,6 +60,7 @@ _MANFILES=	Intro.5			\
 		iconv_unicode.5		\
 		ieee802.3.5		\
 		ieee802.11.5		\
+		inotify.5		\
 		ipfilter.5		\
 		isalist.5		\
 		kerberos.5		\
@@ -70,6 +71,7 @@ _MANFILES=	Intro.5			\
 		lfcompile.5		\
 		lfcompile64.5		\
 		locale.5		\
+		lx.5			\
 		man.5			\
 		mandoc_char.5		\
 		mandoc_roff.5		\
@@ -81,6 +83,7 @@ _MANFILES=	Intro.5			\
 		ms.5			\
 		mutex.5			\
 		nfssec.5		\
+		overlay.5		\
 		pam_allow.5		\
 		pam_authtok_check.5	\
 		pam_authtok_get.5	\
diff --git a/usr/src/man/man5/brands.5 b/usr/src/man/man5/brands.5
index 9d7ce16d42..cc79ac173a 100644
--- a/usr/src/man/man5/brands.5
+++ b/usr/src/man/man5/brands.5
@@ -83,5 +83,4 @@ Interface Stability	Evolving
 \fBin.rlogind\fR(1M), \fBsshd\fR(1M), \fBzoneadm\fR(1M), \fBzonecfg\fR(1M),
 \fBkill\fR(2), \fBpriocntl\fR(2), \fBgetzoneid\fR(3C), \fBucred_get\fR(3C),
 \fBgetzoneid\fR(3C), \fBproc\fR(4), \fBattributes\fR(5), \fBlx\fR(5),
-\fBnative\fR(5), \fBprivileges\fR(5), \fBzones\fR(5), \fBlx_systrace\fR(7D),
-\fBcrgetzoneid\fR(9F)
+\fBprivileges\fR(5), \fBzones\fR(5), \fBcrgetzoneid\fR(9F)
diff --git a/usr/src/man/man5/inotify.5 b/usr/src/man/man5/inotify.5
new file mode 100644
index 0000000000..9b0016101d
--- /dev/null
+++ b/usr/src/man/man5/inotify.5
@@ -0,0 +1,305 @@
+'\" te
+.\"  Copyright (c) 2014, Joyent, Inc. All Rights Reserved.
+.\"  This file and its contents are supplied under the terms of the
+.\"  Common Development and Distribution License ("CDDL"), version 1.0.
+.\"  You may only use this file in accordance with the terms of version
+.\"  1.0 of the CDDL.
+.\" 
+.\"  A full copy of the text of the CDDL should have accompanied this
+.\"  source.  A copy of the CDDL is also available via the Internet at
+.\"  http://www.illumos.org/license/CDDL.
+.TH INOTIFY 5 "Sep 17, 2014"
+.SH NAME
+inotify \- Linux-compatible file event notification facility
+.SH SYNOPSIS
+
+.LP
+.nf
+#include <sys/inotify.h>
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+
+\fBinotify\fR is a facility for receiving file system events on specified
+files or directories.  When monitoring a directory, \fBinotify\fR can be
+used to retrieve events not only on the directory, but also on any files
+that the directory contains.  \fBinotify\fR originated with Linux, and
+this facility is designed to be binary-compatible with the Linux facility,
+including the following interfaces:
+
+.RS +4
+.TP
+.ie t \(bu
+.el o
+\fBinotify_init\fR(3C) creates an \fBinotify\fR instance, returning a file
+descriptor associated with the in-kernel event queue.
+.RE
+.RS +4
+.TP
+.ie t \(bu
+.el o
+\fBinotify_init1\fR(3C) also creates an \fBinotify\fR instance, but allows
+for a flags argument that controls some attributes of the returned file
+descriptor.
+.RE
+.RS +4
+.TP
+.ie t \(bu
+.el o
+\fBinotify_add_watch\fR(3C) allows a watch of a particular file or directory
+to be added to a watch list associated with the specified \fBinotify\fR
+instance. \fBinotify_add_watch\fR(3C) returns a watch descriptor that will
+be reflected in the \fIwd\fR member of the \fIinotify_event\fR structure
+returned via a \fBread\fR(2) of the instance.
+.RE
+.RS +4
+.TP
+.ie t \(bu
+.el o
+\fBinotify_rm_watch\fR(3C) removes the watch that corresponds to the specified
+watch descriptor.
+.RE
+
+When all file descriptors referring to a particular \fBinotify\fR instance
+are closed, the instance and all watches associated with that instance are
+freed.
+
+To consume events on an \fBinotify\fR instance, an application should 
+issue a \fBread\fR(2) to the instance.  If no events are available
+(and the \fBinotify\fR instance has not been explicitly made non-blocking
+via \fBinotify_init1\fR(3C)) the \fBread\fR(2) will block until a
+watched event occurs. If and when events are available, \fBread\fR(2) will
+return an array of the following structures:
+
+.sp
+.in +2
+.nf
+struct inotify_event {
+        int      wd;       /* watch descriptor */
+        uint32_t mask;     /* mask of event */
+        uint32_t cookie;   /* cookie for associating renames */
+        uint32_t len;      /* size of name field */
+        char     name[];   /* optional name */
+};
+.fi
+.in -2
+
+\fIwd\fR contains the watch descriptor that corresponds to the event,
+as returned by \fBinotify_add_watch\fR(3C).
+
+\fImask\fR is a bitwise \fBOR\fR of event masks (see below) that
+describes the event.
+
+\fIcookie\fR is an opaque value that can be used to associate different
+events into a single logical event. In particular, it allows consumers to
+associate \fBIN_MOVED_FROM\fR events with subsequent \fBIN_MOVED_TO\fR
+events.
+
+\fIlen\fR denotes the length of the \fIname\fR field, including any padding
+required for trailing null bytes and alignment. The size of the entire
+event is therefore the size of the \fIinotify_event\fR structure plus the
+value of \fIlen\fR.
+
+\fIname\fR contains the name of the file associated with the event, if any.
+This field is only present when the watched entity is a directory and
+the event corresponds to a file that was contained by the watched directory
+(though see \fBNOTES\fR and \fBWARNINGS\fR for details and limitations).
+When present, \fIname\fR is null terminated, and may contain additional
+zero bytes
+to pad for alignment. (The length of this field -- including any bytes
+for alignment -- is denoted by the \fIlen\fR field.)
+
+.SS "Events"
+
+The events that can be generated on a watched entity are as follows:
+
+.sp
+.in +2
+.TS
+c c
+l l .
+\fIEvent\fR	\fIDescription\fR
+\fBIN_ACCESS\fR	File/directory was accessed
+\fBIN_ATTRIB\fR	File/directory attributes were changed
+\fBIN_CLOSE_WRITE\fR	File/directory opened for writing was closed 
+\fBIN_CLOSE_NOWRITE\fR	File/directory not opened for writing was closed
+\fBIN_CREATE\fR	File/directory created in watched directory
+\fBIN_DELETE\fR	File/directory deleted from watched directory
+\fBIN_DELETE_SELF\fR	Watched file/directory was deleted
+\fBIN_MODIFY\fR	File/directory was modified
+\fBIN_MODIFY_SELF\fR	Watched file/directory was modified
+\fBIN_MOVED_FROM\fR	File was renamed from entity in watched directory
+\fBIN_MOVED_TO\fR	File was renamed to entity in watched directory
+\fBIN_OPEN\fR	File/directory was opened
+.TE
+.in -2
+
+Of these, all events except \fBIN_MOVE_SELF\fR and \fBIN_DELETE_SELF\fR
+can refer to either the watched entity or (if the watched entity
+is a directory) a file or directory contained by the watched directory.
+(See \fBNOTES\fR and \fBWARNINGS\fR, below for details on this
+mechanism and its limitations.)
+If the event corresponds to a contained entity,
+\fIname\fR will be set to the name of the affected
+entity.
+
+In addition to speciyfing events of interest, watched events may
+be modified by potentially setting any of the following when adding a
+watch via \fBinotify_add_watch\fR(3C):
+
+.sp
+.ne 2
+.na
+\fBIN_DONT_FOLLOW\fR
+.ad
+.RS 12n
+Don't follow the specified pathname if it is a symbolic link.
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_EXCL_UNLINK\fR
+.ad
+.RS 12n
+If watching a directory and a contained entity becomes unlinked, cease
+generating events for that entity. (By default, contained entities will
+continue to generate events on their former parent directory.)
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_MASK_ADD\fR
+.ad
+.RS 12n
+If the specified pathname is already being watched, the specified events
+will be added to the watched events instead of the default behavior of
+replacing them. (If one
+may forgive the editorializing, this particular interface gewgaw
+seems entirely superfluous, and a canonical example of
+feasibility trumping wisdom.)
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_ONESHOT\fR
+.ad
+.RS 12n
+Once an event has been generated for the watched entity, remove the
+watch from the watch list as if \fBinotify_rm_watch\fR(3C) had been called
+on it (thereby inducing an \fBIN_IGNORED\fR event).
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_ONLYDIR\fR
+.ad
+.RS 12n
+Only watch the specified pathname if it is a directory.
+.RE
+
+In addition to the specified events, the following bits may be specified
+in the \fImask\fR field as returned from \fBread\fR(2):
+
+.sp
+.ne 2
+.na
+\fBIN_IGNORED\fR
+.ad
+.RS 12n
+A watch was removed explicitly (i.e, via \fBinotify_rm_watch\fR(3C)) or
+implicitly (e.g., because \fBIN_ONESHOT\fR was set or because the watched
+entity was deleted). 
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_ISDIR\fR
+.ad
+.RS 12n
+The entity inducing the event is a directory.
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_Q_OVERFLOW\fR
+.ad
+.RS 12n
+The event queue exceeded the maximum event queue length per instance.
+(By default, this is 16384, but it can be tuned by setting 
+\fBinotify_maxevents\fR via \fB/etc/system\fR.)
+.RE
+
+.sp
+.ne 2
+.na
+\fBIN_UNMOUNT\fR
+.ad
+.RS 12n
+The filesystem containing the watched entity was unmounted.
+.RE
+
+.sp
+.SH NOTES
+.sp
+.LP
+
+\fBinotify\fR instances can be monitored via \fBpoll\fR(2), 
+\fBport_get\fR(3C), \fBepoll\fR(5), etc.
+
+The event queue associated with an \fBinotify\fR instance is serialized
+and ordered: events will be placed on the tail of the queue in the order
+that they occur.
+
+If at the time an event occurs the tail of the event queue is identical
+to the newly received event, the newly received event will be dropped,
+effectively coalescing the two events.
+
+When watching a directory and receieving events on contained elements
+(i.e., a contained file or subdirectory), note that the information
+received in the \fIname\fR field may be stale:  the file may have been
+renamed between the event and its processing.  If a file has been unlinked
+(and if \fBIN_EXCL_UNLINK\fR has not been set),
+the \fIname\fR will reflect the last name that resolved to the file.
+If a new file is created in the same directory with the old name, events
+on the new file and the old (unlinked) file will become undistinguishable.
+
+The number of bytes that are available to be read on an \fBinotify\fR 
+instance can be determined via a \fBFIONREAD\fR \fBioctl\fR(2).
+
+.sp
+.SH WARNINGS
+.sp
+.LP
+
+While a best effort has been made to mimic the Linux semantics, there
+remains a fundamental difference with respect to hard links:  on Linux,
+if a file has multiple hard links to it, a notification on a watched
+directory or file will be received if and only if that event was received
+via the watched path.  For events that are induced by open files
+(such as \fBIN_MODIFY\fR), these semantics seem peculiar:  the watched
+file is in fact changing, but because it is not changing via the watched
+path, no notification is received.  By contrast, the implementation here
+will always yield an event in this case -- even if the event was induced
+by an \fBopen\fR(2) via an unwatched path.  If an event occurs within a
+watched directory on a file for which there exist multiple hard links within
+the same (watched) directory, the event's \fIname\fR will correspond to one
+of the links to the file.  If multiple hard links exist to the
+same file in the same watched directory and one of the links is removed,
+notifications may not necessarily continue to be received for the file,
+despite the (remaining) link in the watched directory; users of
+\fBinotify\fR should exercise extreme caution when watching directories
+that contain files with multiple hard links in the same directory.
+
+.SH SEE ALSO
+.sp
+.LP
+\fBinotify_init\fR(3C), \fBinotify_init1\fR(3C), \fBinotify_add_watch\fR(3C),
+\fBinotify_rm_watch\fR(3C), \fBport_get\fR(3C), \fBepoll\fR(5)
diff --git a/usr/src/man/man5/lx.5 b/usr/src/man/man5/lx.5
new file mode 100644
index 0000000000..9ad903a396
--- /dev/null
+++ b/usr/src/man/man5/lx.5
@@ -0,0 +1,113 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2016, Joyent, Inc.
+.\"
+.Dd February 5, 2106
+.Dt LX 5
+.Os
+.Sh NAME
+.Nm lx
+.Nd zone brand for running a GNU/Linux user-level environment
+.Sh DESCRIPTION
+The
+.Em lx
+brand
+uses the
+.Xr brands 5
+framework to provide an environment for running binary applications built
+for GNU/Linux.
+User-level code, including an entire Linux distribution, can run inside the
+zone.
+Both 32-bit and 64-bit applications are supported.
+The majority of Linux system calls are provided, along with emulation for a
+variety of Linux file systems, such as
+.Em proc ,
+.Em cgroup
+and
+.Em sysfs .
+.Pp
+The
+.Em /proc
+file system within the zone is a subset of a full Linux
+.Em /proc .
+Most kernel-level tuning applied to
+.Em /proc
+is unavailable or ignored.
+Some tuning can be performed, but only to reduce the overall limits that have
+been specified on the zone's configuration.
+That is, within the zone there is no way to increase the resource limits set on
+the zone itself.
+.Pp
+The zone must be installed using a clone of a
+.Xr zfs 1m
+dataset which contains an image of the software to be run in the zone.
+.Pp
+Example:
+.Dl zoneadm -z myzone install -x nodataset -t debian7
+.Pp
+Applications provided by the base SunOS operating system are also available
+within the zone under the
+.Em /native
+mount point.
+This allows the use of various native tools such as
+.Xr dtrace 1m ,
+.Xr mdb 1 ,
+or the
+.Xr proc 1
+tools on GNU/Linux applications.
+However, not every native tool will work properly within an
+.Em lx
+zone.
+.Sh CONFIGURATION
+The
+.Em kernel-version
+attribute can be included in the zone's
+.Xr zonecfg 1m
+settings as a way to specify the Linux version that the zone is emulating.
+For example, the value could be
+.Em 3.13.0 .
+.Sh LIMITATIONS
+The brand only supports the exclusive IP stack zone configuration.
+.Pp
+Most modern GNU/Linux application software runs on
+.Em lx ,
+but because there are some system calls or file systems which are not currently
+implemented, it's possible that an application won't run.
+This does not preclude the application running in the future as the
+.Em lx
+brand adds new capabilities.
+.Pp
+Because there is only the single SunOS kernel running on the system, there
+is no support for any Linux kernel-level modules.
+That is, there is no support for add-on drivers or any other modules that are
+part of the Linux kernel itself.
+If that is required, a full virtual machine should be used instead of an
+.Em lx
+branded zone.
+.Pp
+Any core files produced within the zone are in the native SunOS format.
+.Pp
+As with any zone, the normal security mechanisms and privileges apply.
+Thus, certain operations (for example, changing the system time), will not be
+allowed unless the zone has been configured with the appropriate additional
+privileges.
+.Sh SEE ALSO
+.Xr mdb 1 ,
+.Xr proc 1 ,
+.Xr dtrace 1m ,
+.Xr zfs 1m ,
+.Xr zoneadm 1m ,
+.Xr zonecfg 1m ,
+.Xr brands 5 ,
+.Xr privileges 5 ,
+.Xr resource_controls 5 ,
+.Xr zones 5
diff --git a/usr/src/man/man5/overlay.5 b/usr/src/man/man5/overlay.5
new file mode 100644
index 0000000000..4e884fd382
--- /dev/null
+++ b/usr/src/man/man5/overlay.5
@@ -0,0 +1,521 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2015 Joyent, Inc.
+.\"
+.Dd Apr 09, 2015
+.Dt OVERLAY 5
+.Os
+.Sh NAME
+.Nm overlay
+.Nd Overlay Devices
+.Sh DESCRIPTION
+Overlay devices are a GLDv3 device that allows users to create overlay
+networks that can be used to form the basis of network virtualization
+and software defined networking.
+Overlay networks allow a single physical network, often called an
+.Sy underlay
+network, to provide the means for creating multiple logical, isolated,
+and discrete layer two and layer three networks on top of it.
+.Pp
+Overlay devices are administered through
+.Xr dladm 1M .
+Overlay devices themselves cannot be plumbed up with
+.Sy IP ,
+.Sy vnd ,
+or any other protocol.
+Instead, like an
+.Sy etherstub ,
+they allow for VNICs to be created on top of them.
+Like an
+.Sy etherstub ,
+an overlay device acts as a local switch; however, when it encounters a
+non-local destination address, it instead looks up where it should send
+the packet, encapsulates it, and sends it out another interface in the
+system.
+.Pp
+A single overlay device encapsulates the logic to answer two different,
+but related, questions:
+.Pp
+.Bl -enum -offset indent -compact
+.It
+How should a packet be transformed and put on the wire?
+.It
+Where should a transformed packet be sent?
+.El
+.Pp
+Each of these questions is answered by a plugin.
+The first question is answered by what's called an
+.Em encapsulation plugin .
+The second question is answered by what's called a
+.Em search plugin .
+Packets are encapsulated and decapsulated using the encapsulation plugin
+by the kernel.
+The search plugins are all user land plugins that are consumed by the
+varpd service whose FMRI is
+.Em svc:/network/varpd:default .
+This separation allows for the kernel to be responsible for the data
+path, while having the search plugins in userland allows the system to
+provide a much more expressive interface.
+.Ss Overlay Types
+Overlay devices come in two different flavors, one where all packets are
+always sent to a single address, the other, where the destination of a
+packet varies based on the target MAC address of the packet.
+This information is maintained in a
+.Em target table ,
+which is independent and unique to each overlay device.
+We call the plugins that send traffic to a single location, for example
+a single unicast or multicast IP address, a
+.Sy point to point
+overlay and the overlay devices that can send traffic to different
+locations based on the MAC address of that packet a
+.Sy dynamic
+overlay.
+The plugin type is determined based on the type of the
+.Sy search plugin .
+These are all fully listed in the section
+.Sx Plugins and their Properties .
+.Ss Overlay Destination
+Both encapsulation and search plugins define the kinds of destinations
+that they know how to support.
+An encapsulation plugin always has a single destination type that's
+determined based on how the encapsulation is defined.
+A search plugin, on the other hand, can support multiple combinations of
+destinations.
+A search plugin must support the destination type of the encapsulation
+device.
+The destination may require any of the following three pieces of
+information, depending on the encapsulation plugin:
+.Bl -hang -width Ds
+.It Sy MAC Address
+.Bd -filled -compact
+An Ethernet MAC address is required to determine the destination.
+.Ed
+.It Sy IP Address
+.Bd -filled -compact
+An IP address is required.
+Both IPv4 and IPv6 addresses are supported.
+.Ed
+.It Sy Port
+.Bd -filled -compact
+An IP protocol level (TCP, UDP, SCTP, etc.) port is required.
+.Ed
+.El
+.Pp
+The list of destination types that are supported by both the search and
+encapsulation plugins is listed in the section
+.Sx Plugins and their Properties .
+.Ss varpd
+The varpd service, mentioned above, is responsible for providing the
+virtual ARP daemon.
+Its responsibility is conceptually similar to ARP.
+It runs all instances of search plugins in the system and is responsible
+for answering the kernel's ARP-like questions for where packets should
+be sent.
+.Pp
+The varpd service, svc:/network/varpd:default, must be enabled for
+overlay devices to function.
+If it is disabled while there are active devices, then most overlay
+devices will not function correctly and likely will end up dropping
+traffic.
+.Sh PLUGINS AND PROPERTIES
+Properties fall into three categories in the system:
+.Bl -enum -offset indent -compact
+.It
+Generic properties all overlay devices have
+.It
+Properties specific to the encapsulation plugin
+.It
+Properties specific to the search plugin
+.El
+.Pp
+Each property in the system has the following attributes, which mirror
+the traditional
+.Xr dladm 1M
+link properties:
+.Bl -hang -width Ds
+.It Sy Name
+.Bd -filled -compact
+The name of a property is namespaced by its module and always structured
+and referred to as as module/property.
+This allows for both an encapsulation and search plugin to have a
+property with the same name.
+Properties that are valid for all overlay devices and not specific to a
+module do not generally use a module prefix.
+.Pp
+For example, the property
+.Sy vxlan/listen_ip
+is associated with the
+.Sy vxlan
+encapsulation module.
+.Ed
+.It Sy Type
+.Bd -filled -compact
+Each property in the system has a type.
+.Xr dladm 1M
+takes care of converting between the internal representation and a
+value, but the type influences the acceptable input range.
+The types are:
+.Bl -hang -width Ds
+.It Sy INT
+A signed integer that is up to eight bytes long
+.Pq Sy int64_t .
+.It Sy UINT
+An unsigned integer that is up to eight bytes long
+.Pq Sy uint64_t .
+.It Sy IP
+Either an IPv4 or IPv6 address in traditional string form.
+For example, 192.168.128.23 or 2001:470:8af4::1:1.
+IPv4 addresses may also be encoded as IPv4-mapped IPv6 addresses.
+.It Sy STRING
+A string of ASCII or UTF-8 encoded characters terminated with a
+.Sy NUL
+byte.
+The maximum string length, including the terminator, is currently
+256 bytes.
+.El
+.Ed
+.It Sy Permissions
+.Bd -filled -compact
+Each property has permissions associated with it, which indicate whether
+the system considers them read-only properties or read-write properties.
+A read-only property can never be updated once the device is created.
+This generally includes things like the overlay's encapsulation module.
+.Ed
+.It Sy Required
+.Bd -filled -compact
+This property indicates whether the property is required for the given
+plugin.
+If it is not specified during a call to
+.Sy dladm create-overlay ,
+then the overlay cannot be successfully created.
+Properties which have a
+.Sy default
+will use that value if one is not specified rather than cause the
+overlay creation to fail.
+.Ed
+.It Sy Current Value
+.Bd -filled -compact
+The current value of a property, if the property has a value set.
+Required properties always have a value set.
+.Ed
+.It Sy Default Value
+.Bd -filled -compact
+The default value is an optional part of a given property.
+If a property does define a default value, then it will be used when an
+overlay is created and no other value is given.
+.Ed
+.It Sy Value ranges
+.Bd -filled -compact
+Value ranges are an optional part of a given property.
+They indicate a range or set of values that are valid and may be set for
+a property.
+A property may not declare such a range as it may be impractical or
+unknown.
+For example, most properties based on IP addresses will not
+declare a range.
+.Ed
+.El
+.Pp
+The following sections describe both the modules and the properties that
+exist for each module, noting their name, type, permissions, whether or
+not they are required, and if there is a default value.
+In addition, the effects of each property will be described.
+.Ss Encapsulation Plugins
+.Bl -hang -width Ds
+.It Sy vxlan
+The
+.Sy vxlan
+module is a UDP based encapsulation method.
+It takes a frame that would be put on the wire, wraps it up in a VXLAN
+header and places it in a UDP packet that gets sent out on the
+underlying network.
+For more details about the specific format of the VXLAN header, see
+.Xr vxlan 7P .
+.Pp
+The
+.Sy vxlan
+module requires both an
+.Sy IP address
+and
+.Sy port
+to address it.
+It has a 24-bit virtual network ID space, allowing for
+virtual network identifiers that range from
+.Sy 0
+-
+.Sy 16777215 .
+.Pp
+The
+.Sy vxlan
+module has the following properties:
+.Bl -hang -width Ds
+.It Sy vxlan/listen_ip
+.Bd -filled -compact
+Type:
+.Sy IP |
+Permissions:
+.Sy Read/Write |
+.Sy Required
+.Ed
+.Bd -filled
+The
+.Sy vxlan/listen_ip
+property determines the IP address that the system will accept VXLAN
+encapsulated packets on for this overlay.
+.Ed
+.It Sy vxlan/listen_port
+.Bd -filled -compact
+Type:
+.Sy UINT |
+Permissions:
+.Sy Read/Write |
+.Sy Required
+.Ed
+.Bd -filled -compact
+Default Value:
+.Sy 4789 |
+Range:
+.Sy 0 - 65535
+.Ed
+.Bd -filled
+The
+.Sy vxlan/listen_port
+property determines the UDP port that the system will listen on for
+VXLAN traffic for this overlay.
+The default value is
+.Sy 4789 ,
+the IANA assigned port for VXLAN.
+.Ed
+.El
+.Pp
+The
+.Sy vxlan/listen_ip
+and
+.Sy vxlan/listen_port
+properties determine how the system will accept VXLAN encapsulated
+packets for this interface.
+It does not determine the interface that packets will be sent out over.
+Multiple overlays that all use VXLAN can share the same IP and port
+combination, as the virtual network identifier can be used to tell the
+different overlays apart.
+.El
+.Ss Search Plugins
+Because search plugins may support multiple destinations, they may have
+more properties listed than necessarily show up for a given overlay.
+For example, the
+.Sy direct
+plugin supports destinations that are identified by both an IP address
+and a port, or just an IP address.
+In cases where the device is created over an overlay that only uses an
+IP address for its destination, then it will not have the
+.Sy direct/dest_port
+property.
+.Bl -hang -width Ds
+.It Sy direct
+The
+.Sy direct
+plugin is a point to point module that can be used to create an overlay
+that forwards all non-local traffic to a single destination.
+It supports destinations that are a combination of an
+.Sy IP Address
+and a
+.Sy port .
+.Pp
+The
+.Sy direct
+plugin has the following properties:
+.Bl -hang -width Ds
+.It Sy direct/dest_ip
+.Bd -filled -compact
+Type:
+.Sy IP |
+Permissions:
+.Sy Read/Write |
+.Sy Required
+.Ed
+.Bd -filled
+The
+.Sy direct/dest_ip
+property indicates the IP address that all traffic will be sent out.
+Traffic will be sent out the corresponding interface based on
+traditional IP routing rules and the configuration of the networking
+stack of the global zone.
+.Ed
+.It Sy direct/dest_port
+.Bd -filled -compact
+Type:
+.Sy UINT |
+Permissions:
+.Sy Read/Write |
+.Sy Required
+.Ed
+.Bd -filled -compact
+Default Value:
+.Sy - |
+Range:
+.Sy 0 - 65535
+.Ed
+.Bd -filled
+The
+.Sy direct/dest_port
+property indicates the TCP or UDP port that all traffic will be directed
+to.
+.Ed
+.El
+.It Sy files
+The
+.Sy files
+plugin implements a
+.Sy dynamic
+plugin that specifies where traffic should be sent based on a file.
+It is a glorified version of /etc/ethers.
+The
+.Sy dynamic
+plugin does not support broadcast or multicast traffic, but it has
+support for proxy ARP, NDP, and DHCPv4.
+For the full details of the file format, see
+.Xr overlay_files 4 .
+.Pp
+The
+.Sy files
+plugin has the following property:
+.Bl -hang -width Ds
+.It Sy files/config
+.Bd -filled -compact
+Type:
+.Sy String |
+Permissions:
+.Sy Read/Write |
+.Sy Required
+.Ed
+.Bd -filled
+The
+.Sy files/config
+property specifies an absolute path to a file to read.
+The file is a JSON file that is formatted according to
+.Xr overlay_files 4 .
+.Ed
+.El
+.El
+.Ss General Properties
+Each overaly has the following properties which are used to give
+additional information about the system.
+None of these properties may be specified as part of a
+.Sy dladm create-overlay ,
+instead they come from other arguments or from internal parts of the
+system.
+.Bl -hang -width Ds
+.It Sy encap
+.Bd -filled -compact
+.Sy String |
+Permissions:
+.Sy Read Only
+.Ed
+.Bd -filled
+The
+.Sy encap
+property contains the name of the encapsulation module that's in use.
+.Ed
+.It Sy mtu
+.Bd -filled -compact
+.Sy UINT |
+Permissions:
+.Sy Read/Write
+.Ed
+.Bd -filled -compact
+Default Value:
+.Sy 1400 |
+Range:
+.Sy 576 - 9000
+.Ed
+.Bd -filled
+The
+.Sy mtu
+property describes the maximum transmission unit of the overlay.
+The default value is
+.Sy 1400
+bytes, which ensures that in a traditional deployment with an MTU of
+1500 bytes, the overhead that is added from encapsulation is all
+accounted for.
+It is the administrator's responsibility to ensure that
+the device's MTU and the encapsulation overhead does not exceed that of
+the interfaces that the encapsulated traffic will be sent out of.
+.Pp
+To modify the
+.Sy mtu
+property, use
+.Sy dladm set-linkprop .
+.Ed
+.It Sy search
+.Bd -filled -compact
+.Sy String |
+Permissions:
+.Sy Read Only
+.Ed
+.Bd -filled
+The
+.Sy search
+property contains the name of the search plugin that's in use.
+.Ed
+.It Sy varpd/id
+.Bd -filled -compact
+.Sy String |
+Permissions:
+.Sy Read Only
+.Ed
+.Bd -filled
+The
+.Sy varpd/id
+property indicates the identifier which the
+.Sy varpd
+service uses for this overlay.
+.Ed
+.It Sy vnetid
+.Bd -filled -compact
+.Sy UINT |
+Permissions:
+.Sy Read/Write
+.Ed
+.Bd -filled
+The
+.Sy vnetid
+property has the virtual network identifier that belongs to this overlay.
+The valid range for the virtual network identifier depends on the
+encapsulation engine.
+.Ed
+.El
+.Sh FMA INTEGRATION
+Overlay devices are wired into FMA, the illumos fault management
+architecture, and generates error reports depending on the
+.Sy search
+plugin in use.
+Due to limitations in FMA today, when a single overlay
+enters a degraded state, meaning that it cannot properly perform look
+ups or another error occurred, then it degrades the overall
+.Sy overlay
+pseudo-device driver.
+.Pp
+For more fine-grained information about which overlay is actually in a
+.Em degraded
+state, one should run
+.Sy dladm show-overlay -f .
+In addition, for each overlay in a degraded state a more useful
+diagnostic message is provided which describes the reason that caused
+this overlay to enter into a degraded state.
+.Pp
+The overlay driver is self-healing.
+If the problem corrects itself on its own, it will clear the fault on
+the corresponding device.
+.Sh SEE ALSO
+.Xr dladm 1M ,
+.Xr overlay_files 4 ,
+.Xr vxlan 7P
diff --git a/usr/src/man/man5/privileges.5 b/usr/src/man/man5/privileges.5
index 9ca40fadad..0f3f28d8c1 100644
--- a/usr/src/man/man5/privileges.5
+++ b/usr/src/man/man5/privileges.5
@@ -1,6 +1,6 @@
 '\" te
 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
-.\" Copyright 2015, Joyent, Inc. All Rights Reserved.
+.\" Copyright 2016, Joyent, Inc. All Rights Reserved.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
 .\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
@@ -307,6 +307,16 @@ Allow a process to perform privileged mappings through a graphics device.
 .sp
 .ne 2
 .na
+\fB\fBPRIV_HYPRLOFS_CONTROL\fR\fR
+.ad
+.sp .6
+.RS 4n
+Allow a process to perform hyprlofs name space management.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBPRIV_IPC_DAC_READ\fR\fR
 .ad
 .sp .6
@@ -475,7 +485,7 @@ Allow a process to change its root directory.
 .ad
 .sp .6
 .RS 4n
-Allow a process to use high resolution timers.
+Allow a process to use high resolution timers with very small time values.
 .RE
 
 .sp
@@ -697,6 +707,16 @@ Allow a process to configure a system's datalink interfaces.
 .sp
 .ne 2
 .na
+\fB\fBPRIV_SYS_FS_IMPORT\fR\fR
+.ad
+.sp .6
+.RS 4n
+Allow a process to import a potentially untrusted file system (e.g. ZFS recv).
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBPRIV_SYS_IP_CONFIG\fR\fR
 .ad
 .sp .6
diff --git a/usr/src/man/man5/resource_controls.5 b/usr/src/man/man5/resource_controls.5
index fe22484bcc..8dba24173f 100644
--- a/usr/src/man/man5/resource_controls.5
+++ b/usr/src/man/man5/resource_controls.5
@@ -1,15 +1,17 @@
 '\" te
 .\" Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved.
+.\" Copyright 2017, Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH RESOURCE_CONTROLS 5 "April 9, 2016"
+.TH RESOURCE_CONTROLS 5 "April 28, 2017"
 .SH NAME
-resource_controls \- resource controls available through project database
+resource_controls \- resource controls available through projects and zones
 .SH DESCRIPTION
 .LP
-The resource controls facility is configured through the project database. See
-\fBproject\fR(4). You can set and modify resource controls through the
+For projects the resource controls facility is configured through the project
+database.  See \fBproject\fR(4). For zones, resource controls are configured
+through \fBzonecfg\fR(1M).  You can set and modify resource controls through the
 following utilities:
 .RS +4
 .TP
@@ -35,6 +37,12 @@ following utilities:
 .el o
 \fBrctladm\fR(1M)
 .RE
+.RS +4
+.TP
+.ie t \(bu
+.el o
+\fBzonecfg\fR(1M)
+.RE
 .sp
 .LP
 In a program, you use \fBsetrctl\fR(2) to set resource control values.
@@ -115,6 +123,21 @@ number of bytes.
 .sp
 .ne 2
 .na
+\fB\fBprocess.max-locked-memory\fR\fR
+.ad
+.sp .6
+.RS 4n
+Total amount of physical memory that can be locked by this process, expressed
+as a number of bytes. This limit is not enforced for a process with the
+\fB\fBPRIV_PROC_LOCK_MEMORY\fR\fR privilege. Because the ability to lock memory
+is controlled by the \fB\fBPRIV_PROC_LOCK_MEMORY\fR\fR privilege within native
+zones, this resource control is only useful within branded zones which might
+support a different policy for locking memory.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBprocess.max-msg-messages\fR\fR
 .ad
 .sp .6
@@ -282,6 +305,19 @@ Maximum allowable number of event ports, expressed as an integer.
 .sp
 .ne 2
 .na
+\fB\fBproject.max-processes\fR\fR
+.ad
+.sp .6
+.RS 4n
+Maximum number of processes that can be active in a project. This rctl is
+similar to \fBproject.max-lwps\fR, except that zombie processes are included.
+This rctl prevents process-slot exhaustion which can occur due to an excessive
+number of zombies. Expressed as an integer.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBproject.max-sem-ids\fR\fR
 .ad
 .sp .6
@@ -370,6 +406,33 @@ The following zone-wide resource controls are available:
 .sp
 .ne 2
 .na
+\fB\fBzone.cpu-baseline\fR\fR
+.ad
+.sp .6
+.RS 4n
+Sets a baseline amount of CPU time that a zone can use before it is considered
+to be bursting. The unit used is the percentage of a single CPU that is being
+used by all user threads in a zone. The value should be less than the
+\fBzone.cpu-cap\fR rctl value and is expressed as an integer.
+This resource control does not support the \fBsyslog\fR action.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBzone.cpu-burst-time\fR\fR
+.ad
+.sp .6
+.RS 4n
+Sets the number of seconds that a zone can exceed the \fBzone.cpu-baseline\fR
+rctl value before being cpu-capped down to the \fBzone.cpu-baseline\fR.
+A value of 0 means that \fBzone.cpu-baseline\fR can be exceeded indefinitely.
+This resource control does not support the \fBsyslog\fR action.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBzone.cpu-cap\fR\fR
 .ad
 .sp .6
@@ -388,7 +451,7 @@ not support the \fBsyslog\fR action.
 .ad
 .sp .6
 .RS 4n
-Sets a limit on the number of fair share scheduler (FSS) CPU shares for a zone.
+Sets a value on the number of fair share scheduler (FSS) CPU shares for a zone.
 CPU shares are first allocated to the zone, and then further subdivided among
 projects within the zone as specified in the \fBproject.cpu-shares\fR entries.
 Expressed as an integer. This resource control does not support the
@@ -408,14 +471,25 @@ Total amount of physical locked memory available to a zone.
 .sp
 .ne 2
 .na
+\fB\fBzone.max-lofi\fR\fR
+.ad
+.sp .6
+.RS 4n
+Sets a limit on the number of \fBLOFI\fR(7D) devices that can be created in a
+zone. Expressed as an integer. This resource control does not support the
+\fBsyslog\fR action.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBzone.max-lwps\fR\fR
 .ad
 .sp .6
 .RS 4n
-Enhances resource isolation by preventing too many LWPs in one zone from
-affecting other zones. A zone's total LWPs can be further subdivided among
-projects within the zone within the zone by using \fBproject.max-lwps\fR
-entries. Expressed as an integer.
+Sets a limit on how many LWPs can be active in a zone. A zone's total LWPs
+can be further subdivided among projects within the zone within the zone by
+using \fBproject.max-lwps\fR entries. Expressed as an integer.
 .RE
 
 .sp
@@ -432,6 +506,33 @@ integer.
 .sp
 .ne 2
 .na
+\fB\fBzone.max-physical-memory\fR\fR
+.ad
+.sp .6
+.RS 4n
+Sets a limit on the amount of physical memory (RSS) that can be used by a zone
+before resident pages start being forcibly paged out.  The unit used is bytes.
+Expressed as an integer.  This resource control does not support the
+\fBsyslog\fR action.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fBzone.max-processes\fR\fR
+.ad
+.sp .6
+.RS 4n
+Maximum number of processes that can be active in a zone. This rctl is
+similar to \fBzone.max-lwps\fR, except that zombie processes are included.
+This rctl prevents process-slot exhaustion which can occur due to an excessive
+number of zombies. This rctl can be further subdivided among projects within
+the zone using \fBproject.max-processes\fR. Expressed as an integer.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBzone.max-sem-ids\fR\fR
 .ad
 .sp .6
@@ -473,6 +574,18 @@ mappings and \fBtmpfs\fR mounts for this zone.
 .RE
 
 .sp
+.ne 2
+.na
+\fB\fBzone.zfs-io-priority\fR\fR
+.ad
+.sp .6
+.RS 4n
+Sets a value for the \fBzfs\fR(1M) I/O priority for a zone. This is used as
+one of the inputs to determine if a zone's I/O should be throttled.  Expressed
+as an integer. This resource control does not support the \fBsyslog\fR action.
+.RE
+
+.sp
 .LP
 See \fBzones\fR(5).
 .SS "Units Used in Resource Controls"
@@ -985,7 +1098,7 @@ Interface Stability	Evolving
 \fBprctl\fR(1), \fBpooladm\fR(1M), \fBpoolcfg\fR(1M), \fBprojadd\fR(1M),
 \fBprojmod\fR(1M), \fBrctladm\fR(1M), \fBsetrctl\fR(2),
 \fBrctlblk_set_value\fR(3C), \fBlibpool\fR(3LIB), \fBproject\fR(4),
-\fBattributes\fR(5), \fBFSS\fR(7)
+\fBattributes\fR(5), \fBprivileges\fR(5), \fBzones\fR(5), \fBFSS\fR(7)
 .sp
 .LP
 \fISystem Administration Guide:  Virtualization Using the Solaris Operating
diff --git a/usr/src/man/man7/Makefile b/usr/src/man/man7/Makefile
index 929693a927..c53357d29a 100644
--- a/usr/src/man/man7/Makefile
+++ b/usr/src/man/man7/Makefile
@@ -12,6 +12,7 @@
 #
 # Copyright 2011, Richard Lowe
 # Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+# Copyright 2017 Joyent, Inc.
 #
 
 include		$(SRC)/Makefile.master
@@ -22,7 +23,8 @@ MANSECT= 	7
 MANFILES= 	FSS.7	\
 		Intro.7	\
 		cpr.7	\
-		ibmf.7
+		ibmf.7	\
+		swap.7
 
 MANLINKS=	intro.7
 
diff --git a/usr/src/man/man7/swap.7 b/usr/src/man/man7/swap.7
new file mode 100644
index 0000000000..d060e993a9
--- /dev/null
+++ b/usr/src/man/man7/swap.7
@@ -0,0 +1,92 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2017, Joyent, Inc.
+.\"
+.Dd Aug 14, 2017
+.Dt SWAP 7
+.Os
+.Sh NAME
+.Nm swap
+.Nd swap space
+.Sh DESCRIPTION
+The operating system uses demand paging as the primary mechanism to implement
+virtual memory.
+The system can also use traditional swapping, wherein an entire process state
+is moved between physical memory and swap space on disk, but it is very rare
+for the system to actually swap an entire process out to disk.
+A system which is swapping does not have enough enough physical memory to
+support the workload on the machine.
+In this case, work should be reduced or more memory added.
+.Pp
+Given that the system rarely, if ever, swaps, but still has swap space
+configured, the question arises as to what this space is for?
+.Pp
+In a demand paged virtual memory system, every page mapped by a process is
+backed by some object.
+For the actual program code used by the process, the backing objects are the
+underlying files in the filesystem for the program's binary, and any
+dynamically linked libraries.
+The portions of a process that are not backed by a named file, including its
+stack and its heap, are called anonymous memory.
+The system uses the swap space as the backing store for these pages.
+When the system determines that it needs to page out one of the anonymous pages,
+the swap space is where that page is written.
+.Pp
+Unlike some other operating systems, illumos reserves the backing storage
+space for anonymous memory at the time of allocation.
+For example, if a process asks for more heap space, the total size of the
+swap allocation that may be required to store the new pages if they need to
+be paged out is reserved at that time.
+This does not mean that anything is written to the swap space, but simply that
+the space is reserved for the entire allocation.
+Thus, a process will always get a correct error from the
+.Xr sbrk 2
+system call if swap space is unavailable.
+Some other operating systems don't allocate backing store for anonymous memory
+until it is used, so the error handling when space is not available can be
+complex or problematic on those systems.
+.Pp
+The
+.Xr vmstat 1m
+command can be used to monitor swap and paging activity.
+The
+.Xr pmap 1
+command can be used to inspect all of the mappings in a process address space,
+and their backing objects.
+The
+.Xr swap 1m
+command can be used to monitor, add and remove swap space.
+.Pp
+The operating system provides the
+.Ql zone.max-swap
+resource control to limit the amount of
+anonymous memory used by all of the processes within a zone.
+This resource control can also be configured under the
+.Xr capped-memory 2
+setting for a zone.
+See the
+.Xr prctl 1
+and
+.Xr zonecfg 1m
+man pages for information on setting this limit.
+The zone's usage against this resource control can be seen using the
+.Ql swapresv_zone_{zoneid}
+kstat.
+.Sh SEE ALSO
+.Xr pmap 1 ,
+.Xr prctl 1 ,
+.Xr kstat 1m ,
+.Xr swap 1m ,
+.Xr vmstat 1m ,
+.Xr zonecfg 1m ,
+.Xr sbrk 2 ,
+.Xr resource_controls 5
diff --git a/usr/src/man/man7d/Makefile b/usr/src/man/man7d/Makefile
index f27ddf6131..5775f8a754 100644
--- a/usr/src/man/man7d/Makefile
+++ b/usr/src/man/man7d/Makefile
@@ -142,11 +142,13 @@ _MANFILES=	aac.7d		\
 		virtualkm.7d	\
 		vni.7d		\
 		vr.7d		\
+		vnd.7d		\
 		wscons.7d	\
 		xge.7d		\
 		yge.7d		\
 		zcons.7d	\
-		zero.7d
+		zero.7d		\
+		zfd.7d
 
 sparc_MANFILES=	audiocs.7d	\
 		bbc_beep.7d	\
diff --git a/usr/src/man/man7d/cpuid.7d b/usr/src/man/man7d/cpuid.7d
index cc522b1969..f24f73ed40 100644
--- a/usr/src/man/man7d/cpuid.7d
+++ b/usr/src/man/man7d/cpuid.7d
@@ -1,5 +1,6 @@
 '\" te
 .\" Copyright (c) 2004, Sun Microsystems, Inc.  All Rights Reserved
+.\" Copyright 2015, Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
@@ -43,6 +44,10 @@ the years).
 See the processor manufacturers documentation for further information about the
 syntax and semantics of the wide variety of information available from this
 instruction.
+.LP
+Some systems can be configured to limit the cpuid opcodes which are accessible.
+While illumos handles this condition, other software may malfunction when such
+limits are enabled.  Those settings are typically manipulated in the BIOS.
 .SH EXAMPLE
 .LP
 This example allows you to determine if the current x86 processor supports
diff --git a/usr/src/man/man7d/i40e.7d b/usr/src/man/man7d/i40e.7d
index 2d8a2da45b..f025fba01a 100644
--- a/usr/src/man/man7d/i40e.7d
+++ b/usr/src/man/man7d/i40e.7d
@@ -9,9 +9,9 @@
 .\" http://www.illumos.org/license/CDDL.
 .\"
 .\"
-.\" Copyright (c) 2017 Joyent, Inc.
+.\" Copyright (c) 2018 Joyent, Inc.
 .\"
-.Dd September 8, 2017
+.Dd May 23, 2018
 .Dt I40E 7D
 .Os
 .Sh NAME
@@ -273,6 +273,22 @@ binding.
 By setting this property to its maximum, all frames will be processed by copying
 the frame.
 .Ed
+.It Sy tx_lso_enable
+.Bd -filled -compact
+Minimum:
+.Sy 0 |
+Maximum:
+.Sy 1
+.Ed
+.Bd -filled
+The
+.Sy tx_lso_enable
+property controls whether or not the device enables support for Large Segment
+Offloand (LSO) when transmitting packets.
+The default is to always enable support for this.
+Turning it off will decrease throughput when transmitting packets, but should
+be done if a hardware bug is suspected.
+.Ed
 .El
 .Sh ARCHITECTURE
 The
diff --git a/usr/src/man/man7d/vnd.7d b/usr/src/man/man7d/vnd.7d
new file mode 100644
index 0000000000..d311c4dc08
--- /dev/null
+++ b/usr/src/man/man7d/vnd.7d
@@ -0,0 +1,118 @@
+'\" te
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+.\"
+.TH VND 7D "Feb 11, 2014"
+.SH NAME
+vnd \- virtual layer two network driver
+
+.SH SYNOPSIS
+.nf
+.LP
+/dev/vnd/ctl
+.LP
+/dev/vnd/*
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+The vnd driver provides support for a layer two datapath in an
+analogous way that IP(7P) provides a support for an IP-based layer
+three datapath. Both devices operate exclusively on datalinks. A
+datalink that has been plumbed up with IP via ifconfig(1M) or
+ipadm(1M) cannot be used with vnd or vice-versa.
+.sp
+.LP
+The vnd driver supports and takes advantage of the the following
+illumos features:
+.RS
+.sp
+.LP
+Supports dld/dls feature negotation of GLDv3 features, such
+as direct calls, flow control, checksum offloading, and more.
+.sp
+.LP
+All IP and IPv6 based traffic is sent through ipfilter(5),
+allowing packet filtering.
+.sp
+.LP
+Better control over vectored reads and writes in a frame-centric manner
+through framed I/O. See libvnd(3LIB) for more information on these
+interfaces.
+.RE
+.sp
+.LP
+The vnd driver exposes two different kinds of device nodes. The first is
+a self-cloning control node which can be used to create vnd devices on
+top of datalinks. Those devices can optionally be bound into the file
+system namespace under /dev/vnd. Control operations on the control node
+or named devices are private to the implementation. Instead,
+libvnd(3LIB) provides a stable interfaces for using, creating, and
+manipulating vnd devices.
+.sp
+.SH FILES
+.sp
+.ne 2
+.na
+/dev/vnd/ctl
+.ad
+.RS 16n
+vnd self-cloning control node
+.RE
+
+.sp
+.ne 2
+.na
+/dev/vnd/%link
+.ad
+.RS 16n
+Character device that corresponds to the vnd device of the given
+name (%link). A given device will appear for each actively linked device
+in the current zone.
+.RE
+
+.sp
+.ne 2
+.na
+/dev/vnd/zone/%zone/%link
+.ad
+.RS 16n
+These are character devices that correspond to the vnd device of
+the given name (%link). They are organized based on the zone that they
+appear in. Thus if a zone named foo has a vnd device named
+bar, then the global zone will have the file
+/dev/vnd/zone/foo/bar. Note, these only occur in the global zone.
+.RE
+
+.SH ATTRIBUTES
+.sp
+.LP
+See attributes(5) for descriptions of the following attributes:
+.sp
+
+.sp
+.TS
+box;
+c | c
+l | l .
+ATTRIBUTE TYPE	ATTRIBUTE VALUE
+_
+Interface Stability	Evolving
+.TE
+
+.SH SEE ALSO
+.sp
+.LP
+dladm(1M), ipflter(5), libvnd(3LIB), vndadm(1M),
+vndstat(1)
diff --git a/usr/src/man/man7d/zfd.7d b/usr/src/man/man7d/zfd.7d
new file mode 100644
index 0000000000..cbdc869819
--- /dev/null
+++ b/usr/src/man/man7d/zfd.7d
@@ -0,0 +1,81 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2015, Joyent, Inc. All rights reserved.
+.\"
+.Dd "Oct 16, 2015"
+.Dt ZFD 7D
+.Os
+.Sh NAME
+.Nm zfd
+.Nd Zone file descriptor driver
+.Sh DESCRIPTION
+The
+.Nm zfd
+character driver exports devices into the zone which can be used by a
+a standalone process within the zone as
+.Vt stdin ,
+.Vt stdout ,
+and
+.Vt stderr .
+The
+.Nm zfd
+driver behaves in a similar manner as the
+.Nm zcons(7D)
+device.
+Inside a zone, the slave side devices appear as
+.Nm /dev/zfd/[0-4] .
+.sp
+The zone's zfd device configuration is driven by
+.Nm zoneadmd
+and a zone attribute
+.Nm zlog-mode
+which is somewhat of a misnomer since its purpose has evolved.
+The attribute can have a variety of values, but the lowest two positions
+in the value string are used to control how many zfd devices are created
+inside the zone and if the primary stream is a tty.
+.sp
+.Dl --
+.Dl -n
+.Dl t-
+.Dl tn
+.sp
+With the
+.Nm t
+flag set,
+.Vt stdin ,
+.Vt stdout ,
+and
+.Vt stderr ,
+are multiplexed onto a single full-duplex stream which is configured as a tty.
+That is,
+.Nm ptem ,
+.Nm ldterm
+and
+.Nm ttycompat
+are autopushed onto the stream when the slave side is opened.
+There is only a single zfd device (0) needed for the primary stream.
+.sp
+When the
+.Nm n
+flag is set, it is assumed that output logging will be done within the zone
+itself.
+In this configuration 1 or 2 additional zfd devices, depending on tty mode
+.Nm ( t
+flag), are created within the zone.
+An application can then configure the zfd streams driver into a multiplexer.
+Output from the stdout/stderr zfd(s) will be teed into the correspond
+logging zfd(s) within the zone.
+.Sh SEE ALSO
+.Xr zlogin 1 ,
+.Xr zoneadmd 1M ,
+.Xr zonecfg 1M ,
+.Xr zcons 7D
diff --git a/usr/src/man/man7fs/Makefile b/usr/src/man/man7fs/Makefile
index 187bacff78..57aa608a65 100644
--- a/usr/src/man/man7fs/Makefile
+++ b/usr/src/man/man7fs/Makefile
@@ -26,7 +26,9 @@ MANFILES= 	bootfs.7fs	\
 	 	devfs.7fs	\
 		fd.7fs		\
 	 	hsfs.7fs	\
+	 	hyprlofs.7fs	\
 	 	lofs.7fs	\
+	 	lxproc.7fs	\
 	 	objfs.7fs	\
 	 	pcfs.7fs	\
 	 	sharefs.7fs	\
diff --git a/usr/src/man/man7fs/hyprlofs.7fs b/usr/src/man/man7fs/hyprlofs.7fs
new file mode 100644
index 0000000000..8655791193
--- /dev/null
+++ b/usr/src/man/man7fs/hyprlofs.7fs
@@ -0,0 +1,62 @@
+'\" te
+.\" Copyright (c) 2012, Joyent, Inc.
+.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
+.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
+.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
+.TH HYPRLOFS 7FS "March 7, 2012"
+.SH NAME
+hyprlofs \- fast name space virtual file system
+.SH SYNOPSIS
+.LP
+.nf
+#include <sys/fs/hyprlofs.h>
+
+\fB\fR\fBmount\fR (\fB\fR\fIspecial\fR, \fB\fR\fIdirectory\fR, \fB\fR\fIMS_DATA\fR, \fB\fR\fI"hyprlofs"\fR, \fB\fR\fINULL\fR, \fB\fR\fI0\fR);
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+\fBhyprlofs\fR is a hybrid file system combining features from
+\fBtmpfs(7FS)\fR and \fBlofs(7FS)\fR.
+As with \fBlofs\fR, the \fBhyprlofs\fR file system allows new, virtual file
+systems to be created which provide access to existing files using alternate
+pathnames.  In addition, the files themselves may have alternate names and
+paths within the mount.
+Unlike \fBlofs\fR, files cannot be created and backing files cannot be removed.
+The name space is completely managed through ioctls on the mount.
+Entries in the name space are not mounts and thus, they will not appear in the
+mnttab.  The file system is designed to provide a very fast name space to the
+backing files.  The name space can be modified very quickly through the ioctl
+interface.
+.sp
+.LP
+\fBhyprlofs\fR file systems can be mounted with the command:
+.sp
+.in +2
+.nf
+\fBmount \fR\fB-F\fR\fB hyprlofs swap \fR\fIdirectory\fR
+.fi
+.in -2
+
+.sp
+.LP
+The name space used by \fBhyprlofs\fR exists only in-memory so it will consume
+a small amount of the system's virtual memory.  The files themselves are backed
+by the original file as with \fBlofs\fR.
+
+.SH SEE ALSO
+.sp
+.LP
+\fBdf\fR(1M), \fBmount\fR(1M), \fBswap\fR(1M),
+\fBmount\fR(2), \fBumount\fR(2)
+.sp
+.LP
+\fISystem Administration Guide: Basic Administration\fR
+.SH DIAGNOSTICS
+.sp
+.LP
+\fBdf\fR(1M) output is of limited accuracy since
+the space available to \fBhyprlofs\fR is dependent on the swap
+space demands of the entire system and the files in the name space are not
+included.
diff --git a/usr/src/man/man7fs/lxproc.7fs b/usr/src/man/man7fs/lxproc.7fs
new file mode 100644
index 0000000000..7ef10ce343
--- /dev/null
+++ b/usr/src/man/man7fs/lxproc.7fs
@@ -0,0 +1,115 @@
+'\" te
+.\" Copyright (c) 2012, Joyent, Inc.
+.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
+.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
+.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
+.TH LXPROC 7FS "April 25, 2012"
+.SH NAME
+lxproc \- a loosely Linux-compatible /proc
+.SH SYNOPSIS
+.LP
+.nf
+\fB\fR\fBmount\fR (\fB\fR\fI"lxproc"\fR, \fB\fR\fIdirectory\fR, \fB\fR\fIMS_DATA\fR, \fB\fR\fI"lxproc"\fR, \fB\fR\fINULL\fR, \fB\fR\fI0\fR);
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+\fBlxproc\fR is an implementation of the \fB/proc\fR filesystem that
+loosely matches the Linux semantics of providing human-readable text files
+that correspond to elements of the system.
+As with both \fBproc\fR(4) and Linux \fB/proc\fR, \fBlxproc\fR makes available
+a directory for every process, with each directory containing a number
+of files; like Linux \fB/proc\fR but unlike \fBproc\fR(4), \fBlxproc\fR also
+makes available a number of files related to system-wide information.
+To ascertain the meaning and structure of the files provided via
+\fBlxproc\fR, users should consult the Linux documentation.
+.sp
+.LP
+The \fBlxproc\fR compatibility layer is
+provided only as a best-effort for simple Linux \fB/proc\fR readers; it
+is not intended to exactly mimic Linux semantics and nor does it attempt to
+somehow fool a consumer into believing that it is operating within a Linux
+environment. As such, \fBlxproc\fR should only be used by Linux-specific
+programs that are willing to trade precision in understanding the
+system in return for Linux compatibility.  To programmatically understand
+the system precisely and in terms of its native constructs,
+one should not use \fBlxproc\fR, but rather \fBproc\fR(4) or
+\fBkstat\fR(3KSTAT).
+To understand
+a process or group of processes from either a shell script or the command line,
+one should not use \fBlxproc\fR, but rather \fBproc\fR(4)-based tools like
+\fBprstat\fR(1M),
+\fBpfiles\fR(1),
+\fBpargs\fR(1),
+\fBpmap\fR(1),
+\fBptree\fR(1),
+\fBplimit\fR(1),
+\fBpflags\fR(1),
+\fBpcred\fR(1),
+\fBpstack\fR(1),
+\fBpldd\fR(1),
+\fBpsig\fR(1),
+or
+\fBpwdx\fR(1).
+To understand system-wide constructs from either a shell script or the
+command line, one should not use \fBlxproc\fR, but rather
+\fBkstat\fR(3KSTAT)-based tools like
+\fBkstat\fR(1M),
+\fBmpstat\fR(1M),
+\fBiostat\fR(1M),
+\fBnetstat\fR(1M) or
+\fBpsrinfo\fR(1M).
+.sp
+.LP
+Like \fB/proc\fR, \fBlxproc\fR can be mounted on any mount point, but the
+preferred mount point is \fB/system/lxproc\fR; if a zone brand elects to
+mount it by default, this will (or should) generally be the mount point.
+.sp
+.LP
+\fBlxproc\fR can be mounted with the command:
+.sp
+.in +2
+.nf
+\fBmount \fR\fB-F\fR\fB lxproc lxproc \fR\fIdirectory\fR
+.fi
+.in -2
+
+.SH SEE ALSO
+.sp
+.LP
+\fBdf\fR(1M),
+\fBiostat\fR(1M),
+\fBkstat\fR(1M),
+\fBmpstat\fR(1M),
+\fBmount\fR(1M),
+\fBnetstat\fR(1M),
+\fBpargs\fR(1),
+\fBpcred\fR(1),
+\fBpfiles\fR(1),
+\fBpflags\fR(1),
+\fBpldd\fR(1),
+\fBplimit\fR(1),
+\fBpmap\fR(1),
+\fBprstat\fR(1M),
+\fBpsig\fR(1),
+\fBpsrinfo\fR(1M),
+\fBpstack\fR(1),
+\fBptree\fR(1),
+\fBpwdx\fR(1),
+\fBmount\fR(2), \fBumount\fR(2), \fBkstat\fR(3KSTAT), \fBproc\fR(4),
+\fBkstat\fR(9S)
+
+.SH NOTES
+.sp
+.LP
+When choosing between offering
+Linux compatibility and telling the truth, \fBlxproc\fR emphatically picks
+the truth.  A particular glaring example of this is the Linux notion of
+"tasks" (that is, threads), which -- due to historical misadventures on
+Linux -- allocate their identifiers from the process identifier space.
+(That is, each thread has in effect a pid.)  Some Linux \fB/proc\fR readers
+have come to depend on this attribute, and become confused when threads
+appear with proper identifiers, so \fBlxproc\fR simply opts for the pre-2.6
+behavior, and does not present the tasks directory at all.
+
diff --git a/usr/src/man/man7i/uscsi.7i b/usr/src/man/man7i/uscsi.7i
index 3247f53cc1..f246590ca4 100644
--- a/usr/src/man/man7i/uscsi.7i
+++ b/usr/src/man/man7i/uscsi.7i
@@ -1,9 +1,10 @@
 '\" te
 .\" Copyright (c) 2007 by Sun Microsystems, Inc.  All rights reserved.
+.\" Copyright 2016 Joyent, Inc.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH USCSI 7I "May 29, 2007"
+.TH USCSI 7I "Sep 23, 2016"
 .SH NAME
 uscsi \- user SCSI command interface
 .SH SYNOPSIS
@@ -15,7 +16,6 @@ uscsi \- user SCSI command interface
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBuscsi\fR command is very powerful and somewhat dangerous; therefore it
 has some permission restrictions. See \fBWARNINGS\fR for more details.
@@ -349,8 +349,13 @@ See the \fBscsi_pkt\fR(9S) flag \fBFLAG_RENEGOTIATE_WIDE_SYNC\fR for more
 information.
 .RE
 
+The \fBuscsi_xfer_t\fR is a type definition that corresponds to a 64-bit
+unsigned integer. It should be used for the \fBUSCSIMAXXFER\fR ioctls. This is
+used for determining the maximum transfer size that can be performed in a single
+\fBUSCSICMD\fR ioctl. If the SCSI request is larger than the specified size,
+then it may not work, depending on the hardware platform.
+
 .SH IOCTLS
-.sp
 .LP
 The \fBioctl\fR supported by drivers providing the \fBuscsi\fR interface is:
 .sp
@@ -371,10 +376,24 @@ status, and Request Sense is enabled, the sense data itself is returned in
 Sense data transfer.
 .RE
 
-.SH ERRORS
 .sp
 .ne 2
 .na
+.B USCSIMAXXFER
+.ad
+.RS 12n
+The argument is a pointer to a \fBuscsi_xfer_t\fR value. The maximum transfer
+size that can be used with the \fBUSCSICMD\fR ioctl for the current device will
+be returned in the \fBuscsi_xfer_t\fR.
+.sp
+.LP
+Not all devices which support the \fBUSCSICMD\fR ioctl also support the
+\fBUSCSIMAXXFER\fR ioctl.
+.RE
+
+.SH ERRORS
+.ne 2
+.na
 \fB\fBEINVAL\fR\fR
 .ad
 .RS 10n
@@ -396,7 +415,8 @@ An error occurred during the execution of the command.
 \fB\fBEPERM\fR\fR
 .ad
 .RS 10n
-A process without root credentials tried to execute the \fBUSCSICMD\fR ioctl.
+A process without root credentials tried to execute the \fBUSCSICMD\fR or
+\fRUSCSIMAXXFER\fR ioctl.
 .RE
 
 .sp
@@ -405,12 +425,11 @@ A process without root credentials tried to execute the \fBUSCSICMD\fR ioctl.
 \fB\fBEFAULT\fR\fR
 .ad
 .RS 10n
-The \fBuscsi_cmd\fR itself, the \fBuscsi_cdb\fR, the \fBuscsi_buf\fR, or the
-\fBuscsi_rqbuf\fR point to an invalid address.
+The \fBuscsi_cmd\fR itself, the \fBuscsi_cdb\fR, the \fBuscsi_buf\fR, the
+\fBuscsi_rqbuf\fR, or the \fBuscsi_xfer_t\fR point to an invalid address.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -426,14 +445,12 @@ Interface Stability 	Committed
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBioctl\fR(2), \fBattributes\fR(5), \fBsd\fR(7D), \fBst\fR(7D)
 .sp
 .LP
 \fIANSI Small Computer System Interface-2 (SCSI-2)\fR
 .SH WARNINGS
-.sp
 .LP
 The \fBuscsi\fR command is very powerful, but somewhat dangerous, and so its
 use is restricted to processes running as root, regardless of the file
@@ -450,7 +467,8 @@ number is used to send the command.
 The \fBuscsi\fR interface is not recommended for very large data transfers
 (typically more than 16MB). If the requested transfer size exceeds the maximum
 transfer size of the DMA engine, it will not be broken up into multiple
-transfers and DMA errors may result.
+transfers and DMA errors may result. The \fBUSCSIMAXXFER\fR ioctl can be used
+to determine the maximum transfer size.
 .sp
 .LP
 The \fBUSCSICMD\fR ioctl associates a \fBstruct uscsi_cmd\fR with a device by
diff --git a/usr/src/man/man7m/Makefile b/usr/src/man/man7m/Makefile
index e32c5aea3c..42ba9d33af 100644
--- a/usr/src/man/man7m/Makefile
+++ b/usr/src/man/man7m/Makefile
@@ -12,6 +12,7 @@
 #
 # Copyright 2011, Richard Lowe
 # Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+# Copyright 2015 Joyent, Inc.
 #
 
 include		$(SRC)/Makefile.master
@@ -20,6 +21,7 @@ MANSECT= 	7m
 
 _MANFILES = 	bufmod.7m	\
 		connld.7m	\
+		datafilt.7m	\
 		ldterm.7m	\
 		pckt.7m		\
 		pfmod.7m	\
diff --git a/usr/src/man/man7m/datafilt.7m b/usr/src/man/man7m/datafilt.7m
new file mode 100644
index 0000000000..f840e389c8
--- /dev/null
+++ b/usr/src/man/man7m/datafilt.7m
@@ -0,0 +1,48 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2014 Ryan Zezeski
+.\" Copyright 2015 Joyent, Inc.
+.\"
+.Dd Apr 21, 2015
+.Dt DATAFILT 7M
+.Os
+.Sh NAME
+.Nm datafilt
+.Nd socket filter module for deferred TCP connections
+.Sh DESCRIPTION
+The
+.Nm datafilt
+socket filter provides deferment of
+.Xr accept 3SOCKET
+for TCP connections.
+The accept call will not return until at least one byte has been
+buffered by the kernel.
+Deferment assures the application that the first call to
+.Xr read 2
+or
+.Xr recv 3SOCKET
+will not block.
+It reduces unnecessary switching between user and kernel.
+.Sh EXAMPLES
+.Ss Example 1
+Enable deferment on the listening socket.
+.Bd -literal
+    setsockopt(lsock, SOL_FILTER, FIL_ATTACH, "datafilt", 8);
+.Ed
+.Ss Example 2
+Disable deferment on the listening socket.
+.Bd -literal
+    char filt[] = "datafilt";
+    setsockopt(lsock, SOL_FILTER, FIL_DETACH, filt, strlen(filt) + 1);
+.Ed
+.Sh SEE ALSO
+.Xr setsockopt 3SOCKET
diff --git a/usr/src/man/man7p/Makefile b/usr/src/man/man7p/Makefile
index 13cb58770d..f73a157f47 100644
--- a/usr/src/man/man7p/Makefile
+++ b/usr/src/man/man7p/Makefile
@@ -39,7 +39,8 @@ MANFILES= 	arp.7p		\
 	 	sip.7p		\
 	 	slp.7p		\
 	 	tcp.7p		\
-	 	udp.7p
+	 	udp.7p		\
+		vxlan.7p
 
 MANLINKS=	AH.7p		\
 		ARP.7p		\
@@ -51,6 +52,7 @@ MANLINKS=	AH.7p		\
 		SCTP.7p		\
 		TCP.7p		\
 		UDP.7p		\
+		VXLAN.7p	\
 	 	if.7p
 
 ARP.7p		:= LINKSRC = arp.7p
@@ -75,6 +77,8 @@ TCP.7p		:= LINKSRC = tcp.7p
 
 UDP.7p		:= LINKSRC = udp.7p
 
+VXLAN.7p	:= LINKSRC = vxlan.7p
+
 .KEEP_STATE:
 
 include		$(SRC)/man/Makefile.man
diff --git a/usr/src/man/man7p/vxlan.7p b/usr/src/man/man7p/vxlan.7p
new file mode 100644
index 0000000000..43c4756585
--- /dev/null
+++ b/usr/src/man/man7p/vxlan.7p
@@ -0,0 +1,130 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2015 Joyent, Inc.
+.\"
+.Dd Apr 10, 2015
+.Dt VXLAN 7P
+.Os
+.Sh NAME
+.Nm VXLAN ,
+.Nm vxlan
+.Nd Virtual eXtensible Local Area Network
+.Sh SYNOPSIS
+.In sys/vxlan.h
+.Sh DESCRIPTION
+.Nm
+(RFC 7348) is a network encapsulation protocol that is used by
+.Xr overlay 5
+devices.
+A payload, commonly an Ethernet frame, is placed inside of a
+UDP packet and prepended with an 8-byte
+.Nm
+header.
+.Pp
+The
+.Nm
+header contains two 32-bit words.
+The first word is an 8-bit flags field followed by 24 reserved bits.
+The second word is a 24-bit virtual network identifier followed by 8
+reserved bits.
+The virtual network identifier identifies a unique
+.Nm
+and
+is similar in concept to an IEEE 802.1Q VLAN identifier.
+.Pp
+The system provides access to
+.Nm
+through dladm overlays.
+See
+.Xr dladm 1M
+and
+.Xr overlay 5
+for more information.
+.Pp
+The
+.In sys/vxlan.h
+header provides information for working with the
+.Nm
+protocol.
+The contents of this header are
+.Sy uncommitted .
+The header defines a structure that may be used to encode and decode a VXLAN
+header.
+It defines a packed structure type
+.Sy vxlan_hdr_t
+which represents the
+.Nm
+frame header and has the following members:
+.Bd -literal
+	uint32_t	vxlan_flags;	/* flags in upper 8 bits */
+	uint32_t	vxlan_id;	/* VXLAN ID in upper 24 bits */
+.Ed
+.Sh EXAMPLES
+.Sy Example 1
+Decoding a
+.Nm
+header
+.Pp
+The following example shows how to validate a
+.Nm header.
+For more information on this process, see RFC 7348.
+.Bd -literal -offset indent
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <inttypes.h>
+#include <sys/vxlan.h>
+
+\&...
+
+/*
+ * Validate the following bytes as a VXLAN header. If valid, return
+ * 0 and store the VXLAN identifier in *vidp. Otherwise, return an
+ * error.
+ */
+int
+validate_vxlan(void *buf, int len, uint32_t *vidp)
+{
+	vxlan_hdr_t *hdr;
+
+	if (len < sizeof (vxlan_hdr_t))
+		return (EINAVL);
+
+	hdr = buf;
+	if ((ntohl(hdr->vxlan_flags) & VXLAN_MAGIC) == 0)
+		return (EINAVL);
+
+	*vidp = ntohl(vxlan->vxlan_id) >> VXLAN_ID_SHIFT;
+
+	return (0);
+}
+.Ed
+.Sh STABILITY
+The contents of
+.In sys/vxlan.h
+are
+.Sy Uncommitted .
+.Sh SEE ALSO
+.Xr dladm 1M ,
+.Xr overlay 5
+.Rs
+.%A Mahalingam, M.
+.%A Dutt, D.
+.%A Duda, K.
+.%A Agarwal, P.
+.%A Kreeger L.
+.%A Sridhar, T.
+.%A Bursell, M.
+.%A C. Wright
+.%T RFC 7348, Virtual eXtensible Local Area Network (VXLAN): A Framework
+.%T for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks
+.%D August 2014
+.Re
diff --git a/usr/src/man/man9e/mac.9e b/usr/src/man/man9e/mac.9e
index 52984f9791..c22becc131 100644
--- a/usr/src/man/man9e/mac.9e
+++ b/usr/src/man/man9e/mac.9e
@@ -9,9 +9,9 @@
 .\" http://www.illumos.org/license/CDDL.
 .\"
 .\"
-.\" Copyright 2016 Joyent, Inc.
+.\" Copyright 2018 Joyent, Inc.
 .\"
-.Dd March 26, 2017
+.Dd March 23, 2018
 .Dt MAC 9E
 .Os
 .Sh NAME
@@ -550,24 +550,28 @@ The following set of flags may be combined through a bitwise inclusive OR:
 .Bl -tag -width Ds
 .It Sy HCKSUM_INET_PARTIAL
 This indicates that the hardware can calculate a partial checksum for
-both IPv4 and IPv6; however, it requires the pseudo-header checksum be
-calculated for it.
+both IPv4 and IPv6 UDP and TCP packets; however, it requires the pseudo-header
+checksum be calculated for it.
 The pseudo-header checksum will be available for the mblk_t when calling
 .Xr mac_hcksum_get 9F .
-Note this does not imply that the hardware is capable of calculating the
-IPv4 header checksum.
+Note this does not imply that the hardware is capable of calculating
+the partial checksum for other L4 protocols or the IPv4 header checksum.
 That should be indicated with the
 .Sy HCKSUM_IPHDRCKSUM flag.
 .It Sy HCKSUM_INET_FULL_V4
-This indicates that the hardware will fully calculate the L4 checksum
-for outgoing IPv4 packets and does not require a pseudo-header checksum.
+This indicates that the hardware will fully calculate the L4 checksum for
+outgoing IPv4 UDP or TCP packets only, and does not require a pseudo-header
+checksum.
 Note this does not imply that the hardware is capable of calculating the
-IPv4 header checksum.
+checksum for other L4 protocols or the IPv4 header checksum.
 That should be indicated with the
 .Sy HCKSUM_IPHDRCKSUM .
 .It Sy HCKSUM_INET_FULL_V6
-This indicates that the hardware will fully calculate the L4 checksum
-for outgoing IPv6 packets and does not require a pseudo-header checksum.
+This indicates that the hardware will fully calculate the L4 checksum for
+outgoing IPv6 UDP or TCP packets only, and does not require a pseudo-header
+checksum.
+Note this does not imply that the hardware is capable of calculating the
+checksum for any other L4 protocols.
 .It Sy HCKSUM_IPHDRCKSUM
 This indicates that the hardware supports calculating the checksum for
 the IPv4 header itself.
diff --git a/usr/src/man/man9f/Makefile b/usr/src/man/man9f/Makefile
index b2f4b32fac..3d02d6e075 100644
--- a/usr/src/man/man9f/Makefile
+++ b/usr/src/man/man9f/Makefile
@@ -755,7 +755,9 @@ MANLINKS=	AVL_NEXT.9f					\
 		ddi_dmae_release.9f				\
 		ddi_dmae_stop.9f				\
 		ddi_exit_critical.9f				\
+		ddi_ffsll.9f					\
 		ddi_fls.9f					\
+		ddi_flsll.9f					\
 		ddi_fm_capable.9f				\
 		ddi_fm_dma_err_clear.9f				\
 		ddi_fm_dma_err_get.9f				\
@@ -1556,7 +1558,9 @@ ddi_dmae_stop.9f			:= LINKSRC = ddi_dmae.9f
 
 ddi_exit_critical.9f			:= LINKSRC = ddi_enter_critical.9f
 
+ddi_ffsll.9f				:= LINKSRC = ddi_ffs.9f
 ddi_fls.9f				:= LINKSRC = ddi_ffs.9f
+ddi_flsll.9f				:= LINKSRC = ddi_ffs.9f
 
 ddi_fm_dma_err_clear.9f			:= LINKSRC = ddi_fm_acc_err_clear.9f
 
diff --git a/usr/src/man/man9f/ddi_ffs.9f b/usr/src/man/man9f/ddi_ffs.9f
index afd1e13dbd..e6d5c1dfe2 100644
--- a/usr/src/man/man9f/ddi_ffs.9f
+++ b/usr/src/man/man9f/ddi_ffs.9f
@@ -3,74 +3,95 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH DDI_FFS 9F "Jun 5, 2013"
-.SH NAME
-ddi_ffs, ddi_fls \- find first (last) bit set in a long integer
-.SH SYNOPSIS
-.LP
-.nf
-#include <sys/conf.h>
-#include <sys/ddi.h>
-#include <sys/sunddi.h>
-
-
-
-\fBint\fR \fBddi_ffs\fR(\fBlong\fR \fImask\fR);
-.fi
-
-.LP
-.nf
-\fBint\fR \fBddi_fls\fR(\fBlong\fR \fImask\fR);
-.fi
-
-.SH INTERFACE LEVEL
-.sp
-.LP
+.Dd July 14, 2017
+.Dt DDI_FFS 9F
+.Os
+.Sh NAME
+.Nm ddi_ffs, ddi_ffsll, ddi_fls, ddi_flsll
+.Nd find first (last) bit set in a long (long) integer
+.Sh SYNOPSIS
+.In sys/conf.h
+.In sys/ddi.h
+.In sys/sunddi.h
+.Ft int
+.Fo "ddi_ffs"
+.Fa "long mask"
+.Fc
+.Ft int
+.Fo "ddi_fls"
+.Fa "long mask"
+.Fc
+.Ft int
+.Fo "ddi_ffs"
+.Fa "long long mask"
+.Fc
+.Ft int
+.Fo "ddi_fls"
+.Fa "long long mask"
+.Fc
+.Sh INTERFACE LEVEL
 Solaris DDI specific (Solaris DDI).
-.SH PARAMETERS
-.sp
-.ne 2
-.na
-\fB\fImask\fR\fR
-.ad
-.RS 8n
-A 32-bit argument value to search through.
-.RE
-
-.SH DESCRIPTION
-.sp
-.LP
-The function \fBddi_ffs()\fR takes its argument and returns the shift count
-that the first (least significant) bit set in the argument corresponds to. The
-function \fBddi_fls()\fR does the same, only it returns the shift count for the
-last (most significant) bit set in the argument.
-.SH RETURN VALUES
-.sp
-.ne 2
-.na
-\fB\fB0\fR\fR
-.ad
-.RS 5n
+.Sh PARAMETERS
+.Bl -tag -width Va
+.It Fa mask
+A 32-bit or 64-bit argument value to search through.
+.El
+.Sh DESCRIPTION
+The functions
+.Fn ddi_ffs
+and
+.Fn ddi_ffsll
+take their argument and return the shift count that the first (least
+significant) bit set in the argument corresponds to.
+The functions
+.Fn ddi_fls
+and
+.Fn ddi_flsll
+do the same, only they returns the shift count for the last (most
+significant) bit set in the argument.
+.Fn ddi_ffs
+and
+.Fn ddi_fls
+operate on 32-bit values, while
+.Fn ddi_ffsll
+and
+.Fn ddi_flsll
+operate on 64-bit values.
+.Sh CONTEXT
+These functions can be called from user, interrupt, or kernel context.
+.Sh RETURN VALUES
+.Bl -tag -width Va
+.It 0
 No bits are set in mask.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fIN\fR\fR
-.ad
-.RS 5n
-Bit  \fIN\fR is the least significant (\fBddi_ffs\fR) or most significant
-(\fBddi_fls\fR) bit set in mask. Bits are numbered from  \fB1\fR to  \fB32\fR,
-with bit \fB1\fR being the least significant bit position and bit \fB32\fR the
-most significant position.
-.RE
-
-.SH CONTEXT
-.sp
-.LP
-This function can be called from user, interrupt, or kernel context.
-.SH SEE ALSO
-.sp
-.LP
+.It N
+Bit
+.Em N
+is the least significant
+.Po
+.Fn ddi_ffs ,
+.Fn ddi_ffsll
+.Pc
+or most significant
+.Po
+.Fn ddi_fls ,
+.Fn ddi_flsll
+.Pc
+bit set in
+.Fa mask .
+Bits are numbered from
+.Em 1
+to
+.Em 32
+or
+.Em 64 ,
+with bit
+.Em 1
+being the least significant bit position and bit
+.Em 32
+or
+.Em 64
+the most significant position, depending on the variant of the
+functions used.
+.El
+.Sh SEE ALSO
 \fIWriting Device Drivers\fR
diff --git a/usr/src/man/man9f/kmem_alloc.9f b/usr/src/man/man9f/kmem_alloc.9f
index 9c4f8ccb0c..201544b57c 100644
--- a/usr/src/man/man9f/kmem_alloc.9f
+++ b/usr/src/man/man9f/kmem_alloc.9f
@@ -129,5 +129,8 @@ uninitialized kernel memory should be handled carefully. For example, never
 .SH NOTES
 .sp
 .LP
-\fBkmem_alloc(0\fR, \fIflag\fR\fB)\fR always returns \fINULL\fR.
-\fBkmem_free(NULL, 0)\fR is legal.
+\fBkmem_alloc(0\fR, \fIflag\fR\fB)\fR always returns \fINULL\fR, but
+if \fBKM_SLEEP\fR is set, this behavior is considered to be deprecated;
+the system may be configured to explicitly panic in this case in lieu
+of returning \fINULL\fR.
+\fBkmem_free(NULL, 0)\fR is legal, however.
diff --git a/usr/src/man/man9f/mac_hcksum_get.9f b/usr/src/man/man9f/mac_hcksum_get.9f
index b96f501f91..eb854a1928 100644
--- a/usr/src/man/man9f/mac_hcksum_get.9f
+++ b/usr/src/man/man9f/mac_hcksum_get.9f
@@ -9,9 +9,9 @@
 .\" http://www.illumos.org/license/CDDL.
 .\"
 .\"
-.\" Copyright 2016 Joyent, Inc.
+.\" Copyright 2018 Joyent, Inc.
 .\"
-.Dd June 01, 2016
+.Dd March 15, 2018
 .Dt MAC_HCKSUM_GET 9F
 .Os
 .Sh NAME
@@ -22,7 +22,7 @@
 .In sys/mac_provider.h
 .Ft void
 .Fo mac_hcksum_get
-.Fa "mblk_t *mp"
+.Fa "const mblk_t *mp"
 .Fa "uint32_t *start"
 .Fa "uint32_t *stuff"
 .Fa "uint32_t *end"
diff --git a/usr/src/pkg/manifests/SUNWcs.mf b/usr/src/pkg/manifests/SUNWcs.mf
index 1a146fd573..0adffef48d 100644
--- a/usr/src/pkg/manifests/SUNWcs.mf
+++ b/usr/src/pkg/manifests/SUNWcs.mf
@@ -237,9 +237,6 @@ $(i386_ONLY)dir path=usr/sbin/$(ARCH32)
 dir path=usr/sbin/$(ARCH64)
 dir path=usr/share
 dir path=usr/share/doc group=other
-dir path=usr/share/doc/ksh
-dir path=usr/share/doc/ksh/images
-dir path=usr/share/doc/ksh/images/callouts
 dir path=usr/share/lib
 dir path=usr/share/lib/mailx
 dir path=usr/share/lib/pub
@@ -1371,30 +1368,6 @@ file path=usr/sbin/wall group=tty mode=2555
 file path=usr/sbin/whodo mode=4555
 file path=usr/sbin/zdump mode=0555
 file path=usr/sbin/zic mode=0555
-file path=usr/share/doc/ksh/COMPATIBILITY
-file path=usr/share/doc/ksh/DESIGN
-file path=usr/share/doc/ksh/OBSOLETE
-file path=usr/share/doc/ksh/README
-file path=usr/share/doc/ksh/RELEASE
-file path=usr/share/doc/ksh/TYPES
-file path=usr/share/doc/ksh/images/callouts/1.png
-file path=usr/share/doc/ksh/images/callouts/10.png
-file path=usr/share/doc/ksh/images/callouts/2.png
-file path=usr/share/doc/ksh/images/callouts/3.png
-file path=usr/share/doc/ksh/images/callouts/4.png
-file path=usr/share/doc/ksh/images/callouts/5.png
-file path=usr/share/doc/ksh/images/callouts/6.png
-file path=usr/share/doc/ksh/images/callouts/7.png
-file path=usr/share/doc/ksh/images/callouts/8.png
-file path=usr/share/doc/ksh/images/callouts/9.png
-file path=usr/share/doc/ksh/images/tag_bourne.png
-file path=usr/share/doc/ksh/images/tag_i18n.png
-file path=usr/share/doc/ksh/images/tag_ksh.png
-file path=usr/share/doc/ksh/images/tag_ksh88.png
-file path=usr/share/doc/ksh/images/tag_ksh93.png
-file path=usr/share/doc/ksh/images/tag_l10n.png
-file path=usr/share/doc/ksh/images/tag_perf.png
-file path=usr/share/doc/ksh/shell_styleguide.docbook
 file path=usr/share/lib/mailx/mailx.help
 file path=usr/share/lib/mailx/mailx.help.~
 file path=usr/share/lib/tabset/3101
diff --git a/usr/src/pkg/manifests/developer-acpi.mf b/usr/src/pkg/manifests/developer-acpi.mf
index 487b085e6d..4b2b7fc23b 100644
--- a/usr/src/pkg/manifests/developer-acpi.mf
+++ b/usr/src/pkg/manifests/developer-acpi.mf
@@ -10,7 +10,7 @@
 #
 
 #
-# Copyright 2016 Joyent, Inc.
+# Copyright 2017 Joyent, Inc.
 #
 set name=pkg.fmri value=pkg:/developer/acpi@$(PKGVERS)
 set name=pkg.description value="ACPI utilities"
@@ -21,6 +21,7 @@ set name=variant.arch value=i386
 dir path=usr/share/man/man1m
 file path=usr/sbin/acpidump mode=0555
 file path=usr/sbin/acpixtract mode=0555
+file path=usr/sbin/iasl mode=0555
 file path=usr/share/man/man1m/acpidump.1m
 file path=usr/share/man/man1m/acpixtract.1m
 depend fmri=driver/x11/xsvc type=require
diff --git a/usr/src/pkg/manifests/developer-build-onbld.mf b/usr/src/pkg/manifests/developer-build-onbld.mf
index 49863c8e63..47ffd7808e 100644
--- a/usr/src/pkg/manifests/developer-build-onbld.mf
+++ b/usr/src/pkg/manifests/developer-build-onbld.mf
@@ -101,6 +101,7 @@ file path=opt/onbld/bin/find_elf mode=0555
 file path=opt/onbld/bin/findcrypto mode=0555
 file path=opt/onbld/bin/flg.flp mode=0555
 file path=opt/onbld/bin/genoffsets mode=0555
+file path=opt/onbld/bin/gensetdefs mode=0555
 file path=opt/onbld/bin/git-pbchk mode=0555
 file path=opt/onbld/bin/hdrchk mode=0555
 file path=opt/onbld/bin/interface_check mode=0555
diff --git a/usr/src/pkg/manifests/developer-opensolaris-osnet.mf b/usr/src/pkg/manifests/developer-opensolaris-osnet.mf
index ef3473902a..ca27aff134 100644
--- a/usr/src/pkg/manifests/developer-opensolaris-osnet.mf
+++ b/usr/src/pkg/manifests/developer-opensolaris-osnet.mf
@@ -20,6 +20,7 @@
 #
 
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2018, Joyent, Inc.
 
 set name=pkg.fmri value=pkg:/developer/opensolaris/osnet@$(PKGVERS)
 set name=pkg.description \
@@ -37,6 +38,7 @@ depend fmri=developer/build/onbld@0.5.11-0.133 type=require
 $(i386_ONLY)depend fmri=developer/gnu-binutils@2.19-0.133 type=require
 depend fmri=developer/java/jdk@0.5.11-0.133 type=require
 depend fmri=developer/lexer/flex@2.5.35-0.133 type=require
+depend fmri=developer/macro/gnu-m4@1.4 type=require
 depend fmri=developer/object-file@0.5.11-0.133 type=require
 depend fmri=developer/parser/bison@2.3-0.133 type=require
 depend fmri=developer/versioning/mercurial@1.3.1-0.133 type=require
diff --git a/usr/src/pkg/manifests/driver-crypto-nfp.mf b/usr/src/pkg/manifests/driver-crypto-nfp.mf
new file mode 100644
index 0000000000..fcdf538c1d
--- /dev/null
+++ b/usr/src/pkg/manifests/driver-crypto-nfp.mf
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2014 <contributor>
+#
+
+set name=pkg.fmri value=pkg:/driver/crypto/nfp@$(PKGVERS)
+set name=pkg.description value="nfast Crypto Accelerator Driver"
+set name=pkg.summary value="nfast Crypto Accelerator"
+set name=info.classification \
+    value=org.opensolaris.category.2008:System/Hardware
+set name=variant.arch value=i386
+dir path=kernel group=sys
+dir path=kernel/drv group=sys
+dir path=kernel/drv/$(ARCH64) group=sys
+driver name=nfp \
+    alias=pci1011,1065.100.100 \
+    alias=pci8086,b555.100.100 \
+    alias=pciex1011,1065.100.100 \
+    alias=pciex8086,b555.100.100
+file path=kernel/drv/$(ARCH64)/nfp group=sys
+$(i386_ONLY)file path=kernel/drv/nfp group=sys
+license usr/src/uts/common/io/nfp/THIRDPARTYLICENSE \
+    license=usr/src/uts/common/io/nfp/THIRDPARTYLICENSE
diff --git a/usr/src/pkg/manifests/service-fault-management.mf b/usr/src/pkg/manifests/service-fault-management.mf
index f2176a6a36..f97cdac667 100644
--- a/usr/src/pkg/manifests/service-fault-management.mf
+++ b/usr/src/pkg/manifests/service-fault-management.mf
@@ -21,6 +21,7 @@
 
 #
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2018, Joyent, Inc.
 #
 
 #
@@ -570,6 +571,7 @@ file path=usr/lib/fm/topo/plugins/fac_prov_mptsas.so mode=0555
 file path=usr/lib/fm/topo/plugins/ipmi.so mode=0555
 file path=usr/lib/fm/topo/plugins/nic.so mode=0555
 file path=usr/lib/fm/topo/plugins/ses.so mode=0555
+file path=usr/lib/fm/topo/plugins/smbios.so mode=0555
 file path=usr/lib/fm/topo/plugins/xfp.so mode=0555
 #
 # Dictionaries, whether they are hardware-specific or not, are
@@ -729,7 +731,55 @@ $(i386_ONLY)file path=usr/platform/i86pc/lib/fm/eft/gcpu.eft mode=0444
 $(i386_ONLY)file path=usr/platform/i86pc/lib/fm/eft/gcpu_amd.eft mode=0444
 $(i386_ONLY)file path=usr/platform/i86pc/lib/fm/eft/intel.eft mode=0444
 $(i386_ONLY)file \
-    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Compute-Platform-1101-disk-hc-topology.xml \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Storage-Platform-7001-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Storage-Platform-7001-chassis-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Storage-Platform-7001-slot-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2028R-ACR24L-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)link \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Compute-Platform-3101-hc-topology.xml \
+    target=./SSG-2028R-ACR24L-hc-topology.xml
+$(i386_ONLY)link \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Compute-Platform-3102-hc-topology.xml \
+    target=./SSG-2028R-ACR24L-hc-topology.xml
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Compute-Platform-3301-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)link \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Compute-Platform-3302-hc-topology.xml \
+    target=./Joyent-Compute-Platform-3301-hc-topology.xml
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Compute-Platform-330x-chassis-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/Joyent-Compute-Platform-330x-fan-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2028R-ACR24L-chassis-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2028R-ACR24L-disk-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2028R-ACR24L-slot-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2029P-ACR24L-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2029P-ACR24L-chassis-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2029P-ACR24L-disk-hc-topology.xml \
+    mode=0444
+$(i386_ONLY)file \
+    path=usr/platform/i86pc/lib/fm/topo/maps/SSG-2029P-ACR24L-slot-hc-topology.xml \
     mode=0444
 $(i386_ONLY)file \
     path=usr/platform/i86pc/lib/fm/topo/maps/Netra-X4200-M2-disk-hc-topology.xml \
diff --git a/usr/src/pkg/manifests/system-bhyve.mf b/usr/src/pkg/manifests/system-bhyve.mf
new file mode 100644
index 0000000000..fe19fb21b4
--- /dev/null
+++ b/usr/src/pkg/manifests/system-bhyve.mf
@@ -0,0 +1,60 @@
+#
+# CDDL HEADER START
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+#
+# The default for payload-bearing actions in this package is to appear in the
+# global zone only.  See the include file for greater detail, as well as
+# information about overriding the defaults.
+#
+<include global_zone_only_component>
+set name=pkg.fmri value=pkg:/system/bhyve@$(PKGVERS)
+set name=pkg.description value="BSD hypervisor"
+set name=pkg.summary value="BSD hypervisor"
+set name=info.classification \
+    value=org.opensolaris.category.2008:System/Virtualization
+set name=variant.arch value=i386
+dir path=kernel group=sys
+dir path=lib group=bin
+dir path=lib/$(ARCH64) group=bin
+dir path=usr group=sys
+dir path=usr/kernel/drv group=sys
+dir path=usr/kernel/drv/$(ARCH64) group=sys
+dir path=usr/lib group=bin
+dir path=usr/share
+dir path=usr/share/man
+dir path=usr/share/man/man1m
+dir path=usr/sbin
+driver name=ppt
+driver name=viona
+driver name=vmm
+file path=lib/$(ARCH64)/libvmmapi.so.1
+link path=lib/$(ARCH64)/libvmmapi.so target=./libvmmapi.so.1
+file path=usr/kernel/drv/$(ARCH64)/ppt
+file path=usr/kernel/drv/$(ARCH64)/viona
+file path=usr/kernel/drv/$(ARCH64)/vmm
+file path=usr/kernel/drv/ppt.conf
+file path=usr/kernel/drv/viona.conf
+file path=usr/kernel/drv/vmm.conf
+file path=usr/lib/libppt.so.1
+file path=usr/lib/$(ARCH64)/libppt.so.1
+file path=usr/sbin/bhyve mode=0555
+file path=usr/sbin/bhyvectl mode=0555
+file path=usr/sbin/pptadm mode=0555
+file path=usr/share/man/man1m/pptadm.1m
+license lic_CDDL license=lic_CDDL
diff --git a/usr/src/pkg/manifests/system-dtrace-tests.mf b/usr/src/pkg/manifests/system-dtrace-tests.mf
index 3a5d1e8e05..1ee076373b 100644
--- a/usr/src/pkg/manifests/system-dtrace-tests.mf
+++ b/usr/src/pkg/manifests/system-dtrace-tests.mf
@@ -1589,6 +1589,8 @@ file path=opt/SUNWdtrt/tst/common/scalars/tst.16kglobal.d mode=0444
 file path=opt/SUNWdtrt/tst/common/scalars/tst.16klocal.d mode=0444
 file path=opt/SUNWdtrt/tst/common/scalars/tst.basicvar.d mode=0444
 file path=opt/SUNWdtrt/tst/common/scalars/tst.basicvar.d.out mode=0444
+file path=opt/SUNWdtrt/tst/common/scalars/err.bigglobal.d mode=0444
+file path=opt/SUNWdtrt/tst/common/scalars/err.biglocal.d mode=0444
 file path=opt/SUNWdtrt/tst/common/scalars/tst.localvar.d mode=0444
 file path=opt/SUNWdtrt/tst/common/scalars/tst.misc.d mode=0444
 file path=opt/SUNWdtrt/tst/common/scalars/tst.self.d mode=0444
diff --git a/usr/src/pkg/manifests/system-kernel.man9f.inc b/usr/src/pkg/manifests/system-kernel.man9f.inc
index 8d705ffe5d..15e2395d6f 100644
--- a/usr/src/pkg/manifests/system-kernel.man9f.inc
+++ b/usr/src/pkg/manifests/system-kernel.man9f.inc
@@ -726,7 +726,9 @@ link path=usr/share/man/man9f/ddi_dmae_release.9f target=ddi_dmae.9f
 link path=usr/share/man/man9f/ddi_dmae_stop.9f target=ddi_dmae.9f
 link path=usr/share/man/man9f/ddi_exit_critical.9f \
     target=ddi_enter_critical.9f
+link path=usr/share/man/man9f/ddi_ffsll.9f target=ddi_ffs.9f
 link path=usr/share/man/man9f/ddi_fls.9f target=ddi_ffs.9f
+link path=usr/share/man/man9f/ddi_flsll.9f target=ddi_ffs.9f
 link path=usr/share/man/man9f/ddi_fm_capable.9f target=ddi_fm_init.9f
 link path=usr/share/man/man9f/ddi_fm_dma_err_clear.9f \
     target=ddi_fm_acc_err_clear.9f
diff --git a/usr/src/pkg/manifests/system-test-ostest.mf b/usr/src/pkg/manifests/system-test-ostest.mf
index 935920cc83..70e9d378c1 100644
--- a/usr/src/pkg/manifests/system-test-ostest.mf
+++ b/usr/src/pkg/manifests/system-test-ostest.mf
@@ -72,6 +72,10 @@ file path=opt/os-tests/tests/sockfs/drop_priv mode=0555
 file path=opt/os-tests/tests/sockfs/nosignal mode=0555
 file path=opt/os-tests/tests/sockfs/sockpair mode=0555
 file path=opt/os-tests/tests/spoof-ras mode=0555
+file path=opt/os-tests/tests/file-locking/runtests.32 mode=0555
+file path=opt/os-tests/tests/file-locking/runtests.64 mode=0555
+file path=opt/os-tests/tests/file-locking/acquire-lock.32 mode=0555
+file path=opt/os-tests/tests/file-locking/acquire-lock.64 mode=0555
 file path=opt/os-tests/tests/stress/dladm-kstat mode=0555
 license cr_Sun license=cr_Sun
 license lic_CDDL license=lic_CDDL
diff --git a/usr/src/pkg/manifests/system-zones-brand-joyent.mf b/usr/src/pkg/manifests/system-zones-brand-joyent.mf
new file mode 100644
index 0000000000..33452cdcd7
--- /dev/null
+++ b/usr/src/pkg/manifests/system-zones-brand-joyent.mf
@@ -0,0 +1,54 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2010 Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+set name=pkg.fmri value=pkg:/system/zones/brand/joyent@$(PKGVERS)
+set name=pkg.description value="Support for the 'joyent' Brand"
+set name=pkg.summary value="Joyent Containers: joyent brand support"
+set name=info.classification \
+    value=org.opensolaris.category.2008:System/Virtualization
+set name=variant.arch value=$(ARCH)
+dir path=etc group=sys
+dir path=etc/zones group=sys
+dir path=lib variant.opensolaris.zone=global
+dir path=lib/svc variant.opensolaris.zone=global
+dir path=lib/svc/manifest group=sys variant.opensolaris.zone=global
+dir path=lib/svc/manifest/system group=sys variant.opensolaris.zone=global
+dir path=lib/svc/method variant.opensolaris.zone=global
+dir path=usr group=sys
+dir path=usr/lib
+dir path=usr/lib/brand
+dir path=usr/lib/brand/joyent group=sys
+file path=etc/zones/Joyent.xml mode=0444
+file path=lib/svc/manifest/system/joyinit.xml group=sys mode=0444 \
+    variant.opensolaris.zone=global
+file path=lib/svc/method/svc-joyinit mode=0555 variant.opensolaris.zone=global
+file path=usr/lib/brand/joyent/config.xml mode=0444
+file path=usr/lib/brand/joyent/jinstall mode=0755
+file path=usr/lib/brand/joyent/juninstall mode=0755
+file path=usr/lib/brand/joyent/pinstall mode=0755
+file path=usr/lib/brand/joyent/platform.xml mode=0444
+file path=usr/lib/brand/joyent/prestate mode=0755
+license lic_CDDL license=lic_CDDL
diff --git a/usr/src/pkg/manifests/system-zones-brand-lx.mf b/usr/src/pkg/manifests/system-zones-brand-lx.mf
index ca3a8cc541..58a016fa9c 100644
--- a/usr/src/pkg/manifests/system-zones-brand-lx.mf
+++ b/usr/src/pkg/manifests/system-zones-brand-lx.mf
@@ -20,9 +20,104 @@
 #
 
 #
-# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2015 Joyent, Inc.
 #
 
-set name=pkg.fmri value=pkg:/system/zones/brand/lx@0.5.11,5.11-0.143
-set name=pkg.obsolete value=true
+#
+# This package will install successfully into any zone, global or
+# non-global.  The files, directories, links, and hardlinks, however,
+# will only be installed into the global zone.
+#
+<include global_zone_only_component>
+set name=pkg.fmri value=pkg:/system/zones/brand/lx@$(PKGVERS)
+set name=pkg.description value="Support for the 'lx' Brand"
+set name=pkg.summary value="lx Brand"
+set name=info.classification \
+    value="org.opensolaris.category.2008:Applications/System Utilities"
 set name=variant.arch value=i386
+dir path=etc group=sys
+dir path=etc/zones group=sys
+dir path=usr group=sys
+dir path=usr/kernel group=sys
+dir path=usr/kernel/brand group=sys
+dir path=usr/kernel/brand/$(ARCH64) group=sys
+dir path=usr/kernel/drv group=sys
+dir path=usr/kernel/drv/$(ARCH64) group=sys
+dir path=usr/kernel/dtrace group=sys
+dir path=usr/kernel/dtrace/$(ARCH64) group=sys
+dir path=usr/kernel/fs group=sys
+dir path=usr/kernel/fs/$(ARCH64) group=sys
+dir path=usr/kernel/strmod group=sys
+dir path=usr/kernel/strmod/$(ARCH64) group=sys
+dir path=usr/lib
+dir path=usr/lib/brand
+dir path=usr/lib/brand/lx
+dir path=usr/lib/brand/lx/$(ARCH64)
+dir path=usr/lib/brand/lx/distros
+dir path=usr/lib/devfsadm group=sys
+dir path=usr/lib/devfsadm/linkmod group=sys
+driver name=lx_audio
+driver name=lx_ptm perms="lx_ptmajor 0666 root sys"
+driver name=lx_systrace perms="* 0644 root sys"
+file path=etc/zones/SUNWlx.xml mode=0444
+file path=etc/zones/SUNWlx26.xml mode=0444
+file path=usr/kernel/brand/$(ARCH64)/lx_brand group=sys mode=0755
+file path=usr/kernel/brand/lx_brand group=sys mode=0755
+file path=usr/kernel/drv/$(ARCH64)/lx_audio group=sys
+file path=usr/kernel/drv/$(ARCH64)/lx_ptm group=sys
+file path=usr/kernel/drv/$(ARCH64)/lx_systrace group=sys
+file path=usr/kernel/drv/lx_audio group=sys
+file path=usr/kernel/drv/lx_audio.conf group=sys
+file path=usr/kernel/drv/lx_ptm group=sys
+file path=usr/kernel/drv/lx_ptm.conf group=sys
+file path=usr/kernel/drv/lx_systrace group=sys
+file path=usr/kernel/drv/lx_systrace.conf group=sys
+file path=usr/kernel/fs/$(ARCH64)/lx_afs group=sys mode=0755
+file path=usr/kernel/fs/$(ARCH64)/lx_proc group=sys mode=0755
+file path=usr/kernel/fs/lx_afs group=sys mode=0755
+file path=usr/kernel/fs/lx_proc group=sys mode=0755
+file path=usr/kernel/strmod/$(ARCH64)/ldlinux group=sys mode=0755
+file path=usr/kernel/strmod/ldlinux group=sys mode=0755
+file path=usr/lib/brand/lx/$(ARCH64)/lx_librtld_db.so.1
+file path=usr/lib/brand/lx/config.xml mode=0444
+file path=usr/lib/brand/lx/distros/centos35.distro mode=0444
+file path=usr/lib/brand/lx/distros/centos36.distro mode=0444
+file path=usr/lib/brand/lx/distros/centos37.distro mode=0444
+file path=usr/lib/brand/lx/distros/centos38.distro mode=0444
+file path=usr/lib/brand/lx/distros/rhel35.distro mode=0444
+file path=usr/lib/brand/lx/distros/rhel36.distro mode=0444
+file path=usr/lib/brand/lx/distros/rhel37.distro mode=0444
+file path=usr/lib/brand/lx/distros/rhel38.distro mode=0444
+file path=usr/lib/brand/lx/distros/rhel_centos_common mode=0444
+file path=usr/lib/brand/lx/etc_default_nfs group=sys mode=0444
+file path=usr/lib/brand/lx/lx_distro_install mode=0755
+file path=usr/lib/brand/lx/lxinit mode=0755
+file path=usr/lib/brand/lx/lx_init_zone mode=0755
+file path=usr/lib/brand/lx/lx_init_zone_debian mode=0755
+file path=usr/lib/brand/lx/lx_init_zone_redhat mode=0755
+file path=usr/lib/brand/lx/lx_install mode=0755
+file path=usr/lib/brand/lx/lx_librtld_db.so.1
+file path=usr/lib/brand/lx/lx_native mode=0755
+file path=usr/lib/brand/lx/lx_support mode=0755
+file path=usr/lib/brand/lx/platform.xml mode=0444
+file path=usr/lib/devfsadm/linkmod/SUNW_lx_link_$(ARCH).so group=sys
+file path=usr/lib/lx_brand.so.1
+hardlink path=usr/kernel/dtrace/$(ARCH64)/lx_systrace \
+    target=../../../kernel/drv/$(ARCH64)/lx_systrace
+hardlink path=usr/kernel/dtrace/lx_systrace \
+    target=../../kernel/drv/lx_systrace
+legacy pkg=SUNWlxr arch=$(ARCH) category=system \
+    desc="Support for the 'lx' Brand" \
+    hotline="Please contact your local service provider" \
+    name="lx Brand (Root)" vendor="Sun Microsystems, Inc." \
+    version=11.11,REV=2009.11.11
+legacy pkg=SUNWlxu arch=$(ARCH) category=system \
+    desc="Support for the 'lx' Brand" \
+    hotline="Please contact your local service provider" \
+    name="lx Brand (Usr)" vendor="Sun Microsystems, Inc." \
+    version=11.11,REV=2009.11.11
+license cr_Sun license=cr_Sun
+license lic_CDDL license=lic_CDDL
+link path=usr/lib/brand/lx/64 target=$(ARCH64)
diff --git a/usr/src/psm/stand/cpr/sparcv9/sun4u/machdep.c b/usr/src/psm/stand/cpr/sparcv9/sun4u/machdep.c
index 95e4b4e143..640dbc4902 100644
--- a/usr/src/psm/stand/cpr/sparcv9/sun4u/machdep.c
+++ b/usr/src/psm/stand/cpr/sparcv9/sun4u/machdep.c
@@ -22,16 +22,15 @@
 /*
  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <sys/cpr.h>
 #include <sys/promimpl.h>
 #include <sys/privregs.h>
 #include <sys/stack.h>
-#include <sys/cpuvar.h>
+#include <sys/bitmap.h>
 #include "cprboot.h"
 
 
@@ -54,7 +53,7 @@ uint_t cpu_delay;
  */
 typedef void (*tlb_func_t)(int, caddr_t, tte_t *);
 static uint_t mdlen;
-static cpuset_t slave_set;
+static ulong_t slave_set[BT_BITOUL(NCPU)];
 static int has_scbc;
 
 
@@ -234,7 +233,7 @@ slave_init(int cpu_id)
 {
 	restore_tlb(mdinfo.dtte, cpu_id);
 	restore_tlb(mdinfo.itte, cpu_id);
-	CPUSET_ADD(slave_set, cpu_id);
+	BT_SET(slave_set, cpu_id);
 	membar_stld();
 	if (has_scbc) {
 		/* just spin, master will park this cpu */
@@ -282,7 +281,7 @@ cb_mpsetup(void)
 	 * and wait about a second for them to checkin with slave_set
 	 */
 	ncpu = 0;
-	CPUSET_ZERO(slave_set);
+	bzero(slave_set, sizeof (slave_set));
 	for (scip = mdinfo.sci, tail = scip + NCPU; scip < tail; scip++) {
 		if (scip->node == 0 || scip->cpu_id == cb_mid)
 			continue;
@@ -290,7 +289,7 @@ cb_mpsetup(void)
 		    (caddr_t)cpu_launch, scip->cpu_id);
 
 		for (timeout = TIMEOUT_MSECS; timeout; timeout--) {
-			if (CPU_IN_SET(slave_set, scip->cpu_id))
+			if (BT_TEST(slave_set, scip->cpu_id))
 				break;
 			cb_usec_wait(MILLISEC);
 		}
diff --git a/usr/src/req.flg b/usr/src/req.flg
index 83e2936a36..d62f4ac12c 100644
--- a/usr/src/req.flg
+++ b/usr/src/req.flg
@@ -22,6 +22,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc
 #
 
 echo_file usr/src/Makefile
@@ -32,3 +33,5 @@ echo_file usr/src/Makefile.master.64
 echo_file usr/src/Makefile.msg.targ
 echo_file usr/src/Makefile.psm
 echo_file usr/src/Makefile.psm.targ
+
+find_files "s.*" usr/contrib/freebsd
diff --git a/usr/src/stand/lib/fs/hsfs/hsfsops.c b/usr/src/stand/lib/fs/hsfs/hsfsops.c
index 0119d3fe99..21f8c37081 100644
--- a/usr/src/stand/lib/fs/hsfs/hsfsops.c
+++ b/usr/src/stand/lib/fs/hsfs/hsfsops.c
@@ -1026,6 +1026,7 @@ boot_hsfs_getdents(int fd, struct dirent *dep, unsigned size)
 		 *	  alignment.
 		 */
 		n = strlen(hdp->hs_ufs_dir.d_name);
+
 		n = roundup((sizeof (struct dirent) + ((n > SLOP) ? n : 0)),
 		    sizeof (off_t));
 
diff --git a/usr/src/test/Readme.smartos b/usr/src/test/Readme.smartos
new file mode 100644
index 0000000000..9c413aba2f
--- /dev/null
+++ b/usr/src/test/Readme.smartos
@@ -0,0 +1,80 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2017, Joyent, Inc.
+#
+
+I) Introduction
+
+The procedure to run the illumos tests under SmartOS is unlike that for
+other distributions because of the zone-centric nature of the distribution,
+and because there is no built-in package management for the global zone.
+
+This Readme assumes you will run the tests in the global zone, as root.
+Although it is possible to run some of the tests within a non-global zone, as a
+user configured within that zone, that approach is not described here.
+
+Some test suites, such as the ZFS tests, assume there are available disks to
+use for the test run. This configuration is not currently available on a
+standard SmartOS installation, where all of the disks are already setup in the
+"zones" zpool, so these tests are not runnable at this time. The ZFS tests
+also are required to run as a non-root user, and that is non-standard for a
+SmartOS global zone, where any user created is lost on reboot.
+
+II) Setup to Run the Tests
+
+1) The tests currently require python27 to run, so you need to install this in
+   the global zone. The easiest way to do this is with pkgsrc using the
+   following procedure:
+
+   a) Get a copy of the following bootstrap tarball onto the test machine:
+      https://pkgsrc.joyent.com/packages/SmartOS/bootstrap/bootstrap-2014Q4-multiarch.tar.gz
+
+   b) Install the bootstrap tarball:
+      # gzcat bootstrap-2014Q4-multiarch.tar.gz | (cd /; tar -xpf -)
+
+   c) Install python27:
+      pkgin in python27
+
+2) You need to get the tests from your build machine onto the test machine's
+   global zone. This can be done in whatever way is easiest for you. Here is
+   one simple way:
+
+   a) On your build machine, in your fully built smartos-live proto area,
+      create a tarball of the test directory:
+      % cd proto/opt
+      % tar czf ../opt.tgz *
+
+
+   b) Copy the tarball from the build machine to the test machine running
+      SmartOS (the next step assumes you placed the tarball into the /zones
+      directory).
+
+3) In the global zone on your test machine, install the tests.
+
+   # cd /opt
+   # tar xf /zones/opt.tgz
+
+III) Run the Tests
+
+Now that setup is complete, you can run the tests using the normal procedure.
+For example:
+
+    # /opt/util-tests/bin/utiltest
+or
+    # /opt/os-tests/bin/ostest
+
+IV) Running New Tests
+
+During development, if you are creating or updating new tests, you can repeat
+steps 2 and 3 as often as necessary to make the new tests available on the test
+machine.
diff --git a/usr/src/test/libc-tests/runfiles/default.run b/usr/src/test/libc-tests/runfiles/default.run
index 9c7e893cf6..6781cba483 100644
--- a/usr/src/test/libc-tests/runfiles/default.run
+++ b/usr/src/test/libc-tests/runfiles/default.run
@@ -71,6 +71,10 @@ timeout = 600
 [/opt/libc-tests/tests/call_once.32]
 [/opt/libc-tests/tests/call_once.64]
 [/opt/libc-tests/tests/catopen]
+[/opt/libc-tests/tests/env-OS-4089.32]
+[/opt/libc-tests/tests/env-OS-4089.64]
+[/opt/libc-tests/tests/env-7076.32]
+[/opt/libc-tests/tests/env-7076.64]
 [/opt/libc-tests/tests/endian.32]
 [/opt/libc-tests/tests/endian.64]
 [/opt/libc-tests/tests/env-7076.32]
diff --git a/usr/src/test/libc-tests/tests/Makefile b/usr/src/test/libc-tests/tests/Makefile
index 88d463294d..4d53e707e5 100644
--- a/usr/src/test/libc-tests/tests/Makefile
+++ b/usr/src/test/libc-tests/tests/Makefile
@@ -31,6 +31,7 @@ SUBDIRS = \
 	wctype
 
 PROGS = \
+	env-OS-4089 \
 	aligned_alloc \
 	c11_threads \
 	c11_tss \
diff --git a/usr/src/test/libc-tests/tests/env-OS-4089.c b/usr/src/test/libc-tests/tests/env-OS-4089.c
new file mode 100644
index 0000000000..0f52201c79
--- /dev/null
+++ b/usr/src/test/libc-tests/tests/env-OS-4089.c
@@ -0,0 +1,73 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Regression test for OS-4089 where doing a putenv() call without an '=' sign
+ * may lead to a segmentation fault when doing a getenv() depending on the
+ * circumstances of the environment's layout. Verify putenv() mimics
+ * unsetenv().
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <sys/debug.h>
+
+int
+main(void)
+{
+	if (putenv("FOO=bar") != 0) {
+		fprintf(stderr, "failed to put FOO into the environment: %s\n",
+		    strerror(errno));
+		return (1);
+	}
+
+	if (getenv("FOO") == NULL) {
+		fprintf(stderr, "failed to retrieve FOO from the "
+		    "environment!\n");
+		return (1);
+	}
+
+	VERIFY0(unsetenv("FOO"));
+
+	if (getenv("FOO") != NULL) {
+		fprintf(stderr, "Somehow retrieved FOO from the "
+		    "environment after unsetenv()!\n");
+		return (1);
+	}
+
+	if (putenv("FOO=bar") != 0) {
+		fprintf(stderr, "failed to put FOO into the environment: %s\n",
+		    strerror(errno));
+		return (1);
+	}
+
+	if (getenv("FOO") == NULL) {
+		fprintf(stderr, "failed to retrieve FOO from the "
+		    "environment!\n");
+		return (1);
+	}
+
+	VERIFY0(putenv("FOO"));
+
+	if (getenv("FOO") != NULL) {
+		fprintf(stderr, "Somehow retrieved FOO from the "
+		    "environment after putenv()!\n");
+		return (1);
+	}
+
+	return (0);
+}
diff --git a/usr/src/test/libc-tests/tests/random/Makefile b/usr/src/test/libc-tests/tests/random/Makefile
index ed480dacb9..c1a1a18e1f 100644
--- a/usr/src/test/libc-tests/tests/random/Makefile
+++ b/usr/src/test/libc-tests/tests/random/Makefile
@@ -17,7 +17,6 @@ include $(SRC)/Makefile.master
 
 ROOTOPTPKG = $(ROOT)/opt/libc-tests
 TESTDIR = $(ROOTOPTPKG)/tests/random
-ROOTBINDIR = $(ROOTOPTPKG)/bin
 
 PROGS = arc4random 		\
 	arc4random_prefork 	\
@@ -74,17 +73,12 @@ arc4random_preforksig: arc4random_forksig.c
 	$(POST_PROCESS)
 
 chacha: chacha_tv.c
-	$(COMPILE.c) -DKEYSTREAM_ONLY -I$(SRC)/common/crypto/chacha -o chacha.o -c $(SRC)/common/crypto/chacha/chacha.c
+	$(COMPILE.c) -DKEYSTREAM_ONLY -I$(SRC)/common/crypto/chacha \
+	    -o chacha.o -c $(SRC)/common/crypto/chacha/chacha.c
 	$(COMPILE.c) -I$(SRC)/common/crypto/chacha -o chacha_tv.o -c chacha_tv.c
 	$(LINK.c) -o $@ chacha_tv.o chacha.o $(LDLIBS)
 	$(POST_PROCESS)
 
-$(ROOTBINDIR):
-	$(INS.dir)
-
-$(ROOTBINDIR)/%: %
-	$(INS.file)
-
 $(TESTDIR):
 	$(INS.dir)
 
diff --git a/usr/src/test/libc-tests/tests/symbols/Makefile b/usr/src/test/libc-tests/tests/symbols/Makefile
index cd499add8c..a5eef8a3a8 100644
--- a/usr/src/test/libc-tests/tests/symbols/Makefile
+++ b/usr/src/test/libc-tests/tests/symbols/Makefile
@@ -11,6 +11,7 @@
 
 #
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
+# Copyright 2018, Joyent, Inc.
 #
 
 include $(SRC)/Makefile.master
@@ -49,14 +50,8 @@ EXTRAPROG += $(SYMTESTS)
 
 include ../Makefile.com
 
-#
-# Since we use libcmdutils which is LF64, we need to be LF64 even though we're
-# not using the LF64 related features at the moment, lint catches us otherwise.
-#
-CPPFLAGS += -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-
-LDLIBS += -lcmdutils
-LDLIBS64 += -lcmdutils
+LDLIBS += -lcustr
+LDLIBS64 += -lcustr
 
 $(SYMTESTS:%=$(TESTDIR)/%): $(TESTDIR)/setup
 	-$(RM) $@
diff --git a/usr/src/test/libc-tests/tests/symbols/symbols_test.c b/usr/src/test/libc-tests/tests/symbols/symbols_test.c
index 53e0d015de..ac92feb2b6 100644
--- a/usr/src/test/libc-tests/tests/symbols/symbols_test.c
+++ b/usr/src/test/libc-tests/tests/symbols/symbols_test.c
@@ -11,7 +11,7 @@
 
 /*
  * Copyright 2015 Garrett D'Amore <garrett@damore.org>
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -27,7 +27,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <note.h>
-#include <libcmdutils.h>
+#include <libcustr.h>
 #include <sys/wait.h>
 #include "test_common.h"
 
diff --git a/usr/src/test/os-tests/runfiles/default.run b/usr/src/test/os-tests/runfiles/default.run
index d67642f32b..974829b1f6 100644
--- a/usr/src/test/os-tests/runfiles/default.run
+++ b/usr/src/test/os-tests/runfiles/default.run
@@ -22,7 +22,7 @@ timeout = 60
 post =
 outputdir = /var/tmp/test_results
 
-[/opt/os-tests/tests/poll_test]
+[/opt/os-tests/tests/poll]
 user = root
 tests = ['poll_test', 'epoll_test']
 
@@ -48,6 +48,14 @@ tests = ['sigqueue_queue_size']
 user = root
 tests = ['sdevfs_eisdir']
 
+[/opt/os-tests/tests/timer]
+user = root
+tests = ['timer_limit']
+
+[/opt/os-tests/tests/tmpfs]
+user = root
+tests = ['tmpfs_badmount', 'tmpfs_enospc']
+
 [/opt/os-tests/tests/stress]
 user = root
 tests = ['dladm-kstat']
@@ -63,6 +71,9 @@ tests = ['conn', 'dgram', 'drop_priv', 'nosignal', 'sockpair']
 user = root
 tests = ['acquire-compare', 'acquire-spray']
 
+[/opt/os-tests/tests/OS-6097.32]
+[/opt/os-tests/tests/OS-6097.64]
+
 [/opt/os-tests/tests/i386]
 user = root
 arch = i86pc
diff --git a/usr/src/test/os-tests/tests/Makefile b/usr/src/test/os-tests/tests/Makefile
index 5de66f69e5..0c9c55f633 100644
--- a/usr/src/test/os-tests/tests/Makefile
+++ b/usr/src/test/os-tests/tests/Makefile
@@ -16,7 +16,62 @@
 
 SUBDIRS_i386 = i386
 
-SUBDIRS = poll secflags sigqueue spoof-ras sdevfs sockfs stress file-locking \
-	pf_key $(SUBDIRS_$(MACH))
+SUBDIRS = poll secflags sigqueue spoof-ras sdevfs sockfs stress timer tmpfs \
+	file-locking pf_key $(SUBDIRS_$(MACH))
 
-include $(SRC)/test/Makefile.com
+PROGS = \
+	OS-6097
+
+PROGS32 = $(PROGS:%=%.32)
+PROGS64 = $(PROGS:%=%.64)
+
+OS-6097.32 :=	LDLIBS += -ldlpi
+OS-6097.64 :=	LDLIBS64 += -ldlpi
+
+ROOTOPTDIR = $(ROOT)/opt/os-tests/tests
+ROOTOPTPROGS = $(PROGS32:%=$(ROOTOPTDIR)/%) \
+	$(PROGS64:%=$(ROOTOPTDIR)/%) \
+	$(SCRIPTS:%=$(ROOTOPTDIR)/%)
+
+include $(SRC)/cmd/Makefile.cmd
+
+all     :=      TARGET = all
+install :=      TARGET = install
+clean   :=      TARGET = clean
+clobber :=      TARGET = clobber
+lint    :=      TARGET = lint
+
+.KEEP_STATE:
+
+install: $(SUBDIRS) $(ROOTOPTPROGS)
+
+all: $(SUBDIRS) $(PROGS32) $(PROGS64)
+
+clean lint: $(SUBDIRS)
+
+$(ROOTOPTPROGS): $(PROGS32) $(PROGS64) $(ROOTOPTDIR)
+
+$(ROOTOPTDIR):
+	$(INS.dir)
+
+$(ROOTOPTDIR)/%: %
+	$(INS.file)
+
+$(ROOTOPTDIR)/%: %.ksh
+	$(INS.rename)
+
+%.64: %.c
+	$(LINK64.c) -o $@ $< $(LDLIBS64)
+	$(POST_PROCESS)
+
+%.32: %.c
+	$(LINK.c) -o $@ $< $(LDLIBS)
+	$(POST_PROCESS)
+
+clobber: $(SUBDIRS)
+	$(RM) $(PROGS32) $(PROGS64)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/test/os-tests/tests/OS-6097.c b/usr/src/test/os-tests/tests/OS-6097.c
new file mode 100644
index 0000000000..160c01e9c7
--- /dev/null
+++ b/usr/src/test/os-tests/tests/OS-6097.c
@@ -0,0 +1,74 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+/*
+ * Regression test for OS-6097.
+ */
+
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <libdlpi.h>
+#include <sys/debug.h>
+
+int
+main(void)
+{
+	int ret;
+	char path[4096];
+	uint_t num = 4294967294U;
+	dlpi_handle_t dh;
+
+	/*
+	 * First, we need to determine a path that doesn't exist to trigger this
+	 * bug. We start with the highest possible number and just decrement
+	 * until we find something.
+	 */
+
+	while (num > 0) {
+		struct stat st;
+
+		(void) snprintf(path, sizeof (path), "/dev/net/net%u", num);
+
+		ret = stat(path, &st);
+		if (ret == -1 && errno == ENOENT)
+			break;
+		if (ret == -1) {
+			(void) fprintf(stderr, "test failed: unexpected error "
+			    "running stat(2) on %s: %s\n", path,
+			    strerror(errno));
+			return (1);
+		}
+		num--;
+	}
+
+	/*
+	 * While technically this is a valid entry that we could try, at this
+	 * point we've exhausted so many NICs, there's likely a bug.
+	 */
+	if (num == 0) {
+		(void) fprintf(stderr, "failed to construct a non-existent "
+		    "NIC with a name starting with 'net'\n");
+		return (1);
+	}
+
+	(void) snprintf(path, sizeof (path), "net%u", num);
+	ret = dlpi_open(path, &dh, 0);
+	VERIFY3U(ret, ==, DLPI_ENOLINK);
+	return (0);
+}
diff --git a/usr/src/test/os-tests/tests/file-locking/Makefile b/usr/src/test/os-tests/tests/file-locking/Makefile
index aecf20edb4..79f44472ee 100644
--- a/usr/src/test/os-tests/tests/file-locking/Makefile
+++ b/usr/src/test/os-tests/tests/file-locking/Makefile
@@ -28,6 +28,9 @@ SRCS = $(PROGS:%=%.c) $(UTILS)
 PROGS32 = $(PROGS:%=%.32)
 PROGS64 = $(PROGS:%=%.64)
 
+runtests.32 :=	LDLIBS += -lgen
+runtests.64 :=	LDLIBS64 += -lgen
+
 LINTS = $(PROGS:%=%.ln)
 LINTFLAGS += -erroff=E_NAME_DEF_NOT_USED2
 LINTFLAGS += -erroff=E_NAME_USED_NOT_DEF2
@@ -36,6 +39,12 @@ ROOTOPTDIR = $(ROOT)/opt/os-tests/tests/file-locking
 ROOTOPTPROGS = $(PROGS32:%=$(ROOTOPTDIR)/%) \
 	$(PROGS64:%=$(ROOTOPTDIR)/%)
 
+all     :=      TARGET = all
+install :=      TARGET = install
+clean   :=      TARGET = clean
+clobber :=      TARGET = clobber
+lint    :=      TARGET = lint
+
 .KEEP_STATE:
 
 install: $(ROOTOPTPROGS)
diff --git a/usr/src/test/os-tests/tests/i386/ldt.c b/usr/src/test/os-tests/tests/i386/ldt.c
index dbe816b19c..dbe816b19c 100755..100644
--- a/usr/src/test/os-tests/tests/i386/ldt.c
+++ b/usr/src/test/os-tests/tests/i386/ldt.c
diff --git a/usr/src/test/os-tests/tests/poll/Makefile b/usr/src/test/os-tests/tests/poll/Makefile
index ae416f9628..feffc744fb 100644
--- a/usr/src/test/os-tests/tests/poll/Makefile
+++ b/usr/src/test/os-tests/tests/poll/Makefile
@@ -11,7 +11,7 @@
 
 #
 # Copyright (c) 2012 by Delphix. All rights reserved.
-# Copyright 2016 Joyent, Inc.
+# Copyright 2017 Joyent, Inc.
 #
 
 include $(SRC)/cmd/Makefile.cmd
@@ -26,7 +26,7 @@ poll_test.ln := LDLIBS += -lsocket
 CSTD = $(CSTD_GNU99)
 
 ROOTOPTPKG = $(ROOT)/opt/os-tests
-TESTDIR = $(ROOTOPTPKG)/tests
+TESTDIR = $(ROOTOPTPKG)/tests/poll
 
 CMDS = $(PROG:%=$(TESTDIR)/%)
 $(CMDS) := FILEMODE = 0555
diff --git a/usr/src/test/os-tests/tests/timer/Makefile b/usr/src/test/os-tests/tests/timer/Makefile
new file mode 100644
index 0000000000..4c88f2465e
--- /dev/null
+++ b/usr/src/test/os-tests/tests/timer/Makefile
@@ -0,0 +1,50 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+include $(SRC)/Makefile.master
+
+ROOTOPTPKG = $(ROOT)/opt/os-tests
+TESTDIR = $(ROOTOPTPKG)/tests/timer
+
+PROGS = timer_limit
+
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/test/Makefile.com
+
+CSTD= $(CSTD_GNU99)
+
+
+CMDS = $(PROGS:%=$(TESTDIR)/%)
+$(CMDS) := FILEMODE = 0555
+
+all: $(PROGS)
+
+install: all $(CMDS)
+
+lint:
+
+clobber: clean
+	-$(RM) $(PROGS)
+
+clean:
+	-$(RM) *.o
+
+$(CMDS): $(TESTDIR) $(PROGS)
+
+$(TESTDIR):
+	$(INS.dir)
+
+$(TESTDIR)/%: %
+	$(INS.file)
diff --git a/usr/src/test/os-tests/tests/timer/timer_limit.c b/usr/src/test/os-tests/tests/timer/timer_limit.c
new file mode 100644
index 0000000000..77473c806f
--- /dev/null
+++ b/usr/src/test/os-tests/tests/timer/timer_limit.c
@@ -0,0 +1,83 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <time.h>
+#include <limits.h>
+#include <assert.h>
+#include <sys/sysconfig.h>
+#include <sys/sysmacros.h>
+
+/* Need direct access to _sysconfig to query NCPU */
+extern long _sysconfig(int);
+
+
+static int
+mktimer(timer_t *timer)
+{
+	struct sigevent sev;
+	sev.sigev_notify = SIGEV_SIGNAL;
+	sev.sigev_signo = SIGRTMIN;
+	sev.sigev_value.sival_ptr = timer;
+
+	return (timer_create(CLOCK_MONOTONIC, &sev, timer));
+}
+
+int
+main()
+{
+	long ncpu;
+	size_t limit;
+	timer_t *timers, timer_overage;
+
+	/* Query NCPU with private sysconfig param */
+	ncpu = _sysconfig(_CONFIG_NPROC_NCPU);
+	assert(ncpu > 0 && ncpu < INT32_MAX);
+
+	/* Current specified limit is 4 * NCPU */
+	limit = 4 * ncpu;
+	timers = calloc(limit + 1, sizeof (timer_t));
+	assert(timers != NULL);
+
+	/* Slowly walk up to the limit doing creations/deletions */
+	for (int i = 1; i <= limit; i = MIN(limit, i*2)) {
+		for (int j = 0; j < i; j++) {
+			assert(mktimer(&timers[j]) == 0);
+		}
+
+		/*
+		 * Attempt to allocate one additional timer if we've reached
+		 * the assumed limit.
+		 */
+		if (i == limit) {
+			assert(mktimer(&timer_overage) == -1);
+		}
+
+		for (int j = 0; j < i; j++) {
+			assert(timer_delete(timers[j]) == 0);
+		}
+
+		/* Bail out if we've finished at the limit */
+		if (i == limit)
+			break;
+	}
+
+
+	return (0);
+}
diff --git a/usr/src/test/os-tests/tests/tmpfs/Makefile b/usr/src/test/os-tests/tests/tmpfs/Makefile
new file mode 100644
index 0000000000..d6515b38fa
--- /dev/null
+++ b/usr/src/test/os-tests/tests/tmpfs/Makefile
@@ -0,0 +1,52 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+include $(SRC)/Makefile.master
+
+ROOTOPTPKG = $(ROOT)/opt/os-tests
+TESTDIR = $(ROOTOPTPKG)/tests/tmpfs
+
+PROGS = tmpfs_full
+SCRIPTS = tmpfs_badmount \
+	  tmpfs_enospc
+
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/test/Makefile.com
+
+CMDS = $(PROGS:%=$(TESTDIR)/%) $(SCRIPTS:%=$(TESTDIR)/%)
+$(CMDS) := FILEMODE = 0555
+
+all: $(PROGS)
+
+install: all $(CMDS)
+
+lint:
+
+clobber: clean
+	-$(RM) $(PROGS)
+
+clean:
+	-$(RM) *.o
+
+$(CMDS): $(TESTDIR) $(PROGS)
+
+$(TESTDIR):
+	$(INS.dir)
+
+$(TESTDIR)/%: %.ksh
+	$(INS.rename)
+
+$(TESTDIR)/%: %
+	$(INS.file)
diff --git a/usr/src/test/os-tests/tests/tmpfs/tmpfs_badmount.ksh b/usr/src/test/os-tests/tests/tmpfs/tmpfs_badmount.ksh
new file mode 100644
index 0000000000..7e2c4a6095
--- /dev/null
+++ b/usr/src/test/os-tests/tests/tmpfs/tmpfs_badmount.ksh
@@ -0,0 +1,114 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# Test various options to try and mount a tmpfs. Aside from the first to
+# verify that we can mount tmpfs at all, these should all fail.
+#
+
+tb_arg0=$(basename $0)
+tb_mountpoint="/var/tmp/$0.$$"
+tb_mount=/usr/sbin/mount
+tb_umount=/usr/sbin/umount
+
+function fatal
+{
+	rmdir $tb_mountpoint
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="test failed"
+	echo "$tb_arg0: test failed $msg" >&2
+	exit 1
+}
+
+function check_mount
+{
+	mkdir -p $tb_mountpoint || fatal \
+	    "failed to make mountpoint $tb_mountpoint"
+	$tb_mount -F tmpfs swap $tb_mountpoint || fatal \
+	    "failed to mount tmpfs, check user perms"
+	$tb_umount $tb_mountpoint || fatal \
+	    "failed to unmount test point"
+}
+
+function test_one
+{
+	typeset opts=$1
+
+	[[ -z "$opts" ]] && fatal "missing required opts"
+	$tb_mount -F tmpfs -o $opts swap $tb_mountpoint 2>/dev/null
+	if [[ $? -eq 0 ]]; then
+		$tb_umount $tb_mountpoint
+		fatal "successfully mounted with opts $opts, expected failure"
+	fi
+}
+
+check_mount
+
+#
+# Test invalid percentages.
+#
+test_one "size=-5%"
+test_one "size=200%"
+test_one "size=55.55555%"
+test_one "size=100.0%"
+test_one "size=bad%"
+test_one "size=30g%"
+test_one "size=%"
+test_one "size=%wat"
+
+#
+# Test invalid sizes. Only kmg are valid prefixes.
+#
+test_one "size=hello;world"
+test_one "size=0xnope"
+test_one "size=3.14g"
+test_one "size=3;14"
+test_one "size=thisisanormalsize"
+test_one "size="
+test_one "size=100mtry"
+
+#
+# Now, we need to try and trigger a bunch of overflow. We're going to do
+# this assuming we're on a 64-bit kernel (which will always overflow a
+# 32-bit kernel).
+#
+test_one "size=20000000000000000000"
+test_one "size=1ggggggggggggggggggg"
+test_one "size=1mmmmmmmmmmmmmmmmmmm"
+test_one "size=1kkkkkkkkkkkkkkkkkkk"
+test_one "size=1kkkkkkkkkkkkkkkkkkk"
+test_one "size=18014398509481983k"
+test_one "size=17592186044416m"
+test_one "size=17179869185g"
+test_one "size=17179869184g"
+
+#
+# Let's throw a couple bad modes around while we're here.
+#
+test_one "mode=17777"
+test_one "mode=27777"
+test_one "mode=37777"
+test_one "mode=47777"
+test_one "mode=57777"
+test_one "mode=67777"
+test_one "mode=77777"
+test_one "mode=87777"
+test_one "mode=97777"
+test_one "mode=asdf"
+test_one "mode=deadbeef"
+test_one "mode=kefka"
+
+rmdir $tb_mountpoint
diff --git a/usr/src/test/os-tests/tests/tmpfs/tmpfs_enospc.ksh b/usr/src/test/os-tests/tests/tmpfs/tmpfs_enospc.ksh
new file mode 100644
index 0000000000..a285f306e2
--- /dev/null
+++ b/usr/src/test/os-tests/tests/tmpfs/tmpfs_enospc.ksh
@@ -0,0 +1,74 @@
+#!/usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# Verify that if we fill up a tmpfs that we can't then perform
+# additional things to it that would result in the creation or use of
+# kernel memory.
+#
+
+te_arg0=$(basename $0)
+te_root=$(dirname $0)
+te_bin=$te_root/tmpfs_full
+te_mountpoint="/var/tmp/$0.$$"
+te_mount=/usr/sbin/mount
+te_umount=/usr/sbin/umount
+te_testfile=1m
+te_mounted=
+te_exit=1
+
+function fatal
+{
+	[[ -n "$te_mounted" ]] && $te_umount $te_mountpoint
+	rmdir $te_mountpoint
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="test failed"
+	echo "$te_arg0: test failed $msg" >&2
+	exit 1
+}
+
+function setup
+{
+	typeset ofile=$te_mountpoint/$te_testfile
+
+	mkdir -p $te_mountpoint || fatal \
+	    "failed to make mountpoint $te_mountpoint"
+	$te_mount -F tmpfs swap $te_mountpoint || fatal \
+	    "failed to mount tmpfs, check user perms"
+	te_mounted=1
+	dd if=/dev/zero of=$ofile bs=1M count=1 2>/dev/null || fatal \
+	    "failed to create a 1 MB file"
+	$te_mount -F tmpfs -o remount,size=512k swap $te_mountpoint ||
+	    fatal "failed to remount tmpfs"
+}
+
+function run_test
+{
+	$te_bin $te_mountpoint $te_testfile || fatal "$te_bin failed"
+}
+
+function cleanup
+{
+	te_mounted=
+	$te_umount $te_mountpoint || fatal "failed to unmount $te_mountpoint"
+	rmdir $te_mountpoint || fatal "failed to remove $te_mountpoint"
+}
+
+setup
+run_test
+cleanup
+
+exit 0
diff --git a/usr/src/test/os-tests/tests/tmpfs/tmpfs_full.c b/usr/src/test/os-tests/tests/tmpfs/tmpfs_full.c
new file mode 100644
index 0000000000..6c6037710b
--- /dev/null
+++ b/usr/src/test/os-tests/tests/tmpfs/tmpfs_full.c
@@ -0,0 +1,94 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Given a path to a tmpfs that has already been marked as full, attempt to
+ * perform certain activities on it, all of which should fail with ENOSPC.
+ */
+
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/statvfs.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <strings.h>
+#include <sys/debug.h>
+#include <unistd.h>
+
+int
+main(int argc, const char *argv[])
+{
+	int fd, ret;
+	struct statvfs vfs;
+
+	if (argc != 3) {
+		fprintf(stderr, "test failed: missing path or file\n");
+		return (1);
+	}
+
+	if ((fd = open(argv[1], O_RDONLY)) < 0) {
+		fprintf(stderr, "test failed: failed to open root %s: %s\n",
+		    argv[1], strerror(errno));
+		return (1);
+	}
+
+	if (fstatvfs(fd, &vfs) != 0) {
+		fprintf(stderr, "test failed: failed to stat vfs for %s: %s\n",
+		    argv[1], strerror(errno));
+		return (1);
+	}
+
+	if (strncmp("tmpfs", vfs.f_basetype, FSTYPSZ) != 0) {
+		fprintf(stderr, "test failed: asked to run on non-tmpfs\n");
+		return (1);
+	}
+
+	/*
+	 * Once a few additional bugs in tmpfs are fixed, we should double check
+	 * and make sure that the free space here is actually zero before
+	 * continuing.
+	 */
+
+	/*
+	 * Go through operations that would create nodes and make sure that they
+	 * all fail.
+	 */
+
+	ret = openat(fd, "Mnemosyne", O_RDWR | O_CREAT, 0755);
+	VERIFY3S(ret, ==, -1);
+	VERIFY3S(errno, ==, ENOSPC);
+
+	ret = mkdirat(fd, "Euterpe", 0775);
+	VERIFY3S(ret, ==, -1);
+	VERIFY3S(errno, ==, ENOSPC);
+
+	ret = symlinkat("/dev/null", fd, "Melpomene");
+	VERIFY3S(ret, ==, -1);
+	VERIFY3S(errno, ==, ENOSPC);
+
+	ret = linkat(fd, argv[2], fd, "Urania", 0);
+	VERIFY3S(ret, ==, -1);
+	VERIFY3S(errno, ==, ENOSPC);
+
+	/*
+	 * Make sure we can't create open extended attributes.
+	 */
+	ret = openat(fd, "Lethe", O_RDWR | O_CREAT | O_XATTR);
+	VERIFY3S(ret, ==, -1);
+	VERIFY3S(errno, ==, ENOSPC);
+
+	return (0);
+}
diff --git a/usr/src/test/test-runner/cmd/run b/usr/src/test/test-runner/cmd/run
index 678f74f4e1..779141692e 100644
--- a/usr/src/test/test-runner/cmd/run
+++ b/usr/src/test/test-runner/cmd/run
@@ -12,6 +12,7 @@
 #
 
 #
+# Copyright 2018 Joyent, Inc.
 # Copyright (c) 2012, 2016 by Delphix. All rights reserved.
 # Copyright (c) 2017, Chris Fraire <cfraire@me.com>.
 # Copyright 2018 Joyent, Inc.
@@ -38,6 +39,7 @@ BASEDIR = '/var/tmp/test_results'
 KILL = '/usr/bin/kill'
 TRUE = '/usr/bin/true'
 SUDO = '/usr/bin/sudo'
+SU = '/usr/bin/su'
 
 # Custom class to reopen the log file in case it is forcibly closed by a test.
 class WatchedFileHandlerClosed(WatchedFileHandler):
@@ -165,7 +167,21 @@ class Cmd(object):
         sudo is required, this user was verified previously.
         """
         self.killed = True
-        do_sudo = len(self.user) != 0
+        cur_user = getpwuid(os.getuid()).pw_name
+
+        #
+        # The test runs in a child process of the process performing
+        # the kill and this child process may be owned by a different
+        # user (specified by self.user). If this is the case, and the
+        # parent process is not running as root, then sudo must be
+        # used. The verify_user function should prevent us from ever
+        # getting here on a system which doesn't have sudo.
+        #
+        if len(self.user) != 0 and self.user != cur_user and cur_user != 'root':
+            do_sudo = True
+        else:
+            do_sudo = False
+
         signal = '-TERM'
 
         cmd = [SUDO, KILL, signal, str(proc.pid)]
@@ -181,15 +197,23 @@ class Cmd(object):
     def update_cmd_privs(self, cmd, user):
         """
         If a user has been specified to run this Cmd and we're not already
-        running as that user, prepend the appropriate sudo command to run
-        as that user.
+        running as that user, prepend the appropriate sudo command to
+        run as that user. If running as root use su instead. The
+        verify_user function should prevent us from ever getting here
+        on a system which doesn't have sudo.
+
         """
-        me = getpwuid(os.getuid())
 
-        if not user or user is me:
+        cur_user = getpwuid(os.getuid()).pw_name
+
+        if not user or user == cur_user:
             return cmd
 
-        ret = '%s -E -u %s %s' % (SUDO, user, cmd)
+        if cur_user == 'root':
+            ret = '%s %s -c %s' % (SU, user, cmd)
+        else:
+            ret = '%s -E -u %s %s' % (SUDO, user, cmd)
+
         return ret.split(' ')
 
     def collect_output(self, proc):
@@ -750,14 +774,28 @@ def verify_file(pathname):
 
 def verify_user(user, logger):
     """
-    Verify that the specified user exists on this system, and can execute
-    sudo without being prompted for a password.
+    Verify that the specified user exists on this system, and can
+    execute sudo without being prompted for a password. If the user
+    executing the test is the same as the requested user then this
+    check is skipped. If the user executing the test is root this
+    check is skipped as su can be used instead.
     """
+
     testcmd = [SUDO, '-n', '-u', user, TRUE]
 
     if user in Cmd.verified_users:
         return True
 
+    cur_user = getpwuid(os.getuid()).pw_name
+
+    if user == cur_user or cur_user == 'root':
+        Cmd.verified_users.append(user)
+        return True
+
+    if not os.path.isfile(SUDO):
+        logger.info("Warning: this test requires sudo but it doesn't exist.")
+        return False
+
     try:
         _ = getpwnam(user)
     except KeyError:
diff --git a/usr/src/test/util-tests/runfiles/default.run b/usr/src/test/util-tests/runfiles/default.run
index 1b0077b748..b8dd6e36bf 100644
--- a/usr/src/test/util-tests/runfiles/default.run
+++ b/usr/src/test/util-tests/runfiles/default.run
@@ -27,10 +27,18 @@ outputdir = /var/tmp/test_results
 [/opt/util-tests/tests/printf_test]
 [/opt/util-tests/tests/allowed-ips]
 [/opt/util-tests/tests/set-linkprop]
+[/opt/util-tests/tests/show-overlay-exit]
+[/opt/util-tests/tests/vnic-mtu]
+[/opt/util-tests/tests/bunyan/bunyan]
 [/opt/util-tests/tests/libsff/libsff]
 
 [/opt/util-tests/tests/xargs_test]
 
+[/opt/util-tests/tests/mergeq/mqt]
+[/opt/util-tests/tests/mergeq/wqt]
+
+[/opt/util-tests/tests/dis/distest]
+
 [/opt/util-tests/tests/libnvpair_json]
 tests = ['json_00_blank', 'json_01_boolean', 'json_02_numbers',
     'json_03_empty_arrays', 'json_04_number_arrays', 'json_05_strings',
diff --git a/usr/src/test/util-tests/tests/Makefile b/usr/src/test/util-tests/tests/Makefile
index 7eb4a5fe6c..336ec7e765 100644
--- a/usr/src/test/util-tests/tests/Makefile
+++ b/usr/src/test/util-tests/tests/Makefile
@@ -15,6 +15,7 @@
 # Copyright 2014 Nexenta Systems, Inc. All rights reserved.
 #
 
-SUBDIRS = date dis dladm iconv libnvpair_json libsff printf xargs grep_xpg4
+SUBDIRS = date dis dladm iconv libnvpair_json libsff printf xargs bunyan \
+	 mergeq workq grep_xpg4
 
 include $(SRC)/test/Makefile.com
diff --git a/usr/src/test/util-tests/tests/bunyan/Makefile b/usr/src/test/util-tests/tests/bunyan/Makefile
new file mode 100644
index 0000000000..5f58bf1614
--- /dev/null
+++ b/usr/src/test/util-tests/tests/bunyan/Makefile
@@ -0,0 +1,68 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include $(SRC)/Makefile.master
+
+ROOTOPTPKG = $(ROOT)/opt/util-tests
+TESTDIR = $(ROOTOPTPKG)/tests/bunyan
+TESTBIN = $(ROOTOPTPKG)/bin
+
+PROG = btest
+
+SCRIPTS = \
+	bunyan
+
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/test/Makefile.com
+
+OBJS = $(PROG:%=%.o)
+SRCS = $(OBJS:%.o=%.c)
+
+CMDS = $(PROG:%=$(TESTBIN)/%) $(SCRIPTS:%=$(TESTDIR)/%)
+$(CMDS) := FILEMODE = 0555
+
+DIRS = $(TESTDIR) $(TESTBIN)
+
+LDLIBS += -lbunyan
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+install: all $(CMDS)
+
+lint:
+
+clobber: clean
+	-$(RM) $(PROG)
+
+clean:
+	-$(RM) $(OBJS)
+
+$(CMDS): $(DIRS)
+
+$(DIRS):
+	$(INS.dir)
+
+$(TESTDIR)/%: %.ksh
+	$(INS.rename)
+
+$(TESTDIR)/%: %
+	$(INS.file)
+
+$(TESTBIN)/%: %
+	$(INS.file)
diff --git a/usr/src/test/util-tests/tests/bunyan/btest.c b/usr/src/test/util-tests/tests/bunyan/btest.c
new file mode 100644
index 0000000000..f6be13afa2
--- /dev/null
+++ b/usr/src/test/util-tests/tests/bunyan/btest.c
@@ -0,0 +1,316 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014, Joyent, Inc.
+ */
+
+#include <stdio.h>
+#include <assert.h>
+#include <bunyan.h>
+#include <netinet/in.h>
+#include <strings.h>
+
+static void
+create_handles(void)
+{
+	bunyan_logger_t *a, *b, *c;
+
+	assert(bunyan_init("foo", &a) == 0);
+	assert(bunyan_init("foo", &b) == 0);
+	assert(bunyan_init("foo", &c) == 0);
+	bunyan_fini(a);
+	bunyan_fini(b);
+	bunyan_fini(c);
+}
+
+static void
+create_stream(void)
+{
+	bunyan_logger_t *a;
+
+	assert(bunyan_init("foo", &a) == 0);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_stream_add(a, "baz", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == EEXIST);
+	assert(bunyan_stream_add(a, "baz", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == EEXIST);
+	assert(bunyan_stream_remove(a, "baz") == 0);
+	assert(bunyan_stream_remove(a, "baz") == ENOENT);
+	assert(bunyan_stream_remove(a, "foobaz") == ENOENT);
+	assert(bunyan_stream_remove(a, "blah") == ENOENT);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == EEXIST);
+	assert(bunyan_stream_add(a, "baz", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_stream_add(a, "debug", BUNYAN_L_DEBUG,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_stream_add(a, "info", BUNYAN_L_INFO,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_stream_add(a, "warn", BUNYAN_L_WARN,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_stream_add(a, "error", BUNYAN_L_ERROR,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_stream_add(a, "fatal", BUNYAN_L_FATAL,
+	    bunyan_stream_fd, (void *)1) == 0);
+
+	bunyan_fini(a);
+}
+
+static void
+create_key(void)
+{
+	bunyan_logger_t *a;
+	struct in_addr v4;
+	struct in6_addr v6;
+
+	assert(bunyan_init("foo", &a) == 0);
+	assert(bunyan_key_remove(a, "blah") == ENOENT);
+	assert(bunyan_key_add(a, BUNYAN_T_END) == 0);
+
+	assert(bunyan_key_add(a, BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+
+	assert(bunyan_key_remove(a, "s") == 0);
+	assert(bunyan_key_remove(a, "s") == ENOENT);
+	assert(bunyan_key_remove(a, "p") == 0);
+	assert(bunyan_key_remove(a, "p") == ENOENT);
+	assert(bunyan_key_remove(a, "v4") == 0);
+	assert(bunyan_key_remove(a, "v4") == ENOENT);
+	assert(bunyan_key_remove(a, "v6") == 0);
+	assert(bunyan_key_remove(a, "v6") == ENOENT);
+	assert(bunyan_key_remove(a, "b") == 0);
+	assert(bunyan_key_remove(a, "b") == ENOENT);
+	assert(bunyan_key_remove(a, "i32") == 0);
+	assert(bunyan_key_remove(a, "i32") == ENOENT);
+	assert(bunyan_key_remove(a, "i64") == 0);
+	assert(bunyan_key_remove(a, "i64") == ENOENT);
+	assert(bunyan_key_remove(a, "u32") == 0);
+	assert(bunyan_key_remove(a, "u32") == ENOENT);
+	assert(bunyan_key_remove(a, "u64") == 0);
+	assert(bunyan_key_remove(a, "u64") == ENOENT);
+	assert(bunyan_key_remove(a, "d") == 0);
+	assert(bunyan_key_remove(a, "d") == ENOENT);
+	assert(bunyan_key_remove(a, "i64s") == 0);
+	assert(bunyan_key_remove(a, "i64s") == ENOENT);
+	assert(bunyan_key_remove(a, "u64s") == 0);
+	assert(bunyan_key_remove(a, "u64s") == ENOENT);
+
+	bunyan_fini(a);
+}
+
+static void
+bad_level(void)
+{
+	bunyan_logger_t *a;
+
+	assert(bunyan_init("bad level", &a) == 0);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_TRACE - 1,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_TRACE + 1,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_DEBUG - 1,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_INFO + 1,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_WARN - 1,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_ERROR + 1,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+	assert(bunyan_stream_add(a, "bar", BUNYAN_L_FATAL - 1,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+	assert(bunyan_stream_add(a, "bar", -5,
+	    bunyan_stream_fd, (void *)1) == EINVAL);
+
+	bunyan_fini(a);
+}
+
+static void
+basic_log(void)
+{
+	bunyan_logger_t *a;
+
+	assert(bunyan_init("basic", &a) == 0);
+	assert(bunyan_stream_add(a, "foo", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_trace(a, "trace", BUNYAN_T_END) == 0);
+	assert(bunyan_debug(a, "debug", BUNYAN_T_END) == 0);
+	assert(bunyan_info(a, "info", BUNYAN_T_END) == 0);
+	assert(bunyan_warn(a, "warn", BUNYAN_T_END) == 0);
+	assert(bunyan_error(a, "error", BUNYAN_T_END) == 0);
+	assert(bunyan_fatal(a, "fatal", BUNYAN_T_END) == 0);
+
+	bunyan_fini(a);
+}
+
+static void
+crazy_log(void)
+{
+	bunyan_logger_t *a;
+	struct in_addr v4;
+	struct in6_addr v6;
+
+	bzero(&v4, sizeof (struct in_addr));
+	bzero(&v6, sizeof (struct in6_addr));
+
+	assert(bunyan_init("basic", &a) == 0);
+	assert(bunyan_stream_add(a, "foo", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_trace(a, "trace", BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+	assert(bunyan_debug(a, "debug", BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+	assert(bunyan_info(a, "info", BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+	assert(bunyan_warn(a, "warn", BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+	assert(bunyan_error(a, "error", BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+	assert(bunyan_fatal(a, "fatal", BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+
+	bunyan_fini(a);
+}
+
+static void
+child_log(void)
+{
+	bunyan_logger_t *a, *child;
+	struct in_addr v4;
+	struct in6_addr v6;
+
+	bzero(&v4, sizeof (struct in_addr));
+	bzero(&v6, sizeof (struct in6_addr));
+
+	assert(bunyan_init("child", &a) == 0);
+	assert(bunyan_stream_add(a, "foo", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_child(a, &child,  BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+
+	assert(bunyan_key_remove(a, "p") == ENOENT);
+
+	bunyan_fini(a);
+	assert(bunyan_trace(child, "trace", BUNYAN_T_END) == 0);
+	assert(bunyan_debug(child, "debug", BUNYAN_T_END) == 0);
+	assert(bunyan_info(child, "info", BUNYAN_T_END) == 0);
+	assert(bunyan_warn(child, "warn", BUNYAN_T_END) == 0);
+	assert(bunyan_error(child, "error", BUNYAN_T_END) == 0);
+	assert(bunyan_fatal(child, "fatal", BUNYAN_T_END) == 0);
+
+	assert(bunyan_key_remove(child, "p") == 0);
+
+	bunyan_fini(child);
+}
+
+static void
+crazy_child(void)
+{
+	bunyan_logger_t *a, *child;
+	struct in_addr v4;
+	struct in6_addr v6;
+
+	bzero(&v4, sizeof (struct in_addr));
+	bzero(&v6, sizeof (struct in6_addr));
+
+	assert(bunyan_init("crazy child", &a) == 0);
+	assert(bunyan_stream_add(a, "foo", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_key_add(a, BUNYAN_T_STRING, "s", "foo",
+	    BUNYAN_T_POINTER, "p", (void *)a, BUNYAN_T_IP, "v4", &v4,
+	    BUNYAN_T_IP6, "v6", &v6, BUNYAN_T_BOOLEAN, "b", B_TRUE,
+	    BUNYAN_T_INT32, "i32", 69, BUNYAN_T_INT64, "i64", (uint64_t)6969,
+	    BUNYAN_T_UINT32, "u32", 23, BUNYAN_T_UINT64, "u64", (uint64_t)2323,
+	    BUNYAN_T_DOUBLE, "d", 3.14,
+	    BUNYAN_T_INT64STR, "i64s", (uint64_t)12345,
+	    BUNYAN_T_UINT64STR, "u64s", (uint64_t)54321, BUNYAN_T_END) == 0);
+	assert(bunyan_child(a, &child, BUNYAN_T_END) == 0);
+	bunyan_fini(a);
+
+	assert(bunyan_stream_remove(child, "foo") == 0);
+	assert(bunyan_stream_add(child, "bar", BUNYAN_L_TRACE,
+	    bunyan_stream_fd, (void *)1) == 0);
+	assert(bunyan_key_remove(child, "u64s") == 0);
+	assert(bunyan_trace(child, "trace", BUNYAN_T_END) == 0);
+	assert(bunyan_debug(child, "debug", BUNYAN_T_END) == 0);
+	assert(bunyan_info(child, "info", BUNYAN_T_END) == 0);
+	assert(bunyan_warn(child, "warn", BUNYAN_T_END) == 0);
+	assert(bunyan_error(child, "error", BUNYAN_T_END) == 0);
+	assert(bunyan_fatal(child, "fatal", BUNYAN_T_END) == 0);
+
+	bunyan_fini(child);
+}
+
+int
+main(void)
+{
+	create_handles();
+	create_stream();
+	create_key();
+	bad_level();
+	basic_log();
+	crazy_log();
+	child_log();
+	crazy_child();
+
+	return (0);
+}
diff --git a/usr/src/test/util-tests/tests/bunyan/bunyan.ksh b/usr/src/test/util-tests/tests/bunyan/bunyan.ksh
new file mode 100644
index 0000000000..4ec0f4bd62
--- /dev/null
+++ b/usr/src/test/util-tests/tests/bunyan/bunyan.ksh
@@ -0,0 +1,26 @@
+#! /usr/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014, Joyent, Inc. 
+#
+
+#
+# Simple wrapper for the classic test.out
+#
+
+set -o errexit
+
+btest_root=$(dirname $0)/../..
+btest_bin=$btest_root/bin/btest
+
+LD_PRELOAD=libumem.so UMEM_DEBUG=default $btest_bin >/dev/null
diff --git a/usr/src/test/util-tests/tests/dladm/Makefile b/usr/src/test/util-tests/tests/dladm/Makefile
index e37ae56072..2ce969fcc4 100644
--- a/usr/src/test/util-tests/tests/dladm/Makefile
+++ b/usr/src/test/util-tests/tests/dladm/Makefile
@@ -17,7 +17,7 @@ include $(SRC)/cmd/Makefile.cmd
 include $(SRC)/test/Makefile.com
 
 ROOTOPTPKG = $(ROOT)/opt/util-tests/tests
-PROG = allowed-ips set-linkprop
+PROG = allowed-ips set-linkprop show-overlay-exit vnic-mtu
 
 ROOTPROG = $(PROG:%=$(ROOTOPTPKG)/%)
 
diff --git a/usr/src/test/util-tests/tests/dladm/allowed-cids.ksh b/usr/src/test/util-tests/tests/dladm/allowed-cids.ksh
new file mode 100644
index 0000000000..9b62962baf
--- /dev/null
+++ b/usr/src/test/util-tests/tests/dladm/allowed-cids.ksh
@@ -0,0 +1,95 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2017 Joyent, Inc.
+#
+
+source ./common.ksh
+
+property="allowed-dhcp-cids"
+
+setup
+
+# Valid hexadecimal strings
+epass 0x1234
+epass 0x123456789abcdef0
+epass 0x123456789abcdef0
+
+# Hex strings w/ an odd number of characters are not allowed
+efail 0x0
+efail 0x1
+efail 0x1fa
+efail 0xfba39e2
+
+# Invalid hexadecimal strings
+efail 0xz
+efail 0x01234567q12
+efail 0x=+
+efail 0x-1
+efail 0x1,2,3
+
+# Valid RFC 3315 DUID strings
+
+## DUID-LLT
+epass 1.1.1234.90:b8:d0:81:91:30
+epass 1.1.1512434853.90:b8:d0:81:91:30
+epass 1.1.28530123.90:b8:d0:81:91:30
+epass 1.6.1512434853.14:10:9f:d0:5b:d3
+
+## DUID-EN
+epass 2.9.0CC084D303000912
+epass 2.9.0cc084d303000912
+epass 2.32473.45ab
+epass 2.38678.0123abcd
+
+## DUID-LL
+epass 3.1.90:b8:d0:81:91:30
+epass 3.1.90:b8:d0:4b:c7:3b
+epass 3.1.2:8:20:a4:4d:ee
+epass 3.6.14:10:9f:d0:5b:d3
+
+# Invalid RFC 3315 DUID strings
+
+## DUID-LLT
+efail 1.1.12a34.90:b8:d0:81:91:30
+efail 1.1.15-33.90:b8:d0:81:91:30
+efail 1.1.98+123.90:b8:d0:81:91:30
+efail 3.z.1512434853.14:10:9f:d0:5b:d3
+efail 3.6.1512434853.q4:10:9f:d0:5b:d3
+
+## DUID-EN
+efail 2.32473.45a
+efail 2.9.Z
+efail 2.9.-12
+efail 2.QZ4.45a
+efail 2.38d78.0123abcd
+
+## DUID-LL
+efail 3.wy.90:b8:d0:81:91:30
+efail 3.1.90:z8:di:ob:c7:3b
+efail 3.1.5.2:8:20:a4:4d:ee
+
+## Uknown DUID forms
+efail 4.1.45a
+efail 9.1.45a
+efail 23.1.45a
+
+# Random strings of bytes are also accepted,
+# if they don't have the above prefixes.
+epass 1234
+epass abcdef
+epass qsxasdasdfgfdgkj123455
+epass 0x
+
+cleanup
+printf "TEST PASS: $ai_arg0\n"
diff --git a/usr/src/test/util-tests/tests/dladm/allowed-ips.ksh b/usr/src/test/util-tests/tests/dladm/allowed-ips.ksh
index 866b8c7966..4802f86286 100644
--- a/usr/src/test/util-tests/tests/dladm/allowed-ips.ksh
+++ b/usr/src/test/util-tests/tests/dladm/allowed-ips.ksh
@@ -11,47 +11,12 @@
 #
 
 #
-# Copyright (c) 2014, Joyent, Inc.
+# Copyright 2016 Joyent, Inc.
 #
 
-ai_arg0="$(basename $0)"
-ai_stub="teststub$$"
-ai_vnic="testvnic$$"
+source ./common.ksh
 
-function fatal
-{
-	typeset msg="$*"
-	[[ -z "$msg" ]] && msg="failed"
-	echo "TEST_FAIL: $vt_arg0: $msg" >&2
-	exit 1
-}
-
-function setup
-{
-	dladm create-etherstub $ai_stub || fatal "failed to create etherstub"
-	dladm create-vnic -l $ai_stub $ai_vnic || fatal "failed to create vnic"
-}
-
-function cleanup
-{
-	dladm delete-vnic $ai_vnic || fatal "failed to remove vnic"
-	dladm delete-etherstub $ai_stub || fatal "failed to remove etherstub"
-}
-
-function runtest
-{
-	dladm set-linkprop -p allowed-ips="$@" $ai_vnic 2>/dev/null
-}
-
-function epass
-{
-	runtest $* || fatal "allowed-ips=$* failed, expected success\n"
-}
-
-function efail
-{
-	runtest $* && fatal "allowed-ips=$* succeeded, expected failure\n"
-}
+property="allowed-ips"
 
 #
 # Run through all IPv6 prefixes for validity with a token prefix
@@ -204,4 +169,4 @@ epass fe80::/15
 epass fe82::/15
 
 cleanup
-printf "TEST PASS: $ai_arg0"
+printf "TEST PASS: $ai_arg0\n"
diff --git a/usr/src/test/util-tests/tests/dladm/common.ksh b/usr/src/test/util-tests/tests/dladm/common.ksh
new file mode 100644
index 0000000000..e5301d0a52
--- /dev/null
+++ b/usr/src/test/util-tests/tests/dladm/common.ksh
@@ -0,0 +1,57 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2017 Joyent, Inc.
+#
+
+ai_arg0="$(basename $0)"
+ai_stub="teststub$$"
+ai_vnic="testvnic$$"
+
+typeset property
+
+function fatal
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "TEST_FAIL: $ai_arg0: $msg" >&2
+	exit 1
+}
+
+function setup
+{
+	dladm create-etherstub $ai_stub || fatal "failed to create etherstub"
+	dladm create-vnic -l $ai_stub $ai_vnic || fatal "failed to create vnic"
+}
+
+function cleanup
+{
+	dladm delete-vnic $ai_vnic || fatal "failed to remove vnic"
+	dladm delete-etherstub $ai_stub || fatal "failed to remove etherstub"
+}
+
+function runtest
+{
+	[[ -z "$property" ]] && fatal "missing property to set"
+	dladm set-linkprop -p $property="$@" $ai_vnic 2>/dev/null
+}
+
+function epass
+{
+	runtest $* || fatal "$property=$* failed, expected success\n"
+}
+
+function efail
+{
+	runtest $* && fatal "$property=$* succeeded, expected failure\n"
+}
diff --git a/usr/src/test/util-tests/tests/dladm/dynamic-methods.ksh b/usr/src/test/util-tests/tests/dladm/dynamic-methods.ksh
new file mode 100644
index 0000000000..4ed64a92b4
--- /dev/null
+++ b/usr/src/test/util-tests/tests/dladm/dynamic-methods.ksh
@@ -0,0 +1,45 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2017 Joyent, Inc.
+#
+
+source ./common.ksh
+
+property="dynamic-methods"
+
+setup
+
+# All valid values on their own
+epass slaac
+epass dhcpv4
+epass dhcpv6
+epass addrconf
+
+# Combinations of values
+epass slaac,dhcpv4
+epass slaac,dhcpv6
+epass dhcpv4,dhcpv6
+epass dhcpv4,addrconf
+epass dhcpv4,dhcpv6,slaac
+
+# Illegal values
+efail dhcpv8
+efail slaac,dhcpv8
+efail slack
+efail ipv6
+efail dhcp
+efail dhcpv
+
+cleanup
+printf "TEST PASS: $ai_arg0\n"
diff --git a/usr/src/test/util-tests/tests/dladm/show-overlay-exit.ksh b/usr/src/test/util-tests/tests/dladm/show-overlay-exit.ksh
new file mode 100644
index 0000000000..8a551a8182
--- /dev/null
+++ b/usr/src/test/util-tests/tests/dladm/show-overlay-exit.ksh
@@ -0,0 +1,82 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2017, Joyent, Inc.
+#
+
+soe_arg0="$(basename $0)"
+
+soe_overlay="soe_overlay$$"
+soe_dummy_ip="169.254.0.0"
+
+soe_port="2000"
+soe_vnetid=20
+soe_encap="vxlan"
+soe_search="direct"
+
+soe_etherstub="soe_teststub$$"
+
+function fatal
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "TEST_FAIL: $vt_arg0: $msg" >&2
+	dladm delete-overlay $soe_overlay
+	dladm delete-etherstub $soe_etherstub
+	exit 1
+}
+
+function setup
+{
+	dladm create-overlay -v $soe_vnetid -e $soe_encap -s $soe_search \
+	    -p vxlan/listen_ip=$soe_dummy_ip -p direct/dest_ip=$soe_dummy_ip \
+	    -p direct/dest_port=$soe_port $soe_overlay || \
+	    fatal "failed to create overlay"
+
+	dladm create-etherstub $soe_etherstub || \
+	    fatal "failed to create etherstub"
+}
+
+function cleanup
+{
+	dladm delete-overlay $soe_overlay || \
+	    fatal "failed to remove overlay"
+	dladm delete-etherstub $soe_etherstub || \
+	    fatal "failed to remove etherstub"
+}
+
+function runtest
+{
+	dladm show-overlay $* > /dev/null 2>&1
+}
+
+function epass
+{
+	runtest $* || fatal "show-overlay=$* failed, expected success\n"
+}
+
+function efail
+{
+	runtest $* && fatal "show-overlay=$* succeeded, expected failure\n"
+}
+
+setup
+
+epass $soe_overlay
+efail $soe_etherstub
+efail $soe_etherstub $soe_overlay
+efail $soe_overlay $soe_etherstub
+
+cleanup
+
+printf "TEST PASS: $soe_arg0"
diff --git a/usr/src/test/util-tests/tests/dladm/vnic-mtu.ksh b/usr/src/test/util-tests/tests/dladm/vnic-mtu.ksh
new file mode 100644
index 0000000000..cfb48e2e65
--- /dev/null
+++ b/usr/src/test/util-tests/tests/dladm/vnic-mtu.ksh
@@ -0,0 +1,116 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# The purpose of this is to test the MTU property on VNICs, using both
+# temporary and persistent properties. To do this, we create an
+# Etherstub and then create various VNICs on top of it.
+#
+
+vm_arg0="$(basename $0)"
+vm_stub="teststub$$"
+vm_vnic="testvnic$$"
+
+VM_MTU_MIN=576
+VM_MTU_MAX=9000
+
+fatal()
+{
+	typeset msg="$*"
+	[[ -z "$msg" ]] && msg="failed"
+	echo "TEST_FAIL: $vm_arg0: $msg" >&2
+
+	# Try to clean up just in case
+	dladm delete-vnic $vm_vnic 2>/dev/null
+	dladm delete-etherstub $vm_stub 2>/dev/null
+	exit 1
+}
+
+#
+# Validate that the MTU of the datalink dev has the MTU that we expect
+#
+validate_mtu()
+{
+	typeset dev=$1
+	typeset mtu=$2
+	typeset val
+
+	[[ -z "$dev" ]] && fatal "missing required device"
+	[[ -z "$mtu" ]] && fatal "missing required mtu"
+	val=$(dladm show-linkprop -c -p mtu -o value $dev)
+	[[ $? -eq 0 ]] || fatal "failed to get MTU for $dev"
+	(( $val == $mtu )) || fatal \
+	    "mtu mismatch on $dev: expected $mtu, got $val"
+}
+
+delete_stub()
+{
+	dladm delete-etherstub $vm_stub || fatal \
+	    "failed to delete stub $vm_stub"
+}
+
+create_stub()
+{
+	dladm create-etherstub $vm_stub || fatal \
+	    "failed to create stub"
+	validate_mtu $vm_stub $VM_MTU_MAX
+}
+
+delete_vnic()
+{
+	dladm delete-vnic $vm_vnic || fatal "failed to delete vnic $vm_vnic"
+}
+
+test_vnic_pass()
+{
+	typeset mtu=$1
+	typeset flags=$2
+
+	[[ -z "$mtu" ]] && fatal "missing required mtu"
+	dladm create-vnic $flags -l $vm_stub -p mtu=$mtu $vm_vnic || fatal \
+	    "failed to create vnic: $vm_vnic"
+	validate_mtu "$vm_vnic" "$mtu"
+	delete_vnic
+}
+
+test_vnic_fail()
+{
+	typeset mtu=$1
+	typeset flags=$2
+
+	[[ -z "$mtu" ]] && fatal "missing required mtu"
+	dladm create-vnic $flags -l $vm_stub -p mtu=$mtu \
+	    $vm_vnic 2>/dev/null && fatal \
+	    "created vnic with mtu $mtu, but failure expected"
+}
+
+test_pass()
+{
+	typeset flags=$1
+
+	create_stub
+	test_vnic_pass 1500 $flags
+	test_vnic_pass 1400 $flags
+	test_vnic_pass $VM_MTU_MIN $flags
+	test_vnic_pass $VM_MTU_MAX $flags
+	test_vnic_fail $((($VM_MTU_MIN - 1))) $flags
+	test_vnic_fail $((($VM_MTU_MAX + 1))) $flags
+	delete_stub
+}
+
+test_pass "-t"
+test_pass
+echo "TEST PASS: $vm_arg0"
diff --git a/usr/src/test/util-tests/tests/libnvpair_json/Makefile b/usr/src/test/util-tests/tests/libnvpair_json/Makefile
index d1d3585b02..3b48e0b630 100644
--- a/usr/src/test/util-tests/tests/libnvpair_json/Makefile
+++ b/usr/src/test/util-tests/tests/libnvpair_json/Makefile
@@ -10,14 +10,14 @@
 #
 
 #
-# Copyright (c) 2014 Joyent, Inc.
+# Copyright 2015 Joyent, Inc.
 #
 
 include $(SRC)/Makefile.master
 
 ROOTOPTPKG = $(ROOT)/opt/util-tests
 TESTDIR = $(ROOTOPTPKG)/tests/libnvpair_json
-ROOTBINDIR = $(ROOTOPTPKG)/bin
+TESTBIN = $(ROOTOPTPKG)/bin
 
 PROG = print_json
 
@@ -38,9 +38,11 @@ include $(SRC)/test/Makefile.com
 OBJS = $(PROG:%=%.o)
 SRCS = $(OBJS:%.o=%.c)
 
-CMDS = $(PROG:%=$(ROOTBINDIR)/%) $(SCRIPTS:%=$(TESTDIR)/%)
+CMDS = $(PROG:%=$(TESTBIN)/%) $(SCRIPTS:%=$(TESTDIR)/%)
 $(CMDS) := FILEMODE = 0555
 
+DIRS = $(TESTDIR) $(TESTBIN)
+
 LDLIBS += -lnvpair
 
 LINTFLAGS += -erroff=E_FUNC_ARG_UNUSED
@@ -61,16 +63,13 @@ clobber: clean
 clean:
 	-$(RM) $(OBJS)
 
-$(CMDS): $(TESTDIR) $(PROG)
+$(CMDS): $(DIRS)
 
-$(ROOTBINDIR):
-	$(INS.dir)
-
-$(ROOTBINDIR)/%: %
-	$(INS.file)
-
-$(TESTDIR):
+$(DIRS):
 	$(INS.dir)
 
 $(TESTDIR)/%: %.ksh
 	$(INS.rename)
+
+$(TESTBIN)/%: %
+	$(INS.file)
diff --git a/usr/src/test/util-tests/tests/libnvpair_json/json_08_large_data.ksh b/usr/src/test/util-tests/tests/libnvpair_json/json_08_large_data.ksh
new file mode 100644
index 0000000000..ca19e10d06
--- /dev/null
+++ b/usr/src/test/util-tests/tests/libnvpair_json/json_08_large_data.ksh
@@ -0,0 +1,37 @@
+#!/bin/ksh
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015, Joyent, Inc.
+#
+
+DIR=$(dirname $(whence $0))
+. ${DIR}/json_common
+
+BASELINE="$(cat <<EOF
+{\
+"o":[\
+$(for i in {1..50}; do
+    printf '"%s",' 'some_very_big_string_that_takes_up_space'
+done)\
+"end"\
+]\
+}
+EOF)"
+
+OUTPUT="$(${DIR}/../../bin/print_json <<-EOF
+add_string_array "o" $(for i in {1..50}; do
+    printf '"%s" ' 'some_very_big_string_that_takes_up_space'
+done)"end";
+EOF)"
+
+complete
diff --git a/usr/src/test/util-tests/tests/libnvpair_json/print_json.c b/usr/src/test/util-tests/tests/libnvpair_json/print_json.c
index e34ae8f7b1..9ac19b1bd1 100644
--- a/usr/src/test/util-tests/tests/libnvpair_json/print_json.c
+++ b/usr/src/test/util-tests/tests/libnvpair_json/print_json.c
@@ -814,7 +814,7 @@ main(int argc, char **argv)
 	/*
 	 * Print the resultant list, and a terminating newline:
 	 */
-	if (nvlist_print_json(stdout, lw->lw_nvl[0]) != 0 ||
+	if (nvlist_print_json(stdout, lw->lw_nvl[0]) < 0 ||
 	    fprintf(stdout, "\n") < 0)
 		goto out;
 
diff --git a/usr/src/test/util-tests/tests/mergeq/Makefile b/usr/src/test/util-tests/tests/mergeq/Makefile
new file mode 100644
index 0000000000..ef6c6abb99
--- /dev/null
+++ b/usr/src/test/util-tests/tests/mergeq/Makefile
@@ -0,0 +1,64 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include $(SRC)/Makefile.master
+
+ROOTOPTPKG = $(ROOT)/opt/util-tests
+TESTDIR = $(ROOTOPTPKG)/tests/mergeq
+
+PROG = mqt
+OBJS = mqt.o mergeq.o
+
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/cmd/Makefile.ctf
+include $(SRC)/test/Makefile.com
+
+CMDS = $(PROG:%=$(TESTDIR)/%)
+$(CMDS) := FILEMODE = 0555
+
+CPPFLAGS += -I$(SRC)/lib/mergeq -D_REENTRANT
+LDLIBS += -lumem
+
+all: $(PROG)
+
+install: all $(CMDS)
+
+lint: lint_SRCS
+
+clobber: clean
+	-$(RM) $(PROG)
+
+clean:
+	-$(RM) $(OBJS)
+
+%.o: %.c
+	$(COMPILE.c) -o $@ -c $<
+	$(POST_PROCESS_O)
+
+%.o: $(SRC)/lib/mergeq/%.c
+	$(COMPILE.c) -o $@ -c $<
+	$(POST_PROCESS_O)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+$(CMDS): $(TESTDIR) $(PROG)
+
+$(TESTDIR):
+	$(INS.dir)
+
+$(TESTDIR)/%: %
+	$(INS.file)
diff --git a/usr/src/test/util-tests/tests/mergeq/mqt.c b/usr/src/test/util-tests/tests/mergeq/mqt.c
new file mode 100644
index 0000000000..e61e9173d2
--- /dev/null
+++ b/usr/src/test/util-tests/tests/mergeq/mqt.c
@@ -0,0 +1,217 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * mergeq testing routines
+ */
+
+#include <mergeq.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+const char *
+_umem_debug_init()
+{
+	return ("default,verbose");
+}
+
+const char *
+_umem_logging_init(void)
+{
+	return ("fail,contents");
+}
+
+void *
+mergeq_alloc(size_t size)
+{
+	return (malloc(size));
+}
+
+/*ARGSUSED*/
+void
+mergeq_free(void *buf, size_t size)
+{
+	free(buf);
+}
+
+static int
+mqt_int(void *first, void *second, void **outp, void *arg)
+{
+	uintptr_t a, b, c;
+	a = (uintptr_t)first;
+	b = (uintptr_t)second;
+	c = a + b;
+	*outp = (void *)c;
+
+	return (0);
+}
+
+static int
+mqt_append(void *first, void *second, void **outp, void *arg)
+{
+	char *out;
+
+	/* Yes, this leaks, don't worry about it for the test */
+	if (asprintf(&out, "%s%s", first, second) != -1) {
+		*outp = out;
+		return (0);
+	}
+	return (-1);
+}
+
+static int
+mqt_fatal(void *first, void *second, void **outp, void *arg)
+{
+	return (-1);
+}
+
+/*
+ * Test structures and cases. We really want mq_args to be a flexible array
+ * member, but then we cant initialize it. Thus we set a fixed size number of
+ * entries.
+ */
+typedef struct mq_test {
+	const char	*mq_desc;	/* test description/name */
+	mergeq_proc_f	*mq_proc;	/* processing function */
+	int		mq_rval;	/* mergeq_merge return value */
+	int		mq_uerr;	/* user error, if any */
+	boolean_t	mq_strcmp;	/* use strcmp rather than == */
+	void		*mq_result;	/* expected result */
+	void		**mq_args;	/* argument array */
+} mq_test_t;
+
+static void *mqt_empty_args[] = { NULL };
+static void *mqt_single_args[] = { (void *)42, NULL };
+static void *mqt_double_args[] = { (void *)42, (void *)27, NULL };
+static void *mqt_wrap_args[] = {
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, NULL
+};
+static void *mqt_grow_args[] = {
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, NULL
+};
+static void *mqt_order_args[] = { "l", "e", "g", "e", "n", "d", " ", "o", "f",
+	" ", "z", "e", "l", "d", "a", NULL };
+
+
+static mq_test_t mq_tests[] = {
+	{ "empty", mqt_int, 0, 0, B_FALSE, NULL, mqt_empty_args },
+	{ "single", mqt_int, 0, 0, B_FALSE, (void *)42, mqt_single_args },
+	{ "double", mqt_int, 0, 0, B_FALSE, (void *)69, mqt_double_args },
+	{ "wrap", mqt_int, 0, 0, B_FALSE, (void *)64, mqt_wrap_args },
+	{ "grow", mqt_int, 0, 0, B_FALSE, (void *)92, mqt_grow_args },
+	{ "fatal", mqt_fatal, MERGEQ_UERROR, -1, B_FALSE, NULL,
+	    mqt_double_args },
+	{ "order", mqt_append, 0, 0, B_TRUE, "alegend of zeld", mqt_order_args }
+};
+
+#define	NMQ_TESTS (sizeof (mq_tests) / sizeof (mq_test_t))
+
+static void
+mq_test_run(mergeq_t *mqp, mq_test_t *mqt)
+{
+	int ret, err;
+	void **itemp = mqt->mq_args;
+	void *out;
+
+	while (*itemp != NULL) {
+		if ((ret = mergeq_add(mqp, *itemp)) != 0) {
+			(void) fprintf(stderr,
+			    "test %s: failed to add item: %s\n",
+			    mqt->mq_desc, strerror(errno));
+			exit(1);
+		}
+		itemp++;
+	}
+
+	ret = mergeq_merge(mqp, mqt->mq_proc, NULL, &out, &err);
+	if (ret != mqt->mq_rval) {
+		(void) fprintf(stderr, "test %s: got incorrect rval. "
+		    "Expected %d, got %d\n", mqt->mq_desc, mqt->mq_rval, ret);
+		exit(1);
+	}
+
+	if (ret == MERGEQ_UERROR && err != mqt->mq_uerr) {
+		(void) fprintf(stderr, "test %s: got incorrect user error. "
+		    "Expected %d, got %d\n", mqt->mq_desc, mqt->mq_uerr, err);
+		exit(1);
+	}
+
+	if (ret == 0) {
+		if (mqt->mq_strcmp == B_TRUE &&
+		    strcmp(out, mqt->mq_result) != 0) {
+			(void) fprintf(stderr, "test %s: got unexpected "
+			    "result: %s, expected %s\n", mqt->mq_desc, out,
+			    mqt->mq_result);
+			exit(1);
+		} else if (mqt->mq_strcmp == B_FALSE && out != mqt->mq_result) {
+			(void) fprintf(stderr, "test %s: got unexpected "
+			    "result: %p, expected %p\n", mqt->mq_desc, out,
+			    mqt->mq_result);
+			exit(1);
+		}
+	}
+}
+
+int
+main(void)
+{
+	int ret, i, t;
+	mergeq_t *mqp;
+	int nthreads[] = { 1, 2, 4, 8, 16, 32, 64, 128, 256, -1 };
+
+	for (t = 0; nthreads[t] != -1; t++) {
+		printf("Beginning tests with %d threads\n", nthreads[t]);
+		if ((ret = mergeq_init(&mqp, nthreads[t])) != 0) {
+			fprintf(stderr, "failed to init mergeq: %s\n",
+			    strerror(errno));
+			return (1);
+		}
+
+		for (i = 0; i < NMQ_TESTS; i++) {
+			mq_test_run(mqp, &mq_tests[i]);
+		}
+
+		mergeq_fini(mqp);
+	}
+
+	return (0);
+}
diff --git a/usr/src/test/util-tests/tests/workq/Makefile b/usr/src/test/util-tests/tests/workq/Makefile
new file mode 100644
index 0000000000..ab5455fd86
--- /dev/null
+++ b/usr/src/test/util-tests/tests/workq/Makefile
@@ -0,0 +1,64 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+include $(SRC)/Makefile.master
+
+ROOTOPTPKG = $(ROOT)/opt/util-tests
+TESTDIR = $(ROOTOPTPKG)/tests/mergeq
+
+PROG = wqt
+OBJS = wqt.o workq.o
+
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/cmd/Makefile.ctf
+include $(SRC)/test/Makefile.com
+
+CMDS = $(PROG:%=$(TESTDIR)/%)
+$(CMDS) := FILEMODE = 0555
+
+CPPFLAGS += -I$(SRC)/lib/mergeq -D_REENTRANT
+LDLIBS += -lumem
+
+all: $(PROG)
+
+install: all $(CMDS)
+
+lint: lint_SRCS
+
+clobber: clean
+	-$(RM) $(PROG)
+
+clean:
+	-$(RM) $(OBJS)
+
+%.o: %.c
+	$(COMPILE.c) -o $@ -c $<
+	$(POST_PROCESS_O)
+
+%.o: $(SRC)/lib/mergeq/%.c
+	$(COMPILE.c) -o $@ -c $<
+	$(POST_PROCESS_O)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+$(CMDS): $(TESTDIR) $(PROG)
+
+$(TESTDIR):
+	$(INS.dir)
+
+$(TESTDIR)/%: %
+	$(INS.file)
diff --git a/usr/src/test/util-tests/tests/workq/wqt.c b/usr/src/test/util-tests/tests/workq/wqt.c
new file mode 100644
index 0000000000..bda0b4a9e5
--- /dev/null
+++ b/usr/src/test/util-tests/tests/workq/wqt.c
@@ -0,0 +1,196 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * workq testing routines
+ *
+ * What we want to guarantee is that every function is executed exactly once. To
+ * that end we have the callback function basically increment a global in the
+ * test around a mutex.
+ */
+
+#include <workq.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <thread.h>
+#include <synch.h>
+
+mutex_t wqt_lock = ERRORCHECKMUTEX;
+uintptr_t wqt_count;
+
+const char *
+_umem_debug_init()
+{
+	return ("default,verbose");
+}
+
+const char *
+_umem_logging_init(void)
+{
+	return ("fail,contents");
+}
+
+void *
+workq_alloc(size_t size)
+{
+	return (malloc(size));
+}
+
+/*ARGSUSED*/
+void
+workq_free(void *buf, size_t size)
+{
+	free(buf);
+}
+
+/*ARGSUSED*/
+int
+wqt_fatal(void *item, void *arg)
+{
+	return (-1);
+}
+
+int
+wqt_add(void *item, void *arg)
+{
+	uintptr_t a = (uintptr_t)item;
+
+	mutex_enter(&wqt_lock);
+	wqt_count += a;
+	mutex_exit(&wqt_lock);
+
+	return (0);
+}
+
+typedef struct wq_test {
+	const char	*wq_desc;	/* test description/name */
+	workq_proc_f	*wq_proc;	/* processing function */
+	int		wq_rval;	/* workq_work return value */
+	int		wq_uerr;	/* user error, if any */
+	uintptr_t	wq_sum;		/* expected sum */
+	void		**wq_args;	/* argument array */
+} wq_test_t;
+
+static void *wqt_empty_args[] = { NULL };
+static void *wqt_single_args[] = { (void *)42, NULL };
+static void *wqt_double_args[] = { (void *)42, (void *)27, NULL };
+static void *wqt_wrap_args[] = {
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, NULL
+};
+static void *wqt_grow_args[] = {
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, (void *)1, (void *)1, (void *)1, (void *)1,
+	(void *)1, (void *)1, NULL
+};
+
+static wq_test_t wq_tests[] = {
+	{ "empty", wqt_add, 0, 0, NULL, wqt_empty_args },
+	{ "single", wqt_add, 0, 0, 42, wqt_single_args },
+	{ "double", wqt_add, 0, 0, 69, wqt_double_args },
+	{ "wrap", wqt_add, 0, 0, 64, wqt_wrap_args },
+	{ "grow", wqt_add, 0, 0, 92, wqt_grow_args },
+	{ "fatal", wqt_fatal, WORKQ_UERROR, -1, -1, wqt_double_args }
+};
+
+#define	NWQ_TESTS (sizeof (wq_tests) / sizeof (wq_test_t))
+
+static void
+wq_test_run(workq_t *wqp, wq_test_t *wqt)
+{
+	int ret, err;
+	void **itemp = wqt->wq_args;
+
+	while (*itemp != NULL) {
+		if ((ret = workq_add(wqp, *itemp)) != 0) {
+			(void) fprintf(stderr, "test %s: failed to add item: "
+			    "%s\n", wqt->wq_desc, strerror(errno));
+			exit(1);
+		}
+		itemp++;
+	}
+
+	wqt_count = 0;
+	ret = workq_work(wqp, wqt->wq_proc, NULL, &err);
+	if (ret != wqt->wq_rval) {
+		(void) fprintf(stderr, "test %s: got incorrect rval. "
+		    "Expected %d, got %d (%d)\n", wqt->wq_desc, wqt->wq_rval,
+		    ret, errno);
+		exit(1);
+	}
+
+	if (ret == WORKQ_UERROR && err != wqt->wq_uerr) {
+		(void) fprintf(stderr, "test %s: got incorrect user error. "
+		    "Expected %d, got %d\n", wqt->wq_desc, wqt->wq_uerr, err);
+		exit(1);
+	}
+
+	if (ret == 0 && wqt_count != wqt->wq_sum) {
+		(void) fprintf(stderr, "test %s: got unexpected "
+		    "result: %d, expected %d\n", wqt->wq_desc, wqt_count,
+		    wqt->wq_sum);
+		exit(1);
+	}
+}
+
+int
+main(void)
+{
+	int ret, i, t;
+	workq_t *wqp;
+	int nthreads[] = { 1, 2, 4, 8, 16, 32, 64, 128, 256, -1 };
+
+	for (t = 0; nthreads[t] != -1; t++) {
+		printf("Beginning tests with %d threads\n", nthreads[t]);
+		if ((ret = workq_init(&wqp, nthreads[t])) != 0) {
+			fprintf(stderr, "failed to init workq: %s\n",
+			    strerror(errno));
+			return (1);
+		}
+
+		for (i = 0; i < NWQ_TESTS; i++) {
+			wq_test_run(wqp, &wq_tests[i]);
+		}
+
+		workq_fini(wqp);
+	}
+
+
+	return (0);
+}
diff --git a/usr/src/tools/Makefile b/usr/src/tools/Makefile
index ef9cf113bf..b3ce7df21b 100644
--- a/usr/src/tools/Makefile
+++ b/usr/src/tools/Makefile
@@ -60,6 +60,7 @@ COMMON_SUBDIRS= \
 #
 UNSHIPPED_SUBDIRS = \
 	localedef \
+	man \
 	mandoc \
 	tic \
 	vtfontcvt \
diff --git a/usr/src/tools/README.tools b/usr/src/tools/README.tools
index 8612af43f7..8bb2f4c405 100644
--- a/usr/src/tools/README.tools
+++ b/usr/src/tools/README.tools
@@ -148,6 +148,9 @@ findunref
 	  sort > ~/unref-sparc.out
 	$ comm -12 ~/unref-i386.out ~/unref-sparc.out > ~/unref.out
 
+git-active
+	helper used by webrev to generate file lists for Git workspaces.
+
 hdrchk
 	checks headers for compliance with OS/Net standards (form, includes,
 	C++ guards).
diff --git a/usr/src/tools/ctf/Makefile b/usr/src/tools/ctf/Makefile
index dee410e27c..b6679b2678 100644
--- a/usr/src/tools/ctf/Makefile
+++ b/usr/src/tools/ctf/Makefile
@@ -26,7 +26,7 @@
 
 include ../Makefile.tools
 
-SUBDIRS = cvt dump stabs ctfstrip
+SUBDIRS = cvt stabs ctfstrip libctf ctfdiff ctfmerge ctfdump ctfconvert
 
 .PARALLEL: $(SUBDIRS)
 
@@ -38,6 +38,11 @@ lint	:= TARGET= lint
 
 .KEEP_STATE:
 
+ctfmerge: libctf
+ctfdiff: libctf
+ctfdump: libctf
+ctfconvert: libctf
+
 all clean clobber install lint: dwarf .WAIT $(SUBDIRS)
 
 dwarf $(SUBDIRS): FRC
diff --git a/usr/src/tools/ctf/Makefile.ctf b/usr/src/tools/ctf/Makefile.ctf
index 7c5b041746..0cf32bf1bc 100644
--- a/usr/src/tools/ctf/Makefile.ctf
+++ b/usr/src/tools/ctf/Makefile.ctf
@@ -41,6 +41,7 @@ HDRDIRS= \
 	-I$(SRC) \
 	-I/usr/include \
 	-I$(SRC)/uts/common \
+	-I$(SRC)/common/ctf \
 	-I$(NATIVE_ADJUNCT)/include
 
 CPPFLAGS += $(HDRDIRS)
diff --git a/usr/src/tools/ctf/common/ctf_headers.h b/usr/src/tools/ctf/common/ctf_headers.h
index b00b8fd9a6..a63690be77 100644
--- a/usr/src/tools/ctf/common/ctf_headers.h
+++ b/usr/src/tools/ctf/common/ctf_headers.h
@@ -27,8 +27,6 @@
 #ifndef _CTF_HEADERS_H
 #define	_CTF_HEADERS_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * Because the ON tools are executed on the system where they are built,
  * the tools need to include the headers installed on the build system,
@@ -37,6 +35,7 @@
  * as part of Solaris.  These include the following:
  *
  * $(SRC)/lib/libctf/common/libctf.h
+ * $(SRC)/lib/libctf/common/libctf_impl.h
  * $(SRC)/uts/common/sys/ctf_api.h
  * $(SRC)/uts/common/sys/ctf.h
  *
@@ -67,6 +66,8 @@
 
 #include <uts/common/sys/ctf.h>
 #include <uts/common/sys/ctf_api.h>
+#include <common/ctf/ctf_impl.h>
 #include <lib/libctf/common/libctf.h>
+#include <lib/libctf/common/libctf_impl.h>
 
 #endif /* _CTF_HEADERS_H */
diff --git a/usr/src/tools/ctf/common/utils.h b/usr/src/tools/ctf/common/utils.h
index 9b07361a53..4ae2dd0917 100644
--- a/usr/src/tools/ctf/common/utils.h
+++ b/usr/src/tools/ctf/common/utils.h
@@ -27,9 +27,8 @@
 #ifndef	_UTILS_H
 #define	_UTILS_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <stdarg.h>
+#include <ctf_headers.h>
 
 #ifdef	__cplusplus
 extern "C" {
diff --git a/usr/src/tools/ctf/dump/Makefile b/usr/src/tools/ctf/ctfconvert/Makefile
index 16d8280cdd..07fadc5f8f 100644
--- a/usr/src/tools/ctf/dump/Makefile
+++ b/usr/src/tools/ctf/ctfconvert/Makefile
@@ -23,7 +23,6 @@
 # Copyright (c) 2001 by Sun Microsystems, Inc.
 # All rights reserved.
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
 
 include		../../Makefile.tools
 
diff --git a/usr/src/tools/ctf/ctfconvert/Makefile.com b/usr/src/tools/ctf/ctfconvert/Makefile.com
new file mode 100644
index 0000000000..d1cea479fb
--- /dev/null
+++ b/usr/src/tools/ctf/ctfconvert/Makefile.com
@@ -0,0 +1,44 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+PROG = ctfconvert-altexec
+SRCS = ctfconvert.c
+
+include ../../Makefile.ctf
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf -lelf
+
+LDFLAGS = \
+	-L$(ROOTONBLDLIBMACH) \
+	'-R$$ORIGIN/../../lib/$(MACH)' \
+
+CPPFLAGS += -include ../../common/ctf_headers.h
+
+OBJS = $(SRCS:%.c=%.o)
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: $(SRC)/cmd/ctfconvert/%.c
+	$(COMPILE.c) $<
+
+$(ROOTONBLDMACHPROG): $(PROG)
+
+install: $(ROOTONBLDMACHPROG)
+
+clean:
+	$(RM) $(OBJS) $(LINTFILES)
+
+include $(SRC)/tools/Makefile.targ
diff --git a/usr/src/tools/ctf/dump/i386/Makefile b/usr/src/tools/ctf/ctfconvert/i386/Makefile
index 94e5883ae2..cd5462bee3 100644
--- a/usr/src/tools/ctf/dump/i386/Makefile
+++ b/usr/src/tools/ctf/ctfconvert/i386/Makefile
@@ -23,6 +23,5 @@
 # Copyright (c) 2001 by Sun Microsystems, Inc.
 # All rights reserved.
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
 
 include ../Makefile.com
diff --git a/usr/src/tools/ctf/dump/sparc/Makefile b/usr/src/tools/ctf/ctfconvert/sparc/Makefile
index 94e5883ae2..cd5462bee3 100644
--- a/usr/src/tools/ctf/dump/sparc/Makefile
+++ b/usr/src/tools/ctf/ctfconvert/sparc/Makefile
@@ -23,6 +23,5 @@
 # Copyright (c) 2001 by Sun Microsystems, Inc.
 # All rights reserved.
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
 
 include ../Makefile.com
diff --git a/usr/src/tools/ctf/ctfdiff/Makefile b/usr/src/tools/ctf/ctfdiff/Makefile
new file mode 100644
index 0000000000..07fadc5f8f
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdiff/Makefile
@@ -0,0 +1,44 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2001 by Sun Microsystems, Inc.
+# All rights reserved.
+#
+
+include		../../Makefile.tools
+
+SUBDIRS	= $(MACH)
+
+all	:= TARGET= all
+install	:= TARGET= install
+clean	:= TARGET= clean
+clobber	:= TARGET= clobber
+lint	:= TARGET= lint
+
+.KEEP_STATE:
+
+install all clean clobber lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/tools/ctf/ctfdiff/Makefile.com b/usr/src/tools/ctf/ctfdiff/Makefile.com
new file mode 100644
index 0000000000..3c5e19fb6e
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdiff/Makefile.com
@@ -0,0 +1,44 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+PROG = ctfdiff
+SRCS = ctfdiff.c
+
+include ../../Makefile.ctf
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf
+
+LDFLAGS = \
+	-L$(ROOTONBLDLIBMACH) \
+	'-R$$ORIGIN/../../lib/$(MACH)' \
+
+CPPFLAGS += -include ../../common/ctf_headers.h
+
+OBJS = $(SRCS:%.c=%.o)
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: $(SRC)/cmd/ctfdiff/%.c
+	$(COMPILE.c) $<
+
+$(ROOTONBLDMACHPROG): $(PROG)
+
+install: $(ROOTONBLDMACHPROG)
+
+clean:
+	$(RM) $(OBJS) $(LINTFILES)
+
+include $(SRC)/tools/Makefile.targ
diff --git a/usr/src/tools/ctf/ctfdiff/i386/Makefile b/usr/src/tools/ctf/ctfdiff/i386/Makefile
new file mode 100644
index 0000000000..92c756cb42
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdiff/i386/Makefile
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc. 
+#
+
+include ../Makefile.com
diff --git a/usr/src/tools/ctf/ctfdiff/sparc/Makefile b/usr/src/tools/ctf/ctfdiff/sparc/Makefile
new file mode 100644
index 0000000000..92c756cb42
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdiff/sparc/Makefile
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc. 
+#
+
+include ../Makefile.com
diff --git a/usr/src/tools/ctf/ctfdump/Makefile b/usr/src/tools/ctf/ctfdump/Makefile
new file mode 100644
index 0000000000..20d304216a
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdump/Makefile
@@ -0,0 +1,33 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc.
+#
+
+include		../../Makefile.tools
+
+SUBDIRS	= $(MACH)
+
+all	:= TARGET= all
+install	:= TARGET= install
+clean	:= TARGET= clean
+clobber	:= TARGET= clobber
+lint	:= TARGET= lint
+
+.KEEP_STATE:
+
+install all clean clobber lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/tools/ctf/ctfdump/Makefile.com b/usr/src/tools/ctf/ctfdump/Makefile.com
new file mode 100644
index 0000000000..3e1414ea59
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdump/Makefile.com
@@ -0,0 +1,44 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+PROG = ctfdump
+SRCS = ctfdump.c
+
+include ../../Makefile.ctf
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf
+
+LDFLAGS = \
+	-L$(ROOTONBLDLIBMACH) \
+	'-R$$ORIGIN/../../lib/$(MACH)' \
+
+CPPFLAGS += -include ../../common/ctf_headers.h
+
+OBJS = $(SRCS:%.c=%.o)
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: $(SRC)/cmd/ctfdump/%.c
+	$(COMPILE.c) $<
+
+$(ROOTONBLDMACHPROG): $(PROG)
+
+install: $(ROOTONBLDMACHPROG)
+
+clean:
+	$(RM) $(OBJS) $(LINTFILES)
+
+include $(SRC)/tools/Makefile.targ
diff --git a/usr/src/tools/ctf/ctfdump/i386/Makefile b/usr/src/tools/ctf/ctfdump/i386/Makefile
new file mode 100644
index 0000000000..92c756cb42
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdump/i386/Makefile
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc. 
+#
+
+include ../Makefile.com
diff --git a/usr/src/tools/ctf/ctfdump/sparc/Makefile b/usr/src/tools/ctf/ctfdump/sparc/Makefile
new file mode 100644
index 0000000000..92c756cb42
--- /dev/null
+++ b/usr/src/tools/ctf/ctfdump/sparc/Makefile
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc. 
+#
+
+include ../Makefile.com
diff --git a/usr/src/tools/ctf/ctfmerge/Makefile b/usr/src/tools/ctf/ctfmerge/Makefile
new file mode 100644
index 0000000000..07fadc5f8f
--- /dev/null
+++ b/usr/src/tools/ctf/ctfmerge/Makefile
@@ -0,0 +1,44 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2001 by Sun Microsystems, Inc.
+# All rights reserved.
+#
+
+include		../../Makefile.tools
+
+SUBDIRS	= $(MACH)
+
+all	:= TARGET= all
+install	:= TARGET= install
+clean	:= TARGET= clean
+clobber	:= TARGET= clobber
+lint	:= TARGET= lint
+
+.KEEP_STATE:
+
+install all clean clobber lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/tools/ctf/ctfmerge/Makefile.com b/usr/src/tools/ctf/ctfmerge/Makefile.com
new file mode 100644
index 0000000000..3f58feed9c
--- /dev/null
+++ b/usr/src/tools/ctf/ctfmerge/Makefile.com
@@ -0,0 +1,46 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+PROG = ctfmerge-altexec
+SRCS = ctfmerge.c
+
+include ../../Makefile.ctf
+
+CFLAGS += $(CCVERBOSE)
+LDLIBS += -lctf -lelf
+
+LDFLAGS += \
+	-L$(ROOTONBLDLIBMACH) \
+	'-R$$ORIGIN/../../lib/$(MACH)' \
+
+CPPFLAGS += -include ../../common/ctf_headers.h
+CERRWARN += -_gcc=-Wno-unused-variable
+CERRWARN += -_gcc=-Wno-uninitialized
+
+OBJS = $(SRCS:%.c=%.o)
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: $(SRC)/cmd/ctfmerge/%.c
+	$(COMPILE.c) $<
+
+$(ROOTONBLDMACHPROG): $(PROG)
+
+install: $(ROOTONBLDMACHPROG)
+
+clean:
+	$(RM) $(OBJS) $(LINTFILES)
+
+include $(SRC)/tools/Makefile.targ
diff --git a/usr/src/tools/ctf/ctfmerge/i386/Makefile b/usr/src/tools/ctf/ctfmerge/i386/Makefile
new file mode 100644
index 0000000000..cd5462bee3
--- /dev/null
+++ b/usr/src/tools/ctf/ctfmerge/i386/Makefile
@@ -0,0 +1,27 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2001 by Sun Microsystems, Inc.
+# All rights reserved.
+#
+
+include ../Makefile.com
diff --git a/usr/src/tools/ctf/ctfmerge/sparc/Makefile b/usr/src/tools/ctf/ctfmerge/sparc/Makefile
new file mode 100644
index 0000000000..cd5462bee3
--- /dev/null
+++ b/usr/src/tools/ctf/ctfmerge/sparc/Makefile
@@ -0,0 +1,27 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2001 by Sun Microsystems, Inc.
+# All rights reserved.
+#
+
+include ../Makefile.com
diff --git a/usr/src/tools/ctf/cvt/Makefile.com b/usr/src/tools/ctf/cvt/Makefile.com
index 5cdccf6dfc..052cf02cc4 100644
--- a/usr/src/tools/ctf/cvt/Makefile.com
+++ b/usr/src/tools/ctf/cvt/Makefile.com
@@ -32,6 +32,7 @@ PROG=ctfconvert ctfmerge
 
 GENSRCS= \
 	alist.c \
+	altexec.c \
 	barrier.c \
 	ctf.c \
 	fifo.c \
@@ -71,7 +72,7 @@ DWARFLDFLAGS	= \
 	-L$(ROOTONBLDLIBMACH) \
 	'-R$$ORIGIN/../../lib/$(MACH)' \
 	-ldwarf
-DWARFCPPFLAGS	= -I../../dwarf/common
+DWARFCPPFLAGS	= -I$(SRC)/lib/libdwarf/common
 
 LDFLAGS		+= -L$(NATIVE_ADJUNCT)/lib
 LDLIBS		+= -lz -lelf
diff --git a/usr/src/tools/ctf/cvt/altexec.c b/usr/src/tools/ctf/cvt/altexec.c
new file mode 100644
index 0000000000..c986c0731a
--- /dev/null
+++ b/usr/src/tools/ctf/cvt/altexec.c
@@ -0,0 +1,45 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015, Joyent, Inc.
+ */
+
+/*
+ * Alternate execution engine for CTF tools
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "ctftools.h"
+
+void
+ctf_altexec(const char *env, int argc, char **argv)
+{
+	const char *alt;
+	char *altexec;
+
+	alt = getenv(env);
+	if (alt == NULL || *alt == '\0')
+		return;
+
+	altexec = strdup(alt);
+	if (altexec == NULL)
+		terminate("failed to allocate memory for altexec\n");
+
+	if (unsetenv(env) != 0)
+		aborterr("failed to remove %s from environment", env);
+
+	(void) execv(altexec, argv);
+	terminate("failed to altexec %s", altexec);
+}
diff --git a/usr/src/tools/ctf/cvt/ctfconvert.c b/usr/src/tools/ctf/cvt/ctfconvert.c
index 36496c5e9d..af005e1934 100644
--- a/usr/src/tools/ctf/cvt/ctfconvert.c
+++ b/usr/src/tools/ctf/cvt/ctfconvert.c
@@ -146,6 +146,7 @@ main(int argc, char **argv)
 {
 	tdata_t *filetd, *mstrtd;
 	char *label = NULL;
+	char *altexec;
 	int verbose = 0;
 	int ignore_non_c = 0;
 	int c;
@@ -156,12 +157,21 @@ main(int argc, char **argv)
 
 	progname = basename(argv[0]);
 
+	ctf_altexec("CTFCONVERT_ALTEXEC", argc, argv);
+
 	if (getenv("CTFCONVERT_DEBUG_LEVEL"))
 		debug_level = atoi(getenv("CTFCONVERT_DEBUG_LEVEL"));
 	if (getenv("CTFCONVERT_DEBUG_PARSE"))
 		debug_parse = atoi(getenv("CTFCONVERT_DEBUG_PARSE"));
 
-	while ((c = getopt(argc, argv, ":l:L:o:ivs")) != EOF) {
+	if ((altexec = getenv("CTFCONVERT_ALTEXEC")) != NULL) {
+		(void) unsetenv("CTFCONVERT_ALTEXEC");
+		(void) execv(altexec, argv);
+		(void) fprintf(stderr, "ctfconvert altexec failed to "
+		    "run %s: %s\n", altexec, strerror(errno));
+	}
+
+	while ((c = getopt(argc, argv, ":l:L:o:givs")) != EOF) {
 		switch (c) {
 		case 'l':
 			label = optarg;
diff --git a/usr/src/tools/ctf/cvt/ctfmerge.c b/usr/src/tools/ctf/cvt/ctfmerge.c
index 1d6d751d99..d2db789e5f 100644
--- a/usr/src/tools/ctf/cvt/ctfmerge.c
+++ b/usr/src/tools/ctf/cvt/ctfmerge.c
@@ -748,6 +748,8 @@ main(int argc, char **argv)
 
 	progname = basename(argv[0]);
 
+	ctf_altexec("CTFMERGE_ALTEXEC", argc, argv);
+
 	if (getenv("CTFMERGE_DEBUG_LEVEL"))
 		debug_level = atoi(getenv("CTFMERGE_DEBUG_LEVEL"));
 
diff --git a/usr/src/tools/ctf/cvt/ctftools.h b/usr/src/tools/ctf/cvt/ctftools.h
index 79746cba52..da02df8c94 100644
--- a/usr/src/tools/ctf/cvt/ctftools.h
+++ b/usr/src/tools/ctf/cvt/ctftools.h
@@ -43,6 +43,17 @@
 extern "C" {
 #endif
 
+/*
+ * XXX: This is hack to deal with GCC 4.x removing __builtin_stdarg_start
+ *
+ * We need to build on systems that don't have the fixed va_impl.h on the
+ * system, to achieve that, we stub it out here and in all similar places to
+ * give us a leg up.
+ */
+#if __GNUC__ >= 4
+#define	__builtin_stdarg_start(list, name)	__builtin_va_start(list, name)
+#endif
+
 #include "list.h"
 #include "hash.h"
 
@@ -442,6 +453,9 @@ void warning(char *, ...);
 void vadebug(int, char *, va_list);
 void debug(int, char *, ...);
 
+/* altexec.c */
+void ctf_altexec(const char *, int argc, char **);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/usr/src/tools/ctf/dump/dump.c b/usr/src/tools/ctf/dump/dump.c
deleted file mode 100644
index 5579bae596..0000000000
--- a/usr/src/tools/ctf/dump/dump.c
+++ /dev/null
@@ -1,1028 +0,0 @@
-/*
- * CDDL HEADER START
- *
- * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
- *
- * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- *
- * When distributing Covered Code, include this CDDL HEADER in each
- * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- * If applicable, add the following below this CDDL HEADER, with the
- * fields enclosed by brackets "[]" replaced with your own identifying
- * information: Portions Copyright [yyyy] [name of copyright owner]
- *
- * CDDL HEADER END
- */
-/*
- * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
-#include <sys/types.h>
-#include <sys/sysmacros.h>
-#include <sys/stat.h>
-#include <sys/mman.h>
-
-#include <strings.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <fcntl.h>
-#include <gelf.h>
-#include <zlib.h>
-
-#include "ctf_headers.h"
-#include "utils.h"
-#include "symbol.h"
-
-#define	WARN(x)	{ warn(x); return (E_ERROR); }
-
-/*
- * Flags that indicate what data is to be displayed.  An explicit `all' value is
- * provided to allow the code to distinguish between a request for everything
- * (currently requested by invoking ctfdump without flags) and individual
- * requests for all of the types of data (an invocation with all flags).  In the
- * former case, we want to be able to implicitly adjust the definition of `all'
- * based on the CTF version of the file being dumped.  For example, if a v2 file
- * is being dumped, `all' includes F_LABEL - a request to dump the label
- * section.  If a v1 file is being dumped, `all' does not include F_LABEL,
- * because v1 CTF doesn't support labels.  We need to be able to distinguish
- * between `ctfdump foo', which has an implicit request for labels if `foo'
- * supports them, and `ctfdump -l foo', which has an explicity request.  In the
- * latter case, we exit with an error if `foo' is a v1 CTF file.
- */
-static enum {
-	F_DATA	= 0x01,		/* show data object section */
-	F_FUNC	= 0x02,		/* show function section */
-	F_HDR	= 0x04,		/* show header */
-	F_STR	= 0x08,		/* show string table */
-	F_TYPES	= 0x10,		/* show type section */
-	F_STATS = 0x20, 	/* show statistics */
-	F_LABEL	= 0x40,		/* show label section */
-	F_ALL	= 0x80,		/* explicit request for `all' */
-	F_ALLMSK = 0xff		/* show all sections and statistics */
-} flags = 0;
-
-static struct {
-	ulong_t s_ndata;	/* total number of data objects */
-	ulong_t s_nfunc;	/* total number of functions */
-	ulong_t s_nargs;	/* total number of function arguments */
-	ulong_t s_argmax;	/* longest argument list */
-	ulong_t s_ntypes;	/* total number of types */
-	ulong_t s_types[16];	/* number of types by kind */
-	ulong_t s_nsmem;	/* total number of struct members */
-	ulong_t s_nsbytes;	/* total size of all structs */
-	ulong_t s_smmax;	/* largest struct in terms of members */
-	ulong_t s_sbmax;	/* largest struct in terms of bytes */
-	ulong_t s_numem;	/* total number of union members */
-	ulong_t s_nubytes;	/* total size of all unions */
-	ulong_t s_ummax;	/* largest union in terms of members */
-	ulong_t s_ubmax;	/* largest union in terms of bytes */
-	ulong_t s_nemem;	/* total number of enum members */
-	ulong_t s_emmax;	/* largest enum in terms of members */
-	ulong_t s_nstr;		/* total number of strings */
-	size_t s_strlen;	/* total length of all strings */
-	size_t s_strmax;	/* longest string length */
-} stats;
-
-typedef struct ctf_data {
-	caddr_t cd_ctfdata;	/* Pointer to the CTF data */
-	size_t cd_ctflen;	/* Length of CTF data */
-
-	/*
-	 * cd_symdata will be non-NULL if the CTF data is being retrieved from
-	 * an ELF file with a symbol table.  cd_strdata and cd_nsyms should be
-	 * used only if cd_symdata is non-NULL.
-	 */
-	Elf_Data *cd_symdata;	/* Symbol table */
-	Elf_Data *cd_strdata;	/* Symbol table strings */
-	int cd_nsyms;		/* Number of symbol table entries */
-} ctf_data_t;
-
-static const char *
-ref_to_str(uint_t name, const ctf_header_t *hp, const ctf_data_t *cd)
-{
-	size_t offset = CTF_NAME_OFFSET(name);
-	const char *s = cd->cd_ctfdata + hp->cth_stroff + offset;
-
-	if (CTF_NAME_STID(name) != CTF_STRTAB_0)
-		return ("<< ??? - name in external strtab >>");
-
-	if (offset >= hp->cth_strlen)
-		return ("<< ??? - name exceeds strlab len >>");
-
-	if (hp->cth_stroff + offset >= cd->cd_ctflen)
-		return ("<< ??? - file truncated >>");
-
-	if (s[0] == '\0')
-		return ("(anon)");
-
-	return (s);
-}
-
-static const char *
-int_encoding_to_str(uint_t encoding)
-{
-	static char buf[32];
-
-	if (encoding == 0 || (encoding & ~(CTF_INT_SIGNED | CTF_INT_CHAR |
-	    CTF_INT_BOOL | CTF_INT_VARARGS)) != 0)
-		(void) snprintf(buf, sizeof (buf), " 0x%x", encoding);
-	else {
-		buf[0] = '\0';
-		if (encoding & CTF_INT_SIGNED)
-			(void) strcat(buf, " SIGNED");
-		if (encoding & CTF_INT_CHAR)
-			(void) strcat(buf, " CHAR");
-		if (encoding & CTF_INT_BOOL)
-			(void) strcat(buf, " BOOL");
-		if (encoding & CTF_INT_VARARGS)
-			(void) strcat(buf, " VARARGS");
-	}
-
-	return (buf + 1);
-}
-
-static const char *
-fp_encoding_to_str(uint_t encoding)
-{
-	static const char *const encs[] = {
-		NULL, "SINGLE", "DOUBLE", "COMPLEX", "DCOMPLEX", "LDCOMPLEX",
-		"LDOUBLE", "INTERVAL", "DINTERVAL", "LDINTERVAL", "IMAGINARY",
-		"DIMAGINARY", "LDIMAGINARY"
-	};
-
-	static char buf[16];
-
-	if (encoding < 1 || encoding >= (sizeof (encs) / sizeof (char *))) {
-		(void) snprintf(buf, sizeof (buf), "%u", encoding);
-		return (buf);
-	}
-
-	return (encs[encoding]);
-}
-
-static void
-print_line(const char *s)
-{
-	static const char line[] = "----------------------------------------"
-	    "----------------------------------------";
-	(void) printf("\n%s%.*s\n\n", s, (int)(78 - strlen(s)), line);
-}
-
-static int
-print_header(const ctf_header_t *hp, const ctf_data_t *cd)
-{
-	print_line("- CTF Header ");
-
-	(void) printf("  cth_magic    = 0x%04x\n", hp->cth_magic);
-	(void) printf("  cth_version  = %u\n", hp->cth_version);
-	(void) printf("  cth_flags    = 0x%02x\n", hp->cth_flags);
-	(void) printf("  cth_parlabel = %s\n",
-	    ref_to_str(hp->cth_parlabel, hp, cd));
-	(void) printf("  cth_parname  = %s\n",
-	    ref_to_str(hp->cth_parname, hp, cd));
-	(void) printf("  cth_lbloff   = %u\n", hp->cth_lbloff);
-	(void) printf("  cth_objtoff  = %u\n", hp->cth_objtoff);
-	(void) printf("  cth_funcoff  = %u\n", hp->cth_funcoff);
-	(void) printf("  cth_typeoff  = %u\n", hp->cth_typeoff);
-	(void) printf("  cth_stroff   = %u\n", hp->cth_stroff);
-	(void) printf("  cth_strlen   = %u\n", hp->cth_strlen);
-
-	return (E_SUCCESS);
-}
-
-static int
-print_labeltable(const ctf_header_t *hp, const ctf_data_t *cd)
-{
-	/* LINTED - pointer alignment */
-	const ctf_lblent_t *ctl = (ctf_lblent_t *)(cd->cd_ctfdata +
-	    hp->cth_lbloff);
-	ulong_t i, n = (hp->cth_objtoff - hp->cth_lbloff) / sizeof (*ctl);
-
-	print_line("- Label Table ");
-
-	if (hp->cth_lbloff & 3)
-		WARN("cth_lbloff is not aligned properly\n");
-	if (hp->cth_lbloff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_lbloff is corrupt\n");
-	if (hp->cth_objtoff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_objtoff is corrupt\n");
-	if (hp->cth_lbloff > hp->cth_objtoff)
-		WARN("file is corrupt -- cth_lbloff > cth_objtoff\n");
-
-	for (i = 0; i < n; i++, ctl++) {
-		(void) printf("  %5u %s\n", ctl->ctl_typeidx,
-		    ref_to_str(ctl->ctl_label, hp, cd));
-	}
-
-	return (E_SUCCESS);
-}
-
-/*
- * Given the current symbol index (-1 to start at the beginning of the symbol
- * table) and the type of symbol to match, this function returns the index of
- * the next matching symbol (if any), and places the name of that symbol in
- * *namep.  If no symbol is found, -1 is returned.
- */
-static int
-next_sym(const ctf_data_t *cd, const int symidx, const uchar_t matchtype,
-    char **namep)
-{
-	int i;
-
-	for (i = symidx + 1; i < cd->cd_nsyms; i++) {
-		GElf_Sym sym;
-		char *name;
-		int type;
-
-		if (gelf_getsym(cd->cd_symdata, i, &sym) == 0)
-			return (-1);
-
-		name = (char *)cd->cd_strdata->d_buf + sym.st_name;
-		type = GELF_ST_TYPE(sym.st_info);
-
-		/*
-		 * Skip various types of symbol table entries.
-		 */
-		if (type != matchtype || ignore_symbol(&sym, name))
-			continue;
-
-		/* Found one */
-		*namep = name;
-		return (i);
-	}
-
-	return (-1);
-}
-
-static int
-read_data(const ctf_header_t *hp, const ctf_data_t *cd)
-{
-	/* LINTED - pointer alignment */
-	const ushort_t *idp = (ushort_t *)(cd->cd_ctfdata + hp->cth_objtoff);
-	ulong_t n = (hp->cth_funcoff - hp->cth_objtoff) / sizeof (ushort_t);
-
-	if (flags != F_STATS)
-		print_line("- Data Objects ");
-
-	if (hp->cth_objtoff & 1)
-		WARN("cth_objtoff is not aligned properly\n");
-	if (hp->cth_objtoff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_objtoff is corrupt\n");
-	if (hp->cth_funcoff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_funcoff is corrupt\n");
-	if (hp->cth_objtoff > hp->cth_funcoff)
-		WARN("file is corrupt -- cth_objtoff > cth_funcoff\n");
-
-	if (flags != F_STATS) {
-		int symidx, len, i;
-		char *name = NULL;
-
-		for (symidx = -1, i = 0; i < n; i++) {
-			int nextsym;
-
-			if (cd->cd_symdata == NULL || (nextsym = next_sym(cd,
-			    symidx, STT_OBJECT, &name)) < 0)
-				name = NULL;
-			else
-				symidx = nextsym;
-
-			len = printf("  [%u] %u", i, *idp++);
-			if (name != NULL)
-				(void) printf("%*s%s (%u)", (15 - len), "",
-				    name, symidx);
-			(void) putchar('\n');
-		}
-	}
-
-	stats.s_ndata = n;
-	return (E_SUCCESS);
-}
-
-static int
-read_funcs(const ctf_header_t *hp, const ctf_data_t *cd)
-{
-	/* LINTED - pointer alignment */
-	const ushort_t *fp = (ushort_t *)(cd->cd_ctfdata + hp->cth_funcoff);
-
-	/* LINTED - pointer alignment */
-	const ushort_t *end = (ushort_t *)(cd->cd_ctfdata + hp->cth_typeoff);
-
-	ulong_t id;
-	int symidx;
-
-	if (flags != F_STATS)
-		print_line("- Functions ");
-
-	if (hp->cth_funcoff & 1)
-		WARN("cth_funcoff is not aligned properly\n");
-	if (hp->cth_funcoff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_funcoff is corrupt\n");
-	if (hp->cth_typeoff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_typeoff is corrupt\n");
-	if (hp->cth_funcoff > hp->cth_typeoff)
-		WARN("file is corrupt -- cth_funcoff > cth_typeoff\n");
-
-	for (symidx = -1, id = 0; fp < end; id++) {
-		ushort_t info = *fp++;
-		ushort_t kind = CTF_INFO_KIND(info);
-		ushort_t n = CTF_INFO_VLEN(info);
-		ushort_t i;
-		int nextsym;
-		char *name;
-
-		if (cd->cd_symdata == NULL || (nextsym = next_sym(cd, symidx,
-		    STT_FUNC, &name)) < 0)
-			name = NULL;
-		else
-			symidx = nextsym;
-
-		if (kind == CTF_K_UNKNOWN && n == 0)
-			continue; /* skip padding */
-
-		if (kind != CTF_K_FUNCTION) {
-			(void) printf("  [%lu] unexpected kind -- %u\n",
-			    id, kind);
-			return (E_ERROR);
-		}
-
-		if (fp + n > end) {
-			(void) printf("  [%lu] vlen %u extends past section "
-			    "boundary\n", id, n);
-			return (E_ERROR);
-		}
-
-		if (flags != F_STATS) {
-			(void) printf("  [%lu] FUNC ", id);
-			if (name != NULL)
-				(void) printf("(%s) ", name);
-			(void) printf("returns: %u args: (", *fp++);
-
-			if (n != 0) {
-				(void) printf("%u", *fp++);
-				for (i = 1; i < n; i++)
-					(void) printf(", %u", *fp++);
-			}
-
-			(void) printf(")\n");
-		} else
-			fp += n + 1; /* skip to next function definition */
-
-		stats.s_nfunc++;
-		stats.s_nargs += n;
-		stats.s_argmax = MAX(stats.s_argmax, n);
-	}
-
-	return (E_SUCCESS);
-}
-
-static int
-read_types(const ctf_header_t *hp, const ctf_data_t *cd)
-{
-	/* LINTED - pointer alignment */
-	const ctf_type_t *tp = (ctf_type_t *)(cd->cd_ctfdata + hp->cth_typeoff);
-
-	/* LINTED - pointer alignment */
-	const ctf_type_t *end = (ctf_type_t *)(cd->cd_ctfdata + hp->cth_stroff);
-
-	ulong_t id;
-
-	if (flags != F_STATS)
-		print_line("- Types ");
-
-	if (hp->cth_typeoff & 3)
-		WARN("cth_typeoff is not aligned properly\n");
-	if (hp->cth_typeoff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_typeoff is corrupt\n");
-	if (hp->cth_stroff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_stroff is corrupt\n");
-	if (hp->cth_typeoff > hp->cth_stroff)
-		WARN("file is corrupt -- cth_typeoff > cth_stroff\n");
-
-	id = 1;
-	if (hp->cth_parlabel || hp->cth_parname)
-		id += 1 << CTF_PARENT_SHIFT;
-
-	for (/* */; tp < end; id++) {
-		ulong_t i, n = CTF_INFO_VLEN(tp->ctt_info);
-		size_t size, increment, vlen = 0;
-		int kind = CTF_INFO_KIND(tp->ctt_info);
-
-		union {
-			const void *ptr;
-			const ctf_array_t *ap;
-			const ctf_member_t *mp;
-			const ctf_lmember_t *lmp;
-			const ctf_enum_t *ep;
-			const ushort_t *argp;
-		} u;
-
-		if (flags != F_STATS) {
-			(void) printf("  %c%lu%c ",
-			    "[<"[CTF_INFO_ISROOT(tp->ctt_info)], id,
-			    "]>"[CTF_INFO_ISROOT(tp->ctt_info)]);
-		}
-
-		if (tp->ctt_size == CTF_LSIZE_SENT) {
-			increment = sizeof (ctf_type_t);
-			size = (size_t)CTF_TYPE_LSIZE(tp);
-		} else {
-			increment = sizeof (ctf_stype_t);
-			size = tp->ctt_size;
-		}
-		u.ptr = (caddr_t)tp + increment;
-
-		switch (kind) {
-		case CTF_K_INTEGER:
-			if (flags != F_STATS) {
-				uint_t encoding = *((const uint_t *)u.ptr);
-
-				(void) printf("INTEGER %s encoding=%s offset=%u"
-				    " bits=%u", ref_to_str(tp->ctt_name, hp,
-				    cd), int_encoding_to_str(
-				    CTF_INT_ENCODING(encoding)),
-				    CTF_INT_OFFSET(encoding),
-				    CTF_INT_BITS(encoding));
-			}
-			vlen = sizeof (uint_t);
-			break;
-
-		case CTF_K_FLOAT:
-			if (flags != F_STATS) {
-				uint_t encoding = *((const uint_t *)u.ptr);
-
-				(void) printf("FLOAT %s encoding=%s offset=%u "
-				    "bits=%u", ref_to_str(tp->ctt_name, hp,
-				    cd), fp_encoding_to_str(
-				    CTF_FP_ENCODING(encoding)),
-				    CTF_FP_OFFSET(encoding),
-				    CTF_FP_BITS(encoding));
-			}
-			vlen = sizeof (uint_t);
-			break;
-
-		case CTF_K_POINTER:
-			if (flags != F_STATS) {
-				(void) printf("POINTER %s refers to %u",
-				    ref_to_str(tp->ctt_name, hp, cd),
-				    tp->ctt_type);
-			}
-			break;
-
-		case CTF_K_ARRAY:
-			if (flags != F_STATS) {
-				(void) printf("ARRAY %s content: %u index: %u "
-				    "nelems: %u\n", ref_to_str(tp->ctt_name,
-				    hp, cd), u.ap->cta_contents,
-				    u.ap->cta_index, u.ap->cta_nelems);
-			}
-			vlen = sizeof (ctf_array_t);
-			break;
-
-		case CTF_K_FUNCTION:
-			if (flags != F_STATS) {
-				(void) printf("FUNCTION %s returns: %u args: (",
-				    ref_to_str(tp->ctt_name, hp, cd),
-				    tp->ctt_type);
-
-				if (n != 0) {
-					(void) printf("%u", *u.argp++);
-					for (i = 1; i < n; i++, u.argp++)
-						(void) printf(", %u", *u.argp);
-				}
-
-				(void) printf(")");
-			}
-
-			vlen = sizeof (ushort_t) * (n + (n & 1));
-			break;
-
-		case CTF_K_STRUCT:
-		case CTF_K_UNION:
-			if (kind == CTF_K_STRUCT) {
-				stats.s_nsmem += n;
-				stats.s_smmax = MAX(stats.s_smmax, n);
-				stats.s_nsbytes += size;
-				stats.s_sbmax = MAX(stats.s_sbmax, size);
-
-				if (flags != F_STATS)
-					(void) printf("STRUCT");
-			} else {
-				stats.s_numem += n;
-				stats.s_ummax = MAX(stats.s_ummax, n);
-				stats.s_nubytes += size;
-				stats.s_ubmax = MAX(stats.s_ubmax, size);
-
-				if (flags != F_STATS)
-					(void) printf("UNION");
-			}
-
-			if (flags != F_STATS) {
-				(void) printf(" %s (%d bytes)\n",
-				    ref_to_str(tp->ctt_name, hp, cd), size);
-
-				if (size >= CTF_LSTRUCT_THRESH) {
-					for (i = 0; i < n; i++, u.lmp++) {
-						(void) printf(
-						    "\t%s type=%u off=%llu\n",
-						    ref_to_str(u.lmp->ctlm_name,
-						    hp, cd), u.lmp->ctlm_type,
-						    CTF_LMEM_OFFSET(u.lmp));
-					}
-				} else {
-					for (i = 0; i < n; i++, u.mp++) {
-						(void) printf(
-						    "\t%s type=%u off=%u\n",
-						    ref_to_str(u.mp->ctm_name,
-						    hp, cd), u.mp->ctm_type,
-						    u.mp->ctm_offset);
-					}
-				}
-			}
-
-			vlen = n * (size >= CTF_LSTRUCT_THRESH ?
-			    sizeof (ctf_lmember_t) : sizeof (ctf_member_t));
-			break;
-
-		case CTF_K_ENUM:
-			if (flags != F_STATS) {
-				(void) printf("ENUM %s\n",
-				    ref_to_str(tp->ctt_name, hp, cd));
-
-				for (i = 0; i < n; i++, u.ep++) {
-					(void) printf("\t%s = %d\n",
-					    ref_to_str(u.ep->cte_name, hp, cd),
-					    u.ep->cte_value);
-				}
-			}
-
-			stats.s_nemem += n;
-			stats.s_emmax = MAX(stats.s_emmax, n);
-
-			vlen = sizeof (ctf_enum_t) * n;
-			break;
-
-		case CTF_K_FORWARD:
-			if (flags != F_STATS) {
-				(void) printf("FORWARD %s",
-				    ref_to_str(tp->ctt_name, hp, cd));
-			}
-			break;
-
-		case CTF_K_TYPEDEF:
-			if (flags != F_STATS) {
-				(void) printf("TYPEDEF %s refers to %u",
-				    ref_to_str(tp->ctt_name, hp, cd),
-				    tp->ctt_type);
-			}
-			break;
-
-		case CTF_K_VOLATILE:
-			if (flags != F_STATS) {
-				(void) printf("VOLATILE %s refers to %u",
-				    ref_to_str(tp->ctt_name, hp, cd),
-				    tp->ctt_type);
-			}
-			break;
-
-		case CTF_K_CONST:
-			if (flags != F_STATS) {
-				(void) printf("CONST %s refers to %u",
-				    ref_to_str(tp->ctt_name, hp, cd),
-				    tp->ctt_type);
-			}
-			break;
-
-		case CTF_K_RESTRICT:
-			if (flags != F_STATS) {
-				(void) printf("RESTRICT %s refers to %u",
-				    ref_to_str(tp->ctt_name, hp, cd),
-				    tp->ctt_type);
-			}
-			break;
-
-		case CTF_K_UNKNOWN:
-			break; /* hole in type id space */
-
-		default:
-			(void) printf("unexpected kind %u\n", kind);
-			return (E_ERROR);
-		}
-
-		if (flags != F_STATS)
-			(void) printf("\n");
-
-		stats.s_ntypes++;
-		stats.s_types[kind]++;
-
-		tp = (ctf_type_t *)((uintptr_t)tp + increment + vlen);
-	}
-
-	return (E_SUCCESS);
-}
-
-static int
-read_strtab(const ctf_header_t *hp, const ctf_data_t *cd)
-{
-	size_t n, off, len = hp->cth_strlen;
-	const char *s = cd->cd_ctfdata + hp->cth_stroff;
-
-	if (flags != F_STATS)
-		print_line("- String Table ");
-
-	if (hp->cth_stroff >= cd->cd_ctflen)
-		WARN("file is truncated or cth_stroff is corrupt\n");
-	if (hp->cth_stroff + hp->cth_strlen > cd->cd_ctflen)
-		WARN("file is truncated or cth_strlen is corrupt\n");
-
-	for (off = 0; len != 0; off += n) {
-		if (flags != F_STATS) {
-			(void) printf("  [%lu] %s\n", (ulong_t)off,
-			    s[0] == '\0' ? "\\0" : s);
-		}
-		n = strlen(s) + 1;
-		len -= n;
-		s += n;
-
-		stats.s_nstr++;
-		stats.s_strlen += n;
-		stats.s_strmax = MAX(stats.s_strmax, n);
-	}
-
-	return (E_SUCCESS);
-}
-
-static void
-long_stat(const char *name, ulong_t value)
-{
-	(void) printf("  %-36s= %lu\n", name, value);
-}
-
-static void
-fp_stat(const char *name, float value)
-{
-	(void) printf("  %-36s= %.2f\n", name, value);
-}
-
-static int
-print_stats(void)
-{
-	print_line("- CTF Statistics ");
-
-	long_stat("total number of data objects", stats.s_ndata);
-	(void) printf("\n");
-
-	long_stat("total number of functions", stats.s_nfunc);
-	long_stat("total number of function arguments", stats.s_nargs);
-	long_stat("maximum argument list length", stats.s_argmax);
-
-	if (stats.s_nfunc != 0) {
-		fp_stat("average argument list length",
-		    (float)stats.s_nargs / (float)stats.s_nfunc);
-	}
-
-	(void) printf("\n");
-
-	long_stat("total number of types", stats.s_ntypes);
-	long_stat("total number of integers", stats.s_types[CTF_K_INTEGER]);
-	long_stat("total number of floats", stats.s_types[CTF_K_FLOAT]);
-	long_stat("total number of pointers", stats.s_types[CTF_K_POINTER]);
-	long_stat("total number of arrays", stats.s_types[CTF_K_ARRAY]);
-	long_stat("total number of func types", stats.s_types[CTF_K_FUNCTION]);
-	long_stat("total number of structs", stats.s_types[CTF_K_STRUCT]);
-	long_stat("total number of unions", stats.s_types[CTF_K_UNION]);
-	long_stat("total number of enums", stats.s_types[CTF_K_ENUM]);
-	long_stat("total number of forward tags", stats.s_types[CTF_K_FORWARD]);
-	long_stat("total number of typedefs", stats.s_types[CTF_K_TYPEDEF]);
-	long_stat("total number of volatile types",
-	    stats.s_types[CTF_K_VOLATILE]);
-	long_stat("total number of const types", stats.s_types[CTF_K_CONST]);
-	long_stat("total number of restrict types",
-	    stats.s_types[CTF_K_RESTRICT]);
-	long_stat("total number of unknowns (holes)",
-	    stats.s_types[CTF_K_UNKNOWN]);
-
-	(void) printf("\n");
-
-	long_stat("total number of struct members", stats.s_nsmem);
-	long_stat("maximum number of struct members", stats.s_smmax);
-	long_stat("total size of all structs", stats.s_nsbytes);
-	long_stat("maximum size of a struct", stats.s_sbmax);
-
-	if (stats.s_types[CTF_K_STRUCT] != 0) {
-		fp_stat("average number of struct members",
-		    (float)stats.s_nsmem / (float)stats.s_types[CTF_K_STRUCT]);
-		fp_stat("average size of a struct", (float)stats.s_nsbytes /
-		    (float)stats.s_types[CTF_K_STRUCT]);
-	}
-
-	(void) printf("\n");
-
-	long_stat("total number of union members", stats.s_numem);
-	long_stat("maximum number of union members", stats.s_ummax);
-	long_stat("total size of all unions", stats.s_nubytes);
-	long_stat("maximum size of a union", stats.s_ubmax);
-
-	if (stats.s_types[CTF_K_UNION] != 0) {
-		fp_stat("average number of union members",
-		    (float)stats.s_numem / (float)stats.s_types[CTF_K_UNION]);
-		fp_stat("average size of a union", (float)stats.s_nubytes /
-		    (float)stats.s_types[CTF_K_UNION]);
-	}
-
-	(void) printf("\n");
-
-	long_stat("total number of enum members", stats.s_nemem);
-	long_stat("maximum number of enum members", stats.s_emmax);
-
-	if (stats.s_types[CTF_K_ENUM] != 0) {
-		fp_stat("average number of enum members",
-		    (float)stats.s_nemem / (float)stats.s_types[CTF_K_ENUM]);
-	}
-
-	(void) printf("\n");
-
-	long_stat("total number of unique strings", stats.s_nstr);
-	long_stat("bytes of string data", stats.s_strlen);
-	long_stat("maximum string length", stats.s_strmax);
-
-	if (stats.s_nstr != 0) {
-		fp_stat("average string length",
-		    (float)stats.s_strlen / (float)stats.s_nstr);
-	}
-
-	(void) printf("\n");
-	return (E_SUCCESS);
-}
-
-static int
-print_usage(FILE *fp, int verbose)
-{
-	(void) fprintf(fp, "Usage: %s [-dfhlsSt] [-u file] file\n", getpname());
-
-	if (verbose) {
-		(void) fprintf(fp,
-		    "\t-d  dump data object section\n"
-		    "\t-f  dump function section\n"
-		    "\t-h  dump file header\n"
-		    "\t-l  dump label table\n"
-		    "\t-s  dump string table\n"
-		    "\t-S  dump statistics\n"
-		    "\t-t  dump type section\n"
-		    "\t-u  save uncompressed CTF to a file\n");
-	}
-
-	return (E_USAGE);
-}
-
-static Elf_Scn *
-findelfscn(Elf *elf, GElf_Ehdr *ehdr, char *secname)
-{
-	GElf_Shdr shdr;
-	Elf_Scn *scn;
-	char *name;
-
-	for (scn = NULL; (scn = elf_nextscn(elf, scn)) != NULL; ) {
-		if (gelf_getshdr(scn, &shdr) != NULL && (name =
-		    elf_strptr(elf, ehdr->e_shstrndx, shdr.sh_name)) != NULL &&
-		    strcmp(name, secname) == 0)
-			return (scn);
-	}
-
-	return (NULL);
-}
-
-int
-main(int argc, char *argv[])
-{
-	const char *filename = NULL;
-	const char *ufile = NULL;
-	int error = 0;
-	int c, fd, ufd;
-
-	ctf_data_t cd;
-	const ctf_preamble_t *pp;
-	ctf_header_t *hp;
-	Elf *elf;
-	GElf_Ehdr ehdr;
-
-	(void) elf_version(EV_CURRENT);
-
-	for (opterr = 0; optind < argc; optind++) {
-		while ((c = getopt(argc, argv, "dfhlsStu:")) != (int)EOF) {
-			switch (c) {
-			case 'd':
-				flags |= F_DATA;
-				break;
-			case 'f':
-				flags |= F_FUNC;
-				break;
-			case 'h':
-				flags |= F_HDR;
-				break;
-			case 'l':
-				flags |= F_LABEL;
-				break;
-			case 's':
-				flags |= F_STR;
-				break;
-			case 'S':
-				flags |= F_STATS;
-				break;
-			case 't':
-				flags |= F_TYPES;
-				break;
-			case 'u':
-				ufile = optarg;
-				break;
-			default:
-				if (optopt == '?')
-					return (print_usage(stdout, 1));
-				warn("illegal option -- %c\n", optopt);
-				return (print_usage(stderr, 0));
-			}
-		}
-
-		if (optind < argc) {
-			if (filename != NULL)
-				return (print_usage(stderr, 0));
-			filename = argv[optind];
-		}
-	}
-
-	if (filename == NULL)
-		return (print_usage(stderr, 0));
-
-	if (flags == 0 && ufile == NULL)
-		flags = F_ALLMSK;
-
-	if ((fd = open(filename, O_RDONLY)) == -1)
-		die("failed to open %s", filename);
-
-	if ((elf = elf_begin(fd, ELF_C_READ, NULL)) != NULL &&
-	    gelf_getehdr(elf, &ehdr) != NULL) {
-
-		Elf_Data *dp;
-		Elf_Scn *ctfscn = findelfscn(elf, &ehdr, ".SUNW_ctf");
-		Elf_Scn *symscn;
-		GElf_Shdr ctfshdr;
-
-		if (ctfscn == NULL || (dp = elf_getdata(ctfscn, NULL)) == NULL)
-			die("%s does not contain .SUNW_ctf data\n", filename);
-
-		cd.cd_ctfdata = dp->d_buf;
-		cd.cd_ctflen = dp->d_size;
-
-		/*
-		 * If the sh_link field of the CTF section header is non-zero
-		 * it indicates which section contains the symbol table that
-		 * should be used. We default to the .symtab section if sh_link
-		 * is zero or if there's an error reading the section header.
-		 */
-		if (gelf_getshdr(ctfscn, &ctfshdr) != NULL &&
-		    ctfshdr.sh_link != 0) {
-			symscn = elf_getscn(elf, ctfshdr.sh_link);
-		} else {
-			symscn = findelfscn(elf, &ehdr, ".symtab");
-		}
-
-		/* If we found a symbol table, find the corresponding strings */
-		if (symscn != NULL) {
-			GElf_Shdr shdr;
-			Elf_Scn *symstrscn;
-
-			if (gelf_getshdr(symscn, &shdr) != NULL) {
-				symstrscn = elf_getscn(elf, shdr.sh_link);
-
-				cd.cd_nsyms = shdr.sh_size / shdr.sh_entsize;
-				cd.cd_symdata = elf_getdata(symscn, NULL);
-				cd.cd_strdata = elf_getdata(symstrscn, NULL);
-			}
-		}
-	} else {
-		struct stat st;
-
-		if (fstat(fd, &st) == -1)
-			die("failed to fstat %s", filename);
-
-		cd.cd_ctflen = st.st_size;
-		cd.cd_ctfdata = mmap(NULL, cd.cd_ctflen, PROT_READ,
-		    MAP_PRIVATE, fd, 0);
-		if (cd.cd_ctfdata == MAP_FAILED)
-			die("failed to mmap %s", filename);
-	}
-
-	/*
-	 * Get a pointer to the CTF data buffer and interpret the first portion
-	 * as a ctf_header_t.  Validate the magic number and size.
-	 */
-
-	if (cd.cd_ctflen < sizeof (ctf_preamble_t))
-		die("%s does not contain a CTF preamble\n", filename);
-
-	/* LINTED - pointer alignment */
-	pp = (const ctf_preamble_t *)cd.cd_ctfdata;
-
-	if (pp->ctp_magic != CTF_MAGIC)
-		die("%s does not appear to contain CTF data\n", filename);
-
-	if (pp->ctp_version == CTF_VERSION) {
-		/* LINTED - pointer alignment */
-		hp = (ctf_header_t *)cd.cd_ctfdata;
-		cd.cd_ctfdata = (caddr_t)cd.cd_ctfdata + sizeof (ctf_header_t);
-
-		if (cd.cd_ctflen < sizeof (ctf_header_t)) {
-			die("%s does not contain a v%d CTF header\n", filename,
-			    CTF_VERSION);
-		}
-
-	} else {
-		die("%s contains unsupported CTF version %d\n", filename,
-		    pp->ctp_version);
-	}
-
-	/*
-	 * If the data buffer is compressed, then malloc a buffer large enough
-	 * to hold the decompressed data, and use zlib to decompress it.
-	 */
-	if (hp->cth_flags & CTF_F_COMPRESS) {
-		z_stream zstr;
-		void *buf;
-		int rc;
-
-		if ((buf = malloc(hp->cth_stroff + hp->cth_strlen)) == NULL)
-			die("failed to allocate decompression buffer");
-
-		bzero(&zstr, sizeof (z_stream));
-		zstr.next_in = (void *)cd.cd_ctfdata;
-		zstr.avail_in = cd.cd_ctflen;
-		zstr.next_out = buf;
-		zstr.avail_out = hp->cth_stroff + hp->cth_strlen;
-
-		if ((rc = inflateInit(&zstr)) != Z_OK)
-			die("failed to initialize zlib: %s\n", zError(rc));
-
-		if ((rc = inflate(&zstr, Z_FINISH)) != Z_STREAM_END)
-			die("failed to decompress CTF data: %s\n", zError(rc));
-
-		if ((rc = inflateEnd(&zstr)) != Z_OK)
-			die("failed to finish decompression: %s\n", zError(rc));
-
-		if (zstr.total_out != hp->cth_stroff + hp->cth_strlen)
-			die("CTF data is corrupt -- short decompression\n");
-
-		cd.cd_ctfdata = buf;
-		cd.cd_ctflen = hp->cth_stroff + hp->cth_strlen;
-	}
-
-	if (flags & F_HDR)
-		error |= print_header(hp, &cd);
-	if (flags & (F_LABEL))
-		error |= print_labeltable(hp, &cd);
-	if (flags & (F_DATA | F_STATS))
-		error |= read_data(hp, &cd);
-	if (flags & (F_FUNC | F_STATS))
-		error |= read_funcs(hp, &cd);
-	if (flags & (F_TYPES | F_STATS))
-		error |= read_types(hp, &cd);
-	if (flags & (F_STR | F_STATS))
-		error |= read_strtab(hp, &cd);
-	if (flags & F_STATS)
-		error |= print_stats();
-
-	/*
-	 * If the -u option is specified, write the uncompressed CTF data to a
-	 * raw CTF file.  CTF data can already be extracted compressed by
-	 * applying elfdump -w -N .SUNW_ctf to an ELF file, so we don't bother.
-	 */
-	if (ufile != NULL) {
-		ctf_header_t h;
-
-		bcopy(hp, &h, sizeof (h));
-		h.cth_flags &= ~CTF_F_COMPRESS;
-
-		if ((ufd = open(ufile, O_WRONLY|O_CREAT|O_TRUNC, 0666)) < 0 ||
-		    write(ufd, &h, sizeof (h)) != sizeof (h) ||
-		    write(ufd, cd.cd_ctfdata, cd.cd_ctflen) != cd.cd_ctflen) {
-			warn("failed to write CTF data to '%s'", ufile);
-			error |= E_ERROR;
-		}
-
-		(void) close(ufd);
-	}
-
-	if (elf != NULL)
-		(void) elf_end(elf);
-
-	(void) close(fd);
-	return (error);
-}
diff --git a/usr/src/tools/ctf/dwarf/Makefile.com b/usr/src/tools/ctf/dwarf/Makefile.com
index 51e788ff04..d90e85b55a 100644
--- a/usr/src/tools/ctf/dwarf/Makefile.com
+++ b/usr/src/tools/ctf/dwarf/Makefile.com
@@ -67,11 +67,10 @@ OBJECTS=dwarf_abbrev.o		\
 
 include $(SRC)/lib/Makefile.lib
 
-SRCS=	$(PICS:%.o=../common/%.c)
 
-FILEMODE	= 0755
-
-SRCDIR = ../common/
+FILEMODE =	0755
+SRCDIR =	$(SRC)/lib/libdwarf/common/
+SRCS =		$(PICS:%.o=$(SRCDIR)/%.c)
 
 CPPFLAGS +=	-I$(SRCDIR) -DELF_TARGET_ALL=1
 CERRWARN +=	-_gcc=-Wno-unused
diff --git a/usr/src/tools/ctf/libctf/Makefile b/usr/src/tools/ctf/libctf/Makefile
new file mode 100644
index 0000000000..5e9236c43d
--- /dev/null
+++ b/usr/src/tools/ctf/libctf/Makefile
@@ -0,0 +1,46 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+include ../../Makefile.tools
+
+HDRS = libctf.h
+HDRDIR = common
+
+SUBDIRS = $(MACH) 
+
+all := TARGET = all
+clean := TARGET = clean
+clobber := TARGET = clobber
+install := TARGET = install
+lint := TARGET = lint
+
+.KEEP_STATE:
+
+all clean clobber install lint: $(SUBDIRS)
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
diff --git a/usr/src/tools/ctf/libctf/Makefile.com b/usr/src/tools/ctf/libctf/Makefile.com
new file mode 100644
index 0000000000..0444b975d5
--- /dev/null
+++ b/usr/src/tools/ctf/libctf/Makefile.com
@@ -0,0 +1,55 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc.
+#
+
+include $(SRC)/lib/libctf/Makefile.shared.com
+include ../../Makefile.ctf
+
+#
+# For some reason LDFLAGS doesn't seem to be taking effect at the
+# moment. Therefore add what we need to LDLIBS for now.
+#
+LDLIBS += \
+	-L$(ROOTONBLDLIBMACH) \
+	'-R$$ORIGIN/../../lib/$(MACH)' \
+
+CPPFLAGS +=	-I$(SRC)/lib/libctf/common/ \
+		-I$(SRC)/lib/libdwarf/common/ \
+		-I$(SRC)/lib/mergeq \
+		-include ../../common/ctf_headers.h \
+		-DCTF_OLD_VERSIONS \
+		-DCTF_TOOLS_BUILD
+LDLIBS += -lc -lelf -ldwarf -lavl
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+install: all $(ROOTONBLDLIBMACH)/libctf.so.1 $(ROOTONBLDLIBMACH)/libctf.so
+
+$(ROOTONBLDLIBMACH)/%: %
+	$(INS.file)
+
+$(ROOTONBLDLIBMACH)/$(LIBLINKS): $(ROOTONBLDLIBMACH)/$(LIBLINKS)$(VERS)
+	$(INS.liblink)
+
+#
+# Just like with libdwarf, we can't actually add ctf to ourselves,
+# because we're part of the tools for creating CTF.
+#
+$(DYNLIB) := CTFMERGE_POST= :
+CTFCONVERT_O= :
+
+include $(SRC)/lib/Makefile.targ
+include $(SRC)/lib/libctf/Makefile.shared.targ
diff --git a/usr/src/tools/ctf/libctf/i386/Makefile b/usr/src/tools/ctf/libctf/i386/Makefile
new file mode 100644
index 0000000000..bb2f077f86
--- /dev/null
+++ b/usr/src/tools/ctf/libctf/i386/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc. 
+#
+
+include ../Makefile.com
+
+all:	$(LIBS)
diff --git a/usr/src/tools/ctf/libctf/sparc/Makefile b/usr/src/tools/ctf/libctf/sparc/Makefile
new file mode 100644
index 0000000000..bb2f077f86
--- /dev/null
+++ b/usr/src/tools/ctf/libctf/sparc/Makefile
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2015, Joyent, Inc. 
+#
+
+include ../Makefile.com
+
+all:	$(LIBS)
diff --git a/usr/src/tools/env/illumos.sh b/usr/src/tools/env/illumos.sh
index 9c911632c0..0b5234aa6d 100644
--- a/usr/src/tools/env/illumos.sh
+++ b/usr/src/tools/env/illumos.sh
@@ -224,3 +224,9 @@ export ENABLE_SMB_PRINTING=
 #export PERL_VERSION=5.16.1
 #export PERL_ARCH=i86pc-solaris-thread-multi-64int
 #export PERL_PKGVERS=-5161
+
+#
+# These checks ensure that if we accidentally run a program linked against the
+# proto area, that we then fail the build.
+#
+export LD_TOXIC_PATH="$ROOT/lib:$ROOT/usr/lib"
diff --git a/usr/src/tools/findunref/exception_list.git b/usr/src/tools/findunref/exception_list.git
new file mode 100644
index 0000000000..d14dbd22f0
--- /dev/null
+++ b/usr/src/tools/findunref/exception_list.git
@@ -0,0 +1,39 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2009 Cyril Plisko.  All rights reserved.
+# Use is subject to license terms.
+#
+
+#
+# Git-specific exception list
+#
+# See README.exception_lists for details
+#
+
+#
+# Without nested repositories, this list could be empty, because ON
+# checks for unref relative to usr, and the git files are all in the
+# root of the repository.
+#
+
+*/.git
diff --git a/usr/src/tools/findunref/exception_list.unknown b/usr/src/tools/findunref/exception_list.unknown
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/usr/src/tools/findunref/exception_list.unknown
diff --git a/usr/src/tools/make/lib/bsd/Makefile b/usr/src/tools/make/lib/bsd/Makefile
index 3dff341075..d9f7398611 100644
--- a/usr/src/tools/make/lib/bsd/Makefile
+++ b/usr/src/tools/make/lib/bsd/Makefile
@@ -28,4 +28,8 @@ install: all
 
 lint:
 
+# We can't create CTF in the tools build because of a bootstrap bug with the new CTF
+$(DYNLIB) := CTFMERGE_POST= :
+CTFCONVERT_O= :
+
 include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/tools/make/lib/makestate/Makefile.com b/usr/src/tools/make/lib/makestate/Makefile.com
index 7f2324264c..1bf0d1d89a 100644
--- a/usr/src/tools/make/lib/makestate/Makefile.com
+++ b/usr/src/tools/make/lib/makestate/Makefile.com
@@ -37,4 +37,8 @@ $(ROOTONBLDLIBMACH)/%: %
 $(ROOTONBLDLIBMACH64)/%: %
 	$(INS.file)
 
+# We can't create CTF in the tools build because of a bootstrap bug with the new CTF
+$(DYNLIB) := CTFMERGE_POST= :
+CTFCONVERT_O= :
+
 include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/tools/make/lib/mksh/Makefile b/usr/src/tools/make/lib/mksh/Makefile
index 418cb43cb5..b351b488bb 100644
--- a/usr/src/tools/make/lib/mksh/Makefile
+++ b/usr/src/tools/make/lib/mksh/Makefile
@@ -29,4 +29,8 @@ install: all
 
 lint:
 
+# We can't create CTF in the tools build because of a bootstrap bug with the new CTF
+$(DYNLIB) := CTFMERGE_POST= :
+CTFCONVERT_O= :
+
 include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/tools/make/lib/vroot/Makefile b/usr/src/tools/make/lib/vroot/Makefile
index e119349178..7965de5fde 100644
--- a/usr/src/tools/make/lib/vroot/Makefile
+++ b/usr/src/tools/make/lib/vroot/Makefile
@@ -50,4 +50,8 @@ install: all
 
 lint:
 
+# We can't create CTF in the tools build because of a bootstrap bug with the new CTF
+$(DYNLIB) := CTFMERGE_POST= :
+CTFCONVERT_O= :
+
 include $(SRC)/lib/Makefile.targ
diff --git a/usr/src/tools/man/Makefile b/usr/src/tools/man/Makefile
new file mode 100644
index 0000000000..5f0e685323
--- /dev/null
+++ b/usr/src/tools/man/Makefile
@@ -0,0 +1,37 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015, Joyent, Inc.
+#
+
+include $(SRC)/cmd/man/Makefile.com
+include ../Makefile.tools
+
+include ../Makefile.targ
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+%.o: $(SRC)/cmd/man/%.c
+	$(COMPILE.c) $<
+
+$(ROOTONBLDMACHPROG): $(PROG)
+
+install: $(ROOTONBLDMACHPROG)
+
+clean:
+	$(RM) $(OBJS) $(LINTFILES)
+
+include $(SRC)/tools/Makefile.targ
diff --git a/usr/src/tools/mandoc/Makefile b/usr/src/tools/mandoc/Makefile
index c60f0893ed..f6e39d759d 100644
--- a/usr/src/tools/mandoc/Makefile
+++ b/usr/src/tools/mandoc/Makefile
@@ -20,6 +20,9 @@ LCDIR=		$(SRC)/lib/libc/port
 include		$(SRC)/tools/Makefile.tools
 include		$(CMDDIR)/Makefile.common
 
+CPPFLAGS += -_gcc=-nostdinc -I/usr/include -I$(NATIVE_ADJUNCT)/include
+CPPFLAGS += -D_FILE_OFFSET_BITS=64
+LDFLAGS += -L$(NATIVE_ADJUNCT)/lib -R$(NATIVE_ADJUNCT)/lib
 OBJS +=		fts.o \
 		reallocarray.o \
 		recallocarray.o \
diff --git a/usr/src/tools/onbld/Checks/Cddl.py b/usr/src/tools/onbld/Checks/Cddl.py
index 1f5f99f953..0f4d995e89 100644
--- a/usr/src/tools/onbld/Checks/Cddl.py
+++ b/usr/src/tools/onbld/Checks/Cddl.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 
 CDDL = '''
 CDDL HEADER START
diff --git a/usr/src/tools/onbld/Checks/CmtBlk.py b/usr/src/tools/onbld/Checks/CmtBlk.py
index 2f3d29fa79..ddf5caec48 100644
--- a/usr/src/tools/onbld/Checks/CmtBlk.py
+++ b/usr/src/tools/onbld/Checks/CmtBlk.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 
 #
 # CDDL HEADER START
diff --git a/usr/src/tools/onbld/Checks/Comments.py b/usr/src/tools/onbld/Checks/Comments.py
index daf6aa47d9..5d6feb265a 100644
--- a/usr/src/tools/onbld/Checks/Comments.py
+++ b/usr/src/tools/onbld/Checks/Comments.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
@@ -38,7 +38,7 @@ import re, sys
 from onbld.Checks.DbLookups import BugDB
 
 
-bugre = re.compile(r'^(\d{2,7}) (.*)$')
+bugre = re.compile(r'^(\d{2,7}|[A-Z]{1,7}-\d{1,7}) (.*)$')
 
 
 def isBug(comment):
diff --git a/usr/src/tools/onbld/Checks/Copyright.py b/usr/src/tools/onbld/Checks/Copyright.py
index 81a80058aa..8071b7f435 100644
--- a/usr/src/tools/onbld/Checks/Copyright.py
+++ b/usr/src/tools/onbld/Checks/Copyright.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
diff --git a/usr/src/tools/onbld/Checks/DbLookups.py b/usr/src/tools/onbld/Checks/DbLookups.py
index 11fd4185be..2843673035 100644
--- a/usr/src/tools/onbld/Checks/DbLookups.py
+++ b/usr/src/tools/onbld/Checks/DbLookups.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
@@ -37,6 +37,7 @@ import htmllib
 import re
 import urllib
 import urllib2
+import json
 
 try:				# Python >= 2.5
 	from xml.etree import ElementTree
@@ -62,9 +63,9 @@ class BugDB(object):
 	print r["6505625"]["synopsis"]
 	"""
 
-	VALID_DBS = ["illumos"]
+	VALID_DBS = ["illumos", "smartos"]
 
-	def __init__(self, priority = ["illumos"]):
+	def __init__(self, priority = VALID_DBS):
 		"""Create a BugDB object.
 
 		Keyword argument:
@@ -75,6 +76,24 @@ class BugDB(object):
 				raise BugDBException, database
 		self.__priority = priority
 
+	def __smartosbug(self, cr):
+		url = "http://smartos.org/bugview/json/%s" % cr
+		req = urllib2.Request(url)
+
+		try:
+			data = urllib2.urlopen(req)
+		except urllib2.HTTPError, e:
+			if e.code == 404 or e.code == 403 or e.code == 400:
+				raise NonExistentBug(cr)
+			else:
+				raise
+
+		bug = json.load(data)
+
+		return {'cr_number': bug['id'],
+			'synopsis': bug['summary']
+		}
+
 
 	def __illbug(self, cr):
 		url = "http://illumos.org/issues/%s.xml" % cr
@@ -117,6 +136,12 @@ class BugDB(object):
 						results[str(cr)] = self.__illbug(cr)
 					except NonExistentBug:
 						continue
+			elif database == "smartos":
+				for cr in crs:
+					try:
+						results[str(cr)] = self.__smartosbug(cr)
+					except NonExistentBug:
+						continue
 
 			# the CR has already been found by one bug database
 			# so don't bother looking it up in the others
diff --git a/usr/src/tools/onbld/Checks/HdrChk.py b/usr/src/tools/onbld/Checks/HdrChk.py
index c2697dcaf2..8f7b946d12 100644
--- a/usr/src/tools/onbld/Checks/HdrChk.py
+++ b/usr/src/tools/onbld/Checks/HdrChk.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
diff --git a/usr/src/tools/onbld/Checks/Keywords.py b/usr/src/tools/onbld/Checks/Keywords.py
index 5c374c3abb..ac3555be32 100644
--- a/usr/src/tools/onbld/Checks/Keywords.py
+++ b/usr/src/tools/onbld/Checks/Keywords.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
@@ -24,8 +24,6 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
-#
 
 #
 # Mercurial (lack of) keyword checks
diff --git a/usr/src/tools/onbld/Checks/Mapfile.py b/usr/src/tools/onbld/Checks/Mapfile.py
index 2a8cb74aed..d4fa70d141 100644
--- a/usr/src/tools/onbld/Checks/Mapfile.py
+++ b/usr/src/tools/onbld/Checks/Mapfile.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
diff --git a/usr/src/tools/onbld/Checks/__init__.py b/usr/src/tools/onbld/Checks/__init__.py
index 9f0611d969..a8bca05d55 100644
--- a/usr/src/tools/onbld/Checks/__init__.py
+++ b/usr/src/tools/onbld/Checks/__init__.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
diff --git a/usr/src/tools/onbld/Scm/__init__.py b/usr/src/tools/onbld/Scm/__init__.py
index f45ecbc95f..8934eb3942 100644
--- a/usr/src/tools/onbld/Scm/__init__.py
+++ b/usr/src/tools/onbld/Scm/__init__.py
@@ -1,4 +1,4 @@
-#! /usr/bin/python
+#!ON_PYTHON
 #
 # CDDL HEADER START
 #
@@ -24,5 +24,3 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
-#
diff --git a/usr/src/tools/scripts/Makefile b/usr/src/tools/scripts/Makefile
index 3acb27d1a4..be65637a17 100644
--- a/usr/src/tools/scripts/Makefile
+++ b/usr/src/tools/scripts/Makefile
@@ -22,6 +22,7 @@
 # Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
 #
 # Copyright 2010, Richard Lowe
+# Copyright 2017 Joyent, Inc.
 
 SHELL=/usr/bin/ksh93
 
@@ -47,6 +48,7 @@ SHFILES= \
 PERLFILES= \
 	check_rtime \
 	find_elf \
+	gensetdefs \
 	interface_check \
 	interface_cmp \
 	jstyle \
diff --git a/usr/src/tools/scripts/bldenv.sh b/usr/src/tools/scripts/bldenv.sh
index ff098329f8..c60f072cc1 100644
--- a/usr/src/tools/scripts/bldenv.sh
+++ b/usr/src/tools/scripts/bldenv.sh
@@ -290,9 +290,6 @@ if "${flags.t}" ; then
 	export STABS="${TOOLS_PROTO}/opt/onbld/bin/${MACH}/stabs"
 	export CTFSTABS="${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ctfstabs"
 	export GENOFFSETS="${TOOLS_PROTO}/opt/onbld/bin/genoffsets"
-
-	export CTFCONVERT="${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ctfconvert"
-	export CTFMERGE="${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ctfmerge"
 	export NDRGEN="${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ndrgen"
 
 	PATH="${TOOLS_PROTO}/opt/onbld/bin/${MACH}:${PATH}"
diff --git a/usr/src/tools/scripts/build_cscope.conf b/usr/src/tools/scripts/build_cscope.conf
index 859b5137d6..298db1281b 100644
--- a/usr/src/tools/scripts/build_cscope.conf
+++ b/usr/src/tools/scripts/build_cscope.conf
@@ -22,8 +22,8 @@
 #
 # Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
 #
 # This file configures the set of cross-references built by build_cscope.
 # The format is:
@@ -35,6 +35,6 @@
 # directories.
 #
 
-complete  -f   .
+complete  ""   .
 uts	  ""   uts uts/sun4u uts/sun4v uts/i86pc
 psm	  ""   psm/stand psm/stand/boot psm/stand/boot/sparcv9/sun4u psm/stand/boot/sparcv9/sun4v
diff --git a/usr/src/tools/scripts/gensetdefs.pl b/usr/src/tools/scripts/gensetdefs.pl
new file mode 100644
index 0000000000..8ca5782feb
--- /dev/null
+++ b/usr/src/tools/scripts/gensetdefs.pl
@@ -0,0 +1,31 @@
+#!/usr/bin/perl -w
+#
+# COPYRIGHT 2013 Pluribus Networks Inc.
+#
+# All rights reserved. This copyright notice is Copyright Management
+# Information under 17 USC 1202 and is included to protect this work and
+# deter copyright infringement.  Removal or alteration of this Copyright
+# Management Information without the express written permission from
+# Pluribus Networks Inc is prohibited, and any such unauthorized removal
+# or alteration will be a violation of federal law.
+
+use strict;
+
+my @Sections = split(/\n/, `elfedit -r -e \'shdr:sh_name -osimple\' $ARGV[0] 2>&1`);
+
+foreach my $Section (@Sections) {
+	if ($Section =~ "^set_") {
+		print "\tfixing $Section\n";
+
+		chomp(my $SectionAddr = `elfedit -r -e \'shdr:sh_addr -onum $Section\' $ARGV[0] 2>&1`);
+		chomp(my $SectionSize = `elfedit -r -e \'shdr:sh_size -onum $Section\' $ARGV[0] 2>&1`);
+		my $SectionEnd = hex($SectionAddr) + hex($SectionSize);
+
+		`elfedit -e \'sym:st_bind __start_$Section global\' $ARGV[0] 2>&1`;
+		`elfedit -e \'sym:st_value __start_$Section $SectionAddr\' $ARGV[0] 2>&1`;
+		`elfedit -e \'sym:st_shndx __start_$Section $Section\' $ARGV[0] 2>&1`;
+		`elfedit -e \'sym:st_bind __stop_$Section global\' $ARGV[0] 2>&1`;
+		`elfedit -e \'sym:st_value __stop_$Section $SectionEnd\' $ARGV[0] 2>&1`;
+		`elfedit -e \'sym:st_shndx __stop_$Section $Section\' $ARGV[0] 2>&1`;
+	}
+}
diff --git a/usr/src/tools/scripts/nightly.sh b/usr/src/tools/scripts/nightly.sh
index cec1849ff0..34b0790701 100644
--- a/usr/src/tools/scripts/nightly.sh
+++ b/usr/src/tools/scripts/nightly.sh
@@ -25,6 +25,7 @@
 # Copyright 2008, 2010, Richard Lowe
 # Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
 # Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+# Copyright 2018 (c) Joyent, Inc.  All rights reserved.
 # Copyright (c) 2017 by Delphix. All rights reserved.
 # Copyright 2018 Joyent, Inc.
 # Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
@@ -1721,9 +1722,9 @@ if [[ "$t_FLAG" = "y" ]]; then
 		GENOFFSETS=${TOOLS_PROTO}/opt/onbld/bin/genoffsets
 		export GENOFFSETS
 
-		CTFCONVERT=${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ctfconvert
+		CTFCONVERT=${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ctfconvert-altexec
 		export CTFCONVERT
-		CTFMERGE=${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ctfmerge
+		CTFMERGE=${TOOLS_PROTO}/opt/onbld/bin/${MACH}/ctfmerge-altexec
 		export CTFMERGE
 
 		PATH="${TOOLS_PROTO}/opt/onbld/bin/${MACH}:${PATH}"
diff --git a/usr/src/tools/scripts/webrev.sh b/usr/src/tools/scripts/webrev.sh
index 7466bdcb13..88478554e1 100644
--- a/usr/src/tools/scripts/webrev.sh
+++ b/usr/src/tools/scripts/webrev.sh
@@ -2860,7 +2860,12 @@ done
 #
 # Output directory.
 #
-WDIR=${WDIR:-$CWS/webrev}
+if [[ $SCM_MODE == "git" ]]; then
+	ws_top_dir=$(dirname $CWS)
+	WDIR=${WDIR:-$ws_top_dir/webrev}
+else
+	WDIR=${WDIR:-$CWS/webrev}
+fi
 
 #
 # Name of the webrev, derived from the workspace name or output directory;
diff --git a/usr/src/ucbhead/Makefile b/usr/src/ucbhead/Makefile
new file mode 100644
index 0000000000..ef9fc7f2fe
--- /dev/null
+++ b/usr/src/ucbhead/Makefile
@@ -0,0 +1,68 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 1989-2003 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ucbhead/Makefile
+#
+# include global definitions
+include ../Makefile.master
+
+LN= ln
+
+HDRS= curses.h dbm.h setjmp.h sgtty.h signal.h stdio.h strings.h unistd.h
+
+SYSHDRS= \
+dir.h        fcntl.h      file.h       ioctl.h \
+param.h      resource.h   rusage.h     signal.h \
+sysmacros.h  ttychars.h   types.h      vfs.h \
+wait.h
+
+ROOTHDRS= $(HDRS:%=$(ROOT)/usr/ucbinclude/%)  \
+	$(SYSHDRS:%=$(ROOT)/usr/ucbinclude/sys/%)
+
+DIRS= sys
+ROOTDIRS= $(ROOT)/usr/ucbinclude $(DIRS:%=$(ROOT)/usr/ucbinclude/%)
+
+FCNTLH= $(ROOT)/usr/ucbinclude/fcntl.h
+SYSFCNTLH= $(ROOT)/usr/ucbinclude/sys/fcntl.h
+
+INS.FCNTLH=	$(RM) $@; $(SYMLINK) sys/fcntl.h $@
+
+# install rules
+$(ROOT)/usr/ucbinclude/sys/%: sys/%
+	$(INS.file)
+
+$(ROOT)/usr/ucbinclude/%: %
+	$(INS.file)
+
+.KEEP_STATE:
+
+install_h: $(ROOTDIRS) $(ROOTHDRS) $(FCNTLH)
+
+$(FCNTLH): $(SYSFCNTLH)
+	$(INS.FCNTLH)
+
+$(ROOTDIRS):
+	$(INS.dir)
+
diff --git a/usr/src/ucbhead/sys/file.h b/usr/src/ucbhead/sys/file.h
index 10863380dd..152141fcd7 100644
--- a/usr/src/ucbhead/sys/file.h
+++ b/usr/src/ucbhead/sys/file.h
@@ -77,6 +77,10 @@ typedef struct file
 #include <sys/fcntl.h>
 #endif
 
+#if !defined(__XOPEN_OR_POSIX) || defined(__EXTENSIONS__)
+int flock(int, int);
+#endif
+
 /* flags - see also fcntl.h */
 
 #ifndef FOPEN
diff --git a/usr/src/ucblib/libucb/port/sys/flock.c b/usr/src/ucblib/libucb/port/sys/flock.c
index d29a07eac0..364d4f1f5f 100644
--- a/usr/src/ucblib/libucb/port/sys/flock.c
+++ b/usr/src/ucblib/libucb/port/sys/flock.c
@@ -34,9 +34,9 @@
 
 /*LINTLIBRARY*/
 
+#include <sys/fcntl.h>
 #include <sys/types.h>
 #include <sys/file.h>
-#include <sys/fcntl.h>
 #include <errno.h>
 
 int
diff --git a/usr/src/uts/Makefile.mapfile b/usr/src/uts/Makefile.mapfile
new file mode 100644
index 0000000000..45ab0ae22b
--- /dev/null
+++ b/usr/src/uts/Makefile.mapfile
@@ -0,0 +1,43 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# This Makefile should be included in individual kernel modules to opt
+# into a -z defs world. Note, this should be included after a MAPFILES
+# entry is defined. See uts/common/README.mapfiles for more information.
+#
+
+#
+# Mapfile base
+#
+MAPBASE = $(UTSBASE)/common/mapfiles
+DTRACE_MAPFILE = $(OBJS_DIR)/dtrace.mapfile
+
+#
+# Always append -z defs to the LD FLAGS and append all mapfiles.
+#
+LDFLAGS += -z defs $(MAPFILES:%=-M $(MAPBASE)/%.mapfile) -M $(DTRACE_MAPFILE)
+
+#
+# Definitions and rulesto assemble the DTrace probe mapfile. There's no
+# good way to automatically do this, hence we have a slightly gross
+# series of automated tools. This does mean that we have a bit more work
+# to do, but also means that probes can be added arbitrarily without
+# having to manually edit mapfiles.
+#
+DTRACE_AWK_FILE = $(MAPBASE)/dtrace.mapfile.awk
+
+$(OBJS_DIR)/dtrace.mapfile: $(OBJECTS) $(DTRACE_AWK_FILE)
+	$(NM) -u $(OBJECTS) | $(AWK) -f $(DTRACE_AWK_FILE) > $@
diff --git a/usr/src/uts/Makefile.targ b/usr/src/uts/Makefile.targ
index 93a2bcc5ae..0fb7bb8a90 100644
--- a/usr/src/uts/Makefile.targ
+++ b/usr/src/uts/Makefile.targ
@@ -20,6 +20,7 @@
 #
 #
 # Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2015, Joyent, Inc.
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
 # Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
 #
@@ -50,7 +51,7 @@ $(OBJECTS): $(INLINES)
 #	Partially link .o files to generate the kmod. The fake dependency
 #	on modstubs simplifies things...
 #
-$(BINARY):		$(OBJECTS)
+$(BINARY):		$(OBJECTS) $(DTRACE_MAPFILE)
 	$(LD) -r $(LDFLAGS) -o $@ $(OBJECTS)
 	$(CTFMERGE_UNIQUIFY_AGAINST_GENUNIX)
 	$(POST_PROCESS)
@@ -204,6 +205,9 @@ $(ROOT_FONT_DIR)/%:	$(OBJS_DIR)/% $(ROOT_MOD_DIR) $(ROOT_FONT_DIR) FRC
 $(ROOT_MAC_DIR)/%:	$(OBJS_DIR)/% $(ROOT_MOD_DIR) $(ROOT_MAC_DIR) FRC
 	$(INS.file)
 
+$(ROOT_OVERLAY_DIR)/%:	$(OBJS_DIR)/% $(ROOT_MOD_DIR) $(ROOT_OVERLAY_DIR) FRC
+	$(INS.file)
+
 $(USR_DRV_DIR)/%:	$(OBJS_DIR)/% $(USR_DRV_DIR) FRC
 	$(INS.file)
 
diff --git a/usr/src/uts/Makefile.uts b/usr/src/uts/Makefile.uts
index f9eeb946fa..76cd9aef72 100644
--- a/usr/src/uts/Makefile.uts
+++ b/usr/src/uts/Makefile.uts
@@ -24,6 +24,7 @@
 # Copyright (c) 2011 Bayard G. Bell. All rights reserved.
 # Copyright (c) 2011 by Delphix. All rights reserved.
 # Copyright (c) 2013 Andrew Stormont.  All rights reserved.
+# Copyright 2015 Joyent, Inc.
 # Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
 #
 
@@ -214,6 +215,7 @@ AS_CPPFLAGS	= $(ALWAYS_DEFS) $(ALL_DEFS) $(CONFIG_DEFS) $(AS_DEFS) \
 
 # Override the default, the kernel is squeaky clean
 CERRWARN = -errtags=yes -errwarn=%all
+$(__GNUC4)CERRWARN += -_gcc=-Wno-address
 
 CERRWARN += -_gcc=-Wno-missing-braces
 CERRWARN += -_gcc=-Wno-sign-compare
@@ -413,6 +415,7 @@ ROOT_FONT_DIR_32	= $(ROOT_MOD_DIR)/fonts
 ROOT_DACF_DIR_32	= $(ROOT_MOD_DIR)/dacf
 ROOT_CRYPTO_DIR_32	= $(ROOT_MOD_DIR)/crypto
 ROOT_MAC_DIR_32		= $(ROOT_MOD_DIR)/mac
+ROOT_OVERLAY_DIR_32	= $(ROOT_MOD_DIR)/overlay
 ROOT_KICONV_DIR_32	= $(ROOT_MOD_DIR)/kiconv
 
 ROOT_KERN_DIR_64	= $(ROOT_MOD_DIR)/$(SUBDIR64)
@@ -440,6 +443,7 @@ ROOT_FONT_DIR_64	= $(ROOT_MOD_DIR)/fonts/$(SUBDIR64)
 ROOT_DACF_DIR_64	= $(ROOT_MOD_DIR)/dacf/$(SUBDIR64)
 ROOT_CRYPTO_DIR_64	= $(ROOT_MOD_DIR)/crypto/$(SUBDIR64)
 ROOT_MAC_DIR_64		= $(ROOT_MOD_DIR)/mac/$(SUBDIR64)
+ROOT_OVERLAY_DIR_64	= $(ROOT_MOD_DIR)/overlay/$(SUBDIR64)
 ROOT_KICONV_DIR_64	= $(ROOT_MOD_DIR)/kiconv/$(SUBDIR64)
 
 ROOT_KERN_DIR		= $(ROOT_KERN_DIR_$(CLASS))
@@ -467,6 +471,7 @@ ROOT_FONT_DIR		= $(ROOT_FONT_DIR_$(CLASS))
 ROOT_DACF_DIR		= $(ROOT_DACF_DIR_$(CLASS))
 ROOT_CRYPTO_DIR		= $(ROOT_CRYPTO_DIR_$(CLASS))
 ROOT_MAC_DIR		= $(ROOT_MAC_DIR_$(CLASS))
+ROOT_OVERLAY_DIR	= $(ROOT_OVERLAY_DIR_$(CLASS))
 ROOT_KICONV_DIR		= $(ROOT_KICONV_DIR_$(CLASS))
 ROOT_FIRMWARE_DIR	= $(ROOT_MOD_DIR)/firmware
 
@@ -485,6 +490,7 @@ ROOT_MOD_DIRS_32        += $(ROOT_EMLXS_FW_DIR_32)
 ROOT_MOD_DIRS_32	+= $(ROOT_CPU_DIR_32) $(ROOT_FONT_DIR_32)
 ROOT_MOD_DIRS_32	+= $(ROOT_TOD_DIR_32) $(ROOT_DACF_DIR_32)
 ROOT_MOD_DIRS_32	+= $(ROOT_CRYPTO_DIR_32) $(ROOT_MAC_DIR_32)
+ROOT_MOD_DIRS_32	+= $(ROOT_OVERLAY_DIR_32)
 ROOT_MOD_DIRS_32	+= $(ROOT_KICONV_DIR_32)
 ROOT_MOD_DIRS_32	+= $(ROOT_FIRMWARE_DIR)
 
@@ -578,7 +584,7 @@ PARALLEL_KMODS = $(DRV_KMODS) $(EXEC_KMODS) $(FS_KMODS) $(SCHED_KMODS) \
 		 $(MMU_KMODS) $(DACF_KMODS) $(EXPORT_KMODS) $(IPP_KMODS) \
 		 $(CRYPTO_KMODS) $(PCBE_KMODS) \
 		 $(DRV_KMODS_$(CLASS)) $(MISC_KMODS_$(CLASS)) $(MAC_KMODS) \
-		 $(BRAND_KMODS) $(KICONV_KMODS) \
+		 $(BRAND_KMODS) $(KICONV_KMODS) $(OVERLAY_KMODS) \
 		 $(SOCKET_KMODS)
 
 KMODS = $(GENUNIX_KMODS) $(PARALLEL_KMODS)
@@ -632,3 +638,11 @@ PRIVS_DEF = $(SRC)/uts/common/os/priv_defs
 #
 USBDEVS_AWK =	$(SRC)/uts/common/io/usb/usbdevs2h.awk
 USBDEVS_DATA =	$(SRC)/uts/common/io/usb/usbdevs
+
+
+#
+# If we're using the newer CTF tools, then we need to make sure that we
+# are building with the private -X option to ctfconvert which allows us
+# to fixup the struct cpu to account for machcpu.
+#
+$(ENABLE_NEW_CTF)$(__GNUC)CTFCVTFLAGS += -X
diff --git a/usr/src/uts/common/Makefile.files b/usr/src/uts/common/Makefile.files
index 43f3aacb75..c9d04fb798 100644
--- a/usr/src/uts/common/Makefile.files
+++ b/usr/src/uts/common/Makefile.files
@@ -25,7 +25,7 @@
 # Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
 # Copyright 2018 Nexenta Systems, Inc.
 # Copyright 2016 Garrett D'Amore <garrett@damore.org>
-# Copyright (c) 2017, Joyent, Inc.
+# Copyright 2017 Joyent, Inc.
 # Copyright 2016 OmniTI Computer Consulting, Inc.  All rights reserved.
 # Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
 #
@@ -286,6 +286,7 @@ GENUNIX_OBJS +=	\
 		rctl.o		\
 		rctlsys.o	\
 		readlink.o	\
+		refhash.o	\
 		refstr.o	\
 		rename.o	\
 		resolvepath.o	\
@@ -435,6 +436,8 @@ PROFILE_OBJS += profile.o
 
 SYSTRACE_OBJS += systrace.o
 
+LX_SYSTRACE_OBJS += lx_systrace.o
+
 LOCKSTAT_OBJS += lockstat.o
 
 FASTTRAP_OBJS += fasttrap.o fasttrap_isa.o
@@ -497,6 +500,10 @@ PTSL_OBJS +=	tty_pts.o
 
 PTM_OBJS +=	ptm.o
 
+LX_PTM_OBJS +=	lx_ptm.o
+
+LX_NETLINK_OBJS +=	lx_netlink.o
+
 MII_OBJS +=	mii.o mii_cicada.o mii_natsemi.o mii_intel.o mii_qualsemi.o \
 		mii_marvell.o mii_realtek.o mii_other.o
 
@@ -554,6 +561,7 @@ IP_SCTP_OBJS =	sctp.o sctp_opt_data.o sctp_output.o \
 		sctp_addr.o tn_ipopt.o tnet.o ip_netinfo.o \
 		sctp_misc.o
 IP_ILB_OBJS =	ilb.o ilb_nat.o ilb_conn.o ilb_alg_hash.o ilb_alg_rr.o
+IP_COMM_OBJS =	inet_hash.o
 
 IP_OBJS +=	igmp.o ipmp.o ip.o ip6.o ip6_asp.o ip6_if.o ip6_ire.o \
 		ip6_rts.o ip_if.o ip_ire.o ip_listutils.o ip_mroute.o \
@@ -564,12 +572,14 @@ IP_OBJS +=	igmp.o ipmp.o ip.o ip6.o ip6_asp.o ip6_if.o ip6_ire.o \
 		ip_helper_stream.o ip_tunables.o \
 		ip_output.o ip_input.o ip6_input.o ip6_output.o ip_arp.o \
 		conn_opt.o ip_attr.o ip_dce.o \
+		bpf_filter.o \
 		$(IP_ICMP_OBJS) \
 		$(IP_RTS_OBJS) \
 		$(IP_TCP_OBJS) \
 		$(IP_UDP_OBJS) \
 		$(IP_SCTP_OBJS) \
-		$(IP_ILB_OBJS)
+		$(IP_ILB_OBJS) \
+		$(IP_COMM_OBJS)
 
 IP6_OBJS +=	ip6ddi.o
 
@@ -587,6 +597,8 @@ IPSECESP_OBJS += ipsecespddi.o ipsecesp.o
 
 IPSECAH_OBJS +=	ipsecahddi.o ipsecah.o sadb.o
 
+DATAFILT_OBJS += datafilt.o
+
 SPPP_OBJS +=	sppp.o sppp_dlpi.o sppp_mod.o s_common.o
 
 SPPPTUN_OBJS +=	sppptun.o sppptun_mod.o
@@ -640,7 +652,7 @@ TL_OBJS +=	tl.o
 
 DUMP_OBJS +=	dump.o
 
-BPF_OBJS +=	bpf.o bpf_filter.o bpf_mod.o bpf_dlt.o bpf_mac.o
+BPF_OBJS +=	bpf.o bpf_wrap.o bpf_mod.o bpf_dlt.o bpf_mac.o
 
 CLONE_OBJS +=	clone.o
 
@@ -684,6 +696,15 @@ NET80211_OBJS += net80211.o net80211_proto.o net80211_input.o \
 
 VNIC_OBJS +=	vnic_ctl.o vnic_dev.o
 
+OVERLAY_OBJS +=	overlay.o overlay_fm.o overlay_mux.o overlay_plugin.o \
+		overlay_prop.o overlay_target.o
+
+OVERLAY_VXLAN_OBJS +=	overlay_vxlan.o
+
+VND_OBJS +=	vnd.o frameio.o
+
+GSQUEUE_OBJS +=	gsqueue.o
+
 SIMNET_OBJS +=	simnet.o
 
 IB_OBJS +=	ibnex.o ibnex_ioctl.o ibnex_hca.o
@@ -936,6 +957,8 @@ SIGNALFD_OBJS += signalfd.o
 
 I8042_OBJS +=	i8042.o
 
+INOTIFY_OBJS +=	inotify.o
+
 KB8042_OBJS +=	\
 		at_keyprocess.o	\
 		kb8042.o	\
@@ -1010,6 +1033,8 @@ QLGE_OBJS += qlge.o qlge_dbg.o qlge_flash.o qlge_fm.o qlge_gld.o qlge_mpi.o
 
 ZCONS_OBJS += zcons.o
 
+ZFD_OBJS += zfd.o
+
 NV_SATA_OBJS += nv_sata.o
 
 SI3124_OBJS += si3124.o
@@ -1063,8 +1088,7 @@ DEVFS_OBJS +=	devfs_subr.o	devfs_vfsops.o	devfs_vnops.o
 DEV_OBJS  +=	sdev_subr.o	sdev_vfsops.o	sdev_vnops.o	\
 		sdev_ptsops.o	sdev_zvolops.o	sdev_comm.o	\
 		sdev_profile.o	sdev_ncache.o	sdev_netops.o	\
-		sdev_ipnetops.o	\
-		sdev_vtops.o
+		sdev_ipnetops.o	sdev_vtops.o	sdev_plugin.o
 
 CTFS_OBJS +=	ctfs_all.o ctfs_cdir.o ctfs_ctl.o ctfs_event.o \
 		ctfs_latest.o ctfs_root.o ctfs_sym.o ctfs_tdir.o ctfs_tmpl.o
@@ -1081,8 +1105,13 @@ PIPE_OBJS +=	pipe.o
 HSFS_OBJS +=	hsfs_node.o	hsfs_subr.o	hsfs_vfsops.o	hsfs_vnops.o \
 		hsfs_susp.o	hsfs_rrip.o	hsfs_susp_subr.o
 
+HYPRLOFS_OBJS += hyprlofs_dir.o hyprlofs_subr.o \
+		hyprlofs_vnops.o hyprlofs_vfsops.o
+
 LOFS_OBJS +=	lofs_subr.o	lofs_vfsops.o	lofs_vnops.o
 
+LXPROC_OBJS +=	lxpr_subr.o	lxpr_vfsops.o	lxpr_vnops.o
+
 NAMEFS_OBJS +=	namevfs.o	namevno.o
 
 NFS_OBJS +=	nfs_client.o	nfs_common.o	nfs_dump.o \
@@ -1234,8 +1263,8 @@ SMBSRV_OBJS +=	$(SMBSRV_SHARED_OBJS)			\
 PCFS_OBJS +=	pc_alloc.o	pc_dir.o	pc_node.o	pc_subr.o \
 		pc_vfsops.o	pc_vnops.o
 
-PROC_OBJS +=	prcontrol.o	prioctl.o	prsubr.o	prusrio.o \
-		prvfsops.o	prvnops.o
+PROC_OBJS +=	prargv.o	prcontrol.o	prioctl.o	prsubr.o \
+		prusrio.o	prvfsops.o	prvnops.o
 
 MNTFS_OBJS +=	mntvfsops.o	mntvnops.o
 
@@ -1396,6 +1425,7 @@ ZFS_COMMON_OBJS +=		\
 	zfs_fuid.o		\
 	zfs_sa.o		\
 	zfs_znode.o		\
+	zfs_zone.o		\
 	zil.o			\
 	zio.o			\
 	zio_checksum.o		\
@@ -1857,7 +1887,7 @@ ZYD_OBJS += zyd.o zyd_usb.o zyd_hw.o zyd_fw.o
 
 MXFE_OBJS += mxfe.o
 
-MPTSAS_OBJS += mptsas.o mptsas_hash.o mptsas_impl.o mptsas_init.o \
+MPTSAS_OBJS += mptsas.o mptsas_impl.o mptsas_init.o \
 		mptsas_raid.o mptsas_smhba.o
 
 SFE_OBJS += sfe.o sfe_util.o
@@ -1892,9 +1922,9 @@ LINT_DEFS	+= -Dunix
 #	It is a bug in the current compilation system that the assember
 #	can't process the -Y I, flag.
 #
-NATIVE_INC_PATH += $(INC_PATH) $(CCYFLAG)$(UTSBASE)/common
-AS_INC_PATH	+= $(INC_PATH) -I$(UTSBASE)/common
-INCLUDE_PATH    += $(INC_PATH) $(CCYFLAG)$(UTSBASE)/common
+NATIVE_INC_PATH += $(PRE_INC_PATH) $(INC_PATH) $(CCYFLAG)$(UTSBASE)/common
+AS_INC_PATH	+= $(PRE_INC_PATH) $(INC_PATH) -I$(UTSBASE)/common
+INCLUDE_PATH    += $(PRE_INC_PATH) $(INC_PATH) $(CCYFLAG)$(UTSBASE)/common
 
 PCIEB_OBJS += pcieb.o
 
@@ -2092,6 +2122,11 @@ MEGA_SAS_OBJS = megaraid_sas.o
 MR_SAS_OBJS = ld_pd_map.o mr_sas.o mr_sas_tbolt.o mr_sas_list.o
 
 #
+#	DR_SAS module
+#
+DR_SAS_OBJS = dr_sas.o
+
+#
 #	CPQARY3 module
 #
 CPQARY3_OBJS =	cpqary3.o cpqary3_noe.o cpqary3_talk2ctlr.o	\
@@ -2100,6 +2135,20 @@ CPQARY3_OBJS =	cpqary3.o cpqary3_noe.o cpqary3_talk2ctlr.o	\
 		cpqary3_bd.o
 
 #
+#	HP Smart Array driver module (smrt)
+#
+SMRT_OBJS =	smrt.o \
+		smrt_device.o \
+		smrt_interrupts.o \
+		smrt_commands.o \
+		smrt_logvol.o \
+		smrt_hba.o \
+		smrt_ciss_simple.o \
+		smrt_ciss.o \
+		smrt_physical.o \
+		smrt_sata.o
+
+#
 #	ISCSI_INITIATOR module
 #
 ISCSI_INITIATOR_OBJS =	chap.o iscsi_io.o iscsi_thread.o	\
@@ -2139,6 +2188,11 @@ URF_OBJS = urf_usbgem.o
 UPF_OBJS = upf_usbgem.o
 
 #
+#	NFP objects
+#
+NFP_OBJS = hostif.o osif.o drvlist.o i21555.o i21285.o i21555d.o
+
+#
 #	BNXE objects
 #
 BNXE_OBJS +=	bnxe_cfg.o		\
diff --git a/usr/src/uts/common/Makefile.rules b/usr/src/uts/common/Makefile.rules
index 9bf6f18a26..6c48ec8930 100644
--- a/usr/src/uts/common/Makefile.rules
+++ b/usr/src/uts/common/Makefile.rules
@@ -23,7 +23,7 @@
 # Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2016 Garrett D'Amore <garrett@damore.org>
 # Copyright 2013 Saso Kiselkov. All rights reserved.
-# Copyright 2016 Joyent, Inc.
+# Copyright 2017 Joyent, Inc.
 # Copyright 2018 Nexenta Systems, Inc.
 # Copyright (c) 2016 by Delphix. All rights reserved.
 #
@@ -98,6 +98,10 @@ $(OBJS_DIR)/%.o:		$(COMMONBASE)/avl/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(COMMONBASE)/inet/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(COMMONBASE)/ucode/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -263,10 +267,18 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/fs/hsfs/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/fs/hyprlofs/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/fs/lofs/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/fs/lxproc/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/fs/mntfs/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -746,6 +758,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/drm/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/dr_sas/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/efe/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -946,6 +962,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/net80211/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/nfp/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/nge/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -965,6 +985,14 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/nxge/npi/%.c
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/nxge/%.s
 	$(COMPILE.s) -o $@ $<
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/overlay/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/overlay/plugins/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/pci-ide/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -1069,6 +1097,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/scsi/adapters/scsi_vhci/fops/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/scsi/adapters/smrt/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/fibre-channel/ulp/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -1109,6 +1141,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/sdcard/targets/sdcard/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/gsqueue/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/sfe/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -1121,6 +1157,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/softmac/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/vnd/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/uath/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -1465,9 +1505,14 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/vioblk/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(COMMONBASE)/idspace/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/vioif/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
+
 #
 # krtld must refer to its own bzero/bcopy until the kernel is fully linked
 #
@@ -1532,6 +1577,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/pcmcia/pcs/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/refhash/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/rpc/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -1655,6 +1704,9 @@ $(LINTS_DIR)/%.ln:		$(COMMONBASE)/acl/%.c
 $(LINTS_DIR)/%.ln:		$(COMMONBASE)/avl/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(COMMONBASE)/inet/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(COMMONBASE)/ucode/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -1769,9 +1821,15 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/fs/fifofs/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/fs/hsfs/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/fs/hyprlofs/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/fs/lofs/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/fs/lxproc/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/fs/mntfs/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2120,6 +2178,9 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/dmfe/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/drm/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/dr_sas/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/efe/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2267,6 +2328,9 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/mwl/mwl_fw/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/net80211/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/nfp/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:              $(UTSBASE)/common/io/nge/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2282,6 +2346,12 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/nxge/%.s
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/nxge/npi/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/overlay/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/overlay/plugins/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/pci-ide/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2351,6 +2421,9 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/scsi/adapters/scsi_vhci/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/scsi/adapters/scsi_vhci/fops/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/scsi/adapters/smrt/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/fibre-channel/ulp/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2390,6 +2463,9 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/sdcard/impl/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/sdcard/targets/sdcard/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:              $(UTSBASE)/common/io/gsqueue/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:              $(UTSBASE)/common/io/sfe/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2399,6 +2475,9 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/simnet/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/softmac/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/vnd/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/uath/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2660,6 +2739,9 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/pcmcia/nexus/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/pcmcia/pcs/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/refhash/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/rpc/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
@@ -2753,3 +2835,6 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/skd/%.c
 
 $(LINTS_DIR)/%.ln:		$(COMMONBASE)/fsreparse/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(COMMONBASE)/idspace/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/common/brand/lx/autofs/lx_autofs.c b/usr/src/uts/common/brand/lx/autofs/lx_autofs.c
new file mode 100644
index 0000000000..730deae80e
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/autofs/lx_autofs.c
@@ -0,0 +1,3174 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * See the big theory statement in ../sys/lx_autofs.h
+ */
+
+#include <fs/fs_subr.h>
+#include <sys/stat.h>
+#include <sys/atomic.h>
+#include <sys/cmn_err.h>
+#include <sys/dirent.h>
+#include <sys/fs/fifonode.h>
+#include <sys/modctl.h>
+#include <sys/mount.h>
+#include <sys/policy.h>
+#include <sys/sunddi.h>
+#include <sys/conf.h>
+#include <sys/sdt.h>
+
+#include <sys/sysmacros.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+
+#include <sys/dnlc.h>
+#include <nfs/rnode.h>
+#include <nfs/rnode4.h>
+#include <sys/lx_autofs_impl.h>
+#include <sys/lx_types.h>
+
+/*
+ * External functions
+ */
+extern uintptr_t		space_fetch(char *key);
+extern int			space_store(char *key, uintptr_t ptr);
+extern int			umount2_engine(vfs_t *, int, cred_t *, int);
+
+/*
+ * Globals
+ */
+static vfsops_t			*lx_autofs_vfsops;
+static vnodeops_t		*lx_autofs_vn_ops = NULL;
+static int			lx_autofs_fstype;
+static major_t			lx_autofs_major;
+static minor_t			lx_autofs_minor = 0;
+static dev_info_t		*lx_autofs_dip = NULL;
+
+#define	LX_AUTOFS_DEV_VERSION_MAJOR	1
+#define	LX_AUTOFS_DEV_VERSION_MINOR	0
+
+/* The Linux autofs superblock magic number */
+#define	LX_AUTOFS_SB_MAGIC	0x0187
+
+/* Linux autofs mount types */
+#define	LX_AUTOFS_TYPE_INDIRECT		1
+#define	LX_AUTOFS_TYPE_DIRECT		2
+#define	LX_AUTOFS_TYPE_OFFSET		4
+
+/* Structure passed for autofs dev ioctls */
+typedef struct lx_autofs_dv_ioctl {
+	uint32_t lad_ver_major;
+	uint32_t lad_ver_minor;
+	uint32_t lad_size;
+	uint32_t lad_ioctlfd;
+	uint32_t lad_arg1;
+	uint32_t lad_arg2;
+	char	lad_path[0];
+} lx_autofs_dv_ioctl_t;
+
+/*
+ * Support functions
+ */
+static void
+lx_autofs_strfree(char *str)
+{
+	kmem_free(str, strlen(str) + 1);
+}
+
+static char *
+lx_autofs_strdup(char *str)
+{
+	int	n = strlen(str);
+	char	*ptr = kmem_alloc(n + 1, KM_SLEEP);
+	bcopy(str, ptr, n + 1);
+	return (ptr);
+}
+
+static int
+lx_autofs_str_to_int(char *str, int *val)
+{
+	long	res;
+
+	if (str == NULL)
+		return (-1);
+
+	if ((ddi_strtol(str, NULL, 10, &res) != 0) ||
+	    (res < INT_MIN) || (res > INT_MAX))
+		return (-1);
+
+	*val = res;
+	return (0);
+}
+
+static void
+ls_autofs_stack_init(list_t *lp)
+{
+	list_create(lp,
+	    sizeof (stack_elem_t), offsetof(stack_elem_t, se_list));
+}
+
+static void
+lx_autofs_stack_fini(list_t *lp)
+{
+	ASSERT(list_head(lp) == NULL);
+	list_destroy(lp);
+}
+
+static void
+lx_autofs_stack_push(list_t *lp, caddr_t ptr1, caddr_t ptr2, caddr_t ptr3)
+{
+	stack_elem_t	*se;
+
+	se = kmem_alloc(sizeof (*se), KM_SLEEP);
+	se->se_ptr1 = ptr1;
+	se->se_ptr2 = ptr2;
+	se->se_ptr3 = ptr3;
+	list_insert_head(lp, se);
+}
+
+static int
+lx_autofs_stack_pop(list_t *lp, caddr_t *ptr1, caddr_t *ptr2, caddr_t *ptr3)
+{
+	stack_elem_t	*se;
+
+	if ((se = list_head(lp)) == NULL)
+		return (-1);
+	list_remove(lp, se);
+	if (ptr1 != NULL)
+		*ptr1 = se->se_ptr1;
+	if (ptr2 != NULL)
+		*ptr2 = se->se_ptr2;
+	if (ptr3 != NULL)
+		*ptr3 = se->se_ptr3;
+	kmem_free(se, sizeof (*se));
+	return (0);
+}
+
+static vnode_t *
+lx_autofs_fifo_peer_vp(vnode_t *vp)
+{
+	fifonode_t *fnp = VTOF(vp);
+	fifonode_t *fn_dest = fnp->fn_dest;
+	return (FTOV(fn_dest));
+}
+
+static vnode_t *
+lx_autofs_vn_alloc(vfs_t *vfsp, vnode_t *uvp)
+{
+	lx_autofs_vfs_t	*data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	vnode_t		*vp, *vp_old;
+
+	/* Allocate a new vnode structure in case we need it. */
+	vp = vn_alloc(KM_SLEEP);
+	vn_setops(vp, lx_autofs_vn_ops);
+	VN_SET_VFS_TYPE_DEV(vp, vfsp, uvp->v_type, uvp->v_rdev);
+	vp->v_data = uvp;
+	ASSERT(vp->v_count == 1);
+
+	/*
+	 * Take a hold on the vfs structure.  This is how unmount will
+	 * determine if there are any active vnodes in the file system.
+	 */
+	VFS_HOLD(vfsp);
+
+	/*
+	 * Check if we already have a vnode allocated for this underlying
+	 * vnode_t.
+	 */
+	mutex_enter(&data->lav_lock);
+	if (mod_hash_find(data->lav_vn_hash,
+	    (mod_hash_key_t)uvp, (mod_hash_val_t *)&vp_old) != 0) {
+
+		/*
+		 * Didn't find an existing node.
+		 * Add this node to the hash and return.
+		 */
+		VERIFY(mod_hash_insert(data->lav_vn_hash,
+		    (mod_hash_key_t)uvp,
+		    (mod_hash_val_t)vp) == 0);
+		mutex_exit(&data->lav_lock);
+		return (vp);
+	}
+
+	/* Get a hold on the existing vnode and free up the one we allocated. */
+	VN_HOLD(vp_old);
+	mutex_exit(&data->lav_lock);
+
+	/* Free up the new vnode we allocated. */
+	VN_RELE(uvp);
+	VFS_RELE(vfsp);
+	vn_invalid(vp);
+	vn_free(vp);
+
+	return (vp_old);
+}
+
+static void
+lx_autofs_vn_free(vnode_t *vp)
+{
+	vfs_t		*vfsp = vp->v_vfsp;
+	lx_autofs_vfs_t	*data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	vnode_t		*uvp = vp->v_data;
+	vnode_t	*vp_tmp;
+
+	ASSERT(MUTEX_HELD((&data->lav_lock)));
+	ASSERT(MUTEX_HELD((&vp->v_lock)));
+
+	ASSERT(vp->v_count == 0);
+
+	/* We're about to free this vnode so take it out of the hash. */
+	(void) mod_hash_remove(data->lav_vn_hash,
+	    (mod_hash_key_t)uvp, (mod_hash_val_t)&vp_tmp);
+
+	/*
+	 * No one else can lookup this vnode any more so there's no need
+	 * to hold locks.
+	 */
+	mutex_exit(&data->lav_lock);
+	mutex_exit(&vp->v_lock);
+
+	/* Release the underlying vnode. */
+	VN_RELE(uvp);
+	VFS_RELE(vfsp);
+	vn_invalid(vp);
+	vn_free(vp);
+}
+
+static lx_autofs_automnt_req_t *
+lx_autofs_la_alloc(lx_autofs_vfs_t *data, boolean_t *is_dup, boolean_t expire,
+    char *nm)
+{
+	lx_autofs_automnt_req_t	*laar, *laar_dup;
+
+	/* Pre-allocate a new automounter request before grabbing locks. */
+	laar = kmem_zalloc(sizeof (*laar), KM_SLEEP);
+	mutex_init(&laar->laar_lock, NULL, MUTEX_DEFAULT, NULL);
+	cv_init(&laar->laar_cv, NULL, CV_DEFAULT, NULL);
+	laar->laar_ref = 1;
+
+	if (data->lav_min_proto == 5) {
+		laar->laar_pkt.lap_protover = LX_AUTOFS_PROTO_VERS5;
+
+		if (data->lav_mnttype == LXAMT_INDIR) {
+			if (expire) {
+				laar->laar_pkt.lap_type =
+				    LX_AUTOFS_PTYPE_EXPIRE_INDIR;
+			} else {
+				laar->laar_pkt.lap_type =
+				    LX_AUTOFS_PTYPE_MISSING_INDIR;
+			}
+		} else {
+			if (expire) {
+				laar->laar_pkt.lap_type =
+				    LX_AUTOFS_PTYPE_EXPIRE_DIRECT;
+			} else {
+				laar->laar_pkt.lap_type =
+				    LX_AUTOFS_PTYPE_MISSING_DIRECT;
+			}
+		}
+		laar->laar_pkt_size = sizeof (lx_autofs_v5_pkt_t);
+
+		laar->laar_pkt.lap_v5.lap_dev = data->lav_dev;
+		laar->laar_pkt.lap_v5.lap_ino = data->lav_ino;
+		/*
+		 * Note that we're currently not filling in the other v5 pkt
+		 * fields (pid, uid, etc.) since they don't appear to be used
+		 * by the automounter. We can fill those in later if it proves
+		 * necessary.
+		 */
+
+		/*
+		 * For indirect mounts the token expected by the automounter is
+		 * the name of the directory entry to look up (not the entire
+		 * path that is being accessed.) For direct mounts the Linux
+		 * kernel passes a dummy name, so this is just as good.
+		 */
+		laar->laar_pkt.lap_v5.lap_name_len = strlen(nm);
+		if (laar->laar_pkt.lap_v5.lap_name_len >
+		    (sizeof (laar->laar_pkt.lap_v5.lap_name) - 1)) {
+			zcmn_err(getzoneid(), CE_NOTE,
+			    "invalid autofs automnt req: \"%s\"", nm);
+			kmem_free(laar, sizeof (*laar));
+			return (NULL);
+		}
+		(void) strlcpy(laar->laar_pkt.lap_v5.lap_name, nm,
+		    sizeof (laar->laar_pkt.lap_v5.lap_name));
+
+	} else if (expire) {
+		zcmn_err(getzoneid(), CE_WARN,
+		    "unsupported expire protocol request: \"%s\"", nm);
+		kmem_free(laar, sizeof (*laar));
+		return (NULL);
+
+	} else {
+		ASSERT(expire == B_FALSE);
+
+		/* Older protocol pkt (really v2) */
+		laar->laar_pkt.lap_protover = LX_AUTOFS_PROTO_VERS2;
+		laar->laar_pkt.lap_type = LX_AUTOFS_PTYPE_MISSING;
+		laar->laar_pkt_size = sizeof (lx_autofs_v2_pkt_t);
+
+		/*
+		 * The token expected by the linux automount is the name of
+		 * the directory entry to look up.  (And not the entire
+		 * path that is being accessed.)
+		 */
+		laar->laar_pkt.lap_v2.lap_name_len = strlen(nm);
+		if (laar->laar_pkt.lap_v2.lap_name_len >
+		    (sizeof (laar->laar_pkt.lap_v2.lap_name) - 1)) {
+			zcmn_err(getzoneid(), CE_NOTE,
+			    "invalid autofs lookup: \"%s\"", nm);
+			kmem_free(laar, sizeof (*laar));
+			return (NULL);
+		}
+		(void) strlcpy(laar->laar_pkt.lap_v2.lap_name, nm,
+		    sizeof (laar->laar_pkt.lap_v2.lap_name));
+	}
+
+	/* Assign a unique id for this request. */
+	laar->laar_pkt.lap_id = id_alloc(data->lav_ids);
+
+	/* Check for an outstanding request for this path. */
+	mutex_enter(&data->lav_lock);
+	if (mod_hash_find(data->lav_path_hash,
+	    (mod_hash_key_t)nm, (mod_hash_val_t *)&laar_dup) == 0) {
+		/*
+		 * There's already an outstanding request for this
+		 * path so we don't need a new one.
+		 */
+		id_free(data->lav_ids, laar->laar_pkt.lap_id);
+		kmem_free(laar, sizeof (*laar));
+		laar = laar_dup;
+
+		/* Bump the ref count on the old request. */
+		atomic_add_int(&laar->laar_ref, 1);
+
+		*is_dup = 1;
+	} else {
+		/* Add it to the hashes. */
+		VERIFY(mod_hash_insert(data->lav_id_hash,
+		    (mod_hash_key_t)(uintptr_t)laar->laar_pkt.lap_id,
+		    (mod_hash_val_t)laar) == 0);
+		VERIFY(mod_hash_insert(data->lav_path_hash,
+		    (mod_hash_key_t)lx_autofs_strdup(nm),
+		    (mod_hash_val_t)laar) == 0);
+
+		*is_dup = 0;
+	}
+	mutex_exit(&data->lav_lock);
+
+	return (laar);
+}
+
+static lx_autofs_automnt_req_t *
+lx_autofs_la_find(lx_autofs_vfs_t *data, int id)
+{
+	lx_autofs_automnt_req_t	*laar;
+
+	/* Check for an outstanding request for this id. */
+	mutex_enter(&data->lav_lock);
+	if (mod_hash_find(data->lav_id_hash, (mod_hash_key_t)(uintptr_t)id,
+	    (mod_hash_val_t *)&laar) != 0) {
+		mutex_exit(&data->lav_lock);
+		return (NULL);
+	}
+	atomic_add_int(&laar->laar_ref, 1);
+	mutex_exit(&data->lav_lock);
+	return (laar);
+}
+
+static void
+lx_autofs_la_complete(lx_autofs_vfs_t *data, lx_autofs_automnt_req_t *laar)
+{
+	lx_autofs_automnt_req_t	*laar_tmp;
+
+	/* Remove this request from the hashes so no one can look it up. */
+	mutex_enter(&data->lav_lock);
+	(void) mod_hash_remove(data->lav_id_hash,
+	    (mod_hash_key_t)(uintptr_t)laar->laar_pkt.lap_id,
+	    (mod_hash_val_t)&laar_tmp);
+	if (data->lav_min_proto == 5) {
+		(void) mod_hash_remove(data->lav_path_hash,
+		    (mod_hash_key_t)laar->laar_pkt.lap_v5.lap_name,
+		    (mod_hash_val_t)&laar_tmp);
+	} else {
+		(void) mod_hash_remove(data->lav_path_hash,
+		    (mod_hash_key_t)laar->laar_pkt.lap_v2.lap_name,
+		    (mod_hash_val_t)&laar_tmp);
+	}
+	mutex_exit(&data->lav_lock);
+
+	/* Mark this requst as complete and wakeup anyone waiting on it. */
+	mutex_enter(&laar->laar_lock);
+	laar->laar_complete = 1;
+	cv_broadcast(&laar->laar_cv);
+	mutex_exit(&laar->laar_lock);
+}
+
+static void
+lx_autofs_la_release(lx_autofs_vfs_t *data, lx_autofs_automnt_req_t *laar)
+{
+	ASSERT(!MUTEX_HELD(&laar->laar_lock));
+	if (atomic_add_int_nv(&laar->laar_ref, -1) > 0)
+		return;
+	ASSERT(laar->laar_ref == 0);
+	id_free(data->lav_ids, laar->laar_pkt.lap_id);
+	kmem_free(laar, sizeof (*laar));
+}
+
+static void
+lx_autofs_la_abort(lx_autofs_vfs_t *data, lx_autofs_automnt_req_t *laar)
+{
+	lx_autofs_automnt_req_t	*laar_tmp;
+
+	/*
+	 * This is a little tricky.  We're aborting the wait for this
+	 * request.  So if anyone else is waiting for this request we
+	 * can't free it, but if no one else is waiting for the request
+	 * we should free it.
+	 */
+	mutex_enter(&data->lav_lock);
+	if (atomic_add_int_nv(&laar->laar_ref, -1) > 0) {
+		mutex_exit(&data->lav_lock);
+		return;
+	}
+	ASSERT(laar->laar_ref == 0);
+
+	/* Remove this request from the hashes so no one can look it up. */
+	(void) mod_hash_remove(data->lav_id_hash,
+	    (mod_hash_key_t)(uintptr_t)laar->laar_pkt.lap_id,
+	    (mod_hash_val_t)&laar_tmp);
+	if (data->lav_min_proto == 5) {
+		(void) mod_hash_remove(data->lav_path_hash,
+		    (mod_hash_key_t)laar->laar_pkt.lap_v5.lap_name,
+		    (mod_hash_val_t)&laar_tmp);
+	} else {
+		(void) mod_hash_remove(data->lav_path_hash,
+		    (mod_hash_key_t)laar->laar_pkt.lap_v2.lap_name,
+		    (mod_hash_val_t)&laar_tmp);
+	}
+	mutex_exit(&data->lav_lock);
+
+	/* It's ok to free this now because the ref count was zero. */
+	id_free(data->lav_ids, laar->laar_pkt.lap_id);
+	kmem_free(laar, sizeof (*laar));
+}
+
+static int
+lx_autofs_fifo_lookup(pid_t pgrp, int fd, file_t **fpp_wr, file_t **fpp_rd)
+{
+	proc_t		*prp;
+	uf_info_t	*fip;
+	uf_entry_t	*ufp_wr, *ufp_rd = NULL;
+	file_t		*fp_wr, *fp_rd = NULL;
+	vnode_t		*vp_wr, *vp_rd;
+	int		i;
+
+	/*
+	 * sprlock() is zone aware, so assuming this mount call was
+	 * initiated by a process in a zone, if it tries to specify
+	 * a pgrp outside of it's zone this call will fail.
+	 *
+	 * Also, we want to grab hold of the main automounter process
+	 * and its going to be the group leader for pgrp, so its
+	 * pid will be equal to pgrp.
+	 */
+	prp = sprlock(pgrp);
+	if (prp == NULL)
+		return (-1);
+	mutex_exit(&prp->p_lock);
+
+	/* Now we want to access the processes open file descriptors. */
+	fip = P_FINFO(prp);
+	mutex_enter(&fip->fi_lock);
+
+	/* Sanity check fifo write fd. */
+	if (fd >= fip->fi_nfiles) {
+		mutex_exit(&fip->fi_lock);
+		mutex_enter(&prp->p_lock);
+		sprunlock(prp);
+		return (-1);
+	}
+
+	/* Get a pointer to the write fifo. */
+	UF_ENTER(ufp_wr, fip, fd);
+	if (((fp_wr = ufp_wr->uf_file) == NULL) ||
+	    ((vp_wr = fp_wr->f_vnode) == NULL) || (vp_wr->v_type != VFIFO)) {
+		/* Invalid fifo fd. */
+		UF_EXIT(ufp_wr);
+		mutex_exit(&fip->fi_lock);
+		mutex_enter(&prp->p_lock);
+		sprunlock(prp);
+		return (-1);
+	}
+
+	/*
+	 * Now we need to find the read end of the fifo (for reasons
+	 * explained below.)  We assume that the read end of the fifo
+	 * is in the same process as the write end.
+	 */
+	vp_rd = lx_autofs_fifo_peer_vp(fp_wr->f_vnode);
+	for (i = 0; i < fip->fi_nfiles; i++) {
+		if (i == fd)
+			continue;
+		UF_ENTER(ufp_rd, fip, i);
+		if (((fp_rd = ufp_rd->uf_file) != NULL) &&
+		    (fp_rd->f_vnode == vp_rd))
+			break;
+		UF_EXIT(ufp_rd);
+	}
+	if (i == fip->fi_nfiles) {
+		/* Didn't find it. */
+		UF_EXIT(ufp_wr);
+		mutex_exit(&fip->fi_lock);
+		mutex_enter(&prp->p_lock);
+		sprunlock(prp);
+		return (-1);
+	}
+
+	/*
+	 * We need to drop fi_lock before we can try to acquire f_tlock
+	 * the good news is that the file pointers are protected because
+	 * we're still holding uf_lock.
+	 */
+	mutex_exit(&fip->fi_lock);
+
+	/*
+	 * Here we bump the open counts on the fifos.  The reason
+	 * that we do this is because when we go to write to the
+	 * fifo we want to ensure that they are actually open (and
+	 * not in the process of being closed) without having to
+	 * stop the automounter.  (If the write end of the fifo
+	 * were closed and we tried to write to it we would panic.
+	 * If the read end of the fifo was closed and we tried to
+	 * write to the other end, the process that invoked the
+	 * lookup operation would get an unexpected SIGPIPE.)
+	 */
+	mutex_enter(&fp_wr->f_tlock);
+	fp_wr->f_count++;
+	ASSERT(fp_wr->f_count >= 2);
+	mutex_exit(&fp_wr->f_tlock);
+
+	mutex_enter(&fp_rd->f_tlock);
+	fp_rd->f_count++;
+	ASSERT(fp_rd->f_count >= 2);
+	mutex_exit(&fp_rd->f_tlock);
+
+	/* Release all our locks. */
+	UF_EXIT(ufp_wr);
+	UF_EXIT(ufp_rd);
+	mutex_enter(&prp->p_lock);
+	sprunlock(prp);
+
+	/* Return the file pointers. */
+	*fpp_rd = fp_rd;
+	*fpp_wr = fp_wr;
+	return (0);
+}
+
+static uint_t
+/*ARGSUSED*/
+lx_autofs_fifo_close_cb(mod_hash_key_t key, mod_hash_val_t *val, void *arg)
+{
+	int	*id = (int *)arg;
+	/* Return the key and terminate the walk. */
+	*id = (uintptr_t)key;
+	return (MH_WALK_TERMINATE);
+}
+
+static void
+lx_autofs_fifo_close(lx_autofs_vfs_t *data)
+{
+	/*
+	 * Close the fifo to prevent any future requests from
+	 * getting sent to the automounter.
+	 */
+	mutex_enter(&data->lav_lock);
+	if (data->lav_fifo_wr != NULL) {
+		(void) closef(data->lav_fifo_wr);
+		data->lav_fifo_wr = NULL;
+	}
+	if (data->lav_fifo_rd != NULL) {
+		(void) closef(data->lav_fifo_rd);
+		data->lav_fifo_rd = NULL;
+	}
+	mutex_exit(&data->lav_lock);
+
+	/*
+	 * Wakeup any threads currently waiting for the automounter
+	 * note that it's possible for multiple threads to have entered
+	 * this function and to be doing the work below simultaneously.
+	 */
+	for (;;) {
+		lx_autofs_automnt_req_t	*laar;
+		int			id;
+
+		/* Lookup the first entry in the hash. */
+		id = -1;
+		mod_hash_walk(data->lav_id_hash,
+		    lx_autofs_fifo_close_cb, &id);
+		if (id == -1) {
+			/* No more id's in the hash. */
+			break;
+		}
+		if ((laar = lx_autofs_la_find(data, id)) == NULL) {
+			/* Someone else beat us to it. */
+			continue;
+		}
+
+		/* Mark the request as complete and release it. */
+		lx_autofs_la_complete(data, laar);
+		lx_autofs_la_release(data, laar);
+	}
+}
+
+static int
+lx_autofs_fifo_verify_rd(lx_autofs_vfs_t *data)
+{
+	proc_t		*prp;
+	uf_info_t	*fip;
+	uf_entry_t	*ufp_rd = NULL;
+	file_t		*fp_rd =  NULL;
+	vnode_t		*vp_rd;
+	int		i;
+
+	ASSERT(MUTEX_HELD((&data->lav_lock)));
+
+	/* Check if we've already been shut down. */
+	if (data->lav_fifo_wr == NULL) {
+		ASSERT(data->lav_fifo_rd == NULL);
+		return (-1);
+	}
+	vp_rd = lx_autofs_fifo_peer_vp(data->lav_fifo_wr->f_vnode);
+
+	/*
+	 * sprlock() is zone aware, so assuming this mount call was
+	 * initiated by a process in a zone, if it tries to specify
+	 * a pgrp outside of it's zone this call will fail.
+	 *
+	 * Also, we want to grab hold of the main automounter process
+	 * and its going to be the group leader for pgrp, so its
+	 * pid will be equal to pgrp.
+	 */
+	prp = sprlock(data->lav_pgrp);
+	if (prp == NULL)
+		return (-1);
+	mutex_exit(&prp->p_lock);
+
+	/* Now we want to access the processes open file descriptors. */
+	fip = P_FINFO(prp);
+	mutex_enter(&fip->fi_lock);
+
+	/*
+	 * Now we need to find the read end of the fifo (for reasons
+	 * explained below.)  We assume that the read end of the fifo
+	 * is in the same process as the write end.
+	 */
+	for (i = 0; i < fip->fi_nfiles; i++) {
+		UF_ENTER(ufp_rd, fip, i);
+		if (((fp_rd = ufp_rd->uf_file) != NULL) &&
+		    (fp_rd->f_vnode == vp_rd))
+			break;
+		UF_EXIT(ufp_rd);
+	}
+	if (i == fip->fi_nfiles) {
+		/* Didn't find it. */
+		mutex_exit(&fip->fi_lock);
+		mutex_enter(&prp->p_lock);
+		sprunlock(prp);
+		return (-1);
+	}
+
+	/*
+	 * Seems the automounter still has the read end of the fifo
+	 * open, we're done here.  Release all our locks and exit.
+	 */
+	mutex_exit(&fip->fi_lock);
+	UF_EXIT(ufp_rd);
+	mutex_enter(&prp->p_lock);
+	sprunlock(prp);
+
+	return (0);
+}
+
+static int
+lx_autofs_fifo_write(lx_autofs_vfs_t *data, lx_autofs_automnt_req_t *laarp)
+{
+	struct uio	uio;
+	struct iovec	iov;
+	file_t		*fp_wr, *fp_rd;
+	int		error;
+
+	/*
+	 * The catch here is we need to make sure _we_ don't close
+	 * the the fifo while writing to it.  (Another thread could come
+	 * along and realize the automounter process is gone and close
+	 * the fifo.  To do this we bump the open count before we
+	 * write to the fifo.
+	 */
+	mutex_enter(&data->lav_lock);
+	if (data->lav_fifo_wr == NULL) {
+		ASSERT(data->lav_fifo_rd == NULL);
+		mutex_exit(&data->lav_lock);
+		return (ENOENT);
+	}
+	fp_wr = data->lav_fifo_wr;
+	fp_rd = data->lav_fifo_rd;
+
+	/* Bump the open count on the write fifo. */
+	mutex_enter(&fp_wr->f_tlock);
+	fp_wr->f_count++;
+	mutex_exit(&fp_wr->f_tlock);
+
+	/* Bump the open count on the read fifo. */
+	mutex_enter(&fp_rd->f_tlock);
+	fp_rd->f_count++;
+	mutex_exit(&fp_rd->f_tlock);
+
+	mutex_exit(&data->lav_lock);
+
+	iov.iov_base = (caddr_t)&laarp->laar_pkt;
+	iov.iov_len = laarp->laar_pkt_size;
+	uio.uio_iov = &iov;
+	uio.uio_iovcnt = 1;
+	uio.uio_loffset = 0;
+	uio.uio_segflg = (short)UIO_SYSSPACE;
+	uio.uio_resid = laarp->laar_pkt_size;
+	uio.uio_llimit = 0;
+	uio.uio_fmode = FWRITE | FNDELAY | FNONBLOCK;
+
+	error = VOP_WRITE(fp_wr->f_vnode, &uio, 0, kcred, NULL);
+	(void) closef(fp_wr);
+	(void) closef(fp_rd);
+
+	/*
+	 * After every write we verify that the automounter still has
+	 * these files open.
+	 */
+	mutex_enter(&data->lav_lock);
+	if (lx_autofs_fifo_verify_rd(data) != 0) {
+		/*
+		 * Something happened to the automounter.
+		 * Close down the communication pipe we setup.
+		 */
+		mutex_exit(&data->lav_lock);
+		lx_autofs_fifo_close(data);
+		if (error != 0)
+			return (error);
+		return (ENOENT);
+	}
+	mutex_exit(&data->lav_lock);
+
+	return (error);
+}
+
+static int
+lx_autofs_bs_readdir(vnode_t *dvp, list_t *dir_stack, list_t *file_stack)
+{
+	struct iovec	iov;
+	struct uio	uio;
+	dirent64_t	*dp, *dbuf;
+	vnode_t		*vp;
+	size_t		dlen, dbuflen;
+	int		eof, error, ndirents = 64;
+	char		*nm;
+
+	dlen = ndirents * (sizeof (*dbuf));
+	dbuf = kmem_alloc(dlen, KM_SLEEP);
+
+	uio.uio_iov = &iov;
+	uio.uio_iovcnt = 1;
+	uio.uio_segflg = UIO_SYSSPACE;
+	uio.uio_fmode = 0;
+	uio.uio_extflg = UIO_COPY_CACHED;
+	uio.uio_loffset = 0;
+	uio.uio_llimit = MAXOFFSET_T;
+
+	eof = 0;
+	error = 0;
+	while (!error && !eof) {
+		uio.uio_resid = dlen;
+		iov.iov_base = (char *)dbuf;
+		iov.iov_len = dlen;
+
+		(void) VOP_RWLOCK(dvp, V_WRITELOCK_FALSE, NULL);
+		if (VOP_READDIR(dvp, &uio, kcred, &eof, NULL, 0) != 0) {
+			VOP_RWUNLOCK(dvp, V_WRITELOCK_FALSE, NULL);
+			kmem_free(dbuf, dlen);
+			return (-1);
+		}
+		VOP_RWUNLOCK(dvp, V_WRITELOCK_FALSE, NULL);
+
+		if ((dbuflen = dlen - uio.uio_resid) == 0) {
+			/* We're done. */
+			break;
+		}
+
+		for (dp = dbuf; ((intptr_t)dp < (intptr_t)dbuf + dbuflen);
+		    dp = (dirent64_t *)((intptr_t)dp + dp->d_reclen)) {
+
+			nm = dp->d_name;
+
+			if (strcmp(nm, ".") == 0 || strcmp(nm, "..") == 0)
+				continue;
+
+			if (VOP_LOOKUP(dvp, nm, &vp, NULL, 0, NULL, kcred,
+			    NULL, NULL, NULL) != 0) {
+				kmem_free(dbuf, dlen);
+				return (-1);
+			}
+			if (vp->v_type == VDIR) {
+				if (dir_stack != NULL) {
+					lx_autofs_stack_push(dir_stack,
+					    (caddr_t)dvp,
+					    (caddr_t)vp, lx_autofs_strdup(nm));
+				} else {
+					VN_RELE(vp);
+				}
+			} else {
+				if (file_stack != NULL) {
+					lx_autofs_stack_push(file_stack,
+					    (caddr_t)dvp,
+					    (caddr_t)vp, lx_autofs_strdup(nm));
+				} else {
+					VN_RELE(vp);
+				}
+			}
+		}
+	}
+	kmem_free(dbuf, dlen);
+	return (0);
+}
+
+static void
+lx_autofs_bs_destroy(vnode_t *dvp, char *path)
+{
+	list_t	search_stack;
+	list_t	dir_stack;
+	list_t	file_stack;
+	vnode_t	*pdvp, *vp;
+	char	*dpath, *fpath;
+	int	ret;
+
+	if (VOP_LOOKUP(dvp, path, &vp, NULL, 0, NULL, kcred,
+	    NULL, NULL, NULL) != 0) {
+		/* A directory entry with this name doesn't actually exist. */
+		return;
+	}
+
+	if ((vp->v_type & VDIR) == 0) {
+		/* Easy, the directory entry is a file so delete it. */
+		VN_RELE(vp);
+		(void) VOP_REMOVE(dvp, path, kcred, NULL, 0);
+		return;
+	}
+
+	/*
+	 * The directory entry is a subdirectory, now we have a bit more
+	 * work to do.  (We'll have to recurse into the sub directory.)
+	 * It would have been much easier to do this recursively but kernel
+	 * stacks are notoriously small.
+	 */
+	ls_autofs_stack_init(&search_stack);
+	ls_autofs_stack_init(&dir_stack);
+	ls_autofs_stack_init(&file_stack);
+
+	/* Save our newfound subdirectory into a list. */
+	lx_autofs_stack_push(&search_stack, (caddr_t)dvp, (caddr_t)vp,
+	    lx_autofs_strdup(path));
+
+	/* Do a recursive depth first search into the subdirectories. */
+	while (lx_autofs_stack_pop(&search_stack,
+	    (caddr_t *)&pdvp, (caddr_t *)&dvp, &dpath) == 0) {
+
+		/* Get a list of the subdirectories in this directory. */
+		if (lx_autofs_bs_readdir(dvp, &search_stack, NULL) != 0)
+			goto exit;
+
+		/* Save the current directory a separate stack. */
+		lx_autofs_stack_push(&dir_stack, (caddr_t)pdvp, (caddr_t)dvp,
+		    dpath);
+	}
+
+	/*
+	 * Now dir_stack contains a list of directories, the deepest paths
+	 * are at the top of the list.  So let's go through and process them.
+	 */
+	while (lx_autofs_stack_pop(&dir_stack,
+	    (caddr_t *)&pdvp, (caddr_t *)&dvp, &dpath) == 0) {
+
+		/* Get a list of the files in this directory. */
+		if (lx_autofs_bs_readdir(dvp, NULL, &file_stack) != 0) {
+			VN_RELE(dvp);
+			lx_autofs_strfree(dpath);
+			goto exit;
+		}
+
+		/* Delete all the files in this directory. */
+		while (lx_autofs_stack_pop(&file_stack,
+		    NULL, (caddr_t *)&vp, &fpath) == 0) {
+			VN_RELE(vp)
+			ret = VOP_REMOVE(dvp, fpath, kcred, NULL, 0);
+			lx_autofs_strfree(fpath);
+			if (ret != 0) {
+				lx_autofs_strfree(dpath);
+				goto exit;
+			}
+		}
+
+		/* Delete this directory. */
+		VN_RELE(dvp);
+		ret = VOP_RMDIR(pdvp, dpath, pdvp, kcred, NULL, 0);
+		lx_autofs_strfree(dpath);
+		if (ret != 0)
+			goto exit;
+	}
+
+exit:
+	while (
+	    (lx_autofs_stack_pop(&search_stack, NULL, (caddr_t *)&vp,
+	    &path) == 0) ||
+	    (lx_autofs_stack_pop(&dir_stack, NULL, (caddr_t *)&vp,
+	    &path) == 0) ||
+	    (lx_autofs_stack_pop(&file_stack, NULL, (caddr_t *)&vp,
+	    &path) == 0)) {
+		VN_RELE(vp);
+		lx_autofs_strfree(path);
+	}
+	lx_autofs_stack_fini(&search_stack);
+	lx_autofs_stack_fini(&dir_stack);
+	lx_autofs_stack_fini(&file_stack);
+}
+
+static vnode_t *
+lx_autofs_bs_create(vnode_t *dvp, char *bs_name)
+{
+	vnode_t	*vp;
+	vattr_t	vattr;
+
+	/*
+	 * After looking at the mkdir syscall path it seems we don't need
+	 * to initialize all of the vattr_t structure.
+	 */
+	bzero(&vattr, sizeof (vattr));
+	vattr.va_type = VDIR;
+	vattr.va_mode = 0755; /* u+rwx,og=rx */
+	vattr.va_mask = AT_TYPE|AT_MODE;
+
+	if (VOP_MKDIR(dvp, bs_name, &vattr, &vp, kcred, NULL, 0, NULL) != 0)
+		return (NULL);
+	return (vp);
+}
+
+static int
+lx_autofs_automounter_call(vnode_t *dvp, char *nm)
+{
+	lx_autofs_automnt_req_t	*laar;
+	lx_autofs_vfs_t		*data;
+	int			error;
+	boolean_t		is_dup;
+
+	/* Get a pointer to the vfs mount data. */
+	data = (lx_autofs_vfs_t *)dvp->v_vfsp->vfs_data;
+
+	/* The automounter only supports queries in the root directory. */
+	if (dvp != data->lav_root)
+		return (ENOENT);
+
+	/*
+	 * Check if the current process is in the automounters process
+	 * group.  (If it is, the current process is either the autmounter
+	 * itself or one of it's forked child processes.)  If so, don't
+	 * redirect this call back into the automounter because we'll
+	 * hang.
+	 */
+	mutex_enter(&pidlock);
+	if (data->lav_pgrp == curproc->p_pgrp) {
+		mutex_exit(&pidlock);
+		return (ENOENT);
+	}
+	mutex_exit(&pidlock);
+
+	/* Verify that the automount process pipe still exists. */
+	mutex_enter(&data->lav_lock);
+	if (data->lav_fifo_wr == NULL) {
+		ASSERT(data->lav_fifo_rd == NULL);
+		mutex_exit(&data->lav_lock);
+		return (ENOENT);
+	}
+	mutex_exit(&data->lav_lock);
+
+	/* Allocate an automounter request structure. */
+	if ((laar = lx_autofs_la_alloc(data, &is_dup, B_FALSE,
+	    nm)) == NULL)
+		return (ENOENT);
+
+	/*
+	 * If we were the first one to allocate this request then we
+	 * need to send it to the automounter.
+	 */
+	if ((!is_dup) &&
+	    ((error = lx_autofs_fifo_write(data, laar)) != 0)) {
+		/*
+		 * Unable to send the request to the automounter.
+		 * Unblock any other threads waiting on the request
+		 * and release the request.
+		 */
+		lx_autofs_la_complete(data, laar);
+		lx_autofs_la_release(data, laar);
+		return (error);
+	}
+
+	/* Wait for someone to signal us that this request has completed. */
+	mutex_enter(&laar->laar_lock);
+	while (!laar->laar_complete) {
+		if (cv_wait_sig(&laar->laar_cv, &laar->laar_lock) == 0) {
+			/* We got a signal, abort this call. */
+			mutex_exit(&laar->laar_lock);
+			lx_autofs_la_abort(data, laar);
+			return (EINTR);
+		}
+	}
+	mutex_exit(&laar->laar_lock);
+
+	if (laar->laar_result == LXACR_READY) {
+		/*
+		 * Mount succeeded, keep track for future expire calls.
+		 *
+		 * See vfs lav_vn_hash. Is this something we could use for
+		 * iterating mounts under this autofs? Used by
+		 * lx_autofs_vn_alloc
+		 */
+		lx_autofs_mntent_t *mp;
+
+		mp = kmem_zalloc(sizeof (lx_autofs_mntent_t), KM_SLEEP);
+		mp->lxafme_len = strlen(nm) + 1;
+		mp->lxafme_path = kmem_zalloc(mp->lxafme_len, KM_SLEEP);
+		mp->lxafme_ts = TICK_TO_SEC(ddi_get_lbolt64());
+		(void) strlcpy(mp->lxafme_path, nm, mp->lxafme_len);
+
+		mutex_enter(&data->lav_lock);
+		list_insert_tail(&data->lav_mnt_list, mp);
+		mutex_exit(&data->lav_lock);
+	}
+
+	lx_autofs_la_release(data, laar);
+
+	return (0);
+}
+
+/*
+ * Same preliminary checks as in lx_autofs_unmount.
+ */
+static boolean_t
+lx_autofs_may_unmount(vfs_t *vfsp, struct cred *cr)
+{
+	lx_autofs_vfs_t *data;
+
+	if (secpolicy_fs_unmount(cr, vfsp) != 0)
+		return (B_FALSE);
+
+	/*
+	 * We should never have a reference count of less than 2: one for the
+	 * caller, one for the root vnode.
+	 */
+	ASSERT(vfsp->vfs_count >= 2);
+
+	/* If there are any outstanding vnodes, we can't unmount. */
+	if (vfsp->vfs_count > 2)
+		return (B_FALSE);
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	ASSERT(data->lav_root->v_vfsp == vfsp);
+
+	/* Check for any remaining holds on the root vnode. */
+	if (data->lav_root->v_count > 1)
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
+
+static vfs_t *
+lx_autofs_get_mountvfs(char *fs_mntpt, int *cnt)
+{
+	struct vfs *vfsp;
+	struct vfs *vfslist;
+	vfs_t *fnd_vfs = NULL;
+	int fsmplen;
+	int acnt = 0;
+
+	fsmplen = strlen(fs_mntpt);
+
+	vfs_list_read_lock();
+
+	vfsp = vfslist = curzone->zone_vfslist;
+	if (vfslist == NULL) {
+		vfs_list_unlock();
+		*cnt = 0;
+		return (NULL);
+	}
+
+	do {
+		/* Skip mounts we shouldn't show. */
+		if (!(vfsp->vfs_flag & VFS_NOMNTTAB)) {
+			char *mntpt;
+
+			mntpt = (char *)refstr_value(vfsp->vfs_mntpt);
+			if (strncmp(fs_mntpt, mntpt, fsmplen) == 0 &&
+			    (mntpt[fsmplen] == '\0' || mntpt[fsmplen] == '/')) {
+				/*
+				 * We'll return the first one we find but don't
+				 * return a mount that is actually autofs (i.e.
+				 * autofs direct or offset mount).
+				 */
+				if (vfsp->vfs_op == lx_autofs_vfsops) {
+					acnt++;
+				} else if (fnd_vfs == NULL) {
+					fnd_vfs = vfsp;
+					VFS_HOLD(fnd_vfs)
+				}
+			}
+		}
+		vfsp = vfsp->vfs_zone_next;
+	} while (vfsp != vfslist);
+
+	vfs_list_unlock();
+
+	*cnt = acnt;
+	return (fnd_vfs);
+}
+
+/*
+ * Unmount all autofs offset mounts below the given path.
+ */
+static boolean_t
+lx_autofs_umount_offset(char *fs_mntpt, struct cred *cr)
+{
+	struct vfs *vfsp;
+	struct vfs *vfslist;
+	boolean_t busy = B_FALSE;
+	int fsmplen = strlen(fs_mntpt);
+
+restart:
+	vfs_list_read_lock();
+
+	vfsp = vfslist = curzone->zone_vfslist;
+	if (vfslist == NULL) {
+		vfs_list_unlock();
+		return (B_FALSE);
+	}
+
+	do {
+		char *mntpt;
+		lx_autofs_vfs_t *data;
+
+		/* Skip mounts we should ignore. */
+		if ((vfsp->vfs_flag & VFS_NOMNTTAB)) {
+			vfsp = vfsp->vfs_zone_next;
+			continue;
+		}
+
+		mntpt = (char *)refstr_value(vfsp->vfs_mntpt);
+		if (strncmp(fs_mntpt, mntpt, fsmplen) != 0 ||
+		    (mntpt[fsmplen] != '\0' && mntpt[fsmplen] != '/')) {
+			vfsp = vfsp->vfs_zone_next;
+			continue;
+		}
+
+		if (vfsp->vfs_op != lx_autofs_vfsops) {
+			/*
+			 * Something got mounted over the autofs mountpoint
+			 * after we checked that this inidrect hierarchy was
+			 * not busy.
+			 */
+			busy = B_TRUE;
+			break;
+		}
+
+		data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+		if (data->lav_mnttype != LXAMT_OFFSET) {
+			/*
+			 * Something mounted a non-offset autofs fs under this
+			 * indirect mnt!
+			 */
+			busy = B_TRUE;
+			break;
+		}
+
+		/*
+		 * Attempt to umount - set busy if fails.
+		 *
+		 * umount2_engine will call VFS_RELE, so we need to take an
+		 * extra hold to match the behavior during the normal umount
+		 * path.
+		 *
+		 * We also need to drop the list lock to prevent deadlock
+		 * during umount.
+		 */
+		VFS_HOLD(vfsp);
+		vfs_list_unlock();
+		if (umount2_engine(vfsp, 0, cr, 0) != 0) {
+			busy = B_TRUE;
+			goto errexit;
+		}
+
+		/* Retake list lock and look for more. */
+		goto restart;
+	} while (vfsp != vfslist);
+
+	vfs_list_unlock();
+
+errexit:
+	return (busy);
+}
+
+
+/*
+ * Note that lx_autofs_automounter_call() only supports queries in the root
+ * directory, so all mntent names are relative to that.
+ */
+static int
+lx_autofs_expire(vfs_t *vfsp, struct cred *cr)
+{
+	lx_autofs_vfs_t *data;
+	lx_autofs_mntent_t *mp;
+	lx_autofs_automnt_req_t	*laar;
+	boolean_t is_dup;
+	vfs_t *fnd_vfs;
+	int autofs_cnt;
+	boolean_t busy = B_FALSE;
+	char exp_path[MAXPATHLEN];
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+
+	/*
+	 * We process only the first element (i.e. do not do multi). This
+	 * works fine for the automounter.
+	 */
+	mutex_enter(&data->lav_lock);
+	mp = (lx_autofs_mntent_t *)list_remove_head(&data->lav_mnt_list);
+	mutex_exit(&data->lav_lock);
+	if (mp == NULL) {
+		if (data->lav_mnttype == LXAMT_OFFSET) {
+			/*
+			 * During restart the automounter will openmount each
+			 * offset mount for management. It won't closemount the
+			 * offset mount until we expire it, even though nothing
+			 * is mounted over that offset. We handle this as a
+			 * special expiration case.
+			 */
+			int cnt;
+
+			mutex_enter(&data->lav_lock);
+			cnt = data->lav_openmnt_cnt;
+			mutex_exit(&data->lav_lock);
+
+			if (cnt == 1 && vn_ismntpt(data->lav_root) == 0) {
+				char *mntpt = (char *)
+				    refstr_value(vfsp->vfs_mntpt);
+				char *nm = ZONE_PATH_TRANSLATE(mntpt, curzone);
+
+				mp = kmem_zalloc(sizeof (lx_autofs_mntent_t),
+				    KM_SLEEP);
+				mp->lxafme_len = strlen(nm) + 1;
+				mp->lxafme_path = kmem_zalloc(mp->lxafme_len,
+				    KM_SLEEP);
+				mp->lxafme_ts = TICK_TO_SEC(ddi_get_lbolt64());
+				(void) strlcpy(mp->lxafme_path, nm,
+				    mp->lxafme_len);
+
+				goto exp_offset;
+			}
+		}
+
+		return (EAGAIN);
+	}
+
+	/*
+	 * We only return an expired mount if it is inactive for the full
+	 * timeout. This reduces overly aggressive umount/mount activity.
+	 */
+	if (data->lav_timeout > 0) {
+		uint64_t now = TICK_TO_SEC(ddi_get_lbolt64());
+
+		if ((now - mp->lxafme_ts) < data->lav_timeout) {
+			/* put it back at the end of the line */
+			mutex_enter(&data->lav_lock);
+			list_insert_tail(&data->lav_mnt_list, mp);
+			mutex_exit(&data->lav_lock);
+			return (EAGAIN);
+		}
+	}
+
+	if (data->lav_mnttype == LXAMT_INDIR) {
+		(void) snprintf(exp_path, sizeof (exp_path), "%s/%s",
+		    (char *)refstr_value(vfsp->vfs_mntpt), mp->lxafme_path);
+	} else {
+		(void) strlcpy(exp_path, (char *)refstr_value(vfsp->vfs_mntpt),
+		    sizeof (exp_path));
+	}
+
+	fnd_vfs = lx_autofs_get_mountvfs(exp_path, &autofs_cnt);
+	if (fnd_vfs != NULL) {
+		boolean_t skip = B_FALSE;
+		vfssw_t *vfssw;
+
+		/*
+		 * If it's an NFS file system (typical) then we check in
+		 * advance to see if it can be unmounted, otherwise, proceed.
+		 * The fs-specific umount attempted by the automounter will
+		 * either succeed or fail. Both are valid outcomes but checking
+		 * now for nfs will save a bunch of work by the automounter
+		 * if the fs is busy.
+		 *
+		 * Unfortunately, for NFS the vfs_fstype is the same for all
+		 * versions of NFS, so we need to check the vfs_op member to
+		 * determine which version of NFS we're dealing with.
+		 */
+		if (!skip && (vfssw = vfs_getvfssw("nfs4")) != NULL) {
+			if (vfs_matchops(fnd_vfs, &vfssw->vsw_vfsops)) {
+				(void) dnlc_purge_vfsp(fnd_vfs, 0);
+				if (check_rtable4(fnd_vfs))
+					busy = B_TRUE;
+				skip = B_TRUE;
+			}
+			vfs_unrefvfssw(vfssw);
+		}
+
+		if (!skip && (vfssw = vfs_getvfssw("nfs3")) != NULL) {
+			if (vfs_matchops(fnd_vfs, &vfssw->vsw_vfsops)) {
+				(void) dnlc_purge_vfsp(fnd_vfs, 0);
+				if (check_rtable(fnd_vfs))
+					busy = B_TRUE;
+			}
+			vfs_unrefvfssw(vfssw);
+		}
+
+		VFS_RELE(fnd_vfs);
+
+	} else if (autofs_cnt > 0) {
+		/*
+		 * The automounter is asking us to expire and we pulled this
+		 * name from our vfs mountpoint list, but if
+		 * lx_autofs_get_mountvfs returns null then that means we
+		 * didn't find a non-autofs mount under this name. Thus, the
+		 * name could be a subdirectory under an autofs toplevel
+		 * indirect mount with one or more offset mounts below.
+		 * autofs_cnt will indicate how many autofs mounts exist below
+		 * this subdirectory name.
+		 *
+		 * The automounter will take care of unmounting any fs mounted
+		 * over one of these offset mounts (i.e. offset is like a
+		 * direct mount which the automounter will manage) but the
+		 * automounter will not unmount the actual autofs offset mount
+		 * itself, so we have to do that before we can expire the
+		 * top-level subrectory name.
+		 */
+		busy = lx_autofs_umount_offset(exp_path, cr);
+	}
+
+	if (busy) {
+		/*
+		 * Can't unmount this one right now, put it at the end of the
+		 * list and return. The caller will return EAGAIN for the
+		 * expire ioctl and the automounter will check again later.
+		 */
+		mp->lxafme_ts = TICK_TO_SEC(ddi_get_lbolt64());
+		mutex_enter(&data->lav_lock);
+		list_insert_tail(&data->lav_mnt_list, mp);
+		mutex_exit(&data->lav_lock);
+		return (EAGAIN);
+	}
+
+	/*
+	 * See lx_autofs_automounter_call. We want to send a msg up the pipe
+	 * to the automounter in a similar way.
+	 */
+
+exp_offset:
+	/* Verify that the automount process pipe still exists. */
+	mutex_enter(&data->lav_lock);
+	if (data->lav_fifo_wr == NULL) {
+		ASSERT(data->lav_fifo_rd == NULL);
+		mutex_exit(&data->lav_lock);
+		goto err_free;
+	}
+	mutex_exit(&data->lav_lock);
+
+	/* Allocate an automounter expire structure. */
+	if ((laar = lx_autofs_la_alloc(data, &is_dup, B_TRUE,
+	    mp->lxafme_path)) == NULL)
+		goto err_free;
+
+	/*
+	 * If we were the first one to allocate this request then we
+	 * need to send it to the automounter.
+	 */
+	if (!is_dup && lx_autofs_fifo_write(data, laar) != 0) {
+		/*
+		 * Unable to send the request to the automounter.
+		 * Unblock any other threads waiting on the request
+		 * and release the request.
+		 */
+		lx_autofs_la_complete(data, laar);
+		lx_autofs_la_release(data, laar);
+		goto err_free;
+	}
+
+	/* Wait for someone to signal us that this request has completed. */
+	mutex_enter(&laar->laar_lock);
+	while (!laar->laar_complete) {
+		if (cv_wait_sig(&laar->laar_cv, &laar->laar_lock) == 0) {
+			/* We got a signal, abort this request. */
+			mutex_exit(&laar->laar_lock);
+			lx_autofs_la_abort(data, laar);
+			goto err_free;
+		}
+	}
+	mutex_exit(&laar->laar_lock);
+
+	/*
+	 * If it failed or if the file system is still mounted after we get the
+	 * response from our expire msg, then that means the automounter tried
+	 * to unmount it but failed because the file system is busy, so we put
+	 * this entry back on our list to try to expire it again later.
+	 */
+	fnd_vfs = NULL;
+	if (laar->laar_result == LXACR_FAIL ||
+	    (fnd_vfs = lx_autofs_get_mountvfs(exp_path, &autofs_cnt)) != NULL ||
+	    autofs_cnt > 0) {
+		if (fnd_vfs != NULL)
+			VFS_RELE(fnd_vfs);
+		mp->lxafme_ts = TICK_TO_SEC(ddi_get_lbolt64());
+		mutex_enter(&data->lav_lock);
+		list_insert_tail(&data->lav_mnt_list, mp);
+		mutex_exit(&data->lav_lock);
+	} else {
+		kmem_free(mp->lxafme_path, mp->lxafme_len);
+		kmem_free(mp, sizeof (lx_autofs_mntent_t));
+	}
+
+	lx_autofs_la_release(data, laar);
+	return (0);
+
+err_free:
+	kmem_free(mp->lxafme_path, mp->lxafme_len);
+	kmem_free(mp, sizeof (lx_autofs_mntent_t));
+	return (EAGAIN);
+}
+
+static int
+lx_autofs_ack(int reqid, vfs_t *vfsp, enum lx_autofs_callres result)
+{
+	lx_autofs_vfs_t	*data;
+	lx_autofs_automnt_req_t	*laar;
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	if ((laar = lx_autofs_la_find(data, reqid)) == NULL)
+		return (ENXIO);
+
+	/* Mark the request as complete and release it. */
+	laar->laar_result = result;
+	lx_autofs_la_complete(data, laar);
+	lx_autofs_la_release(data, laar);
+	return (0);
+}
+
+static int
+lx_autofs_automounter_ioctl(vnode_t *vp, int cmd, intptr_t arg, cred_t *cr)
+{
+	lx_autofs_vfs_t *data = (lx_autofs_vfs_t *)vp->v_vfsp->vfs_data;
+	int			id = arg;
+	int			v;
+	int			err;
+
+	/*
+	 * Be strict.
+	 * We only accept ioctls from the automounter process group.
+	 */
+	mutex_enter(&pidlock);
+	if (data->lav_pgrp != curproc->p_pgrp) {
+		mutex_exit(&pidlock);
+		return (ENOENT);
+	}
+	mutex_exit(&pidlock);
+
+	switch (cmd) {
+	case LX_AUTOFS_IOC_READY:
+		if ((err = lx_autofs_ack(id, vp->v_vfsp, LXACR_READY)) != 0)
+			return (err);
+		return (0);
+
+	case LX_AUTOFS_IOC_FAIL:
+		if ((err = lx_autofs_ack(id, vp->v_vfsp, LXACR_FAIL)) != 0)
+			return (err);
+		return (0);
+
+	case LX_AUTOFS_IOC_CATATONIC:
+		/* The automounter is shutting down. */
+		lx_autofs_fifo_close(data);
+		return (0);
+
+	case LX_AUTOFS_IOC_PROTOVER:
+		v = LX_AUTOFS_PROTO_VERS5;
+		if (copyout(&v, (caddr_t)arg, sizeof (int)) != 0)
+			return (EFAULT);
+		return (0);
+
+	case LX_AUTOFS_IOC_PROTOSUBVER:
+		v = LX_AUTOFS_PROTO_SUBVERSION;
+		if (copyout(&v, (caddr_t)arg, sizeof (int)) != 0)
+			return (EFAULT);
+		return (0);
+
+	case LX_AUTOFS_IOC_ASKUMOUNT:
+		/*
+		 * This is asking if autofs can be unmounted, not asking to
+		 * actually unmount it. We return 1 if it is busy or 0 if it
+		 * can be unmounted.
+		 */
+		v = 1;
+		if (lx_autofs_may_unmount(vp->v_vfsp, cr))
+			v = 0;
+
+		if (copyout(&v, (caddr_t)arg, sizeof (int)) != 0)
+			return (EFAULT);
+		return (0);
+
+	case LX_AUTOFS_IOC_SETTIMEOUT:
+		if (copyin((caddr_t)arg, &data->lav_timeout, sizeof (ulong_t))
+		    != 0)
+			return (EFAULT);
+		return (0);
+
+	case LX_AUTOFS_IOC_EXPIRE:
+		return (ENOTSUP);
+
+	case LX_AUTOFS_IOC_EXPIRE_MULTI:
+		lx_autofs_expire(vp->v_vfsp, cr);
+		return (EAGAIN);
+
+	default:
+		ASSERT(0);
+		return (ENOTSUP);
+	}
+}
+
+static int
+lx_autofs_parse_mntopt(vfs_t *vfsp, lx_autofs_vfs_t *data)
+{
+	char		*fd_str, *pgrp_str, *minproto_str, *maxproto_str;
+	int		fd, pgrp, minproto, maxproto;
+	file_t		*fp_wr, *fp_rd;
+
+	/* Require these options to be present. */
+	if ((vfs_optionisset(vfsp, LX_MNTOPT_FD, &fd_str) != 1) ||
+	    (vfs_optionisset(vfsp, LX_MNTOPT_PGRP, &pgrp_str) != 1) ||
+	    (vfs_optionisset(vfsp, LX_MNTOPT_MINPROTO, &minproto_str) != 1) ||
+	    (vfs_optionisset(vfsp, LX_MNTOPT_MAXPROTO, &maxproto_str) != 1))
+		return (EINVAL);
+
+	/* Get the values for each parameter. */
+	if ((lx_autofs_str_to_int(fd_str, &fd) != 0) ||
+	    (lx_autofs_str_to_int(pgrp_str, &pgrp) != 0) ||
+	    (lx_autofs_str_to_int(minproto_str, &minproto) != 0) ||
+	    (lx_autofs_str_to_int(maxproto_str, &maxproto) != 0))
+		return (EINVAL);
+
+	/*
+	 * We primarily support v2 & v5 of the linux kernel automounter
+	 * protocol. The userland daemon typically needs v5. We'll reject
+	 * unsupported ioctls later if we get one.
+	 */
+	if ((minproto > 5) || (maxproto < 2))
+		return (EINVAL);
+
+	/*
+	 * Now we need to lookup the fifos we'll be using
+	 * to talk to the userland automounter process.
+	 */
+	if (lx_autofs_fifo_lookup(pgrp, fd, &fp_wr, &fp_rd) != 0) {
+		/*
+		 * The automounter doesn't always have the same id as the pgrp.
+		 * This happens when it is started via one of the various
+		 * service managers. In this case the fifo lookup will fail
+		 * so we retry with our own pid.
+		 */
+		int pid = (int)curproc->p_pid;
+
+		if (lx_autofs_fifo_lookup(pid, fd, &fp_wr, &fp_rd) != 0)
+			return (EINVAL);
+	}
+
+	if (vfs_optionisset(vfsp, LX_MNTOPT_INDIRECT, NULL)) {
+		data->lav_mnttype = LXAMT_INDIR;
+	}
+	if (vfs_optionisset(vfsp, LX_MNTOPT_DIRECT, NULL)) {
+		if (data->lav_mnttype != LXAMT_NONE)
+			return (EINVAL);
+		data->lav_mnttype = LXAMT_DIRECT;
+	}
+	if (vfs_optionisset(vfsp, LX_MNTOPT_OFFSET, NULL)) {
+		if (data->lav_mnttype != LXAMT_NONE)
+			return (EINVAL);
+		data->lav_mnttype = LXAMT_OFFSET;
+	}
+	/* The automounter does test mounts with none of the options */
+	if (data->lav_mnttype == LXAMT_NONE)
+		data->lav_mnttype = LXAMT_DIRECT;
+
+	/* Save the mount options and fifo pointers. */
+	data->lav_fd = fd;
+	data->lav_min_proto = minproto;
+	data->lav_pgrp = pgrp;
+	data->lav_fifo_rd = fp_rd;
+	data->lav_fifo_wr = fp_wr;
+	return (0);
+}
+
+static uint64_t
+s2l_dev(dev_t dev)
+{
+	major_t	maj = getmajor(dev);
+	minor_t	min = getminor(dev);
+
+	return (LX_MAKEDEVICE(maj, min));
+}
+
+/*
+ * VFS entry points
+ */
+static int
+lx_autofs_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
+{
+	lx_autofs_vfs_t	*data;
+	dev_t		dev;
+	char		name[40];
+	int		error;
+	vattr_t		va;
+
+	if (secpolicy_fs_mount(cr, mvp, vfsp) != 0)
+		return (EPERM);
+
+	if (mvp->v_type != VDIR)
+		return (ENOTDIR);
+
+	if ((uap->flags & MS_OVERLAY) == 0 &&
+	    (mvp->v_count > 1 || (mvp->v_flag & VROOT)))
+		return (EBUSY);
+
+	/* We don't support mounts in the global zone. */
+	if (getzoneid() == GLOBAL_ZONEID)
+		return (EPERM);
+
+	/*
+	 * Offset mounts will occur below the top-level mountpoint so we
+	 * need to allow for autofs mounts even though mvp is an autofs.
+	 */
+
+	/* Allocate a vfs struct. */
+	data = kmem_zalloc(sizeof (lx_autofs_vfs_t), KM_SLEEP);
+
+	/* Parse mount options. */
+	if ((error = lx_autofs_parse_mntopt(vfsp, data)) != 0) {
+		kmem_free(data, sizeof (lx_autofs_vfs_t));
+		return (error);
+	}
+
+	/* Initialize the backing store. */
+	lx_autofs_bs_destroy(mvp, LX_AUTOFS_BS_DIR);
+	data->lav_bs_vp = lx_autofs_bs_create(mvp, LX_AUTOFS_BS_DIR);
+	if (data->lav_bs_vp == NULL) {
+		kmem_free(data, sizeof (lx_autofs_vfs_t));
+		return (EBUSY);
+	}
+	data->lav_bs_name = LX_AUTOFS_BS_DIR;
+
+	/* Get the backing store inode for use in v5 protocol msgs */
+	va.va_mask = AT_STAT;
+	if ((error = VOP_GETATTR(data->lav_bs_vp, &va, 0, cr, NULL)) != 0) {
+		kmem_free(data, sizeof (lx_autofs_vfs_t));
+		return (error);
+	}
+	data->lav_ino = va.va_nodeid;
+
+	/* We have to hold the underlying vnode we're mounted on. */
+	data->lav_mvp = mvp;
+	VN_HOLD(mvp);
+
+	/* Initialize vfs fields */
+	vfsp->vfs_bsize = DEV_BSIZE;
+	vfsp->vfs_fstype = lx_autofs_fstype;
+	vfsp->vfs_data = data;
+
+	/* Invent a dev_t (sigh) */
+	do {
+		dev = makedevice(lx_autofs_major,
+		    atomic_add_32_nv(&lx_autofs_minor, 1) & L_MAXMIN32);
+	} while (vfs_devismounted(dev));
+	vfsp->vfs_dev = dev;
+	vfs_make_fsid(&vfsp->vfs_fsid, dev, lx_autofs_fstype);
+
+	data->lav_dev = s2l_dev(vfsp->vfs_dev);
+
+	/* Create an id space arena for automounter requests. */
+	(void) snprintf(name, sizeof (name), "lx_autofs_id_%d",
+	    getminor(vfsp->vfs_dev));
+	data->lav_ids = id_space_create(name, 1, INT_MAX);
+
+	/* Create hashes to keep track of automounter requests. */
+	mutex_init(&data->lav_lock, NULL, MUTEX_DEFAULT, NULL);
+	(void) snprintf(name, sizeof (name), "lx_autofs_path_hash_%d",
+	    getminor(vfsp->vfs_dev));
+	data->lav_path_hash = mod_hash_create_strhash(name,
+	    LX_AUTOFS_VFS_PATH_HASH_SIZE, mod_hash_null_valdtor);
+	(void) snprintf(name, sizeof (name), "lx_autofs_id_hash_%d",
+	    getminor(vfsp->vfs_dev));
+	data->lav_id_hash = mod_hash_create_idhash(name,
+	    LX_AUTOFS_VFS_ID_HASH_SIZE, mod_hash_null_valdtor);
+
+	/* Create a hash to keep track of vnodes. */
+	(void) snprintf(name, sizeof (name), "lx_autofs_vn_hash_%d",
+	    getminor(vfsp->vfs_dev));
+	data->lav_vn_hash = mod_hash_create_ptrhash(name,
+	    LX_AUTOFS_VFS_VN_HASH_SIZE, mod_hash_null_valdtor,
+	    sizeof (vnode_t));
+
+	list_create(&data->lav_mnt_list, sizeof (lx_autofs_mntent_t),
+	    offsetof(lx_autofs_mntent_t, lxafme_lst));
+
+	/* Create root vnode */
+	data->lav_root = lx_autofs_vn_alloc(vfsp, data->lav_bs_vp);
+
+	data->lav_root->v_flag |= VROOT | VNOCACHE | VNOMAP | VNOSWAP;
+
+	/*
+	 * For a direct mountpoint we need to allow a filesystem to be
+	 * mounted overtop of this autofs mount. Otherwise, disallow that.
+	 */
+	if (data->lav_mnttype == LXAMT_INDIR)
+		data->lav_root->v_flag |= VNOMOUNT;
+
+	return (0);
+}
+
+static int
+lx_autofs_unmount(vfs_t *vfsp, int flag, struct cred *cr)
+{
+	lx_autofs_vfs_t *data;
+
+	if (secpolicy_fs_unmount(cr, vfsp) != 0)
+		return (EPERM);
+
+	/* We do not currently support forced unmounts. */
+	if (flag & MS_FORCE)
+		return (ENOTSUP);
+
+	/*
+	 * We should never have a reference count of less than 2: one for the
+	 * caller, one for the root vnode.
+	 */
+	ASSERT(vfsp->vfs_count >= 2);
+
+	/* If there are any outstanding vnodes, we can't unmount. */
+	if (vfsp->vfs_count > 2)
+		return (EBUSY);
+
+	/* Check for any remaining holds on the root vnode. */
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	ASSERT(data->lav_root->v_vfsp == vfsp);
+	if (data->lav_root->v_count > 1)
+		return (EBUSY);
+
+	/* Close the fifo to the automount process. */
+	if (data->lav_fifo_wr != NULL)
+		(void) closef(data->lav_fifo_wr);
+	if (data->lav_fifo_rd != NULL)
+		(void) closef(data->lav_fifo_rd);
+
+	/*
+	 * We have to release our hold on our root vnode before we can
+	 * delete the backing store.  (Since the root vnode is linked
+	 * to the backing store.)
+	 */
+	VN_RELE(data->lav_root);
+
+	/* Cleanup the backing store. */
+	lx_autofs_bs_destroy(data->lav_mvp, data->lav_bs_name);
+	VN_RELE(data->lav_mvp);
+
+	/*
+	 * Delete all listed mounts.
+	 */
+	for (;;) {
+		lx_autofs_mntent_t *mp;
+
+		mp = list_remove_head(&data->lav_mnt_list);
+		if (mp == NULL)
+			break;
+		kmem_free(mp->lxafme_path, mp->lxafme_len);
+		kmem_free(mp, sizeof (lx_autofs_mntent_t));
+	}
+
+	/* Cleanup out remaining data structures. */
+	mod_hash_destroy_strhash(data->lav_path_hash);
+	mod_hash_destroy_idhash(data->lav_id_hash);
+	mod_hash_destroy_ptrhash(data->lav_vn_hash);
+	id_space_destroy(data->lav_ids);
+	list_destroy(&data->lav_mnt_list);
+	kmem_free(data, sizeof (lx_autofs_vfs_t));
+
+	return (0);
+}
+
+static int
+lx_autofs_root(vfs_t *vfsp, vnode_t **vpp)
+{
+	lx_autofs_vfs_t	*data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+
+	*vpp = data->lav_root;
+	VN_HOLD(*vpp);
+
+	return (0);
+}
+
+static int
+lx_autofs_statvfs(vfs_t *vfsp, statvfs64_t *sp)
+{
+	lx_autofs_vfs_t	*data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	vnode_t		*urvp = data->lav_root->v_data;
+	dev32_t		d32;
+	int		error;
+
+	if ((error = VFS_STATVFS(urvp->v_vfsp, sp)) != 0)
+		return (error);
+
+	/* Update some of values before returning. */
+	(void) cmpldev(&d32, vfsp->vfs_dev);
+	sp->f_fsid = d32;
+	(void) strlcpy(sp->f_basetype, vfssw[vfsp->vfs_fstype].vsw_name,
+	    sizeof (sp->f_basetype));
+	sp->f_flag = vf_to_stf(vfsp->vfs_flag);
+	bzero(sp->f_fstr, sizeof (sp->f_fstr));
+	return (0);
+}
+
+static const fs_operation_def_t lx_autofs_vfstops[] = {
+	{ VFSNAME_MOUNT,	{ .vfs_mount = lx_autofs_mount } },
+	{ VFSNAME_UNMOUNT,	{ .vfs_unmount = lx_autofs_unmount } },
+	{ VFSNAME_ROOT,		{ .vfs_root = lx_autofs_root } },
+	{ VFSNAME_STATVFS,	{ .vfs_statvfs = lx_autofs_statvfs } },
+	{ NULL, NULL }
+};
+
+/*
+ * VOP entry points - simple passthrough
+ *
+ * For most VOP entry points we can simply pass the request on to
+ * the underlying filesystem we're mounted on.
+ */
+static int
+lx_autofs_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
+    caller_context_t *ctp)
+{
+	vnode_t *uvp = vp->v_data;
+	return (VOP_CLOSE(uvp, flag, count, offset, cr, ctp));
+}
+
+static int
+lx_autofs_readdir(vnode_t *vp, uio_t *uiop, cred_t *cr, int *eofp,
+    caller_context_t *ctp, int flags)
+{
+	vnode_t *uvp = vp->v_data;
+	return (VOP_READDIR(uvp, uiop, cr, eofp, ctp, flags));
+}
+
+static int
+lx_autofs_access(vnode_t *vp, int mode, int flags, cred_t *cr,
+    caller_context_t *ctp)
+{
+	vnode_t *uvp = vp->v_data;
+	return (VOP_ACCESS(uvp, mode, flags, cr, ctp));
+}
+
+static int
+lx_autofs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
+{
+	vnode_t *uvp = vp->v_data;
+	return (VOP_RWLOCK(uvp, write_lock, ctp));
+}
+
+static void
+lx_autofs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
+{
+	vnode_t *uvp = vp->v_data;
+	VOP_RWUNLOCK(uvp, write_lock, ctp);
+}
+
+/*
+ * Check if attempting to access a 'direct' mount and if so, call the
+ * automounter to perform the mount. Once the mount occurs, the new filesystem
+ * will be mounted overtop of this autofs mountpoint and we will no longer
+ * come through this path.
+ */
+static vnode_t *
+lx_autofs_do_direct(vnode_t *vp)
+{
+	vfs_t	*vfsp = vp->v_vfsp;
+	lx_autofs_vfs_t *data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	vnode_t *nvp;
+	boolean_t skip_am_call = B_FALSE;
+
+	if (data->lav_mnttype == LXAMT_INDIR)
+		return (NULL);
+
+	/*
+	 * Check if the current process is in the automounter's process group.
+	 * If it is, the current process is either the automounter itself or
+	 * one of it's children. If so, don't call back into the automounter.
+	 */
+	mutex_enter(&pidlock);
+	if (data->lav_pgrp == curproc->p_pgrp) {
+		skip_am_call = B_TRUE;
+	}
+	mutex_exit(&pidlock);
+
+	/*
+	 * It is possible there is already a new fs mounted on top of our vnode.
+	 * This can happen if the caller first did a lookup of a file name
+	 * using our vnode as the directory vp. The lookup would trigger the
+	 * autofs mount on top of ourself, but if the caller then uses our
+	 * vnode to do a getattr on the directory, it will use the autofs
+	 * vnode and not the newly mounted vnode. We need to skip re-calling
+	 * the automounter for this case.
+	 */
+	if (!skip_am_call && vn_mountedvfs(vp) == NULL) {
+		char tbuf[MAXPATHLEN];
+		char *nm;
+
+		(void) strlcpy(tbuf, (char *)refstr_value(vfsp->vfs_mntpt),
+		    sizeof (tbuf));
+		nm = tbuf + strlen(tbuf);
+		while (*nm != '/' && nm != tbuf)
+			nm--;
+		if (*nm == '/')
+			nm++;
+		(void) lx_autofs_automounter_call(vp, nm);
+	}
+
+	/*
+	 * We need to take an extra hold on our vp (which is the autofs
+	 * root vp) to account for the rele done in traverse. traverse will
+	 * take a hold on the new vp so the caller is responsible for calling
+	 * VN_RELE on the returned vp.
+	 */
+	VN_HOLD(vp);
+	nvp = vp;
+	if (traverse(&nvp) != 0) {
+		VN_RELE(nvp);
+		return (NULL);
+	}
+
+	/* Confirm that we have a non-autofs fs mounted now */
+	if (nvp->v_op == lx_autofs_vn_ops) {
+		VN_RELE(nvp);
+		return (NULL);
+	}
+
+	return (nvp);
+}
+
+/*ARGSUSED*/
+static int
+lx_autofs_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
+    caller_context_t *ctp, int flags)
+{
+	vnode_t *udvp = dvp->v_data;
+	vnode_t		*nvp;
+
+	/* handle direct mount here */
+	if ((nvp = lx_autofs_do_direct(dvp)) != NULL) {
+		int error;
+
+		error = VOP_RMDIR(nvp, nm, cdir, cr, ctp, flags);
+		VN_RELE(nvp);
+		return (error);
+	}
+
+	/*
+	 * cdir is the calling processes current directory.
+	 * If cdir is lx_autofs vnode then get its real underlying
+	 * vnode ptr.  (It seems like the only thing cdir is
+	 * ever used for is to make sure the user doesn't delete
+	 * their current directory.)
+	 */
+	if (vn_matchops(cdir, lx_autofs_vn_ops)) {
+		vnode_t *ucdir = cdir->v_data;
+		return (VOP_RMDIR(udvp, nm, ucdir, cr, ctp, flags));
+	}
+
+	return (VOP_RMDIR(udvp, nm, cdir, cr, ctp, flags));
+}
+
+/*
+ * VOP entry points - special passthrough
+ *
+ * For some VOP entry points we will first pass the request on to
+ * the underlying filesystem we're mounted on.  If there's an error
+ * then we immediately return the error, but if the request succeeds
+ * we have to do some extra work before returning.
+ */
+static int
+lx_autofs_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ctp)
+{
+	vnode_t		*ovp = *vpp;
+	vnode_t		*uvp = ovp->v_data;
+	int		error;
+
+	/* direct mounts were handled by the lookup to get *vpp */
+
+	if ((error = VOP_OPEN(&uvp, flag, cr, ctp)) != 0)
+		return (error);
+
+	/* Check for clone opens. */
+	if (uvp == ovp->v_data)
+		return (0);
+
+	/* Deal with clone opens by returning a new vnode. */
+	*vpp = lx_autofs_vn_alloc(ovp->v_vfsp, uvp);
+	VN_RELE(ovp);
+	return (0);
+}
+
+/*
+ * Internally, we have already converted our autofs vfs device number into a
+ * Linux-format device during lx_autofs_mount and stored that device number
+ * in data->lav_dev. However, our lx emulation for the various stat() syscalls
+ * also wants to convert the fsid the same way. That obviously will be
+ * incorrect if we pass along an fsid that is already converted, so we always
+ * pass along the original vfs fsid here. Both lav_dev and lav_ino are passed
+ * in messages to the automounter, and these must match the values obtained by
+ * stat().
+ */
+static int
+lx_autofs_getattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
+    caller_context_t *ctp)
+{
+	vnode_t		*uvp = vp->v_data;
+	vnode_t		*dvp;
+	int		error;
+	lx_autofs_vfs_t *data = (lx_autofs_vfs_t *)vp->v_vfsp->vfs_data;
+	dev_t		autofs_fsid = vp->v_vfsp->vfs_dev;
+
+	if ((dvp = lx_autofs_do_direct(vp)) != NULL) {
+		uvp = dvp;
+	}
+
+	error = VOP_GETATTR(uvp, vap, flags, cr, ctp);
+
+	if (dvp != NULL) {
+		/* we operated on the direct mounted fs */
+		VN_RELE(dvp);
+		if (error == 0) {
+			/*
+			 * During automounter restart recovery, the automounter
+			 * will fstat the fd provided in the setpipe ioctl. It
+			 * uses the resulting inode & dev to correlate future
+			 * autofs fifo requests to the correct entry. Thus, we
+			 * have to update the attributes with the proper IDs.
+			 */
+			vap->va_fsid = autofs_fsid;
+			vap->va_nodeid = data->lav_ino;
+		}
+	} else if (error == 0) {
+		/* Update the attributes with our filesystem id. */
+		vap->va_fsid = autofs_fsid;
+	}
+
+	return (error);
+}
+
+static int
+lx_autofs_mkdir(vnode_t *dvp, char *nm, struct vattr *vap, vnode_t **vpp,
+    cred_t *cr, caller_context_t *ctp, int flags, vsecattr_t *vsecp)
+{
+	vnode_t		*udvp = dvp->v_data;
+	vnode_t		*nvp;
+	int		error;
+
+	if ((nvp = lx_autofs_do_direct(dvp)) != NULL) {
+		udvp = nvp;
+	}
+
+	error = VOP_MKDIR(udvp, nm, vap, vpp, cr, ctp, flags, vsecp);
+
+	if (nvp != NULL) {
+		/* we operated on the direct mounted fs */
+		VN_RELE(nvp);
+	} else if (error == 0) {
+		vnode_t		*uvp = NULL;
+
+		/* Update the attributes with our filesystem id. */
+		vap->va_fsid = dvp->v_vfsp->vfs_dev;
+
+		/* Allocate our new vnode. */
+		uvp = *vpp;
+		*vpp = lx_autofs_vn_alloc(dvp->v_vfsp, uvp);
+	}
+
+	return (error);
+}
+
+/*
+ * VOP entry points - custom
+ */
+/*ARGSUSED*/
+static void
+lx_autofs_inactive(struct vnode *vp, struct cred *cr, caller_context_t *ctp)
+{
+	lx_autofs_vfs_t	*data = (lx_autofs_vfs_t *)vp->v_vfsp->vfs_data;
+
+	/*
+	 * We need to hold the vfs lock because if we're going to free
+	 * this vnode we have to prevent anyone from looking it up
+	 * in the vnode hash.
+	 */
+	mutex_enter(&data->lav_lock);
+	mutex_enter(&vp->v_lock);
+
+	if (vp->v_count < 1) {
+		panic("lx_autofs_inactive: bad v_count");
+		/*NOTREACHED*/
+	}
+
+	/* Drop the temporary hold by vn_rele now. */
+	if (--vp->v_count > 0) {
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&data->lav_lock);
+		return;
+	}
+
+	/*
+	 * No one should have been blocked on this lock because we're
+	 * about to free this vnode.
+	 */
+	lx_autofs_vn_free(vp);
+}
+
+static int
+lx_autofs_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
+    int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ctp,
+    int *direntflags, pathname_t *realpnp)
+{
+	vnode_t			*udvp = dvp->v_data;
+	vnode_t			*uvp = NULL;
+	lx_autofs_vfs_t		*data;
+	int			error = ENOENT;
+
+	data = (lx_autofs_vfs_t *)dvp->v_vfsp->vfs_data;
+
+	/*
+	 * For an indirect mount first try to lookup if this path component
+	 * already exists.
+	 */
+	if (data->lav_mnttype == LXAMT_INDIR) {
+		if ((error = VOP_LOOKUP(udvp, nm, &uvp, pnp, flags, rdir, cr,
+		    ctp, direntflags, realpnp)) == 0) {
+			*vpp = lx_autofs_vn_alloc(dvp->v_vfsp, uvp);
+			return (0);
+		}
+	}
+
+	/* Only query the automounter if the path does not exist. */
+	if (error != ENOENT)
+		return (error);
+
+	if (data->lav_catatonic)
+		return (ENOENT);
+
+	/* Save the uid/gid for the requestor ioctl. */
+	data->lav_uid = crgetuid(cr);
+	data->lav_gid = crgetgid(cr);
+
+	/* Refer the lookup to the automounter. */
+	if ((error = lx_autofs_automounter_call(dvp, nm)) != 0)
+		return (error);
+
+	if (data->lav_mnttype == LXAMT_INDIR) {
+		/*
+		 * Indirect mount. The automounter call should have mounted
+		 * something on nm. Retry the lookup operation.
+		 */
+		if ((error = VOP_LOOKUP(udvp, nm, &uvp, pnp, flags, rdir, cr,
+		    ctp, direntflags, realpnp)) == 0) {
+			*vpp = lx_autofs_vn_alloc(dvp->v_vfsp, uvp);
+			return (0);
+		}
+	} else {
+		/*
+		 * Direct or offset mount. The automounter call should have
+		 * covered our 'dvp' with a new filesystem. Traverse into the
+		 * new mount and retry the lookup.
+		 *
+		 * We need to take an extra hold on our vp (which is the autofs
+		 * root vp) to acount for the rele done in traverse. Our caller
+		 * will also do a rele on the original dvp and that would leave
+		 * us one ref short on our autofs root vnode.
+		 */
+		vnode_t *orig_dvp = dvp;
+
+		VN_HOLD(dvp);
+		if ((error = traverse(&dvp)) != 0) {
+			VN_RELE(dvp);
+			return (error);
+		}
+
+		if (dvp == orig_dvp) {
+			/*
+			 * For some reason the automountd did not actually
+			 * mount the new filesystem. Return an error.
+			 */
+			VN_RELE(dvp);
+			return (ENOENT);
+		}
+
+		error = VOP_LOOKUP(dvp, nm, vpp, pnp, flags, rdir, cr, ctp,
+		    direntflags, realpnp);
+
+		/* release the traverse hold */
+		VN_RELE(dvp);
+	}
+	return (error);
+}
+
+static int
+lx_autofs_ioctl(vnode_t *vp, int cmd, intptr_t arg, int mode, cred_t *cr,
+    int *rvalp, caller_context_t *ctp)
+{
+	vnode_t			*uvp = vp->v_data;
+
+	/* Intercept our ioctls. */
+	switch ((uint_t)cmd) {
+	case LX_AUTOFS_IOC_READY:
+	case LX_AUTOFS_IOC_FAIL:
+	case LX_AUTOFS_IOC_CATATONIC:
+	case LX_AUTOFS_IOC_PROTOVER:
+	case LX_AUTOFS_IOC_SETTIMEOUT:
+	case LX_AUTOFS_IOC_EXPIRE:
+	case LX_AUTOFS_IOC_EXPIRE_MULTI:
+	case LX_AUTOFS_IOC_PROTOSUBVER:
+	case LX_AUTOFS_IOC_ASKUMOUNT:
+		return (lx_autofs_automounter_ioctl(vp, cmd, arg, cr));
+	}
+
+	/* Pass any remaining ioctl on. */
+	return (VOP_IOCTL(uvp, cmd, arg, mode, cr, rvalp, ctp));
+}
+
+/*
+ * VOP entry points definitions
+ */
+static const fs_operation_def_t lx_autofs_tops_root[] = {
+	{ VOPNAME_OPEN,		{ .vop_open = lx_autofs_open } },
+	{ VOPNAME_CLOSE,	{ .vop_close = lx_autofs_close } },
+	{ VOPNAME_IOCTL,	{ .vop_ioctl = lx_autofs_ioctl } },
+	{ VOPNAME_RWLOCK,	{ .vop_rwlock = lx_autofs_rwlock } },
+	{ VOPNAME_RWUNLOCK,	{ .vop_rwunlock = lx_autofs_rwunlock } },
+	{ VOPNAME_GETATTR,	{ .vop_getattr = lx_autofs_getattr } },
+	{ VOPNAME_ACCESS,	{ .vop_access = lx_autofs_access } },
+	{ VOPNAME_READDIR,	{ .vop_readdir = lx_autofs_readdir } },
+	{ VOPNAME_LOOKUP,	{ .vop_lookup = lx_autofs_lookup } },
+	{ VOPNAME_INACTIVE,	{ .vop_inactive = lx_autofs_inactive } },
+	{ VOPNAME_MKDIR,	{ .vop_mkdir = lx_autofs_mkdir } },
+	{ VOPNAME_RMDIR,	{ .vop_rmdir = lx_autofs_rmdir } },
+	{ NULL }
+};
+
+/*
+ * DEV-specific entry points
+ */
+
+/*ARGSUSED*/
+static int
+lx_autofs_dev_open(dev_t *devp, int flags, int otyp, cred_t *credp)
+{
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+lx_autofs_dev_close(dev_t dev, int flags, int otyp, cred_t *credp)
+{
+	return (0);
+}
+
+static int
+lx_autofs_dev_validate_cmd(intptr_t arg, lx_autofs_dv_ioctl_t *dcmd)
+{
+	if (copyin((caddr_t)arg, dcmd, sizeof (lx_autofs_dv_ioctl_t)) != 0)
+		return (EFAULT);
+
+	if (dcmd->lad_ver_major != LX_AUTOFS_DEV_VERSION_MAJOR ||
+	    dcmd->lad_ver_minor > LX_AUTOFS_DEV_VERSION_MINOR)
+		return (EINVAL);
+
+	DTRACE_PROBE1(lx__dev__cmd, void *, dcmd);
+
+	/* Fill in the version for return */
+	dcmd->lad_ver_major = LX_AUTOFS_DEV_VERSION_MAJOR;
+	dcmd->lad_ver_minor = LX_AUTOFS_DEV_VERSION_MINOR;
+	return (0);
+}
+
+static vfs_t *
+lx_autofs_dev_getvfs_bypath(char *fs_mntpt)
+{
+	struct vfs *vfsp;
+	struct vfs *vfslist;
+	vfs_t *fnd_vfs = NULL;
+	zone_t *zone = curzone;
+
+	vfs_list_read_lock();
+
+	vfsp = vfslist = curzone->zone_vfslist;
+	if (vfslist == NULL) {
+		vfs_list_unlock();
+		return (NULL);
+	}
+
+	do {
+		if (vfsp->vfs_op == lx_autofs_vfsops) {
+			char *mntpt = (char *)refstr_value(vfsp->vfs_mntpt);
+
+			if (strcmp(fs_mntpt, ZONE_PATH_TRANSLATE(mntpt, zone))
+			    == 0) {
+				fnd_vfs = vfsp;
+				VFS_HOLD(fnd_vfs)
+				break;
+			}
+		}
+		vfsp = vfsp->vfs_zone_next;
+	} while (vfsp != vfslist);
+
+	vfs_list_unlock();
+
+	return (fnd_vfs);
+}
+
+static int
+lx_autofs_dev_fd_preamble(intptr_t arg, lx_autofs_dv_ioctl_t *dc, vfs_t **vfspp)
+{
+	int err;
+	lx_autofs_vfs_t	*data;
+	file_t *fp;
+	vfs_t *vfsp;
+
+	if ((err = lx_autofs_dev_validate_cmd(arg, dc)) != 0)
+		return (err);
+
+	if ((fp = getf(dc->lad_ioctlfd)) == NULL)
+		return (EBADF);
+
+	vfsp = fp->f_vnode->v_vfsp;
+	if (vfsp->vfs_op != lx_autofs_vfsops) {
+		releasef(dc->lad_ioctlfd);
+		return (EBADF);
+	}
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	if (data->lav_root->v_count <= 1) {
+		releasef(dc->lad_ioctlfd);
+		return (EBADF);
+	}
+
+	VFS_HOLD(vfsp);
+	*vfspp = vfsp;
+
+	releasef(dc->lad_ioctlfd);
+	return (0);
+}
+
+static int
+lx_autofs_dev_vers(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+
+	if ((err = lx_autofs_dev_validate_cmd(arg, &dcmd)) != 0)
+		return (err);
+
+	if (copyout(&dcmd, (caddr_t)arg, sizeof (dcmd)) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static int
+lx_autofs_dev_protver(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+
+	if ((err = lx_autofs_dev_validate_cmd(arg, &dcmd)) != 0)
+		return (err);
+
+	dcmd.lad_arg1 = LX_AUTOFS_PROTO_VERS5;
+
+	if (copyout(&dcmd, (caddr_t)arg, sizeof (dcmd)) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static int
+lx_autofs_dev_protosubver(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+
+	if ((err = lx_autofs_dev_validate_cmd(arg, &dcmd)) != 0)
+		return (err);
+
+	dcmd.lad_arg1 = LX_AUTOFS_PROTO_SUBVERSION;
+
+	if (copyout(&dcmd, (caddr_t)arg, sizeof (dcmd)) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static int
+lx_autofs_dev_get_path_cmd(intptr_t arg, lx_autofs_dv_ioctl_t **dcp)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd, *dc;
+
+	if ((err = lx_autofs_dev_validate_cmd(arg, &dcmd)) != 0)
+		return (err);
+
+	if (dcmd.lad_size <= sizeof (dcmd) ||
+	    dcmd.lad_size > (sizeof (dcmd) + MAXPATHLEN))
+		return (EINVAL);
+
+	dc = kmem_alloc(dcmd.lad_size, KM_SLEEP);
+
+	/* re-copyin the full struct with the path */
+	if (copyin((caddr_t)arg, dc, dcmd.lad_size) != 0) {
+		kmem_free(dc, dcmd.lad_size);
+		return (EFAULT);
+	}
+	dc->lad_size = dcmd.lad_size;
+
+	if (dc->lad_path[0] != '/' ||
+	    dc->lad_path[dcmd.lad_size - sizeof (dcmd) - 1] != '\0') {
+		kmem_free(dc, dcmd.lad_size);
+		return (EINVAL);
+	}
+
+	*dcp = dc;
+	return (0);
+}
+
+static int
+lx_autofs_dev_openmount(intptr_t arg)
+{
+	int err;
+	int fd;
+	lx_autofs_dv_ioctl_t *dc;
+	vfs_t *vfsp;
+	lx_autofs_vfs_t	*data;
+
+	if ((err = lx_autofs_dev_get_path_cmd(arg, &dc)) != 0)
+		return (err);
+
+	if ((vfsp = lx_autofs_dev_getvfs_bypath(dc->lad_path)) == NULL) {
+		kmem_free(dc, dc->lad_size);
+		return (EINVAL);
+	}
+
+	/* lad_arg1 is the dev number of the mnt but we don't check that */
+
+	/*
+	 * Do an "open" on the root vnode. To fully simulate "open" we also add
+	 * a hold on the root vnode itself since lx_autofs_open will only open
+	 * (and hold) the underlying vnode.
+	 */
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	VN_HOLD(data->lav_root);
+	if ((err = fassign(&data->lav_root, FWRITE|FREAD, &fd)) != 0) {
+		VN_RELE(data->lav_root);
+		VFS_RELE(vfsp);
+		kmem_free(dc, dc->lad_size);
+		return (err);
+	}
+
+	mutex_enter(&data->lav_lock);
+	data->lav_openmnt_cnt++;
+	mutex_exit(&data->lav_lock);
+
+	dc->lad_ioctlfd = fd;
+
+	if (copyout(dc, (caddr_t)arg, sizeof (lx_autofs_dv_ioctl_t)) != 0) {
+		mutex_enter(&data->lav_lock);
+		data->lav_openmnt_cnt--;
+		mutex_exit(&data->lav_lock);
+		(void) closeandsetf(fd, NULL);
+		VFS_RELE(vfsp);
+		kmem_free(dc, dc->lad_size);
+		return (EFAULT);
+	}
+	VFS_RELE(vfsp);
+
+	kmem_free(dc, dc->lad_size);
+	return (0);
+}
+
+static int
+lx_autofs_dev_closemount(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+	lx_autofs_vfs_t	*data;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+
+	/* "close" the vnode */
+	if ((err = closeandsetf(dcmd.lad_ioctlfd, NULL)) != 0) {
+		VFS_RELE(vfsp);
+		return (err);
+	}
+
+	mutex_enter(&data->lav_lock);
+	ASSERT(data->lav_openmnt_cnt > 0);
+	data->lav_openmnt_cnt--;
+	mutex_exit(&data->lav_lock);
+
+	VFS_RELE(vfsp);
+	return (0);
+}
+
+static int
+lx_autofs_dev_ready(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	if ((err = lx_autofs_ack(dcmd.lad_arg1, vfsp, LXACR_READY)) != 0) {
+		VFS_RELE(vfsp);
+		return (err);
+	}
+
+	VFS_RELE(vfsp);
+	return (0);
+}
+
+static int
+lx_autofs_dev_fail(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	if ((err = lx_autofs_ack(dcmd.lad_arg1, vfsp, LXACR_FAIL)) != 0) {
+		VFS_RELE(vfsp);
+		return (err);
+	}
+
+	VFS_RELE(vfsp);
+	return (0);
+}
+
+/*
+ * Update the fifo pipe information we use to talk to the automounter. The
+ * ioctl is used when the automounter restarts. This logic is similar to the
+ * handling done in lx_autofs_parse_mntopt() when the filesytem is first
+ * mounted.
+ */
+static int
+lx_autofs_dev_setpipefd(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+	lx_autofs_vfs_t	*data;
+	int fd, pgrp;
+	file_t *fp_wr, *fp_rd;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	mutex_enter(&pidlock);
+	pgrp = curproc->p_pgrp;
+	mutex_exit(&pidlock);
+	fd = dcmd.lad_arg1;
+
+	/* Lookup the new fifos. See comment in lx_autofs_parse_mntopt. */
+	if (lx_autofs_fifo_lookup(pgrp, fd, &fp_wr, &fp_rd) != 0) {
+		int pid = (int)curproc->p_pid;
+
+		if (lx_autofs_fifo_lookup(pid, fd, &fp_wr, &fp_rd) != 0) {
+			VFS_RELE(vfsp);
+			return (EINVAL);
+		}
+	}
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+
+	/* Close the old fifos. */
+	if (data->lav_fifo_wr != NULL)
+		(void) closef(data->lav_fifo_wr);
+	if (data->lav_fifo_rd != NULL)
+		(void) closef(data->lav_fifo_rd);
+
+	data->lav_fd = fd;
+	data->lav_pgrp = pgrp;
+	data->lav_fifo_rd = fp_rd;
+	data->lav_fifo_wr = fp_wr;
+	/*
+	 * Not explicitly in the ioctl spec. but necessary for correct recovery
+	 */
+	data->lav_catatonic = B_FALSE;
+
+	VFS_RELE(vfsp);
+
+	return (0);
+}
+
+static int
+lx_autofs_dev_catatonic(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+	lx_autofs_vfs_t	*data;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	data->lav_catatonic = B_TRUE;
+	VFS_RELE(vfsp);
+
+	return (0);
+}
+
+static int
+lx_autofs_dev_expire(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	/* If it succeeds in expiring then we don't want to return EAGAIN */
+	if ((err = lx_autofs_expire(vfsp, kcred)) == 0) {
+		VFS_RELE(vfsp);
+		return (0);
+	}
+
+	VFS_RELE(vfsp);
+	return (EAGAIN);
+}
+
+static int
+lx_autofs_dev_timeout(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+	lx_autofs_vfs_t	*data;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	data = (lx_autofs_vfs_t *)vfsp->vfs_data;
+	data->lav_timeout = dcmd.lad_arg1;
+	VFS_RELE(vfsp);
+
+	return (0);
+}
+
+static int
+lx_autofs_dev_requestor(intptr_t arg)
+{
+	int err;
+	lx_autofs_dv_ioctl_t *dc;
+	vfs_t *vfsp;
+	vfs_t *fnd_vfs = NULL;
+	struct vfs *vfslist;
+	zone_t *zone = curzone;
+	lx_autofs_vfs_t	*data;
+	uid_t uid;
+	gid_t gid;
+
+	if ((err = lx_autofs_dev_get_path_cmd(arg, &dc)) != 0)
+		return (err);
+
+	vfs_list_read_lock();
+	vfsp = vfslist = curzone->zone_vfslist;
+	if (vfslist == NULL) {
+		vfs_list_unlock();
+		kmem_free(dc, dc->lad_size);
+		return (EINVAL);
+	}
+
+	do {
+		/* Skip mounts we shouldn't show. */
+		if (!(vfsp->vfs_flag & VFS_NOMNTTAB)) {
+			char *mntpt = (char *)refstr_value(vfsp->vfs_mntpt);
+
+			if (strcmp(dc->lad_path,
+			    ZONE_PATH_TRANSLATE(mntpt, zone)) == 0) {
+
+				if (vfsp->vfs_op != lx_autofs_vfsops) {
+					/*
+					 * Found an indirect mount (probably
+					 * NFS) so we need to get the vfs it's
+					 * mounted onto.
+					 */
+					vnode_t *vn = vfsp->vfs_vnodecovered;
+					vfsp = vn->v_vfsp;
+
+					if (vfsp->vfs_op != lx_autofs_vfsops) {
+						/*
+						 * autofs doesn't manage this
+						 * path.
+						 */
+						break;
+					}
+				}
+
+				fnd_vfs = vfsp;
+				VFS_HOLD(fnd_vfs)
+				break;
+			}
+		}
+		vfsp = vfsp->vfs_zone_next;
+	} while (vfsp != vfslist);
+	vfs_list_unlock();
+
+	if (fnd_vfs == NULL) {
+		kmem_free(dc, dc->lad_size);
+		return (EINVAL);
+	}
+
+	data = (lx_autofs_vfs_t *)fnd_vfs->vfs_data;
+	uid = data->lav_uid;
+	gid = data->lav_gid;
+	VFS_RELE(fnd_vfs);
+
+	dc->lad_arg1 = uid;
+	dc->lad_arg2 = gid;
+
+	if (copyout(dc, (caddr_t)arg, sizeof (lx_autofs_dv_ioctl_t)) != 0) {
+		kmem_free(dc, dc->lad_size);
+		return (EFAULT);
+	}
+
+	kmem_free(dc, dc->lad_size);
+	return (0);
+}
+
+static int
+lx_autofs_dev_ismntpt(intptr_t arg)
+{
+	int err = 0;
+	lx_autofs_dv_ioctl_t *dc;
+	struct vfs *vfslist;
+	vfs_t *vfsp;
+	vfs_t *fnd_vfs = NULL;
+	zone_t *zone = curzone;
+
+	if ((err = lx_autofs_dev_get_path_cmd(arg, &dc)) != 0)
+		return (err);
+
+	/*
+	 * The automounter will always pass a path. It can also either pass an
+	 * ioctlfd or, if it's -1, arg1 can be an LX_AUTOFS_TYPE_* value. We
+	 * currently don't need those for our algorithm.
+	 */
+
+	vfs_list_read_lock();
+	vfsp = vfslist = curzone->zone_vfslist;
+	if (vfslist == NULL) {
+		vfs_list_unlock();
+		kmem_free(dc, dc->lad_size);
+		return (0);	/* return 0 if not a mount point */
+	}
+
+	do {
+		if (!(vfsp->vfs_flag & VFS_NOMNTTAB)) {
+			char *mntpt = (char *)refstr_value(vfsp->vfs_mntpt);
+
+			if (strcmp(dc->lad_path,
+			    ZONE_PATH_TRANSLATE(mntpt, zone)) == 0) {
+
+				/*
+				 * To handle direct mounts (on top of an autofs
+				 * mount), we must prefer non-autofs vfs for
+				 * this request.
+				 */
+				if (fnd_vfs != NULL)
+					VFS_RELE(fnd_vfs);
+
+				fnd_vfs = vfsp;
+				VFS_HOLD(fnd_vfs)
+
+				if (fnd_vfs->vfs_op != lx_autofs_vfsops)
+					break;
+			}
+		}
+		vfsp = vfsp->vfs_zone_next;
+	} while (vfsp != vfslist);
+	vfs_list_unlock();
+
+	if (fnd_vfs == NULL) {
+		kmem_free(dc, dc->lad_size);
+		return (0);	/* return 0 if not a mount point */
+	}
+
+	/*
+	 * arg1 is device number, arg2 is superblock magic number
+	 * The superblock value only matters if autofs or not.
+	 */
+	dc->lad_arg1 = fnd_vfs->vfs_dev;
+	if (fnd_vfs->vfs_op == lx_autofs_vfsops) {
+		dc->lad_arg2 = LX_AUTOFS_SB_MAGIC;
+	} else {
+		dc->lad_arg2 = ~LX_AUTOFS_SB_MAGIC;
+	}
+
+	VFS_RELE(fnd_vfs);
+
+	if (copyout(dc, (caddr_t)arg, sizeof (lx_autofs_dv_ioctl_t)) != 0) {
+		kmem_free(dc, dc->lad_size);
+		return (EFAULT);
+	}
+
+	kmem_free(dc, dc->lad_size);
+
+	/*
+	 * We have to return 1 if it is a mount point. The lx ioctl autofs
+	 * translator will convert a negative value back to a positive,
+	 * non-error return value.
+	 */
+	return (-1);
+}
+
+static int
+lx_autofs_dev_askumount(intptr_t arg)
+{
+	int err;
+	int v;
+	lx_autofs_dv_ioctl_t dcmd;
+	vfs_t *vfsp;
+
+	if ((err = lx_autofs_dev_fd_preamble(arg, &dcmd, &vfsp)) != 0)
+		return (err);
+
+	if (lx_autofs_may_unmount(vfsp, kcred)) {
+		v = 0;
+	} else {
+		v = 1;
+	}
+	VFS_RELE(vfsp);
+
+	dcmd.lad_arg1 = v;
+	if (copyout(&dcmd, (caddr_t)arg, sizeof (dcmd)) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+lx_autofs_dev_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rvalp)
+{
+	switch (cmd) {
+	case LX_AUTOFS_DEV_IOC_VERSION_CMD:
+		return (lx_autofs_dev_vers(arg));
+
+	case LX_AUTOFS_DEV_IOC_PROTOVER_CMD:
+		return (lx_autofs_dev_protver(arg));
+
+	case LX_AUTOFS_DEV_IOC_PROTOSUBVER_CMD:
+		return (lx_autofs_dev_protosubver(arg));
+
+	case LX_AUTOFS_DEV_IOC_OPENMOUNT_CMD:
+		return (lx_autofs_dev_openmount(arg));
+
+	case LX_AUTOFS_DEV_IOC_CLOSEMOUNT_CMD:
+		return (lx_autofs_dev_closemount(arg));
+
+	case LX_AUTOFS_DEV_IOC_READY_CMD:
+		return (lx_autofs_dev_ready(arg));
+
+	case LX_AUTOFS_DEV_IOC_FAIL_CMD:
+		return (lx_autofs_dev_fail(arg));
+
+	case LX_AUTOFS_DEV_IOC_SETPIPEFD_CMD:
+		return (lx_autofs_dev_setpipefd(arg));
+
+	case LX_AUTOFS_DEV_IOC_CATATONIC_CMD:
+		return (lx_autofs_dev_catatonic(arg));
+
+	case LX_AUTOFS_DEV_IOC_TIMEOUT_CMD:
+		return (lx_autofs_dev_timeout(arg));
+
+	case LX_AUTOFS_DEV_IOC_REQUESTER_CMD:
+		return (lx_autofs_dev_requestor(arg));
+
+	case LX_AUTOFS_DEV_IOC_EXPIRE_CMD:
+		return (lx_autofs_dev_expire(arg));
+
+	case LX_AUTOFS_DEV_IOC_ASKUMOUNT_CMD:
+		return (lx_autofs_dev_askumount(arg));
+
+	case LX_AUTOFS_DEV_IOC_ISMOUNTPOINT_CMD:
+		return (lx_autofs_dev_ismntpt(arg));
+	}
+
+	return (EINVAL);
+}
+
+/*
+ * lx_autofs_init() gets invoked via the mod_install() call in
+ * this module's _init() routine.  Therefore, the code that cleans
+ * up the structures we allocate below is actually found in
+ * our _fini() routine.
+ */
+/* ARGSUSED */
+static int
+lx_autofs_init(int fstype, char *name)
+{
+	int		error;
+
+	lx_autofs_major = ddi_name_to_major(LX_AUTOFS_NAME);
+
+	lx_autofs_fstype = fstype;
+	if ((error = vfs_setfsops(fstype, lx_autofs_vfstops,
+	    &lx_autofs_vfsops)) != 0) {
+		cmn_err(CE_WARN, "lx_autofs_init: bad vfs ops template");
+		return (error);
+	}
+
+	if ((error = vn_make_ops(name, lx_autofs_tops_root,
+	    &lx_autofs_vn_ops)) != 0) {
+		VERIFY(vfs_freevfsops_by_type(fstype) == 0);
+		lx_autofs_vn_ops = NULL;
+		return (error);
+	}
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+lx_autofs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	int	instance = ddi_get_instance(dip);
+
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	ASSERT(instance == 0);
+	if (instance != 0)
+		return (DDI_FAILURE);
+
+	/* create our minor node */
+	if (ddi_create_minor_node(dip, LX_AUTOFS_MINORNAME, S_IFCHR, 0,
+	    DDI_PSEUDO, 0) != DDI_SUCCESS)
+		return (DDI_FAILURE);
+
+	lx_autofs_dip = dip;
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+lx_autofs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	lx_autofs_dip = NULL;
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+lx_autofs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg,
+    void **resultp)
+{
+	switch (infocmd) {
+	case DDI_INFO_DEVT2DEVINFO:
+		*resultp = lx_autofs_dip;
+		return (DDI_SUCCESS);
+
+	case DDI_INFO_DEVT2INSTANCE:
+		*resultp = (void *)0;
+		return (DDI_SUCCESS);
+	}
+	return (DDI_FAILURE);
+}
+
+/*
+ * Driver flags
+ */
+static struct cb_ops lx_autofs_cb_ops = {
+	lx_autofs_dev_open,	/* open */
+	lx_autofs_dev_close,	/* close */
+	nodev,			/* strategy */
+	nodev,			/* print */
+	nodev,			/* dump */
+	nodev,			/* read */
+	nodev,			/* write */
+	lx_autofs_dev_ioctl,	/* ioctl */
+	nodev,			/* devmap */
+	nodev,			/* mmap */
+	nodev,			/* segmap */
+	nochpoll,		/* poll */
+	ddi_prop_op,		/* vb_prop_op */
+	NULL,			/* streamtab */
+	D_NEW | D_MP		/* Driver compatibility flag */
+};
+
+/*
+ * Module linkage
+ */
+static mntopt_t lx_autofs_mntopt[] = {
+	{ LX_MNTOPT_FD,		NULL,	0,	MO_HASVALUE },
+	{ LX_MNTOPT_PGRP,	NULL,	0,	MO_HASVALUE },
+	{ LX_MNTOPT_MINPROTO,	NULL,	0,	MO_HASVALUE },
+	{ LX_MNTOPT_MAXPROTO,	NULL,	0,	MO_HASVALUE },
+	{ LX_MNTOPT_INDIRECT,	NULL,	0,	0 },
+	{ LX_MNTOPT_DIRECT,	NULL,	0,	0 },
+	{ LX_MNTOPT_OFFSET,	NULL,	0,	0 }
+};
+
+static mntopts_t lx_autofs_mntopts = {
+	sizeof (lx_autofs_mntopt) / sizeof (mntopt_t),
+	lx_autofs_mntopt
+};
+
+static vfsdef_t vfw = {
+	VFSDEF_VERSION,
+	LX_AUTOFS_NAME,
+	lx_autofs_init,
+	VSW_HASPROTO | VSW_VOLATILEDEV | VSW_ZMOUNT,
+	&lx_autofs_mntopts
+};
+
+static struct dev_ops lx_autofs_dev_ops = {
+	DEVO_REV,		/* version */
+	0,			/* refcnt */
+	lx_autofs_info,		/* info */
+	nulldev,		/* identify */
+	nulldev,		/* probe */
+	lx_autofs_attach,	/* attach */
+	lx_autofs_detach,	/* detach */
+	nodev,			/* reset */
+	&lx_autofs_cb_ops,	/* driver operations */
+	NULL,			/* no bus operations */
+	NULL,			/* power */
+	ddi_quiesce_not_needed	/* quiesce */
+};
+
+extern struct mod_ops mod_fsops;
+
+static struct modlfs modlfs = {
+	&mod_fsops, "lx autofs filesystem", &vfw
+};
+
+static struct modldrv modldrv = {
+	&mod_driverops, "lx autofs driver", &lx_autofs_dev_ops
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,
+	(void *)&modlfs,
+	(void *)&modldrv,
+	NULL
+};
+
+int
+_init(void)
+{
+	int error;
+
+	if ((error = mod_install(&modlinkage)) != 0) {
+		return (error);
+	}
+
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int		error;
+
+	if ((error = mod_remove(&modlinkage)) != 0)
+		return (error);
+
+	if (lx_autofs_vn_ops != NULL) {
+		vn_freevnodeops(lx_autofs_vn_ops);
+		lx_autofs_vn_ops = NULL;
+	}
+
+	/*
+	 * In our init routine, if we get an error after calling
+	 * vfs_setfsops() we cleanup by calling vfs_freevfsops_by_type().
+	 * But we don't need to call vfs_freevfsops_by_type() here
+	 * because the fs framework did this for us as part of the
+	 * mod_remove() call above.
+	 */
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/autofs/lxautofs.conf b/usr/src/uts/common/brand/lx/autofs/lxautofs.conf
new file mode 100644
index 0000000000..36e0119e33
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/autofs/lxautofs.conf
@@ -0,0 +1,14 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+name="lxautofs" parent="pseudo" instance=0;
diff --git a/usr/src/uts/common/brand/lx/cgroups/cgrps.h b/usr/src/uts/common/brand/lx/cgroups/cgrps.h
new file mode 100644
index 0000000000..46e2cdd886
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/cgroups/cgrps.h
@@ -0,0 +1,222 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_LXCGRPS_H
+#define	_LXCGRPS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * cgrps.h: declarations, data structures and macros for lx_cgroup
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/policy.h>
+#include <sys/dirent.h>
+#include <sys/errno.h>
+#include <sys/kmem.h>
+#include <sys/pathname.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/sysmacros.h>
+#include <sys/cred.h>
+#include <sys/priv.h>
+#include <sys/vnode.h>
+#include <sys/vfs.h>
+#include <sys/statvfs.h>
+#include <sys/cmn_err.h>
+#include <sys/zone.h>
+#include <sys/uio.h>
+#include <sys/utsname.h>
+#include <sys/atomic.h>
+#include <vm/anon.h>
+
+/*
+ * cgrpmgr ioctl interface.
+ */
+#define	CGRPFS_IOC	('C' << 16 | 'G' << 8)
+#define	CGRPFS_GETEVNT	(CGRPFS_IOC | 1)
+
+typedef struct cgrpmgr_info {
+	pid_t	cgmi_pid;
+	char	*cgmi_rel_agent_path;
+	char	*cgmi_cgroup_path;
+} cgrpmgr_info_t;
+
+#if defined(_KERNEL)
+
+#include <sys/lx_brand.h>
+
+typedef struct cgrpmgr_info32 {
+	pid_t		cgmi_pid;
+	caddr32_t	cgmi_rel_agent_path;
+	caddr32_t	cgmi_cgroup_path;
+} cgrpmgr_info32_t;
+
+#define	CG_PSNSIZE	256	/* max size of pseudo file name entries */
+#define	CG_PSDSIZE	16	/* pretend that a dir entry takes 16 bytes */
+
+/*
+ * The order of these entries must be in sync with the cg_ssde_dir array.
+ */
+typedef enum cgrp_ssid {
+	CG_SSID_GENERIC = 1,
+	CG_SSID_NUM		/* last ssid for range checking */
+} cgrp_ssid_t;
+
+typedef enum cgrp_nodetype {
+	CG_CGROUP_DIR = 1,	/* cgroup directory entry */
+	CG_NOTIFY,		/* notify_on_release file */
+	CG_PROCS,		/* cgroup.procs file */
+	CG_REL_AGENT,		/* release_agent file */
+	CG_TASKS,		/* tasks file */
+} cgrp_nodetype_t;
+
+typedef struct cgrp_subsys_dirent {
+	cgrp_nodetype_t cgrp_ssd_type;
+	char		*cgrp_ssd_name;
+} cgrp_subsys_dirent_t;
+
+#define	N_DIRENTS(m)	(cgrp_num_pseudo_ents((m)->cg_ssid) + 2)
+
+/*
+ * A modern systemd-based Linux system typically has 50-60 cgroups so
+ * we size the hash for 2x that number.
+ */
+#define	CGRP_HASH_SZ	128
+#define	CGRP_AGENT_LEN	(MAXPATHLEN + 1)
+
+/*
+ * cgroups per-mount data structure.
+ *
+ * All but the event related fields are protected by cg_contents.
+ * The evnt_list and counter is protected by cg_events.
+ */
+typedef struct cgrp_mnt {
+	struct vfs	*cg_vfsp;	/* filesystem's vfs struct */
+	struct cgrp_node *cg_rootnode;	/* root cgrp_node */
+	char 		*cg_mntpath;	/* name of cgroup mount point */
+	cgrp_ssid_t	cg_ssid;	/* subsystem type */
+	dev_t		cg_dev;		/* unique dev # of mounted `device' */
+	uint_t		cg_gen;		/* node ID source for files */
+	uint_t		cg_grp_gen;	/* ID source for cgroups */
+	kmutex_t	cg_contents;	/* global lock for most fs activity */
+	char		cg_agent[CGRP_AGENT_LEN]; /* release_agent path */
+	/* ptr to zone data for containing zone */
+	lx_zone_data_t	*cg_lxzdata;
+	struct cgrp_node **cg_grp_hash;	/* hash list of cgroups in the fs */
+} cgrp_mnt_t;
+
+/*
+ * cgrp_node is the file system dependent node for cgroups.
+ *
+ * The node is used to represent both directories (a cgroup) and pseudo files
+ * within the directory.
+ *
+ * Members are tagged in the comment to note which type of node they apply to:
+ * A - all
+ * D - dir (i.e. a cgroup)
+ * F - pseudo file
+ */
+
+typedef struct cgrp_node {
+	struct cgrp_node	*cgn_back;	/* A lnked lst of cgrp_nodes */
+	struct cgrp_node	*cgn_forw;	/* A lnked lst of cgrp_nodes */
+	struct cgrp_dirent	*cgn_dir;	/* D dirent list */
+	struct cgrp_node	*cgn_parent;	/* A dir containing this node */
+	struct cgrp_node	*cgn_next;	/* D link in per-mount cgroup */
+						/*   hash table */
+	uint_t			cgn_dirents;	/* D number of dirents */
+	cgrp_nodetype_t		cgn_type;	/* A type for this node */
+	uint_t			cgn_notify;	/* D notify_on_release value */
+	uint_t			cgn_task_cnt;	/* D number of threads in grp */
+	struct vnode 		*cgn_vnode;	/* A vnode for this cgrp_node */
+	uint_t 			cgn_id;		/* D ID number for the cgroup */
+	struct vattr		cgn_attr;	/* A attributes */
+} cgrp_node_t;
+
+/*
+ * File system independent to cgroups conversion macros
+ */
+#define	VFSTOCGM(vfsp)		((cgrp_mnt_t *)(vfsp)->vfs_data)
+#define	VTOCGM(vp)		((cgrp_mnt_t *)(vp)->v_vfsp->vfs_data)
+#define	VTOCGN(vp)		((struct cgrp_node *)(vp)->v_data)
+#define	CGNTOV(cn)		((cn)->cgn_vnode)
+#define	cgnode_hold(cn)		VN_HOLD(CGNTOV(cn))
+#define	cgnode_rele(cn)		VN_RELE(CGNTOV(cn))
+
+/*
+ * Attributes
+ */
+#define	cgn_mask	cgn_attr.va_mask
+#define	cgn_mode	cgn_attr.va_mode
+#define	cgn_uid		cgn_attr.va_uid
+#define	cgn_gid		cgn_attr.va_gid
+#define	cgn_fsid	cgn_attr.va_fsid
+#define	cgn_nodeid	cgn_attr.va_nodeid
+#define	cgn_nlink	cgn_attr.va_nlink
+#define	cgn_size	cgn_attr.va_size
+#define	cgn_atime	cgn_attr.va_atime
+#define	cgn_mtime	cgn_attr.va_mtime
+#define	cgn_ctime	cgn_attr.va_ctime
+#define	cgn_rdev	cgn_attr.va_rdev
+#define	cgn_blksize	cgn_attr.va_blksize
+#define	cgn_nblocks	cgn_attr.va_nblocks
+#define	cgn_seq		cgn_attr.va_seq
+
+/*
+ * cgroup directories are made up of a linked list of cg_dirent structures
+ * hanging off directory cgrp_nodes.  File names are not fixed length,
+ * but are null terminated.
+ */
+typedef struct cgrp_dirent {
+	struct cgrp_node	*cgd_cgrp_node;	/* cg node for this file */
+	struct cgrp_dirent	*cgd_next;	/* next directory entry */
+	struct cgrp_dirent	*cgd_prev;	/* prev directory entry */
+	uint_t			cgd_offset;	/* "offset" of dir entry */
+	uint_t			cgd_hash;	/* a hash of cgd_name */
+	struct cgrp_dirent	*cgd_link;	/* linked via hash table */
+	struct cgrp_node	*cgd_parent;	/* parent, dir we are in */
+	char			*cgd_name;	/* null terminated */
+} cgrp_dirent_t;
+
+enum de_op	{ DE_CREATE, DE_MKDIR, DE_RENAME };	/* direnter ops */
+enum dr_op	{ DR_REMOVE, DR_RMDIR, DR_RENAME };	/* dirremove ops */
+
+extern struct vnodeops *cgrp_vnodeops;
+
+int cgrp_dirdelete(cgrp_node_t *, cgrp_node_t *, char *, enum dr_op, cred_t *);
+int cgrp_direnter(cgrp_mnt_t *, cgrp_node_t *, char *, enum de_op,
+    cgrp_node_t *, struct vattr *, cgrp_node_t **, cred_t *);
+void cgrp_dirinit(cgrp_node_t *, cgrp_node_t *, cred_t *);
+int cgrp_dirlookup(cgrp_node_t *, char *, cgrp_node_t **, cred_t *);
+void cgrp_dirtrunc(cgrp_node_t *);
+void cgrp_node_init(cgrp_mnt_t *, cgrp_node_t *, vattr_t *, cred_t *);
+int cgrp_taccess(void *, int, cred_t *);
+ino_t cgrp_inode(cgrp_nodetype_t, unsigned int);
+int cgrp_num_pseudo_ents(cgrp_ssid_t);
+cgrp_node_t *cgrp_cg_hash_lookup(cgrp_mnt_t *, uint_t);
+void cgrp_rel_agent_event(cgrp_mnt_t *, cgrp_node_t *, boolean_t);
+
+#endif /* KERNEL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _LXCGRPS_H */
diff --git a/usr/src/uts/common/brand/lx/cgroups/cgrps_node.c b/usr/src/uts/common/brand/lx/cgroups/cgrps_node.c
new file mode 100644
index 0000000000..66b6f60376
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/cgroups/cgrps_node.c
@@ -0,0 +1,1014 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/time.h>
+#include <sys/vfs.h>
+#include <sys/vnode.h>
+#include <sys/errno.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/stat.h>
+#include <sys/mode.h>
+#include <sys/policy.h>
+#include <sys/sdt.h>
+
+#include "cgrps.h"
+
+static int cgrp_dirmakecgnode(cgrp_node_t *, cgrp_mnt_t *, struct vattr *,
+	enum de_op, cgrp_node_t **, struct cred *);
+static int cgrp_diraddentry(cgrp_node_t *, cgrp_node_t *, char *);
+
+static cgrp_subsys_dirent_t cgrp_generic_dir[] = {
+	{ CG_PROCS,		"cgroup.procs" },
+	{ CG_NOTIFY,		"notify_on_release" },
+	{ CG_TASKS,		"tasks" }
+};
+
+typedef struct cgrp_ssde {
+	cgrp_subsys_dirent_t	*cg_ssde_files;
+	int			cg_ssde_nfiles;
+} cgrp_ssde_t;
+
+#define	CGDIRLISTSZ(l)		(sizeof (l) / sizeof ((l)[0]))
+
+/*
+ * Note, these entries must be in the same order as the cgrp_ssid_t entries.
+ */
+static cgrp_ssde_t cg_ssde_dir[] = {
+	/* subsystems start at 1 */
+	{NULL, 0},
+
+	/* CG_SSID_GENERIC */
+	{cgrp_generic_dir, CGDIRLISTSZ(cgrp_generic_dir)},
+};
+
+
+#define	CG_HASH_SIZE	8192		/* must be power of 2 */
+#define	CG_MUTEX_SIZE	64
+
+static cgrp_dirent_t	*cg_hashtable[CG_HASH_SIZE];
+static kmutex_t		 cg_hashmutex[CG_MUTEX_SIZE];
+
+#define	CG_HASH_INDEX(a)	((a) & (CG_HASH_SIZE-1))
+#define	CG_MUTEX_INDEX(a)	((a) & (CG_MUTEX_SIZE-1))
+
+#define	CG_HASH(cp, name, hash)				\
+	{							\
+		char Xc, *Xcp;					\
+		hash = (uint_t)(uintptr_t)(cp) >> 8;		\
+		for (Xcp = (name); (Xc = *Xcp) != 0; Xcp++)	\
+			hash = (hash << 4) + hash + (uint_t)Xc;	\
+	}
+
+#define	MODESHIFT	3
+
+typedef enum cgrp_nodehold {
+	NOHOLD,
+	HOLD
+} cgrp_nodehold_t;
+
+void
+cgrp_hash_init(void)
+{
+	int i;
+
+	for (i = 0; i < CG_MUTEX_SIZE; i++)
+		mutex_init(&cg_hashmutex[i], NULL, MUTEX_DEFAULT, NULL);
+}
+
+static void
+cgrp_hash_in(cgrp_dirent_t *c)
+{
+	uint_t		hash;
+	cgrp_dirent_t	**prevpp;
+	kmutex_t	*cg_hmtx;
+
+	CG_HASH(c->cgd_parent, c->cgd_name, hash);
+	c->cgd_hash = hash;
+	prevpp = &cg_hashtable[CG_HASH_INDEX(hash)];
+	cg_hmtx = &cg_hashmutex[CG_MUTEX_INDEX(hash)];
+	mutex_enter(cg_hmtx);
+	c->cgd_link = *prevpp;
+	*prevpp = c;
+	mutex_exit(cg_hmtx);
+}
+
+static void
+cgrp_hash_out(cgrp_dirent_t *c)
+{
+	uint_t		hash;
+	cgrp_dirent_t	**prevpp;
+	kmutex_t	*cg_hmtx;
+
+	hash = c->cgd_hash;
+	prevpp = &cg_hashtable[CG_HASH_INDEX(hash)];
+	cg_hmtx = &cg_hashmutex[CG_MUTEX_INDEX(hash)];
+	mutex_enter(cg_hmtx);
+	while (*prevpp != c)
+		prevpp = &(*prevpp)->cgd_link;
+	*prevpp = c->cgd_link;
+	mutex_exit(cg_hmtx);
+}
+
+static cgrp_dirent_t *
+cgrp_hash_lookup(char *name, cgrp_node_t *parent, cgrp_nodehold_t hold,
+    cgrp_node_t **found)
+{
+	cgrp_dirent_t	*l;
+	uint_t		hash;
+	kmutex_t	*cg_hmtx;
+	cgrp_node_t	*cnp;
+
+	CG_HASH(parent, name, hash);
+	cg_hmtx = &cg_hashmutex[CG_MUTEX_INDEX(hash)];
+	mutex_enter(cg_hmtx);
+	l = cg_hashtable[CG_HASH_INDEX(hash)];
+	while (l) {
+		if ((l->cgd_hash == hash) &&
+		    (l->cgd_parent == parent) &&
+		    (strcmp(l->cgd_name, name) == 0)) {
+			/*
+			 * We need to make sure that the cgrp_node that
+			 * we put a hold on is the same one that we pass back.
+			 * Hence, temporary variable cnp is necessary.
+			 */
+			cnp = l->cgd_cgrp_node;
+			if (hold == HOLD) {
+				ASSERT(cnp);
+				cgnode_hold(cnp);
+			}
+			if (found)
+				*found = cnp;
+			mutex_exit(cg_hmtx);
+			return (l);
+		} else {
+			l = l->cgd_link;
+		}
+	}
+	mutex_exit(cg_hmtx);
+	return (NULL);
+}
+
+/*
+ * The following functions maintain the per-mount cgroup hash table.
+ */
+static void
+cgrp_cg_hash_insert(cgrp_mnt_t *cgm, cgrp_node_t *cn)
+{
+	uint_t cgid;
+	int hsh;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+
+	cgid = cn->cgn_id;
+	hsh = cgid % CGRP_HASH_SZ;
+
+	cn->cgn_next = cgm->cg_grp_hash[hsh];
+	cgm->cg_grp_hash[hsh] = cn;
+}
+
+static void
+cgrp_cg_hash_remove(cgrp_mnt_t *cgm, cgrp_node_t *cn)
+{
+	uint_t cgid;
+	int hsh;
+	cgrp_node_t *np = NULL, *curp, *prevp = NULL;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+
+	cgid = cn->cgn_id;
+	hsh = cgid % CGRP_HASH_SZ;
+
+	for (curp = cgm->cg_grp_hash[hsh]; curp != NULL;
+	    curp = curp->cgn_next) {
+		if (curp->cgn_id == cgid) {
+			if (prevp == NULL) {
+				cgm->cg_grp_hash[hsh] = curp->cgn_next;
+			} else {
+				prevp->cgn_next = curp->cgn_next;
+			}
+			np = curp;
+			np->cgn_next = NULL;
+			break;
+		}
+
+		prevp = curp;
+	}
+
+	ASSERT(np != NULL);
+	ASSERT(np->cgn_task_cnt == 0);
+}
+
+/*
+ * Count up the number of threads already running in the zone and initialize the
+ * first cgroup's task counter.
+ *
+ * We have to look at all of the processes to find applicable ones.
+ */
+static void
+cgrp_cg_hash_init(cgrp_node_t *cn)
+{
+	int i;
+	int cnt = 0;
+	zoneid_t zoneid = curproc->p_zone->zone_id;
+	pid_t schedpid = curproc->p_zone->zone_zsched->p_pid;
+
+	/* Scan all of the process entries */
+	mutex_enter(&pidlock);
+	for (i = 1; i < v.v_proc; i++) {
+		proc_t *p;
+
+		/*
+		 * Skip indices for which there is no pid_entry, PIDs for
+		 * which there is no corresponding process, system processes,
+		 * a PID of 0, the pid for our zsched process,  anything the
+		 * security policy doesn't allow us to look at, its not an
+		 * lx-branded process and processes that are not in the zone.
+		 */
+		if ((p = pid_entry(i)) == NULL ||
+		    p->p_stat == SIDL ||
+		    (p->p_flag & SSYS) != 0 ||
+		    p->p_pid == 0 ||
+		    p->p_pid == schedpid ||
+		    secpolicy_basic_procinfo(CRED(), p, curproc) != 0 ||
+		    p->p_zone->zone_id != zoneid) {
+			continue;
+		}
+
+		mutex_enter(&p->p_lock);
+		if (p->p_brand != &lx_brand) {
+			mutex_exit(&p->p_lock);
+			continue;
+		}
+		cnt += p->p_lwpcnt;
+		mutex_exit(&p->p_lock);
+	}
+
+	/*
+	 * There should be at least the init process with 1 thread in the zone
+	 */
+	ASSERT(cnt > 0);
+	cn->cgn_task_cnt = cnt;
+
+	DTRACE_PROBE2(cgrp__grp__init, void *, cn, int, cnt);
+
+	mutex_exit(&pidlock);
+}
+
+cgrp_node_t *
+cgrp_cg_hash_lookup(cgrp_mnt_t *cgm, uint_t cgid)
+{
+	int hsh = cgid % CGRP_HASH_SZ;
+	cgrp_node_t *curp;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+
+	for (curp = cgm->cg_grp_hash[hsh]; curp != NULL;
+	    curp = curp->cgn_next) {
+		if (curp->cgn_id == cgid) {
+			return (curp);
+		}
+	}
+
+	return (NULL);
+}
+
+/*
+ * Calculate an inode number
+ *
+ * This takes various bits of info and munges them to give the inode number for
+ * a cgrp pseudo file node.
+ */
+ino_t
+cgrp_inode(cgrp_nodetype_t type, unsigned int cgrpid)
+{
+	/*
+	 * cgroup inode format:
+	 * 00000000AABBBBBB
+	 *
+	 * AA		- node type (from subsystem list)
+	 * BBBBBB	- id of the cgroup
+	 */
+
+	return ((ino_t)(type << 24) | (cgrpid & 0xffffff));
+}
+
+/*
+ * Return the number of pseudo file entries in a cgroup directory for the
+ * given subsystem.
+ */
+int
+cgrp_num_pseudo_ents(cgrp_ssid_t ssid)
+{
+	cgrp_ssde_t *ssdp = &cg_ssde_dir[ssid];
+
+	return (ssdp->cg_ssde_nfiles);
+}
+
+int
+cgrp_taccess(void *vcp, int mode, cred_t *cred)
+{
+	cgrp_node_t *cn = vcp;
+	int shift = 0;
+	/*
+	 * Check access based on owner, group and public perms in cgrp_node.
+	 */
+	if (crgetuid(cred) != cn->cgn_uid) {
+		shift += MODESHIFT;
+		if (groupmember(cn->cgn_gid, cred) == 0)
+			shift += MODESHIFT;
+	}
+
+	return (secpolicy_vnode_access2(cred, CGNTOV(cn), cn->cgn_uid,
+	    cn->cgn_mode << shift, mode));
+}
+
+/*
+ * Search directory 'parent' for entry 'name'.
+ *
+ * 0 is returned on success and *foundcp points
+ * to the found cgrp_node with its vnode held.
+ */
+int
+cgrp_dirlookup(cgrp_node_t *parent, char *name, cgrp_node_t **foundcp,
+    cred_t *cred)
+{
+	int error;
+
+	ASSERT(MUTEX_HELD(&VTOCGM(parent->cgn_vnode)->cg_contents));
+	*foundcp = NULL;
+	if (parent->cgn_type != CG_CGROUP_DIR)
+		return (ENOTDIR);
+
+	if ((error = cgrp_taccess(parent, VEXEC, cred)))
+		return (error);
+
+	if (*name == '\0') {
+		cgnode_hold(parent);
+		*foundcp = parent;
+		return (0);
+	}
+
+	/*
+	 * Search the directory for the matching name
+	 * We need the lock protecting the cgn_dir list
+	 * so that it doesn't change out from underneath us.
+	 * cgrp_hash_lookup() will pass back the cgrp_node
+	 * with a hold on it.
+	 */
+
+	if (cgrp_hash_lookup(name, parent, HOLD, foundcp) != NULL) {
+		ASSERT(*foundcp);
+		return (0);
+	}
+
+	return (ENOENT);
+}
+
+/*
+ * Enter a directory entry for 'name' and 'cp' into directory 'dir'
+ *
+ * Returns 0 on success.
+ */
+int
+cgrp_direnter(
+	cgrp_mnt_t	*cgm,
+	cgrp_node_t	*dir,		/* target directory to make entry in */
+	char		*name,		/* name of entry */
+	enum de_op	op,		/* entry operation */
+	cgrp_node_t	*cn,		/* existing cgrp_node, if rename */
+	struct vattr	*va,
+	cgrp_node_t	**cnp,		/* return cgrp_node, if create/mkdir */
+	cred_t		*cred)
+{
+	cgrp_dirent_t *cdp;
+	cgrp_node_t *found = NULL;
+	int error = 0;
+	char *s;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+	ASSERT(dir->cgn_type == CG_CGROUP_DIR);
+
+	/*
+	 * Don't allow '/' characters in pathname component,
+	 */
+	for (s = name; *s; s++)
+		if (*s == '/')
+			return (EACCES);
+
+	if (name[0] == '\0')
+		panic("cgrp_direnter: NULL name");
+
+	/*
+	 * For rename lock the source entry and check the link count
+	 * to see if it has been removed while it was unlocked.
+	 * Remember that we can only rename within the same directory.
+	 */
+	if (op == DE_RENAME) {
+		if (cn->cgn_nlink == 0) {
+			return (ENOENT);
+		}
+
+		if (cn->cgn_nlink == MAXLINK) {
+			return (EMLINK);
+		}
+		cn->cgn_nlink++;
+		gethrestime(&cn->cgn_ctime);
+	}
+
+	/*
+	 * This might be a "dangling detached directory".
+	 * it could have been removed, but a reference
+	 * to it kept in u_cwd.  don't bother searching
+	 * it, and with any luck the user will get tired
+	 * of dealing with us and cd to some absolute
+	 * pathway.  *sigh*, thus in ufs, too.
+	 */
+	if (dir->cgn_nlink == 0) {
+		error = ENOENT;
+		goto out;
+	}
+
+	/*
+	 * Search for the entry. In all cases it is an error if it exists.
+	 */
+	cdp = cgrp_hash_lookup(name, dir, HOLD, &found);
+
+	if (cdp) {
+		ASSERT(found != NULL);
+		error = EEXIST;
+		mutex_exit(&cgm->cg_contents);
+		cgnode_rele(found);
+		mutex_enter(&cgm->cg_contents);
+	} else {
+
+		/*
+		 * The entry does not exist. Check write permission in
+		 * directory to see if entry can be created.
+		 */
+		if ((error = cgrp_taccess(dir, VWRITE, cred)) != 0)
+			goto out;
+		if (op == DE_CREATE || op == DE_MKDIR) {
+			/*
+			 * Make new cgrp_node and directory entry as required.
+			 */
+			error = cgrp_dirmakecgnode(dir, cgm, va, op, &cn, cred);
+			if (error)
+				goto out;
+
+			if (op == DE_MKDIR) {
+				/*
+				 * inherit notify_on_release value from parent
+				 */
+				cn->cgn_notify = dir->cgn_notify;
+			}
+		}
+
+		error = cgrp_diraddentry(dir, cn, name);
+		if (error != 0) {
+			if (op == DE_CREATE || op == DE_MKDIR) {
+				/*
+				 * Unmake the inode we just made.
+				 */
+				if ((cn->cgn_type) == CG_CGROUP_DIR) {
+					ASSERT(cdp == NULL);
+					/*
+					 * cleanup allocs made by cgrp_dirinit
+					 */
+					cgrp_dirtrunc(cn);
+				}
+				cn->cgn_nlink = 0;
+				gethrestime(&cn->cgn_ctime);
+				mutex_exit(&cgm->cg_contents);
+				cgnode_rele(cn);
+				mutex_enter(&cgm->cg_contents);
+				cn = NULL;
+			}
+		} else if (cnp) {
+			*cnp = cn;
+		} else if (op == DE_CREATE || op == DE_MKDIR) {
+			mutex_exit(&cgm->cg_contents);
+			cgnode_rele(cn);
+			mutex_enter(&cgm->cg_contents);
+		}
+	}
+
+out:
+	if (error && op == DE_RENAME) {
+		/* Undo bumped link count. */
+		cn->cgn_nlink--;
+		gethrestime(&cn->cgn_ctime);
+	}
+	return (error);
+}
+
+/*
+ * Delete entry cn of name "nm" from parent dir. This is used to both remove
+ * a cgroup directory and to remove the pseudo file nodes within the cgroup
+ * directory (by recursively calling itself). It frees the dir entry space
+ * and decrements link count on cgrp_node(s).
+ *
+ * Return 0 on success.
+ */
+int
+cgrp_dirdelete(cgrp_node_t *dir, cgrp_node_t *cn, char *nm, enum dr_op op,
+    cred_t *cred)
+{
+	cgrp_mnt_t *cgm = VTOCGM(cn->cgn_vnode);
+	cgrp_dirent_t *cndp;
+	int error;
+	size_t namelen;
+	cgrp_node_t *cnnp;
+	timestruc_t now;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+
+	if (nm[0] == '\0')
+		panic("cgrp_dirdelete: empty name for 0x%p", (void *)cn);
+
+	/*
+	 * return error when removing . and ..
+	 */
+	if (nm[0] == '.') {
+		if (nm[1] == '\0')
+			return (EINVAL);
+		if (nm[1] == '.' && nm[2] == '\0')
+			return (EEXIST); /* thus in ufs */
+	}
+
+	if ((error = cgrp_taccess(dir, VEXEC|VWRITE, cred)) != 0)
+		return (error);
+
+	if (dir->cgn_dir == NULL)
+		return (ENOENT);
+
+	if (op == DR_RMDIR) {
+		/*
+		 * This is the top-level removal of a cgroup dir. Start by
+		 * removing the fixed pseudo file entries from the dir. We do
+		 * this by recursively calling back into this function with
+		 * a different op code. The caller of this function has
+		 * already verified that it is safe to remove this directory.
+		 */
+		cgrp_dirent_t *cdp;
+
+		ASSERT(cn->cgn_type == CG_CGROUP_DIR);
+
+		cdp = cn->cgn_dir;
+		while (cdp) {
+			cgrp_node_t *pseudo_node;
+			cgrp_dirent_t *nextp;
+
+			if (strcmp(cdp->cgd_name, ".") == 0 ||
+			    strcmp(cdp->cgd_name, "..") == 0) {
+				cdp = cdp->cgd_next;
+				continue;
+			}
+
+			pseudo_node = cdp->cgd_cgrp_node;
+			nextp = cdp->cgd_next;
+
+			cgnode_hold(pseudo_node);
+			error = cgrp_dirdelete(cn, pseudo_node,
+			    cdp->cgd_name, DR_REMOVE, cred);
+			mutex_exit(&cgm->cg_contents);
+			cgnode_rele(pseudo_node);
+			mutex_enter(&cgm->cg_contents);
+
+			cdp = nextp;
+		}
+
+		cgrp_cg_hash_remove(cgm, cn);
+	}
+
+	cndp = cgrp_hash_lookup(nm, dir, NOHOLD, &cnnp);
+	VERIFY(cndp != NULL);
+	VERIFY(cn == cnnp);
+
+	cgrp_hash_out(cndp);
+
+	/* Take cndp out of the directory list. */
+	ASSERT(cndp->cgd_next != cndp);
+	ASSERT(cndp->cgd_prev != cndp);
+	if (cndp->cgd_prev) {
+		cndp->cgd_prev->cgd_next = cndp->cgd_next;
+	}
+	if (cndp->cgd_next) {
+		cndp->cgd_next->cgd_prev = cndp->cgd_prev;
+	}
+
+	/*
+	 * If the roving slot pointer happens to match cndp,
+	 * point it at the previous dirent.
+	 */
+	if (dir->cgn_dir->cgd_prev == cndp) {
+		dir->cgn_dir->cgd_prev = cndp->cgd_prev;
+	}
+	ASSERT(cndp->cgd_next != cndp);
+	ASSERT(cndp->cgd_prev != cndp);
+
+	/* cndp points to the correct directory entry */
+	namelen = strlen(cndp->cgd_name) + 1;
+
+	kmem_free(cndp, sizeof (cgrp_dirent_t) + namelen);
+	dir->cgn_size -= (sizeof (cgrp_dirent_t) + namelen);
+	dir->cgn_dirents--;
+
+	gethrestime(&now);
+	dir->cgn_mtime = now;
+	dir->cgn_ctime = now;
+	cn->cgn_ctime = now;
+
+	ASSERT(cn->cgn_nlink > 0);
+	cn->cgn_nlink--;
+	if (op == DR_RMDIR && cn->cgn_type == CG_CGROUP_DIR) {
+		cgrp_dirtrunc(cn);
+		ASSERT(cn->cgn_nlink == 0);
+	}
+	return (0);
+}
+
+/*
+ * Initialize a cgrp_node and add it to file list under mount point.
+ */
+void
+cgrp_node_init(cgrp_mnt_t *cgm, cgrp_node_t *cn, vattr_t *vap, cred_t *cred)
+{
+	struct vnode *vp;
+	timestruc_t now;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+	ASSERT(vap != NULL);
+
+	cn->cgn_mode = MAKEIMODE(vap->va_type, vap->va_mode);
+	cn->cgn_mask = 0;
+	cn->cgn_attr.va_type = vap->va_type;
+	cn->cgn_nlink = 1;
+	cn->cgn_size = 0;
+
+	if (cred == NULL) {
+		cn->cgn_uid = vap->va_uid;
+		cn->cgn_gid = vap->va_gid;
+	} else {
+		cn->cgn_uid = crgetuid(cred);
+		cn->cgn_gid = crgetgid(cred);
+	}
+
+	cn->cgn_fsid = cgm->cg_dev;
+	cn->cgn_rdev = vap->va_rdev;
+	cn->cgn_blksize = PAGESIZE;
+	cn->cgn_nblocks = 0;
+	gethrestime(&now);
+	cn->cgn_atime = now;
+	cn->cgn_mtime = now;
+	cn->cgn_ctime = now;
+	cn->cgn_seq = 0;
+	cn->cgn_dir = NULL;
+
+	cn->cgn_vnode = vn_alloc(KM_SLEEP);
+	vp = CGNTOV(cn);
+	vn_setops(vp, cgrp_vnodeops);
+	vp->v_vfsp = cgm->cg_vfsp;
+	vp->v_type = vap->va_type;
+	vp->v_rdev = vap->va_rdev;
+	vp->v_data = (caddr_t)cn;
+
+	cn->cgn_nodeid = cgm->cg_gen++;
+
+	/*
+	 * Add new cgrp_node to end of linked list of cgrp_nodes for this
+	 * cgroup fs. Root directory is handled specially in cgrp_mount.
+	 */
+	if (cgm->cg_rootnode != (cgrp_node_t *)NULL) {
+		cn->cgn_forw = NULL;
+		cn->cgn_back = cgm->cg_rootnode->cgn_back;
+		cn->cgn_back->cgn_forw = cgm->cg_rootnode->cgn_back = cn;
+	}
+	vn_exists(vp);
+}
+
+void
+cgrp_addnode(cgrp_mnt_t *cgm, cgrp_node_t *dir, char *name,
+    cgrp_nodetype_t type, struct vattr *nattr, cred_t *cr)
+{
+	cgrp_node_t *ncn;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+
+	VERIFY0(cgrp_direnter(cgm, dir, name, DE_CREATE, (cgrp_node_t *)NULL,
+	    nattr, &ncn, cr));
+
+	/*
+	 * Fix the inode and assign the pseudo file type to be correct.
+	 */
+	ncn->cgn_nodeid = cgrp_inode(type, dir->cgn_nodeid);
+	ncn->cgn_type = type;
+
+	/*
+	 * Since we're creating these entries here and not via the
+	 * normal VOP_CREATE code path, we need to do the rele to drop
+	 * our hold. This will leave the vnode v_count at 0 when we
+	 * come out of cgrp_inactive but we won't reclaim the vnode
+	 * there since the cgn_nlink value will still be 1.
+	 */
+	mutex_exit(&cgm->cg_contents);
+	cgnode_rele(ncn);
+	mutex_enter(&cgm->cg_contents);
+}
+
+/*
+ * cgrp_dirinit is used internally to initialize a directory (dir)
+ * with '.' and '..' entries without checking permissions and locking
+ * It also creates the entries for the pseudo file nodes that reside in the
+ * directory.
+ */
+void
+cgrp_dirinit(cgrp_node_t *parent, cgrp_node_t *dir, cred_t *cr)
+{
+	cgrp_dirent_t *dot, *dotdot;
+	timestruc_t now;
+	cgrp_mnt_t *cgm = VTOCGM(dir->cgn_vnode);
+	cgrp_ssde_t *ssdp;
+	cgrp_subsys_dirent_t *pseudo_files;
+	struct vattr nattr;
+	int i;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+	ASSERT(dir->cgn_type == CG_CGROUP_DIR);
+
+	ASSERT(cgm->cg_ssid > 0 && cgm->cg_ssid < CG_SSID_NUM);
+	ssdp = &cg_ssde_dir[cgm->cg_ssid];
+
+	/*
+	 * If this is the top-level cgroup created by the mount then we need to
+	 * count up the number of procs and tasks already running in the zone.
+	 */
+
+	/*
+	 * Set the cgroup ID for this cgrp_node by using a counter on each
+	 * mount.
+	 */
+	dir->cgn_id = cgm->cg_grp_gen++;
+	cgrp_cg_hash_insert(cgm, dir);
+	/* Initialise the first cgroup if this is top-level group */
+	if (parent == dir)
+		cgrp_cg_hash_init(dir);
+
+	/*
+	 * Initialize the entries
+	 */
+	dot = kmem_zalloc(sizeof (cgrp_dirent_t) + 2, KM_SLEEP);
+	dot->cgd_cgrp_node = dir;
+	dot->cgd_offset = 0;
+	dot->cgd_name = (char *)dot + sizeof (cgrp_dirent_t);
+	dot->cgd_name[0] = '.';
+	dot->cgd_parent = dir;
+	cgrp_hash_in(dot);
+
+	dotdot = kmem_zalloc(sizeof (cgrp_dirent_t) + 3, KM_SLEEP);
+	dotdot->cgd_cgrp_node = parent;
+	dotdot->cgd_offset = 1;
+	dotdot->cgd_name = (char *)dotdot + sizeof (cgrp_dirent_t);
+	dotdot->cgd_name[0] = '.';
+	dotdot->cgd_name[1] = '.';
+	dotdot->cgd_parent = dir;
+	cgrp_hash_in(dotdot);
+
+	/*
+	 * Initialize directory entry list.
+	 */
+	dot->cgd_next = dotdot;
+	dot->cgd_prev = dotdot;	/* dot's cgd_prev holds roving slot pointer */
+	dotdot->cgd_next = NULL;
+	dotdot->cgd_prev = dot;
+
+	gethrestime(&now);
+	dir->cgn_mtime = now;
+	dir->cgn_ctime = now;
+
+	parent->cgn_nlink++;
+	parent->cgn_ctime = now;
+
+	dir->cgn_dir = dot;
+	dir->cgn_size = 2 * sizeof (cgrp_dirent_t) + 5;	/* dot and dotdot */
+	dir->cgn_dirents = 2;
+	dir->cgn_nlink = 2;
+
+	bzero(&nattr, sizeof (struct vattr));
+	nattr.va_mode = (mode_t)(0644);
+	nattr.va_type = VREG;
+	nattr.va_rdev = 0;
+
+	/*
+	 * If this is the top-level dir in the file system then it always
+	 * has a release_agent pseudo file. Only the top-level dir has this
+	 * file.
+	 */
+	if (parent == dir) {
+		cgrp_addnode(cgm, dir, "release_agent", CG_REL_AGENT, &nattr,
+		    cr);
+	}
+
+	pseudo_files = ssdp->cg_ssde_files;
+	for (i = 0; i < ssdp->cg_ssde_nfiles; i++) {
+		cgrp_addnode(cgm, dir, pseudo_files[i].cgrp_ssd_name,
+		    pseudo_files[i].cgrp_ssd_type, &nattr, cr);
+	}
+}
+
+/*
+ * cgrp_dirtrunc is called to remove all directory entries under this directory.
+ */
+void
+cgrp_dirtrunc(cgrp_node_t *dir)
+{
+	cgrp_dirent_t *cgdp;
+	timestruc_t now;
+
+	ASSERT(MUTEX_HELD(&VTOCGM(dir->cgn_vnode)->cg_contents));
+	ASSERT(dir->cgn_type == CG_CGROUP_DIR);
+
+	for (cgdp = dir->cgn_dir; cgdp; cgdp = dir->cgn_dir) {
+		size_t namelen;
+		cgrp_node_t *cn;
+
+		ASSERT(cgdp->cgd_next != cgdp);
+		ASSERT(cgdp->cgd_prev != cgdp);
+		ASSERT(cgdp->cgd_cgrp_node);
+
+		dir->cgn_dir = cgdp->cgd_next;
+		namelen = strlen(cgdp->cgd_name) + 1;
+
+		/*
+		 * Adjust the link counts to account for this directory entry
+		 * removal. We do hold/rele operations to free up these nodes.
+		 */
+		cn = cgdp->cgd_cgrp_node;
+		ASSERT(cn->cgn_nlink > 0);
+		cn->cgn_nlink--;
+
+		cgrp_hash_out(cgdp);
+		kmem_free(cgdp, sizeof (cgrp_dirent_t) + namelen);
+		dir->cgn_size -= (sizeof (cgrp_dirent_t) + namelen);
+		dir->cgn_dirents--;
+	}
+
+	gethrestime(&now);
+	dir->cgn_mtime = now;
+	dir->cgn_ctime = now;
+
+	ASSERT(dir->cgn_dir == NULL);
+	ASSERT(dir->cgn_size == 0);
+	ASSERT(dir->cgn_dirents == 0);
+}
+
+static int
+cgrp_diraddentry(cgrp_node_t *dir, cgrp_node_t *cn, char *name)
+{
+	cgrp_dirent_t *cdp, *cpdp;
+	size_t		namelen, alloc_size;
+	timestruc_t	now;
+
+	/*
+	 * Make sure the parent directory wasn't removed from
+	 * underneath the caller.
+	 */
+	if (dir->cgn_dir == NULL)
+		return (ENOENT);
+
+	/* Check that everything is on the same filesystem. */
+	if (cn->cgn_vnode->v_vfsp != dir->cgn_vnode->v_vfsp)
+		return (EXDEV);
+
+	/* Allocate and initialize directory entry */
+	namelen = strlen(name) + 1;
+	alloc_size = namelen + sizeof (cgrp_dirent_t);
+	cdp = kmem_zalloc(alloc_size, KM_NOSLEEP | KM_NORMALPRI);
+	if (cdp == NULL)
+		return (ENOSPC);
+
+	cn->cgn_parent = dir;
+
+	dir->cgn_size += alloc_size;
+	dir->cgn_dirents++;
+	cdp->cgd_cgrp_node = cn;
+	cdp->cgd_parent = dir;
+
+	/* The directory entry and its name were allocated sequentially. */
+	cdp->cgd_name = (char *)cdp + sizeof (cgrp_dirent_t);
+	(void) strcpy(cdp->cgd_name, name);
+
+	cgrp_hash_in(cdp);
+
+	/*
+	 * Some utilities expect the size of a directory to remain
+	 * somewhat static.  For example, a routine which removes
+	 * subdirectories between calls to readdir(); the size of the
+	 * directory changes from underneath it and so the real
+	 * directory offset in bytes is invalid.  To circumvent
+	 * this problem, we initialize a directory entry with an
+	 * phony offset, and use this offset to determine end of
+	 * file in cgrp_readdir.
+	 */
+	cpdp = dir->cgn_dir->cgd_prev;
+	/*
+	 * Install at first empty "slot" in directory list.
+	 */
+	while (cpdp->cgd_next != NULL && (cpdp->cgd_next->cgd_offset -
+	    cpdp->cgd_offset) <= 1) {
+		ASSERT(cpdp->cgd_next != cpdp);
+		ASSERT(cpdp->cgd_prev != cpdp);
+		ASSERT(cpdp->cgd_next->cgd_offset > cpdp->cgd_offset);
+		cpdp = cpdp->cgd_next;
+	}
+	cdp->cgd_offset = cpdp->cgd_offset + 1;
+
+	/*
+	 * If we're at the end of the dirent list and the offset (which
+	 * is necessarily the largest offset in this directory) is more
+	 * than twice the number of dirents, that means the directory is
+	 * 50% holes.  At this point we reset the slot pointer back to
+	 * the beginning of the directory so we start using the holes.
+	 * The idea is that if there are N dirents, there must also be
+	 * N holes, so we can satisfy the next N creates by walking at
+	 * most 2N entries; thus the average cost of a create is constant.
+	 * Note that we use the first dirent's cgd_prev as the roving
+	 * slot pointer; it's ugly, but it saves a word in every dirent.
+	 */
+	if (cpdp->cgd_next == NULL && cpdp->cgd_offset > 2 * dir->cgn_dirents)
+		dir->cgn_dir->cgd_prev = dir->cgn_dir->cgd_next;
+	else
+		dir->cgn_dir->cgd_prev = cdp;
+
+	ASSERT(cpdp->cgd_next != cpdp);
+	ASSERT(cpdp->cgd_prev != cpdp);
+
+	cdp->cgd_next = cpdp->cgd_next;
+	if (cdp->cgd_next) {
+		cdp->cgd_next->cgd_prev = cdp;
+	}
+	cdp->cgd_prev = cpdp;
+	cpdp->cgd_next = cdp;
+
+	ASSERT(cdp->cgd_next != cdp);
+	ASSERT(cdp->cgd_prev != cdp);
+	ASSERT(cpdp->cgd_next != cpdp);
+	ASSERT(cpdp->cgd_prev != cpdp);
+
+	gethrestime(&now);
+	dir->cgn_mtime = now;
+	dir->cgn_ctime = now;
+
+	return (0);
+}
+
+static int
+cgrp_dirmakecgnode(cgrp_node_t *dir, cgrp_mnt_t *cgm, struct vattr *va,
+    enum de_op op, cgrp_node_t **newnode, struct cred *cred)
+{
+	cgrp_node_t *cn;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+	ASSERT(va != NULL);
+
+	if (((va->va_mask & AT_ATIME) && TIMESPEC_OVERFLOW(&va->va_atime)) ||
+	    ((va->va_mask & AT_MTIME) && TIMESPEC_OVERFLOW(&va->va_mtime)))
+		return (EOVERFLOW);
+
+	cn = kmem_zalloc(sizeof (cgrp_node_t), KM_SLEEP);
+	cgrp_node_init(cgm, cn, va, cred);
+
+	cn->cgn_vnode->v_rdev = cn->cgn_rdev = NODEV;
+	cn->cgn_vnode->v_type = va->va_type;
+	cn->cgn_uid = crgetuid(cred);
+	cn->cgn_gid = crgetgid(cred);
+
+	if (va->va_mask & AT_ATIME)
+		cn->cgn_atime = va->va_atime;
+	if (va->va_mask & AT_MTIME)
+		cn->cgn_mtime = va->va_mtime;
+
+	if (op == DE_MKDIR) {
+		cn->cgn_type = CG_CGROUP_DIR;
+		cgrp_dirinit(dir, cn, cred);
+	}
+
+	*newnode = cn;
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/cgroups/cgrps_vfsops.c b/usr/src/uts/common/brand/lx/cgroups/cgrps_vfsops.c
new file mode 100644
index 0000000000..7805c3f2bd
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/cgroups/cgrps_vfsops.c
@@ -0,0 +1,1071 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * The cgroup file system implements a subset of the Linux cgroup functionality
+ * for use by lx-branded zones. On Linux, cgroups are a generic process grouping
+ * mechanism which is used to apply various behaviors to the processes within
+ * the group, although it's primary purpose is for resource management.
+ *
+ * In Linux, the cgroup file system provides two pieces of functionality:
+ * 1) A per-mount set of cgroups arranged in a tree, such that every task in
+ *    the system is in one, and only one, of the cgroups in the tree.
+ * 2) A set of subsystems; each subsystem has subsystem-specific state and
+ *    behavior and is associated with a cgroup mount. This provides a way to
+ *    apply arbitrary functionality (but generally resource management related)
+ *    to the processes associated with the nodes in the tree at that mount
+ *    point.
+ *
+ * For example, it is common to see cgroup trees (each is its own mount with a
+ * different subsystem controller) for blkio, cpuset, memory, systemd (has no
+ * controller), etc. Within each tree there is a top-level directory with at
+ * least a cgroup.procs, notify_on_release, release_agent, and tasks file.
+ * The cgroup.procs file lists the processes within that group and the tasks
+ * file lists the threads in the group. There could be subdirectories, which
+ * define new cgroups, that then contain a subset of the processes. Each
+ * subdirectory also has, at a minimum, a cgroup.procs, notify_on_release, and
+ * tasks file.
+ *
+ * Since we're using lx to run user-level code within zones, the majority (all?)
+ * of the cgroup resource management functionality simply doesn't apply to us.
+ * The primary need for cgroups is to support the init program 'systemd' as the
+ * consumer. systemd only requires the process grouping hierarchy of cgroups,
+ * although it can also use the resource management features if they are
+ * available. Given this, our cgroup file system only implements the process
+ * hierarchy and does not report that any resource management controllers are
+ * available for separate mounts.
+ *
+ * In addition to the hierarchy, the other important component of cgroups that
+ * is used by systemd is the 'release_agent'. This provides a mechanism to
+ * run a command when a cgroup becomes empty (the last task in the group
+ * leaves, either by exit or move, and there are no more sub-cgroups). The
+ * 'release_agent' file only exists in the top-level cgroup of the mounted
+ * file system and holds the path to a command to run. The 'notify_on_release'
+ * file exists in each cgroup dir. If that file contains a '1' then the agent
+ * is run when that group becomes empty. The agent is passed a path string of
+ * the cgroup, relative to the file system mount point (e.g. a mount on
+ * /sys/fs/cgroups/systemd with a sub-cgroup of /sys/fs/cgroups/systemd/foo/bar
+ * gets the arg /foo/bar).
+ *
+ * Cgroup membership is implemented via hooks into the lx brand code. When
+ * the cgroup file system loads it installs callbacks for:
+ *    lx_cgrp_initlwp
+ *    lx_cgrp_freelwp
+ * and when it unloads it clears those hooks. The lx brand code calls those
+ * hooks when a lwp starts and when it exits. Internally we use a
+ * simple reference counter (cgn_task_cnt) on the cgroup node to track how many
+ * threads are in the group, so we can tell when a group becomes empty.
+ * To make this quick, a hash table (cg_grp_hash) is maintained on the
+ * cgrp_mnt_t struct to allow quick lookups by cgroup ID. The hash table is
+ * sized so that there should typically only be 0 or 1 cgroups per bucket.
+ * We also keep a reference to the file system in the zone-specific brand data
+ * (lxzd_cgroup) so that the lx brand code can pass in the correct vfs_t
+ * when it runs the hook.
+ *
+ * Once a cgroup is about to become empty, the final process exiting the cgroup
+ * will launch a new user-level process which execs the release agent. The new
+ * process is created as a child of zsched (indicated by the -1 pid argument
+ * to newproc) and is not associated with the exiting process in any way.
+ *
+ * This file system is similar to tmpfs in that directories only exist in
+ * memory. Each subdirectory represents a different cgroup. Within the cgroup
+ * there are pseudo files (see cg_ssde_dir) with well-defined names which
+ * control the configuration and behavior of the cgroup (see cgrp_nodetype_t).
+ * The primary files within every cgroup are named 'cgroup.procs',
+ * 'notify_on_release', and 'tasks' (as well as 'release_agent' in the
+ * top-level cgroup). The cgroup.procs and tasks files are used to control and
+ * list which processes/threads belong to the cgroup. In the general case there
+ * could be additional files in the cgroup, which defined additional behavior
+ * (i.e. subsystem specific pseudo files), although none exist at this time.
+ *
+ * Each cgroup node has a unique ID (cgn_nodeid) within the mount. This ID is
+ * used to correlate with the threads to determine cgroup membership. When
+ * assigning a PID to a cgroup (via write) the code updates the br_cgroupid
+ * member in the brand-specific lx_lwp_data structure to control which cgroup
+ * the thread belongs to. Note that because the br_cgroupid lives in
+ * lx_lwp_data, native processes will not appear in the cgroup hierarchy.
+ *
+ * An overview of the behavior for the various vnode operations is:
+ * - no hardlinks or symlinks
+ * - no file create (the subsystem-specific files are a fixed list of
+ *   pseudo-files accessible within the directory)
+ * - no file remove
+ * - no file rename, but a directory (i.e. a cgroup) can be renamed within the
+ *   containing directory, but not into a different directory
+ * - can mkdir and rmdir to create/destroy cgroups
+ * - cannot rmdir while it contains tasks or a subdir (i.e. a sub-cgroup)
+ * - open, read/write, close on the subsytem-specific pseudo files is
+ *   allowed, as this is the interface to configure and report on the cgroup.
+ *   The pseudo file's mode controls write access and cannot be changed.
+ *
+ * The locking in this file system is simple since the file system is not
+ * subjected to heavy I/O activity and all data is in-memory. There is a single
+ * global mutex for each mount (cg_contents). This mutex is held for the life
+ * of most vnode operations. The most active path is probably the LWP start and
+ * exit hooks which increment/decrement the reference counter on the cgroup
+ * node. The lock is important for this case since we don't want concurrent
+ * activity (such as moving the process into another cgroup) while we're trying
+ * to lookup the cgroup from the mount's hash table. We must be careful to
+ * avoid a deadlock while reading or writing since that code can take pidlock
+ * and p_lock, but the cgrp_lwp_fork_helper can also be called while one of
+ * those is held. To prevent deadlock we always take cg_contents after pidlock
+ * and p_lock.
+ *
+ * EXTENDING THE FILE SYSTEM
+ *
+ * When adding support for a new subsystem, be sure to also update the
+ * lxpr_read_cgroups function in lx_procfs so that the subsystem is reported
+ * by proc.
+ *
+ * Although we don't currently support any subsystem controllers, the design
+ * allows for the file system to be extended to add controller emulation
+ * if needed. New controller IDs (i.e. different subsystems) for a mount can
+ * be defined in the cgrp_ssid_t enum (e.g. CG_SSID_CPUSET or CG_SSID_MEMORY)
+ * and new node types for additional pseudo files in the tree can be defined in
+ * the cgrp_nodetype_t enum (e.g. CG_CPUSET_CPUS or CG_MEMORY_USAGE_IN_BYTES).
+ * The cg_ssde_dir array would need a new entry for the new subsystem to
+ * control which nodes are visible in a directory for the new subsystem.
+ *
+ * New emulation would then need to be written to manage the behavior on the
+ * new pseudo file(s) associated with new cgrp_nodetype_t types.
+ *
+ * Within lx procfs the lxpr_read_pid_cgroup() function would need to be
+ * updated so that it reported the various subsystems used by the different
+ * mounts.
+ *
+ * In addition, in order to support more than one cgroup mount we would need a
+ * list of cgroup IDs associated with every thread, instead of just one ID
+ * (br_cgroupid). The thread data would need to become a struct which held
+ * both an ID and an indication as to which mounted cgroup file system instance
+ * the ID was associated with. We would also need a list of cgroup mounts per
+ * zone, instead the current single zone reference.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/kmem.h>
+#include <sys/time.h>
+#include <sys/pathname.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/stat.h>
+#include <sys/errno.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/statvfs.h>
+#include <sys/mount.h>
+#include <sys/systm.h>
+#include <sys/mntent.h>
+#include <sys/policy.h>
+#include <sys/sdt.h>
+#include <sys/ddi.h>
+#include <sys/vmparam.h>
+#include <sys/corectl.h>
+#include <sys/contract_impl.h>
+#include <sys/pool.h>
+#include <sys/stack.h>
+#include <sys/rt.h>
+#include <sys/fx.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+
+#include "cgrps.h"
+
+/* Module level parameters */
+static int	cgrp_fstype;
+static dev_t	cgrp_dev;
+
+#define	MAX_AGENT_EVENTS	32		/* max num queued events */
+
+#define	UMNT_DELAY_TIME	drv_usectohz(50000)	/* 500th of a second */
+#define	UMNT_RETRY_MAX	100			/* 100 times - 2 secs */
+
+/*
+ * cgrp_mountcount is used to prevent module unloads while there is still
+ * state from a former mount hanging around. The filesystem module must not be
+ * allowed to go away before the last VFS_FREEVFS() call has been made. Since
+ * this is just an atomic counter, there's no need for locking.
+ */
+static uint32_t cgrp_mountcount;
+
+/*
+ * cgrp_minfree is the minimum amount of swap space that cgroups leaves for
+ * the rest of the zone. In other words, if the amount of free swap space
+ * in the zone drops below cgrp_minfree, cgroup anon allocations will fail.
+ * This number is only likely to become factor when DRAM and swap have both
+ * been capped low to allow for maximum tenancy.
+ */
+size_t cgrp_minfree = 0;
+
+/*
+ * CGMINFREE -- the value from which cgrp_minfree is derived -- should be
+ * configured to a value that is roughly the smallest practical value for
+ * memory + swap minus the largest reasonable size for cgroups in such
+ * a configuration. As of this writing, the smallest practical memory + swap
+ * configuration is 128MB, and it seems reasonable to allow cgroups to consume
+ * no more than half of this, yielding a CGMINFREE of 64MB.
+ */
+#define	CGMINFREE	64 * 1024 * 1024	/* 64 Megabytes */
+
+extern pgcnt_t swapfs_minfree;
+
+/*
+ * cgroup vfs operations.
+ */
+static int cgrp_init(int, char *);
+static int cgrp_mount(struct vfs *, struct vnode *,
+	struct mounta *, struct cred *);
+static int cgrp_unmount(struct vfs *, int, struct cred *);
+static int cgrp_root(struct vfs *, struct vnode **);
+static int cgrp_statvfs(struct vfs *, struct statvfs64 *);
+static void cgrp_freevfs(vfs_t *vfsp);
+
+/* Forward declarations for hooks */
+static void cgrp_lwp_fork_helper(vfs_t *, uint_t, id_t, pid_t);
+static void cgrp_lwp_exit_helper(vfs_t *, uint_t, id_t, pid_t);
+
+/*
+ * Loadable module wrapper
+ */
+#include <sys/modctl.h>
+
+static vfsdef_t vfw = {
+	VFSDEF_VERSION,
+	"lx_cgroup",
+	cgrp_init,
+	VSW_ZMOUNT,
+	NULL
+};
+
+/*
+ * Module linkage information
+ */
+static struct modlfs modlfs = {
+	&mod_fsops, "lx brand cgroups", &vfw
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, &modlfs, NULL
+};
+
+int
+_init()
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_fini()
+{
+	int error;
+
+	if (cgrp_mountcount)
+		return (EBUSY);
+
+	if ((error = mod_remove(&modlinkage)) != 0)
+		return (error);
+
+	/* Disable hooks used by the lx brand module. */
+	lx_cgrp_initlwp = NULL;
+	lx_cgrp_freelwp = NULL;
+
+	/*
+	 * Tear down the operations vectors
+	 */
+	(void) vfs_freevfsops_by_type(cgrp_fstype);
+	vn_freevnodeops(cgrp_vnodeops);
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+/*
+ * Initialize global locks, etc. Called when loading cgroup module.
+ */
+static int
+cgrp_init(int fstype, char *name)
+{
+	static const fs_operation_def_t cgrp_vfsops_template[] = {
+		VFSNAME_MOUNT,		{ .vfs_mount = cgrp_mount },
+		VFSNAME_UNMOUNT,	{ .vfs_unmount = cgrp_unmount },
+		VFSNAME_ROOT,		{ .vfs_root = cgrp_root },
+		VFSNAME_STATVFS,	{ .vfs_statvfs = cgrp_statvfs },
+		VFSNAME_FREEVFS,	{ .vfs_freevfs = cgrp_freevfs },
+		NULL,			NULL
+	};
+	extern const struct fs_operation_def cgrp_vnodeops_template[];
+	int error;
+	extern  void    cgrp_hash_init();
+	major_t dev;
+
+	cgrp_hash_init();
+	cgrp_fstype = fstype;
+	ASSERT(cgrp_fstype != 0);
+
+	error = vfs_setfsops(fstype, cgrp_vfsops_template, NULL);
+	if (error != 0) {
+		cmn_err(CE_WARN, "cgrp_init: bad vfs ops template");
+		return (error);
+	}
+
+	error = vn_make_ops(name, cgrp_vnodeops_template, &cgrp_vnodeops);
+	if (error != 0) {
+		(void) vfs_freevfsops_by_type(fstype);
+		cmn_err(CE_WARN, "cgrp_init: bad vnode ops template");
+		return (error);
+	}
+
+	/*
+	 * cgrp_minfree doesn't need to be some function of configured
+	 * swap space since it really is an absolute limit of swap space
+	 * which still allows other processes to execute.
+	 */
+	if (cgrp_minfree == 0) {
+		/* Set if not patched */
+		cgrp_minfree = btopr(CGMINFREE);
+	}
+
+	if ((dev = getudev()) == (major_t)-1) {
+		cmn_err(CE_WARN, "cgrp_init: Can't get unique device number.");
+		dev = 0;
+	}
+
+	/*
+	 * Make the pseudo device
+	 */
+	cgrp_dev = makedevice(dev, 0);
+
+	/* Install the hooks used by the lx brand module. */
+	lx_cgrp_initlwp = cgrp_lwp_fork_helper;
+	lx_cgrp_freelwp = cgrp_lwp_exit_helper;
+
+	return (0);
+}
+
+static int
+cgrp_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
+{
+	cgrp_mnt_t *cgm = NULL;
+	struct cgrp_node *cp;
+	struct pathname dpn;
+	int error;
+	struct vattr rattr;
+	cgrp_ssid_t ssid = CG_SSID_GENERIC;
+	lx_zone_data_t *lxzdata;
+
+	if ((error = secpolicy_fs_mount(cr, mvp, vfsp)) != 0)
+		return (error);
+
+	if (mvp->v_type != VDIR)
+		return (ENOTDIR);
+
+	/*
+	 * Since we depend on per-thread lx brand data, only allow mounting
+	 * within lx zones.
+	 */
+	if (curproc->p_zone->zone_brand != &lx_brand)
+		return (EINVAL);
+
+	/*
+	 * Ensure we don't allow overlaying mounts
+	 */
+	mutex_enter(&mvp->v_lock);
+	if ((uap->flags & MS_OVERLAY) == 0 &&
+	    (mvp->v_count > 1 || (mvp->v_flag & VROOT))) {
+		mutex_exit(&mvp->v_lock);
+		return (EBUSY);
+	}
+	mutex_exit(&mvp->v_lock);
+
+	/*
+	 * Having the resource be anything but "swap" doesn't make sense.
+	 */
+	vfs_setresource(vfsp, "swap", 0);
+
+	/* cgroups don't support read-only mounts */
+	if (vfs_optionisset(vfsp, MNTOPT_RO, NULL)) {
+		error = EINVAL;
+		goto out;
+	}
+
+	/*
+	 * Here is where we could support subsystem-specific controller
+	 * mounting. For example, if mounting a cgroup fs with the 'cpuset'
+	 * option to specify that particular controller.
+	 *
+	 * char *argstr;
+	 * if (vfs_optionisset(vfsp, "cpuset", &argstr)) {
+	 *	if (ssid != CG_SSID_GENERIC) {
+	 *		error = EINVAL;
+	 *		goto out;
+	 *	}
+	 *	ssid = CG_SSID_CPUSET;
+	 * }
+	 */
+
+	error = pn_get(uap->dir,
+	    (uap->flags & MS_SYSSPACE) ? UIO_SYSSPACE : UIO_USERSPACE, &dpn);
+	if (error != 0)
+		goto out;
+
+	/*
+	 * We currently only support one mount per zone.
+	 */
+	lxzdata = ztolxzd(curproc->p_zone);
+	mutex_enter(&lxzdata->lxzd_lock);
+	if (lxzdata->lxzd_cgroup != NULL) {
+		mutex_exit(&lxzdata->lxzd_lock);
+		return (EINVAL);
+	}
+
+	cgm = kmem_zalloc(sizeof (*cgm), KM_SLEEP);
+
+	/* Set but don't bother entering the mutex (not on mount list yet) */
+	mutex_init(&cgm->cg_contents, NULL, MUTEX_DEFAULT, NULL);
+
+	cgm->cg_vfsp = lxzdata->lxzd_cgroup = vfsp;
+	mutex_exit(&lxzdata->lxzd_lock);
+
+	cgm->cg_lxzdata = lxzdata;
+	cgm->cg_ssid = ssid;
+
+	vfsp->vfs_data = (caddr_t)cgm;
+	vfsp->vfs_fstype = cgrp_fstype;
+	vfsp->vfs_dev = cgrp_dev;
+	vfsp->vfs_bsize = PAGESIZE;
+	vfsp->vfs_flag |= VFS_NOTRUNC;
+	vfs_make_fsid(&vfsp->vfs_fsid, cgrp_dev, cgrp_fstype);
+	cgm->cg_mntpath = kmem_zalloc(dpn.pn_pathlen + 1, KM_SLEEP);
+	(void) strcpy(cgm->cg_mntpath, dpn.pn_path);
+
+	cgm->cg_grp_hash = kmem_zalloc(sizeof (cgrp_node_t *) * CGRP_HASH_SZ,
+	    KM_SLEEP);
+
+	/* allocate and initialize root cgrp_node structure */
+	bzero(&rattr, sizeof (struct vattr));
+	rattr.va_mode = (mode_t)(S_IFDIR | 0755);
+	rattr.va_type = VDIR;
+	rattr.va_rdev = 0;
+	cp = kmem_zalloc(sizeof (struct cgrp_node), KM_SLEEP);
+
+	mutex_enter(&cgm->cg_contents);
+	cgrp_node_init(cgm, cp, &rattr, cr);
+
+	CGNTOV(cp)->v_flag |= VROOT;
+
+	/*
+	 * initialize linked list of cgrp_nodes so that the back pointer of
+	 * the root cgrp_node always points to the last one on the list
+	 * and the forward pointer of the last node is null
+	 */
+	cp->cgn_back = cp;
+	cp->cgn_forw = NULL;
+	cp->cgn_nlink = 0;
+	cgm->cg_rootnode = cp;
+
+	cp->cgn_type = CG_CGROUP_DIR;
+	cp->cgn_nodeid = cgrp_inode(CG_CGROUP_DIR, cgm->cg_gen);
+
+	/*
+	 * This initial cgrp_node will have an ID of 0. All existing processes
+	 * inside the zone will have been started with, or inherited, a
+	 * br_cgroupid of 0. The cgrp_cg_hash_init function will initialize the
+	 * cgn_task_cnt for cgroup 0 to reflect the number of tasks already in
+	 * the group.
+	 *
+	 * Because we must hold cg_contents in cgrp_lwp_fork_helper and
+	 * cgrp_lwp_exit_helper, no process can be creating or exiting another
+	 * thread (although that is unlikely anyway since the cgroup filesystem
+	 * is normally mounted at the start of zone bootup, before anything
+	 * else is started).
+	 */
+	cgrp_dirinit(cp, cp, cr);
+
+	mutex_exit(&cgm->cg_contents);
+
+	pn_free(&dpn);
+	error = 0;
+	atomic_inc_32(&cgrp_mountcount);
+
+out:
+	if (error == 0)
+		vfs_set_feature(vfsp, VFSFT_SYSATTR_VIEWS);
+
+	return (error);
+}
+
+static int
+cgrp_unmount(struct vfs *vfsp, int flag, struct cred *cr)
+{
+	cgrp_mnt_t *cgm = (cgrp_mnt_t *)VFSTOCGM(vfsp);
+	cgrp_node_t *cgnp, *cancel;
+	struct vnode	*vp;
+	int error;
+	uint_t cnt;
+	int retry_cnt = 0;
+
+	if ((error = secpolicy_fs_unmount(cr, vfsp)) != 0)
+		return (error);
+
+retry:
+	mutex_enter(&cgm->cg_contents);
+
+	/*
+	 * In the normal unmount case, if there were no open files, only the
+	 * root node would have a reference count. However, the user-level
+	 * agent manager should have the root vnode open and be waiting in
+	 * ioctl. We need to wake the manager and it may take some retries
+	 * before it closes its file descriptor.
+	 *
+	 * With cg_contents held, nothing can be added or removed.
+	 * There may be some dirty pages.  To prevent fsflush from
+	 * disrupting the unmount, put a hold on each node while scanning.
+	 * If we find a previously referenced node, undo the holds we have
+	 * placed and fail EBUSY.
+	 */
+	cgnp = cgm->cg_rootnode;
+
+	ASSERT(cgm->cg_lxzdata->lxzd_cgroup != NULL);
+
+	vp = CGNTOV(cgnp);
+	mutex_enter(&vp->v_lock);
+
+	if (flag & MS_FORCE) {
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&cgm->cg_contents);
+		return (EINVAL);
+	}
+
+
+	cnt = vp->v_count;
+	if (cnt > 1) {
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&cgm->cg_contents);
+		/* Likely because the user-level manager hasn't exited yet */
+		if (retry_cnt++ < UMNT_RETRY_MAX) {
+			delay(UMNT_DELAY_TIME);
+			goto retry;
+		}
+		return (EBUSY);
+	}
+
+	mutex_exit(&vp->v_lock);
+
+	/*
+	 * Check for open files. An open file causes everything to unwind.
+	 */
+	for (cgnp = cgnp->cgn_forw; cgnp; cgnp = cgnp->cgn_forw) {
+		vp = CGNTOV(cgnp);
+		mutex_enter(&vp->v_lock);
+		cnt = vp->v_count;
+		if (cnt > 0) {
+			/* An open file; unwind the holds we've been adding. */
+			mutex_exit(&vp->v_lock);
+			cancel = cgm->cg_rootnode->cgn_forw;
+			while (cancel != cgnp) {
+				vp = CGNTOV(cancel);
+				ASSERT(vp->v_count > 0);
+				VN_RELE(vp);
+				cancel = cancel->cgn_forw;
+			}
+			mutex_exit(&cgm->cg_contents);
+			return (EBUSY);
+		} else {
+			/* directly add a VN_HOLD since we have the lock */
+			vp->v_count++;
+			mutex_exit(&vp->v_lock);
+		}
+	}
+
+	mutex_enter(&cgm->cg_lxzdata->lxzd_lock);
+	cgm->cg_lxzdata->lxzd_cgroup = NULL;
+	mutex_exit(&cgm->cg_lxzdata->lxzd_lock);
+	kmem_free(cgm->cg_grp_hash, sizeof (cgrp_node_t *) * CGRP_HASH_SZ);
+
+	/*
+	 * We can drop the mutex now because
+	 * no one can find this mount anymore
+	 */
+	vfsp->vfs_flag |= VFS_UNMOUNTED;
+	mutex_exit(&cgm->cg_contents);
+
+	return (0);
+}
+
+/*
+ * Implementation of VFS_FREEVFS(). This is called by the vfs framework after
+ * umount and the last VFS_RELE, to trigger the release of any resources still
+ * associated with the given vfs_t. This is normally called immediately after
+ * cgrp_umount.
+ */
+void
+cgrp_freevfs(vfs_t *vfsp)
+{
+	cgrp_mnt_t *cgm = (cgrp_mnt_t *)VFSTOCGM(vfsp);
+	cgrp_node_t *cn;
+	struct vnode	*vp;
+
+	/*
+	 * Free all kmemalloc'd and anonalloc'd memory associated with
+	 * this filesystem.  To do this, we go through the file list twice,
+	 * once to remove all the directory entries, and then to remove
+	 * all the pseudo files.
+	 */
+
+	/*
+	 * Now that we are tearing ourselves down we need to remove the
+	 * UNMOUNTED flag. If we don't, we'll later hit a VN_RELE when we remove
+	 * files from the system causing us to have a negative value. Doing this
+	 * seems a bit better than trying to set a flag on the tmount that says
+	 * we're tearing down.
+	 */
+	vfsp->vfs_flag &= ~VFS_UNMOUNTED;
+
+	/*
+	 * Remove all directory entries
+	 */
+	for (cn = cgm->cg_rootnode; cn; cn = cn->cgn_forw) {
+		mutex_enter(&cgm->cg_contents);
+		if (cn->cgn_type == CG_CGROUP_DIR)
+			cgrp_dirtrunc(cn);
+		mutex_exit(&cgm->cg_contents);
+	}
+
+	ASSERT(cgm->cg_rootnode);
+
+	/*
+	 * All links are gone, v_count is keeping nodes in place.
+	 * VN_RELE should make the node disappear, unless somebody
+	 * is holding pages against it.  Nap and retry until it disappears.
+	 *
+	 * We re-acquire the lock to prevent others who have a HOLD on
+	 * a cgrp_node via its pages or anon slots from blowing it away
+	 * (in cgrp_inactive) while we're trying to get to it here. Once
+	 * we have a HOLD on it we know it'll stick around.
+	 *
+	 */
+	mutex_enter(&cgm->cg_contents);
+
+	/* Remove all the files (except the rootnode) backwards. */
+	while ((cn = cgm->cg_rootnode->cgn_back) != cgm->cg_rootnode) {
+		mutex_exit(&cgm->cg_contents);
+		/*
+		 * All nodes will be released here. Note we handled the link
+		 * count above.
+		 */
+		vp = CGNTOV(cn);
+		VN_RELE(vp);
+		mutex_enter(&cgm->cg_contents);
+		/*
+		 * It's still there after the RELE. Someone else like pageout
+		 * has a hold on it so wait a bit and then try again - we know
+		 * they'll give it up soon.
+		 */
+		if (cn == cgm->cg_rootnode->cgn_back) {
+			VN_HOLD(vp);
+			mutex_exit(&cgm->cg_contents);
+			delay(hz / 4);
+			mutex_enter(&cgm->cg_contents);
+		}
+	}
+	mutex_exit(&cgm->cg_contents);
+
+	VN_RELE(CGNTOV(cgm->cg_rootnode));
+
+	ASSERT(cgm->cg_mntpath);
+
+	kmem_free(cgm->cg_mntpath, strlen(cgm->cg_mntpath) + 1);
+
+	mutex_destroy(&cgm->cg_contents);
+	kmem_free(cgm, sizeof (cgrp_mnt_t));
+
+	/* Allow _fini() to succeed now */
+	atomic_dec_32(&cgrp_mountcount);
+}
+
+/*
+ * return root cgnode for given vnode
+ */
+static int
+cgrp_root(struct vfs *vfsp, struct vnode **vpp)
+{
+	cgrp_mnt_t *cgm = (cgrp_mnt_t *)VFSTOCGM(vfsp);
+	cgrp_node_t *cp = cgm->cg_rootnode;
+	struct vnode *vp;
+
+	ASSERT(cp);
+
+	vp = CGNTOV(cp);
+	VN_HOLD(vp);
+	*vpp = vp;
+	return (0);
+}
+
+static int
+cgrp_statvfs(struct vfs *vfsp, struct statvfs64 *sbp)
+{
+	cgrp_mnt_t *cgm = (cgrp_mnt_t *)VFSTOCGM(vfsp);
+	ulong_t	blocks;
+	dev32_t d32;
+	zoneid_t eff_zid;
+	struct zone *zp;
+
+	zp = cgm->cg_vfsp->vfs_zone;
+
+	if (zp == NULL)
+		eff_zid = GLOBAL_ZONEUNIQID;
+	else
+		eff_zid = zp->zone_id;
+
+	sbp->f_bsize = PAGESIZE;
+	sbp->f_frsize = PAGESIZE;
+
+	/*
+	 * Find the amount of available physical and memory swap
+	 */
+	mutex_enter(&anoninfo_lock);
+	ASSERT(k_anoninfo.ani_max >= k_anoninfo.ani_phys_resv);
+	blocks = (ulong_t)CURRENT_TOTAL_AVAILABLE_SWAP;
+	mutex_exit(&anoninfo_lock);
+
+	if (blocks > cgrp_minfree)
+		sbp->f_bfree = blocks - cgrp_minfree;
+	else
+		sbp->f_bfree = 0;
+
+	sbp->f_bavail = sbp->f_bfree;
+
+	/*
+	 * Total number of blocks is just what's available
+	 */
+	sbp->f_blocks = (fsblkcnt64_t)(sbp->f_bfree);
+
+	if (eff_zid != GLOBAL_ZONEUNIQID &&
+	    zp->zone_max_swap_ctl != UINT64_MAX) {
+		/*
+		 * If the fs is used by a zone with a swap cap,
+		 * then report the capped size.
+		 */
+		rctl_qty_t cap, used;
+		pgcnt_t pgcap, pgused;
+
+		mutex_enter(&zp->zone_mem_lock);
+		cap = zp->zone_max_swap_ctl;
+		used = zp->zone_max_swap;
+		mutex_exit(&zp->zone_mem_lock);
+
+		pgcap = btop(cap);
+		pgused = btop(used);
+
+		sbp->f_bfree = MIN(pgcap - pgused, sbp->f_bfree);
+		sbp->f_bavail = sbp->f_bfree;
+		sbp->f_blocks = MIN(pgcap, sbp->f_blocks);
+	}
+
+	/*
+	 * The maximum number of files available is approximately the number
+	 * of cgrp_nodes we can allocate from the remaining kernel memory
+	 * available to cgroups.  This is fairly inaccurate since it doesn't
+	 * take into account the names stored in the directory entries.
+	 */
+	sbp->f_ffree = sbp->f_files = ptob(availrmem) /
+	    (sizeof (cgrp_node_t) + sizeof (cgrp_dirent_t));
+	sbp->f_favail = (fsfilcnt64_t)(sbp->f_ffree);
+	(void) cmpldev(&d32, vfsp->vfs_dev);
+	sbp->f_fsid = d32;
+	(void) strcpy(sbp->f_basetype, vfssw[cgrp_fstype].vsw_name);
+	(void) strncpy(sbp->f_fstr, cgm->cg_mntpath, sizeof (sbp->f_fstr));
+	/* ensure null termination */
+	sbp->f_fstr[sizeof (sbp->f_fstr) - 1] = '\0';
+	sbp->f_flag = vf_to_stf(vfsp->vfs_flag);
+	sbp->f_namemax = MAXNAMELEN - 1;
+	return (0);
+}
+
+static int
+cgrp_get_dirname(cgrp_node_t *cn, char *buf, int blen)
+{
+	cgrp_node_t *parent;
+	cgrp_dirent_t *dp;
+
+	buf[0] = '\0';
+
+	parent = cn->cgn_parent;
+	if (parent == NULL || parent == cn) {
+		(void) strlcpy(buf, ".", blen);
+		return (0);
+	}
+
+	/*
+	 * Search the parent dir list to find this cn's name.
+	 */
+	for (dp = parent->cgn_dir; dp != NULL; dp = dp->cgd_next) {
+		if (dp->cgd_cgrp_node->cgn_id == cn->cgn_id) {
+			(void) strlcpy(buf, dp->cgd_name, blen);
+			return (0);
+		}
+	}
+
+	return (-1);
+}
+
+typedef struct cgrp_rra_arg {
+	char *crraa_agent_path;
+	char *crraa_event_path;
+} cgrp_rra_arg_t;
+
+static void
+cgrp_run_rel_agent(void *a)
+{
+	cgrp_rra_arg_t *rarg = a;
+	proc_t *p = ttoproc(curthread);
+	zone_t *z = p->p_zone;
+	struct core_globals *cg;
+	int res;
+
+	ASSERT(!INGLOBALZONE(curproc));
+
+	/* The following block is derived from start_init_common */
+	ASSERT_STACK_ALIGNED();
+
+	p->p_cstime = p->p_stime = p->p_cutime = p->p_utime = 0;
+	p->p_usrstack = (caddr_t)USRSTACK32;
+	p->p_model = DATAMODEL_ILP32;
+	p->p_stkprot = PROT_ZFOD & ~PROT_EXEC;
+	p->p_datprot = PROT_ZFOD & ~PROT_EXEC;
+	p->p_stk_ctl = INT32_MAX;
+
+	p->p_as = as_alloc();
+	p->p_as->a_proc = p;
+	p->p_as->a_userlimit = (caddr_t)USERLIMIT32;
+	(void) hat_setup(p->p_as->a_hat, HAT_INIT);
+
+	VERIFY((cg = zone_getspecific(core_zone_key, z)) != NULL);
+
+	corectl_path_hold(cg->core_default_path);
+	corectl_content_hold(cg->core_default_content);
+
+	curproc->p_corefile = cg->core_default_path;
+	curproc->p_content = cg->core_default_content;
+
+	init_mstate(curthread, LMS_SYSTEM);
+	res = exec_init(rarg->crraa_agent_path, rarg->crraa_event_path);
+
+	/* End of code derived from start_init_common */
+
+	kmem_free(rarg->crraa_event_path, MAXPATHLEN);
+	kmem_free(rarg->crraa_agent_path, CGRP_AGENT_LEN);
+	kmem_free(rarg, sizeof (cgrp_rra_arg_t));
+
+	/* The following is derived from zone_start_init - see comments there */
+	if (res != 0 || zone_status_get(global_zone) >= ZONE_IS_SHUTTING_DOWN) {
+		if (proc_exit(CLD_EXITED, res) != 0) {
+			mutex_enter(&p->p_lock);
+			ASSERT(p->p_flag & SEXITLWPS);
+			lwp_exit();
+		}
+	} else {
+		id_t cid = curthread->t_cid;
+
+		mutex_enter(&class_lock);
+		ASSERT(cid < loaded_classes);
+		if (strcmp(sclass[cid].cl_name, "FX") == 0 &&
+		    z->zone_fixed_hipri) {
+			pcparms_t pcparms;
+
+			pcparms.pc_cid = cid;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_upri = FXMAXUPRI;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_uprilim =
+			    FXMAXUPRI;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_cflags =
+			    FX_DOUPRILIM | FX_DOUPRI;
+
+			mutex_enter(&pidlock);
+			mutex_enter(&curproc->p_lock);
+			(void) parmsset(&pcparms, curthread);
+			mutex_exit(&curproc->p_lock);
+			mutex_exit(&pidlock);
+		} else if (strcmp(sclass[cid].cl_name, "RT") == 0) {
+			curthread->t_pri = RTGPPRIO0;
+		}
+		mutex_exit(&class_lock);
+
+		/* cause the process to return to userland. */
+		lwp_rtt();
+	}
+}
+
+/*
+ * Launch the user-level release_agent manager. The event data is the
+ * pathname (relative to the mount point of the file system) of the newly empty
+ * cgroup.
+ *
+ * The cg_contents mutex is held on entry and dropped before returning.
+ */
+void
+cgrp_rel_agent_event(cgrp_mnt_t *cgm, cgrp_node_t *cn, boolean_t is_exit)
+{
+	cgrp_node_t *parent;
+	char nm[MAXNAMELEN];
+	char *argstr, *oldstr, *tmp;
+	id_t cid;
+	proc_t *p = ttoproc(curthread);
+	zone_t *z = p->p_zone;
+	lx_lwp_data_t *plwpd = ttolxlwp(curthread);
+	cgrp_rra_arg_t *rarg;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+
+	/* Nothing to do if the agent is not set */
+	if (cgm->cg_agent[0] == '\0') {
+		mutex_exit(&cgm->cg_contents);
+		return;
+	}
+
+	parent = cn->cgn_parent;
+	/* Cannot remove the top-level cgroup (only via unmount) */
+	if (parent == cn) {
+		mutex_exit(&cgm->cg_contents);
+		return;
+	}
+
+	argstr = kmem_alloc(MAXPATHLEN, KM_SLEEP);
+	oldstr = kmem_alloc(MAXPATHLEN, KM_SLEEP);
+	*argstr = '\0';
+
+	/*
+	 * Iterate up the directory tree to construct the agent argument string.
+	 */
+	do {
+		VERIFY0(cgrp_get_dirname(cn, nm, sizeof (nm)));
+		DTRACE_PROBE1(cgrp__dir__name, char *, nm);
+		if (*argstr == '\0') {
+			(void) snprintf(argstr, MAXPATHLEN, "/%s", nm);
+		} else {
+			tmp = oldstr;
+			oldstr = argstr;
+			argstr = tmp;
+			(void) snprintf(argstr, MAXPATHLEN, "/%s%s", nm,
+			    oldstr);
+		}
+
+		if (cn->cgn_parent == NULL)
+			break;
+		cn = cn->cgn_parent;
+		parent = cn->cgn_parent;
+
+		/*
+		 * The arg path is relative to the mountpoint so we stop when
+		 * we get to the top level.
+		 */
+		if (parent == NULL || parent == cn)
+			break;
+	} while (parent != cn);
+
+	kmem_free(oldstr, MAXPATHLEN);
+
+	rarg = kmem_alloc(sizeof (cgrp_rra_arg_t), KM_SLEEP);
+	rarg->crraa_agent_path = kmem_alloc(sizeof (cgm->cg_agent), KM_SLEEP);
+	(void) strlcpy(rarg->crraa_agent_path, cgm->cg_agent,
+	    sizeof (cgm->cg_agent));
+	rarg->crraa_event_path = argstr;
+
+	DTRACE_PROBE2(cgrp__agent__event, cgrp_rra_arg_t *, rarg,
+	    int, plwpd->br_cgroupid);
+
+	/*
+	 * When we're exiting, the release agent process cannot belong to our
+	 * cgroup. When the release agent is called for a move or rmdir, then
+	 * we do not change our cgroupid.
+	 */
+	if (is_exit) {
+		plwpd->br_cgroupid = 0;
+	}
+
+	/*
+	 * The cg_contents mutex cannot be held while taking the pool lock
+	 * or calling newproc.
+	 */
+	mutex_exit(&cgm->cg_contents);
+
+	if (z->zone_defaultcid > 0) {
+		cid = z->zone_defaultcid;
+	} else {
+		pool_lock();
+		cid = pool_get_class(z->zone_pool);
+		pool_unlock();
+	}
+	if (cid == -1)
+		cid = defaultcid;
+
+	if (newproc(cgrp_run_rel_agent, (void *)rarg, cid, minclsyspri - 1,
+	    NULL, -1) != 0) {
+		/* There's nothing we can do if creating the proc fails. */
+		kmem_free(rarg->crraa_event_path, MAXPATHLEN);
+		kmem_free(rarg->crraa_agent_path, sizeof (cgm->cg_agent));
+		kmem_free(rarg, sizeof (cgrp_rra_arg_t));
+	}
+}
+
+/*ARGSUSED*/
+static void
+cgrp_lwp_fork_helper(vfs_t *vfsp, uint_t cg_id, id_t tid, pid_t tpid)
+{
+	cgrp_mnt_t *cgm = (cgrp_mnt_t *)VFSTOCGM(vfsp);
+	cgrp_node_t *cn;
+
+	mutex_enter(&cgm->cg_contents);
+	cn = cgrp_cg_hash_lookup(cgm, cg_id);
+	ASSERT(cn != NULL);
+	cn->cgn_task_cnt++;
+	mutex_exit(&cgm->cg_contents);
+
+	DTRACE_PROBE1(cgrp__lwp__fork, void *, cn);
+}
+
+/*ARGSUSED*/
+static void
+cgrp_lwp_exit_helper(vfs_t *vfsp, uint_t cg_id, id_t tid, pid_t tpid)
+{
+	cgrp_mnt_t *cgm = (cgrp_mnt_t *)VFSTOCGM(vfsp);
+	cgrp_node_t *cn;
+
+	mutex_enter(&cgm->cg_contents);
+	cn = cgrp_cg_hash_lookup(cgm, cg_id);
+	ASSERT(cn != NULL);
+	if (cn->cgn_task_cnt == 0) {
+		/* top-level cgroup cnt can be 0 during reboot */
+		mutex_exit(&cgm->cg_contents);
+		return;
+	}
+	cn->cgn_task_cnt--;
+	DTRACE_PROBE1(cgrp__lwp__exit, void *, cn);
+
+	if (cn->cgn_task_cnt == 0 && cn->cgn_dirents == N_DIRENTS(cgm) &&
+	    cn->cgn_notify == 1) {
+		cgrp_rel_agent_event(cgm, cn, B_TRUE);
+		ASSERT(MUTEX_NOT_HELD(&cgm->cg_contents));
+	} else {
+		mutex_exit(&cgm->cg_contents);
+	}
+}
diff --git a/usr/src/uts/common/brand/lx/cgroups/cgrps_vnops.c b/usr/src/uts/common/brand/lx/cgroups/cgrps_vnops.c
new file mode 100644
index 0000000000..0078ad7876
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/cgroups/cgrps_vnops.c
@@ -0,0 +1,1552 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sysmacros.h>
+#include <sys/user.h>
+#include <sys/time.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/file.h>
+#include <sys/fcntl.h>
+#include <sys/flock.h>
+#include <sys/kmem.h>
+#include <sys/uio.h>
+#include <sys/errno.h>
+#include <sys/stat.h>
+#include <sys/cred.h>
+#include <sys/dirent.h>
+#include <sys/pathname.h>
+#include <vm/seg_vn.h>
+#include <sys/cmn_err.h>
+#include <sys/buf.h>
+#include <sys/vm.h>
+#include <sys/prsystm.h>
+#include <sys/policy.h>
+#include <fs/fs_subr.h>
+#include <sys/sdt.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+
+#include "cgrps.h"
+
+typedef enum cgrp_wr_type {
+	CG_WR_PROCS = 1,
+	CG_WR_TASKS
+} cgrp_wr_type_t;
+
+/* ARGSUSED1 */
+static int
+cgrp_open(struct vnode **vpp, int flag, struct cred *cred, caller_context_t *ct)
+{
+	/*
+	 * swapon to a cgrp file is not supported so access is denied on open
+	 * if VISSWAP is set.
+	 */
+	if ((*vpp)->v_flag & VISSWAP)
+		return (EINVAL);
+
+	return (0);
+}
+
+/* ARGSUSED1 */
+static int
+cgrp_close(struct vnode *vp, int flag, int count, offset_t offset,
+    struct cred *cred, caller_context_t *ct)
+{
+	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
+	cleanshares(vp, ttoproc(curthread)->p_pid);
+	return (0);
+}
+
+/*
+ * Lookup proc or task based on pid and typ.
+ */
+static proc_t *
+cgrp_p_for_wr(pid_t pid, cgrp_wr_type_t typ)
+{
+	int i;
+	zoneid_t zoneid = curproc->p_zone->zone_id;
+	pid_t schedpid = curproc->p_zone->zone_zsched->p_pid;
+
+	ASSERT(MUTEX_HELD(&pidlock));
+
+	/* getting a proc from a pid is easy */
+	if (typ == CG_WR_PROCS)
+		return (prfind(pid));
+
+	ASSERT(typ == CG_WR_TASKS);
+
+	/*
+	 * We have to scan all of the process entries to find the proc
+	 * containing this task.
+	 */
+	mutex_exit(&pidlock);
+	for (i = 1; i < v.v_proc; i++) {
+		proc_t *p;
+		kthread_t *t;
+
+		mutex_enter(&pidlock);
+		/*
+		 * Skip indices for which there is no pid_entry, PIDs for
+		 * which there is no corresponding process, system processes,
+		 * a PID of 0, the pid for our zsched process, anything the
+		 * security policy doesn't allow us to look at, its not an
+		 * lx-branded process and processes that are not in the zone.
+		 */
+		if ((p = pid_entry(i)) == NULL ||
+		    p->p_stat == SIDL ||
+		    (p->p_flag & SSYS) != 0 ||
+		    p->p_pid == 0 ||
+		    p->p_pid == schedpid ||
+		    secpolicy_basic_procinfo(CRED(), p, curproc) != 0 ||
+		    p->p_brand != &lx_brand ||
+		    p->p_zone->zone_id != zoneid) {
+			mutex_exit(&pidlock);
+			continue;
+		}
+
+		mutex_enter(&p->p_lock);
+		if ((t = p->p_tlist) == NULL) {
+			/* no threads, skip it */
+			mutex_exit(&p->p_lock);
+			mutex_exit(&pidlock);
+			continue;
+		}
+
+		/*
+		 * Check all threads in this proc.
+		 */
+		do {
+			lx_lwp_data_t *plwpd = ttolxlwp(t);
+			if (plwpd != NULL && plwpd->br_pid == pid) {
+				mutex_exit(&p->p_lock);
+				return (p);
+			}
+
+			t = t->t_forw;
+		} while (t != p->p_tlist);
+
+		mutex_exit(&p->p_lock);
+		mutex_exit(&pidlock);
+	}
+
+	mutex_enter(&pidlock);
+	return (NULL);
+}
+
+/*
+ * Move a thread from one cgroup to another. If the old cgroup is empty
+ * we queue up an agent event. We return true in that case since we've
+ * dropped the locks and the caller needs to reacquire them.
+ */
+static boolean_t
+cgrp_thr_move(cgrp_mnt_t *cgm, lx_lwp_data_t *plwpd, cgrp_node_t *ncn,
+    uint_t cg_id, proc_t *p)
+{
+	cgrp_node_t *ocn;
+
+	ASSERT(MUTEX_HELD(&cgm->cg_contents));
+	ASSERT(MUTEX_HELD(&p->p_lock));
+
+	ocn = cgrp_cg_hash_lookup(cgm, plwpd->br_cgroupid);
+	VERIFY(ocn != NULL);
+
+	ASSERT(ocn->cgn_task_cnt > 0);
+	atomic_dec_32(&ocn->cgn_task_cnt);
+	atomic_inc_32(&ncn->cgn_task_cnt);
+	plwpd->br_cgroupid = cg_id;
+
+	if (ocn->cgn_task_cnt == 0 && ocn->cgn_dirents == N_DIRENTS(cgm) &&
+	    ocn->cgn_notify == 1) {
+		/*
+		 * We want to drop p_lock before queuing the event since
+		 * that might sleep. Dropping p_lock might cause the caller to
+		 * have to restart the move process from the beginning.
+		 */
+		mutex_exit(&p->p_lock);
+		cgrp_rel_agent_event(cgm, ocn, B_FALSE);
+		ASSERT(MUTEX_NOT_HELD(&cgm->cg_contents));
+		return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * Assign either all of the threads, or a single thread, for the specified pid
+ * to the new cgroup. Controlled by the typ argument.
+ */
+static int
+cgrp_proc_set_id(cgrp_mnt_t *cgm, uint_t cg_id, pid_t pid, cgrp_wr_type_t typ)
+{
+	proc_t *p;
+	kthread_t *t;
+	int error;
+	cgrp_node_t *ncn;
+
+	if (pid == 1)
+		pid = curproc->p_zone->zone_proc_initpid;
+
+	/*
+	 * Move one or all threads to this cgroup.
+	 */
+	if (typ == CG_WR_TASKS) {
+		error = ESRCH;
+	} else {
+		error = 0;
+	}
+
+restart:
+	mutex_enter(&pidlock);
+
+	p = cgrp_p_for_wr(pid, typ);
+	if (p == NULL) {
+		mutex_exit(&pidlock);
+		return (ESRCH);
+	}
+
+	/*
+	 * Fail writes for pids for which there is no corresponding process,
+	 * system processes, a pid of 0, the pid for our zsched process,
+	 * anything the security policy doesn't allow us to look at, and
+	 * processes that are not in the zone.
+	 */
+	if (p->p_stat == SIDL ||
+	    (p->p_flag & SSYS) != 0 ||
+	    p->p_pid == 0 ||
+	    p->p_pid == curproc->p_zone->zone_zsched->p_pid ||
+	    secpolicy_basic_procinfo(CRED(), p, curproc) != 0 ||
+	    p->p_zone->zone_id != curproc->p_zone->zone_id) {
+		mutex_exit(&pidlock);
+		return (ESRCH);
+	}
+
+	/*
+	 * Ignore writes for PID which is not an lx-branded process or with
+	 * no threads.
+	 */
+
+	mutex_enter(&p->p_lock);
+	mutex_exit(&pidlock);
+	if (p->p_brand != &lx_brand || (t = p->p_tlist) == NULL ||
+	    p->p_flag & SEXITING) {
+		mutex_exit(&p->p_lock);
+		return (0);
+	}
+
+	mutex_enter(&cgm->cg_contents);
+
+	ncn = cgrp_cg_hash_lookup(cgm, cg_id);
+	VERIFY(ncn != NULL);
+
+	do {
+		lx_lwp_data_t *plwpd = ttolxlwp(t);
+		if (plwpd != NULL && plwpd->br_cgroupid != cg_id) {
+			if (typ == CG_WR_PROCS) {
+				if (cgrp_thr_move(cgm, plwpd, ncn, cg_id, p)) {
+					/*
+					 * We dropped all of the locks so we
+					 * need to start over.
+					 */
+					goto restart;
+				}
+
+			} else if (plwpd->br_pid == pid) {
+				/* type is CG_WR_TASKS and we found the task */
+				error = 0;
+				if (cgrp_thr_move(cgm, plwpd, ncn, cg_id, p)) {
+					goto done;
+				} else {
+					break;
+				}
+			}
+		}
+		t = t->t_forw;
+	} while (t != p->p_tlist);
+
+	mutex_exit(&cgm->cg_contents);
+	mutex_exit(&p->p_lock);
+done:
+
+	return (error);
+}
+
+/*
+ * User-level is writing a pid string. We need to get that string and convert
+ * it to a pid. The user-level code has to completely write an entire pid
+ * string at once. The user-level code could write multiple strings (delimited
+ * by newline) although that is frowned upon. However, we must handle this
+ * case too. Thus we consume the input one byte at a time until we get a whole
+ * pid string. We can't consume more than a byte at a time since otherwise we
+ * might be left with a partial pid string.
+ */
+static int
+cgrp_get_pid_str(struct uio *uio, pid_t *pid)
+{
+	char buf[16];	/* big enough for a pid string */
+	int i;
+	int error;
+	char *p = &buf[0];
+	char *ep;
+	long pidnum;
+
+	bzero(buf, sizeof (buf));
+	for (i = 0; uio->uio_resid > 0 && i < sizeof (buf); i++, p++) {
+		error = uiomove(p, 1, UIO_WRITE, uio);
+		if (error != 0)
+			return (error);
+		if (buf[i] == '\n') {
+			buf[i] = '\0';
+			break;
+		}
+	}
+
+	if (buf[0] == '\0' || i >= sizeof (buf)) /* no input or too long */
+		return (EINVAL);
+
+	error = ddi_strtol(buf, &ep, 10, &pidnum);
+	if (error != 0 || *ep != '\0' || pidnum > maxpid || pidnum < 0)
+		return (EINVAL);
+
+	*pid = (pid_t)pidnum;
+	return (0);
+}
+
+static int
+cgrp_wr_notify(cgrp_node_t *cn, struct uio *uio)
+{
+	int error;
+	uint_t value;
+
+	/*
+	 * This is cheesy but since we only take a 0 or 1 value we can
+	 * let the pid_str function do the uio string conversion.
+	 */
+	error = cgrp_get_pid_str(uio, (pid_t *)&value);
+	if (error != 0)
+		return (error);
+
+	if (value != 0 && value != 1)
+		return (EINVAL);
+
+	/*
+	 * The flag is on the containing dir. We don't bother taking the
+	 * cg_contents lock since this is a simple assignment.
+	 */
+	cn->cgn_parent->cgn_notify = value;
+	return (0);
+}
+
+static int
+cgrp_wr_rel_agent(cgrp_mnt_t *cgm, struct uio *uio)
+{
+	int error;
+	int len;
+	char *wrp;
+
+	len = uio->uio_offset + uio->uio_resid;
+	if (len > MAXPATHLEN)
+		return (EFBIG);
+
+	mutex_enter(&cgm->cg_contents);
+
+	wrp = &cgm->cg_agent[uio->uio_offset];
+	error = uiomove(wrp, uio->uio_resid, UIO_WRITE, uio);
+	cgm->cg_agent[len] = '\0';
+	if (len > 1 && cgm->cg_agent[len - 1] == '\n')
+		cgm->cg_agent[len - 1] = '\0';
+
+	mutex_exit(&cgm->cg_contents);
+	return (error);
+}
+
+static int
+cgrp_wr_proc_or_task(cgrp_mnt_t *cgm, cgrp_node_t *cn, struct uio *uio,
+    cgrp_wr_type_t typ)
+{
+	/* the cgroup ID is on the containing dir */
+	uint_t cg_id = cn->cgn_parent->cgn_id;
+	int error;
+	pid_t pidnum;
+
+	while (uio->uio_resid > 0) {
+		error = cgrp_get_pid_str(uio, &pidnum);
+		if (error != 0)
+			return (error);
+
+		error = cgrp_proc_set_id(cgm, cg_id, pidnum, typ);
+		if (error != 0)
+			return (error);
+	}
+
+	return (0);
+}
+
+static int
+cgrp_wr(cgrp_mnt_t *cgm, cgrp_node_t *cn, struct uio *uio)
+{
+	int error = 0;
+	rlim64_t limit = uio->uio_llimit;
+
+	ASSERT(CGNTOV(cn)->v_type == VREG);
+
+	if (uio->uio_loffset < 0)
+		return (EINVAL);
+
+	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
+		limit = MAXOFFSET_T;
+
+	if (uio->uio_loffset >= MAXOFF_T)
+		return (EFBIG);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	if (limit > MAXOFF_T)
+		limit = MAXOFF_T;
+
+	switch (cn->cgn_type) {
+	case CG_NOTIFY:
+		error = cgrp_wr_notify(cn, uio);
+		break;
+	case CG_PROCS:
+		error = cgrp_wr_proc_or_task(cgm, cn, uio, CG_WR_PROCS);
+		break;
+	case CG_REL_AGENT:
+		error = cgrp_wr_rel_agent(cgm, uio);
+		break;
+	case CG_TASKS:
+		error = cgrp_wr_proc_or_task(cgm, cn, uio, CG_WR_TASKS);
+		break;
+	default:
+		VERIFY(0);
+	}
+
+	return (error);
+}
+
+/*
+ * Read value from the notify_on_release pseudo file on the parent node
+ * (which is the actual cgroup node). We don't bother taking the cg_contents
+ * lock since it's a single instruction so an empty group action/read will
+ * only see one value or the other.
+ */
+/* ARGSUSED */
+static int
+cgrp_rd_notify(cgrp_mnt_t *cgm, cgrp_node_t *cn, struct uio *uio)
+{
+	int len;
+	int error = 0;
+	char buf[16];
+	char *rdp;
+	/* the flag is on the containing dir */
+	uint_t value = cn->cgn_parent->cgn_notify;
+
+	len = snprintf(buf, sizeof (buf), "%u\n", value);
+	if (uio->uio_offset > len)
+		return (0);
+
+	len -= uio->uio_offset;
+	rdp = &buf[uio->uio_offset];
+	len = (uio->uio_resid < len) ? uio->uio_resid : len;
+
+	error = uiomove(rdp, len, UIO_READ, uio);
+	return (error);
+}
+
+/*
+ * Read value from the release_agent pseudo file.
+ */
+static int
+cgrp_rd_rel_agent(cgrp_mnt_t *cgm, struct uio *uio)
+{
+	int len;
+	int error = 0;
+	char *rdp;
+
+	mutex_enter(&cgm->cg_contents);
+
+	if (cgm->cg_agent[0] == '\0') {
+		mutex_exit(&cgm->cg_contents);
+		return (0);
+	}
+
+	len = strlen(cgm->cg_agent);
+	if (uio->uio_offset > len) {
+		mutex_exit(&cgm->cg_contents);
+		return (0);
+	}
+
+	len -= uio->uio_offset;
+	rdp = &cgm->cg_agent[uio->uio_offset];
+	len = (uio->uio_resid < len) ? uio->uio_resid : len;
+
+	error = uiomove(rdp, len, UIO_READ, uio);
+
+	mutex_exit(&cgm->cg_contents);
+
+	return (error);
+}
+
+/*
+ * Read pids from the cgroup.procs pseudo file. We have to look at all of the
+ * processes to find applicable ones, then report pids for any process which
+ * has all of its threads in the same cgroup.
+ */
+static int
+cgrp_rd_procs(cgrp_mnt_t *cgm, cgrp_node_t *cn, struct uio *uio)
+{
+	int i;
+	ssize_t offset = 0;
+	ssize_t uresid;
+	zoneid_t zoneid = curproc->p_zone->zone_id;
+	int error = 0;
+	pid_t initpid = curproc->p_zone->zone_proc_initpid;
+	pid_t schedpid = curproc->p_zone->zone_zsched->p_pid;
+	/* the cgroup ID is on the containing dir */
+	uint_t cg_id = cn->cgn_parent->cgn_id;
+
+	/* Scan all of the process entries */
+	for (i = 1; i < v.v_proc && (uresid = uio->uio_resid) > 0; i++) {
+		proc_t *p;
+		ssize_t len;
+		pid_t pid;
+		char buf[16];
+		char *rdp;
+		kthread_t *t;
+		boolean_t in_cg;
+
+		mutex_enter(&pidlock);
+		/*
+		 * Skip indices for which there is no pid_entry, PIDs for
+		 * which there is no corresponding process, system processes,
+		 * a PID of 0, the pid for our zsched process,  anything the
+		 * security policy doesn't allow us to look at, its not an
+		 * lx-branded process and processes that are not in the zone.
+		 */
+		if ((p = pid_entry(i)) == NULL ||
+		    p->p_stat == SIDL ||
+		    (p->p_flag & SSYS) != 0 ||
+		    p->p_pid == 0 ||
+		    p->p_pid == schedpid ||
+		    secpolicy_basic_procinfo(CRED(), p, curproc) != 0 ||
+		    p->p_brand != &lx_brand ||
+		    p->p_zone->zone_id != zoneid) {
+			mutex_exit(&pidlock);
+			continue;
+		}
+
+		mutex_enter(&p->p_lock);
+		if ((t = p->p_tlist) == NULL) {
+			/* no threads, skip it */
+			mutex_exit(&p->p_lock);
+			mutex_exit(&pidlock);
+			continue;
+		}
+
+		/*
+		 * Check if all threads are in this cgroup.
+		 */
+		in_cg = B_TRUE;
+		mutex_enter(&cgm->cg_contents);
+		do {
+			lx_lwp_data_t *plwpd = ttolxlwp(t);
+			if (plwpd == NULL || plwpd->br_cgroupid != cg_id) {
+				in_cg = B_FALSE;
+				break;
+			}
+
+			t = t->t_forw;
+		} while (t != p->p_tlist);
+		mutex_exit(&cgm->cg_contents);
+
+		mutex_exit(&p->p_lock);
+		if (!in_cg) {
+			/*
+			 * This proc, or at least one of its threads, is not
+			 * in this cgroup.
+			 */
+			mutex_exit(&pidlock);
+			continue;
+		}
+
+		/*
+		 * Convert pid to the Linux default of 1 if we're the zone's
+		 * init process, otherwise use the value from the proc struct
+		 */
+		if (p->p_pid == initpid) {
+			pid = 1;
+		} else {
+			pid = p->p_pid;
+		}
+
+		mutex_exit(&pidlock);
+
+		/*
+		 * Generate pid line and write all or part of it if we're
+		 * in the right spot within the pseudo file.
+		 */
+		len = snprintf(buf, sizeof (buf), "%u\n", pid);
+		if ((offset + len) > uio->uio_offset) {
+			int diff = (int)(uio->uio_offset - offset);
+
+			ASSERT(diff < len);
+			offset += diff;
+			rdp = &buf[diff];
+			len -= diff;
+			if (len > uresid)
+				len = uresid;
+
+			error = uiomove(rdp, len, UIO_READ, uio);
+			if (error != 0)
+				return (error);
+		}
+		offset += len;
+	}
+
+	return (0);
+}
+
+/*
+ * We are given a locked process we know is valid, report on any of its thresds
+ * that are in the cgroup.
+ */
+static int
+cgrp_rd_proc_tasks(uint_t cg_id, proc_t *p, pid_t initpid, ssize_t *offset,
+    struct uio *uio)
+{
+	int error = 0;
+	uint_t tid;
+	char buf[16];
+	char *rdp;
+	kthread_t *t;
+
+	ASSERT(p->p_proc_flag & P_PR_LOCK);
+
+	/*
+	 * Report all threads in this cgroup.
+	 */
+	t = p->p_tlist;
+	do {
+		lx_lwp_data_t *plwpd = ttolxlwp(t);
+		if (plwpd == NULL) {
+			t = t->t_forw;
+			continue;
+		}
+
+		if (plwpd->br_cgroupid == cg_id) {
+			int len;
+
+			/*
+			 * Convert taskid to the Linux default of 1 if
+			 * we're the zone's init process.
+			 */
+			tid = plwpd->br_pid;
+			if (tid == initpid)
+				tid = 1;
+
+			len = snprintf(buf, sizeof (buf), "%u\n", tid);
+			if ((*offset + len) > uio->uio_offset) {
+				int diff;
+
+				diff = (int)(uio->uio_offset - *offset);
+				ASSERT(diff < len);
+				*offset = *offset + diff;
+				rdp = &buf[diff];
+				len -= diff;
+				if (len > uio->uio_resid)
+					len = uio->uio_resid;
+
+				error = uiomove(rdp, len, UIO_READ, uio);
+				if (error != 0)
+					return (error);
+			}
+			*offset = *offset + len;
+		}
+
+		t = t->t_forw;
+	} while (t != p->p_tlist && uio->uio_resid > 0);
+
+	return (0);
+}
+
+/*
+ * Read PIDs from the tasks pseudo file.  In order to do this, the process
+ * table is walked, searching for entries which are in the correct state and
+ * match this zone.  The LX emulated PIDs will be reported from branded entries
+ * which fulfill the criteria.  Since records are being emulated for every task
+ * in the process, PR_LOCK is acquired to prevent changes during output.
+ *
+ * Note: If the buffer is filled and the accessing process is forced into a
+ * subsequent read, the reported threads may changes while locks are dropped in
+ * the mean time.
+ */
+static int
+cgrp_rd_tasks(cgrp_mnt_t *cgm, cgrp_node_t *cn, struct uio *uio)
+{
+	int i;
+	ssize_t offset = 0;
+	zoneid_t zoneid = curproc->p_zone->zone_id;
+	cred_t *cred = CRED();
+	int error = 0;
+	pid_t initpid = curproc->p_zone->zone_proc_initpid;
+	/* the cgroup ID is on the containing dir */
+	uint_t cg_id = cn->cgn_parent->cgn_id;
+
+	/* Scan all of the process entries */
+	for (i = 1; i < v.v_proc && uio->uio_resid > 0; i++) {
+		proc_t *p;
+
+		mutex_enter(&pidlock);
+		for (;;) {
+			if ((p = pid_entry(i)) == NULL) {
+				/* Quickly move onto the next slot */
+				if (++i < v.v_proc) {
+					continue;
+				} else {
+					mutex_exit(&pidlock);
+					break;
+				}
+			}
+
+			/*
+			 * Check if this process would even be of interest to
+			 * cgroupfs before attempting to acquire its PR_LOCK.
+			 */
+			mutex_enter(&p->p_lock);
+			mutex_exit(&pidlock);
+			if (p->p_brand != &lx_brand ||
+			    p->p_zone->zone_id != zoneid) {
+				mutex_exit(&p->p_lock);
+				p = NULL;
+				break;
+			}
+
+			/* Attempt to grab P_PR_LOCK. */
+			error = sprtrylock_proc(p);
+			if (error == 0) {
+				/* Success */
+				break;
+			} else if (error < 0) {
+				/*
+				 * This process is not in a state where
+				 * P_PR_LOCK can be acquired.  It either
+				 * belongs to the system or is a zombie.
+				 * Regardless, give up and move on.
+				 */
+				mutex_exit(&p->p_lock);
+				p = NULL;
+				break;
+			} else {
+				/*
+				 * Wait until P_PR_LOCK is no longer contended
+				 * and attempt to acquire it again.  Since the
+				 * process may have changed state, the entry
+				 * lookup must be repeated.
+				 */
+				sprwaitlock_proc(p);
+				mutex_enter(&pidlock);
+			}
+		}
+
+		if (p == NULL) {
+			continue;
+		} else if (secpolicy_basic_procinfo(cred, p, curproc) != 0) {
+			sprunlock(p);
+			continue;
+		}
+
+		/* Shuffle locks and output the entry. */
+		mutex_exit(&p->p_lock);
+		mutex_enter(&cgm->cg_contents);
+		error = cgrp_rd_proc_tasks(cg_id, p, initpid, &offset, uio);
+		mutex_exit(&cgm->cg_contents);
+		mutex_enter(&p->p_lock);
+
+		sprunlock(p);
+		if (error != 0) {
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+static int
+cgrp_rd(cgrp_mnt_t *cgm, cgrp_node_t *cn, struct uio *uio)
+{
+	int error = 0;
+
+	if (uio->uio_loffset >= MAXOFF_T)
+		return (0);
+	if (uio->uio_loffset < 0)
+		return (EINVAL);
+	if (uio->uio_resid == 0)
+		return (0);
+
+	switch (cn->cgn_type) {
+	case CG_NOTIFY:
+		error = cgrp_rd_notify(cgm, cn, uio);
+		break;
+	case CG_PROCS:
+		error = cgrp_rd_procs(cgm, cn, uio);
+		break;
+	case CG_REL_AGENT:
+		error = cgrp_rd_rel_agent(cgm, uio);
+		break;
+	case CG_TASKS:
+		error = cgrp_rd_tasks(cgm, cn, uio);
+		break;
+	default:
+		VERIFY(0);
+	}
+
+	return (error);
+}
+
+/* ARGSUSED2 */
+static int
+cgrp_read(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cred,
+    struct caller_context *ct)
+{
+	cgrp_node_t *cn = VTOCGN(vp);
+	cgrp_mnt_t *cgm = VTOCGM(vp);
+	int error;
+
+	/*
+	 * We don't support reading non-regular files
+	 */
+	if (vp->v_type == VDIR)
+		return (EISDIR);
+	if (vp->v_type != VREG)
+		return (EINVAL);
+	error = cgrp_rd(cgm, cn, uiop);
+
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+cgrp_write(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cred,
+    struct caller_context *ct)
+{
+	cgrp_node_t *cn = VTOCGN(vp);
+	cgrp_mnt_t *cgm = VTOCGM(vp);
+	int error;
+
+	/*
+	 * We don't support writing to non-regular files
+	 */
+	if (vp->v_type != VREG)
+		return (EINVAL);
+
+	if (ioflag & FAPPEND) {
+		/* In append mode start at end of file. */
+		uiop->uio_loffset = cn->cgn_size;
+	}
+
+	error = cgrp_wr(cgm, cn, uiop);
+
+	return (error);
+}
+
+/* ARGSUSED2 */
+static int
+cgrp_getattr(struct vnode *vp, struct vattr *vap, int flags, struct cred *cred,
+    caller_context_t *ct)
+{
+	cgrp_node_t *cn = VTOCGN(vp);
+	cgrp_mnt_t *cgm;
+
+	cgm = VTOCGM(cn->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+	vap->va_type = vp->v_type;
+	vap->va_mode = cn->cgn_mode & MODEMASK;
+	vap->va_uid = cn->cgn_uid;
+	vap->va_gid = cn->cgn_gid;
+	vap->va_fsid = cn->cgn_fsid;
+	vap->va_nodeid = (ino64_t)cn->cgn_nodeid;
+	vap->va_nlink = cn->cgn_nlink;
+	vap->va_size = (u_offset_t)cn->cgn_size;
+	vap->va_atime = cn->cgn_atime;
+	vap->va_mtime = cn->cgn_mtime;
+	vap->va_ctime = cn->cgn_ctime;
+	vap->va_blksize = PAGESIZE;
+	vap->va_rdev = cn->cgn_rdev;
+	vap->va_seq = cn->cgn_seq;
+
+	vap->va_nblocks = (fsblkcnt64_t)btodb(ptob(btopr(vap->va_size)));
+	mutex_exit(&cgm->cg_contents);
+	return (0);
+}
+
+/*ARGSUSED4*/
+static int
+cgrp_setattr(struct vnode *vp, struct vattr *vap, int flags, struct cred *cred,
+    caller_context_t *ct)
+{
+	cgrp_node_t *cn = VTOCGN(vp);
+	cgrp_mnt_t *cgm;
+	int error = 0;
+	struct vattr *get;
+	long mask;
+
+	/*
+	 * Cannot set these attributes
+	 */
+	if ((vap->va_mask & AT_NOSET) || (vap->va_mask & AT_XVATTR) ||
+	    (vap->va_mode & (S_ISUID | S_ISGID)) || (vap->va_mask & AT_SIZE))
+		return (EINVAL);
+
+	cgm = VTOCGM(cn->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+
+	get = &cn->cgn_attr;
+	/*
+	 * Change file access modes. Must be owner or have sufficient
+	 * privileges.
+	 */
+	error = secpolicy_vnode_setattr(cred, vp, vap, get, flags, cgrp_taccess,
+	    cn);
+
+	if (error)
+		goto out;
+
+	mask = vap->va_mask;
+
+	if (mask & AT_MODE) {
+		get->va_mode &= S_IFMT;
+		get->va_mode |= vap->va_mode & ~S_IFMT;
+	}
+
+	if (mask & AT_UID)
+		get->va_uid = vap->va_uid;
+	if (mask & AT_GID)
+		get->va_gid = vap->va_gid;
+	if (mask & AT_ATIME)
+		get->va_atime = vap->va_atime;
+	if (mask & AT_MTIME)
+		get->va_mtime = vap->va_mtime;
+
+	if (mask & (AT_UID | AT_GID | AT_MODE | AT_MTIME))
+		gethrestime(&cn->cgn_ctime);
+
+out:
+	mutex_exit(&cgm->cg_contents);
+	return (error);
+}
+
+/* ARGSUSED2 */
+static int
+cgrp_access(struct vnode *vp, int mode, int flags, struct cred *cred,
+    caller_context_t *ct)
+{
+	cgrp_node_t *cn = VTOCGN(vp);
+	cgrp_mnt_t *cgm;
+	int error;
+
+	cgm = VTOCGM(cn->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+	error = cgrp_taccess(cn, mode, cred);
+	mutex_exit(&cgm->cg_contents);
+	return (error);
+}
+
+/* ARGSUSED3 */
+static int
+cgrp_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
+    struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cred,
+    caller_context_t *ct, int *direntflags, pathname_t *realpnp)
+{
+	cgrp_node_t *cn = VTOCGN(dvp);
+	cgrp_mnt_t *cgm;
+	cgrp_node_t *ncn = NULL;
+	int error;
+
+	/* disallow extended attrs */
+	if (flags & LOOKUP_XATTR)
+		return (EINVAL);
+
+	/*
+	 * Null component name is a synonym for directory being searched.
+	 */
+	if (*nm == '\0') {
+		VN_HOLD(dvp);
+		*vpp = dvp;
+		return (0);
+	}
+	ASSERT(cn);
+
+	cgm = VTOCGM(cn->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+	error = cgrp_dirlookup(cn, nm, &ncn, cred);
+	mutex_exit(&cgm->cg_contents);
+
+	if (error == 0) {
+		ASSERT(ncn);
+		*vpp = CGNTOV(ncn);
+	}
+
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+cgrp_create(struct vnode *dvp, char *nm, struct vattr *vap,
+    enum vcexcl exclusive, int mode, struct vnode **vpp, struct cred *cred,
+    int flag, caller_context_t *ct, vsecattr_t *vsecp)
+{
+	cgrp_node_t *parent = VTOCGN(dvp);
+	cgrp_node_t *cn = NULL;
+	cgrp_mnt_t *cgm;
+	int error;
+
+	if (*nm == '\0')
+		return (EPERM);
+
+	cgm = VTOCGM(parent->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+	error = cgrp_dirlookup(parent, nm, &cn, cred);
+	if (error == 0) {		/* name found */
+		ASSERT(cn);
+
+		mutex_exit(&cgm->cg_contents);
+		/*
+		 * Creating an existing file, allow it except for the following
+		 * errors.
+		 */
+		if (exclusive == EXCL) {
+			error = EEXIST;
+		} else if ((CGNTOV(cn)->v_type == VDIR) && (mode & VWRITE)) {
+			error = EISDIR;
+		} else {
+			error = cgrp_taccess(cn, mode, cred);
+		}
+		if (error != 0) {
+			cgnode_rele(cn);
+			return (error);
+		}
+		*vpp = CGNTOV(cn);
+		return (0);
+	}
+	mutex_exit(&cgm->cg_contents);
+
+	/*
+	 * cgroups doesn't allow creation of additional, non-subsystem specific
+	 * files in a dir
+	 */
+	return (EPERM);
+}
+
+/* ARGSUSED3 */
+static int
+cgrp_remove(struct vnode *dvp, char *nm, struct cred *cred,
+    caller_context_t *ct, int flags)
+{
+	cgrp_node_t *parent = VTOCGN(dvp);
+	int error;
+	cgrp_node_t *cn = NULL;
+	cgrp_mnt_t *cgm;
+
+	/*
+	 * Removal of subsystem-specific files is not allowed but we need
+	 * to return the correct error if they try to remove a non-existent
+	 * file.
+	 */
+
+	cgm = VTOCGM(parent->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+	error = cgrp_dirlookup(parent, nm, &cn, cred);
+	mutex_exit(&cgm->cg_contents);
+	if (error)
+		return (error);
+
+	ASSERT(cn);
+	cgnode_rele(cn);
+	return (EPERM);
+}
+
+/* ARGSUSED */
+static int
+cgrp_link(struct vnode *dvp, struct vnode *srcvp, char *cnm, struct cred *cred,
+    caller_context_t *ct, int flags)
+{
+	/* cgroups doesn't support hard links */
+	return (EPERM);
+}
+
+/*
+ * Rename of subsystem-specific files is not allowed but we can rename
+ * directories (i.e. sub-groups). We cannot mv subdirs from one group to
+ * another so the src and dest vnode must be the same.
+ */
+/* ARGSUSED5 */
+static int
+cgrp_rename(
+	struct vnode *odvp,	/* source parent vnode */
+	char *onm,		/* source name */
+	struct vnode *ndvp,	/* destination parent vnode */
+	char *nnm,		/* destination name */
+	struct cred *cred,
+	caller_context_t *ct,
+	int flags)
+{
+	cgrp_node_t *fromparent;
+	cgrp_node_t *toparent;
+	cgrp_node_t *fromcn = NULL;	/* source cgrp_node */
+	cgrp_mnt_t *cgm = VTOCGM(odvp);
+	int error, err;
+
+	fromparent = VTOCGN(odvp);
+	toparent = VTOCGN(ndvp);
+
+	if (fromparent != toparent)
+		return (EIO);
+
+	/* discourage additional use of toparent */
+	toparent = NULL;
+
+	mutex_enter(&cgm->cg_contents);
+
+	/*
+	 * Look up cgrp_node of file we're supposed to rename.
+	 */
+	error = cgrp_dirlookup(fromparent, onm, &fromcn, cred);
+	if (error) {
+		mutex_exit(&cgm->cg_contents);
+		return (error);
+	}
+
+	if (fromcn->cgn_type != CG_CGROUP_DIR) {
+		error = EPERM;
+		goto done;
+	}
+
+	/*
+	 * Make sure we can delete the old (source) entry.  This
+	 * requires write permission on the containing directory.
+	 */
+	if (((error = cgrp_taccess(fromparent, VWRITE, cred)) != 0))
+		goto done;
+
+	/*
+	 * Check for renaming to or from '.' or '..' or that
+	 * fromcn == fromparent
+	 */
+	if ((onm[0] == '.' &&
+	    (onm[1] == '\0' || (onm[1] == '.' && onm[2] == '\0'))) ||
+	    (nnm[0] == '.' &&
+	    (nnm[1] == '\0' || (nnm[1] == '.' && nnm[2] == '\0'))) ||
+	    (fromparent == fromcn)) {
+		error = EINVAL;
+		goto done;
+	}
+
+	/*
+	 * Link source to new target
+	 */
+	error = cgrp_direnter(cgm, fromparent, nnm, DE_RENAME,
+	    fromcn, (struct vattr *)NULL,
+	    (cgrp_node_t **)NULL, cred);
+
+	if (error)
+		goto done;
+
+	/*
+	 * Unlink from source.
+	 */
+	error = err = cgrp_dirdelete(fromparent, fromcn, onm, DR_RENAME, cred);
+
+	/*
+	 * The following handles the case where our source cgrp_node was
+	 * removed before we got to it.
+	 */
+	if (error == ENOENT)
+		error = 0;
+
+	if (err == 0) {
+		vnevent_rename_src(CGNTOV(fromcn), odvp, onm, ct);
+		vnevent_rename_dest_dir(ndvp, CGNTOV(fromcn), nnm, ct);
+	}
+
+done:
+	mutex_exit(&cgm->cg_contents);
+	cgnode_rele(fromcn);
+
+	return (error);
+}
+
+/* ARGSUSED5 */
+static int
+cgrp_mkdir(struct vnode *dvp, char *nm, struct vattr *va, struct vnode **vpp,
+    struct cred *cred, caller_context_t *ct, int flags, vsecattr_t *vsecp)
+{
+	cgrp_node_t *parent = VTOCGN(dvp);
+	cgrp_node_t *self = NULL;
+	cgrp_mnt_t *cgm = VTOCGM(dvp);
+	int error;
+
+	/*
+	 * Might be dangling directory.  Catch it here, because a ENOENT
+	 * return from cgrp_dirlookup() is an "ok return".
+	 */
+	if (parent->cgn_nlink == 0)
+		return (ENOENT);
+
+	mutex_enter(&cgm->cg_contents);
+	error = cgrp_dirlookup(parent, nm, &self, cred);
+	if (error == 0) {
+		ASSERT(self != NULL);
+		mutex_exit(&cgm->cg_contents);
+		cgnode_rele(self);
+		return (EEXIST);
+	}
+	if (error != ENOENT) {
+		mutex_exit(&cgm->cg_contents);
+		return (error);
+	}
+
+	error = cgrp_direnter(cgm, parent, nm, DE_MKDIR, (cgrp_node_t *)NULL,
+	    va, &self, cred);
+	if (error) {
+		mutex_exit(&cgm->cg_contents);
+		if (self != NULL)
+			cgnode_rele(self);
+		return (error);
+	}
+	mutex_exit(&cgm->cg_contents);
+	*vpp = CGNTOV(self);
+	return (0);
+}
+
+/* ARGSUSED4 */
+static int
+cgrp_rmdir(struct vnode *dvp, char *nm, struct vnode *cdir, struct cred *cred,
+    caller_context_t *ct, int flags)
+{
+	cgrp_node_t *parent = VTOCGN(dvp);
+	cgrp_mnt_t *cgm;
+	cgrp_node_t *self = NULL;
+	struct vnode *vp;
+	int error = 0;
+
+	/*
+	 * Return error when removing . and ..
+	 */
+	if (strcmp(nm, ".") == 0)
+		return (EINVAL);
+	if (strcmp(nm, "..") == 0)
+		return (EEXIST); /* Should be ENOTEMPTY */
+
+	cgm = VTOCGM(parent->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+
+	error = cgrp_dirlookup(parent, nm, &self, cred);
+	if (error) {
+		mutex_exit(&cgm->cg_contents);
+		return (error);
+	}
+
+	vp = CGNTOV(self);
+	if (vp == dvp || vp == cdir) {
+		error = EINVAL;
+		goto done;
+	}
+	if (self->cgn_type != CG_CGROUP_DIR) {
+		error = ENOTDIR;
+		goto done;
+	}
+
+	cgm = (cgrp_mnt_t *)VFSTOCGM(self->cgn_vnode->v_vfsp);
+
+	/*
+	 * Check for the existence of any sub-cgroup directories or tasks in
+	 * the cgroup.
+	 */
+	if (self->cgn_task_cnt > 0 || self->cgn_dirents > N_DIRENTS(cgm)) {
+		error = EEXIST;
+		/*
+		 * Update atime because checking cn_dirents is logically
+		 * equivalent to reading the directory
+		 */
+		gethrestime(&self->cgn_atime);
+		goto done;
+	}
+
+	if (vn_vfswlock(vp)) {
+		error = EBUSY;
+		goto done;
+	}
+	if (vn_mountedvfs(vp) != NULL) {
+		error = EBUSY;
+	} else {
+		error = cgrp_dirdelete(parent, self, nm, DR_RMDIR, cred);
+	}
+
+	vn_vfsunlock(vp);
+
+	if (parent->cgn_task_cnt == 0 &&
+	    parent->cgn_dirents == N_DIRENTS(cgm) && parent->cgn_notify == 1) {
+		cgrp_rel_agent_event(cgm, parent, B_FALSE);
+		ASSERT(MUTEX_NOT_HELD(&cgm->cg_contents));
+		goto dropped;
+	}
+
+done:
+	mutex_exit(&cgm->cg_contents);
+dropped:
+	vnevent_rmdir(CGNTOV(self), dvp, nm, ct);
+	cgnode_rele(self);
+
+	return (error);
+}
+
+/* ARGSUSED2 */
+static int
+cgrp_readdir(struct vnode *vp, struct uio *uiop, struct cred *cred, int *eofp,
+    caller_context_t *ct, int flags)
+{
+	cgrp_node_t *cn = VTOCGN(vp);
+	cgrp_mnt_t *cgm;
+	cgrp_dirent_t *cdp;
+	int error = 0;
+	size_t namelen;
+	struct dirent64 *dp;
+	ulong_t offset;
+	ulong_t total_bytes_wanted;
+	long outcount = 0;
+	long bufsize;
+	int reclen;
+	caddr_t outbuf;
+
+	if (uiop->uio_loffset >= MAXOFF_T) {
+		if (eofp)
+			*eofp = 1;
+		return (0);
+	}
+
+	if (uiop->uio_iovcnt != 1)
+		return (EINVAL);
+
+	if (vp->v_type != VDIR)
+		return (ENOTDIR);
+
+	cgm = VTOCGM(cn->cgn_vnode);
+	mutex_enter(&cgm->cg_contents);
+
+	if (cn->cgn_dir == NULL) {
+		VERIFY(cn->cgn_nlink == 0);
+		mutex_exit(&cgm->cg_contents);
+		return (0);
+	}
+
+	/*
+	 * Get space for multiple directory entries
+	 */
+	total_bytes_wanted = uiop->uio_iov->iov_len;
+	bufsize = total_bytes_wanted + sizeof (struct dirent64);
+	outbuf = kmem_alloc(bufsize, KM_SLEEP);
+
+	/* LINTED: alignment */
+	dp = (struct dirent64 *)outbuf;
+
+	offset = 0;
+	cdp = cn->cgn_dir;
+	while (cdp) {
+		namelen = strlen(cdp->cgd_name);	/* no +1 needed */
+		offset = cdp->cgd_offset;
+		if (offset >= uiop->uio_offset) {
+			reclen = (int)DIRENT64_RECLEN(namelen);
+			if (outcount + reclen > total_bytes_wanted) {
+				if (!outcount) {
+					/* Buffer too small for any entries. */
+					error = EINVAL;
+				}
+				break;
+			}
+			ASSERT(cdp->cgd_cgrp_node != NULL);
+
+			/* use strncpy(9f) to zero out uninitialized bytes */
+
+			(void) strncpy(dp->d_name, cdp->cgd_name,
+			    DIRENT64_NAMELEN(reclen));
+			dp->d_reclen = (ushort_t)reclen;
+			dp->d_ino = (ino64_t)cdp->cgd_cgrp_node->cgn_nodeid;
+			dp->d_off = (offset_t)cdp->cgd_offset + 1;
+			dp = (struct dirent64 *)((uintptr_t)dp + dp->d_reclen);
+			outcount += reclen;
+			ASSERT(outcount <= bufsize);
+		}
+		cdp = cdp->cgd_next;
+	}
+
+	if (!error)
+		error = uiomove(outbuf, outcount, UIO_READ, uiop);
+
+	if (!error) {
+		/*
+		 * If we reached the end of the list our offset should now be
+		 * just past the end.
+		 */
+		if (!cdp) {
+			offset += 1;
+			if (eofp)
+				*eofp = 1;
+		} else if (eofp)
+			*eofp = 0;
+		uiop->uio_offset = offset;
+	}
+	gethrestime(&cn->cgn_atime);
+
+	mutex_exit(&cgm->cg_contents);
+
+	kmem_free(outbuf, bufsize);
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+cgrp_symlink(struct vnode *dvp, char *lnm, struct vattr *cva, char *cnm,
+    struct cred *cred, caller_context_t *ct, int flags)
+{
+	/* cgroups doesn't support symlinks */
+	return (EPERM);
+}
+
+/* ARGSUSED */
+static void
+cgrp_inactive(struct vnode *vp, struct cred *cred, caller_context_t *ct)
+{
+	cgrp_node_t *cn = VTOCGN(vp);
+	cgrp_mnt_t *cgm = VFSTOCGM(vp->v_vfsp);
+
+	mutex_enter(&cgm->cg_contents);
+	mutex_enter(&vp->v_lock);
+	ASSERT(vp->v_count >= 1);
+
+	/*
+	 * If we don't have the last hold or the link count is non-zero,
+	 * there's little to do -- just drop our hold.
+	 */
+	if (vp->v_count > 1 || cn->cgn_nlink != 0) {
+		vp->v_count--;
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&cgm->cg_contents);
+		return;
+	}
+
+	if (cn->cgn_forw == NULL)
+		cgm->cg_rootnode->cgn_back = cn->cgn_back;
+	else
+		cn->cgn_forw->cgn_back = cn->cgn_back;
+	cn->cgn_back->cgn_forw = cn->cgn_forw;
+
+	mutex_exit(&vp->v_lock);
+	mutex_exit(&cgm->cg_contents);
+
+	/* Here's our chance to send invalid event */
+	vn_invalid(CGNTOV(cn));
+
+	vn_free(CGNTOV(cn));
+	kmem_free(cn, sizeof (cgrp_node_t));
+}
+
+/* ARGSUSED */
+static int
+cgrp_seek(struct vnode *vp, offset_t ooff, offset_t *noffp,
+    caller_context_t *ct)
+{
+	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
+}
+
+/* ARGSUSED */
+static int
+cgrp_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
+{
+	return (write_lock);
+}
+
+/* ARGSUSED */
+static void
+cgrp_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
+{
+}
+
+static int
+cgrp_pathconf(struct vnode *vp, int cmd, ulong_t *valp, cred_t *cr,
+    caller_context_t *ct)
+{
+	int error;
+
+	switch (cmd) {
+	case _PC_XATTR_EXISTS:
+		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
+			*valp = 0;	/* assume no attributes */
+			error = 0;	/* okay to ask */
+		} else {
+			error = EINVAL;
+		}
+		break;
+	case _PC_SATTR_ENABLED:
+	case _PC_SATTR_EXISTS:
+		*valp = vfs_has_feature(vp->v_vfsp, VFSFT_SYSATTR_VIEWS) &&
+		    (vp->v_type == VREG || vp->v_type == VDIR);
+		error = 0;
+		break;
+	case _PC_TIMESTAMP_RESOLUTION:
+		/* nanosecond timestamp resolution */
+		*valp = 1L;
+		error = 0;
+		break;
+	default:
+		error = fs_pathconf(vp, cmd, valp, cr, ct);
+	}
+	return (error);
+}
+
+
+struct vnodeops *cgrp_vnodeops;
+
+const fs_operation_def_t cgrp_vnodeops_template[] = {
+	VOPNAME_OPEN,		{ .vop_open = cgrp_open },
+	VOPNAME_CLOSE,		{ .vop_close = cgrp_close },
+	VOPNAME_READ,		{ .vop_read = cgrp_read },
+	VOPNAME_WRITE,		{ .vop_write = cgrp_write },
+	VOPNAME_GETATTR,	{ .vop_getattr = cgrp_getattr },
+	VOPNAME_SETATTR,	{ .vop_setattr = cgrp_setattr },
+	VOPNAME_ACCESS,		{ .vop_access = cgrp_access },
+	VOPNAME_LOOKUP,		{ .vop_lookup = cgrp_lookup },
+	VOPNAME_CREATE,		{ .vop_create = cgrp_create },
+	VOPNAME_REMOVE,		{ .vop_remove = cgrp_remove },
+	VOPNAME_LINK,		{ .vop_link = cgrp_link },
+	VOPNAME_RENAME,		{ .vop_rename = cgrp_rename },
+	VOPNAME_MKDIR,		{ .vop_mkdir = cgrp_mkdir },
+	VOPNAME_RMDIR,		{ .vop_rmdir = cgrp_rmdir },
+	VOPNAME_READDIR,	{ .vop_readdir = cgrp_readdir },
+	VOPNAME_SYMLINK,	{ .vop_symlink = cgrp_symlink },
+	VOPNAME_INACTIVE,	{ .vop_inactive = cgrp_inactive },
+	VOPNAME_RWLOCK,		{ .vop_rwlock = cgrp_rwlock },
+	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = cgrp_rwunlock },
+	VOPNAME_SEEK,		{ .vop_seek = cgrp_seek },
+	VOPNAME_PATHCONF,	{ .vop_pathconf = cgrp_pathconf },
+	VOPNAME_VNEVENT,	{ .vop_vnevent = fs_vnevent_support },
+	NULL,			NULL
+};
diff --git a/usr/src/uts/common/brand/lx/devfs/lxd.h b/usr/src/uts/common/brand/lx/devfs/lxd.h
new file mode 100644
index 0000000000..437b0b6162
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/devfs/lxd.h
@@ -0,0 +1,244 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_LXD_H
+#define	_LXD_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * lxd.h: declarations, data structures and macros for lxd (lxd devfs).
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/policy.h>
+#include <sys/dirent.h>
+#include <sys/errno.h>
+#include <sys/kmem.h>
+#include <sys/pathname.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/sysmacros.h>
+#include <sys/cred.h>
+#include <sys/priv.h>
+#include <sys/vnode.h>
+#include <sys/vfs.h>
+#include <sys/statvfs.h>
+#include <sys/cmn_err.h>
+#include <sys/zone.h>
+#include <sys/uio.h>
+#include <sys/utsname.h>
+#include <sys/atomic.h>
+#include <vm/anon.h>
+#include <sys/lx_types.h>
+
+#if defined(_KERNEL)
+
+#include <sys/lx_brand.h>
+
+/*
+ * It's unlikely that we need to create more than 50-60 subdirs/symlinks
+ * as front files so we size the file system hash for 2x that number.
+ * The back devfs typically has ~80 nodes so this is also a comfortable size
+ * for the back hash table.
+ */
+#define	LXD_HASH_SZ	128
+
+#define	LXD_BACK_HASH(v)	((((intptr_t)(v)) >> 10) & ((LXD_HASH_SZ) - 1))
+
+#define	LXD_NM_HASH(ldn, name, hash)				\
+	{							\
+		char Xc, *Xcp;					\
+		hash = (uint_t)(uintptr_t)(ldn) >> 8;		\
+		for (Xcp = (name); (Xc = *Xcp) != 0; Xcp++)	\
+			hash = (hash << 4) + hash + (uint_t)Xc;	\
+		hash &= (LXD_HASH_SZ - 1);			\
+	}
+
+
+enum lxd_node_type	{ LXDNT_NONE, LXDNT_BACK, LXDNT_FRONT };
+
+typedef struct lxd_dev_attr {
+	list_node_t	lxda_link;
+	char 		lxda_name[MAXPATHLEN];
+	uid_t 		lxda_uid;
+	gid_t 		lxda_gid;
+	mode_t 		lxda_mode;
+} lxd_dev_attr_t;
+
+/*
+ * lxd per-mount data structure.
+ *
+ * All fields are protected by lxd_contents.
+ * File renames on a specific file system are protected lxdm_renamelck.
+ */
+typedef struct lxd_mnt {
+	struct vfs	*lxdm_vfsp;	/* filesystem's vfs struct */
+	struct lxd_node *lxdm_rootnode;	/* root lxd_node */
+	char 		*lxdm_mntpath;	/* name of lxd mount point */
+	dev_t		lxdm_dev;	/* unique dev # of mounted `device' */
+	kmutex_t	lxdm_contents;	/* per-mount lock */
+	kmutex_t	lxdm_renamelck;	/* rename lock for this mount */
+	kmutex_t	lxdm_attrlck;	/* per-mount attr. file lock */
+	list_t		lxdm_devattrs;	/* list of device attr. settings */
+	uint_t		lxdm_gen;	/* node ID source for files */
+
+	/* protects buckets in both "dir ent" and "back" hash tables */
+	kmutex_t	lxdm_hash_mutex[LXD_HASH_SZ];
+
+	/* per-mount data for "back" vnodes in the fs */
+	uint_t		lxdm_back_refcnt; /* # outstanding "back" vnodes */
+	struct lxd_node *lxdm_back_htable[LXD_HASH_SZ];
+
+	/*
+	 * Per-mount directory data for "front" nodes in the fs.
+	 * Each front node has a directory entry but directory entries can live
+	 * on either front or back nodes.
+	 */
+	uint_t		lxdm_dent_refcnt; /* # outstanding dir ents */
+	struct lxd_dirent *lxdm_dent_htable[LXD_HASH_SZ];
+} lxd_mnt_t;
+
+/*
+ * lxd_node is the file system dependent node for lxd.
+ *
+ * The node is used to represent both front and back files. For front files
+ * the node can represent either a directory or symlink.
+ */
+typedef struct lxd_node {
+	enum lxd_node_type	lxdn_type;
+
+	/* Data for "front" nodes */
+	struct lxd_node		*lxdn_prev;	/* lnked lst of lxd nodes */
+	struct lxd_node		*lxdn_next;	/* lnked lst of lxd nodes */
+	struct lxd_node		*lxdn_parent;	/* dir containing this node */
+	krwlock_t		lxdn_rwlock;	/* serialize mods/dir updates */
+	kmutex_t		lxdn_tlock;	/* time, flag, and nlink lock */
+
+	/* these could be in a union ala tmpfs but not really necessary */
+	uint_t			lxdn_dirents;	/* number of dirents */
+	struct lxd_dirent	*lxdn_dir;	/* dirent list */
+	char			*lxdn_symlink;	/* pointer to symlink */
+	struct vattr		lxdn_attr;	/* attributes */
+
+	/* Hash table link */
+	struct lxd_node		*lxdn_hnxt;	/* link in per-mount entry */
+						/* hash table */
+	vnode_t 		*lxdn_vnode;	/* vnode for this lxd_node */
+
+	vnode_t			*lxdn_real_vp;	/* back file - real vnode */
+} lxd_node_t;
+
+/*
+ * Attributes
+ */
+#define	lxdn_mask	lxdn_attr.va_mask
+#define	lxdn_mode	lxdn_attr.va_mode
+#define	lxdn_uid	lxdn_attr.va_uid
+#define	lxdn_gid	lxdn_attr.va_gid
+#define	lxdn_fsid	lxdn_attr.va_fsid
+#define	lxdn_nodeid	lxdn_attr.va_nodeid
+#define	lxdn_nlink	lxdn_attr.va_nlink
+#define	lxdn_size	lxdn_attr.va_size
+#define	lxdn_atime	lxdn_attr.va_atime
+#define	lxdn_mtime	lxdn_attr.va_mtime
+#define	lxdn_ctime	lxdn_attr.va_ctime
+#define	lxdn_rdev	lxdn_attr.va_rdev
+#define	lxdn_blksize	lxdn_attr.va_blksize
+#define	lxdn_nblocks	lxdn_attr.va_nblocks
+#define	lxdn_seq	lxdn_attr.va_seq
+
+/*
+ * lx devfs conversion macros
+ */
+#define	VFSTOLXDM(vfsp)		((lxd_mnt_t *)(vfsp)->vfs_data)
+#define	VTOLXDM(vp)		((lxd_mnt_t *)(vp)->v_vfsp->vfs_data)
+#define	VTOLDN(vp)		((lxd_node_t *)(vp)->v_data)
+#define	LDNTOV(ln)		((ln)->lxdn_vnode)
+#define	ldnode_hold(ln)		VN_HOLD(LDNTOV(ln))
+#define	ldnode_rele(ln)		VN_RELE(LDNTOV(ln))
+
+#define	REALVP(vp)		(VTOLDN(vp)->lxdn_real_vp)
+
+/*
+ * front directories are made up of a linked list of lxd_dirent structures
+ * hanging off directory lxdn_nodes.  File names are not fixed length, but are
+ * null terminated.
+ */
+typedef struct lxd_dirent {
+	lxd_node_t		*lddir_node;	/* lxd node for this file */
+	struct lxd_dirent	*lddir_next;	/* next directory entry */
+	struct lxd_dirent	*lddir_prev;	/* prev directory entry */
+	uint_t			lddir_offset;	/* "offset" of dir entry */
+	uint_t			lddir_hash;	/* a hash of lddir_name */
+	struct lxd_dirent	*lddir_link;	/* linked via hash table */
+	lxd_node_t		*lddir_parent;	/* parent, dir we are in */
+	char			*lddir_name;	/* null terminated */
+} lxd_dirent_t;
+
+enum de_op	{ DE_CREATE, DE_MKDIR, DE_RENAME };	/* direnter ops */
+enum dr_op	{ DR_REMOVE, DR_RMDIR, DR_RENAME };	/* dirremove ops */
+
+typedef struct lxd_minor_translator {
+	char	*lxd_mt_path;		/* illumos minor node path */
+	minor_t	lxd_mt_minor;		/* illumos minor node number */
+	int	lxd_mt_lx_major;	/* linux major node number */
+	int	lxd_mt_lx_minor;	/* linux minor node number */
+} lxd_minor_translator_t;
+
+enum lxd_xl_tp	{ DTT_INVALID, DTT_LIST, DTT_CUSTOM };
+
+#define	xl_list		lxd_xl_minor.lxd_xl_list
+#define	xl_custom	lxd_xl_minor.lxd_xl_custom
+
+typedef struct lxd_devt_translator {
+	char		*lxd_xl_driver;	/* driver name */
+	major_t		lxd_xl_major;	/* driver number */
+
+	enum lxd_xl_tp	lxd_xl_type;	/* dictates how we intrep. xl_minor */
+	union {
+		uintptr_t		lxd_xl_foo; /* required to compile */
+		lxd_minor_translator_t	*lxd_xl_list;
+		void			(*lxd_xl_custom)(dev_t, dev_t *);
+	} lxd_xl_minor;
+} lxd_devt_translator_t;
+
+extern struct vnodeops *lxd_vnodeops;
+extern lxd_devt_translator_t lxd_devt_translators[];
+
+vnode_t *lxd_make_back_node(vnode_t *, lxd_mnt_t *);
+void lxd_free_back_node(lxd_node_t *);
+int lxd_dirdelete(lxd_node_t *, lxd_node_t *, char *, enum dr_op, cred_t *);
+int lxd_direnter(lxd_mnt_t *, lxd_node_t *, char *, enum de_op, lxd_node_t *,
+	lxd_node_t *, struct vattr *, lxd_node_t **, cred_t *);
+void lxd_dirinit(lxd_node_t *, lxd_node_t *);
+int lxd_dirlookup(lxd_node_t *, char *, lxd_node_t **, cred_t *);
+void lxd_dirtrunc(lxd_node_t *);
+void lxd_node_init(lxd_mnt_t *, lxd_node_t *, vnode_t *, vattr_t *, cred_t *);
+int lxd_naccess(void *, int, cred_t *);
+
+void lxd_save_attrs(lxd_mnt_t *, vnode_t *);
+void lxd_apply_db(lxd_mnt_t *);
+
+#endif /* KERNEL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _LXD_H */
diff --git a/usr/src/uts/common/brand/lx/devfs/lxd_attrdb.c b/usr/src/uts/common/brand/lx/devfs/lxd_attrdb.c
new file mode 100644
index 0000000000..02d396a36d
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/devfs/lxd_attrdb.c
@@ -0,0 +1,368 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/vnode.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/cred.h>
+#include <sys/pathname.h>
+#include <sys/debug.h>
+#include <sys/sdt.h>
+#include <fs/fs_subr.h>
+
+#include "lxd.h"
+
+#define	LX_ATTR_FILE		"/etc/.lxd_dev_attr"
+
+#define	RD_BUFSIZE	MAXPATHLEN
+#define	ENTRY_BUFSIZE	(MAXPATHLEN + 32)
+
+static int
+lxd_db_open(int fmode, vnode_t **vpp)
+{
+	return (vn_open(LX_ATTR_FILE, UIO_SYSSPACE, fmode,
+	    (int)(0644 & MODEMASK), vpp, CRCREAT, PTOU(curproc)->u_cmask));
+}
+
+static int
+lxd_wr_entry(vnode_t *wvn, off_t offset, char *entry)
+{
+	int len, err;
+	struct uio auio;
+	struct iovec aiov;
+
+	len = strlen(entry);
+	aiov.iov_base = entry;
+	aiov.iov_len = len;
+
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = offset;
+	auio.uio_segflg = UIO_SYSSPACE;
+	auio.uio_resid = len;
+	auio.uio_llimit = curproc->p_fsz_ctl;
+	auio.uio_fmode = FWRITE;
+	auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	(void) VOP_RWLOCK(wvn, V_WRITELOCK_TRUE, NULL);
+	err = VOP_WRITE(wvn, &auio, FAPPEND, CRED(), NULL);
+	VOP_RWUNLOCK(wvn, V_WRITELOCK_TRUE, NULL);
+
+	if (err != 0)
+		return (0);
+	return (len);
+}
+
+/*
+ * Given an entry, apply a uid, gid and mode change to the given device. There
+ * is no strtok in the kernel but it's easy to tokenize the entry ourselves.
+ *
+ * entries have the form (newline removed by caller):
+ * path uid gid mode\0
+ */
+static int
+lxd_apply_entry(char *entry, char **dpath, uid_t *uidp, gid_t *gidp,
+    mode_t *modep)
+{
+	char *dp, *up, *gp, *mp, *ep;
+	long uid, gid, mode;
+	int error, res = 0;
+	vnode_t *vp;
+	vattr_t va;
+
+	dp = entry;
+
+	/* find and delimit the first field (device name) */
+	for (up = dp; *up != ' ' && *up != '\0'; up++)
+		;
+	if (*up != ' ')
+		return (-1);
+	*up++ = '\0';
+
+	/* find and delimit the second field (uid) */
+	for (gp = up; *gp != ' ' && *gp != '\0'; gp++)
+		;
+	if (*gp != ' ')
+		return (-1);
+	*gp++ = '\0';
+
+	/* find and delimit the third field (gid) */
+	for (mp = gp; *mp != ' ' && *mp != '\0'; mp++)
+		;
+	if (*mp != ' ')
+		return (-1);
+	*mp++ = '\0';
+
+	/* validate the fourth field (mode) */
+	ep = mp + strlen(mp);
+	if (*ep != '\0')
+		return (-1);
+
+	if (*dp != '/')
+		return (-1);
+
+	error = ddi_strtol(up, &ep, 10, &uid);
+	if (error != 0 || *ep != '\0' || uid > MAXUID || uid < 0)
+		return (-1);
+
+	error = ddi_strtol(gp, &ep, 10, &gid);
+	if (error != 0 || *ep != '\0' || gid > MAXUID || gid < 0)
+		return (-1);
+
+	/* note that the mode is octal */
+	error = ddi_strtol(mp, &ep, 8, &mode);
+	if (error != 0 || *ep != '\0' || mode > 0777 || mode < 0)
+		return (-1);
+
+	if (lookupname(dp, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp) != 0) {
+		/*
+		 * It's likely the device is no longer visible to the zone.
+		 * No matter the reason, we indicate failure.
+		 */
+		return (-1);
+	}
+
+	va.va_mask =  AT_UID | AT_GID | AT_MODE;
+	va.va_uid = (uid_t)uid;
+	va.va_gid = (gid_t)gid;
+	va.va_mode = (mode_t)mode;
+
+	if (VOP_SETATTR(vp, &va, 0, CRED(), NULL) != 0)
+		res = -1;
+
+	VN_RELE(vp);
+
+	*dpath = dp;
+	*uidp = (uid_t)uid;
+	*gidp = (gid_t)gid;
+	*modep = (mode_t)mode;
+	return (res);
+}
+
+/*
+ * Return true if this is a pre-existing record.
+ */
+static boolean_t
+lxd_save_devattr(lxd_mnt_t *lxdm, char *dpath, uid_t uid, gid_t gid,
+    mode_t mode)
+{
+	lxd_dev_attr_t *da;
+
+	da = list_head(&lxdm->lxdm_devattrs);
+	while (da != NULL) {
+		if (strcmp(dpath, da->lxda_name) == 0) {
+			da->lxda_uid = uid;
+			da->lxda_gid = gid;
+			da->lxda_mode = mode;
+			return (B_TRUE);
+		}
+		da = list_next(&lxdm->lxdm_devattrs, da);
+	}
+
+	da = kmem_zalloc(sizeof (lxd_dev_attr_t), KM_SLEEP);
+	(void) strlcpy(da->lxda_name, dpath, sizeof (da->lxda_name));
+	da->lxda_uid = uid;
+	da->lxda_gid = gid;
+	da->lxda_mode = mode;
+
+	list_insert_tail(&lxdm->lxdm_devattrs, da);
+	return (B_FALSE);
+}
+
+static void
+lxd_save_db(lxd_mnt_t *lxdm)
+{
+	lxd_dev_attr_t *da;
+	char *entry;
+	vnode_t *wvn;
+	off_t woff = 0;
+
+	if (list_is_empty(&lxdm->lxdm_devattrs)) {
+		/* The attribute file is no longer needed. */
+		(void) vn_remove(LX_ATTR_FILE, UIO_SYSSPACE, RMFILE);
+		return;
+	}
+
+	if (lxd_db_open(FWRITE | FCREAT | FTRUNC, &wvn) != 0)
+		return;
+
+	entry = kmem_alloc(ENTRY_BUFSIZE, KM_SLEEP);
+
+	woff = lxd_wr_entry(wvn, woff, "# DO NOT EDIT: this file is "
+	    "automatically maintained for lx container devices\n");
+
+	da = list_head(&lxdm->lxdm_devattrs);
+	while (da != NULL) {
+		(void) snprintf(entry, ENTRY_BUFSIZE, "%s %d %d %o\n",
+		    da->lxda_name, da->lxda_uid, da->lxda_gid,
+		    da->lxda_mode & 0777);
+		woff += lxd_wr_entry(wvn, woff, entry);
+		da = list_next(&lxdm->lxdm_devattrs, da);
+	}
+
+	(void) VOP_CLOSE(wvn, FWRITE, 1, woff, CRED(), NULL);
+
+	kmem_free(entry, ENTRY_BUFSIZE);
+}
+
+/*
+ * This function records the uid, gid and mode information for an lx devfs
+ * block device node after a chown/chmod setattr operation so that these
+ * changes can be persistent across reboots. Since the actual setattr has
+ * already suceeded, the tracking of these changes is done on a "best effort"
+ * basis. That is, if we fail to record the change for some reason, the setattr
+ * will still return success. The vp passed in is the "real vp" for the back
+ * device node.
+ */
+void
+lxd_save_attrs(lxd_mnt_t *lxdm, vnode_t *vp)
+{
+	vattr_t va;
+	char devpath[MAXPATHLEN];
+
+	/* the path returned is relative to the zone's root */
+	if (vnodetopath(curproc->p_zone->zone_rootvp, vp, devpath,
+	    sizeof (devpath), CRED()) != 0)
+		return;
+
+	va.va_mask = AT_MODE | AT_UID | AT_GID;
+
+	/*
+	 * We just set attrs, so the getattr shouldn't fail. If the device
+	 * is not a block device we don't persist the change.
+	 */
+	if (VOP_GETATTR(vp, &va, 0, CRED(), NULL) != 0 ||
+	    ((va.va_mode & S_IFBLK) != S_IFBLK))
+		return;
+
+	/*
+	 * We serialize all updates to the attribute DB file. In practice this
+	 * should not be a problem since there is rarely concurrent device
+	 * file mode changes.
+	 */
+	mutex_enter(&lxdm->lxdm_attrlck);
+
+	(void) lxd_save_devattr(lxdm, devpath, va.va_uid, va.va_gid,
+	    va.va_mode & 0777);
+	lxd_save_db(lxdm);
+
+	mutex_exit(&lxdm->lxdm_attrlck);
+}
+
+/*
+ * Re-apply the persistent attribute settings to the devices when this lx
+ * devfs is mounted. As with lxd_save_attrs, this is done on a best effort and
+ * we won't prevent the mount if there is a problem. No locking is needed
+ * while reading the DB file since this action is performed during the
+ * mount of the devfs.
+ */
+void
+lxd_apply_db(lxd_mnt_t *lxdm)
+{
+	vnode_t *rvn;
+	char *buf, *entry, *bp, *ep;
+	struct uio auio;
+	struct iovec aiov;
+	size_t cnt, len, ecnt, roff;
+	char *devpath;
+	uid_t uid;
+	gid_t gid;
+	mode_t mode;
+	boolean_t needs_update = B_FALSE;
+
+	if (lxd_db_open(FREAD, &rvn) != 0)
+		return;
+
+	buf = kmem_alloc(RD_BUFSIZE, KM_SLEEP);
+	entry = kmem_alloc(ENTRY_BUFSIZE, KM_SLEEP);
+
+	roff = 0;
+	ep = entry;
+	ecnt = 0;
+	(void) VOP_RWLOCK(rvn, V_WRITELOCK_FALSE, NULL);
+loop:
+	aiov.iov_base = buf;
+	aiov.iov_len = RD_BUFSIZE;
+
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = roff;
+	auio.uio_segflg = UIO_SYSSPACE;
+	auio.uio_resid = RD_BUFSIZE;
+	auio.uio_fmode = 0;
+	auio.uio_extflg = UIO_COPY_CACHED;
+
+	(void) VOP_READ(rvn, &auio, 0, CRED(), NULL);
+
+	len = RD_BUFSIZE - auio.uio_resid;
+	roff += len;
+
+	if (len > 0) {
+		for (bp = buf, cnt = 0; cnt < len; bp++, cnt++) {
+
+			/*
+			 * We have an improperly formed entry in the file (too
+			 * long). In an attempt to recover we reset the entry
+			 * pointer so we can read the rest of the line and try
+			 * to absorb the bad line. The code in lxd_apply_entry
+			 * will handle any malformed or inapplicable entries.
+			 */
+			if (ecnt >= (ENTRY_BUFSIZE - 1)) {
+				ep = entry;
+				ecnt = 0;
+				needs_update = B_TRUE;
+			}
+
+			if (*bp == '\n') {
+				*ep = '\0';
+
+				/* skip comments */
+				if (entry[0] != '#') {
+					if (lxd_apply_entry(entry, &devpath,
+					    &uid, &gid, &mode) != 0 ||
+					    lxd_save_devattr(lxdm, devpath,
+					    uid, gid, mode)) {
+						/*
+						 * An invalid entry, a
+						 * non-existent device node or
+						 * a duplicate entry.
+						 */
+						needs_update = B_TRUE;
+					}
+				}
+				ep = entry;
+				ecnt = 0;
+			} else {
+				*ep++ = *bp;
+				ecnt++;
+			}
+		}
+		goto loop;
+	}
+	VOP_RWUNLOCK(rvn, V_WRITELOCK_FALSE, NULL);
+
+	kmem_free(buf, RD_BUFSIZE);
+	kmem_free(entry, ENTRY_BUFSIZE);
+
+	(void) VOP_CLOSE(rvn, FREAD, 1, 0, CRED(), NULL);
+
+	if (needs_update)
+		lxd_save_db(lxdm);
+}
diff --git a/usr/src/uts/common/brand/lx/devfs/lxd_node.c b/usr/src/uts/common/brand/lx/devfs/lxd_node.c
new file mode 100644
index 0000000000..0d056ab167
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/devfs/lxd_node.c
@@ -0,0 +1,1003 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/time.h>
+#include <sys/vfs.h>
+#include <sys/vnode.h>
+#include <sys/errno.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/stat.h>
+#include <sys/mode.h>
+#include <sys/policy.h>
+#include <sys/sdt.h>
+
+#include "lxd.h"
+
+#define	LXD_HASH_SIZE	8192		/* must be power of 2 */
+#define	LXD_MUTEX_SIZE	64
+
+
+#define	MODESHIFT	3
+
+typedef enum lxd_nodehold {
+	NOHOLD,
+	HOLD
+} lxd_nodehold_t;
+
+/*
+ * The following functions maintain the per-mount "front" files.
+ */
+static void
+lxd_save_dirent(lxd_dirent_t *de)
+{
+	lxd_mnt_t	*lxdm = VTOLXDM(LDNTOV(de->lddir_parent));
+	uint_t		hash;
+	kmutex_t	*hmtx;
+
+	LXD_NM_HASH(de->lddir_parent, de->lddir_name, hash);
+	de->lddir_hash = hash;
+
+	hmtx = &lxdm->lxdm_hash_mutex[hash];
+
+	mutex_enter(hmtx);
+	ASSERT(de->lddir_link == NULL);
+	de->lddir_link = lxdm->lxdm_dent_htable[hash];
+	lxdm->lxdm_dent_htable[hash] = de;
+	mutex_exit(hmtx);
+
+	atomic_inc_32(&lxdm->lxdm_dent_refcnt);
+}
+
+static void
+lxd_rm_dirent(lxd_dirent_t *de)
+{
+	lxd_mnt_t	*lxdm = VTOLXDM(LDNTOV(de->lddir_parent));
+	uint_t		hash;
+	lxd_dirent_t	**prevpp;
+	kmutex_t	*hmtx;
+
+	hash = de->lddir_hash;
+	hmtx = &lxdm->lxdm_hash_mutex[hash];
+
+	mutex_enter(hmtx);
+	prevpp = &lxdm->lxdm_dent_htable[hash];
+	while (*prevpp != de)
+		prevpp = &(*prevpp)->lddir_link;
+	*prevpp = de->lddir_link;
+	de->lddir_link = NULL;
+	mutex_exit(hmtx);
+
+	ASSERT(lxdm->lxdm_dent_refcnt > 0);
+	atomic_dec_32(&lxdm->lxdm_dent_refcnt);
+}
+
+static lxd_dirent_t *
+lxd_find_dirent(char *name, lxd_node_t *parent, lxd_nodehold_t do_hold,
+    lxd_node_t **found)
+{
+	lxd_mnt_t	*lxdm = VTOLXDM(LDNTOV(parent));
+	lxd_dirent_t	*de;
+	uint_t		hash;
+	kmutex_t	*hmtx;
+
+	LXD_NM_HASH(parent, name, hash);
+	hmtx = &lxdm->lxdm_hash_mutex[hash];
+
+	mutex_enter(hmtx);
+	de = lxdm->lxdm_dent_htable[hash];
+	while (de) {
+		if (de->lddir_hash == hash && de->lddir_parent == parent &&
+		    strcmp(de->lddir_name, name) == 0) {
+			lxd_node_t *ldn = de->lddir_node;
+
+			if (do_hold == HOLD) {
+				ASSERT(ldn != NULL);
+				ldnode_hold(ldn);
+			}
+			if (found != NULL)
+				*found = ldn;
+			mutex_exit(hmtx);
+			return (de);
+		}
+
+		de = de->lddir_link;
+	}
+	mutex_exit(hmtx);
+	return (NULL);
+}
+
+int
+lxd_naccess(void *vcp, int mode, cred_t *cr)
+{
+	lxd_node_t *ldn = vcp;
+	int shift = 0;
+	/*
+	 * Check access based on owner, group and public perms in lxd_node.
+	 */
+	if (crgetuid(cr) != ldn->lxdn_uid) {
+		shift += MODESHIFT;
+		if (groupmember(ldn->lxdn_gid, cr) == 0)
+			shift += MODESHIFT;
+	}
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (secpolicy_vnode_access2(cr, LDNTOV(ldn),
+		    ldn->lxdn_uid, ldn->lxdn_mode << shift, mode));
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	return (VOP_ACCESS(ldn->lxdn_real_vp, mode, 0, cr, NULL));
+}
+
+static lxd_node_t *
+lxd_find_back(struct vnode *vp, uint_t hash, lxd_mnt_t *lxdm)
+{
+	lxd_node_t *l;
+
+	ASSERT(MUTEX_HELD(&lxdm->lxdm_hash_mutex[hash]));
+
+	for (l = lxdm->lxdm_back_htable[hash]; l != NULL; l = l->lxdn_hnxt) {
+		if (l->lxdn_real_vp == vp) {
+			ASSERT(l->lxdn_type == LXDNT_BACK);
+
+			VN_HOLD(LDNTOV(l));
+			return (l);
+		}
+	}
+	return (NULL);
+}
+
+static void
+lxd_save_back(lxd_node_t *l, uint_t hash, lxd_mnt_t *lxdm)
+{
+	ASSERT(l->lxdn_type == LXDNT_BACK);
+	ASSERT(l->lxdn_real_vp != NULL);
+	ASSERT(MUTEX_HELD(&lxdm->lxdm_hash_mutex[hash]));
+
+	atomic_inc_32(&lxdm->lxdm_back_refcnt);
+
+	l->lxdn_hnxt = lxdm->lxdm_back_htable[hash];
+	lxdm->lxdm_back_htable[hash] = l;
+}
+
+
+struct vnode *
+lxd_make_back_node(struct vnode *vp, lxd_mnt_t *lxdm)
+{
+	uint_t hash;
+	kmutex_t *hmtx;
+	lxd_node_t *l;
+
+	hash = LXD_BACK_HASH(vp);	/* Note: hashing with realvp */
+	hmtx = &lxdm->lxdm_hash_mutex[hash];
+	mutex_enter(hmtx);
+
+	l = lxd_find_back(vp, hash, lxdm);
+	if (l == NULL) {
+		vnode_t *nvp;
+
+		l = kmem_zalloc(sizeof (lxd_node_t), KM_SLEEP);
+		nvp = vn_alloc(KM_SLEEP);
+
+		rw_init(&l->lxdn_rwlock, NULL, RW_DEFAULT, NULL);
+		mutex_init(&l->lxdn_tlock, NULL, MUTEX_DEFAULT, NULL);
+
+		l->lxdn_vnode = nvp;
+		l->lxdn_type = LXDNT_BACK;
+		l->lxdn_real_vp = vp;
+
+		VN_SET_VFS_TYPE_DEV(nvp, lxdm->lxdm_vfsp, vp->v_type,
+		    vp->v_rdev);
+		nvp->v_flag |= (vp->v_flag & (VNOMOUNT|VNOMAP|VDIROPEN));
+		vn_setops(nvp, lxd_vnodeops);
+		nvp->v_data = (caddr_t)l;
+
+		lxd_save_back(l, hash, lxdm);
+		vn_exists(vp);
+	} else {
+		VN_RELE(vp);
+	}
+
+	mutex_exit(hmtx);
+	return (LDNTOV(l));
+}
+
+void
+lxd_free_back_node(lxd_node_t *lp)
+{
+	uint_t hash;
+	kmutex_t *hmtx;
+	lxd_node_t *l;
+	lxd_node_t *lprev = NULL;
+	vnode_t *vp = LDNTOV(lp);
+	vnode_t *realvp = REALVP(vp);
+	lxd_mnt_t *lxdm = VTOLXDM(vp);
+
+	/* in lxd_make_back_node we call lxd_find_back with the realvp */
+	hash = LXD_BACK_HASH(realvp);
+	hmtx = &lxdm->lxdm_hash_mutex[hash];
+	mutex_enter(hmtx);
+
+	mutex_enter(&vp->v_lock);
+	if (vp->v_count > 1) {
+		vp->v_count--;	/* release our hold from vn_rele */
+		mutex_exit(&vp->v_lock);
+		mutex_exit(hmtx);
+		return;
+	}
+	mutex_exit(&vp->v_lock);
+
+	for (l = lxdm->lxdm_back_htable[hash]; l != NULL;
+	    lprev = l, l = l->lxdn_hnxt) {
+
+		if (l != lp)
+			continue;
+
+		ASSERT(l->lxdn_type == LXDNT_BACK);
+		ASSERT(lxdm->lxdm_back_refcnt > 0);
+
+		atomic_dec_32(&lxdm->lxdm_back_refcnt);
+		vn_invalid(vp);
+
+		if (lprev == NULL) {
+			lxdm->lxdm_back_htable[hash] = l->lxdn_hnxt;
+		} else {
+			lprev->lxdn_hnxt = l->lxdn_hnxt;
+		}
+
+		mutex_exit(hmtx);
+		rw_destroy(&l->lxdn_rwlock);
+		mutex_destroy(&l->lxdn_tlock);
+		kmem_free(l, sizeof (lxd_node_t));
+		vn_free(vp);
+		VN_RELE(realvp);
+		return;
+	}
+
+	panic("lxd_free_back_node");
+	/*NOTREACHED*/
+}
+/*
+ * Search directory 'parent' for entry 'name'.
+ *
+ * 0 is returned on success and *foundcp points
+ * to the found lxd_node with its vnode held.
+ */
+int
+lxd_dirlookup(lxd_node_t *parent, char *name, lxd_node_t **foundnp, cred_t *cr)
+{
+	int error;
+
+	*foundnp = NULL;
+	if (parent->lxdn_vnode->v_type != VDIR)
+		return (ENOTDIR);
+
+	if ((error = lxd_naccess(parent, VEXEC, cr)))
+		return (error);
+
+	if (*name == '\0') {
+		ldnode_hold(parent);
+		*foundnp = parent;
+		return (0);
+	}
+
+	/*
+	 * Search the directory for the matching name
+	 * We need the lock protecting the lxdn_dir list
+	 * so that it doesn't change out from underneath us.
+	 * lxd_find_dirent() will pass back the lxd_node
+	 * with a hold on it.
+	 */
+
+	if (lxd_find_dirent(name, parent, HOLD, foundnp) != NULL) {
+		ASSERT(*foundnp);
+		return (0);
+	}
+
+	return (ENOENT);
+}
+
+/*
+ * Check if the source directory is in the path of the target directory.
+ * The target directory is locked by the caller.
+ */
+static int
+lxd_dircheckpath(lxd_node_t *fromnode, lxd_node_t *toparent)
+{
+	int error = 0;
+	lxd_node_t *dir, *dotdot;
+
+	ASSERT(RW_WRITE_HELD(&toparent->lxdn_rwlock));
+	ASSERT(toparent->lxdn_vnode->v_type == VDIR);
+
+	dotdot = toparent->lxdn_parent;
+	if (dotdot == NULL)
+		return (ENOENT);
+	ldnode_hold(dotdot);
+
+	if (dotdot == toparent) {
+		/* root of fs.  search trivially satisfied. */
+		ldnode_rele(dotdot);
+		return (0);
+	}
+
+	for (;;) {
+		/*
+		 * Return error for cases like "mv c c/d",
+		 * "mv c c/d/e" and so on.
+		 */
+		if (dotdot == fromnode) {
+			ldnode_rele(dotdot);
+			error = EINVAL;
+			break;
+		}
+
+		dir = dotdot;
+		dotdot = dir->lxdn_parent;
+		if (dotdot == NULL) {
+			ldnode_rele(dir);
+			error = ENOENT;
+			break;
+		}
+		ldnode_hold(dotdot);
+
+		/*
+		 * We're okay if we traverse the directory tree up to
+		 * the root directory and don't run into the
+		 * parent directory.
+		 */
+		if (dir == dotdot) {
+			ldnode_rele(dir);
+			ldnode_rele(dotdot);
+			break;
+		}
+		ldnode_rele(dir);
+	}
+
+	return (error);
+}
+
+static int
+lxd_dir_make_node(lxd_node_t *dir, lxd_mnt_t *lxdm, struct vattr *va,
+    enum de_op op, lxd_node_t **newnode, struct cred *cred)
+{
+	lxd_node_t *ldn;
+
+	ASSERT(va != NULL);
+
+	if (((va->va_mask & AT_ATIME) && TIMESPEC_OVERFLOW(&va->va_atime)) ||
+	    ((va->va_mask & AT_MTIME) && TIMESPEC_OVERFLOW(&va->va_mtime)))
+		return (EOVERFLOW);
+
+	ldn = kmem_zalloc(sizeof (lxd_node_t), KM_SLEEP);
+
+	ldn->lxdn_type = LXDNT_FRONT;
+	lxd_node_init(lxdm, ldn, NULL, va, cred);
+
+	ldn->lxdn_vnode->v_rdev = ldn->lxdn_rdev = NODEV;
+	ldn->lxdn_vnode->v_type = va->va_type;
+	ldn->lxdn_uid = crgetuid(cred);
+	ldn->lxdn_gid = crgetgid(cred);
+	ldn->lxdn_nodeid = lxdm->lxdm_gen++;
+
+	if (va->va_mask & AT_ATIME)
+		ldn->lxdn_atime = va->va_atime;
+	if (va->va_mask & AT_MTIME)
+		ldn->lxdn_mtime = va->va_mtime;
+
+	if (op == DE_MKDIR) {
+		lxd_dirinit(dir, ldn);
+	}
+
+	*newnode = ldn;
+	return (0);
+}
+
+static int
+lxd_diraddentry(lxd_node_t *dir, lxd_node_t *ldn, char *name)
+{
+	lxd_dirent_t	*dp, *pdp;
+	size_t		namelen, alloc_size;
+	timestruc_t	now;
+
+	/*
+	 * Make sure the parent directory wasn't removed from
+	 * underneath the caller.
+	 */
+	if (dir->lxdn_dir == NULL)
+		return (ENOENT);
+
+	/* Check that everything is on the same filesystem. */
+	if (ldn->lxdn_vnode->v_vfsp != dir->lxdn_vnode->v_vfsp)
+		return (EXDEV);
+
+	/* Allocate and initialize directory entry */
+	namelen = strlen(name) + 1;
+	alloc_size = namelen + sizeof (lxd_dirent_t);
+	dp = kmem_zalloc(alloc_size, KM_NOSLEEP | KM_NORMALPRI);
+	if (dp == NULL)
+		return (ENOSPC);
+
+	ldn->lxdn_parent = dir;
+
+	dir->lxdn_size += alloc_size;
+	dir->lxdn_dirents++;
+	dp->lddir_node = ldn;
+	dp->lddir_parent = dir;
+
+	/* The directory entry and its name were allocated sequentially. */
+	dp->lddir_name = (char *)dp + sizeof (lxd_dirent_t);
+	(void) strcpy(dp->lddir_name, name);
+
+	lxd_save_dirent(dp);
+
+	/*
+	 * Some utilities expect the size of a directory to remain
+	 * somewhat static.  For example, a routine which removes
+	 * subdirectories between calls to readdir(); the size of the
+	 * directory changes from underneath it and so the real
+	 * directory offset in bytes is invalid.  To circumvent
+	 * this problem, we initialize a directory entry with an
+	 * phony offset, and use this offset to determine end of
+	 * file in lxd_readdir.
+	 */
+	pdp = dir->lxdn_dir->lddir_prev;
+	/*
+	 * Install at first empty "slot" in directory list.
+	 */
+	while (pdp->lddir_next != NULL &&
+	    (pdp->lddir_next->lddir_offset - pdp->lddir_offset) <= 1) {
+		ASSERT(pdp->lddir_next != pdp);
+		ASSERT(pdp->lddir_prev != pdp);
+		ASSERT(pdp->lddir_next->lddir_offset > pdp->lddir_offset);
+		pdp = pdp->lddir_next;
+	}
+	dp->lddir_offset = pdp->lddir_offset + 1;
+
+	/*
+	 * If we're at the end of the dirent list and the offset (which
+	 * is necessarily the largest offset in this directory) is more
+	 * than twice the number of dirents, that means the directory is
+	 * 50% holes.  At this point we reset the slot pointer back to
+	 * the beginning of the directory so we start using the holes.
+	 * The idea is that if there are N dirents, there must also be
+	 * N holes, so we can satisfy the next N creates by walking at
+	 * most 2N entries; thus the average cost of a create is constant.
+	 * Note that we use the first dirent's lddir_prev as the roving
+	 * slot pointer; it's ugly, but it saves a word in every dirent.
+	 */
+	if (pdp->lddir_next == NULL &&
+	    pdp->lddir_offset > 2 * dir->lxdn_dirents)
+		dir->lxdn_dir->lddir_prev = dir->lxdn_dir->lddir_next;
+	else
+		dir->lxdn_dir->lddir_prev = dp;
+
+	ASSERT(pdp->lddir_next != pdp);
+	ASSERT(pdp->lddir_prev != pdp);
+
+	dp->lddir_next = pdp->lddir_next;
+	if (dp->lddir_next) {
+		dp->lddir_next->lddir_prev = dp;
+	}
+	dp->lddir_prev = pdp;
+	pdp->lddir_next = dp;
+
+	ASSERT(dp->lddir_next != dp);
+	ASSERT(dp->lddir_prev != dp);
+	ASSERT(pdp->lddir_next != pdp);
+	ASSERT(pdp->lddir_prev != pdp);
+
+	gethrestime(&now);
+	dir->lxdn_mtime = now;
+	dir->lxdn_ctime = now;
+
+	return (0);
+}
+
+/*
+ * Enter a directory entry for 'name' into directory 'dir'
+ *
+ * Returns 0 on success.
+ */
+int
+lxd_direnter(
+	lxd_mnt_t	*lxdm,
+	lxd_node_t	*dir,		/* target directory to make entry in */
+	char		*name,		/* name of entry */
+	enum de_op	op,		/* entry operation */
+	lxd_node_t	*fromparent,    /* original directory if rename */
+	lxd_node_t	*ldn,		/* existing lxd_node, if rename */
+	struct vattr	*va,
+	lxd_node_t	**rnp,		/* return lxd_node, if create/mkdir */
+	cred_t		*cr)
+{
+	lxd_dirent_t *dirp;
+	lxd_node_t *found = NULL;
+	int error = 0;
+	char *s;
+
+	/* lxdn_rwlock is held to serialize direnter and dirdeletes */
+	ASSERT(RW_WRITE_HELD(&dir->lxdn_rwlock));
+	ASSERT(dir->lxdn_vnode->v_type == VDIR);
+
+	/*
+	 * Don't allow '/' characters in pathname component,
+	 */
+	for (s = name; *s; s++)
+		if (*s == '/')
+			return (EACCES);
+
+	if (name[0] == '\0')
+		panic("lxd_direnter: NULL name");
+
+	/*
+	 * For rename lock the source entry and check the link count
+	 * to see if it has been removed while it was unlocked.
+	 */
+	if (op == DE_RENAME) {
+		mutex_enter(&ldn->lxdn_tlock);
+		if (ldn->lxdn_nlink == 0) {
+			mutex_exit(&ldn->lxdn_tlock);
+			return (ENOENT);
+		}
+
+		if (ldn->lxdn_nlink == MAXLINK) {
+			mutex_exit(&ldn->lxdn_tlock);
+			return (EMLINK);
+		}
+		ldn->lxdn_nlink++;
+		gethrestime(&ldn->lxdn_ctime);
+		mutex_exit(&ldn->lxdn_tlock);
+	}
+
+	/*
+	 * This might be a "dangling detached directory" (it could have been
+	 * removed, but a reference to it kept in u_cwd). Don't bother
+	 * searching it, and with any luck the user will get tired of dealing
+	 * with us and cd to some absolute pathway (thus in ufs, too).
+	 */
+	if (dir->lxdn_nlink == 0) {
+		error = ENOENT;
+		goto out;
+	}
+
+	/*
+	 * If this is a rename of a directory and the parent is different
+	 * (".." must be changed), then the source directory must not be in the
+	 * directory hierarchy above the target, as this would orphan
+	 * everything below the source directory.
+	 */
+	if (op == DE_RENAME) {
+		if (ldn == dir) {
+			error = EINVAL;
+			goto out;
+		}
+		if ((ldn->lxdn_vnode->v_type) == VDIR) {
+			if ((fromparent != dir) &&
+			    (error = lxd_dircheckpath(ldn, dir)) != 0) {
+				goto out;
+			}
+		}
+	}
+
+	/* Search for an existing entry. */
+	dirp = lxd_find_dirent(name, dir, HOLD, &found);
+	if (dirp != NULL) {
+		ASSERT(found != NULL);
+		switch (op) {
+		case DE_CREATE:
+		case DE_MKDIR:
+			if (rnp != NULL) {
+				*rnp = found;
+				error = EEXIST;
+			} else {
+				ldnode_rele(found);
+			}
+			break;
+
+		case DE_RENAME:
+			/*
+			 * Note that we only hit this path when we're renaming
+			 * a symlink from one directory to another and there is
+			 * a pre-existing symlink as the target. lxd_rename
+			 * will unlink the src from the original directory but
+			 * here we need to unlink the dest that we collided
+			 * with, then create the new directory entry as we do
+			 * below when there is no pre-existing symlink.
+			 */
+			if ((error = lxd_naccess(dir, VWRITE, cr)) != 0)
+				goto out;
+
+			ASSERT(found->lxdn_vnode->v_type == VLNK);
+			/* dir rw lock is already held and asserted above */
+			rw_enter(&found->lxdn_rwlock, RW_WRITER);
+			error = lxd_dirdelete(dir, found, name, DR_RENAME, cr);
+			rw_exit(&found->lxdn_rwlock);
+			ldnode_rele(found);
+			if (error != 0)
+				goto out;
+
+			error = lxd_diraddentry(dir, ldn, name);
+			if (error == 0 && rnp != NULL)
+				*rnp = ldn;
+			break;
+		}
+	} else {
+
+		/*
+		 * The directory entry does not exist, but the node might if
+		 * this is a rename. Check write permission in directory to
+		 * see if entry can be created.
+		 */
+		if ((error = lxd_naccess(dir, VWRITE, cr)) != 0)
+			goto out;
+		if (op == DE_CREATE || op == DE_MKDIR) {
+			/*
+			 * Make new lxd_node and directory entry as required.
+			 */
+			error = lxd_dir_make_node(dir, lxdm, va, op, &ldn, cr);
+			if (error)
+				goto out;
+		}
+
+		error = lxd_diraddentry(dir, ldn, name);
+		if (error != 0) {
+			if (op == DE_CREATE || op == DE_MKDIR) {
+				/*
+				 * Unmake the inode we just made.
+				 */
+				rw_enter(&ldn->lxdn_rwlock, RW_WRITER);
+				if ((ldn->lxdn_vnode->v_type) == VDIR) {
+					ASSERT(dirp == NULL);
+					/*
+					 * cleanup allocs made by lxd_dirinit
+					 */
+					lxd_dirtrunc(ldn);
+				}
+				mutex_enter(&ldn->lxdn_tlock);
+				ldn->lxdn_nlink = 0;
+				gethrestime(&ldn->lxdn_ctime);
+				mutex_exit(&ldn->lxdn_tlock);
+				rw_exit(&ldn->lxdn_rwlock);
+				ldnode_rele(ldn);
+				ldn = NULL;
+			}
+		} else if (rnp != NULL) {
+			*rnp = ldn;
+		} else if (op == DE_CREATE || op == DE_MKDIR) {
+			ldnode_rele(ldn);
+		}
+	}
+
+out:
+	if (error && op == DE_RENAME) {
+		/* Undo bumped link count. */
+		mutex_enter(&ldn->lxdn_tlock);
+		ldn->lxdn_nlink--;
+		gethrestime(&ldn->lxdn_ctime);
+		mutex_exit(&ldn->lxdn_tlock);
+	}
+	return (error);
+}
+
+/*
+ * Delete entry ldn of name "nm" from parent dir. This is used to both remove
+ * a directory and to remove file nodes within the directory (by recursively
+ * calling itself). It frees the dir entry space and decrements link count on
+ * lxd_node(s).
+ *
+ * Return 0 on success.
+ */
+int
+lxd_dirdelete(lxd_node_t *dir, lxd_node_t *ldn, char *nm, enum dr_op op,
+    cred_t *cred)
+{
+	lxd_dirent_t *dirp;
+	int error;
+	size_t namelen;
+	lxd_node_t *fndnp;
+	timestruc_t now;
+
+	ASSERT(RW_WRITE_HELD(&dir->lxdn_rwlock));
+	ASSERT(RW_WRITE_HELD(&ldn->lxdn_rwlock));
+	ASSERT(dir->lxdn_vnode->v_type == VDIR);
+
+	if (nm[0] == '\0')
+		panic("lxd_dirdelete: empty name for 0x%p", (void *)ldn);
+
+	/*
+	 * return error when removing . and ..
+	 */
+	if (nm[0] == '.') {
+		if (nm[1] == '\0')
+			return (EINVAL);
+		if (nm[1] == '.' && nm[2] == '\0')
+			return (EEXIST); /* thus in ufs */
+	}
+
+	if ((error = lxd_naccess(dir, VEXEC|VWRITE, cred)) != 0)
+		return (error);
+
+	if (dir->lxdn_dir == NULL)
+		return (ENOENT);
+
+	if (op == DR_RMDIR) {
+		/*
+		 * This is the top-level removal of a directory. Start by
+		 * removing any file entries from the dir. We do this by
+		 * recursively calling back into this function with a different
+		 * op code. The caller of this function has already verified
+		 * that it is safe to remove this directory.
+		 */
+		lxd_dirent_t *dirp;
+
+		ASSERT(ldn->lxdn_vnode->v_type == VDIR);
+
+		dirp = ldn->lxdn_dir;
+		while (dirp) {
+			lxd_node_t *dn;
+			lxd_dirent_t *nextp;
+
+			if (strcmp(dirp->lddir_name, ".") == 0 ||
+			    strcmp(dirp->lddir_name, "..") == 0) {
+				dirp = dirp->lddir_next;
+				continue;
+			}
+
+			dn = dirp->lddir_node;
+			nextp = dirp->lddir_next;
+
+			ldnode_hold(dn);
+			error = lxd_dirdelete(ldn, dn, dirp->lddir_name,
+			    DR_REMOVE, cred);
+			ldnode_rele(dn);
+
+			dirp = nextp;
+		}
+	}
+
+	dirp = lxd_find_dirent(nm, dir, NOHOLD, &fndnp);
+	VERIFY(dirp != NULL);
+	VERIFY(ldn == fndnp);
+
+	lxd_rm_dirent(dirp);
+
+	/* Take dirp out of the directory list. */
+	ASSERT(dirp->lddir_next != dirp);
+	ASSERT(dirp->lddir_prev != dirp);
+	if (dirp->lddir_prev) {
+		dirp->lddir_prev->lddir_next = dirp->lddir_next;
+	}
+	if (dirp->lddir_next) {
+		dirp->lddir_next->lddir_prev = dirp->lddir_prev;
+	}
+
+	/*
+	 * If the roving slot pointer happens to match dirp,
+	 * point it at the previous dirent.
+	 */
+	if (dir->lxdn_dir->lddir_prev == dirp) {
+		dir->lxdn_dir->lddir_prev = dirp->lddir_prev;
+	}
+	ASSERT(dirp->lddir_next != dirp);
+	ASSERT(dirp->lddir_prev != dirp);
+
+	/* dirp points to the correct directory entry */
+	namelen = strlen(dirp->lddir_name) + 1;
+
+	kmem_free(dirp, sizeof (lxd_dirent_t) + namelen);
+	dir->lxdn_size -= (sizeof (lxd_dirent_t) + namelen);
+	dir->lxdn_dirents--;
+
+	gethrestime(&now);
+	dir->lxdn_mtime = now;
+	dir->lxdn_ctime = now;
+	ldn->lxdn_ctime = now;
+
+	ASSERT(ldn->lxdn_nlink > 0);
+	mutex_enter(&ldn->lxdn_tlock);
+	ldn->lxdn_nlink--;
+	mutex_exit(&ldn->lxdn_tlock);
+	if (op == DR_RMDIR && ldn->lxdn_vnode->v_type == VDIR) {
+		lxd_dirtrunc(ldn);
+		ASSERT(ldn->lxdn_nlink == 0);
+	}
+	return (0);
+}
+
+/*
+ * Initialize a lxd_node and add it to file list under mount point.
+ */
+void
+lxd_node_init(lxd_mnt_t *lxdm, lxd_node_t *ldn, vnode_t *realvp, vattr_t *vap,
+    cred_t *cred)
+{
+	struct vnode *vp;
+	timestruc_t now;
+
+	ASSERT(vap != NULL);
+
+	rw_init(&ldn->lxdn_rwlock, NULL, RW_DEFAULT, NULL);
+	mutex_init(&ldn->lxdn_tlock, NULL, MUTEX_DEFAULT, NULL);
+	ldn->lxdn_mode = MAKEIMODE(vap->va_type, vap->va_mode);
+	ldn->lxdn_mask = 0;
+	ldn->lxdn_attr.va_type = vap->va_type;
+	ldn->lxdn_nlink = 1;
+	ldn->lxdn_size = 0;
+
+	if (cred == NULL) {
+		ldn->lxdn_uid = vap->va_uid;
+		ldn->lxdn_gid = vap->va_gid;
+	} else {
+		ldn->lxdn_uid = crgetuid(cred);
+		ldn->lxdn_gid = crgetgid(cred);
+	}
+
+	ldn->lxdn_fsid = lxdm->lxdm_dev;
+	ldn->lxdn_rdev = vap->va_rdev;
+	ldn->lxdn_blksize = PAGESIZE;
+	ldn->lxdn_nblocks = 0;
+	gethrestime(&now);
+	ldn->lxdn_atime = now;
+	ldn->lxdn_mtime = now;
+	ldn->lxdn_ctime = now;
+	ldn->lxdn_seq = 0;
+	ldn->lxdn_dir = NULL;
+
+	ldn->lxdn_real_vp = realvp;
+
+	ldn->lxdn_vnode = vn_alloc(KM_SLEEP);
+	vp = LDNTOV(ldn);
+	vn_setops(vp, lxd_vnodeops);
+	vp->v_vfsp = lxdm->lxdm_vfsp;
+	vp->v_type = vap->va_type;
+	vp->v_rdev = vap->va_rdev;
+	vp->v_data = (caddr_t)ldn;
+
+	mutex_enter(&lxdm->lxdm_contents);
+	ldn->lxdn_nodeid = lxdm->lxdm_gen++;
+
+	/*
+	 * Add new lxd_node to end of linked list of lxd_nodes for this
+	 * lxdevfs. Root directory is handled specially in lxd_mount.
+	 */
+	if (lxdm->lxdm_rootnode != (lxd_node_t *)NULL) {
+		ldn->lxdn_next = NULL;
+		ldn->lxdn_prev = lxdm->lxdm_rootnode->lxdn_prev;
+		ldn->lxdn_prev->lxdn_next = lxdm->lxdm_rootnode->lxdn_prev =
+		    ldn;
+	}
+	mutex_exit(&lxdm->lxdm_contents);
+	vn_exists(vp);
+}
+
+/*
+ * lxd_dirinit is used internally to initialize a directory (dir)
+ * with '.' and '..' entries without checking permissions and locking
+ * It also creates the entries for the pseudo file nodes that reside in the
+ * directory.
+ */
+void
+lxd_dirinit(lxd_node_t *parent, lxd_node_t *dir)
+{
+	lxd_dirent_t *dot, *dotdot;
+	timestruc_t now;
+	lxd_mnt_t *lxdm = VTOLXDM(dir->lxdn_vnode);
+	struct vattr nattr;
+
+	ASSERT(RW_WRITE_HELD(&parent->lxdn_rwlock));
+	ASSERT(dir->lxdn_vnode->v_type == VDIR);
+
+	dir->lxdn_nodeid = lxdm->lxdm_gen++;
+
+	/*
+	 * Initialize the entries
+	 */
+	dot = kmem_zalloc(sizeof (lxd_dirent_t) + 2, KM_SLEEP);
+	dot->lddir_node = dir;
+	dot->lddir_offset = 0;
+	dot->lddir_name = (char *)dot + sizeof (lxd_dirent_t);
+	dot->lddir_name[0] = '.';
+	dot->lddir_parent = dir;
+	lxd_save_dirent(dot);
+
+	dotdot = kmem_zalloc(sizeof (lxd_dirent_t) + 3, KM_SLEEP);
+	dotdot->lddir_node = parent;
+	dotdot->lddir_offset = 1;
+	dotdot->lddir_name = (char *)dotdot + sizeof (lxd_dirent_t);
+	dotdot->lddir_name[0] = '.';
+	dotdot->lddir_name[1] = '.';
+	dotdot->lddir_parent = dir;
+	lxd_save_dirent(dotdot);
+
+	/*
+	 * Initialize directory entry list.
+	 */
+	dot->lddir_next = dotdot;
+	dot->lddir_prev = dotdot; /* dot's lddir_prev holds roving slot ptr */
+	dotdot->lddir_next = NULL;
+	dotdot->lddir_prev = dot;
+
+	gethrestime(&now);
+	dir->lxdn_mtime = now;
+	dir->lxdn_ctime = now;
+
+	parent->lxdn_nlink++;
+	parent->lxdn_ctime = now;
+
+	dir->lxdn_dir = dot;
+	dir->lxdn_size = 2 * sizeof (lxd_dirent_t) + 5;	/* dot and dotdot */
+	dir->lxdn_dirents = 2;
+	dir->lxdn_nlink = 2;
+	dir->lxdn_parent = parent;
+
+	bzero(&nattr, sizeof (struct vattr));
+	nattr.va_mode = (mode_t)(0644);
+	nattr.va_type = VREG;
+	nattr.va_rdev = 0;
+}
+
+/*
+ * lxd_dirtrunc is called to remove all directory entries under this directory.
+ */
+void
+lxd_dirtrunc(lxd_node_t *dir)
+{
+	lxd_dirent_t *ldp;
+	timestruc_t now;
+
+	ASSERT(RW_WRITE_HELD(&dir->lxdn_rwlock));
+	ASSERT(dir->lxdn_vnode->v_type == VDIR);
+
+	for (ldp = dir->lxdn_dir; ldp; ldp = dir->lxdn_dir) {
+		size_t namelen;
+		lxd_node_t *ldn;
+
+		ASSERT(ldp->lddir_next != ldp);
+		ASSERT(ldp->lddir_prev != ldp);
+		ASSERT(ldp->lddir_node);
+
+		dir->lxdn_dir = ldp->lddir_next;
+		namelen = strlen(ldp->lddir_name) + 1;
+
+		/*
+		 * Adjust the link counts to account for this directory entry
+		 * removal. We do hold/rele operations to free up these nodes.
+		 */
+		ldn = ldp->lddir_node;
+
+		ASSERT(ldn->lxdn_nlink > 0);
+		mutex_enter(&ldn->lxdn_tlock);
+		ldn->lxdn_nlink--;
+		mutex_exit(&ldn->lxdn_tlock);
+
+		lxd_rm_dirent(ldp);
+		kmem_free(ldp, sizeof (lxd_dirent_t) + namelen);
+		dir->lxdn_size -= (sizeof (lxd_dirent_t) + namelen);
+		dir->lxdn_dirents--;
+	}
+
+	gethrestime(&now);
+	dir->lxdn_mtime = now;
+	dir->lxdn_ctime = now;
+
+	ASSERT(dir->lxdn_dir == NULL);
+	ASSERT(dir->lxdn_size == 0);
+	ASSERT(dir->lxdn_dirents == 0);
+}
diff --git a/usr/src/uts/common/brand/lx/devfs/lxd_vfsops.c b/usr/src/uts/common/brand/lx/devfs/lxd_vfsops.c
new file mode 100644
index 0000000000..b2e2b9b9e3
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/devfs/lxd_vfsops.c
@@ -0,0 +1,860 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * The lx devfs (lxd) file system is used within lx branded zones to provide
+ * the Linux view of /dev.
+ *
+ * In the past, the Linux /dev was simply a lofs mount pointing at /native/dev.
+ * lxd now provides the Linux /dev.
+ *
+ * The lxd file system is a hybrid of lofs and tmpfs. It supports a "back" file
+ * system which is the special device and corresponds to the special device in
+ * a lofs mount. As with lofs, all files in the special device are accessible
+ * through the lxd mount. Because the zone's devfs is not directly modifiable
+ * within the zone (also mknod(2) is not generally allowed within a zone) it is
+ * impossible to create files in devfs. For lx, in some cases it's useful to be
+ * able to make new symlinks or new directories under /dev. lxd implements
+ * these operations by creating "files" in memory in the same way as tmpfs
+ * does. Within lxd these are referred to as "front" files. For operations such
+ * as lookup or readdir, lxd provides a merged view of both the front and back
+ * files. lxd does not support regular front files or simple I/O (read/write)
+ * to front files, since there is no need for that. For back files, all
+ * operations are simply passed through to the real vnode, as is done with
+ * lofs. Front files are not allowed to mask back files.
+ *
+ * The Linux /dev is now a lxd mount with the special file (i.e. the back
+ * file system) as /native/dev.
+ *
+ * In addition, lx has a need for some illumos/Linux translation for the
+ * various *stat(2) system calls when used on a device. This translation can
+ * be centralized within lxd's getattr vnode entry point.
+ *
+ * Because the front file system only exists in memory and the back file
+ * system is the zone's devfs, which is not persistent across reboots, we
+ * track any device uid/gid/mode changes in a per-zone /etc/.lxd_dev_attr
+ * file and re-apply those changes when the lx devfs file system is mounted.
+ * Currently only changes to block device nodes are persistent.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/kmem.h>
+#include <sys/time.h>
+#include <sys/pathname.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/stat.h>
+#include <sys/errno.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/statvfs.h>
+#include <sys/mount.h>
+#include <sys/systm.h>
+#include <sys/mntent.h>
+#include <sys/policy.h>
+#include <sys/sdt.h>
+#include <sys/ddi.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_ptm.h>
+#include <sys/lx_impl.h>
+
+#include "lxd.h"
+
+/* Module level parameters */
+static int	lxd_fstype;
+static dev_t	lxd_dev;
+
+/*
+ * lxd_mountcount is used to prevent module unloads while there is still
+ * state from a former mount hanging around. The filesystem module must not be
+ * allowed to go away before the last VFS_FREEVFS() call has been made. Since
+ * this is just an atomic counter, there's no need for locking.
+ */
+static uint32_t lxd_mountcount;
+
+/*
+ * lxd_minfree is the minimum amount of swap space that lx devfs leaves for
+ * the rest of the zone.
+ */
+size_t lxd_minfree = 0;
+
+/*
+ * LXDMINFREE -- the value from which lxd_minfree is derived -- should be
+ * configured to a value that is roughly the smallest practical value for
+ * memory + swap minus the largest reasonable size for lxd in such
+ * a configuration. As of this writing, the smallest practical memory + swap
+ * configuration is 128MB, and it seems reasonable to allow lxd to consume
+ * no more than ~10% of this, yielding a LXDMINFREE of 12MB.
+ */
+#define	LXDMINFREE	12 * 1024 * 1024	/* 12 Megabytes */
+
+extern pgcnt_t swapfs_minfree;
+
+extern int lxd_symlink(vnode_t *, char *, struct vattr *, char *, cred_t *,
+    caller_context_t *, int);
+extern int stat64(char *, struct stat64 *);
+
+/*
+ * lxd vfs operations.
+ */
+static int lxd_init(int, char *);
+static int lxd_mount(vfs_t *, vnode_t *, struct mounta *, cred_t *);
+static int lxd_unmount(vfs_t *, int, cred_t *);
+static int lxd_root(vfs_t *, vnode_t **);
+static int lxd_statvfs(vfs_t *, statvfs64_t *);
+static void lxd_freevfs(vfs_t *vfsp);
+
+/*
+ * Loadable module wrapper
+ */
+#include <sys/modctl.h>
+
+static vfsdef_t vfw = {
+	VFSDEF_VERSION,
+	"lx_devfs",
+	lxd_init,
+	VSW_ZMOUNT,
+	NULL
+};
+
+/*
+ * Module linkage information
+ */
+static struct modlfs modlfs = {
+	&mod_fsops, "lx brand devfs", &vfw
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, &modlfs, NULL
+};
+
+/*
+ * Definitions and translators for devt's.
+ */
+static void lxd_pts_devt_translator(dev_t, dev_t *);
+static void lxd_ptm_devt_translator(dev_t, dev_t *);
+
+static kmutex_t			lxd_xlate_lock;
+static boolean_t		lxd_xlate_initialized = B_FALSE;
+
+static lxd_minor_translator_t lxd_mtranslator_mm[] = {
+	{ "/dev/null",		0, 1, 3 },
+	{ "/dev/zero",		0, 1, 5 },
+	{ NULL,			0, 0, 0 }
+};
+static lxd_minor_translator_t lxd_mtranslator_random[] = {
+	{ "/dev/random",	0, 1, 8 },
+	{ "/dev/urandom",	0, 1, 9 },
+	{ NULL,			0, 0, 0 }
+};
+static lxd_minor_translator_t lxd_mtranslator_sy[] = {
+	{ "/dev/tty",		0, LX_TTY_MAJOR, 0 },
+	{ NULL,			0, 0, 0 }
+};
+static lxd_minor_translator_t lxd_mtranslator_zcons[] = {
+	{ "/dev/console",	0, LX_TTY_MAJOR, 1 },
+	{ NULL,			0, 0, 0 }
+};
+lxd_devt_translator_t lxd_devt_translators[] = {
+	{ "mm",		0, DTT_LIST,	(uintptr_t)&lxd_mtranslator_mm },
+	{ "random",	0, DTT_LIST,	(uintptr_t)&lxd_mtranslator_random },
+	{ "sy",		0, DTT_LIST,	(uintptr_t)&lxd_mtranslator_sy },
+	{ "zcons",	0, DTT_LIST,	(uintptr_t)&lxd_mtranslator_zcons },
+	{ LX_PTM_DRV,	0, DTT_CUSTOM,	(uintptr_t)lxd_ptm_devt_translator },
+	{ "pts",	0, DTT_CUSTOM,	(uintptr_t)lxd_pts_devt_translator },
+	{ NULL,		0, DTT_INVALID,	NULL }
+};
+
+int
+_init()
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_fini()
+{
+	int error;
+
+	if (lxd_mountcount > 0)
+		return (EBUSY);
+
+	if ((error = mod_remove(&modlinkage)) != 0)
+		return (error);
+
+	/*
+	 * Tear down the operations vectors
+	 */
+	(void) vfs_freevfsops_by_type(lxd_fstype);
+	vn_freevnodeops(lxd_vnodeops);
+	mutex_destroy(&lxd_xlate_lock);
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+/*
+ * Initialize global locks, etc. Called when loading lxd module.
+ */
+static int
+lxd_init(int fstype, char *name)
+{
+	static const fs_operation_def_t lxd_vfsops_template[] = {
+		VFSNAME_MOUNT,		{ .vfs_mount = lxd_mount },
+		VFSNAME_UNMOUNT,	{ .vfs_unmount = lxd_unmount },
+		VFSNAME_ROOT,		{ .vfs_root = lxd_root },
+		VFSNAME_STATVFS,	{ .vfs_statvfs = lxd_statvfs },
+		VFSNAME_FREEVFS,	{ .vfs_freevfs = lxd_freevfs },
+		NULL,			NULL
+	};
+	extern const struct fs_operation_def lxd_vnodeops_template[];
+	int error;
+	major_t dev;
+
+	lxd_fstype = fstype;
+	ASSERT(lxd_fstype != 0);
+
+	error = vfs_setfsops(fstype, lxd_vfsops_template, NULL);
+	if (error != 0) {
+		cmn_err(CE_WARN, "lxd_init: bad vfs ops template");
+		return (error);
+	}
+
+	error = vn_make_ops(name, lxd_vnodeops_template, &lxd_vnodeops);
+	if (error != 0) {
+		(void) vfs_freevfsops_by_type(fstype);
+		cmn_err(CE_WARN, "lxd_init: bad vnode ops template");
+		return (error);
+	}
+
+	/*
+	 * lxd_minfree doesn't need to be some function of configured
+	 * swap space since it really is an absolute limit of swap space
+	 * which still allows other processes to execute.
+	 */
+	if (lxd_minfree == 0) {
+		/* Set if not patched */
+		lxd_minfree = btopr(LXDMINFREE);
+	}
+
+	if ((dev = getudev()) == (major_t)-1) {
+		cmn_err(CE_WARN, "lxd_init: Can't get unique device number.");
+		dev = 0;
+	}
+
+	/*
+	 * Make the pseudo device
+	 */
+	lxd_dev = makedevice(dev, 0);
+
+	mutex_init(&lxd_xlate_lock, NULL, MUTEX_DEFAULT, NULL);
+
+	return (0);
+}
+
+/*
+ * Initialize device translator mapping table.
+ *
+ * Note that we cannot do this in lxd_init since that can lead to a recursive
+ * rw_enter while we're doing lookupnameat (via sdev_lookup/prof_make_maps/
+ * devi_attach_node/modload). Thus we do it in the mount path and keep track
+ * so that we only initialize the table once.
+ */
+static void
+lxd_xlate_init()
+{
+	int i;
+
+	mutex_enter(&lxd_xlate_lock);
+	if (lxd_xlate_initialized) {
+		mutex_exit(&lxd_xlate_lock);
+		return;
+	}
+
+	for (i = 0; lxd_devt_translators[i].lxd_xl_driver != NULL; i++) {
+		lxd_minor_translator_t	*mt;
+		int j;
+
+		lxd_devt_translators[i].lxd_xl_major =
+		    mod_name_to_major(lxd_devt_translators[i].lxd_xl_driver);
+
+		/* if this translator doesn't use a list mapping we're done. */
+		if (lxd_devt_translators[i].lxd_xl_type != DTT_LIST)
+			continue;
+
+		/* for each device listed, lookup the minor node number */
+		mt = lxd_devt_translators[i].xl_list;
+		for (j = 0; mt[j].lxd_mt_path != NULL; j++) {
+			vnode_t *vp;
+			struct vattr va;
+			char *tpath;
+			char tnm[MAXPATHLEN];
+
+			/*
+			 * The attach might be triggered in either the global
+			 * zone or in a non-global zone, so we may need to
+			 * adjust the path if we're in a NGZ.
+			 */
+			if (curproc->p_zone->zone_id == GLOBAL_ZONEUNIQID) {
+				tpath = mt[j].lxd_mt_path;
+			} else {
+				(void) snprintf(tnm, sizeof (tnm), "/native%s",
+				    mt[j].lxd_mt_path);
+				tpath = tnm;
+			}
+
+			if (lookupnameat(tpath, UIO_SYSSPACE, FOLLOW, NULL,
+			    &vp, NULL) != 0) {
+				mt[j].lxd_mt_minor = UINT_MAX;
+				continue;
+			}
+
+			va.va_mask = AT_RDEV;
+			if (VOP_GETATTR(vp, &va, 0, kcred, NULL) != 0) {
+				va.va_rdev = NODEV;
+			} else {
+				ASSERT(getmajor(va.va_rdev) ==
+				    lxd_devt_translators[i].lxd_xl_major);
+				ASSERT(mt[j].lxd_mt_lx_minor < LX_MAXMIN);
+			}
+
+			mt[j].lxd_mt_minor = getminor(va.va_rdev);
+
+			VN_RELE(vp);
+		}
+	}
+
+	lxd_xlate_initialized = B_TRUE;
+	mutex_exit(&lxd_xlate_lock);
+}
+
+static int
+lxd_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
+{
+	lxd_mnt_t *lxdm = NULL;
+	struct lxd_node *ldn;
+	struct pathname dpn;
+	int error;
+	int i;
+	int nodev;
+	struct vattr rattr;
+	vnode_t *realrootvp;
+	vnode_t *tvp;
+	lx_zone_data_t *lxzdata;
+	lx_virt_disk_t *vd;
+	vattr_t vattr;
+
+	nodev = vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL);
+
+	if ((error = secpolicy_fs_mount(cr, mvp, vfsp)) != 0)
+		return (error);
+
+	if (mvp->v_type != VDIR)
+		return (ENOTDIR);
+
+	lxd_xlate_init();
+
+	/*
+	 * This is the same behavior as with lofs.
+	 * Loopback devices which get "nodevices" added can be done without
+	 * "nodevices" set because we cannot import devices into a zone
+	 * with loopback.  Note that we have all zone privileges when
+	 * this happens; if not, we'd have gotten "nosuid".
+	 */
+	if (!nodev && vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL))
+		vfs_setmntopt(vfsp, MNTOPT_DEVICES, NULL, VFS_NODISPLAY);
+
+	/*
+	 * Only allow mounting within lx zones.
+	 */
+	if (curproc->p_zone->zone_brand != &lx_brand)
+		return (EINVAL);
+
+	/*
+	 * Ensure we don't allow overlaying mounts
+	 */
+	mutex_enter(&mvp->v_lock);
+	if ((uap->flags & MS_OVERLAY) == 0 &&
+	    (mvp->v_count > 1 || (mvp->v_flag & VROOT))) {
+		mutex_exit(&mvp->v_lock);
+		return (EBUSY);
+	}
+	mutex_exit(&mvp->v_lock);
+
+	/* lxd doesn't support read-only mounts */
+	if (vfs_optionisset(vfsp, MNTOPT_RO, NULL)) {
+		error = EINVAL;
+		goto out;
+	}
+
+	error = pn_get(uap->dir,
+	    (uap->flags & MS_SYSSPACE) ? UIO_SYSSPACE : UIO_USERSPACE, &dpn);
+	if (error != 0)
+		goto out;
+
+	/*
+	 * Find real root
+	 */
+	if ((error = lookupname(uap->spec, (uap->flags & MS_SYSSPACE) ?
+	    UIO_SYSSPACE : UIO_USERSPACE, FOLLOW, NULLVPP, &realrootvp))) {
+		pn_free(&dpn);
+		return (error);
+	}
+
+	if ((error = VOP_ACCESS(realrootvp, 0, 0, cr, NULL)) != 0) {
+		pn_free(&dpn);
+		VN_RELE(realrootvp);
+		return (error);
+	}
+
+	/* If realroot is not a devfs, error out */
+	if (strcmp(realrootvp->v_op->vnop_name, "dev") != 0) {
+		pn_free(&dpn);
+		VN_RELE(realrootvp);
+		return (EINVAL);
+	}
+
+	lxdm = kmem_zalloc(sizeof (*lxdm), KM_SLEEP);
+
+	/* init but don't bother entering the mutex (not on mount list yet) */
+	mutex_init(&lxdm->lxdm_contents, NULL, MUTEX_DEFAULT, NULL);
+	mutex_init(&lxdm->lxdm_renamelck, NULL, MUTEX_DEFAULT, NULL);
+	mutex_init(&lxdm->lxdm_attrlck, NULL, MUTEX_DEFAULT, NULL);
+
+	list_create(&lxdm->lxdm_devattrs, sizeof (lxd_dev_attr_t),
+	    offsetof(lxd_dev_attr_t, lxda_link));
+
+	/* Initialize the hash table mutexes */
+	for (i = 0; i < LXD_HASH_SZ; i++) {
+		mutex_init(&lxdm->lxdm_hash_mutex[i], NULL, MUTEX_DEFAULT,
+		    NULL);
+	}
+
+	lxdm->lxdm_vfsp = vfsp;
+	lxdm->lxdm_gen = 1;	/* start inode counter at 1 */
+
+	vfsp->vfs_data = (caddr_t)lxdm;
+	vfsp->vfs_fstype = lxd_fstype;
+	vfsp->vfs_dev = lxd_dev;
+	vfsp->vfs_bsize = PAGESIZE;
+	vfsp->vfs_flag |= VFS_NOTRUNC;
+	vfs_make_fsid(&vfsp->vfs_fsid, lxd_dev, lxd_fstype);
+	lxdm->lxdm_mntpath = kmem_zalloc(dpn.pn_pathlen + 1, KM_SLEEP);
+	(void) strcpy(lxdm->lxdm_mntpath, dpn.pn_path);
+
+	/* allocate and initialize root lxd_node structure */
+	bzero(&rattr, sizeof (struct vattr));
+	rattr.va_mode = (mode_t)(S_IFDIR | 0755);
+	rattr.va_type = VDIR;
+	rattr.va_rdev = 0;
+
+	tvp = lxd_make_back_node(realrootvp, lxdm);
+	ldn = VTOLDN(tvp);
+
+	rw_enter(&ldn->lxdn_rwlock, RW_WRITER);
+	LDNTOV(ldn)->v_flag |= VROOT;
+
+	/*
+	 * initialize linked list of lxd_nodes so that the back pointer of
+	 * the root lxd_node always points to the last one on the list
+	 * and the forward pointer of the last node is null
+	 */
+	ldn->lxdn_prev = ldn;
+	ldn->lxdn_next = NULL;
+	ldn->lxdn_nlink = 0;
+	lxdm->lxdm_rootnode = ldn;
+
+	ldn->lxdn_nodeid = lxdm->lxdm_gen++;
+	lxd_dirinit(ldn, ldn);
+
+	rw_exit(&ldn->lxdn_rwlock);
+
+	pn_free(&dpn);
+	error = 0;
+	atomic_inc_32(&lxd_mountcount);
+
+	lxzdata = ztolxzd(curproc->p_zone);
+	ASSERT(lxzdata->lxzd_vdisks != NULL);
+
+	vattr.va_mask = AT_TYPE | AT_MODE;
+	vattr.va_type = VLNK;
+	vattr.va_mode = 0777;
+
+	vd = list_head(lxzdata->lxzd_vdisks);
+	while (vd != NULL) {
+		if (vd->lxvd_type == LXVD_ZVOL) {
+			char lnknm[MAXPATHLEN];
+
+			/* Create a symlink for the actual zvol. */
+			(void) snprintf(lnknm, sizeof (lnknm),
+			    "./zvol/dsk/%s", vd->lxvd_real_name);
+			(void) lxd_symlink(LDNTOV(ldn), vd->lxvd_name, &vattr,
+			    lnknm, cr, NULL, 0);
+		} else if (vd->lxvd_type == LXVD_ZFS_DS) {
+			/*
+			 * Create a symlink for the root "disk" using /dev/zfs
+			 * as the target device.
+			 */
+			(void) lxd_symlink(LDNTOV(ldn), vd->lxvd_name, &vattr,
+			    "./zfs", cr, NULL, 0);
+		}
+
+		vd = list_next(lxzdata->lxzd_vdisks, vd);
+	}
+
+	/* Apply any persistent attribute changes. */
+	lxd_apply_db(lxdm);
+
+out:
+	if (error == 0)
+		vfs_set_feature(vfsp, VFSFT_SYSATTR_VIEWS);
+
+	return (error);
+}
+
+static int
+lxd_unmount(struct vfs *vfsp, int flag, struct cred *cr)
+{
+	lxd_mnt_t *lxdm = (lxd_mnt_t *)VFSTOLXDM(vfsp);
+	lxd_node_t *ldn, *cancel;
+	struct vnode	*vp;
+	int error;
+	uint_t cnt;
+
+	if ((error = secpolicy_fs_unmount(cr, vfsp)) != 0)
+		return (error);
+
+	mutex_enter(&lxdm->lxdm_contents);
+
+	/*
+	 * In the normal unmount case only the root node would have a reference
+	 * count.
+	 *
+	 * With lxdm_contents held, nothing can be added or removed.
+	 * If we find a previously referenced node, undo the holds we have
+	 * placed and fail EBUSY.
+	 */
+	ldn = lxdm->lxdm_rootnode;
+
+	vp = LDNTOV(ldn);
+	mutex_enter(&vp->v_lock);
+
+	if (flag & MS_FORCE) {
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&lxdm->lxdm_contents);
+		return (EINVAL);
+	}
+
+	cnt = vp->v_count;
+	if (cnt > 1) {
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&lxdm->lxdm_contents);
+		return (EBUSY);
+	}
+
+	mutex_exit(&vp->v_lock);
+
+	/*
+	 * Check for open files. An open file causes everything to unwind.
+	 */
+	for (ldn = ldn->lxdn_next; ldn; ldn = ldn->lxdn_next) {
+		vp = LDNTOV(ldn);
+		mutex_enter(&vp->v_lock);
+		cnt = vp->v_count;
+		if (cnt > 0) {
+			/* An open file; unwind the holds we've been adding. */
+			mutex_exit(&vp->v_lock);
+			cancel = lxdm->lxdm_rootnode->lxdn_next;
+			while (cancel != ldn) {
+				vp = LDNTOV(cancel);
+				ASSERT(vp->v_count > 0);
+				VN_RELE(vp);
+				cancel = cancel->lxdn_next;
+			}
+			mutex_exit(&lxdm->lxdm_contents);
+			return (EBUSY);
+		} else {
+			/*
+			 * It may seem incorrect for us to have a vnode with
+			 * a count of 0, but this is modeled on tmpfs and works
+			 * the same way. See lxd_front_inactive. There we allow
+			 * the v_count to go to 0 but rely on the link count to
+			 * keep the vnode alive. Since we now want to cleanup
+			 * these vnodes we manually add a VN_HOLD so that the
+			 * VN_RELEs that occur in the lxd_freevfs() cleanup
+			 * will take us down the lxd_inactive code path. We
+			 * can directly add a VN_HOLD since we have the lock.
+			 */
+			vp->v_count++;
+			mutex_exit(&vp->v_lock);
+		}
+	}
+
+	/*
+	 * We can drop the mutex now because
+	 * no one can find this mount anymore
+	 */
+	vfsp->vfs_flag |= VFS_UNMOUNTED;
+	mutex_exit(&lxdm->lxdm_contents);
+
+	return (0);
+}
+
+/*
+ * Implementation of VFS_FREEVFS(). This is called by the vfs framework after
+ * umount and the last VFS_RELE, to trigger the release of any resources still
+ * associated with the given vfs_t. This is normally called immediately after
+ * lxd_unmount.
+ */
+void
+lxd_freevfs(vfs_t *vfsp)
+{
+	lxd_mnt_t *lxdm = (lxd_mnt_t *)VFSTOLXDM(vfsp);
+	lxd_node_t *ldn;
+	struct vnode *vp;
+	lxd_dev_attr_t *da;
+
+	/*
+	 * Free all kmemalloc'd and anonalloc'd memory associated with
+	 * this filesystem.  To do this, we go through the file list twice,
+	 * once to remove all the directory entries, and then to remove
+	 * all the pseudo files.
+	 */
+
+	/*
+	 * Now that we are tearing ourselves down we need to remove the
+	 * UNMOUNTED flag. If we don't, we'll later hit a VN_RELE when we remove
+	 * files from the system causing us to have a negative value. Doing this
+	 * seems a bit better than trying to set a flag on the lxd_mnt_t that
+	 * says we're tearing down.
+	 */
+	vfsp->vfs_flag &= ~VFS_UNMOUNTED;
+
+	/*
+	 * Remove all directory entries (this doesn't remove top-level dirs).
+	 */
+	for (ldn = lxdm->lxdm_rootnode; ldn; ldn = ldn->lxdn_next) {
+		rw_enter(&ldn->lxdn_rwlock, RW_WRITER);
+		if (ldn->lxdn_vnode->v_type == VDIR)
+			lxd_dirtrunc(ldn);
+		rw_exit(&ldn->lxdn_rwlock);
+	}
+
+	ASSERT(lxdm->lxdm_rootnode != NULL);
+
+	/*
+	 * All links are gone, v_count is keeping nodes in place.
+	 * VN_RELE should make the node disappear, unless somebody
+	 * is holding pages against it.  Nap and retry until it disappears.
+	 *
+	 * We re-acquire the lock to prevent others who have a HOLD on a
+	 * lxd_node from blowing it away (in lxd_inactive) while we're trying
+	 * to get to it here. Once we have a HOLD on it we know it'll stick
+	 * around.
+	 */
+	mutex_enter(&lxdm->lxdm_contents);
+
+	/*
+	 * Remove all the files (except the rootnode) backwards.
+	 */
+	while ((ldn = lxdm->lxdm_rootnode->lxdn_prev) != lxdm->lxdm_rootnode) {
+		mutex_exit(&lxdm->lxdm_contents);
+		/*
+		 * All nodes will be released here. Note we handled the link
+		 * count above.
+		 */
+		vp = LDNTOV(ldn);
+		ASSERT(vp->v_type == VLNK || vp->v_type == VDIR ||
+		    vp->v_type == VSOCK);
+		VN_RELE(vp);
+		mutex_enter(&lxdm->lxdm_contents);
+		/*
+		 * It's still there after the RELE. Someone else like pageout
+		 * has a hold on it so wait a bit and then try again - we know
+		 * they'll give it up soon.
+		 */
+		if (ldn == lxdm->lxdm_rootnode->lxdn_prev) {
+			VN_HOLD(vp);
+			mutex_exit(&lxdm->lxdm_contents);
+			delay(hz / 4);
+			mutex_enter(&lxdm->lxdm_contents);
+		}
+	}
+	mutex_exit(&lxdm->lxdm_contents);
+
+	ASSERT(lxdm->lxdm_back_refcnt == 1);
+	ASSERT(lxdm->lxdm_dent_refcnt == 0);
+
+	VN_RELE(LDNTOV(lxdm->lxdm_rootnode));
+
+	ASSERT(lxdm->lxdm_mntpath != NULL);
+	kmem_free(lxdm->lxdm_mntpath, strlen(lxdm->lxdm_mntpath) + 1);
+
+	da = list_remove_head(&lxdm->lxdm_devattrs);
+	while (da != NULL) {
+		kmem_free(da, sizeof (lxd_dev_attr_t));
+		da = list_remove_head(&lxdm->lxdm_devattrs);
+	}
+	list_destroy(&lxdm->lxdm_devattrs);
+
+	mutex_destroy(&lxdm->lxdm_contents);
+	mutex_destroy(&lxdm->lxdm_renamelck);
+	mutex_destroy(&lxdm->lxdm_attrlck);
+	kmem_free(lxdm, sizeof (lxd_mnt_t));
+
+	/* Allow _fini() to succeed now */
+	atomic_dec_32(&lxd_mountcount);
+}
+
+/*
+ * return root lxdnode for given vnode
+ */
+static int
+lxd_root(struct vfs *vfsp, struct vnode **vpp)
+{
+	lxd_mnt_t *lxdm = (lxd_mnt_t *)VFSTOLXDM(vfsp);
+	lxd_node_t *ldn = lxdm->lxdm_rootnode;
+	struct vnode *vp;
+
+	ASSERT(ldn != NULL);
+
+	vp = LDNTOV(ldn);
+	VN_HOLD(vp);
+	*vpp = vp;
+	return (0);
+}
+
+static int
+lxd_statvfs(struct vfs *vfsp, statvfs64_t *sbp)
+{
+	lxd_mnt_t *lxdm = (lxd_mnt_t *)VFSTOLXDM(vfsp);
+	ulong_t	blocks;
+	dev32_t d32;
+	zoneid_t eff_zid;
+	struct zone *zp;
+
+	zp = lxdm->lxdm_vfsp->vfs_zone;
+
+	if (zp == NULL)
+		eff_zid = GLOBAL_ZONEUNIQID;
+	else
+		eff_zid = zp->zone_id;
+
+	sbp->f_bsize = PAGESIZE;
+	sbp->f_frsize = PAGESIZE;
+
+	/*
+	 * Find the amount of available physical and memory swap
+	 */
+	mutex_enter(&anoninfo_lock);
+	ASSERT(k_anoninfo.ani_max >= k_anoninfo.ani_phys_resv);
+	blocks = (ulong_t)CURRENT_TOTAL_AVAILABLE_SWAP;
+	mutex_exit(&anoninfo_lock);
+
+	if (blocks > lxd_minfree)
+		sbp->f_bfree = blocks - lxd_minfree;
+	else
+		sbp->f_bfree = 0;
+
+	sbp->f_bavail = sbp->f_bfree;
+
+	/*
+	 * Total number of blocks is just what's available
+	 */
+	sbp->f_blocks = (fsblkcnt64_t)(sbp->f_bfree);
+
+	if (eff_zid != GLOBAL_ZONEUNIQID &&
+	    zp->zone_max_swap_ctl != UINT64_MAX) {
+		/*
+		 * If the fs is used by a zone with a swap cap,
+		 * then report the capped size.
+		 */
+		rctl_qty_t cap, used;
+		pgcnt_t pgcap, pgused;
+
+		mutex_enter(&zp->zone_mem_lock);
+		cap = zp->zone_max_swap_ctl;
+		used = zp->zone_max_swap;
+		mutex_exit(&zp->zone_mem_lock);
+
+		pgcap = btop(cap);
+		pgused = btop(used);
+
+		sbp->f_bfree = MIN(pgcap - pgused, sbp->f_bfree);
+		sbp->f_bavail = sbp->f_bfree;
+		sbp->f_blocks = MIN(pgcap, sbp->f_blocks);
+	}
+
+	/*
+	 * The maximum number of files available is approximately the number
+	 * of lxd_nodes we can allocate from the remaining kernel memory
+	 * available to lxdevfs in this zone.  This is fairly inaccurate since
+	 * it doesn't take into account the names stored in the directory
+	 * entries.
+	 */
+	sbp->f_ffree = sbp->f_files = ptob(availrmem) /
+	    (sizeof (lxd_node_t) + sizeof (lxd_dirent_t));
+	sbp->f_favail = (fsfilcnt64_t)(sbp->f_ffree);
+	(void) cmpldev(&d32, vfsp->vfs_dev);
+	sbp->f_fsid = d32;
+	(void) strcpy(sbp->f_basetype, vfssw[lxd_fstype].vsw_name);
+	(void) strncpy(sbp->f_fstr, lxdm->lxdm_mntpath, sizeof (sbp->f_fstr));
+	/* ensure null termination */
+	sbp->f_fstr[sizeof (sbp->f_fstr) - 1] = '\0';
+	sbp->f_flag = vf_to_stf(vfsp->vfs_flag);
+	sbp->f_namemax = MAXNAMELEN - 1;
+	return (0);
+}
+
+static void
+lxd_pts_devt_translator(dev_t dev, dev_t *jdev)
+{
+	minor_t	min = getminor(dev);
+	int	lx_maj, lx_min;
+
+	/*
+	 * Linux uses a range of major numbers for pts devices to address the
+	 * relatively small minor number space (20 bits).
+	 */
+
+	lx_maj = LX_PTS_MAJOR_MIN + (min / LX_MAXMIN);
+	lx_min = min % LX_MAXMIN;
+	if (lx_maj > LX_PTS_MAJOR_MAX) {
+		/*
+		 * The major is outside the acceptable range but there's little
+		 * we can presently do about it short of overhauling the
+		 * translation logic.
+		 */
+		lx_unsupported("pts major out of translation range");
+	}
+
+	*jdev = LX_MAKEDEVICE(lx_maj, lx_min);
+}
+
+/* ARGSUSED */
+static void
+lxd_ptm_devt_translator(dev_t dev, dev_t *jdev)
+{
+	*jdev = LX_MAKEDEVICE(LX_PTM_MAJOR, LX_PTM_MINOR);
+}
diff --git a/usr/src/uts/common/brand/lx/devfs/lxd_vnops.c b/usr/src/uts/common/brand/lx/devfs/lxd_vnops.c
new file mode 100644
index 0000000000..8088ba6174
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/devfs/lxd_vnops.c
@@ -0,0 +1,1520 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/vnode.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/cred.h>
+#include <sys/pathname.h>
+#include <sys/debug.h>
+#include <sys/sdt.h>
+#include <fs/fs_subr.h>
+#include <vm/as.h>
+#include <vm/seg.h>
+#include <sys/lx_brand.h>
+#include <sys/brand.h>
+
+#include "lxd.h"
+
+static int
+lxd_open(vnode_t **vpp, int flag, struct cred *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(*vpp);
+	vnode_t *vp = *vpp;
+	vnode_t *rvp;
+	vnode_t *oldvp;
+	int error;
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (0);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	oldvp = vp;
+	vp = rvp = REALVP(vp);
+	/*
+	 * Need to hold new reference to vp since VOP_OPEN() may
+	 * decide to release it.
+	 */
+	VN_HOLD(vp);
+	error = VOP_OPEN(&rvp, flag, cr, ct);
+
+	if (!error && rvp != vp) {
+		/*
+		 * the FS which we called should have released the
+		 * new reference on vp
+		 */
+		*vpp = lxd_make_back_node(rvp, VFSTOLXDM(oldvp->v_vfsp));
+
+		if (IS_DEVVP(*vpp)) {
+			vnode_t *svp;
+
+			svp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
+			VN_RELE(*vpp);
+			if (svp == NULL)
+				error = ENOSYS;
+			else
+				*vpp = svp;
+		}
+		VN_RELE(oldvp);
+	} else {
+		ASSERT(rvp->v_count > 1);
+		VN_RELE(rvp);
+	}
+
+	return (error);
+}
+
+static int
+lxd_close(vnode_t *vp, int flag, int count, offset_t offset, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (0);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_CLOSE(vp, flag, count, offset, cr, ct));
+}
+
+static int
+lxd_read(vnode_t *vp, struct uio *uiop, int ioflag, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (ENOTSUP);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_READ(vp, uiop, ioflag, cr, ct));
+}
+
+static int
+lxd_write(vnode_t *vp, struct uio *uiop, int ioflag, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (ENOTSUP);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_WRITE(vp, uiop, ioflag, cr, ct));
+}
+
+static int
+lxd_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, struct cred *cr,
+    int *rvalp, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (ENOTSUP);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_IOCTL(vp, cmd, arg, flag, cr, rvalp, ct));
+}
+
+static int
+lxd_setfl(vnode_t *vp, int oflags, int nflags, cred_t *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (ENOTSUP);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_SETFL(vp, oflags, nflags, cr, ct));
+}
+
+/*
+ * Translate SunOS devt to Linux devt.
+ */
+static void
+lxd_s2l_devt(dev_t dev, dev_t *rdev)
+{
+	lxd_minor_translator_t	*mt;
+	int			i, j;
+	major_t			maj = getmajor(dev);
+	minor_t			min = getminor(dev);
+
+	/* look for a devt translator for this major number */
+	for (i = 0; lxd_devt_translators[i].lxd_xl_driver != NULL; i++) {
+		if (lxd_devt_translators[i].lxd_xl_major == maj)
+			break;
+	}
+
+	if (lxd_devt_translators[i].lxd_xl_driver != NULL) {
+		/* try to translate the illumos devt to a linux devt */
+		switch (lxd_devt_translators[i].lxd_xl_type) {
+		case DTT_INVALID:
+			ASSERT(0);
+			break;
+
+		case DTT_LIST:
+			mt = lxd_devt_translators[i].xl_list;
+			for (j = 0; mt[j].lxd_mt_path != NULL; j++) {
+				if (mt[j].lxd_mt_minor == min) {
+					ASSERT(mt[j].lxd_mt_minor < LX_MAXMIN);
+
+					/* found a translation */
+					*rdev = LX_MAKEDEVICE(
+					    mt[j].lxd_mt_lx_major,
+					    mt[j].lxd_mt_lx_minor);
+					return;
+				}
+			}
+			break;
+
+		case DTT_CUSTOM:
+			lxd_devt_translators[i].xl_custom(dev, rdev);
+			return;
+		}
+	}
+
+	/* we don't have a translator for this device */
+	*rdev = LX_MAKEDEVICE(maj, min);
+}
+
+static int
+lxd_getattr(vnode_t *vp, struct vattr *vap, int flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+	int error;
+	vnode_t *rvp;
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		mutex_enter(&ldn->lxdn_tlock);
+
+		vap->va_type = vp->v_type;
+		vap->va_mode = ldn->lxdn_mode & MODEMASK;
+		vap->va_uid = ldn->lxdn_uid;
+		vap->va_gid = ldn->lxdn_gid;
+		vap->va_fsid = ldn->lxdn_fsid;
+		vap->va_nodeid = (ino64_t)ldn->lxdn_nodeid;
+		vap->va_nlink = ldn->lxdn_nlink;
+		vap->va_size = (u_offset_t)ldn->lxdn_size;
+		vap->va_atime = ldn->lxdn_atime;
+		vap->va_mtime = ldn->lxdn_mtime;
+		vap->va_ctime = ldn->lxdn_ctime;
+		vap->va_blksize = PAGESIZE;
+		vap->va_rdev = 0;	/* no devs in front */
+		vap->va_seq = ldn->lxdn_seq;
+
+		vap->va_nblocks = (fsblkcnt64_t)btodb(ptob(btopr(
+		    vap->va_size)));
+		mutex_exit(&ldn->lxdn_tlock);
+		return (0);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	rvp = REALVP(vp);
+	if ((error = VOP_GETATTR(rvp, vap, flags, cr, ct)))
+		return (error);
+
+	/* Skip devt translation for native programs */
+	if (curproc->p_brand != &lx_brand) {
+		return (0);
+	} else {
+		/*
+		 * We also skip translation when called from the user-land
+		 * emulation code.
+		 */
+		lx_lwp_data_t *lwpd = ttolxlwp(curthread);
+
+		if (lwpd == NULL || lwpd->br_stack_mode != LX_STACK_MODE_BRAND)
+			return (0);
+	}
+
+	if (rvp->v_type == VCHR) {
+		dev_t ldev;
+
+		lxd_s2l_devt(vap->va_rdev, &ldev);
+		DTRACE_PROBE3(lxd__devxl, void *, rvp, void *, vap, int, ldev);
+		vap->va_rdev = ldev;
+	}
+
+	return (0);
+}
+
+static int
+lxd_setattr(vnode_t *vp, struct vattr *vap, int flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+	lxd_mnt_t *lxdm = VTOLXDM(vp);
+	int res;
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		int error = 0;
+		struct vattr *set;
+		long mask = vap->va_mask;
+
+		/* Cannot set these attributes */
+		if ((mask & AT_NOSET) || (mask & AT_XVATTR) ||
+		    (mask & AT_MODE && vap->va_mode & (S_ISUID | S_ISGID)) ||
+		    (mask & AT_SIZE))
+			return (EINVAL);
+
+		mutex_enter(&ldn->lxdn_tlock);
+
+		set = &ldn->lxdn_attr;
+		/*
+		 * Change file access modes. Must be owner or have sufficient
+		 * privileges.
+		 */
+		error = secpolicy_vnode_setattr(cr, vp, vap, set, flags,
+		    lxd_naccess, ldn);
+		if (error) {
+			mutex_exit(&ldn->lxdn_tlock);
+			return (error);
+		}
+
+		if (mask & AT_MODE) {
+			set->va_mode &= S_IFMT;
+			set->va_mode |= vap->va_mode & ~S_IFMT;
+		}
+
+		if (mask & AT_UID)
+			set->va_uid = vap->va_uid;
+		if (mask & AT_GID)
+			set->va_gid = vap->va_gid;
+		if (mask & AT_ATIME)
+			set->va_atime = vap->va_atime;
+		if (mask & AT_MTIME)
+			set->va_mtime = vap->va_mtime;
+
+		if (mask & (AT_UID | AT_GID | AT_MODE | AT_MTIME))
+			gethrestime(&ldn->lxdn_ctime);
+
+		mutex_exit(&ldn->lxdn_tlock);
+		return (error);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	res = VOP_SETATTR(vp, vap, flags, cr, ct);
+	if (res == 0 && (vap->va_mask & (AT_MODE | AT_UID | AT_GID))) {
+		lxd_save_attrs(lxdm, vp);
+	}
+	return (res);
+}
+
+static int
+lxd_access(vnode_t *vp, int mode, int flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		int error;
+
+		mutex_enter(&ldn->lxdn_tlock);
+		error = lxd_naccess(ldn, mode, cr);
+		mutex_exit(&ldn->lxdn_tlock);
+		return (error);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	if (mode & VWRITE) {
+		if (vp->v_type == VREG && vn_is_readonly(vp))
+			return (EROFS);
+	}
+	vp = REALVP(vp);
+	return (VOP_ACCESS(vp, mode, flags, cr, ct));
+}
+
+static int
+lxd_fsync(vnode_t *vp, int syncflag, struct cred *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (0);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_FSYNC(vp, syncflag, cr, ct));
+}
+
+/* ARGSUSED */
+static void
+lxd_front_inactive(struct vnode *vp, struct cred *cred, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+	lxd_mnt_t *lxdm = VTOLXDM(vp);
+
+	ASSERT(ldn->lxdn_type == LXDNT_FRONT);
+	rw_enter(&ldn->lxdn_rwlock, RW_WRITER);
+
+	mutex_enter(&ldn->lxdn_tlock);
+	mutex_enter(&vp->v_lock);
+	ASSERT(vp->v_count >= 1);
+
+	/*
+	 * If we don't have the last hold or the link count is non-zero,
+	 * there's little to do -- just drop our hold.
+	 */
+	if (vp->v_count > 1 || ldn->lxdn_nlink != 0) {
+		vp->v_count--;
+
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&ldn->lxdn_tlock);
+		rw_exit(&ldn->lxdn_rwlock);
+		return;
+	}
+
+	/*
+	 * We have the last hold *and* the link count is zero, so this node is
+	 * dead from the filesystem's viewpoint.
+	 */
+	if (ldn->lxdn_size != 0) {
+		if (ldn->lxdn_vnode->v_type == VLNK)
+			kmem_free(ldn->lxdn_symlink, ldn->lxdn_size + 1);
+	}
+
+	mutex_exit(&vp->v_lock);
+	mutex_exit(&ldn->lxdn_tlock);
+
+	vn_invalid(LDNTOV(ldn));
+
+	mutex_enter(&lxdm->lxdm_contents);
+	if (ldn->lxdn_next == NULL)
+		lxdm->lxdm_rootnode->lxdn_prev = ldn->lxdn_prev;
+	else
+		ldn->lxdn_next->lxdn_prev = ldn->lxdn_prev;
+	ldn->lxdn_prev->lxdn_next = ldn->lxdn_next;
+
+	mutex_exit(&lxdm->lxdm_contents);
+	rw_exit(&ldn->lxdn_rwlock);
+	rw_destroy(&ldn->lxdn_rwlock);
+	mutex_destroy(&ldn->lxdn_tlock);
+
+	vn_free(LDNTOV(ldn));
+	kmem_free(ldn, sizeof (lxd_node_t));
+}
+
+/*ARGSUSED*/
+static void
+lxd_inactive(vnode_t *vp, struct cred *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		lxd_front_inactive(vp, cr, ct);
+		return;
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	lxd_free_back_node(ldn);
+}
+
+/* ARGSUSED */
+static int
+lxd_fid(vnode_t *vp, struct fid *fidp, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT)
+		return (ENOTSUP);
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_FID(vp, fidp, ct));
+}
+
+/*
+ * For a front node lookup in the dirent hash table and return a shadow vnode
+ * (lxd_node_t type) of type LXDNT_FRONT.
+ *
+ * For a back node, lookup nm name and return a shadow vnode (lxd_node_t type)
+ * of the real vnode found.
+ */
+static int
+lxd_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
+    int flags, vnode_t *rdir, struct cred *cr, caller_context_t *ct,
+    int *direntflags, pathname_t *realpnp)
+{
+	vnode_t *vp = NULL;
+	int error;
+	vnode_t *realdvp;
+	lxd_mnt_t *lxdm = VTOLXDM(dvp);
+	int doingdotdot = 0;
+	lxd_node_t *ldn = VTOLDN(dvp);
+	lxd_node_t *nldn = NULL;
+
+	/*
+	 * First check for front file which could be instantiated on either a
+	 * front or back node (e.g. the top-level moint point directory node is
+	 * a back node which can have front files created in it).
+	 */
+
+	/* disallow extended attrs */
+	if (flags & LOOKUP_XATTR)
+		return (EINVAL);
+
+	/* Null component name is a synonym for dir being searched. */
+	if (*nm == '\0') {
+		VN_HOLD(dvp);
+		*vpp = dvp;
+		return (0);
+	}
+
+	rw_enter(&ldn->lxdn_rwlock, RW_READER);
+	error = lxd_dirlookup(ldn, nm, &nldn, cr);
+	rw_exit(&ldn->lxdn_rwlock);
+
+	if (error == 0) {
+		/* found */
+		ASSERT(nldn != NULL);
+		*vpp = LDNTOV(nldn);
+		return (0);
+	}
+
+	/* At this point, if dir node is a front node, error */
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (ENOENT);
+	}
+
+	realdvp = REALVP(dvp);
+
+	if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0') {
+		doingdotdot++;
+		/*
+		 * Handle ".." out of mounted filesystem
+		 */
+		while ((realdvp->v_flag & VROOT) && realdvp != rootdir) {
+			realdvp = realdvp->v_vfsp->vfs_vnodecovered;
+			ASSERT(realdvp != NULL);
+		}
+	}
+
+	*vpp = NULL;	/* default(error) case */
+
+	/*
+	 * Do the normal lookup
+	 */
+	if ((error = VOP_LOOKUP(realdvp, nm, &vp, pnp, flags, rdir, cr,
+	    ct, direntflags, realpnp)) != 0) {
+		vp = NULL;
+		goto out;
+	}
+
+	/*
+	 * We do this check here to avoid returning a stale file handle to the
+	 * caller.
+	 */
+	if (nm[0] == '.' && nm[1] == '\0') {
+		ASSERT(vp == realdvp);
+		VN_HOLD(dvp);
+		VN_RELE(vp);
+		*vpp = dvp;
+		return (0);
+	}
+
+	if (doingdotdot) {
+		*vpp = lxd_make_back_node(vp, lxdm);
+		return (0);
+	}
+
+	/*
+	 * If this vnode is mounted on, then we
+	 * traverse to the vnode which is the root of
+	 * the mounted file system.
+	 */
+	if ((error = traverse(&vp)) != 0)
+		goto out;
+
+	/*
+	 * Make a lxd node for the real vnode.
+	 */
+	*vpp = lxd_make_back_node(vp, lxdm);
+	if (vp->v_type != VDIR) {
+		if (IS_DEVVP(*vpp)) {
+			vnode_t *svp;
+
+			svp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
+			VN_RELE(*vpp);
+			if (svp == NULL) {
+				VN_RELE(vp);
+				error = ENOSYS;
+			} else {
+				*vpp = svp;
+			}
+		}
+		return (error);
+	}
+
+out:
+	if (error != 0 && vp != NULL)
+		VN_RELE(vp);
+
+	return (error);
+}
+
+/*ARGSUSED*/
+static int
+lxd_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
+    int mode, vnode_t **vpp, struct cred *cr, int flag, caller_context_t *ct,
+    vsecattr_t *vsecp)
+{
+	int error;
+	lxd_node_t *parent = VTOLDN(dvp);
+	lxd_node_t *lnp = NULL;
+
+	rw_enter(&parent->lxdn_rwlock, RW_READER);
+	error = lxd_dirlookup(parent, nm, &lnp, cr);
+	rw_exit(&parent->lxdn_rwlock);
+
+	/*
+	 * If a back node already exists then there is no need to pass
+	 * the create to native devfs -- just set the vpp to the back
+	 * vnode. If the front node already exists then fail because
+	 * it can't represent a regular file. In both cases, enforce
+	 * open(2)'s EEXIST and EISDIR semantics.
+	 */
+	if (error == 0) {
+		if (exclusive == EXCL) {
+			error = EEXIST;
+		} else if (LDNTOV(lnp)->v_type == VDIR &&
+		    (mode & S_IWRITE)) {
+			error = EISDIR;
+		} else if (lnp->lxdn_type == LXDNT_FRONT) {
+			error = ENOTSUP;
+		}
+
+		if (error != 0) {
+			ldnode_rele(lnp);
+			return (error);
+		}
+
+		VERIFY3S(lnp->lxdn_type, ==, LXDNT_BACK);
+		*vpp = lnp->lxdn_vnode;
+
+		return (error);
+	}
+
+	/*
+	 * We cannot create files in the back devfs but we want to allow for
+	 * O_CREAT on existing files.  Pass this through and let the back file
+	 * system allow or deny it.
+	 */
+	if (parent->lxdn_type == LXDNT_BACK) {
+		vnode_t *vp = NULL;
+
+		if (*nm == '\0') {
+			ASSERT(vpp && dvp == *vpp);
+			vp = REALVP(*vpp);
+		}
+		if ((error = VOP_CREATE(REALVP(dvp), nm, va, exclusive, mode,
+		    &vp, cr, flag, ct, vsecp)) == 0) {
+			*vpp = lxd_make_back_node(vp, VFSTOLXDM(dvp->v_vfsp));
+			if (IS_DEVVP(*vpp)) {
+				vnode_t *svp;
+
+				svp = specvp(*vpp, (*vpp)->v_rdev,
+				    (*vpp)->v_type, cr);
+				VN_RELE(*vpp);
+				if (svp == NULL) {
+					return (ENOSYS);
+				}
+				*vpp = svp;
+			}
+			return (0);
+		}
+		/*
+		 * If we were unable to perform the VOP_CREATE for any reason
+		 * other than sdev being read-only, we should bail.
+		 */
+		if (error != ENOTSUP && error != EROFS) {
+			return (error);
+		}
+	}
+
+	/*
+	 * While we don't allow creating data-containing files under
+	 * lx devfs, we must allow VSOCK front nodes to be created so
+	 * that paths such as /dev/log can be used as AF_UNIX sockets.
+	 */
+	if (va->va_type == VSOCK) {
+		lxd_mnt_t *lxdm = VTOLXDM(parent->lxdn_vnode);
+
+		lnp = NULL;
+		rw_enter(&parent->lxdn_rwlock, RW_WRITER);
+		error = lxd_direnter(lxdm, parent, nm, DE_CREATE, NULL, NULL,
+		    va, &lnp, cr);
+		rw_exit(&parent->lxdn_rwlock);
+
+		if (error == 0) {
+			*vpp = LDNTOV(lnp);
+		} else if (lnp != NULL) {
+			/*
+			 * It's possible that a racing process created an entry
+			 * at this name since we last performed the lookup.
+			 */
+			ldnode_rele(lnp);
+		}
+	} else {
+		error = ENOTSUP;
+	}
+
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+lxd_remove(vnode_t *dvp, char *nm, struct cred *cr, caller_context_t *ct,
+    int flags)
+{
+	lxd_node_t *parent = VTOLDN(dvp);
+	lxd_node_t *ldn = NULL;
+	int error;
+
+	/* can only remove existing front nodes */
+	error = lxd_dirlookup(parent, nm, &ldn, cr);
+	if (error) {
+		return (error);
+	}
+
+	ASSERT(ldn != NULL);
+	ASSERT(ldn->lxdn_type == LXDNT_FRONT);
+	rw_enter(&parent->lxdn_rwlock, RW_WRITER);
+	rw_enter(&ldn->lxdn_rwlock, RW_WRITER);
+
+	error = lxd_dirdelete(parent, ldn, nm, DR_REMOVE, cr);
+
+	rw_exit(&ldn->lxdn_rwlock);
+	rw_exit(&parent->lxdn_rwlock);
+
+	ldnode_rele(ldn);
+
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+lxd_link(vnode_t *tdvp, vnode_t *vp, char *tnm, struct cred *cr,
+    caller_context_t *ct, int flags)
+{
+	return (ENOTSUP);
+}
+
+/* ARGSUSED */
+static int
+lxd_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, struct cred *cr,
+    caller_context_t *ct, int flags)
+{
+	lxd_node_t *oldparent = VTOLDN(odvp);
+	lxd_node_t *newparent;
+	lxd_mnt_t *lxdm = VTOLXDM(oldparent->lxdn_vnode);
+	lxd_node_t *fromnode = NULL;
+	int error;
+	int samedir = 0;
+
+	if (!vn_matchops(ndvp, lxd_vnodeops)) {
+		/* cannot rename out of this file system */
+		return (EACCES);
+	}
+
+	mutex_enter(&lxdm->lxdm_renamelck);
+
+	newparent = VTOLDN(ndvp);
+
+	/*
+	 * We can only rename front nodes.
+	 */
+	error = lxd_dirlookup(oldparent, onm, &fromnode, cr);
+	if (error != 0) {
+		/* not found in front */
+		mutex_exit(&lxdm->lxdm_renamelck);
+		return (error);
+	}
+
+	/*
+	 * Make sure we can delete the old (source) entry.  This
+	 * requires write permission on the containing directory.  If
+	 * that directory is "sticky" it requires further checks.
+	 */
+	if ((error = lxd_naccess(oldparent, VWRITE, cr)) != 0)
+		goto done;
+
+	/*
+	 * Check for renaming to or from '.' or '..' or that
+	 * fromnode == oldparent
+	 */
+	if ((onm[0] == '.' &&
+	    (onm[1] == '\0' || (onm[1] == '.' && onm[2] == '\0'))) ||
+	    (nnm[0] == '.' &&
+	    (nnm[1] == '\0' || (nnm[1] == '.' && nnm[2] == '\0'))) ||
+	    (oldparent == fromnode)) {
+		error = EINVAL;
+		goto done;
+	}
+
+	samedir = (oldparent == newparent);
+
+	/*
+	 * Make sure we can search and rename into the destination directory.
+	 */
+	if (!samedir) {
+		if ((error = lxd_naccess(newparent, VEXEC|VWRITE, cr)) != 0)
+			goto done;
+	}
+
+	/*
+	 * Link source to new target
+	 */
+	rw_enter(&newparent->lxdn_rwlock, RW_WRITER);
+	error = lxd_direnter(lxdm, newparent, nnm, DE_RENAME,
+	    oldparent, fromnode, (struct vattr *)NULL, (lxd_node_t **)NULL,
+	    cr);
+	rw_exit(&newparent->lxdn_rwlock);
+
+	if (error)
+		goto done;
+
+	/*
+	 * Unlink from source.
+	 */
+	rw_enter(&oldparent->lxdn_rwlock, RW_WRITER);
+	rw_enter(&fromnode->lxdn_rwlock, RW_WRITER);
+
+	error = lxd_dirdelete(oldparent, fromnode, onm, DR_RENAME, cr);
+
+	/*
+	 * The following handles the case where our source node was
+	 * removed before we got to it.
+	 */
+	if (error == ENOENT)
+		error = 0;
+
+	rw_exit(&fromnode->lxdn_rwlock);
+	rw_exit(&oldparent->lxdn_rwlock);
+
+done:
+	ldnode_rele(fromnode);
+	mutex_exit(&lxdm->lxdm_renamelck);
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+lxd_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp,
+    struct cred *cr, caller_context_t *ct, int flags, vsecattr_t *vsecp)
+{
+	int error;
+	vnode_t *tvp;
+	lxd_node_t *ndir = NULL;
+	lxd_node_t *parent = VTOLDN(dvp);
+	lxd_mnt_t *lxdm = VTOLXDM(parent->lxdn_vnode);
+
+	/* check for existence in both front and back */
+	if (lxd_lookup(dvp, nm, &tvp, NULL, 0, NULL, cr, ct, NULL, NULL) == 0) {
+		/* The entry already exists */
+		VN_RELE(tvp);
+		return (EEXIST);
+	}
+
+	/* make front directory */
+	rw_enter(&parent->lxdn_rwlock, RW_WRITER);
+	error = lxd_direnter(lxdm, parent, nm, DE_MKDIR, NULL, NULL,
+	    va, &ndir, cr);
+	rw_exit(&parent->lxdn_rwlock);
+
+	if (error != 0) {
+		if (ndir != NULL)
+			ldnode_rele(ndir);
+	} else {
+		*vpp = LDNTOV(ndir);
+	}
+
+	return (error);
+}
+
+static int
+lxd_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		*vpp = vp;
+		return (0);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	while (vn_matchops(vp, lxd_vnodeops))
+		vp = REALVP(vp);
+
+	if (VOP_REALVP(vp, vpp, ct) != 0)
+		*vpp = vp;
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+lxd_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, struct cred *cr,
+    caller_context_t *ct, int flags)
+{
+	int error;
+	lxd_node_t *ldn;
+	struct vnode *vp;
+	lxd_node_t *parent = VTOLDN(dvp);
+
+	/*
+	 * Return error if trying to remove . or ..
+	 */
+	if (strcmp(nm, ".") == 0)
+		return (EINVAL);
+	if (strcmp(nm, "..") == 0)
+		return (EEXIST);
+
+	error = lxd_dirlookup(VTOLDN(dvp), nm, &ldn, cr);
+	if (error != 0) {
+		/* not found in front */
+		return (error);
+	}
+
+	rw_enter(&parent->lxdn_rwlock, RW_WRITER);
+	rw_enter(&ldn->lxdn_rwlock, RW_WRITER);
+
+	vp = LDNTOV(ldn);
+	if (vp == dvp || vp == cdir) {
+		error = EINVAL;
+		goto err;
+	}
+
+	if (ldn->lxdn_vnode->v_type != VDIR) {
+		error = ENOTDIR;
+		goto err;
+	}
+
+	mutex_enter(&ldn->lxdn_tlock);
+	if (ldn->lxdn_nlink > 2) {
+		mutex_exit(&ldn->lxdn_tlock);
+		error = EEXIST;
+		goto err;
+	}
+	mutex_exit(&ldn->lxdn_tlock);
+
+	/* Check for an empty directory */
+	if (ldn->lxdn_dirents > 2) {
+		error = EEXIST;
+		gethrestime(&ldn->lxdn_atime);
+		goto err;
+	}
+
+	if (vn_vfswlock(vp)) {
+		error = EBUSY;
+		goto err;
+	}
+	if (vn_mountedvfs(vp) != NULL) {
+		error = EBUSY;
+		vn_vfsunlock(vp);
+		goto err;
+	}
+
+	error = lxd_dirdelete(parent, ldn, nm, DR_RMDIR, cr);
+	vn_vfsunlock(vp);
+
+err:
+	rw_exit(&ldn->lxdn_rwlock);
+	rw_exit(&parent->lxdn_rwlock);
+	ldnode_rele(ldn);
+
+	return (error);
+}
+
+/* Not static so it can be used during mount. */
+/* ARGSUSED */
+int
+lxd_symlink(vnode_t *dvp, char *nm, struct vattr *tva, char *tnm,
+    struct cred *cr, caller_context_t *ct, int flags)
+{
+	lxd_node_t *parent = VTOLDN(dvp);
+	lxd_mnt_t *lxdm = VTOLXDM(parent->lxdn_vnode);
+	lxd_node_t *self = NULL;
+	vnode_t *tvp;
+	char *cp = NULL;
+	int error;
+	size_t len;
+
+	/* this will check for existence in both front and back */
+	if (lxd_lookup(dvp, nm, &tvp, NULL, 0, NULL, cr, ct, NULL, NULL) == 0) {
+		/* The entry already exists */
+		VN_RELE(tvp);
+		return (EEXIST);
+	}
+
+	/* make symlink in the front */
+	rw_enter(&parent->lxdn_rwlock, RW_WRITER);
+	error = lxd_direnter(lxdm, parent, nm, DE_CREATE, NULL, NULL,
+	    tva, &self, cr);
+	rw_exit(&parent->lxdn_rwlock);
+
+	if (error) {
+		if (self != NULL)
+			ldnode_rele(self);
+		return (error);
+	}
+
+	len = strlen(tnm) + 1;
+	cp = kmem_alloc(len, KM_NOSLEEP | KM_NORMALPRI);
+	if (cp == NULL) {
+		ldnode_rele(self);
+		return (ENOSPC);
+	}
+	(void) strcpy(cp, tnm);
+
+	self->lxdn_symlink = cp;
+	self->lxdn_size = len - 1;
+	ldnode_rele(self);
+
+	return (error);
+}
+
+static int
+lxd_readlink(vnode_t *vp, struct uio *uiop, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		int error;
+
+		if (vp->v_type != VLNK)
+			return (EINVAL);
+
+		rw_enter(&ldn->lxdn_rwlock, RW_READER);
+		error = uiomove(ldn->lxdn_symlink, ldn->lxdn_size, UIO_READ,
+		    uiop);
+		gethrestime(&ldn->lxdn_atime);
+		rw_exit(&ldn->lxdn_rwlock);
+		return (error);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_READLINK(vp, uiop, cr, ct));
+}
+
+static int
+lx_merge_front(vnode_t *vp, struct uio *uiop, off_t req_off, int *eofp)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+	struct dirent *sd;
+	lxd_dirent_t *ldp;
+	enum lxd_node_type type = ldn->lxdn_type;
+	ssize_t uresid;
+	off_t front_off;
+	int error = 0;
+	int sdlen;
+
+	/* skip the front entries if the back read was incomplete */
+	if (*eofp == 0)
+		return (0);
+
+	/*
+	 * If this was a back node then reading that node has completed and we
+	 * may have a partially full uio struct. eof should be set to true.
+	 * Leave it set since we're likely to hit eof for the front nodes (if
+	 * any).
+	 */
+
+	front_off = uiop->uio_offset + 1;
+	sdlen = sizeof (struct dirent) + MAXPATHLEN;
+	/* zalloc to ensure we don't have anything in the d_name buffer */
+	sd = (struct dirent *)kmem_zalloc(sdlen, KM_SLEEP);
+	ldp = ldn->lxdn_dir;
+	while (ldp != NULL && (uresid = uiop->uio_resid) > 0) {
+		int namelen;
+		int reclen;
+
+		/*
+		 * Skip dot and dotdot for back nodes since we have them
+		 * already.
+		 */
+		if (type == LXDNT_BACK &&
+		    (strcmp(ldp->lddir_name, ".") == 0 ||
+		    strcmp(ldp->lddir_name, "..") == 0)) {
+			ldp = ldp->lddir_next;
+			continue;
+		}
+
+		/*
+		 * Might have previously had a partial readdir of the front
+		 * nodes, and now we're back for more, or we may just be
+		 * be doing a follow-up readdir after we've previously
+		 * returned all front and back nodes.
+		 */
+		if (front_off > req_off) {
+			namelen = strlen(ldp->lddir_name); /* no +1 needed */
+			reclen = (int)DIRENT64_RECLEN(namelen);
+
+			/*
+			 * If the size of the data to transfer is greater
+			 * than that requested, then we can't do it this
+			 * transfer.
+			 */
+			if (reclen > uresid) {
+				*eofp = 0;
+				/* Buffer too small for any entries. */
+				if (front_off == 0)
+					error = EINVAL;
+				break;
+			}
+
+			(void) strncpy(sd->d_name, ldp->lddir_name,
+			    DIRENT64_NAMELEN(reclen));
+			sd->d_reclen = (ushort_t)reclen;
+			sd->d_ino = (ino_t)ldp->lddir_node->lxdn_nodeid;
+			sd->d_off = front_off;
+
+			/* uiomove will adjust iov_base properly */
+			if ((error = uiomove((caddr_t)sd, reclen, UIO_READ,
+			    uiop)) != 0) {
+				*eofp = 0;
+				break;
+			}
+		}
+
+		/*
+		 * uiomove() above updates both uio_resid and uio_offset by the
+		 * same amount but we want uio_offset to change in increments
+		 * of 1, which is different from the number of bytes being
+		 * returned to the caller, so we set uio_offset explicitly,
+		 * ignoring what uiomove() did.
+		 */
+		uiop->uio_offset = front_off;
+		front_off++;
+
+		ldp = ldp->lddir_next;
+	}
+
+	kmem_free(sd, sdlen);
+	return (error);
+}
+
+static int
+lxd_readdir(vnode_t *vp, struct uio *uiop, struct cred *cr, int *eofp,
+    caller_context_t *ct, int flags)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+	vnode_t *rvp;
+	int res;
+	off_t req_off;
+
+	if (uiop->uio_iovcnt != 1)
+		return (EINVAL);
+
+	if (vp->v_type != VDIR)
+		return (ENOTDIR);
+
+	req_off = uiop->uio_offset;
+
+	/* First read the back node (if it is one) */
+	if (ldn->lxdn_type == LXDNT_BACK) {
+		rvp = REALVP(vp);
+		res = VOP_READDIR(rvp, uiop, cr, eofp, ct, flags);
+		if (res != 0)
+			return (res);
+	} else {
+		/* setup for merge_front */
+		ASSERT(ldn->lxdn_type == LXDNT_FRONT);
+		/* caller should have already called lxd_rwlock */
+		ASSERT(RW_READ_HELD(&ldn->lxdn_rwlock));
+
+		*eofp = 1;
+		/*
+		 * The merge code starts the offset calculation from uio_offset,
+		 * which is normally already set to the high value by the back
+		 * code, but in this case we need to count up from 0.
+		 */
+		uiop->uio_offset = 0;
+	}
+
+	/*
+	 * Our back nodes can also have front entries hanging on them so we
+	 * need to merge those in. Or, we may simply have a front node (i.e. a
+	 * front subdir).
+	 */
+	res = lx_merge_front(vp, uiop, req_off, eofp);
+	return (res);
+}
+
+static int
+lxd_rwlock(vnode_t *vp, int write_lock, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		if (write_lock) {
+			rw_enter(&ldn->lxdn_rwlock, RW_WRITER);
+		} else {
+			rw_enter(&ldn->lxdn_rwlock, RW_READER);
+		}
+		return (write_lock);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_RWLOCK(vp, write_lock, ct));
+}
+
+static void
+lxd_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		rw_exit(&ldn->lxdn_rwlock);
+		return;
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	VOP_RWUNLOCK(vp, write_lock, ct);
+}
+
+static int
+lxd_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_SEEK(vp, ooff, noffp, ct));
+}
+
+static int
+lxd_cmp(vnode_t *vp1, vnode_t *vp2, caller_context_t *ct)
+{
+	while (vn_matchops(vp1, lxd_vnodeops) &&
+	    VTOLDN(vp1)->lxdn_type == LXDNT_BACK) {
+		vp1 = REALVP(vp1);
+	}
+	while (vn_matchops(vp2, lxd_vnodeops) &&
+	    VTOLDN(vp2)->lxdn_type == LXDNT_BACK) {
+		vp2 = REALVP(vp2);
+	}
+
+	if (vn_matchops(vp1, lxd_vnodeops) || vn_matchops(vp2, lxd_vnodeops))
+		return (vp1 == vp2);
+
+	return (VOP_CMP(vp1, vp2, ct));
+}
+
+static int
+lxd_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag, offset_t offset,
+    struct flk_callback *flk_cbp, cred_t *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_FRLOCK(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
+}
+
+static int
+lxd_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag, offset_t offset,
+    struct cred *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_SPACE(vp, cmd, bfp, flag, offset, cr, ct));
+}
+
+static int
+lxd_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *prot,
+    struct page *parr[], size_t psz, struct seg *seg, caddr_t addr,
+    enum seg_rw rw, struct cred *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_GETPAGE(vp, off, len, prot, parr, psz, seg, addr, rw, cr,
+	    ct));
+}
+
+static int
+lxd_putpage(vnode_t *vp, offset_t off, size_t len, int flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_PUTPAGE(vp, off, len, flags, cr, ct));
+}
+
+static int
+lxd_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp, size_t len,
+    uchar_t prot, uchar_t maxprot, uint_t flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_MAP(vp, off, as, addrp, len, prot, maxprot, flags, cr, ct));
+}
+
+static int
+lxd_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr, size_t len,
+    uchar_t prot, uchar_t maxprot, uint_t flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_ADDMAP(vp, off, as, addr, len, prot, maxprot, flags, cr,
+	    ct));
+}
+
+static int
+lxd_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr, size_t len,
+    uint_t prot, uint_t maxprot, uint_t flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_DELMAP(vp, off, as, addr, len, prot, maxprot, flags, cr,
+	    ct));
+}
+
+static int
+lxd_poll(vnode_t *vp, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_POLL(vp, events, anyyet, reventsp, phpp, ct));
+}
+
+static int
+lxd_dump(vnode_t *vp, caddr_t addr, offset_t bn, offset_t count,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_DUMP(vp, addr, bn, count, ct));
+}
+
+static int
+lxd_pathconf(vnode_t *vp, int cmd, ulong_t *valp, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_PATHCONF(vp, cmd, valp, cr, ct));
+}
+
+static int
+lxd_pageio(vnode_t *vp, struct page *pp, u_offset_t io_off, size_t io_len,
+    int flags, cred_t *cr, caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_PAGEIO(vp, pp, io_off, io_len, flags, cr, ct));
+}
+
+static void
+lxd_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return;
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	if (vp != NULL && !VN_ISKAS(vp))
+		VOP_DISPOSE(vp, pp, fl, dn, cr, ct);
+}
+
+static int
+lxd_setsecattr(vnode_t *vp, vsecattr_t *secattr, int flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (ENOSYS);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	if (vn_is_readonly(vp))
+		return (EROFS);
+
+	vp = REALVP(vp);
+	return (VOP_SETSECATTR(vp, secattr, flags, cr, ct));
+}
+
+static int
+lxd_getsecattr(vnode_t *vp, vsecattr_t *secattr, int flags, struct cred *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (ENOSYS);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_GETSECATTR(vp, secattr, flags, cr, ct));
+}
+
+static int
+lxd_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
+    caller_context_t *ct)
+{
+	lxd_node_t *ldn = VTOLDN(vp);
+
+	if (ldn->lxdn_type == LXDNT_FRONT) {
+		return (EINVAL);
+	}
+
+	ASSERT(ldn->lxdn_type == LXDNT_BACK);
+	vp = REALVP(vp);
+	return (VOP_SHRLOCK(vp, cmd, shr, flag, cr, ct));
+}
+
+/*
+ * Loopback vnode operations vector.
+ */
+
+struct vnodeops *lxd_vnodeops;
+
+const fs_operation_def_t lxd_vnodeops_template[] = {
+	VOPNAME_OPEN,		{ .vop_open = lxd_open },
+	VOPNAME_CLOSE,		{ .vop_close = lxd_close },
+	VOPNAME_READ,		{ .vop_read = lxd_read },
+	VOPNAME_WRITE,		{ .vop_write = lxd_write },
+	VOPNAME_IOCTL,		{ .vop_ioctl = lxd_ioctl },
+	VOPNAME_SETFL,		{ .vop_setfl = lxd_setfl },
+	VOPNAME_GETATTR,	{ .vop_getattr = lxd_getattr },
+	VOPNAME_SETATTR,	{ .vop_setattr = lxd_setattr },
+	VOPNAME_ACCESS,		{ .vop_access = lxd_access },
+	VOPNAME_LOOKUP,		{ .vop_lookup = lxd_lookup },
+	VOPNAME_CREATE,		{ .vop_create = lxd_create },
+	VOPNAME_REMOVE,		{ .vop_remove = lxd_remove },
+	VOPNAME_LINK,		{ .vop_link = lxd_link },
+	VOPNAME_RENAME,		{ .vop_rename = lxd_rename },
+	VOPNAME_MKDIR,		{ .vop_mkdir = lxd_mkdir },
+	VOPNAME_RMDIR,		{ .vop_rmdir = lxd_rmdir },
+	VOPNAME_READDIR,	{ .vop_readdir = lxd_readdir },
+	VOPNAME_SYMLINK,	{ .vop_symlink = lxd_symlink },
+	VOPNAME_READLINK,	{ .vop_readlink = lxd_readlink },
+	VOPNAME_FSYNC,		{ .vop_fsync = lxd_fsync },
+	VOPNAME_INACTIVE,	{ .vop_inactive = lxd_inactive },
+	VOPNAME_FID,		{ .vop_fid = lxd_fid },
+	VOPNAME_RWLOCK,		{ .vop_rwlock = lxd_rwlock },
+	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = lxd_rwunlock },
+	VOPNAME_SEEK,		{ .vop_seek = lxd_seek },
+	VOPNAME_CMP,		{ .vop_cmp = lxd_cmp },
+	VOPNAME_FRLOCK,		{ .vop_frlock = lxd_frlock },
+	VOPNAME_SPACE,		{ .vop_space = lxd_space },
+	VOPNAME_REALVP,		{ .vop_realvp = lxd_realvp },
+	VOPNAME_GETPAGE,	{ .vop_getpage = lxd_getpage },
+	VOPNAME_PUTPAGE,	{ .vop_putpage = lxd_putpage },
+	VOPNAME_MAP,		{ .vop_map = lxd_map },
+	VOPNAME_ADDMAP,		{ .vop_addmap = lxd_addmap },
+	VOPNAME_DELMAP,		{ .vop_delmap = lxd_delmap },
+	VOPNAME_POLL,		{ .vop_poll = lxd_poll },
+	VOPNAME_DUMP,		{ .vop_dump = lxd_dump },
+	VOPNAME_DUMPCTL,	{ .error = fs_error },
+	VOPNAME_PATHCONF,	{ .vop_pathconf = lxd_pathconf },
+	VOPNAME_PAGEIO,		{ .vop_pageio = lxd_pageio },
+	VOPNAME_DISPOSE,	{ .vop_dispose = lxd_dispose },
+	VOPNAME_SETSECATTR,	{ .vop_setsecattr = lxd_setsecattr },
+	VOPNAME_GETSECATTR,	{ .vop_getsecattr = lxd_getsecattr },
+	VOPNAME_SHRLOCK,	{ .vop_shrlock = lxd_shrlock },
+	NULL,			NULL
+};
diff --git a/usr/src/uts/common/brand/lx/dtrace/lx_systrace.c b/usr/src/uts/common/brand/lx/dtrace/lx_systrace.c
new file mode 100644
index 0000000000..de5a16c414
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/dtrace/lx_systrace.c
@@ -0,0 +1,499 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+
+#include <sys/modctl.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/stat.h>
+#include <sys/conf.h>
+#include <sys/frame.h>
+#include <sys/dtrace.h>
+#include <sys/dtrace_impl.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_impl.h>
+
+/*
+ * We store the syscall number in the low 16 bits (which limits us to 64k
+ * syscalls). The next bit indicates entry/return probe and the next bit
+ * indicates 64bit/32bit syscall.
+ */
+#define	SCALL_MASK	0xffff
+#define	ENTRY_FLAG	0x10000
+#define	SYSC_64_BIT	0x100000
+
+#define	LX_SYSTRACE_IS64BIT(x)	((int)(x) & SYSC_64_BIT)
+#define	LX_SYSTRACE_ISENTRY(x)	((int)(x) & ENTRY_FLAG)
+#define	LX_SYSTRACE_SYSNUM(x)	((int)(x) & SCALL_MASK)
+
+#define	LX_SYSTRACE32_ENTRY(id)	(ENTRY_FLAG | (id))
+#define	LX_SYSTRACE32_RETURN(id) (id)
+
+#define	LX_SYSTRACE64_ENTRY(id)	(SYSC_64_BIT | ENTRY_FLAG | (id))
+#define	LX_SYSTRACE64_RETURN(id) (SYSC_64_BIT | id)
+
+#define	LX_SYSTRACE_ENTRY_AFRAMES	2
+#define	LX_SYSTRACE_RETURN_AFRAMES	4
+
+typedef struct lx_systrace_sysent {
+	const char *lss_name;
+	dtrace_id_t lss_entry;
+	dtrace_id_t lss_return;
+} lx_systrace_sysent_t;
+
+static dev_info_t *lx_systrace_devi;
+static dtrace_provider_id_t lx_systrace_id;
+static kmutex_t lx_systrace_lock;
+static uint_t lx_systrace_nenabled;
+
+static int lx_systrace_nsysent32;
+static lx_systrace_sysent_t *lx_systrace_sysent32;
+
+#if defined(_LP64)
+static int lx_systrace_nsysent64;
+static lx_systrace_sysent_t *lx_systrace_sysent64;
+#endif
+
+/*ARGSUSED*/
+static void
+lx_systrace_entry(ulong_t sysnum, ulong_t arg0, ulong_t arg1, ulong_t arg2,
+    ulong_t arg3, ulong_t arg4, ulong_t arg5)
+{
+	dtrace_id_t id;
+
+#if defined(_LP64)
+	if ((ttoproc(curthread))->p_model == DATAMODEL_NATIVE) {
+		if (sysnum >= lx_systrace_nsysent64)
+			return;
+		id = lx_systrace_sysent64[sysnum].lss_entry;
+	} else
+#endif
+	{
+		if (sysnum >= lx_systrace_nsysent32)
+			return;
+		id = lx_systrace_sysent32[sysnum].lss_entry;
+	}
+
+	if (id == DTRACE_IDNONE)
+		return;
+	dtrace_probe(id, arg0, arg1, arg2, arg3, arg4);
+}
+
+/*ARGSUSED*/
+static void
+lx_systrace_return(ulong_t sysnum, ulong_t arg0, ulong_t arg1, ulong_t arg2,
+    ulong_t arg3, ulong_t arg4, ulong_t arg5)
+{
+	dtrace_id_t id;
+
+#if defined(_LP64)
+	if ((ttoproc(curthread))->p_model == DATAMODEL_NATIVE) {
+		if (sysnum >= lx_systrace_nsysent64)
+			return;
+		id = lx_systrace_sysent64[sysnum].lss_return;
+	} else
+#endif
+	{
+		if (sysnum >= lx_systrace_nsysent32)
+			return;
+		id = lx_systrace_sysent32[sysnum].lss_return;
+	}
+
+	if (id == DTRACE_IDNONE)
+		return;
+	dtrace_probe(id, arg0, arg1, arg2, arg3, arg4);
+}
+
+/*ARGSUSED*/
+static void
+lx_systrace_provide(void *arg, const dtrace_probedesc_t *desc)
+{
+	int i;
+
+	if (desc != NULL)
+		return;
+
+	for (i = 0; i < lx_systrace_nsysent32; i++) {
+		if (dtrace_probe_lookup(lx_systrace_id, "sys32",
+		    lx_systrace_sysent32[i].lss_name, "entry") != 0)
+			continue;
+
+		(void) dtrace_probe_create(lx_systrace_id, "sys32",
+		    lx_systrace_sysent32[i].lss_name, "entry",
+		    LX_SYSTRACE_ENTRY_AFRAMES,
+		    (void *)((uintptr_t)LX_SYSTRACE32_ENTRY(i)));
+
+		(void) dtrace_probe_create(lx_systrace_id, "sys32",
+		    lx_systrace_sysent32[i].lss_name, "return",
+		    LX_SYSTRACE_RETURN_AFRAMES,
+		    (void *)((uintptr_t)LX_SYSTRACE32_RETURN(i)));
+
+		lx_systrace_sysent32[i].lss_entry = DTRACE_IDNONE;
+		lx_systrace_sysent32[i].lss_return = DTRACE_IDNONE;
+	}
+
+#if defined(_LP64)
+	for (i = 0; i < lx_systrace_nsysent64; i++) {
+		if (dtrace_probe_lookup(lx_systrace_id, "sys64",
+		    lx_systrace_sysent64[i].lss_name, "entry") != 0)
+			continue;
+
+		(void) dtrace_probe_create(lx_systrace_id, "sys64",
+		    lx_systrace_sysent64[i].lss_name, "entry",
+		    LX_SYSTRACE_ENTRY_AFRAMES,
+		    (void *)((uintptr_t)LX_SYSTRACE64_ENTRY(i)));
+
+		(void) dtrace_probe_create(lx_systrace_id, "sys64",
+		    lx_systrace_sysent64[i].lss_name, "return",
+		    LX_SYSTRACE_RETURN_AFRAMES,
+		    (void *)((uintptr_t)LX_SYSTRACE64_RETURN(i)));
+
+		lx_systrace_sysent64[i].lss_entry = DTRACE_IDNONE;
+		lx_systrace_sysent64[i].lss_return = DTRACE_IDNONE;
+	}
+#endif
+}
+
+/*ARGSUSED*/
+static int
+lx_systrace_enable(void *arg, dtrace_id_t id, void *parg)
+{
+	int sysnum = LX_SYSTRACE_SYSNUM((uintptr_t)parg);
+
+	mutex_enter(&lx_systrace_lock);
+	if (lx_systrace_nenabled++ == 0)
+		lx_brand_systrace_enable();
+	mutex_exit(&lx_systrace_lock);
+
+#if defined(_LP64)
+	if (LX_SYSTRACE_IS64BIT((uintptr_t)parg)) {
+		ASSERT(sysnum < lx_systrace_nsysent64);
+
+		if (LX_SYSTRACE_ISENTRY((uintptr_t)parg)) {
+			lx_systrace_sysent64[sysnum].lss_entry = id;
+		} else {
+			lx_systrace_sysent64[sysnum].lss_return = id;
+		}
+	} else
+#endif
+	{
+		ASSERT(sysnum < lx_systrace_nsysent32);
+
+		if (LX_SYSTRACE_ISENTRY((uintptr_t)parg)) {
+			lx_systrace_sysent32[sysnum].lss_entry = id;
+		} else {
+			lx_systrace_sysent32[sysnum].lss_return = id;
+		}
+	}
+	return (0);
+}
+
+/*ARGSUSED*/
+static void
+lx_systrace_disable(void *arg, dtrace_id_t id, void *parg)
+{
+	int sysnum = LX_SYSTRACE_SYSNUM((uintptr_t)parg);
+
+#if defined(_LP64)
+	if (LX_SYSTRACE_IS64BIT((uintptr_t)parg)) {
+		ASSERT(sysnum < lx_systrace_nsysent64);
+
+		if (LX_SYSTRACE_ISENTRY((uintptr_t)parg)) {
+			lx_systrace_sysent64[sysnum].lss_entry = DTRACE_IDNONE;
+		} else {
+			lx_systrace_sysent64[sysnum].lss_return = DTRACE_IDNONE;
+		}
+	} else
+#endif
+	{
+		ASSERT(sysnum < lx_systrace_nsysent32);
+
+		if (LX_SYSTRACE_ISENTRY((uintptr_t)parg)) {
+			lx_systrace_sysent32[sysnum].lss_entry = DTRACE_IDNONE;
+		} else {
+			lx_systrace_sysent32[sysnum].lss_return = DTRACE_IDNONE;
+		}
+	}
+
+	mutex_enter(&lx_systrace_lock);
+	if (--lx_systrace_nenabled == 0)
+		lx_brand_systrace_disable();
+	mutex_exit(&lx_systrace_lock);
+}
+
+/*ARGSUSED*/
+static void
+lx_systrace_destroy(void *arg, dtrace_id_t id, void *parg)
+{
+}
+
+/*ARGSUSED*/
+static uint64_t
+lx_systrace_getarg(void *arg, dtrace_id_t id, void *parg, int argno,
+    int aframes)
+{
+	struct frame *fp = (struct frame *)dtrace_getfp();
+	uintptr_t *stack;
+	uint64_t val = 0;
+	int i;
+
+	if (argno >= 6)
+		return (0);
+
+	/*
+	 * Walk the four frames down the stack to the entry or return callback.
+	 * Our callback calls dtrace_probe() which calls dtrace_dif_variable()
+	 * which invokes this function to get the extended arguments. We get
+	 * the frame pointer in via call to dtrace_getfp() above which makes for
+	 * four frames.
+	 */
+	for (i = 0; i < 4; i++) {
+		fp = (struct frame *)fp->fr_savfp;
+	}
+
+	stack = (uintptr_t *)&fp[1];
+
+	/*
+	 * Skip the first argument to the callback -- the system call number.
+	 */
+	argno++;
+
+#ifdef __amd64
+	/*
+	 * On amd64, the first 6 arguments are passed in registers while
+	 * subsequent arguments are on the stack.
+	 */
+	argno -= 6;
+#endif
+
+	DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
+	val = stack[argno];
+	DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
+
+	return (val);
+}
+
+
+static const dtrace_pattr_t lx_systrace_attr = {
+{ DTRACE_STABILITY_EVOLVING, DTRACE_STABILITY_EVOLVING, DTRACE_CLASS_COMMON },
+{ DTRACE_STABILITY_PRIVATE, DTRACE_STABILITY_PRIVATE, DTRACE_CLASS_UNKNOWN },
+{ DTRACE_STABILITY_PRIVATE, DTRACE_STABILITY_PRIVATE, DTRACE_CLASS_ISA },
+{ DTRACE_STABILITY_EVOLVING, DTRACE_STABILITY_EVOLVING, DTRACE_CLASS_COMMON },
+{ DTRACE_STABILITY_PRIVATE, DTRACE_STABILITY_PRIVATE, DTRACE_CLASS_ISA },
+};
+
+static dtrace_pops_t lx_systrace_pops = {
+	lx_systrace_provide,
+	NULL,
+	lx_systrace_enable,
+	lx_systrace_disable,
+	NULL,
+	NULL,
+	NULL,
+	lx_systrace_getarg,
+	NULL,
+	lx_systrace_destroy
+};
+
+static int
+lx_systrace_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
+{
+	int i;
+
+	switch (cmd) {
+	case DDI_ATTACH:
+		break;
+	case DDI_RESUME:
+		return (DDI_SUCCESS);
+	default:
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_create_minor_node(devi, "lx_systrace", S_IFCHR,
+	    0, DDI_PSEUDO, NULL) == DDI_FAILURE ||
+	    dtrace_register("lx-syscall", &lx_systrace_attr,
+	    DTRACE_PRIV_USER, 0, &lx_systrace_pops, NULL,
+	    &lx_systrace_id) != 0) {
+		ddi_remove_minor_node(devi, NULL);
+		return (DDI_FAILURE);
+	}
+
+	ddi_report_dev(devi);
+	lx_systrace_devi = devi;
+
+	/*
+	 * Initialize the 32-bit table.
+	 */
+	VERIFY(lx_nsysent32 > 0);
+	lx_systrace_nsysent32 = lx_nsysent32;
+	lx_systrace_sysent32 = kmem_zalloc(lx_systrace_nsysent32 *
+	    sizeof (lx_systrace_sysent_t), KM_SLEEP);
+
+	for (i = 0; i < lx_systrace_nsysent32; i++) {
+		lx_systrace_sysent32[i].lss_name = lx_sysent32[i].sy_name;
+		lx_systrace_sysent32[i].lss_entry = DTRACE_IDNONE;
+		lx_systrace_sysent32[i].lss_return = DTRACE_IDNONE;
+	}
+
+#if defined(_LP64)
+	/*
+	 * Initialize the 64-bit table.
+	 */
+	VERIFY(lx_nsysent64 > 0);
+	lx_systrace_nsysent64 = lx_nsysent64;
+	lx_systrace_sysent64 = kmem_zalloc(lx_systrace_nsysent64 *
+	    sizeof (lx_systrace_sysent_t), KM_SLEEP);
+
+	for (i = 0; i < lx_systrace_nsysent64; i++) {
+		lx_systrace_sysent64[i].lss_name = lx_sysent64[i].sy_name;
+		lx_systrace_sysent64[i].lss_entry = DTRACE_IDNONE;
+		lx_systrace_sysent64[i].lss_return = DTRACE_IDNONE;
+	}
+#endif
+
+	/*
+	 * Install probe triggers.
+	 */
+	lx_systrace_entry_ptr = lx_systrace_entry;
+	lx_systrace_return_ptr = lx_systrace_return;
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+lx_systrace_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
+{
+	switch (cmd) {
+	case DDI_DETACH:
+		break;
+	case DDI_SUSPEND:
+		return (DDI_SUCCESS);
+	default:
+		return (DDI_FAILURE);
+	}
+
+	if (dtrace_unregister(lx_systrace_id) != 0)
+		return (DDI_FAILURE);
+
+	/*
+	 * Free tables.
+	 */
+	kmem_free(lx_systrace_sysent32, lx_systrace_nsysent32 *
+	    sizeof (lx_systrace_sysent_t));
+	lx_systrace_sysent32 = NULL;
+	lx_systrace_nsysent32 = 0;
+
+#if defined(_LP64)
+	kmem_free(lx_systrace_sysent64, lx_systrace_nsysent64 *
+	    sizeof (lx_systrace_sysent_t));
+	lx_systrace_sysent64 = NULL;
+	lx_systrace_nsysent64 = 0;
+#endif
+
+	/*
+	 * Reset probe triggers.
+	 */
+	lx_systrace_entry_ptr = NULL;
+	lx_systrace_return_ptr = NULL;
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+lx_systrace_open(dev_t *devp, int flag, int otyp, cred_t *cred_p)
+{
+	return (0);
+}
+
+static struct cb_ops lx_systrace_cb_ops = {
+	lx_systrace_open,	/* open */
+	nodev,			/* close */
+	nulldev,		/* strategy */
+	nulldev,		/* print */
+	nodev,			/* dump */
+	nodev,			/* read */
+	nodev,			/* write */
+	nodev,			/* ioctl */
+	nodev,			/* devmap */
+	nodev,			/* mmap */
+	nodev,			/* segmap */
+	nochpoll,		/* poll */
+	ddi_prop_op,		/* cb_prop_op */
+	0,			/* streamtab */
+	D_NEW | D_MP		/* Driver compatibility flag */
+};
+
+static struct dev_ops lx_systrace_ops = {
+	DEVO_REV,		/* devo_rev */
+	0,			/* refcnt */
+	ddi_getinfo_1to1,	/* get_dev_info */
+	nulldev,		/* identify */
+	nulldev,		/* probe */
+	lx_systrace_attach,	/* attach */
+	lx_systrace_detach,	/* detach */
+	nodev,			/* reset */
+	&lx_systrace_cb_ops,	/* driver operations */
+	NULL,			/* bus operations */
+	nodev,			/* dev power */
+	ddi_quiesce_not_needed,		/* quiesce */
+};
+
+/*
+ * Module linkage information for the kernel.
+ */
+static struct modldrv modldrv = {
+	&mod_driverops,		/* module type (this is a pseudo driver) */
+	"Linux Brand System Call Tracing", /* name of module */
+	&lx_systrace_ops	/* driver ops */
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,
+	(void *)&modldrv,
+	NULL
+};
+
+int
+_init(void)
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	return (mod_remove(&modlinkage));
+}
diff --git a/usr/src/uts/common/brand/lx/dtrace/lx_systrace.conf b/usr/src/uts/common/brand/lx/dtrace/lx_systrace.conf
new file mode 100644
index 0000000000..e4499c8a5b
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/dtrace/lx_systrace.conf
@@ -0,0 +1,27 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#ident	"%Z%%M%	%I%	%E% SMI"
+
+name="lx_systrace" parent="pseudo" instance=0;
diff --git a/usr/src/uts/common/brand/lx/io/lx_netlink.c b/usr/src/uts/common/brand/lx/io/lx_netlink.c
new file mode 100644
index 0000000000..76d68f5921
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/io/lx_netlink.c
@@ -0,0 +1,2232 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * Compatibility for the Linux netlink(7) kernel/user transport, as well as
+ * for in-kernel netlink(7) providers like rtnetlink(7).  See RFC 3549 for
+ * details of the protocol, and the Linux man pages for details of the Linux
+ * implementation that we're mimicking.
+ */
+
+#include <sys/strsubr.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/strsun.h>
+#include <sys/tihdr.h>
+#include <sys/sockio.h>
+#include <sys/brand.h>
+#include <sys/debug.h>
+#include <sys/ucred.h>
+#include <inet/ip.h>
+#include <inet/ip6.h>
+#include <inet/ip_impl.h>
+#include <inet/ip_ire.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_socket.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_audit.h>
+#include <sys/ethernet.h>
+#include <sys/dlpi.h>
+#include <sys/policy.h>
+#include <sys/ddi.h>
+
+/*
+ * Flags in netlink header
+ * See Linux include/uapi/linux/netlink.h
+ * Additional flags for "GET" requests
+ */
+#define	LX_NETLINK_NLM_F_REQUEST		1
+#define	LX_NETLINK_NLM_F_MULTI			2
+#define	LX_NETLINK_NLM_F_ACK			4
+#define	LX_NETLINK_NLM_F_ECHO			8
+#define	LX_NETLINK_NLM_F_DUMP_INTR		16
+#define	LX_NETLINK_NLM_F_ROOT			0x100
+#define	LX_NETLINK_NLM_F_MATCH			0x200
+#define	LX_NETLINK_NLM_F_ATOMIC			0x400
+
+/*
+ * Generic message type constants
+ */
+#define	LX_NETLINK_NLMSG_NONE			0
+#define	LX_NETLINK_NLMSG_NOOP			1
+#define	LX_NETLINK_NLMSG_ERROR			2
+#define	LX_NETLINK_NLMSG_DONE			3
+#define	LX_NETLINK_NLMSG_OVERRUN		4
+
+/*
+ * Protocol constants.
+ */
+#define	LX_NETLINK_ROUTE			0
+#define	LX_NETLINK_UNUSED			1
+#define	LX_NETLINK_USERSOCK			2
+#define	LX_NETLINK_FIREWALL			3
+#define	LX_NETLINK_SOCK_DIAG			4
+#define	LX_NETLINK_NFLOG			5
+#define	LX_NETLINK_XFRM				6
+#define	LX_NETLINK_SELINUX			7
+#define	LX_NETLINK_ISCSI			8
+#define	LX_NETLINK_AUDIT			9
+#define	LX_NETLINK_FIB_LOOKUP			10
+#define	LX_NETLINK_CONNECTOR			11
+#define	LX_NETLINK_NETFILTER			12
+#define	LX_NETLINK_IP6_FW			13
+#define	LX_NETLINK_DNRTMSG			14
+#define	LX_NETLINK_KOBJECT_UEVENT		15
+#define	LX_NETLINK_GENERIC			16
+#define	LX_NETLINK_SCSITRANSPORT		18
+#define	LX_NETLINK_ECRYPTFS			19
+#define	LX_NETLINK_RDMA				20
+#define	LX_NETLINK_CRYPTO			21
+
+/*
+ * rtnetlink(7) attribute-related constants
+ */
+#define	LX_NETLINK_NLA_ALIGNTO			4
+
+#define	LX_NETLINK_RTM_NEWLINK			16
+#define	LX_NETLINK_RTM_DELLINK			17
+#define	LX_NETLINK_RTM_GETLINK			18
+#define	LX_NETLINK_RTM_SETLINK			19
+#define	LX_NETLINK_RTM_NEWADDR			20
+#define	LX_NETLINK_RTM_DELADDR			21
+#define	LX_NETLINK_RTM_GETADDR			22
+#define	LX_NETLINK_RTM_NEWROUTE			24
+#define	LX_NETLINK_RTM_DELROUTE			25
+#define	LX_NETLINK_RTM_GETROUTE			26
+#define	LX_NETLINK_RTM_NEWNEIGH			28
+#define	LX_NETLINK_RTM_DELNEIGH			29
+#define	LX_NETLINK_RTM_GETNEIGH			30
+#define	LX_NETLINK_RTM_NEWRULE			32
+#define	LX_NETLINK_RTM_DELRULE			33
+#define	LX_NETLINK_RTM_GETRULE			34
+#define	LX_NETLINK_RTM_NEWQDISC			36
+#define	LX_NETLINK_RTM_DELQDISC			37
+#define	LX_NETLINK_RTM_GETQDISC			38
+#define	LX_NETLINK_RTM_NEWTCLASS		40
+#define	LX_NETLINK_RTM_DELTCLASS		41
+#define	LX_NETLINK_RTM_GETTCLASS		42
+#define	LX_NETLINK_RTM_NEWTFILTER		44
+#define	LX_NETLINK_RTM_DELTFILTER		45
+#define	LX_NETLINK_RTM_GETTFILTER		46
+#define	LX_NETLINK_RTM_NEWACTION		48
+#define	LX_NETLINK_RTM_DELACTION		49
+#define	LX_NETLINK_RTM_GETACTION		50
+#define	LX_NETLINK_RTM_NEWPREFIX		52
+#define	LX_NETLINK_RTM_GETMULTICAST		58
+#define	LX_NETLINK_RTM_GETANYCAST		62
+#define	LX_NETLINK_RTM_NEWNEIGHTBL		64
+#define	LX_NETLINK_RTM_GETNEIGHTBL		66
+#define	LX_NETLINK_RTM_SETNEIGHTBL		67
+#define	LX_NETLINK_RTM_NEWNDUSEROPT		68
+#define	LX_NETLINK_RTM_NEWADDRLABEL		72
+#define	LX_NETLINK_RTM_DELADDRLABEL		73
+#define	LX_NETLINK_RTM_GETADDRLABEL		74
+#define	LX_NETLINK_RTM_GETDCB			78
+#define	LX_NETLINK_RTM_SETDCB			79
+#define	LX_NETLINK_RTM_NEWNETCONF		80
+#define	LX_NETLINK_RTM_GETNETCONF		82
+#define	LX_NETLINK_RTM_NEWMDB			84
+#define	LX_NETLINK_RTM_DELMDB			85
+#define	LX_NETLINK_RTM_GETMDB			86
+#define	LX_NETLINK_RTM_MAX			87
+
+/*
+ * rtnetlink(7) attribute constants
+ */
+#define	LX_NETLINK_RTA_UNSPEC		0
+#define	LX_NETLINK_RTA_DST		1
+#define	LX_NETLINK_RTA_SRC		2
+#define	LX_NETLINK_RTA_IIF		3
+#define	LX_NETLINK_RTA_OIF		4
+#define	LX_NETLINK_RTA_GATEWAY		5
+#define	LX_NETLINK_RTA_PRIORITY		6
+#define	LX_NETLINK_RTA_PREFSRC		7
+#define	LX_NETLINK_RTA_METRICS		8
+#define	LX_NETLINK_RTA_MULTIPATH	9
+#define	LX_NETLINK_RTA_PROTOINFO	10
+#define	LX_NETLINK_RTA_FLOW		11
+#define	LX_NETLINK_RTA_CACHEINFO	12
+#define	LX_NETLINK_RTA_SESSION		13
+#define	LX_NETLINK_RTA_MP_ALGO		14
+#define	LX_NETLINK_RTA_TABLE		15
+#define	LX_NETLINK_RTA_MARK		16
+#define	LX_NETLINK_RTA_MFC_STATS	17
+#define	LX_NETLINK_MAX_RTA	LX_NETLINK_RTA_MFC_STATS
+
+/*
+ * rtnetlink(7) NEWLINK/DELLINK/GETLINK constants
+ */
+#define	LX_NETLINK_IFLA_UNSPEC			0
+#define	LX_NETLINK_IFLA_ADDRESS			1
+#define	LX_NETLINK_IFLA_BROADCAST		2
+#define	LX_NETLINK_IFLA_IFNAME			3
+#define	LX_NETLINK_IFLA_MTU			4
+#define	LX_NETLINK_IFLA_LINK			5
+#define	LX_NETLINK_IFLA_QDISC			6
+#define	LX_NETLINK_IFLA_STATS			7
+#define	LX_NETLINK_IFLA_COST			8
+#define	LX_NETLINK_IFLA_PRIORITY		9
+#define	LX_NETLINK_IFLA_MASTER			10
+#define	LX_NETLINK_IFLA_WIRELESS		11
+#define	LX_NETLINK_IFLA_PROTINFO		12
+#define	LX_NETLINK_IFLA_TXQLEN			13
+#define	LX_NETLINK_IFLA_MAP			14
+#define	LX_NETLINK_IFLA_WEIGHT			15
+#define	LX_NETLINK_IFLA_OPERSTATE		16
+#define	LX_NETLINK_IFLA_LINKMODE		17
+#define	LX_NETLINK_IFLA_LINKINFO		18
+#define	LX_NETLINK_IFLA_NET_NS_PID		19
+#define	LX_NETLINK_IFLA_IFALIAS			20
+#define	LX_NETLINK_IFLA_NUM_VF			21
+#define	LX_NETLINK_IFLA_VFINFO_LIST		22
+#define	LX_NETLINK_IFLA_STATS64			23
+#define	LX_NETLINK_IFLA_VF_PORTS		24
+#define	LX_NETLINK_IFLA_PORT_SELF		25
+#define	LX_NETLINK_IFLA_AF_SPEC			26
+#define	LX_NETLINK_IFLA_GROUP			27
+#define	LX_NETLINK_IFLA_NET_NS_FD		28
+#define	LX_NETLINK_IFLA_EXT_MASK		29
+#define	LX_NETLINK_IFLA_PROMISCUITY		30
+#define	LX_NETLINK_IFLA_NUM_TX_QUEUES		31
+#define	LX_NETLINK_IFLA_NUM_RX_QUEUES		32
+#define	LX_NETLINK_IFLA_CARRIER			33
+#define	LX_NETLINK_IFLA_PHYS_PORT_ID		34
+#define	LX_NETLINK_IFLA_CARRIER_CHANGES		35
+#define	LX_NETLINK_IFLA_MAX			36
+
+/*
+ * rtnetlink(7) NEWADDR/DELADDR/GETADDR constants
+ */
+#define	LX_NETLINK_IFA_UNSPEC			0
+#define	LX_NETLINK_IFA_ADDRESS			1
+#define	LX_NETLINK_IFA_LOCAL			2
+#define	LX_NETLINK_IFA_LABEL			3
+#define	LX_NETLINK_IFA_BROADCAST		4
+#define	LX_NETLINK_IFA_ANYCAST			5
+#define	LX_NETLINK_IFA_CACHEINFO		6
+#define	LX_NETLINK_IFA_MULTICAST		7
+#define	LX_NETLINK_IFA_FLAGS			8
+#define	LX_NETLINK_IFA_MAX			9
+
+#define	LX_NETLINK_IFA_F_SECONDARY		0x01
+#define	LX_NETLINK_IFA_F_TEMPORARY		LX_NETLINK_IFA_F_SECONDARY
+#define	LX_NETLINK_IFA_F_NODAD			0x02
+#define	LX_NETLINK_IFA_F_OPTIMISTIC		0x04
+#define	LX_NETLINK_IFA_F_DADFAILED		0x08
+#define	LX_NETLINK_IFA_F_HOMEADDRESS		0x10
+#define	LX_NETLINK_IFA_F_DEPRECATED		0x20
+#define	LX_NETLINK_IFA_F_TENTATIVE		0x40
+#define	LX_NETLINK_IFA_F_PERMANENT		0x80
+#define	LX_NETLINK_IFA_F_MANAGETEMPADDR		0x100
+#define	LX_NETLINK_IFA_F_NOPREFIXROUTE		0x200
+
+/*
+ * Linux interface flags.
+ */
+#define	LX_IFF_UP		(1<<0)
+#define	LX_IFF_BROADCAST	(1<<1)
+#define	LX_IFF_DEBUG		(1<<2)
+#define	LX_IFF_LOOPBACK		(1<<3)
+#define	LX_IFF_POINTOPOINT	(1<<4)
+#define	LX_IFF_NOTRAILERS	(1<<5)
+#define	LX_IFF_RUNNING		(1<<6)
+#define	LX_IFF_NOARP		(1<<7)
+#define	LX_IFF_PROMISC		(1<<8)
+#define	LX_IFF_ALLMULTI		(1<<9)
+#define	LX_IFF_MASTER		(1<<10)
+#define	LX_IFF_SLAVE		(1<<11)
+#define	LX_IFF_MULTICAST	(1<<12)
+#define	LX_IFF_PORTSEL		(1<<13)
+#define	LX_IFF_AUTOMEDIA	(1<<14)
+#define	LX_IFF_DYNAMIC		(1<<15)
+#define	LX_IFF_LOWER_UP		(1<<16)
+#define	LX_IFF_DORMANT		(1<<17)
+#define	LX_IFF_ECHO		(1<<18)
+
+/* rtm_table */
+#define	LX_ROUTE_TABLE_MAIN	254
+
+/* rtm_type */
+#define	LX_RTN_UNSPEC		0
+#define	LX_RTN_UNICAST		1
+#define	LX_RTN_LOCAL		2
+#define	LX_RTN_BROADCAST	3
+#define	LX_RTN_ANYCAST		4
+#define	LX_RTN_MULTICAST	5
+#define	LX_RTN_BLACKHOLE	6
+#define	LX_RTN_UNREACHABLE	7
+#define	LX_RTN_PROHIBIT		8
+#define	LX_RTN_THROW		9
+#define	LX_RTN_NAT		10
+#define	LX_RTN_XRESOLVE		11
+
+/* rtm_protocol */
+#define	LX_RTPROT_UNSPEC	0
+#define	LX_RTPROT_REDIRECT	1	/* From ICMP redir	*/
+#define	LX_RTPROT_KERNEL	2	/* From kernel		*/
+#define	LX_RTPROT_BOOT		3	/* From boot		*/
+#define	LX_RTPROT_STATIC	4	/* From administrator	*/
+#define	LX_RTPROT_NULL		0xff	/* Uninitialized	*/
+
+/* rtm_scope */
+#define	LX_RTSCOPE_UNIVERSE	0
+#define	LX_RTSCOPE_SITE		200
+#define	LX_RTSCOPE_LINK		253
+#define	LX_RTSCOPE_HOST		254
+#define	LX_RTSCOPE_NOWHERE	255
+
+/*
+ * Audit message types (lxnh_type in the lx_netlink_hdr_t msg header)
+ * See Linux include/uapi/linux/audit.h and user-level auditd source
+ * lib/libaudit.h.
+ *
+ * The types fall into range blocks:
+ * 1000-1099 is for audit system control commands
+ * 1100-2999 various messages, as detailed in include/uapi/linux/audit.h
+ */
+#define	LX_AUDIT_GET		1000	/* get audit system status */
+#define	LX_AUDIT_SET		1001	/* set audit system status */
+#define	LX_AUDIT_WATCH_INS	1007	/* insert file watch */
+#define	LX_AUDIT_WATCH_REM	1008	/* remove file watch */
+#define	LX_AUDIT_WATCH_LIST	1009	/* list file watchs */
+#define	LX_AUDIT_ADD_RULE	1011	/* add syscall rule */
+#define	LX_AUDIT_DEL_RULE	1012	/* del syscall rule */
+#define	LX_AUDIT_LIST_RULES	1013	/* list syscall rules */
+#define	LX_AUDIT_SET_FEATURE	1018
+#define	LX_AUDIT_GET_FEATURE	1019
+#define	LX_AUDIT_USER_MSG_START	1100
+
+/*
+ * Netlink sockopts
+ */
+#define	SOL_LX_NETLINK	270
+
+/* See Linux include/uapi/linux/netlink.h */
+#define	LX_NETLINK_SO_ADD_MEMBERSHIP	1
+#define	LX_NETLINK_SO_DROP_MEMBERSHIP	2
+#define	LX_NETLINK_SO_PKTINFO		3
+#define	LX_NETLINK_SO_BROADCAST_ERROR	4
+#define	LX_NETLINK_SO_NO_ENOBUFS	5
+#define	LX_NETLINK_SO_RX_RING		6
+#define	LX_NETLINK_SO_TX_RING		7
+#define	LX_NETLINK_SO_LISTEN_ALL_NSID	8
+#define	LX_NETLINK_SO_LIST_MEMBERSHIPS	9
+#define	LX_NETLINK_SO_CAP_ACK 		10
+
+/* Internal socket flags */
+#define	LXNLF_RECVUCRED			0x1
+#define	LXNLF_AUDITD			0x2
+
+/* nlmsg structure macros */
+#define	LXNLMSG_ALIGNTO	4
+#define	LXNLMSG_ALIGN(len)	\
+	(((len) + LXNLMSG_ALIGNTO - 1) & ~(LXNLMSG_ALIGNTO - 1))
+#define	LXNLMSG_HDRLEN	\
+	((int)LXNLMSG_ALIGN(sizeof (lx_netlink_hdr_t)))
+#define	LXNLMSG_LENGTH(len)	((len) + NLMSG_HDRLEN)
+#define	LXNLMSG_SPACE(len)	NLMSG_ALIGN(NLMSG_LENGTH(len))
+#define	LXNLMSG_DATA(nlh)	((void*)(((char *)nlh) + NLMSG_LENGTH(0)))
+#define	LXNLMSG_PAYLOAD(nlh, len)	\
+	((nlh)->nlmsg_len - NLMSG_SPACE((len)))
+
+#define	LXATTR_PAYLOAD(lxa)	\
+	((void*)((caddr_t)(lxa) + sizeof (lx_netlink_attr_t)))
+#define	LXATTR_HDRLEN	LXNLMSG_ALIGN(sizeof (lx_netlink_attr_t))
+#define	LXATTR_LEN(len)	(LXATTR_HDRLEN + LXNLMSG_ALIGN(len))
+
+typedef struct lx_netlink_hdr {
+	uint32_t lxnh_len;			/* length of message */
+	uint16_t lxnh_type;			/* type of message */
+	uint16_t lxnh_flags;			/* flags */
+	uint32_t lxnh_seq;			/* sequence number */
+	uint32_t lxnh_pid;			/* sending pid */
+} lx_netlink_hdr_t;
+
+typedef struct lx_netlink_err {
+	lx_netlink_hdr_t	lxne_hdr;	/* header */
+	int32_t			lxne_errno;	/* errno */
+	lx_netlink_hdr_t	lxne_failed;	/* header of err */
+} lx_netlink_err_t;
+
+typedef struct lx_netlink_attr {
+	uint16_t	lxna_len;		/* length of attribute */
+	uint16_t	lxna_type;		/* type of attribute */
+} lx_netlink_attr_t;
+
+typedef struct lx_netlink_ifinfomsg {
+	uint8_t		lxnl_ifi_family;	/* family: AF_UNSPEC */
+	uint8_t		lxnl_ifi__pad;
+	uint16_t	lxnl_ifi_type;		/* device type */
+	uint32_t	lxnl_ifi_index;		/* interface index */
+	uint32_t	lxnl_ifi_flags;		/* device flags */
+	uint32_t 	lxnl_ifi_change;	/* unused; must be -1 */
+} lx_netlink_ifinfomsg_t;
+
+typedef struct lx_netlink_ifaddrmsg {
+	uint8_t		lxnl_ifa_family;	/* address type */
+	uint8_t		lxnl_ifa_prefixlen;	/* prefix length of address */
+	uint8_t		lxnl_ifa_flags;		/* address flags */
+	uint8_t		lxnl_ifa_scope;		/* address scope */
+	uint8_t		lxnl_ifa_index;		/* interface index */
+} lx_netlink_ifaddrmsg_t;
+
+typedef struct lx_netlink_rtmsg {
+	uint8_t		rtm_family;	/* route AF			*/
+	uint8_t		rtm_dst_len;	/* destination addr length	*/
+	uint8_t		rtm_src_len;	/* source addr length		*/
+	uint8_t		rtm_tos;	/* TOS filter			*/
+	uint8_t		rtm_table;	/* routing table ID		*/
+	uint8_t		rtm_protocol;	/* routing protocol		*/
+	uint8_t		rtm_scope;
+	uint8_t		rtm_type;
+	uint32_t	rtm_flags;
+} lx_netlink_rtmsg_t;
+
+typedef struct lx_netlink_sockaddr {
+	sa_family_t	lxnl_family;		/* AF_LX_NETLINK */
+	uint16_t	lxnl_pad;		/* padding */
+	uint32_t	lxnl_port;		/* port id */
+	uint32_t	lxnl_groups;		/* multicast groups mask */
+} lx_netlink_sockaddr_t;
+
+typedef struct lx_netlink_sock {
+	struct lx_netlink_sock *lxns_next;	/* list of lx_netlink sockets */
+	sock_upcalls_t *lxns_upcalls;		/* pointer to socket upcalls */
+	sock_upper_handle_t lxns_uphandle;	/* socket upcall handle */
+	ldi_handle_t lxns_iphandle;		/* handle to /dev/ip */
+	ldi_handle_t lxns_ip6handle;		/* handle to /dev/ip6 */
+	ldi_handle_t lxns_current;		/* current ip handle */
+	int lxns_proto;				/* protocol */
+	uint32_t lxns_port;			/* port identifier */
+	uint32_t lxns_groups;			/* group subscriptions */
+	uint32_t lxns_bufsize;			/* buffer size */
+	uint32_t lxns_flags;			/* socket flags */
+	kmutex_t lxns_flowctl_mtx;		/* protects lxns_flowctrled */
+	boolean_t lxns_flowctrled;		/* sock is flow-controlled */
+} lx_netlink_sock_t;
+
+typedef struct lx_netlink_reply {
+	lx_netlink_hdr_t lxnr_hdr;		/* header that we're reply to */
+	lx_netlink_sock_t *lxnr_sock;		/* socket */
+	uint32_t lxnr_seq;			/* sequence number */
+	uint16_t lxnr_type;			/* type of reply */
+	mblk_t *lxnr_mp;			/* current mblk */
+	mblk_t *lxnr_err;			/* error mblk */
+	mblk_t *lxnr_mp1;			/* T_UNITDATA_IND mblk */
+	int lxnr_errno;				/* errno, if any */
+} lx_netlink_reply_t;
+
+static lx_netlink_sock_t *lx_netlink_head;	/* head of lx_netlink sockets */
+static uint_t lx_netlink_audit_cnt;		/* prevent unload for audit */
+static kmutex_t lx_netlink_lock;		/* lock to protect state */
+static ldi_ident_t lx_netlink_ldi;		/* LDI handle */
+static int lx_netlink_bufsize = 4096;		/* default buffer size */
+static int lx_netlink_flowctrld;		/* # of times flow controlled */
+
+typedef enum {
+	LXNL_BIND,
+	LXNL_SENDMSG
+} lx_netlink_action_t;
+
+#define	LX_UNSUP_BUFSZ	64
+
+/*
+ * On Linux, CAP_NET_ADMIN is required to take certain netlink actions.  This
+ * restriction is loosened for certain protocol types, provided the activity is
+ * limited to communicating directly with the kernel (rather than transmitting
+ * to the various multicast groups)
+ */
+static int
+lx_netlink_access(lx_netlink_sock_t *lns, cred_t *cr, lx_netlink_action_t act)
+{
+	/* Simple actions are allowed on these netlink protocols. */
+	if (act != LXNL_SENDMSG) {
+		switch (lns->lxns_proto) {
+		case LX_NETLINK_ROUTE:
+		case LX_NETLINK_AUDIT:
+		case LX_NETLINK_KOBJECT_UEVENT:
+			return (0);
+		default:
+			break;
+		}
+	}
+
+	/* CAP_NET_ADMIN roughly maps to PRIV_SYS_IP_CONFIG. */
+	if (secpolicy_ip_config(cr, B_FALSE) != 0) {
+		return (EACCES);
+	}
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static void
+lx_netlink_activate(sock_lower_handle_t handle,
+    sock_upper_handle_t sock_handle, sock_upcalls_t *sock_upcalls,
+    int flags, cred_t *cr)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)handle;
+	struct sock_proto_props sopp;
+
+	sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT |
+	    SOCKOPT_RCVLOWAT | SOCKOPT_MAXADDRLEN | SOCKOPT_MAXPSZ |
+	    SOCKOPT_MAXBLK | SOCKOPT_MINPSZ;
+	sopp.sopp_wroff = 0;
+	sopp.sopp_rxhiwat = SOCKET_RECVHIWATER;
+	sopp.sopp_rxlowat = SOCKET_RECVLOWATER;
+	sopp.sopp_maxaddrlen = sizeof (struct sockaddr_dl);
+	sopp.sopp_maxpsz = INFPSZ;
+	sopp.sopp_maxblk = INFPSZ;
+	sopp.sopp_minpsz = 0;
+
+	lxsock->lxns_upcalls = sock_upcalls;
+	lxsock->lxns_uphandle = sock_handle;
+
+	sock_upcalls->su_set_proto_props(sock_handle, &sopp);
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_setsockopt(sock_lower_handle_t handle, int level,
+    int option_name, const void *optval, socklen_t optlen, struct cred *cr)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)handle;
+
+	if (level == SOL_SOCKET && option_name == SO_RECVUCRED) {
+		int *ival;
+		if (optlen != sizeof (int)) {
+			return (EINVAL);
+		}
+		ival = (int *)optval;
+		if (*ival == 0) {
+			lxsock->lxns_flags &= ~LXNLF_RECVUCRED;
+		} else {
+			lxsock->lxns_flags |= LXNLF_RECVUCRED;
+		}
+		return (0);
+	} else if (level == SOL_SOCKET) {
+		/* Punt on the other SOL_SOCKET options */
+		return (0);
+	} else if (level != SOL_LX_NETLINK) {
+		return (EOPNOTSUPP);
+	}
+
+	switch (option_name) {
+	case LX_NETLINK_SO_ADD_MEMBERSHIP:
+	case LX_NETLINK_SO_DROP_MEMBERSHIP:
+	case LX_NETLINK_SO_PKTINFO:
+	case LX_NETLINK_SO_BROADCAST_ERROR:
+	case LX_NETLINK_SO_NO_ENOBUFS:
+	case LX_NETLINK_SO_RX_RING:
+	case LX_NETLINK_SO_TX_RING:
+		/* Blatant lie */
+		return (0);
+	default:
+		return (EINVAL);
+	}
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_getsockopt(sock_lower_handle_t handle, int level,
+    int option_name, void *optval, socklen_t *optlen, cred_t *cr)
+{
+	if (level != SOL_LX_NETLINK) {
+		return (EOPNOTSUPP);
+	}
+
+	switch (option_name) {
+	case LX_NETLINK_SO_LIST_MEMBERSHIPS:
+		/* Report that we have 0 members to allow systemd to proceed. */
+		*optlen = 0;
+		return (0);
+	default:
+		return (EINVAL);
+	}
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_bind(sock_lower_handle_t handle, struct sockaddr *name,
+    socklen_t namelen, struct cred *cr)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)handle;
+	lx_netlink_sockaddr_t *lxsa = (lx_netlink_sockaddr_t *)name;
+
+	if (namelen != sizeof (lx_netlink_sockaddr_t) ||
+	    lxsa->lxnl_family != AF_LX_NETLINK) {
+		return (EINVAL);
+	}
+
+	/*
+	 * Perform access checks if attempting to bind on any multicast groups.
+	 */
+	if (lxsa->lxnl_groups != 0) {
+		int err;
+
+		if ((err = lx_netlink_access(lxsock, cr, LXNL_BIND)) != 0) {
+			return (err);
+		}
+
+		/* Lie about group subscription for now */
+		lxsock->lxns_groups = lxsa->lxnl_groups;
+	}
+
+	/*
+	 * Linux netlink uses nl_port to identify distinct netlink sockets.
+	 * Binding to an address of nl_port=0 triggers the kernel to
+	 * automatically assign a free nl_port identifier.  Originally,
+	 * consumers of lx_netlink were required to bind with that automatic
+	 * address.  We now support non-zero values for nl_port although strict
+	 * checking to identify conflicts is not performed.  Use of the
+	 * id_space facility could be a convenient solution, if a need arose.
+	 */
+	if (lxsa->lxnl_port == 0) {
+		/*
+		 * Because we are not doing conflict detection, there is no
+		 * need to expend effort selecting a unique port for automatic
+		 * addressing during bind.
+		 */
+		lxsock->lxns_port = curproc->p_pid;
+	} else {
+		lxsock->lxns_port = lxsa->lxnl_port;
+	}
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_getsockname(sock_lower_handle_t handle, struct sockaddr *sa,
+    socklen_t *len, struct cred *cr)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)handle;
+	lx_netlink_sockaddr_t *lxsa = (lx_netlink_sockaddr_t *)sa;
+
+	if (*len < sizeof (lx_netlink_sockaddr_t))
+		return (EINVAL);
+
+	lxsa->lxnl_family = AF_LX_NETLINK;
+	lxsa->lxnl_pad = 0;
+	lxsa->lxnl_port = lxsock->lxns_port;
+	lxsa->lxnl_groups = lxsock->lxns_groups;
+
+	*len = sizeof (lx_netlink_sockaddr_t);
+
+	return (0);
+}
+
+static mblk_t *
+lx_netlink_alloc_mp1(lx_netlink_sock_t *lxsock)
+{
+	mblk_t *mp;
+	size_t size;
+	struct T_unitdata_ind *tunit;
+	lx_netlink_sockaddr_t *lxsa;
+	boolean_t send_ucred;
+
+	/*
+	 * Certain netlink clients (such as systemd) will set SO_RECVUCRED
+	 * (via the Linux SCM_CREDENTIALS) on the expectation that all replies
+	 * will contain credentials passed via cmsg.  They require this to
+	 * authenticate those messages as having originated in the kernel by
+	 * checking uc_pid == 0.
+	 */
+	VERIFY(lxsock != NULL);
+	send_ucred = ((lxsock->lxns_flags & LXNLF_RECVUCRED) != 0);
+
+	/*
+	 * Message structure:
+	 * +----------------------------+
+	 * | struct T_unit_data_ind	|
+	 * +----------------------------+
+	 * | lx_netlink_sockaddr_t	|
+	 * +----------------------------+  -+
+	 * | struct cmsghdr (SCM_UCRED)	|   |
+	 * +----------------------------+   +-(optional)
+	 * | struct ucred_s (cmsg data)	|   |
+	 * +----------------------------+  -+
+	 */
+	size = sizeof (*tunit) + sizeof (*lxsa);
+	if (send_ucred) {
+		size += sizeof (struct cmsghdr) +
+		    ROUNDUP_cmsglen(sizeof (struct ucred_s));
+	}
+	mp = allocb(size, 0);
+	if (mp == NULL) {
+		return (NULL);
+	}
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	tunit = (struct T_unitdata_ind *)mp->b_rptr;
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	lxsa = (lx_netlink_sockaddr_t *)((caddr_t)tunit + sizeof (*tunit));
+	mp->b_wptr += size;
+
+	mp->b_datap->db_type = M_PROTO;
+	tunit->PRIM_type = T_UNITDATA_IND;
+	tunit->SRC_length = sizeof (*lxsa);
+	tunit->SRC_offset = sizeof (*tunit);
+
+	lxsa->lxnl_family = AF_LX_NETLINK;
+	lxsa->lxnl_port = 0;
+	lxsa->lxnl_groups = 0;
+	lxsa->lxnl_pad = 0;
+
+	if (send_ucred) {
+		struct cmsghdr *cmsg;
+		struct ucred_s *ucred;
+
+		/* LINTED: E_BAD_PTR_CAST_ALIGN */
+		cmsg = (struct cmsghdr *)((caddr_t)lxsa + sizeof (*lxsa));
+		ucred = (struct ucred_s *)CMSG_CONTENT(cmsg);
+		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*ucred);
+		cmsg->cmsg_level = SOL_SOCKET;
+		cmsg->cmsg_type = SCM_UCRED;
+		bzero(ucred, sizeof (*ucred));
+		ucred->uc_size = sizeof (*ucred);
+		ucred->uc_zoneid = getzoneid();
+
+		tunit->OPT_length = sizeof (*cmsg) +
+		    ROUNDUP_cmsglen(sizeof (*ucred));
+		tunit->OPT_offset = tunit->SRC_offset + tunit->SRC_length;
+	} else {
+		tunit->OPT_length = 0;
+		tunit->OPT_offset = 0;
+	}
+
+	return (mp);
+}
+
+static lx_netlink_reply_t *
+lx_netlink_reply(lx_netlink_sock_t *lxsock,
+    lx_netlink_hdr_t *hdr, uint16_t type)
+{
+	lx_netlink_reply_t *reply;
+	mblk_t *err, *mp1;
+
+	/*
+	 * We always allocate an error block to assure that even if subsequent
+	 * allocations fail, we can return an error.
+	 */
+	if ((err = allocb(sizeof (lx_netlink_err_t), 0)) == NULL)
+		return (NULL);
+
+	if ((mp1 = lx_netlink_alloc_mp1(lxsock)) == NULL) {
+		freeb(err);
+		return (NULL);
+	}
+
+	reply = kmem_zalloc(sizeof (lx_netlink_reply_t), KM_SLEEP);
+	reply->lxnr_err = err;
+	reply->lxnr_sock = lxsock;
+	reply->lxnr_hdr = *hdr;
+	reply->lxnr_type = type;
+	reply->lxnr_mp1 = mp1;
+
+	return (reply);
+}
+
+static void
+lx_netlink_reply_add(lx_netlink_reply_t *reply, void *payload, uint32_t size)
+{
+	lx_netlink_hdr_t *hdr;
+	lx_netlink_sock_t *lxsock = reply->lxnr_sock;
+	uint32_t aligned;
+	mblk_t *mp = reply->lxnr_mp;
+
+	if (reply->lxnr_errno)
+		return;
+
+	aligned = LXNLMSG_ALIGN(size);
+	hdr = (lx_netlink_hdr_t *)mp->b_rptr;
+
+	if (hdr->lxnh_len + aligned > lxsock->lxns_bufsize) {
+		reply->lxnr_errno = E2BIG;
+		return;
+	}
+
+	bcopy(payload, mp->b_wptr, size);
+	hdr->lxnh_len += aligned;
+	mp->b_wptr += aligned;
+}
+
+static void
+lx_netlink_reply_msg(lx_netlink_reply_t *reply, void *payload, uint32_t size)
+{
+	lx_netlink_hdr_t *hdr;
+	lx_netlink_sock_t *lxsock = reply->lxnr_sock;
+	mblk_t *mp;
+
+	if (reply->lxnr_errno)
+		return;
+
+	VERIFY(reply->lxnr_mp == NULL);
+
+	if ((reply->lxnr_mp = mp = allocb(lxsock->lxns_bufsize, 0)) == NULL) {
+		reply->lxnr_errno = ENOMEM;
+		return;
+	}
+
+	bzero(mp->b_rptr, lxsock->lxns_bufsize);
+	hdr = (lx_netlink_hdr_t *)mp->b_rptr;
+	hdr->lxnh_flags = LX_NETLINK_NLM_F_MULTI;
+	hdr->lxnh_len = LXNLMSG_ALIGN(sizeof (lx_netlink_hdr_t));
+	hdr->lxnh_seq = reply->lxnr_hdr.lxnh_seq;
+	hdr->lxnh_pid = lxsock->lxns_port;
+
+	mp->b_wptr += LXNLMSG_ALIGN(sizeof (lx_netlink_hdr_t));
+
+	if (payload == NULL) {
+		/*
+		 * A NULL payload denotes a "done" message.
+		 */
+		hdr->lxnh_type = LX_NETLINK_NLMSG_DONE;
+	} else {
+		hdr->lxnh_type = reply->lxnr_type;
+		lx_netlink_reply_add(reply, payload, size);
+	}
+}
+
+static void
+lx_netlink_reply_attr(lx_netlink_reply_t *reply, uint16_t type,
+    void *payload, uint32_t size)
+{
+	lx_netlink_attr_t attr;
+
+	attr.lxna_len = size + sizeof (lx_netlink_attr_t);
+	attr.lxna_type = type;
+
+	lx_netlink_reply_add(reply, &attr, sizeof (attr));
+	lx_netlink_reply_add(reply, payload, size);
+}
+
+static void
+lx_netlink_reply_attr_string(lx_netlink_reply_t *reply,
+    uint16_t type, const char *str)
+{
+	lx_netlink_reply_attr(reply, type, (void *)str, strlen(str) + 1);
+}
+
+static void
+lx_netlink_reply_attr_int32(lx_netlink_reply_t *reply,
+    uint16_t type, int32_t val)
+{
+	int32_t v = val;
+
+	lx_netlink_reply_attr(reply, type, &v, sizeof (int32_t));
+}
+
+static int
+lx_netlink_reply_ioctl(lx_netlink_reply_t *reply, int cmd, void *arg)
+{
+	int rval;
+
+	if (reply->lxnr_errno != 0)
+		return (reply->lxnr_errno);
+
+	if ((rval = ldi_ioctl(reply->lxnr_sock->lxns_current,
+	    cmd, (intptr_t)arg, FKIOCTL, kcred, NULL)) != 0) {
+		reply->lxnr_errno = rval;
+	}
+
+	return (rval);
+}
+
+static void
+lx_netlink_reply_sendup(lx_netlink_reply_t *reply, mblk_t *mp, mblk_t *mp1)
+{
+	lx_netlink_sock_t *lxsock = reply->lxnr_sock;
+	int error;
+
+	/*
+	 * To prevent the stream head from coalescing messages and to indicate
+	 * their origin, we send them as T_UNITDATA_IND messages, not as raw
+	 * M_DATA.
+	 */
+	mp1->b_cont = mp;
+
+	lxsock->lxns_upcalls->su_recv(lxsock->lxns_uphandle, mp1,
+	    msgdsize(mp1), 0, &error, NULL);
+
+	if (error != 0)
+		lx_netlink_flowctrld++;
+}
+
+static void
+lx_netlink_reply_send(lx_netlink_reply_t *reply)
+{
+	mblk_t *mp1;
+
+	if (reply->lxnr_errno)
+		return;
+
+	if ((mp1 = lx_netlink_alloc_mp1(reply->lxnr_sock)) == NULL) {
+		reply->lxnr_errno = ENOMEM;
+		return;
+	}
+
+	lx_netlink_reply_sendup(reply, reply->lxnr_mp, mp1);
+	reply->lxnr_mp = NULL;
+}
+
+static void
+lx_netlink_reply_done(lx_netlink_reply_t *reply)
+{
+	lx_netlink_sock_t *lxsock = reply->lxnr_sock;
+	mblk_t *mp;
+
+	/*
+	 * Denote that we're done via a message with a NULL payload.
+	 */
+	lx_netlink_reply_msg(reply, NULL, 0);
+
+	if (reply->lxnr_errno) {
+		/*
+		 * If anything failed, we'll send up an error message.
+		 */
+		lx_netlink_hdr_t *hdr;
+		lx_netlink_err_t *err;
+
+		if (reply->lxnr_mp != NULL) {
+			freeb(reply->lxnr_mp);
+			reply->lxnr_mp = NULL;
+		}
+
+		mp = reply->lxnr_err;
+		VERIFY(mp != NULL);
+		reply->lxnr_err = NULL;
+		err = (lx_netlink_err_t *)mp->b_rptr;
+		hdr = &err->lxne_hdr;
+		mp->b_wptr += sizeof (lx_netlink_err_t);
+
+		err->lxne_failed = reply->lxnr_hdr;
+		err->lxne_errno = reply->lxnr_errno;
+		hdr->lxnh_type = LX_NETLINK_NLMSG_ERROR;
+		hdr->lxnh_seq = reply->lxnr_hdr.lxnh_seq;
+		hdr->lxnh_len = sizeof (lx_netlink_err_t);
+		hdr->lxnh_seq = reply->lxnr_hdr.lxnh_seq;
+		hdr->lxnh_pid = lxsock->lxns_port;
+	} else {
+		uint32_t status = 0;
+
+		/*
+		 * More recent versions of the iproute2 utils expect a status
+		 * value after the header, even in the absence of errors.
+		 */
+		lx_netlink_reply_add(reply, &status, sizeof (status));
+
+		/*
+		 * "done" is also the most minimal response possible.  If
+		 * lx_netlink_reply_msg() does not set lxnr_errno, we should
+		 * be guaranteed enough room to hold this (i.e. our
+		 * lx_netlink_reply_add() call should never end up setting
+		 * lxnr_errno).
+		 */
+		VERIFY0(reply->lxnr_errno);
+
+		mp = reply->lxnr_mp;
+		VERIFY(mp != NULL);
+		reply->lxnr_mp = NULL;
+	}
+
+	lx_netlink_reply_sendup(reply, mp, reply->lxnr_mp1);
+
+	if (reply->lxnr_mp != NULL)
+		freeb(reply->lxnr_mp);
+
+	if (reply->lxnr_err != NULL)
+		freeb(reply->lxnr_err);
+
+	kmem_free(reply, sizeof (lx_netlink_reply_t));
+}
+
+static int
+lx_netlink_reply_error(lx_netlink_sock_t *lxsock,
+    lx_netlink_hdr_t *hdr, int errno)
+{
+	/*
+	 * The type of the message doesn't matter, as we're going to explicitly
+	 * set lxnr_errno and therefore send only an error message.
+	 */
+	lx_netlink_reply_t *reply = lx_netlink_reply(lxsock, hdr, 0);
+
+	if (reply == NULL)
+		return (ENOMEM);
+
+	reply->lxnr_errno = errno;
+	lx_netlink_reply_done(reply);
+
+	return (0);
+}
+
+/*
+ * Send an ack message with an explicit errno of 0.
+ * TODO: this needs more work
+ */
+/*
+ * static void
+ * lx_netlink_reply_ack(lx_netlink_reply_t *reply)
+ * {
+ * 	lx_netlink_sock_t *lxsock = reply->lxnr_sock;
+ * 	mblk_t *mp;
+ * 	lx_netlink_hdr_t *hdr;
+ * 	lx_netlink_err_t *err;
+ *
+ * 	lx_netlink_reply_msg(reply, NULL, 0);
+ *
+ * 	mp = reply->lxnr_err;
+ * 	VERIFY(mp != NULL);
+ * 	reply->lxnr_err = NULL;
+ * 	err = (lx_netlink_err_t *)mp->b_rptr;
+ * 	hdr = &err->lxne_hdr;
+ *
+ * 	err->lxne_failed = reply->lxnr_hdr;
+ * 	err->lxne_errno = 0;
+ * 	hdr->lxnh_type = LX_NETLINK_NLMSG_ERROR;
+ * 	hdr->lxnh_seq = reply->lxnr_hdr.lxnh_seq;
+ * 	hdr->lxnh_len = sizeof (lx_netlink_err_t);
+ * 	hdr->lxnh_seq = reply->lxnr_hdr.lxnh_seq;
+ * 	hdr->lxnh_pid = lxsock->lxns_port;
+ *
+ * 	lx_netlink_reply_sendup(reply, mp, reply->lxnr_mp1);
+ *
+ * 	kmem_free(reply, sizeof (lx_netlink_reply_t));
+ * }
+ */
+
+static int
+lx_netlink_parse_msg_attrs(mblk_t *mp, void **msgp, unsigned int msg_size,
+    lx_netlink_attr_t **attrp, unsigned int *attr_max)
+{
+	lx_netlink_hdr_t *hdr = (lx_netlink_hdr_t *)mp->b_rptr;
+	lx_netlink_attr_t *lxa;
+	unsigned char *buf = mp->b_rptr + LXNLMSG_HDRLEN;
+	unsigned int i;
+	uint32_t buf_left = MBLKL(mp) - LXNLMSG_HDRLEN;
+	uint32_t msg_left = hdr->lxnh_len;
+
+	msg_size = LXNLMSG_ALIGN(msg_size);
+	if (msg_size > buf_left || msg_size > msg_left) {
+		return (-1);
+	}
+
+	*msgp = (void *)buf;
+	buf += msg_size;
+	buf_left -= msg_size;
+	msg_left -= msg_size;
+
+	/* Do not bother with attr parsing if not requested */
+	if (attrp == NULL || *attr_max == 0) {
+		return (0);
+	}
+
+	for (i = 0; i < *attr_max; i++) {
+		if (buf_left < LXATTR_HDRLEN || msg_left < LXATTR_HDRLEN) {
+			break;
+		}
+
+		lxa = (lx_netlink_attr_t *)buf;
+		if (lxa->lxna_len > buf_left || lxa->lxna_len > msg_left) {
+			return (-1);
+		}
+
+		attrp[i] = lxa;
+		buf += lxa->lxna_len;
+		buf_left -= lxa->lxna_len;
+		msg_left -= lxa->lxna_len;
+	}
+	*attr_max = i;
+
+	return (0);
+}
+
+/*
+ * Takes an IPv4 address (in network byte order) and returns the address scope.
+ */
+static uint8_t
+lx_ipv4_rtscope(in_addr_t nbo_addr)
+{
+	in_addr_t addr = ntohl(nbo_addr);
+	if ((addr >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
+		return (LX_RTSCOPE_HOST);
+	} else if ((addr & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) {
+		return (LX_RTSCOPE_LINK);
+	} else if ((addr & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
+	    (addr & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
+	    (addr & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) {
+		return (LX_RTSCOPE_SITE);
+	} else {
+		return (LX_RTSCOPE_UNIVERSE);
+	}
+}
+
+/*
+ * Takes an IPv6 address and returns the address scope.
+ */
+static uint8_t
+lx_ipv6_rtscope(const in6_addr_t *addr)
+{
+	if (IN6_ARE_ADDR_EQUAL(addr, &ipv6_loopback)) {
+		return (LX_RTSCOPE_HOST);
+	} else if (IN6_IS_ADDR_LINKLOCAL(addr)) {
+		return (LX_RTSCOPE_LINK);
+	} else if (IN6_IS_ADDR_SITELOCAL(addr)) {
+		return (LX_RTSCOPE_SITE);
+	} else {
+		return (LX_RTSCOPE_UNIVERSE);
+	}
+}
+
+static void
+lx_netlink_getlink_lifreq(lx_netlink_reply_t *reply, struct lifreq *lifr)
+{
+	lx_netlink_ifinfomsg_t ifi;
+	int i;
+	char if_name[IFNAMSIZ];
+	struct sockaddr_dl *sdl;
+	struct sockaddr hwaddr;
+	int hwaddr_size;
+	boolean_t is_loopback;
+
+	struct {
+		int native;
+		int lx;
+	} flags[] = {
+		{ IFF_UP, LX_IFF_UP },
+		{ IFF_BROADCAST, LX_IFF_BROADCAST },
+		{ IFF_DEBUG, LX_IFF_DEBUG },
+		{ IFF_LOOPBACK, LX_IFF_LOOPBACK },
+		{ IFF_POINTOPOINT, LX_IFF_POINTOPOINT },
+		{ IFF_NOTRAILERS, LX_IFF_NOTRAILERS },
+		{ IFF_RUNNING, LX_IFF_RUNNING },
+		{ IFF_NOARP, LX_IFF_NOARP },
+		{ IFF_PROMISC, LX_IFF_PROMISC },
+		{ IFF_ALLMULTI, LX_IFF_ALLMULTI },
+		{ IFF_MULTICAST, LX_IFF_MULTICAST },
+		{ 0 }
+	};
+
+	/*
+	 * illumos interfaces that contain a ':' are non-zero logical
+	 * interfaces. We should only emit the name of the zeroth logical
+	 * interface, since RTM_GETLINK only expects to see the name of
+	 * devices. The addresses of all logical devices will be
+	 * returned via an RTM_GETADDR.
+	 */
+	if (strchr(lifr->lifr_name, ':') != NULL)
+		return;
+
+	/*
+	 * Most of the lx_netlink module is architected to emit information in
+	 * an illumos-native manner.  Socket syscalls such as getsockname will
+	 * not translate fields to values Linux programs would expect since
+	 * that conversion is performed by the generic socket emulation.
+	 *
+	 * This is _not_ true of the actual protocol output from lx_netlink.
+	 * Since translating it at the socket layer would be onerous, all
+	 * output (including constants and names) is pre-translated to values
+	 * valid for Linux.
+	 */
+
+	bzero(&ifi, sizeof (ifi));
+	ifi.lxnl_ifi_family = AF_UNSPEC;
+	ifi.lxnl_ifi_change = (uint32_t)-1;
+
+	/* Convert the name to be Linux-friendly */
+	(void) strlcpy(if_name, lifr->lifr_name, IFNAMSIZ);
+	lx_ifname_convert(if_name, LX_IF_FROMNATIVE);
+	is_loopback = (strncmp(if_name, "lo", 2) == 0);
+
+	if (lx_netlink_reply_ioctl(reply, SIOCGLIFINDEX, lifr) != 0)
+		return;
+
+	ifi.lxnl_ifi_index = lifr->lifr_index;
+
+	if (lx_netlink_reply_ioctl(reply, SIOCGLIFFLAGS, lifr) != 0)
+		return;
+
+	for (i = 0; flags[i].native; i++) {
+		if (lifr->lifr_flags & flags[i].native)
+			ifi.lxnl_ifi_flags |= flags[i].lx;
+	}
+
+	/*
+	 * Query the datalink address.
+	 * The interface type will be included in the outgoing infomsg while
+	 * the address itself will be output separately.
+	 */
+	sdl = (struct sockaddr_dl *)&lifr->lifr_addr;
+	bzero(sdl, sizeof (*sdl));
+	if (!is_loopback) {
+		(void) lx_netlink_reply_ioctl(reply, SIOCGLIFHWADDR, lifr);
+	} else {
+		/* Simulate an empty hwaddr for loopback */
+		sdl->sdl_type = DL_LOOP;
+		sdl->sdl_alen = ETHERADDRL;
+	}
+	lx_stol_hwaddr(sdl, &hwaddr, &hwaddr_size);
+
+	ifi.lxnl_ifi_type = hwaddr.sa_family;
+	lx_netlink_reply_msg(reply, &ifi, sizeof (lx_netlink_ifinfomsg_t));
+
+	lx_netlink_reply_attr_string(reply, LX_NETLINK_IFLA_IFNAME, if_name);
+
+	if (lx_netlink_reply_ioctl(reply, SIOCGLIFMTU, lifr) != 0)
+		return;
+
+	lx_netlink_reply_attr_int32(reply, LX_NETLINK_IFLA_MTU, lifr->lifr_mtu);
+
+	if (hwaddr_size != 0) {
+		lx_netlink_reply_attr(reply, LX_NETLINK_IFLA_ADDRESS,
+		    hwaddr.sa_data, hwaddr_size);
+	}
+
+	/* Emulate a txqlen of 1. (0 for loopbacks) */
+	lx_netlink_reply_attr_int32(reply, LX_NETLINK_IFLA_TXQLEN,
+	    (is_loopback) ? 0 : 1);
+
+	lx_netlink_reply_send(reply);
+}
+
+static void
+lx_netlink_reply_eachfamily(lx_netlink_reply_t *reply,
+    void (*func)(lx_netlink_reply_t *, struct lifreq *), boolean_t distinct)
+{
+	lx_netlink_sock_t *sock = reply->lxnr_sock;
+	int nlifr, i;
+
+	struct {
+		int family;
+		ldi_handle_t handle;
+		struct lifconf lifc;
+		struct lifnum lifn;
+	} families[] = {
+		{ AF_INET, sock->lxns_iphandle },
+		{ AF_INET6, sock->lxns_ip6handle },
+		{ AF_UNSPEC }
+	}, *family, *check;
+
+	for (family = families; family->family != AF_UNSPEC; family++) {
+		struct lifconf *lifc = &family->lifc;
+		struct lifnum *lifn = &family->lifn;
+
+		lifn->lifn_family = family->family;
+		sock->lxns_current = family->handle;
+
+		if (lx_netlink_reply_ioctl(reply, SIOCGLIFNUM, lifn) != 0)
+			break;
+
+		lifc->lifc_family = lifn->lifn_family;
+		lifc->lifc_flags = 0;
+		lifc->lifc_len = lifn->lifn_count * sizeof (struct lifreq);
+		if (lifn->lifn_count == 0) {
+			lifc->lifc_buf = NULL;
+			continue;
+		}
+		lifc->lifc_buf = kmem_alloc(lifc->lifc_len, KM_SLEEP);
+
+		if (lx_netlink_reply_ioctl(reply, SIOCGLIFCONF, lifc) != 0)
+			break;
+
+		nlifr = lifc->lifc_len / sizeof (lifc->lifc_req[0]);
+
+		for (i = 0; i < nlifr; i++) {
+			if (!distinct) {
+				func(reply, &lifc->lifc_req[i]);
+				continue;
+			}
+
+			/*
+			 * If we have been asked to provide each interface
+			 * exactly once, we need to (annoyingly) check this
+			 * name against others that we've already processed for
+			 * other families.  Yes, this is quadratic time -- but
+			 * the number of interfaces per family is expected to
+			 * be very small.
+			 */
+			for (check = families; check != family; check++) {
+				struct lifconf *clifc = &check->lifc;
+				int cnlifr = clifc->lifc_len /
+				    sizeof (clifc->lifc_req[0]), j;
+				char *nm = lifc->lifc_req[i].lifr_name, *cnm;
+
+				for (j = 0; j < cnlifr; j++) {
+					cnm = clifc->lifc_req[j].lifr_name;
+
+					if (strcmp(nm, cnm) == 0)
+						break;
+				}
+
+				if (j != cnlifr)
+					break;
+			}
+
+			if (check != family)
+				continue;
+
+			func(reply, &lifc->lifc_req[i]);
+		}
+	}
+
+	for (family = families; family->family != AF_UNSPEC; family++) {
+		struct lifconf *lifc = &family->lifc;
+
+		if (lifc->lifc_buf != NULL)
+			kmem_free(lifc->lifc_buf, lifc->lifc_len);
+	}
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_getlink(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	lx_netlink_reply_t *reply;
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_NETLINK_RTM_NEWLINK);
+
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_netlink_reply_eachfamily(reply, lx_netlink_getlink_lifreq, B_TRUE);
+	lx_netlink_reply_done(reply);
+
+	return (0);
+}
+
+static void
+lx_netlink_getaddr_lifreq(lx_netlink_reply_t *reply, struct lifreq *lifr)
+{
+	lx_netlink_ifaddrmsg_t ifa;
+
+	bzero(&ifa, sizeof (ifa));
+
+	if (lx_netlink_reply_ioctl(reply, SIOCGLIFINDEX, lifr) != 0)
+		return;
+
+	ifa.lxnl_ifa_index = lifr->lifr_index;
+
+	if (lx_netlink_reply_ioctl(reply, SIOCGLIFFLAGS, lifr) != 0)
+		return;
+
+	/*
+	 * Don't report on-link subnets
+	 */
+	if ((lifr->lifr_flags & IFF_NOLOCAL) != 0)
+		return;
+
+	if (lx_netlink_reply_ioctl(reply, SIOCGLIFSUBNET, lifr) != 0)
+		return;
+
+	ifa.lxnl_ifa_prefixlen = lifr->lifr_addrlen;
+
+	if (lx_netlink_reply_ioctl(reply, SIOCGLIFADDR, lifr) != 0)
+		return;
+
+	if (lifr->lifr_addr.ss_family == AF_INET) {
+		struct sockaddr_in *sin;
+
+		ifa.lxnl_ifa_family = LX_AF_INET;
+
+		sin = (struct sockaddr_in *)&lifr->lifr_addr;
+		ifa.lxnl_ifa_scope = lx_ipv4_rtscope(
+		    sin->sin_addr.s_addr);
+
+		lx_netlink_reply_msg(reply, &ifa,
+		    sizeof (lx_netlink_ifaddrmsg_t));
+
+		lx_netlink_reply_attr_int32(reply,
+		    LX_NETLINK_IFA_ADDRESS, sin->sin_addr.s_addr);
+	} else {
+		struct sockaddr_in6 *sin;
+
+		ifa.lxnl_ifa_family = LX_AF_INET6;
+
+		sin = (struct sockaddr_in6 *)&lifr->lifr_addr;
+		ifa.lxnl_ifa_scope = lx_ipv6_rtscope(&sin->sin6_addr);
+
+		lx_netlink_reply_msg(reply, &ifa,
+		    sizeof (lx_netlink_ifaddrmsg_t));
+
+		lx_netlink_reply_attr(reply, LX_NETLINK_IFA_ADDRESS,
+		    &sin->sin6_addr, sizeof (sin->sin6_addr));
+	}
+
+	lx_netlink_reply_send(reply);
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_getaddr(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	lx_netlink_reply_t *reply;
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_NETLINK_RTM_NEWADDR);
+
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_netlink_reply_eachfamily(reply, lx_netlink_getaddr_lifreq, B_FALSE);
+	lx_netlink_reply_done(reply);
+
+	return (0);
+}
+
+struct lx_getroute_ctx {
+	lx_netlink_reply_t *lgrtctx_reply;
+	lx_netlink_rtmsg_t *lgrtctx_rtmsg;
+	lx_netlink_attr_t *lgrtctx_attrs[LX_NETLINK_MAX_RTA];
+	unsigned int lgrtctx_max_attr;
+	lx_netlink_attr_t *lgrtctx_rtadst;
+};
+
+static void
+lx_netlink_getroute_ipv4(ire_t *ire, struct lx_getroute_ctx *ctx)
+{
+	lx_netlink_reply_t *reply = ctx->lgrtctx_reply;
+	lx_netlink_rtmsg_t *rtmsg = ctx->lgrtctx_rtmsg;
+	lx_netlink_attr_t *rtadst = ctx->lgrtctx_rtadst;
+	lx_netlink_rtmsg_t res;
+	ill_t *ill = NULL;
+
+	/* Certain IREs are too specific for netlink */
+	if ((ire->ire_type & (IRE_BROADCAST | IRE_MULTICAST | IRE_NOROUTE |
+	    IRE_LOOPBACK | IRE_LOCAL)) != 0 || ire->ire_testhidden != 0) {
+		return;
+	}
+	/*
+	 * When listing routes, CLONE entries are undesired.
+	 * They are required for 'ip route get' on a local address.
+	 */
+	if (rtmsg->rtm_dst_len == 0 && (ire->ire_type & IRE_IF_CLONE) != 0) {
+		return;
+	}
+
+	bzero(&res, sizeof (res));
+	res.rtm_family = LX_AF_INET;
+	res.rtm_table = LX_ROUTE_TABLE_MAIN;
+	res.rtm_type = LX_RTN_UNICAST;
+	res.rtm_dst_len = ire->ire_masklen;
+
+	if (ire->ire_type & (IRE_IF_NORESOLVER|IRE_IF_RESOLVER)) {
+		/* Interface-local networks considered kernel-created */
+		res.rtm_protocol = LX_RTPROT_KERNEL;
+		res.rtm_scope = LX_RTSCOPE_LINK;
+	} else if (ire->ire_flags & RTF_STATIC) {
+		res.rtm_protocol = LX_RTPROT_STATIC;
+	}
+
+	if (rtmsg->rtm_dst_len == 0x20 && rtadst != NULL) {
+		/*
+		 * SpecifY single-destination route.
+		 * RTA_DST details will be added later
+		 */
+		res.rtm_dst_len = rtmsg->rtm_dst_len;
+	}
+
+
+	lx_netlink_reply_msg(reply, &res, sizeof (res));
+
+	if (rtmsg->rtm_dst_len == 0x20 && rtadst != NULL) {
+		/* Add RTA_DST details for single-destination route. */
+		lx_netlink_reply_attr(reply, LX_NETLINK_RTA_DST,
+		    LXATTR_PAYLOAD(rtadst), sizeof (ipaddr_t));
+	} else if (ire->ire_masklen != 0) {
+		lx_netlink_reply_attr(reply, LX_NETLINK_RTA_DST,
+		    &ire->ire_addr, sizeof (ire->ire_addr));
+	}
+
+	if (ire->ire_ill != NULL) {
+		ill = ire->ire_ill;
+	} else if (ire->ire_dep_parent != NULL) {
+		ill = ire->ire_dep_parent->ire_ill;
+	}
+
+	if (ill != NULL) {
+		uint32_t ifindex, addr_src;
+
+		ifindex = ill->ill_phyint->phyint_ifindex;
+		lx_netlink_reply_attr(reply, LX_NETLINK_RTA_OIF,
+		    &ifindex, sizeof (ifindex));
+
+		addr_src = ill->ill_ipif->ipif_lcl_addr;
+		lx_netlink_reply_attr(reply, LX_NETLINK_RTA_PREFSRC,
+		    &addr_src, sizeof (addr_src));
+	}
+
+	if (ire->ire_flags & RTF_GATEWAY) {
+		lx_netlink_reply_attr(reply, LX_NETLINK_RTA_GATEWAY,
+		    &ire->ire_gateway_addr, sizeof (ire->ire_gateway_addr));
+	}
+
+	lx_netlink_reply_send(reply);
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_getroute(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr,
+    mblk_t *mp)
+{
+	struct lx_getroute_ctx ctx;
+	lx_netlink_reply_t *reply;
+	lx_netlink_rtmsg_t rtmsg, *rtmsgp;
+	int rtmsg_size = sizeof (rtmsg);
+	netstack_t *ns;
+	int i;
+
+	bzero(&ctx, sizeof (ctx));
+	ctx.lgrtctx_max_attr = LX_NETLINK_MAX_RTA;
+
+	if (lx_netlink_parse_msg_attrs(mp, (void **)&rtmsgp,
+	    rtmsg_size, ctx.lgrtctx_attrs, &ctx.lgrtctx_max_attr) != 0) {
+		return (EPROTO);
+	}
+
+	/*
+	 * Older version of libnetlink send a truncated rtmsg struct for
+	 * certain RTM_GETROUTE queries.  We must detect this condition and
+	 * truncate our input to prevent later confusion.
+	 */
+	if (curproc->p_zone->zone_brand == &lx_brand &&
+	    lx_kern_release_cmp(curproc->p_zone, "2.6.32") <= 0 &&
+	    rtmsgp->rtm_dst_len == 0) {
+		rtmsg_size = sizeof (rtmsg.rtm_family);
+	}
+	bzero(&rtmsg, sizeof (rtmsg));
+	bcopy(rtmsgp, &rtmsg, rtmsg_size);
+	ctx.lgrtctx_rtmsg = &rtmsg;
+
+	/* If RTA_DST was passed, it effects later decisions */
+	for (i = 0; i < ctx.lgrtctx_max_attr; i++) {
+		lx_netlink_attr_t *attr = ctx.lgrtctx_attrs[i];
+
+		if (attr->lxna_type == LX_NETLINK_RTA_DST &&
+		    attr->lxna_len == LXATTR_LEN(sizeof (ipaddr_t))) {
+			ctx.lgrtctx_rtadst = attr;
+			break;
+		}
+	}
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_NETLINK_RTM_NEWROUTE);
+	if (reply == NULL) {
+		return (ENOMEM);
+	}
+	ctx.lgrtctx_reply = reply;
+
+	/* Do not report anything outside the main table */
+	if (rtmsg.rtm_table != LX_ROUTE_TABLE_MAIN &&
+	    rtmsg.rtm_table != 0) {
+		lx_netlink_reply_done(reply);
+		return (0);
+	}
+
+	ns = netstack_get_current();
+	if (ns == NULL) {
+		lx_netlink_reply_done(reply);
+		return (0);
+	}
+	if (rtmsg.rtm_family == LX_AF_INET || rtmsg.rtm_family == 0) {
+		if (rtmsg.rtm_dst_len == 0x20 && ctx.lgrtctx_rtadst != NULL) {
+			/* resolve route for host */
+			ipaddr_t *dst = LXATTR_PAYLOAD(ctx.lgrtctx_rtadst);
+			ire_t *ire_dst;
+
+			ire_dst = ire_route_recursive_dstonly_v4(*dst, 0, 0,
+			    ns->netstack_ip);
+			lx_netlink_getroute_ipv4(ire_dst, &ctx);
+			ire_refrele(ire_dst);
+		} else {
+			/* get route listing */
+			ire_walk_v4(&lx_netlink_getroute_ipv4, &ctx, ALL_ZONES,
+			    ns->netstack_ip);
+		}
+	}
+	if (rtmsg.rtm_family == LX_AF_INET6) {
+		/* punt on ipv6 for now */
+		netstack_rele(ns);
+		lx_netlink_reply_done(reply);
+		return (EPROTO);
+	}
+	netstack_rele(ns);
+
+	lx_netlink_reply_done(reply);
+	return (0);
+}
+
+/*
+ * Auditing callback to emit response.
+ */
+static void
+lx_netlink_au_cb(void *r, void *b, uint_t blen)
+{
+	lx_netlink_reply_t *reply = (lx_netlink_reply_t *)r;
+
+	lx_netlink_reply_msg(reply, b, blen);
+}
+
+/*
+ * Audit get
+ */
+static int
+lx_netlink_au_get(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr)
+{
+	lx_netlink_reply_t *reply;
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_AUDIT_GET);
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_audit_get(reply, lx_netlink_au_cb);
+	lx_netlink_reply_send(reply);
+	lx_netlink_reply_done(reply);
+	return (0);
+}
+
+/*
+ * Set or clear flag indicating socket is being used to communicate with the
+ * user-level auditd. Also update the counter which prevents this module
+ * from unloading while auditing is using the socket to the auditd.
+ */
+static void
+lx_netlink_au_sock_cb(void *s, boolean_t set)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)s;
+
+	if (set) {
+		lxsock->lxns_flags |= LXNLF_AUDITD;
+		mutex_enter(&lx_netlink_lock);
+		lx_netlink_audit_cnt++;
+		mutex_exit(&lx_netlink_lock);
+	} else {
+		lxsock->lxns_flags &= ~LXNLF_AUDITD;
+		mutex_enter(&lx_netlink_lock);
+		VERIFY(lx_netlink_audit_cnt > 0);
+		lx_netlink_audit_cnt--;
+		mutex_exit(&lx_netlink_lock);
+	}
+}
+
+static int
+lx_netlink_au_set(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	lx_netlink_reply_t *reply;
+	void *datap;
+	size_t datalen;
+	int err;
+
+	datap = (void *)(mp->b_rptr + sizeof (lx_netlink_hdr_t));
+	datalen = MBLKL(mp) - sizeof (lx_netlink_hdr_t);
+
+	err = lx_audit_set(lxsock, datap, datalen, lx_netlink_au_sock_cb);
+	if (err != 0)
+		return (err);
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_AUDIT_SET);
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_netlink_reply_done(reply);
+	return (0);
+}
+
+/*
+ * Audit append rule
+ */
+static int
+lx_netlink_au_ar(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	lx_netlink_reply_t *reply;
+	void *datap;
+	size_t datalen;
+	int err;
+
+	/*
+	 * TODO: At this time, everything we support fits in a single mblk,
+	 * but as we add additional field support, eventually we might need
+	 * to handle an mblk chain for really long string data in the
+	 * rulep->lxar_buf.
+	 */
+	if (mp->b_cont != NULL)
+		return (EINVAL);
+
+	datap = (void *)(mp->b_rptr + sizeof (lx_netlink_hdr_t));
+	datalen = MBLKL(mp) - sizeof (lx_netlink_hdr_t);
+
+	if ((err = lx_audit_append_rule(datap, datalen)) != 0)
+		return (err);
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_AUDIT_ADD_RULE);
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_netlink_reply_done(reply);
+	return (0);
+}
+
+/*
+ * Audit delete rule
+ */
+static int
+lx_netlink_au_dr(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	lx_netlink_reply_t *reply;
+	void *datap;
+	size_t datalen;
+	int err;
+
+	/*
+	 * TODO: At this time, everything we support fits in a single mblk,
+	 * but as we add additional field support, eventually we might need
+	 * to handle an mblk chain for really long string data in the
+	 * rulep->lxar_buf.
+	 */
+	if (mp->b_cont != NULL)
+		return (EINVAL);
+
+	datap = (void *)(mp->b_rptr + sizeof (lx_netlink_hdr_t));
+	datalen = MBLKL(mp) - sizeof (lx_netlink_hdr_t);
+
+	if ((err = lx_audit_delete_rule(datap, datalen)) != 0)
+		return (err);
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_AUDIT_DEL_RULE);
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_netlink_reply_done(reply);
+	return (0);
+}
+
+/*
+ * Auditing callback to emit rule list.
+ */
+static void
+lx_netlink_au_lr_cb(void *r, void *b0, uint_t b0_len, void *b1, uint_t b1_len)
+{
+	lx_netlink_reply_t *reply = (lx_netlink_reply_t *)r;
+
+	lx_netlink_reply_msg(reply, b0, b0_len);
+	lx_netlink_reply_add(reply, b1, b1_len);
+	lx_netlink_reply_send(reply);
+}
+
+/*
+ * Audit list rules
+ */
+static int
+lx_netlink_au_lr(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr)
+{
+	lx_netlink_reply_t *reply;
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_AUDIT_LIST_RULES);
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_audit_list_rules(reply, lx_netlink_au_lr_cb);
+	lx_netlink_reply_done(reply);
+	return (0);
+}
+
+/*
+ * Audit get feature
+ */
+static int
+lx_netlink_au_gf(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr)
+{
+	lx_netlink_reply_t *reply;
+
+	reply = lx_netlink_reply(lxsock, hdr, LX_AUDIT_GET_FEATURE);
+	if (reply == NULL)
+		return (ENOMEM);
+
+	lx_audit_get_feature(reply, lx_netlink_au_cb);
+	lx_netlink_reply_send(reply);
+	lx_netlink_reply_done(reply);
+	return (0);
+}
+
+/*
+ * Audit user message
+ * User messages are submitted as free-form messages which need to get sent
+ * back up to the auditd. This includes informative messages such as starting
+ * or stopping auditing.
+ */
+static int
+lx_netlink_au_um(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	lx_netlink_reply_t *reply;
+	size_t datalen;
+	void *bp;
+
+	bp = mp->b_rptr + sizeof (lx_netlink_hdr_t);
+	datalen = MBLKL(mp) - (sizeof (lx_netlink_hdr_t));
+
+	/*
+	 * TODO: At this time, everything we support fits in a single mblk,
+	 * but eventually we might need to handle an mblk chain for a really
+	 * long user message.
+	 */
+	if (mp->b_cont != NULL)
+		return (EINVAL);
+
+	lx_audit_emit_user_msg(hdr->lxnh_type, datalen, bp);
+
+	if (hdr->lxnh_flags & LX_NETLINK_NLM_F_ACK) {
+		reply = lx_netlink_reply(lxsock, hdr, hdr->lxnh_type);
+		if (reply == NULL)
+			return (ENOMEM);
+
+		lx_netlink_reply_done(reply);
+	}
+	return (0);
+}
+
+static int
+lx_netlink_au_emit_cb(void *s, uint_t type, const char *msg, uint_t size)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)s;
+	lx_netlink_hdr_t *hdr;
+	mblk_t *mp, *mp1;
+	int error;
+	uint32_t len;
+
+	len = LXNLMSG_ALIGN(sizeof (lx_netlink_hdr_t));
+	if (msg != NULL) {
+		len += LXNLMSG_ALIGN(size);
+		if (len > lxsock->lxns_bufsize)
+			return (E2BIG);
+	}
+
+	if ((mp = allocb(lxsock->lxns_bufsize, 0)) == NULL) {
+		return (ENOMEM);
+	}
+
+	bzero(mp->b_rptr, lxsock->lxns_bufsize);
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	hdr = (lx_netlink_hdr_t *)mp->b_rptr;
+	hdr->lxnh_flags = LX_NETLINK_NLM_F_MULTI;
+	hdr->lxnh_len = len;
+	hdr->lxnh_type = (msg == NULL ? LX_NETLINK_NLMSG_DONE : type);
+	hdr->lxnh_seq = 0;
+	hdr->lxnh_pid = 0;
+
+	mp->b_wptr += LXNLMSG_ALIGN(sizeof (lx_netlink_hdr_t));
+	if (msg != NULL) {
+		bcopy(msg, mp->b_wptr, size);
+		mp->b_wptr += LXNLMSG_ALIGN(size);
+	}
+
+	/* As in lx_netlink_reply_sendup, send as T_UNITDATA_IND message. */
+	if ((mp1 = lx_netlink_alloc_mp1(lxsock)) == NULL) {
+		freeb(mp);
+		return (ENOMEM);
+	}
+	mp1->b_cont = mp;
+
+	/*
+	 * If the socket is currently flow-controlled, do not allow further
+	 * data to be sent out.  Messages of the NLMSG_DONE type, triggered by
+	 * passing msg == NULL, are excempt from this restriction.
+	 */
+	mutex_enter(&lxsock->lxns_flowctl_mtx);
+	if (lxsock->lxns_flowctrled && msg != NULL) {
+		mutex_exit(&lxsock->lxns_flowctl_mtx);
+		freemsg(mp1);
+		return (ENOSPC);
+	}
+
+	lxsock->lxns_upcalls->su_recv(lxsock->lxns_uphandle, mp1,
+	    msgdsize(mp1), 0, &error, NULL);
+
+	/*
+	 * The socket indicated that it is now flow-controlled.  That said, it
+	 * still queued the last message, so indicated success (but track the
+	 * flow-controlled state).
+	 */
+	if (error == ENOSPC) {
+		lxsock->lxns_flowctrled = B_TRUE;
+		lx_netlink_flowctrld++;
+		error = 0;
+	}
+	mutex_exit(&lxsock->lxns_flowctl_mtx);
+
+	return (error);
+}
+
+static int
+lx_netlink_audit(lx_netlink_sock_t *lxsock, lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	/*
+	 * This is paranoia, in case our socket somehow escaped the zone.
+	 */
+	if (curproc->p_zone->zone_brand != &lx_brand)
+		return (ECONNREFUSED);
+
+	if (MBLKL(mp) < sizeof (lx_netlink_hdr_t))
+		return (EINVAL);
+
+	/*
+	 * Ensure audit state is setup whenever we get an audit control msg.
+	 * However, we skip initialization for user messages since some apps
+	 * (e.g. systemd) blindly send audit messages, even though auditing
+	 * is not installed or in use. Uninitialized state is handled in
+	 * lx_audit_user_msg().
+	 */
+	if (hdr->lxnh_type < LX_AUDIT_USER_MSG_START)
+		lx_audit_init(lx_netlink_au_emit_cb);
+
+	/*
+	 * Within Linux, when a netlink message requests an ack, the code
+	 * first sends the ack as an error response (NLMSG_ERROR) with an
+	 * error code of 0.
+	 *
+	 * TODO: this needs more work, but is unnecessary for now.
+	 * if (hdr->lxnh_flags & LX_NETLINK_NLM_F_ACK) {
+	 *	reply = lx_netlink_reply(lxsock, hdr, LX_NETLINK_NLMSG_ERROR);
+	 *	if (reply == NULL)
+	 *		return (ENOMEM);
+	 *	lx_netlink_reply_ack(reply);
+	 * }
+	 */
+
+	if (hdr->lxnh_type >= LX_AUDIT_USER_MSG_START) {
+		return (lx_netlink_au_um(lxsock, hdr, mp));
+	}
+
+	switch (hdr->lxnh_type) {
+	case LX_AUDIT_GET:
+		return (lx_netlink_au_get(lxsock, hdr));
+	case LX_AUDIT_SET:
+		return (lx_netlink_au_set(lxsock, hdr, mp));
+	case LX_AUDIT_ADD_RULE:
+		return (lx_netlink_au_ar(lxsock, hdr, mp));
+	case LX_AUDIT_DEL_RULE:
+		return (lx_netlink_au_dr(lxsock, hdr, mp));
+	case LX_AUDIT_LIST_RULES:
+		return (lx_netlink_au_lr(lxsock, hdr));
+	case LX_AUDIT_GET_FEATURE:
+		return (lx_netlink_au_gf(lxsock, hdr));
+	}
+
+	/*
+	 * For all other auditing messages (i.e. one we don't yet support), we
+	 * return ECONNREFUSED.
+	 */
+	return (ECONNREFUSED);
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_kobject_uevent(lx_netlink_sock_t *lxsock,
+    lx_netlink_hdr_t *hdr, mblk_t *mp)
+{
+	/*
+	 * For udev, we just silently accept all writes and never actually
+	 * reply with anything -- which appears to be sufficient for things
+	 * to work.
+	 */
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_send(sock_lower_handle_t handle, mblk_t *mp,
+    struct nmsghdr *msg, cred_t *cr)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)handle;
+	lx_netlink_hdr_t *hdr = (lx_netlink_hdr_t *)mp->b_rptr;
+	int i, rval;
+
+	static struct {
+		int proto;
+		uint16_t type;
+		int (*func)(lx_netlink_sock_t *, lx_netlink_hdr_t *, mblk_t *);
+	} handlers[] = {
+		{ LX_NETLINK_ROUTE,
+		    LX_NETLINK_RTM_GETLINK, lx_netlink_getlink },
+		{ LX_NETLINK_ROUTE,
+		    LX_NETLINK_RTM_GETADDR, lx_netlink_getaddr },
+		{ LX_NETLINK_ROUTE,
+		    LX_NETLINK_RTM_GETROUTE, lx_netlink_getroute },
+		{ LX_NETLINK_AUDIT,
+		    LX_NETLINK_NLMSG_NONE, lx_netlink_audit },
+		{ LX_NETLINK_KOBJECT_UEVENT,
+		    LX_NETLINK_NLMSG_NONE, lx_netlink_kobject_uevent },
+		{ LX_NETLINK_NLMSG_NOOP, LX_NETLINK_NLMSG_NONE, NULL }
+	};
+
+	if (msg->msg_name != NULL) {
+		lx_netlink_sockaddr_t *lxsa =
+		    (lx_netlink_sockaddr_t *)msg->msg_name;
+
+		if (msg->msg_namelen != sizeof (lx_netlink_sockaddr_t) ||
+		    lxsa->lxnl_family != AF_LX_NETLINK) {
+			return (EINVAL);
+		}
+
+		/*
+		 * If this message is targeted beyond just the OS kernel, an
+		 * access check must be made.
+		 */
+		if (lxsa->lxnl_port != 0 || lxsa->lxnl_groups != 0) {
+			int err;
+			char buf[LX_UNSUP_BUFSZ];
+
+			err = lx_netlink_access(lxsock, cr, LXNL_SENDMSG);
+			if (err != 0) {
+				return (err);
+			}
+
+			/*
+			 * Support for netlink messages beyond rtnetlink(7) is
+			 * non-existent at this time.  These messages are
+			 * tolerated, rather than tossing a potentially fatal
+			 * error to the application.
+			 */
+			(void) snprintf(buf, LX_UNSUP_BUFSZ,
+			    "netlink sendmsg addr port:%X groups:%08X",
+			    lxsa->lxnl_port, lxsa->lxnl_groups);
+			lx_unsupported(buf);
+		}
+	}
+
+	if (DB_TYPE(mp) != M_DATA || MBLKL(mp) < sizeof (lx_netlink_hdr_t)) {
+		freemsg(mp);
+		return (EPROTO);
+	}
+
+	for (i = 0; handlers[i].func != NULL; i++) {
+		if (lxsock->lxns_proto != handlers[i].proto)
+			continue;
+
+		if (handlers[i].type != LX_NETLINK_NLMSG_NONE &&
+		    hdr->lxnh_type != handlers[i].type)
+			continue;
+
+		rval = handlers[i].func(lxsock, hdr, mp);
+		freemsg(mp);
+
+		return (rval);
+	}
+
+	/*
+	 * An unrecognized message.  We will bounce up an EOPNOTSUPP reply.
+	 */
+	rval = lx_netlink_reply_error(lxsock, hdr, EOPNOTSUPP);
+	freemsg(mp);
+
+	return (rval);
+}
+
+static void
+lx_netlink_clr_flowctrl(sock_lower_handle_t handle)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)handle;
+
+	mutex_enter(&lxsock->lxns_flowctl_mtx);
+	lxsock->lxns_flowctrled = B_FALSE;
+	mutex_exit(&lxsock->lxns_flowctl_mtx);
+}
+
+/*ARGSUSED*/
+static int
+lx_netlink_close(sock_lower_handle_t handle, int flags, cred_t *cr)
+{
+	lx_netlink_sock_t *lxsock = (lx_netlink_sock_t *)handle, *sock, **prev;
+
+	if (lxsock->lxns_flags & LXNLF_AUDITD)
+		lx_audit_stop_worker(lxsock, lx_netlink_au_sock_cb);
+
+	mutex_enter(&lx_netlink_lock);
+
+	prev = &lx_netlink_head;
+
+	for (sock = *prev; sock != lxsock; sock = sock->lxns_next)
+		prev = &sock->lxns_next;
+
+	*prev = sock->lxns_next;
+
+	mutex_exit(&lx_netlink_lock);
+
+	(void) ldi_close(lxsock->lxns_iphandle, FREAD, kcred);
+	(void) ldi_close(lxsock->lxns_ip6handle, FREAD, kcred);
+	mutex_destroy(&lxsock->lxns_flowctl_mtx);
+	kmem_free(lxsock, sizeof (lx_netlink_sock_t));
+
+	return (0);
+}
+
+static sock_downcalls_t sock_lx_netlink_downcalls = {
+	lx_netlink_activate,		/* sd_activate */
+	sock_accept_notsupp,		/* sd_accept */
+	lx_netlink_bind,		/* sd_bind */
+	sock_listen_notsupp,		/* sd_listen */
+	sock_connect_notsupp,		/* sd_connect */
+	sock_getpeername_notsupp,	/* sd_getpeername */
+	lx_netlink_getsockname,		/* sd_getsockname */
+	lx_netlink_getsockopt,		/* sd_getsockopt */
+	lx_netlink_setsockopt,		/* sd_setsockopt */
+	lx_netlink_send,		/* sd_send */
+	NULL,				/* sd_send_uio */
+	NULL,				/* sd_recv_uio */
+	NULL,				/* sd_poll */
+	sock_shutdown_notsupp,		/* sd_shutdown */
+	lx_netlink_clr_flowctrl,	/* sd_clr_flowctrl */
+	sock_ioctl_notsupp,		/* sd_ioctl */
+	lx_netlink_close		/* sd_close */
+};
+
+/*ARGSUSED*/
+static sock_lower_handle_t
+lx_netlink_create(int family, int type, int proto,
+    sock_downcalls_t **sock_downcalls, uint_t *smodep, int *errorp,
+    int flags, cred_t *credp)
+{
+	lx_netlink_sock_t *lxsock;
+	ldi_handle_t handle, handle6;
+	cred_t *kcred = zone_kcred();
+	int err;
+
+	if (family != AF_LX_NETLINK ||
+	    (type != SOCK_DGRAM && type != SOCK_RAW)) {
+		*errorp = EPROTONOSUPPORT;
+		return (NULL);
+	}
+
+	switch (proto) {
+	case LX_NETLINK_ROUTE:
+	case LX_NETLINK_AUDIT:
+	case LX_NETLINK_KOBJECT_UEVENT:
+		break;
+
+	default:
+		*errorp = EPROTONOSUPPORT;
+		return (NULL);
+	}
+
+	if ((err = ldi_open_by_name(DEV_IP, FREAD, kcred,
+	    &handle, lx_netlink_ldi)) != 0) {
+		*errorp = err;
+		return (NULL);
+	}
+
+	if ((err = ldi_open_by_name(DEV_IP6, FREAD, kcred,
+	    &handle6, lx_netlink_ldi)) != 0) {
+		(void) ldi_close(handle, FREAD, kcred);
+		*errorp = err;
+		return (NULL);
+	}
+
+	*sock_downcalls = &sock_lx_netlink_downcalls;
+	*smodep = SM_ATOMIC;
+
+	lxsock = kmem_zalloc(sizeof (lx_netlink_sock_t), KM_SLEEP);
+	lxsock->lxns_iphandle = handle;
+	lxsock->lxns_ip6handle = handle6;
+	lxsock->lxns_bufsize = lx_netlink_bufsize;
+	lxsock->lxns_proto = proto;
+	mutex_init(&lxsock->lxns_flowctl_mtx, NULL, MUTEX_DEFAULT, NULL);
+
+	mutex_enter(&lx_netlink_lock);
+
+	lxsock->lxns_next = lx_netlink_head;
+	lx_netlink_head = lxsock;
+
+	mutex_exit(&lx_netlink_lock);
+
+	return ((sock_lower_handle_t)lxsock);
+}
+
+static void
+lx_netlink_init(void)
+{
+	major_t major = mod_name_to_major("ip");
+	int err;
+
+	VERIFY(major != DDI_MAJOR_T_NONE);
+
+	err = ldi_ident_from_major(major, &lx_netlink_ldi);
+	VERIFY(err == 0);
+}
+
+static void
+lx_netlink_fini(void)
+{
+	ldi_ident_release(lx_netlink_ldi);
+}
+
+static smod_reg_t sinfo = {
+	SOCKMOD_VERSION,
+	"lx_netlink",
+	SOCK_UC_VERSION,
+	SOCK_DC_VERSION,
+	lx_netlink_create,
+	NULL
+};
+
+/* modldrv structure */
+static struct modlsockmod sockmod = {
+	&mod_sockmodops, "AF_LX_NETLINK socket module", &sinfo
+};
+
+/* modlinkage structure */
+static struct modlinkage ml = {
+	MODREV_1,
+	&sockmod,
+	NULL
+};
+
+int
+_init(void)
+{
+	int err;
+
+	lx_netlink_init();
+
+	if ((err = mod_install(&ml)) != 0)
+		lx_netlink_fini();
+
+	return (err);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&ml, modinfop));
+}
+
+int
+_fini(void)
+{
+	int err = 0;
+
+	mutex_enter(&lx_netlink_lock);
+
+	if (lx_netlink_head != NULL || lx_netlink_audit_cnt != 0)
+		err = EBUSY;
+
+	mutex_exit(&lx_netlink_lock);
+
+	if (err == 0) {
+		lx_audit_cleanup();
+		if ((err = mod_remove(&ml)) == 0)
+			lx_netlink_fini();
+	}
+
+	return (err);
+}
diff --git a/usr/src/uts/common/brand/lx/io/lx_ptm.c b/usr/src/uts/common/brand/lx/io/lx_ptm.c
new file mode 100644
index 0000000000..23e0c6f459
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/io/lx_ptm.c
@@ -0,0 +1,1188 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright 2016 Joyent, Inc.  All rights reserved.
+ */
+
+
+/*
+ * This driver attempts to emulate some of the the behaviors of
+ * Linux terminal devices (/dev/ptmx and /dev/pts/[0-9][0-9]*) on Solaris
+ *
+ * It does this by layering over the /dev/ptmx device and intercepting
+ * opens to it.
+ *
+ * This driver makes the following assumptions about the way the ptm/pts
+ * drivers on Solaris work:
+ *
+ *    - all opens of the /dev/ptmx device node return a unique dev_t.
+ *
+ *    - the dev_t minor node value for each open ptm instance corrospondes
+ *      to it's associated slave terminal device number.  ie. the path to
+ *      the slave terminal device associated with an open ptm instance
+ *      who's dev_t minor node vaue is 5, is /dev/pts/5.
+ *
+ *    - the ptm driver always allocates the lowest numbered slave terminal
+ *      device possible.
+ */
+
+#include <sys/conf.h>
+#include <sys/ddi.h>
+#include <sys/devops.h>
+#include <sys/file.h>
+#include <sys/filio.h>
+#include <sys/kstr.h>
+#include <sys/lx_ptm.h>
+#include <sys/modctl.h>
+#include <sys/pathname.h>
+#include <sys/ptms.h>
+#include <sys/ptyvar.h>
+#include <sys/stat.h>
+#include <sys/stropts.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/sysmacros.h>
+#include <sys/types.h>
+#include <sys/sdt.h>
+
+#define	LP_PTM_PATH		"/dev/ptmx"
+#define	LP_PTS_PATH		"/dev/pts/"
+#define	LP_PTS_DRV_NAME		"pts"
+#define	LP_PTS_USEC_DELAY	(5 * 1000)	/* 5 ms */
+#define	LP_PTS_USEC_DELAY_MAX	(5 * MILLISEC)	/* 5 ms */
+
+/*
+ * this driver is layered on top of the ptm driver.  we'd like to
+ * make this drivers minor name space a mirror of the ptm drivers
+ * namespace, but we can't actually do this.  the reason is that the
+ * ptm driver is opened via the clone driver.  there for no minor nodes
+ * of the ptm driver are actually accessible via the filesystem.
+ * since we're not a streams device we can't be opened by the clone
+ * driver.  there for we need to have at least minor node accessible
+ * via the filesystem so that consumers can open it.  we use the device
+ * node with a minor number of 0 for this purpose.  what this means is
+ * that minor node 0 can't be used to map ptm minor node 0.  since this
+ * minor node is now reserved we need to shift our ptm minor node
+ * mappings by one.  ie. a ptm minor node with a value of 0 will
+ * corrospond to our minor node with a value of 1.  these mappings are
+ * managed with the following macros.
+ */
+#define	DEVT_TO_INDEX(x)	LX_PTM_DEV_TO_PTS(x)
+#define	INDEX_TO_MINOR(x)	((x) + 1)
+
+/*
+ * grow our layered handle array by the same size increment that the ptm
+ * driver uses to grow the pty device space - PTY_MAXDELTA
+ */
+#define	LP_PTY_INC	128
+
+/*
+ * lx_ptm_ops contains state information about outstanding operations on the
+ * underlying master terminal device.  Currently we only track information
+ * for read operations.
+ *
+ * Note that this data has not been rolled directly into the lx_ptm_handle
+ * structure because we can't put mutex's of condition variables into
+ * lx_ptm_handle structure.  The reason is that the array of lx_ptm_handle
+ * structures linked to from the global lx_ptm state can be resized
+ * dynamically, and when it's resized, the new array is at a different
+ * memory location and the old array memory is discarded.  Mutexs and cvs
+ * are accessed based off their address, so if this array was re-sized while
+ * there were outstanding operations on any mutexs or cvs in the array
+ * then the system would tip over.  In the future the lx_ptm_handle structure
+ * array should probably be replaced with either an array of pointers to
+ * lx_ptm_handle structures or some other kind of data structure containing
+ * pointers to lx_ptm_handle structures.  Then the lx_ptm_ops structure
+ * could be folded directly into the lx_ptm_handle structures.  (This will
+ * also require the definition of a new locking mechanism to protect the
+ * contents of lx_ptm_handle structures.)
+ */
+typedef struct lx_ptm_ops {
+	int			lpo_rops;
+	kcondvar_t		lpo_rops_cv;
+	kmutex_t		lpo_rops_lock;
+} lx_ptm_ops_t;
+
+/*
+ * Every open of the master terminal device in a zone results in a new
+ * lx_ptm_handle handle allocation.  These handles are stored in an array
+ * hanging off the lx_ptm_state structure.
+ */
+typedef struct lx_ptm_handle {
+	/* Device handle to the underlying real /dev/ptmx master terminal. */
+	ldi_handle_t		lph_handle;
+
+	/* Flag to indicate if TIOCPKT mode has been enabled. */
+	int			lph_pktio;
+
+	/* Number of times the slave device has been opened/closed. */
+	int			lph_eofed;
+
+	/* Callback handler in the ptm driver to check if slave is open. */
+	ptmptsopencb_t		lph_ppocb;
+
+	/* Pointer to state for operations on underlying device. */
+	lx_ptm_ops_t		*lph_lpo;
+} lx_ptm_handle_t;
+
+/*
+ * Global state for the lx_ptm driver.
+ */
+typedef struct lx_ptm_state {
+	/* lx_ptm device devinfo pointer */
+	dev_info_t		*lps_dip;
+
+	/* LDI ident used to open underlying real /dev/ptmx master terminals. */
+	ldi_ident_t		lps_li;
+
+	/* pts drivers major number */
+	major_t			lps_pts_major;
+
+	/* rw lock used to manage access and growth of lps_lh_array */
+	krwlock_t		lps_lh_rwlock;
+
+	/* number of elements in lps_lh_array */
+	uint_t			lps_lh_count;
+
+	/* Array of handles to underlying real /dev/ptmx master terminals. */
+	lx_ptm_handle_t		*lps_lh_array;
+} lx_ptm_state_t;
+
+/* Pointer to the lx_ptm global state structure. */
+static lx_ptm_state_t	lps;
+
+/*
+ * List of modules to be autopushed onto slave terminal devices when they
+ * are opened in an lx branded zone.
+ */
+static char *lx_pts_mods[] = {
+	"ptem",
+	"ldterm",
+	"ttcompat",
+	NULL
+};
+
+static void
+lx_ptm_lh_grow(uint_t index)
+{
+	uint_t			new_lh_count, old_lh_count;
+	lx_ptm_handle_t		*new_lh_array, *old_lh_array;
+
+	/*
+	 * allocate a new array.  we drop the rw lock on the array so that
+	 * readers can still access devices in case our memory allocation
+	 * blocks.
+	 */
+	new_lh_count = MAX(lps.lps_lh_count + LP_PTY_INC, index + 1);
+	new_lh_array =
+	    kmem_zalloc(sizeof (lx_ptm_handle_t) * new_lh_count, KM_SLEEP);
+
+	/*
+	 * double check that we still actually need to increase the size
+	 * of the array
+	 */
+	rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+	if (index < lps.lps_lh_count) {
+		/* someone beat us to it so there's nothing more to do */
+		rw_exit(&lps.lps_lh_rwlock);
+		kmem_free(new_lh_array,
+		    sizeof (lx_ptm_handle_t) * new_lh_count);
+		return;
+	}
+
+	/* copy the existing data into the new array */
+	ASSERT((lps.lps_lh_count != 0) || (lps.lps_lh_array == NULL));
+	ASSERT((lps.lps_lh_count == 0) || (lps.lps_lh_array != NULL));
+	if (lps.lps_lh_count != 0) {
+		bcopy(lps.lps_lh_array, new_lh_array,
+		    sizeof (lx_ptm_handle_t) * lps.lps_lh_count);
+	}
+
+	/* save info on the old array */
+	old_lh_array = lps.lps_lh_array;
+	old_lh_count = lps.lps_lh_count;
+
+	/* install the new array */
+	lps.lps_lh_array = new_lh_array;
+	lps.lps_lh_count = new_lh_count;
+
+	rw_exit(&lps.lps_lh_rwlock);
+
+	/* free the old array */
+	if (old_lh_array != NULL) {
+		kmem_free(old_lh_array,
+		    sizeof (lx_ptm_handle_t) * old_lh_count);
+	}
+}
+
+static void
+lx_ptm_lh_insert(uint_t index, ldi_handle_t lh)
+{
+	lx_ptm_ops_t *lpo;
+
+	ASSERT(lh != NULL);
+
+	/* Allocate and initialize the ops structure */
+	lpo = kmem_zalloc(sizeof (lx_ptm_ops_t), KM_SLEEP);
+	mutex_init(&lpo->lpo_rops_lock, NULL, MUTEX_DEFAULT, NULL);
+	cv_init(&lpo->lpo_rops_cv, NULL, CV_DEFAULT, NULL);
+
+	rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+
+	/* check if we need to grow the size of the layered handle array */
+	if (index >= lps.lps_lh_count) {
+		rw_exit(&lps.lps_lh_rwlock);
+		lx_ptm_lh_grow(index);
+		rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+	}
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle == NULL);
+	ASSERT(lps.lps_lh_array[index].lph_pktio == 0);
+	ASSERT(lps.lps_lh_array[index].lph_eofed == 0);
+	ASSERT(lps.lps_lh_array[index].lph_lpo == NULL);
+
+	/* insert the new handle and return */
+	lps.lps_lh_array[index].lph_handle = lh;
+	lps.lps_lh_array[index].lph_pktio = 0;
+	lps.lps_lh_array[index].lph_eofed = 0;
+	lps.lps_lh_array[index].lph_lpo = lpo;
+
+	rw_exit(&lps.lps_lh_rwlock);
+}
+
+static ldi_handle_t
+lx_ptm_lh_remove(uint_t index)
+{
+	ldi_handle_t	lh;
+
+	rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+	ASSERT(lps.lps_lh_array[index].lph_lpo->lpo_rops == 0);
+	ASSERT(!MUTEX_HELD(&lps.lps_lh_array[index].lph_lpo->lpo_rops_lock));
+
+	/* free the write handle */
+	kmem_free(lps.lps_lh_array[index].lph_lpo, sizeof (lx_ptm_ops_t));
+	lps.lps_lh_array[index].lph_lpo = NULL;
+
+	/* remove the handle and return it */
+	lh = lps.lps_lh_array[index].lph_handle;
+	lps.lps_lh_array[index].lph_handle = NULL;
+	lps.lps_lh_array[index].lph_pktio = 0;
+	lps.lps_lh_array[index].lph_eofed = 0;
+	rw_exit(&lps.lps_lh_rwlock);
+	return (lh);
+}
+
+static void
+lx_ptm_lh_get_ppocb(uint_t index, ptmptsopencb_t *ppocb)
+{
+	rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+
+	*ppocb = lps.lps_lh_array[index].lph_ppocb;
+	rw_exit(&lps.lps_lh_rwlock);
+}
+
+static void
+lx_ptm_lh_set_ppocb(uint_t index, ptmptsopencb_t *ppocb)
+{
+	rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+
+	lps.lps_lh_array[index].lph_ppocb = *ppocb;
+	rw_exit(&lps.lps_lh_rwlock);
+}
+
+static ldi_handle_t
+lx_ptm_lh_lookup(uint_t index)
+{
+	ldi_handle_t	lh;
+
+	rw_enter(&lps.lps_lh_rwlock, RW_READER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+
+	/* return the handle */
+	lh = lps.lps_lh_array[index].lph_handle;
+	rw_exit(&lps.lps_lh_rwlock);
+	return (lh);
+}
+
+static lx_ptm_ops_t *
+lx_ptm_lpo_lookup(uint_t index)
+{
+	lx_ptm_ops_t	*lpo;
+
+	rw_enter(&lps.lps_lh_rwlock, RW_READER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_lpo != NULL);
+
+	/* return the handle */
+	lpo = lps.lps_lh_array[index].lph_lpo;
+	rw_exit(&lps.lps_lh_rwlock);
+	return (lpo);
+}
+
+static int
+lx_ptm_lh_pktio_get(uint_t index)
+{
+	int		pktio;
+
+	rw_enter(&lps.lps_lh_rwlock, RW_READER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+
+	/* return the pktio state */
+	pktio = lps.lps_lh_array[index].lph_pktio;
+	rw_exit(&lps.lps_lh_rwlock);
+	return (pktio);
+}
+
+static void
+lx_ptm_lh_pktio_set(uint_t index, int pktio)
+{
+	rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+
+	/* set the pktio state */
+	lps.lps_lh_array[index].lph_pktio = pktio;
+	rw_exit(&lps.lps_lh_rwlock);
+}
+
+static int
+lx_ptm_lh_eofed_get(uint_t index)
+{
+	int		eofed;
+
+	rw_enter(&lps.lps_lh_rwlock, RW_READER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+
+	/* return the eofed state */
+	eofed = lps.lps_lh_array[index].lph_eofed;
+	rw_exit(&lps.lps_lh_rwlock);
+	return (eofed);
+}
+
+static void
+lx_ptm_lh_eofed_set(uint_t index)
+{
+	rw_enter(&lps.lps_lh_rwlock, RW_WRITER);
+
+	ASSERT(index < lps.lps_lh_count);
+	ASSERT(lps.lps_lh_array[index].lph_handle != NULL);
+
+	/* set the eofed state */
+	lps.lps_lh_array[index].lph_eofed++;
+	rw_exit(&lps.lps_lh_rwlock);
+}
+
+static int
+lx_ptm_read_start(dev_t dev)
+{
+	lx_ptm_ops_t	*lpo = lx_ptm_lpo_lookup(DEVT_TO_INDEX(dev));
+
+	mutex_enter(&lpo->lpo_rops_lock);
+	ASSERT(lpo->lpo_rops >= 0);
+
+	/* Wait for other read operations to finish */
+	while (lpo->lpo_rops != 0) {
+		if (cv_wait_sig(&lpo->lpo_rops_cv, &lpo->lpo_rops_lock) == 0) {
+			mutex_exit(&lpo->lpo_rops_lock);
+			return (-1);
+		}
+	}
+
+	/* Start a read operation */
+	VERIFY(++lpo->lpo_rops == 1);
+	mutex_exit(&lpo->lpo_rops_lock);
+	return (0);
+}
+
+static void
+lx_ptm_read_end(dev_t dev)
+{
+	lx_ptm_ops_t	*lpo = lx_ptm_lpo_lookup(DEVT_TO_INDEX(dev));
+
+	mutex_enter(&lpo->lpo_rops_lock);
+	ASSERT(lpo->lpo_rops >= 0);
+
+	/* End a read operation */
+	VERIFY(--lpo->lpo_rops == 0);
+	cv_signal(&lpo->lpo_rops_cv);
+
+	mutex_exit(&lpo->lpo_rops_lock);
+}
+
+static int
+lx_ptm_pts_isopen(dev_t dev)
+{
+	ptmptsopencb_t	ppocb;
+
+	lx_ptm_lh_get_ppocb(DEVT_TO_INDEX(dev), &ppocb);
+	return (ppocb.ppocb_func(ppocb.ppocb_arg));
+}
+
+static void
+lx_ptm_eof_read(ldi_handle_t lh)
+{
+	struct uio	uio;
+	iovec_t		iov;
+	char		junk[1];
+
+	/*
+	 * We can remove any EOF message from the head of the stream by
+	 * doing a zero byte read from the stream.
+	 */
+	iov.iov_len = 0;
+	iov.iov_base = junk;
+	uio.uio_iovcnt = 1;
+	uio.uio_iov = &iov;
+	uio.uio_resid = iov.iov_len;
+	uio.uio_offset = 0;
+	uio.uio_segflg = UIO_SYSSPACE;
+	uio.uio_fmode = 0;
+	uio.uio_extflg = 0;
+	uio.uio_llimit = MAXOFFSET_T;
+	(void) ldi_read(lh, &uio, kcred);
+}
+
+static int
+lx_ptm_eof_drop_1(dev_t dev, int *rvalp)
+{
+	ldi_handle_t	lh = lx_ptm_lh_lookup(DEVT_TO_INDEX(dev));
+	int		err, msg_size, msg_count;
+
+	*rvalp = 0;
+
+	/*
+	 * Check if there is an EOF message (represented by a zero length
+	 * data message) at the head of the stream.  Note that the
+	 * I_NREAD ioctl is a streams framework ioctl so it will succeed
+	 * even if there have been previous write errors on this stream.
+	 */
+	if ((err = ldi_ioctl(lh, I_NREAD, (intptr_t)&msg_size,
+	    FKIOCTL, kcred, &msg_count)) != 0)
+		return (err);
+
+	if ((msg_count == 0) || (msg_size != 0)) {
+		/* No EOF message found */
+		return (0);
+	}
+
+	/* Record the fact that the slave device has been closed. */
+	lx_ptm_lh_eofed_set(DEVT_TO_INDEX(dev));
+
+	/* drop the EOF */
+	lx_ptm_eof_read(lh);
+	*rvalp = 1;
+	return (0);
+}
+
+static int
+lx_ptm_eof_drop(dev_t dev, int *rvalp)
+{
+	int rval, err;
+
+	if (rvalp != NULL)
+		*rvalp = 0;
+	for (;;) {
+		if ((err = lx_ptm_eof_drop_1(dev, &rval)) != 0)
+			return (err);
+		if (rval == 0)
+			return (0);
+		if (rvalp != NULL)
+			*rvalp = 1;
+	}
+}
+
+static int
+lx_ptm_data_check(dev_t dev, int ignore_eof, int *rvalp)
+{
+	ldi_handle_t	lh = lx_ptm_lh_lookup(DEVT_TO_INDEX(dev));
+	int		err;
+
+	*rvalp = 0;
+	if (ignore_eof) {
+		int	size, rval;
+
+		if ((err = ldi_ioctl(lh, FIONREAD, (intptr_t)&size,
+		    FKIOCTL, kcred, &rval)) != 0)
+			return (err);
+		if (size != 0)
+			*rvalp = 1;
+	} else {
+		int	msg_size, msg_count;
+
+		if ((err = ldi_ioctl(lh, I_NREAD, (intptr_t)&msg_size,
+		    FKIOCTL, kcred, &msg_count)) != 0)
+			return (err);
+		if (msg_count != 0)
+			*rvalp = 1;
+	}
+	return (0);
+}
+
+static int
+lx_ptm_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	int err;
+
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	if (ddi_create_minor_node(dip, LX_PTM_MINOR_NODE, S_IFCHR,
+	    ddi_get_instance(dip), DDI_PSEUDO, 0) != DDI_SUCCESS)
+		return (DDI_FAILURE);
+
+	err = ldi_ident_from_dip(dip, &lps.lps_li);
+	if (err != 0) {
+		ddi_remove_minor_node(dip, ddi_get_name(dip));
+		return (DDI_FAILURE);
+	}
+
+	lps.lps_dip = dip;
+	lps.lps_pts_major = ddi_name_to_major(LP_PTS_DRV_NAME);
+
+	rw_init(&lps.lps_lh_rwlock, NULL, RW_DRIVER, NULL);
+	lps.lps_lh_count = 0;
+	lps.lps_lh_array = NULL;
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+lx_ptm_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	ldi_ident_release(lps.lps_li);
+	lps.lps_dip = NULL;
+
+	ASSERT((lps.lps_lh_count != 0) || (lps.lps_lh_array == NULL));
+	ASSERT((lps.lps_lh_count == 0) || (lps.lps_lh_array != NULL));
+	if (lps.lps_lh_array != NULL) {
+		kmem_free(lps.lps_lh_array,
+		    sizeof (lx_ptm_handle_t) * lps.lps_lh_count);
+		lps.lps_lh_array = NULL;
+		lps.lps_lh_count = 0;
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+lx_ptm_open(dev_t *devp, int flag, int otyp, cred_t *credp)
+{
+	struct strioctl	iocb;
+	ptmptsopencb_t	ppocb = { NULL, NULL };
+	ldi_handle_t	lh;
+	major_t		maj, our_major = getmajor(*devp);
+	minor_t		min, lastmin;
+	uint_t		index, anchor = 1;
+	dev_t		ptm_dev;
+	int		err, rval = 0;
+
+	/*
+	 * Don't support the FNDELAY flag and FNONBLOCK until we either
+	 * find a Linux app that opens /dev/ptmx with the O_NDELAY
+	 * or O_NONBLOCK flags explicitly, or until we create test cases
+	 * to determine how reads of master terminal devices opened with
+	 * these flags behave in different situations on Linux.  Supporting
+	 * these flags will involve enhancing our read implementation
+	 * and changing the way it deals with EOF notifications.
+	 */
+	if (flag & (FNDELAY | FNONBLOCK))
+		return (ENOTSUP);
+
+	/*
+	 * we're layered on top of the ptm driver so open that driver
+	 * first.  (note that we're opening /dev/ptmx in the global
+	 * zone, not ourselves in the lx zone.)
+	 */
+	err = ldi_open_by_name(LP_PTM_PATH, flag, credp, &lh, lps.lps_li);
+	if (err != 0)
+		return (err);
+
+	/* get the devt returned by the ptmx open */
+	err = ldi_get_dev(lh, &ptm_dev);
+	if (err != 0) {
+		(void) ldi_close(lh, flag, credp);
+		return (err);
+	}
+
+	/*
+	 * we're a cloning driver so here's where we'll change the devt that we
+	 * return.  the ptmx is also a cloning driver so we'll just use
+	 * it's minor number as our minor number (it already manages it's
+	 * minor name space so no reason to duplicate the effort.)
+	 */
+	index = getminor(ptm_dev);
+	*devp = makedevice(our_major, INDEX_TO_MINOR(index));
+
+	/* Get a callback function to query if the pts device is open. */
+	iocb.ic_cmd = PTMPTSOPENCB;
+	iocb.ic_timout = 0;
+	iocb.ic_len = sizeof (ppocb);
+	iocb.ic_dp = (char *)&ppocb;
+
+	err = ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, kcred, &rval);
+	if ((err != 0) || (rval != 0)) {
+		(void) ldi_close(lh, flag, credp);
+		return (EIO); /* XXX return something else here? */
+	}
+	ASSERT(ppocb.ppocb_func != NULL);
+
+	/*
+	 * now setup autopush for the terminal slave device.  this is
+	 * necessary so that when a Linux program opens the device we
+	 * can push required strmod modules onto the stream.  in Solaris
+	 * this is normally done by the application that actually
+	 * allocates the terminal.
+	 */
+	maj = lps.lps_pts_major;
+	min = index;
+	lastmin = 0;
+	err = kstr_autopush(SET_AUTOPUSH, &maj, &min, &lastmin,
+	    &anchor, lx_pts_mods);
+	if (err != 0 && err != EEXIST) {
+		(void) ldi_close(lh, flag, credp);
+		return (EIO); /* XXX return something else here? */
+	}
+
+	/* save off this layered handle for future accesses */
+	lx_ptm_lh_insert(index, lh);
+	lx_ptm_lh_set_ppocb(index, &ppocb);
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+lx_ptm_close(dev_t dev, int flag, int otyp, cred_t *credp)
+{
+	ldi_handle_t	lh;
+	major_t		maj;
+	minor_t		min, lastmin;
+	uint_t		index;
+	int		err;
+	int		i;
+
+	index = DEVT_TO_INDEX(dev);
+
+	/*
+	 * we must cleanup all the state associated with this major/minor
+	 * terminal pair before actually closing the ptm master device.
+	 * this is required because once the close of the ptm device is
+	 * complete major/minor terminal pair is immediatly available for
+	 * re-use in any zone.
+	 */
+
+	/* free up our saved reference for this layered handle */
+	lh = lx_ptm_lh_remove(index);
+
+	/* unconfigure autopush for the associated terminal slave device */
+	maj = lps.lps_pts_major;
+	min = index;
+	lastmin = 0;
+	for (i = 0; i < 5; i++) {
+		/*
+		 * we loop here because we don't want to release this ptm
+		 * node if autopush can't be disabled on the associated
+		 * slave device because then bad things could happen if
+		 * another brand were to get this terminal allocated
+		 * to them. If we keep failing we eventually drive on so that
+		 * things don't hang.
+		 */
+		err = kstr_autopush(CLR_AUTOPUSH, &maj, &min, &lastmin,
+		    0, NULL);
+		if (err == 0)
+			break;
+
+		cmn_err(CE_WARN, "lx zoneid %d: error %d on kstr_autopush",
+		    getzoneid(), err);
+
+		/* wait one second and try again */
+		delay(drv_usectohz(1000000));
+	}
+
+	err = ldi_close(lh, flag, credp);
+
+	/*
+	 * note that we don't have to bother with changing the permissions
+	 * on the associated slave device here.  the reason is that no one
+	 * can actually open the device untill it's associated master
+	 * device is re-opened, which will result in the permissions on
+	 * it being reset.
+	 */
+	return (err);
+}
+
+static int
+lx_ptm_read_loop(dev_t dev, struct uio *uiop, cred_t *credp, int *loop)
+{
+	ldi_handle_t	lh = lx_ptm_lh_lookup(DEVT_TO_INDEX(dev));
+	int		err, rval;
+	struct uio	uio = *uiop;
+
+	*loop = 0;
+
+	/*
+	 * Here's another way that Linux master terminals behave differently
+	 * from Solaris master terminals.  If you do a read on a Linux
+	 * master terminal (that was opened witout NDELAY and NONBLOCK)
+	 * who's corrosponding slave terminal is currently closed and
+	 * has been opened and closed at least once, Linux return -1 and
+	 * set errno to EIO where as Solaris blocks.
+	 */
+	if (lx_ptm_lh_eofed_get(DEVT_TO_INDEX(dev))) {
+		/* Slave has been opened and closed at least once. */
+		if (lx_ptm_pts_isopen(dev) == 0) {
+			/*
+			 * Slave is closed.  Make sure that data is avaliable
+			 * before attempting a read.
+			 */
+			if ((err = lx_ptm_data_check(dev, 0, &rval)) != 0)
+				return (err);
+
+			/* If there is no data available then return. */
+			if (rval == 0)
+				return (EIO);
+		}
+	}
+
+	/* Actually do the read operation. */
+	if ((err = ldi_read(lh, uiop, credp)) != 0)
+		return (err);
+
+	/* If read returned actual data then return. */
+	if (uio.uio_resid != uiop->uio_resid)
+		return (0);
+
+	/*
+	 * This was a zero byte read (ie, an EOF).  This indicates
+	 * that the slave terinal device has been closed.  Record
+	 * the fact that the slave device has been closed and retry
+	 * the read operation.
+	 */
+	lx_ptm_lh_eofed_set(DEVT_TO_INDEX(dev));
+	*loop = 1;
+	return (0);
+}
+
+static int
+lx_ptm_read(dev_t dev, struct uio *uiop, cred_t *credp)
+{
+	int		pktio = lx_ptm_lh_pktio_get(DEVT_TO_INDEX(dev));
+	int		err, loop;
+	struct uio	uio;
+	struct iovec	iovp;
+
+	ASSERT(uiop->uio_iovcnt > 0);
+
+	/*
+	 * If packet mode has been enabled (via TIOCPKT) we need to pad
+	 * all read requests with a leading byte that indicates any
+	 * relevant control status information.
+	 */
+	if (pktio != 0) {
+		/*
+		 * We'd like to write the control information into
+		 * the current buffer but we can't yet.  We don't
+		 * want to modify userspace memory here only to have
+		 * the read operation fail later.  So instead
+		 * what we'll do here is read one character from the
+		 * beginning of the memory pointed to by the uio
+		 * structure.  This will advance the output pointer
+		 * by one.  Then when the read completes successfully
+		 * we can update the byte that we passed over.  Before
+		 * we do the read make a copy of the current uiop and
+		 * iovec structs so we can write to them later.
+		 */
+		uio = *uiop;
+		iovp = *uiop->uio_iov;
+		uio.uio_iov = &iovp;
+
+		if (uwritec(uiop) == -1)
+			return (EFAULT);
+	}
+
+	do {
+		/*
+		 * Before we actually attempt a read operation we need
+		 * to make sure there's some buffer space to actually
+		 * read in some data.  We do this because if we're in
+		 * pktio mode and the caller only requested one byte,
+		 * then we've already used up that one byte and we
+		 * don't want to pass this read request.  Doing a 0
+		 * byte read (unless there is a problem with the stream
+		 * head) always returns succcess.  Normally when a streams
+		 * read returns 0 bytes we interpret that as an EOF on
+		 * the stream (ie, the slave side has been opened and
+		 * closed) and we ignore it and re-try the read operation.
+		 * So if we pass on a 0 byte read here lx_ptm_read_loop()
+		 * will tell us to loop around and we'll end up in an
+		 * infinite loop.
+		 */
+		if (uiop->uio_resid == 0)
+			break;
+
+		/*
+		 * Serialize all reads.  We need to do this so that we can
+		 * properly emulate the behavior of master terminals on Linux.
+		 * In reality this serializaion should not pose any kind of
+		 * performance problem since it would be very strange to have
+		 * multiple threads trying to read from the same master
+		 * terminal device concurrently.
+		 */
+		if (lx_ptm_read_start(dev) != 0)
+			return (EINTR);
+
+		err = lx_ptm_read_loop(dev, uiop, credp, &loop);
+		lx_ptm_read_end(dev);
+		if (err != 0)
+			return (err);
+	} while (loop != 0);
+
+	if (pktio != 0) {
+		uint8_t		pktio_data = TIOCPKT_DATA;
+
+		/*
+		 * Note that the control status information we
+		 * pass back is faked up in the sense that we
+		 * don't actually report any events, we always
+		 * report a status of 0.
+		 */
+		if (uiomove(&pktio_data, 1, UIO_READ, &uio) != 0)
+			return (EFAULT);
+	}
+
+	return (0);
+}
+
+static int
+lx_ptm_write(dev_t dev, struct uio *uiop, cred_t *credp)
+{
+	ldi_handle_t		lh = lx_ptm_lh_lookup(DEVT_TO_INDEX(dev));
+	int		err;
+
+	err = ldi_write(lh, uiop, credp);
+
+	return (err);
+}
+
+static int
+lx_ptm_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rvalp)
+{
+	ldi_handle_t	lh = lx_ptm_lh_lookup(DEVT_TO_INDEX(dev));
+	int		err;
+
+	/*
+	 * here we need to make sure that we never allow the
+	 * I_SETSIG and I_ESETSIG ioctls to pass through.  we
+	 * do this because we can't support them.
+	 *
+	 * the native Solaris ptm device supports these ioctls because
+	 * they are streams framework ioctls and all streams devices
+	 * support them by default.  these ioctls cause the current
+	 * process to be registered with a stream and receive signals
+	 * when certain stream events occur.
+	 *
+	 * a problem arises with cleanup of these registrations
+	 * for layered drivers.
+	 *
+	 * normally the streams framework is notified whenever a
+	 * process closes any reference to a stream and it goes ahead
+	 * and cleans up these registrations.  but actual device drivers
+	 * are not notified when a process performs a close operation
+	 * unless the process is closing the last opened reference to
+	 * the device on the entire system.
+	 *
+	 * so while we could pass these ioctls on and allow processes
+	 * to register for signal delivery, we would never receive
+	 * any notification when those processes exit (or close a
+	 * stream) and we wouldn't be able to unregister them.
+	 *
+	 * luckily these operations are streams specific and Linux
+	 * doesn't support streams devices.  so it doesn't actually
+	 * seem like we need to support these ioctls.  if it turns
+	 * out that we do need to support them for some reason in
+	 * the future, the current driver model will have to be
+	 * enhanced to better support streams device layering.
+	 */
+	if ((cmd == I_SETSIG) || (cmd == I_ESETSIG))
+		return (EINVAL);
+
+	/*
+	 * here we fake up support for TIOCPKT.  Linux applications expect
+	 * /etc/ptmx to support this ioctl, but on Solaris it doesn't.
+	 * (it is supported on older bsd style ptys.)  so we'll fake
+	 * up support for it here.
+	 *
+	 * the reason that this ioctl is emulated here instead of in
+	 * userland is that this ioctl affects the results returned
+	 * from read() operations.  if this ioctl was emulated in
+	 * userland the brand library would need to intercept all
+	 * read operations and check to see if pktio was enabled
+	 * for the fd being read from.  since this ioctl only needs
+	 * to be supported on the ptmx device it makes more sense
+	 * to support it here where we can easily update the results
+	 * returned for read() operations performed on ourselves.
+	 */
+	if (cmd == TIOCPKT) {
+		int	pktio;
+
+		if (ddi_copyin((void *)arg, &pktio, sizeof (pktio),
+		    mode) != DDI_SUCCESS)
+			return (EFAULT);
+
+		if (pktio == 0)
+			lx_ptm_lh_pktio_set(DEVT_TO_INDEX(dev), 0);
+		else
+			lx_ptm_lh_pktio_set(DEVT_TO_INDEX(dev), 1);
+
+		return (0);
+	}
+
+	err = ldi_ioctl(lh, cmd, arg, mode, credp, rvalp);
+
+	/*
+	 * On recent versions of Linux some apps issue the following ioctls to
+	 * the master side of the ptm before opening the slave side. Because
+	 * our streams modules (specifically ptem) aren't autopushed until the
+	 * slave side has been opened, these ioctls will fail. To alleviate the
+	 * issue we simply pretend that these ioctls have succeeded.
+	 *
+	 * We could push our own "lx_ptem" module onto the master side of the
+	 * stream in lx_ptm_open if we need better emulation, but that would
+	 * require an "lx_ptem" module which duplicates most of ptem. ptem
+	 * doesn't work properly when pushed on the master side.
+	 */
+	if (err == EINVAL && (cmd == TIOCSWINSZ || cmd == TCSETS) &&
+	    lx_ptm_pts_isopen(dev) == 0) {
+		/* slave side not open, assume we need to succeed */
+		DTRACE_PROBE1(lx_ptm_ioctl__override, int, cmd);
+		return (0);
+	}
+
+	return (err);
+}
+
+static int
+lx_ptm_poll_loop(dev_t dev, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp, int *loop)
+{
+	ldi_handle_t	lh = lx_ptm_lh_lookup(DEVT_TO_INDEX(dev));
+	short		reventsp2;
+	int		err, rval;
+
+	*loop = 0;
+
+	/*
+	 * If the slave device has been opened and closed at least
+	 * once and the slave device is currently closed, then poll
+	 * always needs to returns immediatly.
+	 */
+	if ((lx_ptm_lh_eofed_get(DEVT_TO_INDEX(dev)) != 0) &&
+	    (lx_ptm_pts_isopen(dev) == 0)) {
+		/* In this case always return POLLHUP */
+		*reventsp = POLLHUP;
+
+		/*
+		 * Check if there really is data on the stream.
+		 * If so set the correct return flags.
+		 */
+		if ((err = lx_ptm_data_check(dev, 1, &rval)) != 0) {
+			/* Something went wrong. */
+			return (err);
+		}
+		if (rval != 0)
+			*reventsp |= (events & (POLLIN | POLLRDNORM));
+
+		/*
+		 * Is the user checking for writability?  Note that for ptm
+		 * devices Linux seems to ignore the POLLWRBAND write flag.
+		 */
+		if ((events & POLLWRNORM) == 0)
+			return (0);
+
+		/*
+		 * To check if the stream is writable we have to actually
+		 * call poll, but make sure to set anyyet to 1 to prevent
+		 * the streams framework from setting up callbacks.
+		 */
+		if ((err = ldi_poll(lh, POLLWRNORM, 1, &reventsp2, NULL)) != 0)
+			return (err);
+
+		*reventsp |= (reventsp2 & POLLWRNORM);
+	} else {
+		int lockstate;
+
+		/* The slave device is open, do the poll */
+		if ((err = ldi_poll(lh, events, anyyet, reventsp, phpp)) != 0)
+			return (err);
+
+		/*
+		 * Drop any leading EOFs on the stream.
+		 *
+		 * Note that we have to use pollunlock() here to avoid
+		 * recursive mutex enters in the poll framework.  The
+		 * reason is that if there is an EOF message on the stream
+		 * then the act of reading from the queue to remove the
+		 * message can cause the ptm drivers event service
+		 * routine to be invoked, and if there is no open
+		 * slave device then the ptm driver may generate
+		 * error messages and put them on the stream.  This
+		 * in turn will generate a poll event and the poll
+		 * framework will try to invoke any poll callbacks
+		 * associated with the stream.  In the process of
+		 * doing that the poll framework will try to aquire
+		 * locks that we are already holding.  So we need to
+		 * drop those locks here before we do our read.
+		 */
+		if (pollunlock(&lockstate) != 0) {
+			*reventsp = POLLNVAL;
+			return (0);
+		}
+		err = lx_ptm_eof_drop(dev, &rval);
+		pollrelock(lockstate);
+		if (err)
+			return (err);
+
+		/* If no EOF was dropped then return */
+		if (rval == 0)
+			return (0);
+
+		/*
+		 * An EOF was removed from the stream.  Retry the entire
+		 * poll operation from the top because polls on the ptm
+		 * device should behave differently now.
+		 */
+		*loop = 1;
+	}
+	return (0);
+}
+
+static int
+lx_ptm_poll(dev_t dev, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp)
+{
+	int loop, err;
+
+	do {
+		/* Serialize ourself wrt read operations. */
+		if (lx_ptm_read_start(dev) != 0)
+			return (EINTR);
+
+		err = lx_ptm_poll_loop(dev,
+		    events, anyyet, reventsp, phpp, &loop);
+		lx_ptm_read_end(dev);
+		if (err != 0)
+			return (err);
+	} while (loop != 0);
+	return (0);
+}
+
+static struct cb_ops lx_ptm_cb_ops = {
+	lx_ptm_open,		/* open */
+	lx_ptm_close,		/* close */
+	nodev,			/* strategy */
+	nodev,			/* print */
+	nodev,			/* dump */
+	lx_ptm_read,		/* read */
+	lx_ptm_write,		/* write */
+	lx_ptm_ioctl,		/* ioctl */
+	nodev,			/* devmap */
+	nodev,			/* mmap */
+	nodev,			/* segmap */
+	lx_ptm_poll,		/* chpoll */
+	ddi_prop_op,		/* prop_op */
+	NULL,			/* cb_str */
+	D_NEW | D_MP,
+	CB_REV,
+	NULL,
+	NULL
+};
+
+static struct dev_ops lx_ptm_ops = {
+	DEVO_REV,
+	0,
+	ddi_getinfo_1to1,
+	nulldev,
+	nulldev,
+	lx_ptm_attach,
+	lx_ptm_detach,
+	nodev,
+	&lx_ptm_cb_ops,
+	NULL,
+	NULL,
+	ddi_quiesce_not_needed,		/* quiesce */
+};
+
+static struct modldrv modldrv = {
+	&mod_driverops,			/* type of module */
+	"Linux master terminal driver",	/* description of module */
+	&lx_ptm_ops			/* driver ops */
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,
+	&modldrv,
+	NULL
+};
+
+int
+_init(void)
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	return (mod_remove(&modlinkage));
+}
diff --git a/usr/src/uts/common/brand/lx/io/lx_ptm.conf b/usr/src/uts/common/brand/lx/io/lx_ptm.conf
new file mode 100644
index 0000000000..481b4e3c74
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/io/lx_ptm.conf
@@ -0,0 +1,27 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#ident	"%Z%%M%	%I%	%E% SMI"
+
+name="lx_ptm" parent="pseudo" instance=0;
diff --git a/usr/src/uts/common/brand/lx/os/lx_acct.c b/usr/src/uts/common/brand/lx/os/lx_acct.c
new file mode 100644
index 0000000000..7f38a240ab
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_acct.c
@@ -0,0 +1,198 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/acct.h>
+#include <sys/proc.h>
+#include <sys/user.h>
+#include <sys/cred.h>
+#include <sys/file.h>
+#include <sys/vnode.h>
+#include <sys/session.h>
+#include <sys/wait.h>
+#include <sys/ddi.h>
+#include <sys/zone.h>
+#include <sys/lx_types.h>
+
+/*
+ * Based on the Linux acct(5) man page, their comp_t definition is the same
+ * as ours. lxac_etime is encoded as a float for v3 accounting records.
+ */
+
+#define	LX_ACCT_VERSION	3
+
+/*
+ * Bit flags in lxac_flag. The Linux AFORK and ASU match native. The rest of
+ * the flags diverge.
+ */
+#define	LX_AFORK	0x01	/* executed fork, but no exec */
+#define	LX_ASU		0x02	/* used superuser privileges */
+#define	LX_ACORE	0x08	/* dumped core */
+#define	LX_AXSIG	0x10	/* killed by a signal */
+
+typedef struct lx_acct {
+	char		lxac_flag;
+	char		lxac_version;
+	uint16_t	lxac_tty;
+	uint32_t	lxac_exitcode;
+	uint32_t	lxac_uid;
+	uint32_t	lxac_gid;
+	uint32_t	lxac_pid;
+	uint32_t	lxac_ppid;
+	uint32_t	lxac_btime;	/* seconds since the epoch */
+	uint32_t	lxac_etime;	/* float representation of ticks */
+	comp_t		lxac_utime;
+	comp_t		lxac_stime;
+	comp_t		lxac_mem;	/* kb */
+	comp_t		lxac_io;	/* unused */
+	comp_t		lxac_rw;	/* unused */
+	comp_t		lxac_minflt;
+	comp_t		lxac_majflt;
+	comp_t		lxac_swaps;	/* unused */
+	char		lxac_comm[16];
+} lx_acct_t;
+
+/*
+ * Same functionality as acct_compress(). Produce a pseudo-floating point
+ * representation with 3 bits base-8 exponent, 13 bits fraction.
+ */
+static comp_t
+lx_acct_compt(ulong_t t)
+{
+	int exp = 0, round = 0;
+
+	while (t >= 8192) {
+		exp++;
+		round = t & 04;
+		t >>= 3;
+	}
+	if (round) {
+		t++;
+		if (t >= 8192) {
+			t >>= 3;
+			exp++;
+		}
+	}
+#ifdef _LP64
+	if (exp > 7) {
+		/* prevent wraparound */
+		t = 8191;
+		exp = 7;
+	}
+#endif
+	return ((exp << 13) + t);
+}
+
+/*
+ * 32-bit IEEE float encoding as-per Linux.
+ */
+static uint32_t
+lx_acct_float(int64_t t)
+{
+	uint32_t val, exp = 190;
+
+	if (t == 0)
+		return (0);
+
+	while (t > 0) {
+		t <<= 1;
+		exp--;
+	}
+	val = (uint32_t)(t >> 40) & 0x7fffffu;
+
+	return (val | (exp << 23));
+}
+
+/*
+ * Write a Linux-formatted record to the accounting file.
+ */
+void
+lx_acct_out(vnode_t *vp, int exit_status)
+{
+	struct proc *p;
+	user_t *ua;
+	struct cred *cr;
+	dev_t d;
+	pid_t pid, ppid;
+	struct vattr va;
+	ssize_t resid = 0;
+	int err;
+	lx_acct_t a;
+
+	p = curproc;
+	ua = PTOU(p);
+	cr = CRED();
+
+	bzero(&a, sizeof (a));
+
+	a.lxac_flag = ua->u_acflag & (LX_AFORK | LX_ASU);
+	a.lxac_version = LX_ACCT_VERSION;
+	d = cttydev(p);
+	a.lxac_tty = LX_MAKEDEVICE(getmajor(d), getminor(d));
+	if (WIFEXITED(exit_status)) {
+		a.lxac_exitcode = WEXITSTATUS(exit_status);
+	} else if (WIFSIGNALED(exit_status)) {
+		a.lxac_flag |= LX_AXSIG;
+		if (WCOREDUMP(exit_status)) {
+			a.lxac_flag |= LX_ACORE;
+		}
+	}
+	a.lxac_uid = crgetruid(cr);
+	a.lxac_gid = crgetrgid(cr);
+	pid = p->p_pid;
+	ppid = p->p_ppid;
+	/* Perform pid translation ala lxpr_fixpid(). */
+	if (pid == curzone->zone_proc_initpid) {
+		pid = 1;
+		ppid = 0;
+	} else {
+		if (ppid == curzone->zone_proc_initpid) {
+			ppid = 1;
+		} else if (ppid == curzone->zone_zsched->p_pid ||
+		    (p->p_flag & SZONETOP) != 0) {
+			ppid = 1;
+		}
+	}
+	a.lxac_pid = pid;
+	a.lxac_ppid = ppid;
+	a.lxac_btime = ua->u_start.tv_sec;
+	/* For Linux v3 accounting record, this is an encoded float. */
+	a.lxac_etime = lx_acct_float(ddi_get_lbolt() - ua->u_ticks);
+	a.lxac_utime = lx_acct_compt(NSEC_TO_TICK(p->p_acct[LMS_USER]));
+	a.lxac_stime = lx_acct_compt(
+	    NSEC_TO_TICK(p->p_acct[LMS_SYSTEM] + p->p_acct[LMS_TRAP]));
+	a.lxac_mem = lx_acct_compt((ulong_t)(ptob(ua->u_mem) / 1024));
+	/* a.lxac_io		unused */
+	/* a.lxac_rw		unused */
+	a.lxac_minflt = lx_acct_compt((ulong_t)p->p_ru.minflt);
+	a.lxac_majflt = lx_acct_compt((ulong_t)p->p_ru.majflt);
+	/* a.lxac_swaps		unused */
+	bcopy(ua->u_comm, a.lxac_comm, sizeof (a.lxac_comm));
+
+	/*
+	 * As with the native acct() handling, we save the size so that if the
+	 * write fails, we can reset the size to avoid corrupting the accounting
+	 * file.
+	 */
+	va.va_mask = AT_SIZE;
+	if (VOP_GETATTR(vp, &va, 0, kcred, NULL) == 0) {
+		err = vn_rdwr(UIO_WRITE, vp, (caddr_t)&a, sizeof (a), 0LL,
+		    UIO_SYSSPACE, FAPPEND, (rlim64_t)MAXOFF_T, kcred, &resid);
+		if (err != 0 || resid != 0)
+			(void) VOP_SETATTR(vp, &va, 0, kcred, NULL);
+	}
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_acl.c b/usr/src/uts/common/brand/lx/os/lx_acl.c
new file mode 100644
index 0000000000..594671f401
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_acl.c
@@ -0,0 +1,210 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/sysmacros.h>
+#include <sys/errno.h>
+#include <sys/cred.h>
+#include <sys/sunddi.h>
+#include <sys/pathname.h>
+#include <sys/acl.h>
+#include <acl/acl_common.h>
+#include <sys/lx_acl.h>
+
+
+typedef struct {
+	uint16_t lpaxe_tag;
+	uint16_t lpaxe_perm;
+	uint32_t lpaxe_id;
+} lx_posix_acl_xattr_entry_t;
+
+typedef struct {
+	uint32_t			lpaxh_version;
+	lx_posix_acl_xattr_entry_t	lpaxh_entries[];
+} lx_posix_acl_xattr_header_t;
+
+#define	LX_POSIX_ACL_XATTR_VERSION	0x0002
+
+/* e_tag entry in struct posix_acl_entry */
+#define	LX_ACL_USER_OBJ		0x01	/* USER_OBJ	*/
+#define	LX_ACL_USER		0x02	/* USER		*/
+#define	LX_ACL_GROUP_OBJ	0x04	/* GROUP_OBJ	*/
+#define	LX_ACL_GROUP		0x08	/* GROUP	*/
+#define	LX_ACL_MASK		0x10	/* CLASS_OBJ	*/
+#define	LX_ACL_OTHER		0x20	/* OTHER_OBJ	*/
+
+
+static int
+lx_acl_from_xattr(enum lx_acl_type atype, void *xattr, uint_t xlen,
+    acl_t **aclpp)
+{
+	lx_posix_acl_xattr_header_t *head = xattr;
+	lx_posix_acl_xattr_entry_t *entry;
+	int err = 0;
+	uint_t count, sz = xlen;
+	const uint_t mask = (atype == LX_ACL_DEFAULT) ? ACL_DEFAULT : 0;
+	acl_t *acl;
+	aclent_t *acle;
+
+	if (xattr == NULL) {
+		/* Handle zero-length set operations */
+		acl = acl_alloc(ACLENT_T);
+		*aclpp = acl;
+		return (0);
+	}
+
+	if (xlen < sizeof (*head)) {
+		return (EINVAL);
+	} else if (head->lpaxh_version != LX_POSIX_ACL_XATTR_VERSION) {
+		return (EOPNOTSUPP);
+	}
+
+	sz -= sizeof (lx_posix_acl_xattr_header_t);
+	if (sz % sizeof (lx_posix_acl_xattr_entry_t) != 0) {
+		return (EINVAL);
+	}
+	count = sz / sizeof (lx_posix_acl_xattr_entry_t);
+
+	acl = acl_alloc(ACLENT_T);
+	if (count == 0) {
+		*aclpp = acl;
+		return (0);
+	}
+
+	acle = kmem_alloc(count * sizeof (aclent_t), KM_SLEEP);
+	acl->acl_cnt = count;
+	acl->acl_aclp = acle;
+	entry = head->lpaxh_entries;
+	for (uint_t i = 0; i < count && err == 0; i++, entry++, acle++) {
+		switch (entry->lpaxe_tag) {
+		case LX_ACL_USER_OBJ:
+		case LX_ACL_GROUP_OBJ:
+		case LX_ACL_OTHER:
+		case LX_ACL_MASK:
+			break;
+		case LX_ACL_USER:
+		case LX_ACL_GROUP:
+			if (entry->lpaxe_id > MAXUID) {
+				err = EINVAL;
+			}
+			break;
+		default:
+			err = EINVAL;
+			break;
+		}
+		acle->a_id = entry->lpaxe_id | mask;
+		acle->a_type = entry->lpaxe_tag;
+		acle->a_perm = entry->lpaxe_perm;
+	}
+	if (err != 0) {
+		acl_free(acl);
+		return (err);
+	}
+
+	*aclpp = acl;
+	return (0);
+}
+
+/* ARGSUSED */
+int
+lx_acl_setxattr(vnode_t *vp, enum lx_acl_type atype, void *data, size_t len)
+{
+	const boolean_t is_dir = (vp->v_type == VDIR);
+	acl_t *acl = NULL;
+	cred_t *cr = CRED();
+	int err;
+
+	if (vp->v_type == VLNK) {
+		return (ENOTSUP);
+	} else if (atype == LX_ACL_DEFAULT && !is_dir) {
+		return (EACCES);
+	}
+
+	/*
+	 * Copyin and verify the input, even through there is little to be done
+	 * with the result.
+	 */
+	if ((err = lx_acl_from_xattr(atype, data, len, &acl)) != 0) {
+		return (err);
+	}
+
+	/*
+	 * Because systemd has decided to scope-creep its way into a position
+	 * of moribund domination over all things system software, there exist
+	 * work-arounds which are required to address its numerous bugs and
+	 * shortcomings.  One such case involves the FreeIPA installer needing
+	 * to perform setfacl(3) on /run/systemd/ask-password.
+	 *
+	 * Between the fact that meaningful ACL translation can be challenging
+	 * and that the path in question resides on tmpfs (which doesn't yet
+	 * support ACLs at all on illumos), faked success is the only palatable
+	 * course of action for now.  Atonement will follow.
+	 *
+	 * See also: https://bugzilla.redhat.com/show_bug.cgi?id=1322167
+	 */
+	err = ENOTSUP;
+	if (crgetuid(cr) == 0) {
+		char *path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
+
+		if (vnodetopath(NULL, vp, path, MAXPATHLEN, cr) == 0 &&
+		    strncmp(path, "/run/systemd/", 13) == 0) {
+			/* Saccharin-sweet fake success */
+			err = 0;
+		}
+		kmem_free(path, MAXPATHLEN);
+	}
+	acl_free(acl);
+
+	return (err);
+}
+
+/* ARGSUSED */
+int
+lx_acl_getxattr(vnode_t *vp, enum lx_acl_type atype, void *data, size_t slen,
+    ssize_t *solen)
+{
+	const boolean_t is_dir = (vp->v_type == VDIR);
+	vsecattr_t vsattr;
+	int err;
+
+	if (vp->v_type == VLNK) {
+		return (ENOTSUP);
+	} else if (atype == LX_ACL_DEFAULT && !is_dir) {
+		return (ENODATA);
+	}
+
+	bzero(&vsattr, sizeof (vsattr));
+	vsattr.vsa_mask = VSA_ACECNT;
+	if ((err = VOP_GETSECATTR(vp, &vsattr, 0, CRED(), NULL)) != 0) {
+		err = (err == ENOENT) ? ENODATA : err;
+		return (err);
+	}
+
+	return (ENODATA);
+}
+
+/* ARGSUSED */
+int
+lx_acl_removexattr(vnode_t *vp, enum lx_acl_type atype)
+{
+	return (ENODATA);
+}
+
+/* ARGSUSED */
+int
+lx_acl_listxattr(vnode_t *vp, uio_t *uio)
+{
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_audit.c b/usr/src/uts/common/brand/lx/os/lx_audit.c
new file mode 100644
index 0000000000..65b8d35e41
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_audit.c
@@ -0,0 +1,1598 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * The Linux auditing system provides a fairly complex rule-based syntax
+ * for configuring what actions are to be audited. The user-level details
+ * are generally described in the Linux audit.rules(7), auditctl(8), and
+ * auditd(8) man pages. The user/kernel netlink API does not seem to be
+ * documented. The Linux kernel source and the user-level auditd source must
+ * be used to understand the interface we have to emulate. The relevant Linux
+ * source files are:
+ *   include/uapi/linux/audit.h
+ *   include/linux/audit.h
+ *   kernel/audit.c
+ *
+ * The lx_netlink module implements the API used for getting or changing the
+ * audit configuration. For rule-oriented operations (list, append, delete),
+ * an lx_audit_rule_t structure (or sequence when listing) is passed in/out of
+ * the kernel. The netlink code calls into the lx_audit_append_rule or
+ * lx_audit_delete_rule functions here to perform the relevant operation.
+ * Within the lx_audit_rule_t structure, each member has the following
+ * meaning:
+ * lxar_flag:	corresponds to user-level list (e.g. "exit" for syscall return)
+ * lxar_action:	user-level action (e.g. "always")
+ * lxar_fld_cnt: number of fields specified in lxar_fields, lxar_values, and
+ *		lxar_flg_flag arrays
+ * lxar_mask:	syscall number bitmask the rule applies to (bit position in
+ *		the array corresponds to the syscall number)
+ * laxr_fields:	array of fields in the rule (i.e. each -F on user-level rule).
+ *		A numeric code (e.g. LX_RF_AUDIT_ARCH) is assigned to each
+ *		possible field.
+ * lxar_values:	array of numeric field values (e.g. the internal b64 value on
+ *		the -F AUDIT_ARCH=b64 rule)
+ * lxar_fld_flag: array of field operators (e.g. the '=' operator on the
+ *		-F AUDIT_ARCH=b64 rule)
+ * lxar_buflen:	length of the buffer data immediately following
+ * lxar_buf:	A variable amount of additional field string data. Non-numeric
+ *		field values are passed here. For example, the string associated
+ *		with the '-F key=...' or -F path=...' rules. For string values,
+ *		the corresponding lxar_values entry is the length of the string.
+ *		The strings in lxar_buf are not C strings because they are not
+ *		NULL terminated. The character data is pulled out of lxar_buf
+ *		in chunks specified by the value and the pointer into the buf
+ *		is advanced accordingly.
+ *
+ * There are two primary kinds of actions which we are currently interested in
+ * auditing;
+ * 1) system call return
+ *    this corresponds to user-level "exit" rule actions
+ * 2) file system related actions
+ *    this corresponds to user-level file system watch rules (-w)
+ *
+ * Only system call return is currently implemented, and only a very limited
+ * subset of all of the possible rule selection behavior.
+ *
+ * The Linux audit rule syntax defines that all selection criteria within a
+ * rule is ANDed together before an audit record is created. However, multiple
+ * rules can be defined for a specific syscall. For example, this user-level
+ * syntax defines two different rules for the "open" syscall:
+ *     -a always,exit -F arch=b64 -S open -F auid>=1000 -F key=user-open
+ *     -a always,exit -F arch=b64 -S open -F auid=0 -F key=priv-open
+ * The first rule would cause an audit record to be created when an "open"
+ * syscall returns and the syscall was performed by a process with a
+ * loginuid >= 1000. The key added to that audit record would be "user-open".
+ * The second rule would create an audit record if the loginuid was 0 and the
+ * record's key would be "priv-open".
+ *
+ * When auditing is enabled for a syscall return, we have to look at multiple
+ * rules and create an audit record for each rule that matches the selection
+ * criteria.
+ *
+ * Although the current implementation is limited, the overall structure is
+ * designed to be enhanced as more auditing support is added over time.
+ *
+ * By default, auditing is not enabled for a zone and no internal audit data
+ * exists. When the first netlink audit msg is received, the zone's audit state
+ * (lx_audit_state_t) is allocated (via lx_audit_init) and attached to the
+ * zone's lx brand-specific data (lxzd_audit_state). Once allocated, the audit
+ * data will persist until the zone halts.
+ *
+ * Audit records are enqueued onto the lxast_ev_queue and a worker thread
+ * (lx_audit_worker) is responsible for dequeueing the audit records and
+ * sending them up to the user-level auditd.
+ *
+ * Audit rules are stored in the lxast_rules list. This is an internal list
+ * consisting of elements of type lx_audit_rule_ent_t. Each element contains
+ * the input rule (lxare_rule) along with some additional data parsed out of
+ * the rule when it is appended (currently only the arch and key).
+ *
+ * When auditing is enabled for a syscall, the appropriate entry in the
+ * lxast_sys64_rulep (or lxast_sys32_rulep) array will point to the first
+ * rule that is applicable to the syscall. When that syscall returns, rule
+ * matching proceeds from that rule to the end of the rule list.
+ *
+ * New rules are always appended at the end of the list and Linux expects that
+ * rules are matched in order.
+ *
+ * If the rule list ever gets large enough that a linear search, anchored off
+ * the syscall pointer, becomes a performance bottleneck, then we'll have to
+ * explore alternate implementations. However, use of auditing is not that
+ * common to begin with, and most syscalls are typically not audited, so as
+ * long as the number of rules is in the order of tens, then the current
+ * implementation should be fine.
+ *
+ * When a rule is deleted, all associated syscall entries (lxast_sys64_rulep or
+ * lxast_sys32_rulep) are cleared, then the rule list is searched to see if
+ * there are any remaining rules which are applicable to the syscall(s). If so,
+ * pointers are reestablished in the relevant lxast_sys64_rulep (or 32) array.
+ */
+
+#include <sys/types.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/proc.h>
+#include <sys/ddi.h>
+#include <sys/zone.h>
+#include <sys/strsubr.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/sunddi.h>
+#include <sys/strsun.h>
+#include <sys/tihdr.h>
+#include <sys/sockio.h>
+#include <sys/brand.h>
+#include <sys/debug.h>
+#include <sys/ucred.h>
+#include <sys/session.h>
+#include <sys/lx_types.h>
+#include <sys/lx_audit.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_socket.h>
+#include <sys/bitmap.h>
+#include <sockcommon.h>
+
+#define	LX_AUDIT_FEATURE_VERSION	1
+
+/*
+ * Audit status mask values (lxas_mask in structure defined below)
+ * See Linux include/uapi/linux/audit.h
+ */
+#define	LX_AUDIT_STATUS_ENABLED			0x001
+#define	LX_AUDIT_STATUS_FAILURE			0x002
+#define	LX_AUDIT_STATUS_PID			0x004
+#define	LX_AUDIT_STATUS_RATE_LIMIT		0x008
+#define	LX_AUDIT_STATUS_BACKLOG_LIMIT		0x010
+#define	LX_AUDIT_STATUS_BACKLOG_WAIT_TIME	0x020
+#define	LX_AUDIT_STATUS_LOST			0x040
+
+/*
+ * Audit features
+ * See Linux include/uapi/linux/audit.h
+ */
+#define	LX_AUDIT_F_BACKLOG_LIMIT	0x001
+#define	LX_AUDIT_F_BACKLOG_WAIT_TIME	0x002
+#define	LX_AUDIT_F_EXECUTABLE_PATH	0x004
+#define	LX_AUDIT_F_EXCLUDE_EXTEND	0x008
+#define	LX_AUDIT_F_SESSIONID_FILTER	0x010
+#define	LX_AUDIT_F_LOST_RESET		0x020
+#define	LX_AUDIT_F_FILTER_FS		0x040
+
+#define	LX_AUDIT_FEATURE_ALL	(LX_AUDIT_F_BACKLOG_LIMIT | \
+	LX_AUDIT_F_BACKLOG_WAIT_TIME | LX_AUDIT_F_EXECUTABLE_PATH | \
+	LX_AUDIT_F_EXCLUDE_EXTEND | LX_AUDIT_F_SESSIONID_FILTER | \
+	LX_AUDIT_F_LOST_RESET | LX_AUDIT_F_FILTER_FS)
+
+
+/* Audit events */
+#define	LX_AUDIT_SYSCALL	1300	/* syscall */
+#define	LX_AUDIT_PATH		1302	/* file path */
+#define	LX_AUDIT_CONFIG_CHANGE	1305	/* configuration change */
+#define	LX_AUDIT_CWD		1307	/* current working directory */
+#define	LX_AUDIT_EXECVE		1309	/* exec args */
+#define	LX_AUDIT_EOE		1320	/* end of multi-record event */
+
+#define	LX_AUDIT_BITMASK_SIZE		64
+#define	LX_AUDIT_MAX_KEY_LEN		256
+
+/* Audit rule filter type */
+#define	LX_AUDIT_FILTER_USER		0	/* user generated msgs */
+#define	LX_AUDIT_FILTER_TASK		1	/* task creation */
+#define	LX_AUDIT_FILTER_ENTRY		2	/* syscall entry - obsolete */
+#define	LX_AUDIT_FILTER_WATCH		3	/* fs watch */
+#define	LX_AUDIT_FILTER_EXIT		4	/* syscall return */
+#define	LX_AUDIT_FILTER_TYPE		5	/* audit log start */
+#define	LX_AUDIT_FILTER_FS		6	/* audit inode child */
+
+/* Audit rule action type */
+#define	LX_AUDIT_ACT_NEVER		0
+#define	LX_AUDIT_ACT_POSSIBLE		1
+#define	LX_AUDIT_ACT_ALWAYS		2	/* the common case */
+
+#define	LX_AUDIT_RULE_MAX_FIELDS	64
+
+/* Linux defaults */
+#define	LX_AUDIT_DEF_BACKLOG_LIMIT	64
+#define	LX_AUDIT_DEF_WAIT_TIME		(60 * HZ_TO_LX_USERHZ(hz))
+
+/*
+ * Audit rule field types
+ * Linux defines a lot of Rule Field values in include/uapi/linux/audit.h.
+ * We currently only handle a few.
+ */
+#define	LX_RF_AUDIT_LOGINUID	9	/* e.g. auid>=1000 */
+#define	LX_RF_AUDIT_ARCH	11	/* e.g.	-F arch=b64 */
+#define	LX_RF_AUDIT_WATCH	105	/* user-level -w rule */
+#define	LX_RF_AUDIT_PERM	106	/* user-level -p option */
+#define	LX_RF_AUDIT_FILTERKEY	210	/* user-level -k key option */
+
+/*
+ * Audit rule field operators
+ * Linux defines the operator values in include/uapi/linux/audit.h.
+ * These 4 bits are combined in various ways for additional operators.
+ */
+#define	LX_OF_AUDIT_BM	0x08000000			/* bit mask (&) */
+#define	LX_OF_AUDIT_LT	0x10000000
+#define	LX_OF_AUDIT_GT	0x20000000
+#define	LX_OF_AUDIT_EQ	0x40000000
+#define	LX_OF_AUDIT_NE	(LX_OF_AUDIT_LT | LX_OF_AUDIT_GT)
+#define	LX_OF_AUDIT_BT	(LX_OF_AUDIT_BM | LX_OF_AUDIT_EQ) /* bit test (&=) */
+#define	LX_OF_AUDIT_LE	(LX_OF_AUDIT_LT | LX_OF_AUDIT_EQ)
+#define	LX_OF_AUDIT_GE	(LX_OF_AUDIT_GT | LX_OF_AUDIT_EQ)
+#define	LX_OF_AUDIT_ALL	(LX_OF_AUDIT_EQ | LX_OF_AUDIT_NE | LX_OF_AUDIT_BM)
+
+/*
+ * Audit rule arch specification
+ * See Linux EM_X86_64 and EM_386 defs.
+ * -F arch=b64 looks like: 0xc000003e
+ * -F arch=b32 looks like: 0x40000003
+ * If no arch is specified (possible with '-S syslog', '-S all', or '-w <file>')
+ * the rule applies to both architectures and LX_RF_AUDIT_ARCH is not passed.
+ */
+#define	LX_AUDIT_ARCH64		0xc000003e
+#define	LX_AUDIT_ARCH32		0x40000003
+
+/*
+ * See Linux include/uapi/linux/audit.h, AUDIT_MESSAGE_TEXT_MAX is 8560.
+ * The auditd src has MAX_AUDIT_MESSAGE_LENGTH as 8970.
+ * Until necessary, we'll limit ourselves to a smaller length.
+ */
+#define	LX_AUDIT_MESSAGE_TEXT_MAX	1024
+
+typedef struct lx_audit_features {
+	uint32_t	lxaf_version;
+	uint32_t	lxaf_mask;
+	uint32_t	lxaf_features;
+	uint32_t	lxaf_lock;
+} lx_audit_features_t;
+
+typedef struct lx_audit_status {
+	uint32_t	lxas_mask;
+	uint32_t	lxas_enabled;
+	uint32_t	lxas_failure;
+	uint32_t	lxas_pid;
+	uint32_t	lxas_rate_limit;
+	uint32_t	lxas_backlog_limit;
+	uint32_t	lxas_lost;
+	uint32_t	lxas_backlog;
+	/* LINTED: E_ANONYMOUS_UNION_DECL */
+	union {
+		uint32_t	lxas_version;
+		uint32_t	lxas_feature_bitmap;
+	};
+	uint32_t	lxas_backlog_wait_time;
+} lx_audit_status_t;
+
+typedef struct lx_audit_rule {
+	uint32_t	lxar_flag;
+	uint32_t	lxar_action;
+	uint32_t	lxar_fld_cnt;
+	uint32_t	lxar_mask[LX_AUDIT_BITMASK_SIZE];
+	uint32_t	lxar_fields[LX_AUDIT_RULE_MAX_FIELDS];
+	uint32_t	lxar_values[LX_AUDIT_RULE_MAX_FIELDS];
+	uint32_t	lxar_fld_flag[LX_AUDIT_RULE_MAX_FIELDS];
+	uint32_t	lxar_buflen;
+	/* LINTED: E_ZERO_OR_NEGATIVE_SUBSCRIPT */
+	char		lxar_buf[0];
+} lx_audit_rule_t;
+
+/*
+ * Internal structure for an audit rule.
+ * Each rule is on the zone's top-level list of all rules (lxast_rules).
+ * This structure also holds the parsed character string fields from the
+ * original input rule (lxar_buf) so that we don't need to re-parse that
+ * data on every match.
+ */
+typedef struct lx_audit_rule_ent {
+	list_node_t	lxare_link;
+	lx_audit_rule_t lxare_rule;
+	char		*lxare_buf;
+	boolean_t	lxare_is32bit;
+	boolean_t	lxare_is64bit;
+	char		*lxare_key;
+} lx_audit_rule_ent_t;
+
+typedef enum lx_audit_fail {
+	LXAE_SILENT,
+	LXAE_PRINT,	/* default */
+	LXAE_PANIC	/* reboot the zone */
+} lx_audit_fail_t;
+
+typedef struct lx_audit_record {
+	list_node_t	lxar_link;
+	uint32_t	lxar_type;
+	char		*lxar_msg;
+} lx_audit_record_t;
+
+/*
+ * Per-zone audit state
+ * Lazy allocated when first needed.
+ *
+ * lxast_rate_limit
+ *    Currently unused, but can be get/set. Linux default is 0.
+ * lxast_backlog_limit
+ *    The maximum number of outstanding audit events allowed (the Linux kernel
+ *    default is 64). If the limit is reached, lxast_failure determines what
+ *    to do.
+ * lxast_backlog_wait_time
+ *    Currently unused, but can be get/set. Linux default is 60HZ.
+ */
+typedef struct lx_audit_state {
+	lx_audit_fail_t	lxast_failure;		/* failure behavior */
+	uint32_t	lxast_rate_limit;
+	uint32_t	lxast_backlog_limit;
+	uint32_t	lxast_backlog_wait_time;
+	lx_audit_rule_ent_t *lxast_sys32_rulep[LX_NSYSCALLS];
+	lx_audit_rule_ent_t *lxast_sys64_rulep[LX_NSYSCALLS];
+	kcondvar_t	lxast_worker_cv;
+	kmutex_t	lxast_lock;		/* protects members below */
+	pid_t		lxast_pid;		/* auditd pid */
+	uint64_t	lxast_seq;		/* event sequence num */
+	uint32_t	lxast_backlog;		/* num of queued events */
+	uint32_t	lxast_lost;		/* num of lost events */
+	void		*lxast_sock;		/* auditd lx_netlink_sock_t */
+	boolean_t	lxast_exit;		/* taskq worker should quit */
+	boolean_t	lxast_panicing;		/* audit forcing reboot? */
+	kthread_t	*lxast_worker;
+	list_t		lxast_ev_queue;		/* audit record queue */
+	list_t		lxast_rules;		/* the list of rules */
+} lx_audit_state_t;
+
+/*
+ * Function pointer to netlink function used by audit worker threads to send
+ * audit messages up to the user-level auditd.
+ */
+static int (*lx_audit_emit_msg)(void *, uint_t, const char *, uint_t);
+static kmutex_t	lx_audit_em_lock;		/* protects emit_msg above */
+
+/* From uts/common/brand/lx/syscall/lx_socket.c */
+extern long lx_socket(int, int, int);
+/* From uts/common/syscall/close.c */
+extern int close(int);
+
+static int
+lx_audit_emit_syscall_event(uint_t mtype, void *lxsock, const char *msg)
+{
+	int err;
+
+	err = lx_audit_emit_msg(lxsock, mtype, msg, LX_AUDIT_MESSAGE_TEXT_MAX);
+	if (err != 0)
+		return (err);
+	err = lx_audit_emit_msg(lxsock, 0, NULL, 0);
+	return (err);
+}
+
+/*
+ * Worker thread for audit record output up to user-level auditd.
+ */
+static void
+lx_audit_worker(void *a)
+{
+	lx_audit_state_t *asp = (lx_audit_state_t *)a;
+	lx_audit_record_t *rp;
+	int err;
+
+	VERIFY(asp != NULL);
+
+	mutex_enter(&asp->lxast_lock);
+
+	while (!asp->lxast_exit) {
+
+		if (asp->lxast_backlog == 0 || asp->lxast_sock == NULL ||
+		    asp->lxast_pid == 0) {
+			cv_wait(&asp->lxast_worker_cv, &asp->lxast_lock);
+			continue;
+		}
+
+		rp = list_remove_head(&asp->lxast_ev_queue);
+		asp->lxast_backlog--;
+
+		err = lx_audit_emit_syscall_event(rp->lxar_type,
+		    asp->lxast_sock, rp->lxar_msg);
+		if (err != ENOMEM && err != ENOSPC) {
+			kmem_free(rp->lxar_msg, LX_AUDIT_MESSAGE_TEXT_MAX);
+			kmem_free(rp, sizeof (lx_audit_record_t));
+		} else {
+			/*
+			 * Put it back on the list, drop the mutex so that
+			 * any other audit-related action could occur (such as
+			 * socket deletion), then wait briefly before retry.
+			 */
+			list_insert_head(&asp->lxast_ev_queue, rp);
+			asp->lxast_backlog++;
+			mutex_exit(&asp->lxast_lock);
+			/* wait 1/10th second and try again */
+			delay(drv_usectohz(100000));
+			mutex_enter(&asp->lxast_lock);
+		}
+	}
+
+	/* Leave state ready for new worker when auditing restarted */
+	asp->lxast_exit = B_FALSE;
+	mutex_exit(&asp->lxast_lock);
+
+	thread_exit();
+}
+
+static void
+lx_audit_set_worker(uint32_t pid, void *lxsock,
+    void (*cb)(void *, boolean_t))
+{
+	lx_audit_state_t *asp = ztolxzd(curzone)->lxzd_audit_state;
+
+	ASSERT(asp != NULL);
+	ASSERT(MUTEX_HELD(&asp->lxast_lock));
+
+	/* First, stop any existing worker thread */
+	while (asp->lxast_sock != NULL) {
+		mutex_exit(&asp->lxast_lock);
+		lx_audit_stop_worker(NULL, cb);
+		mutex_enter(&asp->lxast_lock);
+		/* unlikely we loop, but handle racing setters */
+	}
+
+	VERIFY(asp->lxast_pid == 0);
+	VERIFY(asp->lxast_sock == NULL);
+	VERIFY(asp->lxast_exit == B_FALSE);
+	VERIFY(asp->lxast_worker == NULL);
+	if (pid != 0) {
+		/* Start a worker with the new socket */
+		asp->lxast_sock = lxsock;
+		cb(asp->lxast_sock, B_TRUE);
+		asp->lxast_pid = pid;
+		asp->lxast_worker = thread_create(NULL, 0, lx_audit_worker,
+		    asp, 0, curzone->zone_zsched, TS_RUN, minclsyspri);
+	}
+}
+
+static boolean_t
+lx_audit_match_val(uint32_t op, uint32_t ruleval, uint32_t curval)
+{
+	switch (op) {
+	case LX_OF_AUDIT_LT:
+		return (curval < ruleval);
+	case LX_OF_AUDIT_GT:
+		return (curval > ruleval);
+	case LX_OF_AUDIT_EQ:
+		return (curval == ruleval);
+	case LX_OF_AUDIT_NE:
+		return (curval != ruleval);
+	case LX_OF_AUDIT_LE:
+		return (curval <= ruleval);
+	case LX_OF_AUDIT_GE:
+		return (curval >= ruleval);
+	case LX_OF_AUDIT_BM:	/* bit mask - any bit is set? */
+		return ((curval & ruleval) != 0);
+	case LX_OF_AUDIT_BT:	/* bit test - all bits must be set */
+		return ((curval & ruleval) == ruleval);
+	default:
+		break;
+	}
+	return (B_FALSE);
+}
+
+/*
+ * Per the Linux audit.rules(7) man page, a rule with an auid of -1 means the
+ * process does not have a loginuid. We'll use the absence of a session on the
+ * process to mimic this behavior.
+ */
+static uint32_t
+lx_audit_get_auid()
+{
+	sess_t *s;
+	uint32_t v;
+
+	/*
+	 * A process with no session has:
+	 * s_dev == 0xffffffffffffffff
+	 * s_vp == NULL
+	 * s_cred == NULL
+	 */
+	s = curproc->p_sessp;
+	if (s != NULL && s->s_vp != NULL) {
+		v = crgetsuid(CRED());
+	} else {
+		v = UINT32_MAX;	/* emulate auid of -1 */
+	}
+
+	return (v);
+}
+
+/*
+ * Determine if the rule matches.
+ * Currently, we're actually just checking LX_RF_AUDIT_LOGINUID (-F auid)
+ * fields, but as we add support for additional field matching, this function
+ * should be enhanced.
+ */
+static boolean_t
+lx_audit_syscall_rule_match(lx_audit_rule_ent_t *erp)
+{
+	uint32_t i, v;
+	lx_audit_rule_t *rp = &erp->lxare_rule;
+
+	for (i = 0; i < rp->lxar_fld_cnt; i++) {
+		uint32_t ftype, fval, fop;
+
+		ftype = rp->lxar_fields[i];
+		if (ftype != LX_RF_AUDIT_LOGINUID)
+			continue;
+
+		fop = rp->lxar_fld_flag[i];
+		fval = rp->lxar_values[i];
+		v = lx_audit_get_auid();
+
+		if (!lx_audit_match_val(fop, fval, v))
+			return (B_FALSE);
+	}
+	return (B_TRUE);
+}
+
+static int
+lx_audit_write(file_t *fp, const char *msg)
+{
+	int fflag;
+	ssize_t count;
+	size_t nwrite = 0;
+	struct uio auio;
+	struct iovec aiov;
+
+	count = strlen(msg);
+	fflag = fp->f_flag;
+
+	aiov.iov_base = (void *) msg;
+	aiov.iov_len = count;
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = fp->f_offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_SYSSPACE;
+	auio.uio_llimit = curproc->p_fsz_ctl;
+	auio.uio_fmode = fflag;
+	auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	return (lx_write_common(fp, &auio, &nwrite, B_FALSE));
+}
+
+/*
+ * We first try to send the msg out to the zone's logging service, then
+ * fallback to the zone's console, although in practice, that is unlikely to
+ * be useful to most users.
+ */
+static void
+lx_audit_log_msg(const char *msg)
+{
+	int fd;
+	struct sockaddr_un addr;
+	struct sonode *so;
+	uint_t alen;
+	uint_t sizediff = (sizeof (addr) - sizeof (addr.sun_path));
+	file_t *fp;
+	int err;
+	vnode_t *vp;
+
+	ttolwp(curthread)->lwp_errno = 0;
+	fd = lx_socket(LX_AF_UNIX, LX_SOCK_DGRAM, 0);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		goto trycons;
+
+	bzero((char *)&addr, sizeof (addr));
+	addr.sun_family = AF_UNIX;
+	(void) strncpy(addr.sun_path, "/dev/log", sizeof (addr.sun_path) - 1);
+	alen = strlen(addr.sun_path) + 1 + sizediff;
+
+	/*
+	 * We can't use lx_connect here since that expects to be called from
+	 * user-land, so we do the (streamlined) connect ourselves.
+	 */
+	if ((so = getsonode(fd, &err, &fp)) == NULL) {
+		(void) close(fd);
+		goto trycons;
+	}
+
+	err = socket_connect(so, (struct sockaddr *)&addr, alen, fp->f_flag,
+	    _SOCONNECT_XPG4_2, CRED());
+
+	if (err == 0)
+		err = lx_audit_write(fp, msg);
+
+	releasef(fd);		/* release getsonode hold */
+	(void) close(fd);
+
+	if (err == 0)
+		return;
+
+trycons:
+	/* "open" the console device */
+	if (lookupnameatcred("/dev/console", UIO_SYSSPACE, FOLLOW, NULLVPP,
+	    &vp, NULL, CRED()) != 0)
+		return;
+
+	if (falloc(vp, FWRITE, &fp, &fd) != 0) {
+		VN_RELE(vp);
+		return;
+	}
+	mutex_exit(&fp->f_tlock);
+	setf(fd, fp);
+
+	/* nothing left to do if console write fails */
+	(void) lx_audit_write(fp, msg);
+	close(fd);
+}
+
+static void
+lx_audit_fail(lx_audit_state_t *asp, const char *msg)
+{
+	ASSERT(MUTEX_HELD(&asp->lxast_lock));
+
+	if (asp->lxast_failure == LXAE_PRINT ||
+	    asp->lxast_failure == LXAE_PANIC) {
+		/*
+		 * Linux can ratelimit the amount of log spam here, so we'll
+		 * do something similar, especially since this could be called
+		 * on many syscall returns if the audit daemon is down or
+		 * not consuming audit records for some other reason.
+		 */
+		if (asp->lxast_lost % 100 == 0)
+			lx_audit_log_msg(msg);
+		if (asp->lxast_failure == LXAE_PANIC &&
+		    !asp->lxast_panicing) {
+			/*
+			 * Reboot the zone so that no audit records are lost.
+			 * We delay a second to give the zone's logger a chance
+			 * to handle the log message. We have to drop the lock
+			 * here in case the zone's logger itself is making
+			 * syscalls which would be audited, although that
+			 * wouldn't be the ideal configuration.
+			 */
+			asp->lxast_panicing = B_TRUE;
+			mutex_exit(&asp->lxast_lock);
+			lx_audit_log_msg("audit: panic");
+			delay(drv_usectohz(1000000));
+			zone_kadmin(A_SHUTDOWN, AD_BOOT, NULL, kcred);
+			mutex_enter(&asp->lxast_lock);
+		}
+	}
+	asp->lxast_lost++;
+}
+
+/*
+ * This formats the input string into a format that matches Linux. The input
+ * strings are small right now (<= PSARGSZ) so for simpicity we're using
+ * a temporary buffer of adequate size.
+ */
+static void
+lx_audit_fmt_str(char *dst, char *str, uint_t dlen)
+{
+	char *sp, tmp[100];
+
+	(void) strlcpy(tmp, str, sizeof (tmp));
+	if ((sp = strchr(tmp, ' ')) != NULL)
+		*sp = '\0';
+
+	if ((sp = strchr(tmp, '"')) == NULL) {
+		(void) snprintf(dst, dlen, "\"%s\"", tmp);
+	} else {
+		char *p, *dp;
+		uint_t olen = 0;
+
+		ASSERT(dlen > 2);
+		dlen -= 2;	/* leave room for terminating nul */
+		dp = dst;
+		for (p = str; *p != '\0' && olen < dlen; p++) {
+			(void) sprintf(dp, "%02x", *p);
+			dp += 2;
+			olen += 2;
+		}
+		*dp = '\0';
+	}
+}
+
+/*
+ * Format and enqueue a syscall audit record.
+ */
+static void
+lx_audit_syscall_fmt_rcd(int sysnum, uint32_t arch, long ret,
+    lx_audit_state_t *asp, lx_audit_rule_ent_t *erp, uint64_t seq,
+    timestruc_t *tsp)
+{
+	klwp_t *lwp;
+	proc_t *p;
+	uint32_t items, sessid;
+	lx_lwp_data_t *lwpd;
+	lx_audit_record_t *rp;
+	cred_t *cr = CRED();
+	minor_t minor;
+	char key[LX_AUDIT_MAX_KEY_LEN + 6]; /* for key="%s" formatting */
+	char exe[PSARGSZ * 2 + 8], comm[MAXCOMLEN * 2 + 8];
+
+	ASSERT(MUTEX_HELD(&asp->lxast_lock));
+
+	if (asp->lxast_backlog >= asp->lxast_backlog_limit) {
+		lx_audit_fail(asp, "audit: backlog limit exceeded");
+		return;
+	}
+
+	if (arch == LX_AUDIT_ARCH32) {
+		items = MIN(4, lx_sysent32[sysnum].sy_narg);
+	} else {
+		ASSERT3U(arch, ==, LX_AUDIT_ARCH64);
+		items = MIN(4, lx_sysent64[sysnum].sy_narg);
+	}
+
+	lwp = ttolwp(curthread);
+	lwpd = lwptolxlwp(lwp);
+	p = curproc;
+
+	/*
+	 * For the key, if no key has been set on the rule, Linux formats the
+	 * string "(null)" (with no quotes - i.e. key=(null)).
+	 */
+	if (erp->lxare_key != NULL) {
+		(void) snprintf(key, sizeof (key), "key=\"%s\"",
+		    erp->lxare_key);
+	} else {
+		(void) snprintf(key, sizeof (key), "key=(null)");
+	}
+
+	rp = kmem_alloc(sizeof (lx_audit_record_t), KM_NOSLEEP);
+	if (rp == NULL) {
+		lx_audit_fail(asp, "audit: no kernel memory");
+		return;
+	}
+	rp->lxar_msg = kmem_zalloc(LX_AUDIT_MESSAGE_TEXT_MAX, KM_NOSLEEP);
+	if (rp->lxar_msg == NULL) {
+		kmem_free(rp, sizeof (lx_audit_record_t));
+		lx_audit_fail(asp, "audit: no kernel memory");
+		return;
+	}
+	rp->lxar_type = LX_AUDIT_SYSCALL;
+
+	mutex_enter(&p->p_splock);
+	sessid = p->p_sessp->s_sid;
+	minor = getminor(p->p_sessp->s_dev);
+	mutex_exit(&p->p_splock);
+
+	mutex_enter(&p->p_lock);
+	lx_audit_fmt_str(exe, p->p_user.u_psargs, sizeof (exe));
+	lx_audit_fmt_str(comm, p->p_user.u_comm, sizeof (comm));
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * See Linux audit_log_exit() for how a syscall exit record is
+	 * formatted.
+	 *
+	 * For "arch" value, see Linux AUDIT_ARCH_IA64, AUDIT_ARCH_I386,
+	 * __AUDIT_ARCH_64BIT and __AUDIT_ARCH_LE definitions.
+	 *
+	 * For fsuid/fsgid, see lx_setfsuid/lx_setfsgid for how we handle that.
+	 */
+	(void) snprintf(rp->lxar_msg, LX_AUDIT_MESSAGE_TEXT_MAX,
+	    "audit(%lu.%03lu:%lu): arch=%x syscall=%u "
+	    "success=%s exit=%ld a0=%lu a1=%lu a2=%lu a3=%lu items=%u "
+	    "ppid=%u pid=%u auid=%u uid=%u gid=%u euid=%u suid=%u "
+	    "fsuid=%u egid=%u sgid=%u fsgid=%u tty=pts%u ses=%u "
+	    "comm=%s exe=%s %s",
+	    (uint64_t)tsp->tv_sec,			/* zone's timestamp */
+	    (uint64_t)tsp->tv_nsec / 1000000,
+	    seq,					/* serial number */
+	    arch,					/* arch */
+	    sysnum,					/* syscall */
+	    (lwp->lwp_errno == 0 ? "yes" : "no"),	/* success */
+	    ret,					/* exit */
+	    lwpd->br_syscall_args[0],			/* a0 */
+	    lwpd->br_syscall_args[1],			/* a1 */
+	    lwpd->br_syscall_args[2],			/* a2 */
+	    lwpd->br_syscall_args[3],			/* a3 */
+	    items,					/* items */
+	    lx_lwp_ppid(lwp, NULL, NULL),		/* ppid */
+	    (lwpd->br_pid == curzone->zone_proc_initpid ? 1 : lwpd->br_pid),
+	    lx_audit_get_auid(),			/* auid */
+	    crgetruid(cr),				/* uid */
+	    crgetrgid(cr),				/* gid */
+	    crgetuid(cr),				/* euid */
+	    crgetsuid(cr),				/* saved uid */
+	    crgetuid(cr),				/* fsuid */
+	    crgetgid(cr),				/* egid */
+	    crgetsgid(cr),				/* saved gid */
+	    crgetgid(cr),				/* fsgid */
+	    minor,					/* tty */
+	    sessid,					/* ses */
+	    comm,					/* comm */
+	    exe,					/* exe */
+	    key);					/* key="VAL" */
+
+	list_insert_tail(&asp->lxast_ev_queue, rp);
+	if (asp->lxast_backlog == 0)
+		cv_signal(&asp->lxast_worker_cv);
+	asp->lxast_backlog++;
+}
+
+/*
+ * Get the next rule in the list that is generally applicable to the given
+ * syscall.
+ */
+static lx_audit_rule_ent_t *
+lx_audit_next_applicable_rule(int sysnum, uint32_t arch, lx_audit_state_t *asp,
+    lx_audit_rule_ent_t *erp)
+{
+	ASSERT(MUTEX_HELD(&asp->lxast_lock));
+
+	for (erp = list_next(&asp->lxast_rules, erp);
+	    erp != NULL;
+	    erp = list_next(&asp->lxast_rules, erp)) {
+		lx_audit_rule_t *r = &erp->lxare_rule;
+
+		/* Determine if the rule in the list has the same ARCH. */
+		if (arch == LX_AUDIT_ARCH32 && !erp->lxare_is32bit)
+			continue;
+		if (arch == LX_AUDIT_ARCH64 && !erp->lxare_is64bit)
+			continue;
+
+		/* Determine if this rule applies to the relevant syscall. */
+		if (BT_TEST32(r->lxar_mask, sysnum))
+			return (erp);
+	}
+
+	return (NULL);
+}
+
+void
+lx_audit_syscall_exit(int sysnum, long ret)
+{
+	lx_zone_data_t *lxzd = ztolxzd(curzone);
+	lx_audit_state_t *asp;
+	uint64_t seq;
+	lx_audit_rule_ent_t *erp;
+	timestruc_t ts;
+	uint32_t arch;
+
+	if (lxzd->lxzd_audit_enabled == LXAE_DISABLED)
+		return;
+
+	asp = lxzd->lxzd_audit_state;
+	ASSERT(asp != NULL);
+
+	if (get_udatamodel() == DATAMODEL_ILP32) {
+		arch = LX_AUDIT_ARCH32;
+	} else {
+		ASSERT(get_udatamodel() == DATAMODEL_LP64);
+		arch = LX_AUDIT_ARCH64;
+	}
+
+	/*
+	 * Fast top-level check to see if we're auditing this syscall.
+	 * We don't take the mutex for this since there is no need.
+	 */
+	if (arch == LX_AUDIT_ARCH32) {
+		if (asp->lxast_sys32_rulep[sysnum] == NULL)
+			return;
+	} else {
+		if (asp->lxast_sys64_rulep[sysnum] == NULL)
+			return;
+	}
+
+	mutex_enter(&asp->lxast_lock);
+	if (arch == LX_AUDIT_ARCH32) {
+		erp = asp->lxast_sys32_rulep[sysnum];
+	} else {
+		erp = asp->lxast_sys64_rulep[sysnum];
+	}
+
+	if (erp == NULL) {
+		/* Hit a race and the syscall is no longer being audited */
+		mutex_exit(&asp->lxast_lock);
+		return;
+	}
+
+	/*
+	 * All of the records in the set (i.e. same serial number) have
+	 * the same timestamp.
+	 */
+	seq = asp->lxast_seq++;
+	gethrestime(&ts);
+	ts.tv_sec -= curzone->zone_boot_time;
+
+	/*
+	 * We have to determine if the first rule associated with the syscall,
+	 * or any subsequent applicable rules, match.
+	 *
+	 * The first rule associated with the syscall may (or may not) match,
+	 * but there can be additional rules which might also match. The first
+	 * possible rule is always the one that enables the syscall auditing,
+	 * but we also have to iterate to the end of the list to see if any
+	 * other rules are applicable to this syscall.
+	 */
+	for (; erp != NULL;
+	    erp = lx_audit_next_applicable_rule(sysnum, arch, asp, erp)) {
+		if (!lx_audit_syscall_rule_match(erp))
+			continue;
+
+		lx_audit_syscall_fmt_rcd(sysnum, arch, ret, asp, erp, seq, &ts);
+	}
+
+	/*
+	 * TODO: Currently we only output a single SYSCALL record.
+	 * Real Linux emits a set of audit records for a syscall exit event
+	 * (e.g. for an unlink syscall):
+	 * type=SYSCALL
+	 * type=CWD
+	 * type=PATH - one for the parent dir
+	 * type=PATH - one for the actual file unlinked
+	 * type=PROCTITLE - (this one seems worthless)
+	 * followed by an AUDIT_EOE message (which seems to be ignored).
+	 *
+	 * For syscalls that don't change files in the file system (e.g. ioctl)
+	 * there are no PATH records.
+	 */
+	mutex_exit(&asp->lxast_lock);
+}
+
+/*
+ * Determine which syscalls this rule applies to and setup a fast pointer for
+ * the syscall to enable it's rule match.
+ *
+ * We have to look at each bit and translate the external syscall bits into the
+ * internal syscall number.
+ */
+static void
+lx_enable_syscall_rule(lx_audit_state_t *asp, lx_audit_rule_t *rulep,
+    lx_audit_rule_ent_t *rp)
+{
+	uint_t sysnum;
+
+	ASSERT(MUTEX_HELD(&asp->lxast_lock));
+
+	for (sysnum = 0; sysnum < LX_NSYSCALLS; sysnum++) {
+		if (BT_TEST32(rulep->lxar_mask, sysnum)) {
+			if (rp->lxare_is32bit) {
+				if (asp->lxast_sys32_rulep[sysnum] == NULL)
+					asp->lxast_sys32_rulep[sysnum] = rp;
+			}
+			if (rp->lxare_is64bit) {
+				if (asp->lxast_sys64_rulep[sysnum] == NULL)
+					asp->lxast_sys64_rulep[sysnum] = rp;
+			}
+		}
+	}
+}
+
+int
+lx_audit_append_rule(void *r, uint_t datalen)
+{
+	lx_audit_rule_t *rulep = (lx_audit_rule_t *)r;
+	char *datap;
+	uint_t i;
+	lx_audit_rule_ent_t *rp;
+	lx_audit_state_t *asp;
+	boolean_t is_32bit = B_TRUE, is_64bit = B_TRUE, sys_found = B_FALSE;
+	char *tdp;
+	char key[LX_AUDIT_MAX_KEY_LEN + 1];
+	uint32_t tlen;
+
+	if (ztolxzd(curproc->p_zone)->lxzd_audit_enabled == LXAE_LOCKED)
+		return (EPERM);
+
+	if (datalen < sizeof (lx_audit_rule_t))
+		return (EINVAL);
+	datalen -= sizeof (lx_audit_rule_t);
+
+	if (rulep->lxar_fld_cnt > LX_AUDIT_RULE_MAX_FIELDS)
+		return (EINVAL);
+
+	if (rulep->lxar_buflen > datalen)
+		return (EINVAL);
+
+	datap = rulep->lxar_buf;
+
+	/*
+	 * First check the rule to determine if we support the flag, actions,
+	 * and all of the fields specified (since currently, our rule support
+	 * is incomplete).
+	 *
+	 * NOTE: We currently only handle syscall exit rules.
+	 */
+	if (rulep->lxar_flag != LX_AUDIT_FILTER_EXIT ||
+	    rulep->lxar_action != LX_AUDIT_ACT_ALWAYS)
+		return (ENOTSUP);
+	if (rulep->lxar_fld_cnt > LX_AUDIT_RULE_MAX_FIELDS)
+		return (EINVAL);
+	tdp = datap;
+	tlen = rulep->lxar_buflen;
+	key[0] = '\0';
+	for (i = 0; i < rulep->lxar_fld_cnt; i++) {
+		uint32_t ftype, fval, fop;
+
+		fop = rulep->lxar_fld_flag[i];
+		ftype = rulep->lxar_fields[i];
+		fval = rulep->lxar_values[i];
+		DTRACE_PROBE3(lx__audit__field, uint32_t, fop,
+		    uint32_t, ftype, uint32_t, fval);
+
+		if (ftype == LX_RF_AUDIT_ARCH) {
+			if (fop != LX_OF_AUDIT_EQ)
+				return (ENOTSUP);
+			if (!is_32bit || !is_64bit)
+				return (EINVAL);
+			if (fval == LX_AUDIT_ARCH64) {
+				is_32bit = B_FALSE;
+			} else if (fval == LX_AUDIT_ARCH32) {
+				is_64bit = B_FALSE;
+			} else {
+				return (ENOTSUP);
+			}
+		} else if (ftype == LX_RF_AUDIT_LOGINUID) {
+			if ((fop & LX_OF_AUDIT_ALL) == 0)
+				return (ENOTSUP);
+		} else if (ftype == LX_RF_AUDIT_FILTERKEY) {
+			if (fop != LX_OF_AUDIT_EQ)
+				return (ENOTSUP);
+			if (tlen < fval || fval > LX_AUDIT_MAX_KEY_LEN)
+				return (EINVAL);
+			if (key[0] != '\0')
+				return (EINVAL);
+			/* while we're here, save the parsed key */
+			bcopy(tdp, key, fval);
+			key[fval] = '\0';
+			tdp += fval;
+			tlen -= fval;
+		} else {
+			/*
+			 * TODO: expand the support for additional Linux field
+			 * options.
+			 */
+			return (ENOTSUP);
+		}
+	}
+	for (i = 0; i < LX_NSYSCALLS; i++) {
+		if (BT_TEST32(rulep->lxar_mask, i)) {
+			/* At least one syscall enabled in this mask entry */
+			sys_found = B_TRUE;
+			break;
+		}
+	}
+	if (!sys_found)
+		return (ENOTSUP);
+
+	asp = ztolxzd(curzone)->lxzd_audit_state;
+	ASSERT(asp != NULL);
+
+	/*
+	 * We have confirmed that we can handle the rule specified.
+	 * Before taking the lock, allocate and setup the internal rule struct.
+	 */
+	rp = kmem_alloc(sizeof (lx_audit_rule_ent_t), KM_SLEEP);
+	bcopy(rulep, &rp->lxare_rule, sizeof (lx_audit_rule_t));
+	rp->lxare_buf = kmem_alloc(rulep->lxar_buflen, KM_SLEEP);
+	bcopy(datap, rp->lxare_buf, rulep->lxar_buflen);
+	rp->lxare_is32bit = is_32bit;
+	rp->lxare_is64bit = is_64bit;
+	if (key[0] == '\0') {
+		rp->lxare_key = NULL;
+	} else {
+		int slen = strlen(key);
+		rp->lxare_key = kmem_alloc(slen + 1, KM_SLEEP);
+		(void) strlcpy(rp->lxare_key, key, slen + 1);
+	}
+
+	mutex_enter(&asp->lxast_lock);
+	/* Save the rule on our top-level list. */
+	list_insert_tail(&asp->lxast_rules, rp);
+	/* Enable tracing on the relevant syscalls. */
+	lx_enable_syscall_rule(asp, rulep, rp);
+	mutex_exit(&asp->lxast_lock);
+
+	return (0);
+}
+
+int
+lx_audit_delete_rule(void *r, uint_t datalen)
+{
+	lx_audit_rule_t *rulep = (lx_audit_rule_t *)r;
+	char *datap;
+	uint_t sysnum;
+	lx_audit_state_t *asp;
+	lx_audit_rule_ent_t *erp;
+
+	if (ztolxzd(curproc->p_zone)->lxzd_audit_enabled == LXAE_LOCKED)
+		return (EPERM);
+
+	if (datalen < sizeof (lx_audit_rule_t))
+		return (EINVAL);
+	datalen -= sizeof (lx_audit_rule_t);
+
+	if (rulep->lxar_fld_cnt > LX_AUDIT_RULE_MAX_FIELDS)
+		return (EINVAL);
+
+	if (rulep->lxar_buflen > datalen)
+		return (EINVAL);
+
+	datap = rulep->lxar_buf;
+
+	asp = ztolxzd(curzone)->lxzd_audit_state;
+	ASSERT(asp != NULL);
+
+	mutex_enter(&asp->lxast_lock);
+
+	/* Find the matching rule from the rule list */
+	for (erp = list_head(&asp->lxast_rules);
+	    erp != NULL;
+	    erp = list_next(&asp->lxast_rules, erp)) {
+		lx_audit_rule_t *r;
+		uint_t i;
+		boolean_t mtch;
+
+		r = &erp->lxare_rule;
+		if (rulep->lxar_flag != r->lxar_flag)
+			continue;
+		if (rulep->lxar_action != r->lxar_action)
+			continue;
+		if (rulep->lxar_fld_cnt != r->lxar_fld_cnt)
+			continue;
+		for (i = 0, mtch = B_TRUE; i < LX_AUDIT_BITMASK_SIZE; i++) {
+			if (rulep->lxar_mask[i] != r->lxar_mask[i]) {
+				mtch = B_FALSE;
+				break;
+			}
+		}
+		if (!mtch)
+			continue;
+
+		for (i = 0, mtch = B_TRUE; i < rulep->lxar_fld_cnt; i++) {
+			if (rulep->lxar_fields[i] != r->lxar_fields[i] ||
+			    rulep->lxar_values[i] != r->lxar_values[i] ||
+			    rulep->lxar_fld_flag[i] != r->lxar_fld_flag[i]) {
+				mtch = B_FALSE;
+				break;
+			}
+		}
+		if (!mtch)
+			continue;
+		if (rulep->lxar_buflen != r->lxar_buflen)
+			continue;
+		if (bcmp(datap, erp->lxare_buf, r->lxar_buflen) == 0)
+			break;
+	}
+
+	/* There is no matching rule */
+	if (erp == NULL) {
+		mutex_exit(&asp->lxast_lock);
+		return (ENOENT);
+	}
+
+	/*
+	 * Disable each relevant syscall enabling.
+	 */
+	for (sysnum = 0; sysnum < LX_NSYSCALLS; sysnum++) {
+		if (BT_TEST32(rulep->lxar_mask, sysnum)) {
+			/*
+			 * If this was the first rule on the list for the
+			 * given syscall (likely, since usually only one rule
+			 * per syscall) then either disable tracing for that
+			 * syscall, or point to the next applicable rule in the
+			 * list.
+			 */
+			if (erp->lxare_is32bit) {
+				if (asp->lxast_sys32_rulep[sysnum] == erp) {
+					asp->lxast_sys32_rulep[sysnum] =
+					    lx_audit_next_applicable_rule(
+					    sysnum, LX_AUDIT_ARCH32, asp, erp);
+				}
+			}
+			if (erp->lxare_is64bit) {
+				if (asp->lxast_sys64_rulep[sysnum] == erp) {
+					asp->lxast_sys64_rulep[sysnum] =
+					    lx_audit_next_applicable_rule(
+					    sysnum, LX_AUDIT_ARCH64, asp, erp);
+				}
+			}
+		}
+	}
+
+	/* Remove the rule from the top-level list */
+	list_remove(&asp->lxast_rules, erp);
+
+	kmem_free(erp->lxare_buf, erp->lxare_rule.lxar_buflen);
+	if (erp->lxare_key != NULL)
+		kmem_free(erp->lxare_key, strlen(erp->lxare_key) + 1);
+	kmem_free(erp, sizeof (lx_audit_rule_ent_t));
+
+	mutex_exit(&asp->lxast_lock);
+	return (0);
+}
+
+void
+lx_audit_emit_user_msg(uint_t mtype, uint_t len, char *datap)
+{
+	lx_zone_data_t *lxzd = ztolxzd(curzone);
+	lx_audit_state_t *asp;
+	lx_audit_record_t *rp;
+	timestruc_t ts;
+	uint_t sessid;
+	proc_t *p = curproc;
+	lx_lwp_data_t *lwpd = lwptolxlwp(ttolwp(curthread));
+	uint_t prelen, alen;
+	char msg[LX_AUDIT_MESSAGE_TEXT_MAX];
+
+	/*
+	 * For user messages, auditing may not actually be initialized. If not,
+	 * just return.
+	 */
+	if (lxzd->lxzd_audit_enabled == LXAE_DISABLED ||
+	    lxzd->lxzd_audit_state == NULL)
+		return;
+
+	mutex_enter(&p->p_splock);
+	sessid = p->p_sessp->s_sid;
+	mutex_exit(&p->p_splock);
+
+	asp = lxzd->lxzd_audit_state;
+	ASSERT(asp != NULL);
+
+	mutex_enter(&asp->lxast_lock);
+
+	if (asp->lxast_backlog >= asp->lxast_backlog_limit) {
+		lx_audit_fail(asp, "audit: backlog limit exceeded");
+		mutex_exit(&asp->lxast_lock);
+		return;
+	}
+
+	rp = kmem_alloc(sizeof (lx_audit_record_t), KM_NOSLEEP);
+	if (rp == NULL) {
+		lx_audit_fail(asp, "audit: no kernel memory");
+		mutex_exit(&asp->lxast_lock);
+		return;
+	}
+	rp->lxar_msg = kmem_zalloc(LX_AUDIT_MESSAGE_TEXT_MAX, KM_NOSLEEP);
+	if (rp->lxar_msg == NULL) {
+		lx_audit_fail(asp, "audit: no kernel memory");
+		mutex_exit(&asp->lxast_lock);
+		kmem_free(rp, sizeof (lx_audit_record_t));
+		return;
+	}
+	rp->lxar_type = mtype;
+	bcopy(datap, msg, len);
+	msg[len] = '\0';
+
+	gethrestime(&ts);
+	ts.tv_sec -= curzone->zone_boot_time;
+
+	(void) snprintf(rp->lxar_msg, LX_AUDIT_MESSAGE_TEXT_MAX,
+	    "audit(%lu.%03lu:%lu): pid=%u uid=%u auid=%u ses=%u msg=\'",
+	    (uint64_t)ts.tv_sec,			/* zone's timestamp */
+	    (uint64_t)ts.tv_nsec / 1000000,
+	    asp->lxast_seq++,				/* serial number */
+	    (lwpd->br_pid == curzone->zone_proc_initpid ? 1 : lwpd->br_pid),
+	    crgetruid(CRED()),				/* uid */
+	    lx_audit_get_auid(),			/* auid */
+	    sessid);					/* ses */
+
+	prelen = strlen(rp->lxar_msg);
+	alen = LX_AUDIT_MESSAGE_TEXT_MAX - prelen - 2;
+	(void) strlcat(rp->lxar_msg + prelen, msg, alen);
+	(void) strlcat(rp->lxar_msg, "\'", LX_AUDIT_MESSAGE_TEXT_MAX);
+
+	list_insert_tail(&asp->lxast_ev_queue, rp);
+	if (asp->lxast_backlog == 0)
+		cv_signal(&asp->lxast_worker_cv);
+	asp->lxast_backlog++;
+	mutex_exit(&asp->lxast_lock);
+}
+
+void
+lx_audit_list_rules(void *reply,
+    void (*cb)(void *, void *, uint_t, void *, uint_t))
+{
+	lx_audit_state_t *asp;
+	lx_audit_rule_ent_t *rp;
+
+	asp = ztolxzd(curzone)->lxzd_audit_state;
+	ASSERT(asp != NULL);
+
+	/*
+	 * Output the rule list
+	 */
+	mutex_enter(&asp->lxast_lock);
+	for (rp = list_head(&asp->lxast_rules); rp != NULL;
+	    rp = list_next(&asp->lxast_rules, rp)) {
+		cb(reply, &rp->lxare_rule, sizeof (lx_audit_rule_t),
+		    rp->lxare_buf, rp->lxare_rule.lxar_buflen);
+	}
+	mutex_exit(&asp->lxast_lock);
+}
+
+void
+lx_audit_get_feature(void *reply, void (*cb)(void *, void *, uint_t))
+{
+	lx_audit_features_t af;
+
+	af.lxaf_version = LX_AUDIT_FEATURE_VERSION;
+	af.lxaf_mask = 0xffffffff;
+	af.lxaf_features = 0;
+	af.lxaf_lock = 0;
+
+	cb(reply, &af, sizeof (af));
+}
+
+void
+lx_audit_get(void *reply, void (*cb)(void *, void *, uint_t))
+{
+	lx_audit_status_t status;
+	lx_zone_data_t *lxzd;
+	lx_audit_state_t *asp;
+
+	lxzd = ztolxzd(curproc->p_zone);
+	asp = lxzd->lxzd_audit_state;
+	ASSERT(asp != NULL);
+
+	bzero(&status, sizeof (status));
+
+	mutex_enter(&asp->lxast_lock);
+	status.lxas_enabled = lxzd->lxzd_audit_enabled;
+	status.lxas_failure = asp->lxast_failure;
+	status.lxas_pid = asp->lxast_pid;
+	status.lxas_rate_limit = asp->lxast_rate_limit;
+	status.lxas_backlog_limit = asp->lxast_backlog_limit;
+	status.lxas_lost = asp->lxast_lost;
+	status.lxas_backlog = asp->lxast_backlog;
+	status.lxas_backlog_wait_time = asp->lxast_backlog_wait_time;
+	status.lxas_feature_bitmap = LX_AUDIT_FEATURE_ALL;
+	mutex_exit(&asp->lxast_lock);
+
+	cb(reply, &status, sizeof (status));
+}
+
+int
+lx_audit_set(void *lxsock, void *s, uint_t datalen,
+    void (*cb)(void *, boolean_t))
+{
+	lx_audit_status_t *statusp = (lx_audit_status_t *)s;
+	lx_zone_data_t *lxzd;
+	lx_audit_state_t *asp;
+
+	/*
+	 * Unfortunately, some user-level code does not send down a full
+	 * lx_audit_status_t structure in the message (e.g. this occurs on
+	 * CentOS7). Only the structure up to, but not including, the embedded
+	 * union is being sent in. This appears to be a result of the user-level
+	 * code being built for older versions of the kernel. To handle this,
+	 * we have to subtract the last 8 bytes from the size in order to
+	 * accomodate this code. We'll revalidate with the full size if
+	 * LX_AUDIT_STATUS_BACKLOG_WAIT_TIME were to be set in the mask.
+	 */
+	if (datalen < sizeof (lx_audit_status_t) - 8)
+		return (EINVAL);
+
+	lxzd = ztolxzd(curproc->p_zone);
+	asp = lxzd->lxzd_audit_state;
+	ASSERT(asp != NULL);
+
+	/* Once the config is locked, we only allow changing the auditd pid */
+	mutex_enter(&asp->lxast_lock);
+	if (lxzd->lxzd_audit_enabled == LXAE_LOCKED &&
+	    (statusp->lxas_mask & ~LX_AUDIT_STATUS_PID)) {
+		mutex_exit(&asp->lxast_lock);
+		return (EPERM);
+	}
+
+	if (statusp->lxas_mask & LX_AUDIT_STATUS_FAILURE) {
+		switch (statusp->lxas_failure) {
+		case LXAE_SILENT:
+		case LXAE_PRINT:
+		case LXAE_PANIC:
+			asp->lxast_failure = statusp->lxas_failure;
+			break;
+		default:
+			mutex_exit(&asp->lxast_lock);
+			return (EINVAL);
+		}
+	}
+	if (statusp->lxas_mask & LX_AUDIT_STATUS_PID) {
+		/*
+		 * The process that sets the pid is the daemon, so this is the
+		 * socket we'll write audit records out to.
+		 */
+		lx_audit_set_worker(statusp->lxas_pid, lxsock, cb);
+	}
+	if (statusp->lxas_mask & LX_AUDIT_STATUS_RATE_LIMIT) {
+		asp->lxast_rate_limit = statusp->lxas_rate_limit;
+	}
+	if (statusp->lxas_mask & LX_AUDIT_STATUS_BACKLOG_LIMIT) {
+		asp->lxast_backlog_limit = statusp->lxas_backlog_limit;
+	}
+	if (statusp->lxas_mask & LX_AUDIT_STATUS_BACKLOG_WAIT_TIME) {
+		/*
+		 * See the comment above. We have to revalidate the full struct
+		 * size since we previously only validated for a shorter struct.
+		 */
+		if (datalen < sizeof (lx_audit_status_t)) {
+			mutex_exit(&asp->lxast_lock);
+			return (EINVAL);
+		}
+		asp->lxast_backlog_wait_time = statusp->lxas_backlog_wait_time;
+	}
+	if (statusp->lxas_mask & LX_AUDIT_STATUS_LOST) {
+		asp->lxast_lost = statusp->lxas_lost;
+	}
+
+	if (statusp->lxas_mask & LX_AUDIT_STATUS_ENABLED) {
+		switch (statusp->lxas_enabled) {
+		case 0:
+			lxzd->lxzd_audit_enabled = LXAE_DISABLED;
+			break;
+		case 1:
+			lxzd->lxzd_audit_enabled = LXAE_ENABLED;
+			break;
+		case 2:
+			lxzd->lxzd_audit_enabled = LXAE_LOCKED;
+			break;
+		default:
+			mutex_exit(&asp->lxast_lock);
+			return (EINVAL);
+		}
+	}
+	mutex_exit(&asp->lxast_lock);
+
+	return (0);
+}
+
+void
+lx_audit_stop_worker(void *s, void (*cb)(void *, boolean_t))
+{
+	lx_audit_state_t *asp = ztolxzd(curzone)->lxzd_audit_state;
+	kt_did_t tid = 0;
+
+	ASSERT(asp != NULL);
+	mutex_enter(&asp->lxast_lock);
+	if (s == NULL) {
+		s = asp->lxast_sock;
+	} else {
+		VERIFY(s == asp->lxast_sock);
+	}
+	asp->lxast_sock = NULL;
+	asp->lxast_pid = 0;
+	if (asp->lxast_worker != NULL) {
+		tid = asp->lxast_worker->t_did;
+		asp->lxast_worker = NULL;
+		asp->lxast_exit = B_TRUE;
+		cv_signal(&asp->lxast_worker_cv);
+	}
+	if (s != NULL)
+		cb(s, B_FALSE);
+	mutex_exit(&asp->lxast_lock);
+
+	if (tid != 0)
+		thread_join(tid);
+}
+
+/*
+ * Called when audit netlink message received, in order to perform lazy
+ * allocation of audit state for the zone. We also perform the one-time step to
+ * cache the netlink callback used by the audit worker thread to send messages
+ * up to the auditd.
+ */
+void
+lx_audit_init(int (*cb)(void *, uint_t, const char *, uint_t))
+{
+	lx_zone_data_t *lxzd = ztolxzd(curzone);
+	lx_audit_state_t *asp;
+
+	mutex_enter(&lxzd->lxzd_lock);
+
+	if (lxzd->lxzd_audit_state != NULL) {
+		mutex_exit(&lxzd->lxzd_lock);
+		return;
+	}
+
+	asp = kmem_zalloc(sizeof (lx_audit_state_t), KM_SLEEP);
+
+	mutex_init(&asp->lxast_lock, NULL, MUTEX_DEFAULT, NULL);
+	cv_init(&asp->lxast_worker_cv, NULL, CV_DEFAULT, NULL);
+	list_create(&asp->lxast_ev_queue, sizeof (lx_audit_record_t),
+	    offsetof(lx_audit_record_t, lxar_link));
+	list_create(&asp->lxast_rules, sizeof (lx_audit_rule_ent_t),
+	    offsetof(lx_audit_rule_ent_t, lxare_link));
+	asp->lxast_failure = LXAE_PRINT;
+	asp->lxast_backlog_limit = LX_AUDIT_DEF_BACKLOG_LIMIT;
+	asp->lxast_backlog_wait_time = LX_AUDIT_DEF_WAIT_TIME;
+
+	lxzd->lxzd_audit_state = asp;
+
+	mutex_exit(&lxzd->lxzd_lock);
+
+	mutex_enter(&lx_audit_em_lock);
+	if (lx_audit_emit_msg == NULL)
+		lx_audit_emit_msg = cb;
+	mutex_exit(&lx_audit_em_lock);
+}
+
+/*
+ * Called when netlink module is unloading so that we can clear the cached
+ * netlink callback used by the audit worker thread to send messages up to the
+ * auditd.
+ */
+void
+lx_audit_cleanup(void)
+{
+	mutex_enter(&lx_audit_em_lock);
+	lx_audit_emit_msg = NULL;
+	mutex_exit(&lx_audit_em_lock);
+}
+
+/*
+ * Called when the zone is being destroyed, not when auditing is being disabled.
+ * Note that zsched has already exited and any lxast_worker thread has exited.
+ */
+void
+lx_audit_fini(zone_t *zone)
+{
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+	lx_audit_state_t *asp;
+	lx_audit_record_t *rp;
+	lx_audit_rule_ent_t *erp;
+
+	ASSERT(MUTEX_HELD(&lxzd->lxzd_lock));
+
+	if ((asp = lxzd->lxzd_audit_state) == NULL)
+		return;
+
+	mutex_enter(&asp->lxast_lock);
+
+	VERIFY(asp->lxast_worker == NULL);
+
+	rp = list_remove_head(&asp->lxast_ev_queue);
+	while (rp != NULL) {
+		kmem_free(rp->lxar_msg, LX_AUDIT_MESSAGE_TEXT_MAX);
+		kmem_free(rp, sizeof (lx_audit_record_t));
+		rp = list_remove_head(&asp->lxast_ev_queue);
+	}
+
+	list_destroy(&asp->lxast_ev_queue);
+	asp->lxast_backlog = 0;
+	asp->lxast_pid = 0;
+
+	erp = list_remove_head(&asp->lxast_rules);
+	while (erp != NULL) {
+		kmem_free(erp->lxare_buf, erp->lxare_rule.lxar_buflen);
+		if (erp->lxare_key != NULL)
+			kmem_free(erp->lxare_key, strlen(erp->lxare_key) + 1);
+		kmem_free(erp, sizeof (lx_audit_rule_ent_t));
+		erp = list_remove_head(&asp->lxast_rules);
+	}
+	list_destroy(&asp->lxast_rules);
+
+	mutex_exit(&asp->lxast_lock);
+
+	cv_destroy(&asp->lxast_worker_cv);
+	mutex_destroy(&asp->lxast_lock);
+	lxzd->lxzd_audit_state = NULL;
+	kmem_free(asp, sizeof (lx_audit_state_t));
+}
+
+/*
+ * Audit initialization/cleanup when lx brand module is loaded and
+ * unloaded.
+ */
+void
+lx_audit_ld()
+{
+	mutex_init(&lx_audit_em_lock, NULL, MUTEX_DEFAULT, NULL);
+}
+
+void
+lx_audit_unld()
+{
+	mutex_destroy(&lx_audit_em_lock);
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_brand.c b/usr/src/uts/common/brand/lx/os/lx_brand.c
new file mode 100644
index 0000000000..974c8603e0
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_brand.c
@@ -0,0 +1,2697 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2017, Joyent, Inc. All rights reserved.
+ */
+
+/*
+ * The LX Brand: emulation of a Linux operating environment within a zone.
+ *
+ * OVERVIEW
+ *
+ * The LX brand enables a full Linux userland -- including a C library,
+ * init(1) framework, and some set of applications -- to run unmodified
+ * within an illumos zone.  Unlike illumos, where applications are expected
+ * to link against and consume functions exported from libraries, the
+ * supported Linux binary compatibility boundary is the system call
+ * interface.  By accurately emulating the behaviour of Linux system calls,
+ * Linux software can be executed in this environment as if it were running
+ * on a native Linux system.
+ *
+ * EMULATING LINUX SYSTEM CALLS
+ *
+ * Linux system calls are made in 32-bit processes via the "int 0x80"
+ * instruction; in 64-bit processes the "syscall" instruction is used, as it
+ * is with native illumos processes.  In both cases, arguments to system
+ * calls are generally passed in registers and the usermode stack is not
+ * interpreted or modified by the Linux kernel.
+ *
+ * When the emulated Linux process makes a system call, it traps into the
+ * illumos kernel.  The in-kernel brand module contains various emulation
+ * routines, and can fully service some emulated system calls; e.g. read(2)
+ * and write(2).  Other system calls require assistance from the illumos
+ * libc, bouncing back out to the brand library ("lx_brand.so.1") for
+ * emulation.
+ *
+ * The brand mechanism allows for the provision of an alternative trap
+ * handler for the various system call mechanisms.  Traditionally this was
+ * used to immediately revector execution to the usermode emulation library,
+ * which was responsible for handling all system calls.  In the interests of
+ * more accurate emulation and increased performance, much of the regular
+ * illumos system call path is now invoked.  Only the argument processing and
+ * handler dispatch are replaced by the brand, via the per-LWP
+ * "lwp_brand_syscall" interposition function pointer.
+ *
+ * THE NATIVE AND BRAND STACKS
+ *
+ * Some runtime environments (e.g. the Go language) allocate very small
+ * thread stacks, preferring to grow or split the stack as necessary.  The
+ * Linux kernel generally does not use the usermode stack when servicing
+ * system calls, so this is not a problem.  In order for our emulation to
+ * have the same zero stack impact, we must execute usermode emulation
+ * routines on an _alternate_ stack.  This is similar, in principle, to the
+ * use of sigaltstack(3C) to run signal handlers off the main thread stack.
+ *
+ * To this end, the brand library allocates and installs an alternate stack
+ * (called the "native" stack) for each LWP.  The in-kernel brand code uses
+ * this stack for usermode emulation calls and interposed signal delivery,
+ * while the emulated Linux process sees only the data on the main thread
+ * stack, known as the "brand" stack.  The stack mode is tracked in the
+ * per-LWP brand-private data, using the LX_STACK_MODE_* enum.
+ *
+ * The stack mode doubles as a system call "mode bit".  When in the
+ * LX_STACK_MODE_BRAND mode, system calls are processed as emulated Linux
+ * system calls.  In other modes, system calls are assumed to be native
+ * illumos system calls as made during brand library initialisation and
+ * usermode emulation.
+ *
+ * USERMODE EMULATION
+ *
+ * When a Linux system call cannot be emulated within the kernel, we preserve
+ * the register state of the Linux process and revector the LWP to the brand
+ * library usermode emulation handler: the "lx_emulate()" function in
+ * "lx_brand.so.1".  This revectoring is modelled on the delivery of signals,
+ * and is performed in "lx_emulate_user()".
+ *
+ * First, the emulated process state is written out to the usermode stack of
+ * the process as a "ucontext_t" object.  Arguments to the emulation routine
+ * are passed on the stack or in registers, depending on the ABI.  When the
+ * usermode emulation is complete, the result is passed back to the kernel
+ * (via the "B_EMULATION_DONE" brandsys subcommand) with the saved context
+ * for restoration.
+ *
+ * SIGNAL DELIVERY, SETCONTEXT AND GETCONTEXT
+ *
+ * When servicing emulated system calls in the usermode brand library, or
+ * during signal delivery, various state is preserved by the kernel so that
+ * the running LWP may be revectored to a handling routine.  The context
+ * allows the kernel to restart the program at the point of interruption,
+ * either at the return of the signal handler, via setcontext(3C); or after
+ * the usermode emulation request has been serviced, via B_EMULATION_DONE.
+ *
+ * In illumos native processes, the saved context (a "ucontext_t" object)
+ * includes the state of registers and the current signal mask at the point
+ * of interruption.  The context also includes a link to the most recently
+ * saved context, forming a chain to be unwound as requests complete.  The LX
+ * brand requires additional book-keeping to describe the machine state: in
+ * particular, the current stack mode and the occupied extent of the native
+ * stack.
+ *
+ * The brand code is able to interpose on the context save and restore
+ * operations in the kernel -- see "lx_savecontext()" and
+ * "lx_restorecontext()" -- to enable getcontext(3C) and setcontext(3C) to
+ * function correctly in the face of a dual stack LWP.  The brand also
+ * interposes on the signal delivery mechanism -- see "lx_sendsig()" and
+ * "lx_sendsig_stack()" -- to allow all signals to be delivered to the brand
+ * library interposer on the native stack, regardless of the interrupted
+ * execution mode.  Linux sigaltstack(2) emulation is performed entirely by
+ * the usermode brand library during signal handler interposition.
+ */
+
+#include <sys/types.h>
+#include <sys/kmem.h>
+#include <sys/errno.h>
+#include <sys/thread.h>
+#include <sys/systm.h>
+#include <sys/syscall.h>
+#include <sys/proc.h>
+#include <sys/modctl.h>
+#include <sys/cmn_err.h>
+#include <sys/model.h>
+#include <sys/exec.h>
+#include <sys/lx_impl.h>
+#include <sys/machbrand.h>
+#include <sys/lx_syscalls.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_futex.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+#include <sys/lx_userhz.h>
+#include <sys/param.h>
+#include <sys/termios.h>
+#include <sys/sunddi.h>
+#include <sys/ddi.h>
+#include <sys/vnode.h>
+#include <sys/pathname.h>
+#include <sys/auxv.h>
+#include <sys/priv.h>
+#include <sys/regset.h>
+#include <sys/privregs.h>
+#include <sys/archsystm.h>
+#include <sys/zone.h>
+#include <sys/brand.h>
+#include <sys/sdt.h>
+#include <sys/x86_archext.h>
+#include <sys/controlregs.h>
+#include <sys/core.h>
+#include <sys/stack.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <lx_signum.h>
+#include <util/sscanf.h>
+#include <sys/lx_brand.h>
+#include <sys/zfs_ioctl.h>
+#include <inet/tcp_impl.h>
+#include <inet/udp_impl.h>
+
+int	lx_debug = 0;
+uint_t	lx_hz_scale = 0;
+
+void	lx_init_brand_data(zone_t *, kmutex_t *);
+void	lx_free_brand_data(zone_t *);
+void	lx_setbrand(proc_t *);
+int	lx_getattr(zone_t *, int, void *, size_t *);
+int	lx_setattr(zone_t *, int, void *, size_t);
+int	lx_brandsys(int, int64_t *, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+void	lx_set_kern_version(zone_t *, char *);
+void	lx_copy_procdata(proc_t *, proc_t *);
+
+extern int getsetcontext(int, void *);
+extern int waitsys(idtype_t, id_t, siginfo_t *, int);
+#if defined(_SYSCALL32_IMPL)
+extern int getsetcontext32(int, void *);
+extern int waitsys32(idtype_t, id_t, siginfo_t *, int);
+#endif
+
+extern int zvol_name2minor(const char *, minor_t *);
+extern int zvol_create_minor(const char *);
+
+extern void lx_proc_exit(proc_t *);
+extern int lx_sched_affinity(int, uintptr_t, int, uintptr_t, int64_t *);
+
+extern void lx_io_clear(lx_proc_data_t *);
+extern void lx_io_cleanup(proc_t *);
+
+extern void lx_ioctl_init();
+extern void lx_ioctl_fini();
+extern void lx_socket_init();
+extern void lx_socket_fini();
+
+extern int lx_start_nfs_lockd();
+extern void lx_upcall_statd();
+
+lx_systrace_f *lx_systrace_entry_ptr;
+lx_systrace_f *lx_systrace_return_ptr;
+
+static int lx_systrace_enabled;
+
+/*
+ * cgroup file system maintenance functions which are set when cgroups loads.
+ */
+void (*lx_cgrp_initlwp)(vfs_t *, uint_t, id_t, pid_t);
+void (*lx_cgrp_freelwp)(vfs_t *, uint_t, id_t, pid_t);
+
+/*
+ * While this is effectively mmu.hole_start - PAGESIZE, we don't particularly
+ * want an MMU dependency here (and should there be a microprocessor without
+ * a hole, we don't want to start allocating from the top of the VA range).
+ */
+#define	LX_MAXSTACK64	0x7ffffff00000
+
+uint64_t lx_maxstack64 = LX_MAXSTACK64;
+
+static int lx_elfexec(struct vnode *vp, struct execa *uap, struct uarg *args,
+    struct intpdata *idata, int level, long *execsz, int setid,
+    caddr_t exec_file, struct cred *cred, int *brand_action);
+
+static boolean_t lx_native_exec(uint8_t, const char **);
+static uint32_t lx_map32limit(proc_t *);
+
+static void lx_savecontext(ucontext_t *);
+static void lx_restorecontext(ucontext_t *);
+static caddr_t lx_sendsig_stack(int);
+static void lx_sendsig(int);
+#if defined(_SYSCALL32_IMPL)
+static void lx_savecontext32(ucontext32_t *);
+#endif
+static int lx_setid_clear(vattr_t *, cred_t *);
+#if defined(_LP64)
+static int lx_pagefault(proc_t *, klwp_t *, caddr_t, enum fault_type,
+    enum seg_rw);
+#endif
+static void	lx_clearbrand(proc_t *, boolean_t);
+
+typedef struct lx_zfs_ds {
+	list_node_t	ds_link;
+	char		ds_name[MAXPATHLEN];
+	uint64_t	ds_cookie;
+} lx_zfs_ds_t;
+
+/* lx brand */
+struct brand_ops lx_brops = {
+	lx_init_brand_data,		/* b_init_brand_data */
+	lx_free_brand_data,		/* b_free_brand_data */
+	lx_brandsys,			/* b_brandsys */
+	lx_setbrand,			/* b_setbrand */
+	lx_getattr,			/* b_getattr */
+	lx_setattr,			/* b_setattr */
+	lx_copy_procdata,		/* b_copy_procdata */
+	lx_proc_exit,			/* b_proc_exit */
+	lx_exec,			/* b_exec */
+	lx_setrval,			/* b_lwp_setrval */
+	lx_lwpdata_alloc,		/* b_lwpdata_alloc */
+	lx_lwpdata_free,		/* b_lwpdata_free */
+	lx_initlwp,			/* b_initlwp */
+	lx_initlwp_post,		/* b_initlwp_post */
+	lx_forklwp,			/* b_forklwp */
+	lx_freelwp,			/* b_freelwp */
+	lx_exitlwp,			/* b_lwpexit */
+	lx_elfexec,			/* b_elfexec */
+	NULL,				/* b_sigset_native_to_brand */
+	NULL,				/* b_sigset_brand_to_native */
+	lx_sigfd_translate,		/* b_sigfd_translate */
+	NSIG,				/* b_nsig */
+	lx_exit_with_sig,		/* b_exit_with_sig */
+	lx_wait_filter,			/* b_wait_filter */
+	lx_native_exec,			/* b_native_exec */
+	lx_map32limit,			/* b_map32limit */
+	lx_stop_notify,			/* b_stop_notify */
+	lx_waitid_helper,		/* b_waitid_helper */
+	lx_sigcld_repost,		/* b_sigcld_repost */
+	lx_ptrace_issig_stop,		/* b_issig_stop */
+	lx_ptrace_sig_ignorable,	/* b_sig_ignorable */
+	lx_savecontext,			/* b_savecontext */
+#if defined(_SYSCALL32_IMPL)
+	lx_savecontext32,		/* b_savecontext32 */
+#endif
+	lx_restorecontext,		/* b_restorecontext */
+	lx_sendsig_stack,		/* b_sendsig_stack */
+	lx_sendsig,			/* b_sendsig */
+	lx_setid_clear,			/* b_setid_clear */
+#if defined(_LP64)
+	lx_pagefault,			/* b_pagefault */
+#else
+	NULL,
+#endif
+	B_FALSE,			/* b_intp_parse_arg */
+	lx_clearbrand,			/* b_clearbrand */
+	lx_upcall_statd,		/* b_rpc_statd */
+	lx_acct_out			/* b_acct_out */
+};
+
+struct brand_mach_ops lx_mops = {
+	NULL,
+	NULL,
+	NULL,
+	NULL,
+	NULL,
+	lx_fixsegreg,
+	lx_fsbase
+};
+
+struct brand lx_brand = {
+	BRAND_VER_1,
+	"lx",
+	&lx_brops,
+	&lx_mops,
+	sizeof (struct lx_proc_data)
+};
+
+static struct modlbrand modlbrand = {
+	&mod_brandops, "lx brand", &lx_brand
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, (void *)&modlbrand, NULL
+};
+
+void
+lx_proc_exit(proc_t *p)
+{
+	lx_proc_data_t *lxpd;
+	proc_t *cp;
+
+	lx_clone_grp_exit(p, B_FALSE);
+	/* Cleanup any outstanding aio contexts */
+	lx_io_cleanup(p);
+
+	mutex_enter(&p->p_lock);
+	VERIFY((lxpd = ptolxproc(p)) != NULL);
+	VERIFY(lxpd->l_ptrace == 0);
+	if ((lxpd->l_flags & LX_PROC_CHILD_DEATHSIG) == 0) {
+		mutex_exit(&p->p_lock);
+		return;
+	}
+	mutex_exit(&p->p_lock);
+
+	/* Check for children which desire notification of parental death. */
+	mutex_enter(&pidlock);
+	for (cp = p->p_child; cp != NULL; cp = cp->p_sibling) {
+		mutex_enter(&cp->p_lock);
+		if ((lxpd = ptolxproc(cp)) == NULL) {
+			mutex_exit(&cp->p_lock);
+			continue;
+		}
+		if (lxpd->l_parent_deathsig != 0) {
+			sigtoproc(cp, NULL, lxpd->l_parent_deathsig);
+		}
+		mutex_exit(&cp->p_lock);
+	}
+	mutex_exit(&pidlock);
+}
+
+void
+lx_setbrand(proc_t *p)
+{
+	/* Send SIGCHLD to parent by default when child exits */
+	ptolxproc(p)->l_signal = stol_signo[SIGCHLD];
+
+	lx_read_argv_bounds(p);
+}
+
+/* ARGSUSED */
+int
+lx_setattr(zone_t *zone, int attr, void *ubuf, size_t ubufsz)
+{
+	lx_zone_data_t *lxzd = (lx_zone_data_t *)zone->zone_brand_data;
+
+	switch (attr) {
+	case LX_ATTR_KERN_RELEASE: {
+		char buf[LX_KERN_RELEASE_MAX];
+		bzero(buf, LX_KERN_RELEASE_MAX);
+		if (ubufsz >= LX_KERN_RELEASE_MAX) {
+			return (ERANGE);
+		}
+		if (copyin(ubuf, buf, ubufsz) != 0) {
+			return (EFAULT);
+		}
+		mutex_enter(&lxzd->lxzd_lock);
+		(void) strlcpy(lxzd->lxzd_kernel_release, buf,
+		    LX_KERN_RELEASE_MAX);
+		mutex_exit(&lxzd->lxzd_lock);
+		return (0);
+	}
+	case LX_ATTR_KERN_VERSION: {
+		char buf[LX_KERN_VERSION_MAX];
+		bzero(buf, LX_KERN_VERSION_MAX);
+		if (ubufsz >= LX_KERN_VERSION_MAX) {
+			return (ERANGE);
+		}
+		if (copyin(ubuf, buf, ubufsz) != 0) {
+			return (EFAULT);
+		}
+		mutex_enter(&lxzd->lxzd_lock);
+		(void) strlcpy(lxzd->lxzd_kernel_version, buf,
+		    LX_KERN_VERSION_MAX);
+		mutex_exit(&lxzd->lxzd_lock);
+		return (0);
+	}
+	case LX_ATTR_TTY_GID: {
+		gid_t	gid;
+		if (ubufsz != sizeof (gid)) {
+			return (ERANGE);
+		}
+		if (copyin(ubuf, &gid, ubufsz) != 0) {
+			return (EFAULT);
+		}
+		mutex_enter(&lxzd->lxzd_lock);
+		lxzd->lxzd_ttygrp = gid;
+		mutex_exit(&lxzd->lxzd_lock);
+		return (0);
+	}
+	default:
+		return (EINVAL);
+	}
+}
+
+/* ARGSUSED */
+int
+lx_getattr(zone_t *zone, int attr, void *ubuf, size_t *ubufsz)
+{
+	lx_zone_data_t *lxzd = (lx_zone_data_t *)zone->zone_brand_data;
+	int len;
+
+	switch (attr) {
+	case LX_ATTR_KERN_RELEASE: {
+		char buf[LX_KERN_RELEASE_MAX];
+
+		mutex_enter(&lxzd->lxzd_lock);
+		len = strnlen(lxzd->lxzd_kernel_release, LX_KERN_RELEASE_MAX);
+		len++;
+		if (*ubufsz < len) {
+			mutex_exit(&lxzd->lxzd_lock);
+			return (ERANGE);
+		}
+		bzero(buf, sizeof (buf));
+		(void) strncpy(buf, lxzd->lxzd_kernel_release, sizeof (buf));
+		mutex_exit(&lxzd->lxzd_lock);
+		if (copyout(buf, ubuf, len) != 0) {
+			return (EFAULT);
+		}
+		*ubufsz = len;
+		return (0);
+	}
+	case LX_ATTR_KERN_VERSION: {
+		char buf[LX_KERN_VERSION_MAX];
+
+		mutex_enter(&lxzd->lxzd_lock);
+		len = strnlen(lxzd->lxzd_kernel_version, LX_KERN_VERSION_MAX);
+		len++;
+		if (*ubufsz < len) {
+			mutex_exit(&lxzd->lxzd_lock);
+			return (ERANGE);
+		}
+		bzero(buf, sizeof (buf));
+		(void) strncpy(buf, lxzd->lxzd_kernel_version, sizeof (buf));
+		mutex_exit(&lxzd->lxzd_lock);
+		if (copyout(buf, ubuf, len) != 0) {
+			return (EFAULT);
+		}
+		*ubufsz = len;
+		return (0);
+	}
+	default:
+		return (EINVAL);
+	}
+}
+
+uint32_t
+lx_map32limit(proc_t *p)
+{
+	/*
+	 * To be bug-for-bug compatible with Linux, we have MAP_32BIT only
+	 * allow mappings in the first 31 bits.  This was a nuance in the
+	 * original Linux implementation circa 2002, and applications have
+	 * come to depend on its behavior.
+	 *
+	 * This is only relevant for 64-bit processes.
+	 */
+	if (p->p_model == DATAMODEL_LP64)
+		return ((uint32_t)1 << 31);
+
+	return ((uint32_t)USERLIMIT32);
+}
+
+void
+lx_brand_systrace_enable(void)
+{
+	VERIFY(!lx_systrace_enabled);
+
+	lx_systrace_enabled = 1;
+}
+
+void
+lx_brand_systrace_disable(void)
+{
+	VERIFY(lx_systrace_enabled);
+
+	lx_systrace_enabled = 0;
+}
+
+void
+lx_lwp_set_native_stack_current(lx_lwp_data_t *lwpd, uintptr_t new_sp)
+{
+	VERIFY(lwpd->br_ntv_stack != 0);
+
+	/*
+	 * The "brand-lx-set-ntv-stack-current" probe has arguments:
+	 *   arg0: stack pointer before change
+	 *   arg1: stack pointer after change
+	 *   arg2: current stack base
+	 */
+	DTRACE_PROBE3(brand__lx__set__ntv__stack__current,
+	    uintptr_t, lwpd->br_ntv_stack_current,
+	    uintptr_t, new_sp,
+	    uintptr_t, lwpd->br_ntv_stack);
+
+	lwpd->br_ntv_stack_current = new_sp;
+}
+
+#if defined(_LP64)
+static int
+lx_pagefault(proc_t *p, klwp_t *lwp, caddr_t addr, enum fault_type type,
+    enum seg_rw rw)
+{
+	int syscall_num;
+
+	/*
+	 * We only want to handle a very specific set of circumstances.
+	 * Namely: this is a 64-bit LX-branded process attempting to execute an
+	 * address in a page for which it does not have a valid mapping.  If
+	 * this is not the case, we bail out as fast as possible.
+	 */
+	VERIFY(PROC_IS_BRANDED(p));
+	if (type != F_INVAL || rw != S_EXEC || lwp_getdatamodel(lwp) !=
+	    DATAMODEL_NATIVE) {
+		return (-1);
+	}
+
+	if (!lx_vsyscall_iscall(lwp, (uintptr_t)addr, &syscall_num)) {
+		return (-1);
+	}
+
+	/*
+	 * This is a valid vsyscall address.  We service the system call and
+	 * return 0 to signal that the pagefault has been handled completely.
+	 */
+	lx_vsyscall_enter(p, lwp, syscall_num);
+	return (0);
+}
+#endif
+
+static void
+lx_clearbrand(proc_t *p, boolean_t lwps_ok)
+{
+	lx_clone_grp_exit(p, lwps_ok);
+}
+
+/*
+ * This hook runs prior to sendsig() processing and allows us to nominate
+ * an alternative stack pointer for delivery of the signal handling frame.
+ * Critically, this routine should _not_ modify any LWP state as the
+ * savecontext() does not run until after this hook.
+ */
+/* ARGSUSED */
+static caddr_t
+lx_sendsig_stack(int sig)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+
+	/*
+	 * We want to take signal delivery on the native stack, but only if
+	 * one has been allocated and installed for this LWP.
+	 */
+	if (lwpd->br_stack_mode == LX_STACK_MODE_BRAND) {
+		/*
+		 * The program is not running on the native stack.  Return
+		 * the native stack pointer from our brand-private data so
+		 * that we may switch to it for signal handling.
+		 */
+		return ((caddr_t)lwpd->br_ntv_stack_current);
+	} else {
+		struct regs *rp = lwptoregs(lwp);
+
+		/*
+		 * Either the program is already running on the native stack,
+		 * or one has not yet been allocated for this LWP.  Use the
+		 * current stack pointer value.
+		 */
+		return ((caddr_t)rp->r_sp);
+	}
+}
+
+/*
+ * This hook runs after sendsig() processing and allows us to update the
+ * per-LWP mode flags for system calls and stacks.  The pre-signal
+ * context has already been saved and delivered to the user at this point.
+ */
+/* ARGSUSED */
+static void
+lx_sendsig(int sig)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	struct regs *rp = lwptoregs(lwp);
+
+	switch (lwpd->br_stack_mode) {
+	case LX_STACK_MODE_BRAND:
+	case LX_STACK_MODE_NATIVE:
+		/*
+		 * In lx_sendsig_stack(), we nominated a stack pointer from the
+		 * native stack.  Update the stack mode, and the current in-use
+		 * extent of the native stack, accordingly:
+		 */
+		lwpd->br_stack_mode = LX_STACK_MODE_NATIVE;
+		lx_lwp_set_native_stack_current(lwpd, rp->r_sp);
+
+		/*
+		 * Fix up segment registers, etc.
+		 */
+		lx_switch_to_native(lwp);
+		break;
+
+	default:
+		/*
+		 * Otherwise, the brand library has not yet installed the
+		 * alternate stack for this LWP.  Signals will be handled on
+		 * the regular stack thread.
+		 */
+		return;
+	}
+}
+
+/*
+ * This hook runs prior to the context restoration, allowing us to take action
+ * or modify the context before it is loaded.
+ */
+static void
+lx_restorecontext(ucontext_t *ucp)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	uintptr_t flags = (uintptr_t)ucp->uc_brand_data[0];
+	caddr_t sp = ucp->uc_brand_data[1];
+
+	if (lwpd->br_stack_mode == LX_STACK_MODE_PREINIT) {
+		/*
+		 * Since we're here with stack_mode as LX_STACK_MODE_PREINIT,
+		 * that can only mean we took a signal really early in this
+		 * thread's lifetime, before we had a chance to setup a native
+		 * stack and start running the thread's code. Since we're still
+		 * handling everything on the single stack, we can't do any of
+		 * the usual work below. Note: this means we cannot look at
+		 * "flags" since the uc_brand_data may not have been properly
+		 * set, depending on where we were when we took the signal.
+		 */
+		return;
+	}
+
+	/*
+	 * We have a saved native stack pointer value that we must restore
+	 * into the per-LWP data.
+	 */
+	if (flags & LX_UC_RESTORE_NATIVE_SP) {
+		lx_lwp_set_native_stack_current(lwpd, (uintptr_t)sp);
+	}
+
+	/*
+	 * We do not wish to restore the value of uc_link in this context,
+	 * so replace it with the value currently in the LWP.
+	 */
+	if (flags & LX_UC_IGNORE_LINK) {
+		ucp->uc_link = (ucontext_t *)lwp->lwp_oldcontext;
+	}
+
+	/*
+	 * Set or restore the stack mode. Usually this restores the mode, but
+	 * the lx_runexe code flow also uses this to set the mode from
+	 * LX_STACK_MODE_INIT to LX_UC_STACK_BRAND.
+	 */
+	if (flags & LX_UC_STACK_NATIVE) {
+		lwpd->br_stack_mode = LX_STACK_MODE_NATIVE;
+	} else if (flags & LX_UC_STACK_BRAND) {
+		lwpd->br_stack_mode = LX_STACK_MODE_BRAND;
+	}
+
+#if defined(__amd64)
+	/*
+	 * Override the fs/gsbase in the context with the value provided
+	 * through the Linux arch_prctl(2) system call.
+	 */
+	if (flags & LX_UC_STACK_BRAND) {
+		if (lwpd->br_lx_fsbase != 0) {
+			ucp->uc_mcontext.gregs[REG_FSBASE] = lwpd->br_lx_fsbase;
+		}
+		if (lwpd->br_lx_gsbase != 0) {
+			ucp->uc_mcontext.gregs[REG_GSBASE] = lwpd->br_lx_gsbase;
+		}
+	}
+#endif
+}
+
+static void
+lx_savecontext(ucontext_t *ucp)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	uintptr_t flags = 0;
+
+	/*
+	 * The ucontext_t affords us three private pointer-sized members in
+	 * "uc_brand_data".  We pack a variety of flags into the first element,
+	 * and an optional stack pointer in the second element.  The flags
+	 * determine which stack pointer (native or brand), if any, is stored
+	 * in the second element.  The third element may contain the system
+	 * call number; this is analogous to the "orig_[er]ax" member of a
+	 * Linux "user_regs_struct".
+	 */
+
+	if (lwpd->br_stack_mode != LX_STACK_MODE_INIT &&
+	    lwpd->br_stack_mode != LX_STACK_MODE_PREINIT) {
+		/*
+		 * Record the value of the native stack pointer to restore
+		 * when returning to this branded context:
+		 */
+		flags |= LX_UC_RESTORE_NATIVE_SP;
+		ucp->uc_brand_data[1] = (void *)lwpd->br_ntv_stack_current;
+	}
+
+	/*
+	 * Save the stack mode:
+	 */
+	if (lwpd->br_stack_mode == LX_STACK_MODE_NATIVE) {
+		flags |= LX_UC_STACK_NATIVE;
+	} else if (lwpd->br_stack_mode == LX_STACK_MODE_BRAND) {
+		flags |= LX_UC_STACK_BRAND;
+	}
+
+	/*
+	 * If we might need to restart this system call, save that information
+	 * in the context:
+	 */
+	if (lwpd->br_stack_mode == LX_STACK_MODE_BRAND) {
+		ucp->uc_brand_data[2] =
+		    (void *)(uintptr_t)lwpd->br_syscall_num;
+		if (lwpd->br_syscall_restart) {
+			flags |= LX_UC_RESTART_SYSCALL;
+		}
+	} else {
+		ucp->uc_brand_data[2] = NULL;
+	}
+
+	ucp->uc_brand_data[0] = (void *)flags;
+}
+
+#if defined(_SYSCALL32_IMPL)
+static void
+lx_savecontext32(ucontext32_t *ucp)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	unsigned int flags = 0;
+
+	/*
+	 * The ucontext_t affords us three private pointer-sized members in
+	 * "uc_brand_data".  We pack a variety of flags into the first element,
+	 * and an optional stack pointer in the second element.  The flags
+	 * determine which stack pointer (native or brand), if any, is stored
+	 * in the second element.  The third element may contain the system
+	 * call number; this is analogous to the "orig_[er]ax" member of a
+	 * Linux "user_regs_struct".
+	 */
+
+	if (lwpd->br_stack_mode != LX_STACK_MODE_INIT &&
+	    lwpd->br_stack_mode != LX_STACK_MODE_PREINIT) {
+		/*
+		 * Record the value of the native stack pointer to restore
+		 * when returning to this branded context:
+		 */
+		flags |= LX_UC_RESTORE_NATIVE_SP;
+		ucp->uc_brand_data[1] = (caddr32_t)lwpd->br_ntv_stack_current;
+	}
+
+	/*
+	 * Save the stack mode:
+	 */
+	if (lwpd->br_stack_mode == LX_STACK_MODE_NATIVE) {
+		flags |= LX_UC_STACK_NATIVE;
+	} else if (lwpd->br_stack_mode == LX_STACK_MODE_BRAND) {
+		flags |= LX_UC_STACK_BRAND;
+	}
+
+	/*
+	 * If we might need to restart this system call, save that information
+	 * in the context:
+	 */
+	if (lwpd->br_stack_mode == LX_STACK_MODE_BRAND) {
+		ucp->uc_brand_data[2] = (caddr32_t)lwpd->br_syscall_num;
+		if (lwpd->br_syscall_restart) {
+			flags |= LX_UC_RESTART_SYSCALL;
+		}
+	} else {
+		ucp->uc_brand_data[2] = NULL;
+	}
+
+	ucp->uc_brand_data[0] = flags;
+}
+#endif
+
+static int
+lx_zfs_ioctl(ldi_handle_t lh, int cmd, zfs_cmd_t *zc, size_t *dst_alloc_size)
+{
+	uint64_t	cookie;
+	size_t		dstsize;
+	int		rc, unused;
+
+	cookie = zc->zc_cookie;
+
+	dstsize = (dst_alloc_size == NULL ? 0 : 8192);
+
+again:
+	if (dst_alloc_size != NULL) {
+		zc->zc_nvlist_dst = (uint64_t)(intptr_t)kmem_alloc(dstsize,
+		    KM_SLEEP);
+		zc->zc_nvlist_dst_size = dstsize;
+	}
+
+	rc = ldi_ioctl(lh, cmd, (intptr_t)zc, FKIOCTL, kcred, &unused);
+	if (rc == ENOMEM && dst_alloc_size != NULL) {
+		/*
+		 * Our nvlist_dst buffer was too small, retry with a bigger
+		 * buffer. ZFS will tell us the exact needed size.
+		 */
+		size_t newsize = zc->zc_nvlist_dst_size;
+		ASSERT(newsize > dstsize);
+
+		kmem_free((void *)(uintptr_t)zc->zc_nvlist_dst, dstsize);
+		dstsize = newsize;
+		zc->zc_cookie = cookie;
+
+		goto again;
+	}
+
+	if (dst_alloc_size != NULL) {
+		*dst_alloc_size = dstsize;
+	}
+
+	return (rc);
+}
+
+static int
+lx_zone_zfs_open(ldi_handle_t *lh, dev_t *zfs_dev)
+{
+	ldi_ident_t li;
+
+	if (ldi_ident_from_mod(&modlinkage, &li) != 0) {
+		return (-1);
+	}
+	if (ldi_open_by_name("/dev/zfs", FREAD|FWRITE, kcred, lh, li) != 0) {
+		ldi_ident_release(li);
+		return (-1);
+	}
+	ldi_ident_release(li);
+	if (ldi_get_dev(*lh, zfs_dev) != 0) {
+		(void) ldi_close(*lh, FREAD|FWRITE, kcred);
+		return (-1);
+	}
+	return (0);
+}
+
+/*
+ * We only get the relevant properties for zvols. This is because we're
+ * essentially iterating all of the ZFS datasets/zvols on the entire system
+ * when we boot the zone and there is a significant performance penalty if we
+ * have to retrieve all of the properties for everything. Especially since we
+ * don't care about any of them except the zvols actually in our delegated
+ * datasets.
+ *
+ * Note that the two properties we care about, volsize & volblocksize, are
+ * mandatory for zvols and should always be present. Also, note that the
+ * blocksize property value cannot change after the zvol has been created.
+ */
+static void
+lx_zvol_props(ldi_handle_t lh, zfs_cmd_t *zc, uint64_t *vsz, uint64_t *bsz)
+{
+	int		rc;
+	size_t		size;
+	nvlist_t	*nv = NULL, *nv2;
+
+	rc = lx_zfs_ioctl(lh, ZFS_IOC_OBJSET_STATS, zc, &size);
+	if (rc != 0)
+		return;
+
+	rc = nvlist_unpack((char *)(uintptr_t)zc->zc_nvlist_dst,
+	    zc->zc_nvlist_dst_size, &nv, 0);
+	ASSERT(rc == 0);
+
+	kmem_free((void *)(uintptr_t)zc->zc_nvlist_dst, size);
+	zc->zc_nvlist_dst = NULL;
+	zc->zc_nvlist_dst_size = 0;
+
+	if ((rc = nvlist_lookup_nvlist(nv, "volsize", &nv2)) == 0) {
+		uint64_t val;
+
+		rc = nvlist_lookup_uint64(nv2, ZPROP_VALUE, &val);
+		if (rc == 0) {
+			*vsz = val;
+		}
+	}
+
+	if ((rc = nvlist_lookup_nvlist(nv, "volblocksize", &nv2)) == 0) {
+		uint64_t val;
+
+		rc = nvlist_lookup_uint64(nv2, ZPROP_VALUE, &val);
+		if (rc == 0) {
+			*bsz = val;
+		}
+	}
+
+	nvlist_free(nv);
+}
+
+/*
+ * Unlike ZFS proper, which does dynamic zvols, we currently only generate the
+ * zone's "disk" list once at zone boot time and use that consistently in all
+ * of the various subsystems (devfs, sysfs, procfs).  This allows us to avoid
+ * re-iterating the datasets every time one of those subsystems accesses a
+ * "disk" and allows us to keep the view consistent across all subsystems, but
+ * it does mean a reboot is required to see new "disks". This is somewhat
+ * mitigated by its similarity to actual disk drives on a real system.
+ */
+static void
+lx_zone_get_zvols(zone_t *zone, ldi_handle_t lh, minor_t *emul_minor)
+{
+	lx_zone_data_t *lxzd;
+	list_t *zvol_lst, ds_lst;
+	int rc;
+	unsigned int devnum = 0;
+	size_t size;
+	zfs_cmd_t *zc;
+	nvpair_t *elem = NULL;
+	nvlist_t *pnv = NULL;
+
+	lxzd = ztolxzd(zone);
+	ASSERT(lxzd != NULL);
+	zvol_lst = lxzd->lxzd_vdisks;
+
+	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
+	if (lx_zfs_ioctl(lh, ZFS_IOC_POOL_CONFIGS, zc, &size) != 0) {
+		goto out;
+	}
+	ASSERT(zc->zc_cookie > 0);
+
+	rc = nvlist_unpack((char *)(uintptr_t)zc->zc_nvlist_dst,
+	    zc->zc_nvlist_dst_size, &pnv, 0);
+	kmem_free((void *)(uintptr_t)zc->zc_nvlist_dst, size);
+	if (rc != 0)
+		goto out;
+
+	/*
+	 * We use a dataset list to process all of the datasets in the pool
+	 * without doing recursion so that we don't risk blowing the kernel
+	 * stack.
+	 */
+	list_create(&ds_lst, sizeof (lx_zfs_ds_t),
+	    offsetof(lx_zfs_ds_t, ds_link));
+
+	while ((elem = nvlist_next_nvpair(pnv, elem)) != NULL) {
+		lx_zfs_ds_t *ds;
+
+		ds = kmem_zalloc(sizeof (lx_zfs_ds_t), KM_SLEEP);
+		(void) strcpy(ds->ds_name, nvpair_name(elem));
+		list_insert_head(&ds_lst, ds);
+
+		while (ds != NULL) {
+			int w;		/* dummy variable */
+
+			bzero(zc, sizeof (zfs_cmd_t));
+			zc->zc_cookie = ds->ds_cookie;
+			(void) strcpy(zc->zc_name, ds->ds_name);
+
+			rc = lx_zfs_ioctl(lh, ZFS_IOC_DATASET_LIST_NEXT,
+			    zc, NULL);
+			/* Update the cookie before doing anything else. */
+			ds->ds_cookie = zc->zc_cookie;
+
+			if (rc != 0) {
+				list_remove(&ds_lst, ds);
+				kmem_free(ds, sizeof (lx_zfs_ds_t));
+				ds = list_tail(&ds_lst);
+				continue;
+			}
+
+			/* Reserved internal names, skip over these. */
+			if (strchr(zc->zc_name, '$') != NULL ||
+			    strchr(zc->zc_name, '%') != NULL)
+				continue;
+
+			if (!zone_dataset_visible_inzone(zone, zc->zc_name, &w))
+				continue;
+
+			if (zc->zc_objset_stats.dds_type == DMU_OST_ZVOL) {
+				lx_virt_disk_t *vd;
+				minor_t m = 0;
+				char *znm = zc->zc_name;
+
+				/* Create a virtual disk entry for the zvol */
+				vd = kmem_zalloc(sizeof (lx_virt_disk_t),
+				    KM_SLEEP);
+				vd->lxvd_type = LXVD_ZVOL;
+				(void) snprintf(vd->lxvd_name,
+				    sizeof (vd->lxvd_name),
+				    "zvol%u", devnum++);
+				(void) strlcpy(vd->lxvd_real_name,
+				    zc->zc_name,
+				    sizeof (vd->lxvd_real_name));
+
+				/* Record emulated and real dev_t values */
+				vd->lxvd_emul_dev = makedevice(LX_MAJOR_DISK,
+				    (*emul_minor)++);
+				if (zvol_name2minor(znm, &m) != 0) {
+					(void) zvol_create_minor(znm);
+					VERIFY(zvol_name2minor(znm, &m) == 0);
+				}
+				if (m != 0) {
+					vd->lxvd_real_dev = makedevice(
+					    getmajor(lxzd->lxzd_zfs_dev), m);
+				}
+
+				/* Query volume size properties */
+				lx_zvol_props(lh, zc, &vd->lxvd_volsize,
+				    &vd->lxvd_blksize);
+
+				list_insert_tail(zvol_lst, vd);
+			} else {
+				lx_zfs_ds_t *nds;
+
+				/* Create a new ds_t for the child. */
+				nds = kmem_zalloc(sizeof (lx_zfs_ds_t),
+				    KM_SLEEP);
+				(void) strcpy(nds->ds_name, zc->zc_name);
+				list_insert_after(&ds_lst, ds, nds);
+
+				/* Depth-first, so do the one just created. */
+				ds = nds;
+			}
+		}
+
+		ASSERT(list_is_empty(&ds_lst));
+	}
+
+	list_destroy(&ds_lst);
+
+out:
+	nvlist_free(pnv);
+	kmem_free(zc, sizeof (zfs_cmd_t));
+}
+
+static void
+lx_zone_get_zfsds(zone_t *zone, minor_t *emul_minor)
+{
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+	vfs_t *vfsp = zone->zone_rootvp->v_vfsp;
+
+	/*
+	 * Only the root will be mounted at zone init time.
+	 * Finding means of discovering other datasets mounted in the zone
+	 * would be a good enhancement later.
+	 */
+	if (getmajor(vfsp->vfs_dev) == getmajor(lxzd->lxzd_zfs_dev)) {
+		lx_virt_disk_t *vd;
+
+		vd = kmem_zalloc(sizeof (lx_virt_disk_t), KM_SLEEP);
+		vd->lxvd_type = LXVD_ZFS_DS;
+		vd->lxvd_real_dev = vfsp->vfs_dev;
+		vd->lxvd_emul_dev = makedevice(LX_MAJOR_DISK, (*emul_minor)++);
+		(void) snprintf(vd->lxvd_name, sizeof (vd->lxvd_name),
+		    "zfsds%u", 0);
+		(void) strlcpy(vd->lxvd_real_name,
+		    refstr_value(vfsp->vfs_resource),
+		    sizeof (vd->lxvd_real_name));
+
+		list_insert_tail(lxzd->lxzd_vdisks, vd);
+	}
+}
+
+/* Cleanup virtual disk list */
+static void
+lx_zone_cleanup_vdisks(lx_zone_data_t *lxzd)
+{
+	lx_virt_disk_t *vd;
+
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+	vd = (list_remove_head(lxzd->lxzd_vdisks));
+	while (vd != NULL) {
+		kmem_free(vd, sizeof (lx_virt_disk_t));
+		vd = list_remove_head(lxzd->lxzd_vdisks);
+	}
+
+	list_destroy(lxzd->lxzd_vdisks);
+	kmem_free(lxzd->lxzd_vdisks, sizeof (list_t));
+	lxzd->lxzd_vdisks = NULL;
+}
+
+/*
+ * By default illumos restricts access to ULP_DEF_EPRIV_PORT1 and
+ * ULP_DEF_EPRIV_PORT2 for TCP and UDP, even though these ports are outside of
+ * the privileged port range. Linux does not do this, so we need to remove
+ * these defaults.
+ *
+ * See also: mod_set_extra_privports
+ */
+static void
+lx_fix_ns_eports(netstack_t *ns)
+{
+	tcp_stack_t	*tcps;
+	udp_stack_t	*udps;
+	in_port_t	*ports;
+	uint_t		i, nports;
+	kmutex_t	*lock;
+
+	tcps = ns->netstack_tcp;
+	ports = tcps->tcps_g_epriv_ports;
+	nports = tcps->tcps_g_num_epriv_ports;
+	lock = &tcps->tcps_epriv_port_lock;
+	mutex_enter(lock);
+	for (i = 0; i < nports; i++)
+		ports[i] = 0;
+	mutex_exit(lock);
+
+	udps = ns->netstack_udp;
+	ports = udps->us_epriv_ports;
+	nports = udps->us_num_epriv_ports;
+	lock = &udps->us_epriv_port_lock;
+	mutex_enter(lock);
+	for (i = 0; i < nports; i++)
+		ports[i] = 0;
+	mutex_exit(lock);
+}
+
+/*
+ * The default limit for TCP buffer sizing on illumos is smaller than its
+ * counterparts on Linux.  Adjust it to meet minimum expectations.
+ */
+static void
+lx_fix_ns_buffers(netstack_t *ns)
+{
+	mod_prop_info_t *pinfo;
+	ulong_t target, parsed;
+	char buf[16];
+
+	/*
+	 * Prior to kernel 3.4, Linux defaulted to a max of 4MB for both the
+	 * tcp_rmem and tcp_wmem tunables.  Kernels since then increase the
+	 * tcp_rmem default max to 6MB.  Since illumos lacks separate tunables
+	 * to cap sizing for read and write buffers, the higher value is
+	 * selected for compatibility.
+	 */
+	if (lx_kern_release_cmp(curzone, "3.4.0") < 0) {
+		target = 4*1024*1024;
+	} else {
+		target = 6*1024*1024;
+	}
+
+	pinfo = mod_prop_lookup(ns->netstack_tcp->tcps_propinfo_tbl,
+	    "max_buf", MOD_PROTO_TCP);
+	if (pinfo == NULL ||
+	    pinfo->mpi_getf(ns, pinfo, NULL, buf, sizeof (buf), 0) != 0 ||
+	    ddi_strtoul(buf, NULL, 10, &parsed) != 0 ||
+	    parsed >= target) {
+		return;
+	}
+
+	(void) snprintf(buf, sizeof (buf), "%lu", target);
+	(void) pinfo->mpi_setf(ns, CRED(), pinfo, NULL, buf, 0);
+}
+
+static void
+lx_bootup_hooks()
+{
+	netstack_t *ns;
+
+	ns = netstack_get_current();
+	if (ns == NULL)
+		return;
+
+	lx_fix_ns_eports(ns);
+	lx_fix_ns_buffers(ns);
+
+	netstack_rele(ns);
+}
+
+void
+lx_init_brand_data(zone_t *zone, kmutex_t *zsl)
+{
+	lx_zone_data_t *data;
+	ldi_handle_t lh;
+
+	ASSERT(MUTEX_HELD(zsl));
+	ASSERT(zone->zone_brand == &lx_brand);
+	ASSERT(zone->zone_brand_data == NULL);
+
+	data = (lx_zone_data_t *)kmem_zalloc(sizeof (lx_zone_data_t), KM_SLEEP);
+	mutex_init(&data->lxzd_lock, NULL, MUTEX_DEFAULT, NULL);
+
+	/* No need to hold mutex now since zone_brand_data is not set yet. */
+
+	/*
+	 * Set the default lxzd_kernel_version to 2.4.
+	 * This can be changed by a call to setattr() during zone boot.
+	 */
+	(void) strlcpy(data->lxzd_kernel_release, "2.4.21",
+	    LX_KERN_RELEASE_MAX);
+	(void) strlcpy(data->lxzd_kernel_version, "BrandZ virtual linux",
+	    LX_KERN_VERSION_MAX);
+	data->lxzd_pipe_max_sz = lx_pipe_max_default;
+
+	zone->zone_brand_data = data;
+
+	/*
+	 * In Linux, if the init(1) process terminates the system panics.
+	 * The zone must reboot to simulate this behaviour.
+	 */
+	zone->zone_reboot_on_init_exit = B_TRUE;
+
+	/*
+	 * We cannot hold the zone_status_lock while performing zfs operations
+	 * so we drop the lock, get the zfs devs as the last step in this
+	 * function, then reaquire the lock. Don't add any code after this
+	 * which requires that the zone_status_lock was continuously held.
+	 */
+	mutex_exit(zsl);
+
+	data->lxzd_vdisks = kmem_alloc(sizeof (list_t), KM_SLEEP);
+	list_create(data->lxzd_vdisks, sizeof (lx_virt_disk_t),
+	    offsetof(lx_virt_disk_t, lxvd_link));
+
+	if (lx_zone_zfs_open(&lh, &data->lxzd_zfs_dev) == 0) {
+		minor_t emul_minor = 1;
+
+		lx_zone_get_zfsds(zone, &emul_minor);
+		lx_zone_get_zvols(zone, lh, &emul_minor);
+		(void) ldi_close(lh, FREAD|FWRITE, kcred);
+	} else {
+		/* Avoid matching any devices */
+		data->lxzd_zfs_dev = makedevice(-1, 0);
+	}
+	mutex_enter(zsl);
+}
+
+void
+lx_free_brand_data(zone_t *zone)
+{
+	lx_zone_data_t *data = ztolxzd(zone);
+	ASSERT(data != NULL);
+	mutex_enter(&data->lxzd_lock);
+	lx_audit_fini(zone);
+	if (data->lxzd_ioctl_sock != NULL) {
+		/*
+		 * Since zone_kcred has been cleaned up already, close the
+		 * socket using the global kcred.
+		 */
+		(void) ksocket_close(data->lxzd_ioctl_sock, kcred);
+		data->lxzd_ioctl_sock = NULL;
+	}
+	ASSERT(data->lxzd_cgroup == NULL);
+
+	lx_zone_cleanup_vdisks(data);
+
+	mutex_exit(&data->lxzd_lock);
+	zone->zone_brand_data = NULL;
+	mutex_destroy(&data->lxzd_lock);
+	kmem_free(data, sizeof (*data));
+}
+
+void
+lx_unsupported(char *dmsg)
+{
+	lx_proc_data_t *pd = ttolxproc(curthread);
+
+	DTRACE_PROBE1(brand__lx__unsupported, char *, dmsg);
+
+	if (pd != NULL && (pd->l_flags & LX_PROC_STRICT_MODE) != 0) {
+		/*
+		 * If this process was run with strict mode enabled
+		 * (via LX_STRICT in the environment), we mark this
+		 * LWP as having triggered an unsupported behaviour.
+		 * This flag will be checked at an appropriate point
+		 * by lx_check_strict_failure().
+		 */
+		lx_lwp_data_t *lwpd = ttolxlwp(curthread);
+
+		lwpd->br_strict_failure = B_TRUE;
+	}
+}
+
+void
+lx_check_strict_failure(lx_lwp_data_t *lwpd)
+{
+	proc_t *p;
+
+	if (!lwpd->br_strict_failure) {
+		return;
+	}
+
+	lwpd->br_strict_failure = B_FALSE;
+
+	/*
+	 * If this process is operating in strict mode (via LX_STRICT in
+	 * the environment), and has triggered a call to
+	 * lx_unsupported(), we drop SIGSYS on it as we return.
+	 */
+	p = curproc;
+	mutex_enter(&p->p_lock);
+	sigtoproc(p, curthread, SIGSYS);
+	mutex_exit(&p->p_lock);
+}
+
+void
+lx_trace_sysenter(int syscall_num, uintptr_t *args)
+{
+	if (lx_systrace_enabled) {
+		VERIFY(lx_systrace_entry_ptr != NULL);
+
+		(*lx_systrace_entry_ptr)(syscall_num, args[0], args[1],
+		    args[2], args[3], args[4], args[5]);
+	}
+}
+
+void
+lx_trace_sysreturn(int syscall_num, long ret)
+{
+	if (lx_systrace_enabled) {
+		VERIFY(lx_systrace_return_ptr != NULL);
+
+		(*lx_systrace_return_ptr)(syscall_num, ret, ret, 0, 0, 0, 0);
+	}
+}
+
+/*
+ * Get the addresses of the user-space system call handler and attach it to
+ * the proc structure. Returning 0 indicates success; the value returned
+ * by the system call is the value stored in rval. Returning a non-zero
+ * value indicates a failure; the value returned is used to set errno, -1
+ * is returned from the syscall and the contents of rval are ignored. To
+ * set errno and have the syscall return a value other than -1 we can
+ * manually set errno and rval and return 0.
+ */
+int
+lx_brandsys(int cmd, int64_t *rval, uintptr_t arg1, uintptr_t arg2,
+    uintptr_t arg3, uintptr_t arg4)
+{
+	kthread_t *t = curthread;
+	klwp_t *lwp = ttolwp(t);
+	proc_t *p = ttoproc(t);
+	lx_proc_data_t *pd;
+	struct termios *termios;
+	uint_t termios_len;
+	int error;
+	int code;
+	int sig;
+	lx_brand_registration_t reg;
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+
+	/*
+	 * There is one operation that is suppored for non-branded
+	 * process.  B_EXEC_BRAND.  This is the equilivant of an
+	 * exec call, but the new process that is created will be
+	 * a branded process.
+	 */
+	if (cmd == B_EXEC_BRAND) {
+		VERIFY(p->p_zone != NULL);
+		VERIFY(p->p_zone->zone_brand == &lx_brand);
+		return (exec_common(
+		    (char *)arg1, (const char **)arg2, (const char **)arg3,
+		    EBA_BRAND));
+	}
+
+	/* For all other operations this must be a branded process. */
+	if (p->p_brand == NULL)
+		return (ENOSYS);
+
+	VERIFY(p->p_brand == &lx_brand);
+	VERIFY(p->p_brand_data != NULL);
+
+	switch (cmd) {
+	case B_REGISTER:
+		if (lwpd->br_stack_mode != LX_STACK_MODE_PREINIT) {
+			lx_print("stack mode was not PREINIT during "
+			    "REGISTER\n");
+			return (EINVAL);
+		}
+
+		if (p->p_model == DATAMODEL_NATIVE) {
+			if (copyin((void *)arg1, &reg, sizeof (reg)) != 0) {
+				lx_print("Failed to copyin brand registration "
+				    "at 0x%p\n", (void *)arg1);
+				return (EFAULT);
+			}
+		}
+#ifdef _LP64
+		else {
+			/* 32-bit userland on 64-bit kernel */
+			lx_brand_registration32_t reg32;
+
+			if (copyin((void *)arg1, &reg32, sizeof (reg32)) != 0) {
+				lx_print("Failed to copyin brand registration "
+				    "at 0x%p\n", (void *)arg1);
+				return (EFAULT);
+			}
+
+			reg.lxbr_version = (uint_t)reg32.lxbr_version;
+			reg.lxbr_handler =
+			    (void *)(uintptr_t)reg32.lxbr_handler;
+			reg.lxbr_flags = reg32.lxbr_flags;
+		}
+#endif
+
+		if (reg.lxbr_version != LX_VERSION_1) {
+			lx_print("Invalid brand library version (%u)\n",
+			    reg.lxbr_version);
+			return (EINVAL);
+		}
+
+		if ((reg.lxbr_flags & ~LX_PROC_ALL) != 0) {
+			lx_print("Invalid brand flags (%u)\n",
+			    reg.lxbr_flags);
+			return (EINVAL);
+		}
+
+		lx_print("Assigning brand 0x%p and handler 0x%p to proc 0x%p\n",
+		    (void *)&lx_brand, (void *)reg.lxbr_handler, (void *)p);
+		pd = p->p_brand_data;
+		pd->l_handler = (uintptr_t)reg.lxbr_handler;
+		pd->l_flags = reg.lxbr_flags & LX_PROC_ALL;
+
+		/*
+		 * There are certain setup tasks which cannot be performed
+		 * during the lx_init_brand_data hook due to the calling
+		 * context from zoneadmd (in the GZ).  This work is instead
+		 * delayed until the init process starts inside the zone.
+		 */
+		if (p->p_pid == p->p_zone->zone_proc_initpid) {
+			lx_bootup_hooks();
+		}
+
+		return (0);
+
+	case B_TTYMODES:
+		/* This is necessary for emulating TCGETS ioctls. */
+		if (ddi_prop_lookup_byte_array(DDI_DEV_T_ANY, ddi_root_node(),
+		    DDI_PROP_NOTPROM, "ttymodes", (uchar_t **)&termios,
+		    &termios_len) != DDI_SUCCESS)
+			return (EIO);
+
+		ASSERT(termios_len == sizeof (*termios));
+
+		if (copyout(&termios, (void *)arg1, sizeof (termios)) != 0) {
+			ddi_prop_free(termios);
+			return (EFAULT);
+		}
+
+		ddi_prop_free(termios);
+		return (0);
+
+	case B_ELFDATA: {
+		mutex_enter(&p->p_lock);
+		pd = curproc->p_brand_data;
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			lx_elf_data_t led;
+
+			bcopy(&pd->l_elf_data, &led, sizeof (led));
+			mutex_exit(&p->p_lock);
+
+			if (copyout(&led, (void *)arg1,
+			    sizeof (lx_elf_data_t)) != 0) {
+				return (EFAULT);
+			}
+		}
+#if defined(_LP64)
+		else {
+			/* 32-bit userland on 64-bit kernel */
+			lx_elf_data32_t led32;
+
+			led32.ed_phdr = (int)pd->l_elf_data.ed_phdr;
+			led32.ed_phent = (int)pd->l_elf_data.ed_phent;
+			led32.ed_phnum = (int)pd->l_elf_data.ed_phnum;
+			led32.ed_entry = (int)pd->l_elf_data.ed_entry;
+			led32.ed_base = (int)pd->l_elf_data.ed_base;
+			led32.ed_ldentry = (int)pd->l_elf_data.ed_ldentry;
+			mutex_exit(&p->p_lock);
+
+			if (copyout(&led32, (void *)arg1,
+			    sizeof (led32)) != 0) {
+				return (EFAULT);
+			}
+		}
+#endif
+		return (0);
+	}
+
+	case B_EXEC_NATIVE:
+		return (exec_common((char *)arg1, (const char **)arg2,
+		    (const char **)arg3, EBA_NATIVE));
+
+	/*
+	 * The B_TRUSS_POINT subcommand is used so that we can make a no-op
+	 * syscall for debugging purposes (dtracing) from within the user-level
+	 * emulation.
+	 */
+	case B_TRUSS_POINT:
+		return (0);
+
+	case B_LPID_TO_SPAIR: {
+		/*
+		 * Given a Linux pid as arg1, return the Solaris pid in arg2 and
+		 * the Solaris LWP in arg3.  We also translate pid 1 (which is
+		 * hardcoded in many applications) to the zone's init process.
+		 */
+		pid_t s_pid;
+		id_t s_tid;
+
+		if ((pid_t)arg1 == 1) {
+			s_pid = p->p_zone->zone_proc_initpid;
+			/* handle the dead/missing init(1M) case */
+			if (s_pid == -1)
+				s_pid = 1;
+			s_tid = 1;
+		} else if (lx_lpid_to_spair((pid_t)arg1, &s_pid, &s_tid) < 0) {
+			return (ESRCH);
+		}
+
+		if (copyout(&s_pid, (void *)arg2, sizeof (s_pid)) != 0 ||
+		    copyout(&s_tid, (void *)arg3, sizeof (s_tid)) != 0) {
+			return (EFAULT);
+		}
+
+		return (0);
+	}
+
+	case B_PTRACE_STOP_FOR_OPT:
+		return (lx_ptrace_stop_for_option((int)arg1, arg2 == 0 ?
+		    B_FALSE : B_TRUE, (ulong_t)arg3, arg4));
+
+	case B_PTRACE_CLONE_BEGIN:
+		/*
+		 * Leverage ptrace brand call to create a clone group for this
+		 * proc if necessary.
+		 */
+		lx_clone_grp_create((uint_t)arg3);
+
+		return (lx_ptrace_set_clone_inherit((int)arg1, arg2 == 0 ?
+		    B_FALSE : B_TRUE));
+
+	case B_PTRACE_SIG_RETURN: {
+		/*
+		 * Our ptrace emulation must emit PR_SYSEXIT for rt_sigreturn.
+		 * Since that syscall does not pass through the normal
+		 * emulation, which would call lx_syscall_return, the event is
+		 * emitted manually. A successful result of the syscall is
+		 * assumed since there is little to be done in the face of
+		 * failure.
+		 */
+		struct regs *rp = lwptoregs(lwp);
+
+		rp->r_r0 = 0;
+		(void) lx_ptrace_stop(LX_PR_SYSEXIT);
+		return (0);
+	}
+
+	case B_UNSUPPORTED: {
+		char dmsg[256];
+
+		if (copyin((void *)arg1, &dmsg, sizeof (dmsg)) != 0) {
+			lx_print("Failed to copyin unsupported msg "
+			    "at 0x%p\n", (void *)arg1);
+			return (EFAULT);
+		}
+		dmsg[255] = '\0';
+		lx_unsupported(dmsg);
+
+		lx_check_strict_failure(lwpd);
+
+		return (0);
+	}
+
+	case B_STORE_ARGS: {
+		/*
+		 * B_STORE_ARGS subcommand
+		 * arg1 = address of struct to be copied in
+		 * arg2 = size of the struct being copied in
+		 * arg3-arg6 ignored
+		 * rval = the amount of data copied.
+		 */
+		void *buf;
+
+		/* only have upper limit because arg2 is unsigned */
+		if (arg2 > LX_BR_ARGS_SIZE_MAX) {
+			return (EINVAL);
+		}
+
+		buf = kmem_alloc(arg2, KM_SLEEP);
+		if (copyin((void *)arg1, buf, arg2) != 0) {
+			lx_print("Failed to copyin scall arg at 0x%p\n",
+			    (void *) arg1);
+			kmem_free(buf, arg2);
+			/*
+			 * Purposely not setting br_scall_args to NULL
+			 * to preserve data for debugging.
+			 */
+			return (EFAULT);
+		}
+
+		if (lwpd->br_scall_args != NULL) {
+			ASSERT(lwpd->br_args_size > 0);
+			kmem_free(lwpd->br_scall_args,
+			    lwpd->br_args_size);
+		}
+
+		lwpd->br_scall_args = buf;
+		lwpd->br_args_size = arg2;
+		*rval = arg2;
+		return (0);
+	}
+
+	case B_HELPER_CLONE:
+		return (lx_helper_clone(rval, arg1, (void *)arg2, (void *)arg3,
+		    (void *)arg4));
+
+	case B_HELPER_SETGROUPS:
+		return (lx_helper_setgroups(arg1, (gid_t *)arg2));
+
+	case B_HELPER_SIGQUEUE:
+		return (lx_helper_rt_sigqueueinfo(arg1, arg2,
+		    (siginfo_t *)arg3));
+
+	case B_HELPER_TGSIGQUEUE:
+		return (lx_helper_rt_tgsigqueueinfo(arg1, arg2, arg3,
+		    (siginfo_t *)arg4));
+
+	case B_GETPID:
+		/*
+		 * The usermode clone(2) code needs to be able to call
+		 * lx_getpid() from native code:
+		 */
+		*rval = lx_getpid();
+		return (0);
+
+	case B_SET_NATIVE_STACK:
+		/*
+		 * B_SET_NATIVE_STACK subcommand
+		 * arg1 = the base of the stack to use for emulation
+		 */
+		if (lwpd->br_stack_mode != LX_STACK_MODE_PREINIT) {
+			lx_print("B_SET_NATIVE_STACK when stack was already "
+			    "set to %p\n", (void *)arg1);
+			return (EEXIST);
+		}
+
+		/*
+		 * We move from the PREINIT state, where we have no brand
+		 * emulation stack, to the INIT state.  Here, we are still
+		 * running on what will become the BRAND stack, but are running
+		 * emulation (i.e. native) code.  Once the initialisation
+		 * process for this thread has finished, we will jump to
+		 * brand-specific code, while moving to the BRAND mode.
+		 *
+		 * When a new LWP is created, lx_initlwp() will clear the
+		 * stack data.  If that LWP is actually being duplicated
+		 * into a child process by fork(2), lx_forklwp() will copy
+		 * it so that the cloned thread will keep using the same
+		 * alternate stack.
+		 */
+		lwpd->br_ntv_stack = arg1;
+		lwpd->br_stack_mode = LX_STACK_MODE_INIT;
+		lx_lwp_set_native_stack_current(lwpd, arg1);
+
+		return (0);
+
+	case B_GET_CURRENT_CONTEXT:
+		/*
+		 * B_GET_CURRENT_CONTEXT subcommand:
+		 * arg1 = address for pointer to current ucontext_t
+		 */
+
+#if defined(_SYSCALL32_IMPL)
+		if (get_udatamodel() != DATAMODEL_NATIVE) {
+			caddr32_t addr = (caddr32_t)lwp->lwp_oldcontext;
+
+			error = copyout(&addr, (void *)arg1, sizeof (addr));
+		} else
+#endif
+		{
+			error = copyout(&lwp->lwp_oldcontext, (void *)arg1,
+			    sizeof (lwp->lwp_oldcontext));
+		}
+
+		return (error != 0 ? EFAULT : 0);
+
+	case B_JUMP_TO_LINUX:
+		/*
+		 * B_JUMP_TO_LINUX subcommand:
+		 * arg1 = ucontext_t pointer for jump state
+		 */
+
+		if (arg1 == NULL)
+			return (EINVAL);
+
+		switch (lwpd->br_stack_mode) {
+		case LX_STACK_MODE_NATIVE: {
+			struct regs *rp = lwptoregs(lwp);
+
+			/*
+			 * We are on the NATIVE stack, so we must preserve
+			 * the extent of that stack.  The pointer will be
+			 * reset by a future setcontext().
+			 */
+			lx_lwp_set_native_stack_current(lwpd,
+			    (uintptr_t)rp->r_sp);
+			break;
+		}
+
+		case LX_STACK_MODE_INIT:
+			/*
+			 * The LWP is transitioning to Linux code for the first
+			 * time.
+			 */
+			break;
+
+		case LX_STACK_MODE_PREINIT:
+			/*
+			 * This LWP has not installed an alternate stack for
+			 * usermode emulation handling.
+			 */
+			return (ENOENT);
+
+		case LX_STACK_MODE_BRAND:
+			/*
+			 * The LWP should not be on the BRAND stack.
+			 */
+			exit(CLD_KILLED, SIGSYS);
+			return (0);
+		}
+
+		/*
+		 * Transfer control to Linux:
+		 */
+		return (lx_runexe(lwp, (void *)arg1));
+
+	case B_EMULATION_DONE:
+		/*
+		 * B_EMULATION_DONE subcommand:
+		 * arg1 = ucontext_t * to restore
+		 * arg2 = system call number
+		 * arg3 = return code
+		 * arg4 = if operation failed, the errno value
+		 */
+
+		/*
+		 * The first part of this operation is a setcontext() to
+		 * restore the register state to the copy we preserved
+		 * before vectoring to the usermode emulation routine.
+		 * If that fails, we return (hopefully) to the emulation
+		 * routine and it will handle the error.
+		 */
+#if (_SYSCALL32_IMPL)
+		if (get_udatamodel() != DATAMODEL_NATIVE) {
+			error = getsetcontext32(SETCONTEXT, (void *)arg1);
+		} else
+#endif
+		{
+			error = getsetcontext(SETCONTEXT, (void *)arg1);
+		}
+
+		if (error != 0) {
+			return (error);
+		}
+
+		/*
+		 * The saved Linux context has been restored.  We handle the
+		 * return value or errno with code common to the in-kernel
+		 * system call emulation.
+		 */
+		if ((error = (int)arg4) != 0) {
+			/*
+			 * lx_syscall_return() looks at the errno in the LWP,
+			 * so set it here:
+			 */
+			(void) set_errno(error);
+		}
+		lx_syscall_return(ttolwp(curthread), (int)arg2, (long)arg3);
+
+		return (0);
+
+	case B_EXIT_AS_SIG:
+		code = CLD_KILLED;
+		sig = (int)arg1;
+		proc_is_exiting(p);
+		if (exitlwps(1) != 0) {
+			mutex_enter(&p->p_lock);
+			lwp_exit();
+		}
+		ttolwp(curthread)->lwp_cursig = sig;
+		if (sig == SIGSEGV) {
+			if (core(sig, 0) == 0)
+				code = CLD_DUMPED;
+		}
+		exit(code, sig);
+		/* NOTREACHED */
+		break;
+
+	case B_OVERRIDE_KERN_VER: {
+		void *urel = (void *)arg1;
+		void *uver = (void *)arg2;
+		size_t len;
+
+		pd = ptolxproc(p);
+		if (urel != NULL) {
+			if (copyinstr(urel, pd->l_uname_release,
+			    LX_KERN_RELEASE_MAX, &len) != 0) {
+				return (EFAULT);
+			}
+			pd->l_uname_release[LX_KERN_RELEASE_MAX - 1] = '\0';
+		}
+		if (uver != NULL) {
+			if (copyinstr(uver, pd->l_uname_version,
+			    LX_KERN_VERSION_MAX, &len) != 0) {
+				return (EFAULT);
+			}
+			pd->l_uname_version[LX_KERN_VERSION_MAX - 1] = '\0';
+		}
+
+		return (0);
+	}
+
+	case B_GET_PERSONALITY: {
+		unsigned int result;
+
+		mutex_enter(&p->p_lock);
+		pd = ptolxproc(p);
+		result = pd->l_personality;
+		mutex_exit(&p->p_lock);
+		return (result);
+	}
+
+	case B_START_NFS_LOCKD:
+		(void) lx_start_nfs_lockd();
+		return (0);
+
+	case B_BLOCK_ALL_SIGS:
+		mutex_enter(&p->p_lock);
+		pd = ptolxproc(p);
+		pd->l_block_all_signals++;
+		mutex_exit(&p->p_lock);
+		return (0);
+
+	case B_UNBLOCK_ALL_SIGS: {
+		uint_t result;
+
+		mutex_enter(&p->p_lock);
+		pd = ptolxproc(p);
+		if (pd->l_block_all_signals == 0) {
+			result = set_errno(EINVAL);
+		} else {
+			pd->l_block_all_signals--;
+			result = 0;
+		}
+		mutex_exit(&p->p_lock);
+		return (result);
+	}
+	}
+
+	return (EINVAL);
+}
+
+/*
+ * Compare linux kernel version to the one set for the zone.
+ * Returns greater than 0 if zone version is higher, less than 0 if the zone
+ * version is lower, and 0 if the versions are equal.
+ */
+int
+lx_kern_release_cmp(zone_t *zone, const char *vers)
+{
+	int zvers[3] = {0, 0, 0};
+	int cvers[3] = {0, 0, 0};
+	int i;
+	lx_zone_data_t *lxzd = (lx_zone_data_t *)zone->zone_brand_data;
+
+	VERIFY(zone->zone_brand == &lx_brand);
+
+	mutex_enter(&lxzd->lxzd_lock);
+	(void) sscanf(lxzd->lxzd_kernel_release, "%d.%d.%d", &zvers[0],
+	    &zvers[1], &zvers[2]);
+	mutex_exit(&lxzd->lxzd_lock);
+	(void) sscanf(vers, "%d.%d.%d", &cvers[0], &cvers[1], &cvers[2]);
+
+	for (i = 0; i < 3; i++) {
+		if (zvers[i] > cvers[i]) {
+			return (1);
+		} else if (zvers[i] < cvers[i]) {
+			return (-1);
+		}
+	}
+	return (0);
+}
+
+/*
+ * Linux unconditionally removes the setuid and setgid bits when changing
+ * file ownership.  This brand hook overrides the illumos native behaviour,
+ * which is based on the PRIV_FILE_SETID privilege.
+ */
+/* ARGSUSED */
+static int
+lx_setid_clear(vattr_t *vap, cred_t *cr)
+{
+	if (S_ISDIR(vap->va_mode)) {
+		return (0);
+	}
+
+	if (vap->va_mode & S_ISUID) {
+		vap->va_mask |= AT_MODE;
+		vap->va_mode &= ~S_ISUID;
+	}
+	if ((vap->va_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
+		vap->va_mask |= AT_MODE;
+		vap->va_mode &= ~S_ISGID;
+	}
+
+	return (0);
+}
+
+/*
+ * Copy the per-process brand data from a parent proc to a child.
+ */
+void
+lx_copy_procdata(proc_t *cp, proc_t *pp)
+{
+	lx_proc_data_t *cpd, *ppd;
+
+	/*
+	 * Since b_copy_procdata is called during getproc(), while the child
+	 * process is still being initialized, acquiring cp->p_lock should not
+	 * be required.
+	 */
+	VERIFY(cp->p_brand == &lx_brand);
+	VERIFY((cpd = cp->p_brand_data) != NULL);
+
+	mutex_enter(&pp->p_lock);
+	VERIFY(pp->p_brand == &lx_brand);
+	VERIFY((ppd = pp->p_brand_data) != NULL);
+
+	bcopy(ppd, cpd, sizeof (lx_proc_data_t));
+	mutex_exit(&pp->p_lock);
+
+	/* Clear any aio contexts from child */
+	lx_io_clear(cpd);
+
+	/*
+	 * The l_ptrace count is normally manipulated only while under holding
+	 * p_lock.  Since this is a freshly created process, it's safe to zero
+	 * out.  If it is to be inherited, the attach will occur later.
+	 */
+	cpd->l_ptrace = 0;
+
+	cpd->l_fake_limits[LX_RLFAKE_LOCKS].rlim_cur = LX_RLIM64_INFINITY;
+	cpd->l_fake_limits[LX_RLFAKE_LOCKS].rlim_max = LX_RLIM64_INFINITY;
+
+	cpd->l_fake_limits[LX_RLFAKE_NICE].rlim_cur = 20;
+	cpd->l_fake_limits[LX_RLFAKE_NICE].rlim_max = 20;
+
+	cpd->l_fake_limits[LX_RLFAKE_RTPRIO].rlim_cur = LX_RLIM64_INFINITY;
+	cpd->l_fake_limits[LX_RLFAKE_RTPRIO].rlim_max = LX_RLIM64_INFINITY;
+
+	cpd->l_fake_limits[LX_RLFAKE_RTTIME].rlim_cur = LX_RLIM64_INFINITY;
+	cpd->l_fake_limits[LX_RLFAKE_RTTIME].rlim_max = LX_RLIM64_INFINITY;
+
+	bzero(cpd->l_clone_grps, sizeof (cpd->l_clone_grps));
+}
+
+#if defined(_LP64)
+static void
+Ehdr32to64(Elf32_Ehdr *src, Ehdr *dst)
+{
+	bcopy(src->e_ident, dst->e_ident, sizeof (src->e_ident));
+	dst->e_type =		src->e_type;
+	dst->e_machine =	src->e_machine;
+	dst->e_version =	src->e_version;
+	dst->e_entry =		src->e_entry;
+	dst->e_phoff =		src->e_phoff;
+	dst->e_shoff =		src->e_shoff;
+	dst->e_flags =		src->e_flags;
+	dst->e_ehsize =		src->e_ehsize;
+	dst->e_phentsize =	src->e_phentsize;
+	dst->e_phnum =		src->e_phnum;
+	dst->e_shentsize =	src->e_shentsize;
+	dst->e_shnum =		src->e_shnum;
+	dst->e_shstrndx =	src->e_shstrndx;
+}
+#endif /* _LP64 */
+
+static void
+restoreexecenv(struct execenv *ep, stack_t *sp)
+{
+	klwp_t *lwp = ttolwp(curthread);
+
+	setexecenv(ep);
+	lwp->lwp_sigaltstack.ss_sp = sp->ss_sp;
+	lwp->lwp_sigaltstack.ss_size = sp->ss_size;
+	lwp->lwp_sigaltstack.ss_flags = sp->ss_flags;
+}
+
+extern int elfexec(vnode_t *, execa_t *, uarg_t *, intpdata_t *, int,
+    long *, int, caddr_t, cred_t *, int *);
+
+extern int elf32exec(struct vnode *, execa_t *, uarg_t *, intpdata_t *, int,
+    long *, int, caddr_t, cred_t *, int *);
+
+static uintptr_t
+lx_map_vdso(struct uarg *args, struct cred *cred)
+{
+	int err;
+	char *fpath = LX_VDSO_PATH;
+	vnode_t *vp;
+	vattr_t attr;
+	caddr_t addr;
+
+#if defined(_LP64)
+	if (args->to_model != DATAMODEL_NATIVE) {
+		fpath = LX_VDSO_PATH32;
+	}
+#endif
+
+	/*
+	 * The comm page should have been mapped in already.
+	 */
+	if (args->commpage == NULL) {
+		return (NULL);
+	}
+
+	/*
+	 * Ensure the VDSO library is present and appropriately sized.
+	 * This lookup is started at the zone root to avoid complications for
+	 * processes which have chrooted.  For the specified lookup root to be
+	 * used, the leading slash must be dropped from the path.
+	 */
+	ASSERT(fpath[0] == '/');
+	fpath++;
+	if (lookupnameat(fpath, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp,
+	    curzone->zone_rootvp) != 0) {
+		return (NULL);
+	}
+
+	/*
+	 * The VDSO requires data exposed via the comm page in order to
+	 * function properly.  The VDSO is always mapped in at a fixed known
+	 * offset from the comm page, providing an easy means to locate it.
+	 */
+	addr = (caddr_t)(args->commpage - LX_VDSO_SIZE);
+	attr.va_mask = AT_SIZE;
+	if (VOP_GETATTR(vp, &attr, 0, cred, NULL) != 0 ||
+	    attr.va_size > LX_VDSO_SIZE) {
+		VN_RELE(vp);
+		return (NULL);
+	}
+
+	err = execmap(vp, addr, attr.va_size, 0, 0,
+	    PROT_USER|PROT_READ|PROT_EXEC, 1, 0);
+	VN_RELE(vp);
+	if (err != 0) {
+		return (NULL);
+	}
+	return ((uintptr_t)addr);
+}
+
+/*
+ * Exec routine called by elfexec() to load either 32-bit or 64-bit Linux
+ * binaries.
+ */
+/* ARGSUSED4 */
+static int
+lx_elfexec(struct vnode *vp, struct execa *uap, struct uarg *args,
+    struct intpdata *idata, int level, long *execsz, int setid,
+    caddr_t exec_file, struct cred *cred, int *brand_action)
+{
+	int		error, i;
+	vnode_t		*nvp;
+	Ehdr		ehdr;
+	Addr		uphdr_vaddr;
+	intptr_t	voffset;
+	char		*interp = NULL;
+	uintptr_t	ldaddr = NULL;
+	proc_t		*p = ttoproc(curthread);
+	klwp_t		*lwp = ttolwp(curthread);
+	lx_proc_data_t	*lxpd = ptolxproc(p);
+	struct execenv	env, origenv;
+	stack_t		orig_sigaltstack;
+	struct user	*up = PTOU(ttoproc(curthread));
+	lx_elf_data_t	edp;
+	char		*lib_path = LX_LIB_PATH;
+	boolean_t	execstk = B_TRUE;
+	unsigned int	personality;
+
+	ASSERT(p->p_brand == &lx_brand);
+	ASSERT(lxpd != NULL);
+
+	/*
+	 * Start with a separate struct for ELF data instead of inheriting
+	 * values from the currently running binary.  This ensures that fields
+	 * such as ed_base are cleared if the new binary does not utilize an
+	 * interpreter.
+	 */
+	bzero(&edp, sizeof (edp));
+
+#if defined(_LP64)
+	if (args->to_model != DATAMODEL_NATIVE) {
+		lib_path = LX_LIB_PATH32;
+	}
+#endif
+
+	/*
+	 * Set the brandname and library name for the new process so that
+	 * elfexec() puts them onto the stack.
+	 */
+	args->brandname = LX_BRANDNAME;
+	args->emulator = lib_path;
+
+#if defined(_LP64)
+	/*
+	 * To conform with the way Linux lays out the address space, we clamp
+	 * the stack to be the top of the lower region of the x86-64 canonical
+	 * form address space -- which has the side-effect of laying out the
+	 * entire address space in that lower region.  Note that this only
+	 * matters on 64-bit processes (this value will always be greater than
+	 * the size of a 32-bit address space) and doesn't actually affect
+	 * USERLIMIT:  if a Linux-branded processes wishes to map something
+	 * into the top half of the address space, it can do so -- but with
+	 * the user stack starting at the top of the bottom region, those high
+	 * virtual addresses won't be used unless explicitly directed.
+	 */
+	args->maxstack = lx_maxstack64;
+#endif
+
+	/*
+	 * Search the binary for a PT_GNU_STACK header.  The PF_X bit contained
+	 * within is used to dictate protection defaults for the stack, among
+	 * other things.
+	 */
+	if (args->to_model == DATAMODEL_NATIVE) {
+		Ehdr ehdr;
+		Phdr *phdrp;
+		caddr_t phdrbase = NULL;
+		ssize_t phdrsize = 0;
+		int nphdrs, hsize;
+
+		if ((error = elfreadhdr(vp, cred, &ehdr, &nphdrs, &phdrbase,
+		    &phdrsize)) != 0) {
+			return (error);
+		}
+
+		hsize = ehdr.e_phentsize;
+		/* LINTED: alignment */
+		phdrp = (Phdr *)phdrbase;
+		for (i = nphdrs; i > 0; i--) {
+			switch (phdrp->p_type) {
+			case PT_GNU_STACK:
+				if ((phdrp->p_flags & PF_X) == 0) {
+					execstk = B_FALSE;
+				}
+				break;
+			}
+			/* LINTED: alignment */
+			phdrp = (Phdr *)((caddr_t)phdrp + hsize);
+		}
+		kmem_free(phdrbase, phdrsize);
+	}
+#if defined(_LP64)
+	else {
+		Elf32_Ehdr ehdr;
+		Elf32_Phdr *phdrp;
+		caddr_t phdrbase = NULL;
+		ssize_t phdrsize = 0;
+		int nphdrs, hsize;
+
+		if ((error = elf32readhdr(vp, cred, &ehdr, &nphdrs, &phdrbase,
+		    &phdrsize)) != 0) {
+			return (error);
+		}
+
+		hsize = ehdr.e_phentsize;
+		/* LINTED: alignment */
+		phdrp = (Elf32_Phdr *)phdrbase;
+		for (i = nphdrs; i > 0; i--) {
+			switch (phdrp->p_type) {
+			case PT_GNU_STACK:
+				if ((phdrp->p_flags & PF_X) == 0) {
+					execstk = B_FALSE;
+				}
+				break;
+			}
+			/* LINTED: alignment */
+			phdrp = (Elf32_Phdr *)((caddr_t)phdrp + hsize);
+		}
+		kmem_free(phdrbase, phdrsize);
+	}
+#endif
+
+	/*
+	 * Revert the base personality while maintaining any existing flags.
+	 */
+	personality = LX_PER_LINUX | (lxpd->l_personality & ~LX_PER_MASK);
+
+	/*
+	 * Linux defaults to an executable stack unless the aformentioned
+	 * PT_GNU_STACK entry in the elf header dictates otherwise.  Enabling
+	 * the READ_IMPLIES_EXEC personality flag is also implied in this case.
+	 */
+	if (execstk) {
+		args->stk_prot |= PROT_EXEC;
+		args->stk_prot_override = B_TRUE;
+		personality |= LX_PER_READ_IMPLIES_EXEC;
+	}
+
+	/*
+	 * We will first exec the brand library, then map in the linux
+	 * executable and the linux linker.
+	 */
+	if ((error = lookupname(lib_path, UIO_SYSSPACE, FOLLOW, NULLVPP,
+	    &nvp))) {
+		uprintf("%s: not found.", lib_path);
+		return (error);
+	}
+
+	/*
+	 * We will eventually set the p_exec member to be the vnode for the new
+	 * executable when we call setexecenv(). However, if we get an error
+	 * before that call we need to restore the execenv to its original
+	 * values so that when we return to the caller fop_close() works
+	 * properly while cleaning up from the failed exec().  Restoring the
+	 * original value will also properly decrement the 2nd VN_RELE that we
+	 * took on the brand library.
+	 */
+	origenv.ex_bssbase = p->p_bssbase;
+	origenv.ex_brkbase = p->p_brkbase;
+	origenv.ex_brksize = p->p_brksize;
+	origenv.ex_vp = p->p_exec;
+	orig_sigaltstack.ss_sp = lwp->lwp_sigaltstack.ss_sp;
+	orig_sigaltstack.ss_size = lwp->lwp_sigaltstack.ss_size;
+	orig_sigaltstack.ss_flags = lwp->lwp_sigaltstack.ss_flags;
+
+	if (args->to_model == DATAMODEL_NATIVE) {
+		error = elfexec(nvp, uap, args, idata, INTP_MAXDEPTH + 1,
+		    execsz, setid, exec_file, cred, brand_action);
+	}
+#if defined(_LP64)
+	else {
+		error = elf32exec(nvp, uap, args, idata, INTP_MAXDEPTH + 1,
+		    execsz, setid, exec_file, cred, brand_action);
+	}
+#endif
+	VN_RELE(nvp);
+	if (error != 0) {
+		restoreexecenv(&origenv, &orig_sigaltstack);
+		return (error);
+	}
+
+	/*
+	 * exec-ed in the brand library above.
+	 * The u_auxv vectors are now setup by elfexec to point to the
+	 * brand emulation library and its linker.
+	 */
+
+	/*
+	 * After execing the brand library (which should have implicitly mapped
+	 * in the comm page), map the VDSO into the approprate place in the AS.
+	 */
+	lxpd->l_vdso = lx_map_vdso(args, cred);
+
+	bzero(&env, sizeof (env));
+
+	/*
+	 * map in the the Linux executable
+	 */
+	if (args->to_model == DATAMODEL_NATIVE) {
+		error = mapexec_brand(vp, args, &ehdr, &uphdr_vaddr,
+		    &voffset, exec_file, &interp, &env.ex_bssbase,
+		    &env.ex_brkbase, &env.ex_brksize, NULL, NULL);
+	}
+#if defined(_LP64)
+	else {
+		Elf32_Ehdr	ehdr32;
+		Elf32_Addr	uphdr_vaddr32;
+
+		error = mapexec32_brand(vp, args, &ehdr32, &uphdr_vaddr32,
+		    &voffset, exec_file, &interp, &env.ex_bssbase,
+		    &env.ex_brkbase, &env.ex_brksize, NULL, NULL);
+
+		Ehdr32to64(&ehdr32, &ehdr);
+
+		if (uphdr_vaddr32 == (Elf32_Addr)-1)
+			uphdr_vaddr = (Addr)-1;
+		else
+			uphdr_vaddr = uphdr_vaddr32;
+	}
+#endif
+	if (error != 0) {
+		restoreexecenv(&origenv, &orig_sigaltstack);
+
+		if (interp != NULL)
+			kmem_free(interp, MAXPATHLEN);
+
+		return (error);
+	}
+
+	/*
+	 * Save off the important properties of the lx executable. The brand
+	 * library will ask us for this data later, when it is ready to set
+	 * things up for the lx executable.
+	 */
+	edp.ed_phdr = (uphdr_vaddr == -1) ? voffset + ehdr.e_phoff :
+	    voffset + uphdr_vaddr;
+	edp.ed_entry = voffset + ehdr.e_entry;
+	edp.ed_phent = ehdr.e_phentsize;
+	edp.ed_phnum = ehdr.e_phnum;
+
+	if (interp != NULL) {
+		if (ehdr.e_type == ET_DYN) {
+			/*
+			 * This is a shared object executable, so we need to
+			 * pick a reasonable place to put the heap. Just don't
+			 * use the first page.
+			 */
+			env.ex_brkbase = (caddr_t)PAGESIZE;
+			env.ex_bssbase = (caddr_t)PAGESIZE;
+		}
+
+		/*
+		 * If the program needs an interpreter (most do), map it in and
+		 * store relevant information about it in the aux vector, where
+		 * the brand library can find it.
+		 */
+		if ((error = lookupname(interp, UIO_SYSSPACE, FOLLOW,
+		    NULLVPP, &nvp))) {
+			uprintf("%s: not found.", interp);
+			restoreexecenv(&origenv, &orig_sigaltstack);
+			kmem_free(interp, MAXPATHLEN);
+			return (error);
+		}
+
+		kmem_free(interp, MAXPATHLEN);
+		interp = NULL;
+
+		/*
+		 * map in the Linux linker
+		 */
+		if (args->to_model == DATAMODEL_NATIVE) {
+			error = mapexec_brand(nvp, args, &ehdr,
+			    &uphdr_vaddr, &voffset, exec_file, NULL, NULL,
+			    NULL, NULL, NULL, &ldaddr);
+		}
+#if defined(_LP64)
+		else {
+			Elf32_Ehdr	ehdr32;
+			Elf32_Addr	uphdr_vaddr32;
+
+			error = mapexec32_brand(nvp, args, &ehdr32,
+			    &uphdr_vaddr32, &voffset, exec_file, NULL, NULL,
+			    NULL, NULL, NULL, &ldaddr);
+
+			Ehdr32to64(&ehdr32, &ehdr);
+
+			if (uphdr_vaddr32 == (Elf32_Addr)-1)
+				uphdr_vaddr = (Addr)-1;
+			else
+				uphdr_vaddr = uphdr_vaddr32;
+		}
+#endif
+
+		VN_RELE(nvp);
+		if (error != 0) {
+			restoreexecenv(&origenv, &orig_sigaltstack);
+			return (error);
+		}
+
+		/*
+		 * Now that we know the base address of the brand's linker,
+		 * we also save this for later use by the brand library.
+		 */
+		edp.ed_base = voffset;
+		edp.ed_ldentry = voffset + ehdr.e_entry;
+	} else {
+		/*
+		 * This program has no interpreter. The lx brand library will
+		 * jump to the address in the AT_SUN_BRAND_LDENTRY aux vector,
+		 * so in this case, put the entry point of the main executable
+		 * there.
+		 */
+		if (ehdr.e_type == ET_EXEC) {
+			/*
+			 * An executable with no interpreter, this must be a
+			 * statically linked executable, which means we loaded
+			 * it at the address specified in the elf header, in
+			 * which case the e_entry field of the elf header is an
+			 * absolute address.
+			 */
+			edp.ed_ldentry = ehdr.e_entry;
+			edp.ed_entry = ehdr.e_entry;
+		} else {
+			/*
+			 * A shared object with no interpreter, we use the
+			 * calculated address from above.
+			 */
+			edp.ed_ldentry = edp.ed_entry;
+
+			/*
+			 * In all situations except an ET_DYN elf object with no
+			 * interpreter, we want to leave the brk and base
+			 * values set by mapexec_brand alone. Normally when
+			 * running ET_DYN objects on Solaris (most likely
+			 * /lib/ld.so.1) the kernel sets brk and base to 0 since
+			 * it doesn't know where to put the heap, and later the
+			 * linker will call brk() to initialize the heap in:
+			 *	usr/src/cmd/sgs/rtld/common/setup.c:setup()
+			 * after it has determined where to put it.  (This
+			 * decision is made after the linker loads and inspects
+			 * elf properties of the target executable being run.)
+			 *
+			 * So for ET_DYN Linux executables, we also don't know
+			 * where the heap should go, so we'll set the brk and
+			 * base to 0.  But in this case the Solaris linker will
+			 * not initialize the heap, so when the Linux linker
+			 * starts running there is no heap allocated.  This
+			 * seems to be ok on Linux 2.4 based systems because the
+			 * Linux linker/libc fall back to using mmap() to
+			 * allocate memory. But on 2.6 systems, running
+			 * applications by specifying them as command line
+			 * arguments to the linker results in segfaults for an
+			 * as yet undetermined reason (which seems to indicatej
+			 * that a more permanent fix for heap initalization in
+			 * these cases may be necessary).
+			 */
+			if (ehdr.e_type == ET_DYN) {
+				env.ex_bssbase = (caddr_t)0;
+				env.ex_brkbase = (caddr_t)0;
+				env.ex_brksize = 0;
+			}
+		}
+	}
+
+	env.ex_vp = vp;
+	setexecenv(&env);
+
+	/*
+	 * We try to keep /proc's view of the aux vector consistent with
+	 * what's on the process stack. See the comment on the lx_times
+	 * syscall for an explanation of the hardcoded LX_USERHZ.
+	 */
+	if (args->to_model == DATAMODEL_NATIVE) {
+		auxv_t phdr_auxv[4] = {
+		    { AT_SUN_BRAND_LX_PHDR, 0 },
+		    { AT_SUN_BRAND_LX_INTERP, 0 },
+		    { AT_SUN_BRAND_LX_CLKTCK, 0 },
+		    { AT_SUN_BRAND_LX_SYSINFO_EHDR, 0 }
+		};
+		phdr_auxv[0].a_un.a_val = edp.ed_phdr;
+		phdr_auxv[1].a_un.a_val = ldaddr;
+		phdr_auxv[2].a_un.a_val = LX_USERHZ;
+		phdr_auxv[3].a_un.a_val = lxpd->l_vdso;
+
+		if (copyout(&phdr_auxv, args->auxp_brand,
+		    sizeof (phdr_auxv)) == -1)
+			return (EFAULT);
+	}
+#if defined(_LP64)
+	else {
+		auxv32_t phdr_auxv32[4] = {
+		    { AT_SUN_BRAND_LX_PHDR, 0 },
+		    { AT_SUN_BRAND_LX_INTERP, 0 },
+		    { AT_SUN_BRAND_LX_CLKTCK, 0 },
+		    { AT_SUN_BRAND_LX_SYSINFO_EHDR, 0 }
+		};
+		phdr_auxv32[0].a_un.a_val = edp.ed_phdr;
+		phdr_auxv32[1].a_un.a_val = ldaddr;
+		phdr_auxv32[2].a_un.a_val = hz;
+		phdr_auxv32[3].a_un.a_val = lxpd->l_vdso;
+
+		if (copyout(&phdr_auxv32, args->auxp_brand,
+		    sizeof (phdr_auxv32)) == -1)
+			return (EFAULT);
+	}
+#endif
+
+	/*
+	 * /proc uses the AT_ENTRY aux vector entry to deduce
+	 * the location of the executable in the address space. The user
+	 * structure contains a copy of the aux vector that needs to have those
+	 * entries patched with the values of the real lx executable (they
+	 * currently contain the values from the lx brand library that was
+	 * elfexec'd, above).
+	 *
+	 * For live processes, AT_BASE is used to locate the linker segment,
+	 * which /proc and friends will later use to find Solaris symbols
+	 * (such as rtld_db_preinit). However, for core files, /proc uses
+	 * AT_ENTRY to find the right segment to label as the executable.
+	 * So we set AT_ENTRY to be the entry point of the linux executable,
+	 * but leave AT_BASE to be the address of the Solaris linker.
+	 */
+	for (i = 0; i < __KERN_NAUXV_IMPL; i++) {
+		switch (up->u_auxv[i].a_type) {
+		case AT_ENTRY:
+			up->u_auxv[i].a_un.a_val = edp.ed_entry;
+			break;
+
+		case AT_SUN_BRAND_LX_PHDR:
+			up->u_auxv[i].a_un.a_val = edp.ed_phdr;
+			break;
+
+		case AT_SUN_BRAND_LX_INTERP:
+			up->u_auxv[i].a_un.a_val = ldaddr;
+			break;
+
+		case AT_SUN_BRAND_LX_CLKTCK:
+			up->u_auxv[i].a_un.a_val = hz;
+			break;
+
+		default:
+			break;
+		}
+	}
+
+	/*
+	 * Record the brand ELF data and new personality now that the exec has
+	 * proceeded successfully.
+	 */
+	bcopy(&edp, &lxpd->l_elf_data, sizeof (edp));
+	lxpd->l_personality = personality;
+
+	return (0);
+}
+
+boolean_t
+lx_native_exec(uint8_t osabi, const char **interp)
+{
+	if (osabi != ELFOSABI_SOLARIS)
+		return (B_FALSE);
+
+	/*
+	 * If the process root matches the zone root, prepend /native to the
+	 * interpreter path for native executables.  Absolute precision from
+	 * VN_CMP is not necessary since any change of process root is likely
+	 * to make native binaries inaccessible via /native.
+	 *
+	 * Processes which chroot directly into /native will be able to
+	 * function as expected with no need for the prefix.
+	 */
+	mutex_enter(&curproc->p_lock);
+	if (VN_CMP(curproc->p_user.u_rdir, curproc->p_zone->zone_rootvp)) {
+		*interp = "/native";
+	}
+	mutex_exit(&curproc->p_lock);
+
+	return (B_TRUE);
+}
+
+static void
+lx_syscall_init(void)
+{
+	int i;
+
+	/*
+	 * Count up the 32-bit Linux system calls.  Note that lx_sysent32
+	 * has (LX_NSYSCALLS + 1) entries.
+	 */
+	for (i = 0; i <= LX_NSYSCALLS && lx_sysent32[i].sy_name != NULL; i++)
+		continue;
+	lx_nsysent32 = i;
+
+#if defined(_LP64)
+	/*
+	 * Count up the 64-bit Linux system calls.  Note that lx_sysent64
+	 * has (LX_NSYSCALLS + 1) entries.
+	 */
+	for (i = 0; i <= LX_NSYSCALLS && lx_sysent64[i].sy_name != NULL; i++)
+		continue;
+	lx_nsysent64 = i;
+#endif
+}
+
+int
+_init(void)
+{
+	int err = 0;
+
+	/* Initialize USER_HZ scaling factor */
+	ASSERT(hz >= LX_USERHZ);
+	lx_hz_scale = hz / LX_USERHZ;
+
+	lx_syscall_init();
+	lx_pid_init();
+	lx_ioctl_init();
+	lx_futex_init();
+	lx_ptrace_init();
+	lx_socket_init();
+	lx_audit_ld();
+
+	err = mod_install(&modlinkage);
+	if (err != 0) {
+		cmn_err(CE_WARN, "Couldn't install lx brand module");
+
+		/*
+		 * This looks drastic, but it should never happen.  These
+		 * two data structures should be completely free-able until
+		 * they are used by Linux processes.  Since the brand
+		 * wasn't loaded there should be no Linux processes, and
+		 * thus no way for these data structures to be modified.
+		 */
+		lx_pid_fini();
+		lx_ioctl_fini();
+		if (lx_futex_fini())
+			panic("lx brand module cannot be loaded or unloaded.");
+	}
+	return (err);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int err;
+	int futex_done = 0;
+
+	/*
+	 * If there are any zones using this brand, we can't allow it to be
+	 * unloaded.
+	 */
+	if (brand_zone_count(&lx_brand))
+		return (EBUSY);
+
+	lx_ptrace_fini();
+	lx_pid_fini();
+	lx_ioctl_fini();
+	lx_socket_fini();
+	lx_audit_unld();
+
+	if ((err = lx_futex_fini()) != 0) {
+		goto done;
+	}
+	futex_done = 1;
+
+	err = mod_remove(&modlinkage);
+
+done:
+	if (err) {
+		/*
+		 * If we can't unload the module, then we have to get it
+		 * back into a sane state.
+		 */
+		lx_ptrace_init();
+		lx_pid_init();
+		lx_ioctl_init();
+		lx_socket_init();
+
+		if (futex_done) {
+			lx_futex_init();
+		}
+	}
+
+	return (err);
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_lockd.c b/usr/src/uts/common/brand/lx/os/lx_lockd.c
new file mode 100644
index 0000000000..d6d965398a
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_lockd.c
@@ -0,0 +1,338 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * lx_start_nfs_lockd() starts an NFS lockd (lx_lockd) process inside the zone.
+ * This uses the same technique as used in our lx cgroupfs to launch a release
+ * agent process. This is called implicitly when an NFS mount syscall occurs
+ * within the zone. See the user-level lx_lockd source for the "big theory"
+ * comment behind this.
+ *
+ * lx_upcall_statd() is a brand hook that interposes on the rpc.statd RPC
+ * handling so that we can interface to a Linux rpc.statd that must run
+ * when NFSv3 locking is in use. The rpc.statd handles server or client reboots
+ * and interacts with the lockd to reclaim locks after the server reboots. The
+ * rcp.statd also informs the server when we reboot, so the server can release
+ * the locks we held.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/errno.h>
+#include <sys/cred.h>
+#include <sys/systm.h>
+#include <sys/policy.h>
+#include <sys/vmparam.h>
+#include <sys/contract_impl.h>
+#include <sys/pool.h>
+#include <sys/stack.h>
+#include <sys/var.h>
+#include <sys/rt.h>
+#include <sys/fx.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/pathname.h>
+#include <rpcsvc/nlm_prot.h>
+#include <rpcsvc/sm_inter.h>
+#include <klm/nlm_impl.h>
+
+#define	LX_LOCKD_PATH	"/native/usr/lib/brand/lx/lx_lockd"
+
+/* Linux lockd RPC called by statd when it detects an NFS server reboot */
+#define	LX_NLMPROC_NSM_NOTIFY	16
+
+/* From uts/common/klm/nlm_impl.c */
+extern void nlm_netbuf_to_netobj(struct netbuf *, int *, netobj *);
+extern void nlm_nsm_clnt_init(CLIENT *, struct nlm_nsm *);
+
+/*
+ * Check if the current lockd is still running.
+ */
+static boolean_t
+lx_lockd_alive(pid_t lockd_pid)
+{
+	boolean_t ret = B_FALSE;
+	proc_t *p;
+	vnode_t *vp;
+	char path[MAXPATHLEN];
+
+	mutex_enter(&pidlock);
+	p = prfind(lockd_pid);
+	if (p == NULL) {
+		mutex_exit(&pidlock);
+		return (B_FALSE);
+	}
+
+	mutex_enter(&p->p_lock);
+	if (p->p_stat == SZOMB || (p->p_flag & SEXITING) != 0) {
+		mutex_exit(&p->p_lock);
+		mutex_exit(&pidlock);
+		return (B_FALSE);
+	}
+	vp = p->p_exec;
+	VN_HOLD(vp);
+	mutex_exit(&p->p_lock);
+	mutex_exit(&pidlock);
+
+	if (vnodetopath(NULL, vp, path, sizeof (path), CRED()) == 0 &&
+	    strcmp(path, LX_LOCKD_PATH) == 0) {
+		ret = B_TRUE;
+	}
+
+	VN_RELE(vp);
+	return (ret);
+}
+
+static void
+lx_run_lockd(void *a)
+{
+	proc_t *p = curproc;
+	zone_t *z = curzone;
+	struct core_globals *cg;
+	lx_zone_data_t *lxzd = ztolxzd(z);
+	int res;
+
+	ASSERT(!INGLOBALZONE(p));
+	VERIFY(lxzd != NULL);
+
+	/* The following block is derived from start_init_common */
+	ASSERT_STACK_ALIGNED();
+
+	p->p_cstime = p->p_stime = p->p_cutime = p->p_utime = 0;
+	p->p_usrstack = (caddr_t)USRSTACK32;
+	p->p_model = DATAMODEL_ILP32;
+	p->p_stkprot = PROT_ZFOD & ~PROT_EXEC;
+	p->p_datprot = PROT_ZFOD & ~PROT_EXEC;
+	p->p_stk_ctl = INT32_MAX;
+
+	p->p_as = as_alloc();
+	p->p_as->a_proc = p;
+	p->p_as->a_userlimit = (caddr_t)USERLIMIT32;
+	(void) hat_setup(p->p_as->a_hat, HAT_INIT);
+
+	VERIFY((cg = zone_getspecific(core_zone_key, z)) != NULL);
+
+	corectl_path_hold(cg->core_default_path);
+	corectl_content_hold(cg->core_default_content);
+
+	p->p_corefile = cg->core_default_path;
+	p->p_content = cg->core_default_content;
+
+	init_mstate(curthread, LMS_SYSTEM);
+	res = exec_init(LX_LOCKD_PATH, NULL);
+
+	/* End of code derived from start_init_common */
+
+	/* The following is derived from zone_start_init - see comments there */
+	if (res != 0 || zone_status_get(global_zone) >= ZONE_IS_SHUTTING_DOWN) {
+		if (proc_exit(CLD_EXITED, res) != 0) {
+			mutex_enter(&p->p_lock);
+			ASSERT(p->p_flag & SEXITLWPS);
+			lwp_exit();
+		}
+	} else {
+		id_t cid = curthread->t_cid;
+
+		mutex_enter(&class_lock);
+		ASSERT(cid < loaded_classes);
+		if (strcmp(sclass[cid].cl_name, "FX") == 0 &&
+		    z->zone_fixed_hipri) {
+			pcparms_t pcparms;
+
+			pcparms.pc_cid = cid;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_upri = FXMAXUPRI;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_uprilim =
+			    FXMAXUPRI;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_cflags =
+			    FX_DOUPRILIM | FX_DOUPRI;
+
+			mutex_enter(&pidlock);
+			mutex_enter(&p->p_lock);
+			(void) parmsset(&pcparms, curthread);
+			mutex_exit(&p->p_lock);
+			mutex_exit(&pidlock);
+		} else if (strcmp(sclass[cid].cl_name, "RT") == 0) {
+			curthread->t_pri = RTGPPRIO0;
+		}
+		mutex_exit(&class_lock);
+
+		/*
+		 * Set our pid as the lockd pid in the zone data, or exit
+		 * if another process raced and already did so.
+		 */
+		mutex_enter(&lxzd->lxzd_lock);
+		if (lxzd->lxzd_lockd_pid != 0) {
+			/* another mount raced and created a new lockd */
+			mutex_exit(&lxzd->lxzd_lock);
+			if (proc_exit(CLD_EXITED, 0) != 0) {
+				mutex_enter(&p->p_lock);
+				ASSERT(p->p_flag & SEXITLWPS);
+				lwp_exit();
+			}
+			return;
+		}
+		lxzd->lxzd_lockd_pid = p->p_pid;
+		mutex_exit(&lxzd->lxzd_lock);
+
+		/* cause the process to return to userland. */
+		lwp_rtt();
+	}
+}
+
+/*
+ * Launch the user-level, native, lx_lockd process.
+ */
+int
+lx_start_nfs_lockd()
+{
+	id_t cid;
+	proc_t *p = ttoproc(curthread);
+	zone_t *z = p->p_zone;
+	lx_zone_data_t *lxzd = ztolxzd(z);
+
+	ASSERT(!INGLOBALZONE(p));
+	ASSERT(lxzd != NULL);
+
+	/*
+	 * This should only be called by the mount emulation, which must have
+	 * 'root' privileges in order to have performed a mount, but
+	 * double-check.
+	 */
+	if (crgetuid(CRED()) != 0)
+		return (EPERM);
+
+	mutex_enter(&lxzd->lxzd_lock);
+	if (lxzd->lxzd_lockd_pid != 0) {
+		/* verify lockd is still alive */
+		pid_t lockd_pid;
+
+		lockd_pid = lxzd->lxzd_lockd_pid;
+		mutex_exit(&lxzd->lxzd_lock);
+
+		if (lx_lockd_alive(lockd_pid))
+			return (EEXIST);
+
+		mutex_enter(&lxzd->lxzd_lock);
+		if (lxzd->lxzd_lockd_pid != lockd_pid) {
+			/* another mount raced and created a new lockd */
+			mutex_exit(&lxzd->lxzd_lock);
+			return (EEXIST);
+		}
+
+		/* old lockd is dead, launch a new one */
+		lxzd->lxzd_lockd_pid = 0;
+	}
+	mutex_exit(&lxzd->lxzd_lock);
+
+	if (z->zone_defaultcid > 0) {
+		cid = z->zone_defaultcid;
+	} else {
+		pool_lock();
+		cid = pool_get_class(z->zone_pool);
+		pool_unlock();
+	}
+	if (cid == -1)
+		cid = defaultcid;
+
+	/*
+	 * There's nothing to do here if creating the proc fails, but we
+	 * return the result to make it obvious while DTracing.
+	 */
+	return (newproc(lx_run_lockd, NULL, cid, minclsyspri - 1, NULL, -1));
+}
+
+void
+lx_upcall_statd(int op, struct nlm_globals *g, struct nlm_host *host)
+{
+	struct nlm_nsm *nsm;
+	struct mon args;
+	struct mon_id *mip = &args.mon_id;
+	int family;
+	netobj obj;
+	enum clnt_stat stat;
+
+	/*
+	 * For Linux rpc.statd monitor registration, the Linux NSMPROC_MON and
+	 * NSMPROC_UNMON RPC upcalls correspond almost directly to the native
+	 * SM_MON and SM_UNMON RPC upcalls. The key differences with the native
+	 * registration is that in our nlm_host_monitor function we make two
+	 * RPC calls:
+	 *    - the first RPC (nsmaddrproc1_reg_1) uses our private 'nsm_addr'
+	 *	RPC protocol to register the lockd RPC information that statd
+	 *	should call when it detects that the remote server rebooted
+	 *    - the second RPC (sm_mon_1) tells statd the information about the
+	 *	remote server to be monitored
+	 * For Linux, there is only a single RPC from the kernel to the local
+	 * statd. This RPC is equivalent to our sm_mon_1 code, but it uses the
+	 * Linux-private NLMPROC_NSM_NOTIFY lockd procedure in the 'my_proc'
+	 * RPC parameter. This corresponds to our private 'nsm_addr' code, and
+	 * tells statd which lockd RPC to call when it detects a server reboot.
+	 *
+	 * Because our sm_mon_1 RPC is so similar to the Linux RPC, we can use
+	 * that directly and simply set the expected value in the 'my_proc'
+	 * argument.
+	 *
+	 * Within the kernel lockd RPC handling, the nlm_prog_3_dtable dispatch
+	 * table has an entry for each lockd RPC function. Thus, this table also
+	 * contains an entry for the Linux NLMPROC_NSM_NOTIFY procedure. That
+	 * procedure number is unused by the native lockd code, so there is no
+	 * conflict with dispatching that procedure. The implementation of the
+	 * procedure corresponds to the native, private NLM_SM_NOTIFY1
+	 * procedure which is called by the native rpc.statd.
+	 *
+	 * The Linux RPC call to "unmonitor" a host expects the same arguments
+	 * as we pass to monitor, so that is also handled here by this same
+	 * brand hook.
+	 */
+	nlm_netbuf_to_netobj(&host->nh_addr, &family, &obj);
+	nsm = &g->nlm_nsm;
+
+	bzero(&args, sizeof (args));
+
+	mip->mon_name = host->nh_name;
+	mip->my_id.my_name = uts_nodename();
+	mip->my_id.my_prog = NLM_PROG;
+	mip->my_id.my_vers = NLM_SM;
+	mip->my_id.my_proc = LX_NLMPROC_NSM_NOTIFY;
+	if (op == SM_MON) {
+		bcopy(&host->nh_sysid, args.priv, sizeof (uint16_t));
+	}
+
+	sema_p(&nsm->ns_sem);
+	nlm_nsm_clnt_init(nsm->ns_handle, nsm);
+	if (op == SM_MON) {
+		struct sm_stat_res mres;
+
+		bzero(&mres, sizeof (mres));
+		stat = sm_mon_1(&args, &mres, nsm->ns_handle);
+	} else {
+		struct sm_stat ures;
+
+		ASSERT(op == SM_UNMON);
+		bzero(&ures, sizeof (ures));
+		stat = sm_unmon_1(mip, &ures, nsm->ns_handle);
+	}
+	sema_v(&nsm->ns_sem);
+
+	if (stat != RPC_SUCCESS) {
+		NLM_WARN("Failed to contact local statd, stat=%d", stat);
+		if (op == SM_MON) {
+			mutex_enter(&g->lock);
+			host->nh_flags &= ~NLM_NH_MONITORED;
+			mutex_exit(&g->lock);
+		}
+	}
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_misc.c b/usr/src/uts/common/brand/lx/os/lx_misc.c
new file mode 100644
index 0000000000..35e42edaa3
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_misc.c
@@ -0,0 +1,1196 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/errno.h>
+#include <sys/systm.h>
+#include <sys/archsystm.h>
+#include <sys/privregs.h>
+#include <sys/exec.h>
+#include <sys/lwp.h>
+#include <sys/sem.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_siginfo.h>
+#include <sys/lx_futex.h>
+#include <lx_errno.h>
+#include <sys/lx_userhz.h>
+#include <sys/cmn_err.h>
+#include <sys/siginfo.h>
+#include <sys/contract/process_impl.h>
+#include <sys/x86_archext.h>
+#include <sys/sdt.h>
+#include <lx_signum.h>
+#include <lx_syscall.h>
+#include <sys/proc.h>
+#include <sys/procfs.h>
+#include <net/if.h>
+#include <inet/ip6.h>
+#include <sys/sunddi.h>
+#include <sys/dlpi.h>
+#include <sys/sysmacros.h>
+
+/* Linux specific functions and definitions */
+static void lx_save(klwp_t *);
+static void lx_restore(klwp_t *);
+
+/*
+ * Set the return code for the forked child, always zero
+ */
+/*ARGSUSED*/
+void
+lx_setrval(klwp_t *lwp, int v1, int v2)
+{
+	lwptoregs(lwp)->r_r0 = 0;
+}
+
+/*
+ * Reset process state on exec(2)
+ */
+void
+lx_exec()
+{
+	klwp_t *lwp = ttolwp(curthread);
+	struct lx_lwp_data *lwpd = lwptolxlwp(lwp);
+	proc_t *p = ttoproc(curthread);
+	lx_proc_data_t *pd = ptolxproc(p);
+	struct regs *rp = lwptoregs(lwp);
+
+	/* b_exec is called without p_lock held */
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	/*
+	 * Any l_handler handlers set as a result of B_REGISTER are now
+	 * invalid; clear them.
+	 */
+	pd->l_handler = NULL;
+
+	/*
+	 * If this was a multi-threaded Linux process and this lwp wasn't the
+	 * main lwp, then we need to make its Illumos and Linux PIDs match.
+	 */
+	if (curthread->t_tid != 1) {
+		lx_pid_reassign(curthread);
+	}
+
+	/*
+	 * Inform ptrace(2) that we are processing an execve(2) call so that if
+	 * we are traced we can post either the PTRACE_EVENT_EXEC event or the
+	 * legacy SIGTRAP.
+	 */
+	(void) lx_ptrace_stop_for_option(LX_PTRACE_O_TRACEEXEC, B_FALSE, 0, 0);
+
+	/* clear the fs/gsbase values until the app. can reinitialize them */
+	lwpd->br_lx_fsbase = NULL;
+	lwpd->br_ntv_fsbase = NULL;
+	lwpd->br_lx_gsbase = NULL;
+	lwpd->br_ntv_gsbase = NULL;
+
+	/*
+	 * Clear the native stack flags.  This will be reinitialised by
+	 * lx_init() in the new process image.
+	 */
+	lwpd->br_stack_mode = LX_STACK_MODE_PREINIT;
+	lwpd->br_ntv_stack = 0;
+	lwpd->br_ntv_stack_current = 0;
+
+	installctx(lwptot(lwp), lwp, lx_save, lx_restore, NULL, NULL, lx_save,
+	    NULL);
+
+	/*
+	 * clear out the tls array
+	 */
+	bzero(lwpd->br_tls, sizeof (lwpd->br_tls));
+
+	/*
+	 * reset the tls entries in the gdt
+	 */
+	kpreempt_disable();
+	lx_restore(lwp);
+	kpreempt_enable();
+
+	/* Grab the updated argv bounds */
+	mutex_enter(&p->p_lock);
+	lx_read_argv_bounds(p);
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * The exec syscall doesn't return (so we don't call lx_syscall_return)
+	 * but for our ptrace emulation we need to do this so that a tracer
+	 * does not get out of sync. We know that by the time this lx_exec
+	 * function is called that the exec has succeeded.
+	 */
+	rp->r_r0 = 0;
+	(void) lx_ptrace_stop(LX_PR_SYSEXIT);
+}
+
+static void
+lx_cleanlwp(klwp_t *lwp, proc_t *p)
+{
+	struct lx_lwp_data *lwpd = lwptolxlwp(lwp);
+	void *rb_list = NULL;
+
+	VERIFY(lwpd != NULL);
+
+	mutex_enter(&p->p_lock);
+	if ((lwpd->br_ptrace_flags & LX_PTF_EXITING) == 0) {
+		lx_ptrace_exit(p, lwp);
+	}
+
+	/*
+	 * While we have p_lock, clear the TP_KTHREAD flag. This is needed
+	 * to prevent races within lx procfs. It's fine for prchoose() to pick
+	 * this thread now since it is exiting and no longer blocked in the
+	 * kernel.
+	 */
+	lwptot(lwp)->t_proc_flag &= ~TP_KTHREAD;
+
+	/*
+	 * While we have p_lock, safely grab any robust_list references and
+	 * clear the lwp field.
+	 */
+	sprlock_proc(p);
+	rb_list = lwpd->br_robust_list;
+	lwpd->br_robust_list = NULL;
+	sprunlock(p);
+
+	if (rb_list != NULL) {
+		lx_futex_robust_exit((uintptr_t)rb_list, lwpd->br_pid);
+	}
+
+	/*
+	 * We need to run our context exit operation (lx_save) here to ensure
+	 * we don't leave any garbage around. This is necessary to handle the
+	 * following calling sequence:
+	 *    exit -> proc_exit -> lx_freelwp -> removectx
+	 * That is, when our branded process exits, proc_exit will call our
+	 * lx_freelwp brand hook which does call this function (lx_cleanlwp),
+	 * but lx_freelwp also removes our context exit operation. The context
+	 * exit functions are run by exitctx, which is called by either
+	 * lwp_exit or thread_exit. The thread_exit function is called at the
+	 * end of proc_exit when we'll swtch() to another thread, but by then
+	 * our context exit function has been removed.
+	 *
+	 * It's ok if this function happens to be called more than once (for
+	 * example, if we exec a native binary).
+	 */
+	kpreempt_disable();
+	lx_save(lwp);
+	kpreempt_enable();
+}
+
+void
+lx_exitlwp(klwp_t *lwp)
+{
+	struct lx_lwp_data *lwpd = lwptolxlwp(lwp);
+	proc_t *p = lwptoproc(lwp);
+	kthread_t *t;
+	sigqueue_t *sqp = NULL;
+	pid_t ppid;
+	id_t ptid;
+
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	if (lwpd == NULL) {
+		/* second time thru' */
+		return;
+	}
+
+	lx_cleanlwp(lwp, p);
+
+	if (lwpd->br_clear_ctidp != NULL) {
+		(void) suword32(lwpd->br_clear_ctidp, 0);
+		(void) lx_futex((uintptr_t)lwpd->br_clear_ctidp, FUTEX_WAKE, 1,
+		    NULL, NULL, 0);
+		lwpd->br_clear_ctidp = NULL;
+	}
+
+	if (lwpd->br_signal != 0) {
+		/*
+		 * The first thread in a process doesn't cause a signal to
+		 * be sent when it exits.  It was created by a fork(), not
+		 * a clone(), so the parent should get signalled when the
+		 * process exits.
+		 */
+		if (lwpd->br_ptid == -1)
+			goto free;
+
+		sqp = kmem_zalloc(sizeof (sigqueue_t), KM_SLEEP);
+		/*
+		 * If br_ppid is 0, it means this is a CLONE_PARENT thread,
+		 * so the signal goes to the parent process - not to a
+		 * specific thread in this process.
+		 */
+		p = lwptoproc(lwp);
+		if (lwpd->br_ppid == 0) {
+			mutex_enter(&p->p_lock);
+			ppid = p->p_ppid;
+			t = NULL;
+		} else {
+			/*
+			 * If we have been reparented to init or if our
+			 * parent thread is gone, then nobody gets
+			 * signaled.
+			 */
+			if ((lx_lwp_ppid(lwp, &ppid, &ptid) == 1) ||
+			    (ptid == -1))
+				goto free;
+
+			mutex_enter(&pidlock);
+			if ((p = prfind(ppid)) == NULL || p->p_stat == SIDL) {
+				mutex_exit(&pidlock);
+				goto free;
+			}
+			mutex_enter(&p->p_lock);
+			mutex_exit(&pidlock);
+
+			if ((t = idtot(p, ptid)) == NULL) {
+				mutex_exit(&p->p_lock);
+				goto free;
+			}
+		}
+
+		sqp->sq_info.si_signo = lwpd->br_signal;
+		sqp->sq_info.si_code = lwpd->br_exitwhy;
+		sqp->sq_info.si_status = lwpd->br_exitwhat;
+		sqp->sq_info.si_pid = lwpd->br_pid;
+		sqp->sq_info.si_uid = crgetruid(CRED());
+		sigaddqa(p, t, sqp);
+		mutex_exit(&p->p_lock);
+		sqp = NULL;
+	}
+
+free:
+	if (lwpd->br_scall_args != NULL) {
+		ASSERT(lwpd->br_args_size > 0);
+		kmem_free(lwpd->br_scall_args, lwpd->br_args_size);
+	}
+	if (sqp)
+		kmem_free(sqp, sizeof (sigqueue_t));
+}
+
+void
+lx_freelwp(klwp_t *lwp)
+{
+	struct lx_lwp_data *lwpd = lwptolxlwp(lwp);
+	proc_t *p = lwptoproc(lwp);
+	lx_zone_data_t *lxzdata;
+	vfs_t *cgrp;
+
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	if (lwpd == NULL) {
+		/*
+		 * There is one case where an LX branded process will possess
+		 * LWPs which lack their own brand data.  During the course of
+		 * executing native binary, the process will be preemptively
+		 * branded to allow hooks such as b_native_exec to function.
+		 * If that process possesses multiple LWPS, they will _not_ be
+		 * branded since they will exit if the exec succeeds.  It's
+		 * during this LWP exit that lx_freelwp would be called on an
+		 * unbranded LWP.  When that is the case, it is acceptable to
+		 * bypass the hook.
+		 */
+		return;
+	}
+
+	/* cgroup integration */
+	lxzdata = ztolxzd(p->p_zone);
+	mutex_enter(&lxzdata->lxzd_lock);
+	cgrp = lxzdata->lxzd_cgroup;
+	if (cgrp != NULL) {
+		VFS_HOLD(cgrp);
+		mutex_exit(&lxzdata->lxzd_lock);
+		ASSERT(lx_cgrp_freelwp != NULL);
+		(*lx_cgrp_freelwp)(cgrp, lwpd->br_cgroupid, lwptot(lwp)->t_tid,
+		    lwpd->br_pid);
+		VFS_RELE(cgrp);
+	} else {
+		mutex_exit(&lxzdata->lxzd_lock);
+	}
+
+	/*
+	 * It is possible for the lx_freelwp hook to be called without a prior
+	 * call to lx_exitlwp being made.  This happens as part of lwp
+	 * de-branding when a native binary is executed from a branded process.
+	 *
+	 * To cover all cases, lx_cleanlwp is called from lx_exitlwp as well
+	 * here in lx_freelwp.  When the second call is redundant, the
+	 * resources will already be freed and no work will be needed.
+	 */
+	lx_cleanlwp(lwp, p);
+
+	/*
+	 * Remove our system call interposer.
+	 */
+	lwp->lwp_brand_syscall = NULL;
+
+	(void) removectx(lwptot(lwp), lwp, lx_save, lx_restore, NULL, NULL,
+	    lx_save, NULL);
+	if (lwpd->br_pid != 0) {
+		lx_pid_rele(lwptoproc(lwp)->p_pid, lwptot(lwp)->t_tid);
+	}
+
+	/*
+	 * Discard the affinity mask.
+	 */
+	VERIFY(lwpd->br_affinitymask != NULL);
+	cpuset_free(lwpd->br_affinitymask);
+	lwpd->br_affinitymask = NULL;
+
+	/*
+	 * Ensure that lx_ptrace_exit() has been called to detach
+	 * ptrace(2) tracers and tracees.
+	 */
+	VERIFY(lwpd->br_ptrace_tracer == NULL);
+	VERIFY(lwpd->br_ptrace_accord == NULL);
+
+	lwp->lwp_brand = NULL;
+	kmem_free(lwpd, sizeof (struct lx_lwp_data));
+}
+
+void *
+lx_lwpdata_alloc(proc_t *p)
+{
+	lx_lwp_data_t *lwpd;
+	struct lx_pid *lpidp;
+	cpuset_t *affmask;
+	pid_t newpid = 0;
+	struct pid *pidp = NULL;
+
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	/*
+	 * LWPs beyond the first will require a pid to be allocated to emulate
+	 * Linux's goofy thread model.  While this  allocation may be
+	 * unnecessary when a single-lwp process undergoes branding, it cannot
+	 * be performed during b_initlwp due to p_lock being held.
+	 */
+	if (p->p_lwpcnt > 0) {
+		if ((newpid = pid_allocate(p, 0, 0)) < 0) {
+			return (NULL);
+		}
+		pidp = pid_find(newpid);
+	}
+
+	lwpd = kmem_zalloc(sizeof (struct lx_lwp_data), KM_SLEEP);
+	lpidp = kmem_zalloc(sizeof (struct lx_pid), KM_SLEEP);
+	affmask = cpuset_alloc(KM_SLEEP);
+
+	lpidp->lxp_lpid = newpid;
+	lpidp->lxp_pidp = pidp;
+	lwpd->br_lpid = lpidp;
+	lwpd->br_affinitymask = affmask;
+
+	return (lwpd);
+}
+
+/*
+ * Free lwp brand data if an error occurred during lwp_create.
+ * Otherwise, lx_freelwp will be used to free the resources after they're
+ * associated with the lwp via lx_initlwp.
+ */
+void
+lx_lwpdata_free(void *lwpbd)
+{
+	lx_lwp_data_t *lwpd = (lx_lwp_data_t *)lwpbd;
+	VERIFY(lwpd != NULL);
+	VERIFY(lwpd->br_lpid != NULL);
+	VERIFY(lwpd->br_affinitymask != NULL);
+
+	cpuset_free(lwpd->br_affinitymask);
+	if (lwpd->br_lpid->lxp_pidp != NULL) {
+		(void) pid_rele(lwpd->br_lpid->lxp_pidp);
+	}
+	kmem_free(lwpd->br_lpid, sizeof (*lwpd->br_lpid));
+	kmem_free(lwpd, sizeof (*lwpd));
+}
+
+void
+lx_initlwp(klwp_t *lwp, void *lwpbd)
+{
+	lx_lwp_data_t *lwpd = (lx_lwp_data_t *)lwpbd;
+	lx_lwp_data_t *plwpd = ttolxlwp(curthread);
+	kthread_t *tp = lwptot(lwp);
+	proc_t *p = lwptoproc(lwp);
+	lx_zone_data_t *lxzdata;
+	vfs_t *cgrp;
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+	VERIFY(lwp->lwp_brand == NULL);
+
+	lwpd->br_exitwhy = CLD_EXITED;
+	lwpd->br_lwp = lwp;
+	lwpd->br_clear_ctidp = NULL;
+	lwpd->br_set_ctidp = NULL;
+	lwpd->br_signal = 0;
+	lwpd->br_stack_mode = LX_STACK_MODE_PREINIT;
+	cpuset_all(lwpd->br_affinitymask);
+
+	/*
+	 * The first thread in a process has ppid set to the parent
+	 * process's pid, and ptid set to -1.  Subsequent threads in the
+	 * process have their ppid set to the pid of the thread that
+	 * created them, and their ptid to that thread's tid.
+	 */
+	if (tp->t_next == tp) {
+		lwpd->br_ppid = tp->t_procp->p_ppid;
+		lwpd->br_ptid = -1;
+	} else if (plwpd != NULL) {
+		bcopy(plwpd->br_tls, lwpd->br_tls, sizeof (lwpd->br_tls));
+		lwpd->br_ppid = plwpd->br_pid;
+		lwpd->br_ptid = curthread->t_tid;
+		/* The child inherits the fs/gsbase values from the parent */
+		lwpd->br_lx_fsbase = plwpd->br_lx_fsbase;
+		lwpd->br_ntv_fsbase = plwpd->br_ntv_fsbase;
+		lwpd->br_lx_gsbase = plwpd->br_lx_gsbase;
+		lwpd->br_ntv_gsbase = plwpd->br_ntv_gsbase;
+	} else {
+		/*
+		 * Oddball case: the parent thread isn't a Linux process.
+		 */
+		lwpd->br_ppid = 0;
+		lwpd->br_ptid = -1;
+	}
+	lwp->lwp_brand = lwpd;
+
+	/*
+	 * When during lx_lwpdata_alloc, we must decide whether or not to
+	 * allocate a new pid to associate with the lwp. Since p_lock is not
+	 * held at that point, the only time we can guarantee a new pid isn't
+	 * needed is when p_lwpcnt == 0.  This is because other lwps won't be
+	 * present to race with us with regards to pid allocation.
+	 *
+	 * This means that in all other cases (where p_lwpcnt > 0), we expect
+	 * that lx_lwpdata_alloc will allocate a pid for us to use here, even
+	 * if it is uneeded.  If this process is undergoing an exec, for
+	 * example, the single existing lwp will not need a new pid when it is
+	 * rebranded.  In that case, lx_pid_assign will free the uneeded pid.
+	 */
+	VERIFY(lwpd->br_lpid->lxp_pidp != NULL || p->p_lwpcnt == 0);
+
+	lx_pid_assign(tp, lwpd->br_lpid);
+	lwpd->br_tgid = lwpd->br_pid;
+	/*
+	 * Having performed the lx pid assignement, the lpid reference is no
+	 * longer needed.  The underlying data will be freed during lx_freelwp.
+	 */
+	lwpd->br_lpid = NULL;
+
+	installctx(lwptot(lwp), lwp, lx_save, lx_restore, NULL, NULL,
+	    lx_save, NULL);
+
+	/*
+	 * Install branded system call hooks for this LWP:
+	 */
+	lwp->lwp_brand_syscall = lx_syscall_enter;
+
+	/*
+	 * The new LWP inherits the parent LWP cgroup ID.
+	 */
+	if (plwpd != NULL) {
+		lwpd->br_cgroupid = plwpd->br_cgroupid;
+	}
+	/*
+	 * The new LWP inherits the parent LWP emulated scheduling info.
+	 */
+	if (plwpd != NULL) {
+		lwpd->br_schd_class = plwpd->br_schd_class;
+		lwpd->br_schd_pri = plwpd->br_schd_pri;
+		lwpd->br_schd_flags = plwpd->br_schd_flags;
+		lwpd->br_schd_runtime = plwpd->br_schd_runtime;
+		lwpd->br_schd_deadline = plwpd->br_schd_deadline;
+		lwpd->br_schd_period = plwpd->br_schd_period;
+	}
+	lxzdata = ztolxzd(p->p_zone);
+	mutex_enter(&lxzdata->lxzd_lock);
+	cgrp = lxzdata->lxzd_cgroup;
+	if (cgrp != NULL) {
+		VFS_HOLD(cgrp);
+		mutex_exit(&lxzdata->lxzd_lock);
+		ASSERT(lx_cgrp_initlwp != NULL);
+		(*lx_cgrp_initlwp)(cgrp, lwpd->br_cgroupid, lwptot(lwp)->t_tid,
+		    lwpd->br_pid);
+		VFS_RELE(cgrp);
+	} else {
+		mutex_exit(&lxzdata->lxzd_lock);
+	}
+}
+
+void
+lx_initlwp_post(klwp_t *lwp)
+{
+	lx_lwp_data_t *plwpd = ttolxlwp(curthread);
+	/*
+	 * If the parent LWP has a ptrace(2) tracer, the new LWP may
+	 * need to inherit that same tracer.
+	 */
+	if (plwpd != NULL) {
+		lx_ptrace_inherit_tracer(plwpd, lwptolxlwp(lwp));
+	}
+}
+
+/*
+ * There is no need to have any locking for either the source or
+ * destination struct lx_lwp_data structs.  This is always run in the
+ * thread context of the source thread, and the destination thread is
+ * always newly created and not referred to from anywhere else.
+ */
+void
+lx_forklwp(klwp_t *srclwp, klwp_t *dstlwp)
+{
+	struct lx_lwp_data *src = srclwp->lwp_brand;
+	struct lx_lwp_data *dst = dstlwp->lwp_brand;
+
+	dst->br_ppid = src->br_pid;
+	dst->br_ptid = lwptot(srclwp)->t_tid;
+	bcopy(src->br_tls, dst->br_tls, sizeof (dst->br_tls));
+
+	switch (src->br_stack_mode) {
+	case LX_STACK_MODE_BRAND:
+	case LX_STACK_MODE_NATIVE:
+		/*
+		 * The parent LWP has an alternate stack installed.
+		 * The child LWP should have the same stack base and extent.
+		 */
+		dst->br_stack_mode = src->br_stack_mode;
+		dst->br_ntv_stack = src->br_ntv_stack;
+		dst->br_ntv_stack_current = src->br_ntv_stack_current;
+		break;
+
+	default:
+		/*
+		 * Otherwise, clear the stack data for this LWP.
+		 */
+		dst->br_stack_mode = LX_STACK_MODE_PREINIT;
+		dst->br_ntv_stack = 0;
+		dst->br_ntv_stack_current = 0;
+	}
+
+	/*
+	 * copy only these flags
+	 */
+	dst->br_lwp_flags = src->br_lwp_flags & BR_CPU_BOUND;
+	dst->br_scall_args = NULL;
+	lx_affinity_forklwp(srclwp, dstlwp);
+
+	/*
+	 * Flag so child doesn't ptrace-stop on syscall exit.
+	 */
+	dst->br_ptrace_flags |= LX_PTF_NOSTOP;
+
+	if (src->br_clone_grp_flags != 0) {
+		lx_clone_grp_enter(src->br_clone_grp_flags, lwptoproc(srclwp),
+		    lwptoproc(dstlwp));
+		/* clone group no longer pending on this thread */
+		src->br_clone_grp_flags = 0;
+	}
+}
+
+/*
+ * When switching a Linux process off the CPU, clear its GDT entries.
+ */
+/* ARGSUSED */
+static void
+lx_save(klwp_t *t)
+{
+	int i;
+
+#if defined(__amd64)
+	reset_sregs();
+#endif
+	for (i = 0; i < LX_TLSNUM; i++)
+		gdt_update_usegd(GDT_TLSMIN + i, &null_udesc);
+}
+
+/*
+ * When switching a Linux process on the CPU, set its GDT entries.
+ *
+ * For 64-bit code we don't have to worry about explicitly setting the
+ * %fsbase via wrmsr(MSR_AMD_FSBASE) here. Instead, that should happen
+ * automatically in update_sregs if we are executing in user-land. If this
+ * is the case then pcb_rupdate should be set.
+ */
+static void
+lx_restore(klwp_t *t)
+{
+	struct lx_lwp_data *lwpd = lwptolxlwp(t);
+	user_desc_t *tls;
+	int i;
+
+	ASSERT(lwpd);
+
+	tls = lwpd->br_tls;
+	for (i = 0; i < LX_TLSNUM; i++)
+		gdt_update_usegd(GDT_TLSMIN + i, &tls[i]);
+}
+
+void
+lx_set_gdt(int entry, user_desc_t *descrp)
+{
+
+	gdt_update_usegd(entry, descrp);
+}
+
+void
+lx_clear_gdt(int entry)
+{
+	gdt_update_usegd(entry, &null_udesc);
+}
+
+longlong_t
+lx_nosys()
+{
+	return (set_errno(ENOSYS));
+}
+
+/*
+ * Brand-specific routine to check if given non-Solaris standard segment
+ * register values should be modified to other values.
+ */
+/*ARGSUSED*/
+greg_t
+lx_fixsegreg(greg_t sr, model_t datamodel)
+{
+	uint16_t idx = SELTOIDX(sr);
+
+	ASSERT(sr == (sr & 0xffff));
+
+	/*
+	 * If the segment selector is a valid TLS selector, just return it.
+	 */
+	if (!SELISLDT(sr) && idx >= GDT_TLSMIN && idx <= GDT_TLSMAX)
+		return (sr | SEL_UPL);
+
+	/*
+	 * Force the SR into the LDT in ring 3 for 32-bit processes.
+	 *
+	 * 64-bit processes get the null GDT selector since they are not
+	 * allowed to have a private LDT.
+	 */
+#if defined(__amd64)
+	return (datamodel == DATAMODEL_ILP32 ? (sr | SEL_TI_LDT | SEL_UPL) : 0);
+#elif defined(__i386)
+	datamodel = datamodel;  /* datamodel currently unused for 32-bit */
+	return (sr | SEL_TI_LDT | SEL_UPL);
+#endif	/* __amd64 */
+}
+
+/*
+ * Brand-specific function to convert the fsbase as pulled from the register
+ * into a native fsbase suitable for locating the ulwp_t from the kernel.
+ */
+uintptr_t
+lx_fsbase(klwp_t *lwp, uintptr_t fsbase)
+{
+	lx_lwp_data_t *lwpd = lwp->lwp_brand;
+
+	if (lwpd->br_stack_mode != LX_STACK_MODE_BRAND ||
+	    lwpd->br_ntv_fsbase == NULL) {
+		return (fsbase);
+	}
+
+	return (lwpd->br_ntv_fsbase);
+}
+
+/*
+ * These two functions simulate winfo and post_sigcld for the lx brand. The
+ * difference is delivering a designated signal as opposed to always SIGCLD.
+ */
+static void
+lx_winfo(proc_t *pp, k_siginfo_t *ip, struct lx_proc_data *dat)
+{
+	ASSERT(MUTEX_HELD(&pidlock));
+	bzero(ip, sizeof (k_siginfo_t));
+	ip->si_signo = ltos_signo[dat->l_signal];
+	ip->si_code = pp->p_wcode;
+	ip->si_pid = pp->p_pid;
+	ip->si_ctid = PRCTID(pp);
+	ip->si_zoneid = pp->p_zone->zone_id;
+	ip->si_status = pp->p_wdata;
+	/*
+	 * These siginfo values are converted to USER_HZ in the user-land
+	 * brand signal code.
+	 */
+	ip->si_stime = pp->p_stime;
+	ip->si_utime = pp->p_utime;
+}
+
+static void
+lx_post_exit_sig(proc_t *cp, sigqueue_t *sqp, struct lx_proc_data *dat)
+{
+	proc_t *pp = cp->p_parent;
+
+	ASSERT(MUTEX_HELD(&pidlock));
+	mutex_enter(&pp->p_lock);
+	/*
+	 * Since Linux doesn't queue SIGCHLD, or any other non RT
+	 * signals, we just blindly deliver whatever signal we can.
+	 */
+	ASSERT(sqp != NULL);
+	lx_winfo(cp, &sqp->sq_info, dat);
+	sigaddqa(pp, NULL, sqp);
+	sqp = NULL;
+	mutex_exit(&pp->p_lock);
+}
+
+
+/*
+ * Brand specific code for exiting and sending a signal to the parent, as
+ * opposed to sigcld().
+ */
+void
+lx_exit_with_sig(proc_t *cp, sigqueue_t *sqp)
+{
+	proc_t *pp = cp->p_parent;
+	lx_proc_data_t *lx_brand_data = ptolxproc(cp);
+	ASSERT(MUTEX_HELD(&pidlock));
+
+	switch (cp->p_wcode) {
+	case CLD_EXITED:
+	case CLD_DUMPED:
+	case CLD_KILLED:
+			ASSERT(cp->p_stat == SZOMB);
+			/*
+			 * The broadcast on p_srwchan_cv is a kludge to
+			 * wakeup a possible thread in uadmin(A_SHUTDOWN).
+			 */
+			cv_broadcast(&cp->p_srwchan_cv);
+
+			/*
+			 * Add to newstate list of the parent
+			 */
+			add_ns(pp, cp);
+
+			cv_broadcast(&pp->p_cv);
+			if ((pp->p_flag & SNOWAIT) ||
+			    PTOU(pp)->u_signal[SIGCLD - 1] == SIG_IGN) {
+				if (!(cp->p_pidflag & CLDWAITPID))
+					freeproc(cp);
+			} else if (!(cp->p_pidflag & CLDNOSIGCHLD) &&
+			    lx_brand_data->l_signal != 0) {
+				lx_post_exit_sig(cp, sqp, lx_brand_data);
+				sqp = NULL;
+			}
+			break;
+
+	case CLD_STOPPED:
+	case CLD_CONTINUED:
+	case CLD_TRAPPED:
+			panic("Should not be called in this case");
+	}
+
+	if (sqp)
+		siginfofree(sqp);
+}
+
+/*
+ * Filters based on arguments that have been passed in by a separate syscall
+ * using the B_STORE_ARGS mechanism. if the __WALL flag is set, no filter is
+ * applied, otherwise we look at the difference between a clone and non-clone
+ * process.
+ * The definition of a clone process in Linux is a thread that does not deliver
+ * SIGCHLD to its parent. The option __WCLONE indicates to wait only on clone
+ * processes. Without that option, a process should only wait on normal
+ * children. The following table shows the cases.
+ *
+ *                   default    __WCLONE
+ *   no SIGCHLD      -           X
+ *   SIGCHLD         X           -
+ *
+ * This is an XOR of __WCLONE being set, and SIGCHLD being the signal sent on
+ * process exit.
+ *
+ * More information on wait in lx brands can be found at
+ * usr/src/lib/brand/lx/lx_brand/common/wait.c.
+ */
+/* ARGSUSED */
+boolean_t
+lx_wait_filter(proc_t *pp, proc_t *cp)
+{
+	lx_lwp_data_t *lwpd = ttolxlwp(curthread);
+	int flags = lwpd->br_waitid_flags;
+	boolean_t ret;
+
+	if (!lwpd->br_waitid_emulate) {
+		return (B_TRUE);
+	}
+
+	mutex_enter(&cp->p_lock);
+	if (flags & LX_WALL) {
+		ret = B_TRUE;
+	} else {
+		lx_proc_data_t *pd = ptolxproc(cp);
+		boolean_t is_sigchld = B_TRUE;
+		boolean_t match_wclone = B_FALSE;
+
+		/*
+		 * When calling clone, an alternate signal can be chosen to
+		 * deliver to the parent when the child exits.
+		 */
+		if (pd != NULL && pd->l_signal != stol_signo[SIGCHLD]) {
+			is_sigchld = B_FALSE;
+		}
+		if ((flags & LX_WCLONE) != 0) {
+			match_wclone = B_TRUE;
+		}
+
+		ret = (match_wclone ^ is_sigchld) ? B_TRUE : B_FALSE;
+	}
+	mutex_exit(&cp->p_lock);
+
+	return (ret);
+}
+
+void
+lx_ifname_convert(char *ifname, lx_if_action_t act)
+{
+	if (act == LX_IF_TONATIVE) {
+		if (strncmp(ifname, "lo", IFNAMSIZ) == 0)
+			(void) strlcpy(ifname, "lo0", IFNAMSIZ);
+	} else {
+		if (strncmp(ifname, "lo0", IFNAMSIZ) == 0)
+			(void) strlcpy(ifname, "lo", IFNAMSIZ);
+	}
+}
+
+void
+lx_ifflags_convert(uint64_t *flags, lx_if_action_t act)
+{
+	uint64_t buf;
+
+	buf = *flags & (IFF_UP | IFF_BROADCAST | IFF_DEBUG |
+	    IFF_LOOPBACK | IFF_POINTOPOINT | IFF_NOTRAILERS |
+	    IFF_RUNNING | IFF_NOARP | IFF_PROMISC | IFF_ALLMULTI);
+
+	/* Linux has different shift for multicast flag */
+	if (act == LX_IF_TONATIVE) {
+		if (*flags & 0x1000)
+			buf |= IFF_MULTICAST;
+	} else {
+		if (*flags & IFF_MULTICAST)
+			buf |= 0x1000;
+	}
+	*flags = buf;
+}
+
+/*
+ * Convert an IPv6 address into the numbers used by /proc/net/if_inet6
+ */
+unsigned int
+lx_ipv6_scope_convert(const in6_addr_t *addr)
+{
+	if (IN6_IS_ADDR_V4COMPAT(addr)) {
+		return (LX_IPV6_ADDR_COMPATv4);
+	} else if (IN6_ARE_ADDR_EQUAL(addr, &ipv6_loopback)) {
+		return (LX_IPV6_ADDR_LOOPBACK);
+	} else if (IN6_IS_ADDR_LINKLOCAL(addr)) {
+		return (LX_IPV6_ADDR_LINKLOCAL);
+	} else if (IN6_IS_ADDR_SITELOCAL(addr)) {
+		return (LX_IPV6_ADDR_SITELOCAL);
+	} else {
+		return (0x0000U);
+	}
+}
+
+
+void
+lx_stol_hwaddr(const struct sockaddr_dl *src, struct sockaddr *dst, int *size)
+{
+	int copy_size = MIN(src->sdl_alen, sizeof (dst->sa_data));
+
+	switch (src->sdl_type) {
+	case DL_ETHER:
+		dst->sa_family = LX_ARPHRD_ETHER;
+		break;
+	case DL_LOOP:
+		dst->sa_family = LX_ARPHRD_LOOPBACK;
+		break;
+	default:
+		dst->sa_family = LX_ARPHRD_VOID;
+	}
+
+	bcopy(LLADDR(src), dst->sa_data, copy_size);
+	*size = copy_size;
+}
+
+/*
+ * Brand hook to convert native kernel siginfo signal number, errno, code, pid
+ * and si_status to Linux values. Similar to the stol_ksiginfo function but
+ * this one converts in-place, converts the pid, and does not copyout.
+ */
+void
+lx_sigfd_translate(k_siginfo_t *infop)
+{
+	zone_t *zone = curproc->p_zone;
+
+	infop->si_signo = lx_stol_signo(infop->si_signo, LX_SIGKILL);
+	infop->si_status = lx_stol_status(infop->si_status, LX_SIGKILL);
+	infop->si_code = lx_stol_sigcode(infop->si_code);
+	infop->si_errno = lx_errno(infop->si_errno, EINVAL);
+
+	/* Map zsched and zone init to pid 1 */
+	if (infop->si_pid == zone->zone_proc_initpid ||
+	    infop->si_pid == zone->zone_zsched->p_pid) {
+		infop->si_pid = 1;
+	}
+}
+
+int
+stol_ksiginfo_copyout(k_siginfo_t *sip, void *ulxsip)
+{
+	lx_siginfo_t lsi;
+
+	bzero(&lsi, sizeof (lsi));
+	lsi.lsi_signo = lx_stol_signo(sip->si_signo, SIGCLD);
+	lsi.lsi_code = lx_stol_sigcode(sip->si_code);
+	lsi.lsi_errno = lx_errno(sip->si_errno, EINVAL);
+
+	switch (lsi.lsi_signo) {
+	case LX_SIGPOLL:
+		lsi.lsi_band = sip->si_band;
+		lsi.lsi_fd = sip->si_fd;
+		break;
+
+	case LX_SIGCHLD:
+		lsi.lsi_pid = sip->si_pid;
+		if (sip->si_code <= 0 || sip->si_code == CLD_EXITED) {
+			lsi.lsi_status = sip->si_status;
+		} else {
+			lsi.lsi_status = lx_stol_status(sip->si_status,
+			    SIGKILL);
+		}
+		lsi.lsi_utime = HZ_TO_LX_USERHZ(sip->si_utime);
+		lsi.lsi_stime = HZ_TO_LX_USERHZ(sip->si_stime);
+		break;
+
+	case LX_SIGILL:
+	case LX_SIGBUS:
+	case LX_SIGFPE:
+	case LX_SIGSEGV:
+		lsi.lsi_addr = sip->si_addr;
+		break;
+
+	default:
+		lsi.lsi_pid = sip->si_pid;
+		lsi.lsi_uid = LX_UID32_TO_UID16(sip->si_uid);
+	}
+
+	if (copyout(&lsi, ulxsip, sizeof (lsi)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
+
+#if defined(_SYSCALL32_IMPL)
+int
+stol_ksiginfo32_copyout(k_siginfo_t *sip, void *ulxsip)
+{
+	lx_siginfo32_t lsi;
+
+	bzero(&lsi, sizeof (lsi));
+	lsi.lsi_signo = lx_stol_signo(sip->si_signo, SIGCLD);
+	lsi.lsi_code = lx_stol_sigcode(sip->si_code);
+	lsi.lsi_errno = lx_errno(sip->si_errno, EINVAL);
+
+	switch (lsi.lsi_signo) {
+	case LX_SIGPOLL:
+		lsi.lsi_band = sip->si_band;
+		lsi.lsi_fd = sip->si_fd;
+		break;
+
+	case LX_SIGCHLD:
+		lsi.lsi_pid = sip->si_pid;
+		if (sip->si_code <= 0 || sip->si_code == CLD_EXITED) {
+			lsi.lsi_status = sip->si_status;
+		} else {
+			lsi.lsi_status = lx_stol_status(sip->si_status,
+			    SIGKILL);
+		}
+		lsi.lsi_utime = HZ_TO_LX_USERHZ(sip->si_utime);
+		lsi.lsi_stime = HZ_TO_LX_USERHZ(sip->si_stime);
+		break;
+
+	case LX_SIGILL:
+	case LX_SIGBUS:
+	case LX_SIGFPE:
+	case LX_SIGSEGV:
+		lsi.lsi_addr = (caddr32_t)(uintptr_t)sip->si_addr;
+		break;
+
+	default:
+		lsi.lsi_pid = sip->si_pid;
+		lsi.lsi_uid = LX_UID32_TO_UID16(sip->si_uid);
+	}
+
+	if (copyout(&lsi, ulxsip, sizeof (lsi)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
+#endif
+
+/*
+ * Linux uses the original bounds of the argv array when determining the
+ * contents of /proc/<pid/cmdline.  We mimic those bounds using argv[0] and
+ * envp[0] as the beginning and end, respectively.
+ */
+void
+lx_read_argv_bounds(proc_t *p)
+{
+	user_t *up = PTOU(p);
+	lx_proc_data_t *pd = ptolxproc(p);
+	uintptr_t addr_arg = up->u_argv;
+	uintptr_t addr_env = up->u_envp;
+	uintptr_t arg_start = 0, env_start = 0, env_end = 0;
+	int i = 0;
+
+	VERIFY(pd != NULL);
+	VERIFY(MUTEX_HELD(&p->p_lock));
+
+	/*
+	 * Use AT_SUN_PLATFORM in the aux vector to find the end of the envp
+	 * strings.
+	 */
+	for (i = 0; i < __KERN_NAUXV_IMPL; i++) {
+		if (up->u_auxv[i].a_type == AT_SUN_PLATFORM) {
+			env_end = (uintptr_t)up->u_auxv[i].a_un.a_val;
+		}
+	}
+
+	/*
+	 * If we come through here for a kernel process (zsched), which happens
+	 * with our cgroupfs when we fork the release agent, then u_argv and
+	 * u_envp will be NULL. While this won't cause a failure, it does
+	 * cause a lot of overhead when the fuword causes a fault, which leads
+	 * to a large amount of stack growth and anonymous memory allocation,
+	 * all of which is pointless since the first page can't be mapped.
+	 */
+	if (addr_arg != NULL || addr_env != NULL) {
+		mutex_exit(&p->p_lock);
+#if defined(_LP64)
+		if (p->p_model != DATAMODEL_NATIVE) {
+			uint32_t buf32;
+			if (fuword32((void *)addr_arg, &buf32) == 0) {
+				arg_start = (uintptr_t)buf32;
+			}
+			if (fuword32((void *)addr_env, &buf32) == 0) {
+				env_start = (uintptr_t)buf32;
+			}
+		} else
+#endif /* defined(_LP64) */
+		{
+			ulong_t buf;
+			if (fulword((void *)addr_arg, &buf) == 0) {
+				arg_start = (uintptr_t)buf;
+			}
+			if (fulword((void *)addr_env, &buf) == 0) {
+				env_start = (uintptr_t)buf;
+			}
+		}
+		mutex_enter(&p->p_lock);
+	}
+
+	pd->l_args_start = arg_start;
+	pd->l_envs_start = env_start;
+	pd->l_envs_end = env_end;
+}
+
+/* Given an LX LWP, determine where user register state is stored. */
+lx_regs_location_t
+lx_regs_location(lx_lwp_data_t *lwpd, void **ucp, boolean_t for_write)
+{
+	switch (lwpd->br_stack_mode) {
+	case LX_STACK_MODE_BRAND:
+		/*
+		 * The LWP was stopped with the brand stack and register state
+		 * loaded, e.g. during a syscall emulated within the kernel.
+		 */
+		return (LX_REG_LOC_LWP);
+
+	case LX_STACK_MODE_PREINIT:
+		if (for_write) {
+			/* setting registers not allowed in this state */
+			break;
+		}
+		if (lwpd->br_ptrace_whatstop == LX_PR_SIGNALLED ||
+		    lwpd->br_ptrace_whatstop == LX_PR_SYSEXIT) {
+			/* The LWP was stopped by tracing on exec. */
+			return (LX_REG_LOC_LWP);
+		}
+		break;
+
+	case LX_STACK_MODE_NATIVE:
+		if (for_write) {
+			/* setting registers not allowed in this state */
+			break;
+		}
+		if (lwpd->br_ptrace_whystop == PR_BRAND) {
+			/* Called while ptrace-event-stopped by lx_exec. */
+			if (lwpd->br_ptrace_whatstop == LX_PR_EVENT) {
+				return (LX_REG_LOC_LWP);
+			}
+
+			/* Called while ptrace-event-stopped after clone. */
+			if (lwpd->br_ptrace_whatstop == LX_PR_SIGNALLED &&
+			    lwpd->br_ptrace_stopsig == LX_SIGSTOP &&
+			    (lwpd->br_ptrace_flags & LX_PTF_STOPPED)) {
+				return (LX_REG_LOC_LWP);
+			}
+
+			/*
+			 * Called to obtain syscall exit for other cases
+			 * (e.g. pseudo return from rt_sigreturn).
+			 */
+			if (lwpd->br_ptrace_whatstop == LX_PR_SYSEXIT &&
+			    (lwpd->br_ptrace_flags & LX_PTF_STOPPED)) {
+				return (LX_REG_LOC_LWP);
+			}
+		}
+		break;
+	default:
+		break;
+	}
+
+	if (lwpd->br_ptrace_stopucp != NULL) {
+		/*
+		 * The LWP was stopped in the usermode emulation library
+		 * but a ucontext_t for the preserved brand stack and
+		 * register state was provided.  Return the register state
+		 * from that ucontext_t.
+		 */
+		VERIFY(ucp != NULL);
+		*ucp = (void *)lwpd->br_ptrace_stopucp;
+		return (LX_REG_LOC_UCP);
+	}
+
+	return (LX_REG_LOC_UNAVAIL);
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_pid.c b/usr/src/uts/common/brand/lx/os/lx_pid.c
new file mode 100644
index 0000000000..8439a23e58
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_pid.c
@@ -0,0 +1,499 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/bitmap.h>
+#include <sys/var.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/brand.h>
+#include <sys/zone.h>
+#include <sys/lx_brand.h>
+
+#define	LINUX_PROC_FACTOR	8	/* factor down the hash table by this */
+static int hash_len = 4;		/* desired average hash chain length */
+static int hash_size;			/* no of buckets in the hash table */
+
+static struct lx_pid **stol_pid_hash;
+static struct lx_pid **ltos_pid_hash;
+
+#define	LTOS_HASH(pid)		((pid) & (hash_size - 1))
+#define	STOL_HASH(pid, tid)	(((pid) + (tid)) & (hash_size - 1))
+
+static kmutex_t hash_lock;
+
+static void
+lx_pid_insert_hash(struct lx_pid *lpidp)
+{
+	int shash = STOL_HASH(lpidp->lxp_spid, lpidp->lxp_stid);
+	int lhash = LTOS_HASH(lpidp->lxp_lpid);
+
+	ASSERT(MUTEX_HELD(&hash_lock));
+
+	lpidp->lxp_stol_next = stol_pid_hash[shash];
+	stol_pid_hash[shash] = lpidp;
+
+	lpidp->lxp_ltos_next = ltos_pid_hash[lhash];
+	ltos_pid_hash[lhash] = lpidp;
+}
+
+static struct lx_pid *
+lx_pid_remove_hash(pid_t pid, id_t tid)
+{
+	struct lx_pid **hpp;
+	struct lx_pid *lpidp = NULL;
+
+	ASSERT(MUTEX_HELD(&hash_lock));
+
+	hpp = &stol_pid_hash[STOL_HASH(pid, tid)];
+	while (*hpp) {
+		if ((*hpp)->lxp_spid == pid && (*hpp)->lxp_stid == tid) {
+			lpidp = *hpp;
+			*hpp = (*hpp)->lxp_stol_next;
+			break;
+		}
+		hpp = &(*hpp)->lxp_stol_next;
+	}
+
+	/*
+	 * when called during error recovery the pid may already
+	 * be released
+	 */
+	if (lpidp == NULL)
+		return (NULL);
+
+	hpp = &ltos_pid_hash[LTOS_HASH(lpidp->lxp_lpid)];
+	while (*hpp) {
+		if (*hpp == lpidp) {
+			*hpp = lpidp->lxp_ltos_next;
+			break;
+		}
+		hpp = &(*hpp)->lxp_ltos_next;
+	}
+
+	return (lpidp);
+}
+
+/*
+ * given a solaris pid/tid pair, create a linux pid
+ */
+void
+lx_pid_assign(kthread_t *t, struct lx_pid *lpidp)
+{
+	proc_t *p = ttoproc(t);
+	lx_lwp_data_t *lwpd = ttolxlwp(t);
+	pid_t spid = p->p_pid;
+	id_t stid = t->t_tid;
+
+	/*
+	 * When lx_initlwp is called from lx_setbrand, p_lwpcnt will already be
+	 * equal to 1. Since lx_initlwp is being called against an lwp that
+	 * already exists, an additional pid allocation is not necessary.
+	 *
+	 * We check for this by testing br_ppid == 0.
+	 */
+	if (p->p_lwpcnt > 0 && lwpd->br_ppid != 0) {
+		/*
+		 * Assign allocated pid to any thread other than the first.
+		 * The lpid and pidp fields should be populated.
+		 */
+		VERIFY(lpidp->lxp_pidp != NULL);
+		VERIFY(lpidp->lxp_lpid != 0);
+	} else {
+		/*
+		 * There are cases where a pid is speculatively allocated but
+		 * is not needed.  We are obligated to free it here.
+		 */
+		if (lpidp->lxp_pidp != NULL) {
+			(void) pid_rele(lpidp->lxp_pidp);
+		}
+		lpidp->lxp_pidp = NULL;
+		lpidp->lxp_lpid = spid;
+	}
+
+	lpidp->lxp_spid = spid;
+	lpidp->lxp_stid = stid;
+	lpidp->lxp_start = t->t_start;
+	lpidp->lxp_procp = p;
+
+	/*
+	 * Now place the pid into the Linux-SunOS and SunOS-Linux conversion
+	 * hash tables.
+	 */
+	mutex_enter(&hash_lock);
+	lx_pid_insert_hash(lpidp);
+	mutex_exit(&hash_lock);
+
+	lwpd->br_pid = lpidp->lxp_lpid;
+}
+
+/*
+ * If we are exec()ing the process, this thread's tid is about to be reset
+ * to 1.  Make sure the Linux PID bookkeeping reflects that change.
+ */
+void
+lx_pid_reassign(kthread_t *t)
+{
+	proc_t *p = ttoproc(t);
+	struct pid *old_pidp;
+	struct lx_pid *lpidp;
+
+	ASSERT(p->p_lwpcnt == 1);
+
+	mutex_enter(&hash_lock);
+
+	/*
+	 * Clean up all the traces of this thread's 'fake' Linux PID.
+	 */
+	lpidp = lx_pid_remove_hash(p->p_pid, t->t_tid);
+	ASSERT(lpidp != NULL);
+	old_pidp = lpidp->lxp_pidp;
+	lpidp->lxp_pidp = NULL;
+
+	/*
+	 * Now register this thread as (pid, 1).
+	 */
+	lpidp->lxp_lpid = p->p_pid;
+	lpidp->lxp_spid = p->p_pid;
+	lpidp->lxp_stid = 1;
+	lx_pid_insert_hash(lpidp);
+
+	mutex_exit(&hash_lock);
+
+	if (old_pidp)
+		(void) pid_rele(old_pidp);
+}
+
+/*
+ * release a solaris pid/tid pair
+ */
+void
+lx_pid_rele(pid_t pid, id_t tid)
+{
+	struct lx_pid *lpidp;
+
+	mutex_enter(&hash_lock);
+	lpidp = lx_pid_remove_hash(pid, tid);
+	mutex_exit(&hash_lock);
+
+	if (lpidp) {
+		if (lpidp->lxp_pidp)
+			(void) pid_rele(lpidp->lxp_pidp);
+
+		kmem_free(lpidp, sizeof (*lpidp));
+	}
+}
+
+/*
+ * given a linux pid, return the solaris pid/tid pair
+ */
+int
+lx_lpid_to_spair(pid_t lpid, pid_t *spid, id_t *stid)
+{
+	struct lx_pid *hp;
+
+	if (lpid == 1) {
+		pid_t initpid;
+
+		/*
+		 * We are trying to look up the Linux init process for the
+		 * current zone, which we pretend has pid 1.
+		 */
+		if ((initpid = curzone->zone_proc_initpid) == -1) {
+			/*
+			 * We could not find the init process for this zone.
+			 */
+			return (-1);
+		}
+
+		if (spid != NULL)
+			*spid = initpid;
+		if (stid != NULL)
+			*stid = 1;
+
+		return (0);
+	}
+
+	mutex_enter(&hash_lock);
+	for (hp = ltos_pid_hash[LTOS_HASH(lpid)]; hp != NULL;
+	    hp = hp->lxp_ltos_next) {
+		if (hp->lxp_lpid == lpid) {
+			if (spid)
+				*spid = hp->lxp_spid;
+			if (stid)
+				*stid = hp->lxp_stid;
+			break;
+		}
+	}
+	mutex_exit(&hash_lock);
+	if (hp != NULL)
+		return (0);
+
+	/*
+	 * We didn't find this pid in our translation table.
+	 * But this still could be the pid of a native process
+	 * running in the current zone so check for that here.
+	 *
+	 * Note that prfind() only searches for processes in the current zone.
+	 */
+	mutex_enter(&pidlock);
+	if (prfind(lpid) != NULL) {
+		mutex_exit(&pidlock);
+		if (spid)
+			*spid = lpid;
+		if (stid)
+			*stid = 0;
+		return (0);
+	}
+	mutex_exit(&pidlock);
+
+	return (-1);
+}
+
+/*
+ * Given a Linux pid, locate the proc_t and optionally acquire P_PR_LOCK.
+ * Returns 0 on success with p_lock held for the proc_t in question.
+ */
+int
+lx_lpid_lock(pid_t lpid, zone_t *zone, lx_pid_flag_t flag, proc_t **pp,
+    kthread_t **tp)
+{
+	proc_t *p;
+	kthread_t *t;
+	id_t tid = 0;
+
+	ASSERT(MUTEX_NOT_HELD(&pidlock));
+	ASSERT(pp != NULL);
+	ASSERT(zone != NULL && zone->zone_brand == &lx_brand);
+
+retry:
+	p = NULL;
+	if (lpid == 1) {
+		pid_t initpid;
+
+		/*
+		 * Look up the init process for the zone.
+		 */
+		if ((initpid = zone->zone_proc_initpid) <= 0) {
+			return (-1);
+		}
+		mutex_enter(&pidlock);
+		p = prfind_zone(initpid, zone->zone_id);
+		tid = 0;
+	} else {
+		struct lx_pid *hp;
+
+		mutex_enter(&pidlock);
+		mutex_enter(&hash_lock);
+		for (hp = ltos_pid_hash[LTOS_HASH(lpid)]; hp != NULL;
+		    hp = hp->lxp_ltos_next) {
+			if (hp->lxp_lpid == lpid) {
+				tid = hp->lxp_stid;
+				p = hp->lxp_procp;
+				break;
+			}
+		}
+		mutex_exit(&hash_lock);
+		/*
+		 * If the pid wasn't listed in the ltos hash, it may correspond
+		 * to an native process in the zone.
+		 */
+		if (p == NULL) {
+			p = prfind_zone(lpid, zone->zone_id);
+			tid = 0;
+		}
+	}
+
+	if (p == NULL) {
+		mutex_exit(&pidlock);
+		return (-1);
+	}
+
+	/*
+	 * Bail on processes belonging to the system, those which are not yet
+	 * complete and zombies (unless explicitly allowed via the flags).
+	 */
+	if (p->p_stat == SIDL || (p->p_flag & SSYS) != 0 ||
+	    (p->p_stat == SZOMB && (flag & LXP_ZOMBOK) == 0)) {
+		mutex_exit(&pidlock);
+		return (-1);
+	}
+	mutex_enter(&p->p_lock);
+	mutex_exit(&pidlock);
+
+	if (flag & LXP_PRLOCK) {
+		/*
+		 * It would be convenient to call sprtrylock_proc() for this
+		 * task.  Unfortunately, its behavior of filtering zombies is
+		 * excessive for some lx_proc use cases.  Instead, when the
+		 * provided flags do not indicate that zombies are allowed,
+		 * exiting processes are filtered out (as would be performed by
+		 * sprtrylock_proc).
+		 */
+		if ((p->p_flag & (SEXITING|SEXITLWPS)) != 0 &&
+		    (flag & LXP_ZOMBOK) == 0) {
+			mutex_exit(&p->p_lock);
+			return (-1);
+		}
+		if (p->p_proc_flag & P_PR_LOCK) {
+			sprwaitlock_proc(p);
+			goto retry;
+		} else {
+			p->p_proc_flag |= P_PR_LOCK;
+			THREAD_KPRI_REQUEST();
+		}
+	}
+
+	if (tid == 0) {
+		t = p->p_tlist;
+	} else {
+		lwpdir_t *ld;
+
+		ld = lwp_hash_lookup(p, tid);
+		if (ld == NULL) {
+			if (flag & LXP_PRLOCK) {
+				sprunprlock(p);
+			}
+			mutex_exit(&p->p_lock);
+			return (-1);
+		}
+		t = ld->ld_entry->le_thread;
+	}
+	*pp = p;
+	if (tp != NULL) {
+		*tp = t;
+	}
+	return (0);
+}
+
+
+/*
+ * Given an lwp, return the Linux pid of its parent.  If the caller
+ * wants them, we return the SunOS (pid, tid) as well.
+ */
+pid_t
+lx_lwp_ppid(klwp_t *lwp, pid_t *ppidp, id_t *ptidp)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	proc_t *p = lwptoproc(lwp);
+	const pid_t zoneinit = p->p_zone->zone_proc_initpid;
+	const pid_t ppid = p->p_ppid;
+
+	/*
+	 * Report a ppid of 1 for processes which are children to either init
+	 * or a process outside the zone.
+	 */
+	if (ppid == zoneinit || (p->p_flag & SZONETOP) != 0) {
+		goto ppid_is_zinit;
+	}
+
+	/*
+	 * Our native concept of a 'parent pid' matches Linux in two cases:
+	 *
+	 * - TGID and PID are equal: This is either the first thread in the
+	 *   process or one created with CLONE_THREAD.
+	 *
+	 * - The brand lwp value for PPID is 0: This is either the child of a
+	 *   differently-branded process or was created with the CLONE_PARENT.
+	 */
+	if (p->p_pid == lwpd->br_tgid || lwpd->br_ppid == 0) {
+		if (ppidp != NULL)
+			*ppidp = ppid;
+		if (ptidp != NULL)
+			*ptidp = -1;
+		return (ppid);
+	}
+
+	/*
+	 * In all other cases, we are looking for the parent of this specific
+	 * thread, which in Linux refers to the thread that clone(2)d it.   We
+	 * stashed that thread's PID away when this thread was created.
+	 */
+	mutex_enter(&hash_lock);
+	for (struct lx_pid *hp = ltos_pid_hash[LTOS_HASH(lwpd->br_ppid)];
+	    hp != NULL; hp = hp->lxp_ltos_next) {
+		if (lwpd->br_ppid == hp->lxp_lpid) {
+			/*
+			 * The PID matches, but there are a couple cases when
+			 * the translation is not suitable:
+			 *
+			 * - The cached start time is too young, indicating
+			 *   that the thread exited and the PID was reused by
+			 *   another process.
+			 * - The parent is zoneinit
+			 *
+			 * In both cases, a result of ppid=1 is yielded.
+			 */
+			if (hp->lxp_start > lwptot(lwp)->t_start ||
+			    lwpd->br_ppid == zoneinit) {
+				break;
+			}
+
+			/* Good match, yield the result */
+			if (ppidp != NULL)
+				*ppidp = hp->lxp_spid;
+			if (ptidp != NULL)
+				*ptidp = hp->lxp_stid;
+			mutex_exit(&hash_lock);
+			return (lwpd->br_ppid);
+		}
+	}
+	mutex_exit(&hash_lock);
+	/*
+	 * If no match is found in the Linux->SunOS translation hash, fall back
+	 * to assuming the zone init process as the parent.
+	 */
+
+ppid_is_zinit:
+	if (ppidp != NULL)
+		*ppidp = 1;
+	if (ptidp != NULL)
+		*ptidp = -1;
+	return (1);
+}
+
+void
+lx_pid_init(void)
+{
+	hash_size = 1 << highbit(v.v_proc / (hash_len * LINUX_PROC_FACTOR));
+
+	stol_pid_hash = kmem_zalloc(sizeof (struct lx_pid *) * hash_size,
+	    KM_SLEEP);
+	ltos_pid_hash = kmem_zalloc(sizeof (struct lx_pid *) * hash_size,
+	    KM_SLEEP);
+
+	mutex_init(&hash_lock, NULL, MUTEX_DEFAULT, NULL);
+}
+
+void
+lx_pid_fini(void)
+{
+	kmem_free(stol_pid_hash, sizeof (struct lx_pid *) * hash_size);
+	kmem_free(ltos_pid_hash, sizeof (struct lx_pid *) * hash_size);
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_ptrace.c b/usr/src/uts/common/brand/lx/os/lx_ptrace.c
new file mode 100644
index 0000000000..3131774f27
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_ptrace.c
@@ -0,0 +1,2671 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * Emulation of the Linux ptrace(2) interface.
+ *
+ * OVERVIEW
+ *
+ * The Linux process model is somewhat different from the illumos native
+ * model.  One critical difference is that each Linux thread has a unique
+ * identifier in the pid namespace.  The lx brand assigns a pid to each LWP
+ * within the emulated process, giving the pid of the process itself to the
+ * first LWP.
+ *
+ * The Linux ptrace(2) interface allows for any LWP in a branded process to
+ * exert control over any other LWP within the same zone.  Control is exerted
+ * by the use of the ptrace(2) system call itself, which accepts a number of
+ * request codes.  Feedback on traced events is primarily received by the
+ * tracer through SIGCLD and the emulated waitpid(2) and waitid(2) system
+ * calls.  Many of the possible ptrace(2) requests will only succeed if the
+ * target LWP is in a "ptrace-stop" condition.
+ *
+ * HISTORY
+ *
+ * The brand support for ptrace(2) was originally built on top of the rich
+ * support for debugging and tracing provided through the illumos /proc
+ * interfaces, mounted at /native/proc within the zone.  The native legacy
+ * ptrace(3C) functionality was used as a starting point, but was generally
+ * insufficient for complete and precise emulation.  The extant legacy
+ * interface, and indeed our native SIGCLD and waitid(2) facilities, are
+ * focused on _process_ level concerns -- the Linux interface has been
+ * extended to be aware of LWPs as well.
+ *
+ * In order to allow us to focus on providing more complete and accurate
+ * emulation without extensive and undesirable changes to the native
+ * facilities, this second generation ptrace(2) emulation is mostly separate
+ * from any other tracing or debugging framework in the system.
+ *
+ * ATTACHING TRACERS TO TRACEES
+ *
+ * There are several ways that a child LWP may becomed traced by a tracer.
+ * To determine which attach method caused a tracee to become attached, one
+ * may inspect the "br_ptrace_attach" member of the LWP-specific brand data
+ * with the debugger.
+ *
+ * The first attach methods to consider are the attaching ptrace(2) requests:
+ *
+ *   PTRACE_TRACEME
+ *
+ *   If an LWP makes a PTRACE_TRACEME call, it will be attached as a tracee
+ *   to its parent LWP (br_ppid).  Using PTRACE_TRACEME does _not_ cause the
+ *   tracee to be held in a stop condition.  It is common practice for
+ *   consumers to raise(SIGSTOP) immediately afterward.
+ *
+ *   PTRACE_ATTACH
+ *
+ *   An LWP may attempt to trace any other LWP in this, or another, process.
+ *   We currently allow any attach where the process containing the tracer
+ *   LWP has permission to write to /proc for the process containing the
+ *   intended tracer.  This action also sends a SIGSTOP to the newly attached
+ *   tracee.
+ *
+ * The second class of attach methods are the clone(2)/fork(2) inheritance
+ * options that may be set on a tracee with PTRACE_SETOPTIONS:
+ *
+ *   PTRACE_O_TRACEFORK, PTRACE_O_TRACEVFORK and PTRACE_O_TRACECLONE
+ *
+ *   If these options have been set on a tracee, then a fork(2), vfork(2) or
+ *   clone(2) respectively will cause the newly created LWP to be traced by
+ *   the same tracer.  The same set of ptrace(2) options will also be set on
+ *   the new child.
+ *
+ * The third class of attach method is the PTRACE_CLONE flag to clone(2).
+ * This flag induces the same inheritance as PTRACE_O_TRACECLONE, but is
+ * passed by the tracee as an argument to clone(2).
+ *
+ * DETACHING TRACEES
+ *
+ * Tracees can be detached by the tracer with the PTRACE_DETACH request.
+ * This request is only valid when the tracee is in a ptrace(2) stop
+ * condition, and is itself a restarting action.
+ *
+ * If the tracer exits without detaching all of its tracees, then all of the
+ * tracees are automatically detached and restarted.  If a tracee was in
+ * "signal-delivery-stop" at the time the tracer exited, the signal will be
+ * released to the child unless it is a SIGSTOP.  We drop this instance of
+ * SIGSTOP in order to prevent the child from becoming stopped by job
+ * control.
+ *
+ * ACCORD ALLOCATION AND MANAGEMENT
+ *
+ * The "lx_ptrace_accord_t" object tracks the agreement between a tracer LWP
+ * and zero or more tracee LWPs.  It is explicitly illegal for a tracee to
+ * trace its tracer, and we block this in PTRACE_ATTACH/PTRACE_TRACEME.
+ *
+ * An LWP starts out without an accord.  If a child of that LWP calls
+ * ptrace(2) with the PTRACE_TRACEME subcommand, or if the LWP itself uses
+ * PTRACE_ATTACH, an accord will be allocated and stored on that LWP.  The
+ * accord structure is not released from that LWP until it arrives in
+ * lx_exitlwp(), as called by lwp_exit().  A new accord will not be
+ * allocated, even if one does not exist, once an LWP arrives in lx_exitlwp()
+ * and sets the LX_PTF_EXITING flag.  An LWP will have at most one accord
+ * structure throughout its entire lifecycle; once it has one, it has the
+ * same one until death.
+ *
+ * The accord is reference counted (lxpa_refcnt), starting at a count of one
+ * at creation to represent the link from the tracer LWP to its accord.  The
+ * accord is not freed until the reference count falls to zero.
+ *
+ * To make mutual exclusion between a detaching tracer and various notifying
+ * tracees simpler, the tracer will hold "pidlock" while it clears the
+ * accord members that point back to the tracer LWP and CV.
+ *
+ * SIGNALS AND JOB CONTROL
+ *
+ * Various actions, either directly ptrace(2) related or commonly associated
+ * with tracing, cause process- or thread-directed SIGSTOP signals to be sent
+ * to tracees (a "signal-delivery-stop"). These signals, and indeed any signal
+ * other than SIGKILL, can be suppressed by the tracer when using a restarting
+ * request (including PTRACE_DETACH) on a child.  The signal may also be
+ * substituted for a different signal.
+ *
+ * If a SIGSTOP (or other stopping signal) is not suppressed by the tracer,
+ * it will induce the regular illumos native job control stop of the entire
+ * traced process.  This is at least passingly similar to the Linux "group
+ * stop" ptrace(2) condition.
+ *
+ * SYSTEM CALL TRACING
+ *
+ * The ptrace(2) interface enables the tracer to hold the tracee on entry and
+ * exit from system calls.  When a stopped tracee is restarted through the
+ * PTRACE_SYSCALL request, the LX_PTF_SYSCALL flag is set until the next
+ * system call boundary.  Whether this is a "syscall-entry-stop" or
+ * "syscall-exit-stop", the tracee is held and the tracer is notified via
+ * SIGCLD/waitpid(2) in the usual way.  The flag LX_PTF_SYSCALL flag is
+ * cleared after each stop; for ongoing system call tracing the tracee must
+ * be continuously restarted with PTRACE_SYSCALL.
+ *
+ * SPECIAL CASES FOR STOP EVENTS
+ *
+ * The strace command is one of the primary consumers of ptrace. In order for
+ * strace to properly understand what is actually happening when it receives a
+ * signal associated with a stop event, these signals must match Linux behavior
+ * exactly or the strace consumer will get out of sync and report incorrect
+ * state. There are a couple of special cases we have to handle to provide
+ * proper interaction of the syscall-entry-stop, syscall-exit-stop, and
+ * signal-delivery-stop events:
+ * 1) The child process of a clone/fork does not emit a syscall-exit-stop event.
+ * 2) A signal that arrives between syscall-enter-stop & syscall-exit-stop must
+ *    not immediately emit signal-delivery-stop. This event must be emitted
+ *    after the syscall is interrupted and syscall-exit-stop has been emitted.
+ *
+ * EVENT STOPS
+ *
+ * Various events (particularly FORK, VFORK, CLONE, EXEC and EXIT) are
+ * enabled by the tracer through PTRACE_SETOPTIONS.  Once enabled, the tracee
+ * will be stopped at the nominated points of interest and the tracer
+ * notified.  The tracer may request additional information about the event,
+ * such as the pid of new LWPs and processes, via PTRACE_GETEVENTMSG.
+ *
+ * LOCK ORDERING RULES
+ *
+ * It is not safe, in general, to hold p_lock for two different processes at
+ * the same time.  This constraint is the primary reason for the existence
+ * (and complexity) of the ptrace(2) accord mechanism.
+ *
+ * In order to facilitate looking up accords by the "pid" of a tracer LWP,
+ * p_lock for the tracer process may be held while entering the accord mutex
+ * (lxpa_lock).  This mutex protects the accord flags and reference count.
+ * The reference count is manipulated through lx_ptrace_accord_hold() and
+ * lx_ptrace_accord_rele().
+ *
+ * DO NOT interact with the accord mutex (lxpa_lock) directly.  The
+ * lx_ptrace_accord_enter() and lx_ptrace_accord_exit() functions do various
+ * book-keeping and lock ordering enforcement and MUST be used.
+ *
+ * It is NOT legal to take ANY p_lock while holding the accord mutex
+ * (lxpa_lock).  If the lxpa_tracees_lock is to be held concurrently with
+ * lxpa_lock, lxpa_lock MUST be taken first and dropped before taking p_lock
+ * of any processes from the tracee list.
+ *
+ * It is NOT legal to take a tracee p_lock and then attempt to enter the
+ * accord mutex (or tracee list mutex) of its tracer.  When running as the
+ * tracee LWP, the tracee's hold will prevent the accord from being freed.
+ * Use of the LX_PTF_STOPPING or LX_PTF_CLONING flag in the LWP-specific brand
+ * data prevents an exiting tracer from altering the tracee until the tracee
+ * has come to an orderly stop, without requiring the tracee to hold its own
+ * p_lock the entire time it is stopping.
+ *
+ * It is not safe, in general, to enter "pidlock" while holding the p_lock of
+ * any process.  It is similarly illegal to hold any accord locks (lxpa_lock
+ * or lxpa_sublock) while attempting to enter "pidlock".  As "pidlock" is a
+ * global mutex, it should be held for the shortest possible time.
+ */
+
+#include <sys/types.h>
+#include <sys/kmem.h>
+#include <sys/ksynch.h>
+#include <sys/sysmacros.h>
+#include <sys/procfs.h>
+#include <sys/cmn_err.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/wait.h>
+#include <sys/prsystm.h>
+#include <sys/note.h>
+
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_misc.h>
+#include <lx_syscall.h>
+#include <lx_signum.h>
+
+
+typedef enum lx_ptrace_cont_flags_t {
+	LX_PTC_NONE = 0x00,
+	LX_PTC_SYSCALL = 0x01,
+	LX_PTC_SINGLESTEP = 0x02
+} lx_ptrace_cont_flags_t;
+
+
+extern int lx_user_regs_copyin(lx_lwp_data_t *, void *);
+extern int lx_user_regs_copyout(lx_lwp_data_t *, void *);
+extern int lx_ptrace_peekuser(lx_lwp_data_t *, uintptr_t, void *);
+extern int lx_ptrace_pokeuser(lx_lwp_data_t *, uintptr_t, void *);
+extern int lx_user_fpregs_copyin(lx_lwp_data_t *, void *);
+extern int lx_user_fpregs_copyout(lx_lwp_data_t *, void *);
+extern int lx_user_fpxregs_copyin(lx_lwp_data_t *, void *);
+extern int lx_user_fpxregs_copyout(lx_lwp_data_t *, void *);
+
+/*
+ * Macros for checking the state of an LWP via "br_ptrace_flags":
+ */
+#define	LX_PTRACE_BUSY \
+	(LX_PTF_EXITING | LX_PTF_STOPPING | LX_PTF_CLONING)
+
+#define	VISIBLE(a)	(((a)->br_ptrace_flags & LX_PTF_EXITING) == 0)
+#define	TRACEE_BUSY(a)	(((a)->br_ptrace_flags & LX_PTRACE_BUSY) != 0)
+
+#define	ACCORD_HELD(a)	MUTEX_HELD(&(a)->lxpa_lock)
+
+#define	LX_PID_TO_INIT(x)	((x) == curproc->p_zone->zone_proc_initpid ? \
+	1 : (x))
+#define	LX_INIT_TO_PID(x)	((x) == 1 ? \
+	curproc->p_zone->zone_proc_initpid : (x))
+
+static kcondvar_t lx_ptrace_busy_cv;
+static kmem_cache_t *lx_ptrace_accord_cache;
+
+/*
+ * Enter the accord mutex.
+ */
+static void
+lx_ptrace_accord_enter(lx_ptrace_accord_t *accord)
+{
+	VERIFY(MUTEX_NOT_HELD(&accord->lxpa_tracees_lock));
+
+	mutex_enter(&accord->lxpa_lock);
+}
+
+/*
+ * Exit the accord mutex.  If the reference count has dropped to zero,
+ * free the accord.
+ */
+static void
+lx_ptrace_accord_exit(lx_ptrace_accord_t *accord)
+{
+	VERIFY(ACCORD_HELD(accord));
+
+	if (accord->lxpa_refcnt > 0) {
+		mutex_exit(&accord->lxpa_lock);
+		return;
+	}
+
+	/*
+	 * When the reference count drops to zero we must free the accord.
+	 */
+	VERIFY(accord->lxpa_tracer == NULL);
+	VERIFY(MUTEX_NOT_HELD(&accord->lxpa_tracees_lock));
+	VERIFY(list_is_empty(&accord->lxpa_tracees));
+	VERIFY(accord->lxpa_flags & LX_ACC_TOMBSTONE);
+
+	mutex_destroy(&accord->lxpa_lock);
+	mutex_destroy(&accord->lxpa_tracees_lock);
+
+	kmem_cache_free(lx_ptrace_accord_cache, accord);
+}
+
+/*
+ * Drop our reference to this accord.  If this drops the reference count
+ * to zero, the next lx_ptrace_accord_exit() will free the accord.
+ */
+static void
+lx_ptrace_accord_rele(lx_ptrace_accord_t *accord)
+{
+	VERIFY(ACCORD_HELD(accord));
+
+	VERIFY(accord->lxpa_refcnt > 0);
+	accord->lxpa_refcnt--;
+}
+
+/*
+ * Place an additional hold on an accord.
+ */
+static void
+lx_ptrace_accord_hold(lx_ptrace_accord_t *accord)
+{
+	VERIFY(ACCORD_HELD(accord));
+
+	accord->lxpa_refcnt++;
+}
+
+/*
+ * Fetch the accord for this LWP.  If one has not yet been created, and the
+ * process is not exiting, allocate it now.  Must be called with p_lock held
+ * for the process containing the target LWP.
+ *
+ * If successful, we return holding the accord lock (lxpa_lock).
+ */
+static int
+lx_ptrace_accord_get_locked(klwp_t *lwp, lx_ptrace_accord_t **accordp,
+    boolean_t allocate_one)
+{
+	lx_ptrace_accord_t *lxpa;
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	proc_t *p = lwptoproc(lwp);
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+
+	/*
+	 * If this LWP does not have an accord, we wish to allocate
+	 * and install one.
+	 */
+	if ((lxpa = lwpd->br_ptrace_accord) == NULL) {
+		if (!allocate_one || !VISIBLE(lwpd)) {
+			/*
+			 * Either we do not wish to allocate an accord, or this
+			 * LWP has already begun exiting from a ptrace
+			 * perspective.
+			 */
+			*accordp = NULL;
+			return (ESRCH);
+		}
+
+		lxpa = kmem_cache_alloc(lx_ptrace_accord_cache, KM_SLEEP);
+		bzero(lxpa, sizeof (*lxpa));
+
+		/*
+		 * The initial reference count is 1 because we are referencing
+		 * it in from the soon-to-be tracer LWP.
+		 */
+		lxpa->lxpa_refcnt = 1;
+		mutex_init(&lxpa->lxpa_lock, NULL, MUTEX_DEFAULT, NULL);
+		mutex_init(&lxpa->lxpa_tracees_lock, NULL, MUTEX_DEFAULT, NULL);
+		list_create(&lxpa->lxpa_tracees, sizeof (lx_lwp_data_t),
+		    offsetof(lx_lwp_data_t, br_ptrace_linkage));
+		lxpa->lxpa_cvp = &p->p_cv;
+
+		lxpa->lxpa_tracer = lwpd;
+		lwpd->br_ptrace_accord = lxpa;
+	}
+
+	/*
+	 * Lock the accord before returning it to the caller.
+	 */
+	lx_ptrace_accord_enter(lxpa);
+
+	/*
+	 * There should be at least one active reference to this accord,
+	 * otherwise it should have been freed.
+	 */
+	VERIFY(lxpa->lxpa_refcnt > 0);
+
+	*accordp = lxpa;
+	return (0);
+}
+
+/*
+ * Accords belong to the tracer LWP.  Get the accord for this tracer or return
+ * an error if it was not possible.  To prevent deadlocks, the caller MUST NOT
+ * hold p_lock on its own or any other process.
+ *
+ * If successful, we return holding the accord lock (lxpa_lock).
+ */
+static int
+lx_ptrace_accord_get_by_pid(pid_t lxpid, lx_ptrace_accord_t **accordp)
+{
+	int ret = ESRCH;
+	proc_t *aproc;
+	kthread_t *athr;
+	klwp_t *alwp;
+	lx_lwp_data_t *alwpd;
+
+	VERIFY(MUTEX_NOT_HELD(&curproc->p_lock));
+
+	/*
+	 * Locate the process containing the tracer LWP based on its Linux pid
+	 * and lock it.
+	 */
+	if (lx_lpid_lock(lxpid, curzone, LXP_PRLOCK, &aproc, &athr) != 0) {
+		return (ESRCH);
+	}
+
+	/*
+	 * Locate the tracer LWP itself and ensure that it is visible to
+	 * ptrace(2).
+	 */
+	if ((alwp = ttolwp(athr)) == NULL ||
+	    (alwpd = lwptolxlwp(alwp)) == NULL ||
+	    !VISIBLE(alwpd)) {
+		sprunlock(aproc);
+		return (ESRCH);
+	}
+
+	/*
+	 * We should not fetch our own accord this way.
+	 */
+	if (athr == curthread) {
+		sprunlock(aproc);
+		return (EPERM);
+	}
+
+	/*
+	 * Fetch (or allocate) the accord owned by this tracer LWP:
+	 */
+	ret = lx_ptrace_accord_get_locked(alwp, accordp, B_TRUE);
+
+	/*
+	 * Unlock the process and return.
+	 */
+	sprunlock(aproc);
+	return (ret);
+}
+
+/*
+ * Get (or allocate) the ptrace(2) accord for the current LWP, acting as a
+ * tracer.  The caller MUST NOT currently hold p_lock on the process containing
+ * this LWP.
+ *
+ * If successful, we return holding the accord lock (lxpa_lock).
+ */
+static int
+lx_ptrace_accord_get(lx_ptrace_accord_t **accordp, boolean_t allocate_one)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	proc_t *p = lwptoproc(lwp);
+	int ret;
+
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	/*
+	 * Lock the tracer (this LWP).
+	 */
+	mutex_enter(&p->p_lock);
+
+	/*
+	 * Fetch (or allocate) the accord for this LWP:
+	 */
+	ret = lx_ptrace_accord_get_locked(lwp, accordp, allocate_one);
+
+	mutex_exit(&p->p_lock);
+
+	return (ret);
+}
+
+/*
+ * Restart an LWP if it is in "ptrace-stop".  This function may induce sleep,
+ * so the caller MUST NOT hold any mutexes other than p_lock for the process
+ * containing the LWP.
+ */
+static void
+lx_ptrace_restart_lwp(klwp_t *lwp)
+{
+	kthread_t *rt = lwptot(lwp);
+	proc_t *rproc = lwptoproc(lwp);
+	lx_lwp_data_t *rlwpd = lwptolxlwp(lwp);
+
+	VERIFY(rt != curthread);
+	VERIFY(MUTEX_HELD(&rproc->p_lock));
+
+	/*
+	 * Exclude potential meddling from procfs.
+	 */
+	prbarrier(rproc);
+
+	/*
+	 * Check that the LWP is still in "ptrace-stop" and, if so, restart it.
+	 */
+	thread_lock(rt);
+	if (BSTOPPED(rt) && rt->t_whystop == PR_BRAND) {
+		rt->t_schedflag |= TS_BSTART;
+		setrun_locked(rt);
+
+		/*
+		 * Clear stop reason.
+		 */
+		rlwpd->br_ptrace_whystop = 0;
+		rlwpd->br_ptrace_whatstop = 0;
+		rlwpd->br_ptrace_flags &= ~(LX_PTF_CLDPEND | LX_PTF_WAITPEND);
+	}
+	thread_unlock(rt);
+}
+
+static void
+lx_ptrace_winfo(lx_lwp_data_t *remote, k_siginfo_t *ip, boolean_t waitflag,
+    pid_t *event_ppid, pid_t *event_pid)
+{
+	int signo;
+
+	/*
+	 * Populate our k_siginfo_t with data about this "ptrace-stop"
+	 * condition:
+	 */
+	bzero(ip, sizeof (*ip));
+	ip->si_signo = SIGCLD;
+	ip->si_pid = LX_PID_TO_INIT(remote->br_pid);
+	ip->si_code = CLD_TRAPPED;
+
+	switch (remote->br_ptrace_whatstop) {
+	case LX_PR_SYSENTRY:
+	case LX_PR_SYSEXIT:
+		ip->si_status = SIGTRAP;
+		if (remote->br_ptrace_options & LX_PTRACE_O_TRACESYSGOOD) {
+			ip->si_status |= 0x80;
+		}
+		break;
+
+	case LX_PR_SIGNALLED:
+		signo = remote->br_ptrace_stopsig;
+		if (signo < 1 || signo >= LX_NSIG) {
+			/*
+			 * If this signal number is not valid, pretend it
+			 * was a SIGTRAP.
+			 */
+			ip->si_status = SIGTRAP;
+		} else {
+			ip->si_status = ltos_signo[signo];
+		}
+		break;
+
+	case LX_PR_EVENT:
+		ip->si_status = SIGTRAP | remote->br_ptrace_event;
+		/*
+		 * Record the Linux pid of both this LWP and the create
+		 * event we are dispatching.  We will use this information
+		 * to unblock any subsequent ptrace(2) events that depend
+		 * on this one.
+		 */
+		if (event_ppid != NULL)
+			*event_ppid = remote->br_pid;
+		if (event_pid != NULL)
+			*event_pid = (pid_t)remote->br_ptrace_eventmsg;
+		break;
+
+	default:
+		cmn_err(CE_PANIC, "unxpected stop subreason: %d",
+		    remote->br_ptrace_whatstop);
+	}
+
+	/*
+	 * If WNOWAIT was specified, do not mark the event as posted
+	 * so that it may be re-fetched on another call to waitid().
+	 */
+	if (waitflag)
+		remote->br_ptrace_flags &= ~(LX_PTF_CLDPEND | LX_PTF_WAITPEND);
+}
+
+/*
+ * Receive notification from stop() of a PR_BRAND stop.
+ */
+void
+lx_stop_notify(proc_t *p, klwp_t *lwp, ushort_t why, ushort_t what)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	lx_ptrace_accord_t *accord;
+	klwp_t *plwp = NULL;
+	proc_t *pp = NULL;
+	lx_lwp_data_t *parent;
+	boolean_t cldpend = B_TRUE;
+	boolean_t cldpost = B_FALSE;
+	sigqueue_t *sqp = NULL;
+
+	/*
+	 * We currently only care about LX-specific stop reasons.
+	 */
+	if (why != PR_BRAND)
+		return;
+
+	switch (what) {
+	case LX_PR_SYSENTRY:
+	case LX_PR_SYSEXIT:
+	case LX_PR_SIGNALLED:
+	case LX_PR_EVENT:
+		break;
+	default:
+		cmn_err(CE_PANIC, "unexpected subreason for PR_BRAND"
+		    " stop: %d", (int)what);
+	}
+
+	/*
+	 * We should be holding the lock on our containing process.  The
+	 * STOPPING flag should have been set by lx_ptrace_stop() for all
+	 * PR_BRAND stops.
+	 */
+	VERIFY(MUTEX_HELD(&p->p_lock));
+	VERIFY(lwpd->br_ptrace_flags & LX_PTF_STOPPING);
+	VERIFY((accord = lwpd->br_ptrace_tracer) != NULL);
+
+	/*
+	 * We must drop our process lock to take "pidlock".  The
+	 * LX_PTF_STOPPING flag protects us from an exiting or detaching tracer.
+	 */
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * Allocate before we enter any mutexes.
+	 */
+	sqp = kmem_zalloc(sizeof (*sqp), KM_SLEEP);
+
+	/*
+	 * We take pidlock now, which excludes all callers of waitid() and
+	 * prevents an exiting tracer from clearing critical accord members.
+	 */
+	mutex_enter(&pidlock);
+	mutex_enter(&p->p_lock);
+
+	/*
+	 * Get the ptrace(2) "parent" process, to which we may send
+	 * a SIGCLD signal later.
+	 */
+	if ((parent = accord->lxpa_tracer) != NULL &&
+	    (plwp = parent->br_lwp) != NULL) {
+		pp = lwptoproc(plwp);
+	}
+
+	/*
+	 * Our tracer should not have been modified in our absence; the
+	 * LX_PTF_STOPPING flag prevents it.
+	 */
+	VERIFY(lwpd->br_ptrace_tracer == accord);
+
+	/*
+	 * Stash data for this stop condition in the LWP data while we hold
+	 * both pidlock and our p_lock.
+	 */
+	lwpd->br_ptrace_whystop = why;
+	lwpd->br_ptrace_whatstop = what;
+	lwpd->br_ptrace_flags |= LX_PTF_WAITPEND;
+
+	/*
+	 * If this event does not depend on an event from the parent LWP,
+	 * populate the siginfo_t for the event pending on this tracee LWP.
+	 */
+	if (!(lwpd->br_ptrace_flags & LX_PTF_PARENT_WAIT) && pp != NULL) {
+		cldpost = B_TRUE;
+		lx_ptrace_winfo(lwpd, &sqp->sq_info, B_FALSE, NULL, NULL);
+	}
+
+	/*
+	 * Drop our p_lock so that we may lock the tracer.
+	 */
+	mutex_exit(&p->p_lock);
+	if (cldpost && pp != NULL) {
+		/*
+		 * Post the SIGCLD to the tracer.
+		 */
+		mutex_enter(&pp->p_lock);
+		if (!sigismember(&pp->p_sig, SIGCLD)) {
+			sigaddqa(pp, plwp->lwp_thread, sqp);
+			cldpend = B_FALSE;
+			sqp = NULL;
+		}
+		mutex_exit(&pp->p_lock);
+	}
+
+	/*
+	 * We re-take our process lock now.  The lock will be held until
+	 * the thread is actually marked stopped, so we will not race with
+	 * lx_ptrace_lock_if_stopped() or lx_waitid_helper().
+	 */
+	mutex_enter(&p->p_lock);
+
+	/*
+	 * We clear the STOPPING flag; stop() continues to hold our p_lock
+	 * until our thread stop state is visible.
+	 */
+	lwpd->br_ptrace_flags &= ~LX_PTF_STOPPING;
+	lwpd->br_ptrace_flags |= LX_PTF_STOPPED;
+	if (cldpend) {
+		/*
+		 * We sent the SIGCLD for this new wait condition already.
+		 */
+		lwpd->br_ptrace_flags |= LX_PTF_CLDPEND;
+	}
+
+	/*
+	 * If lx_ptrace_exit_tracer(), or a detach operation, is trying to
+	 * detach our tracer, it will be sleeping on this CV until
+	 * LX_PTF_STOPPING is clear.  Wake it now.
+	 */
+	cv_broadcast(&lx_ptrace_busy_cv);
+
+	/*
+	 * While still holding pidlock, we attempt to wake our tracer from a
+	 * potential waitid() slumber.
+	 */
+	if (accord->lxpa_cvp != NULL) {
+		cv_broadcast(accord->lxpa_cvp);
+	}
+
+	/*
+	 * We release pidlock and return as we were called: with our p_lock
+	 * held.
+	 */
+	mutex_exit(&pidlock);
+
+	if (sqp != NULL) {
+		kmem_free(sqp, sizeof (*sqp));
+	}
+}
+
+/*
+ * For any restarting action (e.g. PTRACE_CONT, PTRACE_SYSCALL or
+ * PTRACE_DETACH) to be allowed, the tracee LWP must be in "ptrace-stop".  This
+ * check must ONLY be run on tracees of the current LWP.  If the check is
+ * successful, we return with the tracee p_lock held.
+ *
+ * In the case of PTRACE_DETACH, we can return with the tracee locked even if
+ * it is not in "ptrace-stop". This can happen for various reasons, such as if
+ * the remote process is already job-stopped in the kernel. We must still be
+ * able to detach from this process. We return ENOENT in this case.
+ */
+static int
+lx_ptrace_lock_if_stopped(lx_ptrace_accord_t *accord, lx_lwp_data_t *remote,
+    boolean_t detaching)
+{
+	klwp_t *rlwp = remote->br_lwp;
+	proc_t *rproc = lwptoproc(rlwp);
+	kthread_t *rt = lwptot(rlwp);
+
+	/*
+	 * We must never check that we, ourselves, are stopped.  We must also
+	 * have the accord tracee list locked while we lock our tracees.
+	 */
+	VERIFY(curthread != rt);
+	VERIFY(MUTEX_HELD(&accord->lxpa_tracees_lock));
+	VERIFY(accord->lxpa_tracer == ttolxlwp(curthread));
+
+	/*
+	 * Lock the process containing the tracee LWP.
+	 */
+	mutex_enter(&rproc->p_lock);
+	if (!VISIBLE(remote)) {
+		/*
+		 * The tracee LWP is currently detaching itself as it exits.
+		 * It is no longer visible to ptrace(2).
+		 */
+		mutex_exit(&rproc->p_lock);
+		return (ESRCH);
+	}
+
+	/*
+	 * We must only check whether tracees of the current LWP are stopped.
+	 * We check this condition after confirming visibility as an exiting
+	 * tracee may no longer be completely consistent.
+	 */
+	VERIFY(remote->br_ptrace_tracer == accord);
+
+	if (!(remote->br_ptrace_flags & LX_PTF_STOPPED)) {
+		if (detaching) {
+			/*
+			 * The tracee is not in "ptrace-stop", but we still
+			 * return with the locked process. This is indicated
+			 * by ENOENT.
+			 */
+			return (ENOENT);
+		}
+
+		/*
+		 * The tracee is not in "ptrace-stop", so we release the
+		 * process.
+		 */
+		mutex_exit(&rproc->p_lock);
+		return (ESRCH);
+	}
+
+	/*
+	 * The tracee is stopped.  We return holding its process lock so that
+	 * the caller may manipulate it.
+	 */
+	return (0);
+}
+
+static int
+lx_ptrace_setoptions(lx_lwp_data_t *remote, uintptr_t options)
+{
+	/*
+	 * Check for valid options.
+	 */
+	if ((options & ~LX_PTRACE_O_ALL) != 0) {
+		return (EINVAL);
+	}
+
+	/*
+	 * Set ptrace options on the target LWP.
+	 */
+	remote->br_ptrace_options = (lx_ptrace_options_t)options;
+
+	return (0);
+}
+
+static int
+lx_ptrace_geteventmsg(lx_lwp_data_t *remote, void *umsgp)
+{
+	int error;
+
+#if defined(_SYSCALL32_IMPL)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		uint32_t tmp = remote->br_ptrace_eventmsg;
+
+		error = copyout(&tmp, umsgp, sizeof (uint32_t));
+	} else
+#endif
+	{
+		error = copyout(&remote->br_ptrace_eventmsg, umsgp,
+		    sizeof (ulong_t));
+	}
+
+	return (error);
+}
+
+static int
+lx_ptrace_getsiginfo(lx_lwp_data_t *remote, void *usiginfo)
+{
+	klwp_t *lwp = remote->br_lwp;
+	int lx_sig;
+
+	lx_sig = lx_stol_signo(lwp->lwp_cursig, 0);
+	if (lx_sig < 1 || lwp->lwp_curinfo == NULL) {
+		return (EINVAL);
+	}
+
+#if defined(_SYSCALL32_IMPL)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		if (stol_ksiginfo32_copyout(&lwp->lwp_curinfo->sq_info,
+		    usiginfo) != 0) {
+			return (EFAULT);
+		}
+	} else
+#endif
+	{
+		if (stol_ksiginfo_copyout(&lwp->lwp_curinfo->sq_info,
+		    usiginfo) != 0) {
+			return (EFAULT);
+		}
+	}
+
+	return (0);
+}
+
+
+/*
+ * Implements the PTRACE_CONT subcommand of the Linux ptrace(2) interface.
+ */
+static int
+lx_ptrace_cont(lx_lwp_data_t *remote, lx_ptrace_cont_flags_t flags, int signo)
+{
+	klwp_t *lwp = remote->br_lwp;
+
+	if (flags & LX_PTC_SINGLESTEP) {
+		/*
+		 * We do not currently support single-stepping.
+		 */
+		lx_unsupported("PTRACE_SINGLESTEP not currently implemented");
+		return (EINVAL);
+	}
+
+	/*
+	 * The tracer may choose to suppress the delivery of a signal, or
+	 * select an alternative signal for delivery.  If this is an
+	 * appropriate ptrace(2) "signal-delivery-stop", br_ptrace_stopsig
+	 * will be used as the new signal number.
+	 *
+	 * As with so many other aspects of the Linux ptrace(2) interface, this
+	 * may fail silently if the state machine is not aligned correctly.
+	 */
+	remote->br_ptrace_stopsig = signo;
+	remote->br_ptrace_donesig = 0;
+
+	/*
+	 * Handle the syscall-stop flag if this is a PTRACE_SYSCALL restart:
+	 */
+	if (flags & LX_PTC_SYSCALL) {
+		remote->br_ptrace_flags |= LX_PTF_SYSCALL;
+	} else {
+		remote->br_ptrace_flags &= ~LX_PTF_SYSCALL;
+	}
+
+	lx_ptrace_restart_lwp(lwp);
+
+	return (0);
+}
+
+/*
+ * Implements the PTRACE_DETACH subcommand of the Linux ptrace(2) interface.
+ *
+ * The LWP identified by the Linux pid "lx_pid" will, if it as a tracee of the
+ * current LWP, be detached and (optionally) set runnable.
+ */
+static void
+lx_ptrace_detach(lx_ptrace_accord_t *accord, lx_lwp_data_t *remote, int signo,
+    boolean_t restart)
+{
+	klwp_t *rlwp = remote->br_lwp;
+
+	/*
+	 * The tracee LWP may have been in "ptrace-stop" (restart is true if
+	 * that was the case). We now hold the tracee's p_lock.
+	 * Detach the LWP from the accord and set it running.
+	 */
+	VERIFY(!TRACEE_BUSY(remote));
+	VERIFY(MUTEX_HELD(&accord->lxpa_tracees_lock));
+	remote->br_ptrace_flags &= ~(LX_PTF_SYSCALL | LX_PTF_INHERIT);
+	VERIFY(list_link_active(&remote->br_ptrace_linkage));
+	list_remove(&accord->lxpa_tracees, remote);
+
+	remote->br_ptrace_attach = LX_PTA_NONE;
+	remote->br_ptrace_tracer = NULL;
+	remote->br_ptrace_flags = 0;
+
+	/*
+	 * Decrement traced-lwp count for the process.
+	 */
+	ASSERT(MUTEX_HELD(&rlwp->lwp_procp->p_lock));
+	VERIFY(ptolxproc(rlwp->lwp_procp)->l_ptrace-- >= 1);
+
+	/*
+	 * The tracer may, as described in lx_ptrace_cont(), choose to suppress
+	 * or modify the delivered signal.
+	 */
+	remote->br_ptrace_stopsig = signo;
+	remote->br_ptrace_donesig = 0;
+
+	if (restart) {
+		lx_ptrace_restart_lwp(rlwp);
+	}
+}
+
+/*
+ * This routine implements the PTRACE_ATTACH operation of the Linux ptrace(2)
+ * interface.
+ *
+ * This LWP is requesting to be attached as a tracer to another LWP -- the
+ * tracee.  If a ptrace accord to track the list of tracees has not yet been
+ * allocated, one will be allocated and attached to this LWP now.
+ *
+ * The "br_ptrace_tracer" on the tracee LWP is set to this accord, and the
+ * tracee LWP is then added to the "lxpa_tracees" list in the accord.  We drop
+ * locks between these two phases; the only consumer of trace events from this
+ * accord is this LWP, which obviously cannot be running waitpid(2) at the same
+ * time as this call to ptrace(2).
+ */
+static int
+lx_ptrace_attach(pid_t lx_pid)
+{
+	int error = ESRCH;
+	/*
+	 * Our (Tracer) LWP:
+	 */
+	lx_ptrace_accord_t *accord;
+	lx_lwp_data_t *lwpd = ttolxlwp(curthread);
+	/*
+	 * Remote (Tracee) LWP:
+	 */
+	proc_t *rproc;
+	kthread_t *rthr;
+	klwp_t *rlwp;
+	lx_lwp_data_t *rlwpd;
+
+	if (lwpd->br_pid == lx_pid) {
+		/*
+		 * We cannot trace ourselves.
+		 */
+		return (EPERM);
+	}
+
+	/*
+	 * Ensure that we have an accord and obtain a lock on it.  This
+	 * routine should not fail because the LWP cannot make ptrace(2) system
+	 * calls after it has begun exiting.
+	 */
+	VERIFY0(lwpd->br_ptrace_flags & LX_PTF_EXITING);
+	VERIFY(lx_ptrace_accord_get(&accord, B_TRUE) == 0);
+
+	/*
+	 * Place speculative hold in case the attach is successful.
+	 */
+	lx_ptrace_accord_hold(accord);
+	lx_ptrace_accord_exit(accord);
+
+	/*
+	 * Locate the process containing the tracee LWP based on its Linux pid
+	 * and lock it.
+	 */
+	if (lx_lpid_lock(lx_pid, curzone, LXP_PRLOCK, &rproc, &rthr) != 0) {
+		/*
+		 * We could not find the target process.
+		 */
+		goto errout;
+	}
+
+	/*
+	 * Locate the tracee LWP.
+	 */
+	if ((rlwp = ttolwp(rthr)) == NULL ||
+	    (rlwpd = lwptolxlwp(rlwp)) == NULL ||
+	    !VISIBLE(rlwpd)) {
+		/*
+		 * The LWP could not be found, was not branded, or is not
+		 * visible to ptrace(2) at this time.
+		 */
+		goto unlock_errout;
+	}
+
+	/*
+	 * We now hold the lock on the tracee.  Attempt to install ourselves
+	 * as the tracer.
+	 */
+	if (curproc != rproc && priv_proc_cred_perm(curproc->p_cred, rproc,
+	    NULL, VWRITE) != 0) {
+		/*
+		 * This process does not have permission to trace the remote
+		 * process.
+		 */
+		error = EPERM;
+	} else if (rlwpd->br_ptrace_tracer != NULL) {
+		/*
+		 * This LWP is already being traced.
+		 */
+		VERIFY(list_link_active(&rlwpd->br_ptrace_linkage));
+		VERIFY(rlwpd->br_ptrace_attach != LX_PTA_NONE);
+		error = EPERM;
+	} else {
+		lx_proc_data_t *rprocd = ptolxproc(rproc);
+
+		/*
+		 * Bond the tracee to the accord.
+		 */
+		VERIFY0(rlwpd->br_ptrace_flags & LX_PTF_EXITING);
+		VERIFY(rlwpd->br_ptrace_attach == LX_PTA_NONE);
+		rlwpd->br_ptrace_attach = LX_PTA_ATTACH;
+		rlwpd->br_ptrace_tracer = accord;
+
+		/* Don't emit ptrace syscall-stop-exit event on kernel exit. */
+		rlwpd->br_ptrace_flags |= LX_PTF_NOSTOP;
+
+		/*
+		 * We had no tracer, and are thus not in the tracees list.
+		 * It is safe to take the tracee list lock while we insert
+		 * ourselves.
+		 */
+		mutex_enter(&accord->lxpa_tracees_lock);
+		VERIFY(!list_link_active(&rlwpd->br_ptrace_linkage));
+		list_insert_tail(&accord->lxpa_tracees, rlwpd);
+		/*
+		 * Bump traced-lwp count for the remote process.
+		 */
+		rprocd->l_ptrace++;
+		mutex_exit(&accord->lxpa_tracees_lock);
+
+		/*
+		 * Send a thread-directed SIGSTOP.
+		 */
+		sigtoproc(rproc, rthr, SIGSTOP);
+
+
+		error = 0;
+	}
+
+unlock_errout:
+	/*
+	 * Unlock the process containing the tracee LWP and the accord.
+	 */
+	sprunlock(rproc);
+
+errout:
+	if (error != 0) {
+		/*
+		 * The attach was not successful.  Remove our speculative
+		 * hold.
+		 */
+		lx_ptrace_accord_enter(accord);
+		lx_ptrace_accord_rele(accord);
+		lx_ptrace_accord_exit(accord);
+	}
+
+	return (error);
+}
+
+int
+lx_ptrace_set_clone_inherit(int option, boolean_t inherit_flag)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	proc_t *p = lwptoproc(lwp);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+
+	switch (option) {
+	case LX_PTRACE_O_TRACEFORK:
+	case LX_PTRACE_O_TRACEVFORK:
+	case LX_PTRACE_O_TRACECLONE:
+		break;
+
+	default:
+		return (EINVAL);
+	}
+
+	mutex_enter(&p->p_lock);
+
+	lwpd->br_ptrace_clone_option = option;
+
+	if (inherit_flag) {
+		lwpd->br_ptrace_flags |= LX_PTF_INHERIT;
+	} else {
+		lwpd->br_ptrace_flags &= ~LX_PTF_INHERIT;
+	}
+
+	mutex_exit(&p->p_lock);
+	return (0);
+}
+
+/*
+ * If the parent LWP is being traced, we want to attach ourselves to the
+ * same accord.
+ */
+void
+lx_ptrace_inherit_tracer(lx_lwp_data_t *src, lx_lwp_data_t *dst)
+{
+	proc_t *srcp = lwptoproc(src->br_lwp);
+	proc_t *dstp = lwptoproc(dst->br_lwp);
+	lx_ptrace_accord_t *accord;
+	boolean_t is_fork = B_FALSE;
+
+	VERIFY(MUTEX_HELD(&dstp->p_lock));
+	if (srcp != dstp) {
+		/*
+		 * In the case of being called via forklwp, some lock shuffling
+		 * is required.  The destination p_lock must be dropped to
+		 * avoid deadlocks when locking the source and manipulating
+		 * ptrace accord resources.
+		 */
+		is_fork = B_TRUE;
+		sprlock_proc(dstp);
+		mutex_exit(&dstp->p_lock);
+		mutex_enter(&srcp->p_lock);
+	}
+
+	if ((accord = src->br_ptrace_tracer) == NULL) {
+		/*
+		 * The source LWP does not have a tracer to inherit.
+		 */
+		goto out;
+	}
+
+	/*
+	 * There are two conditions to check when determining if the new
+	 * child should inherit the same tracer (and tracing options) as its
+	 * parent.  Either condition is sufficient to trigger inheritance.
+	 */
+	dst->br_ptrace_attach = LX_PTA_NONE;
+	if ((src->br_ptrace_options & src->br_ptrace_clone_option) != 0) {
+		/*
+		 * Condition 1:
+		 * The clone(2), fork(2) and vfork(2) emulated system calls
+		 * populate "br_ptrace_clone_option" with the specific
+		 * ptrace(2) SETOPTIONS option that applies to this
+		 * operation.  If the relevant option has been enabled by the
+		 * tracer then we inherit.
+		 */
+		dst->br_ptrace_attach |= LX_PTA_INHERIT_OPTIONS;
+
+	} else if ((src->br_ptrace_flags & LX_PTF_INHERIT) != 0) {
+		/*
+		 * Condition 2:
+		 * If the caller opted in to inheritance with the
+		 * PTRACE_CLONE flag to clone(2), the LX_PTF_INHERIT flag
+		 * will be set and we inherit.
+		 */
+		dst->br_ptrace_attach |= LX_PTA_INHERIT_CLONE;
+	}
+
+	/*
+	 * These values only apply for the duration of a single clone(2), et
+	 * al, system call.
+	 */
+	src->br_ptrace_flags &= ~LX_PTF_INHERIT;
+	src->br_ptrace_clone_option = 0;
+
+	if (dst->br_ptrace_attach == LX_PTA_NONE) {
+		/*
+		 * No condition triggered inheritance.
+		 */
+		goto out;
+	}
+
+	/*
+	 * Set the LX_PTF_CLONING flag to prevent us from being detached
+	 * while our p_lock is dropped.
+	 */
+	src->br_ptrace_flags |= LX_PTF_CLONING;
+	mutex_exit(&srcp->p_lock);
+
+	/*
+	 * Hold the accord for the new LWP.
+	 */
+	lx_ptrace_accord_enter(accord);
+	lx_ptrace_accord_hold(accord);
+	lx_ptrace_accord_exit(accord);
+
+	/*
+	 * Install the tracer and copy the current PTRACE_SETOPTIONS options.
+	 */
+	dst->br_ptrace_tracer = accord;
+	dst->br_ptrace_options = src->br_ptrace_options;
+
+	/*
+	 * This flag prevents waitid() from seeing events for the new child
+	 * until the parent is able to post the relevant ptrace event to
+	 * the tracer.
+	 */
+	dst->br_ptrace_flags |= LX_PTF_PARENT_WAIT;
+
+	mutex_enter(&accord->lxpa_tracees_lock);
+	VERIFY(list_link_active(&src->br_ptrace_linkage));
+	VERIFY(!list_link_active(&dst->br_ptrace_linkage));
+	list_insert_tail(&accord->lxpa_tracees, dst);
+	mutex_exit(&accord->lxpa_tracees_lock);
+
+	/*
+	 * Relock our process and clear our busy flag.
+	 */
+	mutex_enter(&srcp->p_lock);
+	src->br_ptrace_flags &= ~LX_PTF_CLONING;
+
+	/*
+	 * Bump traced-lwp count for the process.
+	 */
+	ptolxproc(dstp)->l_ptrace++;
+
+	/*
+	 * If lx_ptrace_exit_tracer(), or a detach operation, is trying to
+	 * detach our tracer, it will be sleeping on this CV until
+	 * LX_PTF_CLONING is clear.  Wake it now.
+	 */
+	cv_broadcast(&lx_ptrace_busy_cv);
+
+out:
+	if (is_fork) {
+		mutex_exit(&srcp->p_lock);
+		mutex_enter(&dstp->p_lock);
+		sprunprlock(dstp);
+	}
+}
+
+static int
+lx_ptrace_traceme(void)
+{
+	int error;
+	boolean_t did_attach = B_FALSE;
+	/*
+	 * Our (Tracee) LWP:
+	 */
+	klwp_t *lwp = ttolwp(curthread);
+	proc_t *p = lwptoproc(lwp);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	/*
+	 * Remote (Tracer) LWP:
+	 */
+	lx_ptrace_accord_t *accord;
+
+	/*
+	 * We are intending to be the tracee.  Fetch (or allocate) the accord
+	 * for our parent LWP.
+	 */
+	if ((error = lx_ptrace_accord_get_by_pid(lx_lwp_ppid(lwp, NULL,
+	    NULL), &accord)) != 0) {
+		/*
+		 * Could not determine the Linux pid of the parent LWP, or
+		 * could not get the accord for that LWP.
+		 */
+		return (error);
+	}
+
+	/*
+	 * We now hold the accord lock.
+	 */
+	if (accord->lxpa_flags & LX_ACC_TOMBSTONE) {
+		/*
+		 * The accord is marked for death; give up now.
+		 */
+		lx_ptrace_accord_exit(accord);
+		return (ESRCH);
+	}
+
+	/*
+	 * Bump the reference count so that the accord is not freed.  We need
+	 * to drop the accord lock before we take our own p_lock.
+	 */
+	lx_ptrace_accord_hold(accord);
+	lx_ptrace_accord_exit(accord);
+
+	/*
+	 * We now lock _our_ process and determine if we can install our parent
+	 * as our tracer.
+	 */
+	mutex_enter(&p->p_lock);
+	if (lwpd->br_ptrace_tracer != NULL) {
+		/*
+		 * This LWP is already being traced.
+		 */
+		VERIFY(lwpd->br_ptrace_attach != LX_PTA_NONE);
+		error = EPERM;
+	} else {
+		/*
+		 * Bond ourselves to the accord.  We already bumped the accord
+		 * reference count.
+		 */
+		VERIFY(lwpd->br_ptrace_attach == LX_PTA_NONE);
+		lwpd->br_ptrace_attach = LX_PTA_TRACEME;
+		lwpd->br_ptrace_tracer = accord;
+		did_attach = B_TRUE;
+		error = 0;
+
+		/*
+		 * Speculatively bump l_ptrace now before dropping p_lock.
+		 * It will be reverted if the tracee attachment fails.
+		 */
+		ptolxproc(p)->l_ptrace++;
+	}
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * Lock the accord tracee list and add this LWP.  Once we are in the
+	 * tracee list, it is the responsibility of the tracer to detach us.
+	 */
+	if (error == 0) {
+		lx_ptrace_accord_enter(accord);
+		mutex_enter(&accord->lxpa_tracees_lock);
+
+		if (!(accord->lxpa_flags & LX_ACC_TOMBSTONE)) {
+			/*
+			 * Put ourselves in the tracee list for this accord.
+			 */
+			VERIFY(!list_link_active(&lwpd->br_ptrace_linkage));
+			list_insert_tail(&accord->lxpa_tracees, lwpd);
+			mutex_exit(&accord->lxpa_tracees_lock);
+			lx_ptrace_accord_exit(accord);
+
+			return (0);
+		}
+		mutex_exit(&accord->lxpa_tracees_lock);
+
+		/*
+		 * The accord has been marked for death.  We must
+		 * untrace ourselves.
+		 */
+		error = ESRCH;
+		lx_ptrace_accord_exit(accord);
+
+		/*
+		 * Undo speculative increment of ptracer count.
+		 */
+		mutex_enter(&p->p_lock);
+		ptolxproc(p)->l_ptrace--;
+		mutex_exit(&p->p_lock);
+	}
+
+	/*
+	 * Our optimism was unjustified: We were unable to attach.  We need to
+	 * lock the process containing this LWP again in order to remove the
+	 * tracer.
+	 */
+	VERIFY(error != 0);
+	mutex_enter(&p->p_lock);
+	if (did_attach) {
+		/*
+		 * Verify that things were as we left them:
+		 */
+		VERIFY(!list_link_active(&lwpd->br_ptrace_linkage));
+		VERIFY(lwpd->br_ptrace_tracer == accord);
+
+		lwpd->br_ptrace_attach = LX_PTA_NONE;
+		lwpd->br_ptrace_tracer = NULL;
+	}
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * Remove our speculative hold on the accord, possibly causing it to be
+	 * freed in the process.
+	 */
+	lx_ptrace_accord_enter(accord);
+	lx_ptrace_accord_rele(accord);
+	lx_ptrace_accord_exit(accord);
+
+	return (error);
+}
+
+static boolean_t
+lx_ptrace_stop_common(proc_t *p, lx_lwp_data_t *lwpd, ushort_t what)
+{
+	boolean_t reset_nostop = B_FALSE;
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+
+	/*
+	 * Mark this LWP as stopping and call stop() to enter "ptrace-stop".
+	 */
+	VERIFY0(lwpd->br_ptrace_flags & LX_PTF_STOPPING);
+	lwpd->br_ptrace_flags |= LX_PTF_STOPPING;
+
+	if (lwpd->br_lwp->lwp_nostop == 1 &&
+	    lwpd->br_ptrace_event == LX_PTRACE_EVENT_EXEC) {
+		/* We need to clear this to get the signal delivered. */
+		lwpd->br_lwp->lwp_nostop = 0;
+		reset_nostop = B_TRUE;
+	}
+
+	stop(PR_BRAND, what);
+
+	if (reset_nostop) {
+		VERIFY(lwpd->br_lwp->lwp_nostop == 0);
+		lwpd->br_lwp->lwp_nostop = 1;
+	}
+
+	/*
+	 * We are back from "ptrace-stop" with our process lock held.
+	 */
+	lwpd->br_ptrace_flags &= ~(LX_PTF_STOPPING | LX_PTF_STOPPED |
+	    LX_PTF_CLDPEND);
+	lwpd->br_ptrace_stopucp = NULL;
+	cv_broadcast(&lx_ptrace_busy_cv);
+	mutex_exit(&p->p_lock);
+
+	return (B_TRUE);
+}
+
+int
+lx_ptrace_stop_for_option(int option, boolean_t child, ulong_t msg,
+    uintptr_t ucp)
+{
+	kthread_t *t = curthread;
+	klwp_t *lwp = ttolwp(t);
+	proc_t *p = lwptoproc(lwp);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+
+	mutex_enter(&p->p_lock);
+	if (lwpd->br_ptrace_tracer == NULL) {
+		mutex_exit(&p->p_lock);
+		return (ESRCH);
+	}
+
+	if (!child) {
+		/*
+		 * Only the first event posted by a new process is to be held
+		 * until the matching parent event is dispatched, and only if
+		 * it is a "child" event.  This is not a child event, so we
+		 * clear the wait flag.
+		 */
+		lwpd->br_ptrace_flags &= ~LX_PTF_PARENT_WAIT;
+
+	} else if (option == LX_PTRACE_O_TRACEVFORK) {
+		/*
+		 * For a child, we have to handle vfork as a special case. In
+		 * lx_ptrace_inherit_tracer() we set LX_PTF_PARENT_WAIT to
+		 * force events to be delayed until the parent posts its event.
+		 * This flag is cleared in lx_waitid_helper() to enforce a
+		 * "happens after" relationship. However, this obviously cannot
+		 * work for the vfork case. Thus, we clear our flag now so that
+		 * we can deliver the signal in lx_stop_notify(), if necessary.
+		 */
+		lwpd->br_ptrace_flags &= ~LX_PTF_PARENT_WAIT;
+	}
+
+	if (!(lwpd->br_ptrace_options & option)) {
+		if (option == LX_PTRACE_O_TRACEEXEC) {
+			/*
+			 * Without PTRACE_O_TRACEEXEC, the Linux kernel will
+			 * send SIGTRAP to the process.
+			 */
+			sigtoproc(p, t, SIGTRAP);
+			mutex_exit(&p->p_lock);
+			return (0);
+		}
+
+		/*
+		 * The flag for this trace event is not enabled, so we will not
+		 * stop.
+		 */
+		mutex_exit(&p->p_lock);
+		return (ESRCH);
+	}
+
+	if (child) {
+		switch (option) {
+		case LX_PTRACE_O_TRACECLONE:
+		case LX_PTRACE_O_TRACEFORK:
+		case LX_PTRACE_O_TRACEVFORK:
+			/*
+			 * Send the child LWP a directed SIGSTOP.
+			 */
+			sigtoproc(p, t, SIGSTOP);
+			mutex_exit(&p->p_lock);
+			return (0);
+		default:
+			goto nostop;
+		}
+	}
+
+	lwpd->br_ptrace_eventmsg = msg;
+
+	switch (option) {
+	case LX_PTRACE_O_TRACECLONE:
+		lwpd->br_ptrace_event = LX_PTRACE_EVENT_CLONE;
+		break;
+	case LX_PTRACE_O_TRACEEXEC:
+		lwpd->br_ptrace_event = LX_PTRACE_EVENT_EXEC;
+		lwpd->br_ptrace_eventmsg = 0;
+		break;
+	case LX_PTRACE_O_TRACEEXIT:
+		lwpd->br_ptrace_event = LX_PTRACE_EVENT_EXIT;
+		break;
+	case LX_PTRACE_O_TRACEFORK:
+		lwpd->br_ptrace_event = LX_PTRACE_EVENT_FORK;
+		break;
+	case LX_PTRACE_O_TRACEVFORK:
+		lwpd->br_ptrace_event = LX_PTRACE_EVENT_VFORK;
+		break;
+	case LX_PTRACE_O_TRACEVFORKDONE:
+		lwpd->br_ptrace_event = LX_PTRACE_EVENT_VFORK_DONE;
+		lwpd->br_ptrace_eventmsg = 0;
+		break;
+	default:
+		goto nostop;
+	}
+
+	/*
+	 * Userland may have passed in a ucontext_t pointer for
+	 * PTRACE_GETREGS/PTRACE_SETREGS usage while stopped.
+	 */
+	lwpd->br_ptrace_stopucp = ucp;
+
+	/*
+	 * p_lock for the process containing the tracee will be dropped by
+	 * lx_ptrace_stop_common().
+	 */
+	return (lx_ptrace_stop_common(p, lwpd, LX_PR_EVENT) ? 0 : ESRCH);
+
+nostop:
+	lwpd->br_ptrace_event = 0;
+	lwpd->br_ptrace_eventmsg = 0;
+	mutex_exit(&p->p_lock);
+	return (ESRCH);
+}
+
+boolean_t
+lx_ptrace_stop(ushort_t what)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	proc_t *p = lwptoproc(lwp);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+
+	VERIFY(what == LX_PR_SYSENTRY || what == LX_PR_SYSEXIT ||
+	    what == LX_PR_SIGNALLED);
+
+	/*
+	 * If we do not have an accord, bail out early.
+	 */
+	if (lwpd->br_ptrace_tracer == NULL)
+		return (B_FALSE);
+
+	/*
+	 * Lock this process and re-check the condition.
+	 */
+	mutex_enter(&p->p_lock);
+
+	/*
+	 * The child after a fork/clone doesn't emit syscall-exit-stop event.
+	 */
+	if (what == LX_PR_SYSEXIT && (lwpd->br_ptrace_flags & LX_PTF_NOSTOP)) {
+		lwpd->br_ptrace_flags &= ~LX_PTF_NOSTOP;
+		mutex_exit(&p->p_lock);
+		return (B_FALSE);
+	}
+
+	if (lwpd->br_ptrace_tracer == NULL) {
+		VERIFY0(lwpd->br_ptrace_flags & LX_PTF_SYSCALL);
+		mutex_exit(&p->p_lock);
+		return (B_FALSE);
+	}
+
+	if (what == LX_PR_SYSENTRY || what == LX_PR_SYSEXIT) {
+		if (what == LX_PR_SYSENTRY) {
+			lwpd->br_ptrace_flags |= LX_PTF_INSYSCALL;
+		} else {
+			lwpd->br_ptrace_flags &= ~LX_PTF_INSYSCALL;
+		}
+
+		/*
+		 * This is a syscall-entry-stop or syscall-exit-stop point.
+		 */
+		if (!(lwpd->br_ptrace_flags & LX_PTF_SYSCALL)) {
+			/*
+			 * A system call stop has not been requested.
+			 */
+			mutex_exit(&p->p_lock);
+			return (B_FALSE);
+		}
+
+		/*
+		 * The PTRACE_SYSCALL restart command applies only to the next
+		 * system call entry or exit.  The tracer must restart us with
+		 * PTRACE_SYSCALL while we are in ptrace-stop for us to fire
+		 * again at the next system call boundary.
+		 */
+		lwpd->br_ptrace_flags &= ~LX_PTF_SYSCALL;
+	}
+
+	/*
+	 * p_lock for the process containing the tracee will be dropped by
+	 * lx_ptrace_stop_common().
+	 */
+	return (lx_ptrace_stop_common(p, lwpd, what));
+}
+
+/*
+ * In addition to performing the ptrace sig_stop handling, this function is
+ * also used to block signal from being delivered.
+ *
+ * Return 0 if issig_forreal() should continue on, -1 if issig_forreal should
+ * recheck after we've made changes, or 1 if issig_forreal should stop checking
+ * signals.
+ */
+int
+lx_ptrace_issig_stop(proc_t *p, klwp_t *lwp)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	int lx_sig;
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+
+	if (ptolxproc(p)->l_block_all_signals != 0)
+		return (1);
+
+	/*
+	 * In very rare circumstances, a process which is almost completely
+	 * through proc_exit() may incur issig checks in the current thread via
+	 * clean-up actions.  The process will still be branded, but the thread
+	 * will have already been stripped of any LX-specific data on its way
+	 * to the grave.  Bail early if the brand data is missing.
+	 */
+	if (lwpd == NULL) {
+		return (0);
+	}
+
+	/*
+	 * If we do not have an accord, bail out now.  Additionally, if there
+	 * is no valid signal then we have no reason to stop.
+	 */
+	if (lwpd->br_ptrace_tracer == NULL || lwp->lwp_cursig == SIGKILL ||
+	    (lwp->lwp_cursig == 0 || lwp->lwp_cursig > NSIG) ||
+	    (lx_sig = stol_signo[lwp->lwp_cursig]) < 1) {
+		if (lwp->lwp_cursig == 0) {
+			/*
+			 * If this lwp has no current signal, it means that any
+			 * signal ignorance enabled by br_ptrace_donesig has
+			 * already taken place (the signal was consumed).
+			 * By clearing donesig, we declare desire to ignore no
+			 * signals for accurate ptracing.
+			 */
+			lwpd->br_ptrace_donesig = 0;
+		}
+		return (0);
+	}
+
+	/*
+	 * We can't deliver the signal-delivery-stop condition while we're
+	 * between the syscall-enter-stop and syscall-exit-stop conditions.
+	 * We must first let the signal interrupt the in-progress syscall, let
+	 * it emit syscall-exit-stop with the interrupted result, then we'll
+	 * come back here to emit signal-delivery-stop.
+	 */
+	if (lwpd->br_ptrace_flags & LX_PTF_INSYSCALL) {
+		return (0);
+	}
+
+	/*
+	 * We stash the signal on the LWP where our waitid_helper will find it
+	 * and enter the ptrace "signal-delivery-stop" condition.
+	 */
+	lwpd->br_ptrace_stopsig = lx_sig;
+	lwpd->br_ptrace_donesig = 0;
+	(void) lx_ptrace_stop_common(p, lwpd, LX_PR_SIGNALLED);
+	mutex_enter(&p->p_lock);
+
+	/*
+	 * When we return, the signal may have been altered or suppressed.
+	 */
+	if (lwpd->br_ptrace_stopsig != lx_sig) {
+		int native_sig;
+		lx_sig = lwpd->br_ptrace_stopsig;
+
+		if (lx_sig >= LX_NSIG) {
+			lx_sig = 0;
+		}
+
+		/*
+		 * Translate signal from Linux signal number back to
+		 * an illumos native signal.
+		 */
+		if (lx_sig >= LX_NSIG || lx_sig < 0 || (native_sig =
+		    ltos_signo[lx_sig]) < 1) {
+			/*
+			 * The signal is not deliverable.
+			 */
+			lwp->lwp_cursig = 0;
+			lwp->lwp_extsig = 0;
+			if (lwp->lwp_curinfo) {
+				siginfofree(lwp->lwp_curinfo);
+				lwp->lwp_curinfo = NULL;
+			}
+		} else {
+			/*
+			 * Alter the currently dispatching signal.
+			 */
+			if (native_sig == SIGKILL) {
+				/*
+				 * We mark ourselves the victim and request
+				 * a restart of signal processing.
+				 */
+				p->p_flag |= SKILLED;
+				p->p_flag &= ~SEXTKILLED;
+				return (-1);
+			}
+			lwp->lwp_cursig = native_sig;
+			lwp->lwp_extsig = 0;
+			if (lwp->lwp_curinfo != NULL) {
+				lwp->lwp_curinfo->sq_info.si_signo = native_sig;
+			}
+		}
+	}
+
+	lwpd->br_ptrace_donesig = lwp->lwp_cursig;
+	lwpd->br_ptrace_stopsig = 0;
+	return (0);
+}
+
+boolean_t
+lx_ptrace_sig_ignorable(proc_t *p, klwp_t *lwp, int sig)
+{
+	lx_proc_data_t *lxpd = ptolxproc(p);
+
+	/*
+	 * Ignored signals and ptrace:
+	 *
+	 * When a process is being ptraced by another, special care is needed
+	 * while handling signals.  Since the tracer is interested in all
+	 * signals sent to the tracee, an effort must be made to initially
+	 * bypass signal ignorance logic.  This allows the signal to be placed
+	 * in the tracee's sigqueue to be inspected and potentially altered by
+	 * the tracer.
+	 *
+	 * A critical detail in this procedure is how a signal is handled after
+	 * tracer has completed processing for the event.  If the signal would
+	 * have been ignored, were it not for the initial ptrace override, then
+	 * lx_ptrace_sig_ignorable must report B_TRUE when the tracee is
+	 * restarted and resumes signal processing.  This is done by recording
+	 * the most recent tracee signal consumed by ptrace.
+	 */
+
+	if (lxpd->l_ptrace != 0 && lx_stol_signo(sig, 0) != 0) {
+		/*
+		 * This process is being ptraced.  Bypass signal ignorance for
+		 * anything that maps to a valid Linux signal...
+		 */
+		if (lwp != NULL && lwptolxlwp(lwp)->br_ptrace_donesig == sig) {
+			/*
+			 * ...Unless it is a signal which has already been
+			 * processed by the tracer.
+			 */
+			return (B_TRUE);
+		}
+		return (B_FALSE);
+	}
+	return (B_TRUE);
+}
+
+static void
+lx_ptrace_exit_tracer(proc_t *p, lx_lwp_data_t *lwpd,
+    lx_ptrace_accord_t *accord)
+{
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	lx_ptrace_accord_enter(accord);
+	/*
+	 * Mark this accord for death.  This means no new tracees can be
+	 * attached to this accord.
+	 */
+	VERIFY0(accord->lxpa_flags & LX_ACC_TOMBSTONE);
+	accord->lxpa_flags |= LX_ACC_TOMBSTONE;
+	lx_ptrace_accord_exit(accord);
+
+	/*
+	 * Walk the list of tracees, detaching them and setting them runnable
+	 * if they are stopped.
+	 */
+	for (;;) {
+		klwp_t *rlwp;
+		proc_t *rproc;
+		lx_lwp_data_t *remote;
+		kmutex_t *rmp;
+
+		mutex_enter(&accord->lxpa_tracees_lock);
+		if (list_is_empty(&accord->lxpa_tracees)) {
+			mutex_exit(&accord->lxpa_tracees_lock);
+			break;
+		}
+
+		/*
+		 * Fetch the first tracee LWP in the list and lock the process
+		 * which contains it.
+		 */
+		remote = list_head(&accord->lxpa_tracees);
+		rlwp = remote->br_lwp;
+		rproc = lwptoproc(rlwp);
+		/*
+		 * The p_lock mutex persists beyond the life of the process
+		 * itself.  We save the address, here, to prevent the need to
+		 * dereference the proc_t after awaking from sleep.
+		 */
+		rmp = &rproc->p_lock;
+		mutex_enter(rmp);
+
+		if (TRACEE_BUSY(remote)) {
+			/*
+			 * This LWP is currently detaching itself on exit, or
+			 * mid-way through stop().  We must wait for this
+			 * action to be completed.  While we wait on the CV, we
+			 * must drop the accord tracee list lock.
+			 */
+			mutex_exit(&accord->lxpa_tracees_lock);
+			cv_wait(&lx_ptrace_busy_cv, rmp);
+
+			/*
+			 * While we were waiting, some state may have changed.
+			 * Restart the walk to be sure we don't miss anything.
+			 */
+			mutex_exit(rmp);
+			continue;
+		}
+
+		/*
+		 * We now hold p_lock on the process.  Remove the tracee from
+		 * the list.
+		 */
+		VERIFY(list_link_active(&remote->br_ptrace_linkage));
+		list_remove(&accord->lxpa_tracees, remote);
+
+		/*
+		 * Unlink the accord and clear our trace flags.
+		 */
+		remote->br_ptrace_attach = LX_PTA_NONE;
+		remote->br_ptrace_tracer = NULL;
+		remote->br_ptrace_flags = 0;
+
+		/*
+		 * Let go of the list lock before we restart the LWP.  We must
+		 * not hold any locks other than the process p_lock when
+		 * we call lx_ptrace_restart_lwp() as it will thread_lock
+		 * the tracee.
+		 */
+		mutex_exit(&accord->lxpa_tracees_lock);
+
+		/*
+		 * Decrement traced-lwp count for the remote process.
+		 */
+		VERIFY(ptolxproc(rproc)->l_ptrace-- >= 1);
+
+		/*
+		 * Ensure that the LWP is not stopped on our account.
+		 */
+		lx_ptrace_restart_lwp(rlwp);
+
+		/*
+		 * Unlock the former tracee.
+		 */
+		mutex_exit(rmp);
+
+		/*
+		 * Drop the hold this tracee had on the accord.
+		 */
+		lx_ptrace_accord_enter(accord);
+		lx_ptrace_accord_rele(accord);
+		lx_ptrace_accord_exit(accord);
+	}
+
+	mutex_enter(&p->p_lock);
+	lwpd->br_ptrace_accord = NULL;
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * Clean up and release our hold on the accord If we completely
+	 * detached all tracee LWPs, this will free the accord.  Otherwise, it
+	 * will be freed when they complete their cleanup.
+	 *
+	 * We hold "pidlock" while clearing these members for easy exclusion of
+	 * waitid(), etc.
+	 */
+	mutex_enter(&pidlock);
+	lx_ptrace_accord_enter(accord);
+	accord->lxpa_cvp = NULL;
+	accord->lxpa_tracer = NULL;
+	mutex_exit(&pidlock);
+	lx_ptrace_accord_rele(accord);
+	lx_ptrace_accord_exit(accord);
+}
+
+static void
+lx_ptrace_exit_tracee(proc_t *p, lx_lwp_data_t *lwpd,
+    lx_ptrace_accord_t *accord)
+{
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	/*
+	 * We are the tracee LWP.  Lock the accord tracee list and then our
+	 * containing process.
+	 */
+	mutex_enter(&accord->lxpa_tracees_lock);
+	mutex_enter(&p->p_lock);
+
+	/*
+	 * Remove our reference to the accord.  We will release our hold
+	 * later.
+	 */
+	VERIFY(lwpd->br_ptrace_tracer == accord);
+	lwpd->br_ptrace_attach = LX_PTA_NONE;
+	lwpd->br_ptrace_tracer = NULL;
+
+	/*
+	 * Remove this LWP from the accord tracee list:
+	 */
+	VERIFY(list_link_active(&lwpd->br_ptrace_linkage));
+	list_remove(&accord->lxpa_tracees, lwpd);
+
+	/*
+	 * Wake up any tracers waiting for us to detach from the accord.
+	 */
+	cv_broadcast(&lx_ptrace_busy_cv);
+
+	/*
+	 * Decrement traced-lwp count for the process.
+	 */
+	VERIFY(ptolxproc(p)->l_ptrace-- >= 1);
+
+	mutex_exit(&p->p_lock);
+	mutex_exit(&accord->lxpa_tracees_lock);
+
+	/*
+	 * Grab "pidlock" and wake the tracer if it is blocked in waitid().
+	 */
+	mutex_enter(&pidlock);
+	if (accord->lxpa_cvp != NULL) {
+		cv_broadcast(accord->lxpa_cvp);
+	}
+	mutex_exit(&pidlock);
+
+	/*
+	 * Release our hold on the accord.
+	 */
+	lx_ptrace_accord_enter(accord);
+	lx_ptrace_accord_rele(accord);
+	lx_ptrace_accord_exit(accord);
+}
+
+/*
+ * This routine is called from lx_exitlwp() when an LWP is ready to exit.  If
+ * this LWP is being traced, it will be detached from the tracer's accord.  The
+ * routine will also detach any LWPs being traced by this LWP.
+ */
+void
+lx_ptrace_exit(proc_t *p, klwp_t *lwp)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	lx_ptrace_accord_t *accord;
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+
+	/*
+	 * Mark our LWP as exiting from a ptrace perspective.  This will
+	 * prevent a new accord from being allocated if one does not exist
+	 * already, and will make us invisible to PTRACE_ATTACH/PTRACE_TRACEME.
+	 */
+	VERIFY0(lwpd->br_ptrace_flags & LX_PTF_EXITING);
+	lwpd->br_ptrace_flags |= LX_PTF_EXITING;
+
+	if ((accord = lwpd->br_ptrace_tracer) != NULL) {
+		/*
+		 * We are traced by another LWP and must detach ourselves.
+		 */
+		mutex_exit(&p->p_lock);
+		lx_ptrace_exit_tracee(p, lwpd, accord);
+		mutex_enter(&p->p_lock);
+	}
+
+	if ((accord = lwpd->br_ptrace_accord) != NULL) {
+		/*
+		 * We have been tracing other LWPs, and must detach from
+		 * them and clean up our accord.
+		 */
+		mutex_exit(&p->p_lock);
+		lx_ptrace_exit_tracer(p, lwpd, accord);
+		mutex_enter(&p->p_lock);
+	}
+}
+
+/*
+ * Called when a SIGCLD signal is dispatched so that we may enqueue another.
+ * Return 0 if we enqueued a signal, or -1 if not.
+ */
+int
+lx_sigcld_repost(proc_t *pp, sigqueue_t *sqp)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	lx_ptrace_accord_t *accord;
+	lx_lwp_data_t *remote;
+	klwp_t *rlwp;
+	proc_t *rproc;
+	boolean_t found = B_FALSE;
+
+	VERIFY(MUTEX_HELD(&pidlock));
+	VERIFY(MUTEX_NOT_HELD(&pp->p_lock));
+	VERIFY(lwptoproc(lwp) == pp);
+
+	mutex_enter(&pp->p_lock);
+	if ((accord = lwpd->br_ptrace_accord) == NULL) {
+		/*
+		 * This LWP is not a tracer LWP, so there will be no
+		 * SIGCLD.
+		 */
+		mutex_exit(&pp->p_lock);
+		return (-1);
+	}
+	mutex_exit(&pp->p_lock);
+
+	mutex_enter(&accord->lxpa_tracees_lock);
+	for (remote = list_head(&accord->lxpa_tracees); remote != NULL;
+	    remote = list_next(&accord->lxpa_tracees, remote)) {
+		rlwp = remote->br_lwp;
+		rproc = lwptoproc(rlwp);
+
+		/*
+		 * Check if this LWP is in "ptrace-stop".  If in the correct
+		 * stop condition, lock the process containing the tracee LWP.
+		 */
+		if (lx_ptrace_lock_if_stopped(accord, remote, B_FALSE) != 0) {
+			continue;
+		}
+
+		if (remote->br_ptrace_flags & LX_PTF_PARENT_WAIT) {
+			/*
+			 * This event depends on waitid() clearing out the
+			 * event of another LWP.  Skip it for now.
+			 */
+			mutex_exit(&rproc->p_lock);
+			continue;
+		}
+
+		if (!(remote->br_ptrace_flags & LX_PTF_CLDPEND)) {
+			/*
+			 * No SIGCLD is required for this LWP.
+			 */
+			mutex_exit(&rproc->p_lock);
+			continue;
+		}
+
+		if (!(remote->br_ptrace_flags & LX_PTF_WAITPEND) ||
+		    remote->br_ptrace_whystop == 0 ||
+		    remote->br_ptrace_whatstop == 0) {
+			/*
+			 * No (new) stop reason to post for this LWP.
+			 */
+			mutex_exit(&rproc->p_lock);
+			continue;
+		}
+
+		/*
+		 * We found a process of interest.  Leave the process
+		 * containing the tracee LWP locked and break out of the loop.
+		 */
+		found = B_TRUE;
+		break;
+	}
+	mutex_exit(&accord->lxpa_tracees_lock);
+
+	if (!found) {
+		return (-1);
+	}
+
+	/*
+	 * Generate siginfo for this tracee LWP.
+	 */
+	lx_ptrace_winfo(remote, &sqp->sq_info, B_FALSE, NULL, NULL);
+	remote->br_ptrace_flags &= ~LX_PTF_CLDPEND;
+	mutex_exit(&rproc->p_lock);
+
+	mutex_enter(&pp->p_lock);
+	if (sigismember(&pp->p_sig, SIGCLD)) {
+		mutex_exit(&pp->p_lock);
+
+		mutex_enter(&rproc->p_lock);
+		remote->br_ptrace_flags |= LX_PTF_CLDPEND;
+		mutex_exit(&rproc->p_lock);
+
+		return (-1);
+	}
+	sigaddqa(pp, curthread, sqp);
+	mutex_exit(&pp->p_lock);
+
+	return (0);
+}
+
+/*
+ * Consume the next available ptrace(2) event queued against the accord for
+ * this LWP.  The event will be emitted as if through waitid(), and converted
+ * by lx_waitpid() and friends before the return to usermode.
+ */
+int
+lx_waitid_helper(idtype_t idtype, id_t id, k_siginfo_t *ip, int options,
+    boolean_t *brand_wants_wait, int *rval)
+{
+	lx_ptrace_accord_t *accord;
+	klwp_t *lwp = ttolwp(curthread);
+	proc_t *p = lwptoproc(lwp);
+	lx_lwp_data_t *local = lwptolxlwp(lwp);
+	lx_lwp_data_t *remote;
+	boolean_t found = B_FALSE;
+	klwp_t *rlwp = NULL;
+	proc_t *rproc = NULL;
+	pid_t event_pid = 0, event_ppid = 0;
+	boolean_t waitflag = !(options & WNOWAIT);
+	boolean_t target_found = B_FALSE;
+
+	VERIFY(MUTEX_HELD(&pidlock));
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+
+	/*
+	 * By default, we do not expect waitid() to block on our account.
+	 */
+	*brand_wants_wait = B_FALSE;
+
+	if (!local->br_waitid_emulate) {
+		/*
+		 * This waitid() call is not expecting emulated results.
+		 */
+		return (-1);
+	}
+
+	switch (idtype) {
+	case P_ALL:
+	case P_PID:
+	case P_PGID:
+		break;
+	default:
+		/*
+		 * This idtype has no power here.
+		 */
+		return (-1);
+	}
+
+	if (lx_ptrace_accord_get(&accord, B_FALSE) != 0) {
+		/*
+		 * This LWP does not have an accord; it cannot be tracing.
+		 */
+		return (-1);
+	}
+
+	/*
+	 * We do not need an additional hold on the accord as it belongs to
+	 * the running, tracer, LWP.
+	 */
+	lx_ptrace_accord_exit(accord);
+
+	mutex_enter(&accord->lxpa_tracees_lock);
+	if (list_is_empty(&accord->lxpa_tracees)) {
+		/*
+		 * Though it has an accord, there are currently no tracees in
+		 * the list for this LWP.
+		 */
+		mutex_exit(&accord->lxpa_tracees_lock);
+		return (-1);
+	}
+
+	/*
+	 * Walk the list of tracees and determine if any of them have events to
+	 * report.
+	 */
+	for (remote = list_head(&accord->lxpa_tracees); remote != NULL;
+	    remote = list_next(&accord->lxpa_tracees, remote)) {
+		rlwp = remote->br_lwp;
+		rproc = lwptoproc(rlwp);
+
+		/*
+		 * We check to see if this LWP matches an id we are waiting for.
+		 */
+		switch (idtype) {
+		case P_ALL:
+			break;
+		case P_PID:
+			if (remote->br_pid != id)
+				continue;
+			break;
+		case P_PGID:
+			if (rproc->p_pgrp != id)
+				continue;
+			break;
+		default:
+			cmn_err(CE_PANIC, "unexpected idtype: %d", idtype);
+		}
+
+		/* This tracee matches provided idtype and id */
+		target_found = B_TRUE;
+
+		/*
+		 * Check if this LWP is in "ptrace-stop".  If in the correct
+		 * stop condition, lock the process containing the tracee LWP.
+		 */
+		if (lx_ptrace_lock_if_stopped(accord, remote, B_FALSE) != 0) {
+			continue;
+		}
+
+		if (remote->br_ptrace_flags & LX_PTF_PARENT_WAIT) {
+			/*
+			 * This event depends on waitid() clearing out the
+			 * event of another LWP.  Skip it for now.
+			 */
+			mutex_exit(&rproc->p_lock);
+			continue;
+		}
+
+		if (!(remote->br_ptrace_flags & LX_PTF_WAITPEND) ||
+		    remote->br_ptrace_whystop == 0 ||
+		    remote->br_ptrace_whatstop == 0) {
+			/*
+			 * No (new) stop reason to post for this LWP.
+			 */
+			mutex_exit(&rproc->p_lock);
+			continue;
+		}
+
+		/*
+		 * We found a process of interest.  Leave the process
+		 * containing the tracee LWP locked and break out of the loop.
+		 */
+		found = B_TRUE;
+		break;
+	}
+	mutex_exit(&accord->lxpa_tracees_lock);
+
+	if (!found) {
+		/*
+		 * There were no events of interest, but we have tracees.
+		 * If any of the tracees matched the spcified criteria, signal
+		 * to waitid() that it should block if the provided flags allow
+		 * for it.
+		 */
+		if (target_found) {
+			*brand_wants_wait = B_TRUE;
+		}
+
+		return (-1);
+	}
+
+	/*
+	 * Populate the signal information.
+	 */
+	lx_ptrace_winfo(remote, ip, waitflag, &event_ppid, &event_pid);
+
+	/*
+	 * Unlock the tracee.
+	 */
+	mutex_exit(&rproc->p_lock);
+
+	if (event_pid != 0 && event_ppid != 0) {
+		/*
+		 * We need to do another pass around the tracee list and
+		 * unblock any events that have a "happens after" relationship
+		 * with this event.
+		 */
+		mutex_enter(&accord->lxpa_tracees_lock);
+		for (remote = list_head(&accord->lxpa_tracees); remote != NULL;
+		    remote = list_next(&accord->lxpa_tracees, remote)) {
+			rlwp = remote->br_lwp;
+			rproc = lwptoproc(rlwp);
+
+			mutex_enter(&rproc->p_lock);
+
+			if (remote->br_pid != event_pid ||
+			    remote->br_ppid != event_ppid) {
+				mutex_exit(&rproc->p_lock);
+				continue;
+			}
+
+			remote->br_ptrace_flags &= ~LX_PTF_PARENT_WAIT;
+
+			mutex_exit(&rproc->p_lock);
+		}
+		mutex_exit(&accord->lxpa_tracees_lock);
+	}
+
+	/*
+	 * If we are consuming this wait state, we remove the SIGCLD from
+	 * the queue and post another.
+	 */
+	if (waitflag) {
+		mutex_exit(&pidlock);
+		sigcld_delete(ip);
+		sigcld_repost();
+		mutex_enter(&pidlock);
+	}
+
+	*rval = 0;
+	return (0);
+}
+
+static int
+lx_ptrace_peek(lx_lwp_data_t *lwpd, uintptr_t addr, void *data)
+{
+	proc_t *p = lwptoproc(lwpd->br_lwp);
+	long buf;
+	int error = 0, size = sizeof (buf);
+
+#if defined(_LP64)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		size = sizeof (uint32_t);
+	}
+#endif
+	if ((addr & (size - 1)) != 0) {
+		/* unaligned access */
+		return (EINVAL);
+	}
+
+	mutex_exit(&p->p_lock);
+	error = uread(p, &buf, size, addr);
+	mutex_enter(&p->p_lock);
+
+	if (error != 0) {
+		return (EIO);
+	}
+	if (copyout(&buf, data, size) != 0) {
+		return (EFAULT);
+	}
+
+	return (0);
+}
+
+static int
+lx_ptrace_poke(lx_lwp_data_t *lwpd, uintptr_t addr, uintptr_t data)
+{
+	proc_t *p = lwptoproc(lwpd->br_lwp);
+	int error = 0, size = sizeof (data);
+
+#if defined(_LP64)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		size = sizeof (uint32_t);
+	}
+#endif
+	if ((addr & (size - 1)) != 0) {
+		/* unaligned access */
+		return (EINVAL);
+	}
+
+	mutex_exit(&p->p_lock);
+	error = uwrite(p, &data, size, addr);
+	mutex_enter(&p->p_lock);
+
+	if (error != 0) {
+		return (EIO);
+	}
+	return (0);
+}
+
+static int
+lx_ptrace_kill(lx_lwp_data_t *lwpd)
+{
+	sigtoproc(lwptoproc(lwpd->br_lwp), NULL, SIGKILL);
+
+	return (0);
+}
+
+static int
+lx_ptrace_kernel(int ptrace_op, pid_t lxpid, uintptr_t addr, uintptr_t data)
+{
+	lx_lwp_data_t *local = ttolxlwp(curthread);
+	lx_ptrace_accord_t *accord;
+	lx_lwp_data_t *remote;
+	klwp_t *rlwp;
+	proc_t *rproc;
+	int error;
+	boolean_t found = B_FALSE, restart = B_TRUE;
+
+	/*
+	 * PTRACE_TRACEME and PTRACE_ATTACH operations induce the tracing of
+	 * one LWP by another.  The target LWP must not be traced already.
+	 */
+	switch (ptrace_op) {
+	case LX_PTRACE_TRACEME:
+		return (lx_ptrace_traceme());
+
+	case LX_PTRACE_ATTACH:
+		return (lx_ptrace_attach(lxpid));
+	}
+
+	/*
+	 * Ensure that we have an accord and obtain a lock on it.  This routine
+	 * should not fail because the LWP cannot make ptrace(2) system calls
+	 * after it has begun exiting.
+	 */
+	VERIFY0(local->br_ptrace_flags & LX_PTF_EXITING);
+	VERIFY(lx_ptrace_accord_get(&accord, B_TRUE) == 0);
+
+	/*
+	 * The accord belongs to this (the tracer) LWP, and we have a hold on
+	 * it.  We drop the lock so that we can take other locks.
+	 */
+	lx_ptrace_accord_exit(accord);
+
+	/*
+	 * Does the tracee list contain the pid in question?
+	 */
+retry:
+	mutex_enter(&accord->lxpa_tracees_lock);
+	for (remote = list_head(&accord->lxpa_tracees); remote != NULL;
+	    remote = list_next(&accord->lxpa_tracees, remote)) {
+		if (remote->br_pid == lxpid) {
+			found = B_TRUE;
+			break;
+		}
+	}
+	if (!found) {
+		/*
+		 * The requested pid does not appear in the tracee list.
+		 */
+		mutex_exit(&accord->lxpa_tracees_lock);
+		return (ESRCH);
+	}
+
+	if (ptrace_op == LX_PTRACE_DETACH) {
+		/*
+		 * We're detaching, make sure in-syscall flag is off so that
+		 * signal will stop the process directly.
+		 */
+		remote->br_ptrace_flags &= ~LX_PTF_INSYSCALL;
+	}
+
+	/*
+	 * Attempt to lock the target LWP.
+	 */
+	if ((error = lx_ptrace_lock_if_stopped(accord, remote,
+	    (ptrace_op == LX_PTRACE_DETACH))) != 0) {
+		/*
+		 * The LWP was not in "ptrace-stop". For detach, ENOENT
+		 * indicates that the LWP was not in "ptrace-stop", but is
+		 * still locked.
+		 */
+		if (ptrace_op == LX_PTRACE_DETACH && error == ENOENT) {
+			/*
+			 * We're detaching, but the process was not in
+			 * ptrace_stop, so we don't want to try to restart it.
+			 */
+			restart = B_FALSE;
+		} else {
+			mutex_exit(&accord->lxpa_tracees_lock);
+			return (error);
+		}
+	}
+
+	/*
+	 * The target LWP is in "ptrace-stop".  We have the containing process
+	 * locked.
+	 */
+	rlwp = remote->br_lwp;
+	rproc = lwptoproc(rlwp);
+
+	if (ptrace_op == LX_PTRACE_DETACH) {
+		if (TRACEE_BUSY(remote)) {
+			kmutex_t *rmp;
+
+			/*
+			 * There is a tricky race condition we have to watch
+			 * out for here (for example, if a tracee is in the
+			 * kernel in the middle of a syscall). When the tracee
+			 * is leaving the kernel, it will set LX_PTF_STOPPING.
+			 * In lx_stop_notify() the tracee has to drop its
+			 * p_lock, take pidlock, then reacquire p_lock, before
+			 * it will clear LX_PTF_STOPPING and set LX_PTF_STOPPED.
+			 * During that window, if this tracer is trying to
+			 * detach, we have to make sure the tracee is restarted.
+			 * We handle this case in the same way we handle
+			 * the tracer exiting in lx_ptrace_exit_tracer().
+			 */
+			rmp = &rproc->p_lock;
+			mutex_exit(&accord->lxpa_tracees_lock);
+			(void) cv_wait_sig(&lx_ptrace_busy_cv, rmp);
+
+			/*
+			 * While we were waiting, state will have changed, so
+			 * retry.
+			 */
+			mutex_exit(rmp);
+			goto retry;
+		}
+
+		lx_ptrace_detach(accord, remote, (int)data, restart);
+		/*
+		 * Drop the lock on both the tracee process and the tracee list.
+		 */
+		mutex_exit(&rproc->p_lock);
+		mutex_exit(&accord->lxpa_tracees_lock);
+
+		/*
+		 * Release a hold from the accord.
+		 */
+		lx_ptrace_accord_enter(accord);
+		lx_ptrace_accord_rele(accord);
+		lx_ptrace_accord_exit(accord);
+
+		return (0);
+	}
+
+	/*
+	 * The tracees lock is not needed for any of the other operations.
+	 * Drop it so further actions can avoid deadlock.
+	 */
+	mutex_exit(&accord->lxpa_tracees_lock);
+
+	/*
+	 * Process the ptrace(2) request:
+	 */
+	switch (ptrace_op) {
+	case LX_PTRACE_CONT:
+		error = lx_ptrace_cont(remote, LX_PTC_NONE, (int)data);
+		break;
+
+	case LX_PTRACE_SYSCALL:
+		error = lx_ptrace_cont(remote, LX_PTC_SYSCALL, (int)data);
+		break;
+
+	case LX_PTRACE_SINGLESTEP:
+		error = lx_ptrace_cont(remote, LX_PTC_SINGLESTEP, (int)data);
+		break;
+
+	case LX_PTRACE_SETOPTIONS:
+		error = lx_ptrace_setoptions(remote, data);
+		break;
+
+	case LX_PTRACE_GETEVENTMSG:
+		error = lx_ptrace_geteventmsg(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_GETREGS:
+		error = lx_user_regs_copyout(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_SETREGS:
+		error = lx_user_regs_copyin(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_GETSIGINFO:
+		error = lx_ptrace_getsiginfo(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_PEEKTEXT:
+	case LX_PTRACE_PEEKDATA:
+		error = lx_ptrace_peek(remote, addr, (void *)data);
+		break;
+
+	case LX_PTRACE_POKETEXT:
+	case LX_PTRACE_POKEDATA:
+		error = lx_ptrace_poke(remote, addr, data);
+		break;
+
+	case LX_PTRACE_PEEKUSER:
+		error = lx_ptrace_peekuser(remote, addr, (void *)data);
+		break;
+
+	case LX_PTRACE_POKEUSER:
+		error = lx_ptrace_pokeuser(remote, addr, (void *)data);
+		break;
+
+	case LX_PTRACE_GETFPREGS:
+		error = lx_user_fpregs_copyout(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_SETFPREGS:
+		error = lx_user_fpregs_copyin(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_GETFPXREGS:
+		error = lx_user_fpxregs_copyout(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_SETFPXREGS:
+		error = lx_user_fpxregs_copyin(remote, (void *)data);
+		break;
+
+	case LX_PTRACE_KILL:
+		error = lx_ptrace_kill(remote);
+		break;
+
+	default:
+		error = EINVAL;
+	}
+
+	/*
+	 * Drop the lock on both the tracee process and the tracee list.
+	 */
+	mutex_exit(&rproc->p_lock);
+
+	return (error);
+}
+
+int
+lx_ptrace(int ptrace_op, pid_t lxpid, uintptr_t addr, uintptr_t data)
+{
+	int error;
+
+	error = lx_ptrace_kernel(ptrace_op, LX_INIT_TO_PID(lxpid), addr, data);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+void
+lx_ptrace_init(void)
+{
+	cv_init(&lx_ptrace_busy_cv, NULL, CV_DEFAULT, NULL);
+
+	lx_ptrace_accord_cache = kmem_cache_create("lx_ptrace_accord",
+	    sizeof (lx_ptrace_accord_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
+}
+
+void
+lx_ptrace_fini(void)
+{
+	cv_destroy(&lx_ptrace_busy_cv);
+
+	kmem_cache_destroy(lx_ptrace_accord_cache);
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_signal.c b/usr/src/uts/common/brand/lx/os/lx_signal.c
new file mode 100644
index 0000000000..53e0cecc14
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_signal.c
@@ -0,0 +1,50 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/signal.h>
+#include <sys/sunddi.h>
+#include <lx_signum.h>
+
+void
+lx_ltos_sigset(lx_sigset_t *lsigp, k_sigset_t *ssigp)
+{
+	int lx_sig, sig;
+
+	sigemptyset(ssigp);
+	for (lx_sig = 1; lx_sig <= LX_NSIG; lx_sig++) {
+		if (lx_sigismember(lsigp, lx_sig) &&
+		    ((sig = ltos_signo[lx_sig]) > 0))
+			sigaddset(ssigp, sig);
+	}
+
+	/* Emulate sigutok() restrictions */
+	ssigp->__sigbits[0] &= (FILLSET0 & ~CANTMASK0);
+	ssigp->__sigbits[1] &= (FILLSET1 & ~CANTMASK1);
+	ssigp->__sigbits[2] &= (FILLSET2 & ~CANTMASK2);
+}
+
+void
+lx_stol_sigset(k_sigset_t *ssigp, lx_sigset_t *lsigp)
+{
+	int sig, lx_sig;
+
+	bzero(lsigp, sizeof (lx_sigset_t));
+	for (sig = 1; sig < NSIG; sig++) {
+		if (sigismember(ssigp, sig) &&
+		    ((lx_sig = stol_signo[sig]) > 0))
+			lx_sigaddset(lsigp, lx_sig);
+	}
+}
diff --git a/usr/src/uts/common/brand/lx/os/lx_syscall.c b/usr/src/uts/common/brand/lx/os/lx_syscall.c
new file mode 100644
index 0000000000..ed0ccc4cb7
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/os/lx_syscall.c
@@ -0,0 +1,1228 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/kmem.h>
+#include <sys/errno.h>
+#include <sys/thread.h>
+#include <sys/systm.h>
+#include <sys/syscall.h>
+#include <sys/proc.h>
+#include <sys/modctl.h>
+#include <sys/cmn_err.h>
+#include <sys/model.h>
+#include <sys/privregs.h>
+#include <sys/brand.h>
+#include <sys/machbrand.h>
+#include <sys/sdt.h>
+#include <sys/lx_syscalls.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_misc.h>
+#include <lx_errno.h>
+
+
+/*
+ * Flags for sysent entries:
+ */
+#define	LX_SYS_NOSYS_REASON	0x07
+#define	LX_SYS_EBPARG6		0x08
+
+/*
+ * Flags that denote the specific reason we do not have a particular system
+ * call.  These reasons are only valid if the function is NULL.
+ */
+#define	NOSYS_USERMODE		0
+#define	NOSYS_NULL		1
+#define	NOSYS_NONE		2
+#define	NOSYS_NO_EQUIV		3
+#define	NOSYS_KERNEL		4
+#define	NOSYS_UNDOC		5
+#define	NOSYS_OBSOLETE		6
+#define	NOSYS_MAX		NOSYS_OBSOLETE
+
+#if NOSYS_MAX > LX_SYS_NOSYS_REASON
+#error NOSYS reason codes must fit in LX_SYS_NOSYS_REASON
+#endif
+
+/*
+ * Strings describing the reason we do not emulate a particular system call
+ * in the kernel.
+ */
+static char *nosys_reasons[] = {
+	NULL, /* NOSYS_USERMODE means this call is emulated in usermode */
+	"Not done yet",
+	"No such Linux system call",
+	"No equivalent illumos functionality",
+	"Reads/modifies Linux kernel state",
+	"Undocumented and/or rarely used system call",
+	"Unsupported, obsolete system call"
+};
+
+
+#if defined(_LP64)
+/*
+ * System call handler table and entry count for Linux x86_64 (amd64):
+ */
+lx_sysent_t lx_sysent64[LX_NSYSCALLS + 1];
+int lx_nsysent64;
+#endif
+/*
+ * System call handler table and entry count for Linux x86 (i386):
+ */
+lx_sysent_t lx_sysent32[LX_NSYSCALLS + 1];
+int lx_nsysent32;
+
+#if defined(_LP64)
+struct lx_vsyscall
+{
+	uintptr_t lv_addr;
+	uintptr_t lv_scnum;
+} lx_vsyscalls[] = {
+	{ LX_VSYS_gettimeofday, LX_SYS_gettimeofday },
+	{ LX_VSYS_time, LX_SYS_time },
+	{ LX_VSYS_getcpu, LX_SYS_getcpu },
+	{ NULL, NULL }
+};
+#endif
+
+#if defined(__amd64)
+static int
+lx_emulate_args(klwp_t *lwp, const lx_sysent_t *s, uintptr_t *args)
+{
+	struct regs *rp = lwptoregs(lwp);
+
+	if (get_udatamodel() == DATAMODEL_NATIVE) {
+		/*
+		 * Note: Syscall argument passing is different from function
+		 * call argument passing on amd64.  For function calls, the
+		 * fourth arg is passed via %rcx, but for system calls the 4th
+		 * arg is passed via %r10.  This is because in amd64, the
+		 * syscall instruction puts the lower 32 bits of %rflags in
+		 * %r11 and puts the %rip value to %rcx.
+		 *
+		 * Appendix A of the amd64 ABI (Linux conventions) states that
+		 * syscalls are limited to 6 args and no arg is passed on the
+		 * stack.
+		 */
+		args[0] = rp->r_rdi;
+		args[1] = rp->r_rsi;
+		args[2] = rp->r_rdx;
+		args[3] = rp->r_r10;
+		args[4] = rp->r_r8;
+		args[5] = rp->r_r9;
+	} else {
+		/*
+		 * If the system call takes 6 args, then libc has stashed them
+		 * in memory at the address contained in %ebx. Except for some
+		 * syscalls which store the 6th argument in %ebp.
+		 */
+		if (s->sy_narg == 6 && !(s->sy_flags & LX_SYS_EBPARG6)) {
+			uint32_t args32[6];
+
+			if (copyin((void *)rp->r_rbx, &args32,
+			    sizeof (args32)) != 0) {
+				/*
+				 * Clear the argument vector so that the
+				 * trace probe does not expose kernel
+				 * memory.
+				 */
+				bzero(args, 6 * sizeof (uintptr_t));
+				return (set_errno(EFAULT));
+			}
+
+			args[0] = args32[0];
+			args[1] = args32[1];
+			args[2] = args32[2];
+			args[3] = args32[3];
+			args[4] = args32[4];
+			args[5] = args32[5];
+		} else {
+			args[0] = rp->r_rbx;
+			args[1] = rp->r_rcx;
+			args[2] = rp->r_rdx;
+			args[3] = rp->r_rsi;
+			args[4] = rp->r_rdi;
+			args[5] = rp->r_rbp;
+		}
+	}
+
+	return (0);
+}
+
+#else	/* !__amd64 */
+
+static int
+lx_emulate_args(klwp_t *lwp, const lx_sysent_t *s, uintptr_t *args)
+{
+	struct regs *rp = lwptoregs(lwp);
+
+	/*
+	 * If the system call takes 6 args, then libc has stashed them
+	 * in memory at the address contained in %ebx. Except for some
+	 * syscalls which store the 6th argument in %ebp.
+	 */
+	if (s->sy_narg == 6 && !(s->sy_flags & LX_SYS_EBPARG6)) {
+		if (copyin((void *)rp->r_ebx, args, 6 * sizeof (uintptr_t)) !=
+		    0) {
+			/*
+			 * Clear the argument vector so that the trace probe
+			 * does not expose kernel memory.
+			 */
+			bzero(args, 6 * sizeof (uintptr_t));
+			return (set_errno(EFAULT));
+		}
+	} else {
+		args[0] = rp->r_ebx;
+		args[1] = rp->r_ecx;
+		args[2] = rp->r_edx;
+		args[3] = rp->r_esi;
+		args[4] = rp->r_edi;
+		args[5] = rp->r_ebp;
+	}
+
+	return (0);
+}
+#endif
+
+void
+lx_syscall_return(klwp_t *lwp, int syscall_num, long ret)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	struct regs *rp = lwptoregs(lwp);
+	int error = lwp->lwp_errno;
+
+	if (error != EINTR) {
+		/*
+		 * If this system call was not interrupted, clear the system
+		 * call restart flag before lx_setcontext() can pass it to
+		 * usermode.
+		 */
+		lwpd->br_syscall_restart = B_FALSE;
+	}
+
+	if (error != 0) {
+		/*
+		 * Convert from illumos to Linux errno:
+		 */
+		ret = -lx_errno(error, EINVAL);
+	}
+
+	/*
+	 * 32-bit Linux system calls return via %eax; 64-bit calls return via
+	 * %rax.
+	 */
+	rp->r_r0 = ret;
+
+	/*
+	 * Hold for the ptrace(2) "syscall-exit-stop" condition if required by
+	 * PTRACE_SYSCALL.  Note that the register state may be modified by
+	 * tracer.
+	 */
+	(void) lx_ptrace_stop(LX_PR_SYSEXIT);
+
+	/*
+	 * Emit audit record, if necessary.
+	 */
+	lx_audit_syscall_exit(syscall_num, ret);
+
+	/*
+	 * Fire the DTrace "lx-syscall:::return" probe:
+	 */
+	lx_trace_sysreturn(syscall_num, ret);
+
+	/*
+	 * Clear errno for next time.  We do not clear "br_syscall_restart" or
+	 * "br_syscall_num" as they are potentially used by "lx_savecontext()"
+	 * in the signal delivery path.
+	 */
+	lwp->lwp_errno = 0;
+
+	lx_check_strict_failure(lwpd);
+
+	/*
+	 * We want complete control of the registers on return from this
+	 * emulated Linux system call:
+	 */
+	lwp->lwp_eosys = JUSTRETURN;
+}
+
+static void
+lx_syscall_unsup_msg(lx_sysent_t *s, int syscall_num, int unsup_reason)
+{
+	char buf[100];
+
+	if (s == NULL) {
+		(void) snprintf(buf, sizeof (buf), "NOSYS (%d): out of bounds",
+		    syscall_num);
+	} else {
+		VERIFY(unsup_reason < (sizeof (nosys_reasons) /
+		    sizeof (*nosys_reasons)));
+
+		if (s->sy_name == NULL) {
+			(void) snprintf(buf, sizeof (buf), "NOSYS (%d): %s",
+			    syscall_num, nosys_reasons[unsup_reason]);
+		} else {
+			(void) snprintf(buf, sizeof (buf), "NOSYS (%s): %s",
+			    s->sy_name, nosys_reasons[unsup_reason]);
+		}
+	}
+
+	lx_unsupported(buf);
+}
+
+/*
+ * This function is used to override the processing of arguments and
+ * invocation of a handler for emulated system calls, installed on each
+ * branded LWP as "lwp_brand_syscall".  If this system call should use the
+ * native path, we return 1.  If we handled this system call (and have made
+ * arrangements with respect to post-return usermode register state) we
+ * return 0.
+ */
+int
+lx_syscall_enter(void)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	struct regs *rp = lwptoregs(lwp);
+	int syscall_num;
+	int error;
+	long ret = 0;
+	lx_sysent_t *s;
+	uintptr_t args[6];
+	unsigned int unsup_reason;
+
+	/*
+	 * If we got here, we should have an LWP-specific brand data
+	 * structure.
+	 */
+	VERIFY(lwpd != NULL);
+
+	if (lwpd->br_stack_mode != LX_STACK_MODE_BRAND) {
+		/*
+		 * The lwp is not in in BRAND execution mode, so we return
+		 * to the regular native system call path.
+		 */
+		DTRACE_PROBE(brand__lx__syscall__hook__skip);
+		return (1);
+	}
+
+	/*
+	 * Clear the restartable system call flag.  This flag will be set
+	 * on in the system call handler if the call is a candidate for
+	 * a restart.  It will be saved by lx_setcontext() in the event
+	 * that we take a signal, and used in the signal handling path
+	 * to restart the system call iff SA_RESTART was set for this
+	 * signal.  Save the system call number so that we can store it
+	 * in the saved context if required.
+	 */
+	lwpd->br_syscall_restart = B_FALSE;
+	lwpd->br_syscall_num = (int)rp->r_r0;
+
+	/*
+	 * Hold for the ptrace(2) "syscall-entry-stop" condition if traced by
+	 * PTRACE_SYSCALL.  The system call number and arguments may be
+	 * modified by the tracer.
+	 */
+	(void) lx_ptrace_stop(LX_PR_SYSENTRY);
+
+	/*
+	 * Check that the system call number is within the bounds we expect.
+	 */
+	syscall_num = lwpd->br_syscall_num;
+	if (syscall_num < 0 || syscall_num > LX_MAX_SYSCALL(lwp)) {
+		lx_syscall_unsup_msg(NULL, syscall_num, 0);
+
+		(void) set_errno(ENOTSUP);
+		lx_syscall_return(lwp, syscall_num, -1);
+		return (0);
+	}
+
+#if defined(_LP64)
+	if (lwp_getdatamodel(lwp) == DATAMODEL_NATIVE) {
+		s = &lx_sysent64[syscall_num];
+	} else
+#endif
+	{
+		s = &lx_sysent32[syscall_num];
+	}
+
+	/*
+	 * Process the arguments for this system call and fire the DTrace
+	 * "lx-syscall:::entry" probe:
+	 */
+	error = lx_emulate_args(lwp, s, args);
+	lx_trace_sysenter(syscall_num, args);
+	lwpd->br_syscall_args[0] = args[0];
+	lwpd->br_syscall_args[1] = args[1];
+	lwpd->br_syscall_args[2] = args[2];
+	lwpd->br_syscall_args[3] = args[3];
+	if (error != 0) {
+		/*
+		 * Could not read and process the arguments.  Return the error
+		 * to the process.
+		 */
+		(void) set_errno(error);
+		lx_syscall_return(lwp, syscall_num, -1);
+		return (0);
+	}
+
+	if (s->sy_callc != NULL) {
+		/*
+		 * Call the in-kernel handler for this Linux system call:
+		 */
+		lwpd->br_eosys = NORMALRETURN;
+		ret = s->sy_callc(args[0], args[1], args[2], args[3], args[4],
+		    args[5]);
+		if (lwpd->br_eosys == NORMALRETURN) {
+			lx_syscall_return(lwp, syscall_num, ret);
+		}
+		return (0);
+	}
+
+	/*
+	 * There is no in-kernel handler.
+	 */
+	switch (unsup_reason = (s->sy_flags & LX_SYS_NOSYS_REASON)) {
+	case NOSYS_USERMODE:
+		/*
+		 * Pass to the usermode emulation routine.
+		 */
+#if defined(_LP64)
+		if (get_udatamodel() != DATAMODEL_NATIVE) {
+			lx_emulate_user32(lwp, syscall_num, args);
+		} else
+#endif
+		{
+			lx_emulate_user(lwp, syscall_num, args);
+		}
+		return (0);
+
+	default:
+		/*
+		 * We are not emulating this system call at all.
+		 */
+		lx_syscall_unsup_msg(s, syscall_num, unsup_reason);
+
+		(void) set_errno(ENOTSUP);
+		lx_syscall_return(lwp, syscall_num, -1);
+		return (0);
+	}
+}
+
+#if defined(_LP64)
+/*
+ * Emulate vsyscall support.
+ *
+ * Linux magically maps a single page into the address space of each process,
+ * allowing them to make 'vsyscalls'.  Originally designed to counteract the
+ * perceived overhead of regular system calls, vsyscalls were implemented as
+ * code residing in userspace which could be called directly.  The userspace
+ * implementations of these vsyscalls which have now been replaced by
+ * instructions which vector into the normal syscall path.
+ *
+ * Implementing vsyscalls on Illumos is complicated by the fact that the
+ * required static address region resides inside the kernel address space.
+ * Rather than mapping a user-accessible page into the KAS, a different
+ * approach is taken.  The vsyscall gate is emulated by interposing on
+ * pagefaults in trap().  An attempt to execute a known vsyscall address will
+ * result in emulating the appropriate system call rather than inducing a
+ * SIGSEGV.
+ */
+void
+lx_vsyscall_enter(proc_t *p, klwp_t *lwp, int scnum)
+{
+	struct regs *rp = lwptoregs(lwp);
+	uintptr_t raddr;
+
+	/*
+	 * Fetch the return address from the process stack.
+	 */
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+	if (copyin((void *)rp->r_rsp, &raddr, sizeof (raddr)) != 0) {
+#if DEBUG
+		printf("lx_vsyscall_call: bad brand stack at vsyscall "
+		    "cmd=%s, pid=%d, sp=0x%p\n", PTOU(p)->u_comm,
+		    p->p_pid, (void *)rp->r_rsp);
+#endif
+
+		/*
+		 * The process jumped to the vsyscall address without a
+		 * correctly configured stack.  Terminate the process.
+		 */
+		exit(CLD_KILLED, SIGSEGV);
+		return;
+	}
+
+	DTRACE_PROBE1(brand__lx__vsyscall, int, scnum);
+
+	/* Simulate vectoring into the syscall */
+	rp->r_rax = scnum;
+	rp->r_rip = raddr;
+	rp->r_rsp += sizeof (uintptr_t);
+
+	(void) lx_syscall_enter();
+}
+
+boolean_t
+lx_vsyscall_iscall(klwp_t *lwp, uintptr_t addr, int *scnum)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	int i;
+
+	if (lwpd->br_stack_mode != LX_STACK_MODE_BRAND) {
+		/*
+		 * We only handle vsyscalls when running Linux code.
+		 */
+		return (B_FALSE);
+	}
+
+	if (addr < LX_VSYSCALL_ADDR ||
+	    addr >= (LX_VSYSCALL_ADDR + LX_VSYSCALL_SIZE)) {
+		/*
+		 * Ignore faults outside the vsyscall page.
+		 */
+		return (B_FALSE);
+	}
+
+	for (i = 0; lx_vsyscalls[i].lv_addr != NULL; i++) {
+		if (addr == lx_vsyscalls[i].lv_addr) {
+			/*
+			 * This is a valid vsyscall address.
+			 */
+			*scnum = lx_vsyscalls[i].lv_scnum;
+			return (B_TRUE);
+		}
+	}
+
+	lx_unsupported("bad vsyscall access");
+	return (B_FALSE);
+}
+#endif
+
+/*
+ * Linux defines system call numbers for 32-bit x86 in the file:
+ *   arch/x86/syscalls/syscall_32.tbl
+ */
+lx_sysent_t lx_sysent32[] = {
+	{"nosys",	NULL,			NOSYS_NONE,	0}, /*  0 */
+	{"exit",	NULL,			0,		1}, /*  1 */
+	{"fork",	NULL,			0,		0}, /*  2 */
+	{"read",	lx_read,		0,		3}, /*  3 */
+	{"write",	lx_write,		0,		3}, /*  4 */
+	{"open",	lx_open,		0,		3}, /*  5 */
+	{"close",	lx_close,		0,		1}, /*  6 */
+	{"waitpid",	lx_waitpid,		0,		3}, /*  7 */
+	{"creat",	lx_creat,		0,		2}, /*  8 */
+	{"link",	lx_link,		0,		2}, /*  9 */
+	{"unlink",	lx_unlink,		0,		1}, /* 10 */
+	{"execve",	NULL,			0,		3}, /* 11 */
+	{"chdir",	lx_chdir,		0,		1}, /* 12 */
+	{"time",	lx_time,		0,		1}, /* 13 */
+	{"mknod",	NULL,			0,		3}, /* 14 */
+	{"chmod",	lx_chmod,		0,		2}, /* 15 */
+	{"lchown16",	lx_lchown16,		0,		3}, /* 16 */
+	{"break",	NULL,			NOSYS_OBSOLETE,	0}, /* 17 */
+	{"stat",	NULL,			NOSYS_OBSOLETE,	0}, /* 18 */
+	{"lseek",	lx_lseek32,		0,		3}, /* 19 */
+	{"getpid",	lx_getpid,		0,		0}, /* 20 */
+	{"mount",	lx_mount,		0,		5}, /* 21 */
+	{"umount",	lx_umount,		0,		1}, /* 22 */
+	{"setuid16",	lx_setuid16,		0,		1}, /* 23 */
+	{"getuid16",	lx_getuid16,		0,		0}, /* 24 */
+	{"stime",	lx_stime,		0,		1}, /* 25 */
+	{"ptrace",	lx_ptrace,		0,		4}, /* 26 */
+	{"alarm",	lx_alarm,		0,		1}, /* 27 */
+	{"fstat",	NULL,			NOSYS_OBSOLETE,	0}, /* 28 */
+	{"pause",	lx_pause,		0,		0}, /* 29 */
+	{"utime",	NULL,			0,		2}, /* 30 */
+	{"stty",	NULL,			NOSYS_OBSOLETE,	0}, /* 31 */
+	{"gtty",	NULL,			NOSYS_OBSOLETE,	0}, /* 32 */
+	{"access",	lx_access,		0,		2}, /* 33 */
+	{"nice",	lx_nice,		0,		1}, /* 34 */
+	{"ftime",	NULL,			NOSYS_OBSOLETE,	0}, /* 35 */
+	{"sync",	lx_sync,		0, 		0}, /* 36 */
+	{"kill",	lx_kill,		0,		2}, /* 37 */
+	{"rename",	lx_rename,		0,		2}, /* 38 */
+	{"mkdir",	lx_mkdir,		0,		2}, /* 39 */
+	{"rmdir",	NULL,			0,		1}, /* 40 */
+	{"dup",		lx_dup,			0,		1}, /* 41 */
+	{"pipe",	lx_pipe,		0,		1}, /* 42 */
+	{"times",	lx_times,		0,		1}, /* 43 */
+	{"prof",	NULL,			NOSYS_OBSOLETE,	0}, /* 44 */
+	{"brk",		lx_brk,			0,		1}, /* 45 */
+	{"setgid16",	lx_setgid16,		0,		1}, /* 46 */
+	{"getgid16",	lx_getgid16,		0,		0}, /* 47 */
+	{"signal",	NULL,			0,		2}, /* 48 */
+	{"geteuid16",	lx_geteuid16,		0,		0}, /* 49 */
+	{"getegid16",	lx_getegid16,		0,		0}, /* 50 */
+	{"acct",	lx_acct,		0,		1}, /* 51 */
+	{"umount2",	lx_umount2,		0,		2}, /* 52 */
+	{"lock",	NULL,			NOSYS_OBSOLETE,	0}, /* 53 */
+	{"ioctl",	lx_ioctl,		0,		3}, /* 54 */
+	{"fcntl",	lx_fcntl,		0,		3}, /* 55 */
+	{"mpx",		NULL,			NOSYS_OBSOLETE,	0}, /* 56 */
+	{"setpgid",	lx_setpgid,		0,		2}, /* 57 */
+	{"ulimit",	NULL,			NOSYS_OBSOLETE,	0}, /* 58 */
+	{"olduname",	NULL,			NOSYS_OBSOLETE,	0}, /* 59 */
+	{"umask",	lx_umask,		0,		1}, /* 60 */
+	{"chroot",	lx_chroot,		0,		1}, /* 61 */
+	{"ustat",	NULL,			NOSYS_OBSOLETE,	2}, /* 62 */
+	{"dup2",	lx_dup2,		0,		2}, /* 63 */
+	{"getppid",	lx_getppid,		0,		0}, /* 64 */
+	{"getpgrp",	lx_getpgrp,		0,		0}, /* 65 */
+	{"setsid",	lx_setsid,		0,		0}, /* 66 */
+	{"sigaction",	NULL,			0,		3}, /* 67 */
+	{"sgetmask",	NULL,			NOSYS_OBSOLETE,	0}, /* 68 */
+	{"ssetmask",	NULL,			NOSYS_OBSOLETE,	0}, /* 69 */
+	{"setreuid16",	lx_setreuid16,		0,		2}, /* 70 */
+	{"setregid16",	lx_setregid16,		0,		2}, /* 71 */
+	{"sigsuspend",	NULL,			0,		1}, /* 72 */
+	{"sigpending",	NULL,			0,		1}, /* 73 */
+	{"sethostname",	lx_sethostname,		0,		2}, /* 74 */
+	{"setrlimit",	lx_setrlimit,		0,		2}, /* 75 */
+	{"getrlimit",	lx_oldgetrlimit,	0,		2}, /* 76 */
+	{"getrusage",	lx_getrusage,		0,		2}, /* 77 */
+	{"gettimeofday", lx_gettimeofday,	0,		2}, /* 78 */
+	{"settimeofday", NULL, 			0,		2}, /* 79 */
+	{"getgroups16",	NULL,			0,		2}, /* 80 */
+	{"setgroups16",	NULL,			0,		2}, /* 81 */
+	{"select",	NULL,			NOSYS_OBSOLETE,	0}, /* 82 */
+	{"symlink",	lx_symlink,		0,		2}, /* 83 */
+	{"oldlstat",	NULL,			NOSYS_OBSOLETE,	0}, /* 84 */
+	{"readlink",	lx_readlink,		0,		3}, /* 85 */
+	{"uselib",	NULL,			NOSYS_KERNEL,	0}, /* 86 */
+	{"swapon",	lx_swapon,		0,		2}, /* 87 */
+	{"reboot",	lx_reboot,		0,		4}, /* 88 */
+	{"readdir",	NULL,			0,		3}, /* 89 */
+	{"mmap",	lx_mmap,		0,		6}, /* 90 */
+	{"munmap",	lx_munmap,		0,		2}, /* 91 */
+	{"truncate",	NULL,			0,		2}, /* 92 */
+	{"ftruncate",	NULL,			0,		2}, /* 93 */
+	{"fchmod",	lx_fchmod,		0,		2}, /* 94 */
+	{"fchown16",	lx_fchown16,		0,		3}, /* 95 */
+	{"getpriority",	lx_getpriority,		0,		2}, /* 96 */
+	{"setpriority",	lx_setpriority,		0,		3}, /* 97 */
+	{"profil",	NULL,			NOSYS_NO_EQUIV,	0}, /* 98 */
+	{"statfs",	NULL,			0,		2}, /* 99 */
+	{"fstatfs",	NULL,			0,		2}, /* 100 */
+	{"ioperm",	NULL,			NOSYS_NO_EQUIV,	0}, /* 101 */
+	{"socketcall",	lx_socketcall,		0,		2}, /* 102 */
+	{"syslog",	lx_syslog,		0,		3}, /* 103 */
+	{"setitimer",	NULL,			0,		3}, /* 104 */
+	{"getitimer",	lx_getitimer,		0,		2}, /* 105 */
+	{"stat",	lx_stat32,		0,		2}, /* 106 */
+	{"lstat",	lx_lstat32,		0,		2}, /* 107 */
+	{"fstat",	lx_fstat32,		0,		2}, /* 108 */
+	{"uname",	NULL,			NOSYS_OBSOLETE,	0}, /* 109 */
+	{"oldiopl",	NULL,			NOSYS_NO_EQUIV,	0}, /* 110 */
+	{"vhangup",	lx_vhangup,		0,		0}, /* 111 */
+	{"idle",	NULL,			NOSYS_NO_EQUIV,	0}, /* 112 */
+	{"vm86old",	NULL,			NOSYS_OBSOLETE,	0}, /* 113 */
+	{"wait4",	lx_wait4,		0,		4}, /* 114 */
+	{"swapoff",	lx_swapoff,		0,		1}, /* 115 */
+	{"sysinfo",	lx_sysinfo32,		0,		1}, /* 116 */
+	{"ipc",		NULL,			0,		5}, /* 117 */
+	{"fsync",	NULL,			0,		1}, /* 118 */
+	{"sigreturn",	NULL,			0,		1}, /* 119 */
+	{"clone",	NULL,			0,		5}, /* 120 */
+	{"setdomainname", lx_setdomainname,	0,		2}, /* 121 */
+	{"uname",	lx_uname,		0,		1}, /* 122 */
+	{"modify_ldt",	lx_modify_ldt,		0,		3}, /* 123 */
+	{"adjtimex",	NULL,			0,		1}, /* 124 */
+	{"mprotect",	lx_mprotect,		0,		3}, /* 125 */
+	{"sigprocmask",	NULL,			0,		3}, /* 126 */
+	{"create_module", NULL,			NOSYS_KERNEL,	0}, /* 127 */
+	{"init_module",	NULL,			NOSYS_KERNEL,	0}, /* 128 */
+	{"delete_module", NULL,			NOSYS_KERNEL,	0}, /* 129 */
+	{"get_kernel_syms", NULL,		NOSYS_KERNEL,	0}, /* 130 */
+	{"quotactl",	NULL,			NOSYS_KERNEL,	0}, /* 131 */
+	{"getpgid",	lx_getpgid,		0,		1}, /* 132 */
+	{"fchdir",	lx_fchdir,		0,		1}, /* 133 */
+	{"bdflush",	NULL,			NOSYS_KERNEL,	0}, /* 134 */
+	{"sysfs",	NULL,			0,		3}, /* 135 */
+	{"personality",	lx_personality,		0,		1}, /* 136 */
+	{"afs_syscall",	NULL,			NOSYS_KERNEL,	0}, /* 137 */
+	{"setfsuid16",	lx_setfsuid16,		0,		1}, /* 138 */
+	{"setfsgid16",	lx_setfsgid16,		0,		1}, /* 139 */
+	{"llseek",	lx_llseek,		0,		5}, /* 140 */
+	{"getdents",	lx_getdents_32,		0,		3}, /* 141 */
+	{"select",	lx_select,		0,		5}, /* 142 */
+	{"flock",	lx_flock,		0,		2}, /* 143 */
+	{"msync",	lx_msync,		0,		3}, /* 144 */
+	{"readv",	lx_readv,		0,		3}, /* 145 */
+	{"writev",	lx_writev,		0,		3}, /* 146 */
+	{"getsid",	lx_getsid,		0,		1}, /* 147 */
+	{"fdatasync",	NULL,			0,		1}, /* 148 */
+	{"sysctl",	NULL,			0,		1}, /* 149 */
+	{"mlock",	lx_mlock,		0,		2}, /* 150 */
+	{"munlock",	lx_munlock,		0,		2}, /* 151 */
+	{"mlockall",	lx_mlockall,		0,		1}, /* 152 */
+	{"munlockall",	lx_munlockall,		0,		0}, /* 153 */
+	{"sched_setparam", lx_sched_setparam,	0,		2}, /* 154 */
+	{"sched_getparam", lx_sched_getparam,	0,		2}, /* 155 */
+	{"sched_setscheduler", lx_sched_setscheduler, 0,	3}, /* 156 */
+	{"sched_getscheduler", lx_sched_getscheduler, 0,	1}, /* 157 */
+	{"sched_yield",	lx_sched_yield,		0,		0}, /* 158 */
+	{"sched_get_priority_max", lx_sched_get_priority_max, 0, 1}, /* 159 */
+	{"sched_get_priority_min", lx_sched_get_priority_min, 0, 1}, /* 160 */
+	{"sched_rr_get_interval", lx_sched_rr_get_interval,  0,	 2}, /* 161 */
+	{"nanosleep",	lx_nanosleep,		0,		2}, /* 162 */
+	{"mremap",	lx_mremap,		0,		5}, /* 163 */
+	{"setresuid16",	lx_setresuid16,		0,		3}, /* 164 */
+	{"getresuid16",	lx_getresuid16,		0,		3}, /* 165 */
+	{"vm86",	NULL,			NOSYS_NO_EQUIV,	0}, /* 166 */
+	{"query_module", NULL,			0,		5}, /* 167 */
+	{"poll",	lx_poll,		0,		3}, /* 168 */
+	{"nfsservctl",	NULL,			NOSYS_KERNEL,	0}, /* 169 */
+	{"setresgid16",	lx_setresgid16,		0,		3}, /* 170 */
+	{"getresgid16",	lx_getresgid16,		0,		3}, /* 171 */
+	{"prctl",	lx_prctl,		0,		5}, /* 172 */
+	{"rt_sigreturn", NULL,			0,		0}, /* 173 */
+	{"rt_sigaction", NULL,			0,		4}, /* 174 */
+	{"rt_sigprocmask", NULL,		0,		4}, /* 175 */
+	{"rt_sigpending", NULL,			0,		2}, /* 176 */
+	{"rt_sigtimedwait", NULL,		0,		4}, /* 177 */
+	{"rt_sigqueueinfo", NULL,		0,		3}, /* 178 */
+	{"rt_sigsuspend", NULL,			0,		2}, /* 179 */
+	{"pread64",	lx_pread32,		0,		5}, /* 180 */
+	{"pwrite64",	lx_pwrite32,		0,		5}, /* 181 */
+	{"chown16",	lx_chown16,		0,		3}, /* 182 */
+	{"getcwd",	lx_getcwd,		0,		2}, /* 183 */
+	{"capget",	NULL,			0,		2}, /* 184 */
+	{"capset",	NULL,			0,		2}, /* 185 */
+	{"sigaltstack",	NULL,			0,		2}, /* 186 */
+	{"sendfile",	NULL,			0,		4}, /* 187 */
+	{"getpmsg",	NULL,			NOSYS_OBSOLETE,	0}, /* 188 */
+	{"putpmsg",	NULL,			NOSYS_OBSOLETE,	0}, /* 189 */
+	{"vfork",	NULL,			0,		0}, /* 190 */
+	{"getrlimit",	lx_getrlimit,		0,		2}, /* 191 */
+	{"mmap2",	lx_mmap2,		LX_SYS_EBPARG6,	6}, /* 192 */
+	{"truncate64",	NULL,			0,		3}, /* 193 */
+	{"ftruncate64",	NULL,			0,		3}, /* 194 */
+	{"stat64",	lx_stat64,		0,		2}, /* 195 */
+	{"lstat64",	lx_lstat64,		0,		2}, /* 196 */
+	{"fstat64",	lx_fstat64,		0,		2}, /* 197 */
+	{"lchown",	lx_lchown,		0,		3}, /* 198 */
+	{"getuid",	lx_getuid,		0,		0}, /* 199 */
+	{"getgid",	lx_getgid,		0,		0}, /* 200 */
+	{"geteuid",	lx_geteuid,		0,		0}, /* 201 */
+	{"getegid",	lx_getegid,		0,		0}, /* 202 */
+	{"setreuid",	lx_setreuid,		0,		0}, /* 203 */
+	{"setregid",	lx_setregid,		0,		0}, /* 204 */
+	{"getgroups",	NULL,			0,		2}, /* 205 */
+	{"setgroups",	NULL,			0,		2}, /* 206 */
+	{"fchown",	lx_fchown,		0,		3}, /* 207 */
+	{"setresuid",	lx_setresuid,		0,		3}, /* 208 */
+	{"getresuid",	lx_getresuid,		0,		3}, /* 209 */
+	{"setresgid",	lx_setresgid,		0,		3}, /* 210 */
+	{"getresgid",	lx_getresgid,		0,		3}, /* 211 */
+	{"chown",	lx_chown,		0,		3}, /* 212 */
+	{"setuid",	lx_setuid,		0,		1}, /* 213 */
+	{"setgid",	lx_setgid,		0,		1}, /* 214 */
+	{"setfsuid",	lx_setfsuid,		0,		1}, /* 215 */
+	{"setfsgid",	lx_setfsgid,		0,		1}, /* 216 */
+	{"pivot_root",	NULL,			NOSYS_KERNEL,	0}, /* 217 */
+	{"mincore",	lx_mincore,		0,		3}, /* 218 */
+	{"madvise",	lx_madvise,		0,		3}, /* 219 */
+	{"getdents64",	lx_getdents64,		0,		3}, /* 220 */
+	{"fcntl64",	lx_fcntl64,		0,		3}, /* 221 */
+	{"tux",		NULL,			NOSYS_NO_EQUIV,	0}, /* 222 */
+	{"security",	NULL,			NOSYS_NO_EQUIV,	0}, /* 223 */
+	{"gettid",	lx_gettid,		0,		0}, /* 224 */
+	{"readahead",	NULL,			NOSYS_NO_EQUIV,	0}, /* 225 */
+	{"setxattr",	lx_setxattr,		0,		5}, /* 226 */
+	{"lsetxattr",	lx_lsetxattr,		0,		5}, /* 227 */
+	{"fsetxattr",	lx_fsetxattr,		0,		5}, /* 228 */
+	{"getxattr",	lx_getxattr,		0,		4}, /* 229 */
+	{"lgetxattr",	lx_lgetxattr,		0,		4}, /* 230 */
+	{"fgetxattr",	lx_fgetxattr,		0,		4}, /* 231 */
+	{"listxattr",	lx_listxattr,		0,		3}, /* 232 */
+	{"llistxattr",	lx_llistxattr,		0,		3}, /* 233 */
+	{"flistxattr",	lx_flistxattr,		0,		3}, /* 234 */
+	{"removexattr",	lx_removexattr,		0,		2}, /* 235 */
+	{"lremovexattr", lx_lremovexattr,	0,		2}, /* 236 */
+	{"fremovexattr", lx_fremovexattr,	0,		2}, /* 237 */
+	{"tkill",	lx_tkill,		0,		2}, /* 238 */
+	{"sendfile64",	NULL,			0,		4}, /* 239 */
+	{"futex",	lx_futex,		LX_SYS_EBPARG6,	6}, /* 240 */
+	{"sched_setaffinity", lx_sched_setaffinity,	0,	3}, /* 241 */
+	{"sched_getaffinity", lx_sched_getaffinity,	0,	3}, /* 242 */
+	{"set_thread_area", lx_set_thread_area,	0,		1}, /* 243 */
+	{"get_thread_area", lx_get_thread_area,	0,		1}, /* 244 */
+	{"io_setup",	lx_io_setup,		0,		2}, /* 245 */
+	{"io_destroy",	lx_io_destroy,		0,		1}, /* 246 */
+	{"io_getevents", lx_io_getevents,	0,		5}, /* 247 */
+	{"io_submit",	lx_io_submit,		0,		3}, /* 248 */
+	{"io_cancel",	lx_io_cancel,		0,		3}, /* 249 */
+	{"fadvise64",	lx_fadvise64_32,	0,		5}, /* 250 */
+	{"nosys",	NULL,			0,		0}, /* 251 */
+	{"group_exit",	NULL,			0,		1}, /* 252 */
+	{"lookup_dcookie", NULL,		NOSYS_NO_EQUIV,	0}, /* 253 */
+	{"epoll_create", lx_epoll_create,	0,		1}, /* 254 */
+	{"epoll_ctl",	lx_epoll_ctl,		0,		4}, /* 255 */
+	{"epoll_wait",	lx_epoll_wait,		0,		4}, /* 256 */
+	{"remap_file_pages", NULL,		NOSYS_NO_EQUIV,	0}, /* 257 */
+	{"set_tid_address", lx_set_tid_address,	0,		1}, /* 258 */
+	{"timer_create", lx_timer_create,	0,		3}, /* 259 */
+	{"timer_settime", NULL,			0,		4}, /* 260 */
+	{"timer_gettime", NULL,			0,		2}, /* 261 */
+	{"timer_getoverrun", NULL,		0,		1}, /* 262 */
+	{"timer_delete", NULL,			0,		1}, /* 263 */
+	{"clock_settime", lx_clock_settime,	0,		2}, /* 264 */
+	{"clock_gettime", lx_clock_gettime,	0,		2}, /* 265 */
+	{"clock_getres", lx_clock_getres,	0,		2}, /* 266 */
+	{"clock_nanosleep", NULL,		0,		4}, /* 267 */
+	{"statfs64",	NULL,			0,		2}, /* 268 */
+	{"fstatfs64",	NULL,			0,		2}, /* 269 */
+	{"tgkill",	lx_tgkill,		0,		3}, /* 270 */
+
+/*
+ * The following system calls only exist in kernel 2.6 and greater:
+ */
+	{"utimes",	NULL,			0,		2}, /* 271 */
+	{"fadvise64_64", lx_fadvise64_64,	LX_SYS_EBPARG6,	6}, /* 272 */
+	{"vserver",	NULL,			NOSYS_NULL,	0}, /* 273 */
+	{"mbind",	NULL,			NOSYS_NULL,	0}, /* 274 */
+	{"get_mempolicy", NULL,			NOSYS_NULL,	0}, /* 275 */
+	{"set_mempolicy", NULL,			NOSYS_NULL,	0}, /* 276 */
+	{"mq_open",	NULL,			NOSYS_NULL,	0}, /* 277 */
+	{"mq_unlink",	NULL,			NOSYS_NULL,	0}, /* 278 */
+	{"mq_timedsend", NULL,			NOSYS_NULL,	0}, /* 279 */
+	{"mq_timedreceive", NULL,		NOSYS_NULL,	0}, /* 280 */
+	{"mq_notify",	NULL,			NOSYS_NULL,	0}, /* 281 */
+	{"mq_getsetattr", NULL,			NOSYS_NULL,	0}, /* 282 */
+	{"kexec_load",	NULL,			NOSYS_NULL,	0}, /* 283 */
+	{"waitid",	lx_waitid,		0,		4}, /* 284 */
+	{"sys_setaltroot", NULL,		NOSYS_NULL,	0}, /* 285 */
+	{"add_key",	NULL,			NOSYS_NULL,	0}, /* 286 */
+	{"request_key",	NULL,			NOSYS_NULL,	0}, /* 287 */
+	{"keyctl",	NULL,			NOSYS_NULL,	0}, /* 288 */
+	{"ioprio_set",	lx_ioprio_set,		0,		3}, /* 289 */
+	{"ioprio_get",	lx_ioprio_get,		0,		2}, /* 290 */
+	{"inotify_init", NULL,			0,		0}, /* 291 */
+	{"inotify_add_watch", NULL,		0,		3}, /* 292 */
+	{"inotify_rm_watch", NULL,		0,		2}, /* 293 */
+	{"migrate_pages", NULL,			NOSYS_NULL,	0}, /* 294 */
+	{"openat",	lx_openat,		0,		4}, /* 295 */
+	{"mkdirat",	lx_mkdirat,		0,		3}, /* 296 */
+	{"mknodat",	NULL,			0,		4}, /* 297 */
+	{"fchownat",	lx_fchownat,		0,		5}, /* 298 */
+	{"futimesat",	NULL,			0,		3}, /* 299 */
+	{"fstatat64",	lx_fstatat64,		0,		4}, /* 300 */
+	{"unlinkat",	lx_unlinkat,		0,		3}, /* 301 */
+	{"renameat",	lx_renameat,		0,		4}, /* 302 */
+	{"linkat",	lx_linkat,		0,		5}, /* 303 */
+	{"symlinkat",	lx_symlinkat,		0,		3}, /* 304 */
+	{"readlinkat",	lx_readlinkat,		0,		4}, /* 305 */
+	{"fchmodat",	lx_fchmodat,		0,		3}, /* 306 */
+	{"faccessat",	lx_faccessat,		0,		4}, /* 307 */
+	{"pselect6",	lx_pselect,		LX_SYS_EBPARG6,	6}, /* 308 */
+	{"ppoll",	lx_ppoll,		0,		5}, /* 309 */
+	{"unshare",	lx_unshare,		0,		1}, /* 310 */
+	{"set_robust_list", lx_set_robust_list,	0,		2}, /* 311 */
+	{"get_robust_list", lx_get_robust_list,	0,		3}, /* 312 */
+	{"splice",	lx_splice,		LX_SYS_EBPARG6,	6}, /* 313 */
+	{"sync_file_range", lx_sync_file_range,	0,		4}, /* 314 */
+	{"tee",		NULL,			NOSYS_NULL,	0}, /* 315 */
+	{"vmsplice",	NULL,			NOSYS_NULL,	0}, /* 316 */
+	{"move_pages",	NULL,			NOSYS_NULL,	0}, /* 317 */
+	{"getcpu",	lx_getcpu,		0,		3}, /* 318 */
+	{"epoll_pwait",	lx_epoll_pwait,		0,		5}, /* 319 */
+	{"utimensat",	NULL,			0,		4}, /* 320 */
+	{"signalfd",	NULL,			0,		3}, /* 321 */
+	{"timerfd_create", NULL,		0,		2}, /* 322 */
+	{"eventfd",	lx_eventfd,		0,		1}, /* 323 */
+	{"fallocate",	lx_fallocate32,		LX_SYS_EBPARG6,	6}, /* 324 */
+	{"timerfd_settime", NULL,		0,		4}, /* 325 */
+	{"timerfd_gettime", NULL,		0,		2}, /* 326 */
+	{"signalfd4",	NULL,			0,		4}, /* 327 */
+	{"eventfd2",	lx_eventfd2,		0,		2}, /* 328 */
+	{"epoll_create1", lx_epoll_create1,	0,		1}, /* 329 */
+	{"dup3",	lx_dup3,		0,		3}, /* 330 */
+	{"pipe2",	lx_pipe2,		0,		2}, /* 331 */
+	{"inotify_init1", NULL,			0,		1}, /* 332 */
+	{"preadv",	lx_preadv32,		0,		5}, /* 333 */
+	{"pwritev",	lx_pwritev32,		0,		5}, /* 334 */
+	{"rt_tgsigqueueinfo", NULL,		0,		4}, /* 335 */
+	{"perf_event_open", NULL,		NOSYS_NULL,	0}, /* 336 */
+	{"recvmmsg",	NULL,			NOSYS_NULL,	0}, /* 337 */
+	{"fanotify_init", NULL,			NOSYS_NULL,	0}, /* 338 */
+	{"fanotify_mark", NULL,			NOSYS_NULL,	0}, /* 339 */
+	{"prlimit64",	lx_prlimit64,		0,		4}, /* 340 */
+	{"name_to_handle_at", NULL,		NOSYS_NULL,	0}, /* 341 */
+	{"open_by_handle_at", NULL,		NOSYS_NULL,	0}, /* 342 */
+	{"clock_adjtime", NULL,			NOSYS_NULL,	0}, /* 343 */
+	{"syncfs",	lx_syncfs,		0,		1}, /* 344 */
+	{"sendmmsg",	NULL,			NOSYS_NULL,	0}, /* 345 */
+	{"setns",	NULL,			NOSYS_NULL,	0}, /* 346 */
+	{"process_vm_readv", NULL,		NOSYS_NULL,	0}, /* 347 */
+	{"process_vm_writev", NULL,		NOSYS_NULL,	0}, /* 348 */
+	{"kcmp",	NULL,			NOSYS_NULL,	0}, /* 349 */
+	{"finit_module", NULL,			NOSYS_NULL,	0}, /* 350 */
+	{"sched_setattr", lx_sched_setattr,	0,		3}, /* 351 */
+	{"sched_getattr", lx_sched_getattr,	0,		4}, /* 352 */
+	{"renameat2",	NULL,			NOSYS_NULL,	0}, /* 353 */
+	{"seccomp",	NULL,			NOSYS_NULL,	0}, /* 354 */
+	{"getrandom",	lx_getrandom,		0,		3}, /* 355 */
+	{"memfd_create", NULL,			NOSYS_NULL,	0}, /* 356 */
+	{"bpf",		NULL,			NOSYS_NULL,	0}, /* 357 */
+	{"execveat",	NULL,			NOSYS_NULL,	0}, /* 358 */
+};
+
+#if defined(_LP64)
+/*
+ * Linux defines system call numbers for 64-bit x86 in the file:
+ *   arch/x86/syscalls/syscall_64.tbl
+ */
+lx_sysent_t lx_sysent64[] = {
+	{"read",	lx_read,		0,		3}, /* 0 */
+	{"write",	lx_write,		0,		3}, /* 1 */
+	{"open",	lx_open,		0,		3}, /* 2 */
+	{"close",	lx_close,		0,		1}, /* 3 */
+	{"stat",	lx_stat64,		0,		2}, /* 4 */
+	{"fstat",	lx_fstat64,		0,		2}, /* 5 */
+	{"lstat",	lx_lstat64,		0,		2}, /* 6 */
+	{"poll",	lx_poll,		0,		3}, /* 7 */
+	{"lseek",	lx_lseek64,		0,		3}, /* 8 */
+	{"mmap",	lx_mmap,		0,		6}, /* 9 */
+	{"mprotect",	lx_mprotect,		0,		3}, /* 10 */
+	{"munmap",	lx_munmap,		0,		2}, /* 11 */
+	{"brk",		lx_brk,			0,		1}, /* 12 */
+	{"rt_sigaction", NULL,			0,		4}, /* 13 */
+	{"rt_sigprocmask", NULL,		0,		4}, /* 14 */
+	{"rt_sigreturn", NULL,			0,		0}, /* 15 */
+	{"ioctl",	lx_ioctl,		0,		3}, /* 16 */
+	{"pread64",	lx_pread,		0,		4}, /* 17 */
+	{"pwrite64",	lx_pwrite,		0,		4}, /* 18 */
+	{"readv",	lx_readv,		0,		3}, /* 19 */
+	{"writev",	lx_writev,		0,		3}, /* 20 */
+	{"access",	lx_access,		0,		2}, /* 21 */
+	{"pipe",	lx_pipe,		0,		1}, /* 22 */
+	{"select",	lx_select,		0,		5}, /* 23 */
+	{"sched_yield",	lx_sched_yield,		0,		0}, /* 24 */
+	{"mremap",	lx_mremap,		0,		5}, /* 25 */
+	{"msync",	lx_msync,		0,		3}, /* 26 */
+	{"mincore",	lx_mincore,		0,		3}, /* 27 */
+	{"madvise",	lx_madvise,		0,		3}, /* 28 */
+	{"shmget",	NULL,			0,		3}, /* 29 */
+	{"shmat",	NULL,			0,		4}, /* 30 */
+	{"shmctl",	NULL,			0,		3}, /* 31 */
+	{"dup",		lx_dup,			0,		1}, /* 32 */
+	{"dup2",	lx_dup2,		0,		2}, /* 33 */
+	{"pause",	lx_pause,		0,		0}, /* 34 */
+	{"nanosleep",	lx_nanosleep,		0,		2}, /* 35 */
+	{"getitimer",	lx_getitimer,		0,		2}, /* 36 */
+	{"alarm",	lx_alarm,		0,		1}, /* 37 */
+	{"setitimer",	NULL,			0,		3}, /* 38 */
+	{"getpid",	lx_getpid,		0,		0}, /* 39 */
+	{"sendfile",	NULL,			0,		4}, /* 40 */
+	{"socket",	lx_socket,		0,		3}, /* 41 */
+	{"connect",	lx_connect,		0,		3}, /* 42 */
+	{"accept",	lx_accept,		0,		3}, /* 43 */
+	{"sendto",	lx_sendto,		0,		6}, /* 44 */
+	{"recvfrom",	lx_recvfrom,		0,		6}, /* 45 */
+	{"sendmsg",	lx_sendmsg,		0,		3}, /* 46 */
+	{"recvmsg",	lx_recvmsg,		0,		3}, /* 47 */
+	{"shutdown",	lx_shutdown,		0,		2}, /* 48 */
+	{"bind",	lx_bind,		0,		3}, /* 49 */
+	{"listen",	lx_listen,		0,		2}, /* 50 */
+	{"getsockname",	lx_getsockname,		0,		3}, /* 51 */
+	{"getpeername",	lx_getpeername,		0,		3}, /* 52 */
+	{"socketpair",	lx_socketpair,		0,		4}, /* 53 */
+	{"setsockopt",	lx_setsockopt,		0,		5}, /* 54 */
+	{"getsockopt",	lx_getsockopt,		0,		5}, /* 55 */
+	{"clone",	NULL,			0,		5}, /* 56 */
+	{"fork",	NULL,			0,		0}, /* 57 */
+	{"vfork",	NULL,			0,		0}, /* 58 */
+	{"execve",	NULL,			0,		3}, /* 59 */
+	{"exit",	NULL,			0,		1}, /* 60 */
+	{"wait4",	lx_wait4,		0,		4}, /* 61 */
+	{"kill",	lx_kill,		0,		2}, /* 62 */
+	{"uname",	lx_uname,		0,		1}, /* 63 */
+	{"semget",	NULL,			0,		3}, /* 64 */
+	{"semop",	NULL,			0,		3}, /* 65 */
+	{"semctl",	NULL,			0,		4}, /* 66 */
+	{"shmdt",	NULL,			0,		1}, /* 67 */
+	{"msgget",	NULL,			0,		2}, /* 68 */
+	{"msgsnd",	NULL,			0,		4}, /* 69 */
+	{"msgrcv",	NULL,			0,		5}, /* 70 */
+	{"msgctl",	NULL,			0,		3}, /* 71 */
+	{"fcntl",	lx_fcntl64,		0,		3}, /* 72 */
+	{"flock",	lx_flock,		0,		2}, /* 73 */
+	{"fsync",	NULL,			0,		1}, /* 74 */
+	{"fdatasync",	NULL,			0,		1}, /* 75 */
+	{"truncate",	NULL,			0,		2}, /* 76 */
+	{"ftruncate",	NULL,			0,		2}, /* 77 */
+	{"getdents",	lx_getdents_64,		0,		3}, /* 78 */
+	{"getcwd",	lx_getcwd,		0,		2}, /* 79 */
+	{"chdir",	lx_chdir,		0,		1}, /* 80 */
+	{"fchdir",	lx_fchdir,		0,		1}, /* 81 */
+	{"rename",	lx_rename,		0,		2}, /* 82 */
+	{"mkdir",	lx_mkdir,		0,		2}, /* 83 */
+	{"rmdir",	NULL,			0,		1}, /* 84 */
+	{"creat",	lx_creat,		0,		2}, /* 85 */
+	{"link",	lx_link,		0,		2}, /* 86 */
+	{"unlink",	lx_unlink,		0,		1}, /* 87 */
+	{"symlink",	lx_symlink,		0,		2}, /* 88 */
+	{"readlink",	lx_readlink,		0,		3}, /* 89 */
+	{"chmod",	lx_chmod,		0,		2}, /* 90 */
+	{"fchmod",	lx_fchmod,		0,		2}, /* 91 */
+	{"chown",	lx_chown,		0,		3}, /* 92 */
+	{"fchown",	lx_fchown,		0,		3}, /* 93 */
+	{"lchown",	lx_lchown,		0,		3}, /* 94 */
+	{"umask",	lx_umask,		0,		1}, /* 95 */
+	{"gettimeofday", lx_gettimeofday,	0,		2}, /* 96 */
+	{"getrlimit",	lx_getrlimit,		0,		2}, /* 97 */
+	{"getrusage",	lx_getrusage,		0,		2}, /* 98 */
+	{"sysinfo",	lx_sysinfo64,		0,		1}, /* 99 */
+	{"times",	lx_times,		0,		1}, /* 100 */
+	{"ptrace",	lx_ptrace,		0,		4}, /* 101 */
+	{"getuid",	lx_getuid,		0,		0}, /* 102 */
+	{"syslog",	lx_syslog,		0,		3}, /* 103 */
+	{"getgid",	lx_getgid,		0,		0}, /* 104 */
+	{"setuid",	lx_setuid,		0,		1}, /* 105 */
+	{"setgid",	lx_setgid,		0,		1}, /* 106 */
+	{"geteuid",	lx_geteuid,		0,		0}, /* 107 */
+	{"getegid",	lx_getegid,		0,		0}, /* 108 */
+	{"setpgid",	lx_setpgid,		0,		2}, /* 109 */
+	{"getppid",	lx_getppid,		0,		0}, /* 110 */
+	{"getpgrp",	lx_getpgrp,		0,		0}, /* 111 */
+	{"setsid",	lx_setsid,		0,		0}, /* 112 */
+	{"setreuid",	lx_setreuid,		0,		0}, /* 113 */
+	{"setregid",	lx_setregid,		0,		0}, /* 114 */
+	{"getgroups",	NULL,			0,		2}, /* 115 */
+	{"setgroups",	NULL,			0,		2}, /* 116 */
+	{"setresuid",	lx_setresuid,		0,		3}, /* 117 */
+	{"getresuid",	lx_getresuid,		0,		3}, /* 118 */
+	{"setresgid",	lx_setresgid,		0,		3}, /* 119 */
+	{"getresgid",	lx_getresgid,		0,		3}, /* 120 */
+	{"getpgid",	lx_getpgid,		0,		1}, /* 121 */
+	{"setfsuid",	lx_setfsuid,		0,		1}, /* 122 */
+	{"setfsgid",	lx_setfsgid,		0,		1}, /* 123 */
+	{"getsid",	lx_getsid,		0,		1}, /* 124 */
+	{"capget",	NULL,			0,		2}, /* 125 */
+	{"capset",	NULL,			0,		2}, /* 126 */
+	{"rt_sigpending", NULL,			0,		2}, /* 127 */
+	{"rt_sigtimedwait", NULL,		0,		4}, /* 128 */
+	{"rt_sigqueueinfo", NULL,		0,		3}, /* 129 */
+	{"rt_sigsuspend", NULL,			0,		2}, /* 130 */
+	{"sigaltstack",	NULL,			0,		2}, /* 131 */
+	{"utime",	NULL,			0,		2}, /* 132 */
+	{"mknod",	NULL,			0,		3}, /* 133 */
+	{"uselib",	NULL,			NOSYS_KERNEL,	0}, /* 134 */
+	{"personality",	lx_personality,		0,		1}, /* 135 */
+	{"ustat",	NULL,			NOSYS_OBSOLETE,	2}, /* 136 */
+	{"statfs",	NULL,			0,		2}, /* 137 */
+	{"fstatfs",	NULL,			0,		2}, /* 138 */
+	{"sysfs",	NULL,			0,		3}, /* 139 */
+	{"getpriority",	lx_getpriority,		0,		2}, /* 140 */
+	{"setpriority",	lx_setpriority,		0,		3}, /* 141 */
+	{"sched_setparam", lx_sched_setparam,	0,		2}, /* 142 */
+	{"sched_getparam", lx_sched_getparam,	0,		2}, /* 143 */
+	{"sched_setscheduler", lx_sched_setscheduler, 0,	3}, /* 144 */
+	{"sched_getscheduler", lx_sched_getscheduler, 0,	1}, /* 145 */
+	{"sched_get_priority_max", lx_sched_get_priority_max, 0, 1}, /* 146 */
+	{"sched_get_priority_min", lx_sched_get_priority_min, 0, 1}, /* 147 */
+	{"sched_rr_get_interval", lx_sched_rr_get_interval, 0,	2}, /* 148 */
+	{"mlock",	lx_mlock,		0,		2}, /* 149 */
+	{"munlock",	lx_munlock,		0,		2}, /* 150 */
+	{"mlockall",	lx_mlockall,		0,		1}, /* 151 */
+	{"munlockall",	lx_munlockall,		0,		0}, /* 152 */
+	{"vhangup",	lx_vhangup,		0,		0}, /* 153 */
+	{"modify_ldt",	lx_modify_ldt,		0,		3}, /* 154 */
+	{"pivot_root",	NULL,			NOSYS_KERNEL,	0}, /* 155 */
+	{"sysctl",	NULL,			0,		1}, /* 156 */
+	{"prctl",	lx_prctl,		0,		5}, /* 157 */
+	{"arch_prctl",	lx_arch_prctl,		0,		2}, /* 158 */
+	{"adjtimex",	NULL,			0,		1}, /* 159 */
+	{"setrlimit",	lx_setrlimit,		0,		2}, /* 160 */
+	{"chroot",	lx_chroot,		0,		1}, /* 161 */
+	{"sync",	lx_sync,		0,		0}, /* 162 */
+	{"acct",	lx_acct,		0,		1}, /* 163 */
+	{"settimeofday", NULL,			0,		2}, /* 164 */
+	{"mount",	lx_mount,		0,		5}, /* 165 */
+	{"umount2",	lx_umount2,		0,		2}, /* 166 */
+	{"swapon",	lx_swapon,		0,		2}, /* 167 */
+	{"swapoff",	lx_swapoff,		0,		1}, /* 168 */
+	{"reboot",	lx_reboot,		0,		4}, /* 169 */
+	{"sethostname",	lx_sethostname,		0,		2}, /* 170 */
+	{"setdomainname", lx_setdomainname,	0,		2}, /* 171 */
+	{"iopl",	NULL,			NOSYS_NO_EQUIV,	0}, /* 172 */
+	{"ioperm",	NULL,			NOSYS_NO_EQUIV,	0}, /* 173 */
+	{"create_module", NULL,			NOSYS_KERNEL,	0}, /* 174 */
+	{"init_module",	NULL,			NOSYS_KERNEL,	0}, /* 175 */
+	{"delete_module", NULL,			NOSYS_KERNEL,	0}, /* 176 */
+	{"get_kernel_syms", NULL,		NOSYS_KERNEL,	0}, /* 177 */
+	{"query_module", NULL,			0,		5}, /* 178 */
+	{"quotactl",	NULL,			NOSYS_KERNEL,	0}, /* 179 */
+	{"nfsservctl",	NULL,			NOSYS_KERNEL,	0}, /* 180 */
+	{"getpmsg",	NULL,			NOSYS_OBSOLETE,	0}, /* 181 */
+	{"putpmsg",	NULL,			NOSYS_OBSOLETE,	0}, /* 182 */
+	{"afs_syscall",	NULL,			NOSYS_KERNEL,	0}, /* 183 */
+	{"tux",		NULL,			NOSYS_NO_EQUIV,	0}, /* 184 */
+	{"security",	NULL,			NOSYS_NO_EQUIV,	0}, /* 185 */
+	{"gettid",	lx_gettid,		0,		0}, /* 186 */
+	{"readahead",	NULL,			NOSYS_NO_EQUIV,	0}, /* 187 */
+	{"setxattr",	lx_setxattr,		0,		5}, /* 188 */
+	{"lsetxattr",	lx_lsetxattr,		0,		5}, /* 189 */
+	{"fsetxattr",	lx_fsetxattr,		0,		5}, /* 190 */
+	{"getxattr",	lx_getxattr,		0,		4}, /* 191 */
+	{"lgetxattr",	lx_lgetxattr,		0,		4}, /* 192 */
+	{"fgetxattr",	lx_fgetxattr,		0,		4}, /* 193 */
+	{"listxattr",	lx_listxattr,		0,		3}, /* 194 */
+	{"llistxattr",	lx_llistxattr,		0,		3}, /* 195 */
+	{"flistxattr",	lx_flistxattr,		0,		3}, /* 196 */
+	{"removexattr",	lx_removexattr,		0,		2}, /* 197 */
+	{"lremovexattr", lx_lremovexattr,	0,		2}, /* 198 */
+	{"fremovexattr", lx_fremovexattr,	0,		2}, /* 199 */
+	{"tkill",	lx_tkill,		0,		2}, /* 200 */
+	{"time",	lx_time,		0,		1}, /* 201 */
+	{"futex",	lx_futex,		0,		6}, /* 202 */
+	{"sched_setaffinity", lx_sched_setaffinity,	0,	3}, /* 203 */
+	{"sched_getaffinity", lx_sched_getaffinity,	0,	3}, /* 204 */
+	{"set_thread_area", lx_set_thread_area, 0,		1}, /* 205 */
+	{"io_setup",	lx_io_setup,		0,		2}, /* 206 */
+	{"io_destroy",	lx_io_destroy,		0,		1}, /* 207 */
+	{"io_getevents", lx_io_getevents,	0,		5}, /* 208 */
+	{"io_submit",	lx_io_submit,		0,		3}, /* 209 */
+	{"io_cancel",	lx_io_cancel,		0,		3}, /* 210 */
+	{"get_thread_area", lx_get_thread_area,	0,		1}, /* 211 */
+	{"lookup_dcookie", NULL,		NOSYS_NO_EQUIV,	0}, /* 212 */
+	{"epoll_create", lx_epoll_create,	0,		1}, /* 213 */
+	{"epoll_ctl_old", NULL,			NOSYS_NULL,	0}, /* 214 */
+	{"epoll_wait_old", NULL,		NOSYS_NULL,	0}, /* 215 */
+	{"remap_file_pages", NULL,		NOSYS_NO_EQUIV,	0}, /* 216 */
+	{"getdents64",	lx_getdents64,		0,		3}, /* 217 */
+	{"set_tid_address", lx_set_tid_address, 0,		1}, /* 218 */
+	{"restart_syscall", NULL,		NOSYS_NULL,	0}, /* 219 */
+	{"semtimedop",	NULL,			0,		4}, /* 220 */
+	{"fadvise64",	lx_fadvise64,		0,		4}, /* 221 */
+	{"timer_create", lx_timer_create,	0,		3}, /* 222 */
+	{"timer_settime", NULL,			0,		4}, /* 223 */
+	{"timer_gettime", NULL,			0,		2}, /* 224 */
+	{"timer_getoverrun", NULL,		0,		1}, /* 225 */
+	{"timer_delete", NULL,			0,		1}, /* 226 */
+	{"clock_settime", lx_clock_settime,	0,		2}, /* 227 */
+	{"clock_gettime", lx_clock_gettime,	0,		2}, /* 228 */
+	{"clock_getres", lx_clock_getres,	0,		2}, /* 229 */
+	{"clock_nanosleep", NULL,		0,		4}, /* 230 */
+	{"exit_group",	NULL,			0,		1}, /* 231 */
+	{"epoll_wait",	lx_epoll_wait,		0,		4}, /* 232 */
+	{"epoll_ctl",	lx_epoll_ctl,		0,		4}, /* 233 */
+	{"tgkill",	lx_tgkill,		0,		3}, /* 234 */
+	{"utimes",	NULL,			0,		2}, /* 235 */
+	{"vserver",	NULL,			NOSYS_NULL,	0}, /* 236 */
+	{"mbind",	NULL,			NOSYS_NULL,	0}, /* 237 */
+	{"set_mempolicy", NULL,			NOSYS_NULL,	0}, /* 238 */
+	{"get_mempolicy", NULL,			NOSYS_NULL,	0}, /* 239 */
+	{"mq_open",	NULL,			NOSYS_NULL,	0}, /* 240 */
+	{"mq_unlink",	NULL,			NOSYS_NULL,	0}, /* 241 */
+	{"mq_timedsend", NULL,			NOSYS_NULL,	0}, /* 242 */
+	{"mq_timedreceive", NULL,		NOSYS_NULL,	0}, /* 243 */
+	{"mq_notify",	NULL,			NOSYS_NULL,	0}, /* 244 */
+	{"mq_getsetattr", NULL,			NOSYS_NULL,	0}, /* 245 */
+	{"kexec_load",	NULL,			NOSYS_NULL,	0}, /* 246 */
+	{"waitid",	lx_waitid,		0,		4}, /* 247 */
+	{"add_key",	NULL,			NOSYS_NULL,	0}, /* 248 */
+	{"request_key",	NULL,			NOSYS_NULL,	0}, /* 249 */
+	{"keyctl",	NULL,			NOSYS_NULL,	0}, /* 250 */
+	{"ioprio_set",	lx_ioprio_set,		0,		3}, /* 251 */
+	{"ioprio_get",	lx_ioprio_get,		0,		2}, /* 252 */
+	{"inotify_init", NULL,			0,		0}, /* 253 */
+	{"inotify_add_watch", NULL,		0,		3}, /* 254 */
+	{"inotify_rm_watch", NULL,		0,		2}, /* 255 */
+	{"migrate_pages", NULL,			NOSYS_NULL,	0}, /* 256 */
+	{"openat",	lx_openat,		0,		4}, /* 257 */
+	{"mkdirat",	lx_mkdirat,		0,		3}, /* 258 */
+	{"mknodat",	NULL,			0,		4}, /* 259 */
+	{"fchownat",	lx_fchownat,		0,		5}, /* 260 */
+	{"futimesat",	NULL,			0,		3}, /* 261 */
+	{"fstatat64",	lx_fstatat64,		0,		4}, /* 262 */
+	{"unlinkat",	lx_unlinkat,		0,		3}, /* 263 */
+	{"renameat",	lx_renameat,		0,		4}, /* 264 */
+	{"linkat",	lx_linkat,		0,		5}, /* 265 */
+	{"symlinkat",	lx_symlinkat,		0,		3}, /* 266 */
+	{"readlinkat",	lx_readlinkat,		0,		4}, /* 267 */
+	{"fchmodat",	lx_fchmodat,		0,		3}, /* 268 */
+	{"faccessat",	lx_faccessat,		0,		4}, /* 269 */
+	{"pselect6",	lx_pselect,		0,		6}, /* 270 */
+	{"ppoll",	lx_ppoll,		0,		5}, /* 271 */
+	{"unshare",	lx_unshare,		0,		1}, /* 272 */
+	{"set_robust_list", lx_set_robust_list,	0,		2}, /* 273 */
+	{"get_robust_list", lx_get_robust_list,	0,		3}, /* 274 */
+	{"splice",	lx_splice,		0,		6}, /* 275 */
+	{"tee",		NULL,			NOSYS_NULL,	0}, /* 276 */
+	{"sync_file_range", lx_sync_file_range,	0,		4}, /* 277 */
+	{"vmsplice",	NULL,			NOSYS_NULL,	0}, /* 278 */
+	{"move_pages",	NULL,			NOSYS_NULL,	0}, /* 279 */
+	{"utimensat",	NULL,			0,		4}, /* 280 */
+	{"epoll_pwait",	lx_epoll_pwait,		0,		5}, /* 281 */
+	{"signalfd",	NULL,			0,		3}, /* 282 */
+	{"timerfd_create", NULL,		0,		2}, /* 283 */
+	{"eventfd",	lx_eventfd,		0,		1}, /* 284 */
+	{"fallocate",	lx_fallocate,		0,		4}, /* 285 */
+	{"timerfd_settime", NULL,		0,		4}, /* 286 */
+	{"timerfd_gettime", NULL,		0,		2}, /* 287 */
+	{"accept4",	lx_accept4,		0,		4}, /* 288 */
+	{"signalfd4",	NULL,			0,		4}, /* 289 */
+	{"eventfd2",	lx_eventfd2,		0,		2}, /* 290 */
+	{"epoll_create1", lx_epoll_create1,	0,		1}, /* 291 */
+	{"dup3",	lx_dup3,		0,		3}, /* 292 */
+	{"pipe2",	lx_pipe2,		0,		2}, /* 293 */
+	{"inotify_init1", NULL,			0,		1}, /* 294 */
+	{"preadv",	lx_preadv,		0,		4}, /* 295 */
+	{"pwritev",	lx_pwritev,		0,		4}, /* 296 */
+	{"rt_tgsigqueueinfo", NULL, 		0,		4}, /* 297 */
+	{"perf_event_open", NULL,		NOSYS_NULL,	0}, /* 298 */
+	{"recvmmsg",	NULL,			NOSYS_NULL,	0}, /* 299 */
+	{"fanotify_init", NULL,			NOSYS_NULL,	0}, /* 300 */
+	{"fanotify_mark", NULL,			NOSYS_NULL,	0}, /* 301 */
+	{"prlimit64",	lx_prlimit64,		0,		4}, /* 302 */
+	{"name_to_handle_at", NULL,		NOSYS_NULL,	0}, /* 303 */
+	{"open_by_handle_at", NULL,		NOSYS_NULL,	0}, /* 304 */
+	{"clock_adjtime", NULL,			NOSYS_NULL,	0}, /* 305 */
+	{"syncfs",	lx_syncfs,		0,		1}, /* 306 */
+	{"sendmmsg",	NULL,			NOSYS_NULL,	0}, /* 307 */
+	{"setns",	NULL,			NOSYS_NULL,	0}, /* 309 */
+	{"getcpu",	lx_getcpu,		0,		3}, /* 309 */
+	{"process_vm_readv", NULL,		NOSYS_NULL,	0}, /* 310 */
+	{"process_vm_writev", NULL,		NOSYS_NULL,	0}, /* 311 */
+	{"kcmp",	NULL,			NOSYS_NULL,	0}, /* 312 */
+	{"finit_module", NULL,			NOSYS_NULL,	0}, /* 313 */
+	{"sched_setattr", lx_sched_setattr,	0,		3}, /* 314 */
+	{"sched_getattr", lx_sched_getattr,	0,		4}, /* 315 */
+	{"renameat2", NULL,			NOSYS_NULL,	0}, /* 316 */
+	{"seccomp",	NULL,			NOSYS_NULL,	0}, /* 317 */
+	{"getrandom",	lx_getrandom,		0,		3}, /* 318 */
+	{"memfd_create", NULL,			NOSYS_NULL,	0}, /* 319 */
+	{"kexec_file_load", NULL,		NOSYS_NULL,	0}, /* 320 */
+	{"bpf",		NULL,			NOSYS_NULL,	0}, /* 321 */
+	{"execveat",	NULL,			NOSYS_NULL,	0}, /* 322 */
+
+	/* XXX TBD gap then x32 syscalls from 512 - 544 */
+};
+#endif
diff --git a/usr/src/uts/common/brand/lx/procfs/lx_proc.h b/usr/src/uts/common/brand/lx/procfs/lx_proc.h
new file mode 100644
index 0000000000..ad86667997
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/procfs/lx_proc.h
@@ -0,0 +1,378 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef	_LX_PROC_H
+#define	_LX_PROC_H
+
+#ifdef _LXPROC_NATIVE_H
+#error Attempted to include branded lx_proc.h after native lxproc.h
+#endif
+
+#define	_LXPROC_BRANDED_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * lxproc.h: declarations, data structures and macros for lxprocfs
+ */
+
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/policy.h>
+#include <sys/debug.h>
+#include <sys/dirent.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/kmem.h>
+#include <sys/pathname.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/user.h>
+#include <sys/t_lock.h>
+#include <sys/sysmacros.h>
+#include <sys/cred.h>
+#include <sys/priv.h>
+#include <sys/vnode.h>
+#include <sys/vfs.h>
+#include <sys/statvfs.h>
+#include <sys/cmn_err.h>
+#include <sys/zone.h>
+#include <sys/uio.h>
+#include <sys/utsname.h>
+#include <sys/dnlc.h>
+#include <sys/atomic.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/nvpair.h>
+#include <vm/as.h>
+#include <vm/anon.h>
+
+/*
+ * Convert a vnode into an lxpr_mnt_t
+ */
+#define	VTOLXPM(vp)	((lxpr_mnt_t *)(vp)->v_vfsp->vfs_data)
+
+/*
+ * convert a vnode into an lxpr_node
+ */
+#define	VTOLXP(vp)	((lxpr_node_t *)(vp)->v_data)
+
+/*
+ * convert a lxprnode into a vnode
+ */
+#define	LXPTOV(lxpnp)	((lxpnp)->lxpr_vnode)
+
+/*
+ * convert a lxpr_node into zone for fs
+ */
+#define	LXPTOZ(lxpnp) \
+	(((lxpr_mnt_t *)(lxpnp)->lxpr_vnode->v_vfsp->vfs_data)->lxprm_zone)
+
+#define	LXPNSIZ		256	/* max size of lx /proc file name entries */
+
+/*
+ * Pretend that a directory entry takes 16 bytes
+ */
+#define	LXPR_SDSIZE	16
+
+/*
+ * Node/file types for lx /proc files
+ * (directories and files contained therein).
+ */
+typedef enum lxpr_nodetype {
+	LXPR_INVALID,		/* nodes start at 1	*/
+	LXPR_PROCDIR,		/* /proc		*/
+	LXPR_PIDDIR,		/* /proc/<pid>		*/
+	LXPR_PID_AUXV,		/* /proc/<pid>/auxv	*/
+	LXPR_PID_CGROUP,	/* /proc/<pid>/cgroup	*/
+	LXPR_PID_CMDLINE,	/* /proc/<pid>/cmdline	*/
+	LXPR_PID_COMM,		/* /proc/<pid>/comm	*/
+	LXPR_PID_CPU,		/* /proc/<pid>/cpu	*/
+	LXPR_PID_CURDIR,	/* /proc/<pid>/cwd	*/
+	LXPR_PID_ENV,		/* /proc/<pid>/environ	*/
+	LXPR_PID_EXE,		/* /proc/<pid>/exe	*/
+	LXPR_PID_GIDMAP,	/* /proc/<pid>/gid_map	*/
+	LXPR_PID_LIMITS,	/* /proc/<pid>/limits	*/
+	LXPR_PID_LOGINUID,	/* /proc/<pid>/loginuid	*/
+	LXPR_PID_MAPS,		/* /proc/<pid>/maps	*/
+	LXPR_PID_MEM,		/* /proc/<pid>/mem	*/
+	LXPR_PID_MOUNTINFO,	/* /proc/<pid>/mountinfo */
+	LXPR_PID_MOUNTS,	/* /proc/<pid>/mounts	*/
+	LXPR_PID_OOM_SCR_ADJ,	/* /proc/<pid>/oom_score_adj	*/
+	LXPR_PID_PERSONALITY,	/* /proc/<pid>/personality	*/
+	LXPR_PID_ROOTDIR,	/* /proc/<pid>/root	*/
+	LXPR_PID_STAT,		/* /proc/<pid>/stat	*/
+	LXPR_PID_STATM,		/* /proc/<pid>/statm	*/
+	LXPR_PID_STATUS,	/* /proc/<pid>/status	*/
+	LXPR_PID_TASKDIR,	/* /proc/<pid>/task	*/
+	LXPR_PID_TASK_IDDIR,	/* /proc/<pid>/task/<tid>		*/
+	LXPR_PID_FDDIR,		/* /proc/<pid>/fd	*/
+	LXPR_PID_FD_FD,		/* /proc/<pid>/fd/nn	*/
+	LXPR_PID_UIDMAP,	/* /proc/<pid>/uid_map	*/
+	LXPR_PID_TID_AUXV,	/* /proc/<pid>/task/<tid>/auxv		*/
+	LXPR_PID_TID_CGROUP,	/* /proc/<pid>/task/<tid>/cgroup	*/
+	LXPR_PID_TID_CMDLINE,	/* /proc/<pid>/task/<tid>/cmdline	*/
+	LXPR_PID_TID_COMM,	/* /proc/<pid>/task/<tid>/comm		*/
+	LXPR_PID_TID_CPU,	/* /proc/<pid>/task/<tid>/cpu		*/
+	LXPR_PID_TID_CURDIR,	/* /proc/<pid>/task/<tid>/cwd		*/
+	LXPR_PID_TID_ENV,	/* /proc/<pid>/task/<tid>/environ	*/
+	LXPR_PID_TID_EXE,	/* /proc/<pid>/task/<tid>/exe		*/
+	LXPR_PID_TID_GIDMAP,	/* /proc/<pid>/task/<tid>/gid_map	*/
+	LXPR_PID_TID_LIMITS,	/* /proc/<pid>/task/<tid>/limits	*/
+	LXPR_PID_TID_LOGINUID,	/* /proc/<pid>/task/<tid>/loginuid	*/
+	LXPR_PID_TID_MAPS,	/* /proc/<pid>/task/<tid>/maps		*/
+	LXPR_PID_TID_MEM,	/* /proc/<pid>/task/<tid>/mem		*/
+	LXPR_PID_TID_MOUNTINFO,	/* /proc/<pid>/task/<tid>/mountinfo	*/
+	LXPR_PID_TID_OOM_SCR_ADJ, /* /proc/<pid>/task/<tid>/oom_score_adj */
+	LXPR_PID_TID_PERSONALITY, /* /proc/<pid>/task/<tid>/personality */
+	LXPR_PID_TID_ROOTDIR,	/* /proc/<pid>/task/<tid>/root		*/
+	LXPR_PID_TID_STAT,	/* /proc/<pid>/task/<tid>/stat		*/
+	LXPR_PID_TID_STATM,	/* /proc/<pid>/task/<tid>/statm		*/
+	LXPR_PID_TID_STATUS,	/* /proc/<pid>/task/<tid>/status	*/
+	LXPR_PID_TID_FDDIR,	/* /proc/<pid>/task/<tid>/fd		*/
+	LXPR_PID_TID_FD_FD,	/* /proc/<pid>/task/<tid>/fd/nn		*/
+	LXPR_PID_TID_UIDMAP,	/* /proc/<pid>/task/<tid>/uid_map	*/
+	LXPR_CGROUPS,		/* /proc/cgroups	*/
+	LXPR_CMDLINE,		/* /proc/cmdline	*/
+	LXPR_CPUINFO,		/* /proc/cpuinfo	*/
+	LXPR_DEVICES,		/* /proc/devices	*/
+	LXPR_DISKSTATS,		/* /proc/diskstats	*/
+	LXPR_DMA,		/* /proc/dma		*/
+	LXPR_FILESYSTEMS,	/* /proc/filesystems	*/
+	LXPR_INTERRUPTS,	/* /proc/interrupts	*/
+	LXPR_IOPORTS,		/* /proc/ioports	*/
+	LXPR_KCORE,		/* /proc/kcore		*/
+	LXPR_KMSG,		/* /proc/kmsg		*/
+	LXPR_LOADAVG,		/* /proc/loadavg	*/
+	LXPR_MEMINFO,		/* /proc/meminfo	*/
+	LXPR_MODULES,		/* /proc/modules	*/
+	LXPR_MOUNTS,		/* /proc/mounts		*/
+	LXPR_NETDIR,		/* /proc/net		*/
+	LXPR_NET_ARP,		/* /proc/net/arp	*/
+	LXPR_NET_DEV,		/* /proc/net/dev	*/
+	LXPR_NET_DEV_MCAST,	/* /proc/net/dev_mcast	*/
+	LXPR_NET_IF_INET6,	/* /proc/net/if_inet6	*/
+	LXPR_NET_IGMP,		/* /proc/net/igmp	*/
+	LXPR_NET_IP_MR_CACHE,	/* /proc/net/ip_mr_cache */
+	LXPR_NET_IP_MR_VIF,	/* /proc/net/ip_mr_vif	*/
+	LXPR_NET_IPV6_ROUTE,	/* /proc/net/ipv6_route	*/
+	LXPR_NET_MCFILTER,	/* /proc/net/mcfilter	*/
+	LXPR_NET_NETSTAT,	/* /proc/net/netstat	*/
+	LXPR_NET_RAW,		/* /proc/net/raw	*/
+	LXPR_NET_ROUTE,		/* /proc/net/route	*/
+	LXPR_NET_RPC,		/* /proc/net/rpc	*/
+	LXPR_NET_RT_CACHE,	/* /proc/net/rt_cache	*/
+	LXPR_NET_SOCKSTAT,	/* /proc/net/sockstat	*/
+	LXPR_NET_SNMP,		/* /proc/net/snmp	*/
+	LXPR_NET_STAT,		/* /proc/net/stat	*/
+	LXPR_NET_TCP,		/* /proc/net/tcp	*/
+	LXPR_NET_TCP6,		/* /proc/net/tcp6	*/
+	LXPR_NET_UDP,		/* /proc/net/udp	*/
+	LXPR_NET_UDP6,		/* /proc/net/udp6	*/
+	LXPR_NET_UNIX,		/* /proc/net/unix	*/
+	LXPR_PARTITIONS,	/* /proc/partitions	*/
+	LXPR_SELF,		/* /proc/self		*/
+	LXPR_STAT,		/* /proc/stat		*/
+	LXPR_SWAPS,		/* /proc/swaps		*/
+	LXPR_SYSDIR,		/* /proc/sys/		*/
+	LXPR_SYS_FSDIR,		/* /proc/sys/fs/	*/
+	LXPR_SYS_FS_AIO_MAX_NR,	/* /proc/sys/fs/aio-max-nr */
+	LXPR_SYS_FS_AIO_NR,	/* /proc/sys/fs/aio-nr	*/
+	LXPR_SYS_FS_FILEMAX,	/* /proc/sys/fs/file-max */
+	LXPR_SYS_FS_FILENR,	/* /proc/sys/fs/file-nr */
+	LXPR_SYS_FS_INOTIFYDIR,	/* /proc/sys/fs/inotify	*/
+	LXPR_SYS_FS_INOTIFY_MAX_QUEUED_EVENTS,	/* inotify/max_queued_events */
+	LXPR_SYS_FS_INOTIFY_MAX_USER_INSTANCES,	/* inotify/max_user_instances */
+	LXPR_SYS_FS_INOTIFY_MAX_USER_WATCHES,	/* inotify/max_user_watches */
+	LXPR_SYS_FS_PIPE_MAX,	/* /proc/sys/fs/pipe-max-size	*/
+	LXPR_SYS_KERNELDIR,	/* /proc/sys/kernel/	*/
+	LXPR_SYS_KERNEL_CAPLCAP,	/* /proc/sys/kernel/cap_last_cap */
+	LXPR_SYS_KERNEL_COREPATT,	/* /proc/sys/kernel/core_pattern */
+	LXPR_SYS_KERNEL_HOSTNAME,	/* /proc/sys/kernel/hostname */
+	LXPR_SYS_KERNEL_MSGMAX,	/* /proc/sys/kernel/msgmax */
+	LXPR_SYS_KERNEL_MSGMNB,	/* /proc/sys/kernel/msgmnb */
+	LXPR_SYS_KERNEL_MSGMNI,	/* /proc/sys/kernel/msgmni */
+	LXPR_SYS_KERNEL_NGROUPS_MAX,	/* /proc/sys/kernel/ngroups_max */
+	LXPR_SYS_KERNEL_OSREL,	/* /proc/sys/kernel/osrelease */
+	LXPR_SYS_KERNEL_PID_MAX,	/* /proc/sys/kernel/pid_max */
+	LXPR_SYS_KERNEL_RANDDIR,	/* /proc/sys/kernel/random */
+	LXPR_SYS_KERNEL_RAND_BOOTID, /* /proc/sys/kernel/random/boot_id */
+	LXPR_SYS_KERNEL_RAND_ENTAVL, /* /proc/sys/kernel/random/entropy_avail */
+	LXPR_SYS_KERNEL_SEM,		/* /proc/sys/kernel/sem		*/
+	LXPR_SYS_KERNEL_SHMALL,		/* /proc/sys/kernel/shmall	*/
+	LXPR_SYS_KERNEL_SHMMAX,		/* /proc/sys/kernel/shmmax	*/
+	LXPR_SYS_KERNEL_SHMMNI,		/* /proc/sys/kernel/shmmni	*/
+	LXPR_SYS_KERNEL_THREADS_MAX,	/* /proc/sys/kernel/threads-max */
+	LXPR_SYS_NETDIR,		/* /proc/sys/net		*/
+	LXPR_SYS_NET_COREDIR,		/* /proc/sys/net/core		*/
+	LXPR_SYS_NET_CORE_SOMAXCON,	/* /proc/sys/net/core/somaxconn	*/
+	LXPR_SYS_NET_IPV4DIR,		/* /proc/sys/net/ipv4		*/
+	LXPR_SYS_NET_IPV4_ICMP_EIB,	/* .../icmp_echo_ignore_broadcasts */
+	LXPR_SYS_NET_IPV4_IP_FORWARD,	/* .../net/ipv4/ip_forward */
+	LXPR_SYS_NET_IPV4_IP_LPORT_RANGE, /* .../net/ipv4/ip_local_port_range */
+	LXPR_SYS_NET_IPV4_TCP_FIN_TO,	/* /proc/sys/net/ipv4/tcp_fin_timeout */
+	LXPR_SYS_NET_IPV4_TCP_KA_INT,	/* .../net/ipv4/tcp_keepalive_intvl */
+	LXPR_SYS_NET_IPV4_TCP_KA_TIM,	/* .../net/ipv4/tcp_keepalive_time */
+	LXPR_SYS_NET_IPV4_TCP_MAX_SYN_BL, /* .../net/ipv4/tcp_max_syn_backlog */
+	LXPR_SYS_NET_IPV4_TCP_RETRY2,	/* /proc/sys/net/ipv4/tcp_retries2 */
+	LXPR_SYS_NET_IPV4_TCP_RMEM,	/* /proc/sys/net/ipv4/tcp_rmem */
+	LXPR_SYS_NET_IPV4_TCP_SACK,	/* /proc/sys/net/ipv4/tcp_sack */
+	LXPR_SYS_NET_IPV4_TCP_WINSCALE,	/* .../net/ipv4/tcp_window_scaling */
+	LXPR_SYS_NET_IPV4_TCP_WMEM,	/* /proc/sys/net/ipv4/tcp_wmem */
+	LXPR_SYS_VMDIR,			/* /proc/sys/vm			*/
+	LXPR_SYS_VM_DIRTY_BG_BYTES,	/* .../vm/dirty_background_bytes */
+	LXPR_SYS_VM_DIRTY_BG_RATIO,	/* .../vm/dirty_background_ratio */
+	LXPR_SYS_VM_DIRTY_BYTES,	/* /proc/sys/vm/dirty_bytes */
+	LXPR_SYS_VM_DIRTY_EXP_CS,	/* .../vm/dirty_expire_centisecs */
+	LXPR_SYS_VM_DIRTY_RATIO,	/* /proc/sys/vm/dirty_ratio */
+	LXPR_SYS_VM_DIRTYTIME_EXP_SEC,	/* .../vm/dirtytime_expire_seconds */
+	LXPR_SYS_VM_DIRTY_WB_CS,	/* .../vm/dirty_writeback_centisecs */
+	LXPR_SYS_VM_MAX_MAP_CNT,	/* /proc/sys/vm/max_map_count	*/
+	LXPR_SYS_VM_MINFR_KB,		/* /proc/sys/vm/min_free_kbytes	*/
+	LXPR_SYS_VM_NHUGEP,		/* /proc/sys/vm/nr_hugepages	*/
+	LXPR_SYS_VM_OVERCOMMIT_MEM,	/* /proc/sys/vm/overcommit_memory */
+	LXPR_SYS_VM_SWAPPINESS,		/* /proc/sys/vm/swappiness	*/
+	LXPR_UPTIME,		/* /proc/uptime		*/
+	LXPR_VERSION,		/* /proc/version	*/
+	LXPR_VMSTAT,		/* /proc/vmstat		*/
+	LXPR_NFILES		/* number of lx /proc file types */
+} lxpr_nodetype_t;
+
+
+/*
+ * Number of fds allowed for in the inode number calculation
+ * per process (if a process has more fds then inode numbers
+ * may be duplicated)
+ */
+#define	LXPR_FD_PERPROC 2000
+
+/*
+ * Linux sector size for /proc/diskstats
+ */
+#define	LXPR_SECTOR_SIZE	512
+
+/*
+ * external dirent characteristics
+ */
+typedef struct {
+	lxpr_nodetype_t	d_type;
+	char		*d_name;
+} lxpr_dirent_t;
+
+/*
+ * This is the lxprocfs private data object
+ * which is attached to v_data in the vnode structure
+ */
+typedef struct lxpr_node {
+	lxpr_nodetype_t	lxpr_type;	/* type of this node 		*/
+	vnode_t		*lxpr_vnode;	/* vnode for the node		*/
+	vnode_t		*lxpr_parent;	/* parent directory		*/
+	vnode_t		*lxpr_realvp;	/* real vnode, file in dirs	*/
+	timestruc_t	lxpr_time;	/* creation etc time for file	*/
+	mode_t		lxpr_mode;	/* file mode bits		*/
+	uid_t		lxpr_uid;	/* file owner			*/
+	gid_t		lxpr_gid;	/* file group owner		*/
+	pid_t		lxpr_pid;	/* pid of proc referred to	*/
+	uint_t		lxpr_desc;	/* addl. descriptor (fd or tid)	*/
+	ino_t		lxpr_ino;	/* node id 			*/
+} lxpr_node_t;
+
+struct zone;    /* forward declaration */
+
+/*
+ * This is the lxprocfs private data object
+ * which is attached to vfs_data in the vfs structure
+ */
+typedef struct lxpr_mnt {
+	lxpr_node_t	*lxprm_node;	/* node at root of proc mount */
+	struct zone	*lxprm_zone;	/* zone for this mount */
+	ldi_ident_t	lxprm_li;	/* ident for ldi */
+} lxpr_mnt_t;
+
+extern vnodeops_t	*lxpr_vnodeops;
+extern int		nproc_highbit;	/* highbit(v.v_nproc)		*/
+
+typedef struct mounta	mounta_t;
+
+extern void lxpr_initnodecache();
+extern void lxpr_fininodecache();
+extern void lxpr_initrootnode(lxpr_node_t **, vfs_t *);
+extern ino_t lxpr_inode(lxpr_nodetype_t, pid_t, int);
+extern ino_t lxpr_parentinode(lxpr_node_t *);
+extern boolean_t lxpr_is_writable(lxpr_nodetype_t);
+extern lxpr_node_t *lxpr_getnode(vnode_t *, lxpr_nodetype_t, proc_t *, int);
+extern void lxpr_freenode(lxpr_node_t *);
+extern vnode_t *lxpr_lookup_fdnode(vnode_t *, const char *);
+extern int lxpr_readlink_fdnode(lxpr_node_t *, char *, size_t);
+
+typedef struct lxpr_uiobuf {
+	uio_t *uiop;
+	char *buffer;
+	uint32_t buffsize;
+	char *pos;
+	size_t beg;
+	int error;
+} lxpr_uiobuf_t;
+
+extern lxpr_uiobuf_t *lxpr_uiobuf_new(uio_t *);
+extern void lxpr_uiobuf_free(lxpr_uiobuf_t *);
+extern int lxpr_uiobuf_flush(lxpr_uiobuf_t *);
+extern void lxpr_uiobuf_seek(lxpr_uiobuf_t *, offset_t);
+extern boolean_t lxpr_uiobuf_nonblock(lxpr_uiobuf_t *);
+extern void lxpr_uiobuf_write(lxpr_uiobuf_t *, const char *, size_t);
+extern void lxpr_uiobuf_printf(lxpr_uiobuf_t *, const char *, ...);
+extern void lxpr_uiobuf_seterr(lxpr_uiobuf_t *, int);
+
+extern int lxpr_core_path_l2s(const char *, char *, size_t);
+extern int lxpr_core_path_s2l(const char *, char *, size_t);
+
+typedef enum lxpr_zombok {
+	NO_ZOMB = 0,
+	ZOMB_OK
+} zombok_t;
+
+extern proc_t *lxpr_lock(lxpr_node_t *, zombok_t);
+extern proc_t *lxpr_lock_pid(lxpr_node_t *, pid_t, zombok_t, kthread_t **);
+extern void lxpr_unlock(proc_t *);
+extern netstack_t *lxpr_netstack(lxpr_node_t *);
+extern void lxpr_fixpid(zone_t *, proc_t *, pid_t *, pid_t *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#ifndef islower
+#define	islower(x)	(((unsigned)(x) >= 'a') && ((unsigned)(x) <= 'z'))
+#endif
+#ifndef toupper
+#define	toupper(x)	(islower(x) ? (x) - 'a' + 'A' : (x))
+#endif
+
+#endif /* _LX_PROC_H */
diff --git a/usr/src/uts/common/brand/lx/procfs/lx_prsubr.c b/usr/src/uts/common/brand/lx/procfs/lx_prsubr.c
new file mode 100644
index 0000000000..07dc432329
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/procfs/lx_prsubr.c
@@ -0,0 +1,917 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * lxprsubr.c: Various functions for the /lxproc vnodeops.
+ */
+
+#include <sys/varargs.h>
+
+#include <sys/cpuvar.h>
+#include <sys/mman.h>
+#include <sys/vmsystm.h>
+#include <sys/prsystm.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+
+#include "lx_proc.h"
+
+#define	LXPRCACHE_NAME "lxbpr_cache"
+
+static int lxpr_node_constructor(void *, void *, int);
+static void lxpr_node_destructor(void *, void *);
+
+static kmem_cache_t *lxpr_node_cache;
+
+int lx_pr_bufsize = 4000;
+
+struct lxpr_zfs_ds {
+	list_node_t	ds_link;
+	char		ds_name[MAXPATHLEN];
+	uint64_t	ds_cookie;
+};
+
+struct lxpr_uiobuf *
+lxpr_uiobuf_new(uio_t *uiop)
+{
+	/* Allocate memory for both lxpr_uiobuf and output buffer */
+	int bufsize = lx_pr_bufsize;
+	struct lxpr_uiobuf *uiobuf =
+	    kmem_alloc(sizeof (struct lxpr_uiobuf) + bufsize, KM_SLEEP);
+
+	uiobuf->uiop = uiop;
+	uiobuf->buffer = (char *)&uiobuf[1];
+	uiobuf->buffsize = bufsize;
+	uiobuf->pos = uiobuf->buffer;
+	uiobuf->beg = 0;
+	uiobuf->error = 0;
+
+	return (uiobuf);
+}
+
+void
+lxpr_uiobuf_free(struct lxpr_uiobuf *uiobuf)
+{
+	ASSERT(uiobuf != NULL);
+	ASSERT(uiobuf->pos == uiobuf->buffer);
+
+	kmem_free(uiobuf, sizeof (struct lxpr_uiobuf) + uiobuf->buffsize);
+}
+
+void
+lxpr_uiobuf_seek(struct lxpr_uiobuf *uiobuf, offset_t offset)
+{
+	uiobuf->uiop->uio_offset = (off_t)offset;
+}
+
+boolean_t
+lxpr_uiobuf_nonblock(struct lxpr_uiobuf *uiobuf)
+{
+	if ((uiobuf->uiop->uio_fmode & FNONBLOCK) != 0)
+		return (B_TRUE);
+	return (B_FALSE);
+}
+
+void
+lxpr_uiobuf_seterr(struct lxpr_uiobuf *uiobuf, int err)
+{
+	ASSERT(uiobuf->error == 0);
+
+	uiobuf->error = err;
+}
+
+int
+lxpr_uiobuf_flush(struct lxpr_uiobuf *uiobuf)
+{
+	off_t off = uiobuf->uiop->uio_offset;
+	caddr_t uaddr = uiobuf->buffer;
+	size_t beg = uiobuf->beg;
+	size_t size = (uintptr_t)uiobuf->pos - (uintptr_t)uaddr;
+
+	if (uiobuf->error == 0 && uiobuf->uiop->uio_resid != 0) {
+		ASSERT(off >= beg);
+
+		if (beg + size > off && off >= 0)
+			uiobuf->error =
+			    uiomove(uaddr + (off - beg), size - (off - beg),
+			    UIO_READ, uiobuf->uiop);
+
+		uiobuf->beg += size;
+	}
+
+	uiobuf->pos = uaddr;
+
+	return (uiobuf->error);
+}
+
+void
+lxpr_uiobuf_write(struct lxpr_uiobuf *uiobuf, const char *buf, size_t size)
+{
+	/* While we can still carry on */
+	while (uiobuf->error == 0 && uiobuf->uiop->uio_resid != 0) {
+		uintptr_t remain = (uintptr_t)uiobuf->buffsize -
+		    ((uintptr_t)uiobuf->pos - (uintptr_t)uiobuf->buffer);
+
+		/* Enough space in buffer? */
+		if (remain >= size) {
+			bcopy(buf, uiobuf->pos, size);
+			uiobuf->pos += size;
+			return;
+		}
+
+		/* Not enough space, so copy all we can and try again */
+		bcopy(buf, uiobuf->pos, remain);
+		uiobuf->pos += remain;
+		(void) lxpr_uiobuf_flush(uiobuf);
+		buf += remain;
+		size -= remain;
+	}
+}
+
+#define	TYPBUFFSIZE 256
+
+void
+lxpr_uiobuf_printf(struct lxpr_uiobuf *uiobuf, const char *fmt, ...)
+{
+	va_list args;
+	char buff[TYPBUFFSIZE];
+	int len;
+	char *buffer;
+
+	/* Can we still do any output */
+	if (uiobuf->error != 0 || uiobuf->uiop->uio_resid == 0)
+		return;
+
+	va_start(args, fmt);
+
+	/* Try using stack allocated buffer */
+	len = vsnprintf(buff, TYPBUFFSIZE, fmt, args);
+	if (len < TYPBUFFSIZE) {
+		va_end(args);
+		lxpr_uiobuf_write(uiobuf, buff, len);
+		return;
+	}
+
+	/* Not enough space in pre-allocated buffer */
+	buffer = kmem_alloc(len + 1, KM_SLEEP);
+
+	/*
+	 * We know we allocated the correct amount of space
+	 * so no check on the return value
+	 */
+	(void) vsnprintf(buffer, len+1, fmt, args);
+	lxpr_uiobuf_write(uiobuf, buffer, len);
+	va_end(args);
+	kmem_free(buffer, len+1);
+}
+
+/*
+ * Lookup process, potentially constrained by pid associated with lxpr_node and
+ * return with p_lock and P_PR_LOCK held.
+ */
+proc_t *
+lxpr_lock_pid(lxpr_node_t *lxpnp, pid_t pid, zombok_t zombie_ok,
+    kthread_t **tp)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	proc_t *p;
+	kthread_t *t;
+	lx_pid_flag_t flags = LXP_PRLOCK;
+
+	ASSERT(!MUTEX_HELD(&pidlock));
+
+	/* Consider zsched to be invisible to LX */
+	if (pid == zone->zone_zsched->p_pid) {
+		return (NULL);
+	}
+	if (zombie_ok == ZOMB_OK) {
+		flags |= LXP_ZOMBOK;
+	}
+
+retry:
+	if (lx_lpid_lock(pid, zone, flags, &p, &t) != 0) {
+		return (NULL);
+	}
+
+	/*
+	 * Make sure that thread lookups (where non-main LX threads are
+	 * assigned a pid not equal to the encompassing parent) match the pid
+	 * of the encompasing directory.  This must be performed carefully for
+	 * the Linux pid 1 as it will not equal the native pid despite the
+	 * process matching.
+	 *
+	 * This is necessary to constrain paths such as /proc/<pid>/task/<tid>.
+	 */
+	if (lxpnp->lxpr_pid != 0 && lxpnp->lxpr_pid != pid &&
+	    !(pid == 1 && lxpnp->lxpr_pid == zone->zone_proc_initpid)) {
+		klwp_t *lwp;
+		lx_lwp_data_t *lwpd;
+
+		/*
+		 * Only LWPs of branded processes will be accessible this way.
+		 * The threads of native processes lack pid assignments which
+		 * LX uses to emulate Linux's weird thread/process model.
+		 */
+		if ((lwp = ttolwp(t)) == NULL ||
+		    (lwpd = lwptolxlwp(lwp)) == NULL ||
+		    lwpd->br_pid != pid) {
+			sprunlock(p);
+			return (NULL);
+		}
+	}
+
+	if (zombie_ok == NO_ZOMB &&
+	    ((p->p_flag & SEXITING) || p->p_stat == SZOMB)) {
+		sprunlock(p);
+		return (NULL);
+	}
+
+	/*
+	 * Accessing a process which is undergoing exec(2) is somewhat risky.
+	 * In particular, the p_exec field is updated outside p_lock.  To avoid
+	 * this mess, access is denied when P_PR_EXEC set unless the caller
+	 * happens to be the process itself.  This allows actions such as
+	 * re-exec()-ing /proc/<pid>/exe to make forward progress.
+	 *
+	 * All other callers must block until the flag is cleared.
+	 */
+	if ((p->p_proc_flag & P_PR_EXEC) != 0) {
+		if (p != curproc) {
+			kmutex_t *mp;
+
+			/*
+			 * Drop PR_LOCK and wait for the exec() to ping the CV
+			 * once it has completed.  Afterward, the pid is looked
+			 * up again in case the process exited for some reason.
+			 */
+			mp = &p->p_lock;
+			sprunprlock(p);
+			cv_wait(&pr_pid_cv[p->p_slot], mp);
+			mutex_exit(mp);
+			goto retry;
+		}
+	}
+
+	if (tp != NULL) {
+		*tp = t;
+	}
+	return (p);
+}
+
+netstack_t *
+lxpr_netstack(lxpr_node_t *lxpnp)
+{
+	return (netstack_hold_if_active(LXPTOZ(lxpnp)->zone_netstack));
+}
+
+/*
+ * Lookup process from pid associated with lxpr_node and return with p_lock and
+ * P_PR_LOCK held.
+ */
+proc_t *
+lxpr_lock(lxpr_node_t *lxpnp, zombok_t zombie_ok)
+{
+	return (lxpr_lock_pid(lxpnp, lxpnp->lxpr_pid, zombie_ok, NULL));
+}
+
+void
+lxpr_fixpid(zone_t *zone, proc_t *p, pid_t *pidp, pid_t *ppidp)
+{
+	pid_t pid = p->p_pid;
+	pid_t ppid = p->p_ppid;
+
+	ASSERT(p != NULL);
+	ASSERT(pidp != NULL);
+	ASSERT(zone->zone_brand == &lx_brand);
+	ASSERT(pid != zone->zone_zsched->p_pid);
+
+	if (pid == zone->zone_proc_initpid) {
+		pid = 1;
+		ppid = 0;	/* parent pid for init is 0 */
+	} else {
+		if (ppid == zone->zone_proc_initpid) {
+			/*
+			 * Convert ppid to the Linux default of 1 if our parent
+			 * is the zone's init process
+			 */
+			ppid = 1;
+		} else if (ppid == zone->zone_zsched->p_pid ||
+		    (p->p_flag & SZONETOP) != 0) {
+			/*
+			 * Additionally, if the process has no valid parent
+			 * inside the zone (or its parent is zsched), lie and
+			 * claim init as the parent.
+			 */
+			ppid = 1;
+		}
+	}
+
+	*pidp = pid;
+	if (ppidp != NULL) {
+		*ppidp = ppid;
+	}
+}
+
+/*
+ * lxpr_unlock()
+ *
+ * Unlock locked process
+ */
+void
+lxpr_unlock(proc_t *p)
+{
+	ASSERT(p->p_proc_flag & P_PR_LOCK);
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	ASSERT(!MUTEX_HELD(&pidlock));
+
+	cv_signal(&pr_pid_cv[p->p_slot]);
+	p->p_proc_flag &= ~P_PR_LOCK;
+	mutex_exit(&p->p_lock);
+	THREAD_KPRI_RELEASE();
+}
+
+void
+lxpr_initnodecache()
+{
+	lxpr_node_cache = kmem_cache_create(LXPRCACHE_NAME,
+	    sizeof (lxpr_node_t), 0,
+	    lxpr_node_constructor, lxpr_node_destructor, NULL, NULL, NULL, 0);
+}
+
+void
+lxpr_fininodecache()
+{
+	kmem_cache_destroy(lxpr_node_cache);
+}
+
+/* ARGSUSED */
+static int
+lxpr_node_constructor(void *buf, void *un, int kmflags)
+{
+	lxpr_node_t	*lxpnp = buf;
+	vnode_t		*vp;
+
+	vp = lxpnp->lxpr_vnode = vn_alloc(kmflags);
+	if (vp == NULL)
+		return (-1);
+
+	(void) vn_setops(vp, lxpr_vnodeops);
+	vp->v_data = lxpnp;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+lxpr_node_destructor(void *buf, void *un)
+{
+	lxpr_node_t	*lxpnp = buf;
+
+	vn_free(LXPTOV(lxpnp));
+}
+
+/*
+ * Calculate an inode number
+ *
+ * This takes various bits of info and munges them
+ * to give the inode number for an lxproc node
+ */
+ino_t
+lxpr_inode(lxpr_nodetype_t type, pid_t pid, int desc)
+{
+	switch (type) {
+	case LXPR_PIDDIR:
+		return (maxpid + pid + 1);
+	case LXPR_PID_TASK_IDDIR:
+		return (maxpid + (desc * 10));
+	case LXPR_PROCDIR:
+		return (maxpid + 2);
+	case LXPR_PID_FD_FD:
+		return (maxpid + 2 +
+		    (pid * (LXPR_FD_PERPROC + LXPR_NFILES)) +
+		    LXPR_NFILES + desc);
+	default:
+		return (maxpid + 2 +
+		    (pid * (LXPR_FD_PERPROC + LXPR_NFILES)) +
+		    type);
+	}
+}
+
+/*
+ * Return inode number of parent (directory)
+ */
+ino_t
+lxpr_parentinode(lxpr_node_t *lxpnp)
+{
+	/*
+	 * If the input node is the root then the parent inode
+	 * is the mounted on inode so just return our inode number
+	 */
+	if (lxpnp->lxpr_type != LXPR_PROCDIR)
+		return (VTOLXP(lxpnp->lxpr_parent)->lxpr_ino);
+	else
+		return (lxpnp->lxpr_ino);
+}
+
+/*
+ * Allocate a new lxproc node
+ *
+ * This also allocates the vnode associated with it
+ */
+lxpr_node_t *
+lxpr_getnode(vnode_t *dp, lxpr_nodetype_t type, proc_t *p, int desc)
+{
+	lxpr_node_t *lxpnp;
+	vnode_t *vp;
+	user_t *up;
+	timestruc_t now;
+
+	/*
+	 * Allocate a new node. It is deallocated in vop_inactive
+	 */
+	lxpnp = kmem_cache_alloc(lxpr_node_cache, KM_SLEEP);
+
+	/*
+	 * Set defaults (may be overridden below)
+	 */
+	gethrestime(&now);
+	lxpnp->lxpr_type = type;
+	lxpnp->lxpr_realvp = NULL;
+	lxpnp->lxpr_parent = dp;
+	lxpnp->lxpr_desc = desc;
+	VN_HOLD(dp);
+	if (p != NULL) {
+		lxpr_node_t *dlxpnp = VTOLXP(dp);
+
+		lxpnp->lxpr_pid = p->p_pid;
+		/* Propagate the tid whenever possible. */
+		if (desc == 0 && dlxpnp->lxpr_desc != 0) {
+			lxpnp->lxpr_desc = dlxpnp->lxpr_desc;
+		}
+		lxpnp->lxpr_time = PTOU(p)->u_start;
+		lxpnp->lxpr_uid = crgetruid(p->p_cred);
+		lxpnp->lxpr_gid = crgetrgid(p->p_cred);
+		lxpnp->lxpr_ino = lxpr_inode(type, p->p_pid, desc);
+	} else {
+		/* Pretend files without a proc belong to sched */
+		lxpnp->lxpr_pid = 0;
+		lxpnp->lxpr_time = now;
+		lxpnp->lxpr_uid = lxpnp->lxpr_gid = 0;
+		lxpnp->lxpr_ino = lxpr_inode(type, 0, 0);
+	}
+
+	/* initialize the vnode data */
+	vp = lxpnp->lxpr_vnode;
+	vn_reinit(vp);
+	vp->v_flag = VNOCACHE|VNOMAP|VNOSWAP|VNOMOUNT;
+	vp->v_vfsp = dp->v_vfsp;
+
+	/*
+	 * Do node specific stuff
+	 */
+	if (lxpr_is_writable(type)) {
+		/* These two have different modes; handled later. */
+		if (type != LXPR_PID_FD_FD && type != LXPR_PID_TID_FD_FD) {
+			vp->v_type = VREG;
+			lxpnp->lxpr_mode = 0644;
+			return (lxpnp);
+		}
+	}
+
+	switch (type) {
+	case LXPR_PROCDIR:
+		vp->v_flag |= VROOT;
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0555;	/* read-search by everyone */
+		break;
+
+	case LXPR_PID_CURDIR:
+		ASSERT(p != NULL);
+
+		/*
+		 * Zombie check.  p_stat is officially protected by pidlock,
+		 * but we can't grab pidlock here because we already hold
+		 * p_lock.  Luckily if we look at the process exit code
+		 * we see that p_stat only transisions from SRUN to SZOMB
+		 * while p_lock is held.  Aside from this, the only other
+		 * p_stat transition that we need to be aware about is
+		 * SIDL to SRUN, but that's not a problem since lxpr_lock()
+		 * ignores nodes in the SIDL state so we'll never get a node
+		 * that isn't already in the SRUN state.
+		 */
+		if (p->p_stat == SZOMB || (p->p_flag & SEXITING) != 0) {
+			lxpnp->lxpr_realvp = NULL;
+		} else {
+			ASSERT(MUTEX_HELD(&p->p_lock));
+			up = PTOU(p);
+			lxpnp->lxpr_realvp = up->u_cdir;
+			ASSERT(lxpnp->lxpr_realvp != NULL);
+			VN_HOLD(lxpnp->lxpr_realvp);
+		}
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;	/* anyone does anything ! */
+		break;
+
+	case LXPR_PID_ROOTDIR:
+		ASSERT(p != NULL);
+		/* Zombie check.  see locking comment above */
+		if (p->p_stat == SZOMB || (p->p_flag & SEXITING) != 0) {
+			lxpnp->lxpr_realvp = NULL;
+		} else {
+			ASSERT(MUTEX_HELD(&p->p_lock));
+			up = PTOU(p);
+			lxpnp->lxpr_realvp =
+			    up->u_rdir != NULL ? up->u_rdir : rootdir;
+			ASSERT(lxpnp->lxpr_realvp != NULL);
+			VN_HOLD(lxpnp->lxpr_realvp);
+		}
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;	/* anyone does anything ! */
+		break;
+
+	case LXPR_PID_EXE:
+		ASSERT(p != NULL);
+		lxpnp->lxpr_realvp = p->p_exec;
+		if (lxpnp->lxpr_realvp != NULL) {
+			VN_HOLD(lxpnp->lxpr_realvp);
+		}
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;
+		break;
+
+	case LXPR_SELF:
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;	/* anyone does anything ! */
+		break;
+
+	case LXPR_PID_TASKDIR:
+		ASSERT(p != NULL);
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0555;	/* read-search by everyone */
+		break;
+
+	case LXPR_PID_TASK_IDDIR:
+		ASSERT(p != NULL);
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0555;	/* read-search by everyone */
+		break;
+
+	case LXPR_PID_FD_FD:
+	case LXPR_PID_TID_FD_FD:
+		ASSERT(p != NULL);
+		/* lxpr_realvp is set after we return */
+		lxpnp->lxpr_mode = 0700;	/* read-write-exe owner only */
+		vp->v_type = VLNK;
+		break;
+
+	case LXPR_PID_FDDIR:
+	case LXPR_PID_TID_FDDIR:
+		ASSERT(p != NULL);
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0500;	/* read-search by owner only */
+		break;
+
+	case LXPR_PIDDIR:
+		ASSERT(p != NULL);
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0511;
+		break;
+
+	case LXPR_NETDIR:
+	case LXPR_SYSDIR:
+	case LXPR_SYS_FSDIR:
+	case LXPR_SYS_FS_INOTIFYDIR:
+	case LXPR_SYS_KERNELDIR:
+	case LXPR_SYS_KERNEL_RANDDIR:
+	case LXPR_SYS_NETDIR:
+	case LXPR_SYS_NET_COREDIR:
+	case LXPR_SYS_NET_IPV4DIR:
+	case LXPR_SYS_VMDIR:
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0555;	/* read-search by all */
+		break;
+
+	case LXPR_PID_AUXV:
+	case LXPR_PID_PERSONALITY:
+	case LXPR_PID_ENV:
+	case LXPR_PID_MEM:
+		ASSERT(p != NULL);
+		/*FALLTHRU*/
+	case LXPR_KCORE:
+		vp->v_type = VREG;
+		lxpnp->lxpr_mode = 0400;	/* read-only by owner only */
+		break;
+
+	default:
+		vp->v_type = VREG;
+		lxpnp->lxpr_mode = 0444;	/* read-only by all */
+		break;
+	}
+
+	return (lxpnp);
+}
+
+
+/*
+ * Free the storage obtained from lxpr_getnode().
+ */
+void
+lxpr_freenode(lxpr_node_t *lxpnp)
+{
+	ASSERT(lxpnp != NULL);
+	ASSERT(LXPTOV(lxpnp) != NULL);
+
+	/*
+	 * delete any association with realvp
+	 */
+	if (lxpnp->lxpr_realvp != NULL)
+		VN_RELE(lxpnp->lxpr_realvp);
+
+	/*
+	 * delete any association with parent vp
+	 */
+	if (lxpnp->lxpr_parent != NULL)
+		VN_RELE(lxpnp->lxpr_parent);
+
+	/*
+	 * Release the lxprnode.
+	 */
+	kmem_cache_free(lxpr_node_cache, lxpnp);
+}
+
+/*
+ * Attempt to locate vnode for /proc/<pid>/fd/<#>.
+ */
+vnode_t *
+lxpr_lookup_fdnode(vnode_t *dvp, const char *name)
+{
+	lxpr_node_t *lxdp = VTOLXP(dvp);
+	lxpr_node_t *lxfp;
+	char *endptr = NULL;
+	long num;
+	int fd;
+	proc_t *p;
+	vnode_t *vp = NULL;
+	file_t *fp;
+	uf_entry_t *ufp;
+	uf_info_t *fip;
+
+	ASSERT(lxdp->lxpr_type == LXPR_PID_FDDIR ||
+	    lxdp->lxpr_type == LXPR_PID_TID_FDDIR);
+
+	if (ddi_strtol(name, &endptr, 10, &num) != 0) {
+		return (NULL);
+	} else if (name[0] < '0' || name[0] > '9' || *endptr != '\0') {
+		/*
+		 * ddi_strtol allows leading spaces and trailing garbage
+		 * We do not tolerate such foolishness.
+		 */
+		return (NULL);
+	} else if ((fd = (int)num) < 0) {
+		return (NULL);
+	}
+
+	/* Lock the owner process */
+	if ((p = lxpr_lock(lxdp, NO_ZOMB)) == NULL) {
+		return (NULL);
+	}
+
+	/* Not applicable to processes which are system-owned. */
+	if (p->p_as == &kas) {
+		lxpr_unlock(p);
+		return (NULL);
+	}
+
+	lxfp = lxpr_getnode(dvp, LXPR_PID_FD_FD, p, fd);
+
+	/*
+	 * Drop p_lock, but keep the process P_PR_LOCK'd to prevent it from
+	 * going away while we dereference into fi_list.
+	 */
+	fip = P_FINFO(p);
+	mutex_exit(&p->p_lock);
+	mutex_enter(&fip->fi_lock);
+	if (fd < fip->fi_nfiles) {
+		UF_ENTER(ufp, fip, fd);
+		if ((fp = ufp->uf_file) != NULL) {
+			vp = fp->f_vnode;
+			VN_HOLD(vp);
+		}
+		UF_EXIT(ufp);
+	}
+	mutex_exit(&fip->fi_lock);
+
+	if (vp == NULL) {
+		mutex_enter(&p->p_lock);
+		lxpr_unlock(p);
+		lxpr_freenode(lxfp);
+		return (NULL);
+	} else {
+		/*
+		 * Fill in the lxpr_node so future references will be able to
+		 * find the underlying vnode. The vnode is held on the realvp.
+		 */
+		lxfp->lxpr_realvp = vp;
+
+		/*
+		 * For certain entries (sockets, pipes, etc), Linux expects a
+		 * bogus-named symlink.  If that's the case, report the type as
+		 * VNON to bypass link-following elsewhere in the vfs system.
+		 *
+		 * See lxpr_readlink for more details.
+		 */
+		if (lxpr_readlink_fdnode(lxfp, NULL, 0) == 0)
+			LXPTOV(lxfp)->v_type = VNON;
+	}
+
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+	ASSERT(LXPTOV(lxfp) != NULL);
+	return (LXPTOV(lxfp));
+}
+
+/*
+ * Attempt to create Linux-proc-style fake symlinks contents for supported
+ * /proc/<pid>/fd/<#> entries.
+ */
+int
+lxpr_readlink_fdnode(lxpr_node_t *lxpnp, char *bp, size_t len)
+{
+	const char *format;
+	vnode_t *rvp = lxpnp->lxpr_realvp;
+	vattr_t attr;
+
+	switch (rvp->v_type) {
+	case VSOCK:
+		format = "socket:[%lu]";
+		break;
+	case VFIFO:
+		format = "pipe:[%lu]";
+		break;
+	default:
+		return (-1);
+	}
+
+	/* Fetch the inode of the underlying vnode */
+	if (VOP_GETATTR(rvp, &attr, 0, CRED(), NULL) != 0)
+		return (-1);
+
+	if (bp != NULL)
+		(void) snprintf(bp, len, format, (ino_t)attr.va_nodeid);
+	return (0);
+}
+
+/*
+ * Translate a Linux core_pattern path to a native Illumos one, by replacing
+ * the appropriate % escape sequences.
+ *
+ * Any % escape sequences that are not recognised are double-escaped so that
+ * they will be inserted literally into the path (to mimic Linux).
+ */
+int
+lxpr_core_path_l2s(const char *inp, char *outp, size_t outsz)
+{
+	int i = 0, j = 0;
+	char x;
+
+	while (j < outsz - 1) {
+		x = inp[i++];
+		if (x == '\0')
+			break;
+		if (x != '%') {
+			outp[j++] = x;
+			continue;
+		}
+
+		x = inp[i++];
+		if (x == '\0')
+			break;
+
+		/* Make sure we have enough space in the output buffer. */
+		if (j + 2 >= outsz - 1)
+			return (EINVAL);
+
+		switch (x) {
+		case 'E':
+			if (j + 4 >= outsz - 1)
+				return (EINVAL);
+			outp[j++] = '%';
+			outp[j++] = 'd';
+			outp[j++] = '%';
+			outp[j++] = 'f';
+			break;
+		case 'e':
+			outp[j++] = '%';
+			outp[j++] = 'f';
+			break;
+		case 'p':
+		case 'g':
+		case 'u':
+		case 't':
+		case '%':
+			outp[j++] = '%';
+			outp[j++] = x;
+			break;
+		case 'h':
+			outp[j++] = '%';
+			outp[j++] = 'n';
+			break;
+		default:
+			/* No translation, make it literal. */
+			if (j + 3 >= outsz - 1)
+				return (EINVAL);
+			outp[j++] = '%';
+			outp[j++] = '%';
+			outp[j++] = x;
+			break;
+		}
+	}
+
+	outp[j] = '\0';
+	return (0);
+}
+
+/*
+ * Translate an Illumos core pattern path back to Linux format.
+ */
+int
+lxpr_core_path_s2l(const char *inp, char *outp, size_t outsz)
+{
+	int i = 0, j = 0;
+	char x;
+
+	while (j < outsz - 1) {
+		x = inp[i++];
+		if (x == '\0')
+			break;
+		if (x != '%') {
+			outp[j++] = x;
+			continue;
+		}
+
+		x = inp[i++];
+		if (x == '\0')
+			break;
+
+		/* Make sure we have enough space in the output buffer. */
+		if (j + 2 >= outsz - 1)
+			return (EINVAL);
+
+		switch (x) {
+		case 'd':
+			/* No Linux equivalent unless it's %d%f. */
+			if (inp[i] == '%' && inp[i + 1] == 'f') {
+				i += 2;
+				outp[j++] = '%';
+				outp[j++] = 'E';
+			}
+			break;
+		case 'f':
+			outp[j++] = '%';
+			outp[j++] = 'e';
+			break;
+		case 'p':
+		case 'P':
+		case 'g':
+		case 'u':
+		case 't':
+		case '%':
+			outp[j++] = '%';
+			outp[j++] = (x == 'P' ? 'p' : x);
+			break;
+		case 'n':
+			outp[j++] = '%';
+			outp[j++] = 'h';
+			break;
+		default:
+			/* No translation. */
+			break;
+		}
+	}
+
+	outp[j] = '\0';
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/procfs/lx_prvfsops.c b/usr/src/uts/common/brand/lx/procfs/lx_prvfsops.c
new file mode 100644
index 0000000000..b4dc5091c2
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/procfs/lx_prvfsops.c
@@ -0,0 +1,377 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * lxprvfsops.c: vfs operations for /lxprocfs.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/debug.h>
+#include <sys/errno.h>
+#include <sys/proc.h>
+#include <sys/stat.h>
+#include <sys/statvfs.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/mode.h>
+#include <sys/signal.h>
+#include <sys/user.h>
+#include <sys/mount.h>
+#include <sys/bitmap.h>
+#include <sys/kmem.h>
+#include <sys/policy.h>
+#include <sys/modctl.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_brand.h>
+
+#include "lx_proc.h"
+
+/* Module level parameters */
+static int	lxprocfstype;
+static dev_t	lxprocdev;
+static kmutex_t	lxpr_mount_lock;
+
+int nproc_highbit;	/* highbit(v.v_nproc) */
+
+static int lxpr_mount(vfs_t *, vnode_t *, mounta_t *, cred_t *);
+static int lxpr_unmount(vfs_t *, int, cred_t *);
+static int lxpr_root(vfs_t *, vnode_t **);
+static int lxpr_statvfs(vfs_t *, statvfs64_t *);
+static int lxpr_init(int, char *);
+
+static vfsdef_t vfw = {
+	VFSDEF_VERSION,
+	"lx_proc",
+	lxpr_init,
+	VSW_ZMOUNT,
+	NULL
+};
+
+/*
+ * Module linkage information for the kernel.
+ */
+extern struct mod_ops mod_fsops;
+
+static struct modlfs modlfs = {
+	&mod_fsops, "lx brand procfs", &vfw
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, (void *)&modlfs, NULL
+};
+
+int
+_init(void)
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int retval;
+
+	/*
+	 * attempt to unload the module
+	 */
+	if ((retval = mod_remove(&modlinkage)) != 0)
+		goto done;
+
+	/*
+	 * destroy lxpr_node cache
+	 */
+	lxpr_fininodecache();
+
+	/*
+	 * clean out the vfsops and vnodeops
+	 */
+	(void) vfs_freevfsops_by_type(lxprocfstype);
+	vn_freevnodeops(lxpr_vnodeops);
+
+	mutex_destroy(&lxpr_mount_lock);
+done:
+	return (retval);
+}
+
+static int
+lxpr_init(int fstype, char *name)
+{
+	static const fs_operation_def_t lxpr_vfsops_template[] = {
+		VFSNAME_MOUNT,		{ .vfs_mount = lxpr_mount },
+		VFSNAME_UNMOUNT,	{ .vfs_unmount = lxpr_unmount },
+		VFSNAME_ROOT,		{ .vfs_root = lxpr_root },
+		VFSNAME_STATVFS,	{ .vfs_statvfs = lxpr_statvfs },
+		NULL,			NULL
+	};
+	extern const fs_operation_def_t lxpr_vnodeops_template[];
+	int error;
+	major_t dev;
+
+	nproc_highbit = highbit(v.v_proc);
+	lxprocfstype = fstype;
+	ASSERT(lxprocfstype != 0);
+
+	mutex_init(&lxpr_mount_lock, NULL, MUTEX_DEFAULT, NULL);
+
+	/*
+	 * Associate VFS ops vector with this fstype.
+	 */
+	error = vfs_setfsops(fstype, lxpr_vfsops_template, NULL);
+	if (error != 0) {
+		cmn_err(CE_WARN, "lxpr_init: bad vfs ops template");
+		return (error);
+	}
+
+	/*
+	 * Set up vnode ops vector too.
+	 */
+	error = vn_make_ops(name, lxpr_vnodeops_template, &lxpr_vnodeops);
+	if (error != 0) {
+		(void) vfs_freevfsops_by_type(fstype);
+		cmn_err(CE_WARN, "lxpr_init: bad vnode ops template");
+		return (error);
+	}
+
+	/*
+	 * Assign a unique "device" number (used by stat(2)).
+	 */
+	if ((dev = getudev()) == (major_t)-1) {
+		cmn_err(CE_WARN, "lxpr_init: can't get unique device number");
+		dev = 0;
+	}
+
+	/*
+	 * Make the pseudo device
+	 */
+	lxprocdev = makedevice(dev, 0);
+
+	/*
+	 * Initialise cache for lxpr_nodes
+	 */
+	lxpr_initnodecache();
+
+	return (0);
+}
+
+static int
+lxpr_mount(vfs_t *vfsp, vnode_t *mvp, mounta_t *uap, cred_t *cr)
+{
+	lxpr_mnt_t *lxpr_mnt;
+	zone_t *zone = curproc->p_zone;
+	ldi_ident_t li;
+	int err;
+
+	/*
+	 * must be root to mount
+	 */
+	if (secpolicy_fs_mount(cr, mvp, vfsp) != 0)
+		return (EPERM);
+
+	/*
+	 * mount point must be a directory
+	 */
+	if (mvp->v_type != VDIR)
+		return (ENOTDIR);
+
+	/*
+	 * Mounting lx_proc is not allowed outside an LX zone.
+	 */
+	if (zone->zone_brand != &lx_brand) {
+		return (ENOTSUP);
+	}
+
+	/*
+	 * Having the resource be anything but "lxproc" doesn't make sense
+	 */
+	vfs_setresource(vfsp, "lxproc", 0);
+
+	lxpr_mnt = kmem_alloc(sizeof (*lxpr_mnt), KM_SLEEP);
+
+	if ((err = ldi_ident_from_mod(&modlinkage, &li)) != 0) {
+		kmem_free(lxpr_mnt, sizeof (*lxpr_mnt));
+		return (err);
+	}
+	lxpr_mnt->lxprm_li = li;
+
+	mutex_enter(&lxpr_mount_lock);
+
+	/*
+	 * Ensure we don't allow overlaying mounts
+	 */
+	mutex_enter(&mvp->v_lock);
+	if ((uap->flags & MS_OVERLAY) == 0 &&
+	    (mvp->v_count > 1 || (mvp->v_flag & VROOT))) {
+		mutex_exit(&mvp->v_lock);
+		mutex_exit(&lxpr_mount_lock);
+		kmem_free(lxpr_mnt, sizeof ((*lxpr_mnt)));
+		return (EBUSY);
+	}
+	mutex_exit(&mvp->v_lock);
+
+	/*
+	 * Hold a zone reference for access to the lxzd structure.
+	 */
+	zone_hold(lxpr_mnt->lxprm_zone = zone);
+
+	/*
+	 * Allocate the first vnode and arbitrarily set the parent vnode to the
+	 * mounted over directory
+	 */
+	lxpr_mnt->lxprm_node = lxpr_getnode(mvp, LXPR_PROCDIR, NULL, 0);
+
+	/* Correctly set the fs for the root node */
+	lxpr_mnt->lxprm_node->lxpr_vnode->v_vfsp = vfsp;
+
+	vfs_make_fsid(&vfsp->vfs_fsid, lxprocdev, lxprocfstype);
+	vfsp->vfs_bsize = DEV_BSIZE;
+	vfsp->vfs_fstype = lxprocfstype;
+	vfsp->vfs_data = (caddr_t)lxpr_mnt;
+	vfsp->vfs_dev = lxprocdev;
+
+	mutex_exit(&lxpr_mount_lock);
+
+	return (0);
+}
+
+static int
+lxpr_unmount(vfs_t *vfsp, int flag, cred_t *cr)
+{
+	lxpr_mnt_t *lxpr_mnt = (lxpr_mnt_t *)vfsp->vfs_data;
+	vnode_t *vp;
+	int count;
+
+	ASSERT(lxpr_mnt != NULL);
+	vp = LXPTOV(lxpr_mnt->lxprm_node);
+
+	mutex_enter(&lxpr_mount_lock);
+
+	/*
+	 * must be root to unmount
+	 */
+	if (secpolicy_fs_unmount(cr, vfsp) != 0) {
+		mutex_exit(&lxpr_mount_lock);
+		return (EPERM);
+	}
+
+	/*
+	 * forced unmount is not supported by this file system
+	 */
+	if (flag & MS_FORCE) {
+		mutex_exit(&lxpr_mount_lock);
+		return (ENOTSUP);
+	}
+
+	/*
+	 * Ensure that no vnodes are in use on this mount point.
+	 */
+	mutex_enter(&vp->v_lock);
+	count = vp->v_count;
+	mutex_exit(&vp->v_lock);
+	if (count > 1) {
+		mutex_exit(&lxpr_mount_lock);
+		return (EBUSY);
+	}
+
+
+	/*
+	 * purge the dnlc cache for vnode entries
+	 * associated with this file system
+	 */
+	count = dnlc_purge_vfsp(vfsp, 0);
+
+	/*
+	 * free up the lxprnode
+	 */
+	lxpr_freenode(lxpr_mnt->lxprm_node);
+	zone_rele(lxpr_mnt->lxprm_zone);
+
+	ldi_ident_release(lxpr_mnt->lxprm_li);
+
+	kmem_free(lxpr_mnt, sizeof (*lxpr_mnt));
+
+	mutex_exit(&lxpr_mount_lock);
+
+	return (0);
+}
+
+static int
+lxpr_root(vfs_t *vfsp, vnode_t **vpp)
+{
+	lxpr_node_t *lxpnp = ((lxpr_mnt_t *)vfsp->vfs_data)->lxprm_node;
+	vnode_t *vp = LXPTOV(lxpnp);
+
+	VN_HOLD(vp);
+	*vpp = vp;
+	return (0);
+}
+
+static int
+lxpr_statvfs(vfs_t *vfsp, statvfs64_t *sp)
+{
+	int n;
+	dev32_t d32;
+	extern uint_t nproc;
+
+	n = v.v_proc - nproc;
+
+	bzero((caddr_t)sp, sizeof (*sp));
+	sp->f_bsize	= DEV_BSIZE;
+	sp->f_frsize	= DEV_BSIZE;
+	sp->f_blocks	= (fsblkcnt64_t)0;
+	sp->f_bfree	= (fsblkcnt64_t)0;
+	sp->f_bavail	= (fsblkcnt64_t)0;
+	sp->f_files	= (fsfilcnt64_t)v.v_proc + 2;
+	sp->f_ffree	= (fsfilcnt64_t)n;
+	sp->f_favail	= (fsfilcnt64_t)n;
+	(void) cmpldev(&d32, vfsp->vfs_dev);
+	sp->f_fsid	= d32;
+	/* It is guaranteed that vsw_name will fit in f_basetype */
+	(void) strcpy(sp->f_basetype, vfssw[lxprocfstype].vsw_name);
+	sp->f_flag = vf_to_stf(vfsp->vfs_flag);
+	sp->f_namemax = 64;		/* quite arbitrary */
+	bzero(sp->f_fstr, sizeof (sp->f_fstr));
+
+	/* We know f_fstr is 32 chars */
+	(void) strcpy(sp->f_fstr, "/proc");
+	(void) strcpy(&sp->f_fstr[6], "/proc");
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/procfs/lx_prvnops.c b/usr/src/uts/common/brand/lx/procfs/lx_prvnops.c
new file mode 100644
index 0000000000..15203cee91
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/procfs/lx_prvnops.c
@@ -0,0 +1,8377 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * lx_proc -- a Linux-compatible /proc for the LX brand
+ *
+ * We have -- confusingly -- two implementations of Linux /proc.  One is to
+ * support native (but Linux-borne) programs that wish to view the native
+ * system through the Linux /proc model; the other -- this one -- is to
+ * support Linux binaries via the LX brand.  These two implementations differ
+ * greatly in their aspirations (and their willingness to bend the truth
+ * of the system to accommodate those aspirations); they should not be unified.
+ */
+
+#include <sys/cpupart.h>
+#include <sys/cpuvar.h>
+#include <sys/session.h>
+#include <sys/vmparam.h>
+#include <sys/mman.h>
+#include <vm/rm.h>
+#include <vm/seg_vn.h>
+#include <sys/sdt.h>
+#include <lx_signum.h>
+#include <sys/strlog.h>
+#include <sys/stropts.h>
+#include <sys/cmn_err.h>
+#include <sys/lx_brand.h>
+#include <lx_auxv.h>
+#include <sys/x86_archext.h>
+#include <sys/archsystm.h>
+#include <sys/fp.h>
+#include <sys/pool_pset.h>
+#include <sys/pset.h>
+#include <sys/zone.h>
+#include <sys/fcntl.h>
+#include <sys/pghw.h>
+#include <sys/vfs_opreg.h>
+#include <sys/param.h>
+#include <sys/utsname.h>
+#include <sys/rctl.h>
+#include <sys/kstat.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_types.h>
+#include <sys/lx_userhz.h>
+#include <sys/brand.h>
+#include <sys/cred_impl.h>
+#include <sys/tihdr.h>
+#include <sys/corectl.h>
+#include <sys/rctl_impl.h>
+#include <inet/ip.h>
+#include <inet/ip_ire.h>
+#include <inet/ip6.h>
+#include <inet/ip_if.h>
+#include <inet/tcp.h>
+#include <inet/tcp_impl.h>
+#include <inet/udp_impl.h>
+#include <inet/ipclassifier.h>
+#include <sys/socketvar.h>
+#include <fs/sockfs/socktpi.h>
+#include <sys/random.h>
+
+/* Dependent on procfs */
+extern kthread_t *prchoose(proc_t *);
+extern int prreadargv(proc_t *, char *, size_t, size_t *);
+extern int prreadenvv(proc_t *, char *, size_t, size_t *);
+extern int prreadbuf(proc_t *, uintptr_t, uint8_t *, size_t, size_t *);
+
+#include "lx_proc.h"
+
+extern pgcnt_t swapfs_minfree;
+
+/*
+ * Pointer to the vnode ops vector for this fs.
+ * This is instantiated in lxprinit() in lxpr_vfsops.c
+ */
+vnodeops_t *lxpr_vnodeops;
+
+static int lxpr_open(vnode_t **, int, cred_t *, caller_context_t *);
+static int lxpr_close(vnode_t *, int, int, offset_t, cred_t *,
+    caller_context_t *);
+static int lxpr_create(struct vnode *, char *, struct vattr *, enum vcexcl,
+    int, struct vnode **, struct cred *, int, caller_context_t *, vsecattr_t *);
+static int lxpr_read(vnode_t *, uio_t *, int, cred_t *, caller_context_t *);
+static int lxpr_write(vnode_t *, uio_t *, int, cred_t *, caller_context_t *);
+static int lxpr_space(vnode_t *, int, flock64_t *, int, offset_t, cred_t *,
+    caller_context_t *);
+static int lxpr_setattr(vnode_t *, vattr_t *, int, cred_t *,
+    caller_context_t *);
+static int lxpr_getattr(vnode_t *, vattr_t *, int, cred_t *,
+    caller_context_t *);
+static int lxpr_access(vnode_t *, int, int, cred_t *, caller_context_t *);
+static int lxpr_lookup(vnode_t *, char *, vnode_t **,
+    pathname_t *, int, vnode_t *, cred_t *, caller_context_t *, int *,
+    pathname_t *);
+static int lxpr_readdir(vnode_t *, uio_t *, cred_t *, int *,
+    caller_context_t *, int);
+static int lxpr_readlink(vnode_t *, uio_t *, cred_t *, caller_context_t *);
+static int lxpr_cmp(vnode_t *, vnode_t *, caller_context_t *);
+static int lxpr_realvp(vnode_t *, vnode_t **, caller_context_t *);
+static int lxpr_poll(vnode_t *, short, int, short *, pollhead_t **,
+    caller_context_t *);
+static int lxpr_sync(void);
+static void lxpr_inactive(vnode_t *, cred_t *, caller_context_t *);
+
+static int lxpr_doaccess(lxpr_node_t *, boolean_t, int, int, cred_t *,
+    caller_context_t *);
+
+static vnode_t *lxpr_lookup_procdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_piddir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_not_a_dir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_fddir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_netdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sysdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_fsdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_fs_inotifydir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_kerneldir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_kdir_randdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_netdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_net_coredir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_net_ipv4dir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_sys_vmdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_taskdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_task_tid_dir(vnode_t *, char *);
+
+static int lxpr_readdir_procdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_piddir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_not_a_dir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_fddir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_netdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sysdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_fsdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_fs_inotifydir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_kerneldir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_kdir_randdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_netdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_net_coredir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_net_ipv4dir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_sys_vmdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_taskdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_task_tid_dir(lxpr_node_t *, uio_t *, int *);
+
+static void lxpr_read_invalid(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_empty(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_cgroups(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_cmdline(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_cpuinfo(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_devices(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_diskstats(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_isdir(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_fd(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_filesystems(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_kmsg(lxpr_node_t *, lxpr_uiobuf_t *, ldi_handle_t);
+static void lxpr_read_loadavg(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_meminfo(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_mounts(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_partitions(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_stat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_swaps(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_uptime(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_version(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_vmstat(lxpr_node_t *, lxpr_uiobuf_t *);
+
+static void lxpr_read_pid_auxv(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_cgroup(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_cmdline(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_env(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_id_map(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_limits(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_loginuid(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_maps(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_mountinfo(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_oom_scr_adj(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_personality(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_statm(lxpr_node_t *, lxpr_uiobuf_t *);
+
+static void lxpr_read_pid_tid_comm(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_tid_stat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_tid_status(lxpr_node_t *, lxpr_uiobuf_t *);
+
+static void lxpr_read_net_arp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_dev(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_dev_mcast(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_if_inet6(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_igmp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_ip_mr_cache(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_ip_mr_vif(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_ipv6_route(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_mcfilter(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_netstat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_raw(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_route(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_rpc(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_rt_cache(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_sockstat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_snmp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_stat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_tcp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_tcp6(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_udp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_udp6(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_unix(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_aiomax(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_aionr(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_filemax(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_filenr(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_inotify_max_queued_events(lxpr_node_t *,
+    lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_inotify_max_user_instances(lxpr_node_t *,
+    lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_inotify_max_user_watches(lxpr_node_t *,
+    lxpr_uiobuf_t *);
+static void lxpr_read_sys_fs_pipe_max(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_caplcap(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_corepatt(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_hostname(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_msgmax(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_msgmnb(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_msgmni(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_ngroups_max(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_osrel(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_pid_max(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_rand_bootid(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_rand_entavl(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_sem(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_shmall(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_shmmax(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_shmmni(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_kernel_threads_max(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_core_somaxc(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_icmp_eib(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_ip_forward(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_ip_lport_range(lxpr_node_t *,
+    lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_fin_to(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_ka_int(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_ka_tim(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_max_syn_bl(lxpr_node_t *,
+    lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_retry2(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_rwmem(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_sack(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_net_ipv4_tcp_winscale(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_vm_dirty(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_vm_max_map_cnt(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_vm_minfr_kb(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_vm_nhpages(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_vm_overcommit_mem(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_sys_vm_swappiness(lxpr_node_t *, lxpr_uiobuf_t *);
+
+static int lxpr_write_pid_tid_comm(lxpr_node_t *, uio_t *, cred_t *,
+    caller_context_t *);
+static int lxpr_write_pid_loginuid(lxpr_node_t *, uio_t *, cred_t *,
+    caller_context_t *);
+static int lxpr_write_sys_fs_pipe_max(lxpr_node_t *, uio_t *, cred_t *,
+    caller_context_t *);
+static int lxpr_write_sys_net_core_somaxc(lxpr_node_t *, uio_t *, cred_t *,
+    caller_context_t *);
+static int lxpr_write_sys_net_ipv4_icmp_eib(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_ip_lport_range(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_fin_to(lxpr_node_t *, uio_t *, cred_t *,
+    caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_ka_int(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_ka_tim(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_max_syn_bl(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_retry2(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_rwmem(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_sack(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_net_ipv4_tcp_winscale(lxpr_node_t *, uio_t *,
+    cred_t *, caller_context_t *);
+static int lxpr_write_sys_kernel_corepatt(lxpr_node_t *, uio_t *, cred_t *,
+    caller_context_t *);
+
+/*
+ * Simple conversion
+ */
+#define	btok(x)	((x) >> 10)			/* bytes to kbytes */
+#define	ptok(x)	((x) << (PAGESHIFT - 10))	/* pages to kbytes */
+
+#define	ttolxlwp(t)	((struct lx_lwp_data *)ttolwpbrand(t))
+
+extern rctl_hndl_t rc_process_semmsl;
+extern rctl_hndl_t rc_process_semopm;
+extern rctl_hndl_t rc_zone_semmni;
+extern rctl_hndl_t rc_process_msgmnb;
+
+extern rctl_hndl_t rc_zone_msgmni;
+extern rctl_hndl_t rc_zone_shmmax;
+extern rctl_hndl_t rc_zone_shmmni;
+
+/* From uts/common/crypto/io/swrand.c */
+extern swrand_stats_t swrand_stats;
+
+#define	ONEGB	1073741824ULL
+#define	FOURGB	4294967295ULL
+
+/*
+ * The maximum length of the concatenation of argument vector strings we
+ * will return to the user via the branded procfs. Likewise for the env vector.
+ */
+int lxpr_maxargvlen = 4096;
+int lxpr_maxenvvlen = 4096;
+
+/*
+ * The lx /proc vnode operations vector
+ */
+const fs_operation_def_t lxpr_vnodeops_template[] = {
+	VOPNAME_OPEN,		{ .vop_open = lxpr_open },
+	VOPNAME_CLOSE,		{ .vop_close = lxpr_close },
+	VOPNAME_READ,		{ .vop_read = lxpr_read },
+	VOPNAME_WRITE,		{ .vop_read = lxpr_write },
+	VOPNAME_GETATTR,	{ .vop_getattr = lxpr_getattr },
+	VOPNAME_ACCESS,		{ .vop_access = lxpr_access },
+	VOPNAME_LOOKUP,		{ .vop_lookup = lxpr_lookup },
+	VOPNAME_CREATE,		{ .vop_create = lxpr_create },
+	VOPNAME_READDIR,	{ .vop_readdir = lxpr_readdir },
+	VOPNAME_READLINK,	{ .vop_readlink = lxpr_readlink },
+	VOPNAME_SPACE,		{ .vop_space = lxpr_space },
+	VOPNAME_SETATTR,	{ .vop_setattr = lxpr_setattr },
+	VOPNAME_FSYNC,		{ .error = lxpr_sync },
+	VOPNAME_SEEK,		{ .error = lxpr_sync },
+	VOPNAME_INACTIVE,	{ .vop_inactive = lxpr_inactive },
+	VOPNAME_CMP,		{ .vop_cmp = lxpr_cmp },
+	VOPNAME_REALVP,		{ .vop_realvp = lxpr_realvp },
+	VOPNAME_POLL,		{ .vop_poll = lxpr_poll },
+	NULL,			NULL
+};
+
+
+/*
+ * file contents of an lx /proc directory.
+ */
+static lxpr_dirent_t lx_procdir[] = {
+	{ LXPR_CGROUPS,		"cgroups" },
+	{ LXPR_CMDLINE,		"cmdline" },
+	{ LXPR_CPUINFO,		"cpuinfo" },
+	{ LXPR_DEVICES,		"devices" },
+	{ LXPR_DISKSTATS,	"diskstats" },
+	{ LXPR_DMA,		"dma" },
+	{ LXPR_FILESYSTEMS,	"filesystems" },
+	{ LXPR_INTERRUPTS,	"interrupts" },
+	{ LXPR_IOPORTS,		"ioports" },
+	{ LXPR_KCORE,		"kcore" },
+	{ LXPR_KMSG,		"kmsg" },
+	{ LXPR_LOADAVG,		"loadavg" },
+	{ LXPR_MEMINFO,		"meminfo" },
+	{ LXPR_MODULES,		"modules" },
+	{ LXPR_MOUNTS,		"mounts" },
+	{ LXPR_NETDIR,		"net" },
+	{ LXPR_PARTITIONS,	"partitions" },
+	{ LXPR_SELF,		"self" },
+	{ LXPR_STAT,		"stat" },
+	{ LXPR_SWAPS,		"swaps" },
+	{ LXPR_SYSDIR,		"sys" },
+	{ LXPR_UPTIME,		"uptime" },
+	{ LXPR_VERSION,		"version" },
+	{ LXPR_VMSTAT,		"vmstat" }
+};
+
+#define	PROCDIRFILES	(sizeof (lx_procdir) / sizeof (lx_procdir[0]))
+
+/*
+ * Contents of an lx /proc/<pid> directory.
+ */
+static lxpr_dirent_t piddir[] = {
+	{ LXPR_PID_AUXV,	"auxv" },
+	{ LXPR_PID_CGROUP,	"cgroup" },
+	{ LXPR_PID_CMDLINE,	"cmdline" },
+	{ LXPR_PID_COMM,	"comm" },
+	{ LXPR_PID_CPU,		"cpu" },
+	{ LXPR_PID_CURDIR,	"cwd" },
+	{ LXPR_PID_ENV,		"environ" },
+	{ LXPR_PID_EXE,		"exe" },
+	{ LXPR_PID_GIDMAP,	"gid_map" },
+	{ LXPR_PID_LIMITS,	"limits" },
+	{ LXPR_PID_LOGINUID,	"loginuid" },
+	{ LXPR_PID_MAPS,	"maps" },
+	{ LXPR_PID_MEM,		"mem" },
+	{ LXPR_PID_MOUNTINFO,	"mountinfo" },
+	{ LXPR_PID_MOUNTS,	"mounts" },
+	{ LXPR_PID_OOM_SCR_ADJ,	"oom_score_adj" },
+	{ LXPR_PID_PERSONALITY,	"personality" },
+	{ LXPR_PID_ROOTDIR,	"root" },
+	{ LXPR_PID_STAT,	"stat" },
+	{ LXPR_PID_STATM,	"statm" },
+	{ LXPR_PID_STATUS,	"status" },
+	{ LXPR_PID_TASKDIR,	"task" },
+	{ LXPR_PID_FDDIR,	"fd" },
+	{ LXPR_PID_UIDMAP,	"uid_map" }
+};
+
+#define	PIDDIRFILES	(sizeof (piddir) / sizeof (piddir[0]))
+
+/*
+ * Contents of an lx /proc/<pid>/task/<tid> directory.
+ */
+static lxpr_dirent_t tiddir[] = {
+	{ LXPR_PID_TID_AUXV,	"auxv" },
+	{ LXPR_PID_CGROUP,	"cgroup" },
+	{ LXPR_PID_CMDLINE,	"cmdline" },
+	{ LXPR_PID_TID_COMM,	"comm" },
+	{ LXPR_PID_CPU,		"cpu" },
+	{ LXPR_PID_CURDIR,	"cwd" },
+	{ LXPR_PID_ENV,		"environ" },
+	{ LXPR_PID_EXE,		"exe" },
+	{ LXPR_PID_GIDMAP,	"gid_map" },
+	{ LXPR_PID_LIMITS,	"limits" },
+	{ LXPR_PID_LOGINUID,	"loginuid" },
+	{ LXPR_PID_MAPS,	"maps" },
+	{ LXPR_PID_MEM,		"mem" },
+	{ LXPR_PID_MOUNTINFO,	"mountinfo" },
+	{ LXPR_PID_TID_OOM_SCR_ADJ,	"oom_score_adj" },
+	{ LXPR_PID_PERSONALITY,	"personality" },
+	{ LXPR_PID_ROOTDIR,	"root" },
+	{ LXPR_PID_TID_STAT,	"stat" },
+	{ LXPR_PID_STATM,	"statm" },
+	{ LXPR_PID_TID_STATUS,	"status" },
+	{ LXPR_PID_FDDIR,	"fd" },
+	{ LXPR_PID_UIDMAP,	"uid_map" }
+};
+
+#define	TIDDIRFILES	(sizeof (tiddir) / sizeof (tiddir[0]))
+
+#define	LX_RLIM_INFINITY	0xFFFFFFFFFFFFFFFF
+
+#define	RCTL_INFINITE(x) \
+	((x.rcv_flagaction & RCTL_LOCAL_MAXIMAL) && \
+	(x.rcv_flagaction & RCTL_GLOBAL_INFINITE))
+
+typedef struct lxpr_rlimtab {
+	char	*rlim_name;	/* limit name */
+	char	*rlim_unit;	/* limit unit */
+	char	*rlim_rctl;	/* rctl source */
+} lxpr_rlimtab_t;
+
+static lxpr_rlimtab_t lxpr_rlimtab[] = {
+	{ "Max cpu time",	"seconds",	"process.max-cpu-time" },
+	{ "Max file size",	"bytes",	"process.max-file-size" },
+	{ "Max data size",	"bytes",	"process.max-data-size" },
+	{ "Max stack size",	"bytes",	"process.max-stack-size" },
+	{ "Max core file size",	"bytes",	"process.max-core-size" },
+	{ "Max resident set",	"bytes",	"zone.max-physical-memory" },
+	{ "Max processes",	"processes",	"zone.max-lwps" },
+	{ "Max open files",	"files",	"process.max-file-descriptor" },
+	{ "Max locked memory",	"bytes",	"zone.max-locked-memory" },
+	{ "Max address space",	"bytes",	"process.max-address-space" },
+	{ "Max file locks",	"locks",	NULL },
+	{ "Max pending signals",	"signals",
+		"process.max-sigqueue-size" },
+	{ "Max msgqueue size",	"bytes",	"process.max-msg-messages" }
+};
+
+#define	LX_RLIM_TAB_LEN	(sizeof (lxpr_rlimtab) / sizeof (lxpr_rlimtab[0]))
+
+
+/*
+ * contents of lx /proc/net directory
+ */
+static lxpr_dirent_t netdir[] = {
+	{ LXPR_NET_ARP,		"arp" },
+	{ LXPR_NET_DEV,		"dev" },
+	{ LXPR_NET_DEV_MCAST,	"dev_mcast" },
+	{ LXPR_NET_IF_INET6,	"if_inet6" },
+	{ LXPR_NET_IGMP,	"igmp" },
+	{ LXPR_NET_IP_MR_CACHE,	"ip_mr_cache" },
+	{ LXPR_NET_IP_MR_VIF,	"ip_mr_vif" },
+	{ LXPR_NET_IPV6_ROUTE,	"ipv6_route" },
+	{ LXPR_NET_MCFILTER,	"mcfilter" },
+	{ LXPR_NET_NETSTAT,	"netstat" },
+	{ LXPR_NET_RAW,		"raw" },
+	{ LXPR_NET_ROUTE,	"route" },
+	{ LXPR_NET_RPC,		"rpc" },
+	{ LXPR_NET_RT_CACHE,	"rt_cache" },
+	{ LXPR_NET_SOCKSTAT,	"sockstat" },
+	{ LXPR_NET_SNMP,	"snmp" },
+	{ LXPR_NET_STAT,	"stat" },
+	{ LXPR_NET_TCP,		"tcp" },
+	{ LXPR_NET_TCP6,	"tcp6" },
+	{ LXPR_NET_UDP,		"udp" },
+	{ LXPR_NET_UDP6,	"udp6" },
+	{ LXPR_NET_UNIX,	"unix" }
+};
+
+#define	NETDIRFILES	(sizeof (netdir) / sizeof (netdir[0]))
+
+/*
+ * contents of /proc/sys directory
+ */
+static lxpr_dirent_t sysdir[] = {
+	{ LXPR_SYS_FSDIR,	"fs" },
+	{ LXPR_SYS_KERNELDIR,	"kernel" },
+	{ LXPR_SYS_NETDIR,	"net" },
+	{ LXPR_SYS_VMDIR,	"vm" },
+};
+
+#define	SYSDIRFILES	(sizeof (sysdir) / sizeof (sysdir[0]))
+
+/*
+ * contents of /proc/sys/fs directory
+ */
+static lxpr_dirent_t sys_fsdir[] = {
+	{ LXPR_SYS_FS_AIO_MAX_NR,	"aio-max-nr" },
+	{ LXPR_SYS_FS_AIO_NR,		"aio-nr" },
+	{ LXPR_SYS_FS_FILEMAX,		"file-max" },
+	{ LXPR_SYS_FS_FILENR,		"file-nr" },
+	{ LXPR_SYS_FS_INOTIFYDIR,	"inotify" },
+	{ LXPR_SYS_FS_PIPE_MAX,		"pipe-max-size" },
+};
+
+#define	SYS_FSDIRFILES (sizeof (sys_fsdir) / sizeof (sys_fsdir[0]))
+
+/*
+ * contents of /proc/sys/fs/inotify directory
+ */
+static lxpr_dirent_t sys_fs_inotifydir[] = {
+	{ LXPR_SYS_FS_INOTIFY_MAX_QUEUED_EVENTS,	"max_queued_events" },
+	{ LXPR_SYS_FS_INOTIFY_MAX_USER_INSTANCES,	"max_user_instances" },
+	{ LXPR_SYS_FS_INOTIFY_MAX_USER_WATCHES,		"max_user_watches" },
+};
+
+#define	SYS_FS_INOTIFYDIRFILES \
+	(sizeof (sys_fs_inotifydir) / sizeof (sys_fs_inotifydir[0]))
+
+/*
+ * contents of /proc/sys/kernel directory
+ */
+static lxpr_dirent_t sys_kerneldir[] = {
+	{ LXPR_SYS_KERNEL_CAPLCAP,	"cap_last_cap" },
+	{ LXPR_SYS_KERNEL_COREPATT,	"core_pattern" },
+	{ LXPR_SYS_KERNEL_HOSTNAME,	"hostname" },
+	{ LXPR_SYS_KERNEL_MSGMAX,	"msgmax" },
+	{ LXPR_SYS_KERNEL_MSGMNB,	"msgmnb" },
+	{ LXPR_SYS_KERNEL_MSGMNI,	"msgmni" },
+	{ LXPR_SYS_KERNEL_NGROUPS_MAX,	"ngroups_max" },
+	{ LXPR_SYS_KERNEL_OSREL,	"osrelease" },
+	{ LXPR_SYS_KERNEL_PID_MAX,	"pid_max" },
+	{ LXPR_SYS_KERNEL_RANDDIR,	"random" },
+	{ LXPR_SYS_KERNEL_SEM,		"sem" },
+	{ LXPR_SYS_KERNEL_SHMALL,	"shmall" },
+	{ LXPR_SYS_KERNEL_SHMMAX,	"shmmax" },
+	{ LXPR_SYS_KERNEL_SHMMNI,	"shmmni" },
+	{ LXPR_SYS_KERNEL_THREADS_MAX,	"threads-max" },
+};
+
+#define	SYS_KERNELDIRFILES (sizeof (sys_kerneldir) / sizeof (sys_kerneldir[0]))
+
+/*
+ * contents of /proc/sys/kernel/random directory
+ */
+static lxpr_dirent_t sys_randdir[] = {
+	{ LXPR_SYS_KERNEL_RAND_BOOTID,	"boot_id" },
+	{ LXPR_SYS_KERNEL_RAND_ENTAVL,	"entropy_avail" },
+};
+
+#define	SYS_RANDDIRFILES (sizeof (sys_randdir) / sizeof (sys_randdir[0]))
+
+/*
+ * contents of /proc/sys/net directory
+ */
+static lxpr_dirent_t sys_netdir[] = {
+	{ LXPR_SYS_NET_COREDIR,		"core" },
+	{ LXPR_SYS_NET_IPV4DIR,		"ipv4" },
+};
+
+#define	SYS_NETDIRFILES (sizeof (sys_netdir) / sizeof (sys_netdir[0]))
+
+/*
+ * contents of /proc/sys/net/core directory
+ */
+static lxpr_dirent_t sys_net_coredir[] = {
+	{ LXPR_SYS_NET_CORE_SOMAXCON,	"somaxconn" },
+};
+
+#define	SYS_NET_COREDIRFILES \
+	(sizeof (sys_net_coredir) / sizeof (sys_net_coredir[0]))
+
+/*
+ * contents of /proc/sys/net/ipv4 directory
+ * See the Linux ip(7) & tcp(7) man pages for descriptions and the illumos
+ * ip(7p) & tcp(7p) man pages for the native descriptions.
+ */
+static lxpr_dirent_t sys_net_ipv4dir[] = {
+	{ LXPR_SYS_NET_IPV4_ICMP_EIB,	"icmp_echo_ignore_broadcasts" },
+	{ LXPR_SYS_NET_IPV4_IP_FORWARD, "ip_forward" },
+	{ LXPR_SYS_NET_IPV4_IP_LPORT_RANGE, "ip_local_port_range" },
+	{ LXPR_SYS_NET_IPV4_TCP_FIN_TO,	"tcp_fin_timeout" },
+	{ LXPR_SYS_NET_IPV4_TCP_KA_INT,	"tcp_keepalive_intvl" },
+	{ LXPR_SYS_NET_IPV4_TCP_KA_TIM,	"tcp_keepalive_time" },
+	{ LXPR_SYS_NET_IPV4_TCP_MAX_SYN_BL, "tcp_max_syn_backlog" },
+	{ LXPR_SYS_NET_IPV4_TCP_RETRY2,	"tcp_retries2" },
+	{ LXPR_SYS_NET_IPV4_TCP_RMEM,	"tcp_rmem" },
+	{ LXPR_SYS_NET_IPV4_TCP_SACK,	"tcp_sack" },
+	{ LXPR_SYS_NET_IPV4_TCP_WINSCALE, "tcp_window_scaling" },
+	{ LXPR_SYS_NET_IPV4_TCP_WMEM,	"tcp_wmem" },
+};
+
+#define	SYS_NET_IPV4DIRFILES \
+	(sizeof (sys_net_ipv4dir) / sizeof (sys_net_ipv4dir[0]))
+
+/*
+ * contents of /proc/sys/vm directory
+ */
+static lxpr_dirent_t sys_vmdir[] = {
+	{ LXPR_SYS_VM_DIRTY_BG_BYTES,	"dirty_background_bytes" },
+	{ LXPR_SYS_VM_DIRTY_BG_RATIO,	"dirty_background_ratio" },
+	{ LXPR_SYS_VM_DIRTY_BYTES,	"dirty_bytes" },
+	{ LXPR_SYS_VM_DIRTY_EXP_CS,	"dirty_expire_centisecs" },
+	{ LXPR_SYS_VM_DIRTY_RATIO,	"dirty_ratio" },
+	{ LXPR_SYS_VM_DIRTYTIME_EXP_SEC, "dirtytime_expire_seconds" },
+	{ LXPR_SYS_VM_DIRTY_WB_CS,	"dirty_writeback_centisecs" },
+	{ LXPR_SYS_VM_MAX_MAP_CNT,	"max_map_count" },
+	{ LXPR_SYS_VM_MINFR_KB,		"min_free_kbytes" },
+	{ LXPR_SYS_VM_NHUGEP,		"nr_hugepages" },
+	{ LXPR_SYS_VM_OVERCOMMIT_MEM,	"overcommit_memory" },
+	{ LXPR_SYS_VM_SWAPPINESS,	"swappiness" },
+};
+
+#define	SYS_VMDIRFILES (sizeof (sys_vmdir) / sizeof (sys_vmdir[0]))
+
+/*
+ * Table for standard writable files. Non-standard writable files not in this
+ * table can be handled explicitly as special cases.
+ * This table drives lxpr_is_writable, lxpr_write, and lxpr_create.
+ * Note that the entries LXPR_PID_FD_FD and LXPR_PID_TID_FD_FD exist in the
+ * table both to verify writability and to satisfy opening with O_CREATE.
+ */
+typedef struct wftab {
+	lxpr_nodetype_t	wft_type;	/* file entry type */
+	int		(*wft_wrf)(lxpr_node_t *, struct uio *, cred_t *,
+			    caller_context_t *); /* write function */
+} wftab_t;
+
+static wftab_t wr_tab[] = {
+	{LXPR_PID_COMM, lxpr_write_pid_tid_comm},
+	{LXPR_PID_FD_FD, NULL},
+	{LXPR_PID_LOGINUID, lxpr_write_pid_loginuid},
+	{LXPR_PID_OOM_SCR_ADJ, NULL},
+	{LXPR_PID_TID_COMM, lxpr_write_pid_tid_comm},
+	{LXPR_PID_TID_FD_FD, NULL},
+	{LXPR_PID_TID_OOM_SCR_ADJ, NULL},
+	{LXPR_SYS_FS_FILEMAX, NULL},
+	{LXPR_SYS_KERNEL_COREPATT, lxpr_write_sys_kernel_corepatt},
+	{LXPR_SYS_KERNEL_SHMALL, NULL},
+	{LXPR_SYS_KERNEL_SHMMAX, NULL},
+	{LXPR_SYS_FS_PIPE_MAX, lxpr_write_sys_fs_pipe_max},
+	{LXPR_SYS_NET_CORE_SOMAXCON, lxpr_write_sys_net_core_somaxc},
+	{LXPR_SYS_NET_IPV4_ICMP_EIB, lxpr_write_sys_net_ipv4_icmp_eib},
+	{LXPR_SYS_NET_IPV4_IP_FORWARD, NULL},
+	{LXPR_SYS_NET_IPV4_IP_LPORT_RANGE,
+	    lxpr_write_sys_net_ipv4_ip_lport_range},
+	{LXPR_SYS_NET_IPV4_TCP_FIN_TO, lxpr_write_sys_net_ipv4_tcp_fin_to},
+	{LXPR_SYS_NET_IPV4_TCP_KA_INT, lxpr_write_sys_net_ipv4_tcp_ka_int},
+	{LXPR_SYS_NET_IPV4_TCP_KA_TIM, lxpr_write_sys_net_ipv4_tcp_ka_tim},
+	{LXPR_SYS_NET_IPV4_TCP_MAX_SYN_BL,
+	    lxpr_write_sys_net_ipv4_tcp_max_syn_bl},
+	{LXPR_SYS_NET_IPV4_TCP_RETRY2, lxpr_write_sys_net_ipv4_tcp_retry2},
+	{LXPR_SYS_NET_IPV4_TCP_RMEM, lxpr_write_sys_net_ipv4_tcp_rwmem},
+	{LXPR_SYS_NET_IPV4_TCP_SACK, lxpr_write_sys_net_ipv4_tcp_sack},
+	{LXPR_SYS_NET_IPV4_TCP_WINSCALE, lxpr_write_sys_net_ipv4_tcp_winscale},
+	{LXPR_SYS_NET_IPV4_TCP_WMEM, lxpr_write_sys_net_ipv4_tcp_rwmem},
+	{LXPR_SYS_VM_DIRTY_BG_BYTES, NULL},
+	{LXPR_SYS_VM_DIRTY_BG_RATIO, NULL},
+	{LXPR_SYS_VM_DIRTY_BYTES, NULL},
+	{LXPR_SYS_VM_DIRTY_EXP_CS, NULL},
+	{LXPR_SYS_VM_DIRTY_RATIO, NULL},
+	{LXPR_SYS_VM_DIRTYTIME_EXP_SEC, NULL},
+	{LXPR_SYS_VM_DIRTY_WB_CS, NULL},
+	{LXPR_SYS_VM_OVERCOMMIT_MEM, NULL},
+	{LXPR_SYS_VM_SWAPPINESS, NULL},
+	{LXPR_INVALID, NULL}
+};
+
+/*
+ * Centralized test for the standard writable proc files. Other non-standard
+ * writable files might be handled separately.
+ */
+boolean_t
+lxpr_is_writable(lxpr_nodetype_t type)
+{
+	int i;
+
+	for (i = 0; wr_tab[i].wft_type != LXPR_INVALID; i++) {
+		if (wr_tab[i].wft_type == type)
+			return (B_TRUE);
+	}
+	return (B_FALSE);
+}
+
+/*
+ * lxpr_open(): Vnode operation for VOP_OPEN()
+ */
+static int
+lxpr_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
+{
+	vnode_t		*vp = *vpp;
+	lxpr_node_t	*lxpnp = VTOLXP(vp);
+	lxpr_nodetype_t	type = lxpnp->lxpr_type;
+	vnode_t		*rvp;
+	int		error = 0;
+
+	/* Restrict writes to certain files */
+	if ((flag & FWRITE) && !lxpr_is_writable(type)) {
+		return (EPERM);
+	}
+
+	/*
+	 * If we are opening an underlying file only allow regular files,
+	 * fifos or sockets; reject the open for anything else.
+	 * Just do it if we are opening the current or root directory.
+	 */
+	if (lxpnp->lxpr_realvp != NULL) {
+		rvp = lxpnp->lxpr_realvp;
+
+		if (type == LXPR_PID_FD_FD && rvp->v_type != VREG &&
+		    rvp->v_type != VFIFO && rvp->v_type != VSOCK) {
+			error = EACCES;
+		} else {
+			if (type == LXPR_PID_FD_FD && rvp->v_type == VFIFO) {
+				/*
+				 * This flag lets the fifo open know that
+				 * we're using proc/fd to open a fd which we
+				 * already have open. Otherwise, the fifo might
+				 * reject an open if the other end has closed.
+				 */
+				flag |= FKLYR;
+			}
+			/*
+			 * Need to hold rvp since VOP_OPEN() may release it.
+			 */
+			VN_HOLD(rvp);
+			error = VOP_OPEN(&rvp, flag, cr, ct);
+			if (error) {
+				VN_RELE(rvp);
+			} else {
+				*vpp = rvp;
+				VN_RELE(vp);
+			}
+		}
+	}
+
+	return (error);
+}
+
+
+/*
+ * lxpr_close(): Vnode operation for VOP_CLOSE()
+ */
+/* ARGSUSED */
+static int
+lxpr_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
+    caller_context_t *ct)
+{
+#ifdef DEBUG
+	lxpr_node_t	*lxpr = VTOLXP(vp);
+	lxpr_nodetype_t	type = lxpr->lxpr_type;
+
+	/*
+	 * we should never get here because the close is done on the realvp
+	 * for these nodes
+	 */
+	ASSERT(type != LXPR_PID_FD_FD &&
+	    type != LXPR_PID_CURDIR &&
+	    type != LXPR_PID_ROOTDIR &&
+	    type != LXPR_PID_EXE);
+#endif /* DEBUG */
+
+	return (0);
+}
+
+static void (*lxpr_read_function[LXPR_NFILES])() = {
+	NULL,				/* invalid		*/
+	lxpr_read_isdir,		/* /proc		*/
+	lxpr_read_isdir,		/* /proc/<pid>		*/
+	lxpr_read_pid_auxv,		/* /proc/<pid>/auxv	*/
+	lxpr_read_pid_cgroup,		/* /proc/<pid>/cgroup	*/
+	lxpr_read_pid_cmdline,		/* /proc/<pid>/cmdline	*/
+	lxpr_read_pid_tid_comm,		/* /proc/<pid>/comm	*/
+	lxpr_read_empty,		/* /proc/<pid>/cpu	*/
+	lxpr_read_invalid,		/* /proc/<pid>/cwd	*/
+	lxpr_read_pid_env,		/* /proc/<pid>/environ	*/
+	lxpr_read_invalid,		/* /proc/<pid>/exe	*/
+	lxpr_read_pid_id_map,		/* /proc/<pid>/gid_map	*/
+	lxpr_read_pid_limits,		/* /proc/<pid>/limits	*/
+	lxpr_read_pid_loginuid,		/* /proc/<pid>/loginuid	*/
+	lxpr_read_pid_maps,		/* /proc/<pid>/maps	*/
+	lxpr_read_empty,		/* /proc/<pid>/mem	*/
+	lxpr_read_pid_mountinfo,	/* /proc/<pid>/mountinfo */
+	lxpr_read_mounts,		/* /proc/<pid>/mounts	*/
+	lxpr_read_pid_oom_scr_adj,	/* /proc/<pid>/oom_score_adj */
+	lxpr_read_pid_personality,	/* /proc/<pid>/personality */
+	lxpr_read_invalid,		/* /proc/<pid>/root	*/
+	lxpr_read_pid_tid_stat,		/* /proc/<pid>/stat	*/
+	lxpr_read_pid_statm,		/* /proc/<pid>/statm	*/
+	lxpr_read_pid_tid_status,	/* /proc/<pid>/status	*/
+	lxpr_read_isdir,		/* /proc/<pid>/task	*/
+	lxpr_read_isdir,		/* /proc/<pid>/task/nn	*/
+	lxpr_read_isdir,		/* /proc/<pid>/fd	*/
+	lxpr_read_fd,			/* /proc/<pid>/fd/nn	*/
+	lxpr_read_pid_id_map,		/* /proc/<pid>/uid_map	*/
+	lxpr_read_pid_auxv,		/* /proc/<pid>/task/<tid>/auxv	*/
+	lxpr_read_pid_cgroup,		/* /proc/<pid>/task/<tid>/cgroup */
+	lxpr_read_pid_cmdline,		/* /proc/<pid>/task/<tid>/cmdline */
+	lxpr_read_pid_tid_comm,		/* /proc/<pid>/task/<tid>/comm	*/
+	lxpr_read_empty,		/* /proc/<pid>/task/<tid>/cpu	*/
+	lxpr_read_invalid,		/* /proc/<pid>/task/<tid>/cwd	*/
+	lxpr_read_pid_env,		/* /proc/<pid>/task/<tid>/environ */
+	lxpr_read_invalid,		/* /proc/<pid>/task/<tid>/exe	*/
+	lxpr_read_pid_id_map,		/* /proc/<pid>/task/<tid>/gid_map */
+	lxpr_read_pid_limits,		/* /proc/<pid>/task/<tid>/limits */
+	lxpr_read_pid_loginuid,		/* /proc/<pid>/task/<tid>/loginuid */
+	lxpr_read_pid_maps,		/* /proc/<pid>/task/<tid>/maps	*/
+	lxpr_read_empty,		/* /proc/<pid>/task/<tid>/mem	*/
+	lxpr_read_pid_mountinfo,	/* /proc/<pid>/task/<tid>/mountinfo */
+	lxpr_read_pid_oom_scr_adj,	/* /proc/<pid>/task/<tid>/oom_scr_adj */
+	lxpr_read_pid_personality,	/* /proc/<pid>/task/<tid>/personality */
+	lxpr_read_invalid,		/* /proc/<pid>/task/<tid>/root	*/
+	lxpr_read_pid_tid_stat,		/* /proc/<pid>/task/<tid>/stat	*/
+	lxpr_read_pid_statm,		/* /proc/<pid>/task/<tid>/statm	*/
+	lxpr_read_pid_tid_status,	/* /proc/<pid>/task/<tid>/status */
+	lxpr_read_isdir,		/* /proc/<pid>/task/<tid>/fd	*/
+	lxpr_read_fd,			/* /proc/<pid>/task/<tid>/fd/nn	*/
+	lxpr_read_pid_id_map,		/* /proc/<pid>/task/<tid>/uid_map */
+	lxpr_read_cgroups,		/* /proc/cgroups	*/
+	lxpr_read_cmdline,		/* /proc/cmdline	*/
+	lxpr_read_cpuinfo,		/* /proc/cpuinfo	*/
+	lxpr_read_devices,		/* /proc/devices	*/
+	lxpr_read_diskstats,		/* /proc/diskstats	*/
+	lxpr_read_empty,		/* /proc/dma		*/
+	lxpr_read_filesystems,		/* /proc/filesystems	*/
+	lxpr_read_empty,		/* /proc/interrupts	*/
+	lxpr_read_empty,		/* /proc/ioports	*/
+	lxpr_read_empty,		/* /proc/kcore		*/
+	lxpr_read_invalid,		/* /proc/kmsg -- see lxpr_read() */
+	lxpr_read_loadavg,		/* /proc/loadavg	*/
+	lxpr_read_meminfo,		/* /proc/meminfo	*/
+	lxpr_read_empty,		/* /proc/modules	*/
+	lxpr_read_mounts,		/* /proc/mounts		*/
+	lxpr_read_isdir,		/* /proc/net		*/
+	lxpr_read_net_arp,		/* /proc/net/arp	*/
+	lxpr_read_net_dev,		/* /proc/net/dev	*/
+	lxpr_read_net_dev_mcast,	/* /proc/net/dev_mcast	*/
+	lxpr_read_net_if_inet6,		/* /proc/net/if_inet6	*/
+	lxpr_read_net_igmp,		/* /proc/net/igmp	*/
+	lxpr_read_net_ip_mr_cache,	/* /proc/net/ip_mr_cache */
+	lxpr_read_net_ip_mr_vif,	/* /proc/net/ip_mr_vif	*/
+	lxpr_read_net_ipv6_route,	/* /proc/net/ipv6_route	*/
+	lxpr_read_net_mcfilter,		/* /proc/net/mcfilter	*/
+	lxpr_read_net_netstat,		/* /proc/net/netstat	*/
+	lxpr_read_net_raw,		/* /proc/net/raw	*/
+	lxpr_read_net_route,		/* /proc/net/route	*/
+	lxpr_read_net_rpc,		/* /proc/net/rpc	*/
+	lxpr_read_net_rt_cache,		/* /proc/net/rt_cache	*/
+	lxpr_read_net_sockstat,		/* /proc/net/sockstat	*/
+	lxpr_read_net_snmp,		/* /proc/net/snmp	*/
+	lxpr_read_net_stat,		/* /proc/net/stat	*/
+	lxpr_read_net_tcp,		/* /proc/net/tcp	*/
+	lxpr_read_net_tcp6,		/* /proc/net/tcp6	*/
+	lxpr_read_net_udp,		/* /proc/net/udp	*/
+	lxpr_read_net_udp6,		/* /proc/net/udp6	*/
+	lxpr_read_net_unix,		/* /proc/net/unix	*/
+	lxpr_read_partitions,		/* /proc/partitions	*/
+	lxpr_read_invalid,		/* /proc/self		*/
+	lxpr_read_stat,			/* /proc/stat		*/
+	lxpr_read_swaps,		/* /proc/swaps		*/
+	lxpr_read_invalid,		/* /proc/sys		*/
+	lxpr_read_invalid,		/* /proc/sys/fs		*/
+	lxpr_read_sys_fs_aiomax,	/* /proc/sys/fs/aio-max-nr */
+	lxpr_read_sys_fs_aionr,		/* /proc/sys/fs/aio-nr */
+	lxpr_read_sys_fs_filemax,	/* /proc/sys/fs/file-max */
+	lxpr_read_sys_fs_filenr,	/* /proc/sys/fs/file-nr	*/
+	lxpr_read_invalid,		/* /proc/sys/fs/inotify	*/
+	lxpr_read_sys_fs_inotify_max_queued_events, /* max_queued_events */
+	lxpr_read_sys_fs_inotify_max_user_instances, /* max_user_instances */
+	lxpr_read_sys_fs_inotify_max_user_watches, /* max_user_watches */
+	lxpr_read_sys_fs_pipe_max,	/* /proc/sys/fs/pipe-max-size */
+	lxpr_read_invalid,		/* /proc/sys/kernel	*/
+	lxpr_read_sys_kernel_caplcap,	/* /proc/sys/kernel/cap_last_cap */
+	lxpr_read_sys_kernel_corepatt,	/* /proc/sys/kernel/core_pattern */
+	lxpr_read_sys_kernel_hostname,	/* /proc/sys/kernel/hostname */
+	lxpr_read_sys_kernel_msgmax,	/* /proc/sys/kernel/msgmax */
+	lxpr_read_sys_kernel_msgmnb,	/* /proc/sys/kernel/msgmnb */
+	lxpr_read_sys_kernel_msgmni,	/* /proc/sys/kernel/msgmni */
+	lxpr_read_sys_kernel_ngroups_max, /* /proc/sys/kernel/ngroups_max */
+	lxpr_read_sys_kernel_osrel,	/* /proc/sys/kernel/osrelease */
+	lxpr_read_sys_kernel_pid_max,	/* /proc/sys/kernel/pid_max */
+	lxpr_read_invalid,		/* /proc/sys/kernel/random */
+	lxpr_read_sys_kernel_rand_bootid, /* /proc/sys/kernel/random/boot_id */
+	lxpr_read_sys_kernel_rand_entavl, /* .../kernel/random/entropy_avail */
+	lxpr_read_sys_kernel_sem,	/* /proc/sys/kernel/sem */
+	lxpr_read_sys_kernel_shmall,	/* /proc/sys/kernel/shmall */
+	lxpr_read_sys_kernel_shmmax,	/* /proc/sys/kernel/shmmax */
+	lxpr_read_sys_kernel_shmmni,	/* /proc/sys/kernel/shmmni */
+	lxpr_read_sys_kernel_threads_max, /* /proc/sys/kernel/threads-max */
+	lxpr_read_invalid,		/* /proc/sys/net	*/
+	lxpr_read_invalid,		/* /proc/sys/net/core	*/
+	lxpr_read_sys_net_core_somaxc,	/* /proc/sys/net/core/somaxconn	*/
+	lxpr_read_invalid,		/* /proc/sys/net/ipv4	*/
+	lxpr_read_sys_net_ipv4_icmp_eib, /* .../icmp_echo_ignore_broadcasts */
+	lxpr_read_sys_net_ipv4_ip_forward, /* .../ipv4/ip_forward */
+	lxpr_read_sys_net_ipv4_ip_lport_range, /* ../ipv4/ip_local_port_range */
+	lxpr_read_sys_net_ipv4_tcp_fin_to, /* .../ipv4/tcp_fin_timeout */
+	lxpr_read_sys_net_ipv4_tcp_ka_int, /* .../ipv4/tcp_keepalive_intvl */
+	lxpr_read_sys_net_ipv4_tcp_ka_tim, /* .../ipv4/tcp_keepalive_time */
+	lxpr_read_sys_net_ipv4_tcp_max_syn_bl, /* ../ipv4/tcp_max_syn_backlog */
+	lxpr_read_sys_net_ipv4_tcp_retry2, /* .../ipv4/tcp_retries2 */
+	lxpr_read_sys_net_ipv4_tcp_rwmem, /* .../ipv4/tcp_rmem */
+	lxpr_read_sys_net_ipv4_tcp_sack, /* .../ipv4/tcp_sack */
+	lxpr_read_sys_net_ipv4_tcp_winscale, /* .../ipv4/tcp_window_scaling */
+	lxpr_read_sys_net_ipv4_tcp_rwmem, /* .../ipv4/tcp_wmem */
+	lxpr_read_invalid,		/* /proc/sys/vm	*/
+	lxpr_read_sys_vm_dirty,		/* .../vm/dirty_background_bytes */
+	lxpr_read_sys_vm_dirty,		/* .../vm/dirty_background_ratio */
+	lxpr_read_sys_vm_dirty,		/* .../vm/dirty_bytes */
+	lxpr_read_sys_vm_dirty,		/* .../vm/dirty_expire_centisecs */
+	lxpr_read_sys_vm_dirty,		/* .../vm/dirty_ratio */
+	lxpr_read_sys_vm_dirty,		/* .../vm/dirtytime_expire_seconds */
+	lxpr_read_sys_vm_dirty,		/* .../vm/dirty_writeback_centisecs */
+	lxpr_read_sys_vm_max_map_cnt,	/* /proc/sys/vm/max_map_count */
+	lxpr_read_sys_vm_minfr_kb,	/* /proc/sys/vm/min_free_kbytes */
+	lxpr_read_sys_vm_nhpages,	/* /proc/sys/vm/nr_hugepages */
+	lxpr_read_sys_vm_overcommit_mem, /* /proc/sys/vm/overcommit_memory */
+	lxpr_read_sys_vm_swappiness,	/* /proc/sys/vm/swappiness */
+	lxpr_read_uptime,		/* /proc/uptime		*/
+	lxpr_read_version,		/* /proc/version	*/
+	lxpr_read_vmstat,		/* /proc/vmstat		*/
+};
+
+/*
+ * Array of lookup functions, indexed by lx /proc file type.
+ */
+static vnode_t *(*lxpr_lookup_function[LXPR_NFILES])() = {
+	NULL,				/* invalid		*/
+	lxpr_lookup_procdir,		/* /proc		*/
+	lxpr_lookup_piddir,		/* /proc/<pid>		*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/auxv	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/cgroup	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/cmdline	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/comm	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/cpu	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/cwd	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/environ	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/exe	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/gid_map	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/limits	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/loginuid	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/maps	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/mem	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/mountinfo */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/mounts	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/oom_score_adj */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/personality */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/root	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/stat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/statm	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/status	*/
+	lxpr_lookup_taskdir,		/* /proc/<pid>/task	*/
+	lxpr_lookup_task_tid_dir,	/* /proc/<pid>/task/nn	*/
+	lxpr_lookup_fddir,		/* /proc/<pid>/fd	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/fd/nn	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/uid_map	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/auxv	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/cgroup */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/cmdline */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/comm	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/cpu	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/cwd	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/environ */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/exe	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/gid_map */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/limits */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/loginuid */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/maps	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/mem	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/mountinfo */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/oom_scr_adj */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/personality */
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/root	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/stat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/statm	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/status */
+	lxpr_lookup_fddir,		/* /proc/<pid>/task/<tid>/fd	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/fd/nn	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/task/<tid>/uid_map */
+	lxpr_lookup_not_a_dir,		/* /proc/cgroups	*/
+	lxpr_lookup_not_a_dir,		/* /proc/cmdline	*/
+	lxpr_lookup_not_a_dir,		/* /proc/cpuinfo	*/
+	lxpr_lookup_not_a_dir,		/* /proc/devices	*/
+	lxpr_lookup_not_a_dir,		/* /proc/diskstats	*/
+	lxpr_lookup_not_a_dir,		/* /proc/dma		*/
+	lxpr_lookup_not_a_dir,		/* /proc/filesystems	*/
+	lxpr_lookup_not_a_dir,		/* /proc/interrupts	*/
+	lxpr_lookup_not_a_dir,		/* /proc/ioports	*/
+	lxpr_lookup_not_a_dir,		/* /proc/kcore		*/
+	lxpr_lookup_not_a_dir,		/* /proc/kmsg		*/
+	lxpr_lookup_not_a_dir,		/* /proc/loadavg	*/
+	lxpr_lookup_not_a_dir,		/* /proc/meminfo	*/
+	lxpr_lookup_not_a_dir,		/* /proc/modules	*/
+	lxpr_lookup_not_a_dir,		/* /proc/mounts		*/
+	lxpr_lookup_netdir,		/* /proc/net		*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/arp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/dev	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/dev_mcast	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/if_inet6	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/igmp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/ip_mr_cache */
+	lxpr_lookup_not_a_dir,		/* /proc/net/ip_mr_vif	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/ipv6_route	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/mcfilter	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/netstat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/raw	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/route	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/rpc	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/rt_cache	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/sockstat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/snmp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/stat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/tcp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/tcp6	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/udp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/udp6	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/unix	*/
+	lxpr_lookup_not_a_dir,		/* /proc/partitions	*/
+	lxpr_lookup_not_a_dir,		/* /proc/self		*/
+	lxpr_lookup_not_a_dir,		/* /proc/stat		*/
+	lxpr_lookup_not_a_dir,		/* /proc/swaps		*/
+	lxpr_lookup_sysdir,		/* /proc/sys		*/
+	lxpr_lookup_sys_fsdir,		/* /proc/sys/fs		*/
+	lxpr_lookup_not_a_dir,		/* /proc/sys/fs/aio-max-nr */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/fs/aio-nr */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/fs/file-max */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/fs/file-nr */
+	lxpr_lookup_sys_fs_inotifydir,	/* /proc/sys/fs/inotify	*/
+	lxpr_lookup_not_a_dir,		/* .../inotify/max_queued_events */
+	lxpr_lookup_not_a_dir,		/* .../inotify/max_user_instances */
+	lxpr_lookup_not_a_dir,		/* .../inotify/max_user_watches */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/fs/pipe-max-size */
+	lxpr_lookup_sys_kerneldir,	/* /proc/sys/kernel	*/
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/cap_last_cap */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/core_pattern */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/hostname */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/msgmax */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/msgmnb */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/msgmni */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/ngroups_max */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/osrelease */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/pid_max */
+	lxpr_lookup_sys_kdir_randdir,	/* /proc/sys/kernel/random */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/random/boot_id */
+	lxpr_lookup_not_a_dir,		/* .../kernel/random/entropy_avail */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/sem */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/shmall */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/shmmax */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/shmmni */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/kernel/threads-max */
+	lxpr_lookup_sys_netdir,		/* /proc/sys/net */
+	lxpr_lookup_sys_net_coredir,	/* /proc/sys/net/core */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/net/core/somaxconn */
+	lxpr_lookup_sys_net_ipv4dir,	/* /proc/sys/net/ipv4 */
+	lxpr_lookup_not_a_dir,		/* .../icmp_echo_ignore_broadcasts */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/ip_forward */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/ip_local_port_range */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_fin_timeout */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_keepalive_intvl */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_keepalive_time */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_max_syn_backlog */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_retries2 */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_rmem */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_sack */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_window_scaling */
+	lxpr_lookup_not_a_dir,		/* .../net/ipv4/tcp_wmem */
+	lxpr_lookup_sys_vmdir,		/* /proc/sys/vm */
+	lxpr_lookup_not_a_dir,		/* .../vm/dirty_background_bytes */
+	lxpr_lookup_not_a_dir,		/* .../vm/dirty_background_ratio */
+	lxpr_lookup_not_a_dir,		/* .../vm/dirty_bytes */
+	lxpr_lookup_not_a_dir,		/* .../vm/dirty_expire_centisecs */
+	lxpr_lookup_not_a_dir,		/* .../vm/dirty_ratio */
+	lxpr_lookup_not_a_dir,		/* .../vm/dirtytime_expire_seconds */
+	lxpr_lookup_not_a_dir,		/* .../vm/dirty_writeback_centisecs */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/vm/max_map_count */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/vm/min_free_kbytes */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/vm/nr_hugepages */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/vm/overcommit_memory */
+	lxpr_lookup_not_a_dir,		/* /proc/sys/vm/swappiness */
+	lxpr_lookup_not_a_dir,		/* /proc/uptime		*/
+	lxpr_lookup_not_a_dir,		/* /proc/version	*/
+	lxpr_lookup_not_a_dir,		/* /proc/vmstat		*/
+};
+
+/*
+ * Array of readdir functions, indexed by /proc file type.
+ */
+static int (*lxpr_readdir_function[LXPR_NFILES])() = {
+	NULL,				/* invalid		*/
+	lxpr_readdir_procdir,		/* /proc		*/
+	lxpr_readdir_piddir,		/* /proc/<pid>		*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/auxv	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/cgroup	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/cmdline	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/comm	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/cpu	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/cwd	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/environ	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/exe	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/gid_map	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/limits	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/loginuid	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/maps	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/mem	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/mountinfo */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/mounts	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/oom_score_adj */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/personality */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/root	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/stat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/statm	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/status	*/
+	lxpr_readdir_taskdir,		/* /proc/<pid>/task	*/
+	lxpr_readdir_task_tid_dir,	/* /proc/<pid>/task/nn	*/
+	lxpr_readdir_fddir,		/* /proc/<pid>/fd	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/fd/nn	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/uid_map	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/auxv	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/cgroup */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/cmdline */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/comm	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/cpu	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/cwd	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/environ */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/exe	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/gid_map */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/limits */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/loginuid */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/maps	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/mem	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/mountinfo */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid/oom_scr_adj */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid/personality */
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/root	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/stat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/statm	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/status */
+	lxpr_readdir_fddir,		/* /proc/<pid>/task/<tid>/fd	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/fd/nn	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/task/<tid>/uid_map */
+	lxpr_readdir_not_a_dir,		/* /proc/cgroups	*/
+	lxpr_readdir_not_a_dir,		/* /proc/cmdline	*/
+	lxpr_readdir_not_a_dir,		/* /proc/cpuinfo	*/
+	lxpr_readdir_not_a_dir,		/* /proc/devices	*/
+	lxpr_readdir_not_a_dir,		/* /proc/diskstats	*/
+	lxpr_readdir_not_a_dir,		/* /proc/dma		*/
+	lxpr_readdir_not_a_dir,		/* /proc/filesystems	*/
+	lxpr_readdir_not_a_dir,		/* /proc/interrupts	*/
+	lxpr_readdir_not_a_dir,		/* /proc/ioports	*/
+	lxpr_readdir_not_a_dir,		/* /proc/kcore		*/
+	lxpr_readdir_not_a_dir,		/* /proc/kmsg		*/
+	lxpr_readdir_not_a_dir,		/* /proc/loadavg	*/
+	lxpr_readdir_not_a_dir,		/* /proc/meminfo	*/
+	lxpr_readdir_not_a_dir,		/* /proc/modules	*/
+	lxpr_readdir_not_a_dir,		/* /proc/mounts		*/
+	lxpr_readdir_netdir,		/* /proc/net		*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/arp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/dev	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/dev_mcast	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/if_inet6	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/igmp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/ip_mr_cache */
+	lxpr_readdir_not_a_dir,		/* /proc/net/ip_mr_vif	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/ipv6_route	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/mcfilter	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/netstat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/raw	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/route	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/rpc	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/rt_cache	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/sockstat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/snmp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/stat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/tcp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/tcp6	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/udp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/udp6	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/unix	*/
+	lxpr_readdir_not_a_dir,		/* /proc/partitions	*/
+	lxpr_readdir_not_a_dir,		/* /proc/self		*/
+	lxpr_readdir_not_a_dir,		/* /proc/stat		*/
+	lxpr_readdir_not_a_dir,		/* /proc/swaps		*/
+	lxpr_readdir_sysdir,		/* /proc/sys		*/
+	lxpr_readdir_sys_fsdir,		/* /proc/sys/fs		*/
+	lxpr_readdir_not_a_dir,		/* /proc/sys/fs/aio-max-nr */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/fs/aio-nr */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/fs/file-max */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/fs/file-nr */
+	lxpr_readdir_sys_fs_inotifydir,	/* /proc/sys/fs/inotify	*/
+	lxpr_readdir_not_a_dir,		/* .../inotify/max_queued_events */
+	lxpr_readdir_not_a_dir,		/* .../inotify/max_user_instances */
+	lxpr_readdir_not_a_dir,		/* .../inotify/max_user_watches	*/
+	lxpr_readdir_not_a_dir,		/* /proc/sys/fs/pipe-max-size */
+	lxpr_readdir_sys_kerneldir,	/* /proc/sys/kernel	*/
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/cap_last_cap */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/core_pattern */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/hostname */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/msgmax */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/msgmnb */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/msgmni */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/ngroups_max */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/osrelease */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/pid_max */
+	lxpr_readdir_sys_kdir_randdir,	/* /proc/sys/kernel/random */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/random/boot_id */
+	lxpr_readdir_not_a_dir,		/* .../kernel/random/entropy_avail */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/sem */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/shmall */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/shmmax */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/shmmni */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/kernel/threads-max */
+	lxpr_readdir_sys_netdir,	/* /proc/sys/net */
+	lxpr_readdir_sys_net_coredir,	/* /proc/sys/net/core */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/net/core/somaxconn */
+	lxpr_readdir_sys_net_ipv4dir,	/* /proc/sys/net/ipv4 */
+	lxpr_readdir_not_a_dir,		/* .../icmp_echo_ignore_broadcasts */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/ip_forward */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/ip_local_port_range */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_fin_timeout */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_keepalive_intvl */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_keepalive_time */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_max_syn_backlog */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_retries2 */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_rmem */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_sack */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_window_scaling */
+	lxpr_readdir_not_a_dir,		/* .../net/ipv4/tcp_wmem */
+	lxpr_readdir_sys_vmdir,		/* /proc/sys/vm */
+	lxpr_readdir_not_a_dir,		/* .../vm/dirty_background_bytes */
+	lxpr_readdir_not_a_dir,		/* .../vm/dirty_background_ratio */
+	lxpr_readdir_not_a_dir,		/* .../vm/dirty_bytes */
+	lxpr_readdir_not_a_dir,		/* .../vm/dirty_expire_centisecs */
+	lxpr_readdir_not_a_dir,		/* .../vm/dirty_ratio */
+	lxpr_readdir_not_a_dir,		/* .../vm/dirtytime_expire_seconds */
+	lxpr_readdir_not_a_dir,		/* .../vm/dirty_writeback_centisecs */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/vm/max_map_count */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/vm/min_free_kbytes */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/vm/nr_hugepages */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/vm/overcommit_memory */
+	lxpr_readdir_not_a_dir,		/* /proc/sys/vm/swappiness */
+	lxpr_readdir_not_a_dir,		/* /proc/uptime		*/
+	lxpr_readdir_not_a_dir,		/* /proc/version	*/
+	lxpr_readdir_not_a_dir,		/* /proc/vmstat		*/
+};
+
+
+/*
+ * lxpr_read(): Vnode operation for VOP_READ()
+ *
+ * As the format of all the files that can be read in the lx procfs is human
+ * readable and not binary structures there do not have to be different
+ * read variants depending on whether the reading process model is 32 or 64 bits
+ * (at least in general, and certainly the difference is unlikely to be enough
+ * to justify have different routines for 32 and 64 bit reads
+ */
+/* ARGSUSED */
+static int
+lxpr_read(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr,
+    caller_context_t *ct)
+{
+	lxpr_node_t *lxpnp = VTOLXP(vp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	lxpr_uiobuf_t *uiobuf = lxpr_uiobuf_new(uiop);
+	int error;
+
+	ASSERT(type < LXPR_NFILES);
+
+	if (type == LXPR_KMSG) {
+		ldi_ident_t	li = VTOLXPM(vp)->lxprm_li;
+		ldi_handle_t	ldih;
+		struct strioctl	str;
+		int		rv;
+
+		/*
+		 * Open the zone's console device using the layered driver
+		 * interface.
+		 */
+		if ((error =
+		    ldi_open_by_name("/dev/log", FREAD, cr, &ldih, li)) != 0)
+			return (error);
+
+		/*
+		 * Send an ioctl to the underlying console device, letting it
+		 * know we're interested in getting console messages.
+		 */
+		str.ic_cmd = I_CONSLOG;
+		str.ic_timout = 0;
+		str.ic_len = 0;
+		str.ic_dp = NULL;
+		if ((error = ldi_ioctl(ldih, I_STR,
+		    (intptr_t)&str, FKIOCTL, cr, &rv)) != 0)
+			return (error);
+
+		lxpr_read_kmsg(lxpnp, uiobuf, ldih);
+
+		if ((error = ldi_close(ldih, FREAD, cr)) != 0)
+			return (error);
+	} else {
+		lxpr_read_function[type](lxpnp, uiobuf);
+	}
+
+	error = lxpr_uiobuf_flush(uiobuf);
+	lxpr_uiobuf_free(uiobuf);
+
+	return (error);
+}
+
+/*
+ * lxpr_read_invalid(), lxpr_read_isdir(), lxpr_read_empty()
+ *
+ * Various special case reads:
+ * - trying to read a directory
+ * - invalid file (used to mean a file that should be implemented,
+ *   but isn't yet)
+ * - empty file
+ * - wait to be able to read a file that will never have anything to read
+ */
+/* ARGSUSED */
+static void
+lxpr_read_isdir(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_seterr(uiobuf, EISDIR);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_invalid(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_seterr(uiobuf, EINVAL);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_empty(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/*
+ * lxpr_read_pid_auxv(): read process aux vector
+ */
+static void
+lxpr_read_pid_auxv(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	lx_proc_data_t *pd;
+	lx_elf_data_t *edp = NULL;
+	int i, cnt;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_AUXV ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_AUXV);
+
+	p = lxpr_lock(lxpnp, NO_ZOMB);
+
+	if (p == NULL) {
+		return;
+	}
+	if ((pd = ptolxproc(p)) == NULL) {
+		/* Emit a single AT_NULL record for non-branded processes */
+		auxv_t buf;
+
+		bzero(&buf, sizeof (buf));
+		lxpr_unlock(p);
+		lxpr_uiobuf_write(uiobuf, (char *)&buf, sizeof (buf));
+		return;
+	} else {
+		edp = &pd->l_elf_data;
+	}
+
+	if (p->p_model == DATAMODEL_NATIVE) {
+		auxv_t buf[__KERN_NAUXV_IMPL];
+
+		/*
+		 * Because a_type is only of size int (not long), the buffer
+		 * contents must be zeroed first to ensure cleanliness.
+		 */
+		bzero(buf, sizeof (buf));
+		for (i = 0, cnt = 0; i < __KERN_NAUXV_IMPL; i++) {
+			if (lx_auxv_stol(&p->p_user.u_auxv[i],
+			    &buf[cnt], edp) == 0) {
+				cnt++;
+			}
+			if (p->p_user.u_auxv[i].a_type == AT_NULL) {
+				break;
+			}
+		}
+		lxpr_unlock(p);
+		lxpr_uiobuf_write(uiobuf, (char *)buf, cnt * sizeof (buf[0]));
+	}
+#if defined(_SYSCALL32_IMPL)
+	else {
+		auxv32_t buf[__KERN_NAUXV_IMPL];
+
+		for (i = 0, cnt = 0; i < __KERN_NAUXV_IMPL; i++) {
+			auxv_t temp;
+
+			if (lx_auxv_stol(&p->p_user.u_auxv[i],
+			    &temp, edp) == 0) {
+				buf[cnt].a_type = (int)temp.a_type;
+				buf[cnt].a_un.a_val = (int)temp.a_un.a_val;
+				cnt++;
+			}
+			if (p->p_user.u_auxv[i].a_type == AT_NULL) {
+				break;
+			}
+		}
+		lxpr_unlock(p);
+		lxpr_uiobuf_write(uiobuf, (char *)buf, cnt * sizeof (buf[0]));
+	}
+#endif /* defined(_SYSCALL32_IMPL) */
+}
+
+/*
+ * lxpr_read_pid_cgroup(): read cgroups for process
+ */
+static void
+lxpr_read_pid_cgroup(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_CGROUP ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_CGROUP);
+
+	p = lxpr_lock(lxpnp, ZOMB_OK);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+	lxpr_unlock(p);
+
+	/* basic stub, 3rd field will need to be populated */
+	lxpr_uiobuf_printf(uiobuf, "1:name=systemd:/\n");
+}
+
+static void
+lxpr_copy_cmdline(proc_t *p, lx_proc_data_t *pd, lxpr_uiobuf_t *uiobuf)
+{
+	uio_t *uiop = uiobuf->uiop;
+	char *buf = uiobuf->buffer;
+	int bsz = uiobuf->buffsize;
+	boolean_t env_overflow = B_FALSE;
+	uintptr_t pos = pd->l_args_start + uiop->uio_offset;
+	uintptr_t estart = pd->l_envs_start;
+	uintptr_t eend = pd->l_envs_end;
+	size_t chunk, copied;
+	int err = 0;
+
+	/* Do not bother with data beyond the end of the envp strings area. */
+	if (pos > eend) {
+		return;
+	}
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * If the starting or ending bounds are outside the argv strings area,
+	 * check to see if the process has overwritten the terminating NULL.
+	 * If not, no data needs to be copied from oustide the argv area.
+	 */
+	if (pos >= estart || (pos + uiop->uio_resid) >= estart) {
+		uint8_t term;
+		if (uread(p, &term, sizeof (term), estart - 1) != 0) {
+			err = EFAULT;
+		} else if (term != 0) {
+			env_overflow = B_TRUE;
+		}
+	}
+
+	/* Data between astart and estart-1 can be copied freely. */
+	while (pos < estart && uiop->uio_resid > 0 && err == 0) {
+		chunk = MIN(estart - pos, uiop->uio_resid);
+		chunk = MIN(chunk, bsz);
+
+		if (prreadbuf(p, pos, (uint8_t *)buf, chunk, &copied) != 0 ||
+		    copied != chunk) {
+			err = EFAULT;
+			break;
+		}
+		err = uiomove(buf, copied, UIO_READ, uiop);
+		pos += copied;
+	}
+
+	/*
+	 * Onward from estart, data is copied as a contiguous string.  To
+	 * protect env data from potential snooping, only one buffer-sized copy
+	 * is allowed to avoid complex seek logic.
+	 */
+	if (err == 0 && env_overflow && pos == estart && uiop->uio_resid > 0) {
+		chunk = MIN(eend - pos, uiop->uio_resid);
+		chunk = MIN(chunk, bsz);
+		if (prreadbuf(p, pos, (uint8_t *)buf, chunk, &copied) == 0) {
+			int len = strnlen(buf, copied);
+			if (len > 0) {
+				err = uiomove(buf, len, UIO_READ, uiop);
+			}
+		}
+	}
+
+	uiobuf->error = err;
+	/* reset any uiobuf state */
+	uiobuf->pos = uiobuf->buffer;
+	uiobuf->beg = 0;
+
+	mutex_enter(&p->p_lock);
+}
+
+/*
+ * lxpr_read_pid_cmdline(): read argument vector from process
+ */
+static void
+lxpr_read_pid_cmdline(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	char *buf;
+	size_t asz = lxpr_maxargvlen, sz;
+	lx_proc_data_t *pd;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_CMDLINE ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_CMDLINE);
+
+	buf = kmem_alloc(asz, KM_SLEEP);
+
+	p = lxpr_lock(lxpnp, NO_ZOMB);
+	if (p == NULL) {
+		kmem_free(buf, asz);
+		return;
+	}
+
+	if ((pd = ptolxproc(p)) != NULL && pd->l_args_start != 0 &&
+	    pd->l_envs_start != 0 && pd->l_envs_end != 0) {
+		/* Use Linux-style argv bounds if possible. */
+		lxpr_copy_cmdline(p, pd, uiobuf);
+		lxpr_unlock(p);
+	} else {
+		int r;
+
+		r = prreadargv(p, buf, asz, &sz);
+		lxpr_unlock(p);
+
+		if (r != 0) {
+			lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		} else {
+			lxpr_uiobuf_write(uiobuf, buf, sz);
+		}
+	}
+	kmem_free(buf, asz);
+}
+
+/*
+ * lxpr_read_pid_tid_comm(): read command name from thread
+ */
+static void
+lxpr_read_pid_tid_comm(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	kthread_t *t;
+	pid_t tid;
+	char buf[LX_PR_SET_NAME_NAMELEN], *pnm;
+
+	VERIFY(lxpnp->lxpr_type == LXPR_PID_COMM ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_COMM);
+
+	tid = (lxpnp->lxpr_desc == 0) ? lxpnp->lxpr_pid : lxpnp->lxpr_desc;
+	p = lxpr_lock_pid(lxpnp, tid, ZOMB_OK, &t);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+	if (t == NULL) {
+		lxpr_unlock(p);
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+
+	/*
+	 * If a thread name has not been set, use the process command name.
+	 * This also covers the /proc/{pid}/comm case.
+	 */
+	if (t->t_name == NULL) {
+		pnm = p->p_user.u_comm;
+	} else {
+		pnm = t->t_name;
+	}
+
+	/* Truncate with NUL if the name is longer than the Linux size. */
+	(void) strlcpy(buf, pnm, sizeof (buf));
+
+	lxpr_unlock(p);
+	lxpr_uiobuf_printf(uiobuf, "%s\n", buf);
+}
+
+/* ARGSUSED */
+static int
+lxpr_write_pid_tid_comm(lxpr_node_t *lxpnp, struct uio *uio, struct cred *cr,
+    caller_context_t *ct)
+{
+	int error;
+	size_t olen;
+	char *buf;
+	proc_t *p;
+	kthread_t *t;
+	pid_t tid;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_COMM ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_COMM);
+
+	/*
+	 * Only a thread in the process can update one of the thread names. Not
+	 * even a process with root privileges. Linux returns EINVAL (not EPERM)
+	 * for this case.
+	 */
+	if (lxpnp->lxpr_pid != curproc->p_pid)
+		return (EINVAL);
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > LX_PR_SET_NAME_NAMELEN - 1)
+		olen = LX_PR_SET_NAME_NAMELEN - 1;
+
+	buf = kmem_zalloc(THREAD_NAME_MAX, KM_SLEEP);
+
+	error = uiomove(buf, olen, UIO_WRITE, uio);
+	if (error != 0) {
+		kmem_free(buf, THREAD_NAME_MAX);
+		return (error);
+	}
+	buf[LX_PR_SET_NAME_NAMELEN - 1] = '\0';
+
+	tid = (lxpnp->lxpr_desc == 0) ? lxpnp->lxpr_pid : lxpnp->lxpr_desc;
+	p = lxpr_lock_pid(lxpnp, tid, NO_ZOMB, &t);
+	if (p == NULL) {
+		kmem_free(buf, THREAD_NAME_MAX);
+		return (ENXIO);
+	}
+	if (t == NULL) {
+		lxpr_unlock(p);
+		kmem_free(buf, THREAD_NAME_MAX);
+		return (ENXIO);
+	}
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+
+	/*
+	 * See comments for thread_setname() and prctl(LX_PR_SET_NAME) handling.
+	 */
+	if (t->t_name == NULL) {
+		t->t_name = buf;
+	} else {
+		(void) strlcpy(t->t_name, buf, THREAD_NAME_MAX);
+		kmem_free(buf, THREAD_NAME_MAX);
+	}
+
+	if (t->t_tid == 1) {
+		(void) strncpy(p->p_user.u_comm, t->t_name, MAXCOMLEN + 1);
+		(void) strncpy(p->p_user.u_psargs, t->t_name, PSARGSZ);
+	}
+
+	lxpr_unlock(p);
+	return (0);
+}
+
+/*
+ * lxpr_read_pid_env(): read env vector from process
+ */
+static void
+lxpr_read_pid_env(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	char *buf;
+	size_t asz = lxpr_maxenvvlen, sz;
+	int r;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_ENV);
+
+	buf = kmem_alloc(asz, KM_SLEEP);
+
+	p = lxpr_lock(lxpnp, NO_ZOMB);
+	if (p == NULL) {
+		kmem_free(buf, asz);
+		return;
+	}
+
+	r = prreadenvv(p, buf, asz, &sz);
+	lxpr_unlock(p);
+
+	if (r != 0) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+	} else {
+		lxpr_uiobuf_write(uiobuf, buf, sz);
+	}
+	kmem_free(buf, asz);
+}
+
+/*
+ * lxpr_read_pid_limits(): ulimit file
+ */
+static void
+lxpr_read_pid_limits(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	rctl_qty_t cur[LX_RLIM_TAB_LEN], max[LX_RLIM_TAB_LEN];
+	int i;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_LIMITS ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_LIMITS);
+
+	p = lxpr_lock(lxpnp, NO_ZOMB);
+	if (p == NULL) {
+		return;
+	}
+
+	for (i = 0; i < LX_RLIM_TAB_LEN; i++) {
+		char *kname = lxpr_rlimtab[i].rlim_rctl;
+		rctl_val_t nval, *oval = NULL;
+		rctl_hndl_t hndl;
+
+		/* default to unlimited for resources without an analog */
+		cur[i] = RLIM_INFINITY;
+		max[i] = RLIM_INFINITY;
+		if (kname == NULL || (hndl = rctl_hndl_lookup(kname)) == -1) {
+			continue;
+		}
+		while (rctl_local_get(hndl, oval, &nval, p) == 0) {
+			oval = &nval;
+			switch (nval.rcv_privilege) {
+			case RCPRIV_BASIC:
+				if (!RCTL_INFINITE(nval))
+					cur[i] = nval.rcv_value;
+				break;
+			case RCPRIV_PRIVILEGED:
+				if (!RCTL_INFINITE(nval))
+					max[i] = nval.rcv_value;
+				break;
+			}
+		}
+	}
+	lxpr_unlock(p);
+
+	lxpr_uiobuf_printf(uiobuf, "%-25s %-20s %-20s %-10s\n",
+	    "Limit", "Soft Limit", "Hard Limit", "Units");
+	for (i = 0; i < LX_RLIM_TAB_LEN; i++) {
+		lxpr_uiobuf_printf(uiobuf, "%-25s", lxpr_rlimtab[i].rlim_name);
+		if (cur[i] == RLIM_INFINITY || cur[i] == LX_RLIM_INFINITY) {
+			lxpr_uiobuf_printf(uiobuf, " %-20s", "unlimited");
+		} else {
+			lxpr_uiobuf_printf(uiobuf, " %-20lu", cur[i]);
+		}
+		if (max[i] == RLIM_INFINITY || max[i] == LX_RLIM_INFINITY) {
+			lxpr_uiobuf_printf(uiobuf, " %-20s", "unlimited");
+		} else {
+			lxpr_uiobuf_printf(uiobuf, " %-20lu", max[i]);
+		}
+		lxpr_uiobuf_printf(uiobuf, " %-10s\n",
+		    lxpr_rlimtab[i].rlim_unit);
+	}
+}
+/*
+ * lxpr_read_pid_id_map(): gid_map and uid_map file
+ */
+static void
+lxpr_read_pid_id_map(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_GIDMAP ||
+	    lxpnp->lxpr_type == LXPR_PID_UIDMAP);
+
+	lxpr_uiobuf_printf(uiobuf, "%10u %10u %10u\n", 0, 0, MAXUID);
+}
+
+/*
+ * lxpr_read_pid_loginuid(): loginuid file
+ */
+static void
+lxpr_read_pid_loginuid(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	lx_proc_data_t *pd;
+	uid_t lu = 0;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_LOGINUID ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_LOGINUID);
+
+	p = lxpr_lock(lxpnp, NO_ZOMB);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	if ((pd = ptolxproc(p)) != NULL) {
+		lu = pd->l_loginuid;
+	}
+	lxpr_unlock(p);
+
+	lxpr_uiobuf_printf(uiobuf, "%d", lu);
+}
+
+/*
+ * lxpr_read_pid_maps(): memory map file
+ */
+static void
+lxpr_read_pid_maps(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	lx_proc_data_t *lxpd;
+	struct as *as;
+	struct seg *seg;
+	char *buf;
+	int buflen = MAXPATHLEN;
+	struct print_data {
+		uintptr_t saddr;
+		uintptr_t eaddr;
+		int type;
+		char prot[5];
+		uintptr_t offset;
+		vnode_t *vp;
+		char *name_override;
+		struct print_data *next;
+	} *print_head = NULL;
+	struct print_data **print_tail = &print_head;
+	struct print_data *pbuf;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_MAPS ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_MAPS);
+
+	p = lxpr_lock(lxpnp, NO_ZOMB);
+	if (p == NULL) {
+		return;
+	}
+
+	as = p->p_as;
+	lxpd = ptolxproc(p);
+
+	if (as == &kas) {
+		lxpr_unlock(p);
+		return;
+	}
+
+	mutex_exit(&p->p_lock);
+
+	/* Iterate over all segments in the address space */
+	AS_LOCK_ENTER(as, RW_READER);
+	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
+		vnode_t *vp;
+		uint_t protbits;
+
+		if ((seg->s_flags & S_HOLE) != 0) {
+			continue;
+		}
+
+		pbuf = kmem_alloc(sizeof (*pbuf), KM_SLEEP);
+
+		pbuf->saddr = (uintptr_t)seg->s_base;
+		pbuf->eaddr = pbuf->saddr + seg->s_size;
+		pbuf->type = SEGOP_GETTYPE(seg, seg->s_base);
+
+		/*
+		 * Cheat and only use the protection bits of the first page
+		 * in the segment
+		 */
+		(void) strncpy(pbuf->prot, "----", sizeof (pbuf->prot));
+		(void) SEGOP_GETPROT(seg, seg->s_base, 0, &protbits);
+
+		if (protbits & PROT_READ)	   pbuf->prot[0] = 'r';
+		if (protbits & PROT_WRITE)	   pbuf->prot[1] = 'w';
+		if (protbits & PROT_EXEC)	   pbuf->prot[2] = 'x';
+		if (pbuf->type & MAP_SHARED)	   pbuf->prot[3] = 's';
+		else if (pbuf->type & MAP_PRIVATE) pbuf->prot[3] = 'p';
+
+		if (seg->s_ops == &segvn_ops &&
+		    SEGOP_GETVP(seg, seg->s_base, &vp) == 0 &&
+		    vp != NULL && vp->v_type == VREG) {
+			VN_HOLD(vp);
+			pbuf->vp = vp;
+		} else {
+			pbuf->vp = NULL;
+		}
+
+		pbuf->offset = SEGOP_GETOFFSET(seg, (caddr_t)pbuf->saddr);
+
+		pbuf->name_override = NULL;
+		if (lxpd != NULL) {
+			if (pbuf->saddr == lxpd->l_vdso) {
+				pbuf->name_override = "[vdso]";
+			} else if (pbuf->saddr == p->p_user.u_commpagep) {
+				pbuf->name_override = "[vvar]";
+			}
+		}
+
+		pbuf->next = NULL;
+		*print_tail = pbuf;
+		print_tail = &pbuf->next;
+	}
+	AS_LOCK_EXIT(as);
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+
+	buf = kmem_alloc(buflen, KM_SLEEP);
+
+	/* print the data we've extracted */
+	pbuf = print_head;
+	while (pbuf != NULL) {
+		struct print_data *pbuf_next;
+		vattr_t vattr;
+
+		int maj = 0;
+		int min = 0;
+		ino_t inode = 0;
+
+		*buf = '\0';
+		if (pbuf->name_override != NULL) {
+			(void) strncpy(buf, pbuf->name_override, buflen);
+		} else if (pbuf->vp != NULL) {
+			vattr.va_mask = AT_FSID | AT_NODEID;
+			if (VOP_GETATTR(pbuf->vp, &vattr, 0, CRED(),
+			    NULL) == 0) {
+				maj = getmajor(vattr.va_fsid);
+				min = getminor(vattr.va_fsid);
+				inode = vattr.va_nodeid;
+			}
+			(void) vnodetopath(NULL, pbuf->vp, buf, buflen, CRED());
+			VN_RELE(pbuf->vp);
+		}
+
+		if (p->p_model == DATAMODEL_LP64) {
+			lxpr_uiobuf_printf(uiobuf,
+			    "%08llx-%08llx %s %08llx %02x:%02x %llu%s%s\n",
+			    pbuf->saddr, pbuf->eaddr, pbuf->prot, pbuf->offset,
+			    maj, min, inode, *buf != '\0' ? " " : "", buf);
+		} else {
+			lxpr_uiobuf_printf(uiobuf,
+			    "%08x-%08x %s %08x %02x:%02x %llu%s%s\n",
+			    (uint32_t)pbuf->saddr, (uint32_t)pbuf->eaddr,
+			    pbuf->prot, (uint32_t)pbuf->offset, maj, min,
+			    inode, *buf != '\0' ? " " : "", buf);
+		}
+
+		pbuf_next = pbuf->next;
+		kmem_free(pbuf, sizeof (*pbuf));
+		pbuf = pbuf_next;
+	}
+
+	kmem_free(buf, buflen);
+}
+
+/*
+ * Make mount entry look more like Linux. Non-zero return to skip it.
+ */
+static int
+lxpr_clean_mntent(char **mntpt, char **fstype, char **resource)
+{
+	if (strcmp(*mntpt, "/var/ld") == 0 ||
+	    strcmp(*fstype, "objfs") == 0 ||
+	    strcmp(*fstype, "mntfs") == 0 ||
+	    strcmp(*fstype, "ctfs") == 0 ||
+	    strncmp(*mntpt, "/native/", 8) == 0) {
+		return (1);
+	}
+
+	if (strcmp(*fstype, "tmpfs") == 0) {
+		*resource = "tmpfs";
+	} else if (strcmp(*fstype, "lx_proc") == 0) {
+		*resource = *fstype = "proc";
+	} else if (strcmp(*fstype, "lx_sysfs") == 0) {
+		*resource = *fstype = "sysfs";
+	} else if (strcmp(*fstype, "lx_devfs") == 0) {
+		*resource = *fstype = "devtmpfs";
+	} else if (strcmp(*fstype, "lx_cgroup") == 0) {
+		*resource = *fstype = "cgroup";
+	} else if (strcmp(*fstype, "lxautofs") == 0) {
+		*fstype = "autofs";
+	}
+
+	return (0);
+}
+
+
+typedef struct lxpr_mount_entry {
+	list_node_t	lme_link;
+	uint_t		lme_id;
+	uint_t		lme_parent_id;
+	refstr_t	*lme_mntpt;
+	refstr_t	*lme_resource;
+	uint_t		lme_mntopts_len;
+	char		*lme_mntopts;
+	uint_t		lme_flag;
+	int		lme_fstype;
+	dev_t		lme_dev;
+	boolean_t	lme_force;
+} lxpr_mount_entry_t;
+
+static int lxpr_zfs_fstype = -1;
+
+#define	LXPR_ROOT_MOUNT_ID	15
+#define	LXPR_MNT_OPT_CHUNK	128
+
+/* List of native, non-Linux mount options we should omit. */
+static const char *lx_invalid_mnt_opts[] = {
+	"xattr",
+	NULL
+};
+
+/* First see if we should omit this option */
+static boolean_t
+lxpr_skip_mntopt(const char *s)
+{
+	uint_t i;
+
+	for (i = 0; lx_invalid_mnt_opts[i] != NULL; i++) {
+		if (strcmp(s, lx_invalid_mnt_opts[i]) == 0)
+			return (B_TRUE);
+	}
+	return (B_FALSE);
+}
+
+static void
+lxpr_append_mntopt(lxpr_mount_entry_t *lme, char *s)
+{
+	while (strlcat(lme->lme_mntopts, s, lme->lme_mntopts_len) >=
+	    lme->lme_mntopts_len) {
+		/* expand option string */
+		uint_t tlen = lme->lme_mntopts_len + LXPR_MNT_OPT_CHUNK;
+		char *t = kmem_alloc(tlen, KM_SLEEP);
+
+		(void) strlcpy(t, lme->lme_mntopts, tlen);
+		kmem_free(lme->lme_mntopts, lme->lme_mntopts_len);
+		lme->lme_mntopts_len = tlen;
+		lme->lme_mntopts = t;
+	}
+}
+
+/*
+ * Perform the somewhat complicated work of getting the mount options string
+ * for the mount.
+ */
+static void
+lxpr_get_mntopts(vfs_t *vfsp, lxpr_mount_entry_t *lme)
+{
+	uint_t i;
+	mntopt_t *mop;
+	boolean_t have_nosuid = B_FALSE, have_nodev = B_FALSE;
+
+	lme->lme_mntopts_len = LXPR_MNT_OPT_CHUNK;
+	lme->lme_mntopts = kmem_alloc(lme->lme_mntopts_len, KM_SLEEP);
+	lme->lme_mntopts[0] = '\0';
+
+	/* Always show rw/ro option */
+	lxpr_append_mntopt(lme,
+	    (lme->lme_flag & VFS_RDONLY) == 0 ? "rw" : "ro");
+
+	for (i = 0; i < vfsp->vfs_mntopts.mo_count; i++) {
+		mop = &vfsp->vfs_mntopts.mo_list[i];
+		if ((mop->mo_flags & MO_NODISPLAY) || !(mop->mo_flags & MO_SET))
+			continue;
+
+		if (strcmp(mop->mo_name, "ro") == 0 ||
+		    strcmp(mop->mo_name, "rw") == 0)
+			continue;
+
+		if (strcmp(mop->mo_name, "nosuid") == 0)
+			have_nosuid = B_TRUE;
+		/* sigh, either option string is used */
+		if (strcmp(mop->mo_name, "nodev") == 0 ||
+		    strcmp(mop->mo_name, "nodevices") == 0)
+			have_nodev = B_TRUE;
+
+		if (!lxpr_skip_mntopt(mop->mo_name)) {
+			lxpr_append_mntopt(lme, ",");
+			lxpr_append_mntopt(lme, mop->mo_name);
+			if (mop->mo_arg != NULL) {
+				lxpr_append_mntopt(lme, "=");
+				lxpr_append_mntopt(lme, mop->mo_arg);
+			}
+		}
+	}
+
+	/*
+	 * Sometimes nosuid is an explicit string, other times it's a flag.
+	 * The same is true for nodevices.
+	 */
+	if (!have_nosuid && (lme->lme_flag & VFS_NOSETUID)) {
+		lxpr_append_mntopt(lme, ",nosuid");
+	}
+	if (!have_nodev && (lme->lme_flag & VFS_NODEVICES)) {
+		lxpr_append_mntopt(lme, ",nodevices");
+	}
+}
+
+static list_t *
+lxpr_enumerate_mounts(zone_t *zone)
+{
+	vfs_t *vfsp, *rvfsp, *vfslist;
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+	list_t *result;
+	lxpr_mount_entry_t *lme;
+	lx_virt_disk_t *vd;
+	uint_t root_id, mount_id;
+	char tmppath[MAXPATHLEN];
+
+	result = kmem_alloc(sizeof (list_t), KM_SLEEP);
+	list_create(result, sizeof (lxpr_mount_entry_t),
+	    offsetof(lxpr_mount_entry_t, lme_link));
+	/* use an arbitrary start value for the root mount_id */
+	root_id = 15;
+	mount_id = root_id + 1;
+
+	ASSERT(zone != global_zone);
+	ASSERT(lxzd != NULL);
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+
+	vfs_list_read_lock();
+	vfsp = vfslist = zone->zone_vfslist;
+
+	/*
+	 * If the zone has a root entry, it will be the first in the list.
+	 * Conjure one up if needed.
+	 */
+	if (vfslist == NULL || strcmp(refstr_value(vfsp->vfs_mntpt),
+	    zone->zone_rootpath) != 0) {
+		rvfsp = zone->zone_rootvp->v_vfsp;
+	} else {
+		rvfsp = vfslist;
+		vfsp = vfslist->vfs_zone_next;
+	}
+
+	lme = kmem_alloc(sizeof (lxpr_mount_entry_t), KM_SLEEP);
+	lme->lme_id = root_id;
+	lme->lme_parent_id = 0;
+	lme->lme_mntpt = refstr_alloc(zone->zone_rootpath);
+	lme->lme_flag = rvfsp->vfs_flag;
+	lme->lme_fstype = rvfsp->vfs_fstype;
+	lme->lme_force = B_TRUE;
+	lxpr_get_mntopts(rvfsp, lme);
+
+	lme->lme_resource = NULL;
+	vd = list_head(lxzd->lxzd_vdisks);
+	while (vd != NULL) {
+		if (vd->lxvd_type == LXVD_ZFS_DS &&
+		    vd->lxvd_real_dev == rvfsp->vfs_dev) {
+			(void) snprintf(tmppath, sizeof (tmppath),
+			    "%sdev/%s", zone->zone_rootpath, vd->lxvd_name);
+			lme->lme_resource = refstr_alloc(tmppath);
+			lme->lme_dev = vd->lxvd_emul_dev;
+			break;
+		}
+		vd = list_next(lxzd->lxzd_vdisks, vd);
+	}
+	if (lme->lme_resource == NULL) {
+		lme->lme_resource = refstr_alloc(zone->zone_rootpath);
+		lme->lme_dev = rvfsp->vfs_dev;
+	}
+	list_insert_head(result, lme);
+
+	do {
+		if (vfsp == NULL) {
+			break;
+		}
+		/* Skip mounts we shouldn't show */
+		if ((vfsp->vfs_flag & VFS_NOMNTTAB) != 0) {
+			vfsp = vfsp->vfs_zone_next;
+			continue;
+		}
+
+		lme = kmem_alloc(sizeof (lxpr_mount_entry_t), KM_SLEEP);
+		lme->lme_id = mount_id++;
+		lme->lme_parent_id = root_id;
+		lme->lme_mntpt = vfsp->vfs_mntpt;
+		refstr_hold(vfsp->vfs_mntpt);
+		lme->lme_flag = vfsp->vfs_flag;
+		lme->lme_fstype = vfsp->vfs_fstype;
+		lme->lme_force = B_FALSE;
+		lxpr_get_mntopts(vfsp, lme);
+
+		lme->lme_resource = NULL;
+		vd = list_head(lxzd->lxzd_vdisks);
+		while (vd != NULL) {
+			if (vd->lxvd_type == LXVD_ZFS_DS &&
+			    vd->lxvd_real_dev == vfsp->vfs_dev) {
+				char vdev[MAXPATHLEN];
+
+				(void) snprintf(vdev, sizeof (vdev),
+				    "%sdev/%s",
+				    zone->zone_rootpath, vd->lxvd_name);
+				lme->lme_resource = refstr_alloc(vdev);
+				lme->lme_dev = vd->lxvd_emul_dev;
+				break;
+			}
+			vd = list_next(lxzd->lxzd_vdisks, vd);
+		}
+		if (lme->lme_resource == NULL) {
+			lme->lme_resource = vfsp->vfs_resource;
+			refstr_hold(vfsp->vfs_resource);
+			lme->lme_dev = vfsp->vfs_dev;
+		}
+		list_insert_tail(result, lme);
+		vfsp = vfsp->vfs_zone_next;
+	} while (vfsp != vfslist);
+
+	vfs_list_unlock();
+
+	/* Add a single dummy entry for /native/usr */
+	lme = kmem_alloc(sizeof (lxpr_mount_entry_t), KM_SLEEP);
+	lme->lme_id = mount_id++;
+	lme->lme_parent_id = root_id;
+	lme->lme_flag = VFS_RDONLY;
+	lme->lme_dev = makedevice(0, 1);
+	(void) snprintf(tmppath, sizeof (tmppath),
+	    "%snative/usr", zone->zone_rootpath);
+	lme->lme_mntpt = refstr_alloc(tmppath);
+	lme->lme_resource = lme->lme_mntpt;
+	lme->lme_mntopts_len = 3;
+	lme->lme_mntopts = kmem_alloc(lme->lme_mntopts_len, KM_SLEEP);
+	(void) strlcpy(lme->lme_mntopts, "ro", lme->lme_mntopts_len);
+	refstr_hold(lme->lme_mntpt);
+	if (lxpr_zfs_fstype == -1) {
+		vfssw_t *zfssw = vfs_getvfssw("zfs");
+		VERIFY(zfssw != NULL);
+		lxpr_zfs_fstype = ((uintptr_t)zfssw - (uintptr_t)vfssw) /
+		    sizeof (vfssw[0]);
+		VERIFY(&vfssw[lxpr_zfs_fstype] == zfssw);
+	}
+	lme->lme_fstype = lxpr_zfs_fstype;
+	lme->lme_force = B_TRUE;
+	list_insert_tail(result, lme);
+
+	return (result);
+}
+
+/*
+ * lxpr_read_pid_mountinfo(): information about process mount points.
+ */
+static void
+lxpr_read_pid_mountinfo(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	list_t *mounts;
+	lxpr_mount_entry_t *lme;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_MOUNTINFO ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_MOUNTINFO);
+
+	mounts = lxpr_enumerate_mounts(zone);
+
+	/*
+	 * now we can run through what we've extracted without holding
+	 * vfs_list_read_lock()
+	 */
+	lme = (lxpr_mount_entry_t *)list_remove_head(mounts);
+	while (lme != NULL) {
+		char *resource, *mntpt, *fstype, *rwflag;
+		vnode_t *vp;
+		int error;
+
+		mntpt = (char *)refstr_value(lme->lme_mntpt);
+		resource = (char *)refstr_value(lme->lme_resource);
+
+		if (mntpt == NULL || mntpt[0] == '\0') {
+			goto nextp;
+		}
+		mntpt = ZONE_PATH_TRANSLATE(mntpt, zone);
+		error = lookupname(mntpt, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp);
+		if (error != 0) {
+			goto nextp;
+		} else if ((vp->v_flag & VROOT) == 0 && !lme->lme_force) {
+			VN_RELE(vp);
+			goto nextp;
+		}
+		VN_RELE(vp);
+
+		if (resource != NULL && resource[0] != '\0') {
+			if (resource[0] == '/') {
+				resource = ZONE_PATH_VISIBLE(resource, zone) ?
+				    ZONE_PATH_TRANSLATE(resource, zone) : mntpt;
+			}
+		} else {
+			resource = "none";
+		}
+
+		/*  Make things look more like Linux. */
+		fstype = vfssw[lme->lme_fstype].vsw_name;
+		if (lxpr_clean_mntent(&mntpt, &fstype, &resource) != 0 &&
+		    !lme->lme_force) {
+			goto nextp;
+		}
+		rwflag = ((lme->lme_flag & VFS_RDONLY) == 0) ? "rw" : "ro";
+
+		/*
+		 * XXX parent ID is not tracked correctly here. Currently we
+		 * always assume the parent ID is the root ID.
+		 */
+		lxpr_uiobuf_printf(uiobuf,
+		    "%d %d %d:%d / %s %s - %s %s %s\n",
+		    lme->lme_id, lme->lme_parent_id,
+		    getmajor(lme->lme_dev), getminor(lme->lme_dev),
+		    mntpt, rwflag, fstype, resource, lme->lme_mntopts);
+
+nextp:
+		refstr_rele(lme->lme_mntpt);
+		refstr_rele(lme->lme_resource);
+		kmem_free(lme->lme_mntopts, lme->lme_mntopts_len);
+		kmem_free(lme, sizeof (lxpr_mount_entry_t));
+		lme = (lxpr_mount_entry_t *)list_remove_head(mounts);
+	}
+
+	list_destroy(mounts);
+	kmem_free(mounts, sizeof (list_t));
+}
+
+/*
+ * lxpr_read_pid_oom_scr_adj(): read oom_score_adj for process
+ */
+static void
+lxpr_read_pid_oom_scr_adj(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_OOM_SCR_ADJ ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_OOM_SCR_ADJ);
+
+	p = lxpr_lock(lxpnp, ZOMB_OK);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+	lxpr_unlock(p);
+
+	/* always 0 */
+	lxpr_uiobuf_printf(uiobuf, "0\n");
+}
+
+/*
+ * lxpr_read_pid_personality(): read personality for process
+ */
+static void
+lxpr_read_pid_personality(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	lx_proc_data_t *lxpd;
+	unsigned int personality;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_PERSONALITY);
+
+	p = lxpr_lock(lxpnp, ZOMB_OK);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+	if ((lxpd = ptolxproc(p)) != NULL) {
+		personality = lxpd->l_personality;
+	} else {
+		/* Report native processes as having the SunOS personality */
+		personality = LX_PER_SUNOS;
+	}
+	lxpr_unlock(p);
+
+	lxpr_uiobuf_printf(uiobuf, "%08x\n", personality);
+}
+
+/*
+ * lxpr_read_pid_statm(): memory status file
+ */
+static void
+lxpr_read_pid_statm(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	struct as *as;
+	size_t vsize, rss;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_STATM ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_STATM);
+
+	p = lxpr_lock(lxpnp, ZOMB_OK);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	as = p->p_as;
+	mutex_exit(&p->p_lock);
+	if (as != &kas) {
+		AS_LOCK_ENTER(as, RW_READER);
+		vsize = btopr(as->a_resvsize);
+		rss = rm_asrss(as);
+		AS_LOCK_EXIT(as);
+	} else {
+		vsize = 0;
+		rss = 0;
+	}
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%lu %lu %lu %lu %lu %lu %lu\n",
+	    vsize, rss, 0l, rss, 0l, 0l, 0l);
+}
+
+/*
+ * Determine number of LWPs visible in the process. In particular we want to
+ * ignore aio in-kernel threads.
+ */
+static uint_t
+lxpr_count_tasks(proc_t *p)
+{
+	uint_t cnt = 0;
+	kthread_t *t;
+
+	if ((p->p_stat == SZOMB) || (p->p_flag & (SSYS | SEXITING)) ||
+	    (p->p_as == &kas)) {
+		return (0);
+	}
+
+	if (p->p_brand != &lx_brand || (t = p->p_tlist) == NULL) {
+		cnt = p->p_lwpcnt;
+	} else {
+		do {
+			lx_lwp_data_t *lwpd = ttolxlwp(t);
+			/* Don't count aio kernel worker threads */
+			if ((t->t_proc_flag & TP_KTHREAD) != 0 &&
+			    lwpd != NULL &&
+			    (lwpd->br_lwp_flags & BR_AIO_LWP) == 0) {
+				cnt++;
+			}
+
+			t = t->t_forw;
+		} while (t != p->p_tlist);
+	}
+
+	return (cnt);
+}
+
+/*
+ * pid/tid common code to read status file
+ */
+static void
+lxpr_read_status_common(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf,
+    uint_t lookup_id)
+{
+	proc_t		*p;
+	kthread_t	*t;
+	user_t		*up;
+	cred_t		*cr;
+	const gid_t	*groups;
+	struct as	*as;
+	char		*status;
+	pid_t		pid, ppid;
+	pid_t		tid = (lookup_id == 0) ? lxpnp->lxpr_pid : lookup_id;
+	k_sigset_t	current, ignore, handle;
+	int		i, lx_sig, lwpcnt, ngroups;
+	char		buf_comm[MAXCOMLEN + 1];
+	rlim64_t	fdlim;
+	size_t		vsize = 0, nlocked = 0, rss = 0, stksize = 0;
+	boolean_t	printsz = B_FALSE;
+
+
+	p = lxpr_lock_pid(lxpnp, tid, ZOMB_OK, &t);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	/* Translate the pid (e.g. initpid to 1) */
+	lxpr_fixpid(LXPTOZ(lxpnp), p, &pid, &ppid);
+
+	if (t != NULL) {
+		thread_lock(t);
+		switch (t->t_state) {
+		case TS_SLEEP:
+			status = "S (sleeping)";
+			break;
+		case TS_RUN:
+		case TS_ONPROC:
+			status = "R (running)";
+			break;
+		case TS_ZOMB:
+			status = "Z (zombie)";
+			break;
+		case TS_STOPPED:
+			status = "T (stopped)";
+			break;
+		default:
+			status = "! (unknown)";
+			break;
+		}
+		thread_unlock(t);
+	} else {
+		if (lookup_id != 0) {
+			/* we can't find this specific thread */
+			lxpr_uiobuf_seterr(uiobuf, EINVAL);
+			lxpr_unlock(p);
+			return;
+		}
+
+		/*
+		 * there is a hole in the exit code, where a proc can have
+		 * no threads but it is yet to be flagged SZOMB. We will
+		 * assume we are about to become a zombie
+		 */
+		status = "Z (zombie)";
+	}
+
+	up = PTOU(p);
+	mutex_enter(&p->p_crlock);
+	crhold(cr = p->p_cred);
+	mutex_exit(&p->p_crlock);
+
+	(void) strlcpy(buf_comm, up->u_comm, sizeof (buf_comm));
+	fdlim = p->p_fno_ctl;
+	lwpcnt = lxpr_count_tasks(p);
+
+	/*
+	 * Gather memory information
+	 */
+	as = p->p_as;
+	if ((p->p_stat != SZOMB) && !(p->p_flag & (SSYS | SEXITING)) &&
+	    (as != &kas)) {
+		mutex_exit(&p->p_lock);
+		AS_LOCK_ENTER(as, RW_READER);
+		vsize = as->a_resvsize;
+		rss = rm_asrss(as);
+		AS_LOCK_EXIT(as);
+		mutex_enter(&p->p_lock);
+
+		nlocked = p->p_locked_mem;
+		stksize = p->p_stksize;
+		printsz = B_TRUE;
+	}
+
+	/*
+	 * Gather signal information
+	 */
+	sigemptyset(&current);
+	sigemptyset(&ignore);
+	sigemptyset(&handle);
+	for (i = 1; i < NSIG; i++) {
+		lx_sig = stol_signo[i];
+
+		if ((lx_sig > 0) && (lx_sig <= LX_NSIG)) {
+			if (sigismember(&p->p_sig, i))
+				sigaddset(&current, lx_sig);
+
+			if (up->u_signal[i - 1] == SIG_IGN)
+				sigaddset(&ignore, lx_sig);
+			else if (up->u_signal[i - 1] != SIG_DFL)
+				sigaddset(&handle, lx_sig);
+		}
+	}
+	lxpr_unlock(p);
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "Name:\t%s\n"
+	    "State:\t%s\n"
+	    "Tgid:\t%d\n"
+	    "Pid:\t%d\n"
+	    "PPid:\t%d\n"
+	    "TracerPid:\t%d\n"
+	    "Uid:\t%u\t%u\t%u\t%u\n"
+	    "Gid:\t%u\t%u\t%u\t%u\n"
+	    "FDSize:\t%d\n"
+	    "Groups:\t",
+	    buf_comm,
+	    status,
+	    pid, /* thread group id - same as pid */
+	    (lookup_id == 0) ? pid : lxpnp->lxpr_desc,
+	    ppid,
+	    0,
+	    crgetruid(cr), crgetuid(cr), crgetsuid(cr), crgetuid(cr),
+	    crgetrgid(cr), crgetgid(cr), crgetsgid(cr), crgetgid(cr),
+	    fdlim);
+	ngroups = crgetngroups(cr);
+	groups  = crgetgroups(cr);
+	for (i = 0; i < ngroups; i++) {
+		lxpr_uiobuf_printf(uiobuf,
+		    "%u ",
+		    groups[i]);
+	}
+	crfree(cr);
+	if (printsz) {
+		lxpr_uiobuf_printf(uiobuf,
+		    "\n"
+		    "VmSize:\t%8lu kB\n"
+		    "VmLck:\t%8lu kB\n"
+		    "VmRSS:\t%8lu kB\n"
+		    "VmData:\t%8lu kB\n"
+		    "VmStk:\t%8lu kB\n"
+		    "VmExe:\t%8lu kB\n"
+		    "VmLib:\t%8lu kB",
+		    btok(vsize),
+		    btok(nlocked),
+		    ptok(rss),
+		    0l,
+		    btok(stksize),
+		    ptok(rss),
+		    0l);
+	}
+	lxpr_uiobuf_printf(uiobuf, "\nThreads:\t%u\n", lwpcnt);
+	lxpr_uiobuf_printf(uiobuf,
+	    "SigPnd:\t%08x%08x\n"
+	    "SigBlk:\t%08x%08x\n"
+	    "SigIgn:\t%08x%08x\n"
+	    "SigCgt:\t%08x%08x\n",
+	    current.__sigbits[1], current.__sigbits[0],
+	    0, 0, /* signals blocked on per thread basis */
+	    ignore.__sigbits[1], ignore.__sigbits[0],
+	    handle.__sigbits[1], handle.__sigbits[0]);
+	/* Report only the full bounding set for now */
+	lxpr_uiobuf_printf(uiobuf,
+	    "CapInh:\t%016x\n"
+	    "CapPrm:\t%016x\n"
+	    "CapEff:\t%016x\n"
+	    "CapBnd:\t%016llx\n",
+	    0, 0, 0, 0x1fffffffffLL);
+}
+
+/*
+ * lxpr_read_pid_tid_status(): status file
+ */
+static void
+lxpr_read_pid_tid_status(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_STATUS ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_STATUS);
+
+	lxpr_read_status_common(lxpnp, uiobuf, lxpnp->lxpr_desc);
+}
+
+/*
+ * Same logic as the lx devfs lxd_pts_devt_translator.
+ */
+static dev_t
+lxpr_xlate_pts_dev(dev_t dev)
+{
+	minor_t min = getminor(dev);
+	int lx_maj, lx_min;
+
+	lx_maj = LX_PTS_MAJOR_MIN + (min / LX_MAXMIN);
+	lx_min = min % LX_MAXMIN;
+
+	return (LX_MAKEDEVICE(lx_maj, lx_min));
+}
+
+/*
+ * pid/tid common code to read stat file
+ */
+static void
+lxpr_read_pid_tid_stat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	kthread_t *t;
+	struct as *as;
+	zone_t *zone;
+	char stat;
+	pid_t pid, ppid, pgpid, spid, tid;
+	gid_t psgid;
+	dev_t psdev;
+	size_t rss, vsize;
+	int nice, pri, lwpcnt;
+	caddr_t wchan, stackbase;
+	processorid_t cpu;
+	clock_t utime, stime, cutime, cstime, ticks, boottime;
+	char buf_comm[MAXCOMLEN + 1];
+	rlim64_t vmem_ctl;
+	int exit_signal = -1;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_STAT ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_STAT);
+
+	zone = LXPTOZ(lxpnp);
+	tid = (lxpnp->lxpr_desc == 0) ? lxpnp->lxpr_pid : lxpnp->lxpr_desc;
+	p = lxpr_lock_pid(lxpnp, tid, ZOMB_OK, &t);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	/* Set Linux defaults if we're the zone's init process */
+	pid = p->p_pid;
+	lxpr_fixpid(zone, p, &pid, &ppid);
+	if (pid == 1) {
+		/* init process */
+		pgpid = 0;
+		psgid = (gid_t)-1;
+		spid = 0;
+		psdev = 0;
+	} else {
+		pgpid = p->p_pgrp;
+		mutex_enter(&p->p_splock);
+		mutex_enter(&p->p_sessp->s_lock);
+		spid = p->p_sessp->s_sid;
+		psdev = lxpr_xlate_pts_dev(p->p_sessp->s_dev);
+		if (p->p_sessp->s_cred)
+			psgid = crgetgid(p->p_sessp->s_cred);
+		else
+			psgid = crgetgid(p->p_cred);
+
+		mutex_exit(&p->p_sessp->s_lock);
+		mutex_exit(&p->p_splock);
+	}
+
+	if ((p->p_stat == SZOMB) || (p->p_flag & (SSYS | SEXITING)) ||
+	    (p->p_as == &kas)) {
+		stackbase = 0;
+	} else {
+		/* from prgetstackbase() */
+		stackbase = p->p_usrstack - p->p_stksize;
+	}
+
+	utime = stime = 0;
+	if (t != NULL) {
+		klwp_t *lwp = ttolwp(t);
+		hrtime_t utm = 0, stm = 0;
+
+		/*
+		 * For field 38 (the exit signal), some apps explicitly use
+		 * this field in a check to distinguish processes from threads,
+		 * and assume only processes have a valid signal in this field!
+		 */
+		if (t->t_tid == 1) {
+			lx_proc_data_t *lxpd = ptolxproc(p);
+
+			if (lxpd != NULL) {
+				exit_signal = lxpd->l_signal;
+			} else {
+				exit_signal = SIGCHLD;
+			}
+		}
+
+		thread_lock(t);
+		switch (t->t_state) {
+		case TS_SLEEP:
+			stat = 'S';
+			break;
+		case TS_RUN:
+		case TS_ONPROC:
+			stat = 'R';
+			break;
+		case TS_ZOMB:
+			stat = 'Z';
+			break;
+		case TS_STOPPED:
+			stat = 'T';
+			break;
+		default:
+			stat = '!';
+			break;
+		}
+
+		if (CL_DONICE(t, NULL, 0, &nice) != 0)
+			nice = 0;
+
+		pri = t->t_pri;
+		wchan = t->t_wchan;
+		cpu = t->t_cpu->cpu_id;
+
+		if (lwp != NULL) {
+			struct mstate *ms = &lwp->lwp_mstate;
+
+			utm = ms->ms_acct[LMS_USER];
+			stm = ms->ms_acct[LMS_SYSTEM];
+
+			/* convert unscaled high-res time to nanoseconds */
+			scalehrtime(&utm);
+			scalehrtime(&stm);
+		}
+
+		thread_unlock(t);
+
+		/* Linux /proc expects these values in ticks */
+		utime = (clock_t)NSEC_TO_TICK(utm);
+		stime = (clock_t)NSEC_TO_TICK(stm);
+	} else {
+		/* Only zombies have no threads */
+		stat = 'Z';
+		nice = 0;
+		pri = 0;
+		wchan = 0;
+		cpu = 0;
+	}
+	as = p->p_as;
+	mutex_exit(&p->p_lock);
+	if (as != &kas) {
+		AS_LOCK_ENTER(as, RW_READER);
+		vsize = as->a_resvsize;
+		rss = rm_asrss(as);
+		AS_LOCK_EXIT(as);
+	} else {
+		vsize = 0;
+		rss = 0;
+	}
+	mutex_enter(&p->p_lock);
+
+	if (tid == p->p_pid) {
+		/* process */
+		utime = p->p_utime;
+		stime = p->p_stime;
+	} else {
+		/* tid: utime & stime for the thread set in block above */
+		/* EMPTY */
+	}
+	cutime = p->p_cutime;
+	cstime = p->p_cstime;
+	lwpcnt = lxpr_count_tasks(p);
+	vmem_ctl = p->p_vmem_ctl;
+	(void) strlcpy(buf_comm, p->p_user.u_comm, sizeof (buf_comm));
+	ticks = p->p_user.u_ticks;	/* lbolt at process start */
+	/* adjust ticks to account for zone boot time */
+	boottime = zone->zone_zsched->p_user.u_ticks;
+	ticks -= boottime;
+	lxpr_unlock(p);
+
+	/* Adjust hz for relevant fields */
+	utime = HZ_TO_LX_USERHZ(utime);
+	stime = HZ_TO_LX_USERHZ(stime);
+	cutime = HZ_TO_LX_USERHZ(cutime);
+	cstime = HZ_TO_LX_USERHZ(cstime);
+	ticks = HZ_TO_LX_USERHZ(ticks);
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%d "					/* 1 */
+	    "(%s) %c %d %d %d %d %d "			/* 2-8 */
+	    "%lu %lu %lu %lu %lu "			/* 9-13 */
+	    "%lu %lu %ld %ld "				/* 14-17 */
+	    "%d %d %d "					/* 18-20 */
+	    "%lu "					/* 21 */
+	    "%lu "					/* 22 */
+	    "%lu %ld %llu "				/* 23-25 */
+	    "%lu %lu %llu "				/* 26-28 */
+	    "%lu %lu "					/* 29-30 */
+	    "%lu %lu %lu %lu "				/* 31-34 */
+	    "%lu "					/* 35 */
+	    "%lu %lu "					/* 36-37 */
+	    "%d "					/* 38 */
+	    "%d"					/* 39 */
+	    "\n",
+	    tid,					/* 1 */
+	    buf_comm, stat, ppid, pgpid, spid, psdev, psgid, /* 2-8 */
+	    0l, 0l, 0l, 0l, 0l, /* flags, minflt, cminflt, majflt, cmajflt */
+	    utime, stime, cutime, cstime,		/* 14-17 */
+	    pri, nice, lwpcnt,				/* 18-20 */
+	    0l, /* itrealvalue (time before next SIGALRM) 21 */
+	    ticks,					/* 22 */
+	    vsize, rss, vmem_ctl,			/* 23-25 */
+	    0l, 0l, stackbase, /* startcode, endcode, startstack 26-28 */
+	    0l, 0l,				/* kstkesp, kstkeip 29-30 */
+	    0l, 0l, 0l, 0l, /* signal, blocked, sigignore, sigcatch 31-34 */
+	    wchan,					/* 35 */
+	    0l, 0l,					/* nswap,cnswap 36-37 */
+	    exit_signal,				/* exit_signal	38 */
+	    cpu						/* 39 */);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_arp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+struct lxpr_ifstat {
+	uint64_t rx_bytes;
+	uint64_t rx_packets;
+	uint64_t rx_errors;
+	uint64_t rx_drop;
+	uint64_t tx_bytes;
+	uint64_t tx_packets;
+	uint64_t tx_errors;
+	uint64_t tx_drop;
+	uint64_t collisions;
+	uint64_t rx_multicast;
+};
+
+static void *
+lxpr_kstat_read(kstat_t *kn, boolean_t byname, size_t *size, int *num,
+    zoneid_t zoneid)
+{
+	kstat_t *kp;
+	int i, nrec = 0;
+	size_t bufsize;
+	void *buf = NULL;
+
+	if (byname == B_TRUE) {
+		kp = kstat_hold_byname(kn->ks_module, kn->ks_instance,
+		    kn->ks_name, zoneid);
+	} else {
+		kp = kstat_hold_bykid(kn->ks_kid, zoneid);
+	}
+	if (kp == NULL) {
+		return (NULL);
+	}
+	if (kp->ks_flags & KSTAT_FLAG_INVALID) {
+		kstat_rele(kp);
+		return (NULL);
+	}
+
+	bufsize = kp->ks_data_size + 1;
+	kstat_rele(kp);
+
+	/*
+	 * The kstat in question is released so that kmem_alloc(KM_SLEEP) is
+	 * performed without it held.  After the alloc, the kstat is reacquired
+	 * and its size is checked again. If the buffer is no longer large
+	 * enough, the alloc and check are repeated up to three times.
+	 */
+	for (i = 0; i < 2; i++) {
+		buf = kmem_alloc(bufsize, KM_SLEEP);
+
+		/* Check if bufsize still appropriate */
+		if (byname == B_TRUE) {
+			kp = kstat_hold_byname(kn->ks_module, kn->ks_instance,
+			    kn->ks_name, zoneid);
+		} else {
+			kp = kstat_hold_bykid(kn->ks_kid, zoneid);
+		}
+		if (kp == NULL || kp->ks_flags & KSTAT_FLAG_INVALID) {
+			if (kp != NULL) {
+				kstat_rele(kp);
+			}
+			kmem_free(buf, bufsize);
+			return (NULL);
+		}
+		KSTAT_ENTER(kp);
+		(void) KSTAT_UPDATE(kp, KSTAT_READ);
+		if (bufsize < kp->ks_data_size) {
+			kmem_free(buf, bufsize);
+			buf = NULL;
+			bufsize = kp->ks_data_size + 1;
+			KSTAT_EXIT(kp);
+			kstat_rele(kp);
+			continue;
+		} else {
+			if (KSTAT_SNAPSHOT(kp, buf, KSTAT_READ) != 0) {
+				kmem_free(buf, bufsize);
+				buf = NULL;
+			}
+			nrec = kp->ks_ndata;
+			KSTAT_EXIT(kp);
+			kstat_rele(kp);
+			break;
+		}
+	}
+
+	if (buf != NULL) {
+		*size = bufsize;
+		*num = nrec;
+	}
+	return (buf);
+}
+
+static int
+lxpr_kstat_ifstat(kstat_t *kn, struct lxpr_ifstat *ifs, zoneid_t zoneid)
+{
+	kstat_named_t *kp;
+	int i, num;
+	size_t size;
+
+	/*
+	 * Search by name instead of by kid since there's a small window to
+	 * race against kstats being added/removed.
+	 */
+	bzero(ifs, sizeof (*ifs));
+	kp = (kstat_named_t *)lxpr_kstat_read(kn, B_TRUE, &size, &num, zoneid);
+	if (kp == NULL)
+		return (-1);
+	for (i = 0; i < num; i++) {
+		if (strncmp(kp[i].name, "rbytes64", KSTAT_STRLEN) == 0)
+			ifs->rx_bytes = kp[i].value.ui64;
+		else if (strncmp(kp[i].name, "ipackets64", KSTAT_STRLEN) == 0)
+			ifs->rx_packets = kp[i].value.ui64;
+		else if (strncmp(kp[i].name, "ierrors", KSTAT_STRLEN) == 0)
+			ifs->rx_errors = kp[i].value.ui32;
+		else if (strncmp(kp[i].name, "norcvbuf", KSTAT_STRLEN) == 0)
+			ifs->rx_drop = kp[i].value.ui32;
+		else if (strncmp(kp[i].name, "multircv", KSTAT_STRLEN) == 0)
+			ifs->rx_multicast = kp[i].value.ui32;
+		else if (strncmp(kp[i].name, "obytes64", KSTAT_STRLEN) == 0)
+			ifs->tx_bytes = kp[i].value.ui64;
+		else if (strncmp(kp[i].name, "opackets64", KSTAT_STRLEN) == 0)
+			ifs->tx_packets = kp[i].value.ui64;
+		else if (strncmp(kp[i].name, "oerrors", KSTAT_STRLEN) == 0)
+			ifs->tx_errors = kp[i].value.ui32;
+		else if (strncmp(kp[i].name, "noxmtbuf", KSTAT_STRLEN) == 0)
+			ifs->tx_drop = kp[i].value.ui32;
+		else if (strncmp(kp[i].name, "collisions", KSTAT_STRLEN) == 0)
+			ifs->collisions = kp[i].value.ui32;
+	}
+	kmem_free(kp, size);
+	return (0);
+}
+
+static void
+lxpr_read_net_dev(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	kstat_t *ksr;
+	kstat_t ks0;
+	int i, nidx;
+	size_t sidx;
+	struct lxpr_ifstat ifs;
+	zoneid_t zoneid = LXPTOZ(lxpnp)->zone_id;
+
+	lxpr_uiobuf_printf(uiobuf, "Inter-|   Receive                   "
+	    "                             |  Transmit\n");
+	lxpr_uiobuf_printf(uiobuf, " face |bytes    packets errs drop fifo"
+	    " frame compressed multicast|bytes    packets errs drop fifo"
+	    " colls carrier compressed\n");
+
+	ks0.ks_kid = 0;
+	ksr = (kstat_t *)lxpr_kstat_read(&ks0, B_FALSE, &sidx, &nidx, zoneid);
+	if (ksr == NULL)
+		return;
+
+	for (i = 1; i < nidx; i++) {
+		if (strncmp(ksr[i].ks_module, "link", KSTAT_STRLEN) == 0 ||
+		    strncmp(ksr[i].ks_module, "lo", KSTAT_STRLEN) == 0) {
+			if (lxpr_kstat_ifstat(&ksr[i], &ifs, zoneid) != 0)
+				continue;
+
+			/* Overwriting the name is ok in the local snapshot */
+			lx_ifname_convert(ksr[i].ks_name, LX_IF_FROMNATIVE);
+			lxpr_uiobuf_printf(uiobuf, "%6s: %7llu %7llu %4lu "
+			    "%4lu %4u %5u %10u %9lu %8llu %7llu %4lu %4lu %4u "
+			    "%5lu %7u %10u\n",
+			    ksr[i].ks_name,
+			    ifs.rx_bytes, ifs.rx_packets,
+			    ifs.rx_errors, ifs.rx_drop,
+			    0, 0, 0, ifs.rx_multicast,
+			    ifs.tx_bytes, ifs.tx_packets,
+			    ifs.tx_errors, ifs.tx_drop,
+			    0, ifs.collisions, 0, 0);
+		}
+	}
+
+	kmem_free(ksr, sidx);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_dev_mcast(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+static void
+lxpr_inet6_out(const in6_addr_t *addr, char buf[33])
+{
+	const uint8_t *ip = addr->s6_addr;
+	char digits[] = "0123456789abcdef";
+	int i;
+	for (i = 0; i < 16; i++) {
+		buf[2 * i] = digits[ip[i] >> 4];
+		buf[2 * i + 1] = digits[ip[i] & 0xf];
+	}
+	buf[32] = '\0';
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_if_inet6(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	ip_stack_t *ipst;
+	ill_t *ill;
+	ipif_t *ipif;
+	ill_walk_context_t	ctx;
+	char ifname[LIFNAMSIZ], ip6out[33];
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return;
+	ipst = ns->netstack_ip;
+
+	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
+	ill = ILL_START_WALK_V6(&ctx, ipst);
+
+	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
+		for (ipif = ill->ill_ipif; ipif != NULL;
+		    ipif = ipif->ipif_next) {
+			uint_t index = ill->ill_phyint->phyint_ifindex;
+			int plen = ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
+			unsigned int scope = lx_ipv6_scope_convert(
+			    &ipif->ipif_v6lcl_addr);
+			/* Always report PERMANENT flag */
+			int flag = 0x80;
+
+			(void) snprintf(ifname, LIFNAMSIZ, "%s", ill->ill_name);
+			lx_ifname_convert(ifname, LX_IF_FROMNATIVE);
+			lxpr_inet6_out(&ipif->ipif_v6lcl_addr, ip6out);
+
+			lxpr_uiobuf_printf(uiobuf, "%32s %02x %02x %02x %02x"
+			    " %8s\n", ip6out, index, plen, scope, flag, ifname);
+		}
+	}
+	rw_exit(&ipst->ips_ill_g_lock);
+	netstack_rele(ns);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_igmp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_ip_mr_cache(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_ip_mr_vif(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+static void
+lxpr_format_route_ipv6(ire_t *ire, lxpr_uiobuf_t *uiobuf)
+{
+	uint32_t flags;
+	char name[IFNAMSIZ];
+	char ipv6addr[33];
+
+	lxpr_inet6_out(&ire->ire_addr_v6, ipv6addr);
+	lxpr_uiobuf_printf(uiobuf, "%s %02x ", ipv6addr,
+	    ip_mask_to_plen_v6(&ire->ire_mask_v6));
+
+	/* punt on this for now */
+	lxpr_uiobuf_printf(uiobuf, "%s %02x ",
+	    "00000000000000000000000000000000", 0);
+
+	lxpr_inet6_out(&ire->ire_gateway_addr_v6, ipv6addr);
+	lxpr_uiobuf_printf(uiobuf, "%s", ipv6addr);
+
+	flags = ire->ire_flags &
+	    (RTF_UP|RTF_GATEWAY|RTF_HOST|RTF_DYNAMIC|RTF_MODIFIED);
+	/* Linux's RTF_LOCAL equivalent */
+	if (ire->ire_metrics.iulp_local)
+		flags |= 0x80000000;
+
+	if (ire->ire_ill != NULL) {
+		ill_get_name(ire->ire_ill, name, sizeof (name));
+		lx_ifname_convert(name, LX_IF_FROMNATIVE);
+	} else {
+		name[0] = '\0';
+	}
+
+	lxpr_uiobuf_printf(uiobuf, " %08x %08x %08x %08x %8s\n",
+	    0, /* metric */
+	    ire->ire_refcnt,
+	    0,
+	    flags,
+	    name);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_ipv6_route(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	ip_stack_t *ipst;
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return;
+	ipst = ns->netstack_ip;
+
+	/*
+	 * LX branded zones are expected to have exclusive IP stack, hence
+	 * using ALL_ZONES as the zoneid filter.
+	 */
+	ire_walk_v6(&lxpr_format_route_ipv6, uiobuf, ALL_ZONES, ipst);
+
+	netstack_rele(ns);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_mcfilter(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_netstat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_raw(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+#define	LXPR_SKIP_ROUTE(type)	\
+	(((IRE_IF_CLONE | IRE_BROADCAST | IRE_MULTICAST | \
+	IRE_NOROUTE | IRE_LOOPBACK | IRE_LOCAL) & type) != 0)
+
+static void
+lxpr_format_route_ipv4(ire_t *ire, lxpr_uiobuf_t *uiobuf)
+{
+	uint32_t flags;
+	char name[IFNAMSIZ];
+	ill_t *ill;
+	ire_t *nire;
+	ipif_t *ipif;
+	ipaddr_t gateway;
+
+	if (LXPR_SKIP_ROUTE(ire->ire_type) || ire->ire_testhidden != 0)
+		return;
+
+	/* These route flags have direct Linux equivalents */
+	flags = ire->ire_flags &
+	    (RTF_UP|RTF_GATEWAY|RTF_HOST|RTF_DYNAMIC|RTF_MODIFIED);
+
+	/*
+	 * Search for a suitable IRE for naming purposes.
+	 * On Linux, the default route is typically associated with the
+	 * interface used to access gateway.  The default IRE on Illumos
+	 * typically lacks an ill reference but its parent might have one.
+	 */
+	nire = ire;
+	do {
+		ill = nire->ire_ill;
+		nire = nire->ire_dep_parent;
+	} while (ill == NULL && nire != NULL);
+	if (ill != NULL) {
+		ill_get_name(ill, name, sizeof (name));
+		lx_ifname_convert(name, LX_IF_FROMNATIVE);
+	} else {
+		name[0] = '*';
+		name[1] = '\0';
+	}
+
+	/*
+	 * Linux suppresses the gateway address for directly connected
+	 * interface networks.  To emulate this behavior, we walk all addresses
+	 * of a given route interface.  If one matches the gateway, it is
+	 * displayed as NULL.
+	 */
+	gateway = ire->ire_gateway_addr;
+	if ((ill = ire->ire_ill) != NULL) {
+		for (ipif = ill->ill_ipif; ipif != NULL;
+		    ipif = ipif->ipif_next) {
+			if (ipif->ipif_lcl_addr == gateway) {
+				gateway = 0;
+				break;
+			}
+		}
+	}
+
+	lxpr_uiobuf_printf(uiobuf, "%s\t%08X\t%08X\t%04X\t%d\t%u\t"
+	    "%d\t%08X\t%d\t%u\t%u\n",
+	    name,
+	    ire->ire_addr,
+	    gateway,
+	    flags, 0, 0,
+	    0, /* priority */
+	    ire->ire_mask,
+	    0, 0, /* mss, window */
+	    ire->ire_metrics.iulp_rtt);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_route(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	ip_stack_t *ipst;
+
+	lxpr_uiobuf_printf(uiobuf, "Iface\tDestination\tGateway \tFlags\t"
+	    "RefCnt\tUse\tMetric\tMask\t\tMTU\tWindow\tIRTT\n");
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return;
+	ipst = ns->netstack_ip;
+
+	/*
+	 * LX branded zones are expected to have exclusive IP stack, hence
+	 * using ALL_ZONES as the zoneid filter.
+	 */
+	ire_walk_v4(&lxpr_format_route_ipv4, uiobuf, ALL_ZONES, ipst);
+
+	netstack_rele(ns);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_rpc(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_rt_cache(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_sockstat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+typedef struct lxpr_snmp_table {
+	const char *lst_proto;
+	const char **lst_fields;
+} lxpr_snmp_table_t;
+
+static const char *lxpr_snmp_ip_fields[] = {
+	"forwarding", "defaultTTL", "inReceives", "inHdrErrors",
+	"inAddrErrors", "forwDatagrams", "inUnknownProtos", "inDiscards",
+	"inDelivers", "outRequests", "outDiscards", "outNoRoutes",
+	"reasmTimeout", "reasmReqds", "reasmOKs", "reasmFails", "fragOKs",
+	"fragFails", "fragCreates",
+	NULL
+};
+
+static const char *lxpr_snmp_icmp_fields[] = {
+	"inMsgs", "inErrors", "inCsumErrors", "inDestUnreachs", "inTimeExcds",
+	"inParmProbs", "inSrcQuenchs", "inRedirects", "inEchos", "inEchoReps",
+	"inTimestamps", "inTimestampReps", "inAddrMasks", "inAddrMaskReps",
+	"outMsgs", "outErrors", "outDestUnreachs", "outTimeExcds",
+	"outParmProbs", "outSrcQuenchs", "outRedirects", "outEchos",
+	"outEchoReps", "outTimestamps", "outTimestampReps", "outAddrMasks",
+	"outAddrMaskReps",
+	NULL
+};
+
+static const char *lxpr_snmp_tcp_fields[] = {
+	"rtoAlgorithm", "rtoMin", "rtoMax", "maxConn", "activeOpens",
+	"passiveOpens", "attemptFails", "estabResets", "currEstab", "inSegs",
+	"outSegs", "retransSegs", "inErrs", "outRsts", "inCsumErrors",
+	NULL
+};
+
+static const char *lxpr_snmp_udp_fields[] = {
+	"inDatagrams", "noPorts", "inErrors", "outDatagrams", "rcvbufErrors",
+	"sndbufErrors", "inCsumErrors",
+	NULL
+};
+
+static lxpr_snmp_table_t lxpr_snmp_ip = { "ip", lxpr_snmp_ip_fields };
+static lxpr_snmp_table_t lxpr_snmp_icmp = { "icmp", lxpr_snmp_icmp_fields };
+static lxpr_snmp_table_t lxpr_snmp_tcp = { "tcp", lxpr_snmp_tcp_fields };
+static lxpr_snmp_table_t lxpr_snmp_udp = { "udp", lxpr_snmp_udp_fields };
+
+static lxpr_snmp_table_t *lxpr_net_snmptab[] = {
+	&lxpr_snmp_ip,
+	&lxpr_snmp_icmp,
+	&lxpr_snmp_tcp,
+	&lxpr_snmp_udp,
+	NULL
+};
+
+static void
+lxpr_kstat_print_tab(lxpr_uiobuf_t *uiobuf, lxpr_snmp_table_t *table,
+    kstat_t *kn, zoneid_t zoneid)
+{
+	kstat_named_t *klist;
+	char upname[KSTAT_STRLEN], upfield[KSTAT_STRLEN];
+	int i, j, num;
+	size_t size;
+
+	klist = (kstat_named_t *)lxpr_kstat_read(kn, B_TRUE, &size, &num,
+	    zoneid);
+	if (klist == NULL)
+		return;
+
+	/* Print the header line, fields capitalized */
+	(void) strncpy(upname, table->lst_proto, KSTAT_STRLEN);
+	upname[0] = toupper(upname[0]);
+	lxpr_uiobuf_printf(uiobuf, "%s:", upname);
+	for (i = 0; table->lst_fields[i] != NULL; i++) {
+		(void) strncpy(upfield, table->lst_fields[i], KSTAT_STRLEN);
+		upfield[0] = toupper(upfield[0]);
+		lxpr_uiobuf_printf(uiobuf, " %s", upfield);
+	}
+	lxpr_uiobuf_printf(uiobuf, "\n%s:", upname);
+
+	/* Then loop back through to print the value line. */
+	for (i = 0; table->lst_fields[i] != NULL; i++) {
+		kstat_named_t *kpoint = NULL;
+		for (j = 0; j < num; j++) {
+			if (strncmp(klist[j].name, table->lst_fields[i],
+			    KSTAT_STRLEN) == 0) {
+				kpoint = &klist[j];
+				break;
+			}
+		}
+		if (kpoint == NULL) {
+			/* Output 0 for unknown fields */
+			lxpr_uiobuf_printf(uiobuf, " 0");
+		} else {
+			switch (kpoint->data_type) {
+			case KSTAT_DATA_INT32:
+				lxpr_uiobuf_printf(uiobuf, " %d",
+				    kpoint->value.i32);
+				break;
+			case KSTAT_DATA_UINT32:
+				lxpr_uiobuf_printf(uiobuf, " %u",
+				    kpoint->value.ui32);
+				break;
+			case KSTAT_DATA_INT64:
+				lxpr_uiobuf_printf(uiobuf, " %ld",
+				    kpoint->value.l);
+				break;
+			case KSTAT_DATA_UINT64:
+				lxpr_uiobuf_printf(uiobuf, " %lu",
+				    kpoint->value.ul);
+				break;
+			}
+		}
+	}
+	lxpr_uiobuf_printf(uiobuf, "\n");
+	kmem_free(klist, size);
+}
+
+static void
+lxpr_read_net_snmp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	kstat_t *ksr;
+	kstat_t ks0;
+	lxpr_snmp_table_t **table = lxpr_net_snmptab;
+	int i, t, nidx;
+	size_t sidx;
+	zoneid_t zoneid = LXPTOZ(lxpnp)->zone_id;
+
+	ks0.ks_kid = 0;
+	ksr = (kstat_t *)lxpr_kstat_read(&ks0, B_FALSE, &sidx, &nidx, zoneid);
+	if (ksr == NULL)
+		return;
+
+	for (t = 0; table[t] != NULL; t++) {
+		for (i = 0; i < nidx; i++) {
+			if (strncmp(ksr[i].ks_class, "mib2", KSTAT_STRLEN) != 0)
+				continue;
+			if (strncmp(ksr[i].ks_name, table[t]->lst_proto,
+			    KSTAT_STRLEN) == 0) {
+				lxpr_kstat_print_tab(uiobuf, table[t], &ksr[i],
+				    zoneid);
+				break;
+			}
+		}
+	}
+	kmem_free(ksr, sidx);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_stat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+static int
+lxpr_convert_tcp_state(int st)
+{
+	/*
+	 * Derived from the enum located in the Linux kernel sources:
+	 * include/net/tcp_states.h
+	 */
+	switch (st) {
+	case TCPS_ESTABLISHED:
+		return (1);
+	case TCPS_SYN_SENT:
+		return (2);
+	case TCPS_SYN_RCVD:
+		return (3);
+	case TCPS_FIN_WAIT_1:
+		return (4);
+	case TCPS_FIN_WAIT_2:
+		return (5);
+	case TCPS_TIME_WAIT:
+		return (6);
+	case TCPS_CLOSED:
+		return (7);
+	case TCPS_CLOSE_WAIT:
+		return (8);
+	case TCPS_LAST_ACK:
+		return (9);
+	case TCPS_LISTEN:
+		return (10);
+	case TCPS_CLOSING:
+		return (11);
+	default:
+		/* No translation for TCPS_IDLE, TCPS_BOUND or anything else */
+		return (0);
+	}
+}
+
+static void
+lxpr_format_tcp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf, ushort_t ipver)
+{
+	int i, sl = 0;
+	connf_t *connfp;
+	conn_t *connp;
+	netstack_t *ns;
+	ip_stack_t *ipst;
+	int sonode_shift;
+
+	ASSERT(ipver == IPV4_VERSION || ipver == IPV6_VERSION);
+	if (ipver == IPV4_VERSION) {
+		lxpr_uiobuf_printf(uiobuf, "  sl  local_address rem_address   "
+		    "st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout "
+		    "inode\n");
+	} else {
+		lxpr_uiobuf_printf(uiobuf, "  sl  "
+		    "local_address                         "
+		    "remote_address                        "
+		    "st tx_queue rx_queue tr tm->when retrnsmt   "
+		    "uid  timeout inode\n");
+	}
+	/*
+	 * Due to differences between the Linux and illumos TCP
+	 * implementations, some data will be omitted from the output here.
+	 *
+	 * Valid fields:
+	 *  - local_address
+	 *  - remote_address
+	 *  - st
+	 *  - tx_queue
+	 *  - rx_queue
+	 *  - uid
+	 *  - inode
+	 *
+	 * Omitted/invalid fields
+	 *  - tr
+	 *  - tm->when
+	 *  - retrnsmt
+	 *  - timeout
+	 */
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return;
+	ipst = ns->netstack_ip;
+
+	sonode_shift = highbit(sizeof (sonode_t));
+
+	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
+		connfp = &ipst->ips_ipcl_globalhash_fanout[i];
+		connp = NULL;
+		while ((connp =
+		    ipcl_get_next_conn(connfp, connp, IPCL_TCPCONN)) != NULL) {
+			tcp_t *tcp;
+			ino_t inode;
+			sonode_t *so = (sonode_t *)connp->conn_upper_handle;
+			if (connp->conn_ipversion != ipver)
+				continue;
+			tcp = connp->conn_tcp;
+			if (ipver == IPV4_VERSION) {
+				lxpr_uiobuf_printf(uiobuf,
+				    "%4d: %08X:%04X %08X:%04X ",
+				    ++sl,
+				    connp->conn_laddr_v4,
+				    ntohs(connp->conn_lport),
+				    connp->conn_faddr_v4,
+				    ntohs(connp->conn_fport));
+			} else {
+				lxpr_uiobuf_printf(uiobuf, "%4d: "
+				    "%08X%08X%08X%08X:%04X "
+				    "%08X%08X%08X%08X:%04X ",
+				    ++sl,
+				    connp->conn_laddr_v6.s6_addr32[0],
+				    connp->conn_laddr_v6.s6_addr32[1],
+				    connp->conn_laddr_v6.s6_addr32[2],
+				    connp->conn_laddr_v6.s6_addr32[3],
+				    ntohs(connp->conn_lport),
+				    connp->conn_faddr_v6.s6_addr32[0],
+				    connp->conn_faddr_v6.s6_addr32[1],
+				    connp->conn_faddr_v6.s6_addr32[2],
+				    connp->conn_faddr_v6.s6_addr32[3],
+				    ntohs(connp->conn_fport));
+			}
+
+			/*
+			 * We cannot use VOP_GETATTR here to fetch the
+			 * simulated inode for the socket via the
+			 * so->so_vnode. This is because there is a (very
+			 * tight) race for when the v_vfsp is set on the
+			 * sonode's vnode. However, all we really want here is
+			 * the inode number, which we can compute using the
+			 * same algorithm as socket_vop_getattr.
+			 */
+			inode = ((ino_t)so >> sonode_shift) & 0xFFFF;
+
+			lxpr_uiobuf_printf(uiobuf,
+			    "%02X %08X:%08X %02X:%08X %08X "
+			    "%5u %8d %lu %d %p %u %u %u %u %d\n",
+			    lxpr_convert_tcp_state(tcp->tcp_state),
+			    tcp->tcp_rcv_cnt, tcp->tcp_unsent, /* rx/tx queue */
+			    0, 0, /* tr, when */
+			    0, /* per-connection rexmits aren't tracked today */
+			    connp->conn_cred->cr_uid,
+			    0, /* timeout */
+			    /* inode + more */
+			    inode, 0, NULL, 0, 0, 0, 0, 0);
+		}
+	}
+	netstack_rele(ns);
+}
+
+static void
+lxpr_read_net_tcp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_format_tcp(lxpnp, uiobuf, IPV4_VERSION);
+}
+
+static void
+lxpr_read_net_tcp6(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_format_tcp(lxpnp, uiobuf, IPV6_VERSION);
+}
+
+static void
+lxpr_format_udp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf, ushort_t ipver)
+{
+	int i, sl = 0;
+	connf_t *connfp;
+	conn_t *connp;
+	netstack_t *ns;
+	ip_stack_t *ipst;
+	int sonode_shift;
+
+	ASSERT(ipver == IPV4_VERSION || ipver == IPV6_VERSION);
+	if (ipver == IPV4_VERSION) {
+		lxpr_uiobuf_printf(uiobuf, "  sl  local_address rem_address"
+		    "   st tx_queue rx_queue tr tm->when retrnsmt   uid"
+		    "  timeout inode ref pointer drops\n");
+	} else {
+		lxpr_uiobuf_printf(uiobuf, "  sl  "
+		    "local_address                         "
+		    "remote_address                        "
+		    "st tx_queue rx_queue tr tm->when retrnsmt   "
+		    "uid  timeout inode ref pointer drops\n");
+	}
+	/*
+	 * Due to differences between the Linux and illumos UDP
+	 * implementations, some data will be omitted from the output here.
+	 *
+	 * Valid fields:
+	 *  - local_address
+	 *  - remote_address
+	 *  - st: limited
+	 *  - uid
+	 *
+	 * Omitted/invalid fields
+	 *  - tx_queue
+	 *  - rx_queue
+	 *  - tr
+	 *  - tm->when
+	 *  - retrnsmt
+	 *  - timeout
+	 *  - inode
+	 */
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return;
+	ipst = ns->netstack_ip;
+
+	sonode_shift = highbit(sizeof (sonode_t));
+
+	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
+		connfp = &ipst->ips_ipcl_globalhash_fanout[i];
+		connp = NULL;
+		while ((connp =
+		    ipcl_get_next_conn(connfp, connp, IPCL_UDPCONN)) != NULL) {
+			udp_t *udp;
+			ino_t inode;
+			int state = 0;
+			sonode_t *so = (sonode_t *)connp->conn_upper_handle;
+			if (connp->conn_ipversion != ipver)
+				continue;
+			udp = connp->conn_udp;
+			if (ipver == IPV4_VERSION) {
+				lxpr_uiobuf_printf(uiobuf,
+				    "%4d: %08X:%04X %08X:%04X ",
+				    ++sl,
+				    connp->conn_laddr_v4,
+				    ntohs(connp->conn_lport),
+				    connp->conn_faddr_v4,
+				    ntohs(connp->conn_fport));
+			} else {
+				lxpr_uiobuf_printf(uiobuf, "%4d: "
+				    "%08X%08X%08X%08X:%04X "
+				    "%08X%08X%08X%08X:%04X ",
+				    ++sl,
+				    connp->conn_laddr_v6.s6_addr32[0],
+				    connp->conn_laddr_v6.s6_addr32[1],
+				    connp->conn_laddr_v6.s6_addr32[2],
+				    connp->conn_laddr_v6.s6_addr32[3],
+				    ntohs(connp->conn_lport),
+				    connp->conn_faddr_v6.s6_addr32[0],
+				    connp->conn_faddr_v6.s6_addr32[1],
+				    connp->conn_faddr_v6.s6_addr32[2],
+				    connp->conn_faddr_v6.s6_addr32[3],
+				    ntohs(connp->conn_fport));
+			}
+
+			switch (udp->udp_state) {
+			case TS_UNBND:
+			case TS_IDLE:
+				state = 7;
+				break;
+			case TS_DATA_XFER:
+				state = 1;
+				break;
+			}
+
+			/*
+			 * We cannot use VOP_GETATTR here to fetch the
+			 * simulated inode for the socket via the
+			 * so->so_vnode. This is because there is a (very
+			 * tight) race for when the v_vfsp is set on the
+			 * sonode's vnode. However, all we really want here is
+			 * the inode number, which we can compute using the
+			 * same algorithm as socket_vop_getattr.
+			 */
+			inode = ((ino_t)so >> sonode_shift) & 0xFFFF;
+
+			lxpr_uiobuf_printf(uiobuf,
+			    "%02X %08X:%08X %02X:%08X %08X "
+			    "%5u %8d %lu %d %p %d\n",
+			    state,
+			    0, 0, /* rx/tx queue */
+			    0, 0, /* tr, when */
+			    0, /* retrans */
+			    connp->conn_cred->cr_uid,
+			    0, /* timeout */
+			    /* inode, ref, pointer, drops */
+			    inode, 0, NULL, 0);
+		}
+	}
+	netstack_rele(ns);
+}
+
+static void
+lxpr_read_net_udp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_format_udp(lxpnp, uiobuf, IPV4_VERSION);
+}
+
+static void
+lxpr_read_net_udp6(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_format_udp(lxpnp, uiobuf, IPV6_VERSION);
+}
+
+static void
+lxpr_read_net_unix(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	sonode_t *so;
+	zoneid_t zoneid = LXPTOZ(lxpnp)->zone_id;
+
+	lxpr_uiobuf_printf(uiobuf, "Num       RefCount Protocol Flags    Type "
+	    "St Inode Path\n");
+
+	mutex_enter(&socklist.sl_lock);
+	for (so = socklist.sl_list; so != NULL;
+	    so = _SOTOTPI(so)->sti_next_so) {
+		vnode_t *vp = so->so_vnode;
+		vattr_t attr;
+		sotpi_info_t *sti;
+		const char *name = NULL;
+		int status = 0;
+		int type = 0;
+		int flags = 0;
+
+		/* Only process active sonodes in this zone */
+		if (so->so_count == 0 || so->so_zoneid != zoneid)
+			continue;
+
+		/*
+		 * Grab the inode, if possible.
+		 * This must be done before entering so_lock.
+		 */
+		if (vp == NULL ||
+		    VOP_GETATTR(vp, &attr, 0, CRED(), NULL) != 0)
+			attr.va_nodeid = 0;
+
+		mutex_enter(&so->so_lock);
+		sti = _SOTOTPI(so);
+
+		if (sti->sti_laddr_sa != NULL &&
+		    sti->sti_laddr_len > 0) {
+			name = sti->sti_laddr_sa->sa_data;
+		} else if (sti->sti_faddr_sa != NULL &&
+		    sti->sti_faddr_len > 0) {
+			name = sti->sti_faddr_sa->sa_data;
+		}
+
+		/*
+		 * Derived from enum values in Linux kernel source:
+		 * include/uapi/linux/net.h
+		 */
+		if ((so->so_state & SS_ISDISCONNECTING) != 0) {
+			status = 4;
+		} else if ((so->so_state & SS_ISCONNECTING) != 0) {
+			status = 2;
+		} else if ((so->so_state & SS_ISCONNECTED) != 0) {
+			status = 3;
+		} else {
+			status = 1;
+			/* Add ACC flag for stream-type server sockets */
+			if (so->so_type != SOCK_DGRAM &&
+			    sti->sti_laddr_sa != NULL)
+				flags |= 0x10000;
+		}
+
+		/* Convert to Linux type */
+		switch (so->so_type) {
+		case SOCK_DGRAM:
+			type = 2;
+			break;
+		case SOCK_SEQPACKET:
+			type = 5;
+			break;
+		default:
+			type = 1;
+		}
+
+		lxpr_uiobuf_printf(uiobuf, "%p: %08X %08X %08X %04X %02X %5llu",
+		    so,
+		    so->so_count,
+		    0, /* proto, always 0 */
+		    flags,
+		    type,
+		    status,
+		    (ino_t)attr.va_nodeid);
+
+		/*
+		 * Due to shortcomings in the abstract socket emulation, they
+		 * cannot be properly represented here (as @<path>).
+		 *
+		 * This will be the case until they are better implemented.
+		 */
+		if (name != NULL)
+			lxpr_uiobuf_printf(uiobuf, " %s\n", name);
+		else
+			lxpr_uiobuf_printf(uiobuf, "\n");
+		mutex_exit(&so->so_lock);
+	}
+	mutex_exit(&socklist.sl_lock);
+}
+
+/*
+ * lxpr_read_kmsg(): read the contents of the kernel message queue. We
+ * translate this into the reception of console messages for this zone; each
+ * read copies out a single zone console message, or blocks until the next one
+ * is produced, unless we're open non-blocking, in which case we return after
+ * 1ms.
+ */
+
+#define	LX_KMSG_PRI	"<0>"
+
+/* ARGSUSED */
+static void
+lxpr_read_kmsg(lxpr_node_t *lxpnp, struct lxpr_uiobuf *uiobuf, ldi_handle_t lh)
+{
+	mblk_t		*mp;
+	timestruc_t	to;
+	timestruc_t	*tp = NULL;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_KMSG);
+
+	if (lxpr_uiobuf_nonblock(uiobuf)) {
+		to.tv_sec = 0;
+		to.tv_nsec = 1000000; /* 1msec */
+		tp = &to;
+	}
+
+	if (ldi_getmsg(lh, &mp, tp) == 0) {
+		/*
+		 * lx procfs doesn't like successive reads to the same file
+		 * descriptor unless we do an explicit rewind each time.
+		 */
+		lxpr_uiobuf_seek(uiobuf, 0);
+
+		lxpr_uiobuf_printf(uiobuf, "%s%s", LX_KMSG_PRI,
+		    mp->b_cont->b_rptr);
+
+		freemsg(mp);
+	}
+}
+
+/*
+ * lxpr_read_loadavg(): read the contents of the "loadavg" file.  We do just
+ * enough for uptime and other simple lxproc readers to work
+ */
+extern int nthread;
+
+static void
+lxpr_read_loadavg(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ulong_t avenrun1;
+	ulong_t avenrun5;
+	ulong_t avenrun15;
+	ulong_t avenrun1_cs;
+	ulong_t avenrun5_cs;
+	ulong_t avenrun15_cs;
+	int loadavg[3];
+	int *loadbuf;
+	cpupart_t *cp;
+	zone_t *zone = LXPTOZ(lxpnp);
+
+	uint_t nrunnable = 0;
+	rctl_qty_t nlwps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_LOADAVG);
+
+	mutex_enter(&cpu_lock);
+
+	/*
+	 * Need to add up values over all CPU partitions. If pools are active,
+	 * only report the values of the zone's partition, which by definition
+	 * includes the current CPU.
+	 */
+	if (pool_pset_enabled()) {
+		psetid_t psetid = zone_pset_get(LXPTOZ(lxpnp));
+
+		ASSERT(LXPTOZ(lxpnp) != &zone0);
+		cp = CPU->cpu_part;
+
+		nrunnable = cp->cp_nrunning + cp->cp_nrunnable;
+		(void) cpupart_get_loadavg(psetid, &loadavg[0], 3);
+		loadbuf = &loadavg[0];
+	} else {
+		cp = cp_list_head;
+		do {
+			nrunnable += cp->cp_nrunning + cp->cp_nrunnable;
+		} while ((cp = cp->cp_next) != cp_list_head);
+
+		loadbuf = zone == global_zone ?
+		    &avenrun[0] : zone->zone_avenrun;
+	}
+
+	/*
+	 * If we're in the non-global zone, we'll report the total number of
+	 * LWPs in the zone for the "nproc" parameter of /proc/loadavg,
+	 * otherwise will just use nthread (which will include kernel threads,
+	 * but should be good enough for lxproc).
+	 */
+	nlwps = zone == global_zone ? nthread : zone->zone_nlwps;
+
+	mutex_exit(&cpu_lock);
+
+	avenrun1 = loadbuf[0] >> FSHIFT;
+	avenrun1_cs = ((loadbuf[0] & (FSCALE-1)) * 100) >> FSHIFT;
+	avenrun5 = loadbuf[1] >> FSHIFT;
+	avenrun5_cs = ((loadbuf[1] & (FSCALE-1)) * 100) >> FSHIFT;
+	avenrun15 = loadbuf[2] >> FSHIFT;
+	avenrun15_cs = ((loadbuf[2] & (FSCALE-1)) * 100) >> FSHIFT;
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%ld.%02d %ld.%02d %ld.%02d %d/%d %d\n",
+	    avenrun1, avenrun1_cs,
+	    avenrun5, avenrun5_cs,
+	    avenrun15, avenrun15_cs,
+	    nrunnable, nlwps, 0);
+}
+
+/*
+ * lxpr_read_meminfo(): read the contents of the "meminfo" file.
+ */
+static void
+lxpr_read_meminfo(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+	ulong_t total_mem, free_mem, total_swap;
+	boolean_t swap_disabled;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_MEMINFO);
+	ASSERT(zone->zone_brand == &lx_brand);
+	ASSERT(lxzd != NULL);
+	swap_disabled = lxzd->lxzd_swap_disabled;
+
+	zone_get_physmem_data(zone->zone_id, (pgcnt_t *)&total_mem,
+	    (pgcnt_t *)&free_mem);
+	total_mem = ptob(total_mem);
+	free_mem = ptob(free_mem);
+
+	if (swap_disabled) {
+		total_swap = 0;
+	} else {
+		if (zone->zone_max_swap_ctl == UINT64_MAX) {
+			total_swap = ptob(k_anoninfo.ani_max);
+		} else {
+			mutex_enter(&zone->zone_mem_lock);
+			total_swap = zone->zone_max_swap_ctl;
+			mutex_exit(&zone->zone_mem_lock);
+		}
+	}
+
+	/*
+	 * SwapFree
+	 * On illumos we reserve swap up front, whereas on Linux they just
+	 * wing it and kill a random process if they run out of backing store
+	 * for virtual memory. Our swap reservation doesn't translate to that
+	 * model, so just inform the caller that no swap is being used.
+	 */
+	lxpr_uiobuf_printf(uiobuf,
+	    "MemTotal:  %8lu kB\n"
+	    "MemFree:   %8lu kB\n"
+	    "MemShared: %8u kB\n"
+	    "Buffers:   %8u kB\n"
+	    "Cached:    %8u kB\n"
+	    "SwapCached:%8u kB\n"
+	    "Active:    %8u kB\n"
+	    "Inactive:  %8u kB\n"
+	    "HighTotal: %8u kB\n"
+	    "HighFree:  %8u kB\n"
+	    "LowTotal:  %8u kB\n"
+	    "LowFree:   %8u kB\n"
+	    "SwapTotal: %8lu kB\n"
+	    "SwapFree:  %8lu kB\n",
+	    btok(total_mem),				/* MemTotal */
+	    btok(free_mem),				/* MemFree */
+	    0,						/* MemShared */
+	    0,						/* Buffers */
+	    0,						/* Cached */
+	    0,						/* SwapCached */
+	    0,						/* Active */
+	    0,						/* Inactive */
+	    0,						/* HighTotal */
+	    0,						/* HighFree */
+	    btok(total_mem),				/* LowTotal */
+	    btok(free_mem),				/* LowFree */
+	    btok(total_swap),				/* SwapTotal */
+	    btok(total_swap));				/* SwapFree */
+}
+
+/*
+ * lxpr_read_mounts():
+ *
+ * Note: we currently also use this for /proc/{pid}/mounts since we don't
+ * yet support mount namespaces.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_mounts(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	list_t *mounts;
+	lxpr_mount_entry_t *lme;
+
+	mounts = lxpr_enumerate_mounts(zone);
+
+	/*
+	 * now we can run through what we've extracted without holding
+	 * vfs_list_read_lock()
+	 */
+	lme = list_remove_head(mounts);
+	while (lme != NULL) {
+		char *resource, *mntpt, *fstype;
+		vnode_t *vp;
+		int error;
+
+		mntpt = (char *)refstr_value(lme->lme_mntpt);
+		resource = (char *)refstr_value(lme->lme_resource);
+
+		if (mntpt == NULL || mntpt[0] == '\0') {
+			goto nextp;
+		}
+		mntpt = ZONE_PATH_TRANSLATE(mntpt, zone);
+		error = lookupname(mntpt, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp);
+		if (error != 0) {
+			goto nextp;
+		} else if ((vp->v_flag & VROOT) == 0 && !lme->lme_force) {
+			VN_RELE(vp);
+			goto nextp;
+		}
+		VN_RELE(vp);
+
+		if (resource != NULL && resource[0] != '\0') {
+			if (resource[0] == '/') {
+				resource = ZONE_PATH_VISIBLE(resource, zone) ?
+				    ZONE_PATH_TRANSLATE(resource, zone) : mntpt;
+			}
+		} else {
+			resource = "none";
+		}
+
+		/*  Make things look more like Linux. */
+		fstype = vfssw[lme->lme_fstype].vsw_name;
+		if (lxpr_clean_mntent(&mntpt, &fstype, &resource) != 0 &&
+		    !lme->lme_force) {
+			goto nextp;
+		}
+
+		lxpr_uiobuf_printf(uiobuf, "%s %s %s %s 0 0\n",
+		    resource, mntpt, fstype, lme->lme_mntopts);
+
+nextp:
+		refstr_rele(lme->lme_mntpt);
+		refstr_rele(lme->lme_resource);
+		kmem_free(lme->lme_mntopts, lme->lme_mntopts_len);
+		kmem_free(lme, sizeof (lxpr_mount_entry_t));
+		lme = list_remove_head(mounts);
+	}
+
+	list_destroy(mounts);
+	kmem_free(mounts, sizeof (list_t));
+}
+
+/*
+ * lxpr_read_partitions():
+ *
+ * Over the years, /proc/partitions has been made considerably smaller -- to
+ * the point that it really is only major number, minor number, number of
+ * blocks (which we report as 0), and partition name.
+ *
+ * We support this because some things want to see it to make sense of
+ * /proc/diskstats, and also because "fdisk -l" and a few other things look
+ * here to find all disks on the system.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_partitions(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lx_zone_data_t *lxzd;
+	lx_virt_disk_t *vd;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PARTITIONS);
+
+	lxpr_uiobuf_printf(uiobuf, "major minor  #blocks  name\n\n");
+
+	lxzd = ztolxzd(LXPTOZ(lxpnp));
+	if (lxzd == NULL)
+		return;
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+
+	vd = list_head(lxzd->lxzd_vdisks);
+	while (vd != NULL) {
+		lxpr_uiobuf_printf(uiobuf, "%4d  %7d %10d %s\n",
+		    getmajor(vd->lxvd_emul_dev), getminor(vd->lxvd_emul_dev),
+		    0, vd->lxvd_name);
+		vd = list_next(lxzd->lxzd_vdisks, vd);
+	}
+}
+
+/*
+ * There aren't many actual devices inside a zone but we want to provide the
+ * major numbers for the pseudo devices that do exist, including  our pts/ptm
+ * device, as well as the zvol virtual disk device. We simply hardcode the
+ * emulated major numbers that are used elsewhere in the code and that match
+ * the expected Linux major numbers. See lx devfs where some of the major
+ * numbers have no defined constants.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_devices(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_DEVICES);
+
+	lxpr_uiobuf_printf(uiobuf, "Character devices:\n");
+	lxpr_uiobuf_printf(uiobuf, "%3d /dev/tty\n", LX_TTY_MAJOR);
+	lxpr_uiobuf_printf(uiobuf, "%3d /dev/console\n", LX_TTY_MAJOR);
+	lxpr_uiobuf_printf(uiobuf, "%3d /dev/ptmx\n", LX_TTY_MAJOR);
+	lxpr_uiobuf_printf(uiobuf, "%3d ptm\n", LX_PTM_MAJOR);
+	lxpr_uiobuf_printf(uiobuf, "%3d pts\n", LX_PTS_MAJOR_MIN);
+
+	lxpr_uiobuf_printf(uiobuf, "\nBlock devices:\n");
+	lxpr_uiobuf_printf(uiobuf, "%3d zvol\n", LX_MAJOR_DISK);
+}
+
+/*
+ * lxpr_read_diskstats():
+ *
+ * See the block comment above the per-device output-generating line for the
+ * details of the format.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_diskstats(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	lx_zone_data_t *lxzd;
+	kstat_t kn;
+	int num;
+	zone_vfs_kstat_t *kip;
+	size_t size;
+	lx_virt_disk_t *vd;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_DISKSTATS);
+
+	lxzd = ztolxzd(zone);
+	if (lxzd == NULL)
+		return;
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+
+	/*
+	 * Use the zone_vfs kstat, which is a superset of a kstat_io_t, since
+	 * it tracks IO at the zone level.
+	 */
+	(void) strlcpy(kn.ks_module, "zone_vfs", sizeof (kn.ks_module));
+	(void) strlcpy(kn.ks_name, zone->zone_name, sizeof (kn.ks_name));
+	kn.ks_instance = zone->zone_id;
+
+	kip = (zone_vfs_kstat_t *)lxpr_kstat_read(&kn, B_TRUE, &size, &num,
+	    zone->zone_id);
+	if (kip == NULL)
+		return;
+
+	if (size < sizeof (kstat_io_t)) {
+		kmem_free(kip, size);
+		return;
+	}
+
+	/*
+	 * Because the zone vfs stats are tracked at the zone level we use
+	 * the same kstat for the zone's virtual disk (the zpool) and any
+	 * zvols that might also visible within the zone.
+	 */
+	vd = list_head(lxzd->lxzd_vdisks);
+	while (vd != NULL) {
+		/*
+		 * /proc/diskstats is defined to have one line of output for
+		 * each block device, with each line containing the following
+		 * 14 fields:
+		 *
+		 *	1 - major number
+		 *	2 - minor mumber
+		 *	3 - device name
+		 *	4 - reads completed successfully
+		 * 	5 - reads merged
+		 *	6 - sectors read
+		 *	7 - time spent reading (ms)
+		 *	8 - writes completed
+		 *	9 - writes merged
+		 *	10 - sectors written
+		 *	11 - time spent writing (ms)
+		 *	12 - I/Os currently in progress
+		 *	13 - time spent doing I/Os (ms)
+		 *	14 - weighted time spent doing I/Os (ms)
+		 *
+		 * One small hiccup:  we don't actually keep track of time
+		 * spent reading vs. time spent writing -- we keep track of
+		 * time waiting vs. time actually performing I/O.  While we
+		 * could divide the total time by the I/O mix (making the
+		 * obviously wrong assumption that I/O operations all take the
+		 * same amount of time), this has the undesirable side-effect
+		 * of moving backwards.  Instead, we report the total time
+		 * (read + write) for all three stats (read, write, total).
+		 * This is also a lie of sorts, but it should be more
+		 * immediately clear to the user that reads and writes are
+		 * each being double-counted as the other.
+		 *
+		 * Since certain consumers interpret the major/minor numbers to
+		 * infer device names, some translation is required to avoid
+		 * output which results in totally unexpected results.
+		 */
+
+		lxpr_uiobuf_printf(uiobuf, "%4d %7d %s ",
+		    getmajor(vd->lxvd_emul_dev),
+		    getminor(vd->lxvd_emul_dev),
+		    vd->lxvd_name);
+
+		if (vd->lxvd_type == LXVD_ZFS_DS) {
+			/*
+			 * Use the zone-wide vfs stats for any zfs datasets
+			 * represented via virtual devices.
+			 */
+#define	KV(N)	kip->zv_ ## N.value.ui64
+#define	NS_PER_MS	(uint64_t)(NANOSEC / MILLISEC)
+			lxpr_uiobuf_printf(uiobuf,
+			    "%llu %llu %llu %llu "
+			    "%llu %llu %llu %llu "
+			    "%llu %llu %llu\n",
+			    (uint64_t)KV(reads), 0LL,
+			    KV(nread) / (uint64_t)LXPR_SECTOR_SIZE,
+			    (KV(rtime) + KV(wtime)) / NS_PER_MS,
+			    (uint64_t)KV(writes), 0LL,
+			    KV(nwritten) / (uint64_t)LXPR_SECTOR_SIZE,
+			    (KV(rtime) + KV(wtime)) / NS_PER_MS,
+			    (uint64_t)(KV(rcnt) + KV(wcnt)),
+			    (KV(rtime) + KV(wtime)) / NS_PER_MS,
+			    (KV(rlentime) + KV(wlentime)) / NS_PER_MS);
+#undef	KV
+#undef	NS_PER_MS
+		} else {
+			/*
+			 * Report nearly-zeroed statistics for other devices.
+			 *
+			 * Since iostat will ignore devices which report no
+			 * succesful reads or writes, a single read of one
+			 * sector, taking 1ms, is reported.
+			 */
+			lxpr_uiobuf_printf(uiobuf,
+			    "1 0 1 1 0 0 0 0 0 0 0\n");
+		}
+
+		vd = list_next(lxzd->lxzd_vdisks, vd);
+	}
+
+	kmem_free(kip, size);
+}
+
+/*
+ * lxpr_read_version(): read the contents of the "version" file.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_version(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lx_zone_data_t *lxzd = ztolxzd(LXPTOZ(lxpnp));
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+	char release[LX_KERN_RELEASE_MAX];
+	char version[LX_KERN_VERSION_MAX];
+
+	mutex_enter(&lxzd->lxzd_lock);
+	(void) strlcpy(release, lxzd->lxzd_kernel_release, sizeof (release));
+	(void) strlcpy(version, lxzd->lxzd_kernel_version, sizeof (version));
+	mutex_exit(&lxzd->lxzd_lock);
+
+	/* Use per-process overrides, if specified */
+	if (lxpd != NULL && lxpd->l_uname_release[0] != '\0') {
+		(void) strlcpy(release, lxpd->l_uname_release,
+		    sizeof (release));
+	}
+	if (lxpd != NULL && lxpd->l_uname_version[0] != '\0') {
+		(void) strlcpy(version, lxpd->l_uname_version,
+		    sizeof (version));
+	}
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%s version %s (%s version %d.%d.%d) %s\n",
+	    LX_UNAME_SYSNAME, release,
+#if defined(__GNUC__)
+	    "gcc", __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__,
+#else
+	    "cc", 1, 0, 0,
+#endif
+	    version);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_vmstat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	cpu_t *cp, *cpstart;
+	int pools_enabled;
+
+	ulong_t pgpgin_cum    = 0;
+	ulong_t pgpgout_cum   = 0;
+	ulong_t pgswapout_cum = 0;
+	ulong_t pgswapin_cum  = 0;
+
+	mutex_enter(&cpu_lock);
+	pools_enabled = pool_pset_enabled();
+	/* Calculate cumulative stats */
+	cp = cpstart = CPU->cpu_part->cp_cpulist;
+	do {
+		/* Only count CPUs which are present and active. */
+		if ((cp->cpu_flags & CPU_EXISTS) == 0) {
+			continue;
+		}
+
+		pgpgin_cum += CPU_STATS(cp, vm.pgpgin);
+		pgpgout_cum += CPU_STATS(cp, vm.pgpgout);
+		pgswapin_cum += CPU_STATS(cp, vm.pgswapin);
+		pgswapout_cum += CPU_STATS(cp, vm.pgswapout);
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+	mutex_exit(&cpu_lock);
+
+	/*
+	 * Needless to say, the metrics presented by vmstat are very specific
+	 * to the internals of the Linux kernel.  There is little per-zone
+	 * information which can be translated in a meaningful way to fit the
+	 * expected fields.  For the time being, the output is kept sparse.
+	 */
+	lxpr_uiobuf_printf(uiobuf,
+	    "pgpgin %lu\n"
+	    "pgpgout %lu\n"
+	    "pswpin %lu\n"
+	    "pswpout %lu\n",
+	    pgpgin_cum,
+	    pgpgout_cum,
+	    pgswapin_cum,
+	    pgswapout_cum);
+}
+
+/*
+ * lxpr_read_stat(): read the contents of the "stat" file.
+ *
+ */
+/* ARGSUSED */
+static void
+lxpr_read_stat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	cpu_t *cp, *cpstart;
+	int pools_enabled;
+	ulong_t idle_cum = 0;
+	ulong_t sys_cum  = 0;
+	ulong_t user_cum = 0;
+	ulong_t irq_cum = 0;
+	ulong_t cpu_nrunnable_cum = 0;
+	ulong_t w_io_cum = 0;
+
+	ulong_t pgpgin_cum    = 0;
+	ulong_t pgpgout_cum   = 0;
+	ulong_t pgswapout_cum = 0;
+	ulong_t pgswapin_cum  = 0;
+	ulong_t intr_cum = 0;
+	ulong_t pswitch_cum = 0;
+	ulong_t forks_cum = 0;
+	hrtime_t msnsecs[NCMSTATES];
+	/* is the emulated release > 2.4 */
+	boolean_t newer_than24 = lx_kern_release_cmp(LXPTOZ(lxpnp), "2.4") > 0;
+	zone_t *zone = LXPTOZ(lxpnp);
+	const char *fmtstr0, *fmtstr1;
+	/* temporary variable since scalehrtime modifies data in place */
+	hrtime_t tmptime;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_STAT);
+
+	mutex_enter(&cpu_lock);
+	pools_enabled = pool_pset_enabled();
+
+	/* Calculate cumulative stats */
+	cp = cpstart = CPU->cpu_part->cp_cpulist;
+	do {
+		int i;
+
+		/*
+		 * Don't count CPUs that aren't even in the system
+		 * or aren't up yet.
+		 */
+		if ((cp->cpu_flags & CPU_EXISTS) == 0) {
+			continue;
+		}
+
+		get_cpu_mstate(cp, msnsecs);
+
+		idle_cum += NSEC_TO_TICK(msnsecs[CMS_IDLE]);
+		sys_cum  += NSEC_TO_TICK(msnsecs[CMS_SYSTEM]);
+		user_cum += NSEC_TO_TICK(msnsecs[CMS_USER]);
+
+		pgpgin_cum += CPU_STATS(cp, vm.pgpgin);
+		pgpgout_cum += CPU_STATS(cp, vm.pgpgout);
+		pgswapin_cum += CPU_STATS(cp, vm.pgswapin);
+		pgswapout_cum += CPU_STATS(cp, vm.pgswapout);
+
+
+		if (newer_than24) {
+			cpu_nrunnable_cum += cp->cpu_disp->disp_nrunnable;
+			w_io_cum += CPU_STATS(cp, sys.iowait);
+			for (i = 0; i < NCMSTATES; i++) {
+				tmptime = cp->cpu_intracct[i];
+				scalehrtime(&tmptime);
+				irq_cum += NSEC_TO_TICK(tmptime);
+			}
+		}
+
+		for (i = 0; i < PIL_MAX; i++)
+			intr_cum += CPU_STATS(cp, sys.intr[i]);
+
+		pswitch_cum += CPU_STATS(cp, sys.pswitch);
+		forks_cum += CPU_STATS(cp, sys.sysfork);
+		forks_cum += CPU_STATS(cp, sys.sysvfork);
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+
+	if (lx_kern_release_cmp(zone, "2.6.33") >= 0) {
+		fmtstr0 = "cpu %lu 0 %lu %lu 0 %lu 0 0 0 0\n";
+		fmtstr1 = "cpu%d %lu 0 %lu %lu 0 %lu 0 0 0 0\n";
+	} else if (lx_kern_release_cmp(zone, "2.6.24") >= 0) {
+		fmtstr0 = "cpu %lu 0 %lu %lu 0 %lu 0 0 0\n";
+		fmtstr1 = "cpu%d %lu 0 %lu %lu 0 %lu 0 0 0\n";
+	} else if (lx_kern_release_cmp(zone, "2.6.11") >= 0) {
+		fmtstr0 = "cpu %lu 0 %lu %lu 0 %lu 0 0\n";
+		fmtstr1 = "cpu%d %lu 0 %lu %lu 0 %lu 0 0\n";
+	} else if (lx_kern_release_cmp(zone, "2.5.41") >= 0) {
+		fmtstr0 = "cpu %lu 0 %lu %lu 0 %lu 0\n";
+		fmtstr1 = "cpu%d %lu 0 %lu %lu 0 %lu 0\n";
+	} else {
+		/* Note: we pass an unused param to these fmt strings */
+		fmtstr0 = "cpu %lu 0 %lu %lu\n";
+		fmtstr1 = "cpu%d %lu 0 %lu %lu\n";
+	}
+
+	/* Adjust hz */
+	user_cum = HZ_TO_LX_USERHZ(user_cum);
+	sys_cum = HZ_TO_LX_USERHZ(sys_cum);
+	idle_cum = HZ_TO_LX_USERHZ(idle_cum);
+	irq_cum = HZ_TO_LX_USERHZ(irq_cum);
+
+	lxpr_uiobuf_printf(uiobuf, fmtstr0,
+	    user_cum, sys_cum, idle_cum, irq_cum);
+
+	/* Do per processor stats */
+	do {
+		int i;
+
+		ulong_t idle_ticks;
+		ulong_t sys_ticks;
+		ulong_t user_ticks;
+		ulong_t irq_ticks = 0;
+
+		/*
+		 * Don't count CPUs that aren't even in the system
+		 * or aren't up yet.
+		 */
+		if ((cp->cpu_flags & CPU_EXISTS) == 0) {
+			continue;
+		}
+
+		get_cpu_mstate(cp, msnsecs);
+
+		idle_ticks = HZ_TO_LX_USERHZ(NSEC_TO_TICK(msnsecs[CMS_IDLE]));
+		sys_ticks  = HZ_TO_LX_USERHZ(NSEC_TO_TICK(msnsecs[CMS_SYSTEM]));
+		user_ticks = HZ_TO_LX_USERHZ(NSEC_TO_TICK(msnsecs[CMS_USER]));
+
+		for (i = 0; i < NCMSTATES; i++) {
+			tmptime = cp->cpu_intracct[i];
+			scalehrtime(&tmptime);
+			irq_ticks += NSEC_TO_TICK(tmptime);
+		}
+		irq_ticks = HZ_TO_LX_USERHZ(irq_ticks);
+
+		lxpr_uiobuf_printf(uiobuf, fmtstr1, HZ_TO_LX_USERHZ(cp->cpu_id),
+		    user_ticks, sys_ticks, idle_ticks, irq_ticks);
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+
+	mutex_exit(&cpu_lock);
+
+	if (newer_than24) {
+		lxpr_uiobuf_printf(uiobuf,
+		    "page %lu %lu\n"
+		    "swap %lu %lu\n"
+		    "intr %lu\n"
+		    "ctxt %lu\n"
+		    "btime %lu\n"
+		    "processes %lu\n"
+		    "procs_running %lu\n"
+		    "procs_blocked %lu\n",
+		    pgpgin_cum, pgpgout_cum,
+		    pgswapin_cum, pgswapout_cum,
+		    intr_cum,
+		    pswitch_cum,
+		    zone->zone_boot_time,
+		    forks_cum,
+		    cpu_nrunnable_cum,
+		    w_io_cum);
+	} else {
+		lxpr_uiobuf_printf(uiobuf,
+		    "page %lu %lu\n"
+		    "swap %lu %lu\n"
+		    "intr %lu\n"
+		    "ctxt %lu\n"
+		    "btime %lu\n"
+		    "processes %lu\n",
+		    pgpgin_cum, pgpgout_cum,
+		    pgswapin_cum, pgswapout_cum,
+		    intr_cum,
+		    pswitch_cum,
+		    zone->zone_boot_time,
+		    forks_cum);
+	}
+}
+
+/*
+ * lxpr_read_swaps():
+ *
+ * We don't support swap files or partitions, but some programs like to look
+ * here just to check we have some swap on the system, so we lie and show
+ * our entire swap cap as one swap partition. See lxpr_read_meminfo for an
+ * explanation on why we report 0 used swap.
+ *
+ * The zone's lxzd_swap_disabled boolean controls whether or not we pretend
+ * swap space is configured.
+ *
+ * It is important to use formatting identical to the Linux implementation
+ * so that consumers do not break. See swap_show() in mm/swapfile.c.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_swaps(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	boolean_t swap_enabled;
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+
+	ASSERT(zone->zone_brand == &lx_brand);
+	ASSERT(lxzd != NULL);
+	swap_enabled = !lxzd->lxzd_swap_disabled;
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "Filename\t\t\t\tType\t\tSize\tUsed\tPriority\n");
+
+	if (swap_enabled) {
+		uint64_t totswap, usedswap;
+
+		if (zone->zone_max_swap_ctl == UINT64_MAX) {
+			totswap = (k_anoninfo.ani_max * PAGESIZE) >> 10;
+		} else {
+			mutex_enter(&zone->zone_mem_lock);
+			/* Uses units of 1 kb (2^10). */
+			totswap = zone->zone_max_swap_ctl >> 10;
+			mutex_exit(&zone->zone_mem_lock);
+		}
+		usedswap = 0;
+
+		lxpr_uiobuf_printf(uiobuf, "%-40s%s\t%llu\t%llu\t%d\n",
+		    "/dev/swap", "partition", totswap, usedswap, -1);
+	}
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_aiomax(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_AIO_MAX_NR);
+	lxpr_uiobuf_printf(uiobuf, "%llu\n", LX_AIO_MAX_NR);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_aionr(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+	uint64_t curr;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_AIO_NR);
+	ASSERT(zone->zone_brand == &lx_brand);
+	ASSERT(lxzd != NULL);
+
+	mutex_enter(&lxzd->lxzd_lock);
+	curr = (uint64_t)(lxzd->lxzd_aio_nr);
+	mutex_exit(&lxzd->lxzd_lock);
+	lxpr_uiobuf_printf(uiobuf, "%llu\n", curr);
+}
+
+/*
+ * lxpr_read_sys_fs_filemax():
+ *
+ * The zone's total number of open files is not fixed or tunable, but we can
+ * provide a number by taking:
+ * (zone's proc limit) * (process.max-file-descriptor rctl privileged limit).
+ * The privileged rctl limit is the same as rlim_fd_max.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_filemax(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	uint64_t max_fh, proc_lim;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_FILEMAX);
+	proc_lim = (uint64_t)(zone->zone_nprocs_ctl == INT_MAX ?
+	    maxpid : zone->zone_nprocs_ctl);
+	max_fh = proc_lim * (uint64_t)rlim_fd_max;
+	lxpr_uiobuf_printf(uiobuf, "%llu\n", max_fh);
+}
+
+/*
+ * lxpr_read_sys_fs_filenr():
+ *
+ * Contains 3 numbers: current number of allocated file handles (open files),
+ * number of free file handles, and max. number of file handles (same value as
+ * we use in lxpr_read_sys_fs_filemax). Note that since Linux 2.6 the "free"
+ * value is always 0, so we just do the same here. We don't keep track of the
+ * number of files in use within a zone, so we approximate that value by
+ * looking at the current "fi_nfiles" value for each process in the zone.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_filenr(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	uint64_t max_fh, proc_lim, curr_files = 0;
+	int i;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_FILENR);
+	proc_lim = (uint64_t)(zone->zone_nprocs_ctl == INT_MAX ?
+	    maxpid : zone->zone_nprocs_ctl);
+	max_fh = proc_lim * (uint64_t)rlim_fd_max;
+
+	for (i = 1; i < v.v_proc; i++) {
+		uint_t nfiles;
+		proc_t *p;
+		uf_info_t *fip;
+
+		mutex_enter(&pidlock);
+
+		if ((p = pid_entry(i)) == NULL || p->p_stat == SIDL ||
+		    p->p_pid == 0 || p->p_zone != zone ||
+		    p == zone->zone_zsched ||
+		    secpolicy_basic_procinfo(CRED(), p, curproc) != 0) {
+			mutex_exit(&pidlock);
+			continue;
+		}
+
+		fip = P_FINFO(p);
+		mutex_enter(&fip->fi_lock);
+		nfiles = fip->fi_nfiles;
+		mutex_exit(&fip->fi_lock);
+
+		mutex_exit(&pidlock);
+
+		curr_files += nfiles;
+	}
+
+	lxpr_uiobuf_printf(uiobuf, "%llu\t0\t%llu\n", curr_files, max_fh);
+}
+
+/*
+ * inotify tunables exported via /proc.
+ */
+extern int inotify_maxevents;
+extern int inotify_maxinstances;
+extern int inotify_maxwatches;
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_inotify_max_queued_events(lxpr_node_t *lxpnp,
+    lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_INOTIFY_MAX_QUEUED_EVENTS);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", inotify_maxevents);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_inotify_max_user_instances(lxpr_node_t *lxpnp,
+    lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_INOTIFY_MAX_USER_INSTANCES);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", inotify_maxinstances);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_inotify_max_user_watches(lxpr_node_t *lxpnp,
+    lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_INOTIFY_MAX_USER_WATCHES);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", inotify_maxwatches);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_fs_pipe_max(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lx_zone_data_t *lxzd = ztolxzd(LXPTOZ(lxpnp));
+	uint_t pipe_max;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_PIPE_MAX);
+	ASSERT(lxzd != NULL);
+
+	mutex_enter(&lxzd->lxzd_lock);
+	pipe_max = lxzd->lxzd_pipe_max_sz;
+	mutex_exit(&lxzd->lxzd_lock);
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", pipe_max);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_caplcap(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_CAPLCAP);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", LX_CAP_MAX_VALID);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_corepatt(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	struct core_globals *cg;
+	refstr_t *rp;
+	corectl_path_t *ccp;
+	char tr[MAXPATHLEN];
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_COREPATT);
+
+	cg = zone_getspecific(core_zone_key, zone);
+	ASSERT(cg != NULL);
+
+	/* If core dumps are disabled, return an empty string. */
+	if ((cg->core_options & CC_PROCESS_PATH) == 0) {
+		lxpr_uiobuf_printf(uiobuf, "\n");
+		return;
+	}
+
+	ccp = cg->core_default_path;
+	mutex_enter(&ccp->ccp_mtx);
+	if ((rp = ccp->ccp_path) != NULL)
+		refstr_hold(rp);
+	mutex_exit(&ccp->ccp_mtx);
+
+	if (rp == NULL) {
+		lxpr_uiobuf_printf(uiobuf, "\n");
+		return;
+	}
+
+	bzero(tr, sizeof (tr));
+	if (lxpr_core_path_s2l(refstr_value(rp), tr, sizeof (tr)) != 0) {
+		refstr_rele(rp);
+		lxpr_uiobuf_printf(uiobuf, "\n");
+		return;
+	}
+
+	refstr_rele(rp);
+	lxpr_uiobuf_printf(uiobuf, "%s\n", tr);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_hostname(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_HOSTNAME);
+	lxpr_uiobuf_printf(uiobuf, "%s\n", uts_nodename());
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_msgmax(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	/*
+	 * We don't have an rctl for this. See our definition for LX_MSGMAX
+	 * in the user-level emulation library. Once that code moves into
+	 * the kernel, we can use a common definition. This matches the
+	 * value on Linux.
+	 */
+	uint_t val = 8192;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_MSGMAX);
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", val);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_msgmnb(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	rctl_qty_t val;
+	proc_t *pp = curproc;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_MSGMNB);
+
+	mutex_enter(&pp->p_lock);
+	val = rctl_enforced_value(rc_process_msgmnb, pp->p_rctls, pp);
+	mutex_exit(&pp->p_lock);
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", (uint_t)val);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_msgmni(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	rctl_qty_t val;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_MSGMNI);
+
+	mutex_enter(&curproc->p_lock);
+	val = rctl_enforced_value(rc_zone_msgmni,
+	    LXPTOZ(lxpnp)->zone_rctls, curproc);
+	mutex_exit(&curproc->p_lock);
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", (uint_t)val);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_ngroups_max(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_NGROUPS_MAX);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", ngroups_max);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_osrel(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+	char version[LX_KERN_VERSION_MAX];
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_OSREL);
+	ASSERT(zone->zone_brand == &lx_brand);
+	ASSERT(lxzd != NULL);
+
+	mutex_enter(&lxzd->lxzd_lock);
+	(void) strlcpy(version, lxzd->lxzd_kernel_version, sizeof (version));
+	mutex_exit(&lxzd->lxzd_lock);
+	lxpr_uiobuf_printf(uiobuf, "%s\n", version);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_pid_max(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_PID_MAX);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", maxpid);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_rand_bootid(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	/*
+	 * This file isn't documented on the Linux proc(5) man page but
+	 * according to the blog of the author of systemd/journald (the
+	 * consumer), he says:
+	 *    boot_id: A random ID that is regenerated on each boot. As such it
+	 *    can be used to identify the local machine's current boot. It's
+	 *    universally available on any recent Linux kernel. It's a good and
+	 *    safe choice if you need to identify a specific boot on a specific
+	 *    booted kernel.
+	 *
+	 * We'll just generate a random ID if necessary. On Linux the format
+	 * appears to resemble a uuid but since it is not documented to be a
+	 * uuid, we don't worry about that.
+	 */
+	zone_t *zone = LXPTOZ(lxpnp);
+	lx_zone_data_t *lxzd = ztolxzd(zone);
+	char bootid[LX_BOOTID_LEN];
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_RAND_BOOTID);
+	ASSERT(zone->zone_brand == &lx_brand);
+	ASSERT(lxzd != NULL);
+
+	mutex_enter(&lxzd->lxzd_lock);
+	if (lxzd->lxzd_bootid[0] == '\0') {
+		int i;
+
+		for (i = 0; i < 5; i++) {
+			u_longlong_t n;
+			char s[32];
+
+			(void) random_get_bytes((uint8_t *)&n, sizeof (n));
+			switch (i) {
+			case 0:	(void) snprintf(s, sizeof (s), "%08llx", n);
+				s[8] = '\0';
+				break;
+			case 4:	(void) snprintf(s, sizeof (s), "%012llx", n);
+				s[12] = '\0';
+				break;
+			default: (void) snprintf(s, sizeof (s), "%04llx", n);
+				s[4] = '\0';
+				break;
+			}
+			if (i > 0)
+				(void) strlcat(lxzd->lxzd_bootid, "-",
+				    sizeof (lxzd->lxzd_bootid));
+			(void) strlcat(lxzd->lxzd_bootid, s,
+			    sizeof (lxzd->lxzd_bootid));
+		}
+	}
+	(void) strlcpy(bootid, lxzd->lxzd_bootid, sizeof (bootid));
+	mutex_exit(&lxzd->lxzd_lock);
+
+	lxpr_uiobuf_printf(uiobuf, "%s\n", bootid);
+}
+
+/*
+ * The amount of entropy available (in bits).
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_rand_entavl(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_RAND_ENTAVL);
+	ASSERT(LXPTOZ(lxpnp)->zone_brand == &lx_brand);
+
+	lxpr_uiobuf_printf(uiobuf, "%d\n", swrand_stats.ss_entEst);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_sem(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *pp = curproc;
+	zone_t *zone = LXPTOZ(lxpnp);
+	rctl_qty_t vmsl, vopm, vmni, vmns;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_SEM);
+
+	mutex_enter(&pp->p_lock);
+	vmsl = rctl_enforced_value(rc_process_semmsl, pp->p_rctls, pp);
+	vopm = rctl_enforced_value(rc_process_semopm, pp->p_rctls, pp);
+	vmni = rctl_enforced_value(rc_zone_semmni, zone->zone_rctls, pp);
+	mutex_exit(&pp->p_lock);
+	vmns = vmsl * vmni;
+	if (vmns < vmsl || vmns < vmni) {
+		vmns = ULLONG_MAX;
+	}
+	/*
+	 * Format: semmsl semmns semopm semmni
+	 *  - semmsl: Limit semaphores in a sempahore set.
+	 *  - semmns: Limit semaphores in all semaphore sets
+	 *  - semopm: Limit operations in a single semop call
+	 *  - semmni: Limit number of semaphore sets
+	 */
+	lxpr_uiobuf_printf(uiobuf, "%llu\t%llu\t%llu\t%llu\n",
+	    vmsl, vmns, vopm, vmni);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_shmall(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	rctl_qty_t val;
+	zone_t *zone = LXPTOZ(lxpnp);
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_SHMALL);
+
+	mutex_enter(&curproc->p_lock);
+	val = rctl_enforced_value(rc_zone_shmmax, zone->zone_rctls, curproc);
+	mutex_exit(&curproc->p_lock);
+
+	/* value is in pages */
+	lxpr_uiobuf_printf(uiobuf, "%u\n", (uint_t)btop(val));
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_shmmax(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	rctl_qty_t val;
+	zone_t *zone = LXPTOZ(lxpnp);
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_SHMMAX);
+
+	mutex_enter(&curproc->p_lock);
+	val = rctl_enforced_value(rc_zone_shmmax, zone->zone_rctls, curproc);
+	mutex_exit(&curproc->p_lock);
+
+	if (val > FOURGB)
+		val = FOURGB;
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", (uint_t)val);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_shmmni(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	rctl_qty_t val;
+	zone_t *zone = LXPTOZ(lxpnp);
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_SHMMNI);
+
+	mutex_enter(&curproc->p_lock);
+	val = rctl_enforced_value(rc_zone_shmmni, zone->zone_rctls, curproc);
+	mutex_exit(&curproc->p_lock);
+
+	if (val > FOURGB)
+		val = FOURGB;
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", (uint_t)val);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_kernel_threads_max(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_THREADS_MAX);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", LXPTOZ(lxpnp)->zone_nlwps_ctl);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_core_somaxc(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_CORE_SOMAXCON);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_printf(uiobuf, "%d\n", SOMAXCONN);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\n", tcps->tcps_conn_req_max_q);
+	netstack_rele(ns);
+}
+
+/*
+ * icmp_echo_ignore_broadcasts
+ * integer; 0 or 1
+ *
+ * illumos: ndd /dev/ip ip_respond_to_echo_broadcast
+ * From the tunable guide: Control whether IPv4 responds to broadcast ICMPv4
+ * echo request. default: 1 (enabled)
+ * Not in ip(7p) man page.
+ *
+ * Note that the Linux setting is the inverse of the illumos value.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_icmp_eib(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	ip_stack_t *ipst;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_ICMP_EIB);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	ipst = ns->netstack_ip;
+	lxpr_uiobuf_printf(uiobuf, "%d\n", !ipst->ips_ip_g_resp_to_echo_bcast);
+	netstack_rele(ns);
+}
+
+/*
+ * ip_forward
+ * integer; default: 0
+ *
+ * illumos: ndd /dev/ip ip_forwarding
+ * default: 0 (disabled)
+ * Forwarding is described in the ip(7p) man page. We do not support forwarding
+ * in lx at this time, thus we do not support Linux-ABI methods for
+ * enabling/disabling forwarding, and this is always 0.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_ip_forward(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_IP_FORWARD);
+	lxpr_uiobuf_printf(uiobuf, "0\n");
+}
+
+/*
+ * ip_local_port_range
+ *
+ * The low & high port number range.
+ * integers; default: 32768 61000
+ *
+ * illumos: tcp_smallest_anon_port & tcp_largest_anon_port
+ * Not in tcp(7p) man page.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_ip_lport_range(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_IP_LPORT_RANGE);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\t%d\n",
+	    tcps->tcps_smallest_anon_port, tcps->tcps_largest_anon_port);
+	netstack_rele(ns);
+}
+
+/*
+ * tcp_fin_timeout
+ *
+ * This specifies how many seconds to wait for a final FIN packet before the
+ * socket is forcibly closed. This is strictly a violation of the TCP
+ * specification, but required to prevent denial-of-service attacks.
+ * integer; default: 60;
+ *
+ * illumos: tcp_fin_wait_2_flush_interval
+ * Not in tcp(7p) man page but see comment in uts/common/inet/tcp/tcp_input.c
+ * in the tcp_input_data() function on the use of tcp_fin_wait_2_flush_interval.
+ * The value is in milliseconds.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_fin_to(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_FIN_TO);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\n",
+	    tcps->tcps_fin_wait_2_flush_interval / 1000);
+	netstack_rele(ns);
+}
+
+/*
+ * tcp_keepalive_intvl
+ *
+ * The number of seconds between TCP keep-alive probes. default: 75
+ * Linux retries tcp_keepalive_probes (9) times before timing out.
+ *
+ * illumos:
+ * We have tcp_ka_rinterval but there is no corresponding tcps_* tunable for
+ * this. The closest is tcps_keepalive_abort_interval which specifies the
+ * time threshold for aborting a TCP connection in milliseconds. Linux retries
+ * 9 times (giving a total of 11.25 minutes) so we emulate this by dividing out
+ * tcps_keepalive_abort_interval by 9.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_ka_int(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_KA_INT);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\n",
+	    (tcps->tcps_keepalive_abort_interval / 1000) / 9);
+	netstack_rele(ns);
+}
+
+/*
+ * tcp_keepalive_time
+ *
+ * The number of seconds a connection needs to be idle before TCP begins
+ * sending out keep-alive probes. The default value is 7200 seconds (2 hours).
+ *
+ * illumos: tcp_keepalive_interval
+ * The interval for sending out the first probe in milliseconds. The default is
+ * two hours.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_ka_tim(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_KA_TIM);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\n",
+	    (tcps->tcps_keepalive_interval / 1000));
+	netstack_rele(ns);
+}
+
+/*
+ * tcp_max_syn_backlog
+ *
+ * The number of half-open connections that can be kept by the backlog queue.
+ * See the Linux tcp(7) man page.
+ *
+ * illumos: tcp_conn_req_max_q0
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_max_syn_bl(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t	*ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_MAX_SYN_BL);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\n", tcps->tcps_conn_req_max_q0);
+	netstack_rele(ns);
+}
+
+/*
+ * tcp_retries2
+ *
+ * Controls number of TCP retries for data packets. Often tuned down for HA
+ * configurations. RFC 1122 recommends at least 100 seconds for the timeout,
+ * which, for Linux, corresponds to a value of ~8. Oracle suggests a value of
+ * 3 for a RAC configuration, as do various HA tuning guides.
+ * integer; Ubuntu 16.04 default: 15
+ *
+ * illumos: There are 4 ndd parameters that are related to this:
+ *	tcp_rexmit_interval_initial:	 1000
+ *	tcp_rexmit_interval_min:	  400
+ *	tcp_rexmit_interval_max:	60000
+ * 	tcp_rexmit_interval_extra:	    0
+ * Not in tcp(7p) man page.
+ *
+ * From the tunables guide:
+ * tcp_rexmit_interval_initial is the initial retransmission timeout (RTO) for
+ * a TCP connection in milliseconds (ms).
+ * The interval_min value is the minimum RTO in ms.
+ * The interval_max value is the maximum RTO in ms.
+ * The extra value is an extra time (in ms) to add in to the RTO.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_retry2(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t *tcps;
+	uint_t i, retry, rx_min, rx_max;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RETRY2);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	rx_min = tcps->tcps_rexmit_interval_min;
+	rx_max = tcps->tcps_rexmit_interval_max;
+	netstack_rele(ns);
+
+	for (i = rx_min, retry = 0; i < rx_max; retry++) {
+		i *= 2;
+	}
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", retry);
+}
+
+/*
+ * tcp_rmem and tcp_wmem
+ *
+ * Display the minimum, default, and maximum TCP receive/transmit window sizes,
+ * in bytes. See the Linux tcp(7) man page.
+ *
+ * In illumos this roughly corresponds to: tcp_recv_hiwat or tcp_xmit_hiwat,
+ * and tcp_max_buf.
+ *    tcp_recv_hiwat is the default TCP receive window size
+ *    tcp_xmit_hiwat is the default TCP send window size
+ *    tcp_max_buf is the maximum TCP send and receive buffer size
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_rwmem(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t	*ns;
+	tcp_stack_t	*tcps;
+	uint_t		min;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RMEM ||
+	    lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_WMEM);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+
+	/* Linux defaults to a page */
+	min = MIN((lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RMEM ?
+	    tcps->tcps_recv_hiwat : tcps->tcps_xmit_hiwat), PAGESIZE);
+
+	lxpr_uiobuf_printf(uiobuf, "%d\t%d\t%d\n",
+	    min,
+	    (lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RMEM ?
+	    tcps->tcps_recv_hiwat : tcps->tcps_xmit_hiwat),
+	    tcps->tcps_max_buf);
+	netstack_rele(ns);
+}
+
+/*
+ * tcp_sack
+ *
+ * Enable RFC 2018 TCP Selective Acknowledgements. Boolean, default: enabled
+ *
+ * illumos: tcp_sack_permitted
+ * tcp_sack_permitted 0 == disabled, 1 == no initiate but accept,
+ * 2 == initiate and accept. default is 2.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_sack(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_SACK);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\n",
+	    (tcps->tcps_sack_permitted  == 0 ? 0 : 1));
+	netstack_rele(ns);
+}
+
+/*
+ * tcp_window_scaling
+ *
+ * RFC 1323 TCP window scaling. This feature allows the use of a large window
+ * (> 64K) on a TCP connection. Boolean; default: enabled
+ *
+ * illumos: tcp_wscale_always
+ * tcp_wscale_always is set to 1, the window scale option will always be
+ * set when connecting to a remote system. If tcp_wscale_always is 0, the
+ * window scale option will be set only if the user has requested a send or
+ * receive window larger than 64K. The default value of is 1.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_sys_net_ipv4_tcp_winscale(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	netstack_t *ns;
+	tcp_stack_t	*tcps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_WINSCALE);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, ENXIO);
+		return;
+	}
+
+	tcps = ns->netstack_tcp;
+	lxpr_uiobuf_printf(uiobuf, "%d\n", tcps->tcps_wscale_always);
+	netstack_rele(ns);
+}
+
+/*
+ * The /proc/sys/vm/dirty* files are (poorly) documented in the Linux
+ * source file Documentation/sysctl/vm.txt. These are various VM tunables
+ * that we'll never support, but that a few misguided apps want to inspect and
+ * modify. We simply hardcode some default values and we'll lie about write
+ * success to these files.
+ */
+static void
+lxpr_read_sys_vm_dirty(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	uint_t val;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_VM_DIRTY_BG_BYTES ||
+	    lxpnp->lxpr_type == LXPR_SYS_VM_DIRTY_BG_RATIO ||
+	    lxpnp->lxpr_type == LXPR_SYS_VM_DIRTY_BYTES ||
+	    lxpnp->lxpr_type == LXPR_SYS_VM_DIRTY_EXP_CS ||
+	    lxpnp->lxpr_type == LXPR_SYS_VM_DIRTY_RATIO ||
+	    lxpnp->lxpr_type == LXPR_SYS_VM_DIRTYTIME_EXP_SEC ||
+	    lxpnp->lxpr_type == LXPR_SYS_VM_DIRTY_WB_CS);
+
+	switch (lxpnp->lxpr_type) {
+	case LXPR_SYS_VM_DIRTY_BG_RATIO:
+		val = 10;
+		break;
+	case LXPR_SYS_VM_DIRTY_EXP_CS:
+		val = 3000;
+		break;
+	case LXPR_SYS_VM_DIRTY_RATIO:
+		val = 20;
+		break;
+	case LXPR_SYS_VM_DIRTYTIME_EXP_SEC:
+		val = 43200;
+		break;
+	case LXPR_SYS_VM_DIRTY_WB_CS:
+		val = 500;
+		break;
+	default:
+		val = 0;
+		break;
+	}
+
+	lxpr_uiobuf_printf(uiobuf, "%u\n", val);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_vm_max_map_cnt(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_VM_MAX_MAP_CNT);
+	/* We don't limit mappings, just say we have a large limit. */
+	lxpr_uiobuf_printf(uiobuf, "%d\n", 16777215);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_vm_minfr_kb(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_VM_MINFR_KB);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", 0);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_vm_nhpages(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_VM_NHUGEP);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", 0);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_vm_overcommit_mem(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_VM_OVERCOMMIT_MEM);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", 0);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_sys_vm_swappiness(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_VM_SWAPPINESS);
+	lxpr_uiobuf_printf(uiobuf, "%d\n", 0);
+}
+
+/*
+ * lxpr_read_uptime(): read the contents of the "uptime" file.
+ *
+ * format is: "%.2lf, %.2lf",uptime_secs, idle_secs
+ * Use fixed point arithmetic to get 2 decimal places
+ */
+/* ARGSUSED */
+static void
+lxpr_read_uptime(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	cpu_t *cp, *cpstart;
+	int pools_enabled;
+	ulong_t idle_cum = 0;
+	ulong_t cpu_count = 0;
+	ulong_t idle_s;
+	ulong_t idle_cs;
+	ulong_t up_s;
+	ulong_t up_cs;
+	hrtime_t birthtime;
+	hrtime_t centi_sec = 10000000;  /* 10^7 */
+
+	ASSERT(lxpnp->lxpr_type == LXPR_UPTIME);
+
+	/* Calculate cumulative stats */
+	mutex_enter(&cpu_lock);
+	pools_enabled = pool_pset_enabled();
+
+	cp = cpstart = CPU->cpu_part->cp_cpulist;
+	do {
+		/*
+		 * Don't count CPUs that aren't even in the system
+		 * or aren't up yet.
+		 */
+		if ((cp->cpu_flags & CPU_EXISTS) == 0) {
+			continue;
+		}
+
+		idle_cum += CPU_STATS(cp, sys.cpu_ticks_idle);
+		idle_cum += CPU_STATS(cp, sys.cpu_ticks_wait);
+		cpu_count += 1;
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+	mutex_exit(&cpu_lock);
+
+	/* Getting the Zone zsched process startup time */
+	birthtime = LXPTOZ(lxpnp)->zone_zsched->p_mstart;
+	up_cs = (gethrtime() - birthtime) / centi_sec;
+	up_s = up_cs / 100;
+	up_cs %= 100;
+
+	ASSERT(cpu_count > 0);
+	idle_cum /= cpu_count;
+	idle_s = idle_cum / hz;
+	idle_cs = idle_cum % hz;
+	idle_cs *= 100;
+	idle_cs /= hz;
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%ld.%02d %ld.%02d\n", up_s, up_cs, idle_s, idle_cs);
+}
+
+/*
+ * Report a list of each cgroup subsystem supported by our emulated cgroup fs.
+ * This needs to exist for systemd to run but for now we don't report any
+ * cgroup subsystems as being installed. The commented example below shows
+ * how to print a subsystem entry.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_cgroups(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_printf(uiobuf, "%s\t%s\t%s\t%s\n",
+	    "#subsys_name", "hierarchy", "num_cgroups", "enabled");
+
+	/*
+	 * lxpr_uiobuf_printf(uiobuf, "%s\t%s\t%s\t%s\n",
+	 *   "cpu,cpuacct", "2", "1", "1");
+	 */
+}
+
+/*
+ * Report the zone boot arguments.
+ */
+static void
+lxpr_read_cmdline(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	lxpr_uiobuf_printf(uiobuf, "%s\n", zone->zone_bootargs);
+}
+
+
+typedef enum {
+	LXCS_ALWAYS = 0,
+	LXCS_CPUID1_ECX,
+	LXCS_CPUID1_EDX,
+	LXCS_CPUID7_EBX,
+	LXCS_CPUID7_ECX,
+	LXCS_CPUID7_EDX,
+	LXCS_CPUIDD1_EAX,
+	LXCS_CPUIDX1_ECX,
+	LXCS_CPUIDX1_EDX,
+	LXCS_REG_MAX
+} lx_cpuinfo_source_t;
+
+typedef struct {
+	lx_cpuinfo_source_t	lxcm_source;
+	uint32_t		lxcm_flag;
+	const char		*lxcm_name;
+} lx_cpuinfo_mapping_t;
+
+/*
+ * This listing is derived from the X86_FEATURE flags data in the Linux kernel.
+ * Some entries are missing detectino routines.  They remain in the list,
+ * although commented out, to preserve proper order should they be fixed later.
+ */
+lx_cpuinfo_mapping_t lx_cpuinfo_mappings[] = {
+	/* CPUID EDX: */
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_FPU,		"fpu" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_VME,		"vme" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_DE,		"de" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_PSE,		"pse" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_TSC,		"tsc" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_MSR,		"msr" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_PAE,		"pae" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_MCE,		"mce" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_CX8,		"cx8" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_APIC,		"apic" },
+	/* reserved */
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_SEP,		"sep" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_MTRR,		"mtrr" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_PGE,		"pge" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_MCA,		"mca" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_CMOV,		"cmov" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_PAT,		"pat" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_PSE36,	"pse36" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_PSN,		"pn" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_CLFSH,	"clflush" },
+	/* reserved */
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_DS,		"dts" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_ACPI,		"acpi" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_MMX,		"mmx" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_FXSR,		"fxsr" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_SSE,		"sse" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_SSE2,		"sse2" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_SS,		"ss" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_HTT,		"ht" },
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_TM,		"tm" },
+	/* reserved */
+	{ LXCS_CPUID1_EDX, CPUID_INTC_EDX_PBE,		"pbe" },
+
+	/* AMD-defined CPU features, CPUID level 0x80000001, word 1 */
+#if defined(__amd64)
+	{ LXCS_ALWAYS, 1,				"syscall" },
+#endif
+	/* Present in the Linux listing but not in recent AMD docs: "mp" */
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_NX,		"nx" },
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_MMXamd,	"mmxext" },
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_FFXSR,	"fxsr_opt" },
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_1GPG,		"pdpe1gb" },
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_TSCP,		 "rdtscp" },
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_LM,		"lm" },
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_3DNowx,	"3dnowext" },
+	{ LXCS_CPUIDX1_EDX, CPUID_AMD_EDX_3DNow,	"3dnow" },
+
+	/* CPUID ECX: */
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_SSE3,		"pni" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_PCLMULQDQ,	"pclmulqdq" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_DTES64,	"dtes64" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_MON,		"monitor" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_DSCPL,	"ds_cpl" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_VMX,		"vmx" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_SMX,		"smx" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_EST,		"est" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_TM2,		"tm2" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_SSSE3,	"ssse3" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_CID,		"cid" },
+	{ LXCS_CPUID1_ECX, 0x00000800,			"sdbg" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_FMA,		"fma" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_CX16,		"cx16" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_ETPRD,	"xtpr" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_PDCM,		"pdcm" },
+	/* reserved */
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_PCID,		"pcid" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_DCA,		"dca" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_SSE4_1,	"sse4_1" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_SSE4_2,	"sse4_2" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_X2APIC,	"x2apic" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_MOVBE,	"movbe" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_POPCNT,	"popcnt" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_TSCDL,	"tsc_deadline_timer" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_AES,		"aes" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_XSAVE,	"xsave" },
+	/* osxsave */
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_AVX,		"avx" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_F16C,		"f16c" },
+	{ LXCS_CPUID1_ECX, CPUID_INTC_ECX_RDRAND,	"rdrand" },
+	/* not used */
+
+	/*
+	 * Other features, Linux-defined mapping
+	 * This range is used for feature bits which conflict or are synthesized
+	 * Skipped:
+	 * "recovery",
+	 * "longrun",
+	 * "lrti",
+	 * "cxmmx",
+	 * "k6_mtrr",
+	 * "cyrix_arr",
+	 * "centaur_mcr",
+	 * "constant_tsc",
+	 * "up",
+	 * "arch_perfmon",
+	 * "pebs",
+	 * "bts",
+	 * "rep_good",
+	 * "nopl",
+	 * "xtopology",
+	 * "tsc_reliable",
+	 * "nonstop_tsc",
+	 * "extd_apicid",
+	 * "amd_dcm",
+	 * "aperfmperf",
+	 * "eagerfpu",
+	 * "nonstop_tsc_s3",
+	 *
+	 * "hypervisor",
+	 * "rng",
+	 * "rng_en",
+	 * "ace",
+	 * "ace_en",
+	 * "ace2",
+	 * "ace2_en",
+	 * "phe",
+	 * "phe_en",
+	 * "pmm",
+	 * "pmm_en",
+	 */
+
+	/*
+	 * More extended AMD flags: CPUID level 0x80000001, ecx, word 6
+	 */
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_AHF64,	"lahf_lm" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_CMP_LGCY,	"cmp_legacy" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_SVM,		"svm" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_EAS,		"extapic" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_CR8D,		"cr8_legacy" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_LZCNT,	"abm" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_SSE4A,	"sse4a" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_MAS,		"misalignsse" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_3DNP,		"3dnowprefetch" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_OSVW,		"osvw" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_IBS,		"ibs" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_SSE5,		"xop" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_SKINIT,	"skinit" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_WDT,		"wdt" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_LWP,		"lwp" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_FMA4,		"fma4" },
+	{ LXCS_CPUIDX1_ECX, 0x00020000,			"tce" },
+
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_NIDMSR,	"nodeid_msr" },
+
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_TBM,		"tbm" },
+	{ LXCS_CPUIDX1_ECX, CPUID_AMD_ECX_TOPOEXT,	"topoext" },
+	{ LXCS_CPUIDX1_ECX, 0x00800000,			"perfctr_core" },
+	{ LXCS_CPUIDX1_ECX, 0x01000000,			"perfctr_nb" },
+	{ LXCS_CPUIDX1_ECX, 0x02000000,			"bpext" },
+	{ LXCS_CPUIDX1_ECX, 0x04000000,			"perfctr_l2" },
+	{ LXCS_CPUIDX1_ECX, 0x08000000,			"mwaitx" },
+
+	/*
+	 * Aux flags and virt bits.
+	 * Skipped:
+	 * "cpb",
+	 * "epb",
+	 * "hw_pstate",
+	 * "proc_feedback",
+	 * "intel_pt",
+	 * "tpr_shadow",
+	 * "vnmi",
+	 * "flexpriority",
+	 * "ept",
+	 * "vpid",
+	 * "vmmcall",
+	 */
+
+	/*
+	 * Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9
+	 */
+	{ LXCS_CPUID7_EBX, 0x00000001,			"fsgsbase" },
+	{ LXCS_CPUID7_EBX, 0x00000002,			"tsc_adjust" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_BMI1,	"bmi1" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_HLE,	"hle" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX2,	"avx2" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_SMEP,	"smep" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_BMI2,	"bmi2" },
+	{ LXCS_CPUID7_EBX, 0x00000200,			"erms" },
+	{ LXCS_CPUID7_EBX, 0x00000400,			"invpcid" },
+	{ LXCS_CPUID7_EBX, 0x00000800,			"rtm" },
+	{ LXCS_CPUID7_EBX, 0x00001000,			"cqm" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_MPX,	"mpx" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512F,	"avx512f" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512DQ,	"avx512dq" },
+
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_RDSEED,	"rdseed" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_ADX,	"adx" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_SMAP,	"smap" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512IFMA, "avx512ifma" },
+
+	{ LXCS_CPUID7_EBX, 0x00400000,			"pcommit" },
+	{ LXCS_CPUID7_EBX, 0x00800000,			"clflushopt" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_CLWB,	"clwb" },
+
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512PF,	"avx512pf" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512ER,	"avx512er" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512CD,	"avx512cd" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_SHA,	"sha_ni" },
+
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512BW,	"avx512bw" },
+	{ LXCS_CPUID7_EBX, CPUID_INTC_EBX_7_0_AVX512VL,	"avx512vl" },
+
+	/*
+	 * Intel-defined CPU features, CPUID level 0x00000007:0 (ecx)
+	 */
+	{ LXCS_CPUID7_ECX, CPUID_INTC_ECX_7_0_AVX512VBMI, "avx512vbmi" },
+	{ LXCS_CPUID7_ECX, CPUID_INTC_ECX_7_0_AVX512VPOPCDQ,
+	    "avx512_vpopcntdq" },
+
+	/*
+	 * Intel-defined CPU features, CPUID level 0x00000007:0 (edx)
+	 */
+	{ LXCS_CPUID7_EDX, CPUID_INTC_EDX_7_0_AVX5124NNIW, "avx512_4nniw" },
+	{ LXCS_CPUID7_EDX, CPUID_INTC_EDX_7_0_AVX5124FMAPS, "avx512_4fmaps" },
+
+	/*
+	 * Extended state features, CPUID level 0x0000000d:1 (eax)
+	 */
+	{ LXCS_CPUIDD1_EAX, CPUID_INTC_EAX_D_1_XSAVEOPT, "xsaveopt" },
+	{ LXCS_CPUIDD1_EAX, CPUID_INTC_EAX_D_1_XSAVEC,	"xsavec" },
+	{ LXCS_CPUIDD1_EAX, 0x00000004,			"xgetbv1" },
+	{ LXCS_CPUIDD1_EAX, CPUID_INTC_EAX_D_1_XSAVES,	"xsaves" },
+
+	/*
+	 * Skipped:
+	 * "cqm_llc",
+	 * "cqm_occup_llc",
+	 * "clzero",
+	 */
+
+	/*
+	 * Thermal and Power Management Leaf, CPUID level 0x00000006 (eax)
+	 * Skipped:
+	 * "dtherm",
+	 * "ida",
+	 * "arat",
+	 * "pln",
+	 * "pts",
+	 * "hwp",
+	 * "hwp_notify",
+	 * "hwp_act_window",
+	 * "hwp_epp",
+	 * "hwp_pkg_req",
+	 */
+
+	/*
+	 * AMD SVM Feature Identification, CPUID level 0x8000000a (edx)
+	 * Skipped:
+	 * "npt",
+	 * "lbrv",
+	 * "svm_lock",
+	 * "nrip_save",
+	 * "tsc_scale",
+	 * "vmcb_clean",
+	 * "flushbyasid",
+	 * "decodeassists",
+	 * "pausefilter",
+	 * "pfthreshold",
+	 */
+};
+
+#define	LX_CPUINFO_MAPPING_MAX	\
+	(sizeof (lx_cpuinfo_mappings) / sizeof (lx_cpuinfo_mappings[0]))
+
+/* ARGSUSED */
+static void
+lxpr_read_cpuinfo(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	int i;
+	cpu_t *cp, *cpstart;
+	int pools_enabled;
+	char brandstr[CPU_IDSTRLEN];
+
+	ASSERT(lxpnp->lxpr_type == LXPR_CPUINFO);
+
+	mutex_enter(&cpu_lock);
+	pools_enabled = pool_pset_enabled();
+
+	cp = cpstart = CPU->cpu_part->cp_cpulist;
+	do {
+		struct cpuid_regs cpr;
+		uint32_t maxeax, xmaxeax, cpuid_res[LXCS_REG_MAX] = { 0 };
+
+		cpr.cp_eax = 0;
+		maxeax = cpuid_insn(cp, &cpr);
+		cpr.cp_eax = 0x80000000;
+		xmaxeax = cpuid_insn(cp, &cpr);
+
+		cpuid_res[LXCS_ALWAYS] = 1;
+		if (maxeax >= 1) {
+			cpr.cp_eax = 1;
+			(void) cpuid_insn(cp, &cpr);
+			cpuid_res[LXCS_CPUID1_ECX] = cpr.cp_ecx;
+			cpuid_res[LXCS_CPUID1_EDX] = cpr.cp_edx;
+		}
+		if (maxeax >= 7) {
+			cpr.cp_eax = 7;
+			(void) cpuid_insn(cp, &cpr);
+			cpuid_res[LXCS_CPUID7_EBX] = cpr.cp_ebx;
+			cpuid_res[LXCS_CPUID7_ECX] = cpr.cp_ecx;
+			cpuid_res[LXCS_CPUID7_EDX] = cpr.cp_edx;
+		}
+		if (maxeax >= 0xd) {
+			cpr.cp_eax = 0xd;
+			cpr.cp_ecx = 1;
+			(void) cpuid_insn(cp, &cpr);
+			cpuid_res[LXCS_CPUIDD1_EAX] = cpr.cp_eax;
+		}
+		if (xmaxeax >= 0x80000001) {
+			cpr.cp_eax = 0x80000001;
+			(void) cpuid_insn(cp, &cpr);
+			cpuid_res[LXCS_CPUIDX1_ECX] = cpr.cp_ecx;
+			cpuid_res[LXCS_CPUIDX1_EDX] = cpr.cp_edx;
+		}
+
+		(void) cpuid_getbrandstr(cp, brandstr, CPU_IDSTRLEN);
+
+		lxpr_uiobuf_printf(uiobuf,
+		    "processor\t: %d\n"
+		    "vendor_id\t: %s\n"
+		    "cpu family\t: %d\n"
+		    "model\t\t: %d\n"
+		    "model name\t: %s\n"
+		    "stepping\t: %d\n"
+		    "cpu MHz\t\t: %u.%03u\n",
+		    cp->cpu_id, cpuid_getvendorstr(cp), cpuid_getfamily(cp),
+		    cpuid_getmodel(cp), brandstr, cpuid_getstep(cp),
+		    (uint32_t)(cpu_freq_hz / 1000000),
+		    ((uint32_t)(cpu_freq_hz / 1000)) % 1000);
+
+		lxpr_uiobuf_printf(uiobuf, "cache size\t: %u KB\n",
+		    getl2cacheinfo(cp, NULL, NULL, NULL) / 1024);
+
+		if (is_x86_feature(x86_featureset, X86FSET_HTT)) {
+			/*
+			 * 'siblings' is used for HT-style threads
+			 */
+			lxpr_uiobuf_printf(uiobuf,
+			    "physical id\t: %lu\n"
+			    "siblings\t: %u\n",
+			    pg_plat_hw_instance_id(cp, PGHW_CHIP),
+			    cpuid_get_ncpu_per_chip(cp));
+		}
+
+		/*
+		 * Since we're relatively picky about running on older hardware,
+		 * we can be somewhat cavalier about the answers to these ones.
+		 *
+		 * In fact, given the hardware we support, we just say:
+		 *
+		 *	fdiv_bug	: no	(if we're on a 64-bit kernel)
+		 *	hlt_bug		: no
+		 *	f00f_bug	: no
+		 *	coma_bug	: no
+		 *	wp		: yes	(write protect in supervsr mode)
+		 */
+		lxpr_uiobuf_printf(uiobuf,
+		    "fdiv_bug\t: %s\n"
+		    "hlt_bug \t: no\n"
+		    "f00f_bug\t: no\n"
+		    "coma_bug\t: no\n"
+		    "fpu\t\t: %s\n"
+		    "fpu_exception\t: %s\n"
+		    "cpuid level\t: %d\n"
+		    "flags\t\t:",
+#if defined(__i386)
+		    fpu_pentium_fdivbug ? "yes" : "no",
+#else
+		    "no",
+#endif /* __i386 */
+		    fpu_exists ? "yes" : "no", fpu_exists ? "yes" : "no",
+		    maxeax);
+
+		/* Print CPUID feature flags */
+		for (i = 0; i < LX_CPUINFO_MAPPING_MAX; i++) {
+			lx_cpuinfo_mapping_t *lxm = &lx_cpuinfo_mappings[i];
+
+			ASSERT(lxm->lxcm_source < LXCS_REG_MAX);
+			if (cpuid_res[lxm->lxcm_source] & lxm->lxcm_flag) {
+				lxpr_uiobuf_printf(uiobuf, " %s",
+				    lxm->lxcm_name);
+			}
+		}
+
+		lxpr_uiobuf_printf(uiobuf, "\n\n");
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+
+	mutex_exit(&cpu_lock);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_fd(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_FD_FD);
+	lxpr_uiobuf_seterr(uiobuf, EFAULT);
+}
+
+/*
+ * Report a list of file systems loaded in the kernel. We only report the ones
+ * which we support and which may be checked by various components to see if
+ * they are loaded.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_filesystems(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_printf(uiobuf, "%s\t%s\n", "nodev", "autofs");
+	lxpr_uiobuf_printf(uiobuf, "%s\t%s\n", "nodev", "cgroup");
+	lxpr_uiobuf_printf(uiobuf, "%s\t%s\n", "nodev", "nfs");
+	lxpr_uiobuf_printf(uiobuf, "%s\t%s\n", "nodev", "proc");
+	lxpr_uiobuf_printf(uiobuf, "%s\t%s\n", "nodev", "sysfs");
+	lxpr_uiobuf_printf(uiobuf, "%s\t%s\n", "nodev", "tmpfs");
+}
+
+/*
+ * Calculate the number of links in the task dir. Some code (e.g. chromium)
+ * depends on this value being accurate.
+ */
+static uint_t
+lxpr_count_taskdir(lxpr_node_t *lxpnp)
+{
+	proc_t *p;
+	uint_t cnt;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_TASKDIR);
+
+	p = lxpr_lock(lxpnp, ZOMB_OK);
+	if (p == NULL)
+		return (0);
+
+	cnt = lxpr_count_tasks(p);
+
+	lxpr_unlock(p);
+
+	/* Add the fixed entries ("." & "..") */
+	cnt += 2;
+	return (cnt);
+}
+
+/*
+ * lxpr_getattr(): Vnode operation for VOP_GETATTR()
+ */
+static int
+lxpr_getattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	register lxpr_node_t *lxpnp = VTOLXP(vp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	extern uint_t nproc;
+	int error;
+
+	/*
+	 * Return attributes of underlying vnode if ATTR_REAL
+	 *
+	 * but keep fd files with the symlink permissions
+	 */
+	if (lxpnp->lxpr_realvp != NULL && (flags & ATTR_REAL)) {
+		vnode_t *rvp = lxpnp->lxpr_realvp;
+
+		/*
+		 * withold attribute information to owner or root
+		 */
+		if ((error = VOP_ACCESS(rvp, 0, 0, cr, ct)) != 0) {
+			return (error);
+		}
+
+		/*
+		 * now its attributes
+		 */
+		if ((error = VOP_GETATTR(rvp, vap, flags, cr, ct)) != 0) {
+			return (error);
+		}
+
+		/*
+		 * if it's a file in lx /proc/pid/fd/xx then set its
+		 * mode and keep it looking like a symlink, fifo or socket
+		 */
+		if (type == LXPR_PID_FD_FD) {
+			vap->va_mode = lxpnp->lxpr_mode;
+			vap->va_type = lxpnp->lxpr_realvp->v_type;
+			vap->va_size = 0;
+			vap->va_nlink = 1;
+		}
+		return (0);
+	}
+
+	/* Default attributes, that may be overridden below */
+	bzero(vap, sizeof (*vap));
+	vap->va_atime = vap->va_mtime = vap->va_ctime = lxpnp->lxpr_time;
+	vap->va_nlink = 1;
+	vap->va_type = vp->v_type;
+	vap->va_mode = lxpnp->lxpr_mode;
+	vap->va_fsid = vp->v_vfsp->vfs_dev;
+	vap->va_blksize = DEV_BSIZE;
+	vap->va_uid = lxpnp->lxpr_uid;
+	vap->va_gid = lxpnp->lxpr_gid;
+	vap->va_nodeid = lxpnp->lxpr_ino;
+
+	switch (type) {
+	case LXPR_PROCDIR:
+		vap->va_nlink = nproc + 2 + PROCDIRFILES;
+		vap->va_size = (nproc + 2 + PROCDIRFILES) * LXPR_SDSIZE;
+		break;
+	case LXPR_PIDDIR:
+		vap->va_nlink = PIDDIRFILES;
+		vap->va_size = PIDDIRFILES * LXPR_SDSIZE;
+		break;
+	case LXPR_PID_TASKDIR:
+		vap->va_nlink = lxpr_count_taskdir(lxpnp);
+		vap->va_size = vap->va_nlink * LXPR_SDSIZE;
+		break;
+	case LXPR_PID_TASK_IDDIR:
+		vap->va_nlink = TIDDIRFILES;
+		vap->va_size = TIDDIRFILES * LXPR_SDSIZE;
+		break;
+	case LXPR_SELF:
+		vap->va_uid = crgetruid(curproc->p_cred);
+		vap->va_gid = crgetrgid(curproc->p_cred);
+		break;
+	case LXPR_PID_FD_FD:
+	case LXPR_PID_TID_FD_FD:
+		/*
+		 * Restore VLNK type for lstat-type activity.
+		 * See lxpr_readlink for more details.
+		 */
+		if ((flags & FOLLOW) == 0)
+			vap->va_type = VLNK;
+	default:
+		break;
+	}
+
+	vap->va_nblocks = (fsblkcnt64_t)btod(vap->va_size);
+	return (0);
+}
+
+/*
+ * lxpr_access(): Vnode operation for VOP_ACCESS()
+ */
+static int
+lxpr_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
+{
+	return (lxpr_doaccess(VTOLXP(vp), B_FALSE, mode, flags, cr, ct));
+}
+
+/*
+ * This makes up the bulk of the logic for lxpr_access.  An extra parameter
+ * ('shallow') is present to differentiate checks that must pass muster against
+ * an underlying resource (lxpr_realvp) and those that are only concerned with
+ * permission to the process.
+ */
+static int
+lxpr_doaccess(lxpr_node_t *lxpnp, boolean_t shallow, int mode, int flags,
+    cred_t *cr, caller_context_t *ct)
+{
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	boolean_t allow_pid_access = B_FALSE;
+	int shift = 0;
+	proc_t *tp;
+
+	/*
+	 * lx /proc is primarily a read only file system
+	 * We handle LXPR_SYSDIR as a special case. At least 'systemd' expects
+	 * access() to report /proc/sys is writable, but we can't do that in
+	 * lxpr_is_writable since it breaks other code paths that check if they
+	 * can write there.
+	 */
+	if ((mode & VWRITE) && !lxpr_is_writable(type)) {
+		if (type != LXPR_SYSDIR)
+			return (EROFS);
+	}
+
+	if (type == LXPR_PIDDIR) {
+		return (0);
+	}
+	if (lxpnp->lxpr_pid != 0) {
+		if ((tp = lxpr_lock(lxpnp, ZOMB_OK)) == NULL) {
+			return (ENOENT);
+		}
+		if (tp == curproc || secpolicy_proc_access(cr) == 0 ||
+		    priv_proc_cred_perm(cr, tp, NULL, mode) == 0) {
+			allow_pid_access = B_TRUE;
+		}
+		lxpr_unlock(tp);
+		switch (type) {
+		case LXPR_PID_CGROUP:
+		case LXPR_PID_CMDLINE:
+		case LXPR_PID_COMM:
+		case LXPR_PID_LIMITS:
+		case LXPR_PID_LOGINUID:
+		case LXPR_PID_MOUNTINFO:
+		case LXPR_PID_MOUNTS:
+		case LXPR_PID_OOM_SCR_ADJ:
+		case LXPR_PID_STAT:
+		case LXPR_PID_STATM:
+		case LXPR_PID_STATUS:
+		case LXPR_PID_TASKDIR:
+		case LXPR_PID_TASK_IDDIR:
+		case LXPR_PID_TID_CGROUP:
+		case LXPR_PID_TID_CMDLINE:
+		case LXPR_PID_TID_COMM:
+		case LXPR_PID_TID_LIMITS:
+		case LXPR_PID_TID_LOGINUID:
+		case LXPR_PID_TID_MOUNTINFO:
+		case LXPR_PID_TID_OOM_SCR_ADJ:
+		case LXPR_PID_TID_STAT:
+		case LXPR_PID_TID_STATM:
+		case LXPR_PID_TID_STATUS:
+			/*
+			 * These entries are accessible to any process on the
+			 * system which wishes to query them.
+			 */
+			break;
+		default:
+			/*
+			 * All other entries under the pid/tid hierarchy
+			 * require proper authorization to be accessed.
+			 */
+			if (!allow_pid_access) {
+				return (EACCES);
+			}
+			break;
+		}
+	}
+
+	/*
+	 * If this entry has an underlying vnode, rely upon its access checks.
+	 * Skip this if a shallow check has been requested.
+	 */
+	if (lxpnp->lxpr_realvp != NULL && !shallow) {
+		return (VOP_ACCESS(lxpnp->lxpr_realvp, mode, flags, cr, ct));
+	}
+
+	/*
+	 * Allow access to those (root) possessing the correct privilege or
+	 * already authorized against a pid-specific resource.
+	 */
+	if (allow_pid_access || secpolicy_proc_access(cr) == 0) {
+		return (0);
+	}
+
+	/*
+	 * Access check is based on only one of owner, group, public.  If not
+	 * owner, then check group.  If not a member of the group, then check
+	 * public access.
+	 */
+	if (crgetuid(cr) != lxpnp->lxpr_uid) {
+		shift += 3;
+		if (!groupmember((uid_t)lxpnp->lxpr_gid, cr))
+			shift += 3;
+	}
+
+	mode &= ~(lxpnp->lxpr_mode << shift);
+
+	if (mode == 0)
+		return (0);
+
+	return (EACCES);
+}
+
+/* ARGSUSED */
+static vnode_t *
+lxpr_lookup_not_a_dir(vnode_t *dp, char *comp)
+{
+	return (NULL);
+}
+
+/*
+ * lxpr_lookup(): Vnode operation for VOP_LOOKUP()
+ */
+/* ARGSUSED */
+static int
+lxpr_lookup(vnode_t *dp, char *comp, vnode_t **vpp, pathname_t *pathp,
+    int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
+    int *direntflags, pathname_t *realpnp)
+{
+	lxpr_node_t *lxpnp = VTOLXP(dp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	int error;
+
+	ASSERT(dp->v_type == VDIR);
+	ASSERT(type < LXPR_NFILES);
+
+	/*
+	 * we should never get here because the lookup
+	 * is done on the realvp for these nodes
+	 */
+	ASSERT(type != LXPR_PID_FD_FD &&
+	    type != LXPR_PID_CURDIR &&
+	    type != LXPR_PID_ROOTDIR);
+
+	/*
+	 * restrict lookup permission to owner or root
+	 */
+	if ((error = lxpr_access(dp, VEXEC, 0, cr, ct)) != 0) {
+		return (error);
+	}
+
+	/*
+	 * Just return the parent vnode if that's where we are trying to go.
+	 */
+	if (strcmp(comp, "..") == 0) {
+		VN_HOLD(lxpnp->lxpr_parent);
+		*vpp = lxpnp->lxpr_parent;
+		return (0);
+	}
+
+	/*
+	 * Special handling for directory searches.  Note: null component name
+	 * denotes that the current directory is being searched.
+	 */
+	if ((dp->v_type == VDIR) && (*comp == '\0' || strcmp(comp, ".") == 0)) {
+		VN_HOLD(dp);
+		*vpp = dp;
+		return (0);
+	}
+
+	*vpp = (lxpr_lookup_function[type](dp, comp));
+	return ((*vpp == NULL) ? ENOENT : 0);
+}
+
+/*
+ * Do a sequential search on the given directory table
+ */
+static vnode_t *
+lxpr_lookup_common(vnode_t *dp, char *comp, proc_t *p,
+    lxpr_dirent_t *dirtab, int dirtablen)
+{
+	lxpr_node_t *lxpnp;
+	int count;
+
+	for (count = 0; count < dirtablen; count++) {
+		if (strcmp(dirtab[count].d_name, comp) == 0) {
+			lxpnp = lxpr_getnode(dp, dirtab[count].d_type, p, 0);
+			dp = LXPTOV(lxpnp);
+			ASSERT(dp != NULL);
+			return (dp);
+		}
+	}
+	return (NULL);
+}
+
+static vnode_t *
+lxpr_lookup_piddir(vnode_t *dp, char *comp)
+{
+	proc_t *p;
+
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_PIDDIR);
+
+	p = lxpr_lock(VTOLXP(dp), ZOMB_OK);
+	if (p == NULL)
+		return (NULL);
+
+	dp = lxpr_lookup_common(dp, comp, p, piddir, PIDDIRFILES);
+
+	lxpr_unlock(p);
+
+	return (dp);
+}
+
+/*
+ * Lookup one of the process's task ID's.
+ */
+static vnode_t *
+lxpr_lookup_taskdir(vnode_t *dp, char *comp)
+{
+	lxpr_node_t *dlxpnp = VTOLXP(dp);
+	lxpr_node_t *lxpnp;
+	proc_t *p;
+	uint_t tid;
+	int c;
+	kthread_t *t;
+
+	ASSERT(dlxpnp->lxpr_type == LXPR_PID_TASKDIR);
+
+	/*
+	 * convert the string rendition of the filename to a thread ID
+	 */
+	tid = 0;
+	while ((c = *comp++) != '\0') {
+		int otid;
+		if (c < '0' || c > '9')
+			return (NULL);
+
+		otid = tid;
+		tid = 10 * tid + c - '0';
+		/* integer overflow */
+		if (tid / 10 != otid)
+			return (NULL);
+	}
+
+	/*
+	 * get the proc to work with and lock it
+	 */
+	p = lxpr_lock_pid(dlxpnp, tid, NO_ZOMB, &t);
+	if (p == NULL)
+		return (NULL);
+
+	/*
+	 * Bail if this is a system process.
+	 */
+	if (p->p_as == &kas) {
+		lxpr_unlock(p);
+		return (NULL);
+	}
+
+	if (p->p_brand != &lx_brand) {
+		/*
+		 * Only the main thread is visible for non-branded processes.
+		 */
+		t = p->p_tlist;
+		if (tid != p->p_pid || t == NULL) {
+			t = NULL;
+		}
+	} else if (t != NULL) {
+		/*
+		 * Disallow any access to aio in-kernel worker threads.
+		 * To prevent a potential race while looking at the lwp data
+		 * for an exiting thread, we clear the TP_KTHREAD bit in
+		 * lx_cleanlwp() while the p_lock is held.
+		 */
+		if ((t->t_proc_flag & TP_KTHREAD) != 0) {
+			lx_lwp_data_t *lwpd;
+
+			VERIFY((lwpd = ttolxlwp(t)) != NULL);
+			if ((lwpd->br_lwp_flags & BR_AIO_LWP) != 0) {
+				lxpr_unlock(p);
+				return (NULL);
+			}
+		}
+	}
+
+	if (t == NULL) {
+		lxpr_unlock(p);
+		return (NULL);
+	}
+
+	/*
+	 * Allocate and fill in a new lx /proc taskid node.
+	 * Instead of the last arg being a fd, it is a tid.
+	 */
+	lxpnp = lxpr_getnode(dp, LXPR_PID_TASK_IDDIR, p, tid);
+	dp = LXPTOV(lxpnp);
+	ASSERT(dp != NULL);
+	lxpr_unlock(p);
+	return (dp);
+}
+
+/*
+ * Lookup one of the process's task ID's.
+ */
+static vnode_t *
+lxpr_lookup_task_tid_dir(vnode_t *dp, char *comp)
+{
+	lxpr_node_t *dlxpnp = VTOLXP(dp);
+	lxpr_node_t *lxpnp;
+	proc_t *p;
+	kthread_t *t;
+	int i;
+
+	ASSERT(dlxpnp->lxpr_type == LXPR_PID_TASK_IDDIR);
+
+	/*
+	 * get the proc to work with and lock it
+	 */
+	p = lxpr_lock_pid(dlxpnp, dlxpnp->lxpr_desc, NO_ZOMB, &t);
+	if (p == NULL)
+		return (NULL);
+
+	/*
+	 * Bail if this is a system process.
+	 */
+	if (p->p_as == &kas) {
+		lxpr_unlock(p);
+		return (NULL);
+	}
+
+	/*
+	 * allocate and fill in the new lx /proc taskid dir node
+	 */
+	for (i = 0; i < TIDDIRFILES; i++) {
+		if (strcmp(tiddir[i].d_name, comp) == 0) {
+			lxpnp = lxpr_getnode(dp, tiddir[i].d_type, p,
+			    dlxpnp->lxpr_desc);
+			dp = LXPTOV(lxpnp);
+			ASSERT(dp != NULL);
+			lxpr_unlock(p);
+			return (dp);
+		}
+	}
+
+	lxpr_unlock(p);
+	return (NULL);
+}
+
+/*
+ * Lookup one of the process's open files.
+ */
+static vnode_t *
+lxpr_lookup_fddir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_PID_FDDIR ||
+	    VTOLXP(dp)->lxpr_type == LXPR_PID_TID_FDDIR);
+
+	return (lxpr_lookup_fdnode(dp, comp));
+}
+
+static vnode_t *
+lxpr_lookup_netdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_NETDIR);
+
+	dp = lxpr_lookup_common(dp, comp, NULL, netdir, NETDIRFILES);
+
+	return (dp);
+}
+
+static vnode_t *
+lxpr_lookup_procdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_PROCDIR);
+
+	/*
+	 * We know all the names of files & dirs in our file system structure
+	 * except those that are pid names.  These change as pids are created/
+	 * deleted etc., so we just look for a number as the first char to see
+	 * if we are we doing pid lookups.
+	 *
+	 * Don't need to check for "self" as it is implemented as a symlink
+	 */
+	if (*comp >= '0' && *comp <= '9') {
+		pid_t pid = 0;
+		lxpr_node_t *lxpnp = NULL;
+		vnode_t *vp;
+		proc_t *p;
+		kthread_t *t;
+		int c;
+
+		while ((c = *comp++) != '\0')
+			pid = 10 * pid + c - '0';
+
+		/*
+		 * Can't continue if the process is still loading or it doesn't
+		 * really exist yet (or maybe it just died!)
+		 */
+		p = lxpr_lock_pid(VTOLXP(dp), pid, ZOMB_OK, &t);
+		if (p == NULL)
+			return (NULL);
+
+		if (secpolicy_basic_procinfo(CRED(), p, curproc) != 0) {
+			lxpr_unlock(p);
+			return (NULL);
+		}
+
+		/*
+		 * Allocate and populate a new LX /proc node.
+		 *
+		 * Directory entries for non-main threads can be looked up as
+		 * /proc/<tid> despite the fact that they do not appear in the
+		 * readdir output.  Record the lookup pid (tid) so that later
+		 * operations can be aware of this context.
+		 */
+		lxpnp = lxpr_getnode(dp, LXPR_PIDDIR, p, pid);
+
+		lxpr_unlock(p);
+		vp = LXPTOV(lxpnp);
+		ASSERT(vp != NULL);
+
+		return (vp);
+	}
+
+	/* Lookup fixed names */
+	return (lxpr_lookup_common(dp, comp, NULL, lx_procdir, PROCDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sysdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYSDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sysdir, SYSDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_kerneldir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_KERNELDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_kerneldir,
+	    SYS_KERNELDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_kdir_randdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_KERNEL_RANDDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_randdir,
+	    SYS_RANDDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_netdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_NETDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_netdir,
+	    SYS_NETDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_net_coredir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_NET_COREDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_net_coredir,
+	    SYS_NET_COREDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_net_ipv4dir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_NET_IPV4DIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_net_ipv4dir,
+	    SYS_NET_IPV4DIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_vmdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_VMDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_vmdir,
+	    SYS_VMDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_fsdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_FSDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_fsdir,
+	    SYS_FSDIRFILES));
+}
+
+static vnode_t *
+lxpr_lookup_sys_fs_inotifydir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_SYS_FS_INOTIFYDIR);
+	return (lxpr_lookup_common(dp, comp, NULL, sys_fs_inotifydir,
+	    SYS_FS_INOTIFYDIRFILES));
+}
+
+/*
+ * lxpr_readdir(): Vnode operation for VOP_READDIR()
+ */
+/* ARGSUSED */
+static int
+lxpr_readdir(vnode_t *dp, uio_t *uiop, cred_t *cr, int *eofp,
+    caller_context_t *ct, int flags)
+{
+	lxpr_node_t *lxpnp = VTOLXP(dp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	ssize_t uresid;
+	off_t uoffset;
+	int error;
+
+	ASSERT(dp->v_type == VDIR);
+	ASSERT(type < LXPR_NFILES);
+
+	/*
+	 * we should never get here because the readdir
+	 * is done on the realvp for these nodes
+	 */
+	ASSERT(type != LXPR_PID_FD_FD &&
+	    type != LXPR_PID_CURDIR &&
+	    type != LXPR_PID_ROOTDIR);
+
+	/*
+	 * restrict readdir permission to owner or root
+	 */
+	if ((error = lxpr_access(dp, VREAD, 0, cr, ct)) != 0)
+		return (error);
+
+	uoffset = uiop->uio_offset;
+	uresid = uiop->uio_resid;
+
+	/* can't do negative reads */
+	if (uoffset < 0 || uresid <= 0)
+		return (EINVAL);
+
+	/* can't read directory entries that don't exist! */
+	if (uoffset % LXPR_SDSIZE)
+		return (ENOENT);
+
+	return (lxpr_readdir_function[type](lxpnp, uiop, eofp));
+}
+
+/* ARGSUSED */
+static int
+lxpr_readdir_not_a_dir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	return (ENOTDIR);
+}
+
+/*
+ * This has the common logic for returning directory entries
+ */
+static int
+lxpr_readdir_common(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp,
+    lxpr_dirent_t *dirtab, int dirtablen)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXPNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+
+	oresid = uiop->uio_resid;
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/*
+	 * Satisfy user request
+	 */
+	while ((uresid = uiop->uio_resid) > 0) {
+		int dirindex;
+		off_t uoffset;
+		int reclen;
+		int error;
+
+		uoffset = uiop->uio_offset;
+		dirindex  = (uoffset / LXPR_SDSIZE) - 2;
+
+		if (uoffset == 0) {
+
+			dirent->d_ino = lxpnp->lxpr_ino;
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '\0';
+			reclen = DIRENT64_RECLEN(1);
+
+		} else if (uoffset == LXPR_SDSIZE) {
+
+			dirent->d_ino = lxpr_parentinode(lxpnp);
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '.';
+			dirent->d_name[2] = '\0';
+			reclen = DIRENT64_RECLEN(2);
+
+		} else if (dirindex >= 0 && dirindex < dirtablen) {
+			int slen = strlen(dirtab[dirindex].d_name);
+
+			dirent->d_ino = lxpr_inode(dirtab[dirindex].d_type,
+			    lxpnp->lxpr_pid, 0);
+
+			VERIFY(slen < LXPNSIZ);
+			(void) strcpy(dirent->d_name, dirtab[dirindex].d_name);
+			reclen = DIRENT64_RECLEN(slen);
+
+		} else {
+			/* Run out of table entries */
+			if (eofp) {
+				*eofp = 1;
+			}
+			return (0);
+		}
+
+		dirent->d_off = (off64_t)(uoffset + LXPR_SDSIZE);
+		dirent->d_reclen = (ushort_t)reclen;
+
+		/*
+		 * if the size of the data to transfer is greater
+		 * that that requested then we can't do it this transfer.
+		 */
+		if (reclen > uresid) {
+			/*
+			 * Error if no entries have been returned yet.
+			 */
+			if (uresid == oresid) {
+				return (EINVAL);
+			}
+			break;
+		}
+
+		/*
+		 * uiomove() updates both uiop->uio_resid and uiop->uio_offset
+		 * by the same amount.  But we want uiop->uio_offset to change
+		 * in increments of LXPR_SDSIZE, which is different from the
+		 * number of bytes being returned to the user.  So we set
+		 * uiop->uio_offset separately, ignoring what uiomove() does.
+		 */
+		if ((error = uiomove((caddr_t)dirent, reclen, UIO_READ,
+		    uiop)) != 0)
+			return (error);
+
+		uiop->uio_offset = uoffset + LXPR_SDSIZE;
+	}
+
+	/* Have run out of space, but could have just done last table entry */
+	if (eofp) {
+		*eofp =
+		    (uiop->uio_offset >= ((dirtablen+2) * LXPR_SDSIZE)) ? 1 : 0;
+	}
+	return (0);
+}
+
+
+static int
+lxpr_readdir_procdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXPNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+	off_t uoffset;
+	zone_t *zone;
+	int error;
+	int ceof;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PROCDIR);
+
+	oresid = uiop->uio_resid;
+	zone = LXPTOZ(lxpnp);
+
+	/*
+	 * We return directory entries in the order: "." and ".." then the
+	 * unique lxproc files, then the directories corresponding to the
+	 * running processes.  We have defined this as the ordering because
+	 * it allows us to more easily keep track of where we are betwen calls
+	 * to getdents().  If the number of processes changes between calls
+	 * then we can't lose track of where we are in the lxproc files.
+	 */
+
+	/* Do the fixed entries */
+	error = lxpr_readdir_common(lxpnp, uiop, &ceof, lx_procdir,
+	    PROCDIRFILES);
+
+	/* Finished if we got an error or if we couldn't do all the table */
+	if (error != 0 || ceof == 0)
+		return (error);
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/* Do the process entries */
+	while ((uresid = uiop->uio_resid) > 0) {
+		proc_t *p;
+		pid_t pid, raw_pid;
+		int len;
+		int reclen;
+		int i;
+
+		uoffset = uiop->uio_offset;
+
+		/*
+		 * Stop when entire proc table has been examined.
+		 */
+		i = (uoffset / LXPR_SDSIZE) - 2 - PROCDIRFILES;
+		if (i < 0 || i >= v.v_proc) {
+			/* Run out of table entries */
+			if (eofp) {
+				*eofp = 1;
+			}
+			return (0);
+		}
+		mutex_enter(&pidlock);
+
+		/*
+		 * Skip indices for which there is no pid_entry, PIDs for
+		 * which there is no corresponding process, a PID of 0, the
+		 * zsched process for the zone, and anything the security
+		 * policy doesn't allow us to look at.
+		 */
+		if ((p = pid_entry(i)) == NULL || p->p_stat == SIDL ||
+		    p->p_pid == 0 || p->p_zone != zone ||
+		    p == zone->zone_zsched ||
+		    secpolicy_basic_procinfo(CRED(), p, curproc) != 0) {
+			mutex_exit(&pidlock);
+			goto next;
+		}
+
+		/* Translate the pid (e.g. initpid to 1) */
+		lxpr_fixpid(LXPTOZ(lxpnp), p, &pid, NULL);
+		raw_pid = p->p_pid;
+
+		ASSERT(p->p_stat != 0);
+
+		mutex_exit(&pidlock);
+
+		dirent->d_ino = lxpr_inode(LXPR_PIDDIR, raw_pid, 0);
+		len = snprintf(dirent->d_name, LXPNSIZ, "%d", pid);
+		ASSERT(len < LXPNSIZ);
+		reclen = DIRENT64_RECLEN(len);
+
+		dirent->d_off = (off64_t)(uoffset + LXPR_SDSIZE);
+		dirent->d_reclen = (ushort_t)reclen;
+
+		/*
+		 * if the size of the data to transfer is greater
+		 * that that requested then we can't do it this transfer.
+		 */
+		if (reclen > uresid) {
+			/*
+			 * Error if no entries have been returned yet.
+			 */
+			if (uresid == oresid)
+				return (EINVAL);
+			break;
+		}
+
+		/*
+		 * uiomove() updates both uiop->uio_resid and uiop->uio_offset
+		 * by the same amount.  But we want uiop->uio_offset to change
+		 * in increments of LXPR_SDSIZE, which is different from the
+		 * number of bytes being returned to the user.  So we set
+		 * uiop->uio_offset separately, in the increment of this for
+		 * the loop, ignoring what uiomove() does.
+		 */
+		if ((error = uiomove((caddr_t)dirent, reclen, UIO_READ,
+		    uiop)) != 0)
+			return (error);
+next:
+		uiop->uio_offset = uoffset + LXPR_SDSIZE;
+	}
+
+	if (eofp != NULL) {
+		*eofp = (uiop->uio_offset >=
+		    ((v.v_proc + PROCDIRFILES + 2) * LXPR_SDSIZE)) ? 1 : 0;
+	}
+
+	return (0);
+}
+
+static int
+lxpr_readdir_piddir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	proc_t *p;
+	int err;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PIDDIR);
+
+	/* can't read its contents if it died */
+	if ((p = lxpr_lock(lxpnp, ZOMB_OK)) == NULL) {
+		return (ENOENT);
+	}
+	err = lxpr_readdir_common(lxpnp, uiop, eofp, piddir, PIDDIRFILES);
+	lxpr_unlock(p);
+	return (err);
+}
+
+static int
+lxpr_readdir_netdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_NETDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, netdir, NETDIRFILES));
+}
+
+static int
+lxpr_readdir_taskdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXPNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+	off_t uoffset;
+	int error, ceof, tiddirsize, tasknum;
+	proc_t *p;
+	kthread_t *t;
+	boolean_t branded;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_TASKDIR);
+
+	oresid = uiop->uio_resid;
+
+	p = lxpr_lock(lxpnp, ZOMB_OK);
+	if (p == NULL) {
+		return (ENOENT);
+	}
+
+	/*
+	 * Just emit static entries for system processes and zombies.
+	 */
+	if ((p->p_stat == SZOMB) || (p->p_flag & (SSYS | SEXITING)) ||
+	    (p->p_as == &kas)) {
+		lxpr_unlock(p);
+		return (lxpr_readdir_common(lxpnp, uiop, eofp, 0, 0));
+	}
+
+	/*
+	 * Drop p_lock, but keep the process P_PR_LOCK'd to prevent it from
+	 * going away while we iterate over its threads.
+	 */
+	tiddirsize = p->p_lwpcnt;
+	branded = (p->p_brand == &lx_brand);
+	mutex_exit(&p->p_lock);
+
+	/* Do the fixed entries (in this case just "." & "..") */
+	error = lxpr_readdir_common(lxpnp, uiop, &ceof, 0, 0);
+
+	/* Finished if we got an error or if we couldn't do all the table */
+	if (error != 0 || ceof == 0)
+		goto out;
+
+	if ((t = p->p_tlist) == NULL) {
+		if (eofp != NULL)
+			*eofp = 1;
+		goto out;
+	}
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/*
+	 * Loop until user's request is satisfied or until all thread's have
+	 * been returned.
+	 */
+	for (tasknum = 0; (uresid = uiop->uio_resid) > 0; tasknum++) {
+		int i, reclen, len;
+		uint_t emul_tid;
+		lx_lwp_data_t *lwpd;
+
+		uoffset = uiop->uio_offset;
+
+		/*
+		 * Stop at the end of the thread list
+		 */
+		i = (uoffset / LXPR_SDSIZE) - 2;
+		if (i < 0 || i >= tiddirsize) {
+			if (eofp) {
+				*eofp = 1;
+			}
+			goto out;
+		}
+
+		if (i != tasknum)
+			goto next;
+
+		if (!branded) {
+			/*
+			 * Emulating the goofy linux task model is impossible
+			 * to do for native processes.  We can compromise by
+			 * presenting only the main thread to the consumer.
+			 */
+			emul_tid = p->p_pid;
+		} else {
+			if ((lwpd = ttolxlwp(t)) == NULL) {
+				goto next;
+			}
+			/* Don't show aio kernel worker threads */
+			if ((t->t_proc_flag & TP_KTHREAD) != 0 &&
+			    (lwpd->br_lwp_flags & BR_AIO_LWP) != 0) {
+				goto next;
+			}
+			emul_tid = lwpd->br_pid;
+			/*
+			 * Convert pid to Linux default of 1 if we're the
+			 * zone's init.
+			 */
+			if (emul_tid == LXPTOZ(lxpnp)->zone_proc_initpid)
+				emul_tid = 1;
+		}
+
+		dirent->d_ino = lxpr_inode(LXPR_PID_TASK_IDDIR, p->p_pid,
+		    emul_tid);
+		len = snprintf(dirent->d_name, LXPNSIZ, "%d", emul_tid);
+		ASSERT(len < LXPNSIZ);
+		reclen = DIRENT64_RECLEN(len);
+
+		dirent->d_off = (off64_t)(uoffset + LXPR_SDSIZE);
+		dirent->d_reclen = (ushort_t)reclen;
+
+		if (reclen > uresid) {
+			/*
+			 * Error if no entries have been returned yet.
+			 */
+			if (uresid == oresid)
+				error = EINVAL;
+			goto out;
+		}
+
+		/*
+		 * uiomove() updates both uiop->uio_resid and uiop->uio_offset
+		 * by the same amount.  But we want uiop->uio_offset to change
+		 * in increments of LXPR_SDSIZE, which is different from the
+		 * number of bytes being returned to the user.  So we set
+		 * uiop->uio_offset separately, in the increment of this for
+		 * the loop, ignoring what uiomove() does.
+		 */
+		if ((error = uiomove((caddr_t)dirent, reclen, UIO_READ,
+		    uiop)) != 0)
+			goto out;
+
+next:
+		uiop->uio_offset = uoffset + LXPR_SDSIZE;
+
+		if ((t = t->t_forw) == p->p_tlist || !branded) {
+			if (eofp != NULL)
+				*eofp = 1;
+			goto out;
+		}
+	}
+
+	if (eofp != NULL)
+		*eofp = 0;
+
+out:
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+	return (error);
+}
+
+static int
+lxpr_readdir_task_tid_dir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	proc_t *p;
+	kthread_t *t;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_TASK_IDDIR);
+
+	/* Confirm that process and thread are still present */
+	p = lxpr_lock_pid(lxpnp, lxpnp->lxpr_desc, NO_ZOMB, &t);
+	if (p == NULL) {
+		return (ENOENT);
+	}
+	lxpr_unlock(p);
+
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, tiddir, TIDDIRFILES));
+}
+
+static int
+lxpr_readdir_fddir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXPNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+	off_t uoffset;
+	int error, ceof, fddirsize;
+	proc_t *p;
+	uf_info_t *fip;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_FDDIR ||
+	    lxpnp->lxpr_type == LXPR_PID_TID_FDDIR);
+
+	oresid = uiop->uio_resid;
+
+	p = lxpr_lock(lxpnp, ZOMB_OK);
+	if (p == NULL)
+		return (ENOENT);
+
+	/*
+	 * For exiting/exited processes or those belonging to the system, only
+	 * emit the fixed entries.
+	 */
+	if ((p->p_stat == SZOMB) || (p->p_flag & (SSYS | SEXITING)) ||
+	    (p->p_as == &kas)) {
+		lxpr_unlock(p);
+		return (lxpr_readdir_common(lxpnp, uiop, eofp, 0, 0));
+	}
+
+	/*
+	 * Drop p_lock, but keep the process P_PR_LOCK'd to prevent it from
+	 * going away while we iterate over its fi_list.
+	 */
+	mutex_exit(&p->p_lock);
+
+	/* Get open file info */
+	fip = (&(p)->p_user.u_finfo);
+	mutex_enter(&fip->fi_lock);
+	fddirsize = fip->fi_nfiles;
+
+	/* Do the fixed entries (in this case just "." & "..") */
+	error = lxpr_readdir_common(lxpnp, uiop, &ceof, 0, 0);
+
+	/* Finished if we got an error or if we couldn't do all the table */
+	if (error != 0 || ceof == 0)
+		goto out;
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/*
+	 * Loop until user's request is satisfied or until
+	 * all file descriptors have been examined.
+	 */
+	for (; (uresid = uiop->uio_resid) > 0;
+	    uiop->uio_offset = uoffset + LXPR_SDSIZE) {
+		int reclen;
+		int fd;
+		int len;
+
+		uoffset = uiop->uio_offset;
+
+		/*
+		 * Stop at the end of the fd list
+		 */
+		fd = (uoffset / LXPR_SDSIZE) - 2;
+		if (fd < 0 || fd >= fddirsize) {
+			if (eofp) {
+				*eofp = 1;
+			}
+			goto out;
+		}
+
+		if (fip->fi_list[fd].uf_file == NULL)
+			continue;
+
+		dirent->d_ino = lxpr_inode(LXPR_PID_FD_FD, p->p_pid, fd);
+		len = snprintf(dirent->d_name, LXPNSIZ, "%d", fd);
+		ASSERT(len < LXPNSIZ);
+		reclen = DIRENT64_RECLEN(len);
+
+		dirent->d_off = (off64_t)(uoffset + LXPR_SDSIZE);
+		dirent->d_reclen = (ushort_t)reclen;
+
+		if (reclen > uresid) {
+			/*
+			 * Error if no entries have been returned yet.
+			 */
+			if (uresid == oresid)
+				error = EINVAL;
+			goto out;
+		}
+
+		if ((error = uiomove((caddr_t)dirent, reclen, UIO_READ,
+		    uiop)) != 0)
+			goto out;
+	}
+
+	if (eofp != NULL) {
+		*eofp =
+		    (uiop->uio_offset >= ((fddirsize+2) * LXPR_SDSIZE)) ? 1 : 0;
+	}
+
+out:
+	mutex_exit(&fip->fi_lock);
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+	return (error);
+}
+
+static int
+lxpr_readdir_sysdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYSDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sysdir, SYSDIRFILES));
+}
+
+static int
+lxpr_readdir_sys_fsdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FSDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_fsdir,
+	    SYS_FSDIRFILES));
+}
+
+static int
+lxpr_readdir_sys_fs_inotifydir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_INOTIFYDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_fs_inotifydir,
+	    SYS_FS_INOTIFYDIRFILES));
+}
+
+static int
+lxpr_readdir_sys_kerneldir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNELDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_kerneldir,
+	    SYS_KERNELDIRFILES));
+}
+
+static int
+lxpr_readdir_sys_kdir_randdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_RANDDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_randdir,
+	    SYS_RANDDIRFILES));
+}
+
+static int
+lxpr_readdir_sys_netdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NETDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_netdir,
+	    SYS_NETDIRFILES));
+}
+
+static int
+lxpr_readdir_sys_net_coredir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_COREDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_net_coredir,
+	    SYS_NET_COREDIRFILES));
+}
+
+static int
+lxpr_readdir_sys_net_ipv4dir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4DIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_net_ipv4dir,
+	    SYS_NET_IPV4DIRFILES));
+}
+
+static int
+lxpr_readdir_sys_vmdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_VMDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, sys_vmdir,
+	    SYS_VMDIRFILES));
+}
+
+#define	isdigit(c)	((c) >= '0' && (c) <= '9')
+#define	isspace(c)	((c) == ' ' || (c) == '\t' || (c) == '\n')
+
+/*
+ * Obtain a numeric value from the null-terminated input string.
+ * We don't have strtok in the kernel, so tokenize this ourselves and
+ * validate the input.
+ */
+static int
+lxpr_tokenize_num(char *str, long *pv, char **ep)
+{
+	char *pstart, *pc, c, *endptr;
+	long v;
+
+	for (pc = str; isspace(*pc); pc++)
+		;
+
+	for (pstart = pc; isdigit(*pc); pc++)
+		;
+	if (pc == pstart || (!isspace(*pc) && *pc != '\0'))
+		return (EINVAL);
+	c = *pc;
+	*pc = '\0';
+
+	if (ddi_strtol(pstart, &endptr, 10, &v) != 0) {
+		*pc = c;
+		return (EINVAL);
+	}
+	if (*endptr != '\0') {
+		*pc = c;
+		return (EINVAL);
+	}
+
+	if (pv != NULL)
+		*pv = v;
+	if (ep != NULL)
+		*ep = ++pc;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+lxpr_write_tcp_property(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct, char *prop,
+    int (*xlate)(char *, int))
+{
+	int error;
+	int res = 0;
+	size_t olen;
+	char val[16];	/* big enough for a uint numeric string */
+	netstack_t *ns;
+	mod_prop_info_t *ptbl = NULL;
+	mod_prop_info_t *pinfo = NULL;
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > sizeof (val) - 1)
+		return (EINVAL);
+
+	bzero(val, sizeof (val));
+	error = uiomove(val, olen, UIO_WRITE, uio);
+	if (error != 0)
+		return (error);
+
+	if (val[olen - 1] == '\n')
+		val[olen - 1] = '\0';
+
+	if (val[0] == '\0') /* no input */
+		return (EINVAL);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return (EINVAL);
+
+	if (xlate != NULL && xlate(val, sizeof (val)) != 0) {
+		netstack_rele(ns);
+		return (EINVAL);
+	}
+
+	ptbl = ns->netstack_tcp->tcps_propinfo_tbl;
+	pinfo = mod_prop_lookup(ptbl, prop, MOD_PROTO_TCP);
+	if (pinfo == NULL || pinfo->mpi_setf(ns, cr, pinfo, NULL, val, 0) != 0)
+		res = EINVAL;
+
+	netstack_rele(ns);
+	return (res);
+}
+
+static int
+lxpr_write_sys_net_core_somaxc(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_CORE_SOMAXCON);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct,
+	    "_conn_req_max_q", NULL));
+}
+
+static int
+lxpr_xlate_sec2ms(char *val, int size)
+{
+	long sec;
+	char *ep;
+
+	if (lxpr_tokenize_num(val, &sec, &ep) != 0)
+		return (EINVAL);
+	if (*ep != '\0')
+		return (EINVAL);
+	if (snprintf(val, size, "%ld", sec * 1000) >= size)
+		return (EINVAL);
+	return (0);
+}
+
+static int
+lxpr_xlate_ka_intvl(char *val, int size)
+{
+	long sec;
+	char *ep;
+
+	if (lxpr_tokenize_num(val, &sec, &ep) != 0)
+		return (EINVAL);
+	if (*ep != '\0')
+		return (EINVAL);
+	if (snprintf(val, size, "%ld", sec * 1000 * 9) >= size)
+		return (EINVAL);
+	return (0);
+}
+
+/*
+ * Approximately translate the input count value into a reasonable
+ * _rexmit_interval_max timeout.
+ */
+static int
+lxpr_xlate_retry2(char *val, int size)
+{
+	long cnt;
+	char *ep;
+	uint_t i, rx_max;
+
+	if (lxpr_tokenize_num(val, &cnt, &ep) != 0)
+		return (EINVAL);
+	if (*ep != '\0')
+		return (EINVAL);
+
+	/*
+	 * The _rexmit_interval_max is limited to 2 hours, so a count of 15
+	 * or more will exceed that due to exponential backoff.
+	 */
+	if (cnt > 15)
+		cnt = 15;
+
+	rx_max = 400;	/* Start with default _rexmit_interval_min in ms */
+	for (i = 0; i < cnt; i++)
+		rx_max *= 2;
+
+	/*
+	 * The _rexmit_interval_max is limited to 2 hours, so if we went over
+	 * the limit, just use 2 hours (in ms).
+	 */
+	if (rx_max > (7200 * 1000))
+		rx_max = 7200 * 1000;
+
+	if (snprintf(val, size, "%u", rx_max) >= size)
+		return (EINVAL);
+	return (0);
+}
+
+static int
+lxpr_xlate_sack(char *val, int size)
+{
+	long flag;
+	char *ep;
+
+	if (lxpr_tokenize_num(val, &flag, &ep) != 0)
+		return (EINVAL);
+	if (*ep != '\0')
+		return (EINVAL);
+	if (flag != 0 && flag != 1)
+		return (EINVAL);
+	/* see comment on lxpr_read_sys_net_ipv4_tcp_sack */
+	if (snprintf(val, size, "%d", (flag == 0 ? 0 : 2)) >= size)
+		return (EINVAL);
+	return (0);
+}
+
+/*
+ * We're updating a property on the ip stack so we can't reuse
+ * lxpr_write_tcp_property.
+ */
+/* ARGSUSED */
+static int
+lxpr_write_sys_net_ipv4_icmp_eib(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	int error;
+	size_t olen;
+	char val[16];	/* big enough for a uint numeric string */
+	long flag;
+	char *ep;
+	netstack_t *ns;
+	ip_stack_t *ipst;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_ICMP_EIB);
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > sizeof (val) - 1)
+		return (EINVAL);
+
+	bzero(val, sizeof (val));
+	error = uiomove(val, olen, UIO_WRITE, uio);
+	if (error != 0)
+		return (error);
+
+	if (val[olen - 1] == '\n')
+		val[olen - 1] = '\0';
+
+	if (val[0] == '\0') /* no input */
+		return (EINVAL);
+
+	if (lxpr_tokenize_num(val, &flag, &ep) != 0)
+		return (EINVAL);
+
+	if (*ep != '\0' || (flag != 0 && flag != 1))
+		return (EINVAL);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return (EINVAL);
+
+	ipst = ns->netstack_ip;
+	ipst->ips_ip_g_resp_to_echo_bcast = !flag;
+
+	netstack_rele(ns);
+	return (0);
+}
+
+/*
+ * We expect two port numbers on a line as input for the range, and we have to
+ * set two properties on the netstack_tcp, so we can't reuse
+ * lxpr_write_tcp_property.
+ */
+/* ARGSUSED */
+static int
+lxpr_write_sys_net_ipv4_ip_lport_range(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	int res;
+	size_t olen;
+	char vals[32];	/* big enough for a line w/ 2 16-bit numeric strings */
+	char *ep;
+	long low, high;
+	netstack_t *ns;
+	tcp_stack_t *tcps;
+	mod_prop_info_t *ptbl = NULL;
+	mod_prop_info_t *pinfo = NULL;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_IP_LPORT_RANGE);
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > sizeof (vals) - 1)
+		return (EINVAL);
+
+	bzero(vals, sizeof (vals));
+	res = uiomove(vals, olen, UIO_WRITE, uio);
+	if (res != 0)
+		return (res);
+
+	if (lxpr_tokenize_num(vals, &low, &ep) != 0)
+		return (EINVAL);
+
+	if (lxpr_tokenize_num(ep, &high, &ep) != 0)
+		return (EINVAL);
+
+	if (*ep != '\0') {
+		/* make sure no other tokens on the line */
+		*ep++ = '\0';
+		for (; isspace(*ep); ep++)
+			;
+		if (*ep != '\0')
+			return (EINVAL);
+	}
+
+	if (low > high || high > 65535)
+		return (EINVAL);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return (EINVAL);
+
+	tcps = ns->netstack_tcp;
+	if (low < tcps->tcps_smallest_nonpriv_port) {
+		netstack_rele(ns);
+		return (EINVAL);
+	}
+
+	ptbl = ns->netstack_tcp->tcps_propinfo_tbl;
+
+	(void) snprintf(vals, sizeof (vals), "%ld", low);
+	pinfo = mod_prop_lookup(ptbl, "smallest_anon_port", MOD_PROTO_TCP);
+	if (pinfo == NULL || pinfo->mpi_setf(ns, cr, pinfo, NULL, vals, 0) != 0)
+		res = EINVAL;
+
+	(void) snprintf(vals, sizeof (vals), "%ld", high);
+	pinfo = mod_prop_lookup(ptbl, "largest_anon_port", MOD_PROTO_TCP);
+	if (pinfo == NULL || pinfo->mpi_setf(ns, cr, pinfo, NULL, vals, 0) != 0)
+		res = EINVAL;
+
+	netstack_rele(ns);
+	return (res);
+}
+
+/*
+ * We expect three numbers on a line as input for the range, and we have to
+ * set two properties on the netstack_tcp, so we can't reuse
+ * lxpr_write_tcp_property.
+ *
+ * See the Linux tcp(7) man page.
+ */
+/* ARGSUSED */
+static int
+lxpr_write_sys_net_ipv4_tcp_rwmem(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	int res;
+	size_t olen;
+	char vals[80];	/* big enough for a line w/ 3 numeric strings */
+	char *ep;
+	long min, def, max, min_limit;
+	netstack_t *ns;
+	tcp_stack_t *tcps;
+	mod_prop_info_t *ptbl;
+	mod_prop_info_t *pinfo;
+	char *attr;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RMEM ||
+	    lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_WMEM);
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > sizeof (vals) - 1)
+		return (EINVAL);
+
+	bzero(vals, sizeof (vals));
+	res = uiomove(vals, olen, UIO_WRITE, uio);
+	if (res != 0)
+		return (res);
+
+	if (lxpr_tokenize_num(vals, &min, &ep) != 0)
+		return (EINVAL);
+
+	if (lxpr_tokenize_num(ep, &def, &ep) != 0)
+		return (EINVAL);
+
+	if (lxpr_tokenize_num(ep, &max, &ep) != 0)
+		return (EINVAL);
+
+	if (*ep != '\0') {
+		/* make sure no other tokens on the line */
+		*ep++ = '\0';
+		for (; isspace(*ep); ep++)
+			;
+		if (*ep != '\0')
+			return (EINVAL);
+	}
+
+	/*
+	 * Ensure the numbers are valid, low to high.
+	 * Valid ranges from the tunable's guide.
+	 */
+	min_limit = (lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RMEM ?
+	    2048 : 4096);
+	if (min > def || def > max || min < min_limit ||
+	    def > ONEGB || max < 8192)
+		return (EINVAL);
+
+	ns = lxpr_netstack(lxpnp);
+	if (ns == NULL)
+		return (EINVAL);
+
+	tcps = ns->netstack_tcp;
+
+	/* recv_hiwat and xmit_hiwat are aliased to recv_buf and send_buf. */
+	attr = (lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RMEM ?
+	    "recv_buf" : "send_buf");
+
+	(void) snprintf(vals, sizeof (vals), "%ld", def);
+	ptbl = ns->netstack_tcp->tcps_propinfo_tbl;
+	pinfo = mod_prop_lookup(ptbl, attr, MOD_PROTO_TCP);
+	if (pinfo == NULL ||
+	    pinfo->mpi_setf(ns, cr, pinfo, NULL, vals, 0) != 0)
+		res = EINVAL;
+
+	/*
+	 * Don't reduce max for one side (recv or xmit) since that impacts the
+	 * other.
+	 */
+	if (res == 0 && max > tcps->tcps_max_buf) {
+		(void) snprintf(vals, sizeof (vals), "%ld", max);
+		pinfo = mod_prop_lookup(ptbl, "max_buf", MOD_PROTO_TCP);
+		if (pinfo == NULL ||
+		    pinfo->mpi_setf(ns, cr, pinfo, NULL, vals, 0) != 0)
+			res = EINVAL;
+	}
+
+	netstack_rele(ns);
+	return (res);
+}
+
+static int
+lxpr_write_sys_net_ipv4_tcp_fin_to(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_FIN_TO);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct,
+	    "_fin_wait_2_flush_interval", lxpr_xlate_sec2ms));
+}
+
+static int
+lxpr_write_sys_net_ipv4_tcp_ka_int(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_KA_INT);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct,
+	    "_keepalive_abort_interval", lxpr_xlate_ka_intvl));
+}
+
+static int
+lxpr_write_sys_net_ipv4_tcp_ka_tim(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_KA_TIM);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct,
+	    "_keepalive_interval", lxpr_xlate_sec2ms));
+}
+
+static int
+lxpr_write_sys_net_ipv4_tcp_max_syn_bl(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_MAX_SYN_BL);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct,
+	    "_conn_req_max_q0", NULL));
+}
+
+static int
+lxpr_write_sys_net_ipv4_tcp_retry2(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_RETRY2);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct,
+	    "_rexmit_interval_max", lxpr_xlate_retry2));
+}
+
+static int
+lxpr_write_sys_net_ipv4_tcp_sack(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_SACK);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct, "sack",
+	    lxpr_xlate_sack));
+}
+
+static int
+lxpr_write_sys_net_ipv4_tcp_winscale(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_NET_IPV4_TCP_WINSCALE);
+	return (lxpr_write_tcp_property(lxpnp, uio, cr, ct, "_wscale_always",
+	    NULL));
+}
+
+/* ARGSUSED */
+static int
+lxpr_write_sys_fs_pipe_max(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	int error;
+	size_t olen;
+	char val[16];	/* big enough for a uint numeric string */
+	char *ep;
+	long u;
+	size_t size;
+	lx_zone_data_t *lxzd = ztolxzd(LXPTOZ(lxpnp));
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_FS_PIPE_MAX);
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > sizeof (val) - 1)
+		return (EINVAL);
+
+	bzero(val, sizeof (val));
+	error = uiomove(val, olen, UIO_WRITE, uio);
+	if (error != 0)
+		return (error);
+
+	if (lxpr_tokenize_num(val, &u, &ep) != 0)
+		return (EINVAL);
+	if (*ep != '\0')
+		return (EINVAL);
+
+	/*
+	 * Bound to PAGESIZE <= input <= lx_pipe_max_limit, then round to the
+	 * nearest page.  Linux is a little more picky, rounding to the nearest
+	 * power-of-two pages.  Such strengthened behavior can be added later
+	 * if needed.
+	 */
+	size = (size_t)u;
+	size = P2ROUNDUP(MIN(MAX(PAGESIZE, size), lx_pipe_max_limit), PAGESIZE);
+
+	ASSERT(size <= lx_pipe_max_limit);
+
+	mutex_enter(&lxzd->lxzd_lock);
+	lxzd->lxzd_pipe_max_sz = size;
+	mutex_exit(&lxzd->lxzd_lock);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+lxpr_write_sys_kernel_corepatt(lxpr_node_t *lxpnp, struct uio *uio,
+    struct cred *cr, caller_context_t *ct)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	struct core_globals *cg;
+	refstr_t *rp, *nrp;
+	corectl_path_t *ccp;
+	char val[MAXPATHLEN];
+	char valtr[MAXPATHLEN];
+	size_t olen;
+	int error;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_SYS_KERNEL_COREPATT);
+
+	cg = zone_getspecific(core_zone_key, zone);
+	ASSERT(cg != NULL);
+
+	if (secpolicy_coreadm(cr) != 0)
+		return (EPERM);
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > sizeof (val) - 1)
+		return (EINVAL);
+
+	bzero(val, sizeof (val));
+	error = uiomove(val, olen, UIO_WRITE, uio);
+	if (error != 0)
+		return (error);
+
+	if (val[olen - 1] == '\n')
+		val[olen - 1] = '\0';
+
+	if (val[0] == '|')
+		return (EINVAL);
+
+	if ((error = lxpr_core_path_l2s(val, valtr, sizeof (valtr))) != 0)
+		return (error);
+
+	nrp = refstr_alloc(valtr);
+
+	ccp = cg->core_default_path;
+	mutex_enter(&ccp->ccp_mtx);
+	rp = ccp->ccp_path;
+	refstr_hold((ccp->ccp_path = nrp));
+	cg->core_options |= CC_PROCESS_PATH;
+	mutex_exit(&ccp->ccp_mtx);
+
+	if (rp != NULL)
+		refstr_rele(rp);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+lxpr_write_pid_loginuid(lxpr_node_t *lxpnp, struct uio *uio, struct cred *cr,
+    caller_context_t *ct)
+{
+	int error;
+	size_t olen;
+	char val[16];	/* big enough for a uint numeric string */
+	char *ep;
+	long u;
+	proc_t *p;
+	lx_proc_data_t *pd;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_LOGINUID);
+
+	if (uio->uio_loffset != 0)
+		return (EINVAL);
+
+	if (uio->uio_resid == 0)
+		return (0);
+
+	olen = uio->uio_resid;
+	if (olen > sizeof (val) - 1)
+		return (EINVAL);
+
+	bzero(val, sizeof (val));
+	error = uiomove(val, olen, UIO_WRITE, uio);
+	if (error != 0)
+		return (error);
+
+	if (lxpr_tokenize_num(val, &u, &ep) != 0)
+		return (EINVAL);
+	if (*ep != '\0')
+		return (EINVAL);
+
+	if ((p = lxpr_lock(lxpnp, NO_ZOMB)) == NULL)
+		return (ENXIO);
+
+	if ((pd = ptolxproc(p)) != NULL) {
+		pd->l_loginuid = (uid_t)u;
+	}
+	lxpr_unlock(p);
+
+	return (0);
+}
+
+/*
+ * lxpr_readlink(): Vnode operation for VOP_READLINK()
+ */
+/* ARGSUSED */
+static int
+lxpr_readlink(vnode_t *vp, uio_t *uiop, cred_t *cr, caller_context_t *ct)
+{
+	char bp[MAXPATHLEN + 1];
+	size_t buflen = sizeof (bp);
+	lxpr_node_t *lxpnp = VTOLXP(vp);
+	vnode_t *rvp = lxpnp->lxpr_realvp;
+	pid_t pid;
+	int error = 0;
+
+	/*
+	 * Linux does something very "clever" for /proc/<pid>/fd/<num> entries.
+	 * Open FDs are represented as symlinks, the link contents
+	 * corresponding to the open resource.  For plain files or devices,
+	 * this isn't absurd since one can dereference the symlink to query
+	 * the underlying resource.  For sockets or pipes, it becomes ugly in a
+	 * hurry.  To maintain this human-readable output, those FD symlinks
+	 * point to bogus targets such as "socket:[<inodenum>]".  This requires
+	 * circumventing vfs since the stat/lstat behavior on those FD entries
+	 * will be unusual. (A stat must retrieve information about the open
+	 * socket or pipe.  It cannot fail because the link contents point to
+	 * an absent file.)
+	 *
+	 * To accomplish this, lxpr_getnode returns an vnode typed VNON for FD
+	 * entries.  This bypasses code paths which would normally
+	 * short-circuit on symlinks and allows us to emulate the vfs behavior
+	 * expected by /proc consumers.
+	 */
+	if (vp->v_type != VLNK && lxpnp->lxpr_type != LXPR_PID_FD_FD)
+		return (EINVAL);
+
+	/* Try to produce a symlink name for anything that has a realvp */
+	if (rvp != NULL) {
+		error = lxpr_doaccess(lxpnp, B_TRUE, VREAD, 0, cr, ct);
+		if (error != 0)
+			return (error);
+
+		if ((error = vnodetopath(NULL, rvp, bp, buflen, cr)) != 0) {
+			/*
+			 * Special handling possible for /proc/<pid>/fd/<num>
+			 * Generate <type>:[<inode>] links, if allowed.
+			 */
+			if (lxpnp->lxpr_type != LXPR_PID_FD_FD ||
+			    lxpr_readlink_fdnode(lxpnp, bp, buflen) != 0) {
+				return (error);
+			}
+		}
+	} else {
+		switch (lxpnp->lxpr_type) {
+		case LXPR_SELF:
+			/* Translate the pid (e.g. initpid to 1) */
+			lxpr_fixpid(LXPTOZ(lxpnp), curproc, &pid, NULL);
+
+			/*
+			 * Don't need to check result as every possible int
+			 * will fit within MAXPATHLEN bytes.
+			 */
+			(void) snprintf(bp, buflen, "%d", pid);
+			break;
+		case LXPR_PID_CURDIR:
+		case LXPR_PID_ROOTDIR:
+		case LXPR_PID_EXE:
+			return (EACCES);
+		default:
+			/*
+			 * Need to return error so that nothing thinks
+			 * that the symlink is empty and hence "."
+			 */
+			return (EINVAL);
+		}
+	}
+
+	/* copy the link data to user space */
+	return (uiomove(bp, strlen(bp), UIO_READ, uiop));
+}
+
+
+/*
+ * lxpr_inactive(): Vnode operation for VOP_INACTIVE()
+ * Vnode is no longer referenced, deallocate the file
+ * and all its resources.
+ */
+/* ARGSUSED */
+static void
+lxpr_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
+{
+	lxpr_freenode(VTOLXP(vp));
+}
+
+/*
+ * lxpr_sync(): Vnode operation for VOP_SYNC()
+ */
+static int
+lxpr_sync()
+{
+	/*
+	 * Nothing to sync but this function must never fail
+	 */
+	return (0);
+}
+
+/*
+ * lxpr_cmp(): Vnode operation for VOP_CMP()
+ */
+static int
+lxpr_cmp(vnode_t *vp1, vnode_t *vp2, caller_context_t *ct)
+{
+	vnode_t *rvp;
+
+	while (vn_matchops(vp1, lxpr_vnodeops) &&
+	    (rvp = VTOLXP(vp1)->lxpr_realvp) != NULL) {
+		vp1 = rvp;
+	}
+
+	while (vn_matchops(vp2, lxpr_vnodeops) &&
+	    (rvp = VTOLXP(vp2)->lxpr_realvp) != NULL) {
+		vp2 = rvp;
+	}
+
+	if (vn_matchops(vp1, lxpr_vnodeops) || vn_matchops(vp2, lxpr_vnodeops))
+		return (vp1 == vp2);
+	return (VOP_CMP(vp1, vp2, ct));
+}
+
+/*
+ * lxpr_realvp(): Vnode operation for VOP_REALVP()
+ */
+static int
+lxpr_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
+{
+	vnode_t *rvp;
+
+	if ((rvp = VTOLXP(vp)->lxpr_realvp) != NULL) {
+		vp = rvp;
+		if (VOP_REALVP(vp, &rvp, ct) == 0)
+			vp = rvp;
+	}
+
+	*vpp = vp;
+	return (0);
+}
+
+/* Pollhead for fake POLLET support below */
+static struct pollhead lxpr_pollhead;
+
+/* ARGSUSED */
+static int
+lxpr_poll(vnode_t *vp, short ev, int anyyet, short *reventsp,
+    pollhead_t **phpp, caller_context_t *ct)
+{
+	*reventsp = 0;
+	if (ev & POLLIN)
+		*reventsp |= POLLIN;
+	if (ev & POLLRDNORM)
+		*reventsp |= POLLRDNORM;
+	if (ev & POLLRDBAND)
+		*reventsp |= POLLRDBAND;
+	if (ev & POLLOUT)
+		*reventsp |= POLLOUT;
+	if (ev & POLLWRBAND)
+		*reventsp |= POLLWRBAND;
+
+	/*
+	 * Newer versions of systemd will monitor /proc/self/mountinfo with
+	 * edge-triggered epoll (via libmount).  If adding said resource to an
+	 * epoll descriptor fails, as would be the expectation for a call to
+	 * fs_poll when POLLET is present, then systemd will abort and the zone
+	 * will fail to properly boot.  Until proper pollwakeup() support is
+	 * wired into lx_proc, valid POLLET support must be faked.
+	 *
+	 * While the only known (at this time) lx_proc resource where POLLET
+	 * support is mandatory is LXPR_PID_MOUNTINFO, we cast a wide net to
+	 * avoid other unexpected trouble.  Normal devpoll caching (emitting a
+	 * pollhead when (*reventsp == 0 && !anyyet)) is not enabled.
+	 */
+	if ((ev & POLLET) != 0) {
+		*phpp = &lxpr_pollhead;
+	}
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+lxpr_write(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr,
+    caller_context_t *ct)
+{
+	lxpr_node_t	*lxpnp = VTOLXP(vp);
+	lxpr_nodetype_t	type = lxpnp->lxpr_type;
+	int i;
+
+	for (i = 0; wr_tab[i].wft_type != LXPR_INVALID; i++) {
+		if (wr_tab[i].wft_type == type) {
+			if (wr_tab[i].wft_wrf != NULL) {
+				return (wr_tab[i].wft_wrf(lxpnp, uiop, cr, ct));
+			}
+			break;
+		}
+	}
+
+	/* pretend we wrote the whole thing */
+	uiop->uio_offset += uiop->uio_resid;
+	uiop->uio_resid = 0;
+	return (0);
+}
+
+/* Needed for writable files which are first "truncated" */
+/* ARGSUSED */
+static int
+lxpr_space(vnode_t *vp, int cmd, flock64_t *bfp, int flag, offset_t offset,
+    cred_t *cred, caller_context_t *ct)
+{
+	int error;
+
+	if (cmd != F_FREESP)
+		return (EINVAL);
+	if ((error = lxpr_access(vp, VWRITE, 0, cred, ct)) != 0)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * Needed for writable files which are first "truncated". We only support
+ * truncation.
+ */
+/* ARGSUSED */
+static int
+lxpr_setattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	int error;
+
+	if (vap->va_mask != AT_SIZE)
+		return (EINVAL);
+	if ((error = lxpr_access(vp, VWRITE, 0, cr, ct)) != 0)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * We need to allow open with O_CREAT for the writable files.
+ */
+/* ARGSUSED */
+static int
+lxpr_create(vnode_t *dvp, char *nm, vattr_t *vap, enum vcexcl exclusive,
+    int mode, vnode_t **vpp, cred_t *cr, int flag, caller_context_t *ct,
+    vsecattr_t *vsecp)
+{
+	lxpr_node_t *lxpnp = VTOLXP(dvp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	vnode_t *vp = NULL;
+	int error;
+
+	ASSERT(type < LXPR_NFILES);
+
+	/*
+	 * restrict create permission to owner or root
+	 */
+	if ((error = lxpr_access(dvp, VEXEC, 0, cr, ct)) != 0) {
+		return (error);
+	}
+
+	if (*nm == '\0')
+		return (EPERM);
+
+	if (dvp->v_type != VDIR)
+		return (EPERM);
+
+	if (exclusive == EXCL)
+		return (EEXIST);
+
+	/*
+	 * No writable files in top-level proc dir. We check this to avoid
+	 * getting a non-proc node via "..".
+	 */
+	if (type != LXPR_PROCDIR &&
+	    lxpr_lookup(dvp, nm, &vp, NULL, 0, NULL, cr, ct, NULL, NULL) == 0) {
+		lxpr_nodetype_t ftype = VTOLXP(vp)->lxpr_type;
+		if (!lxpr_is_writable(ftype)) {
+			VN_RELE(vp);
+			vp = NULL;
+		}
+	}
+
+	if (vp != NULL) {
+		ASSERT(vp->v_type != VDIR);
+
+		/* confirm permissions against existing file */
+		if ((error = lxpr_access(vp, mode, 0, cr, ct)) != 0) {
+			VN_RELE(vp);
+			return (error);
+		}
+
+		*vpp = vp;
+		return (0);
+	}
+
+	/*
+	 * Linux proc does not allow creation of addition, non-subsystem
+	 * specific files inside the hierarchy.  ENOENT is tossed when such
+	 * actions are attempted.
+	 */
+	return (ENOENT);
+}
diff --git a/usr/src/uts/common/brand/lx/sys/lx_acl.h b/usr/src/uts/common/brand/lx/sys/lx_acl.h
new file mode 100644
index 0000000000..1e5ab26407
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_acl.h
@@ -0,0 +1,45 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017 Joyent, Inc.
+ */
+
+#ifndef _LX_ACL_H
+#define	_LX_ACL_H
+
+#include <sys/vnode.h>
+#include <sys/uio.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/* Both fall under the 'system.' namespace */
+#define	LX_XATTR_POSIX_ACL_ACCESS	"posix_acl_access"
+#define	LX_XATTR_POSIX_ACL_DEFAULT	"posix_acl_default"
+
+enum lx_acl_type {
+	LX_ACL_ACCESS,
+	LX_ACL_DEFAULT
+};
+
+extern int lx_acl_setxattr(vnode_t *, enum lx_acl_type, void *, size_t);
+extern int lx_acl_getxattr(vnode_t *, enum lx_acl_type, void *, size_t,
+    ssize_t *);
+extern int lx_acl_removexattr(vnode_t *, enum lx_acl_type);
+extern int lx_acl_listxattr(vnode_t *, uio_t *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _LX_ACL_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_audit.h b/usr/src/uts/common/brand/lx/sys/lx_audit.h
new file mode 100644
index 0000000000..76686dd9ec
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_audit.h
@@ -0,0 +1,38 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+/*
+ * Copyright 2018 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef	_LX_AUDIT_H
+#define	_LX_AUDIT_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+extern void lx_audit_init(int (*)(void *, uint_t, const char *, uint_t));
+extern void lx_audit_cleanup(void);
+extern void lx_audit_stop_worker(void *, void (*)(void *, boolean_t));
+extern int lx_audit_append_rule(void *, uint_t);
+extern int lx_audit_delete_rule(void *, uint_t);
+extern void lx_audit_list_rules(void *,
+    void (*)(void *, void *, uint_t, void *, uint_t));
+extern void lx_audit_get_feature(void *, void (*)(void *, void *, uint_t));
+extern void lx_audit_get(void *, void (*)(void *, void *, uint_t));
+extern int lx_audit_set(void *, void *, uint_t, void (*cb)(void *, boolean_t));
+extern void lx_audit_emit_user_msg(uint_t, uint_t, char *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_AUDIT_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_autofs.h b/usr/src/uts/common/brand/lx/sys/lx_autofs.h
new file mode 100644
index 0000000000..17b19895f4
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_autofs.h
@@ -0,0 +1,511 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_LX_AUTOFS_H
+#define	_LX_AUTOFS_H
+
+/*
+ * The lxautofs filesystem and driver exist to emulate the Linux autofs
+ * filesystem and /dev/autofs device (this code emulates both). The
+ * purpose is to provide support for the Linux "automount" automounter.
+ *
+ * The device ioctls map fairly closely to the filesystem ioctls. The device
+ * ioctls have superseded the filesystem ioctls and the automounter will
+ * use the device ioctls if the device exists.
+ *
+ * The device ioctls are used by the automounter to perform recovery
+ * in cases where the automounter is restarted while mounts are present. It
+ * also allows for better management operations when a filesystem is mounted
+ * on top of an autofs mountpoint, as in the case of an NFS direct mount on
+ * top of an autofs mount.
+ *
+ *
+ * +++ Linux automounter background.
+ *
+ * Linux has two automounters: "amd" (not used in any popular, modern distro)
+ * and "automount".
+ *
+ * "automount" is the normal Linux automounter.  It utilizes a kernel
+ * filesystem (autofs) and device (/dev/autofs) to provide its functionality.
+ * Basically, it mounts the autofs filesystem at any automounter controlled
+ * mountpoint. This filesystem then intercepts and redirects lookup operations
+ * to the userland automounter process via a pipe. The pipe to the automounter
+ * is established via a mount option when the autofs filesystem is mounted or
+ * via the setpipefd ioctl if the automounter restarts. When the automounter
+ * receives a request via this pipe, it does lookups (or unmounts) to whatever
+ * backing store it's configured to use, does mkdir operations on the autofs
+ * filesystem, mounts remote NFS filesystems on any directories it manages or
+ * just created, and signals the autofs device via an ioctl to let it know
+ * that the lookup (or expire) can continue. Other management operations (such
+ * as querying expiration for unmounting) are performed using the autofs device.
+ *
+ *
+ * +++ Linux autofs documentation.
+ *
+ * Within the Linux src tree, see the file:
+ * Documentation/filesystems/autofs4-mount-control.txt
+ * This documents some of the autofs behavior and the device driver ioctls.
+ *
+ * The following URL (https://lwn.net/Articles/606960/) documents autofs in
+ * general. This patch was targeted for Documentation/filesystems/autofs4.txt,
+ * but seems to have never integrated into the Linux src tree.
+ *
+ *
+ * +++ Linux autofs (and automount daemon) notes
+ *
+ * Since we're mimicking the behavior of the Linux autofs filesystem and
+ * device, we document some of the observed behavior here.
+ *
+ * There are multiple versions of the autofs filesystem kernel API protocol
+ * and modern implementations of the user-land automount daemon would depend
+ * on v5, although the filesystem API has been superseded by the driver ioctl
+ * API, which is roughly similar.
+ *
+ * We'll describe the filesystem ioctls first, since support for those was
+ * implemented first. The device ioctls roughly correspond to the filesystem
+ * ioctls and were implemented last, but the automounter will use those
+ * ioctls, instead of the filesystem ioctls, when the device is present.
+ *
+ * Our original autofs implementation was developed in the mid-2000s around the
+ * v2 protocol, but that is currently obsolete. Our current implementation is
+ * based around the v5 protocol API. There was no autofs device support at that
+ * time.
+ *
+ * The autoumounter supports 3 different, mutually exclusive, mount options for
+ * each mountpoint:
+ *   - indirect (this was all you got with the v2 support)
+ *   - direct
+ *   - offset
+ *
+ * An 'indirect' mountpoint is managed with dynamic mounts below that
+ * mountpoint. For example, if '/home' were an indirect autofs mount, then
+ * accessing a username under /home would traverse the 'lookup' code described
+ * below, cause a local subdirectory to be created, and a mount, usually NFS,
+ * onto that username subdirectory.
+ *
+ * A 'direct' mountpoint is an autofs mountpoint which will trigger the
+ * mounting of another filesystem overtop that mountpoint when accessed.
+ *
+ * An 'offset' mountpoint behaves like a 'direct' mountpoint but it is
+ * created dynamically by the automounter underneath an 'indirect' mountpoint.
+ * For example, if '/net' were an indirect autosfs mountpoint and the host
+ * 'jurassic' exported two NFS filesystems; '/var/crash' and '/var/core', then
+ * accessing '/net/jurassic' would trigger the automounter to create two
+ * subdirectories; '/net/jurassic/var/crash' and '/net/jurassic/var/core'. The
+ * automounter would then mount an autofs offset mount onto each one of these
+ * directories. Accessing either of those directories would then trigger
+ * automounter to perform another mount on top, as is done with a 'direct'
+ * mount.
+ *
+ * General behavior
+ *
+ * A) Autofs allows root owned, non-automounter processes to create
+ * directories in the autofs filesystem.  The autofs filesystem treats the
+ * automounter's process group as special, but it doesn't prevent root
+ * processes outside of the automounter's process group from creating new
+ * directories in the autofs filesystem.
+ *
+ * B) Autofs doesn't allow creation of any non-directory entries in the
+ * autofs filesystem.  No entity can create files (e.g. /bin/touch or
+ * VOP_CREATE/VOP_SYMLINK/etc.)  The only entries that can exist within
+ * the autofs filesystem are directories.
+ *
+ * C) Autofs only intercepts vop lookup operations.  Notably, it does _not_
+ * intercept and re-direct vop readdir operations.  This means that the
+ * observed behavior of the Linux automounter can be considerably different
+ * from that of the illumos automounter.  Specifically, on illumos if an autofs
+ * mountpoint is mounted _without_ the -nobrowse option then if a user does
+ * an ls operation (which translates into a vop readdir operation) then the
+ * automounter will intercept that operation and list all the possible
+ * directories and mountpoints without actually mounting any filesystems.
+ * Essentially, all automounter managed mountpoints on Linux will behave
+ * like "-nobrowse" mountpoints on illumos.  Here's an example to illustrate
+ * this.  If /ws was mounted on illumos without the -nobrowse option and an
+ * auto_ws yp map was setup as the backing store for this mountpoint, then an
+ * "ls /ws" would list all the keys in the map as valid directories, but an
+ * "ls /ws" on Linux would list an emptry directory.
+ *
+ * D) NFS mounts are performed by the automount process.  When the automount
+ * process gets a redirected lookup request, it determines _all_ the
+ * possible remote mountpoints for that request, creates directory paths
+ * via mkdir, and mounts the remote filesystems on the newly created paths.
+ * This is described in the offset mount example above. Once the automounter
+ * completed the mounts it would signal the autofs filesystem (via an ioctl)
+ * that the lookup could continue.
+ *
+ * E.1) Autofs only redirects vop lookup operations for path entries that
+ * don't already exist in the autofs filesystem.  So for the example above,
+ * an initial (after the start of the automounter) "ls /net/jurassic" would
+ * result in a request to the automounter.  A subsequest "ls /net/jurassic"
+ * would not result in a request to the automounter.  Even if
+ * /net/jurassic/var/crash and /net/jurassic/var/core were manually unmounted
+ * after the initial "ls /net/jurassic", a subsequest "ls /net/jurassic"
+ * would not result in a new request to the automounter.
+ *
+ * E.2) Autofs lookup requests that are sent to the automounter only include
+ * the root directory path component.  So for example, after starting up
+ * the automounter if a user were to do a "ls /net/jurassic/var/crash", the
+ * initial lookup request actually sent to the automounter would just be for
+ * "jurassic" (the same request as if the user had done "ls /net/jurassic").
+ * After the initial mounting of the two offset mounts onto crash and core the
+ * lookup would continue and a final lookup request would be sent to the
+ * automounter for "crash" (but this would be on a different vfs from the
+ * /net vfs).
+ *
+ * E.3) The two statements above aren't entirely entirely true.  The Linux
+ * autofs filesystem will also redirect lookup operations for leaf
+ * directories that don't have a filesystem mounted on them.  Using the
+ * example above, if a user did a "ls /net/jurassic", then manually
+ * unmounted /net/jurassic/var/crash, and then did an "ls
+ * /net/jurassic/var/crash", this would result in a request for
+ * "jurassic/var/crash" being sent to the automounter.  The strange thing
+ * (a Linux bug perhaps) is that the automounter won't do anything with this
+ * request and the lookup will fail.
+ *
+ * F) The autofs filesystem communication protocol (what ioctls it supports
+ * and what data it passes to the automount process) is versioned. The
+ * userland automount daemon (as of version v5.0.7) expects v5 of the protocol
+ * (by running the AUTOFS_IOC_PROTOSUBVER ioctl), and exits if that is not
+ * supported. For v2-v5 the structure passed through the pipe always begins
+ * with a common header followed by different fields depending on the packet
+ * type. In addition the different versions support additional ioctls.
+ *
+ * v2 - basic lookup request
+ * v3 - adds expiring (umounting)
+ * v4 - adds expire multi
+ * v5 - adds missing indirect, expire indirect, missing direct & expire direct.
+ *      Defines a new protocol structure layout.
+ *      The v5 'missing indirect' and 'missing direct' ioctls are analogous to
+ *      the v2 'missing' ioctl. These ioctls are used to initiate a mount via
+ *	a lookup. The 'expire' ioctls are used by the automounter to query if
+ *	it is possible to unmount the filesystem. 'direct' and 'indirect'
+ *	refer to the mount option type that the automounter performed and
+ *	correlate to an automounter direct or indirect map mointpoint.
+ *
+ * G) The automounter periodically issues an 'expire' ioctl to autofs to
+ * obtain the name of a mountpoint which the automounter can unmount.
+ * Unmounting is dicussed in more detail below.
+ *
+ * H) The device ioctls roughly correspond to the filesystem ioctls, but
+ * instead of being tied to an auotfs mountpoint vnode, they can be called any
+ * time. The argument structure uses either a path or an autofs pipe file
+ * descriptor to indicate what is being operated on.
+ *
+ * +++ lxautofs notes
+ *
+ * 1) In general, the lxautofs filesystem tries to mimic the behavior of the
+ * Linux autofs filesystem with the following exceptions:
+ *
+ * 	1.1) We don't bother to implement the E.3 functionality listed above
+ * 	since it doesn't appear to be of any use.
+ *
+ * 	1.2) We only fully implement v2 and v5 of the autofs protocol.
+ *
+ * 2) In general, the approach taken for lxautofs is to keep it as simple
+ * as possible and to minimize it's memory usage.  To do this all information
+ * about the contents of the lxautofs filesystem are mirrored in the
+ * underlying filesystem that lxautofs is mounted on and most vop operations
+ * are simply passed onto this underlying filesystem.  This means we don't
+ * have to implement most of the complex operations that a full filesystem
+ * normally has to implement.  It also means that most of our filesystem state
+ * (wrt the contents of the filesystem) doesn't actually have to be stored
+ * in memory, we can simply go to the underlying filesystem to get it when
+ * it's requested.  For the purposes of discussion, we'll call the underlying
+ * filesystem the "backing store."
+ *
+ * The backing store is actually a directory called ".lxautofs" which is created
+ * in the directory where the lxautofs filesystem is mounted. When the
+ * lxautofs filesystem is unmounted this backing store directory is deleted.
+ * If this directory exists at mount time (perhaps the system crashed while a
+ * previous lxautofs instance was mounted at the same location) it will be
+ * deleted. There are a few implications of using a backing store worth
+ * mentioning.
+ *
+ * 	2.1) lxautofs can't be mounted on a read only filesystem.  If this
+ * 	proves to be a problem we can probably move the location of the
+ * 	backing store.
+ *
+ * 	2.2) If the backing store filesystem runs out of space then the
+ * 	automounter process won't be able to create more directories and mount
+ * 	new filesystems.  Of course, strange failures usually happen when
+ * 	filesystems run out of space.
+ *
+ * 3) Why aren't we using gfs?  gfs has two different usage models.
+ *
+ * 	3.1) I'm my own filesystem but i'm using gfs to help with managing
+ * 	readdir operations.
+ *
+ * 	3.2) I'm a gfs filesystem and gfs is managing all my vnodes
+ *
+ * We're not using the 3.1 interfaces because we don't implement readdir
+ * ourselves.  We pass all readdir operations onto the backing store
+ * filesystem and utilize its readdir implementation.
+ *
+ * We're not using the 3.2 interfaces because they are really designed for
+ * in memory filesystems where all of the filesystem state is stored in
+ * memory.  They don't lend themselves to filesystems where part of the
+ * state is in memory and part of the state is on disk.
+ *
+ * For more information on gfs take a look at the block comments in the
+ * top of gfs.c
+ *
+ * 4) Unmounting
+ *
+ * The automounter has a timeout associated with each mount. It informs autofs
+ * of this timeout using the LX_AUTOFS_DEV_IOC_TIMEOUT_CMD ioctl after autofs
+ * has been mounted on the mountpoint.
+ *
+ * After the automounter has mounted something associated with the mountpoint
+ * then periodically (<timeout>/4 seconds) the automounter will issue the
+ * LX_AUTOFS_DEV_IOC_EXPIRE_CMD ioctl on the autofs mount. autofs is expected
+ * to respond with an underlying mountpoint entry which is a candidate for
+ * unmounting. The automounter will attempt to unmount the filesystem
+ * (which may fail if it is busy, since this is obviously racy) and then
+ * acknowledge the expire ioctl. The successful acknowledgement is independent
+ * of the success of unmounting the underlying filesystem.
+ *
+ * Unmount handling varies based on which type of mount the autofs was mounted
+ * with (indirect, direct or offset).
+ *
+ * To support 'indirect' mount expiration, the autofs vfs keeps track of the
+ * filesystems mounted immediately under the autofs mountpoint (in
+ * lav_mnt_list) after a lookup has completed successfully. Upon receipt of the
+ * LX_AUTOFS_IOC_DEV_EXPIRE_CMD ioctl, autofs removes the first element from
+ * the list, attempts to check if it is busy and if not, returns that mountpoint
+ * over the fifo (if busy the entry is added to the end of the list). When the
+ * ioctl is acknowledged, if the mountpoint still exists, that means the unmount
+ * failed and the entry is added at the back of the list. If there are no
+ * elements or the first one is busy, EAGAIN is returned for the 'expire' ioctl
+ * and the autoumounter will check again in <timeout>/4 seconds.
+ *
+ * For example, if /home is an autofs indirect mount, then there are typically
+ * many different {username}-specific NFS mounts under that /home autofs mount.
+ * autofs uses the lav_mnt_list to respond to 'expire' ioctls in a round-robin
+ * fashion so that the automounter can unmount user file systems that aren't in
+ * use.
+ *
+ * Expiring 'direct' mounts is similar, but since there is only a single mount,
+ * the lav_mnt_list only will have at most one entry if there is a filesystem
+ * mounted overtop of the autofs mount.
+ *
+ * Expiring 'offset' mounts is more complicated because there are at least
+ * two different autofs VFSs involved (the top-level and one for each offset
+ * mount underneath). The actual offset mount is handled exactly like a 'direct'
+ * mount. The top-level is an indirect mount and is handled in a similar way
+ * as described above for indirect mounts, but special handling is needed for
+ * each offset mount below.
+ *
+ * This can be explained using the same 'jurassic' example described earlier
+ * (/net is an autofs 'indirect' mount and the host 'jurassic' has two exported
+ * file systems; /var/crash and /var/core). If the user accesses
+ * /net/jurassic/var/crash then the automounter would setup the system so that
+ * the following mounts exist:
+ *   - /net (the original autofs indirect mount which triggers everything)
+ *   - /net/jurassic/var/crash (autofs offset mount)
+ *   - /net/jurassic/var/crash (NFS mount on top of the autofs offset mount)
+ *   - /net/jurassic/var/core (autofs offset mount)
+ *
+ * For expiration the automounter will issue the LX_AUTOFS_IOC_EXPIRE_MULTI
+ * ioctl on each autofs vfs for which something is mounted, so we would receive
+ * an expire ioctl on /net and another on /net/jusrassic/var/crash. The vfs for
+ * /net will be tracking "jurassic", but we detect it is busy and won't do
+ * anything at first. The vfs for "crash" will work like a direct mount and
+ * acknowledge the expire ioctl to the automounter once that filesystem times
+ * out and is no longer busy. The automounter will then unmount the "crash"
+ * NFS mount.
+ *
+ * Once the "crash" NFS mount has been unmounted by the automounter, we're left
+ * with the two autofs offset mounts under jurassic. The automounter will not
+ * try to unmount either of those, so we have to do that. Once we get another
+ * expire ioctl on /net and check "jurassic", we'll see there are only autofs
+ * mounts under /net/jurassic. We umount those using the lx_autofs_umount_offset
+ * function and respond to the automounter expire ioctl with "jurassic", in the
+ * same way as we would for any other indirect mount.
+ *
+ * 5) Recovery
+ *
+ * If the automounter is restarted for any reason, it needs to cope with
+ * pre-existing autofs mounts, as well as other automount-initiated mounts (e.g.
+ * a direct mount on top of an autofs mountpoint). The automounter uses the
+ * /proc/mounts file to correlate mounts to the managed mountpoints. It then
+ * uses the /dev/autofs device to openmount each of the autofs devices and
+ * reinitialize them using the various dev ioctls (timeout, requester, etc.).
+ *
+ * In general, the autoumounter will closemount the mountpoint once it's done,
+ * but it doesn't in the case of an offset mountpoint with nothing mounted
+ * on top. In this case the automounter expects autofs to expire that mountpoint
+ * before it will closemount (so things can subsequently cleanup). We handle
+ * this special case in the expire code path.
+ */
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Note that the name of the actual file system is lxautofs, not lx_autofs, but
+ * the code uses lx_autofs to prefix the various names. This is because file
+ * system names are limited to 8 characters.
+ */
+#define	LX_AUTOFS_NAME			"lxautofs"
+
+#define	LX_AUTOFS_MINORNAME		"autofs"
+
+/*
+ * Mount options supported.
+ */
+#define	LX_MNTOPT_FD			"fd"
+#define	LX_MNTOPT_PGRP			"pgrp"
+#define	LX_MNTOPT_MINPROTO		"minproto"
+#define	LX_MNTOPT_MAXPROTO		"maxproto"
+#define	LX_MNTOPT_INDIRECT		"indirect"
+#define	LX_MNTOPT_DIRECT		"direct"
+#define	LX_MNTOPT_OFFSET		"offset"
+
+/*
+ * Version/subversion of the Linux kernel automount protocol we support.
+ *
+ * We fully support v2 and v5. We'll return ENOTSUP for all of the ioctls we
+ * don't yet handle.
+ */
+#define	LX_AUTOFS_PROTO_VERS5		5
+#define	LX_AUTOFS_PROTO_SUBVERSION	2
+#define	LX_AUTOFS_PROTO_VERS2		2
+
+/* packet types */
+typedef enum laph_ptype {
+	LX_AUTOFS_PTYPE_MISSING,	/* 0 */
+	LX_AUTOFS_PTYPE_EXPIRE,		/* 1 */
+	LX_AUTOFS_PTYPE_EXPIRE_MULTI,	/* 2 */
+	LX_AUTOFS_PTYPE_MISSING_INDIR,	/* 3 */
+	LX_AUTOFS_PTYPE_EXPIRE_INDIR,	/* 4 */
+	LX_AUTOFS_PTYPE_MISSING_DIRECT,	/* 5 */
+	LX_AUTOFS_PTYPE_EXPIRE_DIRECT	/* 6 */
+} laph_ptype_t;
+
+/*
+ * Common header for all versions of the protocol.
+ */
+typedef struct lx_autofs_pkt_hdr {
+	int		laph_protover;	/* protocol version number */
+	laph_ptype_t	laph_type;
+	int		laph_id;	/* every pkt must have a unique id */
+} lx_autofs_pkt_hdr_t;
+
+/*
+ * Command structure sent to automount process from lxautofs via a pipe.
+ * This structure is the same for v2-v4 of the automount protocol
+ * (the communication pipe is established at mount time).
+ */
+typedef struct lx_autofs_v2_pkt {
+	lx_autofs_pkt_hdr_t lap_hdr;
+	int	lap_name_len;	/* don't include newline or NULL */
+	char	lap_name[256];	/* path component to lookup */
+} lx_autofs_v2_pkt_t;
+
+/* v4 multi-expire */
+typedef struct lx_autofs_v4_exp_pkt {
+	lx_autofs_pkt_hdr_t lape_hdr;
+	int lape_len;
+	char lape_name[MAXNAMELEN];
+} lx_autofs_v4_exp_pkt_t;
+
+/* v5 */
+typedef struct lx_autofs_v5_pkt {
+	lx_autofs_pkt_hdr_t lap_hdr;
+	uint32_t lap_dev;
+	uint64_t lap_ino;
+	uint32_t lap_uid;
+	uint32_t lap_gid;
+	uint32_t lap_pid;
+	uint32_t lap_tgid;
+	uint32_t lap_name_len;
+	char	lap_name[256];
+} lx_autofs_v5_pkt_t;
+
+union lx_autofs_pkt {
+	lx_autofs_v2_pkt_t	lap_v2;
+	lx_autofs_v5_pkt_t	lap_v5;
+};
+
+#define	lap_protover	lap_v2.lap_hdr.laph_protover
+#define	lap_type	lap_v2.lap_hdr.laph_type
+#define	lap_id		lap_v2.lap_hdr.laph_id
+
+/*
+ * Ioctls fully supported (v2 protocol).
+ */
+#define	LX_AUTOFS_IOC_READY		0x00009360 /* arg: int */
+#define	LX_AUTOFS_IOC_FAIL		0x00009361 /* arg: int */
+#define	LX_AUTOFS_IOC_CATATONIC		0x00009362 /* arg: <none> */
+
+/*
+ * Ioctls supported (v3/v4 protocol).
+ */
+#define	LX_AUTOFS_IOC_PROTOVER		0x80049363 /* arg: int */
+#define	LX_AUTOFS_IOC_SETTIMEOUT	0xc0089364 /* arg: ulong_t */
+
+/*
+ * Ioctls not supported (v3/v4 protocol).
+ */
+					/* arg: lx_autofs_v3_exp_pkt_t * */
+#define	LX_AUTOFS_IOC_EXPIRE		0x81109365
+
+/*
+ * Ioctls supported (v5 protocol).
+ */
+#define	LX_AUTOFS_IOC_PROTOSUBVER	0x80049367 /* arg: int */
+#define	LX_AUTOFS_IOC_ASKUMOUNT		0x80049370 /* arg: int */
+#define	LX_AUTOFS_IOC_EXPIRE_MULTI	0x40049366 /* arg: int */
+#define	LX_AUTOFS_IOC_EXPIRE_INDIRECT	LX_AUTOFS_IOC_EXPIRE_MULTI
+#define	LX_AUTOFS_IOC_EXPIRE_DIRECT	LX_AUTOFS_IOC_EXPIRE_MULTI
+
+/*
+ * autofs device ioctls
+ */
+#define	LX_AUTOFS_DEV_IOC_VERSION_CMD		0xc0189371
+#define	LX_AUTOFS_DEV_IOC_PROTOVER_CMD		0xc0189372
+#define	LX_AUTOFS_DEV_IOC_PROTOSUBVER_CMD	0xc0189373
+#define	LX_AUTOFS_DEV_IOC_OPENMOUNT_CMD		0xc0189374
+#define	LX_AUTOFS_DEV_IOC_CLOSEMOUNT_CMD	0xc0189375
+#define	LX_AUTOFS_DEV_IOC_READY_CMD		0xc0189376
+#define	LX_AUTOFS_DEV_IOC_FAIL_CMD		0xc0189377
+#define	LX_AUTOFS_DEV_IOC_SETPIPEFD_CMD		0xc0189378
+#define	LX_AUTOFS_DEV_IOC_CATATONIC_CMD		0xc0189379
+#define	LX_AUTOFS_DEV_IOC_TIMEOUT_CMD		0xc018937a
+#define	LX_AUTOFS_DEV_IOC_REQUESTER_CMD		0xc018937b
+#define	LX_AUTOFS_DEV_IOC_EXPIRE_CMD		0xc018937c
+#define	LX_AUTOFS_DEV_IOC_ASKUMOUNT_CMD		0xc018937d
+#define	LX_AUTOFS_DEV_IOC_ISMOUNTPOINT_CMD	0xc018937e
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_AUTOFS_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_autofs_impl.h b/usr/src/uts/common/brand/lx/sys/lx_autofs_impl.h
new file mode 100644
index 0000000000..39ea96d1fe
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_autofs_impl.h
@@ -0,0 +1,162 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_LX_AUTOFS_IMPL_H
+#define	_LX_AUTOFS_IMPL_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#include <sys/file.h>
+#include <sys/id_space.h>
+#include <sys/modhash.h>
+#include <sys/vnode.h>
+
+#include <sys/lx_autofs.h>
+
+/*
+ * Space key.
+ * Used to persist data across lx_autofs filesystem module unloads.
+ */
+#define	LX_AUTOFS_SPACE_KEY_UDEV	LX_AUTOFS_NAME "_udev"
+
+/*
+ * Name of the backing store directory.
+ */
+#define	LX_AUTOFS_BS_DIR		"." LX_AUTOFS_NAME
+
+#define	LX_AUTOFS_VFS_ID_HASH_SIZE	15
+#define	LX_AUTOFS_VFS_PATH_HASH_SIZE	15
+#define	LX_AUTOFS_VFS_VN_HASH_SIZE	15
+
+enum lx_autofs_mnttype	{ LXAMT_NONE, LXAMT_INDIR, LXAMT_DIRECT, LXAMT_OFFSET };
+
+typedef struct lx_autofs_mntent {
+	list_node_t	lxafme_lst;
+	uint64_t	lxafme_ts;	/* time stamp */
+	uint_t		lxafme_len;
+	char		*lxafme_path;
+} lx_autofs_mntent_t;
+
+/*
+ * VFS data object.
+ */
+typedef struct lx_autofs_vfs {
+	/* Info about the underlying filesystem and backing store. */
+	vnode_t		*lav_mvp;
+	char		*lav_bs_name;
+	vnode_t		*lav_bs_vp;
+
+	/* Info about the automounter process managing this filesystem. */
+	int		lav_fd;
+	pid_t		lav_pgrp;
+	file_t		*lav_fifo_wr;
+	file_t		*lav_fifo_rd;
+
+	/* The mount's dev and ino values for v5 protocol msg */
+	uint64_t	lav_dev;
+	u_longlong_t	lav_ino;
+
+	/* options from the mount */
+	enum lx_autofs_mnttype lav_mnttype;
+	int		lav_min_proto;
+
+	/*
+	 * ioctl-set timeout value. The automounter will perform an expire
+	 * ioctl every timeout/4 seconds. We use this to expire a mount once
+	 * it is inactive for the full timeout.
+	 */
+	ulong_t		lav_timeout;
+
+	/* ioctl-set catatonic value (prevents future mounts).  */
+	boolean_t	lav_catatonic;
+
+	/* Mount initiator's uid/gid for recovery handling. */
+	uid_t		lav_uid;
+	gid_t		lav_gid;
+
+	/* Each automount requests needs a unique id. */
+	id_space_t	*lav_ids;
+
+	/* All remaining structure members are protected by lav_lock. */
+	kmutex_t	lav_lock;
+	/* openmount counter */
+	int		lav_openmnt_cnt;
+
+
+	/* Hashes to keep track of outstanding automounter requests. */
+	mod_hash_t	*lav_path_hash;
+	mod_hash_t	*lav_id_hash;
+
+	/* We need to keep track of all our vnodes. */
+	vnode_t		*lav_root;
+	mod_hash_t	*lav_vn_hash;
+
+	/* list of current mounts */
+	list_t		lav_mnt_list;
+} lx_autofs_vfs_t;
+
+enum lx_autofs_callres	{ LXACR_NONE, LXACR_READY, LXACR_FAIL };
+
+/*
+ * Structure to keep track of automounter requests sent to user-land.
+ */
+typedef struct lx_autofs_automnt_req {
+	/* Packet that gets sent to the automounter. */
+	union lx_autofs_pkt laar_pkt;
+	int		laar_pkt_size;
+
+	/* Reference count.  Always updated atomically. */
+	uint_t		laar_ref;
+
+	/*
+	 * Fields to keep track and sync threads waiting on a lookup.
+	 * Fields are protected by lalr_lock.
+	 */
+	kmutex_t	laar_lock;
+	kcondvar_t	laar_cv;
+	int		laar_complete;
+
+	enum lx_autofs_callres laar_result;
+} lx_autofs_automnt_req_t;
+
+/*
+ * Generic stack structure.
+ */
+typedef struct stack_elem {
+	list_node_t	se_list;
+	caddr_t		se_ptr1;
+	caddr_t		se_ptr2;
+	caddr_t		se_ptr3;
+} stack_elem_t;
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_AUTOFS_IMPL_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_brand.h b/usr/src/uts/common/brand/lx/sys/lx_brand.h
new file mode 100644
index 0000000000..e30568086d
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_brand.h
@@ -0,0 +1,778 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _LX_BRAND_H
+#define	_LX_BRAND_H
+
+#ifndef _ASM
+#include <sys/types.h>
+#include <sys/cpuvar.h>
+#include <sys/zone.h>
+#include <sys/ksocket.h>
+#include <sys/vfs.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/cpuvar.h>
+#include <sys/lx_futex.h>
+#include <sys/lx_userhz.h>
+#endif
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	LX_BRANDNAME	"lx"
+
+/*
+ * Brand uname info
+ */
+#define	LX_UNAME_SYSNAME	"Linux"
+#define	LX_UNAME_RELEASE_2_6	"2.6.18"
+#define	LX_UNAME_RELEASE_2_4	"2.4.21"
+#define	LX_UNAME_VERSION	"BrandZ virtual linux"
+#define	LX_UNAME_MACHINE32	"i686"
+#define	LX_UNAME_MACHINE64	"x86_64"
+
+#define	LX_LIB_PATH32	"/native/usr/lib/lx_brand.so.1"
+#define	LX_LIB_PATH64	"/native/usr/lib/amd64/lx_brand.so.1"
+
+#define	LX_VDSO_PATH32	"/native/usr/lib/brand/lx/lx_vdso.so.1"
+#define	LX_VDSO_PATH64	"/native/usr/lib/brand/lx/amd64/lx_vdso.so.1"
+
+#if defined(_LP64)
+#define	LX_LIB_PATH		LX_LIB_PATH64
+#define	LX_UNAME_MACHINE	LX_UNAME_MACHINE64
+#define	LX_VDSO_PATH		LX_VDSO_PATH64
+#else
+#define	LX_LIB_PATH		LX_LIB_PATH32
+#define	LX_UNAME_MACHINE	LX_UNAME_MACHINE32
+#define	LX_VDSO_PATH		LX_VDSO_PATH32
+#endif
+
+/*
+ * This must be large enough for both the 32-bit table and 64-bit table.
+ */
+#define	LX_NSYSCALLS		358
+
+/* Highest capability we know about */
+#define	LX_CAP_MAX_VALID	36
+
+/* sched attr flag values */
+#define	LX_SCHED_FLAG_RESET_ON_FORK	0x1
+/*
+ * brand(2) subcommands
+ *
+ * Everything >= 128 is a brand-specific subcommand.
+ * > 192 is reserved for in-kernel emulated system calls.
+ */
+#define	B_LPID_TO_SPAIR		128
+#define	B_GET_CURRENT_CONTEXT	129
+#define	B_EMULATION_DONE	130
+#define	B_START_NFS_LOCKD	131
+#define	B_BLOCK_ALL_SIGS	132
+#define	B_UNBLOCK_ALL_SIGS	133
+#define	B_PTRACE_CLONE_BEGIN	134
+#define	B_PTRACE_STOP_FOR_OPT	135
+#define	B_UNSUPPORTED		136
+#define	B_STORE_ARGS		137
+#define	B_GETPID		138
+#define	B_JUMP_TO_LINUX		139
+/* formerly B_SET_THUNK_PID	140 */
+#define	B_EXIT_AS_SIG		141
+/* formerly B_HELPER_WAITID	142 */
+#define	B_HELPER_CLONE		143
+#define	B_HELPER_SETGROUPS	144
+#define	B_HELPER_SIGQUEUE	145
+#define	B_HELPER_TGSIGQUEUE	146
+#define	B_SET_NATIVE_STACK	147
+/* formerly B_SIGEV_THREAD_ID	148 */
+#define	B_OVERRIDE_KERN_VER	149
+#define	B_PTRACE_SIG_RETURN	150
+#define	B_GET_PERSONALITY	151
+
+#ifndef _ASM
+/*
+ * Support for Linux PTRACE_SETOPTIONS handling.
+ */
+typedef enum lx_ptrace_options {
+	LX_PTRACE_O_TRACESYSGOOD =	0x0001,
+	LX_PTRACE_O_TRACEFORK =		0x0002,
+	LX_PTRACE_O_TRACEVFORK =	0x0004,
+	LX_PTRACE_O_TRACECLONE =	0x0008,
+	LX_PTRACE_O_TRACEEXEC =		0x0010,
+	LX_PTRACE_O_TRACEVFORKDONE =	0x0020,
+	LX_PTRACE_O_TRACEEXIT =		0x0040,
+	LX_PTRACE_O_TRACESECCOMP =	0x0080
+} lx_ptrace_options_t;
+
+#define	LX_PTRACE_O_ALL							\
+	(LX_PTRACE_O_TRACESYSGOOD | LX_PTRACE_O_TRACEFORK | 		\
+	LX_PTRACE_O_TRACEVFORK | LX_PTRACE_O_TRACECLONE | 		\
+	LX_PTRACE_O_TRACEEXEC | LX_PTRACE_O_TRACEVFORKDONE |		\
+	LX_PTRACE_O_TRACEEXIT | LX_PTRACE_O_TRACESECCOMP)
+#endif /* !_ASM */
+
+/* siginfo si_status for traced events */
+#define	LX_PTRACE_EVENT_FORK		0x100
+#define	LX_PTRACE_EVENT_VFORK		0x200
+#define	LX_PTRACE_EVENT_CLONE		0x300
+#define	LX_PTRACE_EVENT_EXEC		0x400
+#define	LX_PTRACE_EVENT_VFORK_DONE	0x500
+#define	LX_PTRACE_EVENT_EXIT		0x600
+#define	LX_PTRACE_EVENT_SECCOMP		0x700
+
+/*
+ * Brand-private values for the "pr_what" member of lwpstatus, for use with the
+ * PR_BRAND stop reason.  These reasons are validated in lx_stop_notify();
+ * update it if you add new reasons here.
+ */
+#define	LX_PR_SYSENTRY		1
+#define	LX_PR_SYSEXIT		2
+#define	LX_PR_SIGNALLED		3
+#define	LX_PR_EVENT		4
+
+
+#define	LX_VERSION_1		1
+#define	LX_VERSION		LX_VERSION_1
+
+#define	LX_ATTR_KERN_RELEASE	ZONE_ATTR_BRAND_ATTRS
+#define	LX_ATTR_KERN_VERSION	(ZONE_ATTR_BRAND_ATTRS + 1)
+#define	LX_ATTR_TTY_GID		(ZONE_ATTR_BRAND_ATTRS + 2)
+
+/*
+ * Aux vector containing phdr of Linux executable and ehdr of interpreter
+ * (if any), both of which are used by lx_librtld_db to ascertain r_debug.
+ * We repurpose the 3rd brand-specific aux vector slot for the Linux
+ * AT_SYSINFO_EHDR entry (we modify the a_type in the brand library).
+ */
+#define	AT_SUN_BRAND_LX_PHDR		AT_SUN_BRAND_AUX1
+#define	AT_SUN_BRAND_LX_INTERP		AT_SUN_BRAND_AUX2
+#define	AT_SUN_BRAND_LX_CLKTCK		AT_SUN_BRAND_AUX3
+#define	AT_SUN_BRAND_LX_SYSINFO_EHDR	AT_SUN_BRAND_AUX4
+
+/* Aux vectors containing real/effective user/group IDs */
+#define	AT_LX_UID		11
+#define	AT_LX_EUID		12
+#define	AT_LX_GID		13
+#define	AT_LX_EGID		14
+/* Aux vector containing hz value */
+#define	AT_CLKTCK	17
+/* Aux vector containing secure boolean */
+#define	AT_SECURE	23
+/* Aux vector containing vDSO addr */
+#define	AT_SYSINFO_EHDR	33
+
+/*
+ * Usermode emulation routines are run on an alternate stack allocated by
+ * the brand library.  Every LWP in a process will incur this overhead beyond
+ * the regular thread stack:
+ */
+#define	LX_NATIVE_STACK_PAGE_COUNT	64
+
+/*
+ * When returning in a new child process created with vfork(2) (or CLONE_VFORK)
+ * we discard some of the native stack to prevent corruption of the parent
+ * emulation state.
+ */
+#define	LX_NATIVE_STACK_VFORK_GAP	0x3000
+
+#ifndef	_ASM
+
+extern struct brand lx_brand;
+
+typedef struct lx_brand_registration {
+	uint_t lxbr_version;		/* version number */
+	void *lxbr_handler;		/* base address of handler */
+	uint32_t lxbr_flags;		/* LX_PROC_* registration flags */
+} lx_brand_registration_t;
+
+typedef struct lx_brand_registration32 {
+	uint_t lxbr_version;		/* version number */
+	uint32_t lxbr_handler;		/* base address of handler */
+	uint32_t lxbr_flags;		/* LX_PROC_* registration flags */
+} lx_brand_registration32_t;
+
+#endif /* _ASM */
+
+/*
+ * GDT usage
+ */
+#define	GDT_TLSMIN	(GDT_BRANDMIN)
+#define	GDT_TLSMAX	(GDT_TLSMIN + 2)
+#define	LX_TLSNUM	(GDT_TLSMAX - GDT_TLSMIN)
+
+#ifndef _ASM
+
+/*
+ * Stores information needed by the lx linker to launch the main
+ * lx executable.
+ */
+typedef struct lx_elf_data64 {
+	uintptr_t	ed_phdr;
+	uintptr_t	ed_phent;
+	uintptr_t	ed_phnum;
+	uintptr_t	ed_entry;
+	uintptr_t	ed_base;
+	uintptr_t	ed_ldentry;
+} lx_elf_data64_t;
+
+typedef struct lx_elf_data32 {
+	uint32_t	ed_phdr;
+	uint32_t	ed_phent;
+	uint32_t	ed_phnum;
+	uint32_t	ed_entry;
+	uint32_t	ed_base;
+	uint32_t	ed_ldentry;
+} lx_elf_data32_t;
+
+#if defined(_LP64)
+typedef lx_elf_data64_t lx_elf_data_t;
+#else
+typedef lx_elf_data32_t lx_elf_data_t;
+#endif
+
+typedef enum lx_proc_flags {
+	/* flags configurable via brandsys() and members of LX_PROC_ALL */
+	LX_PROC_INSTALL_MODE	= 0x01,
+	LX_PROC_STRICT_MODE	= 0x02,
+	/* internal flags */
+	LX_PROC_CHILD_DEATHSIG	= 0x04,
+	LX_PROC_NO_DUMP		= 0x08	/* for lx_prctl LX_PR_[GS]ET_DUMPABLE */
+} lx_proc_flags_t;
+
+#define	LX_PROC_ALL	(LX_PROC_INSTALL_MODE | LX_PROC_STRICT_MODE)
+
+/* Maximum length for fields of LX uname */
+#define	LX_SYS_UTS_LN	65
+
+/* Max. length of kernel release string */
+#define	LX_KERN_RELEASE_MAX	LX_SYS_UTS_LN
+#define	LX_KERN_VERSION_MAX	LX_SYS_UTS_LN
+
+#ifdef	_KERNEL
+
+/*
+ * Entry points for cgroup integration.
+ */
+extern void (*lx_cgrp_initlwp)(vfs_t *, uint_t, id_t, pid_t);
+extern void (*lx_cgrp_freelwp)(vfs_t *, uint_t, id_t, pid_t);
+
+#define	LX_RLFAKE_LOCKS		0
+#define	LX_RLFAKE_NICE		1
+#define	LX_RLFAKE_RTPRIO	2
+#define	LX_RLFAKE_RTTIME	3
+
+#define	LX_RLFAKE_NLIMITS	4
+
+#define	LX_RLIM64_INFINITY	(~0ULL)
+
+typedef struct {
+	uint64_t	rlim_cur;
+	uint64_t	rlim_max;
+} lx_rlimit64_t;
+
+typedef struct {
+	list_node_t	lx_clgrpm_link;
+	proc_t		*lx_clgrpm_pp;
+} lx_clone_grp_member_t;
+
+typedef struct {
+	kmutex_t	lx_clgrp_lock;	/* protects cnt & member list */
+	uint_t		lx_clgrp_cnt;
+	list_t		lx_clgrp_members;
+} lx_clone_grp_t;
+
+/* Entries in the l_clone_grps clone-group array */
+#define	LX_CLGRP_FS	0
+#define	LX_CLGRP_MAX	1
+
+/* See explanation in lx_mem.c about lx_mremap */
+#define	LX_REMAP_ANONCACHE_NENTRIES	4
+typedef struct lx_segmap {
+	uintptr_t lxsm_vaddr;	/* virtual address of mapping */
+	size_t	lxsm_size;	/* size of mapping in bytes */
+	uint64_t lxsm_lru;	/* LRU field for cache */
+	uint_t	lxsm_flags;	/* protection and attribute flags */
+} lx_segmap_t;
+
+typedef struct lx_proc_data {
+	uintptr_t l_handler;	/* address of user-space handler */
+	pid_t l_ppid;		/* pid of originating parent proc */
+	uid_t l_loginuid;	/* /proc/{pid}/loginuid */
+	int64_t l_ptrace;	/* count of process lwps observed by ptrace */
+	lx_elf_data_t l_elf_data; /* ELF data for linux executable */
+	/* signal to deliver to parent when this thread group dies */
+	int l_signal;
+	/* native signal to deliver to process when parent dies */
+	int l_parent_deathsig;
+	lx_proc_flags_t l_flags;
+
+	kmutex_t l_clone_grp_lock; /* protects the following member */
+	lx_clone_grp_t *l_clone_grps[LX_CLGRP_MAX];
+
+	lx_rlimit64_t l_fake_limits[LX_RLFAKE_NLIMITS];
+
+	kmutex_t l_io_ctx_lock; /* protects the following members */
+	uintptr_t l_io_ctxpage;
+	kcondvar_t l_io_destroy_cv;
+	uint_t l_io_ctx_cnt;
+	struct lx_io_ctx  **l_io_ctxs;
+
+	/* original start/end bounds of arg/env string data */
+	uintptr_t l_args_start;
+	uintptr_t l_envs_start;
+	uintptr_t l_envs_end;
+
+	/* Override zone-wide settings for uname release and version */
+	char l_uname_release[LX_KERN_RELEASE_MAX];
+	char l_uname_version[LX_KERN_VERSION_MAX];
+
+	/* Linux process personality */
+	unsigned int l_personality;
+
+	/* VDSO location */
+	uintptr_t l_vdso;
+
+	/* mremap anon cache */
+	kmutex_t l_remap_anoncache_lock;
+	uint64_t l_remap_anoncache_generation;
+	lx_segmap_t l_remap_anoncache[LX_REMAP_ANONCACHE_NENTRIES];
+
+	/* Block all signals to all threads; used during vfork */
+	uint_t	 l_block_all_signals;
+} lx_proc_data_t;
+
+#endif	/* _KERNEL */
+
+/*
+ * Linux process personality(2) flags stored in l_personality
+ */
+#define	LX_PER_UNAME26			0x0020000
+#define	LX_PER_ADDR_NO_RANDOMIZE	0x0040000
+#define	LX_PER_FDPIC_FUNCPTRS		0x0080000
+#define	LX_PER_MMAP_PAGE_ZERO		0x0100000
+#define	LX_PER_ADDR_COMPAT_LAYOUT	0x0200000
+#define	LX_PER_READ_IMPLIES_EXEC	0x0400000
+#define	LX_PER_ADDR_LIMIT_32BIT		0x0800000
+#define	LX_PER_SHORT_INODE		0x1000000
+#define	LX_PER_WHOLE_SECONDS		0x2000000
+#define	LX_PER_STICKY_TIMEOUTS		0x4000000
+#define	LX_PER_ADDR_LIMIT_3GB		0x8000000
+
+#define	LX_PER_LINUX	0x00
+#define	LX_PER_SUNOS	(0x06 | LX_PER_STICKY_TIMEOUTS)
+#define	LX_PER_MASK	0xff
+
+/* max. number of aio control blocks (see lx_io_setup) allowed across zone */
+#define	LX_AIO_MAX_NR	65536
+
+/*
+ * A data type big enough to bitmap all Linux possible cpus.
+ * The bitmap size is defined as 1024 cpus in the Linux 2.4 and 2.6 man pages
+ * for sched_getaffinity() and sched_getaffinity().
+ */
+#define	LX_NCPU		(1024)
+#define	LX_AFF_ULONGS	(LX_NCPU / (8 * sizeof (ulong_t)))
+typedef ulong_t lx_affmask_t[LX_AFF_ULONGS];
+
+/* Length of proc boot_id string */
+#define	LX_BOOTID_LEN	37
+
+/*
+ * Flag values for uc_brand_data[0] in the ucontext_t:
+ */
+#define	LX_UC_STACK_NATIVE	0x00001
+#define	LX_UC_STACK_BRAND	0x00002
+#define	LX_UC_RESTORE_NATIVE_SP	0x00010
+#define	LX_UC_FRAME_IS_SYSCALL	0x00100
+#define	LX_UC_RESTART_SYSCALL	0x01000
+#define	LX_UC_IGNORE_LINK	0x10000
+
+#ifdef	_KERNEL
+
+typedef struct lx_lwp_data lx_lwp_data_t;
+
+/*
+ * Flag values for "lxpa_flags" on a ptrace(2) accord.
+ */
+typedef enum lx_accord_flags {
+	LX_ACC_TOMBSTONE = 0x01
+} lx_accord_flags_t;
+
+/*
+ * Flags values for "br_ptrace_flags" in the LWP-specific data.
+ */
+typedef enum lx_ptrace_flags {
+	LX_PTF_SYSCALL = 0x01,		/* handling syscall or a trap */
+	LX_PTF_EXITING = 0x02,
+	LX_PTF_STOPPING = 0x04,
+	LX_PTF_INHERIT = 0x08,
+	LX_PTF_STOPPED = 0x10,
+	LX_PTF_PARENT_WAIT = 0x20,
+	LX_PTF_CLDPEND = 0x40,
+	LX_PTF_CLONING = 0x80,
+	LX_PTF_WAITPEND = 0x100,
+	LX_PTF_NOSTOP = 0x200,		/* disable syscall stop event */
+	LX_PTF_INSYSCALL = 0x400	/* between syscall enter & exit */
+} lx_ptrace_flags_t;
+
+/*
+ * A ptrace(2) accord represents the relationship between a tracer LWP and the
+ * set of LWPs that it is tracing: the tracees.  This data structure belongs
+ * primarily to the tracer, but is reference counted so that it may be freed by
+ * whoever references it last.
+ */
+typedef struct lx_ptrace_accord {
+	kmutex_t		lxpa_lock;
+	uint_t			lxpa_refcnt;
+	lx_accord_flags_t	lxpa_flags;
+
+	/*
+	 * The tracer must hold "pidlock" while clearing these fields for
+	 * exclusion of waitid(), etc.
+	 */
+	lx_lwp_data_t		*lxpa_tracer;
+	kcondvar_t		*lxpa_cvp;
+
+	/*
+	 * The "lxpa_tracees_lock" mutex protects the tracee list.
+	 */
+	kmutex_t		lxpa_tracees_lock;
+	list_t			lxpa_tracees;
+} lx_ptrace_accord_t;
+
+/*
+ * These values are stored in the per-LWP data for a tracee when it is attached
+ * to a tracer.  They record the method that was used to attach.
+ */
+typedef enum lx_ptrace_attach {
+	LX_PTA_NONE = 0x00,		/* not attached */
+	LX_PTA_ATTACH = 0x01,		/* due to tracer using PTRACE_ATTACH */
+	LX_PTA_TRACEME = 0x02,		/* due to child using PTRACE_TRACEME */
+	LX_PTA_INHERIT_CLONE = 0x04,	/* due to PTRACE_CLONE clone(2) flag */
+	LX_PTA_INHERIT_OPTIONS = 0x08	/* due to PTRACE_SETOPTIONS options */
+} lx_ptrace_attach_t;
+
+typedef enum lx_stack_mode {
+	LX_STACK_MODE_PREINIT = 0,
+	LX_STACK_MODE_INIT,
+	LX_STACK_MODE_NATIVE,
+	LX_STACK_MODE_BRAND
+} lx_stack_mode_t;
+
+struct lx_pid {
+	pid_t		lxp_spid;	/* the SunOS pid and ... */
+	id_t		lxp_stid;	/* ... tid pair */
+	pid_t		lxp_lpid;	/* the corresponding linux pid */
+	time_t		lxp_start;	/* birthday of this pid */
+	struct pid	*lxp_pidp;	/* allocated pid struct */
+	proc_t		*lxp_procp;	/* proc_t corresponding to lxp_spid */
+	struct lx_pid	*lxp_stol_next;	/* link in stol hash table */
+	struct lx_pid	*lxp_ltos_next;	/* link in ltos hash table */
+};
+
+/*
+ * lx-specific data in the klwp_t
+ */
+struct lx_lwp_data {
+	uint_t	br_lwp_flags;		/* misc. flags */
+	klwp_t	*br_lwp;		/* back pointer to container lwp */
+	int	br_signal;		/* signal to send to parent when */
+					/* clone()'ed child terminates */
+	int	br_exitwhy;		/* reason for thread (process) exit */
+	int	br_exitwhat;		/* exit code / killing signal */
+	cpuset_t *br_affinitymask;	/* bitmask of CPU sched affinities */
+	struct user_desc br_tls[LX_TLSNUM];
+			/* descriptors used by libc for TLS */
+	ulong_t	br_lx_fsbase;		/* lx fsbase for 64-bit thread ptr */
+	ulong_t	br_ntv_fsbase;		/* native fsbase 64-bit thread ptr */
+	ulong_t	br_lx_gsbase;		/* lx user-land gsbase */
+	ulong_t	br_ntv_gsbase;		/* native user-land gsbase */
+	pid_t	br_pid;			/* converted pid for this thread */
+	pid_t	br_tgid;		/* thread group ID for this thread */
+	pid_t	br_ppid;		/* parent pid for this thread */
+	id_t	br_ptid;		/* parent tid for this thread */
+	void	*br_clear_ctidp;	/* clone thread id ptr */
+	void	*br_set_ctidp;		/* clone thread id ptr */
+	void	*br_robust_list;	/* robust lock list, if any */
+
+	/* first 4 syscall args - used for auditing */
+	uintptr_t br_syscall_args[4];
+
+	/*
+	 * The following struct is used by some system calls to pass extra
+	 * flags into the kernel without impinging on the namespace for
+	 * illumos.
+	 */
+	void	*br_scall_args;
+	int	br_args_size; /* size in bytes of br_scall_args */
+
+	boolean_t br_waitid_emulate;
+	int br_waitid_flags;
+
+	lx_ptrace_flags_t br_ptrace_flags; /* ptrace flags for this LWP */
+	lx_ptrace_options_t br_ptrace_options; /* PTRACE_SETOPTIONS options */
+	lx_ptrace_options_t br_ptrace_clone_option; /* current clone(2) type */
+
+	lx_ptrace_attach_t br_ptrace_attach; /* how did we get attached */
+	lx_ptrace_accord_t *br_ptrace_accord; /* accord for this tracer LWP */
+	lx_ptrace_accord_t *br_ptrace_tracer; /* accord tracing this LWP */
+	list_node_t br_ptrace_linkage;	/* linkage for lxpa_tracees list */
+
+	ushort_t br_ptrace_whystop; 	/* stop reason, 0 for no stop */
+	ushort_t br_ptrace_whatstop;	/* stop sub-reason */
+
+	int32_t br_ptrace_stopsig;	/* stop signal, 0 for no signal */
+	/*
+	 * Track the last (native) signal number processed by a ptrace.
+	 * This allows the tracee to properly handle ignored signals after
+	 * the tracer has been notified and the tracee restarted.
+	 */
+	int32_t br_ptrace_donesig;
+	uintptr_t br_ptrace_stopucp;	/* usermode ucontext_t pointer */
+
+	uint_t	br_ptrace_event;
+	ulong_t	br_ptrace_eventmsg;
+
+	int	br_syscall_num;		/* current system call number */
+	boolean_t br_syscall_restart;	/* should restart on EINTR */
+
+	/*
+	 * Store the LX_STACK_MODE for this LWP, and the current extent of the
+	 * native (emulation) stack.  This is similar, in principle, to the
+	 * sigaltstack mechanism for signal handling.  We also use this mode
+	 * flag to determine how to process system calls from this LWP.
+	 */
+	lx_stack_mode_t	br_stack_mode;
+	uintptr_t br_ntv_stack;
+	uintptr_t br_ntv_stack_current;
+
+	/*
+	 * If strict mode is enabled (via LX_STRICT in the environment), any
+	 * call to lx_unsupported() will set this boolean to B_TRUE.  This will
+	 * cause us to drop SIGSYS on the LWP as it attempts to return to
+	 * usermode.
+	 */
+	boolean_t br_strict_failure;
+
+	/*
+	 * Some syscalls emulated in-kernel still call back out to the
+	 * userspace emulation for certain functions.  When that is the case,
+	 * the syscall_return logic must be bypassed at the end of the
+	 * in-kernel syscall code.  The NORMALRETURN and JUSTRETURN constants
+	 * are used to choose the behavior.
+	 */
+	char br_eosys;
+
+	/*
+	 * Hold a pre-allocated lx_pid structure to be used during lx_initlwp.
+	 */
+	struct lx_pid *br_lpid;
+
+	/*
+	 * ID of the cgroup this thread belongs to.
+	 */
+	uint_t br_cgroupid;
+
+	/*
+	 * When the zone is running under FSS (which is the common case) then
+	 * we cannot change scheduling class, so we emulate that. By default
+	 * Linux uses LX_SCHED_OTHER (which is 0) and that only supports a
+	 * priority of 0, so no special initialization is needed.
+	 */
+	int	br_schd_class;		/* emulated scheduling class */
+	int	br_schd_pri;		/* emulated scheduling priority */
+	uint64_t br_schd_flags;		/* emulated [sg]et_attr flags */
+	uint64_t br_schd_runtime;	/* emulated DEADLINE */
+	uint64_t br_schd_deadline;	/* emulated DEADLINE */
+	uint64_t br_schd_period;	/* emulated DEADLINE */
+
+	fwaiter_t br_fwaiter;		/* futex upon which we're waiting */
+	uint_t	br_clone_grp_flags;	/* pending clone group */
+};
+
+/*
+ * Upper limit on br_args_size, low because this value can persist until
+ * overridden with another value, and the size is given from userland.
+ */
+#define	LX_BR_ARGS_SIZE_MAX	(1024)
+
+typedef enum lx_audit_enbl {
+	LXAE_DISABLED,
+	LXAE_ENABLED,
+	LXAE_LOCKED
+} lx_audit_enbl_t;
+
+/*
+ * brand specific data
+ *
+ * We currently only support a single cgroup mount in an lx zone so we only have
+ * one ptr (lxzd_cgroup) but this could be changed to a list if cgroups is ever
+ * enhanced to support different mounts with different subsystem controllers.
+ */
+typedef struct lx_zone_data {
+	kmutex_t lxzd_lock;			/* protects all members */
+	char lxzd_kernel_release[LX_KERN_RELEASE_MAX];
+	char lxzd_kernel_version[LX_KERN_VERSION_MAX];
+	ksocket_t lxzd_ioctl_sock;
+	char lxzd_bootid[LX_BOOTID_LEN];	/* procfs boot_id */
+	gid_t lxzd_ttygrp;			/* tty gid for pty chown */
+	vfs_t *lxzd_cgroup;			/* cgroup for this zone */
+	pid_t lxzd_lockd_pid;			/* pid of NFS lockd */
+	list_t *lxzd_vdisks;			/* virtual disks (zvols) */
+	dev_t lxzd_zfs_dev;			/* major num for zfs */
+	uint_t lxzd_aio_nr;			/* see lx_aio.c */
+	uint_t lxzd_pipe_max_sz;		/* pipe-max-size sysctl val */
+	boolean_t lxzd_swap_disabled;		/* no fake swap in zone? */
+	lx_audit_enbl_t	lxzd_audit_enabled;	/* auditing? */
+	struct lx_audit_state *lxzd_audit_state; /* zone's audit state */
+} lx_zone_data_t;
+
+/* LWP br_lwp_flags values */
+#define	BR_CPU_BOUND	0x0001
+#define	BR_AIO_LWP	0x0002			/* aio kernel worker thread */
+
+#define	ttolxlwp(t)	((struct lx_lwp_data *)ttolwpbrand(t))
+#define	lwptolxlwp(l)	((struct lx_lwp_data *)lwptolwpbrand(l))
+#define	ttolxproc(t)	\
+	(((t)->t_procp->p_brand == &lx_brand) ? \
+	(struct lx_proc_data *)(t)->t_procp->p_brand_data : NULL)
+#define	ptolxproc(p)	\
+	(((p)->p_brand == &lx_brand) ? \
+	(struct lx_proc_data *)(p)->p_brand_data : NULL)
+#define	ztolxzd(z)		\
+	(((z)->zone_brand == &lx_brand) ?  \
+	(lx_zone_data_t *)(z)->zone_brand_data : NULL)
+
+/* Macro for converting to system call arguments. */
+#define	LX_ARGS(scall) ((struct lx_##scall##_args *)\
+	(ttolxlwp(curthread)->br_scall_args))
+
+typedef enum lx_virt_disk_type {
+	LXVD_NONE,
+	LXVD_ZFS_DS,
+	LXVD_ZVOL
+} lx_virt_disk_type_t;
+
+typedef struct lx_virt_disk {
+	list_node_t		lxvd_link;
+	char			lxvd_name[MAXNAMELEN];
+	lx_virt_disk_type_t	lxvd_type;
+	dev_t			lxvd_emul_dev;
+	dev_t			lxvd_real_dev;
+	uint64_t		lxvd_volsize;
+	uint64_t		lxvd_blksize;
+	char			lxvd_real_name[MAXPATHLEN];
+} lx_virt_disk_t;
+
+/*
+ * Determine the upper bound on the system call number:
+ */
+#if defined(_LP64)
+#define	LX_MAX_SYSCALL(lwp)						\
+	((lwp_getdatamodel(lwp) == DATAMODEL_NATIVE) ?			\
+	    lx_nsysent64 : lx_nsysent32)
+#else
+#define	LX_MAX_SYSCALL(lwp)	lx_nsysent32
+#endif
+
+extern int lx_kern_release_cmp(zone_t *, const char *);
+
+extern void lx_lwp_set_native_stack_current(lx_lwp_data_t *, uintptr_t);
+extern void lx_divert(klwp_t *, uintptr_t);
+extern int lx_runexe(klwp_t *, void *);
+extern void lx_switch_to_native(klwp_t *);
+
+extern int lx_syscall_enter(void);
+extern void lx_syscall_return(klwp_t *, int, long);
+
+extern void lx_trace_sysenter(int, uintptr_t *);
+extern void lx_trace_sysreturn(int, long);
+
+extern void lx_emulate_user(klwp_t *, int, uintptr_t *);
+
+extern void lx_audit_ld();
+extern void lx_audit_unld();
+extern void lx_audit_fini(zone_t *);
+extern void lx_audit_syscall_exit(int, long);
+
+#if defined(_SYSCALL32_IMPL)
+extern void lx_emulate_user32(klwp_t *, int, uintptr_t *);
+#endif
+
+extern int lx_debug;
+#define	lx_print	if (lx_debug) printf
+
+/*
+ * Flags for lx_lpid_lock()
+ */
+typedef enum {
+	LXP_PRLOCK	= 0x1,	/* acquire PR_LOCK as part of locking */
+	LXP_ZOMBOK	= 0x2	/* allow locking of zombies */
+} lx_pid_flag_t;
+
+extern void lx_pid_assign(kthread_t *, struct lx_pid *);
+extern void lx_pid_reassign(kthread_t *);
+extern void lx_pid_rele(pid_t, id_t);
+extern pid_t lx_lpid_to_spair(pid_t, pid_t *, id_t *);
+extern int lx_lpid_lock(pid_t, zone_t *, lx_pid_flag_t, proc_t **,
+    kthread_t **);
+extern pid_t lx_lwp_ppid(klwp_t *, pid_t *, id_t *);
+extern void lx_pid_init(void);
+extern void lx_pid_fini(void);
+extern void lx_acct_out(vnode_t *, int);
+
+extern uint_t lx_pipe_max_limit;
+extern uint_t lx_pipe_max_default;
+
+/*
+ * In-Kernel Linux System Call Description.
+ */
+typedef struct lx_sysent {
+	char	*sy_name;
+	long	(*sy_callc)();
+	char	sy_flags;
+	char	sy_narg;
+} lx_sysent_t;
+
+#if defined(_LP64)
+extern lx_sysent_t lx_sysent64[LX_NSYSCALLS + 1];
+extern int lx_nsysent64;
+#endif
+extern lx_sysent_t lx_sysent32[LX_NSYSCALLS + 1];
+extern int lx_nsysent32;
+
+#endif	/* _KERNEL */
+#endif /* _ASM */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_BRAND_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_fcntl.h b/usr/src/uts/common/brand/lx/sys/lx_fcntl.h
new file mode 100644
index 0000000000..f82c6b867d
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_fcntl.h
@@ -0,0 +1,161 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_LX_FCNTL_H
+#define	_SYS_LX_FCNTL_H
+
+#include <sys/vnode.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Lx open/fcntl flags
+ */
+#define	LX_O_RDONLY		00
+#define	LX_O_WRONLY		01
+#define	LX_O_RDWR		02
+#define	LX_O_ACCMODE		(LX_O_RDONLY | LX_O_WRONLY | LX_O_RDWR)
+#define	LX_O_CREAT		0100
+#define	LX_O_EXCL		0200
+#define	LX_O_NOCTTY		0400
+#define	LX_O_TRUNC		01000
+#define	LX_O_APPEND		02000
+#define	LX_O_NONBLOCK		04000
+#define	LX_O_NDELAY		LX_O_NONBLOCK
+#define	LX_O_SYNC		010000
+#define	LX_O_FSYNC		LX_O_SYNC
+#define	LX_O_ASYNC		020000
+#define	LX_O_DIRECT		040000
+#define	LX_O_LARGEFILE		0100000
+#define	LX_O_DIRECTORY		0200000
+#define	LX_O_NOFOLLOW		0400000
+#define	LX_O_CLOEXEC		02000000
+#define	LX_O_PATH		010000000
+
+#define	LX_F_DUPFD		0
+#define	LX_F_GETFD		1
+#define	LX_F_SETFD		2
+#define	LX_F_GETFL		3
+#define	LX_F_SETFL		4
+#define	LX_F_GETLK		5
+#define	LX_F_SETLK		6
+#define	LX_F_SETLKW		7
+#define	LX_F_SETOWN		8
+#define	LX_F_GETOWN		9
+#define	LX_F_SETSIG		10
+#define	LX_F_GETSIG		11
+
+#define	LX_F_GETLK64		12
+#define	LX_F_SETLK64		13
+#define	LX_F_SETLKW64		14
+
+#define	LX_F_SETLEASE		1024
+#define	LX_F_GETLEASE		1025
+#define	LX_F_NOTIFY		1026
+#define	LX_F_CANCELLK		1029
+#define	LX_F_DUPFD_CLOEXEC	1030
+#define	LX_F_SETPIPE_SZ		1031
+#define	LX_F_GETPIPE_SZ		1032
+
+#define	LX_F_RDLCK		0
+#define	LX_F_WRLCK		1
+#define	LX_F_UNLCK		2
+
+/* Test for emulated O_PATH setting in file_t flags */
+#define	LX_IS_O_PATH(f)		(((f)->f_flag & (FREAD|FWRITE)) == 0)
+
+extern int lx_vp_at(int, char *, vnode_t **, int);
+
+/*
+ * Lx flock codes.
+ */
+#define	LX_NAME_MAX		255
+#define	LX_LOCK_SH		1	/* shared */
+#define	LX_LOCK_EX		2	/* exclusive */
+#define	LX_LOCK_NB		4	/* non-blocking */
+#define	LX_LOCK_UN		8	/* unlock */
+
+/*
+ * On Linux the constants AT_REMOVEDIR and AT_EACCESS have the same value.
+ * AT_REMOVEDIR is used only by unlinkat and AT_EACCESS is used only by
+ * faccessat.
+ */
+#define	LX_AT_FDCWD		(-100)
+#define	LX_AT_SYMLINK_NOFOLLOW	0x100
+#define	LX_AT_REMOVEDIR		0x200
+#define	LX_AT_EACCESS		0x200
+#define	LX_AT_SYMLINK_FOLLOW	0x400
+#define	LX_AT_NO_AUTOMOUNT	0x800
+#define	LX_AT_EMPTY_PATH	0x1000
+
+typedef struct lx_flock {
+	short		l_type;
+	short		l_whence;
+	long		l_start;
+	long		l_len;
+	int		l_pid;
+} lx_flock_t;
+
+typedef struct lx_flock64 {
+	short		l_type;
+	short		l_whence;
+	long long	l_start;
+	long long	l_len;
+	int		l_pid;
+} lx_flock64_t;
+
+#if defined(_KERNEL)
+
+/*
+ * 64-bit kernel view of 32-bit usermode structs.
+ */
+#pragma pack(4)
+typedef struct lx_flock32 {
+	int16_t		l_type;
+	int16_t		l_whence;
+	int32_t		l_start;
+	int32_t		l_len;
+	int32_t		l_pid;
+} lx_flock32_t;
+
+typedef struct lx_flock64_32 {
+	int16_t		l_type;
+	int16_t		l_whence;
+	int64_t		l_start;
+	int64_t		l_len;
+	int32_t		l_pid;
+} lx_flock64_32_t;
+#pragma pack()
+
+#endif /* _KERNEL && _SYSCALL32_IMPL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_FCNTL_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_futex.h b/usr/src/uts/common/brand/lx/sys/lx_futex.h
new file mode 100644
index 0000000000..7eba389218
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_futex.h
@@ -0,0 +1,143 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2017, Joyent, Inc.
+ */
+
+#ifndef _SYS_LX_FUTEX_H
+#define	_SYS_LX_FUTEX_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	FUTEX_WAIT		0
+#define	FUTEX_WAKE		1
+#define	FUTEX_FD		2
+#define	FUTEX_REQUEUE		3
+#define	FUTEX_CMP_REQUEUE	4
+#define	FUTEX_WAKE_OP		5
+#define	FUTEX_LOCK_PI		6
+#define	FUTEX_UNLOCK_PI		7
+#define	FUTEX_TRYLOCK_PI	8
+#define	FUTEX_WAIT_BITSET	9
+#define	FUTEX_WAKE_BITSET	10
+#define	FUTEX_WAIT_REQUEUE_PI	11
+#define	FUTEX_CMP_REQUEUE_PI	12
+#define	FUTEX_MAX_CMD		FUTEX_CMP_REQUEUE_PI
+
+/*
+ * Flags that can be OR'd into a futex operation.
+ */
+#define	FUTEX_CMD_MASK		0x007f
+#define	FUTEX_PRIVATE_FLAG	0x0080
+#define	FUTEX_CLOCK_REALTIME	0x0100
+
+#define	FUTEX_BITSET_MATCH_ANY	0xffffffff
+/*
+ * FUTEX_WAKE_OP operations
+ */
+#define	FUTEX_OP_SET		0	/* *(int *)UADDR2 = OPARG; */
+#define	FUTEX_OP_ADD		1	/* *(int *)UADDR2 += OPARG; */
+#define	FUTEX_OP_OR		2	/* *(int *)UADDR2 |= OPARG; */
+#define	FUTEX_OP_ANDN		3	/* *(int *)UADDR2 &= ~OPARG; */
+#define	FUTEX_OP_XOR		4	/* *(int *)UADDR2 ^= OPARG; */
+
+/*
+ * FUTEX_WAKE_OP comparison operations
+ */
+#define	FUTEX_OP_CMP_EQ		0	/* if (oldval == CMPARG) wake */
+#define	FUTEX_OP_CMP_NE		1	/* if (oldval != CMPARG) wake */
+#define	FUTEX_OP_CMP_LT		2	/* if (oldval < CMPARG) wake */
+#define	FUTEX_OP_CMP_LE		3	/* if (oldval <= CMPARG) wake */
+#define	FUTEX_OP_CMP_GT		4	/* if (oldval > CMPARG) wake */
+#define	FUTEX_OP_CMP_GE		5	/* if (oldval >= CMPARG) wake */
+
+/*
+ * The encoding of the FUTEX_WAKE_OP operation in 32 bits:
+ *
+ *	+--+-- - --+-- - --+-- - --+-- - --+
+ *	|S |OP     |CMP    |OPARG  |CMPARG |
+ *	+--+-- - --+-- - --+-- - --+-- - --+
+ *	|31|30 - 28|27 - 24|23 - 12|11 -  0|
+ *
+ * The S bit denotes that the OPARG should be (1 << OPARG) instead of OPARG.
+ * (Yes, this whole thing is entirely absurd -- see the block comment in
+ * lx_futex.c for an explanation of this nonsense.)  Macros to extract the
+ * various components from the operation, given the above encoding:
+ */
+#define	FUTEX_OP_OP(x)		(((x) >> 28) & 7)
+#define	FUTEX_OP_CMP(x)		(((x) >> 24) & 15)
+#define	FUTEX_OP_OPARG(x)	(((x) >> 31) ? (1 << (((x) << 8) >> 20)) : \
+				((((x) << 8) >> 20)))
+#define	FUTEX_OP_CMPARG(x)	(((x) << 20) >> 20)
+
+#ifdef _KERNEL
+
+/*
+ * This structure is used to track all the threads currently waiting on a
+ * futex.  There is one fwaiter_t for each blocked thread.  We store all
+ * fwaiter_t's in a hash structure, indexed by the memid_t of the integer
+ * containing the futex's value.
+ *
+ * At the moment, all fwaiter_t's for a single futex are simply dumped into
+ * the hash bucket.  If futex contention ever becomes a hot path, we can
+ * chain a single futex's waiters together.
+ */
+typedef struct fwaiter {
+	memid_t		fw_memid;	/* memid of the user-space futex */
+	kcondvar_t	fw_cv;		/* cond var */
+	struct fwaiter	*fw_next;	/* hash queue */
+	struct fwaiter	*fw_prev;	/* hash queue */
+	uint32_t	fw_bits;	/* bits waiting on */
+	pid_t		fw_tid;		/* for PI futexes; the waiter's tid */
+	int		fw_opri;	/* for PI futexes; original pri. */
+	boolean_t	fw_pri_up;	/* for PI futexes; pri. increased */
+	volatile int	fw_woken;
+} fwaiter_t;
+
+#define	FUTEX_WAITERS			0x80000000
+#define	FUTEX_OWNER_DIED		0x40000000
+#define	FUTEX_TID_MASK			0x3fffffff
+
+#define	FUTEX_ROBUST_LOCK_PI		1
+#define	FUTEX_ROBUST_LIST_LIMIT		2048
+
+extern long lx_futex(uintptr_t addr, int cmd, int val, uintptr_t lx_timeout,
+    uintptr_t addr2, int val2);
+extern void lx_futex_init(void);
+extern int lx_futex_fini(void);
+extern long lx_set_robust_list(void *listp, size_t len);
+extern long lx_get_robust_list(pid_t pid, void **listp, size_t *lenp);
+extern void lx_futex_robust_exit(uintptr_t addr, uint32_t tid);
+
+#endif /* _KERNEL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_FUTEX_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_impl.h b/usr/src/uts/common/brand/lx/sys/lx_impl.h
new file mode 100644
index 0000000000..03b9d43038
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_impl.h
@@ -0,0 +1,52 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef	_LX_IMPL_H
+#define	_LX_IMPL_H
+
+#include <sys/types.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+typedef void (lx_systrace_f)(ulong_t, ulong_t, ulong_t, ulong_t, ulong_t,
+    ulong_t, ulong_t);
+
+
+extern lx_systrace_f *lx_systrace_entry_ptr;
+extern lx_systrace_f *lx_systrace_return_ptr;
+
+extern void lx_brand_systrace_enable(void);
+extern void lx_brand_systrace_disable(void);
+
+extern void lx_unsupported(char *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_IMPL_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_ldt.h b/usr/src/uts/common/brand/lx/sys/lx_ldt.h
new file mode 100644
index 0000000000..08d4d78efb
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_ldt.h
@@ -0,0 +1,91 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright 2018 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _SYS_LINUX_LDT_H
+#define	_SYS_LINUX_LDT_H
+
+#include <sys/segments.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+struct ldt_info {
+	uint_t	entry_number;
+	uint_t	base_addr;
+	uint_t	limit;
+	uint_t	seg_32bit:1,
+		contents:2,
+		read_exec_only:1,
+		limit_in_pages:1,
+		seg_not_present:1,
+		useable:1;
+};
+
+#define	LDT_INFO_EMPTY(info)						\
+	((info)->base_addr == 0 && (info)->limit == 0 &&		\
+	(info)->contents == 0 && (info)->read_exec_only == 1 &&		\
+	(info)->seg_32bit == 0 && (info)->limit_in_pages == 0 &&	\
+	(info)->seg_not_present == 1 && (info)->useable == 0)
+
+#if defined(__amd64)
+#define	SETMODE(desc)	(desc)->usd_long = SDP_SHORT;
+#else
+#define	SETMODE(desc)
+#endif
+
+#define	LDT_INFO_TO_DESC(info, desc)	{				\
+	USEGD_SETBASE(desc, (info)->base_addr);				\
+	USEGD_SETLIMIT(desc, (info)->limit);				\
+	(desc)->usd_type = ((info)->contents << 2) | 			\
+	    ((info)->read_exec_only ^ 1) << 1 | SDT_S | SDT_A;		\
+	(desc)->usd_dpl = SEL_UPL;					\
+	(desc)->usd_p = (info)->seg_not_present ^ 1;			\
+	(desc)->usd_def32 = (info)->seg_32bit;				\
+	(desc)->usd_gran = (info)->limit_in_pages;			\
+	(desc)->usd_avl = (info)->useable;				\
+	SETMODE(desc);							\
+}
+
+#define	DESC_TO_LDT_INFO(desc, info)	{				\
+	bzero((info), sizeof (*(info)));				\
+	(info)->base_addr = USEGD_GETBASE(desc);			\
+	(info)->limit = USEGD_GETLIMIT(desc);				\
+	(info)->seg_not_present = (desc)->usd_p ^ 1;			\
+	(info)->contents = ((desc)->usd_type >> 2) & 3;			\
+	(info)->read_exec_only = (((desc)->usd_type >> 1) & 1) ^ 1;	\
+	(info)->seg_32bit = (desc)->usd_def32;				\
+	(info)->limit_in_pages = (desc)->usd_gran;			\
+	(info)->useable = (desc)->usd_avl;				\
+}
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LINUX_LDT_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_misc.h b/usr/src/uts/common/brand/lx/sys/lx_misc.h
new file mode 100644
index 0000000000..0418d3e9f9
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_misc.h
@@ -0,0 +1,136 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _SYS__LX_MISC_H
+#define	_SYS__LX_MISC_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#include <inet/ip.h>
+#include <inet/ip6.h>
+#include <sys/siginfo.h>
+#include <sys/lx_brand.h>
+
+#ifdef _KERNEL
+
+extern void lx_setrval(klwp_t *, int, int);
+extern void lx_exec();
+extern void lx_exitlwp(klwp_t *);
+extern void lx_freelwp(klwp_t *);
+extern void *lx_lwpdata_alloc(proc_t *);
+extern void lx_lwpdata_free(void *);
+extern void lx_initlwp(klwp_t *, void *);
+extern void lx_initlwp_post(klwp_t *);
+extern void lx_forklwp(klwp_t *, klwp_t *);
+
+extern void lx_affinity_forklwp(klwp_t *, klwp_t *);
+
+extern void lx_set_gdt(int, user_desc_t *);
+extern void lx_clear_gdt(int);
+
+extern longlong_t lx_nosys();
+
+extern void lx_clone_grp_create(uint_t);
+extern void lx_clone_grp_enter(uint_t, proc_t *, proc_t *);
+extern void lx_clone_grp_exit(proc_t *, boolean_t);
+extern boolean_t lx_clone_grp_member(lx_proc_data_t *, uint_t);
+extern int lx_clone_grp_walk(lx_proc_data_t *, uint_t,
+    int (*)(proc_t *, void *), void *);
+
+extern greg_t lx_fixsegreg(greg_t, model_t);
+extern uintptr_t lx_fsbase(klwp_t *, uintptr_t);
+extern void lx_exit_with_sig(proc_t *, sigqueue_t *);
+extern boolean_t lx_wait_filter(proc_t *, proc_t *);
+extern void lx_sigfd_translate(k_siginfo_t *);
+extern int stol_ksiginfo_copyout(k_siginfo_t *, void *);
+
+extern int ltos_at_flag(int, int, boolean_t);
+#if defined(_SYSCALL32_IMPL)
+extern int stol_ksiginfo32_copyout(k_siginfo_t *, void *);
+#endif
+extern void lx_read_argv_bounds(proc_t *p);
+
+typedef enum lx_regs_location {
+	LX_REG_LOC_UNAVAIL,
+	LX_REG_LOC_LWP,
+	LX_REG_LOC_UCP
+} lx_regs_location_t;
+
+extern lx_regs_location_t lx_regs_location(lx_lwp_data_t *, void **, boolean_t);
+
+
+typedef enum lx_if_action {
+	LX_IF_FROMNATIVE,
+	LX_IF_TONATIVE
+} lx_if_action_t;
+
+/* Linux ARP protocol hardware identifiers */
+#define	LX_ARPHRD_ETHER		1	/* Ethernet */
+#define	LX_ARPHRD_LOOPBACK	772	/* Loopback */
+#define	LX_ARPHRD_VOID		0xffff	/* Unknown */
+
+/* IPv6 address scope values used in /proc/net/if_inet6 */
+#define	LX_IPV6_ADDR_LOOPBACK	0x0010U
+#define	LX_IPV6_ADDR_LINKLOCAL	0x0020U
+#define	LX_IPV6_ADDR_SITELOCAL	0x0040U
+#define	LX_IPV6_ADDR_COMPATv4	0x0080U
+
+/* Maximum length of a thread name, including the NUL terminator */
+#define	LX_PR_SET_NAME_NAMELEN	16
+
+extern void lx_ifname_convert(char *, lx_if_action_t);
+extern void lx_ifflags_convert(uint64_t *, lx_if_action_t);
+extern unsigned int lx_ipv6_scope_convert(const in6_addr_t *);
+extern void lx_stol_hwaddr(const struct sockaddr_dl *, struct sockaddr *,
+    int *);
+
+extern boolean_t lx_ptrace_stop(ushort_t);
+extern void lx_stop_notify(proc_t *, klwp_t *, ushort_t, ushort_t);
+extern void lx_ptrace_init(void);
+extern void lx_ptrace_fini(void);
+extern int lx_waitid_helper(idtype_t, id_t, k_siginfo_t *, int, boolean_t *,
+    int *);
+extern void lx_ptrace_exit(proc_t *, klwp_t *);
+extern void lx_ptrace_inherit_tracer(lx_lwp_data_t *, lx_lwp_data_t *);
+extern int lx_ptrace_stop_for_option(int, boolean_t, ulong_t, uintptr_t);
+extern int lx_ptrace_set_clone_inherit(int, boolean_t);
+extern int lx_sigcld_repost(proc_t *, sigqueue_t *);
+extern int lx_ptrace_issig_stop(proc_t *, klwp_t *);
+extern boolean_t lx_ptrace_sig_ignorable(proc_t *, klwp_t *, int);
+
+extern int lx_helper_clone(int64_t *, int, void *, void *, void *);
+extern int lx_helper_setgroups(int, gid_t *);
+extern int lx_helper_rt_sigqueueinfo(pid_t, int, siginfo_t *);
+extern int lx_helper_rt_tgsigqueueinfo(pid_t, pid_t, int, siginfo_t *);
+
+extern boolean_t lx_vsyscall_iscall(klwp_t *, uintptr_t, int *);
+extern void lx_vsyscall_enter(proc_t *, klwp_t *, int);
+
+extern void lx_check_strict_failure(lx_lwp_data_t *);
+
+extern boolean_t lx_is_eventfd(file_t *);
+
+extern int lx_read_common(file_t *, uio_t *, size_t *, boolean_t);
+extern int lx_write_common(file_t *, uio_t *, size_t *, boolean_t);
+
+#endif
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS__LX_MISC_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_ptm.h b/usr/src/uts/common/brand/lx/sys/lx_ptm.h
new file mode 100644
index 0000000000..74bbc939a3
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_ptm.h
@@ -0,0 +1,44 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef	_SYS_PTM_LINUX_H
+#define	_SYS_PTM_LINUX_H
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	LX_PTM_DRV		"lx_ptm"
+#define	LX_PTM_MINOR_NODE	"lx_ptmajor"
+
+#define	LX_PTM_DEV_TO_PTS(dev)	(getminor(dev) - 1)
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_PTM_LINUX_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_siginfo.h b/usr/src/uts/common/brand/lx/sys/lx_siginfo.h
new file mode 100644
index 0000000000..9f606b614f
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_siginfo.h
@@ -0,0 +1,190 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LX_SIGINFO_H
+#define	_LX_SIGINFO_H
+
+#include <sys/lx_types.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * lx_siginfo_t lsi_code values
+ *
+ *	LX_SI_ASYNCNL:	Sent by asynch name lookup completion
+ *	LX_SI_DETHREAD:	Sent by execve() killing subsidiary threads
+ *	LX_SI_SIGIO:	Sent by queued SIGIO
+ *	LX_SI_ASYNCIO:	Sent by asynchronous I/O completion
+ *	LX_SI_MESGQ:	Sent by real time message queue state change
+ *	LX_SI_TIMER:	Sent by timer expiration
+ *	LX_SI_QUEUE:	Sent by sigqueue
+ *	LX_SI_USER:	Sent by kill, sigsend, raise, etc.
+ *	LX_SI_KERNEL:	Sent by kernel
+ *	LX_SI_CODE_NOT_EXIST: Error code. When translating from Linux to
+ *	    illumos errors, if there is no translation available, this value
+ *	    should be used. This value should have no meaning as an si_code in
+ *	    illumos or Linux.
+ *
+ * At present, LX_SI_ASYNCNL, LX_SI_DETHREAD, and LX_SI_SIGIO are unused by
+ * BrandZ.
+ */
+#define	LX_SI_CODE_NOT_EXIST	(-61)
+#define	LX_SI_ASYNCNL		(-60)
+#define	LX_SI_DETHREAD		(-7)
+#define	LX_SI_TKILL		(-6)
+#define	LX_SI_SIGIO		(-5)
+#define	LX_SI_ASYNCIO		(-4)
+#define	LX_SI_MESGQ		(-3)
+#define	LX_SI_TIMER		(-2)
+#define	LX_SI_QUEUE		(-1)
+#define	LX_SI_USER		(0)
+#define	LX_SI_KERNEL		(0x80)
+
+#define	LX_SI_MAX_SIZE		128
+#define	LX_SI_PAD_SIZE_32	((LX_SI_MAX_SIZE / sizeof (int)) - 3)
+#define	LX_SI_PAD_SIZE_64	((LX_SI_MAX_SIZE / sizeof (int)) - 4)
+
+#if defined(_LP64)
+/*
+ * Because of the odd number (3) of ints before the union, we need to account
+ * for the smaller padding needed on x64 due to the union being offset to an 8
+ * byte boundary.
+ */
+#define	LX_SI_PAD_SIZE		LX_SI_PAD_SIZE_64
+#else
+#define	LX_SI_PAD_SIZE		LX_SI_PAD_SIZE_32
+#endif
+
+typedef struct lx_siginfo {
+	int lsi_signo;
+	int lsi_errno;
+	int lsi_code;
+	union {
+		int _pad[LX_SI_PAD_SIZE];
+
+		struct {
+			pid_t _pid;
+			lx_uid16_t _uid;
+		} _kill;
+
+		struct {
+			uint_t _timer1;
+			uint_t _timer2;
+		} _timer;
+
+		struct {
+			pid_t _pid;
+			lx_uid16_t _uid;
+			union sigval _sigval;
+		} _rt;
+
+		struct {
+			pid_t _pid;
+			lx_uid16_t _uid;
+			int _status;
+			clock_t _utime;
+			clock_t _stime;
+		} _sigchld;
+
+		struct {
+			void *_addr;
+		} _sigfault;
+
+		struct {
+			int _band;
+			int _fd;
+		} _sigpoll;
+	} _sifields;
+} lx_siginfo_t;
+
+#if defined(_KERNEL) && defined(_SYSCALL32_IMPL)
+/*
+ * 64-bit kernel view of the 32-bit "lx_siginfo_t" object.
+ */
+#pragma pack(4)
+typedef struct lx_siginfo32 {
+	int lsi_signo;
+	int lsi_errno;
+	int lsi_code;
+	union {
+		int _pad[LX_SI_PAD_SIZE_32];
+
+		struct {
+			pid32_t _pid;
+			lx_uid16_t _uid;
+		} _kill;
+
+		struct {
+			uint_t _timer1;
+			uint_t _timer2;
+		} _timer;
+
+		struct {
+			pid32_t _pid;
+			lx_uid16_t _uid;
+			union sigval32 _sigval;
+		} _rt;
+
+		struct {
+			pid32_t _pid;
+			lx_uid16_t _uid;
+			int _status;
+			clock32_t _utime;
+			clock32_t _stime;
+		} _sigchld;
+
+		struct {
+			caddr32_t _addr;
+		} _sigfault;
+
+		struct {
+			int _band;
+			int _fd;
+		} _sigpoll;
+	} _sifields;
+} lx_siginfo32_t;
+#pragma pack()
+#endif /* defined(_KERNEL) && defined(_SYSCALL32_IMPL) */
+
+#define	lsi_pid		_sifields._kill._pid
+#define	lsi_uid		_sifields._kill._uid
+#define	lsi_status	_sifields._sigchld._status
+#define	lsi_utime	_sifields._sigchld._utime
+#define	lsi_stime	_sifields._sigchld._stime
+#define	lsi_value	_sifields._rt._sigval
+#define	lsi_int		_sifields._rt._sigval.sivalx_int
+#define	lsi_ptr		_sifields._rt._sigval.sivalx_ptr
+#define	lsi_addr	_sifields._sigfault._addr
+#define	lsi_band	_sifields._sigpoll._band
+#define	lsi_fd		_sifields._sigpoll._fd
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_SIGINFO_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_signal.h b/usr/src/uts/common/brand/lx/sys/lx_signal.h
new file mode 100644
index 0000000000..552c36238b
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_signal.h
@@ -0,0 +1,32 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _LX_SIGNAL_H
+#define	_LX_SIGNAL_H
+
+#include <lx_signum.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+extern void lx_ltos_sigset(lx_sigset_t *, k_sigset_t *);
+extern void lx_stol_sigset(k_sigset_t *, lx_sigset_t *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _LX_SIGNAL_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_socket.h b/usr/src/uts/common/brand/lx/sys/lx_socket.h
new file mode 100644
index 0000000000..eb9826eebe
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_socket.h
@@ -0,0 +1,434 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef _SYS_LX_SOCKET_H
+#define	_SYS_LX_SOCKET_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Linux address family definitions
+ * Some of these are not supported
+ */
+#define	LX_AF_UNSPEC		0  /* Unspecified */
+#define	LX_AF_UNIX		1  /* local file/pipe name */
+#define	LX_AF_INET		2  /* IP protocol family */
+#define	LX_AF_AX25		3  /* Amateur Radio AX.25 */
+#define	LX_AF_IPX		4  /* Novell Internet Protocol */
+#define	LX_AF_APPLETALK		5  /* Appletalk */
+#define	LX_AF_NETROM		6  /* Amateur radio */
+#define	LX_AF_BRIDGE		7  /* Multiprotocol bridge */
+#define	LX_AF_ATMPVC		8  /* ATM PVCs */
+#define	LX_AF_X25		9  /* X.25 */
+#define	LX_AF_INET6		10 /* IPV 6 */
+#define	LX_AF_ROSE		11 /* Amateur Radio X.25 */
+#define	LX_AF_DECNET		12 /* DECnet */
+#define	LX_AF_NETBEUI		13 /* 802.2LLC */
+#define	LX_AF_SECURITY		14 /* Security callback */
+#define	LX_AF_KEY		15 /* key management */
+#define	LX_AF_ROUTE		16 /* Alias to emulate 4.4BSD */
+#define	LX_AF_NETLINK		LX_AF_ROUTE
+#define	LX_AF_PACKET		17 /* Packet family */
+#define	LX_AF_ASH		18 /* Ash ? */
+#define	LX_AF_ECONET		19 /* Acorn Econet */
+#define	LX_AF_ATMSVC		20 /* ATM SVCs */
+#define	LX_AF_SNA		22 /* Linux SNA */
+#define	LX_AF_IRDA		23 /* IRDA sockets */
+#define	LX_AF_PPPOX		24 /* PPPoX sockets */
+#define	LX_AF_WANPIPE		25 /* Wanpipe API sockets */
+#define	LX_AF_LLC		26
+/* gap in Linux defines for 27 and 28 */
+#define	LX_AF_CAN		29
+#define	LX_AF_TIPC		30
+#define	LX_AF_BLUETOOTH		31 /* Bluetooth sockets */
+#define	LX_AF_IUCV		32
+#define	LX_AF_RXRPC		33
+
+/* limit of AF mappings */
+#define	LX_AF_MAX		LX_AF_RXRPC
+
+#define	AF_NOTSUPPORTED		-1
+#define	AF_INVAL		-2
+
+/*
+ * Options for use with [gs]etsockopt at the SOL_SOCKET level.
+ */
+#define	LX_SOL_SOCKET				1
+
+#define	LX_SCM_RIGHTS				1
+#define	LX_SCM_CRED				2
+
+#define	LX_SO_DEBUG				1
+#define	LX_SO_REUSEADDR				2
+#define	LX_SO_TYPE				3
+#define	LX_SO_ERROR				4
+#define	LX_SO_DONTROUTE				5
+#define	LX_SO_BROADCAST				6
+#define	LX_SO_SNDBUF				7
+#define	LX_SO_RCVBUF				8
+#define	LX_SO_KEEPALIVE				9
+#define	LX_SO_OOBINLINE				10
+#define	LX_SO_NO_CHECK				11
+#define	LX_SO_PRIORITY				12
+#define	LX_SO_LINGER				13
+#define	LX_SO_BSDCOMPAT				14
+#define	LX_SO_REUSEPORT				15
+/*
+ * For Linux see unix(7) man page SO_PASSCRED description. For Illumos see
+ * socket.h(3HEAD) man page SO_RECVUCRED description.
+ */
+#define	LX_SO_PASSCRED				16
+#define	LX_SO_PEERCRED				17
+#define	LX_SO_RCVLOWAT				18
+#define	LX_SO_SNDLOWAT				19
+#define	LX_SO_RCVTIMEO				20
+#define	LX_SO_SNDTIMEO				21
+/* Security levels - as per NRL IPv6 - don't actually do anything */
+#define	LX_SO_SECURITY_AUTHENTICATION		22
+#define	LX_SO_SECURITY_ENCRYPTION_TRANSPORT	23
+#define	LX_SO_SECURITY_ENCRYPTION_NETWORK	24
+#define	LX_SO_BINDTODEVICE			25
+/* Socket filtering */
+#define	LX_SO_ATTACH_FILTER			26
+#define	LX_SO_DETACH_FILTER			27
+#define	LX_SO_PEERNAME				28
+#define	LX_SO_TIMESTAMP				29
+#define	LX_SCM_TIMESTAMP			LX_SO_TIMESTAMP
+#define	LX_SO_ACCEPTCONN			30
+
+#define	LX_SO_PEERSEC				31
+#define	LX_SO_SNDBUFFORCE			32
+#define	LX_SO_RCVBUFFORCE			33
+#define	LX_SO_PASSSEC				34
+#define	LX_SO_TIMESTAMPNS			35
+#define	LX_SCM_TIMESTAMPNS			LX_SO_TIMESTAMPNS
+#define	LX_SO_MARK				36
+#define	LX_SO_TIMESTAMPING			37
+#define	LX_SCM_TIMESTAMPING			LX_SO_TIMESTAMPING
+#define	LX_SO_PROTOCOL				38
+#define	LX_SO_DOMAIN				39
+#define	LX_SO_RXQ_OVFL				40
+#define	LX_SO_WIFI_STATUS			41
+#define	LX_SCM_WIFI_STATUS			LX_SO_WIFI_STATUS
+#define	LX_SO_PEEK_OFF				42
+#define	LX_SO_NOFCS				43
+#define	LX_SO_LOCK_FILTER			44
+#define	LX_SO_SELECT_ERR_QUEUE			45
+#define	LX_SO_BUSY_POLL				46
+#define	LX_SO_MAX_PACING_RATE			47
+#define	LX_SO_BPF_EXTENSIONS			48
+
+/*
+ * Options for use with [gs]etsockopt at the RAW level.
+ * IPPROTO_RAW
+ */
+#define	LX_ICMP_FILTER				1
+
+/*
+ * Options for use with [gs]etsockopt at the PACKET level.
+ * SOL_PACKET
+ */
+#define	LX_SOL_PACKET				263
+
+#define	LX_PACKET_ADD_MEMBERSHIP		1
+#define	LX_PACKET_DROP_MEMBERSHIP		2
+#define	LX_PACKET_RECV_OUTPUT			3
+#define	LX_PACKET_RX_RING			5
+#define	LX_PACKET_STATISTICS			6
+
+/*
+ * Options for use with [gs]etsockopt at the NETLINK level.
+ * SOL_NETLINK
+ */
+#define	LX_SOL_NETLINK				270
+
+/*
+ * Linux socket type definitions
+ */
+#define	LX_SOCK_STREAM		1	/* Connection-based byte streams */
+#define	LX_SOCK_DGRAM		2	/* Connectionless, datagram */
+#define	LX_SOCK_RAW		3	/* Raw protocol interface */
+#define	LX_SOCK_RDM		4	/* Reliably-delivered message */
+#define	LX_SOCK_SEQPACKET	5	/* Sequenced packet stream */
+#define	LX_SOCK_PACKET		10	/* Linux specific */
+#define	LX_SOCK_MAX		11
+
+/*
+ * The Linux socket type can be or-ed with other flags (e.g. SOCK_CLOEXEC).
+ */
+#define	LX_SOCK_TYPE_MASK	0xf
+
+/*
+ * Linux flags for socket, socketpair and accept4. These are or-ed into the
+ * socket type value. In the Linux net.h header these come from fcntl.h (note
+ * that they are in octal in the Linux header).
+ */
+#define	LX_SOCK_CLOEXEC		0x80000
+#define	LX_SOCK_NONBLOCK	0x800
+
+#define	SOCK_NOTSUPPORTED	-1
+#define	SOCK_INVAL		-2
+
+/*
+ * PF_PACKET protocol definitions.
+ */
+#define	LX_ETH_P_802_3	0x0001
+#define	LX_ETH_P_ALL	0x0003
+#define	LX_ETH_P_802_2	0x0004
+#define	LX_ETH_P_IP	0x0800
+#define	LX_ETH_P_ARP	0x0806
+#define	LX_ETH_P_IPV6	0x86DD
+
+/*
+ * IP Protocol levels. Some of these match the Illumos IPPROTO_* values.
+ */
+#define	LX_IPPROTO_IP		0
+#define	LX_IPPROTO_ICMP		1
+#define	LX_IPPROTO_IGMP		2
+#define	LX_IPPROTO_TCP		6
+#define	LX_IPPROTO_UDP		17
+#define	LX_IPPROTO_IPV6		41
+#define	LX_IPPROTO_ICMPV6	58
+#define	LX_IPPROTO_RAW		255
+
+/*
+ * Options for use with [gs]etsockopt at the IP level.
+ * IPPROTO_IP
+ */
+#define	LX_IP_TOS		1
+#define	LX_IP_TTL		2
+#define	LX_IP_HDRINCL		3
+#define	LX_IP_OPTIONS		4
+#define	LX_IP_ROUTER_ALERT	5
+#define	LX_IP_RECVOPTS		6
+#define	LX_IP_RETOPTS		7
+#define	LX_IP_PKTINFO		8
+#define	LX_IP_PKTOPTIONS	9
+#define	LX_IP_MTU_DISCOVER	10
+#define	LX_IP_RECVERR		11
+#define	LX_IP_RECVTTL		12
+#define	LX_IP_RECVTOS		13
+#define	LX_IP_MTU		14
+#define	LX_IP_FREEBIND		15
+#define	LX_IP_IPSEC_POLICY	16
+#define	LX_IP_XFRM_POLICY	17
+#define	LX_IP_PASSSEC		18
+#define	LX_IP_TRANSPARENT	19
+#define	LX_IP_ORIGDSTADDR	20
+#define	LX_IP_MINTTL		21
+#define	LX_IP_NODEFRAG		22
+/* Linux apparently leaves a gap here */
+#define	LX_IP_MULTICAST_IF	32
+#define	LX_IP_MULTICAST_TTL	33
+#define	LX_IP_MULTICAST_LOOP	34
+#define	LX_IP_ADD_MEMBERSHIP	35
+#define	LX_IP_DROP_MEMBERSHIP	36
+#define	LX_IP_UNBLOCK_SOURC	37
+#define	LX_IP_BLOCK_SOURCE	38
+#define	LX_IP_ADD_SOURCE_MEMBERSHIP 39
+#define	LX_IP_DROP_SOURCE_MEMBERSHIP 40
+#define	LX_IP_MSFILTER		41
+#define	LX_MCAST_JOIN_GROUP	42
+#define	LX_MCAST_BLOCK_SOURCE	43
+#define	LX_MCAST_UNBLOCK_SOURCE	44
+#define	LX_MCAST_LEAVE_GROUP	45
+#define	LX_MCAST_JOIN_SOURCE_GROUP 46
+#define	LX_MCAST_LEAVE_SOURCE_GROUP 47
+#define	LX_MCAST_MSFILTER	48
+#define	LX_IP_MULTICAST_ALL	49
+#define	LX_IP_UNICAST_IF	50
+
+/*
+ * LX_IP_MTU_DISCOVER values
+ */
+#define	LX_IP_PMTUDISC_DONT		0
+#define	LX_IP_PMTUDISC_WANT		1
+#define	LX_IP_PMTUDISC_DO		2
+#define	LX_IP_PMTUDISC_PROBE		3
+#define	LX_IP_PMTUDISC_INTERFACE	4
+#define	LX_IP_PMTUDISC_OMIT		5
+
+/*
+ * Options for use with [gs]etsockopt at the IP level.
+ * IPPROTO_IPV6
+ */
+
+#define	LX_IPV6_ADDRFORM	1
+#define	LX_IPV6_2292PKTINFO	2
+#define	LX_IPV6_2292HOPOPTS	3
+#define	LX_IPV6_2292DSTOPTS	4
+#define	LX_IPV6_2292RTHDR	5
+#define	LX_IPV6_2292PKTOPTIONS	6
+#define	LX_IPV6_CHECKSUM	7
+#define	LX_IPV6_2292HOPLIMIT	8
+#define	LX_IPV6_NEXTHOP		9
+#define	LX_IPV6_AUTHHDR		10
+#define	LX_IPV6_UNICAST_HOPS	16
+#define	LX_IPV6_MULTICAST_IF	17
+#define	LX_IPV6_MULTICAST_HOPS	18
+#define	LX_IPV6_MULTICAST_LOOP	19
+#define	LX_IPV6_JOIN_GROUP	20
+#define	LX_IPV6_LEAVE_GROUP	21
+#define	LX_IPV6_ROUTER_ALERT	22
+#define	LX_IPV6_MTU_DISCOVER	23
+#define	LX_IPV6_MTU		24
+#define	LX_IPV6_RECVERR		25
+#define	LX_IPV6_V6ONLY		26
+#define	LX_IPV6_JOIN_ANYCAST	27
+#define	LX_IPV6_LEAVE_ANYCAST	28
+#define	LX_IPV6_IPSEC_POLICY	34
+#define	LX_IPV6_XFRM_POLICY	35
+
+#define	LX_IPV6_RECVPKTINFO	49
+#define	LX_IPV6_PKTINFO		50
+#define	LX_IPV6_RECVHOPLIMIT	51
+#define	LX_IPV6_HOPLIMIT	52
+#define	LX_IPV6_RECVHOPOPTS	53
+#define	LX_IPV6_HOPOPTS		54
+#define	LX_IPV6_RTHDRDSTOPTS	55
+#define	LX_IPV6_RECVRTHDR	56
+#define	LX_IPV6_RTHDR		57
+#define	LX_IPV6_RECVDSTOPTS	58
+#define	LX_IPV6_DSTOPTS		59
+#define	LX_IPV6_RECVTCLASS	66
+#define	LX_IPV6_TCLASS		67
+
+/*
+ * Options for use with [gs]etsockopt at the IP level.
+ * IPPROTO_ICMPV6
+ */
+
+#define	LX_ICMP6_FILTER		1
+
+/*
+ * Options for use with [gs]etsockopt at the TCP level.
+ * IPPROTO_TCP
+ */
+#define	LX_TCP_NODELAY		1  /* Don't delay send to coalesce packets  */
+#define	LX_TCP_MAXSEG		2  /* Set maximum segment size  */
+#define	LX_TCP_CORK		3  /* Control sending of partial frames  */
+#define	LX_TCP_KEEPIDLE		4  /* Start keeplives after this period */
+#define	LX_TCP_KEEPINTVL	5  /* Interval between keepalives */
+#define	LX_TCP_KEEPCNT		6  /* Number of keepalives before death */
+#define	LX_TCP_SYNCNT		7  /* Number of SYN retransmits */
+#define	LX_TCP_LINGER2		8  /* Life time of orphaned FIN-WAIT-2 state */
+#define	LX_TCP_DEFER_ACCEPT	9  /* Wake up listener only when data arrive */
+#define	LX_TCP_WINDOW_CLAMP	10 /* Bound advertised window */
+#define	LX_TCP_INFO		11 /* Information about this connection. */
+#define	LX_TCP_QUICKACK		12 /* Bock/reenable quick ACKs.  */
+#define	LX_TCP_CONGESTION	13 /* Congestion control algorithm */
+#define	LX_TCP_MD5SIG		14 /* TCP MD5 Signature (RFC2385) */
+#define	LX_TCP_THIN_LINEAR_TIMEOUTS 16 /* Use linear timeouts on thin streams */
+#define	LX_TCP_THIN_DUPACK	17 /* Fast retrans. after 1 dupack */
+#define	LX_TCP_USER_TIMEOUT	18 /* How long for loss retry before timeout */
+#define	LX_TCP_REPAIR		19 /* TCP socket under repair */
+#define	LX_TCP_REPAIR_QUEUE	20
+#define	LX_TCP_QUEUE_SEQ	21
+#define	LX_TCP_REPAIR_OPTIONS	22
+#define	LX_TCP_FASTOPEN		23 /* Enable FastOpen on listeners */
+#define	LX_TCP_TIMESTAMP	24
+#define	LX_TCP_NOTSENT_LOWAT	25 /* limit number of unsent bytes */
+
+/*
+ * Options for use with [gs]etsockopt at the IGMP level.
+ * IPPROTO_IGMP
+ */
+#define	LX_IGMP_MINLEN				8
+#define	LX_IGMP_MAX_HOST_REPORT_DELAY		10
+#define	LX_IGMP_HOST_MEMBERSHIP_QUERY		0x11
+#define	LX_IGMP_HOST_MEMBERSHIP_REPORT		0x12
+#define	LX_IGMP_DVMRP				0x13
+#define	LX_IGMP_PIM				0x14
+#define	LX_IGMP_TRACE				0x15
+#define	LX_IGMP_HOST_NEW_MEMBERSHIP_REPORT	0x16
+#define	LX_IGMP_HOST_LEAVE_MESSAGE		0x17
+#define	LX_IGMP_MTRACE_RESP			0x1e
+#define	LX_IGMP_MTRACE				0x1f
+
+/*
+ * Linux socket flags for use with recv(2)/send(2)/recvmsg(2)/sendmsg(2)
+ */
+#define	LX_MSG_OOB		0x1
+#define	LX_MSG_PEEK		0x2
+#define	LX_MSG_DONTROUTE	0x4
+#define	LX_MSG_CTRUNC		0x8
+#define	LX_MSG_PROXY		0x10
+#define	LX_MSG_TRUNC		0x20
+#define	LX_MSG_DONTWAIT		0x40
+#define	LX_MSG_EOR		0x80
+#define	LX_MSG_WAITALL		0x100
+#define	LX_MSG_FIN		0x200
+#define	LX_MSG_SYN		0x400
+#define	LX_MSG_CONFIRM		0x800
+#define	LX_MSG_RST		0x1000
+#define	LX_MSG_ERRQUEUE		0x2000
+#define	LX_MSG_NOSIGNAL		0x4000
+#define	LX_MSG_MORE		0x8000
+#define	LX_MSG_WAITFORONE	0x10000
+#define	LX_MSG_FASTOPEN		0x20000000
+#define	LX_MSG_CMSG_CLOEXEC	0x40000000
+
+typedef struct lx_msghdr {
+	void		*msg_name;	/* optional address */
+	socklen_t	msg_namelen;	/* size of address */
+	struct iovec	*msg_iov;	/* scatter/gather array */
+	size_t		msg_iovlen;	/* # elements in msg_iov */
+	void		*msg_control;	/* ancillary data */
+	size_t		msg_controllen;	/* ancillary data buffer len */
+	int		msg_flags;	/* flags on received message */
+} lx_msghdr_t;
+
+
+#if defined(_LP64)
+
+typedef struct lx_msghdr32 {
+	caddr32_t	msg_name;	/* optional address */
+	uint32_t	msg_namelen;	/* size of address */
+	caddr32_t	msg_iov;	/* scatter/gather array */
+	int32_t		msg_iovlen;	/* # elements in msg_iov */
+	caddr32_t	msg_control;	/* ancillary data */
+	uint32_t	msg_controllen;	/* ancillary data buffer len */
+	int32_t		msg_flags;	/* flags on received message */
+} lx_msghdr32_t;
+
+#endif
+
+typedef struct lx_sockaddr_in6 {
+	sa_family_t	sin6_family;
+	in_port_t	sin6_port;
+	uint32_t	sin6_flowinfo;
+	struct in6_addr	sin6_addr;
+	uint32_t	sin6_scope_id;  /* Depends on scope of sin6_addr */
+	/* one 32-bit field shorter than illumos */
+} lx_sockaddr_in6_t;
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_SOCKET_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_syscalls.h b/usr/src/uts/common/brand/lx/sys/lx_syscalls.h
new file mode 100644
index 0000000000..ad6a0e13b4
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_syscalls.h
@@ -0,0 +1,338 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _SYS_LINUX_SYSCALLS_H
+#define	_SYS_LINUX_SYSCALLS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#ifdef	_KERNEL
+
+extern long lx_accept();
+extern long lx_accept4();
+extern long lx_access();
+extern long lx_acct();
+extern long lx_alarm();
+extern long lx_arch_prctl();
+extern long lx_bind();
+extern long lx_brk();
+extern long lx_chdir();
+extern long lx_chmod();
+extern long lx_chown();
+extern long lx_chown16();
+extern long lx_chroot();
+extern long lx_clock_getres();
+extern long lx_clock_gettime();
+extern long lx_clock_settime();
+extern long lx_close();
+extern long lx_connect();
+extern long lx_creat();
+extern long lx_dup();
+extern long lx_dup2();
+extern long lx_dup3();
+extern long lx_epoll_create();
+extern long lx_epoll_create1();
+extern long lx_epoll_ctl();
+extern long lx_epoll_pwait();
+extern long lx_epoll_wait();
+extern long lx_eventfd();
+extern long lx_eventfd2();
+extern long lx_faccessat();
+extern long lx_fadvise64();
+extern long lx_fadvise64_32();
+extern long lx_fadvise64_64();
+extern long lx_fallocate();
+extern long lx_fallocate32();
+extern long lx_fchdir();
+extern long lx_fchmod();
+extern long lx_fchmodat();
+extern long lx_fchown();
+extern long lx_fchown16();
+extern long lx_fchownat();
+extern long lx_fcntl();
+extern long lx_fcntl64();
+extern long lx_fgetxattr();
+extern long lx_flistxattr();
+extern long lx_flock();
+extern long lx_fremovexattr();
+extern long lx_fsetxattr();
+extern long lx_fstat32();
+extern long lx_fstat64();
+extern long lx_fstatat64();
+extern long lx_futex();
+extern long lx_get_robust_list();
+extern long lx_get_thread_area();
+extern long lx_getcpu();
+extern long lx_getcwd();
+extern long lx_getdents_32();
+extern long lx_getdents_64();
+extern long lx_getdents64();
+extern long lx_getegid();
+extern long lx_getegid16();
+extern long lx_geteuid();
+extern long lx_geteuid16();
+extern long lx_getgid();
+extern long lx_getgid16();
+extern long lx_getitimer();
+extern long lx_getpeername();
+extern long lx_getpgid();
+extern long lx_getpgrp();
+extern long lx_getsockname();
+extern long lx_getpid();
+extern long lx_getppid();
+extern long lx_getpriority();
+extern long lx_getrandom();
+extern long lx_getresgid();
+extern long lx_getresgid16();
+extern long lx_getresuid();
+extern long lx_getresuid16();
+extern long lx_getrlimit();
+extern long lx_getrusage();
+extern long lx_getsid();
+extern long lx_getsockopt();
+extern long lx_gettid();
+extern long lx_gettimeofday();
+extern long lx_getuid();
+extern long lx_getuid16();
+extern long lx_getxattr();
+extern long lx_io_cancel();
+extern long lx_io_destroy();
+extern long lx_io_getevents();
+extern long lx_io_setup();
+extern long lx_io_submit();
+extern long lx_ioctl();
+extern long lx_ioprio_get();
+extern long lx_ioprio_set();
+extern long lx_kill();
+extern long lx_lchown();
+extern long lx_lchown16();
+extern long lx_lgetxattr();
+extern long lx_link();
+extern long lx_linkat();
+extern long lx_listen();
+extern long lx_llistxattr();
+extern long lx_llseek();
+extern long lx_lremovexattr();
+extern long lx_lseek32();
+extern long lx_lseek64();
+extern long lx_lsetxattr();
+extern long lx_lstat32();
+extern long lx_lstat64();
+extern long lx_listxattr();
+extern long lx_madvise();
+extern long lx_mincore();
+extern long lx_mkdir();
+extern long lx_mkdirat();
+extern long lx_mlock();
+extern long lx_mlockall();
+extern long lx_mmap();
+extern long lx_mmap2();
+extern long lx_mremap();
+extern long lx_mprotect();
+extern long lx_modify_ldt();
+extern long lx_mount();
+extern long lx_msync();
+extern long lx_munlock();
+extern long lx_munlockall();
+extern long lx_munmap();
+extern long lx_nanosleep();
+extern long lx_nice();
+extern long lx_oldgetrlimit();
+extern long lx_open();
+extern long lx_openat();
+extern long lx_pause();
+extern long lx_personality();
+extern long lx_pipe();
+extern long lx_pipe2();
+extern long lx_poll();
+extern long lx_ppoll();
+extern long lx_pread();
+extern long lx_pread32();
+extern long lx_preadv();
+extern long lx_preadv32();
+extern long lx_prctl();
+extern long lx_prlimit64();
+extern long lx_pselect();
+extern long lx_ptrace();
+extern long lx_pwrite();
+extern long lx_pwrite32();
+extern long lx_pwritev();
+extern long lx_pwritev32();
+extern long lx_read();
+extern long lx_readlink();
+extern long lx_readlinkat();
+extern long lx_readv();
+extern long lx_reboot();
+extern long lx_recv();
+extern long lx_recvmsg();
+extern long lx_recvfrom();
+extern long lx_rename();
+extern long lx_renameat();
+extern long lx_sched_getaffinity();
+extern long lx_sched_getparam();
+extern long lx_sched_getscheduler();
+extern long lx_sched_getattr();
+extern long lx_sched_get_priority_max();
+extern long lx_sched_get_priority_min();
+extern long lx_sched_rr_get_interval();
+extern long lx_sched_setaffinity();
+extern long lx_sched_setattr();
+extern long lx_sched_setparam();
+extern long lx_sched_setscheduler();
+extern long lx_sched_yield();
+extern long lx_select();
+extern long lx_send();
+extern long lx_sendmsg();
+extern long lx_sendto();
+extern long lx_set_robust_list();
+extern long lx_set_thread_area();
+extern long lx_set_tid_address();
+extern long lx_setdomainname();
+extern long lx_setfsuid();
+extern long lx_setfsuid16();
+extern long lx_setfsgid();
+extern long lx_setfsgid16();
+extern long lx_setgid();
+extern long lx_setgid16();
+extern long lx_sethostname();
+extern long lx_setpgid();
+extern long lx_setpriority();
+extern long lx_setregid();
+extern long lx_setregid16();
+extern long lx_setresgid();
+extern long lx_setresgid16();
+extern long lx_setresuid();
+extern long lx_setresuid16();
+extern long lx_setreuid();
+extern long lx_setreuid16();
+extern long lx_setrlimit();
+extern long lx_setsid();
+extern long lx_setuid();
+extern long lx_setuid16();
+extern long lx_setxattr();
+extern long lx_setsockopt();
+extern long lx_symlink();
+extern long lx_symlinkat();
+extern long lx_shutdown();
+extern long lx_socket();
+extern long lx_socketcall();
+extern long lx_socketpair();
+extern long lx_splice();
+extern long lx_stat32();
+extern long lx_stat64();
+extern long lx_stime();
+extern long lx_swapoff();
+extern long lx_swapon();
+extern long lx_sync();
+extern long lx_sync_file_range();
+extern long lx_syncfs();
+extern long lx_sysinfo32();
+extern long lx_sysinfo64();
+extern long lx_syslog();
+extern long lx_removexattr();
+extern long lx_tgkill();
+extern long lx_time();
+extern long lx_times();
+extern long lx_timer_create();
+extern long lx_tkill();
+extern long lx_umask();
+extern long lx_umount();
+extern long lx_umount2();
+extern long lx_uname();
+extern long lx_unlink();
+extern long lx_unlinkat();
+extern long lx_unshare();
+extern long lx_vhangup();
+extern long lx_wait4();
+extern long lx_waitid();
+extern long lx_waitpid();
+extern long lx_write();
+extern long lx_writev();
+
+#if defined(_LP64)
+/*
+ * Linux vsyscall addresses:
+ */
+#define	LX_VSYS_gettimeofday	(uintptr_t)0xffffffffff600000
+#define	LX_VSYS_time		(uintptr_t)0xffffffffff600400
+#define	LX_VSYS_getcpu		(uintptr_t)0xffffffffff600800
+
+#define	LX_VSYSCALL_ADDR		(uintptr_t)0xffffffffff600000
+#define	LX_VSYSCALL_SIZE		(uintptr_t)0x1000
+#endif
+
+#endif	/* _KERNEL */
+
+/*
+ * System call numbers for revectoring:
+ */
+
+#if defined(__amd64)
+#define	LX_SYS_close		3
+#define	LX_SYS_gettimeofday	96
+#define	LX_SYS_mount		165
+#define	LX_SYS_time		201
+#define	LX_SYS_io_setup		206
+#define	LX_SYS_clock_gettime	228
+#define	LX_SYS_getcpu		309
+
+#define	LX_SYS32_close		6
+#define	LX_SYS32_gettimeofday	78
+#define	LX_SYS32_time		13
+#define	LX_SYS32_mount		21
+#define	LX_SYS32_clock_gettime	265
+#define	LX_SYS32_io_setup	245
+#define	LX_SYS32_getcpu		318
+#elif defined(__i386)
+#define	LX_SYS_close		6
+#define	LX_SYS_mount		21
+#define	LX_SYS_gettimeofday	78
+#define	LX_SYS_time		13
+#define	LX_SYS_clock_gettime	265
+#define	LX_SYS_io_setup		245
+#define	LX_SYS_getcpu		318
+#else
+#error "Architecture not supported"
+#endif /* defined(__amd64) */
+
+/*
+ * The current code in the VDSO operates under the expectation that it will be
+ * mapped at a fixed offset from the comm page.  This simplifies the act of
+ * locating said page without any other reference.  The VDSO must fit within
+ * this offset, matching the same value as COMM_PAGE_ALIGN.
+ * See: uts/i86pc/sys/comm_page.h
+ */
+#define	LX_VDSO_SIZE		0x4000
+#define	LX_VDSO_ADDR_MASK	~(LX_VDSO_SIZE - 1)
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LINUX_SYSCALLS_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_types.h b/usr/src/uts/common/brand/lx/sys/lx_types.h
new file mode 100644
index 0000000000..90363c8939
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_types.h
@@ -0,0 +1,144 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _SYS_LX_TYPES_H
+#define	_SYS_LX_TYPES_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#ifndef	_KERNEL
+
+#define	SHRT_MIN	(-32768)	/* min value of a "short int" */
+#define	SHRT_MAX	32767		/* max value of a "short int" */
+#define	USHRT_MAX	65535		/* max of "unsigned short int" */
+#define	INT_MIN		(-2147483647-1) /* min value of an "int" */
+#define	INT_MAX		2147483647	/* max value of an "int" */
+#define	UINT_MAX	4294967295U	/* max value of an "unsigned int" */
+
+#ifndef LLONG_MAX
+#define	LLONG_MAX	9223372036854775807LL
+#endif
+
+#if defined(_LP64)
+#define	LONG_MAX	9223372036854775807L
+#define	ULONG_MAX	18446744073709551615UL
+#else
+#define	LONG_MAX	2147483647L	/* max value of a 32-bit "long int" */
+#define	ULONG_MAX	4294967295UL	/* max value of a 32-bit "ulong int" */
+#endif
+
+#endif /* !_KERNEL */
+
+
+typedef	uint64_t	lx_dev_t;
+typedef	uint16_t	lx_dev16_t;
+typedef	uint32_t	lx_ino_t;
+typedef	uint64_t	lx_ino64_t;
+typedef	uint32_t	lx_uid_t;
+typedef	uint16_t	lx_uid16_t;
+typedef	uint32_t	lx_gid_t;
+typedef	uint16_t	lx_gid16_t;
+typedef	uint32_t	lx_off_t;
+typedef	uint64_t	lx_off64_t;
+typedef	uint32_t	lx_blksize_t;
+typedef	uint32_t	lx_blkcnt_t;
+typedef	uint64_t	lx_blkcnt64_t;
+typedef	uint32_t	lx_mode_t;
+typedef	uint16_t	lx_mode16_t;
+
+/*
+ * Linux mangles major/minor numbers into dev_t differently than SunOS.
+ */
+#ifdef _LP64
+#define	LX_MAKEDEVICE(maj, min) \
+	(((min) & 0xff) | (((maj) & 0xfff) << 8) | \
+	((uint64_t)((min) & ~0xff) << 12) | ((uint64_t)((maj) & ~0xfff) << 32))
+
+#define	LX_GETMAJOR(lx_dev)	((((lx_dev) >> 8) & 0xfff) | \
+	((((uint64_t)(lx_dev)) >> 32) & ~0xfff))
+
+#else
+#define	LX_MAKEDEVICE(maj, min) \
+	(((min) & 0xff) | (((maj) & 0xfff) << 8) | (((min) & ~0xff) << 12))
+
+#define	LX_GETMAJOR(lx_dev)	(((lx_dev) >> 8) & 0xfff)
+#endif
+
+#define	LX_GETMINOR(lx_dev)	(((lx_dev) & 0xff) | (((lx_dev) >> 12) & ~0xff))
+/* Linux supports 20 bits for the minor, and 12 bits for the major number */
+#define	LX_MAXMIN	0xfffff
+#define	LX_MAXMAJ	0xfff
+
+/*
+ * Certain Linux tools care deeply about major/minor number mapping.
+ * Map virtual disks (zfs datasets, zvols, etc) into a safe reserved range.
+ */
+#define	LX_MAJOR_DISK	203
+
+/* LX ptm driver major/minor number */
+#define	LX_PTM_MAJOR		5
+#define	LX_PTM_MINOR		2
+
+/* LX pts driver major number range */
+#define	LX_PTS_MAJOR_MIN	136
+#define	LX_PTS_MAJOR_MAX	143
+
+/* LX tty/cons driver major number */
+#define	LX_TTY_MAJOR		5
+
+#define	LX_UID16_TO_UID32(uid16)	\
+	(((uid16) == (lx_uid16_t)-1) ? ((lx_uid_t)-1) : (lx_uid_t)(uid16))
+
+#define	LX_GID16_TO_GID32(gid16)     \
+	(((gid16) == (lx_gid16_t)-1) ? ((lx_gid_t)-1) : (lx_gid_t)(gid16))
+
+/* Overflow values default to NFS nobody. */
+
+#define	UID16_OVERFLOW	((lx_uid16_t)65534)
+#define	GID16_OVERFLOW	((lx_gid16_t)65534)
+
+/*
+ * All IDs with high word non-zero are converted to default overflow values to
+ * avoid inadvertent truncation to zero (root) (!).
+ */
+#define	LX_UID32_TO_UID16(uid32)	\
+	((((uid32) & 0xffff0000) == 0)  ? ((lx_uid16_t)(uid32)) : \
+	    (((uid32) == ((lx_uid_t)-1)) ? ((lx_uid16_t)-1) : UID16_OVERFLOW))
+
+#define	LX_GID32_TO_GID16(gid32)	\
+	((((gid32) & 0xffff0000) == 0)  ? ((lx_gid16_t)(gid32)) : \
+	    (((gid32) == ((lx_gid_t)-1)) ? ((lx_gid16_t)-1) : GID16_OVERFLOW))
+
+#define	LX_32TO64(lo, hi)	\
+	((uint64_t)((uint64_t)(lo) | ((uint64_t)(hi) << 32)))
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LX_TYPES_H */
diff --git a/usr/src/uts/common/brand/lx/sys/lx_userhz.h b/usr/src/uts/common/brand/lx/sys/lx_userhz.h
new file mode 100644
index 0000000000..ebbda28698
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sys/lx_userhz.h
@@ -0,0 +1,64 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _LX_USERHZ_H
+#define	_LX_USERHZ_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Within the kernel, Linux implements an internal hz that they refer to as a
+ * "jiffy". Linux can be built with different hz, but on modern kernels
+ * it is frequently 250. However, Linux has a separate concept for the hz
+ * that is visible outside the kernel. This is called "USER_HZ" and is the
+ * value returned by 'sysconf(_SC_CLK_TCK)'. This is almost universally set to
+ * 100hz. Some (lazy) applications just hardcode 100hz instead of checking.
+ * To accommodate these broken applications, we always work with a USER_HZ of
+ * 100 and scale accordingly. See the Linux time(7) man page for a more
+ * detailed discussion of their behavior. See the comment in our
+ * uts/common/conf/param.c for a discussion of valid native hz values.
+ *
+ * There are a few interfaces which expose a clock_t to user-land and which
+ * need to be considered for USER_HZ adjustment.
+ * 1) The times(2) syscall. This is handled correctly.
+ * 2) The waitid(2) syscall passes a siginfo_t which contains si_stime and
+ *    si_utime. Testing waitid(2) on various Linux distributions shows that the
+ *    these fields are garbage. This aligns with the Linux waitid(2) man page,
+ *    which describes the subset of the siginfo_t structure that is populated.
+ *    Neither si_stime or si_utime are listed.
+ * 3) A sigaction(2) handler can pass a siginfo_t. This is only documented to
+ *    occur when the sa_flags is SA_SIGINFO. The si_stime and si_utime are
+ *    documented to only be populated when the signal is SIGCHLD. However,
+ *    testing on Linux seems to show that these fields are not consistent
+ *    with the corresponding times(2) data for the process, even for the
+ *    SIGCHLD sigaction handler case.
+ * 4) Some fields in /proc/stat and /proc/pid/stat. See the Linux proc man
+ *    page for references to sysconf(_SC_CLK_TCK).
+ *
+ * Although the siginfo_t si_stime and si_utime data for cases #2 and #3 is not
+ * consistent on Linux, we populate these fields correctly to be on the safe
+ * side.
+ */
+extern uint_t lx_hz_scale;
+#define	LX_USERHZ		100
+#define	HZ_TO_LX_USERHZ(x)	((x) / lx_hz_scale)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LX_USERHZ_H */
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_access.c b/usr/src/uts/common/brand/lx/syscall/lx_access.c
new file mode 100644
index 0000000000..8cf836cd7a
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_access.c
@@ -0,0 +1,223 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
+ *
+ * Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T
+ *     All Rights Reserved
+ *
+ * Portions of this source code were derived from Berkeley 4.3 BSD
+ * under license from the Regents of the University of California.
+ *
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/param.h>
+#include <sys/isa_defs.h>
+#include <sys/types.h>
+#include <sys/sysmacros.h>
+#include <sys/cred_impl.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/pathname.h>
+#include <sys/vnode.h>
+#include <sys/uio.h>
+#include <sys/cmn_err.h>
+#include <sys/debug.h>
+#include <sys/file.h>
+#include <fs/fs_subr.h>
+#include <c2/audit.h>
+#include <sys/fcntl.h>
+#include <sys/stat.h>
+#include <sys/mode.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_fcntl.h>
+
+/*
+ * Determine accessibility of file.
+ */
+
+#define	E_OK	010	/* use effective ids */
+#define	R_OK	004
+#define	W_OK	002
+#define	X_OK	001
+
+/*
+ * Convert Linux LX_AT_* flags to SunOS AT_* flags but skip verifying allowed
+ * flags have been passed. This also allows EACCESS/REMOVEDIR to be translated
+ * correctly since on linux they have the same value.
+ *
+ * Some code can actually pass in other bits in the flag. We may have to simply
+ * ignore these, as indicated by the enforce parameter.
+ */
+int
+ltos_at_flag(int lflag, int allow, boolean_t enforce)
+{
+	int sflag = 0;
+
+	if ((lflag & LX_AT_EACCESS) && (allow & AT_EACCESS)) {
+		lflag &= ~LX_AT_EACCESS;
+		sflag |= AT_EACCESS;
+	}
+
+	if ((lflag & LX_AT_REMOVEDIR) && (allow & AT_REMOVEDIR)) {
+		lflag &= ~LX_AT_REMOVEDIR;
+		sflag |= AT_REMOVEDIR;
+	}
+
+	if ((lflag & LX_AT_SYMLINK_NOFOLLOW) && (allow & AT_SYMLINK_NOFOLLOW)) {
+		lflag &= ~LX_AT_SYMLINK_NOFOLLOW;
+		sflag |= AT_SYMLINK_NOFOLLOW;
+	}
+
+	/* right now SunOS doesn't have a _FOLLOW flag, so use a fake one */
+	if ((lflag & LX_AT_SYMLINK_FOLLOW) && (allow & LX_AT_SYMLINK_FOLLOW)) {
+		lflag &= ~LX_AT_SYMLINK_FOLLOW;
+		sflag |= LX_AT_SYMLINK_FOLLOW;
+	}
+
+	/* If lflag is not zero than some flags did not hit the above code. */
+	if (enforce && lflag)
+		return (-1);
+
+	return (sflag);
+}
+
+/*
+ * For illumos, access() does this:
+ *    If the process has appropriate privileges, an implementation may indicate
+ *    success for X_OK even if none of the execute file permission bits are set.
+ *
+ * But for Linux, access() does this:
+ *    If the calling process is privileged (i.e., its real UID is zero), then
+ *    an X_OK check is successful for a regular file if execute permission is
+ *    enabled for any of the file owner, group, or other.
+ *
+ * Linux used to behave more like illumos on older kernels:
+ *    In  kernel  2.4 (and earlier) there is some strangeness in the handling
+ *    of X_OK tests for superuser.  If all categories of  execute  permission
+ *    are  disabled for a nondirectory file, then the only access() test that
+ *    returns -1 is when mode is specified as just X_OK; if R_OK or  W_OK  is
+ *    also  specified in mode, then access() returns 0 for such files.
+ *
+ * So we need to handle the case where a privileged process is checking for
+ * X_OK but none of the execute bits are set on the file. We'll keep the old
+ * 2.4 behavior for 2.4 emulation but use the new behavior for any other
+ * kernel rev.
+ */
+static int
+lx_common_access(char *fname, int fmode, vnode_t *startvp)
+{
+	vnode_t *vp;
+	cred_t *tmpcr;
+	int error;
+	int mode;
+	cred_t *cr;
+	int estale_retry = 0;
+
+	if (fmode & ~(E_OK|R_OK|W_OK|X_OK))
+		return (EINVAL);
+
+	mode = ((fmode & (R_OK|W_OK|X_OK)) << 6);
+
+	cr = CRED();
+
+	/* OK to use effective uid/gid, i.e., no need to crdup(CRED())? */
+	if ((fmode & E_OK) != 0 ||
+	    (cr->cr_uid == cr->cr_ruid && cr->cr_gid == cr->cr_rgid)) {
+		tmpcr = cr;
+		crhold(tmpcr);
+	} else {
+		tmpcr = crdup(cr);
+		tmpcr->cr_uid = cr->cr_ruid;
+		tmpcr->cr_gid = cr->cr_rgid;
+		tmpcr->cr_ruid = cr->cr_uid;
+		tmpcr->cr_rgid = cr->cr_gid;
+	}
+
+lookup:
+	if ((error = lookupnameatcred(fname, UIO_USERSPACE, FOLLOW, NULLVPP,
+	    &vp, startvp, tmpcr)) != 0) {
+		if ((error == ESTALE) && fs_need_estale_retry(estale_retry++))
+			goto lookup;
+		crfree(tmpcr);
+		return (error);
+	}
+
+	if (mode != 0) {
+		error = VOP_ACCESS(vp, mode, 0, tmpcr, NULL);
+		if (error != 0) {
+			if ((error == ESTALE) &&
+			    fs_need_estale_retry(estale_retry++)) {
+				VN_RELE(vp);
+				goto lookup;
+			}
+
+		} else if ((fmode & X_OK) != 0 && cr->cr_ruid == 0 &&
+		    lx_kern_release_cmp(curproc->p_zone, "2.4.0") > 0) {
+			/* check for incorrect execute success */
+			vattr_t va;
+
+			va.va_mask = AT_MODE;
+			if ((error = VOP_GETATTR(vp, &va, 0, cr, NULL)) == 0) {
+				mode_t m = VTTOIF(va.va_type) | va.va_mode;
+
+				if ((m & S_IFMT) == S_IFREG &&
+				    !(m & (S_IXUSR | S_IXGRP | S_IXOTH))) {
+					/* no execute bits set in the mode */
+					error = EACCES;
+				}
+			}
+		}
+	}
+
+	crfree(tmpcr);
+	VN_RELE(vp);
+	return (error);
+}
+
+int
+lx_faccessat(int atfd, char *fname, int fmode, int flag)
+{
+	vnode_t *startvp;
+	int error;
+
+	if (atfd == LX_AT_FDCWD)
+		atfd = AT_FDCWD;
+
+	if ((flag = ltos_at_flag(flag, AT_EACCESS, B_FALSE)) < 0)
+		return (set_errno(EINVAL));
+
+	if (fname == NULL)
+		return (set_errno(EFAULT));
+	if ((error = fgetstartvp(atfd, fname, &startvp)) != 0)
+		return (set_errno(error));
+	if (AU_AUDITING() && startvp != NULL)
+		audit_setfsat_path(1);
+
+	/* Do not allow E_OK unless AT_EACCESS flag is set */
+	if ((flag & AT_EACCESS) == 0)
+		fmode &= ~E_OK;
+
+	error = lx_common_access(fname, fmode, startvp);
+	if (startvp != NULL)
+		VN_RELE(startvp);
+	if (error)
+		return (set_errno(error));
+	return (0);
+}
+
+int
+lx_access(char *fname, int fmode)
+{
+	return (lx_faccessat(LX_AT_FDCWD, fname, fmode, 0));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_aio.c b/usr/src/uts/common/brand/lx/syscall/lx_aio.c
new file mode 100644
index 0000000000..c821e72538
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_aio.c
@@ -0,0 +1,1345 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * Linux aio syscall support.
+ *
+ * The Linux story around the io_* syscalls is very confusing. The io_* syscalls
+ * are not exposed via glibc and in fact, glibc seems to implement its own aio
+ * without using the io_* syscalls at all. However, there is the libaio library
+ * which uses the io_* syscalls, although its implementation of the io_*
+ * functions (with the same names!) is different from the syscalls themselves,
+ * and it uses different definitions for some of the structures involved.
+ *
+ * These syscalls are documented to use an aio_context_t for the context
+ * parameter. On Linux this is a ulong_t. The contexts live in the kernel
+ * address space and are looked up using the aio_context_t parameter. However,
+ * the Linux libaio library, which is a consumer of the io_* syscalls, abuses
+ * the context by assuming it can be used as a pointer into memory that is
+ * mapped into the process. To accomodate this abomination we map a page of
+ * anonymous memory and expose the context to user-land as a pointer offset
+ * into that page. The page itself is never used by our code and our internal
+ * context ID is simply an integer we calculate based on the page pointer
+ * offset.
+ *
+ * Most applications never use aio, so we don't want an implementation that
+ * adds overhead to every process, but on the other hand, when an application is
+ * using aio, it is for performance reasons and we want to be as efficient as
+ * possible. In particular, we don't want to dynamically allocate resources
+ * in the paths that enqueue I/O. Instead, we pre-allocate the resources
+ * we may need when the application performs the io_setup call and keep the
+ * io_submit and io_getevents calls streamlined.
+ *
+ * The general approach here is inspired by the native aio support provided by
+ * libc in user-land. We have worker threads that pick up pending work from
+ * the context "lxioctx_pending" list and synchronously issue the operation in
+ * the control block. When the operation completes, the thread places the
+ * control block into the context "lxioctx_done" list for later consumption by
+ * io_getevents. The thread will then attempt to service another pending
+ * operation or wait for more work to arrive.
+ *
+ * The control blocks on the pending or done lists are referenced by an
+ * lx_io_elem_t struct. This simply holds a pointer to the user-land control
+ * block and the result of the operation. These elements are pre-allocated at
+ * io_setup time and stored on the context "lxioctx_free" list.
+ *
+ * io_submit pulls elements off of the free list, places them on the pending
+ * list and kicks a worker thread to run. io_getevents pulls elements off of
+ * the done list, sets up an event to return, and places the elements back
+ * onto the free list.
+ *
+ * The worker threads are pre-allocated at io_setup time. These are LWP's
+ * that are part of the process, but never leave the kernel. The number of
+ * LWP's is allocated based on the nr_events argument to io_setup. Because
+ * this argument can theoretically be large (up to LX_AIO_MAX_NR), we want to
+ * pre-allocate enough threads to get good I/O concurrency, but not overdo it.
+ * For a small nr_events (<= lx_aio_base_workers) we pre-allocate as many
+ * threads as nr_events so that all of the the I/O can run in parallel. Once
+ * we exceed lx_aio_base_workers, we scale up the number of threads by 2, until
+ * we hit the maximum at lx_aio_max_workers. See the code in io_setup for more
+ * information.
+ *
+ * Because the worker threads never leave the kernel, they are marked with the
+ * TP_KTHREAD bit so that /proc operations essentially ignore them. We also tag
+ * the brand lwp flags with the BR_AIO_LWP bit so that these threads never
+ * appear in the lx /proc. Aside from servicing aio submissions, the worker
+ * threads don't participate in most application-initiated operations. Forking
+ * is a special case for the workers. The Linux fork(2) and vfork(2) behavior
+ * always forks only a single thread; the caller. However, during cfork() the
+ * system attempts to quiesce all threads by calling holdlwps(). The workers
+ * check for SHOLDFORK and SHOLDFORK1 in their loops and suspend themselves ala
+ * holdlwp() if the process forks.
+ *
+ * It is hard to make any generalized statements about how the aio syscalls
+ * are used in production. MySQL is one of the more popular consumers of aio
+ * and in the default configuration it will create 10 contexts with a capacity
+ * of 256 I/Os (io_setup nr_events) and 1 context with a capacity of 100 I/Os.
+ * Another application we've seen will create 8 contexts, each with a capacity
+ * of 128 I/Os. In practice 1-7 was the typical number of in-flight I/Os.
+ *
+ * The default configuration for MySQL uses 4 read and 4 write threads. Each
+ * thread has an associated context. MySQL also allocates 3 additional contexts,
+ * so in the default configuration it will only use 11, but the number of
+ * read and write threads can be tuned up to a maximum of 64. We can expand
+ * a process's number of contexts up to a maximum of LX_IOCTX_CNT_MAX, which
+ * is significantly more than we've ever seen in use.
+ *
+ * According to www.kernel.org/doc/Documentation/sysctl/fs.txt, the
+ * /proc/sys/fs entries for aio are:
+ * - aio-nr: The total of all nr_events values specified on the io_setup
+ *           call for every active context.
+ * - aio-max-nr: The upper limit for aio-nr
+ * aio-nr is tracked as a zone-wide value. We keep aio-max-nr limited to
+ * LX_AIO_MAX_NR, which matches Linux and provides plenty of headroom for the
+ * zone.
+ */
+
+#include <sys/systm.h>
+#include <sys/mutex.h>
+#include <sys/time.h>
+#include <sys/brand.h>
+#include <sys/sysmacros.h>
+#include <sys/sdt.h>
+#include <sys/procfs.h>
+#include <sys/eventfd.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_syscalls.h>
+#include <sys/lx_misc.h>
+#include <lx_errno.h>
+
+/* These constants match Linux */
+#define	LX_IOCB_FLAG_RESFD		0x0001
+#define	LX_IOCB_CMD_PREAD		0
+#define	LX_IOCB_CMD_PWRITE		1
+#define	LX_IOCB_CMD_FSYNC		2
+#define	LX_IOCB_CMD_FDSYNC		3
+#define	LX_IOCB_CMD_PREADX		4
+#define	LX_IOCB_CMD_POLL		5
+#define	LX_IOCB_CMD_NOOP		6
+#define	LX_IOCB_CMD_PREADV		7
+#define	LX_IOCB_CMD_PWRITEV		8
+
+#define	LX_KIOCB_KEY			0
+
+/*
+ * Base and max. number of contexts/process. Note that we currently map one
+ * page to manage the user-level context ID, so that code must be adjusted if
+ * LX_IOCTX_CNT_MAX is ever enlarged. Currently, this is the limit for the
+ * number of 64-bit pointers in one 4k page.
+ */
+#define	LX_IOCTX_CNT_BASE	16
+#define	LX_IOCTX_CNT_MAX	512
+
+/*
+ * Max number of control block pointers, or lx_io_event_t's, to allocate on the
+ * stack in io_submit or io_getevents.
+ */
+#define	MAX_ALLOC_ON_STACK	128
+#define	alloca(x)		__builtin_alloca(x)
+extern void *__builtin_alloca(size_t);
+
+/* The context is an offset within the ctxpage we mapped */
+#define	CTXID_TO_PTR(L, I)	((L)->l_io_ctxpage + ((I) * sizeof (uintptr_t)))
+#define	PTR_TO_CTXID(L, P)	((int)((uintptr_t)(P) - (L)->l_io_ctxpage) / \
+				sizeof (uintptr_t))
+
+typedef ulong_t lx_aio_context_t;
+
+uint_t	lx_aio_base_workers = 16;	/* num threads/context before scaling */
+uint_t	lx_aio_max_workers = 32;	/* upper limit on threads/context */
+
+/*
+ * Internal representation of an aio context.
+ */
+typedef struct lx_io_ctx {
+	boolean_t	lxioctx_shutdown;	/* context is being destroyed */
+	uint_t		lxioctx_maxn;		/* nr_events from io_setup */
+	uint_t		lxioctx_in_use;		/* reference counter */
+	kmutex_t	lxioctx_f_lock;		/* free list lock */
+	uint_t		lxioctx_free_cnt;	/* num. elements in free list */
+	list_t		lxioctx_free;		/* free list */
+	kmutex_t	lxioctx_p_lock;		/* pending list lock */
+	kcondvar_t	lxioctx_pending_cv;	/* pending list cv */
+	list_t		lxioctx_pending;	/* pending list */
+	kmutex_t	lxioctx_d_lock;		/* done list lock */
+	kcondvar_t	lxioctx_done_cv;	/* done list cv */
+	uint_t		lxioctx_done_cnt;	/* num. elements in done list */
+	list_t		lxioctx_done;		/* done list */
+} lx_io_ctx_t;
+
+/*
+ * Linux binary definition of an I/O event.
+ */
+typedef struct lx_io_event {
+	uint64_t	lxioe_data;	/* data payload */
+	uint64_t	lxioe_object;	/* object of origin */
+	int64_t		lxioe_res;	/* result code */
+	int64_t		lxioe_res2;	/* "secondary" result (WTF?) */
+} lx_io_event_t;
+
+/*
+ * Linux binary definition of an I/O control block.
+ */
+typedef struct lx_iocb {
+	uint64_t	lxiocb_data;		/* data payload */
+	uint32_t	lxiocb_key;		/* must be LX_KIOCB_KEY (!) */
+	uint32_t	lxiocb_reserved1;
+	uint16_t	lxiocb_op;		/* operation */
+	int16_t		lxiocb_reqprio;		/* request priority */
+	uint32_t	lxiocb_fd;		/* file descriptor */
+	uint64_t	lxiocb_buf;		/* data buffer */
+	uint64_t	lxiocb_nbytes;		/* number of bytes */
+	int64_t		lxiocb_offset;		/* offset in file */
+	uint64_t	lxiocb_reserved2;
+	uint32_t	lxiocb_flags;		/* LX_IOCB_FLAG_* flags */
+	uint32_t	lxiocb_resfd;		/* eventfd fd, if any */
+} lx_iocb_t;
+
+typedef struct lx_io_elem {
+	list_node_t	lxioelem_link;
+	uint16_t	lxioelem_op;		/* operation */
+	uint16_t	lxioelem_flags;		/* bits from lxiocb_flags */
+	int		lxioelem_fd;		/* file descriptor */
+	file_t		*lxioelem_fp;		/* getf() file pointer */
+	int		lxioelem_resfd;		/* RESFD file descriptor */
+	file_t		*lxioelem_resfp;	/* RESFD getf() file pointer */
+	void		*lxioelem_buf;		/* data buffer */
+	uint64_t	lxioelem_nbytes;	/* number of bytes */
+	int64_t		lxioelem_offset;	/* offset in file */
+	uint64_t	lxioelem_data;
+	ssize_t		lxioelem_res;
+	void		*lxioelem_cbp;		/* ptr to iocb in userspace */
+} lx_io_elem_t;
+
+/* From lx_rw.c */
+extern ssize_t lx_pread_fp(file_t *, void *, size_t, off64_t);
+extern ssize_t lx_pwrite_fp(file_t *, void *, size_t, off64_t);
+
+/* From common/syscall/rw.c */
+extern int fdsync(int, int);
+/* From common/os/grow.c */
+extern caddr_t smmap64(caddr_t, size_t, int, int, int, off_t);
+
+/*
+ * Given an aio_context ID, return our internal context pointer with an
+ * additional ref. count, or NULL if cp not found.
+ */
+static lx_io_ctx_t *
+lx_io_cp_hold(lx_aio_context_t cid)
+{
+	int id;
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+	lx_io_ctx_t *cp;
+
+	mutex_enter(&lxpd->l_io_ctx_lock);
+
+	if (lxpd->l_io_ctxs == NULL) {
+		ASSERT(lxpd->l_io_ctx_cnt == 0);
+		ASSERT(lxpd->l_io_ctxpage == NULL);
+		goto bad;
+	}
+
+	id = PTR_TO_CTXID(lxpd, cid);
+	if (id < 0 || id >= lxpd->l_io_ctx_cnt)
+		goto bad;
+
+	if ((cp = lxpd->l_io_ctxs[id]) == NULL)
+		goto bad;
+
+	if (cp->lxioctx_shutdown)
+		goto bad;
+
+	atomic_inc_32(&cp->lxioctx_in_use);
+	mutex_exit(&lxpd->l_io_ctx_lock);
+	return (cp);
+
+bad:
+	mutex_exit(&lxpd->l_io_ctx_lock);
+	return (NULL);
+}
+
+/*
+ * Release a hold on the context and clean up the context if it was the last
+ * hold.
+ */
+static void
+lx_io_cp_rele(lx_io_ctx_t *cp)
+{
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+	lx_zone_data_t *lxzd;
+	int i;
+	lx_io_elem_t *ep;
+
+	mutex_enter(&lxpd->l_io_ctx_lock);
+	ASSERT(cp->lxioctx_in_use >= 1);
+	if (cp->lxioctx_in_use > 1) {
+		atomic_dec_32(&cp->lxioctx_in_use);
+		/* wake all threads waiting on context rele */
+		cv_broadcast(&lxpd->l_io_destroy_cv);
+		mutex_exit(&lxpd->l_io_ctx_lock);
+		return;
+	}
+
+	/*
+	 * We hold the last ref.
+	 */
+	for (i = 0; i < lxpd->l_io_ctx_cnt; i++) {
+		if (lxpd->l_io_ctxs[i] == cp) {
+			lxpd->l_io_ctxs[i] = NULL;
+			break;
+		}
+	}
+	ASSERT(i < lxpd->l_io_ctx_cnt);
+	/* wake all threads waiting on context destruction */
+	cv_broadcast(&lxpd->l_io_destroy_cv);
+	ASSERT(cp->lxioctx_shutdown == B_TRUE);
+
+	mutex_exit(&lxpd->l_io_ctx_lock);
+
+	/* can now decrement the zone's overall aio counter */
+	lxzd = ztolxzd(curproc->p_zone);
+	mutex_enter(&lxzd->lxzd_lock);
+	VERIFY(cp->lxioctx_maxn <= lxzd->lxzd_aio_nr);
+	lxzd->lxzd_aio_nr -= cp->lxioctx_maxn;
+	mutex_exit(&lxzd->lxzd_lock);
+
+	/*
+	 * We have the only pointer to the context now. Free all
+	 * elements from all three queues and the context itself.
+	 */
+	while ((ep = list_remove_head(&cp->lxioctx_free)) != NULL) {
+		kmem_free(ep, sizeof (lx_io_elem_t));
+	}
+
+	/*
+	 * During io_submit() we use getf() to get/validate the file pointer
+	 * for the file descriptor in each control block. We do not releasef()
+	 * the fd, but instead pass along the fd and file pointer to the worker
+	 * threads. In order to manage this hand-off we use clear_active_fd()
+	 * in the syscall path and then in our thread which takes over the file
+	 * descriptor, we use a combination of set_active_fd() and releasef().
+	 * Because our thread that is taking ownership of the fd has not called
+	 * getf(), we first call set_active_fd(-1) to reserve a slot in the
+	 * active fd array for ourselves.
+	 */
+	set_active_fd(-1);
+	while ((ep = list_remove_head(&cp->lxioctx_pending)) != NULL) {
+		set_active_fd(ep->lxioelem_fd);
+		releasef(ep->lxioelem_fd);
+
+		if (ep->lxioelem_flags & LX_IOCB_FLAG_RESFD) {
+			set_active_fd(ep->lxioelem_resfd);
+			releasef(ep->lxioelem_resfd);
+		}
+
+		kmem_free(ep, sizeof (lx_io_elem_t));
+	}
+
+	while ((ep = list_remove_head(&cp->lxioctx_done)) != NULL) {
+		kmem_free(ep, sizeof (lx_io_elem_t));
+	}
+
+	ASSERT(list_is_empty(&cp->lxioctx_free));
+	list_destroy(&cp->lxioctx_free);
+	ASSERT(list_is_empty(&cp->lxioctx_pending));
+	list_destroy(&cp->lxioctx_pending);
+	ASSERT(list_is_empty(&cp->lxioctx_done));
+	list_destroy(&cp->lxioctx_done);
+
+	kmem_free(cp, sizeof (lx_io_ctx_t));
+}
+
+/*
+ * Called by a worker thread to perform the operation specified in the control
+ * block.
+ *
+ * Linux returns a negative errno in the event "lxioelem_res" field as the
+ * result of a failed operation. We do the same.
+ */
+static void
+lx_io_do_op(lx_io_elem_t *ep)
+{
+	int err;
+	int64_t res = 0;
+
+	set_active_fd(ep->lxioelem_fd);
+
+	ttolwp(curthread)->lwp_errno = 0;
+	switch (ep->lxioelem_op) {
+	case LX_IOCB_CMD_FSYNC:
+	case LX_IOCB_CMD_FDSYNC:
+		/*
+		 * Note that Linux always returns EINVAL for these two
+		 * operations. This is apparently because nothing in Linux
+		 * defines the 'aio_fsync' function. Thus, it is unlikely any
+		 * application will actually submit these.
+		 *
+		 * This is basically fdsync(), but we already have the fp.
+		 */
+		err = VOP_FSYNC(ep->lxioelem_fp->f_vnode,
+		    (ep->lxioelem_op == LX_IOCB_CMD_FSYNC) ?  FSYNC : FDSYNC,
+		    ep->lxioelem_fp->f_cred, NULL);
+		if (err != 0) {
+			(void) set_errno(err);
+		}
+
+		break;
+
+	case LX_IOCB_CMD_PREAD:
+		res = lx_pread_fp(ep->lxioelem_fp, ep->lxioelem_buf,
+		    ep->lxioelem_nbytes, ep->lxioelem_offset);
+		break;
+
+	case LX_IOCB_CMD_PWRITE:
+		res = lx_pwrite_fp(ep->lxioelem_fp, ep->lxioelem_buf,
+		    ep->lxioelem_nbytes, ep->lxioelem_offset);
+		break;
+
+	default:
+		/* We validated the op at io_submit syscall time */
+		VERIFY(0);
+		break;
+	}
+	if (ttolwp(curthread)->lwp_errno != 0)
+		res = -lx_errno(ttolwp(curthread)->lwp_errno, EINVAL);
+
+	ep->lxioelem_res = res;
+
+	releasef(ep->lxioelem_fd);
+	ep->lxioelem_fd = 0;
+	ep->lxioelem_fp = NULL;
+}
+
+/*
+ * The operation has either completed or been cancelled. Finalize the handling
+ * and move the operation onto the "done" queue.
+ */
+static void
+lx_io_finish_op(lx_io_ctx_t *cp, lx_io_elem_t *ep, boolean_t do_event)
+{
+	boolean_t do_resfd;
+	int resfd = 0;
+	file_t *resfp = NULL;
+
+	if (ep->lxioelem_flags & LX_IOCB_FLAG_RESFD) {
+		do_resfd = B_TRUE;
+		resfd = ep->lxioelem_resfd;
+		resfp = ep->lxioelem_resfp;
+	} else {
+		do_resfd = B_FALSE;
+	}
+
+	ep->lxioelem_flags = 0;
+	ep->lxioelem_resfd = 0;
+	ep->lxioelem_resfp = NULL;
+
+	mutex_enter(&cp->lxioctx_d_lock);
+	list_insert_tail(&cp->lxioctx_done, ep);
+	cp->lxioctx_done_cnt++;
+	cv_signal(&cp->lxioctx_done_cv);
+	mutex_exit(&cp->lxioctx_d_lock);
+
+	/* Update the eventfd if necessary */
+	if (do_resfd) {
+		vnode_t *vp = resfp->f_vnode;
+		uint64_t val = 1;
+
+		set_active_fd(resfd);
+
+		if (do_event) {
+			/*
+			 * Eventfd notifications from AIO are special in that
+			 * they are not expected to block. This interface allows
+			 * the eventfd value to reach (but not cross) the
+			 * overflow value.
+			 */
+			(void) VOP_IOCTL(vp, EVENTFDIOC_POST, (intptr_t)&val,
+			    FKIOCTL, resfp->f_cred, NULL, NULL);
+		}
+
+		releasef(resfd);
+	}
+}
+
+/*
+ * First check if this worker needs to quit due to shutdown or exit. Return
+ * true in this case.
+ *
+ * Then check if our process is forking. In this case it expects all LWPs to be
+ * stopped first. For the worker threads, a stop equivalent to holdlwp() is
+ * necessary before the fork can proceed.
+ *
+ * It is common to check p_flag outside of p_lock (see issig) and we want to
+ * avoid making p_lock any hotter since this is called in the worker main loops.
+ */
+static boolean_t
+lx_io_worker_chk_status(lx_io_ctx_t *cp, boolean_t locked)
+{
+	if (cp->lxioctx_shutdown)
+		return (B_TRUE);
+
+	if (curproc->p_flag & (SEXITLWPS | SKILLED)) {
+		cp->lxioctx_shutdown = B_TRUE;
+		return (B_TRUE);
+	}
+
+	if (curproc->p_flag & (SHOLDFORK | SHOLDFORK1)) {
+		if (locked)
+			mutex_exit(&cp->lxioctx_p_lock);
+
+		mutex_enter(&curproc->p_lock);
+		stop(PR_SUSPENDED, SUSPEND_NORMAL);
+		mutex_exit(&curproc->p_lock);
+
+		if (locked)
+			mutex_enter(&cp->lxioctx_p_lock);
+
+		if (cp->lxioctx_shutdown)
+			return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * Worker thread - pull work off the pending queue, perform the operation and
+ * place the result on the done queue. Do this as long as work is pending, then
+ * wait for more.
+ */
+static void
+lx_io_worker(void *a)
+{
+	lx_io_ctx_t *cp = (lx_io_ctx_t *)a;
+	lx_io_elem_t *ep;
+
+	set_active_fd(-1);	/* See comment in lx_io_cp_rele */
+
+	while (!cp->lxioctx_shutdown) {
+		mutex_enter(&cp->lxioctx_p_lock);
+		if (list_is_empty(&cp->lxioctx_pending)) {
+			/*
+			 * This must be cv_wait_sig, as opposed to cv_wait, so
+			 * that pokelwps works correctly on these threads.
+			 *
+			 * The worker threads have all of their signals held,
+			 * so a cv_wait_sig return of 0 here only occurs while
+			 * we're shutting down.
+			 */
+			if (cv_wait_sig(&cp->lxioctx_pending_cv,
+			    &cp->lxioctx_p_lock) == 0)
+				cp->lxioctx_shutdown = B_TRUE;
+		}
+
+		if (lx_io_worker_chk_status(cp, B_TRUE)) {
+			mutex_exit(&cp->lxioctx_p_lock);
+			break;
+		}
+
+		ep = list_remove_head(&cp->lxioctx_pending);
+		mutex_exit(&cp->lxioctx_p_lock);
+
+		while (ep != NULL) {
+			lx_io_do_op(ep);
+
+			lx_io_finish_op(cp, ep, B_TRUE);
+
+			if (lx_io_worker_chk_status(cp, B_FALSE))
+				break;
+
+			mutex_enter(&cp->lxioctx_p_lock);
+			ep = list_remove_head(&cp->lxioctx_pending);
+			mutex_exit(&cp->lxioctx_p_lock);
+		}
+	}
+
+	lx_io_cp_rele(cp);
+
+	ASSERT(curthread->t_lwp != NULL);
+	mutex_enter(&curproc->p_lock);
+	lwp_exit();
+}
+
+/*
+ * LTP passes -1 for nr_events but we're limited by LX_AIO_MAX_NR anyway.
+ */
+long
+lx_io_setup(uint_t nr_events, void *ctxp)
+{
+	int i, slot;
+	proc_t *p = curproc;
+	lx_proc_data_t *lxpd = ptolxproc(p);
+	lx_zone_data_t *lxzd = ztolxzd(p->p_zone);
+	lx_io_ctx_t *cp;
+	lx_io_elem_t *ep;
+	uintptr_t cid;
+	uint_t nworkers;
+	k_sigset_t hold_set;
+
+#ifdef _SYSCALL32_IMPL
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		uintptr32_t cid32;
+
+		if (copyin(ctxp, &cid32, sizeof (cid32)) != 0)
+			return (set_errno(EFAULT));
+		cid = (uintptr_t)cid32;
+	} else
+#endif
+	if (copyin(ctxp, &cid, sizeof (cid)) != 0)
+		return (set_errno(EFAULT));
+
+	/* The cid in user-land must be NULL to start */
+	if (cid != NULL || nr_events > LX_AIO_MAX_NR)
+		return (set_errno(EINVAL));
+
+	mutex_enter(&lxzd->lxzd_lock);
+	if ((nr_events + lxzd->lxzd_aio_nr) > LX_AIO_MAX_NR) {
+		mutex_exit(&lxzd->lxzd_lock);
+		return (set_errno(EAGAIN));
+	}
+	lxzd->lxzd_aio_nr += nr_events;
+	mutex_exit(&lxzd->lxzd_lock);
+
+	/* Find a free slot */
+	mutex_enter(&lxpd->l_io_ctx_lock);
+	if (lxpd->l_io_ctxs == NULL) {
+		/*
+		 * First use of aio, allocate a context array and a page
+		 * in our address space to use for context ID handling.
+		 */
+		uintptr_t ctxpage;
+
+		ASSERT(lxpd->l_io_ctx_cnt == 0);
+		ASSERT(lxpd->l_io_ctxpage == NULL);
+
+		ttolwp(curthread)->lwp_errno = 0;
+		ctxpage = (uintptr_t)smmap64(0, PAGESIZE, PROT_READ,
+		    MAP_SHARED | MAP_ANON, -1, 0);
+		if (ttolwp(curthread)->lwp_errno != 0) {
+			mutex_exit(&lxpd->l_io_ctx_lock);
+			return (set_errno(ENOMEM));
+		}
+
+		lxpd->l_io_ctxpage = ctxpage;
+		lxpd->l_io_ctx_cnt = LX_IOCTX_CNT_BASE;
+		lxpd->l_io_ctxs = kmem_zalloc(lxpd->l_io_ctx_cnt *
+		    sizeof (lx_io_ctx_t *), KM_SLEEP);
+		slot = 0;
+	} else {
+		ASSERT(lxpd->l_io_ctx_cnt > 0);
+		for (slot = 0; slot < lxpd->l_io_ctx_cnt; slot++) {
+			if (lxpd->l_io_ctxs[slot] == NULL)
+				break;
+		}
+
+		if (slot == lxpd->l_io_ctx_cnt) {
+			/* Double our context array up to the max. */
+			const uint_t new_cnt = lxpd->l_io_ctx_cnt * 2;
+			const uint_t old_size = lxpd->l_io_ctx_cnt *
+			    sizeof (lx_io_ctx_t *);
+			const uint_t new_size = new_cnt *
+			    sizeof (lx_io_ctx_t *);
+			struct lx_io_ctx  **old_array = lxpd->l_io_ctxs;
+
+			if (new_cnt > LX_IOCTX_CNT_MAX) {
+				mutex_exit(&lxpd->l_io_ctx_lock);
+				mutex_enter(&lxzd->lxzd_lock);
+				lxzd->lxzd_aio_nr -= nr_events;
+				mutex_exit(&lxzd->lxzd_lock);
+				return (set_errno(ENOMEM));
+			}
+
+			/* See big theory comment explaining context ID. */
+			VERIFY(PAGESIZE >= new_size);
+			lxpd->l_io_ctxs = kmem_zalloc(new_size, KM_SLEEP);
+
+			bcopy(old_array, lxpd->l_io_ctxs, old_size);
+			kmem_free(old_array, old_size);
+			lxpd->l_io_ctx_cnt = new_cnt;
+
+			/* note: 'slot' is now valid in the new array */
+		}
+	}
+
+	cp = kmem_zalloc(sizeof (lx_io_ctx_t), KM_SLEEP);
+	list_create(&cp->lxioctx_free, sizeof (lx_io_elem_t),
+	    offsetof(lx_io_elem_t, lxioelem_link));
+	list_create(&cp->lxioctx_pending, sizeof (lx_io_elem_t),
+	    offsetof(lx_io_elem_t, lxioelem_link));
+	list_create(&cp->lxioctx_done, sizeof (lx_io_elem_t),
+	    offsetof(lx_io_elem_t, lxioelem_link));
+	mutex_init(&cp->lxioctx_f_lock, NULL, MUTEX_DEFAULT, NULL);
+	mutex_init(&cp->lxioctx_p_lock, NULL, MUTEX_DEFAULT, NULL);
+	mutex_init(&cp->lxioctx_d_lock, NULL, MUTEX_DEFAULT, NULL);
+	cv_init(&cp->lxioctx_pending_cv, NULL, CV_DEFAULT, NULL);
+	cv_init(&cp->lxioctx_done_cv, NULL, CV_DEFAULT, NULL);
+
+	/* Add a hold on this context until we're done setting up */
+	cp->lxioctx_in_use = 1;
+	lxpd->l_io_ctxs[slot] = cp;
+
+	cid = CTXID_TO_PTR(lxpd, slot);
+
+	mutex_exit(&lxpd->l_io_ctx_lock);
+
+	/*
+	 * Finish setting up the context.
+	 *
+	 * The context is in the l_io_ctxs array now, so it is potentially
+	 * visible to other threads. However, we have a hold so it cannot be
+	 * destroyed, and both lxioctx_free_cnt and lxioctx_maxn are still 0,
+	 * so nothing can be submitted to this context yet either.
+	 */
+
+	/* Setup the free list of internal control block elements */
+	for (i = 0; i < nr_events; i++) {
+		ep = kmem_zalloc(sizeof (lx_io_elem_t), KM_SLEEP);
+		list_insert_head(&cp->lxioctx_free, ep);
+	}
+
+	/*
+	 * Pre-allocate the worker threads at setup time.
+	 *
+	 * Based on how much concurrent input we may be given, we want enough
+	 * worker threads to get good parallelism but we also want to taper off
+	 * and cap at our upper limit. Our zone's ZFS I/O limit may also come
+	 * into play when we're pumping lots of I/O in parallel.
+	 *
+	 * Note: a possible enhancement here would be to also limit the number
+	 * of worker threads based on the zone's cpu-cap. That is, if the
+	 * cap is low, we might not want too many worker threads.
+	 */
+	if (nr_events <= lx_aio_base_workers) {
+		nworkers = nr_events;
+	} else {
+		/* scale up until hit max */
+		nworkers = (nr_events / 2) + (lx_aio_base_workers / 2);
+		if (nworkers > lx_aio_max_workers)
+			nworkers = lx_aio_max_workers;
+	}
+
+	sigfillset(&hold_set);
+	for (i = 0; i < nworkers; i++) {
+		klwp_t *l;
+		kthread_t *t;
+
+		/*
+		 * Note that this lwp will not "stop at sys_rtt" as described
+		 * on lwp_create. This lwp will run entirely in the kernel as
+		 * a worker thread serving aio requests.
+		 */
+		l = lwp_create(lx_io_worker, (void *)cp, 0, p, TS_STOPPED,
+		    minclsyspri - 1, &hold_set, curthread->t_cid, 0);
+		if (l == NULL) {
+			if (i == 0) {
+				/*
+				 * Uh-oh - we can't create a single worker.
+				 * Release our hold which will cleanup.
+				 */
+				cp->lxioctx_shutdown = B_TRUE;
+				mutex_enter(&lxpd->l_io_ctx_lock);
+				cp->lxioctx_maxn = nr_events;
+				mutex_exit(&lxpd->l_io_ctx_lock);
+				lx_io_cp_rele(cp);
+				return (set_errno(ENOMEM));
+			} else {
+				/*
+				 * No new lwp but we already have at least 1
+				 * worker so don't fail entire syscall.
+				 */
+				break;
+			}
+		}
+
+		atomic_inc_32(&cp->lxioctx_in_use);
+
+		/*
+		 * Mark it as an in-kernel thread, an lx AIO worker LWP, and
+		 * set it running.
+		 */
+		t = lwptot(l);
+		mutex_enter(&curproc->p_lock);
+		t->t_proc_flag = (t->t_proc_flag & ~TP_HOLDLWP) | TP_KTHREAD;
+		lwptolxlwp(l)->br_lwp_flags |= BR_AIO_LWP;
+		lwp_create_done(t);
+		mutex_exit(&curproc->p_lock);
+	}
+
+	/*
+	 * io_submit can occur once lxioctx_free_cnt and lxioctx_maxn are
+	 * non-zero.
+	 */
+	mutex_enter(&lxpd->l_io_ctx_lock);
+	cp->lxioctx_maxn = cp->lxioctx_free_cnt = nr_events;
+	mutex_exit(&lxpd->l_io_ctx_lock);
+	/* Release our hold, worker thread refs keep ctx alive. */
+	lx_io_cp_rele(cp);
+
+#ifdef _SYSCALL32_IMPL
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		uintptr32_t cid32 = (uintptr32_t)cid;
+
+		if (copyout(&cid32, ctxp, sizeof (cid32)) != 0) {
+			/* Since we did a copyin above, this shouldn't fail */
+			(void) lx_io_destroy(cid);
+			return (set_errno(EFAULT));
+		}
+	} else
+#endif
+	if (copyout(&cid, ctxp, sizeof (cid)) != 0) {
+		/* Since we did a copyin above, this shouldn't fail */
+		(void) lx_io_destroy(cid);
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
+
+long
+lx_io_submit(lx_aio_context_t cid, const long nr, uintptr_t **bpp)
+{
+	uint_t i = 0;
+	int err = 0;
+	const size_t sz = nr * sizeof (uintptr_t);
+	lx_io_ctx_t *cp;
+	lx_io_elem_t *ep;
+	lx_iocb_t **iocbpp;
+
+	if ((cp = lx_io_cp_hold(cid)) == NULL)
+		return (set_errno(EINVAL));
+
+	if (nr == 0) {
+		lx_io_cp_rele(cp);
+		return (0);
+	}
+
+	if (nr < 0 || nr > cp->lxioctx_maxn) {
+		lx_io_cp_rele(cp);
+		return (set_errno(EINVAL));
+	}
+
+	if (nr > MAX_ALLOC_ON_STACK) {
+		iocbpp = (lx_iocb_t **)kmem_alloc(sz, KM_NOSLEEP);
+		if (iocbpp == NULL) {
+			lx_io_cp_rele(cp);
+			return (set_errno(EAGAIN));
+		}
+	} else {
+		iocbpp = (lx_iocb_t **)alloca(sz);
+	}
+
+#ifdef _SYSCALL32_IMPL
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		uintptr32_t *iocbpp32;
+
+		if (copyin(bpp, iocbpp, nr * sizeof (uintptr32_t)) != 0) {
+			lx_io_cp_rele(cp);
+			err = EFAULT;
+			goto out;
+		}
+
+		/*
+		 * Zero-extend the 32-bit pointers to proper size.  This is
+		 * performed "in reverse" so it can be done in-place, rather
+		 * than with an additional translation copy.
+		 */
+		iocbpp32 = (uintptr32_t *)iocbpp;
+		i = nr;
+		do {
+			i--;
+			iocbpp[i] = (lx_iocb_t *)(uintptr_t)iocbpp32[i];
+		} while (i != 0);
+	} else
+#endif
+	if (copyin(bpp, iocbpp, nr * sizeof (uintptr_t)) != 0) {
+		lx_io_cp_rele(cp);
+		err = EFAULT;
+		goto out;
+	}
+
+	/* We need to return an error if not able to process any of them */
+	mutex_enter(&cp->lxioctx_f_lock);
+	if (cp->lxioctx_free_cnt == 0) {
+		mutex_exit(&cp->lxioctx_f_lock);
+		lx_io_cp_rele(cp);
+		err = EAGAIN;
+		goto out;
+	}
+	mutex_exit(&cp->lxioctx_f_lock);
+
+	for (i = 0; i < nr; i++) {
+		lx_iocb_t cb;
+		file_t *fp, *resfp = NULL;
+
+		if (cp->lxioctx_shutdown)
+			break;
+
+		if (copyin(iocbpp[i], &cb, sizeof (lx_iocb_t)) != 0) {
+			err = EFAULT;
+			break;
+		}
+
+		/* There is only one valid flag */
+		if (cb.lxiocb_flags & ~LX_IOCB_FLAG_RESFD) {
+			err = EINVAL;
+			break;
+		}
+
+		switch (cb.lxiocb_op) {
+		case LX_IOCB_CMD_FSYNC:
+		case LX_IOCB_CMD_FDSYNC:
+		case LX_IOCB_CMD_PREAD:
+		case LX_IOCB_CMD_PWRITE:
+			break;
+
+		/*
+		 * We don't support asynchronous preadv and pwritev (an
+		 * asynchronous scatter/gather being a somewhat odd
+		 * notion to begin with); we return EINVAL for that
+		 * case, which the caller should be able to deal with.
+		 * We also return EINVAL for LX_IOCB_CMD_NOOP or any
+		 * unrecognized opcode.
+		 */
+		default:
+			err = EINVAL;
+			break;
+		}
+		if (err != 0)
+			break;
+
+		/* Validate fd */
+		if ((fp = getf(cb.lxiocb_fd)) == NULL) {
+			err = EBADF;
+			break;
+		}
+
+		if (cb.lxiocb_op == LX_IOCB_CMD_PREAD &&
+		    (fp->f_flag & FREAD) == 0) {
+			err = EBADF;
+			releasef(cb.lxiocb_fd);
+			break;
+		} else if (cb.lxiocb_op == LX_IOCB_CMD_PWRITE &&
+		    (fp->f_flag & FWRITE) == 0) {
+			err = EBADF;
+			releasef(cb.lxiocb_fd);
+			break;
+		}
+
+		/*
+		 * A character device is a bit complicated. Linux seems to
+		 * accept these on some devices (e.g. /dev/zero) but not
+		 * others (e.g. /proc/self/fd/0). This might be related to
+		 * the device being seek-able, but a simple seek-set to the
+		 * current offset will succeed for us on a pty. For now we
+		 * handle this by rejecting the device if it is a stream.
+		 *
+		 * If it is a pipe (VFIFO) or directory (VDIR), we error here
+		 * as does Linux. If it is a socket (VSOCK), it's ok here but
+		 * we will post ESPIPE when processing the I/O CB, as does
+		 * Linux. We also error on our other types: VDOOR, VPROC,
+		 * VPORT, VBAD.
+		 */
+		if (fp->f_vnode->v_type == VCHR) {
+			if (fp->f_vnode->v_stream != NULL) {
+				err = EINVAL;
+				releasef(cb.lxiocb_fd);
+				break;
+			}
+		} else if (fp->f_vnode->v_type != VREG &&
+		    fp->f_vnode->v_type != VBLK &&
+		    fp->f_vnode->v_type != VSOCK) {
+			err = EINVAL;
+			releasef(cb.lxiocb_fd);
+			break;
+		}
+
+		if (cb.lxiocb_flags & LX_IOCB_FLAG_RESFD) {
+			if ((resfp = getf(cb.lxiocb_resfd)) == NULL ||
+			    !lx_is_eventfd(resfp)) {
+				err = EINVAL;
+				releasef(cb.lxiocb_fd);
+				if (resfp != NULL)
+					releasef(cb.lxiocb_resfd);
+				break;
+			}
+		}
+
+		mutex_enter(&cp->lxioctx_f_lock);
+		if (cp->lxioctx_free_cnt == 0) {
+			mutex_exit(&cp->lxioctx_f_lock);
+			releasef(cb.lxiocb_fd);
+			if (cb.lxiocb_flags & LX_IOCB_FLAG_RESFD) {
+				releasef(cb.lxiocb_resfd);
+			}
+			if (i == 0) {
+				/*
+				 * Another thread used all of the free entries
+				 * after the check preceding this loop. Since
+				 * we did nothing, we must return an error.
+				 */
+				err = EAGAIN;
+			}
+			break;
+		}
+		ep = list_remove_head(&cp->lxioctx_free);
+		cp->lxioctx_free_cnt--;
+		ASSERT(ep != NULL);
+		mutex_exit(&cp->lxioctx_f_lock);
+
+		ep->lxioelem_op = cb.lxiocb_op;
+		ep->lxioelem_fd = cb.lxiocb_fd;
+		ep->lxioelem_fp = fp;
+		ep->lxioelem_buf = (void *)(uintptr_t)cb.lxiocb_buf;
+		ep->lxioelem_nbytes = cb.lxiocb_nbytes;
+		ep->lxioelem_offset = cb.lxiocb_offset;
+		ep->lxioelem_data = cb.lxiocb_data;
+		ep->lxioelem_cbp = iocbpp[i];
+
+		/* Hang on to the fp but setup to hand it off to a worker */
+		clear_active_fd(cb.lxiocb_fd);
+
+		if (cb.lxiocb_flags & LX_IOCB_FLAG_RESFD) {
+			ep->lxioelem_flags = LX_IOCB_FLAG_RESFD;
+			ep->lxioelem_resfd = cb.lxiocb_resfd;
+			ep->lxioelem_resfp = resfp;
+			clear_active_fd(cb.lxiocb_resfd);
+		}
+
+		mutex_enter(&cp->lxioctx_p_lock);
+		list_insert_tail(&cp->lxioctx_pending, ep);
+		cv_signal(&cp->lxioctx_pending_cv);
+		mutex_exit(&cp->lxioctx_p_lock);
+	}
+
+	lx_io_cp_rele(cp);
+
+out:
+	if (nr > MAX_ALLOC_ON_STACK) {
+		kmem_free(iocbpp, sz);
+	}
+	if (i == 0 && err != 0)
+		return (set_errno(err));
+
+	return (i);
+}
+
+long
+lx_io_getevents(lx_aio_context_t cid, long min_nr, const long nr,
+    lx_io_event_t *events, timespec_t *timeoutp)
+{
+	int i;
+	lx_io_ctx_t *cp;
+	const size_t sz = nr * sizeof (lx_io_event_t);
+	timespec_t timeout, *tp;
+	lx_io_event_t *out;
+
+	if ((cp = lx_io_cp_hold(cid)) == NULL)
+		return (set_errno(EINVAL));
+
+	if (min_nr < 0 || min_nr > cp->lxioctx_maxn ||
+	    nr < 0 || nr > cp->lxioctx_maxn) {
+		lx_io_cp_rele(cp);
+		return (set_errno(EINVAL));
+	}
+
+	if (nr == 0) {
+		lx_io_cp_rele(cp);
+		return (0);
+	}
+
+	if (events == NULL) {
+		lx_io_cp_rele(cp);
+		return (set_errno(EFAULT));
+	}
+
+	if (timeoutp == NULL) {
+		tp = NULL;
+	} else {
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			if (copyin(timeoutp, &timeout, sizeof (timestruc_t))) {
+				lx_io_cp_rele(cp);
+				return (EFAULT);
+			}
+		}
+#ifdef _SYSCALL32_IMPL
+		else {
+			timestruc32_t timeout32;
+			if (copyin(timeoutp, &timeout32,
+			    sizeof (timestruc32_t))) {
+				lx_io_cp_rele(cp);
+				return (EFAULT);
+			}
+			timeout.tv_sec = (time_t)timeout32.tv_sec;
+			timeout.tv_nsec = timeout32.tv_nsec;
+		}
+#endif
+
+		if (itimerspecfix(&timeout)) {
+			lx_io_cp_rele(cp);
+			return (EINVAL);
+		}
+
+		tp = &timeout;
+		if (timeout.tv_sec == 0 && timeout.tv_nsec == 0) {
+			/*
+			 * A timeout of 0:0 is like a poll; we return however
+			 * many events are ready, irrespective of the passed
+			 * min_nr.
+			 */
+			min_nr = 0;
+		} else {
+			timestruc_t now;
+
+			/*
+			 * We're given a relative time; add it to the current
+			 * time to derive an absolute time.
+			 */
+			gethrestime(&now);
+			timespecadd(tp, &now);
+		}
+	}
+
+	out = kmem_zalloc(sz, KM_SLEEP);
+
+	/*
+	 * A min_nr of 0 is like a poll even if given a NULL timeout; we return
+	 * however many events are ready.
+	 */
+	if (min_nr > 0) {
+		mutex_enter(&cp->lxioctx_d_lock);
+		while (!cp->lxioctx_shutdown && cp->lxioctx_done_cnt < min_nr) {
+			int r;
+
+			r = cv_waituntil_sig(&cp->lxioctx_done_cv,
+			    &cp->lxioctx_d_lock, tp, timechanged);
+			if (r < 0) {
+				/* timeout */
+				mutex_exit(&cp->lxioctx_d_lock);
+				lx_io_cp_rele(cp);
+				kmem_free(out, sz);
+				return (0);
+			} else if (r == 0) {
+				/* interrupted */
+				mutex_exit(&cp->lxioctx_d_lock);
+				lx_io_cp_rele(cp);
+				kmem_free(out, sz);
+				return (set_errno(EINTR));
+			}
+
+			/*
+			 * Signalled that something was queued up. Check if
+			 * there are now enough or if we have to wait for more.
+			 */
+		}
+		ASSERT(cp->lxioctx_done_cnt >= min_nr || cp->lxioctx_shutdown);
+		mutex_exit(&cp->lxioctx_d_lock);
+	}
+
+	/*
+	 * For each done control block, move it into the Linux event we return.
+	 * As we're doing this, we also moving it from the done list to the
+	 * free list.
+	 */
+	for (i = 0; i < nr && !cp->lxioctx_shutdown; i++) {
+		lx_io_event_t *lxe;
+		lx_io_elem_t *ep;
+
+		lxe = &out[i];
+
+		mutex_enter(&cp->lxioctx_d_lock);
+		if (cp->lxioctx_done_cnt == 0) {
+			mutex_exit(&cp->lxioctx_d_lock);
+			break;
+		}
+
+		ep = list_remove_head(&cp->lxioctx_done);
+		cp->lxioctx_done_cnt--;
+		mutex_exit(&cp->lxioctx_d_lock);
+
+		lxe->lxioe_data = ep->lxioelem_data;
+		lxe->lxioe_object = (uint64_t)(uintptr_t)ep->lxioelem_cbp;
+		lxe->lxioe_res = ep->lxioelem_res;
+		lxe->lxioe_res2 = 0;
+
+		/* Put it back on the free list */
+		ep->lxioelem_cbp = NULL;
+		ep->lxioelem_data = 0;
+		ep->lxioelem_res = 0;
+		mutex_enter(&cp->lxioctx_f_lock);
+		list_insert_head(&cp->lxioctx_free, ep);
+		cp->lxioctx_free_cnt++;
+		mutex_exit(&cp->lxioctx_f_lock);
+	}
+
+	lx_io_cp_rele(cp);
+
+	/*
+	 * Note: Linux seems to push the events back into the queue if the
+	 * copyout fails. Since this error is due to an application bug, it
+	 * seems unlikely we need to worry about it, but we can revisit this
+	 * if it is ever seen to be an issue.
+	 */
+	if (i > 0 && copyout(out, events, i * sizeof (lx_io_event_t)) != 0) {
+		kmem_free(out, sz);
+		return (set_errno(EFAULT));
+	}
+
+	kmem_free(out, sz);
+	return (i);
+}
+
+/*
+ * Linux never returns 0 from io_cancel. A successful cancellation will return
+ * EINPROGRESS and the result for the cancelled operation will be available via
+ * a normal io_getevents call. The third parameter (the "result") to this
+ * syscall is unused. Note that currently the Linux man pages are incorrect
+ * about this behavior. Also note that in Linux, only the USB driver currently
+ * support aio cancellation, so callers will almost always get EINVAL when they
+ * attempt to cancel an IO on Linux.
+ */
+/*ARGSUSED*/
+long
+lx_io_cancel(lx_aio_context_t cid, lx_iocb_t *iocbp, lx_io_event_t *result)
+{
+	lx_io_ctx_t *cp;
+	lx_io_elem_t *ep;
+	uint32_t buf;
+
+	/*
+	 * The Linux io_cancel copies in a field from the iocb in order to
+	 * locate the matching kernel-internal structure.  To appease the LTP
+	 * test case which exercises this, a similar copy is performed here.
+	 */
+	if (copyin(iocbp, &buf, sizeof (buf)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	if ((cp = lx_io_cp_hold(cid)) == NULL)
+		return (set_errno(EINVAL));
+
+	/* Try to pull the CB off the pending list */
+	mutex_enter(&cp->lxioctx_p_lock);
+	ep = list_head(&cp->lxioctx_pending);
+	while (ep != NULL) {
+		if (ep->lxioelem_cbp == iocbp) {
+			list_remove(&cp->lxioctx_pending, ep);
+			break;
+		}
+		ep = list_next(&cp->lxioctx_pending, ep);
+	}
+	mutex_exit(&cp->lxioctx_p_lock);
+
+	if (ep == NULL) {
+		lx_io_cp_rele(cp);
+		return (set_errno(EAGAIN));
+	}
+
+	set_active_fd(-1);	 /* See comment in lx_io_cp_rele */
+	set_active_fd(ep->lxioelem_fd);
+	releasef(ep->lxioelem_fd);
+	ep->lxioelem_fd = 0;
+	ep->lxioelem_fp = NULL;
+	ep->lxioelem_res = -lx_errno(EINTR, EINTR);
+
+	lx_io_finish_op(cp, ep, B_FALSE);
+	lx_io_cp_rele(cp);
+
+	return (set_errno(EINPROGRESS));
+}
+
+long
+lx_io_destroy(lx_aio_context_t cid)
+{
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+	lx_io_ctx_t *cp;
+	int cnt = 0;
+
+	if ((cp = lx_io_cp_hold(cid)) == NULL)
+		return (set_errno(EINVAL));
+
+	mutex_enter(&lxpd->l_io_ctx_lock);
+	cp->lxioctx_shutdown = B_TRUE;
+
+	/*
+	 * Wait for the worker threads and any blocked io_getevents threads to
+	 * exit. We have a hold and our rele will cleanup after all other holds
+	 * are released.
+	 */
+	ASSERT(cp->lxioctx_in_use >= 1);
+	while (cp->lxioctx_in_use > 1) {
+		DTRACE_PROBE2(lx__io__destroy, lx_io_ctx_t *, cp, int, cnt);
+		cv_broadcast(&cp->lxioctx_pending_cv);
+		cv_broadcast(&cp->lxioctx_done_cv);
+
+		/*
+		 * Each worker has a hold. We want to let those threads finish
+		 * up and exit.
+		 */
+		cv_wait(&lxpd->l_io_destroy_cv, &lxpd->l_io_ctx_lock);
+		cnt++;
+	}
+
+	mutex_exit(&lxpd->l_io_ctx_lock);
+	lx_io_cp_rele(cp);
+	return (0);
+}
+
+/*
+ * Called at proc fork to clear contexts from child. We don't bother to unmap
+ * l_io_ctxpage since the vast majority of processes will immediately exec and
+ * cause an unmapping. If the child does not exec, there will simply be a
+ * single shared page in its address space, so no additional anonymous memory
+ * is consumed.
+ */
+void
+lx_io_clear(lx_proc_data_t *cpd)
+{
+	cpd->l_io_ctxs = NULL;
+	cpd->l_io_ctx_cnt = 0;
+	cpd->l_io_ctxpage = NULL;
+}
+
+/*
+ * Called via lx_proc_exit to cleanup any existing io context array. All
+ * worker threads should have already exited by this point, so all contexts
+ * should already be deleted.
+ */
+void
+lx_io_cleanup(proc_t *p)
+{
+	lx_proc_data_t *lxpd;
+	int i;
+
+	mutex_enter(&p->p_lock);
+	VERIFY((lxpd = ptolxproc(p)) != NULL);
+	mutex_exit(&p->p_lock);
+
+	mutex_enter(&lxpd->l_io_ctx_lock);
+	if (lxpd->l_io_ctxs == NULL) {
+		ASSERT(lxpd->l_io_ctx_cnt == 0);
+		mutex_exit(&lxpd->l_io_ctx_lock);
+		return;
+	}
+
+	ASSERT(lxpd->l_io_ctx_cnt > 0);
+	for (i = 0; i < lxpd->l_io_ctx_cnt; i++) {
+		ASSERT(lxpd->l_io_ctxs[i] == NULL);
+	}
+
+	kmem_free(lxpd->l_io_ctxs, lxpd->l_io_ctx_cnt * sizeof (lx_io_ctx_t *));
+	lxpd->l_io_ctxs = NULL;
+	lxpd->l_io_ctx_cnt = 0;
+	mutex_exit(&lxpd->l_io_ctx_lock);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_brk.c b/usr/src/uts/common/brand/lx/syscall/lx_brk.c
new file mode 100644
index 0000000000..d46e442759
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_brk.c
@@ -0,0 +1,55 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/errno.h>
+
+/* From usr/src/uts/common/os/grow.c */
+extern intptr_t brk(caddr_t);
+
+long
+lx_brk(caddr_t nva)
+{
+	if (nva != 0) {
+		(void) brk(nva);
+
+		/*
+		 * Despite claims to the contrary in the man page, when Linux
+		 * brk(2) fails, errno is left unchanged.
+		 */
+		ttolwp(curthread)->lwp_errno = 0;
+	}
+
+	/*
+	 * When ASLR was integrated, our internal brk(2) was updated to emit
+	 * the current brk when arg0 == 0.  Using the function yields an
+	 * equivalent result to manually calculating the brk, but also
+	 * serializes with changes to the process AS.
+	 */
+	return ((long)brk((caddr_t)0));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_chmod.c b/usr/src/uts/common/brand/lx/syscall/lx_chmod.c
new file mode 100644
index 0000000000..7783b97cb0
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_chmod.c
@@ -0,0 +1,107 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/fcntl.h>
+#include <sys/thread.h>
+#include <sys/klwp.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_fcntl.h>
+
+long
+lx_vn_chmod(vnode_t *vp, int mode)
+{
+	vattr_t vattr;
+
+	vattr.va_mode = mode & MODEMASK;
+	vattr.va_mask = AT_MODE;
+
+	if (vn_is_readonly(vp)) {
+		return (EROFS);
+	}
+	return (VOP_SETATTR(vp, &vattr, 0, CRED(), NULL));
+}
+
+static long
+lx_fchmodat_wrapper(int fd, char *path, int mode)
+{
+	long error;
+	vnode_t *vp;
+
+	if ((error = lx_vp_at(fd, path, &vp, 0)) != 0) {
+		lx_proc_data_t *pd = ttolxproc(curthread);
+
+		/*
+		 * If the process is in "install mode", return success
+		 * if the operation failed due to an absent file.
+		 */
+		if (error == ENOENT &&
+		    (pd->l_flags & LX_PROC_INSTALL_MODE)) {
+			return (0);
+		}
+		return (set_errno(error));
+	}
+
+	error = lx_vn_chmod(vp, mode);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_fchmodat(int fd, char *path, int mode)
+{
+	return (lx_fchmodat_wrapper(fd, path, mode));
+}
+
+long
+lx_fchmod(int fd, int mode)
+{
+	file_t *fp;
+	vnode_t *vp;
+	long error;
+
+	/*
+	 * In order to do proper O_PATH handling, lx_fchmod cannot leverage
+	 * lx_fchmodat with a NULL path since the desired behavior differs.
+	 */
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+	if (LX_IS_O_PATH(fp)) {
+		releasef(fd);
+		return (set_errno(EBADF));
+	}
+	vp = fp->f_vnode;
+	VN_HOLD(vp);
+	releasef(fd);
+
+	error = lx_vn_chmod(vp, mode);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_chmod(char *path, int mode)
+{
+	return (lx_fchmodat_wrapper(LX_AT_FDCWD, path, mode));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_chown.c b/usr/src/uts/common/brand/lx/syscall/lx_chown.c
new file mode 100644
index 0000000000..830fba0a73
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_chown.c
@@ -0,0 +1,180 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/fcntl.h>
+#include <sys/zone.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_fcntl.h>
+#include <sys/lx_types.h>
+
+long
+lx_vn_chown(vnode_t *vp, uid_t uid, gid_t gid)
+{
+	vattr_t vattr;
+	zone_t *zone = crgetzone(CRED());
+
+	if ((uid != (uid_t)-1 && !VALID_UID(uid, zone)) ||
+	    (gid != (gid_t)-1 && !VALID_GID(gid, zone))) {
+		return (EINVAL);
+	}
+	vattr.va_uid = uid;
+	vattr.va_gid = gid;
+	vattr.va_mask = 0;
+	if (vattr.va_uid != -1)
+		vattr.va_mask |= AT_UID;
+	if (vattr.va_gid != -1)
+		vattr.va_mask |= AT_GID;
+
+	if (vn_is_readonly(vp)) {
+		return (EROFS);
+	}
+	return (VOP_SETATTR(vp, &vattr, 0, CRED(), NULL));
+}
+
+long
+lx_fchownat_wrapper(int fd, char *path, uid_t uid, gid_t gid, int native_flag)
+{
+	long error;
+	vnode_t *vp;
+
+	if ((error = lx_vp_at(fd, path, &vp, native_flag)) != 0) {
+		lx_proc_data_t *pd = ttolxproc(curthread);
+
+		/*
+		 * If the process is in "install mode", return success
+		 * if the operation failed due to an absent file.
+		 */
+		if (error == ENOENT &&
+		    (pd->l_flags & LX_PROC_INSTALL_MODE)) {
+			return (0);
+		}
+		return (set_errno(error));
+	}
+
+	error = lx_vn_chown(vp, uid, gid);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_fchown_wrapper(int fd, uid_t uid, gid_t gid)
+{
+	file_t *fp;
+	vnode_t *vp;
+	long error;
+
+	/*
+	 * In order to do proper O_PATH handling, lx_fchown cannot leverage
+	 * lx_fchownat with a NULL path since the desired behavior differs.
+	 */
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+	if (LX_IS_O_PATH(fp)) {
+		releasef(fd);
+		return (set_errno(EBADF));
+	}
+	vp = fp->f_vnode;
+	VN_HOLD(vp);
+	releasef(fd);
+
+	error = lx_vn_chown(vp, uid, gid);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_fchownat(int fd, char *path, uid_t uid, gid_t gid, int flag)
+{
+	int native_flag = 0;
+
+	if (flag & LX_AT_EMPTY_PATH) {
+		char c;
+
+		/*
+		 * According to fchownat(2), when AT_EMPTY_PATH is set: "if
+		 * path is an empty string, operate on the file referred to by
+		 * fd".  We pass NULL in place of the empty string, which
+		 * causes fchownat() to operate on the fd we passed without an
+		 * additional lookup.
+		 */
+		if (copyin(path, &c, sizeof (c)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		if (c == '\0') {
+			path = NULL;
+		}
+
+		flag &= ~LX_AT_EMPTY_PATH;
+	}
+	if (flag & LX_AT_SYMLINK_NOFOLLOW) {
+		flag &= ~LX_AT_SYMLINK_NOFOLLOW;
+		native_flag |= AT_SYMLINK_NOFOLLOW;
+	}
+	if (flag != 0) {
+		return (set_errno(EINVAL));
+	}
+
+	return (lx_fchownat_wrapper(fd, path, uid, gid, native_flag));
+}
+
+long
+lx_fchown(int fd, uid_t uid, gid_t gid)
+{
+	return (lx_fchown_wrapper(fd, uid, gid));
+}
+
+long
+lx_lchown(char *path, uid_t uid, gid_t gid)
+{
+	return (lx_fchownat_wrapper(AT_FDCWD, path, uid, gid,
+	    AT_SYMLINK_NOFOLLOW));
+}
+
+long
+lx_chown(char *path, uid_t uid, gid_t gid)
+{
+	return (lx_fchownat_wrapper(AT_FDCWD, path, uid, gid, 0));
+}
+
+long
+lx_fchown16(int fd, lx_uid16_t uid, lx_gid16_t gid)
+{
+	return (lx_fchown_wrapper(fd, LX_UID16_TO_UID32(uid),
+	    LX_GID16_TO_GID32(gid)));
+}
+
+long
+lx_lchown16(char *path, uid_t uid, gid_t gid)
+{
+	return (lx_fchownat_wrapper(AT_FDCWD, path, LX_UID16_TO_UID32(uid),
+	    LX_GID16_TO_GID32(gid), AT_SYMLINK_NOFOLLOW));
+}
+
+long
+lx_chown16(char *path, lx_uid16_t uid, lx_gid16_t gid)
+{
+	return (lx_fchownat_wrapper(AT_FDCWD, path, LX_UID16_TO_UID32(uid),
+	    LX_GID16_TO_GID32(gid), 0));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_clone.c b/usr/src/uts/common/brand/lx/syscall/lx_clone.c
new file mode 100644
index 0000000000..4e00e90b1a
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_clone.c
@@ -0,0 +1,513 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * [This comment omits the 'LX_' prefix on the clone flag names.]
+ *
+ * The vast majority of clone calls result in the creation of a new process or
+ * a new thread. Both of these map easily from Linux to our native code. For
+ * these calls, the user-level brand library uses a brand call to hook into the
+ * lx_helper_clone function for the required in-kernel support.
+ *
+ * A fork will typically provide these clone flags:
+ *    CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID
+ *
+ * A new thread will use our SHARED_AS macro which has the flags:
+ *     CLONE_FILES | CLONE_FS | CLONE_SIGHAND | CLONE_THREAD |  CLONE_VM
+ *
+ * In rare cases an application will attempt to use a subset of the SHARED_AS
+ * flags in order to implement some sharing between two processes without using
+ * a true thread. Because we do not have native support for this concept, the
+ * lx brand implements the notion of a 'clone-group'. This is a set of
+ * processes which share a subset of the allowed SHARED_AS flags. The lx brand
+ * syscalls implement the appropriate sharing for each flag. A clone-group is
+ * only instantiated in the rare case that a subset of the SHARED_AS flags are
+ * used with clone.
+ *
+ * The following set of flags could theoretically be supported, although most
+ * are not implemented at this time. The user-level brand library will validate
+ * that a supported subset of the flags are being used, or error if not. We
+ * also re-validate in the kernel.
+ *
+ * CLONE_FILES:	share the file descriptor table
+ * CLONE_FS:	share the filesystem information (root of the filesystem, the
+ *		CWD, and the umask)
+ * CLONE_SIGHAND: share the table of signal handlers
+ * CLONE_THREAD: share the thread group
+ * CLONE_VM:	share the address space
+ *
+ * At this time, only those flags defined in CLONE_GRP_SUBSET (CLONE_FS) are
+ * implemented.
+ *
+ * When a clone-group is in use, the lx_proc_data_t`l_clone_grps array will
+ * hold groups of processes sharing the attributes relevant to the clone flag.
+ * Each supported flag can have an associated group list in the array.
+ *
+ * On the first clone, a new lx_clone_grp_t struct will be created. This struct
+ * holds a pointer to each process in the group. A reference to that group is
+ * held in the appropriate slot in l_clone_grps. The struct is created for
+ * the parent process by lx_clone_grp_create() and then the child process will
+ * associate itself with the group(s) using lx_clone_grp_enter().
+ *
+ * Each syscall acting upon attributes relevant to a clone-group must include
+ * logic to do so properly. The syscalls will use lx_clone_grp_member() to
+ * determine if clone-group handling is required, and use lx_clone_grp_walk()
+ * to walk the list of processes in the group and apply the provided callback
+ * to each process.
+ *
+ * The following example illustrates how a common clone group would be used,
+ * as processes clone with the same set of CLONE_* flags.
+ *	A clones B with CLONE_FS
+ *	B clones C with CLONE_FS
+ * When A clones B, a new clone group is created and saved in the LX_CLGRP_FS
+ * slot in the l_clone_grps array on both A and B. When B clones, since a group
+ * already exists, C is added to the group and the group is saved in the
+ * LX_CLGRP_FS slot on C.
+ *
+ * The following example illustrates how two common clone groups would be used,
+ * as processes clone with the same set of CLONE_* flags.
+ *	A clones B with CLONE_FS|CLONE_THREAD
+ * A new clone group is created and saved in the LX_CLGRP_FS slot in the
+ * l_clone_grps array on both A and B. A second clone group is created and
+ * saved in the LX_CLGRP_THREAD slot on both A and B (note that LX_CLGRP_THREAD
+ * is not implemented at this time).
+ *
+ * The following example illustrates how different clone groups would be used,
+ * as processes clone with different sets of CLONE_* flags.
+ *	A clones B with CLONE_FS
+ *	B clones C with CLONE_THREAD
+ *	C clones D with CLONE_FS
+ * In this example, only A&B and C&D should share their FS information. B&C
+ * have to be in two clone groups. When A clones, a new clone group is created
+ * and saved in the LX_CLGRP_FS slot in the l_clone_grps array on both A and B.
+ * When B clones, a new clone group is created and saved in the LX_CLGRP_THREAD
+ * slot on both B and C (note that LX_CLGRP_THREAD is not implemented at this
+ * time). When C clones, a new clone group is created and saved in the
+ * LX_CLGRP_FS slot on both C and D.
+ *
+ * When a process exits, it removes itself from any groups to which it belongs.
+ * When the last process exits a group, it is cleaned up.
+ *
+ * If clone-groups were commonly used, this implementation would be inefficient
+ * and unwieldy, but since they are so rare a straightforward list-based
+ * approach is adequate.
+ *
+ * During group creation, the l_clone_grp_lock is first taken to ensure only
+ * one group is created, otherwise, only the group's lx_clgrp_lock protects the
+ * list.
+ *
+ * Note: Despite the locking, there is still a subtle race that can occur in
+ * this code. This occurs if a process has two threads and one of them is about
+ * to execute a clone-group aware syscall (e.g. chdir), while the other thread
+ * is forking to create a new clone-group. In theory the child process could be
+ * created, but not yet in the group. The syscall in the first thread could
+ * thus miss the new process. For example, the first thread might chdir the
+ * parent, but since the child process was alrady created, but not yet in the
+ * clone-group, it would not be chdir-ed.
+ */
+
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_ldt.h>
+#include <sys/lx_misc.h>
+#include <lx_signum.h>
+#include <lx_syscall.h>
+#include <sys/x86_archext.h>
+#include <sys/controlregs.h>
+
+/*
+ * We currently only support a single clone-group (CLONE_FS) but the design
+ * allows for future expansion by expanding the lx_proc_data+t`l_clone_grps
+ * array.
+ */
+static int
+lx_clone_flag2grp(uint_t flag)
+{
+	if (flag & LX_CLONE_FS)
+		return (LX_CLGRP_FS);
+
+	return (-1);
+}
+
+/*
+ * Note: this function has the side effect of clearing the flags.
+ */
+static int
+lx_clone_flags_iter(uint_t *fp)
+{
+	if (*fp & LX_CLONE_FS) {
+		*fp &= ~LX_CLONE_FS;
+		return (LX_CLGRP_FS);
+	}
+
+	return (-1);
+}
+
+/*
+ * Setup the current process in the proper clone-group(s) and record the
+ * clone-group flags on the lwp so that we can join the child process to the
+ * group during lx_forklwp().
+ */
+void
+lx_clone_grp_create(uint_t flags)
+{
+	int offset;
+	lx_proc_data_t *plproc = ttolxproc(curthread);
+	lx_lwp_data_t *ldp = (lx_lwp_data_t *)ttolwp(curthread)->lwp_brand;
+	lx_clone_grp_t **cgps;
+	lx_clone_grp_t *cgp;
+	lx_clone_grp_member_t *mp;
+
+	if (!LX_IS_CLONE_GRP(flags))
+		return;
+
+	ldp->br_clone_grp_flags = flags & LX_CLONE_GRP_SUBSET;
+
+	cgps = plproc->l_clone_grps;
+	/*
+	 * We take the top-level mutex during create to ensure we only create
+	 * one group per flag.
+	 */
+	mutex_enter(&plproc->l_clone_grp_lock);
+	while ((offset = lx_clone_flags_iter(&flags)) != -1) {
+		cgp = cgps[offset];
+
+		/*
+		 * If we already havae a clone-group list for this flag then
+		 * nothing to do.
+		 */
+		if (cgp != NULL)
+			continue;
+
+		/*
+		 * Create a new clone-group. If it ever becomes an issue, we
+		 * could preallocate this memory before taking
+		 * l_clone_grp_lock.
+		 */
+		cgp = kmem_alloc(sizeof (lx_clone_grp_t), KM_SLEEP);
+		mutex_init(&cgp->lx_clgrp_lock, NULL, MUTEX_DEFAULT, NULL);
+		cgp->lx_clgrp_cnt = 1;
+		list_create(&cgp->lx_clgrp_members,
+		    sizeof (lx_clone_grp_member_t),
+		    offsetof(lx_clone_grp_member_t, lx_clgrpm_link));
+
+		mp = kmem_zalloc(sizeof (lx_clone_grp_member_t), KM_SLEEP);
+		mp->lx_clgrpm_pp = curproc;
+		list_insert_tail(&cgp->lx_clgrp_members, mp);
+
+		/* Attach group to our proc */
+		plproc->l_clone_grps[offset] = cgp;
+	}
+	mutex_exit(&plproc->l_clone_grp_lock);
+}
+
+/*
+ * Add the child process to the proper parent clone-group(s).
+ *
+ * Called from lx_forklwp, thus there is no need to have any locking for the
+ * destination proc. This is always run in the thread context of the source
+ * thread, and the destination thread is always newly created and not referred
+ * to from anywhere else. The source process should have already created the
+ * clone group(s) that we need to place the child into via lx_clone_grp_create.
+ */
+void
+lx_clone_grp_enter(uint_t flags, proc_t *srcp, proc_t *dstp)
+{
+	int offset;
+	lx_proc_data_t *plproc = ptolxproc(srcp);
+	lx_proc_data_t *clproc = ptolxproc(dstp);
+	lx_clone_grp_t **cgps;
+	lx_clone_grp_t *cgp;
+	lx_clone_grp_member_t *mp;
+
+	cgps = plproc->l_clone_grps;
+	while ((offset = lx_clone_flags_iter(&flags)) != -1) {
+		cgp = cgps[offset];
+
+		/*
+		 * Parent should already have a clone-group list for this flag.
+		 * The child joins that group.
+		 */
+		VERIFY(cgp != NULL);
+
+		mp = kmem_zalloc(sizeof (lx_clone_grp_member_t), KM_SLEEP);
+		mp->lx_clgrpm_pp = dstp;
+
+		mutex_enter(&cgp->lx_clgrp_lock);
+		list_insert_tail(&cgp->lx_clgrp_members, mp);
+		cgp->lx_clgrp_cnt++;
+		clproc->l_clone_grps[offset] = cgp;
+		mutex_exit(&cgp->lx_clgrp_lock);
+	}
+}
+
+/*
+ * The process is exiting or we're exec-ing a native app. In the unlikely event
+ * it is in a clone-group, remove it from the group and perform any necessary
+ * cleanup. Normally we're called from lx_proc_exit(), so we know we're the
+ * last lwp in the process, but we can also be called from lx_clearbrand() when
+ * exec-ing a native application. In this case we know the lwp(s) are stopped
+ * (It is possible to have multiple lwps if we branded the process but the
+ * exec failed. Those lwps were just branded as part of the exec, and will
+ * be de-branded).
+ */
+void
+lx_clone_grp_exit(proc_t *p, boolean_t lwps_ok)
+{
+	int i;
+	lx_proc_data_t *plproc = ptolxproc(p);
+	lx_clone_grp_t **cgps;
+
+	ASSERT(!MUTEX_HELD(&p->p_lock));
+	ASSERT(plproc != NULL);
+
+	if (!lwps_ok)
+		VERIFY(p->p_lwpcnt <= 1);
+
+	cgps = plproc->l_clone_grps;
+	for (i = 0; i < LX_CLGRP_MAX; i++) {
+		lx_clone_grp_t *cgp;
+		lx_clone_grp_member_t *mp;
+		boolean_t found;
+
+		cgp = cgps[i];
+		if (cgp == NULL)
+			continue;
+
+		/*
+		 * The rare case when this process belongs to a clone-group.
+		 */
+
+		mutex_enter(&cgp->lx_clgrp_lock);
+
+		/* First remove ourselves from the group. */
+		found = B_FALSE;
+		mp = list_head(&cgp->lx_clgrp_members);
+		while (mp != NULL) {
+			if (mp->lx_clgrpm_pp == p) {
+				found = B_TRUE;
+				list_remove(&cgp->lx_clgrp_members, mp);
+				kmem_free(mp, sizeof (lx_clone_grp_member_t));
+				ASSERT(cgp->lx_clgrp_cnt > 0);
+				cgp->lx_clgrp_cnt--;
+				plproc->l_clone_grps[i] = NULL;
+				break;
+			}
+			mp = list_next(&cgp->lx_clgrp_members, mp);
+		}
+		VERIFY(found);
+
+		if (cgp->lx_clgrp_cnt > 0) {
+			mutex_exit(&cgp->lx_clgrp_lock);
+			continue;
+		}
+
+		/*
+		 * cgp->lx_clgrp_cnt == 0
+		 *
+		 * We're the sole remaining member; finish cleanup now.
+		 */
+		ASSERT(plproc->l_clone_grps[i] == NULL);
+		mutex_exit(&cgp->lx_clgrp_lock);
+
+		/* Delete the group since there are no more references to it. */
+		VERIFY(list_is_empty(&cgp->lx_clgrp_members));
+
+		list_destroy(&cgp->lx_clgrp_members);
+		mutex_destroy(&cgp->lx_clgrp_lock);
+		kmem_free(cgp, sizeof (lx_clone_grp_t));
+	}
+}
+
+/*
+ * Return true in the rare case that the process is a member of a clone group
+ * with the specific flag set. Clone groups are only added to the array
+ * atomically until this process exits, so we don't need to take
+ * l_clone_grp_lock.
+ */
+boolean_t
+lx_clone_grp_member(lx_proc_data_t *dp, uint_t flag)
+{
+	int offset;
+
+	if ((offset = lx_clone_flag2grp(flag)) == -1)
+		return (B_FALSE);
+
+	if (dp->l_clone_grps[offset] != NULL) {
+		return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * Walk all of the processes in the clone-group list and apply the callback
+ * to each. Because we're holding the group list lock (lx_clgrp_lock) none of
+ * the processes can exit, but that is the only locking guarantee made by this
+ * function itself.
+ */
+int
+lx_clone_grp_walk(lx_proc_data_t *dp, uint_t flag, int (*cb)(proc_t *, void *),
+    void *arg)
+{
+	int offset;
+	lx_clone_grp_t *cgp;
+	lx_clone_grp_member_t *mp;
+	int res, rv = 0;
+
+
+	ASSERT(dp != NULL);
+	/* We should not be called unless we belong to a group */
+	VERIFY((offset = lx_clone_flag2grp(flag)) != -1);
+	VERIFY(dp->l_clone_grps[offset] != NULL);
+
+	cgp = dp->l_clone_grps[offset];
+	mutex_enter(&cgp->lx_clgrp_lock);
+
+	mp = list_head(&cgp->lx_clgrp_members);
+	while (mp != NULL) {
+		res = cb(mp->lx_clgrpm_pp, arg);
+		/* return the first error we see, but try all procs */
+		if (res != 0 && rv == 0)
+			rv = res;
+		mp = list_next(&cgp->lx_clgrp_members, mp);
+	}
+
+	mutex_exit(&cgp->lx_clgrp_lock);
+
+	return (rv);
+}
+
+
+/*
+ * Our lwp has already been created at this point, so this routine is
+ * responsible for setting up all the state needed to track this as a
+ * linux cloned thread.
+ */
+/* ARGSUSED */
+int
+lx_helper_clone(int64_t *rval, int flags, void *ptidp, void *tls, void *ctidp)
+{
+	struct lx_lwp_data *lwpd = ttolxlwp(curthread);
+	struct lx_proc_data *lproc = ttolxproc(curthread);
+	struct ldt_info info;
+	struct user_desc descr;
+	int tls_index;
+	int entry = -1;
+	int signo;
+
+	signo = flags & LX_CSIGNAL;
+	if (signo < 0 || signo > LX_NSIG)
+		return (set_errno(EINVAL));
+
+	if (!(flags & LX_CLONE_THREAD)) {
+		lproc->l_signal = signo;
+	} else {
+		if (flags & LX_CLONE_SETTLS) {
+			if (get_udatamodel() == DATAMODEL_ILP32) {
+				if (copyin((caddr_t)tls, &info, sizeof (info)))
+					return (set_errno(EFAULT));
+
+				if (LDT_INFO_EMPTY(&info))
+					return (set_errno(EINVAL));
+
+				entry = info.entry_number;
+				if (entry < GDT_TLSMIN || entry > GDT_TLSMAX)
+					return (set_errno(EINVAL));
+
+				tls_index = entry - GDT_TLSMIN;
+
+				/*
+				 * Convert the user-space structure into a real
+				 * x86 descriptor and copy it into this LWP's
+				 * TLS array.  We also load it into the GDT.
+				 */
+				LDT_INFO_TO_DESC(&info, &descr);
+				bcopy(&descr, &lwpd->br_tls[tls_index],
+				    sizeof (descr));
+				lx_set_gdt(entry, &lwpd->br_tls[tls_index]);
+			} else {
+				/*
+				 * Set the Linux %fsbase for this LWP.  We will
+				 * restore it the next time we return to Linux
+				 * via setcontext()/lx_restorecontext().
+				 */
+				lwpd->br_lx_fsbase = (uintptr_t)tls;
+			}
+		}
+
+		lwpd->br_clear_ctidp =
+		    (flags & LX_CLONE_CHILD_CLEARTID) ?  ctidp : NULL;
+
+		if (signo && ! (flags & LX_CLONE_DETACH))
+			lwpd->br_signal = signo;
+		else
+			lwpd->br_signal = 0;
+
+		if (flags & LX_CLONE_THREAD)
+			lwpd->br_tgid = curthread->t_procp->p_pid;
+
+		if (flags & LX_CLONE_PARENT)
+			lwpd->br_ppid = 0;
+
+		if ((flags & LX_CLONE_CHILD_SETTID) && (ctidp != NULL) &&
+		    (suword32(ctidp, lwpd->br_pid) != 0)) {
+			if (entry >= 0)
+				lx_clear_gdt(entry);
+			return (set_errno(EFAULT));
+		}
+		if ((flags & LX_CLONE_PARENT_SETTID) && (ptidp != NULL) &&
+		    (suword32(ptidp, lwpd->br_pid) != 0)) {
+			if (entry >= 0)
+				lx_clear_gdt(entry);
+			return (set_errno(EFAULT));
+		}
+	}
+
+	*rval = lwpd->br_pid;
+	return (0);
+}
+
+long
+lx_set_tid_address(int *tidp)
+{
+	struct lx_lwp_data *lwpd = ttolxlwp(curthread);
+	long rv;
+
+	lwpd->br_clear_ctidp = tidp;
+
+	if (curproc->p_pid == curproc->p_zone->zone_proc_initpid) {
+		rv = 1;
+	} else {
+		rv = lwpd->br_pid;
+	}
+
+	return (rv);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_close.c b/usr/src/uts/common/brand/lx/syscall/lx_close.c
new file mode 100644
index 0000000000..5d1a1605c1
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_close.c
@@ -0,0 +1,30 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/mutex.h>
+#include <sys/brand.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_syscalls.h>
+
+
+extern int close(int);
+
+long
+lx_close(int fdes)
+{
+	return (close(fdes));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_cpu.c b/usr/src/uts/common/brand/lx/syscall/lx_cpu.c
new file mode 100644
index 0000000000..b0a92394dc
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_cpu.c
@@ -0,0 +1,36 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/cpuvar.h>
+#include <sys/cmn_err.h>
+#include <sys/lx_impl.h>
+
+/*
+ * We support neither the second argument (NUMA node), nor the third (obsolete
+ * pre-2.6.24 caching functionality which was ultimately broken).
+ */
+/* ARGSUSED1 */
+long
+lx_getcpu(unsigned int *cpu, uintptr_t p2, uintptr_t p3)
+{
+	unsigned int curcpu = curthread->t_cpu->cpu_id;
+
+	if (copyout(&curcpu, cpu, sizeof (curcpu)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_dup.c b/usr/src/uts/common/brand/lx/syscall/lx_dup.c
new file mode 100644
index 0000000000..d0f513753c
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_dup.c
@@ -0,0 +1,53 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/filio.h>
+#include <sys/fcntl.h>
+#include <sys/stat.h>
+#include <sys/lx_fcntl.h>
+#include <sys/lx_misc.h>
+
+/* From usr/src/uts/common/syscall/fcntl.c */
+extern int fcntl(int, int, intptr_t);
+
+long
+lx_dup(int fd)
+{
+	return (fcntl(fd, F_DUPFD, 0));
+}
+
+long
+lx_dup2(int oldfd, int newfd)
+{
+	return (fcntl(oldfd, F_DUP2FD, newfd));
+}
+
+long
+lx_dup3(int oldfd, int newfd, int flags)
+{
+	int rc;
+
+	/* The only valid flag is O_CLOEXEC. */
+	if (flags & ~LX_O_CLOEXEC)
+		return (set_errno(EINVAL));
+
+	/* Only DUP2FD_CLOEXEC returns EINVAL on the same fd's */
+	if (oldfd == newfd)
+		return (set_errno(EINVAL));
+
+	rc = fcntl(oldfd, (flags == 0) ? F_DUP2FD : F_DUP2FD_CLOEXEC, newfd);
+	return (rc);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_epoll.c b/usr/src/uts/common/brand/lx/syscall/lx_epoll.c
new file mode 100644
index 0000000000..47688dad6a
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_epoll.c
@@ -0,0 +1,303 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/zone.h>
+#include <sys/brand.h>
+#include <sys/epoll.h>
+#include <sys/devpoll.h>
+#include <sys/fcntl.h>
+#include <sys/file.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/vnode.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+#include <sys/lx_signal.h>
+
+static major_t devpoll_major = 0;
+
+static boolean_t
+lx_epoll_isvalid(file_t *fp)
+{
+	vnode_t *vp = fp->f_vnode;
+
+	if (vp->v_type == VCHR && getmajor(vp->v_rdev) == devpoll_major)
+		return (B_TRUE);
+	return (B_FALSE);
+}
+
+long
+lx_epoll_create1(int flags)
+{
+	int err, fd, rv;
+	int fmode = FREAD | FWRITE;
+	boolean_t cloexec = B_FALSE;
+	vnode_t *vp = NULL;
+	file_t *fp = NULL;
+
+	if (flags & EPOLL_CLOEXEC) {
+		cloexec = B_TRUE;
+		flags &= ~EPOLL_CLOEXEC;
+	}
+	if (flags != 0) {
+		/* No other flags accepted at this time */
+		return (set_errno(EINVAL));
+	}
+
+	if (falloc((vnode_t *)NULL, fmode, &fp, &fd) != 0) {
+		err = EMFILE;
+		goto error;
+	}
+	if (ldi_vp_from_name("/devices/pseudo/poll@0:poll", &vp) != 0) {
+		err = ENOENT;
+		goto error;
+	}
+	if ((err = VOP_OPEN(&vp, fmode | FKLYR, CRED(), NULL)) != 0) {
+		goto error;
+	}
+	err = VOP_IOCTL(vp, DP_EPOLLCOMPAT, 0, fmode, CRED(), &rv, NULL);
+	if (err != 0) {
+		(void) VOP_CLOSE(vp, fmode, 0, 0, CRED(), NULL);
+		goto error;
+	}
+
+	devpoll_major = getmajor(vp->v_rdev);
+
+	fp->f_vnode = vp;
+	mutex_exit(&fp->f_tlock);
+	setf(fd, fp);
+	if (cloexec) {
+		f_setfd(fd, FD_CLOEXEC);
+	}
+	return (fd);
+
+error:
+	if (fp != NULL) {
+		setf(fd, NULL);
+		unfalloc(fp);
+	}
+	if (vp != NULL) {
+		VN_RELE(vp);
+	}
+	return (set_errno(err));
+}
+
+long
+lx_epoll_create(int size)
+{
+	if (size <= 0) {
+		return (set_errno(EINVAL));
+	}
+
+	return (lx_epoll_create1(0));
+}
+
+
+/* Match values from libc implementation */
+#define	EPOLLIGNORED 	(EPOLLMSG | EPOLLWAKEUP)
+#define	EPOLLSWIZZLED	\
+	(EPOLLRDHUP | EPOLLONESHOT | EPOLLET | EPOLLWRBAND | EPOLLWRNORM)
+#define	EPOLL_TIMEOUT_CLAMP(t)	(((t) < -1) ? -1 : (t))
+
+long
+lx_epoll_ctl(int fd, int op, int pfd, void *event)
+{
+	epoll_event_t epevent;
+	dvpoll_epollfd_t dpevent[2];
+	file_t *fp;
+	iovec_t aiov;
+	uio_t auio;
+	uint32_t events, ev = 0;
+	int error = 0, i = 0;
+
+	dpevent[i].dpep_pollfd.fd = pfd;
+	switch (op) {
+	case EPOLL_CTL_DEL:
+		dpevent[i].dpep_pollfd.events = POLLREMOVE;
+		break;
+
+	case EPOLL_CTL_MOD:
+		/*
+		 * In the modify case, we pass down two events:  one to
+		 * remove the event and another to add it back.
+		 */
+		dpevent[i++].dpep_pollfd.events = POLLREMOVE;
+		dpevent[i].dpep_pollfd.fd = pfd;
+		/* FALLTHROUGH */
+
+	case EPOLL_CTL_ADD:
+		if (copyin(event, &epevent, sizeof (epevent)) != 0)
+			return (set_errno(EFAULT));
+
+		/*
+		 * Mask off the events that we ignore, and then swizzle the
+		 * events for which our values differ from their epoll(7)
+		 * equivalents.
+		 */
+		events = epevent.events;
+		ev = events & ~(EPOLLIGNORED | EPOLLSWIZZLED);
+
+		if (events & EPOLLRDHUP)
+			ev |= POLLRDHUP;
+		if (events & EPOLLET)
+			ev |= POLLET;
+		if (events & EPOLLONESHOT)
+			ev |= POLLONESHOT;
+		if (events & EPOLLWRNORM)
+			ev |= POLLWRNORM;
+		if (events & EPOLLWRBAND)
+			ev |= POLLWRBAND;
+
+		dpevent[i].dpep_data = epevent.data.u64;
+		dpevent[i].dpep_pollfd.events = ev;
+		break;
+
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	} else if (!lx_epoll_isvalid(fp)) {
+		releasef(fd);
+		return (set_errno(EINVAL));
+	}
+
+	aiov.iov_base = (void *)dpevent;
+	aiov.iov_len = sizeof (dvpoll_epollfd_t) * (i + 1);
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_resid = aiov.iov_len;
+	auio.uio_segflg = UIO_SYSSPACE;
+	auio.uio_loffset = 0;
+	auio.uio_fmode = fp->f_flag;
+
+	error = VOP_WRITE(fp->f_vnode, &auio, 1, fp->f_cred, NULL);
+
+	releasef(fd);
+
+	switch (error) {
+	case 0:
+		return (0);
+
+	case EBADF:
+	case EEXIST:
+	case EINVAL:
+	case ENOENT:
+	case ENOMEM:
+	case ENOSPC:
+	case EPERM:
+		/*
+		 * Legal errors should pass straight through.
+		 */
+		return (set_errno(error));
+
+	case ELOOP:
+		/*
+		 * In the case of descriptor loops, /dev/poll emits a more
+		 * descriptive error than Linux epoll consumers would expect.
+		 */
+		return (set_errno(EINVAL));
+
+	default:
+		/*
+		 * While devpoll itself should not emit unexpected errors, it
+		 * is possible that a VOP_POLL handler might.  There is little
+		 * choice but to map these unexpected errors to something which
+		 * is valid for epoll_ctl.
+		 */
+		return (set_errno(ENOMEM));
+	}
+}
+
+long
+lx_epoll_wait(int fd, void *events, int maxevents, int timeout)
+{
+	struct dvpoll arg;
+	file_t *fp;
+	int rv = 0, error, flag;
+
+	if (maxevents <= 0) {
+		return (set_errno(EINVAL));
+	}
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	} else if (!lx_epoll_isvalid(fp)) {
+		releasef(fd);
+		return (set_errno(EINVAL));
+	}
+
+	arg.dp_nfds = maxevents;
+	arg.dp_timeout = EPOLL_TIMEOUT_CLAMP(timeout);
+	arg.dp_fds = (pollfd_t *)events;
+	flag = fp->f_flag | DATAMODEL_NATIVE | FKIOCTL;
+	error = VOP_IOCTL(fp->f_vnode, DP_POLL, (uintptr_t)&arg, flag,
+	    fp->f_cred, &rv, NULL);
+
+	releasef(fd);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (rv);
+}
+
+long
+lx_epoll_pwait(int fd, void *events, int maxevents, int timeout, void *sigmask)
+{
+	struct dvpoll arg;
+	file_t *fp;
+	int rv = 0, error, flag;
+	k_sigset_t ksig;
+
+	if (maxevents <= 0) {
+		return (set_errno(EINVAL));
+	}
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	} else if (!lx_epoll_isvalid(fp)) {
+		releasef(fd);
+		return (set_errno(EINVAL));
+	}
+	if (sigmask != NULL) {
+		lx_sigset_t lsig;
+
+		if (copyin(sigmask, &lsig, sizeof (lsig)) != 0) {
+			releasef(fd);
+			return (set_errno(EFAULT));
+		}
+		lx_ltos_sigset(&lsig, &ksig);
+		arg.dp_setp = (sigset_t *)&ksig;
+	} else {
+		arg.dp_setp = NULL;
+	}
+
+	arg.dp_nfds = maxevents;
+	arg.dp_timeout = EPOLL_TIMEOUT_CLAMP(timeout);
+	arg.dp_fds = (pollfd_t *)events;
+	flag = fp->f_flag | DATAMODEL_NATIVE | FKIOCTL;
+	error = VOP_IOCTL(fp->f_vnode, DP_PPOLL, (uintptr_t)&arg, flag,
+	    fp->f_cred, &rv, NULL);
+
+	releasef(fd);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (rv);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_eventfd.c b/usr/src/uts/common/brand/lx/syscall/lx_eventfd.c
new file mode 100644
index 0000000000..21205aa18a
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_eventfd.c
@@ -0,0 +1,126 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/fcntl.h>
+#include <sys/file.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/vnode.h>
+#include <sys/eventfd.h>
+
+static major_t eventfd_major = 0;
+
+/* io_submit uses this to validate control block eventfd descriptors */
+boolean_t
+lx_is_eventfd(file_t *fp)
+{
+	vnode_t *vp = fp->f_vnode;
+
+	if (vp->v_type == VCHR && getmajor(vp->v_rdev) == eventfd_major)
+		return (B_TRUE);
+	return (B_FALSE);
+}
+
+long
+lx_eventfd2(uint_t initval, int flags)
+{
+	int err, fd;
+	int fmode = FREAD | FWRITE;
+	vnode_t *vp = NULL;
+	file_t *fp = NULL;
+
+	if (flags & ~(EFD_NONBLOCK | EFD_CLOEXEC | EFD_SEMAPHORE))
+		return (set_errno(EINVAL));
+
+	if (flags & EFD_NONBLOCK)
+		fmode |= FNONBLOCK;
+
+	if (falloc((vnode_t *)NULL, fmode, &fp, &fd) != 0)
+		return (set_errno(EMFILE));
+
+	if (ldi_vp_from_name("/dev/eventfd", &vp) != 0) {
+		/*
+		 * If /dev/eventfd is not available then it is less jarring to
+		 * Linux programs to tell them that the system call is not
+		 * supported instead of reporting an error (ENOENT) they are
+		 * not expecting.
+		 */
+		err = ENOTSUP;
+		goto error;
+	}
+	if ((err = VOP_OPEN(&vp, fmode | FKLYR, CRED(), NULL)) != 0) {
+		VN_RELE(vp);
+		vp = NULL;
+		goto error;
+	}
+
+	if (flags & EFD_SEMAPHORE) {
+		int rv;
+
+		if ((err = VOP_IOCTL(vp, EVENTFDIOC_SEMAPHORE, 0, fmode, CRED(),
+		    &rv, NULL)) != 0)
+			goto error;
+	}
+
+	if (initval != 0) {
+		uint64_t val = initval;
+		struct uio auio;
+		struct iovec aiov;
+
+		/* write initial value */
+		aiov.iov_base = (caddr_t)&val;
+		aiov.iov_len = sizeof (val);
+		auio.uio_iov = &aiov;
+		auio.uio_iovcnt = 1;
+		auio.uio_loffset = 0;
+		auio.uio_offset = 0;
+		auio.uio_resid = sizeof (val);
+		auio.uio_segflg = UIO_SYSSPACE;
+		auio.uio_fmode = FWRITE;
+
+		if ((err = VOP_WRITE(vp, &auio, FWRITE, CRED(), NULL)) != 0)
+			goto error;
+	}
+
+	eventfd_major = getmajor(vp->v_rdev);
+
+	fp->f_vnode = vp;
+	mutex_exit(&fp->f_tlock);
+	setf(fd, fp);
+	if (flags & EFD_CLOEXEC) {
+		f_setfd(fd, FD_CLOEXEC);
+	}
+	return (fd);
+
+error:
+	if (fp != NULL) {
+		setf(fd, NULL);
+		unfalloc(fp);
+	}
+	if (vp != NULL) {
+		(void) VOP_CLOSE(vp, fmode, 0, 0, CRED(), NULL);
+		VN_RELE(vp);
+	}
+	return (set_errno(err));
+}
+
+long
+lx_eventfd(uint_t val)
+{
+	return (lx_eventfd2(val, 0));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_fadvise.c b/usr/src/uts/common/brand/lx/syscall/lx_fadvise.c
new file mode 100644
index 0000000000..61f9b936f2
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_fadvise.c
@@ -0,0 +1,103 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/fcntl.h>
+#include <sys/lx_misc.h>
+
+/*
+ * Based on illumos posix_fadvise which does nothing. The only difference is
+ * that on Linux an fd refering to a pipe or FIFO returns EINVAL. The Linux
+ * POSIX_FADV_* values are the same as the illumos values. See how the 32-bit
+ * glibc calls fadvise64; the offeset is a 64-bit value, but the length is not.
+ * fadvise64_64 passes both the offset and length as 64-bit values. The 64-bit
+ * fadvise64 caller always passes 64-bit values for the offset and length.
+ */
+
+/*
+ * This is the fadvise64 function used by 64-bit callers, and by 32-bit callers
+ * after they have adjusted their arguments.
+ */
+/* ARGSUSED */
+int
+lx_fadvise64(int fd, off64_t offset, off64_t len, int advice)
+{
+	file_t *fp;
+	boolean_t is_fifo;
+
+	switch (advice) {
+	case POSIX_FADV_NORMAL:
+	case POSIX_FADV_RANDOM:
+	case POSIX_FADV_SEQUENTIAL:
+	case POSIX_FADV_WILLNEED:
+	case POSIX_FADV_DONTNEED:
+	case POSIX_FADV_NOREUSE:
+		break;
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	if (len < 0)
+		return (set_errno(EINVAL));
+
+	if ((fp = getf(fd)) == NULL)
+		return (set_errno(EBADF));
+	is_fifo = (fp->f_vnode->v_type == VFIFO);
+	releasef(fd);
+
+	if (is_fifo)
+		return (set_errno(ESPIPE));
+
+	return (0);
+}
+
+/*
+ * This is the fadvise64 function used by 32-bit callers. Linux passes the
+ * 64-bit offset by concatenating consecutive arguments. We must perform the
+ * same conversion here.
+ */
+long
+lx_fadvise64_32(int fd, uint32_t off_lo, uint32_t off_hi, int32_t len,
+    int advice)
+{
+	off64_t offset;
+
+	offset = off_hi;
+	offset = offset << 32;
+	offset |= off_lo;
+
+	return (lx_fadvise64(fd, offset, (off64_t)len, advice));
+}
+
+/*
+ * This function is only used by 32-bit callers. Linux passes the 64-bit offset
+ * and length by concatenating consecutive arguments. We must perform the same
+ * conversion here.
+ */
+long
+lx_fadvise64_64(int fd, uint32_t off_lo, uint32_t off_hi, uint32_t len_lo,
+    uint32_t len_hi, int advice)
+{
+	off64_t offset;
+	off64_t len;
+
+	offset = off_hi;
+	offset = offset << 32;
+	offset |= off_lo;
+	len = len_hi;
+	len = len << 32;
+	len |= len_lo;
+
+	return (lx_fadvise64(fd, offset, len, advice));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_fallocate.c b/usr/src/uts/common/brand/lx/syscall/lx_fallocate.c
new file mode 100644
index 0000000000..338e4399fe
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_fallocate.c
@@ -0,0 +1,251 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/zone.h>
+#include <sys/types.h>
+#include <sys/filio.h>
+#include <sys/fcntl.h>
+#include <sys/stat.h>
+#include <sys/nbmlock.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_brand.h>
+#include <sys/sdt.h>
+
+extern int flock_check(vnode_t *, flock64_t *, offset_t, offset_t);
+
+#define	LX_FALLOC_FL_KEEP_SIZE		0x01
+#define	LX_FALLOC_FL_PUNCH_HOLE		0x02
+#define	LX_FALLOC_FL_NO_HIDE_STALE	0x04
+#define	LX_FALLOC_FL_COLLAPSE_RANGE	0x08
+#define	LX_FALLOC_FL_ZERO_RANGE		0x10
+
+#define	LX_FALLOC_VALID	(LX_FALLOC_FL_KEEP_SIZE | LX_FALLOC_FL_PUNCH_HOLE | \
+	LX_FALLOC_FL_NO_HIDE_STALE | LX_FALLOC_FL_COLLAPSE_RANGE | \
+	LX_FALLOC_FL_ZERO_RANGE)
+
+#define	LX_FALLOC_UNSUPP	(LX_FALLOC_FL_NO_HIDE_STALE | \
+	LX_FALLOC_FL_COLLAPSE_RANGE)
+
+long
+lx_fallocate(int fd, int mode, off_t offset, off_t len)
+{
+	int error = 0;
+	file_t *fp;
+	vnode_t *vp;
+	int64_t tot;
+	struct flock64 bf;
+	vattr_t vattr;
+	u_offset_t f_offset;
+	boolean_t in_crit = B_FALSE;
+
+	/*
+	 * Error checking is in a specific order to make LTP happy.
+	 */
+
+	tot = offset + len;
+	if (tot > (LLONG_MAX / (int64_t)1024))
+		return (set_errno(EFBIG));
+
+	if (mode & LX_FALLOC_UNSUPP)
+		return (set_errno(EOPNOTSUPP));
+
+	if ((fp = getf(fd)) == NULL)
+		return (set_errno(EBADF));
+
+	if ((fp->f_flag & FWRITE) == 0) {
+		error = EBADF;
+		goto done;
+	}
+
+	vp = fp->f_vnode;
+	if (vp->v_type != VREG) {
+		error = EINVAL;
+		goto done;
+	}
+
+	if (offset < 0 || len <= 0) {
+		error = EINVAL;
+		goto done;
+	}
+
+	if (tot < 0LL) {
+		error = EFBIG;
+		goto done;
+	}
+
+	if ((mode & ~LX_FALLOC_VALID) != 0) {
+		error = EINVAL;
+		goto done;
+	}
+
+	/*
+	 * If this is the only flag then we don't actually do any work.
+	 */
+	if (mode == LX_FALLOC_FL_KEEP_SIZE)
+		goto done;
+
+	bzero(&bf, sizeof (bf));
+
+	vattr.va_mask = AT_SIZE;
+	if ((error = VOP_GETATTR(vp, &vattr, 0, CRED(), NULL)) != 0)
+		goto done;
+
+	if (mode == 0) {
+		/* Nothing to do if not extending the file */
+		if (vattr.va_size >= tot)
+			goto done;
+
+		/* Extend the file. */
+		bf.l_start = (off64_t)tot;
+		bf.l_len = (off64_t)0;
+
+	} else if (mode & LX_FALLOC_FL_PUNCH_HOLE) {
+		/*
+		 * Deallocate space in the file.
+		 */
+		if ((mode & LX_FALLOC_FL_KEEP_SIZE) == 0) {
+			/* this flag is required with punch hole */
+			error = EINVAL;
+			goto done;
+		}
+
+		if (mode &
+		    ~(LX_FALLOC_FL_PUNCH_HOLE | LX_FALLOC_FL_KEEP_SIZE)) {
+			error = EINVAL;
+			goto done;
+		}
+
+		/* Make sure we don't extend since keep_size is set. */
+		if (vattr.va_size < tot) {
+			if (offset > vattr.va_size)
+				goto done;
+			len = (off_t)vattr.va_size - offset;
+		}
+
+		bf.l_start = (off64_t)offset;
+		bf.l_len = (off64_t)len;
+
+	} else if (mode & LX_FALLOC_FL_ZERO_RANGE) {
+		/*
+		 * Zero out the space in the file.
+		 */
+		if (mode &
+		    ~(LX_FALLOC_FL_ZERO_RANGE | LX_FALLOC_FL_KEEP_SIZE)) {
+			error = EINVAL;
+			goto done;
+		}
+
+		/* Make sure we don't extend when keep_size is set. */
+		if (mode & LX_FALLOC_FL_KEEP_SIZE && vattr.va_size < tot) {
+			if (offset > vattr.va_size)
+				goto done;
+			len = vattr.va_size - offset;
+		}
+
+		bf.l_start = (off64_t)offset;
+		bf.l_len = (off64_t)len;
+	} else {
+		/* We should have already handled all flags */
+		VERIFY(0);
+	}
+
+	/*
+	 * Check for locks in the range.
+	 */
+	f_offset = fp->f_offset;
+	error = flock_check(vp, &bf, f_offset, MAXOFF_T);
+	if (error != 0)
+		goto done;
+
+	/*
+	 * Check for conflicting non-blocking mandatory locks.
+	 * We need to get the size again under nbl_start_crit.
+	 */
+	if (nbl_need_check(vp)) {
+		u_offset_t	begin;
+		ssize_t		length;
+
+		nbl_start_crit(vp, RW_READER);
+		in_crit = B_TRUE;
+		vattr.va_mask = AT_SIZE;
+		if ((error = VOP_GETATTR(vp, &vattr, 0, CRED(), NULL)) != 0)
+			goto done;
+
+		/*
+		 * Make sure we don't extend when keep_size is set.
+		 */
+		if (mode & LX_FALLOC_FL_KEEP_SIZE && vattr.va_size < tot) {
+			ASSERT(mode & (LX_FALLOC_FL_PUNCH_HOLE |
+			    LX_FALLOC_FL_ZERO_RANGE));
+
+			/*
+			 * If the size grew we can short-circuit the rest of
+			 * the work, otherwise adjust bf for the vop_space
+			 * call.
+			 */
+			if (offset >= vattr.va_size)
+				goto done;
+			len = vattr.va_size - offset;
+			bf.l_len = (off64_t)len;
+		}
+
+		if (offset > vattr.va_size) {
+			begin = vattr.va_size;
+			length = offset - vattr.va_size;
+		} else {
+			begin = offset;
+			length = vattr.va_size - offset;
+		}
+
+		if (nbl_conflict(vp, NBL_WRITE, begin, length, 0, NULL)) {
+			error = EACCES;
+			goto done;
+		}
+	}
+
+	error = VOP_SPACE(vp, F_FREESP, &bf, 0, f_offset, fp->f_cred, NULL);
+
+done:
+	if (in_crit)
+		nbl_end_crit(vp);
+
+	releasef(fd);
+	if (error != 0)
+		return (set_errno(error));
+
+	return (0);
+}
+
+long
+lx_fallocate32(int fd, int mode, uint32_t offl, uint32_t offh, uint32_t lenl,
+    uint32_t lenh)
+{
+	int64_t offset = 0, len = 0;
+
+	/*
+	 * From 32-bit callers, Linux passes the 64-bit offset and len by
+	 * concatenating consecutive arguments. We must perform the same
+	 * conversion here.
+	 */
+	offset = offh;
+	offset = offset << 32;
+	offset |= offl;
+	len = lenh;
+	len = len << 32;
+	len |= lenl;
+
+	return (lx_fallocate(fd, mode, (off_t)offset, (off_t)len));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_fcntl.c b/usr/src/uts/common/brand/lx/syscall/lx_fcntl.c
new file mode 100644
index 0000000000..a5406c0a4f
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_fcntl.c
@@ -0,0 +1,701 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/zone.h>
+#include <sys/types.h>
+#include <sys/filio.h>
+#include <sys/fcntl.h>
+#include <sys/stat.h>
+#include <sys/cmn_err.h>
+#include <sys/pathname.h>
+#include <sys/policy.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_fcntl.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_socket.h>
+#include <sys/brand.h>
+#include <sys/fs/fifonode.h>
+#include <sys/strsubr.h>
+#include <sys/stream.h>
+#include <sys/flock.h>
+
+extern int fcntl(int, int, intptr_t);
+extern int flock_check(vnode_t *, flock64_t *, offset_t, offset_t);
+extern int lx_pipe_setsz(stdata_t *, uint_t, boolean_t);
+
+
+int
+lx_vp_at(int fd, char *upath, vnode_t **vpp, int flag)
+{
+	vnode_t *startvp;
+	int error;
+
+	if (fd == LX_AT_FDCWD) {
+		fd = AT_FDCWD;
+	}
+
+	if ((error = fgetstartvp(fd, upath, &startvp)) != 0) {
+		return (error);
+	}
+
+	if (upath != NULL) {
+		uio_seg_t seg = UIO_USERSPACE;
+
+		error = lookupnameat(upath, seg,
+		    (flag == AT_SYMLINK_NOFOLLOW) ?  NO_FOLLOW : FOLLOW,
+		    NULLVPP, vpp, startvp);
+		if (startvp != NULL) {
+			VN_RELE(startvp);
+		}
+		return (error);
+	} else {
+		/* VN_HOLD was established in fgetstartvp */
+		*vpp = startvp;
+		VERIFY(*vpp);
+		return (0);
+	}
+}
+
+#define	LTOS_FLOCK(l, s)						\
+{									\
+	s->l_type = ltos_type(l->l_type);				\
+	s->l_whence = l->l_whence;					\
+	s->l_start = l->l_start;					\
+	s->l_len = l->l_len;						\
+	s->l_sysid = 0;			/* not defined in linux */	\
+	s->l_pid = (pid_t)l->l_pid;					\
+}
+
+#define	STOL_FLOCK(s, l)						\
+{									\
+	l->l_type = stol_type(s->l_type);				\
+	l->l_whence = s->l_whence;					\
+	l->l_start = s->l_start;					\
+	l->l_len = s->l_len;						\
+	l->l_pid = (int)s->l_pid;					\
+}
+
+static short
+ltos_type(short l_type)
+{
+	switch (l_type) {
+	case LX_F_RDLCK:
+		return (F_RDLCK);
+	case LX_F_WRLCK:
+		return (F_WRLCK);
+	case LX_F_UNLCK:
+		return (F_UNLCK);
+	default:
+		return (-1);
+	}
+}
+
+static short
+stol_type(short l_type)
+{
+	switch (l_type) {
+	case F_RDLCK:
+		return (LX_F_RDLCK);
+	case F_WRLCK:
+		return (LX_F_WRLCK);
+	case F_UNLCK:
+		return (LX_F_UNLCK);
+	default:
+		/* can't ever happen */
+		return (0);
+	}
+}
+
+static void
+ltos_flock(struct lx_flock *l, struct flock64 *s)
+{
+	LTOS_FLOCK(l, s)
+}
+
+static void
+stol_flock(struct flock64 *s, struct lx_flock *l)
+{
+	STOL_FLOCK(s, l)
+}
+
+static void
+ltos_flock64(struct lx_flock64_32 *l, struct flock64 *s)
+{
+	LTOS_FLOCK(l, s)
+}
+
+static void
+stol_flock64(struct flock64 *s, struct lx_flock64_32 *l)
+{
+	STOL_FLOCK(s, l)
+}
+
+static int
+lx_fcntl_getfl(int fd)
+{
+	int retval;
+	int rc;
+
+	retval = fcntl(fd, F_GETFL, 0);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		return (ttolwp(curthread)->lwp_errno);
+
+	if ((retval & O_ACCMODE) == O_RDONLY)
+		rc = LX_O_RDONLY;
+	else if ((retval & O_ACCMODE) == O_WRONLY)
+		rc = LX_O_WRONLY;
+	else
+		rc = LX_O_RDWR;
+	/* O_NDELAY != O_NONBLOCK, so we need to check for both */
+	if (retval & O_NDELAY)
+		rc |= LX_O_NDELAY;
+	if (retval & O_NONBLOCK)
+		rc |= LX_O_NONBLOCK;
+	if (retval & O_APPEND)
+		rc |= LX_O_APPEND;
+	if (retval & O_SYNC)
+		rc |= LX_O_SYNC;
+	if (retval & O_LARGEFILE)
+		rc |= LX_O_LARGEFILE;
+	if (retval & FASYNC)
+		rc |= LX_O_ASYNC;
+
+	return (rc);
+}
+
+#define	LX_SETFL_MASK	(O_NONBLOCK | O_APPEND | O_SYNC |  FASYNC);
+
+static int
+lx_fcntl_setfl(int fd, ulong_t arg)
+{
+	int flags;
+
+	/*
+	 * When performing fcntl(F_SETFL), only certain flags are
+	 * allowed to be manipulated. A mask is used to preserve
+	 * other flags, such as those which are specified during
+	 * open(2). The mask on Linux excludes O_LARGEFILE from
+	 * being manipulated, whereas illumos expects the flag to
+	 * be set. In order to properly preserve the O_LARGEFILE
+	 * (FOFFMAX) state, we must first query for it via
+	 * fcntl(F_GETFL) so that the value can be carried
+	 * through.
+	 */
+	flags = fcntl(fd, F_GETFL, 0);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		return (ttolwp(curthread)->lwp_errno);
+
+	flags &= ~LX_SETFL_MASK;
+
+	/* LX_O_NDELAY == LX_O_NONBLOCK, so we only check for one */
+	if (arg & LX_O_NDELAY)
+		flags |= O_NONBLOCK;
+	if (arg & LX_O_APPEND)
+		flags |= O_APPEND;
+	if (arg & LX_O_SYNC)
+		flags |= O_SYNC;
+	if (arg & LX_O_ASYNC)
+		flags |= FASYNC;
+
+	return (fcntl(fd, F_SETFL, flags));
+}
+
+
+static int
+lx_fcntl_pipesz(int fd, int cmd, ulong_t arg)
+{
+	file_t *fp;
+	vnode_t *vp;
+	stdata_t *str;
+	int err = 0, res = 0;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+	vp = fp->f_vnode;
+	if (vp->v_type != VFIFO || vp->v_op != fifo_vnodeops) {
+		err = EBADF;
+		goto out;
+	}
+	VERIFY((str = vp->v_stream) != NULL);
+
+	if (cmd == LX_F_SETPIPE_SZ) {
+		err = lx_pipe_setsz(str, (uint_t)arg, B_FALSE);
+	} else if (cmd == LX_F_GETPIPE_SZ) {
+		size_t val;
+
+		err = strqget(RD(str->sd_wrq), QHIWAT, 0, &val);
+		res = val;
+	} else {
+		/* NOTREACHED */
+		ASSERT(0);
+	}
+
+out:
+	releasef(fd);
+	if (err != 0) {
+		return (set_errno(err));
+	}
+	return (res);
+}
+
+static int
+lx_fcntl_common(int fd, int cmd, ulong_t arg)
+{
+	int		rc = 0;
+	pid_t		pid;
+	int		error;
+	int		rv;
+	int32_t		flag;
+	file_t		*fp;
+
+	/*
+	 * We depend on the call to fcntl to set the errno if necessary.
+	 */
+	ttolwp(curthread)->lwp_errno = 0;
+
+	switch (cmd) {
+	case LX_F_SETSIG:
+	case LX_F_GETSIG:
+	case LX_F_SETLEASE:
+	case LX_F_GETLEASE:
+	case LX_F_NOTIFY:
+	case LX_F_CANCELLK:
+		{
+			char buf[80];
+
+			(void) snprintf(buf, sizeof (buf),
+			    "unsupported fcntl command: %d", cmd);
+			lx_unsupported(buf);
+		}
+		return (set_errno(ENOTSUP));
+
+	case LX_F_DUPFD:
+		rc = fcntl(fd, F_DUPFD, arg);
+		break;
+
+	case LX_F_DUPFD_CLOEXEC:
+		rc = fcntl(fd, F_DUPFD_CLOEXEC, arg);
+		break;
+
+	case LX_F_GETFD:
+		rc = fcntl(fd, F_GETFD, 0);
+		break;
+
+	case LX_F_SETFD:
+		rc = fcntl(fd, F_SETFD, arg);
+		break;
+
+	case LX_F_GETFL:
+		rc = lx_fcntl_getfl(fd);
+		break;
+
+	case LX_F_SETFL:
+		rc = lx_fcntl_setfl(fd, arg);
+		break;
+
+	case LX_F_SETOWN:
+		pid = (pid_t)arg;
+		if (pid == 1) {
+			/* Setown for the init process uses the real pid. */
+			pid = curzone->zone_proc_initpid;
+		}
+
+		if ((fp = getf(fd)) == NULL)
+			return (set_errno(EBADF));
+
+		rv = 0;
+
+		flag = fp->f_flag | get_udatamodel() | FKIOCTL;
+		error = VOP_IOCTL(fp->f_vnode, FIOSETOWN, (intptr_t)&pid,
+		    flag, CRED(), &rv, NULL);
+		releasef(fd);
+		if (error != 0) {
+			/*
+			 * On illumos F_SETOWN is only defined for sockets, but
+			 * some apps hardcode to do this fcntl on other devices
+			 * (e.g. /dev/tty) to setup signal handling. If the
+			 * app is only setting itself to be the signal
+			 * handler, we pretend to succeed.
+			 */
+			if (error != EINVAL ||
+			    curthread->t_procp->p_pid != pid) {
+				return (set_errno(error));
+			}
+		}
+
+		rc = 0;
+		break;
+
+	case LX_F_GETOWN:
+		if ((fp = getf(fd)) == NULL)
+			return (set_errno(EBADF));
+
+		rv = 0;
+
+		flag = fp->f_flag | get_udatamodel() | FKIOCTL;
+		error = VOP_IOCTL(fp->f_vnode, FIOGETOWN, (intptr_t)&pid,
+		    flag, CRED(), &rv, NULL);
+		releasef(fd);
+		if (error != 0)
+			return (set_errno(error));
+
+		if (pid == curzone->zone_proc_initpid) {
+			/* Getown for the init process returns 1. */
+			pid = 1;
+		}
+
+		rc = pid;
+		break;
+
+	case LX_F_SETPIPE_SZ:
+	case LX_F_GETPIPE_SZ:
+		rc = lx_fcntl_pipesz(fd, cmd, arg);
+		break;
+
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	return (rc);
+}
+
+static int
+lx_fcntl_lock_cmd_to_s(int lx_cmd)
+{
+	switch (lx_cmd) {
+	case LX_F_GETLK:
+		return (F_GETLK);
+	case LX_F_SETLK:
+		return (F_SETLK);
+	case LX_F_SETLKW:
+		return (F_SETLKW);
+	case LX_F_GETLK64:
+		return (F_GETLK64);
+	case LX_F_SETLK64:
+		return (F_SETLK64);
+	case LX_F_SETLKW64:
+		return (F_SETLKW64);
+	default:
+		VERIFY(0);
+		/*NOTREACHED*/
+		return (0);
+	}
+}
+
+/*
+ * This is a pain but we can't re-use the fcntl code for locking since it does
+ * its own copyin/copyout for the flock struct. Since we have to convert the
+ * struct we have to do our own copyin/out. Thus we replicate the fcntl code for
+ * these 3 cmds. Luckily it's not much.
+ */
+static int
+lx_fcntl_lock(int fd, int lx_cmd, void *arg)
+{
+	int cmd;
+	int error = 0;
+	file_t *fp;
+	vnode_t *vp;
+	int flag;
+	offset_t maxoffset;
+	u_offset_t offset;
+	model_t datamodel;
+	lx_flock_t lxflk;
+	lx_flock64_32_t lxflk64;
+	struct flock64 bf;
+
+	if ((fp = getf(fd)) == NULL)
+		return (set_errno(EBADF));
+
+	maxoffset = MAXOFF_T;
+	datamodel = DATAMODEL_NATIVE;
+#if defined(_SYSCALL32_IMPL)
+	if ((datamodel = get_udatamodel()) == DATAMODEL_ILP32)
+		maxoffset = MAXOFF32_T;
+#endif
+	vp = fp->f_vnode;
+	flag = fp->f_flag;
+	offset = fp->f_offset;
+
+	cmd = lx_fcntl_lock_cmd_to_s(lx_cmd);
+
+	switch (cmd) {
+	case F_GETLK:
+	case F_SETLK:
+	case F_SETLKW:
+		if (datamodel == DATAMODEL_NATIVE) {
+			if (copyin(arg, &lxflk, sizeof (lx_flock_t)) != 0) {
+				error = EFAULT;
+				break;
+			}
+		}
+#if defined(_SYSCALL32_IMPL)
+		else {
+			lx_flock32_t lxflk32;
+
+			if (copyin(arg, &lxflk32, sizeof (lxflk32)) != 0) {
+				error = EFAULT;
+				break;
+			}
+
+			lxflk.l_type = lxflk32.l_type;
+			lxflk.l_whence = lxflk32.l_whence;
+			lxflk.l_start = (off64_t)lxflk32.l_start;
+			lxflk.l_len = (off64_t)lxflk32.l_len;
+			lxflk.l_pid = lxflk32.l_pid;
+		}
+#endif /* _SYSCALL32_IMPL */
+
+		ltos_flock(&lxflk, &bf);
+
+		if ((error = flock_check(vp, &bf, offset, maxoffset)) != 0)
+			break;
+
+		if ((error = VOP_FRLOCK(vp, cmd, &bf, flag, offset, NULL,
+		    fp->f_cred, NULL)) != 0) {
+			if (cmd == F_SETLKW && error == EINTR) {
+				ttolxlwp(curthread)->br_syscall_restart =
+				    B_TRUE;
+			}
+			break;
+		}
+
+		if (cmd != F_GETLK)
+			break;
+
+		/*
+		 * The command is GETLK, return result.
+		 */
+		stol_flock(&bf, &lxflk);
+
+		/*
+		 * If no lock is found, only the type field is changed.
+		 */
+		if (lxflk.l_type == LX_F_UNLCK) {
+			/* l_type always first entry, always a short */
+			if (copyout(&lxflk.l_type, &((lx_flock_t *)arg)->l_type,
+			    sizeof (lxflk.l_type)))
+				error = EFAULT;
+			break;
+		}
+
+		if (bf.l_start > maxoffset || bf.l_len > maxoffset) {
+			error = EOVERFLOW;
+			break;
+		}
+
+		if (datamodel == DATAMODEL_NATIVE) {
+			if (copyout(&lxflk, arg, sizeof (lxflk)) != 0) {
+				error = EFAULT;
+				break;
+			}
+		}
+#if defined(_SYSCALL32_IMPL)
+		else {
+			lx_flock32_t lxflk32;
+
+			if (bf.l_start > MAXOFF32_T || bf.l_len > MAXOFF32_T) {
+				error = EOVERFLOW;
+				break;
+			}
+
+			lxflk32.l_type = lxflk.l_type;
+			lxflk32.l_whence = lxflk.l_whence;
+			lxflk32.l_start = lxflk.l_start;
+			lxflk32.l_len = lxflk.l_len;
+			lxflk32.l_pid = lxflk.l_pid;
+
+			if (copyout(&lxflk32, arg, sizeof (lxflk32)) != 0) {
+				error = EFAULT;
+				break;
+			}
+		}
+#endif /* _SYSCALL32_IMPL */
+		break;
+
+	case F_GETLK64:
+	case F_SETLK64:
+	case F_SETLKW64:
+		/*
+		 * Large File support is only used for ILP32 apps.
+		 */
+		if (datamodel != DATAMODEL_ILP32) {
+			error = EINVAL;
+			break;
+		}
+
+		if (cmd == F_GETLK64)
+			cmd = F_GETLK;
+		else if (cmd == F_SETLK64)
+			cmd = F_SETLK;
+		else if (cmd == F_SETLKW64)
+			cmd = F_SETLKW;
+
+		if (copyin(arg, &lxflk64, sizeof (lxflk64)) != 0) {
+			error = EFAULT;
+			break;
+		}
+
+		ltos_flock64(&lxflk64, &bf);
+
+		if ((error = flock_check(vp, &bf, offset, MAXOFFSET_T)) != 0)
+			break;
+
+		if ((error = VOP_FRLOCK(vp, cmd, &bf, flag, offset, NULL,
+		    fp->f_cred, NULL)) != 0)
+			break;
+
+		if (cmd != F_GETLK)
+			break;
+
+		/*
+		 * The command is GETLK, return result.
+		 */
+		stol_flock64(&bf, &lxflk64);
+
+		/*
+		 * If no lock is found, only the type field is changed.
+		 */
+		if (lxflk64.l_type == LX_F_UNLCK) {
+			/* l_type always first entry, always a short */
+			if (copyout(&lxflk64.l_type,
+			    &((lx_flock64_t *)arg)->l_type,
+			    sizeof (lxflk64.l_type)))
+				error = EFAULT;
+			break;
+		}
+
+		if (bf.l_start > maxoffset || bf.l_len > maxoffset) {
+			error = EOVERFLOW;
+			break;
+		}
+
+		if (copyout(&lxflk64, arg, sizeof (lxflk64)) != 0) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+
+	releasef(fd);
+	if (error)
+		return (set_errno(error));
+
+	return (0);
+}
+
+long
+lx_fcntl(int fd, int cmd, intptr_t arg)
+{
+	switch (cmd) {
+	case LX_F_GETLK64:
+	case LX_F_SETLK64:
+	case LX_F_SETLKW64:
+		/* The 64-bit fcntl commands must go through fcntl64(). */
+		return (set_errno(EINVAL));
+
+	case LX_F_GETLK:
+	case LX_F_SETLK:
+	case LX_F_SETLKW:
+		return (lx_fcntl_lock(fd, cmd, (void *)arg));
+
+	default:
+		return (lx_fcntl_common(fd, cmd, arg));
+	}
+}
+
+long
+lx_fcntl64(int fd, int cmd, intptr_t arg)
+{
+	switch (cmd) {
+	case LX_F_GETLK:
+	case LX_F_SETLK:
+	case LX_F_SETLKW:
+	case LX_F_GETLK64:
+	case LX_F_SETLKW64:
+	case LX_F_SETLK64:
+		return (lx_fcntl_lock(fd, cmd, (void *)arg));
+
+	default:
+		return (lx_fcntl_common(fd, cmd, (ulong_t)arg));
+	}
+}
+
+/*
+ * Apply or remove an advisory lock on the entire file. F_FLOCK and F_FLOCKW
+ * are OFD-style locks. For more information, see the comment on ofdlock().
+ */
+long
+lx_flock(int fd, int op)
+{
+	int cmd;
+	int error;
+	flock64_t bf;
+	file_t *fp;
+
+	if (op & LX_LOCK_NB) {
+		cmd = F_FLOCK;
+		op &= ~LX_LOCK_NB;
+	} else {
+		cmd = F_FLOCKW;
+	}
+
+	switch (op) {
+	case LX_LOCK_UN:
+		bf.l_type = F_UNLCK;
+		break;
+	case LX_LOCK_SH:
+		bf.l_type = F_RDLCK;
+		break;
+	case LX_LOCK_EX:
+		bf.l_type = F_WRLCK;
+		break;
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	bf.l_whence = 0;
+	bf.l_start = 0;
+	bf.l_len = 0;
+	bf.l_sysid = 0;
+	bf.l_pid = 0;
+
+	if ((fp = getf(fd)) == NULL)
+		return (set_errno(EBADF));
+
+	/*
+	 * See the locking comment in fcntl.c. In summary, the *_frlock
+	 * functions in the various file systems basically do some validation,
+	 * then funnel everything through the fs_frlock function. For OFD-style
+	 * locks, fs_frlock will do nothing. Once control returns here, we call
+	 * the ofdlock function to do the actual locking.
+	 */
+	error = VOP_FRLOCK(fp->f_vnode, cmd, &bf, fp->f_flag, fp->f_offset,
+	    NULL, fp->f_cred, NULL);
+	if (error != 0) {
+		releasef(fd);
+		return (set_errno(error));
+	}
+	error = ofdlock(fp, cmd, &bf, fp->f_flag, fp->f_offset);
+	if (error != 0) {
+		if (cmd == F_FLOCKW && error == EINTR)
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		(void) set_errno(error);
+	}
+	releasef(fd);
+	return (error);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_futex.c b/usr/src/uts/common/brand/lx/syscall/lx_futex.c
new file mode 100644
index 0000000000..2bf65748c0
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_futex.c
@@ -0,0 +1,1665 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/debug.h>
+#include <vm/as.h>
+#include <vm/seg.h>
+#include <vm/seg_vn.h>
+#include <vm/page.h>
+#include <sys/priv.h>
+#include <sys/mman.h>
+#include <sys/timer.h>
+#include <sys/condvar.h>
+#include <sys/inttypes.h>
+#include <sys/cmn_err.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_futex.h>
+#include <sys/lx_impl.h>
+#include <sys/sdt.h>
+
+/*
+ * Futexes are a Linux-specific implementation of inter-process mutexes.
+ * They are designed to use shared memory for simple, uncontested
+ * operations, and rely on the kernel to resolve any contention issues.
+ *
+ * Most of the information in this section comes from the paper "Futexes
+ * Are Tricky", by Ulrich Drepper.  This paper is currently available at:
+ * http://people.redhat.com/~drepper/futex.pdf.
+ *
+ * A futex itself a 4-byte integer, which must be 4-byte aligned.  The
+ * value of this integer is expected to be modified using user-level atomic
+ * operations.  For the original, simple futexes, the futex(4) design itself did
+ * not impose any semantic constraints on the value stored in the futex; it is
+ * up to the application to define its own protocol. For the newer,
+ * priority-inheritance (PI) futexes, the value is 0 or the TID of the holder,
+ * as defined in futex(2).
+ *
+ * When the application decides that kernel intervention is required, it
+ * will use the futex(2) system call.  Originally there were 5 different
+ * operations that could be performed on a futex, using this system call, but
+ * that has subsequently been extended.  Since this interface has evolved over
+ * time, there are several different prototypes available to the user.
+ * Fortunately, there is only a single kernel-level interface:
+ *
+ * long sys_futex(void *futex1, int cmd, int val1,
+ * 	struct timespec	*timeout, void *futex2, int val2)
+ *
+ * The kernel-level operations that may be performed on a simple futex are:
+ *
+ * FUTEX_WAIT
+ *
+ *	Atomically verify that futex1 contains the value val1.  If it
+ *	doesn't, return EWOULDBLOCK.  If it does contain the expected
+ *	value, the thread will sleep until somebody performs a FUTEX_WAKE
+ *	on the futex.  The caller may also specify a timeout, indicating
+ *	the maximum time the thread should sleep.  If the timer expires,
+ *	the call returns ETIMEDOUT.  If the thread is awoken with a signal,
+ *	the call returns EINTR.  Otherwise, the call returns 0.
+ *
+ * FUTEX_WAKE
+ *
+ *	Wake up val1 processes that are waiting on futex1.  The call
+ *	returns the number of blocked threads that were woken up.
+ *
+ * FUTEX_WAIT_BITSET/FUTEX_WAKE_BITSET
+ *
+ *	Similar to FUTEX_WAIT/FUTEX_WAKE, but each takes an additional argument
+ *	denoting a bit vector, with wakers will only waking waiters that match
+ *	in one or more bits.  These semantics are dubious enough, but the
+ *	interface has an inconsistency that is glaring even by the
+ *	embarrassingly low standards that Linux sets for itself:  the timeout
+ *	argument to FUTEX_WAIT_BITSET is absolute, not relative as it is for
+ *	FUTEX_WAIT.  And as if that weren't enough unnecessary complexity,
+ *	the caller may specify this absolute timeout to be against either
+ *	CLOCK_MONOTONIC or CLOCK_REALTIME -- but only for FUTEX_WAIT_BITSET,
+ *	of course!
+ *
+ * FUTEX_WAKE_OP
+ *
+ *	The implementation of a conditional variable in terms of futexes
+ *	actually uses two futexes:  one to assure sequential access and one to
+ *	represent the condition variable.  This implementation gives rise to a
+ *	particular performance problem whereby a thread is awoken on the futex
+ *	that represents the condition variable only to have to (potentially)
+ *	immediately wait on the futex that protects the condition variable.
+ *	(Do not confuse the futex that serves to protect the condition variable
+ *	with the pthread_mutex_t associated with pthread_cond_t -- which
+ *	represents a third futex.)  To (over)solve this problem, FUTEX_WAKE_OP
+ *	was invented, which performs an atomic compare-and-exchange on a
+ *	second address in a specified fashion (that is, with a specified
+ *	operation).  Here are the possible operations (OPARG is defined
+ *	to be 12 bit value embedded in the operation):
+ *
+ *	- FUTEX_OP_SET: Sets the value at the second address to OPARG
+ *	- FUTEX_OP_ADD: Adds the value to OPARG
+ *	- FUTEX_OP_OR: OR's the value with OPARG
+ *	- FUTEX_OP_ANDN: Performs a negated AND of the value with OPARG
+ *	- FUTEX_OP_XOR: XOR's the value with OPARG
+ *
+ *	After this compare-and-exchange on the second address, a FUTEX_WAKE is
+ *	performed on the first address and -- if the compare-and-exchange
+ *	matches a specified result based on a specified comparison operation --
+ *	a FUTEX_WAKE is performed on the second address.  Here are the possible
+ *	comparison operations:
+ *
+ *	- FUTEX_OP_CMP_EQ: If old value is CMPARG, wake
+ *	- FUTEX_OP_CMP_NE: If old value is not equal to CMPARG, wake
+ *	- FUTEX_OP_CMP_LT: If old value is less than CMPARG, wake
+ *	- FUTEX_OP_CMP_LE: If old value is less than or equal to CMPARG, wake
+ *	- FUTEX_OP_CMP_GT: If old value is greater than CMPARG, wake
+ *	- FUTEX_OP_CMP_GE: If old value is greater than or equal to CMPARG, wake
+ *
+ *	As a practical matter, the only way that this is used (or, some might
+ *	argue, is usable) is by the implementation of pthread_cond_signal(),
+ *	which uses FUTEX_WAKE_OP to -- in a single system call -- unlock the
+ *	futex that protects the condition variable and wake the futex that
+ *	represents the condition variable.  The second wake-up is conditional
+ *	because the futex that protects the condition variable (rather than the
+ *	one that represents it) may or may not have waiters.  Given that this
+ *	is the use case, FUTEX_WAKE_OP is falsely generic: despite allowing for
+ *	five different kinds of operations and six different kinds of
+ *	comparision operations, in practice only one is used.  (Namely, setting
+ *	to 0 and waking if the old value is greater than 1 -- which denotes
+ *	that waiters are present and the wakeup should be performed.) Moreover,
+ *	because FUTEX_WAKE_OP does not (and cannot) optimize anything in the
+ *	case that the pthread_mutex_t associated with the pthread_cond_t is
+ *	held at the time of a pthread_cond_signal(), this entire mechanism is
+ *	essentially for naught in this case.  As one can imagine (and can
+ *	verify on just about any source base that uses pthread_cond_signal()),
+ *	it is overwhelmingly the common case that the lock associated with the
+ *	pthread_cond_t is held at the time of pthread_cond_signal(), assuring
+ *	that the problem that all of this complexity was designed to solve
+ *	isn't, in fact, solved because the signalled thread simply wakes up
+ *	only to block again on the held mutex.  Cue a slow clap!
+ *
+ * FUTEX_CMP_REQUEUE
+ *
+ *	If the value stored in futex1 matches that passed in in val2, wake
+ *	up val1 processes that are waiting on futex1.  Otherwise, return
+ *	EAGAIN.
+ *
+ *	If there are more than val1 threads waiting on the futex, remove
+ *	the remaining threads from this futex, and requeue them on futex2.
+ *	The caller can limit the number of threads being requeued by
+ *	encoding an integral numerical value in the position usually used
+ *	for the timeout pointer.
+ *
+ *	The call returns the number of blocked threads that were woken up
+ *	or requeued.
+ *
+ * FUTEX_REQUEUE
+ *
+ *	 Identical to FUTEX_CMP_REQUEUE except that it does not use val2.
+ *	 This command has been declared broken and obsolete, but we still
+ *	 need to support it.
+ *
+ * FUTEX_FD
+ *
+ *	Return a file descriptor, which can be used to refer to the futex.
+ *	This operation was broken by design, and was blessedly removed in
+ *	Linux 2.6.26 ("because it was inherently racy"); it should go without
+ *	saying that we don't support this operation.
+ *
+ * The kernel-level operations that may be performed on a PI futex are:
+ *
+ * FUTEX_LOCK_PI
+ *
+ *	Called after a user-land attempt to acquire the lock using an atomic
+ *	instruction failed because the futex had a nonzero value (the current
+ *	holder's TID). Once enqueued, the thread sleeps until FUTEX_UNLOCK_PI
+ *	is called on the futex, or the timeout expires. The timeout argument to
+ *	FUTEX_LOCK_PI is absolute, unlike FUTEX_WAIT, and cannot be modified
+ *	as with FUTEX_WAIT_BITSET!
+ *
+ * FUTEX_TRYLOCK_PI
+ *
+ *	Similar to FUTEX_LOCK_PI but can be used for error recovery as
+ *	described in futex(2).
+ *
+ * FUTEX_UNLOCK_PI
+ *
+ *	Called when user-land cannot atomically release the lock because
+ *	there are waiting threads. This will wake the highest priority waiting
+ *	thread.
+ *
+ * FUTEX_CMP_REQUEUE_PI
+ *
+ *	Not implemented at this time.
+ *
+ * FUTEX_WAIT_REQUEUE_PI
+ *
+ *	Not implemented at this time.
+ *
+ * Priority Inheritance
+ *
+ * Our general approach to priority inheritance recognizes the fact that the
+ * application is almost certainly not a real-time process running on dedicated
+ * hardware. The zone is most likely running in a multi-tenant environment under
+ * FSS, in spite of whatever scheduling class the Linux application thinks it is
+ * using. Thus, we make our best effort to handle priority inheritance. When a
+ * thread must block on a PI futex, it may increase the scheduling priority of
+ * the futex holder to match the blocking thread. The futex holder's original
+ * priority will be restored when it unlocks the futex.
+ *
+ * This approach does not always handle transitive priority inheritance. For
+ * example, three threads at Low, Medium and High priority:
+ *    L holds futex X
+ *    M holds futex Y and became enqueued on X (M bumped L's priority to M)
+ *    H enqueues on Y and bumps priority of M to H, but never bumps L's priority
+ *      (which is currently M) up to H
+ * In reality this scenario is both uncommon and likely still executes
+ * reasonably well under a multi-tenant, FSS scenario. Also note that if H
+ * enqueued on Y before M enqueues on X, then L will have its priority raised
+ * to H when M enqueues on X.
+ *
+ * PI Futex Cleanup
+ *
+ * Futex cleanup can occur when a thread exits unexpectedly while holding one
+ * or more futexes. Normally this done via a "robust" futex and cleanup of a
+ * robust PI futex works in the same way as a non-PI robust futex (see
+ * lx_futex_robust_exit). On Linux, in the case of a non-robust PI futex,
+ * cleanup can still occur because the futex is associated with a real-time
+ * mutex inside the kernel (see the futex(2) man page for more details). For lx
+ * we are not using anything similar. When a thread exits, lx_futex_robust_exit
+ * will be called, but we would have to iterate every hash bucket, and every
+ * futex in the chain, to look for futexes held by the exiting thread. This
+ * would be very expensive and would occur whether or not the thread held any
+ * futexes. Thus, at this time we don't set the FUTEX_OWNER_DIED bit on
+ * non-robust PI futexes held by a thread when it exits while holding futexes.
+ * In practice this does not seem to be a serious limitation since user-level
+ * code generally appears to use robust futexes, but this may need to be
+ * revisited if it is observed to be an issue.
+ */
+
+/*
+ * The structure of the robust_list, as set with the set_robust_list() system
+ * call.  See lx_futex_robust_exit(), below, for details.
+ */
+typedef struct futex_robust_list {
+	uintptr_t	frl_head;	/* list of robust locks held */
+	uint64_t	frl_offset;	/* offset of lock word within a lock */
+	uintptr_t	frl_pending;	/* pending operation */
+} futex_robust_list_t;
+
+#if defined(_SYSCALL32_IMPL)
+
+#pragma pack(4)
+typedef struct futex_robust_list32 {
+	uint32_t	frl_head;	/* list of robust locks held */
+	uint32_t	frl_offset;	/* offset of lock word within a lock */
+	uint32_t	frl_pending;	/* pending operation */
+} futex_robust_list32_t;
+#pragma pack()
+
+#endif
+
+#define	MEMID_COPY(s, d) \
+	{ (d)->val[0] = (s)->val[0]; (d)->val[1] = (s)->val[1]; }
+#define	MEMID_EQUAL(s, d) \
+	((d)->val[0] == (s)->val[0] && (d)->val[1] == (s)->val[1])
+
+/*
+ * Because collisions on this hash table can be a source of negative
+ * scalability, we make it pretty large: 4,096 entries -- 64K.  If this
+ * size is found to be insufficient, the size should be made dynamic.
+ * (Making it dynamic will be delicate because the per-chain locking will
+ * necessitate memory retiring or similar; see the 2008 ACM Queue article
+ * "Real-world concurrency" for details on this technique.)
+ */
+#define	HASH_SHIFT_SZ	12
+#define	HASH_SIZE	(1 << HASH_SHIFT_SZ)
+#define	HASH_FUNC(id)						\
+	((((uintptr_t)((id)->val[1]) >> 3) +			\
+	((uintptr_t)((id)->val[1]) >> (3 + HASH_SHIFT_SZ)) +		\
+	((uintptr_t)((id)->val[1]) >> (3 + 2 * HASH_SHIFT_SZ)) +	\
+	((uintptr_t)((id)->val[0]) >> 3) +				\
+	((uintptr_t)((id)->val[0]) >> (3 + HASH_SHIFT_SZ)) +		\
+	((uintptr_t)((id)->val[0]) >> (3 + 2 * HASH_SHIFT_SZ))) &	\
+	(HASH_SIZE - 1))
+
+/*
+ * A small, invalid value we can compare against to find the highest scheduling
+ * priority.
+ */
+#define	BELOW_MINPRI	INT_MIN
+
+/*
+ * We place the per-chain lock next to the pointer to the chain itself.
+ * When compared to an array of orthogonal locks, this reduces false sharing
+ * (though adjacent entries can still be falsely shared -- just not as many),
+ * while having the additional bonus of increasing locality.
+ */
+typedef struct futex_hash {
+	kmutex_t fh_lock;
+	fwaiter_t *fh_waiters;
+} futex_hash_t;
+
+static futex_hash_t futex_hash[HASH_SIZE];
+
+static void
+futex_hashin(fwaiter_t *fwp)
+{
+	int index;
+
+	index = HASH_FUNC(&fwp->fw_memid);
+	ASSERT(MUTEX_HELD(&futex_hash[index].fh_lock));
+
+	fwp->fw_prev = NULL;
+	fwp->fw_next = futex_hash[index].fh_waiters;
+	if (fwp->fw_next)
+		fwp->fw_next->fw_prev = fwp;
+	futex_hash[index].fh_waiters = fwp;
+}
+
+static void
+futex_hashout(fwaiter_t *fwp)
+{
+	int index;
+
+	index = HASH_FUNC(&fwp->fw_memid);
+	ASSERT(MUTEX_HELD(&futex_hash[index].fh_lock));
+
+	if (fwp->fw_prev)
+		fwp->fw_prev->fw_next = fwp->fw_next;
+	if (fwp->fw_next)
+		fwp->fw_next->fw_prev = fwp->fw_prev;
+	if (futex_hash[index].fh_waiters == fwp)
+		futex_hash[index].fh_waiters = fwp->fw_next;
+
+	fwp->fw_prev = NULL;
+	fwp->fw_next = NULL;
+}
+
+/*
+ * Go to sleep until somebody does a WAKE operation on this futex, we get a
+ * signal, or the timeout expires.
+ */
+static int
+futex_wait(memid_t *memid, caddr_t addr,
+    int val, timespec_t *timeout, uint32_t bits, boolean_t hrtime)
+{
+	kthread_t *t = curthread;
+	lx_lwp_data_t *lwpd = ttolxlwp(t);
+	fwaiter_t *fwp = &lwpd->br_fwaiter;
+	int err, ret;
+	int32_t curval;
+	int index;
+
+	/*
+	 * The LMS_USER_LOCK micro state becomes valid if we sleep; otherwise
+	 * our time will accrue against LMS_SYSTEM.  Use of this micro state
+	 * is modelled on lwp_mutex_timedlock(), a native analogue of
+	 * futex_wait().
+	 */
+	(void) new_mstate(t, LMS_USER_LOCK);
+
+	fwp->fw_woken = 0;
+	fwp->fw_bits = bits;
+	fwp->fw_tid = 0;
+
+	MEMID_COPY(memid, &fwp->fw_memid);
+	cv_init(&fwp->fw_cv, NULL, CV_DEFAULT, NULL);
+
+	index = HASH_FUNC(&fwp->fw_memid);
+	mutex_enter(&futex_hash[index].fh_lock);
+
+	if (fuword32(addr, (uint32_t *)&curval)) {
+		err = set_errno(EFAULT);
+		goto out;
+	}
+	if (curval != val) {
+		err = set_errno(EWOULDBLOCK);
+		goto out;
+	}
+
+	futex_hashin(fwp);
+
+	err = 0;
+	while ((fwp->fw_woken == 0) && (err == 0)) {
+		/*
+		 * If hrtime is set, we interpret timeout to be absolute and
+		 * CLOCK_MONOTONIC-based; otherwise we treat it as absolute
+		 * and CLOCK_REALTIME-based. (Strictly speaking -- or at least
+		 * in as much as the term "strictly" means anything in the
+		 * semantic shambles that is Linux -- FUTEX_WAIT defines its
+		 * timeout to be CLOCK_MONOTONIC-based but limited by system
+		 * clock interval; we treat these semantics as effectively
+		 * CLOCK_REALTIME.)
+		 */
+		if (hrtime) {
+			ret = cv_timedwait_sig_hrtime(&fwp->fw_cv,
+			    &futex_hash[index].fh_lock, ts2hrt(timeout));
+		} else {
+			ret = cv_waituntil_sig(&fwp->fw_cv,
+			    &futex_hash[index].fh_lock, timeout, timechanged);
+		}
+
+		if (ret < 0) {
+			err = set_errno(ETIMEDOUT);
+		} else if (ret == 0) {
+			/*
+			 * According to signal(7), a futex(2) call with the
+			 * FUTEX_WAIT operation is restartable.
+			 */
+			ttolxlwp(t)->br_syscall_restart = B_TRUE;
+			err = set_errno(EINTR);
+		}
+	}
+
+	/*
+	 * The futex is normally hashed out in wakeup.  If we timed out or
+	 * got a signal, we need to hash it out here instead.
+	 */
+	if (fwp->fw_woken == 0)
+		futex_hashout(fwp);
+
+out:
+	mutex_exit(&futex_hash[index].fh_lock);
+
+	return (err);
+}
+
+/*
+ * Wake up to wake_threads threads that are blocked on the futex at memid.
+ */
+static int
+futex_wake(memid_t *memid, int wake_threads, uint32_t mask)
+{
+	fwaiter_t *fwp, *next;
+	int index;
+	int ret = 0;
+
+	index = HASH_FUNC(memid);
+
+	mutex_enter(&futex_hash[index].fh_lock);
+
+	for (fwp = futex_hash[index].fh_waiters;
+	    fwp != NULL && ret < wake_threads; fwp = next) {
+		next = fwp->fw_next;
+		if (MEMID_EQUAL(&fwp->fw_memid, memid)) {
+			if (fwp->fw_tid != 0) {
+				/*
+				 * A PI waiter. It is invalid to mix PI and
+				 * non-PI usage on the same futex.
+				 */
+				mutex_exit(&futex_hash[index].fh_lock);
+				return (set_errno(EINVAL));
+			}
+
+			if ((fwp->fw_bits & mask)) {
+				futex_hashout(fwp);
+				fwp->fw_woken = 1;
+				cv_signal(&fwp->fw_cv);
+				ret++;
+			}
+		}
+	}
+
+	mutex_exit(&futex_hash[index].fh_lock);
+
+	return (ret);
+}
+
+static int
+futex_wake_op_execute(int32_t *addr, int32_t val3)
+{
+	int32_t op = FUTEX_OP_OP(val3);
+	int32_t cmp = FUTEX_OP_CMP(val3);
+	int32_t cmparg = FUTEX_OP_CMPARG(val3);
+	int32_t oparg, oldval, newval;
+	label_t ljb;
+	int rval;
+
+	if ((uintptr_t)addr >= KERNELBASE)
+		return (-EFAULT);
+
+	if (on_fault(&ljb))
+		return (-EFAULT);
+
+	oparg = FUTEX_OP_OPARG(val3);
+
+	do {
+		oldval = *addr;
+		newval = oparg;
+
+		switch (op) {
+		case FUTEX_OP_SET:
+			break;
+
+		case FUTEX_OP_ADD:
+			newval += oparg;
+			break;
+
+		case FUTEX_OP_OR:
+			newval |= oparg;
+			break;
+
+		case FUTEX_OP_ANDN:
+			newval &= ~oparg;
+			break;
+
+		case FUTEX_OP_XOR:
+			newval ^= oparg;
+			break;
+
+		default:
+			no_fault();
+			return (-EINVAL);
+		}
+	} while (atomic_cas_32((uint32_t *)addr, oldval, newval) != oldval);
+
+	no_fault();
+
+	switch (cmp) {
+	case FUTEX_OP_CMP_EQ:
+		rval = (oldval == cmparg);
+		break;
+
+	case FUTEX_OP_CMP_NE:
+		rval = (oldval != cmparg);
+		break;
+
+	case FUTEX_OP_CMP_LT:
+		rval = (oldval < cmparg);
+		break;
+
+	case FUTEX_OP_CMP_LE:
+		rval = (oldval <= cmparg);
+		break;
+
+	case FUTEX_OP_CMP_GT:
+		rval = (oldval > cmparg);
+		break;
+
+	case FUTEX_OP_CMP_GE:
+		rval = (oldval >= cmparg);
+		break;
+
+	default:
+		return (-EINVAL);
+	}
+
+	return (rval);
+}
+
+static int
+futex_wake_op(memid_t *memid, caddr_t addr2, memid_t *memid2,
+    int wake_threads, int wake_threads2, int val3)
+{
+	kmutex_t *l1, *l2;
+	int ret = 0, ret2 = 0, wake;
+	fwaiter_t *fwp, *next;
+	int index1, index2;
+
+	index1 = HASH_FUNC(memid);
+	index2 = HASH_FUNC(memid2);
+
+	if (index1 == index2) {
+		l1 = &futex_hash[index1].fh_lock;
+		l2 = NULL;
+	} else if (index1 < index2) {
+		l1 = &futex_hash[index1].fh_lock;
+		l2 = &futex_hash[index2].fh_lock;
+	} else {
+		l1 = &futex_hash[index2].fh_lock;
+		l2 = &futex_hash[index1].fh_lock;
+	}
+
+	mutex_enter(l1);
+	if (l2 != NULL)
+		mutex_enter(l2);
+
+	/* LINTED: alignment */
+	if ((wake = futex_wake_op_execute((int32_t *)addr2, val3)) < 0) {
+		(void) set_errno(-wake); /* convert back to positive errno */
+		ret = -1;
+		goto out;
+	}
+
+	for (fwp = futex_hash[index1].fh_waiters; fwp != NULL; fwp = next) {
+		next = fwp->fw_next;
+		if (!MEMID_EQUAL(&fwp->fw_memid, memid))
+			continue;
+
+		if (fwp->fw_tid != 0) {
+			/*
+			 * A PI waiter. It is invalid to mix PI and non-PI
+			 * usage on the same futex.
+			 */
+			(void) set_errno(EINVAL);
+			ret = -1;
+			goto out;
+		}
+
+		futex_hashout(fwp);
+		fwp->fw_woken = 1;
+		cv_signal(&fwp->fw_cv);
+		if (++ret >= wake_threads) {
+			break;
+		}
+	}
+
+	if (!wake)
+		goto out;
+
+	for (fwp = futex_hash[index2].fh_waiters; fwp != NULL; fwp = next) {
+		next = fwp->fw_next;
+		if (!MEMID_EQUAL(&fwp->fw_memid, memid2))
+			continue;
+
+		if (fwp->fw_tid != 0) {
+			/*
+			 * A PI waiter. It is invalid to mix PI and non-PI
+			 * usage on the same futex.
+			 */
+			(void) set_errno(EINVAL);
+			ret = -1;
+			goto out;
+		}
+
+		futex_hashout(fwp);
+		fwp->fw_woken = 1;
+		cv_signal(&fwp->fw_cv);
+		if (++ret2 >= wake_threads2) {
+			break;
+		}
+	}
+
+	ret += ret2;
+out:
+	if (l2 != NULL)
+		mutex_exit(l2);
+	mutex_exit(l1);
+
+	return (ret);
+}
+
+/*
+ * Wake up to wake_threads waiting on the futex at memid.  If there are
+ * more than that many threads waiting, requeue the remaining threads on
+ * the futex at requeue_memid.
+ */
+static int
+futex_requeue(memid_t *memid, memid_t *requeue_memid, int wake_threads,
+    ulong_t requeue_threads, caddr_t addr, int *cmpval)
+{
+	fwaiter_t *fwp, *next;
+	int index1, index2;
+	int ret = 0;
+	int32_t curval;
+	kmutex_t *l1, *l2;
+
+	/*
+	 * To ensure that we don't miss a wakeup if the value of cmpval
+	 * changes, we need to grab locks on both the original and new hash
+	 * buckets.  To avoid deadlock, we always grab the lower-indexed
+	 * lock first.
+	 */
+	index1 = HASH_FUNC(memid);
+	index2 = HASH_FUNC(requeue_memid);
+
+	if (index1 == index2) {
+		l1 = &futex_hash[index1].fh_lock;
+		l2 = NULL;
+	} else if (index1 < index2) {
+		l1 = &futex_hash[index1].fh_lock;
+		l2 = &futex_hash[index2].fh_lock;
+	} else {
+		l1 = &futex_hash[index2].fh_lock;
+		l2 = &futex_hash[index1].fh_lock;
+	}
+
+	mutex_enter(l1);
+	if (l2 != NULL)
+		mutex_enter(l2);
+
+	if (cmpval != NULL) {
+		if (fuword32(addr, (uint32_t *)&curval)) {
+			ret = -EFAULT;
+			goto out;
+		}
+		if (curval != *cmpval) {
+			ret = -EAGAIN;
+			goto out;
+		}
+	}
+
+	for (fwp = futex_hash[index1].fh_waiters; fwp != NULL; fwp = next) {
+		next = fwp->fw_next;
+		if (!MEMID_EQUAL(&fwp->fw_memid, memid))
+			continue;
+
+		futex_hashout(fwp);
+		if (ret++ < wake_threads) {
+			fwp->fw_woken = 1;
+			cv_signal(&fwp->fw_cv);
+		} else {
+			MEMID_COPY(requeue_memid, &fwp->fw_memid);
+			futex_hashin(fwp);
+
+			if ((ret - wake_threads) >= requeue_threads)
+				break;
+		}
+	}
+
+out:
+	if (l2 != NULL)
+		mutex_exit(l2);
+	mutex_exit(l1);
+
+	if (ret < 0)
+		return (set_errno(-ret));
+	return (ret);
+}
+
+/*
+ * Copy in the timeout provided by the application and convert it to an
+ * absolute timeout.  Sadly, this is complicated by the different timeout
+ * semantics of FUTEX_WAIT vs. FUTEX_WAIT_BITSET vs. FUTEX_LOCK_PI. (Yes, you
+ * read that correctly; all three of these have different timeout semantics;
+ * see the block comment at the top of the file for commentary on this
+ * inanity.)  This function doesn't attempt to clean up all of these
+ * differences, however; we will only copy the timer value in, perform some
+ * basic sanity checking, and (if it's an operation operating on a relative
+ * time, which is to say FUTEX_WAIT) adjust it to be absolute.  All other
+ * nuances (namely, the resolution and clock of the timeout) are left up to
+ * the caller.
+ */
+static int
+get_timeout(void *lx_timeout, timestruc_t *timeout, int cmd)
+{
+	timestruc_t now;
+
+	if (get_udatamodel() == DATAMODEL_NATIVE) {
+		if (copyin(lx_timeout, timeout, sizeof (timestruc_t)))
+			return (EFAULT);
+	}
+#ifdef _SYSCALL32_IMPL
+	else {
+		timestruc32_t timeout32;
+		if (copyin(lx_timeout, &timeout32, sizeof (timestruc32_t)))
+			return (EFAULT);
+		timeout->tv_sec = (time_t)timeout32.tv_sec;
+		timeout->tv_nsec = timeout32.tv_nsec;
+	}
+#endif
+	if (itimerspecfix(timeout))
+		return (EINVAL);
+
+	if (cmd == FUTEX_WAIT) {
+		/*
+		 * We've been given a relative time; add it to the current
+		 * time to derive an absolute time.
+		 */
+		gethrestime(&now);
+		timespecadd(timeout, &now);
+	}
+
+	return (0);
+}
+
+/*
+ * Attempt to take the futex. If currently held, enqueue (sleep) on the futex
+ * until a thread performs futex_unlock_pi, we get a signal, or the timeout
+ * expires. If 'is_trylock' is true and the futex is currently held, return
+ * EAGAIN immediately.
+ */
+static int
+futex_lock_pi(memid_t *memid, uint32_t *addr, timespec_t *timeout,
+    boolean_t is_trylock)
+{
+	kthread_t *t = curthread;
+	lx_lwp_data_t *lwpd = ttolxlwp(t);
+	fwaiter_t *fwp = &lwpd->br_fwaiter;
+	fwaiter_t *f_fwp;
+	int fpri, mypri;
+	int err;
+	int index;
+	/* volatile to silence gcc clobber warning for longjmp */
+	volatile pid_t mytid;
+	pid_t ftid;			/* current futex holder tid */
+	proc_t *fproc = NULL;		/* current futex holder proc */
+	kthread_t *fthrd;		/* current futex holder thread */
+	volatile uint32_t oldval;
+
+	if ((uintptr_t)addr >= KERNELBASE)
+		return (set_errno(EFAULT));
+
+	mytid = (lwpd->br_pid == curzone->zone_proc_initpid ? 1 : lwpd->br_pid);
+
+	/*
+	 * Have to take mutex first to prevent the following race with unlock:
+	 * a) T1 sees a tid in the futex and atomically sets FUTEX_WAITERS.
+	 * b) T2 calls unlock, sees there are waiters, but since nothing is in
+	 *    the queue yet, it simply returns with the futex now containing 0.
+	 * c) T1 proceeds to enqueue itself.
+	 * At this point nothing will ever wake T1.
+	 */
+	index = HASH_FUNC(memid);
+	mutex_enter(&futex_hash[index].fh_lock);
+
+	/* It would be very unusual to actually loop here. */
+	oldval = 0;
+	/* CONSTCOND */
+	while (1) {
+		uint32_t curval;
+		label_t ljb;
+
+		if (on_fault(&ljb)) {
+			mutex_exit(&futex_hash[index].fh_lock);
+			return (set_errno(EFAULT));
+		}
+
+		/*
+		 * We optimistically try to set our tid on the off chance that
+		 * the futex was released after we initiated the syscall. That
+		 * may work but it is the unlikely path and is usually just our
+		 * way of getting the current value. This also handles the
+		 * retry in the case when the futex only has the high bits set.
+		 */
+		curval = atomic_cas_32(addr, oldval, mytid);
+		if (oldval == curval) {
+			no_fault();
+			mutex_exit(&futex_hash[index].fh_lock);
+			return (0);
+		}
+
+		oldval = curval;
+		ftid = oldval & FUTEX_TID_MASK;
+		/* high bits were only ones set, so we retry to set our tid */
+		if (ftid == 0) {
+			no_fault();
+			continue;
+		}
+
+		if (ftid == mytid) {
+			no_fault();
+			mutex_exit(&futex_hash[index].fh_lock);
+			return (set_errno(EDEADLK));
+		}
+
+		/* The futex is currently held by another thread. */
+		if (is_trylock) {
+			no_fault();
+			mutex_exit(&futex_hash[index].fh_lock);
+			return (set_errno(EAGAIN));
+		}
+
+		curval = atomic_cas_32(addr, oldval, oldval | FUTEX_WAITERS);
+		no_fault();
+		if (curval == oldval) {
+			/*
+			 * We set the WAITERS bit so now we can enqueue our
+			 * thread on the mutex. This is the typical path.
+			 */
+			oldval |= FUTEX_WAITERS;
+			break;
+		}
+
+		/*
+		 * The rare case when a change snuck into the window between
+		 * first getting the futex value and updating it; retry.
+		 */
+		oldval = 0;
+	}
+
+	/*
+	 * Determine if the current futex holder's priority needs to inherit
+	 * our priority (only if it should be increased).
+	 *
+	 * If a non-branded proc is sharing this futex(!?) then we don't
+	 * interact with it. This seems like it would only occur maliciously.
+	 * That proc will never be able to call futex(2) to unlock the futex.
+	 * We just return ESRCH for this invalid case.
+	 *
+	 * Otherwise, get the holder's priority and if necessary, bump it up to
+	 * our level.
+	 */
+	mutex_enter(&curproc->p_lock);
+	(void) CL_DOPRIO(curthread, kcred, 0, &mypri);
+	mutex_exit(&curproc->p_lock);
+
+	if (lx_lpid_lock(ftid, curzone, 0, &fproc, &fthrd) != 0) {
+		label_t ljb;
+
+		if (on_fault(&ljb) == 0) {
+			(void) atomic_cas_32(addr, oldval,
+			    oldval | FUTEX_OWNER_DIED);
+		}
+		no_fault();
+		mutex_exit(&futex_hash[index].fh_lock);
+		return (set_errno(ESRCH));
+	}
+	if (!PROC_IS_BRANDED(fproc)) {
+		mutex_exit(&fproc->p_lock);
+		mutex_exit(&futex_hash[index].fh_lock);
+		return (set_errno(ESRCH));
+	}
+
+	ASSERT(MUTEX_HELD(&fproc->p_lock));
+	(void) CL_DOPRIO(fthrd, kcred, 0, &fpri);
+
+	f_fwp = &lwptolxlwp(ttolwp(fthrd))->br_fwaiter;
+	if (mypri > fpri) {
+		/* Save holder's current pri if not already bumped up */
+		if (!f_fwp->fw_pri_up)
+			f_fwp->fw_opri = fpri;
+		f_fwp->fw_pri_up = B_TRUE;
+		DTRACE_PROBE2(futex__lck__pri, int, mypri, int, fpri);
+		CL_DOPRIO(fthrd, kcred, mypri - fpri, &fpri);
+	}
+
+	/*
+	 * If we haven't already been bumped by some other thread then
+	 * record our pri at time of enqueue.
+	 */
+	if (!fwp->fw_pri_up) {
+		fwp->fw_opri = mypri;
+	}
+	mutex_exit(&fproc->p_lock);
+
+	/*
+	 * Enqueue our thread on the mutex. This is similar to futex_wait().
+	 * See futex_wait() for LMS_USER_LOCK state description.
+	 */
+	(void) new_mstate(t, LMS_USER_LOCK);
+
+	fwp->fw_woken = 0;
+	fwp->fw_bits = 0;
+	fwp->fw_tid = mytid;
+	MEMID_COPY(memid, &fwp->fw_memid);
+	cv_init(&fwp->fw_cv, NULL, CV_DEFAULT, NULL);
+
+	futex_hashin(fwp);
+
+	err = 0;
+	while (fwp->fw_woken == 0 && err == 0) {
+		int ret;
+
+		ret = cv_waituntil_sig(&fwp->fw_cv, &futex_hash[index].fh_lock,
+		    timeout, timechanged);
+		if (ret < 0) {
+			err = set_errno(ETIMEDOUT);
+		} else if (ret == 0) {
+			/* EINTR is not valid for futex_lock_pi */
+			err = set_errno(EAGAIN);
+		}
+	}
+
+	/*
+	 * The futex is normally hashed out in futex_unlock_pi. If we timed out
+	 * or got a signal, we need to hash it out here instead.
+	 */
+	if (fwp->fw_woken == 0)
+		futex_hashout(fwp);
+
+	mutex_exit(&futex_hash[index].fh_lock);
+	return (err);
+}
+
+/*
+ * This must be a separate function to prevent compiler complaints about
+ * clobbering variables via longjmp (on_fault). When setting the new owner we
+ * must preserve the current WAITERS and OWNER_DIED bits.
+ */
+static int
+futex_unlock_pi_waiter(fwaiter_t *fnd_fwp, uint32_t *addr, uint32_t curval)
+{
+	label_t ljb;
+	pid_t tid;
+
+	if (on_fault(&ljb)) {
+		return (EFAULT);
+	}
+
+	/* No waiter on this futex; again, not normal, but not an error. */
+	if (fnd_fwp == NULL) {
+		int res = 0;
+		if (atomic_cas_32(addr, curval,
+		    0 | (curval & FUTEX_OWNER_DIED)) != curval)
+			res = EINVAL;
+		no_fault();
+		return (res);
+	}
+
+	tid = fnd_fwp->fw_tid | (curval & (FUTEX_WAITERS | FUTEX_OWNER_DIED));
+	if (atomic_cas_32(addr, curval, tid) != curval) {
+		/*
+		 * The value was changed behind our back, return an error and
+		 * don't dequeue the waiter.
+		 */
+		no_fault();
+		return (EINVAL);
+	}
+
+	no_fault();
+
+	futex_hashout(fnd_fwp);
+	fnd_fwp->fw_woken = 1;
+	cv_signal(&fnd_fwp->fw_cv);
+
+	return (0);
+}
+
+/*
+ * Paired with futex_lock_pi; wake up highest priority thread that is blocked
+ * on the futex at memid. A non-zero 'clean_tid' argument is used for a PI
+ * futex during robust or trylock cleanup when the calling thread may not own
+ * the futex. During cleanup we check that the futex contains the expected
+ * tid to avoid cleanup races.
+ */
+static int
+futex_unlock_pi(memid_t *memid, uint32_t *addr, pid_t clean_tid)
+{
+	kthread_t *t = curthread;
+	lx_lwp_data_t *lwpd = ttolxlwp(t);
+	fwaiter_t *fwp, *fnd_fwp;
+	uint32_t curval;
+	pid_t mytid;
+	pid_t holder_tid;
+	int index;
+	int hipri;
+	int res;
+
+	if ((uintptr_t)addr >= KERNELBASE)
+		return (EFAULT);
+
+	mytid = (lwpd->br_pid == curzone->zone_proc_initpid ? 1 : lwpd->br_pid);
+
+	/* See comment in futex_lock_pi for why we take the mutex first. */
+	index = HASH_FUNC(memid);
+	mutex_enter(&futex_hash[index].fh_lock);
+
+	if (fuword32(addr, &curval)) {
+		mutex_exit(&futex_hash[index].fh_lock);
+		return (EFAULT);
+	}
+
+	holder_tid = curval & FUTEX_TID_MASK;
+	if (clean_tid == 0) {
+		/* Not cleaning up so we must hold the futex */
+		if (holder_tid != mytid) {
+			mutex_exit(&futex_hash[index].fh_lock);
+			return (EPERM);
+		}
+	} else {
+		/*
+		 * We're doing cleanup but we want to check if another thread
+		 * already did the cleanup due to a race before we took the
+		 * futex_hash.fh_lock.
+		 *
+		 * There are two posible cases here:
+		 * 1) During robust cleanup we already cleared the dead tid
+		 *    from the futex and set the FUTEX_OWNER_DIED bit.
+		 * 2) During trylock cleanup we want to be sure the tid we
+		 *    saw in the futex before we took the futex_hash lock
+		 *    is still there and that we did not race with another
+		 *    trylock also doing cleanup.
+		 */
+		DTRACE_PROBE2(futex__unl__clean, int, curval, int, clean_tid);
+		if ((curval & FUTEX_OWNER_DIED) != 0) {
+			if (holder_tid != 0) {
+				mutex_exit(&futex_hash[index].fh_lock);
+				return (0);
+			}
+		} else if (holder_tid != clean_tid) {
+			mutex_exit(&futex_hash[index].fh_lock);
+			return (0);
+		}
+	}
+
+	/*
+	 * If necessary, restore our old priority. Since we only ever bump up
+	 * the priority, our incr should be negative, but we allow for the
+	 * case where the priority was lowered in some other way while we held
+	 * the futex. Also, we only reset our priority on a true unlock, not
+	 * when cleaning up, as indicated by clean_tid.
+	 */
+	if (clean_tid == 0) {
+		fwp = &lwpd->br_fwaiter;
+		if (fwp->fw_pri_up) {
+			int curpri;
+			int incr;
+
+			mutex_enter(&curproc->p_lock);
+			CL_DOPRIO(curthread, kcred, 0, &curpri);
+			DTRACE_PROBE2(futex__unl__pri, int, fwp->fw_opri,
+			    int, curpri);
+			incr = fwp->fw_opri - curpri;
+			if (incr < 0) {
+				CL_DOPRIO(curthread, kcred, incr, &curpri);
+			}
+			mutex_exit(&curproc->p_lock);
+			fwp->fw_pri_up = B_FALSE;
+		}
+	}
+
+	/*
+	 * Normally an application wouldn't make the syscall if the WAITERS
+	 * bit is not set, but we also come through here on robust and trylock
+	 * cleanup. Preserve the OWNER_DIED bit even though there are no
+	 * waiters and we're just clearing the tid.
+	 */
+	if ((curval & FUTEX_WAITERS) == 0) {
+		res = 0;
+		label_t fjb;
+
+		if (on_fault(&fjb)) {
+			mutex_exit(&futex_hash[index].fh_lock);
+			return (EFAULT);
+		}
+		if (atomic_cas_32(addr, curval,
+		    0 | (curval & FUTEX_OWNER_DIED)) != curval) {
+			res = EINVAL;
+		}
+
+		no_fault();
+		mutex_exit(&futex_hash[index].fh_lock);
+		return (res);
+	}
+
+	/* Find the highest priority waiter. */
+	hipri = BELOW_MINPRI;
+	fnd_fwp = NULL;
+	for (fwp = futex_hash[index].fh_waiters; fwp != NULL;
+	    fwp = fwp->fw_next) {
+		if (MEMID_EQUAL(&fwp->fw_memid, memid)) {
+			if (fwp->fw_tid == 0) {
+				/*
+				 * A non-PI waiter. It is invalid to mix PI and
+				 * non-PI usage on the same futex.
+				 */
+				no_fault();
+				mutex_exit(&futex_hash[index].fh_lock);
+				return (EINVAL);
+			}
+			/*
+			 * Because futex_hashin inserts at the head of the list
+			 * we want to find the oldest entry with the highest
+			 * priority (hence >=).
+			 */
+			if (fwp->fw_opri >= hipri) {
+				fnd_fwp = fwp;
+				hipri = fwp->fw_opri;
+			}
+		}
+	}
+
+	res = futex_unlock_pi_waiter(fnd_fwp, addr, curval);
+	mutex_exit(&futex_hash[index].fh_lock);
+	return (res);
+}
+
+/*
+ * Handle the case where the futex holder is gone and try to recover. Trylock
+ * will never enqueue on the futex and must return EAGAIN if it is held by
+ * a live process.
+ */
+static int
+futex_trylock_pi(memid_t *memid, uint32_t *addr)
+{
+	uint32_t curval;
+	pid_t ftid;			/* current futex holder tid */
+	proc_t *fproc = NULL;		/* current futex holder proc */
+	kthread_t *fthrd;		/* current futex holder thread */
+
+	if ((uintptr_t)addr >= KERNELBASE)
+		return (set_errno(EFAULT));
+
+	if (fuword32(addr, &curval))
+		return (set_errno(EFAULT));
+
+	/* The futex is free, use the normal flow. */
+	if (curval == 0)
+		return (futex_lock_pi(memid, addr, NULL, B_TRUE));
+
+	/* Determine if the current futex holder is still alive. */
+	ftid = curval & FUTEX_TID_MASK;
+	if (lx_lpid_lock(ftid, curzone, 0, &fproc, &fthrd) == 0) {
+		mutex_exit(&fproc->p_lock);
+	} else {
+		/*
+		 * The current holder is gone. Unlock then take the lock.
+		 * Ignore any error that may result from two threads racing to
+		 * cleanup.
+		 */
+		(void) futex_unlock_pi(memid, addr, ftid);
+	}
+	return (futex_lock_pi(memid, addr, NULL, B_TRUE));
+}
+
+long
+lx_futex(uintptr_t addr, int op, int val, uintptr_t lx_timeout,
+    uintptr_t addr2, int val3)
+{
+	struct as *as = curproc->p_as;
+	memid_t memid, memid2;
+	timestruc_t timeout;
+	timestruc_t *tptr = NULL;
+	int val2 = NULL;
+	int rval = 0;
+	int cmd = op & FUTEX_CMD_MASK;
+	int private = op & FUTEX_PRIVATE_FLAG;
+	char dmsg[32];
+
+	/* must be aligned on int boundary */
+	if (addr & 0x3)
+		return (set_errno(EINVAL));
+
+	/* Sanity check the futex command */
+	if (cmd < 0 || cmd > FUTEX_MAX_CMD)
+		return (set_errno(EINVAL));
+
+	if (cmd == FUTEX_FD) {
+		/*
+		 * FUTEX_FD was sentenced to death for grievous crimes of
+		 * semantics against humanity; it has been ripped out of Linux
+		 * and will never be supported by us.
+		 */
+		(void) snprintf(dmsg, sizeof (dmsg), "futex 0x%x", cmd);
+		lx_unsupported(dmsg);
+		return (set_errno(ENOSYS));
+	}
+
+	switch (cmd) {
+	case FUTEX_WAIT_REQUEUE_PI:
+	case FUTEX_CMP_REQUEUE_PI:
+		/*
+		 * These are operations that we don't currently support, but
+		 * may well need to in the future.  For now, callers need to
+		 * deal with these being missing -- but if and as that changes,
+		 * they may well need to be implemented.
+		 */
+		(void) snprintf(dmsg, sizeof (dmsg), "futex 0x%x", cmd);
+		lx_unsupported(dmsg);
+		return (set_errno(ENOSYS));
+	}
+
+	if ((op & FUTEX_CLOCK_REALTIME) && cmd != FUTEX_WAIT_BITSET) {
+		/*
+		 * Linux only allows FUTEX_CLOCK_REALTIME to be set on the
+		 * FUTEX_WAIT_BITSET and FUTEX_WAIT_REQUEUE_PI commands.
+		 */
+		return (set_errno(ENOSYS));
+	}
+
+	/* Copy in the timeout structure from userspace. */
+	if ((cmd == FUTEX_WAIT || cmd == FUTEX_WAIT_BITSET ||
+	    cmd == FUTEX_LOCK_PI) && lx_timeout != NULL) {
+		rval = get_timeout((timespec_t *)lx_timeout, &timeout, cmd);
+
+		if (rval != 0)
+			return (set_errno(rval));
+		tptr = &timeout;
+	}
+
+	switch (cmd) {
+	case FUTEX_REQUEUE:
+	case FUTEX_CMP_REQUEUE:
+	case FUTEX_WAKE_OP:
+		/*
+		 * lx_timeout is nominally a pointer to a userspace address.
+		 * For several commands, however, it actually contains
+		 * an additional integer parameter.  This is horrible, and
+		 * the people who did this to us should be sorry.
+		 */
+		val2 = (int)lx_timeout;
+	}
+
+	/*
+	 * Translate the process-specific, user-space futex virtual
+	 * address(es) to a universal memid.  If the private bit is set, we
+	 * can just use our as plus the virtual address, saving quite a bit
+	 * of effort.
+	 */
+	if (private) {
+		memid.val[0] = (uintptr_t)as;
+		memid.val[1] = (uintptr_t)addr;
+	} else {
+		rval = as_getmemid(as, (void *)addr, &memid);
+		if (rval != 0)
+			return (set_errno(rval));
+	}
+
+	if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
+	    cmd == FUTEX_WAKE_OP) {
+		if (addr2 & 0x3)
+			return (set_errno(EINVAL));
+
+		if (private) {
+			memid2.val[0] = (uintptr_t)as;
+			memid2.val[1] = (uintptr_t)addr2;
+		} else {
+			rval = as_getmemid(as, (void *)addr2, &memid2);
+			if (rval)
+				return (set_errno(rval));
+		}
+	}
+
+	switch (cmd) {
+	case FUTEX_WAIT:
+		rval = futex_wait(&memid, (void *)addr, val,
+		    tptr, FUTEX_BITSET_MATCH_ANY, B_FALSE);
+		break;
+
+	case FUTEX_WAIT_BITSET:
+		rval = futex_wait(&memid, (void *)addr, val, tptr, val3,
+		    (op & FUTEX_CLOCK_REALTIME) ? B_FALSE : B_TRUE);
+		break;
+
+	case FUTEX_WAKE:
+		rval = futex_wake(&memid, val, FUTEX_BITSET_MATCH_ANY);
+		break;
+
+	case FUTEX_WAKE_BITSET:
+		rval = futex_wake(&memid, val, val3);
+		break;
+
+	case FUTEX_WAKE_OP:
+		rval = futex_wake_op(&memid, (void *)addr2, &memid2,
+		    val, val2, val3);
+		break;
+
+	case FUTEX_CMP_REQUEUE:
+	case FUTEX_REQUEUE:
+		rval = futex_requeue(&memid, &memid2, val,
+		    val2, (void *)addr2, &val3);
+
+		break;
+
+	case FUTEX_LOCK_PI:
+		rval = futex_lock_pi(&memid, (uint32_t *)addr, tptr, B_FALSE);
+		break;
+
+	case FUTEX_TRYLOCK_PI:
+		rval = futex_trylock_pi(&memid, (uint32_t *)addr);
+		break;
+
+	case FUTEX_UNLOCK_PI:
+		rval = futex_unlock_pi(&memid, (uint32_t *)addr, 0);
+		if (rval != 0)
+			(void) set_errno(rval);
+		break;
+	}
+
+	return (rval);
+}
+
+/*
+ * Wake the next waiter if the thread holding the futex has exited without
+ * releasing the futex.
+ */
+static void
+futex_robust_wake(memid_t *memid, uint32_t tid)
+{
+	fwaiter_t *fwp;
+	int index;
+
+	index = HASH_FUNC(memid);
+
+	mutex_enter(&futex_hash[index].fh_lock);
+
+	for (fwp = futex_hash[index].fh_waiters; fwp != NULL;
+	    fwp = fwp->fw_next) {
+		if (MEMID_EQUAL(&fwp->fw_memid, memid))
+			break;
+	}
+
+	if (fwp != NULL) {
+		if (fwp->fw_tid != 0) {
+			/*
+			 * This is a PI futex and there is a waiter; unlock the
+			 * futex in cleanup mode. Ignore errors, which are very
+			 * unlikely, but could happen if the futex was in an
+			 * unexpected state due to some other cleanup, such as
+			 * might happen with a concurrent trylock call.
+			 */
+			mutex_exit(&futex_hash[index].fh_lock);
+			(void) futex_unlock_pi(memid,
+			    (uint32_t *)(uintptr_t)memid->val[1], tid);
+			return;
+		}
+
+		/* non-PI futex, just wake it */
+		futex_hashout(fwp);
+		fwp->fw_woken = 1;
+		cv_signal(&fwp->fw_cv);
+	}
+
+	mutex_exit(&futex_hash[index].fh_lock);
+}
+
+/*
+ * Does the dirty work of actually dropping a held robust lock in the event
+ * of the untimely death of the owner; see lx_futex_robust_exit(), below.
+ */
+static void
+lx_futex_robust_drop(uintptr_t addr, uint32_t tid)
+{
+	memid_t memid;
+	uint32_t oldval, newval;
+
+	VERIFY(addr + sizeof (uint32_t) < KERNELBASE);
+
+	do {
+		fuword32_noerr((void *)addr, &oldval);
+
+		if ((oldval & FUTEX_TID_MASK) != tid)
+			return;
+
+		newval = (oldval & FUTEX_WAITERS) | FUTEX_OWNER_DIED;
+	} while (atomic_cas_32((uint32_t *)addr, oldval, newval) != oldval);
+
+	/*
+	 * We have now denoted that this lock's owner is dead; we need to
+	 * wake any waiters.
+	 */
+	if (as_getmemid(curproc->p_as, (void *)addr, &memid) != 0)
+		return;
+
+	futex_robust_wake(&memid, tid);
+}
+
+/*
+ * Called when a thread is exiting.  The role of the kernel is very clearly
+ * spelled out in the Linux design document entitled robust-futex-ABI.txt:
+ * we must (carefully!) iterate over the list of held locks pointed to by
+ * the robust list head; for each lock, we'll check to see if the calling
+ * (exiting) thread is the owner, and if so, denote that the lock is dead
+ * and wake any waiters.  (The "pending" field of the head points to a lock
+ * that is in transition; it should be dropped if held.)  If there are any
+ * errors through here at all (including memory operations), we abort the
+ * entire operation.
+ */
+void
+lx_futex_robust_exit(uintptr_t addr, uint32_t tid)
+{
+	futex_robust_list_t list;
+	uintptr_t entry, next;
+	model_t model = get_udatamodel();
+	int length = 0;
+	label_t ljb;
+
+	if (on_fault(&ljb))
+		return;
+
+	if (addr + sizeof (futex_robust_list_t) >= KERNELBASE)
+		goto out;
+
+	if (model == DATAMODEL_NATIVE) {
+		copyin_noerr((void *)addr, &list, sizeof (list));
+	}
+#if defined(_SYSCALL32_IMPL)
+	else {
+		futex_robust_list32_t list32;
+
+		copyin_noerr((void *)addr, &list32, sizeof (list32));
+		list.frl_head = list32.frl_head;
+		list.frl_offset = list32.frl_offset;
+		list.frl_pending = list32.frl_pending;
+	}
+#endif
+
+	/*
+	 * Strip off the PI bit, if any.
+	 */
+	entry = list.frl_head & ~FUTEX_ROBUST_LOCK_PI;
+
+	while (entry != addr && length++ < FUTEX_ROBUST_LIST_LIMIT) {
+		if (entry + list.frl_offset + sizeof (uint32_t) >= KERNELBASE)
+			goto out;
+
+		if (model == DATAMODEL_NATIVE) {
+			fulword_noerr((void *)entry, &next);
+		}
+#if defined(_SYSCALL32_IMPL)
+		else {
+			uint32_t next32;
+			fuword32_noerr((void *)entry, &next32);
+			next = next32;
+		}
+#endif
+
+		/*
+		 * Drop the robust mutex -- but only if our pending lock didn't
+		 * somehow sneak on there.
+		 */
+		if (entry != list.frl_pending)
+			lx_futex_robust_drop(entry + list.frl_offset, tid);
+
+		entry = next & ~FUTEX_LOCK_PI;
+	}
+
+	/*
+	 * Finally, drop the pending lock if there is one.
+	 */
+	if (list.frl_pending != NULL && list.frl_pending +
+	    list.frl_offset + sizeof (uint32_t) < KERNELBASE)
+		lx_futex_robust_drop(list.frl_pending + list.frl_offset, tid);
+
+out:
+	no_fault();
+}
+
+long
+lx_set_robust_list(void *listp, size_t len)
+{
+	proc_t *p = curproc;
+	klwp_t *lwp = ttolwp(curthread);
+	struct lx_lwp_data *lwpd = lwptolxlwp(lwp);
+
+	if (get_udatamodel() == DATAMODEL_NATIVE) {
+		if (len != sizeof (futex_robust_list_t))
+			return (set_errno(EINVAL));
+	}
+#if defined(_SYSCALL32_IMPL)
+	else {
+		if (len != sizeof (futex_robust_list32_t))
+			return (set_errno(EINVAL));
+	}
+#endif
+
+	/*
+	 * To assure that we are serialized with respect to any racing call
+	 * to lx_get_robust_list(), we lock ourselves to set the value.  (Note
+	 * that sprunlock() drops p_lock.)
+	 */
+	mutex_enter(&p->p_lock);
+	sprlock_proc(p);
+	lwpd->br_robust_list = listp;
+	sprunlock(p);
+
+	return (0);
+}
+
+long
+lx_get_robust_list(pid_t pid, void **listp, size_t *lenp)
+{
+	model_t model = get_udatamodel();
+	proc_t *rproc;
+	kthread_t *rthr;
+	klwp_t *rlwp;
+	lx_lwp_data_t *rlwpd;
+	void *list;
+	int err = 0;
+
+	if (pid == 0) {
+		/*
+		 * A pid of 0 denotes the current thread; we lock the current
+		 * process even though it isn't strictly necessary (we can't
+		 * race with set_robust_list() because a thread may only set
+		 * its robust list on itself).
+		 */
+		rproc = curproc;
+		rlwpd = lwptolxlwp(ttolwp(curthread));
+		mutex_enter(&curproc->p_lock);
+		sprlock_proc(rproc);
+	} else {
+		if (lx_lpid_lock(pid, curzone, LXP_PRLOCK, &rproc,
+		    &rthr) != 0) {
+			return (set_errno(ESRCH));
+		}
+
+		if (rproc->p_model != model ||
+		    (rlwp = ttolwp(rthr)) == NULL ||
+		    (rlwpd = lwptolxlwp(rlwp)) == NULL) {
+			/*
+			 * The target process does not match our data model, or
+			 * we couldn't find the LWP, or the target process is
+			 * not branded.
+			 */
+			err = ESRCH;
+			goto out;
+		}
+	}
+
+	if (curproc != rproc &&
+	    priv_proc_cred_perm(curproc->p_cred, rproc, NULL, VREAD) != 0) {
+		/*
+		 * We don't have the permission to examine the target.
+		 */
+		err = EPERM;
+		goto out;
+	}
+
+	list = rlwpd->br_robust_list;
+
+out:
+	sprunlock(rproc);
+
+	if (err != 0)
+		return (set_errno(err));
+
+	if (model == DATAMODEL_NATIVE) {
+		if (sulword(listp, (uintptr_t)list) != 0)
+			return (set_errno(EFAULT));
+
+		if (sulword(lenp, sizeof (futex_robust_list_t)) != 0)
+			return (set_errno(EFAULT));
+	}
+#if defined(_SYSCALL32_IMPL)
+	else {
+		if (suword32(listp, (uint32_t)(uintptr_t)list) != 0)
+			return (set_errno(EFAULT));
+
+		if (suword32(lenp, sizeof (futex_robust_list32_t)) != 0)
+			return (set_errno(EFAULT));
+	}
+#endif
+
+	return (0);
+}
+
+void
+lx_futex_init(void)
+{
+	int i;
+
+	for (i = 0; i < HASH_SIZE; i++)
+		mutex_init(&futex_hash[i].fh_lock, NULL, MUTEX_DEFAULT, NULL);
+}
+
+int
+lx_futex_fini(void)
+{
+	int i, err;
+
+	err = 0;
+	for (i = 0; (err == 0) && (i < HASH_SIZE); i++) {
+		mutex_enter(&futex_hash[i].fh_lock);
+		if (futex_hash[i].fh_waiters != NULL)
+			err = EBUSY;
+		mutex_exit(&futex_hash[i].fh_lock);
+	}
+	return (err);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_getcwd.c b/usr/src/uts/common/brand/lx/syscall/lx_getcwd.c
new file mode 100644
index 0000000000..275a781fa0
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_getcwd.c
@@ -0,0 +1,52 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/types.h>
+#include <sys/proc.h>
+#include <sys/vnode.h>
+#include <sys/pathname.h>
+
+/*
+ * getcwd() - Linux syscall semantics are slightly different; we need to return
+ * the length of the pathname copied (+ 1 for the terminating NULL byte.)
+ */
+long
+lx_getcwd(char *buf, int size)
+{
+	int len;
+	int error;
+	vnode_t *vp;
+	char path[MAXPATHLEN + 1];
+
+	mutex_enter(&curproc->p_lock);
+	vp = PTOU(curproc)->u_cdir;
+	VN_HOLD(vp);
+	mutex_exit(&curproc->p_lock);
+	if ((error = vnodetopath(NULL, vp, path, sizeof (path), CRED())) != 0) {
+		VN_RELE(vp);
+		return (set_errno(error));
+	}
+	VN_RELE(vp);
+
+	len = strlen(path) + 1;
+	if (len > size)
+		return (set_errno(ERANGE));
+
+	if (copyout(path, buf, len) != 0)
+		return (set_errno(EFAULT));
+
+	return (len);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_getdents.c b/usr/src/uts/common/brand/lx/syscall/lx_getdents.c
new file mode 100644
index 0000000000..5bde892aea
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_getdents.c
@@ -0,0 +1,416 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/filio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/inttypes.h>
+#include <sys/vnode.h>
+#include <sys/dirent.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/sysmacros.h>
+#include <sys/kmem.h>
+#include <sys/sunddi.h>
+
+#include <sys/lx_types.h>
+#include <sys/lx_misc.h>
+
+#define	LX_NAMEMAX	256
+
+#define	LX_GETDENTS_MAX_BUFSZ	65536
+
+/*
+ * See the comment in our lx_sysfs VFS code for a detailed explanation around
+ * the handling of 'd_type' here.
+ */
+#define	LX_DT_UNKNOWN	0
+#define	LX_DT_FIFO	1
+#define	LX_DT_CHR	2
+#define	LX_DT_DIR	4
+#define	LX_DT_BLK	6
+#define	LX_DT_REG	8
+#define	LX_DT_LNK	10
+#define	LX_DT_SOCK	12
+
+/*
+ * Set by lx_sysfs when it loads. lx_sysfs depends on the lx_brand module,
+ * so our module has to load first and define the variables that lx_sysfs will
+ * set when it loads.
+ */
+int lx_sysfs_vfs_type;
+int (*lx_sysfs_vtype)(ino_t);
+
+/*
+ * Because the Linux dirent has an extra field (d_type), it's possible that
+ * each entry will be 8 bytes larger (and aligned to 8 bytes) due to padding.
+ * To prevent overrun during translation, the illumos-native buffer is sized
+ * pessimistically.
+ */
+#define	LTOS_GETDENTS_BUFSZ(bufsz, datasz)	\
+	(((bufsz) / (((datasz) + 15) & ~7)) * sizeof (struct dirent))
+
+/*
+ * Linux d_type offset is at (d_reclen - 1). See the Linux getdents(2) man page.
+ * This macro assumes d_reclen is already set correctly.
+ */
+#define	LX_DTYPE(l) *(((char *)l) + (l->d_reclen - 1))
+
+/*
+ * Record must be long enough to house d_name string, null terminator and
+ * d_type field.  It's then padded to nearest 8-byte boundary
+ */
+#define	LX_RECLEN(l, t)	\
+	((offsetof(t, d_name) + 2 + (l) + 7) & ~7)
+
+/*
+ * Bytes after d_name string until d_reclen should be zeroed.
+ * Includes zero-terminating d_name
+ */
+#define	LX_ZEROLEN(l, t)	\
+	(LX_RECLEN(l, t) -	\
+	((offsetof(t, d_name) + (l))))
+
+/* The output format of getdents differs if the caller is 32 or 64 bit. */
+struct lx_dirent_32 {
+	uint32_t	d_ino;
+	int32_t		d_off;
+	ushort_t	d_reclen;
+	char		d_name[1];
+	uchar_t		d_type;
+};
+
+struct lx_dirent_64 {
+	uint64_t	d_ino;
+	int64_t		d_off;
+	ushort_t	d_reclen;
+	char		d_name[1];
+	uchar_t		d_type;
+};
+
+static long
+lx_getdents_common(int fd, caddr_t uptr, size_t count,
+    unsigned int lx_size, int (*outcb)(caddr_t, caddr_t, int, boolean_t))
+{
+	vnode_t *vp;
+	boolean_t is_sysfs = B_FALSE;
+	file_t *fp;
+	struct uio auio;
+	struct iovec aiov;
+	int error, at_eof;
+	int sbufsz, lbufsz, bufsz;
+	void *lbuf, *sbuf;
+	size_t outb = 0;
+
+	if (count < lx_size) {
+		return (set_errno(EINVAL));
+	}
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+	vp = fp->f_vnode;
+	if (vp->v_type != VDIR) {
+		releasef(fd);
+		return (set_errno(ENOTDIR));
+	}
+	if (!(fp->f_flag & FREAD)) {
+		releasef(fd);
+		return (set_errno(EBADF));
+	}
+
+	if (vp->v_vfsp->vfs_fstype == lx_sysfs_vfs_type) {
+		is_sysfs = B_TRUE;
+	}
+
+	if (count > LX_GETDENTS_MAX_BUFSZ) {
+		/*
+		 * If the target buffer passed to us is huge, keep the
+		 * translation buffers moderate in size.  Iteration will be
+		 * used to fill the request.
+		 */
+		lbufsz = LX_GETDENTS_MAX_BUFSZ;
+		sbufsz = LTOS_GETDENTS_BUFSZ(LX_GETDENTS_MAX_BUFSZ, lx_size);
+	} else if (count < (lx_size + MAXPATHLEN)) {
+		/*
+		 * If the target buffer is tiny, allocate a Linux-format buffer
+		 * big enough to hold at least one max-length row while keeping
+		 * the illumos-format buffer pesimistic in size.
+		 *
+		 * Assuming the buffer is truely tiny, it's likely that the
+		 * result will not fit and an EINVAL will be tossed.
+		 */
+		lbufsz = (lx_size + MAXPATHLEN);
+		sbufsz = MAX((LTOS_GETDENTS_BUFSZ(count, lx_size)),
+		    sizeof (struct dirent));
+	} else {
+		lbufsz = count;
+		sbufsz = LTOS_GETDENTS_BUFSZ(count, lx_size);
+	}
+	bufsz = sbufsz;
+	lbuf = kmem_alloc(lbufsz, KM_SLEEP);
+	sbuf = kmem_alloc(sbufsz, KM_SLEEP);
+
+	aiov.iov_base = sbuf;
+	aiov.iov_len = sbufsz;
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = fp->f_offset;
+	auio.uio_segflg = UIO_SYSSPACE;
+	auio.uio_resid = sbufsz;
+	auio.uio_fmode = 0;
+	auio.uio_extflg = UIO_COPY_CACHED;
+
+	/*
+	 * Since we use a conservative buffer allocation for the differing
+	 * struct sizing and Linux places fewer limits on getdents buffers in
+	 * general, there's a chance we'll undershoot on the record count.
+	 * When this happens, we can simply repeat the READDIR operation until
+	 * the available records are exhausted or we've filled the user buffer.
+	 */
+	do {
+		int res;
+
+		(void) VOP_RWLOCK(vp, V_WRITELOCK_FALSE, NULL);
+		error = VOP_READDIR(vp, &auio, fp->f_cred, &at_eof, NULL, 0);
+		VOP_RWUNLOCK(vp, V_WRITELOCK_FALSE, NULL);
+		if (error != 0 || auio.uio_resid == sbufsz) {
+			break;
+		}
+		res = outcb(sbuf, lbuf, bufsz - auio.uio_resid, is_sysfs);
+		VERIFY(res <= lbufsz);
+		if (res == 0) {
+			/* no records to copyout from this batch */
+			break;
+		} else if (res > count) {
+			/*
+			 * For very small buffer sizes, it's possible that a
+			 * single record is too large due to a long filename.
+			 */
+			error = EINVAL;
+			break;
+		}
+
+		VERIFY(outb + res <= count);
+		if (copyout(lbuf, (void *)(uptr + outb), res) != 0) {
+			error = EFAULT;
+			break;
+		}
+		outb += res;
+
+		/*
+		 * We undershot the request buffer.
+		 * Reset for another READDIR, taking care not to overshoot.
+		 */
+		bufsz = MIN(sbufsz, LTOS_GETDENTS_BUFSZ(count - outb, lx_size));
+		auio.uio_resid = bufsz;
+		aiov.iov_len = bufsz;
+		aiov.iov_base = sbuf;
+
+		/*
+		 * Continued progress is allowed only if EOF has not been
+		 * reached and there is enough remaining buffer space to hold
+		 * an entry with a max-length filename.
+		 */
+	} while (at_eof == 0 && (count - outb) >= (lx_size + MAXPATHLEN));
+
+	kmem_free(lbuf, lbufsz);
+	kmem_free(sbuf, sbufsz);
+
+	if (error) {
+		releasef(fd);
+		return (set_errno(error));
+	}
+
+	fp->f_offset = auio.uio_loffset;
+	releasef(fd);
+	return (outb);
+}
+
+static int
+lx_get_sysfs_dtype(ino_t ino)
+{
+	vtype_t vt;
+
+	vt = lx_sysfs_vtype(ino);
+
+	switch (vt) {
+	case VREG:	return (LX_DT_REG);
+	case VDIR:	return (LX_DT_DIR);
+	case VBLK:	return (LX_DT_BLK);
+	case VCHR:	return (LX_DT_CHR);
+	case VLNK:	return (LX_DT_LNK);
+	case VFIFO:	return (LX_DT_FIFO);
+	case VSOCK:	return (LX_DT_SOCK);
+	default:	return (LX_DT_UNKNOWN);
+	}
+}
+
+static int
+lx_getdents_format32(caddr_t sbuf, caddr_t lbuf, int len, boolean_t is_sysfs)
+{
+	struct dirent *sd;
+	struct lx_dirent_32 *ld;
+	int namelen;
+	int size = 0;
+
+	while (len > 0) {
+		/* LINTED: alignment */
+		sd = (struct dirent *)sbuf;
+		/* LINTED: alignment */
+		ld = (struct lx_dirent_32 *)lbuf;
+		namelen = MIN(strlen(sd->d_name), LX_NAMEMAX - 1);
+
+		ld->d_ino = sd->d_ino;
+		ld->d_off = sd->d_off;
+		(void) strncpy(ld->d_name, sd->d_name, namelen);
+		ld->d_name[namelen] = 0;
+		ld->d_reclen = (ushort_t)LX_RECLEN(namelen,
+		    struct lx_dirent_32);
+		/* Zero out any alignment padding and d_type */
+		bzero(ld->d_name + namelen,
+		    LX_ZEROLEN(namelen, struct lx_dirent_32));
+
+		if (is_sysfs) {
+			LX_DTYPE(ld) = lx_get_sysfs_dtype(ld->d_ino);
+		}
+
+		len -= sd->d_reclen;
+		size += ld->d_reclen;
+		sbuf += sd->d_reclen;
+		lbuf += ld->d_reclen;
+	}
+	return (size);
+}
+
+static int
+lx_getdents_format64(caddr_t sbuf, caddr_t lbuf, int len, boolean_t is_sysfs)
+{
+	struct dirent *sd;
+	struct lx_dirent_64 *ld;
+	int namelen;
+	int size = 0;
+
+	while (len > 0) {
+		/* LINTED: alignment */
+		sd = (struct dirent *)sbuf;
+		/* LINTED: alignment */
+		ld = (struct lx_dirent_64 *)lbuf;
+		namelen = MIN(strlen(sd->d_name), LX_NAMEMAX - 1);
+
+		ld->d_ino = sd->d_ino;
+		ld->d_off = sd->d_off;
+		(void) strncpy(ld->d_name, sd->d_name, namelen);
+		ld->d_name[namelen] = 0;
+		ld->d_reclen = (ushort_t)LX_RECLEN(namelen,
+		    struct lx_dirent_64);
+		/* Zero out any alignment padding and d_type */
+		bzero(ld->d_name + namelen,
+		    LX_ZEROLEN(namelen, struct lx_dirent_64));
+
+		if (is_sysfs) {
+			LX_DTYPE(ld) = lx_get_sysfs_dtype(ld->d_ino);
+		}
+
+		len -= sd->d_reclen;
+		size += ld->d_reclen;
+		sbuf += sd->d_reclen;
+		lbuf += ld->d_reclen;
+	}
+	return (size);
+}
+
+long
+lx_getdents_32(int fd, caddr_t buf, size_t count)
+{
+	return (lx_getdents_common(fd, buf, count,
+	    sizeof (struct lx_dirent_32), lx_getdents_format32));
+}
+
+long
+lx_getdents_64(int fd, caddr_t buf, size_t count)
+{
+	return (lx_getdents_common(fd, buf, count,
+	    sizeof (struct lx_dirent_64), lx_getdents_format64));
+}
+
+struct lx_dirent64 {
+	uint64_t	d_ino;
+	int64_t		d_off;
+	ushort_t	d_reclen;
+	uchar_t		d_type;
+	char		d_name[1];
+};
+
+#define	LX_RECLEN64(namelen)	\
+	((offsetof(struct lx_dirent64, d_name) + 1 + (namelen) + 7) & ~7)
+
+#define	LX_ZEROLEN64(namelen)	\
+	(LX_RECLEN64(namelen) -	\
+	((offsetof(struct lx_dirent64, d_name) + (namelen))))
+
+static int
+lx_getdents64_format(caddr_t sbuf, caddr_t lbuf, int len, boolean_t is_sysfs)
+{
+	struct dirent *sd;
+	struct lx_dirent64 *ld;
+	int namelen;
+	int size = 0;
+
+	while (len > 0) {
+		/* LINTED: alignment */
+		sd = (struct dirent *)sbuf;
+		/* LINTED: alignment */
+		ld = (struct lx_dirent64 *)lbuf;
+		namelen = MIN(strlen(sd->d_name), LX_NAMEMAX - 1);
+
+		ld->d_ino = sd->d_ino;
+		ld->d_off = sd->d_off;
+		ld->d_type = LX_DT_UNKNOWN;
+		(void) strncpy(ld->d_name, sd->d_name, namelen);
+		ld->d_name[namelen] = 0;
+		ld->d_reclen = (ushort_t)LX_RECLEN64(namelen);
+		/* Zero out any alignment padding */
+		bzero(ld->d_name + namelen, LX_ZEROLEN64(namelen));
+
+		if (is_sysfs) {
+			ld->d_type = lx_get_sysfs_dtype(ld->d_ino);
+		}
+
+		len -= sd->d_reclen;
+		size += ld->d_reclen;
+		sbuf += sd->d_reclen;
+		lbuf += ld->d_reclen;
+	}
+	return (size);
+}
+
+
+long
+lx_getdents64(int fd, caddr_t buf, size_t count)
+{
+	return (lx_getdents_common(fd, buf, count,
+	    sizeof (struct lx_dirent64), lx_getdents64_format));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_getpid.c b/usr/src/uts/common/brand/lx/syscall/lx_getpid.c
new file mode 100644
index 0000000000..0ebd93304e
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_getpid.c
@@ -0,0 +1,75 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/zone.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/cpuvar.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+
+/*
+ * return the pid
+ */
+long
+lx_getpid(void)
+{
+	lx_lwp_data_t *lwpd = ttolxlwp(curthread);
+	long rv;
+
+	if (curproc->p_pid == curproc->p_zone->zone_proc_initpid) {
+		rv = 1;
+	} else {
+		VERIFY(lwpd != NULL);
+
+		rv = lwpd->br_tgid;
+	}
+
+	return (rv);
+}
+
+/*
+ * return the parent pid
+ */
+long
+lx_getppid(void)
+{
+	return (lx_lwp_ppid(ttolwp(curthread), NULL, NULL));
+}
+
+/*
+ * return the thread id
+ */
+long
+lx_gettid(void)
+{
+	lx_lwp_data_t *lwpd = ttolxlwp(curthread);
+
+	return (lwpd->br_pid == curzone->zone_proc_initpid ? 1 : lwpd->br_pid);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_getrandom.c b/usr/src/uts/common/brand/lx/syscall/lx_getrandom.c
new file mode 100644
index 0000000000..acc4073483
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_getrandom.c
@@ -0,0 +1,33 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+
+/*
+ * From "uts/common/syscall/getrandom.c":
+ */
+extern int getrandom(void *, size_t, int);
+
+long
+lx_getrandom(void *bufp, size_t buflen, int flags)
+{
+	/*
+	 * According to signal(7), calls to getrandom(2) are restartable.
+	 */
+	ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+
+	return (getrandom(bufp, buflen, flags));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_id.c b/usr/src/uts/common/brand/lx/syscall/lx_id.c
new file mode 100644
index 0000000000..67f0fc9e5e
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_id.c
@@ -0,0 +1,509 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/zone.h>
+#include <sys/cred.h>
+#include <sys/cred_impl.h>
+#include <sys/policy.h>
+#include <sys/lx_types.h>
+
+#define	LX_NGROUPS_MAX	32
+
+/* From usr/src/uts/common/syscall/gid.c & uid.c */
+extern int setgid(gid_t);
+extern int setregid(gid_t, gid_t);
+extern int setreuid(uid_t, uid_t);
+extern int setuid(uid_t);
+
+/* From usr/src/uts/common/syscall/groups.c */
+extern int setgroups(int, gid_t *);
+
+long
+lx_getegid(void)
+{
+	return (crgetgid(CRED()));
+}
+
+long
+lx_getegid16(void)
+{
+	return ((int)LX_GID32_TO_GID16(crgetgid(CRED())));
+}
+
+long
+lx_geteuid(void)
+{
+	return (crgetuid(CRED()));
+}
+
+long
+lx_geteuid16(void)
+{
+	return ((int)LX_UID32_TO_UID16(crgetuid(CRED())));
+}
+
+long
+lx_getgid(void)
+{
+	return (crgetrgid(CRED()));
+}
+
+long
+lx_getgid16(void)
+{
+	return ((int)LX_GID32_TO_GID16(crgetrgid(CRED())));
+}
+
+long
+lx_getuid(void)
+{
+	return (crgetruid(CRED()));
+}
+
+long
+lx_getuid16(void)
+{
+	return ((int)LX_UID32_TO_UID16(crgetruid(CRED())));
+}
+
+long
+lx_setgid(gid_t gid)
+{
+	return (setgid(gid));
+}
+
+long
+lx_setgid16(lx_gid16_t gid)
+{
+	return (setgid(LX_GID16_TO_GID32(gid)));
+}
+
+long
+lx_setregid(gid_t rgid, gid_t egid)
+{
+	return (setregid(rgid, egid));
+}
+
+long
+lx_setregid16(lx_gid16_t rgid, lx_gid16_t egid)
+{
+	return (setregid(LX_UID16_TO_UID32(rgid), LX_UID16_TO_UID32(egid)));
+}
+
+long
+lx_setreuid(uid_t ruid, uid_t euid)
+{
+	return (setreuid(ruid, euid));
+}
+
+long
+lx_setreuid16(lx_uid16_t ruid, lx_uid16_t euid)
+{
+	return (setreuid(LX_UID16_TO_UID32(ruid), LX_UID16_TO_UID32(euid)));
+}
+
+long
+lx_setuid(uid_t uid)
+{
+	return (setuid(uid));
+}
+
+long
+lx_setuid16(lx_uid16_t uid)
+{
+	return (setuid(LX_UID16_TO_UID32(uid)));
+}
+
+/*
+ * This function is based on setreuid in common/syscall/uid.c and exists
+ * because illumos does not have a way to explicitly set the saved uid (suid)
+ * from any other system call.
+ */
+long
+lx_setresuid(lx_uid_t ruid, lx_uid_t euid, lx_uid_t suid)
+{
+	proc_t	*p;
+	int	error = 0;
+	int	do_nocd = 0;
+	int	uidchge = 0;
+	uid_t	oldruid = ruid;
+	cred_t	*cr, *newcr;
+	zoneid_t zoneid = getzoneid();
+
+	if ((ruid != -1 && (ruid > MAXUID)) ||
+	    (euid != -1 && (euid > MAXUID)) ||
+	    (suid != -1 && (suid > MAXUID))) {
+		error = EINVAL;
+		goto done;
+	}
+
+	/*
+	 * Need to pre-allocate the new cred structure before grabbing
+	 * the p_crlock mutex.
+	 */
+	newcr = cralloc();
+
+	p = ttoproc(curthread);
+
+retry:
+	mutex_enter(&p->p_crlock);
+	cr = p->p_cred;
+
+	if (ruid != -1 &&
+	    ruid != cr->cr_ruid && ruid != cr->cr_uid &&
+	    ruid != cr->cr_suid && secpolicy_allow_setid(cr, ruid, B_FALSE)) {
+		error = EPERM;
+	} else if (euid != -1 &&
+	    euid != cr->cr_ruid && euid != cr->cr_uid &&
+	    euid != cr->cr_suid && secpolicy_allow_setid(cr, euid, B_FALSE)) {
+		error = EPERM;
+	} else if (suid != -1 &&
+	    suid != cr->cr_ruid && suid != cr->cr_uid &&
+	    suid != cr->cr_suid && secpolicy_allow_setid(cr, suid, B_FALSE)) {
+		error = EPERM;
+	} else {
+		if (!uidchge && ruid != -1 && cr->cr_ruid != ruid) {
+			/*
+			 * The ruid of the process is going to change. In order
+			 * to avoid a race condition involving the
+			 * process count associated with the newly given ruid,
+			 * we increment the count before assigning the
+			 * credential to the process.
+			 * To do that, we'll have to take pidlock, so we first
+			 * release p_crlock.
+			 */
+			mutex_exit(&p->p_crlock);
+			uidchge = 1;
+			mutex_enter(&pidlock);
+			upcount_inc(ruid, zoneid);
+			mutex_exit(&pidlock);
+			/*
+			 * As we released p_crlock we can't rely on the cr
+			 * we read. So retry the whole thing.
+			 */
+			goto retry;
+		}
+		crhold(cr);
+		crcopy_to(cr, newcr);
+		p->p_cred = newcr;
+
+		if (euid != -1)
+			newcr->cr_uid = euid;
+		if (suid != -1)
+			newcr->cr_suid = suid;
+		if (ruid != -1) {
+			oldruid = newcr->cr_ruid;
+			newcr->cr_ruid = ruid;
+			ASSERT(ruid != oldruid ? uidchge : 1);
+		}
+
+		/*
+		 * A process that gives up its privilege
+		 * must be marked to produce no core dump.
+		 */
+		if ((cr->cr_uid != newcr->cr_uid ||
+		    cr->cr_ruid != newcr->cr_ruid ||
+		    cr->cr_suid != newcr->cr_suid))
+			do_nocd = 1;
+
+		crfree(cr);
+	}
+	mutex_exit(&p->p_crlock);
+
+	/*
+	 * We decrement the number of processes associated with the oldruid
+	 * to match the increment above, even if the ruid of the process
+	 * did not change or an error occurred (oldruid == uid).
+	 */
+	if (uidchge) {
+		ASSERT(oldruid != -1 && ruid != -1);
+		mutex_enter(&pidlock);
+		upcount_dec(oldruid, zoneid);
+		mutex_exit(&pidlock);
+	}
+
+	if (error == 0) {
+		if (do_nocd) {
+			mutex_enter(&p->p_lock);
+			p->p_flag |= SNOCD;
+			mutex_exit(&p->p_lock);
+		}
+		crset(p, newcr);	/* broadcast to process threads */
+		goto done;
+	}
+	crfree(newcr);
+done:
+	if (error)
+		return (set_errno(error));
+	else
+		return (0);
+}
+
+long
+lx_setresuid16(lx_uid16_t ruid16, lx_uid16_t euid16, lx_uid16_t suid16)
+{
+	long	rval;
+
+	rval = lx_setresuid(
+	    LX_UID16_TO_UID32(ruid16),
+	    LX_UID16_TO_UID32(euid16),
+	    LX_UID16_TO_UID32(suid16));
+
+	return (rval);
+}
+
+/*
+ * This function is based on setregid in common/syscall/gid.c
+ */
+long
+lx_setresgid(lx_gid_t rgid, lx_gid_t egid, lx_gid_t sgid)
+{
+	proc_t	*p;
+	int	error = 0;
+	int	do_nocd = 0;
+	cred_t	*cr, *newcr;
+
+	if ((rgid != -1 && (rgid > MAXUID)) ||
+	    (egid != -1 && (egid > MAXUID)) ||
+	    (sgid != -1 && (sgid > MAXUID))) {
+		error = EINVAL;
+		goto done;
+	}
+
+	/*
+	 * Need to pre-allocate the new cred structure before grabbing
+	 * the p_crlock mutex.
+	 */
+	newcr = cralloc();
+
+	p = ttoproc(curthread);
+	mutex_enter(&p->p_crlock);
+	cr = p->p_cred;
+
+	if (rgid != -1 &&
+	    rgid != cr->cr_rgid && rgid != cr->cr_gid &&
+	    rgid != cr->cr_sgid && secpolicy_allow_setid(cr, -1, B_FALSE)) {
+		error = EPERM;
+	} else if (egid != -1 &&
+	    egid != cr->cr_rgid && egid != cr->cr_gid &&
+	    egid != cr->cr_sgid && secpolicy_allow_setid(cr, -1, B_FALSE)) {
+		error = EPERM;
+	} else if (sgid != -1 &&
+	    sgid != cr->cr_rgid && sgid != cr->cr_gid &&
+	    sgid != cr->cr_sgid && secpolicy_allow_setid(cr, -1, B_FALSE)) {
+		error = EPERM;
+	} else {
+		crhold(cr);
+		crcopy_to(cr, newcr);
+		p->p_cred = newcr;
+
+		if (egid != -1)
+			newcr->cr_gid = egid;
+		if (sgid != -1)
+			newcr->cr_sgid = sgid;
+		if (rgid != -1)
+			newcr->cr_rgid = rgid;
+
+		/*
+		 * A process that gives up its privilege
+		 * must be marked to produce no core dump.
+		 */
+		if ((cr->cr_gid != newcr->cr_gid ||
+		    cr->cr_rgid != newcr->cr_rgid ||
+		    cr->cr_sgid != newcr->cr_sgid))
+			do_nocd = 1;
+
+		crfree(cr);
+	}
+	mutex_exit(&p->p_crlock);
+
+	if (error == 0) {
+		if (do_nocd) {
+			mutex_enter(&p->p_lock);
+			p->p_flag |= SNOCD;
+			mutex_exit(&p->p_lock);
+		}
+		crset(p, newcr);	/* broadcast to process threads */
+		goto done;
+	}
+	crfree(newcr);
+done:
+	if (error)
+		return (set_errno(error));
+	else
+		return (0);
+}
+
+long
+lx_setresgid16(lx_gid16_t rgid16, lx_gid16_t egid16, lx_gid16_t sgid16)
+{
+	long	rval;
+
+	rval = lx_setresgid(
+	    LX_GID16_TO_GID32(rgid16),
+	    LX_GID16_TO_GID32(egid16),
+	    LX_GID16_TO_GID32(sgid16));
+
+	return (rval);
+}
+
+/*
+ * Linux defines NGROUPS_MAX to be 32, but on illumos it is only 16. We employ
+ * the terrible hack below so that tests may proceed, if only on DEBUG kernels.
+ */
+int
+lx_helper_setgroups(int ngroups, gid_t *grouplist)
+{
+#ifdef DEBUG
+	if (ngroups > ngroups_max && ngroups <= LX_NGROUPS_MAX)
+		ngroups = ngroups_max;
+#endif /* DEBUG */
+
+	return (setgroups(ngroups, grouplist));
+}
+
+long
+lx_getresuid(lx_uid_t *ruid, lx_uid_t *euid, lx_uid_t *suid)
+{
+	lx_uid_t lx_ruid, lx_euid, lx_suid;
+	cred_t *cr = CRED();
+
+	lx_ruid = (lx_uid_t)crgetruid(cr);
+	lx_euid = (lx_uid_t)crgetuid(cr);
+	lx_suid = (lx_uid_t)crgetsuid(cr);
+
+	if (copyout(&lx_ruid, (void *)ruid, sizeof (lx_uid_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_euid, (void *)euid, sizeof (lx_uid_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_suid, (void *)suid, sizeof (lx_uid_t)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+long
+lx_getresuid16(lx_uid16_t *ruid16, lx_uid16_t *euid16, lx_uid16_t *suid16)
+{
+	lx_uid16_t lx_ruid16, lx_euid16, lx_suid16;
+	cred_t *cr = CRED();
+
+	lx_ruid16 = LX_UID32_TO_UID16((lx_uid_t)crgetruid(cr));
+	lx_euid16 = LX_UID32_TO_UID16((lx_uid_t)crgetuid(cr));
+	lx_suid16 = LX_UID32_TO_UID16((lx_uid_t)crgetsuid(cr));
+
+	if (copyout(&lx_ruid16, (void *)ruid16, sizeof (lx_uid16_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_euid16, (void *)euid16, sizeof (lx_uid16_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_suid16, (void *)suid16, sizeof (lx_uid16_t)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+long
+lx_getresgid(lx_gid_t *rgid, lx_gid_t *egid, lx_gid_t *sgid)
+{
+	lx_gid_t lx_rgid, lx_egid, lx_sgid;
+	cred_t *cr = CRED();
+
+	lx_rgid = (lx_gid_t)crgetrgid(cr);
+	lx_egid = (lx_gid_t)crgetgid(cr);
+	lx_sgid = (lx_gid_t)crgetsgid(cr);
+
+	if (copyout(&lx_rgid, (void *)rgid, sizeof (lx_gid_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_egid, (void *)egid, sizeof (lx_gid_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_sgid, (void *)sgid, sizeof (lx_gid_t)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+long
+lx_getresgid16(lx_gid16_t *rgid16, lx_gid16_t *egid16, lx_gid16_t *sgid16)
+{
+	lx_gid16_t lx_rgid16, lx_egid16, lx_sgid16;
+	cred_t *cr = CRED();
+
+	lx_rgid16 = LX_GID32_TO_GID16((lx_gid_t)crgetrgid(cr));
+	lx_egid16 = LX_GID32_TO_GID16((lx_gid_t)crgetgid(cr));
+	lx_sgid16 = LX_GID32_TO_GID16((lx_gid_t)crgetsgid(cr));
+
+	if (copyout(&lx_rgid16, (void *)rgid16, sizeof (lx_gid16_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_egid16, (void *)egid16, sizeof (lx_gid16_t)) != 0)
+		return (set_errno(EFAULT));
+	if (copyout(&lx_sgid16, (void *)sgid16, sizeof (lx_gid16_t)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+/*
+ * The lx brand cannot support the setfs[ug]id16/setfs[ug]id calls as that
+ * would require significant rework of the illumos privilege mechanisms, so
+ * instead return the current effective [ug]id.
+ *
+ * In Linux, fsids track effective IDs, so returning the effective IDs works
+ * as a substitute; returning the current value also denotes failure of the
+ * call if the caller had specified something different.  We don't need to
+ * worry about setting error codes because the Linux calls don't set any.
+ */
+/*ARGSUSED*/
+long
+lx_setfsuid16(uid_t fsuid16)
+{
+	return ((int)LX_UID32_TO_UID16(crgetuid(CRED())));
+}
+
+/*ARGSUSED*/
+long
+lx_setfsgid16(gid_t fsgid16)
+{
+	return ((int)LX_GID32_TO_GID16(crgetgid(CRED())));
+}
+
+/*ARGSUSED*/
+long
+lx_setfsuid(uid_t fsuid)
+{
+	return (crgetuid(CRED()));
+}
+
+/*ARGSUSED*/
+long
+lx_setfsgid(gid_t fsgid)
+{
+	return (crgetgid(CRED()));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_ioctl.c b/usr/src/uts/common/brand/lx/syscall/lx_ioctl.c
new file mode 100644
index 0000000000..9d8d88d6f6
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_ioctl.c
@@ -0,0 +1,1865 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/errno.h>
+#include <sys/systm.h>
+#include <sys/file.h>
+#include <sys/filio.h>
+#include <sys/vnode.h>
+#include <sys/fcntl.h>
+#include <sys/termio.h>
+#include <sys/termios.h>
+#include <sys/ptyvar.h>
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <sys/sockio.h>
+#include <sys/stropts.h>
+#include <sys/ptms.h>
+#include <sys/cred.h>
+#include <sys/cred_impl.h>
+#include <sys/sysmacros.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_ptm.h>
+#include <sys/brand.h>
+#include <sys/sunddi.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/session.h>
+#include <sys/kmem.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <net/if_arp.h>
+#include <sys/ioccom.h>
+#include <sys/dtrace.h>
+#include <sys/ethernet.h>
+#include <sys/dlpi.h>
+#include <sys/lx_autofs.h>
+#include <sys/netstack.h>
+#include <inet/ip.h>
+#include <inet/ip_if.h>
+#include <sys/dkio.h>
+#include <sys/sdt.h>
+
+/*
+ * Linux ioctl types
+ */
+#define	LX_IOC_TYPE_HD		0x03
+#define	LX_IOC_TYPE_BLK		0x12
+#define	LX_IOC_TYPE_FD		0x54
+#define	LX_IOC_TYPE_DTRACE	0x68
+#define	LX_IOC_TYPE_SOCK	0x89
+#define	LX_IOC_TYPE_AUTOFS	0x93
+
+/*
+ * Supported ioctls
+ */
+#define	LX_HDIO_GETGEO		0x0301
+#define	LX_BLKGETSIZE		0x1260
+#define	LX_BLKSSZGET		0x1268
+#define	LX_BLKGETSIZE64		0x80081272
+#define	LX_TCGETS		0x5401
+#define	LX_TCSETS		0x5402
+#define	LX_TCSETSW		0x5403
+#define	LX_TCSETSF		0x5404
+#define	LX_TCGETA		0x5405
+#define	LX_TCSETA		0x5406
+#define	LX_TCSETAW		0x5407
+#define	LX_TCSETAF		0x5408
+#define	LX_TCSBRK		0x5409
+#define	LX_TCXONC		0x540a
+#define	LX_TCFLSH		0x540b
+#define	LX_TIOCEXCL		0x540c
+#define	LX_TIOCNXCL		0x540d
+#define	LX_TIOCSCTTY		0x540e
+#define	LX_TIOCGPGRP		0x540f
+#define	LX_TIOCSPGRP		0x5410
+#define	LX_TIOCOUTQ		0x5411
+#define	LX_TIOCSTI		0x5412
+#define	LX_TIOCGWINSZ		0x5413
+#define	LX_TIOCSWINSZ		0x5414
+#define	LX_TIOCMGET		0x5415
+#define	LX_TIOCMBIS		0x5416
+#define	LX_TIOCMBIC		0x5417
+#define	LX_TIOCMSET		0x5418
+#define	LX_TIOCGSOFTCAR		0x5419
+#define	LX_TIOCSSOFTCAR		0x541a
+#define	LX_FIONREAD		0x541b
+#define	LX_TIOCPKT		0x5420
+#define	LX_FIONBIO		0x5421
+#define	LX_TIOCNOTTY		0x5422
+#define	LX_TIOCSETD		0x5423
+#define	LX_TIOCGETD		0x5424
+#define	LX_TCSBRKP		0x5425
+#define	LX_TIOCGSID		0x5429
+#define	LX_TIOCGPTN		0x80045430
+#define	LX_TIOCSPTLCK		0x40045431
+#define	LX_FIONCLEX		0x5450
+#define	LX_FIOCLEX		0x5451
+#define	LX_FIOASYNC		0x5452
+#define	LX_FIOSETOWN		0x8901
+#define	LX_SIOCSPGRP		0x8902
+#define	LX_FIOGETOWN		0x8903
+#define	LX_SIOCGPGRP		0x8904
+#define	LX_SIOCATMARK		0x8905
+#define	LX_SIOCGSTAMP		0x8906
+#define	LX_SIOCADDRT		0x890b
+#define	LX_SIOCDELRT		0x890c
+#define	LX_SIOCRTMSG		0x890d
+#define	LX_SIOCGIFNAME		0x8910
+#define	LX_SIOCSIFLINK		0x8911
+#define	LX_SIOCGIFCONF		0x8912
+#define	LX_SIOCGIFFLAGS		0x8913
+#define	LX_SIOCSIFFLAGS		0x8914
+#define	LX_SIOCGIFADDR		0x8915
+#define	LX_SIOCSIFADDR		0x8916
+#define	LX_SIOCGIFDSTADDR	0x8917
+#define	LX_SIOCSIFDSTADDR	0x8918
+#define	LX_SIOCGIFBRDADDR	0x8919
+#define	LX_SIOCSIFBRDADDR	0x891a
+#define	LX_SIOCGIFNETMASK	0x891b
+#define	LX_SIOCSIFNETMASK	0x891c
+#define	LX_SIOCGIFMETRIC	0x891d
+#define	LX_SIOCSIFMETRIC	0x891e
+#define	LX_SIOCGIFMEM		0x891f
+#define	LX_SIOCSIFMEM		0x8920
+#define	LX_SIOCGIFMTU		0x8921
+#define	LX_SIOCSIFMTU		0x8922
+#define	LX_SIOCSIFNAME		0x8923
+#define	LX_SIOCSIFHWADDR	0x8924
+#define	LX_SIOCGIFENCAP		0x8925
+#define	LX_SIOCSIFENCAP		0x8926
+#define	LX_SIOCGIFHWADDR	0x8927
+#define	LX_SIOCGIFSLAVE		0x8929
+#define	LX_SIOCSIFSLAVE		0x8930
+#define	LX_SIOCADDMULTI		0x8931
+#define	LX_SIOCDELMULTI		0x8932
+#define	LX_SIOCGIFINDEX		0x8933
+#define	LX_SIOCSIFPFLAGS	0x8934
+#define	LX_SIOCGIFPFLAGS	0x8935
+#define	LX_SIOCDIFADDR		0x8936
+#define	LX_SIOCSIFHWBROADCAST	0x8937
+#define	LX_SIOCGIFCOUNT		0x8938
+#define	LX_SIOCGIFBR		0x8940
+#define	LX_SIOCSIFBR		0x8941
+#define	LX_SIOCGIFTXQLEN	0x8942
+#define	LX_SIOCSIFTXQLEN	0x8943
+#define	LX_SIOCETHTOOL		0x8946
+#define	LX_SIOCGMIIPHY		0x8947
+#define	LX_SIOCGMIIREG		0x8948
+#define	LX_SIOCSMIIREG		0x8949
+#define	LX_SIOCWANDEV		0x894a
+#define	LX_SIOCOUTQNSD		0x894b
+#define	LX_SIOCDARP		0x8953
+#define	LX_SIOCGARP		0x8954
+#define	LX_SIOCSARP		0x8955
+#define	LX_SIOCDRARP		0x8960
+#define	LX_SIOCGRARP		0x8961
+#define	LX_SIOCSRARP		0x8962
+#define	LX_SIOCGIFMAP		0x8970
+#define	LX_SIOCSIFMAP		0x8971
+#define	LX_SIOCADDDLCI		0x8980
+#define	LX_SIOCDELDLCI		0x8981
+#define	LX_SIOCGIFVLAN		0x8982
+#define	LX_SIOCSIFVLAN		0x8983
+#define	LX_SIOCBONDENSLAVE	0x8990
+#define	LX_SIOCBONDRELEASE	0x8991
+#define	LX_SIOCBONDSETHWADDR	0x8992
+#define	LX_SIOCBONDSLAVEINFOQUERY 0x8993
+#define	LX_SIOCBONDINFOQUERY	0x8994
+#define	LX_SIOCBONDCHANGEACTIVE	0x8995
+#define	LX_SIOCBRADDBR		0x89a0
+#define	LX_SIOCBRDELBR		0x89a1
+#define	LX_SIOCBRADDIF		0x89a2
+#define	LX_SIOCBRDELIF		0x89a3
+#define	LX_SIOCSHWTSTAMP	0x89b0
+#define	LX_SIOCGHWTSTAMP	0x89b1
+#define	LX_SIOCDEVPRIVATE	0x89f0
+#define	LX_SIOCPROTOPRIVATE	0x89e0
+
+#define	FLUSER(fp)	fp->f_flag | get_udatamodel()
+#define	FLFAKE(fp)	fp->f_flag | FKIOCTL
+
+/*
+ * LX_NCC must be different from LX_NCCS since while the termio and termios
+ * structures may look similar they are fundamentally different sizes and
+ * have different members.
+ */
+#define	LX_NCC	8
+#define	LX_NCCS	19
+
+struct lx_termio {
+	unsigned short c_iflag;		/* input mode flags */
+	unsigned short c_oflag;		/* output mode flags */
+	unsigned short c_cflag;		/* control mode flags */
+	unsigned short c_lflag;		/* local mode flags */
+	unsigned char c_line;		/* line discipline */
+	unsigned char c_cc[LX_NCC];	/* control characters */
+};
+
+struct lx_termios {
+	uint32_t c_iflag;		/* input mode flags */
+	uint32_t c_oflag;		/* output mode flags */
+	uint32_t c_cflag;		/* control mode flags */
+	uint32_t c_lflag;		/* local mode flags */
+	unsigned char c_line;		/* line discipline */
+	unsigned char c_cc[LX_NCCS];	/* control characters */
+};
+
+/*
+ * c_cc characters which are valid for lx_termio and lx_termios
+ */
+#define	LX_VINTR	0
+#define	LX_VQUIT	1
+#define	LX_VERASE	2
+#define	LX_VKILL	3
+#define	LX_VEOF		4
+#define	LX_VTIME	5
+#define	LX_VMIN		6
+#define	LX_VSWTC	7
+
+/*
+ * c_cc characters which are valid for lx_termios
+ */
+#define	LX_VSTART	8
+#define	LX_VSTOP	9
+#define	LX_VSUSP	10
+#define	LX_VEOL		11
+#define	LX_VREPRINT	12
+#define	LX_VDISCARD	13
+#define	LX_VWERASE	14
+#define	LX_VLNEXT	15
+#define	LX_VEOL2	16
+
+/*
+ * Defaults needed for SunOS to Linux format conversion.
+ * See INIT_C_CC in linux-stable/include/asm-generic/termios.h
+ */
+#define	LX_DEF_VTIME	0
+#define	LX_DEF_VMIN	1
+#define	LX_DEF_VEOF	'\004'
+#define	LX_DEF_VEOL	0
+
+/* VSD key for lx_cc information */
+static uint_t lx_ioctl_vsd = 0;
+
+
+/* Terminal helpers */
+
+static void
+l2s_termios(struct lx_termios *l_tios, struct termios *s_tios)
+{
+	ASSERT((l_tios != NULL) && (s_tios != NULL));
+
+	bzero(s_tios, sizeof (*s_tios));
+
+	s_tios->c_iflag = l_tios->c_iflag;
+	s_tios->c_oflag = l_tios->c_oflag;
+	s_tios->c_cflag = l_tios->c_cflag;
+	s_tios->c_lflag = l_tios->c_lflag;
+
+	if (s_tios->c_lflag & ICANON) {
+		s_tios->c_cc[VEOF] = l_tios->c_cc[LX_VEOF];
+		s_tios->c_cc[VEOL] = l_tios->c_cc[LX_VEOL];
+	} else {
+		s_tios->c_cc[VMIN] = l_tios->c_cc[LX_VMIN];
+		s_tios->c_cc[VTIME] = l_tios->c_cc[LX_VTIME];
+	}
+
+	s_tios->c_cc[VEOL2] = l_tios->c_cc[LX_VEOL2];
+	s_tios->c_cc[VERASE] = l_tios->c_cc[LX_VERASE];
+	s_tios->c_cc[VKILL] = l_tios->c_cc[LX_VKILL];
+	s_tios->c_cc[VREPRINT] = l_tios->c_cc[LX_VREPRINT];
+	s_tios->c_cc[VLNEXT] = l_tios->c_cc[LX_VLNEXT];
+	s_tios->c_cc[VWERASE] = l_tios->c_cc[LX_VWERASE];
+	s_tios->c_cc[VINTR] = l_tios->c_cc[LX_VINTR];
+	s_tios->c_cc[VQUIT] = l_tios->c_cc[LX_VQUIT];
+	s_tios->c_cc[VSWTCH] = l_tios->c_cc[LX_VSWTC];
+	s_tios->c_cc[VSTART] = l_tios->c_cc[LX_VSTART];
+	s_tios->c_cc[VSTOP] = l_tios->c_cc[LX_VSTOP];
+	s_tios->c_cc[VSUSP] = l_tios->c_cc[LX_VSUSP];
+	s_tios->c_cc[VDISCARD] = l_tios->c_cc[LX_VDISCARD];
+}
+
+static void
+l2s_termio(struct lx_termio *l_tio, struct termio *s_tio)
+{
+	ASSERT((l_tio != NULL) && (s_tio != NULL));
+
+	bzero(s_tio, sizeof (*s_tio));
+
+	s_tio->c_iflag = l_tio->c_iflag;
+	s_tio->c_oflag = l_tio->c_oflag;
+	s_tio->c_cflag = l_tio->c_cflag;
+	s_tio->c_lflag = l_tio->c_lflag;
+
+	if (s_tio->c_lflag & ICANON) {
+		s_tio->c_cc[VEOF] = l_tio->c_cc[LX_VEOF];
+	} else {
+		s_tio->c_cc[VMIN] = l_tio->c_cc[LX_VMIN];
+		s_tio->c_cc[VTIME] = l_tio->c_cc[LX_VTIME];
+	}
+
+	s_tio->c_cc[VINTR] = l_tio->c_cc[LX_VINTR];
+	s_tio->c_cc[VQUIT] = l_tio->c_cc[LX_VQUIT];
+	s_tio->c_cc[VERASE] = l_tio->c_cc[LX_VERASE];
+	s_tio->c_cc[VKILL] = l_tio->c_cc[LX_VKILL];
+	s_tio->c_cc[VSWTCH] = l_tio->c_cc[LX_VSWTC];
+}
+
+static void
+termios2lx_cc(struct lx_termios *l_tios, struct lx_cc *lio)
+{
+	ASSERT((l_tios != NULL) && (lio != NULL));
+
+	bzero(lio, sizeof (*lio));
+
+	lio->veof = l_tios->c_cc[LX_VEOF];
+	lio->veol = l_tios->c_cc[LX_VEOL];
+	lio->vmin = l_tios->c_cc[LX_VMIN];
+	lio->vtime = l_tios->c_cc[LX_VTIME];
+}
+
+static void
+termio2lx_cc(struct lx_termio *l_tio, struct lx_cc *lio)
+{
+	ASSERT((l_tio != NULL) && (lio != NULL));
+
+	bzero(lio, sizeof (*lio));
+
+	lio->veof = l_tio->c_cc[LX_VEOF];
+	lio->veol = 0;
+	lio->vmin = l_tio->c_cc[LX_VMIN];
+	lio->vtime = l_tio->c_cc[LX_VTIME];
+}
+
+static void
+s2l_termios(struct termios *s_tios, struct lx_termios *l_tios)
+{
+	ASSERT((s_tios != NULL) && (l_tios != NULL));
+
+	bzero(l_tios, sizeof (*l_tios));
+
+	l_tios->c_iflag = s_tios->c_iflag;
+	l_tios->c_oflag = s_tios->c_oflag;
+	l_tios->c_cflag = s_tios->c_cflag;
+	l_tios->c_lflag = s_tios->c_lflag;
+
+	/*
+	 * Since use of the VMIN/VTIME and VEOF/VEOL control characters is
+	 * mutually exclusive (determined by ICANON), SunOS aliases them in the
+	 * c_cc field in termio/termios.  Linux does not perform this aliasing,
+	 * so it expects that the default values are present regardless of
+	 * ICANON status.
+	 *
+	 * These defaults can be overridden later by any values stored via the
+	 * lx_cc mechanism.
+	 */
+	if (s_tios->c_lflag & ICANON) {
+		l_tios->c_cc[LX_VEOF] = s_tios->c_cc[VEOF];
+		l_tios->c_cc[LX_VEOL] = s_tios->c_cc[VEOL];
+		l_tios->c_cc[LX_VTIME] = LX_DEF_VTIME;
+		l_tios->c_cc[LX_VMIN] = LX_DEF_VMIN;
+
+	} else {
+		l_tios->c_cc[LX_VMIN] = s_tios->c_cc[VMIN];
+		l_tios->c_cc[LX_VTIME] = s_tios->c_cc[VTIME];
+		l_tios->c_cc[LX_VEOF] = LX_DEF_VEOF;
+		l_tios->c_cc[LX_VEOL] = LX_DEF_VEOL;
+	}
+
+	l_tios->c_cc[LX_VEOL2] = s_tios->c_cc[VEOL2];
+	l_tios->c_cc[LX_VERASE] = s_tios->c_cc[VERASE];
+	l_tios->c_cc[LX_VKILL] = s_tios->c_cc[VKILL];
+	l_tios->c_cc[LX_VREPRINT] = s_tios->c_cc[VREPRINT];
+	l_tios->c_cc[LX_VLNEXT] = s_tios->c_cc[VLNEXT];
+	l_tios->c_cc[LX_VWERASE] = s_tios->c_cc[VWERASE];
+	l_tios->c_cc[LX_VINTR] = s_tios->c_cc[VINTR];
+	l_tios->c_cc[LX_VQUIT] = s_tios->c_cc[VQUIT];
+	l_tios->c_cc[LX_VSWTC] = s_tios->c_cc[VSWTCH];
+	l_tios->c_cc[LX_VSTART] = s_tios->c_cc[VSTART];
+	l_tios->c_cc[LX_VSTOP] = s_tios->c_cc[VSTOP];
+	l_tios->c_cc[LX_VSUSP] = s_tios->c_cc[VSUSP];
+	l_tios->c_cc[LX_VDISCARD] = s_tios->c_cc[VDISCARD];
+}
+
+static void
+s2l_termio(struct termio *s_tio, struct lx_termio *l_tio)
+{
+	ASSERT((s_tio != NULL) && (l_tio != NULL));
+
+	bzero(l_tio, sizeof (*l_tio));
+
+	l_tio->c_iflag = s_tio->c_iflag;
+	l_tio->c_oflag = s_tio->c_oflag;
+	l_tio->c_cflag = s_tio->c_cflag;
+	l_tio->c_lflag = s_tio->c_lflag;
+
+	if (s_tio->c_lflag & ICANON) {
+		l_tio->c_cc[LX_VEOF] = s_tio->c_cc[VEOF];
+		l_tio->c_cc[LX_VTIME] = LX_DEF_VTIME;
+		l_tio->c_cc[LX_VMIN] = LX_DEF_VMIN;
+	} else {
+		l_tio->c_cc[LX_VMIN] = s_tio->c_cc[VMIN];
+		l_tio->c_cc[LX_VTIME] = s_tio->c_cc[VTIME];
+		l_tio->c_cc[LX_VEOF] = LX_DEF_VEOF;
+	}
+
+	l_tio->c_cc[LX_VINTR] = s_tio->c_cc[VINTR];
+	l_tio->c_cc[LX_VQUIT] = s_tio->c_cc[VQUIT];
+	l_tio->c_cc[LX_VERASE] = s_tio->c_cc[VERASE];
+	l_tio->c_cc[LX_VKILL] = s_tio->c_cc[VKILL];
+	l_tio->c_cc[LX_VSWTC] = s_tio->c_cc[VSWTCH];
+}
+
+static void
+set_lx_cc(vnode_t *vp, struct lx_cc *lio)
+{
+	struct lx_cc *cur;
+	/*
+	 * Linux expects that the termio/termios control characters are
+	 * preserved more strictly than illumos supports.  In order to preserve
+	 * the illusion that the characters are maintained, they are stored as
+	 * vnode-specific data.
+	 */
+	mutex_enter(&vp->v_vsd_lock);
+	cur = (struct lx_cc *)vsd_get(vp, lx_ioctl_vsd);
+	if (cur == NULL) {
+		cur = kmem_alloc(sizeof (struct lx_cc), KM_SLEEP);
+		bcopy(lio, cur, sizeof (struct lx_cc));
+		(void) vsd_set(vp, lx_ioctl_vsd, cur);
+	} else {
+		bcopy(lio, cur, sizeof (struct lx_cc));
+	}
+	mutex_exit(&vp->v_vsd_lock);
+}
+
+static int
+get_lx_cc(vnode_t *vp, struct lx_cc *lio)
+{
+	struct lx_cc *cur;
+	int rv = 1;
+	mutex_enter(&vp->v_vsd_lock);
+	cur = (struct lx_cc *)vsd_get(vp, lx_ioctl_vsd);
+	if (cur != NULL) {
+		bcopy(cur, lio, sizeof (*lio));
+		rv = 0;
+	}
+	mutex_exit(&vp->v_vsd_lock);
+	return (rv);
+}
+
+/* Socket helpers */
+
+typedef struct lx_ifreq32 {
+	char	ifr_name[IFNAMSIZ];
+	union {
+		struct	sockaddr ifru_addr;
+	} ifr_ifrn;
+} lx_ifreq32_t;
+
+typedef struct lx_ifreq64 {
+	char	ifr_name[IFNAMSIZ];
+	union {
+		struct	sockaddr ifru_addr;
+		/* pad this out to the Linux size */
+		uint64_t	ifmap[3];
+	} ifr_ifrn;
+} lx_ifreq64_t;
+
+typedef struct lx_ifconf32 {
+	int32_t	if_len;
+	caddr32_t if_buf;
+} lx_ifconf32_t;
+
+typedef struct lx_ifconf64 {
+	int32_t	if_len;
+	caddr_t if_buf;
+} lx_ifconf64_t;
+
+
+/* Generic translators */
+
+/* ARGSUSED */
+static int
+ict_pass(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	int error = 0;
+	int rv;
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, arg, FLUSER(fp), fp->f_cred, &rv,
+	    NULL);
+	return ((error != 0) ? set_errno(error) : 0);
+}
+
+/* ARGSUSED */
+static int
+ict_fionbio(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	vnode_t *vp;
+	int32_t iflag, flags;
+	int error;
+
+	if (copyin((caddr_t)arg, &iflag, sizeof (iflag)))
+		return (set_errno(EFAULT));
+
+	mutex_enter(&fp->f_tlock);
+	vp = fp->f_vnode;
+	flags = fp->f_flag;
+	/* Linux sets NONBLOCK instead of FIONBIO */
+	if (iflag)
+		flags |= FNONBLOCK;
+	else
+		flags &= ~FNONBLOCK;
+	/* push the flag down */
+	error = VOP_SETFL(vp, fp->f_flag, flags, fp->f_cred, NULL);
+	fp->f_flag = flags;
+	mutex_exit(&fp->f_tlock);
+	return ((error != 0) ? set_errno(error) : 0);
+}
+
+/* ARGSUSED */
+static int
+ict_fionread(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	vnode_t *vp;
+	struct vattr vattr;
+	int error = 0;
+	int rv;
+	/*
+	 * offset is int32_t because that is what FIONREAD is defined in terms
+	 * of.  We cap at INT_MAX as in other cases for this ioctl.
+	 */
+	int32_t offset;
+
+	vp = fp->f_vnode;
+
+	if (vp->v_type == VREG || vp->v_type == VDIR) {
+		vattr.va_mask = AT_SIZE;
+		error = VOP_GETATTR(vp, &vattr, 0, fp->f_cred, NULL);
+		if (error != 0)
+			return (set_errno(error));
+		offset = MIN(vattr.va_size - fp->f_offset, INT_MAX);
+		if (copyout(&offset, (caddr_t)arg, sizeof (offset)))
+			return (set_errno(EFAULT));
+	} else {
+		error = VOP_IOCTL(vp, FIONREAD, arg, FLUSER(fp), fp->f_cred,
+		    &rv, NULL);
+		if (error)
+			return (set_errno(error));
+	}
+	return (0);
+}
+
+/*
+ * hard disk-related translators
+ *
+ * Note that the normal disk ioctls only work for VCHR devices. See spec_ioctl
+ * which will return ENOTTY for a VBLK device. However, fdisk, etc. expect to
+ * work with block devices.
+ *
+ * We expect a zvol to be the primary block device we're interacting with and
+ * we use the zone's lxzd_vdisks list to handle zvols specifically.
+ */
+
+typedef struct lx_hd_geom {
+	unsigned char heads;
+	unsigned char sectors;
+	unsigned short cylinders;
+	unsigned long start;
+} lx_hd_geom_t;
+
+/*
+ * Return the volsize and blksize for the correct virtual "disk" for the zone.
+ * Only these two values are returned in 'vdp' within this code.
+ *
+ * A virtual "disk" can be a zvol visible within the zone, but most zones are
+ * not configured with a delegated dataset necessary to make zvols visible.
+ *
+ * To make various applications happy, lx also pretends that our root filesystem
+ * (normally within the zone's dataset) lives on a virtual disk. We have a
+ * /dev/zfsds0 symlink which points at /dev/zfs. This appears in various places
+ * to give the illusion of root's disk. For example, see:
+ *    /proc/partitions
+ *    /sys/block/zfsds0
+ *    /sys/devices/zfs/zfsds0
+ * If an application issues the various LX_HDIO_GETGEO, LX_BLKGETSIZE*, or
+ * LX_BLKSSZGET ioctls on /dev/zfs (that is, minor number 0), we want to return
+ * something sane. In this case, we return the total size (which is normally
+ * limited by a quota) of the dataset that the zone root lives on.
+ */
+static boolean_t
+lx_lookup_zdsk_info(lx_zone_data_t *lxzd, dev_t dev, lx_virt_disk_t *vdp)
+{
+	lx_virt_disk_t *vd;
+
+	/* Handle /dev/zfs */
+	if (getminor(dev) == 0) {
+		struct statvfs64 sv;
+
+		if (VFS_STATVFS(curzone->zone_rootvp->v_vfsp, &sv) == 0) {
+			vdp->lxvd_volsize = sv.f_blocks * sv.f_frsize;
+			vdp->lxvd_blksize = sv.f_frsize;
+		} else {
+			vdp->lxvd_volsize = 0;
+			/* always set to prevent potential divide-by-zero */
+			vdp->lxvd_blksize = 512;
+		}
+
+		return (B_TRUE);
+	}
+
+	vd = list_head(lxzd->lxzd_vdisks);
+	while (vd != NULL) {
+		if (vd->lxvd_type == LXVD_ZVOL && vd->lxvd_real_dev == dev) {
+			bzero(vdp, sizeof (*vdp));
+			vdp->lxvd_volsize = vd->lxvd_volsize;
+			vdp->lxvd_blksize = vd->lxvd_blksize;
+			return (B_TRUE);
+		}
+		vd = list_next(lxzd->lxzd_vdisks, vd);
+	}
+
+	return (B_FALSE);
+}
+
+/*
+ * See zvol_ioctl() which always fails for DKIOCGGEOM. The geometry for a
+ * zvol (or really any modern disk) is made up, so we do that here as well.
+ */
+/* ARGSUSED */
+static int
+ict_hdgetgeo(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	lx_hd_geom_t lx_geom;
+	lx_zone_data_t *lxzd;
+
+	if (fp->f_vnode->v_type != VCHR && fp->f_vnode->v_type != VBLK)
+		return (set_errno(EINVAL));
+
+	lxzd = ztolxzd(curproc->p_zone);
+	ASSERT(lxzd != NULL);
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+
+	if (getmajor(fp->f_vnode->v_rdev) == getmajor(lxzd->lxzd_zfs_dev)) {
+		lx_virt_disk_t vd;
+
+		if (!lx_lookup_zdsk_info(lxzd, fp->f_vnode->v_rdev, &vd) ||
+		    vd.lxvd_volsize == 0 || vd.lxvd_blksize == 0) {
+			/* should only happen if new zvol */
+			bzero(&lx_geom, sizeof (lx_geom));
+		} else {
+			const diskaddr_t blks =
+			    MAX(1, vd.lxvd_volsize / vd.lxvd_blksize);
+
+			/*
+			 * Attempt to conjure up a Cylinder-Head-Sector
+			 * geometry for the given virtual disk size.
+			 */
+			if (blks <= (63*16*65535)) {
+				/*
+				 * Use traditional BIOS-style geometry for
+				 * adequately small disks.
+				 */
+				lx_geom.sectors	= 63;
+				lx_geom.heads	= 16;
+				lx_geom.cylinders = MAX(1, (blks / (63 * 16)));
+			} else if (blks <= (64*32*65535)) {
+				/* 1MB per cylinder for 512-byte sectors */
+				lx_geom.sectors	= 64;
+				lx_geom.heads	= 32;
+				lx_geom.cylinders = (blks / (64 * 32));
+			} else {
+				/*
+				 * Max out the geometry sizing for large disks.
+				 * This may not be adequate for truely huge
+				 * volumes (maxing out at a little under 2TB
+				 * for those with a 512-byte blocksize), but it
+				 * is the best we can do with the given struct.
+				 */
+				lx_geom.sectors	= 255;
+				lx_geom.heads	= 255;
+				lx_geom.cylinders = MIN(65535,
+				    (blks / (255*255)));
+			}
+			lx_geom.start = 0;
+		}
+	} else {
+		int res, rv;
+		struct dk_geom geom;
+
+		res = VOP_IOCTL(fp->f_vnode, DKIOCGGEOM, (intptr_t)&geom,
+		    fp->f_flag | FKIOCTL, fp->f_cred, &rv, NULL);
+		if (res > 0)
+			return (set_errno(res));
+
+		lx_geom.heads = geom.dkg_nhead;
+		lx_geom.sectors = geom.dkg_nsect;
+		lx_geom.cylinders = geom.dkg_ncyl;
+		lx_geom.start = 0;
+	}
+
+	if (copyout(&lx_geom, (caddr_t)arg, sizeof (lx_geom)))
+		return (set_errno(EFAULT));
+	return (0);
+}
+
+/*
+ * Per the Linux sd(4) man page, get the number of sectors. The linux/fs.h
+ * header says its 512 byte blocks.
+ */
+/* ARGSUSED */
+static int
+ict_blkgetsize(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	diskaddr_t tot;
+	lx_zone_data_t *lxzd;
+
+	if (fp->f_vnode->v_type != VCHR && fp->f_vnode->v_type != VBLK)
+		return (set_errno(EINVAL));
+
+	lxzd = ztolxzd(curproc->p_zone);
+	ASSERT(lxzd != NULL);
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+
+	if (getmajor(fp->f_vnode->v_rdev) == getmajor(lxzd->lxzd_zfs_dev)) {
+		lx_virt_disk_t vd;
+
+		if (!lx_lookup_zdsk_info(lxzd, fp->f_vnode->v_rdev, &vd)) {
+			/* should only happen if new zvol */
+			tot = 0;
+		} else {
+			tot = vd.lxvd_volsize / 512;
+		}
+	} else {
+		int res, rv;
+		struct dk_minfo minfo;
+
+		res = VOP_IOCTL(fp->f_vnode, DKIOCGMEDIAINFO, (intptr_t)&minfo,
+		    fp->f_flag | FKIOCTL, fp->f_cred, &rv, NULL);
+		if (res > 0)
+			return (set_errno(res));
+
+		tot = minfo.dki_capacity;
+		if (minfo.dki_lbsize > 512) {
+			uint_t bsize = minfo.dki_lbsize / 512;
+
+			tot *= bsize;
+		}
+	}
+
+	if (copyout(&tot, (caddr_t)arg, sizeof (long)))
+		return (set_errno(EFAULT));
+	return (0);
+}
+
+/*
+ * Get the sector size (i.e. the logical block size).
+ */
+/* ARGSUSED */
+static int
+ict_blkgetssize(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	uint_t bsize;
+	lx_zone_data_t *lxzd;
+
+	if (fp->f_vnode->v_type != VCHR && fp->f_vnode->v_type != VBLK)
+		return (set_errno(EINVAL));
+
+	lxzd = ztolxzd(curproc->p_zone);
+	ASSERT(lxzd != NULL);
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+
+	if (getmajor(fp->f_vnode->v_rdev) == getmajor(lxzd->lxzd_zfs_dev)) {
+		lx_virt_disk_t vd;
+
+		if (!lx_lookup_zdsk_info(lxzd, fp->f_vnode->v_rdev, &vd)) {
+			/* should only happen if new zvol */
+			bsize = 0;
+		} else {
+			bsize = (uint_t)vd.lxvd_blksize;
+		}
+	} else {
+		int res, rv;
+		struct dk_minfo minfo;
+
+		res = VOP_IOCTL(fp->f_vnode, DKIOCGMEDIAINFO, (intptr_t)&minfo,
+		    fp->f_flag | FKIOCTL, fp->f_cred, &rv, NULL);
+		if (res > 0)
+			return (set_errno(res));
+
+		bsize = (uint_t)minfo.dki_lbsize;
+	}
+
+	if (copyout(&bsize, (caddr_t)arg, sizeof (bsize)))
+		return (set_errno(EFAULT));
+	return (0);
+}
+
+/*
+ * Get the size. The linux/fs.h header says its in bytes.
+ */
+/* ARGSUSED */
+static int
+ict_blkgetsize64(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	uint64_t tot;
+	lx_zone_data_t *lxzd;
+
+	if (fp->f_vnode->v_type != VCHR && fp->f_vnode->v_type != VBLK)
+		return (set_errno(EINVAL));
+
+	lxzd = ztolxzd(curproc->p_zone);
+	ASSERT(lxzd != NULL);
+	ASSERT(lxzd->lxzd_vdisks != NULL);
+
+	if (getmajor(fp->f_vnode->v_rdev) == getmajor(lxzd->lxzd_zfs_dev)) {
+		lx_virt_disk_t vd;
+
+		if (!lx_lookup_zdsk_info(lxzd, fp->f_vnode->v_rdev, &vd)) {
+			/* should only happen if new zvol */
+			tot = 0;
+		} else {
+			tot = vd.lxvd_volsize;
+		}
+	} else {
+		int res, rv;
+		struct dk_minfo minfo;
+
+		res = VOP_IOCTL(fp->f_vnode, DKIOCGMEDIAINFO, (intptr_t)&minfo,
+		    fp->f_flag | FKIOCTL, fp->f_cred, &rv, NULL);
+		if (res > 0)
+			return (set_errno(res));
+
+		tot = minfo.dki_capacity * minfo.dki_lbsize;
+	}
+
+	if (copyout(&tot, (caddr_t)arg, sizeof (uint64_t)))
+		return (set_errno(EFAULT));
+	return (0);
+}
+
+/* ARGSUSED */
+/* Terminal-related translators */
+
+/* ARGSUSED */
+static int
+ict_tcsets(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct lx_termios	l_tios;
+	struct termios		s_tios;
+	struct lx_cc		lio;
+	int			error, rv;
+
+	ASSERT(cmd == TCSETS || cmd == TCSETSW || cmd == TCSETSF);
+
+	if (copyin((struct lx_termios *)arg, &l_tios, sizeof (l_tios)) != 0)
+		return (set_errno(EFAULT));
+	termios2lx_cc(&l_tios, &lio);
+	l2s_termios(&l_tios, &s_tios);
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, (intptr_t)&s_tios,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL);
+	if (error)
+		return (set_errno(error));
+	/* preserve lx_cc */
+	set_lx_cc(fp->f_vnode, &lio);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_tcseta(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct lx_termio	l_tio;
+	struct termio		s_tio;
+	struct lx_cc		lio;
+	int			error, rv;
+
+	ASSERT(cmd == TCSETA || cmd == TCSETAW || cmd == TCSETAF);
+
+	if (copyin((struct lx_termio *)arg, &l_tio, sizeof (l_tio)) != 0)
+		return (set_errno(EFAULT));
+	l2s_termio(&l_tio, &s_tio);
+	termio2lx_cc(&l_tio, &lio);
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, (intptr_t)&s_tio,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL);
+	if (error)
+		return (set_errno(error));
+	/* preserve lx_cc */
+	set_lx_cc(fp->f_vnode, &lio);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_tcgets_ptm(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct lx_termios	l_tios;
+	struct termios		s_tios, *s_tiosd;
+	uint_t			s_tiosl;
+
+	/* get termios defaults */
+	if (ddi_prop_lookup_byte_array(DDI_DEV_T_ANY, ddi_root_node(),
+	    DDI_PROP_NOTPROM, "ttymodes", (uchar_t **)&s_tiosd,
+	    &s_tiosl) != DDI_SUCCESS)
+		return (EIO);
+	ASSERT(s_tiosl == sizeof (*s_tiosd));
+	bcopy(s_tiosd, &s_tios, sizeof (s_tios));
+	ddi_prop_free(s_tiosd);
+
+	/* Now munge the data to how Linux wants it. */
+	s2l_termios(&s_tios, &l_tios);
+	if (copyout(&l_tios, (struct lx_termios *)arg, sizeof (l_tios)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_tcgets_native(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct lx_termios	l_tios;
+	struct termios		s_tios;
+	struct lx_cc		lio;
+	int			error, rv;
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, (intptr_t)&s_tios,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL);
+	if (error)
+		return (set_errno(error));
+
+	/* Now munge the data to how Linux wants it. */
+	s2l_termios(&s_tios, &l_tios);
+
+	/* return preserved lx_cc */
+	if (get_lx_cc(fp->f_vnode, &lio) == 0) {
+		l_tios.c_cc[LX_VEOF] = lio.veof;
+		l_tios.c_cc[LX_VEOL] = lio.veol;
+		l_tios.c_cc[LX_VMIN] = lio.vmin;
+		l_tios.c_cc[LX_VTIME] = lio.vtime;
+	}
+
+	if (copyout(&l_tios, (struct lx_termios *)arg, sizeof (l_tios)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_tcgets(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	if (getmajor(fp->f_vnode->v_rdev) == ddi_name_to_major(LX_PTM_DRV))
+		return (ict_tcgets_ptm(fp, cmd, arg, lxcmd));
+	else
+		return (ict_tcgets_native(fp, cmd, arg, lxcmd));
+}
+
+/* ARGSUSED */
+static int
+ict_tcgeta(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct lx_termio	l_tio;
+	struct termio		s_tio;
+	struct lx_cc		lio;
+	int			error, rv;
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, (intptr_t)&s_tio,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL);
+	if (error)
+		return (set_errno(error));
+
+	s2l_termio(&s_tio, &l_tio);
+	/* return preserved lx_cc */
+	if (get_lx_cc(fp->f_vnode, &lio) == 0) {
+		l_tio.c_cc[LX_VEOF] = lio.veof;
+		l_tio.c_cc[LX_VMIN] = lio.vmin;
+		l_tio.c_cc[LX_VTIME] = lio.vtime;
+	}
+
+	if (copyout(&l_tio, (struct lx_termios *)arg, sizeof (l_tio)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_tiocspgrp(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	pid_t lpid, spid, tid;
+	int error, rv;
+
+	/* Converting to the illumos pid is necessary */
+	if (copyin((pid_t *)arg, &lpid, sizeof (lpid)) < 0)
+		return (set_errno(EFAULT));
+	if (lx_lpid_to_spair(lpid, &spid, &tid) < 0)
+		return (set_errno(EPERM));
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, (intptr_t)&spid,
+	    fp->f_flag |FKIOCTL, fp->f_cred, &rv, NULL);
+	return ((error != 0) ? set_errno(error) : 0);
+}
+
+/* ARGSUSED */
+static int
+ict_tcsbrkp(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	int rv, error;
+	/* use null duration to emulate TCSBRKP */
+	int dur = 0;
+	error = VOP_IOCTL(fp->f_vnode, TCSBRK, (intptr_t)&dur,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL);
+	return ((error != 0) ? set_errno(error) : 0);
+}
+
+/* ARGSUSED */
+static int
+ict_tiocgpgrp(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	pid_t	spgrp;
+	int	error, rv;
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, (intptr_t)&spgrp, FLFAKE(fp),
+	    fp->f_cred, &rv, NULL);
+	if (error == 0) {
+		if (spgrp == curproc->p_zone->zone_proc_initpid) {
+			spgrp = 1;
+		}
+		if (copyout(&spgrp, (caddr_t)arg, sizeof (spgrp))) {
+			return (set_errno(EFAULT));
+		}
+	}
+	return ((error != 0) ? set_errno(error) : 0);
+}
+
+/* ARGSUSED */
+static int
+ict_sptlock(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct strioctl istr;
+	int error, rv;
+
+	istr.ic_cmd = UNLKPT;
+	istr.ic_len = 0;
+	istr.ic_timout = 0;
+	istr.ic_dp = NULL;
+	error = VOP_IOCTL(fp->f_vnode, I_STR, (intptr_t)&istr,
+	    fp->f_flag |FKIOCTL, fp->f_cred, &rv, NULL);
+	/*
+	 * The success/fail return values are different between Linux
+	 * and illumos.   Linux expects 0 or -1.  Illumos can return
+	 * positive number on success.
+	 */
+	return ((error != 0) ? set_errno(error) : 0);
+}
+
+/* ARGSUSED */
+static int
+ict_gptn(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct strioctl istr;
+	cred_t *cr;
+	pt_own_t pto;
+	int error, rv;
+	int ptyno;
+	lx_zone_data_t *lxzd = ztolxzd(curproc->p_zone);
+
+	/* This operation is only valid for the lx_ptm device. */
+	if (getmajor(fp->f_vnode->v_rdev) != ddi_name_to_major(LX_PTM_DRV))
+		return (set_errno(ENOTTY));
+
+	cr = CRED();
+	pto.pto_ruid = cr->cr_uid;
+	/*
+	 * Both Linux and our native code (see grantpt() in native libc)
+	 * prefer assigning the "tty" gid to the new pty. On Linux this is
+	 * done by udev. Since we're in the kernel we cannot lookup the gid, so
+	 * we rely on the lx_support program to initialize the value in the
+	 * zone data at boot time.
+	 */
+	if (lxzd->lxzd_ttygrp == 0) {
+		pto.pto_rgid = cr->cr_gid;
+	} else {
+		pto.pto_rgid = lxzd->lxzd_ttygrp;
+	}
+
+	istr.ic_cmd = OWNERPT;
+	istr.ic_len = sizeof (pto);
+	istr.ic_timout = 0;
+	istr.ic_dp = (char *)&pto;
+	error = VOP_IOCTL(fp->f_vnode, I_STR, (intptr_t)&istr,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL);
+
+	if (error)
+		return (set_errno((error == ENOTTY) ? error: EACCES));
+
+	ptyno = getminor(fp->f_vnode->v_rdev) - 1;
+	if (copyout(&ptyno, (caddr_t)arg, sizeof (ptyno)))
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_tiocgwinsz(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	int error, rv;
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, arg, FLUSER(fp), fp->f_cred, &rv,
+	    NULL);
+
+	/*
+	 * A few Linux libc's (e.g. musl) have chosen to implement isatty()
+	 * using the TIOCGWINSZ ioctl. Some apps also do the same thing
+	 * directly. On Linux that ioctl will return a size of 0x0 for dumb
+	 * terminals but on illumos see the handling for TIOCGWINSZ in ptem's
+	 * ptioc(). We fail if the winsize is all zeros. To emulate the Linux
+	 * behavior use the native ioctl check that we do for isatty and return
+	 * a size of 0x0 if that succeeds.
+	 */
+	if (error == EINVAL) {
+		int err;
+		struct termio s_tio;
+
+		err = VOP_IOCTL(fp->f_vnode, TCGETA, (intptr_t)&s_tio,
+		    FLFAKE(fp), fp->f_cred, &rv, NULL);
+
+		if (err == 0) {
+			struct winsize w;
+
+			bzero(&w, sizeof (w));
+			if (copyout(&w, (struct winsize *)arg, sizeof (w)) != 0)
+				return (set_errno(EFAULT));
+			return (0);
+		}
+	}
+
+	if (error != 0)
+		return (set_errno(error));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_tiocsctty(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	pid_t	ttysid, mysid;
+	int	error, rv;
+	proc_t *p = curproc;
+
+	/* getsid */
+	mutex_enter(&p->p_splock);
+	mysid = p->p_sessp->s_sid;
+	mutex_exit(&p->p_splock);
+
+	/*
+	 * Report success if we already control the tty.
+	 * If no one controls it, TIOCSCTTY will change that later.
+	 */
+	error = VOP_IOCTL(fp->f_vnode, TIOCGSID, (intptr_t)&ttysid,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL);
+	if (error == 0 && ttysid == mysid)
+		return (0);
+
+	/*
+	 * Need to make sure we're a session leader, otherwise the
+	 * TIOCSCTTY ioctl will fail.
+	 */
+	mutex_enter(&pidlock);
+	if (p->p_sessp->s_sidp != p->p_pidp && !pgmembers(p->p_pid)) {
+		mutex_exit(&pidlock);
+		sess_create();
+	} else {
+		mutex_exit(&pidlock);
+	}
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, 0, FLUSER(fp),
+	    fp->f_cred, &rv, NULL);
+	return ((error != 0) ? set_errno(error) : 0);
+}
+
+/* Socket-related translators */
+
+/* ARGSUSED */
+static int
+ict_siocatmark(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	vnode_t *vp = fp->f_vnode;
+	int error, rv;
+	/*
+	 * Linux expects a SIOCATMARK of a UDP socket to return ENOTTY, while
+	 * Illumos allows it. Linux prior to 2.6.39 returned EINVAL for this.
+	 */
+	if (vp->v_type != VSOCK || VTOSO(vp)->so_type != SOCK_STREAM)
+		return (set_errno(ENOTTY));
+
+	error = VOP_IOCTL(fp->f_vnode, cmd, arg, FLUSER(fp), fp->f_cred, &rv,
+	    NULL);
+	if (error)
+		return (set_errno(error));
+
+	return (0);
+}
+
+static int
+ict_if_ioctl(vnode_t *vn, int cmd, intptr_t arg, int flags, cred_t *cred)
+{
+	int error, rv;
+	lx_zone_data_t *lxzd = ztolxzd(curproc->p_zone);
+	ksocket_t ks;
+
+	ASSERT(lxzd != NULL);
+
+	/*
+	 * For ioctls of this type, we are strict about address family
+	 * whereas Linux is lenient.  This strictness can be avoided by using
+	 * an internal AF_INET ksocket, which we use if the family is anything
+	 * but AF_PACKET.
+	 */
+	if (vn->v_type == VSOCK && VTOSO(vn)->so_family == AF_PACKET)
+		return (VOP_IOCTL(vn, cmd, arg, flags, cred, &rv, NULL));
+
+	mutex_enter(&lxzd->lxzd_lock);
+	ks = lxzd->lxzd_ioctl_sock;
+	if (ks == NULL) {
+		/*
+		 * Linux is not at all picky about address family when it comes
+		 * to supporting interface-related ioctls. To mimic this
+		 * behavior, we'll attempt those ioctls against a ksocket
+		 * configured for that purpose.
+		 */
+		(void) ksocket_socket(&lxzd->lxzd_ioctl_sock, AF_INET,
+		    SOCK_DGRAM, 0, 0, curproc->p_zone->zone_kcred);
+		ks = lxzd->lxzd_ioctl_sock;
+	}
+	mutex_exit(&lxzd->lxzd_lock);
+
+	if (ks != NULL) {
+		error = ksocket_ioctl(ks, cmd, arg, &rv, cred);
+	} else {
+		error = VOP_IOCTL(vn, cmd, arg, flags, cred, &rv, NULL);
+	}
+
+	return (error);
+}
+
+static int
+ict_sioghwaddr(file_t *fp, struct lifreq *lreq)
+{
+	struct sockaddr_dl *sdl = (struct sockaddr_dl *)&lreq->lifr_addr;
+	struct sockaddr hwaddr;
+	int error, size;
+
+	error = ict_if_ioctl(fp->f_vnode, SIOCGLIFHWADDR, (intptr_t)lreq,
+	    FLFAKE(fp), fp->f_cred);
+
+	if (error == EADDRNOTAVAIL &&
+	    strncmp(lreq->lifr_name, "lo", 2) == 0) {
+		/* Emulate success on suspected loopbacks */
+		sdl->sdl_type = DL_LOOP;
+		sdl->sdl_alen = ETHERADDRL;
+		bzero(LLADDR(sdl), sdl->sdl_alen);
+		error = 0;
+	}
+
+	if (error == 0) {
+		bzero(&hwaddr, sizeof (hwaddr));
+		lx_stol_hwaddr(sdl, &hwaddr, &size);
+		bcopy(&hwaddr, &lreq->lifr_addr,
+		    size + sizeof (sdl->sdl_family));
+	}
+
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+ict_siocgifname(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct ifreq	req;
+	int		len;
+	char		name[LIFNAMSIZ];
+	netstack_t *ns;
+	ip_stack_t *ipst;
+	phyint_t *phyi;
+
+	if (fp->f_vnode->v_type != VSOCK) {
+		return (set_errno(EINVAL));
+	}
+
+	len = (curproc->p_model == DATAMODEL_LP64) ? sizeof (lx_ifreq64_t) :
+	    sizeof (lx_ifreq32_t);
+	if (copyin((struct ifreq *)arg, &req, len) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	/*
+	 * Since Linux calls this ioctl on all sorts of sockets, perform the
+	 * interface name lookup manually.
+	 */
+	if ((ns = netstack_get_current()) == NULL) {
+		return (set_errno(EINVAL));
+	}
+	ipst = ns->netstack_ip;
+
+	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
+	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
+	    (void *) &req.ifr_index, NULL);
+	if (phyi != NULL) {
+		(void) strncpy(name, phyi->phyint_name, LIFNAMSIZ);
+		lx_ifname_convert(name, LX_IF_FROMNATIVE);
+	} else {
+		name[0] = '\0';
+	}
+
+	rw_exit(&ipst->ips_ill_g_lock);
+	netstack_rele(ns);
+
+	if (strlen(name) != 0) {
+		/* Truncate for ifreq and copyout */
+		(void) strncpy(req.ifr_name, name, IFNAMSIZ);
+		if (copyout(&req, (struct ifreq *)arg, len) != 0) {
+			return (set_errno(EFAULT));
+		}
+		return (0);
+	}
+
+	return (set_errno(EINVAL));
+}
+
+/* ARGSUSED */
+static int
+ict_siolifreq(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	struct ifreq	req;
+	struct lifreq	lreq;
+	int		error, len;
+
+	/* Convert from Linux ifreq to illumos lifreq */
+	if (curproc->p_model == DATAMODEL_LP64)
+		len = sizeof (lx_ifreq64_t);
+	else
+		len = sizeof (lx_ifreq32_t);
+	if (copyin((struct ifreq *)arg, &req, len) != 0)
+		return (set_errno(EFAULT));
+	bzero(&lreq, sizeof (lreq));
+	(void) strncpy(lreq.lifr_name, req.ifr_name, IFNAMSIZ);
+	bcopy(&req.ifr_ifru, &lreq.lifr_lifru, len - IFNAMSIZ);
+	lx_ifname_convert(lreq.lifr_name, LX_IF_TONATIVE);
+
+	switch (cmd) {
+	case SIOCGIFADDR:
+	case SIOCSIFADDR:
+	case SIOCGIFDSTADDR:
+	case SIOCSIFDSTADDR:
+	case SIOCGIFBRDADDR:
+	case SIOCSIFBRDADDR:
+	case SIOCGIFNETMASK:
+	case SIOCSIFNETMASK:
+	case SIOCGIFMETRIC:
+	case SIOCSIFMETRIC:
+	case SIOCGIFMTU:
+	case SIOCSIFMTU:
+		/*
+		 * Convert cmd from SIO*IF* to SIO*LIF*.
+		 * This is needed since Linux allows ifreq operations on ipv6
+		 * sockets where illumos does not.
+		 */
+		cmd = ((cmd & IOC_INOUT) |
+		    _IOW('i', ((cmd & 0xff) + 100), struct lifreq));
+		error = ict_if_ioctl(fp->f_vnode, cmd, (intptr_t)&lreq,
+		    FLFAKE(fp), fp->f_cred);
+		break;
+	case SIOCGIFINDEX:
+		cmd = SIOCGLIFINDEX;
+		error = ict_if_ioctl(fp->f_vnode, cmd, (intptr_t)&lreq,
+		    FLFAKE(fp), fp->f_cred);
+		break;
+	case SIOCGIFFLAGS:
+		cmd = SIOCGLIFFLAGS;
+		error = ict_if_ioctl(fp->f_vnode, cmd, (intptr_t)&lreq,
+		    FLFAKE(fp), fp->f_cred);
+		if (error == 0)
+			lx_ifflags_convert(&lreq.lifr_flags, LX_IF_FROMNATIVE);
+		break;
+	case SIOCSIFFLAGS:
+		cmd = SIOCSLIFFLAGS;
+		lx_ifflags_convert(&lreq.lifr_flags, LX_IF_TONATIVE);
+		error = ict_if_ioctl(fp->f_vnode, cmd, (intptr_t)&lreq,
+		    FLFAKE(fp), fp->f_cred);
+		break;
+	case SIOCGIFHWADDR:
+		error = ict_sioghwaddr(fp, &lreq);
+		break;
+	case LX_SIOCGIFTXQLEN:
+		/*
+		 * Illumos lacks the notion of txqlen.  Confirm the provided
+		 * interface is valid with SIOCGLIFINDEX and return a fake
+		 * txqlen of 1.  Loopback devices will report txqlen of 0.
+		 */
+		if (strncmp(lreq.lifr_name, "lo", 2) == 0) {
+			lreq.lifr_index = 0;
+			error = 0;
+			break;
+		}
+		cmd = SIOCGLIFINDEX;
+		error = ict_if_ioctl(fp->f_vnode, cmd, (intptr_t)&lreq,
+		    FLFAKE(fp), fp->f_cred);
+		if (error == 0) {
+			/* lifr_index aliases to the qlen field */
+			lreq.lifr_index = 1;
+		}
+		break;
+	case LX_SIOCSIFHWADDR:
+		/*
+		 * We're not going to support SIOCSIFHWADDR, but we need to be
+		 * able to check the result of the copyin first to see if the
+		 * command should have returned EFAULT.
+		 */
+	default:
+		error = EINVAL;
+	}
+
+	if (error != 0)
+		return (set_errno(error));
+
+	/* Convert back to a Linux ifreq */
+	lx_ifname_convert(lreq.lifr_name, LX_IF_FROMNATIVE);
+	bzero(&req, sizeof (req));
+	(void) strncpy(req.ifr_name, lreq.lifr_name, IFNAMSIZ);
+	bcopy(&lreq.lifr_lifru, &req.ifr_ifru, len - IFNAMSIZ);
+
+	if (copyout(&req, (struct lifreq *)arg, len) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+ict_siocgifconf32(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	lx_ifconf32_t	conf;
+	lx_ifreq32_t	*oreq;
+	struct ifconf	sconf;
+	int		ifcount, error, i, buf_len;
+
+	if (copyin((lx_ifconf32_t *)arg, &conf, sizeof (conf)) != 0)
+		return (set_errno(EFAULT));
+
+	/* They want to know how many interfaces there are. */
+	if (conf.if_len <= 0 || conf.if_buf == NULL) {
+		error = ict_if_ioctl(fp->f_vnode, SIOCGIFNUM,
+		    (intptr_t)&ifcount, FLFAKE(fp), fp->f_cred);
+		if (error != 0)
+			return (set_errno(error));
+
+		conf.if_len = ifcount * sizeof (lx_ifreq32_t);
+
+		if (copyout(&conf, (lx_ifconf32_t *)arg, sizeof (conf)) != 0)
+			return (set_errno(EFAULT));
+		return (0);
+	} else {
+		ifcount = conf.if_len / sizeof (lx_ifreq32_t);
+	}
+
+	/* Get interface configuration list. */
+	sconf.ifc_len = ifcount * sizeof (struct ifreq);
+	sconf.ifc_req = (struct ifreq *)kmem_alloc(sconf.ifc_len, KM_SLEEP);
+
+	error = ict_if_ioctl(fp->f_vnode, cmd, (intptr_t)&sconf, FLFAKE(fp),
+	    fp->f_cred);
+	if (error != 0) {
+		kmem_free(sconf.ifc_req, ifcount * sizeof (struct ifreq));
+		return (set_errno(error));
+	}
+
+	/* Convert data to Linux format & rename interfaces */
+	buf_len = ifcount * sizeof (lx_ifreq32_t);
+	oreq = (lx_ifreq32_t *)kmem_alloc(buf_len, KM_SLEEP);
+	for (i = 0; i < sconf.ifc_len / sizeof (struct ifreq); i++) {
+		bcopy(&sconf.ifc_req[i], oreq + i, sizeof (lx_ifreq32_t));
+		lx_ifname_convert(oreq[i].ifr_name, LX_IF_FROMNATIVE);
+	}
+	conf.if_len = i * sizeof (*oreq);
+	kmem_free(sconf.ifc_req, ifcount * sizeof (struct ifreq));
+
+	error = 0;
+	if (copyout(oreq, (caddr_t)(uintptr_t)conf.if_buf, conf.if_len) != 0 ||
+	    copyout(&conf, (lx_ifconf32_t *)arg, sizeof (conf)) != 0)
+		error = set_errno(EFAULT);
+
+	kmem_free(oreq, buf_len);
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+ict_siocgifconf64(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	lx_ifconf64_t	conf;
+	lx_ifreq64_t	*oreq;
+	struct ifconf	sconf;
+	int		ifcount, error, i, buf_len;
+
+	if (copyin((lx_ifconf64_t *)arg, &conf, sizeof (conf)) != 0)
+		return (set_errno(EFAULT));
+
+	/* They want to know how many interfaces there are. */
+	if (conf.if_len <= 0 || conf.if_buf == NULL) {
+		error = ict_if_ioctl(fp->f_vnode, SIOCGIFNUM,
+		    (intptr_t)&ifcount, FLFAKE(fp), fp->f_cred);
+		if (error != 0)
+			return (set_errno(error));
+
+		conf.if_len = ifcount * sizeof (lx_ifreq64_t);
+
+		if (copyout(&conf, (lx_ifconf64_t *)arg, sizeof (conf)) != 0)
+			return (set_errno(EFAULT));
+		return (0);
+	} else {
+		ifcount = conf.if_len / sizeof (lx_ifreq64_t);
+	}
+
+	/* Get interface configuration list. */
+	sconf.ifc_len = ifcount * sizeof (struct ifreq);
+	sconf.ifc_req = (struct ifreq *)kmem_alloc(sconf.ifc_len, KM_SLEEP);
+
+	error = ict_if_ioctl(fp->f_vnode, cmd, (intptr_t)&sconf, FLFAKE(fp),
+	    fp->f_cred);
+	if (error != 0) {
+		kmem_free(sconf.ifc_req, ifcount * sizeof (struct ifreq));
+		return (set_errno(error));
+	}
+
+	/* Convert data to Linux format & rename interfaces */
+	buf_len = ifcount * sizeof (lx_ifreq64_t);
+	oreq = (lx_ifreq64_t *)kmem_alloc(buf_len, KM_SLEEP);
+	for (i = 0; i < sconf.ifc_len / sizeof (struct ifreq); i++) {
+		bcopy(&sconf.ifc_req[i], oreq + i, sizeof (lx_ifreq64_t));
+		lx_ifname_convert(oreq[i].ifr_name, LX_IF_FROMNATIVE);
+	}
+	conf.if_len = i * sizeof (*oreq);
+	kmem_free(sconf.ifc_req, ifcount * sizeof (struct ifreq));
+
+	error = 0;
+	if (copyout(oreq, (caddr_t)(uintptr_t)conf.if_buf, conf.if_len) != 0 ||
+	    copyout(&conf, (lx_ifconf64_t *)arg, sizeof (conf)) != 0)
+		error = set_errno(EFAULT);
+
+	kmem_free(oreq, buf_len);
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+ict_siocgifconf(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	if (curproc->p_model == DATAMODEL_LP64)
+		return (ict_siocgifconf64(fp, cmd, arg, lxcmd));
+	else
+		return (ict_siocgifconf32(fp, cmd, arg, lxcmd));
+}
+
+/*
+ * Unfortunately some of the autofs ioctls want to return a positive integer
+ * result which does not indicate an error. To minimize disruption in the
+ * rest of the code, we'll treat a positive return as an errno and a negative
+ * return as the non-error return (which we then negate).
+ */
+/* ARGSUSED */
+static int
+ict_autofs(file_t *fp, int cmd, intptr_t arg, int lxcmd)
+{
+	int res = 0;
+	int rv;
+
+	res = VOP_IOCTL(fp->f_vnode, cmd, arg, FLUSER(fp), fp->f_cred, &rv,
+	    NULL);
+	if (res > 0)
+		return (set_errno(res));
+	if (res == 0)
+		return (0);
+	return (-res);
+}
+
+/* Structure used to define an ioctl translator. */
+typedef struct lx_ioc_cmd_translator {
+	int	lict_lxcmd;
+	int	lict_cmd;
+	int	(*lict_func)(file_t *fp, int cmd, intptr_t arg, int lxcmd);
+} lx_ioc_cmd_translator_t;
+
+#define	LX_IOC_CMD_TRANSLATOR_PASS(ioc_cmd_sym)				\
+	{ (int)LX_##ioc_cmd_sym, (int)ioc_cmd_sym, ict_pass },
+
+#define	LX_IOC_CMD_TRANSLATOR_FILTER(ioc_cmd_sym, ioct_handler)		\
+	{ (int)LX_##ioc_cmd_sym, (int)ioc_cmd_sym, ioct_handler },
+
+#define	LX_IOC_CMD_TRANSLATOR_CUSTOM(ioc_cmd_sym, ioct_handler)		\
+	{ (int)ioc_cmd_sym, (int)ioc_cmd_sym, ioct_handler },
+
+#define	LX_IOC_CMD_TRANSLATOR_PTHRU(ioc_cmd_sym)			\
+	{ (int)ioc_cmd_sym, (int)ioc_cmd_sym, ict_pass },
+
+#define	LX_IOC_CMD_TRANSLATOR_END					\
+	{0, 0, NULL}
+
+static lx_ioc_cmd_translator_t lx_ioc_xlate_fd[] = {
+	LX_IOC_CMD_TRANSLATOR_FILTER(FIONBIO,	ict_fionbio)
+	LX_IOC_CMD_TRANSLATOR_FILTER(FIONREAD,	ict_fionread)
+	LX_IOC_CMD_TRANSLATOR_PASS(FIOASYNC)
+
+	/* streams related */
+	LX_IOC_CMD_TRANSLATOR_PASS(TCXONC)
+	LX_IOC_CMD_TRANSLATOR_PASS(TCFLSH)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCEXCL)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCNXCL)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCSTI)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCSWINSZ)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCMBIS)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCMBIC)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCMSET)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCSETD)
+	LX_IOC_CMD_TRANSLATOR_PASS(TCSBRK)
+
+	/* terminal related */
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCGETD)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCGSID)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCNOTTY)
+	LX_IOC_CMD_TRANSLATOR_PASS(TIOCPKT)
+
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCSETS,		ict_tcsets)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCSETSW,		ict_tcsets)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCSETSF,		ict_tcsets)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCSETA,		ict_tcseta)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCSETAW,		ict_tcseta)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCSETAF,		ict_tcseta)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCGETS,		ict_tcgets)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TCGETA,		ict_tcgeta)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TIOCGWINSZ,	ict_tiocgwinsz)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_TCSBRKP,	ict_tcsbrkp)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TIOCSPGRP,		ict_tiocspgrp)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TIOCGPGRP,		ict_tiocgpgrp)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_TIOCSPTLCK,	ict_sptlock)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_TIOCGPTN,	ict_gptn)
+	LX_IOC_CMD_TRANSLATOR_FILTER(TIOCSCTTY,		ict_tiocsctty)
+
+	LX_IOC_CMD_TRANSLATOR_END
+};
+
+static lx_ioc_cmd_translator_t lx_ioc_xlate_socket[] = {
+	LX_IOC_CMD_TRANSLATOR_PASS(FIOGETOWN)
+
+	LX_IOC_CMD_TRANSLATOR_PASS(SIOCSPGRP)
+	LX_IOC_CMD_TRANSLATOR_PASS(SIOCGPGRP)
+	LX_IOC_CMD_TRANSLATOR_PASS(SIOCGSTAMP)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCATMARK,	ict_siocatmark)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFFLAGS,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCSIFFLAGS,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCSIFADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFDSTADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCSIFDSTADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFBRDADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCSIFBRDADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFNETMASK,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCSIFNETMASK,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFMETRIC,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCSIFMETRIC,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFMTU,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCSIFMTU,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFHWADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_SIOCSIFHWADDR,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFINDEX,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_SIOCGIFTXQLEN,	ict_siolifreq)
+	LX_IOC_CMD_TRANSLATOR_FILTER(SIOCGIFCONF,	ict_siocgifconf)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_SIOCGIFNAME,	ict_siocgifname)
+
+	LX_IOC_CMD_TRANSLATOR_END
+};
+
+static lx_ioc_cmd_translator_t lx_ioc_xlate_dtrace[] = {
+	LX_IOC_CMD_TRANSLATOR_PTHRU(DTRACEHIOC_ADD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(DTRACEHIOC_REMOVE)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(DTRACEHIOC_ADDDOF)
+
+	LX_IOC_CMD_TRANSLATOR_END
+};
+
+static lx_ioc_cmd_translator_t lx_ioc_xlate_autofs[] = {
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_READY)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_FAIL)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_CATATONIC)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_PROTOVER)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_SETTIMEOUT)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_EXPIRE)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_EXPIRE_MULTI)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_PROTOSUBVER)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_IOC_ASKUMOUNT)
+
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_VERSION_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_PROTOVER_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_PROTOSUBVER_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_OPENMOUNT_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_CLOSEMOUNT_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_READY_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_FAIL_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_SETPIPEFD_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_CATATONIC_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_TIMEOUT_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_REQUESTER_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_EXPIRE_CMD)
+	LX_IOC_CMD_TRANSLATOR_PTHRU(LX_AUTOFS_DEV_IOC_ASKUMOUNT_CMD)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_AUTOFS_DEV_IOC_ISMOUNTPOINT_CMD,
+	    ict_autofs)
+
+	LX_IOC_CMD_TRANSLATOR_END
+};
+
+static lx_ioc_cmd_translator_t lx_ioc_xlate_hd[] = {
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_HDIO_GETGEO, ict_hdgetgeo)
+
+	LX_IOC_CMD_TRANSLATOR_END
+};
+
+static lx_ioc_cmd_translator_t lx_ioc_xlate_blk[] = {
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_BLKGETSIZE, ict_blkgetsize)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_BLKSSZGET, ict_blkgetssize)
+	LX_IOC_CMD_TRANSLATOR_CUSTOM(LX_BLKGETSIZE64, ict_blkgetsize64)
+
+	LX_IOC_CMD_TRANSLATOR_END
+};
+
+/*
+ * Linux only restarts ioctls for "slow" devices. This includes terminals,
+ * pipes, and sockets. If additional "slow" devices are discovered in the
+ * future, they can be added here as well.
+ */
+static boolean_t
+lx_ioctl_is_slow_dev(file_t *fp)
+{
+	int rv;
+	struct termio s_tio;
+	vtype_t vt = fp->f_vnode->v_type;
+
+	if (vt == VFIFO || vt == VSOCK)
+		return (B_TRUE);
+
+	/* Check if it's a terminal using the isatty() approach. */
+	if (vt == VCHR && VOP_IOCTL(fp->f_vnode, TCGETA, (intptr_t)&s_tio,
+	    FLFAKE(fp), fp->f_cred, &rv, NULL) == 0)
+		return (B_TRUE);
+
+	return (B_FALSE);
+}
+
+static void
+lx_ioctl_vsd_free(void *data)
+{
+	kmem_free(data, sizeof (struct lx_cc));
+}
+
+void
+lx_ioctl_init()
+{
+	vsd_create(&lx_ioctl_vsd, lx_ioctl_vsd_free);
+}
+
+void
+lx_ioctl_fini()
+{
+	vsd_destroy(&lx_ioctl_vsd);
+}
+
+long
+lx_ioctl(int fdes, int cmd, intptr_t arg)
+{
+	file_t *fp;
+	int res = 0, error = ENOTTY;
+	lx_ioc_cmd_translator_t *ict = NULL;
+
+	if (cmd == LX_FIOCLEX || cmd == LX_FIONCLEX) {
+		res = f_setfd_error(fdes, (cmd == LX_FIOCLEX) ? FD_CLOEXEC : 0);
+		return ((res != 0) ? set_errno(res) : 0);
+	}
+
+	if ((fp = getf(fdes)) == NULL)
+		return (set_errno(EBADF));
+
+	switch ((cmd & 0xff00) >> 8) {
+	case LX_IOC_TYPE_FD:
+		ict = lx_ioc_xlate_fd;
+		break;
+
+	case LX_IOC_TYPE_DTRACE:
+		ict = lx_ioc_xlate_dtrace;
+		break;
+
+	case LX_IOC_TYPE_SOCK:
+		ict = lx_ioc_xlate_socket;
+		error = EOPNOTSUPP;
+		break;
+
+	case LX_IOC_TYPE_AUTOFS:
+		ict = lx_ioc_xlate_autofs;
+		break;
+
+	case LX_IOC_TYPE_BLK:
+		ict = lx_ioc_xlate_blk;
+		break;
+
+	case LX_IOC_TYPE_HD:
+		ict = lx_ioc_xlate_hd;
+		break;
+
+	default:
+		releasef(fdes);
+		return (set_errno(ENOTTY));
+	}
+
+	/*
+	 * Today, none of the ioctls supported by the emulation possess
+	 * overlapping cmd values.  Because of that, no type interrogation of
+	 * the fd is done before executing specific ioctl emulation.  It's
+	 * assumed that the vnode-specific logic called by the emulation
+	 * function will reject ioctl commands not supported by the fd.
+	 */
+	VERIFY(ict != NULL);
+	while (ict->lict_func != NULL) {
+		if (ict->lict_lxcmd == cmd)
+			break;
+		ict++;
+	}
+	if (ict->lict_func == NULL) {
+		releasef(fdes);
+		return (set_errno(error));
+	}
+
+	res = ict->lict_func(fp, ict->lict_cmd, arg, ict->lict_lxcmd);
+
+	if (ttolwp(curthread)->lwp_errno == EINTR && lx_ioctl_is_slow_dev(fp))
+		ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+
+	releasef(fdes);
+	return (res);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_ioprio.c b/usr/src/uts/common/brand/lx/syscall/lx_ioprio.c
new file mode 100644
index 0000000000..13397e199e
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_ioprio.c
@@ -0,0 +1,66 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/errno.h>
+#include <sys/systm.h>
+#include <sys/lx_brand.h>
+
+/* 'which' values. */
+#define	LX_IOPRIO_WHO_PROCESS	1
+#define	LX_IOPRIO_WHO_PGRP	2
+#define	LX_IOPRIO_WHO_USER	3
+
+/*
+ * The possible values for the class. We report best effort (BE) as the class
+ * in use.
+ */
+#define	LX_IOPRIO_CLASS_RT	1
+#define	LX_IOPRIO_CLASS_BE	2
+#define	LX_IOPRIO_CLASS_IDLE	3
+
+/* Macro to determine the class from the input mask */
+#define	LX_IOPRIO_PRIO_CLASS(m)	((m) >> 13)
+
+/* ARGSUSED */
+long
+lx_ioprio_get(int which, int who)
+{
+	if (which < LX_IOPRIO_WHO_PROCESS || which > LX_IOPRIO_WHO_USER)
+		return (set_errno(EINVAL));
+
+	return (LX_IOPRIO_CLASS_BE);
+}
+
+/*
+ * We allow setting any valid class, even though it's ignored.
+ * We ignore the 'who' parameter which means that we're not searching for
+ * the specified target in order to return a specific errno in the case that
+ * the target does not exist.
+ */
+/* ARGSUSED */
+long
+lx_ioprio_set(int which, int who, int mask)
+{
+	int class;
+
+	if (which < LX_IOPRIO_WHO_PROCESS || which > LX_IOPRIO_WHO_USER)
+		return (set_errno(EINVAL));
+
+	class = LX_IOPRIO_PRIO_CLASS(mask);
+	if (class < LX_IOPRIO_CLASS_RT || class > LX_IOPRIO_CLASS_IDLE)
+		return (set_errno(EINVAL));
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_kill.c b/usr/src/uts/common/brand/lx/syscall/lx_kill.c
new file mode 100644
index 0000000000..6fefbde705
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_kill.c
@@ -0,0 +1,408 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/proc.h>
+#include <sys/zone.h>
+#include <sys/thread.h>
+#include <sys/signal.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <lx_signum.h>
+#include <sys/contract/process_impl.h>
+
+extern int kill(pid_t, int);
+
+/*
+ * Check if it is legal to send this signal to the init process.  Linux
+ * kill(2) semantics dictate that no _unhandled_ signal may be sent to pid
+ * 1.
+ */
+static int
+lx_init_sig_check(int sig, pid_t pid)
+{
+	proc_t *p;
+	int rv = 0;
+
+	mutex_enter(&pidlock);
+	if ((p = prfind(pid)) == NULL || p->p_stat == SIDL) {
+		rv = ESRCH;
+	} else if (sig != 0) {
+		if (sigismember(&cantmask, sig)) {
+			rv = EPERM;
+		} else {
+			mutex_enter(&p->p_lock);
+			if (PTOU(p)->u_signal[sig-1] == SIG_DFL ||
+			    PTOU(p)->u_signal[sig-1] == SIG_IGN) {
+				rv = EPERM;
+			}
+			mutex_exit(&p->p_lock);
+		}
+	}
+	mutex_exit(&pidlock);
+
+	return (rv);
+}
+
+static long
+lx_thrkill(pid_t tgid, pid_t pid, int lx_sig, boolean_t tgkill)
+{
+	kthread_t *t;
+	proc_t *pp, *cp = curproc;
+	sigqueue_t *sqp;
+	int sig, rv;
+
+	/*
+	 * Unlike kill(2), Linux tkill(2) doesn't allow signals to
+	 * be sent to process IDs <= 0 as it doesn't overlay any special
+	 * semantics on the pid.
+	 */
+	if ((pid <= 0) || ((lx_sig < 0) || (lx_sig > LX_NSIG)) ||
+	    ((sig = ltos_signo[lx_sig]) < 0))
+		return (set_errno(EINVAL));
+
+	/*
+	 * If the Linux pid is 1, translate the pid to the actual init
+	 * pid for the zone.  Note that Linux dictates that no unhandled
+	 * signals may be sent to init, so check for that, too.
+	 *
+	 * Otherwise, extract the tid and real pid from the Linux pid.
+	 */
+	if (pid == 1) {
+		pid_t initpid;
+
+		initpid = cp->p_zone->zone_proc_initpid;
+		if ((rv = lx_init_sig_check(sig, initpid)) != 0) {
+			return (set_errno(rv));
+		}
+	}
+	sqp = kmem_zalloc(sizeof (sigqueue_t), KM_SLEEP);
+	/*
+	 * Find the process for the passed pid...
+	 */
+	if (lx_lpid_lock(pid, curzone, 0, &pp, &t) != 0) {
+		rv = set_errno(ESRCH);
+		goto free_and_exit;
+	}
+
+	/*
+	 * Make sure the thread group matches the thread.
+	 */
+	if (tgkill) {
+		if ((pid == 1 && tgid != 1) ||
+		    (pid != 1 && tgid != pp->p_pid)) {
+			mutex_exit(&pp->p_lock);
+			rv = set_errno(ESRCH);
+			goto free_and_exit;
+		}
+	}
+
+	/*
+	 * Deny permission to send the signal if either of the following
+	 * is true:
+	 *
+	 *	+ The signal is SIGCONT and the target pid is not in the same
+	 *	  session as the sender
+	 *
+	 *	+ prochasprocperm() shows the user lacks sufficient permission
+	 *	  to send the signal to the target pid
+	 */
+	if (((sig == SIGCONT) && (pp->p_sessp != cp->p_sessp)) ||
+	    (!prochasprocperm(pp, cp, CRED()))) {
+		mutex_exit(&pp->p_lock);
+		rv = set_errno(EPERM);
+		goto free_and_exit;
+	}
+
+	/* a signal of 0 means just check for the existence of the thread */
+	if (lx_sig == 0) {
+		mutex_exit(&pp->p_lock);
+		rv = 0;
+		goto free_and_exit;
+	}
+
+	sqp->sq_info.si_signo = sig;
+	sqp->sq_info.si_code = SI_LWP;
+	sqp->sq_info.si_pid = cp->p_pid;
+	sqp->sq_info.si_zoneid = getzoneid();
+	sqp->sq_info.si_uid = crgetruid(CRED());
+	sigaddqa(pp, t, sqp);
+
+	mutex_exit(&pp->p_lock);
+
+	return (0);
+
+free_and_exit:
+	kmem_free(sqp, sizeof (sigqueue_t));
+	return (rv);
+}
+
+long
+lx_tgkill(pid_t tgid, pid_t pid, int lx_sig)
+{
+	return (lx_thrkill(tgid, pid, lx_sig, B_TRUE));
+}
+
+long
+lx_tkill(pid_t pid, int lx_sig)
+{
+	return (lx_thrkill(0, pid, lx_sig, B_FALSE));
+}
+
+long
+lx_kill(pid_t lx_pid, int lx_sig)
+{
+	pid_t s_pid, initpid;
+	sigsend_t v;
+	zone_t *zone = curzone;
+	struct proc *p;
+	int err, sig, nfound;
+
+	if ((lx_sig < 0) || (lx_sig > LX_NSIG) ||
+	    ((sig = ltos_signo[lx_sig]) < 0))
+		return (set_errno(EINVAL));
+
+	initpid = zone->zone_proc_initpid;
+	if (lx_pid == 0 || lx_pid == -1) {
+		s_pid = 0;
+	} else if (lx_pid > 0) {
+		/*
+		 * Translations for individual processes (including pid 1) is
+		 * all handled by lx_lpid_to_spair.
+		 */
+		if (lx_lpid_to_spair(lx_pid, &s_pid, NULL) != 0) {
+			/*
+			 * If we didn't find this pid that means it doesn't
+			 * exist in this zone.
+			 */
+			return (set_errno(ESRCH));
+		}
+	} else {
+		ASSERT(lx_pid < 0);
+		if (lx_lpid_to_spair(-lx_pid, &s_pid, NULL) != 0) {
+			/*
+			 * If we didn't find this pid it means that the
+			 * process group leader doesn't exist in this zone.
+			 * In this case assuming that the Linux pid is
+			 * the same as the Solaris pid will get us the
+			 * correct behavior.
+			 */
+			s_pid = -lx_pid;
+		}
+	}
+
+	/*
+	 * Check that it is legal for this signal to be sent to init
+	 */
+	if (s_pid == initpid && (err = lx_init_sig_check(sig, s_pid)) != 0)
+		return (set_errno(err));
+
+	/*
+	 * For individual processes, kill() semantics are the same between
+	 * Solaris and Linux.
+	 */
+	if (lx_pid >= 0)
+		return (kill(s_pid, sig));
+
+	/*
+	 * In Solaris, sending a signal to -pid means "send a signal to
+	 * everyone in process group pid."  In Linux it means "send a
+	 * signal to everyone in the group other than init."  Sending a
+	 * signal to -1 means "send a signal to every process except init
+	 * and myself."
+	 */
+
+	bzero(&v, sizeof (v));
+	v.sig = sig;
+	v.checkperm = 1;
+	v.sicode = SI_USER;
+	err = 0;
+
+	mutex_enter(&pidlock);
+
+	p = (lx_pid == -1) ? practive : pgfind(s_pid);
+	nfound = 0;
+	while (err == 0 && p != NULL) {
+		if ((p->p_zone == zone) && (p->p_stat != SIDL) &&
+		    (p->p_pid != initpid) && (lx_pid < -1 || p != curproc)) {
+			nfound++;
+			err = sigsendproc(p, &v);
+		}
+
+		p = (lx_pid == -1) ? p->p_next : p->p_pglink;
+	}
+	mutex_exit(&pidlock);
+
+	/*
+	 * If we found no processes, we'll return ESRCH -- but unlike our
+	 * native kill(2), we do not return EPERM if processes are found but
+	 * we did not have permission to send any of them a signal.
+	 */
+	if (nfound == 0)
+		err = ESRCH;
+
+	return (err ? set_errno(err) : 0);
+}
+
+/*
+ * This handles the unusual case where the user sends a non-queueable signal
+ * through rt_sigqueueinfo. Signals sent with codes that indicate they are
+ * queuable are sent through the sigqueue syscall via the user level function
+ * lx_rt_sigqueueinfo().
+ */
+int
+lx_helper_rt_sigqueueinfo(pid_t tgid, int sig, siginfo_t *uinfo)
+{
+	proc_t *target_proc;
+	pid_t s_pid;
+	zone_t *zone = curproc->p_zone;
+	sigsend_t send;
+	int err;
+	siginfo_t kinfo;
+
+	if (copyin(uinfo, &kinfo, sizeof (siginfo_t)) != 0)
+		return (set_errno(EFAULT));
+	/* Unlike in lx_kill, this process id must be exact, no negatives. */
+	if (tgid == 0)
+		return (set_errno(ESRCH));
+	if (tgid < 0)
+		return (set_errno(EINVAL));
+	/*
+	 * Translate init directly, otherwise use the convenient utility
+	 * function to translate. Since we're sending to the whole group, we
+	 * only need the solaris pid, and not the lwp id.
+	 */
+	if (tgid == 1) {
+		s_pid = zone->zone_proc_initpid;
+	} else {
+		if (lx_lpid_to_spair(tgid, &s_pid, NULL) != 0) {
+			/*
+			 * If we didn't find this pid that means it doesn't
+			 * exist in this zone.
+			 */
+			return (set_errno(ESRCH));
+		}
+	}
+	/*
+	 * We shouldn't have queuable signals here, those are sent elsewhere by
+	 * the usermode handler for this emulated call.
+	 */
+	if (!SI_CANQUEUE(kinfo.si_code)) {
+		return (set_errno(EINVAL));
+	}
+	/* Since our signal shouldn't queue, we just call sigsendproc(). */
+	bzero(&send, sizeof (send));
+	send.sig = sig;
+	send.checkperm = 1;
+	send.sicode = kinfo.si_code;
+	send.value = kinfo.si_value;
+
+	mutex_enter(&pidlock);
+	target_proc = prfind(s_pid);
+	err = 0;
+	if (target_proc != NULL) {
+		err = sigsendproc(target_proc, &send);
+		if (err == 0 && send.perm == 0)
+			err = EPERM;
+	} else {
+		err = ESRCH;
+	}
+	mutex_exit(&pidlock);
+
+	return (err ? set_errno(err) : 0);
+}
+
+/*
+ * Unlike the above function, this handles all system calls to rt_tgsigqueue
+ * regardless of si_code.
+ */
+int
+lx_helper_rt_tgsigqueueinfo(pid_t tgid, pid_t tid, int sig, siginfo_t *uinfo)
+{
+	int err;
+	proc_t *p = NULL;
+	kthread_t *t;
+	sigqueue_t *sqp;
+	siginfo_t kinfo;
+
+	if (copyin(uinfo, &kinfo, sizeof (siginfo_t)) != 0) {
+		return (set_errno(EFAULT));
+	}
+	sqp = kmem_zalloc(sizeof (sigqueue_t), KM_SLEEP);
+
+	if (lx_lpid_lock(tid, curzone, 0, &p, &t) != 0) {
+		err = ESRCH;
+		goto errout;
+	}
+
+	/*
+	 * For group leaders, the SunOS pid == Linux pid, so the SunOS leader
+	 * pid should be the same as the tgid.   Because the tgid comes in via
+	 * the syscall, we need to check for an invalid value.
+	 */
+	if (p->p_pid != tgid) {
+		err = EINVAL;
+		goto errout;
+	}
+
+	/*
+	 * In order to match the Linux behavior of emitting ESRCH errors before
+	 * confirming that the signal is valid, this check _must_ be performed
+	 * after the target process/thread is located.
+	 */
+	if (sig < 0 || sig >= NSIG) {
+		err = EINVAL;
+		goto errout;
+	}
+
+	/*
+	 * To merely check for the existence of a thread, the caller will pass
+	 * a signal value of 0.
+	 */
+	if (sig != 0) {
+		ASSERT(sqp != NULL);
+
+		sqp->sq_info.si_signo = sig;
+		sqp->sq_info.si_code = kinfo.si_code;
+		sqp->sq_info.si_pid = p->p_pid;
+		sqp->sq_info.si_ctid = PRCTID(p);
+		sqp->sq_info.si_zoneid = getzoneid();
+		sqp->sq_info.si_uid = crgetruid(CRED());
+		sigaddqa(p, t, sqp);
+	}
+	mutex_exit(&p->p_lock);
+	return (0);
+
+errout:
+	if (p != NULL) {
+		mutex_exit(&p->p_lock);
+	}
+	kmem_free(sqp, sizeof (sigqueue_t));
+	return (set_errno(err));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_link.c b/usr/src/uts/common/brand/lx/syscall/lx_link.c
new file mode 100644
index 0000000000..4ebf491d23
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_link.c
@@ -0,0 +1,194 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/fcntl.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/vnode.h>
+#include <sys/systm.h>
+#include <sys/lx_fcntl.h>
+#include <sys/lx_misc.h>
+
+#define	LX_LINK_ALLOWED	(LX_AT_SYMLINK_FOLLOW | LX_AT_EMPTY_PATH)
+
+/* From "uts/common/syscall/stat.c" */
+extern int cstatat_getvp(int, char *, int, vnode_t **, cred_t **);
+/* From uts/common/syscall/unlink.c */
+extern int unlinkat(int, char *, int);
+/* From uts/common/syscall/symlink.c */
+extern int symlinkat(char *, int, char *);
+/* From uts/common/syscall/readlink.c */
+extern ssize_t readlinkat(int, char *, char *, size_t);
+
+static long
+lx_link_common(int ffd, char *from, int tfd, char *to, int flags)
+{
+	int error;
+	vnode_t *fsvp = NULL, *tsvp = NULL;
+	enum symfollow follow = NO_FOLLOW;
+
+	if ((flags & ~LX_LINK_ALLOWED) != 0) {
+		return (set_errno(EINVAL));
+	}
+	if ((flags & LX_AT_EMPTY_PATH) == 0) {
+		char c;
+
+		/*
+		 * Check that both 'from' and 'to' names are non-empty if
+		 * AT_EMPTY_PATH is not set.
+		 */
+		if (copyin(from, &c, sizeof (c)) != 0) {
+			return (set_errno(EFAULT));
+		} else if (c == '\0') {
+			return (set_errno(ENOENT));
+		}
+		if (copyin(to, &c, sizeof (c)) != 0) {
+			return (set_errno(EFAULT));
+		} else if (c == '\0') {
+			return (set_errno(ENOENT));
+		}
+
+		/*
+		 * XXX: When our support for LX capabilities improves, ENOENT
+		 * should be thrown when a process lacking CAP_DAC_READ_SEARCH
+		 * attempts to use the AT_EMPTY_PATH flag.
+		 */
+	}
+	if ((flags & LX_AT_SYMLINK_FOLLOW) != 0) {
+		follow = FOLLOW;
+	}
+
+	if ((error = fgetstartvp(ffd, from, &fsvp)) != 0) {
+		goto out;
+	}
+	if ((error = fgetstartvp(tfd, to, &tsvp)) != 0) {
+		goto out;
+	}
+	error = vn_linkat(fsvp, from, follow, tsvp, to, UIO_USERSPACE);
+
+out:
+	if (fsvp != NULL) {
+		VN_RELE(fsvp);
+	}
+	if (tsvp != NULL) {
+		VN_RELE(tsvp);
+	}
+	if (error) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_link(char *from, char *to)
+{
+	return (lx_link_common(AT_FDCWD, from, AT_FDCWD, to, 0));
+}
+
+long
+lx_linkat(int ffd, char *from, int tfd, char *to, int flags)
+{
+	ffd = (ffd == LX_AT_FDCWD) ? AT_FDCWD : ffd;
+	tfd = (tfd == LX_AT_FDCWD) ? AT_FDCWD : tfd;
+
+	return (lx_link_common(ffd, from, tfd, to, flags));
+}
+
+static boolean_t
+lx_isdir(int atfd, char *path)
+{
+	cred_t *cr = NULL;
+	vnode_t *vp = NULL;
+	boolean_t is_dir;
+
+	if (cstatat_getvp(atfd, path, NO_FOLLOW, &vp, &cr) != 0)
+		return (B_FALSE);
+
+	is_dir = (vp->v_type == VDIR);
+	VN_RELE(vp);
+
+	return (is_dir);
+}
+
+long
+lx_unlink(char *path)
+{
+	int err;
+
+	if ((err = unlinkat(AT_FDCWD, path, 0)) == EPERM) {
+		/* On Linux, an unlink of a dir returns EISDIR, not EPERM. */
+		if (lx_isdir(AT_FDCWD, path))
+			return (set_errno(EISDIR));
+	}
+
+	return (err);
+}
+
+long
+lx_unlinkat(int atfd, char *path, int flag)
+{
+	int err;
+
+	if (atfd == LX_AT_FDCWD)
+		atfd = AT_FDCWD;
+
+	if ((flag = ltos_at_flag(flag, AT_REMOVEDIR, B_TRUE)) < 0)
+		return (set_errno(EINVAL));
+
+	err = unlinkat(atfd, path, flag);
+	if (err == EPERM && !(flag & AT_REMOVEDIR)) {
+		/* On Linux, an unlink of a dir returns EISDIR, not EPERM. */
+		if (lx_isdir(atfd, path))
+			return (set_errno(EISDIR));
+	}
+
+	return (err);
+}
+
+long
+lx_symlink(char *name1, char *name2)
+{
+	return (symlinkat(name1, AT_FDCWD, name2));
+}
+
+long
+lx_symlinkat(char *name1, int atfd, char *name2)
+{
+	if (atfd == LX_AT_FDCWD)
+		atfd = AT_FDCWD;
+
+	return (symlinkat(name1, atfd, name2));
+}
+
+long
+lx_readlink(char *path, char *buf, size_t bufsize)
+{
+	if (bufsize <= 0)
+		return (set_errno(EINVAL));
+
+	return (readlinkat(AT_FDCWD, path, buf, bufsize));
+}
+
+long
+lx_readlinkat(int atfd, char *path, char *buf, size_t bufsize)
+{
+	if (bufsize <= 0)
+		return (set_errno(EINVAL));
+
+	if (atfd == LX_AT_FDCWD)
+		atfd = AT_FDCWD;
+
+	return (readlinkat(atfd, path, buf, bufsize));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_lseek.c b/usr/src/uts/common/brand/lx/syscall/lx_lseek.c
new file mode 100644
index 0000000000..3ac32a2faf
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_lseek.c
@@ -0,0 +1,82 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/errno.h>
+#include <sys/debug.h>
+
+
+#if defined(_SYSCALL32_IMPL) || defined(_ILP32)
+
+/* from uts/common/syscalls/lseek.c */
+extern offset_t llseek32(int32_t, uint32_t, uint32_t, int);
+extern off32_t lseek32(int32_t, off32_t, int32_t);
+
+long
+lx_llseek(int fd, uint32_t off_high, uint32_t off_low, void *out, int whence)
+{
+	offset_t res;
+
+	ASSERT(get_udatamodel() == DATAMODEL_ILP32);
+	res = llseek32(fd, off_low, off_high, whence);
+	if (ttolwp(curthread)->lwp_errno == 0) {
+		if (copyout(&res, out, sizeof (offset_t)) != 0) {
+			return (set_errno(EFAULT));
+		}
+	}
+	return (ttolwp(curthread)->lwp_errno);
+}
+
+
+long
+lx_lseek32(int fd, off32_t offset, int whence)
+{
+	offset_t res;
+	const uint32_t hival = (offset < 0) ? (uint32_t)-1 : 0;
+
+	/*
+	 * When returning EOVERFLOW for an offset which is outside the bounds
+	 * of an off32_t, Linux will still perform the actual seek before
+	 * yielding EOVERFLOW.
+	 *
+	 * In order to emulate that behavior, an llseek bound to the 64-bit
+	 * boundary is used.  The overflow can then be reported after the
+	 * successful seek.
+	 */
+	ASSERT(get_udatamodel() == DATAMODEL_ILP32);
+	res = llseek32(fd, (uint32_t)offset, hival, whence);
+	if (ttolwp(curthread)->lwp_errno == 0 && res > MAXOFF32_T) {
+		return (set_errno(EOVERFLOW));
+	}
+	return (res);
+
+}
+#endif /* defined(_SYSCALL32_IMPL) || defined(_ILP32) */
+
+#if defined(_LP64)
+
+/* from uts/common/syscalls/lseek.c */
+extern off_t lseek64(int, off_t, int);
+
+long
+lx_lseek64(int fd, off_t offset, int whence)
+{
+	ASSERT(get_udatamodel() == DATAMODEL_LP64);
+	return (lseek64(fd, offset, whence));
+}
+
+#endif /* defined(_LP64) */
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_mem.c b/usr/src/uts/common/brand/lx/syscall/lx_mem.c
new file mode 100644
index 0000000000..cc756717f1
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_mem.c
@@ -0,0 +1,1118 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/mman.h>
+#include <sys/debug.h>
+#include <sys/sysmacros.h>
+#include <sys/policy.h>
+#include <sys/lx_brand.h>
+#include <sys/fcntl.h>
+#include <sys/pathname.h>
+#include <vm/seg_vn.h>
+#include <vm/seg_spt.h>
+#include <sys/shm_impl.h>
+#include <vm/as.h>
+
+/* From uts/common/os/grow.c */
+extern int mprotect(caddr_t, size_t, int);
+extern caddr_t smmap64(caddr_t, size_t, int, int, int, off_t);
+extern int munmap(caddr_t, size_t);
+/* From uts/common/syscall/close.c */
+extern int close(int);
+/* From uts/common/fs/proc/prsubr.c */
+extern uint_t pr_getprot(struct seg *, int, void **, caddr_t *, caddr_t *,
+    caddr_t);
+/* From uts/common/vm/seg_spt.c */
+extern struct seg_ops segspt_shmops;
+/* From uts/common/syscall/memcntl.c */
+extern int memcntl(caddr_t, size_t, int, caddr_t, int, int);
+/* From uts/common/os/grow.c */
+extern int smmap_common(caddr_t *, size_t, int, int, struct file *, offset_t);
+
+/*
+ * After Linux 2.6.8, an unprivileged process can lock memory up to its
+ * RLIMIT_MEMLOCK resource limit.
+ *
+ * Within memcntl() it assumes we have PRIV_PROC_LOCK_MEMORY, or the check in
+ * secpolicy_lock_memory() will fail when we attempt to lock memory. Thus,
+ * to support the Linux semantics, we bypass memcntl() and perform the locking
+ * operations directly.
+ */
+
+#define	LX_MADV_NORMAL		0
+#define	LX_MADV_RANDOM		1
+#define	LX_MADV_SEQUENTIAL	2
+#define	LX_MADV_WILLNEED	3
+#define	LX_MADV_DONTNEED	4
+#define	LX_MADV_FREE		8
+#define	LX_MADV_REMOVE		9
+#define	LX_MADV_DONTFORK	10
+#define	LX_MADV_DOFORK		11
+#define	LX_MADV_MERGEABLE	12
+#define	LX_MADV_UNMERGEABLE	13
+#define	LX_MADV_HUGEPAGE	14
+#define	LX_MADV_NOHUGEPAGE	15
+#define	LX_MADV_DONTDUMP	16
+#define	LX_MADV_DODUMP		17
+
+#define	LX_VALID_MSYNC	(MS_ASYNC|MS_INVALIDATE|MS_SYNC)
+
+#define	LX_PROT_GROWSDOWN	0x01000000
+#define	LX_PROT_GROWSUP		0x02000000
+
+/* Internal segment map flags */
+#define	LX_SM_READ	0x01
+#define	LX_SM_WRITE	0x02
+#define	LX_SM_EXEC	0x04
+#define	LX_SM_SHM	0x08
+#define	LX_SM_ANON	0x10
+#define	LX_SM_SHARED	0x20
+#define	LX_SM_NORESERVE	0x40
+
+/* For convenience */
+#define	LX_PROT_GROWMASK	(LX_PROT_GROWSUP|LX_PROT_GROWSDOWN)
+
+/* From lx_rlimit.c */
+extern void lx_get_rctl(char *, struct rlimit64 *);
+
+static int
+lx_mlock_common(int op, uintptr_t addr, size_t len)
+{
+	int err;
+	struct as *as = curproc->p_as;
+	const uintptr_t align_addr = addr & (uintptr_t)PAGEMASK;
+	const size_t align_len = P2ROUNDUP(len + (addr & PAGEOFFSET), PAGESIZE);
+
+	if (len == 0) {
+		/* Linux short-circuits to success on zero length */
+		return (0);
+	} else if ((align_addr + align_len) <= align_addr) {
+		/* Catch overflow (including when aligning len) */
+		return (set_errno(EINVAL));
+	}
+
+	err = as_ctl(as, (caddr_t)align_addr, align_len, op, 0, 0, NULL, 0);
+	if (err == EAGAIN)
+		err = ENOMEM;
+	return (err == 0 ? 0 : set_errno(err));
+}
+
+int
+lx_mlock(uintptr_t addr, size_t len)
+{
+	int err;
+
+	/*
+	 * If the the caller is not privileged and either the limit is 0, or
+	 * the kernel version is earlier than 2.6.9, then fail with EPERM. See
+	 * LTP mlock2.c.
+	 */
+	if ((err = secpolicy_lock_memory(CRED())) != 0) {
+		struct rlimit64 rlim64;
+
+		lx_get_rctl("process.max-locked-memory", &rlim64);
+		if (rlim64.rlim_cur == 0 ||
+		    lx_kern_release_cmp(curzone, "2.6.9") < 0)
+			return (set_errno(err));
+	}
+
+	return (lx_mlock_common(MC_LOCK, addr, len));
+}
+
+int
+lx_munlock(uintptr_t addr, size_t len)
+{
+	return (lx_mlock_common(MC_UNLOCK, addr, len));
+}
+
+int
+lx_mlockall(int flags)
+{
+	int err;
+	struct as *as = curproc->p_as;
+
+	/*
+	 * If the the caller is not privileged and either the limit is 0, or
+	 * the kernel version is earlier than 2.6.9, then fail with EPERM. See
+	 * LTP mlockall2.c.
+	 */
+	if ((err = secpolicy_lock_memory(CRED())) != 0) {
+		struct rlimit64 rlim64;
+
+		lx_get_rctl("process.max-locked-memory", &rlim64);
+		if (rlim64.rlim_cur == 0 ||
+		    lx_kern_release_cmp(curzone, "2.6.9") < 0)
+			return (set_errno(err));
+	}
+
+	if ((flags & ~(MCL_FUTURE | MCL_CURRENT)) || flags == 0)
+		return (set_errno(EINVAL));
+
+	err = as_ctl(as, 0, 0, MC_LOCKAS, 0, (uintptr_t)flags, NULL, 0);
+	if (err == EAGAIN)
+		err = ENOMEM;
+	return (err == 0 ? 0 : set_errno(err));
+}
+
+int
+lx_munlockall(void)
+{
+	int err;
+	struct as *as = curproc->p_as;
+
+	if (lx_kern_release_cmp(curzone, "2.6.9") < 0) {
+		if ((err = secpolicy_lock_memory(CRED())) != 0)
+			return (set_errno(err));
+	}
+
+	err = as_ctl(as, 0, 0, MC_UNLOCKAS, 0, 0, NULL, 0);
+	return (err == 0 ? 0 : set_errno(err));
+}
+
+int
+lx_msync(uintptr_t addr, size_t len, int flags)
+{
+	const size_t align_len = P2ROUNDUP(len, PAGESIZE);
+
+	if ((addr & PAGEOFFSET) != 0 ||
+	    (flags & ~LX_VALID_MSYNC) != 0) {
+		return (set_errno(EINVAL));
+	} else if (len == 0) {
+		/* Linux short-circuits to success on zero length */
+		return (0);
+	} else if ((addr + align_len) < addr) {
+		/* Catch overflow (including when aligning len) */
+		return (set_errno(ENOMEM));
+	}
+
+	return (memcntl((caddr_t)addr, align_len, MC_SYNC,
+	    (caddr_t)(uintptr_t)flags, 0, 0));
+}
+
+int
+lx_madvise(uintptr_t addr, size_t len, int advice)
+{
+	int err;
+	const size_t align_len = P2ROUNDUP(len, PAGESIZE);
+
+	switch (advice) {
+	case LX_MADV_REMOVE:
+		/* approximately similar */
+		advice = MADV_FREE;
+		break;
+
+	case LX_MADV_DONTNEED:
+		/*
+		 * On Linux, MADV_DONTNEED implies an immediate purge of the
+		 * specified region.  This is spuriously different from
+		 * (nearly) every other Unix, having apparently been done to
+		 * mimic the semantics on Digital Unix (!).  This is bad enough
+		 * (MADV_FREE both has better semantics and results in better
+		 * performance), but it gets worse:  Linux applications (and
+		 * notably, jemalloc) have managed to depend on the busted
+		 * semantics of MADV_DONTNEED on Linux.  We implement these
+		 * semantics via MADV_PURGE -- and we translate our advice
+		 * accordingly.
+		 */
+		advice = MADV_PURGE;
+		break;
+
+	case LX_MADV_FREE:
+		advice = MADV_FREE;
+		break;
+
+	case LX_MADV_NORMAL:
+	case LX_MADV_RANDOM:
+	case LX_MADV_SEQUENTIAL:
+	case LX_MADV_WILLNEED:
+		/* These map directly to the illumos values */
+		break;
+
+	case LX_MADV_DONTFORK:
+	case LX_MADV_DOFORK:
+	case LX_MADV_HUGEPAGE:
+	case LX_MADV_NOHUGEPAGE:
+	case LX_MADV_DONTDUMP:
+	case LX_MADV_DODUMP:
+		/* harmless to pretend these work */
+		return (0);
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	if ((addr & PAGEOFFSET) != 0) {
+		return (set_errno(EINVAL));
+	} else if (len == 0) {
+		/* Linux short-circuits to success on zero length */
+		return (0);
+	} else if ((addr + align_len) <= addr) {
+		/*
+		 * Catch overflow (including when aligning len).  Unlike
+		 * similar syscalls, this is an EINVAL failure for madvise(2).
+		 */
+		return (set_errno(EINVAL));
+	}
+
+	err = memcntl((caddr_t)addr, align_len, MC_ADVISE,
+	    (caddr_t)(intptr_t)advice, 0, 0);
+	if (err == EBUSY) {
+		if (advice != MADV_PURGE) {
+			return (set_errno(EINVAL));
+		}
+		/*
+		 * If we received an EBUSY from a MADV_PURGE, we will now try
+		 * again with a MADV_DONTNEED: there are conditions (namely,
+		 * with locked mappings that haven't yet been faulted in) where
+		 * MADV_PURGE will fail but MADV_DONTNEED will succeed.  If
+		 * this succeeds, we'll call the operation a success; if not,
+		 * we'll kick back EINVAL.
+		 */
+		advice = MADV_DONTNEED;
+		err = memcntl((caddr_t)addr, align_len, MC_ADVISE,
+		    (caddr_t)(intptr_t)advice, 0, 0);
+		if (err != 0) {
+			return (set_errno(EINVAL));
+		}
+		/* Clear the old errno since success was eventually achieved. */
+		ttolwp(curthread)->lwp_errno = 0;
+	}
+	return (err);
+}
+
+int
+lx_mprotect(uintptr_t addr, size_t len, int prot)
+{
+	const size_t align_len = P2ROUNDUP(len, PAGESIZE);
+
+	/*
+	 * The flags for native mprotect(2) are essentially the same as those
+	 * on Linux, with the exception of PROT_GROWSUP/PROT_GROWSDOWN, for
+	 * which there is no native analog.  Those flags are presently ignored,
+	 * unless they are both present, which represents an invalid argument.
+	 */
+	if ((prot & LX_PROT_GROWMASK) == LX_PROT_GROWMASK) {
+		return (set_errno(EINVAL));
+	}
+	prot &= ~(LX_PROT_GROWMASK);
+
+	if ((addr & PAGEOFFSET) != 0) {
+		return (set_errno(EINVAL));
+	} else if (len == 0) {
+		/* Linux short-circuits to success on zero length */
+		return (0);
+	} else if ((addr + align_len) <= addr) {
+		/* Catch overflow (including when aligning len) */
+		return (set_errno(ENOMEM));
+	}
+
+	return (mprotect((void *)addr, align_len, prot));
+}
+
+/*
+ * There are two forms of mmap, mmap() and mmap2().  The only difference is that
+ * the final argument to mmap2() specifies the number of pages, not bytes. Also,
+ * mmap2 is 32-bit only.
+ *
+ * Linux has a number of additional flags, but they are all deprecated.  We also
+ * ignore the MAP_GROWSDOWN flag, which has no equivalent on Solaris.
+ *
+ * The Linux mmap() returns ENOMEM in some cases where illumos returns
+ * EOVERFLOW, so we translate the errno as necessary.
+ */
+
+#define	LX_MAP_ANONYMOUS	0x00020
+#define	LX_MAP_LOCKED		0x02000
+#define	LX_MAP_NORESERVE	0x04000
+#define	LX_MAP_32BIT		0x00040
+
+#define	ONE_GB			0x40000000
+
+static void lx_remap_anoncache_invalidate(uintptr_t, size_t);
+
+static int
+lx_ltos_mmap_flags(int flags)
+{
+	int new_flags;
+
+	new_flags = flags & (MAP_TYPE | MAP_FIXED);
+
+	if (flags & LX_MAP_ANONYMOUS)
+		new_flags |= MAP_ANONYMOUS;
+	if (flags & LX_MAP_NORESERVE)
+		new_flags |= MAP_NORESERVE;
+
+#if defined(_LP64)
+	if (flags & LX_MAP_32BIT)
+		new_flags |= MAP_32BIT;
+#endif
+
+	return (new_flags);
+}
+
+static void *
+lx_mmap_common(void *addr, size_t len, int prot, int flags, int fd, off64_t off)
+{
+	caddr_t ret;
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+
+	/*
+	 * Under Linux, the file descriptor is ignored when mapping zfod
+	 * anonymous memory,  On illumos, we want the fd set to -1 for the
+	 * same functionality.
+	 */
+	if (flags & LX_MAP_ANONYMOUS)
+		fd = -1;
+
+	/*
+	 * We refuse, as a matter of principle, to overcommit memory.
+	 * Unfortunately, several bits of important and popular software expect
+	 * to be able to pre-allocate large amounts of virtual memory but then
+	 * probably never use it.  One particularly bad example of this
+	 * practice is golang. Another is the JVM.
+	 *
+	 * In the interest of running software, unsafe or not, we fudge
+	 * something vaguely similar to overcommit by permanently enabling
+	 * MAP_NORESERVE unless MAP_LOCKED was requested:
+	 */
+	if (!(flags & LX_MAP_LOCKED)) {
+		flags |= LX_MAP_NORESERVE;
+	}
+
+	/*
+	 * This is totally insane. The NOTES section in the linux mmap(2) man
+	 * page claims that on some architectures, read protection may
+	 * automatically include exec protection. It has been observed on a
+	 * native linux system that the /proc/<pid>/maps file does indeed
+	 * show that segments mmap'd from userland (such as libraries mapped in
+	 * by the dynamic linker) all have exec the permission set, even for
+	 * data segments.
+	 *
+	 * This insanity is tempered by the fact that the behavior is disabled
+	 * for ELF binaries bearing a PT_GNU_STACK header which lacks PF_X
+	 * (which most do).  Such a header will clear the READ_IMPLIES_EXEC
+	 * flag from the process personality.
+	 */
+	if (prot & PROT_READ) {
+		if ((lxpd->l_personality & LX_PER_READ_IMPLIES_EXEC) != 0) {
+			prot |= PROT_EXEC;
+		}
+	}
+
+	ret = smmap64(addr, len, prot, lx_ltos_mmap_flags(flags), fd, off);
+	if (ttolwp(curthread)->lwp_errno != 0) {
+		if (ttolwp(curthread)->lwp_errno == EOVERFLOW)
+			(void) set_errno(ENOMEM);
+		return ((void *)-1);
+	}
+
+	if (flags & LX_MAP_LOCKED) {
+		(void) lx_mlock_common(MC_LOCK, (uintptr_t)ret, len);
+		/* clear any errno from mlock */
+		ttolwp(curthread)->lwp_errno = 0;
+	}
+
+	/*
+	 * We have a new mapping; invalidate any cached anonymous regions that
+	 * overlap(ped) with it.
+	 */
+	mutex_enter(&lxpd->l_remap_anoncache_lock);
+	lx_remap_anoncache_invalidate((uintptr_t)ret, len);
+	mutex_exit(&lxpd->l_remap_anoncache_lock);
+
+	return (ret);
+}
+
+long
+lx_mmap(void *addr, size_t len, int prot, int flags, int fd, off64_t off)
+{
+	return ((ssize_t)lx_mmap_common(addr, len, prot, flags, fd, off));
+}
+
+long
+lx_mmap2(void *addr, size_t len, int prot, int flags,
+    int fd, off_t off)
+{
+	return ((ssize_t)lx_mmap_common(addr, len, prot, flags, fd,
+	    (off64_t)off * PAGESIZE));
+}
+
+long
+lx_munmap(void *addr, size_t len)
+{
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+
+	/*
+	 * Invalidate any cached anonymous regions that overlap(ped) with it.
+	 */
+	mutex_enter(&lxpd->l_remap_anoncache_lock);
+	lx_remap_anoncache_invalidate((uintptr_t)addr, len);
+	mutex_exit(&lxpd->l_remap_anoncache_lock);
+
+	return (munmap(addr, len));
+}
+
+#define	LX_MREMAP_MAYMOVE	1	/* mapping can be moved */
+#define	LX_MREMAP_FIXED		2	/* address is fixed */
+
+/*
+ * Unfortunately, the Linux mremap() manpage contains a statement that is, at
+ * best, grossly oversimplified: that mremap() "can be used to implement a
+ * very efficient realloc(3)."  To the degree this is true at all, it is only
+ * true narrowly (namely, when large buffers are being expanded but can't be
+ * expanded in place due to virtual address space restrictions) -- but
+ * apparently, someone took this very literally, because variants of glibc
+ * appear to simply implement realloc() in terms of mremap().  This is
+ * unfortunate because absent intelligent usage, it forces realloc() to have
+ * an unncessary interaction with the VM system for small expansions -- and if
+ * realloc() is itself abused (e.g., if a consumer repeatedly expands and
+ * contracts the same memory buffer), the net result can be less efficient
+ * than a much more naive realloc() implementation.  And if native Linux is
+ * suboptimal in this case, we are deeply pathological, having not
+ * historically supported mremap() for anonymous mappings at all.  To make
+ * this at least palatable, we not only support remap for anonymous mappings
+ * (see lx_remap_anon(), below), we also cache the metadata associated with
+ * these anonymous remappings to reduce the need to search our address space.
+ * We implement the anonymous metadata cache with l_remap_anoncache, an LRU
+ * cache of lx_segmap_t's that correspond to anonymous segments that have been
+ * resized (only anonymous mappings that have been remapped are cached). The
+ * cache is part of the process's lx-brand-specifc data.
+ */
+
+/*
+ * Search our address space (as) mappings to find the specified mapping. This
+ * is derived from the procfs prgetmap() code. We implement the "reserved"
+ * behavior on the segment so as to accommodate the case where an mmap()'d and
+ * then ftruncate()'d file is being mremap()'d: we use the size of the
+ * mapping (which we need to validate old_size).
+ *
+ * Return 0 if mapping is found, errno if there is a problem or if mapping
+ * not found. If the mapping is found, we populate the mp parameter, vpp and
+ * offp with the results.
+ */
+static int
+lx_get_mapping(uintptr_t find_addr, size_t find_size, lx_segmap_t *mp,
+    vnode_t **vpp, offset_t *offp)
+{
+	struct as *as = curproc->p_as;
+	struct seg *seg;
+	uint_t prot;
+	caddr_t saddr, eaddr, naddr;
+
+	/* pr_getprot asserts that the as is held as a writer */
+	AS_LOCK_ENTER(as, RW_WRITER);
+
+	seg = as_segat(as, (caddr_t)find_addr);
+	if (seg == NULL || (seg->s_flags & S_HOLE) != 0) {
+		AS_LOCK_EXIT(as);
+		return (EFAULT);
+	}
+
+	/*
+	 * We're interested in the reserved space, so we use the size of the
+	 * segment itself.
+	 */
+	eaddr = seg->s_base + seg->s_size;
+	for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
+		uintptr_t vaddr;
+		size_t size;
+		struct vnode *vp;
+		void *tmp = NULL;
+
+		prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
+		if (saddr == naddr)
+			continue;
+
+		vaddr = (uintptr_t)saddr;
+		size = (uintptr_t)naddr - (uintptr_t)saddr;
+
+		if (vaddr == find_addr && find_size < size &&
+		    (find_size & PAGEOFFSET) != 0) {
+			/*
+			 * We found a mapping but the size being requested is
+			 * less than the mapping and not a multiple of our page
+			 * size. If it is an anonymous mapping, that likely
+			 * means the application did the initial mmap with this
+			 * odd size. We'll round up to the next page boundary
+			 * in this case.
+			 */
+			if (seg->s_ops == &segspt_shmops ||
+			    (seg->s_ops == &segvn_ops &&
+			    (SEGOP_GETVP(seg, saddr, &vp) != 0 ||
+			    vp == NULL))) {
+				/*
+				 * It's anonymous, round up the size.
+				 */
+				find_size = ptob(btopr(find_size));
+			}
+		}
+
+		/* Check if mapping matches our arguments */
+		if (vaddr == find_addr && size == find_size) {
+			struct vattr vattr;
+
+			mp->lxsm_vaddr = vaddr;
+			mp->lxsm_size = size;
+			mp->lxsm_flags = 0;
+
+			*offp = SEGOP_GETOFFSET(seg, saddr);
+
+			if (prot & PROT_READ)
+				mp->lxsm_flags |= LX_SM_READ;
+			if (prot & PROT_WRITE)
+				mp->lxsm_flags |= LX_SM_WRITE;
+			if (prot & PROT_EXEC)
+				mp->lxsm_flags |= LX_SM_EXEC;
+			if (SEGOP_GETTYPE(seg, saddr) & MAP_SHARED)
+				mp->lxsm_flags |= LX_SM_SHARED;
+			if (SEGOP_GETTYPE(seg, saddr) & MAP_NORESERVE)
+				mp->lxsm_flags |= LX_SM_NORESERVE;
+			if (seg->s_ops == &segspt_shmops ||
+			    (seg->s_ops == &segvn_ops &&
+			    (SEGOP_GETVP(seg, saddr, &vp) != 0 ||
+			    vp == NULL)))
+				mp->lxsm_flags |= LX_SM_ANON;
+
+			if (seg->s_ops == &segspt_shmops) {
+				mp->lxsm_flags |= LX_SM_SHM;
+			} else if ((mp->lxsm_flags & LX_SM_SHARED) &&
+			    curproc->p_segacct && shmgetid(curproc,
+			    seg->s_base) != SHMID_NONE) {
+				mp->lxsm_flags |= LX_SM_SHM;
+			}
+
+			vattr.va_mask = AT_FSID | AT_NODEID;
+			if (seg->s_ops == &segvn_ops &&
+			    SEGOP_GETVP(seg, saddr, &vp) == 0 &&
+			    vp != NULL && vp->v_type == VREG &&
+			    VOP_GETATTR(vp, &vattr, 0, CRED(),
+			    NULL) == 0) {
+				VN_HOLD(vp);
+				*vpp = vp;
+			} else {
+				*vpp = NULL;
+			}
+
+			AS_LOCK_EXIT(as);
+			return (0);
+		}
+
+		if (vaddr <= find_addr &&
+		    find_addr + find_size < vaddr + size) {
+			/*
+			 * We have a mismatch, but our specified range is a
+			 * subset of the actual segment; this is EINVAL.
+			 */
+			AS_LOCK_EXIT(as);
+			DTRACE_PROBE2(lx__mremap__badsubset, caddr_t,
+			    vaddr, size_t, size);
+			return (EINVAL);
+		}
+	}
+
+	AS_LOCK_EXIT(as);
+	return (EFAULT);
+}
+
+static void
+lx_remap_anoncache_invalidate(uintptr_t addr, size_t size)
+{
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+	uint_t i;
+
+	ASSERT(MUTEX_HELD(&lxpd->l_remap_anoncache_lock));
+
+	if (lxpd->l_remap_anoncache_generation == 0)
+		return;
+
+	for (i = 0; i < LX_REMAP_ANONCACHE_NENTRIES; i++) {
+		lx_segmap_t *map = &lxpd->l_remap_anoncache[i];
+
+		/*
+		 * If the ranges overlap at all, we zap it.
+		 */
+		if (addr < map->lxsm_vaddr + map->lxsm_size &&
+		    map->lxsm_vaddr < addr + size) {
+			bzero(map, sizeof (lx_segmap_t));
+		}
+	}
+}
+
+static void
+lx_remap_anoncache_load(lx_segmap_t *map, size_t size)
+{
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+	uint64_t oldest = UINT64_MAX;
+	lx_segmap_t *evict = NULL;
+	uint_t i;
+
+	ASSERT(MUTEX_HELD(&lxpd->l_remap_anoncache_lock));
+
+	for (i = 0; i < LX_REMAP_ANONCACHE_NENTRIES; i++) {
+		lx_segmap_t *cp = &lxpd->l_remap_anoncache[i];
+
+		if (cp->lxsm_vaddr == map->lxsm_vaddr) {
+			/*
+			 * We're already in the cache -- we just need to update
+			 * our LRU field and size to reflect the hit.
+			 */
+			cp->lxsm_lru = lxpd->l_remap_anoncache_generation++;
+			cp->lxsm_size = size;
+			return;
+		}
+
+		if (cp->lxsm_vaddr == 0) {
+			evict = cp;
+			break;
+		}
+
+		if (cp->lxsm_lru < oldest) {
+			oldest = cp->lxsm_lru;
+			evict = cp;
+		}
+	}
+
+	/* Update the entry we're evicting */
+	ASSERT(evict != NULL);
+	evict->lxsm_vaddr = map->lxsm_vaddr;
+	evict->lxsm_size = size;
+	evict->lxsm_flags = map->lxsm_flags;
+	evict->lxsm_lru = lxpd->l_remap_anoncache_generation++;
+}
+
+static int lx_u2u_copy(void *, void *, size_t);
+
+/*
+ * As part of lx_remap() (see below) and to accommodate heavy realloc() use
+ * cases (see the discussion of the l_remap_anoncache, above), we allow
+ * anonymous segments to be "remapped" in that we are willing to truncate them
+ * or append to them (as much as that's allowed by virtual address space
+ * usage).  If we fall out of these cases, we take the more expensive option
+ * of actually copying the data to a new segment -- but we locate the address
+ * in a portion of the address space that should give us plenty of VA space to
+ * expand.
+ *
+ * We return the address of the mapping or set errno if there is a problem.
+ */
+static long
+lx_remap_anon(lx_segmap_t *mapin, size_t new_size, uint_t flags,
+    uintptr_t new_addr)
+{
+	lx_segmap_t m;
+	int mflags = MAP_ANON;
+	int prot = 0;
+	void *addr, *hint = NULL;
+
+	ASSERT(MUTEX_HELD(&ptolxproc(curproc)->l_remap_anoncache_lock));
+
+	/*
+	 * Make a copy of the input lx_segmap_t argument since it might be
+	 * a reference into the anon cache, and we're manipulating cache
+	 * entries during this function.
+	 */
+	m = *mapin;
+
+	/*
+	 * If our new size is less than our old size and we're either not
+	 * being ordered to move it or the address we're being ordered to
+	 * move it to is our current address, we can just act as Procrustes
+	 * and chop off anything larger than the new size.
+	 */
+	if (new_size < m.lxsm_size && (!(flags & LX_MREMAP_FIXED) ||
+	    new_addr == m.lxsm_vaddr)) {
+		if (munmap((void *)(m.lxsm_vaddr + new_size),
+		    m.lxsm_size - new_size) != 0) {
+			return (set_errno(EINVAL));
+		}
+
+		lx_remap_anoncache_load(&m, new_size);
+		return (m.lxsm_vaddr);
+	}
+
+	if (m.lxsm_flags & LX_SM_SHM)
+		return (set_errno(EINVAL));
+
+	if (m.lxsm_flags & LX_SM_WRITE)
+		prot |= PROT_WRITE;
+
+	if (m.lxsm_flags & LX_SM_READ)
+		prot |= PROT_READ;
+
+	if (m.lxsm_flags & LX_SM_EXEC)
+		prot |= PROT_EXEC;
+
+	mflags |= (m.lxsm_flags & LX_SM_SHARED) ? MAP_SHARED : MAP_PRIVATE;
+
+	if (m.lxsm_flags & LX_SM_NORESERVE)
+		mflags |= MAP_NORESERVE;
+
+	/*
+	 * If we're not being told where to move it, let's try to expand our
+	 * mapping in place by adding a fixed mapping after it.
+	 */
+	if (!(flags & LX_MREMAP_FIXED)) {
+		void *tmp_addr = (void *)(m.lxsm_vaddr + m.lxsm_size);
+
+		ASSERT(new_size > m.lxsm_size);
+		addr = smmap64(tmp_addr, new_size - m.lxsm_size, prot,
+		    mflags, -1, 0);
+		if (ttolwp(curthread)->lwp_errno != 0) {
+			/* There is no place to mmap some extra anon */
+			return (set_errno(EINVAL));
+		}
+
+		if (addr == tmp_addr) {
+			/* The expansion worked */
+			lx_remap_anoncache_load(&m, new_size);
+			return (m.lxsm_vaddr);
+		}
+
+		/*
+		 * Our advisory address was not followed -- which, as a
+		 * practical matter, means that the range conflicted with an
+		 * extant mapping.  Unmap wherever our attempted expansion
+		 * landed, and drop into the relocation case.
+		 */
+		(void) munmap(addr, new_size - m.lxsm_size);
+	}
+
+	lx_remap_anoncache_invalidate(m.lxsm_vaddr, m.lxsm_size);
+
+	/*
+	 * If we're here, we actually need to move this mapping -- so if we
+	 * can't move it, we're done.
+	 */
+	if (!(flags & LX_MREMAP_MAYMOVE))
+		return (set_errno(ENOMEM));
+
+	/*
+	 * If this is a shared private mapping, we can't remap it.
+	 */
+	if (m.lxsm_flags & LX_SM_SHARED)
+		return (set_errno(EINVAL));
+
+	if (flags & LX_MREMAP_FIXED) {
+		mflags |= MAP_FIXED;
+		hint = (void *)new_addr;
+	} else {
+		/*
+		 * Search our address space for a gap to remap into. To give
+		 * ourselves plenty of room for further mremap() expansion,
+		 * we'll multiply our new size by 16 and look for a gap at
+		 * least that big. Historically we looked for an empty gap
+		 * around the 2GB region, so we start our search for the lowest
+		 * gap in that vicinity.
+		 */
+		caddr_t base;
+		size_t upper;
+
+		base = (caddr_t)ONE_GB;
+		upper = (uintptr_t)USERLIMIT - (uintptr_t)base;
+
+		if (as_gap(curproc->p_as, (new_size << 4UL), &base, &upper,
+		    AH_LO, NULL) != -1)
+			hint = base;
+	}
+
+	addr = smmap64(hint, new_size, prot, mflags, -1, 0);
+	if (ttolwp(curthread)->lwp_errno != 0) {
+		return (ttolwp(curthread)->lwp_errno);
+	}
+
+	if (lx_u2u_copy((void *)m.lxsm_vaddr, addr, m.lxsm_size) != 0) {
+		/* We couldn't complete the relocation, backout & fail */
+		(void) munmap(addr, new_size);
+		return (set_errno(ENOMEM));
+	}
+
+	(void) munmap((void *)m.lxsm_vaddr, m.lxsm_size);
+
+	/*
+	 * Add the relocated mapping to the cache.
+	 */
+	m.lxsm_vaddr = (uintptr_t)addr;
+	lx_remap_anoncache_load(&m, new_size);
+
+	return ((long)addr);
+}
+
+/*
+ * We don't have a native mremap() (nor do we particularly want one), so
+ * we emulate it strictly in lx.  The idea is simple: we just want to
+ * mmap() the underlying object with the new size and rip down the old mapping.
+ * However, this is slightly complicated because we don't actually have the
+ * file descriptor that corresponds to the resized mapping. So to get a file
+ * descriptor, we may have to search our address space for the mapping and use
+ * the associated vnode to create a file descriptor. Assuming that this
+ * succeeds, we then mmap() it and rip down the original mapping.  There are
+ * clearly many reasons why this might fail; absent a more apt errno (e.g.,
+ * ENOMEM in some cases), we return EINVAL to denote these cases.
+ */
+long
+lx_mremap(uintptr_t old_addr, size_t old_size, size_t new_size, int flags,
+    uintptr_t new_addr)
+{
+	int prot = 0, oflags, mflags = 0, i, res;
+	lx_segmap_t map, *mp;
+	int rval = 0;
+	lx_proc_data_t *lxpd;
+	offset_t off;
+	struct vnode *vp = NULL;
+	file_t *fp;
+	caddr_t naddr;
+
+	if (flags & LX_MREMAP_FIXED) {
+		/* MREMAP_FIXED requires MREMAP_MAYMOVE */
+		if ((flags & LX_MREMAP_MAYMOVE) == 0)
+			return (set_errno(EINVAL));
+
+		if (new_addr & PAGEOFFSET)
+			return (set_errno(EINVAL));
+
+		mflags |= MAP_FIXED;
+	} else {
+		if (new_size == old_size)
+			return (old_addr);
+
+		/* new_addr is optional and only valid when LX_MREMAP_FIXED. */
+		new_addr = NULL;
+	}
+
+	if (old_addr & PAGEOFFSET)
+		return (set_errno(EINVAL));
+
+	if (new_size == 0)
+		return (set_errno(EINVAL));
+
+	/*
+	 * First consult the anoncache; if we find the segment there, we'll
+	 * drop straight into lx_remap_anon() and save ourself the pain of
+	 * searching our address space.
+	 */
+	lxpd = ptolxproc(curproc);
+	mutex_enter(&lxpd->l_remap_anoncache_lock);
+
+	for (i = 0; i < LX_REMAP_ANONCACHE_NENTRIES; i++) {
+		long rv;
+
+		mp = &lxpd->l_remap_anoncache[i];
+
+		if (mp->lxsm_vaddr != old_addr)
+			continue;
+
+		if (mp->lxsm_size != old_size)
+			continue;
+
+		/*
+		 * lx_remap_anon will either:
+		 * a) expand/contract in place, returning old_addr
+		 * b) relocate & expand the mapping, returning a new address
+		 * c) there will be an error of some sort and errno will be set
+		 */
+		rv = lx_remap_anon(mp, new_size, flags, new_addr);
+		mutex_exit(&lxpd->l_remap_anoncache_lock);
+		return (rv);
+	}
+
+	mutex_exit(&lxpd->l_remap_anoncache_lock);
+
+	/*
+	 * Search our address space to find the specified mapping.
+	 */
+	if ((res = lx_get_mapping(old_addr, old_size, &map, &vp, &off)) > 0)
+		return (set_errno(res));
+
+	/*
+	 * We found the mapping.
+	 */
+	mp = &map;
+	DTRACE_PROBE1(lx__mremap__seg, lx_segmap_t *, mp);
+
+	if (mp->lxsm_flags & LX_SM_SHM) {
+		/*
+		 * If this is either ISM or System V shared memory, we're not
+		 * going to remap it.
+		 */
+		rval = set_errno(EINVAL);
+		goto out;
+	}
+
+	if (mp->lxsm_flags & LX_SM_ANON) {
+		/*
+		 * This is an anonymous mapping -- which is the one case in
+		 * which we perform something that approaches a true remap.
+		 */
+		long rv;
+
+		if (vp != NULL)
+			VN_RELE(vp);
+		mutex_enter(&lxpd->l_remap_anoncache_lock);
+		rv = lx_remap_anon(mp, new_size, flags, new_addr);
+		mutex_exit(&lxpd->l_remap_anoncache_lock);
+		return (rv);
+	}
+
+	/* The rest of the code is for a 'named' mapping */
+
+	if (!(flags & LX_MREMAP_MAYMOVE)) {
+		/*
+		 * If we're not allowed to move this mapping, we're going to
+		 * act as if we can't expand it.
+		 */
+		rval = set_errno(ENOMEM);
+		goto out;
+	}
+
+	if (!(mp->lxsm_flags & LX_SM_SHARED)) {
+		/*
+		 * If this is a private mapping, we're not going to remap it.
+		 */
+		rval = set_errno(EINVAL);
+		goto out;
+	}
+
+	oflags = (mp->lxsm_flags & LX_SM_WRITE) ? (FWRITE | FREAD) : FREAD;
+	if (vp == NULL) {
+		/*
+		 * If vp is NULL, the path might not exist. We're going to kick
+		 * it back with EINVAL.
+		 */
+		rval = set_errno(EINVAL);
+		goto out;
+	}
+
+	/* falloc cannot fail with a NULL fdp. */
+	VERIFY0(falloc(vp, oflags, &fp, NULL));
+	mutex_exit(&fp->f_tlock);
+
+	if (mp->lxsm_flags & LX_SM_WRITE)
+		prot |= PROT_WRITE;
+
+	if (mp->lxsm_flags & LX_SM_READ)
+		prot |= PROT_READ;
+
+	if (mp->lxsm_flags & LX_SM_EXEC)
+		prot |= PROT_EXEC;
+
+	mflags |= MAP_SHARED;
+
+	/*
+	 * We're using smmap_common to pass the fp directly, instead of
+	 * initializing a temporary file descriptor for smmap64(), so as to
+	 * prevent any inadvertent use of that temporary fd within the
+	 * application.
+	 */
+	naddr = (caddr_t)new_addr;
+	rval = smmap_common(&naddr, new_size, prot, mflags, fp, off);
+
+	mutex_enter(&fp->f_tlock);
+	unfalloc(fp);
+
+	if (rval != 0) {
+		rval = set_errno(ENOMEM);
+		goto out;
+	}
+
+	/*
+	 * Our mapping succeeded; we're now going to rip down the old mapping.
+	 */
+	(void) munmap((void *)old_addr, old_size);
+
+out:
+	if (vp != NULL)
+		VN_RELE(vp);
+
+	if (rval == 0)
+		return ((long)naddr);
+	return ((long)rval);
+}
+
+#pragma GCC diagnostic ignored "-Wclobbered"
+/*
+ * During mremap we had to relocate the initial anonymous mapping to a new
+ * location (a new anonymous mapping). Copy the user-level data from the first
+ * mapping to the second mapping.
+ *
+ * We have to lock both sides to ensure there is no fault. We do this in 16MB
+ * chunks at a time and we do not concern ourselves with the zone's
+ * max-locked-memory rctl.
+ *
+ * Keep this function at the end since we're disabling the compiler's "clobber"
+ * check due to the on_fault call.
+ */
+static int
+lx_u2u_copy(void *src, void *dst, size_t len)
+{
+	size_t mlen;
+	caddr_t sp, dp;
+	int err;
+	page_t **ppa_src, **ppa_dst;
+	label_t ljb;
+	struct as *p_as = curproc->p_as;
+
+	/* Both sides should be page aligned since they're from smmap64 */
+	ASSERT(((uintptr_t)src & PAGEOFFSET) == 0);
+	ASSERT(((uintptr_t)dst & PAGEOFFSET) == 0);
+	/* Both came from mmap, so they should be valid user pointers */
+	ASSERT((uintptr_t)src < USERLIMIT && (uintptr_t)dst < USERLIMIT);
+
+	sp = src;
+	dp = dst;
+
+	do {
+		mlen = MIN(len, 16 * 1024 * 1024);
+
+		err = as_pagelock(p_as, &ppa_src, sp, mlen, S_READ);
+		if (err != 0) {
+			return (err);
+		}
+		err = as_pagelock(p_as, &ppa_dst, dp, mlen, S_WRITE);
+		if (err != 0) {
+			as_pageunlock(p_as, ppa_src, sp, mlen, S_READ);
+			return (err);
+		}
+
+		DTRACE_PROBE3(lx__mremap__copy, void *, sp, void *, dp,
+		    size_t, mlen);
+
+		/* on_fault calls smap_disable */
+		if (on_fault(&ljb)) {
+			/*
+			 * Given that the pages are locked and smap is disabled,
+			 * we really should never get here. If we somehow do
+			 * get here, the copy fails just as if we could not
+			 * lock the pages to begin with.
+			 */
+			as_pageunlock(p_as, ppa_dst, dp, mlen, S_WRITE);
+			as_pageunlock(p_as, ppa_src, sp, mlen, S_READ);
+			return (EFAULT);
+		}
+		ucopy(sp, dp, mlen);
+		no_fault();		/* calls smap_enable */
+
+		as_pageunlock(p_as, ppa_dst, dp, mlen, S_WRITE);
+		as_pageunlock(p_as, ppa_src, sp, mlen, S_READ);
+
+		len -= mlen;
+		sp += mlen;
+		dp += mlen;
+	} while (len > 0);
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_miscsys.c b/usr/src/uts/common/brand/lx/syscall/lx_miscsys.c
new file mode 100644
index 0000000000..5245b32870
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_miscsys.c
@@ -0,0 +1,495 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/systeminfo.h>
+#include <sys/fcntl.h>
+#include <sys/resource.h>
+#include <sys/uadmin.h>
+#include <sys/lx_misc.h>
+#include <lx_syscall.h>
+
+#define	LINUX_REBOOT_MAGIC1		0xfee1dead
+#define	LINUX_REBOOT_MAGIC2		672274793
+#define	LINUX_REBOOT_MAGIC2A		85072278
+#define	LINUX_REBOOT_MAGIC2B		369367448
+#define	LINUX_REBOOT_MAGIC2C		537993216
+
+#define	LINUX_REBOOT_CMD_RESTART	0x1234567
+#define	LINUX_REBOOT_CMD_HALT		0xcdef0123
+#define	LINUX_REBOOT_CMD_CAD_ON		0x89abcdef
+#define	LINUX_REBOOT_CMD_CAD_OFF	0
+#define	LINUX_REBOOT_CMD_POWER_OFF	0x4321fedc
+#define	LINUX_REBOOT_CMD_RESTART2	0xa1b2c3d4
+#define	LINUX_REBOOT_CMD_SW_SUSPEND	0xD000FCE2
+#define	LINUX_REBOOT_CMD_KEXEC		0x45584543
+
+#define	LX_RUSAGE_SELF			0
+#define	LX_RUSAGE_CHILDREN		(-1)
+#define	LX_RUSAGE_BOTH			(-2)
+#define	LX_RUSAGE_THREAD		1
+
+#define	LX_SWAP_PRIOMASK		0x7fff
+#define	LX_SWAP_PREFER			0x8000
+#define	LX_SWAP_DISCARD			0x10000
+#define	LX_SWAP_DISCARD_ONCE		0x20000
+#define	LX_SWAP_DISCARD_PAGES		0x40000
+
+#define	LX_SWAP_ALL			(LX_SWAP_DISCARD_PAGES | \
+					LX_SWAP_DISCARD_ONCE | \
+					LX_SWAP_DISCARD | \
+					LX_SWAP_PREFER | LX_SWAP_PRIOMASK)
+
+/* From uts/common/fs/vfs.c */
+extern void vfs_sync(int);
+/* From uts/common/os/grow.c */
+extern int mincore(caddr_t, size_t, char *);
+extern int munmap(caddr_t, size_t);
+/* From uts/common/os/session.c */
+extern int vhangup();
+/* From uts/common/syscall/alarm.c */
+extern int alarm(int);
+/* From uts/common/syscall/chdir.c */
+extern int chdir(char *);
+extern int chroot(char *);
+extern int fchdir(int);
+/* From uts/common/syscall/nice.c */
+extern int nice(int);
+/* From uts/common/syscall/open.c */
+extern int open(char *, int, int);
+/* From uts/common/syscall/pause.c */
+extern int pause();
+/* From uts/common/syscall/rusagesys.c */
+extern int rusagesys(int, void *, void *, void *, void *);
+/* From uts/common/syscall/systeminfo.c */
+extern long systeminfo(int, char *, long);
+/* From uts/common/syscall/timers.c */
+extern int getitimer(uint_t, struct itimerval *);
+/* From uts/common/syscall/time.c */
+extern int stime(time_t);
+/* From uts/common/syscall/uadmin.c */
+extern int uadmin(int, int, uintptr_t);
+/* From uts/common/syscall/chdir.c */
+extern int chdir_proc(proc_t *, vnode_t *, boolean_t, boolean_t);
+/* From uts/common/fs/lookup.c */
+extern int lookupname(char *, enum uio_seg, int, vnode_t **, vnode_t **);
+/* From uts/common/fs/fs_subr.c */
+extern int fs_need_estale_retry(int);
+/* From uts/common/os/acct.c */
+extern int sysacct(char *);
+
+/* The callback arguments when handling a FS clone group. */
+typedef struct {
+	vnode_t	*lcfa_vp;
+	boolean_t lcfa_type;
+	boolean_t lcfa_traverse;
+} lx_clone_fs_arg_t;
+
+long
+lx_alarm(int seconds)
+{
+	return (alarm(seconds));
+}
+
+static int
+lx_clone_fs_cb(proc_t *pp, void *arg)
+{
+	lx_clone_fs_arg_t *ap = (lx_clone_fs_arg_t *)arg;
+	int err;
+
+	/*
+	 * Either:
+	 * A) The initial lookupname() from lx_clone_fs_do_group() will have
+	 *    added a hold on the vnode to ensure its existence throughout the
+	 *    walk.
+	 * B) We added a hold in fchdir.
+	 * We need to add another hold for each process in the group.
+	 */
+	VN_HOLD(ap->lcfa_vp);
+	if ((err = chdir_proc(pp, ap->lcfa_vp, ap->lcfa_type,
+	    ap->lcfa_traverse)) != 0) {
+		/* if we failed, chdir_proc already did a rele on vp */
+		return (err);
+	}
+
+	return (0);
+}
+
+/*
+ * Check to see if the process is in a CLONE_FS clone group. Return false
+ * if not (the normal case), otherwise perform the setup, do the group walk
+ * and return true.
+ */
+static boolean_t
+lx_clone_fs_do_group(char *path, boolean_t is_chroot, int *errp)
+{
+	lx_proc_data_t *lproc = ttolxproc(curthread);
+	vnode_t *vp;
+	lx_clone_fs_arg_t arg;
+	int err;
+	int estale_retry = 0;
+
+	if (!lx_clone_grp_member(lproc, LX_CLONE_FS))
+		return (B_FALSE);
+
+	/* Handle the rare case of being in a CLONE_FS clone group */
+
+retry:
+	err = lookupname(path, UIO_USERSPACE, FOLLOW, NULLVPP, &vp);
+	if (err != 0) {
+		if (err == ESTALE && fs_need_estale_retry(estale_retry++))
+			goto retry;
+		*errp = err;
+		return (B_TRUE);
+	}
+
+	arg.lcfa_vp = vp;
+	arg.lcfa_type = is_chroot;
+	arg.lcfa_traverse = B_TRUE;
+
+	/*
+	 * We use the VN_HOLD from the lookup to guarantee vp exists for the
+	 * entire walk.
+	 */
+	err = lx_clone_grp_walk(lproc, LX_CLONE_FS, lx_clone_fs_cb,
+	    (void *)&arg);
+	VN_RELE(vp);
+	*errp = err;
+	return (B_TRUE);
+}
+
+long
+lx_chdir(char *path)
+{
+	int err;
+
+	/* Handle the rare case of being in a CLONE_FS clone group */
+	if (lx_clone_fs_do_group(path, B_FALSE, &err))
+		return ((err != 0) ? set_errno(err) : 0);
+
+	return (chdir(path));
+}
+
+long
+lx_chroot(char *path)
+{
+	int err;
+
+	/* Handle the rare case of being in a CLONE_FS clone group */
+	if (lx_clone_fs_do_group(path, B_TRUE, &err))
+		return ((err != 0) ? set_errno(err) : 0);
+
+	return (chroot(path));
+}
+
+long
+lx_creat(char *path, mode_t mode)
+{
+	return (open(path, O_WRONLY | O_CREAT | O_TRUNC, mode));
+}
+
+long
+lx_fchdir(int fd)
+{
+	lx_proc_data_t *lproc = ttolxproc(curthread);
+
+	if (lx_clone_grp_member(lproc, LX_CLONE_FS)) {
+		/* Handle the rare case of being in a CLONE_FS clone group */
+		file_t *fp;
+		vnode_t *vp;
+		lx_clone_fs_arg_t arg;
+		int err;
+
+		if ((fp = getf(fd)) == NULL)
+			return (set_errno(EBADF));
+		vp = fp->f_vnode;
+		VN_HOLD(vp);
+		releasef(fd);
+
+		arg.lcfa_vp = vp;
+		arg.lcfa_type = B_FALSE;
+		arg.lcfa_traverse = B_FALSE;
+
+		/*
+		 * We use the VN_HOLD above to guarantee vp exists for the
+		 * entire walk.
+		 */
+		err = lx_clone_grp_walk(lproc, LX_CLONE_FS, lx_clone_fs_cb,
+		    (void *)&arg);
+		VN_RELE(vp);
+		if (err)
+			return (set_errno(err));
+		return (0);
+	}
+
+	return (fchdir(fd));
+}
+
+long
+lx_getitimer(int which, struct itimerval *value)
+{
+	return (getitimer(which, value));
+}
+
+/* Linux and illumos have the same rusage structures. */
+long
+lx_getrusage(int who, struct rusage *rup)
+{
+	int code;
+
+	switch (who) {
+	case LX_RUSAGE_SELF:
+		code = _RUSAGESYS_GETRUSAGE;
+		break;
+	case LX_RUSAGE_CHILDREN:
+		code = _RUSAGESYS_GETRUSAGE_CHLD;
+		break;
+	case LX_RUSAGE_THREAD:
+		code = _RUSAGESYS_GETRUSAGE_LWP;
+		break;
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	return (rusagesys(code, rup, NULL, NULL, NULL));
+}
+
+long
+lx_mincore(caddr_t addr, size_t len, char *vec)
+{
+	int r;
+
+	r = mincore(addr, len, vec);
+	if (r == EINVAL) {
+		/*
+		 * LTP mincore01 expects mincore with a huge len to fail with
+		 * ENOMEM on a modern kernel, although on Linux 2.6.11 and
+		 * earlier, it will return EINVAL.
+		 */
+		if (lx_kern_release_cmp(curzone, "2.6.11") > 0 && (long)len < 0)
+			return (set_errno(ENOMEM));
+	}
+	return (r);
+}
+
+long
+lx_nice(int incr)
+{
+	return (nice(incr));
+}
+
+long
+lx_pause(void)
+{
+	return (pause());
+}
+
+/*ARGSUSED*/
+long
+lx_reboot(int magic1, int magic2, uint_t flag, uintptr_t p4)
+{
+	if (magic1 != LINUX_REBOOT_MAGIC1)
+		return (set_errno(EINVAL));
+
+	switch (magic2) {
+	case LINUX_REBOOT_MAGIC2:
+	case LINUX_REBOOT_MAGIC2A:
+	case LINUX_REBOOT_MAGIC2B:
+	case LINUX_REBOOT_MAGIC2C:
+		break;
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * Once we have better Linux capabilities(7) support we should check
+	 * CAP_SYS_BOOT instead.
+	 */
+	if (crgetuid(CRED()) != 0)
+		return (set_errno(EPERM));
+
+	switch (flag) {
+	case LINUX_REBOOT_CMD_CAD_ON:
+	case LINUX_REBOOT_CMD_CAD_OFF:
+		/* ignored */
+		return (0);
+
+	case LINUX_REBOOT_CMD_POWER_OFF:
+	case LINUX_REBOOT_CMD_HALT:
+		return (uadmin(A_SHUTDOWN, AD_HALT, NULL));
+
+	case LINUX_REBOOT_CMD_RESTART:
+	case LINUX_REBOOT_CMD_RESTART2:
+		/* RESTART2 may need more work */
+		return (uadmin(A_SHUTDOWN, AD_BOOT, NULL));
+
+	default:
+		return (set_errno(EINVAL));
+	}
+}
+
+long
+lx_setdomainname(char *name, long len)
+{
+	if (len < 0 || len >= LX_SYS_UTS_LN)
+		return (set_errno(EINVAL));
+
+	ttolwp(curthread)->lwp_errno = 0;
+	(void) systeminfo(SI_SET_SRPC_DOMAIN, name, len);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		return (ttolwp(curthread)->lwp_errno);
+	return (0);
+}
+
+long
+lx_sethostname(char *name, size_t len)
+{
+	ttolwp(curthread)->lwp_errno = 0;
+	(void) systeminfo(SI_SET_HOSTNAME, name, len);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		return (ttolwp(curthread)->lwp_errno);
+	return (0);
+}
+
+long
+lx_stime(time_t *tp)
+{
+	time_t time;
+
+	if (copyin(tp, &time, sizeof (time)) != 0)
+		return (set_errno(EFAULT));
+
+	return (stime(time));
+}
+
+long
+lx_sync(void)
+{
+	vfs_sync(0);
+	return (0);
+}
+
+/*
+ * For syslog, since there is no Linux kernel and nothing to log, we simply
+ * emulate a kernel buffer (LOG_BUF_LEN) of 0 bytes and only handle errors for
+ * bad input. All actions except 3 and 10 require CAP_SYS_ADMIN or CAP_SYSLOG
+ * so without full capabilities support, for now we just perform an euid check.
+ */
+long
+lx_syslog(int type, char *bufp, int len)
+{
+	if (type < 0 || type > 10)
+		return (set_errno(EINVAL));
+
+	if (type != 3 && type != 10 && crgetuid(CRED()) != 0)
+		return (set_errno(EPERM));
+
+	if (type >= 2 && type <= 4 && (bufp == NULL || len < 0))
+		return (set_errno(EINVAL));
+
+	if (type == 8 && (len < 1 || len > 8))
+		return (set_errno(EINVAL));
+
+	return (0);
+}
+
+long
+lx_vhangup(void)
+{
+	if (crgetuid(CRED()) != 0)
+		return (set_errno(EPERM));
+
+	/*
+	 * The native vhangup code does nothing except check for the sys_config
+	 * privilege. Eventually we'll first want to check our emulation for the
+	 * Linux CAP_SYS_TTY_CONFIG capability, but currently, since we've
+	 * already checked that our process is root, just succeed.
+	 */
+	return (0);
+}
+
+long
+lx_acct(char *p)
+{
+	return (sysacct(p));
+}
+
+/*
+ * Support for Linux namespaces is not yet implemented. Normally we would
+ * simply return ENOSYS for this. However, "systemd" uses mount namespaces to
+ * provide the PrivateTmp feature for some services. Use of this feature is
+ * becoming common and these services will fail to run without namespace
+ * support. "systemd" has a fallback to allow these types of services to run if
+ * it sees either EACCES or EPERM when it tries to setup the namespace. Until
+ * we have namespace support, we return EPERM to workaround this issue.
+ */
+/*ARGSUSED*/
+long
+lx_unshare(int flags)
+{
+	return (set_errno(EPERM));
+}
+
+/*
+ * The whole idea of "swap space" within a zone is a complete fabrication.
+ * However, some apps expect to be able to see swap space data in the /proc
+ * files, while other apps actually don't want there to be any swap space
+ * configured. We use the swapon/off syscalls to allow this visibility to be
+ * controlled from within the zone iself. Note that the "swapon" CLI tends to
+ * do a lot of additional validation which will fail within a zone.
+ *
+ * Once we have better Linux capabilities(7) support we should check
+ * CAP_SYS_ADMIN instead of uid == 0.
+ */
+long
+lx_swapoff(char *path)
+{
+	char buf[MAXPATHLEN];
+	size_t len;
+	lx_zone_data_t *lxzd;
+
+	/* Simple validaton of the argument */
+	if (copyinstr(path, buf, sizeof (buf), &len) != 0)
+		return (set_errno(EFAULT));
+	if (crgetuid(CRED()) != 0)
+		return (set_errno(EPERM));
+
+	lxzd = ztolxzd(curzone);
+	ASSERT(lxzd != NULL);
+
+	lxzd->lxzd_swap_disabled = B_TRUE;
+	return (0);
+}
+
+long
+lx_swapon(char *path, int flags)
+{
+	char buf[MAXPATHLEN];
+	size_t len;
+	lx_zone_data_t *lxzd;
+
+	/* Simple validaton of the arguments */
+	if (copyinstr(path, buf, sizeof (buf), &len) != 0)
+		return (set_errno(EFAULT));
+	if (flags & ~LX_SWAP_ALL)
+		return (set_errno(EINVAL));
+	if (crgetuid(CRED()) != 0)
+		return (set_errno(EPERM));
+
+	lxzd = ztolxzd(curzone);
+	ASSERT(lxzd != NULL);
+
+	lxzd->lxzd_swap_disabled = B_FALSE;
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_mkdir.c b/usr/src/uts/common/brand/lx/syscall/lx_mkdir.c
new file mode 100644
index 0000000000..2f29f56d5f
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_mkdir.c
@@ -0,0 +1,38 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/fcntl.h>
+#include <sys/lx_fcntl.h>
+
+/*
+ * From "uts/common/syscall/mkdir.c":
+ */
+extern int mkdirat(int, char *, int);
+
+long
+lx_mkdirat(int fd, char *dname, int dmode)
+{
+	if (fd == LX_AT_FDCWD) {
+		fd = AT_FDCWD;
+	}
+
+	return (mkdirat(fd, dname, dmode));
+}
+
+long
+lx_mkdir(char *dname, int dmode)
+{
+	return (mkdirat(AT_FDCWD, dname, dmode));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_modify_ldt.c b/usr/src/uts/common/brand/lx/syscall/lx_modify_ldt.c
new file mode 100644
index 0000000000..aa6e12a7d8
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_modify_ldt.c
@@ -0,0 +1,121 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/segments.h>
+#include <sys/archsystm.h>
+#include <sys/proc.h>
+#include <sys/sysi86.h>
+#include <sys/cmn_err.h>
+#include <sys/lx_ldt.h>
+
+/*
+ * Read the ldt_info structure in from the Linux app, convert it to an ssd
+ * structure, and then call setdscr() to do all the heavy lifting.
+ */
+static int
+write_ldt(void *data, ulong_t count)
+{
+	user_desc_t usd;
+	struct ssd ssd;
+	struct ldt_info ldt_inf;
+	proc_t *pp = curthread->t_procp;
+	int err;
+
+	if (count != sizeof (ldt_inf))
+		return (set_errno(EINVAL));
+
+	if (copyin(data, &ldt_inf, sizeof (ldt_inf)))
+		return (set_errno(EFAULT));
+
+	if (ldt_inf.entry_number >= MAXNLDT)
+		return (set_errno(EINVAL));
+
+	LDT_INFO_TO_DESC(&ldt_inf, &usd);
+	usd_to_ssd(&usd, &ssd, SEL_LDT(ldt_inf.entry_number));
+
+	/*
+	 * Get everyone into a safe state before changing the LDT.
+	 */
+	if (!holdlwps(SHOLDFORK1))
+		return (set_errno(EINTR));
+
+	err = setdscr(&ssd);
+
+	/*
+	 * Release the hounds!
+	 */
+	mutex_enter(&pp->p_lock);
+	continuelwps(pp);
+	mutex_exit(&pp->p_lock);
+
+	return (err ? set_errno(err) : 0);
+}
+
+static int
+read_ldt(void *uptr, ulong_t count)
+{
+	proc_t *pp = curproc;
+	int bytes;
+
+	if (pp->p_ldt == NULL)
+		return (0);
+
+	bytes = (pp->p_ldtlimit + 1) * sizeof (user_desc_t);
+	if (bytes > count)
+		bytes = count;
+
+	if (copyout(pp->p_ldt, uptr, bytes))
+		return (set_errno(EFAULT));
+
+	return (bytes);
+}
+
+long
+lx_modify_ldt(int op, void *data, ulong_t count)
+{
+	int rval;
+
+	switch (op) {
+	case 0:
+		rval = read_ldt(data, count);
+		break;
+
+	case 1:
+		rval = write_ldt(data, count);
+		break;
+
+	default:
+		rval = set_errno(ENOSYS);
+		break;
+	}
+
+	return (rval);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_mount.c b/usr/src/uts/common/brand/lx/syscall/lx_mount.c
new file mode 100644
index 0000000000..2524e9044a
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_mount.c
@@ -0,0 +1,675 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/ctype.h>
+#include <sys/types.h>
+#include <sys/mount.h>
+#include <sys/vnode.h>
+#include <sys/pathname.h>
+#include <sys/types.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_syscalls.h>
+#include <sys/lx_autofs.h>
+
+#define	tolower(x)	(((x) >= 'A' && (x) <= 'Z') ? (x) - 'A' + 'a' : (x))
+
+/*
+ * mount(2) is significantly different between Linux and illumos. One of the
+ * main differences is between the set of flags.  Some flags on Linux can be
+ * translated to an illumos equivalent, some are converted to a
+ * filesystem-specific option, while others have no equivalent whatsoever.
+ *
+ * Another big difference is that mounting NFS is fully handled in the kernel on
+ * Linux whereas on illumos a lot of preliminary work is done by the NFS mount
+ * command before calling mount(2). As a simplification, we forward NFS
+ * mount calls back out to the user-level library which does the same kind of
+ * preliminary processing that is done by the native user-level NFS mount code.
+ */
+#define	LX_MS_MGC_VAL		0xC0ED0000
+#define	LX_MS_RDONLY		0x00000001
+#define	LX_MS_NOSUID		0x00000002
+#define	LX_MS_NODEV		0x00000004
+#define	LX_MS_NOEXEC		0x00000008
+#define	LX_MS_SYNCHRONOUS	0x00000010
+#define	LX_MS_REMOUNT		0x00000020
+#define	LX_MS_MANDLOCK		0x00000040
+#define	LX_MS_NOATIME		0x00000400
+#define	LX_MS_NODIRATIME	0x00000800
+#define	LX_MS_BIND		0x00001000
+#define	LX_MS_MOVE		0x00002000
+#define	LX_MS_REC		0x00004000
+#define	LX_MS_SILENT		0x00008000
+#define	LX_MS_POSIXACL		0x00010000
+#define	LX_MS_UNBINDABLE	0x00020000
+#define	LX_MS_PRIVATE		0x00040000
+#define	LX_MS_SLAVE		0x00080000
+#define	LX_MS_SHARED		0x00100000
+#define	LX_MS_RELATIME		0x00200000
+#define	LX_MS_KERNMOUNT		0x00400000
+#define	LX_MS_I_VERSION		0x00800000
+#define	LX_MS_STRICTATIME	0x01000000
+#define	LX_MS_LAZYTIME		0x02000000
+
+/* Linux kernel-internal flags - ignored if passed in */
+#define	LX_MS_NOSEC		0x10000000
+#define	LX_MS_BORN		0x20000000
+#define	LX_MS_ACTIVE		0x40000000
+#define	LX_MS_NOUSER		0x80000000
+
+#define	LX_MS_SUPPORTED		(LX_MS_MGC_VAL | \
+				LX_MS_RDONLY | LX_MS_NOSUID | \
+				LX_MS_NODEV | LX_MS_NOEXEC | \
+				LX_MS_REMOUNT | LX_MS_NOATIME | \
+				LX_MS_BIND | LX_MS_SILENT | \
+				LX_MS_STRICTATIME | LX_MS_NOSEC | \
+				LX_MS_BORN | LX_MS_ACTIVE | LX_MS_NOUSER)
+
+/*
+ * support definitions
+ */
+typedef enum mount_opt_type {
+	MOUNT_OPT_INVALID	= 0,
+	MOUNT_OPT_NORMAL	= 1,	/* option value: none */
+	MOUNT_OPT_UINT		= 2,	/* option value: unsigned int */
+	MOUNT_OPT_PASSTHRU	= 3	/* option value: validated downstream */
+} mount_opt_type_t;
+
+typedef struct mount_opt {
+	char			*mo_name;
+	mount_opt_type_t	mo_type;
+} mount_opt_t;
+
+/* From uts/common/syscall/umount.c */
+extern int umount2(char *, int);
+
+/* From lx_chown.c */
+extern long lx_vn_chown(vnode_t *, uid_t, gid_t);
+
+/*
+ * Globals
+ */
+static mount_opt_t lofs_options[] = {
+	{ NULL,			MOUNT_OPT_INVALID }
+};
+
+static mount_opt_t lx_proc_options[] = {
+	{ NULL,			MOUNT_OPT_INVALID }
+};
+
+static mount_opt_t lx_sysfs_options[] = {
+	{ NULL,			MOUNT_OPT_INVALID }
+};
+
+static mount_opt_t lx_tmpfs_options[] = {
+	{ "size",		MOUNT_OPT_PASSTHRU },
+	{ "mode",		MOUNT_OPT_UINT },
+	{ "uid",		MOUNT_OPT_UINT },
+	{ "gid",		MOUNT_OPT_UINT },
+	{ NULL,			MOUNT_OPT_INVALID }
+};
+
+static mount_opt_t lx_autofs_options[] = {
+	{ LX_MNTOPT_FD,		MOUNT_OPT_UINT },
+	{ LX_MNTOPT_PGRP,	MOUNT_OPT_UINT },
+	{ LX_MNTOPT_MINPROTO,	MOUNT_OPT_UINT },
+	{ LX_MNTOPT_MAXPROTO,	MOUNT_OPT_UINT },
+	{ LX_MNTOPT_INDIRECT,	MOUNT_OPT_NORMAL },
+	{ LX_MNTOPT_DIRECT,	MOUNT_OPT_NORMAL },
+	{ LX_MNTOPT_OFFSET,	MOUNT_OPT_NORMAL },
+	{ NULL,			MOUNT_OPT_INVALID }
+};
+
+static const char *lx_common_mnt_opts[] = {
+	"exec",
+	"noexec",
+	"devices",
+	"nodevices",
+	"dev",
+	"nodev",
+	"suid",
+	"nosuid",
+	NULL
+};
+
+/*
+ * Check the mount options.
+ *
+ * On illumos all mount option verification is done by the user-level mount
+ * command. Invalid options are simply ignored by domount(). Thus, we check
+ * here for invalid/unsupported options.
+ */
+static int
+lx_mnt_opt_verify(char *opts, mount_opt_t *mop)
+{
+	int	opts_len = strlen(opts);
+	char	*opt, *tp;
+	int	opt_len, i;
+	boolean_t last = B_FALSE;
+
+	ASSERT((opts != NULL) && (mop != NULL));
+
+	/* If no options were specified, nothing to do. */
+	if (opts_len == 0)
+		return (0);
+
+	/* If no options are allowed, fail. */
+	if (mop[0].mo_name == NULL)
+		return (ENOTSUP);
+
+	/* Don't accept leading or trailing ','. */
+	if ((opts[0] == ',') || (opts[opts_len] == ','))
+		return (EINVAL);
+
+	/* Don't accept sequential ','. */
+	for (i = 1; i < opts_len; i++) {
+		if ((opts[i - 1] ==  ',') && (opts[i] ==  ','))
+			return (EINVAL);
+	}
+
+	/*
+	 * Verify each prop one at a time. There is no strtok in the kernel but
+	 * it's easy to tokenize the entry ourselves.
+	 */
+	opt = opts;
+	for (tp = opt; *tp != ',' && *tp != '\0'; tp++)
+		;
+	if (*tp == ',') {
+		*tp = '\0';
+	} else {
+		last = B_TRUE;
+	}
+	for (;;) {
+		opt_len = strlen(opt);
+
+		/* Check common options we support on all filesystems */
+		for (i = 0; lx_common_mnt_opts[i] != NULL; i++) {
+			if (strcmp(opt, lx_common_mnt_opts[i]) == 0)
+				goto next_opt;
+		}
+
+		/* Check for matching option/value pair. */
+		for (i = 0; mop[i].mo_name != NULL; i++) {
+			char	*ovalue;
+			int	ovalue_len, mo_len;
+
+			/* If the options is too short don't bother comparing */
+			mo_len = strlen(mop[i].mo_name);
+			if (opt_len < mo_len) {
+				/* Keep trying to find a match. */
+				continue;
+			}
+
+			/* Compare the option to an allowed option. */
+			if (strncmp(mop[i].mo_name, opt, mo_len) != 0) {
+				/* Keep trying to find a match. */
+				continue;
+			}
+
+			if (mop[i].mo_type == MOUNT_OPT_NORMAL) {
+				/* The option doesn't take a value. */
+				if (opt_len == mo_len) {
+					/* This option is ok. */
+					break;
+				} else {
+					/* Keep trying to find a match. */
+					continue;
+				}
+			}
+
+			/* This options takes a value. */
+			if ((opt_len == mo_len) || (opt[mo_len] != '=')) {
+				/* Keep trying to find a match. */
+				continue;
+			}
+
+			/* We have an option match.  Verify option value. */
+			ovalue = &opt[mo_len] + 1;
+			ovalue_len = strlen(ovalue);
+
+			/* Value can't be zero length string. */
+			if (ovalue_len == 0) {
+				goto bad;
+			}
+
+			if (mop[i].mo_type == MOUNT_OPT_UINT) {
+				int j;
+				/* Verify that value is an unsigned int. */
+				for (j = 0; j < ovalue_len; j++) {
+					if (!ISDIGIT(ovalue[j])) {
+						goto bad;
+					}
+				}
+			} else if (mop[i].mo_type == MOUNT_OPT_PASSTHRU) {
+				/* Filesystem will do its own validation. */
+				break;
+			} else {
+				/* Unknown option type specified. */
+				goto bad;
+			}
+
+			/* The option is ok. */
+			break;
+		}
+
+		/* If there were no matches this is an unsupported option. */
+		if (mop[i].mo_name == NULL) {
+			goto bad;
+		}
+
+next_opt:
+		/*
+		 * This option is ok, either we're done or move on to the next
+		 * option.
+		 */
+		if (last)
+			break;
+
+		*tp = ',';
+		opt = tp + 1;
+		for (tp = opt; *tp != ',' && *tp != '\0'; tp++)
+			;
+		if (*tp == ',') {
+			*tp = '\0';
+		} else {
+			last = B_TRUE;
+		}
+	};
+
+	/* We verified all the options. */
+	return (0);
+
+bad:
+	if (!last) {
+		*tp = ',';
+	}
+	return (EINVAL);
+}
+
+/*
+ * Remove an option from the string and save it in the provided buffer.
+ * The option string should have already been verified as valid.
+ * Return 0 if not present, -1 if error, and 1 if present and fine.
+ */
+static int
+lx_mnt_opt_rm(char *opts, char *rmopt, char *retstr, int retlen)
+{
+	int	opts_len = strlen(opts);
+	char	*optstart, *optend;
+	int	optlen;
+
+	ASSERT((opts != NULL) && (rmopt != NULL));
+
+	retstr[0] = '\0';
+
+	/* If no options were specified, there's no problem. */
+	if (opts_len == 0)
+		return (0);
+
+	if ((optstart = strstr(opts, rmopt)) == NULL)
+		return (0);
+
+	for (optend = optstart; *optend != ',' && *optend != '\0'; optend++)
+		;
+
+	/*LINTED*/
+	optlen = optend - optstart;
+	if (optlen >= retlen)
+		return (-1);
+	(void) strncpy(retstr, optstart, optlen);
+	retstr[optlen] = '\0';
+
+	if (*optend == ',')
+		optend++;
+
+	optlen = strlen(optend) + 1;
+	bcopy(optend, optstart, optlen);
+
+	if (*optstart == '\0' && optstart != opts) {
+		/* removed last opt and it had a preceeding opt, remove comma */
+		*(optstart - 1) = '\0';
+	}
+
+	return (1);
+}
+
+static int
+lx_mnt_opt_val(char *opt, int *valp)
+{
+	char *op, *ep;
+	long lval;
+
+	if ((op = strchr(opt, '=')) == NULL)
+		return (-1);
+
+	op++;
+	if (!ISDIGIT(*op))
+		return (-1);
+
+	if (ddi_strtoul(op, &ep, 10, (ulong_t *)&lval) != 0 || lval > INT_MAX) {
+		return (-1);
+	}
+
+	if (*ep != '\0')
+		return (-1);
+
+	*valp = (int)lval;
+	return (0);
+}
+
+static int
+lx_mnt_add_opt(char *option, char *buf, size_t buf_size)
+{
+	char *fmt_str = NULL;
+	size_t len;
+
+	ASSERT((option != NULL) && (strlen(option) > 0));
+	ASSERT((buf != NULL) && (buf_size > 0));
+
+	if (buf[0] == '\0') {
+		fmt_str = "%s";
+	} else {
+		fmt_str = ",%s";
+	}
+
+	len = strlen(buf);
+	VERIFY(len <= buf_size);
+	buf_size -= len;
+	buf += len;
+
+	if (snprintf(buf, buf_size, fmt_str, option) > (buf_size - 1))
+		return (EOVERFLOW);
+	return (0);
+}
+
+static int
+lx_mnt_copyin_arg(const char *from, char *to, size_t len)
+{
+	size_t	slen;
+	int	rv;
+
+	rv = copyinstr(from, to, len, &slen);
+	if (rv == ENAMETOOLONG || slen == len)
+		return (ENAMETOOLONG);
+	if (rv != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+long
+lx_mount(const char *sourcep, const char *targetp, const char *fstypep,
+    uint_t flags, const void *datap)
+{
+	char			fstype[16];
+	char			source[MAXPATHLEN];
+	char			target[MAXPATHLEN];
+	char			options[MAX_MNTOPT_STR];
+	int			sflags, rv;
+	struct mounta		ma, *map = &ma;
+	vfs_t			*vfsp;
+	vnode_t			*vp = NULL;
+	int			uid = -1;
+	int			gid = -1;
+
+	if ((rv = lx_mnt_copyin_arg(fstypep, fstype, sizeof (fstype))) != 0) {
+		if (rv == ENAMETOOLONG)
+			return (set_errno(ENODEV));
+		return (set_errno(rv));
+	}
+
+	/*
+	 * Vector back out to userland emulation for NFS.
+	 */
+	if (strcmp(fstype, "nfs") == 0 || strcmp(fstype, "nfs4") == 0) {
+		uintptr_t uargs[5] = {(uintptr_t)sourcep, (uintptr_t)targetp,
+		    (uintptr_t)fstypep, (uintptr_t)flags, (uintptr_t)datap};
+
+		/* The userspace emulation will do the lx_syscall_return() */
+		ttolxlwp(curthread)->br_eosys = JUSTRETURN;
+
+#if defined(_LP64)
+		if (get_udatamodel() != DATAMODEL_NATIVE) {
+			lx_emulate_user32(ttolwp(curthread), LX_SYS32_mount,
+			    uargs);
+		} else
+#endif
+		{
+			lx_emulate_user(ttolwp(curthread), LX_SYS_mount, uargs);
+		}
+		return (0);
+	}
+
+	sflags = MS_SYSSPACE | MS_OPTIONSTR;
+	options[0] = '\0';
+
+	/* Copy in parameters that are always present. */
+	if ((rv = lx_mnt_copyin_arg(sourcep, source, sizeof (source))) != 0)
+		return (set_errno(rv));
+
+	if ((rv = lx_mnt_copyin_arg(targetp, target, sizeof (target))) != 0)
+		return (set_errno(rv));
+
+	/*
+	 * While SunOS is picky about mount(2) target paths being absolute,
+	 * Linux is not so strict. In order to facilitate this looser
+	 * requirement we must lookup the full path.
+	 */
+	if (target[0] != '/') {
+		vnode_t *vp;
+
+		if ((rv = lookupnameatcred(target, UIO_SYSSPACE, FOLLOW,
+		    NULLVPP, &vp, NULL, CRED())) != 0)
+			return (set_errno(rv));
+
+		rv = vnodetopath(NULL, vp, target, MAXPATHLEN, CRED());
+		VN_RELE(vp);
+		if (rv != 0)
+			return (set_errno(rv));
+	}
+
+	/* Make sure we support the requested mount flags. */
+	if ((flags & ~LX_MS_SUPPORTED) != 0)
+		return (set_errno(ENOTSUP));
+
+	/* Copy in Linux mount options. */
+	if (datap != NULL &&
+	    (rv = lx_mnt_copyin_arg(datap, options, sizeof (options))) != 0)
+		return (set_errno(rv));
+
+	/* Do filesystem specific mount work. */
+	if (flags & LX_MS_BIND) {
+		/* If MS_BIND is set, we turn this into a lofs mount.  */
+		(void) strcpy(fstype, "lofs");
+
+		/* Verify Linux mount options. */
+		if ((rv = lx_mnt_opt_verify(options, lofs_options)) != 0)
+			return (set_errno(rv));
+	} else if (strcmp(fstype, "tmpfs") == 0) {
+		char	idstr[64];
+
+		/* Verify Linux mount options. */
+		if ((rv = lx_mnt_opt_verify(options, lx_tmpfs_options)) != 0)
+			return (set_errno(rv));
+
+		/*
+		 * Linux defaults to mode=1777 for tmpfs mounts.
+		 */
+		if (strstr(options, "mode=") == NULL) {
+			if (options[0] != '\0')
+				(void) strlcat(options, ",", sizeof (options));
+			(void) strlcat(options, "mode=1777", sizeof (options));
+		}
+
+		switch (lx_mnt_opt_rm(options, "uid=", idstr, sizeof (idstr))) {
+		case 0:
+			uid = -1;
+			break;
+		case 1:
+			if (lx_mnt_opt_val(idstr, &uid) < 0)
+				return (set_errno(EINVAL));
+			break;
+		default:
+			return (set_errno(E2BIG));
+		}
+		switch (lx_mnt_opt_rm(options, "gid=", idstr, sizeof (idstr))) {
+		case 0:
+			gid = -1;
+			break;
+		case 1:
+			if (lx_mnt_opt_val(idstr, &gid) < 0)
+				return (set_errno(EINVAL));
+			break;
+		default:
+			return (set_errno(E2BIG));
+		}
+
+		/*
+		 * Linux seems to always allow overlay mounts. We allow this
+		 * everywhere except under /dev where it interferes with device
+		 * emulation.
+		 */
+		if (strcmp(target, "/dev") != 0 &&
+		    strncmp(target, "/dev/", 5) != 0)
+			sflags |= MS_OVERLAY;
+	} else if (strcmp(fstype, "proc") == 0) {
+		/* Translate proc mount requests to lx_proc requests. */
+		(void) strcpy(fstype, "lx_proc");
+
+		/* Verify Linux mount options. */
+		if ((rv = lx_mnt_opt_verify(options, lx_proc_options)) != 0)
+			return (set_errno(rv));
+	} else if (strcmp(fstype, "sysfs") == 0) {
+		/* Translate sysfs mount requests to lx_sysfs requests. */
+		(void) strcpy(fstype, "lx_sysfs");
+
+		/* Verify Linux mount options. */
+		if ((rv = lx_mnt_opt_verify(options, lx_sysfs_options)) != 0)
+			return (set_errno(rv));
+	} else if (strcmp(fstype, "cgroup") == 0) {
+		/* Translate cgroup mount requests to lx_cgroup requests. */
+		(void) strcpy(fstype, "lx_cgroup");
+
+		/*
+		 * Currently don't verify Linux mount options since we can
+		 * have a subsystem string provided.
+		 */
+	} else if (strcmp(fstype, "autofs") == 0) {
+		/* Translate autofs mount requests to lxautofs requests. */
+		(void) strcpy(fstype, LX_AUTOFS_NAME);
+
+		/* Verify Linux mount options. */
+		if ((rv = lx_mnt_opt_verify(options, lx_autofs_options)) != 0)
+			return (set_errno(rv));
+
+		/* Linux seems to always allow overlay mounts */
+		sflags |= MS_OVERLAY;
+	} else {
+		return (set_errno(ENODEV));
+	}
+
+	/* Convert some Linux flags to illumos flags. */
+	if (flags & LX_MS_RDONLY)
+		sflags |= MS_RDONLY;
+	if (flags & LX_MS_NOSUID)
+		sflags |= MS_NOSUID;
+	if (flags & LX_MS_REMOUNT)
+		sflags |= MS_REMOUNT;
+
+	/*
+	 * Convert some Linux flags to illumos option strings.
+	 */
+	if (flags & LX_MS_STRICTATIME) {
+		/*
+		 * The "strictatime" mount option ensures that none of the
+		 * weaker atime-related mode options are in effect.
+		 */
+		flags &= ~(LX_MS_RELATIME | LX_MS_NOATIME);
+	}
+	if ((flags & LX_MS_NODEV) &&
+	    (rv = lx_mnt_add_opt("nodev", options, sizeof (options))) != 0)
+		return (set_errno(rv));
+	if ((flags & LX_MS_NOEXEC) &&
+	    (rv = lx_mnt_add_opt("noexec", options, sizeof (options))) != 0)
+		return (set_errno(rv));
+	if ((flags & LX_MS_NOATIME) &&
+	    (rv = lx_mnt_add_opt("noatime", options, sizeof (options))) != 0)
+		return (set_errno(rv));
+
+	if ((rv = lookupname(target, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp)) != 0)
+		return (set_errno(rv));
+
+	/* If mounting proc over itself, just return ok */
+	if (strcmp(fstype, "lx_proc") == 0 && strcmp("lx_proc",
+	    vfssw[vp->v_vfsp->vfs_fstype].vsw_name) == 0) {
+		VN_RELE(vp);
+		return (0);
+	}
+
+	map->spec = source;
+	map->dir = target;
+	map->flags = sflags;
+	map->fstype = fstype;
+	map->dataptr = NULL;
+	map->datalen = 0;
+	map->optptr = options;
+	map->optlen = sizeof (options);
+
+	rv = domount(NULL, map, vp, CRED(), &vfsp);
+	VN_RELE(vp);
+	if (rv != 0)
+		return (set_errno(rv));
+
+	VFS_RELE(vfsp);
+	if (strcmp(fstype, "tmpfs") == 0 && (uid != -1 || gid != -1)) {
+		/* Handle tmpfs uid/gid mount options. */
+		if (lookupname(target, UIO_SYSSPACE, FOLLOW, NULLVPP,
+		    &vp) == 0) {
+			(void) lx_vn_chown(vp, (uid_t)uid, (gid_t)gid);
+			VN_RELE(vp);
+		}
+	}
+
+	return (0);
+}
+
+/*
+ * umount() is identical to illumos, though implemented on top of umount2().
+ */
+long
+lx_umount(char *path)
+{
+	return (umount2(path, 0));
+}
+
+/*
+ * The Linux umount2() system call is identical to illumos but has a different
+ * value for MNT_FORCE (the logical equivalent to MS_FORCE).
+ */
+#define	LX_MNT_FORCE	0x1
+
+long
+lx_umount2(char *path, int flg)
+{
+	int flags = 0;
+
+	if (flg & ~LX_MNT_FORCE)
+		return (set_errno(EINVAL));
+
+	if (flg & LX_MNT_FORCE)
+		flags |= MS_FORCE;
+
+	return (umount2(path, flags));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_open.c b/usr/src/uts/common/brand/lx/syscall/lx_open.c
new file mode 100644
index 0000000000..f26f2d1fa6
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_open.c
@@ -0,0 +1,265 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/fcntl.h>
+#include <sys/file.h>
+#include <sys/filio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/inttypes.h>
+#include <sys/mutex.h>
+
+#include <sys/lx_types.h>
+#include <sys/lx_fcntl.h>
+#include <sys/lx_misc.h>
+#include <sys/brand.h>
+
+extern int fcntl(int, int, intptr_t);
+extern int openat(int, char *, int, int);
+extern int open(char *, int, int);
+extern int close(int);
+extern int cioctl(file_t *, int, intptr_t, int *);
+extern int lookupnameat(char *, enum uio_seg, int, vnode_t **, vnode_t **,
+    vnode_t *);
+
+
+static int
+ltos_open_flags(int input)
+{
+	int flags;
+
+	if (input & LX_O_PATH) {
+		input &= (LX_O_DIRECTORY | LX_O_NOFOLLOW | LX_O_CLOEXEC);
+	}
+
+	/* This depends on the Linux ACCMODE flags being the same as SunOS. */
+	flags = (input & LX_O_ACCMODE);
+
+	if (input & LX_O_CREAT) {
+		flags |= O_CREAT;
+	}
+
+	if (input & LX_O_EXCL)
+		flags |= O_EXCL;
+	if (input & LX_O_NOCTTY)
+		flags |= O_NOCTTY;
+	if (input & LX_O_TRUNC)
+		flags |= O_TRUNC;
+	if (input & LX_O_APPEND)
+		flags |= O_APPEND;
+	if (input & LX_O_NONBLOCK)
+		flags |= O_NONBLOCK;
+	if (input & LX_O_SYNC)
+		flags |= O_SYNC;
+	if (input & LX_O_LARGEFILE)
+		flags |= O_LARGEFILE;
+	if (input & LX_O_NOFOLLOW)
+		flags |= O_NOFOLLOW;
+	if (input & LX_O_CLOEXEC)
+		flags |= O_CLOEXEC;
+
+	/*
+	 * Linux uses the LX_O_DIRECT flag to do raw, synchronous I/O to the
+	 * device backing the fd in question.  Illumos doesn't have similar
+	 * functionality, but we can attempt to simulate it using the flags
+	 * (O_RSYNC|O_SYNC) and directio(3C).
+	 *
+	 * The LX_O_DIRECT flag also requires that the transfer size and
+	 * alignment of I/O buffers be a multiple of the logical block size for
+	 * the underlying file system, but frankly there isn't an easy way to
+	 * support that functionality without doing something like adding an
+	 * fcntl(2) flag to denote LX_O_DIRECT mode.
+	 *
+	 * Since LX_O_DIRECT is merely a performance advisory, we'll just
+	 * emulate what we can and trust that the only applications expecting
+	 * an error when performing I/O from a misaligned buffer or when
+	 * passing a transfer size is not a multiple of the underlying file
+	 * system block size will be test suites.
+	 */
+	if (input & LX_O_DIRECT)
+		flags |= (O_RSYNC|O_SYNC);
+
+	return (flags);
+}
+
+#define	LX_POSTPROCESS_OPTS	(LX_O_DIRECT | LX_O_ASYNC | LX_O_PATH)
+
+static int
+lx_open_postprocess(int fd, int fmode)
+{
+	file_t *fp;
+	int rv, error = 0;
+
+	if ((fmode & LX_POSTPROCESS_OPTS) == 0) {
+		/* Skip out early, if possible */
+		return (0);
+	}
+
+	if ((fp = getf(fd)) == NULL) {
+		/*
+		 * It is possible that this fd was closed by the time we
+		 * arrived here if some one is hammering away with close().
+		 */
+		return (EIO);
+	}
+
+	if (fmode & LX_O_DIRECT && error == 0) {
+		(void) VOP_IOCTL(fp->f_vnode, _FIODIRECTIO, DIRECTIO_ON,
+		    fp->f_flag, fp->f_cred, &rv, NULL);
+	}
+
+	if (fmode & LX_O_ASYNC && error == 0) {
+		if ((error = VOP_SETFL(fp->f_vnode, fp->f_flag, FASYNC,
+		    fp->f_cred, NULL)) == 0) {
+			mutex_enter(&fp->f_tlock);
+			fp->f_flag |= FASYNC;
+			mutex_exit(&fp->f_tlock);
+		}
+	}
+
+	if (fmode & LX_O_PATH && error == 0) {
+		/*
+		 * While the O_PATH flag has no direct analog in SunOS, it is
+		 * emulated by removing both FREAD and FWRITE from f_flag.
+		 * This causes read(2) and write(2) result in EBADF and can be
+		 * checked for in other syscalls to tigger the correct behavior
+		 * there.
+		 */
+		mutex_enter(&fp->f_tlock);
+		fp->f_flag &= ~(FREAD|FWRITE);
+		mutex_exit(&fp->f_tlock);
+	}
+
+	releasef(fd);
+	if (error != 0) {
+		(void) closeandsetf(fd, NULL);
+	}
+	return (error);
+}
+
+long
+lx_openat(int atfd, char *path, int fmode, int cmode)
+{
+	int flags, fd, error;
+	mode_t mode = 0;
+
+	if (atfd == LX_AT_FDCWD)
+		atfd = AT_FDCWD;
+
+	flags = ltos_open_flags(fmode);
+
+	/*
+	 * We use the FSEARCH flag to make sure this is a directory. We have to
+	 * explicitly add 1 to emulate the FREAD/FWRITE mapping of the OPENMODE
+	 * macro since it won't get set via OPENMODE when FSEARCH is used.
+	 */
+	if (fmode & LX_O_DIRECTORY) {
+		flags |= FSEARCH;
+		flags++;
+	}
+
+	if (flags & O_CREAT)
+		mode = (mode_t)cmode;
+
+	ttolwp(curthread)->lwp_errno = 0;
+	fd = openat(atfd, path, flags, mode);
+	if (ttolwp(curthread)->lwp_errno != 0) {
+		if ((fmode & LX_O_DIRECTORY) &&
+		    ttolwp(curthread)->lwp_errno != ENOTDIR) {
+			/*
+			 * We got an error trying to open a file as a directory.
+			 * We need to determine if we should return the original
+			 * error or ENOTDIR.
+			 */
+			vnode_t *startvp;
+			vnode_t *vp;
+			int oerror, error = 0;
+
+			oerror = ttolwp(curthread)->lwp_errno;
+
+			if (atfd == AT_FDCWD) {
+				/* regular open */
+				startvp = NULL;
+			} else {
+				char startchar;
+
+				if (copyin(path, &startchar, sizeof (char)))
+					return (set_errno(oerror));
+
+				/* if startchar is / then startfd is ignored */
+				if (startchar == '/') {
+					startvp = NULL;
+				} else {
+					file_t *startfp;
+
+					if ((startfp = getf(atfd)) == NULL)
+						return (set_errno(oerror));
+					startvp = startfp->f_vnode;
+					VN_HOLD(startvp);
+					releasef(atfd);
+				}
+			}
+
+			if (lookupnameat(path, UIO_USERSPACE,
+			    (fmode & LX_O_NOFOLLOW) ?  NO_FOLLOW : FOLLOW,
+			    NULLVPP, &vp, startvp) != 0) {
+				if (startvp != NULL)
+					VN_RELE(startvp);
+				return (set_errno(oerror));
+			}
+
+			if (startvp != NULL)
+				VN_RELE(startvp);
+
+			if (vp->v_type != VDIR)
+				error = ENOTDIR;
+
+			VN_RELE(vp);
+			if (error != 0)
+				return (set_errno(ENOTDIR));
+
+			(void) set_errno(oerror);
+		}
+
+		if (ttolwp(curthread)->lwp_errno == EINTR)
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+
+		return (ttolwp(curthread)->lwp_errno);
+	}
+
+	if ((error = lx_open_postprocess(fd, fmode)) != 0) {
+		return (set_errno(error));
+	}
+	return (fd);
+}
+
+long
+lx_open(char *path, int fmode, int cmode)
+{
+	return (lx_openat(LX_AT_FDCWD, path, fmode, cmode));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_personality.c b/usr/src/uts/common/brand/lx/syscall/lx_personality.c
new file mode 100644
index 0000000000..e7aa945b50
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_personality.c
@@ -0,0 +1,112 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/mutex.h>
+#include <sys/brand.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_impl.h>
+
+
+/*
+ * These flags are for what Linux calls "bug emulation".
+ * (Descriptions from the personality(2) Linux man page.)
+ *
+ * Flags which are currently actionable in LX:
+ * - READ_IMPLIES_EXEC (since Linux 2.6.8)
+ *   With this flag set, PROT_READ implies PROT_EXEC for mmap(2).
+ *
+ * Flags which are current accepted but ignored:
+ * - UNAME26 (since Linux 3.1)
+ *   Have uname(2) report a 2.6.40+ version number rather than a 3.x version
+ *   number.  Added as a stopgap measure to support broken applications that
+ *   could not handle the kernel version- numbering switch from 2.6.x to 3.x.
+ *
+ * - ADDR_NO_RANDOMIZE (since Linux 2.6.12)
+ *   With this flag set, disable address-space-layout randomization.
+ *
+ * - FDPIC_FUNCPTRS (since Linux 2.6.11)
+ *   User-space function pointers to signal handlers point (on certain
+ *   architectures) to descriptors.
+ *
+ * - MMAP_PAGE_ZERO (since Linux 2.4.0)
+ *   Map page 0 as read-only (to support binaries that depend on this SVr4
+ *   behavior).
+ *
+ * - ADDR_COMPAT_LAYOUT (since Linux 2.6.9)
+ *   With this flag set, provide legacy virtual address space layout.
+ *
+ * - ADDR_LIMIT_32BIT (since Linux 2.2)
+ *   Limit the address space to 32 bits.
+ *
+ * - SHORT_INODE (since Linux 2.4.0)
+ *   No effects(?).
+ *
+ * - WHOLE_SECONDS (since Linux 1.2.0)
+ *   No effects(?).
+ *
+ * - STICKY_TIMEOUTS (since Linux 1.2.0)
+ *   With this flag set, select(2), pselect(2), and ppoll(2) do not modify the
+ *   returned timeout argument when interrupted by a signal handler.
+ *
+ * - ADDR_LIMIT_3GB (since Linux 2.4.0)
+ *   With this flag set, use 0xc0000000 as the offset at which to search a
+ *   virtual memory chunk on mmap(2); otherwise use 0xffffe000.
+ */
+
+#define	LX_PER_GET	0xffffffff
+
+long
+lx_personality(unsigned int arg)
+{
+	lx_proc_data_t *lxpd = ptolxproc(curproc);
+	unsigned int result = 0;
+
+	mutex_enter(&curproc->p_lock);
+	result = lxpd->l_personality;
+
+	if (arg == LX_PER_GET) {
+		mutex_exit(&curproc->p_lock);
+		return (result);
+	}
+
+	/*
+	 * Prevent changes to the personality if the process is undergoing an
+	 * exec.  This will allow elfexec and friends to manipulate the
+	 * personality without hinderance.
+	 */
+	if ((curproc->p_flag & P_PR_EXEC) != 0) {
+		mutex_exit(&curproc->p_lock);
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * Keep tabs when a non-Linux personality is set.  This is silently
+	 * allowed to succeed, even though the emulation required is almost
+	 * certainly missing.
+	 */
+	if ((arg & LX_PER_MASK) != LX_PER_LINUX) {
+		char buf[64];
+
+		(void) snprintf(buf, sizeof (buf), "invalid personality: %02X",
+		    arg & LX_PER_MASK);
+		lx_unsupported(buf);
+	}
+
+	lxpd->l_personality = arg;
+	mutex_exit(&curproc->p_lock);
+	return (result);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_pgrp.c b/usr/src/uts/common/brand/lx/syscall/lx_pgrp.c
new file mode 100644
index 0000000000..2acd9d431e
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_pgrp.c
@@ -0,0 +1,189 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/lx_misc.h>
+
+#define	LX_INIT_PGID	1
+#define	LX_INIT_SID	1
+
+/* From uts/common/syscall/pgrpsys.c */
+extern int setpgrp(int, int, int);
+
+long
+lx_getpgrp(void)
+{
+	int pg;
+
+	/* getpgrp() */
+	pg = setpgrp(0, 0, 0);
+
+	/*
+	 * If the pgrp is that of the init process, return the value Linux
+	 * expects.
+	 */
+	if (pg == curzone->zone_proc_initpid)
+		return (LX_INIT_PGID);
+
+	return (pg);
+}
+
+long
+lx_getpgid(int pid)
+{
+	pid_t spid;
+	int tid;
+	int pg;
+
+	if (pid < 0)
+		return (set_errno(ESRCH));
+
+	/*
+	 * If the supplied pid matches that of the init process, return the pgid
+	 * Linux expects.
+	 */
+	if (pid == curzone->zone_proc_initpid)
+		return (LX_INIT_PGID);
+
+	if (pid == 0) {
+		spid = curproc->p_pid;
+	} else if (lx_lpid_to_spair(pid, &spid, &tid) < 0) {
+		return (set_errno(ESRCH));
+	}
+
+	/* getpgid() */
+	ttolwp(curthread)->lwp_errno = 0;
+	pg = setpgrp(4, spid, 0);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		return (ttolwp(curthread)->lwp_errno);
+
+	/*
+	 * If the pgid is that of the init process, return the value Linux
+	 * expects.
+	 */
+	if (pg == curzone->zone_proc_initpid)
+		return (LX_INIT_PGID);
+
+	return (pg);
+}
+
+long
+lx_setpgid(pid_t pid, pid_t pgid)
+{
+	pid_t spid, spgid;
+	int tid;
+	int pg;
+	int ret;
+
+	if (pid < 0)
+		return (set_errno(ESRCH));
+
+	if (pgid < 0)
+		return (set_errno(EINVAL));
+
+	if (pid == 0) {
+		spid = curproc->p_pid;
+	} else if (lx_lpid_to_spair(pid, &spid, &tid) < 0) {
+		return (set_errno(ESRCH));
+	}
+
+	if (pgid == 0) {
+		spgid = spid;
+	} else if (lx_lpid_to_spair(pgid, &spgid, &tid) < 0) {
+		return (set_errno(ESRCH));
+	}
+
+	/* setpgid() */
+	ret = setpgrp(5, spid, spgid);
+
+	if (ret == EPERM) {
+		/*
+		 * On Linux, when calling setpgid with a desired pgid that is
+		 * equal to the current pgid of the process, no error is
+		 * emitted. This differs slightly from illumos which would
+		 * return EPERM. To emulate the Linux behavior, we check
+		 * specifically for matching pgids.
+		 */
+
+		/* getpgid() */
+		ttolwp(curthread)->lwp_errno = 0;
+		pg = setpgrp(4, spid, 0);
+		if (ttolwp(curthread)->lwp_errno == 0 && spgid == pg)
+			return (0);
+		return (set_errno(EPERM));
+	}
+
+	return (ret);
+}
+
+long
+lx_getsid(int pid)
+{
+	pid_t spid;
+	int tid;
+	int sid;
+
+	if (pid < 0)
+		return (set_errno(ESRCH));
+
+	/*
+	 * If the supplied pid matches that of the init process, return the sid
+	 * Linux expects.
+	 */
+	if (pid == curzone->zone_proc_initpid)
+		return (LX_INIT_SID);
+
+	if (pid == 0) {
+		spid = curproc->p_pid;
+	} else if (lx_lpid_to_spair(pid, &spid, &tid) < 0) {
+		return (set_errno(ESRCH));
+	}
+
+	/* getsid() */
+	ttolwp(curthread)->lwp_errno = 0;
+	sid = setpgrp(2, spid, 0);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		return (ttolwp(curthread)->lwp_errno);
+
+
+	/*
+	 * If the sid is that of the init process, return the value Linux
+	 * expects.
+	 */
+	if (sid == curzone->zone_proc_initpid)
+		return (LX_INIT_SID);
+
+	return (sid);
+}
+
+long
+lx_setsid(void)
+{
+	int sid;
+
+	/* setsid() */
+	ttolwp(curthread)->lwp_errno = 0;
+	sid = setpgrp(3, 0, 0);
+	if (ttolwp(curthread)->lwp_errno != 0)
+		return (ttolwp(curthread)->lwp_errno);
+
+	/*
+	 * If the sid is that of the init process, return the value Linux
+	 * expects.
+	 */
+	if (sid == curzone->zone_proc_initpid)
+		return (LX_INIT_SID);
+
+	return (sid);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_pipe.c b/usr/src/uts/common/brand/lx/syscall/lx_pipe.c
new file mode 100644
index 0000000000..96959e40df
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_pipe.c
@@ -0,0 +1,309 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T. All Rights Reserved.
+ *
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2013 OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/zone.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/cpuvar.h>
+#include <sys/cred.h>
+#include <sys/user.h>
+#include <sys/vnode.h>
+#include <sys/file.h>
+#include <sys/stream.h>
+#include <sys/strsubr.h>
+#include <sys/errno.h>
+#include <sys/debug.h>
+#include <sys/fs/fifonode.h>
+#include <sys/fcntl.h>
+#include <sys/policy.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_fcntl.h>
+#include <sys/sysmacros.h>
+
+#define	LX_DEFAULT_PIPE_SIZE	65536
+
+/*
+ * Our default value for fs.pipe-size-max mirrors Linux.  The enforced maximum
+ * is meant to provide some sort of upper bound on pipe buffer sizing.  Its
+ * value was chosen somewhat arbitrarily.
+ */
+uint_t lx_pipe_max_default = 1048576;
+uint_t lx_pipe_max_limit = 8388608;
+
+int
+lx_pipe_setsz(stdata_t *str, uint_t size, boolean_t is_init)
+{
+	int err;
+	stdata_t *mate;
+	lx_zone_data_t *lxzd = ztolxzd(curzone);
+	uint_t max_size = lxzd->lxzd_pipe_max_sz;
+	fifonode_t *fnp1, *fnp2;
+
+	size = P2ROUNDUP(size, PAGESIZE);
+	if (size == 0) {
+		return (EINVAL);
+	} else if (size > max_size && secpolicy_resource(CRED()) != 0) {
+		if (!is_init) {
+			return (EPERM);
+		}
+		/*
+		 * If the size limit is breached during initial pipe setup,
+		 * simply clamp it to the maximum.  On Linux kernels prior to
+		 * 4.9, this clamping would not occur and it would be possible
+		 * to open a pipe with the default buffer size even if it
+		 * exceeded the sysctl limit.  Rather than trigger behavior
+		 * here based on  the configured kernel version, it is applied
+		 * to all callers.
+		 */
+		size = max_size;
+		ASSERT(max_size <= lx_pipe_max_limit);
+	} else if (size > lx_pipe_max_limit) {
+		/*
+		 * Unlike Linux, we do maintain a global hard cap on pipe
+		 * buffer limits.
+		 */
+		return (EPERM);
+	}
+
+	if (!STRMATED(str)) {
+		err = strqset(RD(str->sd_wrq), QHIWAT, 0, (intptr_t)size);
+		if (err == 0) {
+			fnp1 = VTOF(str->sd_vnode);
+			mutex_enter(&fnp1->fn_lock->flk_lock);
+			fnp1->fn_hiwat = size;
+			mutex_exit(&fnp1->fn_lock->flk_lock);
+		}
+		return (err);
+	}
+
+	/*
+	 * Ensure consistent order so the set operation is always attempted on
+	 * the "higher" stream first.
+	 */
+	if (str > str->sd_mate) {
+		VERIFY((mate = str->sd_mate) != NULL);
+	} else {
+		mate = str;
+		VERIFY((str = mate->sd_mate) != NULL);
+	}
+
+	/*
+	 * While it is unfortunate that an error could occur for the latter
+	 * half of the stream pair, there is little to be done about it aside
+	 * from reporting the failure.
+	 */
+	if ((err = strqset(RD(str->sd_wrq), QHIWAT, 0, (intptr_t)size)) == 0) {
+		err = strqset(RD(mate->sd_wrq), QHIWAT, 0, (intptr_t)size);
+	}
+
+	if (err == 0) {
+		fnp1 = VTOF(str->sd_vnode);
+		fnp2 = VTOF(str->sd_mate->sd_vnode);
+
+		/*
+		 * See fnode_constructor. Both sides should have the same
+		 * lock. We expect our callers to ensure that the vnodes
+		 * are VFIFO and have v_op == fifovnops.
+		 */
+		ASSERT(str->sd_vnode->v_type == VFIFO);
+		ASSERT(str->sd_mate->sd_vnode->v_type == VFIFO);
+		ASSERT(fnp1->fn_lock == fnp2->fn_lock);
+
+		mutex_enter(&fnp1->fn_lock->flk_lock);
+
+		fnp1->fn_hiwat = size;
+		fnp2->fn_hiwat = size;
+
+		mutex_exit(&fnp1->fn_lock->flk_lock);
+	}
+
+	return (err);
+}
+
+/*
+ * Based on native pipe(2) system call, except that the pipe is half-duplex.
+ */
+static int
+lx_hd_pipe(intptr_t arg, int flags)
+{
+	vnode_t *vp1, *vp2;
+	struct file *fp1, *fp2;
+	int error = 0;
+	int flag1, flag2, iflags;
+	int fd1, fd2;
+	stdata_t *str;
+
+	/*
+	 * Validate allowed flags.
+	 */
+	if ((flags & ~(FCLOEXEC|FNONBLOCK)) != 0) {
+		return (set_errno(EINVAL));
+	}
+	/*
+	 * Allocate and initialize two vnodes.
+	 */
+	makepipe(&vp1, &vp2);
+
+	/*
+	 * Allocate and initialize two file table entries and two
+	 * file pointers. The first file pointer is open for read and the
+	 * second is open for write.
+	 */
+	if ((error = falloc(vp1, FREAD, &fp1, &fd1)) != 0) {
+		VN_RELE(vp1);
+		VN_RELE(vp2);
+		return (set_errno(error));
+	}
+
+	if ((error = falloc(vp2, FWRITE, &fp2, &fd2)) != 0)
+		goto out2;
+
+	/*
+	 * Create two stream heads and attach to each vnode.
+	 */
+	if ((error = fifo_stropen(&vp1, FREAD, fp1->f_cred, 0, 0)) != 0)
+		goto out;
+
+	if ((error = fifo_stropen(&vp2, FWRITE, fp2->f_cred, 0, 0)) != 0) {
+		(void) VOP_CLOSE(vp1, FREAD, 1, (offset_t)0,
+		    fp1->f_cred, NULL);
+		goto out;
+	}
+
+	strmate(vp1, vp2);
+
+	VTOF(vp1)->fn_ino = VTOF(vp2)->fn_ino = fifogetid();
+
+	/*
+	 * Attempt to set pipe buffer sizes to expected value.
+	 */
+	VERIFY((str = vp1->v_stream) != NULL);
+	(void) lx_pipe_setsz(str, LX_DEFAULT_PIPE_SIZE, B_TRUE);
+
+	/*
+	 * Set the O_NONBLOCK flag if requested.
+	 */
+	if (flags & FNONBLOCK) {
+		flag1 = fp1->f_flag;
+		flag2 = fp2->f_flag;
+		iflags = flags & FNONBLOCK;
+
+		if ((error = VOP_SETFL(vp1, flag1, iflags, fp1->f_cred,
+		    NULL)) != 0) {
+			goto out_vop_close;
+		}
+		fp1->f_flag |= iflags;
+
+		if ((error = VOP_SETFL(vp2, flag2, iflags, fp2->f_cred,
+		    NULL)) != 0) {
+			goto out_vop_close;
+		}
+		fp2->f_flag |= iflags;
+	}
+
+	/*
+	 * Return the file descriptors to the user. They now
+	 * point to two different vnodes which have different
+	 * stream heads.
+	 */
+	if (copyout(&fd1, &((int *)arg)[0], sizeof (int)) ||
+	    copyout(&fd2, &((int *)arg)[1], sizeof (int))) {
+		error = EFAULT;
+		goto out_vop_close;
+	}
+
+	/*
+	 * Now fill in the entries that falloc reserved
+	 */
+	mutex_exit(&fp1->f_tlock);
+	mutex_exit(&fp2->f_tlock);
+	setf(fd1, fp1);
+	setf(fd2, fp2);
+
+	/*
+	 * Optionally set the FCLOEXEC flag
+	 */
+	if ((flags & FCLOEXEC) != 0) {
+		f_setfd(fd1, FD_CLOEXEC);
+		f_setfd(fd2, FD_CLOEXEC);
+	}
+
+	return (0);
+out_vop_close:
+	(void) VOP_CLOSE(vp1, FREAD, 1, (offset_t)0, fp1->f_cred, NULL);
+	(void) VOP_CLOSE(vp2, FWRITE, 1, (offset_t)0, fp2->f_cred, NULL);
+out:
+	setf(fd2, NULL);
+	unfalloc(fp2);
+out2:
+	setf(fd1, NULL);
+	unfalloc(fp1);
+	VN_RELE(vp1);
+	VN_RELE(vp2);
+	return (set_errno(error));
+}
+
+/*
+ * pipe(2) system call.
+ */
+long
+lx_pipe(intptr_t arg)
+{
+	return (lx_hd_pipe(arg, 0));
+}
+
+/*
+ * pipe2(2) system call.
+ */
+long
+lx_pipe2(intptr_t arg, int lxflags)
+{
+	int flags = 0;
+
+	/*
+	 * Validate allowed flags.
+	 */
+	if ((lxflags & ~(LX_O_NONBLOCK | LX_O_CLOEXEC)) != 0) {
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * Convert from Linux flags to illumos flags.
+	 */
+	if (lxflags & LX_O_NONBLOCK) {
+		flags |= FNONBLOCK;
+	}
+	if (lxflags & LX_O_CLOEXEC) {
+		flags |= FCLOEXEC;
+	}
+
+	return (lx_hd_pipe(arg, flags));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_poll.c b/usr/src/uts/common/brand/lx/syscall/lx_poll.c
new file mode 100644
index 0000000000..92852e72ae
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_poll.c
@@ -0,0 +1,778 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/zone.h>
+#include <sys/brand.h>
+#include <sys/sunddi.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+#include <sys/poll_impl.h>
+#include <sys/schedctl.h>
+#include <sys/lx_signal.h>
+
+
+/* From uts/common/syscall/poll.c */
+extern int poll_copyin(pollstate_t *, pollfd_t *, nfds_t);
+extern int poll_common(pollstate_t *, pollfd_t *, nfds_t, timespec_t *, int *);
+
+/*
+ * These events are identical between Linux and SunOS
+ */
+#define	LX_POLLIN	0x001
+#define	LX_POLLPRI	0x002
+#define	LX_POLLOUT	0x004
+#define	LX_POLLERR	0x008
+#define	LX_POLLHUP	0x010
+#define	LX_POLLNVAL	0x020
+#define	LX_POLLRDNORM	0x040
+#define	LX_POLLRDBAND	0x080
+
+#define	LX_POLL_COMMON_EVENTS (LX_POLLIN | LX_POLLPRI | LX_POLLOUT |	\
+	LX_POLLERR | LX_POLLHUP | LX_POLLNVAL | LX_POLLRDNORM | LX_POLLRDBAND)
+
+/*
+ * These events differ between Linux and SunOS
+ */
+#define	LX_POLLWRNORM	0x0100
+#define	LX_POLLWRBAND	0x0200
+#define	LX_POLLRDHUP	0x2000
+
+
+#define	LX_POLL_SUPPORTED_EVENTS	\
+	(LX_POLL_COMMON_EVENTS | LX_POLLWRNORM | LX_POLLWRBAND | LX_POLLRDHUP)
+
+
+static int
+lx_poll_copyin(pollstate_t *ps, pollfd_t *fds, nfds_t nfds, short *oldevt)
+{
+	int i, error = 0;
+	pollfd_t *pollfdp;
+
+	if ((error = poll_copyin(ps, fds, nfds)) != 0) {
+		return (error);
+	}
+	pollfdp = ps->ps_pollfd;
+
+	/* Convert the Linux events bitmask into SunOS equivalent. */
+	for (i = 0; i < nfds; i++) {
+		short lx_events = pollfdp[i].events;
+		short events;
+
+		/*
+		 * If the caller is polling for an unsupported event, we
+		 * have to bail out.
+		 */
+		if (lx_events & ~LX_POLL_SUPPORTED_EVENTS) {
+			return (ENOTSUP);
+		}
+
+		events = lx_events & LX_POLL_COMMON_EVENTS;
+		if (lx_events & LX_POLLWRNORM)
+			events |= POLLWRNORM;
+		if (lx_events & LX_POLLWRBAND)
+			events |= POLLWRBAND;
+		if (lx_events & LX_POLLRDHUP)
+			events |= POLLRDHUP;
+		pollfdp[i].events = events;
+		oldevt[i] = lx_events;
+	}
+	return (0);
+}
+
+static int
+lx_poll_copyout(pollfd_t *pollfdp, pollfd_t *fds, nfds_t nfds, short *oldevt)
+{
+	int i;
+
+	/*
+	 * Convert SunOS revents bitmask into Linux equivalent and restore
+	 * cached events field which was swizzled by lx_poll_copyin.
+	 */
+	for (i = 0; i < nfds; i++) {
+		short revents = pollfdp[i].revents;
+		short lx_revents = revents & LX_POLL_COMMON_EVENTS;
+		short orig_events = oldevt[i];
+
+		if (revents & POLLWRBAND)
+			lx_revents |= LX_POLLWRBAND;
+		if (revents & POLLRDHUP)
+			lx_revents |= LX_POLLRDHUP;
+		/*
+		 * Because POLLOUT and POLLWRNORM are native defined as the
+		 * same value, care must be taken when translating them to
+		 * Linux where they differ.
+		 */
+		if (revents & POLLOUT) {
+			if ((orig_events & LX_POLLOUT) == 0)
+				lx_revents &= ~LX_POLLOUT;
+			if (orig_events & LX_POLLWRNORM)
+				lx_revents |= LX_POLLWRNORM;
+		}
+
+		pollfdp[i].revents = lx_revents;
+		pollfdp[i].events = orig_events;
+	}
+
+	if (copyout(pollfdp, fds, sizeof (pollfd_t) * nfds) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static long
+lx_poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
+{
+	kthread_t *t = curthread;
+	klwp_t *lwp = ttolwp(t);
+	proc_t *p = ttoproc(t);
+	pollstate_t *ps = NULL;
+	pollfd_t *pollfdp = NULL;
+	short *oldevt = NULL;
+	int error = 0, fdcnt = 0;
+
+	/*
+	 * Reset our signal mask, if requested.
+	 */
+	if (ksetp != NULL) {
+		mutex_enter(&p->p_lock);
+		schedctl_finish_sigblock(t);
+		lwp->lwp_sigoldmask = t->t_hold;
+		t->t_hold = *ksetp;
+		t->t_flag |= T_TOMASK;
+		/*
+		 * Call cv_reltimedwait_sig() just to check for signals.
+		 * We will return immediately with either 0 or -1.
+		 */
+		if (!cv_reltimedwait_sig(&t->t_delay_cv, &p->p_lock, 0,
+		    TR_CLOCK_TICK)) {
+			mutex_exit(&p->p_lock);
+			error = EINTR;
+			goto pollout;
+		}
+		mutex_exit(&p->p_lock);
+	}
+
+	/*
+	 * Initialize pollstate and copy in pollfd data if present.
+	 */
+	if (nfds != 0) {
+		if (nfds > p->p_fno_ctl) {
+			mutex_enter(&p->p_lock);
+			(void) rctl_action(rctlproc_legacy[RLIMIT_NOFILE],
+			    p->p_rctls, p, RCA_SAFE);
+			mutex_exit(&p->p_lock);
+			error = EINVAL;
+			goto pollout;
+		}
+
+		/*
+		 * Need to allocate memory for pollstate before anything
+		 * because the mutex and cv are created in this space
+		 */
+		ps = pollstate_create();
+		if (ps->ps_pcache == NULL)
+			ps->ps_pcache = pcache_alloc();
+
+		/*
+		 * Certain event types which are distinct on Linux are aliased
+		 * against each other on illumos.  In order properly translate
+		 * back into the Linux format, the original events of interest
+		 * are stored in 'oldevt' for use during lx_poll_copyout.
+		 */
+		oldevt = kmem_alloc(nfds * sizeof (short), KM_SLEEP);
+		if ((error = lx_poll_copyin(ps, fds, nfds, oldevt)) != 0)
+			goto pollout;
+		pollfdp = ps->ps_pollfd;
+
+		/*
+		 * The Linux poll(2) implicitly polls for POLLERR and POLLHUP
+		 * in addition to any other events specified for the file
+		 * descriptors in question.  It does not modify pollfd_t`events
+		 * to reflect that fact when performing a later copyout.
+		 */
+		ps->ps_implicit_ev = POLLERR | POLLHUP;
+	}
+
+	/*
+	 * Perform the actual poll.
+	 */
+	error = poll_common(ps, fds, nfds, tsp, &fdcnt);
+
+	/*
+	 * Clear implicit event interest, if needed.
+	 */
+	if (ps != NULL) {
+		ps->ps_implicit_ev = 0;
+	}
+
+
+pollout:
+	/*
+	 * If we changed the signal mask but we received no signal then restore
+	 * the signal mask.  Otherwise psig() will deal with the signal mask.
+	 */
+	if (ksetp != NULL) {
+		mutex_enter(&p->p_lock);
+		if (lwp->lwp_cursig == 0) {
+			t->t_hold = lwp->lwp_sigoldmask;
+			t->t_flag &= ~T_TOMASK;
+		}
+		mutex_exit(&p->p_lock);
+	}
+
+	/*
+	 * Copy out the events and return the fdcnt to the user.
+	 */
+	if (nfds != 0 && error == 0) {
+		error = lx_poll_copyout(pollfdp, fds, nfds, oldevt);
+	}
+	if (oldevt != NULL) {
+		kmem_free(oldevt, nfds * sizeof (short));
+	}
+	if (error) {
+		return (set_errno(error));
+	}
+	return (fdcnt);
+}
+
+long
+lx_poll(pollfd_t *fds, nfds_t nfds, int timeout)
+{
+	timespec_t ts, *tsp = NULL;
+
+	if (timeout >= 0) {
+		ts.tv_sec = timeout / MILLISEC;
+		ts.tv_nsec = (timeout % MILLISEC) * MICROSEC;
+		tsp = &ts;
+	}
+
+	return (lx_poll_common(fds, nfds, tsp, NULL));
+}
+
+long
+lx_ppoll(pollfd_t *fds, nfds_t nfds, timespec_t *timeoutp, lx_sigset_t *setp)
+{
+	timespec_t ts, *tsp = NULL;
+	k_sigset_t kset, *ksetp = NULL;
+
+	/*
+	 * Copy in timeout and sigmask.
+	 */
+	if (timeoutp != NULL) {
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			if (copyin(timeoutp, &ts, sizeof (ts)))
+				return (set_errno(EFAULT));
+		} else {
+			timespec32_t ts32;
+
+			if (copyin(timeoutp, &ts32, sizeof (ts32)))
+				return (set_errno(EFAULT));
+			TIMESPEC32_TO_TIMESPEC(&ts, &ts32)
+		}
+
+		if (itimerspecfix(&ts))
+			return (set_errno(EINVAL));
+		tsp = &ts;
+	}
+	if (setp != NULL) {
+		lx_sigset_t lset;
+
+		if (copyin(setp, &lset, sizeof (lset)))
+			return (set_errno(EFAULT));
+		lx_ltos_sigset(&lset, &kset);
+		ksetp = &kset;
+	}
+
+	return (lx_poll_common(fds, nfds, tsp, ksetp));
+}
+
+typedef struct lx_select_buf_s {
+	long		*lsb_rfds;
+	long		*lsb_wfds;
+	long		*lsb_efds;
+	unsigned int	lsb_size;
+} lx_select_buf_t;
+
+/*
+ * Size (in bytes) of buffer appropriate for fd_set copyin/copyout.
+ * Linux uses buffers of 'long' to accomplish this.
+ */
+#define	LX_FD_SET_BYTES		(sizeof (long))
+#define	LX_FD_SET_BITS		(8 * LX_FD_SET_BYTES)
+#define	LX_FD_SET_SIZE(nfds)	\
+	((((nfds) + (LX_FD_SET_BITS - 1)) / LX_FD_SET_BITS) * LX_FD_SET_BYTES)
+
+static int
+lx_select_copyin(pollstate_t *ps, lx_select_buf_t *sbuf, int nfds,
+    long *rfds, long *wfds, long *efds)
+{
+	int n;
+	long *in, *out, *ex;
+	long absent = 0;
+	pollfd_t *pfd;
+	nfds_t old_nfds;
+
+	/*
+	 * Just like pollsys and lx_poll, attempt to reuse ps_pollfd if it is
+	 * appropriately sized.  See poll_copyin for more detail.
+	 */
+	old_nfds = ps->ps_nfds;
+	if (nfds != old_nfds) {
+		kmem_free(ps->ps_pollfd, old_nfds * sizeof (pollfd_t));
+		pfd = kmem_alloc(nfds * sizeof (pollfd_t), KM_SLEEP);
+		ps->ps_pollfd = pfd;
+		ps->ps_nfds = nfds;
+	} else {
+		pfd = ps->ps_pollfd;
+	}
+
+	if (rfds != NULL) {
+		if (copyin(rfds, sbuf->lsb_rfds, sbuf->lsb_size) != 0) {
+			return (EFAULT);
+		}
+	}
+	if (wfds != NULL) {
+		if (copyin(wfds, sbuf->lsb_wfds, sbuf->lsb_size) != 0) {
+			return (EFAULT);
+		}
+	}
+	if (efds != NULL) {
+		if (copyin(efds, sbuf->lsb_efds, sbuf->lsb_size) != 0) {
+			return (EFAULT);
+		}
+	}
+
+	/*
+	 * For each fd, if any bits are set convert them into the appropriate
+	 * pollfd struct. (Derived from libc's select logic)
+	 */
+	in = (rfds != NULL) ? sbuf->lsb_rfds : &absent;
+	out = (wfds != NULL) ? sbuf->lsb_wfds : &absent;
+	ex = (efds != NULL) ? sbuf->lsb_efds : &absent;
+	for (n = 0; n < nfds; n += LX_FD_SET_BITS) {
+		unsigned long b, m, j;
+
+		b = (unsigned long)(*in | *out | *ex);
+		m = 1;
+		for (j = 0; j < LX_FD_SET_BITS; j++) {
+			int fd = n + j;
+
+			if (fd >= nfds)
+				return (0);
+			pfd->events = 0;
+			if (b & 1) {
+				pfd->fd = fd;
+				if (*in & m)
+					pfd->events |= POLLRDNORM;
+				if (*out & m)
+					pfd->events |= POLLWRNORM;
+				if (*ex & m)
+					pfd->events |= POLLRDBAND;
+			} else {
+				pfd->fd = -1;
+			}
+			pfd++;
+			b >>= 1;
+			m <<= 1;
+		}
+
+		if (rfds != NULL)
+			in++;
+		if (wfds != NULL)
+			out++;
+		if (efds != NULL)
+			ex++;
+	}
+	return (0);
+}
+
+static int
+lx_select_copyout(pollfd_t *pollfdp, lx_select_buf_t *sbuf, int nfds,
+    long *rfds, long *wfds, long *efds, int *fdcnt)
+{
+	int n;
+	pollfd_t *pfd;
+	long rv = 0;
+
+	/*
+	 * If poll did not find any fds of interest, we can just zero out the
+	 * fd_set fields for copyout.
+	 */
+	if (*fdcnt == 0) {
+		if (rfds != NULL) {
+			bzero(sbuf->lsb_rfds, sbuf->lsb_size);
+		}
+		if (wfds != NULL) {
+			bzero(sbuf->lsb_wfds, sbuf->lsb_size);
+		}
+		if (efds != NULL) {
+			bzero(sbuf->lsb_efds, sbuf->lsb_size);
+		}
+		goto copyout;
+	}
+
+	/*
+	 * For each fd, if any bits are set convert them into the appropriate
+	 * pollfd struct. (Derived from libc's select logic)
+	 */
+	pfd = pollfdp;
+	for (n = 0; n < nfds; n += LX_FD_SET_BITS) {
+		unsigned long m, j;
+		long in = 0, out = 0, ex = 0;
+
+		m = 1;
+		for (j = 0; j < LX_FD_SET_BITS; j++) {
+			if ((n + j) >= nfds)
+				break;
+			if (pfd->revents != 0) {
+				if (pfd->revents & POLLNVAL) {
+					return (EBADF);
+				}
+				if (pfd->revents & POLLRDNORM) {
+					in |= m;
+					rv++;
+				}
+				if (pfd->revents & POLLWRNORM) {
+					out |= m;
+					rv++;
+				}
+				if (pfd->revents & POLLRDBAND) {
+					ex |= m;
+					rv++;
+				}
+				/*
+				 * Only set this bit on return if we asked
+				 * about input conditions.
+				 */
+				if ((pfd->revents & (POLLHUP|POLLERR)) &&
+				    (pfd->events & POLLRDNORM)) {
+					if ((in & m) == 0) {
+						/* wasn't already set */
+						rv++;
+					}
+					in |= m;
+				}
+				/*
+				 * Only set this bit on return if we asked
+				 * about output conditions.
+				 */
+				if ((pfd->revents & (POLLHUP|POLLERR)) &&
+				    (pfd->events & POLLWRNORM)) {
+					if ((out & m) == 0) {
+						/* wasn't already set */
+						rv++;
+					}
+					out |= m;
+				}
+				/*
+				 * Only set this bit on return if we asked
+				 * about output conditions.
+				 */
+				if ((pfd->revents & (POLLHUP|POLLERR)) &&
+				    (pfd->events & POLLRDBAND)) {
+					if ((ex & m) == 0) {
+						/* wasn't already set */
+						rv++;
+					}
+					ex |= m;
+				}
+			}
+			m <<= 1;
+			pfd++;
+		}
+		if (rfds != NULL)
+			sbuf->lsb_rfds[n / LX_FD_SET_BITS] = in;
+		if (wfds != NULL)
+			sbuf->lsb_wfds[n / LX_FD_SET_BITS] = out;
+		if (efds != NULL)
+			sbuf->lsb_efds[n / LX_FD_SET_BITS] = ex;
+	}
+
+copyout:
+	if (rfds != NULL) {
+		if (copyout(sbuf->lsb_rfds, rfds, sbuf->lsb_size) != 0) {
+			return (EFAULT);
+		}
+	}
+	if (wfds != NULL) {
+		if (copyout(sbuf->lsb_wfds, wfds, sbuf->lsb_size) != 0) {
+			return (EFAULT);
+		}
+	}
+	if (efds != NULL) {
+		if (copyout(sbuf->lsb_efds, efds, sbuf->lsb_size) != 0) {
+			return (EFAULT);
+		}
+	}
+	*fdcnt = rv;
+	return (0);
+}
+
+
+static long
+lx_select_common(int nfds, long *rfds, long *wfds, long *efds,
+    timespec_t *tsp, k_sigset_t *ksetp)
+{
+	kthread_t *t = curthread;
+	klwp_t *lwp = ttolwp(t);
+	proc_t *p = ttoproc(t);
+	pollstate_t *ps = NULL;
+	pollfd_t *pollfdp = NULL, *fake_fds = NULL;
+	lx_select_buf_t sbuf = {0};
+	int error = 0, fdcnt = 0;
+
+	if (nfds < 0) {
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * Reset our signal mask, if requested.
+	 */
+	if (ksetp != NULL) {
+		mutex_enter(&p->p_lock);
+		schedctl_finish_sigblock(t);
+		lwp->lwp_sigoldmask = t->t_hold;
+		t->t_hold = *ksetp;
+		t->t_flag |= T_TOMASK;
+		/*
+		 * Call cv_reltimedwait_sig() just to check for signals.
+		 * We will return immediately with either 0 or -1.
+		 */
+		if (!cv_reltimedwait_sig(&t->t_delay_cv, &p->p_lock, 0,
+		    TR_CLOCK_TICK)) {
+			mutex_exit(&p->p_lock);
+			error = EINTR;
+			goto out;
+		}
+		mutex_exit(&p->p_lock);
+	}
+
+	/*
+	 * Because poll caching uses the userspace pollfd_t pointer to verify
+	 * cache reuse validity, a simulated value must be supplied when
+	 * emulating Linux select(2).  The first non-NULL pointer from
+	 * rfds/wfds/efds is used for this purpose.
+	 */
+	if (rfds != NULL) {
+		fake_fds = (pollfd_t *)rfds;
+	} else if (wfds != NULL) {
+		fake_fds = (pollfd_t *)wfds;
+	} else if (efds != NULL) {
+		fake_fds = (pollfd_t *)efds;
+	} else {
+		/*
+		 * A non-zero nfds was supplied but all three fd_set pointers
+		 * were null.  Fall back to doing a simple timeout.
+		 */
+		nfds = 0;
+	}
+
+	/*
+	 * Initialize pollstate and copy in pollfd data if present.
+	 */
+	if (nfds != 0) {
+		if (nfds > p->p_fno_ctl) {
+			mutex_enter(&p->p_lock);
+			(void) rctl_action(rctlproc_legacy[RLIMIT_NOFILE],
+			    p->p_rctls, p, RCA_SAFE);
+			mutex_exit(&p->p_lock);
+			error = EINVAL;
+			goto out;
+		}
+
+		/*
+		 * Need to allocate memory for pollstate before anything
+		 * because the mutex and cv are created in this space
+		 */
+		ps = pollstate_create();
+		if (ps->ps_pcache == NULL)
+			ps->ps_pcache = pcache_alloc();
+
+		sbuf.lsb_size = LX_FD_SET_SIZE(nfds);
+		if (rfds != NULL)
+			sbuf.lsb_rfds = kmem_alloc(sbuf.lsb_size, KM_SLEEP);
+		if (wfds != NULL)
+			sbuf.lsb_wfds = kmem_alloc(sbuf.lsb_size, KM_SLEEP);
+		if (efds != NULL)
+			sbuf.lsb_efds = kmem_alloc(sbuf.lsb_size, KM_SLEEP);
+
+		error = lx_select_copyin(ps, &sbuf, nfds, rfds, wfds, efds);
+		if (error != 0) {
+			goto out;
+		}
+
+		pollfdp = ps->ps_pollfd;
+	}
+
+	/*
+	 * Perform the actual poll.
+	 */
+	error = poll_common(ps, fake_fds, (nfds_t)nfds, tsp, &fdcnt);
+
+out:
+	/*
+	 * If we changed the signal mask but we received no signal then restore
+	 * the signal mask.  Otherwise psig() will deal with the signal mask.
+	 */
+	if (ksetp != NULL) {
+		mutex_enter(&p->p_lock);
+		if (lwp->lwp_cursig == 0) {
+			t->t_hold = lwp->lwp_sigoldmask;
+			t->t_flag &= ~T_TOMASK;
+		}
+		mutex_exit(&p->p_lock);
+	}
+
+	/*
+	 * Copy out the events and return the fdcnt to the user.
+	 */
+	if (error == 0 && nfds != 0) {
+		error = lx_select_copyout(pollfdp, &sbuf, nfds, rfds, wfds,
+		    efds, &fdcnt);
+	}
+	if (sbuf.lsb_size != 0) {
+		if (sbuf.lsb_rfds != NULL)
+			kmem_free(sbuf.lsb_rfds, sbuf.lsb_size);
+		if (sbuf.lsb_wfds != NULL)
+			kmem_free(sbuf.lsb_wfds, sbuf.lsb_size);
+		if (sbuf.lsb_efds != NULL)
+			kmem_free(sbuf.lsb_efds, sbuf.lsb_size);
+	}
+	if (error) {
+		return (set_errno(error));
+	}
+	return (fdcnt);
+}
+
+long
+lx_select(int nfds, long *rfds, long *wfds, long *efds,
+    struct timeval *timeoutp)
+{
+	timespec_t ts, *tsp = NULL;
+
+	if (timeoutp != NULL) {
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			struct timeval tv;
+
+			if (copyin(timeoutp, &tv, sizeof (tv)))
+				return (set_errno(EFAULT));
+			ts.tv_sec = tv.tv_sec;
+			ts.tv_nsec = tv.tv_usec * (NANOSEC / MICROSEC);
+		} else {
+			struct timeval32 tv32;
+
+			if (copyin(timeoutp, &tv32, sizeof (tv32)))
+				return (set_errno(EFAULT));
+			ts.tv_sec = tv32.tv_sec;
+			ts.tv_nsec = tv32.tv_usec * (NANOSEC / MICROSEC);
+		}
+
+		if (itimerspecfix(&ts))
+			return (set_errno(EINVAL));
+		tsp = &ts;
+	}
+
+	return (lx_select_common(nfds, rfds, wfds, efds, tsp, NULL));
+}
+
+
+typedef struct {
+	uintptr_t lpsa_addr;
+	unsigned long lpsa_len;
+} lx_pselect_sig_arg_t;
+
+#if defined(_LP64)
+typedef struct {
+	caddr32_t lpsa_addr;
+	uint32_t lpsa_len;
+} lx_pselect_sig_arg32_t;
+#endif /* defined(_LP64) */
+
+long
+lx_pselect(int nfds, long *rfds, long *wfds, long *efds,
+    timespec_t *timeoutp, void *setp)
+{
+	timespec_t ts, *tsp = NULL;
+	k_sigset_t kset, *ksetp = NULL;
+
+	/*
+	 * Copy in timeout and sigmask.
+	 */
+	if (timeoutp != NULL) {
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			if (copyin(timeoutp, &ts, sizeof (ts)))
+				return (set_errno(EFAULT));
+		} else {
+			timespec32_t ts32;
+
+			if (copyin(timeoutp, &ts32, sizeof (ts32)))
+				return (set_errno(EFAULT));
+			TIMESPEC32_TO_TIMESPEC(&ts, &ts32)
+		}
+
+		if (itimerspecfix(&ts))
+			return (set_errno(EINVAL));
+		tsp = &ts;
+	}
+	if (setp != NULL) {
+		lx_sigset_t lset, *sigaddr = NULL;
+
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			lx_pselect_sig_arg_t lpsa;
+
+			if (copyin(setp, &lpsa, sizeof (lpsa)) != 0)
+				return (set_errno(EFAULT));
+			/*
+			 * Linux forces a size to be passed only so it can
+			 * check that it's the size of a sigset_t.
+			 */
+			if (lpsa.lpsa_len != sizeof (lx_sigset_t))
+				return (set_errno(EINVAL));
+
+			sigaddr = (lx_sigset_t *)lpsa.lpsa_addr;
+		}
+#if defined(_LP64)
+		else {
+			lx_pselect_sig_arg32_t lpsa32;
+
+			if (copyin(setp, &lpsa32, sizeof (lpsa32)) != 0)
+				return (set_errno(EFAULT));
+			/*
+			 * Linux forces a size to be passed only so it can
+			 * check that it's the size of a sigset_t.
+			 */
+			if (lpsa32.lpsa_len != sizeof (lx_sigset_t))
+				return (set_errno(EINVAL));
+
+			sigaddr = (lx_sigset_t *)(uint64_t)lpsa32.lpsa_addr;
+		}
+#endif /* defined(_LP64) */
+
+		/* This is where we check if the sigset is *really* NULL. */
+		if (sigaddr != NULL) {
+			if (copyin(sigaddr, &lset, sizeof (lset)) != 0)
+				return (set_errno(EFAULT));
+
+			lx_ltos_sigset(&lset, &kset);
+			ksetp = &kset;
+		}
+	}
+
+	return (lx_select_common(nfds, rfds, wfds, efds, tsp, ksetp));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_prctl.c b/usr/src/uts/common/brand/lx/syscall/lx_prctl.c
new file mode 100644
index 0000000000..4aecb6e9cc
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_prctl.c
@@ -0,0 +1,286 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/types.h>
+#include <sys/user.h>
+#include <sys/priv.h>
+#include <sys/brand.h>
+#include <sys/cmn_err.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_misc.h>
+#include <lx_signum.h>
+
+#define	LX_PR_SET_PDEATHSIG		1
+#define	LX_PR_GET_PDEATHSIG		2
+#define	LX_PR_GET_DUMPABLE		3
+#define	LX_PR_SET_DUMPABLE		4
+#define	LX_PR_GET_UNALIGN		5
+#define	LX_PR_SET_UNALIGN		6
+#define	LX_PR_GET_KEEPCAPS		7
+#define	LX_PR_SET_KEEPCAPS		8
+#define	LX_PR_GET_FPEMU			9
+#define	LX_PR_SET_FPEMU			10
+#define	LX_PR_GET_FPEXC			11
+#define	LX_PR_SET_FPEXC			12
+#define	LX_PR_GET_TIMING		13
+#define	LX_PR_SET_TIMING		14
+#define	LX_PR_SET_NAME			15
+#define	LX_PR_GET_NAME			16
+#define	LX_PR_GET_ENDIAN		19
+#define	LX_PR_SET_ENDIAN		20
+#define	LX_PR_GET_SECCOMP		21
+#define	LX_PR_SET_SECCOMP		22
+#define	LX_PR_CAPBSET_READ		23
+#define	LX_PR_CAPBSET_DROP		24
+#define	LX_PR_GET_TSC			25
+#define	LX_PR_SET_TSC			26
+#define	LX_PR_GET_SECUREBITS		27
+#define	LX_PR_SET_SECUREBITS		28
+#define	LX_PR_SET_TIMERSLACK		29
+#define	LX_PR_GET_TIMERSLACK		30
+#define	LX_PR_TASK_PERF_EVENTS_DISABLE	31
+#define	LX_PR_TASK_PERF_EVENTS_ENABLE	32
+#define	LX_PR_MCE_KILL			33
+#define	LX_PR_MCE_KILL_GET		34
+#define	LX_PR_SET_MM			35
+#define	LX_PR_SET_CHILD_SUBREAPER	36
+#define	LX_PR_GET_CHILD_SUBREAPER	37
+#define	LX_PR_SET_NO_NEW_PRIVS		38
+#define	LX_PR_GET_NO_NEW_PRIVS		39
+#define	LX_PR_GET_TID_ADDRESS		40
+#define	LX_PR_SET_THP_DISABLE		41
+#define	LX_PR_GET_THP_DISABLE		42
+
+long
+lx_prctl(int opt, uintptr_t data)
+{
+	long err;
+	char ebuf[64];
+
+	switch (opt) {
+	case LX_PR_GET_DUMPABLE: {
+		/* Only track in brand data - could hook into SNOCD later */
+		lx_proc_data_t *lxpd;
+		int val;
+
+		mutex_enter(&curproc->p_lock);
+		VERIFY((lxpd = ptolxproc(curproc)) != NULL);
+		val = lxpd->l_flags & LX_PROC_NO_DUMP;
+		mutex_exit(&curproc->p_lock);
+
+		return (val == 0);
+	}
+
+	case LX_PR_SET_DUMPABLE: {
+		lx_proc_data_t *lxpd;
+
+		if (data != 0 && data != 1) {
+			return (set_errno(EINVAL));
+		}
+
+		mutex_enter(&curproc->p_lock);
+		VERIFY((lxpd = ptolxproc(curproc)) != NULL);
+		if (data == 0) {
+			lxpd->l_flags |= LX_PROC_NO_DUMP;
+		} else {
+			lxpd->l_flags &= ~LX_PROC_NO_DUMP;
+		}
+		mutex_exit(&curproc->p_lock);
+
+		return (0);
+	}
+
+	case LX_PR_GET_SECUREBITS: {
+		/* Our bits are always 0 */
+		return (0);
+	}
+
+	case LX_PR_SET_SECUREBITS: {
+		/* Ignore setting any bits from arg2 */
+		return (0);
+	}
+
+	case LX_PR_SET_KEEPCAPS: {
+		/*
+		 * The closest illumos analog to SET_KEEPCAPS is the PRIV_AWARE
+		 * flag.  There are probably some cases where it's not exactly
+		 * the same, but this will do for a first try.
+		 */
+		if (data == 0) {
+			err = setpflags(PRIV_AWARE_RESET, 1, NULL);
+		} else {
+			err = setpflags(PRIV_AWARE, 1, NULL);
+		}
+
+		if (err != 0) {
+			return (set_errno(err));
+		}
+		return (0);
+	}
+
+	case LX_PR_GET_NAME: {
+		/*
+		 * We allow longer thread names than Linux for compatibility
+		 * with other OSes (Solaris, NetBSD) that also allow larger
+		 * names.  We just truncate (with NUL termination) if
+		 * the name is longer.
+		 */
+		char name[LX_PR_SET_NAME_NAMELEN] = { 0 };
+		kthread_t *t = curthread;
+
+		mutex_enter(&ttoproc(t)->p_lock);
+		if (t->t_name != NULL) {
+			(void) strlcpy(name, t->t_name, sizeof (name));
+		}
+		mutex_exit(&ttoproc(t)->p_lock);
+
+		/*
+		 * FWIW, the prctl(2) manpage says that the user-supplied
+		 * buffer should be at least 16 (LX_PR_SET_NAME_NAMELEN) bytes
+		 * long.
+		 */
+		if (copyout(name, (void *)data, LX_PR_SET_NAME_NAMELEN) != 0) {
+			return (set_errno(EFAULT));
+		}
+		return (0);
+	}
+
+	case LX_PR_SET_NAME: {
+		char name[LX_PR_SET_NAME_NAMELEN] = { 0 };
+		kthread_t *t = curthread;
+		proc_t *p = ttoproc(t);
+		int ret;
+
+		ret = copyinstr((const char *)data, name, sizeof (name), NULL);
+		/*
+		 * prctl(2) explicitly states that over length strings are
+		 * silently truncated
+		 */
+		if (ret != 0 && ret != ENAMETOOLONG) {
+			return (set_errno(EFAULT));
+		}
+		name[LX_PR_SET_NAME_NAMELEN - 1] = '\0';
+
+		thread_setname(t, name);
+
+		/*
+		 * In Linux, PR_SET_NAME sets the name of the thread, not the
+		 * process.  Due to the historical quirks of Linux's asinine
+		 * thread model, this name is effectively the name of the
+		 * process (as visible via ps(1)) if the thread is the first of
+		 * its task group.  The first thread is therefore special, and
+		 * to best mimic Linux semantics we set the thread name, and if
+		 * we are setting LWP 1, we also update the name of the process.
+		 */
+		if (t->t_tid != 1) {
+			return (0);
+		}
+
+		/*
+		 * We are currently choosing to not allow an empty thread
+		 * name to clear p->p_user.u_comm and p->p_user.u_psargs.
+		 * This is a slight divergence from linux behavior (which
+		 * allows this) so that we can preserve the original command.
+		 */
+		if (strlen(name) == 0) {
+			return (0);
+		}
+
+		/*
+		 * We explicitly use t->t_name here instead of name in case
+		 * a thread has come in between the above thread_setname()
+		 * call and the setting of u_comm/u_psargs below.  On Linux,
+		 * one can also change the name of a thread (either itself or
+		 * another thread in the same process) via writing to /proc, so
+		 * while racy, this is no worse than what might happen on
+		 * Linux.
+		 */
+		mutex_enter(&p->p_lock);
+		(void) strncpy(p->p_user.u_comm, t->t_name, MAXCOMLEN + 1);
+		(void) strncpy(p->p_user.u_psargs, t->t_name, PSARGSZ);
+		mutex_exit(&p->p_lock);
+		return (0);
+	}
+
+	case LX_PR_GET_PDEATHSIG: {
+		int sig;
+		lx_proc_data_t *lxpd;
+
+		mutex_enter(&curproc->p_lock);
+		VERIFY((lxpd = ptolxproc(curproc)) != NULL);
+		sig = lxpd->l_parent_deathsig;
+		mutex_exit(&curproc->p_lock);
+
+		return (sig);
+	}
+
+	case LX_PR_SET_PDEATHSIG: {
+		int sig = lx_ltos_signo((int)data, 0);
+		proc_t *pp = NULL;
+		lx_proc_data_t *lxpd;
+
+		if (sig == 0 && data != 0) {
+			return (set_errno(EINVAL));
+		}
+
+		mutex_enter(&pidlock);
+		/* Set signal on our self */
+		mutex_enter(&curproc->p_lock);
+		VERIFY((lxpd = ptolxproc(curproc)) != NULL);
+		lxpd->l_parent_deathsig = sig;
+		pp = curproc->p_parent;
+		mutex_exit(&curproc->p_lock);
+
+		/* Configure parent to potentially signal children on death */
+		mutex_enter(&pp->p_lock);
+		if (PROC_IS_BRANDED(pp)) {
+			VERIFY((lxpd = ptolxproc(pp)) != NULL);
+			/*
+			 * Mark the parent as having children which wish to be
+			 * signaled on death of parent.
+			 */
+			lxpd->l_flags |= LX_PROC_CHILD_DEATHSIG;
+		} else {
+			/*
+			 * If the parent is not a branded process, the needed
+			 * hooks to facilitate this mechanism will not fire
+			 * when it dies. We lie about success in this case.
+			 */
+			/* EMPTY */
+		}
+		mutex_exit(&pp->p_lock);
+		mutex_exit(&pidlock);
+		return (0);
+	}
+
+	case LX_PR_CAPBSET_DROP: {
+		/*
+		 * On recent versions of Linux the login svc drops capabilities
+		 * and if that fails the svc dies and is restarted by systemd.
+		 * For now we pretend dropping capabilities succeeded.
+		 */
+		return (0);
+	}
+
+	default:
+		break;
+	}
+
+	(void) snprintf(ebuf, 64, "prctl option %d", opt);
+	lx_unsupported(ebuf);
+	return (set_errno(EINVAL));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_priority.c b/usr/src/uts/common/brand/lx/syscall/lx_priority.c
new file mode 100644
index 0000000000..44c60b66bf
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_priority.c
@@ -0,0 +1,192 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/procset.h>
+#include <sys/resource.h>
+#include <sys/priocntl.h>
+#include <sys/param.h>
+#include <sys/policy.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+
+/* From uts/common/disp/priocntl.c */
+extern int donice(procset_t *, pcnice_t *);
+
+/*
+ * The Linux syscall returns priorities in the range (highest) 40-1 (lowest)
+ * and then glibc adjusts these to the range -20 - 19.
+ */
+long
+lx_getpriority(int which, id_t who)
+{
+	int rval;
+	idtype_t idtype;
+	id_t id, lid;
+	pcnice_t pcnice;
+	procset_t procset;
+
+	switch (which) {
+	case PRIO_PROCESS:
+		idtype = P_PID;
+		if (who > 0 && lx_lpid_to_spair(who, &who, &lid) < 0)
+			return (set_errno(ESRCH));
+		break;
+	case PRIO_PGRP:
+		idtype = P_PGID;
+		break;
+	case PRIO_USER:
+		idtype = P_UID;
+		break;
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	/* Linux fails with a different errno on a negative id */
+	if (who < 0)
+		return (set_errno(ESRCH));
+
+	id = (who == 0 ? P_MYID : who);
+
+	pcnice.pc_val = 0;
+	pcnice.pc_op = PC_GETNICE;
+
+	setprocset(&procset, POP_AND, idtype, id, P_ALL, 0);
+
+	rval = donice(&procset, &pcnice);
+	if (rval != 0) {
+		if (which == PRIO_PROCESS &&
+		    (who == curproc->p_pid || who == 0) &&
+		    strcmp(sclass[curthread->t_cid].cl_name, "RT") == 0) {
+			/*
+			 * donice() will always return EINVAL if we're in the
+			 * RT class. The zone won't be able to put itself or any
+			 * of its processes into RT, but if we put the whole
+			 * zone into RT via the scheduling-class property, then
+			 * getpriority would always fail. This breaks pam and
+			 * prevents any login. Just pretend to be the highest
+			 * priority.
+			 */
+			return (40);
+		}
+
+		/*
+		 * Linux does not return EINVAL for invalid 'who' values, it
+		 * returns ESRCH instead. We already validated 'which' above.
+		 */
+		if (rval == EINVAL)
+			rval = ESRCH;
+		return (set_errno(rval));
+	}
+
+	/*
+	 * The return value of the getpriority syscall is biased by 20 to avoid
+	 * returning negative values when successful (-20 internally is our
+	 * highest priority and 19 is our lowest).
+	 */
+	return (20 - pcnice.pc_val);
+}
+
+/*
+ * Return EPERM if the current process is not allowed to operate on the target
+ * process (which is part of the procset for setpriority).
+ */
+/* ARGSUSED */
+static int
+lx_chk_pripriv(proc_t *pp, char *dummy)
+{
+	ASSERT(MUTEX_HELD(&pidlock));
+	mutex_enter(&pp->p_lock);
+	if (!prochasprocperm(pp, curproc, CRED())) {
+		mutex_exit(&pp->p_lock);
+		return (EPERM);
+	}
+	mutex_exit(&pp->p_lock);
+	return (0);
+}
+
+long
+lx_setpriority(int which, id_t who, int prio)
+{
+	int rval;
+	idtype_t idtype;
+	id_t id, lid;
+	pcnice_t pcnice;
+	procset_t procset;
+
+	switch (which) {
+	case PRIO_PROCESS:
+		idtype = P_PID;
+		if (who > 0 && lx_lpid_to_spair(who, &who, &lid) < 0)
+			return (set_errno(ESRCH));
+		break;
+	case PRIO_PGRP:
+		idtype = P_PGID;
+		break;
+	case PRIO_USER:
+		idtype = P_UID;
+		break;
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	/* Linux fails with a different errno on a negative id */
+	if (who < 0)
+		return (set_errno(ESRCH));
+
+	id = (who == 0 ? P_MYID : who);
+
+	if (prio > NZERO - 1) {
+		prio = NZERO - 1;
+	} else if (prio < -NZERO) {
+		prio = -NZERO;
+	}
+
+	pcnice.pc_val = prio;
+	pcnice.pc_op = PC_SETNICE;
+
+	setprocset(&procset, POP_AND, idtype, id, P_ALL, 0);
+
+	rval = donice(&procset, &pcnice);
+	if (rval != 0) {
+		/*
+		 * Once we fully support Linux capabilities, we should update
+		 * the following check to look at the CAP_SYS_NICE capability.
+		 */
+		if (rval == EPERM && crgetuid(CRED()) != 0) {
+			/*
+			 * donice() returns EPERM under two conditions:
+			 * 1) if either the real or eff. uid don't match
+			 * 2) we lack the privileges to raise the priority
+			 *
+			 * However, setpriority() must return a different errno
+			 * based on the following:
+			 * EPERM  - real or eff. uid did not match
+			 * EACCES - trying to increase priority
+			 *
+			 * We use lx_chk_pripriv to determine which case we hit.
+			 *
+			 * Note that the native setpriority(3C) code has the
+			 * same race on re-checking.
+			 */
+			if (dotoprocs(&procset, lx_chk_pripriv, NULL) != EPERM)
+				rval = EACCES;
+		}
+
+		return (set_errno(rval));
+	}
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_rename.c b/usr/src/uts/common/brand/lx/syscall/lx_rename.c
new file mode 100644
index 0000000000..2fad627771
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_rename.c
@@ -0,0 +1,39 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/fcntl.h>
+#include <sys/lx_fcntl.h>
+
+/* From uts/common/syscall/rename.c */
+extern int rename(char *, char *);
+extern int renameat(int, char *, int, char *);
+
+long
+lx_rename(char *p1, char *p2)
+{
+	return (rename(p1, p2));
+}
+
+long
+lx_renameat(int atfd1, char *p1, int atfd2, char *p2)
+{
+	if (atfd1 == LX_AT_FDCWD)
+		atfd1 = AT_FDCWD;
+
+	if (atfd2 == LX_AT_FDCWD)
+		atfd2 = AT_FDCWD;
+
+	return (renameat(atfd1, p1, atfd2, p2));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_rlimit.c b/usr/src/uts/common/brand/lx/syscall/lx_rlimit.c
new file mode 100644
index 0000000000..30fa996615
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_rlimit.c
@@ -0,0 +1,587 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/zone.h>
+#include <sys/cpuvar.h>
+#include <sys/cmn_err.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_brand.h>
+
+#define	LX_RLIMIT_CPU		0
+#define	LX_RLIMIT_FSIZE		1
+#define	LX_RLIMIT_DATA		2
+#define	LX_RLIMIT_STACK		3
+#define	LX_RLIMIT_CORE		4
+#define	LX_RLIMIT_RSS		5
+#define	LX_RLIMIT_NPROC		6
+#define	LX_RLIMIT_NOFILE	7
+#define	LX_RLIMIT_MEMLOCK	8
+#define	LX_RLIMIT_AS		9
+#define	LX_RLIMIT_LOCKS		10	/* NA limit on locks, early 2.4 only */
+#define	LX_RLIMIT_SIGPENDING	11
+#define	LX_RLIMIT_MSGQUEUE	12
+#define	LX_RLIMIT_NICE		13	/* NA ceiling for nice */
+#define	LX_RLIMIT_RTPRIO	14	/* NA ceiling on the RT priority */
+#define	LX_RLIMIT_RTTIME	15	/* NA cpu limit for RT proc. */
+
+#define	LX_RLIMIT_NLIMITS	16
+
+#define	RCTL_INFINITE(x) \
+	((x->rcv_flagaction & RCTL_LOCAL_MAXIMAL) && \
+	(x->rcv_flagaction & RCTL_GLOBAL_INFINITE))
+
+typedef struct {
+	ulong_t	rlim_cur;
+	ulong_t	rlim_max;
+} lx_rlimit_t;
+
+typedef struct {
+	uint32_t	rlim_cur;
+	uint32_t	rlim_max;
+} lx_rlimit32_t;
+
+/*
+ * Linux supports many of the same resources that we do, but on illumos these
+ * are rctls. Instead of using rlimit, we use rctls for all of the limits.
+ * This table is used to translate Linux rlimit keys into the illumos legacy
+ * rlimit. We then primarily use the rctl/rlimit compatability code to
+ * manage these.
+ */
+static int l_to_r[LX_RLIMIT_NLIMITS] = {
+	RLIMIT_CPU,		/* 0 CPU */
+	RLIMIT_FSIZE,		/* 1 FSIZE */
+	RLIMIT_DATA,		/* 2 DATA */
+	RLIMIT_STACK,		/* 3 STACK */
+	RLIMIT_CORE,		/* 4 CORE */
+	-1,			/* 5 RSS */
+	-1,			/* 6 NPROC */
+	RLIMIT_NOFILE,		/* 7 NOFILE */
+	-1,			/* 8 MEMLOCK */
+	RLIMIT_AS,		/* 9 AS */
+	-1,			/* 10 LOCKS */
+	-1, 			/* 11 SIGPENDING */
+	-1, 			/* 12 MSGQUEUE */
+	-1,			/* 13 NICE */
+	-1,			/* 14 RTPRIO */
+	-1			/* 15 RTTIME */
+};
+
+/*
+ * Magic value Linux uses to indicate infinity
+ */
+#define	LX_RLIM_INFINITY_N	ULONG_MAX
+
+void
+lx_get_rctl(char *nm, struct rlimit64 *rlp64)
+{
+	rctl_hndl_t hndl;
+	rctl_val_t *oval, *nval;
+
+	rlp64->rlim_cur = RLIM_INFINITY;
+	rlp64->rlim_max = RLIM_INFINITY;
+
+	nval = kmem_alloc(sizeof (rctl_val_t), KM_SLEEP);
+	mutex_enter(&curproc->p_lock);
+
+	hndl = rctl_hndl_lookup(nm);
+	oval = NULL;
+	while ((hndl != -1) && rctl_local_get(hndl, oval, nval, curproc) == 0) {
+		oval = nval;
+		switch (nval->rcv_privilege) {
+		case RCPRIV_BASIC:
+			if (!RCTL_INFINITE(nval))
+				rlp64->rlim_cur = nval->rcv_value;
+			break;
+		case RCPRIV_PRIVILEGED:
+			if (!RCTL_INFINITE(nval))
+				rlp64->rlim_max = nval->rcv_value;
+			break;
+		}
+	}
+
+	mutex_exit(&curproc->p_lock);
+	kmem_free(nval, sizeof (rctl_val_t));
+
+	if (rlp64->rlim_cur == RLIM_INFINITY &&
+	    rlp64->rlim_max != RLIM_INFINITY)
+		rlp64->rlim_cur = rlp64->rlim_max;
+}
+
+static int
+lx_getrlimit_common(int lx_resource, uint64_t *rlim_curp, uint64_t *rlim_maxp)
+{
+	lx_proc_data_t *pd = ptolxproc(curproc);
+	int resource;
+	int64_t cur = -1;
+	boolean_t cur_inf = B_FALSE;
+	int64_t max = -1;
+	boolean_t max_inf = B_FALSE;
+	struct rlimit64 rlim64;
+
+	if (lx_resource < 0 || lx_resource >= LX_RLIMIT_NLIMITS)
+		return (EINVAL);
+
+	switch (lx_resource) {
+	case LX_RLIMIT_LOCKS:
+		rlim64.rlim_cur = pd->l_fake_limits[LX_RLFAKE_LOCKS].rlim_cur;
+		rlim64.rlim_max = pd->l_fake_limits[LX_RLFAKE_LOCKS].rlim_max;
+		break;
+
+	case LX_RLIMIT_NICE:
+		rlim64.rlim_cur = pd->l_fake_limits[LX_RLFAKE_NICE].rlim_cur;
+		rlim64.rlim_max = pd->l_fake_limits[LX_RLFAKE_NICE].rlim_max;
+		break;
+
+	case LX_RLIMIT_RTPRIO:
+		rlim64.rlim_cur = pd->l_fake_limits[LX_RLFAKE_RTPRIO].rlim_cur;
+		rlim64.rlim_max = pd->l_fake_limits[LX_RLFAKE_RTPRIO].rlim_max;
+		break;
+
+	case LX_RLIMIT_RTTIME:
+		rlim64.rlim_cur = pd->l_fake_limits[LX_RLFAKE_RTTIME].rlim_cur;
+		rlim64.rlim_max = pd->l_fake_limits[LX_RLFAKE_RTTIME].rlim_max;
+		break;
+
+	case LX_RLIMIT_RSS:
+		/* zone.max-physical-memory */
+		zone_get_physmem_data(curzone->zone_id,
+		    (pgcnt_t *)&rlim64.rlim_cur,
+		    (pgcnt_t *)&rlim64.rlim_max); /* max is dummy variable */
+		rlim64.rlim_cur = rlim64.rlim_max = ptob(rlim64.rlim_cur);
+
+		break;
+
+	case LX_RLIMIT_NPROC:
+		/*  zone.max-lwps */
+		rlim64.rlim_cur = rlim64.rlim_max = curzone->zone_nlwps_ctl;
+		break;
+
+	case LX_RLIMIT_MEMLOCK:
+		lx_get_rctl("process.max-locked-memory", &rlim64);
+
+		/* If unlimited, use zone.max-locked-memory */
+		if (rlim64.rlim_max == RLIM64_INFINITY)
+			rlim64.rlim_max = curzone->zone_locked_mem_ctl;
+		if (rlim64.rlim_cur == RLIM64_INFINITY)
+			rlim64.rlim_cur = curzone->zone_locked_mem_ctl;
+		break;
+
+	case LX_RLIMIT_SIGPENDING:
+		lx_get_rctl("process.max-sigqueue-size", &rlim64);
+		break;
+
+	case LX_RLIMIT_MSGQUEUE:
+		lx_get_rctl("process.max-msg-messages", &rlim64);
+		break;
+
+	default:
+		resource = l_to_r[lx_resource];
+
+		mutex_enter(&curproc->p_lock);
+		(void) rctl_rlimit_get(rctlproc_legacy[resource], curproc,
+		    &rlim64);
+		mutex_exit(&curproc->p_lock);
+		break;
+	}
+
+
+	if (rlim64.rlim_cur == RLIM64_INFINITY) {
+		cur = LX_RLIM_INFINITY_N;
+	} else {
+		cur = rlim64.rlim_cur;
+	}
+	if (rlim64.rlim_max == RLIM64_INFINITY) {
+		max = LX_RLIM_INFINITY_N;
+	} else {
+		max = rlim64.rlim_max;
+	}
+
+	if (lx_resource == LX_RLIMIT_STACK && cur > INT_MAX) {
+		/*
+		 * Stunningly, Linux has somehow managed to confuse the concept
+		 * of a "limit" with that of a "default" -- and the value of
+		 * RLIMIT_STACK is used by NPTL as the _default_ stack size if
+		 * it isn't specified. (!!)  Even for a system that prides
+		 * itself on slapdash castles of junk, this is an amazingly
+		 * willful act of incompetence -- and one that is gleefully
+		 * confessed in the pthread_create() man page: "if the
+		 * RLIMIT_STACK soft resource limit at the time the program
+		 * started has any value other than 'unlimited', then it
+		 * determines the default stack size of new threads."  A
+		 * typical stack limit for us is 32TB; if it needs to be said,
+		 * setting the default stack size to be 32TB doesn't work so
+		 * well!  Of course, glibc dropping a deuce in its pants
+		 * becomes our problem -- so to prevent smelly accidents we
+		 * tell Linux that any stack limit over the old (32-bit) values
+		 * for infinity are just infinitely large.
+		 */
+		cur_inf = B_TRUE;
+		max_inf = B_TRUE;
+	}
+
+	if (cur_inf) {
+		*rlim_curp = LX_RLIM64_INFINITY;
+	} else {
+		*rlim_curp = cur;
+	}
+
+	if (max_inf) {
+		*rlim_maxp = LX_RLIM64_INFINITY;
+	} else {
+		*rlim_maxp = max;
+	}
+
+	return (0);
+}
+
+/*
+ * This is the 'new' getrlimit, variously called getrlimit or ugetrlimit
+ * in Linux headers and code.  The only difference between this and the old
+ * getrlimit (variously called getrlimit or old_getrlimit) is the value of
+ * RLIM_INFINITY, which is smaller for the older version.  Modern code will
+ * use this version by default.
+ */
+long
+lx_getrlimit(int resource, lx_rlimit_t *rlp)
+{
+	int rv;
+	lx_rlimit_t rl;
+	uint64_t rlim_cur, rlim_max;
+
+	rv = lx_getrlimit_common(resource, &rlim_cur, &rlim_max);
+	if (rv != 0)
+		return (set_errno(rv));
+
+	if (get_udatamodel() == DATAMODEL_NATIVE) {
+		if (rlim_cur == LX_RLIM64_INFINITY)
+			rl.rlim_cur = LX_RLIM_INFINITY_N;
+		else if (rlim_cur > LX_RLIM_INFINITY_N)
+			rl.rlim_cur = LX_RLIM_INFINITY_N;
+		else
+			rl.rlim_cur = (ulong_t)rlim_cur;
+
+		if (rlim_max == LX_RLIM64_INFINITY)
+			rl.rlim_max = LX_RLIM_INFINITY_N;
+		else if (rlim_max > LX_RLIM_INFINITY_N)
+			rl.rlim_max = LX_RLIM_INFINITY_N;
+		else
+			rl.rlim_max = (ulong_t)rlim_max;
+
+		if (copyout(&rl, rlp, sizeof (rl)) != 0)
+			return (set_errno(EFAULT));
+	}
+#ifdef _SYSCALL32_IMPL
+	else {
+		lx_rlimit32_t rl32;
+
+		if (rlim_cur > UINT_MAX)
+			rl.rlim_cur = UINT_MAX;
+		else
+			rl.rlim_cur = (ulong_t)rlim_cur;
+
+		if (rlim_max > UINT_MAX)
+			rl.rlim_max = UINT_MAX;
+		else
+			rl.rlim_max = (ulong_t)rlim_max;
+
+		rl32.rlim_cur = rl.rlim_cur;
+		rl32.rlim_max = rl.rlim_max;
+
+		if (copyout(&rl32, rlp, sizeof (rl32)) != 0)
+			return (set_errno(EFAULT));
+	}
+#endif
+
+	return (0);
+}
+
+/*
+ * This is the 'old' getrlimit, variously called getrlimit or old_getrlimit
+ * in Linux headers and code.  The only difference between this and the new
+ * getrlimit (variously called getrlimit or ugetrlimit) is the value of
+ * RLIM_INFINITY, which is smaller for the older version.
+ *
+ * This is only used for 32-bit code.
+ */
+long
+lx_oldgetrlimit(int resource, lx_rlimit_t *rlp)
+{
+	int rv;
+	lx_rlimit32_t rl32;
+	uint64_t rlim_cur, rlim_max;
+
+	rv = lx_getrlimit_common(resource, &rlim_cur, &rlim_max);
+	if (rv != 0)
+		return (set_errno(rv));
+
+	if (rlim_cur > INT_MAX)
+		rl32.rlim_cur = INT_MAX;
+	else
+		rl32.rlim_cur = (ulong_t)rlim_cur;
+
+	if (rlim_max > INT_MAX)
+		rl32.rlim_max = INT_MAX;
+	else
+		rl32.rlim_max = (ulong_t)rlim_cur;
+
+	if (copyout(&rl32, rlp, sizeof (rl32)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+static int
+lx_set_rctl(char *nm, struct rlimit64 *rlp64)
+{
+	int err;
+	rctl_hndl_t hndl;
+	rctl_alloc_gp_t *gp;
+
+	gp = rctl_rlimit_set_prealloc(1);
+
+	mutex_enter(&curproc->p_lock);
+
+	hndl = rctl_hndl_lookup(nm);
+
+	/*
+	 * We're not supposed to do this but since we want all our rctls to
+	 * behave like rlimits, we take advantage of this function to set up
+	 * this way.
+	 */
+	err = rctl_rlimit_set(hndl, curproc, rlp64, gp, RCTL_LOCAL_DENY, 0,
+	    CRED());
+
+	mutex_exit(&curproc->p_lock);
+
+	rctl_prealloc_destroy(gp);
+
+	return (err);
+}
+
+static int
+lx_setrlimit_common(int lx_resource, uint64_t rlim_cur, uint64_t rlim_max)
+{
+	lx_proc_data_t *pd = ptolxproc(curproc);
+	int err;
+	int resource;
+	rctl_alloc_gp_t *gp;
+	struct rlimit64 rl64;
+
+	if (lx_resource < 0 || lx_resource >= LX_RLIMIT_NLIMITS)
+		return (EINVAL);
+
+	switch (lx_resource) {
+	case LX_RLIMIT_LOCKS:
+		pd->l_fake_limits[LX_RLFAKE_LOCKS].rlim_cur = rlim_cur;
+		pd->l_fake_limits[LX_RLFAKE_LOCKS].rlim_max = rlim_max;
+		break;
+
+	case LX_RLIMIT_NICE:
+		pd->l_fake_limits[LX_RLFAKE_NICE].rlim_cur = rlim_cur;
+		pd->l_fake_limits[LX_RLFAKE_NICE].rlim_max = rlim_max;
+		break;
+
+	case LX_RLIMIT_RTPRIO:
+		pd->l_fake_limits[LX_RLFAKE_RTPRIO].rlim_cur = rlim_cur;
+		pd->l_fake_limits[LX_RLFAKE_RTPRIO].rlim_max = rlim_max;
+		break;
+
+	case LX_RLIMIT_RTTIME:
+		pd->l_fake_limits[LX_RLFAKE_RTTIME].rlim_cur = rlim_cur;
+		pd->l_fake_limits[LX_RLFAKE_RTTIME].rlim_max = rlim_max;
+		break;
+
+	case LX_RLIMIT_RSS:
+		/*
+		 * zone.max-physical-memory
+		 * Since we're emulating the value via a zone rctl, we can't
+		 * set that from within the zone. Lie and say we set the value.
+		 */
+		break;
+
+	case LX_RLIMIT_NPROC:
+		/*
+		 * zone.max-lwps
+		 * Since we're emulating the value via a zone rctl, we can't
+		 * set that from within the zone. Lie and say we set the value.
+		 */
+		break;
+
+	case LX_RLIMIT_MEMLOCK:
+		/*
+		 * We allow setting to unlimited (LX_RLIM_INFINITY_N). The zone
+		 * limit will always apply.
+		 */
+		rl64.rlim_cur = rlim_cur;
+		rl64.rlim_max = rlim_max;
+		err = lx_set_rctl("process.max-locked-memory", &rl64);
+		if (err != 0)
+			return (set_errno(err));
+		break;
+
+	case LX_RLIMIT_SIGPENDING:
+		/*
+		 * On Ubuntu at least, the login and sshd processes expect to
+		 * set this limit to 16k and login will fail if this fails. On
+		 * illumos we have a system limit of 8k and normally the
+		 * privileged limit is 512. We simply pretend this works to
+		 * allow login to work.
+		 */
+		if (rlim_max > 8192)
+			return (0);
+
+		rl64.rlim_cur = rlim_cur;
+		rl64.rlim_max = rlim_max;
+		if ((err = lx_set_rctl("process.max-sigqueue-size", &rl64))
+		    != 0)
+			return (set_errno(err));
+		break;
+
+	case LX_RLIMIT_MSGQUEUE:
+		rl64.rlim_cur = rlim_cur;
+		rl64.rlim_max = rlim_max;
+		if ((err = lx_set_rctl("process.max-msg-messages", &rl64)) != 0)
+			return (set_errno(err));
+		break;
+
+	default:
+		resource = l_to_r[lx_resource];
+
+		/*
+		 * Linux limits the max number of open files to 1m and there is
+		 * a test for this.
+		 */
+		if (lx_resource == LX_RLIMIT_NOFILE && rlim_max > (1024 * 1024))
+			return (EPERM);
+
+		rl64.rlim_cur = rlim_cur;
+		rl64.rlim_max = rlim_max;
+		gp = rctl_rlimit_set_prealloc(1);
+
+		mutex_enter(&curproc->p_lock);
+		err = rctl_rlimit_set(rctlproc_legacy[resource], curproc,
+		    &rl64, gp, rctlproc_flags[resource],
+		    rctlproc_signals[resource], CRED());
+		mutex_exit(&curproc->p_lock);
+
+		rctl_prealloc_destroy(gp);
+		if (err != 0)
+			return (set_errno(err));
+		break;
+	}
+
+	return (0);
+}
+
+long
+lx_setrlimit(int resource, lx_rlimit_t *rlp)
+{
+	int rv;
+	lx_rlimit_t rl;
+	uint64_t rlim_cur, rlim_max;
+
+	if (get_udatamodel() == DATAMODEL_NATIVE) {
+		if (copyin(rlp, &rl, sizeof (rl)) != 0)
+			return (set_errno(EFAULT));
+	}
+#ifdef _SYSCALL32_IMPL
+	else {
+		lx_rlimit32_t rl32;
+
+		if (copyin(rlp, &rl32, sizeof (rl32)) != 0)
+			return (set_errno(EFAULT));
+
+		rl.rlim_cur = rl32.rlim_cur;
+		rl.rlim_max = rl32.rlim_max;
+	}
+#endif
+
+	if ((rl.rlim_max != LX_RLIM_INFINITY_N &&
+	    rl.rlim_cur == LX_RLIM_INFINITY_N) ||
+	    rl.rlim_cur > rl.rlim_max)
+		return (set_errno(EINVAL));
+
+	if (rl.rlim_cur == LX_RLIM_INFINITY_N)
+		rlim_cur = LX_RLIM64_INFINITY;
+	else
+		rlim_cur = rl.rlim_cur;
+
+	if (rl.rlim_max == LX_RLIM_INFINITY_N)
+		rlim_max = LX_RLIM64_INFINITY;
+	else
+		rlim_max = rl.rlim_max;
+
+	rv = lx_setrlimit_common(resource, rlim_cur, rlim_max);
+	if (rv != 0)
+		return (set_errno(rv));
+	return (0);
+}
+
+/*
+ * From the man page:
+ * The Linux-specific prlimit() system call combines and extends the
+ * functionality of setrlimit() and getrlimit(). It can be used to both set
+ * and get the resource limits of an arbitrary process.
+ *
+ * If pid is 0, then the call applies to the calling process.
+ */
+long
+lx_prlimit64(pid_t pid, int resource, lx_rlimit64_t *nrlp, lx_rlimit64_t *orlp)
+{
+	int rv;
+	lx_rlimit64_t nrl, orl;
+
+	if (pid != 0) {
+		/* XXX TBD if needed */
+		char buf[80];
+
+		(void) snprintf(buf, sizeof (buf),
+		    "setting prlimit %d for another process\n", resource);
+		lx_unsupported(buf);
+		return (ENOTSUP);
+	}
+
+	if (orlp != NULL) {
+		/* we first get the current limits */
+		rv = lx_getrlimit_common(resource, &orl.rlim_cur,
+		    &orl.rlim_max);
+		if (rv != 0)
+			return (set_errno(rv));
+	}
+
+	if (nrlp != NULL) {
+		if (copyin(nrlp, &nrl, sizeof (nrl)) != 0)
+			return (set_errno(EFAULT));
+
+		if ((nrl.rlim_max != LX_RLIM64_INFINITY &&
+		    nrl.rlim_cur == LX_RLIM64_INFINITY) ||
+		    nrl.rlim_cur > nrl.rlim_max)
+			return (set_errno(EINVAL));
+
+		rv = lx_setrlimit_common(resource, nrl.rlim_cur, nrl.rlim_max);
+		if (rv != 0)
+			return (set_errno(rv));
+	}
+
+	if (orlp != NULL) {
+		/* now return the original limits, if necessary */
+		if (copyout(&orl, orlp, sizeof (orl)) != 0)
+			return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_rw.c b/usr/src/uts/common/brand/lx/syscall/lx_rw.c
new file mode 100644
index 0000000000..34aafcaf5d
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_rw.c
@@ -0,0 +1,956 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/errno.h>
+#include <sys/systm.h>
+#include <sys/file.h>
+#include <sys/vnode.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+#include <sys/nbmlock.h>
+#include <sys/limits.h>
+
+/* uts/common/syscall/rw.c */
+extern size_t copyout_max_cached;
+
+
+/* Common routines */
+
+static int
+lx_iovec_copyin(void *uiovp, int iovcnt, iovec_t *kiovp, ssize_t *count)
+{
+#ifdef _SYSCALL32_IMPL
+	/*
+	 * 32-bit callers need to have their iovec expanded, while ensuring
+	 * that they can't move more than 2Gbytes of data in a single call.
+	 */
+	if (get_udatamodel() == DATAMODEL_ILP32) {
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		int aiov32len = 0;
+		ssize32_t total32 = 0;
+		int i;
+
+		if (iovcnt > IOV_MAX_STACK) {
+			aiov32len = iovcnt * sizeof (iovec32_t);
+			aiov32 = kmem_alloc(aiov32len, KM_SLEEP);
+		}
+
+		if (copyin(uiovp, aiov32, iovcnt * sizeof (iovec32_t))) {
+			if (aiov32len != 0) {
+				kmem_free(aiov32, aiov32len);
+			}
+			return (EFAULT);
+		}
+
+		for (i = 0; i < iovcnt; i++) {
+			ssize32_t iovlen32 = aiov32[i].iov_len;
+			total32 += iovlen32;
+			if (iovlen32 < 0 || total32 < 0) {
+				if (aiov32len != 0) {
+					kmem_free(aiov32, aiov32len);
+				}
+				return (EINVAL);
+			}
+			kiovp[i].iov_len = iovlen32;
+			kiovp[i].iov_base =
+			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
+			/* Linux does a basic sanity test on the address */
+			if ((uintptr_t)kiovp[i].iov_base >= USERLIMIT32) {
+				if (aiov32len != 0) {
+					kmem_free(aiov32, aiov32len);
+				}
+				return (EFAULT);
+			}
+		}
+		*count = total32;
+
+		if (aiov32len != 0)
+			kmem_free(aiov32, aiov32len);
+	} else
+#endif
+	{
+		ssize_t total = 0;
+		int i;
+
+		if (copyin(uiovp, kiovp, iovcnt * sizeof (iovec_t)))
+			return (EFAULT);
+		for (i = 0; i < iovcnt; i++) {
+			ssize_t iovlen = kiovp[i].iov_len;
+			total += iovlen;
+			if (iovlen < 0 || total < 0) {
+				return (EINVAL);
+			}
+			/* Linux does a basic sanity test on the address */
+			if ((uintptr_t)kiovp[i].iov_base >= USERLIMIT) {
+				return (EFAULT);
+			}
+		}
+		*count = total;
+	}
+	return (0);
+}
+
+int
+lx_read_common(file_t *fp, uio_t *uiop, size_t *nread, boolean_t positioned)
+{
+	vnode_t *vp = fp->f_vnode;
+	int error = 0, rwflag = 0, ioflag;
+	ssize_t count = uiop->uio_resid;
+	size_t rcount = 0;
+	struct cpu *cp;
+	boolean_t in_crit = B_FALSE;
+
+	if (fp->f_vnode->v_type == VDIR) {
+		return (EISDIR);
+	}
+	if (positioned &&
+	    (fp->f_vnode->v_type == VFIFO || fp->f_vnode->v_type == VSOCK)) {
+		return (ESPIPE);
+	}
+
+	/*
+	 * We have to enter the critical region before calling VOP_RWLOCK
+	 * to avoid a deadlock with ufs.
+	 */
+	if (nbl_need_check(vp)) {
+		int svmand;
+
+		nbl_start_crit(vp, RW_READER);
+		in_crit = B_TRUE;
+		error = nbl_svmand(vp, fp->f_cred, &svmand);
+		if (error != 0)
+			goto out;
+		if (nbl_conflict(vp, NBL_READ, uiop->uio_offset, count, svmand,
+		    NULL) != 0) {
+			error = EACCES;
+			goto out;
+		}
+	}
+
+	(void) VOP_RWLOCK(vp, rwflag, NULL);
+	/*
+	 * For non-positioned reads, recheck offset/count validity inside
+	 * VOP_WRLOCK to prevent filesize from changing during validation.
+	 */
+	if (!positioned) {
+		u_offset_t uoffset = (u_offset_t)(ulong_t)fp->f_offset;
+
+		if ((vp->v_type == VREG) && (uoffset >= OFFSET_MAX(fp))) {
+			struct vattr va;
+
+			va.va_mask = AT_SIZE;
+			error = VOP_GETATTR(vp, &va, 0, fp->f_cred, NULL);
+			VOP_RWUNLOCK(vp, rwflag, NULL);
+			if (error != 0)
+				goto out;
+			/* We have to return EOF if fileoff is >= file size. */
+			if (uoffset >= va.va_size)
+				goto out;
+			/*
+			 * File is greater than or equal to maxoff and
+			 * therefore we return EOVERFLOW.
+			 */
+			error = EOVERFLOW;
+			goto out;
+		}
+		if ((vp->v_type == VREG) &&
+		    (uoffset + count > OFFSET_MAX(fp))) {
+			count = (ssize_t)(OFFSET_MAX(fp) - uoffset);
+			uiop->uio_resid = count;
+		}
+		uiop->uio_offset = uoffset;
+	}
+	ioflag = uiop->uio_fmode & (FAPPEND|FSYNC|FDSYNC|FRSYNC);
+	/* If read sync is not asked for, filter sync flags */
+	if ((ioflag & FRSYNC) == 0)
+		ioflag &= ~(FSYNC|FDSYNC);
+	error = VOP_READ(vp, uiop, ioflag, fp->f_cred, NULL);
+	rcount = count - uiop->uio_resid;
+	CPU_STATS_ENTER_K();
+	cp = CPU;
+	CPU_STATS_ADDQ(cp, sys, sysread, 1);
+	CPU_STATS_ADDQ(cp, sys, readch, (ulong_t)rcount);
+	CPU_STATS_EXIT_K();
+	ttolwp(curthread)->lwp_ru.ioch += (ulong_t)rcount;
+	/* Store offset for non-positioned reads */
+	if (!positioned) {
+		if (vp->v_type == VFIFO) {
+			/* Backward compatibility */
+			fp->f_offset = rcount;
+		} else if (((fp->f_flag & FAPPEND) == 0) ||
+		    (vp->v_type != VREG) || (count != 0)) {
+			/* POSIX */
+			fp->f_offset = uiop->uio_loffset;
+		}
+	}
+	VOP_RWUNLOCK(vp, rwflag, NULL);
+
+out:
+	if (in_crit)
+		nbl_end_crit(vp);
+	*nread = rcount;
+	return (error);
+}
+
+int
+lx_write_common(file_t *fp, uio_t *uiop, size_t *nwrite, boolean_t positioned)
+{
+	vnode_t *vp = fp->f_vnode;
+	int error = 0, rwflag = 1, ioflag;
+	ssize_t count = uiop->uio_resid;
+	size_t wcount = 0;
+	struct cpu *cp;
+	boolean_t in_crit = B_FALSE;
+
+	if (positioned &&
+	    (fp->f_vnode->v_type == VFIFO || fp->f_vnode->v_type == VSOCK)) {
+		return (ESPIPE);
+	}
+
+	/*
+	 * We have to enter the critical region before calling VOP_RWLOCK
+	 * to avoid a deadlock with ufs.
+	 */
+	if (nbl_need_check(vp)) {
+		int svmand;
+
+		nbl_start_crit(vp, RW_READER);
+		in_crit = B_TRUE;
+		error = nbl_svmand(vp, fp->f_cred, &svmand);
+		if (error != 0)
+			goto out;
+		if (nbl_conflict(vp, NBL_WRITE, uiop->uio_loffset, count,
+		    svmand, NULL) != 0) {
+			error = EACCES;
+			goto out;
+		}
+	}
+
+	(void) VOP_RWLOCK(vp, rwflag, NULL);
+
+	if (!positioned) {
+		/*
+		 * For non-positioned writes, the value of fp->f_offset is
+		 * re-queried while inside VOP_RWLOCK.  This ensures that other
+		 * writes which alter the filesize will be taken into account.
+		 */
+		uiop->uio_loffset = fp->f_offset;
+		ioflag = uiop->uio_fmode & (FAPPEND|FSYNC|FDSYNC|FRSYNC);
+	} else {
+		/*
+		 * In a senseless departure from POSIX, positioned write calls
+		 * on Linux do _not_ ignore the O_APPEND flag.
+		 */
+		ioflag = uiop->uio_fmode & (FAPPEND|FSYNC|FDSYNC|FRSYNC);
+	}
+	if (vp->v_type == VREG) {
+		u_offset_t fileoff = (u_offset_t)(ulong_t)uiop->uio_loffset;
+
+		if (fileoff >= curproc->p_fsz_ctl) {
+			VOP_RWUNLOCK(vp, rwflag, NULL);
+			mutex_enter(&curproc->p_lock);
+			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
+			    curproc->p_rctls, curproc, RCA_UNSAFE_SIGINFO);
+			mutex_exit(&curproc->p_lock);
+			error = EFBIG;
+			goto out;
+		}
+		if (fileoff >= OFFSET_MAX(fp)) {
+			VOP_RWUNLOCK(vp, rwflag, NULL);
+			error = EFBIG;
+			goto out;
+		}
+		if (fileoff + count > OFFSET_MAX(fp)) {
+			count = (ssize_t)(OFFSET_MAX(fp) - fileoff);
+			uiop->uio_resid = count;
+		}
+	}
+
+	error = VOP_WRITE(vp, uiop, ioflag, fp->f_cred, NULL);
+	wcount = count - uiop->uio_resid;
+	CPU_STATS_ENTER_K();
+	cp = CPU;
+	CPU_STATS_ADDQ(cp, sys, syswrite, 1);
+	CPU_STATS_ADDQ(cp, sys, writech, (ulong_t)wcount);
+	CPU_STATS_EXIT_K();
+	ttolwp(curthread)->lwp_ru.ioch += (ulong_t)wcount;
+
+	/* Store offset for non-positioned writes */
+	if (!positioned) {
+		if (vp->v_type == VFIFO) {
+			/* Backward compatibility */
+			fp->f_offset = wcount;
+		} else if (((fp->f_flag & FAPPEND) == 0) ||
+		    (vp->v_type != VREG) || (count != 0)) {
+			/* POSIX */
+			fp->f_offset = uiop->uio_loffset;
+		}
+	}
+	VOP_RWUNLOCK(vp, rwflag, NULL);
+
+out:
+	if (in_crit)
+		nbl_end_crit(vp);
+	*nwrite = wcount;
+	return (error);
+}
+
+/*
+ * The Linux routines for reading and writing data from file descriptors behave
+ * differently from their SunOS counterparts in a few key ways:
+ *
+ * - Passing an iovcnt of 0 to the vectored functions results in an error on
+ *   SunOS, but on Linux it yields return value of 0.
+ *
+ * - If any data is successfully read or written, Linux will return a success.
+ *   This is unlike SunOS which would return an error code for the entire
+ *   operation in cases where vectors had gone unprocessed.
+ *
+ * - Breaking from POSIX, Linux positioned writes (pwrite/pwritev) on Linux
+ *   will obey the O_APPEND flag if it is set on the descriptor.
+ */
+
+ssize_t
+lx_read(int fdes, void *cbuf, size_t ccount)
+{
+	struct uio auio;
+	struct iovec aiov;
+	file_t *fp;
+	ssize_t count = (ssize_t)ccount;
+	size_t nread = 0;
+	int fflag, error = 0;
+
+	if (count < 0)
+		return (set_errno(EINVAL));
+	if ((fp = getf(fdes)) == NULL)
+		return (set_errno(EBADF));
+	if (((fflag = fp->f_flag) & FREAD) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG && count == 0) {
+		goto out;
+	}
+
+	aiov.iov_base = cbuf;
+	aiov.iov_len = count;
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = fp->f_offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = MAXOFFSET_T;
+	auio.uio_fmode = fflag;
+	if (count <= copyout_max_cached)
+		auio.uio_extflg = UIO_COPY_CACHED;
+	else
+		auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	error = lx_read_common(fp, &auio, &nread, B_FALSE);
+
+	if (error == EINTR) {
+		if (nread != 0) {
+			error = 0;
+		} else {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	releasef(fdes);
+	if (error != 0)
+		return (set_errno(error));
+	return ((ssize_t)nread);
+}
+
+ssize_t
+lx_write(int fdes, void *cbuf, size_t ccount)
+{
+	struct uio auio;
+	struct iovec aiov;
+	file_t *fp;
+	ssize_t count = (ssize_t)ccount;
+	size_t nwrite = 0;
+	int fflag, error = 0;
+
+	if (count < 0)
+		return (set_errno(EINVAL));
+	if ((fp = getf(fdes)) == NULL)
+		return (set_errno(EBADF));
+	if (((fflag = fp->f_flag) & FWRITE) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG && count == 0) {
+		goto out;
+	}
+
+	aiov.iov_base = cbuf;
+	aiov.iov_len = count;
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = fp->f_offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = curproc->p_fsz_ctl;
+	auio.uio_fmode = fflag;
+	auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	error = lx_write_common(fp, &auio, &nwrite, B_FALSE);
+
+	if (error == EINTR) {
+		if (nwrite != 0) {
+			error = 0;
+		} else {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	releasef(fdes);
+	if (error != 0)
+		return (set_errno(error));
+	return (nwrite);
+}
+
+ssize_t
+lx_readv(int fdes, struct iovec *iovp, int iovcnt)
+{
+	struct uio auio;
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
+	file_t *fp;
+	ssize_t count;
+	size_t nread = 0;
+	int fflag, error = 0;
+
+	if (iovcnt < 0 || iovcnt > IOV_MAX) {
+		return (set_errno(EINVAL));
+	} else if (iovcnt == 0) {
+		return (0);
+	}
+
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+	if ((error = lx_iovec_copyin(iovp, iovcnt, aiov, &count)) != 0) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(error));
+	}
+
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(EBADF));
+	}
+	if (((fflag = fp->f_flag) & FREAD) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG && count == 0) {
+		goto out;
+	}
+
+	auio.uio_iov = aiov;
+	auio.uio_iovcnt = iovcnt;
+	auio.uio_loffset = fp->f_offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = MAXOFFSET_T;
+	auio.uio_fmode = fflag;
+	if (count <= copyout_max_cached)
+		auio.uio_extflg = UIO_COPY_CACHED;
+	else
+		auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	error = lx_read_common(fp, &auio, &nread, B_FALSE);
+
+	if (error != 0) {
+		if (nread != 0) {
+			error = 0;
+		} else if (error == EINTR) {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (nread);
+}
+
+ssize_t
+lx_writev(int fdes, struct iovec *iovp, int iovcnt)
+{
+	struct uio auio;
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
+	file_t *fp;
+	ssize_t count;
+	size_t nwrite = 0;
+	int fflag, error = 0;
+
+	if (iovcnt < 0 || iovcnt > IOV_MAX) {
+		return (set_errno(EINVAL));
+	} else if (iovcnt == 0) {
+		return (0);
+	}
+
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+	if ((error = lx_iovec_copyin(iovp, iovcnt, aiov, &count)) != 0) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(error));
+	}
+
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(EBADF));
+	}
+	if (((fflag = fp->f_flag) & FWRITE) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG && count == 0) {
+		goto out;
+	}
+
+	auio.uio_iov = aiov;
+	auio.uio_iovcnt = iovcnt;
+	auio.uio_loffset = fp->f_offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = curproc->p_fsz_ctl;
+	auio.uio_fmode = fflag;
+	auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	error = lx_write_common(fp, &auio, &nwrite, B_FALSE);
+
+	if (error != 0) {
+		if (nwrite != 0) {
+			error = 0;
+		} else if (error == EINTR) {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (nwrite);
+}
+
+ssize_t
+lx_pread_fp(file_t *fp, void *cbuf, size_t ccount, off64_t offset)
+{
+	struct uio auio;
+	struct iovec aiov;
+	ssize_t count = (ssize_t)ccount;
+	size_t nread = 0;
+	int fflag, error = 0;
+
+	if (count < 0)
+		return (set_errno(EINVAL));
+	if (((fflag = fp->f_flag) & FREAD) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG) {
+		u_offset_t fileoff = (u_offset_t)offset;
+
+		if (count == 0)
+			goto out;
+		/*
+		 * Return EINVAL if an invalid offset comes to pread.
+		 * Negative offset from user will cause this error.
+		 */
+		if (fileoff > MAXOFFSET_T) {
+			error = EINVAL;
+			goto out;
+		}
+		/*
+		 * Limit offset such that we don't read or write
+		 * a file beyond the maximum offset representable in
+		 * an off_t structure.
+		 */
+		if (fileoff + count > MAXOFFSET_T)
+			count = (ssize_t)((offset_t)MAXOFFSET_T - fileoff);
+	}
+
+	aiov.iov_base = cbuf;
+	aiov.iov_len = count;
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = MAXOFFSET_T;
+	auio.uio_fmode = fflag;
+	auio.uio_extflg = UIO_COPY_CACHED;
+
+	error = lx_read_common(fp, &auio, &nread, B_TRUE);
+
+	if (error == EINTR) {
+		if (nread != 0) {
+			error = 0;
+		} else {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	if (error) {
+		return (set_errno(error));
+	}
+	return ((ssize_t)nread);
+
+}
+
+ssize_t
+lx_pread(int fdes, void *cbuf, size_t ccount, off64_t offset)
+{
+	file_t *fp;
+	size_t nread;
+
+	if ((fp = getf(fdes)) == NULL)
+		return (set_errno(EBADF));
+
+	nread = lx_pread_fp(fp, cbuf, ccount, offset);
+	releasef(fdes);
+	return (nread);
+}
+
+ssize_t
+lx_pwrite_fp(file_t *fp, void *cbuf, size_t ccount, off64_t offset)
+{
+	struct uio auio;
+	struct iovec aiov;
+	ssize_t count = (ssize_t)ccount;
+	size_t nwrite = 0;
+	int fflag, error = 0;
+
+	if (count < 0)
+		return (set_errno(EINVAL));
+	if (((fflag = fp->f_flag) & (FWRITE)) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG) {
+		u_offset_t fileoff = (u_offset_t)offset;
+
+		if (count == 0)
+			goto out;
+		/*
+		 * return EINVAL for offsets that cannot be
+		 * represented in an off_t.
+		 */
+		if (fileoff > MAXOFFSET_T) {
+			error = EINVAL;
+			goto out;
+		}
+		/*
+		 * Take appropriate action if we are trying to write above the
+		 * resource limit.
+		 */
+		if (fileoff >= curproc->p_fsz_ctl) {
+			mutex_enter(&curproc->p_lock);
+			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
+			    curproc->p_rctls, curproc, RCA_UNSAFE_SIGINFO);
+			mutex_exit(&curproc->p_lock);
+
+			error = EFBIG;
+			goto out;
+		}
+		/*
+		 * Don't allow pwrite to cause file sizes to exceed maxoffset.
+		 */
+		if (fileoff == MAXOFFSET_T) {
+			error = EFBIG;
+			goto out;
+		}
+		if (fileoff + count > MAXOFFSET_T)
+			count = (ssize_t)((u_offset_t)MAXOFFSET_T - fileoff);
+	}
+
+	aiov.iov_base = cbuf;
+	aiov.iov_len = count;
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = curproc->p_fsz_ctl;
+	auio.uio_fmode = fflag;
+	auio.uio_extflg = UIO_COPY_CACHED;
+
+	error = lx_write_common(fp, &auio, &nwrite, B_TRUE);
+
+	if (error == EINTR) {
+		if (nwrite != 0) {
+			error = 0;
+		} else {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	if (error) {
+		return (set_errno(error));
+	}
+	return (nwrite);
+}
+
+ssize_t
+lx_pwrite(int fdes, void *cbuf, size_t ccount, off64_t offset)
+{
+	file_t *fp;
+	size_t nwrite;
+
+	if ((fp = getf(fdes)) == NULL)
+		return (set_errno(EBADF));
+
+	nwrite = lx_pwrite_fp(fp, cbuf, ccount, offset);
+	releasef(fdes);
+	return (nwrite);
+}
+
+ssize_t
+lx_pread32(int fdes, void *cbuf, size_t ccount, uint32_t off_lo,
+    uint32_t off_hi)
+{
+	return (lx_pread(fdes, cbuf, ccount, LX_32TO64(off_lo, off_hi)));
+}
+
+ssize_t
+lx_pwrite32(int fdes, void *cbuf, size_t ccount, uint32_t off_lo,
+    uint32_t off_hi)
+{
+	return (lx_pwrite(fdes, cbuf, ccount, LX_32TO64(off_lo, off_hi)));
+}
+
+ssize_t
+lx_preadv(int fdes, void *iovp, int iovcnt, off64_t offset)
+{
+	struct uio auio;
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
+	file_t *fp;
+	ssize_t count;
+	size_t nread = 0;
+	int fflag, error = 0;
+
+	if (iovcnt < 0 || iovcnt > IOV_MAX) {
+		return (set_errno(EINVAL));
+	} else if (iovcnt == 0) {
+		return (0);
+	}
+
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+	if ((error = lx_iovec_copyin(iovp, iovcnt, aiov, &count)) != 0) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(error));
+	}
+
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(EBADF));
+	}
+	if (((fflag = fp->f_flag) & FREAD) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG) {
+		u_offset_t fileoff = (u_offset_t)offset;
+
+		if (count == 0)
+			goto out;
+		/*
+		 * Return EINVAL if an invalid offset comes to pread.
+		 * Negative offset from user will cause this error.
+		 */
+		if (fileoff > MAXOFFSET_T) {
+			error = EINVAL;
+			goto out;
+		}
+		/*
+		 * Limit offset such that we don't read or write a file beyond
+		 * the maximum offset representable in an off_t structure.
+		 */
+		if (fileoff + count > MAXOFFSET_T)
+			count = (ssize_t)((offset_t)MAXOFFSET_T - fileoff);
+	}
+
+	auio.uio_iov = aiov;
+	auio.uio_iovcnt = iovcnt;
+	auio.uio_loffset = offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = MAXOFFSET_T;
+	auio.uio_fmode = fflag;
+	if (count <= copyout_max_cached)
+		auio.uio_extflg = UIO_COPY_CACHED;
+	else
+		auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	error = lx_read_common(fp, &auio, &nread, B_TRUE);
+
+	if (error != 0) {
+		if (nread != 0) {
+			error = 0;
+		} else if (error == EINTR) {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (nread);
+}
+
+ssize_t
+lx_pwritev(int fdes, void *iovp, int iovcnt, off64_t offset)
+{
+	struct uio auio;
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
+	file_t *fp;
+	ssize_t count;
+	size_t nwrite = 0;
+	int fflag, error = 0;
+
+	if (iovcnt < 0 || iovcnt > IOV_MAX) {
+		return (set_errno(EINVAL));
+	} else if (iovcnt == 0) {
+		return (0);
+	}
+
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+	if ((error = lx_iovec_copyin(iovp, iovcnt, aiov, &count)) != 0) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(error));
+	}
+
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
+		return (set_errno(EBADF));
+	}
+	if (((fflag = fp->f_flag) & FWRITE) == 0) {
+		error = EBADF;
+		goto out;
+	}
+	if (fp->f_vnode->v_type == VREG) {
+		u_offset_t fileoff = (u_offset_t)offset;
+
+		if (count == 0)
+			goto out;
+		/*
+		 * Return EINVAL if an invalid offset comes to pread.
+		 * Negative offset from user will cause this error.
+		 */
+		if (fileoff > MAXOFFSET_T) {
+			error = EINVAL;
+			goto out;
+		}
+		/*
+		 * Take appropriate action if we are trying to write above the
+		 * resource limit.
+		 */
+		if (fileoff >= curproc->p_fsz_ctl) {
+			mutex_enter(&curproc->p_lock);
+			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
+			    curproc->p_rctls, curproc, RCA_UNSAFE_SIGINFO);
+			mutex_exit(&curproc->p_lock);
+
+			error = EFBIG;
+			goto out;
+		}
+		/*
+		 * Don't allow pwritev to cause file sizes to exceed maxoffset.
+		 */
+		if (fileoff == MAXOFFSET_T) {
+			error = EFBIG;
+			goto out;
+		}
+		/*
+		 * Limit offset such that we don't read or write a file beyond
+		 * the maximum offset representable in an off_t structure.
+		 */
+		if (fileoff + count > MAXOFFSET_T)
+			count = (ssize_t)((u_offset_t)MAXOFFSET_T - fileoff);
+	}
+
+	auio.uio_iov = aiov;
+	auio.uio_iovcnt = iovcnt;
+	auio.uio_loffset = offset;
+	auio.uio_resid = count;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_llimit = curproc->p_fsz_ctl;
+	auio.uio_fmode = fflag;
+	auio.uio_extflg = UIO_COPY_DEFAULT;
+
+	error = lx_write_common(fp, &auio, &nwrite, B_TRUE);
+
+	if (error != 0) {
+		if (nwrite != 0) {
+			error = 0;
+		} else if (error == EINTR) {
+			ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+		}
+	}
+out:
+	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (nwrite);
+}
+
+ssize_t
+lx_preadv32(int fdes, void *iovp, int iovcnt, uint32_t off_lo, uint32_t off_hi)
+{
+	return (lx_preadv(fdes, iovp, iovcnt, LX_32TO64(off_lo, off_hi)));
+}
+
+ssize_t
+lx_pwritev32(int fdes, void *iovp, int iovcnt, uint32_t off_lo,
+    uint32_t off_hi)
+{
+	return (lx_pwritev(fdes, iovp, iovcnt, LX_32TO64(off_lo, off_hi)));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_sched.c b/usr/src/uts/common/brand/lx/syscall/lx_sched.c
new file mode 100644
index 0000000000..6d4904a5fe
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_sched.c
@@ -0,0 +1,1161 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Emulation for scheduling related syscalls.
+ *
+ * Under a typical zone configuration the zones will always be running under
+ * FSS so that no single zone can monopolize the system. Zones do not have the
+ * privilege to leave FSS (for the obvious reason that this would violate the
+ * global zone resource management policies). Thus, for the sched_* syscalls
+ * we typically will never be able to emulate those using our other native
+ * scheduling classes. Under this common case we simply track the scheduler
+ * settings on the lwp's lx brand structure and we also try to adjust the
+ * lwp priority within the valid range to approximate the intended effect.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/proc.h>
+#include <sys/cpu.h>
+#include <sys/rtpriocntl.h>
+#include <sys/tspriocntl.h>
+#include <sys/processor.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/sysmacros.h>
+#include <sys/policy.h>
+#include <sys/procset.h>
+#include <sys/priocntl.h>
+
+typedef int l_pid_t;
+
+extern int yield();
+extern long priocntl_common(int, procset_t *, int, caddr_t, caddr_t, uio_seg_t);
+
+static int lx_sched_setprocset(procset_t *, l_pid_t);
+static long lx_do_priocntlsys(int, procset_t *, void *);
+
+#define	BITS_PER_BYTE	8
+
+/*
+ * Linux scheduler policies.
+ */
+#define	LX_SCHED_OTHER		0
+#define	LX_SCHED_FIFO		1
+#define	LX_SCHED_RR		2
+#define	LX_SCHED_BATCH		3
+#define	LX_SCHED_IDLE		5
+#define	LX_SCHED_DEADLINE	6
+
+/*
+ * Linux scheduler priority ranges.
+ */
+#define	LX_SCHED_PRIORITY_MIN_OTHER	0
+#define	LX_SCHED_PRIORITY_MAX_OTHER	0
+#define	LX_SCHED_PRIORITY_MIN_RRFIFO	1
+#define	LX_SCHED_PRIORITY_MAX_RRFIFO	99
+
+#define	MAXPRI	60	/* See FSS_MAXUPRI */
+
+/*
+ * When emulating scheduling priorities (e.g. under FSS) we'll do the best we
+ * can by adjusting the thread's priority within our range.
+ */
+static int lx_emul_pri_map[] = {
+	0,		/* LX_SCHED_OTHER */
+	MAXPRI,		/* LX_SCHED_FIFO */
+	MAXPRI - 1,	/* LX_SCHED_RR */
+	-MAXPRI + 1,	/* LX_SCHED_BATCH */
+	0,		/* UNUSED */
+	-MAXPRI,	/* LX_SCHED_IDLE */
+	MAXPRI		/* LX_SCHED_DEADLINE */
+};
+
+/*
+ * Determine if we should emulate the sched_* syscalls. A zone is almost always
+ * going to be running under FSS in any kind of production configuration, and
+ * FSS is currently the only class which zone processes won't have the privilege
+ * to leave. Instead of checking for FSS explicitly, we generalize our check
+ * using CL_CANEXIT.
+ */
+#define	EMUL_SCHED()	(CL_CANEXIT(curthread, CRED()) != 0)
+
+struct lx_sched_param {
+	int	lx_sched_prio;
+};
+
+typedef struct lx_sched_attr {
+	uint32_t lx_size;
+
+	uint32_t lx_sched_policy;
+	uint64_t lx_sched_flags;
+
+	/* For LX_SCHED_OTHER or LX_SCHED_BATCH */
+	int lx_sched_nice;
+
+	/* For LX_SCHED_FIFO or LX_SCHED_RR */
+	uint32_t lx_sched_priority;
+
+	/* For LX_SCHED_DEADLINE */
+	uint64_t lx_sched_runtime;
+	uint64_t lx_sched_deadline;
+	uint64_t lx_sched_period;
+} lx_sched_attr_t;
+
+long
+lx_sched_yield(void)
+{
+	yield();
+
+	return (0);
+}
+
+static void
+ltos_cpuset(lx_affmask_t *lmask, cpuset_t *smask)
+{
+	/* NOTE: fix this code if NCPU is ever made > LX_NCPU */
+
+	cpuset_zero(smask);
+	for (int i = 0; i < NCPU; i++) {
+		if (BT_TEST(*lmask, i)) {
+			cpuset_add(smask, i);
+		}
+	}
+}
+
+static void
+stol_cpuset(cpuset_t *smask, lx_affmask_t *lmask)
+{
+	/* NOTE: fix this code if NCPU is ever made > LX_NCPU */
+
+	bzero(lmask, sizeof (*lmask));
+	for (int i = 0; i < NCPU; i++) {
+		if (cpu_in_set(smask, i)) {
+			BT_SET(*lmask, i);
+		}
+	}
+}
+
+/*
+ * Find and lock a process for lx_sched_* operations.
+ * Sets 'pp' and 'tp' on success, with P_PR_LOCK set and p_lock held.
+ * The target process must be branded.
+ */
+static int
+lx_sched_pidlock(l_pid_t pid, proc_t **pp, kthread_t **tp, boolean_t is_write)
+{
+	proc_t		*p;
+	kthread_t	*t = NULL;
+	int		err = 0;
+
+	if (pid < 0) {
+		return (EINVAL);
+	}
+	if (pid == 0) {
+		p = curproc;
+		ASSERT(PROC_IS_BRANDED(p));
+		mutex_enter(&p->p_lock);
+		sprlock_proc(p);
+
+		*tp = curthread;
+		*pp = p;
+		return (0);
+	}
+
+	if (lx_lpid_lock((pid_t)pid, curzone, LXP_PRLOCK, &p, &t) != 0) {
+		return (ESRCH);
+	}
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	if (!(PROC_IS_BRANDED(p))) {
+		sprunlock(p);
+		return (EPERM);
+	}
+
+	if (is_write) {
+		cred_t *cr = CRED();
+
+		/*
+		 * To perform a sched_* operation on a thread outside of the
+		 * current process, either the euid/egid of the target must
+		 * match, or the calling process must hold CAP_SYS_NICE.
+		 * (PRIV_PROC_PRIOUP maps to CAP_SYS_NICE)
+		 */
+		err = 0;
+		if (secpolicy_raisepriority(cr) != 0) {
+			err = 0;
+			mutex_exit(&p->p_lock);
+			mutex_enter(&p->p_crlock);
+			if (crgetuid(cr) != crgetuid(p->p_cred) ||
+			    crgetgid(cr) != crgetgid(p->p_cred)) {
+				err = EPERM;
+			}
+			mutex_exit(&p->p_crlock);
+			mutex_enter(&p->p_lock);
+			if (err != 0) {
+				sprunlock(p);
+				return (err);
+			}
+		}
+	}
+	*pp = p;
+	*tp = t;
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	return (0);
+}
+
+long
+lx_sched_getaffinity(l_pid_t pid, unsigned int len, void *maskp)
+{
+	proc_t		*p;
+	kthread_t	*tp = NULL;
+	lx_lwp_data_t	*lwpd;
+	int		err;
+	unsigned int	pmin, pmax, compare_size;
+	lx_affmask_t	lmask;
+	cpuset_t	*smask;
+
+	/*
+	 * The length boundary requirement is to match Linux's behavior.
+	 */
+	switch (get_udatamodel()) {
+	case DATAMODEL_ILP32:
+		compare_size = sizeof (uint32_t);
+		break;
+	default:
+		compare_size = sizeof (ulong_t);
+		break;
+	}
+	if ((len & (compare_size - 1)) != 0) {
+		return (set_errno(EINVAL));
+	}
+
+	smask = cpuset_alloc(KM_SLEEP);
+	if ((err = lx_sched_pidlock(pid, &p, &tp, B_FALSE)) != 0) {
+		cpuset_free(smask);
+		return (set_errno(err));
+	}
+
+	mutex_exit(&p->p_lock);
+	mutex_enter(&cpu_lock);
+	mutex_enter(&p->p_lock);
+	/*
+	 * Grab the existing affinity mask and constrain it by the current set
+	 * of active CPUs (which may have changed since it was assigned.
+	 */
+	lwpd = ttolxlwp(tp);
+	cpuset_or(smask, lwpd->br_affinitymask);
+	cpuset_and(smask, &cpu_active_set);
+	sprunlock(p);
+	mutex_exit(&cpu_lock);
+
+	cpuset_bounds(smask, &pmin, &pmax);
+	stol_cpuset(smask, &lmask);
+	cpuset_free(smask);
+
+	/*
+	 * It is out of convenience that this check is performed so late.  If
+	 * the need arises, it could be altered to be done earlier in order to
+	 * match Linux error ordering.
+	 */
+	if (pmax >= (len * BITS_PER_BYTE)) {
+		return (set_errno(EINVAL));
+	}
+
+	len = MIN(len, sizeof (lx_affmask_t));
+	if (copyout(&lmask, maskp, len) != 0) {
+		return (set_errno(EFAULT));
+	}
+	return (len);
+}
+
+long
+lx_sched_setaffinity(l_pid_t pid, unsigned int len, void *maskp)
+{
+	proc_t		*p;
+	kthread_t	*tp = NULL;
+	lx_lwp_data_t	*lwpd;
+	int		err;
+	unsigned int	pmin, pmax;
+	lx_affmask_t	lmask;
+	cpuset_t	*smask;
+
+	if (pid < 0) {
+		return (set_errno(EINVAL));
+	}
+
+	if (len < sizeof (lmask)) {
+		bzero(&lmask, sizeof (lmask));
+	} else if (len > sizeof (lmask)) {
+		len = sizeof (lmask);
+	}
+	if (copyin(maskp, &lmask, len) != 0) {
+		return (set_errno(EFAULT));
+	}
+	smask = cpuset_alloc(KM_SLEEP);
+	ltos_cpuset(&lmask, smask);
+	if ((err = lx_sched_pidlock(pid, &p, &tp, B_TRUE)) != 0) {
+		cpuset_free(smask);
+		return (set_errno(err));
+	}
+
+	/*
+	 * Constrain the mask to currently active CPUs.
+	 */
+	mutex_exit(&p->p_lock);
+	mutex_enter(&cpu_lock);
+	mutex_enter(&p->p_lock);
+	lwpd = ttolxlwp(tp);
+
+	cpuset_and(smask, &cpu_active_set);
+	if (cpuset_isnull(smask)) {
+		err = EINVAL;
+		goto out;
+	}
+	if (cpuset_isequal(lwpd->br_affinitymask, smask)) {
+		err = 0;
+		goto out;
+	}
+
+	/*
+	 * If one (and only one) CPU is selected in the affinity mask, bind the
+	 * thread to that CPU.
+	 */
+	cpuset_bounds(smask, &pmin, &pmax);
+	VERIFY(pmin != CPUSET_NOTINSET);
+	if (pmin == pmax) {
+		processorid_t obind;
+
+		(void) cpu_bind_thread(tp, pmin, &obind, &err);
+		if (err != 0) {
+			goto out;
+		}
+	} else {
+		/*
+		 * If the thread transitions away from a single-CPU mask, it
+		 * should be unbound from that processor.
+		 */
+		cpuset_bounds(lwpd->br_affinitymask, &pmin, &pmax);
+		if (pmin == pmax) {
+			processorid_t obind;
+			(void) cpu_bind_thread(tp, PBIND_NONE, &obind, &err);
+		}
+	}
+	cpuset_zero(lwpd->br_affinitymask);
+	cpuset_or(lwpd->br_affinitymask, smask);
+	err = 0;
+
+out:
+	mutex_exit(&cpu_lock);
+	sprunlock(p);
+	cpuset_free(smask);
+	if (err != 0) {
+		return (set_errno(err));
+	}
+	return (0);
+}
+
+void
+lx_affinity_forklwp(klwp_t *srclwp, klwp_t *dstlwp)
+{
+	proc_t *pp = lwptoproc(srclwp);
+	lx_lwp_data_t *slwpd = lwptolxlwp(srclwp);
+	lx_lwp_data_t *dlwpd = lwptolxlwp(dstlwp);
+
+	/*
+	 * Copy over the affinity mask.  This could be enhanced in the future
+	 * to perform single-CPU binding like sched_setaffinity.
+	 */
+	mutex_enter(&pp->p_lock);
+	cpuset_zero(dlwpd->br_affinitymask);
+	cpuset_or(dlwpd->br_affinitymask, slwpd->br_affinitymask);
+	mutex_exit(&pp->p_lock);
+}
+
+long
+lx_sched_setscheduler(l_pid_t pid, int policy, struct lx_sched_param *param)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	procset_t procset;
+	procset_t procset_cid;
+	pcparms_t pcparm;
+	pcinfo_t pcinfo;
+	struct lx_sched_param sched_param;
+	tsparms_t *tsp;
+	int prio, maxupri;
+	int rv;
+
+	if (pid < 0 || param == NULL)
+		return (set_errno(EINVAL));
+
+	if (copyin(param, &sched_param, sizeof (sched_param)))
+		return (set_errno(EFAULT));
+
+	prio = sched_param.lx_sched_prio;
+
+	if (EMUL_SCHED()) {
+		proc_t		*p;
+		kthread_t	*tp = NULL;
+		int		incr;
+		lx_lwp_data_t	*lwpd;
+
+		switch (policy) {
+		case LX_SCHED_OTHER:
+		case LX_SCHED_BATCH:
+		case LX_SCHED_IDLE:
+		case LX_SCHED_DEADLINE:
+			if (prio != LX_SCHED_PRIORITY_MIN_OTHER)
+				return (set_errno(EINVAL));
+			break;
+		case LX_SCHED_FIFO:
+		case LX_SCHED_RR:
+			if (crgetuid(CRED()) != 0)
+				return (set_errno(EPERM));
+			if (prio < LX_SCHED_PRIORITY_MIN_RRFIFO ||
+			    prio > LX_SCHED_PRIORITY_MAX_RRFIFO)
+				return (set_errno(EINVAL));
+			break;
+		default:
+			return (set_errno(EINVAL));
+		}
+
+		/* Find and operate on the target lwp. */
+		if ((rv = lx_sched_pidlock(pid, &p, &tp, B_TRUE)) != 0)
+			return (set_errno(rv));
+
+		lwpd = lwptolxlwp(ttolwp(tp));
+		if (lwpd->br_schd_class == LX_SCHED_IDLE &&
+		    policy != LX_SCHED_IDLE && crgetuid(CRED()) != 0) {
+
+			sprunlock(p);
+			return (set_errno(EPERM));
+		}
+
+		lwpd->br_schd_class = policy;
+		lwpd->br_schd_pri = prio;
+
+		ASSERT(policy <= LX_SCHED_DEADLINE);
+		incr = lx_emul_pri_map[policy];
+
+		CL_DOPRIO(tp, CRED(), incr, &rv);
+
+		sprunlock(p);
+		return (0);
+	}
+
+	if ((rv = lx_sched_setprocset(&procset, pid)))
+		return (rv);
+
+	/* get the class id */
+	pcparm.pc_cid = PC_CLNULL;
+	(void) lx_do_priocntlsys(PC_GETPARMS, &procset, &pcparm);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	/* get the current policy */
+	bzero(&pcinfo, sizeof (pcinfo));
+	pcinfo.pc_cid = pcparm.pc_cid;
+	(void) lx_do_priocntlsys(PC_GETCLINFO, &procset, &pcinfo);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	if (policy < 0) {
+		if (strcmp(pcinfo.pc_clname, "TS") == 0) {
+			policy = LX_SCHED_OTHER;
+		} else if (strcmp(pcinfo.pc_clname, "RT") == 0) {
+			policy = ((rtparms_t *)pcparm.pc_clparms)->rt_tqnsecs ==
+			    RT_TQINF ? LX_SCHED_FIFO : LX_SCHED_RR;
+		} else {
+			return (set_errno(EINVAL));
+		}
+	}
+
+	bzero(&pcinfo, sizeof (pcinfo));
+	bzero(&pcparm, sizeof (pcparm));
+	setprocset(&procset_cid, POP_AND, P_PID, 0, P_ALL, 0);
+	switch (policy) {
+	case LX_SCHED_FIFO:
+	case LX_SCHED_RR:
+		(void) strcpy(pcinfo.pc_clname, "RT");
+		(void) lx_do_priocntlsys(PC_GETCID, &procset_cid, &pcinfo);
+		if (lwp->lwp_errno)
+			return (lwp->lwp_errno);
+
+		if (prio < 0 ||
+		    prio > ((rtinfo_t *)pcinfo.pc_clinfo)->rt_maxpri)
+			return (set_errno(EINVAL));
+		pcparm.pc_cid = pcinfo.pc_cid;
+		((rtparms_t *)pcparm.pc_clparms)->rt_pri = prio;
+		((rtparms_t *)pcparm.pc_clparms)->rt_tqnsecs =
+		    policy == LX_SCHED_RR ? RT_TQDEF : RT_TQINF;
+		break;
+
+	case LX_SCHED_OTHER:
+		(void) strcpy(pcinfo.pc_clname, "TS");
+		(void) lx_do_priocntlsys(PC_GETCID, &procset_cid, &pcinfo);
+		if (lwp->lwp_errno)
+			return (lwp->lwp_errno);
+
+		maxupri = ((tsinfo_t *)pcinfo.pc_clinfo)->ts_maxupri;
+		if (prio > maxupri || prio < -maxupri)
+			return (set_errno(EINVAL));
+
+		pcparm.pc_cid = pcinfo.pc_cid;
+		tsp = (tsparms_t *)pcparm.pc_clparms;
+		tsp->ts_upri = prio;
+		tsp->ts_uprilim = TS_NOCHANGE;
+		break;
+
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * finally set scheduling policy and parameters
+	 */
+	(void) lx_do_priocntlsys(PC_SETPARMS, &procset, &pcparm);
+
+	return (0);
+}
+
+long
+lx_sched_getscheduler(l_pid_t pid)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	procset_t procset;
+	pcparms_t pcparm;
+	pcinfo_t pcinfo;
+	int policy;
+	int rv;
+
+	if (pid < 0)
+		return (set_errno(EINVAL));
+
+	if (EMUL_SCHED()) {
+		proc_t		*p;
+		kthread_t	*tp = NULL;
+
+		/* Find and operate on the target lwp. */
+		if ((rv = lx_sched_pidlock(pid, &p, &tp, B_FALSE)) != 0)
+			return (set_errno(rv));
+
+		policy = lwptolxlwp(ttolwp(tp))->br_schd_class;
+		sprunlock(p);
+
+		return (policy);
+	}
+
+	if ((rv = lx_sched_setprocset(&procset, pid)))
+		return (rv);
+
+	/*
+	 * get the class id
+	 */
+	pcparm.pc_cid = PC_CLNULL;
+	(void) lx_do_priocntlsys(PC_GETPARMS, &procset, &pcparm);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	/*
+	 * get the class info and identify the equivalent linux policy
+	 */
+	bzero(&pcinfo, sizeof (pcinfo));
+	pcinfo.pc_cid = pcparm.pc_cid;
+	(void) lx_do_priocntlsys(PC_GETCLINFO, &procset, &pcinfo);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	if (strcmp(pcinfo.pc_clname, "TS") == 0) {
+		policy = LX_SCHED_OTHER;
+	} else if (strcmp(pcinfo.pc_clname, "RT") == 0) {
+		policy = ((rtparms_t *)pcparm.pc_clparms)->rt_tqnsecs ==
+		    RT_TQINF ? LX_SCHED_FIFO : LX_SCHED_RR;
+	} else {
+		policy = set_errno(EINVAL);
+	}
+
+	return (policy);
+}
+
+long
+lx_sched_setparam(l_pid_t pid, struct lx_sched_param *param)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	procset_t procset;
+	procset_t procset_cid;
+	pcparms_t pcparm;
+	pcinfo_t pcinfo;
+	struct lx_sched_param sched_param;
+	tsparms_t *tsp;
+	int policy;
+	int prio, maxupri;
+	int rv;
+
+	if (pid < 0 || param == NULL)
+		return (set_errno(EINVAL));
+
+	if (copyin(param, &sched_param, sizeof (sched_param)))
+		return (set_errno(EFAULT));
+
+	prio = sched_param.lx_sched_prio;
+
+	if (EMUL_SCHED()) {
+		proc_t		*p;
+		kthread_t	*tp = NULL;
+		int		incr;
+
+		/* Find and operate on the target lwp. */
+		if ((rv = lx_sched_pidlock(pid, &p, &tp, B_TRUE)) != 0)
+			return (set_errno(rv));
+
+		policy = lwptolxlwp(ttolwp(tp))->br_schd_class;
+		switch (policy) {
+		case LX_SCHED_OTHER:
+		case LX_SCHED_BATCH:
+		case LX_SCHED_IDLE:
+		case LX_SCHED_DEADLINE:
+			if (prio != LX_SCHED_PRIORITY_MIN_OTHER) {
+				sprunlock(p);
+				return (set_errno(EINVAL));
+			}
+			break;
+		case LX_SCHED_FIFO:
+		case LX_SCHED_RR:
+			if (crgetuid(CRED()) != 0) {
+				sprunlock(p);
+				return (set_errno(EPERM));
+			}
+			if (prio < LX_SCHED_PRIORITY_MIN_RRFIFO ||
+			    prio > LX_SCHED_PRIORITY_MAX_RRFIFO) {
+				sprunlock(p);
+				return (set_errno(EINVAL));
+			}
+			break;
+		default:
+			/* this shouldn't happen */
+			ASSERT(0);
+			sprunlock(p);
+			return (set_errno(EINVAL));
+		}
+
+		lwptolxlwp(ttolwp(tp))->br_schd_pri = prio;
+
+		ASSERT(policy <= LX_SCHED_DEADLINE);
+		incr = lx_emul_pri_map[policy];
+
+		CL_DOPRIO(tp, CRED(), incr, &rv);
+		sprunlock(p);
+		return (0);
+	}
+
+	if ((rv = lx_sched_setprocset(&procset, pid)))
+		return (rv);
+
+	/*
+	 * get the class id
+	 */
+	pcparm.pc_cid = PC_CLNULL;
+	(void) lx_do_priocntlsys(PC_GETPARMS, &procset, &pcparm);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	/*
+	 * get the current policy
+	 */
+	bzero(&pcinfo, sizeof (pcinfo));
+	pcinfo.pc_cid = pcparm.pc_cid;
+	(void) lx_do_priocntlsys(PC_GETCLINFO, &procset, &pcinfo);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	if (strcmp(pcinfo.pc_clname, "TS") == 0)
+		policy = LX_SCHED_OTHER;
+	else if (strcmp(pcinfo.pc_clname, "RT") == 0)
+		policy = ((rtparms_t *)pcparm.pc_clparms)->rt_tqnsecs ==
+		    RT_TQINF ? LX_SCHED_FIFO : LX_SCHED_RR;
+	else
+		return (set_errno(EINVAL));
+
+	bzero(&pcinfo, sizeof (pcinfo));
+	bzero(&pcparm, sizeof (pcparm));
+	setprocset(&procset_cid, POP_AND, P_PID, 0, P_ALL, 0);
+	switch (policy) {
+	case LX_SCHED_FIFO:
+	case LX_SCHED_RR:
+		(void) strcpy(pcinfo.pc_clname, "RT");
+		(void) lx_do_priocntlsys(PC_GETCID, &procset_cid, &pcinfo);
+		if (lwp->lwp_errno)
+			return (lwp->lwp_errno);
+
+		if (prio < 0 ||
+		    prio > ((rtinfo_t *)pcinfo.pc_clinfo)->rt_maxpri)
+			return (set_errno(EINVAL));
+		pcparm.pc_cid = pcinfo.pc_cid;
+		((rtparms_t *)pcparm.pc_clparms)->rt_pri = prio;
+		((rtparms_t *)pcparm.pc_clparms)->rt_tqnsecs =
+		    policy == LX_SCHED_RR ? RT_TQDEF : RT_TQINF;
+		break;
+
+	case LX_SCHED_OTHER:
+		(void) strcpy(pcinfo.pc_clname, "TS");
+		(void) lx_do_priocntlsys(PC_GETCID, &procset_cid, &pcinfo);
+		if (lwp->lwp_errno)
+			return (lwp->lwp_errno);
+
+		maxupri = ((tsinfo_t *)pcinfo.pc_clinfo)->ts_maxupri;
+		if (prio > maxupri || prio < -maxupri)
+			return (set_errno(EINVAL));
+
+		pcparm.pc_cid = pcinfo.pc_cid;
+		tsp = (tsparms_t *)pcparm.pc_clparms;
+		tsp->ts_upri = prio;
+		tsp->ts_uprilim = TS_NOCHANGE;
+		break;
+
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * finally set scheduling policy and parameters
+	 */
+	(void) lx_do_priocntlsys(PC_SETPARMS, &procset, &pcparm);
+
+	return (0);
+}
+
+long
+lx_sched_getparam(l_pid_t pid, struct lx_sched_param *param)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	struct lx_sched_param local_param;
+	procset_t procset;
+	pcparms_t pcparm;
+	pcinfo_t pcinfo;
+	tsinfo_t *tsi;
+	int prio, scale;
+	int rv;
+
+	if (pid < 0 || param == NULL)
+		return (set_errno(EINVAL));
+
+	if (EMUL_SCHED()) {
+		proc_t		*p;
+		kthread_t	*tp = NULL;
+
+		/* Find and operate on the target lwp. */
+		if ((rv = lx_sched_pidlock(pid, &p, &tp, B_FALSE)) != 0)
+			return (set_errno(rv));
+
+		local_param.lx_sched_prio = lwptolxlwp(ttolwp(tp))->br_schd_pri;
+		sprunlock(p);
+		if (copyout(&local_param, param, sizeof (local_param)))
+			return (set_errno(EFAULT));
+
+		return (0);
+	}
+
+	if ((rv = lx_sched_setprocset(&procset, pid)))
+		return (rv);
+
+	/*
+	 * get the class id
+	 */
+	pcparm.pc_cid = PC_CLNULL;
+	(void) lx_do_priocntlsys(PC_GETPARMS, &procset, &pcparm);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	/*
+	 * get the class info and identify the equivalent linux policy
+	 */
+	bzero(&pcinfo, sizeof (pcinfo));
+	pcinfo.pc_cid = pcparm.pc_cid;
+	(void) lx_do_priocntlsys(PC_GETCLINFO, &procset, &pcinfo);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	bzero(&local_param, sizeof (local_param));
+	if (strcmp(pcinfo.pc_clname, "TS") == 0) {
+		/*
+		 * I don't know if we need to do this, coz it can't be
+		 * changed from zero anyway.....
+		 */
+		tsi = (tsinfo_t *)pcinfo.pc_clinfo;
+		prio = ((tsparms_t *)pcparm.pc_clparms)->ts_upri;
+		scale = tsi->ts_maxupri;
+		if (scale == 0)
+			local_param.lx_sched_prio = 0;
+		else
+			local_param.lx_sched_prio = -(prio * 20) / scale;
+	} else if (strcmp(pcinfo.pc_clname, "RT") == 0) {
+		local_param.lx_sched_prio =
+		    ((rtparms_t *)pcparm.pc_clparms)->rt_pri;
+	} else {
+		rv = set_errno(EINVAL);
+	}
+
+	if (rv == 0)
+		if (copyout(&local_param, param, sizeof (local_param)))
+			return (set_errno(EFAULT));
+
+	return (rv);
+}
+
+long
+lx_sched_rr_get_interval(l_pid_t pid, struct timespec *ival)
+{
+	klwp_t *lwp = ttolwp(curthread);
+	struct timespec interval;
+	procset_t procset;
+	pcparms_t pcparm;
+	pcinfo_t pcinfo;
+	int rv;
+
+	if (pid < 0)
+		return (set_errno(EINVAL));
+
+	if (EMUL_SCHED()) {
+		int		policy;
+		proc_t		*p;
+		kthread_t	*tp = NULL;
+
+		/* Find and operate on the target lwp. */
+		if ((rv = lx_sched_pidlock(pid, &p, &tp, B_FALSE)) != 0)
+			return (set_errno(rv));
+
+		policy = lwptolxlwp(ttolwp(tp))->br_schd_class;
+		sprunlock(p);
+
+		interval.tv_sec = 0;
+		if (policy == LX_SCHED_RR) {
+			/* Use a made-up value similar to Linux */
+			interval.tv_nsec = 100000000;
+		} else {
+			interval.tv_nsec = 0;
+		}
+
+#if defined(_SYSCALL32_IMPL)
+		if (get_udatamodel() != DATAMODEL_NATIVE) {
+			timespec32_t t32;
+
+			/*
+			 * A timespec may overflow for 32-bit but EOVERFLOW
+			 * is not documented as an acceptable error for
+			 * sched_rr_get_interval.  Such an occurance would be
+			 * exceptionally weird for the RR interval.
+			 */
+			TIMESPEC_TO_TIMESPEC32(&t32, &interval);
+
+			if (copyout(&t32, ival, sizeof (t32)) != 0) {
+				return (set_errno(EFAULT));
+			}
+		}
+		else
+#endif
+		{
+			if (copyout(&interval, ival, sizeof (interval)))
+				return (set_errno(EFAULT));
+		}
+
+		return (0);
+	}
+
+	if ((rv = lx_sched_setprocset(&procset, pid)))
+		return (rv);
+
+	/*
+	 * get the class id
+	 */
+	pcparm.pc_cid = PC_CLNULL;
+	(void) lx_do_priocntlsys(PC_GETPARMS, &procset, &pcparm);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	/*
+	 * get the class info and identify the equivalent linux policy
+	 */
+	bzero(&pcinfo, sizeof (pcinfo));
+	pcinfo.pc_cid = pcparm.pc_cid;
+	(void) lx_do_priocntlsys(PC_GETCLINFO, &procset, &pcinfo);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	/*
+	 * get the class info and identify the equivalent linux policy
+	 */
+	setprocset(&procset, POP_AND, P_PID, 0, P_ALL, 0);
+	bzero(&pcinfo, sizeof (pcinfo));
+	(void) strcpy(pcinfo.pc_clname, "RT");
+	(void) lx_do_priocntlsys(PC_GETCID, &procset, &pcinfo);
+	if (lwp->lwp_errno)
+		return (lwp->lwp_errno);
+
+	/*
+	 * Contrary to what the man page says, you don't have to be in RR to
+	 * get this interval.
+	 */
+	if (((rtparms_t *)pcparm.pc_clparms)->rt_tqnsecs != RT_TQINF) {
+		interval.tv_sec = ((rtparms_t *)pcparm.pc_clparms)->rt_tqsecs;
+		interval.tv_nsec = ((rtparms_t *)pcparm.pc_clparms)->rt_tqnsecs;
+
+#if defined(_SYSCALL32_IMPL)
+		if (get_udatamodel() != DATAMODEL_NATIVE) {
+			timespec32_t t32;
+
+			/*
+			 * Like above, the 32-bit EOVERFLOW check is not
+			 * appropriate here.
+			 */
+			TIMESPEC_TO_TIMESPEC32(&t32, &interval);
+
+			if (copyout(&t32, ival, sizeof (t32)) != 0) {
+				return (set_errno(EFAULT));
+			}
+		}
+		else
+#endif
+		{
+			if (copyout(&interval, ival, sizeof (interval)))
+				return (set_errno(EFAULT));
+		}
+
+		return (0);
+	}
+
+	return (set_errno(EINVAL));
+}
+
+long
+lx_sched_get_priority_min(uintptr_t policy)
+{
+	/*
+	 * Linux scheduling priorities are not alterable, so there is no
+	 * illumos translation necessary.
+	 */
+	switch (policy) {
+	case LX_SCHED_FIFO:
+	case LX_SCHED_RR:
+		return (LX_SCHED_PRIORITY_MIN_RRFIFO);
+	case LX_SCHED_OTHER:
+	case LX_SCHED_BATCH:
+	case LX_SCHED_IDLE:
+	case LX_SCHED_DEADLINE:
+		return (LX_SCHED_PRIORITY_MIN_OTHER);
+	default:
+		break;
+	}
+	return (set_errno(EINVAL));
+}
+
+long
+lx_sched_get_priority_max(uintptr_t policy)
+{
+	/*
+	 * Linux scheduling priorities are not alterable, so there is no
+	 * illumos translation necessary.
+	 */
+	switch (policy) {
+	case LX_SCHED_FIFO:
+	case LX_SCHED_RR:
+		return (LX_SCHED_PRIORITY_MAX_RRFIFO);
+	case LX_SCHED_OTHER:
+	case LX_SCHED_BATCH:
+	case LX_SCHED_IDLE:
+	case LX_SCHED_DEADLINE:
+		return (LX_SCHED_PRIORITY_MAX_OTHER);
+	default:
+		break;
+	}
+	return (set_errno(EINVAL));
+}
+
+long
+lx_sched_setattr(l_pid_t pid, lx_sched_attr_t *attr, uint32_t flags)
+{
+	int		rv;
+	uint32_t	lx_size;
+	lx_sched_attr_t local_attr;
+	uint64_t	flg;
+
+	if (pid < 0 || attr == NULL || flags != 0)
+		return (set_errno(EINVAL));
+
+	if (copyin(attr, &lx_size, sizeof (lx_size)))
+		return (set_errno(EFAULT));
+
+	if (lx_size > sizeof (local_attr))
+		return (set_errno(E2BIG));
+
+	bzero(&local_attr, sizeof (local_attr));
+	if (copyin(attr, &local_attr, lx_size))
+		return (set_errno(EFAULT));
+
+	flg = local_attr.lx_sched_flags;
+	if ((flg & ~LX_SCHED_FLAG_RESET_ON_FORK) != 0)
+		return (set_errno(EINVAL));
+
+	if (EMUL_SCHED()) {
+		int		policy;
+		proc_t		*p;
+		kthread_t	*tp = NULL;
+		int		incr;
+		lx_lwp_data_t	*lwpd;
+
+		/* Find and operate on the target lwp. */
+		if ((rv = lx_sched_pidlock(pid, &p, &tp, B_TRUE)) != 0)
+			return (set_errno(rv));
+
+		policy = local_attr.lx_sched_policy;
+
+		switch (policy) {
+		case LX_SCHED_OTHER:
+		case LX_SCHED_BATCH:
+		case LX_SCHED_IDLE:
+			break;
+		case LX_SCHED_FIFO:
+		case LX_SCHED_RR:
+			if (crgetuid(CRED()) != 0) {
+				sprunlock(p);
+				return (set_errno(EPERM));
+			}
+			if (local_attr.lx_sched_priority <
+			    LX_SCHED_PRIORITY_MIN_RRFIFO ||
+			    local_attr.lx_sched_priority >
+			    LX_SCHED_PRIORITY_MAX_RRFIFO) {
+				sprunlock(p);
+				return (set_errno(EINVAL));
+			}
+			break;
+
+		case LX_SCHED_DEADLINE:
+			if (crgetuid(CRED()) != 0) {
+				sprunlock(p);
+				return (set_errno(EPERM));
+			}
+			break;
+		default:
+			sprunlock(p);
+			return (set_errno(EINVAL));
+		}
+
+		lwpd = lwptolxlwp(ttolwp(tp));
+		lwpd->br_schd_class = policy;
+		lwpd->br_schd_flags = flg;
+		lwpd->br_schd_pri = local_attr.lx_sched_priority;
+
+		lwpd->br_schd_runtime = local_attr.lx_sched_runtime;
+		lwpd->br_schd_deadline = local_attr.lx_sched_deadline;
+		lwpd->br_schd_period = local_attr.lx_sched_period;
+
+		ASSERT(policy <= LX_SCHED_DEADLINE);
+		incr = lx_emul_pri_map[policy];
+
+		CL_DOPRIO(tp, CRED(), incr, &rv);
+		sprunlock(p);
+		return (0);
+	}
+
+	/* Currently not supported under other classes */
+	return (set_errno(ENOSYS));
+}
+
+long
+lx_sched_getattr(l_pid_t pid, lx_sched_attr_t *attr, uint32_t size,
+    uint32_t flags)
+{
+	lx_sched_attr_t local_attr;
+	int rv;
+
+	if (pid < 0 || attr == NULL || flags != 0 || size < sizeof (local_attr))
+		return (set_errno(EINVAL));
+
+	bzero(&local_attr, sizeof (local_attr));
+	if (EMUL_SCHED()) {
+		proc_t		*p;
+		kthread_t	*tp = NULL;
+		lx_lwp_data_t	*lwpd;
+
+		/* Find and operate on the target lwp. */
+		if ((rv = lx_sched_pidlock(pid, &p, &tp, B_FALSE)) != 0)
+			return (set_errno(rv));
+
+		lwpd = lwptolxlwp(ttolwp(tp));
+		local_attr.lx_sched_policy = lwpd->br_schd_class;
+		local_attr.lx_sched_priority = lwpd->br_schd_pri;
+		local_attr.lx_sched_flags = lwpd->br_schd_flags;
+
+		local_attr.lx_sched_runtime = lwpd->br_schd_runtime;
+		local_attr.lx_sched_deadline = lwpd->br_schd_deadline;
+		local_attr.lx_sched_period = lwpd->br_schd_period;
+
+		sprunlock(p);
+
+		local_attr.lx_size = sizeof (lx_sched_attr_t);
+
+		if (copyout(&local_attr, attr, sizeof (local_attr)))
+			return (set_errno(EFAULT));
+
+		return (0);
+	}
+
+	/* Currently not supported under other classes */
+	return (set_errno(ENOSYS));
+}
+
+static int
+lx_sched_setprocset(procset_t *procset, l_pid_t pid)
+{
+	id_t lid, rid;
+	idtype_t lidtype, ridtype;
+
+	/*
+	 * define the target lwp
+	 */
+	if (pid == 0)
+		pid = curproc->p_pid;
+
+	if (lx_lpid_to_spair(pid, &pid, &lid) < 0)
+		return (set_errno(ESRCH));
+	rid = 0;
+	ridtype = P_ALL;
+	lidtype = P_LWPID;
+
+	setprocset(procset, POP_AND, lidtype, lid, ridtype, rid);
+
+	return (0);
+}
+
+static long
+lx_do_priocntlsys(int cmd, procset_t *procset, void *arg)
+{
+	return (priocntl_common(PC_VERSION, procset, cmd, (caddr_t)arg, 0,
+	    UIO_SYSSPACE));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_socket.c b/usr/src/uts/common/brand/lx/syscall/lx_socket.c
new file mode 100644
index 0000000000..18bc92433d
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_socket.c
@@ -0,0 +1,4378 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/errno.h>
+#include <sys/systm.h>
+#include <sys/types.h>
+#include <sys/cmn_err.h>
+#include <sys/sockio.h>
+#include <sys/thread.h>
+#include <sys/stropts.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/kmem.h>
+#include <sys/un.h>
+#include <sys/sunddi.h>
+#include <sys/cred.h>
+#include <sys/ucred.h>
+#include <sys/model.h>
+#include <sys/brand.h>
+#include <sys/vmsystm.h>
+#include <sys/limits.h>
+#include <sys/fcntl.h>
+#include <sys/sysmacros.h>
+#include <netpacket/packet.h>
+#include <sockcommon.h>
+#include <socktpi_impl.h>
+#include <netinet/udp.h>
+#include <sys/sdt.h>
+#include <netinet/tcp.h>
+#include <netinet/igmp.h>
+#include <netinet/icmp6.h>
+#include <inet/tcp_impl.h>
+#include <lx_errno.h>
+
+#include <sys/lx_brand.h>
+#include <sys/lx_socket.h>
+#include <sys/lx_types.h>
+#include <sys/lx_impl.h>
+
+/* From uts/common/fs/sockfs/socksyscalls.c */
+extern int listen(int, int, int);
+extern int shutdown(int, int, int);
+
+typedef struct lx_ucred {
+	pid_t		lxu_pid;
+	lx_uid_t	lxu_uid;
+	lx_gid_t	lxu_gid;
+} lx_ucred_t;
+
+typedef struct lx_socket_aux_data
+{
+	kmutex_t lxsad_lock;
+	enum lxsad_status_t {
+		LXSS_NONE = 0,
+		LXSS_CONNECTING,
+		LXSS_CONNECTED
+	} lxsad_status;
+	uint_t lxsad_flags;
+} lx_socket_aux_data_t;
+
+#define	LX_SS_MAXSIZE	128
+
+typedef struct lx_sockaddr_storage {
+	unsigned short	lxss_family;
+	char		lxdata[LX_SS_MAXSIZE - sizeof (unsigned short)];
+} lx_sockaddr_storage_t;
+
+typedef struct lx_group_req {
+	uint32_t	lxgr_interface;
+#ifdef _LP64
+	/* On 64-bit linux kernels, gr_interface is padded by 4 bytes. */
+	uint32_t	_lxgr_pad;
+#endif
+	lx_sockaddr_storage_t	lxgr_group;
+} lx_group_req_t;
+
+#if defined(_SYSCALL32_IMPL)
+
+typedef struct lx_group_req32 {
+	uint32_t		lxgr_interface;
+	lx_sockaddr_storage_t	lxgr_group;
+} lx_group_req32_t;
+
+#endif /* defined(_SYSCALL32_IMPL) */
+
+/* lxsad_flags */
+#define	LXSAD_FL_STRCRED	0x1
+#define	LXSAD_FL_EMULSEQPKT	0x2
+
+static lx_socket_aux_data_t *lx_sad_acquire(vnode_t *);
+
+/* VSD key for lx-specific socket information */
+static uint_t lx_socket_vsd = 0;
+
+/* Convenience enum to enforce translation direction */
+typedef enum lx_xlate_dir {
+	SUNOS_TO_LX,
+	LX_TO_SUNOS
+} lx_xlate_dir_t;
+
+/* enum for getpeername/getsockname handling */
+typedef enum lx_getname_type {
+	LX_GETPEERNAME,
+	LX_GETSOCKNAME
+} lx_getname_type_t;
+
+/*
+ * What follows are a series of tables we use to translate Linux constants
+ * into equivalent Illumos constants and back again.  I wish this were
+ * cleaner, more programmatic, and generally nicer.  Sadly, life is messy,
+ * and Unix networking even more so.
+ */
+static const int ltos_family[LX_AF_MAX + 1] =  {
+	AF_UNSPEC,		/* LX_AF_UNSPEC		*/
+	AF_UNIX,		/* LX_AF_UNIX		*/
+	AF_INET,		/* LX_AF_INET		*/
+	AF_NOTSUPPORTED,	/* LX_AF_AX25		*/
+	AF_NOTSUPPORTED,	/* LX_AF_IPX		*/
+	AF_NOTSUPPORTED,	/* LX_AF_APPLETALK	*/
+	AF_NOTSUPPORTED,	/* LX_AF_NETROM		*/
+	AF_NOTSUPPORTED,	/* LX_AF_BRIDGE		*/
+	AF_NOTSUPPORTED,	/* LX_AF_ATMPVC		*/
+	AF_NOTSUPPORTED,	/* LX_AF_X25		*/
+	AF_INET6,		/* LX_AF_INET6		*/
+	AF_NOTSUPPORTED,	/* LX_AF_ROSE		*/
+	AF_NOTSUPPORTED,	/* LX_AF_DECNET		*/
+	AF_NOTSUPPORTED,	/* LX_AF_NETBEUI	*/
+	AF_NOTSUPPORTED,	/* LX_AF_SECURITY	*/
+	AF_NOTSUPPORTED,	/* LX_AF_KEY		*/
+	AF_LX_NETLINK,		/* LX_AF_NETLINK	*/
+	AF_PACKET,		/* LX_AF_PACKET		*/
+	AF_NOTSUPPORTED,	/* LX_AF_ASH		*/
+	AF_NOTSUPPORTED,	/* LX_AF_ECONET		*/
+	AF_NOTSUPPORTED,	/* LX_AF_ATMSVC		*/
+	AF_NOTSUPPORTED,	/* LX_AF_RDS		*/
+	AF_NOTSUPPORTED,	/* LX_AF_SNA		*/
+	AF_NOTSUPPORTED,	/* LX_AF_IRDA		*/
+	AF_NOTSUPPORTED,	/* LX_AF_PPOX		*/
+	AF_NOTSUPPORTED,	/* LX_AF_WANPIPE	*/
+	AF_NOTSUPPORTED,	/* LX_AF_LLC		*/
+	AF_NOTSUPPORTED,	/* NONE			*/
+	AF_NOTSUPPORTED,	/* NONE			*/
+	AF_NOTSUPPORTED,	/* LX_AF_CAN		*/
+	AF_NOTSUPPORTED,	/* LX_AF_TIPC		*/
+	AF_NOTSUPPORTED,	/* LX_AF_BLUETOOTH	*/
+	AF_NOTSUPPORTED,	/* LX_AF_IUCV		*/
+	AF_NOTSUPPORTED		/* LX_AF_RXRPC		*/
+				/* LX_AF_ISDN		*/
+				/* LX_AF_PHONET		*/
+				/* LX_AF_IEEE802154	*/
+				/* LX_AF_CAIF		*/
+				/* LX_AF_ALG		*/
+				/* LX_AF_NFC		*/
+				/* LX_AF_VSOCK		*/
+};
+
+static const int stol_family[LX_AF_MAX + 1] =  {
+	AF_UNSPEC,		/* AF_UNSPEC		*/
+	AF_UNIX,		/* AF_UNIX		*/
+	AF_INET,		/* AF_INET		*/
+	AF_NOTSUPPORTED,	/* AF_IMPLINK		*/
+	AF_NOTSUPPORTED,	/* AF_PUP		*/
+	AF_NOTSUPPORTED,	/* AF_CHAOS		*/
+	AF_NOTSUPPORTED,	/* AF_NS		*/
+	AF_NOTSUPPORTED,	/* AF_NBS		*/
+	AF_NOTSUPPORTED,	/* AF_ECMA		*/
+	AF_NOTSUPPORTED,	/* AF_DATAKIT		*/
+	AF_NOTSUPPORTED,	/* AF_CCITT		*/
+	AF_NOTSUPPORTED,	/* AF_SNA		*/
+	AF_NOTSUPPORTED,	/* AF_DECNET		*/
+	AF_NOTSUPPORTED,	/* AF_DLI		*/
+	AF_NOTSUPPORTED,	/* AF_LAT		*/
+	AF_NOTSUPPORTED,	/* AF_HYLINK		*/
+	AF_NOTSUPPORTED,	/* AF_APPLETALK		*/
+	AF_NOTSUPPORTED,	/* AF_NIT		*/
+	AF_NOTSUPPORTED,	/* AF_802		*/
+	AF_NOTSUPPORTED,	/* AF_OSI		*/
+	AF_NOTSUPPORTED,	/* AF_X25		*/
+	AF_NOTSUPPORTED,	/* AF_OSINET		*/
+	AF_NOTSUPPORTED,	/* AF_GOSIP		*/
+	AF_NOTSUPPORTED,	/* AF_IPX		*/
+	AF_NOTSUPPORTED,	/* AF_ROUTE		*/
+	AF_NOTSUPPORTED,	/* AF_LINK		*/
+	LX_AF_INET6,		/* AF_INET6		*/
+	AF_NOTSUPPORTED,	/* AF_KEY		*/
+	AF_NOTSUPPORTED,	/* AF_NCA		*/
+	AF_NOTSUPPORTED,	/* AF_POLICY		*/
+	AF_NOTSUPPORTED,	/* AF_INET_OFFLOAD	*/
+	AF_NOTSUPPORTED,	/* AF_TRILL		*/
+	LX_AF_PACKET,		/* AF_PACKET		*/
+	LX_AF_NETLINK		/* AF_LX_NETLINK	*/
+};
+
+#define	LTOS_FAMILY(d) ((d) <= LX_AF_MAX ? ltos_family[(d)] : AF_INVAL)
+#define	STOL_FAMILY(d) ((d) <= LX_AF_MAX ? stol_family[(d)] : AF_INVAL)
+
+
+static const int ltos_socktype[LX_SOCK_PACKET + 1] = {
+	SOCK_NOTSUPPORTED, SOCK_STREAM, SOCK_DGRAM, SOCK_RAW,
+	SOCK_RDM, SOCK_SEQPACKET, SOCK_NOTSUPPORTED, SOCK_NOTSUPPORTED,
+	SOCK_NOTSUPPORTED, SOCK_NOTSUPPORTED, SOCK_NOTSUPPORTED
+};
+
+static const int stol_socktype[SOCK_SEQPACKET + 1] = {
+	SOCK_NOTSUPPORTED, LX_SOCK_DGRAM, LX_SOCK_STREAM, SOCK_NOTSUPPORTED,
+	LX_SOCK_RAW, LX_SOCK_RDM, LX_SOCK_SEQPACKET
+};
+
+#define	LTOS_SOCKTYPE(t)	\
+	((t) <= LX_SOCK_PACKET ? ltos_socktype[(t)] : SOCK_INVAL)
+#define	STOL_SOCKTYPE(t)	\
+	((t) <= SOCK_SEQPACKET ? stol_socktype[(t)] : SOCK_INVAL)
+
+
+/*
+ * This string is used to prefix all abstract namespace Unix sockets, ie all
+ * abstract namespace sockets are converted to regular sockets in the /tmp
+ * directory with .ABSK_ prefixed to their names.
+ */
+#define	ABST_PRFX "/tmp/.ABSK_"
+#define	ABST_PRFX_LEN (sizeof (ABST_PRFX) - 1)
+
+#define	DATAFILT	"datafilt"
+
+typedef enum {
+	lxa_none,
+	lxa_abstract,
+	lxa_devlog
+} lx_addr_type_t;
+
+static int
+ltos_pkt_proto(int protocol)
+{
+	switch (ntohs(protocol)) {
+	case LX_ETH_P_802_2:
+		return (ETH_P_802_2);
+	case LX_ETH_P_IP:
+		return (ETH_P_IP);
+	case LX_ETH_P_ARP:
+		return (ETH_P_ARP);
+	case LX_ETH_P_IPV6:
+		return (ETH_P_IPV6);
+	case LX_ETH_P_ALL:
+	case LX_ETH_P_802_3:
+		return (ETH_P_ALL);
+	default:
+		return (-1);
+	}
+}
+
+
+typedef struct lx_flag_map {
+	enum {
+		LXFM_MAP,
+		LXFM_IGNORE,
+		LXFM_UNSUP
+	} lxfm_action;
+	int lxfm_sunos_flag;
+	int lxfm_linux_flag;
+	char *lxfm_name;
+} lx_flag_map_t;
+
+static lx_flag_map_t lx_flag_map_tbl[] = {
+	{ LXFM_MAP,	MSG_OOB,		LX_MSG_OOB,		NULL },
+	{ LXFM_MAP,	MSG_PEEK,		LX_MSG_PEEK,		NULL },
+	{ LXFM_MAP,	MSG_DONTROUTE,		LX_MSG_DONTROUTE,	NULL },
+	{ LXFM_MAP,	MSG_CTRUNC,		LX_MSG_CTRUNC,		NULL },
+	{ LXFM_MAP,	MSG_TRUNC,		LX_MSG_TRUNC,		NULL },
+	{ LXFM_MAP,	MSG_DONTWAIT,		LX_MSG_DONTWAIT,	NULL },
+	{ LXFM_MAP,	MSG_EOR,		LX_MSG_EOR,		NULL },
+	{ LXFM_MAP,	MSG_WAITALL,		LX_MSG_WAITALL,		NULL },
+	/* MSG_CONFIRM is safe to ignore */
+	{ LXFM_IGNORE,	0,			LX_MSG_CONFIRM,		NULL },
+	/*
+	 * The NOSIGNAL and CMSG_CLOEXEC flags are handled by the emulation
+	 * outside of the flag-conversion routine.
+	 */
+	{ LXFM_IGNORE,	0,			LX_MSG_NOSIGNAL,	NULL },
+	{ LXFM_IGNORE,	0,			LX_MSG_CMSG_CLOEXEC,	NULL },
+	{ LXFM_UNSUP,	LX_MSG_PROXY,		0,	"MSG_PROXY" },
+	{ LXFM_UNSUP,	LX_MSG_FIN,		0,	"MSG_FIN" },
+	{ LXFM_UNSUP,	LX_MSG_SYN,		0,	"MSG_SYN" },
+	{ LXFM_UNSUP,	LX_MSG_RST,		0,	"MSG_RST" },
+	{ LXFM_UNSUP,	LX_MSG_ERRQUEUE,	0,	"MSG_ERRQUEUE" },
+	{ LXFM_UNSUP,	LX_MSG_MORE,		0,	"MSG_MORE" },
+	{ LXFM_UNSUP,	LX_MSG_WAITFORONE,	0,	"MSG_WAITFORONE" },
+	{ LXFM_UNSUP,	LX_MSG_FASTOPEN,	0,	"MSG_FASTOPEN" },
+};
+
+#define	LX_FLAG_MAP_MAX	\
+	(sizeof (lx_flag_map_tbl) / sizeof (lx_flag_map_tbl[0]))
+
+#define	LX_UNSUP_BUFSZ	64
+
+static int
+lx_xlate_sock_flags(int inflags, lx_xlate_dir_t dir)
+{
+	int i, outflags = 0;
+	char buf[LX_UNSUP_BUFSZ];
+
+	VERIFY(dir == SUNOS_TO_LX || dir == LX_TO_SUNOS);
+
+	for (i = 0; i < LX_FLAG_MAP_MAX; i++) {
+		lx_flag_map_t *map = &lx_flag_map_tbl[i];
+		int match, out;
+
+		if (dir == SUNOS_TO_LX) {
+			match = inflags & map->lxfm_sunos_flag;
+			out = map->lxfm_linux_flag;
+		} else {
+			match = inflags & map->lxfm_linux_flag;
+			out = map->lxfm_sunos_flag;
+		}
+		switch (map->lxfm_action) {
+		case LXFM_MAP:
+			if (match != 0) {
+				inflags &= ~(match);
+				outflags |= out;
+			}
+			break;
+		case LXFM_IGNORE:
+			if (match != 0) {
+				inflags &= ~(match);
+			}
+			break;
+		case LXFM_UNSUP:
+			if (match != 0) {
+				(void) snprintf(buf, LX_UNSUP_BUFSZ,
+				    "unsupported sock flag %s", map->lxfm_name);
+				lx_unsupported(buf);
+			}
+		}
+	}
+	if (inflags != 0) {
+		(void) snprintf(buf, LX_UNSUP_BUFSZ,
+		    "unsupported sock flags 0x%08x", inflags);
+		lx_unsupported(buf);
+	}
+
+	return (outflags);
+}
+
+typedef enum lx_sun_type {
+	LX_SUN_NORMAL,
+	LX_SUN_ABSTRACT,
+} lx_sun_type_t;
+
+static void
+ltos_sockaddr_ux(const struct sockaddr *inaddr, const socklen_t inlen,
+    struct sockaddr **outaddr, socklen_t *outlen, lx_sun_type_t *sun_type)
+{
+	struct sockaddr_un buf;
+	/* Calculate size of (sun_family + any padding) in sockaddr */
+	int sizediff = (sizeof (buf) - sizeof (buf.sun_path));
+	int len = inlen - sizediff;
+
+	VERIFY(len > 0);
+	VERIFY(len <= sizeof (buf.sun_path));
+	bzero(&buf, sizeof (buf));
+
+	if (inaddr->sa_data[0] == '\0') {
+		/*
+		 * Linux supports abstract Unix sockets, which are simply
+		 * sockets that do not exist on the file system.  These sockets
+		 * are denoted by beginning the path with a NULL character. To
+		 * support these, we strip out the leading NULL character and
+		 * change the path to point to a real place in /tmp directory,
+		 * by prepending ABST_PRFX and replacing all illegal characters
+		 * with * '_'.
+		 *
+		 * Since these sockets are supposed to exist outside the
+		 * filesystem, they must be cleaned up after use.  This removal
+		 * is performed during bind().
+		 */
+		int idx, odx;
+
+		/* Add our abstract prefix */
+		(void) strcpy(buf.sun_path, ABST_PRFX);
+		for (idx = 1, odx = ABST_PRFX_LEN;
+		    idx < len && odx < sizeof (buf.sun_path);
+		    idx++, odx++) {
+			char c = inaddr->sa_data[idx];
+			if (c == '\0' || c == '/') {
+				buf.sun_path[odx] = '_';
+			} else {
+				buf.sun_path[odx] = c;
+			}
+		}
+
+		/*
+		 * Since abstract socket addresses might not be NUL terminated,
+		 * we must explicitly NUL terminate the translated path.
+		 * Care is taken not to overflow the buffer.
+		 */
+		if (odx == sizeof (buf.sun_path)) {
+			buf.sun_path[odx - 1] = '\0';
+		} else {
+			buf.sun_path[odx] = '\0';
+		}
+
+		if (sun_type != NULL) {
+			*sun_type = LX_SUN_ABSTRACT;
+		}
+	} else {
+		/* Copy the address directly, minding termination */
+		(void) strncpy(buf.sun_path, inaddr->sa_data, len);
+		len = strnlen(buf.sun_path, len);
+		if (len == sizeof (buf.sun_path)) {
+			buf.sun_path[len - 1] = '\0';
+		} else {
+			VERIFY(len < sizeof (buf.sun_path));
+			buf.sun_path[len] = '\0';
+		}
+
+		if (sun_type != NULL) {
+			*sun_type = LX_SUN_NORMAL;
+		}
+	}
+	buf.sun_family = AF_UNIX;
+	*outlen = strlen(buf.sun_path) + 1 + sizediff;
+	VERIFY(*outlen <= sizeof (struct sockaddr_un));
+
+	*outaddr = kmem_alloc(*outlen, KM_SLEEP);
+	bcopy(&buf, *outaddr, *outlen);
+}
+
+/*
+ * Copy in a Linux-native socket address from userspace and convert it into
+ * illumos format.  When successful, it will allocate an appropriately sized
+ * struct to be freed by the caller.
+ */
+static long
+ltos_sockaddr_copyin(const struct sockaddr *inaddr, const socklen_t inlen,
+    struct sockaddr **outaddr, socklen_t *outlen, lx_sun_type_t *sun_type)
+{
+	sa_family_t family;
+	struct sockaddr *laddr;
+	struct sockaddr_ll *sal;
+	int proto, error = 0;
+
+	VERIFY(inaddr != NULL);
+
+	if (inlen < sizeof (sa_family_t) ||
+	    inlen > sizeof (struct sockaddr_storage)) {
+		return (EINVAL);
+	}
+	laddr = kmem_alloc(inlen, KM_SLEEP);
+	if (copyin(inaddr, laddr, inlen) != 0) {
+		kmem_free(laddr, inlen);
+		return (EFAULT);
+	}
+
+	family = LTOS_FAMILY(laddr->sa_family);
+	switch (family) {
+		case (sa_family_t)AF_NOTSUPPORTED:
+			error = EPROTONOSUPPORT;
+			break;
+
+		case (sa_family_t)AF_INVAL:
+			error = EAFNOSUPPORT;
+			break;
+
+		case AF_UNIX:
+			if (inlen < sizeof (sa_family_t) + 2 ||
+			    inlen > sizeof (struct sockaddr_un)) {
+				error = EINVAL;
+				break;
+			}
+			ltos_sockaddr_ux(laddr, inlen, outaddr, outlen,
+			    sun_type);
+
+			/* AF_UNIX bypasses the standard copy logic */
+			kmem_free(laddr, inlen);
+			return (0);
+
+		case AF_PACKET:
+			if (inlen < sizeof (struct sockaddr_ll)) {
+				error = EINVAL;
+				break;
+			}
+			*outlen = sizeof (struct sockaddr_ll);
+
+			/* sll_protocol must be translated */
+			/* LINTED: alignment */
+			sal = (struct sockaddr_ll *)laddr;
+			proto = ltos_pkt_proto(sal->sll_protocol);
+			if (proto < 0) {
+				error = EINVAL;
+			}
+			sal->sll_protocol = proto;
+			break;
+
+		case AF_INET:
+			if (inlen < sizeof (struct sockaddr)) {
+				error = EINVAL;
+				break;
+			}
+			*outlen = sizeof (struct sockaddr);
+			break;
+
+		case AF_INET6:
+			/*
+			 * The illumos sockaddr_in6 has one more 32-bit field
+			 * than the Linux version.  We simply zero that field
+			 * via kmem_zalloc.
+			 */
+			if (inlen < sizeof (lx_sockaddr_in6_t)) {
+				error = EINVAL;
+				break;
+			}
+			*outlen = sizeof (struct sockaddr_in6);
+			*outaddr = (struct sockaddr *)kmem_zalloc(*outlen,
+			    KM_SLEEP);
+			bcopy(laddr, *outaddr, sizeof (lx_sockaddr_in6_t));
+			(*outaddr)->sa_family = AF_INET6;
+			/* AF_INET6 bypasses the standard copy logic */
+			kmem_free(laddr, inlen);
+			return (0);
+
+		default:
+			*outlen = inlen;
+	}
+
+	if (error == 0) {
+		/*
+		 * For most address families, just copying into a sockaddr of
+		 * the correct size and updating sa_family is adequate.
+		 */
+		VERIFY(inlen >= *outlen);
+
+		*outaddr = (struct sockaddr *)kmem_zalloc(*outlen, KM_SLEEP);
+		bcopy(laddr, *outaddr, *outlen);
+		(*outaddr)->sa_family = family;
+	}
+	kmem_free(laddr, inlen);
+	return (error);
+}
+
+/*
+ * Convert an illumos-native socket address into Linux format and copy it out
+ * to userspace.
+ */
+static long
+stol_sockaddr_copyout(struct sockaddr *inaddr, socklen_t inlen,
+    struct sockaddr *outaddr, void *outlenp, socklen_t orig)
+{
+	socklen_t size = inlen;
+	struct sockaddr_storage buf;
+	struct sockaddr *bufaddr;
+
+	/*
+	 * Either we were passed a valid sockaddr (with length) or the length
+	 * is set to 0.
+	 */
+	VERIFY(inaddr != NULL || inlen == 0);
+
+	if (inlen == 0) {
+		goto finish;
+	}
+
+
+	switch (inaddr->sa_family) {
+	case AF_INET:
+		if (inlen != sizeof (struct sockaddr)) {
+			return (EINVAL);
+		}
+		break;
+
+	case AF_INET6:
+		if (inlen != sizeof (struct sockaddr_in6)) {
+			return (EINVAL);
+		}
+		/*
+		 * The linux sockaddr_in6 is shorter than illumos.
+		 * Truncate the extra field on the way out.
+		 */
+		size = (sizeof (lx_sockaddr_in6_t));
+		inlen = (sizeof (lx_sockaddr_in6_t));
+		break;
+
+	case AF_UNIX:
+		if (inlen > sizeof (struct sockaddr_un)) {
+			return (EINVAL);
+		}
+
+		/*
+		 * On Linux an empty AF_UNIX address is returned as NULL, which
+		 * means setting the returned length to only encompass the
+		 * address family part of the buffer. However, some code also
+		 * references the address portion of the buffer and uses it,
+		 * even though the returned length has been shortened. Thus, we
+		 * clear the buffer to ensure that the address portion is NULL.
+		 */
+		if (inaddr->sa_data[0] == '\0') {
+			bzero(&buf, sizeof (buf));
+			inlen = sizeof (inaddr->sa_family);
+		}
+		break;
+
+	case (sa_family_t)AF_NOTSUPPORTED:
+		return (EPROTONOSUPPORT);
+
+	case (sa_family_t)AF_INVAL:
+		return (EAFNOSUPPORT);
+
+	default:
+		break;
+	}
+
+	/*
+	 * The input should be smaller than sockaddr_storage, the largest
+	 * sockaddr we support.
+	 */
+	VERIFY(inlen <= sizeof (buf));
+
+	bufaddr = (struct sockaddr *)&buf;
+	bcopy(inaddr, bufaddr, inlen);
+	bufaddr->sa_family = STOL_FAMILY(bufaddr->sa_family);
+
+	/*
+	 * It is possible that userspace passed us a smaller buffer than we
+	 * hope to output.  When this is the case, we will truncate our output
+	 * to the max size of their buffer but report the true size of the
+	 * sockaddr when outputting the outlen value.
+	 */
+	size = (orig < size) ? orig : size;
+
+	if (copyout(bufaddr, outaddr, size) != 0) {
+		return (EFAULT);
+	}
+
+finish:
+#if defined(_LP64)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		int32_t len32 = (int32_t)inlen;
+		if (copyout(&len32, outlenp, sizeof (len32)) != 0) {
+			return (EFAULT);
+		}
+	} else
+#endif /* defined(_LP64) */
+	{
+		if (copyout(&inlen, outlenp, sizeof (inlen)) != 0) {
+			return (EFAULT);
+		}
+	}
+
+	return (0);
+}
+
+typedef struct lx_cmsg_xlate {
+	int lcx_sunos_level;
+	int lcx_sunos_type;
+	int (*lcx_stol_conv)(struct cmsghdr *, struct cmsghdr *);
+	int lcx_linux_level;
+	int lcx_linux_type;
+	int (*lcx_ltos_conv)(struct cmsghdr *, struct cmsghdr *);
+} lx_cmsg_xlate_t;
+
+static int cmsg_conv_generic(struct cmsghdr *, struct cmsghdr *);
+static int stol_conv_ucred(struct cmsghdr *, struct cmsghdr *);
+static int ltos_conv_ucred(struct cmsghdr *, struct cmsghdr *);
+static int stol_conv_recvttl(struct cmsghdr *, struct cmsghdr *);
+
+/*
+ * Table describing SunOS <-> Linux cmsg translation mappings.
+ * Certain types (IP_RECVTTL) are only converted in one direction and are
+ * indicated by one of the translation functions being set to NULL.
+ */
+static lx_cmsg_xlate_t lx_cmsg_xlate_tbl[] = {
+	{ SOL_SOCKET, SCM_RIGHTS, cmsg_conv_generic,
+	    LX_SOL_SOCKET, LX_SCM_RIGHTS, cmsg_conv_generic },
+	{ SOL_SOCKET, SCM_UCRED, stol_conv_ucred,
+	    LX_SOL_SOCKET, LX_SCM_CRED, ltos_conv_ucred },
+	{ SOL_SOCKET, SCM_TIMESTAMP, cmsg_conv_generic,
+	    LX_SOL_SOCKET, LX_SCM_TIMESTAMP, cmsg_conv_generic },
+	{ IPPROTO_IP, IP_PKTINFO, cmsg_conv_generic,
+	    LX_IPPROTO_IP, LX_IP_PKTINFO, cmsg_conv_generic },
+	{ IPPROTO_IP, IP_RECVTTL, stol_conv_recvttl,
+	    LX_IPPROTO_IP, LX_IP_TTL, NULL },
+	{ IPPROTO_IP, IP_TTL, cmsg_conv_generic,
+	    LX_IPPROTO_IP, LX_IP_TTL, cmsg_conv_generic },
+	{ IPPROTO_IPV6, IPV6_HOPLIMIT, cmsg_conv_generic,
+	    LX_IPPROTO_IPV6, LX_IPV6_HOPLIMIT, cmsg_conv_generic },
+	{ IPPROTO_IPV6, IPV6_PKTINFO, cmsg_conv_generic,
+	    LX_IPPROTO_IPV6, LX_IPV6_PKTINFO, cmsg_conv_generic }
+};
+
+#define	LX_MAX_CMSG_XLATE	\
+	(sizeof (lx_cmsg_xlate_tbl) / sizeof (lx_cmsg_xlate_tbl[0]))
+
+#if defined(_LP64)
+
+typedef struct {
+	int64_t	cmsg_len;
+	int32_t	cmsg_level;
+	int32_t	cmsg_type;
+} lx_cmsghdr64_t;
+
+/* The alignment/padding for 64bit Linux cmsghdr is not the same. */
+#define	LX_CMSG64_ALIGNMENT	8
+#define	ISALIGNED_LX_CMSG64(addr)					\
+	(((uintptr_t)(addr) & (LX_CMSG64_ALIGNMENT - 1)) == 0)
+#define	ROUNDUP_LX_CMSG64_LEN(len)					\
+	(((len) + LX_CMSG64_ALIGNMENT - 1) & ~(LX_CMSG64_ALIGNMENT - 1))
+
+#define	LX_CMSG64_IS_ALIGNED(m)			\
+	(((uintptr_t)(m) & (_CMSG_DATA_ALIGNMENT - 1)) == 0)
+#define	LX_CMSG64_DATA(c)	((unsigned char *)(((lx_cmsghdr64_t *)(c)) + 1))
+/*
+ * LX_CMSG64_VALID is closely derived from CMSG_VALID with one particularly
+ * important addition.  Since cmsg_len is 64bit, (cmsg + cmsg_len) is checked
+ * against the start address as well.  This prevents bogus inputs from wrapping
+ * around the address space.
+ */
+#define	LX_CMSG64_VALID(cmsg, start, end)				\
+	(ISALIGNED_LX_CMSG64(cmsg) &&					\
+	((uintptr_t)(cmsg) >= (uintptr_t)(start)) &&			\
+	((uintptr_t)(cmsg) < (uintptr_t)(end)) &&			\
+	((cmsg)->cmsg_len >= sizeof (lx_cmsghdr64_t)) &&		\
+	((uintptr_t)(cmsg) + (cmsg)->cmsg_len <= (uintptr_t)(end)) &&	\
+	((uintptr_t)(cmsg) + (cmsg)->cmsg_len >= (uintptr_t)(start)))
+#define	LX_CMSG64_NEXT(cmsg)				\
+	(lx_cmsghdr64_t *)((uintptr_t)(cmsg) +		\
+	    ROUNDUP_LX_CMSG64_LEN((cmsg)->cmsg_len))
+#define	LX_CMSG64_DIFF	sizeof (uint32_t)
+
+#endif /* defined(_LP64) */
+
+/*
+ * convert ucred_s to lx_ucred.
+ */
+static int
+stol_conv_ucred(struct cmsghdr *inmsg, struct cmsghdr *omsg)
+{
+	/*
+	 * Format the data correctly in the omsg buffer.
+	 */
+	if (omsg != NULL) {
+		struct ucred_s *scred;
+		prcred_t *cr;
+		lx_ucred_t lcred;
+
+		scred = (struct ucred_s *)CMSG_CONTENT(inmsg);
+		lcred.lxu_pid = scred->uc_pid;
+		/* LINTED: alignment */
+		cr = UCCRED(scred);
+		if (cr != NULL) {
+			lcred.lxu_uid = cr->pr_euid;
+			lcred.lxu_gid = cr->pr_egid;
+		} else {
+			lcred.lxu_uid = lcred.lxu_gid = 0;
+		}
+
+		bcopy(&lcred, CMSG_CONTENT(omsg), sizeof (lx_ucred_t));
+	}
+
+	return (sizeof (struct cmsghdr) + sizeof (lx_ucred_t));
+}
+
+static int
+ltos_conv_ucred(struct cmsghdr *inmsg, struct cmsghdr *omsg)
+{
+	if (omsg != NULL) {
+		struct ucred_s *uc;
+		prcred_t *pc;
+		lx_ucred_t *lcred;
+
+		uc = (struct ucred_s *)CMSG_CONTENT(omsg);
+		/* LINTED: alignment */
+		pc = (prcred_t *)((char *)uc + sizeof (struct ucred_s));
+
+		uc->uc_credoff = sizeof (struct ucred_s);
+
+		lcred = (lx_ucred_t *)CMSG_CONTENT(inmsg);
+
+		uc->uc_pid = lcred->lxu_pid;
+		pc->pr_euid = lcred->lxu_uid;
+		pc->pr_egid = lcred->lxu_gid;
+	}
+
+	return (sizeof (struct cmsghdr) + sizeof (struct ucred_s) +
+	    sizeof (prcred_t));
+
+}
+
+static int
+stol_conv_recvttl(struct cmsghdr *inmsg, struct cmsghdr *omsg)
+{
+	/*
+	 * SunOS communicates the TTL of incoming packets via IP_RECVTTL using
+	 * a uint8_t value instead of IP_TTL using an int. This conversion is
+	 * only needed in the one direction since Linux does not handle
+	 * IP_RECVTTL in the sendmsg path.
+	 */
+	if (omsg != NULL) {
+		uint8_t *inttl = (uint8_t *)CMSG_CONTENT(inmsg);
+		int *ottl = (int *)CMSG_CONTENT(omsg);
+
+		*ottl = (int)*inttl;
+	}
+
+	return (sizeof (struct cmsghdr) + sizeof (int));
+}
+
+static int
+cmsg_conv_generic(struct cmsghdr *inmsg, struct cmsghdr *omsg)
+{
+	if (omsg != NULL) {
+		size_t data_len;
+
+		data_len = inmsg->cmsg_len - sizeof (struct cmsghdr);
+		bcopy(CMSG_CONTENT(inmsg), CMSG_CONTENT(omsg), data_len);
+	}
+
+	return (inmsg->cmsg_len);
+}
+
+static int
+lx_xlate_cmsg(struct cmsghdr *inmsg, struct cmsghdr *omsg, lx_xlate_dir_t dir)
+{
+	int i;
+	int len;
+
+	VERIFY(dir == SUNOS_TO_LX || dir == LX_TO_SUNOS);
+
+	for (i = 0; i < LX_MAX_CMSG_XLATE; i++) {
+		lx_cmsg_xlate_t *xlate = &lx_cmsg_xlate_tbl[i];
+		if (dir == LX_TO_SUNOS &&
+		    inmsg->cmsg_level == xlate->lcx_linux_level &&
+		    inmsg->cmsg_type == xlate->lcx_linux_type &&
+		    xlate->lcx_ltos_conv != NULL) {
+			len = xlate->lcx_ltos_conv(inmsg, omsg);
+			if (omsg != NULL) {
+				omsg->cmsg_len = len;
+				omsg->cmsg_level = xlate->lcx_sunos_level;
+				omsg->cmsg_type = xlate->lcx_sunos_type;
+			}
+			return (len);
+		} else if (dir == SUNOS_TO_LX &&
+		    inmsg->cmsg_level == xlate->lcx_sunos_level &&
+		    inmsg->cmsg_type == xlate->lcx_sunos_type &&
+		    xlate->lcx_stol_conv != NULL) {
+			len = xlate->lcx_stol_conv(inmsg, omsg);
+			if (omsg != NULL) {
+				omsg->cmsg_len = len;
+				omsg->cmsg_level = xlate->lcx_linux_level;
+				omsg->cmsg_type = xlate->lcx_linux_type;
+			}
+			return (len);
+		}
+	}
+	/*
+	 * The Linux man page for sendmsg does not define a specific error for
+	 * unsupported cmsgs.  While it is meant to indicated bad values for
+	 * passed flags, EOPNOTSUPP appears to be the next closest choice.
+	 */
+	return (-EOPNOTSUPP);
+}
+
+static long
+ltos_cmsgs_copyin(void *addr, socklen_t inlen, void **outmsg,
+    socklen_t *outlenp)
+{
+	void *inbuf, *obuf;
+	struct cmsghdr *inmsg, *omsg;
+	int slen = 0;
+
+	if (inlen < sizeof (struct cmsghdr) || inlen > SO_MAXARGSIZE) {
+		return (EINVAL);
+	}
+
+#if defined(_LP64)
+	if (get_udatamodel() == DATAMODEL_NATIVE &&
+	    inlen < sizeof (lx_cmsghdr64_t)) {
+		/* The size requirements are more strict for 64bit. */
+		return (EINVAL);
+	}
+#endif /* defined(_LP64) */
+
+	inbuf = kmem_alloc(inlen, KM_SLEEP);
+	if (copyin(addr, inbuf, inlen) != 0) {
+		kmem_free(inbuf, inlen);
+		return (EFAULT);
+	}
+
+#if defined(_LP64)
+	if (get_udatamodel() == DATAMODEL_NATIVE) {
+		/*
+		 * Linux cmsg headers are longer than illumos under x86_64.
+		 * Convert to regular cmsgs first.
+		 */
+		lx_cmsghdr64_t *lmsg;
+		struct cmsghdr *smsg;
+		void *newbuf;
+		int len = 0;
+
+		/* Inventory the new cmsg size */
+		for (lmsg = (lx_cmsghdr64_t *)inbuf;
+		    LX_CMSG64_VALID(lmsg, inbuf, (uintptr_t)inbuf + inlen) != 0;
+		    lmsg = LX_CMSG64_NEXT(lmsg)) {
+			len += ROUNDUP_cmsglen(lmsg->cmsg_len - LX_CMSG64_DIFF);
+		}
+
+		VERIFY(len < inlen);
+		if (len == 0) {
+			/* Input was bogus, so we can give up early. */
+			kmem_free(inbuf, inlen);
+			*outmsg = NULL;
+			*outlenp = 0;
+			return (EINVAL);
+		}
+
+		newbuf = kmem_alloc(len, KM_SLEEP);
+
+		for (lmsg = (lx_cmsghdr64_t *)inbuf,
+		    smsg = (struct cmsghdr *)newbuf;
+		    LX_CMSG64_VALID(lmsg, inbuf, (uintptr_t)inbuf + inlen) != 0;
+		    lmsg = LX_CMSG64_NEXT(lmsg), smsg = CMSG_NEXT(smsg)) {
+			smsg->cmsg_level = lmsg->cmsg_level;
+			smsg->cmsg_type = lmsg->cmsg_type;
+			smsg->cmsg_len = lmsg->cmsg_len - LX_CMSG64_DIFF;
+
+			/* The above length measurement should ensure this */
+			ASSERT(CMSG_VALID(smsg, newbuf,
+			    (uintptr_t)newbuf + len));
+
+			bcopy(LX_CMSG64_DATA(lmsg), CMSG_CONTENT(smsg),
+			    smsg->cmsg_len - sizeof (*smsg));
+		}
+
+		kmem_free(inbuf, inlen);
+		inbuf = newbuf;
+		inlen = len;
+	}
+#endif /* defined(_LP64) */
+
+	/*
+	 * Now determine how much space we need for the conversion.
+	 */
+	for (inmsg = (struct cmsghdr *)inbuf;
+	    CMSG_VALID(inmsg, inbuf, (uintptr_t)inbuf + inlen) != 0;
+	    inmsg = CMSG_NEXT(inmsg)) {
+		int sz;
+
+		if ((sz = lx_xlate_cmsg(inmsg, NULL, LX_TO_SUNOS)) < 0) {
+			/* unsupported msg */
+			kmem_free(inbuf, inlen);
+			return (-sz);
+		}
+
+		slen += ROUNDUP_cmsglen(sz);
+	}
+
+	obuf = kmem_zalloc(slen, KM_SLEEP);
+
+	/*
+	 * Now do the conversion.
+	 */
+	for (inmsg = (struct cmsghdr *)inbuf, omsg = (struct cmsghdr *)obuf;
+	    CMSG_VALID(inmsg, inbuf, (uintptr_t)inbuf + inlen) != 0;
+	    inmsg = CMSG_NEXT(inmsg), omsg = CMSG_NEXT(omsg)) {
+		VERIFY(lx_xlate_cmsg(inmsg, omsg, LX_TO_SUNOS) >= 0);
+	}
+
+	kmem_free(inbuf, inlen);
+	*outmsg = obuf;
+	*outlenp = slen;
+	return (0);
+}
+
+static long
+stol_cmsgs_copyout(void *input, socklen_t inlen, void *addr,
+    void *outlenp, socklen_t orig_outlen)
+{
+	void *obuf;
+	struct cmsghdr *inmsg, *omsg;
+	int error = 0;
+	socklen_t lx_len = 0;
+#if defined(_LP64)
+	model_t model = get_udatamodel();
+#endif
+
+	if (inlen == 0) {
+		/* Simply output the zero controllen */
+		goto finish;
+	}
+
+	VERIFY(inlen > sizeof (struct cmsghdr));
+
+	/*
+	 * First determine how much space we need for the conversion and
+	 * make sure the caller has provided at least that much space to return
+	 * results.
+	 */
+	for (inmsg = (struct cmsghdr *)input;
+	    CMSG_VALID(inmsg, input, (uintptr_t)input + inlen) != 0;
+	    inmsg = CMSG_NEXT(inmsg)) {
+		int sz;
+
+		if ((sz = lx_xlate_cmsg(inmsg, NULL, SUNOS_TO_LX)) < 0) {
+			/* unsupported msg */
+			return (-sz);
+		}
+
+#if defined(_LP64)
+		if (model == DATAMODEL_NATIVE) {
+			/*
+			 * The converted 64-bit cmsgs require an additional 4
+			 * bytes of header space and must be aligned to 8 bytes
+			 * (instead of the typical 4 for x86)
+			 */
+			sz = ROUNDUP_LX_CMSG64_LEN(sz + LX_CMSG64_DIFF);
+		} else
+#endif /* defined(_LP64) */
+		{
+			/*
+			 * The converted 32-bit cmsgs do not require additional
+			 * header space or padding for Linux conversion.
+			 */
+			sz = ROUNDUP_cmsglen(sz);
+		}
+
+		/*
+		 * Unlike SunOS, Linux requires that the last cmsg be
+		 * adequately padded for alignment.
+		 */
+		lx_len += sz;
+	}
+
+	if (lx_len > orig_outlen || addr == NULL) {
+		/* This will be interpreted by the caller */
+		error = EMSGSIZE;
+		lx_len = 0;
+		goto finish;
+	}
+
+	/*
+	 * Since cmsgs are often padded to an aligned size, kmem_zalloc is
+	 * necessary to prevent leaking the contents of uninitialized memory.
+	 */
+	obuf = kmem_zalloc(lx_len, KM_SLEEP);
+
+	/*
+	 * Convert the msgs.
+	 */
+	for (inmsg = (struct cmsghdr *)input, omsg = (struct cmsghdr *)obuf;
+	    CMSG_VALID(inmsg, input, (uintptr_t)input + inlen) != 0;
+	    inmsg = CMSG_NEXT(inmsg), omsg = CMSG_NEXT(omsg)) {
+		VERIFY(lx_xlate_cmsg(inmsg, omsg, SUNOS_TO_LX) >= 0);
+	}
+
+#if defined(_LP64)
+	if (model == DATAMODEL_NATIVE) {
+		/* Linux cmsg headers are longer than illumos under x86_64. */
+		struct cmsghdr *smsg;
+		lx_cmsghdr64_t *lmsg;
+		void *newbuf;
+
+		/*
+		 * Once again, kmem_zalloc is needed to avoid leaking the
+		 * contents of uninialized memory
+		 */
+		newbuf = kmem_zalloc(lx_len, KM_SLEEP);
+		for (smsg = (struct cmsghdr *)obuf,
+		    lmsg = (lx_cmsghdr64_t *)newbuf;
+		    CMSG_VALID(smsg, obuf, (uintptr_t)obuf + inlen) != 0;
+		    smsg = CMSG_NEXT(smsg), lmsg = LX_CMSG64_NEXT(lmsg)) {
+			lmsg->cmsg_level = smsg->cmsg_level;
+			lmsg->cmsg_type = smsg->cmsg_type;
+			lmsg->cmsg_len = smsg->cmsg_len + LX_CMSG64_DIFF;
+
+			ASSERT(LX_CMSG64_VALID(lmsg, newbuf,
+			    (uintptr_t)newbuf + lx_len) != 0);
+
+			bcopy(CMSG_CONTENT(smsg), LX_CMSG64_DATA(lmsg),
+			    smsg->cmsg_len - sizeof (*smsg));
+		}
+
+		kmem_free(obuf, lx_len);
+		obuf = newbuf;
+	}
+#endif /* defined(_LP64) */
+
+	if (copyout(obuf, addr, lx_len) != 0) {
+		kmem_free(obuf, lx_len);
+		return (EFAULT);
+	}
+	kmem_free(obuf, lx_len);
+
+finish:
+	if (outlenp != NULL) {
+#if defined(_LP64)
+		if (model != DATAMODEL_NATIVE) {
+			int32_t len32 = (int32_t)lx_len;
+			if (copyout(&len32, outlenp, sizeof (len32)) != 0) {
+				return (EFAULT);
+			}
+		} else
+#endif /* defined(_LP64) */
+		{
+			if (copyout(&lx_len, outlenp, sizeof (lx_len)) != 0) {
+				return (EFAULT);
+			}
+		}
+	}
+	return (error);
+}
+
+static void
+lx_cmsg_set_cloexec(void *input, socklen_t inlen)
+{
+	struct cmsghdr *inmsg;
+
+	if (inlen == 0) {
+		return;
+	}
+
+	for (inmsg = (struct cmsghdr *)input;
+	    CMSG_VALID(inmsg, input, (uintptr_t)input + inlen) != 0;
+	    inmsg = CMSG_NEXT(inmsg)) {
+		if (inmsg->cmsg_level == SOL_SOCKET &&
+		    inmsg->cmsg_type == SCM_RIGHTS) {
+			int *fds = (int *)CMSG_CONTENT(inmsg);
+			int i, num = (int)CMSG_CONTENTLEN(inmsg) / sizeof (int);
+
+			for (i = 0; i < num; i++) {
+				char flags;
+				file_t *fp;
+
+				fp = getf(fds[i]);
+				if (fp == NULL) {
+					/*
+					 * It is possible that a received fd
+					 * will already have been closed if a
+					 * thread in the local process is
+					 * indiscriminately issuing close(2)
+					 * calls while the message is being
+					 * received.  If that is the case, no
+					 * further processing of the fd is
+					 * needed.  It will still be passed
+					 * up in the cmsg even though the
+					 * caller chose to close it already.
+					 */
+					continue;
+				}
+
+				flags = f_getfd(fds[i]);
+				flags |= FD_CLOEXEC;
+				f_setfd(fds[i], flags);
+				releasef(fds[i]);
+			}
+		}
+	}
+}
+
+static int
+lx_cmsg_try_ucred(sonode_t *so, struct nmsghdr *msg, socklen_t origlen)
+{
+	lx_socket_aux_data_t *sad;
+	struct cmsghdr *cmsg = NULL;
+	int msgsize;
+	cred_t *cred;
+
+	if (origlen == 0) {
+		return (0);
+	}
+	sad = lx_sad_acquire(SOTOV(so));
+	if ((sad->lxsad_flags & LXSAD_FL_STRCRED) == 0) {
+		mutex_exit(&sad->lxsad_lock);
+		return (0);
+	}
+	mutex_exit(&sad->lxsad_lock);
+
+	mutex_enter(&so->so_lock);
+	if (so->so_peercred == NULL) {
+		mutex_exit(&so->so_lock);
+		return (0);
+	}
+	crhold(cred = so->so_peercred);
+	mutex_exit(&so->so_lock);
+
+	msgsize = ucredminsize(cred) + sizeof (struct cmsghdr);
+	if (msg->msg_control == NULL) {
+		msg->msg_controllen = msgsize;
+		msg->msg_control = cmsg = kmem_zalloc(msgsize, KM_SLEEP);
+	} else {
+		/*
+		 * The so_recvmsg operation may have allocated a msg_control
+		 * buffer which precisely fits all returned cmsgs.  We must
+		 * manually verify the length of that cmsg data and reallocate
+		 * the buffer if it lacks the necessary space.
+		 */
+		uintptr_t start = (uintptr_t)msg->msg_control;
+		uintptr_t end = start + msg->msg_controllen;
+
+		ASSERT(msg->msg_controllen > 0);
+		cmsg = (struct cmsghdr *)msg->msg_control;
+		while (CMSG_VALID(cmsg, start, end) != 0) {
+			if (cmsg->cmsg_level == SOL_SOCKET &&
+			    cmsg->cmsg_type == SCM_UCRED) {
+				/*
+				 * If some later code change results in a ucred
+				 * being attached anyways, there is no need for
+				 * us to do it manually
+				 */
+				crfree(cred);
+				return (0);
+			}
+			cmsg = CMSG_NEXT(cmsg);
+		}
+		if (((uintptr_t)cmsg + msgsize) > end) {
+			socklen_t offset = (uintptr_t)cmsg - start;
+			socklen_t newsize = offset + msgsize;
+			void *newbuf;
+
+			if (newsize < msg->msg_controllen) {
+				/* size overflow, bail */
+				crfree(cred);
+				return (-1);
+			}
+			newbuf = kmem_alloc(newsize, KM_SLEEP);
+			bcopy(msg->msg_control, newbuf, msg->msg_controllen);
+			kmem_free(msg->msg_control, msg->msg_controllen);
+
+			msg->msg_control = newbuf;
+			msg->msg_controllen = newsize;
+			cmsg = (struct cmsghdr *)((uintptr_t)newbuf + offset);
+		}
+	}
+
+	cmsg->cmsg_level = SOL_SOCKET;
+	cmsg->cmsg_type = SCM_UCRED;
+	cmsg->cmsg_len = msgsize;
+	(void) cred2ucred(cred, so->so_cpid, CMSG_CONTENT(cmsg), CRED());
+	crfree(cred);
+	return (0);
+}
+
+static lx_socket_aux_data_t *
+lx_sad_acquire(vnode_t *vp)
+{
+	lx_socket_aux_data_t *cur, *created;
+
+	mutex_enter(&vp->v_vsd_lock);
+	cur = (lx_socket_aux_data_t *)vsd_get(vp, lx_socket_vsd);
+	if (cur == NULL) {
+		/* perform our allocation carefully */
+		mutex_exit(&vp->v_vsd_lock);
+
+		created = (lx_socket_aux_data_t *)kmem_zalloc(
+		    sizeof (*created), KM_SLEEP);
+
+		mutex_enter(&vp->v_vsd_lock);
+		cur = (lx_socket_aux_data_t *)vsd_get(vp, lx_socket_vsd);
+		if (cur == NULL) {
+			mutex_init(&created->lxsad_lock, NULL, MUTEX_DEFAULT,
+			    NULL);
+			(void) vsd_set(vp, lx_socket_vsd, created);
+			cur = created;
+		} else {
+			kmem_free(created, sizeof (*created));
+		}
+	}
+	mutex_exit(&vp->v_vsd_lock);
+	mutex_enter(&cur->lxsad_lock);
+	return (cur);
+}
+
+static int
+lx_convert_pkt_proto(int protocol)
+{
+	switch (ntohs(protocol)) {
+	case LX_ETH_P_802_2:
+		return (ETH_P_802_2);
+	case LX_ETH_P_IP:
+		return (ETH_P_IP);
+	case LX_ETH_P_ARP:
+		return (ETH_P_ARP);
+	case LX_ETH_P_IPV6:
+		return (ETH_P_IPV6);
+	case LX_ETH_P_ALL:
+	case LX_ETH_P_802_3:
+		return (ETH_P_ALL);
+	default:
+		return (-1);
+	}
+}
+
+static int
+lx_convert_sock_args(int in_dom, int in_type, int in_proto, int *out_dom,
+    int *out_type, int *out_options, int *out_proto)
+{
+	int domain, type, options;
+
+	if (in_dom < 0 || in_type < 0 || in_proto < 0)
+		return (EINVAL);
+
+	domain = LTOS_FAMILY(in_dom);
+	if (domain == AF_NOTSUPPORTED || domain == AF_UNSPEC)
+		return (EAFNOSUPPORT);
+	if (domain == AF_INVAL)
+		return (EINVAL);
+
+	type = LTOS_SOCKTYPE(in_type & LX_SOCK_TYPE_MASK);
+	if (type == SOCK_INVAL)
+		return (EINVAL);
+	/*
+	 * Linux does not allow the app to specify IP Protocol for raw sockets.
+	 * SunOS does, so bail out here.
+	 */
+	if (type == SOCK_NOTSUPPORTED ||
+	    (domain == AF_INET && type == SOCK_RAW && in_proto == IPPROTO_IP)) {
+		if (lx_kern_release_cmp(curzone, "2.6.15") < 0) {
+			/*
+			 * Use error appropriate for kernel version.
+			 * See lx_socket_create for more detail.
+			 */
+			return (ESOCKTNOSUPPORT);
+		}
+		return (EPROTONOSUPPORT);
+	}
+
+	options = 0;
+	in_type &= ~(LX_SOCK_TYPE_MASK);
+	if (in_type & LX_SOCK_NONBLOCK) {
+		in_type ^= LX_SOCK_NONBLOCK;
+		options |= SOCK_NONBLOCK;
+	}
+	if (in_type & LX_SOCK_CLOEXEC) {
+		in_type ^= LX_SOCK_CLOEXEC;
+		options |= SOCK_CLOEXEC;
+	}
+	if (in_type != 0) {
+		return (EINVAL);
+	}
+
+	/* Protocol definitions for PF_PACKET differ between Linux and SunOS */
+	if (domain == PF_PACKET &&
+	    (in_proto = lx_convert_pkt_proto(in_proto)) < 0)
+		return (EINVAL);
+
+	*out_dom = domain;
+	*out_type = type;
+	*out_options = options;
+	*out_proto = in_proto;
+	return (0);
+}
+
+/*
+ * For restartable socket syscall handling, the relevant syscalls are only
+ * restarted when a timeout is not set on the socket.
+ */
+static void
+lx_sock_syscall_restart(sonode_t *so, boolean_t recv)
+{
+	if (recv) {
+		if (so->so_rcvtimeo != 0)
+			return;
+	} else {
+		if (so->so_sndtimeo != 0)
+			return;
+	}
+
+	ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+}
+
+static int
+lx_socket_create(int domain, int type, int protocol, int options, file_t **fpp,
+    int *fdp)
+{
+	sonode_t *so;
+	vnode_t *vp;
+	file_t *fp;
+	int err, fd;
+
+	/* logic cloned from so_socket */
+	so = socket_create(domain, type, protocol, NULL, NULL, SOCKET_SLEEP,
+	    SOV_DEFAULT, CRED(), &err);
+
+	if (so == NULL) {
+		switch (err) {
+		case EPROTOTYPE:
+		case EPROTONOSUPPORT:
+			if (lx_kern_release_cmp(curzone, "2.6.15") < 0) {
+				/*
+				 * Linux changed its socket error behavior in
+				 * versions 2.6.15 and later.  See git commit
+				 * 86c8f9d158f68538a971a47206a46a22c7479bac in
+				 * the Linux repository.
+				 *
+				 * LTP presently checks for version 2.6.16.
+				 */
+				return (ESOCKTNOSUPPORT);
+			}
+			return (EPROTONOSUPPORT);
+		default:
+			return (err);
+		}
+	}
+
+	/* Allocate a file descriptor for the socket */
+	vp = SOTOV(so);
+	if ((err = falloc(vp, FWRITE|FREAD, &fp, &fd)) != 0) {
+		(void) socket_close(so, 0, CRED());
+		socket_destroy(so);
+		return (err);
+	}
+
+	/*
+	 * Linux programs do not tolerate errors appearing from asynchronous
+	 * events (such as ICMP messages arriving).  Setting SM_DEFERERR will
+	 * prevent checking/delivery of such errors.
+	 */
+	so->so_mode |= SM_DEFERERR;
+
+	/* Now fill in the entries that falloc reserved */
+	if (options & SOCK_NONBLOCK) {
+		so->so_state |= SS_NONBLOCK;
+		fp->f_flag |= FNONBLOCK;
+	}
+	mutex_exit(&fp->f_tlock);
+	*fpp = fp;
+	*fdp = fd;
+	return (0);
+}
+
+static void
+lx_socket_destroy(file_t *fp, int fd)
+{
+	sonode_t *so = VTOSO(fp->f_vnode);
+
+	setf(fd, NULL);
+
+	mutex_enter(&fp->f_tlock);
+	unfalloc(fp);
+
+	(void) socket_close(so, 0, CRED());
+	socket_destroy(so);
+}
+
+long
+lx_socket(int domain, int type, int protocol)
+{
+	int error, options, fd = -1;
+	file_t *fp = NULL;
+
+	if ((error = lx_convert_sock_args(domain, type, protocol, &domain,
+	    &type, &options, &protocol)) != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_socket_create(domain, type, protocol, options, &fp, &fd);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	setf(fd, fp);
+	if ((options & SOCK_CLOEXEC) != 0) {
+		f_setfd(fd, FD_CLOEXEC);
+	}
+	return (fd);
+}
+
+long
+lx_bind(long sock, uintptr_t name, socklen_t namelen)
+{
+	struct sonode *so;
+	struct sockaddr *addr = NULL;
+	socklen_t len = 0;
+	file_t *fp;
+	int error;
+	lx_sun_type_t sun_type;
+	boolean_t not_sock = B_FALSE;
+
+	if ((so = getsonode(sock, &error, &fp)) == NULL) {
+		return (set_errno(error));
+	}
+
+	if (namelen != 0) {
+		error = ltos_sockaddr_copyin((struct sockaddr *)name, namelen,
+		    &addr, &len, &sun_type);
+		if (error != 0) {
+			releasef(sock);
+			return (set_errno(error));
+		}
+	}
+
+	if (addr != NULL && addr->sa_family == AF_UNIX) {
+		vnode_t *vp;
+
+		error = so_ux_lookup(so, (struct sockaddr_un *)addr, B_TRUE,
+		    &vp);
+		if (error == 0) {
+			/* A valid socket exists and is open at this address. */
+			VN_RELE(vp);
+		} else {
+			/* Keep track of paths which are not valid sockets. */
+			if (error == ENOTSOCK) {
+				not_sock = B_TRUE;
+			}
+
+			/*
+			 * When binding to an abstract namespace address or
+			 * /dev/log, implicit clean-up must occur if there is
+			 * not a valid socket at the specififed address.  See
+			 * ltos_sockaddr_copyin for details about why these
+			 * socket types act differently.
+			 */
+			if (sun_type == LX_SUN_ABSTRACT) {
+				(void) vn_removeat(NULL, addr->sa_data,
+				    UIO_SYSSPACE, RMFILE);
+			}
+		}
+	}
+
+	error = socket_bind(so, addr, len, _SOBIND_XPG4_2, CRED());
+
+	/*
+	 * Linux returns EADDRINUSE for attempts to bind to Unix domain
+	 * sockets that aren't sockets.
+	 */
+	if (error == EINVAL && addr != NULL && addr->sa_family == AF_UNIX &&
+	    not_sock == B_TRUE) {
+		error = EADDRINUSE;
+	}
+
+	releasef(sock);
+
+	if (addr != NULL) {
+		kmem_free(addr, len);
+	}
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_connect(long sock, uintptr_t name, socklen_t namelen)
+{
+	struct sonode *so;
+	struct sockaddr *addr = NULL;
+	lx_socket_aux_data_t *sad = NULL;
+	socklen_t len = 0;
+	file_t *fp;
+	int error;
+
+	if ((so = getsonode(sock, &error, &fp)) == NULL) {
+		return (set_errno(error));
+	}
+
+	/*
+	 * Ensure the name is sized appropriately before we alloc memory and
+	 * copy it in from userspace.  We need at least the address family to
+	 * make later sizing decisions.
+	 */
+	if (namelen != 0) {
+		error = ltos_sockaddr_copyin((struct sockaddr *)name, namelen,
+		    &addr, &len, NULL);
+		if (error != 0) {
+			releasef(sock);
+			return (set_errno(error));
+		}
+	}
+
+	error = socket_connect(so, addr, len, fp->f_flag,
+	    _SOCONNECT_XPG4_2, CRED());
+
+	if (error == EINTR)
+		lx_sock_syscall_restart(so, B_FALSE);
+
+	/*
+	 * Linux connect(2) behavior is rather strange when using the
+	 * O_NONBLOCK flag.  The first call will return EINPROGRESS, as
+	 * expected.  Provided that is successful, a second call to connect
+	 * will return 0 instead of EISCONN.  Subsequent connect calls will
+	 * return EISCONN.
+	 */
+	if ((fp->f_flag & FNONBLOCK) != 0 && error != 0) {
+		sad = lx_sad_acquire(SOTOV(so));
+		if (error == EISCONN &&
+		    sad->lxsad_status == LXSS_CONNECTING) {
+			/* Report the one success */
+			sad->lxsad_status = LXSS_CONNECTED;
+			error = 0;
+		} else if (error == EINPROGRESS) {
+			sad->lxsad_status = LXSS_CONNECTING;
+		}
+		mutex_exit(&sad->lxsad_lock);
+	}
+
+	/*
+	 * When connecting to a UDP socket, configure it so that future
+	 * sendto/sendmsg operations are allowed to specify a destination
+	 * address. See the Posix spec. for sendto(2). Linux allows this while
+	 * illumos would return EISCONN if the option is not set.
+	 */
+	if (error == 0 && so->so_protocol == IPPROTO_UDP &&
+	    (so->so_family == AF_INET || so->so_family == AF_INET6)) {
+		int val = 1;
+
+		DTRACE_PROBE(lx__connect__udp);
+		(void) socket_setsockopt(so, IPPROTO_UDP, UDP_SND_TO_CONNECTED,
+		    &val, sizeof (val), CRED());
+	}
+
+	releasef(sock);
+
+	if (addr != NULL) {
+		kmem_free(addr, len);
+	}
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+/*
+ * Custom version of socket_recvmsg for error-handling overrides.
+ */
+static int
+lx_socket_recvmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
+    cred_t *cr)
+{
+	int error;
+	ssize_t orig_resid = uiop->uio_resid;
+
+	/*
+	 * Do not bypass the cache when reading data, as the application
+	 * is likely to access the data shortly.
+	 */
+	uiop->uio_extflg |= UIO_COPY_CACHED;
+
+	error = SOP_RECVMSG(so, msg, uiop, cr);
+
+	switch (error) {
+	case EINTR:
+	/* EAGAIN is EWOULDBLOCK */
+	case EWOULDBLOCK:
+		/* We did a partial read */
+		if (uiop->uio_resid != orig_resid)
+			error = 0;
+		break;
+	case ENOTCONN:
+		/*
+		 * The rules are different for non-blocking sockets which are
+		 * still in the process of making a connection
+		 */
+		if ((msg->msg_flags & MSG_DONTWAIT) != 0 ||
+		    (uiop->uio_fmode & (FNONBLOCK|FNDELAY)) != 0) {
+			error = EAGAIN;
+		}
+		break;
+	default:
+		break;
+	}
+	return (error);
+}
+
+static long
+lx_recv_common(int sock, struct nmsghdr *msg, xuio_t *xuiop, int flags,
+    void *namelenp, void *controllenp, void *flagsp)
+{
+	struct sonode *so;
+	file_t *fp;
+	void *name;
+	socklen_t namelen;
+	void *control;
+	socklen_t controllen;
+	ssize_t len;
+	int error;
+	boolean_t fd_cloexec;
+	boolean_t is_peek_trunc;
+
+	if ((so = getsonode(sock, &error, &fp)) == NULL) {
+		return (set_errno(error));
+	}
+
+	fd_cloexec = ((flags & LX_MSG_CMSG_CLOEXEC) != 0);
+	flags = lx_xlate_sock_flags(flags, LX_TO_SUNOS);
+	is_peek_trunc = (flags & (MSG_PEEK|MSG_TRUNC)) == (MSG_PEEK|MSG_TRUNC);
+	len = xuiop->xu_uio.uio_resid;
+	xuiop->xu_uio.uio_fmode = fp->f_flag;
+	xuiop->xu_uio.uio_extflg = UIO_COPY_CACHED;
+
+	/*
+	 * Linux accepts MSG_TRUNC as an input flag, unlike SunOS and many
+	 * other UNIX distributions.  When combined with MSG_PEEK, it causes
+	 * recvmsg to return the size of the waiting message, regardless of
+	 * buffer size.  This behavior is commonly used with a 0-length buffer
+	 * to interrogate the size of a queued message prior to allocating a
+	 * buffer for it.
+	 *
+	 * In order to support this functionality, a custom XUIO type is used
+	 * to communicate the total message size out from the depths of sockfs.
+	 */
+	if (is_peek_trunc) {
+		xuiop->xu_uio.uio_extflg |= UIO_XUIO;
+		xuiop->xu_type = UIOTYPE_PEEKSIZE;
+		xuiop->xu_ext.xu_ps.xu_ps_set = B_FALSE;
+		xuiop->xu_ext.xu_ps.xu_ps_size = 0;
+	}
+
+	name = msg->msg_name;
+	namelen = msg->msg_namelen;
+	control = msg->msg_control;
+	controllen = msg->msg_controllen;
+
+	/*
+	 * socket_recvmsg will allocate these if needed.
+	 * NULL them out to prevent any confusion.
+	 */
+	msg->msg_name = NULL;
+	msg->msg_control = NULL;
+
+	msg->msg_flags = flags & (MSG_OOB | MSG_PEEK | MSG_WAITALL |
+	    MSG_DONTWAIT);
+	/* Default to XPG4.2 operation */
+	msg->msg_flags |= MSG_XPG4_2;
+
+	error = lx_socket_recvmsg(so, msg, (struct uio *)xuiop, CRED());
+	if (error) {
+		if (error == EINTR)
+			lx_sock_syscall_restart(so, B_TRUE);
+		releasef(sock);
+		return (set_errno(error));
+	}
+	lwp_stat_update(LWP_STAT_MSGRCV, 1);
+	releasef(sock);
+
+	if (namelen != 0) {
+		error = stol_sockaddr_copyout(msg->msg_name, msg->msg_namelen,
+		    name, namelenp, namelen);
+
+		if (msg->msg_namelen != 0) {
+			kmem_free(msg->msg_name, (size_t)msg->msg_namelen);
+			msg->msg_namelen = 0;
+		}
+
+		/*
+		 * Errors during copyout of the name are not a concern to Linux
+		 * callers at this point in the syscall
+		 */
+		if (error != 0 && error != EFAULT) {
+			goto err;
+		}
+	}
+
+	if (controllen != 0) {
+		if (fd_cloexec) {
+			/*
+			 * If CLOEXEC needs to set on file descriptors passed
+			 * via SCM_RIGHTS, do so before formatting the cmsgs
+			 * for Linux.
+			 */
+			lx_cmsg_set_cloexec(msg->msg_control,
+			    msg->msg_controllen);
+		}
+		if (so->so_family == AF_UNIX &&
+		    (so->so_mode & SM_CONNREQUIRED) != 0) {
+			/*
+			 * It may be necessary to append a SCM_UCRED cmsg to
+			 * the controls if SO_PASSCRED is set on a
+			 * connection-oriented AF_UNIX socket.
+			 *
+			 * See lx_setsockopt_socket for more details.
+			 */
+			if (lx_cmsg_try_ucred(so, msg, controllen) != 0) {
+				msg->msg_flags |= MSG_CTRUNC;
+			}
+		}
+
+		error = stol_cmsgs_copyout(msg->msg_control,
+		    msg->msg_controllen, control, controllenp, controllen);
+
+		if (error != 0) {
+			/*
+			 * If there was an error during cmsg translation or
+			 * copyout, we need to clean up any FDs that are being
+			 * passed back via SCM_RIGHTS.  This prevents us from
+			 * leaking those open files.
+			 */
+			so_closefds(msg->msg_control, msg->msg_controllen, 0,
+			    0);
+
+			/*
+			 * An error during cmsg_copyout means we had
+			 * _something_ to process.
+			 */
+			VERIFY(msg->msg_controllen != 0);
+
+			kmem_free(msg->msg_control,
+			    (size_t)msg->msg_controllen);
+			msg->msg_controllen = 0;
+
+			if (error == EMSGSIZE) {
+				/* Communicate that messages were truncated */
+				msg->msg_flags |= MSG_CTRUNC;
+				error = 0;
+			} else {
+				goto err;
+			}
+		} else if (msg->msg_controllen != 0) {
+			kmem_free(msg->msg_control,
+			    (size_t)msg->msg_controllen);
+			msg->msg_controllen = 0;
+		}
+	}
+
+	if (flagsp != NULL) {
+		int flags;
+
+		/* Clear internal flag. */
+		flags = msg->msg_flags & ~MSG_XPG4_2;
+		flags = lx_xlate_sock_flags(flags, SUNOS_TO_LX);
+
+		if (copyout(&flags, flagsp, sizeof (flags) != 0)) {
+			error = EFAULT;
+			goto err;
+		}
+	}
+
+	/*
+	 * If both MSG_PEEK|MSG_TRUNC were set on the input flags and the
+	 * socket layer was able to calculate the total message size for us,
+	 * return that instead of the copied size.
+	 */
+	if (is_peek_trunc && xuiop->xu_ext.xu_ps.xu_ps_set == B_TRUE) {
+		return (xuiop->xu_ext.xu_ps.xu_ps_size);
+	}
+
+	return (len - xuiop->xu_uio.uio_resid);
+
+err:
+	if (msg->msg_controllen != 0) {
+		/* Prevent FD leakage (see above) */
+		so_closefds(msg->msg_control, msg->msg_controllen, 0, 0);
+		kmem_free(msg->msg_control, (size_t)msg->msg_controllen);
+	}
+	if (msg->msg_namelen != 0) {
+		kmem_free(msg->msg_name, (size_t)msg->msg_namelen);
+	}
+	return (set_errno(error));
+}
+
+long
+lx_recv(int sock, void *buffer, size_t len, int flags)
+{
+	struct nmsghdr smsg;
+	xuio_t xuio;
+	struct iovec uiov;
+
+	if ((ssize_t)len < 0) {
+		/*
+		 * The input len is unsigned, so limit it to SSIZE_MAX since
+		 * the return value is signed.
+		 */
+		return (set_errno(EINVAL));
+	}
+
+	uiov.iov_base = buffer;
+	uiov.iov_len = len;
+	xuio.xu_uio.uio_loffset = 0;
+	xuio.xu_uio.uio_iov = &uiov;
+	xuio.xu_uio.uio_iovcnt = 1;
+	xuio.xu_uio.uio_resid = len;
+	xuio.xu_uio.uio_segflg = UIO_USERSPACE;
+	xuio.xu_uio.uio_limit = 0;
+
+	smsg.msg_namelen = 0;
+	smsg.msg_controllen = 0;
+	smsg.msg_flags = 0;
+	return (lx_recv_common(sock, &smsg, &xuio, flags, NULL, NULL, NULL));
+}
+
+long
+lx_recvfrom(int sock, void *buffer, size_t len, int flags,
+    struct sockaddr *srcaddr, socklen_t *addrlenp)
+{
+	struct nmsghdr smsg;
+	xuio_t xuio;
+	struct iovec uiov;
+
+	if ((ssize_t)len < 0) {
+		/* Keep len reasonably limited (see lx_recv) */
+		return (set_errno(EINVAL));
+	}
+
+	uiov.iov_base = buffer;
+	uiov.iov_len = len;
+	xuio.xu_uio.uio_loffset = 0;
+	xuio.xu_uio.uio_iov = &uiov;
+	xuio.xu_uio.uio_iovcnt = 1;
+	xuio.xu_uio.uio_resid = len;
+	xuio.xu_uio.uio_segflg = UIO_USERSPACE;
+	xuio.xu_uio.uio_limit = 0;
+
+	smsg.msg_name = (char *)srcaddr;
+	if (addrlenp != NULL && srcaddr != NULL) {
+		/*
+		 * Despite addrlenp being defined as a socklen_t *, Linux
+		 * treats it internally as an int *.  Certain LTP tests depend
+		 * upon this behavior, so we must emulate it as well.
+		 */
+		int namelen;
+
+		if (copyin(addrlenp, &namelen, sizeof (namelen)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		if (namelen < 0) {
+			return (set_errno(EINVAL));
+		}
+		smsg.msg_namelen = namelen;
+	} else {
+		smsg.msg_namelen = 0;
+	}
+	smsg.msg_controllen = 0;
+	smsg.msg_flags = 0;
+
+	return (lx_recv_common(sock, &smsg, &xuio, flags, addrlenp, NULL,
+	    NULL));
+}
+
+long
+lx_recvmsg(int sock, void *msg, int flags)
+{
+	struct nmsghdr smsg;
+	xuio_t xuio;
+	struct iovec luiov[IOV_MAX_STACK], *uiov;
+	int i, iovcnt, iovsize;
+	long res;
+	ssize_t len = 0;
+	void *namelenp, *controllenp, *flagsp;
+
+#if defined(_LP64)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		lx_msghdr32_t lmsg32;
+		if (copyin(msg, &lmsg32, sizeof (lmsg32)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		smsg.msg_name = (void *)(uintptr_t)lmsg32.msg_name;
+		smsg.msg_namelen = lmsg32.msg_namelen;
+		smsg.msg_iov = (struct iovec *)(uintptr_t)lmsg32.msg_iov;
+		smsg.msg_iovlen = lmsg32.msg_iovlen;
+		smsg.msg_control = (void *)(uintptr_t)lmsg32.msg_control;
+		smsg.msg_controllen = lmsg32.msg_controllen;
+		smsg.msg_flags = lmsg32.msg_flags;
+
+		namelenp = &((lx_msghdr32_t *)msg)->msg_namelen;
+		controllenp = &((lx_msghdr32_t *)msg)->msg_controllen;
+		flagsp = &((lx_msghdr32_t *)msg)->msg_flags;
+	} else
+#endif /* defined(_LP64) */
+	{
+		lx_msghdr_t lmsg;
+		if (copyin(msg, &lmsg, sizeof (lmsg)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		smsg.msg_name = lmsg.msg_name;
+		smsg.msg_namelen = lmsg.msg_namelen;
+		smsg.msg_iov = lmsg.msg_iov;
+		smsg.msg_iovlen = lmsg.msg_iovlen;
+		smsg.msg_control = lmsg.msg_control;
+		smsg.msg_controllen = lmsg.msg_controllen;
+		smsg.msg_flags = lmsg.msg_flags;
+
+		namelenp = &((lx_msghdr_t *)msg)->msg_namelen;
+		controllenp = &((lx_msghdr_t *)msg)->msg_controllen;
+		flagsp = &((lx_msghdr_t *)msg)->msg_flags;
+	}
+
+	iovcnt = smsg.msg_iovlen;
+	if (iovcnt < 0 || iovcnt > IOV_MAX) {
+		return (set_errno(EMSGSIZE));
+	}
+	if (iovcnt > IOV_MAX_STACK) {
+		iovsize = iovcnt * sizeof (struct iovec);
+		uiov = kmem_alloc(iovsize, KM_SLEEP);
+	} else if (iovcnt > 0) {
+		iovsize = 0;
+		uiov = luiov;
+	} else {
+		iovsize = 0;
+		uiov = NULL;
+		goto noiov;
+	}
+
+#if defined(_LP64)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		/* convert from 32bit iovec structs */
+		struct iovec32 luiov32[IOV_MAX_STACK], *uiov32;
+		ssize_t iov32size;
+		ssize32_t count32;
+
+		iov32size = iovcnt * sizeof (struct iovec32);
+		if (iovsize != 0) {
+			uiov32 = kmem_alloc(iov32size, KM_SLEEP);
+		} else {
+			uiov32 = luiov32;
+		}
+
+		if (copyin((struct iovec32 *)smsg.msg_iov, uiov32, iov32size)) {
+			if (iovsize != 0) {
+				kmem_free(uiov32, iov32size);
+				kmem_free(uiov, iovsize);
+			}
+
+			return (set_errno(EFAULT));
+		}
+
+		count32 = 0;
+		for (i = 0; i < iovcnt; i++) {
+			ssize32_t iovlen32;
+
+			iovlen32 = uiov32[i].iov_len;
+			count32 += iovlen32;
+			if (iovlen32 < 0 || count32 < 0) {
+				if (iovsize != 0) {
+					kmem_free(uiov32, iov32size);
+					kmem_free(uiov, iovsize);
+				}
+
+				return (set_errno(EINVAL));
+			}
+
+			uiov[i].iov_len = iovlen32;
+			uiov[i].iov_base =
+			    (caddr_t)(uintptr_t)uiov32[i].iov_base;
+		}
+		len = count32;
+
+		if (iovsize != 0) {
+			kmem_free(uiov32, iov32size);
+		}
+	} else
+#endif /* defined(_LP64) */
+	{
+		if (copyin(smsg.msg_iov, uiov,
+		    iovcnt * sizeof (struct iovec)) != 0) {
+			if (iovsize != 0) {
+				kmem_free(uiov, iovsize);
+			}
+			return (set_errno(EFAULT));
+		}
+
+		len = 0;
+		for (i = 0; i < iovcnt; i++) {
+			ssize_t iovlen = uiov[i].iov_len;
+			len += iovlen;
+			if (iovlen < 0 || len < 0) {
+				if (iovsize != 0) {
+					kmem_free(uiov, iovsize);
+				}
+				return (set_errno(EINVAL));
+			}
+		}
+	}
+
+noiov:
+	/* Since the iovec is passed via the uio, NULL it out in the msg */
+	smsg.msg_iov = NULL;
+
+	xuio.xu_uio.uio_loffset = 0;
+	xuio.xu_uio.uio_iov = uiov;
+	xuio.xu_uio.uio_iovcnt = iovcnt;
+	xuio.xu_uio.uio_resid = len;
+	xuio.xu_uio.uio_segflg = UIO_USERSPACE;
+	xuio.xu_uio.uio_limit = 0;
+
+	res = lx_recv_common(sock, &smsg, &xuio, flags, namelenp, controllenp,
+	    flagsp);
+
+	if (iovsize != 0) {
+		kmem_free(uiov, iovsize);
+	}
+
+	return (res);
+}
+
+/*
+ * Custom version of socket_sendmsg for error-handling overrides.
+ */
+static int
+lx_socket_sendmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
+    cred_t *cr, boolean_t nosig)
+{
+	int error = 0;
+	ssize_t orig_resid = uiop->uio_resid;
+
+	/*
+	 * Do not bypass the cache if we are doing a local (AF_UNIX) write.
+	 */
+	if (so->so_family == AF_UNIX) {
+		uiop->uio_extflg |= UIO_COPY_CACHED;
+	} else {
+		uiop->uio_extflg &= ~UIO_COPY_CACHED;
+	}
+
+	error = SOP_SENDMSG(so, msg, uiop, cr);
+
+	switch (error) {
+	case EINTR:
+	case ENOMEM:
+	/* EAGAIN is EWOULDBLOCK */
+	case EWOULDBLOCK:
+		/* We did a partial send */
+		if (uiop->uio_resid != orig_resid) {
+			error = 0;
+		}
+		break;
+
+	case ENOTCONN:
+		/*
+		 * The rules are different for non-blocking sockets which are
+		 * still in the process of making a connection
+		 */
+		if ((msg->msg_flags & MSG_DONTWAIT) != 0 ||
+		    (uiop->uio_fmode & (FNONBLOCK|FNDELAY)) != 0) {
+			error = EAGAIN;
+			break;
+		}
+
+		/* Appease LTP and match behavior detailed in the man page */
+		error = EPIPE;
+		/* FALLTHROUGH */
+	case EPIPE:
+		if (nosig == B_FALSE) {
+			tsignal(curthread, SIGPIPE);
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static long
+lx_send_common(int sock, struct nmsghdr *msg, struct uio *uiop, int flags)
+{
+	struct sonode *so;
+	file_t *fp;
+	struct sockaddr *name = NULL;
+	socklen_t namelen;
+	void *control = NULL;
+	socklen_t controllen;
+	ssize_t len = 0;
+	int error;
+	boolean_t nosig;
+
+	if ((so = getsonode(sock, &error, &fp)) == NULL) {
+		return (set_errno(error));
+	}
+
+	uiop->uio_fmode = fp->f_flag;
+
+	/* Allocate and copyin name and control */
+	if (msg->msg_name != NULL && msg->msg_namelen != 0) {
+		ASSERT(MUTEX_NOT_HELD(&so->so_lock));
+
+		error = ltos_sockaddr_copyin((struct sockaddr *)msg->msg_name,
+		    msg->msg_namelen, &name, &namelen, NULL);
+		if (error != 0) {
+			goto done;
+		}
+		/* copyin_name null terminates addresses for AF_UNIX */
+		msg->msg_namelen = namelen;
+		msg->msg_name = name;
+	} else {
+		msg->msg_name = name = NULL;
+		msg->msg_namelen = namelen = 0;
+	}
+
+	if (msg->msg_control != NULL && msg->msg_controllen != 0) {
+		/*
+		 * Verify that the length is not excessive to prevent
+		 * an application from consuming all of kernel memory.
+		 */
+		if (msg->msg_controllen > SO_MAXARGSIZE) {
+			error = EINVAL;
+			goto done;
+		}
+		if ((error = ltos_cmsgs_copyin(msg->msg_control,
+		    msg->msg_controllen, &control, &controllen)) != 0) {
+			goto done;
+		}
+		msg->msg_control = control;
+		msg->msg_controllen = controllen;
+	} else {
+		msg->msg_control = control = NULL;
+		msg->msg_controllen = controllen = 0;
+	}
+
+	len = uiop->uio_resid;
+	msg->msg_flags = lx_xlate_sock_flags(flags, LX_TO_SUNOS);
+	/* Default to XPG4.2 operation */
+	msg->msg_flags |= MSG_XPG4_2;
+	nosig = ((flags & LX_MSG_NOSIGNAL) != 0);
+
+	error = lx_socket_sendmsg(so, msg, uiop, CRED(), nosig);
+	if (error == EINTR)
+		lx_sock_syscall_restart(so, B_FALSE);
+done:
+	if (control != NULL) {
+		kmem_free(control, controllen);
+	}
+	if (name != NULL) {
+		kmem_free(name, namelen);
+	}
+	if (error != 0) {
+		releasef(sock);
+		return (set_errno(error));
+	}
+	lwp_stat_update(LWP_STAT_MSGSND, 1);
+	releasef(sock);
+	return (len - uiop->uio_resid);
+}
+
+/*
+ * For both send and sendto Linux evaluates errors in a different order than
+ * we do internally. Specifically it will check the buffer address before
+ * checking if the socket is connected. This can lead to a different errno on
+ * us vs. Linux (seen with LTP) but we don't bother to emulate this.
+ */
+long
+lx_send(int sock, void *buffer, size_t len, int flags)
+{
+	struct nmsghdr smsg;
+	struct uio auio;
+	struct iovec aiov[1];
+
+	if ((ssize_t)len < 0) {
+		/* Keep len reasonably limited (see lx_recv) */
+		return (set_errno(EINVAL));
+	}
+
+	aiov[0].iov_base = buffer;
+	aiov[0].iov_len = len;
+	auio.uio_loffset = 0;
+	auio.uio_iov = aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_resid = len;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_limit = 0;
+
+	smsg.msg_name = NULL;
+	smsg.msg_control = NULL;
+	return (lx_send_common(sock, &smsg, &auio, flags));
+}
+
+long
+lx_sendto(int sock, void *buffer, size_t len, int flags,
+    struct sockaddr *dstaddr, socklen_t addrlen)
+{
+	struct nmsghdr smsg;
+	struct uio auio;
+	struct iovec aiov[1];
+
+	if ((ssize_t)len < 0) {
+		/* Keep len reasonably limited (see lx_recv) */
+		return (set_errno(EINVAL));
+	}
+
+	aiov[0].iov_base = buffer;
+	aiov[0].iov_len = len;
+	auio.uio_loffset = 0;
+	auio.uio_iov = aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_resid = len;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_limit = 0;
+
+	smsg.msg_name = (char *)dstaddr;
+	smsg.msg_namelen = addrlen;
+	smsg.msg_control = NULL;
+	return (lx_send_common(sock, &smsg, &auio, flags));
+}
+
+long
+lx_sendmsg(int sock, void *msg, int flags)
+{
+	struct nmsghdr smsg;
+	struct uio auio;
+	struct iovec buf[IOV_MAX_STACK], *aiov;
+	int i, iovcnt, iovsize;
+	long res;
+	ssize_t len = 0;
+
+#if defined(_LP64)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		lx_msghdr32_t lmsg32;
+		if (copyin(msg, &lmsg32, sizeof (lmsg32)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		smsg.msg_name = (void *)(uintptr_t)lmsg32.msg_name;
+		smsg.msg_namelen = lmsg32.msg_namelen;
+		smsg.msg_iov = (struct iovec *)(uintptr_t)lmsg32.msg_iov;
+		smsg.msg_iovlen = lmsg32.msg_iovlen;
+		smsg.msg_control = (void *)(uintptr_t)lmsg32.msg_control;
+		smsg.msg_controllen = lmsg32.msg_controllen;
+		smsg.msg_flags = lmsg32.msg_flags;
+	} else
+#endif /* defined(_LP64) */
+	{
+		lx_msghdr_t lmsg;
+		if (copyin(msg, &lmsg, sizeof (lmsg)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		smsg.msg_name = lmsg.msg_name;
+		smsg.msg_namelen = lmsg.msg_namelen;
+		smsg.msg_iov = lmsg.msg_iov;
+		smsg.msg_iovlen = lmsg.msg_iovlen;
+		smsg.msg_control = lmsg.msg_control;
+		smsg.msg_controllen = lmsg.msg_controllen;
+		smsg.msg_flags = lmsg.msg_flags;
+	}
+
+	iovcnt = smsg.msg_iovlen;
+	if (iovcnt <= 0 || iovcnt > IOV_MAX) {
+		return (set_errno(EMSGSIZE));
+	}
+	if (iovcnt > IOV_MAX_STACK) {
+		iovsize = iovcnt * sizeof (struct iovec);
+		aiov = kmem_alloc(iovsize, KM_SLEEP);
+	} else {
+		iovsize = 0;
+		aiov = buf;
+	}
+
+#if defined(_LP64)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		/* convert from 32bit iovec structs */
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		ssize_t iov32size;
+		ssize32_t count32;
+
+		iov32size = iovcnt * sizeof (struct iovec32);
+		if (iovsize != 0) {
+			aiov32 = kmem_alloc(iov32size, KM_SLEEP);
+		}
+
+		if (copyin((struct iovec32 *)smsg.msg_iov, aiov32, iov32size)) {
+			if (iovsize != 0) {
+				kmem_free(aiov32, iov32size);
+				kmem_free(aiov, iovsize);
+			}
+
+			return (set_errno(EFAULT));
+		}
+
+		count32 = 0;
+		for (i = 0; i < iovcnt; i++) {
+			ssize32_t iovlen32;
+
+			iovlen32 = aiov32[i].iov_len;
+			count32 += iovlen32;
+			if (iovlen32 < 0 || count32 < 0) {
+				if (iovsize != 0) {
+					kmem_free(aiov32, iov32size);
+					kmem_free(aiov, iovsize);
+				}
+
+				return (set_errno(EINVAL));
+			}
+
+			aiov[i].iov_len = iovlen32;
+			aiov[i].iov_base =
+			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
+		}
+		len = count32;
+
+		if (iovsize != 0) {
+			kmem_free(aiov32, iov32size);
+		}
+	} else
+#endif /* defined(_LP64) */
+	{
+		if (copyin(smsg.msg_iov, aiov,
+		    iovcnt * sizeof (struct iovec)) != 0) {
+			if (iovsize != 0) {
+				kmem_free(aiov, iovsize);
+			}
+			return (set_errno(EFAULT));
+		}
+
+		len = 0;
+		for (i = 0; i < iovcnt; i++) {
+			ssize_t iovlen = aiov[i].iov_len;
+
+			len += iovlen;
+			if (iovlen < 0 || len < 0) {
+				if (iovsize != 0) {
+					kmem_free(aiov, iovsize);
+				}
+				return (set_errno(EINVAL));
+			}
+		}
+	}
+	/* Since the iovec is passed via the uio, NULL it out in the msg */
+	smsg.msg_iov = NULL;
+
+	auio.uio_loffset = 0;
+	auio.uio_iov = aiov;
+	auio.uio_iovcnt = iovcnt;
+	auio.uio_resid = len;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_limit = 0;
+
+	res = lx_send_common(sock, &smsg, &auio, flags);
+
+	if (iovsize != 0) {
+		kmem_free(aiov, iovsize);
+	}
+
+	return (res);
+}
+
+/*
+ * Linux socket option type definitions
+ *
+ * The protocol `levels` are well defined (see in.h) The option values are
+ * not so well defined. Linux often uses different values vs. Illumos
+ * although they mean the same thing. For example, IP_TOS in Linux is
+ * defined as value 1 but in Illumos it is defined as value 3. This table
+ * maps all the Protocol levels to their options and maps them between
+ * Linux and Illumos and vice versa.  Hence the reason for the complexity.
+ *
+ * For a certain subset of sockopts, Linux will implicitly truncate optval
+ * input, so long as optlen meets a minimum size.  Because illumos is strict
+ * about optlen, we must cap optlen for those options.
+ */
+
+typedef struct lx_sockopt_map {
+	const int lsm_opt;	/* Illumos-native equivalent */
+	const int lsm_lcap;	/* Cap optlen to this size. (Ignored if 0) */
+} lx_sockopt_map_t;
+
+typedef struct lx_proto_opts {
+	const lx_sockopt_map_t	*lpo_entries;	/* Linux->SunOS map entries */
+	unsigned int		lpo_max;	/* max entries in table */
+} lx_proto_opts_t;
+
+#define	OPTNOTSUP	-1	/* we don't support it */
+
+#define	PROTO_SOCKOPTS(opts)    \
+	{ (opts), sizeof ((opts)) / sizeof ((opts)[0]) }
+
+/* Shorten name so the columns can line up */
+#define	IP_MREQ_SZ	sizeof (struct ip_mreq)
+
+static const lx_sockopt_map_t ltos_ip_sockopts[LX_IP_UNICAST_IF + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ IP_TOS, sizeof (int) },		/* IP_TOS		*/
+	{ IP_TTL, sizeof (int) },		/* IP_TTL		*/
+	{ IP_HDRINCL, sizeof (int) },		/* IP_HDRINCL		*/
+	{ IP_OPTIONS, 0 },			/* IP_OPTIONS		*/
+	{ OPTNOTSUP, 0 },			/* IP_ROUTER_ALERT	*/
+	{ IP_RECVOPTS, sizeof (int) },		/* IP_RECVOPTS		*/
+	{ IP_RETOPTS, sizeof (int) },		/* IP_RETOPTS		*/
+	{ IP_PKTINFO, sizeof (int) },		/* IP_PKTINFO		*/
+	{ OPTNOTSUP, 0 },			/* IP_PKTOPTIONS	*/
+	{ OPTNOTSUP, 0 },			/* IP_MTUDISCOVER	*/
+	{ OPTNOTSUP, 0 },			/* IP_RECVERR		*/
+	{ IP_RECVTTL, sizeof (int) },		/* IP_RECVTTL		*/
+	{ OPTNOTSUP, 0 },			/* IP_RECVTOS		*/
+	{ OPTNOTSUP, 0 },			/* IP_MTU		*/
+	{ OPTNOTSUP, 0 },			/* IP_FREEBIND		*/
+	{ OPTNOTSUP, 0 },			/* IP_IPSEC_POLICY	*/
+	{ OPTNOTSUP, 0 },			/* IP_XFRM_POLICY	*/
+	{ OPTNOTSUP, 0 },			/* IP_PASSSEC		*/
+	{ OPTNOTSUP, 0 },			/* IP_TRANSPARENT	*/
+	{ OPTNOTSUP, 0 },			/* IP_ORIGDSTADDR	*/
+	{ OPTNOTSUP, 0 },			/* IP_MINTTL		*/
+	{ OPTNOTSUP, 0 },			/* IP_NODEFRAG		*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ IP_MULTICAST_IF, sizeof (int) },	/* IP_MULTICAST_IF	*/
+	{ IP_MULTICAST_TTL, sizeof (int) },	/* IP_MULTICAST_TTL	*/
+	{ IP_MULTICAST_LOOP, sizeof (int) },	/* IP_MULTICAST_LOOP	*/
+	{ IP_ADD_MEMBERSHIP, IP_MREQ_SZ },	/* IP_ADD_MEMBERSHIP	*/
+	{ IP_DROP_MEMBERSHIP, IP_MREQ_SZ },	/* IP_DROP_MEMBERSHIP	*/
+	{ IP_UNBLOCK_SOURCE, 0 },		/* IP_UNBLOCK_SOURCE	*/
+	{ IP_BLOCK_SOURCE, 0 },			/* IP_BLOCK_SOURCE	*/
+	{ IP_ADD_SOURCE_MEMBERSHIP, 0 },	/* IP_ADD_SOURCE_MEMBERSHIP */
+	{ OPTNOTSUP, 0 },			/* IP_DROP_SOURCE_MEMBERSHIP */
+	{ OPTNOTSUP, 0 },			/* IP_MSFILTER		*/
+	{ MCAST_JOIN_GROUP, 0 },		/* MCAST_JOIN_GROUP	*/
+	{ OPTNOTSUP, 0 },			/* MCAST_BLOCK_SOURCE	*/
+	{ OPTNOTSUP, 0 },			/* MCAST_UNBLOCK_SOURCE	*/
+	{ MCAST_LEAVE_GROUP, 0 },		/* MCAST_LEAVE_GROUP	*/
+	{ OPTNOTSUP, 0 },			/* MCAST_JOIN_SOURCE_GROUP */
+	{ OPTNOTSUP, 0 },			/* MCAST_LEAVE_SOURCE_GROUP */
+	{ OPTNOTSUP, 0 },			/* MCAST_MSFILTER	*/
+	{ OPTNOTSUP, 0 },			/* IP_MULTICAST_ALL	*/
+	{ OPTNOTSUP, 0 }			/* IP_UNICAST_IF	*/
+};
+
+/* Shorten name so the columns can line up */
+#define	IP6_MREQ_SZ	sizeof (struct ipv6_mreq)
+
+static const lx_sockopt_map_t ltos_ipv6_sockopts[LX_IPV6_TCLASS + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },			/* IPV6_ADDRFORM	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_2292PKTINFO	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_2292HOPOPTS	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_2292DSTOPTS	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_2292RTHDR	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_2292PKTOPTIONS	*/
+	{ IPV6_CHECKSUM, sizeof (int) },	/* IPV6_CHECKSUM	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_2292HOPLIMIT	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_NEXTHOP		*/
+	{ OPTNOTSUP, 0 },			/* IPV6_AUTHHDR		*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ IPV6_UNICAST_HOPS, sizeof (int) },	/* IPV6_UNICAST_HOPS	*/
+	{ IPV6_MULTICAST_IF, sizeof (int) },	/* IPV6_MULTICAST_IF	*/
+	{ IPV6_MULTICAST_HOPS, sizeof (int) },	/* IPV6_MULTICAST_HOPS	*/
+	{ IPV6_MULTICAST_LOOP, sizeof (int) },	/* IPV6_MULTICAST_LOOP	*/
+	{ IPV6_ADD_MEMBERSHIP, IP6_MREQ_SZ },	/* IPV6_JOIN_GROUP	*/
+	{ IPV6_DROP_MEMBERSHIP, IP6_MREQ_SZ },	/* IPV6_LEAVE_GROUP	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_ROUTER_ALERT	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_MTU_DISCOVER	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_MTU		*/
+	{ OPTNOTSUP, 0 },			/* IPV6_RECVERR		*/
+	{ IPV6_V6ONLY, sizeof (int) },		/* IPV6_V6ONLY		*/
+	{ OPTNOTSUP, 0 },			/* IPV6_JOIN_ANYCAST	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_LEAVE_ANYCAST	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_IPSEC_POLICY	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_XFRM_POLICY	*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ MCAST_JOIN_GROUP, 0 },		/* MCAST_JOIN_GROUP	*/
+	{ OPTNOTSUP, 0 },			/* MCAST_BLOCK_SOURCE	*/
+	{ OPTNOTSUP, 0 },			/* MCAST_UNBLOCK_SOURCE	*/
+	{ MCAST_LEAVE_GROUP, 0 },		/* MCAST_LEAVE_GROUP	*/
+	{ OPTNOTSUP, 0 },			/* MCAST_JOIN_SOURCE_GROUP */
+	{ OPTNOTSUP, 0 },			/* MCAST_LEAVE_SOURCE_GROUP */
+	{ OPTNOTSUP, 0 },			/* MCAST_MSFILTER	*/
+	{ IPV6_RECVPKTINFO, sizeof (int) },	/* IPV6_RECVPKTINFO	*/
+	{ IPV6_PKTINFO, 0 },			/* IPV6_PKTINFO		*/
+	{ IPV6_RECVHOPLIMIT, sizeof (int) },	/* IPV6_RECVHOPLIMIT	*/
+	{ IPV6_HOPLIMIT, 0 },			/* IPV6_HOPLIMIT	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_RECVHOPOPTS	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_HOPOPTS		*/
+	{ OPTNOTSUP, 0 },			/* IPV6_RTHDRDSTOPTS	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_RECVRTHDR	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_RTHDR		*/
+	{ OPTNOTSUP, 0 },			/* IPV6_RECVDSTOPTS	*/
+	{ OPTNOTSUP, 0 },			/* IPV6_DSTOPTS		*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },			/* IPV6_RECVTCLASS	*/
+	{ IPV6_TCLASS, sizeof (int) }		/* IPV6_TCLASS		*/
+};
+
+static const lx_sockopt_map_t ltos_icmpv6_sockopts[LX_ICMP6_FILTER + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ ICMP6_FILTER, 0 }	/* ICMP6_FILTER	*/
+};
+
+/*
+ * Options marked as "in code" in their comment are handled in the
+ * lx_setsockopt_tcp() and lx_getsockopt_tcp() functions.
+ *
+ * For the Linux TCP_SYNCNT option (the number of SYN retransmits) we emulate
+ * that by interpreting the two connection interval settings:
+ *    TCP_CONN_NOTIFY_THRESHOLD
+ *	tcp_first_ctimer_threshold = tcps->tcps_ip_notify_cinterval
+ *    TCP_CONN_ABORT_THRESHOLD
+ *	tcp_second_ctimer_threshold = tcps->tcps_ip_abort_cinterval
+ * The system (re)transmits a SYN and performs a doubling backoff from the
+ * first timer until it passes the second timer. We determine the SYN count
+ * from these two values. Normally it will be 5. Also see the TCPS_SYN_SENT
+ * case in tcp_timer(); a tcp_second_ctimer_threshold value of 0 means to
+ * retransmit SYN indefinitely.
+ *
+ * For the Linux TCP_USER_TIMEOUT option we use our TCP_ABORT_THRESHOLD since
+ * this seems to be the closest match. This value is the
+ * tcp_second_timer_threshold, which gets initialized to the
+ * tcp_ip_abort_interval value. The tunable guide describes this as:
+ *     For a given TCP connection, if TCP has been retransmitting for
+ *     tcp_ip_abort_interval period of time and it has not received any
+ *     acknowledgment from the other endpoint during this period, TCP closes
+ *     this connection.
+ * The value is in milliseconds, which matches TCP_USER_TIMEOUT.
+ */
+static const lx_sockopt_map_t ltos_tcp_sockopts[LX_TCP_NOTSENT_LOWAT + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ TCP_NODELAY, sizeof (int) },		/* TCP_NODELAY		*/
+	{ TCP_MAXSEG, sizeof (int) },		/* TCP_MAXSEG - in code	*/
+	{ TCP_CORK, sizeof (int) },		/* TCP_CORK		*/
+	{ TCP_KEEPIDLE, sizeof (int) },		/* TCP_KEEPIDLE		*/
+	{ TCP_KEEPINTVL, sizeof (int) },	/* TCP_KEEPINTVL	*/
+	{ TCP_KEEPCNT, sizeof (int) },		/* TCP_KEEPCNT		*/
+	{ OPTNOTSUP, 0 },			/* TCP_SYNCNT - in code	*/
+	{ TCP_LINGER2, sizeof (int) },		/* TCP_LINGER2		*/
+	{ OPTNOTSUP, 0 },			/* TCP_DEFER_ACCEPT - in code */
+	{ OPTNOTSUP, 0 },			/* TCP_WINDOW_CLAMP - in code */
+	{ OPTNOTSUP, 0 },			/* TCP_INFO		*/
+	{ OPTNOTSUP, 0 },			/* TCP_QUICKACK - in code */
+	{ OPTNOTSUP, 0 },			/* TCP_CONGESTION	*/
+	{ OPTNOTSUP, 0 },			/* TCP_MD5SIG		*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },			/* TCP_THIN_LINEAR_TIMEOUTS */
+	{ OPTNOTSUP, 0 },			/* TCP_THIN_DUPACK	*/
+	{ TCP_ABORT_THRESHOLD, sizeof (int) },	/* TCP_USER_TIMEOUT	*/
+	{ OPTNOTSUP, 0 },			/* TCP_REPAIR		*/
+	{ OPTNOTSUP, 0 },			/* TCP_REPAIR_QUEUE	*/
+	{ OPTNOTSUP, 0 },			/* TCP_QUEUE_SEQ	*/
+	{ OPTNOTSUP, 0 },			/* TCP_REPAIR_OPTIONS	*/
+	{ OPTNOTSUP, 0 },			/* TCP_FASTOPEN		*/
+	{ OPTNOTSUP, 0 },			/* TCP_TIMESTAMP	*/
+	{ OPTNOTSUP, 0 }			/* TCP_NOTSENT_LOWAT	*/
+};
+
+static const lx_sockopt_map_t ltos_igmp_sockopts[IGMP_MTRACE + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ IGMP_MINLEN, 0 },		/* IGMP_MINLEN			*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ IGMP_MEMBERSHIP_QUERY, 0 },	/* IGMP_HOST_MEMBERSHIP_QUERY	*/
+	{ IGMP_V1_MEMBERSHIP_REPORT, 0 }, /* IGMP_HOST_MEMBERSHIP_REPORT */
+	{ IGMP_DVMRP, 0 },		/* IGMP_DVMRP			*/
+	{ IGMP_PIM, 0 },		/* IGMP_PIM			*/
+	{ OPTNOTSUP, 0 },		/* IGMP_TRACE			*/
+	{ IGMP_V2_MEMBERSHIP_REPORT, 0 }, /* IGMPV2_HOST_MEMBERSHIP_REPORT */
+	{ IGMP_V2_LEAVE_GROUP, 0 },	/* IGMP_HOST_LEAVE_MESSAGE	*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },
+	{ IGMP_MTRACE_RESP, 0 },	/* IGMP_MTRACE_RESP		*/
+	{ IGMP_MTRACE, 0 }		/* IGMP_MTRACE			*/
+};
+
+static const lx_sockopt_map_t ltos_socket_sockopts[LX_SO_BPF_EXTENSIONS + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ SO_DEBUG, sizeof (int) },	/* SO_DEBUG			*/
+	{ SO_REUSEADDR, sizeof (int) },	/* SO_REUSEADDR			*/
+	{ SO_TYPE, 0 },			/* SO_TYPE			*/
+	{ SO_ERROR, 0 },		/* SO_ERROR			*/
+	{ SO_DONTROUTE, sizeof (int) },	/* SO_DONTROUTE			*/
+	{ SO_BROADCAST, sizeof (int) },	/* SO_BROADCAST			*/
+	{ SO_SNDBUF, sizeof (int) },	/* SO_SNDBUF			*/
+	{ SO_RCVBUF, sizeof (int) },	/* SO_RCVBUF			*/
+	{ SO_KEEPALIVE, sizeof (int) },	/* SO_KEEPALIVE			*/
+	{ SO_OOBINLINE, sizeof (int) },	/* SO_OOBINLINE			*/
+	{ OPTNOTSUP, 0 },		/* SO_NO_CHECK			*/
+	{ OPTNOTSUP, 0 },		/* SO_PRIORITY			*/
+	{ SO_LINGER, 0 },		/* SO_LINGER			*/
+	{ OPTNOTSUP, 0 },		/* SO_BSDCOMPAT			*/
+	{ SO_REUSEPORT, sizeof (int) },	/* SO_REUSEPORT			*/
+	{ SO_RECVUCRED, sizeof (int) },	/* SO_PASSCRED			*/
+	{ OPTNOTSUP, 0 },		/* SO_PEERCRED			*/
+	{ SO_RCVLOWAT, sizeof (int) },	/* SO_RCVLOWAT			*/
+	{ SO_SNDLOWAT, sizeof (int) },	/* SO_SNDLOWAT			*/
+	{ SO_RCVTIMEO, 0 },		/* SO_RCVTIMEO			*/
+	{ SO_SNDTIMEO, 0 },		/* SO_SNDTIMEO			*/
+	{ OPTNOTSUP, 0 },		/* SO_SECURITY_AUTHENTICATION	*/
+	{ OPTNOTSUP, 0 },		/* SO_SECURITY_ENCRYPTION_TRANSPORT */
+	{ OPTNOTSUP, 0 },		/* SO_SECURITY_ENCRYPTION_NETWORK */
+	{ OPTNOTSUP, 0 },		/* SO_BINDTODEVICE		*/
+	{ SO_ATTACH_FILTER, 0 },	/* SO_ATTACH_FILTER		*/
+	{ SO_DETACH_FILTER, 0 },	/* SO_DETACH_FILTER		*/
+	{ OPTNOTSUP, 0 },		/* SO_PEERNAME			*/
+	{ SO_TIMESTAMP, sizeof (int) },	/* SO_TIMESTAMP			*/
+	{ SO_ACCEPTCONN, 0 },		/* SO_ACCEPTCONN		*/
+	{ OPTNOTSUP, 0 },		/* SO_PEERSEC			*/
+	{ SO_SNDBUF, sizeof (int) },	/* SO_SNDBUFFORCE		*/
+	{ SO_RCVBUF, sizeof (int) },	/* SO_RCVBUFFORCE		*/
+	{ OPTNOTSUP, 0 },		/* SO_PASSSEC			*/
+	{ OPTNOTSUP, 0 },		/* SO_TIMESTAMPNS		*/
+	{ OPTNOTSUP, 0 },		/* SO_MARK			*/
+	{ OPTNOTSUP, 0 },		/* SO_TIMESTAMPING		*/
+	{ SO_PROTOTYPE, 0 },		/* SO_PROTOCOL			*/
+	{ SO_DOMAIN, 0 },		/* SO_DOMAIN			*/
+	{ OPTNOTSUP, 0 },		/* SO_RXQ_OVFL			*/
+	{ OPTNOTSUP, 0 },		/* SO_WIFI_STATUS		*/
+	{ OPTNOTSUP, 0 },		/* SO_PEEK_OFF			*/
+	{ OPTNOTSUP, 0 },		/* SO_NOFCS			*/
+	{ OPTNOTSUP, 0 },		/* SO_LOCK_FILTER		*/
+	{ OPTNOTSUP, 0 },		/* SO_SELECT_ERR_QUEUE		*/
+	{ OPTNOTSUP, 0 },		/* SO_BUSY_POLL			*/
+	{ OPTNOTSUP, 0 },		/* SO_MAX_PACING_RATE		*/
+	{ OPTNOTSUP, 0 }		/* SO_BPF_EXTENSIONS		*/
+};
+
+static const lx_sockopt_map_t ltos_raw_sockopts[LX_ICMP_FILTER + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 }		/* ICMP_FILTER		*/
+};
+
+static const lx_sockopt_map_t ltos_packet_sockopts[LX_PACKET_STATISTICS + 1] = {
+	{ OPTNOTSUP, 0 },
+	{ PACKET_ADD_MEMBERSHIP, 0 },	/* PACKET_ADD_MEMBERSHIP	*/
+	{ PACKET_DROP_MEMBERSHIP, 0 },	/* PACKET_DROP_MEMBERSHIP	*/
+	{ OPTNOTSUP, 0 },		/* PACKET_RECV_OUTPUT		*/
+	{ OPTNOTSUP, 0 },
+	{ OPTNOTSUP, 0 },		/* PACKET_RX_RING		*/
+	{ PACKET_STATISTICS, 0 }	/* PACKET_STATISTICS		*/
+};
+
+/* Needed for SO_ATTACH_FILTER */
+struct lx_bpf_program {
+    unsigned short bf_len;
+    caddr_t bf_insns;
+};
+
+/* Invert filter fields as Linux expects */
+#define	LX_ICMP6_FILTER_INVERT(filterp) ( \
+	((filterp)->__icmp6_filt[0] ^= 0xFFFFFFFFU), \
+	((filterp)->__icmp6_filt[1] ^= 0xFFFFFFFFU), \
+	((filterp)->__icmp6_filt[2] ^= 0xFFFFFFFFU), \
+	((filterp)->__icmp6_filt[3] ^= 0xFFFFFFFFU), \
+	((filterp)->__icmp6_filt[4] ^= 0xFFFFFFFFU), \
+	((filterp)->__icmp6_filt[5] ^= 0xFFFFFFFFU), \
+	((filterp)->__icmp6_filt[6] ^= 0xFFFFFFFFU), \
+	((filterp)->__icmp6_filt[7] ^= 0xFFFFFFFFU))
+
+static boolean_t
+lx_sockopt_lookup(lx_proto_opts_t tbl, int *optname, socklen_t *optlen)
+{
+	const lx_sockopt_map_t *entry;
+
+	if (*optname > tbl.lpo_max) {
+		return (B_FALSE);
+	}
+	entry = &tbl.lpo_entries[*optname];
+	if (entry->lsm_opt == OPTNOTSUP) {
+		return (B_FALSE);
+	}
+	*optname = entry->lsm_opt;
+	/* Truncate the optlen if needed/allowed */
+	if (entry->lsm_lcap != 0 && *optlen > entry->lsm_lcap) {
+		*optlen = entry->lsm_lcap;
+	}
+	return (B_TRUE);
+}
+
+static int
+lx_mcast_common(sonode_t *so, int level, int optname, void *optval,
+    socklen_t optlen)
+{
+	int error;
+	struct group_req gr;
+	lx_sockaddr_storage_t *lxss;
+
+	ASSERT(optname == LX_MCAST_JOIN_GROUP ||
+	    optname == LX_MCAST_LEAVE_GROUP);
+
+	/*
+	 * For MCAST_JOIN_GROUP and MCAST_LEAVE_GROUP, Linux uses a
+	 * gr_group that has a different size from the native gr_group.
+	 * We need to translate to the native gr_group taking special
+	 * care to do the right thing when dealing with a 32-bit program
+	 * making a call into a 64-bit kernel.
+	 */
+
+	bzero(&gr, sizeof (gr));
+
+#if defined(_SYSCALL32_IMPL)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		if (optlen != sizeof (lx_group_req32_t)) {
+			return (EINVAL);
+		}
+
+		lx_group_req32_t *lxgr = optval;
+
+		/* use the 32-bit type */
+		gr.gr_interface = lxgr->lxgr_interface;
+		lxss = &lxgr->lxgr_group;
+	} else
+#endif /* defined(_SYSCALL32_IMPL) */
+	{
+		if (optlen != sizeof (lx_group_req_t)) {
+			return (EINVAL);
+		}
+
+		lx_group_req_t *lxgr = optval;
+
+		gr.gr_interface = lxgr->lxgr_interface;
+		lxss = &lxgr->lxgr_group;
+	}
+
+	bcopy(lxss, &gr.gr_group, sizeof (*lxss));
+	gr.gr_group.ss_family = LTOS_FAMILY(lxss->lxss_family);
+
+	optlen = sizeof (gr);
+	optname = (optname == LX_MCAST_JOIN_GROUP) ?
+	    MCAST_JOIN_GROUP : MCAST_LEAVE_GROUP;
+
+	error = socket_setsockopt(so, level, optname, &gr,
+	    optlen, CRED());
+	return (error);
+}
+
+static int
+lx_setsockopt_ip(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	int *intval = (int *)optval;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_ip_sockopts);
+
+	switch (optname) {
+	case LX_IP_RECVERR:
+		/*
+		 * Ping sets this option to receive errors on raw sockets.
+		 * Currently we just ignore it to make ping happy. From the
+		 * Linux ip.7 man page:
+		 *
+		 *   For raw sockets, IP_RECVERR enables passing of all
+		 *   received ICMP errors to the application.
+		 *
+		 * Programs known to depend upon this:
+		 * - ping
+		 * - traceroute
+		 * - mount.nfs
+		 */
+		return (0);
+
+	case LX_IP_MTU_DISCOVER: {
+		int val;
+
+		/*
+		 * We translate Linux's IP_MTU_DISCOVER into our IP_DONTFRAG,
+		 * allowing this be a byte or an integer and observing the
+		 * inverted sense of the two relative to one another (and
+		 * translating accordingly).
+		 */
+		if (optlen < sizeof (int)) {
+			val = *((uint8_t *)optval);
+		} else {
+			val = *((int *)optval);
+		}
+
+		switch (val) {
+		case LX_IP_PMTUDISC_DONT:
+			val = 1;
+			break;
+
+		case LX_IP_PMTUDISC_DO:
+		case LX_IP_PMTUDISC_WANT:
+			val = 0;
+			break;
+
+		default:
+			return (EOPNOTSUPP);
+		}
+
+		error = socket_setsockopt(so, IPPROTO_IP, IP_DONTFRAG,
+		    &val, sizeof (val), CRED());
+		return (error);
+	}
+
+	case LX_IP_MULTICAST_TTL:
+	case LX_IP_MULTICAST_LOOP:
+		/*
+		 * For IP_MULTICAST_TTL and IP_MULTICAST_LOOP, Linux defines
+		 * the option value to be an integer while we define it to be
+		 * an unsigned character.  To prevent the kernel from spitting
+		 * back an error on an illegal length, verify that the option
+		 * value is less than UCHAR_MAX before truncating optlen.
+		 */
+		if (optlen <= 0 || optlen > sizeof (int) ||
+		    *intval > UINT8_MAX) {
+			return (EINVAL);
+		}
+		optlen = sizeof (uchar_t);
+		break;
+
+	case LX_MCAST_JOIN_GROUP:
+	case LX_MCAST_LEAVE_GROUP:
+		error = lx_mcast_common(so, IPPROTO_IP, optname, optval,
+		    optlen);
+		return (error);
+	default:
+		break;
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_setsockopt(so, IPPROTO_IP, optname, optval, optlen,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_setsockopt_ipv6(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_ipv6_sockopts);
+
+	switch (optname) {
+	case LX_IPV6_MTU:
+		/*
+		 * There isn't a good translation for IPV6_MTU and certain apps
+		 * such as bind9 will bail if it cannot be set.
+		 * We just lie about the success for now.
+		 */
+		return (0);
+	case LX_MCAST_JOIN_GROUP:
+	case LX_MCAST_LEAVE_GROUP:
+		error = lx_mcast_common(so, IPPROTO_IPV6, optname, optval,
+		    optlen);
+		return (error);
+	default:
+		break;
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+	error = socket_setsockopt(so, IPPROTO_IPV6, optname, optval, optlen,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_setsockopt_icmpv6(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_icmpv6_sockopts);
+
+	if (optname == LX_ICMP6_FILTER && optval != NULL) {
+		/*
+		 * Surprise! The input to ICMP6_FILTER on Linux is inverted
+		 * when compared to illumos.
+		 */
+		if (optlen != sizeof (icmp6_filter_t)) {
+			return (EINVAL);
+		}
+		LX_ICMP6_FILTER_INVERT((icmp6_filter_t *)optval);
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+	error = socket_setsockopt(so, IPPROTO_ICMPV6, optname, optval, optlen,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_setsockopt_tcp(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_tcp_sockopts);
+	cred_t *cr = CRED();
+	uint32_t rto_max, abrt_thresh;
+	boolean_t abrt_changed = B_FALSE, rto_max_changed = B_FALSE;
+
+	if (optname == LX_TCP_WINDOW_CLAMP || optname == LX_TCP_QUICKACK) {
+		/* It appears safe to lie and say we did these. */
+		return (0);
+	}
+
+	if (optname == LX_TCP_MAXSEG) {
+		/*
+		 * We can get, but not set, TCP_MAXSEG. However, it appears
+		 * safe to lie and say we did this. A future extension might
+		 * be to allow setting this before a connection is established.
+		 */
+		return (0);
+	}
+
+	if (optname == LX_TCP_SYNCNT) {
+		int intval;
+		uint64_t syn_last_backoff;
+		uint_t syn_cnt, syn_backoff, len;
+
+		/*
+		 * See the comment above the ltos_tcp_sockopts table for an
+		 * explanation of the TCP_SYNCNT emulation.
+		 */
+		if (optlen != sizeof (int)) {
+			return (EINVAL);
+		}
+		intval = *(int *)optval;
+		if (intval > 255) {
+			return (EINVAL);
+		}
+
+		len = sizeof (syn_backoff);
+		error = socket_getsockopt(so, IPPROTO_TCP,
+		    TCP_CONN_NOTIFY_THRESHOLD, &syn_backoff, &len, 0, cr);
+		if (error != 0)
+			return (error);
+
+		syn_last_backoff = syn_backoff;
+		for (syn_cnt = 0; syn_cnt < intval; syn_cnt++) {
+			syn_last_backoff *= 2;
+			/*
+			 * Since the tcps_ip_abort_cinterval is milliseconds and
+			 * stored as a uint_t, it's basically impossible to get
+			 * up to the Linux limit of 255 SYN retries due to the
+			 * doubling on the backoff.
+			 */
+			if (syn_last_backoff > UINT_MAX) {
+				return (EINVAL);
+			}
+		}
+
+		syn_backoff = (uint_t)syn_last_backoff;
+		error = socket_setsockopt(so, IPPROTO_TCP,
+		    TCP_CONN_ABORT_THRESHOLD, &syn_backoff, len, cr);
+		return (error);
+	}
+
+	if (optname == LX_TCP_DEFER_ACCEPT) {
+		int *intval;
+		char *dfp;
+
+		/*
+		 * Emulate TCP_DEFER_ACCEPT using the datafilt(7M) socket
+		 * filter but we can't emulate the timeout aspect so treat any
+		 * non-zero value as enabling and zero as disabling.
+		 */
+		if (optlen != sizeof (int)) {
+			return (EINVAL);
+		}
+		intval = (int *)optval;
+
+		/*
+		 * socket_setsockopt asserts that the optval is aligned, so
+		 * we use kmem_alloc to ensure this.
+		 */
+		dfp = (char *)kmem_alloc(sizeof (DATAFILT), KM_SLEEP);
+		(void) strcpy(dfp, DATAFILT);
+
+		if (*intval > 0) {
+			error = socket_setsockopt(so, SOL_FILTER, FIL_ATTACH,
+			    dfp, 9, cr);
+			if (error == EEXIST) {
+				error = 0;
+			}
+		} else {
+			error = socket_setsockopt(so, SOL_FILTER, FIL_DETACH,
+			    dfp, 9, cr);
+			if (error == ENXIO) {
+				error = 0;
+			}
+		}
+		kmem_free(dfp, sizeof (DATAFILT));
+		return (error);
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	if (optname == TCP_KEEPINTVL) {
+		/*
+		 * When setting TCP_KEEPINTVL there is an unfortunate set of
+		 * dependencies. TCP_KEEPINTVL must be <= TCP_RTO_MAX and
+		 * TCP_RTO_MAX must be <= TCP_ABORT_THRESHOLD. Thus, we may
+		 * have to increase one or both of these in order to increase
+		 * TCP_KEEPINTVL. Note that TCP_KEEPINTVL is passed in seconds
+		 * but TCP_RTO_MAX and TCP_ABORT_THRESHOLD are in milliseconds.
+		 * Also note that we currently make no attempt to handle
+		 * concurrent application threads simultaneously changing
+		 * TCP_KEEPINTVL, since that is unlikely. We could revisit
+		 * locking if it ever becomes an issue.
+		 */
+		uint32_t new_val = *(uint_t *)optval * 1000;
+		uint32_t len;
+
+		/*
+		 * Linux limits this to 32k, so we do too. However, anything
+		 * over 2 hours (7200000 ms) will fail anyway due to the
+		 * system-wide default (see "_rexmit_interval_max" in
+		 * tcp_tunables.c). Our 2 hour default seems reasonable as a
+		 * practical limit for now.
+		 */
+		if (*(uint_t *)optval > SHRT_MAX)
+			return (EINVAL);
+
+		len = sizeof (rto_max);
+		if ((error = socket_getsockopt(so, IPPROTO_TCP, TCP_RTO_MAX,
+		    &rto_max, &len, 0, cr)) != 0)
+			return (error);
+		len = sizeof (abrt_thresh);
+		if ((error = socket_getsockopt(so, IPPROTO_TCP,
+		    TCP_ABORT_THRESHOLD, &abrt_thresh, &len, 0, cr)) != 0)
+			return (error);
+
+		if (new_val > abrt_thresh) {
+			error = socket_setsockopt(so, IPPROTO_TCP,
+			    TCP_ABORT_THRESHOLD, &new_val, sizeof (new_val),
+			    cr);
+			if (error != 0)
+				goto fail;
+			abrt_changed = B_TRUE;
+		}
+		if (new_val > rto_max) {
+			error = socket_setsockopt(so, IPPROTO_TCP,
+			    TCP_RTO_MAX, &new_val, sizeof (new_val), cr);
+			if (error != 0)
+				goto fail;
+			rto_max_changed = B_TRUE;
+		}
+	}
+
+	error = socket_setsockopt(so, IPPROTO_TCP, optname, optval, optlen, cr);
+
+fail:
+	if (error != 0 && optname == TCP_KEEPINTVL) {
+		/*
+		 * If changing TCP_KEEPINTVL failed then we may need to
+		 * restore the previous values for TCP_ABORT_THRESHOLD and
+		 * TCP_RTO_MAX.
+		 */
+		if (rto_max_changed) {
+			(void) socket_setsockopt(so, IPPROTO_TCP,
+			    TCP_RTO_MAX, &rto_max,
+			    sizeof (rto_max), cr);
+		}
+		if (abrt_changed) {
+			(void) socket_setsockopt(so, IPPROTO_TCP,
+			    TCP_ABORT_THRESHOLD, &abrt_thresh,
+			    sizeof (abrt_thresh), cr);
+		}
+	}
+
+	return (error);
+}
+
+static int
+lx_setsockopt_socket(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_socket_sockopts);
+	struct lx_bpf_program *lbp;
+	int *intval;
+	struct bpf_program bp;
+
+	switch (optname) {
+	case LX_SO_BSDCOMPAT:
+		/* Linux ignores this option. */
+		return (0);
+
+	case LX_SO_TIMESTAMP:
+		/*
+		 * SO_TIMESTAMP is not supported on AF_UNIX sockets but we have
+		 * some of those which apps use for logging, etc., so pretend
+		 * this worked.
+		 */
+		if (so->so_family == AF_UNIX) {
+			return (0);
+		}
+		break;
+
+	case LX_SO_ATTACH_FILTER:
+		/*
+		 * Convert bpf program struct
+		 */
+		if (optlen != sizeof (struct lx_bpf_program)) {
+			return (EINVAL);
+		}
+		lbp = (struct lx_bpf_program *)optval;
+		bp.bf_len = lbp->bf_len;
+		/* LINTED: alignment */
+		bp.bf_insns = (struct bpf_insn *)lbp->bf_insns;
+		optval = &bp;
+		break;
+
+	case LX_SO_PASSSEC:
+		/*
+		 * SO_PASSSEC is very similar to SO_PASSCRED (emulated by
+		 * SO_RECVUCRED) in that it requests that cmsgs containing
+		 * identity information be attached to recieved messages.
+		 * Instead of ucred information, security-module-specific
+		 * information such as selinux label is expected
+		 *
+		 * Since LX does not at all support selinux today, the
+		 * option is silently accepted.
+		 */
+		return (0);
+
+	case LX_SO_PASSCRED:
+		/*
+		 * In many cases, the Linux SO_PASSCRED is mapped to the SunOS
+		 * SO_RECVUCRED to enable the passing of peer credential
+		 * information via received cmsgs.  One exception is for
+		 * connection-oriented AF_UNIX sockets which do not yet support
+		 * that option.  Instead, we track the setting internally and,
+		 * when there is appropriate cmsg space, emulate the credential
+		 * passing by querying the STREAMS ioctl.
+		 *
+		 * Note: this approach is broken for the case when a process
+		 * sets up a Unix-domain socket with SO_PASSCRED, then forks
+		 * one or more children, and expects to use the cmsg cred to
+		 * accurately know which child pid sent the message (currently
+		 * a pid is recorded when the socket is connected, not for each
+		 * msg sent). getpeerucred(3c) suffers from the same problem.
+		 * We have a workaround in lx_socketpair (use DGRAM if
+		 * SEQPACKET), but the general case requires enhancing our
+		 * streams support to allow passing credential cmsgs on a
+		 * connection-oriented Unix socket.
+		 */
+		if (so->so_family == AF_UNIX &&
+		    (so->so_mode & SM_CONNREQUIRED) != 0) {
+			lx_socket_aux_data_t *sad;
+
+			if (optlen != sizeof (int)) {
+				return (EINVAL);
+			}
+			intval = (int *)optval;
+			sad = lx_sad_acquire(SOTOV(so));
+			if (*intval == 0) {
+				sad->lxsad_flags &= ~LXSAD_FL_STRCRED;
+			} else {
+				sad->lxsad_flags |= LXSAD_FL_STRCRED;
+			}
+			mutex_exit(&sad->lxsad_lock);
+			return (0);
+		}
+		break;
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_setsockopt(so, SOL_SOCKET, optname, optval, optlen,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_setsockopt_raw(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_raw_sockopts);
+
+	switch (optname) {
+	case LX_ICMP_FILTER:
+		/*
+		 * This option is currently ignored to appease ping.
+		 */
+		return (0);
+
+	case LX_IPV6_CHECKSUM:
+		/*
+		 * Ping6 tries to set the IPV6_CHECKSUM offset in a way that
+		 * illumos won't allow.  Quietly ignore this to prevent it from
+		 * complaining.
+		 */
+		return (0);
+
+	default:
+		break;
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_setsockopt(so, IPPROTO_TCP, optname, optval, optlen,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_setsockopt_packet(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_packet_sockopts);
+	struct packet_mreq *mr;
+
+	switch (optname) {
+	case LX_PACKET_ADD_MEMBERSHIP:
+	case LX_PACKET_DROP_MEMBERSHIP:
+		/* Convert Linux mr_type to illumos */
+		if (optlen != sizeof (struct packet_mreq)) {
+			return (EINVAL);
+		}
+		mr = (struct packet_mreq *)optval;
+		if (--mr->mr_type > PACKET_MR_ALLMULTI)
+			return (EINVAL);
+		optval = mr;
+		break;
+
+	default:
+		break;
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_setsockopt(so, SOL_PACKET, optname, optval, optlen,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_setsockopt_igmp(sonode_t *so, int optname, void *optval, socklen_t optlen)
+{
+	int error;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_igmp_sockopts);
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, &optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_setsockopt(so, IPPROTO_IGMP, optname, optval, optlen,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_getsockopt_ip(sonode_t *so, int optname, void *optval, socklen_t *optlen)
+{
+	int error = 0;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_ip_sockopts);
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, IPPROTO_IP, optname, optval, optlen, 0,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_getsockopt_ipv6(sonode_t *so, int optname, void *optval, socklen_t *optlen)
+{
+	int error = 0;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_ipv6_sockopts);
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, IPPROTO_IPV6, optname, optval, optlen, 0,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_getsockopt_icmpv6(sonode_t *so, int optname, void *optval,
+    socklen_t *optlen)
+{
+	int error = 0;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_icmpv6_sockopts);
+
+	if (optname == LX_ICMP6_FILTER) {
+		error = socket_getsockopt(so, IPPROTO_ICMPV6, ICMP6_FILTER,
+		    optval, optlen, 0, CRED());
+
+		/*
+		 * ICMP6_FILTER is inverted on Linux. Make it so before copying
+		 * back to caller's buffer.
+		 */
+		if (error == 0) {
+			LX_ICMP6_FILTER_INVERT((icmp6_filter_t *)optval);
+		}
+		return (error);
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, IPPROTO_ICMPV6, optname, optval, optlen,
+	    0, CRED());
+	return (error);
+}
+
+static int
+lx_getsockopt_tcp(sonode_t *so, int optname, void *optval, socklen_t *optlen)
+{
+	int error = 0;
+	cred_t *cr = CRED();
+	int *intval = (int *)optval;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_tcp_sockopts);
+
+	switch (optname) {
+	case LX_TCP_WINDOW_CLAMP:
+	case LX_TCP_QUICKACK:
+		/*
+		 * We do not support these options but some apps rely on them.
+		 * Rather than return an error we just return 0.  This isn't
+		 * exactly a lie, since the options really aren't set, but it's
+		 * not the whole truth either. Fortunately, we aren't under
+		 * oath.
+		 */
+		if (*optlen < sizeof (int)) {
+			error = EINVAL;
+		} else {
+			*intval = 0;
+		}
+		*optlen = sizeof (int);
+		return (error);
+
+	case LX_TCP_SYNCNT:
+		/*
+		 * See the comment above the ltos_tcp_sockopts table for an
+		 * explanation of the TCP_SYNCNT emulation.
+		 */
+		if (*optlen < sizeof (int)) {
+			error = EINVAL;
+		} else {
+			uint_t syn_cnt, syn_backoff, syn_abortconn, len;
+
+			len = sizeof (syn_backoff);
+			error = socket_getsockopt(so, IPPROTO_TCP,
+			    TCP_CONN_NOTIFY_THRESHOLD, &syn_backoff, &len, 0,
+			    cr);
+			if (error != 0)
+				return (error);
+			error = socket_getsockopt(so, IPPROTO_TCP,
+			    TCP_CONN_ABORT_THRESHOLD, &syn_abortconn, &len, 0,
+			    cr);
+			if (error != 0)
+				return (error);
+
+			syn_cnt = 0;
+			while (syn_backoff < syn_abortconn) {
+				syn_cnt++;
+				syn_backoff *= 2;
+			}
+			if (syn_cnt > 255)	/* clamp to Linux limit */
+				syn_cnt = 255;
+
+			*intval = syn_cnt;
+			*optlen = sizeof (int);
+		}
+
+		return (error);
+
+	case LX_TCP_DEFER_ACCEPT:
+		/*
+		 * We do support TCP_DEFER_ACCEPT using the datafilt(7M) socket
+		 * filter but we don't emulate the timeout aspect so treat the
+		 * existence as 1 and absence as 0.
+		 */
+		if (*optlen < sizeof (int)) {
+			error = EINVAL;
+		} else {
+			struct fil_info fi[10];
+			int i;
+			socklen_t len = sizeof (fi);
+
+			if ((error = socket_getsockopt(so, SOL_FILTER,
+			    FIL_LIST, fi, &len, 0, cr)) != 0) {
+				*optlen = sizeof (int);
+				return (error);
+			}
+
+			*intval = 0;
+			len = len / sizeof (struct fil_info);
+			for (i = 0; i < len; i++) {
+				if (fi[i].fi_flags == FILF_PROG &&
+				    strcmp(fi[i].fi_name, "datafilt") == 0) {
+					*intval = 1;
+					break;
+				}
+			}
+		}
+		*optlen = sizeof (int);
+		return (error);
+	default:
+		break;
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, IPPROTO_TCP, optname, optval, optlen, 0,
+	    cr);
+	return (error);
+}
+
+static int
+lx_getsockopt_socket(sonode_t *so, int optname, void *optval,
+    socklen_t *optlen)
+{
+	int error = 0;
+	int *intval = (int *)optval;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_socket_sockopts);
+
+	switch (optname) {
+	case LX_SO_TYPE:
+		/*
+		 * Special handling for connectionless AF_UNIX sockets.
+		 * See lx_socketpair for more details.
+		 */
+		if (so->so_family == AF_UNIX &&
+		    (so->so_mode & SM_CONNREQUIRED) == 0) {
+			lx_socket_aux_data_t *sad;
+
+			if (*optlen < sizeof (int))
+				return (EINVAL);
+			sad = lx_sad_acquire(SOTOV(so));
+			if ((sad->lxsad_flags & LXSAD_FL_EMULSEQPKT) != 0) {
+				*intval = LX_SOCK_SEQPACKET;
+				*optlen = sizeof (int);
+				mutex_exit(&sad->lxsad_lock);
+				return (0);
+			}
+			mutex_exit(&sad->lxsad_lock);
+		}
+		break;
+
+	case LX_SO_PASSSEC:
+		/*
+		 * Communicate value of 0 since selinux-related functionality
+		 * is not supported.
+		 */
+		if (*optlen < sizeof (int)) {
+			error = EINVAL;
+		} else {
+			*intval = 0;
+		}
+		*optlen = sizeof (int);
+		return (error);
+
+	case LX_SO_PASSCRED:
+		/*
+		 * Special handling for connection-oriented AF_UNIX sockets.
+		 * See lx_setsockopt_socket for more details.
+		 */
+		if (so->so_family == AF_UNIX &&
+		    (so->so_mode & SM_CONNREQUIRED) != 0) {
+			lx_socket_aux_data_t *sad;
+
+			if (*optlen < sizeof (int)) {
+				return (EINVAL);
+			}
+			sad = lx_sad_acquire(SOTOV(so));
+			*intval = ((sad->lxsad_flags & LXSAD_FL_STRCRED) == 0 ?
+			    0 : 1);
+			*optlen = sizeof (int);
+			mutex_exit(&sad->lxsad_lock);
+			return (0);
+		}
+		break;
+
+	case LX_SO_PEERCRED:
+		if (*optlen < sizeof (struct lx_ucred)) {
+			error = EINVAL;
+		} else {
+			struct lx_ucred *lcred = (struct lx_ucred *)optval;
+
+			mutex_enter(&so->so_lock);
+			if ((so->so_mode & SM_CONNREQUIRED) == 0) {
+				error = ENOTSUP;
+			} else if (so->so_peercred == NULL) {
+				error = EINVAL;
+			} else {
+				lcred->lxu_uid = crgetuid(so->so_peercred);
+				lcred->lxu_gid = crgetgid(so->so_peercred);
+				lcred->lxu_pid = so->so_cpid;
+			}
+			mutex_exit(&so->so_lock);
+		}
+		*optlen = sizeof (struct lx_ucred);
+		return (error);
+
+	default:
+		break;
+	}
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, SOL_SOCKET, optname, optval, optlen, 0,
+	    CRED());
+
+	if (error == 0) {
+		switch (optname) {
+		case SO_TYPE:
+			/* translate our type back to Linux */
+			*intval = STOL_SOCKTYPE(*intval);
+			break;
+
+		case SO_ERROR:
+			*intval = lx_errno(*intval, EINVAL);
+			break;
+		default:
+			break;
+		}
+	}
+	return (error);
+}
+
+static int
+lx_getsockopt_raw(sonode_t *so, int optname, void *optval, socklen_t *optlen)
+{
+	int error = 0;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_raw_sockopts);
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, IPPROTO_RAW, optname, optval, optlen, 0,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_getsockopt_packet(sonode_t *so, int optname, void *optval,
+    socklen_t *optlen)
+{
+	int error = 0;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_packet_sockopts);
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, SOL_PACKET, optname, optval, optlen, 0,
+	    CRED());
+	return (error);
+}
+
+static int
+lx_getsockopt_igmp(sonode_t *so, int optname, void *optval, socklen_t *optlen)
+{
+	int error = 0;
+	lx_proto_opts_t sockopts_tbl = PROTO_SOCKOPTS(ltos_igmp_sockopts);
+
+	if (!lx_sockopt_lookup(sockopts_tbl, &optname, optlen)) {
+		return (ENOPROTOOPT);
+	}
+
+	error = socket_getsockopt(so, IPPROTO_IGMP, optname, optval, optlen, 0,
+	    CRED());
+	return (error);
+}
+
+long
+lx_setsockopt(int sock, int level, int optname, void *optval, socklen_t optlen)
+{
+	struct sonode *so;
+	file_t *fp;
+	int buflen = 0;
+	intptr_t stkbuf[2];
+	void *optbuf = stkbuf;
+	int error = 0;
+
+	if (optlen != 0) {
+		if (optlen > SO_MAXARGSIZE) {
+			return (set_errno(EINVAL));
+		}
+		if (optlen > sizeof (stkbuf)) {
+			buflen = optlen;
+			optbuf = kmem_alloc(optlen, KM_SLEEP);
+		} else {
+			/*
+			 * Zero the on-stack buffer to avoid poisoning smaller
+			 * optvals with stack garbage.
+			 */
+			stkbuf[0] = 0;
+			stkbuf[1] = 0;
+		}
+		if (copyin(optval, optbuf, optlen) != 0) {
+			if (buflen != 0) {
+				kmem_free(optbuf, buflen);
+			}
+			return (set_errno(EFAULT));
+		}
+	} else {
+		optbuf = NULL;
+	}
+	if ((so = getsonode(sock, &error, &fp)) == NULL) {
+		if (buflen != 0) {
+			kmem_free(optbuf, buflen);
+		}
+		return (set_errno(error));
+	}
+
+	switch (level) {
+	case LX_IPPROTO_IP:
+		error = lx_setsockopt_ip(so, optname, optbuf, optlen);
+		break;
+	case LX_IPPROTO_IPV6:
+		error = lx_setsockopt_ipv6(so, optname, optbuf, optlen);
+		break;
+	case LX_IPPROTO_ICMPV6:
+		error = lx_setsockopt_icmpv6(so, optname, optbuf, optlen);
+		break;
+	case LX_IPPROTO_TCP:
+		error = lx_setsockopt_tcp(so, optname, optbuf, optlen);
+		break;
+	case LX_SOL_SOCKET:
+		error = lx_setsockopt_socket(so, optname, optbuf, optlen);
+		break;
+	case LX_IPPROTO_RAW:
+		error = lx_setsockopt_raw(so, optname, optbuf, optlen);
+		break;
+	case LX_SOL_PACKET:
+		error = lx_setsockopt_packet(so, optname, optbuf, optlen);
+		break;
+	case LX_IPPROTO_IGMP:
+		error = lx_setsockopt_igmp(so, optname, optbuf, optlen);
+		break;
+	case LX_SOL_NETLINK:
+		/*
+		 * Since our netlink implmentation is modeled after Linux,
+		 * sockopts can be passed directly through.
+		 */
+		error = socket_setsockopt(so, LX_SOL_NETLINK, optname, optval,
+		    optlen, CRED());
+		break;
+	default:
+		error = ENOPROTOOPT;
+		break;
+	}
+
+	if (error == ENOPROTOOPT) {
+		char buf[LX_UNSUP_BUFSZ];
+
+		(void) snprintf(buf, LX_UNSUP_BUFSZ, "setsockopt(%d, %d)",
+		    level, optname);
+		lx_unsupported(buf);
+	}
+	if (buflen != 0) {
+		kmem_free(optbuf, buflen);
+	}
+	releasef(sock);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_getsockopt(int sock, int level, int optname, void *optval,
+    socklen_t *optlenp)
+{
+	struct sonode *so;
+	file_t *fp;
+	int error = 0, buflen = 0;
+	socklen_t optlen;
+	intptr_t stkbuf[2];
+	void *optbuf = stkbuf;
+
+	if (copyin(optlenp, &optlen, sizeof (optlen)) != 0) {
+		return (set_errno(EFAULT));
+	}
+	if (optlen != 0) {
+		if (optlen > SO_MAXARGSIZE) {
+			return (set_errno(EINVAL));
+		}
+		if (optlen > sizeof (stkbuf)) {
+			buflen = optlen;
+			optbuf = kmem_zalloc(optlen, KM_SLEEP);
+		} else {
+			/* zero the on-stack buffer, just in case */
+			stkbuf[0] = 0;
+			stkbuf[1] = 0;
+		}
+	} else {
+		optbuf = NULL;
+	}
+	if ((so = getsonode(sock, &error, &fp)) == NULL) {
+		if (buflen != 0) {
+			kmem_free(optbuf, buflen);
+		}
+		return (set_errno(error));
+	}
+
+	switch (level) {
+	case LX_IPPROTO_IP:
+		error = lx_getsockopt_ip(so, optname, optbuf, &optlen);
+		break;
+	case LX_IPPROTO_IPV6:
+		error = lx_getsockopt_ipv6(so, optname, optbuf, &optlen);
+		break;
+	case LX_IPPROTO_ICMPV6:
+		error = lx_getsockopt_icmpv6(so, optname, optbuf, &optlen);
+		break;
+	case LX_IPPROTO_TCP:
+		error = lx_getsockopt_tcp(so, optname, optbuf, &optlen);
+		break;
+	case LX_SOL_SOCKET:
+		error = lx_getsockopt_socket(so, optname, optbuf, &optlen);
+		break;
+	case LX_IPPROTO_RAW:
+		error = lx_getsockopt_raw(so, optname, optbuf, &optlen);
+		break;
+	case LX_SOL_PACKET:
+		error = lx_getsockopt_packet(so, optname, optbuf, &optlen);
+		break;
+	case LX_IPPROTO_IGMP:
+		error = lx_getsockopt_igmp(so, optname, optbuf, &optlen);
+		break;
+	case LX_SOL_NETLINK:
+		/*
+		 * Since our netlink implmentation is modeled after Linux,
+		 * sockopts can be passed directly through.
+		 */
+		error = socket_getsockopt(so, LX_SOL_NETLINK, optname, optval,
+		    &optlen, 0, CRED());
+		break;
+	default:
+		error = EOPNOTSUPP;
+		break;
+	}
+
+	if (error == ENOPROTOOPT) {
+		char buf[LX_UNSUP_BUFSZ];
+
+		(void) snprintf(buf, LX_UNSUP_BUFSZ, "getsockopt(%d, %d)",
+		    level, optname);
+		lx_unsupported(buf);
+	}
+	if (copyout(&optlen, optlenp, sizeof (optlen)) != 0) {
+		error = EFAULT;
+	}
+	if (error == 0 && optlen > 0) {
+		VERIFY(optlen <= sizeof (stkbuf) || optlen <= buflen);
+		if (copyout(optbuf, optval, optlen) != 0) {
+			error = EFAULT;
+		}
+	}
+	if (buflen != 0) {
+		kmem_free(optbuf, buflen);
+	}
+	releasef(sock);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_getname_common(lx_getname_type_t type, int sockfd, void *np, int *nlp)
+{
+	struct sockaddr_storage buf;
+	struct sockaddr *name = (struct sockaddr *)&buf;
+	socklen_t namelen, namelen_orig;
+	int err, tmp;
+	struct sonode *so;
+
+	/* We need to validate the name address up front to pass LTP. */
+	if (copyin(np, &tmp, sizeof (tmp)) != 0)
+		return (set_errno(EFAULT));
+
+	if (copyin(nlp, &namelen, sizeof (socklen_t)) != 0)
+		return (set_errno(EFAULT));
+	namelen_orig = namelen;
+
+	/* LTP can pass -1 */
+	if ((int)namelen < 0)
+		return (set_errno(EINVAL));
+
+	if ((so = getsonode(sockfd, &err, NULL)) == NULL)
+		return (set_errno(err));
+
+	bzero(&buf, sizeof (buf));
+	namelen = sizeof (struct sockaddr_storage);
+	if (type == LX_GETPEERNAME) {
+		err = socket_getpeername(so, name, &namelen, B_FALSE, CRED());
+	} else {
+		err = socket_getsockname(so, name, &namelen, CRED());
+	}
+
+	if (err == 0) {
+		ASSERT(namelen <= so->so_max_addr_len);
+		err = stol_sockaddr_copyout(name, namelen,
+		    (struct sockaddr *)np, (socklen_t *)nlp, namelen_orig);
+	}
+
+	releasef(sockfd);
+	return (err != 0 ? set_errno(err) : 0);
+}
+
+long
+lx_getpeername(int sockfd, void *np, int *nlp)
+{
+	return (lx_getname_common(LX_GETPEERNAME, sockfd, np, nlp));
+}
+
+long
+lx_getsockname(int sockfd, void *np, int *nlp)
+{
+	return (lx_getname_common(LX_GETSOCKNAME, sockfd, np, nlp));
+}
+
+static int
+lx_accept_common(int sock, struct sockaddr *name, socklen_t *nlp, int flags)
+{
+	struct sonode *so;
+	file_t *fp;
+	int error;
+	socklen_t namelen;
+	struct sonode *nso;
+	struct vnode *nvp;
+	struct file *nfp;
+	int nfd;
+	int arg;
+
+	if (flags & ~(LX_SOCK_CLOEXEC | LX_SOCK_NONBLOCK)) {
+		return (set_errno(EINVAL));
+	}
+
+	if ((so = getsonode(sock, &error, &fp)) == NULL)
+		return (set_errno(error));
+
+	if (name != NULL) {
+		/*
+		 * The Linux man page says that -1 is returned and errno is set
+		 * to EFAULT if the "name" address is bad, but it is silent on
+		 * what to set errno to if the "namelen" address is bad.
+		 * LTP expects EINVAL.
+		 *
+		 * Note that we must first check the name pointer, as the Linux
+		 * docs state nothing is copied out if the "name" pointer is
+		 * NULL. If it is NULL, we don't care about the namelen
+		 * pointer's value or about dereferencing it.
+		 */
+		if (copyin(nlp, &namelen, sizeof (namelen))) {
+			releasef(sock);
+			return (set_errno(EINVAL));
+		}
+		if (namelen == 0) {
+			name = NULL;
+		}
+	} else {
+		namelen = 0;
+	}
+
+	/*
+	 * Allocate the user fd before socket_accept() in order to
+	 * catch EMFILE errors before calling socket_accept().
+	 */
+	if ((error = falloc(NULL, FWRITE|FREAD, &nfp, &nfd)) != 0) {
+		eprintsoline(so, EMFILE);
+		releasef(sock);
+		return (set_errno(error));
+	}
+	if ((error = socket_accept(so, fp->f_flag, CRED(), &nso)) != 0) {
+		if (error == EINTR)
+			lx_sock_syscall_restart(so, B_TRUE);
+		setf(nfd, NULL);
+		unfalloc(nfp);
+		releasef(sock);
+		return (set_errno(error));
+	}
+
+	nvp = SOTOV(nso);
+
+	if (namelen != 0) {
+		socklen_t addrlen = sizeof (struct sockaddr_storage);
+		struct sockaddr_storage buf;
+		struct sockaddr *addrp = (struct sockaddr *)&buf;
+
+		if ((error = socket_getpeername(nso, addrp, &addrlen, B_TRUE,
+		    CRED())) == 0) {
+			error = stol_sockaddr_copyout(addrp, addrlen,
+			    name, nlp, namelen);
+			/*
+			 * Logic might dictate that we should check if we can
+			 * write to the namelen pointer earlier so we don't
+			 * accept a pending connection only to fail the call
+			 * because we can't write the namelen value back out.
+			 * However, testing shows Linux does indeed fail the
+			 * call after accepting the connection so we must
+			 * behave in a compatible manner.
+			 */
+		} else {
+			ASSERT(error == EINVAL || error == ENOTCONN);
+			error = ECONNABORTED;
+		}
+	}
+
+	if (error != 0) {
+		setf(nfd, NULL);
+		unfalloc(nfp);
+		(void) socket_close(nso, 0, CRED());
+		socket_destroy(nso);
+		releasef(sock);
+		return (set_errno(error));
+	}
+
+	/* Fill in the entries that falloc reserved */
+	nfp->f_vnode = nvp;
+	mutex_exit(&nfp->f_tlock);
+	setf(nfd, nfp);
+
+	/* Act on LX_SOCK_CLOEXEC from flags */
+	if (flags & LX_SOCK_CLOEXEC) {
+		f_setfd(nfd, FD_CLOEXEC);
+	}
+
+	/*
+	 * In Linux, accept()ed sockets do not inherit anything set by fcntl(),
+	 * so either explicitly set the flags or filter those out.
+	 *
+	 * The VOP_SETFL code is a simplification of the F_SETFL code in
+	 * fcntl(). Ignore any errors from VOP_SETFL.
+	 */
+	arg = 0;
+	if (flags & LX_SOCK_NONBLOCK)
+		arg |= FNONBLOCK;
+
+	error = VOP_SETFL(nvp, nfp->f_flag, arg, nfp->f_cred, NULL);
+	if (error != 0) {
+		eprintsoline(so, error);
+		error = 0;
+	} else {
+		mutex_enter(&nfp->f_tlock);
+		nfp->f_flag &= ~FMASK | (FREAD|FWRITE);
+		nfp->f_flag |= arg;
+		mutex_exit(&nfp->f_tlock);
+	}
+
+	releasef(sock);
+	return (nfd);
+}
+
+long
+lx_accept(int sockfd, void *np, int *nlp)
+{
+	return (lx_accept_common(sockfd, (struct sockaddr *)np,
+	    (socklen_t *)nlp, 0));
+}
+
+long
+lx_accept4(int sockfd, void *np, int *nlp, int flags)
+{
+	return (lx_accept_common(sockfd, (struct sockaddr *)np,
+	    (socklen_t *)nlp, flags));
+}
+
+long
+lx_listen(int sockfd, int backlog)
+{
+	return (listen(sockfd, backlog, 0));
+}
+
+long
+lx_shutdown(int sockfd, int how)
+{
+	return (shutdown(sockfd, how, 0));
+}
+
+/*
+ * Connect two sockets together for a socketpair.  This is derived from
+ * so_socketpair, but forgoes the task of dealing with file descriptors.
+ */
+static int
+lx_socketpair_connect(file_t *fp1, file_t *fp2)
+{
+	sonode_t *so1, *so2;
+	sotpi_info_t *sti1, *sti2;
+	struct sockaddr_ux name;
+	int error;
+
+	so1 = VTOSO(fp1->f_vnode);
+	so2 = VTOSO(fp2->f_vnode);
+	sti1 = SOTOTPI(so1);
+	sti2 = SOTOTPI(so2);
+
+	VERIFY(so1->so_ops == &sotpi_sonodeops &&
+	    so2->so_ops == &sotpi_sonodeops);
+
+	if (so1->so_type == SOCK_DGRAM) {
+		/*
+		 * Bind both sockets and connect them with each other.
+		 */
+		error = socket_bind(so1, NULL, 0, _SOBIND_UNSPEC, CRED());
+		if (error) {
+			return (error);
+		}
+		error = socket_bind(so2, NULL, 0, _SOBIND_UNSPEC, CRED());
+		if (error) {
+			return (error);
+		}
+		name.sou_family = AF_UNIX;
+		name.sou_addr = sti2->sti_ux_laddr;
+		error = socket_connect(so1, (struct sockaddr *)&name,
+		    (socklen_t)sizeof (name), 0, _SOCONNECT_NOXLATE, CRED());
+		if (error) {
+			return (error);
+		}
+		name.sou_addr = sti1->sti_ux_laddr;
+		error = socket_connect(so2, (struct sockaddr *)&name,
+		    (socklen_t)sizeof (name), 0, _SOCONNECT_NOXLATE, CRED());
+		return (error);
+	} else {
+		sonode_t *nso;
+
+		/*
+		 * Bind both sockets, with 'so1' being a listener.  Connect
+		 * 'so2' to 'so1', doing so as nonblocking to avoid waiting for
+		 * soaccept to complete.  Accept the connection on 'so1',
+		 * replacing the socket/vnode in 'fp1' with the new connection.
+		 *
+		 * We could simply call socket_listen() here (which would do the
+		 * binding automatically) if the code didn't rely on passing
+		 * _SOBIND_NOXLATE to the TPI implementation of socket_bind().
+		 */
+		error = socket_bind(so1, NULL, 0, _SOBIND_UNSPEC|
+		    _SOBIND_NOXLATE|_SOBIND_LISTEN|_SOBIND_SOCKETPAIR, CRED());
+		if (error) {
+			return (error);
+		}
+		error = socket_bind(so2, NULL, 0, _SOBIND_UNSPEC, CRED());
+		if (error) {
+			return (error);
+		}
+
+		name.sou_family = AF_UNIX;
+		name.sou_addr = sti1->sti_ux_laddr;
+		error = socket_connect(so2,
+		    (struct sockaddr *)&name,
+		    (socklen_t)sizeof (name),
+		    FNONBLOCK, _SOCONNECT_NOXLATE, CRED());
+		if (error != 0 && error != EINPROGRESS) {
+			return (error);
+		}
+
+		error = socket_accept(so1, 0, CRED(), &nso);
+		if (error) {
+			return (error);
+		}
+
+		/* wait for so2 being SS_CONNECTED */
+		mutex_enter(&so2->so_lock);
+		error = sowaitconnected(so2, 0, 0);
+		mutex_exit(&so2->so_lock);
+		if (error != 0) {
+			(void) socket_close(nso, 0, CRED());
+			socket_destroy(nso);
+			return (error);
+		}
+
+		(void) socket_close(so1, 0, CRED());
+		socket_destroy(so1);
+		fp1->f_vnode = SOTOV(nso);
+	}
+	return (0);
+}
+
+long
+lx_socketpair(int domain, int type, int protocol, int *sv)
+{
+	int err, options, fds[2];
+	file_t *fps[2];
+	boolean_t emul_seqp = B_FALSE;
+
+	/*
+	 * For the special case of SOCK_SEQPACKET for AF_UNIX, we want to treat
+	 * this as a SOCK_DGRAM. The semantics are similar, but our native code
+	 * will not pass cmsg creds over a connection-oriented socket, unlike a
+	 * connectionless one. Some Linux code depends on this for Unix-domain
+	 * sockets. In particular, a sockopt of SO_PASSCRED, which we map into
+	 * our native SO_RECVUCRED, must work across fork so that the correct
+	 * pid of the sender is available in the cmsg. See the comment in
+	 * lx_setsockopt_socket().
+	 */
+	if (domain == LX_AF_UNIX && type == LX_SOCK_SEQPACKET) {
+		type = LX_SOCK_DGRAM;
+		emul_seqp = B_TRUE;
+	}
+
+	if ((err = lx_convert_sock_args(domain, type, protocol, &domain, &type,
+	    &options, &protocol)) != 0) {
+		return (set_errno(err));
+	}
+
+	if ((err = lx_socket_create(domain, type, protocol, options, &fps[0],
+	    &fds[0])) != 0) {
+		return (set_errno(err));
+	}
+
+	/*
+	 * While it seems silly to check the family after socket creation, this
+	 * is done to appease LTP when it tries some outlandish combinations of
+	 * domain/type/protocol.  The socket_create function is relied upon to
+	 * emit the expected errors.
+	 */
+	if (VTOSO(fps[0]->f_vnode)->so_family != AF_UNIX) {
+		lx_socket_destroy(fps[0], fds[0]);
+		return (set_errno(EOPNOTSUPP));
+	}
+
+	if ((err = lx_socket_create(domain, type, protocol, options, &fps[1],
+	    &fds[1])) != 0) {
+		lx_socket_destroy(fps[0], fds[0]);
+		return (set_errno(err));
+	}
+
+	err = lx_socketpair_connect(fps[0], fps[1]);
+	if (err != 0) {
+		lx_socket_destroy(fps[0], fds[0]);
+		lx_socket_destroy(fps[1], fds[1]);
+		return (set_errno(err));
+	}
+
+	if (emul_seqp) {
+		int i;
+		for (i = 0; i < 2; i++) {
+			sonode_t *so = VTOSO(fps[i]->f_vnode);
+			lx_socket_aux_data_t *sad = lx_sad_acquire(SOTOV(so));
+			sad->lxsad_flags |= LXSAD_FL_EMULSEQPKT;
+			mutex_exit(&sad->lxsad_lock);
+		}
+	}
+
+	setf(fds[0], fps[0]);
+	setf(fds[1], fps[1]);
+
+	if ((options & SOCK_CLOEXEC) != 0) {
+		f_setfd(fds[0], FD_CLOEXEC);
+		f_setfd(fds[1], FD_CLOEXEC);
+	}
+	if (copyout(fds, sv, sizeof (fds)) != 0) {
+		(void) closeandsetf(fds[0], NULL);
+		(void) closeandsetf(fds[1], NULL);
+		return (set_errno(EFAULT));
+	}
+	return (0);
+}
+
+
+#if defined(_SYSCALL32_IMPL)
+
+#define	LX_SYS_SOCKETCALL		102
+#define	LX_SOCKETCALL_MAX		20
+
+typedef long (*lx_sockfn_t)();
+
+static struct {
+	lx_sockfn_t s_fn;	/* Function implementing the subcommand */
+	int s_nargs;		/* Number of arguments the function takes */
+} lx_socketcall_fns[] = {
+	lx_socket,	3,	/* socket */
+	lx_bind,	3,	/* bind */
+	lx_connect,	3,	/* connect */
+	lx_listen,	2,	/* listen */
+	lx_accept,	3,	/* accept */
+	lx_getsockname,	3,	/* getsockname */
+	lx_getpeername,	3,	/* getpeername */
+	lx_socketpair,	4,	/* socketpair */
+	lx_send,	4,	/* send */
+	lx_recv,	4,	/* recv */
+	lx_sendto,	6,	/* sendto */
+	lx_recvfrom,	6,	/* recvfrom */
+	lx_shutdown,	2,	/* shutdown */
+	lx_setsockopt,	5,	/* setsockopt */
+	lx_getsockopt,	5,	/* getsockopt */
+	lx_sendmsg,	3,	/* sendmsg */
+	lx_recvmsg,	3,	/* recvmsg */
+	lx_accept4,	4,	/* accept4 */
+	NULL,		5,	/* recvmmsg */
+	NULL,		4	/* sendmmsg */
+};
+
+long
+lx_socketcall(long p1, uint32_t *p2)
+{
+	int subcmd, i;
+	unsigned long args[6] = { 0, 0, 0, 0, 0, 0 };
+
+	/* incoming subcmds are 1-indexed */
+	subcmd = (int)p1 - 1;
+
+	if (subcmd < 0 || subcmd >= LX_SOCKETCALL_MAX ||
+	    lx_socketcall_fns[subcmd].s_fn == NULL) {
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * Copy the arguments to the subcommand in from the app's address
+	 * space, returning EFAULT if we get a bogus pointer.
+	 */
+	for (i = 0; i < lx_socketcall_fns[subcmd].s_nargs; i++) {
+		uint32_t arg;
+
+		if (copyin(&p2[i], &arg, sizeof (uint32_t)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		args[i] = (unsigned long)arg;
+	}
+
+	return ((lx_socketcall_fns[subcmd].s_fn)(args[0], args[1], args[2],
+	    args[3], args[4], args[5]));
+}
+
+#endif /* defined(_SYSCALL32_IMPL) */
+
+static void
+lx_socket_vsd_free(void *data)
+{
+	lx_socket_aux_data_t *entry;
+
+	entry = (lx_socket_aux_data_t *)data;
+	mutex_destroy(&entry->lxsad_lock);
+	kmem_free(entry, sizeof (*entry));
+}
+
+void
+lx_socket_init()
+{
+	vsd_create(&lx_socket_vsd, lx_socket_vsd_free);
+}
+
+void
+lx_socket_fini()
+{
+	vsd_destroy(&lx_socket_vsd);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_splice.c b/usr/src/uts/common/brand/lx/syscall/lx_splice.c
new file mode 100644
index 0000000000..64db538413
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_splice.c
@@ -0,0 +1,491 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017, Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/zone.h>
+#include <sys/brand.h>
+#include <sys/sunddi.h>
+#include <sys/fs/fifonode.h>
+#include <sys/strsun.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+#include <sys/lx_misc.h>
+#include <sys/lx_signal.h>
+
+/* Splice flags */
+#define	LX_SPLICE_F_MOVE	0x01
+#define	LX_SPLICE_F_NONBLOCK	0x02
+#define	LX_SPLICE_F_MORE	0x04
+#define	LX_SPLICE_F_GIFT	0x08
+
+/*
+ * Use a max buffer size of 32k. This is a good compromise between doing I/O in
+ * large chunks, the limit on how much data we can write into an lx pipe by
+ * default (LX_DEFAULT_PIPE_SIZE), and how much kernel memory we'll allocate.
+ */
+#define	LX_SPL_BUF_SIZE		(32 * 1024)
+
+/*
+ * We only want to read as much from the input fd as we can write into the
+ * output fd, up to our buffer size. Figure out what that quantity is.
+ * Note that len will continuously decrease to 0 which triggers the typical
+ * end of the splice loop.
+ */
+static size_t
+lx_spl_wr_sz(file_t *fp_out, u_offset_t fileoff, size_t bsz, size_t len,
+    boolean_t first)
+{
+	size_t sz;
+
+	sz = MIN(bsz, len);
+	if (fp_out->f_vnode->v_type == VFIFO) {
+		/*
+		 * If no readers on pipe, or if it would go over high water
+		 * mark then return 0. Note that the first write into a
+		 * pipe is expected to block if we're over the high water mark.
+		 */
+		fifonode_t *fn_dest = VTOF(fp_out->f_vnode)->fn_dest;
+		fifolock_t *fn_lock = fn_dest->fn_lock;
+
+		mutex_enter(&fn_lock->flk_lock);
+		if (fn_dest->fn_rcnt == 0) {
+			sz = 0;
+		} else if (!first &&
+		    (sz + fn_dest->fn_count) > fn_dest->fn_hiwat) {
+			sz = 0;
+		}
+		mutex_exit(&fn_lock->flk_lock);
+	} else if (fp_out->f_vnode->v_type == VREG) {
+		if (fileoff >= curproc->p_fsz_ctl ||
+		    fileoff >= OFFSET_MAX(fp_out)) {
+			sz = 0;
+		} else {
+			sz = MIN(sz, (size_t)curproc->p_fsz_ctl - fileoff);
+			sz = MIN(sz, (size_t)OFFSET_MAX(fp_out) - fileoff);
+		}
+	}
+
+	/*
+	 * if (fp_out->f_vnode->v_type == VSOCK)
+	 *
+	 * There is no good way to determine if a socket is "full". A write for
+	 * the different protocol implementations can return EWOULDBLOCK under
+	 * different conditions, none of which we can easily check for in
+	 * advance.
+	 */
+
+	return (sz);
+}
+
+/*
+ * The splice read function handles "reading" from a pipe and passes everything
+ * else along to our normal VOP_READ code path.
+ *
+ * When we have a pipe as our input, we don't want to consume the data out
+ * of the pipe until the write has succeeded. This aligns more closely with
+ * the Linux behavior when a write error occurs. Thus, when a pipe is the input
+ * and we got some data, we return with the fifo flagged as FIFORDBLOCK. This
+ * ensures that the data we're writing cannot be consumed by another thread
+ * until we consume it ourself.
+ *
+ * The pipe "read" code here is derived from the fifo I_PEEK code.
+ */
+static int
+lx_spl_read(file_t *fp, uio_t *uiop, size_t *nread, boolean_t pipe_in,
+    boolean_t rd_pos)
+{
+	fifonode_t *fnp;
+	fifolock_t *fn_lock;
+	int count;
+	mblk_t *bp;
+
+	if (!pipe_in)
+		return (lx_read_common(fp, uiop, nread, rd_pos));
+
+	ASSERT(fp->f_vnode->v_type == VFIFO);
+	fnp = VTOF(fp->f_vnode);
+	fn_lock = fnp->fn_lock;
+	*nread = 0;
+
+	mutex_enter(&fn_lock->flk_lock);
+
+	/*
+	 * If the pipe has been switched to socket mode then this implies an
+	 * internal programmatic error. Likewise, if it was switched to
+	 * socket mode because we dropped the lock to set the stayfast flag.
+	 */
+	if ((fnp->fn_flag & FIFOFAST) == 0 || !fifo_stayfast_enter(fnp)) {
+		mutex_exit(&fn_lock->flk_lock);
+		return (EBADF);
+	}
+
+	while (fnp->fn_count == 0 || (fnp->fn_flag & FIFORDBLOCK) != 0) {
+		fifonode_t *fn_dest = fnp->fn_dest;
+
+		/* No writer, EOF */
+		if (fn_dest->fn_wcnt == 0 || fn_dest->fn_rcnt == 0) {
+			fifo_stayfast_exit(fnp);
+			mutex_exit(&fn_lock->flk_lock);
+			return (0);
+		}
+
+		/* If non-blocking, return EAGAIN otherwise 0. */
+		if (uiop->uio_fmode & (FNDELAY|FNONBLOCK)) {
+			fifo_stayfast_exit(fnp);
+			mutex_exit(&fn_lock->flk_lock);
+			if (uiop->uio_fmode & FNONBLOCK)
+				return (EAGAIN);
+			return (0);
+		}
+
+		/* Wait for data */
+		fnp->fn_flag |= FIFOWANTR;
+		if (!cv_wait_sig_swap(&fnp->fn_wait_cv, &fn_lock->flk_lock)) {
+			fifo_stayfast_exit(fnp);
+			mutex_exit(&fn_lock->flk_lock);
+			return (EINTR);
+		}
+	}
+
+	VERIFY((fnp->fn_flag & FIFORDBLOCK) == 0);
+	VERIFY((fnp->fn_flag & FIFOSTAYFAST) != 0);
+
+	/* Get up to our read size or whatever is currently available. */
+	count = MIN(uiop->uio_resid, fnp->fn_count);
+	ASSERT(count > 0);
+	*nread = count;
+	bp = fnp->fn_mp;
+	while (count > 0) {
+		uint_t cnt = MIN(uiop->uio_resid, MBLKL(bp));
+
+		/*
+		 * We have the input pipe locked and we know there is data
+		 * available to consume. We're doing a UIO_SYSSPACE move into
+		 * an internal buffer that we allocated in lx_splice() so
+		 * this should never fail.
+		 */
+		VERIFY(uiomove((char *)bp->b_rptr, cnt, UIO_READ, uiop) == 0);
+		count -= cnt;
+		bp = bp->b_cont;
+	}
+
+	fnp->fn_flag |= FIFORDBLOCK;
+
+	mutex_exit(&fn_lock->flk_lock);
+	return (0);
+}
+
+/*
+ * We've already "read" the data out of the pipe without actually consuming it.
+ * Here we update the pipe to consume the data and discard it. This is derived
+ * from the fifo_read code, except that we already know the amount of data
+ * in the pipe to consume and we don't have to actually move any data.
+ */
+static void
+lx_spl_consume(file_t *fp, uint_t count)
+{
+	fifonode_t *fnp, *fn_dest;
+	fifolock_t *fn_lock;
+
+	ASSERT(fp->f_vnode->v_type == VFIFO);
+
+	fnp = VTOF(fp->f_vnode);
+	fn_lock = fnp->fn_lock;
+
+	mutex_enter(&fn_lock->flk_lock);
+	VERIFY(fnp->fn_count >= count);
+
+	while (count > 0) {
+		int bpsize = MBLKL(fnp->fn_mp);
+		int decr_size = MIN(bpsize, count);
+
+		fnp->fn_count -= decr_size;
+		if (bpsize <= decr_size) {
+			mblk_t *bp = fnp->fn_mp;
+			fnp->fn_mp = fnp->fn_mp->b_cont;
+			freeb(bp);
+		} else {
+			fnp->fn_mp->b_rptr += decr_size;
+		}
+
+		count -= decr_size;
+	}
+
+	fnp->fn_flag &= ~FIFORDBLOCK;
+	fifo_stayfast_exit(fnp);
+
+	fifo_wakereader(fnp, fn_lock);
+
+	/*
+	 * Wake up any blocked writers, processes sleeping on POLLWRNORM, or
+	 * processes waiting for SIGPOLL.
+	 */
+	fn_dest = fnp->fn_dest;
+	if (fn_dest->fn_flag & (FIFOWANTW | FIFOHIWATW) &&
+	    fnp->fn_count < fn_dest->fn_hiwat) {
+		fifo_wakewriter(fn_dest, fn_lock);
+	}
+
+	/* Update vnode update access time */
+	fnp->fn_atime = fnp->fn_dest->fn_atime = gethrestime_sec();
+
+	mutex_exit(&fn_lock->flk_lock);
+}
+
+/*
+ * Transfer data from the input file descriptor to the output file descriptor
+ * without leaving the kernel. For Linux this is limited by it's kernel
+ * implementation which forces at least one of the file descriptors to be a
+ * pipe. Our implementation is likely quite different from the Linux
+ * one, which appears to play some VM tricks with shared pages from the pipe
+ * code. Instead, our implementation uses our normal VOP_READ/VOP_WRITE
+ * operations to internally move the data while using a single uio buffer. We
+ * implement the additional Linux behavior around the various checks and
+ * limitations.
+ *
+ * One key point on the read side is how we handle an input pipe. We don't
+ * want to consume the data out of the pipe until the write has succeeded.
+ * This aligns more closely with the Linux behavior when a write error occurs.
+ * The lx_spl_read() and lx_spl_consume() functions are used to handle this
+ * case.
+ */
+long
+lx_splice(int fd_in, off_t *off_in, int fd_out, off_t *off_out, size_t len,
+    uint_t flags)
+{
+	int error = 0;
+	file_t *fp_in = NULL, *fp_out = NULL;
+	boolean_t found_pipe = B_FALSE, rd_pos = B_FALSE, wr_pos = B_FALSE;
+	boolean_t first = B_TRUE, pipe_in = B_FALSE;
+	iovec_t iov;
+	uio_t uio;
+	void *buf = NULL;
+	off_t r_off = 0, w_off = 0;
+	ushort_t r_flag, w_flag;
+	size_t bsize = 0, wr_sz, nread, nwrite, total = 0;
+
+	/*
+	 * Start by validating the inputs.
+	 *
+	 * Linux doesn't bother to check for valid flags, so neither do we.
+	 * Also, aside from SPLICE_F_NONBLOCK, we ignore the rest of the
+	 * flags since they're just hints to the Linux kernel implementation
+	 * and have no effect on the proper functioning of the syscall.
+	 */
+
+	if (len == 0)
+		return (0);
+
+	if ((fp_in = getf(fd_in)) == NULL) {
+		error = EBADF;
+		goto done;
+	}
+	switch (fp_in->f_vnode->v_type) {
+	case VFIFO:
+		/* A fifo that is not in fast mode does not count as a pipe */
+		if (((VTOF(fp_in->f_vnode))->fn_flag & FIFOFAST) != 0) {
+			found_pipe = B_TRUE;
+			pipe_in = B_TRUE;
+		}
+		/*FALLTHROUGH*/
+	case VSOCK:
+		if (off_in != NULL) {
+			error = ESPIPE;
+			goto done;
+		}
+		break;
+	case VREG:
+	case VBLK:
+	case VCHR:
+	case VPROC:
+		if (off_in != NULL) {
+			if (copyin(off_in, &r_off, sizeof (r_off)) != 0) {
+				error = EFAULT;
+				goto done;
+			}
+			rd_pos = B_TRUE;
+		}
+		break;
+	default:
+		error = EBADF;
+		goto done;
+	}
+	r_flag = fp_in->f_flag;
+	if ((r_flag & FREAD) == 0) {
+		error = EBADF;
+		goto done;
+	}
+
+	if ((fp_out = getf(fd_out)) == NULL) {
+		error = EBADF;
+		goto done;
+	}
+	switch (fp_out->f_vnode->v_type) {
+	case VFIFO:
+		found_pipe = B_TRUE;
+		/* Splicing to ourself returns EINVAL on Linux */
+		if (pipe_in) {
+			fifonode_t *fnp = VTOF(fp_in->f_vnode);
+			if (VTOF(fp_out->f_vnode) == fnp->fn_dest) {
+				error = EINVAL;
+				goto done;
+			}
+		}
+		/*FALLTHROUGH*/
+	case VSOCK:
+		if (off_out != NULL) {
+			error = ESPIPE;
+			goto done;
+		}
+		break;
+	case VREG:
+	case VBLK:
+	case VCHR:
+	case VPROC:
+		if (off_out != NULL) {
+			if (copyin(off_out, &w_off, sizeof (w_off)) != 0) {
+				error = EFAULT;
+				goto done;
+			}
+			wr_pos = B_TRUE;
+		}
+		break;
+	default:
+		error = EBADF;
+		goto done;
+	}
+	w_flag = fp_out->f_flag;
+	if ((w_flag & FWRITE) == 0) {
+		error = EBADF;
+		goto done;
+	}
+	/* Appending is invalid for output fd in splice */
+	if ((w_flag & FAPPEND) != 0) {
+		error = EINVAL;
+		goto done;
+	}
+
+	if (!found_pipe) {
+		error = EINVAL;
+		goto done;
+	}
+
+	/*
+	 * Check for non-blocking pipe operations. If no data in the input
+	 * pipe, return EAGAIN. If the output pipe is full, return EAGAIN.
+	 */
+	if (flags & LX_SPLICE_F_NONBLOCK) {
+		fifonode_t *fn_dest;
+
+		if (fp_in->f_vnode->v_type == VFIFO) {
+			fn_dest = VTOF(fp_in->f_vnode)->fn_dest;
+			if (fn_dest->fn_count == 0) {
+				error = EAGAIN;
+				goto done;
+			}
+		}
+		if (fp_out->f_vnode->v_type == VFIFO) {
+			fn_dest = VTOF(fp_out->f_vnode)->fn_dest;
+			fifolock_t *fn_lock = fn_dest->fn_lock;
+			mutex_enter(&fn_lock->flk_lock);
+			if (fn_dest->fn_count >= fn_dest->fn_hiwat) {
+				mutex_exit(&fn_lock->flk_lock);
+				error = EAGAIN;
+				goto done;
+			}
+			mutex_exit(&fn_lock->flk_lock);
+		}
+	}
+
+	bsize = MIN(LX_SPL_BUF_SIZE, len);
+
+	buf = kmem_alloc(bsize, KM_SLEEP);
+	bzero(&uio, sizeof (uio));
+	uio.uio_iovcnt = 1;
+	uio.uio_iov = &iov;
+	uio.uio_segflg = UIO_SYSSPACE;
+	uio.uio_llimit = curproc->p_fsz_ctl;
+
+	/*
+	 * Loop reading data from fd_in and writing to fd_out. This is
+	 * controlled by how much of the requested data we can actually write,
+	 * particularly when the destination is a pipe. This matches the Linux
+	 * behavior, which may terminate earlier than the full 'len' if the
+	 * pipe fills up. However, we need to block when writing into a full
+	 * pipe on the first iteration of the loop. We already checked above
+	 * for a full output pipe when non-blocking.
+	 */
+	while ((wr_sz = lx_spl_wr_sz(fp_out, w_off, bsize, len, first)) > 0) {
+		first = B_FALSE;
+
+		/* (re)setup for a read */
+		uio.uio_resid = iov.iov_len = wr_sz; /* only rd. max writable */
+		iov.iov_base = buf;
+		uio.uio_offset = r_off;
+		uio.uio_extflg = UIO_COPY_CACHED;
+		uio.uio_fmode = r_flag;
+		error = lx_spl_read(fp_in, &uio, &nread, pipe_in, rd_pos);
+		if (error != 0 || nread == 0)
+			break;
+		r_off = uio.uio_offset;
+
+		/* Setup and perform a write from the same buffer */
+		uio.uio_resid = iov.iov_len = nread;
+		iov.iov_base = buf;
+		uio.uio_offset = w_off;
+		uio.uio_extflg = UIO_COPY_DEFAULT;
+		uio.uio_fmode = w_flag;
+		error = lx_write_common(fp_out, &uio, &nwrite, wr_pos);
+		if (error != 0) {
+			if (pipe_in) {
+				/* Need to unblock reading from the fifo. */
+				fifonode_t *fnp = VTOF(fp_in->f_vnode);
+
+				mutex_enter(&fnp->fn_lock->flk_lock);
+				fnp->fn_flag &= ~FIFORDBLOCK;
+				fifo_stayfast_exit(fnp);
+				fifo_wakereader(fnp, fnp->fn_lock);
+				mutex_exit(&fnp->fn_lock->flk_lock);
+			}
+			break;
+		}
+		w_off  = uio.uio_offset;
+
+		/*
+		 * If input is a pipe, then we can consume the amount of data
+		 * out of the pipe that we successfully wrote.
+		 */
+		if (pipe_in)
+			lx_spl_consume(fp_in, nwrite);
+
+		total += nwrite;
+		len -= nwrite;
+	}
+
+done:
+	if (buf != NULL)
+		kmem_free(buf, bsize);
+	if (fp_in != NULL)
+		releasef(fd_in);
+	if (fp_out != NULL)
+		releasef(fd_out);
+	if (error != 0)
+		return (set_errno(error));
+
+	return (total);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_stat.c b/usr/src/uts/common/brand/lx/syscall/lx_stat.c
new file mode 100644
index 0000000000..9af0080138
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_stat.c
@@ -0,0 +1,486 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/vnode.h>
+#include <sys/file.h>
+#include <sys/fcntl.h>
+#include <sys/debug.h>
+#include <sys/errno.h>
+#include <sys/model.h>
+#include <sys/mode.h>
+#include <sys/stat.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_fcntl.h>
+#include <sys/lx_types.h>
+#include <sys/lx_impl.h>
+#include <sys/brand.h>
+#include <sys/ddi.h>
+
+/* From "uts/common/syscall/stat.c" */
+extern int cstatat_getvp(int, char *, int, vnode_t **, cred_t **);
+
+typedef struct lx_timespec32 {
+	int32_t	ts_sec;
+	int32_t	ts_nsec;
+} lx_timespec32_t;
+
+typedef struct lx_timespec64 {
+	int64_t	ts_sec;
+	int64_t	ts_nsec;
+}lx_timespec64_t;
+
+struct lx_stat32 {
+	uint16_t	st_dev;
+	uint16_t	st_pad1;
+	uint32_t	st_ino;
+	uint16_t	st_mode;
+	uint16_t	st_nlink;
+	uint16_t	st_uid;
+	uint16_t	st_gid;
+	uint16_t	st_rdev;
+	uint16_t 	st_pad2;
+	uint32_t	st_size;
+	uint32_t	st_blksize;
+	uint32_t	st_blocks;
+	lx_timespec32_t	st_atime;
+	lx_timespec32_t	st_mtime;
+	lx_timespec32_t	st_ctime;
+	uint32_t	st_pad3;
+	uint32_t	st_pad4;
+};
+
+#pragma pack(4)
+struct lx_stat64_32 {
+	uint64_t	st_dev;
+	uint32_t	st_pad1;
+	uint32_t	st_small_ino;
+	uint32_t	st_mode;
+	uint32_t	st_nlink;
+	uint32_t	st_uid;
+	uint32_t	st_gid;
+	uint64_t	st_rdev;
+	uint32_t	st_pad2;
+	uint64_t	st_size;
+	uint32_t	st_blksize;
+	uint64_t	st_blocks;
+	lx_timespec32_t	st_atime;
+	lx_timespec32_t	st_mtime;
+	lx_timespec32_t	st_ctime;
+	uint64_t	st_ino;
+};
+#pragma pack()
+
+#if defined(_LP64)
+struct lx_stat64_64 {
+	uint64_t	st_dev;
+	uint64_t	st_ino;
+	uint64_t	st_nlink;	/* yes, the order really is */
+	uint32_t	st_mode;	/* different for these two */
+	uint32_t	st_uid;
+	uint32_t	st_gid;
+	uint32_t	st_pad0;
+	uint64_t	st_rdev;
+	int64_t		st_size;
+	int64_t		st_blksize;
+	int64_t		st_blocks;
+	lx_timespec64_t	st_atime;
+	lx_timespec64_t	st_mtime;
+	lx_timespec64_t	st_ctime;
+	int64_t		st_unused[3];
+};
+#endif /* defined(_LP64) */
+
+typedef enum lx_stat_fmt {
+	LXF_STAT32,
+	LXF_STAT64_32,
+	LXF_STAT64_64
+} lx_stat_fmt_t;
+
+static void
+lx_stat_xlate_dev(vattr_t *vattr)
+{
+	lx_zone_data_t *lxzd = ztolxzd(curproc->p_zone);
+	dev_t dev;
+	lx_virt_disk_t *vd;
+	boolean_t is_dev;
+
+	if (S_ISCHR(vattr->va_mode) || S_ISBLK(vattr->va_mode)) {
+		dev = vattr->va_rdev;
+		is_dev = B_TRUE;
+	} else {
+		dev = vattr->va_fsid;
+		is_dev = B_FALSE;
+	}
+
+	/*
+	 * See if this is the /dev/zfs device. If it is, the device number has
+	 * already been converted to Linux format in the lx devfs so we have
+	 * to check for that and not a native major/minor style.
+	 */
+	if (S_ISCHR(vattr->va_mode) &&
+	    LX_GETMAJOR(dev) == getmajor(lxzd->lxzd_zfs_dev) &&
+	    LX_GETMINOR(dev) == 0) {
+		/*
+		 * We use the /dev/zfs device as a placeholder for our in-zone
+		 * fabricated /dev/zfsds0 device that we're pretending / is
+		 * mounted on. lx_zone_get_zfsds has pre-allocated this
+		 * entry in the emulated device list. Reset dev so we can
+		 * properly match in the following loop.
+		 */
+		dev = curproc->p_zone->zone_rootvp->v_vfsp->vfs_dev;
+	}
+
+	/* Substitute emulated major/minor on zvols or mounted datasets. */
+	vd = list_head(lxzd->lxzd_vdisks);
+	while (vd != NULL) {
+		if (vd->lxvd_real_dev == dev) {
+			dev = vd->lxvd_emul_dev;
+			/*
+			 * We only update rdev for matching zfds/zvol devices
+			 * so that the other devices are unchanged.
+			 */
+			if (is_dev) {
+				vattr->va_rdev = LX_MAKEDEVICE(getmajor(dev),
+				    getminor(dev));
+			}
+			break;
+		}
+		vd = list_next(lxzd->lxzd_vdisks, vd);
+	}
+
+	/* Mangle st_dev into expected format */
+	vattr->va_fsid = LX_MAKEDEVICE(getmajor(dev), getminor(dev));
+}
+
+static long
+lx_stat_common(vnode_t *vp, cred_t *cr, void *outp, lx_stat_fmt_t fmt,
+    int follow)
+{
+	vattr_t vattr;
+	mode_t mode;
+	int error, flags;
+
+	/*
+	 * When symlink following is desired, the ATTR_REAL flag is necessary
+	 * to circumvent some of the weird behavior present in filesystems like
+	 * lx_proc.
+	 */
+	flags = (follow == FOLLOW) ? ATTR_REAL : 0;
+
+	vattr.va_mask = AT_STAT | AT_NBLOCKS | AT_BLKSIZE | AT_SIZE;
+	if ((error = VOP_GETATTR(vp, &vattr, flags, cr, NULL)) != 0) {
+		return (error);
+	}
+
+	mode = VTTOIF(vattr.va_type) | vattr.va_mode;
+	if ((mode & S_IFMT) == S_IFBLK) {
+		/* Linux seems to report a 0 st_size for all block devices */
+		vattr.va_size = 0;
+	}
+	if (vattr.va_rdev == NODEV) {
+		/* Linux leaves st_rdev zeroed when it is absent */
+		vattr.va_rdev = 0;
+	}
+
+	lx_stat_xlate_dev(&vattr);
+
+	if (fmt == LXF_STAT32) {
+		struct lx_stat32 sb;
+
+		if (vattr.va_fsid > USHRT_MAX || vattr.va_rdev > USHRT_MAX ||
+		    vattr.va_nlink > USHRT_MAX || vattr.va_size > INT_MAX) {
+			return (EOVERFLOW);
+		}
+
+		bzero(&sb, sizeof (sb));
+		sb.st_dev = vattr.va_fsid;
+		sb.st_ino = vattr.va_nodeid;
+		sb.st_mode = mode;
+		sb.st_nlink = vattr.va_nlink;
+		sb.st_uid = LX_UID32_TO_UID16(vattr.va_uid);
+		sb.st_gid = LX_GID32_TO_GID16(vattr.va_gid);
+		sb.st_rdev = vattr.va_rdev;
+		sb.st_size = vattr.va_size;
+		sb.st_blksize = vattr.va_blksize;
+		sb.st_blocks = vattr.va_nblocks;
+		sb.st_atime.ts_sec = vattr.va_atime.tv_sec;
+		sb.st_atime.ts_nsec = vattr.va_atime.tv_nsec;
+		sb.st_mtime.ts_sec = vattr.va_mtime.tv_sec;
+		sb.st_mtime.ts_nsec = vattr.va_mtime.tv_nsec;
+		sb.st_ctime.ts_sec = vattr.va_ctime.tv_sec;
+		sb.st_ctime.ts_nsec = vattr.va_ctime.tv_nsec;
+		if (copyout(&sb, outp, sizeof (sb)) != 0) {
+			return (EFAULT);
+		}
+		return (0);
+	} else if (fmt == LXF_STAT64_32) {
+		struct lx_stat64_32 sb;
+
+		bzero(&sb, sizeof (sb));
+		sb.st_dev = vattr.va_fsid;
+		sb.st_ino = vattr.va_nodeid;
+		sb.st_small_ino = (vattr.va_nodeid & UINT_MAX);
+		sb.st_mode = mode;
+		sb.st_nlink = vattr.va_nlink;
+		sb.st_uid = vattr.va_uid;
+		sb.st_gid = vattr.va_gid;
+		sb.st_rdev = vattr.va_rdev;
+		sb.st_size = vattr.va_size;
+		sb.st_blksize = vattr.va_blksize;
+		sb.st_blocks = vattr.va_nblocks;
+		sb.st_atime.ts_sec = vattr.va_atime.tv_sec;
+		sb.st_atime.ts_nsec = vattr.va_atime.tv_nsec;
+		sb.st_mtime.ts_sec = vattr.va_mtime.tv_sec;
+		sb.st_mtime.ts_nsec = vattr.va_mtime.tv_nsec;
+		sb.st_ctime.ts_sec = vattr.va_ctime.tv_sec;
+		sb.st_ctime.ts_nsec = vattr.va_ctime.tv_nsec;
+		if (copyout(&sb, outp, sizeof (sb)) != 0) {
+			return (EFAULT);
+		}
+		return (0);
+	} else if (fmt == LXF_STAT64_64) {
+#if defined(_LP64)
+		struct lx_stat64_64 sb;
+
+		bzero(&sb, sizeof (sb));
+		sb.st_dev = vattr.va_fsid;
+		sb.st_ino = vattr.va_nodeid;
+		sb.st_mode = mode;
+		sb.st_nlink = vattr.va_nlink;
+		sb.st_uid = vattr.va_uid;
+		sb.st_gid = vattr.va_gid;
+		sb.st_rdev = vattr.va_rdev;
+		sb.st_size = vattr.va_size;
+		sb.st_blksize = vattr.va_blksize;
+		sb.st_blocks = vattr.va_nblocks;
+		sb.st_atime.ts_sec = vattr.va_atime.tv_sec;
+		sb.st_atime.ts_nsec = vattr.va_atime.tv_nsec;
+		sb.st_mtime.ts_sec = vattr.va_mtime.tv_sec;
+		sb.st_mtime.ts_nsec = vattr.va_mtime.tv_nsec;
+		sb.st_ctime.ts_sec = vattr.va_ctime.tv_sec;
+		sb.st_ctime.ts_nsec = vattr.va_ctime.tv_nsec;
+		if (copyout(&sb, outp, sizeof (sb)) != 0) {
+			return (EFAULT);
+		}
+		return (0);
+#else
+		/* Invalid output format on 32-bit */
+		VERIFY(0);
+#endif
+	}
+
+	/* Invalid output format */
+	VERIFY(0);
+	return (0);
+}
+
+long
+lx_stat32(char *name, void *outp)
+{
+	vnode_t *vp = NULL;
+	cred_t *cr = NULL;
+	int error;
+
+	if ((error = cstatat_getvp(AT_FDCWD, name, FOLLOW, &vp, &cr)) != 0) {
+		return (set_errno(error));
+	}
+	error = lx_stat_common(vp, cr, outp, LXF_STAT32, FOLLOW);
+	VN_RELE(vp);
+	crfree(cr);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_fstat32(int fd, void *outp)
+{
+	file_t *fp;
+	int error;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+	error = lx_stat_common(fp->f_vnode, fp->f_cred, outp, LXF_STAT32,
+	    FOLLOW);
+	releasef(fd);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_lstat32(char *name, void *outp)
+{
+	vnode_t *vp = NULL;
+	cred_t *cr = NULL;
+	int error;
+
+	if ((error = cstatat_getvp(AT_FDCWD, name, NO_FOLLOW, &vp, &cr)) != 0) {
+		return (set_errno(error));
+	}
+	error = lx_stat_common(vp, cr, outp, LXF_STAT32, NO_FOLLOW);
+	VN_RELE(vp);
+	crfree(cr);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_stat64(char *name, void *outp)
+{
+	vnode_t *vp = NULL;
+	cred_t *cr = NULL;
+	model_t model = get_udatamodel();
+	int error;
+
+	if ((error = cstatat_getvp(AT_FDCWD, name, FOLLOW, &vp, &cr)) != 0) {
+		return (set_errno(error));
+	}
+	error = lx_stat_common(vp, cr, outp,
+	    (model == DATAMODEL_LP64) ? LXF_STAT64_64 : LXF_STAT64_32, FOLLOW);
+	VN_RELE(vp);
+	crfree(cr);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_fstat64(int fd, void *outp)
+{
+	file_t *fp;
+	model_t model = get_udatamodel();
+	int error;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+	error = lx_stat_common(fp->f_vnode, fp->f_cred, outp,
+	    (model == DATAMODEL_LP64) ? LXF_STAT64_64 : LXF_STAT64_32, FOLLOW);
+	releasef(fd);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+#define	LX_FSTATAT_ALLOWED	(LX_AT_SYMLINK_NOFOLLOW | LX_AT_EMPTY_PATH | \
+    LX_AT_NO_AUTOMOUNT)
+
+long
+lx_fstatat64(int fd, char *name, void *outp, int flag)
+{
+	vnode_t *vp = NULL;
+	cred_t *cr = NULL;
+	model_t model = get_udatamodel();
+	enum symfollow follow = FOLLOW;
+	int error;
+	char c;
+
+	if (fd == LX_AT_FDCWD) {
+		fd = AT_FDCWD;
+	}
+	if ((flag & ~LX_FSTATAT_ALLOWED) != 0) {
+		return (set_errno(EINVAL));
+	}
+	if ((flag & LX_AT_NO_AUTOMOUNT) != 0) {
+		/*
+		 * While AT_NO_AUTOMOUNT is a legal flag for fstatat64, it is
+		 * not yet supported by lx_autofs.
+		 */
+		lx_unsupported("fstatat(AT_NO_AUTOMOUNT)");
+		return (set_errno(EINVAL));
+	}
+	if ((flag & LX_AT_SYMLINK_NOFOLLOW) != 0) {
+		follow = NO_FOLLOW;
+	}
+
+	if (copyin(name, &c, sizeof (c)) != 0) {
+		return (set_errno(EFAULT));
+	}
+	if (c == '\0') {
+		if ((flag & LX_AT_EMPTY_PATH) == 0) {
+			return (set_errno(ENOENT));
+		}
+
+		/*
+		 * When AT_EMPTY_PATH is set and and empty string has been
+		 * passed for the name parameter, direct the lookup against the
+		 * vnode for that fd.
+		 */
+		if (fd == AT_FDCWD) {
+			mutex_enter(&curproc->p_lock);
+			vp = PTOU(curproc)->u_cdir;
+			VN_HOLD(vp);
+			mutex_exit(&curproc->p_lock);
+			cr = CRED();
+			crhold(cr);
+		} else {
+			file_t *fp;
+
+			if ((fp = getf(fd)) == NULL) {
+				return (set_errno(EBADF));
+			}
+			vp = fp->f_vnode;
+			VN_HOLD(vp);
+			cr = fp->f_cred;
+			crhold(cr);
+			releasef(fd);
+		}
+	} else {
+		if ((error = cstatat_getvp(fd, name, follow, &vp, &cr)) != 0) {
+			return (set_errno(error));
+		}
+	}
+
+	error = lx_stat_common(vp, cr, outp,
+	    (model == DATAMODEL_LP64) ? LXF_STAT64_64 : LXF_STAT64_32, follow);
+	VN_RELE(vp);
+	crfree(cr);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_lstat64(char *name, void *outp)
+{
+	vnode_t *vp = NULL;
+	cred_t *cr = NULL;
+	model_t model = get_udatamodel();
+	int error;
+
+	if ((error = cstatat_getvp(AT_FDCWD, name, NO_FOLLOW, &vp, &cr)) != 0) {
+		return (set_errno(error));
+	}
+	error = lx_stat_common(vp, cr, outp,
+	    (model == DATAMODEL_LP64) ? LXF_STAT64_64 : LXF_STAT64_32,
+	    NO_FOLLOW);
+	VN_RELE(vp);
+	crfree(cr);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_sync.c b/usr/src/uts/common/brand/lx/syscall/lx_sync.c
new file mode 100644
index 0000000000..614afca0b0
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_sync.c
@@ -0,0 +1,86 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#include <sys/systm.h>
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/vfs.h>
+#include <sys/vnode.h>
+#include <sys/lx_impl.h>
+#include <sys/lx_brand.h>
+
+long
+lx_syncfs(int fd)
+{
+	file_t *fp;
+	vfs_t *vfsp;
+
+	if ((fp = getf(fd)) == NULL)
+		return (set_errno(EBADF));
+
+	vfsp = fp->f_vnode->v_vfsp;
+	releasef(fd);
+
+	(void) (vfsp->vfs_op->vfs_sync)(vfsp, 0, CRED());
+
+	return (0);
+}
+
+#define	LX_SYNC_FILE_RANGE_WAIT_BEFORE	0x1
+#define	LX_SYNC_FILE_RANGE_WRITE	0x2
+#define	LX_SYNC_FILE_RANGE_WAIT_AFTER	0x4
+
+#define	LX_SYNC_FILE_RANGE_VALID	(LX_SYNC_FILE_RANGE_WAIT_BEFORE | \
+	LX_SYNC_FILE_RANGE_WRITE | LX_SYNC_FILE_RANGE_WAIT_AFTER)
+
+
+long
+lx_sync_file_range(int fd, off_t offset, off_t nbytes, int flags)
+{
+	file_t *fp;
+	int error, sflags = 0;
+
+	if ((flags & ~LX_SYNC_FILE_RANGE_VALID) != 0)
+		return (set_errno(EINVAL));
+	if (offset < 0 || nbytes < 0)
+		return (set_errno(EINVAL));
+
+	if ((fp = getf(fd)) == NULL)
+		return (set_errno(EBADF));
+
+	/*
+	 * Since sync_file_range is implemented in terms of VOP_PUTPAGE, both
+	 * SYNC_FILE_RANGE_WAIT flags are treated as forcing synchronous
+	 * operation.  While this differs from the Linux behavior where
+	 * BEFORE/AFTER are distinct, it achieves an adequate level of safety
+	 * since the requested data is synced out at the end of the call.
+	 */
+	if ((flags & (LX_SYNC_FILE_RANGE_WAIT_BEFORE |
+	    LX_SYNC_FILE_RANGE_WAIT_AFTER)) == 0) {
+		sflags |= B_ASYNC;
+	}
+
+	error = VOP_PUTPAGE(fp->f_vnode, offset, nbytes, sflags, CRED(), NULL);
+	if (error == ENOSYS) {
+		error = ESPIPE;
+	}
+
+	releasef(fd);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_sysinfo.c b/usr/src/uts/common/brand/lx/syscall/lx_sysinfo.c
new file mode 100644
index 0000000000..052ad322a7
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_sysinfo.c
@@ -0,0 +1,207 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <vm/anon.h>
+#include <sys/systm.h>
+#include <sys/sysmacros.h>
+#include <sys/zone.h>
+#include <sys/time.h>
+
+typedef struct lx_sysinfo {
+	int64_t si_uptime;	/* Seconds since boot */
+	uint64_t si_loads[3];	/* 1, 5, and 15 minute avg runq length */
+	uint64_t si_totalram;	/* Total memory size */
+	uint64_t si_freeram;	/* Available memory */
+	uint64_t si_sharedram;	/* Shared memory */
+	uint64_t si_bufferram;	/* Buffer memory */
+	uint64_t si_totalswap;	/* Total swap space */
+	uint64_t si_freeswap;	/* Avail swap space */
+	uint16_t si_procs;	/* Process count */
+	uint16_t si_pad;	/* Padding */
+	uint64_t si_totalhigh;	/* High memory size */
+	uint64_t si_freehigh;	/* Avail high memory */
+	uint32_t si_mem_unit;	/* Unit size of memory fields */
+} lx_sysinfo_t;
+
+#if defined(_SYSCALL32_IMPL)
+/*
+ * 64-bit kernel view of the 32-bit usermode struct.
+ */
+#pragma pack(4)
+typedef struct lx_sysinfo32 {
+	int32_t si_uptime;	/* Seconds since boot */
+	uint32_t si_loads[3];	/* 1, 5, and 15 minute avg runq length */
+	uint32_t si_totalram;	/* Total memory size */
+	uint32_t si_freeram;	/* Available memory */
+	uint32_t si_sharedram;	/* Shared memory */
+	uint32_t si_bufferram;	/* Buffer memory */
+	uint32_t si_totalswap;	/* Total swap space */
+	uint32_t si_freeswap;	/* Avail swap space */
+	uint16_t si_procs;	/* Process count */
+	uint16_t si_pad;	/* Padding */
+	uint32_t si_totalhigh;	/* High memory size */
+	uint32_t si_freehigh;	/* Avail high memory */
+	uint32_t si_mem_unit;	/* Unit size of memory fields */
+	char __si_pad[8];
+} lx_sysinfo32_t;
+#pragma pack()
+#endif
+
+extern pgcnt_t swapfs_minfree;
+
+static void
+lx_sysinfo_common(lx_sysinfo_t *si)
+{
+	zone_t *zone = curzone;
+	pgcnt_t zphysmem, zfreemem;
+	ulong_t ztotswap, zfreeswap;
+
+	si->si_uptime = gethrestime_sec() - zone->zone_boot_time;
+
+	si->si_loads[0] = zone->zone_hp_avenrun[0];
+	si->si_loads[1] = zone->zone_hp_avenrun[1];
+	si->si_loads[2] = zone->zone_hp_avenrun[2];
+
+	/*
+	 * In linux each thread looks like a process, so we conflate the
+	 * two in this stat as well.
+	 */
+	si->si_procs = (int32_t)zone->zone_nlwps;
+
+	zone_get_physmem_data(zone->zone_id, &zphysmem, &zfreemem);
+
+	if (zone->zone_max_swap_ctl == UINT64_MAX) {
+		ztotswap = k_anoninfo.ani_max;
+		zfreeswap = k_anoninfo.ani_free;
+	} else {
+		/*
+		 * See the comment in swapctl for a description of how free is
+		 * calculated within a zone.
+		 */
+		rctl_qty_t used;
+		spgcnt_t avail;
+		uint64_t max;
+
+		avail = MAX((spgcnt_t)(availrmem - swapfs_minfree), 0);
+		max = k_anoninfo.ani_max + k_anoninfo.ani_mem_resv + avail;
+
+		mutex_enter(&zone->zone_mem_lock);
+		ztotswap = btop(zone->zone_max_swap_ctl);
+		used = btop(zone->zone_max_swap);
+		mutex_exit(&zone->zone_mem_lock);
+
+		zfreeswap = MIN(ztotswap, max) - used;
+	}
+
+	/*
+	 * If the maximum memory stat is less than 1^20 pages (i.e. 4GB),
+	 * then we report the result in bytes.  Otherwise we use pages.
+	 * Once we start supporting >1TB systems/zones, we'll need a third
+	 * option.
+	 */
+	if (MAX(zphysmem, ztotswap) < 1024 * 1024) {
+		si->si_totalram = ptob(zphysmem);
+		si->si_freeram = ptob(zfreemem);
+		si->si_totalswap = ptob(ztotswap);
+		si->si_freeswap = ptob(zfreeswap);
+		si->si_mem_unit = 1;
+	} else {
+		si->si_totalram = zphysmem;
+		si->si_freeram = zfreemem;
+		si->si_totalswap = ztotswap;
+		si->si_freeswap = zfreeswap;
+		si->si_mem_unit = PAGESIZE;
+	}
+	si->si_bufferram = 0;
+	si->si_sharedram = 0;
+
+	/*
+	 * These two stats refer to high physical memory.  If an
+	 * application running in a Linux zone cares about this, then
+	 * either it or we are broken.
+	 */
+	si->si_totalhigh = 0;
+	si->si_freehigh = 0;
+}
+
+long
+lx_sysinfo64(caddr_t sip)
+{
+	lx_sysinfo_t si;
+
+	bzero(&si, sizeof (si));
+	lx_sysinfo_common(&si);
+
+	if (copyout(&si, sip, sizeof (si)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
+
+#if defined(_SYSCALL32_IMPL)
+long
+lx_sysinfo32(caddr_t sip)
+{
+	lx_sysinfo_t si;
+	lx_sysinfo32_t si32;
+	int i;
+
+	lx_sysinfo_common(&si);
+
+	/*
+	 * Convert the lx_sysinfo_t into the legacy 32-bit view:
+	 */
+	bzero(&si32, sizeof (si32));
+	si32.si_uptime = si.si_uptime;
+
+	for (i = 0; i < 3; i++) {
+		if ((si.si_loads[i]) > 0x7fffffff)
+			si32.si_loads[i] = 0x7fffffff;
+		else
+			si32.si_loads[i] = si.si_loads[i];
+	}
+
+	si32.si_procs = si.si_procs;
+	si32.si_totalram = si.si_totalram;
+	si32.si_freeram = si.si_freeram;
+	si32.si_totalswap = si.si_totalswap;
+	si32.si_freeswap = si.si_freeswap;
+	si32.si_mem_unit = si.si_mem_unit;
+
+	si32.si_bufferram = si.si_bufferram;
+	si32.si_sharedram = si.si_sharedram;
+
+	si32.si_totalhigh = si.si_totalhigh;
+	si32.si_freehigh = si.si_freehigh;
+
+	if (copyout(&si32, sip, sizeof (si32)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
+#endif
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_thread_area.c b/usr/src/uts/common/brand/lx/syscall/lx_thread_area.c
new file mode 100644
index 0000000000..a84c17e139
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_thread_area.c
@@ -0,0 +1,194 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/cpuvar.h>
+#include <sys/archsystm.h>
+#include <sys/proc.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_ldt.h>
+#include <sys/lx_misc.h>
+#include <sys/x86_archext.h>
+#include <sys/controlregs.h>
+#include <lx_syscall.h>
+
+/* ARGSUSED */
+long
+lx_arch_prctl(int code, ulong_t addr)
+{
+#if defined(__amd64)
+	klwp_t *lwp = ttolwp(curthread);
+	lx_lwp_data_t *llwp = lwptolxlwp(lwp);
+	pcb_t *pcb = &lwp->lwp_pcb;
+
+	switch (code) {
+	case LX_ARCH_GET_FS:
+		if (copyout(&llwp->br_lx_fsbase, (void *)addr,
+		    sizeof (llwp->br_lx_fsbase)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		break;
+
+	case LX_ARCH_SET_FS:
+		llwp->br_lx_fsbase = addr;
+
+		kpreempt_disable();
+		if (pcb->pcb_fsbase != llwp->br_lx_fsbase) {
+			pcb->pcb_fsbase = llwp->br_lx_fsbase;
+
+			/*
+			 * Ensure we go out via update_sregs.
+			 */
+			PCB_SET_UPDATE_SEGS(pcb);
+		}
+		kpreempt_enable();
+		break;
+
+	case LX_ARCH_GET_GS:
+		if (copyout(&llwp->br_lx_gsbase, (void *)addr,
+		    sizeof (llwp->br_lx_gsbase)) != 0) {
+			return (set_errno(EFAULT));
+		}
+		break;
+
+	case LX_ARCH_SET_GS:
+		llwp->br_lx_gsbase = addr;
+
+		kpreempt_disable();
+		if (pcb->pcb_gsbase != llwp->br_lx_gsbase) {
+			pcb->pcb_gsbase = llwp->br_lx_gsbase;
+
+			/*
+			 * Ensure we go out via update_sregs.
+			 */
+			PCB_SET_UPDATE_SEGS(pcb);
+		}
+		kpreempt_enable();
+		break;
+
+	default:
+		return (set_errno(EINVAL));
+	}
+#endif
+
+	return (0);
+}
+
+long
+lx_get_thread_area(struct ldt_info *inf)
+{
+	struct lx_lwp_data *jlwp = ttolxlwp(curthread);
+	struct ldt_info ldt_inf;
+	user_desc_t *dscrp;
+	int entry;
+
+	if (fuword32(&inf->entry_number, (uint32_t *)&entry))
+		return (set_errno(EFAULT));
+
+	if (entry < GDT_TLSMIN || entry > GDT_TLSMAX)
+		return (set_errno(EINVAL));
+
+	dscrp = jlwp->br_tls + entry - GDT_TLSMIN;
+
+	/*
+	 * convert the solaris ldt to the linux format expected by the
+	 * caller
+	 */
+	DESC_TO_LDT_INFO(dscrp, &ldt_inf);
+	ldt_inf.entry_number = entry;
+
+	if (copyout(&ldt_inf, inf, sizeof (struct ldt_info)))
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+long
+lx_set_thread_area(struct ldt_info *inf)
+{
+	struct lx_lwp_data *jlwp = ttolxlwp(curthread);
+	struct ldt_info ldt_inf;
+	user_desc_t *dscrp;
+	int entry;
+	int i;
+
+	if (copyin(inf, &ldt_inf, sizeof (ldt_inf)))
+		return (set_errno(EFAULT));
+
+	entry = ldt_inf.entry_number;
+	if (entry == -1) {
+		/*
+		 * Find an empty entry in the tls for this thread.
+		 * The casts assume each user_desc_t entry is 8 bytes.
+		 */
+		for (i = 0, dscrp = jlwp->br_tls; i < LX_TLSNUM; i++, dscrp++) {
+			if (((uint_t *)dscrp)[0] == 0 &&
+			    ((uint_t *)dscrp)[1] == 0)
+				break;
+		}
+
+		if (i < LX_TLSNUM) {
+			/*
+			 * found one
+			 */
+			entry = i + GDT_TLSMIN;
+			if (suword32(&inf->entry_number, entry))
+				return (set_errno(EFAULT));
+		} else {
+			return (set_errno(ESRCH));
+		}
+	}
+
+	if (entry < GDT_TLSMIN || entry > GDT_TLSMAX)
+		return (set_errno(EINVAL));
+
+	/*
+	 * convert the linux ldt info to standard intel descriptor
+	 */
+	dscrp = jlwp->br_tls + entry - GDT_TLSMIN;
+
+	if (LDT_INFO_EMPTY(&ldt_inf)) {
+		((uint_t *)dscrp)[0] = 0;
+		((uint_t *)dscrp)[1] = 0;
+	} else {
+		LDT_INFO_TO_DESC(&ldt_inf, dscrp);
+	}
+
+	/*
+	 * update the gdt with the new descriptor
+	 */
+	kpreempt_disable();
+
+	for (i = 0, dscrp = jlwp->br_tls; i < LX_TLSNUM; i++, dscrp++)
+		lx_set_gdt(GDT_TLSMIN + i, dscrp);
+
+	kpreempt_enable();
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_time.c b/usr/src/uts/common/brand/lx/syscall/lx_time.c
new file mode 100644
index 0000000000..b9bc8e5ab4
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_time.c
@@ -0,0 +1,72 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017, Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/times.h>
+#include <sys/msacct.h>
+#include <sys/lx_userhz.h>
+
+/* See the comment on LX_USERHZ for more details. */
+#define	LX_NSEC_PER_USERHZ	(NANOSEC / LX_USERHZ)
+#define	NSEC_TO_LX_USERHZ(nsec)	((nsec) / LX_NSEC_PER_USERHZ)
+
+/*
+ * Our times(2) implementation is based on the native times(2), but with
+ * the necessary scaling to adjust to USER_HZ. Also, Linux avoids writing
+ * to a NULL tp, whereas our native code returns EFAULT.
+ */
+long
+lx_times(struct tms *tp)
+{
+	proc_t *p = curproc;
+	struct tms p_time;
+	clock_t ret_lbolt;
+
+	mutex_enter(&p->p_lock);
+	p_time.tms_utime =
+	    (clock_t)NSEC_TO_LX_USERHZ(mstate_aggr_state(p, LMS_USER));
+	p_time.tms_stime =
+	    (clock_t)NSEC_TO_LX_USERHZ(mstate_aggr_state(p, LMS_SYSTEM));
+	p_time.tms_cutime = HZ_TO_LX_USERHZ(p->p_cutime);
+	p_time.tms_cstime = HZ_TO_LX_USERHZ(p->p_cstime);
+	mutex_exit(&p->p_lock);
+
+#ifdef _SYSCALL32_IMPL
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		struct tms32 t32;
+
+		t32.tms_utime = p_time.tms_utime;
+		t32.tms_stime = p_time.tms_stime;
+		t32.tms_cutime = p_time.tms_cutime;
+		t32.tms_cstime = p_time.tms_cstime;
+
+		if (tp != NULL && copyout(&t32, tp, sizeof (t32)) != 0)
+			return (set_errno(EFAULT));
+
+		ret_lbolt = ddi_get_lbolt();
+		return ((clock32_t)HZ_TO_LX_USERHZ(ret_lbolt));
+	} else
+#endif /* _SYSCALL32_IMPL */
+	{
+		if (tp != NULL && copyout(&p_time, tp, sizeof (p_time)) != 0)
+			return (set_errno(EFAULT));
+
+		ret_lbolt = ddi_get_lbolt();
+		return (HZ_TO_LX_USERHZ(ret_lbolt));
+	}
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_timer.c b/usr/src/uts/common/brand/lx/syscall/lx_timer.c
new file mode 100644
index 0000000000..279bdbddc7
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_timer.c
@@ -0,0 +1,637 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * The illumos kernel provides two clock backends: CLOCK_REALTIME, the
+ * adjustable system wall clock; and CLOCK_HIGHRES, the monotonically
+ * increasing time source that is not subject to drift or adjustment.  By
+ * contrast, the Linux kernel is furnished with an overabundance of narrowly
+ * differentiated clock types.
+ *
+ * Fortunately, most of the commonly used Linux clock types are either similar
+ * enough to the native clock backends that they can be directly mapped, or
+ * represent queries to the per-process and per-LWP microstate counters.
+ *
+ * CLOCK_BOOTTIME is identical to CLOCK_MONOTONIC, except that it takes into
+ * account time that the system is suspended. Since that is uninteresting to
+ * us, we treat it the same.
+ */
+
+#include <sys/time.h>
+#include <sys/systm.h>
+#include <sys/cmn_err.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_impl.h>
+#include <lx_signum.h>
+
+/*
+ * From "uts/common/os/timer.c":
+ */
+extern int clock_settime(clockid_t, timespec_t *);
+extern int clock_gettime(clockid_t, timespec_t *);
+extern int clock_getres(clockid_t, timespec_t *);
+extern int nanosleep(timespec_t *, timespec_t *);
+
+
+static int lx_emul_clock_getres(clockid_t, timespec_t *);
+static int lx_emul_clock_gettime(clockid_t, timespec_t *);
+static int lx_emul_clock_settime(clockid_t, timespec_t *);
+
+typedef struct lx_clock_backend {
+	clockid_t lclk_ntv_id;
+	int (*lclk_clock_getres)(clockid_t, timespec_t *);
+	int (*lclk_clock_gettime)(clockid_t, timespec_t *);
+	int (*lclk_clock_settime)(clockid_t, timespec_t *);
+} lx_clock_backend_t;
+
+/*
+ * NOTE: The Linux man pages state this structure is obsolete and is
+ * unsupported, so it is declared here for sizing purposes only.
+ */
+struct lx_timezone {
+	int tz_minuteswest;	/* minutes W of Greenwich */
+	int tz_dsttime;		/* type of dst correction */
+};
+
+/*
+ * Use the native clock_* system call implementation, but with a translated
+ * clock identifier:
+ */
+#define	NATIVE(ntv_id)							\
+	{ ntv_id, clock_getres, clock_gettime, clock_settime }
+
+/*
+ * This backend is not supported, so we provide an emulation handler:
+ */
+#define	EMUL(ntv_id)							\
+	{ ntv_id, lx_emul_clock_getres, lx_emul_clock_gettime,		\
+	    lx_emul_clock_settime }
+
+static lx_clock_backend_t lx_clock_backends[] = {
+	NATIVE(CLOCK_REALTIME),		/* LX_CLOCK_REALTIME */
+	NATIVE(CLOCK_HIGHRES),		/* LX_CLOCK_MONOTONIC */
+	EMUL(CLOCK_PROCESS_CPUTIME_ID),	/* LX_CLOCK_PROCESS_CPUTIME_ID */
+	EMUL(CLOCK_THREAD_CPUTIME_ID),	/* LX_CLOCK_THREAD_CPUTIME_ID */
+	NATIVE(CLOCK_HIGHRES),		/* LX_CLOCK_MONOTONIC_RAW */
+	NATIVE(CLOCK_REALTIME),		/* LX_CLOCK_REALTIME_COARSE */
+	NATIVE(CLOCK_HIGHRES),		/* LX_CLOCK_MONOTONIC_COARSE */
+	NATIVE(CLOCK_HIGHRES)		/* LX_CLOCK_BOOTTIME */
+};
+
+#define	LX_CLOCK_MAX \
+	(sizeof (lx_clock_backends) / sizeof (lx_clock_backends[0]))
+#define	LX_CLOCK_BACKEND(clk) (((clk) < LX_CLOCK_MAX && (clk) >= 0) ? \
+	&lx_clock_backends[(clk)] : NULL)
+
+/*
+ * Linux defines the size of the sigevent structure to be 64 bytes.  In order
+ * to meet that definition, the trailing union includes a member which pads it
+ * out to the desired length for the given architecture.
+ */
+#define	LX_SIGEV_PAD_SIZE	((64 - \
+	(sizeof (int) * 2 + sizeof (union sigval))) / sizeof (int))
+
+typedef struct {
+	union sigval	lx_sigev_value;
+	int		lx_sigev_signo;
+	int		lx_sigev_notify;
+	union {
+		int	lx_pad[LX_SIGEV_PAD_SIZE];
+		int	lx_tid;
+		struct {
+			void (*lx_notify_function)(union sigval);
+			void *lx_notify_attribute;
+		} lx_sigev_thread;
+	} lx_sigev_un;
+} lx_sigevent_t;
+
+
+#ifdef _SYSCALL32_IMPL
+
+#define	LX_SIGEV32_PAD_SIZE	((64 - \
+	(sizeof (int) * 2 + sizeof (union sigval32))) / sizeof (int))
+
+typedef struct {
+	union sigval32	lx_sigev_value;
+	int		lx_sigev_signo;
+	int		lx_sigev_notify;
+	union {
+		int	lx_pad[LX_SIGEV32_PAD_SIZE];
+		int	lx_tid;
+		struct {
+			caddr32_t lx_notify_function;
+			caddr32_t lx_notify_attribute;
+		} lx_sigev_thread;
+	} lx_sigev_un;
+} lx_sigevent32_t;
+
+#endif /* _SYSCALL32_IMPL */
+
+#define	LX_SIGEV_SIGNAL		0
+#define	LX_SIGEV_NONE		1
+#define	LX_SIGEV_THREAD		2
+#define	LX_SIGEV_THREAD_ID	4
+
+/*
+ * Access private SIGEV_THREAD_ID callback state in itimer_t
+ */
+#define	LX_SIGEV_THREAD_ID_LPID(it)	((it)->it_cb_data[0])
+#define	LX_SIGEV_THREAD_ID_TID(it)	((it)->it_cb_data[1])
+
+
+/* ARGSUSED */
+static int
+lx_emul_clock_settime(clockid_t clock, timespec_t *tp)
+{
+	return (set_errno(EINVAL));
+}
+
+static int
+lx_emul_clock_gettime(clockid_t clock, timespec_t *tp)
+{
+	timespec_t t;
+
+	switch (clock) {
+	case CLOCK_PROCESS_CPUTIME_ID: {
+		proc_t *p = ttoproc(curthread);
+		hrtime_t snsecs, unsecs;
+
+		/*
+		 * Based on getrusage() in "rusagesys.c":
+		 */
+		mutex_enter(&p->p_lock);
+		unsecs = mstate_aggr_state(p, LMS_USER);
+		snsecs = mstate_aggr_state(p, LMS_SYSTEM);
+		mutex_exit(&p->p_lock);
+
+		hrt2ts(unsecs + snsecs, &t);
+		break;
+	}
+
+	case CLOCK_THREAD_CPUTIME_ID: {
+		klwp_t *lwp = ttolwp(curthread);
+		struct mstate *ms = &lwp->lwp_mstate;
+		hrtime_t snsecs, unsecs;
+
+		/*
+		 * Based on getrusage_lwp() in "rusagesys.c":
+		 */
+		unsecs = ms->ms_acct[LMS_USER];
+		snsecs = ms->ms_acct[LMS_SYSTEM] + ms->ms_acct[LMS_TRAP];
+
+		scalehrtime(&unsecs);
+		scalehrtime(&snsecs);
+
+		hrt2ts(unsecs + snsecs, &t);
+		break;
+	}
+
+	default:
+		return (set_errno(EINVAL));
+	}
+
+#if defined(_SYSCALL32_IMPL)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		timespec32_t t32;
+
+		if (TIMESPEC_OVERFLOW(&t)) {
+			return (set_errno(EOVERFLOW));
+		}
+		TIMESPEC_TO_TIMESPEC32(&t32, &t);
+
+		if (copyout(&t32, tp, sizeof (t32)) != 0) {
+			return (set_errno(EFAULT));
+		}
+
+		return (0);
+	}
+#endif
+
+	if (copyout(&t, tp, sizeof (t)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
+
+static int
+lx_emul_clock_getres(clockid_t clock, timespec_t *tp)
+{
+	timespec_t t;
+
+	if (tp == NULL) {
+		return (0);
+	}
+
+	switch (clock) {
+	case CLOCK_PROCESS_CPUTIME_ID:
+	case CLOCK_THREAD_CPUTIME_ID:
+		/*
+		 * These clock backends return microstate accounting values for
+		 * the LWP or the entire process.  The Linux kernel claims they
+		 * have nanosecond resolution; so will we.
+		 */
+		t.tv_sec = 0;
+		t.tv_nsec = 1;
+		break;
+
+	default:
+		return (set_errno(EINVAL));
+	}
+
+#if defined(_SYSCALL32_IMPL)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		timespec32_t t32;
+
+		if (TIMESPEC_OVERFLOW(&t)) {
+			return (set_errno(EOVERFLOW));
+		}
+		TIMESPEC_TO_TIMESPEC32(&t32, &t);
+
+		if (copyout(&t32, tp, sizeof (t32)) != 0) {
+			return (set_errno(EFAULT));
+		}
+
+		return (0);
+	}
+#endif
+
+	if (copyout(&t, tp, sizeof (t)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
+
+static void
+lx_clock_unsupported(int clock)
+{
+	char buf[100];
+
+	(void) snprintf(buf, sizeof (buf), "unsupported clock: %d", clock);
+	lx_unsupported(buf);
+}
+
+long
+lx_clock_settime(int clock, timespec_t *tp)
+{
+	lx_clock_backend_t *backend;
+
+	if ((backend = LX_CLOCK_BACKEND(clock)) == NULL) {
+		lx_clock_unsupported(clock);
+		return (set_errno(EINVAL));
+	}
+
+	return (backend->lclk_clock_settime(backend->lclk_ntv_id, tp));
+}
+
+long
+lx_clock_gettime(int clock, timespec_t *tp)
+{
+	lx_clock_backend_t *backend;
+
+	if ((backend = LX_CLOCK_BACKEND(clock)) == NULL) {
+		lx_clock_unsupported(clock);
+		return (set_errno(EINVAL));
+	}
+
+	return (backend->lclk_clock_gettime(backend->lclk_ntv_id, tp));
+}
+
+long
+lx_clock_getres(int clock, timespec_t *tp)
+{
+	lx_clock_backend_t *backend;
+
+	if ((backend = LX_CLOCK_BACKEND(clock)) == NULL) {
+		lx_clock_unsupported(clock);
+		return (set_errno(EINVAL));
+	}
+
+	/*
+	 * It is important this check is performed after the clock
+	 * check. Both glibc and musl, in their clock_getcpuclockid(),
+	 * use clock_getres() with a NULL tp to validate a clock
+	 * value. Performing the tp check before the clock check could
+	 * indicate a valid clock to libc when it shouldn't.
+	 */
+	if (tp == NULL) {
+		return (0);
+	}
+
+	return (backend->lclk_clock_getres(backend->lclk_ntv_id, tp));
+}
+
+static int
+lx_ltos_sigev(lx_sigevent_t *lev, struct sigevent *sev)
+{
+	bzero(sev, sizeof (*sev));
+
+	switch (lev->lx_sigev_notify) {
+	case LX_SIGEV_NONE:
+		sev->sigev_notify = SIGEV_NONE;
+		break;
+
+	case LX_SIGEV_SIGNAL:
+	case LX_SIGEV_THREAD_ID:
+		sev->sigev_notify = SIGEV_SIGNAL;
+		break;
+
+	case LX_SIGEV_THREAD:
+		/*
+		 * Just as in illumos, SIGEV_THREAD handling is performed in
+		 * userspace with the help of SIGEV_SIGNAL/SIGEV_THREAD_ID.
+		 *
+		 * It's not expected to make an appearance in the syscall.
+		 */
+	default:
+		return (EINVAL);
+	}
+
+	sev->sigev_signo = lx_ltos_signo(lev->lx_sigev_signo, 0);
+	sev->sigev_value = lev->lx_sigev_value;
+
+	/* Ensure SIGEV_SIGNAL has a valid signo to work with. */
+	if (sev->sigev_notify == SIGEV_SIGNAL && sev->sigev_signo == 0) {
+		return (EINVAL);
+	}
+	return (0);
+}
+
+static int
+lx_sigev_copyin(lx_sigevent_t *userp, lx_sigevent_t *levp)
+{
+#ifdef _SYSCALL32_IMPL
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		lx_sigevent32_t lev32;
+
+		if (copyin(userp, &lev32, sizeof (lev32)) != 0) {
+			return (EFAULT);
+		}
+		levp->lx_sigev_value.sival_int = lev32.lx_sigev_value.sival_int;
+		levp->lx_sigev_signo = lev32.lx_sigev_signo;
+		levp->lx_sigev_notify = lev32.lx_sigev_notify;
+		levp->lx_sigev_un.lx_tid = lev32.lx_sigev_un.lx_tid;
+	} else
+#endif /* _SYSCALL32_IMPL */
+	{
+		if (copyin(userp, levp, sizeof (lx_sigevent_t)) != 0) {
+			return (EFAULT);
+		}
+	}
+	return (0);
+}
+
+static void
+lx_sigev_thread_fire(itimer_t *it)
+{
+	proc_t *p = it->it_proc;
+	pid_t lpid = (pid_t)LX_SIGEV_THREAD_ID_LPID(it);
+	id_t tid = (id_t)LX_SIGEV_THREAD_ID_TID(it);
+	lwpdir_t *ld;
+
+	ASSERT(MUTEX_HELD(&it->it_mutex));
+	ASSERT(it->it_pending == 0);
+	ASSERT(it->it_flags & IT_SIGNAL);
+	ASSERT(MUTEX_HELD(&p->p_lock));
+
+	ld = lwp_hash_lookup(p, tid);
+	if (ld != NULL) {
+		lx_lwp_data_t *lwpd;
+		kthread_t *t;
+
+		t = ld->ld_entry->le_thread;
+		lwpd = ttolxlwp(t);
+		if (lwpd != NULL && lwpd->br_pid == lpid) {
+			/*
+			 * A thread matching the LX pid is still present in the
+			 * process.  Send a targeted signal as requested.
+			 */
+			it->it_pending = 1;
+			mutex_exit(&it->it_mutex);
+			sigaddqa(p, t, it->it_sigq);
+			return;
+		}
+	}
+
+	mutex_exit(&it->it_mutex);
+}
+
+long
+lx_timer_create(int clock, lx_sigevent_t *sevp, timer_t *tidp)
+{
+	int error;
+	lx_sigevent_t lev;
+	struct sigevent sev;
+	clock_backend_t *backend = NULL;
+	proc_t *p = curproc;
+	itimer_t *itp;
+	timer_t tid;
+
+	if (clock == -2) {
+		/*
+		 * A change was made to the old userspace timer emulation to
+		 * handle this specific clock ID for MapR.  It was wrongly
+		 * mapped to CLOCK_REALTIME rather than CLOCK_THREAD_CPUTIME_ID
+		 * which it maps to.  Until the CLOCK_*_CPUTIME_ID timers can
+		 * be emulated, the admittedly incorrect mapping will remain.
+		 */
+		backend = clock_get_backend(CLOCK_REALTIME);
+	} else {
+		lx_clock_backend_t *lback = LX_CLOCK_BACKEND(clock);
+
+		if (lback != NULL) {
+			backend = clock_get_backend(lback->lclk_ntv_id);
+		}
+	}
+	if (backend == NULL) {
+		return (set_errno(EINVAL));
+	}
+
+	/* We have to convert the Linux sigevent layout to the illumos layout */
+	if (sevp != NULL) {
+		if ((error = lx_sigev_copyin(sevp, &lev)) != 0) {
+			return (set_errno(error));
+		}
+		if ((error = lx_ltos_sigev(&lev, &sev)) != 0) {
+			return (set_errno(error));
+		}
+	} else {
+		bzero(&sev, sizeof (sev));
+		sev.sigev_notify = SIGEV_SIGNAL;
+		sev.sigev_signo = SIGALRM;
+	}
+
+	if ((error = timer_setup(backend, &sev, NULL, &itp, &tid)) != 0) {
+		return (set_errno(error));
+	}
+
+	/*
+	 * The SIGEV_THREAD_ID notification method in Linux allows the caller
+	 * to target a specific thread to receive the signal.  The IT_CALLBACK
+	 * timer functionality is used to fulfill this need.  After translating
+	 * the LX pid to a SunOS thread ID (ensuring it exists in the current
+	 * process), those IDs are attached to the timer along with the custom
+	 * lx_sigev_thread_fire callback.  This targets the signal notification
+	 * properly when the timer fires.
+	 */
+	if (lev.lx_sigev_notify == LX_SIGEV_THREAD_ID) {
+		pid_t lpid, spid;
+		id_t stid;
+
+		lpid = (pid_t)lev.lx_sigev_un.lx_tid;
+		if (lx_lpid_to_spair(lpid, &spid, &stid) != 0 ||
+		    spid != curproc->p_pid) {
+			error = EINVAL;
+			goto err;
+		}
+
+		itp->it_flags |= IT_CALLBACK;
+		itp->it_cb_func = lx_sigev_thread_fire;
+		LX_SIGEV_THREAD_ID_LPID(itp) = lpid;
+		LX_SIGEV_THREAD_ID_TID(itp) = stid;
+	}
+
+	/*
+	 * When the sigevent is not specified, its sigev_value field is
+	 * expected to be populated with the timer ID.
+	 */
+	if (sevp == NULL) {
+		itp->it_sigq->sq_info.si_value.sival_int = tid;
+	}
+
+	if (copyout(&tid, tidp, sizeof (timer_t)) != 0) {
+		error = EFAULT;
+		goto err;
+	}
+
+	timer_release(p, itp);
+	return (0);
+
+err:
+	timer_delete_grabbed(p, tid, itp);
+	return (set_errno(error));
+}
+
+long
+lx_gettimeofday(struct timeval *tvp, struct lx_timezone *tzp)
+{
+	struct lx_timezone tz;
+
+	bzero(&tz, sizeof (tz));
+
+	/*
+	 * We want to be similar to libc which just does a fasttrap to
+	 * gethrestime and simply converts that result. We follow how uniqtime
+	 * does the conversion but we can't use that code since it does some
+	 * extra work which can cause the result to bounce around based on which
+	 * CPU we run on.
+	 */
+	if (tvp != NULL) {
+		struct timeval tv;
+		timestruc_t ts;
+		int usec, nsec;
+
+		gethrestime(&ts);
+		nsec = ts.tv_nsec;
+		usec = nsec + (nsec >> 2);
+		usec = nsec + (usec >> 1);
+		usec = nsec + (usec >> 2);
+		usec = nsec + (usec >> 4);
+		usec = nsec - (usec >> 3);
+		usec = nsec + (usec >> 2);
+		usec = nsec + (usec >> 3);
+		usec = nsec + (usec >> 4);
+		usec = nsec + (usec >> 1);
+		usec = nsec + (usec >> 6);
+		usec = usec >> 10;
+
+		tv.tv_sec = ts.tv_sec;
+		tv.tv_usec = usec;
+
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			if (copyout(&tv, tvp, sizeof (tv)) != 0)
+				return (set_errno(EFAULT));
+		}
+#ifdef _SYSCALL32_IMPL
+		else {
+			struct timeval32 tv32;
+
+			if (TIMEVAL_OVERFLOW(&tv))
+				return (set_errno(EOVERFLOW));
+			TIMEVAL_TO_TIMEVAL32(&tv32, &tv);
+
+			if (copyout(&tv32, tvp, sizeof (tv32)))
+				return (set_errno(EFAULT));
+		}
+#endif
+	}
+
+	/*
+	 * The Linux man page states use of the second parameter is obsolete,
+	 * but gettimeofday(2) should still return EFAULT if it is set
+	 * to a bad non-NULL pointer (sigh...)
+	 */
+	if (tzp != NULL && copyout(&tz, tzp, sizeof (tz)) != 0)
+		return (set_errno(EFAULT));
+
+	return (0);
+}
+
+/*
+ * On Linux a bad buffer will set errno to EFAULT, and on Illumos the failure
+ * mode is documented as "undefined."
+ */
+long
+lx_time(time_t *tp)
+{
+	timestruc_t ts;
+	struct timeval tv;
+
+	gethrestime(&ts);
+	tv.tv_sec = ts.tv_sec;
+	tv.tv_usec = 0;
+
+	if (get_udatamodel() == DATAMODEL_NATIVE) {
+		if (tp != NULL &&
+		    copyout(&tv.tv_sec, tp, sizeof (tv.tv_sec)) != 0)
+			return (set_errno(EFAULT));
+
+		return (tv.tv_sec);
+	}
+#ifdef _SYSCALL32_IMPL
+	else {
+		struct timeval32 tv32;
+
+		if (TIMEVAL_OVERFLOW(&tv))
+			return (set_errno(EOVERFLOW));
+		TIMEVAL_TO_TIMEVAL32(&tv32, &tv);
+
+		if (tp != NULL &&
+		    copyout(&tv32.tv_sec, tp, sizeof (tv32.tv_sec)))
+			return (set_errno(EFAULT));
+
+		return (tv32.tv_sec);
+	}
+#endif /* _SYSCALL32_IMPL */
+	/* NOTREACHED */
+}
+
+long
+lx_nanosleep(timespec_t *rqtp, timespec_t *rmtp)
+{
+	return (nanosleep(rqtp, rmtp));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_umask.c b/usr/src/uts/common/brand/lx/syscall/lx_umask.c
new file mode 100644
index 0000000000..cb5e4ed232
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_umask.c
@@ -0,0 +1,52 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/lx_misc.h>
+#include <lx_syscall.h>
+
+/* From usr/src/uts/common/syscall/umask.c */
+extern int umask(int);
+
+/*
+ * Just do what umask() does, but for the given process.
+ */
+static int
+lx_clone_umask_cb(proc_t *pp, void *arg)
+{
+	mode_t cmask = (mode_t)(intptr_t)arg;
+	mode_t orig;
+
+	orig = PTOU(pp)->u_cmask;
+	PTOU(pp)->u_cmask = (mode_t)(cmask & PERMMASK);
+	return ((int)orig);
+}
+
+long
+lx_umask(mode_t cmask)
+{
+	lx_proc_data_t *lproc = ttolxproc(curthread);
+
+	/* Handle the rare case of being in a CLONE_FS clone group */
+	if (lx_clone_grp_member(lproc, LX_CLONE_FS)) {
+		int omask;
+
+		omask = lx_clone_grp_walk(lproc, LX_CLONE_FS, lx_clone_umask_cb,
+		    (void *)(intptr_t)cmask);
+		return (omask);
+	}
+
+	return (umask(cmask));
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_uname.c b/usr/src/uts/common/brand/lx/syscall/lx_uname.c
new file mode 100644
index 0000000000..2d18408eaa
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_uname.c
@@ -0,0 +1,82 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/zone.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+
+struct lx_utsname {
+	char lxu_sysname[LX_SYS_UTS_LN];
+	char lxu_nodename[LX_SYS_UTS_LN];
+	char lxu_release[LX_SYS_UTS_LN];
+	char lxu_version[LX_SYS_UTS_LN];
+	char lxu_machine[LX_SYS_UTS_LN];
+	char lxu_domainname[LX_SYS_UTS_LN];
+};
+
+long
+lx_uname(void *uptr)
+{
+	proc_t *p = curproc;
+	lx_proc_data_t *lxpd = ptolxproc(p);
+	lx_zone_data_t *lxzd = ztolxzd(p->p_zone);
+	struct lx_utsname un;
+
+	bzero(&un, sizeof (un));
+
+	(void) strlcpy(un.lxu_sysname, LX_UNAME_SYSNAME, LX_SYS_UTS_LN);
+	(void) strlcpy(un.lxu_nodename, p->p_zone->zone_nodename,
+	    LX_SYS_UTS_LN);
+
+	mutex_enter(&lxzd->lxzd_lock);
+
+	if (lxpd->l_uname_release[0] != '\0') {
+		(void) strlcpy(un.lxu_release, lxpd->l_uname_release,
+		    LX_SYS_UTS_LN);
+	} else {
+		(void) strlcpy(un.lxu_release, lxzd->lxzd_kernel_release,
+		    LX_SYS_UTS_LN);
+	}
+	if (lxpd->l_uname_version[0] != '\0') {
+		(void) strlcpy(un.lxu_version, lxpd->l_uname_version,
+		    LX_SYS_UTS_LN);
+	} else {
+		(void) strlcpy(un.lxu_version, lxzd->lxzd_kernel_version,
+		    LX_SYS_UTS_LN);
+	}
+
+	mutex_exit(&lxzd->lxzd_lock);
+
+	if (get_udatamodel() == DATAMODEL_LP64) {
+		(void) strlcpy(un.lxu_machine, LX_UNAME_MACHINE64,
+		    LX_SYS_UTS_LN);
+	} else {
+		(void) strlcpy(un.lxu_machine, LX_UNAME_MACHINE32,
+		    LX_SYS_UTS_LN);
+	}
+	(void) strlcpy(un.lxu_domainname, p->p_zone->zone_domain,
+	    LX_SYS_UTS_LN);
+
+	if (copyout(&un, uptr, sizeof (un)) != 0) {
+		return (set_errno(EFAULT));
+	}
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_wait.c b/usr/src/uts/common/brand/lx/syscall/lx_wait.c
new file mode 100644
index 0000000000..e8358f9f69
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_wait.c
@@ -0,0 +1,377 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * wait() family of functions.
+ *
+ * The first minor difference between the Linux and Solaris family of wait()
+ * calls is that the values for WNOHANG and WUNTRACED are different. Thankfully,
+ * the exit status values are identical between the two implementations.
+ *
+ * Things get very different and very complicated when we introduce the Linux
+ * threading model.  Under linux, both threads and child processes are
+ * represented as processes.  However, the behavior of wait() with respect to
+ * each child varies according to the flags given to clone()
+ *
+ *	SIGCHLD 	The SIGCHLD signal should be sent on termination
+ *	CLONE_THREAD	The child shares the same thread group as the parent
+ *	CLONE_DETACHED	The parent receives no notification when the child exits
+ *
+ * The following flags control the Linux behavior w.r.t. the above attributes:
+ *
+ * 	__WALL		Wait on all children, regardless of type
+ * 	__WCLONE	Wait only on non-SIGCHLD children
+ * 	__WNOTHREAD	Don't wait on children of other threads in this group
+ *
+ * The following chart shows whether wait() returns when the child exits:
+ *
+ *                           default    __WCLONE    __WALL
+ *           no SIGCHLD		-	    X	      X
+ *              SIGCHLD		X	    -	      X
+ *
+ * The following chart shows whether wait() returns when the grandchild exits:
+ *
+ *                           default   __WNOTHREAD
+ * 	no CLONE_THREAD		-	    -
+ *         CLONE_THREAD		X	    -
+ *
+ * The CLONE_DETACHED flag is universal - when the child exits, no state is
+ * stored and wait() has no effect.
+ *
+ * XXX Support the above combination of options, or some reasonable subset that
+ *     covers at least fork() and pthread_create().
+ */
+
+#include <sys/wait.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_types.h>
+#include <sys/lx_misc.h>
+#include <lx_signum.h>
+#include <lx_errno.h>
+#include <lx_syscall.h>
+
+/*
+ * From "uts/common/os/exit.c" and "uts/common/syscall/rusagesys.c":
+ */
+extern int waitid(idtype_t, id_t, k_siginfo_t *, int);
+extern int rusagesys(int, void *, void *, void *, void *);
+
+/*
+ * Convert between Linux options and Solaris options, returning -1 if any
+ * invalid flags are found.
+ */
+#define	LX_WNOHANG	0x00000001
+#define	LX_WUNTRACED	0x00000002
+#define	LX_WSTOPPED	LX_WUNTRACED
+#define	LX_WEXITED	0x00000004
+#define	LX_WCONTINUED	0x00000008
+#define	LX_WNOWAIT	0x01000000
+
+#define	LX_WNOTHREAD	0x20000000
+#define	LX_WALL		0x40000000
+#define	LX_WCLONE	0x80000000
+
+#define	LX_P_ALL	0x0
+#define	LX_P_PID	0x1
+#define	LX_P_GID	0x2
+
+/*
+ * Split the passed waitpid/waitid options into two separate variables:
+ * those for the native illumos waitid(2), and the extra Linux-specific
+ * options we will handle in our brand-specific code.
+ */
+static int
+ltos_options(uintptr_t options, int *native_options, int *extra_options)
+{
+	int newoptions = 0;
+
+	if (((options) & ~(LX_WNOHANG | LX_WUNTRACED | LX_WEXITED |
+	    LX_WCONTINUED | LX_WNOWAIT | LX_WNOTHREAD | LX_WALL |
+	    LX_WCLONE)) != 0) {
+		return (-1);
+	}
+
+	*extra_options = options & (LX_WNOTHREAD | LX_WALL | LX_WCLONE);
+
+	if (options & LX_WNOHANG)
+		newoptions |= WNOHANG;
+	if (options & LX_WUNTRACED)
+		newoptions |= WUNTRACED;
+	if (options & LX_WEXITED)
+		newoptions |= WEXITED;
+	if (options & LX_WCONTINUED)
+		newoptions |= WCONTINUED;
+	if (options & LX_WNOWAIT)
+		newoptions |= WNOWAIT;
+
+	/*
+	 * The trapped option is implicit on Linux.
+	 */
+	newoptions |= WTRAPPED;
+
+	*native_options = newoptions;
+	return (0);
+}
+
+static int
+lx_wstat(int code, int status)
+{
+	int stat = 0;
+
+	switch (code) {
+	case CLD_EXITED:
+		stat = status << 8;
+		break;
+	case CLD_DUMPED:
+		stat = lx_stol_signo(status, SIGKILL) | WCOREFLG;
+		break;
+	case CLD_KILLED:
+		stat = lx_stol_signo(status, SIGKILL);
+		break;
+	case CLD_TRAPPED:
+	case CLD_STOPPED:
+		stat = (lx_stol_status(status, SIGKILL) << 8) | WSTOPFLG;
+		break;
+	case CLD_CONTINUED:
+		stat = WCONTFLG;
+		break;
+	}
+
+	return (stat);
+}
+
+static int
+lx_call_waitid(idtype_t idtype, id_t id, k_siginfo_t *sip, int native_options,
+    int extra_options)
+{
+	lx_lwp_data_t *lwpd = ttolxlwp(curthread);
+	int error;
+
+	/*
+	 * Our brand-specific waitid helper only understands a subset of
+	 * the possible idtypes.  Ensure we keep to that subset here:
+	 */
+	if (idtype != P_ALL && idtype != P_PID && idtype != P_PGID) {
+		return (EINVAL);
+	}
+
+	/*
+	 * Enable the return of emulated ptrace(2) stop conditions
+	 * through lx_waitid_helper, and stash the Linux-specific
+	 * extra waitid() flags.
+	 */
+	lwpd->br_waitid_emulate = B_TRUE;
+	lwpd->br_waitid_flags = extra_options;
+
+	if ((error = waitid(idtype, id, sip, native_options)) == EINTR) {
+		/*
+		 * According to signal(7), the wait4(2), waitid(2), and
+		 * waitpid(2) system calls are restartable.
+		 */
+		ttolxlwp(curthread)->br_syscall_restart = B_TRUE;
+	}
+
+	lwpd->br_waitid_emulate = B_FALSE;
+	lwpd->br_waitid_flags = 0;
+
+	return (error);
+}
+
+long
+lx_wait4(uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4)
+{
+	k_siginfo_t info = { 0 };
+	idtype_t idtype;
+	id_t id;
+	int status = 0;
+	pid_t pid = (pid_t)p1;
+	int error;
+	int native_options, extra_options;
+	int *statusp = (int *)p2;
+	void *rup = (void *)p4;
+
+	if (ltos_options(p3, &native_options, &extra_options) == -1) {
+		return (set_errno(EINVAL));
+	}
+
+	if (pid > maxpid) {
+		return (set_errno(ECHILD));
+	}
+
+	/*
+	 * While not listed as a valid return code, Linux's wait4(2) does,
+	 * in fact, get an EFAULT if either the status pointer or rusage
+	 * pointer is invalid. Since a failed waitpid should leave child
+	 * process in a state where a future wait4(2) will succeed, we
+	 * check them by copying out the values their buffers originally
+	 * contained.  (We need to do this as a failed system call should
+	 * never affect the contents of a passed buffer.)
+	 *
+	 * This will fail if the buffers in question are write-only.
+	 */
+	if (statusp != NULL) {
+		if (copyin(statusp, &status, sizeof (status)) != 0 ||
+		    copyout(&status, statusp, sizeof (status)) != 0) {
+			return (set_errno(EFAULT));
+		}
+	}
+
+	/*
+	 * Do the same check for the "struct rusage" pointer, which differs
+	 * in size for 32- and 64-bit processes.
+	 */
+	if (rup != NULL) {
+		struct rusage ru;
+		void *krup = &ru;
+		size_t rusz = sizeof (ru);
+#if defined(_SYSCALL32_IMPL)
+		struct rusage32 ru32;
+
+		if (get_udatamodel() != DATAMODEL_NATIVE) {
+			krup = &ru32;
+			rusz = sizeof (ru32);
+		}
+#endif
+
+		if (copyin(rup, krup, rusz) != 0 ||
+		    copyout(krup, rup, rusz) != 0) {
+			return (set_errno(EFAULT));
+		}
+	}
+
+	if (pid < -1) {
+		idtype = P_PGID;
+		id = -pid;
+	} else if (pid == -1) {
+		idtype = P_ALL;
+		id = 0;
+	} else if (pid == 0) {
+		idtype = P_PGID;
+		mutex_enter(&pidlock);
+		id = curproc->p_pgrp;
+		mutex_exit(&pidlock);
+	} else {
+		idtype = P_PID;
+		id = pid;
+	}
+
+	native_options |= (WEXITED | WTRAPPED);
+
+	if ((error = lx_call_waitid(idtype, id, &info, native_options,
+	    extra_options)) != 0) {
+		return (set_errno(error));
+	}
+
+	/*
+	 * If the WNOHANG flag was specified and no child was found return 0.
+	 */
+	if ((native_options & WNOHANG) && info.si_pid == 0) {
+		return (0);
+	}
+
+	status = lx_wstat(info.si_code, info.si_status);
+
+	/*
+	 * Unfortunately if this attempt to copy out either the status or the
+	 * rusage fails, the process will be in an inconsistent state as
+	 * subsequent calls to wait for the same child will fail where they
+	 * should succeed on a Linux system. This, however, is rather
+	 * unlikely since we tested the validity of both above.
+	 */
+	if (statusp != NULL) {
+		if (copyout(&status, statusp, sizeof (status)) != 0) {
+			return (set_errno(EFAULT));
+		}
+	}
+
+	if (rup != NULL) {
+		if ((error = rusagesys(_RUSAGESYS_GETRUSAGE_CHLD, rup, NULL,
+		    NULL, NULL)) != 0) {
+			return (set_errno(error));
+		}
+	}
+
+	return (info.si_pid);
+}
+
+long
+lx_waitpid(uintptr_t p1, uintptr_t p2, uintptr_t p3)
+{
+	return (lx_wait4(p1, p2, p3, NULL));
+}
+
+long
+lx_waitid(uintptr_t idtype, uintptr_t id, uintptr_t infop, uintptr_t opt)
+{
+	int error;
+	int native_options, extra_options;
+	k_siginfo_t info = { 0 };
+
+	if (ltos_options(opt, &native_options, &extra_options) == -1) {
+		return (set_errno(EINVAL));
+	}
+
+	if (((opt) & (LX_WEXITED | LX_WSTOPPED | LX_WCONTINUED)) == 0) {
+		return (set_errno(EINVAL));
+	}
+
+	switch (idtype) {
+	case LX_P_ALL:
+		idtype = P_ALL;
+		break;
+	case LX_P_PID:
+		idtype = P_PID;
+		break;
+	case LX_P_GID:
+		idtype = P_PGID;
+		break;
+	default:
+		return (set_errno(EINVAL));
+	}
+
+	if ((error = lx_call_waitid(idtype, id, &info, native_options,
+	    extra_options)) != 0) {
+		return (set_errno(error));
+	}
+
+	/*
+	 * If the WNOHANG flag was specified and no child was found return 0.
+	 */
+	if ((native_options & WNOHANG) && info.si_pid == 0) {
+		return (0);
+	}
+
+#if defined(_SYSCALL32_IMPL)
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		return (stol_ksiginfo32_copyout(&info, (void *)infop));
+	} else
+#endif
+	{
+		return (stol_ksiginfo_copyout(&info, (void *)infop));
+	}
+}
diff --git a/usr/src/uts/common/brand/lx/syscall/lx_xattr.c b/usr/src/uts/common/brand/lx/syscall/lx_xattr.c
new file mode 100644
index 0000000000..19bf9a4ebb
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/syscall/lx_xattr.c
@@ -0,0 +1,519 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017 Joyent, Inc.
+ */
+
+#include <sys/errno.h>
+#include <sys/systm.h>
+#include <sys/file.h>
+#include <sys/vnode.h>
+#include <sys/pathname.h>
+#include <sys/lx_acl.h>
+
+
+#define	LX_XATTR_NAME_MAX	255
+#define	LX_XATTR_SIZE_MAX	65536
+#define	LX_XATTR_LIST_MAX	65536
+
+#define	LX_XATTR_FLAG_CREATE	0x1
+#define	LX_XATTR_FLAG_REPLACE	0x2
+#define	LX_XATTR_FLAGS_VALID	(LX_XATTR_FLAG_CREATE | LX_XATTR_FLAG_REPLACE)
+
+enum lx_xattr_ns {
+	LX_XATTR_NS_SECURITY,
+	LX_XATTR_NS_SYSTEM,
+	LX_XATTR_NS_TRUSTED,
+	LX_XATTR_NS_USER,
+	LX_XATTR_NS_INVALID	/* Catch-all for invalid namespaces */
+};
+
+/* Present under the 'security.' namespace */
+#define	LX_XATTR_CAPABILITY	"capability"
+
+typedef struct lx_xattr_ns_list {
+	const char *lxnl_name;
+	unsigned lxnl_len;
+	enum lx_xattr_ns lxnl_ns;
+} lx_xattr_ns_list_t;
+
+static lx_xattr_ns_list_t lx_xattr_namespaces[] = {
+	{ "user.", 5, LX_XATTR_NS_USER },
+	{ "system.", 7, LX_XATTR_NS_SYSTEM },
+	{ "trusted.", 8, LX_XATTR_NS_TRUSTED },
+	{ "security.", 9, LX_XATTR_NS_SECURITY },
+	{ NULL, 0, LX_XATTR_NS_INVALID }
+};
+
+static int
+lx_xattr_parse(const char *name, size_t nlen, const char **key)
+{
+	lx_xattr_ns_list_t *lxn = lx_xattr_namespaces;
+
+	for (; lxn->lxnl_name != NULL; lxn++) {
+		if (nlen < lxn->lxnl_len) {
+			continue;
+		}
+		if (strncmp(lxn->lxnl_name, name, lxn->lxnl_len) == 0) {
+			*key = name + (lxn->lxnl_len);
+			return (lxn->lxnl_ns);
+		}
+	}
+
+	*key = name;
+	return (LX_XATTR_NS_INVALID);
+}
+
+/*
+ * *xattr() family of functions.
+ *
+ * These are largely unimplemented.  In most cases we return EOPNOTSUPP, rather
+ * than using NOSYS_NO_EQUIV to avoid unwanted stderr output from ls(1).
+ *
+ * Note that CRED() is used instead of f_cred in the f*xattr functions.  This
+ * is intentional as Linux does not have the same notion of per-fd credentials.
+ */
+
+/* ARGSUSED */
+static int
+lx_setxattr_common(vnode_t *vp, char *name, void *value, size_t sz, int flags)
+{
+	int error, type;
+	char name_buf[LX_XATTR_NAME_MAX + 1];
+	const char *key;
+	size_t name_len;
+	void *buf = NULL;
+
+	if ((flags & ~LX_XATTR_FLAGS_VALID) != 0) {
+		return (EINVAL);
+	}
+	error = copyinstr(name, name_buf, sizeof (name_buf), &name_len);
+	if (error == ENAMETOOLONG || name_len == sizeof (name_buf)) {
+		return (ERANGE);
+	} else if (error != 0) {
+		return (EFAULT);
+	}
+
+	type = lx_xattr_parse(name_buf, name_len, &key);
+
+	if (sz != 0) {
+		if (sz > LX_XATTR_SIZE_MAX) {
+			return (E2BIG);
+		}
+		buf = kmem_alloc(sz, KM_SLEEP);
+		if (copyin(value, buf, sz) != 0) {
+			kmem_free(buf, sz);
+			return (EFAULT);
+		}
+	}
+
+	error = EOPNOTSUPP;
+	switch (type) {
+	case LX_XATTR_NS_SECURITY:
+		/*
+		 * In order to keep package management software happy, despite
+		 * lacking support for file-based Linux capabilities via
+		 * xattrs, we fake success when root attempts a setxattr on
+		 * that attribute.
+		 */
+		if (crgetuid(CRED()) == 0 &&
+		    strcmp(key, LX_XATTR_CAPABILITY) == 0) {
+			error = 0;
+		}
+		break;
+	case LX_XATTR_NS_SYSTEM:
+		if (strcmp(key, LX_XATTR_POSIX_ACL_ACCESS) == 0) {
+			error = lx_acl_setxattr(vp, LX_ACL_ACCESS, buf, sz);
+		} else if (strcmp(key, LX_XATTR_POSIX_ACL_DEFAULT) == 0) {
+			error = lx_acl_setxattr(vp, LX_ACL_DEFAULT, buf, sz);
+		}
+	default:
+		break;
+	}
+
+	if (buf != NULL) {
+		kmem_free(buf, sz);
+	}
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+lx_getxattr_common(vnode_t *vp, char *name, char *value, size_t sz,
+    ssize_t *osz)
+{
+	int error, type;
+	char name_buf[LX_XATTR_NAME_MAX + 1];
+	const char *key;
+	size_t name_len;
+	void *buf = NULL;
+
+	error = copyinstr(name, name_buf, sizeof (name_buf), &name_len);
+	if (error == ENAMETOOLONG || name_len == sizeof (name_buf)) {
+		return (ERANGE);
+	} else if (error != 0) {
+		return (EFAULT);
+	}
+	if (sz != 0) {
+		if (sz > LX_XATTR_SIZE_MAX) {
+			sz = LX_XATTR_SIZE_MAX;
+		}
+		buf = kmem_alloc(sz, KM_SLEEP);
+	}
+
+	type = lx_xattr_parse(name_buf, name_len, &key);
+
+	error = EOPNOTSUPP;
+	switch (type) {
+	case LX_XATTR_NS_SYSTEM:
+		if (strcmp(key, LX_XATTR_POSIX_ACL_ACCESS) == 0) {
+			error = lx_acl_getxattr(vp, LX_ACL_ACCESS, buf, sz,
+			    osz);
+		} else if (strcmp(key, LX_XATTR_POSIX_ACL_DEFAULT) == 0) {
+			error = lx_acl_getxattr(vp, LX_ACL_DEFAULT, buf, sz,
+			    osz);
+		}
+		break;
+	default:
+		break;
+	}
+
+	if (error == 0 && buf != NULL) {
+		VERIFY(*osz <= sz);
+
+		if (copyout(buf, value, *osz) != 0) {
+			error = EFAULT;
+		}
+	}
+	if (buf != NULL) {
+		kmem_free(buf, sz);
+	}
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+lx_listxattr_common(vnode_t *vp, void *value, size_t size, ssize_t *osize)
+{
+	struct uio auio;
+	struct iovec aiov;
+	int err = 0;
+
+	aiov.iov_base = value;
+	aiov.iov_len = size;
+	auio.uio_iov = &aiov;
+	auio.uio_iovcnt = 1;
+	auio.uio_loffset = 0;
+	auio.uio_segflg = UIO_USERSPACE;
+	auio.uio_resid = size;
+	auio.uio_fmode = 0;
+	auio.uio_extflg = UIO_COPY_CACHED;
+
+	/*
+	 * Call into all the listxattr routines (which may be no-ops) which are
+	 * currently implemented.
+	 */
+	err = lx_acl_listxattr(vp, &auio);
+
+	if (err == 0) {
+		*osize = size - auio.uio_resid;
+	}
+
+	return (err);
+}
+
+/* ARGSUSED */
+static int
+lx_removexattr_common(vnode_t *vp, char *name)
+{
+	int error, type;
+	char name_buf[LX_XATTR_NAME_MAX + 1];
+	const char *key;
+	size_t name_len;
+
+	error = copyinstr(name, name_buf, sizeof (name_buf), &name_len);
+	if (error == ENAMETOOLONG || name_len == sizeof (name_buf)) {
+		return (ERANGE);
+	} else if (error != 0) {
+		return (EFAULT);
+	}
+
+
+	type = lx_xattr_parse(name_buf, name_len, &key);
+
+	error = EOPNOTSUPP;
+	switch (type) {
+	case LX_XATTR_NS_SYSTEM:
+		if (strcmp(key, LX_XATTR_POSIX_ACL_ACCESS) == 0) {
+			error = lx_acl_removexattr(vp, LX_ACL_ACCESS);
+		} else if (strcmp(key, LX_XATTR_POSIX_ACL_DEFAULT) == 0) {
+			error = lx_acl_removexattr(vp, LX_ACL_DEFAULT);
+		}
+	default:
+		break;
+	}
+
+	return (EOPNOTSUPP);
+}
+
+
+long
+lx_setxattr(char *path, char *name, void *value, size_t size, int flags)
+{
+	int error;
+	vnode_t *vp = NULL;
+
+	error = lookupname(path, UIO_USERSPACE, FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_setxattr_common(vp, name, value, size, flags);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_lsetxattr(char *path, char *name, void *value, size_t size, int flags)
+{
+	int error;
+	vnode_t *vp = NULL;
+
+	error = lookupname(path, UIO_USERSPACE, NO_FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_setxattr_common(vp, name, value, size, flags);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+long
+lx_fsetxattr(int fd, char *name, void *value, size_t size, int flags)
+{
+	int error;
+	file_t *fp;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+
+	error = lx_setxattr_common(fp->f_vnode, name, value, size, flags);
+	releasef(fd);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+ssize_t
+lx_getxattr(char *path, char *name, void *value, size_t size)
+{
+	int error;
+	vnode_t *vp = NULL;
+	ssize_t osize;
+
+	error = lookupname(path, UIO_USERSPACE, FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_getxattr_common(vp, name, value, size, &osize);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (osize);
+}
+
+ssize_t
+lx_lgetxattr(char *path, char *name, void *value, size_t size)
+{
+
+	int error;
+	vnode_t *vp = NULL;
+	ssize_t osize;
+
+	error = lookupname(path, UIO_USERSPACE, NO_FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_getxattr_common(vp, name, value, size, &osize);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (osize);
+}
+
+ssize_t
+lx_fgetxattr(int fd, char *name, void *value, size_t size)
+{
+	int error;
+	file_t *fp;
+	ssize_t osize;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+
+	/*
+	 * When a file is opened with O_PATH we clear read/write and fgetxattr
+	 * is expected to return EBADF.
+	 */
+	if ((fp->f_flag & (FREAD | FWRITE)) == 0) {
+		releasef(fd);
+		return (set_errno(EBADF));
+	}
+
+	error = lx_getxattr_common(fp->f_vnode, name, value, size, &osize);
+	releasef(fd);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (osize);
+}
+
+ssize_t
+lx_listxattr(char *path, char *list, size_t size)
+{
+	int error;
+	vnode_t *vp = NULL;
+	ssize_t osize;
+
+	error = lookupname(path, UIO_USERSPACE, FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_listxattr_common(vp, list, size, &osize);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (osize);
+}
+
+ssize_t
+lx_llistxattr(char *path, char *list, size_t size)
+{
+	int error;
+	vnode_t *vp = NULL;
+	ssize_t osize;
+
+	error = lookupname(path, UIO_USERSPACE, NO_FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_listxattr_common(vp, list, size, &osize);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (osize);
+}
+
+ssize_t
+lx_flistxattr(int fd, char *list, size_t size)
+{
+	int error;
+	file_t *fp;
+	ssize_t osize;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+
+	error = lx_listxattr_common(fp->f_vnode, list, size, &osize);
+	releasef(fd);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (osize);
+}
+
+int
+lx_removexattr(char *path, char *name)
+{
+	int error;
+	vnode_t *vp = NULL;
+
+	error = lookupname(path, UIO_USERSPACE, FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_removexattr_common(vp, name);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+int
+lx_lremovexattr(char *path, char *name)
+{
+	int error;
+	vnode_t *vp = NULL;
+
+	error = lookupname(path, UIO_USERSPACE, NO_FOLLOW, NULLVPP, &vp);
+	if (error != 0) {
+		return (set_errno(error));
+	}
+
+	error = lx_removexattr_common(vp, name);
+	VN_RELE(vp);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
+
+int
+lx_fremovexattr(int fd, char *name)
+{
+	int error;
+	file_t *fp;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (set_errno(EBADF));
+	}
+
+	error = lx_removexattr_common(fp->f_vnode, name);
+	releasef(fd);
+
+	if (error != 0) {
+		return (set_errno(error));
+	}
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/sysfs/lx_sysfs.h b/usr/src/uts/common/brand/lx/sysfs/lx_sysfs.h
new file mode 100644
index 0000000000..f34ed31dcb
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sysfs/lx_sysfs.h
@@ -0,0 +1,198 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef	_LXSYSFS_H
+#define	_LXSYSFS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * lx_sysfs.h: declarations, data structures and macros for lx_sysfs
+ */
+
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/policy.h>
+#include <sys/debug.h>
+#include <sys/dirent.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/kmem.h>
+#include <sys/pathname.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/user.h>
+#include <sys/t_lock.h>
+#include <sys/sysmacros.h>
+#include <sys/cred.h>
+#include <sys/priv.h>
+#include <sys/vnode.h>
+#include <sys/vfs.h>
+#include <sys/statvfs.h>
+#include <sys/cmn_err.h>
+#include <sys/zone.h>
+#include <sys/uio.h>
+#include <sys/utsname.h>
+#include <sys/dnlc.h>
+#include <sys/atomic.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <vm/as.h>
+#include <vm/anon.h>
+#include <sys/netstack.h>
+#include <inet/ip.h>
+#include <inet/ip_if.h>
+
+/*
+ * Convert a vnode into an lxsys_mnt_t
+ */
+#define	VTOLXSM(vp)	((lxsys_mnt_t *)(vp)->v_vfsp->vfs_data)
+
+/*
+ * convert a vnode into an lxsys_node
+ */
+#define	VTOLXS(vp)	((lxsys_node_t *)(vp)->v_data)
+
+/*
+ * convert a lxsys_node into a vnode
+ */
+#define	LXSTOV(lxsnp)	((lxsnp)->lxsys_vnode)
+
+/*
+ * convert a lxsys_node into zone for fs
+ */
+#define	LXSTOZ(lxsnp) \
+	(((lxsys_mnt_t *)(lxsnp)->lxsys_vnode->v_vfsp->vfs_data)->lxsysm_zone)
+
+#define	LXSNSIZ		256	/* max size of lx /sys file name entries */
+
+/*
+ * Pretend that a directory entry takes 16 bytes
+ */
+#define	LXSYS_SDSIZE	16
+
+/* Root sysfs lxsys_instance */
+#define	LXSYS_INST_ROOT	0
+
+/*
+ * Node/file types for lx /sys files
+ * (directories and files contained therein).
+ */
+typedef enum lxsys_nodetype {
+	LXSYS_NONE,		/* None-type to keep inodes non-zero	*/
+	LXSYS_STATIC,		/* Statically defined entries		*/
+	LXSYS_CLASS_NET,	/* /sys/class/net/<iface>		*/
+	LXSYS_DEV_NET,		/* /sys/devices/virtual/net/<iface>	*/
+	LXSYS_BLOCK,		/* /sys/block/<dev>			*/
+	LXSYS_DEV_ZFS,		/* /sys/devices/zfs/<dev>		*/
+	LXSYS_DEV_SYS_CPU,	/* /sys/devices/system/cpu/<cpu>	*/
+	LXSYS_DEV_SYS_CPUINFO,	/* /sys/devices/system/cpu/cpuN/<info>	*/
+	LXSYS_DEV_SYS_NODE,	/* /sys/devices/system/node/node0/<info> */
+	LXSYS_MAXTYPE,		/* type limit				*/
+} lxsys_nodetype_t;
+
+/*
+ * external dirent characteristics
+ */
+typedef struct {
+	unsigned int	d_idnum;
+	char		*d_name;
+} lxsys_dirent_t;
+
+typedef struct {
+	unsigned int	dl_instance;
+	lxsys_dirent_t	*dl_list;
+	int		dl_length;
+} lxsys_dirlookup_t;
+
+/*
+ * This is the lx sysfs private data object
+ * which is attached to v_data in the vnode structure
+ */
+struct lxsys_node;
+typedef struct lxsys_node lxsys_node_t;
+struct lxsys_node {
+	lxsys_nodetype_t	lxsys_type;	/* type ID of node 	*/
+	unsigned int		lxsys_instance;	/* instance ID node	*/
+	unsigned int		lxsys_endpoint;	/* endpoint ID node	*/
+	vnode_t			*lxsys_vnode;	/* vnode for the node	*/
+	vnode_t			*lxsys_parentvp; /* parent directory	*/
+	lxsys_node_t		*lxsys_next;	/* next list entry	*/
+	timestruc_t		lxsys_time;	/* creation time	*/
+	mode_t			lxsys_mode;	/* file mode bits	*/
+	uid_t			lxsys_uid;	/* file owner		*/
+	gid_t			lxsys_gid;	/* file group owner	*/
+	ino_t			lxsys_ino;	/* node id		*/
+};
+
+/*
+ * This is the lxsysfs private data object
+ * which is attached to vfs_data in the vfs structure
+ */
+typedef struct lxsys_mnt {
+	kmutex_t	lxsysm_lock;	/* protects fields		*/
+	lxsys_node_t	*lxsysm_node;	/* node at root of sys mount	*/
+	zone_t		*lxsysm_zone;	/* zone for this mount		*/
+} lxsys_mnt_t;
+
+extern vnodeops_t	*lxsys_vnodeops;
+
+typedef struct mounta	mounta_t;
+
+extern void lxsys_initnodecache();
+extern void lxsys_fininodecache();
+extern ino_t lxsys_inode(lxsys_nodetype_t, unsigned int, unsigned int);
+extern ino_t lxsys_parentinode(lxsys_node_t *);
+extern lxsys_node_t *lxsys_getnode(vnode_t *, lxsys_nodetype_t, unsigned int,
+    unsigned int);
+extern lxsys_node_t *lxsys_getnode_static(vnode_t *, unsigned int);
+extern void lxsys_freenode(lxsys_node_t *);
+
+extern netstack_t *lxsys_netstack(lxsys_node_t *);
+extern ill_t *lxsys_find_ill(ip_stack_t *, uint_t);
+
+extern int lxsys_ino_get_type(ino_t);
+
+typedef struct lxpr_uiobuf {
+	uio_t *uiop;
+	char *buffer;
+	uint32_t bufsize;
+	char *pos;
+	size_t beg;
+	int error;
+} lxsys_uiobuf_t;
+
+extern lxsys_uiobuf_t *lxsys_uiobuf_new(uio_t *);
+extern void lxsys_uiobuf_free(lxsys_uiobuf_t *);
+extern void lxsys_uiobuf_seterr(lxsys_uiobuf_t *, int);
+extern int lxsys_uiobuf_flush(lxsys_uiobuf_t *);
+extern void lxsys_uiobuf_write(lxsys_uiobuf_t *, const char *, size_t);
+extern void lxsys_uiobuf_printf(lxsys_uiobuf_t *uiobuf, const char *fmt, ...);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#ifndef islower
+#define	islower(x)	(((unsigned)(x) >= 'a') && ((unsigned)(x) <= 'z'))
+#endif
+#ifndef toupper
+#define	toupper(x)	(islower(x) ? (x) - 'a' + 'A' : (x))
+#endif
+
+#endif /* _LXSYSFS_H */
diff --git a/usr/src/uts/common/brand/lx/sysfs/lx_syssubr.c b/usr/src/uts/common/brand/lx/sysfs/lx_syssubr.c
new file mode 100644
index 0000000000..69234ddbaa
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sysfs/lx_syssubr.c
@@ -0,0 +1,443 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * lx_syssubr.c: Various functions for the /sys vnodeops.
+ */
+
+#include <sys/varargs.h>
+
+#include <sys/cpuvar.h>
+#include <sys/mman.h>
+#include <sys/vmsystm.h>
+#include <sys/prsystm.h>
+
+#include "lx_sysfs.h"
+
+#define	LXSYSCACHE_NAME "lxsys_cache"
+
+static int lxsys_node_constructor(void *, void *, int);
+static void lxsys_node_destructor(void *, void *);
+
+static kmem_cache_t *lxsys_node_cache;
+
+void
+lxsys_initnodecache()
+{
+	lxsys_node_cache = kmem_cache_create(LXSYSCACHE_NAME,
+	    sizeof (lxsys_node_t), 0,
+	    lxsys_node_constructor, lxsys_node_destructor, NULL, NULL, NULL, 0);
+}
+
+void
+lxsys_fininodecache()
+{
+	kmem_cache_destroy(lxsys_node_cache);
+}
+
+/* ARGSUSED */
+static int
+lxsys_node_constructor(void *buf, void *un, int kmflags)
+{
+	lxsys_node_t	*lxsnp = buf;
+	vnode_t		*vp;
+
+	vp = lxsnp->lxsys_vnode = vn_alloc(kmflags);
+	if (vp == NULL)
+		return (-1);
+
+	(void) vn_setops(vp, lxsys_vnodeops);
+	vp->v_data = lxsnp;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+lxsys_node_destructor(void *buf, void *un)
+{
+	lxsys_node_t	*lxsnp = buf;
+
+	vn_free(LXSTOV(lxsnp));
+}
+
+/*
+ * Calculate an inode number
+ *
+ * This takes various bits of info and munges them
+ * to give the inode number for an lxsys node
+ */
+ino_t
+lxsys_inode(lxsys_nodetype_t type, unsigned int instance,
+    unsigned int endpoint)
+{
+	/*
+	 * Sysfs Inode format:
+	 * 0000AABBBBCC
+	 *
+	 * AA - TYPE
+	 * BBBB - INSTANCE
+	 * CC - ENDPOINT
+	 */
+	ASSERT(instance <= 0xffff);
+	ASSERT(endpoint <= 0xff);
+
+	return ((ino_t)(type << 24)|(instance << 8)|endpoint);
+}
+
+/*
+ * Return inode number of parent (directory)
+ */
+ino_t
+lxsys_parentinode(lxsys_node_t *lxsnp)
+{
+	/*
+	 * If the input node is the root then the parent inode
+	 * is the mounted on inode so just return our inode number
+	 */
+	if (lxsnp->lxsys_type == LXSYS_STATIC &&
+	    lxsnp->lxsys_instance == LXSYS_INST_ROOT) {
+		return (lxsnp->lxsys_ino);
+	} else {
+		return (VTOLXS(lxsnp->lxsys_parentvp)->lxsys_ino);
+	}
+}
+
+/*
+ * Allocate a new lxsys node
+ *
+ * This also allocates the vnode associated with it
+ */
+lxsys_node_t *
+lxsys_getnode(vnode_t *dp, lxsys_nodetype_t type, unsigned int instance,
+    unsigned int endpoint)
+{
+	lxsys_node_t *lxsnp;
+	vnode_t *vp;
+	timestruc_t now;
+
+	/*
+	 * Allocate a new node. It is deallocated in vop_innactive
+	 */
+	lxsnp = kmem_cache_alloc(lxsys_node_cache, KM_SLEEP);
+
+	/*
+	 * Set defaults (may be overridden below)
+	 */
+	gethrestime(&now);
+	lxsnp->lxsys_type = type;
+	lxsnp->lxsys_instance = instance;
+	lxsnp->lxsys_endpoint = endpoint;
+	lxsnp->lxsys_next = NULL;
+	lxsnp->lxsys_parentvp = dp;
+	VN_HOLD(dp);
+
+	lxsnp->lxsys_time = now;
+	lxsnp->lxsys_uid = lxsnp->lxsys_gid = 0;
+	lxsnp->lxsys_ino = lxsys_inode(type, instance, endpoint);
+
+	/* initialize the vnode data */
+	vp = lxsnp->lxsys_vnode;
+	vn_reinit(vp);
+	vp->v_flag = VNOCACHE|VNOMAP|VNOSWAP|VNOMOUNT;
+	vp->v_vfsp = dp->v_vfsp;
+
+	/*
+	 * Default to a directory with open permissions.
+	 * Specific components will override this
+	 */
+	if (type == LXSYS_STATIC && instance == LXSYS_INST_ROOT) {
+		vp->v_flag |= VROOT;
+	}
+	vp->v_type = VDIR;
+	lxsnp->lxsys_mode = 0555;
+
+	return (lxsnp);
+}
+
+lxsys_node_t *
+lxsys_getnode_static(vnode_t *dp, unsigned int instance)
+{
+	lxsys_mnt_t *lxsm = VTOLXSM(dp);
+	lxsys_node_t *lnp, *tail = NULL;
+
+	mutex_enter(&lxsm->lxsysm_lock);
+	for (lnp = lxsm->lxsysm_node; lnp != NULL; lnp = lnp->lxsys_next) {
+		if (lnp->lxsys_instance == instance) {
+			VERIFY(lnp->lxsys_parentvp == dp);
+
+			VN_HOLD(lnp->lxsys_vnode);
+			mutex_exit(&lxsm->lxsysm_lock);
+			return (lnp);
+		} else if (lnp->lxsys_next == NULL) {
+			/* Found no match by the end of the list */
+			tail = lnp;
+			break;
+		}
+	}
+
+	tail->lxsys_next = lxsys_getnode(dp, LXSYS_STATIC, instance, 0);
+	lnp = tail->lxsys_next;
+	/* Allow mounts on static entries */
+	LXSTOV(lnp)->v_flag &= (~VNOMOUNT);
+	mutex_exit(&lxsm->lxsysm_lock);
+	return (lnp);
+}
+
+/* Clean up persistence for static lxsys_node */
+int
+lxsys_freenode_static(lxsys_node_t *lnp)
+{
+	lxsys_node_t *plnp;
+	vnode_t *vp = LXSTOV(lnp);
+	lxsys_mnt_t *lxsm = VTOLXSM(vp);
+
+	if (lnp->lxsys_instance == LXSYS_INST_ROOT) {
+		/*
+		 * The root vnode does not need special cleanup since it
+		 * anchors the list and is freed by lxsys_unmount.
+		 */
+		return (0);
+	}
+
+	mutex_enter(&lxsm->lxsysm_lock);
+
+	/*
+	 * It is possible that a different process acquired a fresh reference
+	 * to this vnode via lookup while we were waiting on the lxsysm_lock.
+	 * To avoid freeing the vnode out from under them, we will double-check
+	 * v_count and bail from the fop_inactive if it was grabbed.
+	 */
+	mutex_enter(&vp->v_lock);
+	if (vp->v_count != 1) {
+		VERIFY(vp->v_count > 0);
+
+		/* Release our hold before bailing out of lxsys_inactive */
+		vp->v_count--;
+
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&lxsm->lxsysm_lock);
+		return (-1);
+	}
+	mutex_exit(&vp->v_lock);
+
+	/* search for the record pointing to lnp */
+	plnp = lxsm->lxsysm_node;
+	while (plnp != NULL && plnp->lxsys_next != lnp) {
+		plnp = plnp->lxsys_next;
+	}
+	/* entry should always be found */
+	VERIFY(plnp != NULL);
+	plnp->lxsys_next = lnp->lxsys_next;
+
+	mutex_exit(&lxsm->lxsysm_lock);
+	return (0);
+}
+
+/*
+ * Free the storage obtained from lxsys_getnode().
+ */
+void
+lxsys_freenode(lxsys_node_t *lxsnp)
+{
+	vnode_t *vp = LXSTOV(lxsnp);
+
+	VERIFY(vp != NULL);
+
+	if (lxsnp->lxsys_type == LXSYS_STATIC) {
+		if (lxsys_freenode_static(lxsnp) != 0) {
+			return;
+		}
+	}
+
+	/*
+	 * delete any association with parent vp
+	 */
+	if (lxsnp->lxsys_parentvp != NULL)
+		VN_RELE(lxsnp->lxsys_parentvp);
+
+	/*
+	 * Release the lxsysnode.
+	 */
+	kmem_cache_free(lxsys_node_cache, lxsnp);
+}
+
+/*
+ * Get the netstack associated with this lxsys mount
+ */
+netstack_t *
+lxsys_netstack(lxsys_node_t *lnp)
+{
+	zone_t *zone = VTOLXSM(LXSTOV(lnp))->lxsysm_zone;
+
+	return (netstack_hold_if_active(zone->zone_netstack));
+}
+
+ill_t *
+lxsys_find_ill(ip_stack_t *ipst, uint_t ifindex)
+{
+	ill_t *ill;
+	phyint_t *phyi;
+
+	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
+	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
+	    (void *) &ifindex, NULL);
+	if (phyi != NULL) {
+		/*
+		 * Since interface information presented via /sys is not
+		 * specific to IPv4 or IPv6, an ill reference from either
+		 * protocol will be adequate.  Check both, starting with IPv4
+		 * for a valid reference to use.
+		 */
+		for (ill = phyi->phyint_illv4; ill != phyi->phyint_illv6;
+		    ill = phyi->phyint_illv6) {
+			if (ill != NULL) {
+				mutex_enter(&ill->ill_lock);
+				if (!ILL_IS_CONDEMNED(ill)) {
+					ill_refhold_locked(ill);
+					mutex_exit(&ill->ill_lock);
+					rw_exit(&ipst->ips_ill_g_lock);
+					return (ill);
+				}
+				mutex_exit(&ill->ill_lock);
+			}
+		}
+	}
+	rw_exit(&ipst->ips_ill_g_lock);
+	return (NULL);
+}
+
+
+#define	LXSYSUIOBUFSZ	4096
+
+lxsys_uiobuf_t *
+lxsys_uiobuf_new(uio_t *uiop)
+{
+	/* Allocate memory for both lxsys_uiobuf and output buffer */
+	int bufsize = LXSYSUIOBUFSZ;
+	lxsys_uiobuf_t *uiobuf =
+	    kmem_alloc(sizeof (lxsys_uiobuf_t) + bufsize, KM_SLEEP);
+
+	uiobuf->uiop = uiop;
+	uiobuf->buffer = (char *)&uiobuf[1];
+	uiobuf->bufsize = bufsize;
+	uiobuf->pos = uiobuf->buffer;
+	uiobuf->beg = 0;
+	uiobuf->error = 0;
+
+	return (uiobuf);
+}
+
+void
+lxsys_uiobuf_free(lxsys_uiobuf_t *uiobuf)
+{
+	ASSERT(uiobuf != NULL);
+	ASSERT(uiobuf->pos == uiobuf->buffer);
+
+	kmem_free(uiobuf, sizeof (lxsys_uiobuf_t) + uiobuf->bufsize);
+}
+
+void
+lxsys_uiobuf_seterr(lxsys_uiobuf_t *uiobuf, int err)
+{
+	ASSERT(uiobuf->error == 0);
+
+	uiobuf->error = err;
+}
+
+int
+lxsys_uiobuf_flush(lxsys_uiobuf_t *uiobuf)
+{
+	off_t off = uiobuf->uiop->uio_offset;
+	caddr_t uaddr = uiobuf->buffer;
+	size_t beg = uiobuf->beg;
+	size_t size = (uintptr_t)uiobuf->pos - (uintptr_t)uaddr;
+
+	if (uiobuf->error == 0 && uiobuf->uiop->uio_resid != 0) {
+		ASSERT(off >= beg);
+
+		if (beg + size > off && off >= 0)
+			uiobuf->error =
+			    uiomove(uaddr + (off - beg), size - (off - beg),
+			    UIO_READ, uiobuf->uiop);
+
+		uiobuf->beg += size;
+	}
+
+	uiobuf->pos = uaddr;
+
+	return (uiobuf->error);
+}
+
+void
+lxsys_uiobuf_write(lxsys_uiobuf_t *uiobuf, const char *buf, size_t size)
+{
+	/* While we can still carry on */
+	while (uiobuf->error == 0 && uiobuf->uiop->uio_resid != 0) {
+		uintptr_t remain = (uintptr_t)uiobuf->bufsize -
+		    ((uintptr_t)uiobuf->pos - (uintptr_t)uiobuf->buffer);
+
+		/* Enough space in buffer? */
+		if (remain >= size) {
+			bcopy(buf, uiobuf->pos, size);
+			uiobuf->pos += size;
+			return;
+		}
+
+		/* Not enough space, so copy all we can and try again */
+		bcopy(buf, uiobuf->pos, remain);
+		uiobuf->pos += remain;
+		(void) lxsys_uiobuf_flush(uiobuf);
+		buf += remain;
+		size -= remain;
+	}
+}
+
+#define	TYPBUFFSIZE 256
+
+void
+lxsys_uiobuf_printf(lxsys_uiobuf_t *uiobuf, const char *fmt, ...)
+{
+	va_list args;
+	char buff[TYPBUFFSIZE];
+	int len;
+	char *buffer;
+
+	/* Can we still do any output */
+	if (uiobuf->error != 0 || uiobuf->uiop->uio_resid == 0)
+		return;
+
+	va_start(args, fmt);
+
+	/* Try using stack allocated buffer */
+	len = vsnprintf(buff, TYPBUFFSIZE, fmt, args);
+	if (len < TYPBUFFSIZE) {
+		va_end(args);
+		lxsys_uiobuf_write(uiobuf, buff, len);
+		return;
+	}
+
+	/* Not enough space in pre-allocated buffer */
+	buffer = kmem_alloc(len + 1, KM_SLEEP);
+
+	/*
+	 * We know we allocated the correct amount of space
+	 * so no check on the return value
+	 */
+	(void) vsnprintf(buffer, len+1, fmt, args);
+	lxsys_uiobuf_write(uiobuf, buffer, len);
+	va_end(args);
+	kmem_free(buffer, len+1);
+}
diff --git a/usr/src/uts/common/brand/lx/sysfs/lx_sysvfsops.c b/usr/src/uts/common/brand/lx/sysfs/lx_sysvfsops.c
new file mode 100644
index 0000000000..fddc1e0234
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sysfs/lx_sysvfsops.c
@@ -0,0 +1,365 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * lxsysvfsops.c: vfs operations for lx sysfs.
+ *
+ * sysfs has a close relationship with the lx getdents(2) syscall. This is
+ * necessary so that the getdents code can populate the 'd_type' entries
+ * during a sysfs readdir operation. The glibc code which accesses sysfs
+ * (specifically the 'cpu' subtree) expects dirents to have the d_type field
+ * populated. One problematic consumer is java, which becomes unstable if it
+ * gets the incorrect data from glibc. When sysfs loads, it populates the
+ * lx_sysfs_vfs_type and lx_sysfs_vtype variables defined in lx_getdents.c.
+ * The getdents code can then call into sysfs to determine the d_type for any
+ * given inode directory entry.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/debug.h>
+#include <sys/errno.h>
+#include <sys/proc.h>
+#include <sys/stat.h>
+#include <sys/statvfs.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/mode.h>
+#include <sys/signal.h>
+#include <sys/user.h>
+#include <sys/mount.h>
+#include <sys/bitmap.h>
+#include <sys/kmem.h>
+#include <sys/policy.h>
+#include <sys/modctl.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <sys/lx_impl.h>
+
+#include "lx_sysfs.h"
+
+/* Module level parameters */
+static int	lxsysfstype;
+static dev_t	lxsysdev;
+static kmutex_t	lxsys_mount_lock;
+
+extern int	lx_sysfs_vfs_type;
+extern int	(*lx_sysfs_vtype)(ino_t);
+
+static int lxsys_mount(vfs_t *, vnode_t *, mounta_t *, cred_t *);
+static int lxsys_unmount(vfs_t *, int, cred_t *);
+static int lxsys_root(vfs_t *, vnode_t **);
+static int lxsys_statvfs(vfs_t *, statvfs64_t *);
+static int lxsys_init(int, char *);
+
+static vfsdef_t vfw = {
+	VFSDEF_VERSION,
+	"lx_sysfs",
+	lxsys_init,
+	VSW_ZMOUNT,
+	NULL
+};
+
+/*
+ * Module linkage information for the kernel.
+ */
+extern struct mod_ops mod_fsops;
+
+static struct modlfs modlfs = {
+	&mod_fsops, "lx brand sysfs", &vfw
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, (void *)&modlfs, NULL
+};
+
+int
+_init(void)
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int retval;
+
+	/*
+	 * attempt to unload the module
+	 */
+	if ((retval = mod_remove(&modlinkage)) != 0)
+		goto done;
+
+	lx_sysfs_vfs_type = 0;
+	lx_sysfs_vtype = NULL;
+
+	/*
+	 * destroy lxsys_node cache
+	 */
+	lxsys_fininodecache();
+
+	/*
+	 * clean out the vfsops and vnodeops
+	 */
+	(void) vfs_freevfsops_by_type(lxsysfstype);
+	vn_freevnodeops(lxsys_vnodeops);
+
+	mutex_destroy(&lxsys_mount_lock);
+done:
+	return (retval);
+}
+
+static int
+lxsys_init(int fstype, char *name)
+{
+	static const fs_operation_def_t lxsys_vfsops_template[] = {
+		VFSNAME_MOUNT,		{ .vfs_mount = lxsys_mount },
+		VFSNAME_UNMOUNT,	{ .vfs_unmount = lxsys_unmount },
+		VFSNAME_ROOT,		{ .vfs_root = lxsys_root },
+		VFSNAME_STATVFS,	{ .vfs_statvfs = lxsys_statvfs },
+		NULL,			NULL
+	};
+	extern const fs_operation_def_t lxsys_vnodeops_template[];
+	int error;
+	major_t dev;
+
+	lx_sysfs_vtype = lxsys_ino_get_type;
+	lx_sysfs_vfs_type = lxsysfstype = fstype;
+	ASSERT(lxsysfstype != 0);
+
+	mutex_init(&lxsys_mount_lock, NULL, MUTEX_DEFAULT, NULL);
+
+	/*
+	 * Associate VFS ops vector with this fstype.
+	 */
+	error = vfs_setfsops(fstype, lxsys_vfsops_template, NULL);
+	if (error != 0) {
+		cmn_err(CE_WARN, "lxsys_init: bad vfs ops template");
+		return (error);
+	}
+
+	/*
+	 * Set up vnode ops vector too.
+	 */
+	error = vn_make_ops(name, lxsys_vnodeops_template, &lxsys_vnodeops);
+	if (error != 0) {
+		(void) vfs_freevfsops_by_type(fstype);
+		cmn_err(CE_WARN, "lxsys_init: bad vnode ops template");
+		return (error);
+	}
+
+	/*
+	 * Assign a unique "device" number (used by stat(2)).
+	 */
+	if ((dev = getudev()) == (major_t)-1) {
+		cmn_err(CE_WARN, "lxsys_init: can't get unique device number");
+		dev = 0;
+	}
+
+	/*
+	 * Make the pseudo device
+	 */
+	lxsysdev = makedevice(dev, 0);
+
+	/*
+	 * Initialise cache for lxsys_nodes
+	 */
+	lxsys_initnodecache();
+
+	return (0);
+}
+
+static int
+lxsys_mount(vfs_t *vfsp, vnode_t *mvp, mounta_t *uap, cred_t *cr)
+{
+	lxsys_mnt_t *lxsys_mnt;
+	zone_t *zone = curproc->p_zone;
+
+	/*
+	 * must be root to mount
+	 */
+	if (secpolicy_fs_mount(cr, mvp, vfsp) != 0)
+		return (EPERM);
+
+	/*
+	 * mount point must be a directory
+	 */
+	if (mvp->v_type != VDIR)
+		return (ENOTDIR);
+
+	if (zone == global_zone) {
+		zone_t *mntzone;
+
+		mntzone = zone_find_by_path(refstr_value(vfsp->vfs_mntpt));
+		zone_rele(mntzone);
+		if (zone != mntzone)
+			return (EBUSY);
+	}
+
+	/*
+	 * Having the resource be anything but "lxsys" doesn't make sense
+	 */
+	vfs_setresource(vfsp, "lxsys", 0);
+
+	lxsys_mnt = kmem_alloc(sizeof (*lxsys_mnt), KM_SLEEP);
+
+	mutex_enter(&lxsys_mount_lock);
+
+	/*
+	 * Ensure we don't allow overlaying mounts
+	 */
+	mutex_enter(&mvp->v_lock);
+	if ((uap->flags & MS_OVERLAY) == 0 &&
+	    (mvp->v_count > 1 || (mvp->v_flag & VROOT))) {
+		mutex_exit(&mvp->v_lock);
+		mutex_exit(&lxsys_mount_lock);
+		kmem_free(lxsys_mnt, sizeof ((*lxsys_mnt)));
+		return (EBUSY);
+	}
+	mutex_exit(&mvp->v_lock);
+
+
+	mutex_init(&lxsys_mnt->lxsysm_lock, NULL, MUTEX_DEFAULT, NULL);
+	zone_hold(lxsys_mnt->lxsysm_zone = zone);
+
+	/* Arbitrarily set the parent vnode to the mounted over directory */
+	lxsys_mnt->lxsysm_node = lxsys_getnode(mvp, LXSYS_STATIC,
+	    LXSYS_INST_ROOT, 0);
+	lxsys_mnt->lxsysm_node->lxsys_next = NULL;
+
+	/* Correctly set the fs for the root node */
+	lxsys_mnt->lxsysm_node->lxsys_vnode->v_vfsp = vfsp;
+
+	vfs_make_fsid(&vfsp->vfs_fsid, lxsysdev, lxsysfstype);
+	vfsp->vfs_bsize = DEV_BSIZE;
+	vfsp->vfs_fstype = lxsysfstype;
+	vfsp->vfs_data = (caddr_t)lxsys_mnt;
+	vfsp->vfs_dev = lxsysdev;
+
+	mutex_exit(&lxsys_mount_lock);
+
+	return (0);
+}
+
+static int
+lxsys_unmount(vfs_t *vfsp, int flag, cred_t *cr)
+{
+	lxsys_mnt_t *lxsys_mnt = (lxsys_mnt_t *)vfsp->vfs_data;
+	lxsys_node_t *lnp;
+	vnode_t *vp;
+	int count;
+
+	VERIFY(lxsys_mnt != NULL);
+
+	mutex_enter(&lxsys_mount_lock);
+
+	/* must be root to unmount */
+	if (secpolicy_fs_unmount(cr, vfsp) != 0) {
+		mutex_exit(&lxsys_mount_lock);
+		return (EPERM);
+	}
+
+	/* forced unmount is not supported by this fs */
+	if (flag & MS_FORCE) {
+		mutex_exit(&lxsys_mount_lock);
+		return (ENOTSUP);
+	}
+
+	/* Ensure that no vnodes are in use on this mount point. */
+	lnp = lxsys_mnt->lxsysm_node;
+	vp = LXSTOV(lnp);
+	mutex_enter(&vp->v_lock);
+	count = vp->v_count;
+	mutex_exit(&vp->v_lock);
+	if (count > 1) {
+		mutex_exit(&lxsys_mount_lock);
+		return (EBUSY);
+	}
+
+	/*
+	 * If there are no references to the root vnode the list of persistent
+	 * static vnodes should be empty
+	 */
+	VERIFY(lnp->lxsys_next == NULL);
+
+	(void) dnlc_purge_vfsp(vfsp, 0);
+
+	lxsys_mnt->lxsysm_node = NULL;
+	lxsys_freenode(lnp);
+	zone_rele(lxsys_mnt->lxsysm_zone);
+	vfsp->vfs_data = NULL;
+	kmem_free(lxsys_mnt, sizeof (*lxsys_mnt));
+
+	mutex_exit(&lxsys_mount_lock);
+
+	return (0);
+}
+
+static int
+lxsys_root(vfs_t *vfsp, vnode_t **vpp)
+{
+	lxsys_mnt_t *lxsm = (lxsys_mnt_t *)vfsp->vfs_data;
+	vnode_t *vp;
+
+	VERIFY(lxsm != NULL);
+	VERIFY(lxsm->lxsysm_node != NULL);
+
+	vp = LXSTOV(lxsm->lxsysm_node);
+	VN_HOLD(vp);
+	*vpp = vp;
+
+	return (0);
+}
+
+static int
+lxsys_statvfs(vfs_t *vfsp, statvfs64_t *sp)
+{
+	dev32_t d32;
+
+	bzero((caddr_t)sp, sizeof (*sp));
+	sp->f_bsize	= DEV_BSIZE;
+	sp->f_frsize	= DEV_BSIZE;
+	sp->f_blocks	= (fsblkcnt64_t)0;
+	sp->f_bfree	= (fsblkcnt64_t)0;
+	sp->f_bavail	= (fsblkcnt64_t)0;
+	sp->f_files	= (fsfilcnt64_t)3;
+	sp->f_ffree	= (fsfilcnt64_t)0;	/* none */
+	sp->f_favail	= (fsfilcnt64_t)0;	/* none */
+	(void) cmpldev(&d32, vfsp->vfs_dev);
+	sp->f_fsid	= d32;
+	/* It is guaranteed that vsw_name will fit in f_basetype */
+	(void) strcpy(sp->f_basetype, vfssw[lxsysfstype].vsw_name);
+	sp->f_flag = vf_to_stf(vfsp->vfs_flag);
+	sp->f_namemax = 64;		/* quite arbitrary */
+	bzero(sp->f_fstr, sizeof (sp->f_fstr));
+
+	/* We know f_fstr is 32 chars */
+	(void) strcpy(sp->f_fstr, "/sys");
+	(void) strcpy(&sp->f_fstr[6], "/sys");
+
+	return (0);
+}
diff --git a/usr/src/uts/common/brand/lx/sysfs/lx_sysvnops.c b/usr/src/uts/common/brand/lx/sysfs/lx_sysvnops.c
new file mode 100644
index 0000000000..10c99baa7b
--- /dev/null
+++ b/usr/src/uts/common/brand/lx/sysfs/lx_sysvnops.c
@@ -0,0 +1,2165 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * lx_sysfs -- a Linux-compatible /sys for the LX brand
+ */
+
+#include <vm/seg_vn.h>
+#include <sys/sdt.h>
+#include <sys/strlog.h>
+#include <sys/stropts.h>
+#include <sys/cmn_err.h>
+#include <sys/lx_brand.h>
+#include <sys/x86_archext.h>
+#include <sys/archsystm.h>
+#include <sys/fp.h>
+#include <sys/pool_pset.h>
+#include <sys/pset.h>
+#include <sys/zone.h>
+#include <sys/pghw.h>
+#include <sys/vfs_opreg.h>
+#include <sys/param.h>
+#include <sys/utsname.h>
+#include <sys/lx_misc.h>
+#include <sys/brand.h>
+#include <sys/cred_impl.h>
+#include <sys/tihdr.h>
+#include <sys/sunddi.h>
+#include <sys/vnode.h>
+#include <sys/netstack.h>
+#include <sys/ethernet.h>
+#include <inet/ip_arp.h>
+
+#include "lx_sysfs.h"
+
+/*
+ * Pointer to the vnode ops vector for this fs.
+ * This is instantiated in lxsys_init() in lx_sysvfsops.c
+ */
+vnodeops_t *lxsys_vnodeops;
+
+static int lxsys_open(vnode_t **, int, cred_t *, caller_context_t *);
+static int lxsys_close(vnode_t *, int, int, offset_t, cred_t *,
+    caller_context_t *);
+static int lxsys_read(vnode_t *, uio_t *, int, cred_t *, caller_context_t *);
+static int lxsys_getattr(vnode_t *, vattr_t *, int, cred_t *,
+    caller_context_t *);
+static int lxsys_access(vnode_t *, int, int, cred_t *, caller_context_t *);
+static int lxsys_lookup(vnode_t *, char *, vnode_t **,
+    pathname_t *, int, vnode_t *, cred_t *, caller_context_t *, int *,
+    pathname_t *);
+static int lxsys_readdir(vnode_t *, uio_t *, cred_t *, int *,
+    caller_context_t *, int);
+static int lxsys_readlink(vnode_t *, uio_t *, cred_t *, caller_context_t *);
+static int lxsys_cmp(vnode_t *, vnode_t *, caller_context_t *);
+static int lxsys_sync(void);
+static void lxsys_inactive(vnode_t *, cred_t *, caller_context_t *);
+
+static vnode_t *lxsys_lookup_static(lxsys_node_t *, char *);
+static vnode_t *lxsys_lookup_class_netdir(lxsys_node_t *, char *);
+static vnode_t *lxsys_lookup_devices_virtual_netdir(lxsys_node_t *, char *);
+static vnode_t *lxsys_lookup_blockdir(lxsys_node_t *, char *);
+static vnode_t *lxsys_lookup_devices_zfsdir(lxsys_node_t *, char *);
+static vnode_t *lxsys_lookup_devices_syscpu(lxsys_node_t *, char *);
+static vnode_t *lxsys_lookup_devices_syscpuinfo(lxsys_node_t *, char *);
+static vnode_t *lxsys_lookup_devices_sysnode(lxsys_node_t *, char *);
+
+static int lxsys_read_static(lxsys_node_t *, lxsys_uiobuf_t *);
+static int lxsys_read_devices_virtual_net(lxsys_node_t *, lxsys_uiobuf_t *);
+static int lxsys_read_devices_zfs_block(lxsys_node_t *, lxsys_uiobuf_t *);
+static int lxsys_read_devices_syscpu(lxsys_node_t *, lxsys_uiobuf_t *);
+static int lxsys_read_devices_sysnode(lxsys_node_t *, lxsys_uiobuf_t *);
+
+static int lxsys_readdir_devices_syscpu(lxsys_node_t *, uio_t *, int *);
+static int lxsys_readdir_devices_syscpuinfo(lxsys_node_t *, uio_t *, int *);
+static int lxsys_readdir_devices_sysnode(lxsys_node_t *, uio_t *, int *);
+static int lxsys_readdir_static(lxsys_node_t *, uio_t *, int *);
+static int lxsys_readdir_class_netdir(lxsys_node_t *, uio_t *, int *);
+static int lxsys_readdir_devices_virtual_netdir(lxsys_node_t *, uio_t *, int *);
+static int lxsys_readdir_blockdir(lxsys_node_t *, uio_t *, int *);
+static int lxsys_readdir_devices_zfsdir(lxsys_node_t *, uio_t *, int *);
+
+static int lxsys_readlink_class_net(lxsys_node_t *, char *, size_t);
+static int lxsys_readlink_block(lxsys_node_t *, char *, size_t);
+
+/*
+ * The lx /sys vnode operations vector
+ */
+const fs_operation_def_t lxsys_vnodeops_template[] = {
+	VOPNAME_OPEN,		{ .vop_open = lxsys_open },
+	VOPNAME_CLOSE,		{ .vop_close = lxsys_close },
+	VOPNAME_READ,		{ .vop_read = lxsys_read },
+	VOPNAME_GETATTR,	{ .vop_getattr = lxsys_getattr },
+	VOPNAME_ACCESS,		{ .vop_access = lxsys_access },
+	VOPNAME_LOOKUP,		{ .vop_lookup = lxsys_lookup },
+	VOPNAME_READDIR,	{ .vop_readdir = lxsys_readdir },
+	VOPNAME_READLINK,	{ .vop_readlink = lxsys_readlink },
+	VOPNAME_FSYNC,		{ .error = lxsys_sync },
+	VOPNAME_SEEK,		{ .error = lxsys_sync },
+	VOPNAME_INACTIVE,	{ .vop_inactive = lxsys_inactive },
+	VOPNAME_CMP,		{ .vop_cmp = lxsys_cmp },
+	NULL,			NULL
+};
+
+typedef enum lxsys_cpu_state {
+	LXSYS_CPU_ON,		/* online */
+	LXSYS_CPU_OFF,		/* offline */
+	LXSYS_CPU_ANY,		/* don't care */
+} lxsys_cpu_state_t;
+
+static void lxsys_format_cpu(char *, int, lxsys_cpu_state_t);
+
+/*
+ * Sysfs Inode format:
+ * 0000AABBBBCC
+ *
+ * AA - TYPE
+ * BBBB - INSTANCE
+ * CC - ENDPOINT
+ *
+ * Where TYPE is one of:
+ * 1 - SYS_STATIC
+ * 2 - SYS_CLASS_NET
+ * 3 - SYS_DEV_NET
+ * 4 - SYS_BLOCK
+ * 5 - SYS_DEV_ZFS
+ * 6 - SYS_DEV_SYS_CPU
+ * 7 - SYS_DEV_SYS_CPUINFO
+ * 8 - SYS_DEV_SYS_NODE
+ *
+ * Static entries will have assigned INSTANCE identifiers:
+ * - 0x00: /sys
+ * - 0x01: /sys/class
+ * - 0x02: /sys/devices
+ * - 0x03: /sys/fs
+ * - 0x04: /sys/class/net
+ * - 0x05: /sys/devices/virtual
+ * - 0x06: /sys/devices/system
+ * - 0x07: /sys/fs/cgroup
+ * - 0x08: /sys/devices/virtual/net
+ * - 0x09: /sys/block
+ * - 0x0a: /sys/devices/zfs
+ * - 0x0b: /sys/devices/system/cpu
+ * - 0x0c: /sys/devices/system/node
+ * - 0x0d: /sys/bus
+ *
+ * Dynamic /sys/class/net/<interface> symlinks will use an INSTANCE derived
+ * from the corresonding ifindex.
+ *
+ * Dynamic /sys/devices/virtual/net/<interface>/<entries> directories will use
+ * an INSTANCE derived from the ifindex and statically assigned ENDPOINT IDs
+ * for the contained entries.
+ *
+ * Dynamic /sys/block/<dev> symlinks will use an INSTANCE derived from the
+ * device major and instance from records listed in kstat or zvols.
+ *
+ * Dynamic /sys/devices/zfs/<dev> directories will use an INSTANCE derived from
+ * the emulated minor number.
+ *
+ * Semi-static/Dynamic /sys/devices/system/cpu contains the fixed 'kernel_max',
+ * 'offline', 'online', 'possible', and 'present' files, and a dynamic set of
+ * cpuN subdirectories. All of these are dynamic nodes.
+ *
+ * Static /sys/devices/system/node/node0 currently only contains a
+ * static cpulist file, but will likely need future dynamic entries for cpuN
+ * symlinks, and perhaps other static files. By only providing 'node0' we
+ * pretend that there is only a single NUMA node available to a zone (trying to
+ * be NUMA-aware inside a zone is generally not going to work anyway).
+ * If dynamic entries are added under node0, it must be converted to the
+ * semi-static/dynamic approach as used under /sys/devices/system/cpu.
+ *
+ * The dyn_ino_type table must be updated whenever a new static instance is
+ * defined.
+ */
+
+#define	LXSYS_INST_CLASSDIR			0x1
+#define	LXSYS_INST_DEVICESDIR			0x2
+#define	LXSYS_INST_FSDIR			0x3
+#define	LXSYS_INST_CLASS_NETDIR			0x4
+#define	LXSYS_INST_DEVICES_VIRTUALDIR		0x5
+#define	LXSYS_INST_DEVICES_SYSTEMDIR		0x6
+#define	LXSYS_INST_FS_CGROUPDIR			0x7
+#define	LXSYS_INST_DEVICES_VIRTUAL_NETDIR	0x8
+#define	LXSYS_INST_BLOCKDIR			0x9
+#define	LXSYS_INST_DEVICES_ZFSDIR		0xa
+#define	LXSYS_INST_DEVICES_SYSCPU		0xb
+#define	LXSYS_INST_DEVICES_SYSNODE		0xc
+#define	LXSYS_INST_BUSDIR			0xd
+#define	LXSYS_INST_MAX				LXSYS_INST_BUSDIR /* limit */
+
+/*
+ * These are of dynamic type (LXSYS_DEV_SYS_CPU), but essentially fixed
+ * instances. Under /sys/devices/system/cpu we have: kernel_max, offline,
+ * online, possible and present. We also have a dynamic set of cpuN subdirs.
+ * The cpuN subdirs are actually of type LXSYS_DEV_SYS_CPUINFO, so we can use
+ * the following instance IDs for the fixed files.
+ */
+#define	LXSYS_INST_DEV_SYSCPU_KMAX		0x1
+#define	LXSYS_INST_DEV_SYSCPU_OFFLINE		0x2
+#define	LXSYS_INST_DEV_SYSCPU_ONLINE		0x3
+#define	LXSYS_INST_DEV_SYSCPU_POSSIBLE		0x4
+#define	LXSYS_INST_DEV_SYSCPU_PRESENT		0x5
+
+/*
+ * This array is used for directory inode correction in lxsys_readdir_common
+ * when a directory's static-type entry is actually a dynamic-type.
+ */
+static int dyn_ino_type [] = {
+	0,				/* invalid */
+	0,				/* LXSYS_INST_CLASSDIR */
+	0,				/* LXSYS_INST_DEVICESDIR */
+	0,				/* LXSYS_INST_FSDIR */
+	LXSYS_CLASS_NET,		/* LXSYS_INST_CLASS_NETDIR */
+	0,				/* LXSYS_INST_DEVICES_VIRTUALDIR */
+	0,				/* LXSYS_INST_DEVICES_SYSTEMDIR */
+	0,				/* LXSYS_INST_FS_CGROUPDIR */
+	LXSYS_DEV_NET,			/* LXSYS_INST_DEV_VIRTUAL_NETDIR */
+	LXSYS_BLOCK,			/* LXSYS_INST_BLOCKDIR */
+	LXSYS_DEV_ZFS,			/* LXSYS_INST_DEVICES_ZFSDIR */
+	LXSYS_DEV_SYS_CPU,		/* LXSYS_INST_DEVICES_SYSCPU */
+	LXSYS_DEV_SYS_NODE,		/* LXSYS_INST_DEV_SYSNODE */
+	0,				/* LXSYS_INST_BUSDIR */
+};
+#define	DYN_INO_LEN \
+	(sizeof (dyn_ino_type) / sizeof ((dyn_ino_type)[0]))
+
+/*
+ * file contents of an lx /sys directory.
+ */
+static lxsys_dirent_t dirlist_root[] = {
+	{ LXSYS_INST_BLOCKDIR,		"block" },
+	{ LXSYS_INST_BUSDIR,		"bus" },
+	{ LXSYS_INST_CLASSDIR,		"class" },
+	{ LXSYS_INST_DEVICESDIR,	"devices" },
+	{ LXSYS_INST_FSDIR,		"fs" }
+};
+static lxsys_dirent_t dirlist_class[] = {
+	{ LXSYS_INST_CLASS_NETDIR,	"net" }
+};
+static lxsys_dirent_t dirlist_fs[] = {
+	{ LXSYS_INST_FS_CGROUPDIR,	"cgroup" }
+};
+static lxsys_dirent_t dirlist_devices[] = {
+	{ LXSYS_INST_DEVICES_SYSTEMDIR,		"system" },
+	{ LXSYS_INST_DEVICES_VIRTUALDIR,	"virtual" },
+	{ LXSYS_INST_DEVICES_ZFSDIR,		"zfs" }
+};
+static lxsys_dirent_t dirlist_devices_virtual[] = {
+	{ LXSYS_INST_DEVICES_VIRTUAL_NETDIR,	"net" }
+};
+
+static lxsys_dirent_t dirlist_devices_system[] = {
+	{ LXSYS_INST_DEVICES_SYSCPU,	"cpu" },
+	{ LXSYS_INST_DEVICES_SYSNODE,	"node" }
+};
+
+#define	LXSYS_ENDP_NET_ADDRESS	1
+#define	LXSYS_ENDP_NET_ADDRLEN	2
+#define	LXSYS_ENDP_NET_FLAGS	3
+#define	LXSYS_ENDP_NET_IFINDEX	4
+#define	LXSYS_ENDP_NET_MTU	5
+#define	LXSYS_ENDP_NET_TXQLEN	6
+#define	LXSYS_ENDP_NET_TYPE	7
+
+#define	LXSYS_ENDP_BLOCK_DEVICE	1
+
+#define	LXSYS_ENDP_NODE_CPULIST	1
+#define	LXSYS_ENDP_NODE_CPUMAP	2
+
+static lxsys_dirent_t dirlist_devices_virtual_net[] = {
+	{ LXSYS_ENDP_NET_ADDRESS,	"address" },
+	{ LXSYS_ENDP_NET_ADDRLEN,	"addr_len" },
+	{ LXSYS_ENDP_NET_FLAGS,		"flags" },
+	{ LXSYS_ENDP_NET_IFINDEX,	"ifindex" },
+	{ LXSYS_ENDP_NET_MTU,		"mtu" },
+	{ LXSYS_ENDP_NET_TXQLEN,	"tx_queue_len" },
+	{ LXSYS_ENDP_NET_TYPE,		"type" }
+};
+
+static lxsys_dirent_t dirlist_devices_zfs_block[] = {
+	{ LXSYS_ENDP_BLOCK_DEVICE,	"device" }
+};
+
+static lxsys_dirent_t dirlist_devices_sysnode[] = {
+	{ LXSYS_ENDP_NODE_CPULIST,	"cpulist" },
+	{ LXSYS_ENDP_NODE_CPUMAP,	"cpumap" }
+};
+
+#define	SYSDIRLISTSZ(l)	(sizeof (l) / sizeof ((l)[0]))
+
+#define	SYSDLENT(i, l)	{ i, l, SYSDIRLISTSZ(l) }
+static lxsys_dirlookup_t lxsys_dirlookup[] = {
+	SYSDLENT(LXSYS_INST_ROOT, dirlist_root),
+	SYSDLENT(LXSYS_INST_CLASSDIR, dirlist_class),
+	SYSDLENT(LXSYS_INST_FSDIR, dirlist_fs),
+	{ LXSYS_INST_FS_CGROUPDIR, NULL, 0 },
+	SYSDLENT(LXSYS_INST_DEVICESDIR, dirlist_devices),
+	SYSDLENT(LXSYS_INST_DEVICES_SYSTEMDIR, dirlist_devices_system),
+	SYSDLENT(LXSYS_INST_DEVICES_VIRTUALDIR, dirlist_devices_virtual),
+	SYSDLENT(LXSYS_INST_DEVICES_SYSNODE, dirlist_devices_sysnode),
+	{ LXSYS_INST_BUSDIR, NULL, 0 },
+};
+
+
+/*
+ * Array of lookup functions, indexed by lx /sys file type.
+ */
+static vnode_t *(*lxsys_lookup_function[LXSYS_MAXTYPE])() = {
+	NULL,					/* LXSYS_NONE		*/
+	lxsys_lookup_static,			/* LXSYS_STATIC		*/
+	lxsys_lookup_class_netdir,		/* LXSYS_CLASS_NET	*/
+	lxsys_lookup_devices_virtual_netdir,	/* LXSYS_DEV_NET	*/
+	lxsys_lookup_blockdir,			/* LXSYS_BLOCK		*/
+	lxsys_lookup_devices_zfsdir,		/* LXSYS_DEV_ZFS	*/
+	lxsys_lookup_devices_syscpu,		/* LXSYS_DEV_SYS_CPU	*/
+	lxsys_lookup_devices_syscpuinfo,	/* LXSYS_DEV_SYS_CPUINFO */
+	lxsys_lookup_devices_sysnode,		/* LXSYS_DEV_SYS_NODE	*/
+};
+
+/*
+ * Array of readdir functions, indexed by /sys file type.
+ */
+static int (*lxsys_readdir_function[LXSYS_MAXTYPE])() = {
+	NULL,					/* LXSYS_NONE		*/
+	lxsys_readdir_static,			/* LXSYS_STATIC		*/
+	lxsys_readdir_class_netdir,		/* LXSYS_CLASS_NET	*/
+	lxsys_readdir_devices_virtual_netdir,	/* LXSYS_DEV_NET	*/
+	lxsys_readdir_blockdir,			/* LXSYS_BLOCK		*/
+	lxsys_readdir_devices_zfsdir,		/* LXSYS_DEV_ZFS	*/
+	lxsys_readdir_devices_syscpu,		/* LXSYS_DEV_SYS_CPU	*/
+	lxsys_readdir_devices_syscpuinfo,	/* LXSYS_DEV_SYS_CPUINFO */
+	lxsys_readdir_devices_sysnode,		/* LXSYS_DEV_SYS_NODE	*/
+};
+
+/*
+ * Array of read functions, indexed by /sys file type.
+ */
+static int (*lxsys_read_function[LXSYS_MAXTYPE])() = {
+	NULL,					/* LXSYS_NONE		*/
+	lxsys_read_static,			/* LXSYS_STATIC		*/
+	NULL,					/* LXSYS_CLASS_NET	*/
+	lxsys_read_devices_virtual_net,		/* LXSYS_DEV_NET	*/
+	NULL,					/* LXSYS_BLOCK		*/
+	lxsys_read_devices_zfs_block,		/* LXSYS_DEV_ZFS	*/
+	lxsys_read_devices_syscpu,		/* LXSYS_DEV_SYS_CPU	*/
+	NULL,					/* LXSYS_DEV_SYS_CPUINFO */
+	lxsys_read_devices_sysnode,		/* LXSYS_DEV_SYS_NODE	*/
+};
+
+/*
+ * Array of readlink functions, indexed by /sys file type.
+ */
+static int (*lxsys_readlink_function[LXSYS_MAXTYPE])() = {
+	NULL,					/* LXSYS_NONE		*/
+	NULL,					/* LXSYS_STATIC		*/
+	lxsys_readlink_class_net,		/* LXSYS_CLASS_NET	*/
+	NULL,					/* LXSYS_DEV_NET	*/
+	lxsys_readlink_block,			/* LXSYS_BLOCK		*/
+	NULL,					/* LXSYS_DEV_ZFS	*/
+	NULL,					/* LXSYS_DEV_SYS_CPU	*/
+	NULL,					/* LXSYS_DEV_SYS_CPUINFO */
+	NULL,					/* LXSYS_DEV_SYS_NODE	*/
+};
+
+/*
+ * Given one of our inodes, return the vnode type.
+ *
+ * lxsys_getnode will always set the vnode type to VDIR. It expects the
+ * caller (normally the lookup functions) to fix the type. Those same rules are
+ * encoded here for our inode-to-type translation.
+ */
+int
+lxsys_ino_get_type(ino_t ino)
+{
+	lxsys_nodetype_t type;
+	unsigned int instance;
+	unsigned int endpoint;
+
+	type = (ino & 0xff000000) >> 24;
+	instance = (ino & 0xffff00) >> 8;
+	endpoint = (ino & 0xff);
+
+	if (instance > LXSYS_INST_MAX)
+		return (VNON);
+
+	/* Validate non-static node types */
+	if (type != LXSYS_STATIC &&
+	    (type <= LXSYS_STATIC || type >= LXSYS_MAXTYPE)) {
+		return (VNON);
+	}
+
+	if (type != LXSYS_STATIC) {
+		/* Non-static node types */
+		switch (type) {
+		case LXSYS_CLASS_NET:
+			if (instance != 0) {
+				return (VLNK);
+			}
+			break;
+		case LXSYS_DEV_NET:
+			/*
+			 * /sys/devices/virtual/net usually has the eth0 and
+			 * lo directories. Each network device directory is an
+			 * instances with a 0 endpoint. The files within
+			 * that directory have a non-0 endpoint.
+			 */
+			if (endpoint != 0) {
+				return (VREG);
+			}
+			break;
+		case LXSYS_BLOCK:
+			if (instance != 0) {
+				return (VLNK);
+			}
+			break;
+		case LXSYS_DEV_ZFS:
+			/*
+			 * /sys/devices/zfs usually has the zfsds0 directory
+			 * instance with a 0 endpoint. The device file within
+			 * that directory has a non-0 endpoint.
+			 */
+			if (endpoint != 0) {
+				return (VREG);
+			}
+			break;
+		case LXSYS_DEV_SYS_CPU:
+			if (instance != 0) {
+				return (VREG);
+			}
+			break;
+		case LXSYS_DEV_SYS_CPUINFO:
+			/*
+			 * There is an instance of /sys/devices/system/cpu/cpuN
+			 * for each CPU. These have an instance per CPU and
+			 * currently the endpoint is 0 since there is nothing
+			 * underneath the cpuN subdirectories. Future
+			 * regular file entries are likely to be added there.
+			 */
+			if (endpoint != 0) {
+				return (VREG);
+			}
+			break;
+		case LXSYS_DEV_SYS_NODE:
+			/*
+			 * /sys/devices/system/node has the node0 directory
+			 * instance with a 0 endpoint. The cpulist file within
+			 * that directory has a non-0 endpoint.
+			 */
+			if (endpoint != 0) {
+				return (VREG);
+			}
+			break;
+		default:
+			break;
+		}
+	}
+	return (VDIR);
+}
+
+/*
+ * lxsys_open(): Vnode operation for VOP_OPEN()
+ */
+/* ARGSUSED */
+static int
+lxsys_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
+{
+	/*
+	 * We only allow reading in this file system
+	 */
+	if (flag & FWRITE)
+		return (EROFS);
+
+	return (0);
+}
+
+
+/*
+ * lxsys_close(): Vnode operation for VOP_CLOSE()
+ */
+/* ARGSUSED */
+static int
+lxsys_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
+    caller_context_t *ct)
+{
+	return (0);
+}
+
+
+/*
+ * lxsys_read(): Vnode operation for VOP_READ()
+ * All we currently have in this fs are directories.
+ */
+/* ARGSUSED */
+static int
+lxsys_read(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr,
+    caller_context_t *ct)
+{
+	lxsys_node_t *lnp = VTOLXS(vp);
+	lxsys_nodetype_t type = lnp->lxsys_type;
+	int (*rlfunc)();
+	int error;
+	lxsys_uiobuf_t *luio;
+
+	VERIFY(type > LXSYS_NONE && type < LXSYS_MAXTYPE);
+
+	if (vp->v_type == VDIR) {
+		return (EISDIR);
+	}
+
+	rlfunc = lxsys_read_function[type];
+	if (rlfunc != NULL) {
+		luio = lxsys_uiobuf_new(uiop);
+		if ((error = rlfunc(lnp, luio)) == 0) {
+			error = lxsys_uiobuf_flush(luio);
+		}
+		lxsys_uiobuf_free(luio);
+	} else {
+		error = EIO;
+	}
+
+	return (error);
+}
+
+/*
+ * lxsys_getattr(): Vnode operation for VOP_GETATTR()
+ */
+/* ARGSUSED */
+static int
+lxsys_getattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	register lxsys_node_t *lxsnp = VTOLXS(vp);
+
+	/* Default attributes, that may be overridden below */
+	bzero(vap, sizeof (*vap));
+	vap->va_atime = vap->va_mtime = vap->va_ctime = lxsnp->lxsys_time;
+	vap->va_nlink = 1;
+	vap->va_type = vp->v_type;
+	vap->va_mode = lxsnp->lxsys_mode;
+	vap->va_fsid = vp->v_vfsp->vfs_dev;
+	vap->va_blksize = DEV_BSIZE;
+	vap->va_uid = lxsnp->lxsys_uid;
+	vap->va_gid = lxsnp->lxsys_gid;
+	vap->va_nodeid = lxsnp->lxsys_ino;
+
+	vap->va_nblocks = (fsblkcnt64_t)btod(vap->va_size);
+	return (0);
+}
+
+/*
+ * lxsys_access(): Vnode operation for VOP_ACCESS()
+ */
+/* ARGSUSED */
+static int
+lxsys_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
+{
+	lxsys_node_t *lxsnp = VTOLXS(vp);
+	int shift = 0;
+
+	/*
+	 * Although our lx sysfs is basically a read only file system, Linux
+	 * expects it to be writable so we can't just error if (mode & VWRITE).
+	 */
+
+	/* If user is root allow access regardless of permission bits */
+	if (secpolicy_proc_access(cr) == 0)
+		return (0);
+
+	/*
+	 * Access check is based on only one of owner, group, public.  If not
+	 * owner, then check group.  If not a member of the group, then check
+	 * public access.
+	 */
+	if (crgetuid(cr) != lxsnp->lxsys_uid) {
+		shift += 3;
+		if (!groupmember((uid_t)lxsnp->lxsys_gid, cr))
+			shift += 3;
+	}
+
+	mode &= ~(lxsnp->lxsys_mode << shift);
+
+	if (mode == 0)
+		return (0);
+
+	return (EACCES);
+}
+
+/*
+ * lxsys_lookup(): Vnode operation for VOP_LOOKUP()
+ */
+/* ARGSUSED */
+static int
+lxsys_lookup(vnode_t *dp, char *comp, vnode_t **vpp, pathname_t *pathp,
+    int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
+    int *direntflags, pathname_t *realpnp)
+{
+	lxsys_node_t *lxsnp = VTOLXS(dp);
+	lxsys_nodetype_t type = lxsnp->lxsys_type;
+	int error;
+
+	VERIFY(dp->v_type == VDIR);
+	VERIFY(type > LXSYS_NONE && type < LXSYS_MAXTYPE);
+
+	/*
+	 * restrict lookup permission to owner or root
+	 */
+	if ((error = lxsys_access(dp, VEXEC, 0, cr, ct)) != 0) {
+		return (error);
+	}
+
+	/*
+	 * Just return the parent vnode if that's where we are trying to go.
+	 */
+	if (strcmp(comp, "..") == 0) {
+		VN_HOLD(lxsnp->lxsys_parentvp);
+		*vpp = lxsnp->lxsys_parentvp;
+		return (0);
+	}
+
+	/*
+	 * Special handling for directory searches.  Note: null component name
+	 * denotes that the current directory is being searched.
+	 */
+	if ((dp->v_type == VDIR) && (*comp == '\0' || strcmp(comp, ".") == 0)) {
+		VN_HOLD(dp);
+		*vpp = dp;
+		return (0);
+	}
+
+	*vpp = (lxsys_lookup_function[type](lxsnp, comp));
+	return ((*vpp == NULL) ? ENOENT : 0);
+}
+
+static lxsys_node_t *
+lxsys_lookup_disk(lxsys_node_t *ldp, char *comp, lxsys_nodetype_t type)
+{
+	lxsys_node_t *lnp = NULL;
+	lx_zone_data_t *lxzdata;
+	lx_virt_disk_t *vd;
+
+	lxzdata = ztolxzd(curproc->p_zone);
+	if (lxzdata == NULL)
+		return (NULL);
+	ASSERT(lxzdata->lxzd_vdisks != NULL);
+
+	vd = list_head(lxzdata->lxzd_vdisks);
+	while (vd != NULL) {
+		int inst = getminor(vd->lxvd_emul_dev) & 0xffff;
+
+		if (strcmp(vd->lxvd_name, comp) == 0 && inst != 0) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, type, inst, 0);
+			break;
+		}
+
+		vd = list_next(lxzdata->lxzd_vdisks, vd);
+	}
+
+	return (lnp);
+}
+
+static vnode_t *
+lxsys_lookup_static(lxsys_node_t *ldp, char *comp)
+{
+	lxsys_dirent_t *dirent = NULL;
+	int i, len = 0;
+
+	for (i = 0; i < SYSDIRLISTSZ(lxsys_dirlookup); i++) {
+		if (ldp->lxsys_instance == lxsys_dirlookup[i].dl_instance) {
+			dirent = lxsys_dirlookup[i].dl_list;
+			len = lxsys_dirlookup[i].dl_length;
+			break;
+		}
+	}
+	if (dirent == NULL) {
+		return (NULL);
+	}
+
+	for (i = 0; i < len; i++) {
+		if (strncmp(comp, dirent[i].d_name, MAXPATHLEN) == 0) {
+			lxsys_nodetype_t node_type = ldp->lxsys_type;
+			unsigned int node_instance = 0;
+			lxsys_node_t *lnp;
+
+			switch (dirent[i].d_idnum) {
+			case LXSYS_INST_BLOCKDIR:
+				node_type = LXSYS_BLOCK;
+				break;
+			case LXSYS_INST_CLASS_NETDIR:
+				node_type = LXSYS_CLASS_NET;
+				break;
+			case LXSYS_INST_DEVICES_VIRTUAL_NETDIR:
+				node_type = LXSYS_DEV_NET;
+				break;
+			case LXSYS_INST_DEVICES_ZFSDIR:
+				node_type = LXSYS_DEV_ZFS;
+				break;
+			case LXSYS_INST_DEVICES_SYSCPU:
+				node_type = LXSYS_DEV_SYS_CPU;
+				break;
+			case LXSYS_INST_DEVICES_SYSNODE:
+				node_type = LXSYS_DEV_SYS_NODE;
+				break;
+			default:
+				/* Another static node */
+				node_instance = dirent[i].d_idnum;
+			}
+			if (node_type == LXSYS_STATIC) {
+				lnp = lxsys_getnode_static(ldp->lxsys_vnode,
+				    node_instance);
+			} else {
+				lnp = lxsys_getnode(ldp->lxsys_vnode,
+				    node_type, node_instance, 0);
+			}
+			return (lnp->lxsys_vnode);
+		}
+	}
+	return (NULL);
+}
+
+static vnode_t *
+lxsys_lookup_class_netdir(lxsys_node_t *ldp, char *comp)
+{
+	vnode_t *result = NULL;
+	lxsys_node_t *lnp;
+	netstack_t *ns;
+	ip_stack_t *ipst;
+	avl_tree_t *phytree;
+	phyint_t *phyi;
+	char ifname[LIFNAMSIZ];
+
+	if (ldp->lxsys_type != LXSYS_CLASS_NET ||
+	    ldp->lxsys_instance != 0) {
+		/* Lookups only allowed at directory level */
+		return (NULL);
+	}
+
+	(void) strncpy(ifname, comp, LIFNAMSIZ);
+	lx_ifname_convert(ifname, LX_IF_TONATIVE);
+
+	if ((ns = lxsys_netstack(ldp)) == NULL) {
+		return (NULL);
+	}
+	ipst = ns->netstack_ip;
+	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
+
+	phytree = &ipst->ips_phyint_g_list->phyint_list_avl_by_name;
+	phyi = avl_find(phytree, ifname, NULL);
+	if (phyi != NULL) {
+		lnp = lxsys_getnode(ldp->lxsys_vnode, ldp->lxsys_type,
+		    phyi->phyint_ifindex, 0);
+		result = lnp->lxsys_vnode;
+		result->v_type = VLNK;
+	}
+
+	rw_exit(&ipst->ips_ill_g_lock);
+	netstack_rele(ns);
+
+	return (result);
+}
+
+static vnode_t *
+lxsys_lookup_devices_virtual_netdir(lxsys_node_t *ldp, char *comp)
+{
+	lxsys_node_t *lnp;
+
+	if (ldp->lxsys_instance == 0) {
+		/* top-level interface listing */
+		vnode_t *result = NULL;
+		netstack_t *ns;
+		ip_stack_t *ipst;
+		avl_tree_t *phytree;
+		phyint_t *phyi;
+		char ifname[LIFNAMSIZ];
+
+		(void) strncpy(ifname, comp, LIFNAMSIZ);
+		lx_ifname_convert(ifname, LX_IF_TONATIVE);
+
+		if ((ns = lxsys_netstack(ldp)) == NULL) {
+			return (NULL);
+		}
+		ipst = ns->netstack_ip;
+		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
+
+		phytree = &ipst->ips_phyint_g_list->phyint_list_avl_by_name;
+		phyi = avl_find(phytree, ifname, NULL);
+		if (phyi != NULL) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, ldp->lxsys_type,
+			    phyi->phyint_ifindex, 0);
+			result = lnp->lxsys_vnode;
+		}
+
+		rw_exit(&ipst->ips_ill_g_lock);
+		netstack_rele(ns);
+
+		return (result);
+	} else if (ldp->lxsys_endpoint == 0) {
+		/* interface-level sub-item listing */
+		int i, size;
+		lxsys_dirent_t *dirent;
+
+		size = SYSDIRLISTSZ(dirlist_devices_virtual_net);
+		for (i = 0; i < size; i++) {
+			dirent = &dirlist_devices_virtual_net[i];
+			if (strncmp(comp, dirent->d_name, LXSNSIZ) == 0) {
+				lnp = lxsys_getnode(ldp->lxsys_vnode,
+				    ldp->lxsys_type, ldp->lxsys_instance,
+				    dirent->d_idnum);
+				lnp->lxsys_vnode->v_type = VREG;
+				lnp->lxsys_mode = 0444;
+				return (lnp->lxsys_vnode);
+			}
+		}
+	}
+
+	return (NULL);
+}
+
+static vnode_t *
+lxsys_lookup_blockdir(lxsys_node_t *ldp, char *comp)
+{
+	lxsys_node_t *lnp;
+
+	if (ldp->lxsys_instance == 0) {
+		/* top-level dev listing */
+		lnp = lxsys_lookup_disk(ldp, comp, LXSYS_BLOCK);
+
+		if (lnp != NULL) {
+			lnp->lxsys_vnode->v_type = VLNK;
+			return (lnp->lxsys_vnode);
+		}
+	}
+
+	return (NULL);
+}
+
+static vnode_t *
+lxsys_lookup_devices_zfsdir(lxsys_node_t *ldp, char *comp)
+{
+	lxsys_node_t *lnp;
+
+	if (ldp->lxsys_instance == 0) {
+		/* top-level dev listing */
+		lnp = lxsys_lookup_disk(ldp, comp, LXSYS_DEV_ZFS);
+
+		if (lnp != NULL) {
+			return (lnp->lxsys_vnode);
+		}
+	} else if (ldp->lxsys_endpoint == 0) {
+		/* disk-level sub-item listing */
+		int i, size;
+		lxsys_dirent_t *dirent;
+
+		/*
+		 * All of these entries currently look like regular files
+		 * but on a real Linux system some will be subdirs. This should
+		 * be fixed when we populate the directory for real.
+		 */
+		size = SYSDIRLISTSZ(dirlist_devices_zfs_block);
+		for (i = 0; i < size; i++) {
+			dirent = &dirlist_devices_zfs_block[i];
+			if (strncmp(comp, dirent->d_name, LXSNSIZ) == 0) {
+				lnp = lxsys_getnode(ldp->lxsys_vnode,
+				    ldp->lxsys_type, ldp->lxsys_instance,
+				    dirent->d_idnum);
+				lnp->lxsys_vnode->v_type = VREG;
+				lnp->lxsys_mode = 0444;
+				return (lnp->lxsys_vnode);
+			}
+		}
+	}
+
+	return (NULL);
+}
+
+static vnode_t *
+lxsys_lookup_devices_syscpu(lxsys_node_t *ldp, char *comp)
+{
+	lxsys_node_t *lnp = NULL;
+
+	if (ldp->lxsys_instance == 0) {
+		/* top-level cpu listing */
+
+		/* If fixed entry */
+		if (strcmp(comp, "kernel_max") == 0) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, LXSYS_DEV_SYS_CPU,
+			    LXSYS_INST_DEV_SYSCPU_KMAX, 0);
+			lnp->lxsys_vnode->v_type = VREG;
+			lnp->lxsys_mode = 0444;
+		} else if (strcmp(comp, "offline") == 0) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, LXSYS_DEV_SYS_CPU,
+			    LXSYS_INST_DEV_SYSCPU_OFFLINE, 0);
+			lnp->lxsys_vnode->v_type = VREG;
+			lnp->lxsys_mode = 0444;
+		} else if (strcmp(comp, "online") == 0) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, LXSYS_DEV_SYS_CPU,
+			    LXSYS_INST_DEV_SYSCPU_ONLINE, 0);
+			lnp->lxsys_vnode->v_type = VREG;
+			lnp->lxsys_mode = 0444;
+		} else if (strcmp(comp, "possible") == 0) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, LXSYS_DEV_SYS_CPU,
+			    LXSYS_INST_DEV_SYSCPU_POSSIBLE, 0);
+			lnp->lxsys_vnode->v_type = VREG;
+			lnp->lxsys_mode = 0444;
+		} else if (strcmp(comp, "present") == 0) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, LXSYS_DEV_SYS_CPU,
+			    LXSYS_INST_DEV_SYSCPU_PRESENT, 0);
+			lnp->lxsys_vnode->v_type = VREG;
+			lnp->lxsys_mode = 0444;
+		} else {
+			/* Else dynamic cpuN entry */
+			cpuset_t *avail;	/* all installed CPUs */
+			uint_t i, avlo, avhi;
+
+			avail = cpuset_alloc(KM_SLEEP);
+			cpuset_all(avail);
+
+			/* Take a snapshot of the available set */
+			mutex_enter(&cpu_lock);
+			cpuset_and(avail, &cpu_available);
+			mutex_exit(&cpu_lock);
+
+			cpuset_bounds(avail, &avlo, &avhi);
+
+			for (i = avlo; i <= avhi; i++) {
+				char cpunm[16];
+
+				if (!cpu_in_set(avail, i))
+					continue;
+
+				(void) snprintf(cpunm, sizeof (cpunm), "cpu%u",
+				    i);
+
+				if (strcmp(comp, cpunm) == 0) {
+					lnp = lxsys_getnode(ldp->lxsys_vnode,
+					    LXSYS_DEV_SYS_CPUINFO, i + 1, 0);
+					break;
+				}
+			}
+			cpuset_free(avail);
+		}
+
+		if (lnp != NULL) {
+			return (lnp->lxsys_vnode);
+		}
+	} else if (ldp->lxsys_endpoint == 0) {
+		/* cpu-level sub-item listing, currently empty */
+		/* EMPTY */
+	}
+
+	return (NULL);
+}
+
+/* ARGSUSED */
+static vnode_t *
+lxsys_lookup_devices_syscpuinfo(lxsys_node_t *ldp, char *comp)
+{
+	return (NULL);
+}
+
+static vnode_t *
+lxsys_lookup_devices_sysnode(lxsys_node_t *ldp, char *comp)
+{
+	lxsys_node_t *lnp = NULL;
+
+	if (ldp->lxsys_instance == 0) {
+		/*
+		 * The system is presently represented as a single node,
+		 * regardless of any NUMA topology which exists.
+		 * The instances are offset by 1 to account for the top level
+		 * directory occupying instance 0.
+		 */
+		if (strcmp(comp, "node0") == 0) {
+			lnp = lxsys_getnode(ldp->lxsys_vnode, ldp->lxsys_type,
+			    1, 0);
+			return (lnp->lxsys_vnode);
+		}
+	} else {
+		/* interface-level sub-item listing */
+		int i, size;
+		lxsys_dirent_t *dirent;
+
+		size = SYSDIRLISTSZ(dirlist_devices_sysnode);
+		for (i = 0; i < size; i++) {
+			dirent = &dirlist_devices_sysnode[i];
+			if (strncmp(comp, dirent->d_name, LXSNSIZ) == 0) {
+				lnp = lxsys_getnode(ldp->lxsys_vnode,
+				    ldp->lxsys_type, ldp->lxsys_instance,
+				    dirent->d_idnum);
+				lnp->lxsys_vnode->v_type = VREG;
+				lnp->lxsys_mode = 0444;
+				return (lnp->lxsys_vnode);
+			}
+		}
+	}
+
+	return (NULL);
+}
+
+static int
+lxsys_read_devices_virtual_net(lxsys_node_t *lnp, lxsys_uiobuf_t *luio)
+{
+	netstack_t *ns;
+	ill_t *ill;
+	uint_t ifindex = lnp->lxsys_instance;
+	uint8_t *addr;
+	uint64_t flags;
+	int error = 0;
+
+	if (ifindex == 0 || lnp->lxsys_endpoint == 0) {
+		return (EISDIR);
+	}
+
+	if ((ns = lxsys_netstack(lnp)) == NULL) {
+		return (EIO);
+	}
+
+	ill = lxsys_find_ill(ns->netstack_ip, ifindex);
+	if (ill == NULL) {
+		netstack_rele(ns);
+		return (EIO);
+	}
+
+	switch (lnp->lxsys_endpoint) {
+	case LXSYS_ENDP_NET_ADDRESS:
+		if (ill->ill_phys_addr_length != ETHERADDRL) {
+			lxsys_uiobuf_printf(luio, "00:00:00:00:00:00\n");
+			break;
+		}
+		addr = ill->ill_phys_addr;
+		lxsys_uiobuf_printf(luio,
+		    "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n",
+		    addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+		break;
+	case LXSYS_ENDP_NET_ADDRLEN:
+		lxsys_uiobuf_printf(luio, "%u\n",
+		    IS_LOOPBACK(ill) ? ETHERADDRL : ill->ill_phys_addr_length);
+		break;
+	case LXSYS_ENDP_NET_FLAGS:
+		flags = (ill->ill_flags | ill->ill_ipif->ipif_flags |
+		    ill->ill_phyint->phyint_flags) & 0xffff;
+		lx_ifflags_convert(&flags, LX_IF_FROMNATIVE);
+		lxsys_uiobuf_printf(luio, "0x%x\n", flags);
+		break;
+	case LXSYS_ENDP_NET_IFINDEX:
+		lxsys_uiobuf_printf(luio, "%u\n", ifindex);
+		break;
+	case LXSYS_ENDP_NET_MTU:
+		lxsys_uiobuf_printf(luio, "%u\n", ill->ill_mtu);
+		break;
+	case LXSYS_ENDP_NET_TXQLEN:
+		/* perpetuate the txqlen lie */
+		if (IS_LOOPBACK(ill)) {
+			lxsys_uiobuf_printf(luio, "0\n");
+		} else {
+			lxsys_uiobuf_printf(luio, "1\n");
+		}
+		break;
+	case LXSYS_ENDP_NET_TYPE:
+		lxsys_uiobuf_printf(luio, "%u\n",
+		    IS_LOOPBACK(ill) ? LX_ARPHRD_LOOPBACK :
+		    arp_hw_type(ill->ill_mactype));
+		break;
+	default:
+		error = EIO;
+	}
+
+	ill_refrele(ill);
+	netstack_rele(ns);
+	return (error);
+}
+
+/* ARGSUSED1 */
+static int
+lxsys_read_devices_zfs_block(lxsys_node_t *lnp, lxsys_uiobuf_t *luio)
+{
+	uint_t dskindex = lnp->lxsys_instance;
+
+	if (dskindex == 0 || lnp->lxsys_endpoint == 0) {
+		return (EISDIR);
+	}
+
+	return (EIO);
+}
+
+/*
+ * In the Linux src tree, see ABI/stable/sysfs-devices-node.
+ *
+ * For the 'cpumap' file, each CPU is treated as a bit, then those are
+ * accumulated and printed as a hex digit, with CPU0 as the rightmost bit.
+ * Each set of 8 digits (i.e. 32 CPUs) is then delimited with a comma.
+ * Since we are emulating a single NUMA group, all of our CPUs will be listed
+ * in this file. For example, a 48 CPU system would look like:
+ *     00000000,00000000,00000000,00000000,00000000,00000000,0000ffff,ffffffff
+ * It comes out this way because 'kernel_max' is NCPU, which is currently
+ * defined to be 256.
+ */
+static int
+lxsys_read_devices_sysnode(lxsys_node_t *lnp, lxsys_uiobuf_t *luio)
+{
+	if (lnp->lxsys_instance == 1) {
+		char outbuf[256];
+
+		if (lnp->lxsys_endpoint == LXSYS_ENDP_NODE_CPULIST) {
+			/* Show the range of CPUs */
+			lxsys_format_cpu(outbuf, sizeof (outbuf),
+			    LXSYS_CPU_ANY);
+		} else if (lnp->lxsys_endpoint == LXSYS_ENDP_NODE_CPUMAP) {
+			int i;
+			uint_t j, ndigits;
+			cpuset_t *avail;	/* all installed CPUs */
+
+			avail = cpuset_alloc(KM_SLEEP);
+			cpuset_all(avail);
+
+			/* Take a snapshot of the available set */
+			mutex_enter(&cpu_lock);
+			cpuset_and(avail, &cpu_available);
+			mutex_exit(&cpu_lock);
+
+			outbuf[0] = '\0';
+			ndigits = 0;
+			for (i = NCPU - 1; i >= 0; i -= 4) {
+				char buf[8];
+				int cnt = 3;
+				uint_t digit = 0;
+
+				for (j = i; cnt >= 0; j--, cnt--) {
+					if (cpu_in_set(avail, j))
+						digit |= 1 << cnt;
+				}
+				(void) snprintf(buf, sizeof (buf), "%x", digit);
+				if (ndigits == 8) {
+					(void) strlcat(outbuf, ",",
+					    sizeof (outbuf));
+					ndigits = 0;
+				}
+				(void) strlcat(outbuf, buf, sizeof (outbuf));
+				ndigits++;
+			}
+
+			cpuset_free(avail);
+		} else {
+			return (EISDIR);
+		}
+
+		lxsys_uiobuf_printf(luio, "%s\n", outbuf);
+		return (0);
+	}
+	return (EISDIR);
+}
+
+static void
+lxsys_format_range(char *buf, int blen, boolean_t *first, uint_t start,
+    uint_t cnt)
+{
+	char tmp[256];
+	char *delim;
+
+	if (cnt == 0)
+		return;
+
+	if (*first) {
+		*first = B_FALSE;
+		delim = "";
+	} else {
+		delim = ",";
+	}
+	if (cnt > 1) {
+		(void) snprintf(tmp, sizeof (tmp), "%s%u-%u", delim, start,
+		    start + cnt - 1);
+	} else {
+		(void) snprintf(tmp, sizeof (tmp), "%s%u", delim, start);
+	}
+	(void) strlcat(buf, tmp, blen);
+}
+
+/*
+ * Format a string of which CPUs are online, offline, or don't care (depending
+ * on chk_state), and which would be formatted like this:
+ *    0-31
+ * or
+ *    0-12,14,20-31
+ */
+static void
+lxsys_format_cpu(char *buf, int blen, lxsys_cpu_state_t chk_state)
+{
+	uint_t start, cnt, avlo, avhi;
+	boolean_t first = B_TRUE;
+	cpuset_t *active;	/* CPUs online */
+	cpuset_t *avail;	/* all installed CPUs */
+
+	active = cpuset_alloc(KM_SLEEP);
+	avail = cpuset_alloc(KM_SLEEP);
+	cpuset_all(active);
+	cpuset_all(avail);
+
+	/* Take a snapshot of the available and active sets */
+	mutex_enter(&cpu_lock);
+	cpuset_and(avail, &cpu_available);
+	cpuset_and(active, &cpu_active_set);
+	mutex_exit(&cpu_lock);
+
+	cpuset_bounds(avail, &avlo, &avhi);
+
+	buf[0] = '\0';
+	if (chk_state == LXSYS_CPU_ANY) {
+		start = avlo;
+		cnt = avhi + 1;
+	} else {
+		uint_t i;
+		boolean_t incl_cpu = B_TRUE;
+
+		start = 0;
+		cnt = 0;
+		for (i = avlo; i <= avhi; i++) {
+			if (chk_state == LXSYS_CPU_ON) {
+				if (!cpu_in_set(active, i))
+					incl_cpu = B_FALSE;
+			} else {
+				if (cpu_in_set(active, i))
+					incl_cpu = B_FALSE;
+			}
+
+			if (incl_cpu && cpu_in_set(avail, i)) {
+				cnt++;
+			} else {
+				/*
+				 * Note: this may print nothing if our 'cnt'
+				 * is 0, but we advance 'start' properly so we
+				 * handle the next range of elements we're
+				 * looking for.
+				 */
+				lxsys_format_range(buf, blen, &first, start,
+				    cnt);
+				start += cnt + 1;
+				cnt = 0;
+				incl_cpu = B_TRUE;
+			}
+		}
+	}
+
+	cpuset_free(avail);
+	cpuset_free(active);
+
+	lxsys_format_range(buf, blen, &first, start, cnt);
+}
+
+static int
+lxsys_read_devices_syscpu(lxsys_node_t *lnp, lxsys_uiobuf_t *luio)
+{
+	uint_t inst = lnp->lxsys_instance;
+	char outbuf[256];
+
+	/*
+	 * For 'kernel_max', 'offline', 'online', 'possible', and 'present',
+	 * see the Documentaion/cputopology.txt file in the Linux src tree.
+	 */
+	if (inst == LXSYS_INST_DEV_SYSCPU_KMAX) {
+		lxsys_uiobuf_printf(luio, "%d\n", NCPU - 1);
+		return (0);
+	}
+
+	if (inst == LXSYS_INST_DEV_SYSCPU_OFFLINE) {
+		lxsys_format_cpu(outbuf, sizeof (outbuf), LXSYS_CPU_OFF);
+		lxsys_uiobuf_printf(luio, "%s\n", outbuf);
+		return (0);
+	}
+
+	if (inst == LXSYS_INST_DEV_SYSCPU_ONLINE) {
+		lxsys_format_cpu(outbuf, sizeof (outbuf), LXSYS_CPU_ON);
+		lxsys_uiobuf_printf(luio, "%s\n", outbuf);
+		return (0);
+	}
+
+	if (inst == LXSYS_INST_DEV_SYSCPU_POSSIBLE ||
+	    inst == LXSYS_INST_DEV_SYSCPU_PRESENT) {
+		lxsys_format_cpu(outbuf, sizeof (outbuf), LXSYS_CPU_ANY);
+		lxsys_uiobuf_printf(luio, "%s\n", outbuf);
+		return (0);
+	}
+
+	/* All other nodes are directories */
+	return (EISDIR);
+}
+
+/* ARGSUSED */
+static int
+lxsys_read_static(lxsys_node_t *lnp, lxsys_uiobuf_t *luio)
+{
+	/* All static nodes are directories */
+	return (EISDIR);
+}
+
+/*
+ * lxsys_readdir(): Vnode operation for VOP_READDIR()
+ */
+/* ARGSUSED */
+static int
+lxsys_readdir(vnode_t *dp, uio_t *uiop, cred_t *cr, int *eofp,
+    caller_context_t *ct, int flags)
+{
+	lxsys_node_t *lxsnp = VTOLXS(dp);
+	lxsys_nodetype_t type = lxsnp->lxsys_type;
+	ssize_t uresid;
+	off_t uoffset;
+	int error, leof;
+
+	ASSERT(dp->v_type == VDIR);
+	VERIFY(type > LXSYS_NONE && type < LXSYS_MAXTYPE);
+
+	/*
+	 * restrict readdir permission to owner or root
+	 */
+	if ((error = lxsys_access(dp, VREAD, 0, cr, ct)) != 0)
+		return (error);
+
+	uoffset = uiop->uio_offset;
+	uresid = uiop->uio_resid;
+
+	/* can't do negative reads */
+	if (uoffset < 0 || uresid <= 0)
+		return (EINVAL);
+
+	/* can't read directory entries that don't exist! */
+	if (uoffset % LXSYS_SDSIZE)
+		return (ENOENT);
+
+	/* Free lower functions from having to check eofp == NULL */
+	if (eofp == NULL) {
+		eofp = &leof;
+	}
+
+	return (lxsys_readdir_function[lxsnp->lxsys_type](lxsnp, uiop, eofp));
+}
+
+static int
+lxsys_dirent_out(dirent64_t *d, ushort_t n, struct uio *uio)
+{
+	int error;
+	off_t offset = uio->uio_offset;
+
+	/*
+	 * uiomove() updates both uiop->uio_resid and uiop->uio_offset by the
+	 * same amount.  But we want uiop->uio_offset to change in increments
+	 * of LXSYS_SDSIZE, which is different from the number of bytes being
+	 * returned to the user.  To accomplish this, we set uiop->uio_offset
+	 * separately on success, overriding what uiomove() does.
+	 */
+	d->d_off = (off64_t)(offset + LXSYS_SDSIZE);
+	d->d_reclen = n;
+	if ((error = uiomove(d, n, UIO_READ, uio)) != 0) {
+		return (error);
+	}
+	uio->uio_offset = offset + LXSYS_SDSIZE;
+	return (0);
+}
+
+/*
+ * This has the common logic for returning directory entries
+ */
+static int
+lxsys_readdir_common(lxsys_node_t *lxsnp, uio_t *uiop, int *eofp,
+    lxsys_dirent_t *dirtab, int dirtablen)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXSNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+
+	oresid = uiop->uio_resid;
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/* Satisfy user request */
+	while ((uresid = uiop->uio_resid) > 0) {
+		int dirindex;
+		off_t uoffset;
+		int reclen;
+		int error;
+
+		uoffset = uiop->uio_offset;
+		dirindex  = (uoffset / LXSYS_SDSIZE) - 2;
+
+		if (uoffset == 0) {
+
+			dirent->d_ino = lxsnp->lxsys_ino;
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '\0';
+			reclen = DIRENT64_RECLEN(1);
+
+		} else if (uoffset == LXSYS_SDSIZE) {
+
+			dirent->d_ino = lxsys_parentinode(lxsnp);
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '.';
+			dirent->d_name[2] = '\0';
+			reclen = DIRENT64_RECLEN(2);
+
+		} else if (dirindex >= 0 && dirindex < dirtablen) {
+
+			int slen = strlen(dirtab[dirindex].d_name);
+			int idnum, ino_type = 0;
+
+			idnum = dirtab[dirindex].d_idnum;
+			if (idnum > 0 && idnum < DYN_INO_LEN)
+				ino_type = dyn_ino_type[idnum];
+
+			if (ino_type != 0) {
+				/*
+				 * Correct the inode for static directories
+				 * which contain non-static lxsys_nodetype_t's.
+				 */
+				dirent->d_ino = lxsys_inode(ino_type, 0, 0);
+				DTRACE_PROBE3(lxsys__fix__inode,
+				    char *, dirtab[dirindex].d_name,
+				    int, ino_type, int, dirent->d_ino);
+			} else {
+				dirent->d_ino = lxsys_inode(LXSYS_STATIC,
+				    idnum, 0);
+			}
+
+			(void) strcpy(dirent->d_name, dirtab[dirindex].d_name);
+			reclen = DIRENT64_RECLEN(slen);
+
+		} else {
+			/* Run out of table entries */
+			*eofp = 1;
+			return (0);
+		}
+
+		/*
+		 * If the size of the data to transfer is greater than the
+		 * user-provided buffer, we cannot continue.
+		 */
+		if (reclen > uresid) {
+			/* Error if no entries have been returned yet. */
+			if (uresid == oresid) {
+				return (EINVAL);
+			}
+			break;
+		}
+
+		if ((error = lxsys_dirent_out(dirent, reclen, uiop)) != 0) {
+			return (error);
+		}
+	}
+
+	/* Have run out of space, but could have just done last table entry */
+	*eofp = (uiop->uio_offset >= ((dirtablen+2) * LXSYS_SDSIZE)) ?  1 : 0;
+	return (0);
+}
+
+static int
+lxsys_readdir_subdir(lxsys_node_t *lxsnp, uio_t *uiop, int *eofp,
+    lxsys_dirent_t *dirtab, int dirtablen)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXSNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+
+	VERIFY(dirtab != NULL || dirtablen == 0);
+
+	oresid = uiop->uio_resid;
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/* Satisfy user request */
+	while ((uresid = uiop->uio_resid) > 0) {
+		int dirindex;
+		off_t uoffset;
+		int reclen;
+		int error;
+
+		uoffset = uiop->uio_offset;
+		dirindex  = (uoffset / LXSYS_SDSIZE) - 2;
+
+		if (uoffset == 0) {
+
+			dirent->d_ino = lxsnp->lxsys_ino;
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '\0';
+			reclen = DIRENT64_RECLEN(1);
+
+		} else if (uoffset == LXSYS_SDSIZE) {
+
+			dirent->d_ino = lxsys_parentinode(lxsnp);
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '.';
+			dirent->d_name[2] = '\0';
+			reclen = DIRENT64_RECLEN(2);
+
+		} else if (dirindex >= 0 && dirindex < dirtablen) {
+
+			int slen = strlen(dirtab[dirindex].d_name);
+
+			dirent->d_ino = lxsys_inode(lxsnp->lxsys_type,
+			    lxsnp->lxsys_instance, dirtab[dirindex].d_idnum);
+			(void) strcpy(dirent->d_name, dirtab[dirindex].d_name);
+			reclen = DIRENT64_RECLEN(slen);
+
+		} else {
+			/* Run out of table entries */
+			*eofp = 1;
+			return (0);
+		}
+
+		/*
+		 * If the size of the data to transfer is greater than the
+		 * user-provided buffer, we cannot continue.
+		 */
+		if (reclen > uresid) {
+			/* Error if no entries have been returned yet. */
+			if (uresid == oresid) {
+				return (EINVAL);
+			}
+			break;
+		}
+
+		if ((error = lxsys_dirent_out(dirent, reclen, uiop)) != 0) {
+			return (error);
+		}
+	}
+
+	/* Have run out of space, but could have just done last table entry */
+	*eofp = (uiop->uio_offset >= ((dirtablen+2) * LXSYS_SDSIZE)) ?  1 : 0;
+	return (0);
+}
+
+static int
+lxsys_readdir_ifaces(lxsys_node_t *ldp, struct uio *uiop, int *eofp,
+    lxsys_nodetype_t type)
+{
+	longlong_t bp[DIRENT64_RECLEN(LXSNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid, uresid;
+	netstack_t *ns;
+	ip_stack_t *ipst;
+	avl_tree_t *phytree;
+	phyint_t *phyi;
+	int error, i;
+
+
+	/* Emit "." and ".." entries */
+	oresid = uiop->uio_resid;
+	error = lxsys_readdir_common(ldp, uiop, eofp, NULL, 0);
+	if (error != 0 || *eofp == 0) {
+		return (error);
+	}
+
+	if ((ns = lxsys_netstack(ldp)) == NULL) {
+		*eofp = 1;
+		return (0);
+	}
+	ipst = ns->netstack_ip;
+
+	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
+	phytree = &ipst->ips_phyint_g_list->phyint_list_avl_by_index;
+	phyi = avl_first(phytree);
+	if (phyi == NULL) {
+		*eofp = 1;
+	}
+	bzero(bp, sizeof (bp));
+
+	/*
+	 * Skip records we have already passed with the offset.
+	 * This accounts for the two "." and ".." records already seen.
+	 */
+	for (i = (uiop->uio_offset/LXSYS_SDSIZE) - 2; i > 0; i--) {
+		if ((phyi = avl_walk(phytree, phyi, AVL_AFTER)) == NULL) {
+			*eofp = 1;
+			break;
+		}
+	}
+
+	while ((uresid = uiop->uio_resid) > 0 && phyi != NULL) {
+		uint_t ifindex;
+		int reclen;
+
+		ifindex = phyi->phyint_ifindex;
+		(void) strncpy(dirent->d_name, phyi->phyint_name, LIFNAMSIZ);
+		lx_ifname_convert(dirent->d_name, LX_IF_FROMNATIVE);
+		dirent->d_ino = lxsys_inode(type, ifindex, 0);
+		reclen = DIRENT64_RECLEN(strlen(dirent->d_name));
+
+		if (reclen > uresid) {
+			if (uresid == oresid) {
+				/* Not enough space for one record */
+				error = EINVAL;
+			}
+			break;
+		}
+		if ((error = lxsys_dirent_out(dirent, reclen, uiop)) != 0) {
+			break;
+		}
+
+		if ((phyi = avl_walk(phytree, phyi, AVL_AFTER)) == NULL) {
+			*eofp = 1;
+			break;
+		}
+	}
+
+	rw_exit(&ipst->ips_ill_g_lock);
+	netstack_rele(ns);
+	return (error);
+}
+
+static int
+lxsys_readdir_disks(lxsys_node_t *ldp, struct uio *uiop, int *eofp,
+    lxsys_nodetype_t type)
+{
+	longlong_t bp[DIRENT64_RECLEN(LXSNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid, uresid;
+	int skip, error;
+	int reclen;
+	uint_t instance;
+	lx_zone_data_t *lxzdata;
+	lx_virt_disk_t *vd;
+
+	/* Emit "." and ".." entries */
+	oresid = uiop->uio_resid;
+	error = lxsys_readdir_common(ldp, uiop, eofp, NULL, 0);
+	if (error != 0 || *eofp == 0) {
+		return (error);
+	}
+
+	skip = (uiop->uio_offset/LXSYS_SDSIZE) - 2;
+
+	lxzdata = ztolxzd(curproc->p_zone);
+	if (lxzdata == NULL)
+		return (EINVAL);
+	ASSERT(lxzdata->lxzd_vdisks != NULL);
+
+	vd = list_head(lxzdata->lxzd_vdisks);
+	while (vd != NULL) {
+		if (skip > 0) {
+			skip--;
+			goto next;
+		}
+
+		if (strnlen(vd->lxvd_name, sizeof (vd->lxvd_name)) > LXSNSIZ)
+			goto next;
+
+		(void) strncpy(dirent->d_name, vd->lxvd_name, LXSNSIZ);
+
+		instance = getminor(vd->lxvd_emul_dev) & 0xffff;
+		if (instance == 0)
+			goto next;
+
+		dirent->d_ino = lxsys_inode(type, instance, 0);
+		reclen = DIRENT64_RECLEN(strlen(dirent->d_name));
+
+		uresid = uiop->uio_resid;
+		if (reclen > uresid) {
+			if (uresid == oresid) {
+				/* Not enough space for one record */
+				error = EINVAL;
+			}
+			break;
+		}
+		if ((error = lxsys_dirent_out(dirent, reclen, uiop)) != 0) {
+			break;
+		}
+
+next:
+		vd = list_next(lxzdata->lxzd_vdisks, vd);
+	}
+
+	/* Indicate EOF if we reached the end of the virtual disks. */
+	if (vd == NULL) {
+		*eofp = 1;
+	}
+
+	return (error);
+}
+
+
+static int
+lxsys_readdir_static(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	lxsys_dirent_t *dirent = NULL;
+	int i, len = 0;
+	boolean_t found = B_FALSE;
+
+	for (i = 0; i < SYSDIRLISTSZ(lxsys_dirlookup); i++) {
+		if (lnp->lxsys_instance == lxsys_dirlookup[i].dl_instance) {
+			dirent = lxsys_dirlookup[i].dl_list;
+			len = lxsys_dirlookup[i].dl_length;
+			found = B_TRUE;
+			break;
+		}
+	}
+
+	if (!found) {
+		return (ENOTDIR);
+	}
+
+	return (lxsys_readdir_common(lnp, uiop, eofp, dirent, len));
+}
+
+static int
+lxsys_readdir_class_netdir(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	if (lnp->lxsys_type != LXSYS_CLASS_NET ||
+	    lnp->lxsys_instance != 0) {
+		/*
+		 * Since /sys/class/net contains only symlinks, readdir
+		 * operations should not be performed anywhere except the top
+		 * level (instance == 0).
+		 */
+		return (ENOTDIR);
+	}
+
+	return (lxsys_readdir_ifaces(lnp, uiop, eofp, LXSYS_CLASS_NET));
+}
+
+static int
+lxsys_readdir_devices_virtual_netdir(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	int error;
+
+	if (lnp->lxsys_instance == 0) {
+		/* top-level interface listing */
+		error = lxsys_readdir_ifaces(lnp, uiop, eofp,
+		    LXSYS_DEV_NET);
+	} else if (lnp->lxsys_endpoint == 0) {
+		/* interface-level sub-item listing */
+		error = lxsys_readdir_subdir(lnp, uiop, eofp,
+		    dirlist_devices_virtual_net,
+		    SYSDIRLISTSZ(dirlist_devices_virtual_net));
+	} else {
+		/* there shouldn't be subdirs below this */
+		error = ENOTDIR;
+	}
+
+	return (error);
+}
+
+static int
+lxsys_readdir_blockdir(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	if (lnp->lxsys_type != LXSYS_BLOCK ||
+	    lnp->lxsys_instance != 0) {
+		/*
+		 * Since /sys/block contains only symlinks, readdir operations
+		 * should not be performed anywhere except the top level
+		 * (instance == 0).
+		 */
+		return (ENOTDIR);
+	}
+
+	return (lxsys_readdir_disks(lnp, uiop, eofp, LXSYS_BLOCK));
+}
+
+static int
+lxsys_readdir_devices_zfsdir(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	int error;
+
+	if (lnp->lxsys_instance == 0) {
+		/* top-level dev listing */
+		error = lxsys_readdir_disks(lnp, uiop, eofp,
+		    LXSYS_DEV_ZFS);
+	} else if (lnp->lxsys_endpoint == 0) {
+		/* disk-level sub-item listing */
+		error = lxsys_readdir_subdir(lnp, uiop, eofp,
+		    dirlist_devices_zfs_block,
+		    SYSDIRLISTSZ(dirlist_devices_zfs_block));
+	} else {
+		/*
+		 * Currently there shouldn't be subdirs below this but
+		 * on a real Linux system some will be subdirs. This should
+		 * be fixed when we populate the directory for real.
+		 */
+		error = ENOTDIR;
+	}
+
+	return (error);
+}
+
+/* Handle fixed entries within the cpu directory. */
+static int
+lxsys_do_sub_cpu(struct uio *uiop, ssize_t oresid, dirent64_t *dirent,
+    char *nm, int inst, int *errp)
+{
+	int reclen;
+	ssize_t uresid;
+
+	(void) strncpy(dirent->d_name, nm, LXSNSIZ);
+
+	dirent->d_ino = lxsys_inode(LXSYS_DEV_SYS_CPU, inst, 0);
+	reclen = DIRENT64_RECLEN(strlen(dirent->d_name));
+
+	uresid = uiop->uio_resid;
+	if (reclen > uresid) {
+		if (uresid == oresid) {
+			/* Not enough space for one record */
+			*errp = EINVAL;
+		}
+		return (-1);
+	}
+	if ((*errp = lxsys_dirent_out(dirent, reclen, uiop)) != 0) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+lxsys_readdir_cpu(lxsys_node_t *ldp, struct uio *uiop, int *eofp)
+{
+	longlong_t bp[DIRENT64_RECLEN(LXSNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid, uresid;
+	int skip, error;
+	int reclen;
+	cpuset_t *avail;
+	uint_t i, avlo, avhi;
+
+	/* Emit "." and ".." entries */
+	oresid = uiop->uio_resid;
+	error = lxsys_readdir_common(ldp, uiop, eofp, NULL, 0);
+	if (error != 0 || *eofp == 0) {
+		return (error);
+	}
+
+	skip = (uiop->uio_offset/LXSYS_SDSIZE) - 2;
+
+	/* Fixed entries */
+	if (skip > 0) {
+		skip--;
+	} else {
+		if (lxsys_do_sub_cpu(uiop, oresid, dirent, "kernel_max",
+		    LXSYS_INST_DEV_SYSCPU_KMAX, &error) != 0)
+			goto done;
+
+		if (lxsys_do_sub_cpu(uiop, oresid, dirent, "offline",
+		    LXSYS_INST_DEV_SYSCPU_OFFLINE, &error) != 0)
+			goto done;
+
+		if (lxsys_do_sub_cpu(uiop, oresid, dirent, "online",
+		    LXSYS_INST_DEV_SYSCPU_ONLINE, &error) != 0)
+			goto done;
+
+		if (lxsys_do_sub_cpu(uiop, oresid, dirent, "possible",
+		    LXSYS_INST_DEV_SYSCPU_POSSIBLE, &error) != 0)
+			goto done;
+
+		if (lxsys_do_sub_cpu(uiop, oresid, dirent, "present",
+		    LXSYS_INST_DEV_SYSCPU_PRESENT, &error) != 0)
+			goto done;
+	}
+
+	avail = cpuset_alloc(KM_SLEEP);
+	cpuset_all(avail);
+
+	/* Take a snapshot of the available set */
+	mutex_enter(&cpu_lock);
+	cpuset_and(avail, &cpu_available);
+	mutex_exit(&cpu_lock);
+
+	cpuset_bounds(avail, &avlo, &avhi);
+
+	/* Output dynamic CPU info */
+	for (i = avlo; i <= avhi; i++) {
+		char cpunm[16];
+
+		if (skip > 0) {
+			skip--;
+			continue;
+		}
+
+		if (!cpu_in_set(avail, i))
+			continue;
+
+		(void) snprintf(cpunm, sizeof (cpunm), "cpu%u", i);
+		(void) strncpy(dirent->d_name, cpunm, LXSNSIZ);
+
+		dirent->d_ino = lxsys_inode(LXSYS_DEV_SYS_CPUINFO, i + 1, 0);
+		reclen = DIRENT64_RECLEN(strlen(dirent->d_name));
+
+		uresid = uiop->uio_resid;
+		if (reclen > uresid) {
+			if (uresid == oresid) {
+				/* Not enough space for one record */
+				error = EINVAL;
+			}
+			break;
+		}
+		if ((error = lxsys_dirent_out(dirent, reclen, uiop)) != 0) {
+			break;
+		}
+	}
+	cpuset_free(avail);
+
+	/* Indicate EOF if we reached the end of the CPU list. */
+	if (i == avhi) {
+		*eofp = 1;
+	}
+
+done:
+	return (error);
+}
+
+static int
+lxsys_readdir_devices_syscpu(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	int error;
+
+	if (lnp->lxsys_instance == 0) {
+		/* top-level cpu listing */
+		error = lxsys_readdir_cpu(lnp, uiop, eofp);
+	} else if (lnp->lxsys_endpoint == 0) {
+		/* cpu-level sub-item listing */
+		error = lxsys_readdir_subdir(lnp, uiop, eofp, NULL, 0);
+	} else {
+		/*
+		 * Currently there shouldn't be subdirs below this but
+		 * on a real Linux system some will be subdirs. This should
+		 * be fixed when we populate the directory for real.
+		 */
+		error = ENOTDIR;
+	}
+
+	return (error);
+}
+
+static int
+lxsys_readdir_devices_syscpuinfo(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	int error;
+
+	if (lnp->lxsys_type != LXSYS_DEV_SYS_CPUINFO) {
+		/*
+		 * Since /sys/devices/system/cpu/cpuN is empty, readdir
+		 * operations should not be performed anywhere except the top
+		 * level.
+		 */
+		return (ENOTDIR);
+	}
+
+	/*
+	 * Emit "." and ".." entries
+	 * All cpuN directories are currently empty.
+	 */
+	error = lxsys_readdir_common(lnp, uiop, eofp, NULL, 0);
+	if (error != 0 || *eofp == 0) {
+		return (error);
+	}
+
+	/* Indicate EOF */
+	*eofp = 1;
+
+	return (error);
+}
+
+static int
+lxsys_readdir_devices_sysnode(lxsys_node_t *lnp, uio_t *uiop, int *eofp)
+{
+	int error;
+
+	if (lnp->lxsys_instance == 0) {
+		/* top-level node listing */
+		longlong_t bp[DIRENT64_RECLEN(LXSNSIZ) / sizeof (longlong_t)];
+		dirent64_t *dirent = (dirent64_t *)bp;
+		ssize_t oresid, uresid;
+		int reclen, skip;
+
+		/* Emit "." and ".." entries */
+		oresid = uiop->uio_resid;
+		error = lxsys_readdir_common(lnp, uiop, eofp, NULL, 0);
+		if (error != 0 || *eofp == 0) {
+			return (error);
+		}
+		skip = (uiop->uio_offset/LXSYS_SDSIZE) - 2;
+
+		/* Fixed entries */
+		if (skip > 0) {
+			skip--;
+		} else {
+			(void) strncpy(dirent->d_name, "node0", LXSNSIZ);
+
+			dirent->d_ino = lxsys_inode(LXSYS_DEV_SYS_NODE,
+			    1, 0);
+			reclen = DIRENT64_RECLEN(strlen(dirent->d_name));
+
+			uresid = uiop->uio_resid;
+			if (reclen > uresid) {
+				if (uresid == oresid) {
+					/* Not enough space for one record */
+					return (EINVAL);
+				}
+				return (0);
+			}
+			error = lxsys_dirent_out(dirent, reclen, uiop);
+		}
+		/* Indicate EOF */
+		if (error == 0) {
+			*eofp = 1;
+		}
+	} else if (lnp->lxsys_endpoint == 0) {
+		/* node-level sub-item listing */
+		error = lxsys_readdir_subdir(lnp, uiop, eofp,
+		    dirlist_devices_sysnode,
+		    SYSDIRLISTSZ(dirlist_devices_sysnode));
+	} else {
+		/* there shouldn't be subdirs below this */
+		error = ENOTDIR;
+	}
+
+	return (error);
+}
+
+/*
+ * lxsys_readlink(): Vnode operation for VOP_READLINK()
+ */
+/* ARGSUSED */
+static int
+lxsys_readlink(vnode_t *vp, uio_t *uiop, cred_t *cr, caller_context_t *ct)
+{
+	char buf[MAXPATHLEN + 1];
+	lxsys_node_t *lnp = VTOLXS(vp);
+	lxsys_nodetype_t type = lnp->lxsys_type;
+	int (*rlfunc)();
+	int error;
+
+	VERIFY(type > LXSYS_NONE && type < LXSYS_MAXTYPE);
+
+	if (vp->v_type != VLNK) {
+		return (EINVAL);
+	}
+
+	rlfunc = lxsys_readlink_function[lnp->lxsys_type];
+	if (rlfunc != NULL) {
+		if ((error = rlfunc(lnp, buf, sizeof (buf))) == 0) {
+			error = uiomove(buf, strlen(buf), UIO_READ, uiop);
+		}
+	} else {
+		error = EINVAL;
+	}
+
+	return (error);
+}
+
+
+static int
+lxsys_readlink_class_net(lxsys_node_t *lnp, char *buf, size_t len)
+{
+	netstack_t *ns;
+	ip_stack_t *ipst;
+	avl_tree_t *phytree;
+	phyint_t *phyi;
+	uint_t ifindex;
+	char ifname[LIFNAMSIZ];
+	int error = EINVAL;
+
+	if ((ifindex = lnp->lxsys_instance) == 0) {
+		return (error);
+	}
+
+	if ((ns = lxsys_netstack(lnp)) == NULL) {
+		return (error);
+	}
+	ipst = ns->netstack_ip;
+	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
+
+	phytree = &ipst->ips_phyint_g_list->phyint_list_avl_by_index;
+	phyi = avl_find(phytree, &ifindex, NULL);
+	if (phyi != NULL) {
+		(void) strncpy(ifname, phyi->phyint_name, LIFNAMSIZ);
+		lx_ifname_convert(ifname, LX_IF_FROMNATIVE);
+		(void) snprintf(buf, len, "/sys/devices/virtual/net/%s",
+		    ifname);
+		error = 0;
+	}
+
+	rw_exit(&ipst->ips_ill_g_lock);
+	netstack_rele(ns);
+	return (error);
+}
+
+static int
+lxsys_readlink_block(lxsys_node_t *lnp, char *buf, size_t len)
+{
+	int inst, error = EINVAL;
+	lx_zone_data_t *lxzdata;
+	lx_virt_disk_t *vd;
+
+	if ((inst = lnp->lxsys_instance) == 0) {
+		return (error);
+	}
+
+	lxzdata = ztolxzd(curproc->p_zone);
+	if (lxzdata == NULL)
+		return (error);
+	ASSERT(lxzdata->lxzd_vdisks != NULL);
+
+	vd = list_head(lxzdata->lxzd_vdisks);
+	while (vd != NULL) {
+		int vinst = getminor(vd->lxvd_emul_dev) & 0xffff;
+
+		if (vinst == inst) {
+			(void) snprintf(buf, len,
+			    "../devices/zfs/%s", vd->lxvd_name);
+			error = 0;
+			break;
+		}
+		vd = list_next(lxzdata->lxzd_vdisks, vd);
+	}
+
+	return (error);
+}
+
+/*
+ * lxsys_inactive(): Vnode operation for VOP_INACTIVE()
+ * Vnode is no longer referenced, deallocate the file
+ * and all its resources.
+ */
+/* ARGSUSED */
+static void
+lxsys_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
+{
+	lxsys_freenode(VTOLXS(vp));
+}
+
+/*
+ * lxsys_sync(): Vnode operation for VOP_SYNC()
+ */
+static int
+lxsys_sync()
+{
+	/*
+	 * Nothing to sync but this function must never fail
+	 */
+	return (0);
+}
+
+/*
+ * lxsys_cmp(): Vnode operation for VOP_CMP()
+ */
+static int
+lxsys_cmp(vnode_t *vp1, vnode_t *vp2, caller_context_t *ct)
+{
+	if (vn_matchops(vp1, lxsys_vnodeops) ||
+	    vn_matchops(vp2, lxsys_vnodeops))
+		return (vp1 == vp2);
+	return (VOP_CMP(vp1, vp2, ct));
+}
diff --git a/usr/src/uts/common/brand/sn1/sn1_brand.c b/usr/src/uts/common/brand/sn1/sn1_brand.c
index d61928d578..a2383ca076 100644
--- a/usr/src/uts/common/brand/sn1/sn1_brand.c
+++ b/usr/src/uts/common/brand/sn1/sn1_brand.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/errno.h>
@@ -42,43 +43,69 @@
 
 char *sn1_emulation_table = NULL;
 
-void	sn1_init_brand_data(zone_t *);
+void	sn1_init_brand_data(zone_t *, kmutex_t *);
 void	sn1_free_brand_data(zone_t *);
 void	sn1_setbrand(proc_t *);
 int	sn1_getattr(zone_t *, int, void *, size_t *);
 int	sn1_setattr(zone_t *, int, void *, size_t);
 int	sn1_brandsys(int, int64_t *, uintptr_t, uintptr_t, uintptr_t,
-		uintptr_t, uintptr_t, uintptr_t);
+		uintptr_t);
 void	sn1_copy_procdata(proc_t *, proc_t *);
-void	sn1_proc_exit(struct proc *, klwp_t *);
+void	sn1_proc_exit(struct proc *);
 void	sn1_exec();
-int	sn1_initlwp(klwp_t *);
+void	sn1_initlwp(klwp_t *, void *);
 void	sn1_forklwp(klwp_t *, klwp_t *);
 void	sn1_freelwp(klwp_t *);
 void	sn1_lwpexit(klwp_t *);
 int	sn1_elfexec(vnode_t *, execa_t *, uarg_t *, intpdata_t *, int,
-	long *, int, caddr_t, cred_t *, int);
+	long *, int, caddr_t, cred_t *, int *);
 
 /* sn1 brand */
 struct brand_ops sn1_brops = {
-	sn1_init_brand_data,
-	sn1_free_brand_data,
-	sn1_brandsys,
-	sn1_setbrand,
-	sn1_getattr,
-	sn1_setattr,
-	sn1_copy_procdata,
-	sn1_proc_exit,
-	sn1_exec,
-	lwp_setrval,
-	sn1_initlwp,
-	sn1_forklwp,
-	sn1_freelwp,
-	sn1_lwpexit,
-	sn1_elfexec,
-	NULL,
-	NULL,
-	NSIG,
+	sn1_init_brand_data,		/* b_init_brand_data */
+	sn1_free_brand_data,		/* b_free_brand_data */
+	sn1_brandsys,			/* b_brandsys */
+	sn1_setbrand,			/* b_setbrand */
+	sn1_getattr,			/* b_getattr */
+	sn1_setattr,			/* b_setattr */
+	sn1_copy_procdata,		/* b_copy_procdata */
+	sn1_proc_exit,			/* b_proc_exit */
+	sn1_exec,			/* b_exec */
+	lwp_setrval,			/* b_lwp_setrval */
+	NULL,				/* b_lwpdata_alloc */
+	NULL,				/* b_lwpdata_free */
+	sn1_initlwp,			/* b_initlwp */
+	NULL,				/* b_initlwp_post */
+	sn1_forklwp,			/* b_forklwp */
+	sn1_freelwp,			/* b_freelwp */
+	sn1_lwpexit,			/* b_lwpexit */
+	sn1_elfexec,			/* b_elfexec */
+	NULL,				/* b_sigset_native_to_brand */
+	NULL,				/* b_sigset_brand_to_native */
+	NULL,				/* b_sigfd_translate */
+	NSIG,				/* b_nsig */
+	NULL,				/* b_exit_with_sig */
+	NULL,				/* b_wait_filter */
+	NULL,				/* b_native_exec */
+	NULL,				/* b_map32limit */
+	NULL,				/* b_stop_notify */
+	NULL,				/* b_waitid_helper */
+	NULL,				/* b_sigcld_repost */
+	NULL,				/* b_issig_stop */
+	NULL,				/* b_sig_ignorable */
+	NULL,				/* b_savecontext */
+#if defined(_SYSCALL32_IMPL)
+	NULL,				/* b_savecontext32 */
+#endif
+	NULL,				/* b_restorecontext */
+	NULL,				/* b_sendsig_stack */
+	NULL,				/* b_sendsig */
+	NULL,				/* b_setid_clear */
+	NULL,				/* b_pagefault */
+	B_TRUE,				/* b_intp_parse_arg */
+	NULL,				/* b_clearbrand */
+	NULL,				/* b_rpc_statd */
+	NULL				/* b_acct_out */
 };
 
 #ifdef	sparc
@@ -94,9 +121,12 @@ struct brand_mach_ops sn1_mops = {
 
 struct brand_mach_ops sn1_mops = {
 	sn1_brand_sysenter_callback,
+	NULL,
 	sn1_brand_int91_callback,
 	sn1_brand_syscall_callback,
-	sn1_brand_syscall32_callback
+	sn1_brand_syscall32_callback,
+	NULL,
+	NULL
 };
 
 #else	/* ! __amd64 */
@@ -104,7 +134,10 @@ struct brand_mach_ops sn1_mops = {
 struct brand_mach_ops sn1_mops = {
 	sn1_brand_sysenter_callback,
 	NULL,
+	NULL,
 	sn1_brand_syscall_callback,
+	NULL,
+	NULL,
 	NULL
 };
 #endif	/* __amd64 */
@@ -115,7 +148,8 @@ struct brand	sn1_brand = {
 	BRAND_VER_1,
 	"sn1",
 	&sn1_brops,
-	&sn1_mops
+	&sn1_mops,
+	sizeof (brand_proc_data_t),
 };
 
 static struct modlbrand modlbrand = {
@@ -148,10 +182,10 @@ sn1_setattr(zone_t *zone, int attr, void *buf, size_t bufsize)
 	return (EINVAL);
 }
 
-/*ARGSUSED*/
+/* ARGSUSED5 */
 int
 sn1_brandsys(int cmd, int64_t *rval, uintptr_t arg1, uintptr_t arg2,
-    uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6)
+    uintptr_t arg3, uintptr_t arg4)
 {
 	int	res;
 
@@ -171,9 +205,9 @@ sn1_copy_procdata(proc_t *child, proc_t *parent)
 }
 
 void
-sn1_proc_exit(struct proc *p, klwp_t *l)
+sn1_proc_exit(struct proc *p)
 {
-	brand_solaris_proc_exit(p, l, &sn1_brand);
+	brand_solaris_proc_exit(p, &sn1_brand);
 }
 
 void
@@ -182,10 +216,10 @@ sn1_exec()
 	brand_solaris_exec(&sn1_brand);
 }
 
-int
-sn1_initlwp(klwp_t *l)
+void
+sn1_initlwp(klwp_t *l, void *bd)
 {
-	return (brand_solaris_initlwp(l, &sn1_brand));
+	brand_solaris_initlwp(l, &sn1_brand);
 }
 
 void
@@ -214,18 +248,18 @@ sn1_free_brand_data(zone_t *zone)
 
 /*ARGSUSED*/
 void
-sn1_init_brand_data(zone_t *zone)
+sn1_init_brand_data(zone_t *zone, kmutex_t *zsl)
 {
 }
 
 int
 sn1_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
-	int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
-	int brand_action)
+    int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
+    int *brand_action)
 {
 	return (brand_solaris_elfexec(vp, uap, args, idatap, level, execsz,
 	    setid, exec_file, cred, brand_action, &sn1_brand, SN1_BRANDNAME,
-	    SN1_LIB, SN1_LIB32, SN1_LINKER, SN1_LINKER32));
+	    SN1_LIB, SN1_LIB32));
 }
 
 int
diff --git a/usr/src/uts/common/brand/sn1/sn1_brand.h b/usr/src/uts/common/brand/sn1/sn1_brand.h
index b487745e21..fef9dc128b 100644
--- a/usr/src/uts/common/brand/sn1/sn1_brand.h
+++ b/usr/src/uts/common/brand/sn1/sn1_brand.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  */
 
 #ifndef _SN1_BRAND_H
@@ -37,20 +38,14 @@ extern "C" {
 #define	SN1_VERSION		SN1_VERSION_1
 
 #define	SN1_LIB_NAME		"sn1_brand.so.1"
-#define	SN1_LINKER_NAME		"ld.so.1"
 
 #define	SN1_LIB32		BRAND_NATIVE_DIR "usr/lib/" SN1_LIB_NAME
-#define	SN1_LINKER32		"/lib/" SN1_LINKER_NAME
-
 #define	SN1_LIB64		BRAND_NATIVE_DIR "usr/lib/64/" SN1_LIB_NAME
-#define	SN1_LINKER64		"/lib/64/" SN1_LINKER_NAME
 
 #if defined(_LP64)
 #define	SN1_LIB		SN1_LIB64
-#define	SN1_LINKER	SN1_LINKER64
 #else /* !_LP64 */
 #define	SN1_LIB		SN1_LIB32
-#define	SN1_LINKER	SN1_LINKER32
 #endif /* !_LP64 */
 
 #if defined(_KERNEL)
diff --git a/usr/src/uts/common/brand/solaris10/s10_brand.c b/usr/src/uts/common/brand/solaris10/s10_brand.c
index 0841f02e51..c5a9d10f58 100644
--- a/usr/src/uts/common/brand/solaris10/s10_brand.c
+++ b/usr/src/uts/common/brand/solaris10/s10_brand.c
@@ -46,45 +46,71 @@
 
 char *s10_emulation_table = NULL;
 
-void	s10_init_brand_data(zone_t *);
+void	s10_init_brand_data(zone_t *, kmutex_t *);
 void	s10_free_brand_data(zone_t *);
 void	s10_setbrand(proc_t *);
 int	s10_getattr(zone_t *, int, void *, size_t *);
 int	s10_setattr(zone_t *, int, void *, size_t);
 int	s10_brandsys(int, int64_t *, uintptr_t, uintptr_t, uintptr_t,
-		uintptr_t, uintptr_t, uintptr_t);
+		uintptr_t);
 void	s10_copy_procdata(proc_t *, proc_t *);
-void	s10_proc_exit(struct proc *, klwp_t *);
+void	s10_proc_exit(struct proc *);
 void	s10_exec();
-int	s10_initlwp(klwp_t *);
+void	s10_initlwp(klwp_t *, void *);
 void	s10_forklwp(klwp_t *, klwp_t *);
 void	s10_freelwp(klwp_t *);
 void	s10_lwpexit(klwp_t *);
 int	s10_elfexec(vnode_t *, execa_t *, uarg_t *, intpdata_t *, int,
-	long *, int, caddr_t, cred_t *, int);
+	long *, int, caddr_t, cred_t *, int *);
 void	s10_sigset_native_to_s10(sigset_t *);
 void	s10_sigset_s10_to_native(sigset_t *);
 
 /* s10 brand */
 struct brand_ops s10_brops = {
-	s10_init_brand_data,
-	s10_free_brand_data,
-	s10_brandsys,
-	s10_setbrand,
-	s10_getattr,
-	s10_setattr,
-	s10_copy_procdata,
-	s10_proc_exit,
-	s10_exec,
-	lwp_setrval,
-	s10_initlwp,
-	s10_forklwp,
-	s10_freelwp,
-	s10_lwpexit,
-	s10_elfexec,
-	s10_sigset_native_to_s10,
-	s10_sigset_s10_to_native,
-	S10_NSIG,
+	s10_init_brand_data,		/* b_init_brand_data */
+	s10_free_brand_data,		/* b_free_brand_data */
+	s10_brandsys,			/* b_brandsys */
+	s10_setbrand,			/* b_setbrand */
+	s10_getattr,			/* b_getattr */
+	s10_setattr,			/* b_setattr */
+	s10_copy_procdata,		/* b_copy_procdata */
+	s10_proc_exit,			/* b_proc_exit */
+	s10_exec,			/* b_exec */
+	lwp_setrval,			/* b_lwp_setrval */
+	NULL,				/* b_lwpdata_alloc */
+	NULL,				/* b_lwpdata_free */
+	s10_initlwp,			/* b_initlwp */
+	NULL,				/* b_initlwp_post */
+	s10_forklwp,			/* b_forklwp */
+	s10_freelwp,			/* b_freelwp */
+	s10_lwpexit,			/* b_lwpexit */
+	s10_elfexec,			/* b_elfexec */
+	s10_sigset_native_to_s10,	/* b_sigset_native_to_brand */
+	s10_sigset_s10_to_native,	/* b_sigset_brand_to_native */
+	NULL,				/* b_sigfd_translate */
+	S10_NSIG,			/* b_nsig */
+	NULL,				/* b_exit_with_sig */
+	NULL,				/* b_wait_filter */
+	NULL,				/* b_native_exec */
+	NULL,				/* b_map32limit */
+	NULL,				/* b_stop_notify */
+	NULL,				/* b_waitid_helper */
+	NULL,				/* b_sigcld_repost */
+	NULL,				/* b_issig_stop */
+	NULL,				/* b_sig_ignorable */
+	NULL,				/* b_savecontext */
+#if defined(_SYSCALL32_IMPL)
+	NULL,				/* b_savecontext32 */
+#endif
+	NULL,				/* b_restorecontext */
+	NULL,				/* b_sendsig_stack */
+	NULL,				/* b_sendsig */
+	NULL,				/* b_setid_clear */
+	NULL,				/* b_pagefault */
+	B_TRUE,				/* b_intp_parse_arg */
+	NULL,				/* b_clearbrand */
+	NULL,				/* b_rpc_statd */
+	NULL				/* b_acct_out */
 };
 
 #ifdef	sparc
@@ -100,9 +126,12 @@ struct brand_mach_ops s10_mops = {
 
 struct brand_mach_ops s10_mops = {
 	s10_brand_sysenter_callback,
+	NULL,
 	s10_brand_int91_callback,
 	s10_brand_syscall_callback,
-	s10_brand_syscall32_callback
+	s10_brand_syscall32_callback,
+	NULL,
+	NULL
 };
 
 #else	/* ! __amd64 */
@@ -110,7 +139,10 @@ struct brand_mach_ops s10_mops = {
 struct brand_mach_ops s10_mops = {
 	s10_brand_sysenter_callback,
 	NULL,
+	NULL,
 	s10_brand_syscall_callback,
+	NULL,
+	NULL,
 	NULL
 };
 #endif	/* __amd64 */
@@ -121,7 +153,8 @@ struct brand	s10_brand = {
 	BRAND_VER_1,
 	"solaris10",
 	&s10_brops,
-	&s10_mops
+	&s10_mops,
+	sizeof (brand_proc_data_t),
 };
 
 static struct modlbrand modlbrand = {
@@ -250,10 +283,10 @@ s10_native(void *cmd, void *args)
 	return (0);
 }
 
-/*ARGSUSED*/
+/* ARGSUSED5 */
 int
 s10_brandsys(int cmd, int64_t *rval, uintptr_t arg1, uintptr_t arg2,
-    uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6)
+    uintptr_t arg3, uintptr_t arg4)
 {
 	proc_t	*p = curproc;
 	int	res;
@@ -327,9 +360,9 @@ s10_copy_procdata(proc_t *child, proc_t *parent)
 }
 
 void
-s10_proc_exit(struct proc *p, klwp_t *l)
+s10_proc_exit(struct proc *p)
 {
-	brand_solaris_proc_exit(p, l, &s10_brand);
+	brand_solaris_proc_exit(p, &s10_brand);
 }
 
 void
@@ -338,10 +371,10 @@ s10_exec()
 	brand_solaris_exec(&s10_brand);
 }
 
-int
-s10_initlwp(klwp_t *l)
+void
+s10_initlwp(klwp_t *l, void *bd)
 {
-	return (brand_solaris_initlwp(l, &s10_brand));
+	brand_solaris_initlwp(l, &s10_brand);
 }
 
 void
@@ -381,7 +414,7 @@ s10_free_brand_data(zone_t *zone)
 }
 
 void
-s10_init_brand_data(zone_t *zone)
+s10_init_brand_data(zone_t *zone, kmutex_t *zsl)
 {
 	ASSERT(zone->zone_brand == &s10_brand);
 	ASSERT(zone->zone_brand_data == NULL);
@@ -390,12 +423,12 @@ s10_init_brand_data(zone_t *zone)
 
 int
 s10_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
-	int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
-	int brand_action)
+    int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
+    int *brand_action)
 {
 	return (brand_solaris_elfexec(vp, uap, args, idatap, level, execsz,
 	    setid, exec_file, cred, brand_action, &s10_brand, S10_BRANDNAME,
-	    S10_LIB, S10_LIB32, S10_LINKER, S10_LINKER32));
+	    S10_LIB, S10_LIB32));
 }
 
 void
diff --git a/usr/src/uts/common/brand/solaris10/s10_brand.h b/usr/src/uts/common/brand/solaris10/s10_brand.h
index 11f9853f48..ffef485e12 100644
--- a/usr/src/uts/common/brand/solaris10/s10_brand.h
+++ b/usr/src/uts/common/brand/solaris10/s10_brand.h
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved.
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  */
 
 #ifndef _S10_BRAND_H
@@ -42,17 +43,12 @@ extern "C" {
 #define	S10_LINKER_NAME		"ld.so.1"
 
 #define	S10_LIB32		BRAND_NATIVE_DIR "usr/lib/" S10_LIB_NAME
-#define	S10_LINKER32		"/lib/" S10_LINKER_NAME
-
 #define	S10_LIB64		BRAND_NATIVE_DIR "usr/lib/64/" S10_LIB_NAME
-#define	S10_LINKER64		"/lib/64/" S10_LINKER_NAME
 
 #if defined(_LP64)
 #define	S10_LIB		S10_LIB64
-#define	S10_LINKER	S10_LINKER64
 #else /* !_LP64 */
 #define	S10_LIB		S10_LIB32
-#define	S10_LINKER	S10_LINKER32
 #endif /* !_LP64 */
 
 /*
diff --git a/usr/src/uts/common/conf/param.c b/usr/src/uts/common/conf/param.c
index 64227a3998..1120748b98 100644
--- a/usr/src/uts/common/conf/param.c
+++ b/usr/src/uts/common/conf/param.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 1983, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  * Copyright 2012 Milan Jurik. All rights reserved.
  */
 
@@ -559,8 +560,8 @@ char *isa_list = architecture;
 static pgcnt_t original_physmem = 0;
 
 #define	MIN_DEFAULT_MAXUSERS	8u
-#define	MAX_DEFAULT_MAXUSERS	2048u
-#define	MAX_MAXUSERS		4096u
+#define	MAX_DEFAULT_MAXUSERS	10000u
+#define	MAX_MAXUSERS		20000u
 
 void
 param_preset(void)
@@ -572,7 +573,7 @@ void
 param_calc(int platform_max_nprocs)
 {
 	/*
-	 * Default to about one "user" per megabyte, taking into
+	 * Default to about one "user" per 8MB, taking into
 	 * account both physical and virtual constraints.
 	 * Note: 2^20 is a meg; shifting right by (20 - PAGESHIFT)
 	 * converts pages to megs without integer overflow.
@@ -586,8 +587,9 @@ param_calc(int platform_max_nprocs)
 	if (maxusers == 0) {
 		pgcnt_t physmegs = physmem >> (20 - PAGESHIFT);
 		pgcnt_t virtmegs = vmem_size(heap_arena, VMEM_FREE) >> 20;
-		maxusers = MIN(MAX(MIN(physmegs, virtmegs),
-		    MIN_DEFAULT_MAXUSERS), MAX_DEFAULT_MAXUSERS);
+		maxusers = MIN(physmegs, virtmegs) >> 3; /* divide by 8 */
+		maxusers = MAX(maxusers, MIN_DEFAULT_MAXUSERS);
+		maxusers = MIN(maxusers, MAX_DEFAULT_MAXUSERS);
 	}
 	if (maxusers > MAX_MAXUSERS) {
 		maxusers = MAX_MAXUSERS;
@@ -604,15 +606,26 @@ param_calc(int platform_max_nprocs)
 
 	/*
 	 * We need to dynamically change any variables now so that
-	 * the setting of maxusers and pidmax propagate to the other
+	 * the setting of maxusers and maxpid propagate to the other
 	 * variables that are dependent on them.
 	 */
 	if (reserved_procs == 0)
 		reserved_procs = 5;
-	if (pidmax < reserved_procs || pidmax > MAX_MAXPID)
+	if (pidmax < reserved_procs || pidmax > MAX_MAXPID) {
 		maxpid = MAX_MAXPID;
-	else
+	} else {
+		/*
+		 * If pidmax has not been explicity set in /etc/system, then
+		 * increase it to the maximum on larger machines. We choose a
+		 * 128GB memory size as the threshold to increase pidmax.
+		 */
+		if (pidmax == DEFAULT_MAXPID) {
+			if (physmem > (btop(128ULL * 0x40000000ULL))) {
+				pidmax = MAX_MAXPID;
+			}
+		}
 		maxpid = pidmax;
+	}
 
 	/*
 	 * This allows platform-dependent code to constrain the maximum
diff --git a/usr/src/uts/common/contract/process.c b/usr/src/uts/common/contract/process.c
index 9fd23fdb61..e46cbd3abf 100644
--- a/usr/src/uts/common/contract/process.c
+++ b/usr/src/uts/common/contract/process.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/mutex.h>
@@ -955,6 +956,18 @@ contract_process_exit(cont_process_t *ctp, proc_t *p, int exitstatus)
 		(void) cte_publish_all(ct, event, nvl, NULL);
 		mutex_enter(&ct->ct_lock);
 	}
+
+	/*
+	 * CT_PR_EV_EXIT is not part of the CT_PR_ALLFATAL definition since
+	 * we never allow including this in the fatal set via a user-land
+	 * application, but we do allow CT_PR_EV_EXIT in the contract's fatal
+	 * set for a process setup for zone init. See zone_start_init().
+	 */
+	if (EVFATALP(ctp, CT_PR_EV_EXIT)) {
+		ASSERT(MUTEX_HELD(&ct->ct_lock));
+		contract_process_kill(ct, p, B_TRUE);
+	}
+
 	if (empty) {
 		/*
 		 * Send EMPTY message.
@@ -1057,6 +1070,17 @@ contract_process_fork(ctmpl_process_t *rtmpl, proc_t *cp, proc_t *pp,
 		event->cte_type = CT_PR_EV_FORK;
 		(void) cte_publish_all(ct, event, nvl, NULL);
 	}
+
+	/*
+	 * Because the CT_PR_KEEP_EXEC flag is meant to be used by applications
+	 * which are not contract aware, we can assume that these applications
+	 * will never explicitly abandon the child's new contract. Thus, we
+	 * abandon it now.
+	 */
+	if (ctp->conp_params & CT_PR_KEEP_EXEC) {
+		(void) contract_abandon(ct, pp, 1);
+	}
+
 	return (ctp);
 }
 
diff --git a/usr/src/uts/common/crypto/api/kcf_random.c b/usr/src/uts/common/crypto/api/kcf_random.c
index 5f84a4952e..7f17521b04 100644
--- a/usr/src/uts/common/crypto/api/kcf_random.c
+++ b/usr/src/uts/common/crypto/api/kcf_random.c
@@ -70,6 +70,7 @@
 #include <sys/cpuvar.h>
 #include <sys/taskq.h>
 #include <rng/fips_random.h>
+#include <sys/strlog.h>
 
 #define	RNDPOOLSIZE		1024	/* Pool size in bytes */
 #define	MINEXTRACTBYTES		20
@@ -933,7 +934,8 @@ rnd_handler(void *arg)
 	int len = 0;
 
 	if (!rng_prov_found && rng_ok_to_log) {
-		cmn_err(CE_WARN, "No randomness provider enabled for "
+		(void) strlog(0, 0, 0, SL_NOTE,
+		    "No randomness provider enabled for "
 		    "/dev/random. Use cryptoadm(1M) to enable a provider.");
 		rng_ok_to_log = B_FALSE;
 	}
diff --git a/usr/src/uts/common/crypto/core/kcf_sched.c b/usr/src/uts/common/crypto/core/kcf_sched.c
index f461fe048c..8b2760b237 100644
--- a/usr/src/uts/common/crypto/core/kcf_sched.c
+++ b/usr/src/uts/common/crypto/core/kcf_sched.c
@@ -1027,9 +1027,9 @@ kcfpool_svc(void *arg)
 			case 0:
 			case -1:
 				/*
-				 * Woke up with no work to do. Check
-				 * if this thread should exit. We keep
-				 * at least kcf_minthreads.
+				 * Woke up with no work to do. Check if we
+				 * should lwp_exit() (which won't return). We
+				 * keep at least kcf_minthreads.
 				 */
 				if (kcfpool->kp_threads > kcf_minthreads) {
 					KCF_ATOMIC_DECR(kcfpool->kp_threads);
diff --git a/usr/src/uts/common/ctf/ctf_mod.c b/usr/src/uts/common/ctf/ctf_mod.c
index b34cf400cd..421b922c96 100644
--- a/usr/src/uts/common/ctf/ctf_mod.c
+++ b/usr/src/uts/common/ctf/ctf_mod.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/sysmacros.h>
 #include <sys/modctl.h>
 #include <sys/debug.h>
@@ -117,6 +115,15 @@ ctf_version(int version)
 
 /*ARGSUSED*/
 ctf_file_t *
+ctf_fdcreate_int(int fd, int *errp, ctf_sect_t *ctfp)
+{
+	if (errp != NULL)
+		*errp = ENOTSUP;
+	return (NULL);
+}
+
+/*ARGSUSED*/
+ctf_file_t *
 ctf_modopen(struct module *mp, int *error)
 {
 	ctf_sect_t ctfsect, symsect, strsect;
diff --git a/usr/src/uts/common/disp/cmt.c b/usr/src/uts/common/disp/cmt.c
index 0196b15dae..80b5340543 100644
--- a/usr/src/uts/common/disp/cmt.c
+++ b/usr/src/uts/common/disp/cmt.c
@@ -201,13 +201,15 @@ pg_cmt_cpu_startup(cpu_t *cp)
 
 /*
  * Return non-zero if thread can migrate between "from" and "to"
- * without a performance penalty
+ * without a performance penalty.  This is true only if we share a core on
+ * virtually any CPU; sharing the last-level cache is insufficient to make
+ * migration possible without penalty.
  */
 int
 pg_cmt_can_migrate(cpu_t *from, cpu_t *to)
 {
-	if (from->cpu_physid->cpu_cacheid ==
-	    to->cpu_physid->cpu_cacheid)
+	if (from->cpu_physid->cpu_coreid ==
+	    to->cpu_physid->cpu_coreid)
 		return (1);
 	return (0);
 }
diff --git a/usr/src/uts/common/disp/cpucaps.c b/usr/src/uts/common/disp/cpucaps.c
index 46f53faab6..2a4365ff73 100644
--- a/usr/src/uts/common/disp/cpucaps.c
+++ b/usr/src/uts/common/disp/cpucaps.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2013 Joyent, Inc.  All rights reserved.
  */
 
 #include <sys/disp.h>
@@ -74,6 +75,32 @@
  * Putting threads on wait queues in random places while running in the
  * kernel might lead to all kinds of locking problems.
  *
+ * Bursting
+ * ========
+ *
+ * CPU bursting occurs when the CPU usage is over the baseline but under the
+ * cap.  The baseline CPU (zone.cpu-baseline) is set in a multi-tenant
+ * environment so that we know how much CPU is allocated for a tenant under
+ * normal utilization.  We can then track how much time a zone is spending
+ * over the "normal" CPU utilization expected for that zone using the
+ * "above_base_sec" kstat. This kstat is cumulative.
+ *
+ * If the zone has a burst limit (zone.cpu-burst-time) then the zone can
+ * burst for that period of time (in seconds) before the effective cap is
+ * lowered to the baseline.  Once the effective cap is lowered, the zone
+ * will run at the baseline for the burst limit before the effective cap is
+ * raised again to the full value.  This will allow the zone to burst again.
+ * We can watch this behavior using the kstats.  The "effective" kstat shows
+ * which cap is being used, the baseline value or the burst value.  The
+ * "burst_limit_sec" shows the value of the zone.cpu-burst-time rctl and the
+ * "bursting_sec" kstat shows how many seconds the zone has currently been
+ * bursting.  When the CPU load is continuously greater than the baseline,
+ * bursting_sec will increase, up to the burst_limit_sec value, then the
+ * effective kstat will drop to the baseline and the bursting_sec value will
+ * decrease until it hits 0, at which time the effective kstat will return to
+ * the full burst value and the bursting_sec value will begin to increase
+ * again.
+ *
  * Accounting
  * ==========
  *
@@ -203,18 +230,28 @@ static void caps_update();
  */
 struct cap_kstat {
 	kstat_named_t	cap_value;
+	kstat_named_t	cap_baseline;
+	kstat_named_t	cap_effective;
+	kstat_named_t	cap_burst_limit;
+	kstat_named_t	cap_bursting;
 	kstat_named_t	cap_usage;
 	kstat_named_t	cap_nwait;
 	kstat_named_t	cap_below;
 	kstat_named_t	cap_above;
+	kstat_named_t	cap_above_base;
 	kstat_named_t	cap_maxusage;
 	kstat_named_t	cap_zonename;
 } cap_kstat = {
 	{ "value",	KSTAT_DATA_UINT64 },
+	{ "baseline",	KSTAT_DATA_UINT64 },
+	{ "effective",	KSTAT_DATA_UINT64 },
+	{ "burst_limit_sec", KSTAT_DATA_UINT64 },
+	{ "bursting_sec", KSTAT_DATA_UINT64 },
 	{ "usage",	KSTAT_DATA_UINT64 },
 	{ "nwait",	KSTAT_DATA_UINT64 },
 	{ "below_sec",	KSTAT_DATA_UINT64 },
 	{ "above_sec",	KSTAT_DATA_UINT64 },
+	{ "above_base_sec", KSTAT_DATA_UINT64 },
 	{ "maxusage",	KSTAT_DATA_UINT64 },
 	{ "zonename",	KSTAT_DATA_STRING },
 };
@@ -311,7 +348,7 @@ cap_enable(list_t *l, cpucap_t *cap, hrtime_t value)
 	cap->cap_below = cap->cap_above = 0;
 	cap->cap_maxusage = 0;
 	cap->cap_usage = 0;
-	cap->cap_value = value;
+	cap->cap_value = cap->cap_chk_value = value;
 	waitq_unblock(&cap->cap_waitq);
 	if (CPUCAPS_OFF()) {
 		cpucaps_enabled = B_TRUE;
@@ -340,19 +377,21 @@ cap_disable(list_t *l, cpucap_t *cap)
 	ASSERT(CAP_ENABLED(cap));
 
 	waitq_block(&cap->cap_waitq);
+
+	/* do this first to avoid race with cap_kstat_update */
+	if (cap->cap_kstat != NULL) {
+		kstat_delete(cap->cap_kstat);
+		cap->cap_kstat = NULL;
+	}
+
 	list_remove(l, cap);
 	if (list_is_empty(&capped_projects) && list_is_empty(&capped_zones)) {
 		cpucaps_enabled = B_FALSE;
 		cpucaps_clock_callout = NULL;
 	}
-	cap->cap_value = 0;
+	cap->cap_value = cap->cap_chk_value = 0;
 	cap->cap_project = NULL;
 	cap->cap_zone = NULL;
-	if (cap->cap_kstat != NULL) {
-		kstat_delete(cap->cap_kstat);
-		cap->cap_kstat = NULL;
-	}
-
 }
 
 /*
@@ -487,6 +526,8 @@ cap_walk(list_t *l, void (*cb)(cpucap_t *, int64_t))
  * The waitq_isempty check is performed without the waitq lock. If a new thread
  * is placed on the waitq right after the check, it will be picked up during the
  * next invocation of cap_poke_waitq().
+ *
+ * Called once per tick for zones.
  */
 /* ARGSUSED */
 static void
@@ -494,15 +535,92 @@ cap_poke_waitq(cpucap_t *cap, int64_t gen)
 {
 	ASSERT(MUTEX_HELD(&caps_lock));
 
-	if (cap->cap_usage >= cap->cap_value) {
+	if (cap->cap_base != 0) {
+		/*
+		 * Because of the way usage is calculated and decayed, its
+		 * possible for the zone to be slightly over its cap, but we
+		 * don't want to count that after we have reduced the effective
+		 * cap to the baseline.  That way the zone will be able to
+		 * burst again after the burst_limit has expired.
+		 */
+		if (cap->cap_usage > cap->cap_base &&
+		    cap->cap_chk_value == cap->cap_value) {
+			cap->cap_above_base++;
+
+			/*
+			 * If bursting is limited and we've been bursting
+			 * longer than we're supposed to, then set the
+			 * effective cap to the baseline.
+			 */
+			if (cap->cap_burst_limit != 0) {
+				cap->cap_bursting++;
+				if (cap->cap_bursting >= cap->cap_burst_limit)
+					cap->cap_chk_value = cap->cap_base;
+			}
+		} else if (cap->cap_bursting > 0) {
+			/*
+			 * We're not bursting now, but we were, decay the
+			 * bursting timer.
+			 */
+			cap->cap_bursting--;
+			/*
+			 * Reset the effective cap once we decay to 0 so we
+			 * can burst again.
+			 */
+			if (cap->cap_bursting == 0 &&
+			    cap->cap_chk_value != cap->cap_value)
+				cap->cap_chk_value = cap->cap_value;
+		}
+	}
+
+	if (cap->cap_usage >= cap->cap_chk_value) {
 		cap->cap_above++;
 	} else {
 		waitq_t *wq = &cap->cap_waitq;
 
 		cap->cap_below++;
 
-		if (!waitq_isempty(wq))
-			waitq_runone(wq);
+		if (!waitq_isempty(wq)) {
+			int i, ndequeue, p;
+
+			/*
+			 * Since this function is only called once per tick,
+			 * we can hit a situation where we have artificially
+			 * limited the project/zone below its cap.  This would
+			 * happen if we have multiple threads queued up but
+			 * only dequeued one thread/tick. To avoid this we
+			 * dequeue multiple threads, calculated based on the
+			 * usage percentage of the cap. It is possible that we
+			 * could dequeue too many threads and some of them
+			 * might be put back on the wait queue quickly, but
+			 * since we know that threads are on the wait queue
+			 * because we're capping, we know that there is unused
+			 * CPU cycles anyway, so this extra work would not
+			 * hurt. Also, the ndequeue number is only an upper
+			 * bound and we might dequeue less, depending on how
+			 * many threads are actually in the wait queue. The
+			 * ndequeue values are empirically derived and could be
+			 * adjusted or calculated in another way if necessary.
+			 */
+			p = (int)((100 * cap->cap_usage) / cap->cap_chk_value);
+			if (p >= 98)
+				ndequeue = 10;
+			else if (p >= 95)
+				ndequeue = 20;
+			else if (p >= 90)
+				ndequeue = 40;
+			else if (p >= 85)
+				ndequeue = 80;
+			else
+				ndequeue = 160;
+
+			for (i = 0; i < ndequeue; i++) {
+				waitq_runone(wq);
+				if (waitq_isempty(wq))
+					break;
+			}
+			DTRACE_PROBE2(cpucaps__pokeq, int, p, int, i);
+		}
 	}
 }
 
@@ -629,14 +747,14 @@ cap_project_zone_modify_walker(kproject_t *kpj, void *arg)
 		 * Remove all projects in this zone without caps
 		 * from the capped_projects list.
 		 */
-		if (project_cap->cap_value == MAX_USAGE) {
+		if (project_cap->cap_chk_value == MAX_USAGE) {
 			cap_project_disable(kpj);
 		}
 	} else if (CAP_DISABLED(project_cap)) {
 		/*
 		 * Add the project to capped_projects list.
 		 */
-		ASSERT(project_cap->cap_value == 0);
+		ASSERT(project_cap->cap_chk_value == 0);
 		cap_project_enable(kpj, MAX_USAGE);
 	}
 	mutex_exit(&caps_lock);
@@ -746,7 +864,7 @@ cpucaps_zone_set(zone_t *zone, rctl_qty_t cap_val)
 		/*
 		 * No state transitions, just change the value
 		 */
-		cap->cap_value = value;
+		cap->cap_value = cap->cap_chk_value = value;
 	}
 
 	ASSERT(MUTEX_HELD(&caps_lock));
@@ -757,6 +875,108 @@ cpucaps_zone_set(zone_t *zone, rctl_qty_t cap_val)
 }
 
 /*
+ * Set zone's base cpu value to base_val
+ */
+int
+cpucaps_zone_set_base(zone_t *zone, rctl_qty_t base_val)
+{
+	cpucap_t *cap = NULL;
+	hrtime_t value;
+
+	ASSERT(base_val <= MAXCAP);
+	if (base_val > MAXCAP)
+		base_val = MAXCAP;
+
+	if (CPUCAPS_OFF() || !ZONE_IS_CAPPED(zone))
+		return (0);
+
+	if (zone->zone_cpucap == NULL)
+		cap = cap_alloc();
+
+	mutex_enter(&caps_lock);
+
+	if (cpucaps_busy) {
+		mutex_exit(&caps_lock);
+		return (EBUSY);
+	}
+
+	/*
+	 * Double-check whether zone->zone_cpucap is NULL, now with caps_lock
+	 * held. If it is still NULL, assign a newly allocated cpucap to it.
+	 */
+	if (zone->zone_cpucap == NULL) {
+		zone->zone_cpucap = cap;
+	} else if (cap != NULL) {
+		cap_free(cap);
+	}
+
+	cap = zone->zone_cpucap;
+
+	value = base_val * cap_tick_cost;
+	if (value < 0 || value > cap->cap_value)
+		value = 0;
+
+	cap->cap_base = value;
+
+	mutex_exit(&caps_lock);
+
+	return (0);
+}
+
+/*
+ * Set zone's maximum burst time in seconds.  A burst time of 0 means that
+ * the zone can run over its baseline indefinitely.
+ */
+int
+cpucaps_zone_set_burst_time(zone_t *zone, rctl_qty_t base_val)
+{
+	cpucap_t *cap = NULL;
+	hrtime_t value;
+
+	ASSERT(base_val <= INT_MAX);
+	/* Treat the default as 0 - no limit */
+	if (base_val == INT_MAX)
+		base_val = 0;
+	if (base_val > INT_MAX)
+		base_val = INT_MAX;
+
+	if (CPUCAPS_OFF() || !ZONE_IS_CAPPED(zone))
+		return (0);
+
+	if (zone->zone_cpucap == NULL)
+		cap = cap_alloc();
+
+	mutex_enter(&caps_lock);
+
+	if (cpucaps_busy) {
+		mutex_exit(&caps_lock);
+		return (EBUSY);
+	}
+
+	/*
+	 * Double-check whether zone->zone_cpucap is NULL, now with caps_lock
+	 * held. If it is still NULL, assign a newly allocated cpucap to it.
+	 */
+	if (zone->zone_cpucap == NULL) {
+		zone->zone_cpucap = cap;
+	} else if (cap != NULL) {
+		cap_free(cap);
+	}
+
+	cap = zone->zone_cpucap;
+
+	value = SEC_TO_TICK(base_val);
+	if (value < 0)
+		value = 0;
+
+	cap->cap_burst_limit = value;
+
+	mutex_exit(&caps_lock);
+
+	return (0);
+}
+
+/*
  * The project is going away so disable its cap.
  */
 void
@@ -902,7 +1122,7 @@ cpucaps_project_set(kproject_t *kpj, rctl_qty_t cap_val)
 		if (CAP_DISABLED(cap))
 			cap_project_enable(kpj, value);
 		else
-			cap->cap_value = value;
+			cap->cap_value = cap->cap_chk_value = value;
 	} else if (CAP_ENABLED(cap)) {
 		/*
 		 * User requested to drop a cap on the project. If it is part of
@@ -910,7 +1130,7 @@ cpucaps_project_set(kproject_t *kpj, rctl_qty_t cap_val)
 		 * otherwise disable the cap.
 		 */
 		if (ZONE_IS_CAPPED(kpj->kpj_zone)) {
-			cap->cap_value = MAX_USAGE;
+			cap->cap_value = cap->cap_chk_value = MAX_USAGE;
 		} else {
 			cap_project_disable(kpj);
 		}
@@ -948,6 +1168,26 @@ cpucaps_zone_get(zone_t *zone)
 }
 
 /*
+ * Get current zone baseline.
+ */
+rctl_qty_t
+cpucaps_zone_get_base(zone_t *zone)
+{
+	return (zone->zone_cpucap != NULL ?
+	    (rctl_qty_t)(zone->zone_cpucap->cap_base / cap_tick_cost) : 0);
+}
+
+/*
+ * Get current zone maximum burst time.
+ */
+rctl_qty_t
+cpucaps_zone_get_burst_time(zone_t *zone)
+{
+	return (zone->zone_cpucap != NULL ?
+	    (rctl_qty_t)(TICK_TO_SEC(zone->zone_cpucap->cap_burst_limit)) : 0);
+}
+
+/*
  * Charge project of thread t the time thread t spent on CPU since previously
  * adjusted.
  *
@@ -1045,7 +1285,7 @@ cpucaps_charge(kthread_id_t t, caps_sc_t *csc, cpucaps_charge_t charge_type)
 
 	project_cap = kpj->kpj_cpucap;
 
-	if (project_cap->cap_usage >= project_cap->cap_value) {
+	if (project_cap->cap_usage >= project_cap->cap_chk_value) {
 		t->t_schedflag |= TS_PROJWAITQ;
 		rc = B_TRUE;
 	} else if (t->t_schedflag & TS_PROJWAITQ) {
@@ -1059,7 +1299,7 @@ cpucaps_charge(kthread_id_t t, caps_sc_t *csc, cpucaps_charge_t charge_type)
 	} else {
 		cpucap_t *zone_cap = zone->zone_cpucap;
 
-		if (zone_cap->cap_usage >= zone_cap->cap_value) {
+		if (zone_cap->cap_usage >= zone_cap->cap_chk_value) {
 			t->t_schedflag |= TS_ZONEWAITQ;
 			rc = B_TRUE;
 		} else if (t->t_schedflag & TS_ZONEWAITQ) {
@@ -1119,6 +1359,7 @@ cpucaps_enforce(kthread_t *t)
 
 /*
  * Convert internal cap statistics into values exported by cap kstat.
+ * Note that the kstat is held throughout this function but caps_lock is not.
  */
 static int
 cap_kstat_update(kstat_t *ksp, int rw)
@@ -1133,6 +1374,12 @@ cap_kstat_update(kstat_t *ksp, int rw)
 
 	capsp->cap_value.value.ui64 =
 	    ROUND_SCALE(cap->cap_value, cap_tick_cost);
+	capsp->cap_baseline.value.ui64 =
+	    ROUND_SCALE(cap->cap_base, cap_tick_cost);
+	capsp->cap_effective.value.ui64 =
+	    ROUND_SCALE(cap->cap_chk_value, cap_tick_cost);
+	capsp->cap_burst_limit.value.ui64 =
+	    ROUND_SCALE(cap->cap_burst_limit, tick_sec);
 	capsp->cap_usage.value.ui64 =
 	    ROUND_SCALE(cap->cap_usage, cap_tick_cost);
 	capsp->cap_maxusage.value.ui64 =
@@ -1140,6 +1387,10 @@ cap_kstat_update(kstat_t *ksp, int rw)
 	capsp->cap_nwait.value.ui64 = cap->cap_waitq.wq_count;
 	capsp->cap_below.value.ui64 = ROUND_SCALE(cap->cap_below, tick_sec);
 	capsp->cap_above.value.ui64 = ROUND_SCALE(cap->cap_above, tick_sec);
+	capsp->cap_above_base.value.ui64 =
+	    ROUND_SCALE(cap->cap_above_base, tick_sec);
+	capsp->cap_bursting.value.ui64 =
+	    ROUND_SCALE(cap->cap_bursting, tick_sec);
 	kstat_named_setstr(&capsp->cap_zonename, zonename);
 
 	return (0);
diff --git a/usr/src/uts/common/disp/cpupart.c b/usr/src/uts/common/disp/cpupart.c
index c260329c61..4ddc568187 100644
--- a/usr/src/uts/common/disp/cpupart.c
+++ b/usr/src/uts/common/disp/cpupart.c
@@ -20,6 +20,8 @@
  */
 /*
  * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ *
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -324,7 +326,7 @@ cpupart_move_cpu(cpu_t *cp, cpupart_t *newpp, int forced)
 	kthread_t *t;
 	int	move_threads = 1;
 	lgrp_id_t lgrpid;
-	proc_t 	*p;
+	proc_t	*p;
 	int lgrp_diff_lpl;
 	lpl_t	*cpu_lpl;
 	int	ret;
@@ -569,8 +571,8 @@ again:
 				/* Update CPU last ran on if it was this CPU */
 				if (t->t_cpu == cp && t->t_cpupart == oldpp &&
 				    t->t_bound_cpu != cp) {
-					t->t_cpu = disp_lowpri_cpu(ncp,
-					    t->t_lpl, t->t_pri, NULL);
+					t->t_cpu = disp_lowpri_cpu(ncp, t,
+					    t->t_pri);
 				}
 				t = t->t_forw;
 			} while (t != p->p_tlist);
@@ -622,8 +624,8 @@ again:
 			/* Update CPU last ran on if it was this CPU */
 			if (t->t_cpu == cp && t->t_cpupart == oldpp &&
 			    t->t_bound_cpu != cp) {
-				t->t_cpu = disp_lowpri_cpu(ncp, t->t_lpl,
-				    t->t_pri, NULL);
+				t->t_cpu = disp_lowpri_cpu(ncp, t,
+				    t->t_pri);
 			}
 
 			t = t->t_next;
@@ -883,7 +885,7 @@ cpupart_create(psetid_t *psid)
 static int
 cpupart_unbind_threads(cpupart_t *pp, boolean_t unbind_all)
 {
-	void 	*projbuf, *zonebuf;
+	void	*projbuf, *zonebuf;
 	kthread_t *t;
 	proc_t	*p;
 	int	err = 0;
diff --git a/usr/src/uts/common/disp/disp.c b/usr/src/uts/common/disp/disp.c
index 0c2c0b4993..4898a18bf2 100644
--- a/usr/src/uts/common/disp/disp.c
+++ b/usr/src/uts/common/disp/disp.c
@@ -23,6 +23,10 @@
  * Use is subject to license terms.
  */
 
+/*
+ * Copyright (c) 2018, Joyent, Inc. All rights reserved.
+ */
+
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
 /*	  All Rights Reserved  	*/
 
@@ -56,6 +60,7 @@
 #include <sys/dtrace.h>
 #include <sys/sdt.h>
 #include <sys/archsystm.h>
+#include <sys/ht.h>
 
 #include <vm/as.h>
 
@@ -105,7 +110,7 @@ static void	cpu_resched(cpu_t *cp, pri_t tpri);
 /*
  * If this is set, only interrupt threads will cause kernel preemptions.
  * This is done by changing the value of kpreemptpri.  kpreemptpri
- * will either be the max sysclass pri + 1 or the min interrupt pri.
+ * will either be the max sysclass pri or the min interrupt pri.
  */
 int	only_intr_kpreempt;
 
@@ -252,7 +257,23 @@ dispinit(void)
 				maxglobpri = cl_maxglobpri;
 		}
 	}
-	kpreemptpri = (pri_t)v.v_maxsyspri + 1;
+
+	/*
+	 * Historically, kpreemptpri was set to v_maxsyspri + 1 -- which is
+	 * to say, maxclsyspri + 1.  However, over time, the system has used
+	 * more and more asynchronous kernel threads, with an increasing number
+	 * of these doing work on direct behalf of higher-level software (e.g.,
+	 * network processing).  This has led to potential priority inversions:
+	 * threads doing low-priority lengthy kernel work can effectively
+	 * delay kernel-level processing of higher-priority data. To minimize
+	 * such inversions, we set kpreemptpri to be v_maxsyspri; anything in
+	 * the kernel that runs at maxclsyspri will therefore induce kernel
+	 * preemption, and this priority should be used if/when an asynchronous
+	 * thread (or, as is often the case, task queue) is performing a task
+	 * on behalf of higher-level software (or any task that is otherwise
+	 * latency-sensitve).
+	 */
+	kpreemptpri = (pri_t)v.v_maxsyspri;
 	if (kpqpri == KPQPRI)
 		kpqpri = kpreemptpri;
 
@@ -1115,15 +1136,13 @@ swtch_to(kthread_t *next)
 	 */
 }
 
-#define	CPU_IDLING(pri)	((pri) == -1)
-
 static void
 cpu_resched(cpu_t *cp, pri_t tpri)
 {
 	int	call_poke_cpu = 0;
 	pri_t   cpupri = cp->cpu_dispatch_pri;
 
-	if (!CPU_IDLING(cpupri) && (cpupri < tpri)) {
+	if (cpupri != CPU_IDLE_PRI && cpupri < tpri) {
 		TRACE_2(TR_FAC_DISP, TR_CPU_RESCHED,
 		    "CPU_RESCHED:Tpri %d Cpupri %d", tpri, cpupri);
 		if (tpri >= upreemptpri && cp->cpu_runrun == 0) {
@@ -1219,17 +1238,17 @@ setbackdq(kthread_t *tp)
 		/*
 		 * We'll generally let this thread continue to run where
 		 * it last ran...but will consider migration if:
-		 * - We thread probably doesn't have much cache warmth.
+		 * - The thread probably doesn't have much cache warmth.
+		 * - HT exclusion would prefer us to run elsewhere
 		 * - The CPU where it last ran is the target of an offline
 		 *   request.
-		 * - The thread last ran outside it's home lgroup.
+		 * - The thread last ran outside its home lgroup.
 		 */
 		if ((!THREAD_HAS_CACHE_WARMTH(tp)) ||
-		    (tp->t_cpu == cpu_inmotion)) {
-			cp = disp_lowpri_cpu(tp->t_cpu, tp->t_lpl, tpri, NULL);
-		} else if (!LGRP_CONTAINS_CPU(tp->t_lpl->lpl_lgrp, tp->t_cpu)) {
-			cp = disp_lowpri_cpu(tp->t_cpu, tp->t_lpl, tpri,
-			    self ? tp->t_cpu : NULL);
+		    !ht_should_run(tp, tp->t_cpu) ||
+		    (tp->t_cpu == cpu_inmotion) ||
+		    !LGRP_CONTAINS_CPU(tp->t_lpl->lpl_lgrp, tp->t_cpu)) {
+			cp = disp_lowpri_cpu(tp->t_cpu, tp, tpri);
 		} else {
 			cp = tp->t_cpu;
 		}
@@ -1258,7 +1277,8 @@ setbackdq(kthread_t *tp)
 					newcp = cp->cpu_next_part;
 				}
 
-				if (RUNQ_LEN(newcp, tpri) < qlen) {
+				if (ht_should_run(tp, newcp) &&
+				    RUNQ_LEN(newcp, tpri) < qlen) {
 					DTRACE_PROBE3(runq__balance,
 					    kthread_t *, tp,
 					    cpu_t *, cp, cpu_t *, newcp);
@@ -1269,8 +1289,8 @@ setbackdq(kthread_t *tp)
 			/*
 			 * Migrate to a cpu in the new partition.
 			 */
-			cp = disp_lowpri_cpu(tp->t_cpupart->cp_cpulist,
-			    tp->t_lpl, tp->t_pri, NULL);
+			cp = disp_lowpri_cpu(tp->t_cpupart->cp_cpulist, tp,
+			    tp->t_pri);
 		}
 		ASSERT((cp->cpu_flags & CPU_QUIESCED) == 0);
 	} else {
@@ -1407,7 +1427,7 @@ setfrontdq(kthread_t *tp)
 			/*
 			 * We'll generally let this thread continue to run
 			 * where it last ran, but will consider migration if:
-			 * - The thread last ran outside it's home lgroup.
+			 * - The thread last ran outside its home lgroup.
 			 * - The CPU where it last ran is the target of an
 			 *   offline request (a thread_nomigrate() on the in
 			 *   motion CPU relies on this when forcing a preempt).
@@ -1415,21 +1435,18 @@ setfrontdq(kthread_t *tp)
 			 *   it last ran, and it is considered not likely to
 			 *   have significant cache warmth.
 			 */
-			if ((!LGRP_CONTAINS_CPU(tp->t_lpl->lpl_lgrp, cp)) ||
-			    (cp == cpu_inmotion)) {
-				cp = disp_lowpri_cpu(tp->t_cpu, tp->t_lpl, tpri,
-				    (tp == curthread) ? cp : NULL);
-			} else if ((tpri < cp->cpu_disp->disp_maxrunpri) &&
-			    (!THREAD_HAS_CACHE_WARMTH(tp))) {
-				cp = disp_lowpri_cpu(tp->t_cpu, tp->t_lpl, tpri,
-				    NULL);
+			if (!LGRP_CONTAINS_CPU(tp->t_lpl->lpl_lgrp, cp) ||
+			    cp == cpu_inmotion ||
+			    (tpri < cp->cpu_disp->disp_maxrunpri &&
+			    !THREAD_HAS_CACHE_WARMTH(tp))) {
+				cp = disp_lowpri_cpu(tp->t_cpu, tp, tpri);
 			}
 		} else {
 			/*
 			 * Migrate to a cpu in the new partition.
 			 */
 			cp = disp_lowpri_cpu(tp->t_cpupart->cp_cpulist,
-			    tp->t_lpl, tp->t_pri, NULL);
+			    tp, tp->t_pri);
 		}
 		ASSERT((cp->cpu_flags & CPU_QUIESCED) == 0);
 	} else {
@@ -1580,7 +1597,7 @@ setkpdq(kthread_t *tp, int borf)
 		/* migrate to a cpu in the new partition */
 		cp = tp->t_cpupart->cp_cpulist;
 	}
-	cp = disp_lowpri_cpu(cp, tp->t_lpl, tp->t_pri, NULL);
+	cp = disp_lowpri_cpu(cp, tp, tp->t_pri);
 	disp_lock_enter_high(&cp->cpu_disp->disp_lock);
 	ASSERT((cp->cpu_flags & CPU_QUIESCED) == 0);
 
@@ -2258,7 +2275,7 @@ disp_getbest(disp_t *dp)
 		 * placed earlier.
 		 */
 		if (tcp == NULL ||
-		    pri >= minclsyspri ||
+		    (pri >= minclsyspri && tp->t_procp == &p0) ||
 		    tp->t_cpu != tcp)
 			break;
 
@@ -2553,80 +2570,85 @@ disp_cpu_inactive(cpu_t *cp)
 }
 
 /*
- * disp_lowpri_cpu - find CPU running the lowest priority thread.
- *	The hint passed in is used as a starting point so we don't favor
- *	CPU 0 or any other CPU.  The caller should pass in the most recently
- *	used CPU for the thread.
+ * Return a score rating this CPU for running this thread: lower is better.
+ *
+ * If curthread is looking for a new CPU, then we ignore cpu_dispatch_pri for
+ * curcpu (as that's our own priority).
+ *
+ * If a cpu is the target of an offline request, then try to avoid it.
  *
- *	The lgroup and priority are used to determine the best CPU to run on
- *	in a NUMA machine.  The lgroup specifies which CPUs are closest while
- *	the thread priority will indicate whether the thread will actually run
- *	there.  To pick the best CPU, the CPUs inside and outside of the given
- *	lgroup which are running the lowest priority threads are found.  The
- *	remote CPU is chosen only if the thread will not run locally on a CPU
- *	within the lgroup, but will run on the remote CPU. If the thread
- *	cannot immediately run on any CPU, the best local CPU will be chosen.
+ * Otherwise we'll use double the effective dispatcher priority for the CPU.
+ *
+ * We do this so ht_adjust_cpu_score() can increment the score if needed,
+ * without ending up over-riding a dispatcher priority.
+ */
+static pri_t
+cpu_score(cpu_t *cp, kthread_t *tp)
+{
+	pri_t score;
+
+	if (tp == curthread && cp == curthread->t_cpu)
+		score = 2 * CPU_IDLE_PRI;
+	else if (cp == cpu_inmotion)
+		score = SHRT_MAX;
+	else
+		score = 2 * cp->cpu_dispatch_pri;
+
+	if (2 * cp->cpu_disp->disp_maxrunpri > score)
+		score = 2 * cp->cpu_disp->disp_maxrunpri;
+	if (2 * cp->cpu_chosen_level > score)
+		score = 2 * cp->cpu_chosen_level;
+
+	return (ht_adjust_cpu_score(tp, cp, score));
+}
+
+/*
+ * disp_lowpri_cpu - find a suitable CPU to run the given thread.
  *
- *	The lpl specified also identifies the cpu partition from which
- *	disp_lowpri_cpu should select a CPU.
+ * We are looking for a CPU with an effective dispatch priority lower than the
+ * thread's, so that the thread will run immediately rather than be enqueued.
+ * For NUMA locality, we prefer "home" CPUs within the thread's ->t_lpl group.
+ * If we don't find an available CPU there, we will expand our search to include
+ * wider locality levels. (Note these groups are already divided by CPU
+ * partition.)
  *
- *	curcpu is used to indicate that disp_lowpri_cpu is being called on
- *      behalf of the current thread. (curthread is looking for a new cpu)
- *      In this case, cpu_dispatch_pri for this thread's cpu should be
- *      ignored.
+ * If the thread cannot immediately run on *any* CPU, we'll enqueue ourselves on
+ * the best home CPU we found.
  *
- *      If a cpu is the target of an offline request then try to avoid it.
+ * The hint passed in is used as a starting point so we don't favor CPU 0 or any
+ * other CPU.  The caller should pass in the most recently used CPU for the
+ * thread; it's of course possible that this CPU isn't in the home lgroup.
  *
- *	This function must be called at either high SPL, or with preemption
- *	disabled, so that the "hint" CPU cannot be removed from the online
- *	CPU list while we are traversing it.
+ * This function must be called at either high SPL, or with preemption disabled,
+ * so that the "hint" CPU cannot be removed from the online CPU list while we
+ * are traversing it.
  */
 cpu_t *
-disp_lowpri_cpu(cpu_t *hint, lpl_t *lpl, pri_t tpri, cpu_t *curcpu)
+disp_lowpri_cpu(cpu_t *hint, kthread_t *tp, pri_t tpri)
 {
 	cpu_t	*bestcpu;
 	cpu_t	*besthomecpu;
 	cpu_t   *cp, *cpstart;
 
-	pri_t   bestpri;
-	pri_t   cpupri;
-
 	klgrpset_t	done;
-	klgrpset_t	cur_set;
 
 	lpl_t		*lpl_iter, *lpl_leaf;
-	int		i;
 
-	/*
-	 * Scan for a CPU currently running the lowest priority thread.
-	 * Cannot get cpu_lock here because it is adaptive.
-	 * We do not require lock on CPU list.
-	 */
 	ASSERT(hint != NULL);
-	ASSERT(lpl != NULL);
-	ASSERT(lpl->lpl_ncpu > 0);
+	ASSERT(tp->t_lpl->lpl_ncpu > 0);
 
-	/*
-	 * First examine local CPUs. Note that it's possible the hint CPU
-	 * passed in in remote to the specified home lgroup. If our priority
-	 * isn't sufficient enough such that we can run immediately at home,
-	 * then examine CPUs remote to our home lgroup.
-	 * We would like to give preference to CPUs closest to "home".
-	 * If we can't find a CPU where we'll run at a given level
-	 * of locality, we expand our search to include the next level.
-	 */
 	bestcpu = besthomecpu = NULL;
 	klgrpset_clear(done);
-	/* start with lpl we were passed */
 
-	lpl_iter = lpl;
+	lpl_iter = tp->t_lpl;
 
 	do {
+		pri_t best = SHRT_MAX;
+		klgrpset_t cur_set;
 
-		bestpri = SHRT_MAX;
 		klgrpset_clear(cur_set);
 
-		for (i = 0; i < lpl_iter->lpl_nrset; i++) {
+		for (int i = 0; i < lpl_iter->lpl_nrset; i++) {
 			lpl_leaf = lpl_iter->lpl_rset[i];
 			if (klgrpset_ismember(done, lpl_leaf->lpl_lgrpid))
 				continue;
@@ -2639,34 +2661,25 @@ disp_lowpri_cpu(cpu_t *hint, lpl_t *lpl, pri_t tpri, cpu_t *curcpu)
 				cp = cpstart = lpl_leaf->lpl_cpus;
 
 			do {
-				if (cp == curcpu)
-					cpupri = -1;
-				else if (cp == cpu_inmotion)
-					cpupri = SHRT_MAX;
-				else
-					cpupri = cp->cpu_dispatch_pri;
-				if (cp->cpu_disp->disp_maxrunpri > cpupri)
-					cpupri = cp->cpu_disp->disp_maxrunpri;
-				if (cp->cpu_chosen_level > cpupri)
-					cpupri = cp->cpu_chosen_level;
-				if (cpupri < bestpri) {
-					if (CPU_IDLING(cpupri)) {
-						ASSERT((cp->cpu_flags &
-						    CPU_QUIESCED) == 0);
-						return (cp);
-					}
+				pri_t score = cpu_score(cp, tp);
+
+				if (score < best) {
+					best = score;
 					bestcpu = cp;
-					bestpri = cpupri;
+
+					/* An idle CPU: we're done. */
+					if (score / 2 == CPU_IDLE_PRI)
+						goto out;
 				}
 			} while ((cp = cp->cpu_next_lpl) != cpstart);
 		}
 
-		if (bestcpu && (tpri > bestpri)) {
-			ASSERT((bestcpu->cpu_flags & CPU_QUIESCED) == 0);
-			return (bestcpu);
-		}
+		if (bestcpu != NULL && tpri > (best / 2))
+			goto out;
+
 		if (besthomecpu == NULL)
 			besthomecpu = bestcpu;
+
 		/*
 		 * Add the lgrps we just considered to the "done" set
 		 */
@@ -2678,8 +2691,11 @@ disp_lowpri_cpu(cpu_t *hint, lpl_t *lpl, pri_t tpri, cpu_t *curcpu)
 	 * The specified priority isn't high enough to run immediately
 	 * anywhere, so just return the best CPU from the home lgroup.
 	 */
-	ASSERT((besthomecpu->cpu_flags & CPU_QUIESCED) == 0);
-	return (besthomecpu);
+	bestcpu = besthomecpu;
+
+out:
+	ASSERT((bestcpu->cpu_flags & CPU_QUIESCED) == 0);
+	return (bestcpu);
 }
 
 /*
@@ -2699,3 +2715,19 @@ static void
 generic_enq_thread(cpu_t *cpu, int bound)
 {
 }
+
+cpu_t *
+disp_choose_best_cpu(void)
+{
+	kthread_t *t = curthread;
+	cpu_t *curcpu = CPU;
+
+	ASSERT(t->t_preempt > 0);
+	ASSERT(t->t_state == TS_ONPROC);
+	ASSERT(t->t_schedflag & TS_VCPU);
+
+	if (ht_should_run(t, curcpu))
+		return (curcpu);
+
+	return (disp_lowpri_cpu(curcpu, t, t->t_pri));
+}
diff --git a/usr/src/uts/common/disp/fx.c b/usr/src/uts/common/disp/fx.c
index ab5ba278a0..8260680a07 100644
--- a/usr/src/uts/common/disp/fx.c
+++ b/usr/src/uts/common/disp/fx.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -71,16 +71,6 @@ static struct modlinkage modlinkage = {
 };
 
 
-/*
- * control flags (kparms->fx_cflags).
- */
-#define	FX_DOUPRILIM	0x01    /* change user priority limit */
-#define	FX_DOUPRI	0x02    /* change user priority */
-#define	FX_DOTQ		0x04    /* change FX time quantum */
-
-
-#define	FXMAXUPRI 60		/* maximum user priority setting */
-
 #define	FX_MAX_UNPRIV_PRI	0	/* maximum unpriviledge priority */
 
 /*
diff --git a/usr/src/uts/common/disp/priocntl.c b/usr/src/uts/common/disp/priocntl.c
index 5412df83f5..60e870ba28 100644
--- a/usr/src/uts/common/disp/priocntl.c
+++ b/usr/src/uts/common/disp/priocntl.c
@@ -114,7 +114,7 @@ copyin_vaparms32(caddr_t arg, pc_vaparms_t *vap, uio_seg_t seg)
 
 #endif
 
-static int donice(procset_t *, pcnice_t *);
+int donice(procset_t *, pcnice_t *);
 static int doprio(procset_t *, pcprio_t *);
 static int proccmp(proc_t *, struct pcmpargs *);
 static int setparms(proc_t *, struct stprmargs *);
@@ -991,7 +991,7 @@ setprocnice(proc_t *pp, pcnice_t *pcnice)
 /*
  * Update the nice value of the specified LWP or set of processes.
  */
-static int
+int
 donice(procset_t *procset, pcnice_t *pcnice)
 {
 	int err_proc = 0;
diff --git a/usr/src/uts/common/disp/rt.c b/usr/src/uts/common/disp/rt.c
index f87f8c56ce..115e42ccb8 100644
--- a/usr/src/uts/common/disp/rt.c
+++ b/usr/src/uts/common/disp/rt.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2013 Joyent, Inc.  All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -103,13 +103,6 @@ _info(struct modinfo *modinfop)
 pri_t rt_maxpri = RTMAXPRI;	/* maximum real-time priority */
 rtdpent_t *rt_dptbl;	  /* real-time dispatcher parameter table */
 
-/*
- * control flags (kparms->rt_cflags).
- */
-#define	RT_DOPRI	0x01	/* change priority */
-#define	RT_DOTQ		0x02	/* change RT time quantum */
-#define	RT_DOSIG	0x04	/* change RT time quantum signal */
-
 static int	rt_admin(caddr_t, cred_t *);
 static int	rt_enterclass(kthread_t *, id_t, void *, cred_t *, void *);
 static int	rt_fork(kthread_t *, kthread_t *, void *);
diff --git a/usr/src/uts/common/disp/rt_dptbl.c b/usr/src/uts/common/disp/rt_dptbl.c
index 768b499ef2..cc88ed72fc 100644
--- a/usr/src/uts/common/disp/rt_dptbl.c
+++ b/usr/src/uts/common/disp/rt_dptbl.c
@@ -28,8 +28,6 @@
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989, 1990 AT&T	*/
 /*	  All Rights Reserved  	*/
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/proc.h>
 #include <sys/priocntl.h>
 #include <sys/class.h>
@@ -70,8 +68,6 @@ _info(struct modinfo *modinfop)
 	return (mod_info(&modlinkage, modinfop));
 }
 
-#define	RTGPPRIO0	100	/* Global priority for RT priority 0 */
-
 rtdpent_t	config_rt_dptbl[] = {
 
 /*   	prilevel    Time quantum */
diff --git a/usr/src/uts/common/disp/thread.c b/usr/src/uts/common/disp/thread.c
index f2685af534..c923ba5d1a 100644
--- a/usr/src/uts/common/disp/thread.c
+++ b/usr/src/uts/common/disp/thread.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -74,6 +74,11 @@
 #include <sys/waitq.h>
 #include <sys/cpucaps.h>
 #include <sys/kiconv.h>
+#include <sys/ht.h>
+
+#ifndef	STACK_GROWTH_DOWN
+#error Stacks do not grow downward; 3b2 zombie attack detected!
+#endif
 
 struct kmem_cache *thread_cache;	/* cache of free threads */
 struct kmem_cache *lwp_cache;		/* cache of free lwps */
@@ -372,7 +377,7 @@ thread_create(
 		if (stksize <= sizeof (kthread_t) + PTR24_ALIGN)
 			cmn_err(CE_PANIC, "thread_create: proposed stack size"
 			    " too small to hold thread.");
-#ifdef STACK_GROWTH_DOWN
+
 		stksize -= SA(sizeof (kthread_t) + PTR24_ALIGN - 1);
 		stksize &= -PTR24_ALIGN;	/* make thread aligned */
 		t = (kthread_t *)(stk + stksize);
@@ -381,13 +386,6 @@ thread_create(
 			audit_thread_create(t);
 		t->t_stk = stk + stksize;
 		t->t_stkbase = stk;
-#else	/* stack grows to larger addresses */
-		stksize -= SA(sizeof (kthread_t));
-		t = (kthread_t *)(stk);
-		bzero(t, sizeof (kthread_t));
-		t->t_stk = stk + sizeof (kthread_t);
-		t->t_stkbase = stk + stksize + sizeof (kthread_t);
-#endif	/* STACK_GROWTH_DOWN */
 		t->t_flag |= T_TALLOCSTK;
 		t->t_swap = stk;
 	} else {
@@ -400,13 +398,8 @@ thread_create(
 		 * Initialize t_stk to the kernel stack pointer to use
 		 * upon entry to the kernel
 		 */
-#ifdef STACK_GROWTH_DOWN
 		t->t_stk = stk + stksize;
 		t->t_stkbase = stk;
-#else
-		t->t_stk = stk;			/* 3b2-like */
-		t->t_stkbase = stk + stksize;
-#endif /* STACK_GROWTH_DOWN */
 	}
 
 	if (kmem_stackinfo != 0) {
@@ -515,8 +508,8 @@ thread_create(
 	if (CPU->cpu_part == &cp_default)
 		t->t_cpu = CPU;
 	else
-		t->t_cpu = disp_lowpri_cpu(cp_default.cp_cpulist, t->t_lpl,
-		    t->t_pri, NULL);
+		t->t_cpu = disp_lowpri_cpu(cp_default.cp_cpulist, t,
+		    t->t_pri);
 
 	t->t_disp_queue = t->t_cpu->cpu_disp;
 	kpreempt_enable();
@@ -589,6 +582,9 @@ thread_exit(void)
 	if ((t->t_proc_flag & TP_ZTHREAD) != 0)
 		cmn_err(CE_PANIC, "thread_exit: zthread_exit() not called");
 
+	if ((t->t_flag & T_SPLITSTK) != 0)
+		cmn_err(CE_PANIC, "thread_exit: called when stack is split");
+
 	tsd_exit();		/* Clean up this thread's TSD */
 
 	kcpc_passivate();	/* clean up performance counter state */
@@ -791,6 +787,11 @@ thread_free(kthread_t *t)
 	nthread--;
 	mutex_exit(&pidlock);
 
+	if (t->t_name != NULL) {
+		kmem_free(t->t_name, THREAD_NAME_MAX);
+		t->t_name = NULL;
+	}
+
 	/*
 	 * Free thread, lwp and stack.  This needs to be done carefully, since
 	 * if T_TALLOCSTK is set, the thread is part of the stack.
@@ -1049,8 +1050,44 @@ installctx(
 	ctx->exit_op = exit;
 	ctx->free_op = free;
 	ctx->arg = arg;
-	ctx->next = t->t_ctx;
+	ctx->save_ts = 0;
+	ctx->restore_ts = 0;
+
+	/*
+	 * Keep ctxops in a doubly-linked list to allow traversal in both
+	 * directions.  Using only the newest-to-oldest ordering was adequate
+	 * previously, but reversing the order for restore_op actions is
+	 * necessary if later-added ctxops depends on earlier ones.
+	 *
+	 * One example of such a dependency:  Hypervisor software handling the
+	 * guest FPU expects that it save FPU state prior to host FPU handling
+	 * and consequently handle the guest logic _after_ the host FPU has
+	 * been restored.
+	 *
+	 * The t_ctx member points to the most recently added ctxop or is NULL
+	 * if no ctxops are associated with the thread.  The 'next' pointers
+	 * form a loop of the ctxops in newest-to-oldest order.  The 'prev'
+	 * pointers form a loop in the reverse direction, where t_ctx->prev is
+	 * the oldest entry associated with the thread.
+	 *
+	 * The protection of kpreempt_disable is required to safely perform the
+	 * list insertion, since there are inconsistent states between some of
+	 * the pointer assignments.
+	 */
+	kpreempt_disable();
+	if (t->t_ctx == NULL) {
+		ctx->next = ctx;
+		ctx->prev = ctx;
+	} else {
+		struct ctxop *head = t->t_ctx, *tail = t->t_ctx->prev;
+
+		ctx->next = head;
+		ctx->prev = tail;
+		head->prev = ctx;
+		tail->next = ctx;
+	}
 	t->t_ctx = ctx;
+	kpreempt_enable();
 }
 
 /*
@@ -1067,7 +1104,7 @@ removectx(
 	void	(*exit)(void *),
 	void	(*free)(void *, int))
 {
-	struct ctxop *ctx, *prev_ctx;
+	struct ctxop *ctx, *head;
 
 	/*
 	 * The incoming kthread_t (which is the thread for which the
@@ -1092,17 +1129,31 @@ removectx(
 	 * and the target thread from racing with each other during lwp exit.
 	 */
 	mutex_enter(&t->t_ctx_lock);
-	prev_ctx = NULL;
 	kpreempt_disable();
-	for (ctx = t->t_ctx; ctx != NULL; ctx = ctx->next) {
+
+	if (t->t_ctx == NULL) {
+		mutex_exit(&t->t_ctx_lock);
+		kpreempt_enable();
+		return (0);
+	}
+
+	ctx = head = t->t_ctx;
+	do {
 		if (ctx->save_op == save && ctx->restore_op == restore &&
 		    ctx->fork_op == fork && ctx->lwp_create_op == lwp_create &&
 		    ctx->exit_op == exit && ctx->free_op == free &&
 		    ctx->arg == arg) {
-			if (prev_ctx)
-				prev_ctx->next = ctx->next;
-			else
+			ctx->prev->next = ctx->next;
+			ctx->next->prev = ctx->prev;
+			if (ctx->next == ctx) {
+				/* last remaining item */
+				t->t_ctx = NULL;
+			} else if (ctx == t->t_ctx) {
+				/* fix up head of list */
 				t->t_ctx = ctx->next;
+			}
+			ctx->next = ctx->prev = NULL;
+
 			mutex_exit(&t->t_ctx_lock);
 			if (ctx->free_op != NULL)
 				(ctx->free_op)(ctx->arg, 0);
@@ -1110,44 +1161,70 @@ removectx(
 			kpreempt_enable();
 			return (1);
 		}
-		prev_ctx = ctx;
-	}
+
+		ctx = ctx->next;
+	} while (ctx != head);
+
 	mutex_exit(&t->t_ctx_lock);
 	kpreempt_enable();
-
 	return (0);
 }
 
 void
 savectx(kthread_t *t)
 {
-	struct ctxop *ctx;
-
 	ASSERT(t == curthread);
-	for (ctx = t->t_ctx; ctx != 0; ctx = ctx->next)
-		if (ctx->save_op != NULL)
-			(ctx->save_op)(ctx->arg);
+
+	if (t->t_ctx != NULL) {
+		struct ctxop *ctx, *head;
+
+		/* Forward traversal */
+		ctx = head = t->t_ctx;
+		do {
+			if (ctx->save_op != NULL) {
+				ctx->save_ts = gethrtime_unscaled();
+				(ctx->save_op)(ctx->arg);
+			}
+			ctx = ctx->next;
+		} while (ctx != head);
+	}
 }
 
 void
 restorectx(kthread_t *t)
 {
-	struct ctxop *ctx;
-
 	ASSERT(t == curthread);
-	for (ctx = t->t_ctx; ctx != 0; ctx = ctx->next)
-		if (ctx->restore_op != NULL)
-			(ctx->restore_op)(ctx->arg);
+
+	if (t->t_ctx != NULL) {
+		struct ctxop *ctx, *tail;
+
+		/* Backward traversal (starting at the tail) */
+		ctx = tail = t->t_ctx->prev;
+		do {
+			if (ctx->restore_op != NULL) {
+				ctx->restore_ts = gethrtime_unscaled();
+				(ctx->restore_op)(ctx->arg);
+			}
+			ctx = ctx->prev;
+		} while (ctx != tail);
+	}
 }
 
 void
 forkctx(kthread_t *t, kthread_t *ct)
 {
-	struct ctxop *ctx;
-
-	for (ctx = t->t_ctx; ctx != NULL; ctx = ctx->next)
-		if (ctx->fork_op != NULL)
-			(ctx->fork_op)(t, ct);
+	if (t->t_ctx != NULL) {
+		struct ctxop *ctx, *head;
+
+		/* Forward traversal */
+		ctx = head = t->t_ctx;
+		do {
+			if (ctx->fork_op != NULL) {
+				(ctx->fork_op)(t, ct);
+			}
+			ctx = ctx->next;
+		} while (ctx != head);
+	}
 }
 
 /*
@@ -1158,11 +1235,18 @@ forkctx(kthread_t *t, kthread_t *ct)
 void
 lwp_createctx(kthread_t *t, kthread_t *ct)
 {
-	struct ctxop *ctx;
-
-	for (ctx = t->t_ctx; ctx != NULL; ctx = ctx->next)
-		if (ctx->lwp_create_op != NULL)
-			(ctx->lwp_create_op)(t, ct);
+	if (t->t_ctx != NULL) {
+		struct ctxop *ctx, *head;
+
+		/* Forward traversal */
+		ctx = head = t->t_ctx;
+		do {
+			if (ctx->lwp_create_op != NULL) {
+				(ctx->lwp_create_op)(t, ct);
+			}
+			ctx = ctx->next;
+		} while (ctx != head);
+	}
 }
 
 /*
@@ -1175,11 +1259,18 @@ lwp_createctx(kthread_t *t, kthread_t *ct)
 void
 exitctx(kthread_t *t)
 {
-	struct ctxop *ctx;
-
-	for (ctx = t->t_ctx; ctx != NULL; ctx = ctx->next)
-		if (ctx->exit_op != NULL)
-			(ctx->exit_op)(t);
+	if (t->t_ctx != NULL) {
+		struct ctxop *ctx, *head;
+
+		/* Forward traversal */
+		ctx = head = t->t_ctx;
+		do {
+			if (ctx->exit_op != NULL) {
+				(ctx->exit_op)(t);
+			}
+			ctx = ctx->next;
+		} while (ctx != head);
+	}
 }
 
 /*
@@ -1189,14 +1280,21 @@ exitctx(kthread_t *t)
 void
 freectx(kthread_t *t, int isexec)
 {
-	struct ctxop *ctx;
-
 	kpreempt_disable();
-	while ((ctx = t->t_ctx) != NULL) {
-		t->t_ctx = ctx->next;
-		if (ctx->free_op != NULL)
-			(ctx->free_op)(ctx->arg, isexec);
-		kmem_free(ctx, sizeof (struct ctxop));
+	if (t->t_ctx != NULL) {
+		struct ctxop *ctx, *head;
+
+		ctx = head = t->t_ctx;
+		t->t_ctx = NULL;
+		do {
+			struct ctxop *next = ctx->next;
+
+			if (ctx->free_op != NULL) {
+				(ctx->free_op)(ctx->arg, isexec);
+			}
+			kmem_free(ctx, sizeof (struct ctxop));
+			ctx = next;
+		} while (ctx != head);
 	}
 	kpreempt_enable();
 }
@@ -1211,17 +1309,22 @@ freectx(kthread_t *t, int isexec)
 void
 freectx_ctx(struct ctxop *ctx)
 {
-	struct ctxop *nctx;
+	struct ctxop *head = ctx;
 
 	ASSERT(ctx != NULL);
 
 	kpreempt_disable();
+
+	head = ctx;
 	do {
-		nctx = ctx->next;
-		if (ctx->free_op != NULL)
+		struct ctxop *next = ctx->next;
+
+		if (ctx->free_op != NULL) {
 			(ctx->free_op)(ctx->arg, 0);
+		}
 		kmem_free(ctx, sizeof (struct ctxop));
-	} while ((ctx = nctx) != NULL);
+		ctx = next;
+	} while (ctx != head);
 	kpreempt_enable();
 }
 
@@ -1320,6 +1423,8 @@ thread_unpin()
 	itp = t->t_intr;		/* interrupted thread */
 	t->t_intr = NULL;		/* clear interrupt ptr */
 
+	ht_end_intr();
+
 	/*
 	 * Get state from interrupt thread for the one
 	 * it interrupted.
@@ -1883,6 +1988,103 @@ thread_change_pri(kthread_t *t, pri_t disp_pri, int front)
 	return (on_rq);
 }
 
+
+/*
+ * There are occasions in the kernel when we need much more stack than we
+ * allocate by default, but we do not wish to have that work done
+ * asynchronously by another thread.  To accommodate these scenarios, we allow
+ * for a split stack (also known as a "segmented stack") whereby a new stack
+ * is dynamically allocated and the current thread jumps onto it for purposes
+ * of executing the specified function.  After the specified function returns,
+ * the stack is deallocated and control is returned to the caller.  This
+ * functionality is implemented by thread_splitstack(), below; there are a few
+ * constraints on its use:
+ *
+ * - The caller must be in a context where it is safe to block for memory.
+ * - The caller cannot be in a t_onfault context
+ * - The called function must not call thread_exit() while on the split stack
+ *
+ * The code will explicitly panic if these constraints are violated.  Notably,
+ * however, thread_splitstack() _can_ be called on a split stack -- there
+ * is no limit to the level that split stacks can nest.
+ *
+ * When the stack is split, it is constructed such that stack backtraces
+ * from kernel debuggers continue to function -- though note that DTrace's
+ * stack() action and stackdepth function will only show the stack up to and
+ * including thread_splitstack_run(); DTrace explicitly bounds itself to
+ * pointers that exist within the current declared stack as a safety
+ * mechanism.
+ */
+void
+thread_splitstack(void (*func)(void *), void *arg, size_t stksize)
+{
+	kthread_t *t = curthread;
+	caddr_t ostk, ostkbase, stk;
+	ushort_t otflag;
+
+	if (t->t_onfault != NULL)
+		panic("thread_splitstack: called with non-NULL t_onfault");
+
+	ostk = t->t_stk;
+	ostkbase = t->t_stkbase;
+	otflag = t->t_flag;
+
+	stksize = roundup(stksize, PAGESIZE);
+
+	if (stksize < default_stksize)
+		stksize = default_stksize;
+
+	if (stksize == default_stksize) {
+		stk = (caddr_t)segkp_cache_get(segkp_thread);
+	} else {
+		stksize = roundup(stksize, PAGESIZE);
+		stk = (caddr_t)segkp_get(segkp, stksize,
+		    (KPD_HASREDZONE | KPD_NO_ANON | KPD_LOCKED));
+	}
+
+	/*
+	 * We're going to lock ourselves before we set T_SPLITSTK to assure
+	 * that we're not swapped out in the meantime.  (Note that we don't
+	 * bother to set t_swap, as we're not going to be swapped out.)
+	 */
+	thread_lock(t);
+
+	if (!(otflag & T_SPLITSTK))
+		t->t_flag |= T_SPLITSTK;
+
+	t->t_stk = stk + stksize;
+	t->t_stkbase = stk;
+
+	thread_unlock(t);
+
+	/*
+	 * Now actually run on the new (split) stack...
+	 */
+	thread_splitstack_run(t->t_stk, func, arg);
+
+	/*
+	 * We're back onto our own stack; lock ourselves and restore our
+	 * pre-split state.
+	 */
+	thread_lock(t);
+
+	t->t_stk = ostk;
+	t->t_stkbase = ostkbase;
+
+	if (!(otflag & T_SPLITSTK))
+		t->t_flag &= ~T_SPLITSTK;
+
+	thread_unlock(t);
+
+	/*
+	 * Now that we are entirely back on our own stack, call back into
+	 * the platform layer to perform any platform-specific cleanup.
+	 */
+	thread_splitstack_cleanup();
+
+	segkp_release(segkp, stk);
+}
+
 /*
  * Tunable kmem_stackinfo is set, fill the kernel thread stack with a
  * specific pattern.
@@ -2127,3 +2329,49 @@ stkinfo_percent(caddr_t t_stk, caddr_t t_stkbase, caddr_t sp)
 	}
 	return (percent);
 }
+
+/*
+ * NOTE: This will silently truncate a name > THREAD_NAME_MAX - 1 characters
+ * long.  It is expected that callers (acting on behalf of userland clients)
+ * will perform any required checks to return the correct error semantics.
+ * It is also expected callers on behalf of userland clients have done
+ * any necessary permission checks.
+ */
+void
+thread_setname(kthread_t *t, const char *name)
+{
+	char *buf = NULL;
+
+	/*
+	 * We optimistically assume that a thread's name will only be set
+	 * once and so allocate memory in preparation of setting t_name.
+	 * If it turns out a name has already been set, we just discard (free)
+	 * the buffer we just allocated and reuse the current buffer
+	 * (as all should be THREAD_NAME_MAX large).
+	 *
+	 * Such an arrangement means over the lifetime of a kthread_t, t_name
+	 * is either NULL or has one value (the address of the buffer holding
+	 * the current thread name).   The assumption is that most kthread_t
+	 * instances will not have a name assigned, so dynamically allocating
+	 * the memory should minimize the footprint of this feature, but by
+	 * having the buffer persist for the life of the thread, it simplifies
+	 * usage in highly constrained situations (e.g. dtrace).
+	 */
+	if (name != NULL && name[0] != '\0') {
+		buf = kmem_zalloc(THREAD_NAME_MAX, KM_SLEEP);
+		(void) strlcpy(buf, name, THREAD_NAME_MAX);
+	}
+
+	mutex_enter(&ttoproc(t)->p_lock);
+	if (t->t_name == NULL) {
+		t->t_name = buf;
+	} else {
+		if (buf != NULL) {
+			(void) strlcpy(t->t_name, name, THREAD_NAME_MAX);
+			kmem_free(buf, THREAD_NAME_MAX);
+		} else {
+			bzero(t->t_name, THREAD_NAME_MAX);
+		}
+	}
+	mutex_exit(&ttoproc(t)->p_lock);
+}
diff --git a/usr/src/uts/common/disp/thread_intr.c b/usr/src/uts/common/disp/thread_intr.c
index 67ccc6922f..c840bdf31a 100644
--- a/usr/src/uts/common/disp/thread_intr.c
+++ b/usr/src/uts/common/disp/thread_intr.c
@@ -23,19 +23,10 @@
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
-
 /*
- * FILE NOTICE BEGIN
- *
- * This file should not be modified.  If you wish to modify it or have it
- * modified, please contact Sun Microsystems at <LFI149367@-sun-.-com->
- * (without anti-spam dashes)
- *
- * FILE NOTICE END
+ * Copyright 2015, Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/cpuvar.h>
 #include <sys/stack.h>
 #include <vm/seg_kp.h>
@@ -44,6 +35,17 @@
 #include <sys/sysmacros.h>
 
 /*
+ * Use a slightly larger thread stack size for interrupt threads rather than the
+ * default. This is useful for cases where the networking stack may do an rx and
+ * a tx in the context of a single interrupt and when combined with various
+ * promisc hooks that need memory, can cause us to get dangerously close to the
+ * edge of the traditional stack sizes. This is only a few pages more than a
+ * traditional stack and given that we don't have that many interrupt threads,
+ * the memory costs end up being more than worthwhile.
+ */
+#define	LL_INTR_STKSZ	(32 * 1024)
+
+/*
  * Create and initialize an interrupt thread.
  */
 static void
@@ -51,7 +53,7 @@ thread_create_intr(cpu_t *cp)
 {
 	kthread_t *tp;
 
-	tp = thread_create(NULL, 0,
+	tp = thread_create(NULL, LL_INTR_STKSZ,
 	    (void (*)())thread_create_intr, NULL, 0, &p0, TS_ONPROC, 0);
 
 	/*
@@ -97,9 +99,12 @@ thread_create_intr(cpu_t *cp)
 }
 
 /*
- * Allocate a given number of interrupt threads for a given CPU.
- * These threads will get freed by cpu_destroy_bound_threads()
- * when CPU gets unconfigured.
+ * Allocate a given number of interrupt threads for a given CPU.  These threads
+ * will get freed by cpu_destroy_bound_threads() when CPU gets unconfigured.
+ *
+ * Note, high level interrupts are always serviced using cpu_intr_stack and are
+ * not allowed to block. Low level interrupts or soft-interrupts use the
+ * kthread_t's that we create through the calls to thread_create_intr().
  */
 void
 cpu_intr_alloc(cpu_t *cp, int n)
@@ -110,6 +115,6 @@ cpu_intr_alloc(cpu_t *cp, int n)
 		thread_create_intr(cp);
 
 	cp->cpu_intr_stack = (caddr_t)segkp_get(segkp, INTR_STACK_SIZE,
-		KPD_HASREDZONE | KPD_NO_ANON | KPD_LOCKED) +
-		INTR_STACK_SIZE - SA(MINFRAME);
+	    KPD_HASREDZONE | KPD_NO_ANON | KPD_LOCKED) +
+	    INTR_STACK_SIZE - SA(MINFRAME);
 }
diff --git a/usr/src/uts/common/dtrace/dtrace.c b/usr/src/uts/common/dtrace/dtrace.c
index ced7249084..9b53e08b6a 100644
--- a/usr/src/uts/common/dtrace/dtrace.c
+++ b/usr/src/uts/common/dtrace/dtrace.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2016, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  * Copyright (c) 2012, 2014 by Delphix. All rights reserved.
  */
 
@@ -3545,6 +3545,34 @@ dtrace_dif_variable(dtrace_mstate_t *mstate, dtrace_state_t *state, uint64_t v,
 	}
 }
 
+static void
+dtrace_dif_variable_write(dtrace_mstate_t *mstate, dtrace_state_t *state,
+    uint64_t v, uint64_t ndx, uint64_t data)
+{
+	switch (v) {
+	case DIF_VAR_UREGS: {
+		klwp_t *lwp;
+
+		if (dtrace_destructive_disallow ||
+		    !dtrace_priv_proc_control(state, mstate)) {
+			return;
+		}
+
+		if ((lwp = curthread->t_lwp) == NULL) {
+			DTRACE_CPUFLAG_SET(CPU_DTRACE_BADADDR);
+			cpu_core[CPU->cpu_id].cpuc_dtrace_illval = NULL;
+			return;
+		}
+
+		dtrace_setreg(lwp->lwp_regs, ndx, data);
+		return;
+	}
+
+	default:
+		DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
+		return;
+	}
+}
 
 typedef enum dtrace_json_state {
 	DTRACE_JSON_REST = 1,
@@ -6024,6 +6052,11 @@ dtrace_dif_emulate(dtrace_difo_t *difo, dtrace_mstate_t *mstate,
 			regs[rd] = dtrace_dif_variable(mstate, state, id, 0);
 			break;
 
+		case DIF_OP_STGA:
+			dtrace_dif_variable_write(mstate, state, r1, regs[r2],
+			    regs[rd]);
+			break;
+
 		case DIF_OP_STGS:
 			id = DIF_INSTR_VAR(instr);
 
@@ -7718,7 +7751,7 @@ dtrace_cred2priv(cred_t *cr, uint32_t *privp, uid_t *uidp, zoneid_t *zoneidp)
 		priv = DTRACE_PRIV_ALL;
 	} else {
 		*uidp = crgetuid(cr);
-		*zoneidp = crgetzoneid(cr);
+		*zoneidp = crgetzonedid(cr);
 
 		priv = 0;
 		if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_KERNEL, B_FALSE))
@@ -8214,7 +8247,7 @@ dtrace_register(const char *name, const dtrace_pattr_t *pap, uint32_t priv,
 	provider->dtpv_priv.dtpp_flags = priv;
 	if (cr != NULL) {
 		provider->dtpv_priv.dtpp_uid = crgetuid(cr);
-		provider->dtpv_priv.dtpp_zoneid = crgetzoneid(cr);
+		provider->dtpv_priv.dtpp_zoneid = crgetzonedid(cr);
 	}
 	provider->dtpv_pops = *pops;
 
@@ -8825,6 +8858,7 @@ dtrace_probe_enable(const dtrace_probedesc_t *desc, dtrace_enabling_t *enab)
 	uint32_t priv;
 	uid_t uid;
 	zoneid_t zoneid;
+	dtrace_state_t *state = enab->dten_vstate->dtvs_state;
 
 	ASSERT(MUTEX_HELD(&dtrace_lock));
 	dtrace_ecb_create_cache = NULL;
@@ -8839,8 +8873,22 @@ dtrace_probe_enable(const dtrace_probedesc_t *desc, dtrace_enabling_t *enab)
 	}
 
 	dtrace_probekey(desc, &pkey);
-	dtrace_cred2priv(enab->dten_vstate->dtvs_state->dts_cred.dcr_cred,
-	    &priv, &uid, &zoneid);
+	dtrace_cred2priv(state->dts_cred.dcr_cred, &priv, &uid, &zoneid);
+
+	if ((priv & DTRACE_PRIV_ZONEOWNER) &&
+	    state->dts_options[DTRACEOPT_ZONE] != DTRACEOPT_UNSET) {
+		/*
+		 * If we have the privilege of instrumenting all zones but we
+		 * have been told to instrument but one, we will spoof this up
+		 * depriving ourselves of DTRACE_PRIV_ZONEOWNER for purposes
+		 * of dtrace_match().  (Note that DTRACEOPT_ZONE is not for
+		 * security but rather for performance: it allows the global
+		 * zone to instrument USDT probes in a local zone without
+		 * requiring all zones to be instrumented.)
+		 */
+		priv &= ~DTRACE_PRIV_ZONEOWNER;
+		zoneid = state->dts_options[DTRACEOPT_ZONE];
+	}
 
 	return (dtrace_match(&pkey, priv, uid, zoneid, dtrace_ecb_create_enable,
 	    enab));
@@ -9392,6 +9440,15 @@ dtrace_difo_validate(dtrace_difo_t *dp, dtrace_vstate_t *vstate, uint_t nregs,
 			if (rd == 0)
 				err += efunc(pc, "cannot write to %r0\n");
 			break;
+		case DIF_OP_STGA:
+			if (r1 > DIF_VAR_ARRAY_MAX)
+				err += efunc(pc, "invalid array %u\n", r1);
+			if (r2 >= nregs)
+				err += efunc(pc, "invalid register %u\n", r2);
+			if (rd >= nregs)
+				err += efunc(pc, "invalid register %u\n", rd);
+			dp->dtdo_destructive = 1;
+			break;
 		case DIF_OP_LDGS:
 		case DIF_OP_LDTS:
 		case DIF_OP_LDLS:
@@ -9737,12 +9794,23 @@ dtrace_difo_validate_helper(dtrace_difo_t *dp)
 			break;
 
 		case DIF_OP_LDTA:
+			if (v < DIF_VAR_OTHER_UBASE) {
+				err += efunc(pc, "illegal variable load\n");
+				break;
+			}
+			/* FALLTHROUGH */
 		case DIF_OP_LDTS:
 		case DIF_OP_LDGAA:
 		case DIF_OP_LDTAA:
 			err += efunc(pc, "illegal dynamic variable load\n");
 			break;
 
+		case DIF_OP_STGA:
+			if (v < DIF_VAR_OTHER_UBASE) {
+				err += efunc(pc, "illegal variable store\n");
+				break;
+			}
+			/* FALLTHROUGH */
 		case DIF_OP_STTS:
 		case DIF_OP_STGAA:
 		case DIF_OP_STTAA:
diff --git a/usr/src/uts/common/dtrace/sdt_subr.c b/usr/src/uts/common/dtrace/sdt_subr.c
index 157acc25fc..3d350ff278 100644
--- a/usr/src/uts/common/dtrace/sdt_subr.c
+++ b/usr/src/uts/common/dtrace/sdt_subr.c
@@ -97,6 +97,10 @@ static dtrace_pattr_t iscsi_attr = {
 { DTRACE_STABILITY_EVOLVING, DTRACE_STABILITY_EVOLVING, DTRACE_CLASS_ISA },
 };
 
+/*
+ * When adding a new provider you must add it before sdt as sdt is a catch all
+ * for remaining probes.
+ */
 sdt_provider_t sdt_providers[] = {
 	{ "vtrace", "__vtrace_", &vtrace_attr },
 	{ "sysinfo", "__cpu_sysinfo_", &info_attr, DTRACE_PRIV_USER },
@@ -117,6 +121,7 @@ sdt_provider_t sdt_providers[] = {
 	{ "fc", "__fc_", &fc_attr },
 	{ "srp", "__srp_", &fc_attr },
 	{ "sysevent", "__sysevent_", &stab_attr },
+	{ "vnd", "__vnd_", &stab_attr },
 	{ "sdt", NULL, &sdt_attr },
 	{ NULL }
 };
@@ -1151,6 +1156,34 @@ sdt_argdesc_t sdt_args[] = {
 	{ "fc", "abts-receive", 2, 2, "fct_i_remote_port_t *",
 	    "fc_port_info_t *" },
 
+	{ "vnd", "flow-blocked", 0, 0, "vnd_str_t *", "ifinfo_t *" },
+	{ "vnd", "flow-blocked", 1, 1, "uint64_t", "uint64_t" },
+	{ "vnd", "flow-blocked", 2, 2, "uintptr_t", "uintptr_t" },
+	{ "vnd", "flow-resumed", 0, 0, "vnd_str_t *", "ifinfo_t *" },
+	{ "vnd", "flow-resumed", 1, 1, "uint64_t", "uint64_t" },
+	{ "vnd", "flow-resumed", 2, 2, "uintptr_t", "uintptr_t" },
+	{ "vnd", "drop-in", 0, 0, "mblk_t *", "pktinfo_t *" },
+	{ "vnd", "drop-in", 1, 1, "vnd_str_t *", "ifinfo_t *" },
+	{ "vnd", "drop-in", 2, 2, "mblk_t *", "etherinfo_t *" },
+	{ "vnd", "drop-in", 3, 3, "const char *", "const char *" },
+	{ "vnd", "drop-out", 0, 0, "mblk_t *", "pktinfo_t *" },
+	{ "vnd", "drop-out", 1, 1, "vnd_str_t *", "ifinfo_t *" },
+	{ "vnd", "drop-out", 2, 2, "mblk_t *", "etherinfo_t *" },
+	{ "vnd", "drop-out", 3, 3, "const char *", "const char *" },
+	{ "vnd", "drop-ctl", 0, 0, "mblk_t *", "pktinfo_t *" },
+	{ "vnd", "drop-ctl", 1, 1, "vnd_str_t *", "ifinfo_t *" },
+	{ "vnd", "drop-ctl", 2, 2, "mblk_t *", "etherinfo_t *" },
+	{ "vnd", "drop-ctl", 3, 3, "const char *", "const char *" },
+	{ "vnd", "send", 0, 0, "mblk_t *", "pktinfo_t *" },
+	{ "vnd", "send", 1, 1, "void *", "csinfo_t *" },
+	{ "vnd", "send", 2, 2, "void *", "ipinfo_t *" },
+	{ "vnd", "send", 3, 3, "vnd_str_t *", "ifinfo_t *" },
+	{ "vnd", "send", 4, 4, "mblk_t *", "etherinfo_t *" },
+	{ "vnd", "recv", 0, 0, "mblk_t *", "pktinfo_t *" },
+	{ "vnd", "recv", 1, 1, "void *", "csinfo_t *" },
+	{ "vnd", "recv", 2, 2, "void *", "ipinfo_t *" },
+	{ "vnd", "recv", 3, 3, "vnd_str_t *", "ifinfo_t *" },
+	{ "vnd", "recv", 4, 4, "mblk_t *", "etherinfo_t *" },
 
 	{ NULL }
 };
diff --git a/usr/src/uts/common/exec/aout/aout.c b/usr/src/uts/common/exec/aout/aout.c
index fc45bd9544..5dbb2ed28c 100644
--- a/usr/src/uts/common/exec/aout/aout.c
+++ b/usr/src/uts/common/exec/aout/aout.c
@@ -22,6 +22,7 @@
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -54,7 +55,7 @@
 
 static int aoutexec(vnode_t *vp, execa_t *uap, uarg_t *args,
     intpdata_t *idatap, int level, long *execsz, int setid,
-    caddr_t exec_file, cred_t *cred, int brand_action);
+    caddr_t exec_file, cred_t *cred, int *brand_action);
 static int get_aout_head(struct vnode **vpp, struct exdata *edp, long *execsz,
     int *isdyn);
 static int aoutcore(vnode_t *vp, proc_t *pp, cred_t *credp,
@@ -130,7 +131,7 @@ _info(struct modinfo *modinfop)
 static int
 aoutexec(vnode_t *vp, struct execa *uap, struct uarg *args,
     struct intpdata *idatap, int level, long *execsz, int setid,
-    caddr_t exec_file, cred_t *cred, int brand_action)
+    caddr_t exec_file, cred_t *cred, int *brand_action)
 {
 	auxv32_t auxflags_auxv32;
 	int error;
diff --git a/usr/src/uts/common/exec/elf/elf.c b/usr/src/uts/common/exec/elf/elf.c
index d3cc0b8f0d..4fa22c3a09 100644
--- a/usr/src/uts/common/exec/elf/elf.c
+++ b/usr/src/uts/common/exec/elf/elf.c
@@ -207,12 +207,16 @@ handle_secflag_dt(proc_t *p, uint_t dt, uint_t val)
 }
 
 /*
- * Map in the executable pointed to by vp. Returns 0 on success.
+ * Map in the executable pointed to by vp. Returns 0 on success.  Note that
+ * this function currently has the maximum number of arguments allowed by
+ * modstubs on x86 (MAXNARG)!  Do _not_ add to this function signature without
+ * adding to MAXNARG.  (Better yet, do not add to this monster of a function
+ * signature!)
  */
 int
 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
-    intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
-    caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
+    intptr_t *voffset, caddr_t exec_file, char **interpp, caddr_t *bssbase,
+    caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap, uintptr_t *minaddrp)
 {
 	size_t		len;
 	struct vattr	vat;
@@ -224,6 +228,7 @@ mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
 	Phdr		*junk = NULL;
 	Phdr		*dynphdr = NULL;
 	Phdr		*dtrphdr = NULL;
+	char		*interp = NULL;
 	uintptr_t	lddata;
 	long		execsz;
 	intptr_t	minaddr;
@@ -231,6 +236,9 @@ mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
 	if (lddatap != NULL)
 		*lddatap = NULL;
 
+	if (minaddrp != NULL)
+		*minaddrp = NULL;
+
 	if (error = execpermissions(vp, &vat, args)) {
 		uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
 		return (error);
@@ -256,25 +264,89 @@ mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
 	    &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
 	    len, &execsz, brksize)) {
 		uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
+		if (uphdr != NULL && uphdr->p_flags == 0)
+			kmem_free(uphdr, sizeof (Phdr));
 		kmem_free(phdrbase, phdrsize);
 		return (error);
 	}
 
+	if (minaddrp != NULL)
+		*minaddrp = minaddr;
+
 	/*
-	 * Inform our caller if the executable needs an interpreter.
+	 * If the executable requires an interpreter, determine its name.
 	 */
-	*interp = (dynphdr == NULL) ? 0 : 1;
+	if (dynphdr != NULL) {
+		ssize_t	resid;
+
+		if (dynphdr->p_filesz > MAXPATHLEN || dynphdr->p_filesz == 0) {
+			uprintf("%s: Invalid interpreter\n", exec_file);
+			kmem_free(phdrbase, phdrsize);
+			return (ENOEXEC);
+		}
+
+		interp = kmem_alloc(MAXPATHLEN, KM_SLEEP);
+
+		if ((error = vn_rdwr(UIO_READ, vp, interp, dynphdr->p_filesz,
+		    (offset_t)dynphdr->p_offset, UIO_SYSSPACE, 0,
+		    (rlim64_t)0, CRED(), &resid)) != 0 || resid != 0 ||
+		    interp[dynphdr->p_filesz - 1] != '\0') {
+			uprintf("%s: Cannot obtain interpreter pathname\n",
+			    exec_file);
+			kmem_free(interp, MAXPATHLEN);
+			kmem_free(phdrbase, phdrsize);
+			return (error != 0 ? error : ENOEXEC);
+		}
+	}
 
 	/*
 	 * If this is a statically linked executable, voffset should indicate
 	 * the address of the executable itself (it normally holds the address
 	 * of the interpreter).
 	 */
-	if (ehdr->e_type == ET_EXEC && *interp == 0)
+	if (ehdr->e_type == ET_EXEC && interp == NULL)
 		*voffset = minaddr;
 
+	/*
+	 * If the caller has asked for the interpreter name, return it (it's
+	 * up to the caller to free it); if the caller hasn't asked for it,
+	 * free it ourselves.
+	 */
+	if (interpp != NULL) {
+		*interpp = interp;
+	} else if (interp != NULL) {
+		kmem_free(interp, MAXPATHLEN);
+	}
+
 	if (uphdr != NULL) {
 		*uphdr_vaddr = uphdr->p_vaddr;
+
+		if (uphdr->p_flags == 0)
+			kmem_free(uphdr, sizeof (Phdr));
+	} else if (ehdr->e_type == ET_DYN) {
+		/*
+		 * If we don't have a uphdr, we'll apply the logic found
+		 * in mapelfexec() and use the p_vaddr of the first PT_LOAD
+		 * section as the base address of the object.
+		 */
+		Phdr *phdr = (Phdr *)phdrbase;
+		int i, hsize = ehdr->e_phentsize;
+
+		for (i = nphdrs; i > 0; i--) {
+			if (phdr->p_type == PT_LOAD) {
+				*uphdr_vaddr = (uintptr_t)phdr->p_vaddr +
+				    ehdr->e_phoff;
+				break;
+			}
+
+			phdr = (Phdr *)((caddr_t)phdr + hsize);
+		}
+
+		/*
+		 * If we don't have a PT_LOAD segment, we should have returned
+		 * ENOEXEC when elfsize() returned 0, above.
+		 */
+		VERIFY(i > 0);
 	} else {
 		*uphdr_vaddr = (Addr)-1;
 	}
@@ -287,13 +359,13 @@ mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
 int
 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
     int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
-    int brand_action)
+    int *brand_action)
 {
 	caddr_t		phdrbase = NULL;
 	caddr_t		bssbase = 0;
 	caddr_t		brkbase = 0;
 	size_t		brksize = 0;
-	ssize_t		dlnsize;
+	ssize_t		dlnsize, nsize = 0;
 	aux_entry_t	*aux;
 	int		error;
 	ssize_t		resid;
@@ -319,6 +391,7 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 	int		hasauxv = 0;
 	int		hasintp = 0;
 	int		branded = 0;
+	int		dynuphdr = 0;
 
 	struct proc *p = ttoproc(curthread);
 	struct user *up = PTOU(p);
@@ -373,7 +446,9 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
 	} else {
 		args->to_model = DATAMODEL_LP64;
-		args->stk_prot &= ~PROT_EXEC;
+		if (!args->stk_prot_override) {
+			args->stk_prot &= ~PROT_EXEC;
+		}
 #if defined(__i386) || defined(__amd64)
 		args->dat_prot &= ~PROT_EXEC;
 #endif
@@ -385,11 +460,25 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 #endif	/* _LP64 */
 
 	/*
-	 * We delay invoking the brand callback until we've figured out
-	 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
-	 * We do this because now the brand library can just check
-	 * args->to_model to see if the target is 32-bit or 64-bit without
-	 * having do duplicate all the code above.
+	 * We delay invoking the brand callback until we've figured out what
+	 * kind of elf binary we're trying to run, 32-bit or 64-bit.  We do this
+	 * because now the brand library can just check args->to_model to see if
+	 * the target is 32-bit or 64-bit without having do duplicate all the
+	 * code above.
+	 *
+	 * We also give the brand a chance to indicate that based on the ELF
+	 * OSABI of the target binary it should become unbranded and optionally
+	 * indicate that it should be treated as existing in a specific prefix.
+	 *
+	 * Note that if a brand opts to go down this route it does not actually
+	 * end up being debranded. In other words, future programs that exec
+	 * will still be considered for branding unless this escape hatch is
+	 * used. Consider the case of lx brand for example. If a user runs
+	 * /native/usr/sbin/dtrace -c /bin/ls, the isaexec and normal executable
+	 * of DTrace that's in /native will take this escape hatch and be run
+	 * and interpreted using the normal system call table; however, the
+	 * execution of a non-illumos binary in the form of /bin/ls will still
+	 * be branded and be subject to all of the normal actions of the brand.
 	 *
 	 * The level checks associated with brand handling below are used to
 	 * prevent a loop since the brand elfexec function typically comes back
@@ -397,8 +486,20 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 	 * handling in the #! interpreter code will increment the level before
 	 * calling gexec to run the final elfexec interpreter.
 	 */
+	if ((level <= INTP_MAXDEPTH) && (*brand_action != EBA_NATIVE) &&
+	    (PROC_IS_BRANDED(p)) && (BROP(p)->b_native_exec != NULL)) {
+		if (BROP(p)->b_native_exec(ehdrp->e_ident[EI_OSABI],
+		    &args->brand_nroot) == B_TRUE) {
+			ASSERT(ehdrp->e_ident[EI_OSABI]);
+			*brand_action = EBA_NATIVE;
+			/* Add one for the trailing '/' in the path */
+			if (args->brand_nroot != NULL)
+				nsize = strlen(args->brand_nroot) + 1;
+		}
+	}
+
 	if ((level <= INTP_MAXDEPTH) &&
-	    (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
+	    (*brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
 		error = BROP(p)->b_elfexec(vp, uap, args,
 		    idatap, level + 1, execsz, setid, exec_file, cred,
 		    brand_action);
@@ -472,14 +573,15 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 		 *	AT_BASE
 		 *	AT_FLAGS
 		 *	AT_PAGESZ
+		 *	AT_RANDOM	(added in stk_copyout)
 		 *	AT_SUN_AUXFLAGS
 		 *	AT_SUN_HWCAP
 		 *	AT_SUN_HWCAP2
-		 *	AT_SUN_PLATFORM (added in stk_copyout)
-		 *	AT_SUN_EXECNAME (added in stk_copyout)
+		 *	AT_SUN_PLATFORM	(added in stk_copyout)
+		 *	AT_SUN_EXECNAME	(added in stk_copyout)
 		 *	AT_NULL
 		 *
-		 * total == 9
+		 * total == 10
 		 */
 		if (hasintp && hasu) {
 			/*
@@ -494,7 +596,7 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 			 *
 			 * total = 5
 			 */
-			args->auxsize = (9 + 5) * sizeof (aux_entry_t);
+			args->auxsize = (10 + 5) * sizeof (aux_entry_t);
 		} else if (hasintp) {
 			/*
 			 * Has PT_INTERP but no PT_PHDR
@@ -504,9 +606,9 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 			 *
 			 * total = 2
 			 */
-			args->auxsize = (9 + 2) * sizeof (aux_entry_t);
+			args->auxsize = (10 + 2) * sizeof (aux_entry_t);
 		} else {
-			args->auxsize = 9 * sizeof (aux_entry_t);
+			args->auxsize = 10 * sizeof (aux_entry_t);
 		}
 	} else {
 		args->auxsize = 0;
@@ -520,6 +622,15 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 		args->auxsize += sizeof (aux_entry_t);
 
 	/*
+	 * If this is a native binary that's been given a modified interpreter
+	 * root, inform it that the native system exists at that root.
+	 */
+	if (args->brand_nroot != NULL) {
+		args->auxsize += sizeof (aux_entry_t);
+	}
+
+
+	/*
 	 * On supported kernels (x86_64) make room in the auxv for the
 	 * AT_SUN_COMMPAGE entry.  This will go unpopulated on i86xpv systems
 	 * which do not provide such functionality.
@@ -531,13 +642,24 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 	args->auxsize += 3 * sizeof (aux_entry_t);
 #endif /* defined(__amd64) */
 
-	if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
+	/*
+	 * If we have user credentials, we'll supply the following entries:
+	 *	AT_SUN_UID
+	 *	AT_SUN_RUID
+	 *	AT_SUN_GID
+	 *	AT_SUN_RGID
+	 */
+	if (cred != NULL) {
+		args->auxsize += 4 * sizeof (aux_entry_t);
+	}
+
+	if ((*brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
 		branded = 1;
 		/*
-		 * We will be adding 4 entries to the aux vectors.  One for
-		 * the the brandname and 3 for the brand specific aux vectors.
+		 * We will be adding 5 entries to the aux vectors.  One for
+		 * the the brandname and 4 for the brand specific aux vectors.
 		 */
-		args->auxsize += 4 * sizeof (aux_entry_t);
+		args->auxsize += 5 * sizeof (aux_entry_t);
 	}
 
 	/* If the binary has an explicit ASLR flag, it must be honoured */
@@ -612,7 +734,8 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 	aux = bigwad->elfargs;
 	/*
 	 * Move args to the user's stack.
-	 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries.
+	 * This can fill in the AT_SUN_PLATFORM, AT_SUN_EXECNAME and AT_RANDOM
+	 * aux entries.
 	 */
 	if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
 		if (error == -1) {
@@ -639,6 +762,14 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 	    len, execsz, &brksize)) != 0)
 		goto bad;
 
+	if (uphdr != NULL) {
+		/*
+		 * Our uphdr has been dynamically allocated if (and only if)
+		 * its program header flags are clear.
+		 */
+		dynuphdr = (uphdr->p_flags == 0);
+	}
+
 	if (uphdr != NULL && intphdr == NULL)
 		goto bad;
 
@@ -653,17 +784,22 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 		char		*p;
 		struct vnode	*nvp;
 
-		dlnsize = intphdr->p_filesz;
+		dlnsize = intphdr->p_filesz + nsize;
 
 		if (dlnsize > MAXPATHLEN || dlnsize <= 0)
 			goto bad;
 
+		if (nsize != 0) {
+			bcopy(args->brand_nroot, dlnp, nsize - 1);
+			dlnp[nsize - 1] = '/';
+		}
+
 		/*
 		 * Read in "interpreter" pathname.
 		 */
-		if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz,
-		    (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
-		    CRED(), &resid)) != 0) {
+		if ((error = vn_rdwr(UIO_READ, vp, dlnp + nsize,
+		    intphdr->p_filesz, (offset_t)intphdr->p_offset,
+		    UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) {
 			uprintf("%s: Cannot obtain interpreter pathname\n",
 			    exec_file);
 			goto bad;
@@ -808,9 +944,10 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 
 		dtrphdr = NULL;
 
-		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
+		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, NULL, &junk,
 		    &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
 		    execsz, NULL);
+
 		if (error || junk != NULL) {
 			VN_RELE(nvp);
 			uprintf("%s: Cannot map %s\n", exec_file, dlnp);
@@ -841,8 +978,8 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 		int fptype;
 
 		/*
-		 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via
-		 * exec_args()
+		 * Note: AT_SUN_PLATFORM, AT_SUN_EXECNAME and AT_RANDOM were
+		 * filled in via exec_args()
 		 */
 		ADDAUX(aux, AT_BASE, voffset)
 		ADDAUX(aux, AT_FLAGS, at_flags)
@@ -870,7 +1007,7 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 		 * malicious user within the zone from crafting a wrapper to
 		 * run native suid commands with unsecure libraries interposed.
 		 */
-		if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
+		if ((*brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
 		    (setid &= ~EXECSETID_SETID) != 0))
 			auxf &= ~AF_SUN_SETUGID;
 
@@ -885,6 +1022,17 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 		ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
 
 		/*
+		 * Record information about the real and effective user and
+		 * group IDs.
+		 */
+		if (cred != NULL) {
+			ADDAUX(aux, AT_SUN_UID, crgetuid(cred));
+			ADDAUX(aux, AT_SUN_RUID, crgetruid(cred));
+			ADDAUX(aux, AT_SUN_GID, crgetgid(cred));
+			ADDAUX(aux, AT_SUN_RGID, crgetrgid(cred));
+		}
+
+		/*
 		 * Hardware capability flag word (performance hints)
 		 * Used for choosing faster library routines.
 		 * (Potentially different between 32-bit and 64-bit ABIs)
@@ -913,6 +1061,7 @@ elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
 			ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
 			ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
 			ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
+			ADDAUX(aux, AT_SUN_BRAND_AUX4, 0)
 		}
 
 		/*
@@ -1048,6 +1197,8 @@ bad:
 	if (error == 0)
 		error = ENOEXEC;
 out:
+	if (dynuphdr)
+		kmem_free(uphdr, sizeof (Phdr));
 	if (phdrbase != NULL)
 		kmem_free(phdrbase, phdrsize);
 	if (cap != NULL)
@@ -1314,6 +1465,29 @@ getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
 	return (0);
 }
 
+
+#ifdef _ELF32_COMPAT
+int
+elf32readhdr(vnode_t *vp, cred_t *credp, Ehdr *ehdrp, int *nphdrs,
+    caddr_t *phbasep, ssize_t *phsizep)
+#else
+int
+elfreadhdr(vnode_t *vp, cred_t *credp, Ehdr *ehdrp, int *nphdrs,
+    caddr_t *phbasep, ssize_t *phsizep)
+#endif
+{
+	int error, nshdrs, shstrndx;
+
+	if ((error = getelfhead(vp, credp, ehdrp, &nshdrs, &shstrndx,
+	    nphdrs)) != 0 ||
+	    (error = getelfphdr(vp, credp, ehdrp, *nphdrs, phbasep,
+	    phsizep)) != 0) {
+		return (error);
+	}
+	return (0);
+}
+
+
 static int
 mapelfexec(
 	vnode_t *vp,
@@ -1334,7 +1508,7 @@ mapelfexec(
 	size_t *brksize)
 {
 	Phdr *phdr;
-	int i, prot, error;
+	int i, prot, error, lastprot = 0;
 	caddr_t addr = NULL;
 	size_t zfodsz;
 	int ptload = 0;
@@ -1342,9 +1516,11 @@ mapelfexec(
 	off_t offset;
 	int hsize = ehdr->e_phentsize;
 	caddr_t mintmp = (caddr_t)-1;
+	uintptr_t lastaddr = NULL;
 	extern int use_brk_lpg;
 
 	if (ehdr->e_type == ET_DYN) {
+		caddr_t vaddr;
 		secflagset_t flags = 0;
 		/*
 		 * Obtain the virtual address of a hole in the
@@ -1359,30 +1535,71 @@ mapelfexec(
 		*voffset = (intptr_t)addr;
 
 		/*
-		 * Calculate the minimum vaddr so it can be subtracted out.
-		 * According to the ELF specification, since PT_LOAD sections
-		 * must be sorted by increasing p_vaddr values, this is
-		 * guaranteed to be the first PT_LOAD section.
+		 * Despite the fact that mmapobj(2) refuses to load them, we
+		 * need to support executing ET_DYN objects that have a
+		 * non-NULL p_vaddr.  When found in the wild, these objects
+		 * are likely to be due to an old (and largely obviated) Linux
+		 * facility, prelink(8), that rewrites shared objects to
+		 * prefer specific (disjoint) virtual address ranges.  (Yes,
+		 * this is putatively for performance -- and yes, it has
+		 * limited applicability, many edge conditions and grisly
+		 * failure modes; even for Linux, it's insane.)  As ELF
+		 * mandates that the PT_LOAD segments be in p_vaddr order, we
+		 * find the lowest p_vaddr by finding the first PT_LOAD
+		 * segment.
 		 */
 		phdr = (Phdr *)phdrbase;
 		for (i = nphdrs; i > 0; i--) {
 			if (phdr->p_type == PT_LOAD) {
-				*voffset -= (uintptr_t)phdr->p_vaddr;
+				addr = (caddr_t)(uintptr_t)phdr->p_vaddr;
 				break;
 			}
 			phdr = (Phdr *)((caddr_t)phdr + hsize);
 		}
 
+		/*
+		 * We have a non-zero p_vaddr in the first PT_LOAD segment --
+		 * presumably because we're directly executing a prelink(8)'d
+		 * ld-linux.so.  While we could correctly execute such an
+		 * object without locating it at its desired p_vaddr (it is,
+		 * after all, still relocatable), our inner antiquarian
+		 * derives a perverse pleasure in accommodating the steampunk
+		 * prelink(8) contraption -- goggles on!
+		 */
+		if ((vaddr = addr) != NULL) {
+			if (as_gap(curproc->p_as, len,
+			    &addr, &len, AH_LO, NULL) == -1 || addr != vaddr) {
+				addr = NULL;
+			}
+		}
+
+		if (addr == NULL) {
+			/*
+			 * We either have a NULL p_vaddr (the common case, by
+			 * many orders of magnitude) or we have a non-NULL
+			 * p_vaddr and we were unable to obtain the specified
+			 * VA range (presumably because it's an illegal
+			 * address).  Either way, obtain an address in which
+			 * to map the interpreter.
+			 */
+			map_addr(&addr, len, (offset_t)0, 1, 0);
+			if (addr == NULL)
+				return (ENOMEM);
+		}
+
+		/*
+		 * Our voffset is the difference between where we landed and
+		 * where we wanted to be.
+		 */
+		*voffset = (uintptr_t)addr - (uintptr_t)vaddr;
 	} else {
 		*voffset = 0;
 	}
+
 	phdr = (Phdr *)phdrbase;
 	for (i = nphdrs; i > 0; i--) {
 		switch (phdr->p_type) {
 		case PT_LOAD:
-			if ((*intphdr != NULL) && (*uphdr == NULL))
-				return (0);
-
 			ptload = 1;
 			prot = PROT_USER;
 			if (phdr->p_flags & PF_R)
@@ -1394,6 +1611,34 @@ mapelfexec(
 
 			addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
 
+			if ((*intphdr != NULL) && uphdr != NULL &&
+			    (*uphdr == NULL)) {
+				/*
+				 * The PT_PHDR program header is, strictly
+				 * speaking, optional.  If we find that this
+				 * is missing, we will determine the location
+				 * of the program headers based on the address
+				 * of the lowest PT_LOAD segment (namely, this
+				 * one):  we subtract the p_offset to get to
+				 * the ELF header and then add back the program
+				 * header offset to get to the program headers.
+				 * We then cons up a Phdr that corresponds to
+				 * the (missing) PT_PHDR, setting the flags
+				 * to 0 to denote that this is artificial and
+				 * should (must) be freed by the caller.
+				 */
+				Phdr *cons;
+
+				cons = kmem_zalloc(sizeof (Phdr), KM_SLEEP);
+
+				cons->p_flags = 0;
+				cons->p_type = PT_PHDR;
+				cons->p_vaddr = ((uintptr_t)addr -
+				    phdr->p_offset) + ehdr->e_phoff;
+
+				*uphdr = cons;
+			}
+
 			/*
 			 * Keep track of the segment with the lowest starting
 			 * address.
@@ -1401,6 +1646,41 @@ mapelfexec(
 			if (addr < mintmp)
 				mintmp = addr;
 
+			/*
+			 * Segments need not correspond to page boundaries:
+			 * they are permitted to share a page.  If two PT_LOAD
+			 * segments share the same page, and the permissions
+			 * of the segments differ, the behavior is historically
+			 * that the permissions of the latter segment are used
+			 * for the page that the two segments share.  This is
+			 * also historically a non-issue:  binaries generated
+			 * by most anything will make sure that two PT_LOAD
+			 * segments with differing permissions don't actually
+			 * share any pages.  However, there exist some crazy
+			 * things out there (including at least an obscure
+			 * Portuguese teaching language called G-Portugol) that
+			 * actually do the wrong thing and expect it to work:
+			 * they have a segment with execute permission share
+			 * a page with a subsequent segment that does not
+			 * have execute permissions and expect the resulting
+			 * shared page to in fact be executable.  To accommodate
+			 * such broken link editors, we take advantage of a
+			 * latitude explicitly granted to the loader:  it is
+			 * permitted to make _any_ PT_LOAD segment executable
+			 * (provided that it is readable or writable).  If we
+			 * see that we're sharing a page and that the previous
+			 * page was executable, we will add execute permissions
+			 * to our segment.
+			 */
+			if (btop(lastaddr) == btop((uintptr_t)addr) &&
+			    (phdr->p_flags & (PF_R | PF_W)) &&
+			    (lastprot & PROT_EXEC)) {
+				prot |= PROT_EXEC;
+			}
+
+			lastaddr = (uintptr_t)addr + phdr->p_filesz;
+			lastprot = prot;
+
 			zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
 
 			offset = phdr->p_offset;
@@ -1472,8 +1752,22 @@ mapelfexec(
 			break;
 
 		case PT_INTERP:
-			if (ptload)
-				goto bad;
+			/*
+			 * The ELF specification is unequivocal about the
+			 * PT_INTERP program header with respect to any PT_LOAD
+			 * program header:  "If it is present, it must precede
+			 * any loadable segment entry." Linux, however, makes
+			 * no attempt to enforce this -- which has allowed some
+			 * binary editing tools to get away with generating
+			 * invalid ELF binaries in the respect that PT_INTERP
+			 * occurs after the first PT_LOAD program header.  This
+			 * is unfortunate (and of course, disappointing) but
+			 * it's no worse than that: there is no reason that we
+			 * can't process the PT_INTERP entry (if present) after
+			 * one or more PT_LOAD entries.  We therefore
+			 * deliberately do not check ptload here and always
+			 * store dyphdr to be the PT_INTERP program header.
+			 */
 			*intphdr = phdr;
 			break;
 
@@ -1482,9 +1776,12 @@ mapelfexec(
 			break;
 
 		case PT_PHDR:
-			if (ptload)
+			if (ptload || phdr->p_flags == 0)
 				goto bad;
-			*uphdr = phdr;
+
+			if (uphdr != NULL)
+				*uphdr = phdr;
+
 			break;
 
 		case PT_NULL:
@@ -2362,7 +2659,7 @@ static struct modlexec modlexec = {
 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
 			intpdata_t *idatap, int level, long *execsz,
 			int setid, caddr_t exec_file, cred_t *cred,
-			int brand_action);
+			int *brand_action);
 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
 			rlim64_t rlimit, int sig, core_content_t content);
 
diff --git a/usr/src/uts/common/exec/elf/elf_notes.c b/usr/src/uts/common/exec/elf/elf_notes.c
index 4037507dda..7453f6c745 100644
--- a/usr/src/uts/common/exec/elf/elf_notes.c
+++ b/usr/src/uts/common/exec/elf/elf_notes.c
@@ -26,7 +26,7 @@
 
 /*
  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
- * Copyright (c) 2014, Joyent, Inc. All rights reserved.
+ * Copyright 2016, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -336,11 +336,13 @@ write_elfnotes(proc_t *p, int sig, vnode_t *vp, offset_t offset,
 
 
 	/* open file table */
+	mutex_enter(&p->p_lock);
 	vroot = PTOU(p)->u_rdir;
 	if (vroot == NULL)
 		vroot = rootdir;
 
 	VN_HOLD(vroot);
+	mutex_exit(&p->p_lock);
 
 	fip = P_FINFO(p);
 
diff --git a/usr/src/uts/common/exec/intp/intp.c b/usr/src/uts/common/exec/intp/intp.c
index 269ba86b1b..512cab2b66 100644
--- a/usr/src/uts/common/exec/intp/intp.c
+++ b/usr/src/uts/common/exec/intp/intp.c
@@ -22,6 +22,7 @@
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright 2012 Milan Jurik. All rights reserved.
+ * Copyright 2016, Joyent, Inc.
  */
 
 /*	Copyright (c) 1988 AT&T	*/
@@ -47,6 +48,7 @@
 #include <sys/kmem.h>
 #include <sys/note.h>
 #include <sys/sdt.h>
+#include <sys/brand.h>
 
 /*
  * This is the loadable module wrapper.
@@ -54,7 +56,7 @@
 #include <sys/modctl.h>
 
 extern int intpexec(struct vnode *, struct execa *, struct uarg *,
-    struct intpdata *, int, long *, int, caddr_t, struct cred *, int);
+    struct intpdata *, int, long *, int, caddr_t, struct cred *, int *);
 
 static struct execsw esw = {
 	intpmagicstr,
@@ -126,13 +128,20 @@ getintphead(struct vnode *vp, struct intpdata *idatap)
 	*cp = '\0';
 
 	/*
-	 * Locate the beginning and end of the interpreter name.
-	 * In addition to the name, one additional argument may
-	 * optionally be included here, to be prepended to the
-	 * arguments provided on the command line.  Thus, for
-	 * example, you can say
+	 * Locate the beginning and end of the interpreter name. Historically,
+	 * for illumos and its predecessors, in addition to the name, one
+	 * additional argument may optionally be included here, to be prepended
+	 * to the arguments provided on the command line. Thus, for example,
+	 * you can say
 	 *
 	 * 	#! /usr/bin/awk -f
+	 *
+	 * However, handling of interpreter arguments varies across operating
+	 * systems and other systems allow more than one argument. In
+	 * particular, Linux allows more than one and delivers all arguments
+	 * as a single string (argv[1] is "-arg1 -arg2 ..."). We support this
+	 * style of argument handling as a brand-specific option (setting
+	 * b_intp_parse_arg to B_FALSE).
 	 */
 	for (cp = &linep[2]; *cp == ' '; cp++)
 		;
@@ -151,9 +160,12 @@ getintphead(struct vnode *vp, struct intpdata *idatap)
 			idatap->intp_arg[0] = NULL;
 		else {
 			idatap->intp_arg[0] = cp;
-			while (*cp && *cp != ' ')
-				cp++;
-			*cp = '\0';
+			if (!PROC_IS_BRANDED(curproc) ||
+			    BROP(curproc)->b_intp_parse_arg) {
+				while (*cp && *cp != ' ')
+					cp++;
+				*cp = '\0';
+			}
 		}
 	}
 	return (0);
@@ -188,9 +200,8 @@ intpexec(
 	int setid,
 	caddr_t exec_file,
 	struct cred *cred,
-	int brand_action)
+	int *brand_action)
 {
-	_NOTE(ARGUNUSED(brand_action))
 	vnode_t *nvp;
 	int error = 0;
 	struct intpdata idata;
@@ -281,7 +292,7 @@ intpexec(
 	}
 
 	error = gexec(&nvp, uap, args, &idata, ++level, execsz, exec_file, cred,
-	    EBA_NONE);
+	    brand_action);
 
 	if (!error) {
 		/*
diff --git a/usr/src/uts/common/exec/java/java.c b/usr/src/uts/common/exec/java/java.c
index fdc327dcbb..5170fda5cb 100644
--- a/usr/src/uts/common/exec/java/java.c
+++ b/usr/src/uts/common/exec/java/java.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*
@@ -85,7 +86,7 @@ char *jexec_arg = "-jar";
 static int
 javaexec(vnode_t *vp, struct execa *uap, struct uarg *args,
     struct intpdata *idatap, int level, long *execsz, int setid,
-    caddr_t execfile, cred_t *cred, int brand_action)
+    caddr_t execfile, cred_t *cred, int *brand_action)
 {
 	struct intpdata idata;
 	int error;
diff --git a/usr/src/uts/common/exec/shbin/shbin.c b/usr/src/uts/common/exec/shbin/shbin.c
index ee5060a07e..016d87b9ef 100644
--- a/usr/src/uts/common/exec/shbin/shbin.c
+++ b/usr/src/uts/common/exec/shbin/shbin.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -58,7 +59,7 @@ shbinexec(
 	int setid,
 	caddr_t exec_file,
 	struct cred *cred,
-	int brand_action);
+	int *brand_action);
 
 #define	SHBIN_CNTL(x)	((x)&037)
 #define	SHBINMAGIC_LEN	4
@@ -162,7 +163,7 @@ shbinexec(
 	int setid,
 	caddr_t exec_file,
 	struct cred *cred,
-	int brand_action)
+	int *brand_action)
 {
 	_NOTE(ARGUNUSED(brand_action))
 	vnode_t *nvp;
diff --git a/usr/src/uts/common/fs/dev/sdev_netops.c b/usr/src/uts/common/fs/dev/sdev_netops.c
index 4eaf38f484..a0edd668f2 100644
--- a/usr/src/uts/common/fs/dev/sdev_netops.c
+++ b/usr/src/uts/common/fs/dev/sdev_netops.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -41,8 +42,102 @@
 #include <sys/zone.h>
 #include <sys/dls.h>
 
+static const char *devnet_zpath = "/dev/net/zone/";
 struct vnodeops		*devnet_vnodeops;
 
+static zoneid_t
+devnet_nodetozone(sdev_node_t *dv)
+{
+	char *zname = NULL, *dup;
+	zone_t *zone;
+	int duplen;
+	zoneid_t zid;
+
+	/*
+	 * If in a non-global zone, always return it's zid no matter what the
+	 * node is.
+	 */
+	zid = getzoneid();
+	if (zid != GLOBAL_ZONEID)
+		return (zid);
+
+	/*
+	 * If it doesn't have /dev/net/zone/ then it can't be a specific zone
+	 * we're targetting.
+	 */
+	if (strncmp(devnet_zpath, dv->sdev_path, strlen(devnet_zpath)) != 0)
+		return (GLOBAL_ZONEID);
+
+	if (dv->sdev_vnode->v_type == VDIR) {
+		zone = zone_find_by_name(dv->sdev_name);
+	} else {
+		/* Non directories have the form /dev/net/zone/%z/%s */
+		dup = strdup(dv->sdev_path);
+		duplen = strlen(dup);
+		zname = strrchr(dup, '/');
+		*zname = '\0';
+		zname--;
+		zname = strrchr(dup, '/');
+		zname++;
+		zone = zone_find_by_name(zname);
+		kmem_free(dup, duplen + 1);
+	}
+	if (zone == NULL)
+		return (GLOBAL_ZONEID);
+	zid = zone->zone_id;
+	zone_rele(zone);
+	return (zid);
+}
+
+static int
+devnet_mkdir(struct sdev_node *ddv, char *name)
+{
+	sdev_node_t *dv;
+	struct vattr va;
+	int ret;
+
+	ASSERT(RW_WRITE_HELD(&ddv->sdev_contents));
+	dv = sdev_cache_lookup(ddv, name);
+	if (dv != NULL) {
+		SDEV_SIMPLE_RELE(dv);
+		return (EEXIST);
+	}
+
+	va = *sdev_getdefault_attr(VDIR);
+	gethrestime(&va.va_atime);
+	va.va_mtime = va.va_atime;
+	va.va_ctime = va.va_atime;
+
+	ret = sdev_mknode(ddv, name, &dv, &va, NULL, NULL, kcred, SDEV_READY);
+	if (ret != 0)
+		return (ret);
+	SDEV_SIMPLE_RELE(dv);
+	return (0);
+}
+
+/*
+ * We basically need to walk down the directory path to determine what we should
+ * do. At the top level of /dev/net, only the directory /dev/net/zone is valid,
+ * and it is always valid. Following on that, /dev/net/zone/%zonename is valid
+ * if and only if we can look up that zone name. If it's not, or it's some other
+ * name, then it's SDEV_VTOR_INVALID.
+ */
+static int
+devnet_dirvalidate(struct sdev_node *dv)
+{
+	zone_t *zonep;
+	char *path = "/dev/net/zone";
+
+	if (strcmp(path, dv->sdev_path) == 0)
+		return (SDEV_VTOR_VALID);
+
+	zonep = zone_find_by_name(dv->sdev_name);
+	if (zonep == NULL)
+		return (SDEV_VTOR_INVALID);
+	zone_rele(zonep);
+	return (SDEV_VTOR_VALID);
+}
+
 /*
  * Check if a net sdev_node is still valid - i.e. it represents a current
  * network link.
@@ -60,11 +155,20 @@ devnet_validate(struct sdev_node *dv)
 
 	ASSERT(dv->sdev_state == SDEV_READY);
 
-	if (dls_mgmt_get_linkid(dv->sdev_name, &linkid) != 0)
+	if (dv->sdev_vnode->v_type == VDIR)
+		return (devnet_dirvalidate(dv));
+
+	if (strncmp(devnet_zpath, dv->sdev_path, strlen(devnet_zpath)) == 0) {
+		ASSERT(SDEV_IS_GLOBAL(dv));
+		zoneid = devnet_nodetozone(dv);
+	} else {
+		zoneid = getzoneid();
+	}
+
+	if (dls_mgmt_get_linkid_in_zone(dv->sdev_name, &linkid, zoneid) != 0)
 		return (SDEV_VTOR_INVALID);
-	if (SDEV_IS_GLOBAL(dv))
+	if (zoneid == GLOBAL_ZONEID)
 		return (SDEV_VTOR_VALID);
-	zoneid = getzoneid();
 	return (zone_check_datalink(&zoneid, linkid) == 0 ?
 	    SDEV_VTOR_VALID : SDEV_VTOR_INVALID);
 }
@@ -74,13 +178,14 @@ devnet_validate(struct sdev_node *dv)
  * a net entry when the node is not found in the cache.
  */
 static int
-devnet_create_rvp(const char *nm, struct vattr *vap, dls_dl_handle_t *ddhp)
+devnet_create_rvp(const char *nm, struct vattr *vap, dls_dl_handle_t *ddhp,
+    zoneid_t zid)
 {
 	timestruc_t now;
 	dev_t dev;
 	int error;
 
-	if ((error = dls_devnet_open(nm, ddhp, &dev)) != 0) {
+	if ((error = dls_devnet_open_in_zone(nm, ddhp, &dev, zid)) != 0) {
 		sdcmn_err12(("devnet_create_rvp: not a valid vanity name "
 		    "network node: %s\n", nm));
 		return (error);
@@ -116,6 +221,7 @@ devnet_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
 	struct sdev_node *ddv = VTOSDEV(dvp);
 	struct sdev_node *dv = NULL;
 	dls_dl_handle_t ddh = NULL;
+	zone_t *zone;
 	struct vattr vattr;
 	int nmlen;
 	int error = ENOENT;
@@ -123,6 +229,9 @@ devnet_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
 	if (SDEVTOV(ddv)->v_type != VDIR)
 		return (ENOTDIR);
 
+	if (!SDEV_IS_GLOBAL(ddv) && crgetzoneid(cred) == GLOBAL_ZONEID)
+		return (EPERM);
+
 	/*
 	 * Empty name or ., return node itself.
 	 */
@@ -145,6 +254,12 @@ devnet_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
 	rw_enter(&ddv->sdev_contents, RW_WRITER);
 
 	/*
+	 * ZOMBIED parent does not allow new node creation, bail out early.
+	 */
+	if (ddv->sdev_state == SDEV_ZOMBIE)
+		goto failed;
+
+	/*
 	 * directory cache lookup:
 	 */
 	if ((dv = sdev_cache_lookup(ddv, nm)) != NULL) {
@@ -153,13 +268,42 @@ devnet_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
 			goto found;
 	}
 
+	if (SDEV_IS_GLOBAL(ddv)) {
+		/*
+		 * Check for /dev/net/zone
+		 */
+		if (strcmp("zone", nm) == 0 && strcmp("/dev/net",
+		    ddv->sdev_path) == 0) {
+			(void) devnet_mkdir(ddv, nm);
+			dv = sdev_cache_lookup(ddv, nm);
+			ASSERT(dv != NULL);
+			goto found;
+		}
+
+		/*
+		 * Check for /dev/net/zone/%z. We can't use devnet_zpath due to
+		 * its trailing slash.
+		 */
+		if (strcmp("/dev/net/zone", ddv->sdev_path) == 0) {
+			zone = zone_find_by_name(nm);
+			if (zone == NULL)
+				goto failed;
+			(void) devnet_mkdir(ddv, nm);
+			zone_rele(zone);
+			dv = sdev_cache_lookup(ddv, nm);
+			ASSERT(dv != NULL);
+			goto found;
+		}
+	} else if (strcmp("/dev/net", ddv->sdev_path) != 0) {
+		goto failed;
+	}
+
 	/*
-	 * ZOMBIED parent does not allow new node creation, bail out early.
+	 * We didn't find what we were looking for. What that is depends a lot
+	 * on what directory we're in.
 	 */
-	if (ddv->sdev_state == SDEV_ZOMBIE)
-		goto failed;
 
-	error = devnet_create_rvp(nm, &vattr, &ddh);
+	error = devnet_create_rvp(nm, &vattr, &ddh, devnet_nodetozone(ddv));
 	if (error != 0)
 		goto failed;
 
@@ -219,7 +363,7 @@ devnet_filldir_datalink(datalink_id_t linkid, void *arg)
 	if ((dv = sdev_cache_lookup(ddv, (char *)link)) != NULL)
 		goto found;
 
-	if (devnet_create_rvp(link, &vattr, &ddh) != 0)
+	if (devnet_create_rvp(link, &vattr, &ddh, devnet_nodetozone(arg)) != 0)
 		return (0);
 
 	ASSERT(ddh != NULL);
@@ -244,16 +388,77 @@ found:
 	return (0);
 }
 
+/*
+ * Fill in all the entries for the current zone.
+ */
 static void
-devnet_filldir(struct sdev_node *ddv)
+devnet_fillzone(struct sdev_node *ddv, zoneid_t zid)
 {
-	sdev_node_t	*dv, *next;
 	datalink_id_t	linkid;
 
+	ASSERT(RW_WRITE_HELD(&ddv->sdev_contents));
+	if (zid == GLOBAL_ZONEID) {
+		ASSERT(SDEV_IS_GLOBAL(ddv));
+		linkid = DATALINK_INVALID_LINKID;
+		do {
+			linkid = dls_mgmt_get_next(linkid, DATALINK_CLASS_ALL,
+			    DATALINK_ANY_MEDIATYPE, DLMGMT_ACTIVE);
+			if (linkid != DATALINK_INVALID_LINKID)
+				(void) devnet_filldir_datalink(linkid, ddv);
+		} while (linkid != DATALINK_INVALID_LINKID);
+	} else {
+		(void) zone_datalink_walk(zid,  devnet_filldir_datalink, ddv);
+	}
+}
+
+/*
+ * Callback for zone_walk when filling up /dev/net/zone/...
+ */
+static int
+devnet_fillzdir_cb(zone_t *zonep, void *arg)
+{
+	sdev_node_t *ddv = arg;
+
+	ASSERT(RW_WRITE_HELD(&ddv->sdev_contents));
+	(void) devnet_mkdir(ddv, zonep->zone_name);
+	return (0);
+}
+
+/*
+ * Fill in a directory that isn't the top level /dev/net.
+ */
+static void
+devnet_fillzdir(struct sdev_node *ddv)
+{
+	zone_t *zonep;
+	char *path = "/dev/net/zone";
+
+	if (strcmp(path, ddv->sdev_path) == 0) {
+		(void) zone_walk(devnet_fillzdir_cb, ddv);
+		return;
+	}
+
+	zonep = zone_find_by_name(ddv->sdev_name);
+	if (zonep == NULL)
+		return;
+	devnet_fillzone(ddv, zonep->zone_id);
+	zone_rele(zonep);
+}
+
+static void
+devnet_filldir(struct sdev_node *ddv)
+{
+	int ret;
+	sdev_node_t *dv, *next;
+
 	ASSERT(RW_READ_HELD(&ddv->sdev_contents));
 	if (rw_tryupgrade(&ddv->sdev_contents) == NULL) {
 		rw_exit(&ddv->sdev_contents);
 		rw_enter(&ddv->sdev_contents, RW_WRITER);
+		if (ddv->sdev_state == SDEV_ZOMBIE) {
+			rw_exit(&ddv->sdev_contents);
+			return;
+		}
 	}
 
 	for (dv = SDEV_FIRST_ENTRY(ddv); dv; dv = next) {
@@ -276,31 +481,38 @@ devnet_filldir(struct sdev_node *ddv)
 
 		if (SDEVTOV(dv)->v_count > 0)
 			continue;
+
 		SDEV_HOLD(dv);
+
+		/*
+		 * Clean out everything underneath before we remove ourselves.
+		 */
+		if (SDEVTOV(dv)->v_type == VDIR) {
+			ret = sdev_cleandir(dv, NULL, 0);
+			ASSERT(ret == 0);
+		}
 		/* remove the cache node */
 		(void) sdev_cache_update(ddv, &dv, dv->sdev_name,
 		    SDEV_CACHE_DELETE);
 		SDEV_RELE(dv);
 	}
 
+	if (strcmp(ddv->sdev_path, "/dev/net") != 0) {
+		devnet_fillzdir(ddv);
+		goto done;
+	}
+
 	if (((ddv->sdev_flags & SDEV_BUILD) == 0) && !dls_devnet_rebuild())
 		goto done;
 
 	if (SDEV_IS_GLOBAL(ddv)) {
-		linkid = DATALINK_INVALID_LINKID;
-		do {
-			linkid = dls_mgmt_get_next(linkid, DATALINK_CLASS_ALL,
-			    DATALINK_ANY_MEDIATYPE, DLMGMT_ACTIVE);
-			if (linkid != DATALINK_INVALID_LINKID)
-				(void) devnet_filldir_datalink(linkid, ddv);
-		} while (linkid != DATALINK_INVALID_LINKID);
+		devnet_fillzone(ddv, GLOBAL_ZONEID);
+		(void) devnet_mkdir(ddv, "zone");
 	} else {
-		(void) zone_datalink_walk(getzoneid(),
-		    devnet_filldir_datalink, ddv);
+		devnet_fillzone(ddv, getzoneid());
 	}
 
 	ddv->sdev_flags &= ~SDEV_BUILD;
-
 done:
 	rw_downgrade(&ddv->sdev_contents);
 }
@@ -319,6 +531,9 @@ devnet_readdir(struct vnode *dvp, struct uio *uiop, struct cred *cred,
 
 	ASSERT(sdvp);
 
+	if (crgetzoneid(cred) == GLOBAL_ZONEID && !SDEV_IS_GLOBAL(sdvp))
+		return (EPERM);
+
 	if (uiop->uio_offset == 0)
 		devnet_filldir(sdvp);
 
diff --git a/usr/src/uts/common/fs/dev/sdev_plugin.c b/usr/src/uts/common/fs/dev/sdev_plugin.c
new file mode 100644
index 0000000000..6e1618dc3c
--- /dev/null
+++ b/usr/src/uts/common/fs/dev/sdev_plugin.c
@@ -0,0 +1,948 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+/*
+ * Dynamic directory plugin interface for sdev.
+ *
+ * The sdev plugin interfaces provides a means for a dynamic directory based on
+ * in-kernel state to be simply created. Traditionally, dynamic directories were
+ * built into sdev itself. While these legacy plugins are useful, it makes more
+ * sense for these pieces of functionality to live with the individual drivers.
+ *
+ * The plugin interface requires folks to implement three interfaces and
+ * provides a series of callbacks that can be made in the context of those
+ * interfaces to interrogate the sdev_node_t without having to leak
+ * implementation details of the sdev_node_t. These interfaces are:
+ *
+ *   o spo_validate
+ *
+ *   Given a particular node, answer the question as to whether or not this
+ *   entry is still valid. Here, plugins should use the name and the dev_t
+ *   associated with the node to verify that it matches something that still
+ *   exists.
+ *
+ *   o spo_filldir
+ *
+ *   Fill all the entries inside of a directory. Note that some of these entries
+ *   may already exist.
+ *
+ *   o spo_inactive
+ *
+ *   The given node is no longer being used. This allows the consumer to
+ *   potentially tear down anything that was being held open related to this.
+ *   Note that this only fires when the given sdev_node_t becomes a zombie.
+ *
+ * During these callbacks a consumer is not allowed to register or unregister a
+ * plugin, especially their own. They may call the sdev_ctx style functions. All
+ * callbacks fire in a context where blocking is allowed (eg. the spl is below
+ * LOCK_LEVEL).
+ *
+ * When a plugin is added, we create its directory in the global zone. By doing
+ * that, we ensure that something isn't already there and that nothing else can
+ * come along and try and create something without our knowledge. We only have
+ * to create it in the GZ and not for all other instances of sdev because an
+ * instance of sdev that isn't at /dev does not have dynamic directories, and
+ * second, any instance of sdev present in a non-global zone cannot create
+ * anything, therefore we know that by it not being in the global zone's
+ * instance of sdev that we're good to go.
+ *
+ * Lock Ordering
+ * -------------
+ *
+ * The global sdev_plugin_lock must be held before any of the individual
+ * sdev_plugin_t`sp_lock. Further, once any plugin related lock has been held,
+ * it is not legal to take any holds on any sdev_node_t or to grab the
+ * sdev_node_t`contents_lock in any way.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/fs/sdev_impl.h>
+#include <sys/fs/sdev_plugin.h>
+#include <fs/fs_subr.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/ksynch.h>
+#include <sys/sysmacros.h>
+#include <sys/list.h>
+#include <sys/ctype.h>
+
+kmutex_t sdev_plugin_lock;
+list_t sdev_plugin_list;
+kmem_cache_t *sdev_plugin_cache;
+struct vnodeops *sdev_plugin_vnops;
+
+#define	SDEV_PLUGIN_NAMELEN	64
+
+typedef struct sdev_plugin {
+	list_node_t sp_link;
+	char sp_name[SDEV_PLUGIN_NAMELEN];	/* E */
+	int sp_nflags;				/* E */
+	struct vnodeops *sp_vnops;		/* E */
+	sdev_plugin_ops_t *sp_pops;		/* E */
+	boolean_t sp_islegacy;			/* E */
+	int (*sp_lvtor)(sdev_node_t *);		/* E */
+	kmutex_t sp_lock;			/* Protects everything below */
+	kcondvar_t sp_nodecv;
+	size_t sp_nnodes;
+} sdev_plugin_t;
+
+/* ARGSUSED */
+static int
+sdev_plugin_cache_constructor(void *buf, void *arg, int tags)
+{
+	sdev_plugin_t *spp = buf;
+	mutex_init(&spp->sp_lock, NULL, MUTEX_DRIVER, 0);
+	cv_init(&spp->sp_nodecv, NULL, CV_DRIVER, NULL);
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+sdev_plugin_cache_destructor(void *buf, void *arg)
+{
+	sdev_plugin_t *spp = buf;
+	cv_destroy(&spp->sp_nodecv);
+	mutex_destroy(&spp->sp_lock);
+}
+
+enum vtype
+sdev_ctx_vtype(sdev_ctx_t ctx)
+{
+	sdev_node_t *sdp = (sdev_node_t *)ctx;
+
+	ASSERT(RW_LOCK_HELD(&sdp->sdev_contents));
+	return (sdp->sdev_vnode->v_type);
+}
+
+const char *
+sdev_ctx_path(sdev_ctx_t ctx)
+{
+	sdev_node_t *sdp = (sdev_node_t *)ctx;
+
+	ASSERT(RW_LOCK_HELD(&sdp->sdev_contents));
+	return (sdp->sdev_path);
+}
+
+const char *
+sdev_ctx_name(sdev_ctx_t ctx)
+{
+	sdev_node_t *sdp = (sdev_node_t *)ctx;
+
+	ASSERT(RW_LOCK_HELD(&sdp->sdev_contents));
+	return (sdp->sdev_name);
+}
+
+int
+sdev_ctx_minor(sdev_ctx_t ctx, minor_t *minorp)
+{
+	sdev_node_t *sdp = (sdev_node_t *)ctx;
+
+	ASSERT(RW_LOCK_HELD(&sdp->sdev_contents));
+	ASSERT(minorp != NULL);
+	if (sdp->sdev_vnode->v_type == VCHR ||
+	    sdp->sdev_vnode->v_type == VBLK) {
+		*minorp = getminor(sdp->sdev_vnode->v_rdev);
+		return (0);
+	}
+
+	return (ENODEV);
+}
+
+/*
+ * Currently we only support psasing through a single flag -- SDEV_IS_GLOBAL.
+ */
+sdev_ctx_flags_t
+sdev_ctx_flags(sdev_ctx_t ctx)
+{
+	sdev_node_t *sdp = (sdev_node_t *)ctx;
+
+	ASSERT(RW_LOCK_HELD(&sdp->sdev_contents));
+	return (sdp->sdev_flags & SDEV_GLOBAL);
+}
+
+/*
+ * Use the same rules as zones for a name. isalphanum + '-', '_', and '.'.
+ */
+static int
+sdev_plugin_name_isvalid(const char *c, int buflen)
+{
+	int i;
+
+	for (i = 0; i < buflen; i++, c++) {
+		if (*c == '\0')
+			return (1);
+
+		if (!isalnum(*c) && *c != '-' && *c != '_' && *c != '.')
+			return (0);
+	}
+	/* Never found a null terminator */
+	return (0);
+}
+
+static int
+sdev_plugin_mknode(sdev_plugin_t *spp, sdev_node_t *sdvp, char *name,
+    vattr_t *vap)
+{
+	int ret;
+	sdev_node_t *svp;
+
+	ASSERT(RW_WRITE_HELD(&sdvp->sdev_contents));
+	ASSERT(spp != NULL);
+	svp = sdev_cache_lookup(sdvp, name);
+	if (svp != NULL) {
+		SDEV_SIMPLE_RELE(svp);
+		return (EEXIST);
+	}
+
+	ret = sdev_mknode(sdvp, name, &svp, vap, NULL, NULL, kcred,
+	    SDEV_READY);
+	if (ret != 0)
+		return (ret);
+	SDEV_SIMPLE_RELE(svp);
+
+	return (0);
+}
+
+/*
+ * Plugin node creation callbacks
+ */
+int
+sdev_plugin_mkdir(sdev_ctx_t ctx, char *name)
+{
+	sdev_node_t *sdvp;
+	timestruc_t now;
+	struct vattr vap;
+
+	if (sdev_plugin_name_isvalid(name, SDEV_PLUGIN_NAMELEN) == 0)
+		return (EINVAL);
+
+	sdvp = (sdev_node_t *)ctx;
+	ASSERT(sdvp->sdev_private != NULL);
+	ASSERT(RW_WRITE_HELD(&sdvp->sdev_contents));
+
+	vap = *sdev_getdefault_attr(VDIR);
+	gethrestime(&now);
+	vap.va_atime = now;
+	vap.va_mtime = now;
+	vap.va_ctime = now;
+
+	return (sdev_plugin_mknode(sdvp->sdev_private, sdvp, name, &vap));
+}
+
+int
+sdev_plugin_mknod(sdev_ctx_t ctx, char *name, mode_t mode, dev_t dev)
+{
+	sdev_node_t *sdvp;
+	timestruc_t now;
+	struct vattr vap;
+	mode_t type = mode & S_IFMT;
+	mode_t access = mode & S_IAMB;
+
+	if (sdev_plugin_name_isvalid(name, SDEV_PLUGIN_NAMELEN) == 0)
+		return (EINVAL);
+
+	sdvp = (sdev_node_t *)ctx;
+	ASSERT(RW_WRITE_HELD(&sdvp->sdev_contents));
+
+	/*
+	 * Ensure only type and user/group/other permission bits are present.
+	 * Do not allow setuid, setgid, etc.
+	 */
+	if ((mode & ~(S_IFMT | S_IAMB)) != 0)
+		return (EINVAL);
+
+	/* Disallow types other than character and block devices */
+	if (type != S_IFCHR && type != S_IFBLK)
+		return (EINVAL);
+
+	/* Disallow execute bits */
+	if ((access & (S_IXUSR | S_IXGRP | S_IXOTH)) != 0)
+		return (EINVAL);
+
+	/* No bits other than 0666 in access */
+	ASSERT((access &
+	    ~(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH)) == 0);
+
+	/* Default to relatively safe access bits if none specified. */
+	if (access == 0)
+		access = 0600;
+
+	ASSERT(sdvp->sdev_private != NULL);
+
+	vap = *sdev_getdefault_attr(type == S_IFCHR ? VCHR : VBLK);
+	gethrestime(&now);
+	vap.va_atime = now;
+	vap.va_mtime = now;
+	vap.va_ctime = now;
+	vap.va_rdev = dev;
+	vap.va_mode = type | access;
+
+	/* Despite the similar name, this is in fact a different function */
+	return (sdev_plugin_mknode(sdvp->sdev_private, sdvp, name, &vap));
+}
+
+static int
+sdev_plugin_validate(sdev_node_t *sdp)
+{
+	int ret;
+	sdev_plugin_t *spp;
+
+	ASSERT(sdp->sdev_private != NULL);
+	spp = sdp->sdev_private;
+	ASSERT(spp->sp_islegacy == B_FALSE);
+	ASSERT(spp->sp_pops != NULL);
+	rw_enter(&sdp->sdev_contents, RW_READER);
+	ret = spp->sp_pops->spo_validate((uintptr_t)sdp);
+	rw_exit(&sdp->sdev_contents);
+	return (ret);
+}
+
+static void
+sdev_plugin_validate_dir(sdev_node_t *sdvp)
+{
+	int ret;
+	sdev_node_t *svp, *next;
+
+	ASSERT(RW_WRITE_HELD(&sdvp->sdev_contents));
+
+	for (svp = SDEV_FIRST_ENTRY(sdvp); svp != NULL; svp = next) {
+
+		next = SDEV_NEXT_ENTRY(sdvp, svp);
+		ASSERT(svp->sdev_state != SDEV_ZOMBIE);
+		/* skip nodes that aren't ready */
+		if (svp->sdev_state == SDEV_INIT)
+			continue;
+
+		switch (sdev_plugin_validate(svp)) {
+		case SDEV_VTOR_VALID:
+		case SDEV_VTOR_SKIP:
+			continue;
+		case SDEV_VTOR_INVALID:
+		case SDEV_VTOR_STALE:
+			break;
+		}
+
+		SDEV_HOLD(svp);
+
+		/*
+		 * Clean out everything underneath this node before we
+		 * remove it.
+		 */
+		if (svp->sdev_vnode->v_type == VDIR) {
+			ret = sdev_cleandir(svp, NULL, 0);
+			ASSERT(ret == 0);
+		}
+		/* remove the cache node */
+		(void) sdev_cache_update(sdvp, &svp, svp->sdev_name,
+		    SDEV_CACHE_DELETE);
+		SDEV_RELE(svp);
+	}
+}
+
+/* ARGSUSED */
+static int
+sdev_plugin_vop_readdir(struct vnode *dvp, struct uio *uiop, struct cred *cred,
+    int *eofp, caller_context_t *ct_unused, int flags_unused)
+{
+	int ret;
+	sdev_node_t *sdvp = VTOSDEV(dvp);
+	sdev_plugin_t *spp;
+
+	ASSERT(RW_READ_HELD(&sdvp->sdev_contents));
+
+	/* Sanity check we're not a zombie before we do anyting else */
+	if (sdvp->sdev_state == SDEV_ZOMBIE)
+		return (ENOENT);
+
+	spp = sdvp->sdev_private;
+	ASSERT(spp != NULL);
+	ASSERT(spp->sp_islegacy == B_FALSE);
+	ASSERT(spp->sp_pops != NULL);
+
+	if (crgetzoneid(cred) == GLOBAL_ZONEID && !SDEV_IS_GLOBAL(sdvp))
+		return (EPERM);
+
+	if (uiop->uio_offset == 0) {
+		/*
+		 * We upgrade to a write lock and grab the plugin's lock along
+		 * the way. We're almost certainly going to get creation
+		 * callbacks, so this is the only safe way to go.
+		 */
+		if (rw_tryupgrade(&sdvp->sdev_contents) == 0) {
+			rw_exit(&sdvp->sdev_contents);
+			rw_enter(&sdvp->sdev_contents, RW_WRITER);
+			if (sdvp->sdev_state == SDEV_ZOMBIE) {
+				rw_downgrade(&sdvp->sdev_contents);
+				return (ENOENT);
+			}
+		}
+
+		sdev_plugin_validate_dir(sdvp);
+		ret = spp->sp_pops->spo_filldir((uintptr_t)sdvp);
+		rw_downgrade(&sdvp->sdev_contents);
+		if (ret != 0)
+			return (ret);
+	}
+
+	return (devname_readdir_func(dvp, uiop, cred, eofp, 0));
+}
+
+/*
+ * If we don't have a callback function that returns a failure, then sdev will
+ * try to create a node for us which violates all of our basic assertions. To
+ * work around that we create our own callback for devname_lookup_func which
+ * always returns ENOENT as at this point either it was created with the filldir
+ * callback or it was not.
+ */
+/*ARGSUSED*/
+static int
+sdev_plugin_vop_lookup_cb(sdev_node_t *ddv, char *nm, void **arg, cred_t *cred,
+    void *unused, char *unused2)
+{
+	return (ENOENT);
+}
+
+/* ARGSUSED */
+static int
+sdev_plugin_vop_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
+    struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cred,
+    caller_context_t *ct, int *direntflags, pathname_t *realpnp)
+{
+	int ret;
+	sdev_node_t *sdvp;
+	sdev_plugin_t *spp;
+
+	/* execute access is required to search the directory */
+	if ((ret = VOP_ACCESS(dvp, VEXEC, 0, cred, ct)) != 0)
+		return (ret);
+
+	sdvp = VTOSDEV(dvp);
+	spp = sdvp->sdev_private;
+	ASSERT(spp != NULL);
+	ASSERT(spp->sp_islegacy == B_FALSE);
+	ASSERT(spp->sp_pops != NULL);
+
+	if (crgetzoneid(cred) == GLOBAL_ZONEID && !SDEV_IS_GLOBAL(sdvp))
+		return (EPERM);
+
+	/*
+	 * Go straight for the write lock.
+	 */
+	rw_enter(&sdvp->sdev_contents, RW_WRITER);
+	if (sdvp->sdev_state == SDEV_ZOMBIE) {
+		rw_exit(&sdvp->sdev_contents);
+		return (ENOENT);
+	}
+	sdev_plugin_validate_dir(sdvp);
+	ret = spp->sp_pops->spo_filldir((uintptr_t)sdvp);
+	rw_exit(&sdvp->sdev_contents);
+	if (ret != 0)
+		return (ret);
+
+	return (devname_lookup_func(sdvp, nm, vpp, cred,
+	    sdev_plugin_vop_lookup_cb, SDEV_VATTR));
+}
+
+/*
+ * sdev is not a good citizen. We get inactive callbacks whenever a vnode goes
+ * to zero, but isn't necessairily a zombie yet. As such, to make things easier
+ * for users, we only fire the inactive callback when the node becomes a zombie
+ * and thus will be torn down here.
+ */
+static void
+sdev_plugin_vop_inactive_cb(struct vnode *dvp)
+{
+	sdev_node_t *sdp = VTOSDEV(dvp);
+	sdev_plugin_t *spp = sdp->sdev_private;
+
+	rw_enter(&sdp->sdev_contents, RW_READER);
+	if (sdp->sdev_state != SDEV_ZOMBIE) {
+		rw_exit(&sdp->sdev_contents);
+		return;
+	}
+	spp->sp_pops->spo_inactive((uintptr_t)sdp);
+	mutex_enter(&spp->sp_lock);
+	VERIFY(spp->sp_nnodes > 0);
+	spp->sp_nnodes--;
+	cv_signal(&spp->sp_nodecv);
+	mutex_exit(&spp->sp_lock);
+	rw_exit(&sdp->sdev_contents);
+}
+
+/*ARGSUSED*/
+static void
+sdev_plugin_vop_inactive(struct vnode *dvp, struct cred *cred,
+    caller_context_t *ct)
+{
+	sdev_node_t *sdp = VTOSDEV(dvp);
+	sdev_plugin_t *spp = sdp->sdev_private;
+	ASSERT(sdp->sdev_private != NULL);
+	ASSERT(spp->sp_islegacy == B_FALSE);
+	devname_inactive_func(dvp, cred, sdev_plugin_vop_inactive_cb);
+}
+
+const fs_operation_def_t sdev_plugin_vnodeops_tbl[] = {
+	VOPNAME_READDIR,	{ .vop_readdir = sdev_plugin_vop_readdir },
+	VOPNAME_LOOKUP,		{ .vop_lookup = sdev_plugin_vop_lookup },
+	VOPNAME_INACTIVE,	{ .vop_inactive = sdev_plugin_vop_inactive },
+	VOPNAME_CREATE,		{ .error = fs_nosys },
+	VOPNAME_REMOVE,		{ .error = fs_nosys },
+	VOPNAME_MKDIR,		{ .error = fs_nosys },
+	VOPNAME_RMDIR,		{ .error = fs_nosys },
+	VOPNAME_SYMLINK,	{ .error = fs_nosys },
+	VOPNAME_SETSECATTR,	{ .error = fs_nosys },
+	NULL,			NULL
+};
+
+/*
+ * construct a new template with overrides from vtab
+ */
+static fs_operation_def_t *
+sdev_merge_vtab(const fs_operation_def_t tab[])
+{
+	fs_operation_def_t *new;
+	const fs_operation_def_t *tab_entry;
+
+	/* make a copy of standard vnode ops table */
+	new = kmem_alloc(sdev_vnodeops_tbl_size, KM_SLEEP);
+	bcopy((void *)sdev_vnodeops_tbl, new, sdev_vnodeops_tbl_size);
+
+	/* replace the overrides from tab */
+	for (tab_entry = tab; tab_entry->name != NULL; tab_entry++) {
+		fs_operation_def_t *std_entry = new;
+		while (std_entry->name) {
+			if (strcmp(tab_entry->name, std_entry->name) == 0) {
+				std_entry->func = tab_entry->func;
+				break;
+			}
+			std_entry++;
+		}
+	}
+
+	return (new);
+}
+
+/* free memory allocated by sdev_merge_vtab */
+static void
+sdev_free_vtab(fs_operation_def_t *new)
+{
+	kmem_free(new, sdev_vnodeops_tbl_size);
+}
+
+/*
+ * Register a new plugin.
+ */
+sdev_plugin_hdl_t
+sdev_plugin_register(const char *name, sdev_plugin_ops_t *ops, int *errp)
+{
+	char buf[sizeof ("dev")] = "";
+	struct pathname pn = { 0 };
+	sdev_plugin_t *spp, *iter;
+	vnode_t *vp, *nvp;
+	sdev_node_t *sdp, *slp;
+	timestruc_t now;
+	struct vattr vap;
+	int ret, err;
+
+	/*
+	 * Some consumers don't care about why they failed. To keep the code
+	 * simple, we'll just pretend they gave us something.
+	 */
+	if (errp == NULL)
+		errp = &err;
+
+	if (sdev_plugin_name_isvalid(name, SDEV_PLUGIN_NAMELEN) == 0) {
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	if (ops->spo_version != 1) {
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	if (ops->spo_validate == NULL || ops->spo_filldir == NULL ||
+	    ops->spo_inactive == NULL) {
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	if ((ops->spo_flags & ~SDEV_PLUGIN_FLAGS_MASK) != 0) {
+		*errp = EINVAL;
+		return (NULL);
+	}
+
+	spp = kmem_cache_alloc(sdev_plugin_cache, KM_SLEEP);
+	(void) strlcpy(spp->sp_name, name, SDEV_PLUGIN_NAMELEN);
+
+	spp->sp_pops = ops;
+	spp->sp_nflags = SDEV_DYNAMIC | SDEV_VTOR;
+	if (ops->spo_flags & SDEV_PLUGIN_NO_NCACHE)
+		spp->sp_nflags |= SDEV_NO_NCACHE;
+	if (ops->spo_flags & SDEV_PLUGIN_SUBDIR)
+		spp->sp_nflags |= SDEV_SUBDIR;
+	spp->sp_vnops = sdev_plugin_vnops;
+	spp->sp_islegacy = B_FALSE;
+	spp->sp_lvtor = NULL;
+	spp->sp_nnodes = 0;
+
+	/*
+	 * Make sure our /dev entry is unique and install it.  We also need to
+	 * go through and grab the sdev root node as we cannot grab any sdev
+	 * node locks once we've grabbed the sdev_plugin_lock. We effectively
+	 * assert that if a directory is not present in the GZ's /dev, then it
+	 * doesn't exist in any of the local zones.
+	 *
+	 * Note that we may be in NGZ context: during a prof_filldir(".../dev/")
+	 * enumeration, for example. So we have to dig as deep as lookuppnvp()
+	 * to make sure we really get to the global /dev (i.e.  escape both
+	 * CRED() and ->u_rdir).
+	 */
+	pn_get_buf("dev", UIO_SYSSPACE, &pn, buf, sizeof (buf));
+	VN_HOLD(rootdir);
+	ret = lookuppnvp(&pn, NULL, NO_FOLLOW, NULLVPP,
+	    &vp, rootdir, rootdir, kcred);
+
+	if (ret != 0) {
+		*errp = ret;
+		kmem_cache_free(sdev_plugin_cache, spp);
+		return (NULL);
+	}
+	/* Make sure we have the real vnode */
+	if (VOP_REALVP(vp, &nvp, NULL) == 0) {
+		VN_HOLD(nvp);
+		VN_RELE(vp);
+		vp = nvp;
+		nvp = NULL;
+	}
+	VERIFY(vp->v_op == sdev_vnodeops);
+	sdp = VTOSDEV(vp);
+	rw_enter(&sdp->sdev_contents, RW_WRITER);
+	slp = sdev_cache_lookup(sdp, spp->sp_name);
+	if (slp != NULL) {
+		SDEV_RELE(slp);
+		rw_exit(&sdp->sdev_contents);
+		VN_RELE(vp);
+		*errp = EEXIST;
+		kmem_cache_free(sdev_plugin_cache, spp);
+		return (NULL);
+	}
+
+	mutex_enter(&sdev_plugin_lock);
+	for (iter = list_head(&sdev_plugin_list); iter != NULL;
+	    iter = list_next(&sdev_plugin_list, iter)) {
+		if (strcmp(spp->sp_name, iter->sp_name) == 0) {
+			mutex_exit(&sdev_plugin_lock);
+			rw_exit(&sdp->sdev_contents);
+			VN_RELE(vp);
+			*errp = EEXIST;
+			kmem_cache_free(sdev_plugin_cache, spp);
+			return (NULL);
+		}
+	}
+
+	list_insert_tail(&sdev_plugin_list, spp);
+	mutex_exit(&sdev_plugin_lock);
+
+	/*
+	 * Now go ahead and create the top level directory for the global zone.
+	 */
+	vap = *sdev_getdefault_attr(VDIR);
+	gethrestime(&now);
+	vap.va_atime = now;
+	vap.va_mtime = now;
+	vap.va_ctime = now;
+
+	(void) sdev_plugin_mknode(spp, sdp, spp->sp_name, &vap);
+
+	rw_exit(&sdp->sdev_contents);
+	VN_RELE(vp);
+
+	*errp = 0;
+
+	return ((sdev_plugin_hdl_t)spp);
+}
+
+static void
+sdev_plugin_unregister_cb(sdev_node_t *rdp, void *arg)
+{
+	sdev_plugin_t *spp = arg;
+	sdev_node_t *sdp;
+
+	rw_enter(&rdp->sdev_contents, RW_WRITER);
+	sdp = sdev_cache_lookup(rdp, spp->sp_name);
+	/* If it doesn't exist, we're done here */
+	if (sdp == NULL) {
+		rw_exit(&rdp->sdev_contents);
+		return;
+	}
+
+	/*
+	 * We first delete the directory before recursively marking everything
+	 * else stale. This ordering should ensure that we don't accidentally
+	 * miss anything.
+	 */
+	sdev_cache_update(rdp, &sdp, spp->sp_name, SDEV_CACHE_DELETE);
+	sdev_stale(sdp);
+	SDEV_RELE(sdp);
+	rw_exit(&rdp->sdev_contents);
+}
+
+int sdev_plugin_unregister_allowed;
+
+/*
+ * Remove a plugin. This will block until everything has become a zombie, thus
+ * guaranteeing the caller that nothing will call into them again once this call
+ * returns. While the call is ongoing, it could be called into. Note that while
+ * this is ongoing, it will block other mounts.
+ *
+ * NB: this is not safe when used from detach() context - we will be DEVI_BUSY,
+ * and other sdev threads may be waiting for this.  Only use the over-ride if
+ * willing to risk it.
+ */
+int
+sdev_plugin_unregister(sdev_plugin_hdl_t hdl)
+{
+	sdev_plugin_t *spp = (sdev_plugin_t *)hdl;
+	if (spp->sp_islegacy)
+		return (EINVAL);
+
+	if (!sdev_plugin_unregister_allowed)
+		return (EBUSY);
+
+	mutex_enter(&sdev_plugin_lock);
+	list_remove(&sdev_plugin_list, spp);
+	mutex_exit(&sdev_plugin_lock);
+
+	sdev_mnt_walk(sdev_plugin_unregister_cb, spp);
+	mutex_enter(&spp->sp_lock);
+	while (spp->sp_nnodes > 0)
+		cv_wait(&spp->sp_nodecv, &spp->sp_lock);
+	mutex_exit(&spp->sp_lock);
+	kmem_cache_free(sdev_plugin_cache, spp);
+	return (0);
+}
+
+/*
+ * Register an old sdev style plugin to deal with what used to be in the vtab.
+ */
+static int
+sdev_plugin_register_legacy(struct sdev_vop_table *vtp)
+{
+	sdev_plugin_t *spp;
+
+	spp = kmem_cache_alloc(sdev_plugin_cache, KM_SLEEP);
+	(void) strlcpy(spp->sp_name, vtp->vt_name, SDEV_PLUGIN_NAMELEN);
+	spp->sp_islegacy = B_TRUE;
+	spp->sp_pops = NULL;
+	spp->sp_nflags = vtp->vt_flags;
+	spp->sp_lvtor = vtp->vt_vtor;
+	spp->sp_nnodes = 0;
+
+	if (vtp->vt_service != NULL) {
+		fs_operation_def_t *templ;
+		templ = sdev_merge_vtab(vtp->vt_service);
+		if (vn_make_ops(vtp->vt_name,
+		    (const fs_operation_def_t *)templ,
+		    &spp->sp_vnops) != 0) {
+			cmn_err(CE_WARN, "%s: malformed vnode ops\n",
+			    vtp->vt_name);
+			sdev_free_vtab(templ);
+			kmem_cache_free(sdev_plugin_cache, spp);
+			return (1);
+		}
+
+		if (vtp->vt_global_vops) {
+			*(vtp->vt_global_vops) = spp->sp_vnops;
+		}
+
+		sdev_free_vtab(templ);
+	} else {
+		spp->sp_vnops = sdev_vnodeops;
+	}
+
+	/*
+	 * No need to check for EEXIST here. These are loaded as a part of the
+	 * sdev's initialization function. Further, we don't have to create them
+	 * as that's taken care of in sdev's mount for the GZ.
+	 */
+	mutex_enter(&sdev_plugin_lock);
+	list_insert_tail(&sdev_plugin_list, spp);
+	mutex_exit(&sdev_plugin_lock);
+
+	return (0);
+}
+
+/*
+ * We need to match off of the sdev_path, not the sdev_name. We are only allowed
+ * to exist directly under /dev.
+ */
+static sdev_plugin_t *
+sdev_match(sdev_node_t *dv)
+{
+	int vlen;
+	const char *path;
+	sdev_plugin_t *spp;
+
+	if (strlen(dv->sdev_path) <= 5)
+		return (NULL);
+
+	if (strncmp(dv->sdev_path, "/dev/", 5) != 0)
+		return (NULL);
+	path = dv->sdev_path + 5;
+
+	mutex_enter(&sdev_plugin_lock);
+
+	for (spp = list_head(&sdev_plugin_list); spp != NULL;
+	    spp = list_next(&sdev_plugin_list, spp)) {
+		if (strcmp(spp->sp_name, path) == 0) {
+			mutex_exit(&sdev_plugin_lock);
+			return (spp);
+		}
+
+		if (spp->sp_nflags & SDEV_SUBDIR) {
+			vlen = strlen(spp->sp_name);
+			if ((strncmp(spp->sp_name, path,
+			    vlen - 1) == 0) && path[vlen] == '/') {
+				mutex_exit(&sdev_plugin_lock);
+				return (spp);
+			}
+
+		}
+	}
+
+	mutex_exit(&sdev_plugin_lock);
+	return (NULL);
+}
+
+void
+sdev_set_no_negcache(sdev_node_t *dv)
+{
+	char *path;
+	sdev_plugin_t *spp;
+
+	ASSERT(dv->sdev_path);
+	path = dv->sdev_path + strlen("/dev/");
+
+	mutex_enter(&sdev_plugin_lock);
+	for (spp = list_head(&sdev_plugin_list); spp != NULL;
+	    spp = list_next(&sdev_plugin_list, spp)) {
+		if (strcmp(spp->sp_name, path) == 0) {
+			if (spp->sp_nflags & SDEV_NO_NCACHE)
+				dv->sdev_flags |= SDEV_NO_NCACHE;
+			break;
+		}
+	}
+	mutex_exit(&sdev_plugin_lock);
+}
+
+struct vnodeops *
+sdev_get_vop(sdev_node_t *dv)
+{
+	char *path;
+	sdev_plugin_t *spp;
+
+	path = dv->sdev_path;
+	ASSERT(path);
+
+	/* gets the relative path to /dev/ */
+	path += 5;
+
+	if ((spp = sdev_match(dv)) != NULL) {
+		dv->sdev_flags |= spp->sp_nflags;
+		if (SDEV_IS_PERSIST(dv->sdev_dotdot) &&
+		    (SDEV_IS_PERSIST(dv) || !SDEV_IS_DYNAMIC(dv)))
+			dv->sdev_flags |= SDEV_PERSIST;
+		return (spp->sp_vnops);
+	}
+
+	/* child inherits the persistence of the parent */
+	if (SDEV_IS_PERSIST(dv->sdev_dotdot))
+		dv->sdev_flags |= SDEV_PERSIST;
+	return (sdev_vnodeops);
+}
+
+void *
+sdev_get_vtor(sdev_node_t *dv)
+{
+	sdev_plugin_t *spp;
+
+	if (dv->sdev_private == NULL) {
+		spp = sdev_match(dv);
+		if (spp == NULL)
+			return (NULL);
+	} else {
+		spp = dv->sdev_private;
+	}
+
+	if (spp->sp_islegacy)
+		return ((void *)spp->sp_lvtor);
+	else
+		return ((void *)sdev_plugin_validate);
+}
+
+void
+sdev_plugin_nodeready(sdev_node_t *sdp)
+{
+	sdev_plugin_t *spp;
+
+	ASSERT(RW_WRITE_HELD(&sdp->sdev_contents));
+	ASSERT(sdp->sdev_private == NULL);
+
+	spp = sdev_match(sdp);
+	if (spp == NULL)
+		return;
+	if (spp->sp_islegacy)
+		return;
+	sdp->sdev_private = spp;
+	mutex_enter(&spp->sp_lock);
+	spp->sp_nnodes++;
+	mutex_exit(&spp->sp_lock);
+}
+
+int
+sdev_plugin_init(void)
+{
+	sdev_vop_table_t *vtp;
+	fs_operation_def_t *templ;
+
+	sdev_plugin_cache = kmem_cache_create("sdev_plugin",
+	    sizeof (sdev_plugin_t), 0, sdev_plugin_cache_constructor,
+	    sdev_plugin_cache_destructor, NULL, NULL, NULL, 0);
+	if (sdev_plugin_cache == NULL)
+		return (1);
+	mutex_init(&sdev_plugin_lock, NULL, MUTEX_DRIVER, NULL);
+	list_create(&sdev_plugin_list, sizeof (sdev_plugin_t),
+	    offsetof(sdev_plugin_t, sp_link));
+
+	/*
+	 * Register all of the legacy vnops
+	 */
+	for (vtp = &vtab[0]; vtp->vt_name != NULL; vtp++)
+		if (sdev_plugin_register_legacy(vtp) != 0)
+			return (1);
+
+	templ = sdev_merge_vtab(sdev_plugin_vnodeops_tbl);
+	if (vn_make_ops("sdev_plugin",
+	    (const fs_operation_def_t *)templ,
+	    &sdev_plugin_vnops) != 0) {
+		sdev_free_vtab(templ);
+		return (1);
+	}
+
+	sdev_free_vtab(templ);
+	return (0);
+}
diff --git a/usr/src/uts/common/fs/dev/sdev_subr.c b/usr/src/uts/common/fs/dev/sdev_subr.c
index d810dd9a31..42a3874b95 100644
--- a/usr/src/uts/common/fs/dev/sdev_subr.c
+++ b/usr/src/uts/common/fs/dev/sdev_subr.c
@@ -151,12 +151,6 @@ vattr_t sdev_vattr_chr = {
 kmem_cache_t	*sdev_node_cache;	/* sdev_node cache */
 int		devtype;		/* fstype */
 
-/* static */
-static struct vnodeops *sdev_get_vop(struct sdev_node *);
-static void sdev_set_no_negcache(struct sdev_node *);
-static fs_operation_def_t *sdev_merge_vtab(const fs_operation_def_t []);
-static void sdev_free_vtab(fs_operation_def_t *);
-
 static void
 sdev_prof_free(struct sdev_node *dv)
 {
@@ -314,6 +308,7 @@ sdev_nodeinit(struct sdev_node *ddv, char *nm, struct sdev_node **newdv,
 	(void) snprintf(dv->sdev_path, len, "%s/%s", ddv->sdev_path, nm);
 	/* overwritten for VLNK nodes */
 	dv->sdev_symlink = NULL;
+	list_link_init(&dv->sdev_plist);
 
 	vp = SDEVTOV(dv);
 	vn_reinit(vp);
@@ -402,6 +397,7 @@ sdev_nodeready(struct sdev_node *dv, struct vattr *vap, struct vnode *avp,
 	} else {
 		dv->sdev_nlink = 1;
 	}
+	sdev_plugin_nodeready(dv);
 
 	if (!(SDEV_IS_GLOBAL(dv))) {
 		dv->sdev_origin = (struct sdev_node *)args;
@@ -498,37 +494,22 @@ sdev_mkroot(struct vfs *vfsp, dev_t devdev, struct vnode *mvp,
 	return (dv);
 }
 
-/* directory dependent vop table */
-struct sdev_vop_table {
-	char *vt_name;				/* subdirectory name */
-	const fs_operation_def_t *vt_service;	/* vnodeops table */
-	struct vnodeops *vt_vops;		/* constructed vop */
-	struct vnodeops **vt_global_vops;	/* global container for vop */
-	int (*vt_vtor)(struct sdev_node *);	/* validate sdev_node */
-	int vt_flags;
-};
-
-/*
- * A nice improvement would be to provide a plug-in mechanism
- * for this table instead of a const table.
- */
-static struct sdev_vop_table vtab[] =
-{
-	{ "pts", devpts_vnodeops_tbl, NULL, &devpts_vnodeops, devpts_validate,
+struct sdev_vop_table vtab[] = {
+	{ "pts", devpts_vnodeops_tbl, &devpts_vnodeops, devpts_validate,
 	SDEV_DYNAMIC | SDEV_VTOR },
 
-	{ "vt", devvt_vnodeops_tbl, NULL, &devvt_vnodeops, devvt_validate,
+	{ "vt", devvt_vnodeops_tbl, &devvt_vnodeops, devvt_validate,
 	SDEV_DYNAMIC | SDEV_VTOR },
 
-	{ "zvol", devzvol_vnodeops_tbl, NULL, &devzvol_vnodeops,
+	{ "zvol", devzvol_vnodeops_tbl, &devzvol_vnodeops,
 	devzvol_validate, SDEV_ZONED | SDEV_DYNAMIC | SDEV_VTOR | SDEV_SUBDIR },
 
-	{ "zcons", NULL, NULL, NULL, NULL, SDEV_NO_NCACHE },
+	{ "zcons", NULL, NULL, NULL, SDEV_NO_NCACHE },
 
-	{ "net", devnet_vnodeops_tbl, NULL, &devnet_vnodeops, devnet_validate,
-	SDEV_DYNAMIC | SDEV_VTOR },
+	{ "net", devnet_vnodeops_tbl, &devnet_vnodeops, devnet_validate,
+	SDEV_DYNAMIC | SDEV_VTOR | SDEV_SUBDIR },
 
-	{ "ipnet", devipnet_vnodeops_tbl, NULL, &devipnet_vnodeops,
+	{ "ipnet", devipnet_vnodeops_tbl, &devipnet_vnodeops,
 	devipnet_validate, SDEV_DYNAMIC | SDEV_VTOR | SDEV_NO_NCACHE },
 
 	/*
@@ -543,132 +524,14 @@ static struct sdev_vop_table vtab[] =
 	 * preventing a mkdir.
 	 */
 
-	{ "lofi", NULL, NULL, NULL, NULL,
+	{ "lofi", NULL, NULL, NULL,
 	    SDEV_ZONED | SDEV_DYNAMIC | SDEV_PERSIST },
-	{ "rlofi", NULL, NULL, NULL, NULL,
+	{ "rlofi", NULL, NULL, NULL,
 	    SDEV_ZONED | SDEV_DYNAMIC | SDEV_PERSIST },
 
-	{ NULL, NULL, NULL, NULL, NULL, 0}
+	{ NULL, NULL, NULL, NULL, 0}
 };
 
-/*
- * We need to match off of the sdev_path, not the sdev_name. We are only allowed
- * to exist directly under /dev.
- */
-struct sdev_vop_table *
-sdev_match(struct sdev_node *dv)
-{
-	int vlen;
-	int i;
-	const char *path;
-
-	if (strlen(dv->sdev_path) <= 5)
-		return (NULL);
-
-	if (strncmp(dv->sdev_path, "/dev/", 5) != 0)
-		return (NULL);
-	path = dv->sdev_path + 5;
-
-	for (i = 0; vtab[i].vt_name; i++) {
-		if (strcmp(vtab[i].vt_name, path) == 0)
-			return (&vtab[i]);
-		if (vtab[i].vt_flags & SDEV_SUBDIR) {
-			vlen = strlen(vtab[i].vt_name);
-			if ((strncmp(vtab[i].vt_name, path,
-			    vlen - 1) == 0) && path[vlen] == '/')
-				return (&vtab[i]);
-		}
-
-	}
-	return (NULL);
-}
-
-/*
- *  sets a directory's vnodeops if the directory is in the vtab;
- */
-static struct vnodeops *
-sdev_get_vop(struct sdev_node *dv)
-{
-	struct sdev_vop_table *vtp;
-	char *path;
-
-	path = dv->sdev_path;
-	ASSERT(path);
-
-	/* gets the relative path to /dev/ */
-	path += 5;
-
-	/* gets the vtab entry it matches */
-	if ((vtp = sdev_match(dv)) != NULL) {
-		dv->sdev_flags |= vtp->vt_flags;
-		if (SDEV_IS_PERSIST(dv->sdev_dotdot) &&
-		    (SDEV_IS_PERSIST(dv) || !SDEV_IS_DYNAMIC(dv)))
-			dv->sdev_flags |= SDEV_PERSIST;
-
-		if (vtp->vt_vops) {
-			if (vtp->vt_global_vops)
-				*(vtp->vt_global_vops) = vtp->vt_vops;
-
-			return (vtp->vt_vops);
-		}
-
-		if (vtp->vt_service) {
-			fs_operation_def_t *templ;
-			templ = sdev_merge_vtab(vtp->vt_service);
-			if (vn_make_ops(vtp->vt_name,
-			    (const fs_operation_def_t *)templ,
-			    &vtp->vt_vops) != 0) {
-				cmn_err(CE_PANIC, "%s: malformed vnode ops\n",
-				    vtp->vt_name);
-				/*NOTREACHED*/
-			}
-			if (vtp->vt_global_vops) {
-				*(vtp->vt_global_vops) = vtp->vt_vops;
-			}
-			sdev_free_vtab(templ);
-
-			return (vtp->vt_vops);
-		}
-
-		return (sdev_vnodeops);
-	}
-
-	/* child inherits the persistence of the parent */
-	if (SDEV_IS_PERSIST(dv->sdev_dotdot))
-		dv->sdev_flags |= SDEV_PERSIST;
-
-	return (sdev_vnodeops);
-}
-
-static void
-sdev_set_no_negcache(struct sdev_node *dv)
-{
-	int i;
-	char *path;
-
-	ASSERT(dv->sdev_path);
-	path = dv->sdev_path + strlen("/dev/");
-
-	for (i = 0; vtab[i].vt_name; i++) {
-		if (strcmp(vtab[i].vt_name, path) == 0) {
-			if (vtab[i].vt_flags & SDEV_NO_NCACHE)
-				dv->sdev_flags |= SDEV_NO_NCACHE;
-			break;
-		}
-	}
-}
-
-void *
-sdev_get_vtor(struct sdev_node *dv)
-{
-	struct sdev_vop_table *vtp;
-
-	vtp = sdev_match(dv);
-	if (vtp)
-		return ((void *)vtp->vt_vtor);
-	else
-		return (NULL);
-}
 
 /*
  * Build the base root inode
@@ -948,8 +811,11 @@ sdev_nodedestroy(struct sdev_node *dv, uint_t flags)
 		dv->sdev_path = NULL;
 	}
 
-	if (!SDEV_IS_GLOBAL(dv))
+	if (!SDEV_IS_GLOBAL(dv)) {
 		sdev_prof_free(dv);
+		if (dv->sdev_vnode->v_type != VLNK && dv->sdev_origin != NULL)
+			SDEV_RELE(dv->sdev_origin);
+	}
 
 	if (SDEVTOV(dv)->v_type == VDIR) {
 		ASSERT(SDEV_FIRST_ENTRY(dv) == NULL);
@@ -963,6 +829,7 @@ sdev_nodedestroy(struct sdev_node *dv, uint_t flags)
 	(void) memset((void *)&dv->sdev_instance_data, 0,
 	    sizeof (dv->sdev_instance_data));
 	vn_invalid(SDEVTOV(dv));
+	dv->sdev_private = NULL;
 	kmem_cache_free(sdev_node_cache, dv);
 }
 
@@ -2945,46 +2812,6 @@ sdev_modctl_devexists(const char *path)
 	return (error);
 }
 
-extern int sdev_vnodeops_tbl_size;
-
-/*
- * construct a new template with overrides from vtab
- */
-static fs_operation_def_t *
-sdev_merge_vtab(const fs_operation_def_t tab[])
-{
-	fs_operation_def_t *new;
-	const fs_operation_def_t *tab_entry;
-
-	/* make a copy of standard vnode ops table */
-	new = kmem_alloc(sdev_vnodeops_tbl_size, KM_SLEEP);
-	bcopy((void *)sdev_vnodeops_tbl, new, sdev_vnodeops_tbl_size);
-
-	/* replace the overrides from tab */
-	for (tab_entry = tab; tab_entry->name != NULL; tab_entry++) {
-		fs_operation_def_t *std_entry = new;
-		while (std_entry->name) {
-			if (strcmp(tab_entry->name, std_entry->name) == 0) {
-				std_entry->func = tab_entry->func;
-				break;
-			}
-			std_entry++;
-		}
-		if (std_entry->name == NULL)
-			cmn_err(CE_NOTE, "sdev_merge_vtab: entry %s unused.",
-			    tab_entry->name);
-	}
-
-	return (new);
-}
-
-/* free memory allocated by sdev_merge_vtab */
-static void
-sdev_free_vtab(fs_operation_def_t *new)
-{
-	kmem_free(new, sdev_vnodeops_tbl_size);
-}
-
 /*
  * a generic setattr() function
  *
diff --git a/usr/src/uts/common/fs/dev/sdev_vfsops.c b/usr/src/uts/common/fs/dev/sdev_vfsops.c
index d81702185e..55b388c2d4 100644
--- a/usr/src/uts/common/fs/dev/sdev_vfsops.c
+++ b/usr/src/uts/common/fs/dev/sdev_vfsops.c
@@ -173,7 +173,13 @@ devinit(int fstype, char *name)
 
 	if ((devmajor = getudev()) == (major_t)-1) {
 		cmn_err(CE_WARN, "%s: can't get unique dev", sdev_vfssw.name);
-		return (1);
+		return (ENXIO);
+	}
+
+	if (sdev_plugin_init() != 0) {
+		cmn_err(CE_WARN, "%s: failed to set init plugin subsystem",
+		    sdev_vfssw.name);
+		return (EIO);
 	}
 
 	/* initialize negative cache */
@@ -350,6 +356,7 @@ sdev_mount(struct vfs *vfsp, struct vnode *mvp, struct mounta *uap,
 		ASSERT(sdev_origins);
 		dv->sdev_flags &= ~SDEV_GLOBAL;
 		dv->sdev_origin = sdev_origins->sdev_root;
+		SDEV_HOLD(dv->sdev_origin);
 	} else {
 		sdev_ncache_setup();
 		rw_enter(&dv->sdev_contents, RW_WRITER);
@@ -527,3 +534,17 @@ sdev_mntinfo_rele(struct sdev_data *mntinfo)
 	mutex_exit(&vp->v_lock);
 	mutex_exit(&sdev_lock);
 }
+
+void
+sdev_mnt_walk(void (*func)(struct sdev_node *, void *), void *arg)
+{
+	struct sdev_data *mntinfo;
+
+	mutex_enter(&sdev_lock);
+	mntinfo = sdev_mntinfo;
+	while (mntinfo != NULL) {
+		func(mntinfo->sdev_root, arg);
+		mntinfo = mntinfo->sdev_next;
+	}
+	mutex_exit(&sdev_lock);
+}
diff --git a/usr/src/uts/common/fs/dev/sdev_vnops.c b/usr/src/uts/common/fs/dev/sdev_vnops.c
index 79ebd8b2e5..5a00242482 100644
--- a/usr/src/uts/common/fs/dev/sdev_vnops.c
+++ b/usr/src/uts/common/fs/dev/sdev_vnops.c
@@ -22,7 +22,7 @@
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright 2018, Joyent, Inc.
  */
 
 /*
@@ -372,7 +372,7 @@ sdev_close(struct vnode *vp, int flag, int count,
 /*ARGSUSED*/
 static int
 sdev_read(struct vnode *vp, struct uio *uio, int ioflag, struct cred *cred,
-	struct caller_context *ct)
+    struct caller_context *ct)
 {
 	struct sdev_node *dv = (struct sdev_node *)VTOSDEV(vp);
 	int	error;
@@ -399,7 +399,7 @@ sdev_read(struct vnode *vp, struct uio *uio, int ioflag, struct cred *cred,
 /*ARGSUSED*/
 static int
 sdev_write(struct vnode *vp, struct uio *uio, int ioflag, struct cred *cred,
-	struct caller_context *ct)
+    struct caller_context *ct)
 {
 	struct sdev_node *dv = VTOSDEV(vp);
 	int	error = 0;
@@ -582,7 +582,9 @@ sdev_self_access(sdev_node_t *dv, int mode, int flags, struct cred *cr,
 {
 	int ret;
 
+	ASSERT(RW_READ_HELD(&dv->sdev_contents));
 	ASSERT(dv->sdev_attr || dv->sdev_attrvp);
+
 	if (dv->sdev_attrvp) {
 		ret = VOP_ACCESS(dv->sdev_attrvp, mode, flags, cr, ct);
 	} else if (dv->sdev_attr) {
@@ -892,6 +894,9 @@ sdev_remove(struct vnode *dvp, char *nm, struct cred *cred,
 		}
 	}
 
+	if (error == 0)
+		i_ddi_di_cache_invalidate();
+
 	return (error);
 }
 
@@ -1216,6 +1221,7 @@ sdev_symlink(struct vnode *dvp, char *lnm, struct vattr *tva,
 	sdev_update_timestamps(dvp, kcred, AT_MTIME|AT_ATIME);
 	if (SDEV_IS_GLOBAL(parent))
 		atomic_inc_ulong(&parent->sdev_gdir_gen);
+	i_ddi_di_cache_invalidate();
 
 	/* wake up other threads blocked on looking up this node */
 	mutex_enter(&self->sdev_lookup_lock);
@@ -1288,6 +1294,7 @@ sdev_mkdir(struct vnode *dvp, char *nm, struct vattr *va, struct vnode **vpp,
 	sdev_update_timestamps(dvp, kcred, AT_MTIME|AT_ATIME);
 	if (SDEV_IS_GLOBAL(parent))
 		atomic_inc_ulong(&parent->sdev_gdir_gen);
+	i_ddi_di_cache_invalidate();
 
 	/* wake up other threads blocked on looking up this node */
 	mutex_enter(&self->sdev_lookup_lock);
@@ -1403,6 +1410,9 @@ sdev_rmdir(struct vnode *dvp, char *nm, struct vnode *cdir, struct cred *cred,
 
 	}
 
+	if (error == 0)
+		i_ddi_di_cache_invalidate();
+
 	return (error);
 }
 
@@ -1438,32 +1448,24 @@ sdev_readlink(struct vnode *vp, struct uio *uiop, struct cred *cred,
 
 /*ARGSUSED4*/
 static int
-sdev_readdir(struct vnode *dvp, struct uio *uiop, struct cred *cred, int *eofp,
+sdev_readdir(struct vnode *vp, struct uio *uiop, struct cred *cred, int *eofp,
     caller_context_t *ct, int flags)
 {
-	struct sdev_node *parent = VTOSDEV(dvp);
+	struct sdev_node *dv = VTOSDEV(vp);
 	int error;
 
+	VERIFY(RW_READ_HELD(&dv->sdev_contents));
+
 	/*
-	 * We must check that we have execute access to search the directory --
-	 * but because our sdev_contents lock is already held as a reader (the
-	 * caller must have done a VOP_RWLOCK()), we call directly into the
-	 * underlying access routine if sdev_attr is non-NULL.
+	 * We can't recursively take ->sdev_contents via an indirect
+	 * VOP_ACCESS(), but we don't need to use that anyway.
 	 */
-	if (parent->sdev_attr != NULL) {
-		VERIFY(RW_READ_HELD(&parent->sdev_contents));
-
-		if (sdev_unlocked_access(parent, VEXEC, cred) != 0)
-			return (EACCES);
-	} else {
-		if ((error = VOP_ACCESS(dvp, VEXEC, 0, cred, ct)) != 0)
-			return (error);
-	}
+	if ((error = sdev_self_access(dv, VEXEC, 0, cred, ct)) != 0)
+		return (error);
 
-	ASSERT(parent);
-	if (!SDEV_IS_GLOBAL(parent))
-		prof_filldir(parent);
-	return (devname_readdir_func(dvp, uiop, cred, eofp, SDEV_BROWSE));
+	if (!SDEV_IS_GLOBAL(dv))
+		prof_filldir(dv);
+	return (devname_readdir_func(vp, uiop, cred, eofp, SDEV_BROWSE));
 }
 
 /*ARGSUSED1*/
diff --git a/usr/src/uts/common/fs/dev/sdev_zvolops.c b/usr/src/uts/common/fs/dev/sdev_zvolops.c
index f75d5c3c4e..a52606aeda 100644
--- a/usr/src/uts/common/fs/dev/sdev_zvolops.c
+++ b/usr/src/uts/common/fs/dev/sdev_zvolops.c
@@ -472,8 +472,10 @@ devzvol_create_pool_dirs(struct vnode *dvp)
 		ASSERT(dvp->v_count > 0);
 		rc = VOP_LOOKUP(dvp, nvpair_name(elem), &vp, NULL, 0,
 		    NULL, kcred, NULL, 0, NULL);
-		/* should either work, or not be visible from a zone */
-		ASSERT(rc == 0 || rc == ENOENT);
+		/*
+		 * should either work or we should get an error if this should
+		 * not be visible from the zone, or disallowed in the zone
+		 */
 		if (rc == 0)
 			VN_RELE(vp);
 		pools++;
diff --git a/usr/src/uts/common/fs/fem.c b/usr/src/uts/common/fs/fem.c
index b4e28cc860..5f524def30 100644
--- a/usr/src/uts/common/fs/fem.c
+++ b/usr/src/uts/common/fs/fem.c
@@ -23,6 +23,10 @@
  * Use is subject to license terms.
  */
 
+/*
+ * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+ */
+
 #include <sys/types.h>
 #include <sys/atomic.h>
 #include <sys/kmem.h>
@@ -33,11 +37,12 @@
 #include <sys/systm.h>
 #include <sys/cmn_err.h>
 #include <sys/debug.h>
-
 #include <sys/fem.h>
 #include <sys/vfs.h>
 #include <sys/vnode.h>
 #include <sys/vfs_opreg.h>
+#include <sys/stack.h>
+#include <sys/archsystm.h>
 
 #define	NNODES_DEFAULT	8	/* Default number of nodes in a fem_list */
 /*
@@ -291,6 +296,536 @@ _op_find(femarg_t *ap, void **fp, int offs0, int offs1)
 }
 #endif
 
+/*
+ * File event monitoring handoffs
+ *
+ * File event monitoring relies on being able to inject stack frames between
+ * vnode consumers and the underlying file systems.  This becomes problematic
+ * when there exist many monitors, as kernel stack depth is finite.  The model
+ * very much encodes this injected frame:  the flow of control deliberately
+ * lies with the monitor, not with the monitoring system.  While we could
+ * conceivably address this by allowing each subsystem to install at most
+ * one monitor per vnode (and impose on subsystems that they handle any
+ * of their own consumer multiplexing internally), this in fact exports a
+ * substantial amount of run-time complexity to deal with an uncommon case
+ * (and, it must be said, assumes a small number of consuming subsystems).
+ * To allow our abstraction to remain clean, we instead check our remaining
+ * stack in every vnext_*() call; if the amount of stack remaining is lower
+ * than a threshold (fem_stack_needed), we call thread_splitstack() to carry
+ * on the execution of the monitors and the underlying vnode operation on a
+ * split stack.  Because we can only pass a single argument to our split stack
+ * function, we must marshal our arguments, the mechanics of which are somewhat
+ * ornate in terms of the code: to marshal in a type-safe manner, we define a
+ * baton that is a union of payload structures for each kind of operation,
+ * loading the per-operation payload explicitly and calling into common handoff
+ * code that itself calls thread_splitstack().  The function passed to
+ * thread_splitstack() is a per-entry point function that continues monitor
+ * processing given the specified (marshalled) arguments.  While this method
+ * is a little verbose to implement, it has the advantage of being relatively
+ * robust (that is, broadly type-safe) while imposing minimal burden on each
+ * vnext_*() entry point.
+ *
+ * In terms of the implementation:
+ *
+ * - The FEM_BATON_n macros define the per-entry point baton structures
+ * - The fem_baton_payload_t contains the union of these structures
+ * - The FEM_VNEXTn_DECL macros declare the post-handoff entry point
+ * - The FEM_VNEXTn macros constitute the per-handoff entry point
+ *
+ * Note that we don't use variadic macros -- we define a variant of these
+ * macros for each of our relevant argument counts.  This may seem overly
+ * explicit, but it is deliberate:  the object here is to minimize the
+ * future maintenance burden by minimizing the likelihood of introduced
+ * error --  not to minimize the number of characters in this source file.
+ */
+
+#ifndef STACK_GROWTH_DOWN
+#error Downward stack growth assumed.
+#endif
+
+int fem_stack_toodeep;
+uintptr_t fem_stack_needed = 8 * 1024;
+size_t fem_handoff_stacksize = 128 * 1024;
+
+#define	FEM_TOODEEP() (STACK_BIAS + (uintptr_t)getfp() - \
+	(uintptr_t)curthread->t_stkbase < fem_stack_needed)
+
+#define	FEM_BATON_1(what, t0, l0)					\
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+	} fb_##what
+
+#define	FEM_BATON_2(what, t0, l0, t1, l1)				\
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+		t1 fb_##what##_##l1;					\
+	} fb_##what
+
+#define	FEM_BATON_3(what, t0, l0, t1, l1, t2, l2)			\
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+		t1 fb_##what##_##l1;					\
+		t2 fb_##what##_##l2;					\
+	} fb_##what
+
+#define	FEM_BATON_4(what, t0, l0, t1, l1, t2, l2, t3, l3)		\
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+		t1 fb_##what##_##l1;					\
+		t2 fb_##what##_##l2;					\
+		t3 fb_##what##_##l3;					\
+	} fb_##what
+
+#define	FEM_BATON_5(what, t0, l0, t1, l1, t2, l2, t3, l3, t4, l4)	\
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+		t1 fb_##what##_##l1;					\
+		t2 fb_##what##_##l2;					\
+		t3 fb_##what##_##l3;					\
+		t4 fb_##what##_##l4;					\
+	} fb_##what
+
+#define	FEM_BATON_6(what, t0, l0, t1, l1, t2, l2, t3, l3, t4, l4, t5, l5) \
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+		t1 fb_##what##_##l1;					\
+		t2 fb_##what##_##l2;					\
+		t3 fb_##what##_##l3;					\
+		t4 fb_##what##_##l4;					\
+		t5 fb_##what##_##l5;					\
+	} fb_##what
+
+#define	FEM_BATON_8(what, t0, l0, t1, l1, t2, l2, t3, l3, t4, l4, t5, l5, \
+    t6, l6, t7, l7) \
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+		t1 fb_##what##_##l1;					\
+		t2 fb_##what##_##l2;					\
+		t3 fb_##what##_##l3;					\
+		t4 fb_##what##_##l4;					\
+		t5 fb_##what##_##l5;					\
+		t6 fb_##what##_##l6;					\
+		t7 fb_##what##_##l7;					\
+	} fb_##what
+
+#define	FEM_BATON_9(what, t0, l0, t1, l1, t2, l2, t3, l3, t4, l4, t5, l5, \
+    t6, l6, t7, l7, t8, l8) \
+	struct {							\
+		void *fb_##what##_arg0;					\
+		caller_context_t *fb_##what##_ct;			\
+		t0 fb_##what##_##l0;					\
+		t1 fb_##what##_##l1;					\
+		t2 fb_##what##_##l2;					\
+		t3 fb_##what##_##l3;					\
+		t4 fb_##what##_##l4;					\
+		t5 fb_##what##_##l5;					\
+		t6 fb_##what##_##l6;					\
+		t7 fb_##what##_##l7;					\
+		t8 fb_##what##_##l8;					\
+	} fb_##what
+
+typedef union {
+	FEM_BATON_2(open, int, mode, cred_t *, cr);
+	FEM_BATON_4(close, int, flag, int, count,
+	    offset_t, offset, cred_t *, cr);
+	FEM_BATON_3(read, uio_t *, uiop, int, ioflag, cred_t *, cr);
+	FEM_BATON_3(write, uio_t *, uiop, int, ioflag, cred_t *, cr);
+	FEM_BATON_5(ioctl, int, cmd, intptr_t, arg,
+	    int, flag, cred_t *, cr, int *, rvalp);
+	FEM_BATON_3(setfl, int, oflags, int, nflags, cred_t *, cr);
+	FEM_BATON_3(getattr, vattr_t *, vap, int, flags, cred_t *, cr);
+	FEM_BATON_3(setattr, vattr_t *, vap, int, flags, cred_t *, cr);
+	FEM_BATON_3(access, int, mode, int, flags, cred_t *, cr);
+	FEM_BATON_8(lookup, char *, nm, vnode_t **, vpp,
+	    pathname_t *, pnp, int, flags, vnode_t *, rdir,
+	    cred_t *, cr, int *, direntflags, pathname_t *, realpnp);
+	FEM_BATON_8(create, char *, name, vattr_t *, vap,
+	    vcexcl_t, excl, int, mode, vnode_t **, vpp,
+	    cred_t *, cr, int, flag, vsecattr_t *, vsecp);
+	FEM_BATON_3(remove, char *, nm, cred_t *, cr, int, flags);
+	FEM_BATON_4(link, vnode_t *, svp, char *, tnm,
+	    cred_t *, cr, int, flags);
+	FEM_BATON_5(rename, char *, snm, vnode_t *, tdvp,
+	    char *, tnm, cred_t *, cr, int, flags);
+	FEM_BATON_6(mkdir, char *, dirname, vattr_t *, vap,
+	    vnode_t **, vpp, cred_t *, cr, int, flags,
+	    vsecattr_t *, vsecp);
+	FEM_BATON_4(rmdir, char *, nm, vnode_t *, cdir,
+	    cred_t *, cr, int, flags);
+	FEM_BATON_4(readdir, uio_t *, uiop, cred_t *, cr,
+	    int *, eofp, int, flags);
+	FEM_BATON_5(symlink, char *, linkname, vattr_t *, vap,
+	    char *, target, cred_t *, cr, int, flags);
+	FEM_BATON_2(readlink, uio_t *, uiop, cred_t *, cr);
+	FEM_BATON_2(fsync, int, syncflag, cred_t *, cr);
+	FEM_BATON_1(inactive, cred_t *, cr);
+	FEM_BATON_1(fid, fid_t *, fidp);
+	FEM_BATON_1(rwlock, int, write_lock);
+	FEM_BATON_1(rwunlock, int, write_lock);
+	FEM_BATON_2(seek, offset_t, ooff, offset_t *, noffp);
+	FEM_BATON_1(cmp, vnode_t *, vp2);
+	FEM_BATON_6(frlock, int, cmd, struct flock64 *, bfp,
+	    int, flag, offset_t, offset, struct flk_callback *, flk_cbp,
+	    cred_t *, cr);
+	FEM_BATON_5(space, int, cmd, struct flock64 *, bfp,
+	    int, flag, offset_t, offset, cred_t *, cr);
+	FEM_BATON_1(realvp, vnode_t **, vpp);
+	FEM_BATON_9(getpage, offset_t, off, size_t, len,
+	    uint_t *, protp, struct page **, plarr, size_t, plsz,
+	    struct seg *, seg, caddr_t, addr, enum seg_rw, rw,
+	    cred_t *, cr);
+	FEM_BATON_4(putpage, offset_t, off, size_t, len,
+	    int, flags, cred_t *, cr);
+	FEM_BATON_8(map, offset_t, off, struct as *, as,
+	    caddr_t *, addrp, size_t, len, uchar_t, prot,
+	    uchar_t, maxprot, uint_t, flags, cred_t *, cr);
+	FEM_BATON_8(addmap, offset_t, off, struct as *, as,
+	    caddr_t, addr, size_t, len, uchar_t, prot,
+	    uchar_t, maxprot, uint_t, flags, cred_t *, cr);
+	FEM_BATON_8(delmap, offset_t, off, struct as *, as,
+	    caddr_t, addr, size_t, len, uint_t, prot,
+	    uint_t, maxprot, uint_t, flags, cred_t *, cr);
+	FEM_BATON_4(poll, short, events, int, anyyet,
+	    short *, reventsp, struct pollhead **, phpp);
+	FEM_BATON_3(dump, caddr_t, addr, offset_t, lbdn, offset_t, dblks);
+	FEM_BATON_3(pathconf, int, cmd, ulong_t *, valp, cred_t *, cr);
+	FEM_BATON_5(pageio, struct page *, pp, u_offset_t, io_off,
+	    size_t, io_len, int, flags, cred_t *, cr);
+	FEM_BATON_2(dumpctl, int, action, offset_t *, blkp);
+	FEM_BATON_4(dispose, struct page *, pp, int, flag,
+	    int, dn, cred_t *, cr);
+	FEM_BATON_3(setsecattr, vsecattr_t *, vsap, int, flag, cred_t *, cr);
+	FEM_BATON_3(getsecattr, vsecattr_t *, vsap, int, flag, cred_t *, cr);
+	FEM_BATON_4(shrlock, int, cmd, struct shrlock *, shr,
+	    int, flag, cred_t *, cr);
+	FEM_BATON_3(vnevent, vnevent_t, vnevent, vnode_t *, dvp, char *, cname);
+	FEM_BATON_3(reqzcbuf, enum uio_rw, ioflag,
+	    xuio_t *, xuiop, cred_t *, cr);
+	FEM_BATON_2(retzcbuf, xuio_t *, xuiop, cred_t *, cr);
+} fem_baton_payload_t;
+
+typedef struct {
+	fem_baton_payload_t fb_payload;
+	int (*fb_func)();
+	void (*fb_handoff)();
+	int fb_rval;
+} fem_baton_t;
+
+static int
+fem_handoff(fem_baton_t *bp)
+{
+	fem_stack_toodeep++;
+	thread_splitstack(bp->fb_handoff, bp, fem_handoff_stacksize);
+
+	return (bp->fb_rval);
+}
+
+#define	FEM_VNEXT3_DECL(what, a0, a1, a2)				\
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2);			\
+}
+
+#define	FEM_VNEXT4_DECL(what, a0, a1, a2, a3)				\
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a3);			\
+}
+
+#define	FEM_VNEXT5_DECL(what, a0, a1, a2, a3, a4)			\
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a3,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a4);			\
+}
+
+#define	FEM_VNEXT6_DECL(what, a0, a1, a2, a3, a4, a5)			\
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a3,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a4,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a5);			\
+}
+
+#define	FEM_VNEXT7_DECL(what, a0, a1, a2, a3, a4, a5, a6)		\
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a3,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a4,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a5,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a6);			\
+}
+
+#define	FEM_VNEXT8_DECL(what, a0, a1, a2, a3, a4, a5, a6, a7)		\
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a3,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a4,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a5,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a6,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a7);			\
+}
+
+#define	FEM_VNEXT10_DECL(what, a0, a1, a2, a3, a4, a5, a6, a7, a8, a9)	\
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a3,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a4,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a5,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a6,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a7,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a8,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a9);			\
+}
+
+#define	FEM_VNEXT11_DECL(what, a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10) \
+void									\
+fem_handoff_##what(fem_baton_t *bp)					\
+{									\
+	bp->fb_rval = bp->fb_func(					\
+	    bp->fb_payload.fb_##what.fb_##what##_##a0,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a1,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a2,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a3,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a4,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a5,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a6,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a7,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a8,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a9,			\
+	    bp->fb_payload.fb_##what.fb_##what##_##a10);		\
+}
+
+#define	FEM_VNEXT3(what, func, a0, a1, a2)				\
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2))
+
+#define	FEM_VNEXT4(what, func, a0, a1, a2, a3)				\
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a3 = a3;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2, a3))
+
+#define	FEM_VNEXT5(what, func, a0, a1, a2, a3, a4)			\
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a3 = a3;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a4 = a4;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2, a3, a4))
+
+#define	FEM_VNEXT6(what, func, a0, a1, a2, a3, a4, a5)			\
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a3 = a3;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a4 = a4;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a5 = a5;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2, a3, a4, a5))
+
+#define	FEM_VNEXT7(what, func, a0, a1, a2, a3, a4, a5, a6)		\
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a3 = a3;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a4 = a4;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a5 = a5;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a6 = a6;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2, a3, a4, a5, a6))
+
+#define	FEM_VNEXT8(what, func, a0, a1, a2, a3, a4, a5, a6, a7)		\
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a3 = a3;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a4 = a4;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a5 = a5;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a6 = a6;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a7 = a7;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2, a3, a4, a5, a6, a7))
+
+#define	FEM_VNEXT10(what, func, a0, a1, a2, a3, a4, a5, a6, a7, a8, a9)	\
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a3 = a3;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a4 = a4;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a5 = a5;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a6 = a6;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a7 = a7;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a8 = a8;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a9 = a9;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2, a3, a4, a5, a6, a7, a8, a9))
+
+#define	FEM_VNEXT11(what, func, a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10) \
+	if (FEM_TOODEEP()) {						\
+		fem_baton_t *baton;					\
+		int rval;						\
+									\
+		baton = kmem_alloc(sizeof (fem_baton_t), KM_SLEEP);	\
+		baton->fb_payload.fb_##what.fb_##what##_##a0 = a0;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a1 = a1;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a2 = a2;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a3 = a3;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a4 = a4;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a5 = a5;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a6 = a6;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a7 = a7;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a8 = a8;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a9 = a9;	\
+		baton->fb_payload.fb_##what.fb_##what##_##a10 = a10;	\
+		baton->fb_handoff = fem_handoff_##what;			\
+		baton->fb_func = func;					\
+									\
+		rval = fem_handoff(baton);				\
+		kmem_free(baton, sizeof (fem_baton_t));			\
+									\
+		return (rval);						\
+	}								\
+	return (func(a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10))
+
 static fem_t *
 fem_alloc()
 {
@@ -2036,10 +2571,60 @@ static struct fs_operation_def fshead_vfs_spec[]  = {
  * 5.  Return by invoking the base operation with the base object.
  *
  * for each classification, there needs to be at least one "next" operation
- * for each "head"operation.
- *
+ * for each "head" operation.  Note that we also use the FEM_VNEXTn_DECL macros
+ * to define the function to run when the stack is split; see the discussion
+ * on "File event monitoring handoffs", above.
  */
 
+FEM_VNEXT4_DECL(open, arg0, mode, cr, ct)
+FEM_VNEXT6_DECL(close, arg0, flag, count, offset, cr, ct)
+FEM_VNEXT5_DECL(read, arg0, uiop, ioflag, cr, ct)
+FEM_VNEXT5_DECL(write, arg0, uiop, ioflag, cr, ct)
+FEM_VNEXT7_DECL(ioctl, arg0, cmd, arg, flag, cr, rvalp, ct)
+FEM_VNEXT5_DECL(setfl, arg0, oflags, nflags, cr, ct)
+FEM_VNEXT5_DECL(getattr, arg0, vap, flags, cr, ct)
+FEM_VNEXT5_DECL(setattr, arg0, vap, flags, cr, ct)
+FEM_VNEXT5_DECL(access, arg0, mode, flags, cr, ct)
+FEM_VNEXT10_DECL(lookup, arg0, nm, vpp, pnp, flags, rdir,
+    cr, ct, direntflags, realpnp)
+FEM_VNEXT10_DECL(create, arg0, name, vap, excl, mode, vpp, cr, flag, ct, vsecp)
+FEM_VNEXT5_DECL(remove, arg0, nm, cr, ct, flags)
+FEM_VNEXT6_DECL(link, arg0, svp, tnm, cr, ct, flags)
+FEM_VNEXT7_DECL(rename, arg0, snm, tdvp, tnm, cr, ct, flags)
+FEM_VNEXT8_DECL(mkdir, arg0, dirname, vap, vpp, cr, ct, flags, vsecp)
+FEM_VNEXT6_DECL(rmdir, arg0, nm, cdir, cr, ct, flags)
+FEM_VNEXT6_DECL(readdir, arg0, uiop, cr, eofp, ct, flags)
+FEM_VNEXT7_DECL(symlink, arg0, linkname, vap, target, cr, ct, flags)
+FEM_VNEXT4_DECL(readlink, arg0, uiop, cr, ct)
+FEM_VNEXT4_DECL(fsync, arg0, syncflag, cr, ct)
+FEM_VNEXT3_DECL(fid, arg0, fidp, ct)
+FEM_VNEXT3_DECL(rwlock, arg0, write_lock, ct)
+FEM_VNEXT4_DECL(seek, arg0, ooff, noffp, ct)
+FEM_VNEXT3_DECL(cmp, arg0, vp2, ct)
+FEM_VNEXT8_DECL(frlock, arg0, cmd, bfp, flag, offset, flk_cbp, cr, ct)
+FEM_VNEXT7_DECL(space, arg0, cmd, bfp, flag, offset, cr, ct)
+FEM_VNEXT3_DECL(realvp, arg0, vpp, ct)
+FEM_VNEXT11_DECL(getpage, arg0, off, len, protp, plarr, plsz,
+    seg, addr, rw, cr, ct)
+FEM_VNEXT6_DECL(putpage, arg0, off, len, flags, cr, ct)
+FEM_VNEXT10_DECL(map, arg0, off, as, addrp, len, prot, maxprot,
+    flags, cr, ct)
+FEM_VNEXT10_DECL(addmap, arg0, off, as, addr, len, prot, maxprot,
+    flags, cr, ct)
+FEM_VNEXT10_DECL(delmap, arg0, off, as, addr, len, prot, maxprot,
+    flags, cr, ct)
+FEM_VNEXT6_DECL(poll, arg0, events, anyyet, reventsp, phpp, ct)
+FEM_VNEXT5_DECL(dump, arg0, addr, lbdn, dblks, ct)
+FEM_VNEXT5_DECL(pathconf, arg0, cmd, valp, cr, ct)
+FEM_VNEXT7_DECL(pageio, arg0, pp, io_off, io_len, flags, cr, ct)
+FEM_VNEXT4_DECL(dumpctl, arg0, action, blkp, ct)
+FEM_VNEXT5_DECL(setsecattr, arg0, vsap, flag, cr, ct)
+FEM_VNEXT5_DECL(getsecattr, arg0, vsap, flag, cr, ct)
+FEM_VNEXT6_DECL(shrlock, arg0, cmd, shr, flag, cr, ct)
+FEM_VNEXT5_DECL(vnevent, arg0, vnevent, dvp, cname, ct)
+FEM_VNEXT5_DECL(reqzcbuf, arg0, ioflag, xuiop, cr, ct)
+FEM_VNEXT4_DECL(retzcbuf, arg0, xuiop, cr, ct)
+
 int
 vnext_open(femarg_t *vf, int mode, cred_t *cr, caller_context_t *ct)
 {
@@ -2051,7 +2636,7 @@ vnext_open(femarg_t *vf, int mode, cred_t *cr, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_open, femop_open);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, mode, cr, ct));
+	FEM_VNEXT4(open, func, arg0, mode, cr, ct);
 }
 
 int
@@ -2066,7 +2651,7 @@ vnext_close(femarg_t *vf, int flag, int count, offset_t offset, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_close, femop_close);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, flag, count, offset, cr, ct));
+	FEM_VNEXT6(close, func, arg0, flag, count, offset, cr, ct);
 }
 
 int
@@ -2081,7 +2666,7 @@ vnext_read(femarg_t *vf, uio_t *uiop, int ioflag, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_read, femop_read);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, uiop, ioflag, cr, ct));
+	FEM_VNEXT5(read, func, arg0, uiop, ioflag, cr, ct);
 }
 
 int
@@ -2096,7 +2681,7 @@ vnext_write(femarg_t *vf, uio_t *uiop, int ioflag, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_write, femop_write);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, uiop, ioflag, cr, ct));
+	FEM_VNEXT5(write, func, arg0, uiop, ioflag, cr, ct);
 }
 
 int
@@ -2111,7 +2696,7 @@ vnext_ioctl(femarg_t *vf, int cmd, intptr_t arg, int flag, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_ioctl, femop_ioctl);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, cmd, arg, flag, cr, rvalp, ct));
+	FEM_VNEXT7(ioctl, func, arg0, cmd, arg, flag, cr, rvalp, ct);
 }
 
 int
@@ -2126,7 +2711,7 @@ vnext_setfl(femarg_t *vf, int oflags, int nflags, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_setfl, femop_setfl);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, oflags, nflags, cr, ct));
+	FEM_VNEXT5(setfl, func, arg0, oflags, nflags, cr, ct);
 }
 
 int
@@ -2141,7 +2726,7 @@ vnext_getattr(femarg_t *vf, vattr_t *vap, int flags, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_getattr, femop_getattr);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, vap, flags, cr, ct));
+	FEM_VNEXT5(getattr, func, arg0, vap, flags, cr, ct);
 }
 
 int
@@ -2156,7 +2741,7 @@ vnext_setattr(femarg_t *vf, vattr_t *vap, int flags, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_setattr, femop_setattr);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, vap, flags, cr, ct));
+	FEM_VNEXT5(setattr, func, arg0, vap, flags, cr, ct);
 }
 
 int
@@ -2171,7 +2756,7 @@ vnext_access(femarg_t *vf, int mode, int flags, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_access, femop_access);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, mode, flags, cr, ct));
+	FEM_VNEXT5(access, func, arg0, mode, flags, cr, ct);
 }
 
 int
@@ -2187,8 +2772,8 @@ vnext_lookup(femarg_t *vf, char *nm, vnode_t **vpp, pathname_t *pnp,
 	vsop_find(vf, &func, int, &arg0, vop_lookup, femop_lookup);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, nm, vpp, pnp, flags, rdir, cr, ct,
-	    direntflags, realpnp));
+	FEM_VNEXT10(lookup, func, arg0, nm, vpp, pnp, flags, rdir, cr, ct,
+	    direntflags, realpnp);
 }
 
 int
@@ -2204,7 +2789,8 @@ vnext_create(femarg_t *vf, char *name, vattr_t *vap, vcexcl_t excl,
 	vsop_find(vf, &func, int, &arg0, vop_create, femop_create);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, name, vap, excl, mode, vpp, cr, flag, ct, vsecp));
+	FEM_VNEXT10(create, func, arg0, name, vap, excl,
+	    mode, vpp, cr, flag, ct, vsecp);
 }
 
 int
@@ -2219,7 +2805,7 @@ vnext_remove(femarg_t *vf, char *nm, cred_t *cr, caller_context_t *ct,
 	vsop_find(vf, &func, int, &arg0, vop_remove, femop_remove);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, nm, cr, ct, flags));
+	FEM_VNEXT5(remove, func, arg0, nm, cr, ct, flags);
 }
 
 int
@@ -2234,7 +2820,7 @@ vnext_link(femarg_t *vf, vnode_t *svp, char *tnm, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_link, femop_link);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, svp, tnm, cr, ct, flags));
+	FEM_VNEXT6(link, func, arg0, svp, tnm, cr, ct, flags);
 }
 
 int
@@ -2249,7 +2835,7 @@ vnext_rename(femarg_t *vf, char *snm, vnode_t *tdvp, char *tnm, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_rename, femop_rename);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, snm, tdvp, tnm, cr, ct, flags));
+	FEM_VNEXT7(rename, func, arg0, snm, tdvp, tnm, cr, ct, flags);
 }
 
 int
@@ -2264,7 +2850,7 @@ vnext_mkdir(femarg_t *vf, char *dirname, vattr_t *vap, vnode_t **vpp,
 	vsop_find(vf, &func, int, &arg0, vop_mkdir, femop_mkdir);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, dirname, vap, vpp, cr, ct, flags, vsecp));
+	FEM_VNEXT8(mkdir, func, arg0, dirname, vap, vpp, cr, ct, flags, vsecp);
 }
 
 int
@@ -2279,7 +2865,7 @@ vnext_rmdir(femarg_t *vf, char *nm, vnode_t *cdir, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_rmdir, femop_rmdir);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, nm, cdir, cr, ct, flags));
+	FEM_VNEXT6(rmdir, func, arg0, nm, cdir, cr, ct, flags);
 }
 
 int
@@ -2294,7 +2880,7 @@ vnext_readdir(femarg_t *vf, uio_t *uiop, cred_t *cr, int *eofp,
 	vsop_find(vf, &func, int, &arg0, vop_readdir, femop_readdir);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, uiop, cr, eofp, ct, flags));
+	FEM_VNEXT6(readdir, func, arg0, uiop, cr, eofp, ct, flags);
 }
 
 int
@@ -2309,7 +2895,7 @@ vnext_symlink(femarg_t *vf, char *linkname, vattr_t *vap, char *target,
 	vsop_find(vf, &func, int, &arg0, vop_symlink, femop_symlink);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, linkname, vap, target, cr, ct, flags));
+	FEM_VNEXT7(symlink, func, arg0, linkname, vap, target, cr, ct, flags);
 }
 
 int
@@ -2323,7 +2909,7 @@ vnext_readlink(femarg_t *vf, uio_t *uiop, cred_t *cr, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_readlink, femop_readlink);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, uiop, cr, ct));
+	FEM_VNEXT4(readlink, func, arg0, uiop, cr, ct);
 }
 
 int
@@ -2337,7 +2923,7 @@ vnext_fsync(femarg_t *vf, int syncflag, cred_t *cr, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_fsync, femop_fsync);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, syncflag, cr, ct));
+	FEM_VNEXT4(fsync, func, arg0, syncflag, cr, ct);
 }
 
 void
@@ -2365,7 +2951,7 @@ vnext_fid(femarg_t *vf, fid_t *fidp, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_fid, femop_fid);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, fidp, ct));
+	FEM_VNEXT3(fid, func, arg0, fidp, ct);
 }
 
 int
@@ -2379,7 +2965,7 @@ vnext_rwlock(femarg_t *vf, int write_lock, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_rwlock, femop_rwlock);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, write_lock, ct));
+	FEM_VNEXT3(rwlock, func, arg0, write_lock, ct);
 }
 
 void
@@ -2407,7 +2993,7 @@ vnext_seek(femarg_t *vf, offset_t ooff, offset_t *noffp, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_seek, femop_seek);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, ooff, noffp, ct));
+	FEM_VNEXT4(seek, func, arg0, ooff, noffp, ct);
 }
 
 int
@@ -2421,7 +3007,7 @@ vnext_cmp(femarg_t *vf, vnode_t *vp2, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_cmp, femop_cmp);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, vp2, ct));
+	FEM_VNEXT3(cmp, func, arg0, vp2, ct);
 }
 
 int
@@ -2437,7 +3023,7 @@ vnext_frlock(femarg_t *vf, int cmd, struct flock64 *bfp, int flag,
 	vsop_find(vf, &func, int, &arg0, vop_frlock, femop_frlock);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, cmd, bfp, flag, offset, flk_cbp, cr, ct));
+	FEM_VNEXT8(frlock, func, arg0, cmd, bfp, flag, offset, flk_cbp, cr, ct);
 }
 
 int
@@ -2452,7 +3038,7 @@ vnext_space(femarg_t *vf, int cmd, struct flock64 *bfp, int flag,
 	vsop_find(vf, &func, int, &arg0, vop_space, femop_space);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, cmd, bfp, flag, offset, cr, ct));
+	FEM_VNEXT7(space, func, arg0, cmd, bfp, flag, offset, cr, ct);
 }
 
 int
@@ -2466,7 +3052,7 @@ vnext_realvp(femarg_t *vf, vnode_t **vpp, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_realvp, femop_realvp);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, vpp, ct));
+	FEM_VNEXT3(realvp, func, arg0, vpp, ct);
 }
 
 int
@@ -2482,8 +3068,8 @@ vnext_getpage(femarg_t *vf, offset_t off, size_t len, uint_t *protp,
 	vsop_find(vf, &func, int, &arg0, vop_getpage, femop_getpage);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, off, len, protp, plarr, plsz, seg, addr, rw,
-	    cr, ct));
+	FEM_VNEXT11(getpage, func, arg0, off, len, protp,
+	    plarr, plsz, seg, addr, rw, cr, ct);
 }
 
 int
@@ -2498,7 +3084,7 @@ vnext_putpage(femarg_t *vf, offset_t off, size_t len, int flags,
 	vsop_find(vf, &func, int, &arg0, vop_putpage, femop_putpage);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, off, len, flags, cr, ct));
+	FEM_VNEXT6(putpage, func, arg0, off, len, flags, cr, ct);
 }
 
 int
@@ -2514,8 +3100,8 @@ vnext_map(femarg_t *vf, offset_t off, struct as *as, caddr_t *addrp,
 	vsop_find(vf, &func, int, &arg0, vop_map, femop_map);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, off, as, addrp, len, prot, maxprot, flags,
-	    cr, ct));
+	FEM_VNEXT10(map, func, arg0, off, as, addrp, len, prot, maxprot, flags,
+	    cr, ct);
 }
 
 int
@@ -2531,8 +3117,8 @@ vnext_addmap(femarg_t *vf, offset_t off, struct as *as, caddr_t addr,
 	vsop_find(vf, &func, int, &arg0, vop_addmap, femop_addmap);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, off, as, addr, len, prot, maxprot, flags,
-	    cr, ct));
+	FEM_VNEXT10(addmap, func, arg0, off, as, addr, len, prot, maxprot,
+	    flags, cr, ct);
 }
 
 int
@@ -2548,8 +3134,8 @@ vnext_delmap(femarg_t *vf, offset_t off, struct as *as, caddr_t addr,
 	vsop_find(vf, &func, int, &arg0, vop_delmap, femop_delmap);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, off, as, addr, len, prot, maxprot, flags,
-	    cr, ct));
+	FEM_VNEXT10(delmap, func, arg0, off, as, addr, len, prot, maxprot,
+	    flags, cr, ct);
 }
 
 int
@@ -2564,7 +3150,7 @@ vnext_poll(femarg_t *vf, short events, int anyyet, short *reventsp,
 	vsop_find(vf, &func, int, &arg0, vop_poll, femop_poll);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, events, anyyet, reventsp, phpp, ct));
+	FEM_VNEXT6(poll, func, arg0, events, anyyet, reventsp, phpp, ct);
 }
 
 int
@@ -2579,7 +3165,7 @@ vnext_dump(femarg_t *vf, caddr_t addr, offset_t lbdn, offset_t dblks,
 	vsop_find(vf, &func, int, &arg0, vop_dump, femop_dump);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, addr, lbdn, dblks, ct));
+	FEM_VNEXT5(dump, func, arg0, addr, lbdn, dblks, ct);
 }
 
 int
@@ -2594,7 +3180,7 @@ vnext_pathconf(femarg_t *vf, int cmd, ulong_t *valp, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_pathconf, femop_pathconf);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, cmd, valp, cr, ct));
+	FEM_VNEXT5(pathconf, func, arg0, cmd, valp, cr, ct);
 }
 
 int
@@ -2609,7 +3195,7 @@ vnext_pageio(femarg_t *vf, struct page *pp, u_offset_t io_off,
 	vsop_find(vf, &func, int, &arg0, vop_pageio, femop_pageio);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, pp, io_off, io_len, flags, cr, ct));
+	FEM_VNEXT7(pageio, func, arg0, pp, io_off, io_len, flags, cr, ct);
 }
 
 int
@@ -2623,7 +3209,7 @@ vnext_dumpctl(femarg_t *vf, int action, offset_t *blkp, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_dumpctl, femop_dumpctl);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, action, blkp, ct));
+	FEM_VNEXT4(dumpctl, func, arg0, action, blkp, ct);
 }
 
 void
@@ -2653,7 +3239,7 @@ vnext_setsecattr(femarg_t *vf, vsecattr_t *vsap, int flag, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_setsecattr, femop_setsecattr);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, vsap, flag, cr, ct));
+	FEM_VNEXT5(setsecattr, func, arg0, vsap, flag, cr, ct);
 }
 
 int
@@ -2668,7 +3254,7 @@ vnext_getsecattr(femarg_t *vf, vsecattr_t *vsap, int flag, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_getsecattr, femop_getsecattr);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, vsap, flag, cr, ct));
+	FEM_VNEXT5(getsecattr, func, arg0, vsap, flag, cr, ct);
 }
 
 int
@@ -2683,7 +3269,7 @@ vnext_shrlock(femarg_t *vf, int cmd, struct shrlock *shr, int flag,
 	vsop_find(vf, &func, int, &arg0, vop_shrlock, femop_shrlock);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, cmd, shr, flag, cr, ct));
+	FEM_VNEXT6(shrlock, func, arg0, cmd, shr, flag, cr, ct);
 }
 
 int
@@ -2698,7 +3284,7 @@ vnext_vnevent(femarg_t *vf, vnevent_t vnevent, vnode_t *dvp, char *cname,
 	vsop_find(vf, &func, int, &arg0, vop_vnevent, femop_vnevent);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, vnevent, dvp, cname, ct));
+	FEM_VNEXT5(vnevent, func, arg0, vnevent, dvp, cname, ct);
 }
 
 int
@@ -2713,7 +3299,7 @@ vnext_reqzcbuf(femarg_t *vf, enum uio_rw ioflag, xuio_t *xuiop, cred_t *cr,
 	vsop_find(vf, &func, int, &arg0, vop_reqzcbuf, femop_reqzcbuf);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, ioflag, xuiop, cr, ct));
+	FEM_VNEXT5(reqzcbuf, func, arg0, ioflag, xuiop, cr, ct);
 }
 
 int
@@ -2727,7 +3313,7 @@ vnext_retzcbuf(femarg_t *vf, xuio_t *xuiop, cred_t *cr, caller_context_t *ct)
 	vsop_find(vf, &func, int, &arg0, vop_retzcbuf, femop_retzcbuf);
 	ASSERT(func != NULL);
 	ASSERT(arg0 != NULL);
-	return ((*func)(arg0, xuiop, cr, ct));
+	FEM_VNEXT4(retzcbuf, func, arg0, xuiop, cr, ct);
 }
 
 int
diff --git a/usr/src/uts/common/fs/fifofs/fifosubr.c b/usr/src/uts/common/fs/fifofs/fifosubr.c
index 6e56000ffe..a908f91267 100644
--- a/usr/src/uts/common/fs/fifofs/fifosubr.c
+++ b/usr/src/uts/common/fs/fifofs/fifosubr.c
@@ -22,6 +22,7 @@
 
 /*
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -61,7 +62,6 @@
 #if FIFODEBUG
 int Fifo_fastmode = 1;		/* pipes/fifos will be opened in fast mode */
 int Fifo_verbose = 0;		/* msg when switching out of fast mode */
-int Fifohiwat = FIFOHIWAT;	/* Modifiable FIFO high water mark */
 #endif
 
 /*
@@ -196,6 +196,7 @@ fnode_constructor(void *buf, void *cdrarg, int kmflags)
 		fnp->fn_dest = fnp;
 		fnp->fn_mp = NULL;
 		fnp->fn_count = 0;
+		fnp->fn_hiwat = FIFOHIWAT;
 		fnp->fn_rsynccnt = 0;
 		fnp->fn_wsynccnt = 0;
 		fnp->fn_wwaitcnt = 0;
@@ -388,11 +389,7 @@ fifoinit(int fstype, char *name)
 	    pipe_constructor, pipe_destructor, NULL,
 	    (void *)(sizeof (fifodata_t)), NULL, 0);
 
-#if FIFODEBUG
-	if (Fifohiwat < FIFOHIWAT)
-		Fifohiwat = FIFOHIWAT;
-#endif /* FIFODEBUG */
-	fifo_strdata.qi_minfo->mi_hiwat = Fifohiwat;
+	fifo_strdata.qi_minfo->mi_hiwat = FIFOHIWAT;
 
 	return (0);
 }
@@ -614,9 +611,12 @@ fifo_stropen(vnode_t **vpp, int flag, cred_t *crp, int dotwist, int lockheld)
 	/*
 	 * The other end of the pipe is almost closed so
 	 * reject any other open on this end of the pipe
-	 * This only happens with a pipe mounted under namefs
+	 * This normally only happens with a pipe mounted under namefs, but
+	 * we can also see an open via proc/fd, which should still succeed.
+	 * To indicate the proc/fd case the FKLYR flag is passed.
 	 */
-	if ((fnp->fn_flag & (FIFOCLOSE|ISPIPE)) == (FIFOCLOSE|ISPIPE)) {
+	if ((fnp->fn_flag & (FIFOCLOSE|ISPIPE)) == (FIFOCLOSE|ISPIPE) &&
+	    (flag & FKLYR) == 0) {
 		fifo_cleanup(oldvp, flag);
 		cv_broadcast(&fnp->fn_wait_cv);
 		if (!lockheld)
@@ -1161,7 +1161,8 @@ fifo_wakewriter(fifonode_t *fn_dest, fifolock_t *fn_lock)
 	int fn_dflag = fn_dest->fn_flag;
 
 	ASSERT(MUTEX_HELD(&fn_lock->flk_lock));
-	ASSERT(fn_dest->fn_dest->fn_count < Fifohiwat);
+	ASSERT(fn_dest->fn_dest->fn_count < fn_dest->fn_dest->fn_hiwat);
+
 	if ((fn_dflag & FIFOWANTW)) {
 		cv_broadcast(&fn_dest->fn_wait_cv);
 	}
diff --git a/usr/src/uts/common/fs/fifofs/fifovnops.c b/usr/src/uts/common/fs/fifofs/fifovnops.c
index ef8d76e8e8..c288a2eb61 100644
--- a/usr/src/uts/common/fs/fifofs/fifovnops.c
+++ b/usr/src/uts/common/fs/fifofs/fifovnops.c
@@ -28,7 +28,7 @@
  */
 
 /*
- * Copyright 2015, Joyent, Inc.
+ * Copyright 2017, Joyent, Inc.
  * Copyright (c) 2017 by Delphix. All rights reserved.
  */
 
@@ -104,10 +104,6 @@ static int fifo_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
 static int fifo_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
 	caller_context_t *);
 
-/* functions local to this file */
-static boolean_t fifo_stayfast_enter(fifonode_t *);
-static void fifo_stayfast_exit(fifonode_t *);
-
 /*
  * Define the data structures external to this file.
  */
@@ -645,7 +641,7 @@ fifo_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *crp,
  *    (3) write-only FIFO with no data
  *    (4) no data and FNDELAY flag is set.
  * Otherwise return
- *	EAGAIN if FNONBLOCK is set and no data to read
+ *	EAGAIN if FNONBLOCK is set and no data to read or FIFORDBLOCK is set
  *	EINTR if signal received while waiting for data
  *
  * While there is no data to read....
@@ -681,7 +677,7 @@ fifo_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *crp,
 	 * Check for data on our input queue
 	 */
 
-	while (fnp->fn_count == 0) {
+	while (fnp->fn_count == 0 || (fnp->fn_flag & FIFORDBLOCK) != 0) {
 		/*
 		 * No data on first attempt and no writer, then EOF
 		 */
@@ -731,6 +727,7 @@ fifo_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *crp,
 	}
 
 	ASSERT(fnp->fn_mp != NULL);
+	VERIFY((fnp->fn_flag & FIFORDBLOCK) == 0);
 
 	/* For pipes copy should not bypass cache */
 	uiop->uio_extflg |= UIO_COPY_CACHED;
@@ -772,6 +769,18 @@ fifo_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *crp,
 				    &fn_lock->flk_lock))
 					goto trywake;
 
+				/*
+				 * If another thread snuck in and started to
+				 * consume data using read-blocking out of
+				 * the pipe while we were blocked in the
+				 * cv_wait, then since we have already consumed
+				 * some of the data out of the pipe we need
+				 * to return with a short read.
+				 */
+				if ((fnp->fn_flag & FIFORDBLOCK) != 0) {
+					goto trywake;
+				}
+
 				if (!(fnp->fn_flag & FIFOFAST))
 					goto stream_mode;
 			}
@@ -787,11 +796,11 @@ trywake:
 	/*
 	 * wake up any blocked writers, processes
 	 * sleeping on POLLWRNORM, or processes waiting for SIGPOLL
-	 * Note: checking for fn_count < Fifohiwat emulates
+	 * Note: checking for fn_count < fn_hiwat emulates
 	 * STREAMS functionality when low water mark is 0
 	 */
 	if (fn_dest->fn_flag & (FIFOWANTW | FIFOHIWATW) &&
-	    fnp->fn_count < Fifohiwat) {
+	    fnp->fn_count < fn_dest->fn_hiwat) {
 		fifo_wakewriter(fn_dest, fn_lock);
 	}
 	goto done;
@@ -904,7 +913,7 @@ fifo_write(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *crp,
 		/*
 		 * check to make sure we are not over high water mark
 		 */
-		while (fn_dest->fn_count >= Fifohiwat) {
+		while (fn_dest->fn_count >= fn_dest->fn_hiwat) {
 			/*
 			 * Indicate that we have gone over high
 			 * water mark
@@ -962,7 +971,7 @@ fifo_write(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *crp,
 		 * then we must break the message up into PIPE_BUF
 		 * chunks to stay compliant with STREAMS
 		 */
-		if (uiop->uio_resid + fn_dest->fn_count > Fifohiwat)
+		if (uiop->uio_resid + fn_dest->fn_count > fn_dest->fn_hiwat)
 			size = MIN(uiop->uio_resid, PIPE_BUF);
 		else
 			size = uiop->uio_resid;
@@ -1198,7 +1207,8 @@ fifo_fastioctl(vnode_t *vp, int cmd, intptr_t arg, int mode, cred_t *cr,
 		if (arg != 0) {
 			goto turn_fastoff;
 		}
-		*rvalp = (fnp->fn_dest->fn_count < Fifohiwat) ? 1 : 0;
+		*rvalp = (fnp->fn_dest->fn_count < fnp->fn_dest->fn_hiwat) ?
+		    1 : 0;
 		mutex_exit(&fn_lock->flk_lock);
 		return (0);
 
@@ -1817,7 +1827,7 @@ fifo_poll(vnode_t *vp, short events, int anyyet, short *reventsp,
 			retevents = POLLHUP;
 	} else if (events & (POLLWRNORM | POLLWRBAND)) {
 		if (events & POLLWRNORM) {
-			if (fn_dest->fn_count < Fifohiwat)
+			if (fn_dest->fn_count < fn_dest->fn_hiwat)
 				retevents = POLLWRNORM;
 			else
 				fnp->fn_flag |= FIFOHIWATW;
@@ -1986,7 +1996,7 @@ fifo_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *crp,
  * the lock.
  * If the fifo switches into stream mode while we are waiting, return failure.
  */
-static boolean_t
+boolean_t
 fifo_stayfast_enter(fifonode_t *fnp)
 {
 	ASSERT(MUTEX_HELD(&fnp->fn_lock->flk_lock));
@@ -2008,7 +2018,7 @@ fifo_stayfast_enter(fifonode_t *fnp)
  *	- threads wanting to turn into stream mode waiting in fifo_fastoff(),
  *	- other writers threads waiting in fifo_stayfast_enter().
  */
-static void
+void
 fifo_stayfast_exit(fifonode_t *fnp)
 {
 	fifonode_t *fn_dest = fnp->fn_dest;
diff --git a/usr/src/uts/common/fs/fs_subr.c b/usr/src/uts/common/fs/fs_subr.c
index 3249a574f7..e3d07b595d 100644
--- a/usr/src/uts/common/fs/fs_subr.c
+++ b/usr/src/uts/common/fs/fs_subr.c
@@ -60,6 +60,9 @@
 #include <acl/acl_common.h>
 #include <sys/pathname.h>
 
+/* required for fs_reject_epoll */
+#include <sys/poll_impl.h>
+
 static callb_cpr_t *frlock_serialize_blocked(flk_cb_when_t, void *);
 
 /*
@@ -406,10 +409,20 @@ fs_setfl(vnode_t *vp, int oflags, int nflags, cred_t *cr, caller_context_t *ct)
 }
 
 /*
- * Return the answer requested to poll() for non-device files.
- * Only POLLIN, POLLRDNORM, and POLLOUT are recognized.
+ * Unlike poll(2), epoll should reject attempts to add normal files or
+ * directories to a given handle.  Most non-pseudo filesystems rely on
+ * fs_poll() as their implementation of polling behavior.  Exceptions to that
+ * rule (ufs) can use fs_reject_epoll(), so they don't require access to the
+ * inner details of poll.  Potential race conditions related to the poll module
+ * being loaded are avoided by implementing the check here in genunix.
  */
-struct pollhead fs_pollhd;
+boolean_t
+fs_reject_epoll()
+{
+	/* Check if the currently-active pollcache is epoll-enabled. */
+	return (curthread->t_pollcache != NULL &&
+	    (curthread->t_pollcache->pc_flag & PC_EPOLL) != 0);
+}
 
 /* ARGSUSED */
 int
@@ -417,13 +430,12 @@ fs_poll(vnode_t *vp, short events, int anyyet, short *reventsp,
     struct pollhead **phpp, caller_context_t *ct)
 {
 	/*
-	 * Reject all attempts for edge-triggered polling.  These should only
-	 * occur when regular files are added to a /dev/poll handle which is in
-	 * epoll mode.  The Linux epoll does not allow epoll-ing on regular
-	 * files at all, so rejecting EPOLLET requests is congruent with those
-	 * expectations.
+	 * Regular filesystems should reject epollers.  On the off chance that
+	 * a non-epoll consumer expresses the desire for edge-triggered
+	 * polling, we reject them too.  Yes, the expected error for this
+	 * really is EPERM.
 	 */
-	if (events & POLLET) {
+	if (fs_reject_epoll() || (events & POLLET) != 0) {
 		return (EPERM);
 	}
 
@@ -438,15 +450,7 @@ fs_poll(vnode_t *vp, short events, int anyyet, short *reventsp,
 		*reventsp |= POLLOUT;
 	if (events & POLLWRBAND)
 		*reventsp |= POLLWRBAND;
-	/*
-	 * Emitting a pollhead without the intention of issuing pollwakeup()
-	 * calls against it is a recipe for trouble.  It's only acceptable in
-	 * this case since the above logic matches practically all useful
-	 * events.
-	 */
-	if (*reventsp == 0 && !anyyet) {
-		*phpp = &fs_pollhd;
-	}
+
 	return (0);
 }
 
diff --git a/usr/src/uts/common/fs/fs_subr.h b/usr/src/uts/common/fs/fs_subr.h
index bbcdca71b2..d25bf0213f 100644
--- a/usr/src/uts/common/fs/fs_subr.h
+++ b/usr/src/uts/common/fs/fs_subr.h
@@ -24,6 +24,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #ifndef	_SYS_FS_SUBR_H
@@ -95,6 +96,9 @@ extern int	fs_need_estale_retry(int);
 extern void	fs_vscan_register(int (*av_scan)(vnode_t *, cred_t *, int));
 extern int	fs_vscan(vnode_t *, cred_t *, int);
 
+/* Helper function to detect when epoll checks VOP_POLL handlers */
+extern boolean_t fs_reject_epoll();
+
 #endif	/* _KERNEL */
 
 #ifdef	__cplusplus
diff --git a/usr/src/uts/common/fs/hyprlofs/hyprlofs_dir.c b/usr/src/uts/common/fs/hyprlofs/hyprlofs_dir.c
new file mode 100644
index 0000000000..05ee2c6e09
--- /dev/null
+++ b/usr/src/uts/common/fs/hyprlofs/hyprlofs_dir.c
@@ -0,0 +1,640 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2012, Joyent, Inc.  All rights reserved.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/time.h>
+#include <sys/vfs.h>
+#include <sys/vnode.h>
+#include <sys/errno.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/stat.h>
+#include <sys/policy.h>
+#include <sys/fs/hyprlofs_info.h>
+
+static int hldir_make_hlnode(hlnode_t *, hlfsmount_t *, vattr_t *, enum de_op,
+		vnode_t *, hlnode_t **, cred_t *);
+static int hldiraddentry(hlnode_t *, hlnode_t *, char *);
+
+
+#define	HL_HASH_SIZE	8192		/* must be power of 2 */
+#define	HL_MUTEX_SIZE	64
+
+static hldirent_t	*hl_hashtable[HL_HASH_SIZE];
+static kmutex_t		 hl_hashmutex[HL_MUTEX_SIZE];
+
+#define	HL_HASH_INDEX(a)	((a) & (HL_HASH_SIZE-1))
+#define	HL_MUTEX_INDEX(a)	((a) & (HL_MUTEX_SIZE-1))
+
+#define	HYPRLOFS_HASH(tp, name, hash)				\
+	{							\
+		char Xc, *Xcp;					\
+		hash = (uint_t)(uintptr_t)(tp) >> 8;		\
+		for (Xcp = (name); (Xc = *Xcp) != 0; Xcp++)	\
+			hash = (hash << 4) + hash + (uint_t)Xc;	\
+	}
+
+void
+hyprlofs_hash_init(void)
+{
+	int	ix;
+
+	for (ix = 0; ix < HL_MUTEX_SIZE; ix++)
+		mutex_init(&hl_hashmutex[ix], NULL, MUTEX_DEFAULT, NULL);
+}
+
+static void
+hyprlofs_hash_in(hldirent_t *h)
+{
+	uint_t		hash;
+	hldirent_t	**prevpp;
+	kmutex_t	*hmtx;
+
+	HYPRLOFS_HASH(h->hld_parent, h->hld_name, hash);
+	h->hld_hash = hash;
+	prevpp = &hl_hashtable[HL_HASH_INDEX(hash)];
+	hmtx = &hl_hashmutex[HL_MUTEX_INDEX(hash)];
+	mutex_enter(hmtx);
+	h->hld_link = *prevpp;
+	*prevpp = h;
+	mutex_exit(hmtx);
+}
+
+/* Remove hldirent *h from the hash list. */
+static void
+hyprlofs_hash_out(hldirent_t *h)
+{
+	uint_t		hash;
+	hldirent_t	**prevpp;
+	kmutex_t	*hmtx;
+
+	hash = h->hld_hash;
+	prevpp = &hl_hashtable[HL_HASH_INDEX(hash)];
+	hmtx = &hl_hashmutex[HL_MUTEX_INDEX(hash)];
+	mutex_enter(hmtx);
+	while (*prevpp != h)
+		prevpp = &(*prevpp)->hld_link;
+	*prevpp = h->hld_link;
+	mutex_exit(hmtx);
+}
+
+static hldirent_t *
+hyprlofs_hash_lookup(char *name, hlnode_t *parent, uint_t hold,
+    hlnode_t **found)
+{
+	hldirent_t	*l;
+	uint_t		hash;
+	kmutex_t	*hmtx;
+	hlnode_t	*hnp;
+
+	HYPRLOFS_HASH(parent, name, hash);
+	hmtx = &hl_hashmutex[HL_MUTEX_INDEX(hash)];
+	mutex_enter(hmtx);
+	l = hl_hashtable[HL_HASH_INDEX(hash)];
+	while (l) {
+		if (l->hld_hash == hash && l->hld_parent == parent &&
+		    strcmp(l->hld_name, name) == 0) {
+			/*
+			 * Ensure that the hlnode that we put a hold on is the
+			 * same one that we pass back. Thus the temp. var
+			 * hnp is necessary.
+			 */
+			hnp = l->hld_hlnode;
+			if (hold) {
+				ASSERT(hnp);
+				hlnode_hold(hnp);
+			}
+			if (found)
+				*found = hnp;
+			mutex_exit(hmtx);
+			return (l);
+		} else {
+			l = l->hld_link;
+		}
+	}
+	mutex_exit(hmtx);
+	return (NULL);
+}
+
+/*
+ * Search directory 'parent' for entry 'name'.
+ *
+ * The calling thread can't hold the write version of the rwlock for the
+ * directory being searched
+ *
+ * On success *foundtp points to the found hlnode with its vnode held.
+ */
+int
+hyprlofs_dirlookup(hlnode_t *parent, char *name, hlnode_t **foundtp, cred_t *cr)
+{
+	int error;
+
+	*foundtp = NULL;
+	if (parent->hln_type != VDIR)
+		return (ENOTDIR);
+
+	if ((error = hyprlofs_taccess(parent, VEXEC, cr)))
+		return (error);
+
+	if (*name == '\0') {
+		hlnode_hold(parent);
+		*foundtp = parent;
+		return (0);
+	}
+
+	/*
+	 * Search the directory for the matching name. We need the lock
+	 * protecting the hln_dir list so that it doesn't change out from
+	 * underneath us. hyprlofs_hash_lookup() will pass back the hlnode
+	 * with a hold on it.
+	 */
+	if (hyprlofs_hash_lookup(name, parent, 1, foundtp) != NULL) {
+		ASSERT(*foundtp);
+		return (0);
+	}
+
+	return (ENOENT);
+}
+
+/*
+ * Enter a directory entry (either a file or subdir, depending on op) for
+ * 'name' and 'hp' into directory 'dir'
+ */
+int
+hyprlofs_direnter(
+	hlfsmount_t	*hm,
+	hlnode_t	*dir,		/* target directory to make entry in */
+	char		*name,		/* name of entry */
+	enum de_op	op,		/* entry operation */
+	vnode_t		*realvp,	/* real vnode */
+	vattr_t		*va,
+	hlnode_t	**hpp,		/* return hlnode */
+	cred_t		*cr)
+{
+	hldirent_t *hdp;
+	hlnode_t *found = NULL;
+	hlnode_t *hp;
+	int error = 0;
+	char *s;
+
+	/* hln_rwlock is held to serialize direnter and dirdeletes */
+	ASSERT(RW_WRITE_HELD(&dir->hln_rwlock));
+	ASSERT(dir->hln_type == VDIR);
+
+	/* Don't allow '/' characters in pathname component */
+	for (s = name; *s; s++)
+		if (*s == '/')
+			return (EACCES);
+
+	if (name[0] == '\0')
+		panic("hyprlofs_direnter: NULL name");
+
+	/*
+	 * This might be a "dangling detached directory". It could have been
+	 * removed, but a reference to it kept in u_cwd. Don't bother searching
+	 * it, and with any luck the user will get tired of dealing with us and
+	 * cd to some absolute pathway. This is in ufs, too.
+	 */
+	if (dir->hln_nlink == 0) {
+		return (ENOENT);
+	}
+
+	/* Search for the entry.  Return "found" if it exists. */
+	hdp = hyprlofs_hash_lookup(name, dir, 1, &found);
+
+	if (hdp) {
+		ASSERT(found);
+		switch (op) {
+		case DE_CREATE:
+		case DE_MKDIR:
+			if (hpp) {
+				*hpp = found;
+				error = EEXIST;
+			} else {
+				hlnode_rele(found);
+			}
+			break;
+		}
+	} else {
+
+		/*
+		 * The entry does not exist. Check write perms in dir to see if
+		 * entry can be created.
+		 */
+		if ((error = hyprlofs_taccess(dir, VWRITE, cr)))
+			return (error);
+
+		/* Make new hlnode and directory entry as required. */
+		if ((error = hldir_make_hlnode(dir, hm, va, op, realvp, &hp,
+		    cr)))
+			return (error);
+
+		if ((error = hldiraddentry(dir, hp, name))) {
+			/* Unmake the inode we just made. */
+			rw_enter(&hp->hln_rwlock, RW_WRITER);
+			if ((hp->hln_type) == VDIR) {
+				ASSERT(hdp == NULL);
+				/* cleanup allocs made by hyprlofs_dirinit() */
+				hyprlofs_dirtrunc(hp);
+			}
+			mutex_enter(&hp->hln_tlock);
+			hp->hln_nlink = 0;
+			mutex_exit(&hp->hln_tlock);
+			gethrestime(&hp->hln_ctime);
+			rw_exit(&hp->hln_rwlock);
+			hlnode_rele(hp);
+			hp = NULL;
+		} else if (hpp) {
+			*hpp = hp;
+		} else {
+			hlnode_rele(hp);
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Delete entry hp of name "nm" from dir. Free dir entry space and decrement
+ * link count on hlnode(s).
+ */
+int
+hyprlofs_dirdelete(hlnode_t *dir, hlnode_t *hp, char *nm, enum dr_op op,
+    cred_t *cr)
+{
+	hldirent_t *hpdp;
+	int error;
+	size_t namelen;
+	hlnode_t *hnp;
+	timestruc_t now;
+
+	ASSERT(RW_WRITE_HELD(&dir->hln_rwlock));
+	ASSERT(RW_WRITE_HELD(&hp->hln_rwlock));
+	ASSERT(dir->hln_type == VDIR);
+
+	if (nm[0] == '\0')
+		panic("hyprlofs_dirdelete: NULL name for %p", (void *)hp);
+
+	/* return error if removing . or .. */
+	if (nm[0] == '.') {
+		if (nm[1] == '\0')
+			return (EINVAL);
+		if (nm[1] == '.' && nm[2] == '\0')
+			return (EEXIST); /* thus in ufs */
+	}
+
+	if ((error = hyprlofs_taccess(dir, VEXEC|VWRITE, cr)) != 0)
+		return (error);
+
+	if (dir->hln_dir == NULL)
+		return (ENOENT);
+
+	hpdp = hyprlofs_hash_lookup(nm, dir, 0, &hnp);
+	if (hpdp == NULL) {
+		/*
+		 * If it is gone, some other thread got here first!
+		 * Return error ENOENT.
+		 */
+		return (ENOENT);
+	}
+
+	/*
+	 * If the hlnode in the hldirent changed (shouldn't happen since we
+	 * don't support rename) then original is gone, so return that status
+	 * (same as UFS).
+	 */
+	if (hp != hnp)
+		return (ENOENT);
+
+	hyprlofs_hash_out(hpdp);
+
+	/* Take hpdp out of the directory list. */
+	ASSERT(hpdp->hld_next != hpdp);
+	ASSERT(hpdp->hld_prev != hpdp);
+	if (hpdp->hld_prev) {
+		hpdp->hld_prev->hld_next = hpdp->hld_next;
+	}
+	if (hpdp->hld_next) {
+		hpdp->hld_next->hld_prev = hpdp->hld_prev;
+	}
+
+	/*
+	 * If the roving slot pointer happens to match hpdp, point it at the
+	 * previous dirent.
+	 */
+	if (dir->hln_dir->hld_prev == hpdp) {
+		dir->hln_dir->hld_prev = hpdp->hld_prev;
+	}
+	ASSERT(hpdp->hld_next != hpdp);
+	ASSERT(hpdp->hld_prev != hpdp);
+
+	/* hpdp points to the correct directory entry */
+	namelen = strlen(hpdp->hld_name) + 1;
+
+	kmem_free(hpdp, sizeof (hldirent_t) + namelen);
+	dir->hln_size -= (sizeof (hldirent_t) + namelen);
+	dir->hln_dirents--;
+
+	gethrestime(&now);
+	dir->hln_mtime = now;
+	dir->hln_ctime = now;
+	hp->hln_ctime = now;
+
+	ASSERT(hp->hln_nlink > 0);
+	DECR_COUNT(&hp->hln_nlink, &hp->hln_tlock);
+	if (op == DR_RMDIR && hp->hln_type == VDIR) {
+		hyprlofs_dirtrunc(hp);
+		ASSERT(hp->hln_nlink == 0);
+	}
+	return (0);
+}
+
+/*
+ * hyprlofs_dirinit initializes a dir with '.' and '..' entries without
+ * checking perms and locking
+ */
+void
+hyprlofs_dirinit(
+	hlnode_t *parent,	/* parent of directory to initialize */
+	hlnode_t *dir)		/* the new directory */
+{
+	hldirent_t *dot, *dotdot;
+	timestruc_t now;
+
+	ASSERT(RW_WRITE_HELD(&parent->hln_rwlock));
+	ASSERT(dir->hln_type == VDIR);
+
+	dot = kmem_zalloc(sizeof (hldirent_t) + 2, KM_SLEEP);
+	dotdot = kmem_zalloc(sizeof (hldirent_t) + 3, KM_SLEEP);
+
+	/* Initialize the entries */
+	dot->hld_hlnode = dir;
+	dot->hld_offset = 0;
+	dot->hld_name = (char *)dot + sizeof (hldirent_t);
+	dot->hld_name[0] = '.';
+	dot->hld_parent = dir;
+	hyprlofs_hash_in(dot);
+
+	dotdot->hld_hlnode = parent;
+	dotdot->hld_offset = 1;
+	dotdot->hld_name = (char *)dotdot + sizeof (hldirent_t);
+	dotdot->hld_name[0] = '.';
+	dotdot->hld_name[1] = '.';
+	dotdot->hld_parent = dir;
+	hyprlofs_hash_in(dotdot);
+
+	/* Initialize directory entry list. */
+	dot->hld_next = dotdot;
+	dot->hld_prev = dotdot;
+	dotdot->hld_next = NULL;
+	dotdot->hld_prev = dot;
+
+	gethrestime(&now);
+	dir->hln_mtime = now;
+	dir->hln_ctime = now;
+
+	/*
+	 * Since hyprlofs_dirinit is called with both dir and parent being the
+	 * same for the root vnode, we need to increment this before we set
+	 * hln_nlink = 2 below.
+	 */
+	INCR_COUNT(&parent->hln_nlink, &parent->hln_tlock);
+	parent->hln_ctime = now;
+
+	dir->hln_dir = dot;
+	dir->hln_size = 2 * sizeof (hldirent_t) + 5; /* dot and dotdot */
+	dir->hln_dirents = 2;
+	dir->hln_nlink = 2;
+}
+
+
+/*
+ * hyprlofs_dirtrunc removes all dir entries under this dir.
+ */
+void
+hyprlofs_dirtrunc(hlnode_t *dir)
+{
+	hldirent_t *hdp;
+	hlnode_t *tp;
+	size_t namelen;
+	timestruc_t now;
+
+	ASSERT(RW_WRITE_HELD(&dir->hln_rwlock));
+	ASSERT(dir->hln_type == VDIR);
+
+	if (dir->hln_looped)
+		return;
+
+	for (hdp = dir->hln_dir; hdp; hdp = dir->hln_dir) {
+		ASSERT(hdp->hld_next != hdp);
+		ASSERT(hdp->hld_prev != hdp);
+		ASSERT(hdp->hld_hlnode);
+
+		dir->hln_dir = hdp->hld_next;
+		namelen = strlen(hdp->hld_name) + 1;
+
+		/*
+		 * Adjust the link counts to account for this dir entry removal.
+		 */
+		tp = hdp->hld_hlnode;
+
+		ASSERT(tp->hln_nlink > 0);
+		DECR_COUNT(&tp->hln_nlink, &tp->hln_tlock);
+
+		hyprlofs_hash_out(hdp);
+
+		kmem_free(hdp, sizeof (hldirent_t) + namelen);
+		dir->hln_size -= (sizeof (hldirent_t) + namelen);
+		dir->hln_dirents--;
+	}
+
+	gethrestime(&now);
+	dir->hln_mtime = now;
+	dir->hln_ctime = now;
+
+	ASSERT(dir->hln_dir == NULL);
+	ASSERT(dir->hln_size == 0);
+	ASSERT(dir->hln_dirents == 0);
+}
+
+static int
+hldiraddentry(
+    hlnode_t	*dir,	/* target directory to make entry in */
+    hlnode_t	*hp,	/* new hlnode */
+    char	*name)
+{
+	hldirent_t	*hdp, *hpdp;
+	size_t		namelen, alloc_size;
+	timestruc_t	now;
+
+	/*
+	 * Make sure the parent dir wasn't removed from underneath the caller.
+	 */
+	if (dir->hln_dir == NULL)
+		return (ENOENT);
+
+	/* Check that everything is on the same FS. */
+	if (hp->hln_vnode->v_vfsp != dir->hln_vnode->v_vfsp)
+		return (EXDEV);
+
+	/* Alloc and init dir entry */
+	namelen = strlen(name) + 1;
+	alloc_size = namelen + sizeof (hldirent_t);
+	hdp = kmem_zalloc(alloc_size, KM_NORMALPRI | KM_NOSLEEP);
+	if (hdp == NULL)
+		return (ENOSPC);
+
+	dir->hln_size += alloc_size;
+	dir->hln_dirents++;
+	hdp->hld_hlnode = hp;
+	hdp->hld_parent = dir;
+
+	/* The dir entry and its name were allocated sequentially. */
+	hdp->hld_name = (char *)hdp + sizeof (hldirent_t);
+	(void) strcpy(hdp->hld_name, name);
+
+	hyprlofs_hash_in(hdp);
+
+	/*
+	 * Some utilities expect the size of a directory to remain fairly
+	 * static.  For example, a routine which unlinks files between calls to
+	 * readdir(); the size of the dir changes from underneath it and so the
+	 * real dir offset in bytes is invalid.  To circumvent this problem, we
+	 * initialize a dir entry with a phony offset, and use this offset to
+	 * determine end of file in hyprlofs_readdir.
+	 */
+	hpdp = dir->hln_dir->hld_prev;
+	/*
+	 * Install at first empty "slot" in directory list.
+	 */
+	while (hpdp->hld_next != NULL && (hpdp->hld_next->hld_offset -
+	    hpdp->hld_offset) <= 1) {
+		ASSERT(hpdp->hld_next != hpdp);
+		ASSERT(hpdp->hld_prev != hpdp);
+		ASSERT(hpdp->hld_next->hld_offset > hpdp->hld_offset);
+		hpdp = hpdp->hld_next;
+	}
+	hdp->hld_offset = hpdp->hld_offset + 1;
+
+	/*
+	 * If we're at the end of the dirent list and the offset (which is
+	 * necessarily the largest offset in this dir) is more than twice the
+	 * number of dirents, that means the dir is 50% holes.  At this point
+	 * we reset the slot pointer back to the beginning of the dir so we
+	 * start using the holes. The idea is that if there are N dirents,
+	 * there must also be N holes, so we can satisfy the next N creates by
+	 * walking at most 2N entries; thus the average cost of a create is
+	 * constant. Note that we use the first dirent's hld_prev as the roving
+	 * slot pointer. This saves a word in every dirent.
+	 */
+	if (hpdp->hld_next == NULL && hpdp->hld_offset > 2 * dir->hln_dirents)
+		dir->hln_dir->hld_prev = dir->hln_dir->hld_next;
+	else
+		dir->hln_dir->hld_prev = hdp;
+
+	ASSERT(hpdp->hld_next != hpdp);
+	ASSERT(hpdp->hld_prev != hpdp);
+
+	hdp->hld_next = hpdp->hld_next;
+	if (hdp->hld_next) {
+		hdp->hld_next->hld_prev = hdp;
+	}
+	hdp->hld_prev = hpdp;
+	hpdp->hld_next = hdp;
+
+	ASSERT(hdp->hld_next != hdp);
+	ASSERT(hdp->hld_prev != hdp);
+	ASSERT(hpdp->hld_next != hpdp);
+	ASSERT(hpdp->hld_prev != hpdp);
+
+	gethrestime(&now);
+	dir->hln_mtime = now;
+	dir->hln_ctime = now;
+
+	return (0);
+}
+
+static int
+hldir_make_hlnode(hlnode_t *dir, hlfsmount_t *hm, vattr_t *va, enum de_op op,
+    vnode_t *realvp, hlnode_t **newnode, cred_t *cr)
+{
+	hlnode_t	*hp;
+	enum vtype	type;
+
+	ASSERT(va != NULL);
+	ASSERT(op == DE_CREATE || op == DE_MKDIR);
+	if (((va->va_mask & AT_ATIME) && TIMESPEC_OVERFLOW(&va->va_atime)) ||
+	    ((va->va_mask & AT_MTIME) && TIMESPEC_OVERFLOW(&va->va_mtime)))
+		return (EOVERFLOW);
+	type = va->va_type;
+	hp = kmem_zalloc(sizeof (hlnode_t), KM_SLEEP);
+	hyprlofs_node_init(hm, hp, va, cr);
+
+	hp->hln_vnode->v_rdev = hp->hln_rdev = NODEV;
+	hp->hln_vnode->v_type = type;
+	hp->hln_uid = crgetuid(cr);
+
+	/*
+	 * To determine the gid of the created file:
+	 *   If the directory's set-gid bit is set, set the gid to the gid
+	 *   of the parent dir, otherwise, use the process's gid.
+	 */
+	if (dir->hln_mode & VSGID)
+		hp->hln_gid = dir->hln_gid;
+	else
+		hp->hln_gid = crgetgid(cr);
+
+	/*
+	 * If we're creating a dir and the parent dir has the set-GID bit set,
+	 * set it on the new dir. Otherwise, if the user is neither privileged
+	 * nor a member of the file's new group, clear the file's set-GID bit.
+	 */
+	if (dir->hln_mode & VSGID && type == VDIR)
+		hp->hln_mode |= VSGID;
+	else {
+		if ((hp->hln_mode & VSGID) &&
+		    secpolicy_vnode_setids_setgids(cr, hp->hln_gid) != 0)
+			hp->hln_mode &= ~VSGID;
+	}
+
+	if (va->va_mask & AT_ATIME)
+		hp->hln_atime = va->va_atime;
+	if (va->va_mask & AT_MTIME)
+		hp->hln_mtime = va->va_mtime;
+
+	if (op == DE_MKDIR) {
+		hyprlofs_dirinit(dir, hp);
+		hp->hln_looped = 0;
+	} else {
+		hp->hln_realvp = realvp;
+		hp->hln_size = va->va_size;
+		hp->hln_looped = 1;
+	}
+
+	*newnode = hp;
+	return (0);
+}
diff --git a/usr/src/uts/common/fs/hyprlofs/hyprlofs_subr.c b/usr/src/uts/common/fs/hyprlofs/hyprlofs_subr.c
new file mode 100644
index 0000000000..1d857309f3
--- /dev/null
+++ b/usr/src/uts/common/fs/hyprlofs/hyprlofs_subr.c
@@ -0,0 +1,127 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ */
+
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/param.h>
+#include <sys/t_lock.h>
+#include <sys/systm.h>
+#include <sys/sysmacros.h>
+#include <sys/debug.h>
+#include <sys/time.h>
+#include <sys/cmn_err.h>
+#include <sys/vnode.h>
+#include <sys/stat.h>
+#include <sys/mode.h>
+#include <sys/vfs.h>
+#include <sys/cred.h>
+#include <sys/kmem.h>
+#include <sys/atomic.h>
+#include <sys/policy.h>
+#include <sys/fs/hyprlofs_info.h>
+
+#define	MODESHIFT	3
+
+/* Initialize a hlnode and add it to file list under mount point. */
+void
+hyprlofs_node_init(hlfsmount_t *hm, hlnode_t *h, vattr_t *vap, cred_t *cr)
+{
+	vnode_t *vp;
+	timestruc_t now;
+
+	ASSERT(vap != NULL);
+
+	rw_init(&h->hln_rwlock, NULL, RW_DEFAULT, NULL);
+	mutex_init(&h->hln_tlock, NULL, MUTEX_DEFAULT, NULL);
+	h->hln_mode = MAKEIMODE(vap->va_type, vap->va_mode);
+	h->hln_mask = 0;
+	h->hln_type = vap->va_type;
+	h->hln_nodeid = (ino64_t)(uint32_t)((uintptr_t)h >> 3);
+	h->hln_nlink = 1;
+	h->hln_size = 0;
+
+	if (cr == NULL) {
+		h->hln_uid = vap->va_uid;
+		h->hln_gid = vap->va_gid;
+	} else {
+		h->hln_uid = crgetuid(cr);
+		h->hln_gid = crgetgid(cr);
+	}
+
+	h->hln_fsid = hm->hlm_dev;
+	h->hln_rdev = vap->va_rdev;
+	h->hln_blksize = PAGESIZE;
+	h->hln_nblocks = 0;
+	gethrestime(&now);
+	h->hln_atime = now;
+	h->hln_mtime = now;
+	h->hln_ctime = now;
+	h->hln_seq = 0;
+	h->hln_dir = NULL;
+
+	h->hln_vnode = vn_alloc(KM_SLEEP);
+	vp = HLNTOV(h);
+	vn_setops(vp, hyprlofs_vnodeops);
+	vp->v_vfsp = hm->hlm_vfsp;
+	vp->v_type = vap->va_type;
+	vp->v_rdev = vap->va_rdev;
+	vp->v_data = (caddr_t)h;
+	mutex_enter(&hm->hlm_contents);
+	/*
+	 * Increment the pseudo generation number for this hlnode. Since
+	 * hlnodes are allocated and freed, there really is no particular
+	 * generation number for a new hlnode.  Just fake it by using a
+	 * counter in each file system.
+	 */
+	h->hln_gen = hm->hlm_gen++;
+
+	/*
+	 * Add new hlnode to end of linked list of hlnodes for this hyprlofs
+	 * Root dir is handled specially in hyprlofs_mount.
+	 */
+	if (hm->hlm_rootnode != (hlnode_t *)NULL) {
+		h->hln_forw = NULL;
+		h->hln_back = hm->hlm_rootnode->hln_back;
+		h->hln_back->hln_forw = hm->hlm_rootnode->hln_back = h;
+	}
+	mutex_exit(&hm->hlm_contents);
+	vn_exists(vp);
+}
+
+int
+hyprlofs_taccess(void *vtp, int mode, cred_t *cr)
+{
+	hlnode_t *hp = vtp;
+	int shift = 0;
+
+	/* Check access based on owner, group and public perms in hlnode. */
+	if (crgetuid(cr) != hp->hln_uid) {
+		shift += MODESHIFT;
+		if (groupmember(hp->hln_gid, cr) == 0)
+			shift += MODESHIFT;
+	}
+
+	return (secpolicy_vnode_access2(cr, HLNTOV(hp), hp->hln_uid,
+	    hp->hln_mode << shift, mode));
+}
diff --git a/usr/src/uts/common/fs/hyprlofs/hyprlofs_vfsops.c b/usr/src/uts/common/fs/hyprlofs/hyprlofs_vfsops.c
new file mode 100644
index 0000000000..c582a8cac2
--- /dev/null
+++ b/usr/src/uts/common/fs/hyprlofs/hyprlofs_vfsops.c
@@ -0,0 +1,614 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ */
+
+/*
+ * Hyperlofs is a hybrid file system combining features of the tmpfs(7FS) and
+ * lofs(7FS) file systems.  It is modeled on code from both of these file
+ * systems.
+ *
+ * The purpose is to create a high performance name space for files on which
+ * applications will compute.  Given a large number of data files with various
+ * owners, we want to construct a view onto those files such that only a subset
+ * is visible to the applications and such that the view can be changed very
+ * quickly as compute progresses.  Entries in the name space are not mounts and
+ * thus do not appear in the mnttab.  Entries in the name space are allowed to
+ * refer to files on different backing file systems.  Intermediate directories
+ * in the name space exist only in-memory, ala tmpfs.  There are no leaf nodes
+ * in the name space except for entries that refer to backing files ala lofs.
+ *
+ * The name space is managed via ioctls issued on the mounted file system and
+ * is mostly read-only for the compute applications.  That is, applications
+ * cannot create new files in the name space. If a file is unlinked by an
+ * application, that only removes the file from the name space, the backing
+ * file remains in place.  It is possible for applications to write-through to
+ * the backing files if the file system is mounted read-write.
+ *
+ * The name space is managed via the HYPRLOFS_ADD_ENTRIES, HYPRLOFS_RM_ENTRIES,
+ * and HYPRLOFS_RM_ALL ioctls on the top-level mount.
+ *
+ * The HYPRLOFS_ADD_ENTRIES ioctl specifies path(s) to the backing file(s) and
+ * the name(s) for the file(s) in the name space.  The name(s) may be path(s)
+ * which will be relative to the root of the mount and thus cannot begin with
+ * a /. If the name is a path, it does not have to correspond to any backing
+ * path. The intermediate directories will only exist in the name space. The
+ * entry(ies) will be added to the name space.
+ *
+ * The HYPRLOFS_RM_ENTRIES ioctl specifies the name(s) of the file(s) in the
+ * name space which should be removed.  The name(s) may be path(s) which will
+ * be relative to the root of the mount and thus cannot begin with a /.  The
+ * named entry(ies) will be removed.
+ *
+ * The HYPRLOFS_RM_ALL ioctl will remove all mappings from the name space.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/kmem.h>
+#include <sys/time.h>
+#include <sys/pathname.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/stat.h>
+#include <sys/errno.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/statvfs.h>
+#include <sys/mount.h>
+#include <sys/debug.h>
+#include <sys/systm.h>
+#include <sys/mntent.h>
+#include <fs/fs_subr.h>
+#include <vm/page.h>
+#include <vm/anon.h>
+#include <sys/model.h>
+#include <sys/policy.h>
+
+#include <sys/fs/swapnode.h>
+#include <sys/fs/hyprlofs_info.h>
+
+static int hyprlofsfstype;
+
+/*
+ * hyprlofs vfs operations.
+ */
+static int hyprlofsinit(int, char *);
+static int hyprlofs_mount(vfs_t *, vnode_t *, struct mounta *, cred_t *);
+static int hyprlofs_unmount(vfs_t *, int, cred_t *);
+static int hyprlofs_root(vfs_t *, vnode_t **);
+static int hyprlofs_statvfs(vfs_t *, struct statvfs64 *);
+static int hyprlofs_vget(vfs_t *, vnode_t **, struct fid *);
+
+/*
+ * Loadable module wrapper
+ */
+#include <sys/modctl.h>
+
+static mntopts_t hyprlofs_mntopts;
+
+static vfsdef_t vfw = {
+	VFSDEF_VERSION,
+	"hyprlofs",
+	hyprlofsinit,
+	VSW_HASPROTO|VSW_CANREMOUNT|VSW_STATS|VSW_ZMOUNT,
+	&hyprlofs_mntopts
+};
+
+static mntopts_t hyprlofs_mntopts = {
+	0, NULL
+};
+
+/*
+ * Module linkage information
+ */
+static struct modlfs modlfs = {
+	&mod_fsops, "filesystem for hyprlofs", &vfw
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, &modlfs, NULL
+};
+
+int
+_init()
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_fini()
+{
+	int error;
+
+	error = mod_remove(&modlinkage);
+	if (error)
+		return (error);
+	/*
+	 * Tear down the operations vectors
+	 */
+	(void) vfs_freevfsops_by_type(hyprlofsfstype);
+	vn_freevnodeops(hyprlofs_vnodeops);
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+/*
+ * The following are patchable variables limiting the amount of system
+ * resources hyprlofs can use.
+ *
+ * hyprlofs_maxkmem limits the amount of kernel kmem_alloc memory hyprlofs can
+ * use for it's data structures (e.g. hlnodes, directory entries). It is set
+ * as a percentage of physical memory which is determined when hyprlofs is
+ * first used in the system.
+ *
+ * hyprlofs_minfree is the minimum amount of swap space that hyprlofs leaves for
+ * the rest of the system. If the amount of free swap space in the system
+ * (i.e. anoninfo.ani_free) drops below hyprlofs_minfree, hyprlofs anon
+ * allocations will fail.
+ */
+size_t hyprlofs_maxkmem = 0;
+size_t hyprlofs_minfree = 0;
+size_t hyprlofs_kmemspace;	/* bytes of kernel heap used by all hyprlofs */
+
+static major_t hyprlofs_major;
+static minor_t hyprlofs_minor;
+static kmutex_t	hyprlofs_minor_lock;
+
+/*
+ * initialize global hyprlofs locks and hashes when loading hyprlofs module
+ */
+static int
+hyprlofsinit(int fstype, char *name)
+{
+	static const fs_operation_def_t hl_vfsops_template[] = {
+		VFSNAME_MOUNT,		{ .vfs_mount = hyprlofs_mount },
+		VFSNAME_UNMOUNT,	{ .vfs_unmount = hyprlofs_unmount },
+		VFSNAME_ROOT,		{ .vfs_root = hyprlofs_root },
+		VFSNAME_STATVFS,	{ .vfs_statvfs = hyprlofs_statvfs },
+		VFSNAME_VGET,		{ .vfs_vget = hyprlofs_vget },
+		NULL,			NULL
+	};
+	int error;
+	extern  void    hyprlofs_hash_init();
+
+	hyprlofs_hash_init();
+	hyprlofsfstype = fstype;
+	ASSERT(hyprlofsfstype != 0);
+
+	error = vfs_setfsops(fstype, hl_vfsops_template, NULL);
+	if (error != 0) {
+		cmn_err(CE_WARN, "hyprlofsinit: bad vfs ops template");
+		return (error);
+	}
+
+	error = vn_make_ops(name, hyprlofs_vnodeops_template,
+	    &hyprlofs_vnodeops);
+	if (error != 0) {
+		(void) vfs_freevfsops_by_type(fstype);
+		cmn_err(CE_WARN, "hyprlofsinit: bad vnode ops template");
+		return (error);
+	}
+
+	/*
+	 * hyprlofs_minfree is an absolute limit of swap space which still
+	 * allows other processes to execute.  Set it if its not patched.
+	 */
+	if (hyprlofs_minfree == 0)
+		hyprlofs_minfree = btopr(HYPRLOFSMINFREE);
+
+	if ((hyprlofs_major = getudev()) == (major_t)-1) {
+		cmn_err(CE_WARN,
+		    "hyprlofsinit: Can't get unique device number.");
+		hyprlofs_major = 0;
+	}
+	mutex_init(&hyprlofs_minor_lock, NULL, MUTEX_DEFAULT, NULL);
+	return (0);
+}
+
+static int
+hyprlofs_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
+{
+	hlfsmount_t *hm = NULL;
+	hlnode_t *hp;
+	struct pathname dpn;
+	int error;
+	vattr_t rattr;
+	int got_attrs;
+
+	if ((error = secpolicy_fs_mount(cr, mvp, vfsp)) != 0)
+		return (error);
+	if (secpolicy_hyprlofs_control(cr) != 0)
+		return (EPERM);
+
+	if (mvp->v_type != VDIR)
+		return (ENOTDIR);
+
+	if (uap->flags & MS_REMOUNT)
+		return (EBUSY);
+
+	mutex_enter(&mvp->v_lock);
+	if ((uap->flags & MS_OVERLAY) == 0 &&
+	    (mvp->v_count != 1 || (mvp->v_flag & VROOT))) {
+		mutex_exit(&mvp->v_lock);
+		return (EBUSY);
+	}
+	mutex_exit(&mvp->v_lock);
+
+	/* Having the resource be anything but "swap" doesn't make sense. */
+	vfs_setresource(vfsp, "swap", 0);
+
+	if ((error = pn_get(uap->dir,
+	    (uap->flags & MS_SYSSPACE) ? UIO_SYSSPACE : UIO_USERSPACE,
+	    &dpn)) != 0)
+		goto out;
+
+	if ((hm = kmem_zalloc(sizeof (hlfsmount_t),
+	    KM_NORMALPRI | KM_NOSLEEP)) == NULL) {
+		pn_free(&dpn);
+		error = ENOMEM;
+		goto out;
+	}
+
+	/* Get an available minor device number for this mount */
+	mutex_enter(&hyprlofs_minor_lock);
+	do {
+		hyprlofs_minor = (hyprlofs_minor + 1) & L_MAXMIN32;
+		hm->hlm_dev = makedevice(hyprlofs_major, hyprlofs_minor);
+	} while (vfs_devismounted(hm->hlm_dev));
+	mutex_exit(&hyprlofs_minor_lock);
+
+	/*
+	 * Set but don't bother entering the mutex since hlfsmount is not on
+	 * the mount list yet.
+	 */
+	mutex_init(&hm->hlm_contents, NULL, MUTEX_DEFAULT, NULL);
+
+	hm->hlm_vfsp = vfsp;
+
+	vfsp->vfs_data = (caddr_t)hm;
+	vfsp->vfs_fstype = hyprlofsfstype;
+	vfsp->vfs_dev = hm->hlm_dev;
+	vfsp->vfs_bsize = PAGESIZE;
+	vfsp->vfs_flag |= VFS_NOTRUNC;
+	vfs_make_fsid(&vfsp->vfs_fsid, hm->hlm_dev, hyprlofsfstype);
+	hm->hlm_mntpath = kmem_zalloc(dpn.pn_pathlen + 1, KM_SLEEP);
+	(void) strcpy(hm->hlm_mntpath, dpn.pn_path);
+
+	/* allocate and initialize root hlnode structure */
+	bzero(&rattr, sizeof (vattr_t));
+	rattr.va_mode = (mode_t)(S_IFDIR | 0777);
+	rattr.va_type = VDIR;
+	rattr.va_rdev = 0;
+	hp = kmem_zalloc(sizeof (hlnode_t), KM_SLEEP);
+	hyprlofs_node_init(hm, hp, &rattr, cr);
+
+	/* Get the mode, uid, and gid from the underlying mount point. */
+	rattr.va_mask = AT_MODE|AT_UID|AT_GID;
+	got_attrs = VOP_GETATTR(mvp, &rattr, 0, cr, NULL);
+
+	rw_enter(&hp->hln_rwlock, RW_WRITER);
+	HLNTOV(hp)->v_flag |= VROOT;
+
+	/*
+	 * If the getattr succeeded, use its results, otherwise allow the
+	 * previously set defaults to prevail.
+	 */
+	if (got_attrs == 0) {
+		hp->hln_mode = rattr.va_mode;
+		hp->hln_uid = rattr.va_uid;
+		hp->hln_gid = rattr.va_gid;
+	}
+
+	/*
+	 * Initialize linked list of hlnodes so that the back pointer of the
+	 * root hlnode always points to the last one on the list and the
+	 * forward pointer of the last node is null
+	 */
+	hp->hln_back = hp;
+	hp->hln_forw = NULL;
+	hp->hln_nlink = 0;
+	hm->hlm_rootnode = hp;
+
+	hyprlofs_dirinit(hp, hp);
+
+	rw_exit(&hp->hln_rwlock);
+
+	pn_free(&dpn);
+	error = 0;
+
+out:
+	return (error);
+}
+
+static int
+hyprlofs_unmount(vfs_t *vfsp, int flag, cred_t *cr)
+{
+	hlfsmount_t *hm = (hlfsmount_t *)VFSTOHLM(vfsp);
+	hlnode_t *hnp, *cancel;
+	vnode_t	*vp;
+	int error;
+
+	if ((error = secpolicy_fs_unmount(cr, vfsp)) != 0)
+		return (error);
+	if (secpolicy_hyprlofs_control(cr) != 0)
+		return (EPERM);
+
+	/*
+	 * forced unmount is not supported by this file system
+	 * and thus, ENOTSUP, is being returned.
+	 */
+	if (flag & MS_FORCE)
+		return (ENOTSUP);
+
+	mutex_enter(&hm->hlm_contents);
+
+	/*
+	 * If there are no open files, only the root node should have a ref cnt.
+	 * With hlm_contents held, nothing can be added or removed. There may
+	 * be some dirty pages.  To prevent fsflush from disrupting the unmount,
+	 * put a hold on each node while scanning. If we find a previously
+	 * referenced node, undo the holds we have placed and fail EBUSY.
+	 */
+	hnp = hm->hlm_rootnode;
+	if (HLNTOV(hnp)->v_count > 1) {
+		mutex_exit(&hm->hlm_contents);
+		return (EBUSY);
+	}
+
+	for (hnp = hnp->hln_forw; hnp; hnp = hnp->hln_forw) {
+		if ((vp = HLNTOV(hnp))->v_count > 0) {
+			cancel = hm->hlm_rootnode->hln_forw;
+			while (cancel != hnp) {
+				vp = HLNTOV(cancel);
+				ASSERT(vp->v_count > 0);
+				VN_RELE(vp);
+				cancel = cancel->hln_forw;
+			}
+			mutex_exit(&hm->hlm_contents);
+			return (EBUSY);
+		}
+		VN_HOLD(vp);
+	}
+
+	/* We can drop the mutex now because no one can find this mount */
+	mutex_exit(&hm->hlm_contents);
+
+	/*
+	 * Free all alloc'd memory associated with this FS. To do this, we go
+	 * through the file list twice, once to remove all the dir entries, and
+	 * then to remove all the files.
+	 */
+
+	/* Remove all directory entries */
+	for (hnp = hm->hlm_rootnode; hnp; hnp = hnp->hln_forw) {
+		rw_enter(&hnp->hln_rwlock, RW_WRITER);
+		if (hnp->hln_type == VDIR)
+			hyprlofs_dirtrunc(hnp);
+		rw_exit(&hnp->hln_rwlock);
+	}
+
+	ASSERT(hm->hlm_rootnode);
+
+	/*
+	 * All links are gone, v_count is keeping nodes in place. VN_RELE
+	 * should make the node disappear, unless somebody is holding pages
+	 * against it.  Wait and retry until it disappears.
+	 *
+	 * We re-acquire the lock to prevent others who have a HOLD on a hlnode
+	 * from blowing it away (in hyprlofs_inactive) while we're trying to
+	 * get to it here. Once we have a HOLD on it we know it'll stick around.
+	 */
+	mutex_enter(&hm->hlm_contents);
+
+	/* Remove all the files (except the rootnode) backwards. */
+	while ((hnp = hm->hlm_rootnode->hln_back) != hm->hlm_rootnode) {
+		mutex_exit(&hm->hlm_contents);
+		/* Note we handled the link count in pass 2 above. */
+		vp = HLNTOV(hnp);
+		VN_RELE(vp);
+		mutex_enter(&hm->hlm_contents);
+		/*
+		 * It's still there after the RELE. Someone else like pageout
+		 * has a hold on it so wait a bit and then try again.
+		 */
+		if (hnp == hm->hlm_rootnode->hln_back) {
+			VN_HOLD(vp);
+			mutex_exit(&hm->hlm_contents);
+			delay(hz / 4);
+			mutex_enter(&hm->hlm_contents);
+		}
+	}
+	mutex_exit(&hm->hlm_contents);
+
+	VN_RELE(HLNTOV(hm->hlm_rootnode));
+
+	ASSERT(hm->hlm_mntpath);
+
+	kmem_free(hm->hlm_mntpath, strlen(hm->hlm_mntpath) + 1);
+
+	mutex_destroy(&hm->hlm_contents);
+	kmem_free(hm, sizeof (hlfsmount_t));
+
+	return (0);
+}
+
+/* Return root hlnode for given vnode */
+static int
+hyprlofs_root(vfs_t *vfsp, vnode_t **vpp)
+{
+	hlfsmount_t *hm = (hlfsmount_t *)VFSTOHLM(vfsp);
+	hlnode_t *hp = hm->hlm_rootnode;
+	vnode_t *vp;
+
+	ASSERT(hp);
+
+	vp = HLNTOV(hp);
+	VN_HOLD(vp);
+	*vpp = vp;
+	return (0);
+}
+
+static int
+hyprlofs_statvfs(vfs_t *vfsp, struct statvfs64 *sbp)
+{
+	hlfsmount_t *hm = (hlfsmount_t *)VFSTOHLM(vfsp);
+	ulong_t	blocks;
+	dev32_t d32;
+	zoneid_t eff_zid;
+	struct zone *zp;
+
+	/*
+	 * The FS may have been mounted by the GZ on behalf of the NGZ.  In
+	 * that case, the hlfsmount zone_id will be the global zone.  We want
+	 * to show the swap cap inside the zone in this case, even though the
+	 * FS was mounted by the GZ.
+	 */
+	if (curproc->p_zone->zone_id != GLOBAL_ZONEUNIQID)
+		zp = curproc->p_zone;
+	else
+		zp = hm->hlm_vfsp->vfs_zone;
+
+	if (zp == NULL)
+		eff_zid = GLOBAL_ZONEUNIQID;
+	else
+		eff_zid = zp->zone_id;
+
+	sbp->f_bsize = PAGESIZE;
+	sbp->f_frsize = PAGESIZE;
+
+	/*
+	 * Find the amount of available physical and memory swap
+	 */
+	mutex_enter(&anoninfo_lock);
+	ASSERT(k_anoninfo.ani_max >= k_anoninfo.ani_phys_resv);
+	blocks = (ulong_t)CURRENT_TOTAL_AVAILABLE_SWAP;
+	mutex_exit(&anoninfo_lock);
+
+	if (blocks > hyprlofs_minfree)
+		sbp->f_bfree = blocks - hyprlofs_minfree;
+	else
+		sbp->f_bfree = 0;
+
+	sbp->f_bavail = sbp->f_bfree;
+
+	/*
+	 * Total number of blocks is what's available plus what's been used
+	 */
+	sbp->f_blocks = (fsblkcnt64_t)(sbp->f_bfree);
+
+	if (eff_zid != GLOBAL_ZONEUNIQID &&
+	    zp->zone_max_swap_ctl != UINT64_MAX) {
+		/*
+		 * If the fs is used by a NGZ with a swap cap, then report the
+		 * capped size.
+		 */
+		rctl_qty_t cap, used;
+		pgcnt_t pgcap, pgused;
+
+		mutex_enter(&zp->zone_mem_lock);
+		cap = zp->zone_max_swap_ctl;
+		used = zp->zone_max_swap;
+		mutex_exit(&zp->zone_mem_lock);
+
+		pgcap = btop(cap);
+		pgused = btop(used);
+
+		sbp->f_bfree = MIN(pgcap - pgused, sbp->f_bfree);
+		sbp->f_bavail = sbp->f_bfree;
+		sbp->f_blocks = MIN(pgcap, sbp->f_blocks);
+	}
+
+	/*
+	 * This is fairly inaccurate since it doesn't take into account the
+	 * names stored in the directory entries.
+	 */
+	sbp->f_ffree = sbp->f_files = ptob(availrmem) /
+	    (sizeof (hlnode_t) + sizeof (hldirent_t));
+
+	sbp->f_favail = (fsfilcnt64_t)(sbp->f_ffree);
+	(void) cmpldev(&d32, vfsp->vfs_dev);
+	sbp->f_fsid = d32;
+	(void) strcpy(sbp->f_basetype, vfssw[hyprlofsfstype].vsw_name);
+	(void) strncpy(sbp->f_fstr, hm->hlm_mntpath, sizeof (sbp->f_fstr));
+	/*
+	 * ensure null termination
+	 */
+	sbp->f_fstr[sizeof (sbp->f_fstr) - 1] = '\0';
+	sbp->f_flag = vf_to_stf(vfsp->vfs_flag);
+	sbp->f_namemax = MAXNAMELEN - 1;
+	return (0);
+}
+
+static int
+hyprlofs_vget(vfs_t *vfsp, vnode_t **vpp, struct fid *fidp)
+{
+	hlfid_t *hfid;
+	hlfsmount_t *hm = (hlfsmount_t *)VFSTOHLM(vfsp);
+	hlnode_t *hp = NULL;
+
+	hfid = (hlfid_t *)fidp;
+	*vpp = NULL;
+
+	mutex_enter(&hm->hlm_contents);
+	for (hp = hm->hlm_rootnode; hp; hp = hp->hln_forw) {
+		mutex_enter(&hp->hln_tlock);
+		if (hp->hln_nodeid == hfid->hlfid_ino) {
+			/*
+			 * If the gen numbers don't match we know the file
+			 * won't be found since only one hlnode can have this
+			 * number at a time.
+			 */
+			if (hp->hln_gen != hfid->hlfid_gen ||
+			    hp->hln_nlink == 0) {
+				mutex_exit(&hp->hln_tlock);
+				mutex_exit(&hm->hlm_contents);
+				return (0);
+			}
+			*vpp = (vnode_t *)HLNTOV(hp);
+
+			VN_HOLD(*vpp);
+
+			if ((hp->hln_mode & S_ISVTX) &&
+			    !(hp->hln_mode & (S_IXUSR | S_IFDIR))) {
+				mutex_enter(&(*vpp)->v_lock);
+				(*vpp)->v_flag |= VISSWAP;
+				mutex_exit(&(*vpp)->v_lock);
+			}
+			mutex_exit(&hp->hln_tlock);
+			mutex_exit(&hm->hlm_contents);
+			return (0);
+		}
+		mutex_exit(&hp->hln_tlock);
+	}
+	mutex_exit(&hm->hlm_contents);
+	return (0);
+}
diff --git a/usr/src/uts/common/fs/hyprlofs/hyprlofs_vnops.c b/usr/src/uts/common/fs/hyprlofs/hyprlofs_vnops.c
new file mode 100644
index 0000000000..52dba31761
--- /dev/null
+++ b/usr/src/uts/common/fs/hyprlofs/hyprlofs_vnops.c
@@ -0,0 +1,1450 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/t_lock.h>
+#include <sys/systm.h>
+#include <sys/sysmacros.h>
+#include <sys/user.h>
+#include <sys/time.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/file.h>
+#include <sys/fcntl.h>
+#include <sys/flock.h>
+#include <sys/kmem.h>
+#include <sys/errno.h>
+#include <sys/stat.h>
+#include <sys/cred.h>
+#include <sys/dirent.h>
+#include <sys/pathname.h>
+#include <sys/fs/hyprlofs.h>
+#include <sys/fs/hyprlofs_info.h>
+#include <sys/mman.h>
+#include <vm/pvn.h>
+#include <sys/cmn_err.h>
+#include <sys/buf.h>
+#include <sys/policy.h>
+#include <fs/fs_subr.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+
+static int hyprlofs_add_entry(vnode_t *, char *, char *, cred_t *,
+		caller_context_t *);
+static int hyprlofs_rm_entry(vnode_t *, char *, cred_t *, caller_context_t *,
+		int);
+static int hyprlofs_rm_all(vnode_t *, cred_t *, caller_context_t *, int);
+static int hyprlofs_remove(vnode_t *, char *, cred_t *, caller_context_t *,
+		int);
+static int hyprlofs_get_all(vnode_t *, intptr_t, cred_t *, caller_context_t *,
+		int);
+
+/*
+ * This is a somewhat arbitrary upper limit on the number of entries we can
+ * pass in on a single add/rm ioctl call.  This is only used to validate that
+ * the input list looks sane.
+ */
+#define	MAX_IOCTL_PARAMS	100000
+
+static int
+hyprlofs_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
+{
+	vnode_t *rvp;
+	int error;
+
+	rvp = REALVP(*vpp);
+
+	if (VTOHLN(*vpp)->hln_looped == 0)
+		return (0);
+
+	/*
+	 * looped back, pass through to real vnode. Need to hold new reference
+	 * to vp since VOP_OPEN() may decide to release it.
+	 */
+	VN_HOLD(rvp);
+	error = VOP_OPEN(&rvp, flag, cr, ct);
+	ASSERT(rvp->v_count > 1);
+	VN_RELE(rvp);
+
+	return (error);
+}
+
+static int
+hyprlofs_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
+    caller_context_t *ct)
+{
+	if (VTOHLN(vp)->hln_looped == 0) {
+		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
+		cleanshares(vp, ttoproc(curthread)->p_pid);
+		return (0);
+	}
+
+	return (VOP_CLOSE(REALVP(vp), flag, count, offset, cr, ct));
+}
+
+static int
+hyprlofs_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
+    caller_context_t *ct)
+{
+	if (vp->v_type == VDIR)
+		return (EISDIR);
+	return (VOP_READ(REALVP(vp), uiop, ioflag, cr, ct));
+}
+
+static int
+hyprlofs_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
+    caller_context_t *ct)
+{
+	/* We don't support writing to non-regular files */
+	if (vp->v_type != VREG)
+		return (EINVAL);
+
+	if (vn_is_readonly(vp))
+		return (EROFS);
+
+	return (VOP_WRITE(REALVP(vp), uiop, ioflag, cr, ct));
+}
+
+/* ARGSUSED */
+static int
+hyprlofs_ioctl(vnode_t *vp, int cmd, intptr_t data, int flag,
+    cred_t *cr, int *rvalp, caller_context_t *ct)
+{
+	uint_t len, cnt;
+	int i, error;
+	model_t model;
+	char path[MAXPATHLEN];
+	char nm[MAXPATHLEN];
+
+	/* We only support the hyprlofs ioctls on the root vnode */
+	if (!(vp->v_flag & VROOT))
+		return (ENOTTY);
+
+	/*
+	 * Check if managing hyprlofs is allowed.
+	 */
+	if (secpolicy_hyprlofs_control(cr) != 0)
+		return (EPERM);
+
+	if (cmd == HYPRLOFS_ADD_ENTRIES || cmd == HYPRLOFS_RM_ENTRIES) {
+		model = get_udatamodel();
+
+		if (model == DATAMODEL_NATIVE) {
+			hyprlofs_entries_t ebuf;
+			hyprlofs_entry_t *e;
+
+			if (copyin((void *)data, &ebuf, sizeof (ebuf)))
+				return (EFAULT);
+			cnt = ebuf.hle_len;
+			if (cnt > MAX_IOCTL_PARAMS)
+				return (EINVAL);
+			len = sizeof (hyprlofs_entry_t) * cnt;
+
+			e = kmem_alloc(len, KM_SLEEP);
+			if (copyin((void *)(ebuf.hle_entries), e, len)) {
+				kmem_free(e, len);
+				return (EFAULT);
+			}
+
+			for (i = 0; i < cnt; i++) {
+				if (e[i].hle_nlen == 0 ||
+				    e[i].hle_nlen >= sizeof (nm)) {
+					kmem_free(e, len);
+					return (EINVAL);
+				}
+
+				if (copyin(e[i].hle_name, nm, e[i].hle_nlen)
+				    != 0) {
+					kmem_free(e, len);
+					return (EFAULT);
+				}
+				nm[e[i].hle_nlen] = '\0';
+
+				if (cmd == HYPRLOFS_ADD_ENTRIES) {
+					if (e[i].hle_plen == 0 ||
+					    e[i].hle_plen >= sizeof (path)) {
+						kmem_free(e, len);
+						return (EINVAL);
+					}
+
+					if (copyin(e[i].hle_path, path,
+					    e[i].hle_plen) != 0) {
+						kmem_free(e, len);
+						return (EFAULT);
+					}
+					path[e[i].hle_plen] = '\0';
+
+					if ((error = hyprlofs_add_entry(vp,
+					    path, nm, cr, ct)) != 0) {
+						kmem_free(e, len);
+						return (error);
+					}
+				} else {
+					if ((error = hyprlofs_rm_entry(vp, nm,
+					    cr, ct, flag)) != 0) {
+						kmem_free(e, len);
+						return (error);
+					}
+				}
+			}
+
+			kmem_free(e, len);
+			return (0);
+
+		} else {
+			hyprlofs_entries32_t ebuf32;
+			hyprlofs_entry32_t *e32;
+
+			if (copyin((void *)data, &ebuf32, sizeof (ebuf32)))
+				return (EFAULT);
+
+			cnt = ebuf32.hle_len;
+			if (cnt > MAX_IOCTL_PARAMS)
+				return (EINVAL);
+			len = sizeof (hyprlofs_entry32_t) * cnt;
+
+			e32 = kmem_alloc(len, KM_SLEEP);
+			if (copyin((void *)(unsigned long)(ebuf32.hle_entries),
+			    e32, len)) {
+				kmem_free(e32, len);
+				return (EFAULT);
+			}
+
+			for (i = 0; i < cnt; i++) {
+				if (e32[i].hle_nlen == 0 ||
+				    e32[i].hle_nlen >= sizeof (nm)) {
+					kmem_free(e32, len);
+					return (EINVAL);
+				}
+
+				if (copyin((void *)(unsigned long)
+				    e32[i].hle_name, nm,
+				    e32[i].hle_nlen) != 0) {
+					kmem_free(e32, len);
+					return (EFAULT);
+				}
+				nm[e32[i].hle_nlen] = '\0';
+
+				if (cmd == HYPRLOFS_ADD_ENTRIES) {
+					if (e32[i].hle_plen == 0 ||
+					    e32[i].hle_plen >= sizeof (path)) {
+						kmem_free(e32, len);
+						return (EINVAL);
+					}
+
+					if (copyin((void *)(unsigned long)
+					    e32[i].hle_path, path,
+					    e32[i].hle_plen) != 0) {
+						kmem_free(e32, len);
+						return (EFAULT);
+					}
+					path[e32[i].hle_plen] = '\0';
+
+					if ((error = hyprlofs_add_entry(vp,
+					    path, nm, cr, ct)) != 0) {
+						kmem_free(e32, len);
+						return (error);
+					}
+				} else {
+					if ((error = hyprlofs_rm_entry(vp, nm,
+					    cr, ct, flag)) != 0) {
+						kmem_free(e32, len);
+						return (error);
+					}
+				}
+			}
+
+			kmem_free(e32, len);
+			return (0);
+		}
+	}
+
+	if (cmd == HYPRLOFS_RM_ALL) {
+		return (hyprlofs_rm_all(vp, cr, ct, flag));
+	}
+
+	if (cmd == HYPRLOFS_GET_ENTRIES) {
+		return (hyprlofs_get_all(vp, data, cr, ct, flag));
+	}
+
+	return (ENOTTY);
+}
+
+static int
+hyprlofs_getattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	hlnode_t *tp = (hlnode_t *)VTOHLN(vp);
+	vattr_t tmp_va;
+
+	if (tp->hln_looped == 1) {
+		int error;
+
+		if ((error = VOP_GETATTR(REALVP(vp), &tmp_va, flags, cr,
+		    ct)) != 0)
+			return (error);
+	}
+
+	mutex_enter(&tp->hln_tlock);
+	vap->va_type = vp->v_type;
+	vap->va_mode = tp->hln_mode & MODEMASK;
+	vap->va_uid = tp->hln_uid;
+	vap->va_gid = tp->hln_gid;
+	vap->va_fsid = tp->hln_fsid;
+	vap->va_nodeid = (ino64_t)tp->hln_nodeid;
+	vap->va_nlink = tp->hln_nlink;
+	vap->va_size = (u_offset_t)tp->hln_size;
+	vap->va_atime = tp->hln_atime;
+	vap->va_mtime = tp->hln_mtime;
+	vap->va_ctime = tp->hln_ctime;
+	vap->va_blksize = PAGESIZE;
+	vap->va_rdev = tp->hln_rdev;
+	vap->va_seq = tp->hln_seq;
+
+	if (tp->hln_looped == 1) {
+		vap->va_nblocks = tmp_va.va_nblocks;
+	} else {
+		vap->va_nblocks =
+		    (fsblkcnt64_t)btodb(ptob(btopr(vap->va_size)));
+	}
+	mutex_exit(&tp->hln_tlock);
+	return (0);
+}
+
+/*ARGSUSED4*/
+static int
+hyprlofs_setattr(vnode_t *vp, vattr_t *vap, int flags,
+    cred_t *cr, caller_context_t *ct)
+{
+	hlnode_t *tp = (hlnode_t *)VTOHLN(vp);
+	int error = 0;
+	vattr_t *get;
+	long mask;
+
+	/*
+	 * Cannot set these attributes
+	 */
+	if ((vap->va_mask & AT_NOSET) || (vap->va_mask & AT_XVATTR))
+		return (EINVAL);
+
+	mutex_enter(&tp->hln_tlock);
+
+	get = &tp->hln_attr;
+	/*
+	 * Change file access modes. Must be owner or have sufficient
+	 * privileges.
+	 */
+	error = secpolicy_vnode_setattr(cr, vp, vap, get, flags,
+	    hyprlofs_taccess, tp);
+
+	if (error)
+		goto out;
+
+	mask = vap->va_mask;
+
+	if (mask & AT_MODE) {
+		get->va_mode &= S_IFMT;
+		get->va_mode |= vap->va_mode & ~S_IFMT;
+	}
+
+	if (mask & AT_UID)
+		get->va_uid = vap->va_uid;
+	if (mask & AT_GID)
+		get->va_gid = vap->va_gid;
+	if (mask & AT_ATIME)
+		get->va_atime = vap->va_atime;
+	if (mask & AT_MTIME)
+		get->va_mtime = vap->va_mtime;
+
+	if (mask & (AT_UID | AT_GID | AT_MODE | AT_MTIME))
+		gethrestime(&tp->hln_ctime);
+
+out:
+	mutex_exit(&tp->hln_tlock);
+	return (error);
+}
+
+static int
+hyprlofs_access(vnode_t *vp, int mode, int flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	hlnode_t *tp = (hlnode_t *)VTOHLN(vp);
+	int error;
+
+	if (mode & VWRITE) {
+		if (vp->v_type == VREG && vn_is_readonly(vp))
+			return (EROFS);
+	}
+	if (VTOHLN(vp)->hln_looped == 1)
+		return (VOP_ACCESS(REALVP(vp), mode, flags, cr, ct));
+
+	mutex_enter(&tp->hln_tlock);
+	error = hyprlofs_taccess(tp, mode, cr);
+	mutex_exit(&tp->hln_tlock);
+	return (error);
+}
+
+/* ARGSUSED3 */
+static int
+hyprlofs_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
+    int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
+    int *direntflags, pathname_t *realpnp)
+{
+	hlnode_t *tp = (hlnode_t *)VTOHLN(dvp);
+	hlnode_t *ntp = NULL;
+	int error;
+
+	if (VTOHLN(dvp)->hln_looped == 1)
+		return (VOP_LOOKUP(REALVP(dvp), nm, vpp, pnp, flags, rdir,
+		    cr, ct, direntflags, realpnp));
+
+	if (flags & LOOKUP_XATTR)
+		return (EINVAL);
+
+	/* Null component name is a synonym for directory being searched. */
+	if (*nm == '\0') {
+		VN_HOLD(dvp);
+		*vpp = dvp;
+		return (0);
+	}
+	ASSERT(tp);
+
+	if ((error = hyprlofs_dirlookup(tp, nm, &ntp, cr)) == 0) {
+		ASSERT(ntp);
+		*vpp = HLNTOV(ntp);
+	}
+	return (error);
+}
+
+/*
+ * Create the loopback from the hyprlofs vnode to the real vnode.
+ */
+static int
+hyprlofs_loopback(vnode_t *dvp, vnode_t *rvp, char *nm, vattr_t *vap,
+    int mode, cred_t *cr, caller_context_t *ct)
+{
+	hlnode_t *parent;
+	hlfsmount_t *tm;
+	int error;
+	hlnode_t *oldtp;
+	vnode_t *vp;
+
+	parent = (hlnode_t *)VTOHLN(dvp);
+	tm = (hlfsmount_t *)VTOHLM(dvp);
+	error = 0;
+	oldtp = NULL;
+
+	if (vap->va_type == VREG && (vap->va_mode & VSVTX)) {
+		/* we don't support the sticky bit */
+		vap->va_mode &= ~VSVTX;
+	} else if (vap->va_type == VNON) {
+		return (EINVAL);
+	}
+
+	/* Null component name is a synonym for directory being searched. */
+	if (*nm == '\0') {
+		VN_HOLD(dvp);
+		oldtp = parent;
+	} else {
+		error = hyprlofs_dirlookup(parent, nm, &oldtp, cr);
+	}
+
+	if (error == 0) {	/* name found */
+		ASSERT(oldtp);
+
+		rw_enter(&oldtp->hln_rwlock, RW_WRITER);
+
+		/*
+		 * if create/read-only an existing directory, allow it
+		 */
+		if ((oldtp->hln_type == VDIR) && (mode & VWRITE))
+			error = EISDIR;
+		else {
+			error = hyprlofs_taccess(oldtp, mode, cr);
+		}
+
+		if (error) {
+			rw_exit(&oldtp->hln_rwlock);
+			hlnode_rele(oldtp);
+			return (error);
+		}
+
+		vp = HLNTOV(oldtp);
+		rw_exit(&oldtp->hln_rwlock);
+
+		if (vp->v_type == VREG) {
+			hlnode_rele(oldtp);
+			return (EEXIST);
+		}
+
+		vnevent_create(vp, ct);
+		return (0);
+	}
+
+	if (error != ENOENT)
+		return (error);
+
+	rw_enter(&parent->hln_rwlock, RW_WRITER);
+	error = hyprlofs_direnter(tm, parent, nm, DE_CREATE, rvp, vap, NULL,
+	    cr);
+	rw_exit(&parent->hln_rwlock);
+
+	return (error);
+}
+
+/*
+ * Create an in-memory directory based on the add-entry ioctl name.
+ * If the dir exists, return EEXIST but still also return node in vpp.
+ */
+static int
+hyprlofs_mkdir(vnode_t *dvp, char *nm, vattr_t *va, vnode_t **vpp, cred_t *cr)
+{
+	hlnode_t *parent = (hlnode_t *)VTOHLN(dvp);
+	hlnode_t *self = NULL;
+	hlfsmount_t *tm = (hlfsmount_t *)VTOHLM(dvp);
+	int error;
+
+	/*
+	 * Might be dangling directory.  Catch it here, because a ENOENT return
+	 * from hyprlofs_dirlookup() is a valid return.
+	 */
+	if (parent->hln_nlink == 0)
+		return (ENOENT);
+
+	error = hyprlofs_dirlookup(parent, nm, &self, cr);
+	if (error == 0) {
+		ASSERT(self);
+		hlnode_rele(self);
+		/* We can't loop in under a looped in directory */
+		if (self->hln_looped)
+			return (EACCES);
+		*vpp = HLNTOV(self);
+		return (EEXIST);
+	}
+	if (error != ENOENT)
+		return (error);
+
+	rw_enter(&parent->hln_rwlock, RW_WRITER);
+	error = hyprlofs_direnter(tm, parent, nm, DE_MKDIR, (vnode_t *)NULL,
+	    va, &self, cr);
+	rw_exit(&parent->hln_rwlock);
+
+	if (error == 0 || error == EEXIST) {
+		hlnode_rele(self);
+		*vpp = HLNTOV(self);
+	}
+
+	return (error);
+}
+
+/*
+ * Loop in a file or directory into the namespace.
+ */
+static int
+hyprlofs_add_entry(vnode_t *vp, char *fspath, char *fsname,
+    cred_t *cr, caller_context_t *ct)
+{
+	int error;
+	char *p, *pnm;
+	vnode_t *realvp, *dvp;
+	vattr_t va;
+
+	/*
+	 * Get vnode for the real file/dir. We'll have a hold on realvp which
+	 * we won't vn_rele until hyprlofs_inactive.
+	 */
+	if ((error = lookupname(fspath, UIO_SYSSPACE, FOLLOW, NULLVPP,
+	    &realvp)) != 0)
+		return (error);
+
+	/* no devices allowed */
+	if (IS_DEVVP(realvp)) {
+		VN_RELE(realvp);
+		return (ENODEV);
+	}
+
+	/*
+	 * realvp may be an AUTOFS node, in which case we perform a VOP_ACCESS
+	 * to trigger the mount of the intended filesystem. This causes a
+	 * loopback mount of the intended filesystem instead of the AUTOFS
+	 * filesystem.
+	 */
+	if ((error = VOP_ACCESS(realvp, 0, 0, cr, NULL)) != 0) {
+		VN_RELE(realvp);
+		return (error);
+	}
+
+	/*
+	 * We're interested in the top most filesystem. This is specially
+	 * important when fspath is a trigger AUTOFS node, since we're really
+	 * interested in mounting the filesystem AUTOFS mounted as result of
+	 * the VOP_ACCESS() call not the AUTOFS node itself.
+	 */
+	if (vn_mountedvfs(realvp) != NULL) {
+		if ((error = traverse(&realvp)) != 0) {
+			VN_RELE(realvp);
+			return (error);
+		}
+	}
+
+	va.va_type = VNON;
+	/*
+	 * If the target name is a path, make sure we have all of the
+	 * intermediate directories, creating them if necessary.
+	 */
+	dvp = vp;
+	pnm = p = fsname;
+
+	/* path cannot be absolute */
+	if (*p == '/') {
+		VN_RELE(realvp);
+		return (EINVAL);
+	}
+
+	for (p = strchr(pnm, '/'); p != NULL; p = strchr(pnm, '/')) {
+		if (va.va_type == VNON)
+			/* use the top-level dir as the template va for mkdir */
+			if ((error = VOP_GETATTR(vp, &va, 0, cr, NULL)) != 0) {
+				VN_RELE(realvp);
+				return (error);
+			}
+
+		*p = '\0';
+
+		/* Path component cannot be empty or relative */
+		if (pnm[0] == '\0' ||
+		    (pnm[0] == '.' && pnm[1] == '.' && pnm[2] == '\0')) {
+			VN_RELE(realvp);
+			return (EINVAL);
+		}
+
+		if ((error = hyprlofs_mkdir(dvp, pnm, &va, &dvp, cr)) != 0 &&
+		    error != EEXIST) {
+			VN_RELE(realvp);
+			return (error);
+		}
+
+		*p = '/';
+		pnm = p + 1;
+	}
+
+	/* The file name is required */
+	if (pnm[0] == '\0') {
+		VN_RELE(realvp);
+		return (EINVAL);
+	}
+
+	/* Now use the real file's va as the template va */
+	if ((error = VOP_GETATTR(realvp, &va, 0, cr, NULL)) != 0) {
+		VN_RELE(realvp);
+		return (error);
+	}
+
+	/* Make the vnode */
+	error = hyprlofs_loopback(dvp, realvp, pnm, &va, va.va_mode, cr, ct);
+	if (error != 0)
+		VN_RELE(realvp);
+	return (error);
+}
+
+/*
+ * Remove a looped in file from the namespace.
+ */
+static int
+hyprlofs_rm_entry(vnode_t *dvp, char *fsname, cred_t *cr, caller_context_t *ct,
+    int flags)
+{
+	int error;
+	char *p, *pnm;
+	hlnode_t *parent;
+	hlnode_t *fndtp;
+
+	pnm = p = fsname;
+
+	/* path cannot be absolute */
+	if (*p == '/')
+		return (EINVAL);
+
+	/*
+	 * If the target name is a path, get the containing dir and simple
+	 * file name.
+	 */
+	parent = (hlnode_t *)VTOHLN(dvp);
+	for (p = strchr(pnm, '/'); p != NULL; p = strchr(pnm, '/')) {
+		*p = '\0';
+
+		/* Path component cannot be empty or relative */
+		if (pnm[0] == '\0' ||
+		    (pnm[0] == '.' && pnm[1] == '.' && pnm[2] == '\0'))
+			return (EINVAL);
+
+		if ((error = hyprlofs_dirlookup(parent, pnm, &fndtp, cr)) != 0)
+			return (error);
+
+		dvp = HLNTOV(fndtp);
+		parent = fndtp;
+		pnm = p + 1;
+	}
+
+	/* The file name is required */
+	if (pnm[0] == '\0')
+		return (EINVAL);
+
+	/* Remove the entry from the parent dir */
+	return (hyprlofs_remove(dvp, pnm, cr, ct, flags));
+}
+
+/*
+ * Remove all looped in files from the namespace.
+ */
+static int
+hyprlofs_rm_all(vnode_t *dvp, cred_t *cr, caller_context_t *ct,
+    int flags)
+{
+	int error = 0;
+	hlnode_t *hp = (hlnode_t *)VTOHLN(dvp);
+	hldirent_t *hdp;
+
+	hlnode_hold(hp);
+
+	/*
+	 * There's a window here where someone could have removed
+	 * all the entries in the directory after we put a hold on the
+	 * vnode but before we grabbed the rwlock.  Just return.
+	 */
+	if (hp->hln_dir == NULL) {
+		if (hp->hln_nlink) {
+			panic("empty directory 0x%p", (void *)hp);
+			/*NOTREACHED*/
+		}
+		goto done;
+	}
+
+	hdp = hp->hln_dir;
+	while (hdp) {
+		hlnode_t *fndhp;
+
+		if (strcmp(hdp->hld_name, ".") == 0 ||
+		    strcmp(hdp->hld_name, "..") == 0) {
+			hdp = hdp->hld_next;
+			continue;
+		}
+
+		/* This holds the fndhp vnode */
+		error = hyprlofs_dirlookup(hp, hdp->hld_name, &fndhp, cr);
+		if (error != 0)
+			goto done;
+		hlnode_rele(fndhp);
+
+		if (fndhp->hln_looped == 0) {
+			/* recursively remove contents of this subdir */
+			if (fndhp->hln_type == VDIR) {
+				vnode_t *tvp = HLNTOV(fndhp);
+
+				error = hyprlofs_rm_all(tvp, cr, ct, flags);
+				if (error != 0)
+					goto done;
+			}
+		}
+
+		/* remove the entry */
+		error = hyprlofs_remove(dvp, hdp->hld_name, cr, ct, flags);
+		if (error != 0)
+			goto done;
+
+		hdp = hp->hln_dir;
+	}
+
+done:
+	hlnode_rele(hp);
+	return (error);
+}
+
+/*
+ * Get a list of all looped in files in the namespace.
+ */
+static int
+hyprlofs_get_all_entries(vnode_t *dvp, hyprlofs_curr_entry_t *hcp,
+    char *prefix, uint_t *pcnt, uint_t n_max,
+    cred_t *cr, caller_context_t *ct, int flags)
+{
+	int error = 0;
+	int too_big = 0;
+	uint_t cnt;
+	uint_t len;
+	hlnode_t *hp = (hlnode_t *)VTOHLN(dvp);
+	hldirent_t *hdp;
+	char *path;
+
+	cnt = *pcnt;
+	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
+
+	hlnode_hold(hp);
+
+	/*
+	 * There's a window here where someone could have removed
+	 * all the entries in the directory after we put a hold on the
+	 * vnode but before we grabbed the rwlock.  Just return.
+	 */
+	if (hp->hln_dir == NULL) {
+		if (hp->hln_nlink) {
+			panic("empty directory 0x%p", (void *)hp);
+			/*NOTREACHED*/
+		}
+		goto done;
+	}
+
+	hdp = hp->hln_dir;
+	while (hdp) {
+		hlnode_t *fndhp;
+		vnode_t *tvp;
+
+		if (strcmp(hdp->hld_name, ".") == 0 ||
+		    strcmp(hdp->hld_name, "..") == 0) {
+			hdp = hdp->hld_next;
+			continue;
+		}
+
+		/* This holds the fndhp vnode */
+		error = hyprlofs_dirlookup(hp, hdp->hld_name, &fndhp, cr);
+		if (error != 0)
+			goto done;
+		hlnode_rele(fndhp);
+
+		if (fndhp->hln_looped == 0) {
+			/* recursively get contents of this subdir */
+			VERIFY(fndhp->hln_type == VDIR);
+			tvp = HLNTOV(fndhp);
+
+			if (*prefix == '\0')
+				(void) strlcpy(path, hdp->hld_name, MAXPATHLEN);
+			else
+				(void) snprintf(path, MAXPATHLEN, "%s/%s",
+				    prefix, hdp->hld_name);
+
+			error = hyprlofs_get_all_entries(tvp, hcp, path,
+			    &cnt, n_max, cr, ct, flags);
+
+			if (error == E2BIG) {
+				too_big = 1;
+				error = 0;
+			}
+			if (error != 0)
+				goto done;
+		} else {
+			if (cnt < n_max) {
+				char *p;
+
+				if (*prefix == '\0')
+					(void) strlcpy(path, hdp->hld_name,
+					    MAXPATHLEN);
+				else
+					(void) snprintf(path, MAXPATHLEN,
+					    "%s/%s", prefix, hdp->hld_name);
+
+				len = strlen(path);
+				ASSERT(len <= MAXPATHLEN);
+				if (copyout(path, (void *)(hcp[cnt].hce_name),
+				    len)) {
+					error = EFAULT;
+					goto done;
+				}
+
+				tvp = REALVP(HLNTOV(fndhp));
+				if (tvp->v_path == vn_vpath_empty) {
+					p = "<unknown>";
+				} else {
+					p = tvp->v_path;
+				}
+				len = strlen(p);
+				ASSERT(len <= MAXPATHLEN);
+				if (copyout(p, (void *)(hcp[cnt].hce_path),
+				    len)) {
+					error = EFAULT;
+					goto done;
+				}
+			}
+
+			cnt++;
+			if (cnt > n_max)
+				too_big = 1;
+		}
+
+		hdp = hdp->hld_next;
+	}
+
+done:
+	hlnode_rele(hp);
+	kmem_free(path, MAXPATHLEN);
+
+	*pcnt = cnt;
+	if (error == 0 && too_big == 1)
+		error = E2BIG;
+
+	return (error);
+}
+
+/*
+ * Return a list of all looped in files in the namespace.
+ */
+static int
+hyprlofs_get_all(vnode_t *dvp, intptr_t data, cred_t *cr, caller_context_t *ct,
+    int flags)
+{
+	uint_t limit, cnt;
+	int error;
+	model_t model;
+	hyprlofs_curr_entry_t *e;
+
+	model = get_udatamodel();
+
+	if (model == DATAMODEL_NATIVE) {
+		hyprlofs_curr_entries_t ebuf;
+
+		if (copyin((void *)data, &ebuf, sizeof (ebuf)))
+			return (EFAULT);
+		limit = ebuf.hce_cnt;
+		e = ebuf.hce_entries;
+		if (limit > MAX_IOCTL_PARAMS)
+			return (EINVAL);
+
+	} else {
+		hyprlofs_curr_entries32_t ebuf32;
+
+		if (copyin((void *)data, &ebuf32, sizeof (ebuf32)))
+			return (EFAULT);
+
+		limit = ebuf32.hce_cnt;
+		e = (hyprlofs_curr_entry_t *)(unsigned long)
+		    (ebuf32.hce_entries);
+		if (limit > MAX_IOCTL_PARAMS)
+			return (EINVAL);
+	}
+
+	cnt = 0;
+	error = hyprlofs_get_all_entries(dvp, e, "", &cnt, limit, cr, ct,
+	    flags);
+
+	if (error == 0 || error == E2BIG) {
+		if (model == DATAMODEL_NATIVE) {
+			hyprlofs_curr_entries_t ebuf;
+
+			ebuf.hce_cnt = cnt;
+			if (copyout(&ebuf, (void *)data, sizeof (ebuf)))
+				return (EFAULT);
+
+		} else {
+			hyprlofs_curr_entries32_t ebuf32;
+
+			ebuf32.hce_cnt = cnt;
+			if (copyout(&ebuf32, (void *)data, sizeof (ebuf32)))
+				return (EFAULT);
+		}
+	}
+
+	return (error);
+}
+
+/* ARGSUSED3 */
+static int
+hyprlofs_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct,
+    int flags)
+{
+	hlnode_t *parent = (hlnode_t *)VTOHLN(dvp);
+	int error;
+	hlnode_t *hp = NULL;
+
+	/* This holds the hp vnode */
+	error = hyprlofs_dirlookup(parent, nm, &hp, cr);
+	if (error)
+		return (error);
+
+	ASSERT(hp);
+	rw_enter(&parent->hln_rwlock, RW_WRITER);
+	rw_enter(&hp->hln_rwlock, RW_WRITER);
+
+	error = hyprlofs_dirdelete(parent, hp, nm, DR_REMOVE, cr);
+
+	rw_exit(&hp->hln_rwlock);
+	rw_exit(&parent->hln_rwlock);
+	vnevent_remove(HLNTOV(hp), dvp, nm, ct);
+
+	/*
+	 * We've now dropped the dir link so by rele-ing our vnode we should
+	 * clean up in hyprlofs_inactive.
+	 */
+	hlnode_rele(hp);
+
+	return (error);
+}
+
+/* ARGSUSED4 */
+static int
+hyprlofs_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
+    caller_context_t *ct, int flags)
+{
+	hlnode_t *parent = (hlnode_t *)VTOHLN(dvp);
+	hlnode_t *self = NULL;
+	vnode_t *vp;
+	int error = 0;
+
+	/* Return error if removing . or .. */
+	if (strcmp(nm, ".") == 0)
+		return (EINVAL);
+	if (strcmp(nm, "..") == 0)
+		return (EEXIST); /* Should be ENOTEMPTY */
+	error = hyprlofs_dirlookup(parent, nm, &self, cr);
+	if (error)
+		return (error);
+
+	rw_enter(&parent->hln_rwlock, RW_WRITER);
+	rw_enter(&self->hln_rwlock, RW_WRITER);
+
+	vp = HLNTOV(self);
+	if (vp == dvp || vp == cdir) {
+		error = EINVAL;
+		goto done1;
+	}
+	if (self->hln_type != VDIR) {
+		error = ENOTDIR;
+		goto done1;
+	}
+
+	/*
+	 * When a dir is looped in, we only remove the in-memory dir, not the
+	 * backing dir.
+	 */
+	if (self->hln_looped == 0) {
+		mutex_enter(&self->hln_tlock);
+		if (self->hln_nlink > 2) {
+			mutex_exit(&self->hln_tlock);
+			error = EEXIST;
+			goto done1;
+		}
+		mutex_exit(&self->hln_tlock);
+
+		if (vn_vfswlock(vp)) {
+			error = EBUSY;
+			goto done1;
+		}
+		if (vn_mountedvfs(vp) != NULL) {
+			error = EBUSY;
+			goto done;
+		}
+
+		/*
+		 * Check for an empty directory, i.e. only includes entries for
+		 * "." and ".."
+		 */
+		if (self->hln_dirents > 2) {
+			error = EEXIST;		/* SIGH should be ENOTEMPTY */
+			/*
+			 * Update atime because checking hln_dirents is
+			 * equivalent to reading the directory
+			 */
+			gethrestime(&self->hln_atime);
+			goto done;
+		}
+
+		error = hyprlofs_dirdelete(parent, self, nm, DR_RMDIR, cr);
+	} else {
+		error = hyprlofs_dirdelete(parent, self, nm, DR_REMOVE, cr);
+	}
+
+done:
+	if (self->hln_looped == 0)
+		vn_vfsunlock(vp);
+done1:
+	rw_exit(&self->hln_rwlock);
+	rw_exit(&parent->hln_rwlock);
+	vnevent_rmdir(HLNTOV(self), dvp, nm, ct);
+
+	/*
+	 * We've now dropped the dir link so by rele-ing our vnode we should
+	 * clean up in hyprlofs_inactive.
+	 */
+	hlnode_rele(self);
+
+	return (error);
+}
+
+static int
+hyprlofs_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
+    caller_context_t *ct, int flags)
+{
+	hlnode_t *hp = (hlnode_t *)VTOHLN(vp);
+	hldirent_t *hdp;
+	int error = 0;
+	size_t namelen;
+	struct dirent64 *dp;
+	ulong_t offset;
+	ulong_t total_bytes_wanted;
+	ulong_t outcount = 0;
+	ulong_t bufsize;
+	size_t reclen;
+	caddr_t outbuf;
+
+	if (VTOHLN(vp)->hln_looped == 1)
+		return (VOP_READDIR(REALVP(vp), uiop, cr, eofp, ct, flags));
+
+	if (uiop->uio_loffset >= MAXOFF_T) {
+		if (eofp)
+			*eofp = 1;
+		return (0);
+	}
+	/* assuming syscall has already called hln_rwlock */
+	ASSERT(RW_READ_HELD(&hp->hln_rwlock));
+
+	if (uiop->uio_iovcnt != 1)
+		return (EINVAL);
+
+	if (vp->v_type != VDIR)
+		return (ENOTDIR);
+
+	/*
+	 * There's a window here where someone could have removed
+	 * all the entries in the directory after we put a hold on the
+	 * vnode but before we grabbed the rwlock.  Just return.
+	 */
+	if (hp->hln_dir == NULL) {
+		if (hp->hln_nlink) {
+			panic("empty directory 0x%p", (void *)hp);
+			/*NOTREACHED*/
+		}
+		return (0);
+	}
+
+	/* Get space for multiple dir entries */
+	total_bytes_wanted = uiop->uio_iov->iov_len;
+	bufsize = total_bytes_wanted + sizeof (struct dirent64);
+	outbuf = kmem_alloc(bufsize, KM_SLEEP);
+
+	dp = (struct dirent64 *)((uintptr_t)outbuf);
+
+	offset = 0;
+	hdp = hp->hln_dir;
+	while (hdp) {
+		namelen = strlen(hdp->hld_name);	/* no +1 needed */
+		offset = hdp->hld_offset;
+		if (offset >= uiop->uio_offset) {
+			reclen = DIRENT64_RECLEN(namelen);
+			if (outcount + reclen > total_bytes_wanted) {
+				if (!outcount)
+					/* Buffer too small for any entries. */
+					error = EINVAL;
+				break;
+			}
+			ASSERT(hdp->hld_hlnode != NULL);
+
+			/* zero out uninitialized bytes */
+			(void) strncpy(dp->d_name, hdp->hld_name,
+			    DIRENT64_NAMELEN(reclen));
+			dp->d_reclen = (ushort_t)reclen;
+			dp->d_ino = (ino64_t)hdp->hld_hlnode->hln_nodeid;
+			dp->d_off = (offset_t)hdp->hld_offset + 1;
+			dp = (struct dirent64 *)
+			    ((uintptr_t)dp + dp->d_reclen);
+			outcount += reclen;
+			ASSERT(outcount <= bufsize);
+		}
+		hdp = hdp->hld_next;
+	}
+
+	if (!error)
+		error = uiomove(outbuf, outcount, UIO_READ, uiop);
+
+	if (!error) {
+		/*
+		 * If we reached the end of the list our offset should now be
+		 * just past the end.
+		 */
+		if (!hdp) {
+			offset += 1;
+			if (eofp)
+				*eofp = 1;
+		} else if (eofp)
+			*eofp = 0;
+		uiop->uio_offset = offset;
+	}
+	gethrestime(&hp->hln_atime);
+	kmem_free(outbuf, bufsize);
+	return (error);
+}
+
+static int
+hyprlofs_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
+{
+	if (VTOHLN(vp)->hln_looped == 1)
+		return (VOP_FSYNC(REALVP(vp), syncflag, cr, ct));
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+hyprlofs_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
+{
+	hlnode_t *hp = (hlnode_t *)VTOHLN(vp);
+	hlfsmount_t *hm = (hlfsmount_t *)VFSTOHLM(vp->v_vfsp);
+
+	rw_enter(&hp->hln_rwlock, RW_WRITER);
+
+	mutex_enter(&hp->hln_tlock);
+	mutex_enter(&vp->v_lock);
+	ASSERT(vp->v_count >= 1);
+
+	/*
+	 * If we don't have the last hold or the link count is non-zero,
+	 * there's nothing to do except drop our hold.
+	 */
+	if (vp->v_count > 1 || hp->hln_nlink != 0) {
+		vp->v_count--;
+		mutex_exit(&vp->v_lock);
+		mutex_exit(&hp->hln_tlock);
+		rw_exit(&hp->hln_rwlock);
+		return;
+	}
+
+	mutex_exit(&vp->v_lock);
+	mutex_exit(&hp->hln_tlock);
+
+	/* release hold on the real vnode now */
+	if (hp->hln_looped == 1 && hp->hln_realvp != NULL)
+		VN_RELE(hp->hln_realvp);
+
+	/* Here's our chance to send invalid event while we're between locks */
+	vn_invalid(HLNTOV(hp));
+
+	mutex_enter(&hm->hlm_contents);
+	if (hp->hln_forw == NULL)
+		hm->hlm_rootnode->hln_back = hp->hln_back;
+	else
+		hp->hln_forw->hln_back = hp->hln_back;
+	hp->hln_back->hln_forw = hp->hln_forw;
+	mutex_exit(&hm->hlm_contents);
+	rw_exit(&hp->hln_rwlock);
+	rw_destroy(&hp->hln_rwlock);
+	mutex_destroy(&hp->hln_tlock);
+	vn_free(HLNTOV(hp));
+	kmem_free(hp, sizeof (hlnode_t));
+}
+
+static int
+hyprlofs_fid(vnode_t *vp, struct fid *fidp, caller_context_t *ct)
+{
+	hlnode_t *hp = (hlnode_t *)VTOHLN(vp);
+	hlfid_t *hfid;
+
+	if (VTOHLN(vp)->hln_looped == 1)
+		return (VOP_FID(REALVP(vp), fidp, ct));
+
+	if (fidp->fid_len < (sizeof (hlfid_t) - sizeof (ushort_t))) {
+		fidp->fid_len = sizeof (hlfid_t) - sizeof (ushort_t);
+		return (ENOSPC);
+	}
+
+	hfid = (hlfid_t *)fidp;
+	bzero(hfid, sizeof (hlfid_t));
+	hfid->hlfid_len = (int)sizeof (hlfid_t) - sizeof (ushort_t);
+
+	hfid->hlfid_ino = hp->hln_nodeid;
+	hfid->hlfid_gen = hp->hln_gen;
+
+	return (0);
+}
+
+static int
+hyprlofs_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
+    page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr, enum seg_rw rw,
+    cred_t *cr, caller_context_t *ct)
+{
+	/* return EACCES to be consistent with mmap */
+	if (VTOHLN(vp)->hln_looped != 1)
+		return (EACCES);
+	return (VOP_GETPAGE(REALVP(vp), off, len, protp, pl, plsz, seg, addr,
+	    rw, cr, ct));
+}
+
+int
+hyprlofs_putpage(vnode_t *vp, offset_t off, size_t len, int flags,
+    cred_t *cr, caller_context_t *ct)
+{
+	/* return EACCES to be consistent with mmap */
+	if (VTOHLN(vp)->hln_looped != 1)
+		return (EACCES);
+	return (VOP_PUTPAGE(REALVP(vp), off, len, flags, cr, ct));
+}
+
+static int
+hyprlofs_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
+    size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	/* return EACCES to be consistent with mmap */
+	if (VTOHLN(vp)->hln_looped != 1)
+		return (EACCES);
+	return (VOP_MAP(REALVP(vp), off, as, addrp, len, prot, maxprot, flags,
+	    cr, ct));
+}
+
+static int
+hyprlofs_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
+    size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	/* return EACCES to be consistent with mmap */
+	if (VTOHLN(vp)->hln_looped != 1)
+		return (EACCES);
+	return (VOP_ADDMAP(REALVP(vp), off, as, addr, len, prot, maxprot,
+	    flags, cr, ct));
+}
+
+static int
+hyprlofs_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
+    size_t len, uint_t prot, uint_t maxprot, uint_t flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	/* return EACCES to be consistent with mmap */
+	if (VTOHLN(vp)->hln_looped != 1)
+		return (EACCES);
+	return (VOP_DELMAP(REALVP(vp), off, as, addr, len, prot, maxprot,
+	    flags, cr, ct));
+}
+
+static int
+hyprlofs_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
+    offset_t offset, cred_t *cr, caller_context_t *ct)
+{
+	/* return EACCES to be consistent with mmap */
+	if (VTOHLN(vp)->hln_looped != 1)
+		return (EACCES);
+	return (VOP_SPACE(REALVP(vp), cmd, bfp, flag, offset, cr, ct));
+}
+
+static int
+hyprlofs_seek(vnode_t *vp, offset_t ooff, offset_t *noffp,
+    caller_context_t *ct)
+{
+	if (VTOHLN(vp)->hln_looped == 0)
+		return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
+
+	return (VOP_SEEK(REALVP(vp), ooff, noffp, ct));
+}
+
+static int
+hyprlofs_rwlock(vnode_t *vp, int write_lock, caller_context_t *ct)
+{
+	hlnode_t *hp = VTOHLN(vp);
+
+	if (hp->hln_looped == 1)
+		return (VOP_RWLOCK(REALVP(vp), write_lock, ct));
+
+	if (write_lock) {
+		rw_enter(&hp->hln_rwlock, RW_WRITER);
+	} else {
+		rw_enter(&hp->hln_rwlock, RW_READER);
+	}
+	return (write_lock);
+}
+
+static void
+hyprlofs_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ct)
+{
+	hlnode_t *hp = VTOHLN(vp);
+
+	if (hp->hln_looped == 1) {
+		VOP_RWUNLOCK(REALVP(vp), write_lock, ct);
+		return;
+	}
+
+	rw_exit(&hp->hln_rwlock);
+}
+
+static int
+hyprlofs_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
+    caller_context_t *ct)
+{
+	int error;
+
+	if (VTOHLN(vp)->hln_looped == 1)
+		return (VOP_PATHCONF(REALVP(vp), cmd, valp, cr, ct));
+
+	switch (cmd) {
+	case _PC_XATTR_ENABLED:
+	case _PC_XATTR_EXISTS:
+	case _PC_SATTR_ENABLED:
+	case _PC_SATTR_EXISTS:
+		error = EINVAL;
+		break;
+	case _PC_TIMESTAMP_RESOLUTION:
+		/* nanosecond timestamp resolution */
+		*valp = 1L;
+		error = 0;
+		break;
+	default:
+		error = fs_pathconf(vp, cmd, valp, cr, ct);
+	}
+	return (error);
+}
+
+
+struct vnodeops *hyprlofs_vnodeops;
+
+const fs_operation_def_t hyprlofs_vnodeops_template[] = {
+	VOPNAME_OPEN,		{ .vop_open = hyprlofs_open },
+	VOPNAME_CLOSE,		{ .vop_close = hyprlofs_close },
+	VOPNAME_READ,		{ .vop_read = hyprlofs_read },
+	VOPNAME_WRITE,		{ .vop_write = hyprlofs_write },
+	VOPNAME_IOCTL,		{ .vop_ioctl = hyprlofs_ioctl },
+	VOPNAME_GETATTR,	{ .vop_getattr = hyprlofs_getattr },
+	VOPNAME_SETATTR,	{ .vop_setattr = hyprlofs_setattr },
+	VOPNAME_ACCESS,		{ .vop_access = hyprlofs_access },
+	VOPNAME_LOOKUP,		{ .vop_lookup = hyprlofs_lookup },
+	VOPNAME_CREATE,		{ .error = fs_error },
+	VOPNAME_REMOVE,		{ .vop_remove = hyprlofs_remove },
+	VOPNAME_LINK,		{ .error = fs_error },
+	VOPNAME_RENAME,		{ .error = fs_error },
+	VOPNAME_MKDIR,		{ .error = fs_error },
+	VOPNAME_RMDIR,		{ .vop_rmdir = hyprlofs_rmdir },
+	VOPNAME_READDIR,	{ .vop_readdir = hyprlofs_readdir },
+	VOPNAME_SYMLINK,	{ .error = fs_error },
+	VOPNAME_READLINK,	{ .error = fs_error },
+	VOPNAME_FSYNC,		{ .vop_fsync = hyprlofs_fsync },
+	VOPNAME_INACTIVE,	{ .vop_inactive = hyprlofs_inactive },
+	VOPNAME_FID,		{ .vop_fid = hyprlofs_fid },
+	VOPNAME_RWLOCK,		{ .vop_rwlock = hyprlofs_rwlock },
+	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = hyprlofs_rwunlock },
+	VOPNAME_SEEK,		{ .vop_seek = hyprlofs_seek },
+	VOPNAME_SPACE,		{ .vop_space = hyprlofs_space },
+	VOPNAME_GETPAGE,	{ .vop_getpage = hyprlofs_getpage },
+	VOPNAME_PUTPAGE,	{ .vop_putpage = hyprlofs_putpage },
+	VOPNAME_MAP,		{ .vop_map = hyprlofs_map },
+	VOPNAME_ADDMAP,		{ .vop_addmap = hyprlofs_addmap },
+	VOPNAME_DELMAP,		{ .vop_delmap = hyprlofs_delmap },
+	VOPNAME_PATHCONF,	{ .vop_pathconf = hyprlofs_pathconf },
+	VOPNAME_VNEVENT,	{ .vop_vnevent = fs_vnevent_support },
+	NULL,			NULL
+};
diff --git a/usr/src/uts/common/fs/lookup.c b/usr/src/uts/common/fs/lookup.c
index 69c9efff97..f6910c07cf 100644
--- a/usr/src/uts/common/fs/lookup.c
+++ b/usr/src/uts/common/fs/lookup.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2016 Joyent, Inc.
  */
@@ -58,6 +59,7 @@
 #include <sys/zone.h>
 #include <sys/dnlc.h>
 #include <sys/fs/snode.h>
+#include <sys/brand.h>
 
 /* Controls whether paths are stored with vnodes. */
 int vfs_vnode_path = 1;
diff --git a/usr/src/uts/common/fs/lxproc/lxpr_subr.c b/usr/src/uts/common/fs/lxproc/lxpr_subr.c
new file mode 100644
index 0000000000..24c010a463
--- /dev/null
+++ b/usr/src/uts/common/fs/lxproc/lxpr_subr.c
@@ -0,0 +1,526 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2017, Joyent, Inc.
+ */
+
+#include <sys/varargs.h>
+#include <sys/cpuvar.h>
+#include <sys/mman.h>
+#include <sys/vmsystm.h>
+#include <sys/prsystm.h>
+
+#include "lxproc.h"
+
+#define	LXPRCACHE_NAME "lxpr_cache"
+
+static int lxpr_node_constructor(void *, void *, int);
+static void lxpr_node_destructor(void *, void *);
+
+static kmem_cache_t *lxpr_node_cache;
+
+struct lxpr_uiobuf {
+	uio_t *uiop;
+	char *buffer;
+	uint32_t buffsize;
+	char *pos;
+	size_t beg;
+	int error;
+};
+
+int lxpr_bufsize = 4000;
+
+struct lxpr_uiobuf *
+lxpr_uiobuf_new(uio_t *uiop)
+{
+	/* Allocate memory for both lxpr_uiobuf and output buffer */
+	int bufsize = lxpr_bufsize;
+	struct lxpr_uiobuf *uiobuf =
+	    kmem_alloc(sizeof (struct lxpr_uiobuf) + bufsize, KM_SLEEP);
+
+	uiobuf->uiop = uiop;
+	uiobuf->buffer = (char *)&uiobuf[1];
+	uiobuf->buffsize = bufsize;
+	uiobuf->pos = uiobuf->buffer;
+	uiobuf->beg = 0;
+	uiobuf->error = 0;
+
+	return (uiobuf);
+}
+
+void
+lxpr_uiobuf_free(struct lxpr_uiobuf *uiobuf)
+{
+	ASSERT(uiobuf != NULL);
+	ASSERT(uiobuf->pos == uiobuf->buffer);
+
+	kmem_free(uiobuf, sizeof (struct lxpr_uiobuf) + uiobuf->buffsize);
+}
+
+void
+lxpr_uiobuf_seek(struct lxpr_uiobuf *uiobuf, offset_t offset)
+{
+	uiobuf->uiop->uio_offset = (off_t)offset;
+}
+
+void
+lxpr_uiobuf_seterr(struct lxpr_uiobuf *uiobuf, int err)
+{
+	ASSERT(uiobuf->error == 0);
+
+	uiobuf->error = err;
+}
+
+int
+lxpr_uiobuf_flush(struct lxpr_uiobuf *uiobuf)
+{
+	off_t off = uiobuf->uiop->uio_offset;
+	caddr_t uaddr = uiobuf->buffer;
+	size_t beg = uiobuf->beg;
+	size_t size = (uintptr_t)uiobuf->pos - (uintptr_t)uaddr;
+
+	if (uiobuf->error == 0 && uiobuf->uiop->uio_resid != 0) {
+		ASSERT(off >= beg);
+
+		if (beg + size > off && off >= 0)
+			uiobuf->error =
+			    uiomove(uaddr + (off - beg), size - (off - beg),
+			    UIO_READ, uiobuf->uiop);
+
+		uiobuf->beg += size;
+	}
+
+	uiobuf->pos = uaddr;
+
+	return (uiobuf->error);
+}
+
+void
+lxpr_uiobuf_write(struct lxpr_uiobuf *uiobuf, const char *buf, size_t size)
+{
+	/* While we can still carry on */
+	while (uiobuf->error == 0 && uiobuf->uiop->uio_resid != 0) {
+		uintptr_t remain = (uintptr_t)uiobuf->buffsize -
+		    ((uintptr_t)uiobuf->pos - (uintptr_t)uiobuf->buffer);
+
+		/* Enough space in buffer? */
+		if (remain >= size) {
+			bcopy(buf, uiobuf->pos, size);
+			uiobuf->pos += size;
+			return;
+		}
+
+		/* Not enough space, so copy all we can and try again */
+		bcopy(buf, uiobuf->pos, remain);
+		uiobuf->pos += remain;
+		(void) lxpr_uiobuf_flush(uiobuf);
+		buf += remain;
+		size -= remain;
+	}
+}
+
+#define	TYPBUFFSIZE 256
+
+void
+lxpr_uiobuf_printf(struct lxpr_uiobuf *uiobuf, const char *fmt, ...)
+{
+	va_list args;
+	char buff[TYPBUFFSIZE];
+	int len;
+	char *buffer;
+
+	/* Can we still do any output */
+	if (uiobuf->error != 0 || uiobuf->uiop->uio_resid == 0)
+		return;
+
+	va_start(args, fmt);
+
+	/* Try using stack allocated buffer */
+	len = vsnprintf(buff, TYPBUFFSIZE, fmt, args);
+	if (len < TYPBUFFSIZE) {
+		va_end(args);
+		lxpr_uiobuf_write(uiobuf, buff, len);
+		return;
+	}
+
+	/* Not enough space in pre-allocated buffer */
+	buffer = kmem_alloc(len + 1, KM_SLEEP);
+
+	/*
+	 * We know we allocated the correct amount of space
+	 * so no check on the return value
+	 */
+	(void) vsnprintf(buffer, len+1, fmt, args);
+	lxpr_uiobuf_write(uiobuf, buffer, len);
+	va_end(args);
+	kmem_free(buffer, len+1);
+}
+
+/*
+ * lxpr_lock():
+ *
+ * Lookup process from pid and return with p_plock and P_PR_LOCK held.
+ */
+proc_t *
+lxpr_lock(pid_t pid)
+{
+	proc_t *p;
+	kmutex_t *mp;
+
+	ASSERT(!MUTEX_HELD(&pidlock));
+
+	for (;;) {
+		mutex_enter(&pidlock);
+
+		/*
+		 * If the pid is 1, we really want the zone's init process
+		 */
+		p = prfind((pid == 1) ?
+		    curproc->p_zone->zone_proc_initpid : pid);
+
+		if (p == NULL || p->p_stat == SIDL) {
+			mutex_exit(&pidlock);
+			return (NULL);
+		}
+
+		/*
+		 * p_lock is persistent, but p itself is not -- it could
+		 * vanish during cv_wait().  Load p->p_lock now so we can
+		 * drop it after cv_wait() without referencing p.
+		 */
+		mp = &p->p_lock;
+		mutex_enter(mp);
+
+		mutex_exit(&pidlock);
+
+		if (p->p_flag & SEXITING) {
+			/*
+			 * This process is exiting -- let it go.
+			 */
+			mutex_exit(mp);
+			return (NULL);
+		}
+
+		if (!(p->p_proc_flag & P_PR_LOCK))
+			break;
+
+		cv_wait(&pr_pid_cv[p->p_slot], mp);
+		mutex_exit(mp);
+	}
+
+	p->p_proc_flag |= P_PR_LOCK;
+	THREAD_KPRI_REQUEST();
+	return (p);
+}
+
+/*
+ * lxpr_unlock()
+ *
+ * Unlock locked process
+ */
+void
+lxpr_unlock(proc_t *p)
+{
+	ASSERT(p->p_proc_flag & P_PR_LOCK);
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	ASSERT(!MUTEX_HELD(&pidlock));
+
+	cv_signal(&pr_pid_cv[p->p_slot]);
+	p->p_proc_flag &= ~P_PR_LOCK;
+	mutex_exit(&p->p_lock);
+	THREAD_KPRI_RELEASE();
+}
+
+void
+lxpr_initnodecache()
+{
+	lxpr_node_cache = kmem_cache_create(LXPRCACHE_NAME,
+	    sizeof (lxpr_node_t), 0,
+	    lxpr_node_constructor, lxpr_node_destructor, NULL, NULL, NULL, 0);
+}
+
+void
+lxpr_fininodecache()
+{
+	kmem_cache_destroy(lxpr_node_cache);
+}
+
+/* ARGSUSED */
+static int
+lxpr_node_constructor(void *buf, void *un, int kmflags)
+{
+	lxpr_node_t	*lxpnp = buf;
+	vnode_t		*vp;
+
+	vp = lxpnp->lxpr_vnode = vn_alloc(kmflags);
+	if (vp == NULL)
+		return (-1);
+
+	(void) vn_setops(vp, lxpr_vnodeops);
+	vp->v_data = lxpnp;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+lxpr_node_destructor(void *buf, void *un)
+{
+	lxpr_node_t	*lxpnp = buf;
+
+	vn_free(LXPTOV(lxpnp));
+}
+
+/*
+ * Calculate an inode number
+ *
+ * This takes various bits of info and munges them
+ * to give the inode number for an lxproc node
+ */
+ino_t
+lxpr_inode(lxpr_nodetype_t type, pid_t pid, int fd)
+{
+	if (pid == 1)
+		pid = curproc->p_zone->zone_proc_initpid;
+
+	switch (type) {
+	case LXPR_PIDDIR:
+		return (pid + 1);
+	case LXPR_PROCDIR:
+		return (maxpid + 2);
+	case LXPR_PID_FD_FD:
+		return (maxpid + 2 +
+		    (pid * (LXPR_FD_PERPROC + LXPR_NFILES)) +
+		    LXPR_NFILES + fd);
+	default:
+		return (maxpid + 2 +
+		    (pid * (LXPR_FD_PERPROC + LXPR_NFILES)) +
+		    type);
+	}
+}
+
+/*
+ * Return inode number of parent (directory)
+ */
+ino_t
+lxpr_parentinode(lxpr_node_t *lxpnp)
+{
+	/*
+	 * If the input node is the root then the parent inode
+	 * is the mounted on inode so just return our inode number
+	 */
+	if (lxpnp->lxpr_type != LXPR_PROCDIR)
+		return (VTOLXP(lxpnp->lxpr_parent)->lxpr_ino);
+	else
+		return (lxpnp->lxpr_ino);
+}
+
+/*
+ * Allocate a new lxproc node
+ *
+ * This also allocates the vnode associated with it
+ */
+lxpr_node_t *
+lxpr_getnode(vnode_t *dp, lxpr_nodetype_t type, proc_t *p, int fd)
+{
+	lxpr_node_t *lxpnp;
+	vnode_t *vp;
+	user_t *up;
+	timestruc_t now;
+
+	/*
+	 * Allocate a new node. It is deallocated in vop_innactive
+	 */
+	lxpnp = kmem_cache_alloc(lxpr_node_cache, KM_SLEEP);
+
+	/*
+	 * Set defaults (may be overridden below)
+	 */
+	gethrestime(&now);
+	lxpnp->lxpr_type = type;
+	lxpnp->lxpr_realvp = NULL;
+	lxpnp->lxpr_parent = dp;
+	VN_HOLD(dp);
+	if (p != NULL) {
+		lxpnp->lxpr_pid = ((p->p_pid ==
+		    curproc->p_zone->zone_proc_initpid) ? 1 : p->p_pid);
+
+		lxpnp->lxpr_time = PTOU(p)->u_start;
+		lxpnp->lxpr_uid = crgetruid(p->p_cred);
+		lxpnp->lxpr_gid = crgetrgid(p->p_cred);
+		lxpnp->lxpr_ino = lxpr_inode(type, p->p_pid, fd);
+	} else {
+		/* Pretend files without a proc belong to sched */
+		lxpnp->lxpr_pid = 0;
+		lxpnp->lxpr_time = now;
+		lxpnp->lxpr_uid = lxpnp->lxpr_gid = 0;
+		lxpnp->lxpr_ino = lxpr_inode(type, 0, 0);
+	}
+
+	/* initialize the vnode data */
+	vp = lxpnp->lxpr_vnode;
+	vn_reinit(vp);
+	vp->v_flag = VNOCACHE|VNOMAP|VNOSWAP|VNOMOUNT;
+	vp->v_vfsp = dp->v_vfsp;
+
+	/*
+	 * Do node specific stuff
+	 */
+	switch (type) {
+	case LXPR_PROCDIR:
+		vp->v_flag |= VROOT;
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0555;	/* read-search by everyone */
+		break;
+
+	case LXPR_PID_CURDIR:
+		ASSERT(p != NULL);
+
+		/*
+		 * Zombie check.  p_stat is officially protected by pidlock,
+		 * but we can't grab pidlock here because we already hold
+		 * p_lock.  Luckily if we look at the process exit code
+		 * we see that p_stat only transisions from SRUN to SZOMB
+		 * while p_lock is held.  Aside from this, the only other
+		 * p_stat transition that we need to be aware about is
+		 * SIDL to SRUN, but that's not a problem since lxpr_lock()
+		 * ignores nodes in the SIDL state so we'll never get a node
+		 * that isn't already in the SRUN state.
+		 */
+		if (p->p_stat == SZOMB || (p->p_flag & SEXITING) != 0) {
+			lxpnp->lxpr_realvp = NULL;
+		} else {
+			ASSERT(MUTEX_HELD(&p->p_lock));
+			up = PTOU(p);
+			lxpnp->lxpr_realvp = up->u_cdir;
+			ASSERT(lxpnp->lxpr_realvp != NULL);
+			VN_HOLD(lxpnp->lxpr_realvp);
+		}
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;	/* anyone does anything ! */
+		break;
+
+	case LXPR_PID_ROOTDIR:
+		ASSERT(p != NULL);
+		/* Zombie check.  see locking comment above */
+		if (p->p_stat == SZOMB || (p->p_flag & SEXITING) != 0) {
+			lxpnp->lxpr_realvp = NULL;
+		} else {
+			ASSERT(MUTEX_HELD(&p->p_lock));
+			up = PTOU(p);
+			lxpnp->lxpr_realvp =
+			    up->u_rdir != NULL ? up->u_rdir : rootdir;
+			ASSERT(lxpnp->lxpr_realvp != NULL);
+			VN_HOLD(lxpnp->lxpr_realvp);
+		}
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;	/* anyone does anything ! */
+		break;
+
+	case LXPR_PID_EXE:
+		ASSERT(p != NULL);
+		lxpnp->lxpr_realvp = p->p_exec;
+		if (lxpnp->lxpr_realvp != NULL) {
+			VN_HOLD(lxpnp->lxpr_realvp);
+		}
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;
+		break;
+
+	case LXPR_SELF:
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0777;	/* anyone does anything ! */
+		break;
+
+	case LXPR_PID_FD_FD:
+		ASSERT(p != NULL);
+		/* lxpr_realvp is set after we return */
+		vp->v_type = VLNK;
+		lxpnp->lxpr_mode = 0700;	/* read-write-exe owner only */
+		break;
+
+	case LXPR_PID_FDDIR:
+		ASSERT(p != NULL);
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0500;	/* read-search by owner only */
+		break;
+
+	case LXPR_PIDDIR:
+		ASSERT(p != NULL);
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0511;
+		break;
+
+	case LXPR_NETDIR:
+		vp->v_type = VDIR;
+		lxpnp->lxpr_mode = 0555;	/* read-search by all */
+		break;
+
+	case LXPR_PID_ENV:
+	case LXPR_PID_MEM:
+		ASSERT(p != NULL);
+		/*FALLTHRU*/
+	case LXPR_KCORE:
+		vp->v_type = VREG;
+		lxpnp->lxpr_mode = 0400;	/* read-only by owner only */
+		break;
+
+	default:
+		vp->v_type = VREG;
+		lxpnp->lxpr_mode = 0444;	/* read-only by all */
+		break;
+	}
+
+	return (lxpnp);
+}
+
+
+/*
+ * Free the storage obtained from lxpr_getnode().
+ */
+void
+lxpr_freenode(lxpr_node_t *lxpnp)
+{
+	ASSERT(lxpnp != NULL);
+	ASSERT(LXPTOV(lxpnp) != NULL);
+
+	/*
+	 * delete any association with realvp
+	 */
+	if (lxpnp->lxpr_realvp != NULL)
+		VN_RELE(lxpnp->lxpr_realvp);
+
+	/*
+	 * delete any association with parent vp
+	 */
+	if (lxpnp->lxpr_parent != NULL)
+		VN_RELE(lxpnp->lxpr_parent);
+
+	/*
+	 * Release the lxprnode.
+	 */
+	kmem_cache_free(lxpr_node_cache, lxpnp);
+}
diff --git a/usr/src/uts/common/fs/lxproc/lxpr_vfsops.c b/usr/src/uts/common/fs/lxproc/lxpr_vfsops.c
new file mode 100644
index 0000000000..1bb7bd3823
--- /dev/null
+++ b/usr/src/uts/common/fs/lxproc/lxpr_vfsops.c
@@ -0,0 +1,367 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/cmn_err.h>
+#include <sys/cred.h>
+#include <sys/debug.h>
+#include <sys/errno.h>
+#include <sys/proc.h>
+#include <sys/stat.h>
+#include <sys/statvfs.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/vfs.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vnode.h>
+#include <sys/mode.h>
+#include <sys/signal.h>
+#include <sys/user.h>
+#include <sys/mount.h>
+#include <sys/bitmap.h>
+#include <sys/kmem.h>
+#include <sys/policy.h>
+#include <sys/modctl.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+
+#include "lxproc.h"
+
+/* Module level parameters */
+static int	lxprocfstype;
+static dev_t	lxprocdev;
+static kmutex_t	lxpr_mount_lock;
+
+int nproc_highbit;	/* highbit(v.v_nproc) */
+
+static int lxpr_mount(vfs_t *, vnode_t *, mounta_t *, cred_t *);
+static int lxpr_unmount(vfs_t *, int, cred_t *);
+static int lxpr_root(vfs_t *, vnode_t **);
+static int lxpr_statvfs(vfs_t *, statvfs64_t *);
+static int lxpr_init(int, char *);
+
+static vfsdef_t vfw = {
+	VFSDEF_VERSION,
+	"lxproc",
+	lxpr_init,
+	VSW_ZMOUNT,
+	NULL
+};
+
+/*
+ * Module linkage information for the kernel.
+ */
+extern struct mod_ops mod_fsops;
+
+static struct modlfs modlfs = {
+	&mod_fsops, "generic linux procfs", &vfw
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, (void *)&modlfs, NULL
+};
+
+int
+_init(void)
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int retval;
+
+	/*
+	 * attempt to unload the module
+	 */
+	if ((retval = mod_remove(&modlinkage)) != 0)
+		goto done;
+
+	/*
+	 * destroy lxpr_node cache
+	 */
+	lxpr_fininodecache();
+
+	/*
+	 * clean out the vfsops and vnodeops
+	 */
+	(void) vfs_freevfsops_by_type(lxprocfstype);
+	vn_freevnodeops(lxpr_vnodeops);
+
+	mutex_destroy(&lxpr_mount_lock);
+done:
+	return (retval);
+}
+
+static int
+lxpr_init(int fstype, char *name)
+{
+	static const fs_operation_def_t lxpr_vfsops_template[] = {
+		VFSNAME_MOUNT,		{ .vfs_mount = lxpr_mount },
+		VFSNAME_UNMOUNT,	{ .vfs_unmount = lxpr_unmount },
+		VFSNAME_ROOT,		{ .vfs_root = lxpr_root },
+		VFSNAME_STATVFS,	{ .vfs_statvfs = lxpr_statvfs },
+		NULL,			NULL
+	};
+	extern const fs_operation_def_t lxpr_vnodeops_template[];
+	int error;
+	major_t dev;
+
+	nproc_highbit = highbit(v.v_proc);
+	lxprocfstype = fstype;
+	ASSERT(lxprocfstype != 0);
+
+	mutex_init(&lxpr_mount_lock, NULL, MUTEX_DEFAULT, NULL);
+
+	/*
+	 * Associate VFS ops vector with this fstype.
+	 */
+	error = vfs_setfsops(fstype, lxpr_vfsops_template, NULL);
+	if (error != 0) {
+		cmn_err(CE_WARN, "lxpr_init: bad vfs ops template");
+		return (error);
+	}
+
+	/*
+	 * Set up vnode ops vector too.
+	 */
+	error = vn_make_ops(name, lxpr_vnodeops_template, &lxpr_vnodeops);
+	if (error != 0) {
+		(void) vfs_freevfsops_by_type(fstype);
+		cmn_err(CE_WARN, "lxpr_init: bad vnode ops template");
+		return (error);
+	}
+
+	/*
+	 * Assign a unique "device" number (used by stat(2)).
+	 */
+	if ((dev = getudev()) == (major_t)-1) {
+		cmn_err(CE_WARN, "lxpr_init: can't get unique device number");
+		dev = 0;
+	}
+
+	/*
+	 * Make the pseudo device
+	 */
+	lxprocdev = makedevice(dev, 0);
+
+	/*
+	 * Initialize cache for lxpr_nodes
+	 */
+	lxpr_initnodecache();
+
+	return (0);
+}
+
+static int
+lxpr_mount(vfs_t *vfsp, vnode_t *mvp, mounta_t *uap, cred_t *cr)
+{
+	lxpr_mnt_t *lxpr_mnt;
+	zone_t *zone = curproc->p_zone;
+	ldi_ident_t li;
+	int err;
+
+	/*
+	 * must be root to mount
+	 */
+	if (secpolicy_fs_mount(cr, mvp, vfsp) != 0)
+		return (EPERM);
+
+	/*
+	 * mount point must be a directory
+	 */
+	if (mvp->v_type != VDIR)
+		return (ENOTDIR);
+
+	if (zone == global_zone) {
+		zone_t *mntzone;
+
+		mntzone = zone_find_by_path(refstr_value(vfsp->vfs_mntpt));
+		zone_rele(mntzone);
+		if (zone != mntzone)
+			return (EBUSY);
+	}
+
+	/*
+	 * Having the resource be anything but "lxproc" doesn't make sense
+	 */
+	vfs_setresource(vfsp, "lxproc", 0);
+
+	lxpr_mnt = kmem_alloc(sizeof (*lxpr_mnt), KM_SLEEP);
+
+	if ((err = ldi_ident_from_mod(&modlinkage, &li)) != 0) {
+		kmem_free(lxpr_mnt, sizeof (*lxpr_mnt));
+		return (err);
+	}
+
+	lxpr_mnt->lxprm_li = li;
+
+	mutex_enter(&lxpr_mount_lock);
+
+	/*
+	 * Ensure we don't allow overlaying mounts
+	 */
+	mutex_enter(&mvp->v_lock);
+	if ((uap->flags & MS_OVERLAY) == 0 &&
+	    (mvp->v_count > 1 || (mvp->v_flag & VROOT))) {
+		mutex_exit(&mvp->v_lock);
+		mutex_exit(&lxpr_mount_lock);
+		kmem_free(lxpr_mnt, sizeof ((*lxpr_mnt)));
+		return (EBUSY);
+	}
+	mutex_exit(&mvp->v_lock);
+
+	/*
+	 * allocate the first vnode
+	 */
+	zone_hold(lxpr_mnt->lxprm_zone = zone);
+
+	/* Arbitrarily set the parent vnode to the mounted over directory */
+	lxpr_mnt->lxprm_node = lxpr_getnode(mvp, LXPR_PROCDIR, NULL, 0);
+
+	/* Correctly set the fs for the root node */
+	lxpr_mnt->lxprm_node->lxpr_vnode->v_vfsp = vfsp;
+
+	vfs_make_fsid(&vfsp->vfs_fsid, lxprocdev, lxprocfstype);
+	vfsp->vfs_bsize = DEV_BSIZE;
+	vfsp->vfs_fstype = lxprocfstype;
+	vfsp->vfs_data = (caddr_t)lxpr_mnt;
+	vfsp->vfs_dev = lxprocdev;
+
+	mutex_exit(&lxpr_mount_lock);
+
+	return (0);
+}
+
+static int
+lxpr_unmount(vfs_t *vfsp, int flag, cred_t *cr)
+{
+	lxpr_mnt_t *lxpr_mnt = (lxpr_mnt_t *)vfsp->vfs_data;
+	vnode_t *vp;
+	int count;
+
+	ASSERT(lxpr_mnt != NULL);
+	vp = LXPTOV(lxpr_mnt->lxprm_node);
+
+	mutex_enter(&lxpr_mount_lock);
+
+	/*
+	 * must be root to unmount
+	 */
+	if (secpolicy_fs_unmount(cr, vfsp) != 0) {
+		mutex_exit(&lxpr_mount_lock);
+		return (EPERM);
+	}
+
+	/*
+	 * forced unmount is not supported by this file system
+	 */
+	if (flag & MS_FORCE) {
+		mutex_exit(&lxpr_mount_lock);
+		return (ENOTSUP);
+	}
+
+	/*
+	 * Ensure that no vnodes are in use on this mount point.
+	 */
+	mutex_enter(&vp->v_lock);
+	count = vp->v_count;
+	mutex_exit(&vp->v_lock);
+	if (count > 1) {
+		mutex_exit(&lxpr_mount_lock);
+		return (EBUSY);
+	}
+
+	/*
+	 * purge the dnlc cache for vnode entries
+	 * associated with this file system
+	 */
+	count = dnlc_purge_vfsp(vfsp, 0);
+
+	/*
+	 * free up the lxprnode
+	 */
+	lxpr_freenode(lxpr_mnt->lxprm_node);
+	zone_rele(lxpr_mnt->lxprm_zone);
+	kmem_free(lxpr_mnt, sizeof (*lxpr_mnt));
+
+	mutex_exit(&lxpr_mount_lock);
+
+	return (0);
+}
+
+static int
+lxpr_root(vfs_t *vfsp, vnode_t **vpp)
+{
+	lxpr_node_t *lxpnp = ((lxpr_mnt_t *)vfsp->vfs_data)->lxprm_node;
+	vnode_t *vp = LXPTOV(lxpnp);
+
+	VN_HOLD(vp);
+	*vpp = vp;
+	return (0);
+}
+
+static int
+lxpr_statvfs(vfs_t *vfsp, statvfs64_t *sp)
+{
+	int n;
+	dev32_t d32;
+	extern uint_t nproc;
+
+	n = v.v_proc - nproc;
+
+	bzero((caddr_t)sp, sizeof (*sp));
+	sp->f_bsize	= DEV_BSIZE;
+	sp->f_frsize	= DEV_BSIZE;
+	sp->f_blocks	= (fsblkcnt64_t)0;
+	sp->f_bfree	= (fsblkcnt64_t)0;
+	sp->f_bavail	= (fsblkcnt64_t)0;
+	sp->f_files	= (fsfilcnt64_t)v.v_proc + 2;
+	sp->f_ffree	= (fsfilcnt64_t)n;
+	sp->f_favail	= (fsfilcnt64_t)n;
+	(void) cmpldev(&d32, vfsp->vfs_dev);
+	sp->f_fsid	= d32;
+	/* It is guaranteed that vsw_name will fit in f_basetype */
+	(void) strcpy(sp->f_basetype, vfssw[lxprocfstype].vsw_name);
+	sp->f_flag = vf_to_stf(vfsp->vfs_flag);
+	sp->f_namemax = 64;		/* quite arbitrary */
+
+	(void) strcpy(sp->f_fstr, "lxproc");
+
+	return (0);
+}
diff --git a/usr/src/uts/common/fs/lxproc/lxpr_vnops.c b/usr/src/uts/common/fs/lxproc/lxpr_vnops.c
new file mode 100644
index 0000000000..9bcc0f7e8b
--- /dev/null
+++ b/usr/src/uts/common/fs/lxproc/lxpr_vnops.c
@@ -0,0 +1,3103 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * lxproc -- a loosely Linux-compatible /proc
+ *
+ * We have -- confusingly -- two implementations of Linux /proc.  One is to
+ * support the LX brand with a Linux /proc entirely compatible with the Linux
+ * world view; the other -- this one -- is to support native (but Linux-borne)
+ * programs that wish to view the native system via the Linux /proc model.  So
+ * the aspiration here is to provide something that sufficiently approximates
+ * the Linux /proc implementation for purposes of offering some compatibility
+ * for simple Linux /proc readers (e.g., ps/top/htop).  However, it is not
+ * intended to exactly mimic Linux semantics; when choosing between offering
+ * compatibility and telling the truth, we emphatically pick the truth.  A
+ * particular glaring example of this is the Linux notion of "tasks" (that is,
+ * threads), which -- due to historical misadventures on Linux -- allocate their
+ * identifiers from the process identifier space.  (That is, each thread has in
+ * effect a pid.)  Some Linux /proc readers have come to depend on this
+ * attribute, and become confused when threads appear with proper identifiers,
+ * so we simply opt for the pre-2.6 behavior, and do not present the tasks
+ * directory at all.  Similarly, when choosing between offering compatibility
+ * and remaining consistent with our broader security model, we (obviously)
+ * choose security over compatibility.  In short, this is meant to be a best
+ * effort -- no more -- and as such, it should not be unified with the much
+ * more complete Linux /proc implementation found in the LX brand.
+ */
+
+#include <sys/cpupart.h>
+#include <sys/cpuvar.h>
+#include <sys/session.h>
+#include <sys/vmparam.h>
+#include <sys/mman.h>
+#include <vm/rm.h>
+#include <vm/seg_vn.h>
+#include <sys/sdt.h>
+#include <sys/strlog.h>
+#include <sys/stropts.h>
+#include <sys/cmn_err.h>
+#include <sys/x86_archext.h>
+#include <sys/archsystm.h>
+#include <sys/fp.h>
+#include <sys/pool_pset.h>
+#include <sys/pset.h>
+#include <sys/zone.h>
+#include <sys/pghw.h>
+#include <sys/vfs_opreg.h>
+
+/* Dependent on procfs */
+extern kthread_t *prchoose(proc_t *);
+
+#include "lxproc.h"
+
+extern pgcnt_t swapfs_minfree;
+extern time_t boot_time;
+
+/*
+ * Pointer to the vnode ops vector for this fs.
+ * This is instantiated in lxprinit() in lxpr_vfsops.c
+ */
+vnodeops_t *lxpr_vnodeops;
+
+static int lxpr_open(vnode_t **, int, cred_t *, caller_context_t *);
+static int lxpr_close(vnode_t *, int, int, offset_t, cred_t *,
+    caller_context_t *);
+static int lxpr_read(vnode_t *, uio_t *, int, cred_t *, caller_context_t *);
+static int lxpr_getattr(vnode_t *, vattr_t *, int, cred_t *,
+    caller_context_t *);
+static int lxpr_access(vnode_t *, int, int, cred_t *, caller_context_t *);
+static int lxpr_lookup(vnode_t *, char *, vnode_t **,
+    pathname_t *, int, vnode_t *, cred_t *, caller_context_t *, int *,
+    pathname_t *);
+static int lxpr_readdir(vnode_t *, uio_t *, cred_t *, int *,
+    caller_context_t *, int);
+static int lxpr_readlink(vnode_t *, uio_t *, cred_t *, caller_context_t *);
+static int lxpr_cmp(vnode_t *, vnode_t *, caller_context_t *);
+static int lxpr_realvp(vnode_t *, vnode_t **, caller_context_t *);
+static int lxpr_sync(void);
+static void lxpr_inactive(vnode_t *, cred_t *, caller_context_t *);
+
+static vnode_t *lxpr_lookup_procdir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_piddir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_not_a_dir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_fddir(vnode_t *, char *);
+static vnode_t *lxpr_lookup_netdir(vnode_t *, char *);
+
+static int lxpr_readdir_procdir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_piddir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_not_a_dir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_fddir(lxpr_node_t *, uio_t *, int *);
+static int lxpr_readdir_netdir(lxpr_node_t *, uio_t *, int *);
+
+static void lxpr_read_invalid(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_empty(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_cpuinfo(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_isdir(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_fd(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_kmsg(lxpr_node_t *, lxpr_uiobuf_t *, ldi_handle_t);
+static void lxpr_read_loadavg(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_meminfo(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_mounts(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_partitions(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_stat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_uptime(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_version(lxpr_node_t *, lxpr_uiobuf_t *);
+
+static void lxpr_read_pid_cmdline(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_maps(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_stat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_statm(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_pid_status(lxpr_node_t *, lxpr_uiobuf_t *);
+
+static void lxpr_read_net_arp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_dev(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_dev_mcast(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_igmp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_ip_mr_cache(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_ip_mr_vif(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_mcfilter(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_netstat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_raw(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_route(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_rpc(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_rt_cache(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_sockstat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_snmp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_stat(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_tcp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_udp(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_net_unix(lxpr_node_t *, lxpr_uiobuf_t *);
+
+/*
+ * Simple conversion
+ */
+#define	btok(x)	((x) >> 10)			/* bytes to kbytes */
+#define	ptok(x)	((x) << (PAGESHIFT - 10))	/* pages to kbytes */
+
+/*
+ * The lxproc vnode operations vector
+ */
+const fs_operation_def_t lxpr_vnodeops_template[] = {
+	VOPNAME_OPEN,		{ .vop_open = lxpr_open },
+	VOPNAME_CLOSE,		{ .vop_close = lxpr_close },
+	VOPNAME_READ,		{ .vop_read = lxpr_read },
+	VOPNAME_GETATTR,	{ .vop_getattr = lxpr_getattr },
+	VOPNAME_ACCESS,		{ .vop_access = lxpr_access },
+	VOPNAME_LOOKUP,		{ .vop_lookup = lxpr_lookup },
+	VOPNAME_READDIR,	{ .vop_readdir = lxpr_readdir },
+	VOPNAME_READLINK,	{ .vop_readlink = lxpr_readlink },
+	VOPNAME_FSYNC,		{ .error = lxpr_sync },
+	VOPNAME_SEEK,		{ .error = lxpr_sync },
+	VOPNAME_INACTIVE,	{ .vop_inactive = lxpr_inactive },
+	VOPNAME_CMP,		{ .vop_cmp = lxpr_cmp },
+	VOPNAME_REALVP,		{ .vop_realvp = lxpr_realvp },
+	NULL,			NULL
+};
+
+/*
+ * file contents of an lxproc directory.
+ */
+static lxpr_dirent_t lxpr_dir[] = {
+	{ LXPR_CMDLINE,		"cmdline" },
+	{ LXPR_CPUINFO,		"cpuinfo" },
+	{ LXPR_DEVICES,		"devices" },
+	{ LXPR_DMA,		"dma" },
+	{ LXPR_FILESYSTEMS,	"filesystems" },
+	{ LXPR_INTERRUPTS,	"interrupts" },
+	{ LXPR_IOPORTS,		"ioports" },
+	{ LXPR_KCORE,		"kcore" },
+	{ LXPR_KMSG,		"kmsg" },
+	{ LXPR_LOADAVG,		"loadavg" },
+	{ LXPR_MEMINFO,		"meminfo" },
+	{ LXPR_MOUNTS,		"mounts" },
+	{ LXPR_NETDIR,		"net" },
+	{ LXPR_PARTITIONS,	"partitions" },
+	{ LXPR_SELF,		"self" },
+	{ LXPR_STAT,		"stat" },
+	{ LXPR_UPTIME,		"uptime" },
+	{ LXPR_VERSION,		"version" }
+};
+
+#define	PROCDIRFILES	(sizeof (lxpr_dir) / sizeof (lxpr_dir[0]))
+
+/*
+ * Contents of an /lxproc/<pid> directory.
+ */
+static lxpr_dirent_t piddir[] = {
+	{ LXPR_PID_CMDLINE,	"cmdline" },
+	{ LXPR_PID_CPU,		"cpu" },
+	{ LXPR_PID_CURDIR,	"cwd" },
+	{ LXPR_PID_ENV,		"environ" },
+	{ LXPR_PID_EXE,		"exe" },
+	{ LXPR_PID_MAPS,	"maps" },
+	{ LXPR_PID_MEM,		"mem" },
+	{ LXPR_PID_ROOTDIR,	"root" },
+	{ LXPR_PID_STAT,	"stat" },
+	{ LXPR_PID_STATM,	"statm" },
+	{ LXPR_PID_STATUS,	"status" },
+	{ LXPR_PID_FDDIR,	"fd" }
+};
+
+#define	PIDDIRFILES	(sizeof (piddir) / sizeof (piddir[0]))
+
+/*
+ * contents of /lxproc/net directory
+ */
+static lxpr_dirent_t netdir[] = {
+	{ LXPR_NET_ARP,		"arp" },
+	{ LXPR_NET_DEV,		"dev" },
+	{ LXPR_NET_DEV_MCAST,	"dev_mcast" },
+	{ LXPR_NET_IGMP,	"igmp" },
+	{ LXPR_NET_IP_MR_CACHE,	"ip_mr_cache" },
+	{ LXPR_NET_IP_MR_VIF,	"ip_mr_vif" },
+	{ LXPR_NET_MCFILTER,	"mcfilter" },
+	{ LXPR_NET_NETSTAT,	"netstat" },
+	{ LXPR_NET_RAW,		"raw" },
+	{ LXPR_NET_ROUTE,	"route" },
+	{ LXPR_NET_RPC,		"rpc" },
+	{ LXPR_NET_RT_CACHE,	"rt_cache" },
+	{ LXPR_NET_SOCKSTAT,	"sockstat" },
+	{ LXPR_NET_SNMP,	"snmp" },
+	{ LXPR_NET_STAT,	"stat" },
+	{ LXPR_NET_TCP,		"tcp" },
+	{ LXPR_NET_UDP,		"udp" },
+	{ LXPR_NET_UNIX,	"unix" }
+};
+
+#define	NETDIRFILES	(sizeof (netdir) / sizeof (netdir[0]))
+
+/*
+ * These are the major signal number differences between Linux and native:
+ *
+ * 	====================================
+ * 	| Number | Linux      | Native     |
+ * 	| ====== | =========  | ========== |
+ *	|    7   | SIGBUS     | SIGEMT     |
+ *	|   10   | SIGUSR1    | SIGBUS     |
+ *	|   12   | SIGUSR2    | SIGSYS     |
+ *	|   16   | SIGSTKFLT  | SIGUSR1    |
+ *	|   17   | SIGCHLD    | SIGUSR2    |
+ * 	|   18   | SIGCONT    | SIGCHLD    |
+ *	|   19   | SIGSTOP    | SIGPWR     |
+ * 	|   20   | SIGTSTP    | SIGWINCH   |
+ * 	|   21   | SIGTTIN    | SIGURG     |
+ * 	|   22   | SIGTTOU    | SIGPOLL    |
+ *	|   23   | SIGURG     | SIGSTOP    |
+ * 	|   24   | SIGXCPU    | SIGTSTP    |
+ *	|   25   | SIGXFSZ    | SIGCONT    |
+ *	|   26   | SIGVTALARM | SIGTTIN    |
+ *	|   27   | SIGPROF    | SIGTTOU    |
+ *	|   28   | SIGWINCH   | SIGVTALARM |
+ *	|   29   | SIGPOLL    | SIGPROF    |
+ *	|   30   | SIGPWR     | SIGXCPU    |
+ *	|   31   | SIGSYS     | SIGXFSZ    |
+ * 	====================================
+ *
+ * Not every Linux signal maps to a native signal, nor does every native
+ * signal map to a Linux counterpart. However, when signals do map, the
+ * mapping is unique.
+ */
+static int
+lxpr_sigmap[NSIG] = {
+	0,
+	LX_SIGHUP,
+	LX_SIGINT,
+	LX_SIGQUIT,
+	LX_SIGILL,
+	LX_SIGTRAP,
+	LX_SIGABRT,
+	LX_SIGSTKFLT,
+	LX_SIGFPE,
+	LX_SIGKILL,
+	LX_SIGBUS,
+	LX_SIGSEGV,
+	LX_SIGSYS,
+	LX_SIGPIPE,
+	LX_SIGALRM,
+	LX_SIGTERM,
+	LX_SIGUSR1,
+	LX_SIGUSR2,
+	LX_SIGCHLD,
+	LX_SIGPWR,
+	LX_SIGWINCH,
+	LX_SIGURG,
+	LX_SIGPOLL,
+	LX_SIGSTOP,
+	LX_SIGTSTP,
+	LX_SIGCONT,
+	LX_SIGTTIN,
+	LX_SIGTTOU,
+	LX_SIGVTALRM,
+	LX_SIGPROF,
+	LX_SIGXCPU,
+	LX_SIGXFSZ,
+	-1,			/* 32:  illumos SIGWAITING */
+	-1,			/* 33:  illumos SIGLWP */
+	-1,			/* 34:  illumos SIGFREEZE */
+	-1,			/* 35:  illumos SIGTHAW */
+	-1,			/* 36:  illumos SIGCANCEL */
+	-1,			/* 37:  illumos SIGLOST */
+	-1,			/* 38:  illumos SIGXRES */
+	-1,			/* 39:  illumos SIGJVM1 */
+	-1,			/* 40:  illumos SIGJVM2 */
+	-1,			/* 41:  illumos SIGINFO */
+	LX_SIGRTMIN,		/* 42:  illumos _SIGRTMIN */
+	LX_SIGRTMIN + 1,
+	LX_SIGRTMIN + 2,
+	LX_SIGRTMIN + 3,
+	LX_SIGRTMIN + 4,
+	LX_SIGRTMIN + 5,
+	LX_SIGRTMIN + 6,
+	LX_SIGRTMIN + 7,
+	LX_SIGRTMIN + 8,
+	LX_SIGRTMIN + 9,
+	LX_SIGRTMIN + 10,
+	LX_SIGRTMIN + 11,
+	LX_SIGRTMIN + 12,
+	LX_SIGRTMIN + 13,
+	LX_SIGRTMIN + 14,
+	LX_SIGRTMIN + 15,
+	LX_SIGRTMIN + 16,
+	LX_SIGRTMIN + 17,
+	LX_SIGRTMIN + 18,
+	LX_SIGRTMIN + 19,
+	LX_SIGRTMIN + 20,
+	LX_SIGRTMIN + 21,
+	LX_SIGRTMIN + 22,
+	LX_SIGRTMIN + 23,
+	LX_SIGRTMIN + 24,
+	LX_SIGRTMIN + 25,
+	LX_SIGRTMIN + 26,
+	LX_SIGRTMIN + 27,
+	LX_SIGRTMIN + 28,
+	LX_SIGRTMIN + 29,
+	LX_SIGRTMIN + 30,
+	LX_SIGRTMAX
+};
+
+/*
+ * lxpr_open(): Vnode operation for VOP_OPEN()
+ */
+static int
+lxpr_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
+{
+	vnode_t		*vp = *vpp;
+	lxpr_node_t	*lxpnp = VTOLXP(vp);
+	lxpr_nodetype_t	type = lxpnp->lxpr_type;
+	vnode_t		*rvp;
+	int		error = 0;
+
+	/*
+	 * We only allow reading in this file systrem
+	 */
+	if (flag & FWRITE)
+		return (EROFS);
+
+	/*
+	 * If we are opening an underlying file only allow regular files
+	 * reject the open for anything but a regular file.
+	 * Just do it if we are opening the current or root directory.
+	 */
+	if (lxpnp->lxpr_realvp != NULL) {
+		rvp = lxpnp->lxpr_realvp;
+
+		if (type == LXPR_PID_FD_FD && rvp->v_type != VREG)
+			error = EACCES;
+		else {
+			/*
+			 * Need to hold rvp since VOP_OPEN() may release it.
+			 */
+			VN_HOLD(rvp);
+			error = VOP_OPEN(&rvp, flag, cr, ct);
+			if (error) {
+				VN_RELE(rvp);
+			} else {
+				*vpp = rvp;
+				VN_RELE(vp);
+			}
+		}
+	}
+
+	return (error);
+}
+
+
+/*
+ * lxpr_close(): Vnode operation for VOP_CLOSE()
+ */
+/* ARGSUSED */
+static int
+lxpr_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
+    caller_context_t *ct)
+{
+	lxpr_node_t	*lxpr = VTOLXP(vp);
+	lxpr_nodetype_t	type = lxpr->lxpr_type;
+
+	/*
+	 * we should never get here because the close is done on the realvp
+	 * for these nodes
+	 */
+	ASSERT(type != LXPR_PID_FD_FD &&
+	    type != LXPR_PID_CURDIR &&
+	    type != LXPR_PID_ROOTDIR &&
+	    type != LXPR_PID_EXE);
+
+	return (0);
+}
+
+static void (*lxpr_read_function[LXPR_NFILES])() = {
+	lxpr_read_isdir,		/* /proc		*/
+	lxpr_read_isdir,		/* /proc/<pid>		*/
+	lxpr_read_pid_cmdline,		/* /proc/<pid>/cmdline	*/
+	lxpr_read_empty,		/* /proc/<pid>/cpu	*/
+	lxpr_read_invalid,		/* /proc/<pid>/cwd	*/
+	lxpr_read_empty,		/* /proc/<pid>/environ	*/
+	lxpr_read_invalid,		/* /proc/<pid>/exe	*/
+	lxpr_read_pid_maps,		/* /proc/<pid>/maps	*/
+	lxpr_read_empty,		/* /proc/<pid>/mem	*/
+	lxpr_read_invalid,		/* /proc/<pid>/root	*/
+	lxpr_read_pid_stat,		/* /proc/<pid>/stat	*/
+	lxpr_read_pid_statm,		/* /proc/<pid>/statm	*/
+	lxpr_read_pid_status,		/* /proc/<pid>/status	*/
+	lxpr_read_isdir,		/* /proc/<pid>/fd	*/
+	lxpr_read_fd,			/* /proc/<pid>/fd/nn	*/
+	lxpr_read_empty,		/* /proc/cmdline	*/
+	lxpr_read_cpuinfo,		/* /proc/cpuinfo	*/
+	lxpr_read_empty,		/* /proc/devices	*/
+	lxpr_read_empty,		/* /proc/dma		*/
+	lxpr_read_empty,		/* /proc/filesystems	*/
+	lxpr_read_empty,		/* /proc/interrupts	*/
+	lxpr_read_empty,		/* /proc/ioports	*/
+	lxpr_read_empty,		/* /proc/kcore		*/
+	lxpr_read_invalid,		/* /proc/kmsg -- see lxpr_read() */
+	lxpr_read_loadavg,		/* /proc/loadavg	*/
+	lxpr_read_meminfo,		/* /proc/meminfo	*/
+	lxpr_read_mounts,		/* /proc/mounts		*/
+	lxpr_read_isdir,		/* /proc/net		*/
+	lxpr_read_net_arp,		/* /proc/net/arp	*/
+	lxpr_read_net_dev,		/* /proc/net/dev	*/
+	lxpr_read_net_dev_mcast,	/* /proc/net/dev_mcast	*/
+	lxpr_read_net_igmp,		/* /proc/net/igmp	*/
+	lxpr_read_net_ip_mr_cache,	/* /proc/net/ip_mr_cache */
+	lxpr_read_net_ip_mr_vif,	/* /proc/net/ip_mr_vif	*/
+	lxpr_read_net_mcfilter,		/* /proc/net/mcfilter	*/
+	lxpr_read_net_netstat,		/* /proc/net/netstat	*/
+	lxpr_read_net_raw,		/* /proc/net/raw	*/
+	lxpr_read_net_route,		/* /proc/net/route	*/
+	lxpr_read_net_rpc,		/* /proc/net/rpc	*/
+	lxpr_read_net_rt_cache,		/* /proc/net/rt_cache	*/
+	lxpr_read_net_sockstat,		/* /proc/net/sockstat	*/
+	lxpr_read_net_snmp,		/* /proc/net/snmp	*/
+	lxpr_read_net_stat,		/* /proc/net/stat	*/
+	lxpr_read_net_tcp,		/* /proc/net/tcp	*/
+	lxpr_read_net_udp,		/* /proc/net/udp	*/
+	lxpr_read_net_unix,		/* /proc/net/unix	*/
+	lxpr_read_partitions,		/* /proc/partitions	*/
+	lxpr_read_invalid,		/* /proc/self		*/
+	lxpr_read_stat,			/* /proc/stat		*/
+	lxpr_read_uptime,		/* /proc/uptime		*/
+	lxpr_read_version,		/* /proc/version	*/
+};
+
+/*
+ * Array of lookup functions, indexed by /lxproc file type.
+ */
+static vnode_t *(*lxpr_lookup_function[LXPR_NFILES])() = {
+	lxpr_lookup_procdir,		/* /proc		*/
+	lxpr_lookup_piddir,		/* /proc/<pid>		*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/cmdline	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/cpu	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/cwd	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/environ	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/exe	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/maps	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/mem	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/root	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/stat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/statm	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/status	*/
+	lxpr_lookup_fddir,		/* /proc/<pid>/fd	*/
+	lxpr_lookup_not_a_dir,		/* /proc/<pid>/fd/nn	*/
+	lxpr_lookup_not_a_dir,		/* /proc/cmdline	*/
+	lxpr_lookup_not_a_dir,		/* /proc/cpuinfo	*/
+	lxpr_lookup_not_a_dir,		/* /proc/devices	*/
+	lxpr_lookup_not_a_dir,		/* /proc/dma		*/
+	lxpr_lookup_not_a_dir,		/* /proc/filesystems	*/
+	lxpr_lookup_not_a_dir,		/* /proc/interrupts	*/
+	lxpr_lookup_not_a_dir,		/* /proc/ioports	*/
+	lxpr_lookup_not_a_dir,		/* /proc/kcore		*/
+	lxpr_lookup_not_a_dir,		/* /proc/kmsg		*/
+	lxpr_lookup_not_a_dir,		/* /proc/loadavg	*/
+	lxpr_lookup_not_a_dir,		/* /proc/meminfo	*/
+	lxpr_lookup_not_a_dir,		/* /proc/mounts		*/
+	lxpr_lookup_netdir,		/* /proc/net		*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/arp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/dev	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/dev_mcast	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/igmp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/ip_mr_cache */
+	lxpr_lookup_not_a_dir,		/* /proc/net/ip_mr_vif	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/mcfilter	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/netstat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/raw	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/route	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/rpc	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/rt_cache	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/sockstat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/snmp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/stat	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/tcp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/udp	*/
+	lxpr_lookup_not_a_dir,		/* /proc/net/unix	*/
+	lxpr_lookup_not_a_dir,		/* /proc/partitions	*/
+	lxpr_lookup_not_a_dir,		/* /proc/self		*/
+	lxpr_lookup_not_a_dir,		/* /proc/stat		*/
+	lxpr_lookup_not_a_dir,		/* /proc/uptime		*/
+	lxpr_lookup_not_a_dir,		/* /proc/version	*/
+};
+
+/*
+ * Array of readdir functions, indexed by /proc file type.
+ */
+static int (*lxpr_readdir_function[LXPR_NFILES])() = {
+	lxpr_readdir_procdir,		/* /proc		*/
+	lxpr_readdir_piddir,		/* /proc/<pid>		*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/cmdline	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/cpu	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/cwd	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/environ	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/exe	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/maps	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/mem	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/root	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/stat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/statm	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/status	*/
+	lxpr_readdir_fddir,		/* /proc/<pid>/fd	*/
+	lxpr_readdir_not_a_dir,		/* /proc/<pid>/fd/nn	*/
+	lxpr_readdir_not_a_dir,		/* /proc/cmdline	*/
+	lxpr_readdir_not_a_dir,		/* /proc/cpuinfo	*/
+	lxpr_readdir_not_a_dir,		/* /proc/devices	*/
+	lxpr_readdir_not_a_dir,		/* /proc/dma		*/
+	lxpr_readdir_not_a_dir,		/* /proc/filesystems	*/
+	lxpr_readdir_not_a_dir,		/* /proc/interrupts	*/
+	lxpr_readdir_not_a_dir,		/* /proc/ioports	*/
+	lxpr_readdir_not_a_dir,		/* /proc/kcore		*/
+	lxpr_readdir_not_a_dir,		/* /proc/kmsg		*/
+	lxpr_readdir_not_a_dir,		/* /proc/loadavg	*/
+	lxpr_readdir_not_a_dir,		/* /proc/meminfo	*/
+	lxpr_readdir_not_a_dir,		/* /proc/mounts		*/
+	lxpr_readdir_netdir,		/* /proc/net		*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/arp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/dev	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/dev_mcast	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/igmp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/ip_mr_cache */
+	lxpr_readdir_not_a_dir,		/* /proc/net/ip_mr_vif	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/mcfilter	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/netstat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/raw	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/route	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/rpc	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/rt_cache	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/sockstat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/snmp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/stat	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/tcp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/udp	*/
+	lxpr_readdir_not_a_dir,		/* /proc/net/unix	*/
+	lxpr_readdir_not_a_dir,		/* /proc/partitions	*/
+	lxpr_readdir_not_a_dir,		/* /proc/self		*/
+	lxpr_readdir_not_a_dir,		/* /proc/stat		*/
+	lxpr_readdir_not_a_dir,		/* /proc/uptime		*/
+	lxpr_readdir_not_a_dir,		/* /proc/version	*/
+};
+
+
+/*
+ * lxpr_read(): Vnode operation for VOP_READ()
+ *
+ * As the format of all the files that can be read in lxproc is human readable
+ * and not binary structures there do not have to be different read variants
+ * depending on whether the reading process model is 32- or 64-bit.
+ */
+/* ARGSUSED */
+static int
+lxpr_read(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr,
+    caller_context_t *ct)
+{
+	lxpr_node_t *lxpnp = VTOLXP(vp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	lxpr_uiobuf_t *uiobuf = lxpr_uiobuf_new(uiop);
+	int error;
+
+	ASSERT(type < LXPR_NFILES);
+
+	if (type == LXPR_KMSG) {
+		ldi_ident_t	li = VTOLXPM(vp)->lxprm_li;
+		ldi_handle_t	ldih;
+		struct strioctl	str;
+		int		rv;
+
+		/*
+		 * Open the zone's console device using the layered driver
+		 * interface.
+		 */
+		if ((error =
+		    ldi_open_by_name("/dev/log", FREAD, cr, &ldih, li)) != 0)
+			return (error);
+
+		/*
+		 * Send an ioctl to the underlying console device, letting it
+		 * know we're interested in getting console messages.
+		 */
+		str.ic_cmd = I_CONSLOG;
+		str.ic_timout = 0;
+		str.ic_len = 0;
+		str.ic_dp = NULL;
+		if ((error = ldi_ioctl(ldih, I_STR,
+		    (intptr_t)&str, FKIOCTL, cr, &rv)) != 0)
+			return (error);
+
+		lxpr_read_kmsg(lxpnp, uiobuf, ldih);
+
+		if ((error = ldi_close(ldih, FREAD, cr)) != 0)
+			return (error);
+	} else {
+		lxpr_read_function[type](lxpnp, uiobuf);
+	}
+
+	error = lxpr_uiobuf_flush(uiobuf);
+	lxpr_uiobuf_free(uiobuf);
+
+	return (error);
+}
+
+/*
+ * lxpr_read_invalid(), lxpr_read_isdir(), lxpr_read_empty()
+ *
+ * Various special case reads:
+ * - trying to read a directory
+ * - invalid file (used to mean a file that should be implemented,
+ *   but isn't yet)
+ * - empty file
+ * - wait to be able to read a file that will never have anything to read
+ */
+/* ARGSUSED */
+static void
+lxpr_read_isdir(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_seterr(uiobuf, EISDIR);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_invalid(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_seterr(uiobuf, EINVAL);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_empty(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/*
+ * lxpr_read_pid_cmdline():
+ *
+ * This is not precisely compatible with Linux: the Linux cmdline returns argv
+ * with the correct separation using \0 between the arguments, but we cannot do
+ * that without copying the real argv from the correct process context.  This
+ * is too difficult to attempt so we pretend that the entire cmdline is just
+ * argv[0]. This is good enough for ps and htop to display correctly, but might
+ * cause some other things not to work correctly.
+ */
+static void
+lxpr_read_pid_cmdline(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	char *buf;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_CMDLINE);
+
+	p = lxpr_lock(lxpnp->lxpr_pid);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	buf = PTOU(p)->u_argv != 0 ? PTOU(p)->u_psargs : PTOU(p)->u_comm;
+
+	lxpr_uiobuf_write(uiobuf, buf, strlen(buf) + 1);
+	lxpr_unlock(p);
+}
+
+/*
+ * lxpr_read_pid_maps(): memory map file
+ */
+static void
+lxpr_read_pid_maps(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	struct as *as;
+	struct seg *seg;
+	char *buf;
+	int buflen = MAXPATHLEN;
+	struct print_data {
+		caddr_t saddr;
+		caddr_t eaddr;
+		int type;
+		char prot[5];
+		uint32_t offset;
+		vnode_t *vp;
+		struct print_data *next;
+	} *print_head = NULL;
+	struct print_data **print_tail = &print_head;
+	struct print_data *pbuf;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_MAPS);
+
+	p = lxpr_lock(lxpnp->lxpr_pid);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	as = p->p_as;
+
+	if (as == &kas) {
+		lxpr_unlock(p);
+		return;
+	}
+
+	mutex_exit(&p->p_lock);
+
+	/* Iterate over all segments in the address space */
+	AS_LOCK_ENTER(as, RW_READER);
+	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
+		vnode_t *vp;
+		uint_t protbits;
+
+		if ((seg->s_flags & S_HOLE) != 0) {
+			continue;
+		}
+
+		pbuf = kmem_alloc(sizeof (*pbuf), KM_SLEEP);
+
+		pbuf->saddr = seg->s_base;
+		pbuf->eaddr = seg->s_base+seg->s_size;
+		pbuf->type = SEGOP_GETTYPE(seg, seg->s_base);
+
+		/*
+		 * Cheat and only use the protection bits of the first page
+		 * in the segment
+		 */
+		(void) strncpy(pbuf->prot, "----", sizeof (pbuf->prot));
+		(void) SEGOP_GETPROT(seg, seg->s_base, 0, &protbits);
+
+		if (protbits & PROT_READ)	   pbuf->prot[0] = 'r';
+		if (protbits & PROT_WRITE)	   pbuf->prot[1] = 'w';
+		if (protbits & PROT_EXEC)	   pbuf->prot[2] = 'x';
+		if (pbuf->type & MAP_SHARED)	   pbuf->prot[3] = 's';
+		else if (pbuf->type & MAP_PRIVATE) pbuf->prot[3] = 'p';
+
+		if (seg->s_ops == &segvn_ops &&
+		    SEGOP_GETVP(seg, seg->s_base, &vp) == 0 &&
+		    vp != NULL && vp->v_type == VREG) {
+			VN_HOLD(vp);
+			pbuf->vp = vp;
+		} else {
+			pbuf->vp = NULL;
+		}
+
+		pbuf->offset = (uint32_t)SEGOP_GETOFFSET(seg, pbuf->saddr);
+
+		pbuf->next = NULL;
+		*print_tail = pbuf;
+		print_tail = &pbuf->next;
+	}
+	AS_LOCK_EXIT(as);
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+
+	buf = kmem_alloc(buflen, KM_SLEEP);
+
+	/* print the data we've extracted */
+	pbuf = print_head;
+	while (pbuf != NULL) {
+		struct print_data *pbuf_next;
+		vattr_t vattr;
+
+		int maj = 0;
+		int min = 0;
+		u_longlong_t inode = 0;
+
+		*buf = '\0';
+		if (pbuf->vp != NULL) {
+			vattr.va_mask = AT_FSID | AT_NODEID;
+			if (VOP_GETATTR(pbuf->vp, &vattr, 0, CRED(),
+			    NULL) == 0) {
+				maj = getmajor(vattr.va_fsid);
+				min = getminor(vattr.va_fsid);
+				inode = vattr.va_nodeid;
+			}
+			(void) vnodetopath(NULL, pbuf->vp, buf, buflen, CRED());
+			VN_RELE(pbuf->vp);
+		}
+
+		if (*buf != '\0') {
+			lxpr_uiobuf_printf(uiobuf,
+			    "%08x-%08x %s %08x %02d:%03d %lld %s\n",
+			    pbuf->saddr, pbuf->eaddr, pbuf->prot, pbuf->offset,
+			    maj, min, inode, buf);
+		} else {
+			lxpr_uiobuf_printf(uiobuf,
+			    "%08x-%08x %s %08x %02d:%03d %lld\n",
+			    pbuf->saddr, pbuf->eaddr, pbuf->prot, pbuf->offset,
+			    maj, min, inode);
+		}
+
+		pbuf_next = pbuf->next;
+		kmem_free(pbuf, sizeof (*pbuf));
+		pbuf = pbuf_next;
+	}
+
+	kmem_free(buf, buflen);
+}
+
+/*
+ * lxpr_read_pid_statm(): memory status file
+ */
+static void
+lxpr_read_pid_statm(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	struct as *as;
+	size_t vsize;
+	size_t rss;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_STATM);
+
+	p = lxpr_lock(lxpnp->lxpr_pid);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	as = p->p_as;
+
+	mutex_exit(&p->p_lock);
+
+	AS_LOCK_ENTER(as, RW_READER);
+	vsize = btopr(as->a_resvsize);
+	rss = rm_asrss(as);
+	AS_LOCK_EXIT(as);
+
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%lu %lu %lu %lu %lu %lu %lu\n",
+	    vsize, rss, 0l, rss, 0l, 0l, 0l);
+}
+
+/*
+ * lxpr_read_pid_status(): status file
+ */
+static void
+lxpr_read_pid_status(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	kthread_t *t;
+	user_t *up;
+	cred_t *cr;
+	const gid_t *groups;
+	int    ngroups;
+	struct as *as;
+	char *status;
+	pid_t pid, ppid;
+	size_t vsize;
+	size_t rss;
+	k_sigset_t current, ignore, handle;
+	int    i, lx_sig;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_STATUS);
+
+	p = lxpr_lock(lxpnp->lxpr_pid);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	pid = p->p_pid;
+
+	/*
+	 * Convert pid to the Linux default of 1 if we're the zone's init
+	 * process
+	 */
+	if (pid == curproc->p_zone->zone_proc_initpid) {
+		pid = 1;
+		ppid = 0;	/* parent pid for init is 0 */
+	} else {
+		/*
+		 * Make sure not to reference parent PIDs that reside outside
+		 * the zone
+		 */
+		ppid = ((p->p_flag & SZONETOP)
+		    ? curproc->p_zone->zone_zsched->p_pid : p->p_ppid);
+
+		/*
+		 * Convert ppid to the Linux default of 1 if our parent is the
+		 * zone's init process
+		 */
+		if (ppid == curproc->p_zone->zone_proc_initpid)
+			ppid = 1;
+	}
+
+	t = prchoose(p);
+	if (t != NULL) {
+		switch (t->t_state) {
+		case TS_SLEEP:
+			status = "S (sleeping)";
+			break;
+		case TS_RUN:
+		case TS_ONPROC:
+			status = "R (running)";
+			break;
+		case TS_ZOMB:
+			status = "Z (zombie)";
+			break;
+		case TS_STOPPED:
+			status = "T (stopped)";
+			break;
+		default:
+			status = "! (unknown)";
+			break;
+		}
+		thread_unlock(t);
+	} else {
+		/*
+		 * there is a hole in the exit code, where a proc can have
+		 * no threads but it is yet to be flagged SZOMB. We will
+		 * assume we are about to become a zombie
+		 */
+		status = "Z (zombie)";
+	}
+
+	up = PTOU(p);
+	mutex_enter(&p->p_crlock);
+	crhold(cr = p->p_cred);
+	mutex_exit(&p->p_crlock);
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "Name:\t%s\n"
+	    "State:\t%s\n"
+	    "Tgid:\t%d\n"
+	    "Pid:\t%d\n"
+	    "PPid:\t%d\n"
+	    "TracerPid:\t%d\n"
+	    "Uid:\t%u\t%u\t%u\t%u\n"
+	    "Gid:\t%u\t%u\t%u\t%u\n"
+	    "FDSize:\t%d\n"
+	    "Groups:\t",
+	    up->u_comm,
+	    status,
+	    pid, /* thread group id - same as pid */
+	    pid,
+	    ppid,
+	    0,
+	    crgetruid(cr), crgetuid(cr), crgetsuid(cr), crgetuid(cr),
+	    crgetrgid(cr), crgetgid(cr), crgetsgid(cr), crgetgid(cr),
+	    p->p_fno_ctl);
+
+	ngroups = crgetngroups(cr);
+	groups  = crgetgroups(cr);
+	for (i = 0; i < ngroups; i++) {
+		lxpr_uiobuf_printf(uiobuf,
+		    "%u ",
+		    groups[i]);
+	}
+	crfree(cr);
+
+	as = p->p_as;
+	if ((p->p_stat != SZOMB) && !(p->p_flag & (SSYS | SEXITING)) &&
+	    (as != &kas)) {
+		mutex_exit(&p->p_lock);
+		AS_LOCK_ENTER(as, RW_READER);
+		vsize = as->a_resvsize;
+		rss = rm_asrss(as);
+		AS_LOCK_EXIT(as);
+		mutex_enter(&p->p_lock);
+
+		lxpr_uiobuf_printf(uiobuf,
+		    "\n"
+		    "VmSize:\t%8lu kB\n"
+		    "VmLck:\t%8lu kB\n"
+		    "VmRSS:\t%8lu kB\n"
+		    "VmData:\t%8lu kB\n"
+		    "VmStk:\t%8lu kB\n"
+		    "VmExe:\t%8lu kB\n"
+		    "VmLib:\t%8lu kB",
+		    btok(vsize),
+		    0l,
+		    ptok(rss),
+		    0l,
+		    btok(p->p_stksize),
+		    ptok(rss),
+		    0l);
+	}
+
+	sigemptyset(&current);
+	sigemptyset(&ignore);
+	sigemptyset(&handle);
+
+	for (i = 1; i < NSIG; i++) {
+		lx_sig = lxpr_sigmap[i];
+
+		if ((lx_sig > 0) && (lx_sig <= LX_NSIG)) {
+			if (sigismember(&p->p_sig, i))
+				sigaddset(&current, lx_sig);
+
+			if (up->u_signal[i - 1] == SIG_IGN)
+				sigaddset(&ignore, lx_sig);
+			else if (up->u_signal[i - 1] != SIG_DFL)
+				sigaddset(&handle, lx_sig);
+		}
+	}
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "\n"
+	    "SigPnd:\t%08x%08x\n"
+	    "SigBlk:\t%08x%08x\n"
+	    "SigIgn:\t%08x%08x\n"
+	    "SigCgt:\t%08x%08x\n"
+	    "CapInh:\t%016x\n"
+	    "CapPrm:\t%016x\n"
+	    "CapEff:\t%016x\n",
+	    current.__sigbits[1], current.__sigbits[0],
+	    0, 0, /* signals blocked on per thread basis */
+	    ignore.__sigbits[1], ignore.__sigbits[0],
+	    handle.__sigbits[1], handle.__sigbits[0],
+	    /* Can't do anything with linux capabilities */
+	    0,
+	    0,
+	    0);
+
+	lxpr_unlock(p);
+}
+
+
+/*
+ * lxpr_read_pid_stat(): pid stat file
+ */
+static void
+lxpr_read_pid_stat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	proc_t *p;
+	kthread_t *t;
+	struct as *as;
+	char stat;
+	pid_t pid, ppid, pgpid, spid;
+	gid_t psgid;
+	dev_t psdev;
+	size_t rss, vsize;
+	int nice, pri;
+	caddr_t wchan;
+	processorid_t cpu;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_STAT);
+
+	p = lxpr_lock(lxpnp->lxpr_pid);
+	if (p == NULL) {
+		lxpr_uiobuf_seterr(uiobuf, EINVAL);
+		return;
+	}
+
+	pid = p->p_pid;
+
+	/*
+	 * Set Linux defaults if we're the zone's init process
+	 */
+	if (pid == curproc->p_zone->zone_proc_initpid) {
+		pid = 1;		/* PID for init */
+		ppid = 0;		/* parent PID for init is 0 */
+		pgpid = 0;		/* process group for init is 0 */
+		psgid = (gid_t)-1;	/* credential GID for init is -1 */
+		spid = 0;		/* session id for init is 0 */
+		psdev = 0;		/* session device for init is 0 */
+	} else {
+		/*
+		 * Make sure not to reference parent PIDs that reside outside
+		 * the zone
+		 */
+		ppid = ((p->p_flag & SZONETOP) ?
+		    curproc->p_zone->zone_zsched->p_pid : p->p_ppid);
+
+		/*
+		 * Convert ppid to the Linux default of 1 if our parent is the
+		 * zone's init process
+		 */
+		if (ppid == curproc->p_zone->zone_proc_initpid)
+			ppid = 1;
+
+		pgpid = p->p_pgrp;
+
+		mutex_enter(&p->p_splock);
+		mutex_enter(&p->p_sessp->s_lock);
+		spid = p->p_sessp->s_sid;
+		psdev = p->p_sessp->s_dev;
+		if (p->p_sessp->s_cred)
+			psgid = crgetgid(p->p_sessp->s_cred);
+		else
+			psgid = crgetgid(p->p_cred);
+
+		mutex_exit(&p->p_sessp->s_lock);
+		mutex_exit(&p->p_splock);
+	}
+
+	t = prchoose(p);
+	if (t != NULL) {
+		switch (t->t_state) {
+		case TS_SLEEP:
+			stat = 'S'; break;
+		case TS_RUN:
+		case TS_ONPROC:
+			stat = 'R'; break;
+		case TS_ZOMB:
+			stat = 'Z'; break;
+		case TS_STOPPED:
+			stat = 'T'; break;
+		default:
+			stat = '!'; break;
+		}
+
+		if (CL_DONICE(t, NULL, 0, &nice) != 0)
+			nice = 0;
+
+		pri = t->t_pri;
+		wchan = t->t_wchan;
+		cpu = t->t_cpu->cpu_id;
+		thread_unlock(t);
+	} else {
+		/* Only zombies have no threads */
+		stat = 'Z';
+		nice = 0;
+		pri = 0;
+		wchan = 0;
+		cpu = 0;
+	}
+	as = p->p_as;
+	mutex_exit(&p->p_lock);
+	AS_LOCK_ENTER(as, RW_READER);
+	vsize = as->a_resvsize;
+	rss = rm_asrss(as);
+	AS_LOCK_EXIT(as);
+	mutex_enter(&p->p_lock);
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%d (%s) %c %d %d %d %d %d "
+	    "%lu %lu %lu %lu %lu "
+	    "%lu %lu %ld %ld "
+	    "%d %d %d "
+	    "%lu "
+	    "%lu "
+	    "%lu %ld %llu "
+	    "%lu %lu %u "
+	    "%lu %lu "
+	    "%lu %lu %lu %lu "
+	    "%lu "
+	    "%lu %lu "
+	    "%d "
+	    "%d"
+	    "\n",
+	    pid, PTOU(p)->u_comm, stat, ppid, pgpid, spid, psdev, psgid,
+	    0l, 0l, 0l, 0l, 0l, /* flags, minflt, cminflt, majflt, cmajflt */
+	    p->p_utime, p->p_stime, p->p_cutime, p->p_cstime,
+	    pri, nice, p->p_lwpcnt,
+	    0l, /* itrealvalue (time before next SIGALRM) */
+	    PTOU(p)->u_ticks,
+	    vsize, rss, p->p_vmem_ctl,
+	    0l, 0l, USRSTACK, /* startcode, endcode, startstack */
+	    0l, 0l, /* kstkesp, kstkeip */
+	    0l, 0l, 0l, 0l, /* signal, blocked, sigignore, sigcatch */
+	    wchan,
+	    0l, 0l, /* nswap, cnswap */
+	    0, /* exit_signal */
+	    cpu);
+
+	lxpr_unlock(p);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_arp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_dev(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_printf(uiobuf, "Inter-|   Receive                   "
+	    "                             |  Transmit\n");
+	lxpr_uiobuf_printf(uiobuf, " face |bytes    packets errs drop fifo"
+	    " frame compressed multicast|bytes    packets errs drop fifo"
+	    " colls carrier compressed\n");
+
+	/*
+	 * Data about each interface should go here, but that shouldn't be added
+	 * unless there is an lxproc reader that actually makes use of it (and
+	 * doesn't need anything else that we refuse to provide)...
+	 */
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_dev_mcast(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_igmp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_ip_mr_cache(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_ip_mr_vif(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_mcfilter(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_netstat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_raw(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_route(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_rpc(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_rt_cache(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_sockstat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_snmp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_stat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_tcp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_udp(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_net_unix(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+}
+
+/*
+ * lxpr_read_kmsg(): read the contents of the kernel message queue. We
+ * translate this into the reception of console messages for this zone; each
+ * read copies out a single zone console message, or blocks until the next one
+ * is produced.
+ */
+
+#define	LX_KMSG_PRI	"<0>"
+
+static void
+lxpr_read_kmsg(lxpr_node_t *lxpnp, struct lxpr_uiobuf *uiobuf, ldi_handle_t lh)
+{
+	mblk_t		*mp;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_KMSG);
+
+	if (ldi_getmsg(lh, &mp, NULL) == 0) {
+		/*
+		 * lxproc doesn't like successive reads to the same file
+		 * descriptor unless we do an explicit rewind each time.
+		 */
+		lxpr_uiobuf_seek(uiobuf, 0);
+
+		lxpr_uiobuf_printf(uiobuf, "%s%s", LX_KMSG_PRI,
+		    mp->b_cont->b_rptr);
+
+		freemsg(mp);
+	}
+}
+
+/*
+ * lxpr_read_loadavg(): read the contents of the "loadavg" file.  We do just
+ * enough for uptime and other simple lxproc readers to work
+ */
+extern int nthread;
+
+static void
+lxpr_read_loadavg(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ulong_t avenrun1;
+	ulong_t avenrun5;
+	ulong_t avenrun15;
+	ulong_t avenrun1_cs;
+	ulong_t avenrun5_cs;
+	ulong_t avenrun15_cs;
+	int loadavg[3];
+	int *loadbuf;
+	cpupart_t *cp;
+	zone_t *zone = LXPTOZ(lxpnp);
+
+	uint_t nrunnable = 0;
+	rctl_qty_t nlwps;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_LOADAVG);
+
+	mutex_enter(&cpu_lock);
+
+	/*
+	 * Need to add up values over all CPU partitions. If pools are active,
+	 * only report the values of the zone's partition, which by definition
+	 * includes the current CPU.
+	 */
+	if (pool_pset_enabled()) {
+		psetid_t psetid = zone_pset_get(curproc->p_zone);
+
+		ASSERT(curproc->p_zone != &zone0);
+		cp = CPU->cpu_part;
+
+		nrunnable = cp->cp_nrunning + cp->cp_nrunnable;
+		(void) cpupart_get_loadavg(psetid, &loadavg[0], 3);
+		loadbuf = &loadavg[0];
+	} else {
+		cp = cp_list_head;
+		do {
+			nrunnable += cp->cp_nrunning + cp->cp_nrunnable;
+		} while ((cp = cp->cp_next) != cp_list_head);
+
+		loadbuf = zone == global_zone ?
+		    &avenrun[0] : zone->zone_avenrun;
+	}
+
+	/*
+	 * If we're in the non-global zone, we'll report the total number of
+	 * LWPs in the zone for the "nproc" parameter of /proc/loadavg,
+	 * otherwise will just use nthread (which will include kernel threads,
+	 * but should be good enough for lxproc).
+	 */
+	nlwps = zone == global_zone ? nthread : zone->zone_nlwps;
+
+	mutex_exit(&cpu_lock);
+
+	avenrun1 = loadbuf[0] >> FSHIFT;
+	avenrun1_cs = ((loadbuf[0] & (FSCALE-1)) * 100) >> FSHIFT;
+	avenrun5 = loadbuf[1] >> FSHIFT;
+	avenrun5_cs = ((loadbuf[1] & (FSCALE-1)) * 100) >> FSHIFT;
+	avenrun15 = loadbuf[2] >> FSHIFT;
+	avenrun15_cs = ((loadbuf[2] & (FSCALE-1)) * 100) >> FSHIFT;
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%ld.%02d %ld.%02d %ld.%02d %d/%d %d\n",
+	    avenrun1, avenrun1_cs,
+	    avenrun5, avenrun5_cs,
+	    avenrun15, avenrun15_cs,
+	    nrunnable, nlwps, 0);
+}
+
+/*
+ * lxpr_read_meminfo(): read the contents of the "meminfo" file.
+ */
+static void
+lxpr_read_meminfo(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	zone_t *zone = LXPTOZ(lxpnp);
+	int global = zone == global_zone;
+	ulong_t total_mem, free_mem, total_swap, used_swap;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_MEMINFO);
+
+	zone_get_physmem_data(zone->zone_id, (pgcnt_t *)&total_mem,
+	    (pgcnt_t *)&free_mem);
+	total_mem = ptob(total_mem);
+	free_mem = ptob(free_mem);
+
+	if (global || zone->zone_max_swap_ctl == UINT64_MAX) {
+		total_swap = ptob(k_anoninfo.ani_max);
+		used_swap = ptob(k_anoninfo.ani_phys_resv);
+	} else {
+		mutex_enter(&zone->zone_mem_lock);
+		total_swap = zone->zone_max_swap_ctl;
+		used_swap = zone->zone_max_swap;
+		mutex_exit(&zone->zone_mem_lock);
+	}
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "        total:     used:    free:  shared: buffers:  cached:\n"
+	    "Mem:  %8lu %8lu %8lu %8u %8u %8u\n"
+	    "Swap: %8lu %8lu %8lu\n"
+	    "MemTotal:  %8lu kB\n"
+	    "MemFree:   %8lu kB\n"
+	    "MemShared: %8u kB\n"
+	    "Buffers:   %8u kB\n"
+	    "Cached:    %8u kB\n"
+	    "SwapCached:%8u kB\n"
+	    "Active:    %8u kB\n"
+	    "Inactive:  %8u kB\n"
+	    "HighTotal: %8u kB\n"
+	    "HighFree:  %8u kB\n"
+	    "LowTotal:  %8u kB\n"
+	    "LowFree:   %8u kB\n"
+	    "SwapTotal: %8lu kB\n"
+	    "SwapFree:  %8lu kB\n",
+	    total_mem, total_mem - free_mem, free_mem, 0, 0, 0,
+	    total_swap, used_swap, total_swap - used_swap,
+	    btok(total_mem),				/* MemTotal */
+	    btok(free_mem),				/* MemFree */
+	    0,						/* MemShared */
+	    0,						/* Buffers */
+	    0,						/* Cached */
+	    0,						/* SwapCached */
+	    0,						/* Active */
+	    0,						/* Inactive */
+	    0,						/* HighTotal */
+	    0,						/* HighFree */
+	    btok(total_mem),				/* LowTotal */
+	    btok(free_mem),				/* LowFree */
+	    btok(total_swap),				/* SwapTotal */
+	    btok(total_swap - used_swap));		/* SwapFree */
+}
+
+/*
+ * lxpr_read_mounts():
+ */
+/* ARGSUSED */
+static void
+lxpr_read_mounts(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	struct vfs *vfsp;
+	struct vfs *vfslist;
+	zone_t *zone = LXPTOZ(lxpnp);
+	struct print_data {
+		refstr_t *vfs_mntpt;
+		refstr_t *vfs_resource;
+		uint_t vfs_flag;
+		int vfs_fstype;
+		struct print_data *next;
+	} *print_head = NULL;
+	struct print_data **print_tail = &print_head;
+	struct print_data *printp;
+
+	vfs_list_read_lock();
+
+	if (zone == global_zone) {
+		vfsp = vfslist = rootvfs;
+	} else {
+		vfsp = vfslist = zone->zone_vfslist;
+		/*
+		 * If the zone has a root entry, it will be the first in
+		 * the list.  If it doesn't, we conjure one up.
+		 */
+		if (vfslist == NULL || strcmp(refstr_value(vfsp->vfs_mntpt),
+		    zone->zone_rootpath) != 0) {
+			struct vfs *tvfsp;
+			/*
+			 * The root of the zone is not a mount point.  The vfs
+			 * we want to report is that of the zone's root vnode.
+			 */
+			tvfsp = zone->zone_rootvp->v_vfsp;
+
+			lxpr_uiobuf_printf(uiobuf,
+			    "/ / %s %s 0 0\n",
+			    vfssw[tvfsp->vfs_fstype].vsw_name,
+			    tvfsp->vfs_flag & VFS_RDONLY ? "ro" : "rw");
+
+		}
+		if (vfslist == NULL) {
+			vfs_list_unlock();
+			return;
+		}
+	}
+
+	/*
+	 * Later on we have to do a lookupname, which can end up causing
+	 * another vfs_list_read_lock() to be called. Which can lead to a
+	 * deadlock. To avoid this, we extract the data we need into a local
+	 * list, then we can run this list without holding vfs_list_read_lock()
+	 * We keep the list in the same order as the vfs_list
+	 */
+	do {
+		/* Skip mounts we shouldn't show */
+		if (vfsp->vfs_flag & VFS_NOMNTTAB) {
+			goto nextfs;
+		}
+
+		printp = kmem_alloc(sizeof (*printp), KM_SLEEP);
+		refstr_hold(vfsp->vfs_mntpt);
+		printp->vfs_mntpt = vfsp->vfs_mntpt;
+		refstr_hold(vfsp->vfs_resource);
+		printp->vfs_resource = vfsp->vfs_resource;
+		printp->vfs_flag = vfsp->vfs_flag;
+		printp->vfs_fstype = vfsp->vfs_fstype;
+		printp->next = NULL;
+
+		*print_tail = printp;
+		print_tail = &printp->next;
+
+nextfs:
+		vfsp = (zone == global_zone) ?
+		    vfsp->vfs_next : vfsp->vfs_zone_next;
+
+	} while (vfsp != vfslist);
+
+	vfs_list_unlock();
+
+	/*
+	 * now we can run through what we've extracted without holding
+	 * vfs_list_read_lock()
+	 */
+	printp = print_head;
+	while (printp != NULL) {
+		struct print_data *printp_next;
+		const char *resource;
+		char *mntpt;
+		struct vnode *vp;
+		int error;
+
+		mntpt = (char *)refstr_value(printp->vfs_mntpt);
+		resource = refstr_value(printp->vfs_resource);
+
+		if (mntpt != NULL && mntpt[0] != '\0')
+			mntpt = ZONE_PATH_TRANSLATE(mntpt, zone);
+		else
+			mntpt = "-";
+
+		error = lookupname(mntpt, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp);
+
+		if (error != 0)
+			goto nextp;
+
+		if (!(vp->v_flag & VROOT)) {
+			VN_RELE(vp);
+			goto nextp;
+		}
+		VN_RELE(vp);
+
+		if (resource != NULL && resource[0] != '\0') {
+			if (resource[0] == '/') {
+				resource = ZONE_PATH_VISIBLE(resource, zone) ?
+				    ZONE_PATH_TRANSLATE(resource, zone) :
+				    mntpt;
+			}
+		} else {
+			resource = "-";
+		}
+
+		lxpr_uiobuf_printf(uiobuf,
+		    "%s %s %s %s 0 0\n",
+		    resource, mntpt, vfssw[printp->vfs_fstype].vsw_name,
+		    printp->vfs_flag & VFS_RDONLY ? "ro" : "rw");
+
+nextp:
+		printp_next = printp->next;
+		refstr_rele(printp->vfs_mntpt);
+		refstr_rele(printp->vfs_resource);
+		kmem_free(printp, sizeof (*printp));
+		printp = printp_next;
+
+	}
+}
+
+/*
+ * lxpr_read_partitions():
+ *
+ * We don't support partitions in a local zone because it requires access to
+ * physical devices.  But we need to fake up enough of the file to show that we
+ * have no partitions.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_partitions(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_printf(uiobuf,
+	    "major minor  #blocks  name     rio rmerge rsect ruse "
+	    "wio wmerge wsect wuse running use aveq\n\n");
+}
+
+/*
+ * lxpr_read_version(): read the contents of the "version" file.  Note that
+ * we don't lie here -- we don't pretend that we're Linux.  If lxproc is to
+ * be used in a Linux-branded zone, there will need to be a mount option to
+ * indicate that Linux should be more fully mimicked.
+ */
+/* ARGSUSED */
+static void
+lxpr_read_version(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	lxpr_uiobuf_printf(uiobuf,
+	    "%s version %s (%s version %d.%d.%d) "
+	    "#%s SMP %s\n",
+	    utsname.sysname, utsname.release,
+#if defined(__GNUC__)
+	    "gcc",
+	    __GNUC__,
+	    __GNUC_MINOR__,
+	    __GNUC_PATCHLEVEL__,
+#else
+	    "Sun C",
+	    __SUNPRO_C / 0x100,
+	    (__SUNPRO_C & 0xff) / 0x10,
+	    __SUNPRO_C & 0xf,
+#endif
+	    utsname.version,
+	    "00:00:00 00/00/00");
+}
+
+/*
+ * lxpr_read_stat(): read the contents of the "stat" file.
+ *
+ */
+/* ARGSUSED */
+static void
+lxpr_read_stat(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	cpu_t *cp, *cpstart;
+	int pools_enabled;
+	ulong_t idle_cum = 0;
+	ulong_t sys_cum  = 0;
+	ulong_t user_cum = 0;
+	ulong_t irq_cum = 0;
+	ulong_t cpu_nrunnable_cum = 0;
+	ulong_t w_io_cum = 0;
+
+	ulong_t pgpgin_cum    = 0;
+	ulong_t pgpgout_cum   = 0;
+	ulong_t pgswapout_cum = 0;
+	ulong_t pgswapin_cum  = 0;
+	ulong_t intr_cum = 0;
+	ulong_t pswitch_cum = 0;
+	ulong_t forks_cum = 0;
+	hrtime_t msnsecs[NCMSTATES];
+
+	/* temporary variable since scalehrtime modifies data in place */
+	hrtime_t tmptime;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_STAT);
+
+	mutex_enter(&cpu_lock);
+	pools_enabled = pool_pset_enabled();
+
+	/* Calculate cumulative stats */
+	cp = cpstart = CPU->cpu_part->cp_cpulist;
+	do {
+		int i;
+
+		/*
+		 * Don't count CPUs that aren't even in the system
+		 * or aren't up yet.
+		 */
+		if ((cp->cpu_flags & CPU_EXISTS) == 0) {
+			continue;
+		}
+
+		get_cpu_mstate(cp, msnsecs);
+
+		idle_cum += NSEC_TO_TICK(msnsecs[CMS_IDLE]);
+		sys_cum  += NSEC_TO_TICK(msnsecs[CMS_SYSTEM]);
+		user_cum += NSEC_TO_TICK(msnsecs[CMS_USER]);
+
+		pgpgin_cum += CPU_STATS(cp, vm.pgpgin);
+		pgpgout_cum += CPU_STATS(cp, vm.pgpgout);
+		pgswapin_cum += CPU_STATS(cp, vm.pgswapin);
+		pgswapout_cum += CPU_STATS(cp, vm.pgswapout);
+
+		cpu_nrunnable_cum += cp->cpu_disp->disp_nrunnable;
+		w_io_cum += CPU_STATS(cp, sys.iowait);
+		for (i = 0; i < NCMSTATES; i++) {
+			tmptime = cp->cpu_intracct[i];
+			scalehrtime(&tmptime);
+			irq_cum += NSEC_TO_TICK(tmptime);
+		}
+
+		for (i = 0; i < PIL_MAX; i++)
+			intr_cum += CPU_STATS(cp, sys.intr[i]);
+
+		pswitch_cum += CPU_STATS(cp, sys.pswitch);
+		forks_cum += CPU_STATS(cp, sys.sysfork);
+		forks_cum += CPU_STATS(cp, sys.sysvfork);
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+
+	lxpr_uiobuf_printf(uiobuf, "cpu %lu %lu %lu %lu %lu %lu %lu\n",
+	    user_cum, 0L, sys_cum, idle_cum, 0L, irq_cum, 0L);
+
+	/* Do per processor stats */
+	do {
+		int i;
+
+		ulong_t idle_ticks;
+		ulong_t sys_ticks;
+		ulong_t user_ticks;
+		ulong_t irq_ticks = 0;
+
+		/*
+		 * Don't count CPUs that aren't even in the system
+		 * or aren't up yet.
+		 */
+		if ((cp->cpu_flags & CPU_EXISTS) == 0) {
+			continue;
+		}
+
+		get_cpu_mstate(cp, msnsecs);
+
+		idle_ticks = NSEC_TO_TICK(msnsecs[CMS_IDLE]);
+		sys_ticks  = NSEC_TO_TICK(msnsecs[CMS_SYSTEM]);
+		user_ticks = NSEC_TO_TICK(msnsecs[CMS_USER]);
+
+		for (i = 0; i < NCMSTATES; i++) {
+			tmptime = cp->cpu_intracct[i];
+			scalehrtime(&tmptime);
+			irq_ticks += NSEC_TO_TICK(tmptime);
+		}
+
+		lxpr_uiobuf_printf(uiobuf,
+		    "cpu%d %lu %lu %lu %lu %lu %lu %lu\n",
+		    cp->cpu_id, user_ticks, 0L, sys_ticks, idle_ticks,
+		    0L, irq_ticks, 0L);
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+
+	mutex_exit(&cpu_lock);
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "page %lu %lu\n"
+	    "swap %lu %lu\n"
+	    "intr %lu\n"
+	    "ctxt %lu\n"
+	    "btime %lu\n"
+	    "processes %lu\n"
+	    "procs_running %lu\n"
+	    "procs_blocked %lu\n",
+	    pgpgin_cum, pgpgout_cum,
+	    pgswapin_cum, pgswapout_cum,
+	    intr_cum,
+	    pswitch_cum,
+	    boot_time,
+	    forks_cum,
+	    cpu_nrunnable_cum,
+	    w_io_cum);
+}
+
+/*
+ * lxpr_read_uptime(): read the contents of the "uptime" file.
+ *
+ * format is: "%.2lf, %.2lf",uptime_secs, idle_secs
+ * Use fixed point arithmetic to get 2 decimal places
+ */
+/* ARGSUSED */
+static void
+lxpr_read_uptime(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	cpu_t *cp, *cpstart;
+	int pools_enabled;
+	ulong_t idle_cum = 0;
+	ulong_t cpu_count = 0;
+	ulong_t idle_s;
+	ulong_t idle_cs;
+	ulong_t up_s;
+	ulong_t up_cs;
+	hrtime_t birthtime;
+	hrtime_t centi_sec = 10000000;  /* 10^7 */
+
+	ASSERT(lxpnp->lxpr_type == LXPR_UPTIME);
+
+	/* Calculate cumulative stats */
+	mutex_enter(&cpu_lock);
+	pools_enabled = pool_pset_enabled();
+
+	cp = cpstart = CPU->cpu_part->cp_cpulist;
+	do {
+		/*
+		 * Don't count CPUs that aren't even in the system
+		 * or aren't up yet.
+		 */
+		if ((cp->cpu_flags & CPU_EXISTS) == 0) {
+			continue;
+		}
+
+		idle_cum += CPU_STATS(cp, sys.cpu_ticks_idle);
+		idle_cum += CPU_STATS(cp, sys.cpu_ticks_wait);
+		cpu_count += 1;
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+	mutex_exit(&cpu_lock);
+
+	/* Getting the Zone zsched process startup time */
+	birthtime = LXPTOZ(lxpnp)->zone_zsched->p_mstart;
+	up_cs = (gethrtime() - birthtime) / centi_sec;
+	up_s = up_cs / 100;
+	up_cs %= 100;
+
+	ASSERT(cpu_count > 0);
+	idle_cum /= cpu_count;
+	idle_s = idle_cum / hz;
+	idle_cs = idle_cum % hz;
+	idle_cs *= 100;
+	idle_cs /= hz;
+
+	lxpr_uiobuf_printf(uiobuf,
+	    "%ld.%02d %ld.%02d\n", up_s, up_cs, idle_s, idle_cs);
+}
+
+static const char *amd_x_edx[] = {
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	NULL,	NULL,	"syscall",
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	NULL,	NULL,	"mp",
+	"nx",	NULL,	"mmxext", NULL,
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	"lm",	"3dnowext", "3dnow"
+};
+
+static const char *amd_x_ecx[] = {
+	"lahf_lm", NULL, "svm", NULL,
+	"altmovcr8"
+};
+
+static const char *tm_x_edx[] = {
+	"recovery", "longrun", NULL, "lrti"
+};
+
+/*
+ * Intel calls no-execute "xd" in its docs, but Linux still reports it as "nx."
+ */
+static const char *intc_x_edx[] = {
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	NULL,	NULL,	"syscall",
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	NULL,	NULL,	NULL,
+	"nx",	NULL,	NULL,   NULL,
+	NULL,	NULL,	NULL,	NULL,
+	NULL,	"lm",   NULL,   NULL
+};
+
+static const char *intc_edx[] = {
+	"fpu",	"vme",	"de",	"pse",
+	"tsc",	"msr",	"pae",	"mce",
+	"cx8",	"apic",	 NULL,	"sep",
+	"mtrr",	"pge",	"mca",	"cmov",
+	"pat",	"pse36", "pn",	"clflush",
+	NULL,	"dts",	"acpi",	"mmx",
+	"fxsr",	"sse",	"sse2",	"ss",
+	"ht",	"tm",	"ia64",	"pbe"
+};
+
+/*
+ * "sse3" on linux is called "pni" (Prescott New Instructions).
+ */
+static const char *intc_ecx[] = {
+	"pni",	NULL,	NULL, "monitor",
+	"ds_cpl", NULL,	NULL, "est",
+	"tm2",	NULL,	"cid", NULL,
+	NULL,	"cx16",	"xtpr"
+};
+
+static void
+lxpr_read_cpuinfo(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	int i;
+	uint32_t bits;
+	cpu_t *cp, *cpstart;
+	int pools_enabled;
+	const char **fp;
+	char brandstr[CPU_IDSTRLEN];
+	struct cpuid_regs cpr;
+	int maxeax;
+	int std_ecx, std_edx, ext_ecx, ext_edx;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_CPUINFO);
+
+	mutex_enter(&cpu_lock);
+	pools_enabled = pool_pset_enabled();
+
+	cp = cpstart = CPU->cpu_part->cp_cpulist;
+	do {
+		/*
+		 * This returns the maximum eax value for standard cpuid
+		 * functions in eax.
+		 */
+		cpr.cp_eax = 0;
+		(void) cpuid_insn(cp, &cpr);
+		maxeax = cpr.cp_eax;
+
+		/*
+		 * Get standard x86 feature flags.
+		 */
+		cpr.cp_eax = 1;
+		(void) cpuid_insn(cp, &cpr);
+		std_ecx = cpr.cp_ecx;
+		std_edx = cpr.cp_edx;
+
+		/*
+		 * Now get extended feature flags.
+		 */
+		cpr.cp_eax = 0x80000001;
+		(void) cpuid_insn(cp, &cpr);
+		ext_ecx = cpr.cp_ecx;
+		ext_edx = cpr.cp_edx;
+
+		(void) cpuid_getbrandstr(cp, brandstr, CPU_IDSTRLEN);
+
+		lxpr_uiobuf_printf(uiobuf,
+		    "processor\t: %d\n"
+		    "vendor_id\t: %s\n"
+		    "cpu family\t: %d\n"
+		    "model\t\t: %d\n"
+		    "model name\t: %s\n"
+		    "stepping\t: %d\n"
+		    "cpu MHz\t\t: %u.%03u\n",
+		    cp->cpu_id, cpuid_getvendorstr(cp), cpuid_getfamily(cp),
+		    cpuid_getmodel(cp), brandstr, cpuid_getstep(cp),
+		    (uint32_t)(cpu_freq_hz / 1000000),
+		    ((uint32_t)(cpu_freq_hz / 1000)) % 1000);
+
+		lxpr_uiobuf_printf(uiobuf, "cache size\t: %u KB\n",
+		    getl2cacheinfo(cp, NULL, NULL, NULL) / 1024);
+
+		if (is_x86_feature(x86_featureset, X86FSET_HTT)) {
+			/*
+			 * 'siblings' is used for HT-style threads
+			 */
+			lxpr_uiobuf_printf(uiobuf,
+			    "physical id\t: %lu\n"
+			    "siblings\t: %u\n",
+			    pg_plat_hw_instance_id(cp, PGHW_CHIP),
+			    cpuid_get_ncpu_per_chip(cp));
+		}
+
+		/*
+		 * Since we're relatively picky about running on older hardware,
+		 * we can be somewhat cavalier about the answers to these ones.
+		 *
+		 * In fact, given the hardware we support, we just say:
+		 *
+		 *	fdiv_bug	: no	(if we're on a 64-bit kernel)
+		 *	hlt_bug		: no
+		 *	f00f_bug	: no
+		 *	coma_bug	: no
+		 *	wp		: yes	(write protect in supervsr mode)
+		 */
+		lxpr_uiobuf_printf(uiobuf,
+		    "fdiv_bug\t: %s\n"
+		    "hlt_bug \t: no\n"
+		    "f00f_bug\t: no\n"
+		    "coma_bug\t: no\n"
+		    "fpu\t\t: %s\n"
+		    "fpu_exception\t: %s\n"
+		    "cpuid level\t: %d\n"
+		    "flags\t\t:",
+#if defined(__i386)
+		    fpu_pentium_fdivbug ? "yes" : "no",
+#else
+		    "no",
+#endif /* __i386 */
+		    fpu_exists ? "yes" : "no", fpu_exists ? "yes" : "no",
+		    maxeax);
+
+		for (bits = std_edx, fp = intc_edx, i = 0;
+		    i < sizeof (intc_edx) / sizeof (intc_edx[0]); fp++, i++)
+			if ((bits & (1 << i)) != 0 && *fp)
+				lxpr_uiobuf_printf(uiobuf, " %s", *fp);
+
+		/*
+		 * name additional features where appropriate
+		 */
+		switch (x86_vendor) {
+		case X86_VENDOR_Intel:
+			for (bits = ext_edx, fp = intc_x_edx, i = 0;
+			    i < sizeof (intc_x_edx) / sizeof (intc_x_edx[0]);
+			    fp++, i++)
+				if ((bits & (1 << i)) != 0 && *fp)
+					lxpr_uiobuf_printf(uiobuf, " %s", *fp);
+			break;
+
+		case X86_VENDOR_AMD:
+			for (bits = ext_edx, fp = amd_x_edx, i = 0;
+			    i < sizeof (amd_x_edx) / sizeof (amd_x_edx[0]);
+			    fp++, i++)
+				if ((bits & (1 << i)) != 0 && *fp)
+					lxpr_uiobuf_printf(uiobuf, " %s", *fp);
+
+			for (bits = ext_ecx, fp = amd_x_ecx, i = 0;
+			    i < sizeof (amd_x_ecx) / sizeof (amd_x_ecx[0]);
+			    fp++, i++)
+				if ((bits & (1 << i)) != 0 && *fp)
+					lxpr_uiobuf_printf(uiobuf, " %s", *fp);
+			break;
+
+		case X86_VENDOR_TM:
+			for (bits = ext_edx, fp = tm_x_edx, i = 0;
+			    i < sizeof (tm_x_edx) / sizeof (tm_x_edx[0]);
+			    fp++, i++)
+				if ((bits & (1 << i)) != 0 && *fp)
+					lxpr_uiobuf_printf(uiobuf, " %s", *fp);
+			break;
+		default:
+			break;
+		}
+
+		for (bits = std_ecx, fp = intc_ecx, i = 0;
+		    i < sizeof (intc_ecx) / sizeof (intc_ecx[0]); fp++, i++)
+			if ((bits & (1 << i)) != 0 && *fp)
+				lxpr_uiobuf_printf(uiobuf, " %s", *fp);
+
+		lxpr_uiobuf_printf(uiobuf, "\n\n");
+
+		if (pools_enabled)
+			cp = cp->cpu_next_part;
+		else
+			cp = cp->cpu_next;
+	} while (cp != cpstart);
+
+	mutex_exit(&cpu_lock);
+}
+
+/* ARGSUSED */
+static void
+lxpr_read_fd(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_FD_FD);
+	lxpr_uiobuf_seterr(uiobuf, EFAULT);
+}
+
+/*
+ * lxpr_getattr(): Vnode operation for VOP_GETATTR()
+ */
+static int
+lxpr_getattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	register lxpr_node_t *lxpnp = VTOLXP(vp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	extern uint_t nproc;
+	int error;
+
+	/*
+	 * Return attributes of underlying vnode if ATTR_REAL
+	 *
+	 * but keep fd files with the symlink permissions
+	 */
+	if (lxpnp->lxpr_realvp != NULL && (flags & ATTR_REAL)) {
+		vnode_t *rvp = lxpnp->lxpr_realvp;
+
+		/*
+		 * withold attribute information to owner or root
+		 */
+		if ((error = VOP_ACCESS(rvp, 0, 0, cr, ct)) != 0) {
+			return (error);
+		}
+
+		/*
+		 * now its attributes
+		 */
+		if ((error = VOP_GETATTR(rvp, vap, flags, cr, ct)) != 0) {
+			return (error);
+		}
+
+		/*
+		 * if it's a file in lx /proc/pid/fd/xx then set its
+		 * mode and keep it looking like a symlink
+		 */
+		if (type == LXPR_PID_FD_FD) {
+			vap->va_mode = lxpnp->lxpr_mode;
+			vap->va_type = vp->v_type;
+			vap->va_size = 0;
+			vap->va_nlink = 1;
+		}
+		return (0);
+	}
+
+	/* Default attributes, that may be overridden below */
+	bzero(vap, sizeof (*vap));
+	vap->va_atime = vap->va_mtime = vap->va_ctime = lxpnp->lxpr_time;
+	vap->va_nlink = 1;
+	vap->va_type = vp->v_type;
+	vap->va_mode = lxpnp->lxpr_mode;
+	vap->va_fsid = vp->v_vfsp->vfs_dev;
+	vap->va_blksize = DEV_BSIZE;
+	vap->va_uid = lxpnp->lxpr_uid;
+	vap->va_gid = lxpnp->lxpr_gid;
+	vap->va_nodeid = lxpnp->lxpr_ino;
+
+	switch (type) {
+	case LXPR_PROCDIR:
+		vap->va_nlink = nproc + 2 + PROCDIRFILES;
+		vap->va_size = (nproc + 2 + PROCDIRFILES) * LXPR_SDSIZE;
+		break;
+	case LXPR_PIDDIR:
+		vap->va_nlink = PIDDIRFILES;
+		vap->va_size = PIDDIRFILES * LXPR_SDSIZE;
+		break;
+	case LXPR_SELF:
+		vap->va_uid = crgetruid(curproc->p_cred);
+		vap->va_gid = crgetrgid(curproc->p_cred);
+		break;
+	default:
+		break;
+	}
+
+	vap->va_nblocks = (fsblkcnt64_t)btod(vap->va_size);
+	return (0);
+}
+
+/*
+ * lxpr_access(): Vnode operation for VOP_ACCESS()
+ */
+static int
+lxpr_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
+{
+	lxpr_node_t *lxpnp = VTOLXP(vp);
+	int shift = 0;
+	proc_t *tp;
+
+	/* lx /proc is a read only file system */
+	if (mode & VWRITE)
+		return (EROFS);
+
+	/*
+	 * If this is a restricted file, check access permissions.
+	 */
+	switch (lxpnp->lxpr_type) {
+	case LXPR_PIDDIR:
+		return (0);
+	case LXPR_PID_CURDIR:
+	case LXPR_PID_ENV:
+	case LXPR_PID_EXE:
+	case LXPR_PID_MAPS:
+	case LXPR_PID_MEM:
+	case LXPR_PID_ROOTDIR:
+	case LXPR_PID_FDDIR:
+	case LXPR_PID_FD_FD:
+		if ((tp = lxpr_lock(lxpnp->lxpr_pid)) == NULL)
+			return (ENOENT);
+		if (tp != curproc && secpolicy_proc_access(cr) != 0 &&
+		    priv_proc_cred_perm(cr, tp, NULL, mode) != 0) {
+			lxpr_unlock(tp);
+			return (EACCES);
+		}
+		lxpr_unlock(tp);
+	default:
+		break;
+	}
+
+	if (lxpnp->lxpr_realvp != NULL) {
+		/*
+		 * For these we use the underlying vnode's accessibility.
+		 */
+		return (VOP_ACCESS(lxpnp->lxpr_realvp, mode, flags, cr, ct));
+	}
+
+	/* If user is root allow access regardless of permission bits */
+	if (secpolicy_proc_access(cr) == 0)
+		return (0);
+
+	/*
+	 * Access check is based on only one of owner, group, public.  If not
+	 * owner, then check group.  If not a member of the group, then check
+	 * public access.
+	 */
+	if (crgetuid(cr) != lxpnp->lxpr_uid) {
+		shift += 3;
+		if (!groupmember((uid_t)lxpnp->lxpr_gid, cr))
+			shift += 3;
+	}
+
+	mode &= ~(lxpnp->lxpr_mode << shift);
+
+	if (mode == 0)
+		return (0);
+
+	return (EACCES);
+}
+
+/* ARGSUSED */
+static vnode_t *
+lxpr_lookup_not_a_dir(vnode_t *dp, char *comp)
+{
+	return (NULL);
+}
+
+/*
+ * lxpr_lookup(): Vnode operation for VOP_LOOKUP()
+ */
+/* ARGSUSED */
+static int
+lxpr_lookup(vnode_t *dp, char *comp, vnode_t **vpp, pathname_t *pathp,
+    int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
+    int *direntflags, pathname_t *realpnp)
+{
+	lxpr_node_t *lxpnp = VTOLXP(dp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	int error;
+
+	ASSERT(dp->v_type == VDIR);
+	ASSERT(type < LXPR_NFILES);
+
+	/*
+	 * we should never get here because the lookup
+	 * is done on the realvp for these nodes
+	 */
+	ASSERT(type != LXPR_PID_FD_FD &&
+	    type != LXPR_PID_CURDIR &&
+	    type != LXPR_PID_ROOTDIR);
+
+	/*
+	 * restrict lookup permission to owner or root
+	 */
+	if ((error = lxpr_access(dp, VEXEC, 0, cr, ct)) != 0) {
+		return (error);
+	}
+
+	/*
+	 * Just return the parent vnode if that's where we are trying to go.
+	 */
+	if (strcmp(comp, "..") == 0) {
+		VN_HOLD(lxpnp->lxpr_parent);
+		*vpp = lxpnp->lxpr_parent;
+		return (0);
+	}
+
+	/*
+	 * Special handling for directory searches.  Note: null component name
+	 * denotes that the current directory is being searched.
+	 */
+	if ((dp->v_type == VDIR) && (*comp == '\0' || strcmp(comp, ".") == 0)) {
+		VN_HOLD(dp);
+		*vpp = dp;
+		return (0);
+	}
+
+	*vpp = (lxpr_lookup_function[type](dp, comp));
+	return ((*vpp == NULL) ? ENOENT : 0);
+}
+
+/*
+ * Do a sequential search on the given directory table
+ */
+static vnode_t *
+lxpr_lookup_common(vnode_t *dp, char *comp, proc_t *p,
+    lxpr_dirent_t *dirtab, int dirtablen)
+{
+	lxpr_node_t *lxpnp;
+	int count;
+
+	for (count = 0; count < dirtablen; count++) {
+		if (strcmp(dirtab[count].d_name, comp) == 0) {
+			lxpnp = lxpr_getnode(dp, dirtab[count].d_type, p, 0);
+			dp = LXPTOV(lxpnp);
+			ASSERT(dp != NULL);
+			return (dp);
+		}
+	}
+	return (NULL);
+}
+
+static vnode_t *
+lxpr_lookup_piddir(vnode_t *dp, char *comp)
+{
+	proc_t *p;
+
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_PIDDIR);
+
+	p = lxpr_lock(VTOLXP(dp)->lxpr_pid);
+	if (p == NULL)
+		return (NULL);
+
+	dp = lxpr_lookup_common(dp, comp, p, piddir, PIDDIRFILES);
+
+	lxpr_unlock(p);
+
+	return (dp);
+}
+
+/*
+ * Lookup one of the process's open files.
+ */
+static vnode_t *
+lxpr_lookup_fddir(vnode_t *dp, char *comp)
+{
+	lxpr_node_t *dlxpnp = VTOLXP(dp);
+	lxpr_node_t *lxpnp;
+	vnode_t *vp = NULL;
+	proc_t *p;
+	file_t *fp;
+	uint_t fd;
+	int c;
+	uf_entry_t *ufp;
+	uf_info_t *fip;
+
+	ASSERT(dlxpnp->lxpr_type == LXPR_PID_FDDIR);
+
+	/*
+	 * convert the string rendition of the filename
+	 * to a file descriptor
+	 */
+	fd = 0;
+	while ((c = *comp++) != '\0') {
+		int ofd;
+		if (c < '0' || c > '9')
+			return (NULL);
+
+		ofd = fd;
+		fd = 10*fd + c - '0';
+		/* integer overflow */
+		if (fd / 10 != ofd)
+			return (NULL);
+	}
+
+	/*
+	 * get the proc to work with and lock it
+	 */
+	p = lxpr_lock(dlxpnp->lxpr_pid);
+	if ((p == NULL))
+		return (NULL);
+
+	/*
+	 * If the process is a zombie or system process
+	 * it can't have any open files.
+	 */
+	if ((p->p_stat == SZOMB) || (p->p_flag & (SSYS | SEXITING)) ||
+	    (p->p_as == &kas)) {
+		lxpr_unlock(p);
+		return (NULL);
+	}
+
+	/*
+	 * get us a fresh node/vnode
+	 */
+	lxpnp = lxpr_getnode(dp, LXPR_PID_FD_FD, p, fd);
+
+	/*
+	 * Drop p_lock, but keep the process P_PR_LOCK'd to prevent it from
+	 * going away while we dereference into fi_list.
+	 */
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * get open file info
+	 */
+	fip = (&(p)->p_user.u_finfo);
+	mutex_enter(&fip->fi_lock);
+
+	if (fd < fip->fi_nfiles) {
+		UF_ENTER(ufp, fip, fd);
+		/*
+		 * ensure the fd is still kosher.
+		 * it may have gone between the readdir and
+		 * the lookup
+		 */
+		if (fip->fi_list[fd].uf_file == NULL) {
+			mutex_exit(&fip->fi_lock);
+			UF_EXIT(ufp);
+			mutex_enter(&p->p_lock);
+			lxpr_unlock(p);
+			lxpr_freenode(lxpnp);
+			return (NULL);
+		}
+
+		if ((fp = ufp->uf_file) != NULL)
+			vp = fp->f_vnode;
+		UF_EXIT(ufp);
+	}
+	mutex_exit(&fip->fi_lock);
+
+	if (vp == NULL) {
+		mutex_enter(&p->p_lock);
+		lxpr_unlock(p);
+		lxpr_freenode(lxpnp);
+		return (NULL);
+	} else {
+		/*
+		 * Fill in the lxpr_node so future references will be able to
+		 * find the underlying vnode. The vnode is held on the realvp.
+		 */
+		lxpnp->lxpr_realvp = vp;
+		VN_HOLD(lxpnp->lxpr_realvp);
+	}
+
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+	dp = LXPTOV(lxpnp);
+	ASSERT(dp != NULL);
+
+	return (dp);
+}
+
+static vnode_t *
+lxpr_lookup_netdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_NETDIR);
+
+	dp = lxpr_lookup_common(dp, comp, NULL, netdir, NETDIRFILES);
+
+	return (dp);
+}
+
+static vnode_t *
+lxpr_lookup_procdir(vnode_t *dp, char *comp)
+{
+	ASSERT(VTOLXP(dp)->lxpr_type == LXPR_PROCDIR);
+
+	/*
+	 * We know all the names of files & dirs in our file system structure
+	 * except those that are pid names.  These change as pids are created/
+	 * deleted etc., so we just look for a number as the first char to see
+	 * if we are we doing pid lookups.
+	 *
+	 * Don't need to check for "self" as it is implemented as a symlink
+	 */
+	if (*comp >= '0' && *comp <= '9') {
+		pid_t pid = 0;
+		lxpr_node_t *lxpnp = NULL;
+		proc_t *p;
+		int c;
+
+		while ((c = *comp++) != '\0')
+			pid = 10 * pid + c - '0';
+
+		/*
+		 * Can't continue if the process is still loading or it doesn't
+		 * really exist yet (or maybe it just died!)
+		 */
+		p = lxpr_lock(pid);
+		if (p == NULL)
+			return (NULL);
+
+		if (secpolicy_basic_procinfo(CRED(), p, curproc) != 0) {
+			lxpr_unlock(p);
+			return (NULL);
+		}
+
+		/*
+		 * allocate and fill in a new lxpr node
+		 */
+		lxpnp = lxpr_getnode(dp, LXPR_PIDDIR, p, 0);
+
+		lxpr_unlock(p);
+
+		dp = LXPTOV(lxpnp);
+		ASSERT(dp != NULL);
+
+		return (dp);
+	}
+
+	/* Lookup fixed names */
+	return (lxpr_lookup_common(dp, comp, NULL, lxpr_dir, PROCDIRFILES));
+}
+
+/*
+ * lxpr_readdir(): Vnode operation for VOP_READDIR()
+ */
+/* ARGSUSED */
+static int
+lxpr_readdir(vnode_t *dp, uio_t *uiop, cred_t *cr, int *eofp,
+    caller_context_t *ct, int flags)
+{
+	lxpr_node_t *lxpnp = VTOLXP(dp);
+	lxpr_nodetype_t type = lxpnp->lxpr_type;
+	ssize_t uresid;
+	off_t uoffset;
+	int error;
+
+	ASSERT(dp->v_type == VDIR);
+	ASSERT(type < LXPR_NFILES);
+
+	/*
+	 * we should never get here because the readdir
+	 * is done on the realvp for these nodes
+	 */
+	ASSERT(type != LXPR_PID_FD_FD &&
+	    type != LXPR_PID_CURDIR &&
+	    type != LXPR_PID_ROOTDIR);
+
+	/*
+	 * restrict readdir permission to owner or root
+	 */
+	if ((error = lxpr_access(dp, VREAD, 0, cr, ct)) != 0)
+		return (error);
+
+	uoffset = uiop->uio_offset;
+	uresid = uiop->uio_resid;
+
+	/* can't do negative reads */
+	if (uoffset < 0 || uresid <= 0)
+		return (EINVAL);
+
+	/* can't read directory entries that don't exist! */
+	if (uoffset % LXPR_SDSIZE)
+		return (ENOENT);
+
+	return (lxpr_readdir_function[lxpnp->lxpr_type](lxpnp, uiop, eofp));
+}
+
+/* ARGSUSED */
+static int
+lxpr_readdir_not_a_dir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	return (ENOTDIR);
+}
+
+/*
+ * This has the common logic for returning directory entries
+ */
+static int
+lxpr_readdir_common(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp,
+    lxpr_dirent_t *dirtab, int dirtablen)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXPNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+
+	oresid = uiop->uio_resid;
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/*
+	 * Satisfy user request
+	 */
+	while ((uresid = uiop->uio_resid) > 0) {
+		int dirindex;
+		off_t uoffset;
+		int reclen;
+		int error;
+
+		uoffset = uiop->uio_offset;
+		dirindex  = (uoffset / LXPR_SDSIZE) - 2;
+
+		if (uoffset == 0) {
+
+			dirent->d_ino = lxpnp->lxpr_ino;
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '\0';
+			reclen = DIRENT64_RECLEN(1);
+
+		} else if (uoffset == LXPR_SDSIZE) {
+
+			dirent->d_ino = lxpr_parentinode(lxpnp);
+			dirent->d_name[0] = '.';
+			dirent->d_name[1] = '.';
+			dirent->d_name[2] = '\0';
+			reclen = DIRENT64_RECLEN(2);
+
+		} else if (dirindex >= 0 && dirindex < dirtablen) {
+			int slen = strlen(dirtab[dirindex].d_name);
+
+			dirent->d_ino = lxpr_inode(dirtab[dirindex].d_type,
+			    lxpnp->lxpr_pid, 0);
+
+			VERIFY(slen < LXPNSIZ);
+			(void) strcpy(dirent->d_name, dirtab[dirindex].d_name);
+			reclen = DIRENT64_RECLEN(slen);
+
+		} else {
+			/* Run out of table entries */
+			if (eofp) {
+				*eofp = 1;
+			}
+			return (0);
+		}
+
+		dirent->d_off = (off64_t)(uoffset + LXPR_SDSIZE);
+		dirent->d_reclen = (ushort_t)reclen;
+
+		/*
+		 * if the size of the data to transfer is greater
+		 * that that requested then we can't do it this transfer.
+		 */
+		if (reclen > uresid) {
+			/*
+			 * Error if no entries have been returned yet.
+			 */
+			if (uresid == oresid) {
+				return (EINVAL);
+			}
+			break;
+		}
+
+		/*
+		 * uiomove() updates both uiop->uio_resid and uiop->uio_offset
+		 * by the same amount.  But we want uiop->uio_offset to change
+		 * in increments of LXPR_SDSIZE, which is different from the
+		 * number of bytes being returned to the user.  So we set
+		 * uiop->uio_offset separately, ignoring what uiomove() does.
+		 */
+		if ((error = uiomove((caddr_t)dirent, reclen, UIO_READ,
+		    uiop)) != 0)
+			return (error);
+
+		uiop->uio_offset = uoffset + LXPR_SDSIZE;
+	}
+
+	/* Have run out of space, but could have just done last table entry */
+	if (eofp) {
+		*eofp =
+		    (uiop->uio_offset >= ((dirtablen+2) * LXPR_SDSIZE)) ? 1 : 0;
+	}
+	return (0);
+}
+
+
+static int
+lxpr_readdir_procdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXPNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+	off_t uoffset;
+	zoneid_t zoneid;
+	pid_t pid;
+	int error;
+	int ceof;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PROCDIR);
+
+	oresid = uiop->uio_resid;
+	zoneid = LXPTOZ(lxpnp)->zone_id;
+
+	/*
+	 * We return directory entries in the order: "." and ".." then the
+	 * unique lxproc files, then the directories corresponding to the
+	 * running processes.  We have defined this as the ordering because
+	 * it allows us to more easily keep track of where we are betwen calls
+	 * to getdents().  If the number of processes changes between calls
+	 * then we can't lose track of where we are in the lxproc files.
+	 */
+
+	/* Do the fixed entries */
+	error = lxpr_readdir_common(lxpnp, uiop, &ceof, lxpr_dir,
+	    PROCDIRFILES);
+
+	/* Finished if we got an error or if we couldn't do all the table */
+	if (error != 0 || ceof == 0)
+		return (error);
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/* Do the process entries */
+	while ((uresid = uiop->uio_resid) > 0) {
+		proc_t *p;
+		int len;
+		int reclen;
+		int i;
+
+		uoffset = uiop->uio_offset;
+
+		/*
+		 * Stop when entire proc table has been examined.
+		 */
+		i = (uoffset / LXPR_SDSIZE) - 2 - PROCDIRFILES;
+		if (i < 0 || i >= v.v_proc) {
+			/* Run out of table entries */
+			if (eofp) {
+				*eofp = 1;
+			}
+			return (0);
+		}
+		mutex_enter(&pidlock);
+
+		/*
+		 * Skip indices for which there is no pid_entry, PIDs for
+		 * which there is no corresponding process, a PID of 0,
+		 * and anything the security policy doesn't allow
+		 * us to look at.
+		 */
+		if ((p = pid_entry(i)) == NULL || p->p_stat == SIDL ||
+		    p->p_pid == 0 ||
+		    secpolicy_basic_procinfo(CRED(), p, curproc) != 0) {
+			mutex_exit(&pidlock);
+			goto next;
+		}
+		mutex_exit(&pidlock);
+
+		/*
+		 * Convert pid to the Linux default of 1 if we're the zone's
+		 * init process, otherwise use the value from the proc
+		 * structure
+		 */
+		pid = ((p->p_pid != curproc->p_zone->zone_proc_initpid) ?
+		    p->p_pid : 1);
+
+		/*
+		 * If this /proc was mounted in the global zone, view
+		 * all procs; otherwise, only view zone member procs.
+		 */
+		if (zoneid != GLOBAL_ZONEID && p->p_zone->zone_id != zoneid) {
+			goto next;
+		}
+
+		ASSERT(p->p_stat != 0);
+
+		dirent->d_ino = lxpr_inode(LXPR_PIDDIR, pid, 0);
+		len = snprintf(dirent->d_name, LXPNSIZ, "%d", pid);
+		ASSERT(len < LXPNSIZ);
+		reclen = DIRENT64_RECLEN(len);
+
+		dirent->d_off = (off64_t)(uoffset + LXPR_SDSIZE);
+		dirent->d_reclen = (ushort_t)reclen;
+
+		/*
+		 * if the size of the data to transfer is greater
+		 * that that requested then we can't do it this transfer.
+		 */
+		if (reclen > uresid) {
+			/*
+			 * Error if no entries have been returned yet.
+			 */
+			if (uresid == oresid)
+				return (EINVAL);
+			break;
+		}
+
+		/*
+		 * uiomove() updates both uiop->uio_resid and uiop->uio_offset
+		 * by the same amount.  But we want uiop->uio_offset to change
+		 * in increments of LXPR_SDSIZE, which is different from the
+		 * number of bytes being returned to the user.  So we set
+		 * uiop->uio_offset separately, in the increment of this for
+		 * the loop, ignoring what uiomove() does.
+		 */
+		if ((error = uiomove((caddr_t)dirent, reclen, UIO_READ,
+		    uiop)) != 0)
+			return (error);
+next:
+		uiop->uio_offset = uoffset + LXPR_SDSIZE;
+	}
+
+	if (eofp != NULL) {
+		*eofp = (uiop->uio_offset >=
+		    ((v.v_proc + PROCDIRFILES + 2) * LXPR_SDSIZE)) ? 1 : 0;
+	}
+
+	return (0);
+}
+
+static int
+lxpr_readdir_piddir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	proc_t *p;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PIDDIR);
+
+	/* can't read its contents if it died */
+	mutex_enter(&pidlock);
+
+	p = prfind((lxpnp->lxpr_pid == 1) ?
+	    curproc->p_zone->zone_proc_initpid : lxpnp->lxpr_pid);
+
+	if (p == NULL || p->p_stat == SIDL) {
+		mutex_exit(&pidlock);
+		return (ENOENT);
+	}
+	mutex_exit(&pidlock);
+
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, piddir, PIDDIRFILES));
+}
+
+static int
+lxpr_readdir_netdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	ASSERT(lxpnp->lxpr_type == LXPR_NETDIR);
+	return (lxpr_readdir_common(lxpnp, uiop, eofp, netdir, NETDIRFILES));
+}
+
+static int
+lxpr_readdir_fddir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
+{
+	/* bp holds one dirent64 structure */
+	longlong_t bp[DIRENT64_RECLEN(LXPNSIZ) / sizeof (longlong_t)];
+	dirent64_t *dirent = (dirent64_t *)bp;
+	ssize_t oresid;	/* save a copy for testing later */
+	ssize_t uresid;
+	off_t uoffset;
+	int error;
+	int ceof;
+	proc_t *p;
+	int fddirsize = -1;
+	uf_info_t *fip;
+
+	ASSERT(lxpnp->lxpr_type == LXPR_PID_FDDIR);
+
+	oresid = uiop->uio_resid;
+
+	/* can't read its contents if it died */
+	p = lxpr_lock(lxpnp->lxpr_pid);
+	if (p == NULL)
+		return (ENOENT);
+
+	if ((p->p_stat == SZOMB) || (p->p_flag & (SSYS | SEXITING)) ||
+	    (p->p_as == &kas))
+		fddirsize = 0;
+
+	/*
+	 * Drop p_lock, but keep the process P_PR_LOCK'd to prevent it from
+	 * going away while we iterate over its fi_list.
+	 */
+	mutex_exit(&p->p_lock);
+
+	/* Get open file info */
+	fip = (&(p)->p_user.u_finfo);
+	mutex_enter(&fip->fi_lock);
+
+	if (fddirsize == -1)
+		fddirsize = fip->fi_nfiles;
+
+	/* Do the fixed entries (in this case just "." & "..") */
+	error = lxpr_readdir_common(lxpnp, uiop, &ceof, 0, 0);
+
+	/* Finished if we got an error or if we couldn't do all the table */
+	if (error != 0 || ceof == 0)
+		goto out;
+
+	/* clear out the dirent buffer */
+	bzero(bp, sizeof (bp));
+
+	/*
+	 * Loop until user's request is satisfied or until
+	 * all file descriptors have been examined.
+	 */
+	for (; (uresid = uiop->uio_resid) > 0;
+	    uiop->uio_offset = uoffset + LXPR_SDSIZE) {
+		int reclen;
+		int fd;
+		int len;
+
+		uoffset = uiop->uio_offset;
+
+		/*
+		 * Stop at the end of the fd list
+		 */
+		fd = (uoffset / LXPR_SDSIZE) - 2;
+		if (fd < 0 || fd >= fddirsize) {
+			if (eofp) {
+				*eofp = 1;
+			}
+			goto out;
+		}
+
+		if (fip->fi_list[fd].uf_file == NULL)
+			continue;
+
+		dirent->d_ino = lxpr_inode(LXPR_PID_FD_FD, lxpnp->lxpr_pid, fd);
+		len = snprintf(dirent->d_name, LXPNSIZ, "%d", fd);
+		ASSERT(len < LXPNSIZ);
+		reclen = DIRENT64_RECLEN(len);
+
+		dirent->d_off = (off64_t)(uoffset + LXPR_SDSIZE);
+		dirent->d_reclen = (ushort_t)reclen;
+
+		if (reclen > uresid) {
+			/*
+			 * Error if no entries have been returned yet.
+			 */
+			if (uresid == oresid)
+				error = EINVAL;
+			goto out;
+		}
+
+		if ((error = uiomove((caddr_t)dirent, reclen, UIO_READ,
+		    uiop)) != 0)
+			goto out;
+	}
+
+	if (eofp != NULL) {
+		*eofp =
+		    (uiop->uio_offset >= ((fddirsize+2) * LXPR_SDSIZE)) ? 1 : 0;
+	}
+
+out:
+	mutex_exit(&fip->fi_lock);
+	mutex_enter(&p->p_lock);
+	lxpr_unlock(p);
+	return (error);
+}
+
+
+/*
+ * lxpr_readlink(): Vnode operation for VOP_READLINK()
+ */
+/* ARGSUSED */
+static int
+lxpr_readlink(vnode_t *vp, uio_t *uiop, cred_t *cr, caller_context_t *ct)
+{
+	char bp[MAXPATHLEN + 1];
+	size_t buflen = sizeof (bp);
+	lxpr_node_t *lxpnp = VTOLXP(vp);
+	vnode_t *rvp = lxpnp->lxpr_realvp;
+	pid_t pid;
+	int error = 0;
+
+	/* must be a symbolic link file */
+	if (vp->v_type != VLNK)
+		return (EINVAL);
+
+	/* Try to produce a symlink name for anything that has a realvp */
+	if (rvp != NULL) {
+		if ((error = lxpr_access(vp, VREAD, 0, CRED(), ct)) != 0)
+			return (error);
+		if ((error = vnodetopath(NULL, rvp, bp, buflen, CRED())) != 0)
+			return (error);
+	} else {
+		switch (lxpnp->lxpr_type) {
+		case LXPR_SELF:
+			/*
+			 * Convert pid to the Linux default of 1 if we're the
+			 * zone's init process
+			 */
+			pid = ((curproc->p_pid !=
+			    curproc->p_zone->zone_proc_initpid)
+			    ? curproc->p_pid : 1);
+
+			/*
+			 * Don't need to check result as every possible int
+			 * will fit within MAXPATHLEN bytes.
+			 */
+			(void) snprintf(bp, buflen, "%d", pid);
+			break;
+		case LXPR_PID_CURDIR:
+		case LXPR_PID_ROOTDIR:
+		case LXPR_PID_EXE:
+			return (EACCES);
+		default:
+			/*
+			 * Need to return error so that nothing thinks
+			 * that the symlink is empty and hence "."
+			 */
+			return (EINVAL);
+		}
+	}
+
+	/* copy the link data to user space */
+	return (uiomove(bp, strlen(bp), UIO_READ, uiop));
+}
+
+/*
+ * lxpr_inactive(): Vnode operation for VOP_INACTIVE()
+ * Vnode is no longer referenced, deallocate the file
+ * and all its resources.
+ */
+/* ARGSUSED */
+static void
+lxpr_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
+{
+	lxpr_freenode(VTOLXP(vp));
+}
+
+/*
+ * lxpr_sync(): Vnode operation for VOP_SYNC()
+ */
+static int
+lxpr_sync()
+{
+	/*
+	 * Nothing to sync but this function must never fail
+	 */
+	return (0);
+}
+
+/*
+ * lxpr_cmp(): Vnode operation for VOP_CMP()
+ */
+static int
+lxpr_cmp(vnode_t *vp1, vnode_t *vp2, caller_context_t *ct)
+{
+	vnode_t *rvp;
+
+	while (vn_matchops(vp1, lxpr_vnodeops) &&
+	    (rvp = VTOLXP(vp1)->lxpr_realvp) != NULL) {
+		vp1 = rvp;
+	}
+
+	while (vn_matchops(vp2, lxpr_vnodeops) &&
+	    (rvp = VTOLXP(vp2)->lxpr_realvp) != NULL) {
+		vp2 = rvp;
+	}
+
+	if (vn_matchops(vp1, lxpr_vnodeops) || vn_matchops(vp2, lxpr_vnodeops))
+		return (vp1 == vp2);
+
+	return (VOP_CMP(vp1, vp2, ct));
+}
+
+/*
+ * lxpr_realvp(): Vnode operation for VOP_REALVP()
+ */
+static int
+lxpr_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
+{
+	vnode_t *rvp;
+
+	if ((rvp = VTOLXP(vp)->lxpr_realvp) != NULL) {
+		vp = rvp;
+		if (VOP_REALVP(vp, &rvp, ct) == 0)
+			vp = rvp;
+	}
+
+	*vpp = vp;
+	return (0);
+}
diff --git a/usr/src/uts/common/fs/lxproc/lxproc.h b/usr/src/uts/common/fs/lxproc/lxproc.h
new file mode 100644
index 0000000000..eadb2ccd27
--- /dev/null
+++ b/usr/src/uts/common/fs/lxproc/lxproc.h
@@ -0,0 +1,278 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef	_LXPROC_H
+#define	_LXPROC_H
+
+#ifdef _LXPROC_BRANDED_H
+#error Attempted to include native lxproc.h after branded lx_proc.h
+#endif
+
+#define	_LXPROC_NATIVE_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * lxproc.h: declarations, data structures and macros for lxprocfs
+ */
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/policy.h>
+#include <sys/debug.h>
+#include <sys/dirent.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/kmem.h>
+#include <sys/pathname.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
+#include <sys/var.h>
+#include <sys/user.h>
+#include <sys/t_lock.h>
+#include <sys/sysmacros.h>
+#include <sys/cred.h>
+#include <sys/priv.h>
+#include <sys/vnode.h>
+#include <sys/vfs.h>
+#include <sys/statvfs.h>
+#include <sys/cmn_err.h>
+#include <sys/zone.h>
+#include <sys/uio.h>
+#include <sys/utsname.h>
+#include <sys/dnlc.h>
+#include <sys/atomic.h>
+#include <sys/sunddi.h>
+#include <sys/sunldi.h>
+#include <vm/as.h>
+#include <vm/anon.h>
+
+#define	LX_SIGHUP	1
+#define	LX_SIGINT	2
+#define	LX_SIGQUIT	3
+#define	LX_SIGILL	4
+#define	LX_SIGTRAP	5
+#define	LX_SIGABRT	6
+#define	LX_SIGIOT	6
+#define	LX_SIGBUS	7
+#define	LX_SIGFPE	8
+#define	LX_SIGKILL	9
+#define	LX_SIGUSR1	10
+#define	LX_SIGSEGV	11
+#define	LX_SIGUSR2	12
+#define	LX_SIGPIPE	13
+#define	LX_SIGALRM	14
+#define	LX_SIGTERM	15
+#define	LX_SIGSTKFLT	16
+#define	LX_SIGCHLD	17
+#define	LX_SIGCONT	18
+#define	LX_SIGSTOP	19
+#define	LX_SIGTSTP	20
+#define	LX_SIGTTIN	21
+#define	LX_SIGTTOU	22
+#define	LX_SIGURG	23
+#define	LX_SIGXCPU	24
+#define	LX_SIGXFSZ	25
+#define	LX_SIGVTALRM	26
+#define	LX_SIGPROF	27
+#define	LX_SIGWINCH	28
+#define	LX_SIGIO	29
+#define	LX_SIGPOLL	LX_SIGIO
+#define	LX_SIGPWR	30
+#define	LX_SIGSYS	31
+#define	LX_SIGUNUSED	31
+
+#define	LX_NSIG		64	/* Linux _NSIG */
+
+#define	LX_SIGRTMIN	32
+#define	LX_SIGRTMAX	LX_NSIG
+
+/*
+ * Convert a vnode into an lxpr_mnt_t
+ */
+#define	VTOLXPM(vp)	((lxpr_mnt_t *)(vp)->v_vfsp->vfs_data)
+
+/*
+ * convert a vnode into an lxpr_node
+ */
+#define	VTOLXP(vp)	((lxpr_node_t *)(vp)->v_data)
+
+/*
+ * convert a lxprnode into a vnode
+ */
+#define	LXPTOV(lxpnp)	((lxpnp)->lxpr_vnode)
+
+/*
+ * convert a lxpr_node into zone for fs
+ */
+#define	LXPTOZ(lxpnp) \
+	(((lxpr_mnt_t *)(lxpnp)->lxpr_vnode->v_vfsp->vfs_data)->lxprm_zone)
+
+#define	LXPNSIZ		256	/* max size of lx /proc file name entries */
+
+/*
+ * Pretend that a directory entry takes 16 bytes
+ */
+#define	LXPR_SDSIZE	16
+
+/*
+ * Node/file types for lx /proc files
+ * (directories and files contained therein).
+ */
+typedef enum lxpr_nodetype {
+	LXPR_PROCDIR,		/* /proc		*/
+	LXPR_PIDDIR,		/* /proc/<pid>		*/
+	LXPR_PID_CMDLINE,	/* /proc/<pid>/cmdline	*/
+	LXPR_PID_CPU,		/* /proc/<pid>/cpu	*/
+	LXPR_PID_CURDIR,	/* /proc/<pid>/cwd	*/
+	LXPR_PID_ENV,		/* /proc/<pid>/environ	*/
+	LXPR_PID_EXE,		/* /proc/<pid>/exe	*/
+	LXPR_PID_MAPS,		/* /proc/<pid>/maps	*/
+	LXPR_PID_MEM,		/* /proc/<pid>/mem	*/
+	LXPR_PID_ROOTDIR,	/* /proc/<pid>/root	*/
+	LXPR_PID_STAT,		/* /proc/<pid>/stat	*/
+	LXPR_PID_STATM,		/* /proc/<pid>/statm	*/
+	LXPR_PID_STATUS,	/* /proc/<pid>/status	*/
+	LXPR_PID_FDDIR,		/* /proc/<pid>/fd	*/
+	LXPR_PID_FD_FD,		/* /proc/<pid>/fd/nn	*/
+	LXPR_CMDLINE,		/* /proc/cmdline	*/
+	LXPR_CPUINFO,		/* /proc/cpuinfo	*/
+	LXPR_DEVICES,		/* /proc/devices	*/
+	LXPR_DMA,		/* /proc/dma		*/
+	LXPR_FILESYSTEMS,	/* /proc/filesystems	*/
+	LXPR_INTERRUPTS,	/* /proc/interrupts	*/
+	LXPR_IOPORTS,		/* /proc/ioports	*/
+	LXPR_KCORE,		/* /proc/kcore		*/
+	LXPR_KMSG,		/* /proc/kmsg		*/
+	LXPR_LOADAVG,		/* /proc/loadavg	*/
+	LXPR_MEMINFO,		/* /proc/meminfo	*/
+	LXPR_MOUNTS,		/* /proc/mounts		*/
+	LXPR_NETDIR,		/* /proc/net		*/
+	LXPR_NET_ARP,		/* /proc/net/arp	*/
+	LXPR_NET_DEV,		/* /proc/net/dev	*/
+	LXPR_NET_DEV_MCAST,	/* /proc/net/dev_mcast	*/
+	LXPR_NET_IGMP,		/* /proc/net/igmp	*/
+	LXPR_NET_IP_MR_CACHE,	/* /proc/net/ip_mr_cache */
+	LXPR_NET_IP_MR_VIF,	/* /proc/net/ip_mr_vif	*/
+	LXPR_NET_MCFILTER,	/* /proc/net/mcfilter	*/
+	LXPR_NET_NETSTAT,	/* /proc/net/netstat	*/
+	LXPR_NET_RAW,		/* /proc/net/raw	*/
+	LXPR_NET_ROUTE,		/* /proc/net/route	*/
+	LXPR_NET_RPC,		/* /proc/net/rpc	*/
+	LXPR_NET_RT_CACHE,	/* /proc/net/rt_cache	*/
+	LXPR_NET_SOCKSTAT,	/* /proc/net/sockstat	*/
+	LXPR_NET_SNMP,		/* /proc/net/snmp	*/
+	LXPR_NET_STAT,		/* /proc/net/stat	*/
+	LXPR_NET_TCP,		/* /proc/net/tcp	*/
+	LXPR_NET_UDP,		/* /proc/net/udp	*/
+	LXPR_NET_UNIX,		/* /proc/net/unix	*/
+	LXPR_PARTITIONS,	/* /proc/partitions	*/
+	LXPR_SELF,		/* /proc/self		*/
+	LXPR_STAT,		/* /proc/stat		*/
+	LXPR_UPTIME,		/* /proc/uptime		*/
+	LXPR_VERSION,		/* /proc/version	*/
+	LXPR_NFILES		/* number of lx /proc file types */
+} lxpr_nodetype_t;
+
+/*
+ * Number of fds allowed for in the inode number calculation
+ * per process (if a process has more fds then inode numbers
+ * may be duplicated)
+ */
+#define	LXPR_FD_PERPROC 2000
+
+/*
+ * external dirent characteristics
+ */
+#define	LXPRMAXNAMELEN	14
+typedef struct {
+	lxpr_nodetype_t	d_type;
+	char		d_name[LXPRMAXNAMELEN];
+} lxpr_dirent_t;
+
+/*
+ * This is the lxprocfs private data object
+ * which is attached to v_data in the vnode structure
+ */
+typedef struct lxpr_node {
+	lxpr_nodetype_t	lxpr_type;	/* type of this node 		*/
+	vnode_t		*lxpr_vnode;	/* vnode for the node		*/
+	vnode_t		*lxpr_parent;	/* parent directory		*/
+	vnode_t		*lxpr_realvp;	/* real vnode, file in dirs	*/
+	timestruc_t	lxpr_time;	/* creation etc time for file	*/
+	mode_t		lxpr_mode;	/* file mode bits		*/
+	uid_t		lxpr_uid;	/* file owner			*/
+	gid_t		lxpr_gid;	/* file group owner		*/
+	pid_t		lxpr_pid;	/* pid of proc referred to	*/
+	ino_t		lxpr_ino;	/* node id 			*/
+} lxpr_node_t;
+
+struct zone;    /* forward declaration */
+
+/*
+ * This is the lxprocfs private data object
+ * which is attached to vfs_data in the vfs structure
+ */
+typedef struct lxpr_mnt {
+	lxpr_node_t	*lxprm_node;	/* node at root of proc mount */
+	struct zone	*lxprm_zone;	/* zone for this mount */
+	ldi_ident_t	lxprm_li;	/* ident for ldi */
+} lxpr_mnt_t;
+
+extern vnodeops_t	*lxpr_vnodeops;
+extern int		nproc_highbit;	/* highbit(v.v_nproc)		*/
+
+typedef struct mounta	mounta_t;
+
+extern void lxpr_initnodecache();
+extern void lxpr_fininodecache();
+extern void lxpr_initrootnode(lxpr_node_t **, vfs_t *);
+extern ino_t lxpr_inode(lxpr_nodetype_t, pid_t, int);
+extern ino_t lxpr_parentinode(lxpr_node_t *);
+extern lxpr_node_t *lxpr_getnode(vnode_t *, lxpr_nodetype_t, proc_t *, int);
+extern void lxpr_freenode(lxpr_node_t *);
+
+typedef struct lxpr_uiobuf lxpr_uiobuf_t;
+extern lxpr_uiobuf_t *lxpr_uiobuf_new(uio_t *);
+extern void lxpr_uiobuf_free(lxpr_uiobuf_t *);
+extern int lxpr_uiobuf_flush(lxpr_uiobuf_t *);
+extern void lxpr_uiobuf_seek(lxpr_uiobuf_t *, offset_t);
+extern void lxpr_uiobuf_write(lxpr_uiobuf_t *, const char *, size_t);
+extern void lxpr_uiobuf_printf(lxpr_uiobuf_t *, const char *, ...);
+extern void lxpr_uiobuf_seterr(lxpr_uiobuf_t *, int);
+
+proc_t *lxpr_lock(pid_t);
+void lxpr_unlock(proc_t *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _LXPROC_H */
diff --git a/usr/src/uts/common/fs/nfs/nfs3_vfsops.c b/usr/src/uts/common/fs/nfs/nfs3_vfsops.c
index d6a88a97c3..f6c6b62925 100644
--- a/usr/src/uts/common/fs/nfs/nfs3_vfsops.c
+++ b/usr/src/uts/common/fs/nfs/nfs3_vfsops.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 /*
diff --git a/usr/src/uts/common/fs/nfs/nfs3_vnops.c b/usr/src/uts/common/fs/nfs/nfs3_vnops.c
index b7354c168a..d3b12817ba 100644
--- a/usr/src/uts/common/fs/nfs/nfs3_vnops.c
+++ b/usr/src/uts/common/fs/nfs/nfs3_vnops.c
@@ -29,7 +29,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  */
 
@@ -3353,10 +3353,9 @@ nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
 		if (nvp)
 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
 
-		if (odvp != ndvp)
-			vnevent_rename_dest_dir(ndvp, ct);
 		ASSERT(ovp != NULL);
 		vnevent_rename_src(ovp, odvp, onm, ct);
+		vnevent_rename_dest_dir(ndvp, ovp, nnm, ct);
 	}
 
 	if (nvp) {
@@ -5523,8 +5522,13 @@ nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
 			va.va_size = bfp->l_start;
 			error = nfs3setattr(vp, &va, 0, cr);
 
-			if (error == 0 && bfp->l_start == 0)
-				vnevent_truncate(vp, ct);
+			if (error == 0) {
+				if (bfp->l_start == 0) {
+					vnevent_truncate(vp, ct);
+				} else {
+					vnevent_resize(vp, ct);
+				}
+			}
 		} else
 			error = EINVAL;
 	}
diff --git a/usr/src/uts/common/fs/nfs/nfs4_vfsops.c b/usr/src/uts/common/fs/nfs/nfs4_vfsops.c
index f0320aaee0..25088aafcb 100644
--- a/usr/src/uts/common/fs/nfs/nfs4_vfsops.c
+++ b/usr/src/uts/common/fs/nfs/nfs4_vfsops.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 /*
diff --git a/usr/src/uts/common/fs/nfs/nfs4_vnops.c b/usr/src/uts/common/fs/nfs/nfs4_vnops.c
index 4112cbee05..945d37533d 100644
--- a/usr/src/uts/common/fs/nfs/nfs4_vnops.c
+++ b/usr/src/uts/common/fs/nfs/nfs4_vnops.c
@@ -38,7 +38,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/param.h>
@@ -3745,8 +3745,13 @@ nfs4_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
 	 */
 	error = nfs4setattr(vp, vap, flags, cr, NULL);
 
-	if (error == 0 && (vap->va_mask & AT_SIZE) && vap->va_size == 0)
-		vnevent_truncate(vp, ct);
+	if (error == 0 && (vap->va_mask & AT_SIZE)) {
+		if (vap->va_size == 0) {
+			vnevent_truncate(vp, ct);
+		} else {
+			vnevent_resize(vp, ct);
+		}
+	}
 
 	return (error);
 }
@@ -8062,8 +8067,9 @@ link_call:
 	 * vnode if it already existed.
 	 */
 	if (error == 0) {
-		vnode_t *tvp;
+		vnode_t *tvp, *tovp;
 		rnode4_t *trp;
+
 		/*
 		 * Notify the vnode. Each links is represented by
 		 * a different vnode, in nfsv4.
@@ -8076,23 +8082,20 @@ link_call:
 			vnevent_rename_dest(tvp, ndvp, nnm, ct);
 		}
 
-		/*
-		 * if the source and destination directory are not the
-		 * same notify the destination directory.
-		 */
-		if (VTOR4(odvp) != VTOR4(ndvp)) {
-			trp = VTOR4(ndvp);
-			tvp = ndvp;
-			if (IS_SHADOW(ndvp, trp))
-				tvp = RTOV4(trp);
-			vnevent_rename_dest_dir(tvp, ct);
-		}
-
 		trp = VTOR4(ovp);
-		tvp = ovp;
+		tovp = ovp;
 		if (IS_SHADOW(ovp, trp))
+			tovp = RTOV4(trp);
+
+		vnevent_rename_src(tovp, odvp, onm, ct);
+
+		trp = VTOR4(ndvp);
+		tvp = ndvp;
+
+		if (IS_SHADOW(ndvp, trp))
 			tvp = RTOV4(trp);
-		vnevent_rename_src(tvp, odvp, onm, ct);
+
+		vnevent_rename_dest_dir(tvp, tovp, nnm, ct);
 	}
 
 	if (nvp) {
@@ -10997,8 +11000,13 @@ nfs4_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
 			va.va_size = bfp->l_start;
 			error = nfs4setattr(vp, &va, 0, cr, NULL);
 
-			if (error == 0 && bfp->l_start == 0)
-				vnevent_truncate(vp, ct);
+			if (error == 0) {
+				if (bfp->l_start == 0) {
+					vnevent_truncate(vp, ct);
+				} else {
+					vnevent_resize(vp, ct);
+				}
+			}
 		} else
 			error = EINVAL;
 	}
diff --git a/usr/src/uts/common/fs/nfs/nfs_auth.c b/usr/src/uts/common/fs/nfs/nfs_auth.c
index 2851f8bef9..5fa0e6414f 100644
--- a/usr/src/uts/common/fs/nfs/nfs_auth.c
+++ b/usr/src/uts/common/fs/nfs/nfs_auth.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
  * Copyright (c) 2015 by Delphix. All rights reserved.
  */
 
@@ -561,11 +562,16 @@ retry:
 			*access = res.ares.auth_perm;
 			*srv_uid = res.ares.auth_srv_uid;
 			*srv_gid = res.ares.auth_srv_gid;
-			*srv_gids_cnt = res.ares.auth_srv_gids.len;
-			*srv_gids = kmem_alloc(*srv_gids_cnt * sizeof (gid_t),
-			    KM_SLEEP);
-			bcopy(res.ares.auth_srv_gids.val, *srv_gids,
-			    *srv_gids_cnt * sizeof (gid_t));
+
+			if ((*srv_gids_cnt = res.ares.auth_srv_gids.len) != 0) {
+				*srv_gids = kmem_alloc(*srv_gids_cnt *
+				    sizeof (gid_t), KM_SLEEP);
+				bcopy(res.ares.auth_srv_gids.val, *srv_gids,
+				    *srv_gids_cnt * sizeof (gid_t));
+			} else {
+				*srv_gids = NULL;
+			}
+
 			break;
 
 		case NFSAUTH_DR_EFAIL:
@@ -1054,9 +1060,13 @@ nfsauth_cache_get(struct exportinfo *exi, struct svc_req *req, int flavor,
 		if (gid != NULL)
 			*gid = p->auth_srv_gid;
 		if (ngids != NULL && gids != NULL) {
-			*ngids = p->auth_srv_ngids;
-			*gids = kmem_alloc(*ngids * sizeof (gid_t), KM_SLEEP);
-			bcopy(p->auth_srv_gids, *gids, *ngids * sizeof (gid_t));
+			if ((*ngids = p->auth_srv_ngids) != 0) {
+				size_t sz = *ngids * sizeof (gid_t);
+				*gids = kmem_alloc(sz, KM_SLEEP);
+				bcopy(p->auth_srv_gids, *gids, sz);
+			} else {
+				*gids = NULL;
+			}
 		}
 
 		access = p->auth_access;
diff --git a/usr/src/uts/common/fs/nfs/nfs_server.c b/usr/src/uts/common/fs/nfs/nfs_server.c
index 476da6685a..c6ae29d220 100644
--- a/usr/src/uts/common/fs/nfs/nfs_server.c
+++ b/usr/src/uts/common/fs/nfs/nfs_server.c
@@ -2573,6 +2573,9 @@ nfs_srvinit(void)
 {
 	int error;
 
+	if (getzoneid() != GLOBAL_ZONEID)
+		return (EACCES);
+
 	error = nfs_exportinit();
 	if (error != 0)
 		return (error);
diff --git a/usr/src/uts/common/fs/nfs/nfs_sys.c b/usr/src/uts/common/fs/nfs/nfs_sys.c
index e6ff4a2e0b..b4fc9884b1 100644
--- a/usr/src/uts/common/fs/nfs/nfs_sys.c
+++ b/usr/src/uts/common/fs/nfs/nfs_sys.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  *
  * Copyright (c) 1983,1984,1985,1986,1987,1988,1989  AT&T.
  * All rights reserved.
@@ -247,7 +248,7 @@ nfssys(enum nfssys_op opcode, void *arg)
 			lsa.n_fmly = STRUCT_FGET(ulsa, n_fmly);
 			lsa.n_proto = STRUCT_FGET(ulsa, n_proto);
 			lsa.n_rdev = expldev(STRUCT_FGET(ulsa, n_rdev));
-			lsa.debug = STRUCT_FGET(ulsa, debug);
+			lsa.n_v4_only = STRUCT_FGET(ulsa, n_v4_only);
 			lsa.timout = STRUCT_FGET(ulsa, timout);
 			lsa.grace = STRUCT_FGET(ulsa, grace);
 			lsa.retransmittimeout = STRUCT_FGET(ulsa,
diff --git a/usr/src/uts/common/fs/nfs/nfs_vfsops.c b/usr/src/uts/common/fs/nfs/nfs_vfsops.c
index c9cc306f95..5041ebb6fe 100644
--- a/usr/src/uts/common/fs/nfs/nfs_vfsops.c
+++ b/usr/src/uts/common/fs/nfs/nfs_vfsops.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  *
  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989  AT&T.
  *	All rights reserved.
diff --git a/usr/src/uts/common/fs/nfs/nfs_vnops.c b/usr/src/uts/common/fs/nfs/nfs_vnops.c
index 1a1082bcb8..ee3bac484f 100644
--- a/usr/src/uts/common/fs/nfs/nfs_vnops.c
+++ b/usr/src/uts/common/fs/nfs/nfs_vnops.c
@@ -26,7 +26,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  */
 
@@ -1174,8 +1174,13 @@ nfs_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
 
 	error = nfssetattr(vp, vap, flags, cr);
 
-	if (error == 0 && (mask & AT_SIZE) && vap->va_size == 0)
-		vnevent_truncate(vp, ct);
+	if (error == 0 && (mask & AT_SIZE)) {
+		if (vap->va_size == 0) {
+			vnevent_truncate(vp, ct);
+		} else {
+			vnevent_resize(vp, ct);
+		}
+	}
 
 	return (error);
 }
@@ -2688,11 +2693,9 @@ nfsrename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
 		if (nvp)
 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
 
-		if (odvp != ndvp)
-			vnevent_rename_dest_dir(ndvp, ct);
-
 		ASSERT(ovp != NULL);
 		vnevent_rename_src(ovp, odvp, onm, ct);
+		vnevent_rename_dest_dir(ndvp, ovp, nnm, ct);
 	}
 
 	if (nvp) {
@@ -4620,8 +4623,13 @@ nfs_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
 			va.va_size = bfp->l_start;
 			error = nfssetattr(vp, &va, 0, cr);
 
-			if (error == 0 && bfp->l_start == 0)
-				vnevent_truncate(vp, ct);
+			if (error == 0) {
+				if (bfp->l_start == 0) {
+					vnevent_truncate(vp, ct);
+				} else {
+					vnevent_resize(vp, ct);
+				}
+			}
 		} else
 			error = EINVAL;
 	}
diff --git a/usr/src/uts/common/fs/pcfs/pc_dir.c b/usr/src/uts/common/fs/pcfs/pc_dir.c
index 976715e346..275330a0ae 100644
--- a/usr/src/uts/common/fs/pcfs/pc_dir.c
+++ b/usr/src/uts/common/fs/pcfs/pc_dir.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/param.h>
@@ -826,8 +826,7 @@ top:
 
 	if (error == 0) {
 		vnevent_rename_src(PCTOV(pcp), PCTOV(dp), snm, ctp);
-		if (dp != tdp)
-			vnevent_rename_dest_dir(PCTOV(tdp), ctp);
+		vnevent_rename_dest_dir(PCTOV(tdp), PCTOV(pcp), tnm, ctp);
 	}
 
 done:
diff --git a/usr/src/uts/common/fs/pcfs/pc_vnops.c b/usr/src/uts/common/fs/pcfs/pc_vnops.c
index cb43f0fe59..b307fe11d7 100644
--- a/usr/src/uts/common/fs/pcfs/pc_vnops.c
+++ b/usr/src/uts/common/fs/pcfs/pc_vnops.c
@@ -782,8 +782,11 @@ pcfs_setattr(
 		if (error)
 			goto out;
 
-		if (vap->va_size == 0)
+		if (vap->va_size == 0) {
 			vnevent_truncate(vp, ct);
+		} else {
+			vnevent_resize(vp, ct);
+		}
 	}
 	/*
 	 * Change file modified times.
diff --git a/usr/src/uts/common/fs/portfs/port.c b/usr/src/uts/common/fs/portfs/port.c
index 14be8cbbae..11b7386269 100644
--- a/usr/src/uts/common/fs/portfs/port.c
+++ b/usr/src/uts/common/fs/portfs/port.c
@@ -24,7 +24,9 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
+ */
 
 #include <sys/types.h>
 #include <sys/systm.h>
@@ -1381,12 +1383,18 @@ portnowait:
 
 	if (model == DATAMODEL_NATIVE) {
 		eventsz = sizeof (port_event_t);
-		kevp = kmem_alloc(eventsz * nmax, KM_NOSLEEP);
-		if (kevp == NULL) {
-			if (nmax > pp->port_max_list)
-				nmax = pp->port_max_list;
-			kevp = kmem_alloc(eventsz * nmax, KM_SLEEP);
+
+		if (nmax == 0) {
+			kevp = NULL;
+		} else {
+			kevp = kmem_alloc(eventsz * nmax, KM_NOSLEEP);
+			if (kevp == NULL) {
+				if (nmax > pp->port_max_list)
+					nmax = pp->port_max_list;
+				kevp = kmem_alloc(eventsz * nmax, KM_SLEEP);
+			}
 		}
+
 		results = kevp;
 		lev = NULL;	/* start with first event in the queue */
 		for (nevents = 0; nevents < nmax; ) {
@@ -1423,12 +1431,18 @@ portnowait:
 		port_event32_t	*kevp32;
 
 		eventsz = sizeof (port_event32_t);
-		kevp32 = kmem_alloc(eventsz * nmax, KM_NOSLEEP);
-		if (kevp32 == NULL) {
-			if (nmax > pp->port_max_list)
-				nmax = pp->port_max_list;
-			kevp32 = kmem_alloc(eventsz * nmax, KM_SLEEP);
+
+		if (nmax == 0) {
+			kevp32 = NULL;
+		} else {
+			kevp32 = kmem_alloc(eventsz * nmax, KM_NOSLEEP);
+			if (kevp32 == NULL) {
+				if (nmax > pp->port_max_list)
+					nmax = pp->port_max_list;
+				kevp32 = kmem_alloc(eventsz * nmax, KM_SLEEP);
+			}
 		}
+
 		results = kevp32;
 		lev = NULL;	/* start with first event in the queue */
 		for (nevents = 0; nevents < nmax; ) {
diff --git a/usr/src/uts/common/fs/proc/prargv.c b/usr/src/uts/common/fs/proc/prargv.c
new file mode 100644
index 0000000000..b09a9c8afc
--- /dev/null
+++ b/usr/src/uts/common/fs/proc/prargv.c
@@ -0,0 +1,441 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/sunddi.h>
+#include <sys/proc.h>
+#include <sys/procfs.h>
+#include <sys/sysmacros.h>
+#include <vm/as.h>
+
+/*
+ * Safely read a contiguous region of memory from 'addr' in the address space
+ * of a particular process into the supplied kernel buffer (*buf, sz).
+ * Partially mapped regions will result in a partial read terminating at the
+ * first hole in the address space.  The number of bytes actually read is
+ * returned to the caller via 'rdsz'.
+ */
+int
+prreadbuf(proc_t *p, uintptr_t ustart, uint8_t *buf, size_t sz, size_t *rdsz)
+{
+	int error = 0;
+	size_t rem = sz;
+	off_t pos = 0;
+
+	if (rdsz != NULL)
+		*rdsz = 0;
+
+	while (rem != 0) {
+		uintptr_t addr = ustart + pos;
+		size_t len = MIN(rem, PAGESIZE - (addr & PAGEOFFSET));
+
+		if ((error = uread(p, buf + pos, len, addr)) != 0) {
+			if (error == ENXIO) {
+				/*
+				 * ENXIO from uread() indicates that the page
+				 * does not exist.  This will simply be a
+				 * partial read.
+				 */
+				error = 0;
+			}
+			break;
+		}
+
+		rem -= len;
+		pos += len;
+	}
+
+	if (rdsz != NULL)
+		*rdsz = pos;
+
+	return (error);
+}
+
+/*
+ * Attempt to read the argument vector (argv) from this process.  The caller
+ * must hold the p_lock mutex, and have marked the process P_PR_LOCK (e.g. via
+ * prlock or lx_prlock).
+ *
+ * The caller must provide a buffer (buf, buflen).  We will concatenate each
+ * argument string (including the NUL terminator) into this buffer.  The number
+ * of characters written to this buffer (including the final NUL terminator)
+ * will be stored in 'slen'.
+ */
+int
+prreadargv(proc_t *p, char *buf, size_t bufsz, size_t *slen)
+{
+	int error;
+	user_t *up;
+	struct as *as;
+	size_t pos = 0;
+	caddr_t *argv = NULL;
+	size_t argvsz = 0;
+	int i;
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+	VERIFY(p->p_proc_flag & P_PR_LOCK);
+
+	up = PTOU(p);
+	as = p->p_as;
+
+	if ((p->p_flag & SSYS) || as == &kas || up->u_argv == NULL) {
+		/*
+		 * Return the regular psargs string to the caller.
+		 */
+		bcopy(up->u_psargs, buf, MIN(bufsz, sizeof (up->u_psargs)));
+		buf[bufsz - 1] = '\0';
+		*slen = strlen(buf) + 1;
+
+		return (0);
+	}
+
+	/*
+	 * Allocate space to store argv array.
+	 */
+	argvsz = up->u_argc * (p->p_model == DATAMODEL_ILP32 ?
+	    sizeof (caddr32_t) : sizeof (caddr_t));
+	argv = kmem_alloc(argvsz, KM_SLEEP);
+
+	/*
+	 * Extract the argv array from the target process.  Drop p_lock
+	 * while we do I/O to avoid deadlock with the clock thread.
+	 */
+	mutex_exit(&p->p_lock);
+	if ((error = prreadbuf(p, up->u_argv, (uint8_t *)argv, argvsz,
+	    NULL)) != 0) {
+		kmem_free(argv, argvsz);
+		mutex_enter(&p->p_lock);
+		VERIFY(p->p_proc_flag & P_PR_LOCK);
+		return (-1);
+	}
+
+	/*
+	 * Read each argument string from the pointers in the argv array.
+	 */
+	pos = 0;
+	for (i = 0; i < up->u_argc; i++) {
+		size_t rdsz, trysz;
+		uintptr_t arg;
+		off_t j;
+		boolean_t found_nul;
+		boolean_t do_retry = B_TRUE;
+
+#ifdef	_SYSCALL32_IMPL
+		if (p->p_model == DATAMODEL_ILP32) {
+			arg = (uintptr_t)((caddr32_t *)argv)[i];
+		} else {
+			arg = (uintptr_t)argv[i];
+		}
+#else
+		arg = (uintptr_t)argv[i];
+#endif
+
+		/*
+		 * Stop trying to read arguments if we reach a NULL
+		 * pointer in the vector.
+		 */
+		if (arg == NULL)
+			break;
+
+		/*
+		 * Stop reading if we have read the maximum length
+		 * we can return to the user.
+		 */
+		if (pos >= bufsz)
+			break;
+
+		/*
+		 * Initially we try a short read, on the assumption that
+		 * most individual argument strings are less than 80
+		 * characters long.
+		 */
+		if ((trysz = MIN(80, bufsz - pos - 1)) < 80) {
+			/*
+			 * We don't have room in the target buffer for even
+			 * an entire short read, so there is no need to retry
+			 * with a longer read.
+			 */
+			do_retry = B_FALSE;
+		}
+
+retry:
+		/*
+		 * Read string data for this argument.  Leave room
+		 * in the buffer for a final NUL terminator.
+		 */
+		if ((error = prreadbuf(p, arg, (uint8_t *)&buf[pos], trysz,
+		    &rdsz)) != 0) {
+			/*
+			 * There was a problem reading this string
+			 * from the process.  Give up.
+			 */
+			break;
+		}
+
+		/*
+		 * Find the NUL terminator.
+		 */
+		found_nul = B_FALSE;
+		for (j = 0; j < rdsz; j++) {
+			if (buf[pos + j] == '\0') {
+				found_nul = B_TRUE;
+				break;
+			}
+		}
+
+		if (!found_nul && do_retry) {
+			/*
+			 * We did not find a NUL terminator, but this
+			 * was a first pass short read.  Try once more
+			 * with feeling.
+			 */
+			trysz = bufsz - pos - 1;
+			do_retry = B_FALSE;
+			goto retry;
+		}
+
+		/*
+		 * Commit the string we read to the buffer.
+		 */
+		pos += j + 1;
+		if (!found_nul && pos < bufsz) {
+			/*
+			 * A NUL terminator was not found; add one.
+			 */
+			buf[pos++] = '\0';
+		}
+	}
+
+	/*
+	 * Ensure the entire string is NUL-terminated.
+	 */
+	buf[bufsz - 1] = '\0';
+
+	mutex_enter(&p->p_lock);
+	VERIFY(p->p_proc_flag & P_PR_LOCK);
+	kmem_free(argv, argvsz);
+
+	/*
+	 * If the operation was a success, return the copied string length
+	 * to the caller.
+	 */
+	*slen = (error == 0) ? pos : 0;
+
+	return (error);
+}
+
+/*
+ * Similar to prreadargv except reads the env vector. This is slightly more
+ * complex because there is no count for the env vector that corresponds to
+ * u_argc.
+ */
+int
+prreadenvv(proc_t *p, char *buf, size_t bufsz, size_t *slen)
+{
+	int error;
+	user_t *up;
+	struct as *as;
+	size_t pos = 0;
+	caddr_t *envp = NULL;
+	uintptr_t tmpp = NULL;
+	size_t envpsz = 0, rdsz = 0;
+	int i;
+	int cnt, bound;
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+	VERIFY(p->p_proc_flag & P_PR_LOCK);
+
+	up = PTOU(p);
+	as = p->p_as;
+
+	if ((p->p_flag & SSYS) || as == &kas || up->u_envp == NULL) {
+		/*
+		 * Return empty string.
+		 */
+		buf[0] = '\0';
+		*slen = 1;
+
+		return (0);
+	}
+
+	/*
+	 * Drop p_lock while we do I/O to avoid deadlock with the clock thread.
+	 */
+	mutex_exit(&p->p_lock);
+
+	/*
+	 * We first have to count how many env entries we have. This is
+	 * somewhat painful. We extract the env entries from the target process
+	 * one entry at a time. Stop trying to read env entries if we reach a
+	 * NULL pointer in the vector or hit our upper bound (which we take
+	 * as the bufsz/4) to ensure we don't run off.
+	 */
+	rdsz = (p->p_model == DATAMODEL_ILP32 ?
+	    sizeof (caddr32_t) : sizeof (caddr_t));
+	bound = (int)(bufsz / 4);
+	for (cnt = 0, tmpp = up->u_envp; cnt < bound; cnt++, tmpp += rdsz) {
+		caddr_t tmp = NULL;
+
+		if ((error = prreadbuf(p, tmpp, (uint8_t *)&tmp, rdsz,
+		    NULL)) != 0) {
+			mutex_enter(&p->p_lock);
+			VERIFY(p->p_proc_flag & P_PR_LOCK);
+			return (-1);
+		}
+
+		if (tmp == NULL)
+			break;
+	}
+	if (cnt == 0) {
+		/* Return empty string. */
+		buf[0] = '\0';
+		*slen = 1;
+		mutex_enter(&p->p_lock);
+		VERIFY(p->p_proc_flag & P_PR_LOCK);
+		return (0);
+	}
+
+	/*
+	 * Allocate space to store env array.
+	 */
+	envpsz = cnt * (p->p_model == DATAMODEL_ILP32 ?
+	    sizeof (caddr32_t) : sizeof (caddr_t));
+	envp = kmem_alloc(envpsz, KM_SLEEP);
+
+	/*
+	 * Extract the env array from the target process.
+	 */
+	if ((error = prreadbuf(p, up->u_envp, (uint8_t *)envp, envpsz,
+	    NULL)) != 0) {
+		kmem_free(envp, envpsz);
+		mutex_enter(&p->p_lock);
+		VERIFY(p->p_proc_flag & P_PR_LOCK);
+		return (-1);
+	}
+
+	/*
+	 * Read each env string from the pointers in the env array.
+	 */
+	pos = 0;
+	for (i = 0; i < cnt; i++) {
+		size_t rdsz, trysz;
+		uintptr_t ev;
+		off_t j;
+		boolean_t found_nul;
+		boolean_t do_retry = B_TRUE;
+
+#ifdef	_SYSCALL32_IMPL
+		if (p->p_model == DATAMODEL_ILP32) {
+			ev = (uintptr_t)((caddr32_t *)envp)[i];
+		} else {
+			ev = (uintptr_t)envp[i];
+		}
+#else
+		ev = (uintptr_t)envp[i];
+#endif
+
+		/*
+		 * Stop trying to read env entries if we reach a NULL
+		 * pointer in the vector.
+		 */
+		if (ev == NULL)
+			break;
+
+		/*
+		 * Stop reading if we have read the maximum length
+		 * we can return to the user.
+		 */
+		if (pos >= bufsz)
+			break;
+
+		/*
+		 * Initially we try a short read, on the assumption that
+		 * most individual env strings are less than 80
+		 * characters long.
+		 */
+		if ((trysz = MIN(80, bufsz - pos - 1)) < 80) {
+			/*
+			 * We don't have room in the target buffer for even
+			 * an entire short read, so there is no need to retry
+			 * with a longer read.
+			 */
+			do_retry = B_FALSE;
+		}
+
+retry:
+		/*
+		 * Read string data for this env var.  Leave room
+		 * in the buffer for a final NUL terminator.
+		 */
+		if ((error = prreadbuf(p, ev, (uint8_t *)&buf[pos], trysz,
+		    &rdsz)) != 0) {
+			/*
+			 * There was a problem reading this string
+			 * from the process.  Give up.
+			 */
+			break;
+		}
+
+		/*
+		 * Find the NUL terminator.
+		 */
+		found_nul = B_FALSE;
+		for (j = 0; j < rdsz; j++) {
+			if (buf[pos + j] == '\0') {
+				found_nul = B_TRUE;
+				break;
+			}
+		}
+
+		if (!found_nul && do_retry) {
+			/*
+			 * We did not find a NUL terminator, but this
+			 * was a first pass short read.  Try once more
+			 * with feeling.
+			 */
+			trysz = bufsz - pos - 1;
+			do_retry = B_FALSE;
+			goto retry;
+		}
+
+		/*
+		 * Commit the string we read to the buffer.
+		 */
+		pos += j + 1;
+		if (!found_nul && pos < bufsz) {
+			/*
+			 * A NUL terminator was not found; add one.
+			 */
+			buf[pos++] = '\0';
+		}
+	}
+
+	/*
+	 * Ensure the entire string is NUL-terminated.
+	 */
+	buf[bufsz - 1] = '\0';
+
+	mutex_enter(&p->p_lock);
+	VERIFY(p->p_proc_flag & P_PR_LOCK);
+	kmem_free(envp, envpsz);
+
+	/*
+	 * If the operation was a success, return the copied string length
+	 * to the caller.
+	 */
+	*slen = (error == 0) ? pos : 0;
+
+	return (error);
+}
diff --git a/usr/src/uts/common/fs/proc/prcontrol.c b/usr/src/uts/common/fs/proc/prcontrol.c
index 6b151a6369..07dcb1e7db 100644
--- a/usr/src/uts/common/fs/proc/prcontrol.c
+++ b/usr/src/uts/common/fs/proc/prcontrol.c
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -1481,7 +1481,7 @@ pr_setsig(prnode_t *pnp, siginfo_t *sip)
 		} else if (t->t_state == TS_STOPPED && sig == SIGKILL) {
 			/* If SIGKILL, set stopped lwp running */
 			p->p_stopsig = 0;
-			t->t_schedflag |= TS_XSTART | TS_PSTART;
+			t->t_schedflag |= TS_XSTART | TS_PSTART | TS_BSTART;
 			t->t_dtrace_stop = 0;
 			setrun_locked(t);
 		}
@@ -2276,9 +2276,17 @@ pr_szoneid(proc_t *p, zoneid_t zoneid, cred_t *cr)
 		return (EPERM);
 	if (zoneid != GLOBAL_ZONEID && zoneid != p->p_zone->zone_id)
 		return (EINVAL);
-	if ((zptr = zone_find_by_id(zoneid)) == NULL)
-		return (EINVAL);
+	/*
+	 * We cannot hold p_lock when we call zone_find_by_id since that can
+	 * lead to a deadlock. zone_find_by_id() takes zonehash_lock.
+	 * zone_enter() can hold the zonehash_lock and needs p_lock when it
+	 * calls task_join.
+	 */
 	mutex_exit(&p->p_lock);
+	if ((zptr = zone_find_by_id(zoneid)) == NULL) {
+		mutex_enter(&p->p_lock);
+		return (EINVAL);
+	}
 	mutex_enter(&p->p_crlock);
 	oldcred = p->p_cred;
 	crhold(oldcred);
diff --git a/usr/src/uts/common/fs/proc/prdata.h b/usr/src/uts/common/fs/proc/prdata.h
index 70daaf8767..35a76597b2 100644
--- a/usr/src/uts/common/fs/proc/prdata.h
+++ b/usr/src/uts/common/fs/proc/prdata.h
@@ -27,7 +27,7 @@
 /*	  All Rights Reserved	*/
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef _SYS_PROC_PRDATA_H
@@ -123,6 +123,7 @@ typedef enum prnodetype {
 #if defined(__i386) || defined(__amd64)
 	PR_LDT,			/* /proc/<pid>/ldt			*/
 #endif
+	PR_ARGV,		/* /proc/<pid>/argv			*/
 	PR_USAGE,		/* /proc/<pid>/usage			*/
 	PR_LUSAGE,		/* /proc/<pid>/lusage			*/
 	PR_PAGEDATA,		/* /proc/<pid>/pagedata			*/
@@ -348,6 +349,8 @@ extern	int	pr_unset(proc_t *, long);
 extern	void	pr_sethold(prnode_t *, sigset_t *);
 extern	void	pr_setfault(proc_t *, fltset_t *);
 extern	int	prusrio(proc_t *, enum uio_rw, struct uio *, int);
+extern	int	prreadargv(proc_t *, char *, size_t, size_t *);
+extern	int	prreadenvv(proc_t *, char *, size_t, size_t *);
 extern	int	prwritectl(vnode_t *, struct uio *, cred_t *);
 extern	int	prlock(prnode_t *, int);
 extern	void	prunmark(proc_t *);
@@ -374,6 +377,7 @@ extern	int	clear_watched_area(proc_t *, struct watched_area *);
 extern	void	pr_free_watchpoints(proc_t *);
 extern	proc_t	*pr_cancel_watch(prnode_t *);
 extern	struct seg *break_seg(proc_t *);
+extern	void	prgethold(kthread_t *, sigset_t *);
 
 /*
  * Machine-dependent routines (defined in prmachdep.c).
diff --git a/usr/src/uts/common/fs/proc/prioctl.c b/usr/src/uts/common/fs/proc/prioctl.c
index 3ed40c5d96..470c66362b 100644
--- a/usr/src/uts/common/fs/proc/prioctl.c
+++ b/usr/src/uts/common/fs/proc/prioctl.c
@@ -136,24 +136,12 @@ prctioctl(prnode_t *pnp, int cmd, intptr_t arg, int flag, cred_t *cr)
 /*ARGSUSED*/
 #ifdef _SYSCALL32_IMPL
 static int
-prioctl64(
-	struct vnode *vp,
-	int cmd,
-	intptr_t arg,
-	int flag,
-	cred_t *cr,
-	int *rvalp,
-	caller_context_t *ct)
+prioctl64(struct vnode *vp, int cmd, intptr_t arg, int flag, cred_t *cr,
+    int *rvalp, caller_context_t *ct)
 #else
 int
-prioctl(
-	struct vnode *vp,
-	int cmd,
-	intptr_t arg,
-	int flag,
-	cred_t *cr,
-	int *rvalp,
-	caller_context_t *ct)
+prioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, cred_t *cr,
+    int *rvalp, caller_context_t *ct)
 #endif	/* _SYSCALL32_IMPL */
 {
 	int nsig = PROC_IS_BRANDED(curproc)? BROP(curproc)->b_nsig : NSIG;
@@ -942,8 +930,7 @@ startover:
 	}
 
 	case PIOCGHOLD:		/* get signal-hold mask */
-		schedctl_finish_sigblock(t);
-		sigktou(&t->t_hold, &un.holdmask);
+		prgethold(t, &un.holdmask);
 		prunlock(pnp);
 		if (copyout(&un.holdmask, cmaddr, sizeof (un.holdmask)))
 			error = EFAULT;
@@ -1407,8 +1394,7 @@ oprgetstatus32(kthread_t *t, prstatus32_t *sp, zone_t *zp)
 	sp->pr_cursig  = lwp->lwp_cursig;
 	prassignset(&sp->pr_sigpend, &p->p_sig);
 	prassignset(&sp->pr_lwppend, &t->t_sig);
-	schedctl_finish_sigblock(t);
-	prassignset(&sp->pr_sighold, &t->t_hold);
+	prgethold(t, &sp->pr_sighold);
 	sp->pr_altstack.ss_sp =
 	    (caddr32_t)(uintptr_t)lwp->lwp_sigaltstack.ss_sp;
 	sp->pr_altstack.ss_size = (size32_t)lwp->lwp_sigaltstack.ss_size;
@@ -1685,14 +1671,8 @@ oprgetpsinfo32(proc_t *p, prpsinfo32_t *psp, kthread_t *tp)
 
 /*ARGSUSED*/
 static int
-prioctl32(
-	struct vnode *vp,
-	int cmd,
-	intptr_t arg,
-	int flag,
-	cred_t *cr,
-	int *rvalp,
-	caller_context_t *ct)
+prioctl32(struct vnode *vp, int cmd, intptr_t arg, int flag, cred_t *cr,
+    int *rvalp, caller_context_t *ct)
 {
 	int nsig = PROC_IS_BRANDED(curproc)? BROP(curproc)->b_nsig : NSIG;
 	caddr_t cmaddr = (caddr_t)arg;
@@ -2569,8 +2549,7 @@ startover:
 	}
 
 	case PIOCGHOLD:		/* get signal-hold mask */
-		schedctl_finish_sigblock(t);
-		sigktou(&t->t_hold, &un32.holdmask);
+		prgethold(t, &un32.holdmask);
 		prunlock(pnp);
 		if (copyout(&un32.holdmask, cmaddr, sizeof (un32.holdmask)))
 			error = EFAULT;
@@ -3247,8 +3226,7 @@ oprgetstatus(kthread_t *t, prstatus_t *sp, zone_t *zp)
 	sp->pr_cursig  = lwp->lwp_cursig;
 	prassignset(&sp->pr_sigpend, &p->p_sig);
 	prassignset(&sp->pr_lwppend, &t->t_sig);
-	schedctl_finish_sigblock(t);
-	prassignset(&sp->pr_sighold, &t->t_hold);
+	prgethold(t, &sp->pr_sighold);
 	sp->pr_altstack = lwp->lwp_sigaltstack;
 	prgetaction(p, up, lwp->lwp_cursig, &sp->pr_action);
 	sp->pr_pid   = p->p_pid;
diff --git a/usr/src/uts/common/fs/proc/prsubr.c b/usr/src/uts/common/fs/proc/prsubr.c
index a2ab06d769..2062970885 100644
--- a/usr/src/uts/common/fs/proc/prsubr.c
+++ b/usr/src/uts/common/fs/proc/prsubr.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -148,6 +148,11 @@ prchoose(proc_t *p)
 			continue;
 		}
 
+		/* If this is a process kernel thread, ignore it. */
+		if ((t->t_proc_flag & TP_KTHREAD) != 0) {
+			continue;
+		}
+
 		thread_lock(t);		/* make sure thread is in good state */
 		switch (t->t_state) {
 		default:
@@ -201,6 +206,7 @@ prchoose(proc_t *p)
 			case PR_SYSEXIT:
 			case PR_SIGNALLED:
 			case PR_FAULTED:
+			case PR_BRAND:
 				/*
 				 * Make an lwp calling exit() be the
 				 * last lwp seen in the process.
@@ -534,6 +540,12 @@ prexecend(void)
 			pcp->prc_tslot = tslot;
 		}
 	}
+
+	/*
+	 * There may be threads waiting for the flag change blocked behind the
+	 * pr_pid_cv as well.
+	 */
+	cv_signal(&pr_pid_cv[p->p_slot]);
 }
 
 /*
@@ -919,6 +931,29 @@ prgetstatus(proc_t *p, pstatus_t *sp, zone_t *zp)
 	sp->pr_flags = sp->pr_lwp.pr_flags;
 }
 
+/*
+ * Query mask of held signals for a given thread.
+ *
+ * This makes use of schedctl_sigblock() to query if userspace has requested
+ * that all maskable signals be held.  While it would be tempting to call
+ * schedctl_finish_sigblock() and apply that update to t->t_hold, it cannot be
+ * done safely without the risk of racing with the thread under consideration.
+ */
+void
+prgethold(kthread_t *t, sigset_t *sp)
+{
+	k_sigset_t set;
+
+	if (schedctl_sigblock(t)) {
+		set.__sigbits[0] = FILLSET0 & ~CANTMASK0;
+		set.__sigbits[1] = FILLSET1 & ~CANTMASK1;
+		set.__sigbits[2] = FILLSET2 & ~CANTMASK2;
+	} else {
+		set = t->t_hold;
+	}
+	sigktou(&set, sp);
+}
+
 #ifdef _SYSCALL32_IMPL
 void
 prgetlwpstatus32(kthread_t *t, lwpstatus32_t *sp, zone_t *zp)
@@ -980,8 +1015,7 @@ prgetlwpstatus32(kthread_t *t, lwpstatus32_t *sp, zone_t *zp)
 	sp->pr_lwpid = t->t_tid;
 	sp->pr_cursig  = lwp->lwp_cursig;
 	prassignset(&sp->pr_lwppend, &t->t_sig);
-	schedctl_finish_sigblock(t);
-	prassignset(&sp->pr_lwphold, &t->t_hold);
+	prgethold(t, &sp->pr_lwphold);
 	if (t->t_whystop == PR_FAULTED) {
 		siginfo_kto32(&lwp->lwp_siginfo, &sp->pr_info);
 		if (t->t_whatstop == FLTPAGE)
@@ -1212,8 +1246,7 @@ prgetlwpstatus(kthread_t *t, lwpstatus_t *sp, zone_t *zp)
 	sp->pr_lwpid = t->t_tid;
 	sp->pr_cursig  = lwp->lwp_cursig;
 	prassignset(&sp->pr_lwppend, &t->t_sig);
-	schedctl_finish_sigblock(t);
-	prassignset(&sp->pr_lwphold, &t->t_hold);
+	prgethold(t, &sp->pr_lwphold);
 	if (t->t_whystop == PR_FAULTED)
 		bcopy(&lwp->lwp_siginfo,
 		    &sp->pr_info, sizeof (k_siginfo_t));
@@ -2591,7 +2624,6 @@ prgetlwpsinfo(kthread_t *t, lwpsinfo_t *psp)
 void
 prgetlwpsinfo32(kthread_t *t, lwpsinfo32_t *psp)
 {
-	proc_t *p = ttoproc(t);
 	klwp_t *lwp = ttolwp(t);
 	sobj_ops_t *sobj;
 	char c, state;
@@ -2599,7 +2631,7 @@ prgetlwpsinfo32(kthread_t *t, lwpsinfo32_t *psp)
 	int retval, niceval;
 	hrtime_t hrutime, hrstime;
 
-	ASSERT(MUTEX_HELD(&p->p_lock));
+	ASSERT(MUTEX_HELD(&ttoproc(t)->p_lock));
 
 	bzero(psp, sizeof (*psp));
 
diff --git a/usr/src/uts/common/fs/proc/prvnops.c b/usr/src/uts/common/fs/proc/prvnops.c
index fdef53dc2e..fa5f637f05 100644
--- a/usr/src/uts/common/fs/proc/prvnops.c
+++ b/usr/src/uts/common/fs/proc/prvnops.c
@@ -97,6 +97,11 @@ struct prdirect {
 #define	PRSDSIZE	(sizeof (struct prdirect))
 
 /*
+ * Maximum length of the /proc/$$/argv file:
+ */
+int prmaxargvlen = 4096;
+
+/*
  * Directory characteristics.
  */
 typedef struct prdirent {
@@ -169,6 +174,8 @@ static prdirent_t piddir[] = {
 	{ PR_LDT,	28 * sizeof (prdirent_t), sizeof (prdirent_t),
 		"ldt" },
 #endif
+	{ PR_ARGV,	28 * sizeof (prdirent_t), sizeof (prdirent_t),
+		"argv" },
 };
 
 #define	NPIDDIRFILES	(sizeof (piddir) / sizeof (piddir[0]) - 2)
@@ -585,6 +592,7 @@ static int pr_read_inval(), pr_read_as(), pr_read_status(),
 #if defined(__x86)
 	pr_read_ldt(),
 #endif
+	pr_read_argv(),
 	pr_read_usage(), pr_read_lusage(), pr_read_pagedata(),
 	pr_read_watch(), pr_read_lwpstatus(), pr_read_lwpsinfo(),
 	pr_read_lwpusage(), pr_read_xregs(), pr_read_priv(),
@@ -613,6 +621,7 @@ static int (*pr_read_function[PR_NFILES])() = {
 #if defined(__x86)
 	pr_read_ldt,		/* /proc/<pid>/ldt			*/
 #endif
+	pr_read_argv,		/* /proc/<pid>/argv			*/
 	pr_read_usage,		/* /proc/<pid>/usage			*/
 	pr_read_lusage,		/* /proc/<pid>/lusage			*/
 	pr_read_pagedata,	/* /proc/<pid>/pagedata			*/
@@ -676,6 +685,41 @@ pr_uioread(void *base, long count, uio_t *uiop)
 }
 
 static int
+pr_read_argv(prnode_t *pnp, uio_t *uiop)
+{
+	char *args;
+	int error;
+	size_t asz = prmaxargvlen, sz;
+
+	/*
+	 * Allocate a scratch buffer for collection of the process arguments.
+	 */
+	args = kmem_alloc(asz, KM_SLEEP);
+
+	ASSERT(pnp->pr_type == PR_ARGV);
+
+	if ((error = prlock(pnp, ZNO)) != 0) {
+		kmem_free(args, asz);
+		return (error);
+	}
+
+	if ((error = prreadargv(pnp->pr_common->prc_proc, args, asz,
+	    &sz)) != 0) {
+		prunlock(pnp);
+		kmem_free(args, asz);
+		return (error);
+	}
+
+	prunlock(pnp);
+
+	error = pr_uioread(args, sz, uiop);
+
+	kmem_free(args, asz);
+
+	return (error);
+}
+
+static int
 pr_read_as(prnode_t *pnp, uio_t *uiop)
 {
 	int error;
@@ -1795,6 +1839,7 @@ static int (*pr_read_function_32[PR_NFILES])() = {
 #if defined(__x86)
 	pr_read_ldt,		/* /proc/<pid>/ldt			*/
 #endif
+	pr_read_argv,		/* /proc/<pid>/argv			*/
 	pr_read_usage_32,	/* /proc/<pid>/usage			*/
 	pr_read_lusage_32,	/* /proc/<pid>/lusage			*/
 	pr_read_pagedata_32,	/* /proc/<pid>/pagedata			*/
@@ -2720,6 +2765,103 @@ prread(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr, caller_context_t *ct)
 #endif
 }
 
+/*
+ * We make pr_write_psinfo_fname() somewhat simpler by asserting at compile
+ * time that PRFNSZ has the same definition as MAXCOMLEN.
+ */
+#if PRFNSZ != MAXCOMLEN
+#error PRFNSZ/MAXCOMLEN mismatch
+#endif
+
+static int
+pr_write_psinfo_fname(prnode_t *pnp, uio_t *uiop)
+{
+	char fname[PRFNSZ];
+	int offset = offsetof(psinfo_t, pr_fname), error;
+
+#ifdef _SYSCALL32_IMPL
+	if (curproc->p_model != DATAMODEL_LP64)
+		offset = offsetof(psinfo32_t, pr_fname);
+#endif
+
+	/*
+	 * If this isn't a write to pr_fname (or if the size doesn't match
+	 * PRFNSZ) return.
+	 */
+	if (uiop->uio_offset != offset || uiop->uio_resid != PRFNSZ)
+		return (0);
+
+	if ((error = uiomove(fname, PRFNSZ, UIO_WRITE, uiop)) != 0)
+		return (error);
+
+	fname[PRFNSZ - 1] = '\0';
+
+	if ((error = prlock(pnp, ZNO)) != 0)
+		return (error);
+
+	bcopy(fname, pnp->pr_common->prc_proc->p_user.u_comm, PRFNSZ);
+
+	prunlock(pnp);
+
+	return (0);
+}
+
+/*
+ * We make pr_write_psinfo_psargs() somewhat simpler by asserting at compile
+ * time that PRARGSZ has the same definition as PSARGSZ.
+ */
+#if PRARGSZ != PSARGSZ
+#error PRARGSZ/PSARGSZ mismatch
+#endif
+
+static int
+pr_write_psinfo_psargs(prnode_t *pnp, uio_t *uiop)
+{
+	char psargs[PRARGSZ];
+	int offset = offsetof(psinfo_t, pr_psargs), error;
+
+#ifdef _SYSCALL32_IMPL
+	if (curproc->p_model != DATAMODEL_LP64)
+		offset = offsetof(psinfo32_t, pr_psargs);
+#endif
+
+	/*
+	 * If this isn't a write to pr_psargs (or if the size doesn't match
+	 * PRARGSZ) return.
+	 */
+	if (uiop->uio_offset != offset || uiop->uio_resid != PRARGSZ)
+		return (0);
+
+	if ((error = uiomove(psargs, PRARGSZ, UIO_WRITE, uiop)) != 0)
+		return (error);
+
+	psargs[PRARGSZ - 1] = '\0';
+
+	if ((error = prlock(pnp, ZNO)) != 0)
+		return (error);
+
+	bcopy(psargs, pnp->pr_common->prc_proc->p_user.u_psargs, PRARGSZ);
+
+	prunlock(pnp);
+
+	return (0);
+}
+
+int
+pr_write_psinfo(prnode_t *pnp, uio_t *uiop)
+{
+	int error;
+
+	if ((error = pr_write_psinfo_fname(pnp, uiop)) != 0)
+		return (error);
+
+	if ((error = pr_write_psinfo_psargs(pnp, uiop)) != 0)
+		return (error);
+
+	return (0);
+}
+
+
 /* ARGSUSED */
 static int
 prwrite(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr, caller_context_t *ct)
@@ -2798,6 +2940,9 @@ prwrite(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr, caller_context_t *ct)
 			uiop->uio_resid = resid;
 		return (error);
 
+	case PR_PSINFO:
+		return (pr_write_psinfo(pnp, uiop));
+
 	default:
 		return ((vp->v_type == VDIR)? EISDIR : EBADF);
 	}
@@ -3084,6 +3229,13 @@ prgetattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
 	case PR_AUXV:
 		vap->va_size = __KERN_NAUXV_IMPL * PR_OBJSIZE(auxv32_t, auxv_t);
 		break;
+	case PR_ARGV:
+		if ((p->p_flag & SSYS) || p->p_as == &kas) {
+			vap->va_size = PSARGSZ;
+		} else {
+			vap->va_size = prmaxargvlen;
+		}
+		break;
 #if defined(__x86)
 	case PR_LDT:
 		mutex_exit(&p->p_lock);
@@ -3260,6 +3412,7 @@ praccess(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
 	case PR_USAGE:
 	case PR_LUSAGE:
 	case PR_LWPUSAGE:
+	case PR_ARGV:
 		p = pr_p_lock(pnp);
 		mutex_exit(&pr_pidlock);
 		if (p == NULL)
@@ -3345,6 +3498,7 @@ static vnode_t *(*pr_lookup_function[PR_NFILES])() = {
 #if defined(__x86)
 	pr_lookup_notdir,	/* /proc/<pid>/ldt			*/
 #endif
+	pr_lookup_notdir,	/* /proc/<pid>/argv			*/
 	pr_lookup_notdir,	/* /proc/<pid>/usage			*/
 	pr_lookup_notdir,	/* /proc/<pid>/lusage			*/
 	pr_lookup_notdir,	/* /proc/<pid>/pagedata			*/
@@ -4622,11 +4776,15 @@ prgetnode(vnode_t *dp, prnodetype_t type)
 		break;
 
 	case PR_PSINFO:
+		pnp->pr_mode = 0644;	/* readable by all + owner can write */
+		break;
+
 	case PR_LPSINFO:
 	case PR_LWPSINFO:
 	case PR_USAGE:
 	case PR_LUSAGE:
 	case PR_LWPUSAGE:
+	case PR_ARGV:
 		pnp->pr_mode = 0444;	/* read-only by all */
 		break;
 
@@ -4732,6 +4890,7 @@ static int (*pr_readdir_function[PR_NFILES])() = {
 #if defined(__x86)
 	pr_readdir_notdir,	/* /proc/<pid>/ldt			*/
 #endif
+	pr_readdir_notdir,	/* /proc/<pid>/argv			*/
 	pr_readdir_notdir,	/* /proc/<pid>/usage			*/
 	pr_readdir_notdir,	/* /proc/<pid>/lusage			*/
 	pr_readdir_notdir,	/* /proc/<pid>/pagedata			*/
@@ -4882,6 +5041,7 @@ pr_readdir_piddir(prnode_t *pnp, uio_t *uiop, int *eofp)
 			case PR_PROCDIR:
 			case PR_PSINFO:
 			case PR_USAGE:
+			case PR_ARGV:
 				break;
 			default:
 				continue;
diff --git a/usr/src/uts/common/fs/smbsrv/smb_kshare.c b/usr/src/uts/common/fs/smbsrv/smb_kshare.c
index 126eb9f82e..62d2c080b6 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_kshare.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_kshare.c
@@ -362,6 +362,7 @@ smb_kshare_g_fini(void)
 	kmem_cache_destroy(smb_kshare_cache_vfs);
 }
 
+
 /*
  * A list of shares in nvlist format can be sent down
  * from userspace thourgh the IOCTL interface. The nvlist
diff --git a/usr/src/uts/common/fs/smbsrv/smb_server.c b/usr/src/uts/common/fs/smbsrv/smb_server.c
index b2507b6e71..46b852f0fb 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_server.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_server.c
@@ -847,6 +847,22 @@ smb_server_enum(smb_ioc_svcenum_t *ioc)
 	smb_svcenum_t	*svcenum = &ioc->svcenum;
 	smb_server_t	*sv;
 	int		rc;
+	uint32_t	buflen_adjusted;
+
+	/*
+	 * Reality check that the buffer-length insize the enum doesn't
+	 * overrun the ioctl's total length.
+	 *
+	 * NOTE: Assume se_buf is at the end of smb_svcenum_t.
+	 */
+	buflen_adjusted = svcenum->se_buflen +
+	    offsetof(smb_svcenum_t, se_buf) + sizeof (ioc->hdr);
+	if (buflen_adjusted < svcenum->se_buflen ||	/* Overflow check 1, */
+	    buflen_adjusted < offsetof(smb_svcenum_t, se_buf) || /* check 2, */
+	    buflen_adjusted < sizeof (ioc->hdr) ||	/* check 3. */
+	    buflen_adjusted > ioc->hdr.len) {
+		return (EINVAL);
+	}
 
 	/*
 	 * Reality check that the buffer-length insize the enum doesn't
diff --git a/usr/src/uts/common/fs/sockfs/sockcommon.c b/usr/src/uts/common/fs/sockfs/sockcommon.c
index 87e29b21ae..e7d69f9896 100644
--- a/usr/src/uts/common/fs/sockfs/sockcommon.c
+++ b/usr/src/uts/common/fs/sockfs/sockcommon.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  * Copyright 2017 Sebastian Wiedenroth
  */
 
@@ -504,6 +505,9 @@ sonode_constructor(void *buf, void *cdrarg, int kmflags)
 	cv_init(&so->so_copy_cv, NULL, CV_DEFAULT, NULL);
 	cv_init(&so->so_closing_cv, NULL, CV_DEFAULT, NULL);
 
+	so->so_krecv_cb = NULL;
+	so->so_krecv_arg = NULL;
+
 	return (0);
 }
 
@@ -657,6 +661,10 @@ sonode_fini(struct sonode *so)
 	if (so->so_filter_top != NULL)
 		sof_sonode_cleanup(so);
 
+	/* Clean up any remnants of krecv callbacks */
+	so->so_krecv_cb = NULL;
+	so->so_krecv_arg = NULL;
+
 	ASSERT(list_is_empty(&so->so_acceptq_list));
 	ASSERT(list_is_empty(&so->so_acceptq_defer));
 	ASSERT(!list_link_active(&so->so_acceptq_node));
diff --git a/usr/src/uts/common/fs/sockfs/sockcommon_sops.c b/usr/src/uts/common/fs/sockfs/sockcommon_sops.c
index e5bc6dc845..9b8186a8a0 100644
--- a/usr/src/uts/common/fs/sockfs/sockcommon_sops.c
+++ b/usr/src/uts/common/fs/sockfs/sockcommon_sops.c
@@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
  */
 
 #include <sys/types.h>
@@ -128,7 +128,7 @@ so_bind(struct sonode *so, struct sockaddr *name, socklen_t namelen,
 {
 	int error;
 
-	SO_BLOCK_FALLBACK(so, SOP_BIND(so, name, namelen, flags, cr));
+	SO_BLOCK_FALLBACK_SAFE(so, SOP_BIND(so, name, namelen, flags, cr));
 
 	ASSERT(flags == _SOBIND_XPG4_2 || flags == _SOBIND_SOCKBSD);
 
@@ -305,7 +305,7 @@ so_connect(struct sonode *so, struct sockaddr *name,
 	 * This can happen if a non blocking operation caused an error.
 	 */
 
-	if (so->so_error != 0) {
+	if (so->so_error != 0 && (so->so_mode & SM_DEFERERR) == 0) {
 		mutex_enter(&so->so_lock);
 		error = sogeterr(so, B_TRUE);
 		mutex_exit(&so->so_lock);
@@ -404,7 +404,7 @@ so_sendmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
 			break;
 		}
 
-		if (so->so_error != 0) {
+		if (so->so_error != 0 && (so->so_mode & SM_DEFERERR) == 0) {
 			mutex_enter(&so->so_lock);
 			error = sogeterr(so, B_TRUE);
 			mutex_exit(&so->so_lock);
@@ -513,7 +513,7 @@ so_sendmblk_impl(struct sonode *so, struct nmsghdr *msg, int fflag,
 			error = EPIPE;
 			break;
 		}
-		if (so->so_error != 0) {
+		if (so->so_error != 0 && (so->so_mode & SM_DEFERERR) == 0) {
 			mutex_enter(&so->so_lock);
 			error = sogeterr(so, B_TRUE);
 			mutex_exit(&so->so_lock);
@@ -586,11 +586,6 @@ so_sendmblk(struct sonode *so, struct nmsghdr *msg, int fflag,
 
 	SO_BLOCK_FALLBACK(so, SOP_SENDMBLK(so, msg, fflag, cr, mpp));
 
-	if ((so->so_mode & SM_SENDFILESUPP) == 0) {
-		SO_UNBLOCK_FALLBACK(so);
-		return (EOPNOTSUPP);
-	}
-
 	error = so_sendmblk_impl(so, msg, fflag, cr, mpp, so->so_filter_top,
 	    B_FALSE);
 
@@ -653,7 +648,7 @@ so_getsockname(struct sonode *so, struct sockaddr *addr,
 {
 	int error;
 
-	SO_BLOCK_FALLBACK(so, SOP_GETSOCKNAME(so, addr, addrlen, cr));
+	SO_BLOCK_FALLBACK_SAFE(so, SOP_GETSOCKNAME(so, addr, addrlen, cr));
 
 	if (so->so_filter_active == 0 ||
 	    (error = sof_filter_getsockname(so, addr, addrlen, cr)) < 0)
@@ -702,7 +697,7 @@ so_getsockopt(struct sonode *so, int level, int option_name,
 	if (level == SOL_FILTER)
 		return (sof_getsockopt(so, option_name, optval, optlenp, cr));
 
-	SO_BLOCK_FALLBACK(so,
+	SO_BLOCK_FALLBACK_SAFE(so,
 	    SOP_GETSOCKOPT(so, level, option_name, optval, optlenp, flags, cr));
 
 	if ((so->so_filter_active == 0 ||
@@ -791,7 +786,7 @@ so_setsockopt(struct sonode *so, int level, int option_name,
 	if (level == SOL_FILTER)
 		return (sof_setsockopt(so, option_name, optval, optlen, cr));
 
-	SO_BLOCK_FALLBACK(so,
+	SO_BLOCK_FALLBACK_SAFE(so,
 	    SOP_SETSOCKOPT(so, level, option_name, optval, optlen, cr));
 
 	/* X/Open requires this check */
@@ -876,7 +871,7 @@ so_ioctl(struct sonode *so, int cmd, intptr_t arg, int mode,
 	 * If there is a pending error, return error
 	 * This can happen if a non blocking operation caused an error.
 	 */
-	if (so->so_error != 0) {
+	if (so->so_error != 0 && (so->so_mode & SM_DEFERERR) == 0) {
 		mutex_enter(&so->so_lock);
 		error = sogeterr(so, B_TRUE);
 		mutex_exit(&so->so_lock);
@@ -1329,6 +1324,26 @@ so_queue_msg_impl(struct sonode *so, mblk_t *mp,
 		}
 	}
 
+	mutex_enter(&so->so_lock);
+	if (so->so_krecv_cb != NULL) {
+		boolean_t cont;
+		so_krecv_f func = so->so_krecv_cb;
+		void *arg = so->so_krecv_arg;
+
+		mutex_exit(&so->so_lock);
+		cont = func(so, mp, msg_size, flags & MSG_OOB, arg);
+		mutex_enter(&so->so_lock);
+		if (cont == B_TRUE) {
+			space_left = so->so_rcvbuf;
+		} else {
+			so->so_rcv_queued = so->so_rcvlowat;
+			*errorp = ENOSPC;
+			space_left = -1;
+		}
+		goto done_unlock;
+	}
+	mutex_exit(&so->so_lock);
+
 	if (flags & MSG_OOB) {
 		so_queue_oob(so, mp, msg_size);
 		mutex_enter(&so->so_lock);
@@ -1607,6 +1622,13 @@ so_recvmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
 		return (ENOTCONN);
 	}
 
+	mutex_enter(&so->so_lock);
+	if (so->so_krecv_cb != NULL) {
+		mutex_exit(&so->so_lock);
+		return (EOPNOTSUPP);
+	}
+	mutex_exit(&so->so_lock);
+
 	if (msg->msg_flags & MSG_PEEK)
 		msg->msg_flags &= ~MSG_WAITALL;
 
diff --git a/usr/src/uts/common/fs/sockfs/sockcommon_subr.c b/usr/src/uts/common/fs/sockfs/sockcommon_subr.c
index 957c8f93b4..7bdd64393b 100644
--- a/usr/src/uts/common/fs/sockfs/sockcommon_subr.c
+++ b/usr/src/uts/common/fs/sockfs/sockcommon_subr.c
@@ -24,6 +24,7 @@
  */
 /*
  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -670,10 +671,15 @@ so_dequeue_msg(struct sonode *so, mblk_t **mctlp, struct uio *uiop,
 	int more = 0;
 	int error;
 	ssize_t oobmark;
+	ssize_t copied = 0;
 	sodirect_t *sodp = so->so_direct;
+	xuio_t *xuio = NULL;
 
 	partial_read = B_FALSE;
 	*mctlp = NULL;
+	if ((uiop->uio_extflg & UIO_XUIO) != 0) {
+		xuio = (xuio_t *)uiop;
+	}
 again:
 	mutex_enter(&so->so_lock);
 again1:
@@ -784,8 +790,6 @@ again1:
 		 * enabled socket, uio_resid can be 0.
 		 */
 		if (uiop->uio_resid >= 0) {
-			ssize_t copied = 0;
-
 			if (sodp != NULL && (DB_FLAGS(mp) & DBLK_UIOA)) {
 				mutex_enter(&so->so_lock);
 				ASSERT(uiop == (uio_t *)&sodp->sod_uioa);
@@ -843,6 +847,18 @@ again1:
 		}
 		if (mp != NULL) { /* more data blocks in msg */
 			more |= MOREDATA;
+
+			/*
+			 * If requested, tally up remaining data along with the
+			 * amount already copied.
+			 */
+			if (xuio != NULL &&
+			    xuio->xu_type == UIOTYPE_PEEKSIZE) {
+				xuio->xu_ext.xu_ps.xu_ps_set = B_TRUE;
+				xuio->xu_ext.xu_ps.xu_ps_size =
+				    copied + msgdsize(mp);
+			}
+
 			if ((flags & (MSG_PEEK|MSG_TRUNC))) {
 				if (flags & MSG_PEEK) {
 					freemsg(mp);
@@ -2276,9 +2292,9 @@ so_tpi_fallback(struct sonode *so, struct cred *cr)
 	fbfunc = sp->sp_smod_info->smod_proto_fallback_func;
 
 	/*
-	 * Cannot fallback if the socket has active filters
+	 * Cannot fallback if the socket has active filters or a krecv callback.
 	 */
-	if (so->so_filter_active > 0)
+	if (so->so_filter_active > 0 || so->so_krecv_cb != NULL)
 		return (EINVAL);
 
 	switch (so->so_family) {
@@ -2456,3 +2472,50 @@ out:
 
 	return (error);
 }
+
+int
+so_krecv_set(sonode_t *so, so_krecv_f cb, void *arg)
+{
+	int ret;
+
+	if (cb == NULL && arg != NULL)
+		return (EINVAL);
+
+	SO_BLOCK_FALLBACK(so, so_krecv_set(so, cb, arg));
+
+	mutex_enter(&so->so_lock);
+	if (so->so_state & SS_FALLBACK_COMP) {
+		mutex_exit(&so->so_lock);
+		SO_UNBLOCK_FALLBACK(so);
+		return (ENOTSUP);
+	}
+
+	ret = so_lock_read(so, 0);
+	VERIFY(ret == 0);
+	/*
+	 * Other consumers may actually care about getting extant data delivered
+	 * to them, when they come along, they should figure out the best API
+	 * for that.
+	 */
+	so_rcv_flush(so);
+
+	so->so_krecv_cb = cb;
+	so->so_krecv_arg = arg;
+
+	so_unlock_read(so);
+	mutex_exit(&so->so_lock);
+	SO_UNBLOCK_FALLBACK(so);
+
+	return (0);
+}
+
+void
+so_krecv_unblock(sonode_t *so)
+{
+	mutex_enter(&so->so_lock);
+	VERIFY(so->so_krecv_cb != NULL);
+
+	so->so_rcv_queued = 0;
+	(void) so_check_flow_control(so);
+	mutex_exit(&so->so_lock);
+}
diff --git a/usr/src/uts/common/fs/sockfs/sockfilter.c b/usr/src/uts/common/fs/sockfs/sockfilter.c
index 971523945e..7dca6ae6fc 100644
--- a/usr/src/uts/common/fs/sockfs/sockfilter.c
+++ b/usr/src/uts/common/fs/sockfs/sockfilter.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #include <sys/systm.h>
@@ -246,6 +247,18 @@ sof_setsockopt_impl(struct sonode *so, int option_name,
 
 		/* Module loaded OK, so there must be an ops vector */
 		ASSERT(ent->sofe_mod != NULL);
+
+		/*
+		 * Check again to confirm ATTACH is ok. See if the the module
+		 * is not SOF_ATT_SAFE after an unsafe operation has taken
+		 * place.
+		 */
+		if ((ent->sofe_mod->sofm_flags & SOF_ATT_SAFE) == 0 &&
+		    so->so_state & SS_FILOP_UNSF) {
+			sof_instance_destroy(inst);
+			return (EINVAL);
+		}
+
 		inst->sofi_ops = &ent->sofe_mod->sofm_ops;
 
 		SOF_STAT_ADD(inst, tot_active_attach, 1);
@@ -1444,7 +1457,13 @@ sof_filter_ioctl(struct sonode *so, int cmd, intptr_t arg, int mode,
  * sof_register(version, name, ops, flags)
  *
  * Register a socket filter identified by name `name' and which should use
- * the ops vector `ops' for event notification. `flags' should be set to 0.
+ * the ops vector `ops' for event notification. `flags' should be set to 0
+ * by default for "unsafe" modules or SOF_ATT_SAFE for "safe" modules. An
+ * unsafe filter is one that cannot be attached after any socket operation has
+ * occured. This is the legacy default. A "safe" filter can be attached even
+ * after some basic initial socket operations have taken place. This set is
+ * currently bind, getsockname, getsockopt and setsockopt. The order in which
+ * a "safe" filter can be attached is more relaxed, and thus more flexible.
  * On success 0 is returned, otherwise an errno is returned.
  */
 int
@@ -1452,14 +1471,13 @@ sof_register(int version, const char *name, const sof_ops_t *ops, int flags)
 {
 	sof_module_t *mod;
 
-	_NOTE(ARGUNUSED(flags));
-
 	if (version != SOF_VERSION)
 		return (EINVAL);
 
 	mod = kmem_zalloc(sizeof (sof_module_t), KM_SLEEP);
 	mod->sofm_name = kmem_alloc(strlen(name) + 1, KM_SLEEP);
 	(void) strcpy(mod->sofm_name, name);
+	mod->sofm_flags = flags;
 	mod->sofm_ops = *ops;
 
 	mutex_enter(&sof_module_lock);
diff --git a/usr/src/uts/common/fs/sockfs/sockfilter_impl.h b/usr/src/uts/common/fs/sockfs/sockfilter_impl.h
index 7f7aece1f1..cf2ad8b20d 100644
--- a/usr/src/uts/common/fs/sockfs/sockfilter_impl.h
+++ b/usr/src/uts/common/fs/sockfs/sockfilter_impl.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SOCKFS_SOCKFILTER_H
@@ -51,6 +52,7 @@ typedef struct sof_kstat	sof_kstat_t;
 
 struct sof_module {
 	char		*sofm_name;
+	int		sofm_flags;
 	sof_ops_t	sofm_ops;
 	uint_t		sofm_refcnt;
 	list_node_t	sofm_node;
diff --git a/usr/src/uts/common/fs/sockfs/socksubr.c b/usr/src/uts/common/fs/sockfs/socksubr.c
index ed3c5967e1..7a7651edb5 100644
--- a/usr/src/uts/common/fs/sockfs/socksubr.c
+++ b/usr/src/uts/common/fs/sockfs/socksubr.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc. All rights reserved.
  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
  */
 
@@ -437,8 +438,10 @@ sogetoff(mblk_t *mp, t_uscalar_t offset,
  *
  * The underlying filesystem VSOCK vnode has a v_stream pointer that
  * references the actual stream head (hence indirectly the actual sonode).
+ *
+ * This function is non-static so it can be used by brand emulation.
  */
-static int
+int
 so_ux_lookup(struct sonode *so, struct sockaddr_un *soun, int checkaccess,
     vnode_t **vpp)
 {
@@ -1883,7 +1886,7 @@ ssize_t
 soreadfile(file_t *fp, uchar_t *buf, u_offset_t fileoff, int *err, size_t size)
 {
 	struct uio auio;
-	struct iovec aiov[MSG_MAXIOVLEN];
+	struct iovec aiov[1];
 	register vnode_t *vp;
 	int ioflag, rwflag;
 	ssize_t cnt;
diff --git a/usr/src/uts/common/fs/sockfs/socksyscalls.c b/usr/src/uts/common/fs/sockfs/socksyscalls.c
index 4cbd079539..e0b6b5de43 100644
--- a/usr/src/uts/common/fs/sockfs/socksyscalls.c
+++ b/usr/src/uts/common/fs/sockfs/socksyscalls.c
@@ -21,6 +21,8 @@
 
 /*
  * Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2015, Joyent, Inc.  All rights reserved.
  */
 
 /* Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved. */
@@ -54,6 +56,7 @@
 #include <sys/cmn_err.h>
 #include <sys/vmsystm.h>
 #include <sys/policy.h>
+#include <sys/limits.h>
 
 #include <sys/socket.h>
 #include <sys/socketvar.h>
@@ -86,12 +89,6 @@ extern void	nl7c_init(void);
 extern int	sockfs_defer_nl7c_init;
 
 /*
- * Note: DEF_IOV_MAX is defined and used as it is in "fs/vncalls.c"
- *	 as there isn't a formal definition of IOV_MAX ???
- */
-#define	MSG_MAXIOVLEN	16
-
-/*
  * Kernel component of socket creation.
  *
  * The socket library determines which version number to use.
@@ -1021,9 +1018,10 @@ recvmsg(int sock, struct nmsghdr *msg, int flags)
 	STRUCT_HANDLE(nmsghdr, umsgptr);
 	struct nmsghdr lmsg;
 	struct uio auio;
-	struct iovec aiov[MSG_MAXIOVLEN];
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	ssize_t iovsize = 0;
 	int iovcnt;
-	ssize_t len;
+	ssize_t len, rval;
 	int i;
 	int *flagsp;
 	model_t	model;
@@ -1066,22 +1064,37 @@ recvmsg(int sock, struct nmsghdr *msg, int flags)
 
 	iovcnt = lmsg.msg_iovlen;
 
-	if (iovcnt <= 0 || iovcnt > MSG_MAXIOVLEN) {
+	if (iovcnt <= 0 || iovcnt > IOV_MAX) {
 		return (set_errno(EMSGSIZE));
 	}
 
+	if (iovcnt > IOV_MAX_STACK) {
+		iovsize = iovcnt * sizeof (struct iovec);
+		aiov = kmem_alloc(iovsize, KM_SLEEP);
+	}
+
 #ifdef _SYSCALL32_IMPL
 	/*
 	 * 32-bit callers need to have their iovec expanded, while ensuring
 	 * that they can't move more than 2Gbytes of data in a single call.
 	 */
 	if (model == DATAMODEL_ILP32) {
-		struct iovec32 aiov32[MSG_MAXIOVLEN];
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		ssize_t iov32size;
 		ssize32_t count32;
 
-		if (copyin((struct iovec32 *)lmsg.msg_iov, aiov32,
-		    iovcnt * sizeof (struct iovec32)))
+		iov32size = iovcnt * sizeof (struct iovec32);
+		if (iovsize != 0)
+			aiov32 = kmem_alloc(iov32size, KM_SLEEP);
+
+		if (copyin((struct iovec32 *)lmsg.msg_iov, aiov32, iov32size)) {
+			if (iovsize != 0) {
+				kmem_free(aiov32, iov32size);
+				kmem_free(aiov, iovsize);
+			}
+
 			return (set_errno(EFAULT));
+		}
 
 		count32 = 0;
 		for (i = 0; i < iovcnt; i++) {
@@ -1089,15 +1102,28 @@ recvmsg(int sock, struct nmsghdr *msg, int flags)
 
 			iovlen32 = aiov32[i].iov_len;
 			count32 += iovlen32;
-			if (iovlen32 < 0 || count32 < 0)
+			if (iovlen32 < 0 || count32 < 0) {
+				if (iovsize != 0) {
+					kmem_free(aiov32, iov32size);
+					kmem_free(aiov, iovsize);
+				}
+
 				return (set_errno(EINVAL));
+			}
+
 			aiov[i].iov_len = iovlen32;
 			aiov[i].iov_base =
 			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
 		}
+
+		if (iovsize != 0)
+			kmem_free(aiov32, iov32size);
 	} else
 #endif /* _SYSCALL32_IMPL */
 	if (copyin(lmsg.msg_iov, aiov, iovcnt * sizeof (struct iovec))) {
+		if (iovsize != 0)
+			kmem_free(aiov, iovsize);
+
 		return (set_errno(EFAULT));
 	}
 	len = 0;
@@ -1105,6 +1131,9 @@ recvmsg(int sock, struct nmsghdr *msg, int flags)
 		ssize_t iovlen = aiov[i].iov_len;
 		len += iovlen;
 		if (iovlen < 0 || len < 0) {
+			if (iovsize != 0)
+				kmem_free(aiov, iovsize);
+
 			return (set_errno(EINVAL));
 		}
 	}
@@ -1119,12 +1148,20 @@ recvmsg(int sock, struct nmsghdr *msg, int flags)
 	    (do_useracc == 0 ||
 	    useracc(lmsg.msg_control, lmsg.msg_controllen,
 	    B_WRITE) != 0)) {
+		if (iovsize != 0)
+			kmem_free(aiov, iovsize);
+
 		return (set_errno(EFAULT));
 	}
 
-	return (recvit(sock, &lmsg, &auio, flags,
+	rval = recvit(sock, &lmsg, &auio, flags,
 	    STRUCT_FADDR(umsgptr, msg_namelen),
-	    STRUCT_FADDR(umsgptr, msg_controllen), flagsp));
+	    STRUCT_FADDR(umsgptr, msg_controllen), flagsp);
+
+	if (iovsize != 0)
+		kmem_free(aiov, iovsize);
+
+	return (rval);
 }
 
 /*
@@ -1262,9 +1299,10 @@ sendmsg(int sock, struct nmsghdr *msg, int flags)
 	struct nmsghdr lmsg;
 	STRUCT_DECL(nmsghdr, u_lmsg);
 	struct uio auio;
-	struct iovec aiov[MSG_MAXIOVLEN];
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	ssize_t iovsize = 0;
 	int iovcnt;
-	ssize_t len;
+	ssize_t len, rval;
 	int i;
 	model_t	model;
 
@@ -1307,7 +1345,7 @@ sendmsg(int sock, struct nmsghdr *msg, int flags)
 
 	iovcnt = lmsg.msg_iovlen;
 
-	if (iovcnt <= 0 || iovcnt > MSG_MAXIOVLEN) {
+	if (iovcnt <= 0 || iovcnt > IOV_MAX) {
 		/*
 		 * Unless this is XPG 4.2 we allow iovcnt == 0 to
 		 * be compatible with SunOS 4.X and 4.4BSD.
@@ -1316,19 +1354,34 @@ sendmsg(int sock, struct nmsghdr *msg, int flags)
 			return (set_errno(EMSGSIZE));
 	}
 
+	if (iovcnt > IOV_MAX_STACK) {
+		iovsize = iovcnt * sizeof (struct iovec);
+		aiov = kmem_alloc(iovsize, KM_SLEEP);
+	}
+
 #ifdef _SYSCALL32_IMPL
 	/*
 	 * 32-bit callers need to have their iovec expanded, while ensuring
 	 * that they can't move more than 2Gbytes of data in a single call.
 	 */
 	if (model == DATAMODEL_ILP32) {
-		struct iovec32 aiov32[MSG_MAXIOVLEN];
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		ssize_t iov32size;
 		ssize32_t count32;
 
+		iov32size = iovcnt * sizeof (struct iovec32);
+		if (iovsize != 0)
+			aiov32 = kmem_alloc(iov32size, KM_SLEEP);
+
 		if (iovcnt != 0 &&
-		    copyin((struct iovec32 *)lmsg.msg_iov, aiov32,
-		    iovcnt * sizeof (struct iovec32)))
+		    copyin((struct iovec32 *)lmsg.msg_iov, aiov32, iov32size)) {
+			if (iovsize != 0) {
+				kmem_free(aiov32, iov32size);
+				kmem_free(aiov, iovsize);
+			}
+
 			return (set_errno(EFAULT));
+		}
 
 		count32 = 0;
 		for (i = 0; i < iovcnt; i++) {
@@ -1336,17 +1389,30 @@ sendmsg(int sock, struct nmsghdr *msg, int flags)
 
 			iovlen32 = aiov32[i].iov_len;
 			count32 += iovlen32;
-			if (iovlen32 < 0 || count32 < 0)
+			if (iovlen32 < 0 || count32 < 0) {
+				if (iovsize != 0) {
+					kmem_free(aiov32, iov32size);
+					kmem_free(aiov, iovsize);
+				}
+
 				return (set_errno(EINVAL));
+			}
+
 			aiov[i].iov_len = iovlen32;
 			aiov[i].iov_base =
 			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
 		}
+
+		if (iovsize != 0)
+			kmem_free(aiov32, iov32size);
 	} else
 #endif /* _SYSCALL32_IMPL */
 	if (iovcnt != 0 &&
 	    copyin(lmsg.msg_iov, aiov,
 	    (unsigned)iovcnt * sizeof (struct iovec))) {
+		if (iovsize != 0)
+			kmem_free(aiov, iovsize);
+
 		return (set_errno(EFAULT));
 	}
 	len = 0;
@@ -1354,6 +1420,9 @@ sendmsg(int sock, struct nmsghdr *msg, int flags)
 		ssize_t iovlen = aiov[i].iov_len;
 		len += iovlen;
 		if (iovlen < 0 || len < 0) {
+			if (iovsize != 0)
+				kmem_free(aiov, iovsize);
+
 			return (set_errno(EINVAL));
 		}
 	}
@@ -1364,7 +1433,12 @@ sendmsg(int sock, struct nmsghdr *msg, int flags)
 	auio.uio_segflg = UIO_USERSPACE;
 	auio.uio_limit = 0;
 
-	return (sendit(sock, &lmsg, &auio, flags));
+	rval = sendit(sock, &lmsg, &auio, flags);
+
+	if (iovsize != 0)
+		kmem_free(aiov, iovsize);
+
+	return (rval);
 }
 
 ssize_t
diff --git a/usr/src/uts/common/fs/sockfs/socktpi_impl.h b/usr/src/uts/common/fs/sockfs/socktpi_impl.h
index 6a515be122..24acb81a0a 100644
--- a/usr/src/uts/common/fs/sockfs/socktpi_impl.h
+++ b/usr/src/uts/common/fs/sockfs/socktpi_impl.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef _SOCKFS_SOCKTPI_IMPL_H
@@ -56,6 +57,8 @@ extern int	sogetrderr(vnode_t *, int, int *);
 extern int	sogetwrerr(vnode_t *, int, int *);
 extern int	so_addr_verify(struct sonode *, const struct sockaddr *,
 			socklen_t);
+extern int	so_ux_lookup(struct sonode *, struct sockaddr_un *, int,
+		vnode_t **);
 extern int	so_ux_addr_xlate(struct sonode *, struct sockaddr *,
 			socklen_t, int, void **, socklen_t *);
 extern void	so_unix_close(struct sonode *);
diff --git a/usr/src/uts/common/fs/swapfs/swap_subr.c b/usr/src/uts/common/fs/swapfs/swap_subr.c
index 74c4302da9..a4d983665b 100644
--- a/usr/src/uts/common/fs/swapfs/swap_subr.c
+++ b/usr/src/uts/common/fs/swapfs/swap_subr.c
@@ -110,9 +110,11 @@ swapfs_recalc(pgcnt_t pgs)
 		 * memory that can be used as swap space should do so by
 		 * setting swapfs_desfree at boot time, not swapfs_minfree.
 		 * However, swapfs_minfree is tunable by install as a
-		 * workaround for bugid 1147463.
+		 * workaround for bugid 1147463. Note swapfs_minfree is set
+		 * to 1/8th of memory, but clamped at the limit of 256 MB.
 		 */
-		new_swapfs_minfree = MAX(btopr(2 * 1024 * 1024), pgs >> 3);
+		new_swapfs_minfree = MIN(MAX(btopr(2 * 1024 * 1024), pgs >> 3),
+		    btopr(256 * 1024 * 1024));
 	}
 
 	/*
diff --git a/usr/src/uts/common/fs/tmpfs/tmp_dir.c b/usr/src/uts/common/fs/tmpfs/tmp_dir.c
index f6621c8097..1a620642cc 100644
--- a/usr/src/uts/common/fs/tmpfs/tmp_dir.c
+++ b/usr/src/uts/common/fs/tmpfs/tmp_dir.c
@@ -21,10 +21,9 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/sysmacros.h>
@@ -383,20 +382,7 @@ tdirenter(
 				/*
 				 * Unmake the inode we just made.
 				 */
-				rw_enter(&tp->tn_rwlock, RW_WRITER);
-				if ((tp->tn_type) == VDIR) {
-					ASSERT(tdp == NULL);
-					/*
-					 * cleanup allocs made by tdirinit()
-					 */
-					tdirtrunc(tp);
-				}
-				mutex_enter(&tp->tn_tlock);
-				tp->tn_nlink = 0;
-				mutex_exit(&tp->tn_tlock);
-				gethrestime(&tp->tn_ctime);
-				rw_exit(&tp->tn_rwlock);
-				tmpnode_rele(tp);
+				tmpnode_cleanup(tp);
 				tp = NULL;
 			}
 		} else if (tpp) {
@@ -431,6 +417,7 @@ tdirdelete(
 	enum dr_op op,
 	struct cred *cred)
 {
+	struct tmount *tm;
 	struct tdirent *tpdp;
 	int error;
 	size_t namelen;
@@ -516,7 +503,8 @@ tdirdelete(
 	 */
 	namelen = strlen(tpdp->td_name) + 1;
 
-	tmp_memfree(tpdp, sizeof (struct tdirent) + namelen);
+	tm = TNTOTM(dir);
+	tmp_kmem_free(tm, tpdp, sizeof (struct tdirent) + namelen);
 	dir->tn_size -= (sizeof (struct tdirent) + namelen);
 	dir->tn_dirents--;
 
@@ -538,19 +526,27 @@ tdirdelete(
  * tdirinit is used internally to initialize a directory (dir)
  * with '.' and '..' entries without checking permissions and locking
  */
-void
+int
 tdirinit(
 	struct tmpnode *parent,		/* parent of directory to initialize */
 	struct tmpnode *dir)		/* the new directory */
 {
+	struct tmount *tm;
 	struct tdirent *dot, *dotdot;
 	timestruc_t now;
 
 	ASSERT(RW_WRITE_HELD(&parent->tn_rwlock));
 	ASSERT(dir->tn_type == VDIR);
 
-	dot = tmp_memalloc(sizeof (struct tdirent) + 2, TMP_MUSTHAVE);
-	dotdot = tmp_memalloc(sizeof (struct tdirent) + 3, TMP_MUSTHAVE);
+	tm = TNTOTM(parent);
+	dot = tmp_kmem_zalloc(tm, sizeof (struct tdirent) + 2, KM_SLEEP);
+	if (dot == NULL)
+		return (ENOSPC);
+	dotdot = tmp_kmem_zalloc(tm, sizeof (struct tdirent) + 3, KM_SLEEP);
+	if (dotdot == NULL) {
+		tmp_kmem_free(tm, dot, sizeof (struct tdirent) + 2);
+		return (ENOSPC);
+	}
 
 	/*
 	 * Initialize the entries
@@ -601,6 +597,8 @@ tdirinit(
 	dir->tn_size = 2 * sizeof (struct tdirent) + 5;	/* dot and dotdot */
 	dir->tn_dirents = 2;
 	dir->tn_nlink = 2;
+
+	return (0);
 }
 
 
@@ -612,6 +610,7 @@ tdirtrunc(struct tmpnode *dir)
 {
 	struct tdirent *tdp;
 	struct tmpnode *tp;
+	struct tmount *tm;
 	size_t namelen;
 	timestruc_t now;
 	int isvattrdir, isdotdot, skip_decr;
@@ -619,6 +618,8 @@ tdirtrunc(struct tmpnode *dir)
 	ASSERT(RW_WRITE_HELD(&dir->tn_rwlock));
 	ASSERT(dir->tn_type == VDIR);
 
+	tm = TNTOTM(dir);
+
 	isvattrdir = (dir->tn_vnode->v_flag & V_XATTRDIR) ? 1 : 0;
 	for (tdp = dir->tn_dir; tdp; tdp = dir->tn_dir) {
 		ASSERT(tdp->td_next != tdp);
@@ -650,7 +651,7 @@ tdirtrunc(struct tmpnode *dir)
 
 		tmpfs_hash_out(tdp);
 
-		tmp_memfree(tdp, sizeof (struct tdirent) + namelen);
+		tmp_kmem_free(tm, tdp, sizeof (struct tdirent) + namelen);
 		dir->tn_size -= (sizeof (struct tdirent) + namelen);
 		dir->tn_dirents--;
 	}
@@ -903,6 +904,7 @@ tdiraddentry(
 	enum de_op	op,
 	struct tmpnode	*fromtp)
 {
+	struct tmount *tm;
 	struct tdirent *tdp, *tpdp;
 	size_t		namelen, alloc_size;
 	timestruc_t	now;
@@ -923,9 +925,10 @@ tdiraddentry(
 	/*
 	 * Allocate and initialize directory entry
 	 */
+	tm = TNTOTM(dir);
 	namelen = strlen(name) + 1;
 	alloc_size = namelen + sizeof (struct tdirent);
-	tdp = tmp_memalloc(alloc_size, 0);
+	tdp = tmp_kmem_zalloc(tm, alloc_size, KM_NOSLEEP | KM_NORMALPRI);
 	if (tdp == NULL)
 		return (ENOSPC);
 
@@ -1025,7 +1028,10 @@ tdirmaketnode(
 	    ((va->va_mask & AT_MTIME) && TIMESPEC_OVERFLOW(&va->va_mtime)))
 		return (EOVERFLOW);
 	type = va->va_type;
-	tp = tmp_memalloc(sizeof (struct tmpnode), TMP_MUSTHAVE);
+	tp = tmp_kmem_zalloc(tm, sizeof (struct tmpnode), KM_SLEEP);
+	if (tp == NULL) {
+		return (ENOSPC);
+	}
 	tmpnode_init(tm, tp, va, cred);
 
 	/* setup normal file/dir's extended attribute directory */
@@ -1087,8 +1093,13 @@ tdirmaketnode(
 	if (va->va_mask & AT_MTIME)
 		tp->tn_mtime = va->va_mtime;
 
-	if (op == DE_MKDIR)
-		tdirinit(dir, tp);
+	if (op == DE_MKDIR) {
+		int ret;
+		if ((ret = tdirinit(dir, tp)) != 0) {
+			tmpnode_cleanup(tp);
+			return (ret);
+		}
+	}
 
 	*newnode = tp;
 	return (0);
diff --git a/usr/src/uts/common/fs/tmpfs/tmp_subr.c b/usr/src/uts/common/fs/tmpfs/tmp_subr.c
index 8723631555..0c48c03a75 100644
--- a/usr/src/uts/common/fs/tmpfs/tmp_subr.c
+++ b/usr/src/uts/common/fs/tmpfs/tmp_subr.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -43,6 +43,7 @@
 #include <sys/fs/tmpnode.h>
 #include <sys/ddi.h>
 #include <sys/sunddi.h>
+#include <vm/anon.h>
 
 #define	KILOBYTE	1024
 #define	MEGABYTE	(1024 * KILOBYTE)
@@ -54,6 +55,80 @@
 
 extern pgcnt_t swapfs_minfree;
 
+void *
+tmp_kmem_zalloc(struct tmount *tm, size_t size, int flag)
+{
+	void *buf;
+	zone_t *zone;
+	size_t pages;
+
+	mutex_enter(&tm->tm_contents);
+	zone = tm->tm_vfsp->vfs_zone;
+	if (tm->tm_anonmem + size > tm->tm_anonmax ||
+	    tm->tm_anonmem + size < tm->tm_anonmem ||
+	    size + ptob(tmpfs_minfree) <= size ||
+	    !anon_checkspace(size + ptob(tmpfs_minfree), zone)) {
+		mutex_exit(&tm->tm_contents);
+		return (NULL);
+	}
+
+	/*
+	 * Only make anonymous memory reservations when a page boundary is
+	 * crossed.  This is necessary since the anon_resv functions rounds up
+	 * to PAGESIZE internally.
+	 */
+	pages = btopr(tm->tm_allocmem + size);
+	pages -= btopr(tm->tm_allocmem);
+	if (pages > 0 && anon_try_resv_zone(ptob(pages), zone) == 0) {
+		mutex_exit(&tm->tm_contents);
+		return (NULL);
+	}
+
+	tm->tm_allocmem += size;
+	tm->tm_anonmem += size;
+	mutex_exit(&tm->tm_contents);
+
+	buf = kmem_zalloc(size, flag);
+	if (buf == NULL) {
+		mutex_enter(&tm->tm_contents);
+		ASSERT(tm->tm_anonmem > tm->tm_anonmem - size);
+		tm->tm_anonmem -= size;
+		if (pages > 0) {
+			/*
+			 * Re-chasing the zone pointer is necessary since a
+			 * forced umount could have been performed while the
+			 * tm_contents lock was dropped during allocation.
+			 */
+			anon_unresv_zone(ptob(pages), tm->tm_vfsp->vfs_zone);
+		}
+		mutex_exit(&tm->tm_contents);
+	}
+
+	return (buf);
+}
+
+void
+tmp_kmem_free(struct tmount *tm, void *buf, size_t size)
+{
+	size_t pages;
+
+	kmem_free(buf, size);
+	mutex_enter(&tm->tm_contents);
+	ASSERT(tm->tm_anonmem > tm->tm_anonmem - size);
+	tm->tm_anonmem -= size;
+	pages = btopr(tm->tm_allocmem);
+	tm->tm_allocmem -= size;
+	pages -= btopr(tm->tm_allocmem);
+	/*
+	 * Like the tmp_kmem_zalloc case, only unreserve anonymous memory when
+	 * a page boundary has been crossed.
+	 */
+	if (pages > 0) {
+		anon_unresv_zone(size, tm->tm_vfsp->vfs_zone);
+	}
+	mutex_exit(&tm->tm_contents);
+}
+
 int
 tmp_taccess(void *vtp, int mode, struct cred *cred)
 {
@@ -99,42 +174,8 @@ tmp_sticky_remove_access(struct tmpnode *dir, struct tmpnode *entry,
 }
 
 /*
- * Allocate zeroed memory if tmpfs_maxkmem has not been exceeded
- * or the 'musthave' flag is set.  'musthave' allocations should
- * always be subordinate to normal allocations so that tmpfs_maxkmem
- * can't be exceeded by more than a few KB.  Example: when creating
- * a new directory, the tmpnode is a normal allocation; if that
- * succeeds, the dirents for "." and ".." are 'musthave' allocations.
- */
-void *
-tmp_memalloc(size_t size, int musthave)
-{
-	static time_t last_warning;
-	time_t now;
-
-	if (atomic_add_long_nv(&tmp_kmemspace, size) < tmpfs_maxkmem ||
-	    musthave)
-		return (kmem_zalloc(size, KM_SLEEP));
-
-	atomic_add_long(&tmp_kmemspace, -size);
-	now = gethrestime_sec();
-	if (last_warning != now) {
-		last_warning = now;
-		cmn_err(CE_WARN, "tmp_memalloc: tmpfs over memory limit");
-	}
-	return (NULL);
-}
-
-void
-tmp_memfree(void *cp, size_t size)
-{
-	kmem_free(cp, size);
-	atomic_add_long(&tmp_kmemspace, -size);
-}
-
-/*
- * Convert a string containing a number (number of bytes) to a pgcnt_t,
- * containing the corresponding number of pages. On 32-bit kernels, the
+ * Convert a string containing a number (number of bytes) to a size_t,
+ * containing the corresponding number of bytes. On 32-bit kernels, the
  * maximum value encoded in 'str' is PAGESIZE * ULONG_MAX, while the value
  * returned in 'maxpg' is at most ULONG_MAX.
  *
@@ -152,7 +193,7 @@ tmp_memfree(void *cp, size_t size)
  * error.
  */
 int
-tmp_convnum(char *str, pgcnt_t *maxpg)
+tmp_convnum(char *str, size_t *maxbytes)
 {
 	u_longlong_t num = 0;
 #ifdef _LP64
@@ -160,6 +201,7 @@ tmp_convnum(char *str, pgcnt_t *maxpg)
 #else
 	u_longlong_t max_bytes = PAGESIZE * (uint64_t)ULONG_MAX;
 #endif
+	size_t pages;
 	char *c;
 	const struct convchar {
 		char *cc_char;
@@ -250,13 +292,21 @@ valid_char:
 
 done:
 	/*
-	 * Since btopr() rounds up to page granularity, this round-up can
-	 * cause an overflow only if 'num' is between (max_bytes - PAGESIZE)
-	 * and (max_bytes). In this case the resulting number is zero, which
-	 * is what we check for below.
+	 * We've been given a size in bytes; however, we want to make sure that
+	 * we have at least one page worth no matter what. Therefore we use
+	 * btopr to round up. However, this may cause an overflow only if 'num'
+	 * is between (max_bytes - PAGESIZE) and (max_bytes). In this case the
+	 * resulting number is zero, which is what we check for below. Note, we
+	 * require at least one page, so if pages is zero, well, it wasn't going
+	 * to work anyways.
 	 */
-	if ((*maxpg = (pgcnt_t)btopr(num)) == 0 && num != 0)
+	pages = btopr(num);
+	if (pages == 0) {
 		return (EINVAL);
+	}
+
+	*maxbytes = ptob(pages);
+
 	return (0);
 }
 
diff --git a/usr/src/uts/common/fs/tmpfs/tmp_tnode.c b/usr/src/uts/common/fs/tmpfs/tmp_tnode.c
index 51e57b2611..13ea356924 100644
--- a/usr/src/uts/common/fs/tmpfs/tmp_tnode.c
+++ b/usr/src/uts/common/fs/tmpfs/tmp_tnode.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -64,21 +65,35 @@ tmp_resv(
 	int pagecreate)		/* call anon_resv if set */
 {
 	pgcnt_t pages = btopr(delta);
+	size_t pbytes = ptob(pages);
 	zone_t *zone;
 
 	ASSERT(RW_WRITE_HELD(&tp->tn_rwlock));
 	ASSERT(tp->tn_type == VREG);
+
 	/*
-	 * pagecreate is set only if we actually need to call anon_resv
-	 * to reserve an additional page of anonymous memory.
-	 * Since anon_resv always reserves a page at a time,
-	 * it should only get called when we know we're growing the
-	 * file into a new page or filling a hole.
+	 * pagecreate is set only if we actually need to call anon_resv to
+	 * reserve an additional page of anonymous memory.  Since anon_resv
+	 * always reserves a page at a time, it should only get called when we
+	 * know we're growing the file into a new page or filling a hole. This
+	 * is why we transform delta into a number of pages. However, because we
+	 * track bytes and not pages, we convert that back to a number of bytes
+	 * that we allocate against.
 	 *
-	 * Deny if trying to reserve more than tmpfs can allocate
+	 * Deny if trying to reserve more than tmpfs can allocate, the
+	 * allocation causes an overflow, or the delta round up overflowed.
+	 * Note, that btopr rounds up, so we need to catch the unsigned
+	 * overflow. Note, rounding up when we are within a page of SIZE_MAX is
+	 * done by adding a page, overflowing, which will then be rounded back
+	 * to zero. Hence the following check.
 	 */
+	if (pages == 0 && delta != 0)
+		return (1);
+
 	zone = tm->tm_vfsp->vfs_zone;
-	if (pagecreate && ((tm->tm_anonmem + pages > tm->tm_anonmax) ||
+	if (pagecreate && ((tm->tm_anonmem + pbytes > tm->tm_anonmax) ||
+	    (tm->tm_anonmem + pbytes < tm->tm_anonmem) ||
+	    (ptob(pages + tmpfs_minfree) <= pbytes) ||
 	    (!anon_checkspace(ptob(pages + tmpfs_minfree), zone)) ||
 	    (anon_try_resv_zone(delta, zone) == 0))) {
 		return (1);
@@ -89,7 +104,7 @@ tmp_resv(
 	 */
 	if (pagecreate) {
 		mutex_enter(&tm->tm_contents);
-		tm->tm_anonmem += pages;
+		tm->tm_anonmem += pbytes;
 		mutex_exit(&tm->tm_contents);
 
 		TRACE_2(TR_FAC_VM, TR_ANON_TMPFS, "anon tmpfs:%p %lu",
@@ -110,13 +125,27 @@ tmp_unresv(
 	struct tmpnode *tp,
 	size_t delta)
 {
+	size_t pages, pbytes;
+
 	ASSERT(RW_WRITE_HELD(&tp->tn_rwlock));
 	ASSERT(tp->tn_type == VREG);
 
+	/*
+	 * If this is true, we have a grevious overflow bug and some size
+	 * accounting has been messed with as having an amount to truncate at
+	 * this size would imply that all of memory was used for this file. No
+	 * matter how small the kernel, it will always need at least one page.
+	 */
+	pages = btopr(delta);
+	if (pages == 0 && delta != 0)
+		panic("tmpfs unsigned overflow detected");
+	pbytes = ptob(pages);
+
 	anon_unresv_zone(delta, tm->tm_vfsp->vfs_zone);
 
 	mutex_enter(&tm->tm_contents);
-	tm->tm_anonmem -= btopr(delta);
+	ASSERT(tm->tm_anonmem > tm->tm_anonmem - pbytes);
+	tm->tm_anonmem -= pbytes;
 	mutex_exit(&tm->tm_contents);
 
 	TRACE_2(TR_FAC_VM, TR_ANON_TMPFS, "anon tmpfs:%p %lu", tp, delta);
@@ -154,6 +183,26 @@ tmpnode_growmap(struct tmpnode *tp, ulong_t newsize)
 }
 
 /*
+ * This is used to clean up a tmpnode that hasn't made it out the door. In other
+ * words, we allocated it and did a tmpnode_init; however, before it could get
+ * fully inserted into a directory, bad things happened and it failed.
+ */
+void
+tmpnode_cleanup(struct tmpnode *tp)
+{
+	rw_enter(&tp->tn_rwlock, RW_WRITER);
+	if ((tp->tn_type) == VDIR) {
+		tdirtrunc(tp);
+	}
+	mutex_enter(&tp->tn_tlock);
+	tp->tn_nlink = 0;
+	mutex_exit(&tp->tn_tlock);
+	gethrestime(&tp->tn_ctime);
+	rw_exit(&tp->tn_rwlock);
+	tmpnode_rele(tp);
+}
+
+/*
  * Initialize a tmpnode and add it to file list under mount point.
  */
 void
@@ -232,7 +281,6 @@ tmpnode_trunc(
 {
 	size_t oldsize = tp->tn_size;
 	size_t delta;
-	struct vnode *vp = TNTOV(tp);
 	timestruc_t now;
 	int error = 0;
 
@@ -316,7 +364,7 @@ tmpnode_trunc(
 			/* Delete anon array for tmpnode */
 			ASSERT(tp->tn_nblocks == 0);
 			ASSERT(anon_get_ptr(tp->tn_anon, 0) == NULL);
-			ASSERT(!vn_has_cached_data(vp));
+			ASSERT(!vn_has_cached_data(TNTOV(tp)));
 
 			anon_release(tp->tn_anon, tp->tn_asize);
 			tp->tn_anon = NULL;
diff --git a/usr/src/uts/common/fs/tmpfs/tmp_vfsops.c b/usr/src/uts/common/fs/tmpfs/tmp_vfsops.c
index f0e0c54d3e..cef582ab86 100644
--- a/usr/src/uts/common/fs/tmpfs/tmp_vfsops.c
+++ b/usr/src/uts/common/fs/tmpfs/tmp_vfsops.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -56,6 +56,15 @@
 static int tmpfsfstype;
 
 /*
+ * tmpfs_mountcount is used to prevent module unloads while there is still
+ * state from a former mount hanging around. With forced umount support, the
+ * filesystem module must not be allowed to go away before the last
+ * VFS_FREEVFS() call has been made. Since this is just an atomic counter,
+ * there's no need for locking.
+ */
+static uint32_t	tmpfs_mountcount;
+
+/*
  * tmpfs vfs operations.
  */
 static int tmpfsinit(int, char *);
@@ -65,6 +74,7 @@ static int tmp_unmount(struct vfs *, int, struct cred *);
 static int tmp_root(struct vfs *, struct vnode **);
 static int tmp_statvfs(struct vfs *, struct statvfs64 *);
 static int tmp_vget(struct vfs *, struct vnode **, struct fid *);
+static void tmp_freevfs(vfs_t *vfsp);
 
 /*
  * Loadable module wrapper
@@ -123,6 +133,14 @@ _fini()
 {
 	int error;
 
+	/*
+	 * If a forceably unmounted instance is still hanging around, we cannot
+	 * allow the module to be unloaded because that would cause panics once
+	 * the VFS framework decides it's time to call into VFS_FREEVFS().
+	 */
+	if (tmpfs_mountcount)
+		return (EBUSY);
+
 	error = mod_remove(&modlinkage);
 	if (error)
 		return (error);
@@ -141,14 +159,6 @@ _info(struct modinfo *modinfop)
 }
 
 /*
- * The following are patchable variables limiting the amount of system
- * resources tmpfs can use.
- *
- * tmpfs_maxkmem limits the amount of kernel kmem_alloc memory
- * tmpfs can use for it's data structures (e.g. tmpnodes, directory entries)
- * It is not determined by setting a hard limit but rather as a percentage of
- * physical memory which is determined when tmpfs is first used in the system.
- *
  * tmpfs_minfree is the minimum amount of swap space that tmpfs leaves for
  * the rest of the system.  In other words, if the amount of free swap space
  * in the system (i.e. anoninfo.ani_free) drops below tmpfs_minfree, tmpfs
@@ -157,9 +167,7 @@ _info(struct modinfo *modinfop)
  * There is also a per mount limit on the amount of swap space
  * (tmount.tm_anonmax) settable via a mount option.
  */
-size_t tmpfs_maxkmem = 0;
 size_t tmpfs_minfree = 0;
-size_t tmp_kmemspace;		/* bytes of kernel heap used by all tmpfs */
 
 static major_t tmpfs_major;
 static minor_t tmpfs_minor;
@@ -178,6 +186,7 @@ tmpfsinit(int fstype, char *name)
 		VFSNAME_ROOT,		{ .vfs_root = tmp_root },
 		VFSNAME_STATVFS,	{ .vfs_statvfs = tmp_statvfs },
 		VFSNAME_VGET,		{ .vfs_vget = tmp_vget },
+		VFSNAME_FREEVFS,	{ .vfs_freevfs = tmp_freevfs },
 		NULL,			NULL
 	};
 	int error;
@@ -212,18 +221,12 @@ tmpfsinit(int fstype, char *name)
 		tmpfs_minfree = btopr(TMPMINFREE);
 	}
 
-	/*
-	 * The maximum amount of space tmpfs can allocate is
-	 * TMPMAXPROCKMEM percent of kernel memory
-	 */
-	if (tmpfs_maxkmem == 0)
-		tmpfs_maxkmem = MAX(PAGESIZE, kmem_maxavail() / TMPMAXFRACKMEM);
-
 	if ((tmpfs_major = getudev()) == (major_t)-1) {
 		cmn_err(CE_WARN, "tmpfsinit: Can't get unique device number.");
 		tmpfs_major = 0;
 	}
 	mutex_init(&tmpfs_minor_lock, NULL, MUTEX_DEFAULT, NULL);
+	tmpfs_mountcount = 0;
 	return (0);
 }
 
@@ -234,7 +237,7 @@ tmp_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
 	struct tmpnode *tp;
 	struct pathname dpn;
 	int error;
-	pgcnt_t anonmax;
+	size_t anonmax;
 	struct vattr rattr;
 	int got_attrs;
 	boolean_t mode_arg = B_FALSE;
@@ -278,7 +281,18 @@ tmp_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
 		if ((error = tmp_convnum(argstr, &anonmax)) != 0)
 			goto out;
 	} else {
-		anonmax = ULONG_MAX;
+		anonmax = SIZE_MAX;
+	}
+
+	/*
+	 * The "mode" mount argument allows the operator to override the
+	 * permissions of the root of the tmpfs mount.
+	 */
+	if (vfs_optionisset(vfsp, "mode", &argstr)) {
+		if ((error = tmp_convmode(argstr, &root_mode)) != 0) {
+			goto out;
+		}
+		mode_arg = B_TRUE;
 	}
 
 	/*
@@ -311,7 +325,8 @@ tmp_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
 		goto out;
 	}
 
-	if ((tm = tmp_memalloc(sizeof (struct tmount), 0)) == NULL) {
+	if ((tm = kmem_zalloc(sizeof (struct tmount),
+	    KM_NOSLEEP | KM_NORMALPRI)) == NULL) {
 		pn_free(&dpn);
 		error = ENOMEM;
 		goto out;
@@ -343,17 +358,37 @@ tmp_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
 	vfsp->vfs_bsize = PAGESIZE;
 	vfsp->vfs_flag |= VFS_NOTRUNC;
 	vfs_make_fsid(&vfsp->vfs_fsid, tm->tm_dev, tmpfsfstype);
-	tm->tm_mntpath = tmp_memalloc(dpn.pn_pathlen + 1, TMP_MUSTHAVE);
+	tm->tm_mntpath = kmem_zalloc(dpn.pn_pathlen + 1, KM_SLEEP);
 	(void) strcpy(tm->tm_mntpath, dpn.pn_path);
 
 	/*
+	 * Preemptively set vfs_zone before any of the tmp_kmem_* functions are
+	 * called.  That field is not populated until after a successful
+	 * VFS_MOUNT when domount() sets vfsp metadata via vfs_add().  An
+	 * accurate value is required for proper swap usage accounting.
+	 */
+	ASSERT0(uap->flags & MS_REMOUNT);
+	ASSERT(vfsp->vfs_zone == NULL);
+	vfsp->vfs_zone = curproc->p_zone;
+
+	/*
 	 * allocate and initialize root tmpnode structure
 	 */
 	bzero(&rattr, sizeof (struct vattr));
 	rattr.va_mode = (mode_t)(S_IFDIR | root_mode);
 	rattr.va_type = VDIR;
 	rattr.va_rdev = 0;
-	tp = tmp_memalloc(sizeof (struct tmpnode), TMP_MUSTHAVE);
+	tp = tmp_kmem_zalloc(tm, sizeof (struct tmpnode), KM_SLEEP);
+	if (tp == NULL) {
+		kmem_free(tm->tm_mntpath, strlen(tm->tm_mntpath) + 1);
+		mutex_destroy(&tm->tm_contents);
+		mutex_destroy(&tm->tm_renamelck);
+		kmem_free(tm, sizeof (struct tmount));
+
+		pn_free(&dpn);
+		error = ENOMEM;
+		goto out;
+	}
 	tmpnode_init(tm, tp, &rattr, cr);
 
 	/*
@@ -392,12 +427,34 @@ tmp_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
 	tp->tn_nlink = 0;
 	tm->tm_rootnode = tp;
 
-	tdirinit(tp, tp);
+	if (tdirinit(tp, tp) != 0) {
+		/*
+		 * While we would normally let our VOP_INACTIVE function take
+		 * care of cleaning up here, we're in a bit of a delicate
+		 * situation, so we do so manually. While it's tempting to try
+		 * and rely upon tmpfs_freevfs() and others, it's probably safer
+		 * for the time to do this manually at the cost of duplication.
+		 */
+		vn_invalid(TNTOV(tp));
+		rw_destroy(&tp->tn_rwlock);
+		mutex_destroy(&tp->tn_tlock);
+		vn_free(TNTOV(tp));
+		tmp_kmem_free(tm, tp, sizeof (struct tmpnode));
+
+		kmem_free(tm->tm_mntpath, strlen(tm->tm_mntpath) + 1);
+		mutex_destroy(&tm->tm_contents);
+		mutex_destroy(&tm->tm_renamelck);
+		kmem_free(tm, sizeof (struct tmount));
+		pn_free(&dpn);
+		error = ENOMEM;
+		goto out;
+	}
 
 	rw_exit(&tp->tn_rwlock);
 
 	pn_free(&dpn);
 	error = 0;
+	atomic_inc_32(&tmpfs_mountcount);
 
 out:
 	if (error == 0)
@@ -413,36 +470,107 @@ tmp_unmount(struct vfs *vfsp, int flag, struct cred *cr)
 	struct tmpnode *tnp, *cancel;
 	struct vnode	*vp;
 	int error;
+	uint_t cnt;
+	int i;
 
 	if ((error = secpolicy_fs_unmount(cr, vfsp)) != 0)
 		return (error);
 
-	/*
-	 * forced unmount is not supported by this file system
-	 * and thus, ENOTSUP, is being returned.
-	 */
-	if (flag & MS_FORCE)
-		return (ENOTSUP);
-
 	mutex_enter(&tm->tm_contents);
 
 	/*
-	 * If there are no open files, only the root node should have
-	 * a reference count.
+	 * In the normal unmount case (non-forced unmount), if there are no
+	 * open files, only the root node should have a reference count.
+	 *
 	 * With tm_contents held, nothing can be added or removed.
 	 * There may be some dirty pages.  To prevent fsflush from
 	 * disrupting the unmount, put a hold on each node while scanning.
 	 * If we find a previously referenced node, undo the holds we have
 	 * placed and fail EBUSY.
+	 *
+	 * However, in the case of a forced umount, things are a bit different.
+	 * An additional VFS_HOLD is added for each outstanding VN_HOLD to
+	 * ensure that the file system is not cleaned up (tmp_freevfs) until
+	 * the last vfs hold is dropped. This happens in tmp_inactive as the
+	 * vnodes are released. Also, we can't add an additional VN_HOLD in
+	 * this case since that would prevent tmp_inactive from ever being
+	 * called. Finally, we do need to drop the zone ref now (zone_rele_ref)
+	 * so that the zone is not blocked waiting for the final file system
+	 * cleanup.
 	 */
 	tnp = tm->tm_rootnode;
-	if (TNTOV(tnp)->v_count > 1) {
+
+	vp = TNTOV(tnp);
+	mutex_enter(&vp->v_lock);
+	cnt = vp->v_count;
+	if (flag & MS_FORCE) {
+		vfsp->vfs_flag |= VFS_UNMOUNTED;
+		/* Extra hold which we rele below when we drop the zone ref */
+		VFS_HOLD(vfsp);
+
+		for (i = 1; i < cnt; i++)
+			VFS_HOLD(vfsp);
+
+		/* drop the mutex now because no one can find this mount */
+		mutex_exit(&tm->tm_contents);
+	} else if (cnt > 1) {
+		mutex_exit(&vp->v_lock);
 		mutex_exit(&tm->tm_contents);
 		return (EBUSY);
 	}
+	mutex_exit(&vp->v_lock);
 
+	/*
+	 * Check for open files. An open file causes everything to unwind
+	 * unless this is a forced umount.
+	 */
 	for (tnp = tnp->tn_forw; tnp; tnp = tnp->tn_forw) {
-		if ((vp = TNTOV(tnp))->v_count > 0) {
+		vp = TNTOV(tnp);
+		mutex_enter(&vp->v_lock);
+		cnt = vp->v_count;
+		if (flag & MS_FORCE) {
+			for (i = 0; i < cnt; i++)
+				VFS_HOLD(vfsp);
+
+			/*
+			 * In the case of a forced umount don't add an
+			 * additional VN_HOLD on the already held vnodes, like
+			 * we do in the non-forced unmount case. If the
+			 * cnt > 0, then the vnode already has at least one
+			 * hold and we need tmp_inactive to get called when the
+			 * last pre-existing hold on the node is released so
+			 * that we can VFS_RELE the VFS holds we just added.
+			 */
+			if (cnt == 0) {
+				/* directly add VN_HOLD since have the lock */
+				vp->v_count++;
+			}
+
+			mutex_exit(&vp->v_lock);
+
+			/*
+			 * If the tmpnode has any pages associated with it
+			 * (i.e. if it's a normal file with non-zero size), the
+			 * tmpnode could still be discovered by pageout or
+			 * fsflush via the page vnode pointers. To prevent this
+			 * from interfering with the tmp_freevfs, truncate the
+			 * tmpnode now.
+			 */
+			if (tnp->tn_size != 0 && tnp->tn_type == VREG) {
+				rw_enter(&tnp->tn_rwlock, RW_WRITER);
+				rw_enter(&tnp->tn_contents, RW_WRITER);
+
+				(void) tmpnode_trunc(tm, tnp, 0);
+
+				rw_exit(&tnp->tn_contents);
+				rw_exit(&tnp->tn_rwlock);
+
+				ASSERT(tnp->tn_size == 0);
+				ASSERT(tnp->tn_nblocks == 0);
+			}
+		} else if (cnt > 0) {
+			/* An open file; unwind the holds we've been adding. */
+			mutex_exit(&vp->v_lock);
 			cancel = tm->tm_rootnode->tn_forw;
 			while (cancel != tnp) {
 				vp = TNTOV(cancel);
@@ -452,14 +580,50 @@ tmp_unmount(struct vfs *vfsp, int flag, struct cred *cr)
 			}
 			mutex_exit(&tm->tm_contents);
 			return (EBUSY);
+		} else {
+			/* directly add a VN_HOLD since we have the lock */
+			vp->v_count++;
+			mutex_exit(&vp->v_lock);
 		}
-		VN_HOLD(vp);
 	}
 
-	/*
-	 * We can drop the mutex now because no one can find this mount
-	 */
-	mutex_exit(&tm->tm_contents);
+	if (flag & MS_FORCE) {
+		/*
+		 * Drop the zone ref now since we don't know how long it will
+		 * be until the final vfs_rele is called by tmp_inactive.
+		 */
+		if (vfsp->vfs_zone) {
+			zone_rele_ref(&vfsp->vfs_implp->vi_zone_ref,
+			    ZONE_REF_VFS);
+			vfsp->vfs_zone = 0;
+		}
+		/* We can now drop the extra hold we added above. */
+		VFS_RELE(vfsp);
+	} else {
+		/*
+		 * For the non-forced case, we can drop the mutex now because
+		 * no one can find this mount anymore
+		 */
+		vfsp->vfs_flag |= VFS_UNMOUNTED;
+		mutex_exit(&tm->tm_contents);
+	}
+
+	return (0);
+}
+
+/*
+ * Implementation of VFS_FREEVFS() to support forced umounts. This is called by
+ * the vfs framework after umount and the last VFS_RELE, to trigger the release
+ * of any resources still associated with the given vfs_t. We only add
+ * additional VFS_HOLDs during the forced umount case, so this is normally
+ * called immediately after tmp_umount.
+ */
+void
+tmp_freevfs(vfs_t *vfsp)
+{
+	struct tmount *tm = (struct tmount *)VFSTOTM(vfsp);
+	struct tmpnode *tnp;
+	struct vnode	*vp;
 
 	/*
 	 * Free all kmemalloc'd and anonalloc'd memory associated with
@@ -469,6 +633,16 @@ tmp_unmount(struct vfs *vfsp, int flag, struct cred *cr)
 	 * tmpnode_free which assumes that the directory entry has been
 	 * removed before the file.
 	 */
+
+	/*
+	 * Now that we are tearing ourselves down we need to remove the
+	 * UNMOUNTED flag. If we don't, we'll later hit a VN_RELE when we remove
+	 * files from the system causing us to have a negative value. Doing this
+	 * seems a bit better than trying to set a flag on the tmount that says
+	 * we're tearing down.
+	 */
+	vfsp->vfs_flag &= ~VFS_UNMOUNTED;
+
 	/*
 	 * Remove all directory entries
 	 */
@@ -535,15 +709,16 @@ tmp_unmount(struct vfs *vfsp, int flag, struct cred *cr)
 
 	ASSERT(tm->tm_mntpath);
 
-	tmp_memfree(tm->tm_mntpath, strlen(tm->tm_mntpath) + 1);
+	kmem_free(tm->tm_mntpath, strlen(tm->tm_mntpath) + 1);
 
 	ASSERT(tm->tm_anonmem == 0);
 
 	mutex_destroy(&tm->tm_contents);
 	mutex_destroy(&tm->tm_renamelck);
-	tmp_memfree(tm, sizeof (struct tmount));
+	kmem_free(tm, sizeof (struct tmount));
 
-	return (0);
+	/* Allow _fini() to succeed now */
+	atomic_dec_32(&tmpfs_mountcount);
 }
 
 /*
@@ -605,18 +780,19 @@ tmp_statvfs(struct vfs *vfsp, struct statvfs64 *sbp)
 	 * If tm_anonmax for this mount is less than the available swap space
 	 * (minus the amount tmpfs can't use), use that instead
 	 */
-	if (blocks > tmpfs_minfree)
+	if (blocks > tmpfs_minfree && tm->tm_anonmax > tm->tm_anonmem) {
 		sbp->f_bfree = MIN(blocks - tmpfs_minfree,
-		    tm->tm_anonmax - tm->tm_anonmem);
-	else
+		    btop(tm->tm_anonmax) - btopr(tm->tm_anonmem));
+	} else {
 		sbp->f_bfree = 0;
+	}
 
 	sbp->f_bavail = sbp->f_bfree;
 
 	/*
 	 * Total number of blocks is what's available plus what's been used
 	 */
-	sbp->f_blocks = (fsblkcnt64_t)(sbp->f_bfree + tm->tm_anonmem);
+	sbp->f_blocks = (fsblkcnt64_t)(sbp->f_bfree + btopr(tm->tm_anonmem));
 
 	if (eff_zid != GLOBAL_ZONEUNIQID &&
 	    zp->zone_max_swap_ctl != UINT64_MAX) {
@@ -646,13 +822,7 @@ tmp_statvfs(struct vfs *vfsp, struct statvfs64 *sbp)
 	 * available to tmpfs.  This is fairly inaccurate since it doesn't
 	 * take into account the names stored in the directory entries.
 	 */
-	if (tmpfs_maxkmem > tmp_kmemspace)
-		sbp->f_ffree = (tmpfs_maxkmem - tmp_kmemspace) /
-		    (sizeof (struct tmpnode) + sizeof (struct tdirent));
-	else
-		sbp->f_ffree = 0;
-
-	sbp->f_files = tmpfs_maxkmem /
+	sbp->f_ffree = sbp->f_files = ptob(availrmem) /
 	    (sizeof (struct tmpnode) + sizeof (struct tdirent));
 	sbp->f_favail = (fsfilcnt64_t)(sbp->f_ffree);
 	(void) cmpldev(&d32, vfsp->vfs_dev);
diff --git a/usr/src/uts/common/fs/tmpfs/tmp_vnops.c b/usr/src/uts/common/fs/tmpfs/tmp_vnops.c
index a09f206d88..a356f22750 100644
--- a/usr/src/uts/common/fs/tmpfs/tmp_vnops.c
+++ b/usr/src/uts/common/fs/tmpfs/tmp_vnops.c
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2015, Joyent, Inc. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2016 RackTop Systems.
  * Copyright (c) 2017 by Delphix. All rights reserved.
@@ -586,6 +586,10 @@ tmp_read(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cred,
 	struct tmount *tm = (struct tmount *)VTOTM(vp);
 	int error;
 
+	/* If the filesystem was umounted by force, return immediately. */
+	if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
+		return (EIO);
+
 	/*
 	 * We don't currently support reading non-regular files
 	 */
@@ -615,6 +619,10 @@ tmp_write(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cred,
 	struct tmount *tm = (struct tmount *)VTOTM(vp);
 	int error;
 
+	/* If the filesystem was umounted by force, return immediately. */
+	if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
+		return (EIO);
+
 	/*
 	 * We don't currently support writing to non-regular files
 	 */
@@ -788,8 +796,13 @@ tmp_setattr(
 		rw_exit(&tp->tn_contents);
 		rw_exit(&tp->tn_rwlock);
 
-		if (error == 0 && vap->va_size == 0)
-			vnevent_truncate(vp, ct);
+		if (error == 0) {
+			if (vap->va_size == 0) {
+				vnevent_truncate(vp, ct);
+			} else {
+				vnevent_resize(vp, ct);
+			}
+		}
 
 		goto out1;
 	}
@@ -835,6 +848,9 @@ tmp_lookup(
 	struct tmpnode *ntp = NULL;
 	int error;
 
+	/* If the filesystem was umounted by force, return immediately. */
+	if (dvp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
+		return (EIO);
 
 	/* allow cd into @ dir */
 	if (flags & LOOKUP_XATTR) {
@@ -853,6 +869,8 @@ tmp_lookup(
 
 		rw_enter(&tp->tn_rwlock, RW_WRITER);
 		if (tp->tn_xattrdp == NULL) {
+			int err;
+
 			if (!(flags & CREATE_XATTR_DIR)) {
 				rw_exit(&tp->tn_rwlock);
 				return (ENOENT);
@@ -873,9 +891,13 @@ tmp_lookup(
 				return (error);
 			}
 
-			xdp = tmp_memalloc(sizeof (struct tmpnode),
-			    TMP_MUSTHAVE);
 			tm = VTOTM(dvp);
+			xdp = tmp_kmem_zalloc(tm, sizeof (struct tmpnode),
+			    KM_SLEEP);
+			if (xdp == NULL) {
+				rw_exit(&tp->tn_rwlock);
+				return (ENOSPC);
+			}
 			tmpnode_init(tm, xdp, &tp->tn_attr, NULL);
 			/*
 			 * Fix-up fields unique to attribute directories.
@@ -893,7 +915,16 @@ tmp_lookup(
 			}
 			xdp->tn_vnode->v_type = VDIR;
 			xdp->tn_vnode->v_flag |= V_XATTRDIR;
-			tdirinit(tp, xdp);
+			if ((err = tdirinit(tp, xdp)) != 0) {
+				rw_exit(&tp->tn_rwlock);
+				/*
+				 * This never got properly initialized so we can
+				 * just clean it up.
+				 */
+				xdp->tn_vnode->v_flag &= V_XATTRDIR;
+				tmpnode_cleanup(tp);
+				return (err);
+			}
 			tp->tn_xattrdp = xdp;
 		} else {
 			VN_HOLD(tp->tn_xattrdp->tn_vnode);
@@ -1302,10 +1333,8 @@ tmp_rename(
 		vnevent_rename_src(TNTOV(fromtp), odvp, onm, ct);
 		/*
 		 * vnevent_rename_dest is called in tdirenter().
-		 * Notify the target dir if not same as source dir.
 		 */
-		if (ndvp != odvp)
-			vnevent_rename_dest_dir(ndvp, ct);
+		vnevent_rename_dest_dir(ndvp, TNTOV(fromtp), nnm, ct);
 	}
 
 done:
@@ -1474,6 +1503,10 @@ tmp_readdir(
 	int reclen;
 	caddr_t outbuf;
 
+	/* If the filesystem was umounted by force, return immediately. */
+	if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
+		return (EIO);
+
 	if (uiop->uio_loffset >= MAXOFF_T) {
 		if (eofp)
 			*eofp = 1;
@@ -1607,12 +1640,12 @@ tmp_symlink(
 	rw_exit(&parent->tn_rwlock);
 
 	if (error) {
-		if (self)
+		if (self != NULL)
 			tmpnode_rele(self);
 		return (error);
 	}
 	len = strlen(tnm) + 1;
-	cp = tmp_memalloc(len, 0);
+	cp = tmp_kmem_zalloc(tm, len, KM_NOSLEEP | KM_NORMALPRI);
 	if (cp == NULL) {
 		tmpnode_rele(self);
 		return (ENOSPC);
@@ -1677,10 +1710,27 @@ top:
 	 * there's little to do -- just drop our hold.
 	 */
 	if (vp->v_count > 1 || tp->tn_nlink != 0) {
-		VN_RELE_LOCKED(vp);
+		if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED) {
+			/*
+			 * Since the file system was forcibly unmounted, we can
+			 * have a case (v_count == 1, tn_nlink != 0) where this
+			 * file was open so we didn't add an extra hold on the
+			 * file in tmp_unmount. We are counting on the
+			 * interaction of the hold made in tmp_unmount and
+			 * rele-ed in tmp_vfsfree so we need to be sure we
+			 * don't decrement in this case.
+			 */
+			if (vp->v_count > 1)
+				VN_RELE_LOCKED(vp);
+		} else {
+			VN_RELE_LOCKED(vp);
+		}
 		mutex_exit(&vp->v_lock);
 		mutex_exit(&tp->tn_tlock);
 		rw_exit(&tp->tn_rwlock);
+		/* If the filesystem was umounted by force, rele the vfs ref */
+		if (tm->tm_vfsp->vfs_flag & VFS_UNMOUNTED)
+			VFS_RELE(tm->tm_vfsp);
 		return;
 	}
 
@@ -1705,7 +1755,7 @@ top:
 			goto top;
 		}
 		if (tp->tn_type == VLNK)
-			tmp_memfree(tp->tn_symlink, tp->tn_size + 1);
+			tmp_kmem_free(tm, tp->tn_symlink, tp->tn_size + 1);
 	}
 
 	/*
@@ -1739,7 +1789,11 @@ top:
 	rw_destroy(&tp->tn_rwlock);
 	mutex_destroy(&tp->tn_tlock);
 	vn_free(TNTOV(tp));
-	tmp_memfree(tp, sizeof (struct tmpnode));
+	tmp_kmem_free(tm, tp, sizeof (struct tmpnode));
+
+	/* If the filesystem was umounted by force, rele the vfs ref */
+	if (tm->tm_vfsp->vfs_flag & VFS_UNMOUNTED)
+		VFS_RELE(tm->tm_vfsp);
 }
 
 /* ARGSUSED2 */
@@ -1861,6 +1915,10 @@ tmp_getapage(
 	struct vnode *pvp;
 	u_offset_t poff;
 
+	/* If the filesystem was umounted by force, return immediately. */
+	if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
+		return (EIO);
+
 	if (protp != NULL)
 		*protp = PROT_ALL;
 again:
@@ -2082,6 +2140,10 @@ tmp_putapage(
 	u_offset_t offset;
 	u_offset_t tmpoff;
 
+	/* If the filesystem was umounted by force, return immediately. */
+	if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
+		return (EIO);
+
 	ASSERT(PAGE_LOCKED(pp));
 
 	/* Kluster in tmp_klustsize chunks */
@@ -2342,8 +2404,13 @@ tmp_space(
 			return (EFBIG);
 		error = tmp_freesp(vp, bfp, flag);
 
-		if (error == 0 && bfp->l_start == 0)
-			vnevent_truncate(vp, ct);
+		if (error == 0) {
+			if (bfp->l_start == 0) {
+				vnevent_truncate(vp, ct);
+			} else {
+				vnevent_resize(vp, ct);
+			}
+		}
 	}
 	return (error);
 }
diff --git a/usr/src/uts/common/fs/udfs/udf_dir.c b/usr/src/uts/common/fs/udfs/udf_dir.c
index c1e2c74a87..def046a0bf 100644
--- a/usr/src/uts/common/fs/udfs/udf_dir.c
+++ b/usr/src/uts/common/fs/udfs/udf_dir.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1998, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/types.h>
@@ -562,9 +563,8 @@ out:
 				    namep, ctp);
 			}
 
-			if (sdp != tdp) {
-				vnevent_rename_dest_dir(ITOV(tdp), ctp);
-			}
+			vnevent_rename_dest_dir(ITOV(tdp), ITOV(tip),
+			    namep, ctp);
 		}
 
 		/*
diff --git a/usr/src/uts/common/fs/udfs/udf_vnops.c b/usr/src/uts/common/fs/udfs/udf_vnops.c
index 93cc4d49e8..7e17f16ce2 100644
--- a/usr/src/uts/common/fs/udfs/udf_vnops.c
+++ b/usr/src/uts/common/fs/udfs/udf_vnops.c
@@ -569,8 +569,11 @@ udf_setattr(
 			goto update_inode;
 		}
 
-		if (vap->va_size == 0)
+		if (vap->va_size == 0) {
 			vnevent_truncate(vp, ct);
+		} else {
+			vnevent_resize(vp, ct);
+		}
 	}
 	/*
 	 * Change file access or modified times.
@@ -1649,8 +1652,13 @@ udf_space(
 	} else if ((error = convoff(vp, bfp, 0, offset)) == 0) {
 		error = ud_freesp(vp, bfp, flag, cr);
 
-		if (error == 0 && bfp->l_start == 0)
-			vnevent_truncate(vp, ct);
+		if (error == 0) {
+			if (bfp->l_start == 0) {
+				vnevent_truncate(vp, ct);
+			} else {
+				vnevent_resize(vp, ct);
+			}
+		}
 	}
 
 	return (error);
diff --git a/usr/src/uts/common/fs/ufs/ufs_vnops.c b/usr/src/uts/common/fs/ufs/ufs_vnops.c
index 91efa776cc..10039536eb 100644
--- a/usr/src/uts/common/fs/ufs/ufs_vnops.c
+++ b/usr/src/uts/common/fs/ufs/ufs_vnops.c
@@ -2189,8 +2189,13 @@ again:
 			goto update_inode;
 		}
 
-		if (error == 0 && vap->va_size)
-			vnevent_truncate(vp, ct);
+		if (error == 0) {
+			if (vap->va_size) {
+				vnevent_truncate(vp, ct);
+			} else {
+				vnevent_resize(vp, ct);
+			}
+		}
 	}
 
 	if (ulp) {
@@ -3715,12 +3720,7 @@ retry_firstlock:
 
 	if (error == 0) {
 		vnevent_rename_src(ITOV(sip), sdvp, snm, ct);
-		/*
-		 * Notify the target directory of the rename event
-		 * if source and target directories are not the same.
-		 */
-		if (sdvp != tdvp)
-			vnevent_rename_dest_dir(tdvp, ct);
+		vnevent_rename_dest_dir(tdvp, ITOV(sip), tnm, ct);
 	}
 
 errout:
@@ -4455,8 +4455,13 @@ ufs_space(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
 				return (error);
 			error = ufs_freesp(vp, bfp, flag, cr);
 
-			if (error == 0 && bfp->l_start == 0)
-				vnevent_truncate(vp, ct);
+			if (error == 0) {
+				if (bfp->l_start == 0) {
+					vnevent_truncate(vp, ct);
+				} else {
+					vnevent_resize(vp, ct);
+				}
+			}
 		} else if (cmd == F_ALLOCSP) {
 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
 			    ULOCKFS_FALLOCATE_MASK);
@@ -5735,10 +5740,10 @@ ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp,
 	struct ufsvfs	*ufsvfsp;
 
 	/*
-	 * Regular files reject edge-triggered pollers.
+	 * Regular files reject epollers (and edge-triggered pollers).
 	 * See the comment in fs_poll() for a more detailed explanation.
 	 */
-	if (ev & POLLET) {
+	if (fs_reject_epoll() || (ev & POLLET) != 0) {
 		return (EPERM);
 	}
 
diff --git a/usr/src/uts/common/fs/vfs.c b/usr/src/uts/common/fs/vfs.c
index 42198e2388..5a88c3e69d 100644
--- a/usr/src/uts/common/fs/vfs.c
+++ b/usr/src/uts/common/fs/vfs.c
@@ -856,9 +856,11 @@ vfs_mountroot(void)
 	for (p = practive; p != NULL; p = p->p_next) {
 		ASSERT(p == &p0 || p->p_parent == &p0);
 
+		mutex_enter(&p->p_lock);
 		PTOU(p)->u_cdir = rootdir;
 		VN_HOLD(PTOU(p)->u_cdir);
 		PTOU(p)->u_rdir = NULL;
+		mutex_exit(&p->p_lock);
 	}
 	mutex_exit(&pidlock);
 
@@ -3885,6 +3887,8 @@ vfs_to_modname(const char *vfstype)
 		vfstype = "fdfs";
 	} else if (strncmp(vfstype, "nfs", 3) == 0) {
 		vfstype = "nfs";
+	} else if (strcmp(vfstype, "lxproc") == 0) {
+		vfstype = "lxprocfs";
 	}
 
 	return (vfstype);
diff --git a/usr/src/uts/common/fs/vnode.c b/usr/src/uts/common/fs/vnode.c
index e6243c17be..e0a328c6d3 100644
--- a/usr/src/uts/common/fs/vnode.c
+++ b/usr/src/uts/common/fs/vnode.c
@@ -207,6 +207,11 @@ static void 		(**vsd_destructor)(void *);
 		cr = crgetmapped(cr);					\
 	}
 
+#define	VOP_LATENCY_10MS	10000000
+#define	VOP_LATENCY_100MS	100000000
+#define	VOP_LATENCY_1S		1000000000
+#define	VOP_LATENCY_10S		10000000000
+
 /*
  * Convert stat(2) formats to vnode types and vice versa.  (Knows about
  * numerical order of S_IFMT and vnode types.)
@@ -2543,6 +2548,7 @@ vnevent_rename_src(vnode_t *vp, vnode_t *dvp, char *name, caller_context_t *ct)
 	if (vp == NULL || vp->v_femhead == NULL) {
 		return;
 	}
+	(void) VOP_VNEVENT(dvp, VE_RENAME_SRC_DIR, vp, name, ct);
 	(void) VOP_VNEVENT(vp, VE_RENAME_SRC, dvp, name, ct);
 }
 
@@ -2557,12 +2563,13 @@ vnevent_rename_dest(vnode_t *vp, vnode_t *dvp, char *name,
 }
 
 void
-vnevent_rename_dest_dir(vnode_t *vp, caller_context_t *ct)
+vnevent_rename_dest_dir(vnode_t *vp, vnode_t *nvp, char *name,
+    caller_context_t *ct)
 {
 	if (vp == NULL || vp->v_femhead == NULL) {
 		return;
 	}
-	(void) VOP_VNEVENT(vp, VE_RENAME_DEST_DIR, NULL, NULL, ct);
+	(void) VOP_VNEVENT(vp, VE_RENAME_DEST_DIR, nvp, name, ct);
 }
 
 void
@@ -2649,6 +2656,15 @@ vnevent_truncate(vnode_t *vp, caller_context_t *ct)
 	(void) VOP_VNEVENT(vp, VE_TRUNCATE, NULL, NULL, ct);
 }
 
+void
+vnevent_resize(vnode_t *vp, caller_context_t *ct)
+{
+	if (vp == NULL || vp->v_femhead == NULL) {
+		return;
+	}
+	(void) VOP_VNEVENT(vp, VE_RESIZE, NULL, NULL, ct);
+}
+
 /*
  * Vnode accessors.
  */
@@ -3424,14 +3440,58 @@ fop_read(
 	cred_t *cr,
 	caller_context_t *ct)
 {
-	int	err;
 	ssize_t	resid_start = uiop->uio_resid;
+	zone_t	*zonep = curzone;
+	zone_vfs_kstat_t *zvp = zonep->zone_vfs_stats;
+
+	hrtime_t start = 0, lat;
+	ssize_t len;
+	int err;
+
+	if ((vp->v_type == VREG || vp->v_type == VDIR || vp->v_type == VBLK) &&
+	    vp->v_vfsp != NULL && (vp->v_vfsp->vfs_flag & VFS_STATS)) {
+		start = gethrtime();
+
+		mutex_enter(&zonep->zone_vfs_lock);
+		kstat_runq_enter(&zonep->zone_vfs_rwstats);
+		mutex_exit(&zonep->zone_vfs_lock);
+	}
 
 	VOPXID_MAP_CR(vp, cr);
 
 	err = (*(vp)->v_op->vop_read)(vp, uiop, ioflag, cr, ct);
-	VOPSTATS_UPDATE_IO(vp, read,
-	    read_bytes, (resid_start - uiop->uio_resid));
+	len = resid_start - uiop->uio_resid;
+
+	VOPSTATS_UPDATE_IO(vp, read, read_bytes, len);
+
+	if (start != 0) {
+		mutex_enter(&zonep->zone_vfs_lock);
+		zonep->zone_vfs_rwstats.reads++;
+		zonep->zone_vfs_rwstats.nread += len;
+		kstat_runq_exit(&zonep->zone_vfs_rwstats);
+		mutex_exit(&zonep->zone_vfs_lock);
+
+		lat = gethrtime() - start;
+
+		if (lat >= VOP_LATENCY_10MS) {
+			if (lat < VOP_LATENCY_100MS)
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			else if (lat < VOP_LATENCY_1S) {
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+			} else if (lat < VOP_LATENCY_10S) {
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+			} else {
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_10s_ops.value.ui64);
+			}
+		}
+	}
+
 	return (err);
 }
 
@@ -3443,14 +3503,63 @@ fop_write(
 	cred_t *cr,
 	caller_context_t *ct)
 {
-	int	err;
 	ssize_t	resid_start = uiop->uio_resid;
+	zone_t	*zonep = curzone;
+	zone_vfs_kstat_t *zvp = zonep->zone_vfs_stats;
+
+	hrtime_t start = 0, lat;
+	ssize_t len;
+	int	err;
+
+	/*
+	 * For the purposes of VFS kstat consumers, the "waitq" calculation is
+	 * repurposed as the active queue for VFS write operations.  There's no
+	 * actual wait queue for VFS operations.
+	 */
+	if ((vp->v_type == VREG || vp->v_type == VDIR || vp->v_type == VBLK) &&
+	    vp->v_vfsp != NULL && (vp->v_vfsp->vfs_flag & VFS_STATS)) {
+		start = gethrtime();
+
+		mutex_enter(&zonep->zone_vfs_lock);
+		kstat_waitq_enter(&zonep->zone_vfs_rwstats);
+		mutex_exit(&zonep->zone_vfs_lock);
+	}
 
 	VOPXID_MAP_CR(vp, cr);
 
 	err = (*(vp)->v_op->vop_write)(vp, uiop, ioflag, cr, ct);
-	VOPSTATS_UPDATE_IO(vp, write,
-	    write_bytes, (resid_start - uiop->uio_resid));
+	len = resid_start - uiop->uio_resid;
+
+	VOPSTATS_UPDATE_IO(vp, write, write_bytes, len);
+
+	if (start != 0) {
+		mutex_enter(&zonep->zone_vfs_lock);
+		zonep->zone_vfs_rwstats.writes++;
+		zonep->zone_vfs_rwstats.nwritten += len;
+		kstat_waitq_exit(&zonep->zone_vfs_rwstats);
+		mutex_exit(&zonep->zone_vfs_lock);
+
+		lat = gethrtime() - start;
+
+		if (lat >= VOP_LATENCY_10MS) {
+			if (lat < VOP_LATENCY_100MS)
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			else if (lat < VOP_LATENCY_1S) {
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+			} else if (lat < VOP_LATENCY_10S) {
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+			} else {
+				atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+				atomic_inc_64(&zvp->zv_10s_ops.value.ui64);
+			}
+		}
+	}
+
 	return (err);
 }
 
diff --git a/usr/src/uts/common/fs/zfs/abd.c b/usr/src/uts/common/fs/zfs/abd.c
index 4d7b2cb56a..49e23bd43d 100644
--- a/usr/src/uts/common/fs/zfs/abd.c
+++ b/usr/src/uts/common/fs/zfs/abd.c
@@ -146,7 +146,10 @@ boolean_t zfs_abd_scatter_enabled = B_TRUE;
  * it at runtime would cause ABD iteration to work incorrectly for ABDs which
  * were allocated with the old size, so a safeguard has been put in place which
  * will cause the machine to panic if you change it and try to access the data
- * within a scattered ABD.
+ * within a scattered ABD. Note that tuning this value to be smaller than the
+ * page size can induce heavy fragmentation in the slab layer, which may itself
+ * result in more memory waste than is saved by the smaller chunk size -- and
+ * will induces more computational work in the slab layer. Tune with caution!
  */
 size_t zfs_abd_chunk_size = 4096;
 
diff --git a/usr/src/uts/common/fs/zfs/arc.c b/usr/src/uts/common/fs/zfs/arc.c
index 8fa98b14f0..af70eee950 100644
--- a/usr/src/uts/common/fs/zfs/arc.c
+++ b/usr/src/uts/common/fs/zfs/arc.c
@@ -263,6 +263,7 @@
 #include <sys/vdev.h>
 #include <sys/vdev_impl.h>
 #include <sys/dsl_pool.h>
+#include <sys/zfs_zone.h>
 #include <sys/zio_checksum.h>
 #include <sys/multilist.h>
 #include <sys/abd.h>
@@ -324,7 +325,7 @@ int arc_grow_retry = 60;
 int arc_kmem_cache_reap_retry_ms = 1000;
 
 /* shift of arc_c for calculating overflow limit in arc_get_data_impl */
-int zfs_arc_overflow_shift = 8;
+int zfs_arc_overflow_shift = 3;
 
 /* shift of arc_c for calculating both min and max arc_p */
 int arc_p_min_shift = 4;
@@ -5291,6 +5292,14 @@ top:
 		rzio = zio_read(pio, spa, bp, hdr->b_l1hdr.b_pabd, size,
 		    arc_read_done, hdr, priority, zio_flags, zb);
 
+		/*
+		 * At this point, this read I/O has already missed in the ARC
+		 * and will be going through to the disk.  The I/O throttle
+		 * should delay this I/O if this zone is using more than its I/O
+		 * priority allows.
+		 */
+		zfs_zone_io_throttle(ZFS_ZONE_IOP_READ);
+
 		if (*arc_flags & ARC_FLAG_WAIT)
 			return (zio_wait(rzio));
 
@@ -6236,6 +6245,10 @@ arc_init(void)
 	if (arc_c_min < arc_meta_limit / 2 && zfs_arc_min == 0)
 		arc_c_min = arc_meta_limit / 2;
 
+	/* On larger-memory machines, we clamp the minimum at 1GB */
+	if (zfs_arc_min == 0)
+		arc_c_min = MIN(arc_c_min, (1 << 30));
+
 	if (zfs_arc_meta_min > 0) {
 		arc_meta_min = zfs_arc_meta_min;
 	} else {
diff --git a/usr/src/uts/common/fs/zfs/dbuf.c b/usr/src/uts/common/fs/zfs/dbuf.c
index 4fcf14fba5..f82040d035 100644
--- a/usr/src/uts/common/fs/zfs/dbuf.c
+++ b/usr/src/uts/common/fs/zfs/dbuf.c
@@ -1002,8 +1002,19 @@ dbuf_read_impl(dmu_buf_impl_t *db, zio_t *zio, uint32_t flags)
 		arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
 		if (bonuslen < DN_MAX_BONUSLEN)
 			bzero(db->db.db_data, DN_MAX_BONUSLEN);
-		if (bonuslen)
-			bcopy(DN_BONUS(dn->dn_phys), db->db.db_data, bonuslen);
+
+		if (bonuslen) {
+			/*
+			 * Absent byzantine on-disk corruption, we fully expect
+			 * our bonuslen to be no more than DN_MAX_BONUSLEN --
+			 * but we nonetheless explicitly clamp it on the bcopy()
+			 * to prevent any on-disk corruption from becoming
+			 * rampant in-kernel corruption.
+			 */
+			bcopy(DN_BONUS(dn->dn_phys), db->db.db_data,
+			    MIN(bonuslen, DN_MAX_BONUSLEN));
+		}
+
 		DB_DNODE_EXIT(db);
 		db->db_state = DB_CACHED;
 		mutex_exit(&db->db_mtx);
diff --git a/usr/src/uts/common/fs/zfs/dmu.c b/usr/src/uts/common/fs/zfs/dmu.c
index 23b1c52212..ce0c42d1ee 100644
--- a/usr/src/uts/common/fs/zfs/dmu.c
+++ b/usr/src/uts/common/fs/zfs/dmu.c
@@ -2148,7 +2148,6 @@ dmu_write_policy(objset_t *os, dnode_t *dn, int level, int wp, zio_prop_t *zp)
 			    ZCHECKSUM_FLAG_DEDUP))
 				dedup_verify = B_TRUE;
 		}
-
 		/*
 		 * Enable nopwrite if we have secure enough checksum
 		 * algorithm (see comment in zio_nop_write) and
diff --git a/usr/src/uts/common/fs/zfs/dmu_send.c b/usr/src/uts/common/fs/zfs/dmu_send.c
index 62abee3637..026623f3d5 100644
--- a/usr/src/uts/common/fs/zfs/dmu_send.c
+++ b/usr/src/uts/common/fs/zfs/dmu_send.c
@@ -22,7 +22,7 @@
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
- * Copyright (c) 2014, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc. All rights reserved.
  * Copyright 2014 HybridCluster. All rights reserved.
  * Copyright 2016 RackTop Systems.
  * Copyright (c) 2014 Integros [integros.com]
@@ -2642,8 +2642,12 @@ receive_read_record(struct receive_arg *ra)
 	{
 		struct drr_object *drro = &ra->rrd->header.drr_u.drr_object;
 		uint32_t size = P2ROUNDUP(drro->drr_bonuslen, 8);
-		void *buf = kmem_zalloc(size, KM_SLEEP);
+		void *buf = NULL;
 		dmu_object_info_t doi;
+
+		if (size > 0)
+			buf = kmem_zalloc(size, KM_SLEEP);
+
 		err = receive_read_payload_and_next_header(ra, size, buf);
 		if (err != 0) {
 			kmem_free(buf, size);
diff --git a/usr/src/uts/common/fs/zfs/dmu_tx.c b/usr/src/uts/common/fs/zfs/dmu_tx.c
index 557f7f2e81..549c3ca1b0 100644
--- a/usr/src/uts/common/fs/zfs/dmu_tx.c
+++ b/usr/src/uts/common/fs/zfs/dmu_tx.c
@@ -39,11 +39,11 @@
 #include <sys/sa_impl.h>
 #include <sys/zfs_context.h>
 #include <sys/varargs.h>
+#include <sys/zfs_zone.h>
 
 typedef void (*dmu_tx_hold_func_t)(dmu_tx_t *tx, struct dnode *dn,
     uint64_t arg1, uint64_t arg2);
 
-
 dmu_tx_t *
 dmu_tx_create_dd(dsl_dir_t *dd)
 {
@@ -213,6 +213,8 @@ dmu_tx_count_write(dmu_tx_hold_t *txh, uint64_t off, uint64_t len)
 	if (len == 0)
 		return;
 
+	zfs_zone_io_throttle(ZFS_ZONE_IOP_LOGICAL_WRITE);
+
 	(void) refcount_add_many(&txh->txh_space_towrite, len, FTAG);
 
 	if (refcount_count(&txh->txh_space_towrite) > 2 * DMU_MAX_ACCESS)
diff --git a/usr/src/uts/common/fs/zfs/dsl_dir.c b/usr/src/uts/common/fs/zfs/dsl_dir.c
index 298516f8a4..35e76e273e 100644
--- a/usr/src/uts/common/fs/zfs/dsl_dir.c
+++ b/usr/src/uts/common/fs/zfs/dsl_dir.c
@@ -42,6 +42,7 @@
 #include <sys/zio.h>
 #include <sys/arc.h>
 #include <sys/sunddi.h>
+#include <sys/zfs_zone.h>
 #include <sys/zfeature.h>
 #include <sys/policy.h>
 #include <sys/zfs_znode.h>
@@ -1398,7 +1399,7 @@ dsl_dir_tempreserve_space(dsl_dir_t *dd, uint64_t lsize, uint64_t asize,
 			 * locks are held.
 			 */
 			txg_delay(dd->dd_pool, tx->tx_txg,
-			    MSEC2NSEC(10), MSEC2NSEC(10));
+			    zfs_zone_txg_delay(), MSEC2NSEC(10));
 			err = SET_ERROR(ERESTART);
 		}
 	}
diff --git a/usr/src/uts/common/fs/zfs/dsl_pool.c b/usr/src/uts/common/fs/zfs/dsl_pool.c
index 9f9111efa2..854be91503 100644
--- a/usr/src/uts/common/fs/zfs/dsl_pool.c
+++ b/usr/src/uts/common/fs/zfs/dsl_pool.c
@@ -44,6 +44,7 @@
 #include <sys/zfs_znode.h>
 #include <sys/spa_impl.h>
 #include <sys/dsl_deadlist.h>
+#include <sys/zfs_zone.h>
 #include <sys/vdev_impl.h>
 #include <sys/metaslab_impl.h>
 #include <sys/bptree.h>
@@ -858,7 +859,7 @@ dsl_pool_undirty_space(dsl_pool_t *dp, int64_t space, uint64_t txg)
 	}
 	ASSERT3U(dp->dp_dirty_pertxg[txg & TXG_MASK], >=, space);
 	dp->dp_dirty_pertxg[txg & TXG_MASK] -= space;
-	ASSERT3U(dp->dp_dirty_total, >=, space);
+	VERIFY3U(dp->dp_dirty_total, >=, space);
 	dsl_pool_dirty_delta(dp, -space);
 	mutex_exit(&dp->dp_lock);
 }
diff --git a/usr/src/uts/common/fs/zfs/metaslab.c b/usr/src/uts/common/fs/zfs/metaslab.c
index b965654872..17613c41f9 100644
--- a/usr/src/uts/common/fs/zfs/metaslab.c
+++ b/usr/src/uts/common/fs/zfs/metaslab.c
@@ -60,6 +60,11 @@ int zfs_metaslab_sm_blksz = (1 << 12);
 int zfs_condense_pct = 200;
 
 /*
+ * Never condense any space map.  This is for debugging/recovery only.
+ */
+int zfs_condense_never = 0;
+
+/*
  * Condensing a metaslab is not guaranteed to actually reduce the amount of
  * space used on disk. In particular, a space map uses data in increments of
  * MAX(1 << ashift, space_map_blksize), so a metaslab might use the
@@ -2270,6 +2275,9 @@ metaslab_should_condense(metaslab_t *msp)
 	ASSERT(MUTEX_HELD(&msp->ms_lock));
 	ASSERT(msp->ms_loaded);
 
+	if (zfs_condense_never != 0)
+		return (B_FALSE);
+
 	/*
 	 * Allocations and frees in early passes are generally more space
 	 * efficient (in terms of blocks described in space map entries)
diff --git a/usr/src/uts/common/fs/zfs/sa.c b/usr/src/uts/common/fs/zfs/sa.c
index f36483d265..1b8ee58880 100644
--- a/usr/src/uts/common/fs/zfs/sa.c
+++ b/usr/src/uts/common/fs/zfs/sa.c
@@ -24,6 +24,7 @@
  * Portions Copyright 2011 iXsystems, Inc
  * Copyright (c) 2013, 2017 by Delphix. All rights reserved.
  * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
+ * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
  */
 
@@ -407,15 +408,18 @@ sa_add_layout_entry(objset_t *os, sa_attr_type_t *attrs, int attr_count,
 {
 	sa_os_t *sa = os->os_sa;
 	sa_lot_t *tb, *findtb;
-	int i;
+	int i, size;
 	avl_index_t loc;
 
 	ASSERT(MUTEX_HELD(&sa->sa_lock));
 	tb = kmem_zalloc(sizeof (sa_lot_t), KM_SLEEP);
 	tb->lot_attr_count = attr_count;
-	tb->lot_attrs = kmem_alloc(sizeof (sa_attr_type_t) * attr_count,
-	    KM_SLEEP);
-	bcopy(attrs, tb->lot_attrs, sizeof (sa_attr_type_t) * attr_count);
+
+	if ((size = sizeof (sa_attr_type_t) * attr_count) != 0) {
+		tb->lot_attrs = kmem_alloc(size, KM_SLEEP);
+		bcopy(attrs, tb->lot_attrs, size);
+	}
+
 	tb->lot_num = lot_num;
 	tb->lot_hash = hash;
 	tb->lot_instance = 0;
diff --git a/usr/src/uts/common/fs/zfs/sys/vdev_impl.h b/usr/src/uts/common/fs/zfs/sys/vdev_impl.h
index d4ba5669a0..71753cf24f 100644
--- a/usr/src/uts/common/fs/zfs/sys/vdev_impl.h
+++ b/usr/src/uts/common/fs/zfs/sys/vdev_impl.h
@@ -142,6 +142,7 @@ struct vdev_queue {
 	avl_tree_t	vq_read_offset_tree;
 	avl_tree_t	vq_write_offset_tree;
 	uint64_t	vq_last_offset;
+	zoneid_t	vq_last_zone_id;
 	hrtime_t	vq_io_complete_ts; /* time last i/o completed */
 	kmutex_t	vq_lock;
 };
diff --git a/usr/src/uts/common/fs/zfs/sys/zfs_zone.h b/usr/src/uts/common/fs/zfs/sys/zfs_zone.h
new file mode 100644
index 0000000000..f1431b3f55
--- /dev/null
+++ b/usr/src/uts/common/fs/zfs/sys/zfs_zone.h
@@ -0,0 +1,63 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2015, Joyent, Inc. All rights reserved.
+ */
+
+#ifndef	_SYS_FS_ZFS_ZONE_H
+#define	_SYS_FS_ZFS_ZONE_H
+
+#ifdef _KERNEL
+#include <sys/isa_defs.h>
+#include <sys/types32.h>
+#include <sys/vdev_impl.h>
+#include <sys/zio.h>
+#endif
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+typedef enum {
+	ZFS_ZONE_IOP_READ = 0,
+	ZFS_ZONE_IOP_WRITE,
+	ZFS_ZONE_IOP_LOGICAL_WRITE,
+} zfs_zone_iop_type_t;
+
+extern void zfs_zone_io_throttle(zfs_zone_iop_type_t);
+
+extern void zfs_zone_zio_init(zio_t *);
+extern void zfs_zone_zio_start(zio_t *);
+extern void zfs_zone_zio_done(zio_t *);
+extern void zfs_zone_zio_dequeue(zio_t *);
+extern void zfs_zone_zio_enqueue(zio_t *);
+extern void zfs_zone_report_txg_sync(void *);
+extern hrtime_t zfs_zone_txg_delay();
+#ifdef _KERNEL
+extern zio_t *zfs_zone_schedule(vdev_queue_t *, zio_priority_t, avl_index_t,
+    avl_tree_t *);
+#endif
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_FS_ZFS_ZONE_H */
diff --git a/usr/src/uts/common/fs/zfs/sys/zio.h b/usr/src/uts/common/fs/zfs/sys/zio.h
index ce3626e842..c12cb70906 100644
--- a/usr/src/uts/common/fs/zfs/sys/zio.h
+++ b/usr/src/uts/common/fs/zfs/sys/zio.h
@@ -432,6 +432,7 @@ struct zio {
 	hrtime_t	io_timestamp;
 	hrtime_t	io_queued_timestamp;
 	hrtime_t	io_target_timestamp;
+	hrtime_t	io_dispatched;	/* time I/O was dispatched to disk */
 	avl_node_t	io_queue_node;
 	avl_node_t	io_offset_node;
 	avl_node_t	io_alloc_node;
@@ -464,6 +465,7 @@ struct zio {
 	zio_cksum_report_t *io_cksum_report;
 	uint64_t	io_ena;
 
+	zoneid_t	io_zoneid;	/* zone which originated this I/O */
 	/* Taskq dispatching state */
 	taskq_ent_t	io_tqent;
 };
diff --git a/usr/src/uts/common/fs/zfs/txg.c b/usr/src/uts/common/fs/zfs/txg.c
index 743b914a20..6d2ffe9921 100644
--- a/usr/src/uts/common/fs/zfs/txg.c
+++ b/usr/src/uts/common/fs/zfs/txg.c
@@ -32,6 +32,7 @@
 #include <sys/dsl_scan.h>
 #include <sys/zil.h>
 #include <sys/callb.h>
+#include <sys/zfs_zone.h>
 
 /*
  * ZFS Transaction Groups
@@ -533,6 +534,8 @@ txg_sync_thread(void *arg)
 		    txg, tx->tx_quiesce_txg_waiting, tx->tx_sync_txg_waiting);
 		mutex_exit(&tx->tx_sync_lock);
 
+		zfs_zone_report_txg_sync(dp);
+
 		start = ddi_get_lbolt();
 		spa_sync(spa, txg);
 		delta = ddi_get_lbolt() - start;
diff --git a/usr/src/uts/common/fs/zfs/vdev_disk.c b/usr/src/uts/common/fs/zfs/vdev_disk.c
index 6adc387c88..e4b86b419b 100644
--- a/usr/src/uts/common/fs/zfs/vdev_disk.c
+++ b/usr/src/uts/common/fs/zfs/vdev_disk.c
@@ -26,6 +26,7 @@
  */
 
 #include <sys/zfs_context.h>
+#include <sys/zfs_zone.h>
 #include <sys/spa_impl.h>
 #include <sys/refcount.h>
 #include <sys/vdev_disk.h>
@@ -45,6 +46,11 @@ extern ldi_ident_t zfs_li;
 
 static void vdev_disk_close(vdev_t *);
 
+typedef struct vdev_disk_buf {
+	buf_t	vdb_buf;
+	zio_t	*vdb_io;
+} vdev_disk_buf_t;
+
 typedef struct vdev_disk_ldi_cb {
 	list_node_t		lcb_next;
 	ldi_callback_id_t	lcb_id;
@@ -128,6 +134,8 @@ vdev_disk_off_finalize(ldi_handle_t lh, ldi_ev_cookie_t ecookie,
     int ldi_result, void *arg, void *ev_data)
 {
 	vdev_t *vd = (vdev_t *)arg;
+	vdev_disk_t *dvd = vd->vdev_tsd;
+	vdev_disk_ldi_cb_t *lcb;
 
 	/*
 	 * Ignore events other than offline.
@@ -561,6 +569,7 @@ static void
 vdev_disk_close(vdev_t *vd)
 {
 	vdev_disk_t *dvd = vd->vdev_tsd;
+	vdev_disk_ldi_cb_t *lcb;
 
 	if (vd->vdev_reopening || dvd == NULL)
 		return;
@@ -794,6 +803,8 @@ vdev_disk_io_start(zio_t *zio)
 	bp->b_bufsize = zio->io_size;
 	bp->b_iodone = (int (*)())vdev_disk_io_intr;
 
+	zfs_zone_zio_start(zio);
+
 	/* ldi_strategy() will return non-zero only on programming errors */
 	VERIFY(ldi_strategy(dvd->vd_lh, bp) == 0);
 }
@@ -803,6 +814,8 @@ vdev_disk_io_done(zio_t *zio)
 {
 	vdev_t *vd = zio->io_vd;
 
+	zfs_zone_zio_done(zio);
+
 	/*
 	 * If the device returned EIO, then attempt a DKIOCSTATE ioctl to see if
 	 * the device has been removed.  If this is the case, then we trigger an
diff --git a/usr/src/uts/common/fs/zfs/vdev_queue.c b/usr/src/uts/common/fs/zfs/vdev_queue.c
index f29f4eeb9d..37de37e4b6 100644
--- a/usr/src/uts/common/fs/zfs/vdev_queue.c
+++ b/usr/src/uts/common/fs/zfs/vdev_queue.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 /*
@@ -34,6 +35,7 @@
 #include <sys/zio.h>
 #include <sys/avl.h>
 #include <sys/dsl_pool.h>
+#include <sys/zfs_zone.h>
 #include <sys/metaslab_impl.h>
 #include <sys/abd.h>
 
@@ -144,7 +146,7 @@ uint32_t zfs_vdev_sync_write_min_active = 10;
 uint32_t zfs_vdev_sync_write_max_active = 10;
 uint32_t zfs_vdev_async_read_min_active = 1;
 uint32_t zfs_vdev_async_read_max_active = 3;
-uint32_t zfs_vdev_async_write_min_active = 1;
+uint32_t zfs_vdev_async_write_min_active = 3;
 uint32_t zfs_vdev_async_write_max_active = 10;
 uint32_t zfs_vdev_scrub_min_active = 1;
 uint32_t zfs_vdev_scrub_max_active = 2;
@@ -270,6 +272,8 @@ vdev_queue_init(vdev_t *vd)
 	    vdev_queue_offset_compare, sizeof (zio_t),
 	    offsetof(struct zio, io_offset_node));
 
+	vq->vq_last_zone_id = 0;
+
 	for (zio_priority_t p = 0; p < ZIO_PRIORITY_NUM_QUEUEABLE; p++) {
 		int (*compfn) (const void *, const void *);
 
@@ -308,6 +312,7 @@ vdev_queue_io_add(vdev_queue_t *vq, zio_t *zio)
 	spa_t *spa = zio->io_spa;
 
 	ASSERT3U(zio->io_priority, <, ZIO_PRIORITY_NUM_QUEUEABLE);
+	zfs_zone_zio_enqueue(zio);
 	avl_add(vdev_queue_class_tree(vq, zio->io_priority), zio);
 	avl_add(vdev_queue_type_tree(vq, zio->io_type), zio);
 
@@ -324,6 +329,7 @@ vdev_queue_io_remove(vdev_queue_t *vq, zio_t *zio)
 	spa_t *spa = zio->io_spa;
 
 	ASSERT3U(zio->io_priority, <, ZIO_PRIORITY_NUM_QUEUEABLE);
+	zfs_zone_zio_dequeue(zio);
 	avl_remove(vdev_queue_class_tree(vq, zio->io_priority), zio);
 	avl_remove(vdev_queue_type_tree(vq, zio->io_type), zio);
 
@@ -703,7 +709,11 @@ again:
 	search.io_timestamp = 0;
 	search.io_offset = vq->vq_last_offset + 1;
 	VERIFY3P(avl_find(tree, &search, &idx), ==, NULL);
+#ifdef _KERNEL
+	zio = zfs_zone_schedule(vq, p, idx, tree);
+#else
 	zio = avl_nearest(tree, idx, AVL_AFTER);
+#endif
 	if (zio == NULL)
 		zio = avl_first(tree);
 	ASSERT3U(zio->io_priority, ==, p);
diff --git a/usr/src/uts/common/fs/zfs/zfs_dir.c b/usr/src/uts/common/fs/zfs/zfs_dir.c
index ad78295a54..8c4c05a1d1 100644
--- a/usr/src/uts/common/fs/zfs/zfs_dir.c
+++ b/usr/src/uts/common/fs/zfs/zfs_dir.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc.
  * Copyright (c) 2013, 2016 by Delphix. All rights reserved.
  * Copyright 2017 Nexenta Systems, Inc.
  * Copyright (c) 2015, Joyent, Inc.
diff --git a/usr/src/uts/common/fs/zfs/zfs_ioctl.c b/usr/src/uts/common/fs/zfs/zfs_ioctl.c
index 175938eeb8..ffdc9ad6a0 100644
--- a/usr/src/uts/common/fs/zfs/zfs_ioctl.c
+++ b/usr/src/uts/common/fs/zfs/zfs_ioctl.c
@@ -633,9 +633,10 @@ zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
 	 * Check permissions for special properties.
 	 */
 	switch (prop) {
+	case ZFS_PROP_DEDUP:
 	case ZFS_PROP_ZONED:
 		/*
-		 * Disallow setting of 'zoned' from within a local zone.
+		 * Disallow setting these properties from within a local zone.
 		 */
 		if (!INGLOBALZONE(curproc))
 			return (SET_ERROR(EPERM));
@@ -965,6 +966,9 @@ zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 {
 	int error;
 
+	if (secpolicy_fs_import(cr) != 0)
+		return (set_errno(EPERM));
+
 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
 		return (error);
@@ -2081,7 +2085,8 @@ zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
 }
 
 static int
-zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
+zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os,
+    boolean_t cachedpropsonly)
 {
 	int error = 0;
 	nvlist_t *nv;
@@ -2099,7 +2104,8 @@ zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
 		 * XXX reading with out owning
 		 */
 		if (!zc->zc_objset_stats.dds_inconsistent &&
-		    dmu_objset_type(os) == DMU_OST_ZVOL) {
+		    dmu_objset_type(os) == DMU_OST_ZVOL &&
+		    !cachedpropsonly) {
 			error = zvol_get_stats(os, nv);
 			if (error == EIO)
 				return (error);
@@ -2126,11 +2132,24 @@ static int
 zfs_ioc_objset_stats(zfs_cmd_t *zc)
 {
 	objset_t *os;
+	nvlist_t *nvl = NULL;
+	boolean_t cachedpropsonly = B_FALSE;
 	int error;
 
+	if (zc->zc_nvlist_src != NULL &&
+	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
+	    zc->zc_iflags, &nvl) != 0))
+		return (error);
+
+	if (nvl != NULL) {
+		(void) nvlist_lookup_boolean_value(nvl, "cachedpropsonly",
+		    &cachedpropsonly);
+		nvlist_free(nvl);
+	}
+
 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
 	if (error == 0) {
-		error = zfs_ioc_objset_stats_impl(zc, os);
+		error = zfs_ioc_objset_stats_impl(zc, os, cachedpropsonly);
 		dmu_objset_rele(os, FTAG);
 	}
 
@@ -2325,8 +2344,21 @@ static int
 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
 {
 	objset_t *os;
+	nvlist_t *nvl = NULL;
+	boolean_t cachedpropsonly = B_FALSE;
 	int error;
 
+	if (zc->zc_nvlist_src != NULL &&
+	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
+	    zc->zc_iflags, &nvl) != 0))
+		return (error);
+
+	if (nvl != NULL) {
+		(void) nvlist_lookup_boolean_value(nvl, "cachedpropsonly",
+		    &cachedpropsonly);
+		nvlist_free(nvl);
+	}
+
 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
 	if (error != 0) {
 		return (error == ENOENT ? ESRCH : error);
@@ -2356,8 +2388,10 @@ zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
 			objset_t *ossnap;
 
 			error = dmu_objset_from_ds(ds, &ossnap);
-			if (error == 0)
-				error = zfs_ioc_objset_stats_impl(zc, ossnap);
+			if (error == 0) {
+				error = zfs_ioc_objset_stats_impl(zc,
+				    ossnap, cachedpropsonly);
+			}
 			dsl_dataset_rele(ds, FTAG);
 		}
 	} else if (error == ENOENT) {
@@ -3042,6 +3076,7 @@ zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
 	uint64_t sense = ZFS_PROP_UNDEFINED;
 	uint64_t norm = ZFS_PROP_UNDEFINED;
 	uint64_t u8 = ZFS_PROP_UNDEFINED;
+	int error;
 
 	ASSERT(zplprops != NULL);
 
@@ -3088,8 +3123,9 @@ zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
 	VERIFY(nvlist_add_uint64(zplprops,
 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
 
-	if (norm == ZFS_PROP_UNDEFINED)
-		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
+	if (norm == ZFS_PROP_UNDEFINED &&
+	    (error = zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm)) != 0)
+		return (error);
 	VERIFY(nvlist_add_uint64(zplprops,
 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
 
@@ -3098,13 +3134,15 @@ zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
 	 */
 	if (norm)
 		u8 = 1;
-	if (u8 == ZFS_PROP_UNDEFINED)
-		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
+	if (u8 == ZFS_PROP_UNDEFINED &&
+	    (error = zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8)) != 0)
+		return (error);
 	VERIFY(nvlist_add_uint64(zplprops,
 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
 
-	if (sense == ZFS_PROP_UNDEFINED)
-		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
+	if (sense == ZFS_PROP_UNDEFINED &&
+	    (error = zfs_get_zplprop(os, ZFS_PROP_CASE, &sense)) != 0)
+		return (error);
 	VERIFY(nvlist_add_uint64(zplprops,
 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
 
diff --git a/usr/src/uts/common/fs/zfs/zfs_vfsops.c b/usr/src/uts/common/fs/zfs/zfs_vfsops.c
index f7beea4cc9..a5912b19ab 100644
--- a/usr/src/uts/common/fs/zfs/zfs_vfsops.c
+++ b/usr/src/uts/common/fs/zfs/zfs_vfsops.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright (c) 2012, 2015 by Delphix. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
  * Copyright 2016 Nexenta Systems, Inc. All rights reserved.
@@ -1912,6 +1913,17 @@ zfs_umount(vfs_t *vfsp, int fflag, cred_t *cr)
 	if (zfsvfs->z_ctldir != NULL)
 		zfsctl_destroy(zfsvfs);
 
+	/*
+	 * If we're doing a forced unmount on a dataset which still has
+	 * references and is in a zone, then we need to cleanup the zone
+	 * reference at this point or else the zone will never be able to
+	 * shutdown.
+	 */
+	if ((fflag & MS_FORCE) && vfsp->vfs_count > 1 && vfsp->vfs_zone) {
+		zone_rele_ref(&vfsp->vfs_implp->vi_zone_ref, ZONE_REF_VFS);
+		vfsp->vfs_zone = NULL;
+	}
+
 	return (0);
 }
 
diff --git a/usr/src/uts/common/fs/zfs/zfs_vnops.c b/usr/src/uts/common/fs/zfs/zfs_vnops.c
index 70a7b959d9..792dbb7bac 100644
--- a/usr/src/uts/common/fs/zfs/zfs_vnops.c
+++ b/usr/src/uts/common/fs/zfs/zfs_vnops.c
@@ -23,7 +23,7 @@
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2012, 2017 by Delphix. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2016 Joyent, Inc.
  * Copyright 2017 Nexenta Systems, Inc.
  */
 
@@ -666,6 +666,7 @@ zfs_write(vnode_t *vp, uio_t *uio, int ioflag, cred_t *cr, caller_context_t *ct)
 	rl_t		*rl;
 	int		max_blksz = zfsvfs->z_max_blksz;
 	int		error = 0;
+	int		prev_error;
 	arc_buf_t	*abuf;
 	iovec_t		*aiov = NULL;
 	xuio_t		*xuio = NULL;
@@ -687,6 +688,17 @@ zfs_write(vnode_t *vp, uio_t *uio, int ioflag, cred_t *cr, caller_context_t *ct)
 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
 		limit = MAXOFFSET_T;
 
+	/*
+	 * Pre-fault the pages to ensure slow (eg NFS) pages
+	 * don't hold up txg.
+	 * Skip this if uio contains loaned arc_buf.
+	 */
+	if ((uio->uio_extflg == UIO_XUIO) &&
+	    (((xuio_t *)uio)->xu_type == UIOTYPE_ZEROCOPY))
+		xuio = (xuio_t *)uio;
+	else
+		uio_prefaultpages(n, uio);
+
 	ZFS_ENTER(zfsvfs);
 	ZFS_VERIFY_ZP(zp);
 
@@ -741,17 +753,6 @@ zfs_write(vnode_t *vp, uio_t *uio, int ioflag, cred_t *cr, caller_context_t *ct)
 	}
 
 	/*
-	 * Pre-fault the pages to ensure slow (eg NFS) pages
-	 * don't hold up txg.
-	 * Skip this if uio contains loaned arc_buf.
-	 */
-	if ((uio->uio_extflg == UIO_XUIO) &&
-	    (((xuio_t *)uio)->xu_type == UIOTYPE_ZEROCOPY))
-		xuio = (xuio_t *)uio;
-	else
-		uio_prefaultpages(MIN(n, max_blksz), uio);
-
-	/*
 	 * If in append mode, set the io offset pointer to eof.
 	 */
 	if (ioflag & FAPPEND) {
@@ -972,7 +973,6 @@ zfs_write(vnode_t *vp, uio_t *uio, int ioflag, cred_t *cr, caller_context_t *ct)
 		while ((end_size = zp->z_size) < uio->uio_loffset) {
 			(void) atomic_cas_64(&zp->z_size, end_size,
 			    uio->uio_loffset);
-			ASSERT(error == 0);
 		}
 		/*
 		 * If we are replaying and eof is non zero then force
@@ -982,18 +982,20 @@ zfs_write(vnode_t *vp, uio_t *uio, int ioflag, cred_t *cr, caller_context_t *ct)
 		if (zfsvfs->z_replay && zfsvfs->z_replay_eof != 0)
 			zp->z_size = zfsvfs->z_replay_eof;
 
+		/*
+		 * Keep track of a possible pre-existing error from a partial
+		 * write via dmu_write_uio_dbuf above.
+		 */
+		prev_error = error;
 		error = sa_bulk_update(zp->z_sa_hdl, bulk, count, tx);
 
 		zfs_log_write(zilog, tx, TX_WRITE, zp, woff, tx_bytes, ioflag);
 		dmu_tx_commit(tx);
 
-		if (error != 0)
+		if (prev_error != 0 || error != 0)
 			break;
 		ASSERT(tx_bytes == nbytes);
 		n -= nbytes;
-
-		if (!xuio && n > 0)
-			uio_prefaultpages(MIN(n, max_blksz), uio);
 	}
 
 	zfs_range_unlock(rl);
@@ -2854,8 +2856,11 @@ top:
 			return (err);
 		}
 
-		if (vap->va_size == 0)
+		if (vap->va_size == 0) {
 			vnevent_truncate(ZTOV(zp), ct);
+		} else {
+			vnevent_resize(ZTOV(zp), ct);
+		}
 	}
 
 	if (mask & (AT_ATIME|AT_MTIME) ||
@@ -3783,9 +3788,7 @@ top:
 
 	if (error == 0) {
 		vnevent_rename_src(ZTOV(szp), sdvp, snm, ct);
-		/* notify the target dir if it is not the same as source dir */
-		if (tdvp != sdvp)
-			vnevent_rename_dest_dir(tdvp, ct);
+		vnevent_rename_dest_dir(tdvp, ZTOV(szp), tnm, ct);
 	}
 out:
 	if (zl != NULL)
@@ -4818,10 +4821,6 @@ zfs_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
 	ASSERT3U(VTOZ(vp)->z_mapcnt, >=, pages);
 	atomic_add_64(&VTOZ(vp)->z_mapcnt, -pages);
 
-	if ((flags & MAP_SHARED) && (prot & PROT_WRITE) &&
-	    vn_has_cached_data(vp))
-		(void) VOP_PUTPAGE(vp, off, len, B_ASYNC, cr, ct);
-
 	return (0);
 }
 
@@ -4887,8 +4886,13 @@ zfs_space(vnode_t *vp, int cmd, flock64_t *bfp, int flag,
 
 	error = zfs_freesp(zp, off, len, flag, TRUE);
 
-	if (error == 0 && off == 0 && len == 0)
-		vnevent_truncate(ZTOV(zp), ct);
+	if (error == 0 && len == 0) {
+		if (off == 0) {
+			vnevent_truncate(ZTOV(zp), ct);
+		} else {
+			vnevent_resize(ZTOV(zp), ct);
+		}
+	}
 
 	ZFS_EXIT(zfsvfs);
 	return (error);
diff --git a/usr/src/uts/common/fs/zfs/zfs_znode.c b/usr/src/uts/common/fs/zfs/zfs_znode.c
index 93545ee4a1..a29849cfba 100644
--- a/usr/src/uts/common/fs/zfs/zfs_znode.c
+++ b/usr/src/uts/common/fs/zfs/zfs_znode.c
@@ -2037,17 +2037,6 @@ zfs_obj_to_path_impl(objset_t *osp, uint64_t obj, sa_handle_t *hdl,
 	*path = '\0';
 	sa_hdl = hdl;
 
-	uint64_t deleteq_obj;
-	VERIFY0(zap_lookup(osp, MASTER_NODE_OBJ,
-	    ZFS_UNLINKED_SET, sizeof (uint64_t), 1, &deleteq_obj));
-	error = zap_lookup_int(osp, deleteq_obj, obj);
-	if (error == 0) {
-		return (ESTALE);
-	} else if (error != ENOENT) {
-		return (error);
-	}
-	error = 0;
-
 	for (;;) {
 		uint64_t pobj;
 		char component[MAXNAMELEN + 2];
diff --git a/usr/src/uts/common/fs/zfs/zfs_zone.c b/usr/src/uts/common/fs/zfs/zfs_zone.c
new file mode 100644
index 0000000000..f151595095
--- /dev/null
+++ b/usr/src/uts/common/fs/zfs/zfs_zone.c
@@ -0,0 +1,1419 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018, Joyent, Inc. All rights reserved.
+ */
+
+/*
+ * The ZFS/Zone I/O throttle and scheduler attempts to ensure fair access to
+ * ZFS I/O resources for each zone.
+ *
+ * I/O contention can be major pain point on a multi-tenant system. A single
+ * zone can issue a stream of I/O operations, usually synchronous writes, which
+ * disrupt I/O performance for all other zones. This problem is further
+ * exacerbated by ZFS, which buffers all asynchronous writes in a single TXG,
+ * a set of blocks which are atomically synced to disk. The process of
+ * syncing a TXG can occupy all of a device's I/O bandwidth, thereby starving
+ * out any pending read operations.
+ *
+ * There are two facets to this capability; the throttle and the scheduler.
+ *
+ * Throttle
+ *
+ * The requirements on the throttle are:
+ *
+ *     1) Ensure consistent and predictable I/O latency across all zones.
+ *     2) Sequential and random workloads have very different characteristics,
+ *        so it is a non-starter to track IOPS or throughput.
+ *     3) A zone should be able to use the full disk bandwidth if no other zone
+ *        is actively using the disk.
+ *
+ * The throttle has two components: one to track and account for each zone's
+ * I/O requests, and another to throttle each zone's operations when it
+ * exceeds its fair share of disk I/O. When the throttle detects that a zone is
+ * consuming more than is appropriate, each read or write system call is
+ * delayed by up to 100 microseconds, which we've found is sufficient to allow
+ * other zones to interleave I/O requests during those delays.
+ *
+ * Note: The throttle will delay each logical I/O (as opposed to the physical
+ * I/O which will likely be issued asynchronously), so it may be easier to
+ * think of the I/O throttle delaying each read/write syscall instead of the
+ * actual I/O operation. For each zone, the throttle tracks an ongoing average
+ * of read and write operations performed to determine the overall I/O
+ * utilization for each zone.
+ *
+ * The throttle calculates a I/O utilization metric for each zone using the
+ * following formula:
+ *
+ *     (# of read syscalls) x (Average read latency) +
+ *     (# of write syscalls) x (Average write latency)
+ *
+ * Once each zone has its utilization metric, the I/O throttle will compare I/O
+ * utilization across all zones, and if a zone has a higher-than-average I/O
+ * utilization, system calls from that zone are throttled. That is, if one
+ * zone has a much higher utilization, that zone's delay is increased by 5
+ * microseconds, up to a maximum of 100 microseconds. Conversely, if a zone is
+ * already throttled and has a lower utilization than average, its delay will
+ * be lowered by 5 microseconds.
+ *
+ * The throttle calculation is driven by IO activity, but since IO does not
+ * happen at fixed intervals, timestamps are used to track when the last update
+ * was made and to drive recalculation.
+ *
+ * The throttle recalculates each zone's I/O usage and throttle delay (if any)
+ * on the zfs_zone_adjust_time interval. Overall I/O latency is maintained as
+ * a decayed average which is updated on the zfs_zone_sys_avg_cycle interval.
+ *
+ * Scheduler
+ *
+ * The I/O scheduler manages the vdev queues – the queues of pending I/Os to
+ * issue to the disks. It only makes scheduling decisions for the two
+ * synchronous I/O queues (read & write).
+ *
+ * The scheduler maintains how many I/Os in the queue are from each zone, and
+ * if one zone has a disproportionately large number of I/Os in the queue, the
+ * scheduler will allow certain I/Os from the underutilized zones to be "bumped"
+ * and pulled from the middle of the queue. This bump allows zones with a small
+ * number of I/Os (so small they may not even be taken into account by the
+ * throttle) to complete quickly instead of waiting behind dozens of I/Os from
+ * other zones.
+ */
+
+#include <sys/spa.h>
+#include <sys/vdev_impl.h>
+#include <sys/zfs_zone.h>
+
+#ifndef _KERNEL
+
+/*
+ * Stubs for when compiling for user-land.
+ */
+
+void
+zfs_zone_io_throttle(zfs_zone_iop_type_t type)
+{
+}
+
+void
+zfs_zone_zio_init(zio_t *zp)
+{
+}
+
+void
+zfs_zone_zio_start(zio_t *zp)
+{
+}
+
+void
+zfs_zone_zio_done(zio_t *zp)
+{
+}
+
+void
+zfs_zone_zio_dequeue(zio_t *zp)
+{
+}
+
+void
+zfs_zone_zio_enqueue(zio_t *zp)
+{
+}
+
+/*ARGSUSED*/
+void
+zfs_zone_report_txg_sync(void *dp)
+{
+}
+
+hrtime_t
+zfs_zone_txg_delay()
+{
+	return (MSEC2NSEC(10));
+}
+
+#else
+
+/*
+ * The real code.
+ */
+
+#include <sys/systm.h>
+#include <sys/thread.h>
+#include <sys/proc.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/atomic.h>
+#include <sys/zio.h>
+#include <sys/zone.h>
+#include <sys/avl.h>
+#include <sys/sdt.h>
+#include <sys/ddi.h>
+
+/*
+ * The zone throttle delays read and write operations from certain zones based
+ * on each zone's IO utilitzation.  Once a cycle (defined by zfs_zone_cycle_time
+ * below), the delays for each zone are recalculated based on the utilization
+ * over the previous window.
+ */
+boolean_t	zfs_zone_delay_enable = B_TRUE;	/* enable IO throttle */
+uint8_t		zfs_zone_delay_step = 5;	/* usec amnt to change delay */
+uint8_t		zfs_zone_delay_ceiling = 100;	/* usec delay max */
+
+boolean_t	zfs_zone_priority_enable = B_TRUE;  /* enable IO priority */
+
+/*
+ * For certain workloads, one zone may be issuing primarily sequential I/O and
+ * another primarily random I/O.  The sequential I/O will complete much more
+ * quickly than the random I/O, driving the average system latency for those
+ * operations way down.  As a result, the random I/O may be throttled back, even
+ * though the sequential I/O should be throttled to allow the random I/O more
+ * access to the disk.
+ *
+ * This tunable limits the discrepancy between the read and write system
+ * latency.  If one becomes excessively high, this tunable prevents the I/O
+ * throttler from exacerbating the imbalance.
+ */
+uint_t		zfs_zone_rw_lat_limit = 10;
+
+/*
+ * The I/O throttle will only start delaying zones when it detects disk
+ * utilization has reached a certain level.  This tunable controls the
+ * threshold at which the throttle will start delaying zones.  When the number
+ * of vdevs is small, the calculation should correspond closely with the %b
+ * column from iostat -- but as the number of vdevs becomes large, it will
+ * correlate less and less to any single device (therefore making it a poor
+ * approximation for the actual I/O utilization on such systems).  We
+ * therefore use our derived utilization conservatively:  we know that low
+ * derived utilization does indeed correlate to low I/O use -- but that a high
+ * rate of derived utilization does not necesarily alone denote saturation;
+ * where we see a high rate of utilization, we also look for laggard I/Os to
+ * attempt to detect saturation.
+ */
+uint_t		zfs_zone_util_threshold = 80;
+uint_t		zfs_zone_underutil_threshold = 60;
+
+/*
+ * There are three important tunables here:  zfs_zone_laggard_threshold denotes
+ * the threshold at which an I/O is considered to be of notably high latency;
+ * zfs_zone_laggard_recent denotes the number of microseconds before the
+ * current time after which the last laggard is considered to be sufficiently
+ * recent to merit increasing the throttle; zfs_zone_laggard_ancient denotes
+ * the microseconds before the current time before which the last laggard is
+ * considered to be sufficiently old to merit decreasing the throttle.  The
+ * most important tunable of these three is the zfs_zone_laggard_threshold: in
+ * modeling data from a large public cloud, this tunable was found to have a
+ * much greater effect on the throttle than the two time-based thresholds.
+ * This must be set high enough to not result in spurious throttling, but not
+ * so high as to allow pathological I/O to persist in the system.
+ */
+uint_t		zfs_zone_laggard_threshold = 50000;	/* 50 ms */
+uint_t		zfs_zone_laggard_recent = 1000000;	/* 1000 ms */
+uint_t		zfs_zone_laggard_ancient = 5000000;	/* 5000 ms */
+
+/*
+ * Throughout this subsystem, our timestamps are in microseconds.  Our system
+ * average cycle is one second or 1 million microseconds.  Our zone counter
+ * update cycle is two seconds or 2 million microseconds.  We use a longer
+ * duration for that cycle because some ops can see a little over two seconds of
+ * latency when they are being starved by another zone.
+ */
+uint_t 		zfs_zone_sys_avg_cycle = 1000000;	/* 1 s */
+uint_t 		zfs_zone_cycle_time = 2000000;		/* 2 s */
+
+/*
+ * How often the I/O throttle will reevaluate each zone's utilization, in
+ * microseconds. Default is 1/4 sec.
+ */
+uint_t 		zfs_zone_adjust_time = 250000;		/* 250 ms */
+
+typedef struct {
+	hrtime_t	cycle_start;
+	hrtime_t	cycle_lat;
+	hrtime_t	sys_avg_lat;
+	uint_t		cycle_cnt;
+} sys_lat_cycle_t;
+
+typedef struct {
+	hrtime_t zi_now;
+	uint_t zi_avgrlat;
+	uint_t zi_avgwlat;
+	uint64_t zi_totpri;
+	uint64_t zi_totutil;
+	int zi_active;
+	uint_t zi_diskutil;
+	boolean_t zi_underutil;
+	boolean_t zi_overutil;
+} zoneio_stats_t;
+
+static sys_lat_cycle_t	rd_lat;
+static sys_lat_cycle_t	wr_lat;
+
+/*
+ * Some basic disk stats to determine disk utilization. The utilization info
+ * for all disks on the system is aggregated into these values.
+ *
+ * Overall disk utilization for the current cycle is calculated as:
+ *
+ * ((zfs_disk_rtime - zfs_disk_last_rtime) * 100)
+ * ----------------------------------------------
+ *    ((now - zfs_zone_last_checked) * 1000);
+ */
+kmutex_t	zfs_disk_lock;		/* protects the following: */
+uint_t		zfs_disk_rcnt;		/* Number of outstanding IOs */
+hrtime_t	zfs_disk_rtime = 0; /* cummulative sum of time performing IO */
+hrtime_t	zfs_disk_rlastupdate = 0; /* time last IO dispatched */
+
+hrtime_t	zfs_disk_last_rtime = 0; /* prev. cycle's zfs_disk_rtime val */
+/* time that we last updated per-zone throttle info */
+kmutex_t	zfs_last_check_lock;	/* protects zfs_zone_last_checked */
+hrtime_t	zfs_zone_last_checked = 0;
+hrtime_t	zfs_disk_last_laggard = 0;
+
+/*
+ * Data used to keep track of how often txg sync is running.
+ */
+extern int	zfs_txg_timeout;
+static uint_t	txg_last_check;
+static uint_t	txg_cnt;
+static uint_t	txg_sync_rate;
+
+boolean_t	zfs_zone_schedule_enable = B_TRUE;	/* enable IO sched. */
+/*
+ * Threshold for when zio scheduling should kick in.
+ *
+ * This threshold is based on the zfs_vdev_sync_read_max_active value for the
+ * number of I/Os that can be pending on a device.  If there are more than the
+ * max_active ops already queued up, beyond those already issued to the vdev,
+ * then use zone-based scheduling to get the next synchronous zio.
+ */
+uint32_t	zfs_zone_schedule_thresh = 10;
+
+/*
+ * On each pass of the scheduler we increment the zone's weight (up to this
+ * maximum). The weight is used by the scheduler to prevent starvation so
+ * that zones which haven't been able to do any IO over many iterations
+ * will max out thier weight to this value.
+ */
+#define	SCHED_WEIGHT_MAX	20
+
+/*
+ * Tunables for delay throttling when TXG sync is occurring.
+ *
+ * If the zone is performing a write and we're doing above normal TXG syncing,
+ * then throttle for longer than normal. The zone's wait time is multiplied
+ * by the scale (zfs_zone_txg_throttle_scale).
+ */
+int		zfs_zone_txg_throttle_scale = 2;
+hrtime_t	zfs_zone_txg_delay_nsec = MSEC2NSEC(20);
+
+typedef struct {
+	int		zq_qdepth;
+	zio_priority_t	zq_queue;
+	int		zq_priority;
+	int		zq_wt;
+	zoneid_t	zq_zoneid;
+} zone_q_bump_t;
+
+/*
+ * This uses gethrtime() but returns a value in usecs.
+ */
+#define	GET_USEC_TIME		(gethrtime() / 1000)
+#define	NANO_TO_MICRO(x)	(x / (NANOSEC / MICROSEC))
+
+/*
+ * Keep track of the zone's ZFS IOPs.
+ *
+ * See the comment on the zfs_zone_io_throttle function for which/how IOPs are
+ * accounted for.
+ *
+ * If the number of ops is >1 then we can just use that value.  However,
+ * if the number of ops is <2 then we might have a zone which is trying to do
+ * IO but is not able to get any ops through the system.  We don't want to lose
+ * track of this zone so we factor in its decayed count into the current count.
+ *
+ * Each cycle (zfs_zone_sys_avg_cycle) we want to update the decayed count.
+ * However, since this calculation is driven by IO activity and since IO does
+ * not happen at fixed intervals, we use a timestamp to see when the last update
+ * was made.  If it was more than one cycle ago, then we need to decay the
+ * historical count by the proper number of additional cycles in which no IO was
+ * performed.
+ *
+ * Return a time delta indicating how far into the current cycle we are or 0
+ * if the last IO was more than a cycle ago.
+ */
+static hrtime_t
+compute_historical_zone_cnt(hrtime_t unow, sys_zio_cntr_t *cp)
+{
+	hrtime_t delta;
+	int	gen_cnt;
+
+	/*
+	 * Check if its time to recompute a new zone count.
+	 * If we're still collecting data for the current cycle, return false.
+	 */
+	delta = unow - cp->cycle_start;
+	if (delta < zfs_zone_cycle_time)
+		return (delta);
+
+	/* A previous cycle is past, compute the new zone count. */
+
+	/*
+	 * Figure out how many generations we have to decay the historical
+	 * count, since multiple cycles may have elapsed since our last IO.
+	 * We depend on int rounding here.
+	 */
+	gen_cnt = (int)(delta / zfs_zone_cycle_time);
+
+	/* If more than 5 cycles since last the IO, reset count. */
+	if (gen_cnt > 5) {
+		cp->zone_avg_cnt = 0;
+	} else {
+		/* Update the count. */
+		int	i;
+
+		/*
+		 * If the zone did more than 1 IO, just use its current count
+		 * as the historical value, otherwise decay the historical
+		 * count and factor that into the new historical count.  We
+		 * pick a threshold > 1 so that we don't lose track of IO due
+		 * to int rounding.
+		 */
+		if (cp->cycle_cnt > 1)
+			cp->zone_avg_cnt = cp->cycle_cnt;
+		else
+			cp->zone_avg_cnt = cp->cycle_cnt +
+			    (cp->zone_avg_cnt / 2);
+
+		/*
+		 * If more than one generation has elapsed since the last
+		 * update, decay the values further.
+		 */
+		for (i = 1; i < gen_cnt; i++)
+			cp->zone_avg_cnt = cp->zone_avg_cnt / 2;
+	}
+
+	/* A new cycle begins. */
+	cp->cycle_start = unow;
+	cp->cycle_cnt = 0;
+
+	return (0);
+}
+
+/*
+ * Add IO op data to the zone.
+ */
+static void
+add_zone_iop(zone_persist_t *zpd, hrtime_t unow, zfs_zone_iop_type_t op)
+{
+	zone_zfs_io_t *iop;
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop == NULL) {
+		mutex_exit(&zpd->zpers_zfs_lock);
+		return;
+	}
+
+	switch (op) {
+	case ZFS_ZONE_IOP_READ:
+		(void) compute_historical_zone_cnt(unow, &iop->zpers_rd_ops);
+		iop->zpers_rd_ops.cycle_cnt++;
+		break;
+	case ZFS_ZONE_IOP_WRITE:
+		(void) compute_historical_zone_cnt(unow, &iop->zpers_wr_ops);
+		iop->zpers_wr_ops.cycle_cnt++;
+		break;
+	case ZFS_ZONE_IOP_LOGICAL_WRITE:
+		(void) compute_historical_zone_cnt(unow, &iop->zpers_lwr_ops);
+		iop->zpers_lwr_ops.cycle_cnt++;
+		break;
+	}
+	mutex_exit(&zpd->zpers_zfs_lock);
+}
+
+/*
+ * Use a decaying average to keep track of the overall system latency.
+ *
+ * We want to have the recent activity heavily weighted, but if the
+ * activity decreases or stops, then the average should quickly decay
+ * down to the new value.
+ *
+ * Each cycle (zfs_zone_sys_avg_cycle) we want to update the decayed average.
+ * However, since this calculation is driven by IO activity and since IO does
+ * not happen at fixed intervals, we use a timestamp to see when the last
+ * update was made. If it was more than one cycle ago, then we need to decay
+ * the average by the proper number of additional cycles in which no IO was
+ * performed.
+ *
+ * Return true if we actually computed a new system average.
+ * If we're still within an active cycle there is nothing to do, return false.
+ */
+static boolean_t
+compute_new_sys_avg(hrtime_t unow, sys_lat_cycle_t *cp)
+{
+	hrtime_t delta;
+	int	gen_cnt;
+
+	/*
+	 * Check if its time to recompute a new average.
+	 * If we're still collecting data for the current cycle, return false.
+	 */
+	delta = unow - cp->cycle_start;
+	if (delta < zfs_zone_sys_avg_cycle)
+		return (B_FALSE);
+
+	/* A previous cycle is past, compute a new system average. */
+
+	/*
+	 * Figure out how many generations we have to decay, since multiple
+	 * cycles may have elapsed since our last IO.
+	 * We count on int rounding here.
+	 */
+	gen_cnt = (int)(delta / zfs_zone_sys_avg_cycle);
+
+	/* If more than 5 cycles since last the IO, reset average. */
+	if (gen_cnt > 5) {
+		cp->sys_avg_lat = 0;
+	} else {
+		/* Update the average. */
+		int	i;
+
+		cp->sys_avg_lat =
+		    (cp->sys_avg_lat + cp->cycle_lat) / (1 + cp->cycle_cnt);
+
+		/*
+		 * If more than one generation has elapsed since the last
+		 * update, decay the values further.
+		 */
+		for (i = 1; i < gen_cnt; i++)
+			cp->sys_avg_lat = cp->sys_avg_lat / 2;
+	}
+
+	/* A new cycle begins. */
+	cp->cycle_start = unow;
+	cp->cycle_cnt = 0;
+	cp->cycle_lat = 0;
+
+	return (B_TRUE);
+}
+
+static void
+add_sys_iop(hrtime_t unow, int op, int lat)
+{
+	switch (op) {
+	case ZFS_ZONE_IOP_READ:
+		(void) compute_new_sys_avg(unow, &rd_lat);
+		atomic_inc_uint(&rd_lat.cycle_cnt);
+		atomic_add_64((uint64_t *)&rd_lat.cycle_lat, (int64_t)lat);
+		break;
+	case ZFS_ZONE_IOP_WRITE:
+		(void) compute_new_sys_avg(unow, &wr_lat);
+		atomic_inc_uint(&wr_lat.cycle_cnt);
+		atomic_add_64((uint64_t *)&wr_lat.cycle_lat, (int64_t)lat);
+		break;
+	}
+}
+
+/*
+ * Get the zone IO counts.
+ */
+static uint_t
+calc_zone_cnt(hrtime_t unow, sys_zio_cntr_t *cp)
+{
+	hrtime_t delta;
+	uint_t cnt;
+
+	if ((delta = compute_historical_zone_cnt(unow, cp)) == 0) {
+		/*
+		 * No activity in the current cycle, we already have the
+		 * historical data so we'll use that.
+		 */
+		cnt = cp->zone_avg_cnt;
+	} else {
+		/*
+		 * If we're less than half way through the cycle then use
+		 * the current count plus half the historical count, otherwise
+		 * just use the current count.
+		 */
+		if (delta < (zfs_zone_cycle_time / 2))
+			cnt = cp->cycle_cnt + (cp->zone_avg_cnt / 2);
+		else
+			cnt = cp->cycle_cnt;
+	}
+
+	return (cnt);
+}
+
+/*
+ * Get the average read/write latency in usecs for the system.
+ */
+static uint_t
+calc_avg_lat(hrtime_t unow, sys_lat_cycle_t *cp)
+{
+	if (compute_new_sys_avg(unow, cp)) {
+		/*
+		 * No activity in the current cycle, we already have the
+		 * historical data so we'll use that.
+		 */
+		return (cp->sys_avg_lat);
+	} else {
+		/*
+		 * We're within a cycle; weight the current activity higher
+		 * compared to the historical data and use that.
+		 */
+		DTRACE_PROBE3(zfs__zone__calc__wt__avg,
+		    uintptr_t, cp->sys_avg_lat,
+		    uintptr_t, cp->cycle_lat,
+		    uintptr_t, cp->cycle_cnt);
+
+		return ((cp->sys_avg_lat + (cp->cycle_lat * 8)) /
+		    (1 + (cp->cycle_cnt * 8)));
+	}
+}
+
+/*
+ * Account for the current IOP on the zone and for the system as a whole.
+ * The latency parameter is in usecs.
+ */
+static void
+add_iop(zone_persist_t *zpd, hrtime_t unow, zfs_zone_iop_type_t op,
+    hrtime_t lat)
+{
+	/* Add op to zone */
+	add_zone_iop(zpd, unow, op);
+
+	/* Track system latency */
+	if (op != ZFS_ZONE_IOP_LOGICAL_WRITE)
+		add_sys_iop(unow, op, lat);
+}
+
+/*
+ * Calculate and return the total number of read ops, write ops and logical
+ * write ops for the given zone.  If the zone has issued operations of any type
+ * return a non-zero value, otherwise return 0.
+ */
+static int
+get_zone_io_cnt(hrtime_t unow, zone_zfs_io_t *zpd, uint_t *rops, uint_t *wops,
+    uint_t *lwops)
+{
+	ASSERT3P(zpd, !=, NULL);
+
+	*rops = calc_zone_cnt(unow, &zpd->zpers_rd_ops);
+	*wops = calc_zone_cnt(unow, &zpd->zpers_wr_ops);
+	*lwops = calc_zone_cnt(unow, &zpd->zpers_lwr_ops);
+
+	DTRACE_PROBE4(zfs__zone__io__cnt, uintptr_t, zpd,
+	    uintptr_t, *rops, uintptr_t, *wops, uintptr_t, *lwops);
+
+	return (*rops | *wops | *lwops);
+}
+
+/*
+ * Get the average read/write latency in usecs for the system.
+ */
+static void
+get_sys_avg_lat(hrtime_t unow, uint_t *rlat, uint_t *wlat)
+{
+	*rlat = calc_avg_lat(unow, &rd_lat);
+	*wlat = calc_avg_lat(unow, &wr_lat);
+
+	/*
+	 * In an attempt to improve the accuracy of the throttling algorithm,
+	 * assume that IO operations can't have zero latency.  Instead, assume
+	 * a reasonable lower bound for each operation type. If the actual
+	 * observed latencies are non-zero, use those latency values instead.
+	 */
+	if (*rlat == 0)
+		*rlat = 1000;
+	if (*wlat == 0)
+		*wlat = 1000;
+
+	DTRACE_PROBE2(zfs__zone__sys__avg__lat, uintptr_t, *rlat,
+	    uintptr_t, *wlat);
+}
+
+/*
+ * Find disk utilization for each zone and average utilization for all active
+ * zones.
+ */
+static int
+zfs_zone_wait_adjust_calculate_cb(zone_t *zonep, void *arg)
+{
+	zoneio_stats_t *sp = arg;
+	uint_t rops, wops, lwops;
+	zone_persist_t *zpd = &zone_pdata[zonep->zone_id];
+	zone_zfs_io_t *iop = zpd->zpers_zfsp;
+
+	ASSERT3P(iop, !=, NULL);
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	if (zonep->zone_id == GLOBAL_ZONEID ||
+	    get_zone_io_cnt(sp->zi_now, iop, &rops, &wops, &lwops) == 0) {
+		mutex_exit(&zpd->zpers_zfs_lock);
+		return (0);
+	}
+
+	iop->zpers_io_util = (rops * sp->zi_avgrlat) + (wops * sp->zi_avgwlat) +
+	    (lwops * sp->zi_avgwlat);
+	sp->zi_totutil += iop->zpers_io_util;
+
+	if (iop->zpers_io_util > 0) {
+		sp->zi_active++;
+		sp->zi_totpri += iop->zpers_zfs_io_pri;
+	}
+
+	/*
+	 * sdt:::zfs-zone-utilization
+	 *
+	 *	arg0: zone ID
+	 *	arg1: read operations observed during time window
+	 *	arg2: physical write operations observed during time window
+	 *	arg3: logical write ops observed during time window
+	 *	arg4: calculated utilization given read and write ops
+	 *	arg5: I/O priority assigned to this zone
+	 */
+	DTRACE_PROBE6(zfs__zone__utilization, uint_t, zonep->zone_id,
+	    uint_t, rops, uint_t, wops, uint_t, lwops,
+	    uint64_t, iop->zpers_io_util, uint16_t, iop->zpers_zfs_io_pri);
+
+	mutex_exit(&zpd->zpers_zfs_lock);
+
+	return (0);
+}
+
+static void
+zfs_zone_delay_inc(zone_zfs_io_t *zpd)
+{
+	ASSERT3P(zpd, !=, NULL);
+
+	if (zpd->zpers_io_delay < zfs_zone_delay_ceiling)
+		zpd->zpers_io_delay += zfs_zone_delay_step;
+}
+
+static void
+zfs_zone_delay_dec(zone_zfs_io_t *zpd)
+{
+	ASSERT3P(zpd, !=, NULL);
+
+	if (zpd->zpers_io_delay > 0)
+		zpd->zpers_io_delay -= zfs_zone_delay_step;
+}
+
+/*
+ * For all zones "far enough" away from the average utilization, increase that
+ * zones delay.  Otherwise, reduce its delay.
+ */
+static int
+zfs_zone_wait_adjust_delay_cb(zone_t *zonep, void *arg)
+{
+	zone_persist_t *zpd = &zone_pdata[zonep->zone_id];
+	zone_zfs_io_t *iop = zpd->zpers_zfsp;
+	zoneio_stats_t *sp = arg;
+	uint8_t delay;
+	uint_t fairutil = 0;
+
+	ASSERT3P(iop, !=, NULL);
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	delay = iop->zpers_io_delay;
+	iop->zpers_io_util_above_avg = 0;
+
+	/*
+	 * Given the calculated total utilitzation for all zones, calculate the
+	 * fair share of I/O for this zone.
+	 */
+	if (zfs_zone_priority_enable && sp->zi_totpri > 0) {
+		fairutil = (sp->zi_totutil * iop->zpers_zfs_io_pri) /
+		    sp->zi_totpri;
+	} else if (sp->zi_active > 0) {
+		fairutil = sp->zi_totutil / sp->zi_active;
+	}
+
+	/*
+	 * Adjust each IO's delay.  If the overall delay becomes too high, avoid
+	 * increasing beyond the ceiling value.
+	 */
+	if (iop->zpers_io_util > fairutil && sp->zi_overutil) {
+		iop->zpers_io_util_above_avg = 1;
+
+		if (sp->zi_active > 1)
+			zfs_zone_delay_inc(iop);
+	} else if (iop->zpers_io_util < fairutil || sp->zi_underutil ||
+	    sp->zi_active <= 1) {
+		zfs_zone_delay_dec(iop);
+	}
+
+	/*
+	 * sdt:::zfs-zone-throttle
+	 *
+	 *	arg0: zone ID
+	 *	arg1: old delay for this zone
+	 *	arg2: new delay for this zone
+	 *	arg3: calculated fair I/O utilization
+	 *	arg4: actual I/O utilization
+	 */
+	DTRACE_PROBE5(zfs__zone__throttle, uintptr_t, zonep->zone_id,
+	    uintptr_t, delay, uintptr_t, iop->zpers_io_delay,
+	    uintptr_t, fairutil, uintptr_t, iop->zpers_io_util);
+
+	mutex_exit(&zpd->zpers_zfs_lock);
+
+	return (0);
+}
+
+/*
+ * Examine the utilization between different zones, and adjust the delay for
+ * each zone appropriately.
+ */
+static void
+zfs_zone_wait_adjust(hrtime_t unow, hrtime_t last_checked)
+{
+	zoneio_stats_t stats;
+	hrtime_t laggard_udelta = 0;
+
+	(void) bzero(&stats, sizeof (stats));
+
+	stats.zi_now = unow;
+	get_sys_avg_lat(unow, &stats.zi_avgrlat, &stats.zi_avgwlat);
+
+	if (stats.zi_avgrlat > stats.zi_avgwlat * zfs_zone_rw_lat_limit)
+		stats.zi_avgrlat = stats.zi_avgwlat * zfs_zone_rw_lat_limit;
+	else if (stats.zi_avgrlat * zfs_zone_rw_lat_limit < stats.zi_avgwlat)
+		stats.zi_avgwlat = stats.zi_avgrlat * zfs_zone_rw_lat_limit;
+
+	if (zone_walk(zfs_zone_wait_adjust_calculate_cb, &stats) != 0)
+		return;
+
+	/*
+	 * Calculate disk utilization for the most recent period.
+	 */
+	if (zfs_disk_last_rtime == 0 || unow - last_checked <= 0) {
+		stats.zi_diskutil = 0;
+	} else {
+		stats.zi_diskutil =
+		    ((zfs_disk_rtime - zfs_disk_last_rtime) * 100) /
+		    ((unow - last_checked) * 1000);
+	}
+	zfs_disk_last_rtime = zfs_disk_rtime;
+
+	if (unow > zfs_disk_last_laggard)
+		laggard_udelta = unow - zfs_disk_last_laggard;
+
+	/*
+	 * To minimize porpoising, we have three separate states for our
+	 * assessment of I/O performance:  overutilized, underutilized, and
+	 * neither overutilized nor underutilized.  We will increment the
+	 * throttle if a zone is using more than its fair share _and_ I/O
+	 * is overutilized; we will decrement the throttle if a zone is using
+	 * less than its fair share _or_ I/O is underutilized.
+	 */
+	stats.zi_underutil = stats.zi_diskutil < zfs_zone_underutil_threshold ||
+	    laggard_udelta > zfs_zone_laggard_ancient;
+
+	stats.zi_overutil = stats.zi_diskutil > zfs_zone_util_threshold &&
+	    laggard_udelta < zfs_zone_laggard_recent;
+
+	/*
+	 * sdt:::zfs-zone-stats
+	 *
+	 * Statistics observed over the last period:
+	 *
+	 *	arg0: average system read latency
+	 *	arg1: average system write latency
+	 *	arg2: number of active zones
+	 *	arg3: total I/O 'utilization' for all zones
+	 *	arg4: total I/O priority of all active zones
+	 *	arg5: calculated disk utilization
+	 */
+	DTRACE_PROBE6(zfs__zone__stats, uintptr_t, stats.zi_avgrlat,
+	    uintptr_t, stats.zi_avgwlat, uintptr_t, stats.zi_active,
+	    uintptr_t, stats.zi_totutil, uintptr_t, stats.zi_totpri,
+	    uintptr_t, stats.zi_diskutil);
+
+	(void) zone_walk(zfs_zone_wait_adjust_delay_cb, &stats);
+}
+
+/*
+ * Callback used to calculate a zone's IO schedule priority.
+ *
+ * We scan the zones looking for ones with ops in the queue.  Out of those,
+ * we pick the one that calculates to the highest schedule priority.
+ */
+static int
+get_sched_pri_cb(zone_t *zonep, void *arg)
+{
+	int pri;
+	uint_t cnt;
+	zone_q_bump_t *qbp = arg;
+	zio_priority_t p = qbp->zq_queue;
+	zone_persist_t *zpd = &zone_pdata[zonep->zone_id];
+	zone_zfs_io_t *iop;
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop == NULL) {
+		mutex_exit(&zpd->zpers_zfs_lock);
+		return (0);
+	}
+
+	cnt = iop->zpers_zfs_queued[p];
+	if (cnt == 0) {
+		iop->zpers_zfs_weight = 0;
+		mutex_exit(&zpd->zpers_zfs_lock);
+		return (0);
+	}
+
+	/*
+	 * On each pass, increment the zone's weight.  We use this as input
+	 * to the calculation to prevent starvation.  The value is reset
+	 * each time we issue an IO for this zone so zones which haven't
+	 * done any IO over several iterations will see their weight max
+	 * out.
+	 */
+	if (iop->zpers_zfs_weight < SCHED_WEIGHT_MAX)
+		iop->zpers_zfs_weight++;
+
+	/*
+	 * This zone's IO priority is the inverse of the number of IOs
+	 * the zone has enqueued * zone's configured priority * weight.
+	 * The queue depth has already been scaled by 10 to avoid problems
+	 * with int rounding.
+	 *
+	 * This means that zones with fewer IOs in the queue will get
+	 * preference unless other zone's assigned priority pulls them
+	 * ahead.  The weight is factored in to help ensure that zones
+	 * which haven't done IO in a while aren't getting starved.
+	 */
+	pri = (qbp->zq_qdepth / cnt) *
+	    iop->zpers_zfs_io_pri * iop->zpers_zfs_weight;
+
+	/*
+	 * If this zone has a higher priority than what we found so far,
+	 * it becomes the new leading contender.
+	 */
+	if (pri > qbp->zq_priority) {
+		qbp->zq_zoneid = zonep->zone_id;
+		qbp->zq_priority = pri;
+		qbp->zq_wt = iop->zpers_zfs_weight;
+	}
+	mutex_exit(&zpd->zpers_zfs_lock);
+	return (0);
+}
+
+/*
+ * See if we need to bump a zone's zio to the head of the queue. This is only
+ * done on the two synchronous I/O queues (see the block comment on the
+ * zfs_zone_schedule function). We get the correct vdev_queue_class_t and
+ * queue depth from our caller.
+ *
+ * For single-threaded synchronous processes a zone cannot get more than
+ * 1 op into the queue at a time unless the zone is running multiple processes
+ * in parallel.  This can cause an imbalance in performance if there are zones
+ * with many parallel processes (and ops in the queue) vs. other zones which
+ * are doing simple single-threaded processes, such as interactive tasks in the
+ * shell.  These zones can get backed up behind a deep queue and their IO
+ * performance will appear to be very poor as a result.  This can make the
+ * zone work badly for interactive behavior.
+ *
+ * The scheduling algorithm kicks in once we start to get a deeper queue.
+ * Once that occurs, we look at all of the zones to see which one calculates
+ * to the highest priority.  We bump that zone's first zio to the head of the
+ * queue.
+ *
+ * We use a counter on the zone so that we can quickly find how many ops each
+ * zone has in the queue without having to search the entire queue itself.
+ * This scales better since the number of zones is expected to be on the
+ * order of 10-100 whereas the queue depth can be in the range of 50-2000.
+ * In addition, since the zio's in the queue only have the zoneid, we would
+ * have to look up the zone for each zio enqueued and that means the overhead
+ * for scanning the queue each time would be much higher.
+ *
+ * In all cases, we fall back to simply pulling the next op off the queue
+ * if something should go wrong.
+ */
+static zio_t *
+get_next_zio(vdev_queue_class_t *vqc, int qdepth, zio_priority_t p,
+    avl_tree_t *tree)
+{
+	zone_q_bump_t qbump;
+	zio_t *zp = NULL, *zphead;
+	int cnt = 0;
+
+	/* To avoid problems with int rounding, scale the queue depth by 10 */
+	qbump.zq_qdepth = qdepth * 10;
+	qbump.zq_priority = 0;
+	qbump.zq_zoneid = 0;
+	qbump.zq_queue = p;
+	(void) zone_walk(get_sched_pri_cb, &qbump);
+
+	zphead = avl_first(tree);
+
+	/* Check if the scheduler didn't pick a zone for some reason!? */
+	if (qbump.zq_zoneid != 0) {
+		for (zp = avl_first(tree); zp != NULL;
+		    zp = avl_walk(tree, zp, AVL_AFTER)) {
+			if (zp->io_zoneid == qbump.zq_zoneid)
+				break;
+			cnt++;
+		}
+	}
+
+	if (zp == NULL) {
+		zp = zphead;
+	} else if (zp != zphead) {
+		/*
+		 * Only fire the probe if we actually picked a different zio
+		 * than the one already at the head of the queue.
+		 */
+		DTRACE_PROBE4(zfs__zone__sched__bump, uint_t, zp->io_zoneid,
+		    uint_t, cnt, int, qbump.zq_priority, int, qbump.zq_wt);
+	}
+
+	return (zp);
+}
+
+/*
+ * Add our zone ID to the zio so we can keep track of which zones are doing
+ * what, even when the current thread processing the zio is not associated
+ * with the zone (e.g. the kernel taskq which pushes out TX groups).
+ */
+void
+zfs_zone_zio_init(zio_t *zp)
+{
+	zone_t	*zonep = curzone;
+
+	zp->io_zoneid = zonep->zone_id;
+}
+
+/*
+ * Track and throttle IO operations per zone. Called from:
+ *   - dmu_tx_count_write for (logical) write ops (both dataset and zvol writes
+ *     go through this path)
+ *   - arc_read for read ops that miss the ARC (both dataset and zvol)
+ * For each operation, increment that zone's counter based on the type of
+ * operation, then delay the operation, if necessary.
+ *
+ * There are three basic ways that we can see write ops:
+ * 1) An application does write syscalls.  Those ops go into a TXG which
+ *    we'll count here.  Sometime later a kernel taskq thread (we'll see the
+ *    vdev IO as zone 0) will perform some number of physical writes to commit
+ *    the TXG to disk.  Those writes are not associated with the zone which
+ *    made the write syscalls and the number of operations is not correlated
+ *    between the taskq and the zone. We only see logical writes in this
+ *    function, we see the physcial writes in the zfs_zone_zio_start and
+ *    zfs_zone_zio_done functions.
+ * 2) An application opens a file with O_SYNC.  Each write will result in
+ *    an operation which we'll see here plus a low-level vdev write from
+ *    that zone.
+ * 3) An application does write syscalls followed by an fsync().  We'll
+ *    count the writes going into a TXG here.  We'll also see some number
+ *    (usually much smaller, maybe only 1) of low-level vdev writes from this
+ *    zone when the fsync is performed, plus some other low-level vdev writes
+ *    from the taskq in zone 0 (are these metadata writes?).
+ *
+ * 4) In addition to the above, there are misc. system-level writes, such as
+ *    writing out dirty pages to swap, or sync(2) calls, which will be handled
+ *    by the global zone and which we count but don't generally worry about.
+ *
+ * Because of the above, we can see writes twice; first because this function
+ * is always called by a zone thread for logical writes, but then we also will
+ * count the physical writes that are performed at a low level via
+ * zfs_zone_zio_start. Without this, it can look like a non-global zone never
+ * writes (case 1). Depending on when the TXG is synced, the counts may be in
+ * the same sample bucket or in a different one.
+ *
+ * Tracking read operations is simpler due to their synchronous semantics.  The
+ * zfs_read function -- called as a result of a read(2) syscall -- will always
+ * retrieve the data to be read through arc_read and we only come into this
+ * function when we have an arc miss.
+ */
+void
+zfs_zone_io_throttle(zfs_zone_iop_type_t type)
+{
+	zoneid_t zid = curzone->zone_id;
+	zone_persist_t *zpd = &zone_pdata[zid];
+	zone_zfs_io_t *iop;
+	hrtime_t unow;
+	uint16_t wait;
+
+	unow = GET_USEC_TIME;
+
+	/*
+	 * Only bump the counter for logical writes here.  The counters for
+	 * tracking physical IO operations are handled in zfs_zone_zio_done.
+	 */
+	if (type == ZFS_ZONE_IOP_LOGICAL_WRITE) {
+		add_iop(zpd, unow, type, 0);
+	}
+
+	if (!zfs_zone_delay_enable)
+		return;
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop == NULL) {
+		mutex_exit(&zpd->zpers_zfs_lock);
+		return;
+	}
+
+	/*
+	 * If the zone's I/O priority is set to zero, don't throttle that zone's
+	 * operations at all.
+	 */
+	if (iop->zpers_zfs_io_pri == 0) {
+		mutex_exit(&zpd->zpers_zfs_lock);
+		return;
+	}
+
+	/* Handle periodically updating the per-zone I/O parameters */
+	if ((unow - zfs_zone_last_checked) > zfs_zone_adjust_time) {
+		hrtime_t last_checked;
+		boolean_t do_update = B_FALSE;
+
+		/* Recheck under mutex */
+		mutex_enter(&zfs_last_check_lock);
+		last_checked = zfs_zone_last_checked;
+		if ((unow - last_checked) > zfs_zone_adjust_time) {
+			zfs_zone_last_checked = unow;
+			do_update = B_TRUE;
+		}
+		mutex_exit(&zfs_last_check_lock);
+
+		if (do_update) {
+			mutex_exit(&zpd->zpers_zfs_lock);
+
+			zfs_zone_wait_adjust(unow, last_checked);
+
+			mutex_enter(&zpd->zpers_zfs_lock);
+			iop = zpd->zpers_zfsp;
+			if (iop == NULL) {
+				mutex_exit(&zpd->zpers_zfs_lock);
+				return;
+			}
+		}
+	}
+
+	wait = iop->zpers_io_delay;
+	mutex_exit(&zpd->zpers_zfs_lock);
+
+	if (wait > 0) {
+		/*
+		 * If this is a write and we're doing above normal TXG
+		 * syncing, then throttle for longer than normal.
+		 */
+		if (type == ZFS_ZONE_IOP_LOGICAL_WRITE &&
+		    (txg_cnt > 1 || txg_sync_rate > 1))
+			wait *= zfs_zone_txg_throttle_scale;
+
+		/*
+		 * sdt:::zfs-zone-wait
+		 *
+		 *	arg0: zone ID
+		 *	arg1: type of IO operation
+		 *	arg2: time to delay (in us)
+		 */
+		DTRACE_PROBE3(zfs__zone__wait, uintptr_t, zid,
+		    uintptr_t, type, uintptr_t, wait);
+
+		drv_usecwait(wait);
+
+		if (curzone->zone_vfs_stats != NULL) {
+			atomic_inc_64(&curzone->zone_vfs_stats->
+			    zv_delay_cnt.value.ui64);
+			atomic_add_64(&curzone->zone_vfs_stats->
+			    zv_delay_time.value.ui64, wait);
+		}
+	}
+}
+
+/*
+ * XXX Ignore the pool pointer parameter for now.
+ *
+ * Keep track to see if the TXG sync rate is running above the expected rate.
+ * If so, this implies that we are filling TXG's at a high rate due to a heavy
+ * write workload.  We use this as input into the zone throttle.
+ *
+ * This function is called every 5 seconds (zfs_txg_timeout) under a normal
+ * write load.  In this case, the sync rate is going to be 1.  When there
+ * is a heavy write load, TXG's fill up fast and the sync thread will write
+ * the TXG more frequently (perhaps once a second).  In this case the rate
+ * will be > 1.  The sync rate is a lagging indicator since it can be up
+ * to 5 seconds old.  We use the txg_cnt to keep track of the rate in the
+ * current 5 second interval and txg_sync_rate to keep track of the previous
+ * 5 second interval.  In that way we don't have a period (1 or more seconds)
+ * where the txg_cnt == 0 and we cut back on throttling even though the rate
+ * is still high.
+ */
+/*ARGSUSED*/
+void
+zfs_zone_report_txg_sync(void *dp)
+{
+	uint_t now;
+
+	txg_cnt++;
+	now = (uint_t)(gethrtime() / NANOSEC);
+	if ((now - txg_last_check) >= zfs_txg_timeout) {
+		txg_sync_rate = txg_cnt / 2;
+		txg_cnt = 0;
+		txg_last_check = now;
+	}
+}
+
+hrtime_t
+zfs_zone_txg_delay()
+{
+	zone_persist_t *zpd = &zone_pdata[curzone->zone_id];
+	zone_zfs_io_t *iop;
+	uint8_t above;
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop == NULL) {
+		mutex_exit(&zpd->zpers_zfs_lock);
+		return (0);
+	}
+
+	above = iop->zpers_io_util_above_avg;
+	mutex_exit(&zpd->zpers_zfs_lock);
+
+	if (above) {
+		return (zfs_zone_txg_delay_nsec);
+	}
+
+	return (MSEC2NSEC(10));
+}
+
+/*
+ * Called from vdev_disk_io_start when an IO hits the end of the zio pipeline
+ * and is issued.
+ * Keep track of start time for latency calculation in zfs_zone_zio_done.
+ */
+void
+zfs_zone_zio_start(zio_t *zp)
+{
+	zone_persist_t *zpd = &zone_pdata[zp->io_zoneid];
+	zone_zfs_io_t *iop;
+
+	/*
+	 * I/Os of type ZIO_TYPE_IOCTL are used to flush the disk cache, not for
+	 * an actual I/O operation.  Ignore those operations as they relate to
+	 * throttling and scheduling.
+	 */
+	if (zp->io_type == ZIO_TYPE_IOCTL)
+		return;
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop != NULL) {
+		if (zp->io_type == ZIO_TYPE_READ)
+			kstat_runq_enter(&iop->zpers_zfs_rwstats);
+		iop->zpers_zfs_weight = 0;
+	}
+	mutex_exit(&zpd->zpers_zfs_lock);
+
+	mutex_enter(&zfs_disk_lock);
+	zp->io_dispatched = gethrtime();
+
+	if (zfs_disk_rcnt++ != 0)
+		zfs_disk_rtime += (zp->io_dispatched - zfs_disk_rlastupdate);
+	zfs_disk_rlastupdate = zp->io_dispatched;
+	mutex_exit(&zfs_disk_lock);
+}
+
+/*
+ * Called from vdev_disk_io_done when an IO completes.
+ * Increment our counter for zone ops.
+ * Calculate the IO latency avg. for this zone.
+ */
+void
+zfs_zone_zio_done(zio_t *zp)
+{
+	zone_persist_t *zpd;
+	zone_zfs_io_t *iop;
+	hrtime_t now, unow, udelta;
+
+	if (zp->io_type == ZIO_TYPE_IOCTL)
+		return;
+
+	if (zp->io_dispatched == 0)
+		return;
+
+	zpd = &zone_pdata[zp->io_zoneid];
+
+	now = gethrtime();
+	unow = NANO_TO_MICRO(now);
+	udelta = unow - NANO_TO_MICRO(zp->io_dispatched);
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop != NULL) {
+		/*
+		 * To calculate the wsvc_t average, keep a cumulative sum of
+		 * all the wait time before each I/O was dispatched. Since most
+		 * writes are asynchronous, only track the wait time for
+		 * read I/Os.
+		 */
+		if (zp->io_type == ZIO_TYPE_READ) {
+			iop->zpers_zfs_rwstats.reads++;
+			iop->zpers_zfs_rwstats.nread += zp->io_size;
+			iop->zpers_zfs_rd_waittime +=
+			    zp->io_dispatched - zp->io_timestamp;
+			kstat_runq_exit(&iop->zpers_zfs_rwstats);
+		} else {
+			iop->zpers_zfs_rwstats.writes++;
+			iop->zpers_zfs_rwstats.nwritten += zp->io_size;
+		}
+	}
+	mutex_exit(&zpd->zpers_zfs_lock);
+
+	mutex_enter(&zfs_disk_lock);
+	zfs_disk_rcnt--;
+	zfs_disk_rtime += (now - zfs_disk_rlastupdate);
+	zfs_disk_rlastupdate = now;
+
+	if (udelta > zfs_zone_laggard_threshold)
+		zfs_disk_last_laggard = unow;
+
+	mutex_exit(&zfs_disk_lock);
+
+	if (zfs_zone_delay_enable) {
+		add_iop(zpd, unow, zp->io_type == ZIO_TYPE_READ ?
+		    ZFS_ZONE_IOP_READ : ZFS_ZONE_IOP_WRITE, udelta);
+	}
+
+	/*
+	 * sdt:::zfs-zone-latency
+	 *
+	 *	arg0: zone ID
+	 *	arg1: type of I/O operation
+	 *	arg2: I/O latency (in us)
+	 */
+	DTRACE_PROBE3(zfs__zone__latency, uintptr_t, zp->io_zoneid,
+	    uintptr_t, zp->io_type, uintptr_t, udelta);
+}
+
+void
+zfs_zone_zio_dequeue(zio_t *zp)
+{
+	zio_priority_t p;
+	zone_persist_t *zpd = &zone_pdata[zp->io_zoneid];
+	zone_zfs_io_t *iop;
+
+	p = zp->io_priority;
+	if (p != ZIO_PRIORITY_SYNC_READ && p != ZIO_PRIORITY_SYNC_WRITE)
+		return;
+
+	/* We depend on p being defined as either 0 or 1 */
+	ASSERT(p < 2);
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop != NULL) {
+		ASSERT(iop->zpers_zfs_queued[p] > 0);
+		if (iop->zpers_zfs_queued[p] == 0) {
+			cmn_err(CE_WARN, "zfs_zone_zio_dequeue: count==0");
+		} else {
+			iop->zpers_zfs_queued[p]--;
+		}
+	}
+	mutex_exit(&zpd->zpers_zfs_lock);
+}
+
+void
+zfs_zone_zio_enqueue(zio_t *zp)
+{
+	zio_priority_t p;
+	zone_persist_t *zpd = &zone_pdata[zp->io_zoneid];
+	zone_zfs_io_t *iop;
+
+	p = zp->io_priority;
+	if (p != ZIO_PRIORITY_SYNC_READ && p != ZIO_PRIORITY_SYNC_WRITE)
+		return;
+
+	/* We depend on p being defined as either 0 or 1 */
+	ASSERT(p < 2);
+
+	mutex_enter(&zpd->zpers_zfs_lock);
+	iop = zpd->zpers_zfsp;
+	if (iop != NULL) {
+		iop->zpers_zfs_queued[p]++;
+	}
+	mutex_exit(&zpd->zpers_zfs_lock);
+}
+
+/*
+ * Called from vdev_queue_io_to_issue. That function is where zio's are listed
+ * in FIFO order on one of the sync queues, then pulled off (by
+ * vdev_queue_io_remove) and issued.  We potentially do zone-based scheduling
+ * here to find a zone's zio deeper in the sync queue and issue that instead
+ * of simply doing FIFO.
+ *
+ * We only do zone-based zio scheduling for the two synchronous I/O queues
+ * (read & write). These queues are normally serviced in FIFO order but we
+ * may decide to move a zone's zio to the head of the line. A typical I/O
+ * load will be mostly synchronous reads and some asynchronous writes (which
+ * are scheduled differently due to transaction groups). There will also be
+ * some synchronous writes for those apps which want to ensure their data is on
+ * disk. We want to make sure that a zone with a single-threaded app (e.g. the
+ * shell) that is doing synchronous I/O (typically reads) isn't penalized by
+ * other zones which are doing lots of synchronous I/O because they have many
+ * running threads.
+ *
+ * The vq->vq_lock mutex is held when we're executing this function so we
+ * can safely access the "last zone" variable on the queue.
+ */
+zio_t *
+zfs_zone_schedule(vdev_queue_t *vq, zio_priority_t p, avl_index_t idx,
+    avl_tree_t *tree)
+{
+	vdev_queue_class_t *vqc = &vq->vq_class[p];
+	uint_t cnt;
+	zoneid_t last_zone;
+	zio_t *zio;
+
+	ASSERT(MUTEX_HELD(&vq->vq_lock));
+
+	/* Don't change the order on the LBA ordered queues. */
+	if (p != ZIO_PRIORITY_SYNC_READ && p != ZIO_PRIORITY_SYNC_WRITE)
+		return (avl_nearest(tree, idx, AVL_AFTER));
+
+	/* We depend on p being defined as either 0 or 1 */
+	ASSERT(p < 2);
+
+	cnt = avl_numnodes(tree);
+	last_zone = vq->vq_last_zone_id;
+
+	/*
+	 * If there are only a few zios in the queue then just issue the head.
+	 * If there are more than a few zios already queued up, then use
+	 * scheduling to get the next zio.
+	 */
+	if (!zfs_zone_schedule_enable || cnt < zfs_zone_schedule_thresh)
+		zio = avl_nearest(tree, idx, AVL_AFTER);
+	else
+		zio = get_next_zio(vqc, cnt, p, tree);
+
+	vq->vq_last_zone_id = zio->io_zoneid;
+
+	/*
+	 * Probe with 4 args; the number of IOs in the queue, the zone that
+	 * was last scheduled off this queue, the zone that was associated
+	 * with the next IO that is scheduled, and which queue (priority).
+	 */
+	DTRACE_PROBE4(zfs__zone__sched, uint_t, cnt, uint_t, last_zone,
+	    uint_t, zio->io_zoneid, uint_t, p);
+
+	return (zio);
+}
+
+#endif
diff --git a/usr/src/uts/common/fs/zfs/zil.c b/usr/src/uts/common/fs/zfs/zil.c
index e365aad3c4..66dbf3c386 100644
--- a/usr/src/uts/common/fs/zfs/zil.c
+++ b/usr/src/uts/common/fs/zfs/zil.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  * Copyright (c) 2011, 2018 by Delphix. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
  */
diff --git a/usr/src/uts/common/fs/zfs/zio.c b/usr/src/uts/common/fs/zfs/zio.c
index dc14ad07c2..a7ef33d799 100644
--- a/usr/src/uts/common/fs/zfs/zio.c
+++ b/usr/src/uts/common/fs/zfs/zio.c
@@ -22,6 +22,7 @@
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2011, 2018 by Delphix. All rights reserved.
  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
+ * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
  */
 
@@ -40,6 +41,7 @@
 #include <sys/ddt.h>
 #include <sys/blkptr.h>
 #include <sys/zfeature.h>
+#include <sys/zfs_zone.h>
 #include <sys/metaslab_impl.h>
 #include <sys/abd.h>
 #include <sys/cityhash.h>
@@ -620,11 +622,14 @@ zio_create(zio_t *pio, spa_t *spa, uint64_t txg, const blkptr_t *bp,
 		zio->io_bookmark = *zb;
 
 	if (pio != NULL) {
+		zio->io_zoneid = pio->io_zoneid;
 		if (zio->io_logical == NULL)
 			zio->io_logical = pio->io_logical;
 		if (zio->io_child_type == ZIO_CHILD_GANG)
 			zio->io_gang_leader = pio->io_gang_leader;
 		zio_add_child(pio, zio);
+	} else {
+		zfs_zone_zio_init(zio);
 	}
 
 	return (zio);
diff --git a/usr/src/uts/common/fs/zfs/zvol.c b/usr/src/uts/common/fs/zfs/zvol.c
index 9f8700cba8..2127de2bf0 100644
--- a/usr/src/uts/common/fs/zfs/zvol.c
+++ b/usr/src/uts/common/fs/zfs/zvol.c
@@ -25,8 +25,8 @@
  *
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2012, 2017 by Delphix. All rights reserved.
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -84,11 +84,13 @@
 #include <sys/zvol.h>
 #include <sys/dumphdr.h>
 #include <sys/zil_impl.h>
+#include <sys/sdt.h>
 #include <sys/dbuf.h>
 #include <sys/dmu_tx.h>
 #include <sys/zfeature.h>
 #include <sys/zio_checksum.h>
 #include <sys/zil_impl.h>
+#include <sys/ht.h>
 
 #include "zfs_namecheck.h"
 
@@ -139,6 +141,11 @@ typedef struct zvol_state {
 #define	ZVOL_EXCL	0x4
 #define	ZVOL_WCE	0x8
 
+#define	VOP_LATENCY_10MS	10000000
+#define	VOP_LATENCY_100MS	100000000
+#define	VOP_LATENCY_1S		1000000000
+#define	VOP_LATENCY_10S		10000000000
+
 /*
  * zvol maximum transfer in one DMU tx.
  */
@@ -1275,6 +1282,8 @@ zvol_strategy(buf_t *bp)
 	    (zv->zv_objset->os_sync == ZFS_SYNC_ALWAYS)) &&
 	    !doread && !is_dumpified;
 
+	ht_begin_unsafe();
+
 	/*
 	 * There must be no buffer changes when doing a dmu_sync() because
 	 * we can't change the data whilst calculating the checksum.
@@ -1322,6 +1331,8 @@ zvol_strategy(buf_t *bp)
 		zil_commit(zv->zv_zilog, ZVOL_OBJ);
 	biodone(bp);
 
+	ht_end_unsafe();
+
 	return (0);
 }
 
@@ -1384,6 +1395,9 @@ zvol_read(dev_t dev, uio_t *uio, cred_t *cr)
 	uint64_t volsize;
 	rl_t *rl;
 	int error = 0;
+	zone_t *zonep = curzone;
+	uint64_t tot_bytes;
+	hrtime_t start, lat;
 
 	zv = zfsdev_get_soft_state(minor, ZSST_ZVOL);
 	if (zv == NULL)
@@ -1400,6 +1414,16 @@ zvol_read(dev_t dev, uio_t *uio, cred_t *cr)
 		return (error);
 	}
 
+	ht_begin_unsafe();
+
+	DTRACE_PROBE3(zvol__uio__start, dev_t, dev, uio_t *, uio, int, 0);
+
+	mutex_enter(&zonep->zone_vfs_lock);
+	kstat_runq_enter(&zonep->zone_vfs_rwstats);
+	mutex_exit(&zonep->zone_vfs_lock);
+	start = gethrtime();
+	tot_bytes = 0;
+
 	rl = zfs_range_lock(&zv->zv_znode, uio->uio_loffset, uio->uio_resid,
 	    RL_READER);
 	while (uio->uio_resid > 0 && uio->uio_loffset < volsize) {
@@ -1409,6 +1433,7 @@ zvol_read(dev_t dev, uio_t *uio, cred_t *cr)
 		if (bytes > volsize - uio->uio_loffset)
 			bytes = volsize - uio->uio_loffset;
 
+		tot_bytes += bytes;
 		error =  dmu_read_uio(zv->zv_objset, ZVOL_OBJ, uio, bytes);
 		if (error) {
 			/* convert checksum errors into IO errors */
@@ -1418,6 +1443,41 @@ zvol_read(dev_t dev, uio_t *uio, cred_t *cr)
 		}
 	}
 	zfs_range_unlock(rl);
+
+	mutex_enter(&zonep->zone_vfs_lock);
+	zonep->zone_vfs_rwstats.reads++;
+	zonep->zone_vfs_rwstats.nread += tot_bytes;
+	kstat_runq_exit(&zonep->zone_vfs_rwstats);
+	mutex_exit(&zonep->zone_vfs_lock);
+
+	lat = gethrtime() - start;
+
+	if (lat >= VOP_LATENCY_10MS) {
+		zone_vfs_kstat_t *zvp;
+
+		zvp = zonep->zone_vfs_stats;
+		if (lat < VOP_LATENCY_100MS) {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+		} else if (lat < VOP_LATENCY_1S) {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+		} else if (lat < VOP_LATENCY_10S) {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+		} else {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_10s_ops.value.ui64);
+		}
+	}
+
+	DTRACE_PROBE4(zvol__uio__done, dev_t, dev, uio_t *, uio, int, 0, int,
+	    error);
+
+	ht_end_unsafe();
+
 	return (error);
 }
 
@@ -1431,6 +1491,9 @@ zvol_write(dev_t dev, uio_t *uio, cred_t *cr)
 	rl_t *rl;
 	int error = 0;
 	boolean_t sync;
+	zone_t *zonep = curzone;
+	uint64_t tot_bytes;
+	hrtime_t start, lat;
 
 	zv = zfsdev_get_soft_state(minor, ZSST_ZVOL);
 	if (zv == NULL)
@@ -1447,6 +1510,21 @@ zvol_write(dev_t dev, uio_t *uio, cred_t *cr)
 		return (error);
 	}
 
+	ht_begin_unsafe();
+
+	DTRACE_PROBE3(zvol__uio__start, dev_t, dev, uio_t *, uio, int, 1);
+
+	/*
+	 * For the purposes of VFS kstat consumers, the "waitq" calculation is
+	 * repurposed as the active queue for zvol write operations. There's no
+	 * actual wait queue for zvol operations.
+	 */
+	mutex_enter(&zonep->zone_vfs_lock);
+	kstat_waitq_enter(&zonep->zone_vfs_rwstats);
+	mutex_exit(&zonep->zone_vfs_lock);
+	start = gethrtime();
+	tot_bytes = 0;
+
 	sync = !(zv->zv_flags & ZVOL_WCE) ||
 	    (zv->zv_objset->os_sync == ZFS_SYNC_ALWAYS);
 
@@ -1460,6 +1538,7 @@ zvol_write(dev_t dev, uio_t *uio, cred_t *cr)
 		if (bytes > volsize - off)	/* don't write past the end */
 			bytes = volsize - off;
 
+		tot_bytes += bytes;
 		dmu_tx_hold_write(tx, ZVOL_OBJ, off, bytes);
 		error = dmu_tx_assign(tx, TXG_WAIT);
 		if (error) {
@@ -1477,6 +1556,41 @@ zvol_write(dev_t dev, uio_t *uio, cred_t *cr)
 	zfs_range_unlock(rl);
 	if (sync)
 		zil_commit(zv->zv_zilog, ZVOL_OBJ);
+
+	DTRACE_PROBE4(zvol__uio__done, dev_t, dev, uio_t *, uio, int, 1, int,
+	    error);
+
+	ht_end_unsafe();
+
+	mutex_enter(&zonep->zone_vfs_lock);
+	zonep->zone_vfs_rwstats.writes++;
+	zonep->zone_vfs_rwstats.nwritten += tot_bytes;
+	kstat_waitq_exit(&zonep->zone_vfs_rwstats);
+	mutex_exit(&zonep->zone_vfs_lock);
+
+	lat = gethrtime() - start;
+
+	if (lat >= VOP_LATENCY_10MS) {
+		zone_vfs_kstat_t *zvp;
+
+		zvp = zonep->zone_vfs_stats;
+		if (lat < VOP_LATENCY_100MS) {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+		} else if (lat < VOP_LATENCY_1S) {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+		} else if (lat < VOP_LATENCY_10S) {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+		} else {
+			atomic_inc_64(&zvp->zv_10ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_100ms_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_1s_ops.value.ui64);
+			atomic_inc_64(&zvp->zv_10s_ops.value.ui64);
+		}
+	}
+
 	return (error);
 }
 
@@ -1717,11 +1831,17 @@ zvol_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
 	case DKIOCFLUSHWRITECACHE:
 		dkc = (struct dk_callback *)arg;
 		mutex_exit(&zfsdev_state_lock);
+
+		ht_begin_unsafe();
+
 		zil_commit(zv->zv_zilog, ZVOL_OBJ);
 		if ((flag & FKIOCTL) && dkc != NULL && dkc->dkc_callback) {
 			(*dkc->dkc_callback)(dkc->dkc_cookie, error);
 			error = 0;
 		}
+
+		ht_end_unsafe();
+
 		return (error);
 
 	case DKIOCGETWCE:
@@ -1746,7 +1866,9 @@ zvol_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
 		} else {
 			zv->zv_flags &= ~ZVOL_WCE;
 			mutex_exit(&zfsdev_state_lock);
+			ht_begin_unsafe();
 			zil_commit(zv->zv_zilog, ZVOL_OBJ);
+			ht_end_unsafe();
 		}
 		return (0);
 	}
@@ -1799,6 +1921,8 @@ zvol_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
 
 		mutex_exit(&zfsdev_state_lock);
 
+		ht_begin_unsafe();
+
 		rl = zfs_range_lock(&zv->zv_znode, df.df_start, df.df_length,
 		    RL_WRITER);
 		tx = dmu_tx_create(zv->zv_objset);
@@ -1831,6 +1955,8 @@ zvol_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
 			zil_commit(zv->zv_zilog, ZVOL_OBJ);
 		}
 
+		ht_end_unsafe();
+
 		return (error);
 	}
 
diff --git a/usr/src/uts/common/inet/bpf.h b/usr/src/uts/common/inet/bpf.h
new file mode 100644
index 0000000000..e3eac799e5
--- /dev/null
+++ b/usr/src/uts/common/inet/bpf.h
@@ -0,0 +1,49 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef	_INET_BPF_H
+#define	_INET_BPF_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+
+#ifdef	_KERNEL
+
+#include <sys/types.h>
+
+/*
+ * Clone bpf_insn definition so that consumers don't need net/bpf.h to reason
+ * about struct sizing.
+ */
+typedef struct ip_bpf_insn {
+	uint16_t	code;
+	uint8_t		jt;
+	uint8_t		jf;
+	uint32_t	k;
+} ip_bpf_insn_t;
+
+extern uint32_t ip_bpf_filter(ip_bpf_insn_t *, uchar_t *, uint_t, uint_t);
+extern boolean_t ip_bpf_validate(ip_bpf_insn_t *, uint_t);
+
+
+#endif	/* _KERNEL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _INET_BPF_H */
diff --git a/usr/src/uts/common/io/bpf/bpf_filter.c b/usr/src/uts/common/inet/bpf_filter.c
index db5b224a5e..5a9ba38da6 100644
--- a/usr/src/uts/common/io/bpf/bpf_filter.c
+++ b/usr/src/uts/common/inet/bpf_filter.c
@@ -38,6 +38,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/param.h>
@@ -45,11 +46,12 @@
 #include <sys/stream.h>
 #include <sys/byteorder.h>
 #include <sys/sdt.h>
+#include <inet/bpf.h>
+#include <net/bpf.h>
 
 #define	EXTRACT_SHORT(p)	BE_IN16(p)
 #define	EXTRACT_LONG(p)		BE_IN32(p)
 
-#ifdef _KERNEL
 #define	M_LEN(_m)	((_m)->b_wptr - (_m)->b_rptr)
 #define	mtod(_a, _t)	((_t)((_a)->b_rptr))
 #define	MINDEX(len, m, k) 		\
@@ -123,11 +125,7 @@ m_xhalf(mblk_t *m, uint32_t k, int *err)
 	*err = 0;
 	return ((cp[0] << 8) | mtod(m0, uchar_t *)[0]);
 }
-#else /* _KERNEL */
-#include <stdlib.h>
-#endif /* !_KERNEL */
 
-#include <net/bpf.h>
 
 /*
  * Execute the filter program starting at pc on the packet p
@@ -137,8 +135,8 @@ m_xhalf(mblk_t *m, uint32_t k, int *err)
  * packet is only in one mblk_t.
  * When buflen is 0, p is an mblk_t pointer.
  */
-uint_t
-bpf_filter(struct bpf_insn *pc, uchar_t *p, uint_t wirelen, uint_t buflen)
+uint32_t
+ip_bpf_filter(ip_bpf_insn_t *pc, uchar_t *p, uint_t wirelen, uint_t buflen)
 {
 	uint32_t A, X, k;
 	uint32_t mem[BPF_MEMWORDS];
@@ -147,7 +145,7 @@ bpf_filter(struct bpf_insn *pc, uchar_t *p, uint_t wirelen, uint_t buflen)
 		/*
 		 * No filter means accept all.
 		 */
-		return ((uint_t)-1);
+		return ((uint32_t)-1);
 	A = 0;
 	X = 0;
 	--pc;
@@ -165,10 +163,10 @@ bpf_filter(struct bpf_insn *pc, uchar_t *p, uint_t wirelen, uint_t buflen)
 			abort();
 #endif
 		case BPF_RET|BPF_K:
-			return ((uint_t)pc->k);
+			return (pc->k);
 
 		case BPF_RET|BPF_A:
-			return ((uint_t)A);
+			return (A);
 
 		case BPF_LD|BPF_W|BPF_ABS:
 			k = pc->k;
@@ -456,7 +454,6 @@ bpf_filter(struct bpf_insn *pc, uchar_t *p, uint_t wirelen, uint_t buflen)
 	/* NOTREACHED */
 }
 
-#ifdef _KERNEL
 /*
  * Return true if the 'fcode' is a valid filter program.
  * The constraints are that each jump be forward and to a valid
@@ -468,14 +465,14 @@ bpf_filter(struct bpf_insn *pc, uchar_t *p, uint_t wirelen, uint_t buflen)
  * The kernel needs to be able to verify an application's filter code.
  * Otherwise, a bogus program could easily crash the system.
  */
-int
-bpf_validate(struct bpf_insn *f, int len)
+boolean_t
+ip_bpf_validate(ip_bpf_insn_t *f, uint_t len)
 {
 	uint_t i, from;
-	struct bpf_insn *p;
+	ip_bpf_insn_t *p;
 
 	if (len < 1 || len > BPF_MAXINSNS)
-		return (0);
+		return (B_FALSE);
 
 	for (i = 0; i < len; ++i) {
 		p = &f[i];
@@ -489,7 +486,7 @@ bpf_validate(struct bpf_insn *f, int len)
 			switch (BPF_MODE(p->code)) {
 			case BPF_MEM:
 				if (p->k >= BPF_MEMWORDS)
-					return (0);
+					return (B_FALSE);
 				break;
 			case BPF_ABS:
 			case BPF_IND:
@@ -498,13 +495,13 @@ bpf_validate(struct bpf_insn *f, int len)
 			case BPF_LEN:
 				break;
 			default:
-				return (0);
+				return (B_FALSE);
 			}
 			break;
 		case BPF_ST:
 		case BPF_STX:
 			if (p->k >= BPF_MEMWORDS)
-				return (0);
+				return (B_FALSE);
 			break;
 		case BPF_ALU:
 			switch (BPF_OP(p->code)) {
@@ -522,10 +519,10 @@ bpf_validate(struct bpf_insn *f, int len)
 				 * Check for constant division by 0.
 				 */
 				if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
-					return (0);
+					return (B_FALSE);
 				break;
 			default:
-				return (0);
+				return (B_FALSE);
 			}
 			break;
 		case BPF_JMP:
@@ -549,17 +546,17 @@ bpf_validate(struct bpf_insn *f, int len)
 			switch (BPF_OP(p->code)) {
 			case BPF_JA:
 				if (from + p->k < from || from + p->k >= len)
-					return (0);
+					return (B_FALSE);
 				break;
 			case BPF_JEQ:
 			case BPF_JGT:
 			case BPF_JGE:
 			case BPF_JSET:
 				if (from + p->jt >= len || from + p->jf >= len)
-					return (0);
+					return (B_FALSE);
 				break;
 			default:
-				return (0);
+				return (B_FALSE);
 			}
 			break;
 		case BPF_RET:
@@ -567,10 +564,9 @@ bpf_validate(struct bpf_insn *f, int len)
 		case BPF_MISC:
 			break;
 		default:
-			return (0);
+			return (B_FALSE);
 		}
 	}
 
 	return (BPF_CLASS(f[len - 1].code) == BPF_RET);
 }
-#endif
diff --git a/usr/src/uts/common/inet/inet_hash.h b/usr/src/uts/common/inet/inet_hash.h
new file mode 100644
index 0000000000..a790a797d1
--- /dev/null
+++ b/usr/src/uts/common/inet/inet_hash.h
@@ -0,0 +1,37 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _INET_INET_HASH_H
+#define	_INET_INET_HASH_H
+
+/*
+ * Common packet hashing routines shared across MAC, UDP, and others.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	INET_PKT_HASH_L2	0x01
+#define	INET_PKT_HASH_L3	0x02
+#define	INET_PKT_HASH_L4	0x04
+
+extern uint64_t inet_pkt_hash(uint_t, mblk_t *, uint8_t);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _INET_INET_HASH_H */
diff --git a/usr/src/uts/common/inet/ip.h b/usr/src/uts/common/inet/ip.h
index cc8c489c8c..456d778cc7 100644
--- a/usr/src/uts/common/inet/ip.h
+++ b/usr/src/uts/common/inet/ip.h
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 1990 Mentat Inc.
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ * Copyright 2017, Joyent, Inc. All rights reserved.
  * Copyright 2017 Nexenta Systems, Inc.
  * Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved.
  */
@@ -1415,6 +1415,7 @@ typedef union ill_g_head_u {
 #define	ILL_CAPAB_DLD		0x20		/* DLD capabilities */
 #define	ILL_CAPAB_DLD_POLL	0x40		/* Polling */
 #define	ILL_CAPAB_DLD_DIRECT	0x80		/* Direct function call */
+#define	ILL_CAPAB_DLD_IPCHECK	0x100		/* Check if IPs are permitted */
 
 /*
  * Per-ill Hardware Checksumming capbilities.
@@ -1728,6 +1729,8 @@ typedef struct ill_s {
 	 * Capabilities related fields.
 	 */
 	uint_t  ill_dlpi_capab_state;	/* State of capability query, IDCS_* */
+	kcondvar_t ill_dlpi_capab_cv;	/* CV for broadcasting state changes */
+	kmutex_t ill_dlpi_capab_lock;	/* Lock for accessing above Cond Var */
 	uint_t	ill_capab_pending_cnt;
 	uint64_t ill_capabilities;	/* Enabled capabilities, ILL_CAPAB_* */
 	ill_hcksum_capab_t *ill_hcksum_capab; /* H/W cksumming capabilities */
@@ -1769,6 +1772,10 @@ typedef struct ill_s {
 	 * Used to save errors that occur during plumbing
 	 */
 	uint_t		ill_ifname_pending_err;
+	/*
+	 * Used to save errors that occur during binding
+	 */
+	uint_t		ill_dl_bind_err;
 	avl_node_t	ill_avl_byppa; /* avl node based on ppa */
 	list_t		ill_nce; /* pointer to nce_s list */
 	uint_t		ill_refcnt;	/* active refcnt by threads */
@@ -1934,6 +1941,7 @@ typedef struct ill_s {
  * ill_nd_lla_len		ipsq + down ill		only when ill is up
  * ill_phys_addr_pend		ipsq + down ill		only when ill is up
  * ill_ifname_pending_err	ipsq			ipsq
+ * ill_dl_bind_err		ipsq			ipsq
  * ill_avl_byppa		ipsq, ill_g_lock	write once
  *
  * ill_fastpath_list		ill_lock		ill_lock
@@ -3575,6 +3583,8 @@ typedef	void			(*ip_flow_enable_t)(void *, ip_mac_tx_cookie_t);
 typedef void			*(*ip_dld_callb_t)(void *,
     ip_flow_enable_t, void *);
 typedef boolean_t		(*ip_dld_fctl_t)(void *, ip_mac_tx_cookie_t);
+typedef boolean_t		(*ip_mac_ipcheck_t)(void *, boolean_t,
+    in6_addr_t *);
 typedef int			(*ip_capab_func_t)(void *, uint_t,
     void *, uint_t);
 
@@ -3627,6 +3637,12 @@ typedef struct ill_dld_direct_s {		/* DLD provided driver Tx */
 	void			*idd_tx_fctl_dh;	/* mac_client_handle */
 } ill_dld_direct_t;
 
+/* IP - DLD direct function call to check if an IP is allowed */
+typedef struct ill_dld_ipcheck_s {
+	ip_mac_ipcheck_t	idi_allowed_df;
+	void			*idi_allowed_dh;
+} ill_dld_ipcheck_t;
+
 /* IP - DLD polling capability */
 typedef struct ill_dld_poll_s {
 	ill_rx_ring_t		idp_ring_tbl[ILL_MAX_RINGS];
@@ -3638,6 +3654,7 @@ struct ill_dld_capab_s {
 	void			*idc_capab_dh;	/* dld_str_t *dsp */
 	ill_dld_direct_t	idc_direct;
 	ill_dld_poll_t		idc_poll;
+	ill_dld_ipcheck_t	idc_ipcheck;
 };
 
 /*
diff --git a/usr/src/uts/common/inet/ip/conn_opt.c b/usr/src/uts/common/inet/ip/conn_opt.c
index bcbc1c4949..b4bff4d7b4 100644
--- a/usr/src/uts/common/inet/ip/conn_opt.c
+++ b/usr/src/uts/common/inet/ip/conn_opt.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -619,6 +620,9 @@ conn_opt_get(conn_opt_arg_t *coa, t_scalar_t level, t_scalar_t name,
 		case SO_REUSEADDR:
 			*i1 = connp->conn_reuseaddr ? SO_REUSEADDR : 0;
 			break;	/* goto sizeof (int) option return */
+		case SO_REUSEPORT:
+			*i1 = connp->conn_reuseport;
+			break;	/* goto sizeof (int) option return */
 		case SO_TYPE:
 			*i1 = connp->conn_so_type;
 			break;	/* goto sizeof (int) option return */
@@ -1186,8 +1190,24 @@ conn_opt_set_ip(conn_opt_arg_t *coa, t_scalar_t name, uint_t inlen,
 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
 	int		error;
 
-	if (connp->conn_family != AF_INET)
+	if (connp->conn_family == AF_INET6 &&
+	    connp->conn_ipversion == IPV4_VERSION) {
+		/*
+		 * Allow certain IPv4 options to be set on an AF_INET6 socket
+		 * if the connection is still IPv4.
+		 */
+		switch (name) {
+		case IP_TOS:
+		case T_IP_TOS:
+		case IP_TTL:
+		case IP_DONTFRAG:
+			break;
+		default:
+			return (EINVAL);
+		}
+	} else if (connp->conn_family != AF_INET) {
 		return (EINVAL);
+	}
 
 	switch (name) {
 	case IP_TTL:
diff --git a/usr/src/uts/common/inet/ip/icmp.c b/usr/src/uts/common/inet/ip/icmp.c
index a4abdbd130..01119bf65b 100644
--- a/usr/src/uts/common/inet/ip/icmp.c
+++ b/usr/src/uts/common/inet/ip/icmp.c
@@ -22,6 +22,7 @@
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2013 by Delphix. All rights reserved.
  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -80,6 +81,7 @@
 #include <sys/tsol/tnet.h>
 
 #include <inet/rawip_impl.h>
+#include <net/bpf.h>
 
 #include <sys/disp.h>
 
@@ -1011,6 +1013,12 @@ icmp_close_free(conn_t *connp)
 		icmp->icmp_filter = NULL;
 	}
 
+	if (icmp->icmp_bpf_len != 0) {
+		kmem_free(icmp->icmp_bpf_prog, icmp->icmp_bpf_len);
+		icmp->icmp_bpf_len = 0;
+		icmp->icmp_bpf_prog = NULL;
+	}
+
 	/*
 	 * Clear any fields which the kmem_cache constructor clears.
 	 * Only icmp_connp needs to be preserved.
@@ -1964,6 +1972,104 @@ icmp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr)
 	return (err);
 }
 
+static int
+icmp_attach_filter(icmp_t *icmp, uint_t inlen, const uchar_t *invalp)
+{
+	struct bpf_program prog;
+	ip_bpf_insn_t *insns = NULL;
+	unsigned int size;
+
+#ifdef _LP64
+	if (get_udatamodel() != DATAMODEL_NATIVE) {
+		struct bpf_program32 *prog32;
+
+		if (inlen != sizeof (struct bpf_program32)) {
+			return (EINVAL);
+		}
+		prog32 = (struct bpf_program32 *)invalp;
+		prog.bf_len = prog32->bf_len;
+		prog.bf_insns = (void *)(uint64_t)prog32->bf_insns;
+	} else
+#endif
+	if (inlen == sizeof (struct bpf_program)) {
+		bcopy(invalp, &prog, sizeof (prog));
+	} else {
+		return (EINVAL);
+	}
+
+	if (prog.bf_len > BPF_MAXINSNS || prog.bf_len == 0) {
+		return (EINVAL);
+	}
+	size = prog.bf_len * sizeof (struct bpf_insn);
+	insns = kmem_alloc(size, KM_SLEEP);
+	if (copyin(prog.bf_insns, insns, size) != 0) {
+		kmem_free(insns, size);
+		return (EFAULT);
+	}
+	if (!ip_bpf_validate(insns, prog.bf_len)) {
+		kmem_free(insns, size);
+		return (EINVAL);
+	}
+
+	rw_enter(&icmp->icmp_bpf_lock, RW_WRITER);
+	if (icmp->icmp_bpf_len != 0) {
+		ASSERT(icmp->icmp_bpf_prog != NULL);
+
+		kmem_free(icmp->icmp_bpf_prog, icmp->icmp_bpf_len);
+	}
+	icmp->icmp_bpf_len = size;
+	icmp->icmp_bpf_prog = insns;
+	rw_exit(&icmp->icmp_bpf_lock);
+	return (0);
+}
+
+static int
+icmp_detach_filter(icmp_t *icmp)
+{
+	int error;
+
+	rw_enter(&icmp->icmp_bpf_lock, RW_WRITER);
+	if (icmp->icmp_bpf_len == 0) {
+		ASSERT(icmp->icmp_bpf_prog == NULL);
+		error = ENOENT;
+	} else {
+		kmem_free(icmp->icmp_bpf_prog,
+		    icmp->icmp_bpf_len);
+		icmp->icmp_bpf_len = 0;
+		icmp->icmp_bpf_prog = NULL;
+		error = 0;
+	}
+	rw_exit(&icmp->icmp_bpf_lock);
+	return (error);
+}
+
+static boolean_t
+icmp_eval_filter(icmp_t *icmp, mblk_t *mp, ip_recv_attr_t *ira)
+{
+	boolean_t res;
+	uchar_t *buf = mp->b_rptr;
+	uint_t wirelen, len = MBLKL(mp);
+
+	rw_enter(&icmp->icmp_bpf_lock, RW_READER);
+	if (icmp->icmp_bpf_len == 0) {
+		rw_exit(&icmp->icmp_bpf_lock);
+		return (B_FALSE);
+	}
+	if (ira->ira_flags & IRAF_IS_IPV4) {
+		ipha_t *ipha = (ipha_t *)buf;
+
+		wirelen = ntohs(ipha->ipha_length);
+	} else {
+		ip6_t *ip6h = (ip6_t *)buf;
+
+		wirelen = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
+	}
+	res = !ip_bpf_filter(icmp->icmp_bpf_prog, buf, wirelen, len);
+	rw_exit(&icmp->icmp_bpf_lock);
+
+	return (res);
+}
+
 /*
  * This routine sets socket options.
  */
@@ -2053,6 +2159,10 @@ icmp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
 				return (ENOBUFS);
 			}
 			break;
+		case SO_ATTACH_FILTER:
+			return (icmp_attach_filter(icmp, inlen, invalp));
+		case SO_DETACH_FILTER:
+			return (icmp_detach_filter(icmp));
 		}
 		break;
 
@@ -2598,6 +2708,14 @@ icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
 	/* Initialize regardless of IP version */
 	ipps.ipp_fields = 0;
 
+	/* Apply socket filter, if needed */
+	if (icmp->icmp_bpf_len != 0) {
+		if (icmp_eval_filter(icmp, mp, ira)) {
+			freemsg(mp);
+			return;
+		}
+	}
+
 	if (ira->ira_flags & IRAF_IS_IPV4) {
 		ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
 		ASSERT(MBLKL(mp) >= sizeof (ipha_t));
@@ -5027,7 +5145,8 @@ rawip_stack_fini(netstackid_t stackid, void *arg)
 }
 
 static void *
-rawip_kstat_init(netstackid_t stackid) {
+rawip_kstat_init(netstackid_t stackid)
+{
 	kstat_t	*ksp;
 
 	rawip_named_kstat_t template = {
@@ -5039,9 +5158,7 @@ rawip_kstat_init(netstackid_t stackid) {
 	};
 
 	ksp = kstat_create_netstack("icmp", 0, "rawip", "mib2",
-					KSTAT_TYPE_NAMED,
-					NUM_OF_FIELDS(rawip_named_kstat_t),
-					0, stackid);
+	    KSTAT_TYPE_NAMED, NUM_OF_FIELDS(rawip_named_kstat_t), 0, stackid);
 	if (ksp == NULL || ksp->ks_data == NULL)
 		return (NULL);
 
diff --git a/usr/src/uts/common/inet/ip/icmp_opt_data.c b/usr/src/uts/common/inet/ip/icmp_opt_data.c
index ff0310de0c..d65d3164d3 100644
--- a/usr/src/uts/common/inet/ip/icmp_opt_data.c
+++ b/usr/src/uts/common/inet/ip/icmp_opt_data.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -41,6 +42,7 @@
 #include <netinet/ip_mroute.h>
 #include <inet/optcom.h>
 #include <inet/rawip_impl.h>
+#include <net/bpf.h>
 
 /*
  * Table of all known options handled on a ICMP protocol stack.
@@ -86,6 +88,10 @@ opdes_t	icmp_opt_arr[] = {
 	0 },
 { SO_DOMAIN,	SOL_SOCKET, OA_R, OA_R, OP_NP, 0, sizeof (int), 0 },
 
+{ SO_ATTACH_FILTER,	SOL_SOCKET, OA_W, OA_W, OP_NP, 0,
+	sizeof (struct bpf_program), 0 },
+{ SO_DETACH_FILTER,	SOL_SOCKET, OA_W, OA_W, OP_NP, 0, 0, 0 },
+
 { IP_OPTIONS,	IPPROTO_IP, OA_RW, OA_RW, OP_NP,
 	(OP_VARLEN|OP_NODEFAULT),
 	IP_MAX_OPT_LENGTH + IP_ADDR_LEN, -1 /* not initialized */ },
diff --git a/usr/src/uts/common/inet/ip/ip.c b/usr/src/uts/common/inet/ip/ip.c
index 215d09e724..d673a92387 100644
--- a/usr/src/uts/common/inet/ip/ip.c
+++ b/usr/src/uts/common/inet/ip/ip.c
@@ -4129,6 +4129,8 @@ ip_modclose(ill_t *ill)
 	rw_destroy(&ill->ill_mcast_lock);
 	mutex_destroy(&ill->ill_mcast_serializer);
 	list_destroy(&ill->ill_nce);
+	cv_destroy(&ill->ill_dlpi_capab_cv);
+	mutex_destroy(&ill->ill_dlpi_capab_lock);
 
 	/*
 	 * Now we are done with the module close pieces that
@@ -8200,7 +8202,6 @@ ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
 	conn_t		*connp = NULL;
 	t_uscalar_t	paddrreq;
 	mblk_t		*mp_hw;
-	boolean_t	success;
 	boolean_t	ioctl_aborted = B_FALSE;
 	boolean_t	log = B_TRUE;
 
@@ -8300,7 +8301,8 @@ ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
 			ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
 			mutex_exit(&ill->ill_lock);
 			/*
-			 * Something went wrong with the bind.  We presumably
+			 * Something went wrong with the bind. If this was the
+			 * result of a DL_NOTE_REPLUMB, then we presumably
 			 * have an IOCTL hanging out waiting for completion.
 			 * Find it, take down the interface that was coming
 			 * up, and complete the IOCTL with the error noted.
@@ -8317,6 +8319,15 @@ ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
 
 				(void) ipif_down(ipif, NULL, NULL);
 				/* error is set below the switch */
+			} else {
+				/*
+				 * There's no pending IOCTL, so the bind was
+				 * most likely started by ill_dl_up(). We save
+				 * the error and let it take care of responding
+				 * to the IOCTL.
+				 */
+				ill->ill_dl_bind_err = dlea->dl_unix_errno ?
+				    dlea->dl_unix_errno : ENXIO;
 			}
 			break;
 		case DL_ENABMULTI_REQ:
@@ -8440,55 +8451,7 @@ ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
 		DTRACE_PROBE1(ip__rput__dlpi__bind__ack, ill_t *, ill);
 		ill_nic_event_dispatch(ill, 0, NE_UP, NULL, 0);
 
-		/*
-		 * Now bring up the resolver; when that is complete, we'll
-		 * create IREs.  Note that we intentionally mirror what
-		 * ipif_up() would have done, because we got here by way of
-		 * ill_dl_up(), which stopped ipif_up()'s processing.
-		 */
-		if (ill->ill_isv6) {
-			/*
-			 * v6 interfaces.
-			 * Unlike ARP which has to do another bind
-			 * and attach, once we get here we are
-			 * done with NDP
-			 */
-			(void) ipif_resolver_up(ipif, Res_act_initial);
-			if ((err = ipif_ndp_up(ipif, B_TRUE)) == 0)
-				err = ipif_up_done_v6(ipif);
-		} else if (ill->ill_net_type == IRE_IF_RESOLVER) {
-			/*
-			 * ARP and other v4 external resolvers.
-			 * Leave the pending mblk intact so that
-			 * the ioctl completes in ip_rput().
-			 */
-			if (connp != NULL)
-				mutex_enter(&connp->conn_lock);
-			mutex_enter(&ill->ill_lock);
-			success = ipsq_pending_mp_add(connp, ipif, q, mp1, 0);
-			mutex_exit(&ill->ill_lock);
-			if (connp != NULL)
-				mutex_exit(&connp->conn_lock);
-			if (success) {
-				err = ipif_resolver_up(ipif, Res_act_initial);
-				if (err == EINPROGRESS) {
-					freemsg(mp);
-					return;
-				}
-				mp1 = ipsq_pending_mp_get(ipsq, &connp);
-			} else {
-				/* The conn has started closing */
-				err = EINTR;
-			}
-		} else {
-			/*
-			 * This one is complete. Reply to pending ioctl.
-			 */
-			(void) ipif_resolver_up(ipif, Res_act_initial);
-			err = ipif_up_done(ipif);
-		}
-
-		if ((err == 0) && (ill->ill_up_ipifs)) {
+		if (ill->ill_up_ipifs) {
 			err = ill_up_ipifs(ill, q, mp1);
 			if (err == EINPROGRESS) {
 				freemsg(mp);
@@ -8496,25 +8459,6 @@ ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
 			}
 		}
 
-		/*
-		 * If we have a moved ipif to bring up, and everything has
-		 * succeeded to this point, bring it up on the IPMP ill.
-		 * Otherwise, leave it down -- the admin can try to bring it
-		 * up by hand if need be.
-		 */
-		if (ill->ill_move_ipif != NULL) {
-			if (err != 0) {
-				ill->ill_move_ipif = NULL;
-			} else {
-				ipif = ill->ill_move_ipif;
-				ill->ill_move_ipif = NULL;
-				err = ipif_up(ipif, q, mp1);
-				if (err == EINPROGRESS) {
-					freemsg(mp);
-					return;
-				}
-			}
-		}
 		break;
 
 	case DL_NOTIFY_IND: {
@@ -12576,6 +12520,7 @@ ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
 	ip_ioctl_cmd_t *ipip = arg;
 	ip_extract_func_t *extract_funcp;
+	ill_t *ill;
 	cmd_info_t ci;
 	int err;
 	boolean_t entered_ipsq = B_FALSE;
@@ -12696,6 +12641,13 @@ ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
 	ipsq_current_start(ipsq, ci.ci_ipif, ipip->ipi_cmd);
 
 	/*
+	 * We need to cache the ill_t that we're going to use as the argument
+	 * to the ipif-ioctl DTrace probe (below) because the ci_ipif can be
+	 * blown away by calling ipi_func.
+	 */
+	ill = ci.ci_ipif == NULL ? NULL : ci.ci_ipif->ipif_ill;
+
+	/*
 	 * A return value of EINPROGRESS means the ioctl is
 	 * either queued and waiting for some reason or has
 	 * already completed.
@@ -12703,9 +12655,7 @@ ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
 	err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip, ci.ci_lifr);
 
 	DTRACE_PROBE4(ipif__ioctl, char *, "ip_process_ioctl finish WR",
-	    int, ipip->ipi_cmd,
-	    ill_t *, ci.ci_ipif == NULL ? NULL : ci.ci_ipif->ipif_ill,
-	    ipif_t *, ci.ci_ipif);
+	    int, ipip->ipi_cmd, ill_t *, ill, ipif_t *, ci.ci_ipif);
 	ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq);
 
 	if (entered_ipsq)
diff --git a/usr/src/uts/common/inet/ip/ip6_input.c b/usr/src/uts/common/inet/ip/ip6_input.c
index c7c241f944..79a53eff7c 100644
--- a/usr/src/uts/common/inet/ip/ip6_input.c
+++ b/usr/src/uts/common/inet/ip/ip6_input.c
@@ -23,6 +23,7 @@
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved
  *
  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -143,11 +144,9 @@ static void	ip_input_multicast_v6(ire_t *, mblk_t *, ip6_t *,
  * The ill will always be valid if this function is called directly from
  * the driver.
  *
- * If ip_input_v6() is called from GLDv3:
- *
- *   - This must be a non-VLAN IP stream.
- *   - 'mp' is either an untagged or a special priority-tagged packet.
- *   - Any VLAN tag that was in the MAC header has been stripped.
+ * If this chain is part of a VLAN stream, then the VLAN tag is
+ * stripped from the MAC header before being delivered to this
+ * function.
  *
  * If the IP header in packet is not 32-bit aligned, every message in the
  * chain will be aligned before further operations. This is required on SPARC
diff --git a/usr/src/uts/common/inet/ip/ip6_output.c b/usr/src/uts/common/inet/ip/ip6_output.c
index b023a2fe6a..dc074454e3 100644
--- a/usr/src/uts/common/inet/ip/ip6_output.c
+++ b/usr/src/uts/common/inet/ip/ip6_output.c
@@ -23,6 +23,7 @@
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -866,8 +867,16 @@ ip_output_cksum_v6(iaflags_t ixaflags, mblk_t *mp, ip6_t *ip6h,
 		    ixa->ixa_raw_cksum_offset);
 		cksum = htons(protocol);
 	} else if (protocol == IPPROTO_ICMPV6) {
-		cksump = IPH_ICMPV6_CHECKSUMP(ip6h, ip_hdr_length);
-		cksum = IP_ICMPV6_CSUM_COMP;	/* Pseudo-header cksum */
+		/*
+		 * Currently we assume no HW support for ICMP checksum calc.
+		 *
+		 * When HW support is advertised for ICMP, we'll want the
+		 * following to be set:
+		 * cksump = IPH_ICMPV6_CHECKSUMP(ip6h, ip_hdr_length);
+		 * cksum = IP_ICMPV6_CSUM_COMP;		Pseudo-header cksum
+		 */
+
+		return (ip_output_sw_cksum_v6(mp, ip6h, ixa));
 	} else {
 	ip_hdr_cksum:
 		/* No IP header checksum for IPv6 */
diff --git a/usr/src/uts/common/inet/ip/ip_if.c b/usr/src/uts/common/inet/ip/ip_if.c
index b88dcae2d1..c4b60daa68 100644
--- a/usr/src/uts/common/inet/ip/ip_if.c
+++ b/usr/src/uts/common/inet/ip/ip_if.c
@@ -174,7 +174,7 @@ static ipif_t	*ipif_lookup_on_name_async(char *name, size_t namelen,
 
 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
 static void	ill_delete_interface_type(ill_if_t *);
-static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
+static int	ill_dl_up(ill_t *ill, ipif_t *ipif);
 static void	ill_dl_down(ill_t *ill);
 static void	ill_down(ill_t *ill);
 static void	ill_down_ipifs(ill_t *, boolean_t);
@@ -1380,6 +1380,18 @@ ill_capability_probe(ill_t *ill)
 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
 }
 
+static void
+ill_capability_wait(ill_t *ill)
+{
+	while (ill->ill_capab_pending_cnt != 0) {
+		mutex_enter(&ill->ill_dlpi_capab_lock);
+		ipsq_exit(ill->ill_phyint->phyint_ipsq);
+		cv_wait(&ill->ill_dlpi_capab_cv, &ill->ill_dlpi_capab_lock);
+		mutex_exit(&ill->ill_dlpi_capab_lock);
+		VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
+	}
+}
+
 void
 ill_capability_reset(ill_t *ill, boolean_t reneg)
 {
@@ -1390,6 +1402,8 @@ ill_capability_reset(ill_t *ill, boolean_t reneg)
 
 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
 
+	ASSERT(ill->ill_capab_reset_mp != NULL);
+
 	ill_capability_send(ill, ill->ill_capab_reset_mp);
 	ill->ill_capab_reset_mp = NULL;
 	/*
@@ -2108,6 +2122,49 @@ ill_capability_lso_enable(ill_t *ill)
 	}
 }
 
+/*
+ * Check whether or not mac will prevent us from sending with a given IP
+ * address. This requires having the IPCHECK capability, which we should
+ * always be able to successfully negotiate, but if it's somehow missing
+ * then we just permit the caller to use the address, since mac does the
+ * actual enforcement and ip is just performing a courtesy check to help
+ * prevent users from unwittingly setting and attempting to use blocked
+ * addresses.
+ */
+static boolean_t
+ill_ipcheck_addr(ill_t *ill, in6_addr_t *v6addr)
+{
+	if ((ill->ill_capabilities & ILL_CAPAB_DLD_IPCHECK) == 0)
+		return (B_TRUE);
+
+	ill_dld_ipcheck_t *idi = &ill->ill_dld_capab->idc_ipcheck;
+	ip_mac_ipcheck_t ipcheck = idi->idi_allowed_df;
+	return (ipcheck(idi->idi_allowed_dh, ill->ill_isv6, v6addr));
+}
+
+static void
+ill_capability_ipcheck_enable(ill_t *ill)
+{
+	ill_dld_capab_t		*idc = ill->ill_dld_capab;
+	ill_dld_ipcheck_t	*idi = &idc->idc_ipcheck;
+	dld_capab_ipcheck_t	spoof;
+	int rc;
+
+	ASSERT(IAM_WRITER_ILL(ill));
+
+	bzero(&spoof, sizeof (spoof));
+	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_IPCHECK,
+	    &spoof, DLD_ENABLE)) == 0) {
+		idi->idi_allowed_df = (ip_mac_ipcheck_t)spoof.ipc_allowed_df;
+		idi->idi_allowed_dh = spoof.ipc_allowed_dh;
+		ill->ill_capabilities |= ILL_CAPAB_DLD_IPCHECK;
+	} else {
+		cmn_err(CE_WARN, "warning: could not enable IPCHECK "
+		    "capability, rc = %d\n", rc);
+		DTRACE_PROBE2(ipcheck__off, (ill_t *), ill, (int), rc);
+	}
+}
+
 static void
 ill_capability_dld_enable(ill_t *ill)
 {
@@ -2115,15 +2172,15 @@ ill_capability_dld_enable(ill_t *ill)
 
 	ASSERT(IAM_WRITER_ILL(ill));
 
-	if (ill->ill_isv6)
-		return;
-
 	ill_mac_perim_enter(ill, &mph);
 	if (!ill->ill_isv6) {
 		ill_capability_direct_enable(ill);
 		ill_capability_poll_enable(ill);
 		ill_capability_lso_enable(ill);
 	}
+
+	ill_capability_ipcheck_enable(ill);
+
 	ill->ill_capabilities |= ILL_CAPAB_DLD;
 	ill_mac_perim_exit(ill, mph);
 }
@@ -2188,6 +2245,15 @@ ill_capability_dld_disable(ill_t *ill)
 		    NULL, DLD_DISABLE);
 	}
 
+	if ((ill->ill_capabilities & ILL_CAPAB_DLD_IPCHECK) != 0) {
+		ASSERT(ill->ill_dld_capab->idc_ipcheck.idi_allowed_df != NULL);
+		ASSERT(ill->ill_dld_capab->idc_ipcheck.idi_allowed_dh != NULL);
+
+		ill->ill_capabilities &= ~ILL_CAPAB_DLD_IPCHECK;
+		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_IPCHECK,
+		    NULL, DLD_DISABLE);
+	}
+
 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
 	ill_mac_perim_exit(ill, mph);
 }
@@ -3429,6 +3495,9 @@ ill_init_common(ill_t *ill, queue_t *q, boolean_t isv6, boolean_t is_loopback,
 	ill->ill_max_buf = ND_MAX_Q;
 	ill->ill_refcnt = 0;
 
+	cv_init(&ill->ill_dlpi_capab_cv, NULL, NULL, NULL);
+	mutex_init(&ill->ill_dlpi_capab_lock, NULL, MUTEX_DEFAULT, NULL);
+
 	return (0);
 }
 
@@ -9676,7 +9745,6 @@ ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
 	in6_addr_t v6addr;
 	boolean_t need_up = B_FALSE;
 	ill_t *ill;
-	int i;
 
 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
@@ -9751,20 +9819,9 @@ ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
 
 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
 	}
-	/*
-	 * verify that the address being configured is permitted by the
-	 * ill_allowed_ips[] for the interface.
-	 */
-	if (ill->ill_allowed_ips_cnt > 0) {
-		for (i = 0; i < ill->ill_allowed_ips_cnt; i++) {
-			if (IN6_ARE_ADDR_EQUAL(&ill->ill_allowed_ips[i],
-			    &v6addr))
-				break;
-		}
-		if (i == ill->ill_allowed_ips_cnt) {
-			pr_addr_dbg("!allowed addr %s\n", AF_INET6, &v6addr);
-			return (EPERM);
-		}
+	/* verify that the address being configured is permitted by mac */
+	if (!ill_ipcheck_addr(ill, &v6addr)) {
+		return (EPERM);
 	}
 	/*
 	 * Even if there is no change we redo things just to rerun
@@ -12704,6 +12761,12 @@ ill_dl_down(ill_t *ill)
 	}
 
 	ill->ill_unbind_mp = NULL;
+
+	mutex_enter(&ill->ill_lock);
+	ill->ill_dl_up = 0;
+	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
+	mutex_exit(&ill->ill_lock);
+
 	if (mp != NULL) {
 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
@@ -12726,11 +12789,10 @@ ill_dl_down(ill_t *ill)
 			ill_capability_dld_disable(ill);
 		ill_capability_reset(ill, B_FALSE);
 		ill_dlpi_send(ill, mp);
+
+		/* Wait for the capability reset to finish */
+		ill_capability_wait(ill);
 	}
-	mutex_enter(&ill->ill_lock);
-	ill->ill_dl_up = 0;
-	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
-	mutex_exit(&ill->ill_lock);
 }
 
 void
@@ -12859,6 +12921,10 @@ ill_capability_done(ill_t *ill)
 	if (ill->ill_capab_pending_cnt == 0 &&
 	    ill->ill_dlpi_capab_state == IDCS_OK)
 		ill_capability_reset_alloc(ill);
+
+	mutex_enter(&ill->ill_dlpi_capab_lock);
+	cv_broadcast(&ill->ill_dlpi_capab_cv);
+	mutex_exit(&ill->ill_dlpi_capab_lock);
 }
 
 /*
@@ -14480,7 +14546,14 @@ ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
 			 * address/netmask etc cause a down/up dance, but
 			 * does not cause an unbind (DL_UNBIND) with the driver
 			 */
-			return (ill_dl_up(ill, ipif, mp, q));
+			if ((err = ill_dl_up(ill, ipif)) != 0) {
+				return (err);
+			}
+		}
+
+		/* Reject bringing up interfaces with unusable IP addresses */
+		if (!ill_ipcheck_addr(ill, &ipif->ipif_v6lcl_addr)) {
+			return (EPERM);
 		}
 
 		/*
@@ -14593,24 +14666,22 @@ ill_delete_ires(ill_t *ill)
 
 /*
  * Perform a bind for the physical device.
- * When the routine returns EINPROGRESS then mp has been consumed and
- * the ioctl will be acked from ip_rput_dlpi.
- * Allocate an unbind message and save it until ipif_down.
+ *
+ * When the routine returns successfully then dlpi has been bound and
+ * capabilities negotiated. An unbind message will have been allocated
+ * for later use in ipif_down.
  */
 static int
-ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
+ill_dl_up(ill_t *ill, ipif_t *ipif)
 {
 	mblk_t	*bind_mp = NULL;
 	mblk_t	*unbind_mp = NULL;
-	conn_t	*connp;
-	boolean_t success;
 	int	err;
 
 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_up", ill_t *, ill);
 
 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
 	ASSERT(IAM_WRITER_ILL(ill));
-	ASSERT(mp != NULL);
 
 	/*
 	 * Make sure we have an IRE_MULTICAST in case we immediately
@@ -14645,19 +14716,6 @@ ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
 		if (unbind_mp == NULL)
 			goto bad;
 	}
-	/*
-	 * Record state needed to complete this operation when the
-	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
-	 */
-	connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
-	ASSERT(connp != NULL || !CONN_Q(q));
-	GRAB_CONN_LOCK(q);
-	mutex_enter(&ipif->ipif_ill->ill_lock);
-	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
-	mutex_exit(&ipif->ipif_ill->ill_lock);
-	RELEASE_CONN_LOCK(q);
-	if (!success)
-		goto bad;
 
 	/*
 	 * Save the unbind message for ill_dl_down(); it will be consumed when
@@ -14669,6 +14727,13 @@ ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
 	ill_dlpi_send(ill, bind_mp);
 	/* Send down link-layer capabilities probe if not already done. */
 	ill_capability_probe(ill);
+	/* Wait for DLPI to be bound and the capability probe to finish */
+	ill_capability_wait(ill);
+
+	/* DLPI failed to bind. Return the saved error */
+	if (!ill->ill_dl_up) {
+		return (ill->ill_dl_bind_err);
+	}
 
 	/*
 	 * Sysid used to rely on the fact that netboots set domainname
@@ -14686,11 +14751,7 @@ ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
 			cmn_err(CE_WARN, "no cached dhcp response");
 	}
 
-	/*
-	 * This operation will complete in ip_rput_dlpi with either
-	 * a DL_BIND_ACK or DL_ERROR_ACK.
-	 */
-	return (EINPROGRESS);
+	return (0);
 bad:
 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
 
diff --git a/usr/src/uts/common/inet/ip/ip_input.c b/usr/src/uts/common/inet/ip/ip_input.c
index 6aa70b014a..88f80a926b 100644
--- a/usr/src/uts/common/inet/ip/ip_input.c
+++ b/usr/src/uts/common/inet/ip/ip_input.c
@@ -23,6 +23,7 @@
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
  *
  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -146,11 +147,9 @@ static void	ip_input_multicast_v4(ire_t *, mblk_t *, ipha_t *,
  * The ill will always be valid if this function is called directly from
  * the driver.
  *
- * If ip_input() is called from GLDv3:
- *
- *   - This must be a non-VLAN IP stream.
- *   - 'mp' is either an untagged or a special priority-tagged packet.
- *   - Any VLAN tag that was in the MAC header has been stripped.
+ * If this chain is part of a VLAN stream, then the VLAN tag is
+ * stripped from the MAC header before being delivered to this
+ * function.
  *
  * If the IP header in packet is not 32-bit aligned, every message in the
  * chain will be aligned before further operations. This is required on SPARC
diff --git a/usr/src/uts/common/inet/ip/ip_output.c b/usr/src/uts/common/inet/ip/ip_output.c
index ea69412933..169859707e 100644
--- a/usr/src/uts/common/inet/ip/ip_output.c
+++ b/usr/src/uts/common/inet/ip/ip_output.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -1737,6 +1738,13 @@ ip_output_cksum_v4(iaflags_t ixaflags, mblk_t *mp, ipha_t *ipha,
 #endif
 			sctph->sh_chksum = sctp_cksum(mp, ip_hdr_length);
 		goto ip_hdr_cksum;
+	} else if (protocol == IPPROTO_ICMP) {
+		/*
+		 * Note that we always calculate a SW checksum for ICMP. In the
+		 * future, if HW support for ICMP is advertised, we can change
+		 * this.
+		 */
+		return (ip_output_sw_cksum_v4(mp, ipha, ixa));
 	} else {
 	ip_hdr_cksum:
 		/* Calculate IPv4 header checksum */
diff --git a/usr/src/uts/common/inet/ip/ip_squeue.c b/usr/src/uts/common/inet/ip/ip_squeue.c
index 33a2fa5935..3fb27abfbe 100644
--- a/usr/src/uts/common/inet/ip/ip_squeue.c
+++ b/usr/src/uts/common/inet/ip/ip_squeue.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -101,10 +102,6 @@
  *
  * ip_squeue_fanout can be accessed and changed using ndd on /dev/tcp or
  * /dev/ip.
- *
- * ip_squeue_worker_wait: global value for the sq_wait field for all squeues *
- * created. This is the time squeue code waits before waking up the worker
- * thread after queuing a request.
  */
 
 #include <sys/types.h>
@@ -142,13 +139,6 @@ kmutex_t		sqset_lock;
 
 static void (*ip_squeue_create_callback)(squeue_t *) = NULL;
 
-/*
- * ip_squeue_worker_wait: global value for the sq_wait field for all squeues
- *	created. This is the time squeue code waits before waking up the worker
- *	thread after queuing a request.
- */
-uint_t ip_squeue_worker_wait = 10;
-
 static squeue_t *ip_squeue_create(pri_t);
 static squeue_set_t *ip_squeue_set_create(processorid_t);
 static int ip_squeue_cpu_setup(cpu_setup_t, int, void *);
@@ -163,7 +153,7 @@ ip_squeue_create(pri_t pri)
 {
 	squeue_t *sqp;
 
-	sqp = squeue_create(ip_squeue_worker_wait, pri);
+	sqp = squeue_create(pri, B_TRUE);
 	ASSERT(sqp != NULL);
 	if (ip_squeue_create_callback != NULL)
 		ip_squeue_create_callback(sqp);
diff --git a/usr/src/uts/common/inet/ip/ipclassifier.c b/usr/src/uts/common/inet/ip/ipclassifier.c
index bc2173ff24..a59027801f 100644
--- a/usr/src/uts/common/inet/ip/ipclassifier.c
+++ b/usr/src/uts/common/inet/ip/ipclassifier.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
@@ -868,67 +869,91 @@ ipcl_hash_remove_locked(conn_t *connp, connf_t	*connfp)
 	mutex_exit(&(connfp)->connf_lock);				\
 }
 
-#define	IPCL_HASH_INSERT_BOUND(connfp, connp) {				\
-	conn_t *pconnp = NULL, *nconnp;					\
-	IPCL_HASH_REMOVE((connp));					\
-	mutex_enter(&(connfp)->connf_lock);				\
-	nconnp = (connfp)->connf_head;					\
-	while (nconnp != NULL &&					\
-	    !_IPCL_V4_MATCH_ANY(nconnp->conn_laddr_v6)) {		\
-		pconnp = nconnp;					\
-		nconnp = nconnp->conn_next;				\
-	}								\
-	if (pconnp != NULL) {						\
-		pconnp->conn_next = (connp);				\
-		(connp)->conn_prev = pconnp;				\
-	} else {							\
-		(connfp)->connf_head = (connp);				\
-	}								\
-	if (nconnp != NULL) {						\
-		(connp)->conn_next = nconnp;				\
-		nconnp->conn_prev = (connp);				\
-	}								\
-	(connp)->conn_fanout = (connfp);				\
-	(connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) |	\
-	    IPCL_BOUND;							\
-	CONN_INC_REF(connp);						\
-	mutex_exit(&(connfp)->connf_lock);				\
-}
+/*
+ * When inserting bound or wildcard entries into the hash, ordering rules are
+ * used to facilitate timely and correct lookups.  The order is as follows:
+ * 1. Entries bound to a specific address
+ * 2. Entries bound to INADDR_ANY
+ * 3. Entries bound to ADDR_UNSPECIFIED
+ * Entries in a category which share conn_lport (such as those using
+ * SO_REUSEPORT) will be ordered such that the newest inserted is first.
+ */
 
-#define	IPCL_HASH_INSERT_WILDCARD(connfp, connp) {			\
-	conn_t **list, *prev, *next;					\
-	boolean_t isv4mapped =						\
-	    IN6_IS_ADDR_V4MAPPED(&(connp)->conn_laddr_v6);		\
-	IPCL_HASH_REMOVE((connp));					\
-	mutex_enter(&(connfp)->connf_lock);				\
-	list = &(connfp)->connf_head;					\
-	prev = NULL;							\
-	while ((next = *list) != NULL) {				\
-		if (isv4mapped &&					\
-		    IN6_IS_ADDR_UNSPECIFIED(&next->conn_laddr_v6) &&	\
-		    connp->conn_zoneid == next->conn_zoneid) {		\
-			(connp)->conn_next = next;			\
-			if (prev != NULL)				\
-				prev = next->conn_prev;			\
-			next->conn_prev = (connp);			\
-			break;						\
-		}							\
-		list = &next->conn_next;				\
-		prev = next;						\
-	}								\
-	(connp)->conn_prev = prev;					\
-	*list = (connp);						\
-	(connp)->conn_fanout = (connfp);				\
-	(connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) |	\
-	    IPCL_BOUND;							\
-	CONN_INC_REF((connp));						\
-	mutex_exit(&(connfp)->connf_lock);				\
+void
+ipcl_hash_insert_bound(connf_t *connfp, conn_t *connp)
+{
+	conn_t *pconnp, *nconnp;
+
+	IPCL_HASH_REMOVE(connp);
+	mutex_enter(&connfp->connf_lock);
+	nconnp = connfp->connf_head;
+	pconnp = NULL;
+	while (nconnp != NULL) {
+		/*
+		 * Walk though entries associated with the fanout until one is
+		 * found which fulfills any of these conditions:
+		 * 1. Listen address of ADDR_ANY/ADDR_UNSPECIFIED
+		 * 2. Listen port the same as connp
+		 */
+		if (_IPCL_V4_MATCH_ANY(nconnp->conn_laddr_v6) ||
+		    connp->conn_lport == nconnp->conn_lport)
+			break;
+		pconnp = nconnp;
+		nconnp = nconnp->conn_next;
+	}
+	if (pconnp != NULL) {
+		pconnp->conn_next = connp;
+		connp->conn_prev = pconnp;
+	} else {
+		connfp->connf_head = connp;
+	}
+	if (nconnp != NULL) {
+		connp->conn_next = nconnp;
+		nconnp->conn_prev = connp;
+	}
+	connp->conn_fanout = connfp;
+	connp->conn_flags = (connp->conn_flags & ~IPCL_REMOVED) | IPCL_BOUND;
+	CONN_INC_REF(connp);
+	mutex_exit(&connfp->connf_lock);
 }
 
 void
 ipcl_hash_insert_wildcard(connf_t *connfp, conn_t *connp)
 {
-	IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+	conn_t **list, *prev, *next;
+	conn_t *pconnp = NULL, *nconnp;
+	boolean_t isv4mapped = IN6_IS_ADDR_V4MAPPED(&connp->conn_laddr_v6);
+
+	IPCL_HASH_REMOVE(connp);
+	mutex_enter(&connfp->connf_lock);
+	nconnp = connfp->connf_head;
+	pconnp = NULL;
+	while (nconnp != NULL) {
+		if (IN6_IS_ADDR_V4MAPPED_ANY(&nconnp->conn_laddr_v6) &&
+		    isv4mapped && connp->conn_lport == nconnp->conn_lport)
+			break;
+		if (IN6_IS_ADDR_UNSPECIFIED(&nconnp->conn_laddr_v6) &&
+		    (isv4mapped ||
+		    connp->conn_lport == nconnp->conn_lport))
+			break;
+
+		pconnp = nconnp;
+		nconnp = nconnp->conn_next;
+	}
+	if (pconnp != NULL) {
+		pconnp->conn_next = connp;
+		connp->conn_prev = pconnp;
+	} else {
+		connfp->connf_head = connp;
+	}
+	if (nconnp != NULL) {
+		connp->conn_next = nconnp;
+		nconnp->conn_prev = connp;
+	}
+	connp->conn_fanout = connfp;
+	connp->conn_flags = (connp->conn_flags & ~IPCL_REMOVED) | IPCL_BOUND;
+	CONN_INC_REF(connp);
+	mutex_exit(&connfp->connf_lock);
 }
 
 /*
@@ -1034,9 +1059,9 @@ ipcl_sctp_hash_insert(conn_t *connp, in_port_t lport)
 	    IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
 		if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6) ||
 		    IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_laddr_v6)) {
-			IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+			ipcl_hash_insert_wildcard(connfp, connp);
 		} else {
-			IPCL_HASH_INSERT_BOUND(connfp, connp);
+			ipcl_hash_insert_bound(connfp, connp);
 		}
 	} else {
 		IPCL_HASH_INSERT_CONNECTED(connfp, connp);
@@ -1205,9 +1230,9 @@ ipcl_bind_insert_v4(conn_t *connp)
 		if (connp->conn_faddr_v4 != INADDR_ANY) {
 			IPCL_HASH_INSERT_CONNECTED(connfp, connp);
 		} else if (connp->conn_laddr_v4 != INADDR_ANY) {
-			IPCL_HASH_INSERT_BOUND(connfp, connp);
+			ipcl_hash_insert_bound(connfp, connp);
 		} else {
-			IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+			ipcl_hash_insert_wildcard(connfp, connp);
 		}
 		if (protocol == IPPROTO_RSVP)
 			ill_set_inputfn_all(ipst);
@@ -1219,9 +1244,9 @@ ipcl_bind_insert_v4(conn_t *connp)
 		connfp = &ipst->ips_ipcl_bind_fanout[
 		    IPCL_BIND_HASH(lport, ipst)];
 		if (connp->conn_laddr_v4 != INADDR_ANY) {
-			IPCL_HASH_INSERT_BOUND(connfp, connp);
+			ipcl_hash_insert_bound(connfp, connp);
 		} else {
-			IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+			ipcl_hash_insert_wildcard(connfp, connp);
 		}
 		if (cl_inet_listen != NULL) {
 			ASSERT(connp->conn_ipversion == IPV4_VERSION);
@@ -1271,9 +1296,9 @@ ipcl_bind_insert_v6(conn_t *connp)
 		if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6)) {
 			IPCL_HASH_INSERT_CONNECTED(connfp, connp);
 		} else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
-			IPCL_HASH_INSERT_BOUND(connfp, connp);
+			ipcl_hash_insert_bound(connfp, connp);
 		} else {
-			IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+			ipcl_hash_insert_wildcard(connfp, connp);
 		}
 		break;
 
@@ -1283,9 +1308,9 @@ ipcl_bind_insert_v6(conn_t *connp)
 		connfp = &ipst->ips_ipcl_bind_fanout[
 		    IPCL_BIND_HASH(lport, ipst)];
 		if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
-			IPCL_HASH_INSERT_BOUND(connfp, connp);
+			ipcl_hash_insert_bound(connfp, connp);
 		} else {
-			IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+			ipcl_hash_insert_wildcard(connfp, connp);
 		}
 		if (cl_inet_listen != NULL) {
 			sa_family_t	addr_family;
@@ -1416,9 +1441,9 @@ ipcl_conn_insert_v4(conn_t *connp)
 		if (connp->conn_faddr_v4 != INADDR_ANY) {
 			IPCL_HASH_INSERT_CONNECTED(connfp, connp);
 		} else if (connp->conn_laddr_v4 != INADDR_ANY) {
-			IPCL_HASH_INSERT_BOUND(connfp, connp);
+			ipcl_hash_insert_bound(connfp, connp);
 		} else {
-			IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+			ipcl_hash_insert_wildcard(connfp, connp);
 		}
 		break;
 	}
@@ -1504,9 +1529,9 @@ ipcl_conn_insert_v6(conn_t *connp)
 		if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6)) {
 			IPCL_HASH_INSERT_CONNECTED(connfp, connp);
 		} else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
-			IPCL_HASH_INSERT_BOUND(connfp, connp);
+			ipcl_hash_insert_bound(connfp, connp);
 		} else {
-			IPCL_HASH_INSERT_WILDCARD(connfp, connp);
+			ipcl_hash_insert_wildcard(connfp, connp);
 		}
 		break;
 	}
@@ -2092,6 +2117,7 @@ rawip_conn_constructor(void *buf, void *cdrarg, int kmflags)
 	connp->conn_flags = IPCL_RAWIPCONN;
 	connp->conn_proto = IPPROTO_ICMP;
 	icmp->icmp_connp = connp;
+	rw_init(&icmp->icmp_bpf_lock, NULL, RW_DEFAULT, NULL);
 	rw_init(&connp->conn_ilg_lock, NULL, RW_DEFAULT, NULL);
 	connp->conn_ixa = kmem_zalloc(sizeof (ip_xmit_attr_t), kmflags);
 	if (connp->conn_ixa == NULL)
@@ -2116,6 +2142,7 @@ rawip_conn_destructor(void *buf, void *cdrarg)
 	mutex_destroy(&connp->conn_lock);
 	cv_destroy(&connp->conn_cv);
 	rw_destroy(&connp->conn_ilg_lock);
+	rw_destroy(&icmp->icmp_bpf_lock);
 
 	/* Can be NULL if constructor failed */
 	if (connp->conn_ixa != NULL) {
diff --git a/usr/src/uts/common/inet/ip/sadb.c b/usr/src/uts/common/inet/ip/sadb.c
index 40d5078526..44ebb21db3 100644
--- a/usr/src/uts/common/inet/ip/sadb.c
+++ b/usr/src/uts/common/inet/ip/sadb.c
@@ -3767,7 +3767,8 @@ sadb_expire_assoc(queue_t *pfkey_q, ipsa_t *assoc)
 	}
 
 	alloclen = sizeof (*samsg) + sizeof (*current) + sizeof (*expire) +
-	    2 * sizeof (sadb_address_t) + sizeof (*saext);
+	    2 * sizeof (sadb_address_t) + sizeof (*saext) +
+	    sizeof (sadb_x_kmc_t);
 
 	af = assoc->ipsa_addrfam;
 	switch (af) {
@@ -3896,6 +3897,10 @@ sadb_expire_assoc(queue_t *pfkey_q, ipsa_t *assoc)
 		ASSERT(mp->b_wptr != NULL);
 	}
 
+	mp->b_wptr = sadb_make_kmc_ext(mp->b_wptr, end, assoc->ipsa_kmp,
+	    assoc->ipsa_kmc);
+	ASSERT(mp->b_wptr != NULL);
+
 	/* Can just putnext, we're ready to go! */
 	putnext(pfkey_q, mp1);
 }
diff --git a/usr/src/uts/common/inet/ipclassifier.h b/usr/src/uts/common/inet/ipclassifier.h
index f6466434f6..c3139d9288 100644
--- a/usr/src/uts/common/inet/ipclassifier.h
+++ b/usr/src/uts/common/inet/ipclassifier.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_INET_IPCLASSIFIER_H
@@ -293,7 +294,8 @@ struct conn_s {
 		conn_ipv6_recvpathmtu : 1,	/* IPV6_RECVPATHMTU */
 		conn_mcbc_bind : 1,		/* Bound to multi/broadcast */
 
-		conn_pad_to_bit_31 : 12;
+		conn_reuseport : 1,		/* SO_REUSEPORT state */
+		conn_pad_to_bit_31 : 11;
 
 	boolean_t	conn_blocked;		/* conn is flow-controlled */
 
diff --git a/usr/src/uts/common/inet/ipd/ipd.c b/usr/src/uts/common/inet/ipd/ipd.c
index 553c215984..747a7a814f 100644
--- a/usr/src/uts/common/inet/ipd/ipd.c
+++ b/usr/src/uts/common/inet/ipd/ipd.c
@@ -9,7 +9,7 @@
  * http://www.illumos.org/license/CDDL.
  */
 /*
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc. All rights reserved.
  */
 
 /*
@@ -222,7 +222,7 @@ typedef struct ipd_netstack {
 	net_handle_t	ipdn_v6hdl;		/* IPv4 net handle */
 	int		ipdn_hooked;		/* are hooks registered */
 	hook_t		*ipdn_v4in;		/* IPv4 traffic in hook */
-	hook_t		*ipdn_v4out;		/* IPv4 traffice out hook */
+	hook_t		*ipdn_v4out;		/* IPv4 traffic out hook */
 	hook_t		*ipdn_v6in;		/* IPv6 traffic in hook */
 	hook_t		*ipdn_v6out;		/* IPv6 traffic out hook */
 	int		ipdn_enabled;		/* which perturbs are on */
@@ -613,7 +613,7 @@ ipd_toggle_delay(ipd_netstack_t *ins, uint32_t delay)
 	/*
 	 * If ipd_check_hooks_failed, that must mean that we failed to set up
 	 * the hooks, so we are going to effectively zero out and fail the
-	 * request to enable corruption.
+	 * request to enable packet delays.
 	 */
 	if (rval != 0)
 		ins->ipdn_delay = 0;
diff --git a/usr/src/uts/common/inet/ipf/ip_fil_solaris.c b/usr/src/uts/common/inet/ipf/ip_fil_solaris.c
index f958ca2261..1d8247e52a 100644
--- a/usr/src/uts/common/inet/ipf/ip_fil_solaris.c
+++ b/usr/src/uts/common/inet/ipf/ip_fil_solaris.c
@@ -5,7 +5,7 @@
  *
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  *
- * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #if !defined(lint)
@@ -27,6 +27,7 @@ static const char rcsid[] = "@(#)$Id: ip_fil_solaris.c,v 2.62.2.19 2005/07/13 21
 #include <sys/sunddi.h>
 #include <sys/ksynch.h>
 #include <sys/kmem.h>
+#include <sys/mac_provider.h>
 #include <sys/mkdev.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
@@ -83,6 +84,14 @@ static	int	ipf_hook6_loop_out __P((hook_event_token_t, hook_data_t,
 static	int	ipf_hook6_loop_in __P((hook_event_token_t, hook_data_t,
     void *));
 static	int     ipf_hook6 __P((hook_data_t, int, int, void *));
+static	int	ipf_hookvndl3v4_in __P((hook_event_token_t, hook_data_t,
+    void *));
+static	int	ipf_hookvndl3v6_in __P((hook_event_token_t, hook_data_t,
+    void *));
+static	int	ipf_hookvndl3v4_out __P((hook_event_token_t, hook_data_t,
+    void *));
+static	int	ipf_hookvndl3v6_out __P((hook_event_token_t, hook_data_t,
+    void *));
 extern	int	ipf_geniter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
 extern	int	ipf_frruleiter __P((void *, int, void *, ipf_stack_t *));
 
@@ -152,6 +161,16 @@ char *hook6_loop_in_gz = 	"ipfilter_hook6_loop_in_gz";
 char *hook6_loop_out = 		"ipfilter_hook6_loop_out";
 char *hook6_loop_out_gz = 	"ipfilter_hook6_loop_out_gz";
 
+/* vnd IPv4/v6 hook names */
+char *hook4_vnd_in =		"ipfilter_hookvndl3v4_in";
+char *hook4_vnd_in_gz =		"ipfilter_hookvndl3v4_in_gz";
+char *hook6_vnd_in =		"ipfilter_hookvndl3v6_in";
+char *hook6_vnd_in_gz =		"ipfilter_hookvndl3v6_in_gz";
+char *hook4_vnd_out =		"ipfilter_hookvndl3v4_out";
+char *hook4_vnd_out_gz =	"ipfilter_hookvndl3v4_out_gz";
+char *hook6_vnd_out =		"ipfilter_hookvndl3v6_out";
+char *hook6_vnd_out_gz =	"ipfilter_hookvndl3v6_out_gz";
+
 /* ------------------------------------------------------------------------ */
 /* Function:    ipldetach                                                   */
 /* Returns:     int - 0 == success, else error.                             */
@@ -248,6 +267,31 @@ ipf_stack_t *ifs;
 		ifs->ifs_ipf_ipv4 = NULL;
 	}
 
+	/*
+	 * Remove VND hooks
+	 */
+	if (ifs->ifs_ipf_vndl3v4 != NULL) {
+		UNDO_HOOK(ifs_ipf_vndl3v4, ifs_hookvndl3v4_physical_in,
+		    NH_PHYSICAL_IN, ifs_ipfhookvndl3v4_in);
+		UNDO_HOOK(ifs_ipf_vndl3v4, ifs_hookvndl3v4_physical_out,
+		    NH_PHYSICAL_OUT, ifs_ipfhookvndl3v4_out);
+
+		if (net_protocol_release(ifs->ifs_ipf_vndl3v4) != 0)
+			goto detach_failed;
+		ifs->ifs_ipf_vndl3v4 = NULL;
+	}
+
+	if (ifs->ifs_ipf_vndl3v6 != NULL) {
+		UNDO_HOOK(ifs_ipf_vndl3v6, ifs_hookvndl3v6_physical_in,
+		    NH_PHYSICAL_IN, ifs_ipfhookvndl3v6_in);
+		UNDO_HOOK(ifs_ipf_vndl3v6, ifs_hookvndl3v6_physical_out,
+		    NH_PHYSICAL_OUT, ifs_ipfhookvndl3v6_out);
+
+		if (net_protocol_release(ifs->ifs_ipf_vndl3v6) != 0)
+			goto detach_failed;
+		ifs->ifs_ipf_vndl3v6 = NULL;
+	}
+
 #undef UNDO_HOOK
 
 #ifdef	IPFDEBUG
@@ -445,6 +489,48 @@ ipf_stack_t *ifs;
 	}
 
 	/*
+	 * Add VND INET hooks
+	 */
+	ifs->ifs_ipf_vndl3v4 = net_protocol_lookup(id, NHF_VND_INET);
+	if (ifs->ifs_ipf_vndl3v4 == NULL)
+		goto hookup_failed;
+
+	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhookvndl3v4_in, ipf_hookvndl3v4_in,
+	    hook4_vnd_in, hook4_vnd_in_gz, ifs);
+	HOOK_INIT_GZ_AFTER(ifs->ifs_ipfhookvndl3v4_out, ipf_hookvndl3v4_out,
+	    hook4_vnd_out, hook4_vnd_out_gz, ifs);
+	ifs->ifs_hookvndl3v4_physical_in = (net_hook_register(ifs->ifs_ipf_vndl3v4,
+	    NH_PHYSICAL_IN, ifs->ifs_ipfhookvndl3v4_in) == 0);
+	if (!ifs->ifs_hookvndl3v4_physical_in)
+		goto hookup_failed;
+
+	ifs->ifs_hookvndl3v4_physical_out = (net_hook_register(ifs->ifs_ipf_vndl3v4,
+	    NH_PHYSICAL_OUT, ifs->ifs_ipfhookvndl3v4_out) == 0);
+	if (!ifs->ifs_hookvndl3v4_physical_out)
+		goto hookup_failed;
+
+
+	/*
+	 * VND INET6 hooks
+	 */
+	ifs->ifs_ipf_vndl3v6 = net_protocol_lookup(id, NHF_VND_INET6);
+	if (ifs->ifs_ipf_vndl3v6 == NULL)
+		goto hookup_failed;
+
+	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhookvndl3v6_in, ipf_hookvndl3v6_in,
+	    hook6_vnd_in, hook6_vnd_in_gz, ifs);
+	HOOK_INIT_GZ_AFTER(ifs->ifs_ipfhookvndl3v6_out, ipf_hookvndl3v6_out,
+	    hook6_vnd_out, hook6_vnd_out_gz, ifs);
+	ifs->ifs_hookvndl3v6_physical_in = (net_hook_register(ifs->ifs_ipf_vndl3v6,
+	    NH_PHYSICAL_IN, ifs->ifs_ipfhookvndl3v6_in) == 0);
+	if (!ifs->ifs_hookvndl3v6_physical_in)
+		goto hookup_failed;
+
+	ifs->ifs_hookvndl3v6_physical_out = (net_hook_register(ifs->ifs_ipf_vndl3v6,
+	    NH_PHYSICAL_OUT, ifs->ifs_ipfhookvndl3v6_out) == 0);
+	if (!ifs->ifs_hookvndl3v6_physical_out)
+		goto hookup_failed;
+	/*
 	 * Reacquire ipf_global, now it is safe.
 	 */
 	WRITE_ENTER(&ifs->ifs_ipf_global);
@@ -1011,7 +1097,6 @@ cred_t *cp;
 		return ENXIO;
 	unit = isp->ipfs_minor;
 
-
         /*
 	 * ipf_find_stack returns with a read lock on ifs_ipf_global
 	 */
@@ -1715,8 +1800,7 @@ int len;
 		 * Need to preserve checksum information by copying them
 		 * to newmp which heads the pulluped message.
 		 */
-		hcksum_retrieve(m, NULL, NULL, &start, &stuff, &end,
-		    &value, &flags);
+		mac_hcksum_get(m, &start, &stuff, &end, &value, &flags);
 
 		if (pullupmsg(m, len + ipoff + inc) == 0) {
 			ATOMIC_INCL(ifs->ifs_frstats[out].fr_pull[1]);
@@ -1729,8 +1813,7 @@ int len;
 			return NULL;
 		}
 
-		(void) hcksum_assoc(m, NULL, NULL, start, stuff, end,
-		    value, flags, 0);
+		mac_hcksum_set(m, start, stuff, end, value, flags);
 
 		m->b_prev = m2;
 		m->b_rptr += inc;
@@ -1856,8 +1939,12 @@ frdest_t *fdp;
 		return (-1);
 	}
 
-	/* Check the src here, fin_ifp is the src interface. */
-	if (!fr_forwarding_enabled((phy_if_t)fin->fin_ifp, net_data_p))
+	/*
+	 * If we're forwarding (vs. injecting), check the src here, fin_ifp is
+	 * the src interface.
+	 */
+	if (fdp != NULL &&
+	   !fr_forwarding_enabled((phy_if_t)fin->fin_ifp, net_data_p))
 		return (-1);
 
 	inj = net_inject_alloc(NETINFO_VERSION);
@@ -1924,8 +2011,8 @@ frdest_t *fdp;
 		inj->ni_physical = net_routeto(net_data_p, sinp, NULL);
 	}
 
-	/* we're checking the destinatation here */
-	if (!fr_forwarding_enabled(inj->ni_physical, net_data_p))
+	/* If we're forwarding (vs. injecting), check the destinatation here. */
+	if (fdp != NULL && !fr_forwarding_enabled(inj->ni_physical, net_data_p))
 		goto bad_fastroute;
 
 	/*
@@ -2045,6 +2132,42 @@ int ipf_hook6_loop_out(hook_event_token_t token, hook_data_t info, void *arg)
 }
 
 /* ------------------------------------------------------------------------ */
+/* Function:    ipf_hookvndl3_in					    */
+/* Returns:     int - 0 == packet ok, else problem, free packet if not done */
+/* Parameters:  event(I)     - pointer to event                             */
+/*              info(I)      - pointer to hook information for firewalling  */
+/*                                                                          */
+/* The vnd hooks are private hooks to ON. They represents a layer 2         */
+/* datapath generally used to implement virtual machines. The driver sends  */
+/* along L3 packets of either type IP or IPv6. The ethertype to distinguish */
+/* them is in the upper 16 bits while the remaining bits are the            */
+/* traditional packet hook flags.                                           */
+/*                                                                          */
+/* They end up calling the appropriate traditional ip hooks.                */
+/* ------------------------------------------------------------------------ */
+/*ARGSUSED*/
+int ipf_hookvndl3v4_in(hook_event_token_t token, hook_data_t info, void *arg)
+{
+	return ipf_hook4_in(token, info, arg);
+}
+
+int ipf_hookvndl3v6_in(hook_event_token_t token, hook_data_t info, void *arg)
+{
+	return ipf_hook6_in(token, info, arg);
+}
+
+/*ARGSUSED*/
+int ipf_hookvndl3v4_out(hook_event_token_t token, hook_data_t info, void *arg)
+{
+	return ipf_hook4_out(token, info, arg);
+}
+
+int ipf_hookvndl3v6_out(hook_event_token_t token, hook_data_t info, void *arg)
+{
+	return ipf_hook6_out(token, info, arg);
+}
+
+/* ------------------------------------------------------------------------ */
 /* Function:    ipf_hook4_loop_in                                           */
 /* Returns:     int - 0 == packet ok, else problem, free packet if not done */
 /* Parameters:  event(I)     - pointer to event                             */
diff --git a/usr/src/uts/common/inet/ipf/ipf.conf b/usr/src/uts/common/inet/ipf/ipf.conf
index 6b36f9fdbf..f49e024a72 100644
--- a/usr/src/uts/common/inet/ipf/ipf.conf
+++ b/usr/src/uts/common/inet/ipf/ipf.conf
@@ -1,3 +1,8 @@
 #
 #
 name="ipf" parent="pseudo" instance=0;
+
+# Increase the state table limits. fr_statemax should be ~70% of fr_statesize,
+# and both should be prime numbers
+fr_statesize=151007;
+fr_statemax=113279;
diff --git a/usr/src/uts/common/inet/ipf/netinet/ipf_stack.h b/usr/src/uts/common/inet/ipf/netinet/ipf_stack.h
index a239f1c1ca..9aa2478c6a 100644
--- a/usr/src/uts/common/inet/ipf/netinet/ipf_stack.h
+++ b/usr/src/uts/common/inet/ipf/netinet/ipf_stack.h
@@ -125,6 +125,10 @@ struct ipf_stack {
 	hook_t		*ifs_ipfhook6_loop_in;
 	hook_t		*ifs_ipfhook6_loop_out;
 	hook_t		*ifs_ipfhook6_nicevents;
+	hook_t		*ifs_ipfhookvndl3v4_in;
+	hook_t		*ifs_ipfhookvndl3v6_in;
+	hook_t		*ifs_ipfhookvndl3v4_out;
+	hook_t		*ifs_ipfhookvndl3v6_out;
 
 	/* flags to indicate whether hooks are registered. */
 	boolean_t	ifs_hook4_physical_in;
@@ -137,10 +141,16 @@ struct ipf_stack {
 	boolean_t	ifs_hook6_nic_events;
 	boolean_t	ifs_hook6_loopback_in;
 	boolean_t	ifs_hook6_loopback_out;
+	boolean_t	ifs_hookvndl3v4_physical_in;
+	boolean_t	ifs_hookvndl3v6_physical_in;
+	boolean_t	ifs_hookvndl3v4_physical_out;
+	boolean_t	ifs_hookvndl3v6_physical_out;
 
 	int		ifs_ipf_loopback;
 	net_handle_t	ifs_ipf_ipv4;
 	net_handle_t	ifs_ipf_ipv6;
+	net_handle_t	ifs_ipf_vndl3v4;
+	net_handle_t	ifs_ipf_vndl3v6;
 
 	/* ip_auth.c */
 	int			ifs_fr_authsize;
diff --git a/usr/src/uts/common/inet/ipf/solaris.c b/usr/src/uts/common/inet/ipf/solaris.c
index c541f4dddc..5d56debc31 100644
--- a/usr/src/uts/common/inet/ipf/solaris.c
+++ b/usr/src/uts/common/inet/ipf/solaris.c
@@ -625,7 +625,6 @@ ipf_stack_shutdown(const netid_t id, void *arg)
 /*
  * Destroy things for ipf for one stack.
  */
-/* ARGSUSED */
 static void
 ipf_stack_destroy_one(const netid_t id, ipf_stack_t *ifs)
 {
diff --git a/usr/src/uts/common/inet/rawip_impl.h b/usr/src/uts/common/inet/rawip_impl.h
index 6fb72d1d08..ddb482db78 100644
--- a/usr/src/uts/common/inet/rawip_impl.h
+++ b/usr/src/uts/common/inet/rawip_impl.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -43,6 +44,7 @@ extern "C" {
 #include <inet/ip.h>
 #include <inet/optcom.h>
 #include <inet/tunables.h>
+#include <inet/bpf.h>
 
 /*
  * ICMP stack instances
@@ -84,6 +86,10 @@ typedef	struct icmp_s {
 	mblk_t		*icmp_fallback_queue_head;
 	mblk_t		*icmp_fallback_queue_tail;
 	struct sockaddr_storage	icmp_delayed_addr;
+
+	krwlock_t	icmp_bpf_lock;	/* protects icmp_bpf */
+	ip_bpf_insn_t	*icmp_bpf_prog; /* SO_ATTACH_FILTER bpf */
+	uint_t		icmp_bpf_len;
 } icmp_t;
 
 /*
diff --git a/usr/src/uts/common/inet/sockmods/datafilt.c b/usr/src/uts/common/inet/sockmods/datafilt.c
new file mode 100644
index 0000000000..6e1171de46
--- /dev/null
+++ b/usr/src/uts/common/inet/sockmods/datafilt.c
@@ -0,0 +1,116 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2012, OmniTI Computer Consulting, Inc. All rights reserved.
+ */
+
+/*
+ * This file implements a socketfilter used to deter TCP connections.
+ * To defer a connection means to delay the return of accept(3SOCKET)
+ * until at least one byte is ready to be read(2). This filter may be
+ * applied automatically or programmatically through the use of
+ * soconfig(1M) and setsockopt(3SOCKET).
+ */
+
+#include <sys/kmem.h>
+#include <sys/systm.h>
+#include <sys/stropts.h>
+#include <sys/strsun.h>
+#include <sys/socketvar.h>
+#include <sys/sockfilter.h>
+#include <sys/note.h>
+#include <sys/taskq.h>
+
+#define	DATAFILT_MODULE "datafilt"
+
+static struct modlmisc dataf_modlmisc = {
+	&mod_miscops,
+	"Kernel data-ready socket filter"
+};
+
+static struct modlinkage dataf_modlinkage = {
+	MODREV_1,
+	&dataf_modlmisc,
+	NULL
+};
+
+static sof_rval_t
+dataf_attach_passive_cb(sof_handle_t handle, sof_handle_t ph,
+    void *parg, struct sockaddr *laddr, socklen_t laddrlen,
+    struct sockaddr *faddr, socklen_t faddrlen, void **cookiep)
+{
+	_NOTE(ARGUNUSED(handle, ph, parg, laddr, laddrlen, faddr, faddrlen,
+	cookiep));
+	return (SOF_RVAL_DEFER);
+}
+
+static void
+dataf_detach_cb(sof_handle_t handle, void *cookie, cred_t *cr)
+{
+	_NOTE(ARGUNUSED(handle, cookie, cr));
+}
+
+static mblk_t *
+dataf_data_in_cb(sof_handle_t handle, void *cookie, mblk_t *mp, int flags,
+    size_t *lenp)
+{
+	_NOTE(ARGUNUSED(cookie, flags, lenp));
+
+	if (mp != NULL && MBLKL(mp) > 0) {
+		sof_newconn_ready(handle);
+		sof_bypass(handle);
+	}
+
+	return (mp);
+}
+
+static sof_ops_t dataf_ops = {
+	.sofop_attach_passive = dataf_attach_passive_cb,
+	.sofop_detach = dataf_detach_cb,
+	.sofop_data_in = dataf_data_in_cb
+};
+
+int
+_init(void)
+{
+	int err;
+
+	/*
+	 * This module is safe to attach even after some preliminary socket
+	 * setup calls have taken place. See the comment for SOF_ATT_SAFE.
+	 */
+	err = sof_register(SOF_VERSION, DATAFILT_MODULE, &dataf_ops,
+	    SOF_ATT_SAFE);
+	if (err != 0)
+		return (err);
+	if ((err = mod_install(&dataf_modlinkage)) != 0)
+		(void) sof_unregister(DATAFILT_MODULE);
+
+	return (err);
+}
+
+int
+_fini(void)
+{
+	int err;
+
+	if ((err = sof_unregister(DATAFILT_MODULE)) != 0)
+		return (err);
+
+	return (mod_remove(&dataf_modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&dataf_modlinkage, modinfop));
+}
diff --git a/usr/src/uts/common/inet/sockmods/sockmod_pfp.c b/usr/src/uts/common/inet/sockmods/sockmod_pfp.c
index 586d7f06f8..76191e93b8 100644
--- a/usr/src/uts/common/inet/sockmods/sockmod_pfp.c
+++ b/usr/src/uts/common/inet/sockmods/sockmod_pfp.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015 Joyent, Inc. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -51,6 +51,7 @@
 #include <sys/mac_client.h>
 #include <sys/mac_provider.h>
 #include <sys/mac_client_priv.h>
+#include <inet/bpf.h>
 
 #include <netpacket/packet.h>
 
@@ -448,7 +449,7 @@ pfp_packet(void *arg, mac_resource_handle_t mrh, mblk_t *mp, boolean_t flag)
 			buffer = (uchar_t *)mp;
 		}
 		rw_enter(&ps->ps_bpflock, RW_READER);
-		if (bpf_filter(ps->ps_bpf.bf_insns, buffer,
+		if (ip_bpf_filter((ip_bpf_insn_t *)ps->ps_bpf.bf_insns, buffer,
 		    hdr.mhi_pktsize, buflen) == 0) {
 			rw_exit(&ps->ps_bpflock);
 			ps->ps_stats.tp_drops++;
@@ -1336,7 +1337,7 @@ pfp_setsocket_sockopt(sock_lower_handle_t handle, int option_name,
     const void *optval, socklen_t optlen)
 {
 	struct bpf_program prog;
-	struct bpf_insn *fcode;
+	ip_bpf_insn_t *fcode;
 	struct pfpsock *ps;
 	struct sock_proto_props sopp;
 	int error = 0;
@@ -1370,10 +1371,10 @@ pfp_setsocket_sockopt(sock_lower_handle_t handle, int option_name,
 			return (EFAULT);
 		}
 
-		if (bpf_validate(fcode, (int)prog.bf_len)) {
+		if (ip_bpf_validate(fcode, prog.bf_len)) {
 			rw_enter(&ps->ps_bpflock, RW_WRITER);
 			pfp_release_bpf(ps);
-			ps->ps_bpf.bf_insns = fcode;
+			ps->ps_bpf.bf_insns = (struct bpf_insn *)fcode;
 			ps->ps_bpf.bf_len = size;
 			rw_exit(&ps->ps_bpflock);
 
diff --git a/usr/src/uts/common/inet/squeue.c b/usr/src/uts/common/inet/squeue.c
index 2e08dc359b..a1c0dbe697 100644
--- a/usr/src/uts/common/inet/squeue.c
+++ b/usr/src/uts/common/inet/squeue.c
@@ -23,7 +23,7 @@
  */
 
 /*
- * Copyright 2012 Joyent, Inc.  All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -61,6 +61,10 @@
  * connection are processed on that squeue. The connection ("conn") to
  * squeue mapping is stored in "conn_t" member "conn_sqp".
  *
+ * If the squeue is not related to TCP/IP, then the value of sqp->sq_isip is
+ * false and it will not have an associated conn_t, which means many aspects of
+ * the system, such as polling and swtiching squeues will not be used.
+ *
  * Since the processing of the connection cuts across multiple layers
  * but still allows packets for different connnection to be processed on
  * other CPU/squeues, squeues are also termed as "Vertical Perimeter" or
@@ -132,21 +136,20 @@
 
 #include <sys/squeue_impl.h>
 
-static void squeue_fire(void *);
 static void squeue_drain(squeue_t *, uint_t, hrtime_t);
 static void squeue_worker(squeue_t *sqp);
 static void squeue_polling_thread(squeue_t *sqp);
+static void squeue_worker_wakeup(squeue_t *sqp);
+static void squeue_try_drain_one(squeue_t *, conn_t *);
 
 kmem_cache_t *squeue_cache;
 
 #define	SQUEUE_MSEC_TO_NSEC 1000000
 
 int squeue_drain_ms = 20;
-int squeue_workerwait_ms = 0;
 
 /* The values above converted to ticks or nano seconds */
-static int squeue_drain_ns = 0;
-static int squeue_workerwait_tick = 0;
+static uint_t squeue_drain_ns = 0;
 
 uintptr_t squeue_drain_stack_needed = 10240;
 uint_t squeue_drain_stack_toodeep;
@@ -239,19 +242,16 @@ squeue_init(void)
 	    sizeof (squeue_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
 
 	squeue_drain_ns = squeue_drain_ms * SQUEUE_MSEC_TO_NSEC;
-	squeue_workerwait_tick = MSEC_TO_TICK_ROUNDUP(squeue_workerwait_ms);
 }
 
-/* ARGSUSED */
 squeue_t *
-squeue_create(clock_t wait, pri_t pri)
+squeue_create(pri_t pri, boolean_t isip)
 {
 	squeue_t *sqp = kmem_cache_alloc(squeue_cache, KM_SLEEP);
 
 	bzero(sqp, sizeof (squeue_t));
 	sqp->sq_bind = PBIND_NONE;
 	sqp->sq_priority = pri;
-	sqp->sq_wait = MSEC_TO_TICK(wait);
 	sqp->sq_worker = thread_create(NULL, 0, squeue_worker,
 	    sqp, 0, &p0, TS_RUN, pri);
 
@@ -260,11 +260,36 @@ squeue_create(clock_t wait, pri_t pri)
 
 	sqp->sq_enter = squeue_enter;
 	sqp->sq_drain = squeue_drain;
+	sqp->sq_isip = isip;
 
 	return (sqp);
 }
 
 /*
+ * We need to kill the threads and then clean up. We should VERIFY that
+ * polling is disabled so we don't have to worry about disassociating from
+ * MAC/IP/etc.
+ */
+void
+squeue_destroy(squeue_t *sqp)
+{
+	kt_did_t worker, poll;
+	mutex_enter(&sqp->sq_lock);
+	VERIFY(!(sqp->sq_state & (SQS_POLL_THR_QUIESCED |
+	    SQS_POLL_QUIESCE_DONE | SQS_PAUSE | SQS_EXIT)));
+	worker = sqp->sq_worker->t_did;
+	poll = sqp->sq_poll_thr->t_did;
+	sqp->sq_state |= SQS_EXIT;
+	cv_signal(&sqp->sq_poll_cv);
+	cv_signal(&sqp->sq_worker_cv);
+	mutex_exit(&sqp->sq_lock);
+
+	thread_join(poll);
+	thread_join(worker);
+	kmem_cache_free(squeue_cache, sqp);
+}
+
+/*
  * Bind squeue worker thread to the specified CPU, given by CPU id.
  * If the CPU id  value is -1, bind the worker thread to the value
  * specified in sq_bind field. If a thread is already bound to a
@@ -309,97 +334,6 @@ squeue_unbind(squeue_t *sqp)
 	mutex_exit(&sqp->sq_lock);
 }
 
-void
-squeue_worker_wakeup(squeue_t *sqp)
-{
-	timeout_id_t tid = (sqp)->sq_tid;
-
-	ASSERT(MUTEX_HELD(&(sqp)->sq_lock));
-
-	if (sqp->sq_wait == 0) {
-		ASSERT(tid == 0);
-		ASSERT(!(sqp->sq_state & SQS_TMO_PROG));
-		sqp->sq_awaken = ddi_get_lbolt();
-		cv_signal(&sqp->sq_worker_cv);
-		mutex_exit(&sqp->sq_lock);
-		return;
-	}
-
-	/*
-	 * Queue isn't being processed, so take
-	 * any post enqueue actions needed before leaving.
-	 */
-	if (tid != 0) {
-		/*
-		 * Waiting for an enter() to process mblk(s).
-		 */
-		clock_t now = ddi_get_lbolt();
-		clock_t	waited = now - sqp->sq_awaken;
-
-		if (TICK_TO_MSEC(waited) >= sqp->sq_wait) {
-			/*
-			 * Times up and have a worker thread
-			 * waiting for work, so schedule it.
-			 */
-			sqp->sq_tid = 0;
-			sqp->sq_awaken = now;
-			cv_signal(&sqp->sq_worker_cv);
-			mutex_exit(&sqp->sq_lock);
-			(void) untimeout(tid);
-			return;
-		}
-		mutex_exit(&sqp->sq_lock);
-		return;
-	} else if (sqp->sq_state & SQS_TMO_PROG) {
-		mutex_exit(&sqp->sq_lock);
-		return;
-	} else {
-		clock_t	wait = sqp->sq_wait;
-		/*
-		 * Wait up to sqp->sq_wait ms for an
-		 * enter() to process this queue. We
-		 * don't want to contend on timeout locks
-		 * with sq_lock held for performance reasons,
-		 * so drop the sq_lock before calling timeout
-		 * but we need to check if timeout is required
-		 * after re acquiring the sq_lock. Once
-		 * the sq_lock is dropped, someone else could
-		 * have processed the packet or the timeout could
-		 * have already fired.
-		 */
-		sqp->sq_state |= SQS_TMO_PROG;
-		mutex_exit(&sqp->sq_lock);
-		tid = timeout(squeue_fire, sqp, wait);
-		mutex_enter(&sqp->sq_lock);
-		/* Check again if we still need the timeout */
-		if (((sqp->sq_state & (SQS_PROC|SQS_TMO_PROG)) ==
-		    SQS_TMO_PROG) && (sqp->sq_tid == 0) &&
-		    (sqp->sq_first != NULL)) {
-				sqp->sq_state &= ~SQS_TMO_PROG;
-				sqp->sq_tid = tid;
-				mutex_exit(&sqp->sq_lock);
-				return;
-		} else {
-			if (sqp->sq_state & SQS_TMO_PROG) {
-				sqp->sq_state &= ~SQS_TMO_PROG;
-				mutex_exit(&sqp->sq_lock);
-				(void) untimeout(tid);
-			} else {
-				/*
-				 * The timer fired before we could
-				 * reacquire the sq_lock. squeue_fire
-				 * removes the SQS_TMO_PROG flag
-				 * and we don't need to	do anything
-				 * else.
-				 */
-				mutex_exit(&sqp->sq_lock);
-			}
-		}
-	}
-
-	ASSERT(MUTEX_NOT_HELD(&sqp->sq_lock));
-}
-
 /*
  * squeue_enter() - enter squeue sqp with mblk mp (which can be
  * a chain), while tail points to the end and cnt in number of
@@ -475,18 +409,21 @@ squeue_enter(squeue_t *sqp, mblk_t *mp, mblk_t *tail, uint32_t cnt,
 			 * Handle squeue switching. More details in the
 			 * block comment at the top of the file
 			 */
-			if (connp->conn_sqp == sqp) {
+			if (sqp->sq_isip == B_FALSE || connp->conn_sqp == sqp) {
 				SQUEUE_DBG_SET(sqp, mp, proc, connp,
 				    tag);
-				connp->conn_on_sqp = B_TRUE;
+				if (sqp->sq_isip == B_TRUE)
+					connp->conn_on_sqp = B_TRUE;
 				DTRACE_PROBE3(squeue__proc__start, squeue_t *,
 				    sqp, mblk_t *, mp, conn_t *, connp);
 				(*proc)(connp, mp, sqp, ira);
 				DTRACE_PROBE2(squeue__proc__end, squeue_t *,
 				    sqp, conn_t *, connp);
-				connp->conn_on_sqp = B_FALSE;
+				if (sqp->sq_isip == B_TRUE) {
+					connp->conn_on_sqp = B_FALSE;
+					CONN_DEC_REF(connp);
+				}
 				SQUEUE_DBG_CLEAR(sqp);
-				CONN_DEC_REF(connp);
 			} else {
 				SQUEUE_ENTER_ONE(connp->conn_sqp, mp, proc,
 				    connp, ira, SQ_FILL, SQTAG_SQUEUE_CHANGE);
@@ -497,23 +434,28 @@ squeue_enter(squeue_t *sqp, mblk_t *mp, mblk_t *tail, uint32_t cnt,
 			sqp->sq_run = NULL;
 			if (sqp->sq_first == NULL ||
 			    process_flag == SQ_NODRAIN) {
-				if (sqp->sq_first != NULL) {
-					squeue_worker_wakeup(sqp);
-					return;
+				/*
+				 * Even if SQ_NODRAIN was specified, it may
+				 * still be best to process a single queued
+				 * item if it matches the active connection.
+				 */
+				if (sqp->sq_first != NULL && sqp->sq_isip) {
+					squeue_try_drain_one(sqp, connp);
 				}
+
 				/*
-				 * We processed inline our packet and nothing
-				 * new has arrived. We are done. In case any
-				 * control actions are pending, wake up the
-				 * worker.
+				 * If work or control actions are pending, wake
+				 * up the worker thread.
 				 */
-				if (sqp->sq_state & SQS_WORKER_THR_CONTROL)
-					cv_signal(&sqp->sq_worker_cv);
+				if (sqp->sq_first != NULL ||
+				    sqp->sq_state & SQS_WORKER_THR_CONTROL) {
+					squeue_worker_wakeup(sqp);
+				}
 				mutex_exit(&sqp->sq_lock);
 				return;
 			}
 		} else {
-			if (ira != NULL) {
+			if (sqp->sq_isip == B_TRUE && ira != NULL) {
 				mblk_t	*attrmp;
 
 				ASSERT(cnt == 1);
@@ -565,10 +507,9 @@ squeue_enter(squeue_t *sqp, mblk_t *mp, mblk_t *tail, uint32_t cnt,
 		 * up the worker.
 		 */
 		sqp->sq_run = NULL;
-		if (sqp->sq_state & SQS_WORKER_THR_CONTROL)
-			cv_signal(&sqp->sq_worker_cv);
-		mutex_exit(&sqp->sq_lock);
-		return;
+		if (sqp->sq_state & SQS_WORKER_THR_CONTROL) {
+			squeue_worker_wakeup(sqp);
+		}
 	} else {
 		/*
 		 * We let a thread processing a squeue reenter only
@@ -587,7 +528,8 @@ squeue_enter(squeue_t *sqp, mblk_t *mp, mblk_t *tail, uint32_t cnt,
 		if (!(sqp->sq_state & SQS_REENTER) &&
 		    (process_flag != SQ_FILL) && (sqp->sq_first == NULL) &&
 		    (sqp->sq_run == curthread) && (cnt == 1) &&
-		    (connp->conn_on_sqp == B_FALSE)) {
+		    (sqp->sq_isip == B_FALSE ||
+		    connp->conn_on_sqp == B_FALSE)) {
 			sqp->sq_state |= SQS_REENTER;
 			mutex_exit(&sqp->sq_lock);
 
@@ -602,15 +544,21 @@ squeue_enter(squeue_t *sqp, mblk_t *mp, mblk_t *tail, uint32_t cnt,
 			 * Handle squeue switching. More details in the
 			 * block comment at the top of the file
 			 */
-			if (connp->conn_sqp == sqp) {
-				connp->conn_on_sqp = B_TRUE;
+			if (sqp->sq_isip == B_FALSE || connp->conn_sqp == sqp) {
+				SQUEUE_DBG_SET(sqp, mp, proc, connp,
+				    tag);
+				if (sqp->sq_isip == B_TRUE)
+					connp->conn_on_sqp = B_TRUE;
 				DTRACE_PROBE3(squeue__proc__start, squeue_t *,
 				    sqp, mblk_t *, mp, conn_t *, connp);
 				(*proc)(connp, mp, sqp, ira);
 				DTRACE_PROBE2(squeue__proc__end, squeue_t *,
 				    sqp, conn_t *, connp);
-				connp->conn_on_sqp = B_FALSE;
-				CONN_DEC_REF(connp);
+				if (sqp->sq_isip == B_TRUE) {
+					connp->conn_on_sqp = B_FALSE;
+					CONN_DEC_REF(connp);
+				}
+				SQUEUE_DBG_CLEAR(sqp);
 			} else {
 				SQUEUE_ENTER_ONE(connp->conn_sqp, mp, proc,
 				    connp, ira, SQ_FILL, SQTAG_SQUEUE_CHANGE);
@@ -631,7 +579,7 @@ squeue_enter(squeue_t *sqp, mblk_t *mp, mblk_t *tail, uint32_t cnt,
 #ifdef DEBUG
 		mp->b_tag = tag;
 #endif
-		if (ira != NULL) {
+		if (sqp->sq_isip && ira != NULL) {
 			mblk_t	*attrmp;
 
 			ASSERT(cnt == 1);
@@ -657,54 +605,33 @@ squeue_enter(squeue_t *sqp, mblk_t *mp, mblk_t *tail, uint32_t cnt,
 			tail = mp = attrmp;
 		}
 		ENQUEUE_CHAIN(sqp, mp, tail, cnt);
-		if (!(sqp->sq_state & SQS_PROC)) {
-			squeue_worker_wakeup(sqp);
-			return;
-		}
 		/*
-		 * In case any control actions are pending, wake
-		 * up the worker.
+		 * If the worker isn't running or control actions are pending,
+		 * wake it it up now.
 		 */
-		if (sqp->sq_state & SQS_WORKER_THR_CONTROL)
-			cv_signal(&sqp->sq_worker_cv);
-		mutex_exit(&sqp->sq_lock);
-		return;
+		if ((sqp->sq_state & SQS_PROC) == 0 ||
+		    (sqp->sq_state & SQS_WORKER_THR_CONTROL) != 0) {
+			squeue_worker_wakeup(sqp);
+		}
 	}
+	mutex_exit(&sqp->sq_lock);
 }
 
 /*
  * PRIVATE FUNCTIONS
  */
 
+
+/*
+ * Wake up worker thread for squeue to process queued work.
+ */
 static void
-squeue_fire(void *arg)
+squeue_worker_wakeup(squeue_t *sqp)
 {
-	squeue_t	*sqp = arg;
-	uint_t		state;
-
-	mutex_enter(&sqp->sq_lock);
-
-	state = sqp->sq_state;
-	if (sqp->sq_tid == 0 && !(state & SQS_TMO_PROG)) {
-		mutex_exit(&sqp->sq_lock);
-		return;
-	}
-
-	sqp->sq_tid = 0;
-	/*
-	 * The timeout fired before we got a chance to set it.
-	 * Process it anyway but remove the SQS_TMO_PROG so that
-	 * the guy trying to set the timeout knows that it has
-	 * already been processed.
-	 */
-	if (state & SQS_TMO_PROG)
-		sqp->sq_state &= ~SQS_TMO_PROG;
+	ASSERT(MUTEX_HELD(&(sqp)->sq_lock));
 
-	if (!(state & SQS_PROC)) {
-		sqp->sq_awaken = ddi_get_lbolt();
-		cv_signal(&sqp->sq_worker_cv);
-	}
-	mutex_exit(&sqp->sq_lock);
+	cv_signal(&sqp->sq_worker_cv);
+	sqp->sq_awoken = gethrtime();
 }
 
 static void
@@ -714,10 +641,8 @@ squeue_drain(squeue_t *sqp, uint_t proc_type, hrtime_t expire)
 	mblk_t 		*head;
 	sqproc_t 	proc;
 	conn_t		*connp;
-	timeout_id_t 	tid;
 	ill_rx_ring_t	*sq_rx_ring = sqp->sq_rx_ring;
 	hrtime_t 	now;
-	boolean_t	did_wakeup = B_FALSE;
 	boolean_t	sq_poll_capable;
 	ip_recv_attr_t	*ira, iras;
 
@@ -729,8 +654,7 @@ squeue_drain(squeue_t *sqp, uint_t proc_type, hrtime_t expire)
 	if (proc_type != SQS_WORKER && STACK_BIAS + (uintptr_t)getfp() -
 	    (uintptr_t)curthread->t_stkbase < squeue_drain_stack_needed) {
 		ASSERT(mutex_owned(&sqp->sq_lock));
-		sqp->sq_awaken = ddi_get_lbolt();
-		cv_signal(&sqp->sq_worker_cv);
+		squeue_worker_wakeup(sqp);
 		squeue_drain_stack_toodeep++;
 		return;
 	}
@@ -746,9 +670,6 @@ again:
 	sqp->sq_last = NULL;
 	sqp->sq_count = 0;
 
-	if ((tid = sqp->sq_tid) != 0)
-		sqp->sq_tid = 0;
-
 	sqp->sq_state |= SQS_PROC | proc_type;
 
 	/*
@@ -765,9 +686,6 @@ again:
 	SQS_POLLING_ON(sqp, sq_poll_capable, sq_rx_ring);
 	mutex_exit(&sqp->sq_lock);
 
-	if (tid != 0)
-		(void) untimeout(tid);
-
 	while ((mp = head) != NULL) {
 
 		head = mp->b_next;
@@ -779,7 +697,7 @@ again:
 		mp->b_prev = NULL;
 
 		/* Is there an ip_recv_attr_t to handle? */
-		if (ip_recv_attr_is_mblk(mp)) {
+		if (sqp->sq_isip == B_TRUE && ip_recv_attr_is_mblk(mp)) {
 			mblk_t	*attrmp = mp;
 
 			ASSERT(attrmp->b_cont != NULL);
@@ -804,20 +722,25 @@ again:
 
 
 		/*
-		 * Handle squeue switching. More details in the
-		 * block comment at the top of the file
+		 * Handle squeue switching. More details in the block comment at
+		 * the top of the file. non-IP squeues cannot switch, as there
+		 * is no conn_t.
 		 */
-		if (connp->conn_sqp == sqp) {
+		if (sqp->sq_isip == B_FALSE || connp->conn_sqp == sqp) {
 			SQUEUE_DBG_SET(sqp, mp, proc, connp,
 			    mp->b_tag);
-			connp->conn_on_sqp = B_TRUE;
+			if (sqp->sq_isip == B_TRUE)
+				connp->conn_on_sqp = B_TRUE;
 			DTRACE_PROBE3(squeue__proc__start, squeue_t *,
 			    sqp, mblk_t *, mp, conn_t *, connp);
 			(*proc)(connp, mp, sqp, ira);
 			DTRACE_PROBE2(squeue__proc__end, squeue_t *,
 			    sqp, conn_t *, connp);
-			connp->conn_on_sqp = B_FALSE;
-			CONN_DEC_REF(connp);
+			if (sqp->sq_isip == B_TRUE) {
+				connp->conn_on_sqp = B_FALSE;
+				CONN_DEC_REF(connp);
+			}
+			SQUEUE_DBG_CLEAR(sqp);
 		} else {
 			SQUEUE_ENTER_ONE(connp->conn_sqp, mp, proc, connp, ira,
 			    SQ_FILL, SQTAG_SQUEUE_CHANGE);
@@ -864,11 +787,9 @@ again:
 			if (proc_type == SQS_WORKER)
 				SQS_POLL_RING(sqp);
 			goto again;
-		} else {
-			did_wakeup = B_TRUE;
-			sqp->sq_awaken = ddi_get_lbolt();
-			cv_signal(&sqp->sq_worker_cv);
 		}
+
+		squeue_worker_wakeup(sqp);
 	}
 
 	/*
@@ -927,17 +848,14 @@ again:
 		    SQS_POLL_QUIESCE_DONE)));
 		SQS_POLLING_OFF(sqp, sq_poll_capable, sq_rx_ring);
 		sqp->sq_state &= ~(SQS_PROC | proc_type);
-		if (!did_wakeup && sqp->sq_first != NULL) {
-			squeue_worker_wakeup(sqp);
-			mutex_enter(&sqp->sq_lock);
-		}
 		/*
 		 * If we are not the worker and there is a pending quiesce
 		 * event, wake up the worker
 		 */
 		if ((proc_type != SQS_WORKER) &&
-		    (sqp->sq_state & SQS_WORKER_THR_CONTROL))
-			cv_signal(&sqp->sq_worker_cv);
+		    (sqp->sq_state & SQS_WORKER_THR_CONTROL)) {
+			squeue_worker_wakeup(sqp);
+		}
 	}
 }
 
@@ -1051,6 +969,11 @@ squeue_polling_thread(squeue_t *sqp)
 		cv_wait(async, lock);
 		CALLB_CPR_SAFE_END(&cprinfo, lock);
 
+		if (sqp->sq_state & SQS_EXIT) {
+			mutex_exit(lock);
+			thread_exit();
+		}
+
 		ctl_state = sqp->sq_state & (SQS_POLL_THR_CONTROL |
 		    SQS_POLL_THR_QUIESCED);
 		if (ctl_state != 0) {
@@ -1076,6 +999,9 @@ squeue_polling_thread(squeue_t *sqp)
 		    (SQS_PROC|SQS_POLLING|SQS_GET_PKTS)) ==
 		    (SQS_PROC|SQS_POLLING|SQS_GET_PKTS));
 
+		/* Only IP related squeues should reach this point */
+		VERIFY(sqp->sq_isip == B_TRUE);
+
 poll_again:
 		sq_rx_ring = sqp->sq_rx_ring;
 		sq_get_pkts = sq_rx_ring->rr_rx;
@@ -1137,7 +1063,6 @@ poll_again:
 				 */
 			}
 
-			sqp->sq_awaken = ddi_get_lbolt();
 			/*
 			 * Put the SQS_PROC_HELD on so the worker
 			 * thread can distinguish where its called from. We
@@ -1153,7 +1078,7 @@ poll_again:
 			 */
 			sqp->sq_state |= SQS_PROC_HELD;
 			sqp->sq_state &= ~SQS_GET_PKTS;
-			cv_signal(&sqp->sq_worker_cv);
+			squeue_worker_wakeup(sqp);
 		} else if (sqp->sq_first == NULL &&
 		    !(sqp->sq_state & SQS_WORKER)) {
 			/*
@@ -1173,8 +1098,9 @@ poll_again:
 			 * wake up the worker, since it is currently
 			 * not running.
 			 */
-			if (sqp->sq_state & SQS_WORKER_THR_CONTROL)
-				cv_signal(&sqp->sq_worker_cv);
+			if (sqp->sq_state & SQS_WORKER_THR_CONTROL) {
+				squeue_worker_wakeup(sqp);
+			}
 		} else {
 			/*
 			 * Worker thread is already running. We don't need
@@ -1205,6 +1131,7 @@ squeue_worker_thr_control(squeue_t *sqp)
 	ill_rx_ring_t	*rx_ring;
 
 	ASSERT(MUTEX_HELD(&sqp->sq_lock));
+	VERIFY(sqp->sq_isip == B_TRUE);
 
 	if (sqp->sq_state & SQS_POLL_RESTART) {
 		/* Restart implies a previous quiesce. */
@@ -1316,6 +1243,11 @@ squeue_worker(squeue_t *sqp)
 
 	for (;;) {
 		for (;;) {
+			if (sqp->sq_state & SQS_EXIT) {
+				mutex_exit(lock);
+				thread_exit();
+			}
+
 			/*
 			 * If the poll thread has handed control to us
 			 * we need to break out of the wait.
@@ -1412,6 +1344,7 @@ squeue_synch_enter(conn_t *connp, mblk_t *use_mp)
 
 again:
 	sqp = connp->conn_sqp;
+	VERIFY(sqp->sq_isip == B_TRUE);
 
 	mutex_enter(&sqp->sq_lock);
 	if (sqp->sq_first == NULL && !(sqp->sq_state & SQS_PROC)) {
@@ -1483,36 +1416,109 @@ again:
 	}
 }
 
-void
-squeue_synch_exit(conn_t *connp)
+/*
+ * If possible, attempt to immediately process a single queued request, should
+ * it match the supplied conn_t reference.  This is primarily intended to elide
+ * squeue worker thread wake-ups during local TCP connect() or close()
+ * operations where the response is placed on the squeue during processing.
+ */
+static void
+squeue_try_drain_one(squeue_t *sqp, conn_t *compare_conn)
 {
-	squeue_t *sqp = connp->conn_sqp;
+	mblk_t *next, *mp = sqp->sq_first;
+	conn_t *connp;
+	sqproc_t proc = (sqproc_t)mp->b_queue;
+	ip_recv_attr_t iras, *ira = NULL;
 
-	mutex_enter(&sqp->sq_lock);
-	if (sqp->sq_run == curthread) {
-		ASSERT(sqp->sq_state & SQS_PROC);
+	ASSERT(MUTEX_HELD(&sqp->sq_lock));
+	ASSERT((sqp->sq_state & SQS_PROC) == 0);
+	ASSERT(sqp->sq_run == NULL);
+	ASSERT(sqp->sq_isip);
+	VERIFY(mp != NULL);
 
-		sqp->sq_state &= ~SQS_PROC;
-		sqp->sq_run = NULL;
-		connp->conn_on_sqp = B_FALSE;
+	/*
+	 * There is no guarantee that compare_conn references a valid object at
+	 * this time, so under no circumstance may it be deferenced unless it
+	 * matches the squeue entry.
+	 */
+	connp = (conn_t *)mp->b_prev;
+	if (connp != compare_conn) {
+		return;
+	}
 
-		if (sqp->sq_first == NULL) {
-			mutex_exit(&sqp->sq_lock);
-		} else {
-			/*
-			 * If this was a normal thread, then it would
-			 * (most likely) continue processing the pending
-			 * requests. Since the just completed operation
-			 * was executed synchronously, the thread should
-			 * not be delayed. To compensate, wake up the
-			 * worker thread right away when there are outstanding
-			 * requests.
-			 */
-			sqp->sq_awaken = ddi_get_lbolt();
-			cv_signal(&sqp->sq_worker_cv);
-			mutex_exit(&sqp->sq_lock);
-		}
+	next = mp->b_next;
+	proc = (sqproc_t)mp->b_queue;
+
+	ASSERT(proc != NULL);
+	ASSERT(sqp->sq_count > 0);
+
+	/* Dequeue item from squeue */
+	if (next == NULL) {
+		sqp->sq_first = NULL;
+		sqp->sq_last = NULL;
 	} else {
+		sqp->sq_first = next;
+	}
+	sqp->sq_count--;
+
+	sqp->sq_state |= SQS_PROC;
+	sqp->sq_run = curthread;
+	mutex_exit(&sqp->sq_lock);
+
+	/* Prep mblk_t and retrieve ira if needed */
+	mp->b_prev = NULL;
+	mp->b_queue = NULL;
+	mp->b_next = NULL;
+	if (ip_recv_attr_is_mblk(mp)) {
+		mblk_t	*attrmp = mp;
+
+		ASSERT(attrmp->b_cont != NULL);
+
+		mp = attrmp->b_cont;
+		attrmp->b_cont = NULL;
+
+		ASSERT(mp->b_queue == NULL);
+		ASSERT(mp->b_prev == NULL);
+
+		if (!ip_recv_attr_from_mblk(attrmp, &iras)) {
+			/* ill_t or ip_stack_t disappeared */
+			ip_drop_input("ip_recv_attr_from_mblk", mp, NULL);
+			ira_cleanup(&iras, B_TRUE);
+			CONN_DEC_REF(connp);
+			goto done;
+		}
+		ira = &iras;
+	}
+
+	SQUEUE_DBG_SET(sqp, mp, proc, connp, mp->b_tag);
+	connp->conn_on_sqp = B_TRUE;
+	DTRACE_PROBE3(squeue__proc__start, squeue_t *, sqp, mblk_t *, mp,
+	    conn_t *, connp);
+	(*proc)(connp, mp, sqp, ira);
+	DTRACE_PROBE2(squeue__proc__end, squeue_t *, sqp, conn_t *, connp);
+	connp->conn_on_sqp = B_FALSE;
+	CONN_DEC_REF(connp);
+	SQUEUE_DBG_CLEAR(sqp);
+
+	if (ira != NULL)
+		ira_cleanup(ira, B_TRUE);
+
+done:
+	mutex_enter(&sqp->sq_lock);
+	sqp->sq_state &= ~(SQS_PROC);
+	sqp->sq_run = NULL;
+}
+
+void
+squeue_synch_exit(conn_t *connp, int flag)
+{
+	squeue_t *sqp = connp->conn_sqp;
+
+	VERIFY(sqp->sq_isip == B_TRUE);
+	ASSERT(flag == SQ_NODRAIN || flag == SQ_PROCESS);
+
+	mutex_enter(&sqp->sq_lock);
+	if (sqp->sq_run != curthread) {
 		/*
 		 * The caller doesn't own the squeue, clear the SQS_PAUSE flag,
 		 * and wake up the squeue owner, such that owner can continue
@@ -1524,5 +1530,23 @@ squeue_synch_exit(conn_t *connp)
 		/* There should be only one thread blocking on sq_synch_cv. */
 		cv_signal(&sqp->sq_synch_cv);
 		mutex_exit(&sqp->sq_lock);
+		return;
 	}
+
+	ASSERT(sqp->sq_state & SQS_PROC);
+
+	sqp->sq_state &= ~SQS_PROC;
+	sqp->sq_run = NULL;
+	connp->conn_on_sqp = B_FALSE;
+
+	/* If the caller opted in, attempt to process the head squeue item. */
+	if (flag == SQ_PROCESS && sqp->sq_first != NULL) {
+		squeue_try_drain_one(sqp, connp);
+	}
+
+	/* Wake up the worker if further requests are pending. */
+	if (sqp->sq_first != NULL) {
+		squeue_worker_wakeup(sqp);
+	}
+	mutex_exit(&sqp->sq_lock);
 }
diff --git a/usr/src/uts/common/inet/tcp.h b/usr/src/uts/common/inet/tcp.h
index b2b9973291..6ec2e6b2d7 100644
--- a/usr/src/uts/common/inet/tcp.h
+++ b/usr/src/uts/common/inet/tcp.h
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, Joyent, Inc. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
  * Copyright (c) 2014 by Delphix. All rights reserved.
  */
@@ -134,6 +134,7 @@ typedef	struct tcphdra_s {
 
 struct conn_s;
 struct tcp_listen_cnt_s;
+struct tcp_rg_s;
 
 /*
  * Control structure for each open TCP stream,
@@ -404,6 +405,13 @@ typedef struct tcp_s {
 	struct tcp_s *tcp_bind_hash_port; /* tcp_t's bound to the same lport */
 	struct tcp_s **tcp_ptpbhn;
 
+	/*
+	 * Group of tcp_t entries bound to the same adress and port via
+	 * SO_REUSEPORT.  The pointer itself is protected by tf_lock in the
+	 * containing tcps_bind_fanout slot.
+	 */
+	struct tcp_rg_s	*tcp_rg_bind;
+
 	uint_t		tcp_maxpsz_multiplier;
 
 	uint32_t	tcp_lso_max; /* maximum LSO payload */
diff --git a/usr/src/uts/common/inet/tcp/tcp.c b/usr/src/uts/common/inet/tcp/tcp.c
index c3bbd6a0d6..d86680c4b5 100644
--- a/usr/src/uts/common/inet/tcp/tcp.c
+++ b/usr/src/uts/common/inet/tcp/tcp.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, Joyent Inc. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
  * Copyright (c) 2013,2014 by Delphix. All rights reserved.
  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
@@ -967,8 +967,7 @@ void
 tcp_stop_lingering(tcp_t *tcp)
 {
 	clock_t	delta = 0;
-	tcp_stack_t	*tcps = tcp->tcp_tcps;
-	conn_t		*connp = tcp->tcp_connp;
+	conn_t	*connp = tcp->tcp_connp;
 
 	tcp->tcp_linger_tid = 0;
 	if (tcp->tcp_state > TCPS_LISTEN) {
@@ -996,7 +995,7 @@ tcp_stop_lingering(tcp_t *tcp)
 
 		if (tcp->tcp_state == TCPS_TIME_WAIT) {
 			tcp_time_wait_append(tcp);
-			TCP_DBGSTAT(tcps, tcp_detach_time_wait);
+			TCP_DBGSTAT(tcp->tcp_tcps, tcp_detach_time_wait);
 			goto finish;
 		}
 
@@ -1423,6 +1422,21 @@ tcp_free(tcp_t *tcp)
 	tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
 
 	/*
+	 * Destroy any association with SO_REUSEPORT group.
+	 */
+	if (tcp->tcp_rg_bind != NULL) {
+		/*
+		 * This is only necessary for connections which enabled
+		 * SO_REUSEPORT but were never bound.  Such connections should
+		 * be the one and only member of the tcp_rg_tp to which they
+		 * have been associated.
+		 */
+		VERIFY(tcp_rg_remove(tcp->tcp_rg_bind, tcp));
+		tcp_rg_destroy(tcp->tcp_rg_bind);
+		tcp->tcp_rg_bind = NULL;
+	}
+
+	/*
 	 * If this is a non-STREAM socket still holding on to an upper
 	 * handle, release it. As a result of fallback we might also see
 	 * STREAMS based conns with upper handles, in which case there is
@@ -2054,8 +2068,7 @@ tcp_reinit(tcp_t *tcp)
  * structure!
  */
 static void
-tcp_reinit_values(tcp)
-	tcp_t *tcp;
+tcp_reinit_values(tcp_t *tcp)
 {
 	tcp_stack_t	*tcps = tcp->tcp_tcps;
 	conn_t		*connp = tcp->tcp_connp;
@@ -2456,8 +2469,10 @@ tcp_init_values(tcp_t *tcp, tcp_t *parent)
  * Path MTU might have changed by either increase or decrease, so need to
  * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny
  * or negative MSS, since tcp_mss_set() will do it.
+ *
+ * Returns B_TRUE when the connection PMTU changes, otherwise B_FALSE.
  */
-void
+boolean_t
 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
 {
 	uint32_t	pmtu;
@@ -2467,10 +2482,10 @@ tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
 	iaflags_t	ixaflags;
 
 	if (tcp->tcp_tcps->tcps_ignore_path_mtu)
-		return;
+		return (B_FALSE);
 
 	if (tcp->tcp_state < TCPS_ESTABLISHED)
-		return;
+		return (B_FALSE);
 
 	/*
 	 * Always call ip_get_pmtu() to make sure that IP has updated
@@ -2490,13 +2505,13 @@ tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
 	 * Nothing to change, so just return.
 	 */
 	if (mss == tcp->tcp_mss)
-		return;
+		return (B_FALSE);
 
 	/*
 	 * Currently, for ICMP errors, only PMTU decrease is handled.
 	 */
 	if (mss > tcp->tcp_mss && decrease_only)
-		return;
+		return (B_FALSE);
 
 	DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss);
 
@@ -2531,6 +2546,7 @@ tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
 		tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0;
 	}
 	ixa->ixa_flags = ixaflags;
+	return (B_TRUE);
 }
 
 int
@@ -3401,7 +3417,7 @@ tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype,
 		tcp_update_lso(tcp, connp->conn_ixa);
 		break;
 	case IXAN_PMTU:
-		tcp_update_pmtu(tcp, B_FALSE);
+		(void) tcp_update_pmtu(tcp, B_FALSE);
 		break;
 	case IXAN_ZCOPY:
 		tcp_update_zcopy(tcp);
@@ -3731,7 +3747,6 @@ tcp_stack_init(netstackid_t stackid, netstack_t *ns)
 {
 	tcp_stack_t	*tcps;
 	int		i;
-	int		error = 0;
 	major_t		major;
 	size_t		arrsz;
 
@@ -3795,8 +3810,7 @@ tcp_stack_init(netstackid_t stackid, netstack_t *ns)
 	tcps->tcps_mibkp = tcp_kstat_init(stackid);
 
 	major = mod_name_to_major(INET_NAME);
-	error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident);
-	ASSERT(error == 0);
+	VERIFY0(ldi_ident_from_major(major, &tcps->tcps_ldi_ident));
 	tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL);
 	ASSERT(tcps->tcps_ixa_cleanup_mp != NULL);
 	cv_init(&tcps->tcps_ixa_cleanup_ready_cv, NULL, CV_DEFAULT, NULL);
diff --git a/usr/src/uts/common/inet/tcp/tcp_bind.c b/usr/src/uts/common/inet/tcp/tcp_bind.c
index 72093af2f2..ec2a5d4e29 100644
--- a/usr/src/uts/common/inet/tcp/tcp_bind.c
+++ b/usr/src/uts/common/inet/tcp/tcp_bind.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  * Copyright (c) 2016 by Delphix. All rights reserved.
  */
 
@@ -56,6 +57,7 @@ static uint32_t tcp_random_anon_port = 1;
 static int	tcp_bind_select_lport(tcp_t *, in_port_t *, boolean_t,
 		    cred_t *cr);
 static in_port_t	tcp_get_next_priv_port(const tcp_t *);
+static int tcp_rg_insert(tcp_rg_t *, struct tcp_s *);
 
 /*
  * Hash list insertion routine for tcp_t structures. Each hash bucket
@@ -173,6 +175,16 @@ tcp_bind_hash_remove(tcp_t *tcp)
 
 	ASSERT(lockp != NULL);
 	mutex_enter(lockp);
+
+	/* destroy any association with SO_REUSEPORT group */
+	if (tcp->tcp_rg_bind != NULL) {
+		if (tcp_rg_remove(tcp->tcp_rg_bind, tcp)) {
+			/* Last one out turns off the lights */
+			tcp_rg_destroy(tcp->tcp_rg_bind);
+		}
+		tcp->tcp_rg_bind = NULL;
+	}
+
 	if (tcp->tcp_ptpbhn) {
 		tcpnext = tcp->tcp_bind_hash_port;
 		if (tcpnext != NULL) {
@@ -637,13 +649,12 @@ tcp_bind_check(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
 }
 
 /*
- * If the "bind_to_req_port_only" parameter is set, if the requested port
- * number is available, return it, If not return 0
+ * If the "bind_to_req_port_only" parameter is set and the requested port
+ * number is available, return it (else return 0).
  *
- * If "bind_to_req_port_only" parameter is not set and
- * If the requested port number is available, return it.  If not, return
- * the first anonymous port we happen across.  If no anonymous ports are
- * available, return 0. addr is the requested local address, if any.
+ * If "bind_to_req_port_only" parameter is not set and the requested port
+ * number is available, return it.  If not, return the first anonymous port we
+ * happen across.  If no anonymous ports are available, return 0.
  *
  * In either case, when succeeding update the tcp_t to record the port number
  * and insert it in the bind hash table.
@@ -663,6 +674,7 @@ tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
 	int loopmax;
 	conn_t *connp = tcp->tcp_connp;
 	tcp_stack_t	*tcps = tcp->tcp_tcps;
+	boolean_t reuseport = connp->conn_reuseport;
 
 	/*
 	 * Lookup for free addresses is done in a loop and "loopmax"
@@ -699,6 +711,7 @@ tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
 		tf_t		*tbf;
 		tcp_t		*ltcp;
 		conn_t		*lconnp;
+		boolean_t	attempt_reuse = B_FALSE;
 
 		lport = htons(port);
 
@@ -725,6 +738,7 @@ tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
 		for (; ltcp != NULL; ltcp = ltcp->tcp_bind_hash_port) {
 			boolean_t not_socket;
 			boolean_t exclbind;
+			boolean_t addrmatch;
 
 			lconnp = ltcp->tcp_connp;
 
@@ -830,22 +844,35 @@ tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
 			    &lconnp->conn_faddr_v6)))
 				continue;
 
+			addrmatch = IN6_ARE_ADDR_EQUAL(laddr,
+			    &lconnp->conn_bound_addr_v6);
+
+			if (addrmatch && reuseport && bind_to_req_port_only &&
+			    (ltcp->tcp_state == TCPS_BOUND ||
+			    ltcp->tcp_state == TCPS_LISTEN)) {
+				/*
+				 * This entry is bound to the exact same
+				 * address and port.  If SO_REUSEPORT is set on
+				 * the calling socket, attempt to reuse this
+				 * binding if it too had SO_REUSEPORT enabled
+				 * when it was bound.
+				 */
+				attempt_reuse = (ltcp->tcp_rg_bind != NULL);
+				break;
+			}
+
 			if (!reuseaddr) {
 				/*
-				 * No socket option SO_REUSEADDR.
-				 * If existing port is bound to
-				 * a non-wildcard IP address
-				 * and the requesting stream is
-				 * bound to a distinct
-				 * different IP addresses
-				 * (non-wildcard, also), keep
-				 * going.
+				 * No socket option SO_REUSEADDR.  If an
+				 * existing port is bound to a non-wildcard IP
+				 * address and the requesting stream is bound
+				 * to a distinct different IP address
+				 * (non-wildcard, also), keep going.
 				 */
 				if (!V6_OR_V4_INADDR_ANY(*laddr) &&
 				    !V6_OR_V4_INADDR_ANY(
 				    lconnp->conn_bound_addr_v6) &&
-				    !IN6_ARE_ADDR_EQUAL(laddr,
-				    &lconnp->conn_bound_addr_v6))
+				    !addrmatch)
 					continue;
 				if (ltcp->tcp_state >= TCPS_BOUND) {
 					/*
@@ -860,27 +887,49 @@ tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
 				 * socket option SO_REUSEADDR is set on the
 				 * binding tcp_t.
 				 *
-				 * If two streams are bound to
-				 * same IP address or both addr
-				 * and bound source are wildcards
-				 * (INADDR_ANY), we want to stop
-				 * searching.
-				 * We have found a match of IP source
-				 * address and source port, which is
-				 * refused regardless of the
-				 * SO_REUSEADDR setting, so we break.
+				 * If two streams are bound to the same IP
+				 * address or both addr and bound source are
+				 * wildcards (INADDR_ANY), we want to stop
+				 * searching.  We have found a match of IP
+				 * source address and source port, which is
+				 * refused regardless of the SO_REUSEADDR
+				 * setting, so we break.
 				 */
-				if (IN6_ARE_ADDR_EQUAL(laddr,
-				    &lconnp->conn_bound_addr_v6) &&
+				if (addrmatch &&
 				    (ltcp->tcp_state == TCPS_LISTEN ||
 				    ltcp->tcp_state == TCPS_BOUND))
 					break;
 			}
 		}
-		if (ltcp != NULL) {
+		if (ltcp != NULL && !attempt_reuse) {
 			/* The port number is busy */
 			mutex_exit(&tbf->tf_lock);
 		} else {
+			if (attempt_reuse) {
+				int err;
+				struct tcp_rg_s *rg;
+
+				ASSERT(ltcp != NULL);
+				ASSERT(ltcp->tcp_rg_bind != NULL);
+				ASSERT(tcp->tcp_rg_bind != NULL);
+				ASSERT(ltcp->tcp_rg_bind != tcp->tcp_rg_bind);
+
+				err = tcp_rg_insert(ltcp->tcp_rg_bind, tcp);
+				if (err != 0) {
+					mutex_exit(&tbf->tf_lock);
+					return (0);
+				}
+				/*
+				 * Now that the newly-binding socket has joined
+				 * the existing reuseport group on ltcp, it
+				 * should clean up its own (empty) group.
+				 */
+				rg = tcp->tcp_rg_bind;
+				tcp->tcp_rg_bind = ltcp->tcp_rg_bind;
+				VERIFY(tcp_rg_remove(rg, tcp));
+				tcp_rg_destroy(rg);
+			}
+
 			/*
 			 * This port is ours. Insert in fanout and mark as
 			 * bound to prevent others from getting the port
@@ -945,3 +994,125 @@ tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
 	} while (++count < loopmax);
 	return (0);
 }
+
+/* Max number of members in TCP SO_REUSEPORT group */
+#define	TCP_RG_SIZE_MAX		64
+/* Step size when expanding members array */
+#define	TCP_RG_SIZE_STEP	2
+
+
+tcp_rg_t *
+tcp_rg_init(tcp_t *tcp)
+{
+	tcp_rg_t *rg;
+	rg = kmem_alloc(sizeof (tcp_rg_t), KM_NOSLEEP|KM_NORMALPRI);
+	if (rg == NULL)
+		return (NULL);
+	rg->tcprg_members = kmem_zalloc(2 * sizeof (tcp_t *),
+	    KM_NOSLEEP|KM_NORMALPRI);
+	if (rg->tcprg_members == NULL) {
+		kmem_free(rg, sizeof (tcp_rg_t));
+		return (NULL);
+	}
+
+	mutex_init(&rg->tcprg_lock, NULL, MUTEX_DEFAULT, NULL);
+	rg->tcprg_size = 2;
+	rg->tcprg_count = 1;
+	rg->tcprg_active = 1;
+	rg->tcprg_members[0] = tcp;
+	return (rg);
+}
+
+void
+tcp_rg_destroy(tcp_rg_t *rg)
+{
+	mutex_enter(&rg->tcprg_lock);
+	ASSERT(rg->tcprg_count == 0);
+	ASSERT(rg->tcprg_active == 0);
+	kmem_free(rg->tcprg_members, rg->tcprg_size * sizeof (tcp_t *));
+	mutex_destroy(&rg->tcprg_lock);
+	kmem_free(rg, sizeof (struct tcp_rg_s));
+}
+
+static int
+tcp_rg_insert(tcp_rg_t *rg, tcp_t *tcp)
+{
+	mutex_enter(&rg->tcprg_lock);
+
+	VERIFY(rg->tcprg_size > 0);
+	VERIFY(rg->tcprg_count <= rg->tcprg_size);
+	if (rg->tcprg_count != 0) {
+		cred_t *oldcred = rg->tcprg_members[0]->tcp_connp->conn_cred;
+		cred_t *newcred = tcp->tcp_connp->conn_cred;
+
+		if (crgetuid(oldcred) != crgetuid(newcred) ||
+		    crgetzoneid(oldcred) != crgetzoneid(newcred)) {
+			mutex_exit(&rg->tcprg_lock);
+			return (EPERM);
+		}
+	}
+
+	if (rg->tcprg_count == rg->tcprg_size) {
+		unsigned int oldalloc = rg->tcprg_size * sizeof (tcp_t *);
+		unsigned int newsize = rg->tcprg_size + TCP_RG_SIZE_STEP;
+		tcp_t **newmembers;
+
+		if (newsize > TCP_RG_SIZE_MAX) {
+			mutex_exit(&rg->tcprg_lock);
+			return (EINVAL);
+		}
+		newmembers = kmem_zalloc(newsize * sizeof (tcp_t *),
+		    KM_NOSLEEP|KM_NORMALPRI);
+		if (newmembers == NULL) {
+			mutex_exit(&rg->tcprg_lock);
+			return (ENOMEM);
+		}
+		bcopy(rg->tcprg_members, newmembers, oldalloc);
+		kmem_free(rg->tcprg_members, oldalloc);
+		rg->tcprg_members = newmembers;
+		rg->tcprg_size = newsize;
+	}
+
+	rg->tcprg_members[rg->tcprg_count] = tcp;
+	rg->tcprg_count++;
+	rg->tcprg_active++;
+
+	mutex_exit(&rg->tcprg_lock);
+	return (0);
+}
+
+boolean_t
+tcp_rg_remove(tcp_rg_t *rg, tcp_t *tcp)
+{
+	int i;
+	boolean_t is_empty;
+
+	mutex_enter(&rg->tcprg_lock);
+	for (i = 0; i < rg->tcprg_count; i++) {
+		if (rg->tcprg_members[i] == tcp)
+			break;
+	}
+	/* The item should be present */
+	ASSERT(i < rg->tcprg_count);
+	/* Move the last member into this position */
+	rg->tcprg_count--;
+	rg->tcprg_members[i] = rg->tcprg_members[rg->tcprg_count];
+	rg->tcprg_members[rg->tcprg_count] = NULL;
+	if (tcp->tcp_connp->conn_reuseport != 0)
+		rg->tcprg_active--;
+	is_empty = (rg->tcprg_count == 0);
+	mutex_exit(&rg->tcprg_lock);
+	return (is_empty);
+}
+
+void
+tcp_rg_setactive(tcp_rg_t *rg, boolean_t is_active)
+{
+	mutex_enter(&rg->tcprg_lock);
+	if (is_active) {
+		rg->tcprg_active++;
+	} else {
+		rg->tcprg_active--;
+	}
+	mutex_exit(&rg->tcprg_lock);
+}
diff --git a/usr/src/uts/common/inet/tcp/tcp_input.c b/usr/src/uts/common/inet/tcp/tcp_input.c
index 37e4d72745..1157023ab2 100644
--- a/usr/src/uts/common/inet/tcp/tcp_input.c
+++ b/usr/src/uts/common/inet/tcp/tcp_input.c
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2017 Joyent, Inc.
  * Copyright (c) 2014 by Delphix. All rights reserved.
  */
 
@@ -5562,10 +5562,12 @@ noticmpv4:
 		switch (icmph->icmph_code) {
 		case ICMP_FRAGMENTATION_NEEDED:
 			/*
-			 * Update Path MTU, then try to send something out.
+			 * Attempt to update path MTU and, if the MSS of the
+			 * connection is altered, retransmit outstanding data.
 			 */
-			tcp_update_pmtu(tcp, B_TRUE);
-			tcp_rexmit_after_error(tcp);
+			if (tcp_update_pmtu(tcp, B_TRUE)) {
+				tcp_rexmit_after_error(tcp);
+			}
 			break;
 		case ICMP_PORT_UNREACHABLE:
 		case ICMP_PROTOCOL_UNREACHABLE:
@@ -5608,7 +5610,7 @@ noticmpv4:
 			break;
 		}
 		break;
-	case ICMP_SOURCE_QUENCH: {
+	case ICMP_SOURCE_QUENCH:
 		/*
 		 * use a global boolean to control
 		 * whether TCP should respond to ICMP_SOURCE_QUENCH.
@@ -5629,7 +5631,6 @@ noticmpv4:
 		}
 		break;
 	}
-	}
 	freemsg(mp);
 }
 
@@ -5682,10 +5683,12 @@ noticmpv6:
 	switch (icmp6->icmp6_type) {
 	case ICMP6_PACKET_TOO_BIG:
 		/*
-		 * Update Path MTU, then try to send something out.
+		 * Attempt to update path MTU and, if the MSS of the connection
+		 * is altered, retransmit outstanding data.
 		 */
-		tcp_update_pmtu(tcp, B_TRUE);
-		tcp_rexmit_after_error(tcp);
+		if (tcp_update_pmtu(tcp, B_TRUE)) {
+			tcp_rexmit_after_error(tcp);
+		}
 		break;
 	case ICMP6_DST_UNREACH:
 		switch (icmp6->icmp6_code) {
diff --git a/usr/src/uts/common/inet/tcp/tcp_opt_data.c b/usr/src/uts/common/inet/tcp/tcp_opt_data.c
index 40148b416a..50d97b6ea2 100644
--- a/usr/src/uts/common/inet/tcp/tcp_opt_data.c
+++ b/usr/src/uts/common/inet/tcp/tcp_opt_data.c
@@ -21,6 +21,7 @@
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -62,7 +63,8 @@ opdes_t	tcp_opt_arr[] = {
 { SO_USELOOPBACK, SOL_SOCKET, OA_RW, OA_RW, OP_NP, 0, sizeof (int), 0
 	},
 { SO_BROADCAST,	SOL_SOCKET, OA_RW, OA_RW, OP_NP, 0, sizeof (int), 0 },
-{ SO_REUSEADDR, SOL_SOCKET, OA_RW, OA_RW, OP_NP, 0, sizeof (int), 0 },
+{ SO_REUSEADDR,	SOL_SOCKET, OA_RW, OA_RW, OP_NP, 0, sizeof (int), 0 },
+{ SO_REUSEPORT,	SOL_SOCKET, OA_RW, OA_RW, OP_NP, 0, sizeof (int), 0 },
 { SO_OOBINLINE, SOL_SOCKET, OA_RW, OA_RW, OP_NP, 0, sizeof (int), 0 },
 { SO_TYPE,	SOL_SOCKET, OA_R, OA_R, OP_NP, 0, sizeof (int), 0 },
 { SO_SNDBUF,	SOL_SOCKET, OA_RW, OA_RW, OP_NP, 0, sizeof (int), 0 },
@@ -484,6 +486,104 @@ tcp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr)
 }
 
 /*
+ * Set a TCP connection's participation in SO_REUSEPORT.  This operation is
+ * performed under the protection of the squeue via tcp_setsockopt.
+ * The manipulation of tcp_rg_bind, as part of this operation, is subject to
+ * these constraints:
+ * 1. Prior to bind(), tcp_rg_bind can be set/cleared in tcp_set_reuseport
+ *    under the protection of the squeue.
+ * 2. Once the connection has been bound, the tcp_rg_bind pointer must not be
+ *    altered until such time as tcp_free() cleans up the connection.
+ * 3. A connection undergoing bind, which matches to a connection participating
+ *    in port-reuse, will switch its tcp_rg_bind pointer when it joins the
+ *    group of an existing connection in tcp_bindi().
+ */
+static int
+tcp_set_reuseport(conn_t *connp, boolean_t do_enable)
+{
+	tcp_t *tcp = connp->conn_tcp;
+	struct tcp_rg_s *rg;
+
+	if (!IPCL_IS_NONSTR(connp)) {
+		if (do_enable) {
+			/*
+			 * SO_REUSEPORT cannot be enabled on sockets which have
+			 * fallen back to the STREAMS API.
+			 */
+			return (EINVAL);
+		} else {
+			/*
+			 * A connection with SO_REUSEPORT enabled should be
+			 * prevented from falling back to STREAMS mode via
+			 * logic in tcp_fallback.  It is legal, however, for
+			 * fallen-back connections to affirm the disabled state
+			 * of SO_REUSEPORT.
+			 */
+			ASSERT(connp->conn_reuseport == 0);
+			return (0);
+		}
+	}
+	if (tcp->tcp_state <= TCPS_CLOSED) {
+		return (EINVAL);
+	}
+	if (connp->conn_reuseport == 0 && do_enable) {
+		/* disabled -> enabled */
+		if (tcp->tcp_rg_bind != NULL) {
+			tcp_rg_setactive(tcp->tcp_rg_bind, do_enable);
+		} else {
+			/*
+			 * Connection state is not a concern when initially
+			 * populating tcp_rg_bind.  Setting it to non-NULL on a
+			 * bound or listening connection would only mean that
+			 * new reused-port binds become a possibility.
+			 */
+			if ((rg = tcp_rg_init(tcp)) == NULL) {
+				return (ENOMEM);
+			}
+			tcp->tcp_rg_bind = rg;
+		}
+		connp->conn_reuseport = 1;
+	} else if (connp->conn_reuseport != 0 && !do_enable) {
+		/* enabled -> disabled */
+		ASSERT(tcp->tcp_rg_bind != NULL);
+		if (tcp->tcp_state == TCPS_IDLE) {
+			/*
+			 * If the connection has not been bound yet, discard
+			 * the reuse group state.  Since disabling SO_REUSEPORT
+			 * on a bound socket will _not_ prevent others from
+			 * reusing the port, the presence of tcp_rg_bind is
+			 * used to determine reuse availability, not
+			 * conn_reuseport.
+			 *
+			 * This allows proper behavior for examples such as:
+			 *
+			 * setsockopt(fd1, ... SO_REUSEPORT, &on_val...);
+			 * bind(fd1, &myaddr, ...);
+			 * setsockopt(fd1, ... SO_REUSEPORT, &off_val...);
+			 *
+			 * setsockopt(fd2, ... SO_REUSEPORT, &on_val...);
+			 * bind(fd2, &myaddr, ...); // <- SHOULD SUCCEED
+			 *
+			 */
+			rg = tcp->tcp_rg_bind;
+			tcp->tcp_rg_bind = NULL;
+			VERIFY(tcp_rg_remove(rg, tcp));
+			tcp_rg_destroy(rg);
+		} else {
+			/*
+			 * If a connection has been bound, it's no longer safe
+			 * to manipulate tcp_rg_bind until connection clean-up
+			 * during tcp_free.  Just mark the member status of the
+			 * connection as inactive.
+			 */
+			tcp_rg_setactive(tcp->tcp_rg_bind, do_enable);
+		}
+		connp->conn_reuseport = 0;
+	}
+	return (0);
+}
+
+/*
  * We declare as 'int' rather than 'void' to satisfy pfi_t arg requirements.
  * Parameters are assumed to be verified by the caller.
  */
@@ -653,6 +753,11 @@ tcp_opt_set(conn_t *connp, uint_t optset_context, int level, int name,
 			}
 			*outlenp = inlen;
 			return (0);
+		case SO_REUSEPORT:
+			if (!checkonly) {
+				return (tcp_set_reuseport(connp, *i1 != 0));
+			}
+			return (0);
 		}
 		break;
 	case IPPROTO_TCP:
@@ -976,10 +1081,6 @@ tcp_opt_set(conn_t *connp, uint_t optset_context, int level, int name,
 		}
 		break;
 	case IPPROTO_IP:
-		if (connp->conn_family != AF_INET) {
-			*outlenp = 0;
-			return (EINVAL);
-		}
 		switch (name) {
 		case IP_SEC_OPT:
 			/*
diff --git a/usr/src/uts/common/inet/tcp/tcp_socket.c b/usr/src/uts/common/inet/tcp/tcp_socket.c
index a431bf63d1..2de76ea060 100644
--- a/usr/src/uts/common/inet/tcp/tcp_socket.c
+++ b/usr/src/uts/common/inet/tcp/tcp_socket.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /* This file contains all TCP kernel socket related functions. */
@@ -221,7 +222,7 @@ tcp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
 		error = tcp_do_bind(connp, sa, len, cr, B_TRUE);
 	}
 
-	squeue_synch_exit(connp);
+	squeue_synch_exit(connp, SQ_NODRAIN);
 
 	if (error < 0) {
 		if (error == -TOUTSTATE)
@@ -268,7 +269,7 @@ tcp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
 		else
 			error = proto_tlitosyserr(-error);
 	}
-	squeue_synch_exit(connp);
+	squeue_synch_exit(connp, SQ_NODRAIN);
 	return (error);
 }
 
@@ -332,7 +333,13 @@ tcp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
 		    connp->conn_upper_handle, &sopp);
 	}
 done:
-	squeue_synch_exit(connp);
+	/*
+	 * Indicate (via SQ_PROCESS) that it is acceptable for the squeue to
+	 * attempt to drain a pending request relevant to this connection when
+	 * exiting the synchronous context.  This can improve the performance
+	 * and efficiency of TCP connect(2) operations to localhost.
+	 */
+	squeue_synch_exit(connp, SQ_PROCESS);
 
 	return ((error == 0) ? EINPROGRESS : error);
 }
@@ -401,7 +408,7 @@ tcp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
 	}
 
 	len = tcp_opt_get(connp, level, option_name, optvalp_buf);
-	squeue_synch_exit(connp);
+	squeue_synch_exit(connp, SQ_NODRAIN);
 
 	if (len == -1) {
 		kmem_free(optvalp_buf, max_optbuf_len);
@@ -462,14 +469,14 @@ tcp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
 		if (error < 0) {
 			error = proto_tlitosyserr(-error);
 		}
-		squeue_synch_exit(connp);
+		squeue_synch_exit(connp, SQ_NODRAIN);
 		return (error);
 	}
 
 	error = tcp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name,
 	    optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp,
 	    NULL, cr);
-	squeue_synch_exit(connp);
+	squeue_synch_exit(connp, SQ_NODRAIN);
 
 	ASSERT(error >= 0);
 
@@ -645,7 +652,7 @@ tcp_clr_flowctrl(sock_lower_handle_t proto_handle)
 		}
 	}
 
-	squeue_synch_exit(connp);
+	squeue_synch_exit(connp, SQ_NODRAIN);
 }
 
 /* ARGSUSED */
@@ -1022,6 +1029,16 @@ tcp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
 	}
 
 	/*
+	 * Do not allow fallback on connections making use of SO_REUSEPORT.
+	 */
+	if (tcp->tcp_rg_bind != NULL) {
+		freeb(stropt_mp);
+		freeb(ordrel_mp);
+		squeue_synch_exit(connp, SQ_NODRAIN);
+		return (EINVAL);
+	}
+
+	/*
 	 * Both endpoints must be of the same type (either STREAMS or
 	 * non-STREAMS) for fusion to be enabled. So if we are fused,
 	 * we have to unfuse.
@@ -1051,7 +1068,7 @@ tcp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
 	 * There should be atleast two ref's (IP + TCP)
 	 */
 	ASSERT(connp->conn_ref >= 2);
-	squeue_synch_exit(connp);
+	squeue_synch_exit(connp, SQ_NODRAIN);
 
 	return (0);
 }
diff --git a/usr/src/uts/common/inet/tcp_impl.h b/usr/src/uts/common/inet/tcp_impl.h
index ab7ffa4594..8a9efa8e11 100644
--- a/usr/src/uts/common/inet/tcp_impl.h
+++ b/usr/src/uts/common/inet/tcp_impl.h
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2017 Joyent, Inc.
  * Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved.
  * Copyright (c) 2013, 2014 by Delphix. All rights reserved.
  */
@@ -61,9 +61,9 @@ extern sock_downcalls_t sock_tcp_downcalls;
  * by setting it to 0.
  */
 #define	TCP_XMIT_LOWATER	4096
-#define	TCP_XMIT_HIWATER	49152
+#define	TCP_XMIT_HIWATER	128000
 #define	TCP_RECV_LOWATER	2048
-#define	TCP_RECV_HIWATER	128000
+#define	TCP_RECV_HIWATER	1048576
 
 /*
  * Bind hash list size and has function.  It has to be a power of 2 for
@@ -406,6 +406,22 @@ typedef struct tcp_listen_cnt_s {
 	uint32_t	tlc_drop;
 } tcp_listen_cnt_t;
 
+/*
+ * Track tcp_t entities bound to the same port/address tuple via SO_REUSEPORT.
+ * - tcprg_lock:	Protects the other fields
+ * - tcprg_size:	Allocated size (in entries) of tcprg_members array
+ * - tcprg_count:	Count of occupied tcprg_members slots
+ * - tcprg_active:	Count of members which still have SO_REUSEPORT set
+ * - tcprg_members:	Connections associated with address/port group
+ */
+typedef struct tcp_rg_s {
+	kmutex_t	tcprg_lock;
+	unsigned int	tcprg_size;
+	unsigned int	tcprg_count;
+	unsigned int	tcprg_active;
+	tcp_t		**tcprg_members;
+} tcp_rg_t;
+
 #define	TCP_TLC_REPORT_INTERVAL	(30 * MINUTES)
 
 #define	TCP_DECR_LISTEN_CNT(tcp)					\
@@ -632,7 +648,7 @@ extern int	tcp_rwnd_set(tcp_t *, uint32_t);
 extern int	tcp_set_destination(tcp_t *);
 extern void	tcp_set_ws_value(tcp_t *);
 extern void	tcp_stop_lingering(tcp_t *);
-extern void	tcp_update_pmtu(tcp_t *, boolean_t);
+extern boolean_t	tcp_update_pmtu(tcp_t *, boolean_t);
 extern mblk_t	*tcp_zcopy_backoff(tcp_t *, mblk_t *, boolean_t);
 extern boolean_t	tcp_zcopy_check(tcp_t *);
 extern void	tcp_zcopy_notify(tcp_t *);
@@ -649,6 +665,10 @@ extern in_port_t	tcp_bindi(tcp_t *, in_port_t, const in6_addr_t *,
 			    int, boolean_t, boolean_t, boolean_t);
 extern in_port_t	tcp_update_next_port(in_port_t, const tcp_t *,
 			    boolean_t);
+extern tcp_rg_t *tcp_rg_init(tcp_t *);
+extern boolean_t tcp_rg_remove(tcp_rg_t *, tcp_t *);
+extern void tcp_rg_destroy(tcp_rg_t *);
+extern void tcp_rg_setactive(tcp_rg_t *, boolean_t);
 
 /*
  * Fusion related functions in tcp_fusion.c.
diff --git a/usr/src/uts/common/inet/udp/udp.c b/usr/src/uts/common/inet/udp/udp.c
index 5a15aea4de..a88bac932c 100644
--- a/usr/src/uts/common/inet/udp/udp.c
+++ b/usr/src/uts/common/inet/udp/udp.c
@@ -22,6 +22,7 @@
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -76,7 +77,8 @@
 #include <inet/ipclassifier.h>
 #include <sys/squeue_impl.h>
 #include <inet/ipnet.h>
-#include <sys/ethernet.h>
+#include <sys/vxlan.h>
+#include <inet/inet_hash.h>
 
 #include <sys/tsol/label.h>
 #include <sys/tsol/tnet.h>
@@ -346,6 +348,89 @@ void (*cl_inet_unbind)(netstackid_t stack_id, uint8_t protocol,
 typedef union T_primitives *t_primp_t;
 
 /*
+ * Various protocols that encapsulate UDP have no real use for the source port.
+ * Instead, they want to vary the source port to provide better equal-cost
+ * multipathing and other systems that use fanout. Consider something like
+ * VXLAN. If you're actually sending multiple different streams to a single
+ * host, if you don't vary the source port, then the tuple of ( SRC IP, DST IP,
+ * SRC Port, DST Port) will always be the same.
+ *
+ * Here, we return a port to hash this to, if we know how to hash it. If for
+ * some reason we can't perform an L4 hash, then we just return the default
+ * value, usually the default port. After we determine the hash we transform it
+ * so that it's in the range of [ min, max ].
+ *
+ * We'd like to avoid a pull up for the sake of performing the hash. If the
+ * first mblk_t doesn't have the full protocol header, then we just send it to
+ * the default. If for some reason we have an encapsulated packet that has its
+ * protocol header in different parts of an mblk_t, then we'll go with the
+ * default port. This means that that if a driver isn't consistent about how it
+ * generates the frames for a given flow, it will not always be consistently
+ * hashed. That should be an uncommon event.
+ */
+uint16_t
+udp_srcport_hash(mblk_t *mp, int type, uint16_t min, uint16_t max,
+    uint16_t def)
+{
+	size_t szused = 0;
+	struct ether_header *ether;
+	struct ether_vlan_header *vether;
+	ip6_t *ip6h;
+	ipha_t *ipha;
+	uint16_t sap;
+	uint64_t hash;
+	uint32_t mod;
+
+	ASSERT(min <= max);
+
+	if (type != UDP_HASH_VXLAN)
+		return (def);
+
+	if (!IS_P2ALIGNED(mp->b_rptr, sizeof (uint16_t)))
+		return (def);
+
+	/*
+	 * The following logic is VXLAN specific to get at the header, if we
+	 * have formats, eg. GENEVE, then we should ignore this.
+	 *
+	 * The kernel overlay device often puts a first mblk_t for the data
+	 * which is just the encap. If so, then we're going to use that and try
+	 * to avoid a pull up.
+	 */
+	if (MBLKL(mp) == VXLAN_HDR_LEN) {
+		if (mp->b_cont == NULL)
+			return (def);
+		mp = mp->b_cont;
+		ether = (struct ether_header *)mp->b_rptr;
+	} else if (MBLKL(mp) < VXLAN_HDR_LEN) {
+		return (def);
+	} else {
+		szused = VXLAN_HDR_LEN;
+		ether = (struct ether_header *)((uintptr_t)mp->b_rptr + szused);
+	}
+
+	/* Can we hold a MAC header? */
+	if (MBLKL(mp) + szused < sizeof (struct ether_header))
+		return (def);
+
+	/*
+	 * We need to lie about the starting offset into the message block for
+	 * convenience. Undo it at the end. We know that inet_pkt_hash() won't
+	 * modify the mblk_t.
+	 */
+	mp->b_rptr += szused;
+	hash = inet_pkt_hash(DL_ETHER, mp, INET_PKT_HASH_L2 |
+	    INET_PKT_HASH_L3 | INET_PKT_HASH_L4);
+	mp->b_rptr -= szused;
+
+	if (hash == 0)
+		return (def);
+
+	mod = max - min + 1;
+	return ((hash % mod) + min);
+}
+
+/*
  * Return the next anonymous port in the privileged port range for
  * bind checking.
  *
@@ -1583,6 +1668,16 @@ udp_opt_get(conn_t *connp, t_scalar_t level, t_scalar_t name,
 			*i1 = udp->udp_rcvhdr ? 1 : 0;
 			mutex_exit(&connp->conn_lock);
 			return (sizeof (int));
+		case UDP_SRCPORT_HASH:
+			mutex_enter(&connp->conn_lock);
+			*i1 = udp->udp_vxlanhash;
+			mutex_exit(&connp->conn_lock);
+			return (sizeof (int));
+		case UDP_SND_TO_CONNECTED:
+			mutex_enter(&connp->conn_lock);
+			*i1 = udp->udp_snd_to_conn ? 1 : 0;
+			mutex_exit(&connp->conn_lock);
+			return (sizeof (int));
 		}
 	}
 	mutex_enter(&connp->conn_lock);
@@ -1718,6 +1813,31 @@ udp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
 			udp->udp_rcvhdr = onoff;
 			mutex_exit(&connp->conn_lock);
 			return (0);
+		case UDP_SRCPORT_HASH:
+			/*
+			 * This should have already been verified, but double
+			 * check.
+			 */
+			if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
+				return (error);
+			}
+
+			/* First see if the val is something we understand */
+			if (*i1 != UDP_HASH_DISABLE && *i1 != UDP_HASH_VXLAN)
+				return (EINVAL);
+
+			if (!checkonly) {
+				mutex_enter(&connp->conn_lock);
+				udp->udp_vxlanhash = *i1;
+				mutex_exit(&connp->conn_lock);
+			}
+			/* Fully handled this option. */
+			return (0);
+		case UDP_SND_TO_CONNECTED:
+			mutex_enter(&connp->conn_lock);
+			udp->udp_snd_to_conn = onoff;
+			mutex_exit(&connp->conn_lock);
+			return (0);
 		}
 		break;
 	}
@@ -2001,13 +2121,25 @@ udp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
 	uint32_t	cksum;
 	udp_t		*udp = connp->conn_udp;
 	boolean_t	insert_spi = udp->udp_nat_t_endpoint;
+	boolean_t	hash_srcport = udp->udp_vxlanhash;
 	uint_t		ulp_hdr_len;
+	uint16_t	srcport;
 
 	data_len = msgdsize(data_mp);
 	ulp_hdr_len = UDPH_SIZE;
 	if (insert_spi)
 		ulp_hdr_len += sizeof (uint32_t);
 
+	/*
+	 * If we have source port hashing going on, determine the hash before
+	 * we modify the mblk_t.
+	 */
+	if (hash_srcport == B_TRUE) {
+		srcport = udp_srcport_hash(mp, UDP_HASH_VXLAN,
+		    IPPORT_DYNAMIC_MIN, IPPORT_DYNAMIC_MAX,
+		    ntohs(connp->conn_lport));
+	}
+
 	mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, IPPROTO_UDP, flowinfo,
 	    ulp_hdr_len, data_mp, data_len, us->us_wroff_extra, &cksum, errorp);
 	if (mp == NULL) {
@@ -2019,7 +2151,11 @@ udp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
 	ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
 
 	udpha = (udpha_t *)(mp->b_rptr + ixa->ixa_ip_hdr_length);
-	udpha->uha_src_port = connp->conn_lport;
+	if (hash_srcport == B_TRUE) {
+		udpha->uha_src_port = htons(srcport);
+	} else {
+		udpha->uha_src_port = connp->conn_lport;
+	}
 	udpha->uha_dst_port = dstport;
 	udpha->uha_checksum = 0;
 	udpha->uha_length = htons(data_len);
@@ -3194,6 +3330,7 @@ udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
 	udp_t		*udp = connp->conn_udp;
 	udp_stack_t	*us = udp->udp_us;
 	boolean_t	insert_spi = udp->udp_nat_t_endpoint;
+	boolean_t	hash_srcport = udp->udp_vxlanhash;
 	uint_t		pktlen;
 	uint_t		alloclen;
 	uint_t		copylen;
@@ -3202,10 +3339,21 @@ udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
 	udpha_t		*udpha;
 	uint32_t	cksum;
 	ip_pkt_t	*ipp;
+	uint16_t	srcport;
 
 	ASSERT(MUTEX_HELD(&connp->conn_lock));
 
 	/*
+	 * If we have source port hashing going on, determine the hash before
+	 * we modify the mblk_t.
+	 */
+	if (hash_srcport == B_TRUE) {
+		srcport = udp_srcport_hash(mp, UDP_HASH_VXLAN,
+		    IPPORT_DYNAMIC_MIN, IPPORT_DYNAMIC_MAX,
+		    ntohs(connp->conn_lport));
+	}
+
+	/*
 	 * Copy the header template and leave space for an SPI
 	 */
 	copylen = connp->conn_ht_iphc_len;
@@ -3303,6 +3451,9 @@ udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
 		*((uint32_t *)(udpha + 1)) = 0;
 
 	udpha->uha_dst_port = dstport;
+	if (hash_srcport == B_TRUE)
+		udpha->uha_src_port = htons(srcport);
+
 	return (mp);
 }
 
@@ -5947,10 +6098,18 @@ udp_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
 		else
 			return (error);
 	}
-	if (udp->udp_state == TS_DATA_XFER) {
+
+	/*
+	 * Check if we're allowed to send to a connection on which we've
+	 * already called 'connect'. The posix spec. allows both behaviors but
+	 * historically we've returned an error if already connected. The
+	 * client can allow this via a sockopt.
+	 */
+	if (udp->udp_state == TS_DATA_XFER && !udp->udp_snd_to_conn) {
 		UDPS_BUMP_MIB(us, udpOutErrors);
 		return (EISCONN);
 	}
+
 	error = proto_verify_ip_addr(connp->conn_family,
 	    (struct sockaddr *)msg->msg_name, msg->msg_namelen);
 	if (error != 0) {
diff --git a/usr/src/uts/common/inet/udp/udp_opt_data.c b/usr/src/uts/common/inet/udp/udp_opt_data.c
index c279bb4a21..847e2cdde6 100644
--- a/usr/src/uts/common/inet/udp/udp_opt_data.c
+++ b/usr/src/uts/common/inet/udp/udp_opt_data.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -292,6 +293,9 @@ opdes_t	udp_opt_arr[] = {
 	},
 { UDP_NAT_T_ENDPOINT, IPPROTO_UDP, OA_RW, OA_RW, OP_PRIVPORT, 0, sizeof (int),
 	0 },
+{ UDP_SRCPORT_HASH, IPPROTO_UDP, OA_R, OA_RW, OP_CONFIG, 0, sizeof (int), 0 },
+{ UDP_SND_TO_CONNECTED, IPPROTO_UDP, OA_R, OA_RW, OP_CONFIG, 0, sizeof (int),
+	0 }
 };
 
 /*
diff --git a/usr/src/uts/common/inet/udp_impl.h b/usr/src/uts/common/inet/udp_impl.h
index 6a31ce5c22..ebba10c0f7 100644
--- a/usr/src/uts/common/inet/udp_impl.h
+++ b/usr/src/uts/common/inet/udp_impl.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #ifndef	_UDP_IMPL_H
@@ -178,8 +179,12 @@ typedef	struct udp_s {
 		udp_issocket : 1,	/* socket mode; sockfs is on top */
 		udp_nat_t_endpoint : 1,	/* UDP_NAT_T_ENDPOINT option */
 		udp_rcvhdr : 1,		/* UDP_RCVHDR option */
+		udp_vxlanhash: 1,	/* UDP_SRCPORT_HASH option */
+					/* Because there's only VXLAN, cheat */
+					/* and only use a single bit */
+		udp_snd_to_conn: 1,	/* UDP_SND_TO_CONNECTED option */
 
-		udp_pad_to_bit_31 : 29;
+		udp_pad_to_bit_31 : 27;
 
 	/* Following 2 fields protected by the uf_lock */
 	struct udp_s	*udp_bind_hash; /* Bind hash chain */
diff --git a/usr/src/uts/common/io/aggr/aggr_grp.c b/usr/src/uts/common/io/aggr/aggr_grp.c
index 3554e111c1..47840951d3 100644
--- a/usr/src/uts/common/io/aggr/aggr_grp.c
+++ b/usr/src/uts/common/io/aggr/aggr_grp.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -32,39 +32,69 @@
  * module. The hash key is the linkid associated with the link
  * aggregation group.
  *
- * A set of MAC ports are associated with each association group.
+ * Each aggregation contains a set of ports. The port is represented
+ * by the aggr_port_t structure. A port consists of a single MAC
+ * client which has exclusive (MCIS_EXCLUSIVE) use of the underlying
+ * MAC. This client is used by the aggr to send and receive LACP
+ * traffic. Each port client takes on the same MAC unicast address --
+ * the address of the aggregation itself (taken from the first port by
+ * default).
  *
- * Aggr pseudo TX rings
- * --------------------
- * The underlying ports (NICs) in an aggregation can have TX rings. To
- * enhance aggr's performance, these TX rings are made available to the
- * aggr layer as pseudo TX rings. The concept of pseudo rings are not new.
- * They are already present and implemented on the RX side. It is called
- * as pseudo RX rings. The same concept is extended to the TX side where
- * each TX ring of an underlying port is reflected in aggr as a pseudo
- * TX ring. Thus each pseudo TX ring will map to a specific hardware TX
- * ring. Even in the case of a NIC that does not have a TX ring, a pseudo
- * TX ring is given to the aggregation layer.
+ * The MAC client that hangs off each aggr port is not your typical
+ * MAC client. Not only does it have exclusive control of the MAC, but
+ * it also has no Tx or Rx SRSes. An SRS is designed to queue and
+ * fanout traffic among L4 protocols; but the aggr is an intermediary,
+ * not a consumer. Instead of using SRSes, the aggr puts the
+ * underlying hardware rings into passthru mode and ships packets up
+ * via a direct call to aggr_recv_cb(). This allows aggr to enforce
+ * LACP while passing all other traffic up to clients of the aggr.
+ *
+ * Pseudo Rx Groups and Rings
+ * --------------------------
+ *
+ * It is imperative for client performance that the aggr provide as
+ * many MAC groups as possible. In order to use the underlying HW
+ * resources, aggr creates pseudo groups to aggregate the underlying
+ * HW groups. Every HW group gets mapped to a pseudo group; and every
+ * HW ring in that group gets mapped to a pseudo ring. The pseudo
+ * group at index 0 combines all the HW groups at index 0 from each
+ * port, etc. The aggr's MAC then creates normal MAC groups and rings
+ * out of these pseudo groups and rings to present to the aggr's
+ * clients. To the clients, the aggr's groups and rings are absolutely
+ * no different than a NIC's groups or rings.
+ *
+ * Pseudo Tx Rings
+ * ---------------
+ *
+ * The underlying ports (NICs) in an aggregation can have Tx rings. To
+ * enhance aggr's performance, these Tx rings are made available to
+ * the aggr layer as pseudo Tx rings. The concept of pseudo rings are
+ * not new. They are already present and implemented on the Rx side.
+ * The same concept is extended to the Tx side where each Tx ring of
+ * an underlying port is reflected in aggr as a pseudo Tx ring. Thus
+ * each pseudo Tx ring will map to a specific hardware Tx ring. Even
+ * in the case of a NIC that does not have a Tx ring, a pseudo Tx ring
+ * is given to the aggregation layer.
  *
  * With this change, the outgoing stack depth looks much better:
  *
  * mac_tx() -> mac_tx_aggr_mode() -> mac_tx_soft_ring_process() ->
  * mac_tx_send() -> aggr_ring_rx() -> <driver>_ring_tx()
  *
- * Two new modes are introduced to mac_tx() to handle aggr pseudo TX rings:
+ * Two new modes are introduced to mac_tx() to handle aggr pseudo Tx rings:
  * SRS_TX_AGGR and SRS_TX_BW_AGGR.
  *
  * In SRS_TX_AGGR mode, mac_tx_aggr_mode() routine is called. This routine
- * invokes an aggr function, aggr_find_tx_ring(), to find a (pseudo) TX
+ * invokes an aggr function, aggr_find_tx_ring(), to find a (pseudo) Tx
  * ring belonging to a port on which the packet has to be sent.
  * aggr_find_tx_ring() first finds the outgoing port based on L2/L3/L4
- * policy and then uses the fanout_hint passed to it to pick a TX ring from
+ * policy and then uses the fanout_hint passed to it to pick a Tx ring from
  * the selected port.
  *
  * In SRS_TX_BW_AGGR mode, mac_tx_bw_mode() function is called where
  * bandwidth limit is applied first on the outgoing packet and the packets
  * allowed to go out would call mac_tx_aggr_mode() to send the packet on a
- * particular TX ring.
+ * particular Tx ring.
  */
 
 #include <sys/types.h>
@@ -121,10 +151,12 @@ static int aggr_add_pseudo_rx_group(aggr_port_t *, aggr_pseudo_rx_group_t *);
 static void aggr_rem_pseudo_rx_group(aggr_port_t *, aggr_pseudo_rx_group_t *);
 static int aggr_pseudo_disable_intr(mac_intr_handle_t);
 static int aggr_pseudo_enable_intr(mac_intr_handle_t);
-static int aggr_pseudo_start_ring(mac_ring_driver_t, uint64_t);
-static void aggr_pseudo_stop_ring(mac_ring_driver_t);
+static int aggr_pseudo_start_rx_ring(mac_ring_driver_t, uint64_t);
+static void aggr_pseudo_stop_rx_ring(mac_ring_driver_t);
 static int aggr_addmac(void *, const uint8_t *);
 static int aggr_remmac(void *, const uint8_t *);
+static int aggr_addvlan(mac_group_driver_t, uint16_t);
+static int aggr_remvlan(mac_group_driver_t, uint16_t);
 static mblk_t *aggr_rx_poll(void *, int);
 static void aggr_fill_ring(void *, mac_ring_type_t, const int,
     const int, mac_ring_info_t *, mac_ring_handle_t);
@@ -325,6 +357,7 @@ aggr_grp_attach_port(aggr_grp_t *grp, aggr_port_t *port)
 		return (B_FALSE);
 	}
 
+	mutex_enter(&grp->lg_stat_lock);
 	if (grp->lg_ifspeed == 0) {
 		/*
 		 * The group inherits the speed of the first link being
@@ -338,8 +371,10 @@ aggr_grp_attach_port(aggr_grp_t *grp, aggr_port_t *port)
 		 * the group link speed, as per 802.3ad. Since it is
 		 * not, the attach is cancelled.
 		 */
+		mutex_exit(&grp->lg_stat_lock);
 		return (B_FALSE);
 	}
+	mutex_exit(&grp->lg_stat_lock);
 
 	grp->lg_nattached_ports++;
 
@@ -348,7 +383,9 @@ aggr_grp_attach_port(aggr_grp_t *grp, aggr_port_t *port)
 	 */
 	if (grp->lg_link_state != LINK_STATE_UP) {
 		grp->lg_link_state = LINK_STATE_UP;
+		mutex_enter(&grp->lg_stat_lock);
 		grp->lg_link_duplex = LINK_DUPLEX_FULL;
+		mutex_exit(&grp->lg_stat_lock);
 		link_state_changed = B_TRUE;
 	}
 
@@ -360,9 +397,13 @@ aggr_grp_attach_port(aggr_grp_t *grp, aggr_port_t *port)
 	aggr_grp_multicst_port(port, B_TRUE);
 
 	/*
-	 * Set port's receive callback
+	 * The port client doesn't have an Rx SRS; instead of calling
+	 * mac_rx_set() we set the client's flow callback directly.
+	 * This datapath is used only when the port's driver doesn't
+	 * support MAC_CAPAB_RINGS. Drivers with ring support will
+	 * deliver traffic to the aggr via ring passthru.
 	 */
-	mac_rx_set(port->lp_mch, aggr_recv_cb, port);
+	mac_client_set_flow_cb(port->lp_mch, aggr_recv_cb, port);
 
 	/*
 	 * If LACP is OFF, the port can be used to send data as soon
@@ -392,7 +433,7 @@ aggr_grp_detach_port(aggr_grp_t *grp, aggr_port_t *port)
 	if (port->lp_state != AGGR_PORT_STATE_ATTACHED)
 		return (B_FALSE);
 
-	mac_rx_clear(port->lp_mch);
+	mac_client_clear_flow_cb(port->lp_mch);
 
 	aggr_grp_multicst_port(port, B_FALSE);
 
@@ -406,9 +447,11 @@ aggr_grp_detach_port(aggr_grp_t *grp, aggr_port_t *port)
 	grp->lg_nattached_ports--;
 	if (grp->lg_nattached_ports == 0) {
 		/* the last attached MAC port of the group is being detached */
-		grp->lg_ifspeed = 0;
 		grp->lg_link_state = LINK_STATE_DOWN;
+		mutex_enter(&grp->lg_stat_lock);
+		grp->lg_ifspeed = 0;
 		grp->lg_link_duplex = LINK_DUPLEX_UNKNOWN;
+		mutex_exit(&grp->lg_stat_lock);
 		link_state_changed = B_TRUE;
 	}
 
@@ -529,26 +572,27 @@ aggr_grp_add_port(aggr_grp_t *grp, datalink_id_t port_linkid, boolean_t force,
 	zoneid_t port_zoneid = ALL_ZONES;
 	int err;
 
-	/* The port must be int the same zone as the aggregation. */
+	/* The port must be in the same zone as the aggregation. */
 	if (zone_check_datalink(&port_zoneid, port_linkid) != 0)
 		port_zoneid = GLOBAL_ZONEID;
 	if (grp->lg_zoneid != port_zoneid)
 		return (EBUSY);
 
 	/*
-	 * lg_mh could be NULL when the function is called during the creation
-	 * of the aggregation.
+	 * If we are creating the aggr, then there is no MAC handle
+	 * and thus no perimeter to hold. If we are adding a port to
+	 * an existing aggr, then the perimiter of the aggr's MAC must
+	 * be held.
 	 */
 	ASSERT(grp->lg_mh == NULL || MAC_PERIM_HELD(grp->lg_mh));
 
-	/* create new port */
 	err = aggr_port_create(grp, port_linkid, force, &port);
 	if (err != 0)
 		return (err);
 
 	mac_perim_enter_by_mh(port->lp_mh, &mph);
 
-	/* add port to list of group constituent ports */
+	/* Add the new port to the end of the list. */
 	cport = &grp->lg_ports;
 	while (*cport != NULL)
 		cport = &((*cport)->lp_next);
@@ -630,6 +674,7 @@ aggr_add_pseudo_rx_ring(aggr_port_t *port,
 	ring->arr_flags |= MAC_PSEUDO_RING_INUSE;
 	ring->arr_hw_rh = hw_rh;
 	ring->arr_port = port;
+	ring->arr_grp = rx_grp;
 	rx_grp->arg_ring_cnt++;
 
 	/*
@@ -640,10 +685,15 @@ aggr_add_pseudo_rx_ring(aggr_port_t *port,
 		ring->arr_flags &= ~MAC_PSEUDO_RING_INUSE;
 		ring->arr_hw_rh = NULL;
 		ring->arr_port = NULL;
+		ring->arr_grp = NULL;
 		rx_grp->arg_ring_cnt--;
 	} else {
-		mac_hwring_setup(hw_rh, (mac_resource_handle_t)ring,
-		    mac_find_ring(rx_grp->arg_gh, j));
+		/*
+		 * This must run after the MAC is registered.
+		 */
+		ASSERT3P(ring->arr_rh, !=, NULL);
+		mac_hwring_set_passthru(hw_rh, (mac_rx_t)aggr_recv_cb,
+		    (void *)port, (mac_resource_handle_t)ring);
 	}
 	return (err);
 }
@@ -654,11 +704,9 @@ aggr_add_pseudo_rx_ring(aggr_port_t *port,
 static void
 aggr_rem_pseudo_rx_ring(aggr_pseudo_rx_group_t *rx_grp, mac_ring_handle_t hw_rh)
 {
-	aggr_pseudo_rx_ring_t	*ring;
-	int			j;
+	for (uint_t j = 0; j < MAX_RINGS_PER_GROUP; j++) {
+		aggr_pseudo_rx_ring_t *ring = rx_grp->arg_rings + j;
 
-	for (j = 0; j < MAX_RINGS_PER_GROUP; j++) {
-		ring = rx_grp->arg_rings + j;
 		if (!(ring->arr_flags & MAC_PSEUDO_RING_INUSE) ||
 		    ring->arr_hw_rh != hw_rh) {
 			continue;
@@ -669,134 +717,140 @@ aggr_rem_pseudo_rx_ring(aggr_pseudo_rx_group_t *rx_grp, mac_ring_handle_t hw_rh)
 		ring->arr_flags &= ~MAC_PSEUDO_RING_INUSE;
 		ring->arr_hw_rh = NULL;
 		ring->arr_port = NULL;
+		ring->arr_grp = NULL;
 		rx_grp->arg_ring_cnt--;
-		mac_hwring_teardown(hw_rh);
+		mac_hwring_clear_passthru(hw_rh);
 		break;
 	}
 }
 
 /*
- * This function is called to create pseudo rings over the hardware rings of
- * the underlying device. Note that there is a 1:1 mapping between the pseudo
- * RX rings of the aggr and the hardware rings of the underlying port.
+ * Create pseudo rings over the HW rings of the port.
+ *
+ * o Create a pseudo ring in rx_grp per HW ring in the port's HW group.
+ *
+ * o Program existing unicast filters on the pseudo group into the HW group.
+ *
+ * o Program existing VLAN filters on the pseudo group into the HW group.
  */
 static int
 aggr_add_pseudo_rx_group(aggr_port_t *port, aggr_pseudo_rx_group_t *rx_grp)
 {
-	aggr_grp_t		*grp = port->lp_grp;
 	mac_ring_handle_t	hw_rh[MAX_RINGS_PER_GROUP];
 	aggr_unicst_addr_t	*addr, *a;
 	mac_perim_handle_t	pmph;
-	int			hw_rh_cnt, i = 0, j;
+	aggr_vlan_t		*avp;
+	uint_t			hw_rh_cnt, i;
 	int			err = 0;
+	uint_t			g_idx = rx_grp->arg_index;
 
-	ASSERT(MAC_PERIM_HELD(grp->lg_mh));
+	ASSERT(MAC_PERIM_HELD(port->lp_grp->lg_mh));
+	ASSERT3U(g_idx, <, MAX_GROUPS_PER_PORT);
 	mac_perim_enter_by_mh(port->lp_mh, &pmph);
 
 	/*
-	 * This function must be called after the aggr registers its mac
-	 * and its RX group has been initialized.
+	 * This function must be called after the aggr registers its
+	 * MAC and its Rx groups have been initialized.
 	 */
 	ASSERT(rx_grp->arg_gh != NULL);
 
 	/*
-	 * Get the list the the underlying HW rings.
+	 * Get the list of the underlying HW rings.
 	 */
-	hw_rh_cnt = mac_hwrings_get(port->lp_mch,
-	    &port->lp_hwgh, hw_rh, MAC_RING_TYPE_RX);
-
-	if (port->lp_hwgh != NULL) {
-		/*
-		 * Quiesce the HW ring and the mac srs on the ring. Note
-		 * that the HW ring will be restarted when the pseudo ring
-		 * is started. At that time all the packets will be
-		 * directly passed up to the pseudo RX ring and handled
-		 * by mac srs created over the pseudo RX ring.
-		 */
-		mac_rx_client_quiesce(port->lp_mch);
-		mac_srs_perm_quiesce(port->lp_mch, B_TRUE);
-	}
+	hw_rh_cnt = mac_hwrings_idx_get(port->lp_mh, g_idx,
+	    &port->lp_hwghs[g_idx], hw_rh, MAC_RING_TYPE_RX);
 
 	/*
-	 * Add all the unicast addresses to the newly added port.
+	 * Add existing VLAN and unicast address filters to the port.
 	 */
+	for (avp = list_head(&rx_grp->arg_vlans); avp != NULL;
+	    avp = list_next(&rx_grp->arg_vlans, avp)) {
+		if ((err = aggr_port_addvlan(port, g_idx, avp->av_vid)) != 0)
+			goto err;
+	}
+
 	for (addr = rx_grp->arg_macaddr; addr != NULL; addr = addr->aua_next) {
-		if ((err = aggr_port_addmac(port, addr->aua_addr)) != 0)
-			break;
+		if ((err = aggr_port_addmac(port, g_idx, addr->aua_addr)) != 0)
+			goto err;
 	}
 
-	for (i = 0; err == 0 && i < hw_rh_cnt; i++)
+	for (i = 0; i < hw_rh_cnt; i++) {
 		err = aggr_add_pseudo_rx_ring(port, rx_grp, hw_rh[i]);
+		if (err != 0)
+			goto err;
+	}
 
-	if (err != 0) {
-		for (j = 0; j < i; j++)
-			aggr_rem_pseudo_rx_ring(rx_grp, hw_rh[j]);
+	mac_perim_exit(pmph);
+	return (0);
+
+err:
+	ASSERT(err != 0);
+
+	for (uint_t j = 0; j < i; j++)
+		aggr_rem_pseudo_rx_ring(rx_grp, hw_rh[j]);
+
+	for (a = rx_grp->arg_macaddr; a != addr; a = a->aua_next)
+		aggr_port_remmac(port, g_idx, a->aua_addr);
 
-		for (a = rx_grp->arg_macaddr; a != addr; a = a->aua_next)
-			aggr_port_remmac(port, a->aua_addr);
+	if (avp != NULL)
+		avp = list_prev(&rx_grp->arg_vlans, avp);
 
-		if (port->lp_hwgh != NULL) {
-			mac_srs_perm_quiesce(port->lp_mch, B_FALSE);
-			mac_rx_client_restart(port->lp_mch);
-			port->lp_hwgh = NULL;
+	for (; avp != NULL; avp = list_prev(&rx_grp->arg_vlans, avp)) {
+		int err2;
+
+		if ((err2 = aggr_port_remvlan(port, g_idx, avp->av_vid)) != 0) {
+			cmn_err(CE_WARN, "Failed to remove VLAN %u from port %s"
+			    ": errno %d.", avp->av_vid,
+			    mac_client_name(port->lp_mch), err2);
 		}
-	} else {
-		port->lp_rx_grp_added = B_TRUE;
 	}
-done:
+
+	port->lp_hwghs[g_idx] = NULL;
 	mac_perim_exit(pmph);
 	return (err);
 }
 
 /*
- * This function is called by aggr to remove pseudo RX rings over the
- * HW rings of the underlying port.
+ * Destroy the pseudo rings mapping to this port and remove all VLAN
+ * and unicast filters from this port. Even if there are no underlying
+ * HW rings we must still remove the unicast filters to take the port
+ * out of promisc mode.
  */
 static void
 aggr_rem_pseudo_rx_group(aggr_port_t *port, aggr_pseudo_rx_group_t *rx_grp)
 {
-	aggr_grp_t		*grp = port->lp_grp;
 	mac_ring_handle_t	hw_rh[MAX_RINGS_PER_GROUP];
 	aggr_unicst_addr_t	*addr;
-	mac_group_handle_t	hwgh;
 	mac_perim_handle_t	pmph;
-	int			hw_rh_cnt, i;
+	uint_t			hw_rh_cnt;
+	uint_t			g_idx = rx_grp->arg_index;
 
-	ASSERT(MAC_PERIM_HELD(grp->lg_mh));
+	ASSERT(MAC_PERIM_HELD(port->lp_grp->lg_mh));
+	ASSERT3U(g_idx, <, MAX_GROUPS_PER_PORT);
+	ASSERT3P(rx_grp->arg_gh, !=, NULL);
 	mac_perim_enter_by_mh(port->lp_mh, &pmph);
 
-	if (!port->lp_rx_grp_added)
-		goto done;
-
-	ASSERT(rx_grp->arg_gh != NULL);
-	hw_rh_cnt = mac_hwrings_get(port->lp_mch,
-	    &hwgh, hw_rh, MAC_RING_TYPE_RX);
+	hw_rh_cnt = mac_hwrings_idx_get(port->lp_mh, g_idx, NULL, hw_rh,
+	    MAC_RING_TYPE_RX);
 
-	/*
-	 * If hw_rh_cnt is 0, it means that the underlying port does not
-	 * support RX rings. Directly return in this case.
-	 */
-	for (i = 0; i < hw_rh_cnt; i++)
+	for (uint_t i = 0; i < hw_rh_cnt; i++)
 		aggr_rem_pseudo_rx_ring(rx_grp, hw_rh[i]);
 
 	for (addr = rx_grp->arg_macaddr; addr != NULL; addr = addr->aua_next)
-		aggr_port_remmac(port, addr->aua_addr);
+		aggr_port_remmac(port, g_idx, addr->aua_addr);
 
-	if (port->lp_hwgh != NULL) {
-		port->lp_hwgh = NULL;
+	for (aggr_vlan_t *avp = list_head(&rx_grp->arg_vlans); avp != NULL;
+	    avp = list_next(&rx_grp->arg_vlans, avp)) {
+		int err;
 
-		/*
-		 * First clear the permanent-quiesced flag of the RX srs then
-		 * restart the HW ring and the mac srs on the ring. Note that
-		 * the HW ring and associated SRS will soon been removed when
-		 * the port is removed from the aggr.
-		 */
-		mac_srs_perm_quiesce(port->lp_mch, B_FALSE);
-		mac_rx_client_restart(port->lp_mch);
+		if ((err = aggr_port_remvlan(port, g_idx, avp->av_vid)) != 0) {
+			cmn_err(CE_WARN, "Failed to remove VLAN %u from port %s"
+			    ": errno %d.", avp->av_vid,
+			    mac_client_name(port->lp_mch), err);
+		}
 	}
 
-	port->lp_rx_grp_added = B_FALSE;
-done:
+	port->lp_hwghs[g_idx] = NULL;
 	mac_perim_exit(pmph);
 }
 
@@ -900,8 +954,8 @@ aggr_add_pseudo_tx_group(aggr_port_t *port, aggr_pseudo_tx_group_t *tx_grp)
 	/*
 	 * Get the list the the underlying HW rings.
 	 */
-	hw_rh_cnt = mac_hwrings_get(port->lp_mch,
-	    NULL, hw_rh, MAC_RING_TYPE_TX);
+	hw_rh_cnt = mac_hwrings_get(port->lp_mch, NULL, hw_rh,
+	    MAC_RING_TYPE_TX);
 
 	/*
 	 * Even if the underlying NIC does not have TX rings, we
@@ -1006,23 +1060,46 @@ aggr_pseudo_enable_intr(mac_intr_handle_t ih)
 	return (mac_hwring_enable_intr(rr_ring->arr_hw_rh));
 }
 
+/*
+ * Start the pseudo ring. Since the pseudo ring is just an abstraction
+ * over an actual HW ring, the real task is to start the underlying HW
+ * ring.
+ */
 static int
-aggr_pseudo_start_ring(mac_ring_driver_t arg, uint64_t mr_gen)
+aggr_pseudo_start_rx_ring(mac_ring_driver_t arg, uint64_t mr_gen)
 {
-	aggr_pseudo_rx_ring_t *rr_ring = (aggr_pseudo_rx_ring_t *)arg;
 	int err;
+	aggr_pseudo_rx_ring_t *rr_ring = (aggr_pseudo_rx_ring_t *)arg;
 
 	err = mac_hwring_start(rr_ring->arr_hw_rh);
-	if (err == 0)
-		rr_ring->arr_gen = mr_gen;
+
+	if (err != 0)
+		return (err);
+
+	rr_ring->arr_gen = mr_gen;
 	return (err);
 }
 
+/*
+ * Stop the pseudo ring. Since the pseudo ring is just an abstraction
+ * over an actual HW ring, the real task is to stop the underlying HW
+ * ring.
+ */
 static void
-aggr_pseudo_stop_ring(mac_ring_driver_t arg)
+aggr_pseudo_stop_rx_ring(mac_ring_driver_t arg)
 {
 	aggr_pseudo_rx_ring_t *rr_ring = (aggr_pseudo_rx_ring_t *)arg;
-	mac_hwring_stop(rr_ring->arr_hw_rh);
+
+	/*
+	 * The rings underlying the default group must stay up to
+	 * continue receiving LACP traffic. We would normally never
+	 * stop the default Rx rings because of the primary MAC
+	 * client; but aggr's primary MAC client doesn't call
+	 * mac_unicast_add() and thus mi_active is 0 when the last
+	 * non-primary client is deleted.
+	 */
+	if (rr_ring->arr_grp->arg_index != 0)
+		mac_hwring_stop(rr_ring->arr_hw_rh);
 }
 
 /*
@@ -1032,13 +1109,15 @@ int
 aggr_grp_add_ports(datalink_id_t linkid, uint_t nports, boolean_t force,
     laioc_port_t *ports)
 {
-	int rc, i, nadded = 0;
+	int rc;
+	uint_t port_added = 0;
+	uint_t grp_added;
 	aggr_grp_t *grp = NULL;
 	aggr_port_t *port;
 	boolean_t link_state_changed = B_FALSE;
 	mac_perim_handle_t mph, pmph;
 
-	/* get group corresponding to linkid */
+	/* Get the aggr corresponding to linkid. */
 	rw_enter(&aggr_grp_lock, RW_READER);
 	if (mod_hash_find(aggr_grp_hash, GRP_HASH_KEY(linkid),
 	    (mod_hash_val_t *)&grp) != 0) {
@@ -1048,20 +1127,22 @@ aggr_grp_add_ports(datalink_id_t linkid, uint_t nports, boolean_t force,
 	AGGR_GRP_REFHOLD(grp);
 
 	/*
-	 * Hold the perimeter so that the aggregation won't be destroyed.
+	 * Hold the perimeter so that the aggregation can't be destroyed.
 	 */
 	mac_perim_enter_by_mh(grp->lg_mh, &mph);
 	rw_exit(&aggr_grp_lock);
 
-	/* add the specified ports to group */
-	for (i = 0; i < nports; i++) {
-		/* add port to group */
+	/* Add the specified ports to the aggr. */
+	for (uint_t i = 0; i < nports; i++) {
+		grp_added = 0;
+
 		if ((rc = aggr_grp_add_port(grp, ports[i].lp_linkid,
 		    force, &port)) != 0) {
 			goto bail;
 		}
+
 		ASSERT(port != NULL);
-		nadded++;
+		port_added++;
 
 		/* check capabilities */
 		if (!aggr_grp_capab_check(grp, port) ||
@@ -1078,9 +1159,16 @@ aggr_grp_add_ports(datalink_id_t linkid, uint_t nports, boolean_t force,
 		rc = aggr_add_pseudo_tx_group(port, &grp->lg_tx_group);
 		if (rc != 0)
 			goto bail;
-		rc = aggr_add_pseudo_rx_group(port, &grp->lg_rx_group);
-		if (rc != 0)
-			goto bail;
+
+		for (uint_t j = 0; j < grp->lg_rx_group_count; j++) {
+			rc = aggr_add_pseudo_rx_group(port,
+			    &grp->lg_rx_groups[j]);
+
+			if (rc != 0)
+				goto bail;
+
+			grp_added++;
+		}
 
 		mac_perim_enter_by_mh(port->lp_mh, &pmph);
 
@@ -1098,7 +1186,7 @@ aggr_grp_add_ports(datalink_id_t linkid, uint_t nports, boolean_t force,
 			/*
 			 * Turn on the promiscuous mode over the port when it
 			 * is requested to be turned on to receive the
-			 * non-primary address over a port, or the promiscous
+			 * non-primary address over a port, or the promiscuous
 			 * mode is enabled over the aggr.
 			 */
 			if (grp->lg_promisc || port->lp_prom_addr != NULL) {
@@ -1133,17 +1221,33 @@ aggr_grp_add_ports(datalink_id_t linkid, uint_t nports, boolean_t force,
 bail:
 	if (rc != 0) {
 		/* stop and remove ports that have been added */
-		for (i = 0; i < nadded; i++) {
+		for (uint_t i = 0; i < port_added; i++) {
+			uint_t grp_remove;
+
 			port = aggr_grp_port_lookup(grp, ports[i].lp_linkid);
 			ASSERT(port != NULL);
+
 			if (grp->lg_started) {
 				mac_perim_enter_by_mh(port->lp_mh, &pmph);
 				(void) aggr_port_promisc(port, B_FALSE);
 				aggr_port_stop(port);
 				mac_perim_exit(pmph);
 			}
+
 			aggr_rem_pseudo_tx_group(port, &grp->lg_tx_group);
-			aggr_rem_pseudo_rx_group(port, &grp->lg_rx_group);
+
+			/*
+			 * Only the last port could have a partial set
+			 * of groups added.
+			 */
+			grp_remove = (i + 1 == port_added) ? grp_added :
+			    grp->lg_rx_group_count;
+
+			for (uint_t j = 0; j < grp_remove; j++) {
+				aggr_rem_pseudo_rx_group(port,
+				    &grp->lg_rx_groups[j]);
+			}
+
 			(void) aggr_grp_rem_port(grp, port, NULL, NULL);
 		}
 	}
@@ -1305,7 +1409,8 @@ aggr_grp_create(datalink_id_t linkid, uint32_t key, uint_t nports,
 	grp->lg_tx_blocked_rings = kmem_zalloc((sizeof (mac_ring_handle_t *) *
 	    MAX_RINGS_PER_GROUP), KM_SLEEP);
 	grp->lg_tx_blocked_cnt = 0;
-	bzero(&grp->lg_rx_group, sizeof (aggr_pseudo_rx_group_t));
+	bzero(&grp->lg_rx_groups,
+	    sizeof (aggr_pseudo_rx_group_t) * MAX_GROUPS_PER_PORT);
 	bzero(&grp->lg_tx_group, sizeof (aggr_pseudo_tx_group_t));
 	aggr_lacp_init_grp(grp);
 
@@ -1325,11 +1430,48 @@ aggr_grp_create(datalink_id_t linkid, uint32_t key, uint_t nports,
 	grp->lg_key = key;
 
 	for (i = 0; i < nports; i++) {
-		err = aggr_grp_add_port(grp, ports[i].lp_linkid, force, NULL);
+		err = aggr_grp_add_port(grp, ports[i].lp_linkid, force, &port);
 		if (err != 0)
 			goto bail;
 	}
 
+	grp->lg_rx_group_count = 1;
+
+	for (i = 0, port = grp->lg_ports; port != NULL;
+	     i++, port = port->lp_next) {
+		uint_t num_rgroups;
+
+		mac_perim_enter_by_mh(port->lp_mh, &mph);
+		num_rgroups = mac_get_num_rx_groups(port->lp_mh);
+		mac_perim_exit(mph);
+
+		/*
+		 * Utilize all the groups in a port. If some ports
+		 * have less groups than others, then traffic destined
+		 * for the same unicast address may be HW classified
+		 * on some ports but SW classified by aggr when
+		 * arriving on other ports.
+		 */
+		grp->lg_rx_group_count = MAX(grp->lg_rx_group_count,
+		    num_rgroups);
+	}
+
+	/*
+	 * There could be cases where the hardware provides more
+	 * groups than aggr can support. Make sure we never go above
+	 * the max aggr can support.
+	 */
+	grp->lg_rx_group_count = MIN(grp->lg_rx_group_count,
+	    MAX_GROUPS_PER_PORT);
+
+	ASSERT3U(grp->lg_rx_group_count, >, 0);
+	for (i = 0; i < MAX_GROUPS_PER_PORT; i++) {
+		grp->lg_rx_groups[i].arg_index = i;
+		grp->lg_rx_groups[i].arg_untagged = 0;
+		list_create(&(grp->lg_rx_groups[i].arg_vlans),
+		    sizeof (aggr_vlan_t), offsetof(aggr_vlan_t, av_link));
+	}
+
 	/*
 	 * If no explicit MAC address was specified by the administrator,
 	 * set it to the MAC address of the first port.
@@ -1347,7 +1489,7 @@ aggr_grp_create(datalink_id_t linkid, uint32_t key, uint_t nports,
 		grp->lg_mac_addr_port = grp->lg_ports;
 	}
 
-	/* set the initial group capabilities */
+	/* Set the initial group capabilities. */
 	aggr_grp_capab_set(grp);
 
 	if ((mac = mac_alloc(MAC_VERSION)) == NULL) {
@@ -1382,14 +1524,18 @@ aggr_grp_create(datalink_id_t linkid, uint32_t key, uint_t nports,
 	 * Update the MAC address of the constituent ports.
 	 * None of the port is attached at this time, the link state of the
 	 * aggregation will not change.
+	 *
+	 * All ports take on the primary MAC address of the aggr
+	 * (lg_aggr). At this point, none of the ports are attached;
+	 * thus the link state of the aggregation will not change.
 	 */
 	link_state_changed = aggr_grp_update_ports_mac(grp);
 	ASSERT(!link_state_changed);
 
-	/* update outbound load balancing policy */
+	/* Update outbound load balancing policy. */
 	aggr_send_update_policy(grp, policy);
 
-	/* set LACP mode */
+	/* Set LACP mode. */
 	aggr_lacp_set_mode(grp, lacp_mode, lacp_timer);
 
 	/*
@@ -1397,12 +1543,18 @@ aggr_grp_create(datalink_id_t linkid, uint32_t key, uint_t nports,
 	 */
 	for (port = grp->lg_ports; port != NULL; port = port->lp_next) {
 		/*
-		 * Create the pseudo ring for each HW ring of the underlying
-		 * port. Note that this is done after the aggr registers the
-		 * mac.
+		 * Create the pseudo ring for each HW ring of the
+		 * underlying port. Note that this is done after the
+		 * aggr registers its MAC.
 		 */
-		VERIFY(aggr_add_pseudo_tx_group(port, &grp->lg_tx_group) == 0);
-		VERIFY(aggr_add_pseudo_rx_group(port, &grp->lg_rx_group) == 0);
+		VERIFY3S(aggr_add_pseudo_tx_group(port, &grp->lg_tx_group),
+		    ==, 0);
+
+		for (i = 0; i < grp->lg_rx_group_count; i++) {
+			VERIFY3S(aggr_add_pseudo_rx_group(port,
+			    &grp->lg_rx_groups[i]), ==, 0);
+		}
+
 		if (aggr_port_notify_link(grp, port))
 			link_state_changed = B_TRUE;
 
@@ -1547,7 +1699,9 @@ aggr_grp_rem_port(aggr_grp_t *grp, aggr_port_t *port,
 			continue;
 		val = aggr_port_stat(port, stat);
 		val -= port->lp_stat[i];
+		mutex_enter(&grp->lg_stat_lock);
 		grp->lg_stat[i] += val;
+		mutex_exit(&grp->lg_stat_lock);
 	}
 	for (i = 0; i < ETHER_NSTAT; i++) {
 		stat = i + MACTYPE_STAT_MIN;
@@ -1555,7 +1709,9 @@ aggr_grp_rem_port(aggr_grp_t *grp, aggr_port_t *port,
 			continue;
 		val = aggr_port_stat(port, stat);
 		val -= port->lp_ether_stat[i];
+		mutex_enter(&grp->lg_stat_lock);
 		grp->lg_ether_stat[i] += val;
+		mutex_exit(&grp->lg_stat_lock);
 	}
 
 	grp->lg_nports--;
@@ -1680,7 +1836,8 @@ aggr_grp_rem_ports(datalink_id_t linkid, uint_t nports, laioc_port_t *ports)
 		 * aggr_find_tx_ring() will not return any rings
 		 * belonging to it.
 		 */
-		aggr_rem_pseudo_rx_group(port, &grp->lg_rx_group);
+		for (i = 0; i < grp->lg_rx_group_count; i++)
+			aggr_rem_pseudo_rx_group(port, &grp->lg_rx_groups[i]);
 
 		/* remove port from group */
 		rc = aggr_grp_rem_port(grp, port, &mac_addr_changed,
@@ -1785,7 +1942,8 @@ aggr_grp_delete(datalink_id_t linkid, cred_t *cred)
 		(void) aggr_grp_detach_port(grp, port);
 		mac_perim_exit(pmph);
 		aggr_rem_pseudo_tx_group(port, &grp->lg_tx_group);
-		aggr_rem_pseudo_rx_group(port, &grp->lg_rx_group);
+		for (uint_t i = 0; i < grp->lg_rx_group_count; i++)
+			aggr_rem_pseudo_rx_group(port, &grp->lg_rx_groups[i]);
 		aggr_port_delete(port);
 		port = cport;
 	}
@@ -1804,6 +1962,10 @@ aggr_grp_delete(datalink_id_t linkid, cred_t *cred)
 	VERIFY(mac_unregister(grp->lg_mh) == 0);
 	grp->lg_mh = NULL;
 
+	for (uint_t i = 0; i < MAX_GROUPS_PER_PORT; i++) {
+		list_destroy(&(grp->lg_rx_groups[i].arg_vlans));
+	}
+
 	AGGR_GRP_REFRELE(grp);
 	return (0);
 }
@@ -1886,6 +2048,8 @@ aggr_grp_stat(aggr_grp_t *grp, uint_t stat, uint64_t *val)
 	aggr_port_t	*port;
 	uint_t		stat_index;
 
+	ASSERT(MUTEX_HELD(&grp->lg_stat_lock));
+
 	/* We only aggregate counter statistics. */
 	if (IS_MAC_STAT(stat) && !MAC_STAT_ISACOUNTER(stat) ||
 	    IS_MACTYPE_STAT(stat) && !ETHER_STAT_ISACOUNTER(stat)) {
@@ -1954,10 +2118,9 @@ static int
 aggr_m_stat(void *arg, uint_t stat, uint64_t *val)
 {
 	aggr_grp_t		*grp = arg;
-	mac_perim_handle_t	mph;
 	int			rval = 0;
 
-	mac_perim_enter_by_mh(grp->lg_mh, &mph);
+	mutex_enter(&grp->lg_stat_lock);
 
 	switch (stat) {
 	case MAC_STAT_IFSPEED:
@@ -1977,7 +2140,7 @@ aggr_m_stat(void *arg, uint_t stat, uint64_t *val)
 		rval = aggr_grp_stat(grp, stat, val);
 	}
 
-	mac_perim_exit(mph);
+	mutex_exit(&grp->lg_stat_lock);
 	return (rval);
 }
 
@@ -2167,17 +2330,15 @@ aggr_m_capab_get(void *arg, mac_capab_t cap, void *cap_data)
 		return (!grp->lg_zcopy);
 	case MAC_CAPAB_RINGS: {
 		mac_capab_rings_t *cap_rings = cap_data;
+		uint_t ring_cnt = 0;
+
+		for (uint_t i = 0; i < grp->lg_rx_group_count; i++)
+			ring_cnt += grp->lg_rx_groups[i].arg_ring_cnt;
 
 		if (cap_rings->mr_type == MAC_RING_TYPE_RX) {
 			cap_rings->mr_group_type = MAC_GROUP_TYPE_STATIC;
-			cap_rings->mr_rnum = grp->lg_rx_group.arg_ring_cnt;
-
-			/*
-			 * An aggregation advertises only one (pseudo) RX
-			 * group, which virtualizes the main/primary group of
-			 * the underlying devices.
-			 */
-			cap_rings->mr_gnum = 1;
+			cap_rings->mr_rnum = ring_cnt;
+			cap_rings->mr_gnum = grp->lg_rx_group_count;
 			cap_rings->mr_gaddring = NULL;
 			cap_rings->mr_gremring = NULL;
 		} else {
@@ -2209,19 +2370,17 @@ aggr_m_capab_get(void *arg, mac_capab_t cap, void *cap_data)
 }
 
 /*
- * Callback funtion for MAC layer to register groups.
+ * Callback function for MAC layer to register groups.
  */
 static void
 aggr_fill_group(void *arg, mac_ring_type_t rtype, const int index,
     mac_group_info_t *infop, mac_group_handle_t gh)
 {
 	aggr_grp_t *grp = arg;
-	aggr_pseudo_rx_group_t *rx_group;
-	aggr_pseudo_tx_group_t *tx_group;
 
-	ASSERT(index == 0);
 	if (rtype == MAC_RING_TYPE_RX) {
-		rx_group = &grp->lg_rx_group;
+		aggr_pseudo_rx_group_t *rx_group = &grp->lg_rx_groups[index];
+
 		rx_group->arg_gh = gh;
 		rx_group->arg_grp = grp;
 
@@ -2231,8 +2390,18 @@ aggr_fill_group(void *arg, mac_ring_type_t rtype, const int index,
 		infop->mgi_addmac = aggr_addmac;
 		infop->mgi_remmac = aggr_remmac;
 		infop->mgi_count = rx_group->arg_ring_cnt;
+
+		/*
+		 * Always set the HW VLAN callbacks. They are smart
+		 * enough to know when a port has HW VLAN filters to
+		 * program and when it doesn't.
+		 */
+		infop->mgi_addvlan = aggr_addvlan;
+		infop->mgi_remvlan = aggr_remvlan;
 	} else {
-		tx_group = &grp->lg_tx_group;
+		aggr_pseudo_tx_group_t *tx_group = &grp->lg_tx_group;
+
+		ASSERT3S(index, ==, 0);
 		tx_group->atg_gh = gh;
 	}
 }
@@ -2248,13 +2417,13 @@ aggr_fill_ring(void *arg, mac_ring_type_t rtype, const int rg_index,
 
 	switch (rtype) {
 	case MAC_RING_TYPE_RX: {
-		aggr_pseudo_rx_group_t	*rx_group = &grp->lg_rx_group;
+		aggr_pseudo_rx_group_t	*rx_group;
 		aggr_pseudo_rx_ring_t	*rx_ring;
 		mac_intr_t		aggr_mac_intr;
 
-		ASSERT(rg_index == 0);
-
-		ASSERT((index >= 0) && (index < rx_group->arg_ring_cnt));
+		rx_group = &grp->lg_rx_groups[rg_index];
+		ASSERT3S(index, >=, 0);
+		ASSERT3S(index, <, rx_group->arg_ring_cnt);
 		rx_ring = rx_group->arg_rings + index;
 		rx_ring->arr_rh = rh;
 
@@ -2268,8 +2437,8 @@ aggr_fill_ring(void *arg, mac_ring_type_t rtype, const int rg_index,
 		aggr_mac_intr.mi_ddi_handle = NULL;
 
 		infop->mri_driver = (mac_ring_driver_t)rx_ring;
-		infop->mri_start = aggr_pseudo_start_ring;
-		infop->mri_stop = aggr_pseudo_stop_ring;
+		infop->mri_start = aggr_pseudo_start_rx_ring;
+		infop->mri_stop = aggr_pseudo_stop_rx_ring;
 
 		infop->mri_intr = aggr_mac_intr;
 		infop->mri_poll = aggr_rx_poll;
@@ -2356,6 +2525,7 @@ aggr_addmac(void *arg, const uint8_t *mac_addr)
 	aggr_port_t		*port, *p;
 	mac_perim_handle_t	mph;
 	int			err = 0;
+	uint_t			idx = rx_group->arg_index;
 
 	mac_perim_enter_by_mh(grp->lg_mh, &mph);
 
@@ -2382,12 +2552,12 @@ aggr_addmac(void *arg, const uint8_t *mac_addr)
 	*pprev = addr;
 
 	for (port = grp->lg_ports; port != NULL; port = port->lp_next)
-		if ((err = aggr_port_addmac(port, mac_addr)) != 0)
+		if ((err = aggr_port_addmac(port, idx, mac_addr)) != 0)
 			break;
 
 	if (err != 0) {
 		for (p = grp->lg_ports; p != port; p = p->lp_next)
-			aggr_port_remmac(p, mac_addr);
+			aggr_port_remmac(p, idx, mac_addr);
 
 		*pprev = NULL;
 		kmem_free(addr, sizeof (aggr_unicst_addr_t));
@@ -2432,7 +2602,7 @@ aggr_remmac(void *arg, const uint8_t *mac_addr)
 	}
 
 	for (port = grp->lg_ports; port != NULL; port = port->lp_next)
-		aggr_port_remmac(port, mac_addr);
+		aggr_port_remmac(port, rx_group->arg_index, mac_addr);
 
 	*pprev = addr->aua_next;
 	kmem_free(addr, sizeof (aggr_unicst_addr_t));
@@ -2442,6 +2612,188 @@ aggr_remmac(void *arg, const uint8_t *mac_addr)
 }
 
 /*
+ * Search for VID in the Rx group's list and return a pointer if
+ * found. Otherwise return NULL.
+ */
+static aggr_vlan_t *
+aggr_find_vlan(aggr_pseudo_rx_group_t *rx_group, uint16_t vid)
+{
+	ASSERT(MAC_PERIM_HELD(rx_group->arg_grp->lg_mh));
+	for (aggr_vlan_t *avp = list_head(&rx_group->arg_vlans); avp != NULL;
+	    avp = list_next(&rx_group->arg_vlans, avp)) {
+		if (avp->av_vid == vid)
+			return (avp);
+	}
+
+	return (NULL);
+}
+
+/*
+ * Accept traffic on the specified VID.
+ *
+ * Persist VLAN state in the aggr so that ports added later will
+ * receive the correct filters. In the future it would be nice to
+ * allow aggr to iterate its clients instead of duplicating state.
+ */
+static int
+aggr_addvlan(mac_group_driver_t gdriver, uint16_t vid)
+{
+	aggr_pseudo_rx_group_t	*rx_group = (aggr_pseudo_rx_group_t *)gdriver;
+	aggr_grp_t		*aggr = rx_group->arg_grp;
+	aggr_port_t		*port, *p;
+	mac_perim_handle_t	mph;
+	int			err = 0;
+	aggr_vlan_t		*avp = NULL;
+	uint_t			idx = rx_group->arg_index;
+
+	mac_perim_enter_by_mh(aggr->lg_mh, &mph);
+
+	if (vid == MAC_VLAN_UNTAGGED) {
+		/*
+		 * Aggr is both a MAC provider and MAC client. As a
+		 * MAC provider it is passed MAC_VLAN_UNTAGGED by its
+		 * client. As a client itself, it should pass
+		 * VLAN_ID_NONE to its ports.
+		 */
+		vid = VLAN_ID_NONE;
+		rx_group->arg_untagged++;
+		goto update_ports;
+	}
+
+	avp = aggr_find_vlan(rx_group, vid);
+
+	if (avp != NULL) {
+		avp->av_refs++;
+		mac_perim_exit(mph);
+		return (0);
+	}
+
+	avp = kmem_zalloc(sizeof (aggr_vlan_t), KM_SLEEP);
+	avp->av_vid = vid;
+	avp->av_refs = 1;
+
+update_ports:
+	for (port = aggr->lg_ports; port != NULL; port = port->lp_next)
+		if ((err = aggr_port_addvlan(port, idx, vid)) != 0)
+			break;
+
+	if (err != 0) {
+		/*
+		 * If any of these calls fail then we are in a
+		 * situation where the ports have different HW state.
+		 * There's no reasonable action the MAC client can
+		 * take in this scenario to rectify the situation.
+		 */
+		for (p = aggr->lg_ports; p != port; p = p->lp_next) {
+			int err2;
+
+			if ((err2 = aggr_port_remvlan(p, idx, vid)) != 0) {
+				cmn_err(CE_WARN, "Failed to remove VLAN %u"
+				    " from port %s: errno %d.", vid,
+				    mac_client_name(p->lp_mch), err2);
+			}
+
+		}
+
+		if (vid == VLAN_ID_NONE)
+			rx_group->arg_untagged--;
+
+		if (avp != NULL) {
+			kmem_free(avp, sizeof (aggr_vlan_t));
+			avp = NULL;
+		}
+	}
+
+	if (avp != NULL)
+		list_insert_tail(&rx_group->arg_vlans, avp);
+
+done:
+	mac_perim_exit(mph);
+	return (err);
+}
+
+/*
+ * Stop accepting traffic on this VLAN if it's the last use of this VLAN.
+ */
+static int
+aggr_remvlan(mac_group_driver_t gdriver, uint16_t vid)
+{
+	aggr_pseudo_rx_group_t	*rx_group = (aggr_pseudo_rx_group_t *)gdriver;
+	aggr_grp_t		*aggr = rx_group->arg_grp;
+	aggr_port_t		*port, *p;
+	mac_perim_handle_t	mph;
+	int			err = 0;
+	aggr_vlan_t		*avp = NULL;
+	uint_t			idx = rx_group->arg_index;
+
+	mac_perim_enter_by_mh(aggr->lg_mh, &mph);
+
+	/*
+	 * See the comment in aggr_addvlan().
+	 */
+	if (vid == MAC_VLAN_UNTAGGED) {
+		vid = VLAN_ID_NONE;
+		rx_group->arg_untagged--;
+
+		if (rx_group->arg_untagged > 0)
+			goto done;
+
+		goto update_ports;
+	}
+
+	avp = aggr_find_vlan(rx_group, vid);
+
+	if (avp == NULL) {
+		err = ENOENT;
+		goto done;
+	}
+
+	avp->av_refs--;
+
+	if (avp->av_refs > 0)
+		goto done;
+
+update_ports:
+	for (port = aggr->lg_ports; port != NULL; port = port->lp_next)
+		if ((err = aggr_port_remvlan(port, idx, vid)) != 0)
+			break;
+
+	/*
+	 * See the comment in aggr_addvlan() for justification of the
+	 * use of VERIFY here.
+	 */
+	if (err != 0) {
+		for (p = aggr->lg_ports; p != port; p = p->lp_next) {
+			int err2;
+
+			if ((err2 = aggr_port_addvlan(p, idx, vid)) != 0) {
+				cmn_err(CE_WARN, "Failed to add VLAN %u"
+				    " to port %s: errno %d.", vid,
+				    mac_client_name(p->lp_mch), err2);
+			}
+		}
+
+		if (avp != NULL)
+			avp->av_refs++;
+
+		if (vid == VLAN_ID_NONE)
+			rx_group->arg_untagged++;
+
+		goto done;
+	}
+
+	if (err == 0 && avp != NULL) {
+		VERIFY3U(avp->av_refs, ==, 0);
+		list_remove(&rx_group->arg_vlans, avp);
+		kmem_free(avp, sizeof (aggr_vlan_t));
+	}
+
+done:
+	mac_perim_exit(mph);
+	return (err);
+}
+
+/*
  * Add or remove the multicast addresses that are defined for the group
  * to or from the specified port.
  *
diff --git a/usr/src/uts/common/io/aggr/aggr_lacp.c b/usr/src/uts/common/io/aggr/aggr_lacp.c
index a0d566d12b..7dcd3bfb95 100644
--- a/usr/src/uts/common/io/aggr/aggr_lacp.c
+++ b/usr/src/uts/common/io/aggr/aggr_lacp.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 /*
@@ -606,7 +607,7 @@ lacp_xmit_sm(aggr_port_t *portp)
 	ASSERT(MAC_PERIM_HELD(portp->lp_grp->lg_mh));
 
 	/* LACP_OFF state not in specification so check here.  */
-	if (!pl->sm.lacp_on || !pl->NTT || !portp->lp_started)
+	if (!pl->sm.lacp_on || !pl->NTT)
 		return;
 
 	/*
diff --git a/usr/src/uts/common/io/aggr/aggr_port.c b/usr/src/uts/common/io/aggr/aggr_port.c
index 00545d2c03..c8dbe00336 100644
--- a/usr/src/uts/common/io/aggr/aggr_port.c
+++ b/usr/src/uts/common/io/aggr/aggr_port.c
@@ -21,6 +21,8 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012 OmniTI Computer Consulting, Inc  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -69,10 +71,10 @@ aggr_port_destructor(void *buf, void *arg)
 {
 	aggr_port_t *port = buf;
 
-	ASSERT(port->lp_mnh == NULL);
-	ASSERT(port->lp_mphp == NULL);
-	ASSERT(!port->lp_rx_grp_added && !port->lp_tx_grp_added);
-	ASSERT(port->lp_hwgh == NULL);
+	ASSERT3P(port->lp_mnh, ==, NULL);
+	ASSERT(!port->lp_tx_grp_added);
+	for (uint_t i = 0; i < MAX_GROUPS_PER_PORT; i++)
+		ASSERT3P(port->lp_hwghs[i], ==, NULL);
 }
 
 void
@@ -126,7 +128,6 @@ aggr_port_init_callbacks(aggr_port_t *port)
 	aggr_grp_port_hold(port);
 }
 
-/* ARGSUSED */
 int
 aggr_port_create(aggr_grp_t *grp, const datalink_id_t linkid, boolean_t force,
     aggr_port_t **pp)
@@ -195,9 +196,9 @@ aggr_port_create(aggr_grp_t *grp, const datalink_id_t linkid, boolean_t force,
 	}
 
 	/*
-	 * As the underlying mac's current margin size is used to determine
+	 * As the underlying MAC's current margin size is used to determine
 	 * the margin size of the aggregation itself, request the underlying
-	 * mac not to change to a smaller size.
+	 * MAC not to change to a smaller size.
 	 */
 	if ((err = mac_margin_add(mh, &margin, B_TRUE)) != 0) {
 		id_free(aggr_portids, portid);
@@ -206,7 +207,7 @@ aggr_port_create(aggr_grp_t *grp, const datalink_id_t linkid, boolean_t force,
 
 	if ((err = mac_unicast_add(mch, NULL, MAC_UNICAST_PRIMARY |
 	    MAC_UNICAST_DISABLE_TX_VID_CHECK, &mah, 0, &diag)) != 0) {
-		VERIFY(mac_margin_remove(mh, margin) == 0);
+		VERIFY3S(mac_margin_remove(mh, margin), ==, 0);
 		id_free(aggr_portids, portid);
 		goto fail;
 	}
@@ -261,6 +262,7 @@ aggr_port_create(aggr_grp_t *grp, const datalink_id_t linkid, boolean_t force,
 fail:
 	if (mch != NULL)
 		mac_client_close(mch, MAC_CLOSE_FLAGS_EXCLUSIVE);
+
 	mac_close(mh);
 	return (err);
 }
@@ -270,13 +272,11 @@ aggr_port_delete(aggr_port_t *port)
 {
 	aggr_lacp_port_t *pl = &port->lp_lacp;
 
-	ASSERT(port->lp_mphp == NULL);
 	ASSERT(!port->lp_promisc_on);
-
 	port->lp_closing = B_TRUE;
+	VERIFY0(mac_margin_remove(port->lp_mh, port->lp_margin));
+	mac_client_clear_flow_cb(port->lp_mch);
 
-	VERIFY(mac_margin_remove(port->lp_mh, port->lp_margin) == 0);
-	mac_rx_clear(port->lp_mch);
 	/*
 	 * If the notification callback is already in process and waiting for
 	 * the aggr grp's mac perimeter, don't wait (otherwise there would be
@@ -307,8 +307,10 @@ aggr_port_delete(aggr_port_t *port)
 	 * port's MAC_NOTE_UNICST notify callback function being called.
 	 */
 	(void) mac_unicast_primary_set(port->lp_mh, port->lp_addr);
+
 	if (port->lp_mah != NULL)
 		(void) mac_unicast_remove(port->lp_mch, port->lp_mah);
+
 	mac_client_close(port->lp_mch, MAC_CLOSE_FLAGS_EXCLUSIVE);
 	mac_close(port->lp_mh);
 	AGGR_PORT_REFRELE(port);
@@ -373,10 +375,14 @@ aggr_port_notify_link(aggr_grp_t *grp, aggr_port_t *port)
 	/* link speed changes? */
 	ifspeed = aggr_port_stat(port, MAC_STAT_IFSPEED);
 	if (port->lp_ifspeed != ifspeed) {
+		mutex_enter(&grp->lg_stat_lock);
+
 		if (port->lp_state == AGGR_PORT_STATE_ATTACHED)
 			do_detach |= (ifspeed != grp->lg_ifspeed);
 		else
 			do_attach |= (ifspeed == grp->lg_ifspeed);
+
+		mutex_exit(&grp->lg_stat_lock);
 	}
 	port->lp_ifspeed = ifspeed;
 
@@ -515,6 +521,10 @@ aggr_port_stop(aggr_port_t *port)
 	port->lp_started = B_FALSE;
 }
 
+/*
+ * Set the promisc mode of the port. If the port is already in the
+ * requested mode then do nothing.
+ */
 int
 aggr_port_promisc(aggr_port_t *port, boolean_t on)
 {
@@ -523,27 +533,14 @@ aggr_port_promisc(aggr_port_t *port, boolean_t on)
 	ASSERT(MAC_PERIM_HELD(port->lp_mh));
 
 	if (on == port->lp_promisc_on)
-		/* already in desired promiscous mode */
 		return (0);
 
-	if (on) {
-		mac_rx_clear(port->lp_mch);
-		rc = mac_promisc_add(port->lp_mch, MAC_CLIENT_PROMISC_ALL,
-		    aggr_recv_cb, port, &port->lp_mphp,
-		    MAC_PROMISC_FLAGS_NO_TX_LOOP);
-		if (rc != 0) {
-			mac_rx_set(port->lp_mch, aggr_recv_cb, port);
-			return (rc);
-		}
-	} else {
-		mac_promisc_remove(port->lp_mphp);
-		port->lp_mphp = NULL;
-		mac_rx_set(port->lp_mch, aggr_recv_cb, port);
-	}
+	rc = mac_set_promisc(port->lp_mh, on);
 
-	port->lp_promisc_on = on;
+	if (rc == 0)
+		port->lp_promisc_on = on;
 
-	return (0);
+	return (rc);
 }
 
 /*
@@ -583,35 +580,45 @@ aggr_port_stat(aggr_port_t *port, uint_t stat)
 }
 
 /*
- * Add a non-primary unicast address to the underlying port. If the port
- * supports HW Rx group, try to add the address into the HW Rx group of
- * the port first. If that fails, or if the port does not support HW Rx
- * group, enable the port's promiscous mode.
+ * Add a non-primary unicast address to the underlying port. If the
+ * port supports HW Rx groups, then try to add the address filter to
+ * the HW group first. If that fails, or if the port does not support
+ * RINGS capab, then enable the port's promiscous mode.
  */
 int
-aggr_port_addmac(aggr_port_t *port, const uint8_t *mac_addr)
+aggr_port_addmac(aggr_port_t *port, uint_t idx, const uint8_t *mac_addr)
 {
 	aggr_unicst_addr_t	*addr, **pprev;
 	mac_perim_handle_t	pmph;
 	int			err;
 
 	ASSERT(MAC_PERIM_HELD(port->lp_grp->lg_mh));
+	ASSERT3U(idx, <, MAX_GROUPS_PER_PORT);
 	mac_perim_enter_by_mh(port->lp_mh, &pmph);
 
 	/*
-	 * If the underlying port support HW Rx group, add the mac to its
-	 * RX group directly.
+	 * If the port doesn't have a HW group to back the aggr's
+	 * pseudo group, then try using the port's default group and
+	 * let the aggr SW classify its traffic. This scenario happens
+	 * when mixing ports with a different number of HW groups.
 	 */
-	if ((port->lp_hwgh != NULL) &&
-	    ((mac_hwgroup_addmac(port->lp_hwgh, mac_addr)) == 0)) {
+	if (port->lp_hwghs[idx] == NULL)
+		idx = 0;
+
+	/*
+	 * If there is an underlying HW Rx group, then try adding this
+	 * unicast address to it.
+	 */
+	if ((port->lp_hwghs[idx] != NULL) &&
+	    ((mac_hwgroup_addmac(port->lp_hwghs[idx], mac_addr)) == 0)) {
 		mac_perim_exit(pmph);
 		return (0);
 	}
 
 	/*
-	 * If that fails, or if the port does not support HW Rx group, enable
-	 * the port's promiscous mode. (Note that we turn on the promiscous
-	 * mode only if the port is already started.
+	 * If the port doesn't have HW groups, or we failed to add the
+	 * HW filter, then enable the port's promiscuous mode. We
+	 * enable promiscuous mode only if the port is already started.
 	 */
 	if (port->lp_started &&
 	    ((err = aggr_port_promisc(port, B_TRUE)) != 0)) {
@@ -643,13 +650,14 @@ aggr_port_addmac(aggr_port_t *port, const uint8_t *mac_addr)
  * promiscous mode.
  */
 void
-aggr_port_remmac(aggr_port_t *port, const uint8_t *mac_addr)
+aggr_port_remmac(aggr_port_t *port, uint_t idx, const uint8_t *mac_addr)
 {
 	aggr_grp_t		*grp = port->lp_grp;
 	aggr_unicst_addr_t	*addr, **pprev;
 	mac_perim_handle_t	pmph;
 
 	ASSERT(MAC_PERIM_HELD(grp->lg_mh));
+	ASSERT3U(idx, <, MAX_GROUPS_PER_PORT);
 	mac_perim_enter_by_mh(port->lp_mh, &pmph);
 
 	/*
@@ -662,6 +670,7 @@ aggr_port_remmac(aggr_port_t *port, const uint8_t *mac_addr)
 			break;
 		pprev = &addr->aua_next;
 	}
+
 	if (addr != NULL) {
 		/*
 		 * This unicast address put the port into the promiscous mode,
@@ -674,8 +683,65 @@ aggr_port_remmac(aggr_port_t *port, const uint8_t *mac_addr)
 		if (port->lp_prom_addr == NULL && !grp->lg_promisc)
 			(void) aggr_port_promisc(port, B_FALSE);
 	} else {
-		ASSERT(port->lp_hwgh != NULL);
-		(void) mac_hwgroup_remmac(port->lp_hwgh, mac_addr);
+		/* See comment in aggr_port_addmac(). */
+		if (port->lp_hwghs[idx] == NULL)
+			idx = 0;
+
+		ASSERT3P(port->lp_hwghs[idx], !=, NULL);
+		(void) mac_hwgroup_remmac(port->lp_hwghs[idx], mac_addr);
 	}
+
 	mac_perim_exit(pmph);
 }
+
+int
+aggr_port_addvlan(aggr_port_t *port, uint_t idx, uint16_t vid)
+{
+	mac_perim_handle_t	pmph;
+	int			err;
+
+	ASSERT(MAC_PERIM_HELD(port->lp_grp->lg_mh));
+	ASSERT3U(idx, <, MAX_GROUPS_PER_PORT);
+	mac_perim_enter_by_mh(port->lp_mh, &pmph);
+
+	/* See comment in aggr_port_addmac(). */
+	if (port->lp_hwghs[idx] == NULL)
+		idx = 0;
+
+	/*
+	 * Add the VLAN filter to the HW group if the port has a HW
+	 * group. If the port doesn't have a HW group, then it will
+	 * implicitly allow tagged traffic to pass and there is
+	 * nothing to do.
+	 */
+	if (port->lp_hwghs[idx] == NULL)
+		err = 0;
+	else
+		err = mac_hwgroup_addvlan(port->lp_hwghs[idx], vid);
+
+	mac_perim_exit(pmph);
+	return (err);
+}
+
+int
+aggr_port_remvlan(aggr_port_t *port, uint_t idx, uint16_t vid)
+{
+	mac_perim_handle_t	pmph;
+	int			err;
+
+	ASSERT(MAC_PERIM_HELD(port->lp_grp->lg_mh));
+	ASSERT3U(idx, <, MAX_GROUPS_PER_PORT);
+	mac_perim_enter_by_mh(port->lp_mh, &pmph);
+
+	/* See comment in aggr_port_addmac(). */
+	if (port->lp_hwghs[idx] == NULL)
+		idx = 0;
+
+	if (port->lp_hwghs[idx] == NULL)
+		err = 0;
+	else
+		err = mac_hwgroup_remvlan(port->lp_hwghs[idx], vid);
+
+	mac_perim_exit(pmph);
+	return (err);
+}
diff --git a/usr/src/uts/common/io/aggr/aggr_recv.c b/usr/src/uts/common/io/aggr/aggr_recv.c
index 2bdb7872e3..b6b3e6de1f 100644
--- a/usr/src/uts/common/io/aggr/aggr_recv.c
+++ b/usr/src/uts/common/io/aggr/aggr_recv.c
@@ -21,6 +21,8 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012 OmniTI Computer Consulting, Inc  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -55,7 +57,7 @@ aggr_recv_lacp(aggr_port_t *port, mac_resource_handle_t mrh, mblk_t *mp)
 {
 	aggr_grp_t *grp = port->lp_grp;
 
-	/* in promiscuous mode, send copy of packet up */
+	/* In promiscuous mode, pass copy of packet up. */
 	if (grp->lg_promisc) {
 		mblk_t *nmp = copymsg(mp);
 
@@ -68,11 +70,11 @@ aggr_recv_lacp(aggr_port_t *port, mac_resource_handle_t mrh, mblk_t *mp)
 
 /*
  * Callback function invoked by MAC service module when packets are
- * made available by a MAC port.
+ * made available by a MAC port, both in promisc_on mode and not.
  */
 /* ARGSUSED */
-void
-aggr_recv_cb(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
+static void
+aggr_recv_path_cb(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
     boolean_t loopback)
 {
 	aggr_port_t *port = (aggr_port_t *)arg;
@@ -161,3 +163,10 @@ aggr_recv_cb(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
 		}
 	}
 }
+
+void
+aggr_recv_cb(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
+    boolean_t loopback)
+{
+	aggr_recv_path_cb(arg, mrh, mp, loopback);
+}
diff --git a/usr/src/uts/common/io/bpf/bpf_wrap.c b/usr/src/uts/common/io/bpf/bpf_wrap.c
new file mode 100644
index 0000000000..6cbde58a20
--- /dev/null
+++ b/usr/src/uts/common/io/bpf/bpf_wrap.c
@@ -0,0 +1,35 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <net/bpf.h>
+#include <inet/bpf.h>
+
+/*
+ * With BPF filter validation and evaluation moved into the 'ip' module, these
+ * wrapper functions are provided to expose the original interface.
+ */
+
+uint_t
+bpf_filter(struct bpf_insn *pc, uchar_t *p, uint_t wirelen, uint_t buflen)
+{
+	return ((uint_t)ip_bpf_filter((ip_bpf_insn_t *)pc, p, wirelen, buflen));
+}
+
+int
+bpf_validate(struct bpf_insn *f, int len)
+{
+	return ((int)ip_bpf_validate((ip_bpf_insn_t *)f, (uint_t)len));
+}
diff --git a/usr/src/uts/common/io/chxge/ch.c b/usr/src/uts/common/io/chxge/ch.c
index 9f1f7f87de..80400061af 100644
--- a/usr/src/uts/common/io/chxge/ch.c
+++ b/usr/src/uts/common/io/chxge/ch.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -59,6 +60,7 @@
 #include <sys/sunddi.h>
 #include <sys/dlpi.h>
 #include <sys/ethernet.h>
+#include <sys/mac_provider.h>
 #include <sys/strsun.h>
 #include <sys/strsubr.h>
 #include <inet/common.h>
@@ -1377,8 +1379,7 @@ ch_send_up(ch_t *chp, mblk_t *mp, uint32_t cksum, int flg)
 		 * set in /etc/system (see sge.c).
 		 */
 		if (flg)
-			(void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, cksum,
-			    HCK_FULLCKSUM, 0);
+			mac_hcksum_set(mp, 0, 0, 0, cksum, HCK_FULLCKSUM);
 		gld_recv(chp->ch_macp, mp);
 	} else {
 		freemsg(mp);
@@ -1693,8 +1694,7 @@ ch_send(gld_mac_info_t *macinfo, mblk_t *mp)
 	msg_flg = 0;
 	if (chp->ch_config.cksum_enabled) {
 		if (is_T2(chp)) {
-			hcksum_retrieve(mp, NULL, NULL, NULL, NULL, NULL,
-			    NULL, &msg_flg);
+			mac_hcksum_get(mp, NULL, NULL, NULL, NULL, &msg_flg);
 			flg = (msg_flg & HCK_FULLCKSUM)?
 			    CH_NO_CPL: CH_NO_HWCKSUM|CH_NO_CPL;
 		} else
diff --git a/usr/src/uts/common/io/cons.c b/usr/src/uts/common/io/cons.c
index 6ef1b0b9f7..495ae93cf9 100644
--- a/usr/src/uts/common/io/cons.c
+++ b/usr/src/uts/common/io/cons.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1982, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc. All rights reserved.
  */
 
 /*
@@ -53,6 +54,7 @@
 #include <sys/vnode.h>
 #include <sys/uio.h>
 #include <sys/stat.h>
+#include <sys/limits.h>
 
 #include <sys/console.h>
 #include <sys/consdev.h>
@@ -414,14 +416,24 @@ cnwrite(dev_t dev, struct uio *uio, struct cred *cred)
 	 */
 	if (vsconsvp != NULL && vsconsvp->v_stream != NULL) {
 		struiod_t uiod;
+		struct iovec buf[IOV_MAX_STACK];
+		int iovlen = 0;
+
+		if (uio->uio_iovcnt > IOV_MAX_STACK) {
+			iovlen = uio->uio_iovcnt * sizeof (iovec_t);
+			uiod.d_iov = kmem_alloc(iovlen, KM_SLEEP);
+		} else {
+			uiod.d_iov = buf;
+		}
 
 		/*
 		 * strwrite modifies uio so need to make copy.
 		 */
-		(void) uiodup(uio, &uiod.d_uio, uiod.d_iov,
-		    sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
+		(void) uiodup(uio, &uiod.d_uio, uiod.d_iov, uio->uio_iovcnt);
 
 		(void) strwrite(vsconsvp, &uiod.d_uio, cred);
+		if (iovlen != 0)
+			kmem_free(uiod.d_iov, iovlen);
 	}
 
 	if (rconsvp->v_stream != NULL)
diff --git a/usr/src/uts/common/io/cpqary3/cpqary3.c b/usr/src/uts/common/io/cpqary3/cpqary3.c
index 622f0dcf68..f67d77b3d2 100644
--- a/usr/src/uts/common/io/cpqary3/cpqary3.c
+++ b/usr/src/uts/common/io/cpqary3/cpqary3.c
@@ -41,7 +41,7 @@ extern cpqary3_driver_info_t gdriver_info;
  * Global Variables Definitions
  */
 
-static char cpqary3_brief[]    =	"HP Smart Array Driver";
+static char cpqary3_brief[]    =	"HP Smart Array (Legacy)";
 void *cpqary3_state;
 
 /* HPQaculi Changes */
diff --git a/usr/src/uts/common/io/devpoll.c b/usr/src/uts/common/io/devpoll.c
index 4ef14a99de..e0d37e171b 100644
--- a/usr/src/uts/common/io/devpoll.c
+++ b/usr/src/uts/common/io/devpoll.c
@@ -25,7 +25,7 @@
 
 /*
  * Copyright (c) 2012 by Delphix. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -245,30 +245,20 @@ dpinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
  *	 stale entries!
  */
 static int
-dp_pcache_poll(dp_entry_t *dpep, void *dpbuf,
-    pollcache_t *pcp, nfds_t nfds, int *fdcntp)
+dp_pcache_poll(dp_entry_t *dpep, void *dpbuf, pollcache_t *pcp, nfds_t nfds,
+    int *fdcntp)
 {
-	int		start, ostart, end;
-	int		fdcnt, fd;
-	boolean_t	done;
-	file_t		*fp;
-	short		revent;
-	boolean_t	no_wrap;
-	pollhead_t	*php;
-	polldat_t	*pdp;
+	int		start, ostart, end, fdcnt, error = 0;
+	boolean_t	done, no_wrap;
 	pollfd_t	*pfdp;
 	epoll_event_t	*epoll;
-	int		error = 0;
-	short		mask = POLLRDHUP | POLLWRBAND;
-	boolean_t	is_epoll = (dpep->dpe_flag & DP_ISEPOLLCOMPAT) != 0;
+	const short	mask = POLLRDHUP | POLLWRBAND;
+	const boolean_t	is_epoll = (dpep->dpe_flag & DP_ISEPOLLCOMPAT) != 0;
 
 	ASSERT(MUTEX_HELD(&pcp->pc_lock));
 	if (pcp->pc_bitmap == NULL) {
-		/*
-		 * No Need to search because no poll fd
-		 * has been cached.
-		 */
-		return (error);
+		/* No Need to search because no poll fd has been cached. */
+		return (0);
 	}
 
 	if (is_epoll) {
@@ -281,7 +271,6 @@ dp_pcache_poll(dp_entry_t *dpep, void *dpbuf,
 retry:
 	start = ostart = pcp->pc_mapstart;
 	end = pcp->pc_mapend;
-	php = NULL;
 
 	if (start == 0) {
 		/*
@@ -294,8 +283,11 @@ retry:
 	done = B_FALSE;
 	fdcnt = 0;
 	while ((fdcnt < nfds) && !done) {
-		php = NULL;
-		revent = 0;
+		pollhead_t *php = NULL;
+		short revent = 0;
+		uf_entry_gen_t gen;
+		int fd;
+
 		/*
 		 * Examine the bit map in a circular fashion
 		 * to avoid starvation. Always resume from
@@ -305,6 +297,9 @@ retry:
 		fd = bt_getlowbit(pcp->pc_bitmap, start, end);
 		ASSERT(fd <= end);
 		if (fd >= 0) {
+			file_t *fp;
+			polldat_t *pdp;
+
 			if (fd == end) {
 				if (no_wrap) {
 					done = B_TRUE;
@@ -328,28 +323,14 @@ repoll:
 				 */
 				continue;
 			}
-			if ((fp = getf(fd)) == NULL) {
-				/*
-				 * The fd has been closed, but user has not
-				 * done a POLLREMOVE on this fd yet. Instead
-				 * of cleaning it here implicitly, we return
-				 * POLLNVAL. This is consistent with poll(2)
-				 * polling a closed fd. Hope this will remind
-				 * user to do a POLLREMOVE.
-				 */
-				if (!is_epoll && pfdp != NULL) {
-					pfdp[fdcnt].fd = fd;
-					pfdp[fdcnt].revents = POLLNVAL;
-					fdcnt++;
-					continue;
-				}
-
-				/*
-				 * In the epoll compatibility case, we actually
-				 * perform the implicit removal to remain
-				 * closer to the epoll semantics.
-				 */
+			if ((fp = getf_gen(fd, &gen)) == NULL) {
 				if (is_epoll) {
+					/*
+					 * In the epoll compatibility case, we
+					 * actually perform the implicit
+					 * removal to remain closer to the
+					 * epoll semantics.
+					 */
 					pdp->pd_fp = NULL;
 					pdp->pd_events = 0;
 
@@ -360,30 +341,36 @@ repoll:
 					}
 
 					BT_CLEAR(pcp->pc_bitmap, fd);
-					continue;
+				} else if (pfdp != NULL) {
+					/*
+					 * The fd has been closed, but user has
+					 * not done a POLLREMOVE on this fd
+					 * yet. Instead of cleaning it here
+					 * implicitly, we return POLLNVAL. This
+					 * is consistent with poll(2) polling a
+					 * closed fd. Hope this will remind
+					 * user to do a POLLREMOVE.
+					 */
+					pfdp[fdcnt].fd = fd;
+					pfdp[fdcnt].revents = POLLNVAL;
+					fdcnt++;
 				}
+				continue;
 			}
 
-			if (fp != pdp->pd_fp) {
+			/*
+			 * Detect a change to the resource underlying a cached
+			 * file descriptor.  While the fd generation comparison
+			 * will catch nearly all cases, the file_t comparison
+			 * is maintained as a failsafe as well.
+			 */
+			if (gen != pdp->pd_gen || fp != pdp->pd_fp) {
 				/*
 				 * The user is polling on a cached fd which was
 				 * closed and then reused.  Unfortunately there
 				 * is no good way to communicate this fact to
 				 * the consumer.
 				 *
-				 * If the file struct is also reused, we may
-				 * not be able to detect the fd reuse at all.
-				 * As long as this does not cause system
-				 * failure and/or memory leaks, we will play
-				 * along.  The man page states that if the user
-				 * does not clean up closed fds, polling
-				 * results will be indeterministic.
-				 *
-				 * XXX: perhaps log the detection of fd reuse?
-				 */
-				pdp->pd_fp = fp;
-
-				/*
 				 * When this situation has been detected, it's
 				 * likely that any existing pollhead is
 				 * ill-suited to perform proper wake-ups.
@@ -396,6 +383,30 @@ repoll:
 					pollhead_delete(pdp->pd_php, pdp);
 					pdp->pd_php = NULL;
 				}
+
+				/*
+				 * Since epoll is expected to act on the
+				 * underlying 'struct file' (in Linux terms,
+				 * our vnode_t would be a closer analog) rather
+				 * than the fd itself, an implicit remove
+				 * is necessary under these circumstances to
+				 * suppress any results (or errors) from the
+				 * new resource occupying the fd.
+				 */
+				if (is_epoll) {
+					pdp->pd_fp = NULL;
+					pdp->pd_events = 0;
+					BT_CLEAR(pcp->pc_bitmap, fd);
+					releasef(fd);
+					continue;
+				} else {
+					/*
+					 * Regular /dev/poll is unbothered
+					 * about the fd reassignment.
+					 */
+					pdp->pd_fp = fp;
+					pdp->pd_gen = gen;
+				}
 			}
 			/*
 			 * XXX - pollrelock() logic needs to know which
@@ -700,14 +711,10 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 	pollfd_t	*pollfdp, *pfdp;
 	dvpoll_epollfd_t *epfdp;
 	uintptr_t	limit;
-	int		error, size;
-	ssize_t		uiosize;
-	size_t		copysize;
+	int		error;
+	uint_t		size;
+	size_t		copysize, uiosize;
 	nfds_t		pollfdnum;
-	struct pollhead	*php = NULL;
-	polldat_t	*pdp;
-	int		fd;
-	file_t		*fp;
 	boolean_t	is_epoll, fds_added = B_FALSE;
 
 	minor = getminor(dev);
@@ -732,10 +739,27 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 		pcp->pc_pid = curproc->p_pid;
 	}
 
-	uiosize = uiop->uio_resid;
+	if (uiop->uio_resid < 0) {
+		/* No one else is this careful, but maybe they should be. */
+		return (EINVAL);
+	}
+
+	uiosize = (size_t)uiop->uio_resid;
 	pollfdnum = uiosize / size;
 
 	/*
+	 * For epoll-enabled handles, restrict the allowed write size to 2.
+	 * This corresponds to an epoll_ctl(3C) performing an EPOLL_CTL_MOD
+	 * operation which is expanded into two operations (DEL and ADD).
+	 *
+	 * All other operations performed through epoll_ctl(3C) will consist of
+	 * a single entry.
+	 */
+	if (is_epoll && pollfdnum > 2) {
+		return (EINVAL);
+	}
+
+	/*
 	 * We want to make sure that pollfdnum isn't large enough to DoS us,
 	 * but we also don't want to grab p_lock unnecessarily -- so we
 	 * perform the full check against our resource limits if and only if
@@ -794,6 +818,21 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 	while ((dpep->dpe_flag & DP_WRITER_PRESENT) != 0) {
 		ASSERT(dpep->dpe_refcnt != 0);
 
+		/*
+		 * The epoll API does not allow EINTR as a result when making
+		 * modifications to the set of polled fds.  Given that write
+		 * activity is relatively quick and the size of accepted writes
+		 * is limited above to two entries, a signal-ignorant wait is
+		 * used here to avoid the EINTR.
+		 */
+		if (is_epoll) {
+			cv_wait(&dpep->dpe_cv, &dpep->dpe_lock);
+			continue;
+		}
+
+		/*
+		 * Non-epoll writers to /dev/poll handles can tolerate EINTR.
+		 */
 		if (!cv_wait_sig_swap(&dpep->dpe_cv, &dpep->dpe_lock)) {
 			dpep->dpe_writerwait--;
 			mutex_exit(&dpep->dpe_lock);
@@ -828,7 +867,9 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 	}
 	for (pfdp = pollfdp; (uintptr_t)pfdp < limit;
 	    pfdp = (pollfd_t *)((uintptr_t)pfdp + size)) {
-		fd = pfdp->fd;
+		int fd = pfdp->fd;
+		polldat_t *pdp;
+
 		if ((uint_t)fd >= P_FINFO(curproc)->fi_nfiles) {
 			/*
 			 * epoll semantics demand that we return EBADF if our
@@ -844,78 +885,61 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 
 		pdp = pcache_lookup_fd(pcp, fd);
 		if (pfdp->events != POLLREMOVE) {
+			uf_entry_gen_t gen;
+			file_t *fp = NULL;
+			struct pollhead *php = NULL;
 
-			fp = NULL;
-
-			if (pdp == NULL) {
-				/*
-				 * If we're in epoll compatibility mode, check
-				 * that the fd is valid before allocating
-				 * anything for it; epoll semantics demand that
-				 * we return EBADF if our specified fd is
-				 * invalid.
-				 */
-				if (is_epoll) {
-					if ((fp = getf(fd)) == NULL) {
-						error = EBADF;
-						break;
-					}
+			/*
+			 * If we're in epoll compatibility mode, check that the
+			 * fd is valid before allocating anything for it; epoll
+			 * semantics demand that we return EBADF if our
+			 * specified fd is invalid.
+			 */
+			if (is_epoll) {
+				if ((fp = getf_gen(fd, &gen)) == NULL) {
+					error = EBADF;
+					break;
 				}
-
+			}
+			if (pdp == NULL) {
 				pdp = pcache_alloc_fd(0);
 				pdp->pd_fd = fd;
 				pdp->pd_pcache = pcp;
 				pcache_insert_fd(pcp, pdp, pollfdnum);
-			} else {
+			}
+
+			if (is_epoll) {
 				/*
-				 * epoll semantics demand that we error out if
-				 * a file descriptor is added twice, which we
-				 * check (imperfectly) by checking if we both
-				 * have the file descriptor cached and the
-				 * file pointer that correponds to the file
-				 * descriptor matches our cached value.  If
-				 * there is a pointer mismatch, the file
-				 * descriptor was closed without being removed.
-				 * The converse is clearly not true, however,
-				 * so to narrow the window by which a spurious
-				 * EEXIST may be returned, we also check if
-				 * this fp has been added to an epoll control
-				 * descriptor in the past; if it hasn't, we
-				 * know that this is due to fp reuse -- it's
-				 * not a true EEXIST case.  (By performing this
-				 * additional check, we limit the window of
-				 * spurious EEXIST to situations where a single
-				 * file descriptor is being used across two or
-				 * more epoll control descriptors -- and even
-				 * then, the file descriptor must be closed and
-				 * reused in a relatively tight time span.)
+				 * If the fd is already a member of the epoll
+				 * set, error emission is needed only when the
+				 * fd assignment generation matches the one
+				 * recorded in the polldat_t.  Absence of such
+				 * a generation match indicates that a new
+				 * resource has been assigned at that fd.
+				 *
+				 * Caveat: It is possible to force a generation
+				 * update while keeping the same backing
+				 * resource.  This is possible via dup2, but
+				 * does not represent real-world use cases,
+				 * making the lack of error acceptable.
 				 */
-				if (is_epoll) {
-					if (pdp->pd_fp != NULL &&
-					    (fp = getf(fd)) != NULL &&
-					    fp == pdp->pd_fp &&
-					    (fp->f_flag2 & FEPOLLED)) {
-						error = EEXIST;
-						releasef(fd);
-						break;
-					}
-
-					/*
-					 * We have decided that the cached
-					 * information was stale: it either
-					 * didn't match, or the fp had never
-					 * actually been epoll()'d on before.
-					 * We need to now clear our pd_events
-					 * to assure that we don't mistakenly
-					 * operate on cached event disposition.
-					 */
-					pdp->pd_events = 0;
+				if (pdp->pd_fp != NULL && pdp->pd_gen == gen) {
+					error = EEXIST;
+					releasef(fd);
+					break;
 				}
-			}
 
-			if (is_epoll) {
+				/*
+				 * We have decided that the cached information
+				 * was stale.  Clear pd_events to assure that
+				 * we don't mistakenly operate on cached event
+				 * disposition.
+				 */
+				pdp->pd_events = 0;
+
 				epfdp = (dvpoll_epollfd_t *)pfdp;
 				pdp->pd_epolldata = epfdp->dpep_data;
+
 			}
 
 			ASSERT(pdp->pd_fd == fd);
@@ -928,39 +952,36 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 			if (fd > pcp->pc_mapend) {
 				pcp->pc_mapend = fd;
 			}
-			if (fp == NULL && (fp = getf(fd)) == NULL) {
-				/*
-				 * The fd is not valid. Since we can't pass
-				 * this error back in the write() call, set
-				 * the bit in bitmap to force DP_POLL ioctl
-				 * to examine it.
-				 */
-				BT_SET(pcp->pc_bitmap, fd);
-				pdp->pd_events |= pfdp->events;
-				continue;
-			}
 
-			/*
-			 * To (greatly) reduce EEXIST false positives, we
-			 * denote that this fp has been epoll()'d.  We do this
-			 * regardless of epoll compatibility mode, as the flag
-			 * is harmless if not in epoll compatibility mode.
-			 */
-			fp->f_flag2 |= FEPOLLED;
+			if (!is_epoll) {
+				ASSERT(fp == NULL);
 
-			/*
-			 * Don't do VOP_POLL for an already cached fd with
-			 * same poll events.
-			 */
-			if ((pdp->pd_events == pfdp->events) &&
-			    (pdp->pd_fp == fp)) {
+				if ((fp = getf_gen(fd, &gen)) == NULL) {
+					/*
+					 * The fd is not valid. Since we can't
+					 * pass this error back in the write()
+					 * call, set the bit in bitmap to force
+					 * DP_POLL ioctl to examine it.
+					 */
+					BT_SET(pcp->pc_bitmap, fd);
+					pdp->pd_events |= pfdp->events;
+					continue;
+				}
 				/*
-				 * the events are already cached
+				 * Don't do VOP_POLL for an already cached fd
+				 * with same poll events.
 				 */
-				releasef(fd);
-				continue;
+				if ((pdp->pd_events == pfdp->events) &&
+				    (pdp->pd_fp == fp)) {
+					/*
+					 * the events are already cached
+					 */
+					releasef(fd);
+					continue;
+				}
 			}
 
+
 			/*
 			 * do VOP_POLL and cache this poll fd.
 			 */
@@ -1018,6 +1039,7 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 				break;
 			}
 			pdp->pd_fp = fp;
+			pdp->pd_gen = gen;
 			pdp->pd_events |= pfdp->events;
 			if (php != NULL) {
 				if (pdp->pd_php == NULL) {
@@ -1143,8 +1165,13 @@ dpioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp, int *rvalp)
 		 * to turn it off for a particular open.
 		 */
 		dpep->dpe_flag |= DP_ISEPOLLCOMPAT;
-		mutex_exit(&dpep->dpe_lock);
 
+		/* Record the epoll-enabled nature in the pollcache too */
+		mutex_enter(&pcp->pc_lock);
+		pcp->pc_flag |= PC_EPOLL;
+		mutex_exit(&pcp->pc_lock);
+
+		mutex_exit(&dpep->dpe_lock);
 		return (0);
 	}
 
diff --git a/usr/src/uts/common/io/dld/dld_drv.c b/usr/src/uts/common/io/dld/dld_drv.c
index cfe0f78415..00b5f0e3de 100644
--- a/usr/src/uts/common/io/dld/dld_drv.c
+++ b/usr/src/uts/common/io/dld/dld_drv.c
@@ -347,8 +347,8 @@ drv_ioc_attr(void *karg, intptr_t arg, int mode, cred_t *cred, int *rvalp)
 	if ((err = dls_devnet_hold_tmp(diap->dia_linkid, &dlh)) != 0)
 		return (err);
 
-	if ((err = mac_perim_enter_by_macname(
-	    dls_devnet_mac(dlh), &mph)) != 0) {
+	if ((err = mac_perim_enter_by_macname(dls_devnet_mac(dlh),
+	    &mph)) != 0) {
 		dls_devnet_rele_tmp(dlh);
 		return (err);
 	}
@@ -360,7 +360,6 @@ drv_ioc_attr(void *karg, intptr_t arg, int mode, cred_t *cred, int *rvalp)
 	}
 
 	mac_sdu_get(dlp->dl_mh, NULL, &diap->dia_max_sdu);
-
 	dls_link_rele(dlp);
 	mac_perim_exit(mph);
 	dls_devnet_rele_tmp(dlh);
@@ -702,7 +701,8 @@ drv_ioc_prop_common(dld_ioc_macprop_t *prop, intptr_t arg, boolean_t set,
 				err = EACCES;
 				goto done;
 			}
-			err = dls_devnet_setzid(dlh, dzp->diz_zid);
+			err = dls_devnet_setzid(dlh, dzp->diz_zid,
+			    dzp->diz_transient);
 		} else {
 			kprop->pr_perm_flags = MAC_PROP_PERM_RW;
 			(*(zoneid_t *)kprop->pr_val) = dls_devnet_getzid(dlh);
@@ -717,8 +717,18 @@ drv_ioc_prop_common(dld_ioc_macprop_t *prop, intptr_t arg, boolean_t set,
 			else
 				err = drv_ioc_clrap(linkid);
 		} else {
-			if (kprop->pr_valsize == 0)
-				return (ENOBUFS);
+			/*
+			 * You might think that the earlier call to
+			 * mac_prop_check_size() should catch this but
+			 * it can't. The autopush prop uses 0 as a
+			 * sentinel value to clear the prop. This
+			 * check ensures we don't allow a get with a
+			 * valsize of 0.
+			 */
+			if (kprop->pr_valsize == 0) {
+				err = ENOBUFS;
+				goto done;
+			}
 
 			kprop->pr_perm_flags = MAC_PROP_PERM_RW;
 			err = drv_ioc_getap(linkid, dlap);
@@ -866,7 +876,7 @@ drv_ioc_rename(void *karg, intptr_t arg, int mode, cred_t *cred, int *rvalp)
 		return (err);
 
 	if ((err = dls_devnet_rename(dir->dir_linkid1, dir->dir_linkid2,
-	    dir->dir_link)) != 0)
+	    dir->dir_link, dir->dir_zoneinit)) != 0)
 		return (err);
 
 	if (dir->dir_linkid2 == DATALINK_INVALID_LINKID)
@@ -1321,10 +1331,13 @@ drv_ioc_gettran(void *karg, intptr_t arg, int mode, cred_t *cred,
 	dls_link_t		*dlp = NULL;
 	dld_ioc_gettran_t	*dgt = karg;
 
-	if ((ret = mac_perim_enter_by_linkid(dgt->dgt_linkid, &mph)) != 0)
+	if ((ret = dls_devnet_hold_tmp(dgt->dgt_linkid, &dlh)) != 0)
+		goto done;
+
+	if ((ret = mac_perim_enter_by_macname(dls_devnet_mac(dlh), &mph)) != 0)
 		goto done;
 
-	if ((ret = dls_devnet_hold_link(dgt->dgt_linkid, &dlh, &dlp)) != 0)
+	if ((ret = dls_link_hold(dls_devnet_mac(dlh), &dlp)) != 0)
 		goto done;
 
 	/*
@@ -1343,13 +1356,14 @@ drv_ioc_gettran(void *karg, intptr_t arg, int mode, cred_t *cred,
 	}
 
 done:
-	if (dlh != NULL && dlp != NULL) {
-		dls_devnet_rele_link(dlh, dlp);
-	}
+	if (dlp != NULL)
+		dls_link_rele(dlp);
 
-	if (mph != NULL) {
+	if (mph != NULL)
 		mac_perim_exit(mph);
-	}
+
+	if (dlh != NULL)
+		dls_devnet_rele_tmp(dlh);
 
 	return (ret);
 }
@@ -1373,10 +1387,13 @@ drv_ioc_readtran(void *karg, intptr_t arg, int mode, cred_t *cred,
 	if (dti->dti_nbytes != 256 || dti->dti_off != 0)
 		return (EINVAL);
 
-	if ((ret = mac_perim_enter_by_linkid(dti->dti_linkid, &mph)) != 0)
+	if ((ret = dls_devnet_hold_tmp(dti->dti_linkid, &dlh)) != 0)
+		goto done;
+
+	if ((ret = mac_perim_enter_by_macname(dls_devnet_mac(dlh), &mph)) != 0)
 		goto done;
 
-	if ((ret = dls_devnet_hold_link(dti->dti_linkid, &dlh, &dlp)) != 0)
+	if ((ret = dls_link_hold(dls_devnet_mac(dlh), &dlp)) != 0)
 		goto done;
 
 	/*
@@ -1396,13 +1413,14 @@ drv_ioc_readtran(void *karg, intptr_t arg, int mode, cred_t *cred,
 	}
 
 done:
-	if (dlh != NULL && dlp != NULL) {
-		dls_devnet_rele_link(dlh, dlp);
-	}
+	if (dlp != NULL)
+		dls_link_rele(dlp);
 
-	if (mph != NULL) {
+	if (mph != NULL)
 		mac_perim_exit(mph);
-	}
+
+	if (dlh != NULL)
+		dls_devnet_rele_tmp(dlh);
 
 	return (ret);
 }
@@ -1499,7 +1517,6 @@ done:
 	return (ret);
 }
 
-
 /*
  * Note that ioctls that modify links have a NULL di_priv_func(), as
  * privileges can only be checked after we know the class of the link being
@@ -1575,7 +1592,8 @@ static dld_ioc_modentry_t dld_ioc_modtable[] = {
 	{SIMNET_IOC,	"simnet", 0, NULL, 0},
 	{BRIDGE_IOC,	"bridge", 0, NULL, 0},
 	{IPTUN_IOC,	"iptun", 0, NULL, 0},
-	{IBPART_IOC,	"ibp", -1, NULL, 0}
+	{IBPART_IOC,	"ibp", -1, NULL, 0},
+	{OVERLAY_IOC,	"overlay", 0, NULL, 0}
 };
 #define	DLDIOC_CNT	\
 	(sizeof (dld_ioc_modtable) / sizeof (dld_ioc_modentry_t))
diff --git a/usr/src/uts/common/io/dld/dld_proto.c b/usr/src/uts/common/io/dld/dld_proto.c
index 0d7b774fa1..b09d4db0f5 100644
--- a/usr/src/uts/common/io/dld/dld_proto.c
+++ b/usr/src/uts/common/io/dld/dld_proto.c
@@ -21,7 +21,7 @@
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2012, Nexenta Systems, Inc. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -42,7 +42,7 @@ static proto_reqfunc_t proto_info_req, proto_attach_req, proto_detach_req,
     proto_bind_req, proto_unbind_req, proto_promiscon_req, proto_promiscoff_req,
     proto_enabmulti_req, proto_disabmulti_req, proto_physaddr_req,
     proto_setphysaddr_req, proto_udqos_req, proto_req, proto_capability_req,
-    proto_notify_req, proto_passive_req;
+    proto_notify_req, proto_passive_req, proto_exclusive_req;
 
 static void proto_capability_advertise(dld_str_t *, mblk_t *);
 static int dld_capab_poll_disable(dld_str_t *, dld_capab_poll_t *);
@@ -122,6 +122,9 @@ dld_proto(dld_str_t *dsp, mblk_t *mp)
 	case DL_PASSIVE_REQ:
 		proto_passive_req(dsp, mp);
 		break;
+	case DL_EXCLUSIVE_REQ:
+		proto_exclusive_req(dsp, mp);
+		break;
 	default:
 		proto_req(dsp, mp);
 		break;
@@ -606,6 +609,14 @@ proto_promiscon_req(dld_str_t *dsp, mblk_t *mp)
 		new_flags |= DLS_PROMISC_PHYS;
 		break;
 
+	case DL_PROMISC_RX_ONLY:
+		new_flags |= DLS_PROMISC_RX_ONLY;
+		break;
+
+	case DL_PROMISC_FIXUPS:
+		new_flags |= DLS_PROMISC_FIXUPS;
+		break;
+
 	default:
 		dl_err = DL_NOTSUPPORTED;
 		goto failed2;
@@ -693,6 +704,22 @@ proto_promiscoff_req(dld_str_t *dsp, mblk_t *mp)
 		new_flags &= ~DLS_PROMISC_PHYS;
 		break;
 
+	case DL_PROMISC_RX_ONLY:
+		if (!(dsp->ds_promisc & DLS_PROMISC_RX_ONLY)) {
+			dl_err = DL_NOTENAB;
+			goto failed2;
+		}
+		new_flags &= ~DLS_PROMISC_RX_ONLY;
+		break;
+
+	case DL_PROMISC_FIXUPS:
+		if (!(dsp->ds_promisc & DLS_PROMISC_FIXUPS)) {
+			dl_err = DL_NOTENAB;
+			goto failed2;
+		}
+		new_flags &= ~DLS_PROMISC_FIXUPS;
+		break;
+
 	default:
 		dl_err = DL_NOTSUPPORTED;
 		goto failed2;
@@ -1184,7 +1211,6 @@ proto_unitdata_req(dld_str_t *dsp, mblk_t *mp)
 	uint16_t		sap;
 	uint_t			addr_length;
 	mblk_t			*bp, *payload;
-	uint32_t		start, stuff, end, value, flags;
 	t_uscalar_t		dl_err;
 	uint_t			max_sdu;
 
@@ -1253,9 +1279,7 @@ proto_unitdata_req(dld_str_t *dsp, mblk_t *mp)
 	/*
 	 * Transfer the checksum offload information if it is present.
 	 */
-	hcksum_retrieve(payload, NULL, NULL, &start, &stuff, &end, &value,
-	    &flags);
-	(void) hcksum_assoc(bp, NULL, NULL, start, stuff, end, value, flags, 0);
+	mac_hcksum_clone(payload, bp);
 
 	/*
 	 * Link the payload onto the new header.
@@ -1296,7 +1320,8 @@ proto_passive_req(dld_str_t *dsp, mblk_t *mp)
 	 * If we've already become active by issuing an active primitive,
 	 * then it's too late to try to become passive.
 	 */
-	if (dsp->ds_passivestate == DLD_ACTIVE) {
+	if (dsp->ds_passivestate == DLD_ACTIVE ||
+	    dsp->ds_passivestate == DLD_EXCLUSIVE) {
 		dl_err = DL_OUTSTATE;
 		goto failed;
 	}
@@ -1350,12 +1375,20 @@ dld_capab_direct(dld_str_t *dsp, void *data, uint_t flags)
 
 	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
 
+	if (dsp->ds_sap == ETHERTYPE_IPV6)
+		return (ENOTSUP);
+
 	switch (flags) {
 	case DLD_ENABLE:
 		dls_rx_set(dsp, (dls_rx_t)direct->di_rx_cf,
 		    direct->di_rx_ch);
 
-		direct->di_tx_df = (uintptr_t)str_mdata_fastpath_put;
+		if (direct->di_flags & DI_DIRECT_RAW) {
+			direct->di_tx_df =
+			    (uintptr_t)str_mdata_raw_fastpath_put;
+		} else {
+			direct->di_tx_df = (uintptr_t)str_mdata_fastpath_put;
+		}
 		direct->di_tx_dh = dsp;
 		direct->di_tx_cb_df = (uintptr_t)mac_client_tx_notify;
 		direct->di_tx_cb_dh = dsp->ds_mch;
@@ -1377,24 +1410,22 @@ dld_capab_direct(dld_str_t *dsp, void *data, uint_t flags)
 }
 
 /*
- * dld_capab_poll_enable()
- *
- * This function is misnamed. All polling  and fanouts are run out of the
- * lower mac (in case of VNIC and the only mac in case of NICs). The
- * availability of Rx ring and promiscous mode is all taken care between
- * the soft ring set (mac_srs), the Rx ring, and S/W classifier. Any
- * fanout necessary is done by the soft rings that are part of the
- * mac_srs (by default mac_srs sends the packets up via a TCP and
- * non TCP soft ring).
+ * This function is misnamed. All polling and fanouts are run out of
+ * the lower MAC for VNICs and out of the MAC for NICs. The
+ * availability of Rx rings and promiscous mode is taken care of
+ * between the soft ring set (mac_srs), the Rx ring, and the SW
+ * classifier. Fanout, if necessary, is done by the soft rings that
+ * are part of the SRS. By default the SRS divvies up the packets
+ * based on protocol: TCP, UDP, or Other (OTH).
  *
- * The mac_srs (or its associated soft rings) always store the ill_rx_ring
+ * The SRS (or its associated soft rings) always store the ill_rx_ring
  * (the cookie returned when they registered with IP during plumb) as their
  * 2nd argument which is passed up as mac_resource_handle_t. The upcall
  * function and 1st argument is what the caller registered when they
  * called mac_rx_classify_flow_add() to register the flow. For VNIC,
  * the function is vnic_rx and argument is vnic_t. For regular NIC
  * case, it mac_rx_default and mac_handle_t. As explained above, the
- * mac_srs (or its soft ring) will add the ill_rx_ring (mac_resource_handle_t)
+ * SRS (or its soft ring) will add the ill_rx_ring (mac_resource_handle_t)
  * from its stored 2nd argument.
  */
 static int
@@ -1407,11 +1438,11 @@ dld_capab_poll_enable(dld_str_t *dsp, dld_capab_poll_t *poll)
 		return (ENOTSUP);
 
 	/*
-	 * Enable client polling if and only if DLS bypass is possible.
-	 * Special cases like VLANs need DLS processing in the Rx data path.
-	 * In such a case we can neither allow the client (IP) to directly
-	 * poll the softring (since DLS processing hasn't been done) nor can
-	 * we allow DLS bypass.
+	 * Enable client polling if and only if DLS bypass is
+	 * possible. Some traffic requires DLS processing in the Rx
+	 * data path. In such a case we can neither allow the client
+	 * (IP) to directly poll the soft ring (since DLS processing
+	 * hasn't been done) nor can we allow DLS bypass.
 	 */
 	if (!mac_rx_bypass_set(dsp->ds_mch, dsp->ds_rx, dsp->ds_rx_arg))
 		return (ENOTSUP);
@@ -1456,6 +1487,9 @@ dld_capab_poll(dld_str_t *dsp, void *data, uint_t flags)
 
 	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
 
+	if (dsp->ds_sap == ETHERTYPE_IPV6)
+		return (ENOTSUP);
+
 	switch (flags) {
 	case DLD_ENABLE:
 		return (dld_capab_poll_enable(dsp, poll));
@@ -1466,12 +1500,34 @@ dld_capab_poll(dld_str_t *dsp, void *data, uint_t flags)
 }
 
 static int
+dld_capab_ipcheck(dld_str_t *dsp, void *data, uint_t flags)
+{
+	dld_capab_ipcheck_t	*ipc = data;
+
+	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
+
+	switch (flags) {
+	case DLD_ENABLE:
+		ipc->ipc_allowed_df = (uintptr_t)mac_protect_check_addr;
+		ipc->ipc_allowed_dh = dsp->ds_mch;
+		return (0);
+	case DLD_DISABLE:
+		return (0);
+	}
+
+	return (ENOTSUP);
+}
+
+static int
 dld_capab_lso(dld_str_t *dsp, void *data, uint_t flags)
 {
 	dld_capab_lso_t		*lso = data;
 
 	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
 
+	if (dsp->ds_sap == ETHERTYPE_IPV6)
+		return (ENOTSUP);
+
 	switch (flags) {
 	case DLD_ENABLE: {
 		mac_capab_lso_t		mac_lso;
@@ -1517,8 +1573,9 @@ dld_capab(dld_str_t *dsp, uint_t type, void *data, uint_t flags)
 	 * completes. So we limit the check to DLD_ENABLE case.
 	 */
 	if ((flags == DLD_ENABLE && type != DLD_CAPAB_PERIM) &&
-	    (dsp->ds_sap != ETHERTYPE_IP ||
-	    !check_mod_above(dsp->ds_rq, "ip"))) {
+	    (((dsp->ds_sap != ETHERTYPE_IP && dsp->ds_sap != ETHERTYPE_IPV6) ||
+	    !check_mod_above(dsp->ds_rq, "ip")) &&
+	    !check_mod_above(dsp->ds_rq, "vnd"))) {
 		return (ENOTSUP);
 	}
 
@@ -1539,6 +1596,10 @@ dld_capab(dld_str_t *dsp, uint_t type, void *data, uint_t flags)
 		err = dld_capab_lso(dsp, data, flags);
 		break;
 
+	case DLD_CAPAB_IPCHECK:
+		err = dld_capab_ipcheck(dsp, data, flags);
+		break;
+
 	default:
 		err = ENOTSUP;
 		break;
@@ -1600,9 +1661,15 @@ proto_capability_advertise(dld_str_t *dsp, mblk_t *mp)
 	}
 
 	/*
-	 * Direct capability negotiation interface between IP and DLD
+	 * Direct capability negotiation interface between IP/VND and DLD. Note
+	 * that for vnd we only allow the case where the media type is the
+	 * native media type so we know that there are no transformations that
+	 * would have to happen to the mac header that it receives.
 	 */
-	if (dsp->ds_sap == ETHERTYPE_IP && check_mod_above(dsp->ds_rq, "ip")) {
+	if (((dsp->ds_sap == ETHERTYPE_IP || dsp->ds_sap == ETHERTYPE_IPV6) &&
+	    check_mod_above(dsp->ds_rq, "ip")) ||
+	    (check_mod_above(dsp->ds_rq, "vnd") &&
+	    dsp->ds_mip->mi_media == dsp->ds_mip->mi_nativemedia)) {
 		dld_capable = B_TRUE;
 		subsize += sizeof (dl_capability_sub_t) +
 		    sizeof (dl_capab_dld_t);
@@ -1721,3 +1788,36 @@ dld_capabilities_disable(dld_str_t *dsp)
 	if (dsp->ds_polling)
 		(void) dld_capab_poll_disable(dsp, NULL);
 }
+
+static void
+proto_exclusive_req(dld_str_t *dsp, mblk_t *mp)
+{
+	int ret = 0;
+	t_uscalar_t dl_err;
+	mac_perim_handle_t mph;
+
+	if (dsp->ds_passivestate != DLD_UNINITIALIZED) {
+		dl_err = DL_OUTSTATE;
+		goto failed;
+	}
+
+	if (MBLKL(mp) < DL_EXCLUSIVE_REQ_SIZE) {
+		dl_err = DL_BADPRIM;
+		goto failed;
+	}
+
+	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
+	ret = dls_exclusive_set(dsp, B_TRUE);
+	mac_perim_exit(mph);
+
+	if (ret != 0) {
+		dl_err = DL_SYSERR;
+		goto failed;
+	}
+
+	dsp->ds_passivestate = DLD_EXCLUSIVE;
+	dlokack(dsp->ds_wq, mp, DL_EXCLUSIVE_REQ);
+	return;
+failed:
+	dlerrorack(dsp->ds_wq, mp, DL_EXCLUSIVE_REQ, dl_err, (t_uscalar_t)ret);
+}
diff --git a/usr/src/uts/common/io/dld/dld_str.c b/usr/src/uts/common/io/dld/dld_str.c
index 6f0d0b9a6c..f5308e70ff 100644
--- a/usr/src/uts/common/io/dld/dld_str.c
+++ b/usr/src/uts/common/io/dld/dld_str.c
@@ -854,6 +854,77 @@ i_dld_ether_header_update_tag(mblk_t *mp, uint_t pri, uint16_t vid,
 	return (mp);
 }
 
+static boolean_t
+i_dld_raw_ether_check(dld_str_t *dsp, mac_header_info_t *mhip, mblk_t **mpp)
+{
+	mblk_t *mp = *mpp;
+	mblk_t *newmp;
+	uint_t pri, vid, dvid;
+
+	dvid = mac_client_vid(dsp->ds_mch);
+
+	/*
+	 * Discard the packet if this is a VLAN stream but the VID in
+	 * the packet is not correct.
+	 */
+	vid = VLAN_ID(mhip->mhi_tci);
+	if ((dvid != VLAN_ID_NONE) && (vid != VLAN_ID_NONE))
+		return (B_FALSE);
+
+	/*
+	 * Discard the packet if this packet is a tagged packet
+	 * but both pri and VID are 0.
+	 */
+	pri = VLAN_PRI(mhip->mhi_tci);
+	if (mhip->mhi_istagged && !mhip->mhi_ispvid && pri == 0 &&
+	    vid == VLAN_ID_NONE)
+		return (B_FALSE);
+
+	/*
+	 * Update the priority bits to the per-stream priority if
+	 * priority is not set in the packet. Update the VID for
+	 * packets on a VLAN stream.
+	 */
+	pri = (pri == 0) ? dsp->ds_pri : 0;
+	if ((pri != 0) || (dvid != VLAN_ID_NONE)) {
+		if ((newmp = i_dld_ether_header_update_tag(mp, pri,
+		    dvid, dsp->ds_dlp->dl_tagmode)) == NULL) {
+			return (B_FALSE);
+		}
+		*mpp = newmp;
+	}
+
+	return (B_TRUE);
+}
+
+mac_tx_cookie_t
+str_mdata_raw_fastpath_put(dld_str_t *dsp, mblk_t *mp, uintptr_t f_hint,
+    uint16_t flag)
+{
+	boolean_t is_ethernet = (dsp->ds_mip->mi_media == DL_ETHER);
+	mac_header_info_t mhi;
+	mac_tx_cookie_t cookie;
+
+	if (mac_vlan_header_info(dsp->ds_mh, mp, &mhi) != 0)
+		goto discard;
+
+	if (is_ethernet) {
+		if (i_dld_raw_ether_check(dsp, &mhi, &mp) == B_FALSE)
+			goto discard;
+	}
+
+	if ((cookie = DLD_TX(dsp, mp, f_hint, flag)) != NULL) {
+		DLD_SETQFULL(dsp);
+	}
+	return (cookie);
+discard:
+	/* TODO: bump kstat? */
+	freemsg(mp);
+	return (NULL);
+}
+
+
+
 /*
  * M_DATA put (IP fast-path mode)
  */
@@ -902,7 +973,6 @@ str_mdata_raw_put(dld_str_t *dsp, mblk_t *mp)
 	mblk_t *bp, *newmp;
 	size_t size;
 	mac_header_info_t mhi;
-	uint_t pri, vid, dvid;
 	uint_t max_sdu;
 
 	/*
@@ -948,38 +1018,8 @@ str_mdata_raw_put(dld_str_t *dsp, mblk_t *mp)
 		goto discard;
 
 	if (is_ethernet) {
-		dvid = mac_client_vid(dsp->ds_mch);
-
-		/*
-		 * Discard the packet if this is a VLAN stream but the VID in
-		 * the packet is not correct.
-		 */
-		vid = VLAN_ID(mhi.mhi_tci);
-		if ((dvid != VLAN_ID_NONE) && (vid != VLAN_ID_NONE))
-			goto discard;
-
-		/*
-		 * Discard the packet if this packet is a tagged packet
-		 * but both pri and VID are 0.
-		 */
-		pri = VLAN_PRI(mhi.mhi_tci);
-		if (mhi.mhi_istagged && !mhi.mhi_ispvid && pri == 0 &&
-		    vid == VLAN_ID_NONE)
+		if (i_dld_raw_ether_check(dsp, &mhi, &mp) == B_FALSE)
 			goto discard;
-
-		/*
-		 * Update the priority bits to the per-stream priority if
-		 * priority is not set in the packet. Update the VID for
-		 * packets on a VLAN stream.
-		 */
-		pri = (pri == 0) ? dsp->ds_pri : 0;
-		if ((pri != 0) || (dvid != VLAN_ID_NONE)) {
-			if ((newmp = i_dld_ether_header_update_tag(mp, pri,
-			    dvid, dsp->ds_dlp->dl_tagmode)) == NULL) {
-				goto discard;
-			}
-			mp = newmp;
-		}
 	}
 
 	if (DLD_TX(dsp, mp, 0, 0) != NULL) {
diff --git a/usr/src/uts/common/io/dls/dls.c b/usr/src/uts/common/io/dls/dls.c
index 92993ada58..303ea8eb24 100644
--- a/usr/src/uts/common/io/dls/dls.c
+++ b/usr/src/uts/common/io/dls/dls.c
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2013 Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -171,16 +171,16 @@ dls_bind(dld_str_t *dsp, uint32_t sap)
 	/*
 	 * The MAC layer does the VLAN demultiplexing and will only pass up
 	 * untagged packets to non-promiscuous primary MAC clients. In order to
-	 * support the binding to the VLAN SAP which is required by DLPI, dls
+	 * support binding to the VLAN SAP, which is required by DLPI, DLS
 	 * needs to get a copy of all tagged packets when the client binds to
 	 * the VLAN SAP. We do this by registering a separate promiscuous
-	 * callback for each dls client binding to that SAP.
+	 * callback for each DLS client binding to that SAP.
 	 *
 	 * Note: even though there are two promiscuous handles in dld_str_t,
 	 * ds_mph is for the regular promiscuous mode, ds_vlan_mph is the handle
-	 * to receive VLAN pkt when promiscuous mode is not on. Only one of
-	 * them can be non-NULL at the same time, to avoid receiving dup copies
-	 * of pkts.
+	 * to receive VLAN traffic when promiscuous mode is not on. Only one of
+	 * them can be non-NULL at the same time, to avoid receiving duplicate
+	 * copies of packets.
 	 */
 	if (sap == ETHERTYPE_VLAN && dsp->ds_promisc == 0) {
 		int err;
@@ -248,19 +248,69 @@ dls_promisc(dld_str_t *dsp, uint32_t new_flags)
 {
 	int err = 0;
 	uint32_t old_flags = dsp->ds_promisc;
+	uint32_t new_type = new_flags &
+	    ~(DLS_PROMISC_RX_ONLY | DLS_PROMISC_FIXUPS);
 	mac_client_promisc_type_t mptype = MAC_CLIENT_PROMISC_ALL;
+	uint16_t mac_flags = 0;
+	boolean_t doremove = B_FALSE;
 
 	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
 	ASSERT(!(new_flags & ~(DLS_PROMISC_SAP | DLS_PROMISC_MULTI |
-	    DLS_PROMISC_PHYS)));
+	    DLS_PROMISC_PHYS | DLS_PROMISC_RX_ONLY | DLS_PROMISC_FIXUPS)));
+
+	/*
+	 * If we only have the non-data receive flags set or are only changing
+	 * them, then there's nothing to do other than update the flags here.
+	 * Basically when we only have something in the set of
+	 * DLS_PROMISC_RX_ONLY and DLS_PROMISC_FIXUPS around, then there's
+	 * nothing else for us to do other than toggle it, as there's no need to
+	 * talk to MAC and we don't have to do anything else.
+	 */
+	if ((old_flags & ~(DLS_PROMISC_RX_ONLY | DLS_PROMISC_FIXUPS)) == 0 &&
+	    (new_flags & ~(DLS_PROMISC_RX_ONLY | DLS_PROMISC_FIXUPS)) == 0) {
+		dsp->ds_promisc = new_flags;
+		return (0);
+	}
 
 	/*
 	 * If the user has only requested DLS_PROMISC_MULTI then we need to make
 	 * sure that they don't see all packets.
 	 */
-	if (new_flags == DLS_PROMISC_MULTI)
+	if (new_type == DLS_PROMISC_MULTI)
 		mptype = MAC_CLIENT_PROMISC_MULTI;
 
+	/*
+	 * Look at new flags and figure out the correct mac promisc flags.
+	 * If we've only requested DLS_PROMISC_SAP and not _MULTI or _PHYS,
+	 * don't turn on physical promisc mode.
+	 */
+	if (new_flags & DLS_PROMISC_RX_ONLY)
+		mac_flags |= MAC_PROMISC_FLAGS_NO_TX_LOOP;
+	if (new_flags & DLS_PROMISC_FIXUPS)
+		mac_flags |= MAC_PROMISC_FLAGS_DO_FIXUPS;
+	if (new_type == DLS_PROMISC_SAP)
+		mac_flags |= MAC_PROMISC_FLAGS_NO_PHYS;
+
+	/*
+	 * If we're coming in and we're being asked to transition to a state
+	 * where the only DLS flags would be enabled are flags that change what
+	 * we do with promiscuous packets (DLS_PROMISC_RX_ONLY and
+	 * DLS_PROMISC_FIXUPS) and not which packets we should receive, then we
+	 * need to remove the MAC layer promiscuous handler.
+	 */
+	if ((new_flags & ~(DLS_PROMISC_RX_ONLY | DLS_PROMISC_FIXUPS)) == 0 &&
+	    (old_flags & ~(DLS_PROMISC_RX_ONLY | DLS_PROMISC_FIXUPS)) != 0 &&
+	    new_flags != 0) {
+		doremove = B_TRUE;
+	}
+
+	/*
+	 * There are three cases we care about here with respect to MAC. Going
+	 * from nothing to something, something to nothing, something to
+	 * something where we need to change how we're getting stuff from mac.
+	 * In the last case, as long as they're not equal, we need to assume
+	 * something has changed and do something about it.
+	 */
 	if (dsp->ds_promisc == 0 && new_flags != 0) {
 		/*
 		 * If only DLS_PROMISC_SAP, we don't turn on the
@@ -268,9 +318,7 @@ dls_promisc(dld_str_t *dsp, uint32_t new_flags)
 		 */
 		dsp->ds_promisc = new_flags;
 		err = mac_promisc_add(dsp->ds_mch, mptype,
-		    dls_rx_promisc, dsp, &dsp->ds_mph,
-		    (new_flags != DLS_PROMISC_SAP) ? 0 :
-		    MAC_PROMISC_FLAGS_NO_PHYS);
+		    dls_rx_promisc, dsp, &dsp->ds_mph, mac_flags);
 		if (err != 0) {
 			dsp->ds_promisc = old_flags;
 			return (err);
@@ -281,7 +329,8 @@ dls_promisc(dld_str_t *dsp, uint32_t new_flags)
 			mac_promisc_remove(dsp->ds_vlan_mph);
 			dsp->ds_vlan_mph = NULL;
 		}
-	} else if (dsp->ds_promisc != 0 && new_flags == 0) {
+	} else if (dsp->ds_promisc != 0 &&
+	    (new_flags == 0 || doremove == B_TRUE)) {
 		ASSERT(dsp->ds_mph != NULL);
 
 		mac_promisc_remove(dsp->ds_mph);
@@ -296,19 +345,13 @@ dls_promisc(dld_str_t *dsp, uint32_t new_flags)
 			    MAC_CLIENT_PROMISC_ALL, dls_rx_vlan_promisc, dsp,
 			    &dsp->ds_vlan_mph, MAC_PROMISC_FLAGS_NO_PHYS);
 		}
-	} else if (dsp->ds_promisc == DLS_PROMISC_SAP && new_flags != 0 &&
-	    new_flags != dsp->ds_promisc) {
-		/*
-		 * If the old flag is PROMISC_SAP, but the current flag has
-		 * changed to some new non-zero value, we need to turn the
-		 * physical promiscuous mode.
-		 */
+	} else if (new_flags != 0 && new_flags != old_flags) {
 		ASSERT(dsp->ds_mph != NULL);
 		mac_promisc_remove(dsp->ds_mph);
 		/* Honors both after-remove and before-add semantics! */
 		dsp->ds_promisc = new_flags;
 		err = mac_promisc_add(dsp->ds_mch, mptype,
-		    dls_rx_promisc, dsp, &dsp->ds_mph, 0);
+		    dls_rx_promisc, dsp, &dsp->ds_mph, mac_flags);
 		if (err != 0)
 			dsp->ds_promisc = old_flags;
 	} else {
@@ -629,6 +672,22 @@ boolean_t
 dls_accept_promisc(dld_str_t *dsp, mac_header_info_t *mhip, dls_rx_t *ds_rx,
     void **ds_rx_arg, boolean_t loopback)
 {
+	if (dsp->ds_promisc == 0) {
+		/*
+		 * If there are active walkers of the mi_promisc_list when
+		 * promiscuousness is disabled, ds_promisc will be cleared,
+		 * but the DLS will remain on the mi_promisc_list until the
+		 * walk is completed.  If we do not recognize this case here,
+		 * we won't properly execute the ds_promisc case in the common
+		 * accept routine -- and we will potentially accept a packet
+		 * that has originated with this DLS (which in turn can
+		 * induce recursion and death by stack overflow).  If
+		 * ds_promisc is zero, we know that we are in this window --
+		 * and we refuse to accept the packet.
+		 */
+		return (B_FALSE);
+	}
+
 	return (dls_accept_common(dsp, mhip, ds_rx, ds_rx_arg, B_TRUE,
 	    loopback));
 }
@@ -650,8 +709,8 @@ dls_mac_active_set(dls_link_t *dlp)
 		/* request the primary MAC address */
 		if ((err = mac_unicast_add(dlp->dl_mch, NULL,
 		    MAC_UNICAST_PRIMARY | MAC_UNICAST_TAG_DISABLE |
-		    MAC_UNICAST_DISABLE_TX_VID_CHECK, &dlp->dl_mah, 0,
-		    &diag)) != 0) {
+		    MAC_UNICAST_DISABLE_TX_VID_CHECK, &dlp->dl_mah,
+		    VLAN_ID_NONE, &diag)) != 0) {
 			return (err);
 		}
 
@@ -659,7 +718,10 @@ dls_mac_active_set(dls_link_t *dlp)
 		 * Set the function to start receiving packets.
 		 */
 		mac_rx_set(dlp->dl_mch, i_dls_link_rx, dlp);
+	} else if (dlp->dl_exclusive == B_TRUE) {
+		return (EBUSY);
 	}
+
 	dlp->dl_nactive++;
 	return (0);
 }
@@ -685,7 +747,11 @@ dls_active_set(dld_str_t *dsp)
 	if (dsp->ds_passivestate == DLD_PASSIVE)
 		return (0);
 
-	/* If we're already active, then there's nothing more to do. */
+	if (dsp->ds_dlp->dl_exclusive == B_TRUE &&
+	    dsp->ds_passivestate != DLD_EXCLUSIVE)
+		return (EBUSY);
+
+	/* If we're already active, we need to check the link's exclusivity */
 	if ((dsp->ds_nactive == 0) &&
 	    ((err = dls_mac_active_set(dsp->ds_dlp)) != 0)) {
 		/* except for ENXIO all other errors are mapped to EBUSY */
@@ -694,7 +760,8 @@ dls_active_set(dld_str_t *dsp)
 		return (err);
 	}
 
-	dsp->ds_passivestate = DLD_ACTIVE;
+	dsp->ds_passivestate = dsp->ds_dlp->dl_exclusive == B_TRUE ?
+	    DLD_EXCLUSIVE : DLD_ACTIVE;
 	dsp->ds_nactive++;
 	return (0);
 }
@@ -725,7 +792,32 @@ dls_active_clear(dld_str_t *dsp, boolean_t all)
 	if (dsp->ds_nactive != 0)
 		return;
 
-	ASSERT(dsp->ds_passivestate == DLD_ACTIVE);
+	ASSERT(dsp->ds_passivestate == DLD_ACTIVE ||
+	    dsp->ds_passivestate == DLD_EXCLUSIVE);
 	dls_mac_active_clear(dsp->ds_dlp);
+	/*
+	 * We verify below to ensure that no other part of DLS has mucked with
+	 * our exclusive state.
+	 */
+	if (dsp->ds_passivestate == DLD_EXCLUSIVE)
+		VERIFY(dls_exclusive_set(dsp, B_FALSE) == 0);
 	dsp->ds_passivestate = DLD_UNINITIALIZED;
 }
+
+int
+dls_exclusive_set(dld_str_t *dsp, boolean_t enable)
+{
+	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
+
+	if (enable == B_FALSE) {
+		dsp->ds_dlp->dl_exclusive = B_FALSE;
+		return (0);
+	}
+
+	if (dsp->ds_dlp->dl_nactive != 0)
+		return (EBUSY);
+
+	dsp->ds_dlp->dl_exclusive = B_TRUE;
+
+	return (0);
+}
diff --git a/usr/src/uts/common/io/dls/dls_link.c b/usr/src/uts/common/io/dls/dls_link.c
index 6c8ffcb0a9..904cb47ba4 100644
--- a/usr/src/uts/common/io/dls/dls_link.c
+++ b/usr/src/uts/common/io/dls/dls_link.c
@@ -21,7 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -35,6 +35,9 @@
 #include	<sys/dld_impl.h>
 #include	<sys/sdt.h>
 #include	<sys/atomic.h>
+#include	<sys/sysevent.h>
+#include	<sys/sysevent/eventdefs.h>
+#include	<sys/sysevent/datalink.h>
 
 static kmem_cache_t	*i_dls_link_cachep;
 mod_hash_t		*i_dls_link_hash;
@@ -379,7 +382,16 @@ i_dls_link_rx(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
 
 		vid = VLAN_ID(mhi.mhi_tci);
 
+		/*
+		 * This condition is true only when a sun4v vsw client
+		 * is on the scene; as it is the only type of client
+		 * that multiplexes VLANs on a single client instance.
+		 * All other types of clients have one VLAN per client
+		 * instance. In that case, MAC strips the VLAN tag
+		 * before delivering it to DLS (see mac_rx_deliver()).
+		 */
 		if (mhi.mhi_istagged) {
+
 			/*
 			 * If it is tagged traffic, send it upstream to
 			 * all dld_str_t which are attached to the physical
@@ -580,6 +592,67 @@ drop:
 	freemsg(mp);
 }
 
+/*
+ * We'd like to notify via sysevents that a link state change has occurred.
+ * There are a couple of challenges associated with this. The first is that if
+ * the link is flapping a lot, we may not see an accurate state when we launch
+ * the notification, we're told it changed, not what it changed to.
+ *
+ * The next problem is that all of the information that a user has associated
+ * with this device is the exact opposite of what we have on the dls_link_t. We
+ * have the name of the mac device, which has no bearing on what users see.
+ * Likewise, we don't have the datalink id either. So we're going to have to get
+ * this from dls.
+ *
+ * This is all further complicated by the fact that this could be going on in
+ * another thread at the same time as someone is tearing down the dls_link_t
+ * that we're associated with. We need to be careful not to grab the mac
+ * perimeter, otherwise we stand a good chance of deadlock.
+ */
+static void
+dls_link_notify(void *arg, mac_notify_type_t type)
+{
+	dls_link_t 	*dlp = arg;
+	dls_dl_handle_t	dhp;
+	nvlist_t	*nvp;
+	sysevent_t	*event;
+	sysevent_id_t	eid;
+
+	if (type != MAC_NOTE_LINK && type != MAC_NOTE_LOWLINK)
+		return;
+
+	/*
+	 * If we can't find a devnet handle for this link, then there is no user
+	 * knowable device for this at the moment and there's nothing we can
+	 * really share with them that will make sense.
+	 */
+	if (dls_devnet_hold_tmp_by_link(dlp, &dhp) != 0)
+		return;
+
+	/*
+	 * Because we're attaching this nvlist_t to the sysevent, it'll get
+	 * cleaned up when we call sysevent_free.
+	 */
+	VERIFY(nvlist_alloc(&nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0);
+	VERIFY(nvlist_add_int32(nvp, DATALINK_EV_LINK_ID,
+	    dls_devnet_linkid(dhp)) == 0);
+	VERIFY(nvlist_add_string(nvp, DATALINK_EV_LINK_NAME,
+	    dls_devnet_link(dhp)) == 0);
+	VERIFY(nvlist_add_int32(nvp, DATALINK_EV_ZONE_ID,
+	    dls_devnet_getzid(dhp)) == 0);
+
+	dls_devnet_rele_tmp(dhp);
+
+	event = sysevent_alloc(EC_DATALINK, ESC_DATALINK_LINK_STATE,
+	    ILLUMOS_KERN_PUB"dls", SE_SLEEP);
+	VERIFY(event != NULL);
+	(void) sysevent_attach_attributes(event, (sysevent_attr_list_t *)nvp);
+
+	(void) log_sysevent(event, SE_SLEEP, &eid);
+	sysevent_free(event);
+
+}
+
 static void
 i_dls_link_destroy(dls_link_t *dlp)
 {
@@ -590,6 +663,9 @@ i_dls_link_destroy(dls_link_t *dlp)
 	/*
 	 * Free the structure back to the cache.
 	 */
+	if (dlp->dl_mnh != NULL)
+		mac_notify_remove(dlp->dl_mnh, B_TRUE);
+
 	if (dlp->dl_mch != NULL)
 		mac_client_close(dlp->dl_mch, 0);
 
@@ -601,8 +677,10 @@ i_dls_link_destroy(dls_link_t *dlp)
 	dlp->dl_mh = NULL;
 	dlp->dl_mch = NULL;
 	dlp->dl_mip = NULL;
+	dlp->dl_mnh = NULL;
 	dlp->dl_unknowns = 0;
 	dlp->dl_nonip_cnt = 0;
+	dlp->dl_exclusive = B_FALSE;
 	kmem_cache_free(i_dls_link_cachep, dlp);
 }
 
@@ -641,6 +719,8 @@ i_dls_link_create(const char *name, dls_link_t **dlpp)
 	if (err != 0)
 		goto bail;
 
+	dlp->dl_mnh = mac_notify_add(dlp->dl_mh, dls_link_notify, dlp);
+
 	DTRACE_PROBE2(dls__primary__client, char *, dlp->dl_name, void *,
 	    dlp->dl_mch);
 
diff --git a/usr/src/uts/common/io/dls/dls_mgmt.c b/usr/src/uts/common/io/dls/dls_mgmt.c
index 9755aed43f..a910cbe6b1 100644
--- a/usr/src/uts/common/io/dls/dls_mgmt.c
+++ b/usr/src/uts/common/io/dls/dls_mgmt.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2017 Joyent, Inc.
  */
 /*
  * Copyright (c) 2016 by Delphix. All rights reserved.
@@ -85,6 +86,14 @@ static door_handle_t	dls_mgmt_dh = NULL;
 /* dls_devnet_t dd_flags */
 #define	DD_CONDEMNED		0x1
 #define	DD_IMPLICIT_IPTUN	0x2 /* Implicitly-created ip*.*tun* tunnel */
+#define	DD_INITIALIZING		0x4
+
+/*
+ * If the link is marked as initializing or condemned then it should
+ * not be visible outside of the DLS framework.
+ */
+#define	DD_NOT_VISIBLE(flags)	(					\
+	(flags & (DD_CONDEMNED | DD_INITIALIZING)) != 0)
 
 /*
  * This structure is used to keep the <linkid, macname> mapping.
@@ -108,13 +117,14 @@ typedef struct dls_devnet_s {
 	zoneid_t	dd_zid;		/* current zone */
 	boolean_t	dd_prop_loaded;
 	taskqid_t	dd_prop_taskid;
+	boolean_t	dd_transient;	/* link goes away when zone does */
 } dls_devnet_t;
 
 static int i_dls_devnet_create_iptun(const char *, const char *,
     datalink_id_t *);
 static int i_dls_devnet_destroy_iptun(datalink_id_t);
-static int i_dls_devnet_setzid(dls_devnet_t *, zoneid_t, boolean_t);
-static int dls_devnet_unset(const char *, datalink_id_t *, boolean_t);
+static int i_dls_devnet_setzid(dls_devnet_t *, zoneid_t, boolean_t, boolean_t);
+static int dls_devnet_unset(mac_handle_t, datalink_id_t *, boolean_t);
 
 /*ARGSUSED*/
 static int
@@ -134,9 +144,9 @@ i_dls_devnet_destructor(void *buf, void *arg)
 {
 	dls_devnet_t	*ddp = buf;
 
-	ASSERT(ddp->dd_ksp == NULL);
-	ASSERT(ddp->dd_ref == 0);
-	ASSERT(ddp->dd_tref == 0);
+	VERIFY(ddp->dd_ksp == NULL);
+	VERIFY(ddp->dd_ref == 0);
+	VERIFY(ddp->dd_tref == 0);
 	mutex_destroy(&ddp->dd_mutex);
 	cv_destroy(&ddp->dd_cv);
 }
@@ -148,7 +158,12 @@ dls_zone_remove(datalink_id_t linkid, void *arg)
 	dls_devnet_t *ddp;
 
 	if (dls_devnet_hold_tmp(linkid, &ddp) == 0) {
-		(void) dls_devnet_setzid(ddp, GLOBAL_ZONEID);
+		/*
+		 * Don't bother moving transient links back to the global zone
+		 * since we will simply delete them in dls_devnet_unset.
+		 */
+		if (!ddp->dd_transient)
+			(void) dls_devnet_setzid(ddp, GLOBAL_ZONEID, B_FALSE);
 		dls_devnet_rele_tmp(ddp);
 	}
 	return (0);
@@ -529,6 +544,27 @@ dls_mgmt_get_linkid(const char *link, datalink_id_t *linkid)
 
 	getlinkid.ld_cmd = DLMGMT_CMD_GETLINKID;
 	(void) strlcpy(getlinkid.ld_link, link, MAXLINKNAMELEN);
+	getlinkid.ld_zoneid = getzoneid();
+
+	if ((err = i_dls_mgmt_upcall(&getlinkid, sizeof (getlinkid), &retval,
+	    sizeof (retval))) == 0) {
+		*linkid = retval.lr_linkid;
+	}
+	return (err);
+}
+
+int
+dls_mgmt_get_linkid_in_zone(const char *link, datalink_id_t *linkid,
+    zoneid_t zid)
+{
+	dlmgmt_door_getlinkid_t		getlinkid;
+	dlmgmt_getlinkid_retval_t	retval;
+	int				err;
+
+	ASSERT(getzoneid() == GLOBAL_ZONEID || zid == getzoneid());
+	getlinkid.ld_cmd = DLMGMT_CMD_GETLINKID;
+	(void) strlcpy(getlinkid.ld_link, link, MAXLINKNAMELEN);
+	getlinkid.ld_zoneid = zid;
 
 	if ((err = i_dls_mgmt_upcall(&getlinkid, sizeof (getlinkid), &retval,
 	    sizeof (retval))) == 0) {
@@ -537,6 +573,7 @@ dls_mgmt_get_linkid(const char *link, datalink_id_t *linkid)
 	return (err);
 }
 
+
 datalink_id_t
 dls_mgmt_get_next(datalink_id_t linkid, datalink_class_t class,
     datalink_media_t dmedia, uint32_t flags)
@@ -736,13 +773,24 @@ dls_devnet_stat_update(kstat_t *ksp, int rw)
  * Create the "link" kstats.
  */
 static void
-dls_devnet_stat_create(dls_devnet_t *ddp, zoneid_t zoneid)
+dls_devnet_stat_create(dls_devnet_t *ddp, zoneid_t zoneid, zoneid_t newzoneid)
 {
 	kstat_t	*ksp;
+	char	*nm;
+	char	kname[MAXLINKNAMELEN];
+
+	if (zoneid != newzoneid) {
+		ASSERT(zoneid == GLOBAL_ZONEID);
+		(void) snprintf(kname, sizeof (kname), "z%d_%s", newzoneid,
+		    ddp->dd_linkname);
+		nm = kname;
+	} else {
+		nm = ddp->dd_linkname;
+	}
 
-	if (dls_stat_create("link", 0, ddp->dd_linkname, zoneid,
+	if (dls_stat_create("link", 0, nm, zoneid,
 	    dls_devnet_stat_update, (void *)(uintptr_t)ddp->dd_linkid,
-	    &ksp) == 0) {
+	    &ksp, newzoneid) == 0) {
 		ASSERT(ksp != NULL);
 		if (zoneid == ddp->dd_owner_zid) {
 			ASSERT(ddp->dd_ksp == NULL);
@@ -762,12 +810,12 @@ dls_devnet_stat_destroy(dls_devnet_t *ddp, zoneid_t zoneid)
 {
 	if (zoneid == ddp->dd_owner_zid) {
 		if (ddp->dd_ksp != NULL) {
-			kstat_delete(ddp->dd_ksp);
+			dls_stat_delete(ddp->dd_ksp);
 			ddp->dd_ksp = NULL;
 		}
 	} else {
 		if (ddp->dd_zone_ksp != NULL) {
-			kstat_delete(ddp->dd_zone_ksp);
+			dls_stat_delete(ddp->dd_zone_ksp);
 			ddp->dd_zone_ksp = NULL;
 		}
 	}
@@ -778,24 +826,38 @@ dls_devnet_stat_destroy(dls_devnet_t *ddp, zoneid_t zoneid)
  * and create the new set using the new name.
  */
 static void
-dls_devnet_stat_rename(dls_devnet_t *ddp)
+dls_devnet_stat_rename(dls_devnet_t *ddp, boolean_t zoneinit)
 {
 	if (ddp->dd_ksp != NULL) {
-		kstat_delete(ddp->dd_ksp);
+		dls_stat_delete(ddp->dd_ksp);
 		ddp->dd_ksp = NULL;
 	}
-	/* We can't rename a link while it's assigned to a non-global zone. */
+	if (zoneinit && ddp->dd_zone_ksp != NULL) {
+		dls_stat_delete(ddp->dd_zone_ksp);
+		ddp->dd_zone_ksp = NULL;
+	}
+	/*
+	 * We can't rename a link while it's assigned to a non-global zone
+	 * unless we're first initializing the zone while readying it.
+	 */
 	ASSERT(ddp->dd_zone_ksp == NULL);
-	dls_devnet_stat_create(ddp, ddp->dd_owner_zid);
+	dls_devnet_stat_create(ddp, ddp->dd_owner_zid,
+	    (zoneinit ? ddp->dd_zid : ddp->dd_owner_zid));
+	if (zoneinit)
+		dls_devnet_stat_create(ddp, ddp->dd_zid, ddp->dd_zid);
 }
 
 /*
- * Associate a linkid with a given link (identified by macname)
+ * Associate the linkid with the link identified by macname. If this
+ * is called on behalf of a physical link then linkid may be
+ * DATALINK_INVALID_LINKID. Otherwise, if called on behalf of a
+ * virtual link, linkid must have a value.
  */
 static int
-dls_devnet_set(const char *macname, datalink_id_t linkid, zoneid_t zoneid,
+dls_devnet_set(mac_handle_t mh, datalink_id_t linkid, zoneid_t zoneid,
     dls_devnet_t **ddpp)
 {
+	const char		*macname = mac_name(mh);
 	dls_devnet_t		*ddp = NULL;
 	datalink_class_t	class;
 	int			err;
@@ -828,17 +890,41 @@ dls_devnet_set(const char *macname, datalink_id_t linkid, zoneid_t zoneid,
 		}
 
 		/*
-		 * This might be a physical link that has already
-		 * been created, but which does not have a linkid
-		 * because dlmgmtd was not running when it was created.
+		 * If we arrive here we know we are attempting to set
+		 * the linkid on a physical link. A virtual link
+		 * should never arrive here because it should never
+		 * call this function without a linkid. Virtual links
+		 * are created through dlgmtmd and thus we know
+		 * dlmgmtd is alive to assign it a linkid (search for
+		 * uses of dladm_create_datalink_id() to prove this to
+		 * yourself); we don't have the same guarantee for a
+		 * physical link which may perform an upcall for a
+		 * linkid while dlmgmtd is down but will continue
+		 * creating a devnet without the linkid (see
+		 * softmac_create_datalink() to see how physical link
+		 * creation works). That is why there is no entry in
+		 * the id hash but there is one in the macname hash --
+		 * softmac couldn't acquire a linkid the first time it
+		 * called this function.
+		 *
+		 * Because of the check above, we also know that
+		 * ddp->dd_linkid is not set. Following this, the link
+		 * must still be in the DD_INITIALIZING state because
+		 * that flag is removed IFF dd_linkid is set. This is
+		 * why we can ASSERT the DD_INITIALIZING flag below if
+		 * the call to i_dls_devnet_setzid() fails.
 		 */
 		if (linkid == DATALINK_INVALID_LINKID ||
 		    class != DATALINK_CLASS_PHYS) {
 			err = EINVAL;
 			goto done;
 		}
+
+		ASSERT(ddp->dd_flags & DD_INITIALIZING);
+
 	} else {
 		ddp = kmem_cache_alloc(i_dls_devnet_cachep, KM_SLEEP);
+		ddp->dd_flags = DD_INITIALIZING;
 		ddp->dd_tref = 0;
 		ddp->dd_ref++;
 		ddp->dd_owner_zid = zoneid;
@@ -856,12 +942,6 @@ dls_devnet_set(const char *macname, datalink_id_t linkid, zoneid_t zoneid,
 		    (mod_hash_val_t)ddp) == 0);
 		devnet_need_rebuild = B_TRUE;
 		stat_create = B_TRUE;
-		mutex_enter(&ddp->dd_mutex);
-		if (!ddp->dd_prop_loaded && (ddp->dd_prop_taskid == NULL)) {
-			ddp->dd_prop_taskid = taskq_dispatch(system_taskq,
-			    dls_devnet_prop_task, ddp, TQ_SLEEP);
-		}
-		mutex_exit(&ddp->dd_mutex);
 	}
 	err = 0;
 done:
@@ -875,8 +955,19 @@ done:
 	rw_exit(&i_dls_devnet_lock);
 	if (err == 0) {
 		if (zoneid != GLOBAL_ZONEID &&
-		    (err = i_dls_devnet_setzid(ddp, zoneid, B_FALSE)) != 0)
-			(void) dls_devnet_unset(macname, &linkid, B_TRUE);
+		    (err = i_dls_devnet_setzid(ddp, zoneid, B_FALSE,
+		    B_FALSE)) != 0) {
+			/*
+			 * At this point the link is marked as
+			 * DD_INITIALIZING -- there can be no
+			 * outstanding temp refs and therefore no need
+			 * to wait for them.
+			 */
+			ASSERT(ddp->dd_flags & DD_INITIALIZING);
+			(void) dls_devnet_unset(mh, &linkid, B_FALSE);
+			return (err);
+		}
+
 		/*
 		 * The kstat subsystem holds its own locks (rather perimeter)
 		 * before calling the ks_update (dls_devnet_stat_update) entry
@@ -884,20 +975,35 @@ done:
 		 * lock hierarchy is kstat locks -> i_dls_devnet_lock.
 		 */
 		if (stat_create)
-			dls_devnet_stat_create(ddp, zoneid);
+			dls_devnet_stat_create(ddp, zoneid, zoneid);
 		if (ddpp != NULL)
 			*ddpp = ddp;
+
+		mutex_enter(&ddp->dd_mutex);
+		if (linkid != DATALINK_INVALID_LINKID &&
+		    !ddp->dd_prop_loaded && ddp->dd_prop_taskid == NULL) {
+			ddp->dd_prop_taskid = taskq_dispatch(system_taskq,
+			    dls_devnet_prop_task, ddp, TQ_SLEEP);
+		}
+		mutex_exit(&ddp->dd_mutex);
+
 	}
 	return (err);
 }
 
 /*
- * Disassociate a linkid with a given link (identified by macname)
- * This waits until temporary references to the dls_devnet_t are gone.
+ * Disassociate the linkid from the link identified by macname. If
+ * wait is B_TRUE, wait until all temporary refs are released and the
+ * prop task is finished.
+ *
+ * If waiting then you SHOULD NOT call this from inside the MAC perim
+ * as deadlock will ensue. Otherwise, this function is safe to call
+ * from inside or outside the MAC perim.
  */
 static int
-dls_devnet_unset(const char *macname, datalink_id_t *id, boolean_t wait)
+dls_devnet_unset(mac_handle_t mh, datalink_id_t *id, boolean_t wait)
 {
+	const char	*macname = mac_name(mh);
 	dls_devnet_t	*ddp;
 	int		err;
 	mod_hash_val_t	val;
@@ -918,21 +1024,62 @@ dls_devnet_unset(const char *macname, datalink_id_t *id, boolean_t wait)
 	 * deadlock. Return EBUSY if the asynchronous thread started for
 	 * property loading as part of the post attach hasn't yet completed.
 	 */
-	ASSERT(ddp->dd_ref != 0);
+	VERIFY(ddp->dd_ref != 0);
 	if ((ddp->dd_ref != 1) || (!wait &&
 	    (ddp->dd_tref != 0 || ddp->dd_prop_taskid != NULL))) {
-		mutex_exit(&ddp->dd_mutex);
-		rw_exit(&i_dls_devnet_lock);
-		return (EBUSY);
+		int zstatus = 0;
+
+		/*
+		 * There are a couple of alternatives that might be going on
+		 * here; a) the zone is shutting down and it has a transient
+		 * link assigned, in which case we want to clean it up instead
+		 * of moving it back to the global zone, or b) its possible
+		 * that we're trying to clean up an orphaned vnic that was
+		 * delegated to a zone and which wasn't cleaned up properly
+		 * when the zone went away.  Check for either of these cases
+		 * before we simply return EBUSY.
+		 *
+		 * zstatus indicates which situation we are dealing with:
+		 *	 0 - means return EBUSY
+		 *	 1 - means case (a), cleanup transient link
+		 *	-1 - means case (b), orphained VNIC
+		 */
+		if (ddp->dd_ref > 1 && ddp->dd_zid != GLOBAL_ZONEID) {
+			zone_t	*zp;
+
+			if ((zp = zone_find_by_id(ddp->dd_zid)) == NULL) {
+				zstatus = -1;
+			} else {
+				if (ddp->dd_transient) {
+					zone_status_t s = zone_status_get(zp);
+
+					if (s >= ZONE_IS_SHUTTING_DOWN)
+						zstatus = 1;
+				}
+				zone_rele(zp);
+			}
+		}
+
+		if (zstatus == 0) {
+			mutex_exit(&ddp->dd_mutex);
+			rw_exit(&i_dls_devnet_lock);
+			return (EBUSY);
+		}
+
+		/*
+		 * We want to delete the link, reset ref to 1;
+		 */
+		if (zstatus == -1)
+			/* Log a warning, but continue in this case */
+			cmn_err(CE_WARN, "clear orphaned datalink: %s\n",
+			    ddp->dd_linkname);
+		ddp->dd_ref = 1;
 	}
 
 	ddp->dd_flags |= DD_CONDEMNED;
 	ddp->dd_ref--;
 	*id = ddp->dd_linkid;
 
-	if (ddp->dd_zid != GLOBAL_ZONEID)
-		(void) i_dls_devnet_setzid(ddp, GLOBAL_ZONEID, B_FALSE);
-
 	/*
 	 * Remove this dls_devnet_t from the hash table.
 	 */
@@ -947,18 +1094,40 @@ dls_devnet_unset(const char *macname, datalink_id_t *id, boolean_t wait)
 	}
 	rw_exit(&i_dls_devnet_lock);
 
+	/*
+	 * It is important to call i_dls_devnet_setzid() WITHOUT the
+	 * i_dls_devnet_lock held. The setzid call grabs the MAC
+	 * perim; thus causing DLS -> MAC lock ordering if performed
+	 * with the i_dls_devnet_lock held. This forces consumers to
+	 * grab the MAC perim before calling dls_devnet_unset() (the
+	 * locking rules state MAC -> DLS order). By performing the
+	 * setzid outside of the i_dls_devnet_lock consumers can
+	 * safely call dls_devnet_unset() outside the MAC perim.
+	 */
+	if (ddp->dd_zid != GLOBAL_ZONEID) {
+		dls_devnet_stat_destroy(ddp, ddp->dd_zid);
+		(void) i_dls_devnet_setzid(ddp, GLOBAL_ZONEID, B_FALSE,
+		    B_FALSE);
+	}
+
 	if (wait) {
 		/*
 		 * Wait until all temporary references are released.
+		 * The holders of the tref need the MAC perim to
+		 * perform their work and release the tref. To avoid
+		 * deadlock, assert that the perim is never held here.
 		 */
+		ASSERT0(MAC_PERIM_HELD(mh));
 		while ((ddp->dd_tref != 0) || (ddp->dd_prop_taskid != NULL))
 			cv_wait(&ddp->dd_cv, &ddp->dd_mutex);
 	} else {
-		ASSERT(ddp->dd_tref == 0 && ddp->dd_prop_taskid == NULL);
+		VERIFY(ddp->dd_tref == 0);
+		VERIFY(ddp->dd_prop_taskid == NULL);
 	}
 
-	if (ddp->dd_linkid != DATALINK_INVALID_LINKID)
+	if (ddp->dd_linkid != DATALINK_INVALID_LINKID) {
 		dls_devnet_stat_destroy(ddp, ddp->dd_owner_zid);
+	}
 
 	ddp->dd_prop_loaded = B_FALSE;
 	ddp->dd_linkid = DATALINK_INVALID_LINKID;
@@ -969,6 +1138,39 @@ dls_devnet_unset(const char *macname, datalink_id_t *id, boolean_t wait)
 	return (0);
 }
 
+/*
+ * This is a private hold routine used when we already have the dls_link_t, thus
+ * we know that it cannot go away.
+ */
+int
+dls_devnet_hold_tmp_by_link(dls_link_t *dlp, dls_dl_handle_t *ddhp)
+{
+	int err;
+	dls_devnet_t *ddp = NULL;
+
+	rw_enter(&i_dls_devnet_lock, RW_WRITER);
+	if ((err = mod_hash_find(i_dls_devnet_hash,
+	    (mod_hash_key_t)dlp->dl_name, (mod_hash_val_t *)&ddp)) != 0) {
+		ASSERT(err == MH_ERR_NOTFOUND);
+		rw_exit(&i_dls_devnet_lock);
+		return (ENOENT);
+	}
+
+	mutex_enter(&ddp->dd_mutex);
+	VERIFY(ddp->dd_ref > 0);
+	if (DD_NOT_VISIBLE(ddp->dd_flags)) {
+		mutex_exit(&ddp->dd_mutex);
+		rw_exit(&i_dls_devnet_lock);
+		return (ENOENT);
+	}
+	ddp->dd_tref++;
+	mutex_exit(&ddp->dd_mutex);
+	rw_exit(&i_dls_devnet_lock);
+
+	*ddhp = ddp;
+	return (0);
+}
+
 static int
 dls_devnet_hold_common(datalink_id_t linkid, dls_devnet_t **ddpp,
     boolean_t tmp_hold)
@@ -985,8 +1187,8 @@ dls_devnet_hold_common(datalink_id_t linkid, dls_devnet_t **ddpp,
 	}
 
 	mutex_enter(&ddp->dd_mutex);
-	ASSERT(ddp->dd_ref > 0);
-	if (ddp->dd_flags & DD_CONDEMNED) {
+	VERIFY(ddp->dd_ref > 0);
+	if (DD_NOT_VISIBLE(ddp->dd_flags)) {
 		mutex_exit(&ddp->dd_mutex);
 		rw_exit(&i_dls_devnet_lock);
 		return (ENOENT);
@@ -1053,8 +1255,8 @@ dls_devnet_hold_by_dev(dev_t dev, dls_dl_handle_t *ddhp)
 		return (ENOENT);
 	}
 	mutex_enter(&ddp->dd_mutex);
-	ASSERT(ddp->dd_ref > 0);
-	if (ddp->dd_flags & DD_CONDEMNED) {
+	VERIFY(ddp->dd_ref > 0);
+	if (DD_NOT_VISIBLE(ddp->dd_flags)) {
 		mutex_exit(&ddp->dd_mutex);
 		rw_exit(&i_dls_devnet_lock);
 		return (ENOENT);
@@ -1071,7 +1273,7 @@ void
 dls_devnet_rele(dls_devnet_t *ddp)
 {
 	mutex_enter(&ddp->dd_mutex);
-	ASSERT(ddp->dd_ref > 1);
+	VERIFY(ddp->dd_ref > 1);
 	ddp->dd_ref--;
 	if ((ddp->dd_flags & DD_IMPLICIT_IPTUN) && ddp->dd_ref == 1) {
 		mutex_exit(&ddp->dd_mutex);
@@ -1083,7 +1285,7 @@ dls_devnet_rele(dls_devnet_t *ddp)
 }
 
 static int
-dls_devnet_hold_by_name(const char *link, dls_devnet_t **ddpp)
+dls_devnet_hold_by_name(const char *link, dls_devnet_t **ddpp, zoneid_t zid)
 {
 	char			drv[MAXLINKNAMELEN];
 	uint_t			ppa;
@@ -1093,7 +1295,7 @@ dls_devnet_hold_by_name(const char *link, dls_devnet_t **ddpp)
 	dls_dev_handle_t	ddh;
 	int			err;
 
-	if ((err = dls_mgmt_get_linkid(link, &linkid)) == 0)
+	if ((err = dls_mgmt_get_linkid_in_zone(link, &linkid, zid)) == 0)
 		return (dls_devnet_hold(linkid, ddpp));
 
 	/*
@@ -1236,9 +1438,15 @@ dls_devnet_phydev(datalink_id_t vlanid, dev_t *devp)
  *
  *    This case does not change the <link name, linkid> mapping, so the link's
  *    kstats need to be updated with using name associated the given id2.
+ *
+ * The zoneinit parameter is used to allow us to create a VNIC in the global
+ * zone which is assigned to a non-global zone.  Since there is a race condition
+ * in the create process if two VNICs have the same name, we need to rename it
+ * after it has been assigned to the zone.
  */
 int
-dls_devnet_rename(datalink_id_t id1, datalink_id_t id2, const char *link)
+dls_devnet_rename(datalink_id_t id1, datalink_id_t id2, const char *link,
+    boolean_t zoneinit)
 {
 	dls_dev_handle_t	ddh = NULL;
 	int			err = 0;
@@ -1283,10 +1491,12 @@ dls_devnet_rename(datalink_id_t id1, datalink_id_t id2, const char *link)
 	}
 
 	mutex_enter(&ddp->dd_mutex);
-	if (ddp->dd_ref > 1) {
-		mutex_exit(&ddp->dd_mutex);
-		err = EBUSY;
-		goto done;
+	if (!zoneinit) {
+		if (ddp->dd_ref > 1) {
+			mutex_exit(&ddp->dd_mutex);
+			err = EBUSY;
+			goto done;
+		}
 	}
 	mutex_exit(&ddp->dd_mutex);
 
@@ -1297,7 +1507,15 @@ dls_devnet_rename(datalink_id_t id1, datalink_id_t id2, const char *link)
 		/* rename mac client name and its flow if exists */
 		if ((err = mac_open(ddp->dd_mac, &mh)) != 0)
 			goto done;
-		(void) mac_rename_primary(mh, link);
+		if (zoneinit) {
+			char tname[MAXLINKNAMELEN];
+
+			(void) snprintf(tname, sizeof (tname), "z%d_%s",
+			    ddp->dd_zid, link);
+			(void) mac_rename_primary(mh, tname);
+		} else {
+			(void) mac_rename_primary(mh, link);
+		}
 		mac_close(mh);
 		goto done;
 	}
@@ -1364,7 +1582,7 @@ done:
 	rw_exit(&i_dls_devnet_lock);
 
 	if (err == 0)
-		dls_devnet_stat_rename(ddp);
+		dls_devnet_stat_rename(ddp, zoneinit);
 
 	if (mph != NULL)
 		mac_perim_exit(mph);
@@ -1373,7 +1591,8 @@ done:
 }
 
 static int
-i_dls_devnet_setzid(dls_devnet_t *ddp, zoneid_t new_zoneid, boolean_t setprop)
+i_dls_devnet_setzid(dls_devnet_t *ddp, zoneid_t new_zoneid, boolean_t setprop,
+    boolean_t transient)
 {
 	int			err;
 	mac_perim_handle_t	mph;
@@ -1402,10 +1621,18 @@ i_dls_devnet_setzid(dls_devnet_t *ddp, zoneid_t new_zoneid, boolean_t setprop)
 		    sizeof (retval));
 		if (err != 0)
 			goto done;
+
+		/*
+		 * We set upcall_done only if the upcall is
+		 * successful. This way, if dls_link_setzid() fails,
+		 * we know another upcall must be done to reset the
+		 * dlmgmtd state.
+		 */
 		upcall_done = B_TRUE;
 	}
 	if ((err = dls_link_setzid(ddp->dd_mac, new_zoneid)) == 0) {
 		ddp->dd_zid = new_zoneid;
+		ddp->dd_transient = transient;
 		devnet_need_rebuild = B_TRUE;
 	}
 
@@ -1420,7 +1647,7 @@ done:
 }
 
 int
-dls_devnet_setzid(dls_dl_handle_t ddh, zoneid_t new_zid)
+dls_devnet_setzid(dls_dl_handle_t ddh, zoneid_t new_zid, boolean_t transient)
 {
 	dls_devnet_t	*ddp;
 	int		err;
@@ -1442,7 +1669,7 @@ dls_devnet_setzid(dls_dl_handle_t ddh, zoneid_t new_zid)
 		refheld = B_TRUE;
 	}
 
-	if ((err = i_dls_devnet_setzid(ddh, new_zid, B_TRUE)) != 0) {
+	if ((err = i_dls_devnet_setzid(ddh, new_zid, B_TRUE, transient)) != 0) {
 		if (refheld)
 			dls_devnet_rele(ddp);
 		return (err);
@@ -1459,7 +1686,7 @@ dls_devnet_setzid(dls_dl_handle_t ddh, zoneid_t new_zid)
 	if (old_zid != GLOBAL_ZONEID)
 		dls_devnet_stat_destroy(ddh, old_zid);
 	if (new_zid != GLOBAL_ZONEID)
-		dls_devnet_stat_create(ddh, new_zid);
+		dls_devnet_stat_create(ddh, new_zid, new_zid);
 
 	return (0);
 }
@@ -1497,15 +1724,19 @@ dls_devnet_islinkvisible(datalink_id_t linkid, zoneid_t zoneid)
  * Access a vanity naming node.
  */
 int
-dls_devnet_open(const char *link, dls_dl_handle_t *dhp, dev_t *devp)
+dls_devnet_open_in_zone(const char *link, dls_dl_handle_t *dhp, dev_t *devp,
+    zoneid_t zid)
 {
 	dls_devnet_t	*ddp;
 	dls_link_t	*dlp;
-	zoneid_t	zid = getzoneid();
+	zoneid_t	czid = getzoneid();
 	int		err;
 	mac_perim_handle_t	mph;
 
-	if ((err = dls_devnet_hold_by_name(link, &ddp)) != 0)
+	if (czid != GLOBAL_ZONEID && czid != zid)
+		return (ENOENT);
+
+	if ((err = dls_devnet_hold_by_name(link, &ddp, zid)) != 0)
 		return (err);
 
 	dls_devnet_prop_task_wait(ddp);
@@ -1538,6 +1769,12 @@ dls_devnet_open(const char *link, dls_dl_handle_t *dhp, dev_t *devp)
 	return (0);
 }
 
+int
+dls_devnet_open(const char *link, dls_dl_handle_t *dhp, dev_t *devp)
+{
+	return (dls_devnet_open_in_zone(link, dhp, devp, getzoneid()));
+}
+
 /*
  * Close access to a vanity naming node.
  */
@@ -1594,13 +1831,32 @@ dls_devnet_create(mac_handle_t mh, datalink_id_t linkid, zoneid_t zoneid)
 	 * we need to use the linkid to get the user name for the link
 	 * when we create the MAC client.
 	 */
-	if ((err = dls_devnet_set(mac_name(mh), linkid, zoneid, &ddp)) == 0) {
+	if ((err = dls_devnet_set(mh, linkid, zoneid, &ddp)) == 0) {
 		if ((err = dls_link_hold_create(mac_name(mh), &dlp)) != 0) {
 			mac_perim_exit(mph);
-			(void) dls_devnet_unset(mac_name(mh), &linkid, B_TRUE);
+			(void) dls_devnet_unset(mh, &linkid, B_FALSE);
 			return (err);
 		}
+
+		/*
+		 * If dd_linkid is set then the link was successfully
+		 * initialized. In this case we can remove the
+		 * initializing flag and make the link visible to the
+		 * rest of the system.
+		 *
+		 * If not set then we were called by softmac and it
+		 * was unable to obtain a linkid for the physical link
+		 * because dlmgmtd is down. In that case softmac will
+		 * eventually obtain a linkid and call
+		 * dls_devnet_recreate() to complete initialization.
+		 */
+		mutex_enter(&ddp->dd_mutex);
+		if (ddp->dd_linkid != DATALINK_INVALID_LINKID)
+			ddp->dd_flags &= ~DD_INITIALIZING;
+		mutex_exit(&ddp->dd_mutex);
+
 	}
+
 	mac_perim_exit(mph);
 	return (err);
 }
@@ -1614,8 +1870,19 @@ dls_devnet_create(mac_handle_t mh, datalink_id_t linkid, zoneid_t zoneid)
 int
 dls_devnet_recreate(mac_handle_t mh, datalink_id_t linkid)
 {
-	ASSERT(linkid != DATALINK_INVALID_LINKID);
-	return (dls_devnet_set(mac_name(mh), linkid, GLOBAL_ZONEID, NULL));
+	dls_devnet_t	*ddp;
+	int		err;
+
+	VERIFY(linkid != DATALINK_INVALID_LINKID);
+	if ((err = dls_devnet_set(mh, linkid, GLOBAL_ZONEID, &ddp)) == 0) {
+		mutex_enter(&ddp->dd_mutex);
+		if (ddp->dd_linkid != DATALINK_INVALID_LINKID)
+			ddp->dd_flags &= ~DD_INITIALIZING;
+		mutex_exit(&ddp->dd_mutex);
+	}
+
+	return (err);
+
 }
 
 int
@@ -1625,15 +1892,52 @@ dls_devnet_destroy(mac_handle_t mh, datalink_id_t *idp, boolean_t wait)
 	mac_perim_handle_t	mph;
 
 	*idp = DATALINK_INVALID_LINKID;
-	err = dls_devnet_unset(mac_name(mh), idp, wait);
-	if (err != 0 && err != ENOENT)
+	err = dls_devnet_unset(mh, idp, wait);
+
+	/*
+	 * We continue on in the face of ENOENT because the devnet
+	 * unset and DLS link release are not atomic and we may have a
+	 * scenario where there is no entry in i_dls_devnet_hash for
+	 * the MAC name but there is an entry in i_dls_link_hash. For
+	 * example, if the following occurred:
+	 *
+	 * 1. dls_devnet_unset() returns success, and
+	 *
+	 * 2. dls_link_rele_by_name() fails with ENOTEMPTY because
+	 *    flows still exist, and
+	 *
+	 * 3. dls_devnet_set() fails to set the zone id and calls
+	 *    dls_devnet_unset() -- leaving an entry in
+	 *    i_dls_link_hash but no corresponding entry in
+	 *    i_dls_devnet_hash.
+	 *
+	 * Even if #3 wasn't true the dls_devnet_set() may fail for
+	 * different reasons in the future; the point is that it _can_
+	 * fail as part of its contract. We can't rely on it working
+	 * so we must assume that these two pieces of state (devnet
+	 * and link hashes), which should always be in sync, can get
+	 * out of sync and thus even if we get ENOENT from the devnet
+	 * hash we should still try to delete from the link hash just
+	 * in case.
+	 *
+	 * We could prevent the ENOTEMPTY from dls_link_rele_by_name()
+	 * by calling mac_disable() before calling
+	 * dls_devnet_destroy() but that's not currently possible due
+	 * to a long-standing bug. OpenSolaris 6791335: The semantics
+	 * of mac_disable() were modified by Crossbow such that
+	 * dls_devnet_destroy() needs to be called before
+	 * mac_disable() can succeed. This is because of the implicit
+	 * reference that dls has on the mac_impl_t.
+	 */
+	if (err != 0 && err != ENOENT) {
 		return (err);
+	}
 
 	mac_perim_enter_by_mh(mh, &mph);
 	err = dls_link_rele_by_name(mac_name(mh));
-	mac_perim_exit(mph);
-
 	if (err != 0) {
+		dls_devnet_t	*ddp;
+
 		/*
 		 * XXX It is a general GLDv3 bug that dls_devnet_set() has to
 		 * be called to re-set the link when destroy fails.  The
@@ -1641,9 +1945,22 @@ dls_devnet_destroy(mac_handle_t mh, datalink_id_t *idp, boolean_t wait)
 		 * called from kernel context or from a zone other than that
 		 * which initially created the link.
 		 */
-		(void) dls_devnet_set(mac_name(mh), *idp, crgetzoneid(CRED()),
-		    NULL);
+		(void) dls_devnet_set(mh, *idp, crgetzoneid(CRED()), &ddp);
+
+		/*
+		 * You might think dd_linkid should always be set
+		 * here, but in the case where dls_devnet_unset()
+		 * returns ENOENT it will be DATALINK_INVALID_LINKID.
+		 * Stay consistent with the rest of DLS and only
+		 * remove the initializing flag if linkid is set.
+		 */
+		mutex_enter(&ddp->dd_mutex);
+		if (ddp->dd_linkid != DATALINK_INVALID_LINKID)
+			ddp->dd_flags &= ~DD_INITIALIZING;
+		mutex_exit(&ddp->dd_mutex);
 	}
+
+	mac_perim_exit(mph);
 	return (err);
 }
 
@@ -1717,6 +2034,12 @@ i_dls_devnet_destroy_iptun(datalink_id_t linkid)
 }
 
 const char *
+dls_devnet_link(dls_dl_handle_t ddh)
+{
+	return (ddh->dd_linkname);
+}
+
+const char *
 dls_devnet_mac(dls_dl_handle_t ddh)
 {
 	return (ddh->dd_mac);
diff --git a/usr/src/uts/common/io/dls/dls_stat.c b/usr/src/uts/common/io/dls/dls_stat.c
index 51e4be7260..82dceff278 100644
--- a/usr/src/uts/common/io/dls/dls_stat.c
+++ b/usr/src/uts/common/io/dls/dls_stat.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -30,30 +31,33 @@
 #include <sys/dld_impl.h>
 #include <sys/mac_ether.h>
 
-static mac_stat_info_t	i_dls_si[] = {
-	{ MAC_STAT_IFSPEED, "ifspeed", KSTAT_DATA_UINT64, 0 },
-	{ MAC_STAT_MULTIRCV, "multircv", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_BRDCSTRCV, "brdcstrcv", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_MULTIXMT, "multixmt", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_BRDCSTXMT, "brdcstxmt", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_NORCVBUF, "norcvbuf", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_IERRORS, "ierrors", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_NOXMTBUF, "noxmtbuf", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_OERRORS, "oerrors", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_COLLISIONS, "collisions", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_RBYTES, "rbytes", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_IPACKETS, "ipackets", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_OBYTES, "obytes", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_OPACKETS, "opackets", KSTAT_DATA_UINT32, 0 },
-	{ MAC_STAT_RBYTES, "rbytes64", KSTAT_DATA_UINT64, 0 },
-	{ MAC_STAT_IPACKETS, "ipackets64", KSTAT_DATA_UINT64, 0 },
-	{ MAC_STAT_OBYTES, "obytes64", KSTAT_DATA_UINT64, 0 },
-	{ MAC_STAT_OPACKETS, "opackets64", KSTAT_DATA_UINT64, 0 },
-	{ MAC_STAT_LINK_STATE, "link_state", KSTAT_DATA_UINT32,
-	    (uint64_t)LINK_STATE_UNKNOWN}
-};
-
-#define	STAT_INFO_COUNT	(sizeof (i_dls_si) / sizeof (i_dls_si[0]))
+/*
+ * structure for link kstats
+ */
+typedef struct {
+	kstat_named_t	dk_ifspeed;
+	kstat_named_t	dk_multircv;
+	kstat_named_t	dk_brdcstrcv;
+	kstat_named_t	dk_multixmt;
+	kstat_named_t	dk_brdcstxmt;
+	kstat_named_t	dk_norcvbuf;
+	kstat_named_t	dk_ierrors;
+	kstat_named_t	dk_noxmtbuf;
+	kstat_named_t	dk_oerrors;
+	kstat_named_t	dk_collisions;
+	kstat_named_t	dk_rbytes;
+	kstat_named_t	dk_ipackets;
+	kstat_named_t	dk_obytes;
+	kstat_named_t	dk_opackets;
+	kstat_named_t	dk_rbytes64;
+	kstat_named_t	dk_ipackets64;
+	kstat_named_t	dk_obytes64;
+	kstat_named_t	dk_opackets64;
+	kstat_named_t	dk_link_state;
+	kstat_named_t	dk_link_duplex;
+	kstat_named_t	dk_unknowns;
+	kstat_named_t	dk_zonename;
+} dls_kstat_t;
 
 /*
  * Exported functions.
@@ -61,42 +65,54 @@ static mac_stat_info_t	i_dls_si[] = {
 int
 dls_stat_update(kstat_t *ksp, dls_link_t *dlp, int rw)
 {
-	kstat_named_t	*knp;
-	uint_t		i;
-	uint64_t	val;
+	dls_kstat_t *dkp = ksp->ks_data;
 
 	if (rw != KSTAT_READ)
 		return (EACCES);
 
-	knp = (kstat_named_t *)ksp->ks_data;
-	for (i = 0; i < STAT_INFO_COUNT; i++) {
-		val = mac_stat_get(dlp->dl_mh, i_dls_si[i].msi_stat);
-
-		switch (i_dls_si[i].msi_type) {
-		case KSTAT_DATA_UINT64:
-			knp->value.ui64 = val;
-			break;
-		case KSTAT_DATA_UINT32:
-			knp->value.ui32 = (uint32_t)val;
-			break;
-		default:
-			ASSERT(B_FALSE);
-		}
-
-		knp++;
-	}
+	dkp->dk_ifspeed.value.ui64 = mac_stat_get(dlp->dl_mh, MAC_STAT_IFSPEED);
+	dkp->dk_multircv.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_MULTIRCV);
+	dkp->dk_brdcstrcv.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_BRDCSTRCV);
+	dkp->dk_multixmt.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_MULTIXMT);
+	dkp->dk_brdcstxmt.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_BRDCSTXMT);
+	dkp->dk_norcvbuf.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_NORCVBUF);
+	dkp->dk_ierrors.value.ui32 = mac_stat_get(dlp->dl_mh, MAC_STAT_IERRORS);
+	dkp->dk_noxmtbuf.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_NOXMTBUF);
+	dkp->dk_oerrors.value.ui32 = mac_stat_get(dlp->dl_mh, MAC_STAT_OERRORS);
+	dkp->dk_collisions.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_COLLISIONS);
+	dkp->dk_rbytes.value.ui32 = mac_stat_get(dlp->dl_mh, MAC_STAT_RBYTES);
+	dkp->dk_ipackets.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_IPACKETS);
+	dkp->dk_obytes.value.ui32 = mac_stat_get(dlp->dl_mh, MAC_STAT_OBYTES);
+	dkp->dk_opackets.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_OPACKETS);
+	dkp->dk_rbytes64.value.ui64 = mac_stat_get(dlp->dl_mh, MAC_STAT_RBYTES);
+	dkp->dk_ipackets64.value.ui64 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_IPACKETS);
+	dkp->dk_obytes64.value.ui64 = mac_stat_get(dlp->dl_mh, MAC_STAT_OBYTES);
+	dkp->dk_opackets64.value.ui64 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_OPACKETS);
+	dkp->dk_link_state.value.ui32 = mac_stat_get(dlp->dl_mh,
+	    MAC_STAT_LINK_STATE);
 
 	/*
 	 * Ethernet specific kstat "link_duplex"
 	 */
 	if (dlp->dl_mip->mi_nativemedia != DL_ETHER) {
-		knp->value.ui32 = LINK_DUPLEX_UNKNOWN;
+		dkp->dk_link_duplex.value.ui32 = LINK_DUPLEX_UNKNOWN;
 	} else {
-		val = mac_stat_get(dlp->dl_mh, ETHER_STAT_LINK_DUPLEX);
-		knp->value.ui32 = (uint32_t)val;
+		dkp->dk_link_duplex.value.ui32 =
+		    (uint32_t)mac_stat_get(dlp->dl_mh, ETHER_STAT_LINK_DUPLEX);
 	}
-	knp++;
-	knp->value.ui32 = dlp->dl_unknowns;
+
+	dkp->dk_unknowns.value.ui32 = dlp->dl_unknowns;
 
 	return (0);
 }
@@ -104,30 +120,66 @@ dls_stat_update(kstat_t *ksp, dls_link_t *dlp, int rw)
 int
 dls_stat_create(const char *module, int instance, const char *name,
     zoneid_t zoneid, int (*update)(struct kstat *, int), void *private,
-    kstat_t **kspp)
+    kstat_t **kspp, zoneid_t newzoneid)
 {
 	kstat_t		*ksp;
-	kstat_named_t	*knp;
-	uint_t		i;
+	zone_t		*zone;
+	dls_kstat_t	*dkp;
 
 	if ((ksp = kstat_create_zone(module, instance, name, "net",
-	    KSTAT_TYPE_NAMED, STAT_INFO_COUNT + 2, 0, zoneid)) == NULL) {
+	    KSTAT_TYPE_NAMED, sizeof (dls_kstat_t) / sizeof (kstat_named_t),
+	    KSTAT_FLAG_VIRTUAL, zoneid)) == NULL) {
 		return (EINVAL);
 	}
 
 	ksp->ks_update = update;
 	ksp->ks_private = private;
+	dkp = ksp->ks_data = kmem_zalloc(sizeof (dls_kstat_t), KM_SLEEP);
+	if ((zone = zone_find_by_id(newzoneid)) != NULL) {
+		ksp->ks_data_size += strlen(zone->zone_name) + 1;
+	}
 
-	knp = (kstat_named_t *)ksp->ks_data;
-	for (i = 0; i < STAT_INFO_COUNT; i++) {
-		kstat_named_init(knp, i_dls_si[i].msi_name,
-		    i_dls_si[i].msi_type);
-		knp++;
+	kstat_named_init(&dkp->dk_ifspeed, "ifspeed", KSTAT_DATA_UINT64);
+	kstat_named_init(&dkp->dk_multircv, "multircv", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_brdcstrcv, "brdcstrcv", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_multixmt, "multixmt", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_brdcstxmt, "brdcstxmt", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_norcvbuf, "norcvbuf", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_ierrors, "ierrors", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_noxmtbuf, "noxmtbuf", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_oerrors, "oerrors", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_collisions, "collisions", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_rbytes, "rbytes", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_ipackets, "ipackets", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_obytes, "obytes", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_opackets, "opackets", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_rbytes64, "rbytes64", KSTAT_DATA_UINT64);
+	kstat_named_init(&dkp->dk_ipackets64, "ipackets64", KSTAT_DATA_UINT64);
+	kstat_named_init(&dkp->dk_obytes64, "obytes64", KSTAT_DATA_UINT64);
+	kstat_named_init(&dkp->dk_opackets64, "opackets64", KSTAT_DATA_UINT64);
+	kstat_named_init(&dkp->dk_link_state, "link_state", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_link_duplex, "link_duplex",
+		    KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_unknowns, "unknowns", KSTAT_DATA_UINT32);
+	kstat_named_init(&dkp->dk_zonename, "zonename", KSTAT_DATA_STRING);
+
+	if (zone != NULL) {
+		kstat_named_setstr(&dkp->dk_zonename, zone->zone_name);
+		zone_rele(zone);
 	}
 
-	kstat_named_init(knp++, "link_duplex", KSTAT_DATA_UINT32);
-	kstat_named_init(knp, "unknowns", KSTAT_DATA_UINT32);
 	kstat_install(ksp);
 	*kspp = ksp;
 	return (0);
 }
+
+void
+dls_stat_delete(kstat_t *ksp)
+{
+	void *data;
+	if (ksp != NULL) {
+		data = ksp->ks_data;
+		kstat_delete(ksp);
+		kmem_free(data, sizeof (dls_kstat_t));
+	}
+}
diff --git a/usr/src/uts/common/io/dr_sas/THIRDPARTYLICENSE b/usr/src/uts/common/io/dr_sas/THIRDPARTYLICENSE
new file mode 100644
index 0000000000..00aefb6f51
--- /dev/null
+++ b/usr/src/uts/common/io/dr_sas/THIRDPARTYLICENSE
@@ -0,0 +1,32 @@
+/*
+ * MegaRAID device driver for SAS2.0 controllers
+ * Copyright (c) 2009, LSI Logic Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the author nor the names of its contributors may be
+ *    used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
diff --git a/usr/src/uts/common/io/dr_sas/THIRDPARTYLICENSE.descrip b/usr/src/uts/common/io/dr_sas/THIRDPARTYLICENSE.descrip
new file mode 100644
index 0000000000..ac6d2d1b15
--- /dev/null
+++ b/usr/src/uts/common/io/dr_sas/THIRDPARTYLICENSE.descrip
@@ -0,0 +1 @@
+DR_SAS DRIVER
diff --git a/usr/src/uts/common/io/dr_sas/dr_sas.c b/usr/src/uts/common/io/dr_sas/dr_sas.c
new file mode 100644
index 0000000000..5b1dc82938
--- /dev/null
+++ b/usr/src/uts/common/io/dr_sas/dr_sas.c
@@ -0,0 +1,5506 @@
+/*
+ * dr_sas.c: source for dr_sas driver
+ *
+ * MegaRAID device driver for SAS2.0 controllers
+ * Copyright (c) 2008-2009, LSI Logic Corporation.
+ * All rights reserved.
+ *
+ * Version:
+ * Author:
+ *		Arun Chandrashekhar
+ *		Manju R
+ *        	Rajesh Prabhakaran
+ *        	Seokmann Ju
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the author nor the names of its contributors may be
+ *    used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/errno.h>
+#include <sys/open.h>
+#include <sys/cred.h>
+#include <sys/modctl.h>
+#include <sys/conf.h>
+#include <sys/devops.h>
+#include <sys/cmn_err.h>
+#include <sys/kmem.h>
+#include <sys/stat.h>
+#include <sys/mkdev.h>
+#include <sys/pci.h>
+#include <sys/scsi/scsi.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/atomic.h>
+#include <sys/signal.h>
+#include <sys/fs/dv_node.h>	/* devfs_clean */
+
+#include "dr_sas.h"
+
+/*
+ * FMA header files
+ */
+#include <sys/ddifm.h>
+#include <sys/fm/protocol.h>
+#include <sys/fm/util.h>
+#include <sys/fm/io/ddi.h>
+
+/*
+ * Local static data
+ */
+static void	*drsas_state = NULL;
+static int 	debug_level_g = CL_NONE;
+
+#pragma weak scsi_hba_open
+#pragma weak scsi_hba_close
+#pragma weak scsi_hba_ioctl
+
+static ddi_dma_attr_t drsas_generic_dma_attr = {
+	DMA_ATTR_V0,		/* dma_attr_version */
+	0,			/* low DMA address range */
+	0xFFFFFFFFU,		/* high DMA address range */
+	0xFFFFFFFFU,		/* DMA counter register  */
+	8,			/* DMA address alignment */
+	0x07,			/* DMA burstsizes  */
+	1,			/* min DMA size */
+	0xFFFFFFFFU,		/* max DMA size */
+	0xFFFFFFFFU,		/* segment boundary */
+	DRSAS_MAX_SGE_CNT,	/* dma_attr_sglen */
+	512,			/* granularity of device */
+	0			/* bus specific DMA flags */
+};
+
+int32_t drsas_max_cap_maxxfer = 0x1000000;
+
+/*
+ * cb_ops contains base level routines
+ */
+static struct cb_ops drsas_cb_ops = {
+	drsas_open,		/* open */
+	drsas_close,		/* close */
+	nodev,			/* strategy */
+	nodev,			/* print */
+	nodev,			/* dump */
+	nodev,			/* read */
+	nodev,			/* write */
+	drsas_ioctl,		/* ioctl */
+	nodev,			/* devmap */
+	nodev,			/* mmap */
+	nodev,			/* segmap */
+	nochpoll,		/* poll */
+	nodev,			/* cb_prop_op */
+	0,			/* streamtab  */
+	D_NEW | D_HOTPLUG,	/* cb_flag */
+	CB_REV,			/* cb_rev */
+	nodev,			/* cb_aread */
+	nodev			/* cb_awrite */
+};
+
+/*
+ * dev_ops contains configuration routines
+ */
+static struct dev_ops drsas_ops = {
+	DEVO_REV,		/* rev, */
+	0,			/* refcnt */
+	drsas_getinfo,		/* getinfo */
+	nulldev,		/* identify */
+	nulldev,		/* probe */
+	drsas_attach,		/* attach */
+	drsas_detach,		/* detach */
+	drsas_reset,		/* reset */
+	&drsas_cb_ops,		/* char/block ops */
+	NULL,			/* bus ops */
+	NULL,			/* power */
+	ddi_quiesce_not_supported,		/* quiesce */
+};
+
+char _depends_on[] = "misc/scsi";
+
+static struct modldrv modldrv = {
+	&mod_driverops,		/* module type - driver */
+	DRSAS_VERSION,
+	&drsas_ops,		/* driver ops */
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,	/* ml_rev - must be MODREV_1 */
+	&modldrv,	/* ml_linkage */
+	NULL		/* end of driver linkage */
+};
+
+static struct ddi_device_acc_attr endian_attr = {
+	DDI_DEVICE_ATTR_V0,
+	DDI_STRUCTURE_LE_ACC,
+	DDI_STRICTORDER_ACC
+};
+
+
+/*
+ * ************************************************************************** *
+ *                                                                            *
+ *         common entry points - for loadable kernel modules                  *
+ *                                                                            *
+ * ************************************************************************** *
+ */
+
+int
+_init(void)
+{
+	int ret;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	ret = ddi_soft_state_init(&drsas_state,
+	    sizeof (struct drsas_instance), 0);
+
+	if (ret != DDI_SUCCESS) {
+		con_log(CL_ANN, (CE_WARN, "dr_sas: could not init state"));
+		return (ret);
+	}
+
+	if ((ret = scsi_hba_init(&modlinkage)) != DDI_SUCCESS) {
+		con_log(CL_ANN, (CE_WARN, "dr_sas: could not init scsi hba"));
+		ddi_soft_state_fini(&drsas_state);
+		return (ret);
+	}
+
+	ret = mod_install(&modlinkage);
+
+	if (ret != DDI_SUCCESS) {
+		con_log(CL_ANN, (CE_WARN, "dr_sas: mod_install failed"));
+		scsi_hba_fini(&modlinkage);
+		ddi_soft_state_fini(&drsas_state);
+	}
+
+	return (ret);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int ret;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	if ((ret = mod_remove(&modlinkage)) != DDI_SUCCESS)
+		return (ret);
+
+	scsi_hba_fini(&modlinkage);
+
+	ddi_soft_state_fini(&drsas_state);
+
+	return (ret);
+}
+
+
+/*
+ * ************************************************************************** *
+ *                                                                            *
+ *               common entry points - for autoconfiguration                  *
+ *                                                                            *
+ * ************************************************************************** *
+ */
+
+static int
+drsas_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	int		instance_no;
+	int		nregs;
+	uint8_t		added_isr_f = 0;
+	uint8_t		added_soft_isr_f = 0;
+	uint8_t		create_devctl_node_f = 0;
+	uint8_t		create_scsi_node_f = 0;
+	uint8_t		create_ioc_node_f = 0;
+	uint8_t		tran_alloc_f = 0;
+	uint8_t 	irq;
+	uint16_t	vendor_id;
+	uint16_t	device_id;
+	uint16_t	subsysvid;
+	uint16_t	subsysid;
+	uint16_t	command;
+	off_t		reglength = 0;
+	int		intr_types = 0;
+	char		*data;
+	int		msi_enable = 0;
+
+	scsi_hba_tran_t		*tran;
+	ddi_dma_attr_t  tran_dma_attr;
+	struct drsas_instance	*instance;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* CONSTCOND */
+	ASSERT(NO_COMPETING_THREADS);
+
+	instance_no = ddi_get_instance(dip);
+
+	/*
+	 * check to see whether this device is in a DMA-capable slot.
+	 */
+	if (ddi_slaveonly(dip) == DDI_SUCCESS) {
+		con_log(CL_ANN, (CE_WARN,
+		    "dr_sas%d: Device in slave-only slot, unused",
+		    instance_no));
+		return (DDI_FAILURE);
+	}
+
+	switch (cmd) {
+		case DDI_ATTACH:
+			con_log(CL_DLEVEL1, (CE_NOTE, "dr_sas: DDI_ATTACH"));
+			/* allocate the soft state for the instance */
+			if (ddi_soft_state_zalloc(drsas_state, instance_no)
+			    != DDI_SUCCESS) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas%d: Failed to allocate soft state",
+				    instance_no));
+
+				return (DDI_FAILURE);
+			}
+
+			instance = (struct drsas_instance *)ddi_get_soft_state
+			    (drsas_state, instance_no);
+
+			if (instance == NULL) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas%d: Bad soft state", instance_no));
+
+				ddi_soft_state_free(drsas_state, instance_no);
+
+				return (DDI_FAILURE);
+			}
+
+			bzero((caddr_t)instance,
+			    sizeof (struct drsas_instance));
+
+			instance->func_ptr = kmem_zalloc(
+			    sizeof (struct drsas_func_ptr), KM_SLEEP);
+			ASSERT(instance->func_ptr);
+
+			/* Setup the PCI configuration space handles */
+			if (pci_config_setup(dip, &instance->pci_handle) !=
+			    DDI_SUCCESS) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas%d: pci config setup failed ",
+				    instance_no));
+
+				kmem_free(instance->func_ptr,
+				    sizeof (struct drsas_func_ptr));
+				ddi_soft_state_free(drsas_state, instance_no);
+
+				return (DDI_FAILURE);
+			}
+
+			if (ddi_dev_nregs(dip, &nregs) != DDI_SUCCESS) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas: failed to get registers."));
+
+				pci_config_teardown(&instance->pci_handle);
+				kmem_free(instance->func_ptr,
+				    sizeof (struct drsas_func_ptr));
+				ddi_soft_state_free(drsas_state, instance_no);
+
+				return (DDI_FAILURE);
+			}
+
+			vendor_id = pci_config_get16(instance->pci_handle,
+			    PCI_CONF_VENID);
+			device_id = pci_config_get16(instance->pci_handle,
+			    PCI_CONF_DEVID);
+
+			subsysvid = pci_config_get16(instance->pci_handle,
+			    PCI_CONF_SUBVENID);
+			subsysid = pci_config_get16(instance->pci_handle,
+			    PCI_CONF_SUBSYSID);
+
+			pci_config_put16(instance->pci_handle, PCI_CONF_COMM,
+			    (pci_config_get16(instance->pci_handle,
+			    PCI_CONF_COMM) | PCI_COMM_ME));
+			irq = pci_config_get8(instance->pci_handle,
+			    PCI_CONF_ILINE);
+
+			con_log(CL_DLEVEL1, (CE_CONT, "dr_sas%d: "
+			    "0x%x:0x%x 0x%x:0x%x, irq:%d drv-ver:%s",
+			    instance_no, vendor_id, device_id, subsysvid,
+			    subsysid, irq, DRSAS_VERSION));
+
+			/* enable bus-mastering */
+			command = pci_config_get16(instance->pci_handle,
+			    PCI_CONF_COMM);
+
+			if (!(command & PCI_COMM_ME)) {
+				command |= PCI_COMM_ME;
+
+				pci_config_put16(instance->pci_handle,
+				    PCI_CONF_COMM, command);
+
+				con_log(CL_ANN, (CE_CONT, "dr_sas%d: "
+				    "enable bus-mastering", instance_no));
+			} else {
+				con_log(CL_DLEVEL1, (CE_CONT, "dr_sas%d: "
+				"bus-mastering already set", instance_no));
+			}
+
+			/* initialize function pointers */
+			if ((device_id == PCI_DEVICE_ID_LSI_2108VDE) ||
+			    (device_id == PCI_DEVICE_ID_LSI_2108V)) {
+				con_log(CL_DLEVEL1, (CE_CONT, "dr_sas%d: "
+				    "2108V/DE detected", instance_no));
+				instance->func_ptr->read_fw_status_reg =
+				    read_fw_status_reg_ppc;
+				instance->func_ptr->issue_cmd = issue_cmd_ppc;
+				instance->func_ptr->issue_cmd_in_sync_mode =
+				    issue_cmd_in_sync_mode_ppc;
+				instance->func_ptr->issue_cmd_in_poll_mode =
+				    issue_cmd_in_poll_mode_ppc;
+				instance->func_ptr->enable_intr =
+				    enable_intr_ppc;
+				instance->func_ptr->disable_intr =
+				    disable_intr_ppc;
+				instance->func_ptr->intr_ack = intr_ack_ppc;
+			} else {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas: Invalid device detected"));
+
+				pci_config_teardown(&instance->pci_handle);
+				kmem_free(instance->func_ptr,
+				    sizeof (struct drsas_func_ptr));
+				ddi_soft_state_free(drsas_state, instance_no);
+
+				return (DDI_FAILURE);
+			}
+
+			instance->baseaddress = pci_config_get32(
+			    instance->pci_handle, PCI_CONF_BASE0);
+			instance->baseaddress &= 0x0fffc;
+
+			instance->dip		= dip;
+			instance->vendor_id	= vendor_id;
+			instance->device_id	= device_id;
+			instance->subsysvid	= subsysvid;
+			instance->subsysid	= subsysid;
+			instance->instance	= instance_no;
+
+			/* Initialize FMA */
+			instance->fm_capabilities = ddi_prop_get_int(
+			    DDI_DEV_T_ANY, instance->dip, DDI_PROP_DONTPASS,
+			    "fm-capable", DDI_FM_EREPORT_CAPABLE |
+			    DDI_FM_ACCCHK_CAPABLE | DDI_FM_DMACHK_CAPABLE
+			    | DDI_FM_ERRCB_CAPABLE);
+
+			drsas_fm_init(instance);
+
+			/* Initialize Interrupts */
+			if ((ddi_dev_regsize(instance->dip,
+			    REGISTER_SET_IO_2108, &reglength) != DDI_SUCCESS) ||
+			    reglength < MINIMUM_MFI_MEM_SZ) {
+				return (DDI_FAILURE);
+			}
+			if (reglength > DEFAULT_MFI_MEM_SZ) {
+				reglength = DEFAULT_MFI_MEM_SZ;
+				con_log(CL_DLEVEL1, (CE_NOTE,
+				    "dr_sas: register length to map is "
+				    "0x%lx bytes", reglength));
+			}
+			if (ddi_regs_map_setup(instance->dip,
+			    REGISTER_SET_IO_2108, &instance->regmap, 0,
+			    reglength, &endian_attr, &instance->regmap_handle)
+			    != DDI_SUCCESS) {
+				con_log(CL_ANN, (CE_NOTE,
+				    "dr_sas: couldn't map control registers"));
+				goto fail_attach;
+			}
+
+			/*
+			 * Disable Interrupt Now.
+			 * Setup Software interrupt
+			 */
+			instance->func_ptr->disable_intr(instance);
+
+			msi_enable = 0;
+			if (ddi_prop_lookup_string(DDI_DEV_T_ANY, dip, 0,
+			    "drsas-enable-msi", &data) == DDI_SUCCESS) {
+				if (strncmp(data, "yes", 3) == 0) {
+					msi_enable = 1;
+					con_log(CL_ANN, (CE_WARN,
+					    "msi_enable = %d ENABLED",
+					    msi_enable));
+				}
+				ddi_prop_free(data);
+			}
+
+			con_log(CL_DLEVEL1, (CE_WARN, "msi_enable = %d",
+			    msi_enable));
+
+			/* Check for all supported interrupt types */
+			if (ddi_intr_get_supported_types(
+			    dip, &intr_types) != DDI_SUCCESS) {
+				con_log(CL_ANN, (CE_WARN,
+				    "ddi_intr_get_supported_types() failed"));
+				goto fail_attach;
+			}
+
+			con_log(CL_DLEVEL1, (CE_NOTE,
+			    "ddi_intr_get_supported_types() ret: 0x%x",
+			    intr_types));
+
+			/* Initialize and Setup Interrupt handler */
+			if (msi_enable && (intr_types & DDI_INTR_TYPE_MSIX)) {
+				if (drsas_add_intrs(instance,
+				    DDI_INTR_TYPE_MSIX) != DDI_SUCCESS) {
+					con_log(CL_ANN, (CE_WARN,
+					    "MSIX interrupt query failed"));
+					goto fail_attach;
+				}
+				instance->intr_type = DDI_INTR_TYPE_MSIX;
+			} else if (msi_enable && (intr_types &
+			    DDI_INTR_TYPE_MSI)) {
+				if (drsas_add_intrs(instance,
+				    DDI_INTR_TYPE_MSI) != DDI_SUCCESS) {
+					con_log(CL_ANN, (CE_WARN,
+					    "MSI interrupt query failed"));
+					goto fail_attach;
+				}
+				instance->intr_type = DDI_INTR_TYPE_MSI;
+			} else if (intr_types & DDI_INTR_TYPE_FIXED) {
+				msi_enable = 0;
+				if (drsas_add_intrs(instance,
+				    DDI_INTR_TYPE_FIXED) != DDI_SUCCESS) {
+					con_log(CL_ANN, (CE_WARN,
+					    "FIXED interrupt query failed"));
+					goto fail_attach;
+				}
+				instance->intr_type = DDI_INTR_TYPE_FIXED;
+			} else {
+				con_log(CL_ANN, (CE_WARN, "Device cannot "
+				    "suppport either FIXED or MSI/X "
+				    "interrupts"));
+				goto fail_attach;
+			}
+
+			added_isr_f = 1;
+
+			/* setup the mfi based low level driver */
+			if (init_mfi(instance) != DDI_SUCCESS) {
+				con_log(CL_ANN, (CE_WARN, "dr_sas: "
+				"could not initialize the low level driver"));
+
+				goto fail_attach;
+			}
+
+			/* Initialize all Mutex */
+			INIT_LIST_HEAD(&instance->completed_pool_list);
+			mutex_init(&instance->completed_pool_mtx,
+			    "completed_pool_mtx", MUTEX_DRIVER,
+			    DDI_INTR_PRI(instance->intr_pri));
+
+			mutex_init(&instance->int_cmd_mtx, "int_cmd_mtx",
+			    MUTEX_DRIVER, DDI_INTR_PRI(instance->intr_pri));
+			cv_init(&instance->int_cmd_cv, NULL, CV_DRIVER, NULL);
+
+			mutex_init(&instance->cmd_pool_mtx, "cmd_pool_mtx",
+			    MUTEX_DRIVER, DDI_INTR_PRI(instance->intr_pri));
+
+			/* Register our soft-isr for highlevel interrupts. */
+			instance->isr_level = instance->intr_pri;
+			if (instance->isr_level == HIGH_LEVEL_INTR) {
+				if (ddi_add_softintr(dip, DDI_SOFTINT_HIGH,
+				    &instance->soft_intr_id, NULL, NULL,
+				    drsas_softintr, (caddr_t)instance) !=
+				    DDI_SUCCESS) {
+					con_log(CL_ANN, (CE_WARN,
+					    " Software ISR did not register"));
+
+					goto fail_attach;
+				}
+
+				added_soft_isr_f = 1;
+			}
+
+			/* Allocate a transport structure */
+			tran = scsi_hba_tran_alloc(dip, SCSI_HBA_CANSLEEP);
+
+			if (tran == NULL) {
+				con_log(CL_ANN, (CE_WARN,
+				    "scsi_hba_tran_alloc failed"));
+				goto fail_attach;
+			}
+
+			tran_alloc_f = 1;
+
+			instance->tran = tran;
+
+			tran->tran_hba_private	= instance;
+			tran->tran_tgt_init	= drsas_tran_tgt_init;
+			tran->tran_tgt_probe	= scsi_hba_probe;
+			tran->tran_tgt_free	= drsas_tran_tgt_free;
+			tran->tran_init_pkt	= drsas_tran_init_pkt;
+			tran->tran_start	= drsas_tran_start;
+			tran->tran_abort	= drsas_tran_abort;
+			tran->tran_reset	= drsas_tran_reset;
+			tran->tran_getcap	= drsas_tran_getcap;
+			tran->tran_setcap	= drsas_tran_setcap;
+			tran->tran_destroy_pkt	= drsas_tran_destroy_pkt;
+			tran->tran_dmafree	= drsas_tran_dmafree;
+			tran->tran_sync_pkt	= drsas_tran_sync_pkt;
+			tran->tran_bus_config	= drsas_tran_bus_config;
+
+			tran_dma_attr = drsas_generic_dma_attr;
+			tran_dma_attr.dma_attr_sgllen = instance->max_num_sge;
+
+			/* Attach this instance of the hba */
+			if (scsi_hba_attach_setup(dip, &tran_dma_attr, tran, 0)
+			    != DDI_SUCCESS) {
+				con_log(CL_ANN, (CE_WARN,
+				    "scsi_hba_attach failed"));
+
+				goto fail_attach;
+			}
+
+			/* create devctl node for cfgadm command */
+			if (ddi_create_minor_node(dip, "devctl",
+			    S_IFCHR, INST2DEVCTL(instance_no),
+			    DDI_NT_SCSI_NEXUS, 0) == DDI_FAILURE) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas: failed to create devctl node."));
+
+				goto fail_attach;
+			}
+
+			create_devctl_node_f = 1;
+
+			/* create scsi node for cfgadm command */
+			if (ddi_create_minor_node(dip, "scsi", S_IFCHR,
+			    INST2SCSI(instance_no),
+			    DDI_NT_SCSI_ATTACHMENT_POINT, 0) ==
+			    DDI_FAILURE) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas: failed to create scsi node."));
+
+				goto fail_attach;
+			}
+
+			create_scsi_node_f = 1;
+
+			(void) sprintf(instance->iocnode, "%d:lsirdctl",
+			    instance_no);
+
+			/*
+			 * Create a node for applications
+			 * for issuing ioctl to the driver.
+			 */
+			if (ddi_create_minor_node(dip, instance->iocnode,
+			    S_IFCHR, INST2LSIRDCTL(instance_no),
+			    DDI_PSEUDO, 0) == DDI_FAILURE) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas: failed to create ioctl node."));
+
+				goto fail_attach;
+			}
+
+			create_ioc_node_f = 1;
+
+			/* Create a taskq to handle dr events */
+			if ((instance->taskq = ddi_taskq_create(dip,
+			    "drsas_dr_taskq", 1,
+			    TASKQ_DEFAULTPRI, 0)) == NULL) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas: failed to create taskq "));
+				instance->taskq = NULL;
+				goto fail_attach;
+			}
+
+			/* enable interrupt */
+			instance->func_ptr->enable_intr(instance);
+
+			/* initiate AEN */
+			if (start_mfi_aen(instance)) {
+				con_log(CL_ANN, (CE_WARN,
+				    "dr_sas: failed to initiate AEN."));
+				goto fail_initiate_aen;
+			}
+
+			con_log(CL_DLEVEL1, (CE_NOTE,
+			    "AEN started for instance %d.", instance_no));
+
+			/* Finally! We are on the air.  */
+			ddi_report_dev(dip);
+
+			if (drsas_check_acc_handle(instance->regmap_handle) !=
+			    DDI_SUCCESS) {
+				goto fail_attach;
+			}
+			if (drsas_check_acc_handle(instance->pci_handle) !=
+			    DDI_SUCCESS) {
+				goto fail_attach;
+			}
+			instance->dr_ld_list =
+			    kmem_zalloc(MRDRV_MAX_LD * sizeof (struct drsas_ld),
+			    KM_SLEEP);
+			break;
+		case DDI_PM_RESUME:
+			con_log(CL_ANN, (CE_NOTE,
+			    "dr_sas: DDI_PM_RESUME"));
+			break;
+		case DDI_RESUME:
+			con_log(CL_ANN, (CE_NOTE,
+			    "dr_sas: DDI_RESUME"));
+			break;
+		default:
+			con_log(CL_ANN, (CE_WARN,
+			    "dr_sas: invalid attach cmd=%x", cmd));
+			return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+
+fail_initiate_aen:
+fail_attach:
+	if (create_devctl_node_f) {
+		ddi_remove_minor_node(dip, "devctl");
+	}
+
+	if (create_scsi_node_f) {
+		ddi_remove_minor_node(dip, "scsi");
+	}
+
+	if (create_ioc_node_f) {
+		ddi_remove_minor_node(dip, instance->iocnode);
+	}
+
+	if (tran_alloc_f) {
+		scsi_hba_tran_free(tran);
+	}
+
+
+	if (added_soft_isr_f) {
+		ddi_remove_softintr(instance->soft_intr_id);
+	}
+
+	if (added_isr_f) {
+		drsas_rem_intrs(instance);
+	}
+
+	if (instance && instance->taskq) {
+		ddi_taskq_destroy(instance->taskq);
+	}
+
+	drsas_fm_ereport(instance, DDI_FM_DEVICE_NO_RESPONSE);
+	ddi_fm_service_impact(instance->dip, DDI_SERVICE_LOST);
+
+	drsas_fm_fini(instance);
+
+	pci_config_teardown(&instance->pci_handle);
+
+	ddi_soft_state_free(drsas_state, instance_no);
+
+	con_log(CL_ANN, (CE_NOTE,
+	    "dr_sas: return failure from drsas_attach"));
+
+	return (DDI_FAILURE);
+}
+
+/*ARGSUSED*/
+static int
+drsas_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd,  void *arg, void **resultp)
+{
+	int	rval;
+	int	drsas_minor = getminor((dev_t)arg);
+
+	struct drsas_instance	*instance;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	switch (cmd) {
+		case DDI_INFO_DEVT2DEVINFO:
+			instance = (struct drsas_instance *)
+			    ddi_get_soft_state(drsas_state,
+			    MINOR2INST(drsas_minor));
+
+			if (instance == NULL) {
+				*resultp = NULL;
+				rval = DDI_FAILURE;
+			} else {
+				*resultp = instance->dip;
+				rval = DDI_SUCCESS;
+			}
+			break;
+		case DDI_INFO_DEVT2INSTANCE:
+			*resultp = (void *)instance;
+			rval = DDI_SUCCESS;
+			break;
+		default:
+			*resultp = NULL;
+			rval = DDI_FAILURE;
+	}
+
+	return (rval);
+}
+
+static int
+drsas_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	int	instance_no;
+
+	struct drsas_instance	*instance;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* CONSTCOND */
+	ASSERT(NO_COMPETING_THREADS);
+
+	instance_no = ddi_get_instance(dip);
+
+	instance = (struct drsas_instance *)ddi_get_soft_state(drsas_state,
+	    instance_no);
+
+	if (!instance) {
+		con_log(CL_ANN, (CE_WARN,
+		    "dr_sas:%d could not get instance in detach",
+		    instance_no));
+
+		return (DDI_FAILURE);
+	}
+
+	con_log(CL_ANN, (CE_NOTE,
+	    "dr_sas%d: detaching device 0x%4x:0x%4x:0x%4x:0x%4x",
+	    instance_no, instance->vendor_id, instance->device_id,
+	    instance->subsysvid, instance->subsysid));
+
+	switch (cmd) {
+	case DDI_DETACH:
+		con_log(CL_ANN, (CE_NOTE,
+		    "drsas_detach: DDI_DETACH"));
+
+		if (scsi_hba_detach(dip) != DDI_SUCCESS) {
+			con_log(CL_ANN, (CE_WARN,
+			    "dr_sas:%d failed to detach",
+			    instance_no));
+
+			return (DDI_FAILURE);
+		}
+
+		scsi_hba_tran_free(instance->tran);
+
+		flush_cache(instance);
+
+		if (abort_aen_cmd(instance, instance->aen_cmd)) {
+			con_log(CL_ANN, (CE_WARN, "drsas_detach: "
+			    "failed to abort prevous AEN command"));
+
+			return (DDI_FAILURE);
+		}
+
+		instance->func_ptr->disable_intr(instance);
+
+		if (instance->isr_level == HIGH_LEVEL_INTR) {
+			ddi_remove_softintr(instance->soft_intr_id);
+		}
+
+		drsas_rem_intrs(instance);
+
+		if (instance->taskq) {
+			ddi_taskq_destroy(instance->taskq);
+		}
+		kmem_free(instance->dr_ld_list, MRDRV_MAX_LD
+		    * sizeof (struct drsas_ld));
+		free_space_for_mfi(instance);
+
+		drsas_fm_fini(instance);
+
+		pci_config_teardown(&instance->pci_handle);
+
+		kmem_free(instance->func_ptr,
+		    sizeof (struct drsas_func_ptr));
+
+		ddi_soft_state_free(drsas_state, instance_no);
+		break;
+	case DDI_PM_SUSPEND:
+		con_log(CL_ANN, (CE_NOTE,
+		    "drsas_detach: DDI_PM_SUSPEND"));
+
+		break;
+	case DDI_SUSPEND:
+		con_log(CL_ANN, (CE_NOTE,
+		    "drsas_detach: DDI_SUSPEND"));
+
+		break;
+	default:
+		con_log(CL_ANN, (CE_WARN,
+		    "invalid detach command:0x%x", cmd));
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * ************************************************************************** *
+ *                                                                            *
+ *             common entry points - for character driver types               *
+ *                                                                            *
+ * ************************************************************************** *
+ */
+static  int
+drsas_open(dev_t *dev, int openflags, int otyp, cred_t *credp)
+{
+	int	rval = 0;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* Check root permissions */
+	if (drv_priv(credp) != 0) {
+		con_log(CL_ANN, (CE_WARN,
+		    "dr_sas: Non-root ioctl access denied!"));
+		return (EPERM);
+	}
+
+	/* Verify we are being opened as a character device */
+	if (otyp != OTYP_CHR) {
+		con_log(CL_ANN, (CE_WARN,
+		    "dr_sas: ioctl node must be a char node"));
+		return (EINVAL);
+	}
+
+	if (ddi_get_soft_state(drsas_state, MINOR2INST(getminor(*dev)))
+	    == NULL) {
+		return (ENXIO);
+	}
+
+	if (scsi_hba_open) {
+		rval = scsi_hba_open(dev, openflags, otyp, credp);
+	}
+
+	return (rval);
+}
+
+static  int
+drsas_close(dev_t dev, int openflags, int otyp, cred_t *credp)
+{
+	int	rval = 0;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* no need for locks! */
+
+	if (scsi_hba_close) {
+		rval = scsi_hba_close(dev, openflags, otyp, credp);
+	}
+
+	return (rval);
+}
+
+static int
+drsas_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rvalp)
+{
+	int	rval = 0;
+
+	struct drsas_instance	*instance;
+	struct drsas_ioctl	*ioctl;
+	struct drsas_aen	aen;
+	int i;
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	instance = ddi_get_soft_state(drsas_state, MINOR2INST(getminor(dev)));
+
+	if (instance == NULL) {
+		/* invalid minor number */
+		con_log(CL_ANN, (CE_WARN, "dr_sas: adapter not found."));
+		return (ENXIO);
+	}
+
+	ioctl = (struct drsas_ioctl *)kmem_zalloc(sizeof (struct drsas_ioctl),
+	    KM_SLEEP);
+	ASSERT(ioctl);
+
+	switch ((uint_t)cmd) {
+		case DRSAS_IOCTL_FIRMWARE:
+			for (i = 0; i < sizeof (struct drsas_ioctl); i++) {
+				if (ddi_copyin((uint8_t *)arg+i,
+				    (uint8_t *)ioctl+i, 1, mode)) {
+					con_log(CL_ANN, (CE_WARN, "drsas_ioctl "
+					    "ERROR IOCTL copyin"));
+					kmem_free(ioctl,
+					    sizeof (struct drsas_ioctl));
+					return (EFAULT);
+				}
+			}
+			if (ioctl->control_code == DRSAS_DRIVER_IOCTL_COMMON) {
+				rval = handle_drv_ioctl(instance, ioctl, mode);
+			} else {
+				rval = handle_mfi_ioctl(instance, ioctl, mode);
+			}
+			for (i = 0; i < sizeof (struct drsas_ioctl) - 1; i++) {
+				if (ddi_copyout((uint8_t *)ioctl+i,
+				    (uint8_t *)arg+i, 1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "drsas_ioctl: ddi_copyout "
+					    "failed"));
+					rval = 1;
+					break;
+				}
+			}
+
+			break;
+		case DRSAS_IOCTL_AEN:
+			for (i = 0; i < sizeof (struct drsas_aen); i++) {
+				if (ddi_copyin((uint8_t *)arg+i,
+				    (uint8_t *)&aen+i, 1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "drsas_ioctl: "
+					    "ERROR AEN copyin"));
+					kmem_free(ioctl,
+					    sizeof (struct drsas_ioctl));
+					return (EFAULT);
+				}
+			}
+
+			rval = handle_mfi_aen(instance, &aen);
+			for (i = 0; i < sizeof (struct drsas_aen); i++) {
+				if (ddi_copyout((uint8_t *)&aen + i,
+				    (uint8_t *)arg + i, 1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "drsas_ioctl: "
+					    "ddi_copyout failed"));
+					rval = 1;
+					break;
+				}
+			}
+
+			break;
+		default:
+			rval = scsi_hba_ioctl(dev, cmd, arg,
+			    mode, credp, rvalp);
+
+			con_log(CL_DLEVEL1, (CE_NOTE, "drsas_ioctl: "
+			    "scsi_hba_ioctl called, ret = %x.", rval));
+	}
+
+	kmem_free(ioctl, sizeof (struct drsas_ioctl));
+	return (rval);
+}
+
+/*
+ * ************************************************************************** *
+ *                                                                            *
+ *               common entry points - for block driver types                 *
+ *                                                                            *
+ * ************************************************************************** *
+ */
+/*ARGSUSED*/
+static int
+drsas_reset(dev_info_t *dip, ddi_reset_cmd_t cmd)
+{
+	int	instance_no;
+
+	struct drsas_instance	*instance;
+
+	instance_no = ddi_get_instance(dip);
+	instance = (struct drsas_instance *)ddi_get_soft_state
+	    (drsas_state, instance_no);
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	if (!instance) {
+		con_log(CL_ANN, (CE_WARN, "dr_sas:%d could not get adapter "
+		    "in reset", instance_no));
+		return (DDI_FAILURE);
+	}
+
+	instance->func_ptr->disable_intr(instance);
+
+	con_log(CL_ANN1, (CE_NOTE, "flushing cache for instance %d",
+	    instance_no));
+
+	flush_cache(instance);
+
+	return (DDI_SUCCESS);
+}
+
+
+/*
+ * ************************************************************************** *
+ *                                                                            *
+ *                          entry points (SCSI HBA)                           *
+ *                                                                            *
+ * ************************************************************************** *
+ */
+/*ARGSUSED*/
+static int
+drsas_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+		scsi_hba_tran_t *tran, struct scsi_device *sd)
+{
+	struct drsas_instance *instance;
+	uint16_t tgt = sd->sd_address.a_target;
+	uint8_t lun = sd->sd_address.a_lun;
+
+	con_log(CL_ANN1, (CE_NOTE, "drsas_tgt_init target %d lun %d",
+	    tgt, lun));
+
+	instance = ADDR2MR(&sd->sd_address);
+
+	if (ndi_dev_is_persistent_node(tgt_dip) == 0) {
+		(void) ndi_merge_node(tgt_dip, drsas_name_node);
+		ddi_set_name_addr(tgt_dip, NULL);
+
+		con_log(CL_ANN1, (CE_NOTE, "drsas_tgt_init in "
+		    "ndi_dev_is_persistent_node DDI_FAILURE t = %d l = %d",
+		    tgt, lun));
+		return (DDI_FAILURE);
+	}
+
+	con_log(CL_ANN1, (CE_NOTE, "drsas_tgt_init dev_dip %p tgt_dip %p",
+	    (void *)instance->dr_ld_list[tgt].dip, (void *)tgt_dip));
+
+	if (tgt < MRDRV_MAX_LD && lun == 0) {
+		if (instance->dr_ld_list[tgt].dip == NULL &&
+		    strcmp(ddi_driver_name(sd->sd_dev), "sd") == 0) {
+			instance->dr_ld_list[tgt].dip = tgt_dip;
+			instance->dr_ld_list[tgt].lun_type = DRSAS_LD_LUN;
+		}
+	}
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static void
+drsas_tran_tgt_free(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	struct drsas_instance *instance;
+	int tgt = sd->sd_address.a_target;
+	int lun = sd->sd_address.a_lun;
+
+	instance = ADDR2MR(&sd->sd_address);
+
+	con_log(CL_ANN1, (CE_NOTE, "tgt_free t = %d l = %d", tgt, lun));
+
+	if (tgt < MRDRV_MAX_LD && lun == 0) {
+		if (instance->dr_ld_list[tgt].dip == tgt_dip) {
+			instance->dr_ld_list[tgt].dip = NULL;
+		}
+	}
+}
+
+static dev_info_t *
+drsas_find_child(struct drsas_instance *instance, uint16_t tgt, uint8_t lun)
+{
+	dev_info_t *child = NULL;
+	char addr[SCSI_MAXNAMELEN];
+	char tmp[MAXNAMELEN];
+
+	(void) sprintf(addr, "%x,%x", tgt, lun);
+	for (child = ddi_get_child(instance->dip); child;
+	    child = ddi_get_next_sibling(child)) {
+
+		if (drsas_name_node(child, tmp, MAXNAMELEN) !=
+		    DDI_SUCCESS) {
+			continue;
+		}
+
+		if (strcmp(addr, tmp) == 0) {
+			break;
+		}
+	}
+	con_log(CL_ANN1, (CE_NOTE, "drsas_find_child: return child = %p",
+	    (void *)child));
+	return (child);
+}
+
+static int
+drsas_name_node(dev_info_t *dip, char *name, int len)
+{
+	int tgt, lun;
+
+	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, dip,
+	    DDI_PROP_DONTPASS, "target", -1);
+	con_log(CL_ANN1, (CE_NOTE,
+	    "drsas_name_node: dip %p tgt %d", (void *)dip, tgt));
+	if (tgt == -1) {
+		return (DDI_FAILURE);
+	}
+	lun = ddi_prop_get_int(DDI_DEV_T_ANY, dip, DDI_PROP_DONTPASS,
+	    "lun", -1);
+	con_log(CL_ANN1,
+	    (CE_NOTE, "drsas_name_node: tgt %d lun %d", tgt, lun));
+	if (lun == -1) {
+		return (DDI_FAILURE);
+	}
+	(void) snprintf(name, len, "%x,%x", tgt, lun);
+	return (DDI_SUCCESS);
+}
+
+static struct scsi_pkt *
+drsas_tran_init_pkt(struct scsi_address *ap, register struct scsi_pkt *pkt,
+	struct buf *bp, int cmdlen, int statuslen, int tgtlen,
+	int flags, int (*callback)(), caddr_t arg)
+{
+	struct scsa_cmd	*acmd;
+	struct drsas_instance	*instance;
+	struct scsi_pkt	*new_pkt;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	instance = ADDR2MR(ap);
+
+	/* step #1 : pkt allocation */
+	if (pkt == NULL) {
+		pkt = scsi_hba_pkt_alloc(instance->dip, ap, cmdlen, statuslen,
+		    tgtlen, sizeof (struct scsa_cmd), callback, arg);
+		if (pkt == NULL) {
+			return (NULL);
+		}
+
+		acmd = PKT2CMD(pkt);
+
+		/*
+		 * Initialize the new pkt - we redundantly initialize
+		 * all the fields for illustrative purposes.
+		 */
+		acmd->cmd_pkt		= pkt;
+		acmd->cmd_flags		= 0;
+		acmd->cmd_scblen	= statuslen;
+		acmd->cmd_cdblen	= cmdlen;
+		acmd->cmd_dmahandle	= NULL;
+		acmd->cmd_ncookies	= 0;
+		acmd->cmd_cookie	= 0;
+		acmd->cmd_cookiecnt	= 0;
+		acmd->cmd_nwin		= 0;
+
+		pkt->pkt_address	= *ap;
+		pkt->pkt_comp		= (void (*)())NULL;
+		pkt->pkt_flags		= 0;
+		pkt->pkt_time		= 0;
+		pkt->pkt_resid		= 0;
+		pkt->pkt_state		= 0;
+		pkt->pkt_statistics	= 0;
+		pkt->pkt_reason		= 0;
+		new_pkt			= pkt;
+	} else {
+		acmd = PKT2CMD(pkt);
+		new_pkt = NULL;
+	}
+
+	/* step #2 : dma allocation/move */
+	if (bp && bp->b_bcount != 0) {
+		if (acmd->cmd_dmahandle == NULL) {
+			if (drsas_dma_alloc(instance, pkt, bp, flags,
+			    callback) == DDI_FAILURE) {
+				if (new_pkt) {
+					scsi_hba_pkt_free(ap, new_pkt);
+				}
+				return ((struct scsi_pkt *)NULL);
+			}
+		} else {
+			if (drsas_dma_move(instance, pkt, bp) == DDI_FAILURE) {
+				return ((struct scsi_pkt *)NULL);
+			}
+		}
+	}
+
+	return (pkt);
+}
+
+static int
+drsas_tran_start(struct scsi_address *ap, register struct scsi_pkt *pkt)
+{
+	uchar_t 	cmd_done = 0;
+
+	struct drsas_instance	*instance = ADDR2MR(ap);
+	struct drsas_cmd	*cmd;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d:SCSI CDB[0]=0x%x",
+	    __func__, __LINE__, pkt->pkt_cdbp[0]));
+
+	pkt->pkt_reason	= CMD_CMPLT;
+	*pkt->pkt_scbp = STATUS_GOOD; /* clear arq scsi_status */
+
+	cmd = build_cmd(instance, ap, pkt, &cmd_done);
+
+	/*
+	 * Check if the command is already completed by the drsas_build_cmd()
+	 * routine. In which case the busy_flag would be clear and scb will be
+	 * NULL and appropriate reason provided in pkt_reason field
+	 */
+	if (cmd_done) {
+		pkt->pkt_reason = CMD_CMPLT;
+		pkt->pkt_scbp[0] = STATUS_GOOD;
+		pkt->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET
+		    | STATE_SENT_CMD;
+		if (((pkt->pkt_flags & FLAG_NOINTR) == 0) && pkt->pkt_comp) {
+			(*pkt->pkt_comp)(pkt);
+		}
+
+		return (TRAN_ACCEPT);
+	}
+
+	if (cmd == NULL) {
+		return (TRAN_BUSY);
+	}
+
+	if ((pkt->pkt_flags & FLAG_NOINTR) == 0) {
+		if (instance->fw_outstanding > instance->max_fw_cmds) {
+			con_log(CL_ANN, (CE_CONT, "dr_sas:Firmware busy"));
+			return_mfi_pkt(instance, cmd);
+			return (TRAN_BUSY);
+		}
+
+		/* Synchronize the Cmd frame for the controller */
+		(void) ddi_dma_sync(cmd->frame_dma_obj.dma_handle, 0, 0,
+		    DDI_DMA_SYNC_FORDEV);
+
+		instance->func_ptr->issue_cmd(cmd, instance);
+
+	} else {
+		struct drsas_header *hdr = &cmd->frame->hdr;
+
+		cmd->sync_cmd = DRSAS_TRUE;
+
+		instance->func_ptr-> issue_cmd_in_poll_mode(instance, cmd);
+
+		pkt->pkt_reason		= CMD_CMPLT;
+		pkt->pkt_statistics	= 0;
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+
+		switch (ddi_get8(cmd->frame_dma_obj.acc_handle,
+		    &hdr->cmd_status)) {
+		case MFI_STAT_OK:
+			pkt->pkt_scbp[0] = STATUS_GOOD;
+			break;
+
+		case MFI_STAT_SCSI_DONE_WITH_ERROR:
+
+			pkt->pkt_reason	= CMD_CMPLT;
+			pkt->pkt_statistics = 0;
+
+			((struct scsi_status *)pkt->pkt_scbp)->sts_chk = 1;
+			break;
+
+		case MFI_STAT_DEVICE_NOT_FOUND:
+			pkt->pkt_reason		= CMD_DEV_GONE;
+			pkt->pkt_statistics	= STAT_DISCON;
+			break;
+
+		default:
+			((struct scsi_status *)pkt->pkt_scbp)->sts_busy = 1;
+		}
+
+		return_mfi_pkt(instance, cmd);
+		(void) drsas_common_check(instance, cmd);
+
+		if (pkt->pkt_comp) {
+			(*pkt->pkt_comp)(pkt);
+		}
+
+	}
+
+	return (TRAN_ACCEPT);
+}
+
+/*ARGSUSED*/
+static int
+drsas_tran_abort(struct scsi_address *ap, struct scsi_pkt *pkt)
+{
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* abort command not supported by H/W */
+
+	return (DDI_FAILURE);
+}
+
+/*ARGSUSED*/
+static int
+drsas_tran_reset(struct scsi_address *ap, int level)
+{
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* reset command not supported by H/W */
+
+	return (DDI_FAILURE);
+
+}
+
+/*ARGSUSED*/
+static int
+drsas_tran_getcap(struct scsi_address *ap, char *cap, int whom)
+{
+	int	rval = 0;
+
+	struct drsas_instance	*instance = ADDR2MR(ap);
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* we do allow inquiring about capabilities for other targets */
+	if (cap == NULL) {
+		return (-1);
+	}
+
+	switch (scsi_hba_lookup_capstr(cap)) {
+	case SCSI_CAP_DMA_MAX:
+		/* Limit to 16MB max transfer */
+		rval = drsas_max_cap_maxxfer;
+		break;
+	case SCSI_CAP_MSG_OUT:
+		rval = 1;
+		break;
+	case SCSI_CAP_DISCONNECT:
+		rval = 0;
+		break;
+	case SCSI_CAP_SYNCHRONOUS:
+		rval = 0;
+		break;
+	case SCSI_CAP_WIDE_XFER:
+		rval = 1;
+		break;
+	case SCSI_CAP_TAGGED_QING:
+		rval = 1;
+		break;
+	case SCSI_CAP_UNTAGGED_QING:
+		rval = 1;
+		break;
+	case SCSI_CAP_PARITY:
+		rval = 1;
+		break;
+	case SCSI_CAP_INITIATOR_ID:
+		rval = instance->init_id;
+		break;
+	case SCSI_CAP_ARQ:
+		rval = 1;
+		break;
+	case SCSI_CAP_LINKED_CMDS:
+		rval = 0;
+		break;
+	case SCSI_CAP_RESET_NOTIFICATION:
+		rval = 1;
+		break;
+	case SCSI_CAP_GEOMETRY:
+		rval = -1;
+
+		break;
+	default:
+		con_log(CL_DLEVEL2, (CE_NOTE, "Default cap coming 0x%x",
+		    scsi_hba_lookup_capstr(cap)));
+		rval = -1;
+		break;
+	}
+
+	return (rval);
+}
+
+/*ARGSUSED*/
+static int
+drsas_tran_setcap(struct scsi_address *ap, char *cap, int value, int whom)
+{
+	int		rval = 1;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	/* We don't allow setting capabilities for other targets */
+	if (cap == NULL || whom == 0) {
+		return (-1);
+	}
+
+	switch (scsi_hba_lookup_capstr(cap)) {
+		case SCSI_CAP_DMA_MAX:
+		case SCSI_CAP_MSG_OUT:
+		case SCSI_CAP_PARITY:
+		case SCSI_CAP_LINKED_CMDS:
+		case SCSI_CAP_RESET_NOTIFICATION:
+		case SCSI_CAP_DISCONNECT:
+		case SCSI_CAP_SYNCHRONOUS:
+		case SCSI_CAP_UNTAGGED_QING:
+		case SCSI_CAP_WIDE_XFER:
+		case SCSI_CAP_INITIATOR_ID:
+		case SCSI_CAP_ARQ:
+			/*
+			 * None of these are settable via
+			 * the capability interface.
+			 */
+			break;
+		case SCSI_CAP_TAGGED_QING:
+			rval = 1;
+			break;
+		case SCSI_CAP_SECTOR_SIZE:
+			rval = 1;
+			break;
+
+		case SCSI_CAP_TOTAL_SECTORS:
+			rval = 1;
+			break;
+		default:
+			rval = -1;
+			break;
+	}
+
+	return (rval);
+}
+
+static void
+drsas_tran_destroy_pkt(struct scsi_address *ap, struct scsi_pkt *pkt)
+{
+	struct scsa_cmd *acmd = PKT2CMD(pkt);
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	if (acmd->cmd_flags & CFLAG_DMAVALID) {
+		acmd->cmd_flags &= ~CFLAG_DMAVALID;
+
+		(void) ddi_dma_unbind_handle(acmd->cmd_dmahandle);
+
+		ddi_dma_free_handle(&acmd->cmd_dmahandle);
+
+		acmd->cmd_dmahandle = NULL;
+	}
+
+	/* free the pkt */
+	scsi_hba_pkt_free(ap, pkt);
+}
+
+/*ARGSUSED*/
+static void
+drsas_tran_dmafree(struct scsi_address *ap, struct scsi_pkt *pkt)
+{
+	register struct scsa_cmd *acmd = PKT2CMD(pkt);
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	if (acmd->cmd_flags & CFLAG_DMAVALID) {
+		acmd->cmd_flags &= ~CFLAG_DMAVALID;
+
+		(void) ddi_dma_unbind_handle(acmd->cmd_dmahandle);
+
+		ddi_dma_free_handle(&acmd->cmd_dmahandle);
+
+		acmd->cmd_dmahandle = NULL;
+	}
+}
+
+/*ARGSUSED*/
+static void
+drsas_tran_sync_pkt(struct scsi_address *ap, struct scsi_pkt *pkt)
+{
+	register struct scsa_cmd	*acmd = PKT2CMD(pkt);
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	if (acmd->cmd_flags & CFLAG_DMAVALID) {
+		(void) ddi_dma_sync(acmd->cmd_dmahandle, acmd->cmd_dma_offset,
+		    acmd->cmd_dma_len, (acmd->cmd_flags & CFLAG_DMASEND) ?
+		    DDI_DMA_SYNC_FORDEV : DDI_DMA_SYNC_FORCPU);
+	}
+}
+
+/*
+ * drsas_isr(caddr_t)
+ *
+ * The Interrupt Service Routine
+ *
+ * Collect status for all completed commands and do callback
+ *
+ */
+static uint_t
+drsas_isr(struct drsas_instance *instance)
+{
+	int		need_softintr;
+	uint32_t	producer;
+	uint32_t	consumer;
+	uint32_t	context;
+
+	struct drsas_cmd	*cmd;
+
+	con_log(CL_ANN1, (CE_NOTE, "chkpnt:%s:%d", __func__, __LINE__));
+
+	ASSERT(instance);
+	if ((instance->intr_type == DDI_INTR_TYPE_FIXED) &&
+	    !instance->func_ptr->intr_ack(instance)) {
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	(void) ddi_dma_sync(instance->mfi_internal_dma_obj.dma_handle,
+	    0, 0, DDI_DMA_SYNC_FORCPU);
+
+	if (drsas_check_dma_handle(instance->mfi_internal_dma_obj.dma_handle)
+	    != DDI_SUCCESS) {
+		drsas_fm_ereport(instance, DDI_FM_DEVICE_NO_RESPONSE);
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_LOST);
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	producer = ddi_get32(instance->mfi_internal_dma_obj.acc_handle,
+	    instance->producer);
+	consumer = ddi_get32(instance->mfi_internal_dma_obj.acc_handle,
+	    instance->consumer);
+
+	con_log(CL_ANN1, (CE_CONT, " producer %x consumer %x ",
+	    producer, consumer));
+	if (producer == consumer) {
+		con_log(CL_ANN1, (CE_WARN, "producer = consumer case"));
+		return (DDI_INTR_UNCLAIMED);
+	}
+	mutex_enter(&instance->completed_pool_mtx);
+
+	while (consumer != producer) {
+		context = ddi_get32(instance->mfi_internal_dma_obj.acc_handle,
+		    &instance->reply_queue[consumer]);
+		cmd = instance->cmd_list[context];
+		mlist_add_tail(&cmd->list, &instance->completed_pool_list);
+
+		consumer++;
+		if (consumer == (instance->max_fw_cmds + 1)) {
+			consumer = 0;
+		}
+	}
+
+	mutex_exit(&instance->completed_pool_mtx);
+
+	ddi_put32(instance->mfi_internal_dma_obj.acc_handle,
+	    instance->consumer, consumer);
+	(void) ddi_dma_sync(instance->mfi_internal_dma_obj.dma_handle,
+	    0, 0, DDI_DMA_SYNC_FORDEV);
+
+	if (instance->softint_running) {
+		need_softintr = 0;
+	} else {
+		need_softintr = 1;
+	}
+
+	if (instance->isr_level == HIGH_LEVEL_INTR) {
+		if (need_softintr) {
+			ddi_trigger_softintr(instance->soft_intr_id);
+		}
+	} else {
+		/*
+		 * Not a high-level interrupt, therefore call the soft level
+		 * interrupt explicitly
+		 */
+		(void) drsas_softintr(instance);
+	}
+
+	return (DDI_INTR_CLAIMED);
+}
+
+
+/*
+ * ************************************************************************** *
+ *                                                                            *
+ *                                  libraries                                 *
+ *                                                                            *
+ * ************************************************************************** *
+ */
+/*
+ * get_mfi_pkt : Get a command from the free pool
+ * After successful allocation, the caller of this routine
+ * must clear the frame buffer (memset to zero) before
+ * using the packet further.
+ *
+ * ***** Note *****
+ * After clearing the frame buffer the context id of the
+ * frame buffer SHOULD be restored back.
+ */
+static struct drsas_cmd *
+get_mfi_pkt(struct drsas_instance *instance)
+{
+	mlist_t 		*head = &instance->cmd_pool_list;
+	struct drsas_cmd	*cmd = NULL;
+
+	mutex_enter(&instance->cmd_pool_mtx);
+	ASSERT(mutex_owned(&instance->cmd_pool_mtx));
+
+	if (!mlist_empty(head)) {
+		cmd = mlist_entry(head->next, struct drsas_cmd, list);
+		mlist_del_init(head->next);
+	}
+	if (cmd != NULL)
+		cmd->pkt = NULL;
+	mutex_exit(&instance->cmd_pool_mtx);
+
+	return (cmd);
+}
+
+/*
+ * return_mfi_pkt : Return a cmd to free command pool
+ */
+static void
+return_mfi_pkt(struct drsas_instance *instance, struct drsas_cmd *cmd)
+{
+	mutex_enter(&instance->cmd_pool_mtx);
+	ASSERT(mutex_owned(&instance->cmd_pool_mtx));
+
+	mlist_add(&cmd->list, &instance->cmd_pool_list);
+
+	mutex_exit(&instance->cmd_pool_mtx);
+}
+
+/*
+ * destroy_mfi_frame_pool
+ */
+static void
+destroy_mfi_frame_pool(struct drsas_instance *instance)
+{
+	int		i;
+	uint32_t	max_cmd = instance->max_fw_cmds;
+
+	struct drsas_cmd	*cmd;
+
+	/* return all frames to pool */
+	for (i = 0; i < max_cmd+1; i++) {
+
+		cmd = instance->cmd_list[i];
+
+		if (cmd->frame_dma_obj_status == DMA_OBJ_ALLOCATED)
+			(void) drsas_free_dma_obj(instance, cmd->frame_dma_obj);
+
+		cmd->frame_dma_obj_status  = DMA_OBJ_FREED;
+	}
+
+}
+
+/*
+ * create_mfi_frame_pool
+ */
+static int
+create_mfi_frame_pool(struct drsas_instance *instance)
+{
+	int		i = 0;
+	int		cookie_cnt;
+	uint16_t	max_cmd;
+	uint16_t	sge_sz;
+	uint32_t	sgl_sz;
+	uint32_t	tot_frame_size;
+
+	struct drsas_cmd	*cmd;
+
+	max_cmd = instance->max_fw_cmds;
+
+	sge_sz	= sizeof (struct drsas_sge64);
+
+	/* calculated the number of 64byte frames required for SGL */
+	sgl_sz		= sge_sz * instance->max_num_sge;
+	tot_frame_size	= sgl_sz + MRMFI_FRAME_SIZE + SENSE_LENGTH;
+
+	con_log(CL_DLEVEL3, (CE_NOTE, "create_mfi_frame_pool: "
+	    "sgl_sz %x tot_frame_size %x", sgl_sz, tot_frame_size));
+
+	while (i < max_cmd+1) {
+		cmd = instance->cmd_list[i];
+
+		cmd->frame_dma_obj.size	= tot_frame_size;
+		cmd->frame_dma_obj.dma_attr = drsas_generic_dma_attr;
+		cmd->frame_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+		cmd->frame_dma_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+		cmd->frame_dma_obj.dma_attr.dma_attr_sgllen = 1;
+		cmd->frame_dma_obj.dma_attr.dma_attr_align = 64;
+
+
+		cookie_cnt = drsas_alloc_dma_obj(instance, &cmd->frame_dma_obj,
+		    (uchar_t)DDI_STRUCTURE_LE_ACC);
+
+		if (cookie_cnt == -1 || cookie_cnt > 1) {
+			con_log(CL_ANN, (CE_WARN,
+			    "create_mfi_frame_pool: could not alloc."));
+			return (DDI_FAILURE);
+		}
+
+		bzero(cmd->frame_dma_obj.buffer, tot_frame_size);
+
+		cmd->frame_dma_obj_status = DMA_OBJ_ALLOCATED;
+		cmd->frame = (union drsas_frame *)cmd->frame_dma_obj.buffer;
+		cmd->frame_phys_addr =
+		    cmd->frame_dma_obj.dma_cookie[0].dmac_address;
+
+		cmd->sense = (uint8_t *)(((unsigned long)
+		    cmd->frame_dma_obj.buffer) +
+		    tot_frame_size - SENSE_LENGTH);
+		cmd->sense_phys_addr =
+		    cmd->frame_dma_obj.dma_cookie[0].dmac_address +
+		    tot_frame_size - SENSE_LENGTH;
+
+		if (!cmd->frame || !cmd->sense) {
+			con_log(CL_ANN, (CE_NOTE,
+			    "dr_sas: pci_pool_alloc failed"));
+
+			return (ENOMEM);
+		}
+
+		ddi_put32(cmd->frame_dma_obj.acc_handle,
+		    &cmd->frame->io.context, cmd->index);
+		i++;
+
+		con_log(CL_DLEVEL3, (CE_NOTE, "[%x]-%x",
+		    cmd->index, cmd->frame_phys_addr));
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * free_additional_dma_buffer
+ */
+static void
+free_additional_dma_buffer(struct drsas_instance *instance)
+{
+	if (instance->mfi_internal_dma_obj.status == DMA_OBJ_ALLOCATED) {
+		(void) drsas_free_dma_obj(instance,
+		    instance->mfi_internal_dma_obj);
+		instance->mfi_internal_dma_obj.status = DMA_OBJ_FREED;
+	}
+
+	if (instance->mfi_evt_detail_obj.status == DMA_OBJ_ALLOCATED) {
+		(void) drsas_free_dma_obj(instance,
+		    instance->mfi_evt_detail_obj);
+		instance->mfi_evt_detail_obj.status = DMA_OBJ_FREED;
+	}
+}
+
+/*
+ * alloc_additional_dma_buffer
+ */
+static int
+alloc_additional_dma_buffer(struct drsas_instance *instance)
+{
+	uint32_t	reply_q_sz;
+	uint32_t	internal_buf_size = PAGESIZE*2;
+
+	/* max cmds plus 1 + producer & consumer */
+	reply_q_sz = sizeof (uint32_t) * (instance->max_fw_cmds + 1 + 2);
+
+	instance->mfi_internal_dma_obj.size = internal_buf_size;
+	instance->mfi_internal_dma_obj.dma_attr	= drsas_generic_dma_attr;
+	instance->mfi_internal_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+	instance->mfi_internal_dma_obj.dma_attr.dma_attr_count_max =
+	    0xFFFFFFFFU;
+	instance->mfi_internal_dma_obj.dma_attr.dma_attr_sgllen	= 1;
+
+	if (drsas_alloc_dma_obj(instance, &instance->mfi_internal_dma_obj,
+	    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+		con_log(CL_ANN, (CE_WARN,
+		    "dr_sas: could not alloc reply queue"));
+		return (DDI_FAILURE);
+	}
+
+	bzero(instance->mfi_internal_dma_obj.buffer, internal_buf_size);
+
+	instance->mfi_internal_dma_obj.status |= DMA_OBJ_ALLOCATED;
+
+	instance->producer = (uint32_t *)((unsigned long)
+	    instance->mfi_internal_dma_obj.buffer);
+	instance->consumer = (uint32_t *)((unsigned long)
+	    instance->mfi_internal_dma_obj.buffer + 4);
+	instance->reply_queue = (uint32_t *)((unsigned long)
+	    instance->mfi_internal_dma_obj.buffer + 8);
+	instance->internal_buf = (caddr_t)(((unsigned long)
+	    instance->mfi_internal_dma_obj.buffer) + reply_q_sz + 8);
+	instance->internal_buf_dmac_add =
+	    instance->mfi_internal_dma_obj.dma_cookie[0].dmac_address +
+	    (reply_q_sz + 8);
+	instance->internal_buf_size = internal_buf_size -
+	    (reply_q_sz + 8);
+
+	/* allocate evt_detail */
+	instance->mfi_evt_detail_obj.size = sizeof (struct drsas_evt_detail);
+	instance->mfi_evt_detail_obj.dma_attr = drsas_generic_dma_attr;
+	instance->mfi_evt_detail_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+	instance->mfi_evt_detail_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+	instance->mfi_evt_detail_obj.dma_attr.dma_attr_sgllen = 1;
+	instance->mfi_evt_detail_obj.dma_attr.dma_attr_align = 1;
+
+	if (drsas_alloc_dma_obj(instance, &instance->mfi_evt_detail_obj,
+	    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+		con_log(CL_ANN, (CE_WARN, "alloc_additional_dma_buffer: "
+		    "could not allocate data transfer buffer."));
+		return (DDI_FAILURE);
+	}
+
+	bzero(instance->mfi_evt_detail_obj.buffer,
+	    sizeof (struct drsas_evt_detail));
+
+	instance->mfi_evt_detail_obj.status |= DMA_OBJ_ALLOCATED;
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * free_space_for_mfi
+ */
+static void
+free_space_for_mfi(struct drsas_instance *instance)
+{
+	int		i;
+	uint32_t	max_cmd = instance->max_fw_cmds;
+
+	/* already freed */
+	if (instance->cmd_list == NULL) {
+		return;
+	}
+
+	free_additional_dma_buffer(instance);
+
+	/* first free the MFI frame pool */
+	destroy_mfi_frame_pool(instance);
+
+	/* free all the commands in the cmd_list */
+	for (i = 0; i < instance->max_fw_cmds+1; i++) {
+		kmem_free(instance->cmd_list[i],
+		    sizeof (struct drsas_cmd));
+
+		instance->cmd_list[i] = NULL;
+	}
+
+	/* free the cmd_list buffer itself */
+	kmem_free(instance->cmd_list,
+	    sizeof (struct drsas_cmd *) * (max_cmd+1));
+
+	instance->cmd_list = NULL;
+
+	INIT_LIST_HEAD(&instance->cmd_pool_list);
+}
+
+/*
+ * alloc_space_for_mfi
+ */
+static int
+alloc_space_for_mfi(struct drsas_instance *instance)
+{
+	int		i;
+	uint32_t	max_cmd;
+	size_t		sz;
+
+	struct drsas_cmd	*cmd;
+
+	max_cmd = instance->max_fw_cmds;
+
+	/* reserve 1 more slot for flush_cache */
+	sz = sizeof (struct drsas_cmd *) * (max_cmd+1);
+
+	/*
+	 * instance->cmd_list is an array of struct drsas_cmd pointers.
+	 * Allocate the dynamic array first and then allocate individual
+	 * commands.
+	 */
+	instance->cmd_list = kmem_zalloc(sz, KM_SLEEP);
+	ASSERT(instance->cmd_list);
+
+	for (i = 0; i < max_cmd+1; i++) {
+		instance->cmd_list[i] = kmem_zalloc(sizeof (struct drsas_cmd),
+		    KM_SLEEP);
+		ASSERT(instance->cmd_list[i]);
+	}
+
+	INIT_LIST_HEAD(&instance->cmd_pool_list);
+
+	/* add all the commands to command pool (instance->cmd_pool) */
+	for (i = 0; i < max_cmd; i++) {
+		cmd		= instance->cmd_list[i];
+		cmd->index	= i;
+
+		mlist_add_tail(&cmd->list, &instance->cmd_pool_list);
+	}
+
+	/* single slot for flush_cache won't be added in command pool */
+	cmd		= instance->cmd_list[max_cmd];
+	cmd->index	= i;
+
+	/* create a frame pool and assign one frame to each cmd */
+	if (create_mfi_frame_pool(instance)) {
+		con_log(CL_ANN, (CE_NOTE, "error creating frame DMA pool"));
+		return (DDI_FAILURE);
+	}
+
+	/* create a frame pool and assign one frame to each cmd */
+	if (alloc_additional_dma_buffer(instance)) {
+		con_log(CL_ANN, (CE_NOTE, "error creating frame DMA pool"));
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * get_ctrl_info
+ */
+static int
+get_ctrl_info(struct drsas_instance *instance,
+    struct drsas_ctrl_info *ctrl_info)
+{
+	int	ret = 0;
+
+	struct drsas_cmd		*cmd;
+	struct drsas_dcmd_frame	*dcmd;
+	struct drsas_ctrl_info	*ci;
+
+	cmd = get_mfi_pkt(instance);
+
+	if (!cmd) {
+		con_log(CL_ANN, (CE_WARN,
+		    "Failed to get a cmd for ctrl info"));
+		return (DDI_FAILURE);
+	}
+	/* Clear the frame buffer and assign back the context id */
+	(void) memset((char *)&cmd->frame[0], 0, sizeof (union drsas_frame));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &cmd->frame->hdr.context,
+	    cmd->index);
+
+	dcmd = &cmd->frame->dcmd;
+
+	ci = (struct drsas_ctrl_info *)instance->internal_buf;
+
+	if (!ci) {
+		con_log(CL_ANN, (CE_WARN,
+		    "Failed to alloc mem for ctrl info"));
+		return_mfi_pkt(instance, cmd);
+		return (DDI_FAILURE);
+	}
+
+	(void) memset(ci, 0, sizeof (struct drsas_ctrl_info));
+
+	/* for( i = 0; i < DCMD_MBOX_SZ; i++ ) dcmd->mbox.b[i] = 0; */
+	(void) memset(dcmd->mbox.b, 0, DCMD_MBOX_SZ);
+
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd, MFI_CMD_OP_DCMD);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd_status,
+	    MFI_CMD_STATUS_POLL_MODE);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->sge_count, 1);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->flags,
+	    MFI_FRAME_DIR_READ);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->timeout, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->data_xfer_len,
+	    sizeof (struct drsas_ctrl_info));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->opcode,
+	    DR_DCMD_CTRL_GET_INFO);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->sgl.sge32[0].phys_addr,
+	    instance->internal_buf_dmac_add);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->sgl.sge32[0].length,
+	    sizeof (struct drsas_ctrl_info));
+
+	cmd->frame_count = 1;
+
+	if (!instance->func_ptr->issue_cmd_in_poll_mode(instance, cmd)) {
+		ret = 0;
+		ddi_rep_get8(cmd->frame_dma_obj.acc_handle,
+		    (uint8_t *)ctrl_info, (uint8_t *)ci,
+		    sizeof (struct drsas_ctrl_info), DDI_DEV_AUTOINCR);
+	} else {
+		con_log(CL_ANN, (CE_WARN, "get_ctrl_info: Ctrl info failed"));
+		ret = -1;
+	}
+
+	return_mfi_pkt(instance, cmd);
+	if (drsas_common_check(instance, cmd) != DDI_SUCCESS) {
+		ret = -1;
+	}
+
+	return (ret);
+}
+
+/*
+ * abort_aen_cmd
+ */
+static int
+abort_aen_cmd(struct drsas_instance *instance,
+    struct drsas_cmd *cmd_to_abort)
+{
+	int	ret = 0;
+
+	struct drsas_cmd		*cmd;
+	struct drsas_abort_frame	*abort_fr;
+
+	cmd = get_mfi_pkt(instance);
+
+	if (!cmd) {
+		con_log(CL_ANN, (CE_WARN,
+		    "Failed to get a cmd for ctrl info"));
+		return (DDI_FAILURE);
+	}
+	/* Clear the frame buffer and assign back the context id */
+	(void) memset((char *)&cmd->frame[0], 0, sizeof (union drsas_frame));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &cmd->frame->hdr.context,
+	    cmd->index);
+
+	abort_fr = &cmd->frame->abort;
+
+	/* prepare and issue the abort frame */
+	ddi_put8(cmd->frame_dma_obj.acc_handle,
+	    &abort_fr->cmd, MFI_CMD_OP_ABORT);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &abort_fr->cmd_status,
+	    MFI_CMD_STATUS_SYNC_MODE);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &abort_fr->flags, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &abort_fr->abort_context,
+	    cmd_to_abort->index);
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &abort_fr->abort_mfi_phys_addr_lo, cmd_to_abort->frame_phys_addr);
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &abort_fr->abort_mfi_phys_addr_hi, 0);
+
+	instance->aen_cmd->abort_aen = 1;
+
+	cmd->sync_cmd = DRSAS_TRUE;
+	cmd->frame_count = 1;
+
+	if (instance->func_ptr->issue_cmd_in_sync_mode(instance, cmd)) {
+		con_log(CL_ANN, (CE_WARN,
+		    "abort_aen_cmd: issue_cmd_in_sync_mode failed"));
+		ret = -1;
+	} else {
+		ret = 0;
+	}
+
+	instance->aen_cmd->abort_aen = 1;
+	instance->aen_cmd = 0;
+
+	return_mfi_pkt(instance, cmd);
+	(void) drsas_common_check(instance, cmd);
+
+	return (ret);
+}
+
+/*
+ * init_mfi
+ */
+static int
+init_mfi(struct drsas_instance *instance)
+{
+	struct drsas_cmd		*cmd;
+	struct drsas_ctrl_info		ctrl_info;
+	struct drsas_init_frame		*init_frame;
+	struct drsas_init_queue_info	*initq_info;
+
+	/* we expect the FW state to be READY */
+	if (mfi_state_transition_to_ready(instance)) {
+		con_log(CL_ANN, (CE_WARN, "dr_sas: F/W is not ready"));
+		goto fail_ready_state;
+	}
+
+	/* get various operational parameters from status register */
+	instance->max_num_sge =
+	    (instance->func_ptr->read_fw_status_reg(instance) &
+	    0xFF0000) >> 0x10;
+	/*
+	 * Reduce the max supported cmds by 1. This is to ensure that the
+	 * reply_q_sz (1 more than the max cmd that driver may send)
+	 * does not exceed max cmds that the FW can support
+	 */
+	instance->max_fw_cmds =
+	    instance->func_ptr->read_fw_status_reg(instance) & 0xFFFF;
+	instance->max_fw_cmds = instance->max_fw_cmds - 1;
+
+	instance->max_num_sge =
+	    (instance->max_num_sge > DRSAS_MAX_SGE_CNT) ?
+	    DRSAS_MAX_SGE_CNT : instance->max_num_sge;
+
+	/* create a pool of commands */
+	if (alloc_space_for_mfi(instance) != DDI_SUCCESS)
+		goto fail_alloc_fw_space;
+
+	/*
+	 * Prepare a init frame. Note the init frame points to queue info
+	 * structure. Each frame has SGL allocated after first 64 bytes. For
+	 * this frame - since we don't need any SGL - we use SGL's space as
+	 * queue info structure
+	 */
+	cmd = get_mfi_pkt(instance);
+	/* Clear the frame buffer and assign back the context id */
+	(void) memset((char *)&cmd->frame[0], 0, sizeof (union drsas_frame));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &cmd->frame->hdr.context,
+	    cmd->index);
+
+	init_frame = (struct drsas_init_frame *)cmd->frame;
+	initq_info = (struct drsas_init_queue_info *)
+	    ((unsigned long)init_frame + 64);
+
+	(void) memset(init_frame, 0, MRMFI_FRAME_SIZE);
+	(void) memset(initq_info, 0, sizeof (struct drsas_init_queue_info));
+
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &initq_info->init_flags, 0);
+
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &initq_info->reply_queue_entries, instance->max_fw_cmds + 1);
+
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &initq_info->producer_index_phys_addr_hi, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &initq_info->producer_index_phys_addr_lo,
+	    instance->mfi_internal_dma_obj.dma_cookie[0].dmac_address);
+
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &initq_info->consumer_index_phys_addr_hi, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &initq_info->consumer_index_phys_addr_lo,
+	    instance->mfi_internal_dma_obj.dma_cookie[0].dmac_address + 4);
+
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &initq_info->reply_queue_start_phys_addr_hi, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &initq_info->reply_queue_start_phys_addr_lo,
+	    instance->mfi_internal_dma_obj.dma_cookie[0].dmac_address + 8);
+
+	ddi_put8(cmd->frame_dma_obj.acc_handle,
+	    &init_frame->cmd, MFI_CMD_OP_INIT);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &init_frame->cmd_status,
+	    MFI_CMD_STATUS_POLL_MODE);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &init_frame->flags, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &init_frame->queue_info_new_phys_addr_lo,
+	    cmd->frame_phys_addr + 64);
+	ddi_put32(cmd->frame_dma_obj.acc_handle,
+	    &init_frame->queue_info_new_phys_addr_hi, 0);
+
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &init_frame->data_xfer_len,
+	    sizeof (struct drsas_init_queue_info));
+
+	cmd->frame_count = 1;
+
+	/* issue the init frame in polled mode */
+	if (instance->func_ptr->issue_cmd_in_poll_mode(instance, cmd)) {
+		con_log(CL_ANN, (CE_WARN, "failed to init firmware"));
+		goto fail_fw_init;
+	}
+
+	return_mfi_pkt(instance, cmd);
+	if (drsas_common_check(instance, cmd) != DDI_SUCCESS) {
+		goto fail_fw_init;
+	}
+
+	/* gather misc FW related information */
+	if (!get_ctrl_info(instance, &ctrl_info)) {
+		instance->max_sectors_per_req = ctrl_info.max_request_size;
+		con_log(CL_ANN1, (CE_NOTE, "product name %s ld present %d",
+		    ctrl_info.product_name, ctrl_info.ld_present_count));
+	} else {
+		instance->max_sectors_per_req = instance->max_num_sge *
+		    PAGESIZE / 512;
+	}
+
+	if (drsas_check_acc_handle(instance->regmap_handle) != DDI_SUCCESS) {
+		goto fail_fw_init;
+	}
+
+	return (DDI_SUCCESS);
+
+fail_fw_init:
+fail_alloc_fw_space:
+
+	free_space_for_mfi(instance);
+
+fail_ready_state:
+	ddi_regs_map_free(&instance->regmap_handle);
+
+fail_mfi_reg_setup:
+	return (DDI_FAILURE);
+}
+
+/*
+ * mfi_state_transition_to_ready	: Move the FW to READY state
+ *
+ * @reg_set			: MFI register set
+ */
+static int
+mfi_state_transition_to_ready(struct drsas_instance *instance)
+{
+	int		i;
+	uint8_t		max_wait;
+	uint32_t	fw_ctrl;
+	uint32_t	fw_state;
+	uint32_t	cur_state;
+
+	fw_state =
+	    instance->func_ptr->read_fw_status_reg(instance) & MFI_STATE_MASK;
+	con_log(CL_ANN1, (CE_NOTE,
+	    "mfi_state_transition_to_ready:FW state = 0x%x", fw_state));
+
+	while (fw_state != MFI_STATE_READY) {
+		con_log(CL_ANN, (CE_NOTE,
+		    "mfi_state_transition_to_ready:FW state%x", fw_state));
+
+		switch (fw_state) {
+		case MFI_STATE_FAULT:
+			con_log(CL_ANN, (CE_NOTE,
+			    "dr_sas: FW in FAULT state!!"));
+
+			return (ENODEV);
+		case MFI_STATE_WAIT_HANDSHAKE:
+			/* set the CLR bit in IMR0 */
+			con_log(CL_ANN, (CE_NOTE,
+			    "dr_sas: FW waiting for HANDSHAKE"));
+			/*
+			 * PCI_Hot Plug: MFI F/W requires
+			 * (MFI_INIT_CLEAR_HANDSHAKE|MFI_INIT_HOTPLUG)
+			 * to be set
+			 */
+			/* WR_IB_MSG_0(MFI_INIT_CLEAR_HANDSHAKE, instance); */
+			WR_IB_DOORBELL(MFI_INIT_CLEAR_HANDSHAKE |
+			    MFI_INIT_HOTPLUG, instance);
+
+			max_wait	= 2;
+			cur_state	= MFI_STATE_WAIT_HANDSHAKE;
+			break;
+		case MFI_STATE_BOOT_MESSAGE_PENDING:
+			/* set the CLR bit in IMR0 */
+			con_log(CL_ANN, (CE_NOTE,
+			    "dr_sas: FW state boot message pending"));
+			/*
+			 * PCI_Hot Plug: MFI F/W requires
+			 * (MFI_INIT_CLEAR_HANDSHAKE|MFI_INIT_HOTPLUG)
+			 * to be set
+			 */
+			WR_IB_DOORBELL(MFI_INIT_HOTPLUG, instance);
+
+			max_wait	= 10;
+			cur_state	= MFI_STATE_BOOT_MESSAGE_PENDING;
+			break;
+		case MFI_STATE_OPERATIONAL:
+			/* bring it to READY state; assuming max wait 2 secs */
+			instance->func_ptr->disable_intr(instance);
+			con_log(CL_ANN1, (CE_NOTE,
+			    "dr_sas: FW in OPERATIONAL state"));
+			/*
+			 * PCI_Hot Plug: MFI F/W requires
+			 * (MFI_INIT_READY | MFI_INIT_MFIMODE | MFI_INIT_ABORT)
+			 * to be set
+			 */
+			/* WR_IB_DOORBELL(MFI_INIT_READY, instance); */
+			WR_IB_DOORBELL(MFI_RESET_FLAGS, instance);
+
+			max_wait	= 10;
+			cur_state	= MFI_STATE_OPERATIONAL;
+			break;
+		case MFI_STATE_UNDEFINED:
+			/* this state should not last for more than 2 seconds */
+			con_log(CL_ANN, (CE_NOTE, "FW state undefined"));
+
+			max_wait	= 2;
+			cur_state	= MFI_STATE_UNDEFINED;
+			break;
+		case MFI_STATE_BB_INIT:
+			max_wait	= 2;
+			cur_state	= MFI_STATE_BB_INIT;
+			break;
+		case MFI_STATE_FW_INIT:
+			max_wait	= 2;
+			cur_state	= MFI_STATE_FW_INIT;
+			break;
+		case MFI_STATE_DEVICE_SCAN:
+			max_wait	= 10;
+			cur_state	= MFI_STATE_DEVICE_SCAN;
+			break;
+		default:
+			con_log(CL_ANN, (CE_NOTE,
+			    "dr_sas: Unknown state 0x%x", fw_state));
+			return (ENODEV);
+		}
+
+		/* the cur_state should not last for more than max_wait secs */
+		for (i = 0; i < (max_wait * MILLISEC); i++) {
+			/* fw_state = RD_OB_MSG_0(instance) & MFI_STATE_MASK; */
+			fw_state =
+			    instance->func_ptr->read_fw_status_reg(instance) &
+			    MFI_STATE_MASK;
+
+			if (fw_state == cur_state) {
+				delay(1 * drv_usectohz(MILLISEC));
+			} else {
+				break;
+			}
+		}
+
+		/* return error if fw_state hasn't changed after max_wait */
+		if (fw_state == cur_state) {
+			con_log(CL_ANN, (CE_NOTE,
+			    "FW state hasn't changed in %d secs", max_wait));
+			return (ENODEV);
+		}
+	};
+
+	fw_ctrl = RD_IB_DOORBELL(instance);
+
+	con_log(CL_ANN1, (CE_NOTE,
+	    "mfi_state_transition_to_ready:FW ctrl = 0x%x", fw_ctrl));
+
+	/*
+	 * Write 0xF to the doorbell register to do the following.
+	 * - Abort all outstanding commands (bit 0).
+	 * - Transition from OPERATIONAL to READY state (bit 1).
+	 * - Discard (possible) low MFA posted in 64-bit mode (bit-2).
+	 * - Set to release FW to continue running (i.e. BIOS handshake
+	 *   (bit 3).
+	 */
+	WR_IB_DOORBELL(0xF, instance);
+
+	if (drsas_check_acc_handle(instance->regmap_handle) != DDI_SUCCESS) {
+		return (ENODEV);
+	}
+	return (DDI_SUCCESS);
+}
+
+/*
+ * get_seq_num
+ */
+static int
+get_seq_num(struct drsas_instance *instance,
+    struct drsas_evt_log_info *eli)
+{
+	int	ret = DDI_SUCCESS;
+
+	dma_obj_t			dcmd_dma_obj;
+	struct drsas_cmd		*cmd;
+	struct drsas_dcmd_frame		*dcmd;
+
+	cmd = get_mfi_pkt(instance);
+
+	if (!cmd) {
+		cmn_err(CE_WARN, "dr_sas: failed to get a cmd");
+		return (ENOMEM);
+	}
+	/* Clear the frame buffer and assign back the context id */
+	(void) memset((char *)&cmd->frame[0], 0, sizeof (union drsas_frame));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &cmd->frame->hdr.context,
+	    cmd->index);
+
+	dcmd	= &cmd->frame->dcmd;
+
+	/* allocate the data transfer buffer */
+	dcmd_dma_obj.size = sizeof (struct drsas_evt_log_info);
+	dcmd_dma_obj.dma_attr = drsas_generic_dma_attr;
+	dcmd_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+	dcmd_dma_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+	dcmd_dma_obj.dma_attr.dma_attr_sgllen = 1;
+	dcmd_dma_obj.dma_attr.dma_attr_align = 1;
+
+	if (drsas_alloc_dma_obj(instance, &dcmd_dma_obj,
+	    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+		con_log(CL_ANN, (CE_WARN,
+		    "get_seq_num: could not allocate data transfer buffer."));
+		return (DDI_FAILURE);
+	}
+
+	(void) memset(dcmd_dma_obj.buffer, 0,
+	    sizeof (struct drsas_evt_log_info));
+
+	(void) memset(dcmd->mbox.b, 0, DCMD_MBOX_SZ);
+
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd, MFI_CMD_OP_DCMD);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd_status, 0);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->sge_count, 1);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->flags,
+	    MFI_FRAME_DIR_READ);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->timeout, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->data_xfer_len,
+	    sizeof (struct drsas_evt_log_info));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->opcode,
+	    DR_DCMD_CTRL_EVENT_GET_INFO);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->sgl.sge32[0].length,
+	    sizeof (struct drsas_evt_log_info));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->sgl.sge32[0].phys_addr,
+	    dcmd_dma_obj.dma_cookie[0].dmac_address);
+
+	cmd->sync_cmd = DRSAS_TRUE;
+	cmd->frame_count = 1;
+
+	if (instance->func_ptr->issue_cmd_in_sync_mode(instance, cmd)) {
+		cmn_err(CE_WARN, "get_seq_num: "
+		    "failed to issue DRSAS_DCMD_CTRL_EVENT_GET_INFO");
+		ret = DDI_FAILURE;
+	} else {
+		/* copy the data back into callers buffer */
+		ddi_rep_get8(cmd->frame_dma_obj.acc_handle, (uint8_t *)eli,
+		    (uint8_t *)dcmd_dma_obj.buffer,
+		    sizeof (struct drsas_evt_log_info), DDI_DEV_AUTOINCR);
+		ret = DDI_SUCCESS;
+	}
+
+	if (drsas_free_dma_obj(instance, dcmd_dma_obj) != DDI_SUCCESS)
+		ret = DDI_FAILURE;
+
+	return_mfi_pkt(instance, cmd);
+	if (drsas_common_check(instance, cmd) != DDI_SUCCESS) {
+		ret = DDI_FAILURE;
+	}
+	return (ret);
+}
+
+/*
+ * start_mfi_aen
+ */
+static int
+start_mfi_aen(struct drsas_instance *instance)
+{
+	int	ret = 0;
+
+	struct drsas_evt_log_info	eli;
+	union drsas_evt_class_locale	class_locale;
+
+	/* get the latest sequence number from FW */
+	(void) memset(&eli, 0, sizeof (struct drsas_evt_log_info));
+
+	if (get_seq_num(instance, &eli)) {
+		cmn_err(CE_WARN, "start_mfi_aen: failed to get seq num");
+		return (-1);
+	}
+
+	/* register AEN with FW for latest sequence number plus 1 */
+	class_locale.members.reserved	= 0;
+	class_locale.members.locale	= DR_EVT_LOCALE_ALL;
+	class_locale.members.class	= DR_EVT_CLASS_INFO;
+	ret = register_mfi_aen(instance, eli.newest_seq_num + 1,
+	    class_locale.word);
+
+	if (ret) {
+		cmn_err(CE_WARN, "start_mfi_aen: aen registration failed");
+		return (-1);
+	}
+
+	return (ret);
+}
+
+/*
+ * flush_cache
+ */
+static void
+flush_cache(struct drsas_instance *instance)
+{
+	struct drsas_cmd		*cmd = NULL;
+	struct drsas_dcmd_frame		*dcmd;
+	uint32_t	max_cmd = instance->max_fw_cmds;
+
+	cmd = instance->cmd_list[max_cmd];
+
+	if (cmd == NULL)
+		return;
+
+	dcmd = &cmd->frame->dcmd;
+
+	(void) memset(dcmd->mbox.b, 0, DCMD_MBOX_SZ);
+
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd, MFI_CMD_OP_DCMD);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd_status, 0x0);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->sge_count, 0);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->flags,
+	    MFI_FRAME_DIR_NONE);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->timeout, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->data_xfer_len, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->opcode,
+	    DR_DCMD_CTRL_CACHE_FLUSH);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->mbox.b[0],
+	    DR_FLUSH_CTRL_CACHE | DR_FLUSH_DISK_CACHE);
+
+	cmd->frame_count = 1;
+
+	if (instance->func_ptr->issue_cmd_in_poll_mode(instance, cmd)) {
+		con_log(CL_ANN1, (CE_WARN,
+	    "flush_cache: failed to issue MFI_DCMD_CTRL_CACHE_FLUSH"));
+	}
+	con_log(CL_DLEVEL1, (CE_NOTE, "done"));
+}
+
+/*
+ * service_mfi_aen-	Completes an AEN command
+ * @instance:			Adapter soft state
+ * @cmd:			Command to be completed
+ *
+ */
+static void
+service_mfi_aen(struct drsas_instance *instance, struct drsas_cmd *cmd)
+{
+	uint32_t	seq_num;
+	struct drsas_evt_detail *evt_detail =
+	    (struct drsas_evt_detail *)instance->mfi_evt_detail_obj.buffer;
+	int		rval = 0;
+	int		tgt = 0;
+	ddi_acc_handle_t		acc_handle;
+
+	acc_handle = cmd->frame_dma_obj.acc_handle;
+
+	cmd->cmd_status = ddi_get8(acc_handle, &cmd->frame->io.cmd_status);
+
+	if (cmd->cmd_status == ENODATA) {
+		cmd->cmd_status = 0;
+	}
+
+	/*
+	 * log the MFI AEN event to the sysevent queue so that
+	 * application will get noticed
+	 */
+	if (ddi_log_sysevent(instance->dip, DDI_VENDOR_LSI, "LSIMEGA", "SAS",
+	    NULL, NULL, DDI_NOSLEEP) != DDI_SUCCESS) {
+		int	instance_no = ddi_get_instance(instance->dip);
+		con_log(CL_ANN, (CE_WARN,
+		    "dr_sas%d: Failed to log AEN event", instance_no));
+	}
+	/*
+	 * Check for any ld devices that has changed state. i.e. online
+	 * or offline.
+	 */
+	con_log(CL_ANN1, (CE_NOTE,
+	    "AEN: code = %x class = %x locale = %x args = %x",
+	    ddi_get32(acc_handle, &evt_detail->code),
+	    evt_detail->cl.members.class,
+	    ddi_get16(acc_handle, &evt_detail->cl.members.locale),
+	    ddi_get8(acc_handle, &evt_detail->arg_type)));
+
+	switch (ddi_get32(acc_handle, &evt_detail->code)) {
+	case DR_EVT_CFG_CLEARED: {
+		for (tgt = 0; tgt < MRDRV_MAX_LD; tgt++) {
+			if (instance->dr_ld_list[tgt].dip != NULL) {
+				rval = drsas_service_evt(instance, tgt, 0,
+				    DRSAS_EVT_UNCONFIG_TGT, NULL);
+				con_log(CL_ANN1, (CE_WARN,
+				    "dr_sas: CFG CLEARED AEN rval = %d "
+				    "tgt id = %d", rval, tgt));
+			}
+		}
+		break;
+	}
+
+	case DR_EVT_LD_DELETED: {
+		rval = drsas_service_evt(instance,
+		    ddi_get16(acc_handle, &evt_detail->args.ld.target_id), 0,
+		    DRSAS_EVT_UNCONFIG_TGT, NULL);
+		con_log(CL_ANN1, (CE_WARN, "dr_sas: LD DELETED AEN rval = %d "
+		    "tgt id = %d index = %d", rval,
+		    ddi_get16(acc_handle, &evt_detail->args.ld.target_id),
+		    ddi_get8(acc_handle, &evt_detail->args.ld.ld_index)));
+		break;
+	} /* End of DR_EVT_LD_DELETED */
+
+	case DR_EVT_LD_CREATED: {
+		rval = drsas_service_evt(instance,
+		    ddi_get16(acc_handle, &evt_detail->args.ld.target_id), 0,
+		    DRSAS_EVT_CONFIG_TGT, NULL);
+		con_log(CL_ANN1, (CE_WARN, "dr_sas: LD CREATED AEN rval = %d "
+		    "tgt id = %d index = %d", rval,
+		    ddi_get16(acc_handle, &evt_detail->args.ld.target_id),
+		    ddi_get8(acc_handle, &evt_detail->args.ld.ld_index)));
+		break;
+	} /* End of DR_EVT_LD_CREATED */
+	} /* End of Main Switch */
+
+	/* get copy of seq_num and class/locale for re-registration */
+	seq_num = ddi_get32(acc_handle, &evt_detail->seq_num);
+	seq_num++;
+	(void) memset(instance->mfi_evt_detail_obj.buffer, 0,
+	    sizeof (struct drsas_evt_detail));
+
+	ddi_put8(acc_handle, &cmd->frame->dcmd.cmd_status, 0x0);
+	ddi_put32(acc_handle, &cmd->frame->dcmd.mbox.w[0], seq_num);
+
+	instance->aen_seq_num = seq_num;
+
+	cmd->frame_count = 1;
+
+	/* Issue the aen registration frame */
+	instance->func_ptr->issue_cmd(cmd, instance);
+}
+
+/*
+ * complete_cmd_in_sync_mode -	Completes an internal command
+ * @instance:			Adapter soft state
+ * @cmd:			Command to be completed
+ *
+ * The issue_cmd_in_sync_mode() function waits for a command to complete
+ * after it issues a command. This function wakes up that waiting routine by
+ * calling wake_up() on the wait queue.
+ */
+static void
+complete_cmd_in_sync_mode(struct drsas_instance *instance,
+    struct drsas_cmd *cmd)
+{
+	cmd->cmd_status = ddi_get8(cmd->frame_dma_obj.acc_handle,
+	    &cmd->frame->io.cmd_status);
+
+	cmd->sync_cmd = DRSAS_FALSE;
+
+	if (cmd->cmd_status == ENODATA) {
+		cmd->cmd_status = 0;
+	}
+
+	cv_broadcast(&instance->int_cmd_cv);
+}
+
+/*
+ * drsas_softintr - The Software ISR
+ * @param arg	: HBA soft state
+ *
+ * called from high-level interrupt if hi-level interrupt are not there,
+ * otherwise triggered as a soft interrupt
+ */
+static uint_t
+drsas_softintr(struct drsas_instance *instance)
+{
+	struct scsi_pkt		*pkt;
+	struct scsa_cmd		*acmd;
+	struct drsas_cmd	*cmd;
+	struct mlist_head	*pos, *next;
+	mlist_t			process_list;
+	struct drsas_header	*hdr;
+	struct scsi_arq_status	*arqstat;
+
+	con_log(CL_ANN1, (CE_CONT, "drsas_softintr called"));
+
+	ASSERT(instance);
+	mutex_enter(&instance->completed_pool_mtx);
+
+	if (mlist_empty(&instance->completed_pool_list)) {
+		mutex_exit(&instance->completed_pool_mtx);
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	instance->softint_running = 1;
+
+	INIT_LIST_HEAD(&process_list);
+	mlist_splice(&instance->completed_pool_list, &process_list);
+	INIT_LIST_HEAD(&instance->completed_pool_list);
+
+	mutex_exit(&instance->completed_pool_mtx);
+
+	/* perform all callbacks first, before releasing the SCBs */
+	mlist_for_each_safe(pos, next, &process_list) {
+		cmd = mlist_entry(pos, struct drsas_cmd, list);
+
+		/* syncronize the Cmd frame for the controller */
+		(void) ddi_dma_sync(cmd->frame_dma_obj.dma_handle,
+		    0, 0, DDI_DMA_SYNC_FORCPU);
+
+		if (drsas_check_dma_handle(cmd->frame_dma_obj.dma_handle) !=
+		    DDI_SUCCESS) {
+			drsas_fm_ereport(instance, DDI_FM_DEVICE_NO_RESPONSE);
+			ddi_fm_service_impact(instance->dip, DDI_SERVICE_LOST);
+			return (DDI_INTR_UNCLAIMED);
+		}
+
+		hdr = &cmd->frame->hdr;
+
+		/* remove the internal command from the process list */
+		mlist_del_init(&cmd->list);
+
+		switch (ddi_get8(cmd->frame_dma_obj.acc_handle, &hdr->cmd)) {
+		case MFI_CMD_OP_PD_SCSI:
+		case MFI_CMD_OP_LD_SCSI:
+		case MFI_CMD_OP_LD_READ:
+		case MFI_CMD_OP_LD_WRITE:
+			/*
+			 * MFI_CMD_OP_PD_SCSI and MFI_CMD_OP_LD_SCSI
+			 * could have been issued either through an
+			 * IO path or an IOCTL path. If it was via IOCTL,
+			 * we will send it to internal completion.
+			 */
+			if (cmd->sync_cmd == DRSAS_TRUE) {
+				complete_cmd_in_sync_mode(instance, cmd);
+				break;
+			}
+
+			/* regular commands */
+			acmd =	cmd->cmd;
+			pkt =	CMD2PKT(acmd);
+
+			if (acmd->cmd_flags & CFLAG_DMAVALID) {
+				if (acmd->cmd_flags & CFLAG_CONSISTENT) {
+					(void) ddi_dma_sync(acmd->cmd_dmahandle,
+					    acmd->cmd_dma_offset,
+					    acmd->cmd_dma_len,
+					    DDI_DMA_SYNC_FORCPU);
+				}
+			}
+
+			pkt->pkt_reason		= CMD_CMPLT;
+			pkt->pkt_statistics	= 0;
+			pkt->pkt_state = STATE_GOT_BUS
+			    | STATE_GOT_TARGET | STATE_SENT_CMD
+			    | STATE_XFERRED_DATA | STATE_GOT_STATUS;
+
+			con_log(CL_ANN1, (CE_CONT,
+			    "CDB[0] = %x completed for %s: size %lx context %x",
+			    pkt->pkt_cdbp[0], ((acmd->islogical) ? "LD" : "PD"),
+			    acmd->cmd_dmacount, hdr->context));
+
+			if (pkt->pkt_cdbp[0] == SCMD_INQUIRY) {
+				struct scsi_inquiry	*inq;
+
+				if (acmd->cmd_dmacount != 0) {
+					bp_mapin(acmd->cmd_buf);
+					inq = (struct scsi_inquiry *)
+					    acmd->cmd_buf->b_un.b_addr;
+
+					/* don't expose physical drives to OS */
+					if (acmd->islogical &&
+					    (hdr->cmd_status == MFI_STAT_OK)) {
+						display_scsi_inquiry(
+						    (caddr_t)inq);
+					} else if ((hdr->cmd_status ==
+					    MFI_STAT_OK) && inq->inq_dtype ==
+					    DTYPE_DIRECT) {
+
+						display_scsi_inquiry(
+						    (caddr_t)inq);
+
+						/* for physical disk */
+						hdr->cmd_status =
+						    MFI_STAT_DEVICE_NOT_FOUND;
+					}
+				}
+			}
+
+			switch (hdr->cmd_status) {
+			case MFI_STAT_OK:
+				pkt->pkt_scbp[0] = STATUS_GOOD;
+				break;
+			case MFI_STAT_LD_CC_IN_PROGRESS:
+			case MFI_STAT_LD_RECON_IN_PROGRESS:
+				pkt->pkt_scbp[0] = STATUS_GOOD;
+				break;
+			case MFI_STAT_LD_INIT_IN_PROGRESS:
+				con_log(CL_ANN,
+				    (CE_WARN, "Initialization in Progress"));
+				pkt->pkt_reason	= CMD_TRAN_ERR;
+
+				break;
+			case MFI_STAT_SCSI_DONE_WITH_ERROR:
+				con_log(CL_ANN1, (CE_CONT, "scsi_done error"));
+
+				pkt->pkt_reason	= CMD_CMPLT;
+				((struct scsi_status *)
+				    pkt->pkt_scbp)->sts_chk = 1;
+
+				if (pkt->pkt_cdbp[0] == SCMD_TEST_UNIT_READY) {
+
+					con_log(CL_ANN,
+					    (CE_WARN, "TEST_UNIT_READY fail"));
+
+				} else {
+					pkt->pkt_state |= STATE_ARQ_DONE;
+					arqstat = (void *)(pkt->pkt_scbp);
+					arqstat->sts_rqpkt_reason = CMD_CMPLT;
+					arqstat->sts_rqpkt_resid = 0;
+					arqstat->sts_rqpkt_state |=
+					    STATE_GOT_BUS | STATE_GOT_TARGET
+					    | STATE_SENT_CMD
+					    | STATE_XFERRED_DATA;
+					*(uint8_t *)&arqstat->sts_rqpkt_status =
+					    STATUS_GOOD;
+					ddi_rep_get8(
+					    cmd->frame_dma_obj.acc_handle,
+					    (uint8_t *)
+					    &(arqstat->sts_sensedata),
+					    cmd->sense,
+					    acmd->cmd_scblen -
+					    offsetof(struct scsi_arq_status,
+					    sts_sensedata), DDI_DEV_AUTOINCR);
+				}
+				break;
+			case MFI_STAT_LD_OFFLINE:
+			case MFI_STAT_DEVICE_NOT_FOUND:
+				con_log(CL_ANN1, (CE_CONT,
+				    "device not found error"));
+				pkt->pkt_reason	= CMD_DEV_GONE;
+				pkt->pkt_statistics  = STAT_DISCON;
+				break;
+			case MFI_STAT_LD_LBA_OUT_OF_RANGE:
+				pkt->pkt_state |= STATE_ARQ_DONE;
+				pkt->pkt_reason	= CMD_CMPLT;
+				((struct scsi_status *)
+				    pkt->pkt_scbp)->sts_chk = 1;
+
+				arqstat = (void *)(pkt->pkt_scbp);
+				arqstat->sts_rqpkt_reason = CMD_CMPLT;
+				arqstat->sts_rqpkt_resid = 0;
+				arqstat->sts_rqpkt_state |= STATE_GOT_BUS
+				    | STATE_GOT_TARGET | STATE_SENT_CMD
+				    | STATE_XFERRED_DATA;
+				*(uint8_t *)&arqstat->sts_rqpkt_status =
+				    STATUS_GOOD;
+
+				arqstat->sts_sensedata.es_valid = 1;
+				arqstat->sts_sensedata.es_key =
+				    KEY_ILLEGAL_REQUEST;
+				arqstat->sts_sensedata.es_class =
+				    CLASS_EXTENDED_SENSE;
+
+				/*
+				 * LOGICAL BLOCK ADDRESS OUT OF RANGE:
+				 * ASC: 0x21h; ASCQ: 0x00h;
+				 */
+				arqstat->sts_sensedata.es_add_code = 0x21;
+				arqstat->sts_sensedata.es_qual_code = 0x00;
+
+				break;
+
+			default:
+				con_log(CL_ANN, (CE_CONT, "Unknown status!"));
+				pkt->pkt_reason	= CMD_TRAN_ERR;
+
+				break;
+			}
+
+			atomic_add_16(&instance->fw_outstanding, (-1));
+
+			return_mfi_pkt(instance, cmd);
+
+			(void) drsas_common_check(instance, cmd);
+
+			if (acmd->cmd_dmahandle) {
+				if (drsas_check_dma_handle(
+				    acmd->cmd_dmahandle) != DDI_SUCCESS) {
+					ddi_fm_service_impact(instance->dip,
+					    DDI_SERVICE_UNAFFECTED);
+					pkt->pkt_reason = CMD_TRAN_ERR;
+					pkt->pkt_statistics = 0;
+				}
+			}
+
+			/* Call the callback routine */
+			if (((pkt->pkt_flags & FLAG_NOINTR) == 0) &&
+			    pkt->pkt_comp) {
+				(*pkt->pkt_comp)(pkt);
+			}
+
+			break;
+		case MFI_CMD_OP_SMP:
+		case MFI_CMD_OP_STP:
+			complete_cmd_in_sync_mode(instance, cmd);
+			break;
+		case MFI_CMD_OP_DCMD:
+			/* see if got an event notification */
+			if (ddi_get32(cmd->frame_dma_obj.acc_handle,
+			    &cmd->frame->dcmd.opcode) ==
+			    DR_DCMD_CTRL_EVENT_WAIT) {
+				if ((instance->aen_cmd == cmd) &&
+				    (instance->aen_cmd->abort_aen)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "drsas_softintr: "
+					    "aborted_aen returned"));
+				} else {
+					atomic_add_16(&instance->fw_outstanding,
+					    (-1));
+					service_mfi_aen(instance, cmd);
+				}
+			} else {
+				complete_cmd_in_sync_mode(instance, cmd);
+			}
+
+			break;
+		case MFI_CMD_OP_ABORT:
+			con_log(CL_ANN, (CE_WARN, "MFI_CMD_OP_ABORT complete"));
+			/*
+			 * MFI_CMD_OP_ABORT successfully completed
+			 * in the synchronous mode
+			 */
+			complete_cmd_in_sync_mode(instance, cmd);
+			break;
+		default:
+			drsas_fm_ereport(instance, DDI_FM_DEVICE_NO_RESPONSE);
+			ddi_fm_service_impact(instance->dip, DDI_SERVICE_LOST);
+
+			if (cmd->pkt != NULL) {
+				pkt = cmd->pkt;
+				if (((pkt->pkt_flags & FLAG_NOINTR) == 0) &&
+				    pkt->pkt_comp) {
+					(*pkt->pkt_comp)(pkt);
+				}
+			}
+			con_log(CL_ANN, (CE_WARN, "Cmd type unknown !"));
+			break;
+		}
+	}
+
+	instance->softint_running = 0;
+
+	return (DDI_INTR_CLAIMED);
+}
+
+/*
+ * drsas_alloc_dma_obj
+ *
+ * Allocate the memory and other resources for an dma object.
+ */
+static int
+drsas_alloc_dma_obj(struct drsas_instance *instance, dma_obj_t *obj,
+    uchar_t endian_flags)
+{
+	int	i;
+	size_t	alen = 0;
+	uint_t	cookie_cnt;
+	struct ddi_device_acc_attr tmp_endian_attr;
+
+	tmp_endian_attr = endian_attr;
+	tmp_endian_attr.devacc_attr_endian_flags = endian_flags;
+
+	i = ddi_dma_alloc_handle(instance->dip, &obj->dma_attr,
+	    DDI_DMA_SLEEP, NULL, &obj->dma_handle);
+	if (i != DDI_SUCCESS) {
+
+		switch (i) {
+			case DDI_DMA_BADATTR :
+				con_log(CL_ANN, (CE_WARN,
+				"Failed ddi_dma_alloc_handle- Bad attribute"));
+				break;
+			case DDI_DMA_NORESOURCES :
+				con_log(CL_ANN, (CE_WARN,
+				"Failed ddi_dma_alloc_handle- No Resources"));
+				break;
+			default :
+				con_log(CL_ANN, (CE_WARN,
+				"Failed ddi_dma_alloc_handle: "
+				"unknown status %d", i));
+				break;
+		}
+
+		return (-1);
+	}
+
+	if ((ddi_dma_mem_alloc(obj->dma_handle, obj->size, &tmp_endian_attr,
+	    DDI_DMA_RDWR | DDI_DMA_STREAMING, DDI_DMA_SLEEP, NULL,
+	    &obj->buffer, &alen, &obj->acc_handle) != DDI_SUCCESS) ||
+	    alen < obj->size) {
+
+		ddi_dma_free_handle(&obj->dma_handle);
+
+		con_log(CL_ANN, (CE_WARN, "Failed : ddi_dma_mem_alloc"));
+
+		return (-1);
+	}
+
+	if (ddi_dma_addr_bind_handle(obj->dma_handle, NULL, obj->buffer,
+	    obj->size, DDI_DMA_RDWR | DDI_DMA_STREAMING, DDI_DMA_SLEEP,
+	    NULL, &obj->dma_cookie[0], &cookie_cnt) != DDI_SUCCESS) {
+
+		ddi_dma_mem_free(&obj->acc_handle);
+		ddi_dma_free_handle(&obj->dma_handle);
+
+		con_log(CL_ANN, (CE_WARN, "Failed : ddi_dma_addr_bind_handle"));
+
+		return (-1);
+	}
+
+	if (drsas_check_dma_handle(obj->dma_handle) != DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_LOST);
+		return (-1);
+	}
+
+	if (drsas_check_acc_handle(obj->acc_handle) != DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_LOST);
+		return (-1);
+	}
+
+	return (cookie_cnt);
+}
+
+/*
+ * drsas_free_dma_obj(struct drsas_instance *, dma_obj_t)
+ *
+ * De-allocate the memory and other resources for an dma object, which must
+ * have been alloated by a previous call to drsas_alloc_dma_obj()
+ */
+static int
+drsas_free_dma_obj(struct drsas_instance *instance, dma_obj_t obj)
+{
+
+	if (drsas_check_dma_handle(obj.dma_handle) != DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_UNAFFECTED);
+		return (DDI_FAILURE);
+	}
+
+	if (drsas_check_acc_handle(obj.acc_handle) != DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_UNAFFECTED);
+		return (DDI_FAILURE);
+	}
+
+	(void) ddi_dma_unbind_handle(obj.dma_handle);
+	ddi_dma_mem_free(&obj.acc_handle);
+	ddi_dma_free_handle(&obj.dma_handle);
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * drsas_dma_alloc(instance_t *, struct scsi_pkt *, struct buf *,
+ * int, int (*)())
+ *
+ * Allocate dma resources for a new scsi command
+ */
+static int
+drsas_dma_alloc(struct drsas_instance *instance, struct scsi_pkt *pkt,
+    struct buf *bp, int flags, int (*callback)())
+{
+	int	dma_flags;
+	int	(*cb)(caddr_t);
+	int	i;
+
+	ddi_dma_attr_t	tmp_dma_attr = drsas_generic_dma_attr;
+	struct scsa_cmd	*acmd = PKT2CMD(pkt);
+
+	acmd->cmd_buf = bp;
+
+	if (bp->b_flags & B_READ) {
+		acmd->cmd_flags &= ~CFLAG_DMASEND;
+		dma_flags = DDI_DMA_READ;
+	} else {
+		acmd->cmd_flags |= CFLAG_DMASEND;
+		dma_flags = DDI_DMA_WRITE;
+	}
+
+	if (flags & PKT_CONSISTENT) {
+		acmd->cmd_flags |= CFLAG_CONSISTENT;
+		dma_flags |= DDI_DMA_CONSISTENT;
+	}
+
+	if (flags & PKT_DMA_PARTIAL) {
+		dma_flags |= DDI_DMA_PARTIAL;
+	}
+
+	dma_flags |= DDI_DMA_REDZONE;
+
+	cb = (callback == NULL_FUNC) ? DDI_DMA_DONTWAIT : DDI_DMA_SLEEP;
+
+	tmp_dma_attr.dma_attr_sgllen = instance->max_num_sge;
+	tmp_dma_attr.dma_attr_addr_hi = 0xffffffffffffffffull;
+
+	if ((i = ddi_dma_alloc_handle(instance->dip, &tmp_dma_attr,
+	    cb, 0, &acmd->cmd_dmahandle)) != DDI_SUCCESS) {
+		switch (i) {
+		case DDI_DMA_BADATTR:
+			bioerror(bp, EFAULT);
+			return (DDI_FAILURE);
+
+		case DDI_DMA_NORESOURCES:
+			bioerror(bp, 0);
+			return (DDI_FAILURE);
+
+		default:
+			con_log(CL_ANN, (CE_PANIC, "ddi_dma_alloc_handle: "
+			    "impossible result (0x%x)", i));
+			bioerror(bp, EFAULT);
+			return (DDI_FAILURE);
+		}
+	}
+
+	i = ddi_dma_buf_bind_handle(acmd->cmd_dmahandle, bp, dma_flags,
+	    cb, 0, &acmd->cmd_dmacookies[0], &acmd->cmd_ncookies);
+
+	switch (i) {
+	case DDI_DMA_PARTIAL_MAP:
+		if ((dma_flags & DDI_DMA_PARTIAL) == 0) {
+			con_log(CL_ANN, (CE_PANIC, "ddi_dma_buf_bind_handle: "
+			    "DDI_DMA_PARTIAL_MAP impossible"));
+			goto no_dma_cookies;
+		}
+
+		if (ddi_dma_numwin(acmd->cmd_dmahandle, &acmd->cmd_nwin) ==
+		    DDI_FAILURE) {
+			con_log(CL_ANN, (CE_PANIC, "ddi_dma_numwin failed"));
+			goto no_dma_cookies;
+		}
+
+		if (ddi_dma_getwin(acmd->cmd_dmahandle, acmd->cmd_curwin,
+		    &acmd->cmd_dma_offset, &acmd->cmd_dma_len,
+		    &acmd->cmd_dmacookies[0], &acmd->cmd_ncookies) ==
+		    DDI_FAILURE) {
+
+			con_log(CL_ANN, (CE_PANIC, "ddi_dma_getwin failed"));
+			goto no_dma_cookies;
+		}
+
+		goto get_dma_cookies;
+	case DDI_DMA_MAPPED:
+		acmd->cmd_nwin = 1;
+		acmd->cmd_dma_len = 0;
+		acmd->cmd_dma_offset = 0;
+
+get_dma_cookies:
+		i = 0;
+		acmd->cmd_dmacount = 0;
+		for (;;) {
+			acmd->cmd_dmacount +=
+			    acmd->cmd_dmacookies[i++].dmac_size;
+
+			if (i == instance->max_num_sge ||
+			    i == acmd->cmd_ncookies)
+				break;
+
+			ddi_dma_nextcookie(acmd->cmd_dmahandle,
+			    &acmd->cmd_dmacookies[i]);
+		}
+
+		acmd->cmd_cookie = i;
+		acmd->cmd_cookiecnt = i;
+
+		acmd->cmd_flags |= CFLAG_DMAVALID;
+
+		if (bp->b_bcount >= acmd->cmd_dmacount) {
+			pkt->pkt_resid = bp->b_bcount - acmd->cmd_dmacount;
+		} else {
+			pkt->pkt_resid = 0;
+		}
+
+		return (DDI_SUCCESS);
+	case DDI_DMA_NORESOURCES:
+		bioerror(bp, 0);
+		break;
+	case DDI_DMA_NOMAPPING:
+		bioerror(bp, EFAULT);
+		break;
+	case DDI_DMA_TOOBIG:
+		bioerror(bp, EINVAL);
+		break;
+	case DDI_DMA_INUSE:
+		con_log(CL_ANN, (CE_PANIC, "ddi_dma_buf_bind_handle:"
+		    " DDI_DMA_INUSE impossible"));
+		break;
+	default:
+		con_log(CL_ANN, (CE_PANIC, "ddi_dma_buf_bind_handle: "
+		    "impossible result (0x%x)", i));
+		break;
+	}
+
+no_dma_cookies:
+	ddi_dma_free_handle(&acmd->cmd_dmahandle);
+	acmd->cmd_dmahandle = NULL;
+	acmd->cmd_flags &= ~CFLAG_DMAVALID;
+	return (DDI_FAILURE);
+}
+
+/*
+ * drsas_dma_move(struct drsas_instance *, struct scsi_pkt *, struct buf *)
+ *
+ * move dma resources to next dma window
+ *
+ */
+static int
+drsas_dma_move(struct drsas_instance *instance, struct scsi_pkt *pkt,
+    struct buf *bp)
+{
+	int	i = 0;
+
+	struct scsa_cmd	*acmd = PKT2CMD(pkt);
+
+	/*
+	 * If there are no more cookies remaining in this window,
+	 * must move to the next window first.
+	 */
+	if (acmd->cmd_cookie == acmd->cmd_ncookies) {
+		if (acmd->cmd_curwin == acmd->cmd_nwin && acmd->cmd_nwin == 1) {
+			return (DDI_SUCCESS);
+		}
+
+		/* at last window, cannot move */
+		if (++acmd->cmd_curwin >= acmd->cmd_nwin) {
+			return (DDI_FAILURE);
+		}
+
+		if (ddi_dma_getwin(acmd->cmd_dmahandle, acmd->cmd_curwin,
+		    &acmd->cmd_dma_offset, &acmd->cmd_dma_len,
+		    &acmd->cmd_dmacookies[0], &acmd->cmd_ncookies) ==
+		    DDI_FAILURE) {
+			return (DDI_FAILURE);
+		}
+
+		acmd->cmd_cookie = 0;
+	} else {
+		/* still more cookies in this window - get the next one */
+		ddi_dma_nextcookie(acmd->cmd_dmahandle,
+		    &acmd->cmd_dmacookies[0]);
+	}
+
+	/* get remaining cookies in this window, up to our maximum */
+	for (;;) {
+		acmd->cmd_dmacount += acmd->cmd_dmacookies[i++].dmac_size;
+		acmd->cmd_cookie++;
+
+		if (i == instance->max_num_sge ||
+		    acmd->cmd_cookie == acmd->cmd_ncookies) {
+			break;
+		}
+
+		ddi_dma_nextcookie(acmd->cmd_dmahandle,
+		    &acmd->cmd_dmacookies[i]);
+	}
+
+	acmd->cmd_cookiecnt = i;
+
+	if (bp->b_bcount >= acmd->cmd_dmacount) {
+		pkt->pkt_resid = bp->b_bcount - acmd->cmd_dmacount;
+	} else {
+		pkt->pkt_resid = 0;
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * build_cmd
+ */
+static struct drsas_cmd *
+build_cmd(struct drsas_instance *instance, struct scsi_address *ap,
+    struct scsi_pkt *pkt, uchar_t *cmd_done)
+{
+	uint16_t	flags = 0;
+	uint32_t	i;
+	uint32_t 	context;
+	uint32_t	sge_bytes;
+	ddi_acc_handle_t acc_handle;
+	struct drsas_cmd		*cmd;
+	struct drsas_sge64		*mfi_sgl;
+	struct scsa_cmd			*acmd = PKT2CMD(pkt);
+	struct drsas_pthru_frame 	*pthru;
+	struct drsas_io_frame		*ldio;
+
+	/* find out if this is logical or physical drive command.  */
+	acmd->islogical = MRDRV_IS_LOGICAL(ap);
+	acmd->device_id = MAP_DEVICE_ID(instance, ap);
+	*cmd_done = 0;
+
+	/* get the command packet */
+	if (!(cmd = get_mfi_pkt(instance))) {
+		return (NULL);
+	}
+
+	acc_handle = cmd->frame_dma_obj.acc_handle;
+
+	/* Clear the frame buffer and assign back the context id */
+	(void) memset((char *)&cmd->frame[0], 0, sizeof (union drsas_frame));
+	ddi_put32(acc_handle, &cmd->frame->hdr.context, cmd->index);
+
+	cmd->pkt = pkt;
+	cmd->cmd = acmd;
+
+	/* lets get the command directions */
+	if (acmd->cmd_flags & CFLAG_DMASEND) {
+		flags = MFI_FRAME_DIR_WRITE;
+
+		if (acmd->cmd_flags & CFLAG_CONSISTENT) {
+			(void) ddi_dma_sync(acmd->cmd_dmahandle,
+			    acmd->cmd_dma_offset, acmd->cmd_dma_len,
+			    DDI_DMA_SYNC_FORDEV);
+		}
+	} else if (acmd->cmd_flags & ~CFLAG_DMASEND) {
+		flags = MFI_FRAME_DIR_READ;
+
+		if (acmd->cmd_flags & CFLAG_CONSISTENT) {
+			(void) ddi_dma_sync(acmd->cmd_dmahandle,
+			    acmd->cmd_dma_offset, acmd->cmd_dma_len,
+			    DDI_DMA_SYNC_FORCPU);
+		}
+	} else {
+		flags = MFI_FRAME_DIR_NONE;
+	}
+
+	flags |= MFI_FRAME_SGL64;
+
+	switch (pkt->pkt_cdbp[0]) {
+
+	/*
+	 * case SCMD_SYNCHRONIZE_CACHE:
+	 * 	flush_cache(instance);
+	 *	return_mfi_pkt(instance, cmd);
+	 *	*cmd_done = 1;
+	 *
+	 *	return (NULL);
+	 */
+
+	case SCMD_READ:
+	case SCMD_WRITE:
+	case SCMD_READ_G1:
+	case SCMD_WRITE_G1:
+		if (acmd->islogical) {
+			ldio = (struct drsas_io_frame *)cmd->frame;
+
+			/*
+			 * preare the Logical IO frame:
+			 * 2nd bit is zero for all read cmds
+			 */
+			ddi_put8(acc_handle, &ldio->cmd,
+			    (pkt->pkt_cdbp[0] & 0x02) ? MFI_CMD_OP_LD_WRITE
+			    : MFI_CMD_OP_LD_READ);
+			ddi_put8(acc_handle, &ldio->cmd_status, 0x0);
+			ddi_put8(acc_handle, &ldio->scsi_status, 0x0);
+			ddi_put8(acc_handle, &ldio->target_id, acmd->device_id);
+			ddi_put16(acc_handle, &ldio->timeout, 0);
+			ddi_put8(acc_handle, &ldio->reserved_0, 0);
+			ddi_put16(acc_handle, &ldio->pad_0, 0);
+			ddi_put16(acc_handle, &ldio->flags, flags);
+
+			/* Initialize sense Information */
+			bzero(cmd->sense, SENSE_LENGTH);
+			ddi_put8(acc_handle, &ldio->sense_len, SENSE_LENGTH);
+			ddi_put32(acc_handle, &ldio->sense_buf_phys_addr_hi, 0);
+			ddi_put32(acc_handle, &ldio->sense_buf_phys_addr_lo,
+			    cmd->sense_phys_addr);
+			ddi_put32(acc_handle, &ldio->start_lba_hi, 0);
+			ddi_put8(acc_handle, &ldio->access_byte,
+			    (acmd->cmd_cdblen != 6) ? pkt->pkt_cdbp[1] : 0);
+			ddi_put8(acc_handle, &ldio->sge_count,
+			    acmd->cmd_cookiecnt);
+			mfi_sgl = (struct drsas_sge64	*)&ldio->sgl;
+
+			context = ddi_get32(acc_handle, &ldio->context);
+
+			if (acmd->cmd_cdblen == CDB_GROUP0) {
+				ddi_put32(acc_handle, &ldio->lba_count, (
+				    (uint16_t)(pkt->pkt_cdbp[4])));
+
+				ddi_put32(acc_handle, &ldio->start_lba_lo, (
+				    ((uint32_t)(pkt->pkt_cdbp[3])) |
+				    ((uint32_t)(pkt->pkt_cdbp[2]) << 8) |
+				    ((uint32_t)((pkt->pkt_cdbp[1]) & 0x1F)
+				    << 16)));
+			} else if (acmd->cmd_cdblen == CDB_GROUP1) {
+				ddi_put32(acc_handle, &ldio->lba_count, (
+				    ((uint16_t)(pkt->pkt_cdbp[8])) |
+				    ((uint16_t)(pkt->pkt_cdbp[7]) << 8)));
+
+				ddi_put32(acc_handle, &ldio->start_lba_lo, (
+				    ((uint32_t)(pkt->pkt_cdbp[5])) |
+				    ((uint32_t)(pkt->pkt_cdbp[4]) << 8) |
+				    ((uint32_t)(pkt->pkt_cdbp[3]) << 16) |
+				    ((uint32_t)(pkt->pkt_cdbp[2]) << 24)));
+			} else if (acmd->cmd_cdblen == CDB_GROUP2) {
+				ddi_put32(acc_handle, &ldio->lba_count, (
+				    ((uint16_t)(pkt->pkt_cdbp[9])) |
+				    ((uint16_t)(pkt->pkt_cdbp[8]) << 8) |
+				    ((uint16_t)(pkt->pkt_cdbp[7]) << 16) |
+				    ((uint16_t)(pkt->pkt_cdbp[6]) << 24)));
+
+				ddi_put32(acc_handle, &ldio->start_lba_lo, (
+				    ((uint32_t)(pkt->pkt_cdbp[5])) |
+				    ((uint32_t)(pkt->pkt_cdbp[4]) << 8) |
+				    ((uint32_t)(pkt->pkt_cdbp[3]) << 16) |
+				    ((uint32_t)(pkt->pkt_cdbp[2]) << 24)));
+			} else if (acmd->cmd_cdblen == CDB_GROUP3) {
+				ddi_put32(acc_handle, &ldio->lba_count, (
+				    ((uint16_t)(pkt->pkt_cdbp[13])) |
+				    ((uint16_t)(pkt->pkt_cdbp[12]) << 8) |
+				    ((uint16_t)(pkt->pkt_cdbp[11]) << 16) |
+				    ((uint16_t)(pkt->pkt_cdbp[10]) << 24)));
+
+				ddi_put32(acc_handle, &ldio->start_lba_lo, (
+				    ((uint32_t)(pkt->pkt_cdbp[9])) |
+				    ((uint32_t)(pkt->pkt_cdbp[8]) << 8) |
+				    ((uint32_t)(pkt->pkt_cdbp[7]) << 16) |
+				    ((uint32_t)(pkt->pkt_cdbp[6]) << 24)));
+
+				ddi_put32(acc_handle, &ldio->start_lba_lo, (
+				    ((uint32_t)(pkt->pkt_cdbp[5])) |
+				    ((uint32_t)(pkt->pkt_cdbp[4]) << 8) |
+				    ((uint32_t)(pkt->pkt_cdbp[3]) << 16) |
+				    ((uint32_t)(pkt->pkt_cdbp[2]) << 24)));
+			}
+
+			break;
+		}
+		/* fall through For all non-rd/wr cmds */
+	default:
+
+		switch (pkt->pkt_cdbp[0]) {
+		case SCMD_MODE_SENSE:
+		case SCMD_MODE_SENSE_G1: {
+			union scsi_cdb	*cdbp;
+			uint16_t	page_code;
+
+			cdbp = (void *)pkt->pkt_cdbp;
+			page_code = (uint16_t)cdbp->cdb_un.sg.scsi[0];
+			switch (page_code) {
+			case 0x3:
+			case 0x4:
+				(void) drsas_mode_sense_build(pkt);
+				return_mfi_pkt(instance, cmd);
+				*cmd_done = 1;
+				return (NULL);
+			}
+			break;
+		}
+		default:
+			break;
+		}
+
+		pthru	= (struct drsas_pthru_frame *)cmd->frame;
+
+		/* prepare the DCDB frame */
+		ddi_put8(acc_handle, &pthru->cmd, (acmd->islogical) ?
+		    MFI_CMD_OP_LD_SCSI : MFI_CMD_OP_PD_SCSI);
+		ddi_put8(acc_handle, &pthru->cmd_status, 0x0);
+		ddi_put8(acc_handle, &pthru->scsi_status, 0x0);
+		ddi_put8(acc_handle, &pthru->target_id, acmd->device_id);
+		ddi_put8(acc_handle, &pthru->lun, 0);
+		ddi_put8(acc_handle, &pthru->cdb_len, acmd->cmd_cdblen);
+		ddi_put16(acc_handle, &pthru->timeout, 0);
+		ddi_put16(acc_handle, &pthru->flags, flags);
+		ddi_put32(acc_handle, &pthru->data_xfer_len,
+		    acmd->cmd_dmacount);
+		ddi_put8(acc_handle, &pthru->sge_count, acmd->cmd_cookiecnt);
+		mfi_sgl			= (struct drsas_sge64 *)&pthru->sgl;
+
+		bzero(cmd->sense, SENSE_LENGTH);
+		ddi_put8(acc_handle, &pthru->sense_len, SENSE_LENGTH);
+		ddi_put32(acc_handle, &pthru->sense_buf_phys_addr_hi, 0);
+		ddi_put32(acc_handle, &pthru->sense_buf_phys_addr_lo,
+		    cmd->sense_phys_addr);
+
+		context = ddi_get32(acc_handle, &pthru->context);
+		ddi_rep_put8(acc_handle, (uint8_t *)pkt->pkt_cdbp,
+		    (uint8_t *)pthru->cdb, acmd->cmd_cdblen, DDI_DEV_AUTOINCR);
+
+		break;
+	}
+#ifdef lint
+	context = context;
+#endif
+	/* prepare the scatter-gather list for the firmware */
+	for (i = 0; i < acmd->cmd_cookiecnt; i++, mfi_sgl++) {
+		ddi_put64(acc_handle, &mfi_sgl->phys_addr,
+		    acmd->cmd_dmacookies[i].dmac_laddress);
+		ddi_put32(acc_handle, &mfi_sgl->length,
+		    acmd->cmd_dmacookies[i].dmac_size);
+	}
+
+	sge_bytes = sizeof (struct drsas_sge64)*acmd->cmd_cookiecnt;
+
+	cmd->frame_count = (sge_bytes / MRMFI_FRAME_SIZE) +
+	    ((sge_bytes % MRMFI_FRAME_SIZE) ? 1 : 0) + 1;
+
+	if (cmd->frame_count >= 8) {
+		cmd->frame_count = 8;
+	}
+
+	return (cmd);
+}
+
+/*
+ * issue_mfi_pthru
+ */
+static int
+issue_mfi_pthru(struct drsas_instance *instance, struct drsas_ioctl *ioctl,
+    struct drsas_cmd *cmd, int mode)
+{
+	void		*ubuf;
+	uint32_t	kphys_addr = 0;
+	uint32_t	xferlen = 0;
+	uint_t		model;
+	ddi_acc_handle_t	acc_handle = cmd->frame_dma_obj.acc_handle;
+	dma_obj_t			pthru_dma_obj;
+	struct drsas_pthru_frame	*kpthru;
+	struct drsas_pthru_frame	*pthru;
+	int i;
+	pthru = &cmd->frame->pthru;
+	kpthru = (struct drsas_pthru_frame *)&ioctl->frame[0];
+
+	model = ddi_model_convert_from(mode & FMODELS);
+	if (model == DDI_MODEL_ILP32) {
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_pthru: DDI_MODEL_LP32"));
+
+		xferlen	= kpthru->sgl.sge32[0].length;
+
+		ubuf	= (void *)(ulong_t)kpthru->sgl.sge32[0].phys_addr;
+	} else {
+#ifdef _ILP32
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_pthru: DDI_MODEL_LP32"));
+		xferlen	= kpthru->sgl.sge32[0].length;
+		ubuf	= (void *)(ulong_t)kpthru->sgl.sge32[0].phys_addr;
+#else
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_pthru: DDI_MODEL_LP64"));
+		xferlen	= kpthru->sgl.sge64[0].length;
+		ubuf	= (void *)(ulong_t)kpthru->sgl.sge64[0].phys_addr;
+#endif
+	}
+
+	if (xferlen) {
+		/* means IOCTL requires DMA */
+		/* allocate the data transfer buffer */
+		pthru_dma_obj.size = xferlen;
+		pthru_dma_obj.dma_attr = drsas_generic_dma_attr;
+		pthru_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+		pthru_dma_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+		pthru_dma_obj.dma_attr.dma_attr_sgllen = 1;
+		pthru_dma_obj.dma_attr.dma_attr_align = 1;
+
+		/* allocate kernel buffer for DMA */
+		if (drsas_alloc_dma_obj(instance, &pthru_dma_obj,
+		    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+			con_log(CL_ANN, (CE_WARN, "issue_mfi_pthru: "
+			    "could not allocate data transfer buffer."));
+			return (DDI_FAILURE);
+		}
+
+		/* If IOCTL requires DMA WRITE, do ddi_copyin IOCTL data copy */
+		if (kpthru->flags & MFI_FRAME_DIR_WRITE) {
+			for (i = 0; i < xferlen; i++) {
+				if (ddi_copyin((uint8_t *)ubuf+i,
+				    (uint8_t *)pthru_dma_obj.buffer+i,
+				    1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "issue_mfi_pthru : "
+					    "copy from user space failed"));
+					return (DDI_FAILURE);
+				}
+			}
+		}
+
+		kphys_addr = pthru_dma_obj.dma_cookie[0].dmac_address;
+	}
+
+	ddi_put8(acc_handle, &pthru->cmd, kpthru->cmd);
+	ddi_put8(acc_handle, &pthru->sense_len, kpthru->sense_len);
+	ddi_put8(acc_handle, &pthru->cmd_status, 0);
+	ddi_put8(acc_handle, &pthru->scsi_status, 0);
+	ddi_put8(acc_handle, &pthru->target_id, kpthru->target_id);
+	ddi_put8(acc_handle, &pthru->lun, kpthru->lun);
+	ddi_put8(acc_handle, &pthru->cdb_len, kpthru->cdb_len);
+	ddi_put8(acc_handle, &pthru->sge_count, kpthru->sge_count);
+	ddi_put16(acc_handle, &pthru->timeout, kpthru->timeout);
+	ddi_put32(acc_handle, &pthru->data_xfer_len, kpthru->data_xfer_len);
+
+	ddi_put32(acc_handle, &pthru->sense_buf_phys_addr_hi, 0);
+	/* pthru->sense_buf_phys_addr_lo = cmd->sense_phys_addr; */
+	ddi_put32(acc_handle, &pthru->sense_buf_phys_addr_lo, 0);
+
+	ddi_rep_put8(acc_handle, (uint8_t *)kpthru->cdb, (uint8_t *)pthru->cdb,
+	    pthru->cdb_len, DDI_DEV_AUTOINCR);
+
+	ddi_put16(acc_handle, &pthru->flags, kpthru->flags & ~MFI_FRAME_SGL64);
+	ddi_put32(acc_handle, &pthru->sgl.sge32[0].length, xferlen);
+	ddi_put32(acc_handle, &pthru->sgl.sge32[0].phys_addr, kphys_addr);
+
+	cmd->sync_cmd = DRSAS_TRUE;
+	cmd->frame_count = 1;
+
+	if (instance->func_ptr->issue_cmd_in_sync_mode(instance, cmd)) {
+		con_log(CL_ANN, (CE_WARN,
+		    "issue_mfi_pthru: fw_ioctl failed"));
+	} else {
+		if (xferlen && kpthru->flags & MFI_FRAME_DIR_READ) {
+			for (i = 0; i < xferlen; i++) {
+				if (ddi_copyout(
+				    (uint8_t *)pthru_dma_obj.buffer+i,
+				    (uint8_t *)ubuf+i, 1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "issue_mfi_pthru : "
+					    "copy to user space failed"));
+					return (DDI_FAILURE);
+				}
+			}
+		}
+	}
+
+	kpthru->cmd_status = ddi_get8(acc_handle, &pthru->cmd_status);
+	kpthru->scsi_status = ddi_get8(acc_handle, &pthru->scsi_status);
+
+	con_log(CL_ANN, (CE_NOTE, "issue_mfi_pthru: cmd_status %x, "
+	    "scsi_status %x", kpthru->cmd_status, kpthru->scsi_status));
+
+	if (xferlen) {
+		/* free kernel buffer */
+		if (drsas_free_dma_obj(instance, pthru_dma_obj) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * issue_mfi_dcmd
+ */
+static int
+issue_mfi_dcmd(struct drsas_instance *instance, struct drsas_ioctl *ioctl,
+    struct drsas_cmd *cmd, int mode)
+{
+	void		*ubuf;
+	uint32_t	kphys_addr = 0;
+	uint32_t	xferlen = 0;
+	uint32_t	model;
+	dma_obj_t	dcmd_dma_obj;
+	struct drsas_dcmd_frame	*kdcmd;
+	struct drsas_dcmd_frame	*dcmd;
+	ddi_acc_handle_t	acc_handle = cmd->frame_dma_obj.acc_handle;
+	int i;
+	dcmd = &cmd->frame->dcmd;
+	kdcmd = (struct drsas_dcmd_frame *)&ioctl->frame[0];
+
+	model = ddi_model_convert_from(mode & FMODELS);
+	if (model == DDI_MODEL_ILP32) {
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_dcmd: DDI_MODEL_ILP32"));
+
+		xferlen	= kdcmd->sgl.sge32[0].length;
+
+		ubuf	= (void *)(ulong_t)kdcmd->sgl.sge32[0].phys_addr;
+	} else {
+#ifdef _ILP32
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_dcmd: DDI_MODEL_ILP32"));
+		xferlen	= kdcmd->sgl.sge32[0].length;
+		ubuf	= (void *)(ulong_t)kdcmd->sgl.sge32[0].phys_addr;
+#else
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_dcmd: DDI_MODEL_LP64"));
+		xferlen	= kdcmd->sgl.sge64[0].length;
+		ubuf	= (void *)(ulong_t)kdcmd->sgl.sge64[0].phys_addr;
+#endif
+	}
+	if (xferlen) {
+		/* means IOCTL requires DMA */
+		/* allocate the data transfer buffer */
+		dcmd_dma_obj.size = xferlen;
+		dcmd_dma_obj.dma_attr = drsas_generic_dma_attr;
+		dcmd_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+		dcmd_dma_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+		dcmd_dma_obj.dma_attr.dma_attr_sgllen = 1;
+		dcmd_dma_obj.dma_attr.dma_attr_align = 1;
+
+		/* allocate kernel buffer for DMA */
+		if (drsas_alloc_dma_obj(instance, &dcmd_dma_obj,
+		    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+			con_log(CL_ANN, (CE_WARN, "issue_mfi_dcmd: "
+			    "could not allocate data transfer buffer."));
+			return (DDI_FAILURE);
+		}
+
+		/* If IOCTL requires DMA WRITE, do ddi_copyin IOCTL data copy */
+		if (kdcmd->flags & MFI_FRAME_DIR_WRITE) {
+			for (i = 0; i < xferlen; i++) {
+				if (ddi_copyin((uint8_t *)ubuf + i,
+				    (uint8_t *)dcmd_dma_obj.buffer + i,
+				    1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "issue_mfi_dcmd : "
+					    "copy from user space failed"));
+					return (DDI_FAILURE);
+				}
+			}
+		}
+
+		kphys_addr = dcmd_dma_obj.dma_cookie[0].dmac_address;
+	}
+
+	ddi_put8(acc_handle, &dcmd->cmd, kdcmd->cmd);
+	ddi_put8(acc_handle, &dcmd->cmd_status, 0);
+	ddi_put8(acc_handle, &dcmd->sge_count, kdcmd->sge_count);
+	ddi_put16(acc_handle, &dcmd->timeout, kdcmd->timeout);
+	ddi_put32(acc_handle, &dcmd->data_xfer_len, kdcmd->data_xfer_len);
+	ddi_put32(acc_handle, &dcmd->opcode, kdcmd->opcode);
+
+	ddi_rep_put8(acc_handle, (uint8_t *)kdcmd->mbox.b,
+	    (uint8_t *)dcmd->mbox.b, DCMD_MBOX_SZ, DDI_DEV_AUTOINCR);
+
+	ddi_put16(acc_handle, &dcmd->flags, kdcmd->flags & ~MFI_FRAME_SGL64);
+	ddi_put32(acc_handle, &dcmd->sgl.sge32[0].length, xferlen);
+	ddi_put32(acc_handle, &dcmd->sgl.sge32[0].phys_addr, kphys_addr);
+
+	cmd->sync_cmd = DRSAS_TRUE;
+	cmd->frame_count = 1;
+
+	if (instance->func_ptr->issue_cmd_in_sync_mode(instance, cmd)) {
+		con_log(CL_ANN, (CE_WARN, "issue_mfi_dcmd: fw_ioctl failed"));
+	} else {
+		if (xferlen && (kdcmd->flags & MFI_FRAME_DIR_READ)) {
+			for (i = 0; i < xferlen; i++) {
+				if (ddi_copyout(
+				    (uint8_t *)dcmd_dma_obj.buffer + i,
+				    (uint8_t *)ubuf + i,
+				    1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "issue_mfi_dcmd : "
+					    "copy to user space failed"));
+					return (DDI_FAILURE);
+				}
+			}
+		}
+	}
+
+	kdcmd->cmd_status = ddi_get8(acc_handle, &dcmd->cmd_status);
+
+	if (xferlen) {
+		/* free kernel buffer */
+		if (drsas_free_dma_obj(instance, dcmd_dma_obj) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * issue_mfi_smp
+ */
+static int
+issue_mfi_smp(struct drsas_instance *instance, struct drsas_ioctl *ioctl,
+    struct drsas_cmd *cmd, int mode)
+{
+	void		*request_ubuf;
+	void		*response_ubuf;
+	uint32_t	request_xferlen = 0;
+	uint32_t	response_xferlen = 0;
+	uint_t		model;
+	dma_obj_t			request_dma_obj;
+	dma_obj_t			response_dma_obj;
+	ddi_acc_handle_t	acc_handle = cmd->frame_dma_obj.acc_handle;
+	struct drsas_smp_frame		*ksmp;
+	struct drsas_smp_frame		*smp;
+	struct drsas_sge32		*sge32;
+#ifndef _ILP32
+	struct drsas_sge64		*sge64;
+#endif
+	int i;
+	uint64_t			tmp_sas_addr;
+
+	smp = &cmd->frame->smp;
+	ksmp = (struct drsas_smp_frame *)&ioctl->frame[0];
+
+	model = ddi_model_convert_from(mode & FMODELS);
+	if (model == DDI_MODEL_ILP32) {
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_smp: DDI_MODEL_ILP32"));
+
+		sge32			= &ksmp->sgl[0].sge32[0];
+		response_xferlen	= sge32[0].length;
+		request_xferlen		= sge32[1].length;
+		con_log(CL_ANN, (CE_NOTE, "issue_mfi_smp: "
+		    "response_xferlen = %x, request_xferlen = %x",
+		    response_xferlen, request_xferlen));
+
+		response_ubuf	= (void *)(ulong_t)sge32[0].phys_addr;
+		request_ubuf	= (void *)(ulong_t)sge32[1].phys_addr;
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_smp: "
+		    "response_ubuf = %p, request_ubuf = %p",
+		    response_ubuf, request_ubuf));
+	} else {
+#ifdef _ILP32
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_smp: DDI_MODEL_ILP32"));
+
+		sge32			= &ksmp->sgl[0].sge32[0];
+		response_xferlen	= sge32[0].length;
+		request_xferlen		= sge32[1].length;
+		con_log(CL_ANN, (CE_NOTE, "issue_mfi_smp: "
+		    "response_xferlen = %x, request_xferlen = %x",
+		    response_xferlen, request_xferlen));
+
+		response_ubuf	= (void *)(ulong_t)sge32[0].phys_addr;
+		request_ubuf	= (void *)(ulong_t)sge32[1].phys_addr;
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_smp: "
+		    "response_ubuf = %p, request_ubuf = %p",
+		    response_ubuf, request_ubuf));
+#else
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_smp: DDI_MODEL_LP64"));
+
+		sge64			= &ksmp->sgl[0].sge64[0];
+		response_xferlen	= sge64[0].length;
+		request_xferlen		= sge64[1].length;
+
+		response_ubuf	= (void *)(ulong_t)sge64[0].phys_addr;
+		request_ubuf	= (void *)(ulong_t)sge64[1].phys_addr;
+#endif
+	}
+	if (request_xferlen) {
+		/* means IOCTL requires DMA */
+		/* allocate the data transfer buffer */
+		request_dma_obj.size = request_xferlen;
+		request_dma_obj.dma_attr = drsas_generic_dma_attr;
+		request_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+		request_dma_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+		request_dma_obj.dma_attr.dma_attr_sgllen = 1;
+		request_dma_obj.dma_attr.dma_attr_align = 1;
+
+		/* allocate kernel buffer for DMA */
+		if (drsas_alloc_dma_obj(instance, &request_dma_obj,
+		    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+			con_log(CL_ANN, (CE_WARN, "issue_mfi_smp: "
+			    "could not allocate data transfer buffer."));
+			return (DDI_FAILURE);
+		}
+
+		/* If IOCTL requires DMA WRITE, do ddi_copyin IOCTL data copy */
+		for (i = 0; i < request_xferlen; i++) {
+			if (ddi_copyin((uint8_t *)request_ubuf + i,
+			    (uint8_t *)request_dma_obj.buffer + i,
+			    1, mode)) {
+				con_log(CL_ANN, (CE_WARN, "issue_mfi_smp: "
+				    "copy from user space failed"));
+				return (DDI_FAILURE);
+			}
+		}
+	}
+
+	if (response_xferlen) {
+		/* means IOCTL requires DMA */
+		/* allocate the data transfer buffer */
+		response_dma_obj.size = response_xferlen;
+		response_dma_obj.dma_attr = drsas_generic_dma_attr;
+		response_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+		response_dma_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+		response_dma_obj.dma_attr.dma_attr_sgllen = 1;
+		response_dma_obj.dma_attr.dma_attr_align = 1;
+
+		/* allocate kernel buffer for DMA */
+		if (drsas_alloc_dma_obj(instance, &response_dma_obj,
+		    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+			con_log(CL_ANN, (CE_WARN, "issue_mfi_smp: "
+			    "could not allocate data transfer buffer."));
+			return (DDI_FAILURE);
+		}
+
+		/* If IOCTL requires DMA WRITE, do ddi_copyin IOCTL data copy */
+		for (i = 0; i < response_xferlen; i++) {
+			if (ddi_copyin((uint8_t *)response_ubuf + i,
+			    (uint8_t *)response_dma_obj.buffer + i,
+			    1, mode)) {
+				con_log(CL_ANN, (CE_WARN, "issue_mfi_smp: "
+				    "copy from user space failed"));
+				return (DDI_FAILURE);
+			}
+		}
+	}
+
+	ddi_put8(acc_handle, &smp->cmd, ksmp->cmd);
+	ddi_put8(acc_handle, &smp->cmd_status, 0);
+	ddi_put8(acc_handle, &smp->connection_status, 0);
+	ddi_put8(acc_handle, &smp->sge_count, ksmp->sge_count);
+	/* smp->context		= ksmp->context; */
+	ddi_put16(acc_handle, &smp->timeout, ksmp->timeout);
+	ddi_put32(acc_handle, &smp->data_xfer_len, ksmp->data_xfer_len);
+
+	bcopy((void *)&ksmp->sas_addr, (void *)&tmp_sas_addr,
+	    sizeof (uint64_t));
+	ddi_put64(acc_handle, &smp->sas_addr, tmp_sas_addr);
+
+	ddi_put16(acc_handle, &smp->flags, ksmp->flags & ~MFI_FRAME_SGL64);
+
+	model = ddi_model_convert_from(mode & FMODELS);
+	if (model == DDI_MODEL_ILP32) {
+		con_log(CL_ANN1, (CE_NOTE,
+		    "handle_drv_ioctl: DDI_MODEL_ILP32"));
+
+		sge32 = &smp->sgl[0].sge32[0];
+		ddi_put32(acc_handle, &sge32[0].length, response_xferlen);
+		ddi_put32(acc_handle, &sge32[0].phys_addr,
+		    response_dma_obj.dma_cookie[0].dmac_address);
+		ddi_put32(acc_handle, &sge32[1].length, request_xferlen);
+		ddi_put32(acc_handle, &sge32[1].phys_addr,
+		    request_dma_obj.dma_cookie[0].dmac_address);
+	} else {
+#ifdef _ILP32
+		con_log(CL_ANN1, (CE_NOTE,
+		    "handle_drv_ioctl: DDI_MODEL_ILP32"));
+		sge32 = &smp->sgl[0].sge32[0];
+		ddi_put32(acc_handle, &sge32[0].length, response_xferlen);
+		ddi_put32(acc_handle, &sge32[0].phys_addr,
+		    response_dma_obj.dma_cookie[0].dmac_address);
+		ddi_put32(acc_handle, &sge32[1].length, request_xferlen);
+		ddi_put32(acc_handle, &sge32[1].phys_addr,
+		    request_dma_obj.dma_cookie[0].dmac_address);
+#else
+		con_log(CL_ANN1, (CE_NOTE,
+		    "issue_mfi_smp: DDI_MODEL_LP64"));
+		sge64 = &smp->sgl[0].sge64[0];
+		ddi_put32(acc_handle, &sge64[0].length, response_xferlen);
+		ddi_put64(acc_handle, &sge64[0].phys_addr,
+		    response_dma_obj.dma_cookie[0].dmac_address);
+		ddi_put32(acc_handle, &sge64[1].length, request_xferlen);
+		ddi_put64(acc_handle, &sge64[1].phys_addr,
+		    request_dma_obj.dma_cookie[0].dmac_address);
+#endif
+	}
+	con_log(CL_ANN1, (CE_NOTE, "issue_mfi_smp : "
+	    "smp->response_xferlen = %d, smp->request_xferlen = %d "
+	    "smp->data_xfer_len = %d", ddi_get32(acc_handle, &sge32[0].length),
+	    ddi_get32(acc_handle, &sge32[1].length),
+	    ddi_get32(acc_handle, &smp->data_xfer_len)));
+
+	cmd->sync_cmd = DRSAS_TRUE;
+	cmd->frame_count = 1;
+
+	if (instance->func_ptr->issue_cmd_in_sync_mode(instance, cmd)) {
+		con_log(CL_ANN, (CE_WARN,
+		    "issue_mfi_smp: fw_ioctl failed"));
+	} else {
+		con_log(CL_ANN1, (CE_NOTE,
+		    "issue_mfi_smp: copy to user space"));
+
+		if (request_xferlen) {
+			for (i = 0; i < request_xferlen; i++) {
+				if (ddi_copyout(
+				    (uint8_t *)request_dma_obj.buffer +
+				    i, (uint8_t *)request_ubuf + i,
+				    1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "issue_mfi_smp : copy to user space"
+					    " failed"));
+					return (DDI_FAILURE);
+				}
+			}
+		}
+
+		if (response_xferlen) {
+			for (i = 0; i < response_xferlen; i++) {
+				if (ddi_copyout(
+				    (uint8_t *)response_dma_obj.buffer
+				    + i, (uint8_t *)response_ubuf
+				    + i, 1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "issue_mfi_smp : copy to "
+					    "user space failed"));
+					return (DDI_FAILURE);
+				}
+			}
+		}
+	}
+
+	ksmp->cmd_status = ddi_get8(acc_handle, &smp->cmd_status);
+	con_log(CL_ANN1, (CE_NOTE, "issue_mfi_smp: smp->cmd_status = %d",
+	    ddi_get8(acc_handle, &smp->cmd_status)));
+
+
+	if (request_xferlen) {
+		/* free kernel buffer */
+		if (drsas_free_dma_obj(instance, request_dma_obj) !=
+		    DDI_SUCCESS)
+			return (DDI_FAILURE);
+	}
+
+	if (response_xferlen) {
+		/* free kernel buffer */
+		if (drsas_free_dma_obj(instance, response_dma_obj) !=
+		    DDI_SUCCESS)
+			return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * issue_mfi_stp
+ */
+static int
+issue_mfi_stp(struct drsas_instance *instance, struct drsas_ioctl *ioctl,
+    struct drsas_cmd *cmd, int mode)
+{
+	void		*fis_ubuf;
+	void		*data_ubuf;
+	uint32_t	fis_xferlen = 0;
+	uint32_t	data_xferlen = 0;
+	uint_t		model;
+	dma_obj_t	fis_dma_obj;
+	dma_obj_t	data_dma_obj;
+	struct drsas_stp_frame	*kstp;
+	struct drsas_stp_frame	*stp;
+	ddi_acc_handle_t	acc_handle = cmd->frame_dma_obj.acc_handle;
+	int i;
+
+	stp = &cmd->frame->stp;
+	kstp = (struct drsas_stp_frame *)&ioctl->frame[0];
+
+	model = ddi_model_convert_from(mode & FMODELS);
+	if (model == DDI_MODEL_ILP32) {
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_stp: DDI_MODEL_ILP32"));
+
+		fis_xferlen	= kstp->sgl.sge32[0].length;
+		data_xferlen	= kstp->sgl.sge32[1].length;
+
+		fis_ubuf	= (void *)(ulong_t)kstp->sgl.sge32[0].phys_addr;
+		data_ubuf	= (void *)(ulong_t)kstp->sgl.sge32[1].phys_addr;
+	}
+	else
+	{
+#ifdef _ILP32
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_stp: DDI_MODEL_ILP32"));
+
+		fis_xferlen	= kstp->sgl.sge32[0].length;
+		data_xferlen	= kstp->sgl.sge32[1].length;
+
+		fis_ubuf	= (void *)(ulong_t)kstp->sgl.sge32[0].phys_addr;
+		data_ubuf	= (void *)(ulong_t)kstp->sgl.sge32[1].phys_addr;
+#else
+		con_log(CL_ANN1, (CE_NOTE, "issue_mfi_stp: DDI_MODEL_LP64"));
+
+		fis_xferlen	= kstp->sgl.sge64[0].length;
+		data_xferlen	= kstp->sgl.sge64[1].length;
+
+		fis_ubuf	= (void *)(ulong_t)kstp->sgl.sge64[0].phys_addr;
+		data_ubuf	= (void *)(ulong_t)kstp->sgl.sge64[1].phys_addr;
+#endif
+	}
+
+
+	if (fis_xferlen) {
+		con_log(CL_ANN, (CE_NOTE, "issue_mfi_stp: "
+		    "fis_ubuf = %p fis_xferlen = %x", fis_ubuf, fis_xferlen));
+
+		/* means IOCTL requires DMA */
+		/* allocate the data transfer buffer */
+		fis_dma_obj.size = fis_xferlen;
+		fis_dma_obj.dma_attr = drsas_generic_dma_attr;
+		fis_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+		fis_dma_obj.dma_attr.dma_attr_count_max	= 0xFFFFFFFFU;
+		fis_dma_obj.dma_attr.dma_attr_sgllen = 1;
+		fis_dma_obj.dma_attr.dma_attr_align = 1;
+
+		/* allocate kernel buffer for DMA */
+		if (drsas_alloc_dma_obj(instance, &fis_dma_obj,
+		    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+			con_log(CL_ANN, (CE_WARN, "issue_mfi_stp : "
+			    "could not allocate data transfer buffer."));
+			return (DDI_FAILURE);
+		}
+
+		/* If IOCTL requires DMA WRITE, do ddi_copyin IOCTL data copy */
+		for (i = 0; i < fis_xferlen; i++) {
+			if (ddi_copyin((uint8_t *)fis_ubuf + i,
+			    (uint8_t *)fis_dma_obj.buffer + i, 1, mode)) {
+				con_log(CL_ANN, (CE_WARN, "issue_mfi_stp: "
+				    "copy from user space failed"));
+				return (DDI_FAILURE);
+			}
+		}
+	}
+
+	if (data_xferlen) {
+		con_log(CL_ANN, (CE_NOTE, "issue_mfi_stp: data_ubuf = %p "
+		    "data_xferlen = %x", data_ubuf, data_xferlen));
+
+		/* means IOCTL requires DMA */
+		/* allocate the data transfer buffer */
+		data_dma_obj.size = data_xferlen;
+		data_dma_obj.dma_attr = drsas_generic_dma_attr;
+		data_dma_obj.dma_attr.dma_attr_addr_hi = 0xFFFFFFFFU;
+		data_dma_obj.dma_attr.dma_attr_count_max = 0xFFFFFFFFU;
+		data_dma_obj.dma_attr.dma_attr_sgllen = 1;
+		data_dma_obj.dma_attr.dma_attr_align = 1;
+
+/* allocate kernel buffer for DMA */
+		if (drsas_alloc_dma_obj(instance, &data_dma_obj,
+		    (uchar_t)DDI_STRUCTURE_LE_ACC) != 1) {
+			con_log(CL_ANN, (CE_WARN, "issue_mfi_stp: "
+			    "could not allocate data transfer buffer."));
+			return (DDI_FAILURE);
+		}
+
+		/* If IOCTL requires DMA WRITE, do ddi_copyin IOCTL data copy */
+		for (i = 0; i < data_xferlen; i++) {
+			if (ddi_copyin((uint8_t *)data_ubuf + i,
+			    (uint8_t *)data_dma_obj.buffer + i, 1, mode)) {
+				con_log(CL_ANN, (CE_WARN, "issue_mfi_stp: "
+				    "copy from user space failed"));
+				return (DDI_FAILURE);
+			}
+		}
+	}
+
+	ddi_put8(acc_handle, &stp->cmd, kstp->cmd);
+	ddi_put8(acc_handle, &stp->cmd_status, 0);
+	ddi_put8(acc_handle, &stp->connection_status, 0);
+	ddi_put8(acc_handle, &stp->target_id, kstp->target_id);
+	ddi_put8(acc_handle, &stp->sge_count, kstp->sge_count);
+
+	ddi_put16(acc_handle, &stp->timeout, kstp->timeout);
+	ddi_put32(acc_handle, &stp->data_xfer_len, kstp->data_xfer_len);
+
+	ddi_rep_put8(acc_handle, (uint8_t *)kstp->fis, (uint8_t *)stp->fis, 10,
+	    DDI_DEV_AUTOINCR);
+
+	ddi_put16(acc_handle, &stp->flags, kstp->flags & ~MFI_FRAME_SGL64);
+	ddi_put32(acc_handle, &stp->stp_flags, kstp->stp_flags);
+	ddi_put32(acc_handle, &stp->sgl.sge32[0].length, fis_xferlen);
+	ddi_put32(acc_handle, &stp->sgl.sge32[0].phys_addr,
+	    fis_dma_obj.dma_cookie[0].dmac_address);
+	ddi_put32(acc_handle, &stp->sgl.sge32[1].length, data_xferlen);
+	ddi_put32(acc_handle, &stp->sgl.sge32[1].phys_addr,
+	    data_dma_obj.dma_cookie[0].dmac_address);
+
+	cmd->sync_cmd = DRSAS_TRUE;
+	cmd->frame_count = 1;
+
+	if (instance->func_ptr->issue_cmd_in_sync_mode(instance, cmd)) {
+		con_log(CL_ANN, (CE_WARN, "issue_mfi_stp: fw_ioctl failed"));
+	} else {
+
+		if (fis_xferlen) {
+			for (i = 0; i < fis_xferlen; i++) {
+				if (ddi_copyout(
+				    (uint8_t *)fis_dma_obj.buffer + i,
+				    (uint8_t *)fis_ubuf + i, 1, mode)) {
+					con_log(CL_ANN, (CE_WARN,
+					    "issue_mfi_stp : copy to "
+					    "user space failed"));
+					return (DDI_FAILURE);
+				}
+			}
+		}
+	}
+	if (data_xferlen) {
+		for (i = 0; i < data_xferlen; i++) {
+			if (ddi_copyout(
+			    (uint8_t *)data_dma_obj.buffer + i,
+			    (uint8_t *)data_ubuf + i, 1, mode)) {
+				con_log(CL_ANN, (CE_WARN,
+				    "issue_mfi_stp : copy to"
+				    " user space failed"));
+				return (DDI_FAILURE);
+			}
+		}
+	}
+
+	kstp->cmd_status = ddi_get8(acc_handle, &stp->cmd_status);
+
+	if (fis_xferlen) {
+		/* free kernel buffer */
+		if (drsas_free_dma_obj(instance, fis_dma_obj) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+	}
+
+	if (data_xferlen) {
+		/* free kernel buffer */
+		if (drsas_free_dma_obj(instance, data_dma_obj) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * fill_up_drv_ver
+ */
+static void
+fill_up_drv_ver(struct drsas_drv_ver *dv)
+{
+	(void) memset(dv, 0, sizeof (struct drsas_drv_ver));
+
+	(void) memcpy(dv->signature, "$LSI LOGIC$", strlen("$LSI LOGIC$"));
+	(void) memcpy(dv->os_name, "Solaris", strlen("Solaris"));
+	(void) memcpy(dv->drv_name, "dr_sas", strlen("dr_sas"));
+	(void) memcpy(dv->drv_ver, DRSAS_VERSION, strlen(DRSAS_VERSION));
+	(void) memcpy(dv->drv_rel_date, DRSAS_RELDATE,
+	    strlen(DRSAS_RELDATE));
+}
+
+/*
+ * handle_drv_ioctl
+ */
+static int
+handle_drv_ioctl(struct drsas_instance *instance, struct drsas_ioctl *ioctl,
+    int mode)
+{
+	int	i;
+	int	rval = DDI_SUCCESS;
+	int	*props = NULL;
+	void	*ubuf;
+
+	uint8_t		*pci_conf_buf;
+	uint32_t	xferlen;
+	uint32_t	num_props;
+	uint_t		model;
+	struct drsas_dcmd_frame	*kdcmd;
+	struct drsas_drv_ver	dv;
+	struct drsas_pci_information pi;
+
+	kdcmd = (struct drsas_dcmd_frame *)&ioctl->frame[0];
+
+	model = ddi_model_convert_from(mode & FMODELS);
+	if (model == DDI_MODEL_ILP32) {
+		con_log(CL_ANN1, (CE_NOTE,
+		    "handle_drv_ioctl: DDI_MODEL_ILP32"));
+
+		xferlen	= kdcmd->sgl.sge32[0].length;
+
+		ubuf = (void *)(ulong_t)kdcmd->sgl.sge32[0].phys_addr;
+	} else {
+#ifdef _ILP32
+		con_log(CL_ANN1, (CE_NOTE,
+		    "handle_drv_ioctl: DDI_MODEL_ILP32"));
+		xferlen	= kdcmd->sgl.sge32[0].length;
+		ubuf = (void *)(ulong_t)kdcmd->sgl.sge32[0].phys_addr;
+#else
+		con_log(CL_ANN1, (CE_NOTE,
+		    "handle_drv_ioctl: DDI_MODEL_LP64"));
+		xferlen	= kdcmd->sgl.sge64[0].length;
+		ubuf = (void *)(ulong_t)kdcmd->sgl.sge64[0].phys_addr;
+#endif
+	}
+	con_log(CL_ANN1, (CE_NOTE, "handle_drv_ioctl: "
+	    "dataBuf=%p size=%d bytes", ubuf, xferlen));
+
+	switch (kdcmd->opcode) {
+	case DRSAS_DRIVER_IOCTL_DRIVER_VERSION:
+		con_log(CL_ANN1, (CE_NOTE, "handle_drv_ioctl: "
+		    "DRSAS_DRIVER_IOCTL_DRIVER_VERSION"));
+
+		fill_up_drv_ver(&dv);
+		for (i = 0; i < xferlen; i++) {
+			if (ddi_copyout((uint8_t *)&dv + i, (uint8_t *)ubuf + i,
+			    1, mode)) {
+				con_log(CL_ANN, (CE_WARN, "handle_drv_ioctl: "
+				    "DRSAS_DRIVER_IOCTL_DRIVER_VERSION"
+				    " : copy to user space failed"));
+				kdcmd->cmd_status = 1;
+				rval = DDI_FAILURE;
+				break;
+			}
+		}
+		if (i == xferlen)
+			kdcmd->cmd_status = 0;
+		break;
+	case DRSAS_DRIVER_IOCTL_PCI_INFORMATION:
+		con_log(CL_ANN1, (CE_NOTE, "handle_drv_ioctl: "
+		    "DRSAS_DRIVER_IOCTL_PCI_INFORMAITON"));
+
+		if (ddi_prop_lookup_int_array(DDI_DEV_T_ANY, instance->dip,
+		    0, "reg", &props, &num_props)) {
+			con_log(CL_ANN, (CE_WARN, "handle_drv_ioctl: "
+			    "DRSAS_DRIVER_IOCTL_PCI_INFORMATION : "
+			    "ddi_prop_look_int_array failed"));
+			rval = DDI_FAILURE;
+		} else {
+
+			pi.busNumber = (props[0] >> 16) & 0xFF;
+			pi.deviceNumber = (props[0] >> 11) & 0x1f;
+			pi.functionNumber = (props[0] >> 8) & 0x7;
+			ddi_prop_free((void *)props);
+		}
+
+		pci_conf_buf = (uint8_t *)&pi.pciHeaderInfo;
+
+		for (i = 0; i < (sizeof (struct drsas_pci_information) -
+		    offsetof(struct drsas_pci_information, pciHeaderInfo));
+		    i++) {
+			pci_conf_buf[i] =
+			    pci_config_get8(instance->pci_handle, i);
+		}
+		for (i = 0; i < xferlen; i++) {
+			if (ddi_copyout((uint8_t *)&pi + i, (uint8_t *)ubuf + i,
+			    1, mode)) {
+				con_log(CL_ANN, (CE_WARN, "handle_drv_ioctl: "
+				    "DRSAS_DRIVER_IOCTL_PCI_INFORMATION"
+				    " : copy to user space failed"));
+				kdcmd->cmd_status = 1;
+				rval = DDI_FAILURE;
+				break;
+			}
+		}
+
+		if (i == xferlen)
+			kdcmd->cmd_status = 0;
+
+		break;
+	default:
+		con_log(CL_ANN, (CE_WARN, "handle_drv_ioctl: "
+		    "invalid driver specific IOCTL opcode = 0x%x",
+		    kdcmd->opcode));
+		kdcmd->cmd_status = 1;
+		rval = DDI_FAILURE;
+		break;
+	}
+
+	return (rval);
+}
+
+/*
+ * handle_mfi_ioctl
+ */
+static int
+handle_mfi_ioctl(struct drsas_instance *instance, struct drsas_ioctl *ioctl,
+    int mode)
+{
+	int	rval = DDI_SUCCESS;
+
+	struct drsas_header	*hdr;
+	struct drsas_cmd	*cmd;
+
+	cmd = get_mfi_pkt(instance);
+
+	if (!cmd) {
+		con_log(CL_ANN, (CE_WARN, "dr_sas: "
+		    "failed to get a cmd packet"));
+		return (DDI_FAILURE);
+	}
+
+	/* Clear the frame buffer and assign back the context id */
+	(void) memset((char *)&cmd->frame[0], 0, sizeof (union drsas_frame));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &cmd->frame->hdr.context,
+	    cmd->index);
+
+	hdr = (struct drsas_header *)&ioctl->frame[0];
+
+	switch (hdr->cmd) {
+	case MFI_CMD_OP_DCMD:
+		rval = issue_mfi_dcmd(instance, ioctl, cmd, mode);
+		break;
+	case MFI_CMD_OP_SMP:
+		rval = issue_mfi_smp(instance, ioctl, cmd, mode);
+		break;
+	case MFI_CMD_OP_STP:
+		rval = issue_mfi_stp(instance, ioctl, cmd, mode);
+		break;
+	case MFI_CMD_OP_LD_SCSI:
+	case MFI_CMD_OP_PD_SCSI:
+		rval = issue_mfi_pthru(instance, ioctl, cmd, mode);
+		break;
+	default:
+		con_log(CL_ANN, (CE_WARN, "handle_mfi_ioctl: "
+		    "invalid mfi ioctl hdr->cmd = %d", hdr->cmd));
+		rval = DDI_FAILURE;
+		break;
+	}
+
+
+	return_mfi_pkt(instance, cmd);
+	if (drsas_common_check(instance, cmd) != DDI_SUCCESS)
+		rval = DDI_FAILURE;
+	return (rval);
+}
+
+/*
+ * AEN
+ */
+static int
+handle_mfi_aen(struct drsas_instance *instance, struct drsas_aen *aen)
+{
+	int	rval = 0;
+
+	rval = register_mfi_aen(instance, instance->aen_seq_num,
+	    aen->class_locale_word);
+
+	aen->cmd_status = (uint8_t)rval;
+
+	return (rval);
+}
+
+static int
+register_mfi_aen(struct drsas_instance *instance, uint32_t seq_num,
+    uint32_t class_locale_word)
+{
+	int	ret_val;
+
+	struct drsas_cmd	*cmd, *aen_cmd;
+	struct drsas_dcmd_frame	*dcmd;
+	union drsas_evt_class_locale	curr_aen;
+	union drsas_evt_class_locale	prev_aen;
+
+	/*
+	 * If there an AEN pending already (aen_cmd), check if the
+	 * class_locale of that pending AEN is inclusive of the new
+	 * AEN request we currently have. If it is, then we don't have
+	 * to do anything. In other words, whichever events the current
+	 * AEN request is subscribing to, have already been subscribed
+	 * to.
+	 *
+	 * If the old_cmd is _not_ inclusive, then we have to abort
+	 * that command, form a class_locale that is superset of both
+	 * old and current and re-issue to the FW
+	 */
+
+	curr_aen.word = class_locale_word;
+	aen_cmd = instance->aen_cmd;
+	if (aen_cmd) {
+		prev_aen.word = ddi_get32(aen_cmd->frame_dma_obj.acc_handle,
+		    &aen_cmd->frame->dcmd.mbox.w[1]);
+
+		/*
+		 * A class whose enum value is smaller is inclusive of all
+		 * higher values. If a PROGRESS (= -1) was previously
+		 * registered, then a new registration requests for higher
+		 * classes need not be sent to FW. They are automatically
+		 * included.
+		 *
+		 * Locale numbers don't have such hierarchy. They are bitmap
+		 * values
+		 */
+		if ((prev_aen.members.class <= curr_aen.members.class) &&
+		    !((prev_aen.members.locale & curr_aen.members.locale) ^
+		    curr_aen.members.locale)) {
+			/*
+			 * Previously issued event registration includes
+			 * current request. Nothing to do.
+			 */
+
+			return (0);
+		} else {
+			curr_aen.members.locale |= prev_aen.members.locale;
+
+			if (prev_aen.members.class < curr_aen.members.class)
+				curr_aen.members.class = prev_aen.members.class;
+
+			ret_val = abort_aen_cmd(instance, aen_cmd);
+
+			if (ret_val) {
+				con_log(CL_ANN, (CE_WARN, "register_mfi_aen: "
+				    "failed to abort prevous AEN command"));
+
+				return (ret_val);
+			}
+		}
+	} else {
+		curr_aen.word = class_locale_word;
+	}
+
+	cmd = get_mfi_pkt(instance);
+
+	if (!cmd)
+		return (ENOMEM);
+	/* Clear the frame buffer and assign back the context id */
+	(void) memset((char *)&cmd->frame[0], 0, sizeof (union drsas_frame));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &cmd->frame->hdr.context,
+	    cmd->index);
+
+	dcmd = &cmd->frame->dcmd;
+
+	/* for(i = 0; i < DCMD_MBOX_SZ; i++) dcmd->mbox.b[i] = 0; */
+	(void) memset(dcmd->mbox.b, 0, DCMD_MBOX_SZ);
+
+	(void) memset(instance->mfi_evt_detail_obj.buffer, 0,
+	    sizeof (struct drsas_evt_detail));
+
+	/* Prepare DCMD for aen registration */
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd, MFI_CMD_OP_DCMD);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->cmd_status, 0x0);
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &dcmd->sge_count, 1);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->flags,
+	    MFI_FRAME_DIR_READ);
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &dcmd->timeout, 0);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->data_xfer_len,
+	    sizeof (struct drsas_evt_detail));
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->opcode,
+	    DR_DCMD_CTRL_EVENT_WAIT);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->mbox.w[0], seq_num);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->mbox.w[1],
+	    curr_aen.word);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->sgl.sge32[0].phys_addr,
+	    instance->mfi_evt_detail_obj.dma_cookie[0].dmac_address);
+	ddi_put32(cmd->frame_dma_obj.acc_handle, &dcmd->sgl.sge32[0].length,
+	    sizeof (struct drsas_evt_detail));
+
+	instance->aen_seq_num = seq_num;
+
+
+	/*
+	 * Store reference to the cmd used to register for AEN. When an
+	 * application wants us to register for AEN, we have to abort this
+	 * cmd and re-register with a new EVENT LOCALE supplied by that app
+	 */
+	instance->aen_cmd = cmd;
+
+	cmd->frame_count = 1;
+
+	/* Issue the aen registration frame */
+	/* atomic_add_16 (&instance->fw_outstanding, 1); */
+	instance->func_ptr->issue_cmd(cmd, instance);
+
+	return (0);
+}
+
+static void
+display_scsi_inquiry(caddr_t scsi_inq)
+{
+#define	MAX_SCSI_DEVICE_CODE	14
+	int		i;
+	char		inquiry_buf[256] = {0};
+	int		len;
+	const char	*const scsi_device_types[] = {
+		"Direct-Access    ",
+		"Sequential-Access",
+		"Printer          ",
+		"Processor        ",
+		"WORM             ",
+		"CD-ROM           ",
+		"Scanner          ",
+		"Optical Device   ",
+		"Medium Changer   ",
+		"Communications   ",
+		"Unknown          ",
+		"Unknown          ",
+		"Unknown          ",
+		"Enclosure        ",
+	};
+
+	len = 0;
+
+	len += snprintf(inquiry_buf + len, 265 - len, "  Vendor: ");
+	for (i = 8; i < 16; i++) {
+		len += snprintf(inquiry_buf + len, 265 - len, "%c",
+		    scsi_inq[i]);
+	}
+
+	len += snprintf(inquiry_buf + len, 265 - len, "  Model: ");
+
+	for (i = 16; i < 32; i++) {
+		len += snprintf(inquiry_buf + len, 265 - len, "%c",
+		    scsi_inq[i]);
+	}
+
+	len += snprintf(inquiry_buf + len, 265 - len, "  Rev: ");
+
+	for (i = 32; i < 36; i++) {
+		len += snprintf(inquiry_buf + len, 265 - len, "%c",
+		    scsi_inq[i]);
+	}
+
+	len += snprintf(inquiry_buf + len, 265 - len, "\n");
+
+
+	i = scsi_inq[0] & 0x1f;
+
+
+	len += snprintf(inquiry_buf + len, 265 - len, "  Type:   %s ",
+	    i < MAX_SCSI_DEVICE_CODE ? scsi_device_types[i] :
+	    "Unknown          ");
+
+
+	len += snprintf(inquiry_buf + len, 265 - len,
+	    "                 ANSI SCSI revision: %02x", scsi_inq[2] & 0x07);
+
+	if ((scsi_inq[2] & 0x07) == 1 && (scsi_inq[3] & 0x0f) == 1) {
+		len += snprintf(inquiry_buf + len, 265 - len, " CCS\n");
+	} else {
+		len += snprintf(inquiry_buf + len, 265 - len, "\n");
+	}
+
+	con_log(CL_ANN1, (CE_CONT, inquiry_buf));
+}
+
+static int
+read_fw_status_reg_ppc(struct drsas_instance *instance)
+{
+	return ((int)RD_OB_SCRATCH_PAD_0(instance));
+}
+
+static void
+issue_cmd_ppc(struct drsas_cmd *cmd, struct drsas_instance *instance)
+{
+	atomic_add_16(&instance->fw_outstanding, 1);
+
+	/* Issue the command to the FW */
+	WR_IB_QPORT((cmd->frame_phys_addr) |
+	    (((cmd->frame_count - 1) << 1) | 1), instance);
+}
+
+/*
+ * issue_cmd_in_sync_mode
+ */
+static int
+issue_cmd_in_sync_mode_ppc(struct drsas_instance *instance,
+    struct drsas_cmd *cmd)
+{
+	int		i;
+	uint32_t	msecs = MFI_POLL_TIMEOUT_SECS * (10 * MILLISEC);
+
+	con_log(CL_ANN1, (CE_NOTE, "issue_cmd_in_sync_mode_ppc: called"));
+
+	cmd->cmd_status	= ENODATA;
+
+	WR_IB_QPORT((cmd->frame_phys_addr) |
+	    (((cmd->frame_count - 1) << 1) | 1), instance);
+
+	mutex_enter(&instance->int_cmd_mtx);
+
+	for (i = 0; i < msecs && (cmd->cmd_status == ENODATA); i++) {
+		cv_wait(&instance->int_cmd_cv, &instance->int_cmd_mtx);
+	}
+
+	mutex_exit(&instance->int_cmd_mtx);
+
+	con_log(CL_ANN1, (CE_NOTE, "issue_cmd_in_sync_mode_ppc: done"));
+
+	if (i < (msecs -1)) {
+		return (DDI_SUCCESS);
+	} else {
+		return (DDI_FAILURE);
+	}
+}
+
+/*
+ * issue_cmd_in_poll_mode
+ */
+static int
+issue_cmd_in_poll_mode_ppc(struct drsas_instance *instance,
+    struct drsas_cmd *cmd)
+{
+	int		i;
+	uint16_t	flags;
+	uint32_t	msecs = MFI_POLL_TIMEOUT_SECS * MILLISEC;
+	struct drsas_header *frame_hdr;
+
+	con_log(CL_ANN1, (CE_NOTE, "issue_cmd_in_poll_mode_ppc: called"));
+
+	frame_hdr = (struct drsas_header *)cmd->frame;
+	ddi_put8(cmd->frame_dma_obj.acc_handle, &frame_hdr->cmd_status,
+	    MFI_CMD_STATUS_POLL_MODE);
+	flags = ddi_get16(cmd->frame_dma_obj.acc_handle, &frame_hdr->flags);
+	flags 	|= MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
+
+	ddi_put16(cmd->frame_dma_obj.acc_handle, &frame_hdr->flags, flags);
+
+	/* issue the frame using inbound queue port */
+	WR_IB_QPORT((cmd->frame_phys_addr) |
+	    (((cmd->frame_count - 1) << 1) | 1), instance);
+
+	/* wait for cmd_status to change from 0xFF */
+	for (i = 0; i < msecs && (
+	    ddi_get8(cmd->frame_dma_obj.acc_handle, &frame_hdr->cmd_status)
+	    == MFI_CMD_STATUS_POLL_MODE); i++) {
+		drv_usecwait(MILLISEC); /* wait for 1000 usecs */
+	}
+
+	if (ddi_get8(cmd->frame_dma_obj.acc_handle, &frame_hdr->cmd_status)
+	    == MFI_CMD_STATUS_POLL_MODE) {
+		con_log(CL_ANN, (CE_NOTE, "issue_cmd_in_poll_mode: "
+		    "cmd polling timed out"));
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+static void
+enable_intr_ppc(struct drsas_instance *instance)
+{
+	uint32_t	mask;
+
+	con_log(CL_ANN1, (CE_NOTE, "enable_intr_ppc: called"));
+
+	/* WR_OB_DOORBELL_CLEAR(0xFFFFFFFF, instance); */
+	WR_OB_DOORBELL_CLEAR(OB_DOORBELL_CLEAR_MASK, instance);
+
+	/* WR_OB_INTR_MASK(~0x80000000, instance); */
+	WR_OB_INTR_MASK(~(MFI_REPLY_2108_MESSAGE_INTR_MASK), instance);
+
+	/* dummy read to force PCI flush */
+	mask = RD_OB_INTR_MASK(instance);
+
+	con_log(CL_ANN1, (CE_NOTE, "enable_intr_ppc: "
+	    "outbound_intr_mask = 0x%x", mask));
+}
+
+static void
+disable_intr_ppc(struct drsas_instance *instance)
+{
+	uint32_t	mask;
+
+	con_log(CL_ANN1, (CE_NOTE, "disable_intr_ppc: called"));
+
+	con_log(CL_ANN1, (CE_NOTE, "disable_intr_ppc: before : "
+	    "outbound_intr_mask = 0x%x", RD_OB_INTR_MASK(instance)));
+
+	/* WR_OB_INTR_MASK(0xFFFFFFFF, instance); */
+	WR_OB_INTR_MASK(OB_INTR_MASK, instance);
+
+	con_log(CL_ANN1, (CE_NOTE, "disable_intr_ppc: after : "
+	    "outbound_intr_mask = 0x%x", RD_OB_INTR_MASK(instance)));
+
+	/* dummy read to force PCI flush */
+	mask = RD_OB_INTR_MASK(instance);
+#ifdef lint
+	mask = mask;
+#endif
+}
+
+static int
+intr_ack_ppc(struct drsas_instance *instance)
+{
+	uint32_t	status;
+
+	con_log(CL_ANN1, (CE_NOTE, "intr_ack_ppc: called"));
+
+	/* check if it is our interrupt */
+	status = RD_OB_INTR_STATUS(instance);
+
+	con_log(CL_ANN1, (CE_NOTE, "intr_ack_ppc: status = 0x%x", status));
+
+	if (!(status & MFI_REPLY_2108_MESSAGE_INTR)) {
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	/* clear the interrupt by writing back the same value */
+	WR_OB_DOORBELL_CLEAR(status, instance);
+
+	/* dummy READ */
+	status = RD_OB_INTR_STATUS(instance);
+
+	con_log(CL_ANN1, (CE_NOTE, "intr_ack_ppc: interrupt cleared"));
+
+	return (DDI_INTR_CLAIMED);
+}
+
+static int
+drsas_common_check(struct drsas_instance *instance,
+    struct  drsas_cmd *cmd)
+{
+	int ret = DDI_SUCCESS;
+
+	if (drsas_check_dma_handle(cmd->frame_dma_obj.dma_handle) !=
+	    DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_UNAFFECTED);
+		if (cmd->pkt != NULL) {
+			cmd->pkt->pkt_reason = CMD_TRAN_ERR;
+			cmd->pkt->pkt_statistics = 0;
+		}
+		ret = DDI_FAILURE;
+	}
+	if (drsas_check_dma_handle(instance->mfi_internal_dma_obj.dma_handle)
+	    != DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_UNAFFECTED);
+		if (cmd->pkt != NULL) {
+			cmd->pkt->pkt_reason = CMD_TRAN_ERR;
+			cmd->pkt->pkt_statistics = 0;
+		}
+		ret = DDI_FAILURE;
+	}
+	if (drsas_check_dma_handle(instance->mfi_evt_detail_obj.dma_handle) !=
+	    DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_UNAFFECTED);
+		if (cmd->pkt != NULL) {
+			cmd->pkt->pkt_reason = CMD_TRAN_ERR;
+			cmd->pkt->pkt_statistics = 0;
+		}
+		ret = DDI_FAILURE;
+	}
+	if (drsas_check_acc_handle(instance->regmap_handle) != DDI_SUCCESS) {
+		ddi_fm_service_impact(instance->dip, DDI_SERVICE_UNAFFECTED);
+
+		ddi_fm_acc_err_clear(instance->regmap_handle, DDI_FME_VER0);
+
+		if (cmd->pkt != NULL) {
+			cmd->pkt->pkt_reason = CMD_TRAN_ERR;
+			cmd->pkt->pkt_statistics = 0;
+		}
+		ret = DDI_FAILURE;
+	}
+
+	return (ret);
+}
+
+/*ARGSUSED*/
+static int
+drsas_fm_error_cb(dev_info_t *dip, ddi_fm_error_t *err, const void *impl_data)
+{
+	/*
+	 * as the driver can always deal with an error in any dma or
+	 * access handle, we can just return the fme_status value.
+	 */
+	pci_ereport_post(dip, err, NULL);
+	return (err->fme_status);
+}
+
+static void
+drsas_fm_init(struct drsas_instance *instance)
+{
+	/* Need to change iblock to priority for new MSI intr */
+	ddi_iblock_cookie_t fm_ibc;
+
+	/* Only register with IO Fault Services if we have some capability */
+	if (instance->fm_capabilities) {
+		/* Adjust access and dma attributes for FMA */
+		endian_attr.devacc_attr_access = DDI_FLAGERR_ACC;
+		drsas_generic_dma_attr.dma_attr_flags = DDI_DMA_FLAGERR;
+
+		/*
+		 * Register capabilities with IO Fault Services.
+		 * fm_capabilities will be updated to indicate
+		 * capabilities actually supported (not requested.)
+		 */
+
+		ddi_fm_init(instance->dip, &instance->fm_capabilities, &fm_ibc);
+
+		/*
+		 * Initialize pci ereport capabilities if ereport
+		 * capable (should always be.)
+		 */
+
+		if (DDI_FM_EREPORT_CAP(instance->fm_capabilities) ||
+		    DDI_FM_ERRCB_CAP(instance->fm_capabilities)) {
+			pci_ereport_setup(instance->dip);
+		}
+
+		/*
+		 * Register error callback if error callback capable.
+		 */
+		if (DDI_FM_ERRCB_CAP(instance->fm_capabilities)) {
+			ddi_fm_handler_register(instance->dip,
+			    drsas_fm_error_cb, (void*) instance);
+		}
+	} else {
+		endian_attr.devacc_attr_access = DDI_DEFAULT_ACC;
+		drsas_generic_dma_attr.dma_attr_flags = 0;
+	}
+}
+
+static void
+drsas_fm_fini(struct drsas_instance *instance)
+{
+	/* Only unregister FMA capabilities if registered */
+	if (instance->fm_capabilities) {
+		/*
+		 * Un-register error callback if error callback capable.
+		 */
+		if (DDI_FM_ERRCB_CAP(instance->fm_capabilities)) {
+			ddi_fm_handler_unregister(instance->dip);
+		}
+
+		/*
+		 * Release any resources allocated by pci_ereport_setup()
+		 */
+		if (DDI_FM_EREPORT_CAP(instance->fm_capabilities) ||
+		    DDI_FM_ERRCB_CAP(instance->fm_capabilities)) {
+			pci_ereport_teardown(instance->dip);
+		}
+
+		/* Unregister from IO Fault Services */
+		ddi_fm_fini(instance->dip);
+
+		/* Adjust access and dma attributes for FMA */
+		endian_attr.devacc_attr_access = DDI_DEFAULT_ACC;
+		drsas_generic_dma_attr.dma_attr_flags = 0;
+	}
+}
+
+int
+drsas_check_acc_handle(ddi_acc_handle_t handle)
+{
+	ddi_fm_error_t de;
+
+	if (handle == NULL) {
+		return (DDI_FAILURE);
+	}
+
+	ddi_fm_acc_err_get(handle, &de, DDI_FME_VERSION);
+
+	return (de.fme_status);
+}
+
+int
+drsas_check_dma_handle(ddi_dma_handle_t handle)
+{
+	ddi_fm_error_t de;
+
+	if (handle == NULL) {
+		return (DDI_FAILURE);
+	}
+
+	ddi_fm_dma_err_get(handle, &de, DDI_FME_VERSION);
+
+	return (de.fme_status);
+}
+
+void
+drsas_fm_ereport(struct drsas_instance *instance, char *detail)
+{
+	uint64_t ena;
+	char buf[FM_MAX_CLASS];
+
+	(void) snprintf(buf, FM_MAX_CLASS, "%s.%s", DDI_FM_DEVICE, detail);
+	ena = fm_ena_generate(0, FM_ENA_FMT1);
+	if (DDI_FM_EREPORT_CAP(instance->fm_capabilities)) {
+		ddi_fm_ereport_post(instance->dip, buf, ena, DDI_NOSLEEP,
+		    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERSION, NULL);
+	}
+}
+
+static int
+drsas_add_intrs(struct drsas_instance *instance, int intr_type)
+{
+
+	dev_info_t *dip = instance->dip;
+	int	avail, actual, count;
+	int	i, flag, ret;
+
+	con_log(CL_DLEVEL1, (CE_WARN, "drsas_add_intrs: intr_type = %x",
+	    intr_type));
+
+	/* Get number of interrupts */
+	ret = ddi_intr_get_nintrs(dip, intr_type, &count);
+	if ((ret != DDI_SUCCESS) || (count == 0)) {
+		con_log(CL_ANN, (CE_WARN, "ddi_intr_get_nintrs() failed:"
+		    "ret %d count %d", ret, count));
+
+		return (DDI_FAILURE);
+	}
+
+	con_log(CL_DLEVEL1, (CE_WARN, "drsas_add_intrs: count = %d ", count));
+
+	/* Get number of available interrupts */
+	ret = ddi_intr_get_navail(dip, intr_type, &avail);
+	if ((ret != DDI_SUCCESS) || (avail == 0)) {
+		con_log(CL_ANN, (CE_WARN, "ddi_intr_get_navail() failed:"
+		    "ret %d avail %d", ret, avail));
+
+		return (DDI_FAILURE);
+	}
+	con_log(CL_DLEVEL1, (CE_WARN, "drsas_add_intrs: avail = %d ", avail));
+
+	/* Only one interrupt routine. So limit the count to 1 */
+	if (count > 1) {
+		count = 1;
+	}
+
+	/*
+	 * Allocate an array of interrupt handlers. Currently we support
+	 * only one interrupt. The framework can be extended later.
+	 */
+	instance->intr_size = count * sizeof (ddi_intr_handle_t);
+	instance->intr_htable = kmem_zalloc(instance->intr_size, KM_SLEEP);
+	ASSERT(instance->intr_htable);
+
+	flag = ((intr_type == DDI_INTR_TYPE_MSI) || (intr_type ==
+	    DDI_INTR_TYPE_MSIX)) ? DDI_INTR_ALLOC_STRICT:DDI_INTR_ALLOC_NORMAL;
+
+	/* Allocate interrupt */
+	ret = ddi_intr_alloc(dip, instance->intr_htable, intr_type, 0,
+	    count, &actual, flag);
+
+	if ((ret != DDI_SUCCESS) || (actual == 0)) {
+		con_log(CL_ANN, (CE_WARN, "drsas_add_intrs: "
+		    "avail = %d", avail));
+		kmem_free(instance->intr_htable, instance->intr_size);
+		return (DDI_FAILURE);
+	}
+	if (actual < count) {
+		con_log(CL_ANN, (CE_WARN, "drsas_add_intrs: "
+		    "Requested = %d  Received = %d", count, actual));
+	}
+	instance->intr_cnt = actual;
+
+	/*
+	 * Get the priority of the interrupt allocated.
+	 */
+	if ((ret = ddi_intr_get_pri(instance->intr_htable[0],
+	    &instance->intr_pri)) != DDI_SUCCESS) {
+		con_log(CL_ANN, (CE_WARN, "drsas_add_intrs: "
+		    "get priority call failed"));
+
+		for (i = 0; i < actual; i++) {
+			(void) ddi_intr_free(instance->intr_htable[i]);
+		}
+		kmem_free(instance->intr_htable, instance->intr_size);
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Test for high level mutex. we don't support them.
+	 */
+	if (instance->intr_pri >= ddi_intr_get_hilevel_pri()) {
+		con_log(CL_ANN, (CE_WARN, "drsas_add_intrs: "
+		    "High level interrupts not supported."));
+
+		for (i = 0; i < actual; i++) {
+			(void) ddi_intr_free(instance->intr_htable[i]);
+		}
+		kmem_free(instance->intr_htable, instance->intr_size);
+		return (DDI_FAILURE);
+	}
+
+	con_log(CL_DLEVEL1, (CE_NOTE, "drsas_add_intrs: intr_pri = 0x%x ",
+	    instance->intr_pri));
+
+	/* Call ddi_intr_add_handler() */
+	for (i = 0; i < actual; i++) {
+		ret = ddi_intr_add_handler(instance->intr_htable[i],
+		    (ddi_intr_handler_t *)drsas_isr, (caddr_t)instance,
+		    (caddr_t)(uintptr_t)i);
+
+		if (ret != DDI_SUCCESS) {
+			con_log(CL_ANN, (CE_WARN, "drsas_add_intrs:"
+			    "failed %d", ret));
+
+			for (i = 0; i < actual; i++) {
+				(void) ddi_intr_free(instance->intr_htable[i]);
+			}
+			kmem_free(instance->intr_htable, instance->intr_size);
+			return (DDI_FAILURE);
+		}
+
+	}
+
+	con_log(CL_DLEVEL1, (CE_WARN, " ddi_intr_add_handler done"));
+
+	if ((ret = ddi_intr_get_cap(instance->intr_htable[0],
+	    &instance->intr_cap)) != DDI_SUCCESS) {
+		con_log(CL_ANN, (CE_WARN, "ddi_intr_get_cap() failed %d",
+		    ret));
+
+		/* Free already allocated intr */
+		for (i = 0; i < actual; i++) {
+			(void) ddi_intr_remove_handler(
+			    instance->intr_htable[i]);
+			(void) ddi_intr_free(instance->intr_htable[i]);
+		}
+		kmem_free(instance->intr_htable, instance->intr_size);
+		return (DDI_FAILURE);
+	}
+
+	if (instance->intr_cap &  DDI_INTR_FLAG_BLOCK) {
+		con_log(CL_ANN, (CE_WARN, "Calling ddi_intr_block _enable"));
+
+		(void) ddi_intr_block_enable(instance->intr_htable,
+		    instance->intr_cnt);
+	} else {
+		con_log(CL_ANN, (CE_NOTE, " calling ddi_intr_enable"));
+
+		for (i = 0; i < instance->intr_cnt; i++) {
+			(void) ddi_intr_enable(instance->intr_htable[i]);
+			con_log(CL_ANN, (CE_NOTE, "ddi intr enable returns "
+			    "%d", i));
+		}
+	}
+
+	return (DDI_SUCCESS);
+
+}
+
+
+static void
+drsas_rem_intrs(struct drsas_instance *instance)
+{
+	int i;
+
+	con_log(CL_ANN, (CE_NOTE, "drsas_rem_intrs called"));
+
+	/* Disable all interrupts first */
+	if (instance->intr_cap & DDI_INTR_FLAG_BLOCK) {
+		(void) ddi_intr_block_disable(instance->intr_htable,
+		    instance->intr_cnt);
+	} else {
+		for (i = 0; i < instance->intr_cnt; i++) {
+			(void) ddi_intr_disable(instance->intr_htable[i]);
+		}
+	}
+
+	/* Remove all the handlers */
+
+	for (i = 0; i < instance->intr_cnt; i++) {
+		(void) ddi_intr_remove_handler(instance->intr_htable[i]);
+		(void) ddi_intr_free(instance->intr_htable[i]);
+	}
+
+	kmem_free(instance->intr_htable, instance->intr_size);
+}
+
+static int
+drsas_tran_bus_config(dev_info_t *parent, uint_t flags,
+    ddi_bus_config_op_t op, void *arg, dev_info_t **childp)
+{
+	struct drsas_instance *instance;
+	int config;
+	int rval;
+
+	char *ptr = NULL;
+	int tgt, lun;
+
+	con_log(CL_ANN1, (CE_NOTE, "Bus config called for op = %x", op));
+
+	if ((instance = ddi_get_soft_state(drsas_state,
+	    ddi_get_instance(parent))) == NULL) {
+		return (NDI_FAILURE);
+	}
+
+	/* Hold nexus during bus_config */
+	ndi_devi_enter(parent, &config);
+	switch (op) {
+	case BUS_CONFIG_ONE: {
+
+		/* parse wwid/target name out of name given */
+		if ((ptr = strchr((char *)arg, '@')) == NULL) {
+			rval = NDI_FAILURE;
+			break;
+		}
+		ptr++;
+
+		if (drsas_parse_devname(arg, &tgt, &lun) != 0) {
+			rval = NDI_FAILURE;
+			break;
+		}
+
+		if (lun == 0) {
+			rval = drsas_config_ld(instance, tgt, lun, childp);
+		} else {
+			rval = NDI_FAILURE;
+		}
+
+		break;
+	}
+	case BUS_CONFIG_DRIVER:
+	case BUS_CONFIG_ALL: {
+
+		rval = drsas_config_all_devices(instance);
+
+		rval = NDI_SUCCESS;
+		break;
+	}
+	}
+
+	if (rval == NDI_SUCCESS) {
+		rval = ndi_busop_bus_config(parent, flags, op, arg, childp, 0);
+
+	}
+	ndi_devi_exit(parent, config);
+
+	con_log(CL_ANN1, (CE_NOTE, "drsas_tran_bus_config: rval = %x",
+	    rval));
+	return (rval);
+}
+
+static int
+drsas_config_all_devices(struct drsas_instance *instance)
+{
+	int rval, tgt;
+
+	for (tgt = 0; tgt < MRDRV_MAX_LD; tgt++) {
+		(void) drsas_config_ld(instance, tgt, 0, NULL);
+
+	}
+
+	rval = NDI_SUCCESS;
+	return (rval);
+}
+
+static int
+drsas_parse_devname(char *devnm, int *tgt, int *lun)
+{
+	char devbuf[SCSI_MAXNAMELEN];
+	char *addr;
+	char *p,  *tp, *lp;
+	long num;
+
+	/* Parse dev name and address */
+	(void) strcpy(devbuf, devnm);
+	addr = "";
+	for (p = devbuf; *p != '\0'; p++) {
+		if (*p == '@') {
+			addr = p + 1;
+			*p = '\0';
+		} else if (*p == ':') {
+			*p = '\0';
+			break;
+		}
+	}
+
+	/* Parse target and lun */
+	for (p = tp = addr, lp = NULL; *p != '\0'; p++) {
+		if (*p == ',') {
+			lp = p + 1;
+			*p = '\0';
+			break;
+		}
+	}
+	if (tgt && tp) {
+		if (ddi_strtol(tp, NULL, 0x10, &num)) {
+			return (DDI_FAILURE); /* Can declare this as constant */
+		}
+			*tgt = (int)num;
+	}
+	if (lun && lp) {
+		if (ddi_strtol(lp, NULL, 0x10, &num)) {
+			return (DDI_FAILURE);
+		}
+			*lun = (int)num;
+	}
+	return (DDI_SUCCESS);  /* Success case */
+}
+
+static int
+drsas_config_ld(struct drsas_instance *instance, uint16_t tgt,
+    uint8_t lun, dev_info_t **ldip)
+{
+	struct scsi_device *sd;
+	dev_info_t *child;
+	int rval;
+
+	con_log(CL_ANN1, (CE_NOTE, "drsas_config_ld: t = %d l = %d",
+	    tgt, lun));
+
+	if ((child = drsas_find_child(instance, tgt, lun)) != NULL) {
+		if (ldip) {
+			*ldip = child;
+		}
+		con_log(CL_ANN1, (CE_NOTE,
+		    "drsas_config_ld: Child = %p found t = %d l = %d",
+		    (void *)child, tgt, lun));
+		return (NDI_SUCCESS);
+	}
+
+	sd = kmem_zalloc(sizeof (struct scsi_device), KM_SLEEP);
+	sd->sd_address.a_hba_tran = instance->tran;
+	sd->sd_address.a_target = (uint16_t)tgt;
+	sd->sd_address.a_lun = (uint8_t)lun;
+
+	if (scsi_hba_probe(sd, NULL) == SCSIPROBE_EXISTS)
+		rval = drsas_config_scsi_device(instance, sd, ldip);
+	else
+		rval = NDI_FAILURE;
+
+	/* sd_unprobe is blank now. Free buffer manually */
+	if (sd->sd_inq) {
+		kmem_free(sd->sd_inq, SUN_INQSIZE);
+		sd->sd_inq = (struct scsi_inquiry *)NULL;
+	}
+
+	kmem_free(sd, sizeof (struct scsi_device));
+	con_log(CL_ANN1, (CE_NOTE, "drsas_config_ld: return rval = %d",
+	    rval));
+	return (rval);
+}
+
+static int
+drsas_config_scsi_device(struct drsas_instance *instance,
+    struct scsi_device *sd, dev_info_t **dipp)
+{
+	char *nodename = NULL;
+	char **compatible = NULL;
+	int ncompatible = 0;
+	char *childname;
+	dev_info_t *ldip = NULL;
+	int tgt = sd->sd_address.a_target;
+	int lun = sd->sd_address.a_lun;
+	int dtype = sd->sd_inq->inq_dtype & DTYPE_MASK;
+	int rval;
+
+	con_log(CL_ANN1, (CE_WARN, "dr_sas: scsi_device t%dL%d", tgt, lun));
+	scsi_hba_nodename_compatible_get(sd->sd_inq, NULL, dtype,
+	    NULL, &nodename, &compatible, &ncompatible);
+
+	if (nodename == NULL) {
+		con_log(CL_ANN1, (CE_WARN, "dr_sas: Found no compatible driver "
+		    "for t%dL%d", tgt, lun));
+		rval = NDI_FAILURE;
+		goto finish;
+	}
+
+	childname = (dtype == DTYPE_DIRECT) ? "sd" : nodename;
+	con_log(CL_ANN1, (CE_WARN,
+	    "dr_sas: Childname = %2s nodename = %s", childname, nodename));
+
+	/* Create a dev node */
+	rval = ndi_devi_alloc(instance->dip, childname, DEVI_SID_NODEID, &ldip);
+	con_log(CL_ANN1, (CE_WARN,
+	    "dr_sas_config_scsi_device: ndi_devi_alloc rval = %x", rval));
+	if (rval == NDI_SUCCESS) {
+		if (ndi_prop_update_int(DDI_DEV_T_NONE, ldip, "target", tgt) !=
+		    DDI_PROP_SUCCESS) {
+			con_log(CL_ANN1, (CE_WARN, "dr_sas: unable to create "
+			    "property for t%dl%d target", tgt, lun));
+			rval = NDI_FAILURE;
+			goto finish;
+		}
+		if (ndi_prop_update_int(DDI_DEV_T_NONE, ldip, "lun", lun) !=
+		    DDI_PROP_SUCCESS) {
+			con_log(CL_ANN1, (CE_WARN, "dr_sas: unable to create "
+			    "property for t%dl%d lun", tgt, lun));
+			rval = NDI_FAILURE;
+			goto finish;
+		}
+
+		if (ndi_prop_update_string_array(DDI_DEV_T_NONE, ldip,
+		    "compatible", compatible, ncompatible) !=
+		    DDI_PROP_SUCCESS) {
+			con_log(CL_ANN1, (CE_WARN, "dr_sas: unable to create "
+			    "property for t%dl%d compatible", tgt, lun));
+			rval = NDI_FAILURE;
+			goto finish;
+		}
+
+		rval = ndi_devi_online(ldip, NDI_ONLINE_ATTACH);
+		if (rval != NDI_SUCCESS) {
+			con_log(CL_ANN1, (CE_WARN, "dr_sas: unable to online "
+			    "t%dl%d", tgt, lun));
+			ndi_prop_remove_all(ldip);
+			(void) ndi_devi_free(ldip);
+		} else {
+			con_log(CL_ANN1, (CE_WARN, "dr_sas: online Done :"
+			    "0 t%dl%d", tgt, lun));
+		}
+
+	}
+finish:
+	if (dipp) {
+		*dipp = ldip;
+	}
+
+	con_log(CL_DLEVEL1, (CE_WARN,
+	    "dr_sas: config_scsi_device rval = %d t%dL%d",
+	    rval, tgt, lun));
+	scsi_hba_nodename_compatible_free(nodename, compatible);
+	return (rval);
+}
+
+/*ARGSUSED*/
+static int
+drsas_service_evt(struct drsas_instance *instance, int tgt, int lun, int event,
+    uint64_t wwn)
+{
+	struct drsas_eventinfo *mrevt = NULL;
+
+	con_log(CL_ANN1, (CE_NOTE,
+	    "drsas_service_evt called for t%dl%d event = %d",
+	    tgt, lun, event));
+
+	if ((instance->taskq == NULL) || (mrevt =
+	    kmem_zalloc(sizeof (struct drsas_eventinfo), KM_NOSLEEP)) == NULL) {
+		return (ENOMEM);
+	}
+
+	mrevt->instance = instance;
+	mrevt->tgt = tgt;
+	mrevt->lun = lun;
+	mrevt->event = event;
+
+	if ((ddi_taskq_dispatch(instance->taskq,
+	    (void (*)(void *))drsas_issue_evt_taskq, mrevt, DDI_NOSLEEP)) !=
+	    DDI_SUCCESS) {
+		con_log(CL_ANN1, (CE_NOTE,
+		    "dr_sas: Event task failed for t%dl%d event = %d",
+		    tgt, lun, event));
+		kmem_free(mrevt, sizeof (struct drsas_eventinfo));
+		return (DDI_FAILURE);
+	}
+	return (DDI_SUCCESS);
+}
+
+static void
+drsas_issue_evt_taskq(struct drsas_eventinfo *mrevt)
+{
+	struct drsas_instance *instance = mrevt->instance;
+	dev_info_t *dip, *pdip;
+	int circ1 = 0;
+	char *devname;
+
+	con_log(CL_ANN1, (CE_NOTE, "drsas_issue_evt_taskq: called for"
+	    " tgt %d lun %d event %d",
+	    mrevt->tgt, mrevt->lun, mrevt->event));
+
+	if (mrevt->tgt < MRDRV_MAX_LD && mrevt->lun == 0) {
+		dip = instance->dr_ld_list[mrevt->tgt].dip;
+	} else {
+		return;
+	}
+
+	ndi_devi_enter(instance->dip, &circ1);
+	switch (mrevt->event) {
+	case DRSAS_EVT_CONFIG_TGT:
+		if (dip == NULL) {
+
+			if (mrevt->lun == 0) {
+				(void) drsas_config_ld(instance, mrevt->tgt,
+				    0, NULL);
+			}
+			con_log(CL_ANN1, (CE_NOTE,
+			    "dr_sas: EVT_CONFIG_TGT called:"
+			    " for tgt %d lun %d event %d",
+			    mrevt->tgt, mrevt->lun, mrevt->event));
+
+		} else {
+			con_log(CL_ANN1, (CE_NOTE,
+			    "dr_sas: EVT_CONFIG_TGT dip != NULL:"
+			    " for tgt %d lun %d event %d",
+			    mrevt->tgt, mrevt->lun, mrevt->event));
+		}
+		break;
+	case DRSAS_EVT_UNCONFIG_TGT:
+		if (dip) {
+			if (i_ddi_devi_attached(dip)) {
+
+				pdip = ddi_get_parent(dip);
+
+				devname = kmem_zalloc(MAXNAMELEN + 1, KM_SLEEP);
+				(void) ddi_deviname(dip, devname);
+
+				(void) devfs_clean(pdip, devname + 1,
+				    DV_CLEAN_FORCE);
+				kmem_free(devname, MAXNAMELEN + 1);
+			}
+			(void) ndi_devi_offline(dip, NDI_DEVI_REMOVE);
+			con_log(CL_ANN1, (CE_NOTE,
+			    "dr_sas: EVT_UNCONFIG_TGT called:"
+			    " for tgt %d lun %d event %d",
+			    mrevt->tgt, mrevt->lun, mrevt->event));
+		} else {
+			con_log(CL_ANN1, (CE_NOTE,
+			    "dr_sas: EVT_UNCONFIG_TGT dip == NULL:"
+			    " for tgt %d lun %d event %d",
+			    mrevt->tgt, mrevt->lun, mrevt->event));
+		}
+		break;
+	}
+	kmem_free(mrevt, sizeof (struct drsas_eventinfo));
+	ndi_devi_exit(instance->dip, circ1);
+}
+
+static int
+drsas_mode_sense_build(struct scsi_pkt *pkt)
+{
+	union scsi_cdb		*cdbp;
+	uint16_t 		page_code;
+	struct scsa_cmd		*acmd;
+	struct buf		*bp;
+	struct mode_header	*modehdrp;
+
+	cdbp = (void *)pkt->pkt_cdbp;
+	page_code = cdbp->cdb_un.sg.scsi[0];
+	acmd = PKT2CMD(pkt);
+	bp = acmd->cmd_buf;
+	if ((!bp) && bp->b_un.b_addr && bp->b_bcount && acmd->cmd_dmacount) {
+		con_log(CL_ANN1, (CE_WARN, "Failing MODESENSE Command"));
+		/* ADD pkt statistics as Command failed. */
+		return (NULL);
+	}
+
+	bp_mapin(bp);
+	bzero(bp->b_un.b_addr, bp->b_bcount);
+
+	switch (page_code) {
+		case 0x3: {
+			struct mode_format *page3p = NULL;
+			modehdrp = (struct mode_header *)(bp->b_un.b_addr);
+			modehdrp->bdesc_length = MODE_BLK_DESC_LENGTH;
+
+			page3p = (void *)((caddr_t)modehdrp +
+			    MODE_HEADER_LENGTH + MODE_BLK_DESC_LENGTH);
+			page3p->mode_page.code = 0x3;
+			page3p->mode_page.length =
+			    (uchar_t)(sizeof (struct mode_format));
+			page3p->data_bytes_sect = 512;
+			page3p->sect_track = 63;
+			break;
+		}
+		case 0x4: {
+			struct mode_geometry *page4p = NULL;
+			modehdrp = (struct mode_header *)(bp->b_un.b_addr);
+			modehdrp->bdesc_length = MODE_BLK_DESC_LENGTH;
+
+			page4p = (void *)((caddr_t)modehdrp +
+			    MODE_HEADER_LENGTH + MODE_BLK_DESC_LENGTH);
+			page4p->mode_page.code = 0x4;
+			page4p->mode_page.length =
+			    (uchar_t)(sizeof (struct mode_geometry));
+			page4p->heads = 255;
+			page4p->rpm = 10000;
+			break;
+		}
+		default:
+			break;
+	}
+	return (NULL);
+}
diff --git a/usr/src/uts/common/io/dr_sas/dr_sas.conf b/usr/src/uts/common/io/dr_sas/dr_sas.conf
new file mode 100644
index 0000000000..3792f43ca4
--- /dev/null
+++ b/usr/src/uts/common/io/dr_sas/dr_sas.conf
@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2008-2009, LSI Logic Corporation.
+# All rights reserved.
+#
+# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+#
+# dr_sas.conf for sol 10 (and later) for all supported architectures
+#
+# global definitions
+
+# MSI specific flag. user can uncomment this line and set flag "yes" to enable MSI
+#drsas-enable-msi="yes";
diff --git a/usr/src/uts/common/io/dr_sas/dr_sas.h b/usr/src/uts/common/io/dr_sas/dr_sas.h
new file mode 100644
index 0000000000..8f78658edf
--- /dev/null
+++ b/usr/src/uts/common/io/dr_sas/dr_sas.h
@@ -0,0 +1,1766 @@
+/*
+ * dr_sas.h: header for dr_sas
+ *
+ * Solaris MegaRAID driver for SAS2.0 controllers
+ * Copyright (c) 2008-2009, LSI Logic Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the author nor the names of its contributors may be
+ *    used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef	_DR_SAS_H_
+#define	_DR_SAS_H_
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#include <sys/scsi/scsi.h>
+#include "dr_sas_list.h"
+
+/*
+ * MegaRAID SAS2.0 Driver meta data
+ */
+#define	DRSAS_VERSION				"LSIv2.0"
+#define	DRSAS_RELDATE				"Jan 9, 2009"
+
+#define	DRSAS_TRUE				1
+#define	DRSAS_FALSE				0
+
+/*
+ * MegaRAID SAS2.0 device id conversion definitions.
+ */
+#define	INST2LSIRDCTL(x)		((x) << INST_MINOR_SHIFT)
+
+/*
+ * MegaRAID SAS2.0 supported controllers
+ */
+#define	PCI_DEVICE_ID_LSI_2108VDE		0x0078
+#define	PCI_DEVICE_ID_LSI_2108V			0x0079
+
+/*
+ * Register Index for 2108 Controllers.
+ */
+#define	REGISTER_SET_IO_2108			(2)
+
+#define	DRSAS_MAX_SGE_CNT			0x50
+
+#define	DRSAS_IOCTL_DRIVER			0x12341234
+#define	DRSAS_IOCTL_FIRMWARE			0x12345678
+#define	DRSAS_IOCTL_AEN				0x87654321
+
+#define	DRSAS_1_SECOND				1000000
+
+/* Dynamic Enumeration Flags */
+#define	DRSAS_PD_LUN		1
+#define	DRSAS_LD_LUN		0
+#define	DRSAS_PD_TGT_MAX	255
+#define	DRSAS_GET_PD_MAX(s)	((s)->dr_pd_max)
+#define	WWN_STRLEN		17
+
+/*
+ * =====================================
+ * MegaRAID SAS2.0 MFI firmware definitions
+ * =====================================
+ */
+/*
+ * MFI stands for  MegaRAID SAS2.0 FW Interface. This is just a moniker for
+ * protocol between the software and firmware. Commands are issued using
+ * "message frames"
+ */
+
+/*
+ * FW posts its state in upper 4 bits of outbound_msg_0 register
+ */
+#define	MFI_STATE_SHIFT 			28
+#define	MFI_STATE_MASK				((uint32_t)0xF<<MFI_STATE_SHIFT)
+#define	MFI_STATE_UNDEFINED			((uint32_t)0x0<<MFI_STATE_SHIFT)
+#define	MFI_STATE_BB_INIT			((uint32_t)0x1<<MFI_STATE_SHIFT)
+#define	MFI_STATE_FW_INIT			((uint32_t)0x4<<MFI_STATE_SHIFT)
+#define	MFI_STATE_WAIT_HANDSHAKE		((uint32_t)0x6<<MFI_STATE_SHIFT)
+#define	MFI_STATE_FW_INIT_2			((uint32_t)0x7<<MFI_STATE_SHIFT)
+#define	MFI_STATE_DEVICE_SCAN			((uint32_t)0x8<<MFI_STATE_SHIFT)
+#define	MFI_STATE_BOOT_MESSAGE_PENDING		((uint32_t)0x9<<MFI_STATE_SHIFT)
+#define	MFI_STATE_FLUSH_CACHE			((uint32_t)0xA<<MFI_STATE_SHIFT)
+#define	MFI_STATE_READY				((uint32_t)0xB<<MFI_STATE_SHIFT)
+#define	MFI_STATE_OPERATIONAL			((uint32_t)0xC<<MFI_STATE_SHIFT)
+#define	MFI_STATE_FAULT				((uint32_t)0xF<<MFI_STATE_SHIFT)
+
+#define	MRMFI_FRAME_SIZE			64
+
+/*
+ * During FW init, clear pending cmds & reset state using inbound_msg_0
+ *
+ * ABORT	: Abort all pending cmds
+ * READY	: Move from OPERATIONAL to READY state; discard queue info
+ * MFIMODE	: Discard (possible) low MFA posted in 64-bit mode (??)
+ * CLR_HANDSHAKE: FW is waiting for HANDSHAKE from BIOS or Driver
+ */
+#define	MFI_INIT_ABORT				0x00000001
+#define	MFI_INIT_READY				0x00000002
+#define	MFI_INIT_MFIMODE			0x00000004
+#define	MFI_INIT_CLEAR_HANDSHAKE		0x00000008
+#define	MFI_INIT_HOTPLUG			0x00000010
+#define	MFI_STOP_ADP				0x00000020
+#define	MFI_RESET_FLAGS		MFI_INIT_READY|MFI_INIT_MFIMODE|MFI_INIT_ABORT
+
+/*
+ * MFI frame flags
+ */
+#define	MFI_FRAME_POST_IN_REPLY_QUEUE		0x0000
+#define	MFI_FRAME_DONT_POST_IN_REPLY_QUEUE	0x0001
+#define	MFI_FRAME_SGL32				0x0000
+#define	MFI_FRAME_SGL64				0x0002
+#define	MFI_FRAME_SENSE32			0x0000
+#define	MFI_FRAME_SENSE64			0x0004
+#define	MFI_FRAME_DIR_NONE			0x0000
+#define	MFI_FRAME_DIR_WRITE			0x0008
+#define	MFI_FRAME_DIR_READ			0x0010
+#define	MFI_FRAME_DIR_BOTH			0x0018
+
+/*
+ * Definition for cmd_status
+ */
+#define	MFI_CMD_STATUS_POLL_MODE		0xFF
+#define	MFI_CMD_STATUS_SYNC_MODE		0xFF
+
+/*
+ * MFI command opcodes
+ */
+#define	MFI_CMD_OP_INIT				0x00
+#define	MFI_CMD_OP_LD_READ			0x01
+#define	MFI_CMD_OP_LD_WRITE			0x02
+#define	MFI_CMD_OP_LD_SCSI			0x03
+#define	MFI_CMD_OP_PD_SCSI			0x04
+#define	MFI_CMD_OP_DCMD				0x05
+#define	MFI_CMD_OP_ABORT			0x06
+#define	MFI_CMD_OP_SMP				0x07
+#define	MFI_CMD_OP_STP				0x08
+
+#define	DR_DCMD_CTRL_GET_INFO			0x01010000
+
+#define	DR_DCMD_CTRL_CACHE_FLUSH		0x01101000
+#define	DR_FLUSH_CTRL_CACHE			0x01
+#define	DR_FLUSH_DISK_CACHE			0x02
+
+#define	DR_DCMD_CTRL_SHUTDOWN			0x01050000
+#define	DRSAS_ENABLE_DRIVE_SPINDOWN		0x01
+
+#define	DR_DCMD_CTRL_EVENT_GET_INFO		0x01040100
+#define	DR_DCMD_CTRL_EVENT_GET			0x01040300
+#define	DR_DCMD_CTRL_EVENT_WAIT			0x01040500
+#define	DR_DCMD_LD_GET_PROPERTIES		0x03030000
+#define	DR_DCMD_PD_GET_INFO			0x02020000
+
+/*
+ * Solaris Specific MAX values
+ */
+#define	MAX_SGL					24
+/*
+ * MFI command completion codes
+ */
+enum MFI_STAT {
+	MFI_STAT_OK				= 0x00,
+	MFI_STAT_INVALID_CMD			= 0x01,
+	MFI_STAT_INVALID_DCMD			= 0x02,
+	MFI_STAT_INVALID_PARAMETER		= 0x03,
+	MFI_STAT_INVALID_SEQUENCE_NUMBER	= 0x04,
+	MFI_STAT_ABORT_NOT_POSSIBLE		= 0x05,
+	MFI_STAT_APP_HOST_CODE_NOT_FOUND	= 0x06,
+	MFI_STAT_APP_IN_USE			= 0x07,
+	MFI_STAT_APP_NOT_INITIALIZED		= 0x08,
+	MFI_STAT_ARRAY_INDEX_INVALID		= 0x09,
+	MFI_STAT_ARRAY_ROW_NOT_EMPTY		= 0x0a,
+	MFI_STAT_CONFIG_RESOURCE_CONFLICT	= 0x0b,
+	MFI_STAT_DEVICE_NOT_FOUND		= 0x0c,
+	MFI_STAT_DRIVE_TOO_SMALL		= 0x0d,
+	MFI_STAT_FLASH_ALLOC_FAIL		= 0x0e,
+	MFI_STAT_FLASH_BUSY			= 0x0f,
+	MFI_STAT_FLASH_ERROR			= 0x10,
+	MFI_STAT_FLASH_IMAGE_BAD		= 0x11,
+	MFI_STAT_FLASH_IMAGE_INCOMPLETE		= 0x12,
+	MFI_STAT_FLASH_NOT_OPEN			= 0x13,
+	MFI_STAT_FLASH_NOT_STARTED		= 0x14,
+	MFI_STAT_FLUSH_FAILED			= 0x15,
+	MFI_STAT_HOST_CODE_NOT_FOUNT		= 0x16,
+	MFI_STAT_LD_CC_IN_PROGRESS		= 0x17,
+	MFI_STAT_LD_INIT_IN_PROGRESS		= 0x18,
+	MFI_STAT_LD_LBA_OUT_OF_RANGE		= 0x19,
+	MFI_STAT_LD_MAX_CONFIGURED		= 0x1a,
+	MFI_STAT_LD_NOT_OPTIMAL			= 0x1b,
+	MFI_STAT_LD_RBLD_IN_PROGRESS		= 0x1c,
+	MFI_STAT_LD_RECON_IN_PROGRESS		= 0x1d,
+	MFI_STAT_LD_WRONG_RAID_LEVEL		= 0x1e,
+	MFI_STAT_MAX_SPARES_EXCEEDED		= 0x1f,
+	MFI_STAT_MEMORY_NOT_AVAILABLE		= 0x20,
+	MFI_STAT_MFC_HW_ERROR			= 0x21,
+	MFI_STAT_NO_HW_PRESENT			= 0x22,
+	MFI_STAT_NOT_FOUND			= 0x23,
+	MFI_STAT_NOT_IN_ENCL			= 0x24,
+	MFI_STAT_PD_CLEAR_IN_PROGRESS		= 0x25,
+	MFI_STAT_PD_TYPE_WRONG			= 0x26,
+	MFI_STAT_PR_DISABLED			= 0x27,
+	MFI_STAT_ROW_INDEX_INVALID		= 0x28,
+	MFI_STAT_SAS_CONFIG_INVALID_ACTION	= 0x29,
+	MFI_STAT_SAS_CONFIG_INVALID_DATA	= 0x2a,
+	MFI_STAT_SAS_CONFIG_INVALID_PAGE	= 0x2b,
+	MFI_STAT_SAS_CONFIG_INVALID_TYPE	= 0x2c,
+	MFI_STAT_SCSI_DONE_WITH_ERROR		= 0x2d,
+	MFI_STAT_SCSI_IO_FAILED			= 0x2e,
+	MFI_STAT_SCSI_RESERVATION_CONFLICT	= 0x2f,
+	MFI_STAT_SHUTDOWN_FAILED		= 0x30,
+	MFI_STAT_TIME_NOT_SET			= 0x31,
+	MFI_STAT_WRONG_STATE			= 0x32,
+	MFI_STAT_LD_OFFLINE			= 0x33,
+	/* UNUSED: 0x34 to 0xfe */
+	MFI_STAT_INVALID_STATUS			= 0xFF
+};
+
+enum DR_EVT_CLASS {
+	DR_EVT_CLASS_DEBUG		= -2,
+	DR_EVT_CLASS_PROGRESS		= -1,
+	DR_EVT_CLASS_INFO		=  0,
+	DR_EVT_CLASS_WARNING		=  1,
+	DR_EVT_CLASS_CRITICAL		=  2,
+	DR_EVT_CLASS_FATAL		=  3,
+	DR_EVT_CLASS_DEAD		=  4
+};
+
+enum DR_EVT_LOCALE {
+	DR_EVT_LOCALE_LD		= 0x0001,
+	DR_EVT_LOCALE_PD		= 0x0002,
+	DR_EVT_LOCALE_ENCL		= 0x0004,
+	DR_EVT_LOCALE_BBU		= 0x0008,
+	DR_EVT_LOCALE_SAS		= 0x0010,
+	DR_EVT_LOCALE_CTRL		= 0x0020,
+	DR_EVT_LOCALE_CONFIG		= 0x0040,
+	DR_EVT_LOCALE_CLUSTER		= 0x0080,
+	DR_EVT_LOCALE_ALL		= 0xffff
+};
+
+#define	DR_EVT_CFG_CLEARED		0x0004
+#define	DR_EVT_LD_CREATED		0x008a
+#define	DR_EVT_LD_DELETED		0x008b
+#define	DR_EVT_PD_REMOVED_EXT		0x00f8
+#define	DR_EVT_PD_INSERTED_EXT		0x00f7
+
+enum LD_STATE {
+	LD_OFFLINE		= 0,
+	LD_PARTIALLY_DEGRADED	= 1,
+	LD_DEGRADED		= 2,
+	LD_OPTIMAL		= 3,
+	LD_INVALID		= 0xFF
+};
+
+enum DRSAS_EVT {
+	DRSAS_EVT_CONFIG_TGT	= 0,
+	DRSAS_EVT_UNCONFIG_TGT	= 1,
+	DRSAS_EVT_UNCONFIG_SMP	= 2
+};
+
+#define	DMA_OBJ_ALLOCATED	1
+#define	DMA_OBJ_REALLOCATED	2
+#define	DMA_OBJ_FREED		3
+
+/*
+ * dma_obj_t	- Our DMA object
+ * @param buffer	: kernel virtual address
+ * @param size		: size of the data to be allocated
+ * @param acc_handle	: access handle
+ * @param dma_handle	: dma handle
+ * @param dma_cookie	: scatter-gather list
+ * @param dma_attr	: dma attributes for this buffer
+ * Our DMA object. The caller must initialize the size and dma attributes
+ * (dma_attr) fields before allocating the resources.
+ */
+typedef struct {
+	caddr_t			buffer;
+	uint32_t		size;
+	ddi_acc_handle_t	acc_handle;
+	ddi_dma_handle_t	dma_handle;
+	ddi_dma_cookie_t	dma_cookie[DRSAS_MAX_SGE_CNT];
+	ddi_dma_attr_t		dma_attr;
+	uint8_t			status;
+	uint8_t			reserved[3];
+} dma_obj_t;
+
+struct drsas_eventinfo {
+	struct drsas_instance	*instance;
+	int 			tgt;
+	int 			lun;
+	int 			event;
+};
+
+struct drsas_ld {
+	dev_info_t		*dip;
+	uint8_t 		lun_type;
+	uint8_t 		reserved[3];
+};
+
+struct drsas_pd {
+	dev_info_t		*dip;
+	uint8_t 		lun_type;
+	uint8_t 		dev_id;
+	uint8_t 		flags;
+	uint8_t 		reserved;
+};
+
+struct drsas_pd_info {
+	uint16_t	deviceId;
+	uint16_t	seqNum;
+	uint8_t		inquiryData[96];
+	uint8_t		vpdPage83[64];
+	uint8_t		notSupported;
+	uint8_t		scsiDevType;
+	uint8_t		a;
+	uint8_t		device_speed;
+	uint32_t	mediaerrcnt;
+	uint32_t	other;
+	uint32_t	pred;
+	uint32_t	lastpred;
+	uint16_t	fwState;
+	uint8_t		disabled;
+	uint8_t		linkspwwd;
+	uint32_t	ddfType;
+	struct {
+		uint8_t	count;
+		uint8_t	isPathBroken;
+		uint8_t	connectorIndex[2];
+		uint8_t	reserved[4];
+		uint64_t sasAddr[2];
+		uint8_t	reserved2[16];
+	} pathInfo;
+};
+
+typedef struct drsas_instance {
+	uint32_t	*producer;
+	uint32_t	*consumer;
+
+	uint32_t	*reply_queue;
+	dma_obj_t	mfi_internal_dma_obj;
+
+	uint8_t		init_id;
+	uint8_t		reserved[3];
+
+	uint16_t	max_num_sge;
+	uint16_t	max_fw_cmds;
+	uint32_t	max_sectors_per_req;
+
+	struct drsas_cmd **cmd_list;
+
+	mlist_t		cmd_pool_list;
+	kmutex_t	cmd_pool_mtx;
+
+	mlist_t		cmd_pend_list;
+	kmutex_t	cmd_pend_mtx;
+
+	dma_obj_t	mfi_evt_detail_obj;
+	struct drsas_cmd *aen_cmd;
+
+	uint32_t	aen_seq_num;
+	uint32_t	aen_class_locale_word;
+
+	scsi_hba_tran_t		*tran;
+
+	kcondvar_t	int_cmd_cv;
+	kmutex_t	int_cmd_mtx;
+
+	kcondvar_t	aen_cmd_cv;
+	kmutex_t	aen_cmd_mtx;
+
+	kcondvar_t	abort_cmd_cv;
+	kmutex_t	abort_cmd_mtx;
+
+	dev_info_t		*dip;
+	ddi_acc_handle_t	pci_handle;
+
+	timeout_id_t	timeout_id;
+	uint32_t	unique_id;
+	uint16_t	fw_outstanding;
+	caddr_t		regmap;
+	ddi_acc_handle_t	regmap_handle;
+	uint8_t		isr_level;
+	ddi_iblock_cookie_t	iblock_cookie;
+	ddi_iblock_cookie_t	soft_iblock_cookie;
+	ddi_softintr_t		soft_intr_id;
+	uint8_t		softint_running;
+	kmutex_t	completed_pool_mtx;
+	mlist_t		completed_pool_list;
+
+	caddr_t		internal_buf;
+	uint32_t	internal_buf_dmac_add;
+	uint32_t	internal_buf_size;
+
+	uint16_t	vendor_id;
+	uint16_t	device_id;
+	uint16_t	subsysvid;
+	uint16_t	subsysid;
+	int		instance;
+	int		baseaddress;
+	char		iocnode[16];
+
+	int		fm_capabilities;
+
+	struct drsas_func_ptr *func_ptr;
+	/* MSI interrupts specific */
+	ddi_intr_handle_t *intr_htable;
+	int		intr_type;
+	int		intr_cnt;
+	size_t		intr_size;
+	uint_t		intr_pri;
+	int		intr_cap;
+
+	ddi_taskq_t	*taskq;
+	struct drsas_ld	*dr_ld_list;
+} drsas_t;
+
+struct drsas_func_ptr {
+	int (*read_fw_status_reg)(struct drsas_instance *);
+	void (*issue_cmd)(struct drsas_cmd *, struct drsas_instance *);
+	int (*issue_cmd_in_sync_mode)(struct drsas_instance *,
+	    struct drsas_cmd *);
+	int (*issue_cmd_in_poll_mode)(struct drsas_instance *,
+	    struct drsas_cmd *);
+	void (*enable_intr)(struct drsas_instance *);
+	void (*disable_intr)(struct drsas_instance *);
+	int (*intr_ack)(struct drsas_instance *);
+};
+
+/*
+ * ### Helper routines ###
+ */
+
+/*
+ * con_log() - console log routine
+ * @param level		: indicates the severity of the message.
+ * @fparam mt		: format string
+ *
+ * con_log displays the error messages on the console based on the current
+ * debug level. Also it attaches the appropriate kernel severity level with
+ * the message.
+ *
+ *
+ * console messages debug levels
+ */
+#define	CL_NONE		0	/* No debug information */
+#define	CL_ANN		1	/* print unconditionally, announcements */
+#define	CL_ANN1		2	/* No o/p  */
+#define	CL_DLEVEL1	3	/* debug level 1, informative */
+#define	CL_DLEVEL2	4	/* debug level 2, verbose */
+#define	CL_DLEVEL3	5	/* debug level 3, very verbose */
+
+#ifdef __SUNPRO_C
+#define	__func__ ""
+#endif
+
+#define	con_log(level, fmt) { if (debug_level_g >= level) cmn_err fmt; }
+
+/*
+ * ### SCSA definitions ###
+ */
+#define	PKT2TGT(pkt)	((pkt)->pkt_address.a_target)
+#define	PKT2LUN(pkt)	((pkt)->pkt_address.a_lun)
+#define	PKT2TRAN(pkt)	((pkt)->pkt_adress.a_hba_tran)
+#define	ADDR2TRAN(ap)	((ap)->a_hba_tran)
+
+#define	TRAN2MR(tran)	(struct drsas_instance *)(tran)->tran_hba_private)
+#define	ADDR2MR(ap)	(TRAN2MR(ADDR2TRAN(ap))
+
+#define	PKT2CMD(pkt)	((struct scsa_cmd *)(pkt)->pkt_ha_private)
+#define	CMD2PKT(sp)	((sp)->cmd_pkt)
+#define	PKT2REQ(pkt)	(&(PKT2CMD(pkt)->request))
+
+#define	CMD2ADDR(cmd)	(&CMD2PKT(cmd)->pkt_address)
+#define	CMD2TRAN(cmd)	(CMD2PKT(cmd)->pkt_address.a_hba_tran)
+#define	CMD2MR(cmd)	(TRAN2MR(CMD2TRAN(cmd)))
+
+#define	CFLAG_DMAVALID		0x0001	/* requires a dma operation */
+#define	CFLAG_DMASEND		0x0002	/* Transfer from the device */
+#define	CFLAG_CONSISTENT	0x0040	/* consistent data transfer */
+
+/*
+ * ### Data structures for ioctl inteface and internal commands ###
+ */
+
+/*
+ * Data direction flags
+ */
+#define	UIOC_RD		0x00001
+#define	UIOC_WR		0x00002
+
+#define	SCP2HOST(scp)		(scp)->device->host	/* to host */
+#define	SCP2HOSTDATA(scp)	SCP2HOST(scp)->hostdata	/* to soft state */
+#define	SCP2CHANNEL(scp)	(scp)->device->channel	/* to channel */
+#define	SCP2TARGET(scp)		(scp)->device->id	/* to target */
+#define	SCP2LUN(scp)		(scp)->device->lun	/* to LUN */
+
+#define	SCSIHOST2ADAP(host)	(((caddr_t *)(host->hostdata))[0])
+#define	SCP2ADAPTER(scp)				\
+	(struct drsas_instance *)SCSIHOST2ADAP(SCP2HOST(scp))
+
+#define	MRDRV_IS_LOGICAL_SCSA(instance, acmd)		\
+	(acmd->device_id < MRDRV_MAX_LD) ? 1 : 0
+#define	MRDRV_IS_LOGICAL(ap)				\
+	((ap->a_target < MRDRV_MAX_LD) && (ap->a_lun == 0)) ? 1 : 0
+#define	MAP_DEVICE_ID(instance, ap)			\
+	(ap->a_target)
+
+#define	HIGH_LEVEL_INTR			1
+#define	NORMAL_LEVEL_INTR		0
+
+/*
+ * scsa_cmd  - Per-command mr private data
+ * @param cmd_dmahandle		:  dma handle
+ * @param cmd_dmacookies	:  current dma cookies
+ * @param cmd_pkt		:  scsi_pkt reference
+ * @param cmd_dmacount		:  dma count
+ * @param cmd_cookie		:  next cookie
+ * @param cmd_ncookies		:  cookies per window
+ * @param cmd_cookiecnt		:  cookies per sub-win
+ * @param cmd_nwin		:  number of dma windows
+ * @param cmd_curwin		:  current dma window
+ * @param cmd_dma_offset	:  current window offset
+ * @param cmd_dma_len		:  current window length
+ * @param cmd_flags		:  private flags
+ * @param cmd_cdblen		:  length of cdb
+ * @param cmd_scblen		:  length of scb
+ * @param cmd_buf		:  command buffer
+ * @param channel		:  channel for scsi sub-system
+ * @param target		:  target for scsi sub-system
+ * @param lun			:  LUN for scsi sub-system
+ *
+ * - Allocated at same time as scsi_pkt by scsi_hba_pkt_alloc(9E)
+ * - Pointed to by pkt_ha_private field in scsi_pkt
+ */
+struct scsa_cmd {
+	ddi_dma_handle_t	cmd_dmahandle;
+	ddi_dma_cookie_t	cmd_dmacookies[DRSAS_MAX_SGE_CNT];
+	struct scsi_pkt		*cmd_pkt;
+	ulong_t			cmd_dmacount;
+	uint_t			cmd_cookie;
+	uint_t			cmd_ncookies;
+	uint_t			cmd_cookiecnt;
+	uint_t			cmd_nwin;
+	uint_t			cmd_curwin;
+	off_t			cmd_dma_offset;
+	ulong_t			cmd_dma_len;
+	ulong_t			cmd_flags;
+	uint_t			cmd_cdblen;
+	uint_t			cmd_scblen;
+	struct buf		*cmd_buf;
+	ushort_t		device_id;
+	uchar_t			islogical;
+	uchar_t			lun;
+	struct drsas_device	*drsas_dev;
+};
+
+
+struct drsas_cmd {
+	union drsas_frame	*frame;
+	uint32_t		frame_phys_addr;
+	uint8_t			*sense;
+	uint32_t		sense_phys_addr;
+	dma_obj_t		frame_dma_obj;
+	uint8_t			frame_dma_obj_status;
+
+	uint32_t		index;
+	uint8_t			sync_cmd;
+	uint8_t			cmd_status;
+	uint16_t		abort_aen;
+	mlist_t			list;
+	uint32_t		frame_count;
+	struct scsa_cmd		*cmd;
+	struct scsi_pkt		*pkt;
+};
+
+#define	MAX_MGMT_ADAPTERS			1024
+#define	IOC_SIGNATURE				"MR-SAS"
+
+#define	IOC_CMD_FIRMWARE			0x0
+#define	DRSAS_DRIVER_IOCTL_COMMON		0xF0010000
+#define	DRSAS_DRIVER_IOCTL_DRIVER_VERSION	0xF0010100
+#define	DRSAS_DRIVER_IOCTL_PCI_INFORMATION	0xF0010200
+#define	DRSAS_DRIVER_IOCTL_MRRAID_STATISTICS	0xF0010300
+
+
+#define	DRSAS_MAX_SENSE_LENGTH			32
+
+struct drsas_mgmt_info {
+
+	uint16_t			count;
+	struct drsas_instance		*instance[MAX_MGMT_ADAPTERS];
+	uint16_t			map[MAX_MGMT_ADAPTERS];
+	int				max_index;
+};
+
+#pragma pack(1)
+
+/*
+ * SAS controller properties
+ */
+struct drsas_ctrl_prop {
+	uint16_t	seq_num;
+	uint16_t	pred_fail_poll_interval;
+	uint16_t	intr_throttle_count;
+	uint16_t	intr_throttle_timeouts;
+
+	uint8_t		rebuild_rate;
+	uint8_t		patrol_read_rate;
+	uint8_t		bgi_rate;
+	uint8_t		cc_rate;
+	uint8_t		recon_rate;
+
+	uint8_t		cache_flush_interval;
+
+	uint8_t		spinup_drv_count;
+	uint8_t		spinup_delay;
+
+	uint8_t		cluster_enable;
+	uint8_t		coercion_mode;
+	uint8_t		disk_write_cache_disable;
+	uint8_t		alarm_enable;
+
+	uint8_t		reserved[44];
+};
+
+/*
+ * SAS controller information
+ */
+struct drsas_ctrl_info {
+	/* PCI device information */
+	struct {
+		uint16_t	vendor_id;
+		uint16_t	device_id;
+		uint16_t	sub_vendor_id;
+		uint16_t	sub_device_id;
+		uint8_t	reserved[24];
+	} pci;
+
+	/* Host interface information */
+	struct {
+		uint8_t	PCIX		: 1;
+		uint8_t	PCIE		: 1;
+		uint8_t	iSCSI		: 1;
+		uint8_t	SAS_3G		: 1;
+		uint8_t	reserved_0	: 4;
+		uint8_t	reserved_1[6];
+		uint8_t	port_count;
+		uint64_t	port_addr[8];
+	} host_interface;
+
+	/* Device (backend) interface information */
+	struct {
+		uint8_t	SPI		: 1;
+		uint8_t	SAS_3G		: 1;
+		uint8_t	SATA_1_5G	: 1;
+		uint8_t	SATA_3G		: 1;
+		uint8_t	reserved_0	: 4;
+		uint8_t	reserved_1[6];
+		uint8_t	port_count;
+		uint64_t	port_addr[8];
+	} device_interface;
+
+	/* List of components residing in flash. All str are null terminated */
+	uint32_t	image_check_word;
+	uint32_t	image_component_count;
+
+	struct {
+		char	name[8];
+		char	version[32];
+		char	build_date[16];
+		char	built_time[16];
+	} image_component[8];
+
+	/*
+	 * List of flash components that have been flashed on the card, but
+	 * are not in use, pending reset of the adapter. This list will be
+	 * empty if a flash operation has not occurred. All stings are null
+	 * terminated
+	 */
+	uint32_t	pending_image_component_count;
+
+	struct {
+		char	name[8];
+		char	version[32];
+		char	build_date[16];
+		char	build_time[16];
+	} pending_image_component[8];
+
+	uint8_t		max_arms;
+	uint8_t		max_spans;
+	uint8_t		max_arrays;
+	uint8_t		max_lds;
+
+	char		product_name[80];
+	char		serial_no[32];
+
+	/*
+	 * Other physical/controller/operation information. Indicates the
+	 * presence of the hardware
+	 */
+	struct {
+		uint32_t	bbu		: 1;
+		uint32_t	alarm		: 1;
+		uint32_t	nvram		: 1;
+		uint32_t	uart		: 1;
+		uint32_t	reserved	: 28;
+	} hw_present;
+
+	uint32_t	current_fw_time;
+
+	/* Maximum data transfer sizes */
+	uint16_t		max_concurrent_cmds;
+	uint16_t		max_sge_count;
+	uint32_t		max_request_size;
+
+	/* Logical and physical device counts */
+	uint16_t		ld_present_count;
+	uint16_t		ld_degraded_count;
+	uint16_t		ld_offline_count;
+
+	uint16_t		pd_present_count;
+	uint16_t		pd_disk_present_count;
+	uint16_t		pd_disk_pred_failure_count;
+	uint16_t		pd_disk_failed_count;
+
+	/* Memory size information */
+	uint16_t		nvram_size;
+	uint16_t		memory_size;
+	uint16_t		flash_size;
+
+	/* Error counters */
+	uint16_t		mem_correctable_error_count;
+	uint16_t		mem_uncorrectable_error_count;
+
+	/* Cluster information */
+	uint8_t		cluster_permitted;
+	uint8_t		cluster_active;
+	uint8_t		reserved_1[2];
+
+	/* Controller capabilities structures */
+	struct {
+		uint32_t	raid_level_0	: 1;
+		uint32_t	raid_level_1	: 1;
+		uint32_t	raid_level_5	: 1;
+		uint32_t	raid_level_1E	: 1;
+		uint32_t	reserved	: 28;
+	} raid_levels;
+
+	struct {
+		uint32_t	rbld_rate		: 1;
+		uint32_t	cc_rate			: 1;
+		uint32_t	bgi_rate		: 1;
+		uint32_t	recon_rate		: 1;
+		uint32_t	patrol_rate		: 1;
+		uint32_t	alarm_control		: 1;
+		uint32_t	cluster_supported	: 1;
+		uint32_t	bbu			: 1;
+		uint32_t	spanning_allowed	: 1;
+		uint32_t	dedicated_hotspares	: 1;
+		uint32_t	revertible_hotspares	: 1;
+		uint32_t	foreign_config_import	: 1;
+		uint32_t	self_diagnostic		: 1;
+		uint32_t	reserved		: 19;
+	} adapter_operations;
+
+	struct {
+		uint32_t	read_policy	: 1;
+		uint32_t	write_policy	: 1;
+		uint32_t	io_policy	: 1;
+		uint32_t	access_policy	: 1;
+		uint32_t	reserved	: 28;
+	} ld_operations;
+
+	struct {
+		uint8_t	min;
+		uint8_t	max;
+		uint8_t	reserved[2];
+	} stripe_size_operations;
+
+	struct {
+		uint32_t	force_online	: 1;
+		uint32_t	force_offline	: 1;
+		uint32_t	force_rebuild	: 1;
+		uint32_t	reserved	: 29;
+	} pd_operations;
+
+	struct {
+		uint32_t	ctrl_supports_sas	: 1;
+		uint32_t	ctrl_supports_sata	: 1;
+		uint32_t	allow_mix_in_encl	: 1;
+		uint32_t	allow_mix_in_ld		: 1;
+		uint32_t	allow_sata_in_cluster	: 1;
+		uint32_t	reserved		: 27;
+	} pd_mix_support;
+
+	/* Include the controller properties (changeable items) */
+	uint8_t				reserved_2[12];
+	struct drsas_ctrl_prop		properties;
+
+	uint8_t				pad[0x800 - 0x640];
+};
+
+/*
+ * ==================================
+ * MegaRAID SAS2.0 driver definitions
+ * ==================================
+ */
+#define	MRDRV_MAX_NUM_CMD			1024
+
+#define	MRDRV_MAX_PD_CHANNELS			2
+#define	MRDRV_MAX_LD_CHANNELS			2
+#define	MRDRV_MAX_CHANNELS			(MRDRV_MAX_PD_CHANNELS + \
+						MRDRV_MAX_LD_CHANNELS)
+#define	MRDRV_MAX_DEV_PER_CHANNEL		128
+#define	MRDRV_DEFAULT_INIT_ID			-1
+#define	MRDRV_MAX_CMD_PER_LUN			1000
+#define	MRDRV_MAX_LUN				1
+#define	MRDRV_MAX_LD				64
+
+#define	MRDRV_RESET_WAIT_TIME			300
+#define	MRDRV_RESET_NOTICE_INTERVAL		5
+
+#define	DRSAS_IOCTL_CMD				0
+
+/*
+ * FW can accept both 32 and 64 bit SGLs. We want to allocate 32/64 bit
+ * SGLs based on the size of dma_addr_t
+ */
+#define	IS_DMA64		(sizeof (dma_addr_t) == 8)
+
+#define	IB_MSG_0_OFF			0x10	/* XScale */
+#define	OB_MSG_0_OFF			0x18	/* XScale */
+#define	IB_DOORBELL_OFF			0x20	/* XScale & ROC */
+#define	OB_INTR_STATUS_OFF		0x30	/* XScale & ROC */
+#define	OB_INTR_MASK_OFF		0x34	/* XScale & ROC */
+#define	IB_QPORT_OFF			0x40	/* XScale & ROC */
+#define	OB_DOORBELL_CLEAR_OFF		0xA0	/* ROC */
+#define	OB_SCRATCH_PAD_0_OFF		0xB0	/* ROC */
+#define	OB_INTR_MASK			0xFFFFFFFF
+#define	OB_DOORBELL_CLEAR_MASK		0xFFFFFFFF
+
+/*
+ * All MFI register set macros accept drsas_register_set*
+ */
+#define	WR_IB_MSG_0(v, instance) 	ddi_put32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + IB_MSG_0_OFF), (v))
+
+#define	RD_OB_MSG_0(instance) 		ddi_get32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_MSG_0_OFF))
+
+#define	WR_IB_DOORBELL(v, instance)	ddi_put32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + IB_DOORBELL_OFF), (v))
+
+#define	RD_IB_DOORBELL(instance)	ddi_get32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + IB_DOORBELL_OFF))
+
+#define	WR_OB_INTR_STATUS(v, instance) 	ddi_put32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_INTR_STATUS_OFF), (v))
+
+#define	RD_OB_INTR_STATUS(instance) 	ddi_get32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_INTR_STATUS_OFF))
+
+#define	WR_OB_INTR_MASK(v, instance) 	ddi_put32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_INTR_MASK_OFF), (v))
+
+#define	RD_OB_INTR_MASK(instance) 	ddi_get32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_INTR_MASK_OFF))
+
+#define	WR_IB_QPORT(v, instance) 	ddi_put32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + IB_QPORT_OFF), (v))
+
+#define	WR_OB_DOORBELL_CLEAR(v, instance) ddi_put32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_DOORBELL_CLEAR_OFF), \
+	(v))
+
+#define	RD_OB_SCRATCH_PAD_0(instance) 	ddi_get32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_SCRATCH_PAD_0_OFF))
+
+/*
+ * When FW is in MFI_STATE_READY or MFI_STATE_OPERATIONAL, the state data
+ * of Outbound Msg Reg 0 indicates max concurrent cmds supported, max SGEs
+ * supported per cmd and if 64-bit MFAs (M64) is enabled or disabled.
+ */
+#define	MFI_OB_INTR_STATUS_MASK		0x00000002
+
+/*
+ * This MFI_REPLY_2108_MESSAGE_INTR flag is used also
+ * in enable_intr_ppc also. Hence bit 2, i.e. 0x4 has
+ * been set in this flag along with bit 1.
+ */
+#define	MFI_REPLY_2108_MESSAGE_INTR		0x00000001
+#define	MFI_REPLY_2108_MESSAGE_INTR_MASK	0x00000005
+
+#define	MFI_POLL_TIMEOUT_SECS		60
+
+#define	MFI_ENABLE_INTR(instance)  ddi_put32((instance)->regmap_handle, \
+	(uint32_t *)((uintptr_t)(instance)->regmap + OB_INTR_MASK_OFF), 1)
+#define	MFI_DISABLE_INTR(instance)					\
+{									\
+	uint32_t disable = 1;						\
+	uint32_t mask =  ddi_get32((instance)->regmap_handle, 		\
+	    (uint32_t *)((uintptr_t)(instance)->regmap + OB_INTR_MASK_OFF));\
+	mask &= ~disable;						\
+	ddi_put32((instance)->regmap_handle, (uint32_t *)		\
+	    (uintptr_t)((instance)->regmap + OB_INTR_MASK_OFF), mask);	\
+}
+
+/* By default, the firmware programs for 8 Kbytes of memory */
+#define	DEFAULT_MFI_MEM_SZ	8192
+#define	MINIMUM_MFI_MEM_SZ	4096
+
+/* DCMD Message Frame MAILBOX0-11 */
+#define	DCMD_MBOX_SZ		12
+
+
+struct drsas_register_set {
+	uint32_t	reserved_0[4];
+
+	uint32_t	inbound_msg_0;
+	uint32_t	inbound_msg_1;
+	uint32_t	outbound_msg_0;
+	uint32_t	outbound_msg_1;
+
+	uint32_t	inbound_doorbell;
+	uint32_t	inbound_intr_status;
+	uint32_t	inbound_intr_mask;
+
+	uint32_t	outbound_doorbell;
+	uint32_t	outbound_intr_status;
+	uint32_t	outbound_intr_mask;
+
+	uint32_t	reserved_1[2];
+
+	uint32_t	inbound_queue_port;
+	uint32_t	outbound_queue_port;
+
+	uint32_t 	reserved_2[22];
+
+	uint32_t 	outbound_doorbell_clear;
+
+	uint32_t 	reserved_3[3];
+
+	uint32_t 	outbound_scratch_pad;
+
+	uint32_t 	reserved_4[3];
+
+	uint32_t 	inbound_low_queue_port;
+
+	uint32_t 	inbound_high_queue_port;
+
+	uint32_t 	reserved_5;
+	uint32_t 	index_registers[820];
+};
+
+struct drsas_sge32 {
+	uint32_t	phys_addr;
+	uint32_t	length;
+};
+
+struct drsas_sge64 {
+	uint64_t	phys_addr;
+	uint32_t	length;
+};
+
+union drsas_sgl {
+	struct drsas_sge32	sge32[1];
+	struct drsas_sge64	sge64[1];
+};
+
+struct drsas_header {
+	uint8_t		cmd;
+	uint8_t		sense_len;
+	uint8_t		cmd_status;
+	uint8_t		scsi_status;
+
+	uint8_t		target_id;
+	uint8_t		lun;
+	uint8_t		cdb_len;
+	uint8_t		sge_count;
+
+	uint32_t	context;
+	uint8_t		req_id;
+	uint8_t		msgvector;
+	uint16_t	pad_0;
+
+	uint16_t	flags;
+	uint16_t	timeout;
+	uint32_t	data_xferlen;
+};
+
+union drsas_sgl_frame {
+	struct drsas_sge32	sge32[8];
+	struct drsas_sge64	sge64[5];
+};
+
+struct drsas_init_frame {
+	uint8_t		cmd;
+	uint8_t		reserved_0;
+	uint8_t		cmd_status;
+
+	uint8_t		reserved_1;
+	uint32_t	reserved_2;
+
+	uint32_t	context;
+	uint8_t		req_id;
+	uint8_t		msgvector;
+	uint16_t	pad_0;
+
+	uint16_t	flags;
+	uint16_t	reserved_3;
+	uint32_t	data_xfer_len;
+
+	uint32_t	queue_info_new_phys_addr_lo;
+	uint32_t	queue_info_new_phys_addr_hi;
+	uint32_t	queue_info_old_phys_addr_lo;
+	uint32_t	queue_info_old_phys_addr_hi;
+
+	uint32_t	reserved_4[6];
+};
+
+struct drsas_init_queue_info {
+	uint32_t		init_flags;
+	uint32_t		reply_queue_entries;
+
+	uint32_t		reply_queue_start_phys_addr_lo;
+	uint32_t		reply_queue_start_phys_addr_hi;
+	uint32_t		producer_index_phys_addr_lo;
+	uint32_t		producer_index_phys_addr_hi;
+	uint32_t		consumer_index_phys_addr_lo;
+	uint32_t		consumer_index_phys_addr_hi;
+};
+
+struct drsas_io_frame {
+	uint8_t			cmd;
+	uint8_t			sense_len;
+	uint8_t			cmd_status;
+	uint8_t			scsi_status;
+
+	uint8_t			target_id;
+	uint8_t			access_byte;
+	uint8_t			reserved_0;
+	uint8_t			sge_count;
+
+	uint32_t		context;
+	uint8_t			req_id;
+	uint8_t			msgvector;
+	uint16_t		pad_0;
+
+	uint16_t		flags;
+	uint16_t		timeout;
+	uint32_t		lba_count;
+
+	uint32_t		sense_buf_phys_addr_lo;
+	uint32_t		sense_buf_phys_addr_hi;
+
+	uint32_t		start_lba_lo;
+	uint32_t		start_lba_hi;
+
+	union drsas_sgl		sgl;
+};
+
+struct drsas_pthru_frame {
+	uint8_t			cmd;
+	uint8_t			sense_len;
+	uint8_t			cmd_status;
+	uint8_t			scsi_status;
+
+	uint8_t			target_id;
+	uint8_t			lun;
+	uint8_t			cdb_len;
+	uint8_t			sge_count;
+
+	uint32_t		context;
+	uint8_t			req_id;
+	uint8_t			msgvector;
+	uint16_t		pad_0;
+
+	uint16_t		flags;
+	uint16_t		timeout;
+	uint32_t		data_xfer_len;
+
+	uint32_t		sense_buf_phys_addr_lo;
+	uint32_t		sense_buf_phys_addr_hi;
+
+	uint8_t			cdb[16];
+	union drsas_sgl		sgl;
+};
+
+struct drsas_dcmd_frame {
+	uint8_t			cmd;
+	uint8_t			reserved_0;
+	uint8_t			cmd_status;
+	uint8_t			reserved_1[4];
+	uint8_t			sge_count;
+
+	uint32_t		context;
+	uint8_t			req_id;
+	uint8_t			msgvector;
+	uint16_t		pad_0;
+
+	uint16_t		flags;
+	uint16_t		timeout;
+
+	uint32_t		data_xfer_len;
+	uint32_t		opcode;
+
+	union {
+		uint8_t b[DCMD_MBOX_SZ];
+		uint16_t s[6];
+		uint32_t w[3];
+	} mbox;
+
+	union drsas_sgl		sgl;
+};
+
+struct drsas_abort_frame {
+	uint8_t		cmd;
+	uint8_t		reserved_0;
+	uint8_t		cmd_status;
+
+	uint8_t		reserved_1;
+	uint32_t	reserved_2;
+
+	uint32_t	context;
+	uint8_t		req_id;
+	uint8_t		msgvector;
+	uint16_t	pad_0;
+
+	uint16_t	flags;
+	uint16_t	reserved_3;
+	uint32_t	reserved_4;
+
+	uint32_t	abort_context;
+	uint32_t	pad_1;
+
+	uint32_t	abort_mfi_phys_addr_lo;
+	uint32_t	abort_mfi_phys_addr_hi;
+
+	uint32_t	reserved_5[6];
+};
+
+struct drsas_smp_frame {
+	uint8_t		cmd;
+	uint8_t		reserved_1;
+	uint8_t		cmd_status;
+	uint8_t		connection_status;
+
+	uint8_t		reserved_2[3];
+	uint8_t		sge_count;
+
+	uint32_t	context;
+	uint8_t		req_id;
+	uint8_t		msgvector;
+	uint16_t	pad_0;
+
+	uint16_t	flags;
+	uint16_t	timeout;
+
+	uint32_t	data_xfer_len;
+
+	uint64_t	sas_addr;
+
+	union drsas_sgl	sgl[2];
+};
+
+struct drsas_stp_frame {
+	uint8_t		cmd;
+	uint8_t		reserved_1;
+	uint8_t		cmd_status;
+	uint8_t		connection_status;
+
+	uint8_t		target_id;
+	uint8_t		reserved_2[2];
+	uint8_t		sge_count;
+
+	uint32_t	context;
+	uint8_t		req_id;
+	uint8_t		msgvector;
+	uint16_t	pad_0;
+
+	uint16_t	flags;
+	uint16_t	timeout;
+
+	uint32_t	data_xfer_len;
+
+	uint16_t	fis[10];
+	uint32_t	stp_flags;
+	union drsas_sgl	sgl;
+};
+
+union drsas_frame {
+	struct drsas_header		hdr;
+	struct drsas_init_frame		init;
+	struct drsas_io_frame		io;
+	struct drsas_pthru_frame	pthru;
+	struct drsas_dcmd_frame		dcmd;
+	struct drsas_abort_frame	abort;
+	struct drsas_smp_frame		smp;
+	struct drsas_stp_frame		stp;
+
+	uint8_t			raw_bytes[64];
+};
+
+typedef struct drsas_pd_address {
+	uint16_t	device_id;
+	uint16_t	encl_id;
+
+	union {
+		struct {
+			uint8_t encl_index;
+			uint8_t slot_number;
+		} pd_address;
+		struct {
+			uint8_t	encl_position;
+			uint8_t	encl_connector_index;
+		} encl_address;
+	}address;
+
+	uint8_t	scsi_dev_type;
+
+	union {
+		uint8_t		port_bitmap;
+		uint8_t		port_numbers;
+	} connected;
+
+	uint64_t		sas_addr[2];
+} drsas_pd_address_t;
+
+union drsas_evt_class_locale {
+	struct {
+		uint16_t	locale;
+		uint8_t		reserved;
+		int8_t		class;
+	} members;
+
+	uint32_t	word;
+};
+
+struct drsas_evt_log_info {
+	uint32_t	newest_seq_num;
+	uint32_t	oldest_seq_num;
+	uint32_t	clear_seq_num;
+	uint32_t	shutdown_seq_num;
+	uint32_t	boot_seq_num;
+};
+
+struct drsas_progress {
+	uint16_t	progress;
+	uint16_t	elapsed_seconds;
+};
+
+struct drsas_evtarg_ld {
+	uint16_t	target_id;
+	uint8_t		ld_index;
+	uint8_t		reserved;
+};
+
+struct drsas_evtarg_pd {
+	uint16_t	device_id;
+	uint8_t		encl_index;
+	uint8_t		slot_number;
+};
+
+struct drsas_evt_detail {
+	uint32_t	seq_num;
+	uint32_t	time_stamp;
+	uint32_t	code;
+	union drsas_evt_class_locale	cl;
+	uint8_t		arg_type;
+	uint8_t		reserved1[15];
+
+	union {
+		struct {
+			struct drsas_evtarg_pd	pd;
+			uint8_t			cdb_length;
+			uint8_t			sense_length;
+			uint8_t			reserved[2];
+			uint8_t			cdb[16];
+			uint8_t			sense[64];
+		} cdbSense;
+
+		struct drsas_evtarg_ld		ld;
+
+		struct {
+			struct drsas_evtarg_ld	ld;
+			uint64_t		count;
+		} ld_count;
+
+		struct {
+			uint64_t		lba;
+			struct drsas_evtarg_ld	ld;
+		} ld_lba;
+
+		struct {
+			struct drsas_evtarg_ld	ld;
+			uint32_t		prevOwner;
+			uint32_t		newOwner;
+		} ld_owner;
+
+		struct {
+			uint64_t		ld_lba;
+			uint64_t		pd_lba;
+			struct drsas_evtarg_ld	ld;
+			struct drsas_evtarg_pd	pd;
+		} ld_lba_pd_lba;
+
+		struct {
+			struct drsas_evtarg_ld	ld;
+			struct drsas_progress	prog;
+		} ld_prog;
+
+		struct {
+			struct drsas_evtarg_ld	ld;
+			uint32_t		prev_state;
+			uint32_t		new_state;
+		} ld_state;
+
+		struct {
+			uint64_t		strip;
+			struct drsas_evtarg_ld	ld;
+		} ld_strip;
+
+		struct drsas_evtarg_pd		pd;
+
+		struct {
+			struct drsas_evtarg_pd	pd;
+			uint32_t		err;
+		} pd_err;
+
+		struct {
+			uint64_t		lba;
+			struct drsas_evtarg_pd	pd;
+		} pd_lba;
+
+		struct {
+			uint64_t		lba;
+			struct drsas_evtarg_pd	pd;
+			struct drsas_evtarg_ld	ld;
+		} pd_lba_ld;
+
+		struct {
+			struct drsas_evtarg_pd	pd;
+			struct drsas_progress	prog;
+		} pd_prog;
+
+		struct {
+			struct drsas_evtarg_pd	pd;
+			uint32_t		prevState;
+			uint32_t		newState;
+		} pd_state;
+
+		struct {
+			uint16_t	vendorId;
+			uint16_t	deviceId;
+			uint16_t	subVendorId;
+			uint16_t	subDeviceId;
+		} pci;
+
+		uint32_t	rate;
+		char		str[96];
+
+		struct {
+			uint32_t	rtc;
+			uint32_t	elapsedSeconds;
+		} time;
+
+		struct {
+			uint32_t	ecar;
+			uint32_t	elog;
+			char		str[64];
+		} ecc;
+
+		drsas_pd_address_t	pd_addr;
+
+		uint8_t		b[96];
+		uint16_t	s[48];
+		uint32_t	w[24];
+		uint64_t	d[12];
+	} args;
+
+	char	description[128];
+
+};
+
+/* only 63 are usable by the application */
+#define	MAX_LOGICAL_DRIVES			64
+/* only 255 physical devices may be used */
+#define	MAX_PHYSICAL_DEVICES			256
+#define	MAX_PD_PER_ENCLOSURE			64
+/* maximum disks per array */
+#define	MAX_ROW_SIZE				32
+/* maximum spans per logical drive */
+#define	MAX_SPAN_DEPTH				8
+/* maximum number of arrays a hot spare may be dedicated to */
+#define	MAX_ARRAYS_DEDICATED			16
+/* maximum number of arrays which may exist */
+#define	MAX_ARRAYS				128
+/* maximum number of foreign configs that may ha managed at once */
+#define	MAX_FOREIGN_CONFIGS			8
+/* maximum spares (global and dedicated combined) */
+#define	MAX_SPARES_FOR_THE_CONTROLLER		MAX_PHYSICAL_DEVICES
+/* maximum possible Target IDs (i.e. 0 to 63) */
+#define	MAX_TARGET_ID				63
+/* maximum number of supported enclosures */
+#define	MAX_ENCLOSURES				32
+/* maximum number of PHYs per controller */
+#define	MAX_PHYS_PER_CONTROLLER			16
+/* maximum number of LDs per array (due to DDF limitations) */
+#define	MAX_LDS_PER_ARRAY			16
+
+/*
+ * -----------------------------------------------------------------------------
+ * -----------------------------------------------------------------------------
+ *
+ * Logical Drive commands
+ *
+ * -----------------------------------------------------------------------------
+ * -----------------------------------------------------------------------------
+ */
+#define	DR_DCMD_LD	0x03000000,	/* Logical Device (LD) opcodes */
+
+/*
+ * Input:	dcmd.opcode	- DR_DCMD_LD_GET_LIST
+ *		dcmd.mbox	- reserved
+ *		dcmd.sge IN	- ptr to returned DR_LD_LIST structure
+ * Desc:	Return the logical drive list structure
+ * Status:	No error
+ */
+
+/*
+ * defines the logical drive reference structure
+ */
+typedef	union _DR_LD_REF {	/* LD reference structure */
+	struct {
+		uint8_t	targetId; /* LD target id (0 to MAX_TARGET_ID) */
+		uint8_t	reserved; /* reserved for in line with DR_PD_REF */
+		uint16_t seqNum;  /* Sequence Number */
+	} ld_ref;
+	uint32_t ref;		/* shorthand reference to full 32-bits */
+} DR_LD_REF;			/* 4 bytes */
+
+/*
+ * defines the logical drive list structure
+ */
+typedef struct _DR_LD_LIST {
+	uint32_t	ldCount;	/* number of LDs */
+	uint32_t	reserved;	/* pad to 8-byte boundary */
+	struct {
+		DR_LD_REF ref;	/* LD reference */
+		uint8_t	state;		/* current LD state (DR_LD_STATE) */
+		uint8_t	reserved[3];	/* pad to 8-byte boundary */
+		uint64_t size;		/* LD size */
+	} ldList[MAX_LOGICAL_DRIVES];
+} DR_LD_LIST;
+
+struct drsas_drv_ver {
+	uint8_t	signature[12];
+	uint8_t	os_name[16];
+	uint8_t	os_ver[12];
+	uint8_t	drv_name[20];
+	uint8_t	drv_ver[32];
+	uint8_t	drv_rel_date[20];
+};
+
+#define	PCI_TYPE0_ADDRESSES		6
+#define	PCI_TYPE1_ADDRESSES		2
+#define	PCI_TYPE2_ADDRESSES		5
+
+struct drsas_pci_common_header {
+	uint16_t	vendorID;		/* (ro) */
+	uint16_t	deviceID;		/* (ro) */
+	uint16_t	command;		/* Device control */
+	uint16_t	status;
+	uint8_t		revisionID;		/* (ro) */
+	uint8_t		progIf;			/* (ro) */
+	uint8_t		subClass;		/* (ro) */
+	uint8_t		baseClass;		/* (ro) */
+	uint8_t		cacheLineSize;		/* (ro+) */
+	uint8_t		latencyTimer;		/* (ro+) */
+	uint8_t		headerType;		/* (ro) */
+	uint8_t		bist;			/* Built in self test */
+
+	union {
+	    struct {
+		uint32_t	baseAddresses[PCI_TYPE0_ADDRESSES];
+		uint32_t	cis;
+		uint16_t	subVendorID;
+		uint16_t	subSystemID;
+		uint32_t	romBaseAddress;
+		uint8_t		capabilitiesPtr;
+		uint8_t		reserved1[3];
+		uint32_t	reserved2;
+		uint8_t		interruptLine;
+		uint8_t		interruptPin;	/* (ro) */
+		uint8_t		minimumGrant;	/* (ro) */
+		uint8_t		maximumLatency;	/* (ro) */
+	    } type_0;
+
+	    struct {
+		uint32_t	baseAddresses[PCI_TYPE1_ADDRESSES];
+		uint8_t		primaryBus;
+		uint8_t		secondaryBus;
+		uint8_t		subordinateBus;
+		uint8_t		secondaryLatency;
+		uint8_t		ioBase;
+		uint8_t		ioLimit;
+		uint16_t	secondaryStatus;
+		uint16_t	memoryBase;
+		uint16_t	memoryLimit;
+		uint16_t	prefetchBase;
+		uint16_t	prefetchLimit;
+		uint32_t	prefetchBaseUpper32;
+		uint32_t	prefetchLimitUpper32;
+		uint16_t	ioBaseUpper16;
+		uint16_t	ioLimitUpper16;
+		uint8_t		capabilitiesPtr;
+		uint8_t		reserved1[3];
+		uint32_t	romBaseAddress;
+		uint8_t		interruptLine;
+		uint8_t		interruptPin;
+		uint16_t	bridgeControl;
+	    } type_1;
+
+	    struct {
+		uint32_t	socketRegistersBaseAddress;
+		uint8_t		capabilitiesPtr;
+		uint8_t		reserved;
+		uint16_t	secondaryStatus;
+		uint8_t		primaryBus;
+		uint8_t		secondaryBus;
+		uint8_t		subordinateBus;
+		uint8_t		secondaryLatency;
+		struct {
+			uint32_t	base;
+			uint32_t	limit;
+		} range[PCI_TYPE2_ADDRESSES-1];
+		uint8_t		interruptLine;
+		uint8_t		interruptPin;
+		uint16_t	bridgeControl;
+	    } type_2;
+	} header;
+};
+
+struct drsas_pci_link_capability {
+	union {
+	    struct {
+		uint32_t linkSpeed		:4;
+		uint32_t linkWidth		:6;
+		uint32_t aspmSupport		:2;
+		uint32_t losExitLatency		:3;
+		uint32_t l1ExitLatency		:3;
+		uint32_t rsvdp			:6;
+		uint32_t portNumber		:8;
+	    } bits;
+
+	    uint32_t asUlong;
+	} cap;
+
+};
+
+struct drsas_pci_link_status_capability {
+	union {
+	    struct {
+		uint16_t linkSpeed		:4;
+		uint16_t negotiatedLinkWidth	:6;
+		uint16_t linkTrainingError	:1;
+		uint16_t linkTraning		:1;
+		uint16_t slotClockConfig	:1;
+		uint16_t rsvdZ			:3;
+	    } bits;
+
+	    uint16_t asUshort;
+	} stat_cap;
+
+	uint16_t reserved;
+
+};
+
+struct drsas_pci_capabilities {
+	struct drsas_pci_link_capability	linkCapability;
+	struct drsas_pci_link_status_capability linkStatusCapability;
+};
+
+struct drsas_pci_information
+{
+	uint32_t		busNumber;
+	uint8_t			deviceNumber;
+	uint8_t			functionNumber;
+	uint8_t			interruptVector;
+	uint8_t			reserved;
+	struct drsas_pci_common_header pciHeaderInfo;
+	struct drsas_pci_capabilities capability;
+	uint8_t			reserved2[32];
+};
+
+struct drsas_ioctl {
+	uint16_t	version;
+	uint16_t	controller_id;
+	uint8_t		signature[8];
+	uint32_t	reserved_1;
+	uint32_t	control_code;
+	uint32_t	reserved_2[2];
+	uint8_t		frame[64];
+	union drsas_sgl_frame sgl_frame;
+	uint8_t		sense_buff[DRSAS_MAX_SENSE_LENGTH];
+	uint8_t		data[1];
+};
+
+struct drsas_aen {
+	uint16_t	host_no;
+	uint16_t	cmd_status;
+	uint32_t	seq_num;
+	uint32_t	class_locale_word;
+};
+#pragma pack()
+
+#ifndef	DDI_VENDOR_LSI
+#define	DDI_VENDOR_LSI		"LSI"
+#endif /* DDI_VENDOR_LSI */
+
+static int	drsas_getinfo(dev_info_t *, ddi_info_cmd_t,  void *, void **);
+static int	drsas_attach(dev_info_t *, ddi_attach_cmd_t);
+static int	drsas_reset(dev_info_t *, ddi_reset_cmd_t);
+static int	drsas_detach(dev_info_t *, ddi_detach_cmd_t);
+static int	drsas_open(dev_t *, int, int, cred_t *);
+static int	drsas_close(dev_t, int, int, cred_t *);
+static int	drsas_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
+
+static int	drsas_tran_tgt_init(dev_info_t *, dev_info_t *,
+		    scsi_hba_tran_t *, struct scsi_device *);
+static struct scsi_pkt *drsas_tran_init_pkt(struct scsi_address *, register
+		    struct scsi_pkt *, struct buf *, int, int, int, int,
+		    int (*)(), caddr_t);
+static int	drsas_tran_start(struct scsi_address *,
+		    register struct scsi_pkt *);
+static int	drsas_tran_abort(struct scsi_address *, struct scsi_pkt *);
+static int	drsas_tran_reset(struct scsi_address *, int);
+static int	drsas_tran_getcap(struct scsi_address *, char *, int);
+static int	drsas_tran_setcap(struct scsi_address *, char *, int, int);
+static void	drsas_tran_destroy_pkt(struct scsi_address *,
+		    struct scsi_pkt *);
+static void	drsas_tran_dmafree(struct scsi_address *, struct scsi_pkt *);
+static void	drsas_tran_sync_pkt(struct scsi_address *, struct scsi_pkt *);
+static uint_t	drsas_isr();
+static uint_t	drsas_softintr();
+
+static int	init_mfi(struct drsas_instance *);
+static int	drsas_free_dma_obj(struct drsas_instance *, dma_obj_t);
+static int	drsas_alloc_dma_obj(struct drsas_instance *, dma_obj_t *,
+		    uchar_t);
+static struct drsas_cmd *get_mfi_pkt(struct drsas_instance *);
+static void	return_mfi_pkt(struct drsas_instance *,
+		    struct drsas_cmd *);
+
+static void	free_space_for_mfi(struct drsas_instance *);
+static void	free_additional_dma_buffer(struct drsas_instance *);
+static int	alloc_additional_dma_buffer(struct drsas_instance *);
+static int	read_fw_status_reg_ppc(struct drsas_instance *);
+static void	issue_cmd_ppc(struct drsas_cmd *, struct drsas_instance *);
+static int	issue_cmd_in_poll_mode_ppc(struct drsas_instance *,
+		    struct drsas_cmd *);
+static int	issue_cmd_in_sync_mode_ppc(struct drsas_instance *,
+		    struct drsas_cmd *);
+static void	enable_intr_ppc(struct drsas_instance *);
+static void	disable_intr_ppc(struct drsas_instance *);
+static int	intr_ack_ppc(struct drsas_instance *);
+static int	mfi_state_transition_to_ready(struct drsas_instance *);
+static void	destroy_mfi_frame_pool(struct drsas_instance *);
+static int	create_mfi_frame_pool(struct drsas_instance *);
+static int	drsas_dma_alloc(struct drsas_instance *, struct scsi_pkt *,
+		    struct buf *, int, int (*)());
+static int	drsas_dma_move(struct drsas_instance *,
+			struct scsi_pkt *, struct buf *);
+static void	flush_cache(struct drsas_instance *instance);
+static void	display_scsi_inquiry(caddr_t);
+static int	start_mfi_aen(struct drsas_instance *instance);
+static int	handle_drv_ioctl(struct drsas_instance *instance,
+		    struct drsas_ioctl *ioctl, int mode);
+static int	handle_mfi_ioctl(struct drsas_instance *instance,
+		    struct drsas_ioctl *ioctl, int mode);
+static int	handle_mfi_aen(struct drsas_instance *instance,
+		    struct drsas_aen *aen);
+static void	fill_up_drv_ver(struct drsas_drv_ver *dv);
+static struct drsas_cmd *build_cmd(struct drsas_instance *instance,
+		    struct scsi_address *ap, struct scsi_pkt *pkt,
+		    uchar_t *cmd_done);
+static int	register_mfi_aen(struct drsas_instance *instance,
+		    uint32_t seq_num, uint32_t class_locale_word);
+static int	issue_mfi_pthru(struct drsas_instance *instance, struct
+		    drsas_ioctl *ioctl, struct drsas_cmd *cmd, int mode);
+static int	issue_mfi_dcmd(struct drsas_instance *instance, struct
+		    drsas_ioctl *ioctl, struct drsas_cmd *cmd, int mode);
+static int	issue_mfi_smp(struct drsas_instance *instance, struct
+		    drsas_ioctl *ioctl, struct drsas_cmd *cmd, int mode);
+static int	issue_mfi_stp(struct drsas_instance *instance, struct
+		    drsas_ioctl *ioctl, struct drsas_cmd *cmd, int mode);
+static int	abort_aen_cmd(struct drsas_instance *instance,
+		    struct drsas_cmd *cmd_to_abort);
+
+static int	drsas_common_check(struct drsas_instance *instance,
+		    struct  drsas_cmd *cmd);
+static void	drsas_fm_init(struct drsas_instance *instance);
+static void	drsas_fm_fini(struct drsas_instance *instance);
+static int	drsas_fm_error_cb(dev_info_t *, ddi_fm_error_t *,
+		    const void *);
+static void	drsas_fm_ereport(struct drsas_instance *instance,
+		    char *detail);
+static int	drsas_check_dma_handle(ddi_dma_handle_t handle);
+static int	drsas_check_acc_handle(ddi_acc_handle_t handle);
+
+static void	drsas_rem_intrs(struct drsas_instance *instance);
+static int	drsas_add_intrs(struct drsas_instance *instance, int intr_type);
+
+static void	drsas_tran_tgt_free(dev_info_t *, dev_info_t *,
+		    scsi_hba_tran_t *, struct scsi_device *);
+static int	drsas_tran_bus_config(dev_info_t *, uint_t,
+		    ddi_bus_config_op_t, void *, dev_info_t **);
+static int	drsas_parse_devname(char *, int *, int *);
+static int	drsas_config_all_devices(struct drsas_instance *);
+static int 	drsas_config_scsi_device(struct drsas_instance *,
+		    struct scsi_device *, dev_info_t **);
+static int 	drsas_config_ld(struct drsas_instance *, uint16_t,
+				uint8_t, dev_info_t **);
+static dev_info_t *drsas_find_child(struct drsas_instance *, uint16_t,
+			uint8_t);
+static int	drsas_name_node(dev_info_t *, char *, int);
+static void	drsas_issue_evt_taskq(struct drsas_eventinfo *);
+static int	drsas_service_evt(struct drsas_instance *, int, int, int,
+			uint64_t);
+static int	drsas_mode_sense_build(struct scsi_pkt *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _DR_SAS_H_ */
diff --git a/usr/src/uts/common/io/dr_sas/dr_sas_list.h b/usr/src/uts/common/io/dr_sas/dr_sas_list.h
new file mode 100644
index 0000000000..4154a77796
--- /dev/null
+++ b/usr/src/uts/common/io/dr_sas/dr_sas_list.h
@@ -0,0 +1,212 @@
+/*
+ * dr_sas_list.h: header for dr_sas
+ *
+ * Solaris MegaRAID driver for SAS2.0 controllers
+ * Copyright (c) 2008-2009, LSI Logic Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the author nor the names of its contributors may be
+ *    used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#ifndef	_DR_SAS_LIST_H_
+#define	_DR_SAS_LIST_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Simple doubly linked list implementation.
+ *
+ * Some of the internal functions ("__xxx") are useful when
+ * manipulating whole lists rather than single entries, as
+ * sometimes we already know the next/prev entries and we can
+ * generate better code by using them directly rather than
+ * using the generic single-entry routines.
+ */
+
+struct mlist_head {
+	struct mlist_head *next, *prev;
+};
+
+typedef struct mlist_head mlist_t;
+
+#define	LIST_HEAD_INIT(name) { &(name), &(name) }
+
+#define	LIST_HEAD(name) \
+	struct mlist_head name = LIST_HEAD_INIT(name)
+
+#define	INIT_LIST_HEAD(ptr) { \
+	(ptr)->next = (ptr); (ptr)->prev = (ptr); \
+}
+
+
+/*
+ * Insert a new entry between two known consecutive entries.
+ *
+ * This is only for internal list manipulation where we know
+ * the prev/next entries already!
+ */
+static void __list_add(struct mlist_head *new,
+	struct mlist_head *prev,
+	struct mlist_head *next)
+{
+	next->prev = new;
+	new->next = next;
+	new->prev = prev;
+	prev->next = new;
+}
+
+
+/*
+ * mlist_add - add a new entry
+ * @new: new entry to be added
+ * @head: list head to add it after
+ *
+ * Insert a new entry after the specified head.
+ * This is good for implementing stacks.
+ */
+static void mlist_add(struct mlist_head *new, struct mlist_head *head)
+{
+	__list_add(new, head, head->next);
+}
+
+
+/*
+ * mlist_add_tail - add a new entry
+ * @new: new entry to be added
+ * @head: list head to add it before
+ *
+ * Insert a new entry before the specified head.
+ * This is useful for implementing queues.
+ */
+static void mlist_add_tail(struct mlist_head *new, struct mlist_head *head)
+{
+	__list_add(new, head->prev, head);
+}
+
+
+
+/*
+ * Delete a list entry by making the prev/next entries
+ * point to each other.
+ *
+ * This is only for internal list manipulation where we know
+ * the prev/next entries already!
+ */
+static void __list_del(struct mlist_head *prev,
+			struct mlist_head *next)
+{
+	next->prev = prev;
+	prev->next = next;
+}
+
+
+/*
+ * mlist_del_init - deletes entry from list and reinitialize it.
+ * @entry: the element to delete from the list.
+ */
+static void mlist_del_init(struct mlist_head *entry)
+{
+	__list_del(entry->prev, entry->next);
+	INIT_LIST_HEAD(entry);
+}
+
+
+/*
+ * mlist_empty - tests whether a list is empty
+ * @head: the list to test.
+ */
+static int mlist_empty(struct mlist_head *head)
+{
+	return (head->next == head);
+}
+
+
+/*
+ * mlist_splice - join two lists
+ * @list: the new list to add.
+ * @head: the place to add it in the first list.
+ */
+static void mlist_splice(struct mlist_head *list, struct mlist_head *head)
+{
+	struct mlist_head *first = list->next;
+
+	if (first != list) {
+		struct mlist_head *last = list->prev;
+		struct mlist_head *at = head->next;
+
+		first->prev = head;
+		head->next = first;
+
+		last->next = at;
+		at->prev = last;
+	}
+}
+
+
+/*
+ * mlist_entry - get the struct for this entry
+ * @ptr:	the &struct mlist_head pointer.
+ * @type:	the type of the struct this is embedded in.
+ * @member:	the name of the list_struct within the struct.
+ */
+#define	mlist_entry(ptr, type, member) \
+	((type *)((size_t)(ptr) - offsetof(type, member)))
+
+
+/*
+ * mlist_for_each	-	iterate over a list
+ * @pos:	the &struct mlist_head to use as a loop counter.
+ * @head:	the head for your list.
+ */
+#define	mlist_for_each(pos, head) \
+	for (pos = (head)->next, prefetch(pos->next); pos != (head); \
+		pos = pos->next, prefetch(pos->next))
+
+
+/*
+ * mlist_for_each_safe - iterate over a list safe against removal of list entry
+ * @pos:	the &struct mlist_head to use as a loop counter.
+ * @n:		another &struct mlist_head to use as temporary storage
+ * @head:	the head for your list.
+ */
+#define	mlist_for_each_safe(pos, n, head) \
+	for (pos = (head)->next, n = pos->next; pos != (head); \
+		pos = n, n = pos->next)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DR_SAS_LIST_H_ */
diff --git a/usr/src/uts/common/io/elxl/elxl.c b/usr/src/uts/common/io/elxl/elxl.c
index 2ffe96aff3..42552225f8 100644
--- a/usr/src/uts/common/io/elxl/elxl.c
+++ b/usr/src/uts/common/io/elxl/elxl.c
@@ -1,6 +1,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -1163,8 +1164,7 @@ elxl_m_tx(void *arg, mblk_t *mp)
 		cflags = 0;
 		if ((sc->ex_conf & CONF_90XB) != 0) {
 			uint32_t	pflags;
-			hcksum_retrieve(mp, NULL, NULL, NULL, NULL, NULL, NULL,
-			    &pflags);
+			mac_hcksum_get(mp, NULL, NULL, NULL, NULL, &pflags);
 			if (pflags & HCK_IPV4_HDRCKSUM) {
 				cflags |= EX_DPD_IPCKSUM;
 			}
@@ -1327,7 +1327,7 @@ elxl_recv(elxl_t *sc, ex_desc_t *rxd, uint32_t stat)
 		if (stat & (EX_UPD_TCPCHECKED | EX_UPD_UDPCHECKED)) {
 			pflags |= (HCK_FULLCKSUM | HCK_FULLCKSUM_OK);
 		}
-		(void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0, pflags, 0);
+		mac_hcksum_set(mp, 0, 0, 0, 0, pflags);
 	}
 
 	return (mp);
diff --git a/usr/src/uts/common/io/eventfd.c b/usr/src/uts/common/io/eventfd.c
index 9b0840aa8b..e26cdfc78f 100644
--- a/usr/src/uts/common/io/eventfd.c
+++ b/usr/src/uts/common/io/eventfd.c
@@ -141,37 +141,39 @@ eventfd_read(dev_t dev, uio_t *uio, cred_t *cr)
 	 * transitions from EVENTFD_VALMAX to a lower value.  At all other
 	 * times, it is already considered writable by poll.
 	 */
-	if (oval == EVENTFD_VALMAX) {
+	if (oval >= EVENTFD_VALMAX) {
 		pollwakeup(&state->efd_pollhd, POLLWRNORM | POLLOUT);
 	}
 
 	return (err);
 }
 
-/*ARGSUSED*/
 static int
-eventfd_write(dev_t dev, struct uio *uio, cred_t *credp)
+eventfd_post(eventfd_state_t *state, uint64_t val, boolean_t is_async,
+    boolean_t file_nonblock)
 {
-	eventfd_state_t *state;
-	minor_t minor = getminor(dev);
-	uint64_t val, oval;
-	int err;
-
-	if (uio->uio_resid < sizeof (val))
-		return (EINVAL);
-
-	if ((err = uiomove(&val, sizeof (val), UIO_WRITE, uio)) != 0)
-		return (err);
-
-	if (val > EVENTFD_VALMAX)
-		return (EINVAL);
-
-	state = ddi_get_soft_state(eventfd_softstate, minor);
+	uint64_t oval;
+	boolean_t overflow = B_FALSE;
 
 	mutex_enter(&state->efd_lock);
 
 	while (val > EVENTFD_VALMAX - state->efd_value) {
-		if (uio->uio_fmode & (FNDELAY|FNONBLOCK)) {
+
+		/*
+		 * When called from (LX) AIO, expectations about overflow and
+		 * blocking are different than normal operation.  If the
+		 * incoming value would cause overflow, it is clamped to reach
+		 * the overflow value exactly.  This is added to the existing
+		 * value without blocking.  Any pollers of the eventfd will see
+		 * POLLERR asserted when this occurs.
+		 */
+		if (is_async) {
+			val = EVENTFD_VALOVERFLOW - state->efd_value;
+			overflow = B_TRUE;
+			break;
+		}
+
+		if (file_nonblock) {
 			mutex_exit(&state->efd_lock);
 			return (EAGAIN);
 		}
@@ -186,7 +188,7 @@ eventfd_write(dev_t dev, struct uio *uio, cred_t *credp)
 	}
 
 	/*
-	 * We now know that we can add the value without overflowing.
+	 * We now know that we can safely add the value.
 	 */
 	state->efd_value = (oval = state->efd_value) + val;
 
@@ -200,10 +202,13 @@ eventfd_write(dev_t dev, struct uio *uio, cred_t *credp)
 	mutex_exit(&state->efd_lock);
 
 	/*
-	 * Notify pollers as well if the eventfd is now readable.
+	 * Notify pollers as well if the eventfd has become readable or has
+	 * transitioned into overflow.
 	 */
 	if (oval == 0) {
 		pollwakeup(&state->efd_pollhd, POLLRDNORM | POLLIN);
+	} else if (overflow && val != 0) {
+		pollwakeup(&state->efd_pollhd, POLLERR);
 	}
 
 	return (0);
@@ -211,6 +216,29 @@ eventfd_write(dev_t dev, struct uio *uio, cred_t *credp)
 
 /*ARGSUSED*/
 static int
+eventfd_write(dev_t dev, struct uio *uio, cred_t *credp)
+{
+	eventfd_state_t *state;
+	boolean_t file_nonblock;
+	uint64_t val;
+	int err;
+
+	if (uio->uio_resid < sizeof (val))
+		return (EINVAL);
+
+	if ((err = uiomove(&val, sizeof (val), UIO_WRITE, uio)) != 0)
+		return (err);
+
+	if (val > EVENTFD_VALMAX)
+		return (EINVAL);
+
+	file_nonblock = (uio->uio_fmode & (FNDELAY|FNONBLOCK)) != 0;
+	state = ddi_get_soft_state(eventfd_softstate, getminor(dev));
+	return (eventfd_post(state, val, B_FALSE, file_nonblock));
+}
+
+/*ARGSUSED*/
+static int
 eventfd_poll(dev_t dev, short events, int anyyet, short *reventsp,
     struct pollhead **phpp)
 {
@@ -228,6 +256,9 @@ eventfd_poll(dev_t dev, short events, int anyyet, short *reventsp,
 	if (state->efd_value < EVENTFD_VALMAX)
 		revents |= POLLWRNORM | POLLOUT;
 
+	if (state->efd_value == EVENTFD_VALOVERFLOW)
+		revents |= POLLERR;
+
 	*reventsp = revents & events;
 	if ((*reventsp == 0 && !anyyet) || (events & POLLET)) {
 		*phpp = &state->efd_pollhd;
@@ -244,17 +275,28 @@ eventfd_ioctl(dev_t dev, int cmd, intptr_t arg, int md, cred_t *cr, int *rv)
 {
 	eventfd_state_t *state;
 	minor_t minor = getminor(dev);
+	uint64_t *valp;
 
 	state = ddi_get_soft_state(eventfd_softstate, minor);
 
 	switch (cmd) {
-	case EVENTFDIOC_SEMAPHORE: {
+	case EVENTFDIOC_SEMAPHORE:
 		mutex_enter(&state->efd_lock);
 		state->efd_semaphore ^= 1;
 		mutex_exit(&state->efd_lock);
+		return (0);
 
+	case EVENTFDIOC_POST:
+		/*
+		 * This ioctl is expected to be kernel-internal, used only by
+		 * the AIO emulation in LX.
+		 */
+		if ((md & FKIOCTL) == 0) {
+			break;
+		}
+		valp = (uint64_t *)arg;
+		VERIFY(eventfd_post(state, *valp, B_TRUE, B_FALSE) == 0);
 		return (0);
-	}
 
 	default:
 		break;
diff --git a/usr/src/uts/common/io/fibre-channel/impl/fctl.c b/usr/src/uts/common/io/fibre-channel/impl/fctl.c
index 4c2a39013a..eb2a0c2ec5 100644
--- a/usr/src/uts/common/io/fibre-channel/impl/fctl.c
+++ b/usr/src/uts/common/io/fibre-channel/impl/fctl.c
@@ -24,6 +24,7 @@
  */
 /*
  * Copyright 2012 Garrett D'Amore <garrett@damore.org>.  All rights reserved.
+ * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
  */
 /*
  * Fibre channel Transport Library (fctl)
@@ -5500,6 +5501,11 @@ fc_ulp_get_adapter_paths(char *pathList, int count)
 		maxPorts ++;
 	}
 
+	if (maxPorts == 0) {
+		mutex_exit(&fctl_port_lock);
+		return (0);
+	}
+
 	/* Now allocate a buffer to store all the pointers for comparisons */
 	portList = kmem_zalloc(sizeof (fc_local_port_t *) * maxPorts, KM_SLEEP);
 
diff --git a/usr/src/uts/common/io/gld.c b/usr/src/uts/common/io/gld.c
index c6c6b65900..5502ea54af 100644
--- a/usr/src/uts/common/io/gld.c
+++ b/usr/src/uts/common/io/gld.c
@@ -22,6 +22,7 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright (c) 2016 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -4550,8 +4551,7 @@ gld_unitdata(queue_t *q, mblk_t *mp)
 	ifp = ((gld_mac_pvt_t *)macinfo->gldm_mac_pvt)->interfacep;
 
 	/* grab any checksum information that may be present */
-	hcksum_retrieve(mp->b_cont, NULL, NULL, &start, &stuff, &end,
-	    &value, &flags);
+	mac_hcksum_get(mp->b_cont, &start, &stuff, &end, &value, &flags);
 
 	/*
 	 * Prepend a valid header for transmission
@@ -4567,8 +4567,7 @@ gld_unitdata(queue_t *q, mblk_t *mp)
 	}
 
 	/* apply any checksum information to the first block in the chain */
-	(void) hcksum_assoc(nmp, NULL, NULL, start, stuff, end, value,
-	    flags, 0);
+	mac_hcksum_set(nmp, start, stuff, end, value, flags);
 
 	GLD_CLEAR_MBLK_VTAG(nmp);
 	if (gld_start(q, nmp, GLD_WSRV, upri) == GLD_NORESOURCES) {
diff --git a/usr/src/uts/common/io/gsqueue/gsqueue.c b/usr/src/uts/common/io/gsqueue/gsqueue.c
new file mode 100644
index 0000000000..03bb799499
--- /dev/null
+++ b/usr/src/uts/common/io/gsqueue/gsqueue.c
@@ -0,0 +1,608 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * Serialization queues are a technique used in illumos to provide what's
+ * commonly known as a 'vertical' perimeter. The idea (described a bit in
+ * uts/common/inet/squeue.c) is to provide a means to make sure that message
+ * blocks (mblk_t) are processed in a specific order. Subsystems like ip and vnd
+ * consume these on different policies, ip on a conn_t basis, vnd on a per
+ * device basis, and use this to ensure that only one packet is being processed
+ * at a given time.
+ *
+ * Serialization queues were originally used by ip. As part of that
+ * implementation, many of the details of ip were baked into it. That includes
+ * things like conn_t, ip receive attributes, and the notion of sets. While an
+ * individual serialization queue, or gsqueue_t, is a useful level of
+ * abstraction, it isn't the basis on which monst consumers want to manage them.
+ * Instead, we have the notion of a set of serialization queues. These sets are
+ * DR (CPU Dynamic reconfiguration) aware, and allow consumers to have a
+ * gsqueue_t per CPU to fanout on without managing them all itself. In the
+ * original implementation, this existed, but they were heavily tied into the
+ * infrastructure of IP, and its notion of polling on the underlying MAC
+ * devices.
+ *
+ * The result of that past is a new interface to serialization queues and a
+ * similar, but slightly different, abstraction to sets of these
+ * (gsqueue_set_t).  When designing this there are two different approaches that
+ * one could consider. The first is that the system has one gsqueue_set_t that
+ * the entire world shares, whether IP or some other consumer. The other is that
+ * every consumer has their own set.
+ *
+ * The trade offs between these two failure modes are the pathological failure
+ * modes. There is no guarantee that any two consumers here are equivalent. In
+ * fact, they very likely have very different latency profiles. If they are
+ * being processed in the same queue, that can lead to very odd behaviors. More
+ * generally, if we have a series of processing functions from one consumer
+ * which are generally short, and another which are generally long, that'll
+ * cause undue latency that's harder to observe. If we instead take the approach
+ * that each consumer should have its own set that it fans out over then we
+ * won't end up with the problem that a given serialization queue will have
+ * multiple latency profiles, but instead we'll see cpu contention for the bound
+ * gsqueue_t worker thread. Keep in mind though, that only the gsqueue_t worker
+ * thread is bound and it is in fact possible for it to be processed by other
+ * threads on other CPUs.
+ *
+ * We've opted to go down the second path, so each consumer has its own
+ * independent set of serialization queues that it is bound over.
+ *
+ * Structure Hierarchies
+ * ---------------------
+ *
+ * At the top level, we have a single list of gsqueue_set_t. The gsqueue_set_t
+ * encapsulates all the per-CPU gsqueue_t that exist in the form of
+ * gsqueue_cpu_t.  The gsqueue_cpu_t has been designed such that it could
+ * accommodate more than one gsqueue_t, but today there is a one to one mapping.
+ *
+ * We maintain two different lists of gsqueue_cpu_t, the active and defunct
+ * sets. The active set is maintained in the array `gs_cpus`. There are NCPU
+ * entries available in `gs_cpus` with the total number of currently active cpus
+ * described in `gs_ncpus`. The ordering of `gs_cpus` is unimportant.  When
+ * there is no longer a need for a given binding (see the following section for
+ * more explanation on when this is the case) then we move the entry to the
+ * `gs_defunct` list which is just a list_t of gsqueue_cpu_t.
+ *
+ * In addition, each gsqueue_set_t can have a series of callbacks registered
+ * with it. These are described in the following section. Graphically, a given
+ * gsqueue_set_t looks roughly like the following:
+ *
+ *     +---------------+
+ *     | gsqueue_set_t |
+ *     +---------------+
+ *       |    |     |
+ *       |    |     * . . . gs_cpus
+ *       |    |     |
+ *       |    |     |    +-------------------------------------------------+
+ *       |    |     +--->| gsqueue_cpu_t || gsqueue_cpu_t || gsqueue_cpu_t |...
+ *       |    |          +-------------------------------------------------+
+ *       |    |
+ *       |    * . . . gs_defunct
+ *       |    |
+ *       |    |    +---------------+   +---------------+   +---------------+
+ *       |    +--->| gsqueue_cpu_t |-->| gsqueue_cpu_t |-->| gsqueue_cpu_t |...
+ *       |         +---------------+   +---------------+   +---------------+
+ *       * . . . gs_cbs
+ *       |
+ *       |    +--------------+   +--------------+  +--------------+
+ *       +--->| gsqueue_cb_t |-->| gsqueue_cb_t |->| gsqueue_cb_t |...
+ *            +--------------+   +--------------+  +--------------+
+ *
+ * CPU DR, gsqueue_t, and gsqueue_t
+ * --------------------------------
+ *
+ * Recall, that every serialization queue (gsqueue_t or squeue_t) has a worker
+ * thread that may end up doing work. As part of supporting fanout, we have one
+ * gsqueue_t per CPU, and its worker thread is bound to that CPU. Because of
+ * this binding, we need to deal with CPU DR changes.
+ *
+ * The gsqueue driver maintains a single CPU DR callback that is used for the
+ * entire sub-system. We break down CPU DR events into three groups. Offline
+ * events, online events, and events we can ignore. When the first group occurs,
+ * we need to go through every gsqueue_t, find the gsqueue_cpu_t that
+ * corresponds to that processor id, and unbind all of its gsqueue_t's. It's
+ * rather important that we only unbind the gsqueue_t's and not actually destroy
+ * them. When this happens, they could very easily have data queued inside of
+ * them and it's unreasonable to just throw out everything in them at this
+ * point. The data remains intact and service continues uinterrupted.
+ *
+ * When we receive an online event, we do the opposite. We try to find a
+ * gsqueue_cpu_t that previously was bound to this CPU (by leaving its gqc_cpuid
+ * field intact) in the defunct list. If we find one, we remove it from the
+ * defunct list and add it to the active list as well as binding the gsqueue_t
+ * to the CPU in question. If we don't find one, then we create a new one.
+ *
+ * To deal with these kinds of situations, we allow a consumer to register
+ * callbacks for the gsqueue_t that they are interested in. These callbacks will
+ * fire whenever we are handling a topology change. The design of the callbacks
+ * is not that the user can take any administrative action during them, but
+ * rather set something for them to do asynchronously. It is illegal to make any
+ * calls into the gsqueue system while you are in a callback.
+ *
+ * Locking
+ * -------
+ *
+ * The lock ordering here is fairly straightforward. Due to our use of CPU
+ * binding and the CPU DR callbacks, we have an additional lock to consider
+ * cpu_lock. Because of that, the following are the rules for locking:
+ *
+ *
+ *   o If performing binding operations, you must grab cpu_lock. cpu_lock is
+ *     also at the top of the order.
+ *
+ *   o cpu_lock > gsqueue_lock > gsqueue_t`gs_lock > squeue_t`sq_lock
+ *     If you need to take multiple locks, you must take the greatest
+ *     (left-most) one first.
+ */
+
+#include <sys/types.h>
+#include <sys/conf.h>
+#include <sys/stat.h>
+#include <sys/kmem.h>
+#include <sys/stream.h>
+#include <sys/modctl.h>
+#include <sys/cpuvar.h>
+#include <sys/list.h>
+#include <sys/sysmacros.h>
+
+#include <sys/gsqueue.h>
+#include <sys/squeue_impl.h>
+
+typedef struct gsqueue_cb {
+	struct gsqueue_cb *gcb_next;
+	gsqueue_cb_f gcb_func;
+	void *gcb_arg;
+} gsqueue_cb_t;
+
+typedef struct gsqueue_cpu {
+	list_node_t gqc_lnode;
+	squeue_t *gqc_head;
+	processorid_t gqc_cpuid;
+} gsqueue_cpu_t;
+
+struct gsqueue_set {
+	list_node_t gs_next;
+	pri_t gs_wpri;
+	kmutex_t gs_lock;
+	int gs_ncpus;
+	gsqueue_cpu_t **gs_cpus;
+	list_t gs_defunct;
+	gsqueue_cb_t *gs_cbs;
+};
+
+static kmutex_t gsqueue_lock;
+static list_t gsqueue_list;
+static kmem_cache_t *gsqueue_cb_cache;
+static kmem_cache_t *gsqueue_cpu_cache;
+static kmem_cache_t *gsqueue_set_cache;
+
+static gsqueue_cpu_t *
+gsqueue_cpu_create(pri_t wpri, processorid_t cpuid)
+{
+	gsqueue_cpu_t *scp;
+
+	scp = kmem_cache_alloc(gsqueue_cpu_cache, KM_SLEEP);
+
+	list_link_init(&scp->gqc_lnode);
+	scp->gqc_cpuid = cpuid;
+	scp->gqc_head = squeue_create(wpri, B_FALSE);
+	scp->gqc_head->sq_state = SQS_DEFAULT;
+	squeue_bind(scp->gqc_head, cpuid);
+
+	return (scp);
+}
+
+static void
+gsqueue_cpu_destroy(gsqueue_cpu_t *scp)
+{
+	squeue_destroy(scp->gqc_head);
+	kmem_cache_free(gsqueue_cpu_cache, scp);
+}
+
+gsqueue_set_t *
+gsqueue_set_create(pri_t wpri)
+{
+	int i;
+	gsqueue_set_t *gssp;
+
+	gssp = kmem_cache_alloc(gsqueue_set_cache, KM_SLEEP);
+	gssp->gs_wpri = wpri;
+	gssp->gs_ncpus = 0;
+
+	/*
+	 * We're grabbing CPU lock. Once we let go of it we have to ensure all
+	 * set up of the gsqueue_set_t is complete, as it'll be in there for the
+	 * various CPU DR bits.
+	 */
+	mutex_enter(&cpu_lock);
+
+	for (i = 0; i < NCPU; i++) {
+		gsqueue_cpu_t *scp;
+		cpu_t *cp = cpu_get(i);
+		if (cp != NULL && CPU_ACTIVE(cp) &&
+		    cp->cpu_flags & CPU_EXISTS) {
+			scp = gsqueue_cpu_create(wpri, cp->cpu_id);
+			gssp->gs_cpus[gssp->gs_ncpus] = scp;
+			gssp->gs_ncpus++;
+		}
+	}
+
+	/* Finally we can add it to our global list and be done */
+	mutex_enter(&gsqueue_lock);
+	list_insert_tail(&gsqueue_list, gssp);
+	mutex_exit(&gsqueue_lock);
+	mutex_exit(&cpu_lock);
+
+	return (gssp);
+}
+
+void
+gsqueue_set_destroy(gsqueue_set_t *gssp)
+{
+	int i;
+	gsqueue_cpu_t *scp;
+
+	/*
+	 * Go through and unbind all of the squeues while cpu_lock is held and
+	 * move them to the defunct list. Once that's done, we don't need to do
+	 * anything else with cpu_lock.
+	 */
+	mutex_enter(&cpu_lock);
+	mutex_enter(&gsqueue_lock);
+	list_remove(&gsqueue_list, gssp);
+	mutex_exit(&gsqueue_lock);
+
+	mutex_enter(&gssp->gs_lock);
+
+	for (i = 0; i < gssp->gs_ncpus; i++) {
+		scp = gssp->gs_cpus[i];
+		squeue_unbind(scp->gqc_head);
+		list_insert_tail(&gssp->gs_defunct, scp);
+		gssp->gs_cpus[i] = NULL;
+	}
+	gssp->gs_ncpus = 0;
+
+	mutex_exit(&gssp->gs_lock);
+	mutex_exit(&cpu_lock);
+
+	while ((scp = list_remove_head(&gssp->gs_defunct)) != NULL) {
+		gsqueue_cpu_destroy(scp);
+	}
+
+	while (gssp->gs_cbs != NULL) {
+		gsqueue_cb_t *cbp;
+
+		cbp = gssp->gs_cbs;
+		gssp->gs_cbs = cbp->gcb_next;
+		kmem_cache_free(gsqueue_cb_cache, cbp);
+	}
+
+	ASSERT3U(gssp->gs_ncpus, ==, 0);
+	ASSERT3P(list_head(&gssp->gs_defunct), ==, NULL);
+	ASSERT3P(gssp->gs_cbs, ==, NULL);
+	kmem_cache_free(gsqueue_set_cache, gssp);
+}
+
+gsqueue_t *
+gsqueue_set_get(gsqueue_set_t *gssp, uint_t index)
+{
+	squeue_t *sqp;
+	gsqueue_cpu_t *scp;
+
+	mutex_enter(&gssp->gs_lock);
+	scp = gssp->gs_cpus[index % gssp->gs_ncpus];
+	sqp = scp->gqc_head;
+	mutex_exit(&gssp->gs_lock);
+	return ((gsqueue_t *)sqp);
+}
+
+uintptr_t
+gsqueue_set_cb_add(gsqueue_set_t *gssp, gsqueue_cb_f cb, void *arg)
+{
+	gsqueue_cb_t *cbp;
+
+	cbp = kmem_cache_alloc(gsqueue_cb_cache, KM_SLEEP);
+	cbp->gcb_func = cb;
+	cbp->gcb_arg = arg;
+
+	mutex_enter(&gssp->gs_lock);
+	cbp->gcb_next = gssp->gs_cbs;
+	gssp->gs_cbs = cbp;
+	mutex_exit(&gssp->gs_lock);
+	return ((uintptr_t)cbp);
+}
+
+int
+gsqueue_set_cb_remove(gsqueue_set_t *gssp, uintptr_t id)
+{
+	gsqueue_cb_t *cbp, *prev;
+	mutex_enter(&gssp->gs_lock);
+	cbp = gssp->gs_cbs;
+	prev = NULL;
+	while (cbp != NULL) {
+		if ((uintptr_t)cbp != id) {
+			prev = cbp;
+			cbp = cbp->gcb_next;
+			continue;
+		}
+
+		if (prev == NULL) {
+			gssp->gs_cbs = cbp->gcb_next;
+		} else {
+			prev->gcb_next = cbp->gcb_next;
+		}
+
+		mutex_exit(&gssp->gs_lock);
+		kmem_cache_free(gsqueue_cb_cache, cbp);
+		return (0);
+	}
+	mutex_exit(&gssp->gs_lock);
+	return (-1);
+}
+
+void
+gsqueue_enter_one(gsqueue_t *gsp, mblk_t *mp, gsqueue_proc_f func, void *arg,
+    int flags, uint8_t tag)
+{
+	squeue_t *sqp = (squeue_t *)gsp;
+
+	ASSERT(mp->b_next == NULL);
+	ASSERT(mp->b_prev == NULL);
+	mp->b_queue = (queue_t *)func;
+	mp->b_prev = arg;
+	sqp->sq_enter(sqp, mp, mp, 1, NULL, flags, tag);
+}
+
+static void
+gsqueue_notify(gsqueue_set_t *gssp, squeue_t *sqp, boolean_t online)
+{
+	gsqueue_cb_t *cbp;
+
+	ASSERT(MUTEX_HELD(&gssp->gs_lock));
+	cbp = gssp->gs_cbs;
+	while (cbp != NULL) {
+		cbp->gcb_func(gssp, (gsqueue_t *)sqp, cbp->gcb_arg, online);
+		cbp = cbp->gcb_next;
+	}
+
+}
+
+/*
+ * When we online a processor we need to go through and either bind a defunct
+ * squeue or create a new one. We'll try to reuse a gsqueue_cpu_t from the
+ * defunct list that used to be on that processor. If no such gsqueue_cpu_t
+ * exists, then we'll create a new one. We'd rather avoid taking over an
+ * existing defunct one that used to be on another CPU, as its not unreasonable
+ * to believe that its CPU will come back. More CPUs are offlined and onlined by
+ * the administrator or by creating cpu sets than actually get offlined by FMA.
+ */
+static void
+gsqueue_handle_online(processorid_t id)
+{
+	gsqueue_set_t *gssp;
+
+	ASSERT(MUTEX_HELD(&cpu_lock));
+	mutex_enter(&gsqueue_lock);
+	for (gssp = list_head(&gsqueue_list); gssp != NULL;
+	    gssp = list_next(&gsqueue_list, gssp)) {
+		gsqueue_cpu_t *scp;
+
+		mutex_enter(&gssp->gs_lock);
+		for (scp = list_head(&gssp->gs_defunct); scp != NULL;
+		    scp = list_next(&gssp->gs_defunct, scp)) {
+			if (scp->gqc_cpuid == id) {
+				list_remove(&gssp->gs_defunct, scp);
+				break;
+			}
+		}
+
+		if (scp == NULL) {
+			scp = gsqueue_cpu_create(gssp->gs_wpri, id);
+		} else {
+			squeue_bind(scp->gqc_head, id);
+		}
+
+		ASSERT(gssp->gs_ncpus < NCPU);
+		gssp->gs_cpus[gssp->gs_ncpus] = scp;
+		gssp->gs_ncpus++;
+		gsqueue_notify(gssp, scp->gqc_head, B_TRUE);
+		mutex_exit(&gssp->gs_lock);
+	}
+	mutex_exit(&gsqueue_lock);
+}
+
+static void
+gsqueue_handle_offline(processorid_t id)
+{
+	gsqueue_set_t *gssp;
+
+	ASSERT(MUTEX_HELD(&cpu_lock));
+	mutex_enter(&gsqueue_lock);
+	for (gssp = list_head(&gsqueue_list); gssp != NULL;
+	    gssp = list_next(&gsqueue_list, gssp)) {
+		int i;
+		gsqueue_cpu_t *scp = NULL;
+
+		mutex_enter(&gssp->gs_lock);
+		for (i = 0; i < gssp->gs_ncpus; i++) {
+			if (gssp->gs_cpus[i]->gqc_cpuid == id) {
+				scp = gssp->gs_cpus[i];
+				break;
+			}
+		}
+
+		if (scp != NULL) {
+			squeue_unbind(scp->gqc_head);
+			list_insert_tail(&gssp->gs_defunct, scp);
+			gssp->gs_cpus[i] = gssp->gs_cpus[gssp->gs_ncpus-1];
+			gssp->gs_ncpus--;
+			gsqueue_notify(gssp, scp->gqc_head, B_FALSE);
+		}
+		mutex_exit(&gssp->gs_lock);
+	}
+	mutex_exit(&gsqueue_lock);
+}
+
+/* ARGSUSED */
+static int
+gsqueue_cpu_setup(cpu_setup_t what, int id, void *unused)
+{
+	cpu_t *cp;
+
+	ASSERT(MUTEX_HELD(&cpu_lock));
+	cp = cpu_get(id);
+	switch (what) {
+	case CPU_CONFIG:
+	case CPU_ON:
+	case CPU_INIT:
+	case CPU_CPUPART_IN:
+		if (cp != NULL && CPU_ACTIVE(cp) && cp->cpu_flags & CPU_EXISTS)
+			gsqueue_handle_online(cp->cpu_id);
+		break;
+	case CPU_UNCONFIG:
+	case CPU_OFF:
+	case CPU_CPUPART_OUT:
+		gsqueue_handle_offline(cp->cpu_id);
+		break;
+	default:
+		break;
+	}
+
+	return (0);
+}
+
+
+/* ARGSUSED */
+static int
+gsqueue_set_cache_construct(void *buf, void *arg, int kmflags)
+{
+	gsqueue_set_t *gssp = buf;
+
+	gssp->gs_cpus = kmem_alloc(sizeof (gsqueue_cpu_t *) * NCPU, kmflags);
+	if (gssp->gs_cpus == NULL)
+		return (-1);
+
+	mutex_init(&gssp->gs_lock, NULL, MUTEX_DRIVER, NULL);
+	list_create(&gssp->gs_defunct, sizeof (gsqueue_cpu_t),
+	    offsetof(gsqueue_cpu_t, gqc_lnode));
+	gssp->gs_ncpus = 0;
+	gssp->gs_cbs = NULL;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+gsqueue_set_cache_destruct(void *buf, void *arg)
+{
+	gsqueue_set_t *gssp = buf;
+
+	kmem_free(gssp->gs_cpus, sizeof (gsqueue_cpu_t *) * NCPU);
+	gssp->gs_cpus = NULL;
+	list_destroy(&gssp->gs_defunct);
+	mutex_destroy(&gssp->gs_lock);
+}
+
+static void
+gsqueue_ddiinit(void)
+{
+	list_create(&gsqueue_list, sizeof (gsqueue_set_t),
+	    offsetof(gsqueue_set_t, gs_next));
+	mutex_init(&gsqueue_lock, NULL, MUTEX_DRIVER, NULL);
+
+	gsqueue_cb_cache = kmem_cache_create("gsqueue_cb_cache",
+	    sizeof (gsqueue_cb_t),
+	    0, NULL, NULL, NULL, NULL, NULL, 0);
+	gsqueue_cpu_cache = kmem_cache_create("gsqueue_cpu_cache",
+	    sizeof (gsqueue_cpu_t),
+	    0, NULL, NULL, NULL, NULL, NULL, 0);
+	gsqueue_set_cache = kmem_cache_create("squeue_set_cache",
+	    sizeof (gsqueue_set_t),
+	    0, gsqueue_set_cache_construct, gsqueue_set_cache_destruct,
+	    NULL, NULL, NULL, 0);
+
+
+	mutex_enter(&cpu_lock);
+	register_cpu_setup_func(gsqueue_cpu_setup, NULL);
+	mutex_exit(&cpu_lock);
+}
+
+static int
+gsqueue_ddifini(void)
+{
+	mutex_enter(&gsqueue_lock);
+	if (list_is_empty(&gsqueue_list) == 0) {
+		mutex_exit(&gsqueue_lock);
+		return (EBUSY);
+	}
+	list_destroy(&gsqueue_list);
+	mutex_exit(&gsqueue_lock);
+
+	mutex_enter(&cpu_lock);
+	register_cpu_setup_func(gsqueue_cpu_setup, NULL);
+	mutex_exit(&cpu_lock);
+
+	kmem_cache_destroy(gsqueue_set_cache);
+	kmem_cache_destroy(gsqueue_cpu_cache);
+	kmem_cache_destroy(gsqueue_cb_cache);
+
+	mutex_destroy(&gsqueue_lock);
+
+	return (0);
+}
+
+static struct modlmisc		gsqueue_modmisc = {
+	&mod_miscops,
+	"gsqueue"
+};
+
+static struct modlinkage	gsqueue_modlinkage = {
+	MODREV_1,
+	&gsqueue_modmisc,
+	NULL
+};
+
+int
+_init(void)
+{
+	int ret;
+
+	gsqueue_ddiinit();
+	if ((ret = mod_install(&gsqueue_modlinkage)) != 0) {
+		VERIFY(gsqueue_ddifini() == 0);
+		return (ret);
+	}
+
+	return (ret);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&gsqueue_modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int ret;
+
+	if ((ret = gsqueue_ddifini()) != 0)
+		return (ret);
+
+	if ((ret = mod_remove(&gsqueue_modlinkage)) != 0)
+		return (ret);
+
+	return (0);
+}
diff --git a/usr/src/uts/common/io/i40e/core/i40e_adminq_cmd.h b/usr/src/uts/common/io/i40e/core/i40e_adminq_cmd.h
index fc70dc5891..49eb7caf4b 100644
--- a/usr/src/uts/common/io/i40e/core/i40e_adminq_cmd.h
+++ b/usr/src/uts/common/io/i40e/core/i40e_adminq_cmd.h
@@ -242,6 +242,8 @@ enum i40e_admin_queue_opc {
 	i40e_aqc_opc_set_phy_debug		= 0x0622,
 	i40e_aqc_opc_upload_ext_phy_fm		= 0x0625,
 	i40e_aqc_opc_run_phy_activity		= 0x0626,
+	i40e_aqc_opc_set_phy_register		= 0x0628,
+	i40e_aqc_opc_get_phy_register		= 0x0629,
 
 	/* NVM commands */
 	i40e_aqc_opc_nvm_read			= 0x0701,
@@ -1992,6 +1994,24 @@ struct i40e_aqc_run_phy_activity {
 
 I40E_CHECK_CMD_LENGTH(i40e_aqc_run_phy_activity);
 
+
+/* Set PHY Register command (0x0628) */
+/* Get PHY Register command (0x0629) */
+struct i40e_aqc_phy_register_access {
+	u8	phy_interface;
+#define I40E_AQ_PHY_REG_ACCESS_INTERNAL	0
+#define I40E_AQ_PHY_REG_ACCESS_EXTERNAL	1
+#define I40E_AQ_PHY_REG_ACCESS_EXTERNAL_MODULE	2
+	u8	dev_addres;
+	u8	reserved1[2];
+	u32	reg_address;
+	u32	reg_value;
+	u8	reserved2[4];
+};
+
+I40E_CHECK_CMD_LENGTH(i40e_aqc_phy_register_access);
+
+
 /* NVM Read command (indirect 0x0701)
  * NVM Erase commands (direct 0x0702)
  * NVM Update commands (indirect 0x0703)
diff --git a/usr/src/uts/common/io/i40e/core/i40e_common.c b/usr/src/uts/common/io/i40e/core/i40e_common.c
index df50677faa..f4dd8da819 100644
--- a/usr/src/uts/common/io/i40e/core/i40e_common.c
+++ b/usr/src/uts/common/io/i40e/core/i40e_common.c
@@ -6563,6 +6563,76 @@ do_retry:
 		wr32(hw, reg_addr, reg_val);
 }
 
+
+/**
+ * i40e_aq_set_phy_register
+ * @hw: pointer to the hw struct
+ * @phy_select: select which phy should be accessed
+ * @dev_addr: PHY device address
+ * @reg_addr: PHY register address
+ * @reg_val: new register value
+ * @cmd_details: pointer to command details structure or NULL
+ *
+ * Write the external PHY register.
+ **/
+enum i40e_status_code i40e_aq_set_phy_register(struct i40e_hw *hw,
+				u8 phy_select, u8 dev_addr,
+				u32 reg_addr, u32 reg_val,
+				struct i40e_asq_cmd_details *cmd_details)
+{
+	struct i40e_aq_desc desc;
+	struct i40e_aqc_phy_register_access *cmd =
+		(struct i40e_aqc_phy_register_access *)&desc.params.raw;
+	enum i40e_status_code status;
+
+	i40e_fill_default_direct_cmd_desc(&desc,
+					  i40e_aqc_opc_set_phy_register);
+
+	cmd->phy_interface = phy_select;
+	cmd->dev_addres = dev_addr;
+	cmd->reg_address = reg_addr;
+	cmd->reg_value = reg_val;
+
+	status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details);
+
+	return status;
+}
+
+/**
+ * i40e_aq_get_phy_register
+ * @hw: pointer to the hw struct
+ * @phy_select: select which phy should be accessed
+ * @dev_addr: PHY device address
+ * @reg_addr: PHY register address
+ * @reg_val: read register value
+ * @cmd_details: pointer to command details structure or NULL
+ *
+ * Read the external PHY register.
+ **/
+enum i40e_status_code i40e_aq_get_phy_register(struct i40e_hw *hw,
+				u8 phy_select, u8 dev_addr,
+				u32 reg_addr, u32 *reg_val,
+				struct i40e_asq_cmd_details *cmd_details)
+{
+	struct i40e_aq_desc desc;
+	struct i40e_aqc_phy_register_access *cmd =
+		(struct i40e_aqc_phy_register_access *)&desc.params.raw;
+	enum i40e_status_code status;
+
+	i40e_fill_default_direct_cmd_desc(&desc,
+					  i40e_aqc_opc_get_phy_register);
+
+	cmd->phy_interface = phy_select;
+	cmd->dev_addres = dev_addr;
+	cmd->reg_address = reg_addr;
+
+	status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details);
+	if (!status)
+		*reg_val = cmd->reg_value;
+
+	return status;
+}
+
 /**
  * i40e_aq_set_arp_proxy_config
  * @hw: pointer to the HW structure
diff --git a/usr/src/uts/common/io/i40e/core/i40e_prototype.h b/usr/src/uts/common/io/i40e/core/i40e_prototype.h
index c90a03c259..08433ebd11 100644
--- a/usr/src/uts/common/io/i40e/core/i40e_prototype.h
+++ b/usr/src/uts/common/io/i40e/core/i40e_prototype.h
@@ -502,6 +502,15 @@ enum i40e_status_code i40e_aq_rx_ctl_write_register(struct i40e_hw *hw,
 				u32 reg_addr, u32 reg_val,
 				struct i40e_asq_cmd_details *cmd_details);
 void i40e_write_rx_ctl(struct i40e_hw *hw, u32 reg_addr, u32 reg_val);
+enum i40e_status_code i40e_aq_set_phy_register(struct i40e_hw *hw,
+				u8 phy_select, u8 dev_addr,
+				u32 reg_addr, u32 reg_val,
+				struct i40e_asq_cmd_details *cmd_details);
+enum i40e_status_code i40e_aq_get_phy_register(struct i40e_hw *hw,
+				u8 phy_select, u8 dev_addr,
+				u32 reg_addr, u32 *reg_val,
+				struct i40e_asq_cmd_details *cmd_details);
+
 enum i40e_status_code i40e_aq_set_arp_proxy_config(struct i40e_hw *hw,
 			struct i40e_aqc_arp_proxy_data *proxy_config,
 			struct i40e_asq_cmd_details *cmd_details);
diff --git a/usr/src/uts/common/io/i40e/i40e_gld.c b/usr/src/uts/common/io/i40e/i40e_gld.c
index 9c7f860081..e2a5ef1541 100644
--- a/usr/src/uts/common/io/i40e/i40e_gld.c
+++ b/usr/src/uts/common/io/i40e/i40e_gld.c
@@ -11,7 +11,7 @@
 
 /*
  * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright 2017 Tegile Systems, Inc.  All rights reserved.
  */
 
@@ -582,6 +582,15 @@ i40e_transceiver_info(void *arg, uint_t id, mac_transceiver_info_t *infop)
 		return (EINVAL);
 
 	mutex_enter(&i40e->i40e_general_lock);
+	switch (i40e->i40e_hw_space.phy.link_info.module_type[0]) {
+	case I40E_MODULE_TYPE_SFP:
+	case I40E_MODULE_TYPE_QSFP:
+		break;
+	default:
+		mutex_exit(&i40e->i40e_general_lock);
+		return (ENOTSUP);
+	}
+
 	present = !!(i40e->i40e_hw_space.phy.link_info.link_info &
 	    I40E_AQ_MEDIA_AVAILABLE);
 	if (present) {
@@ -599,6 +608,69 @@ i40e_transceiver_info(void *arg, uint_t id, mac_transceiver_info_t *infop)
 }
 
 static int
+i40e_transceiver_read(void *arg, uint_t id, uint_t page, void *buf,
+    size_t nbytes, off_t offset, size_t *nread)
+{
+	i40e_t *i40e = arg;
+	struct i40e_hw *hw = &i40e->i40e_hw_space;
+	uint8_t *buf8 = buf;
+	size_t i;
+
+	if (id != 0 || buf == NULL || nbytes == 0 || nread == NULL ||
+	    (page != 0xa0 && page != 0xa2) || offset < 0)
+		return (EINVAL);
+
+	/*
+	 * Both supported pages have a length of 256 bytes, ensure nothing asks
+	 * us to go beyond that.
+	 */
+	if (nbytes > 256 || offset >= 256 || (offset + nbytes > 256)) {
+		return (EINVAL);
+	}
+
+	mutex_enter(&i40e->i40e_general_lock);
+	switch (i40e->i40e_hw_space.phy.link_info.module_type[0]) {
+	case I40E_MODULE_TYPE_SFP:
+	case I40E_MODULE_TYPE_QSFP:
+		break;
+	default:
+		mutex_exit(&i40e->i40e_general_lock);
+		return (ENOTSUP);
+	}
+
+	/*
+	 * Make sure we have a sufficiently new firmware version to run this
+	 * command. This was introduced in firmware API 1.7. This is apparently
+	 * only supported on the XL710 MAC, not the XL722.
+	 */
+	if (hw->mac.type != I40E_MAC_XL710 || hw->aq.api_maj_ver != 1 ||
+	    hw->aq.api_min_ver < 7) {
+		mutex_exit(&i40e->i40e_general_lock);
+		return (ENOTSUP);
+	}
+
+	for (i = 0; i < nbytes; i++, offset++) {
+		enum i40e_status_code status;
+		uint32_t val;
+
+		status = i40e_aq_get_phy_register(hw,
+		    I40E_AQ_PHY_REG_ACCESS_EXTERNAL_MODULE, page, offset,
+		    &val, NULL);
+		if (status != I40E_SUCCESS) {
+			mutex_exit(&i40e->i40e_general_lock);
+			return (EIO);
+		}
+
+		buf8[i] = (uint8_t)val;
+	}
+
+	mutex_exit(&i40e->i40e_general_lock);
+	*nread = nbytes;
+
+	return (0);
+}
+
+static int
 i40e_gld_led_set(void *arg, mac_led_mode_t mode, uint_t flags)
 {
 	i40e_t *i40e = arg;
@@ -660,6 +732,18 @@ i40e_m_getcapab(void *arg, mac_capab_t cap, void *cap_data)
 		break;
 	}
 
+	case MAC_CAPAB_LSO: {
+		mac_capab_lso_t *cap_lso = cap_data;
+
+		if (i40e->i40e_tx_lso_enable == B_TRUE) {
+			cap_lso->lso_flags = LSO_TX_BASIC_TCP_IPV4;
+			cap_lso->lso_basic_tcp_ipv4.lso_max = I40E_LSO_MAXLEN;
+		} else {
+			return (B_FALSE);
+		}
+		break;
+	}
+
 	case MAC_CAPAB_RINGS:
 		cap_rings = cap_data;
 		cap_rings->mr_group_type = MAC_GROUP_TYPE_STATIC;
@@ -702,7 +786,7 @@ i40e_m_getcapab(void *arg, mac_capab_t cap, void *cap_data)
 		mct->mct_flags = 0;
 		mct->mct_ntransceivers = 1;
 		mct->mct_info = i40e_transceiver_info;
-		mct->mct_read = NULL;
+		mct->mct_read = i40e_transceiver_read;
 
 		return (B_TRUE);
 	case MAC_CAPAB_LED:
diff --git a/usr/src/uts/common/io/i40e/i40e_main.c b/usr/src/uts/common/io/i40e/i40e_main.c
index 54aef43424..4f6ef25600 100644
--- a/usr/src/uts/common/io/i40e/i40e_main.c
+++ b/usr/src/uts/common/io/i40e/i40e_main.c
@@ -11,7 +11,7 @@
 
 /*
  * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright 2017 Tegile Systems, Inc.  All rights reserved.
  */
 
@@ -359,7 +359,6 @@
  * While bugs have been filed to cover this future work, the following gives an
  * overview of expected work:
  *
- *  o TSO support
  *  o Multiple group support
  *  o DMA binding and breaking up the locking in ring recycling.
  *  o Enhanced detection of device errors
@@ -371,7 +370,7 @@
 
 #include "i40e_sw.h"
 
-static char i40e_ident[] = "Intel 10/40Gb Ethernet v1.0.1";
+static char i40e_ident[] = "Intel 10/40Gb Ethernet v1.0.2";
 
 /*
  * The i40e_glock primarily protects the lists below and the i40e_device_t
@@ -1559,6 +1558,9 @@ i40e_init_properties(i40e_t *i40e)
 	i40e->i40e_tx_hcksum_enable = i40e_get_prop(i40e, "tx_hcksum_enable",
 	    B_FALSE, B_TRUE, B_TRUE);
 
+	i40e->i40e_tx_lso_enable = i40e_get_prop(i40e, "tx_lso_enable",
+	    B_FALSE, B_TRUE, B_TRUE);
+
 	i40e->i40e_rx_hcksum_enable = i40e_get_prop(i40e, "rx_hcksum_enable",
 	    B_FALSE, B_TRUE, B_TRUE);
 
diff --git a/usr/src/uts/common/io/i40e/i40e_stats.c b/usr/src/uts/common/io/i40e/i40e_stats.c
index 7a4f0faedd..e5f6de9f9f 100644
--- a/usr/src/uts/common/io/i40e/i40e_stats.c
+++ b/usr/src/uts/common/io/i40e/i40e_stats.c
@@ -11,7 +11,7 @@
 
 /*
  * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include "i40e_sw.h"
@@ -1249,6 +1249,12 @@ i40e_stats_trqpair_init(i40e_trqpair_t *itrq)
 	kstat_named_init(&tsp->itxs_hck_badl4, "tx_hck_badl4",
 	    KSTAT_DATA_UINT64);
 	tsp->itxs_hck_badl4.value.ui64 = 0;
+	kstat_named_init(&tsp->itxs_lso_nohck, "tx_lso_nohck",
+	    KSTAT_DATA_UINT64);
+	tsp->itxs_lso_nohck.value.ui64 = 0;
+	kstat_named_init(&tsp->itxs_bind_fails, "tx_bind_fails",
+	    KSTAT_DATA_UINT64);
+	tsp->itxs_bind_fails.value.ui64 = 0;
 	kstat_named_init(&tsp->itxs_err_notcb, "tx_err_notcb",
 	    KSTAT_DATA_UINT64);
 	tsp->itxs_err_notcb.value.ui64 = 0;
diff --git a/usr/src/uts/common/io/i40e/i40e_sw.h b/usr/src/uts/common/io/i40e/i40e_sw.h
index 78aced0144..8e1d72a09e 100644
--- a/usr/src/uts/common/io/i40e/i40e_sw.h
+++ b/usr/src/uts/common/io/i40e/i40e_sw.h
@@ -11,7 +11,7 @@
 
 /*
  * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright 2017 Tegile Systems, Inc.  All rights reserved.
  */
 
@@ -152,9 +152,10 @@ typedef enum i40e_itr_index {
 } i40e_itr_index_t;
 
 /*
- * Table 1-5 of the PRM notes that LSO supports up to 256 KB.
+ * The hardware claims to support LSO up to 256 KB, but due to the limitations
+ * imposed by the IP header for non-jumbo frames, we cap it at 64 KB.
  */
-#define	I40E_LSO_MAXLEN	(256 * 1024)
+#define	I40E_LSO_MAXLEN	(64 * 1024)
 
 #define	I40E_CYCLIC_PERIOD NANOSEC	/* 1 second */
 #define	I40E_DRAIN_RX_WAIT	(500 * MILLISEC)	/* In us */
@@ -173,13 +174,22 @@ typedef enum i40e_itr_index {
 #define	I40E_BUF_IPHDR_ALIGNMENT	2
 
 /*
- * The XL710 controller has a limit of eight buffers being allowed to be used
- * for the transmission of a single frame. This is defined in 8.4.1 - Transmit
+ * The XL710 controller has a total of eight buffers available for the
+ * transmission of any single frame. This is defined in 8.4.1 - Transmit
  * Packet in System Memory.
  */
 #define	I40E_TX_MAX_COOKIE	8
 
 /*
+ * An LSO frame can be as large as 64KB, so we allow a DMA bind to span more
+ * cookies than a non-LSO frame.  The key here to is to select a value such
+ * that once the HW has chunked up the LSO frame into MSS-sized segments that no
+ * single segment spans more than 8 cookies (see comments for
+ * I40E_TX_MAX_COOKIE)
+ */
+#define	I40E_TX_LSO_MAX_COOKIE	32
+
+/*
  * Sizing to determine the amount of available descriptors at which we'll
  * consider ourselves blocked. Also, when we have these available, we'll then
  * consider ourselves available to transmit to MAC again. Strictly speaking, the
@@ -203,6 +213,12 @@ typedef enum i40e_itr_index {
 #define	I40E_MAX_TX_DMA_THRESH		INT32_MAX
 
 /*
+ * The max size of each individual tx buffer is 16KB - 1.
+ * See table 8-17
+ */
+#define	I40E_MAX_TX_BUFSZ		0x0000000000003FFFull
+
+/*
  * Resource sizing counts. There are various aspects of hardware where we may
  * have some variable number of elements that we need to handle. Such as the
  * hardware capabilities and switch capacities. We cannot know a priori how many
@@ -405,18 +421,29 @@ typedef struct i40e_rx_control_block {
 typedef enum {
 	I40E_TX_NONE,
 	I40E_TX_COPY,
-	I40E_TX_DMA
+	I40E_TX_DMA,
+	I40E_TX_DESC,
 } i40e_tx_type_t;
 
 typedef struct i40e_tx_desc i40e_tx_desc_t;
+typedef struct i40e_tx_context_desc i40e_tx_context_desc_t;
 typedef union i40e_32byte_rx_desc i40e_rx_desc_t;
 
+struct i40e_dma_bind_info {
+	caddr_t dbi_paddr;
+	size_t dbi_len;
+};
+
 typedef struct i40e_tx_control_block {
 	struct i40e_tx_control_block	*tcb_next;
 	mblk_t				*tcb_mp;
 	i40e_tx_type_t			tcb_type;
 	ddi_dma_handle_t		tcb_dma_handle;
+	ddi_dma_handle_t		tcb_lso_dma_handle;
 	i40e_dma_buffer_t		tcb_dma;
+	struct i40e_dma_bind_info	*tcb_bind_info;
+	uint_t				tcb_bind_ncookies;
+	boolean_t			tcb_used_lso;
 } i40e_tx_control_block_t;
 
 /*
@@ -526,6 +553,8 @@ typedef struct i40e_txq_stat {
 	kstat_named_t	itxs_hck_nol4info;	/* Missing l4 info */
 	kstat_named_t	itxs_hck_badl3;		/* Not IPv4/IPv6 */
 	kstat_named_t	itxs_hck_badl4;		/* Bad L4 Paylaod */
+	kstat_named_t	itxs_lso_nohck;		/* Missing offloads for LSO */
+	kstat_named_t	itxs_bind_fails;	/* DMA bind failures */
 
 	kstat_named_t	itxs_err_notcb;		/* No tcb's available */
 	kstat_named_t	itxs_err_nodescs;	/* No tcb's available */
@@ -832,6 +861,7 @@ typedef struct i40e {
 	uint32_t	i40e_tx_buf_size;
 	uint32_t	i40e_tx_block_thresh;
 	boolean_t	i40e_tx_hcksum_enable;
+	boolean_t	i40e_tx_lso_enable;
 	uint32_t	i40e_tx_dma_min;
 	uint_t		i40e_tx_itr;
 
@@ -855,6 +885,7 @@ typedef struct i40e {
 	 */
 	ddi_dma_attr_t		i40e_static_dma_attr;
 	ddi_dma_attr_t		i40e_txbind_dma_attr;
+	ddi_dma_attr_t		i40e_txbind_lso_dma_attr;
 	ddi_device_acc_attr_t	i40e_desc_acc_attr;
 	ddi_device_acc_attr_t	i40e_buf_acc_attr;
 
diff --git a/usr/src/uts/common/io/i40e/i40e_transceiver.c b/usr/src/uts/common/io/i40e/i40e_transceiver.c
index 75132e27f0..f91c2237b7 100644
--- a/usr/src/uts/common/io/i40e/i40e_transceiver.c
+++ b/usr/src/uts/common/io/i40e/i40e_transceiver.c
@@ -11,7 +11,7 @@
 
 /*
  * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include "i40e_sw.h"
@@ -60,19 +60,19 @@
  * This size is then rounded up to the nearest 1k chunk, which represents the
  * actual amount of memory that we'll allocate for a single frame.
  *
- * Note, that for rx, we do something that might be unexpected. We always add
+ * Note, that for RX, we do something that might be unexpected. We always add
  * an extra two bytes to the frame size that we allocate. We then offset the DMA
  * address that we receive a packet into by two bytes. This ensures that the IP
  * header will always be 4 byte aligned because the MAC header is either 14 or
  * 18 bytes in length, depending on the use of 802.1Q tagging, which makes IP's
  * and MAC's lives easier.
  *
- * Both the rx and tx descriptor rings (which are what we use to communicate
+ * Both the RX and TX descriptor rings (which are what we use to communicate
  * with hardware) are allocated as a single region of DMA memory which is the
  * size of the descriptor (4 bytes and 2 bytes respectively) times the total
- * number of descriptors for an rx and tx ring.
+ * number of descriptors for an RX and TX ring.
  *
- * While the rx and tx descriptors are allocated using DMA-based memory, the
+ * While the RX and TX descriptors are allocated using DMA-based memory, the
  * control blocks for each of them are allocated using normal kernel memory.
  * They aren't special from a DMA perspective. We'll go over the design of both
  * receiving and transmitting separately, as they have slightly different
@@ -113,16 +113,16 @@
  *
  * To try and ensure that the device always has blocks that it can receive data
  * into, we maintain two lists of control blocks, a working list and a free
- * list. Each list is sized equal to the number of descriptors in the rx ring.
- * During the GLDv3 mc_start routine, we allocate a number of rx control blocks
+ * list. Each list is sized equal to the number of descriptors in the RX ring.
+ * During the GLDv3 mc_start routine, we allocate a number of RX control blocks
  * equal to twice the number of descriptors in the ring and we assign them
  * equally to the free list and to the working list. Each control block also has
  * DMA memory allocated and associated with which it will be used to receive the
  * actual packet data. All of a received frame's data will end up in a single
  * DMA buffer.
  *
- * During operation, we always maintain the invariant that each rx descriptor
- * has an associated rx control block which lives in the working list. If we
+ * During operation, we always maintain the invariant that each RX descriptor
+ * has an associated RX control block which lives in the working list. If we
  * feel that we should loan up DMA memory to MAC in the form of a message block,
  * we can only do so if we can maintain this invariant. To do that, we swap in
  * one of the buffers from the free list. If none are available, then we resort
@@ -130,14 +130,14 @@
  * size.
  *
  * Loaned message blocks come back to use when freemsg(9F) or freeb(9F) is
- * called on the block, at which point we restore the rx control block to the
+ * called on the block, at which point we restore the RX control block to the
  * free list and are able to reuse the DMA memory again. While the scheme may
  * seem odd, it importantly keeps us out of trying to do any DMA allocations in
  * the normal path of operation, even though we may still have to allocate
  * message blocks and copy.
  *
- * The following state machine describes the life time of a rx control block. In
- * the diagram we abbrviate the rx ring descriptor entry as rxd and the rx
+ * The following state machine describes the life time of a RX control block. In
+ * the diagram we abbrviate the RX ring descriptor entry as rxd and the rx
  * control block entry as rcb.
  *
  *             |                                   |
@@ -160,11 +160,11 @@
  *             +--------------------<-----| rcb loaned to MAC |
  *                                        +-------------------+
  *
- * Finally, note that every rx control block has a reference count on it. One
+ * Finally, note that every RX control block has a reference count on it. One
  * reference is added as long as the driver has had the GLDv3 mc_start endpoint
  * called. If the GLDv3 mc_stop entry point is called, IP has been unplumbed and
  * no other DLPI consumers remain, then we'll decrement the reference count by
- * one. Whenever we loan up the rx control block and associated buffer to MAC,
+ * one. Whenever we loan up the RX control block and associated buffer to MAC,
  * then we bump the reference count again. Even though the device is stopped,
  * there may still be loaned frames in upper levels that we'll want to account
  * for. Our callback from freemsg(9F)/freeb(9F) will take care of making sure
@@ -192,10 +192,10 @@
  * state tracking. Effectively, we cache the HEAD register and then update it
  * ourselves based on our work.
  *
- * When we iterate over the rx descriptors and thus the received frames, we are
+ * When we iterate over the RX descriptors and thus the received frames, we are
  * either in an interrupt context or we've been asked by MAC to poll on the
  * ring. If we've been asked to poll on the ring, we have a maximum number of
- * bytes of mblk_t's to return. If processing an rx descriptor would cause us to
+ * bytes of mblk_t's to return. If processing an RX descriptor would cause us to
  * exceed that count, then we do not process it. When in interrupt context, we
  * don't have a strict byte count. However, to ensure liveness, we limit the
  * amount of data based on a configuration value
@@ -249,31 +249,44 @@
  * differently due to the fact that all data is originated by the operating
  * system and not by the device.
  *
- * Like rx, there is both a descriptor ring that we use to communicate to the
- * driver and which points to the memory used to transmit a frame. Similarly,
- * there is a corresponding transmit control block. Each transmit control block
- * has a region of DMA memory allocated to it; however, the way we use it
- * varies.
+ * Like RX, there is both a descriptor ring that we use to communicate to the
+ * driver and which points to the memory used to transmit a frame.  Similarly,
+ * there is a corresponding transmit control block, however, the correspondence
+ * between descriptors and control blocks is more complex and not necessarily
+ * 1-to-1.
  *
  * The driver is asked to process a single frame at a time. That message block
  * may be made up of multiple fragments linked together by the mblk_t`b_cont
  * member. The device has a hard limit of up to 8 buffers being allowed for use
  * for a single logical frame. For each fragment, we'll try and use an entry
- * from the tx descriptor ring and then we'll allocate a corresponding tx
- * control block. Depending on the size of the fragment, we may copy it around
- * or we might instead try to do DMA binding of the fragment.
- *
- * If we exceed the number of blocks that fit, we'll try to pull up the block
- * and then we'll do a DMA bind and send it out.
- *
- * If we don't have enough space in the ring or tx control blocks available,
+ * from the TX descriptor ring and then we'll allocate a corresponding TX
+ * control block.
+ *
+ * We alter our DMA strategy based on a threshold tied to the frame size.
+ * This threshold is configurable via the tx_dma_threshold property. If the
+ * frame size is above the threshold, we do DMA binding of the fragments,
+ * building a control block and data descriptor for each piece.  If it's below
+ * or at the threshold then we just use a single control block and data
+ * descriptor and simply bcopy all of the fragments into the pre-allocated DMA
+ * buffer in the control block. For the LSO TX case we always do DMA binding of
+ * the fragments, with one control block and one TX data descriptor allocated
+ * per fragment.
+ *
+ * Furthermore, if the frame requires HW offloads such as LSO, tunneling or
+ * filtering, then the TX data descriptors must be preceeded by a single TX
+ * context descriptor.  Because there is no DMA transfer associated with the
+ * context descriptor, we allocate a control block with a special type which
+ * indicates to the TX ring recycle code that there are no associated DMA
+ * resources to unbind when the control block is free'd.
+ *
+ * If we don't have enough space in the ring or TX control blocks available,
  * then we'll return the unprocessed message block to MAC. This will induce flow
  * control and once we recycle enough entries, we'll once again enable sending
  * on the ring.
  *
  * We size the working list as equal to the number of descriptors in the ring.
  * We size the free list as equal to 1.5 times the number of descriptors in the
- * ring. We'll allocate a number of tx control block entries equal to the number
+ * ring. We'll allocate a number of TX control block entries equal to the number
  * of entries in the free list. By default, all entries are placed in the free
  * list. As we come along and try to send something, we'll allocate entries from
  * the free list and add them to the working list, where they'll stay until the
@@ -325,7 +338,7 @@
  *    +------------------+                       +------------------+
  *    | tcb on free list |---*------------------>| tcb on work list |
  *    +------------------+   .                   +------------------+
- *             ^             . tcb allocated               |
+ *             ^             . N tcbs allocated[1]         |
  *             |               to send frame               v
  *             |               or fragment on              |
  *             |               wire, mblk from             |
@@ -335,20 +348,27 @@
  *                    .
  *                    . Hardware indicates
  *                      entry transmitted.
- *                      tcb recycled, mblk
+ *                      tcbs recycled, mblk
  *                      from MAC freed.
  *
+ * [1] We allocate N tcbs to transmit a single frame where N can be 1 context
+ *     descriptor plus 1 data descriptor, in the non-DMA-bind case.  In the DMA
+ *     bind case, N can be 1 context descriptor plus 1 data descriptor per
+ *     b_cont in the mblk.  In this case, the mblk is associated with the first
+ *     data descriptor and freed as part of freeing that data descriptor.
+ *
  * ------------
  * Blocking MAC
  * ------------
  *
- * Wen performing transmit, we can run out of descriptors and ring entries. When
- * such a case happens, we return the mblk_t to MAC to indicate that we've been
- * blocked. At that point in time, MAC becomes blocked and will not transmit
- * anything out that specific ring until we notify MAC. To indicate that we're
- * in such a situation we set i40e_trqpair_t`itrq_tx_blocked member to B_TRUE.
+ * When performing transmit, we can run out of descriptors and ring entries.
+ * When such a case happens, we return the mblk_t to MAC to indicate that we've
+ * been blocked. At that point in time, MAC becomes blocked and will not
+ * transmit anything out that specific ring until we notify MAC. To indicate
+ * that we're in such a situation we set i40e_trqpair_t`itrq_tx_blocked member
+ * to B_TRUE.
  *
- * When we recycle tx descriptors then we'll end up signaling MAC by calling
+ * When we recycle TX descriptors then we'll end up signaling MAC by calling
  * mac_tx_ring_update() if we were blocked, letting it know that it's safe to
  * start sending frames out to us again.
  */
@@ -367,13 +387,15 @@
 
 /*
  * This structure is used to maintain information and flags related to
- * transmitting a frame. The first member is the set of flags we need to or into
- * the command word (generally checksumming related). The second member controls
- * the word offsets which is required for IP and L4 checksumming.
+ * transmitting a frame.  These fields are ultimately used to construct the
+ * TX data descriptor(s) and, if necessary, the TX context descriptor.
  */
 typedef struct i40e_tx_context {
-	enum i40e_tx_desc_cmd_bits	itc_cmdflags;
-	uint32_t			itc_offsets;
+	enum i40e_tx_desc_cmd_bits	itc_data_cmdflags;
+	uint32_t			itc_data_offsets;
+	enum i40e_tx_ctx_desc_cmd_bits	itc_ctx_cmdflags;
+	uint32_t			itc_ctx_tsolen;
+	uint32_t			itc_ctx_mss;
 } i40e_tx_context_t;
 
 /*
@@ -395,14 +417,18 @@ i40e_debug_rx_t i40e_debug_rx_mode = I40E_DEBUG_RX_DEFAULT;
  * i40e_static_dma_attr, is designed to be used for both the descriptor rings
  * and the static buffers that we associate with control blocks. For this
  * reason, we force an SGL length of one. While technically the driver supports
- * a larger SGL (5 on rx and 8 on tx), we opt to only use one to simplify our
+ * a larger SGL (5 on RX and 8 on TX), we opt to only use one to simplify our
  * management here. In addition, when the Intel common code wants to allocate
  * memory via the i40e_allocate_virt_mem osdep function, we have it leverage
  * the static dma attr.
  *
- * The second set of attributes, i40e_txbind_dma_attr, is what we use when we're
- * binding a bunch of mblk_t fragments to go out the door. Note that the main
- * difference here is that we're allowed a larger SGL length -- eight.
+ * The latter two sets of attributes, are what we use when we're binding a
+ * bunch of mblk_t fragments to go out the door. Note that the main difference
+ * here is that we're allowed a larger SGL length.  For non-LSO TX, we
+ * restrict the SGL length to match the number of TX buffers available to the
+ * PF (8).  For the LSO case we can go much larger, with the caveat that each
+ * MSS-sized chunk (segment) must not span more than 8 data descriptors and
+ * hence must not span more than 8 cookies.
  *
  * Note, we default to setting ourselves to be DMA capable here. However,
  * because we could have multiple instances which have different FMA error
@@ -429,7 +455,7 @@ static const ddi_dma_attr_t i40e_g_txbind_dma_attr = {
 	DMA_ATTR_V0,			/* version number */
 	0x0000000000000000ull,		/* low address */
 	0xFFFFFFFFFFFFFFFFull,		/* high address */
-	0x00000000FFFFFFFFull,		/* dma counter max */
+	I40E_MAX_TX_BUFSZ,		/* dma counter max */
 	I40E_DMA_ALIGNMENT,		/* alignment */
 	0x00000FFF,			/* burst sizes */
 	0x00000001,			/* minimum transfer size */
@@ -440,6 +466,21 @@ static const ddi_dma_attr_t i40e_g_txbind_dma_attr = {
 	DDI_DMA_FLAGERR			/* DMA flags */
 };
 
+static const ddi_dma_attr_t i40e_g_txbind_lso_dma_attr = {
+	DMA_ATTR_V0,			/* version number */
+	0x0000000000000000ull,		/* low address */
+	0xFFFFFFFFFFFFFFFFull,		/* high address */
+	I40E_MAX_TX_BUFSZ,		/* dma counter max */
+	I40E_DMA_ALIGNMENT,		/* alignment */
+	0x00000FFF,			/* burst sizes */
+	0x00000001,			/* minimum transfer size */
+	0x00000000FFFFFFFFull,		/* maximum transfer size */
+	0xFFFFFFFFFFFFFFFFull,		/* maximum segment size	 */
+	I40E_TX_LSO_MAX_COOKIE,		/* scatter/gather list length */
+	0x00000001,			/* granularity */
+	DDI_DMA_FLAGERR			/* DMA flags */
+};
+
 /*
  * Next, we have the attributes for these structures. The descriptor rings are
  * all strictly little endian, while the data buffers are just arrays of bytes
@@ -668,7 +709,7 @@ i40e_alloc_rx_data(i40e_t *i40e, i40e_trqpair_t *itrq)
 	rxd->rxd_work_list = kmem_zalloc(sizeof (i40e_rx_control_block_t *) *
 	    rxd->rxd_ring_size, KM_NOSLEEP);
 	if (rxd->rxd_work_list == NULL) {
-		i40e_error(i40e, "failed to allocate rx work list for a ring "
+		i40e_error(i40e, "failed to allocate RX work list for a ring "
 		    "of %d entries for ring %d", rxd->rxd_ring_size,
 		    itrq->itrq_index);
 		goto cleanup;
@@ -677,7 +718,7 @@ i40e_alloc_rx_data(i40e_t *i40e, i40e_trqpair_t *itrq)
 	rxd->rxd_free_list = kmem_zalloc(sizeof (i40e_rx_control_block_t *) *
 	    rxd->rxd_free_list_size, KM_NOSLEEP);
 	if (rxd->rxd_free_list == NULL) {
-		i40e_error(i40e, "failed to allocate a %d entry rx free list "
+		i40e_error(i40e, "failed to allocate a %d entry RX free list "
 		    "for ring %d", rxd->rxd_free_list_size, itrq->itrq_index);
 		goto cleanup;
 	}
@@ -765,7 +806,7 @@ i40e_alloc_rx_dma(i40e_rx_data_t *rxd)
 	i40e_t *i40e = rxd->rxd_i40e;
 
 	/*
-	 * First allocate the rx descriptor ring.
+	 * First allocate the RX descriptor ring.
 	 */
 	dmasz = sizeof (i40e_rx_desc_t) * rxd->rxd_ring_size;
 	VERIFY(dmasz > 0);
@@ -773,7 +814,7 @@ i40e_alloc_rx_dma(i40e_rx_data_t *rxd)
 	    &i40e->i40e_static_dma_attr, &i40e->i40e_desc_acc_attr, B_FALSE,
 	    B_TRUE, dmasz) == B_FALSE) {
 		i40e_error(i40e, "failed to allocate DMA resources "
-		    "for rx descriptor ring");
+		    "for RX descriptor ring");
 		return (B_FALSE);
 	}
 	rxd->rxd_desc_ring =
@@ -799,7 +840,7 @@ i40e_alloc_rx_dma(i40e_rx_data_t *rxd)
 		if (i40e_alloc_dma_buffer(i40e, dmap,
 		    &i40e->i40e_static_dma_attr, &i40e->i40e_buf_acc_attr,
 		    B_TRUE, B_FALSE, dmasz) == B_FALSE) {
-			i40e_error(i40e, "failed to allocate rx dma buffer");
+			i40e_error(i40e, "failed to allocate RX dma buffer");
 			return (B_FALSE);
 		}
 
@@ -841,6 +882,10 @@ i40e_free_tx_dma(i40e_trqpair_t *itrq)
 				ddi_dma_free_handle(&tcb->tcb_dma_handle);
 				tcb->tcb_dma_handle = NULL;
 			}
+			if (tcb->tcb_lso_dma_handle != NULL) {
+				ddi_dma_free_handle(&tcb->tcb_lso_dma_handle);
+				tcb->tcb_lso_dma_handle = NULL;
+			}
 		}
 
 		fsz = sizeof (i40e_tx_control_block_t) *
@@ -881,7 +926,7 @@ i40e_alloc_tx_dma(i40e_trqpair_t *itrq)
 	    (i40e->i40e_tx_ring_size >> 1);
 
 	/*
-	 * Allocate an additional tx descriptor for the writeback head.
+	 * Allocate an additional TX descriptor for the writeback head.
 	 */
 	dmasz = sizeof (i40e_tx_desc_t) * itrq->itrq_tx_ring_size;
 	dmasz += sizeof (i40e_tx_desc_t);
@@ -890,7 +935,7 @@ i40e_alloc_tx_dma(i40e_trqpair_t *itrq)
 	if (i40e_alloc_dma_buffer(i40e, &itrq->itrq_desc_area,
 	    &i40e->i40e_static_dma_attr, &i40e->i40e_desc_acc_attr,
 	    B_FALSE, B_TRUE, dmasz) == B_FALSE) {
-		i40e_error(i40e, "failed to allocate DMA resources for tx "
+		i40e_error(i40e, "failed to allocate DMA resources for TX "
 		    "descriptor ring");
 		return (B_FALSE);
 	}
@@ -905,7 +950,7 @@ i40e_alloc_tx_dma(i40e_trqpair_t *itrq)
 	itrq->itrq_tcb_work_list = kmem_zalloc(itrq->itrq_tx_ring_size *
 	    sizeof (i40e_tx_control_block_t *), KM_NOSLEEP);
 	if (itrq->itrq_tcb_work_list == NULL) {
-		i40e_error(i40e, "failed to allocate a %d entry tx work list "
+		i40e_error(i40e, "failed to allocate a %d entry TX work list "
 		    "for ring %d", itrq->itrq_tx_ring_size, itrq->itrq_index);
 		goto cleanup;
 	}
@@ -913,14 +958,14 @@ i40e_alloc_tx_dma(i40e_trqpair_t *itrq)
 	itrq->itrq_tcb_free_list = kmem_zalloc(itrq->itrq_tx_free_list_size *
 	    sizeof (i40e_tx_control_block_t *), KM_SLEEP);
 	if (itrq->itrq_tcb_free_list == NULL) {
-		i40e_error(i40e, "failed to allocate a %d entry tx free list "
+		i40e_error(i40e, "failed to allocate a %d entry TX free list "
 		    "for ring %d", itrq->itrq_tx_free_list_size,
 		    itrq->itrq_index);
 		goto cleanup;
 	}
 
 	/*
-	 * We allocate enough tx control blocks to cover the free list.
+	 * We allocate enough TX control blocks to cover the free list.
 	 */
 	itrq->itrq_tcb_area = kmem_zalloc(sizeof (i40e_tx_control_block_t) *
 	    itrq->itrq_tx_free_list_size, KM_NOSLEEP);
@@ -948,18 +993,29 @@ i40e_alloc_tx_dma(i40e_trqpair_t *itrq)
 		    &i40e->i40e_txbind_dma_attr, DDI_DMA_DONTWAIT, NULL,
 		    &tcb->tcb_dma_handle);
 		if (ret != DDI_SUCCESS) {
-			i40e_error(i40e, "failed to allocate DMA handle for tx "
+			i40e_error(i40e, "failed to allocate DMA handle for TX "
 			    "data binding on ring %d: %d", itrq->itrq_index,
 			    ret);
 			tcb->tcb_dma_handle = NULL;
 			goto cleanup;
 		}
 
+		ret = ddi_dma_alloc_handle(i40e->i40e_dip,
+		    &i40e->i40e_txbind_lso_dma_attr, DDI_DMA_DONTWAIT, NULL,
+		    &tcb->tcb_lso_dma_handle);
+		if (ret != DDI_SUCCESS) {
+			i40e_error(i40e, "failed to allocate DMA handle for TX "
+			    "LSO data binding on ring %d: %d", itrq->itrq_index,
+			    ret);
+			tcb->tcb_lso_dma_handle = NULL;
+			goto cleanup;
+		}
+
 		if (i40e_alloc_dma_buffer(i40e, &tcb->tcb_dma,
 		    &i40e->i40e_static_dma_attr, &i40e->i40e_buf_acc_attr,
 		    B_TRUE, B_FALSE, dmasz) == B_FALSE) {
 			i40e_error(i40e, "failed to allocate %ld bytes of "
-			    "DMA for tx data binding on ring %d", dmasz,
+			    "DMA for TX data binding on ring %d", dmasz,
 			    itrq->itrq_index);
 			goto cleanup;
 		}
@@ -989,10 +1045,10 @@ i40e_free_ring_mem(i40e_t *i40e, boolean_t failed_init)
 		i40e_rx_data_t *rxd = i40e->i40e_trqpairs[i].itrq_rxdata;
 
 		/*
-		 * Clean up our rx data. We have to free DMA resources first and
+		 * Clean up our RX data. We have to free DMA resources first and
 		 * then if we have no more pending RCB's, then we'll go ahead
 		 * and clean things up. Note, we can't set the stopped flag on
-		 * the rx data until after we've done the first pass of the
+		 * the RX data until after we've done the first pass of the
 		 * pending resources. Otherwise we might race with
 		 * i40e_rx_recycle on determining who should free the
 		 * i40e_rx_data_t above.
@@ -1055,6 +1111,8 @@ i40e_init_dma_attrs(i40e_t *i40e, boolean_t fma)
 	    sizeof (ddi_dma_attr_t));
 	bcopy(&i40e_g_txbind_dma_attr, &i40e->i40e_txbind_dma_attr,
 	    sizeof (ddi_dma_attr_t));
+	bcopy(&i40e_g_txbind_lso_dma_attr, &i40e->i40e_txbind_lso_dma_attr,
+	    sizeof (ddi_dma_attr_t));
 	bcopy(&i40e_g_desc_acc_attr, &i40e->i40e_desc_acc_attr,
 	    sizeof (ddi_device_acc_attr_t));
 	bcopy(&i40e_g_buf_acc_attr, &i40e->i40e_buf_acc_attr,
@@ -1063,9 +1121,13 @@ i40e_init_dma_attrs(i40e_t *i40e, boolean_t fma)
 	if (fma == B_TRUE) {
 		i40e->i40e_static_dma_attr.dma_attr_flags |= DDI_DMA_FLAGERR;
 		i40e->i40e_txbind_dma_attr.dma_attr_flags |= DDI_DMA_FLAGERR;
+		i40e->i40e_txbind_lso_dma_attr.dma_attr_flags |=
+		    DDI_DMA_FLAGERR;
 	} else {
 		i40e->i40e_static_dma_attr.dma_attr_flags &= ~DDI_DMA_FLAGERR;
 		i40e->i40e_txbind_dma_attr.dma_attr_flags &= ~DDI_DMA_FLAGERR;
+		i40e->i40e_txbind_lso_dma_attr.dma_attr_flags &=
+		    ~DDI_DMA_FLAGERR;
 	}
 }
 
@@ -1102,7 +1164,7 @@ i40e_rcb_alloc(i40e_rx_data_t *rxd)
 /*
  * This is the callback that we get from the OS when freemsg(9F) has been called
  * on a loaned descriptor. In addition, if we take the last reference count
- * here, then we have to tear down all of the rx data.
+ * here, then we have to tear down all of the RX data.
  */
 void
 i40e_rx_recycle(caddr_t arg)
@@ -1768,16 +1830,19 @@ mac_ether_offload_info(mblk_t *mp, mac_ether_offload_info_t *meoi)
  * to properly program the hardware for checksum offload as well as the
  * generally required flags.
  *
- * The i40e_tx_context_t`itc_cmdflags contains the set of flags we need to or
- * into the descriptor based on the checksum flags for this mblk_t and the
+ * The i40e_tx_context_t`itc_data_cmdflags contains the set of flags we need to
+ * 'or' into the descriptor based on the checksum flags for this mblk_t and the
  * actual information we care about.
+ *
+ * If the mblk requires LSO then we'll also gather the information that will be
+ * used to construct the Transmit Context Descriptor.
  */
 static int
 i40e_tx_context(i40e_t *i40e, i40e_trqpair_t *itrq, mblk_t *mp,
     i40e_tx_context_t *tctx)
 {
 	int ret;
-	uint32_t flags, start;
+	uint32_t chkflags, start, mss, lsoflags;
 	mac_ether_offload_info_t meo;
 	i40e_txq_stat_t *txs = &itrq->itrq_txstat;
 
@@ -1786,8 +1851,10 @@ i40e_tx_context(i40e_t *i40e, i40e_trqpair_t *itrq, mblk_t *mp,
 	if (i40e->i40e_tx_hcksum_enable != B_TRUE)
 		return (0);
 
-	mac_hcksum_get(mp, &start, NULL, NULL, NULL, &flags);
-	if (flags == 0)
+	mac_hcksum_get(mp, &start, NULL, NULL, NULL, &chkflags);
+	mac_lso_get(mp, &mss, &lsoflags);
+
+	if (chkflags == 0 && lsoflags == 0)
 		return (0);
 
 	if ((ret = mac_ether_offload_info(mp, &meo)) != 0) {
@@ -1800,7 +1867,7 @@ i40e_tx_context(i40e_t *i40e, i40e_trqpair_t *itrq, mblk_t *mp,
 	 * have sufficient information and then set the proper fields in the
 	 * command structure.
 	 */
-	if (flags & HCK_IPV4_HDRCKSUM) {
+	if (chkflags & HCK_IPV4_HDRCKSUM) {
 		if ((meo.meoi_flags & MEOI_L2INFO_SET) == 0) {
 			txs->itxs_hck_nol2info.value.ui64++;
 			return (-1);
@@ -1813,10 +1880,10 @@ i40e_tx_context(i40e_t *i40e, i40e_trqpair_t *itrq, mblk_t *mp,
 			txs->itxs_hck_badl3.value.ui64++;
 			return (-1);
 		}
-		tctx->itc_cmdflags |= I40E_TX_DESC_CMD_IIPT_IPV4_CSUM;
-		tctx->itc_offsets |= (meo.meoi_l2hlen >> 1) <<
+		tctx->itc_data_cmdflags |= I40E_TX_DESC_CMD_IIPT_IPV4_CSUM;
+		tctx->itc_data_offsets |= (meo.meoi_l2hlen >> 1) <<
 		    I40E_TX_DESC_LENGTH_MACLEN_SHIFT;
-		tctx->itc_offsets |= (meo.meoi_l3hlen >> 2) <<
+		tctx->itc_data_offsets |= (meo.meoi_l3hlen >> 2) <<
 		    I40E_TX_DESC_LENGTH_IPLEN_SHIFT;
 	}
 
@@ -1826,13 +1893,13 @@ i40e_tx_context(i40e_t *i40e, i40e_trqpair_t *itrq, mblk_t *mp,
 	 * onto seeing if we have enough information for the L4 checksum
 	 * offload.
 	 */
-	if (flags & HCK_PARTIALCKSUM) {
+	if (chkflags & HCK_PARTIALCKSUM) {
 		if ((meo.meoi_flags & MEOI_L4INFO_SET) == 0) {
 			txs->itxs_hck_nol4info.value.ui64++;
 			return (-1);
 		}
 
-		if (!(flags & HCK_IPV4_HDRCKSUM)) {
+		if (!(chkflags & HCK_IPV4_HDRCKSUM)) {
 			if ((meo.meoi_flags & MEOI_L2INFO_SET) == 0) {
 				txs->itxs_hck_nol2info.value.ui64++;
 				return (-1);
@@ -1843,40 +1910,60 @@ i40e_tx_context(i40e_t *i40e, i40e_trqpair_t *itrq, mblk_t *mp,
 			}
 
 			if (meo.meoi_l3proto == ETHERTYPE_IP) {
-				tctx->itc_cmdflags |=
+				tctx->itc_data_cmdflags |=
 				    I40E_TX_DESC_CMD_IIPT_IPV4;
 			} else if (meo.meoi_l3proto == ETHERTYPE_IPV6) {
-				tctx->itc_cmdflags |=
+				tctx->itc_data_cmdflags |=
 				    I40E_TX_DESC_CMD_IIPT_IPV6;
 			} else {
 				txs->itxs_hck_badl3.value.ui64++;
 				return (-1);
 			}
-			tctx->itc_offsets |= (meo.meoi_l2hlen >> 1) <<
+			tctx->itc_data_offsets |= (meo.meoi_l2hlen >> 1) <<
 			    I40E_TX_DESC_LENGTH_MACLEN_SHIFT;
-			tctx->itc_offsets |= (meo.meoi_l3hlen >> 2) <<
+			tctx->itc_data_offsets |= (meo.meoi_l3hlen >> 2) <<
 			    I40E_TX_DESC_LENGTH_IPLEN_SHIFT;
 		}
 
 		switch (meo.meoi_l4proto) {
 		case IPPROTO_TCP:
-			tctx->itc_cmdflags |= I40E_TX_DESC_CMD_L4T_EOFT_TCP;
+			tctx->itc_data_cmdflags |=
+			    I40E_TX_DESC_CMD_L4T_EOFT_TCP;
 			break;
 		case IPPROTO_UDP:
-			tctx->itc_cmdflags |= I40E_TX_DESC_CMD_L4T_EOFT_UDP;
+			tctx->itc_data_cmdflags |=
+			    I40E_TX_DESC_CMD_L4T_EOFT_UDP;
 			break;
 		case IPPROTO_SCTP:
-			tctx->itc_cmdflags |= I40E_TX_DESC_CMD_L4T_EOFT_SCTP;
+			tctx->itc_data_cmdflags |=
+			    I40E_TX_DESC_CMD_L4T_EOFT_SCTP;
 			break;
 		default:
 			txs->itxs_hck_badl4.value.ui64++;
 			return (-1);
 		}
 
-		tctx->itc_offsets |= (meo.meoi_l4hlen >> 2) <<
+		tctx->itc_data_offsets |= (meo.meoi_l4hlen >> 2) <<
 		    I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT;
 	}
 
+	if (lsoflags & HW_LSO) {
+		/*
+		 * LSO requires that checksum offloads are enabled.  If for
+		 * some reason they're not we bail out with an error.
+		 */
+		if ((chkflags & HCK_IPV4_HDRCKSUM) == 0 ||
+		    (chkflags & HCK_PARTIALCKSUM) == 0) {
+			txs->itxs_lso_nohck.value.ui64++;
+			return (-1);
+		}
+
+		tctx->itc_ctx_cmdflags |= I40E_TX_CTX_DESC_TSO;
+		tctx->itc_ctx_mss = mss;
+		tctx->itc_ctx_tsolen = msgsize(mp) -
+		    (meo.meoi_l2hlen + meo.meoi_l3hlen + meo.meoi_l4hlen);
+	}
+
 	return (0);
 }
 
@@ -1925,7 +2012,20 @@ i40e_tcb_reset(i40e_tx_control_block_t *tcb)
 		tcb->tcb_dma.dmab_len = 0;
 		break;
 	case I40E_TX_DMA:
-		(void) ddi_dma_unbind_handle(tcb->tcb_dma_handle);
+		if (tcb->tcb_used_lso == B_TRUE && tcb->tcb_bind_ncookies > 0)
+			(void) ddi_dma_unbind_handle(tcb->tcb_lso_dma_handle);
+		else if (tcb->tcb_bind_ncookies > 0)
+			(void) ddi_dma_unbind_handle(tcb->tcb_dma_handle);
+		if (tcb->tcb_bind_info != NULL) {
+			kmem_free(tcb->tcb_bind_info,
+			    tcb->tcb_bind_ncookies *
+			    sizeof (struct i40e_dma_bind_info));
+		}
+		tcb->tcb_bind_info = NULL;
+		tcb->tcb_bind_ncookies = 0;
+		tcb->tcb_used_lso = B_FALSE;
+		break;
+	case I40E_TX_DESC:
 		break;
 	case I40E_TX_NONE:
 		/* Cast to pacify lint */
@@ -1935,8 +2035,10 @@ i40e_tcb_reset(i40e_tx_control_block_t *tcb)
 	}
 
 	tcb->tcb_type = I40E_TX_NONE;
-	freemsg(tcb->tcb_mp);
-	tcb->tcb_mp = NULL;
+	if (tcb->tcb_mp != NULL) {
+		freemsg(tcb->tcb_mp);
+		tcb->tcb_mp = NULL;
+	}
 	tcb->tcb_next = NULL;
 }
 
@@ -1969,10 +2071,11 @@ i40e_tx_cleanup_ring(i40e_trqpair_t *itrq)
 		i40e_tx_control_block_t *tcb;
 
 		tcb = itrq->itrq_tcb_work_list[index];
-		VERIFY(tcb != NULL);
-		itrq->itrq_tcb_work_list[index] = NULL;
-		i40e_tcb_reset(tcb);
-		i40e_tcb_free(itrq, tcb);
+		if (tcb != NULL) {
+			itrq->itrq_tcb_work_list[index] = NULL;
+			i40e_tcb_reset(tcb);
+			i40e_tcb_free(itrq, tcb);
+		}
 
 		bzero(&itrq->itrq_desc_ring[index], sizeof (i40e_tx_desc_t));
 		index = i40e_next_desc(index, 1, itrq->itrq_tx_ring_size);
@@ -1995,6 +2098,7 @@ i40e_tx_recycle_ring(i40e_trqpair_t *itrq)
 	uint32_t wbhead, toclean, count;
 	i40e_tx_control_block_t *tcbhead;
 	i40e_t *i40e = itrq->itrq_i40e;
+	uint_t desc_per_tcb, i;
 
 	mutex_enter(&itrq->itrq_tx_lock);
 
@@ -2042,11 +2146,27 @@ i40e_tx_recycle_ring(i40e_trqpair_t *itrq)
 		tcbhead = tcb;
 
 		/*
-		 * We zero this out for sanity purposes.
+		 * In the DMA bind case, there may not necessarily be a 1:1
+		 * mapping between tcb's and descriptors.  If the tcb type
+		 * indicates a DMA binding then check the number of DMA
+		 * cookies to determine how many entries to clean in the
+		 * descriptor ring.
 		 */
-		bzero(&itrq->itrq_desc_ring[toclean], sizeof (i40e_tx_desc_t));
-		toclean = i40e_next_desc(toclean, 1, itrq->itrq_tx_ring_size);
-		count++;
+		if (tcb->tcb_type == I40E_TX_DMA)
+			desc_per_tcb = tcb->tcb_bind_ncookies;
+		else
+			desc_per_tcb = 1;
+
+		for (i = 0; i < desc_per_tcb; i++) {
+			/*
+			 * We zero this out for sanity purposes.
+			 */
+			bzero(&itrq->itrq_desc_ring[toclean],
+			    sizeof (i40e_tx_desc_t));
+			toclean = i40e_next_desc(toclean, 1,
+			    itrq->itrq_tx_ring_size);
+			count++;
+		}
 	}
 
 	itrq->itrq_desc_head = wbhead;
@@ -2078,6 +2198,95 @@ i40e_tx_recycle_ring(i40e_trqpair_t *itrq)
 	DTRACE_PROBE2(i40e__recycle, i40e_trqpair_t *, itrq, uint32_t, count);
 }
 
+static i40e_tx_control_block_t *
+i40e_tx_bind_fragment(i40e_trqpair_t *itrq, const mblk_t *mp,
+    boolean_t use_lso)
+{
+	ddi_dma_handle_t dma_handle;
+	ddi_dma_cookie_t dma_cookie;
+	uint_t i = 0, ncookies = 0, dmaflags;
+	i40e_tx_control_block_t *tcb;
+	i40e_txq_stat_t *txs = &itrq->itrq_txstat;
+
+	if ((tcb = i40e_tcb_alloc(itrq)) == NULL) {
+		txs->itxs_err_notcb.value.ui64++;
+		return (NULL);
+	}
+	tcb->tcb_type = I40E_TX_DMA;
+
+	if (use_lso == B_TRUE)
+		dma_handle = tcb->tcb_lso_dma_handle;
+	else
+		dma_handle = tcb->tcb_dma_handle;
+
+	dmaflags = DDI_DMA_WRITE | DDI_DMA_STREAMING;
+	if (ddi_dma_addr_bind_handle(dma_handle, NULL,
+	    (caddr_t)mp->b_rptr, MBLKL(mp), dmaflags, DDI_DMA_DONTWAIT, NULL,
+	    &dma_cookie, &ncookies) != DDI_DMA_MAPPED) {
+		txs->itxs_bind_fails.value.ui64++;
+		goto bffail;
+	}
+	tcb->tcb_bind_ncookies = ncookies;
+	tcb->tcb_used_lso = use_lso;
+
+	tcb->tcb_bind_info =
+	    kmem_zalloc(ncookies * sizeof (struct i40e_dma_bind_info),
+	    KM_NOSLEEP);
+	if (tcb->tcb_bind_info == NULL)
+		goto bffail;
+
+	while (i < ncookies) {
+		if (i > 0)
+			ddi_dma_nextcookie(dma_handle, &dma_cookie);
+
+		tcb->tcb_bind_info[i].dbi_paddr =
+		    (caddr_t)dma_cookie.dmac_laddress;
+		tcb->tcb_bind_info[i++].dbi_len = dma_cookie.dmac_size;
+	}
+
+	return (tcb);
+
+bffail:
+	i40e_tcb_reset(tcb);
+	i40e_tcb_free(itrq, tcb);
+	return (NULL);
+}
+
+static void
+i40e_tx_set_data_desc(i40e_trqpair_t *itrq, i40e_tx_context_t *tctx,
+    struct i40e_dma_bind_info *dbi, boolean_t last_desc)
+{
+	i40e_tx_desc_t *txdesc;
+	int cmd;
+
+	ASSERT(MUTEX_HELD(&itrq->itrq_tx_lock));
+	itrq->itrq_desc_free--;
+	txdesc = &itrq->itrq_desc_ring[itrq->itrq_desc_tail];
+	itrq->itrq_desc_tail = i40e_next_desc(itrq->itrq_desc_tail, 1,
+	    itrq->itrq_tx_ring_size);
+
+	cmd = I40E_TX_DESC_CMD_ICRC | tctx->itc_data_cmdflags;
+
+	/*
+	 * The last data descriptor needs the EOP bit set, so that the HW knows
+	 * that we're ready to send.  Additionally, we set the RS (Report
+	 * Status) bit, so that we are notified when the transmit engine has
+	 * completed DMA'ing all of the data descriptors and data buffers
+	 * associated with this frame.
+	 */
+	if (last_desc == B_TRUE) {
+		cmd |= I40E_TX_DESC_CMD_EOP;
+		cmd |= I40E_TX_DESC_CMD_RS;
+	}
+
+	txdesc->buffer_addr = CPU_TO_LE64((uintptr_t)dbi->dbi_paddr);
+	txdesc->cmd_type_offset_bsz =
+	    LE_64(((uint64_t)I40E_TX_DESC_DTYPE_DATA |
+	    ((uint64_t)tctx->itc_data_offsets << I40E_TXD_QW1_OFFSET_SHIFT) |
+	    ((uint64_t)cmd << I40E_TXD_QW1_CMD_SHIFT) |
+	    ((uint64_t)dbi->dbi_len << I40E_TXD_QW1_TX_BUF_SZ_SHIFT)));
+}
+
 /*
  * We've been asked to send a message block on the wire. We'll only have a
  * single chain. There will not be any b_next pointers; however, there may be
@@ -2098,10 +2307,15 @@ i40e_ring_tx(void *arg, mblk_t *mp)
 {
 	const mblk_t *nmp;
 	size_t mpsize;
-	i40e_tx_control_block_t *tcb;
+	i40e_tx_control_block_t *tcb_ctx = NULL, *tcb_data = NULL,
+	    **tcb_dma = NULL;
 	i40e_tx_desc_t *txdesc;
+	i40e_tx_context_desc_t *ctxdesc;
 	i40e_tx_context_t tctx;
 	int cmd, type;
+	uint_t i, needed_desc = 0, nbufs = 0;
+	boolean_t do_ctx_desc = B_FALSE, do_dma_bind = B_FALSE,
+	    use_lso = B_FALSE;
 
 	i40e_trqpair_t *itrq = arg;
 	i40e_t *i40e = itrq->itrq_i40e;
@@ -2121,7 +2335,7 @@ i40e_ring_tx(void *arg, mblk_t *mp)
 
 	/*
 	 * Figure out the relevant context about this frame that we might need
-	 * for enabling checksum, lso, etc. This also fills in information that
+	 * for enabling checksum, LSO, etc. This also fills in information that
 	 * we might set around the packet type, etc.
 	 */
 	if (i40e_tx_context(i40e, itrq, mp, &tctx) < 0) {
@@ -2129,97 +2343,204 @@ i40e_ring_tx(void *arg, mblk_t *mp)
 		itrq->itrq_txstat.itxs_err_context.value.ui64++;
 		return (NULL);
 	}
+	if (tctx.itc_ctx_cmdflags & I40E_TX_CTX_DESC_TSO) {
+		use_lso = B_TRUE;
+		do_ctx_desc = B_TRUE;
+	}
 
 	/*
 	 * For the primordial driver we can punt on doing any recycling right
 	 * now; however, longer term we need to probably do some more pro-active
-	 * recycling to cut back on stalls in the tx path.
+	 * recycling to cut back on stalls in the TX path.
 	 */
 
 	/*
-	 * Do a quick size check to make sure it fits into what we think it
-	 * should for this device. Note that longer term this will be false,
-	 * particularly when we have the world of TSO.
+	 * Iterate through the mblks to calculate both the total size of the
+	 * frame and the number of fragments.  This is used to determine
+	 * whether we're doing DMA binding and, if so, how many TX control
+	 * blocks we'll need.
 	 */
 	mpsize = 0;
 	for (nmp = mp; nmp != NULL; nmp = nmp->b_cont) {
-		mpsize += MBLKL(nmp);
+		size_t blksz = MBLKL(nmp);
+		if (blksz > 0) {
+			mpsize += blksz;
+			nbufs++;
+		}
 	}
 
-	/*
-	 * First we allocate our tx control block and prepare the packet for
-	 * transmit before we do a final check for descriptors. We do it this
-	 * way to minimize the time under the tx lock.
-	 */
-	tcb = i40e_tcb_alloc(itrq);
-	if (tcb == NULL) {
-		txs->itxs_err_notcb.value.ui64++;
-		goto txfail;
+	if (do_ctx_desc) {
+		/*
+		 * If we're doing tunneling or LSO, then we'll need a TX
+		 * context descriptor in addition to one or more TX data
+		 * descriptors.  Since there's no data DMA block or handle
+		 * associated with the context descriptor, we create a special
+		 * control block that behaves effectively like a NOP.
+		 */
+		if ((tcb_ctx = i40e_tcb_alloc(itrq)) == NULL) {
+			txs->itxs_err_notcb.value.ui64++;
+			goto txfail;
+		}
+		tcb_ctx->tcb_type = I40E_TX_DESC;
+		needed_desc++;
 	}
 
 	/*
-	 * For transmitting a block, we're currently going to use just a
-	 * single control block and bcopy all of the fragments into it. We
-	 * should be more intelligent about doing DMA binding or otherwise, but
-	 * for getting off the ground this will have to do.
+	 * For the non-LSO TX case, we alter our DMA strategy based on a
+	 * threshold tied to the frame size.  This threshold is configurable
+	 * via the tx_dma_threshold property.
+	 *
+	 * If the frame size is above the threshold, we do DMA binding of the
+	 * fragments, building a control block and data descriptor for each
+	 * piece.
+	 *
+	 * If it's below or at the threshold then we just use a single control
+	 * block and data descriptor and simply bcopy all of the fragments into
+	 * the pre-allocated DMA buffer in the control block.
+	 *
+	 * For the LSO TX case we always do DMA binding.
 	 */
-	ASSERT(tcb->tcb_dma.dmab_len == 0);
-	ASSERT(tcb->tcb_dma.dmab_size >= mpsize);
-	for (nmp = mp; nmp != NULL; nmp = nmp->b_cont) {
-		size_t clen = MBLKL(nmp);
-		void *coff = tcb->tcb_dma.dmab_address + tcb->tcb_dma.dmab_len;
+	if (use_lso == B_TRUE || mpsize > i40e->i40e_tx_dma_min) {
+		do_dma_bind = B_TRUE;
+		tcb_dma =
+		    kmem_zalloc(nbufs * sizeof (i40e_tx_control_block_t *),
+		    KM_NOSLEEP);
+		if (tcb_dma == NULL) {
+			i40e_error(i40e, "failed to allocate tcb_dma list");
+			goto txfail;
+		}
+		/*
+		 * For each b_cont: bind the control block's DMA handle to the
+		 * b_rptr, and record the cookies so that we can later iterate
+		 * through them and build TX data descriptors.
+		 */
+		for (nmp = mp, i = 0; nmp != NULL; nmp = nmp->b_cont) {
+			if (MBLKL(nmp) == 0)
+				continue;
+			tcb_dma[i] = i40e_tx_bind_fragment(itrq, nmp, use_lso);
+			if (tcb_dma[i] == NULL) {
+				i40e_error(i40e, "dma bind failed!");
+				goto txfail;
+			}
+			if (i == 0)
+				tcb_dma[i]->tcb_mp = mp;
+			needed_desc += tcb_dma[i++]->tcb_bind_ncookies;
+		}
+	} else {
+		/*
+		 * Just use a single control block and bcopy all of the
+		 * fragments into its pre-allocated DMA buffer.
+		 */
+		if ((tcb_data = i40e_tcb_alloc(itrq)) == NULL) {
+			txs->itxs_err_notcb.value.ui64++;
+			goto txfail;
+		}
+		tcb_data->tcb_type = I40E_TX_COPY;
 
-		bcopy(nmp->b_rptr, coff, clen);
-		tcb->tcb_dma.dmab_len += clen;
-	}
-	ASSERT(tcb->tcb_dma.dmab_len == mpsize);
+		ASSERT(tcb_data->tcb_dma.dmab_len == 0);
+		ASSERT(tcb_data->tcb_dma.dmab_size >= mpsize);
 
-	/*
-	 * While there's really no need to keep the mp here, but let's just do
-	 * it to help with our own debugging for now.
-	 */
-	tcb->tcb_mp = mp;
-	tcb->tcb_type = I40E_TX_COPY;
-	I40E_DMA_SYNC(&tcb->tcb_dma, DDI_DMA_SYNC_FORDEV);
+		for (nmp = mp; nmp != NULL; nmp = nmp->b_cont) {
+			size_t clen = MBLKL(nmp);
+			void *coff = tcb_data->tcb_dma.dmab_address +
+			    tcb_data->tcb_dma.dmab_len;
+
+			bcopy(nmp->b_rptr, coff, clen);
+			tcb_data->tcb_dma.dmab_len += clen;
+		}
+		ASSERT(tcb_data->tcb_dma.dmab_len == mpsize);
+		I40E_DMA_SYNC(&tcb_data->tcb_dma, DDI_DMA_SYNC_FORDEV);
+
+		tcb_data->tcb_mp = mp;
+		needed_desc++;
+	}
 
 	mutex_enter(&itrq->itrq_tx_lock);
-	if (itrq->itrq_desc_free < i40e->i40e_tx_block_thresh) {
+	if (itrq->itrq_desc_free < i40e->i40e_tx_block_thresh ||
+	    itrq->itrq_desc_free < needed_desc) {
 		txs->itxs_err_nodescs.value.ui64++;
 		mutex_exit(&itrq->itrq_tx_lock);
 		goto txfail;
 	}
 
-	/*
-	 * Build up the descriptor and send it out. Thankfully at the moment
-	 * we only need a single desc, because we're not doing anything fancy
-	 * yet.
-	 */
-	ASSERT(itrq->itrq_desc_free > 0);
-	itrq->itrq_desc_free--;
-	txdesc = &itrq->itrq_desc_ring[itrq->itrq_desc_tail];
-	itrq->itrq_tcb_work_list[itrq->itrq_desc_tail] = tcb;
-	itrq->itrq_desc_tail = i40e_next_desc(itrq->itrq_desc_tail, 1,
-	    itrq->itrq_tx_ring_size);
+	if (do_ctx_desc) {
+		/*
+		 * If we're enabling any offloads for this frame, then we'll
+		 * need to build up a transmit context descriptor, first.  The
+		 * context descriptor needs to be placed in the TX ring before
+		 * the data descriptor(s).  See section 8.4.2, table 8-16
+		 */
+		uint_t tail = itrq->itrq_desc_tail;
+		itrq->itrq_desc_free--;
+		ctxdesc = (i40e_tx_context_desc_t *)&itrq->itrq_desc_ring[tail];
+		itrq->itrq_tcb_work_list[tail] = tcb_ctx;
+		itrq->itrq_desc_tail = i40e_next_desc(tail, 1,
+		    itrq->itrq_tx_ring_size);
+
+		/* QW0 */
+		type = I40E_TX_DESC_DTYPE_CONTEXT;
+		ctxdesc->tunneling_params = 0;
+		ctxdesc->l2tag2 = 0;
+
+		/* QW1 */
+		ctxdesc->type_cmd_tso_mss = CPU_TO_LE64((uint64_t)type);
+		if (tctx.itc_ctx_cmdflags & I40E_TX_CTX_DESC_TSO) {
+			ctxdesc->type_cmd_tso_mss |= CPU_TO_LE64((uint64_t)
+			    ((uint64_t)tctx.itc_ctx_cmdflags <<
+			    I40E_TXD_CTX_QW1_CMD_SHIFT) |
+			    ((uint64_t)tctx.itc_ctx_tsolen <<
+			    I40E_TXD_CTX_QW1_TSO_LEN_SHIFT) |
+			    ((uint64_t)tctx.itc_ctx_mss <<
+			    I40E_TXD_CTX_QW1_MSS_SHIFT));
+		}
+	}
 
-	/*
-	 * Note, we always set EOP and RS which indicates that this is the last
-	 * data frame and that we should ask for it to be transmitted. We also
-	 * must always set ICRC, because that is an internal bit that must be
-	 * set to one for data descriptors. The remaining bits in the command
-	 * descriptor depend on checksumming and are determined based on the
-	 * information set up in i40e_tx_context().
-	 */
-	type = I40E_TX_DESC_DTYPE_DATA;
-	cmd = I40E_TX_DESC_CMD_EOP |
-	    I40E_TX_DESC_CMD_RS |
-	    I40E_TX_DESC_CMD_ICRC |
-	    tctx.itc_cmdflags;
-	txdesc->buffer_addr =
-	    CPU_TO_LE64((uintptr_t)tcb->tcb_dma.dmab_dma_address);
-	txdesc->cmd_type_offset_bsz = CPU_TO_LE64(((uint64_t)type |
-	    ((uint64_t)tctx.itc_offsets << I40E_TXD_QW1_OFFSET_SHIFT) |
-	    ((uint64_t)cmd << I40E_TXD_QW1_CMD_SHIFT) |
-	    ((uint64_t)tcb->tcb_dma.dmab_len << I40E_TXD_QW1_TX_BUF_SZ_SHIFT)));
+	if (do_dma_bind == B_TRUE) {
+		/*
+		 * Next build up a transmit data descriptor for each buffer.
+		 */
+		boolean_t last_desc = B_FALSE;
+		for (i = 0; i < nbufs; i++) {
+			itrq->itrq_tcb_work_list[itrq->itrq_desc_tail] =
+			    tcb_dma[i];
+
+			for (uint_t c = 0; c < tcb_dma[i]->tcb_bind_ncookies;
+			    c++) {
+				if (i == (nbufs - 1) &&
+				    c == (tcb_dma[i]->tcb_bind_ncookies - 1)) {
+					last_desc = B_TRUE;
+				}
+				i40e_tx_set_data_desc(itrq, &tctx,
+				    &tcb_dma[i]->tcb_bind_info[c], last_desc);
+			}
+		}
+		kmem_free(tcb_dma, nbufs * sizeof (i40e_tx_control_block_t *));
+		tcb_dma = NULL;
+	} else {
+		/*
+		 * Build up the single transmit data descriptor needed for the
+		 * non-DMA-bind case.
+		 */
+		itrq->itrq_desc_free--;
+		txdesc = &itrq->itrq_desc_ring[itrq->itrq_desc_tail];
+		itrq->itrq_tcb_work_list[itrq->itrq_desc_tail] = tcb_data;
+		itrq->itrq_desc_tail = i40e_next_desc(itrq->itrq_desc_tail, 1,
+		    itrq->itrq_tx_ring_size);
+
+		type = I40E_TX_DESC_DTYPE_DATA;
+		cmd = I40E_TX_DESC_CMD_EOP |
+		    I40E_TX_DESC_CMD_RS |
+		    I40E_TX_DESC_CMD_ICRC |
+		    tctx.itc_data_cmdflags;
+		txdesc->buffer_addr =
+		    CPU_TO_LE64((uintptr_t)tcb_data->tcb_dma.dmab_dma_address);
+		txdesc->cmd_type_offset_bsz = CPU_TO_LE64(((uint64_t)type |
+		    ((uint64_t)tctx.itc_data_offsets <<
+		    I40E_TXD_QW1_OFFSET_SHIFT) |
+		    ((uint64_t)cmd << I40E_TXD_QW1_CMD_SHIFT) |
+		    ((uint64_t)tcb_data->tcb_dma.dmab_len <<
+		    I40E_TXD_QW1_TX_BUF_SZ_SHIFT)));
+	}
 
 	/*
 	 * Now, finally, sync the DMA data and alert hardware.
@@ -2228,6 +2549,7 @@ i40e_ring_tx(void *arg, mblk_t *mp)
 
 	I40E_WRITE_REG(hw, I40E_QTX_TAIL(itrq->itrq_index),
 	    itrq->itrq_desc_tail);
+
 	if (i40e_check_acc_handle(i40e->i40e_osdep_space.ios_reg_handle) !=
 	    DDI_FM_OK) {
 		/*
@@ -2241,7 +2563,7 @@ i40e_ring_tx(void *arg, mblk_t *mp)
 
 	txs->itxs_bytes.value.ui64 += mpsize;
 	txs->itxs_packets.value.ui64++;
-	txs->itxs_descriptors.value.ui64++;
+	txs->itxs_descriptors.value.ui64 += needed_desc;
 
 	mutex_exit(&itrq->itrq_tx_lock);
 
@@ -2254,10 +2576,25 @@ txfail:
 	 * Make sure to reset their message block's, since we'll return them
 	 * back to MAC.
 	 */
-	if (tcb != NULL) {
-		tcb->tcb_mp = NULL;
-		i40e_tcb_reset(tcb);
-		i40e_tcb_free(itrq, tcb);
+	if (tcb_ctx != NULL) {
+		tcb_ctx->tcb_mp = NULL;
+		i40e_tcb_reset(tcb_ctx);
+		i40e_tcb_free(itrq, tcb_ctx);
+	}
+	if (tcb_data != NULL) {
+		tcb_data->tcb_mp = NULL;
+		i40e_tcb_reset(tcb_data);
+		i40e_tcb_free(itrq, tcb_data);
+	}
+	if (tcb_dma != NULL) {
+		for (i = 0; i < nbufs; i++) {
+			if (tcb_dma[i] == NULL)
+				break;
+			tcb_dma[i]->tcb_mp = NULL;
+			i40e_tcb_reset(tcb_dma[i]);
+			i40e_tcb_free(itrq, tcb_dma[i]);
+		}
+		kmem_free(tcb_dma, nbufs * sizeof (i40e_tx_control_block_t *));
 	}
 
 	mutex_enter(&itrq->itrq_tx_lock);
diff --git a/usr/src/uts/common/io/ib/clients/ibd/ibd_cm.c b/usr/src/uts/common/io/ib/clients/ibd/ibd_cm.c
index 1c8318b191..55c4159bc4 100644
--- a/usr/src/uts/common/io/ib/clients/ibd/ibd_cm.c
+++ b/usr/src/uts/common/io/ib/clients/ibd/ibd_cm.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -272,8 +273,7 @@ ibd_async_rc_process_too_big(ibd_state_t *state, ibd_req_t *req)
 	icmph->icmph_checksum = IP_CSUM(pmtu_mp,
 	    (int32_t)sizeof (ib_header_info_t) + (int32_t)sizeof (ipha_t), 0);
 
-	(void) hcksum_assoc(pmtu_mp, NULL, NULL, 0, 0, 0, 0,
-	    HCK_FULLCKSUM | HCK_FULLCKSUM_OK, 0);
+	mac_hcksum_set(pmtu_mp, 0, 0, 0, 0, HCK_FULLCKSUM | HCK_FULLCKSUM_OK);
 
 	DPRINT(30, "ibd_async_rc_process_too_big: sap=0x%x, ip_src=0x%x, "
 	    "ip_dst=0x%x, ttl=%d, len_needed=%d, msg_len=%d",
@@ -1560,8 +1560,7 @@ ibd_rc_process_rx(ibd_rc_chan_t *chan, ibd_rwqe_t *rwqe, ibt_wc_t *wc)
 	/*
 	 * Can RC mode in IB guarantee its checksum correctness?
 	 *
-	 *	(void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0,
-	 *	    HCK_FULLCKSUM | HCK_FULLCKSUM_OK, 0);
+	 * mac_hcksum_set(mp, 0, 0, 0, 0, HCK_FULLCKSUM | HCK_FULLCKSUM_OK);
 	 */
 
 	/*
diff --git a/usr/src/uts/common/io/inotify.c b/usr/src/uts/common/io/inotify.c
new file mode 100644
index 0000000000..eaa0c33f0f
--- /dev/null
+++ b/usr/src/uts/common/io/inotify.c
@@ -0,0 +1,1555 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ * Copyright (c) 2015 The MathWorks, Inc.  All rights reserved.
+ */
+
+/*
+ * Support for the inotify facility, a Linux-borne facility for asynchronous
+ * notification of certain events on specified files or directories.  Our
+ * implementation broadly leverages the file event monitoring facility, and
+ * would actually be quite straightforward were it not for a very serious
+ * blunder in the inotify interface:  in addition to allowing for one to be
+ * notified on events on a particular file or directory, inotify also allows
+ * for one to be notified on certain events on files _within_ a watched
+ * directory -- even though those events have absolutely nothing to do with
+ * the directory itself.  This leads to all sorts of madness because file
+ * operations are (of course) not undertaken on paths but rather on open
+ * files -- and the relationships between open files and the paths that resolve
+ * to those files are neither static nor isomorphic.  We implement this
+ * concept by having _child watches_ when directories are watched with events
+ * in IN_CHILD_EVENTS.  We add child watches when a watch on a directory is
+ * first added, and we modify those child watches dynamically as files are
+ * created, deleted, moved into or moved out of the specified directory.  This
+ * mechanism works well, absent hard links.  Hard links, unfortunately, break
+ * this rather badly, and the user is warned that watches on directories that
+ * have multiple directory entries referring to the same file may behave
+ * unexpectedly.
+ */
+
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/inotify.h>
+#include <sys/fem.h>
+#include <sys/conf.h>
+#include <sys/stat.h>
+#include <sys/vfs_opreg.h>
+#include <sys/vmem.h>
+#include <sys/avl.h>
+#include <sys/sysmacros.h>
+#include <sys/cyclic.h>
+#include <sys/filio.h>
+
+struct inotify_state;
+struct inotify_kevent;
+
+typedef struct inotify_watch inotify_watch_t;
+typedef struct inotify_state inotify_state_t;
+typedef struct inotify_kevent inotify_kevent_t;
+
+struct inotify_watch {
+	kmutex_t inw_lock;			/* lock protecting ref count */
+	int inw_refcnt;				/* reference count */
+	uint8_t inw_zombie:1;			/* boolean: is zombie */
+	uint8_t inw_fired:1;			/* boolean: fired one-shot */
+	uint8_t inw_active:1;			/* boolean: watch is active */
+	uint8_t inw_orphaned:1;			/* boolean: orphaned */
+	kcondvar_t inw_cv;			/* condvar for zombifier */
+	uint32_t inw_mask;			/* mask of watch */
+	int32_t inw_wd;				/* watch descriptor */
+	vnode_t *inw_vp;			/* underlying vnode */
+	inotify_watch_t *inw_parent;		/* parent, if a child */
+	avl_node_t inw_byvp;			/* watches by vnode */
+	avl_node_t inw_bywd;			/* watches by descriptor */
+	avl_tree_t inw_children;		/* children, if a parent */
+	char *inw_name;				/* name, if a child */
+	list_node_t inw_orphan;			/* orphan list */
+	cred_t *inw_cred;			/* cred, if orphaned */
+	inotify_state_t *inw_state;		/* corresponding state */
+};
+
+struct inotify_kevent {
+	inotify_kevent_t *ine_next;		/* next event in queue */
+	struct inotify_event ine_event;		/* event (variable size) */
+};
+
+#define	INOTIFY_EVENT_LENGTH(ev) \
+	(sizeof (inotify_kevent_t) + (ev)->ine_event.len)
+
+struct inotify_state {
+	kmutex_t ins_lock;			/* lock protecting state */
+	avl_tree_t ins_byvp;			/* watches by vnode */
+	avl_tree_t ins_bywd;			/* watches by descriptor */
+	vmem_t *ins_wds;			/* watch identifier arena */
+	int ins_maxwatches;			/* maximum number of watches */
+	int ins_maxevents;			/* maximum number of events */
+	int ins_nevents;			/* current # of events */
+	int32_t ins_size;			/* total size of events */
+	inotify_kevent_t *ins_head;		/* head of event queue */
+	inotify_kevent_t *ins_tail;		/* tail of event queue */
+	pollhead_t ins_pollhd;			/* poll head */
+	kcondvar_t ins_cv;			/* condvar for reading */
+	list_t ins_orphans;			/* orphan list */
+	ddi_periodic_t ins_cleaner;		/* cyclic for cleaning */
+	inotify_watch_t *ins_zombies;		/* zombie watch list */
+	cred_t *ins_cred;			/* creator's credentials */
+	inotify_state_t *ins_next;		/* next state on global list */
+};
+
+/*
+ * Tunables (exported read-only in lx-branded zones via /proc).
+ */
+int	inotify_maxwatches = 8192;		/* max watches per instance */
+int	inotify_maxevents = 16384;		/* max events */
+int	inotify_maxinstances = 128;		/* max instances per user */
+
+/*
+ * Internal global variables.
+ */
+static kmutex_t		inotify_lock;		/* lock protecting state */
+static dev_info_t	*inotify_devi;		/* device info */
+static fem_t		*inotify_femp;		/* FEM pointer */
+static vmem_t		*inotify_minor;		/* minor number arena */
+static void		*inotify_softstate;	/* softstate pointer */
+static inotify_state_t	*inotify_state;		/* global list if state */
+
+static void inotify_watch_event(inotify_watch_t *, uint64_t, char *);
+static void inotify_watch_insert(inotify_watch_t *, vnode_t *, char *);
+static void inotify_watch_delete(inotify_watch_t *, uint32_t);
+static void inotify_watch_remove(inotify_state_t *state,
+	inotify_watch_t *watch);
+
+static int
+inotify_fop_close(femarg_t *vf, int flag, int count, offset_t offset,
+    cred_t *cr, caller_context_t *ct)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_close(vf, flag, count, offset, cr, ct)) == 0) {
+		inotify_watch_event(watch, flag & FWRITE ?
+		    IN_CLOSE_WRITE : IN_CLOSE_NOWRITE, NULL);
+	}
+
+	return (rval);
+}
+
+static int
+inotify_fop_create(femarg_t *vf, char *name, vattr_t *vap, vcexcl_t excl,
+    int mode, vnode_t **vpp, cred_t *cr, int flag, caller_context_t *ct,
+    vsecattr_t *vsecp)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_create(vf, name, vap, excl, mode,
+	    vpp, cr, flag, ct, vsecp)) == 0) {
+		inotify_watch_insert(watch, *vpp, name);
+		inotify_watch_event(watch, IN_CREATE, name);
+	}
+
+	return (rval);
+}
+
+static int
+inotify_fop_link(femarg_t *vf, vnode_t *svp, char *tnm, cred_t *cr,
+    caller_context_t *ct, int flags)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_link(vf, svp, tnm, cr, ct, flags)) == 0) {
+		inotify_watch_insert(watch, svp, tnm);
+		inotify_watch_event(watch, IN_CREATE, tnm);
+	}
+
+	return (rval);
+}
+
+static int
+inotify_fop_mkdir(femarg_t *vf, char *name, vattr_t *vap, vnode_t **vpp,
+    cred_t *cr, caller_context_t *ct, int flags, vsecattr_t *vsecp)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_mkdir(vf, name, vap, vpp, cr,
+	    ct, flags, vsecp)) == 0) {
+		inotify_watch_insert(watch, *vpp, name);
+		inotify_watch_event(watch, IN_CREATE | IN_ISDIR, name);
+	}
+
+	return (rval);
+}
+
+static int
+inotify_fop_open(femarg_t *vf, int mode, cred_t *cr, caller_context_t *ct)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_open(vf, mode, cr, ct)) == 0)
+		inotify_watch_event(watch, IN_OPEN, NULL);
+
+	return (rval);
+}
+
+static int
+inotify_fop_read(femarg_t *vf, struct uio *uiop, int ioflag, struct cred *cr,
+    caller_context_t *ct)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval = vnext_read(vf, uiop, ioflag, cr, ct);
+	inotify_watch_event(watch, IN_ACCESS, NULL);
+
+	return (rval);
+}
+
+static int
+inotify_fop_readdir(femarg_t *vf, uio_t *uiop, cred_t *cr, int *eofp,
+    caller_context_t *ct, int flags)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval = vnext_readdir(vf, uiop, cr, eofp, ct, flags);
+	inotify_watch_event(watch, IN_ACCESS | IN_ISDIR, NULL);
+
+	return (rval);
+}
+
+int
+inotify_fop_remove(femarg_t *vf, char *nm, cred_t *cr, caller_context_t *ct,
+    int flags)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_remove(vf, nm, cr, ct, flags)) == 0)
+		inotify_watch_event(watch, IN_DELETE, nm);
+
+	return (rval);
+}
+
+int
+inotify_fop_rmdir(femarg_t *vf, char *nm, vnode_t *cdir, cred_t *cr,
+    caller_context_t *ct, int flags)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_rmdir(vf, nm, cdir, cr, ct, flags)) == 0)
+		inotify_watch_event(watch, IN_DELETE | IN_ISDIR, nm);
+
+	return (rval);
+}
+
+static int
+inotify_fop_setattr(femarg_t *vf, vattr_t *vap, int flags, cred_t *cr,
+    caller_context_t *ct)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval;
+
+	if ((rval = vnext_setattr(vf, vap, flags, cr, ct)) == 0)
+		inotify_watch_event(watch, IN_ATTRIB, NULL);
+
+	return (rval);
+}
+
+static int
+inotify_fop_write(femarg_t *vf, struct uio *uiop, int ioflag, struct cred *cr,
+    caller_context_t *ct)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+	int rval = vnext_write(vf, uiop, ioflag, cr, ct);
+	inotify_watch_event(watch, IN_MODIFY, NULL);
+
+	return (rval);
+}
+
+static int
+inotify_fop_vnevent(femarg_t *vf, vnevent_t vnevent, vnode_t *dvp, char *name,
+    caller_context_t *ct)
+{
+	inotify_watch_t *watch = vf->fa_fnode->fn_available;
+
+	switch (vnevent) {
+	case VE_RENAME_SRC:
+		inotify_watch_event(watch, IN_MOVE_SELF, NULL);
+		inotify_watch_delete(watch, IN_MOVE_SELF);
+		break;
+	case VE_REMOVE:
+		/*
+		 * Linux will apparently fire an IN_ATTRIB event when the link
+		 * count changes (including when it drops to 0 on a remove).
+		 * This is merely somewhat odd; what is amazing is that this
+		 * IN_ATTRIB event is not visible on an inotify watch on the
+		 * parent directory.  (IN_ATTRIB events are normally sent to
+		 * watches on the parent directory).  While it's hard to
+		 * believe that this constitutes desired semantics, ltp
+		 * unfortunately tests this case (if implicitly); in the name
+		 * of bug-for-bug compatibility, we fire IN_ATTRIB iff we are
+		 * explicitly watching the file that has been removed.
+		 */
+		if (watch->inw_parent == NULL)
+			inotify_watch_event(watch, IN_ATTRIB, NULL);
+
+		/*FALLTHROUGH*/
+	case VE_RENAME_DEST:
+		inotify_watch_event(watch, IN_DELETE_SELF, NULL);
+		inotify_watch_delete(watch, IN_DELETE_SELF);
+		break;
+	case VE_RMDIR:
+		/*
+		 * It seems that IN_ISDIR should really be OR'd in here, but
+		 * Linux doesn't seem to do that in this case; for the sake of
+		 * bug-for-bug compatibility, we don't do it either.
+		 */
+		inotify_watch_event(watch, IN_DELETE_SELF, NULL);
+		inotify_watch_delete(watch, IN_DELETE_SELF);
+		break;
+	case VE_CREATE:
+	case VE_TRUNCATE:
+	case VE_RESIZE:
+		inotify_watch_event(watch, IN_MODIFY | IN_ATTRIB, NULL);
+		break;
+	case VE_LINK:
+		inotify_watch_event(watch, IN_ATTRIB, NULL);
+		break;
+	case VE_RENAME_SRC_DIR:
+		inotify_watch_event(watch, IN_MOVED_FROM, name);
+		break;
+	case VE_RENAME_DEST_DIR:
+		if (name == NULL)
+			name = dvp->v_path;
+
+		inotify_watch_insert(watch, dvp, name);
+		inotify_watch_event(watch, IN_MOVED_TO, name);
+		break;
+	case VE_SUPPORT:
+	case VE_MOUNTEDOVER:
+	case VE_PRE_RENAME_SRC:
+	case VE_PRE_RENAME_DEST:
+	case VE_PRE_RENAME_DEST_DIR:
+		break;
+	}
+
+	return (vnext_vnevent(vf, vnevent, dvp, name, ct));
+}
+
+const fs_operation_def_t inotify_vnodesrc_template[] = {
+	VOPNAME_CLOSE,		{ .femop_close = inotify_fop_close },
+	VOPNAME_CREATE,		{ .femop_create = inotify_fop_create },
+	VOPNAME_LINK,		{ .femop_link = inotify_fop_link },
+	VOPNAME_MKDIR,		{ .femop_mkdir = inotify_fop_mkdir },
+	VOPNAME_OPEN,		{ .femop_open = inotify_fop_open },
+	VOPNAME_READ,		{ .femop_read = inotify_fop_read },
+	VOPNAME_READDIR,	{ .femop_readdir = inotify_fop_readdir },
+	VOPNAME_REMOVE,		{ .femop_remove = inotify_fop_remove },
+	VOPNAME_RMDIR,		{ .femop_rmdir = inotify_fop_rmdir },
+	VOPNAME_SETATTR,	{ .femop_setattr = inotify_fop_setattr },
+	VOPNAME_WRITE,		{ .femop_write = inotify_fop_write },
+	VOPNAME_VNEVENT,	{ .femop_vnevent = inotify_fop_vnevent },
+	NULL, NULL
+};
+
+static int
+inotify_watch_cmpwd(inotify_watch_t *lhs, inotify_watch_t *rhs)
+{
+	if (lhs->inw_wd < rhs->inw_wd)
+		return (-1);
+
+	if (lhs->inw_wd > rhs->inw_wd)
+		return (1);
+
+	return (0);
+}
+
+static int
+inotify_watch_cmpvp(inotify_watch_t *lhs, inotify_watch_t *rhs)
+{
+	uintptr_t lvp = (uintptr_t)lhs->inw_vp, rvp = (uintptr_t)rhs->inw_vp;
+
+	if (lvp < rvp)
+		return (-1);
+
+	if (lvp > rvp)
+		return (1);
+
+	return (0);
+}
+
+static void
+inotify_watch_hold(inotify_watch_t *watch)
+{
+	mutex_enter(&watch->inw_lock);
+	VERIFY(watch->inw_refcnt > 0);
+	watch->inw_refcnt++;
+	mutex_exit(&watch->inw_lock);
+}
+
+static void
+inotify_watch_release(inotify_watch_t *watch)
+{
+	mutex_enter(&watch->inw_lock);
+	VERIFY(watch->inw_refcnt > 1);
+
+	if (--watch->inw_refcnt == 1 && watch->inw_zombie) {
+		/*
+		 * We're down to our last reference; kick anyone that might be
+		 * waiting.
+		 */
+		cv_signal(&watch->inw_cv);
+	}
+
+	mutex_exit(&watch->inw_lock);
+}
+
+static void
+inotify_watch_event(inotify_watch_t *watch, uint64_t mask, char *name)
+{
+	inotify_kevent_t *event, *tail;
+	inotify_state_t *state = watch->inw_state;
+	uint32_t wd = watch->inw_wd, cookie = 0, len;
+	boolean_t removal = mask & IN_REMOVAL ? B_TRUE : B_FALSE;
+	inotify_watch_t *source = watch;
+
+	if (!(mask &= watch->inw_mask) || mask == IN_ISDIR)
+		return;
+
+	if (watch->inw_parent != NULL) {
+		/*
+		 * This is an event on the child; if this isn't a valid child
+		 * event, return.  Otherwise, we move our watch to be our
+		 * parent (which we know is around because we have a hold on
+		 * it) and continue.
+		 */
+		if (!(mask & IN_CHILD_EVENTS))
+			return;
+
+		name = watch->inw_name;
+		watch = watch->inw_parent;
+		wd = watch->inw_wd;
+	}
+
+	if (!removal) {
+		mutex_enter(&state->ins_lock);
+
+		if (watch->inw_zombie ||
+		    watch->inw_fired || !watch->inw_active) {
+			mutex_exit(&state->ins_lock);
+			return;
+		}
+	} else {
+		if (!watch->inw_active)
+			return;
+
+		VERIFY(MUTEX_HELD(&state->ins_lock));
+	}
+
+	/*
+	 * If this is an operation on a directory and it's a child event
+	 * (event if it's not on a child), we specify IN_ISDIR.
+	 */
+	if (source->inw_vp->v_type == VDIR && (mask & IN_CHILD_EVENTS))
+		mask |= IN_ISDIR;
+
+	if (mask & (IN_MOVED_FROM | IN_MOVED_TO))
+		cookie = (uint32_t)curthread->t_did;
+
+	if (state->ins_nevents >= state->ins_maxevents) {
+		/*
+		 * We're at our maximum number of events -- turn our event
+		 * into an IN_Q_OVERFLOW event, which will be coalesced if
+		 * it's already the tail event.
+		 */
+		mask = IN_Q_OVERFLOW;
+		wd = (uint32_t)-1;
+		cookie = 0;
+		len = 0;
+	}
+
+	if ((tail = state->ins_tail) != NULL && tail->ine_event.wd == wd &&
+	    tail->ine_event.mask == mask && tail->ine_event.cookie == cookie &&
+	    ((tail->ine_event.len == 0 && len == 0) ||
+	    (name != NULL && tail->ine_event.len != 0 &&
+	    strcmp(tail->ine_event.name, name) == 0))) {
+		/*
+		 * This is an implicitly coalesced event; we're done.
+		 */
+		if (!removal)
+			mutex_exit(&state->ins_lock);
+		return;
+	}
+
+	if (name != NULL) {
+		/*
+		 * We are in the context of a file event monitoring operation,
+		 * so the name length is bounded by the kernel.
+		 */
+		len = strlen(name) + 1;
+		len = roundup(len, sizeof (struct inotify_event));
+	} else {
+		len = 0;
+	}
+
+	event = kmem_zalloc(sizeof (inotify_kevent_t) + len, KM_SLEEP);
+	event->ine_event.wd = wd;
+	event->ine_event.mask = (uint32_t)mask;
+	event->ine_event.cookie = cookie;
+	event->ine_event.len = len;
+
+	if (name != NULL)
+		(void) strcpy(event->ine_event.name, name);
+
+	if (tail != NULL) {
+		tail->ine_next = event;
+	} else {
+		VERIFY(state->ins_head == NULL);
+		state->ins_head = event;
+		cv_broadcast(&state->ins_cv);
+	}
+
+	state->ins_tail = event;
+	state->ins_nevents++;
+	state->ins_size += sizeof (event->ine_event) + len;
+
+	if (removal)
+		return;
+
+	if ((watch->inw_mask & IN_ONESHOT) && !watch->inw_fired) {
+		/*
+		 * If this is a one-shot, we need to remove the watch.  (Note
+		 * that this will recurse back into inotify_watch_event() to
+		 * fire the IN_IGNORED event -- but with "removal" set.)
+		 */
+		watch->inw_fired = 1;
+		inotify_watch_remove(state, watch);
+	}
+
+	mutex_exit(&state->ins_lock);
+	pollwakeup(&state->ins_pollhd, POLLRDNORM | POLLIN);
+}
+
+/*
+ * Destroy a watch.  By the time we're in here, the watch must have exactly
+ * one reference.
+ */
+static void
+inotify_watch_destroy(inotify_watch_t *watch)
+{
+	VERIFY(MUTEX_HELD(&watch->inw_lock));
+
+	if (watch->inw_name != NULL)
+		kmem_free(watch->inw_name, strlen(watch->inw_name) + 1);
+
+	kmem_free(watch, sizeof (inotify_watch_t));
+}
+
+static int
+inotify_fem_install(vnode_t *vp, inotify_watch_t *watch)
+{
+	/*
+	 * For vnodes that are devices (of type VCHR or VBLK), we silently
+	 * refuse to actually install any event monitor.  This is to avoid
+	 * single-thread deadlock when both a special device vnode and its
+	 * underlying real vnode are being watched:  releasing the device
+	 * vnode upon watch removal can induce an attribute update on the
+	 * underlying vnode, which will bring us into inotify_watch_event()
+	 * with our lock already held.  While we could fail earlier and more
+	 * explicitly in this case, we choose to keep with the Linux behavior
+	 * on unwatchable entities and allow the watch but not generate any
+	 * events for it.
+	 */
+	if (vp->v_type == VCHR || vp->v_type == VBLK)
+		return (0);
+
+	return (fem_install(vp, inotify_femp, watch, OPARGUNIQ,
+	    (void (*)(void *))inotify_watch_hold,
+	    (void (*)(void *))inotify_watch_release));
+}
+
+static int
+inotify_fem_uninstall(vnode_t *vp, inotify_watch_t *watch)
+{
+	/*
+	 * See inotify_fem_install(), above, for our rationale here.
+	 */
+	if (vp->v_type == VCHR || vp->v_type == VBLK)
+		return (0);
+
+	return (fem_uninstall(vp, inotify_femp, watch));
+}
+
+/*
+ * Zombify a watch.  By the time we come in here, it must be true that the
+ * watch has already been fem_uninstall()'d -- the only reference should be
+ * in the state's data structure.  If we can get away with freeing it, we'll
+ * do that -- but if the reference count is greater than one due to an active
+ * vnode operation, we'll put this watch on the zombie list on the state
+ * structure.
+ */
+static void
+inotify_watch_zombify(inotify_watch_t *watch)
+{
+	inotify_state_t *state = watch->inw_state;
+
+	VERIFY(MUTEX_HELD(&state->ins_lock));
+	VERIFY(!watch->inw_zombie);
+
+	watch->inw_zombie = 1;
+
+	if (watch->inw_parent != NULL) {
+		inotify_watch_release(watch->inw_parent);
+	} else {
+		avl_remove(&state->ins_byvp, watch);
+		avl_remove(&state->ins_bywd, watch);
+		vmem_free(state->ins_wds, (void *)(uintptr_t)watch->inw_wd, 1);
+		watch->inw_wd = -1;
+	}
+
+	mutex_enter(&watch->inw_lock);
+
+	if (watch->inw_refcnt == 1) {
+		/*
+		 * There are no operations in flight and there is no way
+		 * for anyone to discover this watch -- we can destroy it.
+		 */
+		inotify_watch_destroy(watch);
+	} else {
+		/*
+		 * There are operations in flight; we will need to enqueue
+		 * this for later destruction.
+		 */
+		watch->inw_parent = state->ins_zombies;
+		state->ins_zombies = watch;
+		mutex_exit(&watch->inw_lock);
+	}
+}
+
+static inotify_watch_t *
+inotify_watch_add(inotify_state_t *state, inotify_watch_t *parent,
+    const char *name, vnode_t *vp, uint32_t mask)
+{
+	inotify_watch_t *watch;
+	int err;
+
+	VERIFY(MUTEX_HELD(&state->ins_lock));
+
+	watch = kmem_zalloc(sizeof (inotify_watch_t), KM_SLEEP);
+
+	watch->inw_vp = vp;
+	watch->inw_mask = mask;
+	watch->inw_state = state;
+	watch->inw_refcnt = 1;
+
+	if (parent == NULL) {
+		watch->inw_wd = (int)(uintptr_t)vmem_alloc(state->ins_wds,
+		    1, VM_BESTFIT | VM_SLEEP);
+		avl_add(&state->ins_byvp, watch);
+		avl_add(&state->ins_bywd, watch);
+
+		avl_create(&watch->inw_children,
+		    (int(*)(const void *, const void *))inotify_watch_cmpvp,
+		    sizeof (inotify_watch_t),
+		    offsetof(inotify_watch_t, inw_byvp));
+	} else {
+		VERIFY(name != NULL);
+		inotify_watch_hold(parent);
+		watch->inw_mask &= IN_CHILD_EVENTS;
+		watch->inw_parent = parent;
+
+		/*
+		 * Copy the name.  Note that when the name is user-specified,
+		 * its length is bounded by the copyinstr() to be MAXPATHLEN
+		 * (and regardless, we know by this point that it exists in
+		 * our parent).
+		 */
+		watch->inw_name = kmem_alloc(strlen(name) + 1, KM_SLEEP);
+		(void) strcpy(watch->inw_name, name);
+
+		avl_add(&parent->inw_children, watch);
+	}
+
+	/*
+	 * Add our monitor to the vnode.  We must not have the watch lock held
+	 * when we do this, as it will immediately hold our watch.
+	 */
+	err = inotify_fem_install(vp, watch);
+
+	VERIFY(err == 0);
+
+	return (watch);
+}
+
+/*
+ * Remove a (non-child) watch.  This is called from either synchronous context
+ * via inotify_rm_watch() or monitor context via either a vnevent or a
+ * one-shot.
+ */
+static void
+inotify_watch_remove(inotify_state_t *state, inotify_watch_t *watch)
+{
+	inotify_watch_t *child;
+	int err;
+
+	VERIFY(MUTEX_HELD(&state->ins_lock));
+	VERIFY(watch->inw_parent == NULL);
+
+	err = inotify_fem_uninstall(watch->inw_vp, watch);
+	VERIFY(err == 0);
+
+	/*
+	 * If we have children, we're going to remove them all and set them
+	 * all to be zombies.
+	 */
+	while ((child = avl_first(&watch->inw_children)) != NULL) {
+		VERIFY(child->inw_parent == watch);
+		avl_remove(&watch->inw_children, child);
+
+		err = inotify_fem_uninstall(child->inw_vp, child);
+		VERIFY(err == 0);
+
+		/*
+		 * If this child watch has been orphaned, remove it from the
+		 * state's list of orphans.
+		 */
+		if (child->inw_orphaned) {
+			list_remove(&state->ins_orphans, child);
+			crfree(child->inw_cred);
+		}
+
+		VN_RELE(child->inw_vp);
+
+		/*
+		 * We're down (or should be down) to a single reference to
+		 * this child watch; it's safe to zombify it.
+		 */
+		inotify_watch_zombify(child);
+	}
+
+	inotify_watch_event(watch, IN_IGNORED | IN_REMOVAL, NULL);
+	VN_RELE(watch->inw_vp);
+
+	/*
+	 * It's now safe to zombify the watch -- we know that the only reference
+	 * can come from operations in flight.
+	 */
+	inotify_watch_zombify(watch);
+}
+
+/*
+ * Delete a watch.  Should only be called from VOP context.
+ */
+static void
+inotify_watch_delete(inotify_watch_t *watch, uint32_t event)
+{
+	inotify_state_t *state = watch->inw_state;
+	inotify_watch_t cmp = { .inw_vp = watch->inw_vp }, *parent;
+	int err;
+
+	if (event != IN_DELETE_SELF && !(watch->inw_mask & IN_CHILD_EVENTS))
+		return;
+
+	mutex_enter(&state->ins_lock);
+
+	if (watch->inw_zombie) {
+		mutex_exit(&state->ins_lock);
+		return;
+	}
+
+	if ((parent = watch->inw_parent) == NULL) {
+		if (event == IN_DELETE_SELF) {
+			/*
+			 * If we're here because we're being deleted and we
+			 * are not a child watch, we need to delete the entire
+			 * watch, children and all.
+			 */
+			inotify_watch_remove(state, watch);
+		}
+
+		mutex_exit(&state->ins_lock);
+		return;
+	} else {
+		if (event == IN_DELETE_SELF &&
+		    !(parent->inw_mask & IN_EXCL_UNLINK)) {
+			/*
+			 * This is a child watch for a file that is being
+			 * removed and IN_EXCL_UNLINK has not been specified;
+			 * indicate that it is orphaned and add it to the list
+			 * of orphans.  (This list will be checked by the
+			 * cleaning cyclic to determine when the watch has
+			 * become the only hold on the vnode, at which point
+			 * the watch can be zombified.)  Note that we check
+			 * if the watch is orphaned before we orphan it:  hard
+			 * links make it possible for VE_REMOVE to be called
+			 * multiple times on the same vnode. (!)
+			 */
+			if (!watch->inw_orphaned) {
+				watch->inw_orphaned = 1;
+				watch->inw_cred = CRED();
+				crhold(watch->inw_cred);
+				list_insert_head(&state->ins_orphans, watch);
+			}
+
+			mutex_exit(&state->ins_lock);
+			return;
+		}
+
+		if (watch->inw_orphaned) {
+			/*
+			 * If we're here, a file was orphaned and then later
+			 * moved -- which almost certainly means that hard
+			 * links are on the scene.  We choose the orphan over
+			 * the move because we don't want to spuriously
+			 * drop events if we can avoid it.
+			 */
+			crfree(watch->inw_cred);
+			list_remove(&state->ins_orphans, watch);
+		}
+	}
+
+	if (avl_find(&parent->inw_children, &cmp, NULL) == NULL) {
+		/*
+		 * This watch has already been deleted from the parent.
+		 */
+		mutex_exit(&state->ins_lock);
+		return;
+	}
+
+	avl_remove(&parent->inw_children, watch);
+	err = inotify_fem_uninstall(watch->inw_vp, watch);
+	VERIFY(err == 0);
+
+	VN_RELE(watch->inw_vp);
+
+	/*
+	 * It's now safe to zombify the watch -- which won't actually delete
+	 * it as we know that the reference count is greater than 1.
+	 */
+	inotify_watch_zombify(watch);
+	mutex_exit(&state->ins_lock);
+}
+
+/*
+ * Insert a new child watch.  Should only be called from VOP context when
+ * a child is created in a watched directory.
+ */
+static void
+inotify_watch_insert(inotify_watch_t *watch, vnode_t *vp, char *name)
+{
+	inotify_state_t *state = watch->inw_state;
+	inotify_watch_t cmp = { .inw_vp = vp };
+
+	if (!(watch->inw_mask & IN_CHILD_EVENTS))
+		return;
+
+	mutex_enter(&state->ins_lock);
+
+	if (watch->inw_zombie || watch->inw_parent != NULL || vp == NULL) {
+		mutex_exit(&state->ins_lock);
+		return;
+	}
+
+	if (avl_find(&watch->inw_children, &cmp, NULL) != NULL) {
+		mutex_exit(&state->ins_lock);
+		return;
+	}
+
+	VN_HOLD(vp);
+	watch = inotify_watch_add(state, watch, name, vp, watch->inw_mask);
+	VERIFY(watch != NULL);
+
+	mutex_exit(&state->ins_lock);
+}
+
+
+static int
+inotify_add_watch(inotify_state_t *state, vnode_t *vp, uint32_t mask,
+    int32_t *wdp)
+{
+	inotify_watch_t *watch, cmp = { .inw_vp = vp };
+	uint32_t set;
+
+	set = (mask & (IN_ALL_EVENTS | IN_MODIFIERS)) | IN_UNMASKABLE;
+
+	/*
+	 * Lookup our vnode to determine if we already have a watch on it.
+	 */
+	mutex_enter(&state->ins_lock);
+
+	if ((watch = avl_find(&state->ins_byvp, &cmp, NULL)) == NULL) {
+		/*
+		 * We don't have this watch; allocate a new one, provided that
+		 * we have fewer than our limit.
+		 */
+		if (avl_numnodes(&state->ins_bywd) >= state->ins_maxwatches) {
+			mutex_exit(&state->ins_lock);
+			return (ENOSPC);
+		}
+
+		VN_HOLD(vp);
+		watch = inotify_watch_add(state, NULL, NULL, vp, set);
+		*wdp = watch->inw_wd;
+		mutex_exit(&state->ins_lock);
+
+		return (0);
+	}
+
+	VERIFY(!watch->inw_zombie);
+
+	if (!(mask & IN_MASK_ADD)) {
+		/*
+		 * Note that if we're resetting our event mask and we're
+		 * transitioning from an event mask that includes child events
+		 * to one that doesn't, there will be potentially some stale
+		 * child watches.  This is basically fine:  they won't fire,
+		 * and they will correctly be removed when the watch is
+		 * removed.
+		 */
+		watch->inw_mask = 0;
+	}
+
+	watch->inw_mask |= set;
+
+	*wdp = watch->inw_wd;
+
+	mutex_exit(&state->ins_lock);
+
+	return (0);
+}
+
+static int
+inotify_add_child(inotify_state_t *state, vnode_t *vp, char *name)
+{
+	inotify_watch_t *watch, cmp = { .inw_vp = vp };
+	vnode_t *cvp;
+	int err;
+
+	/*
+	 * Verify that the specified child doesn't have a directory component
+	 * within it.
+	 */
+	if (strchr(name, '/') != NULL)
+		return (EINVAL);
+
+	/*
+	 * Lookup the underlying file.  Note that this will succeed even if
+	 * we don't have permissions to actually read the file.
+	 */
+	if ((err = lookupnameat(name,
+	    UIO_SYSSPACE, NO_FOLLOW, NULL, &cvp, vp)) != 0) {
+		return (err);
+	}
+
+	/*
+	 * Use our vnode to find our watch, and then add our child watch to it.
+	 */
+	mutex_enter(&state->ins_lock);
+
+	if ((watch = avl_find(&state->ins_byvp, &cmp, NULL)) == NULL) {
+		/*
+		 * This is unexpected -- it means that we don't have the
+		 * watch that we thought we had.
+		 */
+		mutex_exit(&state->ins_lock);
+		VN_RELE(cvp);
+		return (ENXIO);
+	}
+
+	/*
+	 * Now lookup the child vnode in the watch; we'll only add it if it
+	 * isn't already there.
+	 */
+	cmp.inw_vp = cvp;
+
+	if (avl_find(&watch->inw_children, &cmp, NULL) != NULL) {
+		mutex_exit(&state->ins_lock);
+		VN_RELE(cvp);
+		return (0);
+	}
+
+	watch = inotify_watch_add(state, watch, name, cvp, watch->inw_mask);
+	VERIFY(watch != NULL);
+	mutex_exit(&state->ins_lock);
+
+	return (0);
+}
+
+static int
+inotify_rm_watch(inotify_state_t *state, int32_t wd)
+{
+	inotify_watch_t *watch, cmp = { .inw_wd = wd };
+
+	mutex_enter(&state->ins_lock);
+
+	if ((watch = avl_find(&state->ins_bywd, &cmp, NULL)) == NULL) {
+		mutex_exit(&state->ins_lock);
+		return (EINVAL);
+	}
+
+	inotify_watch_remove(state, watch);
+	mutex_exit(&state->ins_lock);
+
+	/*
+	 * Because removing a watch will generate an IN_IGNORED event (and
+	 * because inotify_watch_remove() won't alone induce a pollwakeup()),
+	 * we need to explicitly issue a pollwakeup().
+	 */
+	pollwakeup(&state->ins_pollhd, POLLRDNORM | POLLIN);
+
+	return (0);
+}
+
+static int
+inotify_activate(inotify_state_t *state, int32_t wd)
+{
+	inotify_watch_t *watch, cmp = { .inw_wd = wd };
+
+	mutex_enter(&state->ins_lock);
+
+	if ((watch = avl_find(&state->ins_bywd, &cmp, NULL)) == NULL) {
+		mutex_exit(&state->ins_lock);
+		return (EINVAL);
+	}
+
+	watch->inw_active = 1;
+
+	mutex_exit(&state->ins_lock);
+
+	return (0);
+}
+
+/*
+ * Called periodically as a cyclic to process the orphans and zombies.
+ */
+static void
+inotify_clean(void *arg)
+{
+	inotify_state_t *state = arg;
+	inotify_watch_t *watch, *parent, *next, **prev;
+	cred_t *savecred;
+	int err;
+
+	mutex_enter(&state->ins_lock);
+
+	for (watch = list_head(&state->ins_orphans);
+	    watch != NULL; watch = next) {
+		next = list_next(&state->ins_orphans, watch);
+
+		VERIFY(!watch->inw_zombie);
+		VERIFY((parent = watch->inw_parent) != NULL);
+
+		if (watch->inw_vp->v_count > 1)
+			continue;
+
+		avl_remove(&parent->inw_children, watch);
+		err = inotify_fem_uninstall(watch->inw_vp, watch);
+		VERIFY(err == 0);
+
+		list_remove(&state->ins_orphans, watch);
+
+		/*
+		 * For purposes of releasing the vnode, we need to switch our
+		 * cred to be the cred of the orphaning thread (which we held
+		 * at the time this watch was orphaned).
+		 */
+		savecred = curthread->t_cred;
+		curthread->t_cred = watch->inw_cred;
+		VN_RELE(watch->inw_vp);
+		crfree(watch->inw_cred);
+		curthread->t_cred = savecred;
+
+		inotify_watch_zombify(watch);
+	}
+
+	prev = &state->ins_zombies;
+
+	while ((watch = *prev) != NULL) {
+		mutex_enter(&watch->inw_lock);
+
+		if (watch->inw_refcnt == 1) {
+			*prev = watch->inw_parent;
+			inotify_watch_destroy(watch);
+			continue;
+		}
+
+		prev = &watch->inw_parent;
+		mutex_exit(&watch->inw_lock);
+	}
+
+	mutex_exit(&state->ins_lock);
+}
+
+/*ARGSUSED*/
+static int
+inotify_open(dev_t *devp, int flag, int otyp, cred_t *cred_p)
+{
+	inotify_state_t *state;
+	major_t major = getemajor(*devp);
+	minor_t minor = getminor(*devp);
+	int instances = 0;
+	char c[64];
+
+	if (minor != INOTIFYMNRN_INOTIFY)
+		return (ENXIO);
+
+	mutex_enter(&inotify_lock);
+
+	for (state = inotify_state; state != NULL; state = state->ins_next) {
+		if (state->ins_cred == cred_p)
+			instances++;
+	}
+
+	if (instances >= inotify_maxinstances) {
+		mutex_exit(&inotify_lock);
+		return (EMFILE);
+	}
+
+	minor = (minor_t)(uintptr_t)vmem_alloc(inotify_minor, 1,
+	    VM_BESTFIT | VM_SLEEP);
+
+	if (ddi_soft_state_zalloc(inotify_softstate, minor) != DDI_SUCCESS) {
+		vmem_free(inotify_minor, (void *)(uintptr_t)minor, 1);
+		mutex_exit(&inotify_lock);
+		return (NULL);
+	}
+
+	state = ddi_get_soft_state(inotify_softstate, minor);
+	*devp = makedevice(major, minor);
+
+	crhold(cred_p);
+	state->ins_cred = cred_p;
+	state->ins_next = inotify_state;
+	inotify_state = state;
+
+	(void) snprintf(c, sizeof (c), "inotify_watchid_%d", minor);
+	state->ins_wds = vmem_create(c, (void *)1, UINT32_MAX, 1,
+	    NULL, NULL, NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
+
+	avl_create(&state->ins_bywd,
+	    (int(*)(const void *, const void *))inotify_watch_cmpwd,
+	    sizeof (inotify_watch_t),
+	    offsetof(inotify_watch_t, inw_bywd));
+
+	avl_create(&state->ins_byvp,
+	    (int(*)(const void *, const void *))inotify_watch_cmpvp,
+	    sizeof (inotify_watch_t),
+	    offsetof(inotify_watch_t, inw_byvp));
+
+	list_create(&state->ins_orphans, sizeof (inotify_watch_t),
+	    offsetof(inotify_watch_t, inw_orphan));
+
+	state->ins_maxwatches = inotify_maxwatches;
+	state->ins_maxevents = inotify_maxevents;
+
+	mutex_exit(&inotify_lock);
+
+	state->ins_cleaner = ddi_periodic_add(inotify_clean,
+	    state, NANOSEC, DDI_IPL_0);
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+inotify_read(dev_t dev, uio_t *uio, cred_t *cr)
+{
+	inotify_state_t *state;
+	inotify_kevent_t *event;
+	minor_t minor = getminor(dev);
+	int err = 0, nevents = 0;
+	size_t len;
+
+	state = ddi_get_soft_state(inotify_softstate, minor);
+
+	mutex_enter(&state->ins_lock);
+
+	while (state->ins_head == NULL) {
+		if (uio->uio_fmode & (FNDELAY|FNONBLOCK)) {
+			mutex_exit(&state->ins_lock);
+			return (EAGAIN);
+		}
+
+		if (!cv_wait_sig_swap(&state->ins_cv, &state->ins_lock)) {
+			mutex_exit(&state->ins_lock);
+			return (EINTR);
+		}
+	}
+
+	/*
+	 * We have events and we have our lock; return as many as we can.
+	 */
+	while ((event = state->ins_head) != NULL) {
+		len = sizeof (event->ine_event) + event->ine_event.len;
+
+		if (uio->uio_resid < len) {
+			if (nevents == 0)
+				err = EINVAL;
+			break;
+		}
+
+		nevents++;
+
+		if ((err = uiomove(&event->ine_event, len, UIO_READ, uio)) != 0)
+			break;
+
+		VERIFY(state->ins_nevents > 0);
+		state->ins_nevents--;
+
+		VERIFY(state->ins_size > 0);
+		state->ins_size -= len;
+
+		if ((state->ins_head = event->ine_next) == NULL) {
+			VERIFY(event == state->ins_tail);
+			VERIFY(state->ins_nevents == 0);
+			state->ins_tail = NULL;
+		}
+
+		kmem_free(event, INOTIFY_EVENT_LENGTH(event));
+	}
+
+	mutex_exit(&state->ins_lock);
+
+	return (err);
+}
+
+static int
+inotify_poll(dev_t dev, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp)
+{
+	inotify_state_t *state;
+	minor_t minor = getminor(dev);
+
+	state = ddi_get_soft_state(inotify_softstate, minor);
+
+	mutex_enter(&state->ins_lock);
+
+	if (state->ins_head != NULL) {
+		*reventsp = events & (POLLRDNORM | POLLIN);
+	} else {
+		*reventsp = 0;
+	}
+
+	if ((*reventsp == 0 && !anyyet) || (events & POLLET)) {
+		*phpp = &state->ins_pollhd;
+	}
+
+	mutex_exit(&state->ins_lock);
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+inotify_ioctl(dev_t dev, int cmd, intptr_t arg, int md, cred_t *cr, int *rv)
+{
+	inotify_state_t *state;
+	minor_t minor = getminor(dev);
+	file_t *fp;
+	int rval;
+
+	state = ddi_get_soft_state(inotify_softstate, minor);
+
+	switch (cmd) {
+	case INOTIFYIOC_ADD_WATCH: {
+		inotify_addwatch_t addwatch;
+		file_t *fp;
+
+		if (copyin((void *)arg, &addwatch, sizeof (addwatch)) != 0)
+			return (EFAULT);
+
+		if ((fp = getf(addwatch.inaw_fd)) == NULL)
+			return (EBADF);
+
+		rval = inotify_add_watch(state, fp->f_vnode,
+		    addwatch.inaw_mask, rv);
+
+		releasef(addwatch.inaw_fd);
+		return (rval);
+	}
+
+	case INOTIFYIOC_ADD_CHILD: {
+		inotify_addchild_t addchild;
+		char name[MAXPATHLEN];
+
+		if (copyin((void *)arg, &addchild, sizeof (addchild)) != 0)
+			return (EFAULT);
+
+		if (copyinstr(addchild.inac_name, name, MAXPATHLEN, NULL) != 0)
+			return (EFAULT);
+
+		if ((fp = getf(addchild.inac_fd)) == NULL)
+			return (EBADF);
+
+		rval = inotify_add_child(state, fp->f_vnode, name);
+
+		releasef(addchild.inac_fd);
+		return (rval);
+	}
+
+	case INOTIFYIOC_RM_WATCH:
+		return (inotify_rm_watch(state, arg));
+
+	case INOTIFYIOC_ACTIVATE:
+		return (inotify_activate(state, arg));
+
+	case FIONREAD: {
+		int32_t size;
+
+		mutex_enter(&state->ins_lock);
+		size = state->ins_size;
+		mutex_exit(&state->ins_lock);
+
+		if (copyout(&size, (void *)arg, sizeof (size)) != 0)
+			return (EFAULT);
+
+		return (0);
+	}
+
+	default:
+		break;
+	}
+
+	return (ENOTTY);
+}
+
+/*ARGSUSED*/
+static int
+inotify_close(dev_t dev, int flag, int otyp, cred_t *cred_p)
+{
+	inotify_state_t *state, **sp;
+	inotify_watch_t *watch, *zombies;
+	inotify_kevent_t *event;
+	minor_t minor = getminor(dev);
+
+	state = ddi_get_soft_state(inotify_softstate, minor);
+
+	if (state->ins_pollhd.ph_list != NULL) {
+		pollwakeup(&state->ins_pollhd, POLLERR);
+		pollhead_clean(&state->ins_pollhd);
+	}
+
+	mutex_enter(&state->ins_lock);
+
+	/*
+	 * First, destroy all of our watches.
+	 */
+	while ((watch = avl_first(&state->ins_bywd)) != NULL)
+		inotify_watch_remove(state, watch);
+
+	/*
+	 * And now destroy our event queue.
+	 */
+	while ((event = state->ins_head) != NULL) {
+		state->ins_head = event->ine_next;
+		kmem_free(event, INOTIFY_EVENT_LENGTH(event));
+	}
+
+	zombies = state->ins_zombies;
+	state->ins_zombies = NULL;
+	mutex_exit(&state->ins_lock);
+
+	/*
+	 * Now that our state lock is dropped, we can synchronously wait on
+	 * any zombies.
+	 */
+	while ((watch = zombies) != NULL) {
+		zombies = zombies->inw_parent;
+
+		mutex_enter(&watch->inw_lock);
+
+		while (watch->inw_refcnt > 1)
+			cv_wait(&watch->inw_cv, &watch->inw_lock);
+
+		inotify_watch_destroy(watch);
+	}
+
+	if (state->ins_cleaner != NULL) {
+		ddi_periodic_delete(state->ins_cleaner);
+		state->ins_cleaner = NULL;
+	}
+
+	mutex_enter(&inotify_lock);
+
+	/*
+	 * Remove our state from our global list, and release our hold on
+	 * the cred.
+	 */
+	for (sp = &inotify_state; *sp != state; sp = &((*sp)->ins_next))
+		VERIFY(*sp != NULL);
+
+	*sp = (*sp)->ins_next;
+	crfree(state->ins_cred);
+	vmem_destroy(state->ins_wds);
+
+	ddi_soft_state_free(inotify_softstate, minor);
+	vmem_free(inotify_minor, (void *)(uintptr_t)minor, 1);
+
+	mutex_exit(&inotify_lock);
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+inotify_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
+{
+	mutex_enter(&inotify_lock);
+
+	if (ddi_soft_state_init(&inotify_softstate,
+	    sizeof (inotify_state_t), 0) != 0) {
+		cmn_err(CE_NOTE, "/dev/inotify failed to create soft state");
+		mutex_exit(&inotify_lock);
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_create_minor_node(devi, "inotify", S_IFCHR,
+	    INOTIFYMNRN_INOTIFY, DDI_PSEUDO, NULL) == DDI_FAILURE) {
+		cmn_err(CE_NOTE, "/dev/inotify couldn't create minor node");
+		ddi_soft_state_fini(&inotify_softstate);
+		mutex_exit(&inotify_lock);
+		return (DDI_FAILURE);
+	}
+
+	if (fem_create("inotify_fem",
+	    inotify_vnodesrc_template, &inotify_femp) != 0) {
+		cmn_err(CE_NOTE, "/dev/inotify couldn't create FEM state");
+		ddi_remove_minor_node(devi, NULL);
+		ddi_soft_state_fini(&inotify_softstate);
+		mutex_exit(&inotify_lock);
+		return (DDI_FAILURE);
+	}
+
+	ddi_report_dev(devi);
+	inotify_devi = devi;
+
+	inotify_minor = vmem_create("inotify_minor", (void *)INOTIFYMNRN_CLONE,
+	    UINT32_MAX - INOTIFYMNRN_CLONE, 1, NULL, NULL, NULL, 0,
+	    VM_SLEEP | VMC_IDENTIFIER);
+
+	mutex_exit(&inotify_lock);
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+inotify_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	switch (cmd) {
+	case DDI_DETACH:
+		break;
+
+	case DDI_SUSPEND:
+		return (DDI_SUCCESS);
+
+	default:
+		return (DDI_FAILURE);
+	}
+
+	mutex_enter(&inotify_lock);
+	fem_free(inotify_femp);
+	vmem_destroy(inotify_minor);
+
+	ddi_remove_minor_node(inotify_devi, NULL);
+	inotify_devi = NULL;
+
+	ddi_soft_state_fini(&inotify_softstate);
+	mutex_exit(&inotify_lock);
+
+	return (DDI_SUCCESS);
+}
+
+/*ARGSUSED*/
+static int
+inotify_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
+{
+	int error;
+
+	switch (infocmd) {
+	case DDI_INFO_DEVT2DEVINFO:
+		*result = (void *)inotify_devi;
+		error = DDI_SUCCESS;
+		break;
+	case DDI_INFO_DEVT2INSTANCE:
+		*result = (void *)0;
+		error = DDI_SUCCESS;
+		break;
+	default:
+		error = DDI_FAILURE;
+	}
+	return (error);
+}
+
+static struct cb_ops inotify_cb_ops = {
+	inotify_open,		/* open */
+	inotify_close,		/* close */
+	nulldev,		/* strategy */
+	nulldev,		/* print */
+	nodev,			/* dump */
+	inotify_read,		/* read */
+	nodev,			/* write */
+	inotify_ioctl,		/* ioctl */
+	nodev,			/* devmap */
+	nodev,			/* mmap */
+	nodev,			/* segmap */
+	inotify_poll,		/* poll */
+	ddi_prop_op,		/* cb_prop_op */
+	0,			/* streamtab  */
+	D_NEW | D_MP		/* Driver compatibility flag */
+};
+
+static struct dev_ops inotify_ops = {
+	DEVO_REV,		/* devo_rev */
+	0,			/* refcnt */
+	inotify_info,		/* get_dev_info */
+	nulldev,		/* identify */
+	nulldev,		/* probe */
+	inotify_attach,		/* attach */
+	inotify_detach,		/* detach */
+	nodev,			/* reset */
+	&inotify_cb_ops,	/* driver operations */
+	NULL,			/* bus operations */
+	nodev,			/* dev power */
+	ddi_quiesce_not_needed,	/* quiesce */
+};
+
+static struct modldrv modldrv = {
+	&mod_driverops,		/* module type (this is a pseudo driver) */
+	"inotify support",	/* name of module */
+	&inotify_ops,		/* driver ops */
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,
+	(void *)&modldrv,
+	NULL
+};
+
+int
+_init(void)
+{
+	return (mod_install(&modlinkage));
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	return (mod_remove(&modlinkage));
+}
diff --git a/usr/src/uts/common/io/inotify.conf b/usr/src/uts/common/io/inotify.conf
new file mode 100644
index 0000000000..ce9da6180f
--- /dev/null
+++ b/usr/src/uts/common/io/inotify.conf
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+name="inotify" parent="pseudo" instance=0;
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.c b/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.c
index c10e23a8a6..cde57df235 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.c
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.c
@@ -996,17 +996,20 @@ static s32 ixgbe_clear_vmdq_82598(struct ixgbe_hw *hw, u32 rar, u32 vmdq)
  *  @vlan: VLAN id to write to VLAN filter
  *  @vind: VMDq output index that maps queue to VLAN id in VFTA
  *  @vlan_on: boolean flag to turn on/off VLAN in VFTA
+ *  @vlvf_bypass: boolean flag - unused
  *
  *  Turn on/off specified VLAN in the VLAN filter table.
  **/
 s32 ixgbe_set_vfta_82598(struct ixgbe_hw *hw, u32 vlan, u32 vind,
-			 bool vlan_on)
+			 bool vlan_on, bool vlvf_bypass)
 {
 	u32 regindex;
 	u32 bitindex;
 	u32 bits;
 	u32 vftabyte;
 
+	UNREFERENCED_1PARAMETER(vlvf_bypass);
+
 	DEBUGFUNC("ixgbe_set_vfta_82598");
 
 	if (vlan > 4095)
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.h b/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.h
index d2241c70cd..c32672187a 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.h
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_82598.h
@@ -40,7 +40,8 @@ s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw);
 s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw);
 void ixgbe_enable_relaxed_ordering_82598(struct ixgbe_hw *hw);
 s32 ixgbe_set_vmdq_82598(struct ixgbe_hw *hw, u32 rar, u32 vmdq);
-s32 ixgbe_set_vfta_82598(struct ixgbe_hw *hw, u32 vlan, u32 vind, bool vlan_on);
+s32 ixgbe_set_vfta_82598(struct ixgbe_hw *hw, u32 vlan, u32 vind, bool vlan_on,
+			 bool vlvf_bypass);
 s32 ixgbe_read_analog_reg8_82598(struct ixgbe_hw *hw, u32 reg, u8 *val);
 s32 ixgbe_write_analog_reg8_82598(struct ixgbe_hw *hw, u32 reg, u8 val);
 s32 ixgbe_read_i2c_eeprom_82598(struct ixgbe_hw *hw, u8 byte_offset,
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_api.c b/usr/src/uts/common/io/ixgbe/core/ixgbe_api.c
index 894d0b2ac9..c550982710 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_api.c
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_api.c
@@ -1057,33 +1057,38 @@ s32 ixgbe_clear_vfta(struct ixgbe_hw *hw)
  *  ixgbe_set_vfta - Set VLAN filter table
  *  @hw: pointer to hardware structure
  *  @vlan: VLAN id to write to VLAN filter
- *  @vind: VMDq output index that maps queue to VLAN id in VFTA
- *  @vlan_on: boolean flag to turn on/off VLAN in VFTA
+ *  @vind: VMDq output index that maps queue to VLAN id in VLVFB
+ *  @vlan_on: boolean flag to turn on/off VLAN
+ *  @vlvf_bypass: boolean flag indicating updating the default pool is okay
  *
  *  Turn on/off specified VLAN in the VLAN filter table.
  **/
-s32 ixgbe_set_vfta(struct ixgbe_hw *hw, u32 vlan, u32 vind, bool vlan_on)
+s32 ixgbe_set_vfta(struct ixgbe_hw *hw, u32 vlan, u32 vind, bool vlan_on,
+		   bool vlvf_bypass)
 {
 	return ixgbe_call_func(hw, hw->mac.ops.set_vfta, (hw, vlan, vind,
-			       vlan_on), IXGBE_NOT_IMPLEMENTED);
+			       vlan_on, vlvf_bypass), IXGBE_NOT_IMPLEMENTED);
 }
 
 /**
  *  ixgbe_set_vlvf - Set VLAN Pool Filter
  *  @hw: pointer to hardware structure
  *  @vlan: VLAN id to write to VLAN filter
- *  @vind: VMDq output index that maps queue to VLAN id in VFVFB
- *  @vlan_on: boolean flag to turn on/off VLAN in VFVF
- *  @vfta_changed: pointer to boolean flag which indicates whether VFTA
- *                 should be changed
+ *  @vind: VMDq output index that maps queue to VLAN id in VLVFB
+ *  @vlan_on: boolean flag to turn on/off VLAN in VLVF
+ *  @vfta_delta: pointer to the difference between the current value of VFTA
+ *		 and the desired value
+ *  @vfta: the desired value of the VFTA
+ *  @vlvf_bypass: boolean flag indicating updating the default pool is okay
  *
  *  Turn on/off specified bit in VLVF table.
  **/
 s32 ixgbe_set_vlvf(struct ixgbe_hw *hw, u32 vlan, u32 vind, bool vlan_on,
-		    bool *vfta_changed)
+		   u32 *vfta_delta, u32 vfta, bool vlvf_bypass)
 {
 	return ixgbe_call_func(hw, hw->mac.ops.set_vlvf, (hw, vlan, vind,
-			       vlan_on, vfta_changed), IXGBE_NOT_IMPLEMENTED);
+			       vlan_on, vfta_delta, vfta, vlvf_bypass),
+			       IXGBE_NOT_IMPLEMENTED);
 }
 
 /**
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_api.h b/usr/src/uts/common/io/ixgbe/core/ixgbe_api.h
index 24d507039d..3bee89e45e 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_api.h
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_api.h
@@ -125,9 +125,10 @@ s32 ixgbe_enable_mc(struct ixgbe_hw *hw);
 s32 ixgbe_disable_mc(struct ixgbe_hw *hw);
 s32 ixgbe_clear_vfta(struct ixgbe_hw *hw);
 s32 ixgbe_set_vfta(struct ixgbe_hw *hw, u32 vlan,
-		   u32 vind, bool vlan_on);
+		   u32 vind, bool vlan_on, bool vlvf_bypass);
 s32 ixgbe_set_vlvf(struct ixgbe_hw *hw, u32 vlan, u32 vind,
-		   bool vlan_on, bool *vfta_changed);
+		   bool vlan_on, u32 *vfta_delta, u32 vfta,
+		   bool vlvf_bypass);
 s32 ixgbe_fc_enable(struct ixgbe_hw *hw);
 s32 ixgbe_setup_fc(struct ixgbe_hw *hw);
 s32 ixgbe_set_fw_drv_ver(struct ixgbe_hw *hw, u8 maj, u8 min, u8 build,
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_common.c b/usr/src/uts/common/io/ixgbe/core/ixgbe_common.c
index f342eee637..656534862c 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_common.c
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_common.c
@@ -3810,68 +3810,65 @@ s32 ixgbe_init_uta_tables_generic(struct ixgbe_hw *hw)
  *  return the VLVF index where this VLAN id should be placed
  *
  **/
-s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan)
+s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan, bool vlvf_bypass)
 {
-	u32 bits = 0;
-	u32 first_empty_slot = 0;
-	s32 regindex;
+	s32 regindex, first_empty_slot;
+	u32 bits;
 
 	/* short cut the special case */
 	if (vlan == 0)
 		return 0;
 
-	/*
-	  * Search for the vlan id in the VLVF entries. Save off the first empty
-	  * slot found along the way
-	  */
-	for (regindex = 1; regindex < IXGBE_VLVF_ENTRIES; regindex++) {
+	/* if vlvf_bypass is set we don't want to use an empty slot, we
+	 * will simply bypass the VLVF if there are no entries present in the
+	 * VLVF that contain our VLAN
+	 */
+	first_empty_slot = vlvf_bypass ? IXGBE_ERR_NO_SPACE : 0;
+
+	/* add VLAN enable bit for comparison */
+	vlan |= IXGBE_VLVF_VIEN;
+
+	/* Search for the vlan id in the VLVF entries. Save off the first empty
+	 * slot found along the way.
+	 *
+	 * pre-decrement loop covering (IXGBE_VLVF_ENTRIES - 1) .. 1
+	 */
+	for (regindex = IXGBE_VLVF_ENTRIES; --regindex;) {
 		bits = IXGBE_READ_REG(hw, IXGBE_VLVF(regindex));
-		if (!bits && !(first_empty_slot))
+		if (bits == vlan)
+			return regindex;
+		if (!first_empty_slot && !bits)
 			first_empty_slot = regindex;
-		else if ((bits & 0x0FFF) == vlan)
-			break;
 	}
 
-	/*
-	  * If regindex is less than IXGBE_VLVF_ENTRIES, then we found the vlan
-	  * in the VLVF. Else use the first empty VLVF register for this
-	  * vlan id.
-	  */
-	if (regindex >= IXGBE_VLVF_ENTRIES) {
-		if (first_empty_slot)
-			regindex = first_empty_slot;
-		else {
-			ERROR_REPORT1(IXGBE_ERROR_SOFTWARE,
-				     "No space in VLVF.\n");
-			regindex = IXGBE_ERR_NO_SPACE;
-		}
-	}
+	/* If we are here then we didn't find the VLAN.  Return first empty
+	 * slot we found during our search, else error.
+	 */
+	if (!first_empty_slot)
+		ERROR_REPORT1(IXGBE_ERROR_SOFTWARE, "No space in VLVF.\n");
 
-	return regindex;
+	return first_empty_slot ? first_empty_slot : IXGBE_ERR_NO_SPACE;
 }
 
 /**
  *  ixgbe_set_vfta_generic - Set VLAN filter table
  *  @hw: pointer to hardware structure
  *  @vlan: VLAN id to write to VLAN filter
- *  @vind: VMDq output index that maps queue to VLAN id in VFVFB
- *  @vlan_on: boolean flag to turn on/off VLAN in VFVF
+ *  @vind: VMDq output index that maps queue to VLAN id in VLVFB
+ *  @vlan_on: boolean flag to turn on/off VLAN
+ *  @vlvf_bypass: boolean flag indicating updating default pool is okay
  *
  *  Turn on/off specified VLAN in the VLAN filter table.
  **/
 s32 ixgbe_set_vfta_generic(struct ixgbe_hw *hw, u32 vlan, u32 vind,
-			   bool vlan_on)
+			   bool vlan_on, bool vlvf_bypass)
 {
-	s32 regindex;
-	u32 bitindex;
-	u32 vfta;
-	u32 targetbit;
-	s32 ret_val = IXGBE_SUCCESS;
-	bool vfta_changed = FALSE;
+	u32 regidx, vfta_delta, vfta;
+	s32 ret_val;
 
 	DEBUGFUNC("ixgbe_set_vfta_generic");
 
-	if (vlan > 4095)
+	if (vlan > 4095 || vind > 63)
 		return IXGBE_ERR_PARAM;
 
 	/*
@@ -3886,33 +3883,33 @@ s32 ixgbe_set_vfta_generic(struct ixgbe_hw *hw, u32 vlan, u32 vind,
 	 *    bits[11-5]: which register
 	 *    bits[4-0]:  which bit in the register
 	 */
-	regindex = (vlan >> 5) & 0x7F;
-	bitindex = vlan & 0x1F;
-	targetbit = (1 << bitindex);
-	vfta = IXGBE_READ_REG(hw, IXGBE_VFTA(regindex));
-
-	if (vlan_on) {
-		if (!(vfta & targetbit)) {
-			vfta |= targetbit;
-			vfta_changed = TRUE;
-		}
-	} else {
-		if ((vfta & targetbit)) {
-			vfta &= ~targetbit;
-			vfta_changed = TRUE;
-		}
-	}
+	regidx = vlan / 32;
+	vfta_delta = 1 << (vlan % 32);
+	vfta = IXGBE_READ_REG(hw, IXGBE_VFTA(regidx));
+
+	/*
+	 * vfta_delta represents the difference between the current value
+	 * of vfta and the value we want in the register.  Since the diff
+	 * is an XOR mask we can just update the vfta using an XOR
+	 */
+	vfta_delta &= vlan_on ? ~vfta : vfta;
+	vfta ^= vfta_delta;
 
 	/* Part 2
 	 * Call ixgbe_set_vlvf_generic to set VLVFB and VLVF
 	 */
-	ret_val = ixgbe_set_vlvf_generic(hw, vlan, vind, vlan_on,
-					 &vfta_changed);
-	if (ret_val != IXGBE_SUCCESS)
+	ret_val = ixgbe_set_vlvf_generic(hw, vlan, vind, vlan_on, &vfta_delta,
+					 vfta, vlvf_bypass);
+	if (ret_val != IXGBE_SUCCESS) {
+		if (vlvf_bypass)
+			goto vfta_update;
 		return ret_val;
+	}
 
-	if (vfta_changed)
-		IXGBE_WRITE_REG(hw, IXGBE_VFTA(regindex), vfta);
+vfta_update:
+	/* Update VFTA now that we are ready for traffic */
+	if (vfta_delta)
+		IXGBE_WRITE_REG(hw, IXGBE_VFTA(regidx), vfta);
 
 	return IXGBE_SUCCESS;
 }
@@ -3921,21 +3918,25 @@ s32 ixgbe_set_vfta_generic(struct ixgbe_hw *hw, u32 vlan, u32 vind,
  *  ixgbe_set_vlvf_generic - Set VLAN Pool Filter
  *  @hw: pointer to hardware structure
  *  @vlan: VLAN id to write to VLAN filter
- *  @vind: VMDq output index that maps queue to VLAN id in VFVFB
- *  @vlan_on: boolean flag to turn on/off VLAN in VFVF
- *  @vfta_changed: pointer to boolean flag which indicates whether VFTA
- *                 should be changed
+ *  @vind: VMDq output index that maps queue to VLAN id in VLVFB
+ *  @vlan_on: boolean flag to turn on/off VLAN in VLVF
+ *  @vfta_delta: pointer to the difference between the current value of VFTA
+ *		 and the desired value
+ *  @vfta: the desired value of the VFTA
+ *  @vlvf_bypass: boolean flag indicating updating default pool is okay
  *
  *  Turn on/off specified bit in VLVF table.
  **/
 s32 ixgbe_set_vlvf_generic(struct ixgbe_hw *hw, u32 vlan, u32 vind,
-			    bool vlan_on, bool *vfta_changed)
+			   bool vlan_on, u32 *vfta_delta, u32 vfta,
+			   bool vlvf_bypass)
 {
-	u32 vt;
+	u32 bits;
+	s32 vlvf_index;
 
 	DEBUGFUNC("ixgbe_set_vlvf_generic");
 
-	if (vlan > 4095)
+	if (vlan > 4095 || vind > 63)
 		return IXGBE_ERR_PARAM;
 
 	/* If VT Mode is set
@@ -3945,83 +3946,60 @@ s32 ixgbe_set_vlvf_generic(struct ixgbe_hw *hw, u32 vlan, u32 vind,
 	 *   Or !vlan_on
 	 *     clear the pool bit and possibly the vind
 	 */
-	vt = IXGBE_READ_REG(hw, IXGBE_VT_CTL);
-	if (vt & IXGBE_VT_CTL_VT_ENABLE) {
-		s32 vlvf_index;
-		u32 bits;
-
-		vlvf_index = ixgbe_find_vlvf_slot(hw, vlan);
-		if (vlvf_index < 0)
-			return vlvf_index;
-
-		if (vlan_on) {
-			/* set the pool bit */
-			if (vind < 32) {
-				bits = IXGBE_READ_REG(hw,
-						IXGBE_VLVFB(vlvf_index * 2));
-				bits |= (1 << vind);
-				IXGBE_WRITE_REG(hw,
-						IXGBE_VLVFB(vlvf_index * 2),
-						bits);
-			} else {
-				bits = IXGBE_READ_REG(hw,
-					IXGBE_VLVFB((vlvf_index * 2) + 1));
-				bits |= (1 << (vind - 32));
-				IXGBE_WRITE_REG(hw,
-					IXGBE_VLVFB((vlvf_index * 2) + 1),
-					bits);
-			}
-		} else {
-			/* clear the pool bit */
-			if (vind < 32) {
-				bits = IXGBE_READ_REG(hw,
-						IXGBE_VLVFB(vlvf_index * 2));
-				bits &= ~(1 << vind);
-				IXGBE_WRITE_REG(hw,
-						IXGBE_VLVFB(vlvf_index * 2),
-						bits);
-				bits |= IXGBE_READ_REG(hw,
-					IXGBE_VLVFB((vlvf_index * 2) + 1));
-			} else {
-				bits = IXGBE_READ_REG(hw,
-					IXGBE_VLVFB((vlvf_index * 2) + 1));
-				bits &= ~(1 << (vind - 32));
-				IXGBE_WRITE_REG(hw,
-					IXGBE_VLVFB((vlvf_index * 2) + 1),
-					bits);
-				bits |= IXGBE_READ_REG(hw,
-						IXGBE_VLVFB(vlvf_index * 2));
-			}
-		}
+	if (!(IXGBE_READ_REG(hw, IXGBE_VT_CTL) & IXGBE_VT_CTL_VT_ENABLE))
+		return IXGBE_SUCCESS;
 
-		/*
-		 * If there are still bits set in the VLVFB registers
-		 * for the VLAN ID indicated we need to see if the
-		 * caller is requesting that we clear the VFTA entry bit.
-		 * If the caller has requested that we clear the VFTA
-		 * entry bit but there are still pools/VFs using this VLAN
-		 * ID entry then ignore the request.  We're not worried
-		 * about the case where we're turning the VFTA VLAN ID
-		 * entry bit on, only when requested to turn it off as
-		 * there may be multiple pools and/or VFs using the
-		 * VLAN ID entry.  In that case we cannot clear the
-		 * VFTA bit until all pools/VFs using that VLAN ID have also
-		 * been cleared.  This will be indicated by "bits" being
-		 * zero.
+	vlvf_index = ixgbe_find_vlvf_slot(hw, vlan, vlvf_bypass);
+	if (vlvf_index < 0)
+		return vlvf_index;
+
+	bits = IXGBE_READ_REG(hw, IXGBE_VLVFB(vlvf_index * 2 + vind / 32));
+
+	/* set the pool bit */
+	bits |= 1 << (vind % 32);
+	if (vlan_on)
+		goto vlvf_update;
+
+	/* clear the pool bit */
+	bits ^= 1 << (vind % 32);
+
+	if (!bits &&
+	    !IXGBE_READ_REG(hw, IXGBE_VLVFB(vlvf_index * 2 + 1 - vind / 32))) {
+		/* Clear VFTA first, then disable VLVF.  Otherwise
+		 * we run the risk of stray packets leaking into
+		 * the PF via the default pool
 		 */
-		if (bits) {
-			IXGBE_WRITE_REG(hw, IXGBE_VLVF(vlvf_index),
-					(IXGBE_VLVF_VIEN | vlan));
-			if ((!vlan_on) && (vfta_changed != NULL)) {
-				/* someone wants to clear the vfta entry
-				 * but some pools/VFs are still using it.
-				 * Ignore it. */
-				*vfta_changed = FALSE;
-			}
-		} else
-			IXGBE_WRITE_REG(hw, IXGBE_VLVF(vlvf_index), 0);
+		if (*vfta_delta)
+			IXGBE_WRITE_REG(hw, IXGBE_VFTA(vlan / 32), vfta);
+
+		/* disable VLVF and clear remaining bit from pool */
+		IXGBE_WRITE_REG(hw, IXGBE_VLVF(vlvf_index), 0);
+		IXGBE_WRITE_REG(hw, IXGBE_VLVFB(vlvf_index * 2 + vind / 32), 0);
+
+		return IXGBE_SUCCESS;
 	}
 
+	/* If there are still bits set in the VLVFB registers
+	 * for the VLAN ID indicated we need to see if the
+	 * caller is requesting that we clear the VFTA entry bit.
+	 * If the caller has requested that we clear the VFTA
+	 * entry bit but there are still pools/VFs using this VLAN
+	 * ID entry then ignore the request.  We're not worried
+	 * about the case where we're turning the VFTA VLAN ID
+	 * entry bit on, only when requested to turn it off as
+	 * there may be multiple pools and/or VFs using the
+	 * VLAN ID entry.  In that case we cannot clear the
+	 * VFTA bit until all pools/VFs using that VLAN ID have also
+	 * been cleared.  This will be indicated by "bits" being
+	 * zero.
+	 */
+	*vfta_delta = 0;
+
+vlvf_update:
+	/* record pool change and enable VLAN ID if not already enabled */
+	IXGBE_WRITE_REG(hw, IXGBE_VLVFB(vlvf_index * 2 + vind / 32), bits);
+	IXGBE_WRITE_REG(hw, IXGBE_VLVF(vlvf_index), IXGBE_VLVF_VIEN | vlan);
+
 	return IXGBE_SUCCESS;
 }
 
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_common.h b/usr/src/uts/common/io/ixgbe/core/ixgbe_common.h
index 069fc88c96..bd18e96f82 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_common.h
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_common.h
@@ -135,11 +135,12 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq);
 s32 ixgbe_insert_mac_addr_generic(struct ixgbe_hw *hw, u8 *addr, u32 vmdq);
 s32 ixgbe_init_uta_tables_generic(struct ixgbe_hw *hw);
 s32 ixgbe_set_vfta_generic(struct ixgbe_hw *hw, u32 vlan,
-			 u32 vind, bool vlan_on);
+			 u32 vind, bool vlan_on, bool vlvf_bypass);
 s32 ixgbe_set_vlvf_generic(struct ixgbe_hw *hw, u32 vlan, u32 vind,
-			   bool vlan_on, bool *vfta_changed);
+			   bool vlan_on, u32 *vfta_delta, u32 vfta,
+			   bool vlvf_bypass);
 s32 ixgbe_clear_vfta_generic(struct ixgbe_hw *hw);
-s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan);
+s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan, bool vlvf_bypass);
 
 s32 ixgbe_check_mac_link_generic(struct ixgbe_hw *hw,
 			       ixgbe_link_speed *speed,
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_type.h b/usr/src/uts/common/io/ixgbe/core/ixgbe_type.h
index 45e8a7d029..9231979ff7 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_type.h
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_type.h
@@ -3715,8 +3715,9 @@ struct ixgbe_mac_operations {
 	s32 (*enable_mc)(struct ixgbe_hw *);
 	s32 (*disable_mc)(struct ixgbe_hw *);
 	s32 (*clear_vfta)(struct ixgbe_hw *);
-	s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
-	s32 (*set_vlvf)(struct ixgbe_hw *, u32, u32, bool, bool *);
+	s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool, bool);
+	s32 (*set_vlvf)(struct ixgbe_hw *, u32, u32, bool, u32 *, u32,
+			bool);
 	s32 (*init_uta_tables)(struct ixgbe_hw *);
 	void (*set_mac_anti_spoofing)(struct ixgbe_hw *, bool, int);
 	void (*set_vlan_anti_spoofing)(struct ixgbe_hw *, bool, int);
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.c b/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.c
index 2ce4d32a30..66d836eb8f 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.c
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.c
@@ -321,15 +321,16 @@ static s32 ixgbe_mta_vector(struct ixgbe_hw *hw, u8 *mc_addr)
 	return vector;
 }
 
-static void ixgbevf_write_msg_read_ack(struct ixgbe_hw *hw,
-					u32 *msg, u16 size)
+static s32 ixgbevf_write_msg_read_ack(struct ixgbe_hw *hw, u32 *msg,
+				      u32 *retmsg, u16 size)
 {
 	struct ixgbe_mbx_info *mbx = &hw->mbx;
-	u32 retmsg[IXGBE_VFMAILBOX_SIZE];
 	s32 retval = mbx->ops.write_posted(hw, msg, size, 0);
 
-	if (!retval)
-		mbx->ops.read_posted(hw, retmsg, size, 0);
+	if (retval)
+		return retval;
+
+	return mbx->ops.read_posted(hw, retmsg, size, 0);
 }
 
 /**
@@ -415,29 +416,29 @@ s32 ixgbe_update_mc_addr_list_vf(struct ixgbe_hw *hw, u8 *mc_addr_list,
 	return mbx->ops.write_posted(hw, msgbuf, IXGBE_VFMAILBOX_SIZE, 0);
 }
 
-/**
+/*
  *  ixgbe_set_vfta_vf - Set/Unset vlan filter table address
  *  @hw: pointer to the HW structure
  *  @vlan: 12 bit VLAN ID
  *  @vind: unused by VF drivers
  *  @vlan_on: if TRUE then set bit, else clear bit
+ *  @vlvf_bypass: boolean flag indicating updating default pool is okay
+ *
+ *  Turn on/off specified VLAN in the VLAN filter table.
  **/
-s32 ixgbe_set_vfta_vf(struct ixgbe_hw *hw, u32 vlan, u32 vind, bool vlan_on)
+s32 ixgbe_set_vfta_vf(struct ixgbe_hw *hw, u32 vlan, u32 vind,
+		      bool vlan_on, bool vlvf_bypass)
 {
-	struct ixgbe_mbx_info *mbx = &hw->mbx;
 	u32 msgbuf[2];
 	s32 ret_val;
-	UNREFERENCED_1PARAMETER(vind);
+	UNREFERENCED_2PARAMETER(vind, vlvf_bypass);
 
 	msgbuf[0] = IXGBE_VF_SET_VLAN;
 	msgbuf[1] = vlan;
 	/* Setting the 8 bit field MSG INFO to TRUE indicates "add" */
 	msgbuf[0] |= vlan_on << IXGBE_VT_MSGINFO_SHIFT;
 
-	ret_val = mbx->ops.write_posted(hw, msgbuf, 2, 0);
-	if (!ret_val)
-		ret_val = mbx->ops.read_posted(hw, msgbuf, 1, 0);
-
+	ret_val = ixgbevf_write_msg_read_ack(hw, msgbuf, msgbuf, 2);
 	if (!ret_val && (msgbuf[0] & IXGBE_VT_MSGTYPE_ACK))
 		return IXGBE_SUCCESS;
 
@@ -628,7 +629,7 @@ void ixgbevf_rlpml_set_vf(struct ixgbe_hw *hw, u16 max_size)
 
 	msgbuf[0] = IXGBE_VF_SET_LPE;
 	msgbuf[1] = max_size;
-	ixgbevf_write_msg_read_ack(hw, msgbuf, 2);
+	ixgbevf_write_msg_read_ack(hw, msgbuf, msgbuf, 2);
 }
 
 /**
diff --git a/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.h b/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.h
index edc801367d..e9b8dc34ae 100644
--- a/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.h
+++ b/usr/src/uts/common/io/ixgbe/core/ixgbe_vf.h
@@ -132,7 +132,8 @@ s32 ixgbevf_set_uc_addr_vf(struct ixgbe_hw *hw, u32 index, u8 *addr);
 s32 ixgbe_update_mc_addr_list_vf(struct ixgbe_hw *hw, u8 *mc_addr_list,
 				 u32 mc_addr_count, ixgbe_mc_addr_itr,
 				 bool clear);
-s32 ixgbe_set_vfta_vf(struct ixgbe_hw *hw, u32 vlan, u32 vind, bool vlan_on);
+s32 ixgbe_set_vfta_vf(struct ixgbe_hw *hw, u32 vlan, u32 vind,
+		      bool vlan_on, bool vlvf_bypass);
 void ixgbevf_rlpml_set_vf(struct ixgbe_hw *hw, u16 max_size);
 int ixgbevf_negotiate_api_version(struct ixgbe_hw *hw, int api);
 int ixgbevf_get_queues(struct ixgbe_hw *hw, unsigned int *num_tcs,
diff --git a/usr/src/uts/common/io/ixgbe/ixgbe_main.c b/usr/src/uts/common/io/ixgbe/ixgbe_main.c
index 41464050bc..82c9bcdc36 100644
--- a/usr/src/uts/common/io/ixgbe/ixgbe_main.c
+++ b/usr/src/uts/common/io/ixgbe/ixgbe_main.c
@@ -25,7 +25,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
  * Copyright (c) 2013 Saso Kiselkov. All rights reserved.
  * Copyright (c) 2013 OSN Online Service Nuernberg GmbH. All rights reserved.
@@ -57,8 +57,8 @@ static int ixgbe_alloc_rings(ixgbe_t *);
 static void ixgbe_free_rings(ixgbe_t *);
 static int ixgbe_alloc_rx_data(ixgbe_t *);
 static void ixgbe_free_rx_data(ixgbe_t *);
-static void ixgbe_setup_rings(ixgbe_t *);
-static void ixgbe_setup_rx(ixgbe_t *);
+static int ixgbe_setup_rings(ixgbe_t *);
+static int ixgbe_setup_rx(ixgbe_t *);
 static void ixgbe_setup_tx(ixgbe_t *);
 static void ixgbe_setup_rx_ring(ixgbe_rx_ring_t *);
 static void ixgbe_setup_tx_ring(ixgbe_tx_ring_t *);
@@ -67,6 +67,7 @@ static void ixgbe_setup_vmdq(ixgbe_t *);
 static void ixgbe_setup_vmdq_rss(ixgbe_t *);
 static void ixgbe_setup_rss_table(ixgbe_t *);
 static void ixgbe_init_unicst(ixgbe_t *);
+static int ixgbe_init_vlan(ixgbe_t *);
 static int ixgbe_unicst_find(ixgbe_t *, const uint8_t *);
 static void ixgbe_setup_multicst(ixgbe_t *);
 static void ixgbe_get_hw_state(ixgbe_t *);
@@ -113,6 +114,8 @@ static void ixgbe_intr_other_work(ixgbe_t *, uint32_t);
 static void ixgbe_get_driver_control(struct ixgbe_hw *);
 static int ixgbe_addmac(void *, const uint8_t *);
 static int ixgbe_remmac(void *, const uint8_t *);
+static int ixgbe_addvlan(mac_group_driver_t, uint16_t);
+static int ixgbe_remvlan(mac_group_driver_t, uint16_t);
 static void ixgbe_release_driver_control(struct ixgbe_hw *);
 
 static int ixgbe_attach(dev_info_t *, ddi_attach_cmd_t);
@@ -273,7 +276,7 @@ static adapter_info_t ixgbe_82599eb_cap = {
 	128,		/* default number of rx queues */
 	64,		/* maximum number of rx groups */
 	1,		/* minimum number of rx groups */
-	1,		/* default number of rx groups */
+	32,		/* default number of rx groups */
 	128,		/* maximum number of tx queues */
 	1,		/* minimum number of tx queues */
 	8,		/* default number of tx queues */
@@ -304,7 +307,7 @@ static adapter_info_t ixgbe_X540_cap = {
 	128,		/* default number of rx queues */
 	64,		/* maximum number of rx groups */
 	1,		/* minimum number of rx groups */
-	1,		/* default number of rx groups */
+	32,		/* default number of rx groups */
 	128,		/* maximum number of tx queues */
 	1,		/* minimum number of tx queues */
 	8,		/* default number of tx queues */
@@ -1149,6 +1152,8 @@ ixgbe_init_driver_settings(ixgbe_t *ixgbe)
 		rx_group = &ixgbe->rx_groups[i];
 		rx_group->index = i;
 		rx_group->ixgbe = ixgbe;
+		list_create(&rx_group->vlans, sizeof (ixgbe_vlan_t),
+		    offsetof(ixgbe_vlan_t, ixvl_link));
 	}
 
 	for (i = 0; i < ixgbe->num_tx_rings; i++) {
@@ -1898,7 +1903,8 @@ ixgbe_start(ixgbe_t *ixgbe, boolean_t alloc_buffer)
 	/*
 	 * Setup the rx/tx rings
 	 */
-	ixgbe_setup_rings(ixgbe);
+	if (ixgbe_setup_rings(ixgbe) != IXGBE_SUCCESS)
+		goto start_failure;
 
 	/*
 	 * ixgbe_start() will be called when resetting, however if reset
@@ -1999,6 +2005,7 @@ ixgbe_cbfunc(dev_info_t *dip, ddi_cb_action_t cbaction, void *cbarg,
     void *arg1, void *arg2)
 {
 	ixgbe_t *ixgbe = (ixgbe_t *)arg1;
+	int prev = ixgbe->intr_cnt;
 
 	switch (cbaction) {
 	/* IRM callback */
@@ -2012,7 +2019,8 @@ ixgbe_cbfunc(dev_info_t *dip, ddi_cb_action_t cbaction, void *cbarg,
 		if (ixgbe_intr_adjust(ixgbe, cbaction, count) !=
 		    DDI_SUCCESS) {
 			ixgbe_error(ixgbe,
-			    "IRM CB: Failed to adjust interrupts");
+			    "IRM CB: Failed to adjust interrupts [%d %d %d]",
+			    cbaction, count, prev);
 			goto cb_fail;
 		}
 		break;
@@ -2271,6 +2279,16 @@ ixgbe_free_rings(ixgbe_t *ixgbe)
 		ixgbe->tx_rings = NULL;
 	}
 
+	for (uint_t i = 0; i < ixgbe->num_rx_groups; i++) {
+		ixgbe_vlan_t *vlp;
+		ixgbe_rx_group_t *rx_group = &ixgbe->rx_groups[i];
+
+		while ((vlp = list_remove_head(&rx_group->vlans)) != NULL)
+			kmem_free(vlp, sizeof (ixgbe_vlan_t));
+
+		list_destroy(&rx_group->vlans);
+	}
+
 	if (ixgbe->rx_groups != NULL) {
 		kmem_free(ixgbe->rx_groups,
 		    sizeof (ixgbe_rx_group_t) * ixgbe->num_rx_groups);
@@ -2325,7 +2343,7 @@ ixgbe_free_rx_data(ixgbe_t *ixgbe)
 /*
  * ixgbe_setup_rings - Setup rx/tx rings.
  */
-static void
+static int
 ixgbe_setup_rings(ixgbe_t *ixgbe)
 {
 	/*
@@ -2335,9 +2353,12 @@ ixgbe_setup_rings(ixgbe_t *ixgbe)
 	 * 2. Initialize necessary registers for receive/transmit;
 	 * 3. Initialize software pointers/parameters for receive/transmit;
 	 */
-	ixgbe_setup_rx(ixgbe);
+	if (ixgbe_setup_rx(ixgbe) != IXGBE_SUCCESS)
+		return (IXGBE_FAILURE);
 
 	ixgbe_setup_tx(ixgbe);
+
+	return (IXGBE_SUCCESS);
 }
 
 static void
@@ -2423,7 +2444,7 @@ ixgbe_setup_rx_ring(ixgbe_rx_ring_t *rx_ring)
 	IXGBE_WRITE_REG(hw, IXGBE_SRRCTL(rx_ring->hw_index), reg_val);
 }
 
-static void
+static int
 ixgbe_setup_rx(ixgbe_t *ixgbe)
 {
 	ixgbe_rx_ring_t *rx_ring;
@@ -2517,6 +2538,15 @@ ixgbe_setup_rx(ixgbe_t *ixgbe)
 	}
 
 	/*
+	 * Initialize VLAN SW and HW state if VLAN filtering is
+	 * enabled.
+	 */
+	if (ixgbe->vlft_enabled) {
+		if (ixgbe_init_vlan(ixgbe) != IXGBE_SUCCESS)
+			return (IXGBE_FAILURE);
+	}
+
+	/*
 	 * Enable the receive unit.  This must be done after filter
 	 * control is set in FCTRL. On 82598, we disable the descriptor monitor.
 	 * 82598 is the only adapter which defines this RXCTRL option.
@@ -2598,6 +2628,8 @@ ixgbe_setup_rx(ixgbe_t *ixgbe)
 
 		IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, reg_val);
 	}
+
+	return (IXGBE_SUCCESS);
 }
 
 static void
@@ -2829,7 +2861,7 @@ static void
 ixgbe_setup_vmdq(ixgbe_t *ixgbe)
 {
 	struct ixgbe_hw *hw = &ixgbe->hw;
-	uint32_t vmdctl, i, vtctl;
+	uint32_t vmdctl, i, vtctl, vlnctl;
 
 	/*
 	 * Setup the VMDq Control register, enable VMDq based on
@@ -2864,10 +2896,20 @@ ixgbe_setup_vmdq(ixgbe_t *ixgbe)
 		/*
 		 * Enable Virtualization and Replication.
 		 */
-		vtctl = IXGBE_VT_CTL_VT_ENABLE | IXGBE_VT_CTL_REPLEN;
+		vtctl = IXGBE_READ_REG(hw, IXGBE_VT_CTL);
+		ixgbe->rx_def_group = vtctl & IXGBE_VT_CTL_POOL_MASK;
+		vtctl |= IXGBE_VT_CTL_VT_ENABLE | IXGBE_VT_CTL_REPLEN;
 		IXGBE_WRITE_REG(hw, IXGBE_VT_CTL, vtctl);
 
 		/*
+		 * Enable VLAN filtering and switching (VFTA and VLVF).
+		 */
+		vlnctl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+		vlnctl |= IXGBE_VLNCTRL_VFE;
+		IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctl);
+		ixgbe->vlft_enabled = B_TRUE;
+
+		/*
 		 * Enable receiving packets to all VFs
 		 */
 		IXGBE_WRITE_REG(hw, IXGBE_VFRE(0), IXGBE_VFRE_ENABLE_ALL);
@@ -2887,7 +2929,7 @@ ixgbe_setup_vmdq_rss(ixgbe_t *ixgbe)
 {
 	struct ixgbe_hw *hw = &ixgbe->hw;
 	uint32_t i, mrqc;
-	uint32_t vtctl, vmdctl;
+	uint32_t vtctl, vmdctl, vlnctl;
 
 	/*
 	 * Initialize RETA/ERETA table
@@ -2969,10 +3011,21 @@ ixgbe_setup_vmdq_rss(ixgbe_t *ixgbe)
 		/*
 		 * Enable Virtualization and Replication.
 		 */
+		vtctl = IXGBE_READ_REG(hw, IXGBE_VT_CTL);
+		ixgbe->rx_def_group = vtctl & IXGBE_VT_CTL_POOL_MASK;
+		vtctl |= IXGBE_VT_CTL_VT_ENABLE | IXGBE_VT_CTL_REPLEN;
 		vtctl = IXGBE_VT_CTL_VT_ENABLE | IXGBE_VT_CTL_REPLEN;
 		IXGBE_WRITE_REG(hw, IXGBE_VT_CTL, vtctl);
 
 		/*
+		 * Enable VLAN filtering and switching (VFTA and VLVF).
+		 */
+		vlnctl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+		vlnctl |= IXGBE_VLNCTRL_VFE;
+		IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctl);
+		ixgbe->vlft_enabled = B_TRUE;
+
+		/*
 		 * Enable receiving packets to all VFs
 		 */
 		IXGBE_WRITE_REG(hw, IXGBE_VFRE(0), IXGBE_VFRE_ENABLE_ALL);
@@ -3143,6 +3196,53 @@ ixgbe_unicst_find(ixgbe_t *ixgbe, const uint8_t *mac_addr)
 }
 
 /*
+ * Restore the HW state to match the SW state during restart.
+ */
+static int
+ixgbe_init_vlan(ixgbe_t *ixgbe)
+{
+	/*
+	 * The device is starting for the first time; there is nothing
+	 * to do.
+	 */
+	if (!ixgbe->vlft_init) {
+		ixgbe->vlft_init = B_TRUE;
+		return (IXGBE_SUCCESS);
+	}
+
+	for (uint_t i = 0; i < ixgbe->num_rx_groups; i++) {
+		int			ret;
+		boolean_t		vlvf_bypass;
+		ixgbe_rx_group_t	*rxg = &ixgbe->rx_groups[i];
+		struct ixgbe_hw		*hw = &ixgbe->hw;
+
+		if (rxg->aupe) {
+			uint32_t vml2flt;
+
+			vml2flt = IXGBE_READ_REG(hw, IXGBE_VMOLR(rxg->index));
+			vml2flt |= IXGBE_VMOLR_AUPE;
+			IXGBE_WRITE_REG(hw, IXGBE_VMOLR(rxg->index), vml2flt);
+		}
+
+		vlvf_bypass = (rxg->index == ixgbe->rx_def_group);
+		for (ixgbe_vlan_t *vlp = list_head(&rxg->vlans); vlp != NULL;
+		    vlp = list_next(&rxg->vlans, vlp)) {
+			ret = ixgbe_set_vfta(hw, vlp->ixvl_vid, rxg->index,
+			    B_TRUE, vlvf_bypass);
+
+			if (ret != IXGBE_SUCCESS) {
+				ixgbe_error(ixgbe, "Failed to program VFTA"
+				    " for group %u, VID: %u, ret: %d.",
+				    rxg->index, vlp->ixvl_vid, ret);
+				return (IXGBE_FAILURE);
+			}
+		}
+	}
+
+	return (IXGBE_SUCCESS);
+}
+
+/*
  * ixgbe_multicst_add - Add a multicst address.
  */
 int
@@ -6152,6 +6252,7 @@ ixgbe_fill_group(void *arg, mac_ring_type_t rtype, const int index,
     mac_group_info_t *infop, mac_group_handle_t gh)
 {
 	ixgbe_t *ixgbe = (ixgbe_t *)arg;
+	struct ixgbe_hw *hw = &ixgbe->hw;
 
 	switch (rtype) {
 	case MAC_RING_TYPE_RX: {
@@ -6165,6 +6266,20 @@ ixgbe_fill_group(void *arg, mac_ring_type_t rtype, const int index,
 		infop->mgi_stop = NULL;
 		infop->mgi_addmac = ixgbe_addmac;
 		infop->mgi_remmac = ixgbe_remmac;
+
+		if ((ixgbe->classify_mode == IXGBE_CLASSIFY_VMDQ ||
+		    ixgbe->classify_mode == IXGBE_CLASSIFY_VMDQ_RSS) &&
+		    (hw->mac.type == ixgbe_mac_82599EB ||
+		    hw->mac.type == ixgbe_mac_X540 ||
+		    hw->mac.type == ixgbe_mac_X550 ||
+		    hw->mac.type == ixgbe_mac_X550EM_x)) {
+			infop->mgi_addvlan = ixgbe_addvlan;
+			infop->mgi_remvlan = ixgbe_remvlan;
+		} else {
+			infop->mgi_addvlan = NULL;
+			infop->mgi_remvlan = NULL;
+		}
+
 		infop->mgi_count = (ixgbe->num_rx_rings / ixgbe->num_rx_groups);
 
 		break;
@@ -6264,6 +6379,228 @@ ixgbe_rx_ring_intr_disable(mac_intr_handle_t intrh)
 	return (0);
 }
 
+static ixgbe_vlan_t *
+ixgbe_find_vlan(ixgbe_rx_group_t *rx_group, uint16_t vid)
+{
+	for (ixgbe_vlan_t *vlp = list_head(&rx_group->vlans); vlp != NULL;
+	    vlp = list_next(&rx_group->vlans, vlp)) {
+		if (vlp->ixvl_vid == vid)
+			return (vlp);
+	}
+
+	return (NULL);
+}
+
+/*
+ * Attempt to use a VLAN HW filter for this group. If the group is
+ * interested in untagged packets then set AUPE only. If the group is
+ * the default then only set the VFTA. Leave the VLVF slots open for
+ * reserved groups to guarantee their use of HW filtering.
+ */
+static int
+ixgbe_addvlan(mac_group_driver_t gdriver, uint16_t vid)
+{
+	ixgbe_rx_group_t	*rx_group = (ixgbe_rx_group_t *)gdriver;
+	ixgbe_t			*ixgbe = rx_group->ixgbe;
+	struct ixgbe_hw		*hw = &ixgbe->hw;
+	ixgbe_vlan_t		*vlp;
+	int			ret;
+	boolean_t		is_def_grp;
+
+	mutex_enter(&ixgbe->gen_lock);
+
+	if (ixgbe->ixgbe_state & IXGBE_SUSPENDED) {
+		mutex_exit(&ixgbe->gen_lock);
+		return (ECANCELED);
+	}
+
+	/*
+	 * Let's be sure VLAN filtering is enabled.
+	 */
+	VERIFY3B(ixgbe->vlft_enabled, ==, B_TRUE);
+	is_def_grp = (rx_group->index == ixgbe->rx_def_group);
+
+	/*
+	 * VLAN filtering is enabled but we want to receive untagged
+	 * traffic on this group -- set the AUPE bit on the group and
+	 * leave the VLAN tables alone.
+	 */
+	if (vid == MAC_VLAN_UNTAGGED) {
+		/*
+		 * We never enable AUPE on the default group; it is
+		 * redundant. Untagged traffic which passes L2
+		 * filtering is delivered to the default group if no
+		 * other group is interested.
+		 */
+		if (!is_def_grp) {
+			uint32_t vml2flt;
+
+			vml2flt = IXGBE_READ_REG(hw,
+			    IXGBE_VMOLR(rx_group->index));
+			vml2flt |= IXGBE_VMOLR_AUPE;
+			IXGBE_WRITE_REG(hw, IXGBE_VMOLR(rx_group->index),
+			    vml2flt);
+			rx_group->aupe = B_TRUE;
+		}
+
+		mutex_exit(&ixgbe->gen_lock);
+		return (0);
+	}
+
+	vlp = ixgbe_find_vlan(rx_group, vid);
+	if (vlp != NULL) {
+		/* Only the default group supports multiple clients. */
+		VERIFY3B(is_def_grp, ==, B_TRUE);
+		vlp->ixvl_refs++;
+		mutex_exit(&ixgbe->gen_lock);
+		return (0);
+	}
+
+	/*
+	 * The default group doesn't require a VLVF entry, only a VFTA
+	 * entry. All traffic passing L2 filtering (MPSAR + VFTA) is
+	 * delivered to the default group if no other group is
+	 * interested. The fourth argument, vlvf_bypass, tells the
+	 * ixgbe common code to avoid using a VLVF slot if one isn't
+	 * already allocated to this VLAN.
+	 *
+	 * This logic is meant to reserve VLVF slots for use by
+	 * reserved groups: guaranteeing their use of HW filtering.
+	 */
+	ret = ixgbe_set_vfta(hw, vid, rx_group->index, B_TRUE, is_def_grp);
+
+	if (ret == IXGBE_SUCCESS) {
+		vlp = kmem_zalloc(sizeof (ixgbe_vlan_t), KM_SLEEP);
+		vlp->ixvl_vid = vid;
+		vlp->ixvl_refs = 1;
+		list_insert_tail(&rx_group->vlans, vlp);
+		mutex_exit(&ixgbe->gen_lock);
+		return (0);
+	}
+
+	/*
+	 * We should actually never return ENOSPC because we've set
+	 * things up so that every reserved group is guaranteed to
+	 * have a VLVF slot.
+	 */
+	if (ret == IXGBE_ERR_PARAM)
+		ret = EINVAL;
+	else if (ret == IXGBE_ERR_NO_SPACE)
+		ret = ENOSPC;
+	else
+		ret = EIO;
+
+	mutex_exit(&ixgbe->gen_lock);
+	return (ret);
+}
+
+/*
+ * Attempt to remove the VLAN HW filter associated with this group. If
+ * we are removing a HW filter for the default group then we know only
+ * the VFTA was set (VLVF is reserved for non-default/reserved
+ * groups). If the group wishes to stop receiving untagged traffic
+ * then clear the AUPE but leave the VLAN filters alone.
+ */
+static int
+ixgbe_remvlan(mac_group_driver_t gdriver, uint16_t vid)
+{
+	ixgbe_rx_group_t	*rx_group = (ixgbe_rx_group_t *)gdriver;
+	ixgbe_t			*ixgbe = rx_group->ixgbe;
+	struct ixgbe_hw		*hw = &ixgbe->hw;
+	int			ret;
+	ixgbe_vlan_t		*vlp;
+	boolean_t		is_def_grp;
+
+	mutex_enter(&ixgbe->gen_lock);
+
+	if (ixgbe->ixgbe_state & IXGBE_SUSPENDED) {
+		mutex_exit(&ixgbe->gen_lock);
+		return (ECANCELED);
+	}
+
+	is_def_grp = (rx_group->index == ixgbe->rx_def_group);
+
+	/* See the AUPE comment in ixgbe_addvlan(). */
+	if (vid == MAC_VLAN_UNTAGGED) {
+		if (!is_def_grp) {
+			uint32_t vml2flt;
+
+			vml2flt = IXGBE_READ_REG(hw,
+			    IXGBE_VMOLR(rx_group->index));
+			vml2flt &= ~IXGBE_VMOLR_AUPE;
+			IXGBE_WRITE_REG(hw,
+			    IXGBE_VMOLR(rx_group->index), vml2flt);
+			rx_group->aupe = B_FALSE;
+		}
+		mutex_exit(&ixgbe->gen_lock);
+		return (0);
+	}
+
+	vlp = ixgbe_find_vlan(rx_group, vid);
+	if (vlp == NULL)
+		return (ENOENT);
+
+	/*
+	 * See the comment in ixgbe_addvlan() about is_def_grp and
+	 * vlvf_bypass.
+	 */
+	if (vlp->ixvl_refs == 1) {
+		ret = ixgbe_set_vfta(hw, vid, rx_group->index, B_FALSE,
+		    is_def_grp);
+	} else {
+		/*
+		 * Only the default group can have multiple clients.
+		 * If there is more than one client, leave the
+		 * VFTA[vid] bit alone.
+		 */
+		VERIFY3B(is_def_grp, ==, B_TRUE);
+		VERIFY3U(vlp->ixvl_refs, >, 1);
+		vlp->ixvl_refs--;
+		mutex_exit(&ixgbe->gen_lock);
+		return (0);
+	}
+
+	if (ret != IXGBE_SUCCESS) {
+		mutex_exit(&ixgbe->gen_lock);
+		/* IXGBE_ERR_PARAM should be the only possible error here. */
+		if (ret == IXGBE_ERR_PARAM)
+			return (EINVAL);
+		else
+			return (EIO);
+	}
+
+	VERIFY3U(vlp->ixvl_refs, ==, 1);
+	vlp->ixvl_refs = 0;
+	list_remove(&rx_group->vlans, vlp);
+	kmem_free(vlp, sizeof (ixgbe_vlan_t));
+
+	/*
+	 * Calling ixgbe_set_vfta() on a non-default group may have
+	 * cleared the VFTA[vid] bit even though the default group
+	 * still has clients using the vid. This happens because the
+	 * ixgbe common code doesn't ref count the use of VLANs. Check
+	 * for any use of vid on the default group and make sure the
+	 * VFTA[vid] bit is set. This operation is idempotent: setting
+	 * VFTA[vid] to true if already true won't hurt anything.
+	 */
+	if (!is_def_grp) {
+		ixgbe_rx_group_t *defgrp;
+
+		defgrp = &ixgbe->rx_groups[ixgbe->rx_def_group];
+		vlp = ixgbe_find_vlan(defgrp, vid);
+		if (vlp != NULL) {
+			/* This shouldn't fail, but if it does return EIO. */
+			ret = ixgbe_set_vfta(hw, vid, rx_group->index, B_TRUE,
+			    B_TRUE);
+			if (ret != IXGBE_SUCCESS)
+				return (EIO);
+		}
+	}
+
+	mutex_exit(&ixgbe->gen_lock);
+	return (0);
+}
+
 /*
  * Add a mac address.
  */
diff --git a/usr/src/uts/common/io/ixgbe/ixgbe_sw.h b/usr/src/uts/common/io/ixgbe/ixgbe_sw.h
index ca52b10c89..baa4766c0e 100644
--- a/usr/src/uts/common/io/ixgbe/ixgbe_sw.h
+++ b/usr/src/uts/common/io/ixgbe/ixgbe_sw.h
@@ -27,7 +27,7 @@
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2013 Saso Kiselkov. All rights reserved.
  * Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef	_IXGBE_SW_H
@@ -91,6 +91,8 @@ extern "C" {
 
 #define	MAX_NUM_UNICAST_ADDRESSES 	0x80
 #define	MAX_NUM_MULTICAST_ADDRESSES 	0x1000
+#define	MAX_NUM_VLAN_FILTERS		0x40
+
 #define	IXGBE_INTR_NONE			0
 #define	IXGBE_INTR_MSIX			1
 #define	IXGBE_INTR_MSI			2
@@ -387,6 +389,15 @@ typedef union ixgbe_ether_addr {
 	} mac;
 } ixgbe_ether_addr_t;
 
+/*
+ * The list of VLANs an Rx group will accept.
+ */
+typedef struct ixgbe_vlan {
+	list_node_t		ixvl_link;
+	uint16_t		ixvl_vid;   /* The VLAN ID */
+	uint_t			ixvl_refs;  /* Number of users of this VLAN */
+} ixgbe_vlan_t;
+
 typedef enum {
 	USE_NONE,
 	USE_COPY,
@@ -589,6 +600,7 @@ typedef struct ixgbe_rx_ring {
 
 	struct ixgbe		*ixgbe;		/* Pointer to ixgbe struct */
 } ixgbe_rx_ring_t;
+
 /*
  * Software Receive Ring Group
  */
@@ -596,6 +608,8 @@ typedef struct ixgbe_rx_group {
 	uint32_t		index;		/* Group index */
 	mac_group_handle_t	group_handle;   /* call back group handle */
 	struct ixgbe		*ixgbe;		/* Pointer to ixgbe struct */
+	boolean_t		aupe;		/* AUPE bit */
+	list_t			vlans;		/* list of VLANs to allow */
 } ixgbe_rx_group_t;
 
 /*
@@ -662,6 +676,7 @@ typedef struct ixgbe {
 	 */
 	ixgbe_rx_group_t	*rx_groups;	/* Array of rx groups */
 	uint32_t		num_rx_groups;	/* Number of rx groups in use */
+	uint32_t		rx_def_group;	/* Default Rx group index */
 
 	/*
 	 * Transmit Rings
@@ -715,6 +730,9 @@ typedef struct ixgbe {
 	uint32_t		mcast_count;
 	struct ether_addr	mcast_table[MAX_NUM_MULTICAST_ADDRESSES];
 
+	boolean_t		vlft_enabled; /* VLAN filtering enabled? */
+	boolean_t		vlft_init;    /* VLAN filtering initialized? */
+
 	ulong_t			sys_page_size;
 
 	boolean_t		link_check_complete;
diff --git a/usr/src/uts/common/io/ksocket/ksocket.c b/usr/src/uts/common/io/ksocket/ksocket.c
index 17ac19b612..d96bfd3d75 100644
--- a/usr/src/uts/common/io/ksocket/ksocket.c
+++ b/usr/src/uts/common/io/ksocket/ksocket.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2014, Joyent, Inc. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/file.h>
@@ -932,3 +932,15 @@ ksocket_rele(ksocket_t ks)
 			cv_signal(&so->so_closing_cv);
 	}
 }
+
+int
+ksocket_krecv_set(ksocket_t ks, ksocket_krecv_f cb, void *arg)
+{
+	return (so_krecv_set(KSTOSO(ks), (so_krecv_f)cb, arg));
+}
+
+void
+ksocket_krecv_unblock(ksocket_t ks)
+{
+	so_krecv_unblock(KSTOSO(ks));
+}
diff --git a/usr/src/uts/common/io/ksocket/ksocket_impl.h b/usr/src/uts/common/io/ksocket/ksocket_impl.h
index ac5251540f..516a68d358 100644
--- a/usr/src/uts/common/io/ksocket/ksocket_impl.h
+++ b/usr/src/uts/common/io/ksocket/ksocket_impl.h
@@ -22,11 +22,17 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #ifndef	_INET_KSOCKET_KSOCKET_IMPL_H
 #define	_INET_KSOCKET_KSOCKET_IMPL_H
 
+/*
+ * Note that if this relationship ever changes, the logic in ksocket_krecv_set
+ * must be updated and we must maintain local state about this on whatever the
+ * new ksocket object is.
+ */
 #define	KSTOSO(ks)	((struct sonode *)(ks))
 #define	SOTOKS(so)	((ksocket_t)(uintptr_t)(so))
 
diff --git a/usr/src/uts/common/io/ksyms.c b/usr/src/uts/common/io/ksyms.c
index c9f0c63b69..5233fcd0b4 100644
--- a/usr/src/uts/common/io/ksyms.c
+++ b/usr/src/uts/common/io/ksyms.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 
@@ -219,6 +220,14 @@ ksyms_open(dev_t *devp, int flag, int otyp, struct cred *cred)
 	char *addr;
 	void *hptr = NULL;
 	ksyms_buflist_hdr_t hdr;
+
+	/*
+	 * This device should never be visible in a zone, but if it somehow
+	 * does get created we refuse to allow the zone to use it.
+	 */
+	if (crgetzoneid(cred) != GLOBAL_ZONEID)
+		return (EACCES);
+
 	bzero(&hdr, sizeof (struct ksyms_buflist_hdr));
 	list_create(&hdr.blist, PAGESIZE,
 	    offsetof(ksyms_buflist_t, buflist_node));
diff --git a/usr/src/uts/common/io/mac/mac.c b/usr/src/uts/common/io/mac/mac.c
index c386eb2941..2176f7d2af 100644
--- a/usr/src/uts/common/io/mac/mac.c
+++ b/usr/src/uts/common/io/mac/mac.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright 2015 Garrett D'Amore <garrett@damore.org>
  */
 
@@ -158,7 +158,7 @@
  * perimeter) across a call to any other layer from the mac layer. The call to
  * any other layer could be via mi_* entry points, classifier entry points into
  * the driver or via upcall pointers into layers above. The mac perimeter may
- * be acquired or held only in the down direction, for e.g. when calling into
+ * be acquired or held only in the down direction, e.g. when calling into
  * a mi_* driver enty point to provide atomicity of the operation.
  *
  * R8. Since it is not guaranteed (see R14) that drivers won't hold locks across
@@ -207,7 +207,7 @@
  * number whenever the ring's stop routine is invoked.
  * See comments in mac_rx_ring();
  *
- * R17 Similarly mi_stop is another synchronization point and the driver must
+ * R17. Similarly mi_stop is another synchronization point and the driver must
  * ensure that all upcalls are done and there won't be any future upcall
  * before returning from mi_stop.
  *
@@ -227,7 +227,7 @@
  *
  * cpu_lock -> mac_srs_g_lock -> srs_lock -> s_ring_lock [mac_walk_srs_and_bind]
  *
- * i_dls_devnet_lock -> mac layer locks [dls_devnet_rename]
+ * mac perim -> i_dls_devnet_lock [dls_devnet_rename]
  *
  * Perimeters are ordered P1 -> P2 -> P3 from top to bottom in order of mac
  * client to driver. In the case of clients that explictly use the mac provided
@@ -460,7 +460,7 @@ mac_init(void)
 	mac_logging_interval = 20;
 	mac_flow_log_enable = B_FALSE;
 	mac_link_log_enable = B_FALSE;
-	mac_logging_timer = 0;
+	mac_logging_timer = NULL;
 
 	/* Register to be notified of noteworthy pools events */
 	mac_pool_event_reg.pec_func =  mac_pool_event_cb;
@@ -1115,9 +1115,10 @@ mac_start(mac_handle_t mh)
 
 		if ((defgrp = MAC_DEFAULT_RX_GROUP(mip)) != NULL) {
 			/*
-			 * Start the default ring, since it will be needed
-			 * to receive broadcast and multicast traffic for
-			 * both primary and non-primary MAC clients.
+			 * Start the default group which is responsible
+			 * for receiving broadcast and multicast
+			 * traffic for both primary and non-primary
+			 * MAC clients.
 			 */
 			ASSERT(defgrp->mrg_state == MAC_GROUP_STATE_REGISTERED);
 			err = mac_start_group_and_rings(defgrp);
@@ -1456,7 +1457,7 @@ mac_rx_group_unmark(mac_group_t *grp, uint_t flag)
  * used by the aggr driver to access and control the underlying HW Rx group
  * and rings. In this case, the aggr driver has exclusive control of the
  * underlying HW Rx group/rings, it calls the following functions to
- * start/stop the HW Rx rings, disable/enable polling, add/remove mac'
+ * start/stop the HW Rx rings, disable/enable polling, add/remove MAC
  * addresses, or set up the Rx callback.
  */
 /* ARGSUSED */
@@ -1501,8 +1502,9 @@ mac_hwrings_get(mac_client_handle_t mch, mac_group_handle_t *hwgh,
 		ASSERT(B_FALSE);
 		return (-1);
 	}
+
 	/*
-	 * The mac client did not reserve any RX group, return directly.
+	 * The MAC client did not reserve an Rx group, return directly.
 	 * This is probably because the underlying MAC does not support
 	 * any groups.
 	 */
@@ -1511,7 +1513,7 @@ mac_hwrings_get(mac_client_handle_t mch, mac_group_handle_t *hwgh,
 	if (grp == NULL)
 		return (0);
 	/*
-	 * This group must be reserved by this mac client.
+	 * This group must be reserved by this MAC client.
 	 */
 	ASSERT((grp->mrg_state == MAC_GROUP_STATE_RESERVED) &&
 	    (mcip == MAC_GROUP_ONLY_CLIENT(grp)));
@@ -1527,6 +1529,77 @@ mac_hwrings_get(mac_client_handle_t mch, mac_group_handle_t *hwgh,
 }
 
 /*
+ * Get the HW ring handles of the given group index. If the MAC
+ * doesn't have a group at this index, or any groups at all, then 0 is
+ * returned and hwgh is set to NULL. This is a private client API. The
+ * MAC perimeter must be held when calling this function.
+ *
+ * mh: A handle to the MAC that owns the group.
+ *
+ * idx: The index of the HW group to be read.
+ *
+ * hwgh: If non-NULL, contains a handle to the HW group on return.
+ *
+ * hwrh: An array of ring handles pointing to the HW rings in the
+ * group. The array must be large enough to hold a handle to each ring
+ * in the group. To be safe, this array should be of size MAX_RINGS_PER_GROUP.
+ *
+ * rtype: Used to determine if we are fetching Rx or Tx rings.
+ *
+ * Returns the number of rings in the group.
+ */
+uint_t
+mac_hwrings_idx_get(mac_handle_t mh, uint_t idx, mac_group_handle_t *hwgh,
+    mac_ring_handle_t *hwrh, mac_ring_type_t rtype)
+{
+	mac_impl_t		*mip = (mac_impl_t *)mh;
+	mac_group_t		*grp;
+	mac_ring_t		*ring;
+	uint_t			cnt = 0;
+
+	/*
+	 * The MAC perimeter must be held when accessing the
+	 * mi_{rx,tx}_groups fields.
+	 */
+	ASSERT(MAC_PERIM_HELD(mh));
+	ASSERT(rtype == MAC_RING_TYPE_RX || rtype == MAC_RING_TYPE_TX);
+
+	if (rtype == MAC_RING_TYPE_RX) {
+		grp = mip->mi_rx_groups;
+	} else if (rtype == MAC_RING_TYPE_TX) {
+		grp = mip->mi_tx_groups;
+	}
+
+	while (grp != NULL && grp->mrg_index != idx)
+		grp = grp->mrg_next;
+
+	/*
+	 * If the MAC doesn't have a group at this index or doesn't
+	 * impelement RINGS capab, then set hwgh to NULL and return 0.
+	 */
+	if (hwgh != NULL)
+		*hwgh = NULL;
+
+	if (grp == NULL)
+		return (0);
+
+	ASSERT3U(idx, ==, grp->mrg_index);
+
+	for (ring = grp->mrg_rings; ring != NULL; ring = ring->mr_next, cnt++) {
+		ASSERT3U(cnt, <, MAX_RINGS_PER_GROUP);
+		hwrh[cnt] = (mac_ring_handle_t)ring;
+	}
+
+	/* A group should always have at least one ring. */
+	ASSERT3U(cnt, >, 0);
+
+	if (hwgh != NULL)
+		*hwgh = (mac_group_handle_t)grp;
+
+	return (cnt);
+}
+
+/*
  * This function is called to get info about Tx/Rx rings.
  *
  * Return value: returns uint_t which will have various bits set
@@ -1542,6 +1615,69 @@ mac_hwring_getinfo(mac_ring_handle_t rh)
 }
 
 /*
+ * Set the passthru callback on the hardware ring.
+ */
+void
+mac_hwring_set_passthru(mac_ring_handle_t hwrh, mac_rx_t fn, void *arg1,
+    mac_resource_handle_t arg2)
+{
+	mac_ring_t *hwring = (mac_ring_t *)hwrh;
+
+	ASSERT3S(hwring->mr_type, ==, MAC_RING_TYPE_RX);
+
+	hwring->mr_classify_type = MAC_PASSTHRU_CLASSIFIER;
+
+	hwring->mr_pt_fn = fn;
+	hwring->mr_pt_arg1 = arg1;
+	hwring->mr_pt_arg2 = arg2;
+}
+
+/*
+ * Clear the passthru callback on the hardware ring.
+ */
+void
+mac_hwring_clear_passthru(mac_ring_handle_t hwrh)
+{
+	mac_ring_t *hwring = (mac_ring_t *)hwrh;
+
+	ASSERT3S(hwring->mr_type, ==, MAC_RING_TYPE_RX);
+
+	hwring->mr_classify_type = MAC_NO_CLASSIFIER;
+
+	hwring->mr_pt_fn = NULL;
+	hwring->mr_pt_arg1 = NULL;
+	hwring->mr_pt_arg2 = NULL;
+}
+
+void
+mac_client_set_flow_cb(mac_client_handle_t mch, mac_rx_t func, void *arg1)
+{
+	mac_client_impl_t	*mcip = (mac_client_impl_t *)mch;
+	flow_entry_t		*flent = mcip->mci_flent;
+
+	mutex_enter(&flent->fe_lock);
+	flent->fe_cb_fn = (flow_fn_t)func;
+	flent->fe_cb_arg1 = arg1;
+	flent->fe_cb_arg2 = NULL;
+	flent->fe_flags &= ~FE_MC_NO_DATAPATH;
+	mutex_exit(&flent->fe_lock);
+}
+
+void
+mac_client_clear_flow_cb(mac_client_handle_t mch)
+{
+	mac_client_impl_t	*mcip = (mac_client_impl_t *)mch;
+	flow_entry_t		*flent = mcip->mci_flent;
+
+	mutex_enter(&flent->fe_lock);
+	flent->fe_cb_fn = (flow_fn_t)mac_pkt_drop;
+	flent->fe_cb_arg1 = NULL;
+	flent->fe_cb_arg2 = NULL;
+	flent->fe_flags |= FE_MC_NO_DATAPATH;
+	mutex_exit(&flent->fe_lock);
+}
+
+/*
  * Export ddi interrupt handles from the HW ring to the pseudo ring and
  * setup the RX callback of the mac client which exclusively controls
  * HW ring.
@@ -1613,17 +1749,56 @@ mac_hwring_enable_intr(mac_ring_handle_t rh)
 	return (intr->mi_enable(intr->mi_handle));
 }
 
+/*
+ * Start the HW ring pointed to by rh.
+ *
+ * This is used by special MAC clients that are MAC themselves and
+ * need to exert control over the underlying HW rings of the NIC.
+ */
 int
 mac_hwring_start(mac_ring_handle_t rh)
 {
 	mac_ring_t *rr_ring = (mac_ring_t *)rh;
+	int rv = 0;
+
+	if (rr_ring->mr_state != MR_INUSE)
+		rv = mac_start_ring(rr_ring);
+
+	return (rv);
+}
+
+/*
+ * Stop the HW ring pointed to by rh. Also see mac_hwring_start().
+ */
+void
+mac_hwring_stop(mac_ring_handle_t rh)
+{
+	mac_ring_t *rr_ring = (mac_ring_t *)rh;
+
+	if (rr_ring->mr_state != MR_FREE)
+		mac_stop_ring(rr_ring);
+}
+
+/*
+ * Remove the quiesced flag from the HW ring pointed to by rh.
+ *
+ * This is used by special MAC clients that are MAC themselves and
+ * need to exert control over the underlying HW rings of the NIC.
+ */
+int
+mac_hwring_activate(mac_ring_handle_t rh)
+{
+	mac_ring_t *rr_ring = (mac_ring_t *)rh;
 
 	MAC_RING_UNMARK(rr_ring, MR_QUIESCE);
 	return (0);
 }
 
+/*
+ * Quiesce the HW ring pointed to by rh. Also see mac_hwring_activate().
+ */
 void
-mac_hwring_stop(mac_ring_handle_t rh)
+mac_hwring_quiesce(mac_ring_handle_t rh)
 {
 	mac_ring_t *rr_ring = (mac_ring_t *)rh;
 
@@ -1730,6 +1905,68 @@ mac_hwgroup_remmac(mac_group_handle_t gh, const uint8_t *addr)
 }
 
 /*
+ * Program the group's HW VLAN filter if it has such support.
+ * Otherwise, the group will implicitly accept tagged traffic and
+ * there is nothing to do.
+ */
+int
+mac_hwgroup_addvlan(mac_group_handle_t gh, uint16_t vid)
+{
+	mac_group_t *group = (mac_group_t *)gh;
+
+	if (!MAC_GROUP_HW_VLAN(group))
+		return (0);
+
+	return (mac_group_addvlan(group, vid));
+}
+
+int
+mac_hwgroup_remvlan(mac_group_handle_t gh, uint16_t vid)
+{
+	mac_group_t *group = (mac_group_t *)gh;
+
+	if (!MAC_GROUP_HW_VLAN(group))
+		return (0);
+
+	return (mac_group_remvlan(group, vid));
+}
+
+/*
+ * Determine if a MAC has HW VLAN support. This is a private API
+ * consumed by aggr. In the future it might be nice to have a bitfield
+ * in mac_capab_rings_t to track which forms of HW filtering are
+ * supported by the MAC.
+ */
+boolean_t
+mac_has_hw_vlan(mac_handle_t mh)
+{
+	mac_impl_t *mip = (mac_impl_t *)mh;
+
+	return (MAC_GROUP_HW_VLAN(mip->mi_rx_groups));
+}
+
+/*
+ * Get the number of Rx HW groups on this MAC.
+ */
+uint_t
+mac_get_num_rx_groups(mac_handle_t mh)
+{
+	mac_impl_t *mip = (mac_impl_t *)mh;
+
+	ASSERT(MAC_PERIM_HELD(mh));
+	return (mip->mi_rx_group_count);
+}
+
+int
+mac_set_promisc(mac_handle_t mh, boolean_t value)
+{
+	mac_impl_t *mip = (mac_impl_t *)mh;
+
+	ASSERT(MAC_PERIM_HELD(mh));
+	return (i_mac_promisc_set(mip, value));
+}
+
+/*
  * Set the RX group to be shared/reserved. Note that the group must be
  * started/stopped outside of this function.
  */
@@ -2416,7 +2653,6 @@ mac_disable(mac_handle_t mh)
 /*
  * Called when the MAC instance has a non empty flow table, to de-multiplex
  * incoming packets to the right flow.
- * The MAC's rw lock is assumed held as a READER.
  */
 /* ARGSUSED */
 static mblk_t *
@@ -2426,19 +2662,6 @@ mac_rx_classify(mac_impl_t *mip, mac_resource_handle_t mrh, mblk_t *mp)
 	uint_t		flags = FLOW_INBOUND;
 	int		err;
 
-	/*
-	 * If the mac is a port of an aggregation, pass FLOW_IGNORE_VLAN
-	 * to mac_flow_lookup() so that the VLAN packets can be successfully
-	 * passed to the non-VLAN aggregation flows.
-	 *
-	 * Note that there is possibly a race between this and
-	 * mac_unicast_remove/add() and VLAN packets could be incorrectly
-	 * classified to non-VLAN flows of non-aggregation mac clients. These
-	 * VLAN packets will be then filtered out by the mac module.
-	 */
-	if ((mip->mi_state_flags & MIS_EXCLUSIVE) != 0)
-		flags |= FLOW_IGNORE_VLAN;
-
 	err = mac_flow_lookup(mip->mi_flow_tab, mp, flags, &flent);
 	if (err != 0) {
 		/* no registered receive function */
@@ -3772,9 +3995,27 @@ mac_start_group_and_rings(mac_group_t *group)
 
 	for (ring = group->mrg_rings; ring != NULL; ring = ring->mr_next) {
 		ASSERT(ring->mr_state == MR_FREE);
+
 		if ((rv = mac_start_ring(ring)) != 0)
 			goto error;
-		ring->mr_classify_type = MAC_SW_CLASSIFIER;
+
+		/*
+		 * When aggr_set_port_sdu() is called, it will remove
+		 * the port client's unicast address. This will cause
+		 * MAC to stop the default group's rings on the port
+		 * MAC. After it modifies the SDU, it will then re-add
+		 * the unicast address. At which time, this function is
+		 * called to start the default group's rings. Normally
+		 * this function would set the classify type to
+		 * MAC_SW_CLASSIFIER; but that will break aggr which
+		 * relies on the passthru classify mode being set for
+		 * correct delivery (see mac_rx_common()). To avoid
+		 * that, we check for a passthru callback and set the
+		 * classify type to MAC_PASSTHRU_CLASSIFIER; as it was
+		 * before the rings were stopped.
+		 */
+		ring->mr_classify_type = (ring->mr_pt_fn != NULL) ?
+		    MAC_PASSTHRU_CLASSIFIER : MAC_SW_CLASSIFIER;
 	}
 	return (0);
 
@@ -4077,12 +4318,15 @@ mac_init_rings(mac_impl_t *mip, mac_ring_type_t rtype)
 
 
 		/*
-		 * Driver must register group->mgi_addmac/remmac() for rx groups
-		 * to support multiple MAC addresses.
+		 * The driver must register some form of hardware MAC
+		 * filter in order for Rx groups to support multiple
+		 * MAC addresses.
 		 */
 		if (rtype == MAC_RING_TYPE_RX &&
-		    ((group_info.mgi_addmac == NULL) ||
-		    (group_info.mgi_remmac == NULL))) {
+		    (group_info.mgi_addmac == NULL ||
+		    group_info.mgi_remmac == NULL)) {
+			DTRACE_PROBE1(mac__init__rings__no__mac__filter,
+			    char *, mip->mi_name);
 			err = EINVAL;
 			goto bail;
 		}
@@ -4129,8 +4373,9 @@ mac_init_rings(mac_impl_t *mip, mac_ring_type_t rtype)
 
 		/* Update this group's status */
 		mac_set_group_state(group, MAC_GROUP_STATE_REGISTERED);
-	} else
+	} else {
 		group->mrg_rings = NULL;
+	}
 
 	ASSERT(ring_left == 0);
 
@@ -4320,6 +4565,38 @@ mac_free_rings(mac_impl_t *mip, mac_ring_type_t rtype)
 }
 
 /*
+ * Associate the VLAN filter to the receive group.
+ */
+int
+mac_group_addvlan(mac_group_t *group, uint16_t vlan)
+{
+	VERIFY3S(group->mrg_type, ==, MAC_RING_TYPE_RX);
+	VERIFY3P(group->mrg_info.mgi_addvlan, !=, NULL);
+
+	if (vlan > VLAN_ID_MAX)
+		return (EINVAL);
+
+	vlan = MAC_VLAN_UNTAGGED_VID(vlan);
+	return (group->mrg_info.mgi_addvlan(group->mrg_info.mgi_driver, vlan));
+}
+
+/*
+ * Dissociate the VLAN from the receive group.
+ */
+int
+mac_group_remvlan(mac_group_t *group, uint16_t vlan)
+{
+	VERIFY3S(group->mrg_type, ==, MAC_RING_TYPE_RX);
+	VERIFY3P(group->mrg_info.mgi_remvlan, !=, NULL);
+
+	if (vlan > VLAN_ID_MAX)
+		return (EINVAL);
+
+	vlan = MAC_VLAN_UNTAGGED_VID(vlan);
+	return (group->mrg_info.mgi_remvlan(group->mrg_info.mgi_driver, vlan));
+}
+
+/*
  * Associate a MAC address with a receive group.
  *
  * The return value of this function should always be checked properly, because
@@ -4335,8 +4612,8 @@ mac_free_rings(mac_impl_t *mip, mac_ring_type_t rtype)
 int
 mac_group_addmac(mac_group_t *group, const uint8_t *addr)
 {
-	ASSERT(group->mrg_type == MAC_RING_TYPE_RX);
-	ASSERT(group->mrg_info.mgi_addmac != NULL);
+	VERIFY3S(group->mrg_type, ==, MAC_RING_TYPE_RX);
+	VERIFY3P(group->mrg_info.mgi_addmac, !=, NULL);
 
 	return (group->mrg_info.mgi_addmac(group->mrg_info.mgi_driver, addr));
 }
@@ -4347,8 +4624,8 @@ mac_group_addmac(mac_group_t *group, const uint8_t *addr)
 int
 mac_group_remmac(mac_group_t *group, const uint8_t *addr)
 {
-	ASSERT(group->mrg_type == MAC_RING_TYPE_RX);
-	ASSERT(group->mrg_info.mgi_remmac != NULL);
+	VERIFY3S(group->mrg_type, ==, MAC_RING_TYPE_RX);
+	VERIFY3P(group->mrg_info.mgi_remmac, !=, NULL);
 
 	return (group->mrg_info.mgi_remmac(group->mrg_info.mgi_driver, addr));
 }
@@ -4523,28 +4800,20 @@ i_mac_group_add_ring(mac_group_t *group, mac_ring_t *ring, int index)
 	switch (ring->mr_type) {
 	case MAC_RING_TYPE_RX:
 		/*
-		 * Setup SRS on top of the new ring if the group is
-		 * reserved for someones exclusive use.
+		 * Setup an SRS on top of the new ring if the group is
+		 * reserved for someone's exclusive use.
 		 */
 		if (group->mrg_state == MAC_GROUP_STATE_RESERVED) {
-			mac_client_impl_t *mcip;
+			mac_client_impl_t *mcip =  MAC_GROUP_ONLY_CLIENT(group);
 
-			mcip = MAC_GROUP_ONLY_CLIENT(group);
-			/*
-			 * Even though this group is reserved we migth still
-			 * have multiple clients, i.e a VLAN shares the
-			 * group with the primary mac client.
-			 */
-			if (mcip != NULL) {
-				flent = mcip->mci_flent;
-				ASSERT(flent->fe_rx_srs_cnt > 0);
-				mac_rx_srs_group_setup(mcip, flent, SRST_LINK);
-				mac_fanout_setup(mcip, flent,
-				    MCIP_RESOURCE_PROPS(mcip), mac_rx_deliver,
-				    mcip, NULL, NULL);
-			} else {
-				ring->mr_classify_type = MAC_SW_CLASSIFIER;
-			}
+			VERIFY3P(mcip, !=, NULL);
+			flent = mcip->mci_flent;
+			VERIFY3S(flent->fe_rx_srs_cnt, >, 0);
+			mac_rx_srs_group_setup(mcip, flent, SRST_LINK);
+			mac_fanout_setup(mcip, flent, MCIP_RESOURCE_PROPS(mcip),
+			    mac_rx_deliver, mcip, NULL, NULL);
+		} else {
+			ring->mr_classify_type = MAC_SW_CLASSIFIER;
 		}
 		break;
 	case MAC_RING_TYPE_TX:
@@ -4570,7 +4839,7 @@ i_mac_group_add_ring(mac_group_t *group, mac_ring_t *ring, int index)
 
 			mcip = mgcp->mgc_client;
 			flent = mcip->mci_flent;
-			is_aggr = (mcip->mci_state_flags & MCIS_IS_AGGR);
+			is_aggr = (mcip->mci_state_flags & MCIS_IS_AGGR_CLIENT);
 			mac_srs = MCIP_TX_SRS(mcip);
 			tx = &mac_srs->srs_tx;
 			mac_tx_client_quiesce((mac_client_handle_t)mcip);
@@ -4714,7 +4983,7 @@ i_mac_group_rem_ring(mac_group_t *group, mac_ring_t *ring,
 
 			mcip = MAC_GROUP_ONLY_CLIENT(group);
 			ASSERT(mcip != NULL);
-			ASSERT(mcip->mci_state_flags & MCIS_IS_AGGR);
+			ASSERT(mcip->mci_state_flags & MCIS_IS_AGGR_CLIENT);
 			mac_srs = MCIP_TX_SRS(mcip);
 			ASSERT(mac_srs->srs_tx.st_mode == SRS_TX_AGGR ||
 			    mac_srs->srs_tx.st_mode == SRS_TX_BW_AGGR);
@@ -4922,12 +5191,12 @@ mac_free_macaddr(mac_address_t *map)
 	mac_impl_t *mip = map->ma_mip;
 
 	ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));
-	ASSERT(mip->mi_addresses != NULL);
-
-	map = mac_find_macaddr(mip, map->ma_addr);
+	VERIFY3P(mip->mi_addresses, !=, NULL);
 
-	ASSERT(map != NULL);
-	ASSERT(map->ma_nusers == 0);
+	VERIFY3P(map, ==, mac_find_macaddr(mip, map->ma_addr));
+	VERIFY3P(map, !=, NULL);
+	VERIFY3S(map->ma_nusers, ==, 0);
+	VERIFY3P(map->ma_vlans, ==, NULL);
 
 	if (map == mip->mi_addresses) {
 		mip->mi_addresses = map->ma_next;
@@ -4943,85 +5212,201 @@ mac_free_macaddr(mac_address_t *map)
 	kmem_free(map, sizeof (mac_address_t));
 }
 
+static mac_vlan_t *
+mac_find_vlan(mac_address_t *map, uint16_t vid)
+{
+	mac_vlan_t *mvp;
+
+	for (mvp = map->ma_vlans; mvp != NULL; mvp = mvp->mv_next) {
+		if (mvp->mv_vid == vid)
+			return (mvp);
+	}
+
+	return (NULL);
+}
+
+static mac_vlan_t *
+mac_add_vlan(mac_address_t *map, uint16_t vid)
+{
+	mac_vlan_t *mvp;
+
+	/*
+	 * We should never add the same {addr, VID} tuple more
+	 * than once, but let's be sure.
+	 */
+	for (mvp = map->ma_vlans; mvp != NULL; mvp = mvp->mv_next)
+		VERIFY3U(mvp->mv_vid, !=, vid);
+
+	/* Add the VLAN to the head of the VLAN list. */
+	mvp = kmem_zalloc(sizeof (mac_vlan_t), KM_SLEEP);
+	mvp->mv_vid = vid;
+	mvp->mv_next = map->ma_vlans;
+	map->ma_vlans = mvp;
+
+	return (mvp);
+}
+
+static void
+mac_rem_vlan(mac_address_t *map, mac_vlan_t *mvp)
+{
+	mac_vlan_t *pre;
+
+	if (map->ma_vlans == mvp) {
+		map->ma_vlans = mvp->mv_next;
+	} else {
+		pre = map->ma_vlans;
+		while (pre->mv_next != mvp) {
+			pre = pre->mv_next;
+
+			/*
+			 * We've reached the end of the list without
+			 * finding mvp.
+			 */
+			VERIFY3P(pre, !=, NULL);
+		}
+		pre->mv_next = mvp->mv_next;
+	}
+
+	kmem_free(mvp, sizeof (mac_vlan_t));
+}
+
 /*
- * Add a MAC address reference for a client. If the desired MAC address
- * exists, add a reference to it. Otherwise, add the new address by adding
- * it to a reserved group or setting promiscuous mode. Won't try different
- * group is the group is non-NULL, so the caller must explictly share
- * default group when needed.
- *
- * Note, the primary MAC address is initialized at registration time, so
- * to add it to default group only need to activate it if its reference
- * count is still zero. Also, some drivers may not have advertised RINGS
- * capability.
+ * Create a new mac_address_t if this is the first use of the address
+ * or add a VID to an existing address. In either case, the
+ * mac_address_t acts as a list of {addr, VID} tuples where each tuple
+ * shares the same addr. If group is non-NULL then attempt to program
+ * the MAC's HW filters for this group. Otherwise, if group is NULL,
+ * then the MAC has no rings and there is nothing to program.
  */
 int
-mac_add_macaddr(mac_impl_t *mip, mac_group_t *group, uint8_t *mac_addr,
-    boolean_t use_hw)
+mac_add_macaddr_vlan(mac_impl_t *mip, mac_group_t *group, uint8_t *addr,
+    uint16_t vid, boolean_t use_hw)
 {
-	mac_address_t *map;
-	int err = 0;
-	boolean_t allocated_map = B_FALSE;
+	mac_address_t	*map;
+	mac_vlan_t	*mvp;
+	int		err = 0;
+	boolean_t	allocated_map = B_FALSE;
+	boolean_t	hw_mac = B_FALSE;
+	boolean_t	hw_vlan = B_FALSE;
 
 	ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));
 
-	map = mac_find_macaddr(mip, mac_addr);
+	map = mac_find_macaddr(mip, addr);
 
 	/*
-	 * If the new MAC address has not been added. Allocate a new one
-	 * and set it up.
+	 * If this is the first use of this MAC address then allocate
+	 * and initialize a new structure.
 	 */
 	if (map == NULL) {
 		map = kmem_zalloc(sizeof (mac_address_t), KM_SLEEP);
 		map->ma_len = mip->mi_type->mt_addr_length;
-		bcopy(mac_addr, map->ma_addr, map->ma_len);
+		bcopy(addr, map->ma_addr, map->ma_len);
 		map->ma_nusers = 0;
 		map->ma_group = group;
 		map->ma_mip = mip;
+		map->ma_untagged = B_FALSE;
 
-		/* add the new MAC address to the head of the address list */
+		/* Add the new MAC address to the head of the address list. */
 		map->ma_next = mip->mi_addresses;
 		mip->mi_addresses = map;
 
 		allocated_map = B_TRUE;
 	}
 
-	ASSERT(map->ma_group == NULL || map->ma_group == group);
+	VERIFY(map->ma_group == NULL || map->ma_group == group);
 	if (map->ma_group == NULL)
 		map->ma_group = group;
 
+	if (vid == VLAN_ID_NONE) {
+		map->ma_untagged = B_TRUE;
+		mvp = NULL;
+	} else {
+		mvp = mac_add_vlan(map, vid);
+	}
+
+	/*
+	 * Set the VLAN HW filter if:
+	 *
+	 * o the MAC's VLAN HW filtering is enabled, and
+	 * o the address does not currently rely on promisc mode.
+	 *
+	 * This is called even when the client specifies an untagged
+	 * address (VLAN_ID_NONE) because some MAC providers require
+	 * setting additional bits to accept untagged traffic when
+	 * VLAN HW filtering is enabled.
+	 */
+	if (MAC_GROUP_HW_VLAN(group) &&
+	    map->ma_type != MAC_ADDRESS_TYPE_UNICAST_PROMISC) {
+		if ((err = mac_group_addvlan(group, vid)) != 0)
+			goto bail;
+
+		hw_vlan = B_TRUE;
+	}
+
+	VERIFY3S(map->ma_nusers, >=, 0);
+	map->ma_nusers++;
+
 	/*
-	 * If the MAC address is already in use, simply account for the
-	 * new client.
+	 * If this MAC address already has a HW filter then simply
+	 * increment the counter.
 	 */
-	if (map->ma_nusers++ > 0)
+	if (map->ma_nusers > 1)
 		return (0);
 
 	/*
+	 * All logic from here on out is executed during initial
+	 * creation only.
+	 */
+	VERIFY3S(map->ma_nusers, ==, 1);
+
+	/*
 	 * Activate this MAC address by adding it to the reserved group.
 	 */
 	if (group != NULL) {
-		err = mac_group_addmac(group, (const uint8_t *)mac_addr);
-		if (err == 0) {
-			map->ma_type = MAC_ADDRESS_TYPE_UNICAST_CLASSIFIED;
-			return (0);
+		err = mac_group_addmac(group, (const uint8_t *)addr);
+
+		/*
+		 * If the driver is out of filters then we can
+		 * continue and use promisc mode. For any other error,
+		 * assume the driver is in a state where we can't
+		 * program the filters or use promisc mode; so we must
+		 * bail.
+		 */
+		if (err != 0 && err != ENOSPC) {
+			map->ma_nusers--;
+			goto bail;
 		}
+
+		hw_mac = (err == 0);
+	}
+
+	if (hw_mac) {
+		map->ma_type = MAC_ADDRESS_TYPE_UNICAST_CLASSIFIED;
+		return (0);
 	}
 
 	/*
 	 * The MAC address addition failed. If the client requires a
-	 * hardware classified MAC address, fail the operation.
+	 * hardware classified MAC address, fail the operation. This
+	 * feature is only used by sun4v vsw.
 	 */
-	if (use_hw) {
+	if (use_hw && !hw_mac) {
 		err = ENOSPC;
+		map->ma_nusers--;
 		goto bail;
 	}
 
 	/*
-	 * Try promiscuous mode.
-	 *
-	 * For drivers that don't advertise RINGS capability, do
-	 * nothing for the primary address.
+	 * If we reach this point then either the MAC doesn't have
+	 * RINGS capability or we are out of MAC address HW filters.
+	 * In any case we must put the MAC into promiscuous mode.
+	 */
+	VERIFY(group == NULL || !hw_mac);
+
+	/*
+	 * The one exception is the primary address. A non-RINGS
+	 * driver filters the primary address by default; promisc mode
+	 * is not needed.
 	 */
 	if ((group == NULL) &&
 	    (bcmp(map->ma_addr, mip->mi_addr, map->ma_len) == 0)) {
@@ -5030,53 +5415,76 @@ mac_add_macaddr(mac_impl_t *mip, mac_group_t *group, uint8_t *mac_addr,
 	}
 
 	/*
-	 * Enable promiscuous mode in order to receive traffic
-	 * to the new MAC address.
+	 * Enable promiscuous mode in order to receive traffic to the
+	 * new MAC address. All existing HW filters still send their
+	 * traffic to their respective group/SRSes. But with promisc
+	 * enabled all unknown traffic is delivered to the default
+	 * group where it is SW classified via mac_rx_classify().
 	 */
 	if ((err = i_mac_promisc_set(mip, B_TRUE)) == 0) {
 		map->ma_type = MAC_ADDRESS_TYPE_UNICAST_PROMISC;
 		return (0);
 	}
 
-	/*
-	 * Free the MAC address that could not be added. Don't free
-	 * a pre-existing address, it could have been the entry
-	 * for the primary MAC address which was pre-allocated by
-	 * mac_init_macaddr(), and which must remain on the list.
-	 */
 bail:
-	map->ma_nusers--;
+	if (hw_vlan) {
+		int err2 = mac_group_remvlan(group, vid);
+
+		if (err2 != 0) {
+			cmn_err(CE_WARN, "Failed to remove VLAN %u from group"
+			    " %d on MAC %s: %d.", vid, group->mrg_index,
+			    mip->mi_name, err2);
+		}
+	}
+
+	if (mvp != NULL)
+		mac_rem_vlan(map, mvp);
+
 	if (allocated_map)
 		mac_free_macaddr(map);
+
 	return (err);
 }
 
-/*
- * Remove a reference to a MAC address. This may cause to remove the MAC
- * address from an associated group or to turn off promiscuous mode.
- * The caller needs to handle the failure properly.
- */
 int
-mac_remove_macaddr(mac_address_t *map)
+mac_remove_macaddr_vlan(mac_address_t *map, uint16_t vid)
 {
-	mac_impl_t *mip = map->ma_mip;
-	int err = 0;
+	mac_vlan_t	*mvp;
+	mac_impl_t	*mip = map->ma_mip;
+	mac_group_t	*group = map->ma_group;
+	int		err = 0;
 
 	ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));
+	VERIFY3P(map, ==, mac_find_macaddr(mip, map->ma_addr));
+
+	if (vid == VLAN_ID_NONE) {
+		map->ma_untagged = B_FALSE;
+		mvp = NULL;
+	} else {
+		mvp = mac_find_vlan(map, vid);
+		VERIFY3P(mvp, !=, NULL);
+	}
+
+	if (MAC_GROUP_HW_VLAN(group) &&
+	    map->ma_type == MAC_ADDRESS_TYPE_UNICAST_CLASSIFIED &&
+	    ((err = mac_group_remvlan(group, vid)) != 0))
+		return (err);
 
-	ASSERT(map == mac_find_macaddr(mip, map->ma_addr));
+	if (mvp != NULL)
+		mac_rem_vlan(map, mvp);
 
 	/*
 	 * If it's not the last client using this MAC address, only update
 	 * the MAC clients count.
 	 */
-	if (--map->ma_nusers > 0)
+	map->ma_nusers--;
+	if (map->ma_nusers > 0)
 		return (0);
 
 	/*
-	 * The MAC address is no longer used by any MAC client, so remove
-	 * it from its associated group, or turn off promiscuous mode
-	 * if it was enabled for the MAC address.
+	 * The MAC address is no longer used by any MAC client, so
+	 * remove it from its associated group. Turn off promiscuous
+	 * mode if this is the last address relying on it.
 	 */
 	switch (map->ma_type) {
 	case MAC_ADDRESS_TYPE_UNICAST_CLASSIFIED:
@@ -5084,18 +5492,44 @@ mac_remove_macaddr(mac_address_t *map)
 		 * Don't free the preset primary address for drivers that
 		 * don't advertise RINGS capability.
 		 */
-		if (map->ma_group == NULL)
+		if (group == NULL)
 			return (0);
 
-		err = mac_group_remmac(map->ma_group, map->ma_addr);
-		if (err == 0)
-			map->ma_group = NULL;
+		if ((err = mac_group_remmac(group, map->ma_addr)) != 0) {
+			if (vid == VLAN_ID_NONE)
+				map->ma_untagged = B_TRUE;
+			else
+				(void) mac_add_vlan(map, vid);
+
+			/*
+			 * If we fail to remove the MAC address HW
+			 * filter but then also fail to re-add the
+			 * VLAN HW filter then we are in a busted
+			 * state and should just crash.
+			 */
+			if (MAC_GROUP_HW_VLAN(group)) {
+				int err2;
+
+				err2 = mac_group_addvlan(group, vid);
+				if (err2 != 0) {
+					cmn_err(CE_WARN, "Failed to readd VLAN"
+					    " %u to group %d on MAC %s: %d.",
+					    vid, group->mrg_index, mip->mi_name,
+					    err2);
+				}
+			}
+
+			return (err);
+		}
+
+		map->ma_group = NULL;
 		break;
 	case MAC_ADDRESS_TYPE_UNICAST_PROMISC:
 		err = i_mac_promisc_set(mip, B_FALSE);
 		break;
 	default:
-		ASSERT(B_FALSE);
+		panic("Unexpected ma_type 0x%x, file: %s, line %d",
+		    map->ma_type, __FILE__, __LINE__);
 	}
 
 	if (err != 0)
@@ -5252,8 +5686,9 @@ mac_fini_macaddr(mac_impl_t *mip)
 	 * If mi_addresses is initialized, there should be exactly one
 	 * entry left on the list with no users.
 	 */
-	ASSERT(map->ma_nusers == 0);
-	ASSERT(map->ma_next == NULL);
+	VERIFY3S(map->ma_nusers, ==, 0);
+	VERIFY3P(map->ma_next, ==, NULL);
+	VERIFY3P(map->ma_vlans, ==, NULL);
 
 	kmem_free(map, sizeof (mac_address_t));
 	mip->mi_addresses = NULL;
@@ -5815,7 +6250,7 @@ mac_stop_logusage(mac_logtype_t type)
 	mod_hash_walk(i_mac_impl_hash, i_mac_fastpath_walker, &estate);
 
 	(void) untimeout(mac_logging_timer);
-	mac_logging_timer = 0;
+	mac_logging_timer = NULL;
 
 	/* Write log entries for each mac_impl in the list */
 	i_mac_log_info(&net_log_list, &lstate);
@@ -5933,7 +6368,7 @@ mac_reserve_tx_ring(mac_impl_t *mip, mac_ring_t *desired_ring)
 }
 
 /*
- * For a reserved group with multiple clients, return the primary client.
+ * For a non-default group with multiple clients, return the primary client.
  */
 static mac_client_impl_t *
 mac_get_grp_primary(mac_group_t *grp)
@@ -6292,13 +6727,12 @@ mac_group_add_client(mac_group_t *grp, mac_client_impl_t *mcip)
 			break;
 	}
 
-	VERIFY(mgcp == NULL);
+	ASSERT(mgcp == NULL);
 
 	mgcp = kmem_zalloc(sizeof (mac_grp_client_t), KM_SLEEP);
 	mgcp->mgc_client = mcip;
 	mgcp->mgc_next = grp->mrg_clients;
 	grp->mrg_clients = mgcp;
-
 }
 
 void
@@ -6319,8 +6753,27 @@ mac_group_remove_client(mac_group_t *grp, mac_client_impl_t *mcip)
 }
 
 /*
- * mac_reserve_rx_group()
- *
+ * Return true if any client on this group explicitly asked for HW
+ * rings (of type mask) or have a bound share.
+ */
+static boolean_t
+i_mac_clients_hw(mac_group_t *grp, uint32_t mask)
+{
+	mac_grp_client_t	*mgcip;
+	mac_client_impl_t	*mcip;
+	mac_resource_props_t	*mrp;
+
+	for (mgcip = grp->mrg_clients; mgcip != NULL; mgcip = mgcip->mgc_next) {
+		mcip = mgcip->mgc_client;
+		mrp = MCIP_RESOURCE_PROPS(mcip);
+		if (mcip->mci_share != NULL || (mrp->mrp_mask & mask) != 0)
+			return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+/*
  * Finds an available group and exclusively reserves it for a client.
  * The group is chosen to suit the flow's resource controls (bandwidth and
  * fanout requirements) and the address type.
@@ -6343,7 +6796,6 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 	int			need_rings = 0;
 	mac_group_t		*candidate_grp = NULL;
 	mac_client_impl_t	*gclient;
-	mac_resource_props_t	*gmrp;
 	mac_group_t		*donorgrp = NULL;
 	boolean_t		rxhw = mrp->mrp_mask & MRP_RX_RINGS;
 	boolean_t		unspec = mrp->mrp_mask & MRP_RXRINGS_UNSPEC;
@@ -6354,18 +6806,20 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 	isprimary = mcip->mci_flent->fe_type & FLOW_PRIMARY_MAC;
 
 	/*
-	 * Check if a group already has this mac address (case of VLANs)
+	 * Check if a group already has this MAC address (case of VLANs)
 	 * unless we are moving this MAC client from one group to another.
 	 */
 	if (!move && (map = mac_find_macaddr(mip, mac_addr)) != NULL) {
 		if (map->ma_group != NULL)
 			return (map->ma_group);
 	}
+
 	if (mip->mi_rx_groups == NULL || mip->mi_rx_group_count == 0)
 		return (NULL);
+
 	/*
-	 * If exclusive open, return NULL which will enable the
-	 * caller to use the default group.
+	 * If this client is requesting exclusive MAC access then
+	 * return NULL to ensure the client uses the default group.
 	 */
 	if (mcip->mci_state_flags & MCIS_EXCLUSIVE)
 		return (NULL);
@@ -6375,6 +6829,7 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 	    mip->mi_rx_group_type == MAC_GROUP_TYPE_DYNAMIC) {
 		mrp->mrp_nrxrings = 1;
 	}
+
 	/*
 	 * For static grouping we allow only specifying rings=0 and
 	 * unspecified
@@ -6383,6 +6838,7 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 	    mip->mi_rx_group_type == MAC_GROUP_TYPE_STATIC) {
 		return (NULL);
 	}
+
 	if (rxhw) {
 		/*
 		 * We have explicitly asked for a group (with nrxrings,
@@ -6444,25 +6900,19 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 		 * that didn't ask for an exclusive group, but got
 		 * one and it has enough rings (combined with what
 		 * the donor group can donate) for the new MAC
-		 * client
+		 * client.
 		 */
 		if (grp->mrg_state >= MAC_GROUP_STATE_RESERVED) {
 			/*
-			 * If the primary/donor group is not the default
-			 * group, don't bother looking for a candidate group.
-			 * If we don't have enough rings we will check
-			 * if the primary group can be vacated.
+			 * If the donor group is not the default
+			 * group, don't bother looking for a candidate
+			 * group. If we don't have enough rings we
+			 * will check if the primary group can be
+			 * vacated.
 			 */
 			if (candidate_grp == NULL &&
 			    donorgrp == MAC_DEFAULT_RX_GROUP(mip)) {
-				ASSERT(!MAC_GROUP_NO_CLIENT(grp));
-				gclient = MAC_GROUP_ONLY_CLIENT(grp);
-				if (gclient == NULL)
-					gclient = mac_get_grp_primary(grp);
-				ASSERT(gclient != NULL);
-				gmrp = MCIP_RESOURCE_PROPS(gclient);
-				if (gclient->mci_share == NULL &&
-				    (gmrp->mrp_mask & MRP_RX_RINGS) == 0 &&
+				if (!i_mac_clients_hw(grp, MRP_RX_RINGS) &&
 				    (unspec ||
 				    (grp->mrg_cur_count + donor_grp_rcnt >=
 				    need_rings))) {
@@ -6528,6 +6978,7 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 		 */
 		mac_stop_group(grp);
 	}
+
 	/* We didn't find an exclusive group for this MAC client */
 	if (i >= mip->mi_rx_group_count) {
 
@@ -6535,12 +6986,12 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 			return (NULL);
 
 		/*
-		 * If we found a candidate group then we switch the
-		 * MAC client from the candidate_group to the default
-		 * group and give the group to this MAC client. If
-		 * we didn't find a candidate_group, check if the
-		 * primary is in its own group and if it can make way
-		 * for this MAC client.
+		 * If we found a candidate group then move the
+		 * existing MAC client from the candidate_group to the
+		 * default group and give the candidate_group to the
+		 * new MAC client. If we didn't find a candidate
+		 * group, then check if the primary is in its own
+		 * group and if it can make way for this MAC client.
 		 */
 		if (candidate_grp == NULL &&
 		    donorgrp != MAC_DEFAULT_RX_GROUP(mip) &&
@@ -6551,15 +7002,15 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 			boolean_t	prim_grp = B_FALSE;
 
 			/*
-			 * Switch the MAC client from the candidate group
-			 * to the default group.. If this group was the
-			 * donor group, then after the switch we need
-			 * to update the donor group too.
+			 * Switch the existing MAC client from the
+			 * candidate group to the default group. If
+			 * the candidate group is the donor group,
+			 * then after the switch we need to update the
+			 * donor group too.
 			 */
 			grp = candidate_grp;
-			gclient = MAC_GROUP_ONLY_CLIENT(grp);
-			if (gclient == NULL)
-				gclient = mac_get_grp_primary(grp);
+			gclient = grp->mrg_clients->mgc_client;
+			VERIFY3P(gclient, !=, NULL);
 			if (grp == mip->mi_rx_donor_grp)
 				prim_grp = B_TRUE;
 			if (mac_rx_switch_group(gclient, grp,
@@ -6572,7 +7023,6 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 				donorgrp = MAC_DEFAULT_RX_GROUP(mip);
 			}
 
-
 			/*
 			 * Now give this group with the required rings
 			 * to this MAC client.
@@ -6620,10 +7070,10 @@ mac_reserve_rx_group(mac_client_impl_t *mcip, uint8_t *mac_addr, boolean_t move)
 /*
  * mac_rx_release_group()
  *
- * This is called when there are no clients left for the group.
- * The group is stopped and marked MAC_GROUP_STATE_REGISTERED,
- * and if it is a non default group, the shares are removed and
- * all rings are assigned back to default group.
+ * Release the group when it has no remaining clients. The group is
+ * stopped and its shares are removed and all rings are assigned back
+ * to default group. This should never be called against the default
+ * group.
  */
 void
 mac_release_rx_group(mac_client_impl_t *mcip, mac_group_t *group)
@@ -6632,6 +7082,7 @@ mac_release_rx_group(mac_client_impl_t *mcip, mac_group_t *group)
 	mac_ring_t		*ring;
 
 	ASSERT(group != MAC_DEFAULT_RX_GROUP(mip));
+	ASSERT(MAC_GROUP_NO_CLIENT(group) == B_TRUE);
 
 	if (mip->mi_rx_donor_grp == group)
 		mip->mi_rx_donor_grp = MAC_DEFAULT_RX_GROUP(mip);
@@ -6683,56 +7134,7 @@ mac_release_rx_group(mac_client_impl_t *mcip, mac_group_t *group)
 }
 
 /*
- * When we move the primary's mac address between groups, we need to also
- * take all the clients sharing the same mac address along with it (VLANs)
- * We remove the mac address for such clients from the group after quiescing
- * them. When we add the mac address we restart the client. Note that
- * the primary's mac address is removed from the group after all the
- * other clients sharing the address are removed. Similarly, the primary's
- * mac address is added before all the other client's mac address are
- * added. While grp is the group where the clients reside, tgrp is
- * the group where the addresses have to be added.
- */
-static void
-mac_rx_move_macaddr_prim(mac_client_impl_t *mcip, mac_group_t *grp,
-    mac_group_t *tgrp, uint8_t *maddr, boolean_t add)
-{
-	mac_impl_t		*mip = mcip->mci_mip;
-	mac_grp_client_t	*mgcp = grp->mrg_clients;
-	mac_client_impl_t	*gmcip;
-	boolean_t		prim;
-
-	prim = (mcip->mci_state_flags & MCIS_UNICAST_HW) != 0;
-
-	/*
-	 * If the clients are in a non-default group, we just have to
-	 * walk the group's client list. If it is in the default group
-	 * (which will be shared by other clients as well, we need to
-	 * check if the unicast address matches mcip's unicast.
-	 */
-	while (mgcp != NULL) {
-		gmcip = mgcp->mgc_client;
-		if (gmcip != mcip &&
-		    (grp != MAC_DEFAULT_RX_GROUP(mip) ||
-		    mcip->mci_unicast == gmcip->mci_unicast)) {
-			if (!add) {
-				mac_rx_client_quiesce(
-				    (mac_client_handle_t)gmcip);
-				(void) mac_remove_macaddr(mcip->mci_unicast);
-			} else {
-				(void) mac_add_macaddr(mip, tgrp, maddr, prim);
-				mac_rx_client_restart(
-				    (mac_client_handle_t)gmcip);
-			}
-		}
-		mgcp = mgcp->mgc_next;
-	}
-}
-
-
-/*
- * Move the MAC address from fgrp to tgrp. If this is the primary client,
- * we need to take any VLANs etc. together too.
+ * Move the MAC address from fgrp to tgrp.
  */
 static int
 mac_rx_move_macaddr(mac_client_impl_t *mcip, mac_group_t *fgrp,
@@ -6741,56 +7143,86 @@ mac_rx_move_macaddr(mac_client_impl_t *mcip, mac_group_t *fgrp,
 	mac_impl_t		*mip = mcip->mci_mip;
 	uint8_t			maddr[MAXMACADDRLEN];
 	int			err = 0;
-	boolean_t		prim;
-	boolean_t		multiclnt = B_FALSE;
+	uint16_t		vid;
+	mac_unicast_impl_t	*muip;
+	boolean_t		use_hw;
 
 	mac_rx_client_quiesce((mac_client_handle_t)mcip);
-	ASSERT(mcip->mci_unicast != NULL);
+	VERIFY3P(mcip->mci_unicast, !=, NULL);
 	bcopy(mcip->mci_unicast->ma_addr, maddr, mcip->mci_unicast->ma_len);
 
-	prim = (mcip->mci_state_flags & MCIS_UNICAST_HW) != 0;
-	if (mcip->mci_unicast->ma_nusers > 1) {
-		mac_rx_move_macaddr_prim(mcip, fgrp, NULL, maddr, B_FALSE);
-		multiclnt = B_TRUE;
-	}
-	ASSERT(mcip->mci_unicast->ma_nusers == 1);
-	err = mac_remove_macaddr(mcip->mci_unicast);
+	/*
+	 * Does the client require MAC address hardware classifiction?
+	 */
+	use_hw = (mcip->mci_state_flags & MCIS_UNICAST_HW) != 0;
+	vid = i_mac_flow_vid(mcip->mci_flent);
+
+	/*
+	 * You can never move an address that is shared by multiple
+	 * clients. mac_datapath_setup() ensures that clients sharing
+	 * an address are placed on the default group. This guarantees
+	 * that a non-default group will only ever have one client and
+	 * thus make full use of HW filters.
+	 */
+	if (mac_check_macaddr_shared(mcip->mci_unicast))
+		return (EINVAL);
+
+	err = mac_remove_macaddr_vlan(mcip->mci_unicast, vid);
+
 	if (err != 0) {
 		mac_rx_client_restart((mac_client_handle_t)mcip);
-		if (multiclnt) {
-			mac_rx_move_macaddr_prim(mcip, fgrp, fgrp, maddr,
-			    B_TRUE);
-		}
 		return (err);
 	}
+
+	/*
+	 * If this isn't the primary MAC address then the
+	 * mac_address_t has been freed by the last call to
+	 * mac_remove_macaddr_vlan(). In any case, NULL the reference
+	 * to avoid a dangling pointer.
+	 */
+	mcip->mci_unicast = NULL;
+
 	/*
-	 * Program the H/W Classifier first, if this fails we need
-	 * not proceed with the other stuff.
+	 * We also have to NULL all the mui_map references -- sun4v
+	 * strikes again!
 	 */
-	if ((err = mac_add_macaddr(mip, tgrp, maddr, prim)) != 0) {
+	rw_enter(&mcip->mci_rw_lock, RW_WRITER);
+	for (muip = mcip->mci_unicast_list; muip != NULL; muip = muip->mui_next)
+		muip->mui_map = NULL;
+	rw_exit(&mcip->mci_rw_lock);
+
+	/*
+	 * Program the H/W Classifier first, if this fails we need not
+	 * proceed with the other stuff.
+	 */
+	if ((err = mac_add_macaddr_vlan(mip, tgrp, maddr, vid, use_hw)) != 0) {
+		int err2;
+
 		/* Revert back the H/W Classifier */
-		if ((err = mac_add_macaddr(mip, fgrp, maddr, prim)) != 0) {
-			/*
-			 * This should not fail now since it worked earlier,
-			 * should we panic?
-			 */
-			cmn_err(CE_WARN,
-			    "mac_rx_switch_group: switching %p back"
-			    " to group %p failed!!", (void *)mcip,
-			    (void *)fgrp);
+		err2 = mac_add_macaddr_vlan(mip, fgrp, maddr, vid, use_hw);
+
+		if (err2 != 0) {
+			cmn_err(CE_WARN, "Failed to revert HW classification"
+			    " on MAC %s, for client %s: %d.", mip->mi_name,
+			    mcip->mci_name, err2);
 		}
+
 		mac_rx_client_restart((mac_client_handle_t)mcip);
-		if (multiclnt) {
-			mac_rx_move_macaddr_prim(mcip, fgrp, fgrp, maddr,
-			    B_TRUE);
-		}
 		return (err);
 	}
+
+	/*
+	 * Get a reference to the new mac_address_t and update the
+	 * client's reference. Then restart the client and add the
+	 * other clients of this MAC addr (if they exsit).
+	 */
 	mcip->mci_unicast = mac_find_macaddr(mip, maddr);
+	rw_enter(&mcip->mci_rw_lock, RW_WRITER);
+	for (muip = mcip->mci_unicast_list; muip != NULL; muip = muip->mui_next)
+		muip->mui_map = mcip->mci_unicast;
+	rw_exit(&mcip->mci_rw_lock);
 	mac_rx_client_restart((mac_client_handle_t)mcip);
-	if (multiclnt)
-		mac_rx_move_macaddr_prim(mcip, fgrp, tgrp, maddr, B_TRUE);
-	return (err);
+	return (0);
 }
 
 /*
@@ -6811,19 +7243,34 @@ mac_rx_switch_group(mac_client_impl_t *mcip, mac_group_t *fgrp,
 	mac_impl_t		*mip = mcip->mci_mip;
 	mac_grp_client_t	*mgcp;
 
-	ASSERT(fgrp == mcip->mci_flent->fe_rx_ring_group);
+	VERIFY3P(fgrp, ==, mcip->mci_flent->fe_rx_ring_group);
 
 	if ((err = mac_rx_move_macaddr(mcip, fgrp, tgrp)) != 0)
 		return (err);
 
 	/*
-	 * The group might be reserved, but SRSs may not be set up, e.g.
-	 * primary and its vlans using a reserved group.
+	 * If the group is marked as reserved and in use by a single
+	 * client, then there is an SRS to teardown.
 	 */
 	if (fgrp->mrg_state == MAC_GROUP_STATE_RESERVED &&
 	    MAC_GROUP_ONLY_CLIENT(fgrp) != NULL) {
 		mac_rx_srs_group_teardown(mcip->mci_flent, B_TRUE);
 	}
+
+	/*
+	 * If we are moving the client from a non-default group, then
+	 * we know that any additional clients on this group share the
+	 * same MAC address. Since we moved the MAC address filter, we
+	 * need to move these clients too.
+	 *
+	 * If we are moving the client from the default group and its
+	 * MAC address has VLAN clients, then we must move those
+	 * clients as well.
+	 *
+	 * In both cases the idea is the same: we moved the MAC
+	 * address filter to the tgrp, so we must move all clients
+	 * using that MAC address to tgrp as well.
+	 */
 	if (fgrp != MAC_DEFAULT_RX_GROUP(mip)) {
 		mgcp = fgrp->mrg_clients;
 		while (mgcp != NULL) {
@@ -6834,20 +7281,21 @@ mac_rx_switch_group(mac_client_impl_t *mcip, mac_group_t *fgrp,
 			gmcip->mci_flent->fe_rx_ring_group = tgrp;
 		}
 		mac_release_rx_group(mcip, fgrp);
-		ASSERT(MAC_GROUP_NO_CLIENT(fgrp));
+		VERIFY3B(MAC_GROUP_NO_CLIENT(fgrp), ==, B_TRUE);
 		mac_set_group_state(fgrp, MAC_GROUP_STATE_REGISTERED);
 	} else {
 		mac_group_remove_client(fgrp, mcip);
 		mac_group_add_client(tgrp, mcip);
 		mcip->mci_flent->fe_rx_ring_group = tgrp;
+
 		/*
 		 * If there are other clients (VLANs) sharing this address
-		 * we should be here only for the primary.
+		 * then move them too.
 		 */
-		if (mcip->mci_unicast->ma_nusers > 1) {
+		if (mac_check_macaddr_shared(mcip->mci_unicast)) {
 			/*
 			 * We need to move all the clients that are using
-			 * this h/w address.
+			 * this MAC address.
 			 */
 			mgcp = fgrp->mrg_clients;
 			while (mgcp != NULL) {
@@ -6861,20 +7309,24 @@ mac_rx_switch_group(mac_client_impl_t *mcip, mac_group_t *fgrp,
 				}
 			}
 		}
+
 		/*
-		 * The default group will still take the multicast,
-		 * broadcast traffic etc., so it won't go to
+		 * The default group still handles multicast and
+		 * broadcast traffic; it won't transition to
 		 * MAC_GROUP_STATE_REGISTERED.
 		 */
 		if (fgrp->mrg_state == MAC_GROUP_STATE_RESERVED)
 			mac_rx_group_unmark(fgrp, MR_CONDEMNED);
 		mac_set_group_state(fgrp, MAC_GROUP_STATE_SHARED);
 	}
+
 	next_state = mac_group_next_state(tgrp, &group_only_mcip,
 	    MAC_DEFAULT_RX_GROUP(mip), B_TRUE);
 	mac_set_group_state(tgrp, next_state);
+
 	/*
-	 * If the destination group is reserved, setup the SRSs etc.
+	 * If the destination group is reserved, then setup the SRSes.
+	 * Otherwise make sure to use SW classification.
 	 */
 	if (tgrp->mrg_state == MAC_GROUP_STATE_RESERVED) {
 		mac_rx_srs_group_setup(mcip, mcip->mci_flent, SRST_LINK);
@@ -6885,6 +7337,7 @@ mac_rx_switch_group(mac_client_impl_t *mcip, mac_group_t *fgrp,
 	} else {
 		mac_rx_switch_grp_to_sw(tgrp);
 	}
+
 	return (0);
 }
 
@@ -6915,6 +7368,7 @@ mac_reserve_tx_group(mac_client_impl_t *mcip, boolean_t move)
 	boolean_t		isprimary;
 
 	isprimary = mcip->mci_flent->fe_type & FLOW_PRIMARY_MAC;
+
 	/*
 	 * When we come here for a VLAN on the primary (dladm create-vlan),
 	 * we need to pair it along with the primary (to keep it consistent
@@ -6996,8 +7450,7 @@ mac_reserve_tx_group(mac_client_impl_t *mcip, boolean_t move)
 			if (grp->mrg_state == MAC_GROUP_STATE_RESERVED &&
 			    candidate_grp == NULL) {
 				gclient = MAC_GROUP_ONLY_CLIENT(grp);
-				if (gclient == NULL)
-					gclient = mac_get_grp_primary(grp);
+				VERIFY3P(gclient, !=, NULL);
 				gmrp = MCIP_RESOURCE_PROPS(gclient);
 				if (gclient->mci_share == NULL &&
 				    (gmrp->mrp_mask & MRP_TX_RINGS) == 0 &&
@@ -7034,13 +7487,14 @@ mac_reserve_tx_group(mac_client_impl_t *mcip, boolean_t move)
 		 */
 		if (need_exclgrp && candidate_grp != NULL) {
 			/*
-			 * Switch the MAC client from the candidate group
-			 * to the default group.
+			 * Switch the MAC client from the candidate
+			 * group to the default group. We know the
+			 * candidate_grp came from a reserved group
+			 * and thus only has one client.
 			 */
 			grp = candidate_grp;
 			gclient = MAC_GROUP_ONLY_CLIENT(grp);
-			if (gclient == NULL)
-				gclient = mac_get_grp_primary(grp);
+			VERIFY3P(gclient, !=, NULL);
 			mac_tx_client_quiesce((mac_client_handle_t)gclient);
 			mac_tx_switch_group(gclient, grp, defgrp);
 			mac_tx_client_restart((mac_client_handle_t)gclient);
@@ -7208,7 +7662,7 @@ mac_tx_switch_group(mac_client_impl_t *mcip, mac_group_t *fgrp,
 		 */
 		mac_group_remove_client(fgrp, mcip);
 		mac_tx_dismantle_soft_rings(fgrp, flent);
-		if (mcip->mci_unicast->ma_nusers > 1) {
+		if (mac_check_macaddr_shared(mcip->mci_unicast)) {
 			mgcp = fgrp->mrg_clients;
 			while (mgcp != NULL) {
 				gmcip = mgcp->mgc_client;
@@ -7454,7 +7908,7 @@ mac_no_active(mac_handle_t mh)
  * changes and update the mac_resource_props_t for the VLAN's client.
  * We need to do this since we don't support setting these properties
  * on the primary's VLAN clients, but the VLAN clients have to
- * follow the primary w.r.t the rings property;
+ * follow the primary w.r.t the rings property.
  */
 void
 mac_set_prim_vlan_rings(mac_impl_t  *mip, mac_resource_props_t *mrp)
@@ -7603,13 +8057,10 @@ mac_group_ring_modify(mac_client_impl_t *mcip, mac_group_t *group,
 				    MAC_GROUP_STATE_RESERVED) {
 					continue;
 				}
-				mcip = MAC_GROUP_ONLY_CLIENT(tgrp);
-				if (mcip == NULL)
-					mcip = mac_get_grp_primary(tgrp);
-				ASSERT(mcip != NULL);
-				mrp = MCIP_RESOURCE_PROPS(mcip);
-				if ((mrp->mrp_mask & MRP_RX_RINGS) != 0)
+				if (i_mac_clients_hw(tgrp, MRP_RX_RINGS))
 					continue;
+				mcip = tgrp->mrg_clients->mgc_client;
+				VERIFY3P(mcip, !=, NULL);
 				if ((tgrp->mrg_cur_count +
 				    defgrp->mrg_cur_count) < (modify + 1)) {
 					continue;
@@ -7624,12 +8075,10 @@ mac_group_ring_modify(mac_client_impl_t *mcip, mac_group_t *group,
 				    MAC_GROUP_STATE_RESERVED) {
 					continue;
 				}
-				mcip = MAC_GROUP_ONLY_CLIENT(tgrp);
-				if (mcip == NULL)
-					mcip = mac_get_grp_primary(tgrp);
-				mrp = MCIP_RESOURCE_PROPS(mcip);
-				if ((mrp->mrp_mask & MRP_TX_RINGS) != 0)
+				if (i_mac_clients_hw(tgrp, MRP_TX_RINGS))
 					continue;
+				mcip = tgrp->mrg_clients->mgc_client;
+				VERIFY3P(mcip, !=, NULL);
 				if ((tgrp->mrg_cur_count +
 				    defgrp->mrg_cur_count) < (modify + 1)) {
 					continue;
@@ -7899,10 +8348,10 @@ mac_pool_event_cb(pool_event_t what, poolid_t id, void *arg)
  * Set effective rings property. This could be called from datapath_setup/
  * datapath_teardown or set-linkprop.
  * If the group is reserved we just go ahead and set the effective rings.
- * Additionally, for TX this could mean the default  group has lost/gained
+ * Additionally, for TX this could mean the default group has lost/gained
  * some rings, so if the default group is reserved, we need to adjust the
  * effective rings for the default group clients. For RX, if we are working
- * with the non-default group, we just need * to reset the effective props
+ * with the non-default group, we just need to reset the effective props
  * for the default group clients.
  */
 void
@@ -8032,6 +8481,7 @@ mac_check_primary_relocation(mac_client_impl_t *mcip, boolean_t rxhw)
 	 * the first non-primary.
 	 */
 	ASSERT(mip->mi_nactiveclients == 2);
+
 	/*
 	 * OK, now we have the primary that needs to be relocated.
 	 */
diff --git a/usr/src/uts/common/io/mac/mac_client.c b/usr/src/uts/common/io/mac/mac_client.c
index efc3cb7f07..da944d79d4 100644
--- a/usr/src/uts/common/io/mac/mac_client.c
+++ b/usr/src/uts/common/io/mac/mac_client.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2017 RackTop Systems.
  */
 
@@ -865,9 +865,12 @@ mac_unicast_update_client_flow(mac_client_impl_t *mcip)
 	mac_protect_update_mac_token(mcip);
 
 	/*
-	 * A MAC client could have one MAC address but multiple
-	 * VLANs. In that case update the flow entries corresponding
-	 * to all VLANs of the MAC client.
+	 * When there are multiple VLANs sharing the same MAC address,
+	 * each gets its own MAC client, except when running on sun4v
+	 * vsw. In that case the mci_flent_list is used to place
+	 * multiple VLAN flows on one MAC client. If we ever get rid
+	 * of vsw then this code can go, but until then we need to
+	 * update all flow entries.
 	 */
 	for (flent = mcip->mci_flent_list; flent != NULL;
 	    flent = flent->fe_client_next) {
@@ -1025,7 +1028,7 @@ mac_unicast_primary_set(mac_handle_t mh, const uint8_t *addr)
 		return (0);
 	}
 
-	if (mac_find_macaddr(mip, (uint8_t *)addr) != 0) {
+	if (mac_find_macaddr(mip, (uint8_t *)addr) != NULL) {
 		i_mac_perim_exit(mip);
 		return (EBUSY);
 	}
@@ -1040,9 +1043,9 @@ mac_unicast_primary_set(mac_handle_t mh, const uint8_t *addr)
 		mac_capab_aggr_t aggr_cap;
 
 		/*
-		 * If the mac is an aggregation, other than the unicast
+		 * If the MAC is an aggregation, other than the unicast
 		 * addresses programming, aggr must be informed about this
-		 * primary unicst address change to change its mac address
+		 * primary unicst address change to change its MAC address
 		 * policy to be user-specified.
 		 */
 		ASSERT(map->ma_type == MAC_ADDRESS_TYPE_UNICAST_CLASSIFIED);
@@ -1374,7 +1377,7 @@ mac_client_open(mac_handle_t mh, mac_client_handle_t *mchp, char *name,
 		mcip->mci_state_flags |= MCIS_IS_AGGR_PORT;
 
 	if (mip->mi_state_flags & MIS_IS_AGGR)
-		mcip->mci_state_flags |= MCIS_IS_AGGR;
+		mcip->mci_state_flags |= MCIS_IS_AGGR_CLIENT;
 
 	if ((flags & MAC_OPEN_FLAGS_USE_DATALINK_NAME) != 0) {
 		datalink_id_t	linkid;
@@ -1433,6 +1436,7 @@ mac_client_open(mac_handle_t mh, mac_client_handle_t *mchp, char *name,
 	mcip->mci_flent = flent;
 	FLOW_MARK(flent, FE_MC_NO_DATAPATH);
 	flent->fe_mcip = mcip;
+
 	/*
 	 * Place initial creation reference on the flow. This reference
 	 * is released in the corresponding delete action viz.
@@ -1539,7 +1543,8 @@ mac_client_close(mac_client_handle_t mch, uint16_t flags)
 }
 
 /*
- * Set the rx bypass receive callback.
+ * Set the Rx bypass receive callback and return B_TRUE. Return
+ * B_FALSE if it's not possible to enable bypass.
  */
 boolean_t
 mac_rx_bypass_set(mac_client_handle_t mch, mac_direct_rx_t rx_fn, void *arg1)
@@ -1550,11 +1555,11 @@ mac_rx_bypass_set(mac_client_handle_t mch, mac_direct_rx_t rx_fn, void *arg1)
 	ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));
 
 	/*
-	 * If the mac_client is a VLAN, we should not do DLS bypass and
-	 * instead let the packets come up via mac_rx_deliver so the vlan
-	 * header can be stripped.
+	 * If the client has more than one VLAN then process packets
+	 * through DLS. This should happen only when sun4v vsw is on
+	 * the scene.
 	 */
-	if (mcip->mci_nvids > 0)
+	if (mcip->mci_nvids > 1)
 		return (B_FALSE);
 
 	/*
@@ -1608,8 +1613,8 @@ mac_rx_set(mac_client_handle_t mch, mac_rx_t rx_fn, void *arg)
 	i_mac_perim_exit(mip);
 
 	/*
-	 * If we're changing the rx function on the primary mac of a vnic,
-	 * make sure any secondary macs on the vnic are updated as well.
+	 * If we're changing the Rx function on the primary MAC of a VNIC,
+	 * make sure any secondary addresses on the VNIC are updated as well.
 	 */
 	if (umip != NULL) {
 		ASSERT((umip->mi_state_flags & MIS_IS_VNIC) != 0);
@@ -1787,6 +1792,14 @@ mac_client_set_rings_prop(mac_client_impl_t *mcip, mac_resource_props_t *mrp,
 				}
 			/* Let check if we can give this an excl group */
 			} else if (group == defgrp) {
+				/*
+				 * If multiple clients share an
+				 * address then they must stay on the
+				 * default group.
+				 */
+				if (mac_check_macaddr_shared(mcip->mci_unicast))
+					return (0);
+
 				ngrp = 	mac_reserve_rx_group(mcip, mac_addr,
 				    B_TRUE);
 				/* Couldn't give it a group, that's fine */
@@ -1809,6 +1822,16 @@ mac_client_set_rings_prop(mac_client_impl_t *mcip, mac_resource_props_t *mrp,
 		}
 
 		if (group == defgrp && ((mrp->mrp_nrxrings > 0) || unspec)) {
+			/*
+			 * We are requesting Rx rings. Try to reserve
+			 * a non-default group.
+			 *
+			 * If multiple clients share an address then
+			 * they must stay on the default group.
+			 */
+			if (mac_check_macaddr_shared(mcip->mci_unicast))
+				return (EINVAL);
+
 			ngrp = 	mac_reserve_rx_group(mcip, mac_addr, B_TRUE);
 			if (ngrp == NULL)
 				return (ENOSPC);
@@ -2166,10 +2189,10 @@ mac_unicast_flow_create(mac_client_impl_t *mcip, uint8_t *mac_addr,
 		flent_flags = FLOW_VNIC_MAC;
 
 	/*
-	 * For the first flow we use the mac client's name - mci_name, for
-	 * subsequent ones we just create a name with the vid. This is
+	 * For the first flow we use the MAC client's name - mci_name, for
+	 * subsequent ones we just create a name with the VID. This is
 	 * so that we can add these flows to the same flow table. This is
-	 * fine as the flow name (except for the one with the mac client's
+	 * fine as the flow name (except for the one with the MAC client's
 	 * name) is not visible. When the first flow is removed, we just replace
 	 * its fdesc with another from the list, so we will still retain the
 	 * flent with the MAC client's flow name.
@@ -2327,6 +2350,7 @@ mac_client_datapath_setup(mac_client_impl_t *mcip, uint16_t vid,
 		 * The unicast MAC address must have been added successfully.
 		 */
 		ASSERT(mcip->mci_unicast != NULL);
+
 		/*
 		 * Push down the sub-flows that were defined on this link
 		 * hitherto. The flows are added to the active flow table
@@ -2338,15 +2362,23 @@ mac_client_datapath_setup(mac_client_impl_t *mcip, uint16_t vid,
 
 		ASSERT(!no_unicast);
 		/*
-		 * A unicast flow already exists for that MAC client,
-		 * this flow must be the same mac address but with
-		 * different VID. It has been checked by mac_addr_in_use().
+		 * A unicast flow already exists for that MAC client
+		 * so this flow must be the same MAC address but with
+		 * a different VID. It has been checked by
+		 * mac_addr_in_use().
+		 *
+		 * We will use the SRS etc. from the initial
+		 * mci_flent. We don't need to create a kstat for
+		 * this, as except for the fdesc, everything will be
+		 * used from the first flent.
 		 *
-		 * We will use the SRS etc. from the mci_flent. Note that
-		 * We don't need to create kstat for this as except for
-		 * the fdesc, everything will be used from in the 1st flent.
+		 * The only time we should see multiple flents on the
+		 * same MAC client is on the sun4v vsw. If we removed
+		 * that code we should be able to remove the entire
+		 * notion of multiple flents on a MAC client (this
+		 * doesn't affect sub/user flows because they have
+		 * their own list unrelated to mci_flent_list).
 		 */
-
 		if (bcmp(mac_addr, map->ma_addr, map->ma_len) != 0) {
 			err = EINVAL;
 			goto bail;
@@ -2406,7 +2438,17 @@ done_setup:
 	if (flent->fe_rx_ring_group != NULL)
 		mac_rx_group_unmark(flent->fe_rx_ring_group, MR_INCIPIENT);
 	FLOW_UNMARK(flent, FE_INCIPIENT);
-	FLOW_UNMARK(flent, FE_MC_NO_DATAPATH);
+
+	/*
+	 * If this is an aggr port client, don't enable the flow's
+	 * datapath at this stage. Otherwise, bcast traffic could
+	 * arrive while the aggr port is in the process of
+	 * initializing. Instead, the flow's datapath is started later
+	 * when mac_client_set_flow_cb() is called.
+	 */
+	if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) == 0)
+		FLOW_UNMARK(flent, FE_MC_NO_DATAPATH);
+
 	mac_tx_client_unblock(mcip);
 	return (0);
 bail:
@@ -2475,8 +2517,12 @@ i_mac_unicast_add(mac_client_handle_t mch, uint8_t *mac_addr, uint16_t flags,
 	boolean_t		is_vnic_primary =
 	    (flags & MAC_UNICAST_VNIC_PRIMARY);
 
-	/* when VID is non-zero, the underlying MAC can not be VNIC */
-	ASSERT(!((mip->mi_state_flags & MIS_IS_VNIC) && (vid != 0)));
+	/*
+	 * When the VID is non-zero the underlying MAC cannot be a
+	 * VNIC. I.e., dladm create-vlan cannot take a VNIC as
+	 * argument, only the primary MAC client.
+	 */
+	ASSERT(!((mip->mi_state_flags & MIS_IS_VNIC) && (vid != VLAN_ID_NONE)));
 
 	/*
 	 * Can't unicast add if the client asked only for minimal datapath
@@ -2489,18 +2535,19 @@ i_mac_unicast_add(mac_client_handle_t mch, uint8_t *mac_addr, uint16_t flags,
 	 * Check for an attempted use of the current Port VLAN ID, if enabled.
 	 * No client may use it.
 	 */
-	if (mip->mi_pvid != 0 && vid == mip->mi_pvid)
+	if (mip->mi_pvid != VLAN_ID_NONE && vid == mip->mi_pvid)
 		return (EBUSY);
 
 	/*
 	 * Check whether it's the primary client and flag it.
 	 */
-	if (!(mcip->mci_state_flags & MCIS_IS_VNIC) && is_primary && vid == 0)
+	if (!(mcip->mci_state_flags & MCIS_IS_VNIC) && is_primary &&
+	    vid == VLAN_ID_NONE)
 		mcip->mci_flags |= MAC_CLIENT_FLAGS_PRIMARY;
 
 	/*
 	 * is_vnic_primary is true when we come here as a VLAN VNIC
-	 * which uses the primary mac client's address but with a non-zero
+	 * which uses the primary MAC client's address but with a non-zero
 	 * VID. In this case the MAC address is not specified by an upper
 	 * MAC client.
 	 */
@@ -2552,7 +2599,7 @@ i_mac_unicast_add(mac_client_handle_t mch, uint8_t *mac_addr, uint16_t flags,
 		/*
 		 * Create a handle for vid 0.
 		 */
-		ASSERT(vid == 0);
+		ASSERT(vid == VLAN_ID_NONE);
 		muip = kmem_zalloc(sizeof (mac_unicast_impl_t), KM_SLEEP);
 		muip->mui_vid = vid;
 		*mah = (mac_unicast_handle_t)muip;
@@ -2572,7 +2619,9 @@ i_mac_unicast_add(mac_client_handle_t mch, uint8_t *mac_addr, uint16_t flags,
 	}
 
 	/*
-	 * If this is a VNIC/VLAN, disable softmac fast-path.
+	 * If this is a VNIC/VLAN, disable softmac fast-path. This is
+	 * only relevant to legacy devices which use softmac to
+	 * interface with GLDv3.
 	 */
 	if (mcip->mci_state_flags & MCIS_IS_VNIC) {
 		err = mac_fastpath_disable((mac_handle_t)mip);
@@ -2620,9 +2669,11 @@ i_mac_unicast_add(mac_client_handle_t mch, uint8_t *mac_addr, uint16_t flags,
 		(void) mac_client_set_resources(mch, mrp);
 	} else if (mcip->mci_state_flags & MCIS_IS_VNIC) {
 		/*
-		 * This is a primary VLAN client, we don't support
-		 * specifying rings property for this as it inherits the
-		 * rings property from its MAC.
+		 * This is a VLAN client sharing the address of the
+		 * primary MAC client; i.e., one created via dladm
+		 * create-vlan. We don't support specifying ring
+		 * properties for this type of client as it inherits
+		 * these from the primary MAC client.
 		 */
 		if (is_vnic_primary) {
 			mac_resource_props_t	*vmrp;
@@ -2681,7 +2732,7 @@ i_mac_unicast_add(mac_client_handle_t mch, uint8_t *mac_addr, uint16_t flags,
 
 	/*
 	 * Set the flags here so that if this is a passive client, we
-	 * can return  and set it when we call mac_client_datapath_setup
+	 * can return and set it when we call mac_client_datapath_setup
 	 * when this becomes the active client. If we defer to using these
 	 * flags to mac_client_datapath_setup, then for a passive client,
 	 * we'd have to store the flags somewhere (probably fe_flags)
@@ -2984,14 +3035,14 @@ mac_unicast_remove(mac_client_handle_t mch, mac_unicast_handle_t mah)
 	i_mac_perim_enter(mip);
 	if (mcip->mci_flags & MAC_CLIENT_FLAGS_VNIC_PRIMARY) {
 		/*
-		 * Called made by the upper MAC client of a VNIC.
+		 * Call made by the upper MAC client of a VNIC.
 		 * There's nothing much to do, the unicast address will
 		 * be removed by the VNIC driver when the VNIC is deleted,
 		 * but let's ensure that all our transmit is done before
 		 * the client does a mac_client_stop lest it trigger an
 		 * assert in the driver.
 		 */
-		ASSERT(muip->mui_vid == 0);
+		ASSERT(muip->mui_vid == VLAN_ID_NONE);
 
 		mac_tx_client_flush(mcip);
 
@@ -3055,6 +3106,7 @@ mac_unicast_remove(mac_client_handle_t mch, mac_unicast_handle_t mah)
 		i_mac_perim_exit(mip);
 		return (0);
 	}
+
 	/*
 	 * Remove the VID from the list of client's VIDs.
 	 */
@@ -3081,7 +3133,7 @@ mac_unicast_remove(mac_client_handle_t mch, mac_unicast_handle_t mah)
 		 * flows.
 		 */
 		flent = mac_client_get_flow(mcip, muip);
-		ASSERT(flent != NULL);
+		VERIFY3P(flent, !=, NULL);
 
 		/*
 		 * The first one is disappearing, need to make sure
@@ -3109,6 +3161,7 @@ mac_unicast_remove(mac_client_handle_t mch, mac_unicast_handle_t mah)
 
 		FLOW_FINAL_REFRELE(flent);
 		ASSERT(!(mcip->mci_state_flags & MCIS_EXCLUSIVE));
+
 		/*
 		 * Enable fastpath if this is a VNIC or a VLAN.
 		 */
@@ -3122,7 +3175,8 @@ mac_unicast_remove(mac_client_handle_t mch, mac_unicast_handle_t mah)
 	mui_vid = muip->mui_vid;
 	mac_client_datapath_teardown(mch, muip, flent);
 
-	if ((mcip->mci_flags & MAC_CLIENT_FLAGS_PRIMARY) && mui_vid == 0) {
+	if ((mcip->mci_flags & MAC_CLIENT_FLAGS_PRIMARY) &&
+	    mui_vid == VLAN_ID_NONE) {
 		mcip->mci_flags &= ~MAC_CLIENT_FLAGS_PRIMARY;
 	} else {
 		i_mac_perim_exit(mip);
@@ -3264,6 +3318,11 @@ mac_promisc_add(mac_client_handle_t mch, mac_client_promisc_type_t type,
 	mac_cb_info_t	*mcbi;
 	int rc;
 
+	if ((flags & MAC_PROMISC_FLAGS_NO_COPY) &&
+	    (flags & MAC_PROMISC_FLAGS_DO_FIXUPS)) {
+		return (EINVAL);
+	}
+
 	i_mac_perim_enter(mip);
 
 	if ((rc = mac_start((mac_handle_t)mip)) != 0) {
@@ -3310,6 +3369,7 @@ mac_promisc_add(mac_client_handle_t mch, mac_client_promisc_type_t type,
 	mpip->mpi_strip_vlan_tag =
 	    ((flags & MAC_PROMISC_FLAGS_VLAN_TAG_STRIP) != 0);
 	mpip->mpi_no_copy = ((flags & MAC_PROMISC_FLAGS_NO_COPY) != 0);
+	mpip->mpi_do_fixups = ((flags & MAC_PROMISC_FLAGS_DO_FIXUPS) != 0);
 
 	mcbi = &mip->mi_promisc_cb_info;
 	mutex_enter(mcbi->mcbi_lockp);
@@ -3946,15 +4006,22 @@ mac_client_get_effective_resources(mac_client_handle_t mch,
 
 static void
 mac_promisc_dispatch_one(mac_promisc_impl_t *mpip, mblk_t *mp,
-    boolean_t loopback)
+    boolean_t loopback, boolean_t local)
 {
 	mblk_t *mp_copy, *mp_next;
 
-	if (!mpip->mpi_no_copy || mpip->mpi_strip_vlan_tag) {
+	if (!mpip->mpi_no_copy || mpip->mpi_strip_vlan_tag ||
+	    (mpip->mpi_do_fixups && local)) {
 		mp_copy = copymsg(mp);
 		if (mp_copy == NULL)
 			return;
 
+		if (mpip->mpi_do_fixups && local) {
+			mp_copy = mac_fix_cksum(mp_copy);
+			if (mp_copy == NULL)
+				return;
+		}
+
 		if (mpip->mpi_strip_vlan_tag) {
 			mp_copy = mac_strip_vlan_tag_chain(mp_copy);
 			if (mp_copy == NULL)
@@ -4011,7 +4078,7 @@ mac_is_mcast(mac_impl_t *mip, mblk_t *mp)
  */
 void
 mac_promisc_dispatch(mac_impl_t *mip, mblk_t *mp_chain,
-    mac_client_impl_t *sender)
+    mac_client_impl_t *sender, boolean_t local)
 {
 	mac_promisc_impl_t *mpip;
 	mac_cb_t *mcb;
@@ -4051,8 +4118,10 @@ mac_promisc_dispatch(mac_impl_t *mip, mblk_t *mp_chain,
 
 			if (is_sender ||
 			    mpip->mpi_type == MAC_CLIENT_PROMISC_ALL ||
-			    is_mcast)
-				mac_promisc_dispatch_one(mpip, mp, is_sender);
+			    is_mcast) {
+				mac_promisc_dispatch_one(mpip, mp, is_sender,
+				    local);
+			}
 		}
 	}
 	MAC_PROMISC_WALKER_DCR(mip);
@@ -4081,7 +4150,8 @@ mac_promisc_client_dispatch(mac_client_impl_t *mcip, mblk_t *mp_chain)
 			mpip = (mac_promisc_impl_t *)mcb->mcb_objp;
 			if (mpip->mpi_type == MAC_CLIENT_PROMISC_FILTERED &&
 			    !is_mcast) {
-				mac_promisc_dispatch_one(mpip, mp, B_FALSE);
+				mac_promisc_dispatch_one(mpip, mp, B_FALSE,
+				    B_FALSE);
 			}
 		}
 	}
@@ -4152,16 +4222,15 @@ mac_info_get(const char *name, mac_info_t *minfop)
 /*
  * To get the capabilities that MAC layer cares about, such as rings, factory
  * mac address, vnic or not, it should directly invoke this function.  If the
- * link is part of a bridge, then the only "capability" it has is the inability
- * to do zero copy.
+ * link is part of a bridge, then the link is unable to do zero copy.
  */
 boolean_t
 i_mac_capab_get(mac_handle_t mh, mac_capab_t cap, void *cap_data)
 {
 	mac_impl_t *mip = (mac_impl_t *)mh;
 
-	if (mip->mi_bridge_link != NULL)
-		return (cap == MAC_CAPAB_NO_ZCOPY);
+	if (mip->mi_bridge_link != NULL && cap == MAC_CAPAB_NO_ZCOPY)
+		return (B_TRUE);
 	else if (mip->mi_callbacks->mc_callbacks & MC_GETCAPAB)
 		return (mip->mi_getcapab(mip->mi_driver, cap, cap_data));
 	else
@@ -4340,7 +4409,13 @@ mac_addr_len(mac_handle_t mh)
 boolean_t
 mac_is_vnic(mac_handle_t mh)
 {
-	return (((mac_impl_t *)mh)->mi_state_flags & MIS_IS_VNIC);
+	return ((((mac_impl_t *)mh)->mi_state_flags & MIS_IS_VNIC) != 0);
+}
+
+boolean_t
+mac_is_overlay(mac_handle_t mh)
+{
+	return ((((mac_impl_t *)mh)->mi_state_flags & MIS_IS_OVERLAY) != 0);
 }
 
 mac_handle_t
diff --git a/usr/src/uts/common/io/mac/mac_datapath_setup.c b/usr/src/uts/common/io/mac/mac_datapath_setup.c
index 8a8f9a9269..6eea8b0343 100644
--- a/usr/src/uts/common/io/mac/mac_datapath_setup.c
+++ b/usr/src/uts/common/io/mac/mac_datapath_setup.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2017, Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -604,6 +604,7 @@ mac_srs_cpu_setup(cpu_setup_t what, int id, void *arg)
  *
  * TODO: Cleanup and tighten some of the assumptions.
  */
+boolean_t mac_check_overlay = B_TRUE;
 boolean_t mac_use_bw_heuristic = B_TRUE;
 static int
 mac_compute_soft_ring_count(flow_entry_t *flent, int rx_srs_cnt, int maxcpus)
@@ -611,6 +612,7 @@ mac_compute_soft_ring_count(flow_entry_t *flent, int rx_srs_cnt, int maxcpus)
 	uint64_t cpu_speed, bw = 0;
 	int srings = 0;
 	boolean_t bw_enabled = B_FALSE;
+	mac_client_impl_t *mcip = flent->fe_mcip;
 
 	ASSERT(!(flent->fe_type & FLOW_USER));
 	if (flent->fe_resource_props.mrp_mask & MRP_MAXBW &&
@@ -638,7 +640,16 @@ mac_compute_soft_ring_count(flow_entry_t *flent, int rx_srs_cnt, int maxcpus)
 			 */
 			if (mac_soft_ring_enable)
 				srings = srings * 2;
+		} else if (mac_check_overlay == B_TRUE &&
+		    (mcip->mci_state_flags & MCIS_IS_VNIC) != 0) {
+			/* Is this a VNIC on an overlay? */
+			mac_handle_t mh = (mac_handle_t)mcip->mci_mip;
+			if (mac_is_overlay(mh) == B_TRUE) {
+				srings = mac_rx_soft_ring_10gig_count;
+			}
 		}
+
+
 	} else {
 		/*
 		 * Soft ring computation using CPU speed and specified
@@ -1186,7 +1197,7 @@ mac_srs_fanout_list_alloc(mac_soft_ring_set_t *mac_srs)
 		mac_srs->srs_tx_soft_rings = (mac_soft_ring_t **)
 		    kmem_zalloc(sizeof (mac_soft_ring_t *) *
 		    MAX_RINGS_PER_GROUP, KM_SLEEP);
-		if (mcip->mci_state_flags & MCIS_IS_AGGR) {
+		if (mcip->mci_state_flags & MCIS_IS_AGGR_CLIENT) {
 			mac_srs_tx_t *tx = &mac_srs->srs_tx;
 
 			tx->st_soft_rings = (mac_soft_ring_t **)
@@ -1595,13 +1606,13 @@ mac_srs_update_bwlimit(flow_entry_t *flent, mac_resource_props_t *mrp)
 
 /*
  * When the first sub-flow is added to a link, we disable polling on the
- * link and also modify the entry point to mac_rx_srs_subflow_process.
+ * link and also modify the entry point to mac_rx_srs_subflow_process().
  * (polling is disabled because with the subflow added, accounting
  * for polling needs additional logic, it is assumed that when a subflow is
  * added, we can take some hit as a result of disabling polling rather than
  * adding more complexity - if this becomes a perf. issue we need to
  * re-rvaluate this logic).  When the last subflow is removed, we turn back
- * polling and also reset the entry point to mac_rx_srs_process.
+ * polling and also reset the entry point to mac_rx_srs_process().
  *
  * In the future if there are multiple SRS, we can simply
  * take one and give it to the flow rather than disabling polling and
@@ -1646,7 +1657,7 @@ mac_client_update_classifier(mac_client_impl_t *mcip, boolean_t enable)
 	 * Change the S/W classifier so that we can land in the
 	 * correct processing function with correct argument.
 	 * If all subflows have been removed we can revert to
-	 * mac_rx_srsprocess, else we need mac_rx_srs_subflow_process.
+	 * mac_rx_srs_process(), else we need mac_rx_srs_subflow_process().
 	 */
 	mutex_enter(&flent->fe_lock);
 	flent->fe_cb_fn = (flow_fn_t)rx_func;
@@ -1977,8 +1988,6 @@ no_softrings:
 }
 
 /*
- * mac_fanout_setup:
- *
  * Calls mac_srs_fanout_init() or modify() depending upon whether
  * the SRS is getting initialized or re-initialized.
  */
@@ -1991,14 +2000,14 @@ mac_fanout_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 	int i, rx_srs_cnt;
 
 	ASSERT(MAC_PERIM_HELD((mac_handle_t)mcip->mci_mip));
+
 	/*
-	 * This is an aggregation port. Fanout will be setup
-	 * over the aggregation itself.
+	 * Aggr ports do not have SRSes. This function should never be
+	 * called on an aggr port.
 	 */
-	if (mcip->mci_state_flags & MCIS_EXCLUSIVE)
-		return;
-
+	ASSERT3U((mcip->mci_state_flags & MCIS_IS_AGGR_PORT), ==, 0);
 	mac_rx_srs = flent->fe_rx_srs[0];
+
 	/*
 	 * Set up the fanout on the tx side only once, with the
 	 * first rx SRS. The CPU binding, fanout, and bandwidth
@@ -2054,8 +2063,6 @@ mac_fanout_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 }
 
 /*
- * mac_srs_create:
- *
  * Create a mac_soft_ring_set_t (SRS). If soft_ring_fanout_type is
  * SRST_TX, an SRS for Tx side is created. Otherwise an SRS for Rx side
  * processing is created.
@@ -2187,7 +2194,7 @@ mac_srs_create(mac_client_impl_t *mcip, flow_entry_t *flent, uint32_t srs_type,
 	 *    find nothing plus we have an existing backlog
 	 *    (sr_poll_pkt_cnt > 0), we stay in polling mode but don't poll
 	 *    the H/W for packets anymore (let the polling thread go to sleep).
-	 * 5) Once the backlog is relived (packets are processed) we reenable
+	 * 5) Once the backlog is relieved (packets are processed) we reenable
 	 *    polling (by signalling the poll thread) only when the backlog
 	 *    dips below sr_poll_thres.
 	 * 6) sr_hiwat is used exclusively when we are not polling capable
@@ -2210,7 +2217,14 @@ mac_srs_create(mac_client_impl_t *mcip, flow_entry_t *flent, uint32_t srs_type,
 			mac_srs->srs_state |= SRS_SOFTRING_QUEUE;
 	}
 
-	mac_srs->srs_worker = thread_create(NULL, 0,
+	/*
+	 * Create the srs_worker with twice the stack of a normal kernel thread
+	 * to reduce the likelihood of stack overflows in receive-side
+	 * processing.  (The larger stacks are not the only precaution taken
+	 * against stack overflows; see the use of the MAC_RX_SRS_TOODEEP
+	 * macro for details.)
+	 */
+	mac_srs->srs_worker = thread_create(NULL, default_stksize << 1,
 	    mac_srs_worker, mac_srs, 0, &p0, TS_RUN, mac_srs->srs_pri);
 
 	if (is_tx_srs) {
@@ -2258,8 +2272,8 @@ mac_srs_create(mac_client_impl_t *mcip, flow_entry_t *flent, uint32_t srs_type,
 		/*
 		 * Some drivers require serialization and don't send
 		 * packet chains in interrupt context. For such
-		 * drivers, we should always queue in soft ring
-		 * so that we get a chance to switch into a polling
+		 * drivers, we should always queue in the soft ring
+		 * so that we get a chance to switch into polling
 		 * mode under backlog.
 		 */
 		ring_info = mac_hwring_getinfo((mac_ring_handle_t)ring);
@@ -2357,6 +2371,10 @@ mac_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 	mac_rx_srs_group_setup(mcip, flent, link_type);
 	mac_tx_srs_group_setup(mcip, flent, link_type);
 
+	/* Aggr ports don't have SRSes; thus there is no soft ring fanout. */
+	if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
+		return;
+
 	pool_lock();
 	cpupart = mac_pset_find(mrp, &use_default);
 	mac_fanout_setup(mcip, flent, MCIP_RESOURCE_PROPS(mcip),
@@ -2366,9 +2384,11 @@ mac_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 }
 
 /*
- * Set up the RX SRSs. If the S/W SRS is not set, set  it up, if there
- * is a group associated with this MAC client, set up SRSs for individual
- * h/w rings.
+ * Set up the Rx SRSes. If there is no group associated with the
+ * client, then only setup SW classification. If the client has
+ * exlusive (MAC_GROUP_STATE_RESERVED) use of the group, then create an
+ * SRS for each HW ring. If the client is sharing a group, then make
+ * sure to teardown the HW SRSes.
  */
 void
 mac_rx_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
@@ -2379,13 +2399,37 @@ mac_rx_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 	mac_ring_t 		*ring;
 	uint32_t		fanout_type;
 	mac_group_t		*rx_group = flent->fe_rx_ring_group;
+	boolean_t		no_unicast;
+
+	/*
+	 * If this is an an aggr port, then don't setup Rx SRS and Rx
+	 * soft rings as they won't be used. However, we still need to
+	 * start the rings to receive data on them.
+	 */
+	if (mcip->mci_state_flags & MCIS_IS_AGGR_PORT) {
+		if (rx_group == NULL)
+			return;
+
+		for (ring = rx_group->mrg_rings; ring != NULL;
+		    ring = ring->mr_next) {
+			if (ring->mr_state != MR_INUSE)
+				(void) mac_start_ring(ring);
+		}
+
+		return;
+	}
+
+	/*
+	 * Aggr ports should never have SRSes.
+	 */
+	ASSERT3U((mcip->mci_state_flags & MCIS_IS_AGGR_PORT), ==, 0);
 
 	fanout_type = mac_find_fanout(flent, link_type);
+	no_unicast = (mcip->mci_state_flags & MCIS_NO_UNICAST_ADDR) != 0;
 
-	/* Create the SRS for S/W classification if none exists */
+	/* Create the SRS for SW classification if none exists */
 	if (flent->fe_rx_srs[0] == NULL) {
 		ASSERT(flent->fe_rx_srs_cnt == 0);
-		/* Setup the Rx SRS */
 		mac_srs = mac_srs_create(mcip, flent, fanout_type | link_type,
 		    mac_rx_deliver, mcip, NULL, NULL);
 		mutex_enter(&flent->fe_lock);
@@ -2397,15 +2441,17 @@ mac_rx_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 
 	if (rx_group == NULL)
 		return;
+
 	/*
-	 * fanout for default SRS is done when default SRS are created
-	 * above. As each ring is added to the group, we setup the
-	 * SRS and fanout to it.
+	 * If the group is marked RESERVED then setup an SRS and
+	 * fanout for each HW ring.
 	 */
 	switch (rx_group->mrg_state) {
 	case MAC_GROUP_STATE_RESERVED:
 		for (ring = rx_group->mrg_rings; ring != NULL;
 		    ring = ring->mr_next) {
+			uint16_t vid = i_mac_flow_vid(mcip->mci_flent);
+
 			switch (ring->mr_state) {
 			case MR_INUSE:
 			case MR_FREE:
@@ -2415,20 +2461,23 @@ mac_rx_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 					(void) mac_start_ring(ring);
 
 				/*
-				 * Since the group is exclusively ours create
-				 * an SRS for this ring to allow the
-				 * individual SRS to dynamically poll the
-				 * ring. Do this only if the  client is not
-				 * a VLAN MAC client, since for VLAN we do
-				 * s/w classification for the VID check, and
-				 * if it has a unicast address.
+				 * If a client requires SW VLAN
+				 * filtering or has no unicast address
+				 * then we don't create any HW ring
+				 * SRSes.
 				 */
-				if ((mcip->mci_state_flags &
-				    MCIS_NO_UNICAST_ADDR) ||
-				    i_mac_flow_vid(mcip->mci_flent) !=
-				    VLAN_ID_NONE) {
+				if ((!MAC_GROUP_HW_VLAN(rx_group) &&
+				    vid != VLAN_ID_NONE) || no_unicast)
 					break;
-				}
+
+				/*
+				 * When a client has exclusive use of
+				 * a group, and that group's traffic
+				 * is fully HW classified, we create
+				 * an SRS for each HW ring in order to
+				 * make use of dynamic polling of said
+				 * HW rings.
+				 */
 				mac_srs = mac_srs_create(mcip, flent,
 				    fanout_type | link_type,
 				    mac_rx_deliver, mcip, NULL, ring);
@@ -2444,14 +2493,9 @@ mac_rx_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 		break;
 	case MAC_GROUP_STATE_SHARED:
 		/*
-		 * Set all rings of this group to software classified.
-		 *
-		 * If the group is current RESERVED, the existing mac
-		 * client (the only client on this group) is using
-		 * this group exclusively.  In that case we need to
-		 * disable polling on the rings of the group (if it
-		 * was enabled), and free the SRS associated with the
-		 * rings.
+		 * When a group is shared by multiple clients, we must
+		 * use SW classifiction to ensure packets are
+		 * delivered to the correct client.
 		 */
 		mac_rx_switch_grp_to_sw(rx_group);
 		break;
@@ -2468,46 +2512,49 @@ void
 mac_tx_srs_group_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
     uint32_t link_type)
 {
-	int			cnt;
-	int			ringcnt;
-	mac_ring_t		*ring;
-	mac_group_t		*grp;
-
 	/*
-	 * If we are opened exclusively (like aggr does for aggr_ports),
-	 * don't set up Tx SRS and Tx soft rings as they won't be used.
-	 * The same thing has to be done for Rx side also. See bug:
-	 * 6880080
+	 * If this is an exclusive client (e.g. an aggr port), then
+	 * don't setup Tx SRS and Tx soft rings as they won't be used.
+	 * However, we still need to start the rings to send data
+	 * across them.
 	 */
 	if (mcip->mci_state_flags & MCIS_EXCLUSIVE) {
-		/*
-		 * If we have rings, start them here.
-		 */
-		if (flent->fe_tx_ring_group == NULL)
-			return;
+		mac_ring_t		*ring;
+		mac_group_t		*grp;
+
 		grp = (mac_group_t *)flent->fe_tx_ring_group;
-		ringcnt = grp->mrg_cur_count;
-		ring = grp->mrg_rings;
-		for (cnt = 0; cnt < ringcnt; cnt++) {
-			if (ring->mr_state != MR_INUSE) {
+
+		if (grp == NULL)
+			return;
+
+		for (ring = grp->mrg_rings; ring != NULL;
+		    ring = ring->mr_next) {
+			if (ring->mr_state != MR_INUSE)
 				(void) mac_start_ring(ring);
-			}
-			ring = ring->mr_next;
 		}
+
 		return;
 	}
+
+	/*
+	 * Aggr ports should never have SRSes.
+	 */
+	ASSERT3U((mcip->mci_state_flags & MCIS_IS_AGGR_PORT), ==, 0);
+
 	if (flent->fe_tx_srs == NULL) {
 		(void) mac_srs_create(mcip, flent, SRST_TX | link_type,
 		    NULL, mcip, NULL, NULL);
 	}
+
 	mac_tx_srs_setup(mcip, flent);
 }
 
 /*
- * Remove all the RX SRSs. If we want to remove only the SRSs associated
- * with h/w rings, leave the S/W SRS alone. This is used when we want to
- * move the MAC client from one group to another, so we need to teardown
- * on the h/w SRSs.
+ * Teardown all the Rx SRSes. Unless hwonly is set, then only teardown
+ * the Rx HW SRSes and leave the SW SRS alone. The hwonly flag is set
+ * when we wish to move a MAC client from one group to another. In
+ * that case, we need to release the current HW SRSes but keep the SW
+ * SRS for continued traffic classifiction.
  */
 void
 mac_rx_srs_group_teardown(flow_entry_t *flent, boolean_t hwonly)
@@ -2525,8 +2572,16 @@ mac_rx_srs_group_teardown(flow_entry_t *flent, boolean_t hwonly)
 		flent->fe_rx_srs[i] = NULL;
 		flent->fe_rx_srs_cnt--;
 	}
-	ASSERT(!hwonly || flent->fe_rx_srs_cnt == 1);
-	ASSERT(hwonly || flent->fe_rx_srs_cnt == 0);
+
+	/*
+	 * If we are only tearing down the HW SRSes then there must be
+	 * one SRS left for SW classification. Otherwise we are tearing
+	 * down both HW and SW and there should be no SRSes left.
+	 */
+	if (hwonly)
+		VERIFY3S(flent->fe_rx_srs_cnt, ==, 1);
+	else
+		VERIFY3S(flent->fe_rx_srs_cnt, ==, 0);
 }
 
 /*
@@ -2828,6 +2883,7 @@ mac_group_next_state(mac_group_t *grp, mac_client_impl_t **group_only_mcip,
  * even if this is the only client in the default group, we will
  * leave group as shared).
  */
+
 int
 mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
     uint32_t link_type)
@@ -2839,6 +2895,7 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 	mac_group_t		*default_tgroup;
 	int			err;
 	uint8_t 		*mac_addr;
+	uint16_t		vid;
 	mac_group_state_t	next_state;
 	mac_client_impl_t	*group_only_mcip;
 	mac_resource_props_t	*mrp = MCIP_RESOURCE_PROPS(mcip);
@@ -2850,6 +2907,7 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 	boolean_t		no_unicast;
 	boolean_t		isprimary = flent->fe_type & FLOW_PRIMARY_MAC;
 	mac_client_impl_t	*reloc_pmcip = NULL;
+	boolean_t		use_hw;
 
 	ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));
 
@@ -2881,15 +2939,19 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 		    (mrp->mrp_mask & MRP_TXRINGS_UNSPEC));
 
 		/*
-		 * By default we have given the primary all the rings
-		 * i.e. the default group. Let's see if the primary
-		 * needs to be relocated so that the addition of this
-		 * client doesn't impact the primary's performance,
-		 * i.e. if the primary is in the default group and
-		 * we add this client, the primary will lose polling.
-		 * We do this only for NICs supporting dynamic ring
-		 * grouping and only when this is the first client
-		 * after the primary (i.e. nactiveclients is 2)
+		 * All the rings initially belong to the default group
+		 * under dynamic grouping. The primary client uses the
+		 * default group when it is the only client. The
+		 * default group is also used as the destination for
+		 * all multicast and broadcast traffic of all clients.
+		 * Therefore, the primary client loses its ability to
+		 * poll the softrings on addition of a second client.
+		 * To avoid a performance penalty, MAC will move the
+		 * primary client to a dedicated group when it can.
+		 *
+		 * When using static grouping, the primary client
+		 * begins life on a non-default group. There is
+		 * no moving needed upon addition of a second client.
 		 */
 		if (!isprimary && mip->mi_nactiveclients == 2 &&
 		    (group_only_mcip = mac_primary_client_handle(mip)) !=
@@ -2897,6 +2959,7 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 			reloc_pmcip = mac_check_primary_relocation(
 			    group_only_mcip, rxhw);
 		}
+
 		/*
 		 * Check to see if we can get an exclusive group for
 		 * this mac address or if there already exists a
@@ -2910,6 +2973,26 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 		} else if (rgroup == NULL) {
 			rgroup = default_rgroup;
 		}
+
+		/*
+		 * If we are adding a second client to a
+		 * non-default group then we need to move the
+		 * existing client to the default group and
+		 * add the new client to the default group as
+		 * well.
+		 */
+		if (rgroup != default_rgroup &&
+		    rgroup->mrg_state == MAC_GROUP_STATE_RESERVED) {
+			group_only_mcip = MAC_GROUP_ONLY_CLIENT(rgroup);
+			err = mac_rx_switch_group(group_only_mcip, rgroup,
+			    default_rgroup);
+
+			if (err != 0)
+				goto setup_failed;
+
+			rgroup = default_rgroup;
+		}
+
 		/*
 		 * Check to see if we can get an exclusive group for
 		 * this mac client. If no groups are available, use
@@ -2941,14 +3024,17 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 					    rgroup->mrg_cur_count);
 				}
 			}
+
 			flent->fe_rx_ring_group = rgroup;
 			/*
-			 * Add the client to the group. This could cause
-			 * either this group to move to the shared state or
-			 * cause the default group to move to the shared state.
-			 * The actions on this group are done here, while the
-			 * actions on the default group are postponed to
-			 * the end of this function.
+			 * Add the client to the group and update the
+			 * group's state. If rgroup != default_group
+			 * then the rgroup should only ever have one
+			 * client and be in the RESERVED state. But no
+			 * matter what, the default_rgroup will enter
+			 * the SHARED state since it has to receive
+			 * all broadcast and multicast traffic. This
+			 * case is handled later in the function.
 			 */
 			mac_group_add_client(rgroup, mcip);
 			next_state = mac_group_next_state(rgroup,
@@ -2973,28 +3059,37 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 			    &group_only_mcip, default_tgroup, B_FALSE);
 			tgroup->mrg_state = next_state;
 		}
-		/*
-		 * Setup the Rx and Tx SRSes. If we got a pristine group
-		 * exclusively above, mac_srs_group_setup would simply create
-		 * the required SRSes. If we ended up sharing a previously
-		 * reserved group, mac_srs_group_setup would also dismantle the
-		 * SRSes of the previously exclusive group
-		 */
-		mac_srs_group_setup(mcip, flent, link_type);
 
 		/* We are setting up minimal datapath only */
-		if (no_unicast)
+		if (no_unicast) {
+			mac_srs_group_setup(mcip, flent, link_type);
 			break;
-		/* Program the S/W Classifer */
+		}
+
+		/* Program software classification. */
 		if ((err = mac_flow_add(mip->mi_flow_tab, flent)) != 0)
 			goto setup_failed;
 
-		/* Program the H/W Classifier */
-		if ((err = mac_add_macaddr(mip, rgroup, mac_addr,
-		    (mcip->mci_state_flags & MCIS_UNICAST_HW) != 0)) != 0)
+		/* Program hardware classification. */
+		vid = i_mac_flow_vid(flent);
+		use_hw = (mcip->mci_state_flags & MCIS_UNICAST_HW) != 0;
+		err = mac_add_macaddr_vlan(mip, rgroup, mac_addr, vid, use_hw);
+
+		if (err != 0)
 			goto setup_failed;
+
 		mcip->mci_unicast = mac_find_macaddr(mip, mac_addr);
-		ASSERT(mcip->mci_unicast != NULL);
+		VERIFY3P(mcip->mci_unicast, !=, NULL);
+
+		/*
+		 * Setup the Rx and Tx SRSes. If the client has a
+		 * reserved group, then mac_srs_group_setup() creates
+		 * the required SRSes for the HW rings. If we have a
+		 * shared group, mac_srs_group_setup() dismantles the
+		 * HW SRSes of the previously exclusive group.
+		 */
+		mac_srs_group_setup(mcip, flent, link_type);
+
 		/* (Re)init the v6 token & local addr used by link protection */
 		mac_protect_update_mac_token(mcip);
 		break;
@@ -3038,17 +3133,23 @@ mac_datapath_setup(mac_client_impl_t *mcip, flow_entry_t *flent,
 			ASSERT(default_rgroup->mrg_state ==
 			    MAC_GROUP_STATE_SHARED);
 		}
+
 		/*
-		 * If we get an exclusive group for a VLAN MAC client we
-		 * need to take the s/w path to make the additional check for
-		 * the vid. Disable polling and set it to s/w classification.
-		 * Similarly for clients that don't have a unicast address.
+		 * A VLAN MAC client on a reserved group still
+		 * requires SW classification if the MAC doesn't
+		 * provide VLAN HW filtering.
+		 *
+		 * Clients with no unicast address also require SW
+		 * classification.
 		 */
 		if (rgroup->mrg_state == MAC_GROUP_STATE_RESERVED &&
-		    (i_mac_flow_vid(flent) != VLAN_ID_NONE || no_unicast)) {
+		    ((!MAC_GROUP_HW_VLAN(rgroup) && vid != VLAN_ID_NONE) ||
+		    no_unicast)) {
 			mac_rx_switch_grp_to_sw(rgroup);
 		}
+
 	}
+
 	mac_set_rings_effective(mcip);
 	return (0);
 
@@ -3074,6 +3175,7 @@ mac_datapath_teardown(mac_client_impl_t *mcip, flow_entry_t *flent,
 	boolean_t		check_default_group = B_FALSE;
 	mac_group_state_t	next_state;
 	mac_resource_props_t	*mrp = MCIP_RESOURCE_PROPS(mcip);
+	uint16_t		vid;
 
 	ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));
 
@@ -3086,16 +3188,24 @@ mac_datapath_teardown(mac_client_impl_t *mcip, flow_entry_t *flent,
 	case SRST_LINK:
 		/* Stop sending packets */
 		mac_tx_client_block(mcip);
+		group = flent->fe_rx_ring_group;
+		vid = i_mac_flow_vid(flent);
 
-		/* Stop the packets coming from the H/W */
+		/*
+		 * Stop the packet flow from the hardware by disabling
+		 * any hardware filters assigned to this client.
+		 */
 		if (mcip->mci_unicast != NULL) {
 			int err;
-			err = mac_remove_macaddr(mcip->mci_unicast);
+
+			err = mac_remove_macaddr_vlan(mcip->mci_unicast, vid);
+
 			if (err != 0) {
-				cmn_err(CE_WARN, "%s: failed to remove a MAC"
-				    " address because of error 0x%x",
+				cmn_err(CE_WARN, "%s: failed to remove a MAC HW"
+				    " filters because of error 0x%x",
 				    mip->mi_name, err);
 			}
+
 			mcip->mci_unicast = NULL;
 		}
 
@@ -3103,12 +3213,12 @@ mac_datapath_teardown(mac_client_impl_t *mcip, flow_entry_t *flent,
 		mac_flow_remove(mip->mi_flow_tab, flent, B_FALSE);
 		mac_flow_wait(flent, FLOW_DRIVER_UPCALL);
 
-		/* Now quiesce and destroy all SRS and soft rings */
+		/* Quiesce and destroy all the SRSes. */
 		mac_rx_srs_group_teardown(flent, B_FALSE);
 		mac_tx_srs_group_teardown(mcip, flent, SRST_LINK);
 
-		ASSERT((mcip->mci_flent == flent) &&
-		    (flent->fe_next == NULL));
+		ASSERT3P(mcip->mci_flent, ==, flent);
+		ASSERT3P(flent->fe_next, ==, NULL);
 
 		/*
 		 * Release our hold on the group as well. We need
@@ -3116,17 +3226,17 @@ mac_datapath_teardown(mac_client_impl_t *mcip, flow_entry_t *flent,
 		 * left who can use it exclusively. Also, if we
 		 * were the last client, release the group.
 		 */
-		group = flent->fe_rx_ring_group;
 		default_group = MAC_DEFAULT_RX_GROUP(mip);
 		if (group != NULL) {
 			mac_group_remove_client(group, mcip);
 			next_state = mac_group_next_state(group,
 			    &grp_only_mcip, default_group, B_TRUE);
+
 			if (next_state == MAC_GROUP_STATE_RESERVED) {
 				/*
 				 * Only one client left on this RX group.
 				 */
-				ASSERT(grp_only_mcip != NULL);
+				VERIFY3P(grp_only_mcip, !=, NULL);
 				mac_set_group_state(group,
 				    MAC_GROUP_STATE_RESERVED);
 				group_only_flent = grp_only_mcip->mci_flent;
@@ -3151,7 +3261,7 @@ mac_datapath_teardown(mac_client_impl_t *mcip, flow_entry_t *flent,
 				 * to see if the primary client can get
 				 * exclusive access to the default group.
 				 */
-				ASSERT(group != MAC_DEFAULT_RX_GROUP(mip));
+				VERIFY3P(group, !=, MAC_DEFAULT_RX_GROUP(mip));
 				if (mrp->mrp_mask & MRP_RX_RINGS) {
 					MAC_RX_GRP_RELEASED(mip);
 					if (mip->mi_rx_group_type ==
@@ -3165,7 +3275,8 @@ mac_datapath_teardown(mac_client_impl_t *mcip, flow_entry_t *flent,
 				    MAC_GROUP_STATE_REGISTERED);
 				check_default_group = B_TRUE;
 			} else {
-				ASSERT(next_state == MAC_GROUP_STATE_SHARED);
+				VERIFY3S(next_state, ==,
+				    MAC_GROUP_STATE_SHARED);
 				mac_set_group_state(group,
 				    MAC_GROUP_STATE_SHARED);
 				mac_rx_group_unmark(group, MR_CONDEMNED);
@@ -3254,12 +3365,12 @@ mac_datapath_teardown(mac_client_impl_t *mcip, flow_entry_t *flent,
 	 */
 	if (check_default_group) {
 		default_group = MAC_DEFAULT_RX_GROUP(mip);
-		ASSERT(default_group->mrg_state == MAC_GROUP_STATE_SHARED);
+		VERIFY3S(default_group->mrg_state, ==, MAC_GROUP_STATE_SHARED);
 		next_state = mac_group_next_state(default_group,
 		    &grp_only_mcip, default_group, B_TRUE);
 		if (next_state == MAC_GROUP_STATE_RESERVED) {
-			ASSERT(grp_only_mcip != NULL &&
-			    mip->mi_nactiveclients == 1);
+			VERIFY3P(grp_only_mcip, !=, NULL);
+			VERIFY3U(mip->mi_nactiveclients, ==, 1);
 			mac_set_group_state(default_group,
 			    MAC_GROUP_STATE_RESERVED);
 			mac_rx_srs_group_setup(grp_only_mcip,
@@ -3783,7 +3894,7 @@ mac_tx_srs_del_ring(mac_soft_ring_set_t *mac_srs, mac_ring_t *tx_ring)
 	 * is also stored in st_soft_rings[] array. That entry should
 	 * be removed.
 	 */
-	if (mcip->mci_state_flags & MCIS_IS_AGGR) {
+	if (mcip->mci_state_flags & MCIS_IS_AGGR_CLIENT) {
 		mac_srs_tx_t *tx = &mac_srs->srs_tx;
 
 		ASSERT(tx->st_soft_rings[tx_ring->mr_index] == remove_sring);
@@ -3812,7 +3923,7 @@ mac_tx_srs_setup(mac_client_impl_t *mcip, flow_entry_t *flent)
 	boolean_t		is_aggr;
 	uint_t			ring_info = 0;
 
-	is_aggr = (mcip->mci_state_flags & MCIS_IS_AGGR) != 0;
+	is_aggr = (mcip->mci_state_flags & MCIS_IS_AGGR_CLIENT) != 0;
 	grp = flent->fe_tx_ring_group;
 	if (grp == NULL) {
 		ring = (mac_ring_t *)mip->mi_default_tx_ring;
@@ -3956,8 +4067,8 @@ mac_fanout_recompute_client(mac_client_impl_t *mcip, cpupart_t *cpupart)
 }
 
 /*
- * Walk through the list of mac clients for the MAC.
- * For each active mac client, recompute the number of soft rings
+ * Walk through the list of MAC clients for the MAC.
+ * For each active MAC client, recompute the number of soft rings
  * associated with every client, only if current speed is different
  * from the speed that was previously used for soft ring computation.
  * If the cable is disconnected whlie the NIC is started, we would get
@@ -3980,6 +4091,10 @@ mac_fanout_recompute(mac_impl_t *mip)
 
 	for (mcip = mip->mi_clients_list; mcip != NULL;
 	    mcip = mcip->mci_client_next) {
+		/* Aggr port clients don't have SRSes. */
+		if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
+			continue;
+
 		if ((mcip->mci_state_flags & MCIS_SHARE_BOUND) != 0 ||
 		    !MCIP_DATAPATH_SETUP(mcip))
 			continue;
@@ -3992,6 +4107,7 @@ mac_fanout_recompute(mac_impl_t *mip)
 		mac_set_pool_effective(use_default, cpupart, mrp, emrp);
 		pool_unlock();
 	}
+
 	i_mac_perim_exit(mip);
 }
 
diff --git a/usr/src/uts/common/io/mac/mac_protect.c b/usr/src/uts/common/io/mac/mac_protect.c
index da83dc643e..ee493bbca1 100644
--- a/usr/src/uts/common/io/mac/mac_protect.c
+++ b/usr/src/uts/common/io/mac/mac_protect.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+ * Copyright 2017, Joyent, Inc.  All rights reserved.
  */
 /*
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
@@ -209,7 +209,7 @@ typedef struct slaac_addr {
 } slaac_addr_t;
 
 static void	start_txn_cleanup_timer(mac_client_impl_t *);
-static boolean_t allowed_ips_set(mac_resource_props_t *, uint32_t);
+static boolean_t dynamic_method_set(mac_protect_t *, uint32_t);
 
 #define	BUMP_STAT(m, s)	(m)->mci_misc_stat.mms_##s++
 
@@ -580,8 +580,7 @@ intercept_dhcpv4_outbound(mac_client_impl_t *mcip, ipha_t *ipha, uchar_t *end)
 	if (get_dhcpv4_info(ipha, end, &dh4) != 0)
 		return (B_TRUE);
 
-	/* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
-	if (allowed_ips_set(mrp, IPV4_VERSION))
+	if (!dynamic_method_set(&mrp->mrp_protect, MPT_DYN_DHCPV4))
 		return (B_FALSE);
 
 	if (get_dhcpv4_option(dh4, end, CD_DHCP_TYPE, &opt, &opt_len) != 0 ||
@@ -1310,8 +1309,7 @@ intercept_dhcpv6_outbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end)
 	if (get_dhcpv6_info(ip6h, end, &dh6) != 0)
 		return (B_TRUE);
 
-	/* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
-	if (allowed_ips_set(mrp, IPV6_VERSION))
+	if (!dynamic_method_set(&mrp->mrp_protect, MPT_DYN_DHCPV6))
 		return (B_FALSE);
 
 	/*
@@ -1517,6 +1515,10 @@ intercept_ra_inbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end,
 {
 	struct nd_opt_hdr *opt;
 	int len, optlen;
+	mac_protect_t *protect = &MCIP_RESOURCE_PROPS(mcip)->mrp_protect;
+
+	if (!dynamic_method_set(protect, MPT_DYN_SLAAC))
+		return;
 
 	if (ip6h->ip6_hlim != 255) {
 		DTRACE_PROBE1(invalid__hoplimit, uint8_t, ip6h->ip6_hlim);
@@ -1755,6 +1757,7 @@ ipnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *protect,
 	if (*addr == INADDR_ANY)
 		return (B_TRUE);
 
+	/* If any specific addresses or subnets are allowed, check them */
 	for (i = 0; i < protect->mp_ipaddrcnt; i++) {
 		mac_ipaddr_t	*v4addr = &protect->mp_ipaddrs[i];
 
@@ -1775,14 +1778,19 @@ ipnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *protect,
 				return (B_TRUE);
 		}
 	}
-	return (protect->mp_ipaddrcnt == 0 ?
-	    check_dhcpv4_dyn_ip(mcip, *addr) : B_FALSE);
+
+	if (dynamic_method_set(protect, MPT_DYN_DHCPV4)) {
+		return (check_dhcpv4_dyn_ip(mcip, *addr));
+	}
+
+	return (B_FALSE);
 }
 
 static boolean_t
 ipnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *protect,
     in6_addr_t *addr)
 {
+	boolean_t slaac_enabled, dhcpv6_enabled;
 	uint_t	i;
 
 	/*
@@ -1793,7 +1801,7 @@ ipnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *protect,
 	    IN6_ARE_ADDR_EQUAL(&mcip->mci_v6_local_addr, addr)))
 		return (B_TRUE);
 
-
+	/* If any specific addresses or subnets are allowed, check them */
 	for (i = 0; i < protect->mp_ipaddrcnt; i++) {
 		mac_ipaddr_t	*v6addr = &protect->mp_ipaddrs[i];
 
@@ -1804,12 +1812,15 @@ ipnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *protect,
 			return (B_TRUE);
 	}
 
-	if (protect->mp_ipaddrcnt == 0) {
-		return (check_slaac_ip(mcip, addr) ||
-		    check_dhcpv6_dyn_ip(mcip, addr));
-	} else {
-		return (B_FALSE);
-	}
+	slaac_enabled = dynamic_method_set(protect, MPT_DYN_SLAAC);
+	if (slaac_enabled && check_slaac_ip(mcip, addr))
+		return (B_TRUE);
+
+	dhcpv6_enabled = dynamic_method_set(protect, MPT_DYN_DHCPV6);
+	if (dhcpv6_enabled && check_dhcpv6_dyn_ip(mcip, addr))
+		return (B_TRUE);
+
+	return (B_FALSE);
 }
 
 /*
@@ -2025,6 +2036,9 @@ dhcpnospoof_check_cid(mac_protect_t *p, uchar_t *cid, uint_t cidlen)
 		    bcmp(dcid->dc_id, cid, cidlen) == 0)
 			return (B_TRUE);
 	}
+
+	DTRACE_PROBE3(missing__cid, mac_protect_t *, p,
+	    uchar_t *, cid, uint_t, cidlen);
 	return (B_FALSE);
 }
 
@@ -2046,6 +2060,12 @@ dhcpnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *p,
 	    bcmp(mcip->mci_unicast->ma_addr, dh4->chaddr, maclen) != 0) {
 		return (B_FALSE);
 	}
+
+	/* Everything after here is checking the Client Identifier */
+	if (p->mp_allcids == MPT_TRUE) {
+		return (B_TRUE);
+	}
+
 	if (get_dhcpv4_option(dh4, end, CD_CLIENT_ID, &cid, &optlen) == 0)
 		cidlen = optlen;
 
@@ -2082,6 +2102,11 @@ dhcpnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *p,
 	    mtype == DHCPV6_MSG_RECONFIGURE)
 		return (B_TRUE);
 
+	/* Everything after here is checking the Client Identifier */
+	if (p->mp_allcids == MPT_TRUE) {
+		return (B_TRUE);
+	}
+
 	d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
 	    DHCPV6_OPT_CLIENTID, &cidlen);
 	if (d6o == NULL || (uchar_t *)d6o + cidlen > end)
@@ -2159,7 +2184,6 @@ dhcpnospoof_check(mac_client_impl_t *mcip, mac_protect_t *protect,
 	return (0);
 
 fail:
-	/* increment dhcpnospoof stat here */
 	freemsg(nmp);
 	return (err);
 }
@@ -2487,6 +2511,11 @@ mac_protect_validate(mac_resource_props_t *mrp)
 	if ((err = validate_cids(p)) != 0)
 		return (err);
 
+	if (p->mp_allcids != MPT_FALSE && p->mp_allcids != MPT_TRUE &&
+	    p->mp_allcids != MPT_RESET) {
+		return (EINVAL);
+	}
+
 	return (0);
 }
 
@@ -2554,6 +2583,16 @@ mac_protect_update(mac_resource_props_t *new, mac_resource_props_t *curr)
 			cp->mp_cidcnt = 0;
 		}
 	}
+	if (np->mp_allcids == MPT_RESET) {
+		cp->mp_allcids = MPT_FALSE;
+	} else if (np->mp_allcids != 0) {
+		cp->mp_allcids = MPT_TRUE;
+	}
+	if (np->mp_dynamic == MPT_RESET) {
+		cp->mp_dynamic = 0;
+	} else if (np->mp_dynamic != 0) {
+		cp->mp_dynamic = np->mp_dynamic;
+	}
 }
 
 void
@@ -2597,15 +2636,50 @@ mac_protect_fini(mac_client_impl_t *mcip)
 }
 
 static boolean_t
-allowed_ips_set(mac_resource_props_t *mrp, uint32_t af)
+dynamic_method_set(mac_protect_t *mpt, uint32_t method)
+{
+	if (mpt->mp_dynamic != 0) {
+		return ((mpt->mp_dynamic & method) != 0);
+	} else {
+		return (mpt->mp_ipaddrcnt == 0);
+	}
+}
+
+boolean_t
+mac_protect_check_addr(mac_client_handle_t mch, boolean_t isv6,
+    in6_addr_t *v6addr)
 {
-	int i;
+	mac_perim_handle_t	perim;
+	mac_client_impl_t	*mcip = (mac_client_impl_t *)mch;
+	mac_handle_t		mh = (mac_handle_t)mcip->mci_mip;
 
-	for (i = 0; i < mrp->mrp_protect.mp_ipaddrcnt; i++) {
-		if (mrp->mrp_protect.mp_ipaddrs[i].ip_version == af)
-			return (B_TRUE);
+	mac_perim_enter_by_mh(mh, &perim);
+
+	mac_resource_props_t	*mrp = MCIP_RESOURCE_PROPS(mcip);
+	mac_protect_t		*p;
+	boolean_t		allowed;
+
+	ASSERT(mrp != NULL);
+
+	p = &mrp->mrp_protect;
+
+	/* If mac protection/ipnospoof isn't enabled, return true */
+	if ((mrp->mrp_mask & MRP_PROTECT) == 0 ||
+	    (p->mp_types & MPT_IPNOSPOOF) == 0) {
+		allowed = B_TRUE;
+		goto done;
 	}
-	return (B_FALSE);
+
+	if (isv6) {
+		allowed = ipnospoof_check_v6(mcip, p, v6addr);
+	} else {
+		in_addr_t *v4addr = &V4_PART_OF_V6((*v6addr));
+		allowed = ipnospoof_check_v4(mcip, p, v4addr);
+	}
+
+done:
+	mac_perim_exit(perim);
+	return (allowed);
 }
 
 mac_protect_t *
diff --git a/usr/src/uts/common/io/mac/mac_provider.c b/usr/src/uts/common/io/mac/mac_provider.c
index 07201afdec..d739fad87a 100644
--- a/usr/src/uts/common/io/mac/mac_provider.c
+++ b/usr/src/uts/common/io/mac/mac_provider.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved.
  */
 
@@ -56,6 +57,7 @@
 #include <sys/sdt.h>
 #include <sys/pattr.h>
 #include <sys/strsun.h>
+#include <sys/vlan.h>
 
 /*
  * MAC Provider Interface.
@@ -351,6 +353,9 @@ mac_register(mac_register_t *mregp, mac_handle_t *mhp)
 	if (i_mac_capab_get((mac_handle_t)mip, MAC_CAPAB_AGGR, NULL))
 		mip->mi_state_flags |= MIS_IS_AGGR;
 
+	if (i_mac_capab_get((mac_handle_t)mip, MAC_CAPAB_OVERLAY, NULL))
+		mip->mi_state_flags |= MIS_IS_OVERLAY;
+
 	mac_addr_factory_init(mip);
 
 	mac_transceiver_init(mip);
@@ -683,7 +688,7 @@ mac_trill_snoop(mac_handle_t mh, mblk_t *mp)
 	mac_impl_t *mip = (mac_impl_t *)mh;
 
 	if (mip->mi_promisc_list != NULL)
-		mac_promisc_dispatch(mip, mp, NULL);
+		mac_promisc_dispatch(mip, mp, NULL, B_FALSE);
 }
 
 /*
@@ -697,19 +702,18 @@ mac_rx_common(mac_handle_t mh, mac_resource_handle_t mrh, mblk_t *mp_chain)
 	mac_ring_t		*mr = (mac_ring_t *)mrh;
 	mac_soft_ring_set_t 	*mac_srs;
 	mblk_t			*bp = mp_chain;
-	boolean_t		hw_classified = B_FALSE;
 
 	/*
 	 * If there are any promiscuous mode callbacks defined for
 	 * this MAC, pass them a copy if appropriate.
 	 */
 	if (mip->mi_promisc_list != NULL)
-		mac_promisc_dispatch(mip, mp_chain, NULL);
+		mac_promisc_dispatch(mip, mp_chain, NULL, B_FALSE);
 
 	if (mr != NULL) {
 		/*
 		 * If the SRS teardown has started, just return. The 'mr'
-		 * continues to be valid until the driver unregisters the mac.
+		 * continues to be valid until the driver unregisters the MAC.
 		 * Hardware classified packets will not make their way up
 		 * beyond this point once the teardown has started. The driver
 		 * is never passed a pointer to a flow entry or SRS or any
@@ -722,11 +726,25 @@ mac_rx_common(mac_handle_t mh, mac_resource_handle_t mrh, mblk_t *mp_chain)
 			freemsgchain(mp_chain);
 			return;
 		}
-		if (mr->mr_classify_type == MAC_HW_CLASSIFIER) {
-			hw_classified = B_TRUE;
+
+		/*
+		 * The ring is in passthru mode; pass the chain up to
+		 * the pseudo ring.
+		 */
+		if (mr->mr_classify_type == MAC_PASSTHRU_CLASSIFIER) {
 			MR_REFHOLD_LOCKED(mr);
+			mutex_exit(&mr->mr_lock);
+			mr->mr_pt_fn(mr->mr_pt_arg1, mr->mr_pt_arg2, mp_chain,
+			    B_FALSE);
+			MR_REFRELE(mr);
+			return;
 		}
-		mutex_exit(&mr->mr_lock);
+
+		/*
+		 * The passthru callback should only be set when in
+		 * MAC_PASSTHRU_CLASSIFIER mode.
+		 */
+		ASSERT3P(mr->mr_pt_fn, ==, NULL);
 
 		/*
 		 * We check if an SRS is controlling this ring.
@@ -734,19 +752,24 @@ mac_rx_common(mac_handle_t mh, mac_resource_handle_t mrh, mblk_t *mp_chain)
 		 * routine otherwise we need to go through mac_rx_classify
 		 * to reach the right place.
 		 */
-		if (hw_classified) {
+		if (mr->mr_classify_type == MAC_HW_CLASSIFIER) {
+			MR_REFHOLD_LOCKED(mr);
+			mutex_exit(&mr->mr_lock);
+			ASSERT3P(mr->mr_srs, !=, NULL);
 			mac_srs = mr->mr_srs;
+
 			/*
-			 * This is supposed to be the fast path.
-			 * All packets received though here were steered by
-			 * the hardware classifier, and share the same
-			 * MAC header info.
+			 * This is the fast path. All packets received
+			 * on this ring are hardware classified and
+			 * share the same MAC header info.
 			 */
 			mac_srs->srs_rx.sr_lower_proc(mh,
 			    (mac_resource_handle_t)mac_srs, mp_chain, B_FALSE);
 			MR_REFRELE(mr);
 			return;
 		}
+
+		mutex_exit(&mr->mr_lock);
 		/* We'll fall through to software classification */
 	} else {
 		flow_entry_t *flent;
@@ -1472,7 +1495,8 @@ mac_prop_info_set_perm(mac_prop_info_handle_t ph, uint8_t perm)
 	pr->pr_flags |= MAC_PROP_INFO_PERM;
 }
 
-void mac_hcksum_get(mblk_t *mp, uint32_t *start, uint32_t *stuff,
+void
+mac_hcksum_get(const mblk_t *mp, uint32_t *start, uint32_t *stuff,
     uint32_t *end, uint32_t *value, uint32_t *flags_ptr)
 {
 	uint32_t flags;
@@ -1497,8 +1521,9 @@ void mac_hcksum_get(mblk_t *mp, uint32_t *start, uint32_t *stuff,
 		*flags_ptr = flags;
 }
 
-void mac_hcksum_set(mblk_t *mp, uint32_t start, uint32_t stuff,
-    uint32_t end, uint32_t value, uint32_t flags)
+void
+mac_hcksum_set(mblk_t *mp, uint32_t start, uint32_t stuff, uint32_t end,
+    uint32_t value, uint32_t flags)
 {
 	ASSERT(DB_TYPE(mp) == M_DATA);
 
@@ -1510,6 +1535,24 @@ void mac_hcksum_set(mblk_t *mp, uint32_t start, uint32_t stuff,
 }
 
 void
+mac_hcksum_clone(const mblk_t *src, mblk_t *dst)
+{
+	ASSERT3U(DB_TYPE(src), ==, M_DATA);
+	ASSERT3U(DB_TYPE(dst), ==, M_DATA);
+
+	/*
+	 * Do these assignments unconditionally, rather than only when flags is
+	 * non-zero.  This protects a situation where zeroed hcksum data does
+	 * not make the jump onto an mblk_t with stale data in those fields.
+	 */
+	DB_CKSUMFLAGS(dst) = (DB_CKSUMFLAGS(src) & HCK_FLAGS);
+	DB_CKSUMSTART(dst) = DB_CKSUMSTART(src);
+	DB_CKSUMSTUFF(dst) = DB_CKSUMSTUFF(src);
+	DB_CKSUMEND(dst) = DB_CKSUMEND(src);
+	DB_CKSUM16(dst) = DB_CKSUM16(src);
+}
+
+void
 mac_lso_get(mblk_t *mp, uint32_t *mss, uint32_t *flags)
 {
 	ASSERT(DB_TYPE(mp) == M_DATA);
diff --git a/usr/src/uts/common/io/mac/mac_sched.c b/usr/src/uts/common/io/mac/mac_sched.c
index d91d07db09..59d59287b4 100644
--- a/usr/src/uts/common/io/mac/mac_sched.c
+++ b/usr/src/uts/common/io/mac/mac_sched.c
@@ -21,7 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
  */
 
@@ -300,9 +300,8 @@
  *
  * Otherwise, all fanout is performed by software. MAC divides incoming frames
  * into one of three buckets -- IPv4 TCP traffic, IPv4 UDP traffic, and
- * everything else. Note, VLAN tagged traffic is considered other, regardless of
- * the interior EtherType. Regardless of the type of fanout, these three
- * categories or buckets are always used.
+ * everything else. Regardless of the type of fanout, these three categories
+ * or buckets are always used.
  *
  * The difference between protocol level fanout and full software ring protocol
  * fanout is the number of software rings that end up getting created. The
@@ -1367,11 +1366,11 @@ int mac_srs_worker_wakeup_ticks = 0;
  * can occur in situ (in the interrupt thread) or if it should be left to a
  * worker thread.  Note that the constant used to make this determination is
  * not entirely made-up, and is a result of some emprical validation. That
- * said, the constant is left as a static variable to allow it to be
+ * said, the constant is left as a global variable to allow it to be
  * dynamically tuned in the field if and as needed.
  */
-static uintptr_t mac_rx_srs_stack_needed = 10240;
-static uint_t mac_rx_srs_stack_toodeep;
+uintptr_t mac_rx_srs_stack_needed = 14336;
+uint_t mac_rx_srs_stack_toodeep;
 
 #ifndef STACK_GROWTH_DOWN
 #error Downward stack growth assumed.
@@ -1379,7 +1378,7 @@ static uint_t mac_rx_srs_stack_toodeep;
 
 #define	MAC_RX_SRS_TOODEEP() (STACK_BIAS + (uintptr_t)getfp() - \
 	(uintptr_t)curthread->t_stkbase < mac_rx_srs_stack_needed && \
-	++mac_rx_srs_stack_toodeep)
+	(++mac_rx_srs_stack_toodeep || (mac_rx_srs_stack_toodeep = 1)))
 
 
 /*
@@ -1475,16 +1474,15 @@ enum pkt_type {
 #define	PORTS_SIZE 4
 
 /*
- * mac_rx_srs_proto_fanout
- *
- * This routine delivers packets destined to an SRS into one of the
+ * This routine delivers packets destined for an SRS into one of the
  * protocol soft rings.
  *
- * Given a chain of packets we need to split it up into multiple sub chains
- * destined into TCP, UDP or OTH soft ring. Instead of entering
- * the soft ring one packet at a time, we want to enter it in the form of a
- * chain otherwise we get this start/stop behaviour where the worker thread
- * goes to sleep and then next packets comes in forcing it to wake up etc.
+ * Given a chain of packets we need to split it up into multiple sub
+ * chains: TCP, UDP or OTH soft ring. Instead of entering the soft
+ * ring one packet at a time, we want to enter it in the form of a
+ * chain otherwise we get this start/stop behaviour where the worker
+ * thread goes to sleep and then next packet comes in forcing it to
+ * wake up.
  */
 static void
 mac_rx_srs_proto_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
@@ -1523,9 +1521,9 @@ mac_rx_srs_proto_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 	    mac_srs->srs_ring->mr_classify_type == MAC_HW_CLASSIFIER;
 
 	/*
-	 * Special clients (eg. VLAN, non ether, etc) need DLS
-	 * processing in the Rx path. SRST_DLS_BYPASS will be clear for
-	 * such SRSs. Another way of disabling bypass is to set the
+	 * Some clients, such as non-ethernet, need DLS processing in
+	 * the Rx path. Such clients clear the SRST_DLS_BYPASS flag.
+	 * DLS bypass may also be disabled via the
 	 * MCIS_RX_BYPASS_DISABLE flag.
 	 */
 	dls_bypass = ((mac_srs->srs_type & SRST_DLS_BYPASS) != 0) &&
@@ -1537,10 +1535,11 @@ mac_rx_srs_proto_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 	bzero(sz, MAX_SR_TYPES * sizeof (size_t));
 
 	/*
-	 * We got a chain from SRS that we need to send to the soft rings.
-	 * Since squeues for TCP & IPv4 sap poll their soft rings (for
-	 * performance reasons), we need to separate out v4_tcp, v4_udp
-	 * and the rest goes in other.
+	 * We have a chain from SRS that we need to split across the
+	 * soft rings. The squeues for the TCP and IPv4 SAPs use their
+	 * own soft rings to allow polling from the squeue. The rest of
+	 * the packets are delivered on the OTH soft ring which cannot
+	 * be polled.
 	 */
 	while (head != NULL) {
 		mp = head;
@@ -1568,9 +1567,14 @@ mac_rx_srs_proto_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 				evhp = (struct ether_vlan_header *)mp->b_rptr;
 				sap = ntohs(evhp->ether_type);
 				hdrsize = sizeof (struct ether_vlan_header);
+
 				/*
-				 * Check if the VID of the packet, if any,
-				 * belongs to this client.
+				 * Check if the VID of the packet, if
+				 * any, belongs to this client.
+				 * Technically, if this packet came up
+				 * via a HW classified ring then we
+				 * don't need to perform this check.
+				 * Perhaps a future optimization.
 				 */
 				if (!mac_client_check_flow_vid(mcip,
 				    VLAN_ID(ntohs(evhp->ether_tci)))) {
@@ -1635,7 +1639,6 @@ mac_rx_srs_proto_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 		 * performance and may bypass DLS. All other cases go through
 		 * the 'OTH' type path without DLS bypass.
 		 */
-
 		ipha = (ipha_t *)(mp->b_rptr + hdrsize);
 		if ((type != OTH) && MBLK_RX_FANOUT_SLOWPATH(mp, ipha))
 			type = OTH;
@@ -1647,11 +1650,13 @@ mac_rx_srs_proto_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 		}
 
 		ASSERT(type == UNDEF);
+
 		/*
-		 * We look for at least 4 bytes past the IP header to get
-		 * the port information. If we get an IP fragment, we don't
-		 * have the port information, and we use just the protocol
-		 * information.
+		 * Determine the type from the IP protocol value. If
+		 * classified as TCP or UDP, then update the read
+		 * pointer to the beginning of the IP header.
+		 * Otherwise leave the message as is for further
+		 * processing by DLS.
 		 */
 		switch (ipha->ipha_protocol) {
 		case IPPROTO_TCP:
@@ -1695,11 +1700,10 @@ mac_rx_srs_proto_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 int	fanout_unaligned = 0;
 
 /*
- * mac_rx_srs_long_fanout
- *
- * The fanout routine for VLANs, and for anything else that isn't performing
- * explicit dls bypass.  Returns -1 on an error (drop the packet due to a
- * malformed packet), 0 on success, with values written in *indx and *type.
+ * The fanout routine for any clients with DLS bypass disabled or for
+ * traffic classified as "other". Returns -1 on an error (drop the
+ * packet due to a malformed packet), 0 on success, with values
+ * written in *indx and *type.
  */
 static int
 mac_rx_srs_long_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *mp,
@@ -1865,16 +1869,15 @@ src_dst_based_fanout:
 }
 
 /*
- * mac_rx_srs_fanout
- *
- * This routine delivers packets destined to an SRS into a soft ring member
+ * This routine delivers packets destined for an SRS into a soft ring member
  * of the set.
  *
- * Given a chain of packets we need to split it up into multiple sub chains
- * destined for one of the TCP, UDP or OTH soft rings. Instead of entering
- * the soft ring one packet at a time, we want to enter it in the form of a
- * chain otherwise we get this start/stop behaviour where the worker thread
- * goes to sleep and then next packets comes in forcing it to wake up etc.
+ * Given a chain of packets we need to split it up into multiple sub
+ * chains: TCP, UDP or OTH soft ring. Instead of entering the soft
+ * ring one packet at a time, we want to enter it in the form of a
+ * chain otherwise we get this start/stop behaviour where the worker
+ * thread goes to sleep and then next packet comes in forcing it to
+ * wake up.
  *
  * Note:
  * Since we know what is the maximum fanout possible, we create a 2D array
@@ -1935,10 +1938,11 @@ mac_rx_srs_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 	    mac_srs->srs_ring->mr_classify_type == MAC_HW_CLASSIFIER;
 
 	/*
-	 * Special clients (eg. VLAN, non ether, etc) need DLS
-	 * processing in the Rx path. SRST_DLS_BYPASS will be clear for
-	 * such SRSs. Another way of disabling bypass is to set the
-	 * MCIS_RX_BYPASS_DISABLE flag.
+	 * Some clients, such as non Ethernet, need DLS processing in
+	 * the Rx path. Such clients clear the SRST_DLS_BYPASS flag.
+	 * DLS bypass may also be disabled via the
+	 * MCIS_RX_BYPASS_DISABLE flag, but this is only consumed by
+	 * sun4v vsw currently.
 	 */
 	dls_bypass = ((mac_srs->srs_type & SRST_DLS_BYPASS) != 0) &&
 	    ((mcip->mci_state_flags & MCIS_RX_BYPASS_DISABLE) == 0);
@@ -1960,7 +1964,7 @@ mac_rx_srs_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 
 	/*
 	 * We got a chain from SRS that we need to send to the soft rings.
-	 * Since squeues for TCP & IPv4 sap poll their soft rings (for
+	 * Since squeues for TCP & IPv4 SAP poll their soft rings (for
 	 * performance reasons), we need to separate out v4_tcp, v4_udp
 	 * and the rest goes in other.
 	 */
@@ -1990,9 +1994,14 @@ mac_rx_srs_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 				evhp = (struct ether_vlan_header *)mp->b_rptr;
 				sap = ntohs(evhp->ether_type);
 				hdrsize = sizeof (struct ether_vlan_header);
+
 				/*
-				 * Check if the VID of the packet, if any,
-				 * belongs to this client.
+				 * Check if the VID of the packet, if
+				 * any, belongs to this client.
+				 * Technically, if this packet came up
+				 * via a HW classified ring then we
+				 * don't need to perform this check.
+				 * Perhaps a future optimization.
 				 */
 				if (!mac_client_check_flow_vid(mcip,
 				    VLAN_ID(ntohs(evhp->ether_tci)))) {
@@ -2032,7 +2041,6 @@ mac_rx_srs_fanout(mac_soft_ring_set_t *mac_srs, mblk_t *head)
 			continue;
 		}
 
-
 		/*
 		 * If we are using the default Rx ring where H/W or S/W
 		 * classification has not happened, we need to verify if
@@ -2313,7 +2321,7 @@ check_again:
 				if (smcip->mci_mip->mi_promisc_list != NULL) {
 					mutex_exit(lock);
 					mac_promisc_dispatch(smcip->mci_mip,
-					    head, NULL);
+					    head, NULL, B_FALSE);
 					mutex_enter(lock);
 				}
 			}
@@ -2621,7 +2629,6 @@ again:
 
 	mac_srs->srs_state |= (SRS_PROC|proc_type);
 
-
 	/*
 	 * mcip is NULL for broadcast and multicast flows. The promisc
 	 * callbacks for broadcast and multicast packets are delivered from
@@ -2641,10 +2648,8 @@ again:
 	}
 
 	/*
-	 * Check if SRS itself is doing the processing
-	 * This direct path does not apply when subflows are present. In this
-	 * case, packets need to be dispatched to a soft ring according to the
-	 * flow's bandwidth and other resources contraints.
+	 * Check if SRS itself is doing the processing. This direct
+	 * path applies only when subflows are present.
 	 */
 	if (mac_srs->srs_type & SRST_NO_SOFT_RINGS) {
 		mac_direct_rx_t		proc;
@@ -4453,8 +4458,10 @@ mac_tx_send(mac_client_handle_t mch, mac_ring_handle_t ring, mblk_t *mp_chain,
 				 * check is done inside the MAC_TX()
 				 * macro.
 				 */
-				if (mip->mi_promisc_list != NULL)
-					mac_promisc_dispatch(mip, mp, src_mcip);
+				if (mip->mi_promisc_list != NULL) {
+					mac_promisc_dispatch(mip, mp, src_mcip,
+					    B_TRUE);
+				}
 
 				do_switch = ((src_mcip->mci_state_flags &
 				    dst_mcip->mci_state_flags &
@@ -4656,6 +4663,9 @@ mac_rx_deliver(void *arg1, mac_resource_handle_t mrh, mblk_t *mp_chain,
 		 * the packet to the promiscuous listeners of the
 		 * client, since they expect to see the whole
 		 * frame including the VLAN headers.
+		 *
+		 * The MCIS_STRIP_DISABLE is only issued when sun4v
+		 * vsw is in play.
 		 */
 		mp_chain = mac_strip_vlan_tag_chain(mp_chain);
 	}
@@ -4664,13 +4674,11 @@ mac_rx_deliver(void *arg1, mac_resource_handle_t mrh, mblk_t *mp_chain,
 }
 
 /*
- * mac_rx_soft_ring_process
- *
- * process a chain for a given soft ring. The number of packets queued
- * in the SRS and its associated soft rings (including this one) is
- * very small (tracked by srs_poll_pkt_cnt), then allow the entering
- * thread (interrupt or poll thread) to do inline processing. This
- * helps keep the latency down under low load.
+ * Process a chain for a given soft ring. If the number of packets
+ * queued in the SRS and its associated soft rings (including this
+ * one) is very small (tracked by srs_poll_pkt_cnt) then allow the
+ * entering thread (interrupt or poll thread) to process the chain
+ * inline. This is meant to reduce latency under low load.
  *
  * The proc and arg for each mblk is already stored in the mblk in
  * appropriate places.
@@ -4729,13 +4737,13 @@ mac_rx_soft_ring_process(mac_client_impl_t *mcip, mac_soft_ring_t *ringp,
 
 			ASSERT(MUTEX_NOT_HELD(&ringp->s_ring_lock));
 			/*
-			 * If we have a soft ring set which is doing
-			 * bandwidth control, we need to decrement
-			 * srs_size and count so it the SRS can have a
-			 * accurate idea of what is the real data
-			 * queued between SRS and its soft rings. We
-			 * decrement the counters only when the packet
-			 * gets processed by both SRS and the soft ring.
+			 * If we have an SRS performing bandwidth
+			 * control then we need to decrement the size
+			 * and count so the SRS has an accurate count
+			 * of the data queued between the SRS and its
+			 * soft rings. We decrement the counters only
+			 * when the packet is processed by both the
+			 * SRS and the soft ring.
 			 */
 			mutex_enter(&mac_srs->srs_lock);
 			MAC_UPDATE_SRS_COUNT_LOCKED(mac_srs, cnt);
@@ -4751,8 +4759,8 @@ mac_rx_soft_ring_process(mac_client_impl_t *mcip, mac_soft_ring_t *ringp,
 			if ((ringp->s_ring_first == NULL) ||
 			    (ringp->s_ring_state & S_RING_BLANK)) {
 				/*
-				 * We processed inline our packet and
-				 * nothing new has arrived or our
+				 * We processed a single packet inline
+				 * and nothing new has arrived or our
 				 * receiver doesn't want to receive
 				 * any packets. We are done.
 				 */
diff --git a/usr/src/uts/common/io/mac/mac_soft_ring.c b/usr/src/uts/common/io/mac/mac_soft_ring.c
index 2e056c8a2e..34f89328c3 100644
--- a/usr/src/uts/common/io/mac/mac_soft_ring.c
+++ b/usr/src/uts/common/io/mac/mac_soft_ring.c
@@ -21,7 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -207,7 +207,7 @@ mac_soft_ring_create(int id, clock_t wait, uint16_t type,
 		ringp->s_ring_tx_hiwat =
 		    (mac_tx_soft_ring_hiwat > mac_tx_soft_ring_max_q_cnt) ?
 		    mac_tx_soft_ring_max_q_cnt : mac_tx_soft_ring_hiwat;
-		if (mcip->mci_state_flags & MCIS_IS_AGGR) {
+		if (mcip->mci_state_flags & MCIS_IS_AGGR_CLIENT) {
 			mac_srs_tx_t *tx = &mac_srs->srs_tx;
 
 			ASSERT(tx->st_soft_rings[
@@ -339,15 +339,14 @@ mac_soft_ring_fire(void *arg)
 }
 
 /*
- * mac_rx_soft_ring_drain
+ * Drain the soft ring pointed to by ringp.
  *
- * Called when worker thread model (ST_RING_WORKER_ONLY) of processing
- * incoming packets is used. s_ring_first contain the queued packets.
- * s_ring_rx_func contains the upper level (client) routine where the
- * packets are destined and s_ring_rx_arg1/s_ring_rx_arg2 are the
- * cookie meant for the client.
+ *    o s_ring_first: pointer to the queued packet chain.
+ *
+ *    o s_ring_rx_func: pointer to to the client's Rx routine.
+ *
+ *    o s_ring_rx_{arg1,arg2}: opaque values specific to the client.
  */
-/* ARGSUSED */
 static void
 mac_rx_soft_ring_drain(mac_soft_ring_t *ringp)
 {
@@ -392,13 +391,12 @@ mac_rx_soft_ring_drain(mac_soft_ring_t *ringp)
 		(*proc)(arg1, arg2, mp, NULL);
 
 		/*
-		 * If we have a soft ring set which is doing
-		 * bandwidth control, we need to decrement its
-		 * srs_size so it can have a accurate idea of
-		 * what is the real data queued between SRS and
-		 * its soft rings. We decrement the size for a
-		 * packet only when it gets processed by both
-		 * SRS and the soft ring.
+		 * If we have an SRS performing bandwidth control, then
+		 * we need to decrement the size and count so the SRS
+		 * has an accurate measure of the data queued between
+		 * the SRS and its soft rings. We decrement the
+		 * counters only when the packet is processed by both
+		 * the SRS and the soft ring.
 		 */
 		mutex_enter(&mac_srs->srs_lock);
 		MAC_UPDATE_SRS_COUNT_LOCKED(mac_srs, cnt);
@@ -414,12 +412,10 @@ mac_rx_soft_ring_drain(mac_soft_ring_t *ringp)
 }
 
 /*
- * mac_soft_ring_worker
- *
  * The soft ring worker routine to process any queued packets. In
- * normal case, the worker thread is bound to a CPU. It the soft
- * ring is dealing with TCP packets, then the worker thread will
- * be bound to the same CPU as the TCP squeue.
+ * normal case, the worker thread is bound to a CPU. If the soft ring
+ * handles TCP packets then the worker thread is bound to the same CPU
+ * as the TCP squeue.
  */
 static void
 mac_soft_ring_worker(mac_soft_ring_t *ringp)
@@ -604,7 +600,7 @@ mac_soft_ring_dls_bypass(void *arg, mac_direct_rx_t rx_func, void *rx_arg1)
 	mac_soft_ring_t		*softring = arg;
 	mac_soft_ring_set_t	*srs;
 
-	ASSERT(rx_func != NULL);
+	VERIFY3P(rx_func, !=, NULL);
 
 	mutex_enter(&softring->s_ring_lock);
 	softring->s_ring_rx_func = rx_func;
diff --git a/usr/src/uts/common/io/mac/mac_stat.c b/usr/src/uts/common/io/mac/mac_stat.c
index 31972f94d8..2244218f20 100644
--- a/usr/src/uts/common/io/mac/mac_stat.c
+++ b/usr/src/uts/common/io/mac/mac_stat.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -390,8 +391,8 @@ i_mac_stat_create(void *handle, const char *modname, const char *statname,
 	kstat_t		*ksp;
 	kstat_named_t	*knp;
 
-	ksp = kstat_create(modname, 0, statname, "net",
-	    KSTAT_TYPE_NAMED, count, 0);
+	ksp = kstat_create_zone(modname, 0, statname, "net",
+	    KSTAT_TYPE_NAMED, count, 0, getzoneid());
 
 	if (ksp == NULL)
 		return (NULL);
@@ -948,9 +949,9 @@ mac_driver_stat_create(mac_impl_t *mip)
 	major_t		major = getmajor(mip->mi_phy_dev);
 
 	count = MAC_MOD_NKSTAT + MAC_NKSTAT + mip->mi_type->mt_statcount;
-	ksp = kstat_create((const char *)ddi_major_to_name(major),
+	ksp = kstat_create_zone((const char *)ddi_major_to_name(major),
 	    getminor(mip->mi_phy_dev) - 1, MAC_KSTAT_NAME,
-	    MAC_KSTAT_CLASS, KSTAT_TYPE_NAMED, count, 0);
+	    MAC_KSTAT_CLASS, KSTAT_TYPE_NAMED, count, 0, getzoneid());
 	if (ksp == NULL)
 		return;
 
@@ -1003,6 +1004,7 @@ void
 mac_ring_stat_create(mac_ring_t *ring)
 {
 	mac_impl_t	*mip = ring->mr_mip;
+	mac_group_t	*grp = (mac_group_t *)ring->mr_gh;
 	char		statname[MAXNAMELEN];
 	char		modname[MAXNAMELEN];
 
@@ -1014,8 +1016,8 @@ mac_ring_stat_create(mac_ring_t *ring)
 
 	switch (ring->mr_type) {
 	case MAC_RING_TYPE_RX:
-		(void) snprintf(statname, sizeof (statname), "mac_rx_ring%d",
-		    ring->mr_index);
+		(void) snprintf(statname, sizeof (statname),
+		    "mac_rx_ring_%d_%d", grp->mrg_index, ring->mr_index);
 		i_mac_rx_ring_stat_create(ring, modname, statname);
 		break;
 
diff --git a/usr/src/uts/common/io/mac/mac_util.c b/usr/src/uts/common/io/mac/mac_util.c
index e83af37f16..a877ca258c 100644
--- a/usr/src/uts/common/io/mac/mac_util.c
+++ b/usr/src/uts/common/io/mac/mac_util.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -55,15 +56,12 @@ static mblk_t *
 mac_copymsg_cksum(mblk_t *mp)
 {
 	mblk_t *mp1;
-	uint32_t start, stuff, end, value, flags;
 
 	mp1 = copymsg(mp);
 	if (mp1 == NULL)
 		return (NULL);
 
-	hcksum_retrieve(mp, NULL, NULL, &start, &stuff, &end, &value, &flags);
-	(void) hcksum_assoc(mp1, NULL, NULL, start, stuff, end, value,
-	    flags, KM_NOSLEEP);
+	mac_hcksum_clone(mp, mp1);
 
 	return (mp1);
 }
@@ -107,9 +105,9 @@ mac_fix_cksum(mblk_t *mp_chain)
 		uint32_t offset;
 		struct ether_header *ehp;
 		uint16_t sap;
+		mblk_t *skipped_hdr = NULL;
 
-		hcksum_retrieve(mp, NULL, NULL, &start, &stuff, &end, &value,
-		    &flags);
+		mac_hcksum_get(mp, &start, &stuff, &end, &value, &flags);
 		if (flags == 0)
 			continue;
 
@@ -150,6 +148,12 @@ mac_fix_cksum(mblk_t *mp_chain)
 			offset = sizeof (struct ether_header);
 		}
 
+		/*
+		 * If the first mblk in the chain for this packet contains only
+		 * the ethernet header, skip past it for now.  Packets with
+		 * their data contained in only a single mblk can then use the
+		 * fastpaths tuned to that possibility.
+		 */
 		if (MBLKL(mp) <= offset) {
 			offset -= MBLKL(mp);
 			if (mp->b_cont == NULL) {
@@ -164,6 +168,7 @@ mac_fix_cksum(mblk_t *mp_chain)
 				mp = mp1;
 				continue;
 			}
+			skipped_hdr = mp;
 			mp = mp->b_cont;
 		}
 
@@ -266,21 +271,17 @@ mac_fix_cksum(mblk_t *mp_chain)
 		if (flags & HCK_PARTIALCKSUM) {
 			uint16_t *up, partial, cksum;
 			uchar_t *ipp; /* ptr to beginning of IP header */
+			mblk_t *old_mp = NULL;
 
 			if (mp->b_cont != NULL) {
-				mblk_t *mp1;
+				mblk_t *new_mp;
 
-				mp1 = msgpullup(mp, offset + end);
-				if (mp1 == NULL)
+				new_mp = msgpullup(mp, offset + end);
+				if (new_mp == NULL) {
 					continue;
-				mp1->b_next = mp->b_next;
-				mp->b_next = NULL;
-				freemsg(mp);
-				if (prev != NULL)
-					prev->b_next = mp1;
-				else
-					new_chain = mp1;
-				mp = mp1;
+				}
+				old_mp = mp;
+				mp = new_mp;
 			}
 
 			ipp = mp->b_rptr + offset;
@@ -302,10 +303,57 @@ mac_fix_cksum(mblk_t *mp_chain)
 			flags &= ~HCK_PARTIALCKSUM;
 			flags |= HCK_FULLCKSUM_OK;
 			value = 0;
+
+			/*
+			 * If 'mp' is the result of a msgpullup(), it needs to
+			 * be properly reattached into the existing chain of
+			 * messages before continuing.
+			 */
+			if (old_mp != NULL) {
+				if (skipped_hdr != NULL) {
+					/*
+					 * If the ethernet header was cast
+					 * aside before checksum calculation,
+					 * prepare for it to be reattached to
+					 * the pulled-up mblk.
+					 */
+					skipped_hdr->b_cont = mp;
+				} else {
+					/* Link the new mblk into the chain. */
+					mp->b_next = old_mp->b_next;
+
+					if (prev != NULL)
+						prev->b_next = mp;
+					else
+						new_chain = mp;
+				}
+
+				old_mp->b_next = NULL;
+				freemsg(old_mp);
+			}
 		}
 
-		(void) hcksum_assoc(mp, NULL, NULL, start, stuff, end,
-		    value, flags, KM_NOSLEEP);
+		mac_hcksum_set(mp, start, stuff, end, value, flags);
+
+		/*
+		 * If the header was skipped over, we must seek back to it,
+		 * since it is that mblk that is part of any packet chain.
+		 */
+		if (skipped_hdr != NULL) {
+			ASSERT3P(skipped_hdr->b_cont, ==, mp);
+
+			/*
+			 * Duplicate the HCKSUM data into the header mblk.
+			 * This mimics mac_add_vlan_tag which ensures that both
+			 * the first mblk _and_ the first data bearing mblk
+			 * possess the HCKSUM information.  Consumers like IP
+			 * will end up discarding the ether_header mblk, so for
+			 * now, it is important that the data be available in
+			 * both places.
+			 */
+			mac_hcksum_clone(mp, skipped_hdr);
+			mp = skipped_hdr;
+		}
 	}
 
 	return (new_chain);
@@ -320,7 +368,6 @@ mac_add_vlan_tag(mblk_t *mp, uint_t pri, uint16_t vid)
 	mblk_t *hmp;
 	struct ether_vlan_header *evhp;
 	struct ether_header *ehp;
-	uint32_t start, stuff, end, value, flags;
 
 	ASSERT(pri != 0 || vid != 0);
 
@@ -350,9 +397,7 @@ mac_add_vlan_tag(mblk_t *mp, uint_t pri, uint16_t vid)
 	 * Free the original message if it's now empty. Link the
 	 * rest of messages to the header message.
 	 */
-	hcksum_retrieve(mp, NULL, NULL, &start, &stuff, &end, &value, &flags);
-	(void) hcksum_assoc(hmp, NULL, NULL, start, stuff, end, value, flags,
-	    KM_NOSLEEP);
+	mac_hcksum_clone(mp, hmp);
 	if (MBLKL(mp) == 0) {
 		hmp->b_cont = mp->b_cont;
 		freeb(mp);
diff --git a/usr/src/uts/common/io/mem.c b/usr/src/uts/common/io/mem.c
index 950fab1272..fcea4a8f03 100644
--- a/usr/src/uts/common/io/mem.c
+++ b/usr/src/uts/common/io/mem.c
@@ -225,10 +225,19 @@ mmopen(dev_t *devp, int flag, int typ, struct cred *cred)
 	case M_NULL:
 	case M_ZERO:
 	case M_FULL:
+		/* standard devices */
+		break;
+
 	case M_MEM:
 	case M_KMEM:
 	case M_ALLKMEM:
-		/* standard devices */
+		/*
+		 * These devices should never be visible in a zone, but if they
+		 * somehow do get created we refuse to allow the zone to use
+		 * them.
+		 */
+		if (crgetzoneid(cred) != GLOBAL_ZONEID)
+			return (EACCES);
 		break;
 
 	default:
diff --git a/usr/src/uts/common/io/mr_sas/mr_sas.conf b/usr/src/uts/common/io/mr_sas/mr_sas.conf
index cfda434e23..6c585c6a42 100644
--- a/usr/src/uts/common/io/mr_sas/mr_sas.conf
+++ b/usr/src/uts/common/io/mr_sas/mr_sas.conf
@@ -13,3 +13,11 @@
 # Fast-Path specific flag. Default is "yes".
 # mrsas-enable-fp="yes";
 
+flow_control="dmult" queue="qsort" tape="sctp";
+
+# MSI specific flag. To enable MSI modify the flag value to "yes"
+mrsas-enable-msi="yes";
+
+# Fast-Path specific flag. To enable Fast-Path modify the flag value to "yes"
+mrsas-enable-fp="yes";
+
diff --git a/usr/src/uts/common/io/nfp/THIRDPARTYLICENSE b/usr/src/uts/common/io/nfp/THIRDPARTYLICENSE
new file mode 100644
index 0000000000..187088ff34
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/THIRDPARTYLICENSE
@@ -0,0 +1,19 @@
+Copyright (c) 2014, Thales UK Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/usr/src/uts/common/io/nfp/THIRDPARTYLICENSE.descrip b/usr/src/uts/common/io/nfp/THIRDPARTYLICENSE.descrip
new file mode 100644
index 0000000000..cde8b65b37
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/THIRDPARTYLICENSE.descrip
@@ -0,0 +1 @@
+NFAST CRYPTO ACCELERATOR DRIVER
diff --git a/usr/src/uts/common/io/nfp/autoversion.h b/usr/src/uts/common/io/nfp/autoversion.h
new file mode 100644
index 0000000000..b9021942b2
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/autoversion.h
@@ -0,0 +1,21 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+/* AUTOGENERATED - DO NOT EDIT */
+#ifndef AUTOVERSION_H
+#define AUTOVERSION_H
+
+#define VERSION_RELEASEMAJOR 2
+#define VERSION_RELEASEMINOR 26
+#define VERSION_RELEASEPATCH 40
+#define VERSION_NO "2.26.40cam999"
+#define VERSION_COMPNAME "nfdrv"
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/drvlist.c b/usr/src/uts/common/io/nfp/drvlist.c
new file mode 100644
index 0000000000..a04b1fd5b0
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/drvlist.c
@@ -0,0 +1,19 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+#include "nfp_common.h"
+#include "nfp_cmd.h"
+
+const nfpcmd_dev *nfp_drvlist[] = {
+  &i21285_cmddev,
+  &i21555_cmddev,
+  NULL
+};
+
diff --git a/usr/src/uts/common/io/nfp/hostif.c b/usr/src/uts/common/io/nfp/hostif.c
new file mode 100644
index 0000000000..684be703ea
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/hostif.c
@@ -0,0 +1,1192 @@
+/*
+
+hostif.c: nFast PCI driver for Solaris 2.5, 2.6, 2.7 and 2.8
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+06/05/1998 jsh  Original solaris 2.6
+21/05/1999 jsh  added support for solaris 2.5
+10/06/1999 jsh  added support for solaris 2.7 (32 and 64 bit)
+??/??/2001 jsh  added support for solaris 2.8 (32 and 64 bit)
+16/10/2001 jsh  moved from nfast to new structure in nfdrv
+12/02/2002 jsh  added high level interrupt support
+
+*/
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/conf.h>
+#include <sys/uio.h>
+#include <sys/map.h>
+#include <sys/debug.h>
+#include <sys/modctl.h>
+#include <sys/kmem.h>
+#include <sys/cmn_err.h>
+#include <sys/open.h>
+#include <sys/stat.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/pci.h>
+
+#include "nfp_common.h"
+#include "nfp_hostif.h"
+#include "nfp_osif.h"
+#include "nfp_cmd.h"
+
+#include "nfp.h"
+
+/* mapped memory attributes, no-swap endianess (done in higher level) */
+static struct ddi_device_acc_attr nosw_attr = {
+  DDI_DEVICE_ATTR_V0,
+  DDI_NEVERSWAP_ACC,
+  DDI_STRICTORDER_ACC
+};
+
+/* dma attributes */
+static ddi_dma_attr_t dma_attrs = {
+  DMA_ATTR_V0,            /* version number */
+  (uint64_t)0x0,          /* low address */
+  (uint64_t)0xffffffff,   /* high address */
+  (uint64_t)0xffffff,     /* DMA counter max */
+  (uint64_t)0x1,          /* alignment */
+  0x0c,                   /* burst sizes */
+  0x1,                    /* minimum transfer size */
+  (uint64_t)0x3ffffff,    /* maximum transfer size */
+  (uint64_t)0x7fff,       /* maximum segment size */
+  1,                      /* no scatter/gather lists */
+  1,                      /* granularity */
+  0                       /* DMA flags */
+};
+
+/*
+ * Debug message control
+ * Debug Levels:
+ *  0 = no messages
+ *  1 = Errors
+ *  2 = Subroutine calls & control flow
+ *  3 = I/O Data (verbose!)
+ * Can be set with adb or in the /etc/system file with
+ * "set nfp:nfp_debug=<value>"
+ */
+
+int nfp_debug= 1;
+
+static void *state_head; /* opaque handle top of state structs */
+
+static int nfp_open(dev_t *dev, int openflags, int otyp, cred_t *credp);
+static int nfp_close(dev_t dev, int openflags, int otyp, cred_t *credp);
+static int nfp_release_dev( dev_info_t *dip );
+
+static int nfp_read(dev_t dev, struct uio *uiop, cred_t *credp);
+static int nfp_write(dev_t dev, struct uio *uiop, cred_t *credp);
+static int nfp_strategy(struct buf *bp);
+
+static int nfp_ioctl(dev_t dev, int cmd, ioctlptr_t arg, int mode, cred_t *credp, int *rvalp);
+static int nfp_chpoll(dev_t dev, short events, int anyyet, short *reventsp,
+                    struct pollhead **phpp);
+
+static void nfp_wrtimeout (void *pdev);
+static void nfp_rdtimeout (void *pdev);
+
+static int nfp_getinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result);
+static int nfp_attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
+static int nfp_detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
+
+static void nfp_read_complete_final(nfp_dev *pdev, int ok);
+static void nfp_write_complete_final(nfp_dev *pdev, int ok);
+
+/* nfp file ops --------------------------------------------------- */
+
+static struct cb_ops nfp_cb_ops = {
+  nfp_open,
+  nfp_close,
+  nodev,                /* no nfp_strategy */
+  nodev,                /* no print routine */
+  nodev,                /* no dump routine */
+  nfp_read,
+  nfp_write,
+  nfp_ioctl,
+  nodev,                /* no devmap routine */
+  nodev,                /* no mmap routine */
+  nodev,                /* no segmap routine */
+  nfp_chpoll,
+  ddi_prop_op,
+  0,            /* not a STREAMS driver, no cb_str routine */
+  D_NEW | D_MP | EXTRA_CB_FLAGS, /* must be safe for multi-thread/multi-processor */
+  CB_REV,
+  nodev,                /* aread */
+  nodev                 /* awrite */
+};
+
+static struct dev_ops nfp_ops = {
+  DEVO_REV,               /* DEVO_REV indicated by manual */
+  0,                      /* device reference count       */
+  nfp_getinfo,
+  nulldev,                /* identify */
+  nulldev,                /* probe */
+  nfp_attach,
+  nfp_detach,
+  nodev,                  /* device reset routine         */
+  &nfp_cb_ops,
+  (struct bus_ops *)0,    /* bus operations               */
+};
+
+extern struct mod_ops mod_driverops;
+static struct modldrv modldrv = {
+  &mod_driverops,
+  NFP_DRVNAME,
+  &nfp_ops,
+};
+
+static struct modlinkage modlinkage = {
+  MODREV_1,               /* MODREV_1 indicated by manual */
+  (void *)&modldrv,
+  NULL,                   /* termination of list of linkage structures */
+};
+
+/* interface resource allocation */
+
+int nfp_alloc_pci_push( nfp_dev *pdev ) {
+  /* allocate resources needed for PCI Push,
+   * if not already allocated.
+   * return True if successful
+   */
+  nfp_err ret;
+  uint_t cookie_count;
+	size_t real_length;
+
+  if(!pdev->read_buf) {
+    /* allocate read buffer */
+    pdev->read_buf = kmem_zalloc( NFP_READBUF_SIZE, KM_NOSLEEP );
+  }
+  if(!pdev->read_buf) {
+    nfp_log( NFP_DBG1, "nfp_attach: kmem_zalloc read buffer failed");
+    pdev->read_buf = NULL;
+    return 0;
+  }
+
+  if(!pdev->rd_dma_ok) {
+    /* allocate dma handle for read buffer */
+    ret = ddi_dma_alloc_handle( pdev->dip,
+                                &dma_attrs,
+                                DDI_DMA_DONTWAIT,
+                                NULL,
+                                &pdev->read_dma_handle );
+    if( ret != DDI_SUCCESS ) {
+      nfp_log( NFP_DBG1,
+               "nfp_alloc_pci_push: ddi_dma_alloc_handle failed (%d)",
+               ret );
+      return 0;
+    }
+
+    /* Allocate the memory for dma transfers */
+    ret = ddi_dma_mem_alloc(pdev->read_dma_handle, NFP_READBUF_SIZE, &nosw_attr,
+			    DDI_DMA_CONSISTENT, DDI_DMA_DONTWAIT, NULL,
+			    (caddr_t*)&pdev->read_buf, &real_length, &pdev->acchandle);
+    if (ret != DDI_SUCCESS) {
+      nfp_log( NFP_DBG1, "nfp_alloc_pci_push: ddi_dma_mem_alloc failed (%d)", ret);
+      ddi_dma_free_handle( &pdev->read_dma_handle );
+      return 0;
+    }
+
+    ret = ddi_dma_addr_bind_handle( pdev->read_dma_handle,
+                                    NULL, /* kernel address space */
+                                    (caddr_t)pdev->read_buf, real_length,
+                                    DDI_DMA_READ | DDI_DMA_CONSISTENT, /* dma flags */
+                                    DDI_DMA_DONTWAIT, NULL,
+                                    &pdev->read_dma_cookie, &cookie_count );
+    if( ret != DDI_DMA_MAPPED ) {
+      nfp_log( NFP_DBG1,
+               "nfp_alloc_pci_push: ddi_dma_addr_bind_handle failed (%d)",
+               ret);
+      ddi_dma_mem_free(&pdev->acchandle);
+      ddi_dma_free_handle( &pdev->read_dma_handle );
+      return 0;
+    }
+    if( cookie_count > 1 ) {
+      nfp_log( NFP_DBG1,
+               "nfp_alloc_pci_push: error:"
+               " ddi_dma_addr_bind_handle wants %d transfers",
+               cookie_count);
+      ddi_dma_mem_free(&pdev->acchandle);
+      (void) ddi_dma_unbind_handle( pdev->read_dma_handle );
+      ddi_dma_free_handle( &pdev->read_dma_handle );
+      return 0;
+    }
+    pdev->rd_dma_ok = 1;
+  }
+  return pdev->rd_dma_ok;
+}
+
+void nfp_free_pci_push( nfp_dev *pdev ) {
+  /* free resources allocated to PCI Push */
+  if( pdev->rd_dma_ok ) {
+    (void) ddi_dma_sync(pdev->read_dma_handle,0,0,DDI_DMA_SYNC_FORKERNEL);
+    ddi_dma_mem_free(&pdev->acchandle);
+    (void) ddi_dma_unbind_handle( pdev->read_dma_handle );
+    ddi_dma_free_handle( &pdev->read_dma_handle );
+    pdev->rd_dma_ok = 0;
+  }
+  if( pdev->read_buf ) {
+    kmem_free( pdev->read_buf, NFP_READBUF_SIZE );
+    pdev->read_buf = NULL;
+  }
+}
+
+/* include definition of nfp_set_ifvers() */
+#define nfp_ifvers NFDEV_IF_PCI_PUSH
+#include "nfp_ifvers.c"
+#undef nfp_ifvers
+
+/*--------------------*/
+/*  nfp_isr           */
+/*--------------------*/
+
+static u_int nfp_isr( char *pdev_in ) {
+  /* LINTED: alignment */
+  nfp_dev *pdev= (nfp_dev *)pdev_in;
+  nfp_err ne;
+  int handled;
+
+  nfp_log( NFP_DBG3, "nfp_isr: entered");
+
+  if( !pdev ) {
+    nfp_log( NFP_DBG1, "nfp_isr: cannot find dev");
+    return DDI_INTR_UNCLAIMED;
+  }
+
+  /* The isr needs to be mutex'ed - an SMP can call us while we're still
+   * running!
+   */
+  mutex_enter(&pdev->low_mutex);
+  ne= pdev->cmddev->isr( pdev->common.cmdctx, &handled );
+  mutex_exit(&pdev->low_mutex);
+
+  if( !ne && handled )
+    return DDI_INTR_CLAIMED;
+  if (ne)
+    nfp_log( NFP_DBG1, "nfp_isr: failed");
+  else
+    nfp_log( NFP_DBG3, "nfp_isr: unclaimed");
+  return DDI_INTR_UNCLAIMED;
+}
+
+static u_int nfp_soft_isr( char *pdev_in ) {
+  /* LINTED: alignment */
+  nfp_dev *pdev= (nfp_dev *)pdev_in;
+  int rd, wr;
+
+  nfp_log( NFP_DBG3, "nfp_soft_isr: entered");
+
+  if( !pdev ) {
+    nfp_log( NFP_DBG1, "nfp_soft_isr: cannot find dev");
+    return DDI_INTR_UNCLAIMED;
+  }
+  rd= wr= 0;
+  
+  mutex_enter(&pdev->high_mutex);
+  if(pdev->high_read) {
+    pdev->high_read= 0;
+    mutex_exit(&pdev->high_mutex);
+    rd= 1;
+  }
+  if(pdev->high_write) {
+    pdev->high_write= 0;
+    wr= 1;
+  }
+  mutex_exit(&pdev->high_mutex);
+
+  if(rd) {
+    nfp_log( NFP_DBG3, "nfp_soft_isr: read done");
+    nfp_read_complete_final(pdev, pdev->rd_ok);
+  }
+  if(wr) {
+    nfp_log( NFP_DBG3, "nfp_soft_isr: write done");
+    nfp_write_complete_final(pdev, pdev->wr_ok);
+  }
+  if( rd || wr )
+    return DDI_INTR_CLAIMED;
+
+  nfp_log( NFP_DBG2, "nfp_isr: unclaimed");
+  return DDI_INTR_UNCLAIMED;
+}
+
+
+/*-------------------------*/
+/*  nfp_read               */
+/*-------------------------*/
+
+void nfp_read_complete(nfp_dev *pdev, int ok) {
+  nfp_log( NFP_DBG2,"nfp_read_complete: entering");
+
+  if(pdev->high_intr) {
+    nfp_log(NFP_DBG2, "nfp_read_complete: high_intr");
+    mutex_enter(&pdev->high_mutex);
+    nfp_log(NFP_DBG3, "nfp_read_complete: high_mutex entered");
+    if(pdev->high_read)
+      nfp_log(NFP_DBG1, "nfp_read_complete: high_read allread set!");
+    pdev->high_read= 1;
+    pdev->rd_ok= ok;
+    nfp_log(NFP_DBG3, "nfp_read_complete: exiting high_mutex");
+    mutex_exit(&pdev->high_mutex);
+    ddi_trigger_softintr(pdev->soft_int_id);
+  } else
+    nfp_read_complete_final( pdev, ok );
+  nfp_log( NFP_DBG2,"nfp_read_complete: exiting");
+}
+
+static void nfp_read_complete_final(nfp_dev *pdev, int ok) {
+  nfp_log( NFP_DBG2,"nfp_read_complete_final: entering");
+  if(pdev->rdtimeout)
+    (void) untimeout(pdev->rdtimeout);
+  if(!pdev->rd_outstanding) {
+    nfp_log( NFP_DBG1,"nfp_read_complete_final: !pdev->rd_outstanding");
+  }
+  nfp_log( NFP_DBG2,"nfp_read_complete_final: pdev->rd_outstanding=0, ok %d", ok);
+  mutex_enter(&pdev->isr_mutex);
+  pdev->rd_outstanding= 0;
+  pdev->rd_ready= 1;
+  pdev->rd_ok= ok;
+  cv_broadcast(&pdev->rd_cv);
+  mutex_exit(&pdev->isr_mutex);
+  pollwakeup (&pdev->pollhead, POLLRDNORM);
+  nfp_log( NFP_DBG2,"nfp_read_complete_final: exiting");
+}
+
+static void nfp_rdtimeout( void *pdev_in )
+{
+  nfp_dev *pdev= (nfp_dev *)pdev_in;
+
+  nfp_log( NFP_DBG1, "nfp_rdtimeout: read timed out");
+
+  if (!pdev) {
+    nfp_log( NFP_DBG1, "nfp_rdtimeout: NULL pdev." );
+    return;
+  }
+  pdev->rdtimeout= 0;
+  nfp_read_complete_final(pdev, 0);
+}
+
+/* ARGSUSED */
+static int nfp_read(dev_t dev, struct uio *uiop, cred_t *credp) {
+  int ret;
+  nfp_log( NFP_DBG2, "nfp_read: entered" );
+  if (ddi_get_soft_state(state_head, getminor(dev)) != NULL) {
+    nfp_log( NFP_DBG1, "nfp_read: unable to get nfp_dev");
+    return (ENODEV);
+  }
+  nfp_log( NFP_DBG2, "nfp_read: about to physio." );
+  ret = physio(nfp_strategy, (struct buf *)0, dev, B_READ, minphys, uiop );
+  if(ret)
+    nfp_log( NFP_DBG1, "nfp_read: physio returned %x.", ret );
+  return ret;
+}
+
+/*-------------------------*/
+/*  nfp_write              */
+/*-------------------------*/
+
+void nfp_write_complete( nfp_dev *pdev, int ok) {
+  nfp_log( NFP_DBG2,"nfp_write_complete: entering");
+
+  if(pdev->high_intr) {
+    mutex_enter(&pdev->high_mutex);
+    if(pdev->high_write)
+      nfp_log(NFP_DBG1, "nfp_write_complete: high_write allread set!");
+    pdev->high_write= 1;
+    pdev->wr_ok= ok;
+    mutex_exit(&pdev->high_mutex);
+    ddi_trigger_softintr(pdev->soft_int_id);
+  } else
+    nfp_write_complete_final( pdev, ok );
+  nfp_log( NFP_DBG2,"nfp_write_complete: exiting");
+}
+
+static void nfp_write_complete_final( nfp_dev *pdev, int ok) {
+  struct buf *local_wr_bp;
+  nfp_log( NFP_DBG2,"nfp_write_complete_final: entering");
+  if(pdev->wrtimeout)
+    (void) untimeout(pdev->wrtimeout);
+
+  if (!pdev->wr_bp) {
+    nfp_log( NFP_DBG2, "nfp_write_complete_final: write: wr_bp == NULL." );
+    return;
+  }
+
+  bp_mapout(pdev->wr_bp);
+  pdev->wr_bp->b_resid = ok ? 0 : pdev->wr_bp->b_bcount;
+  /* Make sure we set wr_ready before calling biodone to avoid a race */
+  pdev->wr_ready = 1;
+  bioerror(pdev->wr_bp, ok ? 0 : ENXIO);
+  local_wr_bp = pdev->wr_bp;
+  pdev->wr_bp = 0;
+  biodone(local_wr_bp);
+  nfp_log( NFP_DBG2, "nfp_write_complete_final: isr_mutex extited");
+  pollwakeup (&pdev->pollhead, POLLWRNORM);
+
+  nfp_log( NFP_DBG2, "nfp_write_complete_final: leaving");
+}
+
+static void nfp_wrtimeout( void *pdev_in )
+{
+  nfp_dev *pdev= (nfp_dev *)pdev_in;
+
+  nfp_log( NFP_DBG1, "nfp_wrtimeout: write timed out");
+
+  if (!pdev) {
+    nfp_log( NFP_DBG1, "nfp_wrtimeout: NULL pdev." );
+    return;
+  }
+  pdev->wrtimeout= 0;
+  nfp_write_complete_final(pdev, 0);
+}
+
+/* ARGSUSED */
+static int nfp_write(dev_t dev, struct uio *uiop, cred_t *credp) {
+  int ret;
+  nfp_log( NFP_DBG2, "nfp_write: entered." );
+  if (ddi_get_soft_state(state_head, getminor(dev)) == NULL) {
+    nfp_log( NFP_DBG1, "nfp_chread: unable to get nfp_dev.");
+    return (ENODEV);
+  }
+  nfp_log( NFP_DBG2, "nfp_write: about to physio." );
+  ret = physio(nfp_strategy, (struct buf *)0, dev, B_WRITE, minphys, uiop );
+  if(ret)
+    nfp_log( NFP_DBG1, "nfp_write: physio returned %x.", ret );
+  return ret;
+}
+
+/*-------------------------*/
+/*  nfp_strategy           */
+/*-------------------------*/
+
+#define NFP_STRAT_ERR(thebp,err,txt) \
+      nfp_log( NFP_DBG1, "nfp_strategy: " txt ".\n"); \
+      (thebp)->b_resid = (thebp)->b_bcount; \
+      bioerror ((thebp), err); \
+      biodone ((thebp));
+
+static int nfp_strategy(struct buf *bp) {
+  register struct nfp_dev *pdev;
+  nfp_err ne;
+  
+  nfp_log( NFP_DBG2, "nfp_strategy: entered." );
+  if (!(pdev = ddi_get_soft_state(state_head, getminor(bp->b_edev)))) {
+    NFP_STRAT_ERR (bp, ENXIO, "unable to get nfp_dev");
+    return (0);
+  }
+
+  if (bp->b_flags & B_READ) {
+    int count;
+    /* read */
+    if (!pdev->rd_ready) {
+      NFP_STRAT_ERR (bp,ENXIO,"read called when not ready");
+      return (0);
+    }
+    pdev->rd_ready=0;
+    pdev->rd_pending = 0;
+    if( !pdev->rd_ok) {
+      NFP_STRAT_ERR (bp,ENXIO,"read failed");
+      return (0);
+    }
+    /* copy data from module */
+    if(pdev->ifvers >= NFDEV_IF_PCI_PUSH) {
+      nfp_log( NFP_DBG3, "nfp_strategy: copying kernel read buffer");
+      if( ddi_dma_sync(pdev->read_dma_handle,0,0,DDI_DMA_SYNC_FORKERNEL) != DDI_SUCCESS )
+      {
+        NFP_STRAT_ERR(bp,ENXIO,"ddi_dma_sync(read_dma_handle) failed");
+        return (0);
+      }
+      /* LINTED: alignment */
+      count= *(unsigned int *)(pdev->read_buf+4);
+      count= FROM_LE32_MEM(&count);
+      nfp_log( NFP_DBG3, "nfp_strategy: read count %d", count);
+      if(count<0 || count>bp->b_bcount) {
+        NFP_STRAT_ERR(bp,ENXIO,"bad read byte count from device");
+        nfp_log( NFP_DBG1, "nfp_strategy: bad read byte count (%d) from device", count);
+        return (0);
+      }
+      bp_mapin (bp);
+      bcopy( pdev->read_buf + 8, bp->b_un.b_addr, count );
+      bp_mapout (bp);
+    } else {
+      bp_mapin (bp);
+      ne=  pdev->cmddev->read_block( bp->b_un.b_addr, bp->b_bcount, pdev->common.cmdctx, &count );
+      bp_mapout (bp);
+      if( ne != NFP_SUCCESS) {
+        NFP_STRAT_ERR (bp,nfp_oserr(ne),"read_block failed");
+        return (0);
+      }
+    }
+    bioerror(bp, 0);
+    bp->b_resid = 0;
+    biodone (bp);
+  } else {
+    /* write */
+    if (!pdev->wr_ready) {
+      NFP_STRAT_ERR (bp,ENXIO,"write called when not ready");
+      return (0);
+    }
+    if (pdev->wr_bp) {
+      NFP_STRAT_ERR (bp,ENXIO,"wr_bp != NULL");
+      return (0);
+    }
+    pdev->wrtimeout= timeout(nfp_wrtimeout, (caddr_t)pdev, NFP_TIMEOUT_SEC * drv_usectohz(1000000));
+    pdev->wr_bp = bp;
+    pdev->wr_ready = 0;
+    bp_mapin (bp);
+    ne= pdev->cmddev->write_block( bp->b_un.b_addr, bp->b_bcount,  pdev->common.cmdctx);
+    if( ne != NFP_SUCCESS ) {
+      bp_mapout (bp);
+      (void) untimeout(pdev->wrtimeout);
+      pdev->wr_bp = 0;
+      pdev->wr_ready = 1;
+      NFP_STRAT_ERR (bp,nfp_oserr(ne),"write failed");
+      return (0);
+    }
+  }
+  nfp_log( NFP_DBG2, "nfp_strategy: leaving");
+
+  return (0);
+}
+
+
+/*--------------------*/
+/*  poll / select     */
+/*--------------------*/
+
+static int nfp_chpoll(dev_t dev, short events, int anyyet, short *reventsp,
+                      struct pollhead **phpp) {
+  nfp_dev *pdev;
+  short revents;
+
+  if (!(pdev = ddi_get_soft_state(state_head, getminor(dev)))) {
+    nfp_log( NFP_DBG1, "nfp_chpoll: unable to get nfp_dev");
+    *reventsp=0;
+    return (0);
+  }
+  nfp_log( NFP_DBG2, "nfp_chpoll: entered %x", events);
+
+  revents=0;
+  if (events&POLLWRNORM) {
+    if (pdev->wr_ready) {
+      nfp_log( NFP_DBG2, "nfp_chpoll: write ready");
+      revents|=POLLWRNORM;
+    }
+  }
+
+  if (events&POLLRDNORM) {
+    if (pdev->rd_ready) {
+      nfp_log( NFP_DBG2, "nfp_chpoll: read ready");
+      revents|=POLLRDNORM;
+    }
+  }
+
+  if (!revents && !anyyet) {
+    *phpp=&pdev->pollhead;
+  }
+  *reventsp=revents;
+
+  nfp_log( NFP_DBG2, "nfp_chpoll: leaving");
+  return (0);
+}
+
+
+/*--------------------*/
+/*  ioctl             */
+/*--------------------*/
+
+/* ARGSUSED */
+static int nfp_ioctl(dev_t dev, int cmd, ioctlptr_t arg, int mode, cred_t *credp, int *rvalp) {
+  register struct nfp_dev *pdev;
+
+  nfp_log( NFP_DBG2, "nfp_ioctl: entered." );
+
+  if (!(pdev = ddi_get_soft_state(state_head, getminor(dev)))) {
+    nfp_log( NFP_DBG1, "nfp_ioctl: unable to get nfp dev.");
+    return (ENXIO);
+  }
+
+  switch (cmd) {
+  case NFDEV_IOCTL_ENQUIRY:
+    {
+      long *outp;
+      int outlen;
+      nfdev_enquiry_str enq_data;
+
+      enq_data.busno = (unsigned int)-1;
+      enq_data.slotno = (unsigned char)-1;
+
+      /* get our bus and slot num */
+      if (ddi_getlongprop (DDI_DEV_T_NONE,
+                           pdev->dip, 0, "reg",
+                           (caddr_t)&outp, &outlen) != DDI_PROP_NOT_FOUND) {
+        nfp_log( NFP_DBG2, "ddi_getlongprop('reg') ok." );
+        if( outlen > 0 ) {
+          enq_data.busno = ((*outp)>>16) & 0xff;
+          enq_data.slotno = ((*outp)>>11) & 0x1f;
+          nfp_log( NFP_DBG2, "busno %d, slotno %d.",
+                   enq_data.busno, enq_data.slotno );
+        }
+      } else
+        nfp_log( NFP_DBG1, "ddi_getlongprop('reg') failed." );
+
+      if( ddi_copyout( (char *)&enq_data, (void *)arg, sizeof(enq_data), mode ) != 0 ) {
+        nfp_log( NFP_DBG1, "ddi_copyout() failed." );
+        return EFAULT;
+      }
+    }
+    break;
+
+  case NFDEV_IOCTL_ENSUREREADING:
+    {
+      unsigned int addr, len;
+      nfp_err  ret;
+      if( ddi_copyin( (void *)arg, (char *)&len, sizeof(unsigned int), mode ) != 0 ) {
+        nfp_log( NFP_DBG1, "ddi_copyin() failed." );
+        return (EFAULT);
+      }
+      /* signal a read to the module */
+      nfp_log( NFP_DBG2, "nfp_ioctl: signalling read request to module, len = %x.", len );
+      if (len>8192) {
+        nfp_log( NFP_DBG1, "nfp_ioctl: len >8192 = %x.", len );
+        return EINVAL;
+      }
+      if (pdev->rd_outstanding==1) {
+        nfp_log( NFP_DBG1, "nfp_ioctl: not about to call read with read outstanding.");
+        return EIO;
+      }
+
+      addr= 0;
+      if(pdev->ifvers >= NFDEV_IF_PCI_PUSH) {
+        if( len > NFP_READBUF_SIZE ) {
+          nfp_log( NFP_DBG1, "nfp_ioctl: len > NFP_READBUF_SIZE = %x.", len );
+          return EINVAL;
+        }
+        addr= pdev->read_dma_cookie.dmac_address;
+      }
+
+      pdev->rd_outstanding = 1;
+      nfp_log( NFP_DBG2,"nfp_ioctl: pdev->rd_outstanding=1");
+
+      /* setup timeout timer */
+      pdev->rdtimeout= timeout(nfp_rdtimeout, (caddr_t)pdev, NFP_TIMEOUT_SEC * drv_usectohz(1000000));
+
+      nfp_log( NFP_DBG2, "nfp_ioctl: read request");
+      ret = pdev->cmddev->ensure_reading(addr, len, pdev->common.cmdctx);
+      if ( ret != NFP_SUCCESS ) {
+        (void) untimeout(pdev->rdtimeout);
+        pdev->rdtimeout = 0;
+        pdev->rd_outstanding = 0;
+        nfp_log( NFP_DBG1, "nfp_ioctl : cmddev->ensure_reading failed ");
+        return nfp_oserr( ret );
+      }
+    }
+    break;
+
+  case NFDEV_IOCTL_PCI_IFVERS:
+    {
+      int vers;
+
+      nfp_log( NFP_DBG2, "nfp_ioctl: NFDEV_IOCTL_PCI_IFVERS");
+
+      if( ddi_copyin( (void *)arg, (char *)&vers, sizeof(vers), mode ) != 0 ) {
+        nfp_log( NFP_DBG1, "ddi_copyin() failed." );
+        return (EFAULT);
+      }
+
+      if( pdev->rd_outstanding ) {
+        nfp_log( NFP_DBG1, "nfp_ioctl: can't set ifvers %d as read outstanding", vers);
+        return EIO;
+      }
+
+      nfp_set_ifvers(pdev, vers);
+      if( pdev->ifvers != vers ) {
+        nfp_log( NFP_DBG1, "nfp_ioctl: can't set ifvers %d", vers);
+        return EIO;
+      }
+    }
+    break;
+
+  case NFDEV_IOCTL_STATS:
+    {
+      if( ddi_copyout( (char *)&(pdev->common.stats),
+                       (void *)arg,
+                       sizeof(nfdev_stats_str),
+                       mode ) != 0 ) {
+        nfp_log( NFP_DBG1, "ddi_copyout() failed." );
+        return EFAULT;
+      }
+    }
+    break;
+
+  default:
+    nfp_log( NFP_DBG1, "nfp_ioctl: unknown ioctl." );
+    return EINVAL;
+  }
+
+  return 0;
+}
+
+/*-------------------------*/
+/*  nfp_open               */
+/*-------------------------*/
+
+/* ARGSUSED */
+int nfp_open(dev_t *dev, int openflags, int otyp, cred_t *credp)
+{       
+  nfp_err ret;
+  register struct nfp_dev *pdev;
+ 
+  nfp_log( NFP_DBG2, "entered nfp_open." );
+      
+  pdev = (nfp_dev *)ddi_get_soft_state(state_head, getminor(*dev));
+  
+  if( !pdev ) {
+    nfp_log( NFP_DBG1, "nfp_open: unable to get nfp dev.");
+    return (ENODEV);
+  }     
+        
+  if( otyp != OTYP_CHR ) {
+    nfp_log( NFP_DBG1, "nfp_open: not opened as character device");
+    return (EINVAL);
+  } 
+    
+  mutex_enter(&pdev->busy_mutex);
+    
+  if (pdev->busy) {
+    mutex_exit(&pdev->busy_mutex);
+    nfp_log( NFP_DBG1, "nfp_open: device busy");
+    return EBUSY;
+  } 
+  pdev->busy= 1;
+  mutex_exit(&pdev->busy_mutex);
+
+  /* use oldest possible interface until told otherwise */
+  pdev->ifvers= NFDEV_IF_STANDARD;
+  nfp_log( NFP_DBG3, "nfp_open: setting ifvers %d", pdev->ifvers);
+  pdev->rd_ready= 0; /* drop any old data */
+ 
+  ret = pdev->cmddev->open(pdev->common.cmdctx);
+  if( ret != NFP_SUCCESS ) {
+    nfp_log( NFP_DBG1, "nfp_open : cmddev->open failed ");
+    return nfp_oserr( ret );
+  } 
+
+  nfp_log( NFP_DBG2, "nfp_open: done");
+
+  return 0;
+}
+
+/*--------------------*/
+/*  nfp_close         */
+/*--------------------*/
+
+/* ARGSUSED */
+static int nfp_close(dev_t dev, int openflags, int otyp, cred_t *credp) {
+  nfp_dev *pdev;
+  nfp_err ret;
+
+  nfp_log( NFP_DBG2, "nfp_close: entered");
+
+  pdev = (struct nfp_dev *)ddi_get_soft_state(state_head, getminor(dev));
+  if( !pdev ) {
+    nfp_log( NFP_DBG1, "nfp_close: cannot find dev.");
+    return ENODEV;
+  }
+
+  mutex_enter(&pdev->isr_mutex);
+  if(pdev->rd_outstanding) {
+    int lbolt, err;
+    nfp_get_lbolt(&lbolt, err);
+    if(!err)
+      (void) cv_timedwait(&pdev->rd_cv, &pdev->isr_mutex, lbolt + (NFP_TIMEOUT_SEC * drv_usectohz(1000000)) );
+  }
+  mutex_exit(&pdev->isr_mutex);
+  ret = pdev->cmddev->close(pdev->common.cmdctx);
+  if (ret != NFP_SUCCESS ) {
+    nfp_log( NFP_DBG1, " nfp_close : cmddev->close failed");
+    return nfp_oserr( ret );
+  }
+
+  mutex_enter(&pdev->busy_mutex);
+  pdev->busy= 0;
+  mutex_exit(&pdev->busy_mutex);
+
+  return 0;
+}
+
+/****************************************************************************
+
+  nfp driver config
+
+ ****************************************************************************/
+
+/*-------------------------*/
+/*  nfp_getinfo            */
+/*-------------------------*/
+
+/* ARGSUSED */
+static int nfp_getinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result) {
+  int error;
+  nfp_dev *pdev;
+
+  nfp_log( NFP_DBG2, "nfp_getinfo: entered" );
+
+  pdev = (struct nfp_dev *)ddi_get_soft_state(state_head, getminor((dev_t)arg));
+  if( !pdev ) {
+    nfp_log( NFP_DBG1, "nfp_close: cannot find dev.");
+    return ENODEV;
+  }
+
+  switch (infocmd) {
+  case DDI_INFO_DEVT2DEVINFO:
+    if (pdev == NULL) {
+      *result = NULL;
+      error = DDI_FAILURE;
+    } else {
+      /*
+       * don't need to use a MUTEX even though we are
+       * accessing our instance structure; dev->dip
+       * never changes.
+       */
+      *result = pdev->dip;
+      error = DDI_SUCCESS;
+    }
+    break;
+  case DDI_INFO_DEVT2INSTANCE:
+    *result = (void *)(uintptr_t)getminor((dev_t)arg);
+    error = DDI_SUCCESS;
+    break;
+  default:
+    *result = NULL;
+    error = DDI_FAILURE;
+  }
+
+  nfp_log( NFP_DBG2, "nfp_getinfo: leaving." );
+  return (error);
+}
+
+/*-------------------------*/
+/*  nfp_release            */
+/*-------------------------*/
+
+static int nfp_release_dev( dev_info_t *dip ) {
+  nfp_dev *pdev;
+  int instance, i;
+  nfp_err ret;
+
+  nfp_log( NFP_DBG2, "nfp_release_dev: entering" );
+
+  instance = ddi_get_instance(dip);
+  pdev = (struct nfp_dev *)ddi_get_soft_state(state_head, instance);
+  if (pdev) {
+    nfp_log( NFP_DBG3, "nfp_release_dev: removing device" );
+
+    nfp_free_pci_push(pdev);
+
+    if( pdev->cmddev ) {
+      nfp_log( NFP_DBG3, "nfp_release_dev: destroying cmd dev" );
+       ret = pdev->cmddev->destroy(pdev->common.cmdctx);
+       if (ret != NFP_SUCCESS) {
+         nfp_log( NFP_DBG1, " nfp_release_dev : cmddev->destroy failed ");
+         return nfp_oserr( ret );
+       }
+    }
+
+    if(pdev->high_iblock_cookie) {
+      nfp_log( NFP_DBG3, "nfp_release_dev: removing high and soft irq" );
+      ddi_remove_softintr(pdev->soft_int_id);
+      ddi_remove_intr(pdev->dip, 0, pdev->high_iblock_cookie);
+      mutex_destroy( &pdev->busy_mutex );
+      cv_destroy( &pdev->rd_cv );
+      mutex_destroy( &pdev->isr_mutex );
+      mutex_destroy( &pdev->high_mutex );
+    } else if(pdev->iblock_cookie) {
+      nfp_log( NFP_DBG3, "nfp_release_dev: removing irq" );
+      ddi_remove_intr(pdev->dip, 0, pdev->iblock_cookie);
+      mutex_destroy( &pdev->busy_mutex );
+      cv_destroy( &pdev->rd_cv );
+      mutex_destroy( &pdev->isr_mutex );
+    }
+    if(pdev->low_iblock_cookie) {
+      ddi_remove_intr(pdev->dip, 0, pdev->low_iblock_cookie);
+      mutex_destroy( &pdev->low_mutex);
+    }
+
+    for(i=0;i<6;i++) {
+      if( pdev->common.extra[i] ) {
+        nfp_log( NFP_DBG3, "nfp_release_dev: unmapping BAR %d", i );
+        ddi_regs_map_free ((ddi_acc_handle_t *)&pdev->common.extra[i]);
+      }
+    }
+
+    ddi_remove_minor_node(dip, NULL);
+
+    if (pdev->conf_handle)
+      pci_config_teardown( &pdev->conf_handle );
+
+    ddi_soft_state_free(state_head, instance);
+  }
+  nfp_log( NFP_DBG2, "nfp_release: finished" );
+
+  return DDI_SUCCESS;
+}
+
+
+/*-------------------------*/
+/*  nfp_attach             */
+/*-------------------------*/
+
+static int nfp_attach(dev_info_t *dip, ddi_attach_cmd_t cmd) {
+  int instance;
+  nfp_dev *pdev = NULL;
+  int intres;
+  uint16_t device, vendor, sub_device, sub_vendor;
+  long *outp;
+  nfpcmd_dev const *cmddev;
+  int index, i;
+  nfp_err ret;
+
+  nfp_log( NFP_DBG2, "nfp_attach: entered." );
+
+  if (cmd != DDI_ATTACH) {
+    nfp_log( NFP_DBG1, "nfp_attach: bad command." );
+    goto bailout;
+  }
+
+  instance = ddi_get_instance(dip);
+
+  if (ddi_soft_state_zalloc(state_head, instance) != 0) {
+    nfp_log( NFP_DBG1, "nfp_attach: ddi_soft_state_zalloc() failed." );
+    goto bailout;
+  }
+
+  pdev = (struct nfp_dev *)ddi_get_soft_state(state_head, instance);
+  if( !pdev ) {
+    nfp_log( NFP_DBG1, "nfp_attach: cannot find dev.");
+    return ENODEV;
+  }
+  pdev->dip = dip;
+
+  /* map in pci config registers */
+  if (pci_config_setup(dip, &pdev->conf_handle)) {
+    nfp_log( NFP_DBG1, "nfp_attach: pci_config_setup() failed." );
+    goto bailout;
+  }
+
+  /* find out what we have got */
+  vendor= PCI_CONFIG_GET16( pdev->conf_handle, PCI_CONF_VENID );
+  device = PCI_CONFIG_GET16( pdev->conf_handle, PCI_CONF_DEVID );
+  sub_vendor = PCI_CONFIG_GET16( pdev->conf_handle, PCI_CONF_SUBVENID );
+  sub_device = PCI_CONFIG_GET16( pdev->conf_handle, PCI_CONF_SUBSYSID );
+
+  index= 0;
+  while( (cmddev = nfp_drvlist[index++]) != NULL ) {
+    if( cmddev->vendorid == vendor &&
+        cmddev->deviceid == device &&
+        cmddev->sub_vendorid == sub_vendor &&
+        cmddev->sub_deviceid == sub_device )
+      break;
+  }
+  if( !cmddev ) {
+    nfp_log( NFP_DBG1, "nfp_attach: unknonw device." );
+    goto bailout;
+  }
+
+  /* map BARs */
+  for( i=0; i<6; i++ ) {
+    if( cmddev->bar_sizes[i] ) {
+      off_t size;
+      if( ddi_dev_regsize(dip, i+1, &size) != DDI_SUCCESS) {
+        nfp_log( NFP_DBG1, "nfp_attach: ddi_dev_regsize() failed for BAR %d", i );
+        goto bailout;
+      }
+      if( size < (cmddev->bar_sizes[i] & ~NFP_MEMBAR_MASK) ) { 
+        nfp_log( NFP_DBG1, "nfp_attach: BAR %d too small %x (%x)", i, size, (cmddev->bar_sizes[i] & ~0xF) );
+        goto bailout;
+      }
+      if (ddi_regs_map_setup(dip, i+1, (caddr_t *)&pdev->common.bar[i],
+                         0, cmddev->bar_sizes[i] & ~NFP_MEMBAR_MASK, &nosw_attr, (ddi_acc_handle_t *)&pdev->common.extra[i] )) { 
+        nfp_log( NFP_DBG1, "nfp_attach: ddi_regs_map_setup() failed for BAR %d", i );
+        goto bailout;
+      }
+      nfp_log( NFP_DBG3, "nfp_attach: BAR[%d] mapped to %x (%x)", i, pdev->common.bar[i], size );
+    }
+  }
+  
+  pdev->read_buf = NULL;
+  pdev->rd_dma_ok = 0;
+
+  /* attach to minor node */
+  if (ddi_create_minor_node(dip, "nfp", S_IFCHR, instance, (char *)cmddev->name, 0) == DDI_FAILURE) {
+    ddi_remove_minor_node(dip, NULL);
+    nfp_log( NFP_DBG1, "nfp_attach: ddi_create_minor_node() failed." );
+    goto bailout;
+  }
+  
+  pdev->wr_ready = 1;
+  pdev->rd_ready = 0;
+  pdev->rd_pending = 0;
+  pdev->rd_outstanding = 0;
+  pdev->busy=0; 
+  pdev->cmddev= cmddev;
+  
+  ret = pdev->cmddev->create(&pdev->common);
+  if( ret != NFP_SUCCESS) {
+    nfp_log( NFP_DBG1, "nfp_attach: failed to create command device");
+    goto bailout;
+  }
+  pdev->common.dev= pdev;
+
+  if (ddi_intr_hilevel(dip, 0) != 0){
+    nfp_log( NFP_DBG2, "nfp_attach: high-level interrupt");
+    if( ddi_get_iblock_cookie(dip, 0, &pdev->high_iblock_cookie) ) {
+      nfp_log( NFP_DBG1, "nfp_attach: ddi_get_iblock_cookie(high) failed." );
+      goto bailout;
+    } 
+    if( ddi_get_iblock_cookie(dip, 0, &pdev->low_iblock_cookie) ) {
+      nfp_log( NFP_DBG1, "nfp_attach: ddi_get_iblock_cookie(low) failed." );
+      goto bailout;
+    }
+    mutex_init(&pdev->high_mutex, NULL, MUTEX_DRIVER,
+                (void *)pdev->high_iblock_cookie);
+    mutex_init(&pdev->low_mutex, NULL, MUTEX_DRIVER,
+                (void *)pdev->low_iblock_cookie);
+    if (ddi_add_intr(dip, 0, NULL,
+                NULL, nfp_isr,
+                (caddr_t)pdev) != DDI_SUCCESS) {
+      nfp_log( NFP_DBG1, "nfp_attach: ddi_add_intr(high) failed." );
+      goto bailout;
+    }
+    if( ddi_get_soft_iblock_cookie(dip, DDI_SOFTINT_HIGH,
+                &pdev->iblock_cookie) ) {
+      nfp_log( NFP_DBG1, "nfp_attach: ddi_get_iblock_cookie(soft) failed." );
+      goto bailout;
+    }
+    mutex_init(&pdev->isr_mutex, NULL, MUTEX_DRIVER,
+                (void *)pdev->iblock_cookie);
+    if (ddi_add_softintr(dip, DDI_SOFTINT_HIGH, &pdev->soft_int_id,
+                &pdev->iblock_cookie, NULL,
+                nfp_soft_isr, (caddr_t)pdev) != DDI_SUCCESS)
+                goto bailout;
+    pdev->high_intr= 1;
+  } else {
+    nfp_log( NFP_DBG2, "nfp_attach: low-level interrupt");
+
+    if (ddi_get_iblock_cookie (dip, 0, &pdev->iblock_cookie)) {
+      nfp_log( NFP_DBG1, "nfp_attach: ddi_get_iblock_cookie() failed." );
+      goto bailout;
+    }
+  
+    mutex_init(&pdev->isr_mutex, "nfp isr mutex", MUTEX_DRIVER, (void *)pdev->iblock_cookie);
+  
+    if (ddi_add_intr(dip, 0, NULL,
+                     (ddi_idevice_cookie_t *)NULL, nfp_isr,
+                     (caddr_t)pdev) != DDI_SUCCESS) {
+      nfp_log( NFP_DBG1, "nfp_attach: ddi_add_intr() failed." );
+      goto bailout;
+    }
+  }
+  mutex_init(&pdev->busy_mutex, "nfp busy mutex", MUTEX_DRIVER, NULL );
+  cv_init(&pdev->rd_cv, "nfp read condvar", CV_DRIVER, NULL );
+
+  /* get our bus and slot num */
+  if (ddi_getlongprop (DDI_DEV_T_NONE, 
+                       pdev->dip, 0, "reg",
+                       (caddr_t)&outp, &intres) != DDI_PROP_NOT_FOUND) {
+    nfp_log( NFP_DBG2, "nfp_attach: ddi_getlongprop('reg') ok." );
+    if( intres > 0 ) {
+      nfp_log( NFP_DBG1, "nfp_attach: found PCI nfast bus %x slot %x.",
+               ((*outp)>>16) & 0xff, ((*outp)>>11) & 0x1f );
+    }
+  }
+  
+  nfp_log( NFP_DBG2, "nfp_attach: attach succeeded." );
+  return DDI_SUCCESS;
+  
+bailout:
+  (void) nfp_release_dev( dip );
+
+  return DDI_FAILURE;
+}
+
+/*-------------------------*/
+/*  nfp_detach             */
+/*-------------------------*/
+
+/* 
+ * When our driver is unloaded, nfp_detach cleans up and frees the resources
+ * we allocated in nfp_attach.
+ */
+static int nfp_detach(dev_info_t *dip, ddi_detach_cmd_t cmd) {
+  if (cmd != DDI_DETACH)
+    return (DDI_FAILURE);
+
+  (void) nfp_release_dev(dip);
+
+  return (DDI_SUCCESS);
+}
+
+/*-------------------------*/
+/*  _init                  */
+/*-------------------------*/
+
+int _init(void) {
+  register int error;
+
+  nfp_log( NFP_DBG2, "_init: entered" );
+
+  if ((error = ddi_soft_state_init(&state_head, sizeof (struct nfp_dev), 1)) != 0) {
+    nfp_log( NFP_DBG1, "_init: soft_state_init() failed" );
+    return (error);
+  }
+  
+  if ((error = mod_install(&modlinkage)) != 0) {
+    nfp_log( NFP_DBG1, "_init: mod_install() failed" );
+    ddi_soft_state_fini(&state_head);
+  }
+  
+  nfp_log( NFP_DBG2, "_init: leaving" );
+  return (error);
+}
+
+/*-------------------------*/
+/*  _info                  */
+/*-------------------------*/
+
+int _info(struct modinfo *modinfop) { 
+  nfp_log( NFP_DBG2, "_info: entered" );
+  
+  return (mod_info(&modlinkage, modinfop));
+}
+
+/*-------------------------*/
+/*  _fini                  */
+/*-------------------------*/
+
+int _fini(void) {
+  int status;
+  
+  nfp_log( NFP_DBG2, "_fini: entered" );
+  
+  if ((status = mod_remove(&modlinkage)) != 0) {
+    nfp_log( NFP_DBG2, "_fini: mod_remove() failed." );
+    return (status);
+  }
+  
+  ddi_soft_state_fini(&state_head);
+  
+  nfp_log( NFP_DBG2, "_fini: leaving" );
+  
+  return (status);
+}
+
diff --git a/usr/src/uts/common/io/nfp/i21285.c b/usr/src/uts/common/io/nfp/i21285.c
new file mode 100644
index 0000000000..f51a09188d
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/i21285.c
@@ -0,0 +1,310 @@
+/*
+
+i21285.c: nCipher PCI HSM intel/digital 21285 command driver
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+
+history
+
+09/10/2001 jsh  Original
+
+*/
+
+#include "nfp_common.h"
+#include "nfp_error.h"
+#include "nfp_hostif.h"
+#include "nfp_osif.h"
+#include "i21285.h"
+#include "nfp_cmd.h"
+#include "nfpci.h"
+
+/* create ------------------------------------------------------- */
+
+static nfp_err i21285_create( nfp_cdev *pdev ) {
+  unsigned int tmp32;
+
+  nfp_log( NFP_DBG2, "i21285_create: entered");
+  pdev->cmdctx= pdev;  /* set our context to just be a pointer to our nfp_cdev */
+
+  nfp_log( NFP_DBG2, "i21285_create: enable doorbell");
+  if(!pdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21285_create: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+  TO_LE32_IO( &tmp32, DOORBELL_ENABLE | POSTLIST_ENABLE);
+  nfp_outl( pdev, IOBAR, I21285_OFFSET_INTERRUPT_MASK, tmp32 );
+
+  return NFP_SUCCESS;
+}
+
+/* stop ------------------------------------------------------- */
+
+static nfp_err i21285_destroy( void * ctx ) {
+  nfp_cdev *pdev;
+  unsigned int tmp32;
+
+  nfp_log( NFP_DBG2, "i21285_destroy: entered");
+
+  pdev= (nfp_cdev *)ctx;
+  if(!pdev) {
+    nfp_log( NFP_DBG1, "i21285_destroy: NULL pdev");
+    return NFP_ENODEV;
+  }
+  if(!pdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21285_destroy: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+  TO_LE32_IO( &tmp32, DOORBELL_DISABLE | POSTLIST_DISABLE );
+  nfp_outl( pdev, IOBAR, I21285_OFFSET_INTERRUPT_MASK, tmp32 );
+
+  return NFP_SUCCESS;
+}
+
+/* open ------------------------------------------------------- */
+
+/* ARGSUSED */
+static nfp_err i21285_open( void * ctx ) {
+  nfp_log( NFP_DBG2, "i21285_open: entered");
+
+  return NFP_SUCCESS;
+}
+
+/* close ------------------------------------------------------- */
+
+/* ARGSUSED */
+static nfp_err i21285_close( void * ctx ) {
+  nfp_log( NFP_DBG2, "i21285_close: entered");
+
+  return NFP_SUCCESS;
+}
+
+/* isr ------------------------------------------------------- */
+
+static nfp_err i21285_isr( void *ctx, int *handled ) {
+  nfp_cdev *pdev;
+  unsigned int doorbell;
+  unsigned int tmp32;
+
+  nfp_log( NFP_DBG3, "i21285_isr: entered");
+
+  *handled= 0;
+  pdev= (nfp_cdev *)ctx;
+  if(!pdev) {
+    nfp_log( NFP_DBG1, "i21285_isr: NULL pdev");
+    return NFP_ENODEV;
+  }
+
+  doorbell= nfp_inl( pdev, IOBAR, I21285_OFFSET_DOORBELL);
+  doorbell= FROM_LE32_IO(&doorbell) & 0xffff;
+  while( doorbell && doorbell != 0xffff) {
+    *handled= 1;
+    /* service interrupts */
+    if( doorbell & (NFAST_INT_DEVICE_WRITE_OK | NFAST_INT_DEVICE_WRITE_FAILED)) {
+      TO_LE32_IO( &tmp32, NFAST_INT_DEVICE_WRITE_OK | NFAST_INT_DEVICE_WRITE_FAILED);
+      nfp_outl( pdev, IOBAR, I21285_OFFSET_DOORBELL, tmp32 );
+
+      nfp_log(NFP_DBG2, "i21285_isr: write done interrupt, ok = %d.", doorbell & NFAST_INT_DEVICE_WRITE_OK ? 1 : 0 );
+
+      nfp_write_complete(pdev->dev, doorbell & NFAST_INT_DEVICE_WRITE_OK ? 1 : 0 );
+    }
+
+    if( doorbell & (NFAST_INT_DEVICE_READ_OK | NFAST_INT_DEVICE_READ_FAILED)) {
+       TO_LE32_IO( &tmp32, NFAST_INT_DEVICE_READ_OK | NFAST_INT_DEVICE_READ_FAILED );
+       nfp_outl( pdev, IOBAR, I21285_OFFSET_DOORBELL, tmp32 );
+
+      nfp_log(NFP_DBG2, "i21285_isr: read ack interrupt, ok = %d.", doorbell & NFAST_INT_DEVICE_READ_OK ? 1 : 0 );
+      nfp_read_complete( pdev->dev, doorbell & NFAST_INT_DEVICE_READ_OK ? 1 : 0);
+    }
+
+    if( doorbell & ~(NFAST_INT_DEVICE_READ_OK  | NFAST_INT_DEVICE_READ_FAILED |
+                     NFAST_INT_DEVICE_WRITE_OK | NFAST_INT_DEVICE_WRITE_FAILED)) {
+      nfp_log( NFP_DBG1, "i21285_isr: unexpected interrupt %x", doorbell );
+      TO_LE32_IO( &tmp32, 0xffff & doorbell );
+      nfp_outl( pdev, IOBAR, I21285_OFFSET_DOORBELL, tmp32 );
+    }
+    doorbell= nfp_inl( pdev, IOBAR, I21285_OFFSET_DOORBELL);
+    doorbell= FROM_LE32_IO(&doorbell) & 0xffff;
+  }
+  return 0;
+}
+
+/* write ------------------------------------------------------- */
+
+static nfp_err i21285_write( const char *block, int len, void *ctx ) {
+  nfp_cdev *cdev;
+  unsigned int hdr[2];
+  nfp_err ne;
+  unsigned int tmp32;
+
+  nfp_log( NFP_DBG2, "i21285_write: entered");
+
+  cdev= (nfp_cdev *)ctx;
+  if(!cdev) {
+    nfp_log( NFP_DBG1, "i21285_write: NULL pdev");
+    return NFP_ENODEV;
+  }
+
+  nfp_log(NFP_DBG2, "i21285_write: pdev->bar[ MEMBAR ]= %x\n", cdev->bar[ MEMBAR ]);
+  nfp_log(NFP_DBG2, "i21285_write: pdev->bar[ IOBAR ]= %x\n", cdev->bar[ IOBAR ]);
+  if(!cdev->bar[ MEMBAR ]) {
+    nfp_log( NFP_DBG1, "i21285_write: null BAR[%d]", MEMBAR );
+    return NFP_ENOMEM;
+  }
+  ne= nfp_copy_from_user_to_dev( cdev, MEMBAR, NFPCI_JOBS_WR_DATA, block, len);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21285_write: nfp_copy_from_user_to_dev failed");
+    return ne;
+  }
+  TO_LE32_MEM(&hdr[0], NFPCI_JOB_CONTROL);
+  TO_LE32_MEM(&hdr[1], len);
+
+  ne= nfp_copy_to_dev( cdev, MEMBAR, NFPCI_JOBS_WR_CONTROL, (const char *)hdr, 8);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21285_write: nfp_copy_to_dev failed");
+    return ne;
+  }
+
+  ne= nfp_copy_from_dev( cdev, MEMBAR, NFPCI_JOBS_WR_LENGTH, (char *)hdr, 4);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21285_write: nfp_copy_from_dev failed");
+    return ne;
+  }
+  
+  TO_LE32_MEM( &tmp32, len );
+  if ( hdr[0] != tmp32 ) {
+    nfp_log( NFP_DBG1, "i21285_write: length not written");
+    return NFP_EIO;
+  }
+
+  TO_LE32_IO( &tmp32, NFAST_INT_HOST_WRITE_REQUEST);
+
+  nfp_outl( cdev, IOBAR, I21285_OFFSET_DOORBELL, tmp32 );
+
+  nfp_log( NFP_DBG2, "i21285_write: done");
+  return NFP_SUCCESS;
+}
+
+/* read ------------------------------------------------------- */
+
+static nfp_err i21285_read( char *block, int len, void *ctx, int *rcount) {
+  nfp_cdev *cdev;
+  nfp_err ne;
+  int count;
+
+  nfp_log( NFP_DBG2, "i21285_read: entered, len %d", len);
+  *rcount= 0;
+
+  cdev= (nfp_cdev *)ctx;
+  if(!cdev) {
+    nfp_log( NFP_DBG1, "i21285_read: NULL pdev");
+    return NFP_ENODEV;
+  }
+
+  if(!cdev->bar[ MEMBAR ]) {
+    nfp_log( NFP_DBG1, "i21285_read: null BAR[%d]", MEMBAR );
+    return NFP_ENOMEM;
+  }
+  ne= nfp_copy_from_dev( cdev, MEMBAR, NFPCI_JOBS_RD_LENGTH, (char *)&count, 4);
+  if(ne) {
+    nfp_log( NFP_DBG1, "i21285_read: nfp_copy_from_dev failed.");
+    return ne;
+  }
+  count= FROM_LE32_MEM(&count);
+  if(count<0 || count>len) {
+    nfp_log( NFP_DBG1, "i21285_read: bad byte count (%d) from device", count);
+    return NFP_EIO;
+  }
+  ne= nfp_copy_to_user_from_dev( cdev, MEMBAR, NFPCI_JOBS_RD_DATA, block, count);
+  if( ne ) {
+    nfp_log( NFP_DBG1, "i21285_read: nfp_copy_to_user_from_dev failed.");
+    return ne;
+  }
+  nfp_log( NFP_DBG2, "i21285_read: done");
+  *rcount= count;
+  return NFP_SUCCESS;
+}
+
+/* chupdate  ------------------------------------------------------- */
+
+/* ARGSUSED */
+static nfp_err i21285_chupdate( char *data, int len, void *ctx ) {
+  nfp_log( NFP_DBG1, "i21285_chupdate: NYI");
+  return NFP_SUCCESS;
+}
+
+/* ensure reading -------------------------------------------------- */
+
+static nfp_err i21285_ensure_reading( unsigned int addr, int len, void *ctx ) {
+  nfp_cdev *cdev;
+  unsigned int hdr[2];
+  unsigned int tmp32;
+  nfp_err ne;
+
+  nfp_log( NFP_DBG2, "i21285_ensure_reading: entered");
+
+  if(addr) {
+    nfp_log( NFP_DBG2, "i21285_ensure_reading: bad addr");
+    return -NFP_EINVAL;
+  }
+
+  cdev= (nfp_cdev *)ctx;
+  if(!cdev) {
+    nfp_log( NFP_DBG1, "i21285_ensure_reading: NULL pdev");
+    return NFP_ENODEV;
+  }
+
+  if(!cdev->bar[ MEMBAR ]) {
+    nfp_log( NFP_DBG1, "i21285_ensure_reading: null BAR[%d]", MEMBAR );
+    return NFP_ENXIO;
+  }
+  nfp_log( NFP_DBG3, "i21285_ensure_reading: pdev->bar[ MEMBAR ]= %x", cdev->bar[ MEMBAR ]);
+  nfp_log( NFP_DBG3, "i21285_ensure_reading: pdev->bar[ IOBAR ]= %x", cdev->bar[ IOBAR ]);
+  TO_LE32_MEM( &hdr[0], NFPCI_JOB_CONTROL);
+  TO_LE32_MEM( &hdr[1], len);
+  ne= nfp_copy_to_dev( cdev, MEMBAR, NFPCI_JOBS_RD_CONTROL, (const char *)hdr, 8);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21285_ensure_reading: nfp_copy_to_dev failed");
+    return ne;
+  }
+  ne= nfp_copy_from_dev( cdev, MEMBAR, NFPCI_JOBS_RD_LENGTH, (char *)hdr, 4);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21285_ensure_reading: nfp_copy_from_dev failed");
+    return ne;
+  }
+  TO_LE32_MEM( &tmp32, len );
+  if ( hdr[0] != tmp32 ) {
+    nfp_log( NFP_DBG1, "i21285_ensure_reading: len not written");
+    return NFP_EIO;
+  };
+  TO_LE32_IO( &tmp32, NFAST_INT_HOST_READ_REQUEST );
+  nfp_outl( cdev, IOBAR, I21285_OFFSET_DOORBELL, tmp32 );
+
+  return NFP_SUCCESS;
+}
+
+/* command device structure ------------------------------------- */
+
+
+const nfpcmd_dev i21285_cmddev = {
+  "nCipher Gen 1 PCI",
+  PCI_VENDOR_ID_DEC, PCI_DEVICE_ID_DEC_21285,
+  PCI_VENDOR_ID_NCIPHER, PCI_DEVICE_ID_NFAST_GEN1,
+  { 0, IOSIZE | PCI_BASE_ADDRESS_SPACE_IO, NFPCI_RAM_MINSIZE, 0, 0, 0 },
+  NFP_CMD_FLG_NEED_IOBUF,
+  i21285_create,
+  i21285_destroy,
+  i21285_open,
+  i21285_close,
+  i21285_isr,
+  i21285_write,
+  i21285_read,
+  i21285_chupdate,
+  i21285_ensure_reading,
+  0, /* no debug */
+};
+  
diff --git a/usr/src/uts/common/io/nfp/i21285.h b/usr/src/uts/common/io/nfp/i21285.h
new file mode 100644
index 0000000000..4ea1d853ec
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/i21285.h
@@ -0,0 +1,43 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+#ifndef NFP_I21285_H
+#define NFP_I21285_H
+
+#ifndef PCI_VENDOR_ID_DEC
+#define PCI_VENDOR_ID_DEC               0x1011
+#endif
+#ifndef PCI_DEVICE_ID_DEC_21285
+#define PCI_DEVICE_ID_DEC_21285         0x1065
+#endif
+#ifndef PCI_VENDOR_ID_NCIPHER
+#define PCI_VENDOR_ID_NCIPHER           0x0100
+#endif
+
+#ifndef PCI_DEVICE_ID_NFAST_GEN1
+#define PCI_DEVICE_ID_NFAST_GEN1	0x0100
+#endif
+
+#define I21285_OFFSET_DOORBELL		0x60
+#define I21285_OFFSET_INTERRUPT_MASK	0x34
+
+#define DOORBELL_ENABLE 0x0
+#define DOORBELL_DISABLE 0x4
+
+#define POSTLIST_ENABLE 0x0
+#define POSTLIST_DISABLE 0x8
+
+#define IOBAR	1
+#define MEMBAR	2
+
+#define IOSIZE	0x80
+#define MEMSIZE	0x100000
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/i21555.c b/usr/src/uts/common/io/nfp/i21555.c
new file mode 100644
index 0000000000..82024dc800
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/i21555.c
@@ -0,0 +1,423 @@
+/*
+
+i21555.c: nCipher PCI HSM intel 21555 command driver
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+09/10/2001 jsh  Original
+
+*/
+
+#include "nfp_common.h"
+#include "nfp_error.h"
+#include "nfp_hostif.h"
+#include "nfp_osif.h"
+#include "i21555.h"
+#include "nfp_cmd.h"
+#include "nfpci.h"
+
+/* started ------------------------------------------------------
+ *
+ * Check that device is ready to talk, by checking that
+ * the i21555 has master enabled on its secondary interface
+ */
+
+static nfp_err i21555_started( nfp_cdev *pdev ) {
+  unsigned int tmp32;
+#ifdef CONFIGSPACE_DEBUG
+  unsigned int reg32[64];
+  int i;
+#endif
+  nfp_err ne;
+
+  nfp_log( NFP_DBG2, "i21555_started: entered");
+
+#ifdef CONFIGSPACE_DEBUG
+  /* Suck up all the registers */
+  for (i=0; i < 64; i++) {
+    ne = nfp_config_inl( pdev, i*4, &reg32[i] );
+  }
+
+  for (i=0; i < 16; i++) {
+    int j = i * 4;
+    nfp_log( NFP_DBG3, "i21555 config reg %2x: %08x %08x %08x %08x", j*4,
+        reg32[j], reg32[j+1], reg32[j+2], reg32[j+3]);
+  }
+#endif
+
+  ne = nfp_config_inl( pdev, I21555_CFG_SEC_CMD_STATUS, &tmp32 );
+  if (ne) {
+    /* succeed if PCI config reads are not implemented */
+    if (ne == NFP_EUNKNOWN)
+      return NFP_SUCCESS;
+    nfp_log( NFP_DBG1, "i21555_started: nfp_config_inl failed");
+    return ne;
+  }
+
+  tmp32= FROM_LE32_IO(&tmp32) & 0xffff;
+
+  if ( tmp32 & CFG_CMD_MASTER ) {
+    nfp_log( NFP_DBG3, "i21555_started: Yes %x", tmp32);
+    return NFP_SUCCESS;
+  } else {
+    nfp_log( NFP_DBG1, "i21555_started: device not started yet %x", tmp32);
+    return NFP_ESTARTING;
+  }
+}
+
+/* create ------------------------------------------------------- */
+
+static nfp_err i21555_create( nfp_cdev *pdev ) {
+  unsigned int tmp32;
+
+  nfp_log( NFP_DBG2, "i21555_create: entered");
+  pdev->cmdctx= pdev;  /* set our context to just be a pointer to our nfp_cdev */
+
+  if(!pdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21555_create: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+  nfp_log( NFP_DBG2, "i21555_create: enable doorbell");
+  TO_LE32_IO( &tmp32, I21555_DOORBELL_PRI_ENABLE );
+  nfp_outl( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_SET_MASK, tmp32 );
+  nfp_outl( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_CLEAR_MASK, tmp32 );
+  return NFP_SUCCESS;
+}
+
+/* stop ------------------------------------------------------- */
+
+static nfp_err i21555_destroy( void * ctx ) {
+  nfp_cdev *pdev;
+  unsigned int tmp32;
+
+  nfp_log( NFP_DBG2, "i21555_destroy: entered");
+
+  pdev= (nfp_cdev *)ctx;
+  if(!pdev) {
+    nfp_log( NFP_DBG1, "i21555_destroy: NULL pdev");
+    return NFP_ENODEV;
+  }
+  if(!pdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21555_destroy: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+  TO_LE32_IO( &tmp32, I21555_DOORBELL_PRI_DISABLE );
+  nfp_outl( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_SET_MASK, tmp32 );
+  nfp_outl( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_CLEAR_MASK, tmp32 );
+
+  return NFP_SUCCESS;
+}
+
+/* open ------------------------------------------------------- */
+
+/* ARGSUSED */
+static nfp_err i21555_open( void * ctx ) {
+
+  nfp_log( NFP_DBG2, "i21555_open: entered");
+
+  return NFP_SUCCESS;
+}
+
+/* close ------------------------------------------------------- */
+
+/* ARGSUSED */
+static nfp_err i21555_close( void * ctx ) {
+  nfp_log( NFP_DBG2, "i21555_close: entered");
+
+  return NFP_SUCCESS;
+}
+
+/* isr ------------------------------------------------------- */
+
+static nfp_err i21555_isr( void *ctx, int *handled ) {
+  nfp_cdev *pdev;
+  nfp_err ne;
+  unsigned short doorbell;
+  unsigned short tmp16;
+
+  nfp_log( NFP_DBG3, "i21555_isr: entered");
+
+  *handled= 0;
+  pdev= (nfp_cdev *)ctx;
+  if(!pdev) {
+    nfp_log( NFP_DBG1, "i21555_isr: NULL pdev");
+    return NFP_ENODEV;
+  }
+
+  pdev->stats.isr++;
+
+  if(!pdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21555_isr: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+
+  /* This interrupt may not be from our module, so check that it actually is
+   * us before handling it.
+   */
+  ne = i21555_started( pdev );
+  if (ne) {
+    if (ne != NFP_ESTARTING) {
+      nfp_log( NFP_DBG1, "i21555_isr: i21555_started failed");
+    }
+    return ne;
+  }
+
+  doorbell= nfp_inw( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_SET);
+  doorbell= FROM_LE16_IO(&doorbell);
+  while( doorbell && doorbell != 0xffff) {
+    *handled= 1;
+    /* service interrupts */
+    if( doorbell & (NFAST_INT_DEVICE_WRITE_OK | NFAST_INT_DEVICE_WRITE_FAILED)) {
+      pdev->stats.isr_write++;
+      TO_LE16_IO(&tmp16,NFAST_INT_DEVICE_WRITE_OK | NFAST_INT_DEVICE_WRITE_FAILED);
+      nfp_outw( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_CLEAR, tmp16 );
+
+      nfp_log( NFP_DBG2, "i21555_isr: write done interrupt, ok = %d.", doorbell & NFAST_INT_DEVICE_WRITE_OK ? 1 : 0 );
+
+      nfp_write_complete(pdev->dev, doorbell & NFAST_INT_DEVICE_WRITE_OK ? 1 : 0 );
+    }
+
+    if( doorbell & (NFAST_INT_DEVICE_READ_OK | NFAST_INT_DEVICE_READ_FAILED)) {
+      pdev->stats.isr_read++;
+      TO_LE16_IO(&tmp16,NFAST_INT_DEVICE_READ_OK | NFAST_INT_DEVICE_READ_FAILED);
+      nfp_outw( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_CLEAR, tmp16 );
+
+      nfp_log( NFP_DBG2, "i21555_isr: read ack interrupt, ok = %d.", doorbell & NFAST_INT_DEVICE_READ_OK ? 1 : 0 );
+      nfp_read_complete( pdev->dev, doorbell & NFAST_INT_DEVICE_READ_OK ? 1 : 0);
+    }
+
+    if( doorbell & ~(NFAST_INT_DEVICE_READ_OK  | NFAST_INT_DEVICE_READ_FAILED |
+                     NFAST_INT_DEVICE_WRITE_OK | NFAST_INT_DEVICE_WRITE_FAILED)) {
+      TO_LE16_IO(&tmp16,doorbell);
+      nfp_outw( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_CLEAR, tmp16 );
+      nfp_log( NFP_DBG1, "i21555_isr: unexpected interrupt %x", doorbell );
+    }
+    doorbell= nfp_inw( pdev, IOBAR, I21555_OFFSET_DOORBELL_PRI_SET);
+    doorbell= FROM_LE16_IO(&doorbell);
+  }
+  nfp_log( NFP_DBG3, "i21555_isr: exiting");
+  return 0;
+}
+
+/* write ------------------------------------------------------- */
+
+static nfp_err i21555_write( const char *block, int len, void *ctx) {
+  nfp_cdev *cdev;
+  unsigned int hdr[2];
+  nfp_err ne;
+  unsigned short tmp16;
+  unsigned int tmp32;
+
+  nfp_log( NFP_DBG2, "i21555_write: entered");
+
+  cdev= (nfp_cdev *)ctx;
+  if(!cdev) {
+    nfp_log( NFP_DBG1, "i21555_write: NULL cdev");
+    return NFP_ENODEV;
+  }
+
+  cdev->stats.write_fail++;
+
+  if(!cdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21555_write: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+
+  ne = i21555_started( cdev );
+  if (ne) {
+    if (ne != NFP_ESTARTING) {
+      nfp_log( NFP_DBG1, "i21555_write: i21555_started failed");
+    }
+    return ne;
+  }
+
+  nfp_log( NFP_DBG3, "i21555_write: cdev->bar[ MEMBAR ]= %x", cdev->bar[ MEMBAR ]);
+  nfp_log( NFP_DBG3, "i21555_write: cdev->bar[ IOBAR ]= %x", cdev->bar[ IOBAR ]);
+  nfp_log( NFP_DBG3, "i21555_write: block len %d", len ); 
+  ne= nfp_copy_from_user_to_dev( cdev, MEMBAR, NFPCI_JOBS_WR_DATA, block, len);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21555_write: nfp_copy_from_user_to_dev failed");
+    return ne;
+  }
+  TO_LE32_MEM(&hdr[0], NFPCI_JOB_CONTROL);
+  TO_LE32_MEM(&hdr[1], len);
+  ne= nfp_copy_to_dev( cdev, MEMBAR, NFPCI_JOBS_WR_CONTROL, (const char *)hdr, 8);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21555_write: nfp_copy_to_dev failed");
+    return ne;
+  }
+
+  ne= nfp_copy_from_dev( cdev, MEMBAR, NFPCI_JOBS_WR_LENGTH, (char *)hdr, 4);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21555_write: nfp_copy_from_dev failed");
+    return ne;
+  }
+
+  TO_LE32_MEM(&tmp32, len);
+  if ( hdr[0] != tmp32 ) {
+    nfp_log( NFP_DBG1, "i21555_write: length not written");
+    return NFP_EIO;
+  }
+  TO_LE16_IO(&tmp16, NFAST_INT_HOST_WRITE_REQUEST >> 16);
+  nfp_outw( cdev, IOBAR, I21555_OFFSET_DOORBELL_SEC_SET, tmp16);
+
+  cdev->stats.write_fail--;
+  cdev->stats.write_block++;
+  cdev->stats.write_byte += len;
+
+  nfp_log( NFP_DBG2, "i21555_write: done");
+  return NFP_SUCCESS;
+}
+
+/* read ------------------------------------------------------- */
+
+static nfp_err i21555_read( char *block, int len, void *ctx, int *rcount) {
+  nfp_cdev *cdev;
+  nfp_err ne;
+  int count;
+
+  nfp_log( NFP_DBG2, "i21555_read: entered");
+  *rcount= 0;
+
+  cdev= (nfp_cdev *)ctx;
+  if(!cdev) {
+    nfp_log( NFP_DBG1, "i21555_read: NULL pdev");
+    return NFP_ENODEV;
+  }
+
+  cdev->stats.read_fail++;
+
+  if(!cdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21555_read: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+
+  ne= nfp_copy_from_dev( cdev, MEMBAR, NFPCI_JOBS_RD_LENGTH, (char *)&count, 4);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21555_read: nfp_copy_from_dev failed.");
+    return ne;
+  }
+  count= FROM_LE32_MEM(&count);
+  if(count<0 || count>len) {
+    nfp_log( NFP_DBG1, "i21555_read: bad byte count (%d) from device", count);
+    return NFP_EIO;
+  }
+  ne= nfp_copy_to_user_from_dev( cdev, MEMBAR, NFPCI_JOBS_RD_DATA, block, count);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21555_read: nfp_copy_to_user failed.");
+    return ne;
+  }
+  nfp_log( NFP_DBG2, "i21555_read: done");
+  *rcount= count;
+  cdev->stats.read_fail--;
+  cdev->stats.read_block++;
+  cdev->stats.read_byte += len;
+  return NFP_SUCCESS;
+}
+
+/* chupdate  ------------------------------------------------------- */
+
+/* ARGSUSED */
+static nfp_err i21555_chupdate( char *data, int len, void *ctx ) {
+  nfp_log( NFP_DBG1, "i21555_chupdate: NYI");
+  return NFP_SUCCESS;
+}
+
+/* ensure reading -------------------------------------------------- */
+
+static nfp_err i21555_ensure_reading( unsigned int addr, int len, void *ctx ) {
+  nfp_cdev *cdev;
+  unsigned int hdr[3];
+  unsigned short tmp16;
+  unsigned int tmp32;
+  nfp_err ne;
+  int hdr_len;
+
+  nfp_log( NFP_DBG2, "i21555_ensure_reading: entered");
+
+  cdev= (nfp_cdev *)ctx;
+  if(!cdev) {
+    nfp_log( NFP_DBG1, "i21555_ensure_reading: NULL pdev");
+    return NFP_ENODEV;
+  }
+
+  cdev->stats.ensure_fail++;
+
+  if(!cdev->bar[ IOBAR ]) {
+    nfp_log( NFP_DBG1, "i21555_ensure_reading: null BAR[%d]", IOBAR );
+    return NFP_ENOMEM;
+  }
+
+  ne = i21555_started( cdev );
+  if (ne) {
+    if (ne != NFP_ESTARTING) {
+      nfp_log( NFP_DBG1, "i21555_ensure_reading: i21555_started failed");
+    }
+    return ne;
+  }
+
+  nfp_log( NFP_DBG3, "i21555_ensure_reading: pdev->bar[ MEMBAR ]= %x", cdev->bar[ MEMBAR ]);
+  nfp_log( NFP_DBG3, "i21555_ensure_reading: pdev->bar[ IOBAR ]= %x", cdev->bar[ IOBAR ]);
+  if(addr) {
+    nfp_log( NFP_DBG3, "i21555_ensure_reading: new format, addr %x", addr);
+    TO_LE32_MEM(&hdr[0], NFPCI_JOB_CONTROL_PCI_PUSH);
+    TO_LE32_MEM(&hdr[1], len);
+    TO_LE32_MEM(&hdr[2], addr);
+    hdr_len= 12;
+  } else {
+    TO_LE32_MEM(&hdr[0], NFPCI_JOB_CONTROL);
+    TO_LE32_MEM(&hdr[1], len);
+    hdr_len= 8;
+  }
+  ne= nfp_copy_to_dev( cdev, MEMBAR, NFPCI_JOBS_RD_CONTROL, (const char *)hdr, hdr_len);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21555_ensure_reading: nfp_copy_to_dev failed");
+    return ne;
+  }
+
+  ne= nfp_copy_from_dev( cdev, MEMBAR, NFPCI_JOBS_RD_LENGTH, (char *)hdr, 4);
+  if (ne) {
+    nfp_log( NFP_DBG1, "i21555_ensure_reading: nfp_copy_from_dev failed");
+    return ne;
+  }
+
+  TO_LE32_MEM(&tmp32, len);
+
+  if ( hdr[0] != tmp32 ) {
+    nfp_log( NFP_DBG1, "i21555_ensure_reading: len not written");
+    return NFP_EIO;
+  }
+  TO_LE16_IO( &tmp16, NFAST_INT_HOST_READ_REQUEST >> 16);
+  nfp_outw( cdev, IOBAR, I21555_OFFSET_DOORBELL_SEC_SET, tmp16);
+
+  cdev->stats.ensure_fail--;
+  cdev->stats.ensure++;
+
+  return NFP_SUCCESS;
+}
+
+/* command device structure ------------------------------------- */
+
+const nfpcmd_dev i21555_cmddev = {
+  "nCipher Gen 2 PCI",
+  PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_21555,
+  PCI_VENDOR_ID_NCIPHER, PCI_SUBSYSTEM_ID_NFAST_REV1,
+  { 0, IOSIZE | PCI_BASE_ADDRESS_SPACE_IO, NFPCI_RAM_MINSIZE_JOBS, 0, 0, 0 },
+  NFP_CMD_FLG_NEED_IOBUF,
+  i21555_create,
+  i21555_destroy,
+  i21555_open,
+  i21555_close,
+  i21555_isr,
+  i21555_write,
+  i21555_read,
+  i21555_chupdate,
+  i21555_ensure_reading,
+  i21555_debug,
+};
diff --git a/usr/src/uts/common/io/nfp/i21555.h b/usr/src/uts/common/io/nfp/i21555.h
new file mode 100644
index 0000000000..d8f3965938
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/i21555.h
@@ -0,0 +1,51 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+#ifndef I21555_H
+#define I21555_H
+
+#ifndef PCI_VENDOR_ID_INTEL
+#define PCI_VENDOR_ID_INTEL             0x8086
+#endif
+
+#ifndef PCI_DEVICE_ID_INTEL_21555
+#define PCI_DEVICE_ID_INTEL_21555       0xb555
+#endif
+
+#ifndef PCI_VENDOR_ID_NCIPHER
+#define PCI_VENDOR_ID_NCIPHER           0x0100
+#endif
+
+#ifndef PCI_SUBSYSTEM_ID_NFAST_REV1
+#define PCI_SUBSYSTEM_ID_NFAST_REV1     0x0100
+#endif
+
+#define I21555_OFFSET_DOORBELL_PRI_SET		0x9C
+#define I21555_OFFSET_DOORBELL_SEC_SET		0x9E
+#define I21555_OFFSET_DOORBELL_PRI_CLEAR	0x98
+
+#define I21555_OFFSET_DOORBELL_PRI_SET_MASK	0xA4
+#define I21555_OFFSET_DOORBELL_PRI_CLEAR_MASK	0xA0
+
+#define I21555_DOORBELL_PRI_ENABLE 0x0000
+#define I21555_DOORBELL_PRI_DISABLE 0xFFFF
+
+#define I21555_CFG_SEC_CMD_STATUS 0x44
+
+#define CFG_CMD_MASTER 0x0004
+
+#define IOBAR   1
+#define MEMBAR  2
+
+#define IOSIZE  0x100
+
+extern nfp_err i21555_debug( int cmd, void *ctx );
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/i21555d.c b/usr/src/uts/common/io/nfp/i21555d.c
new file mode 100644
index 0000000000..183ace8275
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/i21555d.c
@@ -0,0 +1,28 @@
+/*
+
+i21555d.c: nCipher PCI HSM intel 21555 debug ioctl
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+
+history
+
+15/05/2002 jsh  Original, does nothing
+
+*/
+
+#include "nfp_common.h"
+#include "nfp_error.h"
+#include "nfp_osif.h"
+#include "i21555.h"
+
+/* ARGSUSED */
+nfp_err i21555_debug( int cmd, void *ctx) {
+  nfp_log( NFP_DBG1, "i21555_debug: entered");
+
+  return NFP_EUNKNOWN;
+}
diff --git a/usr/src/uts/common/io/nfp/nfdev-common.h b/usr/src/uts/common/io/nfp/nfdev-common.h
new file mode 100644
index 0000000000..8a97bf2c63
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfdev-common.h
@@ -0,0 +1,141 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+/** \file nfdev-common.h
+ *
+ * \brief nFast device driver (not generic SCSI) ioctl struct definition file
+ *  include NFDEV-$(system) for ioctl number definitions
+ *
+ *  1998.07.13	jsh	Started
+ *
+ * 
+ */
+
+#ifndef NFDEV_COMMON_H
+#define NFDEV_COMMON_H
+
+/**
+ * Result of the ENQUIRY ioctl.
+ */
+typedef struct nfdev_enquiry_str {
+  unsigned int  busno; /**< Which bus is the PCI device on. */
+  unsigned char slotno; /**< Which slot is the PCI device in. */
+  unsigned char reserved[3]; /**< for consistant struct alignment */
+} nfdev_enquiry_str;
+
+/**
+ * Result of the STATS ioctl.
+ */
+typedef struct nfdev_stats_str {
+  unsigned long  isr; /**< Count interrupts. */
+  unsigned long  isr_read; /**< Count read interrupts. */
+  unsigned long  isr_write; /**< Count write interrupts. */
+  unsigned long  write_fail; /**< Count write failures. */
+  unsigned long  write_block; /**< Count blocks written. */
+  unsigned long  write_byte; /**< Count bytes written. */
+  unsigned long  read_fail; /**< Count read failures. */
+  unsigned long  read_block; /**< Count blocks read. */
+  unsigned long  read_byte; /**< Count bytes read. */
+  unsigned long  ensure_fail; /**< Count read request failures. */
+  unsigned long  ensure; /**< Count read requests. */
+} nfdev_stats_str;
+
+/**
+ * Input to the CONTROL ioctl.
+ */
+typedef struct nfdev_control_str {
+  unsigned control; /**< Control flags. */
+} nfdev_control_str;
+
+/** Control bit indicating host supports MOI control */
+#define NFDEV_CONTROL_HOST_MOI 0x0001
+
+/** Index of control bits indicating desired mode
+ *
+ * Desired mode follows the M_ModuleMode enumeration.
+ */
+#define NFDEV_CONTROL_MODE_SHIFT 1
+
+/** Detect a backwards-compatible control value
+ *
+ * Returns true if the request control value "makes no difference", i.e.
+ * and the failure of an attempt to set it is therefore uninteresting.
+ */
+#define NFDEV_CONTROL_HARMLESS(c) ((c) <= 1)
+
+/**
+ * Result of the STATUS ioctl.
+ */
+typedef struct nfdev_status_str {
+  unsigned  status; /**< Status flags. */
+  char      error[8]; /**< Error string. */
+} nfdev_status_str;
+
+/** Monitor firmware supports MOI control and error reporting */
+#define NFDEV_STATUS_MONITOR_MOI 0x0001
+
+/** Application firmware supports MOI control and error reporting */
+#define NFDEV_STATUS_APPLICATION_MOI 0x0002
+
+/** Application firmware running and supports error reporting */
+#define NFDEV_STATUS_APPLICATION_RUNNING 0x0004
+
+/** HSM failed
+ *
+ * Consult error[] for additional information.
+ */
+#define NFDEV_STATUS_FAILED 0x0008
+
+/** Standard PCI interface. */
+#define NFDEV_IF_STANDARD	0x01
+
+/** PCI interface with results pushed from device
+ *  via DMA.
+ */
+#define NFDEV_IF_PCI_PUSH	0x02
+
+/* platform independant base ioctl numbers */
+
+/** Enquiry ioctl.
+ *  \return nfdev_enquiry_str describing the attached device. */
+#define NFDEV_IOCTL_NUM_ENQUIRY        0x01
+/** Channel Update ioctl.
+ *  \deprecated */
+#define NFDEV_IOCTL_NUM_CHUPDATE       0x02
+/** Ensure Reading ioctl.
+ *  Signal a read request to the device.
+ *  \param (unsigned int) Length of data to be read.
+ */
+#define NFDEV_IOCTL_NUM_ENSUREREADING  0x03
+/** Device Count ioctl.
+ *  Not implemented for on all platforms.
+ *  \return (int) the number of attached devices. */
+#define NFDEV_IOCTL_NUM_DEVCOUNT       0x04
+/** Internal Debug ioctl.
+ *  Not implemented in release drivers. */
+#define NFDEV_IOCTL_NUM_DEBUG          0x05
+/** PCI Interface Version ioctl.
+ *  \param (int) Maximum PCI interface version
+ *   supported by the user of the device. */
+#define NFDEV_IOCTL_NUM_PCI_IFVERS     0x06
+/** Statistics ioctl.
+ *  \return nfdev_enquiry_str describing the attached device. */
+#define NFDEV_IOCTL_NUM_STATS          0x07
+
+/** Module control ioctl
+ * \param (nfdev_control_str) Value to write to HSM control register
+ */
+#define NFDEV_IOCTL_NUM_CONTROL        0x08
+
+/** Module state ioctl
+ * \return (nfdev_status_str) Values read from HSM status/error registers
+ */
+#define NFDEV_IOCTL_NUM_STATUS         0x09
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/nfdev-solaris.h b/usr/src/uts/common/io/nfp/nfdev-solaris.h
new file mode 100644
index 0000000000..923b902e46
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfdev-solaris.h
@@ -0,0 +1,37 @@
+/*
+
+nfdev-solaris.h: nFast solaris specific device ioctl interface.
+
+(C) Copyright nCipher Corporation Ltd 1998-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+14/07/1998 jsh  Original
+
+*/
+
+#ifndef NFDEV_SOLARIS_H
+#define NFDEV_SOLARIS_H
+
+#include "nfdev-common.h"
+
+#define NFDEV_IOCTL_TYPE ('n'<<8)
+
+#define NFDEV_IOCTL_ENQUIRY		( NFDEV_IOCTL_TYPE | \
+					  NFDEV_IOCTL_NUM_ENQUIRY )
+#define NFDEV_IOCTL_ENSUREREADING	( NFDEV_IOCTL_TYPE | \
+					  NFDEV_IOCTL_NUM_ENSUREREADING )
+#define NFDEV_IOCTL_DEVCOUNT		( NFDEV_IOCTL_TYPE | \
+					  NFDEV_IOCTL_NUM_DEVCOUNT )
+#define NFDEV_IOCTL_DEBUG		( NFDEV_IOCTL_TYPE | \
+					  NFDEV_IOCTL_NUM_DEBUG )
+#define NFDEV_IOCTL_PCI_IFVERS		( NFDEV_IOCTL_TYPE | \
+					  NFDEV_IOCTL_NUM_PCI_IFVERS )
+#define NFDEV_IOCTL_STATS		( NFDEV_IOCTL_TYPE | \
+					  NFDEV_IOCTL_NUM_STATS )
+
+#endif /* NFDEV_SOLARIS_H */
diff --git a/usr/src/uts/common/io/nfp/nfp.h b/usr/src/uts/common/io/nfp/nfp.h
new file mode 100644
index 0000000000..9704f04fbc
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfp.h
@@ -0,0 +1,113 @@
+/*
+
+nfp.h: nFast PCI driver for Solaris 2.5, 2.6 and 2.7
+
+(C) Copyright nCipher Corporation Ltd 2001-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+06/05/1998 jsh  Original solaris 2.6
+21/05/1999 jsh  added support for solaris 2.5
+10/06/1999 jsh  added support for solaris 2.7 (32 and 64 bit)
+16/10/2001 jsh  moved from nfast to new structure in nfdrv
+
+*/
+
+#ifndef NFP_H
+#define NFP_H
+
+#ifndef _KERNEL
+#error Hello?  this is a driver, please compile with -D_KERNEL
+#endif
+
+#if ( CH_KERNELVER < 260 )
+typedef int ioctlptr_t;
+typedef unsigned short uint16_t;
+#define DDI_GET32    ddi_getl
+#define DDI_PUT32    ddi_putl
+#define DDI_GET16    ddi_getw
+#define DDI_PUT16    ddi_putw
+#define DDI_REP_GET8 ddi_rep_getb
+#define DDI_REP_PUT8 ddi_rep_putb
+#define DDI_REP_GET32 ddi_rep_getl
+#define DDI_REP_PUT32 ddi_rep_putl
+#define PCI_CONFIG_GET16 pci_config_getw
+#else /* ( CH_KERNELVER >= 260 ) */
+typedef intptr_t ioctlptr_t;
+#define DDI_GET32    ddi_get32
+#define DDI_PUT32    ddi_put32
+#define DDI_GET16    ddi_get16
+#define DDI_PUT16    ddi_put16
+#define DDI_REP_GET8 ddi_rep_get8
+#define DDI_REP_PUT8 ddi_rep_put8
+#define DDI_REP_GET32 ddi_rep_get32
+#define DDI_REP_PUT32 ddi_rep_put32
+#define PCI_CONFIG_GET16 pci_config_get16
+#endif
+
+#if ( CH_KERNELVER < 270 )
+typedef int nfp_timeout_t;
+#define EXTRA_CB_FLAGS 0
+#define VSXPRINTF(s, n, format, ap) vsprintf (s, format, ap)
+#else /* ( CH_KERNELVER >= 270 ) */
+typedef timeout_id_t nfp_timeout_t;
+#define EXTRA_CB_FLAGS D_64BIT
+#define VSXPRINTF(s, n, format, ap) vsnprintf(s, n, format, ap)
+#endif
+
+typedef struct nfp_dev {
+  int rd_ok;
+  int wr_ok;
+
+  int ifvers;
+
+  /* for PCI push read interface */
+  unsigned char *read_buf;
+  ddi_dma_handle_t read_dma_handle;
+  ddi_dma_cookie_t read_dma_cookie;
+
+  ddi_acc_handle_t acchandle;
+
+  int rd_dma_ok;
+
+  nfp_timeout_t wrtimeout;
+  nfp_timeout_t rdtimeout;
+
+  struct buf *wr_bp;
+  int wr_ready;
+  int rd_ready;
+  int rd_pending;
+  int rd_outstanding;
+  kcondvar_t rd_cv;
+
+  struct pollhead pollhead;
+  dev_info_t *dip;
+
+  ddi_iblock_cookie_t high_iblock_cookie; /* for mutex */
+  ddi_iblock_cookie_t low_iblock_cookie; /* for mutex */
+  kmutex_t high_mutex;
+  kmutex_t low_mutex;
+  int high_intr;
+  ddi_softintr_t soft_int_id;
+  int high_read;
+  int high_write;
+
+  ddi_iblock_cookie_t iblock_cookie; /* for mutex */
+  kmutex_t isr_mutex;
+
+  kmutex_t busy_mutex;
+  int busy;
+ 
+  ddi_acc_handle_t conf_handle;
+
+  nfp_cdev common;
+  const nfpcmd_dev *cmddev;
+} nfp_dev;
+
+extern struct nfp_dev *nfp_dev_list[];
+
+#endif /* NFP_H */
diff --git a/usr/src/uts/common/io/nfp/nfp_cmd.h b/usr/src/uts/common/io/nfp/nfp_cmd.h
new file mode 100644
index 0000000000..db8af0b2f9
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfp_cmd.h
@@ -0,0 +1,68 @@
+/*
+
+nfp_cmd.h: nCipher PCI HSM command driver decalrations
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+10/10/2001 jsh  Original
+
+*/
+
+#ifndef NFPCMD_H
+#define NFPCMD_H
+
+#include "nfp_hostif.h"
+#include "nfp_error.h"
+
+/* read and write called with userspace buffer */
+
+typedef struct nfpcmd_dev {
+  const char *name;
+  unsigned short vendorid, deviceid,
+                 sub_vendorid, sub_deviceid;
+  unsigned int bar_sizes[6];    /* includes IO bit */
+  unsigned int flags;
+  nfp_err (*create)(struct nfp_cdev *pdev);
+  nfp_err (*destroy)(void * ctx);
+  nfp_err (*open)(void * ctx);
+  nfp_err (*close)(void * ctx);
+  nfp_err (*isr)(void *ctx, int *handled);
+  nfp_err (*write_block)( const char *ublock, int len, void *ctx );
+  nfp_err (*read_block)( char *ublock, int len, void *ctx, int *rcount);
+  nfp_err (*channel_update)( char *data, int len, void *ctx);
+  nfp_err (*ensure_reading)( unsigned int addr, int len, void *ctx );
+  nfp_err (*debug)( int cmd, void *ctx);
+} nfpcmd_dev;
+
+#define NFP_CMD_FLG_NEED_IOBUF	0x1
+
+/* list of all supported drivers ---------------------------------------- */
+
+extern const nfpcmd_dev *nfp_drvlist[];
+
+extern const nfpcmd_dev i21285_cmddev;
+extern const nfpcmd_dev i21555_cmddev;
+extern const nfpcmd_dev bcm5820_cmddev;
+
+#ifndef PCI_BASE_ADDRESS_SPACE_IO
+#define PCI_BASE_ADDRESS_SPACE_IO	0x1
+#endif
+
+#define NFP_MAXDEV	16
+
+
+#define NFP_MEMBAR_MASK    ~0xf
+#define NFP_IOBAR_MASK     ~0x3
+/*
+   This masks off the bottom bits of the PCI_CSR_BAR which signify that the
+   BAR is an IO BAR rather than a MEM BAR 
+*/ 
+
+#endif
+
diff --git a/usr/src/uts/common/io/nfp/nfp_common.h b/usr/src/uts/common/io/nfp/nfp_common.h
new file mode 100644
index 0000000000..d1d2100fea
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfp_common.h
@@ -0,0 +1,68 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+#ifndef NFP_COMMON_H
+#define NFP_COMMON_H
+
+#include <sys/types.h>
+#include <sys/conf.h>
+
+typedef uint32_t UINT32;
+typedef uint8_t BYTE;
+
+#define DEFINE_NFPCI_PACKED_STRUCTS
+#include "nfpci.h"
+#include "nfdev-solaris.h"
+
+typedef int oserr_t;
+
+#if CH_BIGENDIAN
+
+/* Big Endian Sparc */
+
+#define SWP32(x) \
+( (((unsigned int)(x)>>24)&0xff) | (((unsigned int)(x)>>8)&0xff00) | (((unsigned int)(x)<<8)&0xff0000) | (((unsigned int)(x)<<24)&0xff000000) ) 
+
+#define SWP16(x) ( (((x)>>8)&0xff) | (((x)<<8)&0xff00) )
+
+#define FROM_LE32_IO(x)		SWP32(*x)
+#define TO_LE32_IO(x,y)		*x=SWP32(y)
+
+#define FROM_LE32_MEM(x)	SWP32(*x)
+#define TO_LE32_MEM(x,y)	*x=SWP32(y)
+
+#define FROM_LE16_IO(x)		SWP16(*x)
+#define TO_LE16_IO(x,y)		*x=SWP16(y)
+
+#else
+
+/* Little Endian x86 */
+
+#define FROM_LE32_IO(x) (*x)
+#define TO_LE32_IO(x,y) (*x=y)
+
+#define FROM_LE32_MEM(x) (*x)
+#define TO_LE32_MEM(x,y) (*x=y)
+
+#define FROM_LE16_IO(x) (*x)
+#define TO_LE16_IO(x,y) (*x=y)
+
+#endif /* !CH_BIGENDIAN */
+
+#include <sys/types.h>
+
+#if CH_KERNELVER == 260
+#define nfp_get_lbolt( lbolt, err ) err= drv_getparm( LBOLT, lbolt )
+#else
+#define nfp_get_lbolt( lbolt, err ) { *lbolt= ddi_get_lbolt(); err= 0; }
+#endif
+
+#endif
+
diff --git a/usr/src/uts/common/io/nfp/nfp_error.h b/usr/src/uts/common/io/nfp/nfp_error.h
new file mode 100644
index 0000000000..d64cb78fd4
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfp_error.h
@@ -0,0 +1,48 @@
+/*
+
+nfp_error.h: nCipher PCI HSM error handling
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+05/12/2001 jsh  Original
+
+*/
+
+#ifndef NFP_ERROR_H
+#define NFP_ERROR_H
+
+#include "nfp_common.h"
+
+#define NFP_SUCCESS	0x0
+#define NFP_EFAULT      0x1
+#define NFP_ENOMEM	0x2
+#define NFP_EINVAL	0x3
+#define NFP_EIO		0x4
+#define NFP_ENXIO	0x5
+#define NFP_ENODEV	0x6
+#define NFP_EINTR	0x7
+#define NFP_ESTARTING	0x8
+#define NFP_EAGAIN	0x9
+#define NFP_EUNKNOWN	0x100
+
+typedef int nfp_err;
+
+extern oserr_t nfp_oserr( nfp_err nerr );
+extern nfp_err nfp_error( oserr_t oerr );
+
+#define nfr( x) \
+  return nfp_error((x))
+
+#define nfer(x, fn, msg) \
+  { oserr_t err=(x); if(err) { nfp_log( NFP_DBG1, #fn ": " msg); return nfp_error(err); } }
+
+#define er(x, fn, msg ) \
+{ nfp_err err=(x); if(err) { nfp_log( NFP_DBG1, #fn ": " msg); return err; } }
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/nfp_hostif.h b/usr/src/uts/common/io/nfp/nfp_hostif.h
new file mode 100644
index 0000000000..3e7d8187e5
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfp_hostif.h
@@ -0,0 +1,54 @@
+/*
+
+nfp_hostif.h: nCipher PCI HSM host interface declarations
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+10/10/2001 jsh  Original
+
+*/
+
+#ifndef NFP_HOSTIF_H
+#define NFP_HOSTIF_H
+
+#include "nfdev-common.h"
+
+struct nfp_dev;
+
+/* common device structure */
+
+typedef struct nfp_cdev {
+  unsigned char *bar[6];
+  void *extra[6];
+
+  int busno;
+  int slotno;
+
+  void *cmdctx;
+
+  char *iobuf;
+
+  struct nfp_dev* dev;
+
+  struct nfdev_stats_str stats;
+
+} nfp_cdev;
+
+/* callbacks from command drivers -------------------------------------- */
+
+void nfp_read_complete(  struct nfp_dev *pdev, int ok);
+void nfp_write_complete( struct nfp_dev *pdev, int ok);
+
+#define NFP_READ_MAX (8 * 1024)
+#define NFP_READBUF_SIZE (NFP_READ_MAX + 8)
+#define NFP_TIMEOUT_SEC 10
+
+#define NFP_DRVNAME "nCipher nFast PCI driver"
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/nfp_ifvers.c b/usr/src/uts/common/io/nfp/nfp_ifvers.c
new file mode 100644
index 0000000000..807b4f24c5
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfp_ifvers.c
@@ -0,0 +1,51 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+/*
+ * nfp_ifervs.c  - common pci interface versioning
+ *
+ * uses:
+ *
+ * int pdev->ifvers
+ *     device interface version
+ *
+ * int nfp_ifvers
+ *     interface version limit
+ * 
+ * int nfp_alloc_pci_push( nfp_dev *pdev )
+ *     allocates resources needed for PCI Push,
+ *     if not already allocated, and return True if successful
+ *
+ * void nfp_free_pci_push( nfp_dev *pdev ) {
+ *     frees any resources allocated to PCI Push
+ */
+
+void nfp_set_ifvers( nfp_dev *pdev, int vers ) {
+  if( nfp_ifvers != 0 && vers > nfp_ifvers ) {
+    nfp_log( NFP_DBG2,
+             "nfp_set_ifvers: can't set ifvers %d"
+             " as nfp_ifvers wants max ifvers %d",
+             vers, nfp_ifvers);
+    return;
+  }
+  if( vers >= NFDEV_IF_PCI_PUSH ) {
+    if(!nfp_alloc_pci_push(pdev)) {
+      nfp_log( NFP_DBG1,
+               "nfp_set_ifvers: can't set ifvers %d"
+               " as resources not available",
+               vers);
+      return;
+    }
+  } else {
+    nfp_free_pci_push(pdev);
+  }
+  pdev->ifvers= vers;
+  nfp_log( NFP_DBG3, "nfp_set_ifvers: setting ifvers %d", vers);
+}
diff --git a/usr/src/uts/common/io/nfp/nfp_osif.h b/usr/src/uts/common/io/nfp/nfp_osif.h
new file mode 100644
index 0000000000..17ffe469ce
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfp_osif.h
@@ -0,0 +1,105 @@
+/*
+
+nfp_osif.h: nCipher PCI HSM OS interface declarations
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+history
+
+10/10/2001 jsh  Original
+
+*/
+
+#ifndef NFP_OSIF_H
+#define NFP_OSIF_H
+
+#include "nfp_hostif.h"
+#include "nfp_error.h"
+
+/* general typedefs ----------------------------------------------- */
+
+typedef volatile unsigned int reg32;
+typedef volatile unsigned short reg16;
+typedef volatile unsigned char reg8;
+
+/* sempaphores, mutexs and events --------------------------------- */
+
+#if 0
+extern nfp_err nfp_sema_init( nfp_sema *sema, int initial);
+extern void nfp_sema_destroy( nfp_sema *sema );
+extern void nfp_sema_post( nfp_sema *sema );
+extern void nfp_sema_wait( nfp_sema *sema );
+extern int nfp_sema_wait_sig( nfp_sema *sema );
+
+extern nfp_err nfp_mutex_init( nfp_mutex *mutex );
+extern void nfp_mutex_destroy( nfp_mutex *mutex );
+extern void nfp_mutex_enter( nfp_mutex *mutex );
+extern void nfp_mutex_exit( nfp_mutex *mutex );
+
+extern nfp_err nfp_event_init( nfp_event *event );
+extern void nfp_event_destroy( nfp_event *event );
+extern void nfp_event_set( nfp_event *event );
+extern void nfp_event_clear( nfp_event *event );
+extern void nfp_event_wait( nfp_event *event );
+extern void nfp_event_wait_sig( nfp_event *event );
+
+#endif
+
+/* timeouts ------------------------------------------------------ */
+
+extern void nfp_sleep( int ms );
+
+/* memory handling ----------------------------------------------- */
+
+#define KMALLOC_DMA	0
+#define KMALLOC_CACHED	1
+
+extern void *nfp_kmalloc( int size, int flags );
+extern void *nfp_krealloc( void *ptr, int size, int flags );
+extern void nfp_kfree( void * );
+
+/* config space access ------------------------------------------------ */
+
+/* return Little Endian 32 bit config register */
+extern nfp_err nfp_config_inl( nfp_cdev *pdev, int offset, unsigned int *res );
+
+/* io space access ------------------------------------------------ */
+
+extern unsigned int nfp_inl( nfp_cdev *pdev, int bar, int offset );
+extern unsigned short nfp_inw( nfp_cdev *pdev, int bar, int offset );
+extern void nfp_outl( nfp_cdev *pdev, int bar, int offset, unsigned int data );
+extern void nfp_outw( nfp_cdev *pdev, int bar, int offset, unsigned short data );
+
+/* user and device memory space access ---------------------------- */
+
+/* NB these 2 functions are not guarenteed to be re-entrant for a given device */
+extern nfp_err nfp_copy_from_user_to_dev( nfp_cdev *cdev, int bar, int offset, const char *ubuf, int len);
+extern nfp_err nfp_copy_to_user_from_dev( nfp_cdev *cdev, int bar, int offset, char *ubuf, int len);
+
+extern nfp_err nfp_copy_from_user( char *kbuf, const char *ubuf, int len );
+extern nfp_err nfp_copy_to_user( char *ubuf, const char *kbuf, int len );
+
+extern nfp_err nfp_copy_from_dev( nfp_cdev *cdev, int bar, int offset, char *kbuf, int len );
+extern nfp_err nfp_copy_to_dev( nfp_cdev *cdev, int bar, int offset, const char *kbuf, int len);
+
+/* debug ------------------------------------------------------------ */
+
+#define NFP_DBG1	1
+#define NFP_DBGE	NFP_DBG1
+#define NFP_DBG2	2
+#define NFP_DBG3	3
+#define NFP_DBG4	4
+
+#ifdef STRANGE_VARARGS
+extern void nfp_log();
+#else
+extern void nfp_log( int severity, const char *format, ...);
+#endif
+
+extern int nfp_debug;
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/nfpci.h b/usr/src/uts/common/io/nfp/nfpci.h
new file mode 100644
index 0000000000..793f5995e6
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/nfpci.h
@@ -0,0 +1,171 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+/*
+*
+*  NFPCI.H	- nFast PCI interface definition file
+*
+*
+*
+*  1998.06.09	IH	Started
+*
+* The interface presented by nFast PCI devices consists of:
+*
+* A region of shared RAM used for data transfer & control information
+* A doorbell interrupt register, so both sides can give each other interrupts
+* A number of DMA channels for transferring data
+*/
+
+#ifndef NFPCI_H
+#define NFPCI_H
+
+/* Sizes of some regions */
+#define NFPCI_RAM_MINSIZE	0x00100000
+/* This is the minimum size of shared RAM. In future it may be possible to
+   negotiate larger sizes of shared RAM or auto-detect how big it is */
+#define NFPCI_RAM_MINSIZE_JOBS	0x00020000 /* standard jobs only */
+#define NFPCI_RAM_MINSIZE_KERN	0x00040000 /* standard and kernel jobs */
+
+/* Offsets within shared memory space.
+   The following main regions are:
+     jobs input area
+     jobs output area
+     kernel jobs input area
+     kernel output area
+*/
+
+#define NFPCI_OFFSET_JOBS		0x00000000
+#define NFPCI_OFFSET_JOBS_WR		0x00000000
+#define NFPCI_OFFSET_JOBS_RD		0x00010000
+#define NFPCI_OFFSET_KERN		0x00020000
+#define NFPCI_OFFSET_KERN_WR		0x00020000
+#define NFPCI_OFFSET_KERN_RD		0x00030000
+
+/* Interrupts, defined by bit position in doorbell register */
+
+/* Interrupts from device to host */
+#define NFAST_INT_DEVICE_WRITE_OK               0x00000001
+#define NFAST_INT_DEVICE_WRITE_FAILED           0x00000002
+#define NFAST_INT_DEVICE_READ_OK                0x00000004
+#define NFAST_INT_DEVICE_READ_FAILED            0x00000008
+#define NFAST_INT_DEVICE_KERN_WRITE_OK		0x00000010
+#define NFAST_INT_DEVICE_KERN_WRITE_FAILED	0x00000020
+#define NFAST_INT_DEVICE_KERN_READ_OK		0x00000040
+#define NFAST_INT_DEVICE_KERN_READ_FAILED	0x00000080
+
+/* Interrupts from host to device */
+#define NFAST_INT_HOST_WRITE_REQUEST            0x00010000
+#define NFAST_INT_HOST_READ_REQUEST             0x00020000
+#define NFAST_INT_HOST_DEBUG                    0x00040000
+#define NFAST_INT_HOST_KERN_WRITE_REQUEST	0x00080000
+#define NFAST_INT_HOST_KERN_READ_REQUEST	0x00100000
+
+/* Ordinary job submission ------------------------ */
+
+/* The NFPCI_OFFSET_JOBS_WR and NFPCI_OFFSET_JOBS_RD regions are defined
+   by the following (byte) address offsets... */
+
+#define NFPCI_OFFSET_CONTROL	0x0
+#define NFPCI_OFFSET_LENGTH	0x4
+#define NFPCI_OFFSET_DATA	0x8
+#define NFPCI_OFFSET_PUSH_ADDR	0x8
+
+#define NFPCI_JOBS_WR_CONTROL	(NFPCI_OFFSET_JOBS_WR + NFPCI_OFFSET_CONTROL)
+#define NFPCI_JOBS_WR_LENGTH	(NFPCI_OFFSET_JOBS_WR + NFPCI_OFFSET_LENGTH)
+#define NFPCI_JOBS_WR_DATA	(NFPCI_OFFSET_JOBS_WR + NFPCI_OFFSET_DATA)
+#define NFPCI_MAX_JOBS_WR_LEN		(0x0000FFF8)
+
+#define NFPCI_JOBS_RD_CONTROL	(NFPCI_OFFSET_JOBS_RD + NFPCI_OFFSET_CONTROL)
+#define NFPCI_JOBS_RD_LENGTH	(NFPCI_OFFSET_JOBS_RD + NFPCI_OFFSET_LENGTH)
+#define NFPCI_JOBS_RD_DATA	(NFPCI_OFFSET_JOBS_RD + NFPCI_OFFSET_DATA)
+/* address in PCI space of host buffer for NFPCI_JOB_CONTROL_PCI_PUSH */
+#define NFPCI_JOBS_RD_PUSH_ADDR	(NFPCI_OFFSET_JOBS_RD + NFPCI_OFFSET_PUSH_ADDR)
+#define NFPCI_MAX_JOBS_RD_LEN		(0x000FFF8)
+
+/* Kernel inferface job submission ---------------- */
+
+#define NFPCI_KERN_WR_CONTROL   (NFPCI_OFFSET_KERN_WR + NFPCI_OFFSET_CONTROL)
+#define NFPCI_KERN_WR_LENGTH    (NFPCI_OFFSET_KERN_WR + NFPCI_OFFSET_LENGTH)
+#define NFPCI_KERN_WR_DATA      (NFPCI_OFFSET_KERN_WR + NFPCI_OFFSET_DATA)
+#define NFPCI_MAX_KERN_WR_LEN      (0x0000FFF8)
+
+#define NFPCI_KERN_RD_CONTROL   (NFPCI_OFFSET_KERN_RD + NFPCI_OFFSET_CONTROL)
+#define NFPCI_KERN_RD_LENGTH    (NFPCI_OFFSET_KERN_RD + NFPCI_OFFSET_LENGTH)
+#define NFPCI_KERN_RD_DATA      (NFPCI_OFFSET_KERN_RD + NFPCI_OFFSET_DATA)
+/* address in PCI space of host buffer for NFPCI_JOB_CONTROL_PCI_PUSH */
+#define NFPCI_KERN_RD_ADDR      (NFPCI_OFFSET_KERN_RD + NFPCI_OFFSET_PUSH_ADDR)
+#define NFPCI_MAX_KERN_RD_LEN		(0x000FFF8)
+
+#ifdef DEFINE_NFPCI_PACKED_STRUCTS
+typedef struct
+{
+  UINT32	controlword;
+  UINT32	length;		/* length of data to follow */
+  union {
+    BYTE	data[1];
+    UINT32	addr;
+  } uu;
+}
+  NFPCI_JOBS_BLOCK;
+#endif
+
+
+#define NFPCI_JOB_CONTROL		0x00000001
+#define NFPCI_JOB_CONTROL_PCI_PUSH	0x00000002
+/*
+   The 'Control' word is analogous to the SCSI read/write address;
+   1 = standard push/pull IO
+   2 = push/push IO
+
+   To submit a block of job data, the host:
+   - sets the (32-bit, little-endian) word at NFPCI_JOBS_WR_CONTROL to NFPCI_JOB_CONTROL
+   - sets the word at NFPCI_JOBS_WR_LENGTH to the length of the data
+   - copies the data to NFPCI_JOBS_WR_DATA
+   - sets interrupt NFAST_INT_HOST_WRITE_REQUEST in the doorbell register
+   - awaits the NFAST_INT_DEVICE_WRITE_OK (or _FAILED) interrupts back
+
+   To read a block of jobs back, the host:
+   - sets the word at NFPCI_JOBS_RD_CONTROL to NFPCI_JOB_CONTROL
+   - sets the word at NFPCI_JOBS_RD_LENGTH to the max length for returned data
+   - sets interrupt NFAST_INT_HOST_READ_REQUEST
+   - awaits the NFAST_INT_DEVICE_READ_OK (or _FAILED) interrupt
+   - reads the data from NFPCI_JOBS_RD_DATA; the module will set the word at
+	NFPCI_JOBS_RD_LENGTH to its actual length.
+
+   Optionally the host can request the PCI read data to be pushed to host PCI mapped ram:
+   - allocates a contiguous PCI addressable buffer for a NFPCI_JOBS_BLOCK of max
+        size NFPCI_MAX_JOBS_RD_LEN (or NFPCI_MAX_KERN_RD_LEN) + 8
+   - sets the word at NFPCI_JOBS_RD_CONTROL to NFPCI_JOB_CONTROL_PCI_PUSH
+   - sets the word at NFPCI_JOBS_RD_LENGTH to the max length for returned data
+   - sets the word at NFPCI_JOBS_RD_PUSH_ADDR to be the host PCI address of
+        the buffer
+   - sets interrupt NFAST_INT_HOST_READ_REQUEST
+   - awaits the NFAST_INT_DEVICE_READ_OK (or _FAILED) interrupt
+   - reads the data from the buffer at NFPCI_OFFSET_DATA in the buffer.  The
+        module will set NFPCI_OFFSET_LENGTH to the actual length.
+*/
+
+#define NFPCI_SCRATCH_CONTROL       0
+
+#define NFPCI_SCRATCH_CONTROL_HOST_MOI   (1<<0)
+#define NFPCI_SCRATCH_CONTROL_MODE_SHIFT 1
+#define NFPCI_SCRATCH_CONTROL_MODE_MASK  (3<<NFPCI_SCRATCH_CONTROL_MODE_SHIFT)
+
+#define NFPCI_SCRATCH_STATUS        1
+
+#define NFPCI_SCRATCH_STATUS_MONITOR_MOI         (1<<0)
+#define NFPCI_SCRATCH_STATUS_APPLICATION_MOI     (1<<1)
+#define NFPCI_SCRATCH_STATUS_APPLICATION_RUNNING (1<<2)
+#define NFPCI_SCRATCH_STATUS_ERROR               (1<<3)
+
+#define NFPCI_SCRATCH_ERROR_LO      2
+#define NFPCI_SCRATCH_ERROR_HI      3
+
+#endif
diff --git a/usr/src/uts/common/io/nfp/osif.c b/usr/src/uts/common/io/nfp/osif.c
new file mode 100644
index 0000000000..fba62f9a37
--- /dev/null
+++ b/usr/src/uts/common/io/nfp/osif.c
@@ -0,0 +1,184 @@
+/*
+
+(C) Copyright nCipher Corporation Ltd 2002-2008 All rights reserved
+
+Copyright (c) 2008-2013 Thales e-Security All rights reserved
+
+Copyright (c) 2014 Thales UK All rights reserved
+
+*/
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/conf.h>
+#include <sys/uio.h>
+#include <sys/map.h>
+#include <sys/debug.h>
+#include <sys/modctl.h>
+#include <sys/kmem.h>
+#include <sys/cmn_err.h>
+#include <sys/open.h>
+#include <sys/stat.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/pci.h>
+
+#include "nfp_common.h"
+#include "nfp_hostif.h"
+#include "nfp_error.h"
+#include "nfp_osif.h"
+#include "nfp_cmd.h"
+#include "nfp.h"
+#include "autoversion.h"
+
+/* config space access ---------------------------------- */
+
+nfp_err nfp_config_inl( nfp_cdev *pdev, int offset, unsigned int *res ) {
+  unsigned int tmp32;
+  if ( !pdev || !pdev->dev || !pdev->dev->conf_handle )
+    return NFP_ENODEV;
+
+/* pci_config_get32() does byte swapping, so put back to LE */
+  tmp32 = pci_config_get32( pdev->dev->conf_handle, offset );
+  TO_LE32_IO(res, tmp32);
+
+  return NFP_SUCCESS;
+}
+
+/* user space memory access ---------------------------------- */
+
+nfp_err nfp_copy_from_user( char *kbuf, const char *ubuf, int len) {
+  bcopy(ubuf, kbuf, len);
+  return 0;
+}
+
+nfp_err nfp_copy_to_user( char *ubuf, const char *kbuf, int len) {
+  bcopy(kbuf, ubuf, len);
+  return 0;
+}
+
+nfp_err nfp_copy_from_user_to_dev( nfp_cdev *cdev, int bar, int offset, const char *ubuf, int len) {
+  /* dirty hack on Solaris, as we are called from strategy we are, in fact, copying from kernel mem */
+  return nfp_copy_to_dev( cdev, bar, offset, ubuf, len );
+}
+
+nfp_err nfp_copy_to_user_from_dev( nfp_cdev *cdev, int bar, int offset, char *ubuf, int len) {
+  /* dirty hack on Solaris, as we are called from strategy we are, in fact, copying to kernel mem */
+  return nfp_copy_from_dev( cdev, bar, offset, ubuf, len );
+}
+
+nfp_err nfp_copy_from_dev( nfp_cdev *cdev, int bar, int offset, char *kbuf, int len) {
+  if( len & 0x3 || offset & 0x3 )
+    DDI_REP_GET8( cdev->extra[bar], (unsigned char *)kbuf, cdev->bar[bar] + offset, len, DDI_DEV_AUTOINCR);
+  else
+    /* LINTED: alignment */
+    DDI_REP_GET32( cdev->extra[bar], (unsigned int *)kbuf, (unsigned int *)(cdev->bar[bar] + offset), len / 4, DDI_DEV_AUTOINCR);
+  return NFP_SUCCESS;
+}
+
+nfp_err nfp_copy_to_dev( nfp_cdev *cdev, int bar, int offset, const char *kbuf, int len) {
+  if( len & 0x3 || offset & 0x3 )
+    DDI_REP_PUT8( cdev->extra[bar], (unsigned char *)kbuf, cdev->bar[bar] + offset, len, DDI_DEV_AUTOINCR );
+  else
+    /* LINTED: alignment */
+    DDI_REP_PUT32( cdev->extra[bar], (unsigned int *)kbuf, (unsigned int *)(cdev->bar[bar] + offset), len / 4, DDI_DEV_AUTOINCR );
+  return NFP_SUCCESS;
+}
+
+/* pci io space access --------------------------------------- */
+
+unsigned int nfp_inl( nfp_cdev *pdev, int bar, int offset ) {
+  nfp_log( NFP_DBG3, "nfp_inl: addr %x", (uintptr_t) pdev->bar[bar] + offset);
+  /* LINTED: alignment */
+  return DDI_GET32( pdev->extra[bar], (uint32_t *)(pdev->bar[bar] + offset) );
+}
+
+unsigned short nfp_inw( nfp_cdev *pdev, int bar, int offset ) {
+  nfp_log( NFP_DBG3, "nfp_inw: addr %x", (uintptr_t) pdev->bar[bar] + offset);
+  /* LINTED: alignment */
+  return DDI_GET16( pdev->extra[bar], (unsigned short *)(pdev->bar[ bar ] + offset) );
+}
+
+void nfp_outl( nfp_cdev *pdev, int bar, int offset, unsigned int data ) {
+  nfp_log( NFP_DBG3, "nfp_outl: addr %x, data %x", (uintptr_t) pdev->bar[bar] + offset, data);
+  /* LINTED: alignment */
+  DDI_PUT32( pdev->extra[bar], (uint32_t *)(pdev->bar[ bar ] + offset), data ); 
+}
+
+void nfp_outw( nfp_cdev *pdev, int bar, int offset, unsigned short data ) {
+  nfp_log( NFP_DBG3, "nfp_outl: addr %x, data %x", (uintptr_t) pdev->bar[bar] + offset, data);
+  /* LINTED: alignment */
+  DDI_PUT16( pdev->extra[bar], (unsigned short *)(pdev->bar[ bar ] + offset), data ); 
+}
+
+/* logging ---------------------------------------------------- */
+
+void nfp_log( int level, const char *fmt, ...)
+{
+  auto char buf[256];
+  va_list ap;
+
+  switch (level) {
+  case NFP_DBG4: if (nfp_debug < 4) break;
+  /*FALLTHROUGH*/
+  case NFP_DBG3: if (nfp_debug < 3) break;
+  /*FALLTHROUGH*/
+  case NFP_DBG2: if (nfp_debug < 2) break;
+  /*FALLTHROUGH*/
+  case NFP_DBG1: if (nfp_debug < 1) break;
+  /*FALLTHROUGH*/
+  default:
+    va_start(ap, fmt);
+    (void) vsnprintf(buf, 256, fmt, ap);
+    va_end(ap);
+    cmn_err(CE_CONT, "!" VERSION_COMPNAME " " VERSION_NO ": %s\n", buf);
+    break;
+  }
+}
+
+struct errstr {
+  int oserr;
+  nfp_err nferr;
+};
+
+
+static struct errstr errtab[] = {
+  { EFAULT, NFP_EFAULT },
+  { ENOMEM, NFP_ENOMEM },
+  { EINVAL, NFP_EINVAL },
+  { EIO,    NFP_EIO    },
+  { ENXIO,  NFP_ENXIO  },
+  { ENODEV, NFP_ENODEV  },
+  { EINVAL, NFP_EUNKNOWN },
+  { 0, 0 }
+};
+
+nfp_err nfp_error( int oserr )
+{
+  struct errstr *perr;
+  if(!oserr)
+    return 0;
+  perr= errtab;
+  while(perr->nferr) {
+   if(perr->oserr == oserr)
+     return perr->nferr;
+   perr++;
+  }
+  return NFP_EUNKNOWN;
+}
+
+int nfp_oserr( nfp_err nferr )
+{
+  struct errstr *perr;
+  if(nferr == NFP_SUCCESS)
+    return 0;
+  perr= errtab;
+  while(perr->nferr) {
+   if(perr->nferr == nferr)
+     return perr->oserr;
+   perr++;
+  }
+  return EIO;
+}
diff --git a/usr/src/uts/common/io/overlay/overlay.c b/usr/src/uts/common/io/overlay/overlay.c
new file mode 100644
index 0000000000..3f34ec3b58
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay.c
@@ -0,0 +1,2184 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Overlay Devices
+ *
+ * Overlay devices provide a means for creating overlay networks, a means of
+ * multiplexing multiple logical, isolated, and discrete layer two and layer
+ * three networks on top of one physical network.
+ *
+ * In general, these overlay devices encapsulate the logic to answer two
+ * different questions:
+ *
+ *   1) How should I transform a packet to put it on the wire?
+ *   2) Where should I send a transformed packet?
+ *
+ * Each overlay device is presented to the user as a GLDv3 device. While the
+ * link itself cannot have an IP interface created on top of it, it allows for
+ * additional GLDv3 devices, such as a VNIC, to be created on top of it which
+ * can be plumbed up with IP interfaces.
+ *
+ *
+ * --------------------
+ * General Architecture
+ * --------------------
+ *
+ * The logical overlay device that a user sees in dladm(1M) is a combination of
+ * two different components that work together. The first component is this
+ * kernel module, which is responsible for answering question one -- how should
+ * I transform a packet to put it on the wire.
+ *
+ * The second component is what we call the virtual ARP daemon, or varpd. It is
+ * a userland component that is responsible for answering the second question --
+ * Where should I send a transformed packet. Instances of the kernel overlay
+ * GLDv3 device ask varpd the question of where should a packet go.
+ *
+ * The split was done for a few reasons. Importantly, we wanted to keep the act
+ * of generating encapsulated packets in the kernel so as to ensure that the
+ * general data path was fast and also kept simple. On the flip side, while the
+ * question of where should something go may be simple, it may often be
+ * complicated and need to interface with several different external or
+ * distributed systems. In those cases, it's simpler to allow for the full
+ * flexibility of userland to be brought to bear to solve that problem and in
+ * general, the path isn't very common.
+ *
+ * The following is what makes up the logical overlay device that a user would
+ * create with dladm(1M).
+ *
+ *       Kernel                                     Userland
+ *   . . . . . . . . . . . . . . . . . . . . .   . . . . . . . . . . . . .
+ *   . +--------+   +--------+  +--------+   .   .                       .
+ *   . | VNIC 0 |   | VNIC 1 |  | VNIC 2 |   .   .                       .
+ *   . +--------+   +--------+  +--------+   .   .                       .
+ *   .     |            |           |        .   .                       .
+ *   .     |            |           |        .   .                       .
+ *   .     +------------+-----------+        .   .                       .
+ *   .                  |              . . /dev/overlay                  .
+ *   .           +--------------+      .     .   .       +------------+  .
+ *   .           |              |      .     .   .       |            |  .
+ *   .           |    Overlay   |======*=================|   Virtual  |  .
+ *   .           | GLDv3 Device |========================| ARP Daemon |  .
+ *   .           |              |            .   .       |            |  .
+ *   .           +--------------+            .   .       +------------+  .
+ *   .                  |                    .   .              |        .
+ *   .                  |                    .   .              |        .
+ *   .           +----------------+          .   .         +--------+    .
+ *   .           |  Overlay       |          .   .         | varpd  |    .
+ *   .           |  Encapsulation |          .   .         | Lookup |    .
+ *   .           |  Plugin        |          .   .         | Plugin |    .
+ *   .           +----------------+          .   .         +--------+    .
+ *   . . . . . . . . . . . . . . . . . . . . .   . . . . . . . . . . . . .
+ *
+ *
+ * This image shows the two different components and where they live.
+ * Importantly, it also shows that both the kernel overlay device and the
+ * userland varpd both support plugins. The plugins actually implement the
+ * things that users care about and the APIs have been designed to try to
+ * minimize the amount of things that a module writer needs to worry about it.
+ *
+ * IDENTIFIERS
+ *
+ * Every overlay device is defined by a unique identifier which is the overlay
+ * identifier. Its purpose is similar to that of a VLAN identifier, it's a
+ * unique number that is used to differentiate between different entries on the
+ * wire.
+ *
+ * ENCAPSULATION
+ *
+ * An overlay encapsulation plugin is a kernel miscellaneous module whose
+ * purpose is to contain knowledge about how to transform packets to put them
+ * onto the wire and to take them off. An example of an encapsulation plugin is
+ * vxlan. It's also how support for things like nvgre or geneve would be brought
+ * into the system.
+ *
+ * Each encapsulation plugins defines a series of operation vectors and
+ * properties. For the full details on everything they should provide, please
+ * read uts/common/sys/overlay_plugin.h. The encapsulation plugin is responsible
+ * for telling the system what information is required to send a packet. For
+ * example, vxlan is defined to send everything over a UDP packet and therefore
+ * requires a port and an IP address, while nvgre on the other hand is its own
+ * IP type and therefore just requires an IP address. In addition, it also
+ * provides information about the kind of socket that should be created. This is
+ * used by the kernel multiplexor, more of that in the Kernel Components
+ * section.
+ *
+ * LOOKUPS
+ *
+ * The kernel communicates requests for lookups over the character device
+ * /dev/overlay. varpd is responsible for listening for requests on that device
+ * and answering them. The character device is specific to the target path and
+ * varpd.
+ *
+ * Much as the kernel overlay module handles the bulk of the scaffolding but
+ * leaves the important work to the encapsulation plugin, varpd provides a
+ * similar role and leaves the full brunt of lookups to a userland dynamic
+ * shared object which implements the logic of lookups.
+ *
+ * Each lookup plugin defines a series of operation vectors and properties. For
+ * the full details on everything that they should provide, please read
+ * lib/varpd/libvarpd/libvarpd_provider.h. Essentially, they are given a MAC
+ * address and asked to give an address on the physical network that it should
+ * be sent to. In addition, they handle questions related to how to handle
+ * things like broadcast and multicast traffic, etc.
+ *
+ * ----------
+ * Properties
+ * ----------
+ *
+ * A device from a dladm perspective has a unique set of properties that are
+ * combined from three different sources:
+ *
+ *   1) Generic properties that every overlay device has
+ *   2) Properties that are specific to the encapsulation plugin
+ *   3) Properties that are specific to the lookup plugin
+ *
+ * All of these are exposed in a single set of properties in dladm. Note that
+ * these are not necessarily traditional link properties. However, if something
+ * is both a traditional GLDv3 link property, say the MTU of a device, and a
+ * specific property here, than the driver ensures that all existing GLDv3
+ * specific means of manipulating it are used and wraps up its private property
+ * interfaces to ensure that works.
+ *
+ * Properties in the second and third category are prefixed with the name of
+ * their module. For example, the vxlan encapsulation module has a property
+ * called the 'listen_ip'. This property would show up in dladm as
+ * 'vxlan/listen_ip'. This allows different plugins to both use similar names
+ * for similar properties and to also have independent name spaces so that
+ * overlapping names do not conflict with anything else.
+ *
+ * While the kernel combines both sets one and two into a single coherent view,
+ * it does not do anything with respect to the properties that are owned by the
+ * lookup plugin -- those are owned wholly by varpd. Instead, libdladm is in
+ * charge of bridging these two worlds into one magical experience for the user.
+ * It carries the burden of knowing about both overlay specific and varpd
+ * specific properties. Importantly, we want to maintain this distinction. We
+ * don't want to treat the kernel as an arbitrary key/value store for varpd and
+ * we want the kernel to own its own data and not have to ask userland for
+ * information that it owns.
+ *
+ * Every property in the system has the following attributes:
+ *
+ *   o A name
+ *   o A type
+ *   o A size
+ *   o Permissions
+ *   o Default value
+ *   o Valid value ranges
+ *   o A value
+ *
+ * Everything except for the value is obtained by callers through the propinfo
+ * callbacks and a property has a maximum size of OVERLAY_PROP_SIZEMAX,
+ * currently 256 bytes.
+ *
+ * The following are the supported types of properties:
+ *
+ * 	OVERLAY_PROP_T_INT
+ *
+ * 		A signed integer, its length is 8 bytes, corresponding to a
+ * 		int64_t.
+ *
+ * 	OVERLAY_PROP_T_UINT
+ *
+ * 		An unsigned integer, its length is 8 bytes, corresponding to a
+ * 		uint64_t.
+ *
+ * 	OVERLAY_PROP_T_IP
+ *
+ * 		A struct in6_addr, it has a fixed size.
+ *
+ * 	OVERLAY_PROP_T_STRING
+ *
+ * 		A null-terminated character string encoded in either ASCII or
+ * 		UTF-8. Note that the size of the string includes the null
+ * 		terminator.
+ *
+ * The next thing that we apply to a property is its permission. The permissions
+ * are put together by the bitwise or of the following flags and values.
+ *
+ * 	OVERLAY_PROP_PERM_REQ
+ *
+ * 		This indicates a required property. A property that is required
+ * 		must be set by a consumer before the device can be created. If a
+ * 		required property has a default property, this constraint is
+ * 		loosened because the default property defines the value.
+ *
+ * 	OVERLAY_PORP_PERM_READ
+ *
+ * 		This indicates that a property can be read. All properties will
+ * 		have this value set.
+ *
+ * 	OVERLAY_PROP_PERM_WRITE
+ *
+ * 		This indicates that a property can be written to and thus
+ * 		updated by userland. Properties that are only intended to
+ * 		display information, will not have OVERLAY_PROP_PERM_WRITE set.
+ *
+ * In addition, a few additional values are defined as a convenience to
+ * consumers. The first, OVERLAY_PROP_PERM_RW, is a combination of
+ * OVERLAY_PROP_PERM_READ and OVERLAY_PERM_PROP_WRITE. The second,
+ * OVERLAY_PROP_PERM_RRW, is a combination of OVERLAY_PROP_PERM_REQ,
+ * OVERLAY_PROP_PERM_READ, and OVERLAY_PROP_PERM_WRITE. The protection mode of a
+ * property should generally be a constant across its lifetime.
+ *
+ * A property may optionally have a default value. If it does have a default
+ * value, and that property is not set to be a different value, then the default
+ * value is inherited automatically. It also means that if the default value is
+ * acceptable, there is no need to set the value for a required property. For
+ * example, the vxlan module has the vxlan/listen_port property which is
+ * required, but has a default value of 4789 (the IANA assigned port). Because
+ * of that default value, there is no need for it to be set.
+ *
+ * Finally, a property may declare a list of valid values. These valid values
+ * are used for display purposes, they are not enforced by the broader system,
+ * but merely allow a means for the information to be communicated to the user
+ * through dladm(1M). Like a default value, this is optional.
+ *
+ * The general scaffolding does not do very much with respect to the getting and
+ * setting of properties. That is really owned by the individual plugins
+ * themselves.
+ *
+ * -----------------------------
+ * Destinations and Plugin Types
+ * -----------------------------
+ *
+ * Both encapsulation and lookup plugins define the kinds of destinations that
+ * they know how to support. There are three different pieces of information
+ * that can be used to address to a destination currently, all of which is
+ * summarized in the type overlay_point_t. Any combination of these is
+ * supported.
+ *
+ * 	OVERLAY_PLUGIN_D_ETHERNET
+ *
+ * 		An Ethernet MAC address is required.
+ *
+ * 	OVERLAY_PLUGIN_D_IP
+ *
+ * 		An IP address is required. All IP addresses used by the overlay
+ * 		system are transmitted as IPv6 addresses. IPv4 addresses can be
+ * 		represented by using IPv4-mapped IPv6 addresses.
+ *
+ * 	OVERLAY_PLUGIN_D_PORT
+ *
+ * 		A TCP/UDP port is required.
+ *
+ * A kernel encapsulation plugin declares which of these that it requires, it's
+ * a static set. On the other hand, a userland lookup plugin can be built to
+ * support all of these or any combination thereof. It gets passed the required
+ * destination type, based on the kernel encapsulation method, and then it makes
+ * the determination as to whether or not it supports it. For example, the
+ * direct plugin can support either an IP or both an IP and a port, it simply
+ * doesn't display the direct/dest_port property in the cases where a port is
+ * not required to support this.
+ *
+ * The user lookup plugins have two different modes of operation which
+ * determines how they interact with the broader system and how look ups are
+ * performed. These types are:
+ *
+ * 	OVERLAY_TARGET_POINT
+ *
+ * 		A point to point plugin has a single static definition for where
+ * 		to send all traffic. Every packet in the system always gets sent
+ * 		to the exact same destination which is programmed into the
+ * 		kernel when the general device is activated.
+ *
+ * 	OVERLAY_TARGET_DYNAMIC
+ *
+ * 		A dynamic plugin does not have a single static definition.
+ * 		Instead, for each destination, the kernel makes an asynchronous
+ * 		request to varpd to determine where the packet should be routed,
+ * 		and if a specific destination is found, then that destination is
+ * 		cached in the overlay device's target cache.
+ *
+ * This distinction, while important for the general overlay device's operation,
+ * is not important to the encapsulation plugins. They don't need to know about
+ * any of these pieces. It's just a concern for varpd, the userland plugin, and
+ * the general overlay scaffolding.
+ *
+ * When an overlay device is set to OVERLAY_TARGET_POINT, then it does not
+ * maintain a target cache, and instead just keeps track of the destination and
+ * always sends encapsulated packets to that address. When the target type is of
+ * OVERLAY_TARGET_DYNAMIC, then the kernel maintains a cache of all such
+ * destinations. These destinations are kept around in an instance of a
+ * reference hash that is specific to the given overlay device. Entries in the
+ * cache can be invalidated and replaced by varpd and its lookup plugins.
+ *
+ * ----------------------------------
+ * Kernel Components and Architecture
+ * ----------------------------------
+ *
+ * There are multiple pieces inside the kernel that work together, there is the
+ * general overlay_dev_t structure, which is the logical GLDv3 device, but it
+ * itself has references to things like an instance of an encapsulation plugin,
+ * a pointer to a mux and a target cache. It can roughly be summarized in the
+ * following image:
+ *
+ *     +------------------+
+ *     | global           |
+ *     | overlay list     |
+ *     | overlay_dev_list |
+ *     +------------------+
+ *        |
+ *        |  +-----------------------+            +---------------+
+ *        +->| GLDv3 Device          |----------->| GLDv3 Device  | -> ...
+ *           | overlay_dev_t         |            | overlay_dev_t |
+ *           |                       |            +---------------+
+ *           |                       |
+ *           | mac_handle_t     -----+---> GLDv3 handle to MAC
+ *           | datalink_id_t    -----+---> Datalink ID used by DLS
+ *           | overlay_dev_flag_t ---+---> Device state
+ *           | uint_t           -----+---> Curent device MTU
+ *           | uint_t           -----+---> In-progress RX operations
+ *           | uint_t           -----+---> In-progress TX operations
+ *           | char[]           -----+---> FMA degraded message
+ *           | void *           -----+---> plugin private data
+ *           | overlay_target_t * ---+---------------------+
+ *           | overlay_plugin_t * ---+---------+           |
+ *           +-----------------------+         |           |
+ *                           ^                 |           |
+ *   +--------------------+  |                 |           |
+ *   | Kernel Socket      |  |                 |           |
+ *   | Multiplexor        |  |                 |           |
+ *   | overlay_mux_t      |  |                 |           |
+ *   |                    |  |                 |           |
+ *   | avl_tree_t        -+--+                 |           |
+ *   | uint_t            -+--> socket family   |           |
+ *   | uint_t            -+--> socket type     |           |
+ *   | uint_t            -+--> socket protocol |           |
+ *   | ksocket_t         -+--> I/O socket      |           |
+ *   | struct sockaddr * -+--> ksocket address |           |
+ *   | overlay_plugin_t --+--------+           |           |
+ *   +--------------------+        |           |           |
+ *                                 |           |           |
+ *   +-------------------------+   |           |           |
+ *   | Encap Plugin            |<--+-----------+           |
+ *   | overlay_plugin_t        |                           |
+ *   |                         |                           |
+ *   | char *               ---+--> plugin name            |
+ *   | overlay_plugin_ops_t * -+--> plugin downcalls       |
+ *   | char ** (props)      ---+--> property list          |
+ *   | uint_t               ---+--> id length              |
+ *   | overlay_plugin_flags_t -+--> plugin flags           |
+ *   | overlay_plugin_dest_t --+--> destination type       v
+ *   +-------------------------+                    +-------------------------+
+ *                                                  |   Target Cache          |
+ *                                                  |   overlay_target_t      |
+ *                                                  |                         |
+ *                                    cache mode <--+- overlay_target_mode_t  |
+ *                                     dest type <--+- overlay_plugin_dest_t  |
+ *                                   cache flags <--+- overlay_target_flag_t  |
+ *                                     varpd id  <--+- uint64_t               |
+ *                       outstanding varpd reqs. <--+- uint_t                 |
+ *                   OVERLAY_TARGET_POINT state  <--+- overlay_target_point_t |
+ *               OVERLAY_TARGET_DYNAMIC state <-+---+- overlay_target_dyn_t   |
+ *                                              |   +-------------------------+
+ *                      +-----------------------+
+ *                      |
+ *                      v
+ *   +-------------------------------+   +------------------------+
+ *   | Target Entry                  |-->| Target Entry           |--> ...
+ *   | overlay_target_entry_t        |   | overlay_target_entry_t |
+ *   |                               |   +------------------------+
+ *   |                               |
+ *   | overlay_target_entry_flags_t -+--> Entry flags
+ *   | uint8_t[ETHERADDRL]        ---+--> Target MAC address
+ *   | overlay_target_point_t     ---+--> Target underlay address
+ *   | mblk_t *                   ---+--> outstanding mblk head
+ *   | mblk_t *                   ---+--> outstanding mblk tail
+ *   | size_t                     ---+--> outstanding mblk size
+ *   +-------------------------------+
+ *
+ * The primary entries that we care about are the overlay_dev_t, which
+ * correspond to each overlay device that is created with dladm(1M). Globally,
+ * these devices are maintained in a simple list_t which is protected with a
+ * lock.  Hence, these include important information such as the mac_handle_t
+ * and a datalink_id_t which is used to interact with the broader MAC and DLS
+ * ecosystem. We also maintain additional information such as the current state,
+ * outstanding operations, the mtu, and importantly, the plugin's private data.
+ * This is the instance of an encapsulation plugin that gets created as part of
+ * creating an overlay device. Another aspect of this is that the overlay_dev_t
+ * also includes information with respect to FMA. For more information, see the
+ * FMA section.
+ *
+ * Each overlay_dev_t has a pointer to a plugin, a mux, and a target. The plugin
+ * is the encapsulation plugin. This allows the device to make downcalls into it
+ * based on doing things like getting and setting properties. Otherwise, the
+ * plugin itself is a fairly straightforward entity. They are maintained in an
+ * (not pictured above) list. The plugins themselves mostly maintain things like
+ * the static list of properties, what kind of destination they require, and the
+ * operations vector. A given module may contain more if necessary.
+ *
+ * The next piece of the puzzle is the mux, or a multiplexor. The mux itself
+ * maintains a ksocket and it is through the mux that we send and receive
+ * message blocks. The mux represents a socket type and address, as well as a
+ * plugin. Multiple overlay_dev_t devices may then share the same mux. For
+ * example, consider the case where you have different instances of vxlan all on
+ * the same underlay network. These would all logically share the same IP
+ * address and port that packets are sent and received on; however, what differs
+ * is the decapuslation ID.
+ *
+ * Each mux maintains a ksocket_t which is similar to a socket(3SOCKET). Unlike
+ * a socket, we enable a direct callback on the ksocket. This means that
+ * whenever a message block chain is received, rather than sitting there and
+ * getting a callback in a context and kicking that back out to a taskq. Instead
+ * data comes into the callback function overlay_mux_recv().
+ *
+ * The mux is given encapsulated packets (via overlay_m_tx, the GLDv3 tx
+ * function) to transmit. It receives encapsulated packets, decapsulates them to
+ * determine the overlay identifier, looks up the given device that matches that
+ * identifier, and then causes the broader MAC world to receive the packet with
+ * a call to mac_rx().
+ *
+ * Today, we don't do too much that's special with the ksocket; however, as
+ * hardware is gaining understanding for these encapuslation protocols, we'll
+ * probably want to think of better ways to get those capabilities passed down
+ * and potentially better ways to program receive filters so they get directly
+ * to us. Though, that's all fantasy future land.
+ *
+ * The next part of the puzzle is the target cache. The purpose of the target
+ * cache is to cache where we should send a packet on the underlay network,
+ * given its mac address. The target cache operates in two modes depending on
+ * whether the lookup module was declared to OVERLAY_TARGET_POINT or
+ * OVERLAY_TARGET_DYANMIC.
+ *
+ * In the case where the target cache has been programmed to be
+ * OVERLAY_TARGET_POINT, then we only maintain a single overlay_target_point_t
+ * which has the destination that we send everything, no matter the destination
+ * mac address.
+ *
+ * On the other hand, when we have an instance of OVERLAY_TARGET_DYNAMIC, things
+ * are much more interesting and as a result, more complicated. We primarily
+ * store lists of overlay_target_entry_t's which are stored in both an avl tree
+ * and a refhash_t. The primary look up path uses the refhash_t and the avl tree
+ * is only used for a few of the target ioctls used to dump data such that we
+ * can get a consistent iteration order for things like dladm show-overlay -t.
+ * The key that we use for the reference hashtable is based on the mac address
+ * in the cache and currently we just do a simple CRC32 to transform it into a
+ * hash.
+ *
+ * Each entry maintains a set of flags to indicate the current status of the
+ * request. The flags may indicate one of three states: that current cache entry
+ * is valid, that the current cache entry has been directed to drop all output,
+ * and that the current cache entry is invalid and may be being looked up. In
+ * the case where it's valid, we just take the destination address and run with
+ * it.
+ *
+ * If it's invalid and a lookup has not been made, then we start the process
+ * that prepares a query that will make its way up to varpd. The cache entry
+ * entry maintains a message block chain of outstanding message blocks and a
+ * size. These lists are populated only when we don't know the answer as to
+ * where should these be sent. The size entry is used to cap the amount of
+ * outstanding data that we don't know the answer to. If we exceed a cap on the
+ * amount of outstanding data (currently 1 Mb), then we'll drop any additional
+ * packets. Once we get an answer indicating a valid destination, we transmit
+ * any outstanding data to that place. For the full story on how we look that up
+ * will be discussed in the section on the Target Cache Lifecycle.
+ *
+ * ------------------------
+ * FMA and Degraded Devices
+ * ------------------------
+ *
+ * Every kernel overlay device keeps track of its FMA state. Today in FMA we
+ * cannot represent partitions between resources nor can we represent that a
+ * given minor node of a psuedo device has failed -- if we degrade the overlay
+ * device, then the entire dev_info_t is degraded. However, we still want to be
+ * able to indicate to administrators that things may go wrong.
+ *
+ * To this end, we've added a notion of a degraded state to every overlay
+ * device. This state is primarily dictated by userland and it can happen for
+ * various reasons. Generally, because a userland lookup plugin has been
+ * partitioned, or something has gone wrong such that there is no longer any
+ * userland lookup module for a device, then we'll mark it degraded.
+ *
+ * As long as any of our minor instances is degraded, then we'll fire off the
+ * FMA event to note that. Once the last degraded instance is no longer
+ * degraded, then we'll end up telling FMA that we're all clean.
+ *
+ * To help administrators get a better sense of which of the various minor
+ * devices is wrong, we store the odd_fmamsg[] character array. This character
+ * array can be fetched with doing a dladm show-overlay -f.
+ *
+ * Note, that it's important that we do not update the link status of the
+ * devices. We want to remain up as much as possible. By changing the link in a
+ * degraded state, this may end up making things worse. We may still actually
+ * have information in the target cache and if we mark the link down, that'll
+ * result in not being able to use it. The reason being that this'll mark all
+ * the downstream VNICs down which will go to IP and from there we end up
+ * dealing with sadness.
+ *
+ * -----------------------
+ * Target Cache Life Cycle
+ * -----------------------
+ *
+ * This section only applies when we have a lookup plugin of
+ * OVERLAY_TARGET_DYNAMIC. None of this applies to those of type
+ * OVERLAY_TARGET_POINT.
+ *
+ * While we got into the target cache in the general architecture section, it's
+ * worth going into more details as to how this actually works and showing some
+ * examples and state machines. Recall that a target cache entry basically has
+ * the following state transition diagram:
+ *
+ * Initial state
+ *    . . .           . . . first access       . . . varpd lookup enqueued
+ *        .           .                        .
+ *        .           .                        .
+ *     +-------+      .     +----------+       .
+ *     |  No   |------*---->| Invalid  |-------*----+
+ *     | Entry |            |  Entry   |            |
+ *     +-------+            +----------+            |
+ *                 varpd      ^      ^   varpd      |
+ *                 invalidate |      |   drop       |
+ *                      . . . *      * . .          v
+ *          +-------+         |      |         +---------+
+ *          | Entry |--->-----+      +----<----| Entry   |
+ *          | Valid |<----------*---------<----| Pending |->-+     varpd
+ *          +-------+           .              +---------+   * . . drop, but
+ *                              . varpd                ^     |     other queued
+ *                              . success              |     |     entries
+ *                                                     +-----+
+ *
+ * When the table is first created, it is empty. As we attempt to lookup entries
+ * and we find there is no entry at all, we'll create a new table entry for it.
+ * At that point the entry is technically in an invalid state, that means that
+ * we have no valid data from varpd. In that case, we'll go ahead and queue the
+ * packet into the entry's pending chain, and queue a varpd lookup, setting the
+ * OVERLAY_ENTRY_F_PENDING flag in the progress.
+ *
+ * If additional mblk_t's come in for this entry, we end up appending them to
+ * the tail of the chain, if and only if, we don't exceed the threshold for the
+ * amount of space they can take up. An entry remains pending until we get a
+ * varpd reply. If varpd replies with a valid results, we move to the valid
+ * entry state, and remove the OVERLAY_ENTRY_F_PENDING flag and set it with one
+ * of OVERLAY_ENTRY_F_VALID or OVERLAY_ENTRY_F_DROP as appropriate.
+ *
+ * Once an entry is valid, it stays valid until user land tells us to invalidate
+ * it with an ioctl or replace it, OVERLAY_TARG_CACHE_REMOE and
+ * OVERLAY_TARG_CACHE_SET respectively.
+ *
+ * If the lookup fails with a call to drop the packet, then the next state is
+ * determined by the state of the queue. If the set of outstanding entries is
+ * empty, then we just transition back to the invalid state. If instead, the
+ * set of outstanding entries is not empty, then we'll queue another entry and
+ * stay in the same state, repeating this until the number of requests is
+ * drained.
+ *
+ * The following images describes the flow of a given lookup and where the
+ * overlay_target_entry_t is at any given time.
+ *
+ *     +-------------------+
+ *     | Invalid Entry     |		An entry starts off as an invalid entry
+ *     | de:ad:be:ef:00:00 |		and only exists in the target cache.
+ *     +-------------------+
+ *
+ * 	~~~~
+ *
+ *     +---------------------+
+ *     | Global list_t       |		A mblk_t comes in for an entry. We
+ *     | overlay_target_list |		append it to the overlay_target_list.
+ *     +---------------------+
+ *                   |
+ *                   v
+ *             +-------------------+      +-------------------+
+ *             | Pending Entry     |----->| Pending Entry     |--->...
+ *             | 42:5e:1a:10:d6:2d |      | de:ad:be:ef:00:00 |
+ *             +-------------------+      +-------------------+
+ *
+ * 	~~~~
+ *
+ *     +--------------------------+
+ *     | /dev/overlay minor state |	User land said that it would look up an
+ *     | overlay_target_hdl_t     |	entry for us. We remove it from the
+ *     +--------------------------+	global list and add it to the handle's
+ *                  |			outstanding list.
+ *                  |
+ *                  v
+ *            +-------------------+      +-------------------+
+ *            | Pending Entry     |----->| Pending Entry     |
+ *            | 90:b8:d0:79:02:dd |      | de:ad:be:ef:00:00 |
+ *            +-------------------+      +-------------------+
+ *
+ * 	~~~~
+ *
+ *     +-------------------+
+ *     | Valid Entry       |		varpd returned an answer with
+ *     | de:ad:be:ef:00:00 |		OVERLAY_IOC_RESPOND and the target cache
+ *     | 10.169.23.42:4789 |		entry is now populated with a
+ *     +-------------------+		destination and marked as valid
+ *
+ *
+ * The lookup mechanism is performed via a series of operations on the character
+ * psuedo-device /dev/overlay. The only thing that uses this device is the
+ * userland daemon varpd. /dev/overlay is a cloneable device, each open of it
+ * granting a new minor number which maintains its own state. We maintain this
+ * state so that way if an outstanding lookup was queued to something that
+ * crashed or closed its handle without responding, we can know about this and
+ * thus handle it appropriately.
+ *
+ * When a lookup is first created it's added to our global list of outstanding
+ * lookups. To service requests, userland is required to perform an ioctl to ask
+ * for a request. We will block it in the kernel a set amount of time waiting
+ * for a request. When we give a request to a given minor instance of the
+ * device, we remove it from the global list and append the request to the
+ * device's list of outstanding entries, for the reasons we discussed above.
+ * When a lookup comes in, we give user land a smaller amount of information
+ * specific to that packet, the overlay_targ_lookup_t. It includes a request id
+ * to identify this, and then the overlay id, the varpd id, the header and
+ * packet size, the source and destination mac address, the SAP, and any
+ * potential VLAN header.
+ *
+ * At that point, it stays in that outstanding list until one of two ioctls are
+ * returned: OVERLAY_TARG_RESPOND or OVERLAY_TARG_DROP. During this time,
+ * userland may also perform other operations. For example, it may use
+ * OVERLAY_TARG_PKT to get a copy of this packet so it can perform more in-depth
+ * analysis of what to do beyond what we gave it initially. This is useful for
+ * providing proxy arp and the like. Finally, there are two other ioctls that
+ * varpd can then do. The first is OVERLAY_TARG_INJECT which injects the
+ * non-jumbo frame packet up into that mac device and OVERLAY_TARG_RESEND which
+ * causes us to encapsulate and send out the packet they've given us.
+ *
+ *
+ * Finally, through the target cache, several ioctls are provided to allow for
+ * interrogation and management of the cache. They allow for individual entries
+ * to be retrieved, set, or have the entire table flushed. For the full set of
+ * ioctls here and what they do, take a look at uts/common/sys/overlay_target.h.
+ *
+ * ------------------
+ * Sample Packet Flow
+ * ------------------
+ *
+ * There's a lot of pieces here, hopefully an example of how this all fits
+ * together will help clarify and elucidate what's going on. We're going to
+ * first track an outgoing packet, eg. one that is sent from an IP interface on
+ * a VNIC on top of an overlay device, and then we'll look at what it means to
+ * respond to that.
+ *
+ *
+ *    +----------------+        +--------------+            +------------------+
+ *    | IP/DLS send    |------->| MAC sends it |----------->| mblk_t reaches   |
+ *    | packet to MAC  |        | to the GLDv3 |            | overlay GLDv3 tx |
+ *    +----------------+        | VNIC device  |            | overlay_m_tx()   |
+ *                              +--------------+            +------------------+
+ *                                                                   |
+ *                             . lookup              . cache         |
+ *                             . drop                . miss          v
+ *            +---------+      .       +--------+    .      +------------------+
+ *            | freemsg |<-----*-------| varpd  |<---*------| Lookup each mblk |
+ *            | mblk_t  |              | lookup |           | in the target    |
+ *            +---------+              | queued |           | cache            |
+ *                ^                    +--------+           +------------------+
+ *      on send   |                        |                         |     cache
+ *      error . . *                        *. . lookup               * . . hit
+ *                |                        |    success              v
+ *                |                        |                +------------------+
+ *    +-----------------+                  +--------------->| call plugin      |
+ *    | Send out        |                                   | ovpo_encap() to  |
+ *    | overlay_mux_t's |<----------------------------------| get encap mblk_t |
+ *    | ksocket         |                                   +------------------+
+ *    +-----------------+
+ *
+ * The receive end point looks a little different and looks more like:
+ *
+ *  +------------------+     +----------------+    +-----------+
+ *  | mblk_t comes off |---->| enter netstack |--->| delivered |---+
+ *  | the physical     |     | IP stack       |    |     to    |   * . . direct
+ *  | device           |     +----------------+    |  ksocket  |   |   callback
+ *  +------------------+                           +-----------+   |
+ *                       . overlay id                              |
+ *                       . not found                               v
+ *       +-----------+   .      +-----------------+       +--------------------+
+ *       | freemsg   |<--*------| call plugin     |<------| overlay_mux_recv() |
+ *       | mblk_t    |          | ovpo_decap() to |       +--------------------+
+ *       +-----------+          | decap mblk_t    |
+ *                              +-----------------+
+ *                                     |
+ *                                     * . . overlay id
+ *                                     v     found
+ *                                 +--------+      +----------------+
+ *                                 | adjust |----->| call mac_rx    |
+ *                                 | mblk_t |      | on original    |
+ *                                 +--------+      | decaped packet |
+ *                                                 +----------------+
+ *
+ * ------------------
+ * Netstack Awareness
+ * ------------------
+ *
+ * In the above image we note that this enters a netstack. Today the only
+ * netstack that can be is the global zone as the overlay driver itself is not
+ * exactly netstack aware. What this really means is that varpd cannot run in a
+ * non-global zone and an overlay device cannot belong to a non-global zone.
+ * Non-global zones can still have a VNIC assigned to them that's been created
+ * over the overlay device the same way they would if it had been created over
+ * an etherstub or a physical device.
+ *
+ * The majority of the work to make it netstack aware is straightforward and the
+ * biggest thing is to create a netstack module that allows us to hook into
+ * netstack (and thus zone) creation and destruction.  From there, we need to
+ * amend the target cache lookup routines that we discussed earlier to not have
+ * a global outstanding list and a global list of handles, but rather, one per
+ * netstack.
+ *
+ * For the mux, we'll need to open the ksocket in the context of the zone, we
+ * can likely do this with a properly composed credential, but we'll need to do
+ * some more work on that path. Finally, we'll want to make sure the dld ioctls
+ * are aware of the zoneid of the caller and we use that appropriately and store
+ * it in the overlay_dev_t.
+ *
+ * -----------
+ * GLDv3 Notes
+ * -----------
+ *
+ * The overlay driver implements a GLDv3 device. Parts of GLDv3 are more
+ * relevant and other parts are much less relevant for us. For example, the
+ * GLDv3 is used to toggle the device being put into and out of promiscuous
+ * mode, to program MAC addresses for unicast and multicast hardware filters.
+ * Today, an overlay device doesn't have a notion of promiscuous mode nor does
+ * it have a notion of unicast and multicast addresses programmed into the
+ * device. Instead, for the purposes of the hardware filter, we don't do
+ * anything and just always accept new addresses being added and removed.
+ *
+ * If the GLDv3 start function has not been called, then we will not use this
+ * device for I/O purposes. Any calls to transmit or receive should be dropped,
+ * though the GLDv3 guarantees us that transmit will not be called without
+ * calling start. Similarly, once stop is called, then no packets can be dealt
+ * with.
+ *
+ * Today we don't support the stat interfaces, though there's no good reason
+ * that we shouldn't assemble some of the stats based on what we have in the
+ * future.
+ *
+ * When it comes to link properties, many of the traditional link properties do
+ * not apply and many others MAC handles for us. For example, we don't need to
+ * implement anything for overlay_m_getprop() to deal with returning the MTU, as
+ * MAC never calls into us for that. As such, there isn't much of anything to
+ * support in terms of properties.
+ *
+ * Today, we don't support any notion of hardware capabilities. However, if
+ * future NIC hardware or other changes to the system cause it to make sense for
+ * us to emulate logical groups, then we should do that. However, we still do
+ * implement a capab function so that we can identify ourselves as an overlay
+ * device to the broader MAC framework. This is done mostly so that a device
+ * created on top of us can have fanout rings as we don't try to lie about a
+ * speed for our device.
+ *
+ * The other question is what should be done for a device's MTU and margin. We
+ * set our minimum supported MTU to be the minimum value that an IP network may
+ * be set to 576 -- which mimics what an etherstub does. On the flip side, we
+ * have our upper bound set to 8900. This value comes from the fact that a lot
+ * of jumbo networks use their maximum as 9000. As such, we want to reserve 100
+ * bytes, which isn't exactly the most accurate number, but it'll be good enough
+ * for now. Because of that, our default MTU off of these devices is 1400, as
+ * the default MTU for everything is usually 1500 or whatever the underlying
+ * device is at; however, this is a bit simpler than asking the netstack what
+ * are all the IP interfaces at. It also calls into question how PMTU and PMTU
+ * discovery should work here. The challenge, especially for
+ * OVERLAY_TARG_DYNAMIC is that the MTU to any of the places will vary and it's
+ * not clear that if you have a single bad entry that the overall MTU should be
+ * lowered. Instead, we should figure out a better way of determining these
+ * kinds of PMTU errors and appropriately alerting the administrator via FMA.
+ *
+ * Regarding margin, we allow a margin of up to VLAN_TAGSZ depending on whether
+ * or not the underlying encapsulation device supports VLAN tags. If it does,
+ * then we'll set the margin to allow for it, otherwise, we will not.
+ */
+
+#include <sys/conf.h>
+#include <sys/errno.h>
+#include <sys/stat.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/modctl.h>
+#include <sys/policy.h>
+#include <sys/stream.h>
+#include <sys/strsubr.h>
+#include <sys/strsun.h>
+#include <sys/types.h>
+#include <sys/kmem.h>
+#include <sys/param.h>
+#include <sys/sysmacros.h>
+#include <sys/ddifm.h>
+
+#include <sys/dls.h>
+#include <sys/dld_ioc.h>
+#include <sys/mac_provider.h>
+#include <sys/mac_client_priv.h>
+#include <sys/mac_ether.h>
+#include <sys/vlan.h>
+
+#include <sys/overlay_impl.h>
+
+dev_info_t *overlay_dip;
+static kmutex_t overlay_dev_lock;
+static list_t overlay_dev_list;
+static uint8_t overlay_macaddr[ETHERADDRL] =
+	{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+typedef enum overlay_dev_prop {
+	OVERLAY_DEV_P_MTU = 0,
+	OVERLAY_DEV_P_VNETID,
+	OVERLAY_DEV_P_ENCAP,
+	OVERLAY_DEV_P_VARPDID
+} overlay_dev_prop_t;
+
+#define	OVERLAY_DEV_NPROPS	4
+static const char *overlay_dev_props[] = {
+	"mtu",
+	"vnetid",
+	"encap",
+	"varpd/id"
+};
+
+#define	OVERLAY_MTU_MIN	576
+#define	OVERLAY_MTU_DEF	1400
+#define	OVERLAY_MTU_MAX	8900
+
+overlay_dev_t *
+overlay_hold_by_dlid(datalink_id_t id)
+{
+	overlay_dev_t *o;
+
+	mutex_enter(&overlay_dev_lock);
+	for (o = list_head(&overlay_dev_list); o != NULL;
+	    o = list_next(&overlay_dev_list, o)) {
+		if (id == o->odd_linkid) {
+			mutex_enter(&o->odd_lock);
+			o->odd_ref++;
+			mutex_exit(&o->odd_lock);
+			mutex_exit(&overlay_dev_lock);
+			return (o);
+		}
+	}
+
+	mutex_exit(&overlay_dev_lock);
+	return (NULL);
+}
+
+void
+overlay_hold_rele(overlay_dev_t *odd)
+{
+	mutex_enter(&odd->odd_lock);
+	ASSERT(odd->odd_ref > 0);
+	odd->odd_ref--;
+	mutex_exit(&odd->odd_lock);
+}
+
+void
+overlay_io_start(overlay_dev_t *odd, overlay_dev_flag_t flag)
+{
+	ASSERT(flag == OVERLAY_F_IN_RX || flag == OVERLAY_F_IN_TX);
+	ASSERT(MUTEX_HELD(&odd->odd_lock));
+
+	if (flag & OVERLAY_F_IN_RX)
+		odd->odd_rxcount++;
+	if (flag & OVERLAY_F_IN_TX)
+		odd->odd_txcount++;
+	odd->odd_flags |= flag;
+}
+
+void
+overlay_io_done(overlay_dev_t *odd, overlay_dev_flag_t flag)
+{
+	boolean_t signal = B_FALSE;
+
+	ASSERT(flag == OVERLAY_F_IN_RX || flag == OVERLAY_F_IN_TX);
+	ASSERT(MUTEX_HELD(&odd->odd_lock));
+
+	if (flag & OVERLAY_F_IN_RX) {
+		ASSERT(odd->odd_rxcount > 0);
+		odd->odd_rxcount--;
+		if (odd->odd_rxcount == 0) {
+			signal = B_TRUE;
+			odd->odd_flags &= ~OVERLAY_F_IN_RX;
+		}
+	}
+	if (flag & OVERLAY_F_IN_TX) {
+		ASSERT(odd->odd_txcount > 0);
+		odd->odd_txcount--;
+		if (odd->odd_txcount == 0) {
+			signal = B_TRUE;
+			odd->odd_flags &= ~OVERLAY_F_IN_TX;
+		}
+	}
+
+	if (signal == B_TRUE)
+		cv_broadcast(&odd->odd_iowait);
+}
+
+static void
+overlay_io_wait(overlay_dev_t *odd, overlay_dev_flag_t flag)
+{
+	ASSERT((flag & ~OVERLAY_F_IOMASK) == 0);
+	ASSERT(MUTEX_HELD(&odd->odd_lock));
+
+	while (odd->odd_flags & flag) {
+		cv_wait(&odd->odd_iowait, &odd->odd_lock);
+	}
+}
+
+void
+overlay_dev_iter(overlay_dev_iter_f func, void *arg)
+{
+	overlay_dev_t *odd;
+
+	mutex_enter(&overlay_dev_lock);
+	for (odd = list_head(&overlay_dev_list); odd != NULL;
+	    odd = list_next(&overlay_dev_list, odd)) {
+		if (func(odd, arg) != 0) {
+			mutex_exit(&overlay_dev_lock);
+			return;
+		}
+	}
+	mutex_exit(&overlay_dev_lock);
+}
+
+/* ARGSUSED */
+static int
+overlay_m_stat(void *arg, uint_t stat, uint64_t *val)
+{
+	return (ENOTSUP);
+}
+
+static int
+overlay_m_start(void *arg)
+{
+	overlay_dev_t *odd = arg;
+	overlay_mux_t *mux;
+	int ret, domain, family, prot;
+	struct sockaddr_storage storage;
+	socklen_t slen;
+
+	mutex_enter(&odd->odd_lock);
+	if ((odd->odd_flags & OVERLAY_F_ACTIVATED) == 0) {
+		mutex_exit(&odd->odd_lock);
+		return (EAGAIN);
+	}
+	mutex_exit(&odd->odd_lock);
+
+	ret = odd->odd_plugin->ovp_ops->ovpo_socket(odd->odd_pvoid, &domain,
+	    &family, &prot, (struct sockaddr *)&storage, &slen);
+	if (ret != 0)
+		return (ret);
+
+	mux = overlay_mux_open(odd->odd_plugin, domain, family, prot,
+	    (struct sockaddr *)&storage, slen, &ret);
+	if (mux == NULL)
+		return (ret);
+
+	overlay_mux_add_dev(mux, odd);
+	odd->odd_mux = mux;
+	mutex_enter(&odd->odd_lock);
+	ASSERT(!(odd->odd_flags & OVERLAY_F_IN_MUX));
+	odd->odd_flags |= OVERLAY_F_IN_MUX;
+	mutex_exit(&odd->odd_lock);
+
+	return (0);
+}
+
+static void
+overlay_m_stop(void *arg)
+{
+	overlay_dev_t *odd = arg;
+
+	/*
+	 * The MAC Perimeter is held here, so we don't have to worry about
+	 * synchornizing this with respect to metadata operations.
+	 */
+	mutex_enter(&odd->odd_lock);
+	VERIFY(odd->odd_flags & OVERLAY_F_IN_MUX);
+	VERIFY(!(odd->odd_flags & OVERLAY_F_MDDROP));
+	odd->odd_flags |= OVERLAY_F_MDDROP;
+	overlay_io_wait(odd, OVERLAY_F_IOMASK);
+	mutex_exit(&odd->odd_lock);
+
+	overlay_mux_remove_dev(odd->odd_mux, odd);
+	overlay_mux_close(odd->odd_mux);
+	odd->odd_mux = NULL;
+
+	mutex_enter(&odd->odd_lock);
+	odd->odd_flags &= ~OVERLAY_F_IN_MUX;
+	odd->odd_flags &= ~OVERLAY_F_MDDROP;
+	VERIFY((odd->odd_flags & OVERLAY_F_STOPMASK) == 0);
+	mutex_exit(&odd->odd_lock);
+}
+
+/*
+ * For more info on this, see the big theory statement.
+ */
+/* ARGSUSED */
+static int
+overlay_m_promisc(void *arg, boolean_t on)
+{
+	return (0);
+}
+
+/*
+ * For more info on this, see the big theory statement.
+ */
+/* ARGSUSED */
+static int
+overlay_m_multicast(void *arg, boolean_t add, const uint8_t *addrp)
+{
+	return (0);
+}
+
+/*
+ * For more info on this, see the big theory statement.
+ */
+/* ARGSUSED */
+static int
+overlay_m_unicast(void *arg, const uint8_t *macaddr)
+{
+	return (0);
+}
+
+mblk_t *
+overlay_m_tx(void *arg, mblk_t *mp_chain)
+{
+	overlay_dev_t *odd = arg;
+	mblk_t *mp, *ep;
+	int ret;
+	ovep_encap_info_t einfo;
+	struct msghdr hdr;
+
+	mutex_enter(&odd->odd_lock);
+	if ((odd->odd_flags & OVERLAY_F_MDDROP) ||
+	    !(odd->odd_flags & OVERLAY_F_IN_MUX)) {
+		mutex_exit(&odd->odd_lock);
+		freemsgchain(mp_chain);
+		return (NULL);
+	}
+	overlay_io_start(odd, OVERLAY_F_IN_TX);
+	mutex_exit(&odd->odd_lock);
+
+	bzero(&hdr, sizeof (struct msghdr));
+
+	bzero(&einfo, sizeof (ovep_encap_info_t));
+	einfo.ovdi_id = odd->odd_vid;
+	mp = mp_chain;
+	while (mp != NULL) {
+		socklen_t slen;
+		struct sockaddr_storage storage;
+
+		mp_chain = mp->b_next;
+		mp->b_next = NULL;
+		ep = NULL;
+
+		ret = overlay_target_lookup(odd, mp,
+		    (struct sockaddr *)&storage, &slen);
+		if (ret != OVERLAY_TARGET_OK) {
+			if (ret == OVERLAY_TARGET_DROP)
+				freemsg(mp);
+			mp = mp_chain;
+			continue;
+		}
+
+		hdr.msg_name = &storage;
+		hdr.msg_namelen = slen;
+
+		ret = odd->odd_plugin->ovp_ops->ovpo_encap(odd->odd_mh, mp,
+		    &einfo, &ep);
+		if (ret != 0 || ep == NULL) {
+			freemsg(mp);
+			goto out;
+		}
+
+		ep->b_cont = mp;
+		ret = overlay_mux_tx(odd->odd_mux, &hdr, ep);
+		if (ret != 0)
+			goto out;
+
+		mp = mp_chain;
+	}
+
+out:
+	mutex_enter(&odd->odd_lock);
+	overlay_io_done(odd, OVERLAY_F_IN_TX);
+	mutex_exit(&odd->odd_lock);
+	return (mp_chain);
+}
+
+/* ARGSUSED */
+static void
+overlay_m_ioctl(void *arg, queue_t *q, mblk_t *mp)
+{
+	miocnak(q, mp, 0, ENOTSUP);
+}
+
+/* ARGSUSED */
+static boolean_t
+overlay_m_getcapab(void *arg, mac_capab_t cap, void *cap_data)
+{
+	/*
+	 * Tell MAC we're an overlay.
+	 */
+	if (cap == MAC_CAPAB_OVERLAY)
+		return (B_TRUE);
+	return (B_FALSE);
+}
+
+/* ARGSUSED */
+static int
+overlay_m_setprop(void *arg, const char *pr_name, mac_prop_id_t pr_num,
+    uint_t pr_valsize, const void *pr_val)
+{
+	uint32_t mtu, old;
+	int err;
+	overlay_dev_t *odd = arg;
+
+	if (pr_num != MAC_PROP_MTU)
+		return (ENOTSUP);
+
+	bcopy(pr_val, &mtu, sizeof (mtu));
+	if (mtu < OVERLAY_MTU_MIN || mtu > OVERLAY_MTU_MAX)
+		return (EINVAL);
+
+	mutex_enter(&odd->odd_lock);
+	old = odd->odd_mtu;
+	odd->odd_mtu = mtu;
+	err = mac_maxsdu_update(odd->odd_mh, mtu);
+	if (err != 0)
+		odd->odd_mtu = old;
+	mutex_exit(&odd->odd_lock);
+
+	return (err);
+}
+
+/* ARGSUSED */
+static int
+overlay_m_getprop(void *arg, const char *pr_name, mac_prop_id_t pr_num,
+    uint_t pr_valsize, void *pr_val)
+{
+	return (ENOTSUP);
+}
+
+/* ARGSUSED */
+static void
+overlay_m_propinfo(void *arg, const char *pr_name, mac_prop_id_t pr_num,
+    mac_prop_info_handle_t prh)
+{
+	if (pr_num != MAC_PROP_MTU)
+		return;
+
+	mac_prop_info_set_default_uint32(prh, OVERLAY_MTU_DEF);
+	mac_prop_info_set_range_uint32(prh, OVERLAY_MTU_MIN, OVERLAY_MTU_MAX);
+}
+
+static mac_callbacks_t overlay_m_callbacks = {
+	.mc_callbacks = (MC_IOCTL | MC_GETCAPAB | MC_SETPROP | MC_GETPROP |
+	    MC_PROPINFO),
+	.mc_getstat = overlay_m_stat,
+	.mc_start = overlay_m_start,
+	.mc_stop = overlay_m_stop,
+	.mc_setpromisc = overlay_m_promisc,
+	.mc_multicst = overlay_m_multicast,
+	.mc_unicst = overlay_m_unicast,
+	.mc_tx = overlay_m_tx,
+	.mc_ioctl = overlay_m_ioctl,
+	.mc_getcapab = overlay_m_getcapab,
+	.mc_getprop = overlay_m_getprop,
+	.mc_setprop = overlay_m_setprop,
+	.mc_propinfo = overlay_m_propinfo
+};
+
+static boolean_t
+overlay_valid_name(const char *name, size_t buflen)
+{
+	size_t actlen;
+	int err, i;
+
+	for (i = 0; i < buflen; i++) {
+		if (name[i] == '\0')
+			break;
+	}
+
+	if (i == 0 || i == buflen)
+		return (B_FALSE);
+	actlen = i;
+	if (strchr(name, '/') != NULL)
+		return (B_FALSE);
+	if (u8_validate((char *)name, actlen, NULL,
+	    U8_VALIDATE_ENTIRE, &err) < 0)
+		return (B_FALSE);
+	return (B_TRUE);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_create(void *karg, intptr_t arg, int mode, cred_t *cred, int *rvalp)
+{
+	int err;
+	uint64_t maxid;
+	overlay_dev_t *odd, *o;
+	mac_register_t *mac;
+	overlay_ioc_create_t *oicp = karg;
+
+	if (overlay_valid_name(oicp->oic_encap, MAXLINKNAMELEN) == B_FALSE)
+		return (EINVAL);
+
+	odd = kmem_zalloc(sizeof (overlay_dev_t), KM_SLEEP);
+	odd->odd_linkid = oicp->oic_linkid;
+	odd->odd_plugin = overlay_plugin_lookup(oicp->oic_encap);
+	if (odd->odd_plugin == NULL) {
+		kmem_free(odd, sizeof (overlay_dev_t));
+		return (ENOENT);
+	}
+	err = odd->odd_plugin->ovp_ops->ovpo_init((overlay_handle_t)odd,
+	    &odd->odd_pvoid);
+	if (err != 0) {
+		odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+		overlay_plugin_rele(odd->odd_plugin);
+		kmem_free(odd, sizeof (overlay_dev_t));
+		return (EINVAL);
+	}
+
+	/*
+	 * Make sure that our virtual network id is valid for the given plugin
+	 * that we're working with.
+	 */
+	ASSERT(odd->odd_plugin->ovp_id_size <= 8);
+	maxid = UINT64_MAX;
+	if (odd->odd_plugin->ovp_id_size != 8)
+		maxid = (1ULL << (odd->odd_plugin->ovp_id_size * 8)) - 1ULL;
+	if (oicp->oic_vnetid > maxid) {
+		odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+		overlay_plugin_rele(odd->odd_plugin);
+		kmem_free(odd, sizeof (overlay_dev_t));
+		return (EINVAL);
+	}
+	odd->odd_vid = oicp->oic_vnetid;
+
+	mac = mac_alloc(MAC_VERSION);
+	if (mac == NULL) {
+		mutex_exit(&overlay_dev_lock);
+		odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+		overlay_plugin_rele(odd->odd_plugin);
+		kmem_free(odd, sizeof (overlay_dev_t));
+		return (EINVAL);
+	}
+
+	mac->m_type_ident = MAC_PLUGIN_IDENT_ETHER;
+	mac->m_driver = odd;
+	mac->m_dip = overlay_dip;
+	mac->m_dst_addr = NULL;
+	mac->m_callbacks = &overlay_m_callbacks;
+	mac->m_pdata = NULL;
+	mac->m_pdata_size = 0;
+
+	mac->m_priv_props = NULL;
+
+	/* Let mac handle this itself. */
+	mac->m_instance = (uint_t)-1;
+
+	/*
+	 * There is no real source address that should be used here, but saying
+	 * that we're not ethernet is going to cause its own problems. At the
+	 * end of the say, this is fine.
+	 */
+	mac->m_src_addr = overlay_macaddr;
+
+	/*
+	 * Start with the default MTU as the max SDU. If the MTU is changed, the
+	 * SDU will be changed to reflect that.
+	 */
+	mac->m_min_sdu = 1;
+	mac->m_max_sdu = OVERLAY_MTU_DEF;
+	mac->m_multicast_sdu = 0;
+
+	/*
+	 * The underlying device doesn't matter, instead this comes from the
+	 * encapsulation protocol and whether or not they allow VLAN tags.
+	 */
+	if (odd->odd_plugin->ovp_flags & OVEP_F_VLAN_TAG) {
+		mac->m_margin = VLAN_TAGSZ;
+	} else {
+		mac->m_margin = 0;
+	}
+
+	/*
+	 * Today, we have no MAC virtualization, it may make sense in the future
+	 * to go ahead and emulate some subset of this, but it doesn't today.
+	 */
+	mac->m_v12n = MAC_VIRT_NONE;
+
+	mutex_enter(&overlay_dev_lock);
+	for (o = list_head(&overlay_dev_list); o != NULL;
+	    o = list_next(&overlay_dev_list, o)) {
+		if (o->odd_linkid == oicp->oic_linkid) {
+			mutex_exit(&overlay_dev_lock);
+			odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+			overlay_plugin_rele(odd->odd_plugin);
+			kmem_free(odd, sizeof (overlay_dev_t));
+			return (EEXIST);
+		}
+
+		if (o->odd_vid == oicp->oic_vnetid &&
+		    o->odd_plugin == odd->odd_plugin) {
+			mutex_exit(&overlay_dev_lock);
+			odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+			overlay_plugin_rele(odd->odd_plugin);
+			kmem_free(odd, sizeof (overlay_dev_t));
+			return (EEXIST);
+		}
+	}
+
+	err = mac_register(mac, &odd->odd_mh);
+	mac_free(mac);
+	if (err != 0) {
+		mutex_exit(&overlay_dev_lock);
+		odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+		overlay_plugin_rele(odd->odd_plugin);
+		kmem_free(odd, sizeof (overlay_dev_t));
+		return (err);
+	}
+
+	err = dls_devnet_create(odd->odd_mh, odd->odd_linkid,
+	    crgetzoneid(cred));
+	if (err != 0) {
+		mutex_exit(&overlay_dev_lock);
+		(void) mac_unregister(odd->odd_mh);
+		odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+		overlay_plugin_rele(odd->odd_plugin);
+		kmem_free(odd, sizeof (overlay_dev_t));
+		return (err);
+	}
+
+	mutex_init(&odd->odd_lock, NULL, MUTEX_DRIVER, NULL);
+	cv_init(&odd->odd_iowait, NULL, CV_DRIVER, NULL);
+	odd->odd_ref = 0;
+	odd->odd_flags = 0;
+	list_insert_tail(&overlay_dev_list, odd);
+	mutex_exit(&overlay_dev_lock);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_activate(void *karg, intptr_t arg, int mode, cred_t *cred, int *rvalp)
+{
+	int i, ret;
+	overlay_dev_t *odd;
+	mac_perim_handle_t mph;
+	overlay_ioc_activate_t *oiap = karg;
+	overlay_ioc_propinfo_t *infop;
+	overlay_ioc_prop_t *oip;
+	overlay_prop_handle_t phdl;
+
+	odd = overlay_hold_by_dlid(oiap->oia_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	infop = kmem_alloc(sizeof (overlay_ioc_propinfo_t), KM_SLEEP);
+	oip = kmem_alloc(sizeof (overlay_ioc_prop_t), KM_SLEEP);
+	phdl = (overlay_prop_handle_t)infop;
+
+	mac_perim_enter_by_mh(odd->odd_mh, &mph);
+	mutex_enter(&odd->odd_lock);
+	if (odd->odd_flags & OVERLAY_F_ACTIVATED) {
+		mutex_exit(&odd->odd_lock);
+		mac_perim_exit(mph);
+		overlay_hold_rele(odd);
+		kmem_free(infop, sizeof (overlay_ioc_propinfo_t));
+		kmem_free(oip, sizeof (overlay_ioc_prop_t));
+		return (EEXIST);
+	}
+	mutex_exit(&odd->odd_lock);
+
+	for (i = 0; i < odd->odd_plugin->ovp_nprops; i++) {
+		const char *pname = odd->odd_plugin->ovp_props[i];
+		bzero(infop, sizeof (overlay_ioc_propinfo_t));
+		overlay_prop_init(phdl);
+		ret = odd->odd_plugin->ovp_ops->ovpo_propinfo(pname, phdl);
+		if (ret != 0) {
+			mac_perim_exit(mph);
+			overlay_hold_rele(odd);
+			kmem_free(infop, sizeof (overlay_ioc_propinfo_t));
+			kmem_free(oip, sizeof (overlay_ioc_prop_t));
+			return (ret);
+		}
+
+		if ((infop->oipi_prot & OVERLAY_PROP_PERM_REQ) == 0)
+			continue;
+		bzero(oip, sizeof (overlay_ioc_prop_t));
+		oip->oip_size = sizeof (oip->oip_value);
+		ret = odd->odd_plugin->ovp_ops->ovpo_getprop(odd->odd_pvoid,
+		    pname, oip->oip_value, &oip->oip_size);
+		if (ret != 0) {
+			mac_perim_exit(mph);
+			overlay_hold_rele(odd);
+			kmem_free(infop, sizeof (overlay_ioc_propinfo_t));
+			kmem_free(oip, sizeof (overlay_ioc_prop_t));
+			return (ret);
+		}
+		if (oip->oip_size == 0) {
+			mac_perim_exit(mph);
+			overlay_hold_rele(odd);
+			kmem_free(infop, sizeof (overlay_ioc_propinfo_t));
+			kmem_free(oip, sizeof (overlay_ioc_prop_t));
+			return (EINVAL);
+		}
+	}
+
+	mutex_enter(&odd->odd_lock);
+	if ((odd->odd_flags & OVERLAY_F_VARPD) == 0) {
+		mutex_exit(&odd->odd_lock);
+		mac_perim_exit(mph);
+		overlay_hold_rele(odd);
+		kmem_free(infop, sizeof (overlay_ioc_propinfo_t));
+		kmem_free(oip, sizeof (overlay_ioc_prop_t));
+		return (ENXIO);
+	}
+
+	ASSERT((odd->odd_flags & OVERLAY_F_ACTIVATED) == 0);
+	odd->odd_flags |= OVERLAY_F_ACTIVATED;
+
+	/*
+	 * Now that we've activated ourselves, we should indicate to the world
+	 * that we're up. Note that we may not be able to perform lookups at
+	 * this time, but our notion of being 'up' isn't dependent on that
+	 * ability.
+	 */
+	mac_link_update(odd->odd_mh, LINK_STATE_UP);
+	mutex_exit(&odd->odd_lock);
+
+	mac_perim_exit(mph);
+	overlay_hold_rele(odd);
+	kmem_free(infop, sizeof (overlay_ioc_propinfo_t));
+	kmem_free(oip, sizeof (overlay_ioc_prop_t));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_delete(void *karg, intptr_t arg, int mode, cred_t *cred, int *rvalp)
+{
+	overlay_ioc_delete_t *oidp = karg;
+	overlay_dev_t *odd;
+	datalink_id_t tid;
+	int ret;
+
+	odd = overlay_hold_by_dlid(oidp->oid_linkid);
+	if (odd == NULL) {
+		return (ENOENT);
+	}
+
+	mutex_enter(&odd->odd_lock);
+	/* If we're not the only hold, we're busy */
+	if (odd->odd_ref != 1) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (EBUSY);
+	}
+
+	if (odd->odd_flags & OVERLAY_F_IN_MUX) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (EBUSY);
+	}
+
+	/*
+	 * To remove this, we need to first remove it from dls and then remove
+	 * it from mac. The act of removing it from mac will check if there are
+	 * devices on top of this, eg. vnics. If there are, then that will fail
+	 * and we'll have to go through and recreate the dls entry. Only after
+	 * mac_unregister has succeeded, then we'll go through and actually free
+	 * everything and drop the dev lock.
+	 */
+	ret = dls_devnet_destroy(odd->odd_mh, &tid, B_TRUE);
+	if (ret != 0) {
+		overlay_hold_rele(odd);
+		return (ret);
+	}
+
+	ASSERT(oidp->oid_linkid == tid);
+	ret = mac_disable(odd->odd_mh);
+	if (ret != 0) {
+		(void) dls_devnet_create(odd->odd_mh, odd->odd_linkid,
+		    crgetzoneid(cred));
+		overlay_hold_rele(odd);
+		return (ret);
+	}
+
+	overlay_target_quiesce(odd->odd_target);
+
+	mutex_enter(&overlay_dev_lock);
+	list_remove(&overlay_dev_list, odd);
+	mutex_exit(&overlay_dev_lock);
+
+	cv_destroy(&odd->odd_iowait);
+	mutex_destroy(&odd->odd_lock);
+	overlay_target_free(odd);
+	odd->odd_plugin->ovp_ops->ovpo_fini(odd->odd_pvoid);
+	overlay_plugin_rele(odd->odd_plugin);
+	kmem_free(odd, sizeof (overlay_dev_t));
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_nprops(void *karg, intptr_t arg, int mode, cred_t *cred,
+    int *rvalp)
+{
+	overlay_dev_t *odd;
+	overlay_ioc_nprops_t *on = karg;
+
+	odd = overlay_hold_by_dlid(on->oipn_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+	on->oipn_nprops = odd->odd_plugin->ovp_nprops + OVERLAY_DEV_NPROPS;
+	overlay_hold_rele(odd);
+
+	return (0);
+}
+
+static int
+overlay_propinfo_plugin_cb(overlay_plugin_t *opp, void *arg)
+{
+	overlay_prop_handle_t phdl = arg;
+	overlay_prop_set_range_str(phdl, opp->ovp_name);
+	return (0);
+}
+
+static int
+overlay_i_name_to_propid(overlay_dev_t *odd, const char *name, uint_t *id)
+{
+	int i;
+
+	for (i = 0; i < OVERLAY_DEV_NPROPS; i++) {
+		if (strcmp(overlay_dev_props[i], name) == 0) {
+			*id = i;
+			return (0);
+		}
+	}
+
+	for (i = 0; i < odd->odd_plugin->ovp_nprops; i++) {
+		if (strcmp(odd->odd_plugin->ovp_props[i], name) == 0) {
+			*id = i + OVERLAY_DEV_NPROPS;
+			return (0);
+		}
+	}
+
+	return (ENOENT);
+}
+
+static void
+overlay_i_propinfo_mtu(overlay_dev_t *odd, overlay_prop_handle_t phdl)
+{
+	uint32_t def;
+	mac_propval_range_t range;
+	uint_t perm;
+
+	ASSERT(MAC_PERIM_HELD(odd->odd_mh));
+
+	bzero(&range, sizeof (mac_propval_range_t));
+	range.mpr_count = 1;
+	if (mac_prop_info(odd->odd_mh, MAC_PROP_MTU, "mtu", &def,
+	    sizeof (def), &range, &perm) != 0)
+		return;
+
+	if (perm == MAC_PROP_PERM_READ)
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_READ);
+	else if (perm == MAC_PROP_PERM_WRITE)
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_WRITE);
+	else if (perm == MAC_PROP_PERM_RW)
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_RW);
+
+	overlay_prop_set_type(phdl, OVERLAY_PROP_T_UINT);
+	overlay_prop_set_default(phdl, &def, sizeof (def));
+	overlay_prop_set_range_uint32(phdl, range.mpr_range_uint32[0].mpur_min,
+	    range.mpr_range_uint32[0].mpur_max);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_propinfo(void *karg, intptr_t arg, int mode, cred_t *cred,
+    int *rvalp)
+{
+	overlay_dev_t *odd;
+	int ret;
+	mac_perim_handle_t mph;
+	uint_t propid = UINT_MAX;
+	overlay_ioc_propinfo_t *oip = karg;
+	overlay_prop_handle_t phdl = (overlay_prop_handle_t)oip;
+
+	odd = overlay_hold_by_dlid(oip->oipi_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	overlay_prop_init(phdl);
+	mac_perim_enter_by_mh(odd->odd_mh, &mph);
+
+	/*
+	 * If the id is -1, then the property that we're looking for is named in
+	 * oipi_name and we should fill in its id. Otherwise, we've been given
+	 * an id and we need to turn that into a name for our plugin's sake. The
+	 * id is our own fabrication for property discovery.
+	 */
+	if (oip->oipi_id == -1) {
+		/*
+		 * Determine if it's a known generic property or it belongs to a
+		 * module by checking against the list of known names.
+		 */
+		oip->oipi_name[OVERLAY_PROP_NAMELEN-1] = '\0';
+		if ((ret = overlay_i_name_to_propid(odd, oip->oipi_name,
+		    &propid)) != 0) {
+			overlay_hold_rele(odd);
+			mac_perim_exit(mph);
+			return (ret);
+		}
+		oip->oipi_id = propid;
+		if (propid >= OVERLAY_DEV_NPROPS) {
+			ret = odd->odd_plugin->ovp_ops->ovpo_propinfo(
+			    oip->oipi_name, phdl);
+			overlay_hold_rele(odd);
+			mac_perim_exit(mph);
+			return (ret);
+
+		}
+	} else if (oip->oipi_id >= OVERLAY_DEV_NPROPS) {
+		uint_t id = oip->oipi_id - OVERLAY_DEV_NPROPS;
+
+		if (id >= odd->odd_plugin->ovp_nprops) {
+			overlay_hold_rele(odd);
+			mac_perim_exit(mph);
+			return (EINVAL);
+		}
+		ret = odd->odd_plugin->ovp_ops->ovpo_propinfo(
+		    odd->odd_plugin->ovp_props[id], phdl);
+		overlay_hold_rele(odd);
+		mac_perim_exit(mph);
+		return (ret);
+	} else if (oip->oipi_id < -1) {
+		overlay_hold_rele(odd);
+		mac_perim_exit(mph);
+		return (EINVAL);
+	} else {
+		ASSERT(oip->oipi_id < OVERLAY_DEV_NPROPS);
+		ASSERT(oip->oipi_id >= 0);
+		propid = oip->oipi_id;
+		(void) strlcpy(oip->oipi_name, overlay_dev_props[propid],
+		    sizeof (oip->oipi_name));
+	}
+
+	switch (propid) {
+	case OVERLAY_DEV_P_MTU:
+		overlay_i_propinfo_mtu(odd, phdl);
+		break;
+	case OVERLAY_DEV_P_VNETID:
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_RW);
+		overlay_prop_set_type(phdl, OVERLAY_PROP_T_UINT);
+		overlay_prop_set_nodefault(phdl);
+		break;
+	case OVERLAY_DEV_P_ENCAP:
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_READ);
+		overlay_prop_set_type(phdl, OVERLAY_PROP_T_STRING);
+		overlay_prop_set_nodefault(phdl);
+		overlay_plugin_walk(overlay_propinfo_plugin_cb, phdl);
+		break;
+	case OVERLAY_DEV_P_VARPDID:
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_READ);
+		overlay_prop_set_type(phdl, OVERLAY_PROP_T_UINT);
+		overlay_prop_set_nodefault(phdl);
+		break;
+	default:
+		overlay_hold_rele(odd);
+		mac_perim_exit(mph);
+		return (ENOENT);
+	}
+
+	overlay_hold_rele(odd);
+	mac_perim_exit(mph);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_getprop(void *karg, intptr_t arg, int mode, cred_t *cred,
+    int *rvalp)
+{
+	int ret;
+	overlay_dev_t *odd;
+	mac_perim_handle_t mph;
+	overlay_ioc_prop_t *oip = karg;
+	uint_t propid, mtu;
+
+	odd = overlay_hold_by_dlid(oip->oip_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mac_perim_enter_by_mh(odd->odd_mh, &mph);
+	oip->oip_size = OVERLAY_PROP_SIZEMAX;
+	oip->oip_name[OVERLAY_PROP_NAMELEN-1] = '\0';
+	if (oip->oip_id == -1) {
+		int i;
+
+		for (i = 0; i < OVERLAY_DEV_NPROPS; i++) {
+			if (strcmp(overlay_dev_props[i], oip->oip_name) == 0)
+				break;
+			if (i == OVERLAY_DEV_NPROPS) {
+				ret = odd->odd_plugin->ovp_ops->ovpo_getprop(
+				    odd->odd_pvoid, oip->oip_name,
+				    oip->oip_value, &oip->oip_size);
+				overlay_hold_rele(odd);
+				mac_perim_exit(mph);
+				return (ret);
+			}
+		}
+
+		propid = i;
+	} else if (oip->oip_id >= OVERLAY_DEV_NPROPS) {
+		uint_t id = oip->oip_id - OVERLAY_DEV_NPROPS;
+
+		if (id > odd->odd_plugin->ovp_nprops) {
+			overlay_hold_rele(odd);
+			mac_perim_exit(mph);
+			return (EINVAL);
+		}
+		ret = odd->odd_plugin->ovp_ops->ovpo_getprop(odd->odd_pvoid,
+		    odd->odd_plugin->ovp_props[id], oip->oip_value,
+		    &oip->oip_size);
+		overlay_hold_rele(odd);
+		mac_perim_exit(mph);
+		return (ret);
+	} else if (oip->oip_id < -1) {
+		overlay_hold_rele(odd);
+		mac_perim_exit(mph);
+		return (EINVAL);
+	} else {
+		ASSERT(oip->oip_id < OVERLAY_DEV_NPROPS);
+		ASSERT(oip->oip_id >= 0);
+		propid = oip->oip_id;
+	}
+
+	ret = 0;
+	switch (propid) {
+	case OVERLAY_DEV_P_MTU:
+		/*
+		 * The MTU is always set and retrieved through MAC, to allow for
+		 * MAC to do whatever it wants, as really that property belongs
+		 * to MAC. This is important for things where vnics have hold on
+		 * the MTU.
+		 */
+		mac_sdu_get(odd->odd_mh, NULL, &mtu);
+		bcopy(&mtu, oip->oip_value, sizeof (uint_t));
+		oip->oip_size = sizeof (uint_t);
+		break;
+	case OVERLAY_DEV_P_VNETID:
+		/*
+		 * While it's read-only while inside of a mux, we're not in a
+		 * context that can guarantee that. Therefore we always grab the
+		 * overlay_dev_t's odd_lock.
+		 */
+		mutex_enter(&odd->odd_lock);
+		bcopy(&odd->odd_vid, oip->oip_value, sizeof (uint64_t));
+		mutex_exit(&odd->odd_lock);
+		oip->oip_size = sizeof (uint64_t);
+		break;
+	case OVERLAY_DEV_P_ENCAP:
+		oip->oip_size = strlcpy((char *)oip->oip_value,
+		    odd->odd_plugin->ovp_name, oip->oip_size);
+		break;
+	case OVERLAY_DEV_P_VARPDID:
+		mutex_enter(&odd->odd_lock);
+		if (odd->odd_flags & OVERLAY_F_VARPD) {
+			const uint64_t val = odd->odd_target->ott_id;
+			bcopy(&val, oip->oip_value, sizeof (uint64_t));
+			oip->oip_size = sizeof (uint64_t);
+		} else {
+			oip->oip_size = 0;
+		}
+		mutex_exit(&odd->odd_lock);
+		break;
+	default:
+		ret = ENOENT;
+	}
+
+	overlay_hold_rele(odd);
+	mac_perim_exit(mph);
+	return (ret);
+}
+
+static void
+overlay_setprop_vnetid(overlay_dev_t *odd, uint64_t vnetid)
+{
+	mutex_enter(&odd->odd_lock);
+
+	/* Simple case, not active */
+	if (!(odd->odd_flags & OVERLAY_F_IN_MUX)) {
+		odd->odd_vid = vnetid;
+		mutex_exit(&odd->odd_lock);
+		return;
+	}
+
+	/*
+	 * In the hard case, we need to set the drop flag, quiesce I/O and then
+	 * we can go ahead and do everything.
+	 */
+	odd->odd_flags |= OVERLAY_F_MDDROP;
+	overlay_io_wait(odd, OVERLAY_F_IOMASK);
+	mutex_exit(&odd->odd_lock);
+
+	overlay_mux_remove_dev(odd->odd_mux, odd);
+	mutex_enter(&odd->odd_lock);
+	odd->odd_vid = vnetid;
+	mutex_exit(&odd->odd_lock);
+	overlay_mux_add_dev(odd->odd_mux, odd);
+
+	mutex_enter(&odd->odd_lock);
+	ASSERT(odd->odd_flags & OVERLAY_F_IN_MUX);
+	odd->odd_flags &= ~OVERLAY_F_IN_MUX;
+	mutex_exit(&odd->odd_lock);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_setprop(void *karg, intptr_t arg, int mode, cred_t *cred,
+    int *rvalp)
+{
+	int ret;
+	overlay_dev_t *odd;
+	overlay_ioc_prop_t *oip = karg;
+	uint_t propid = UINT_MAX;
+	mac_perim_handle_t mph;
+	uint64_t maxid, *vidp;
+
+	if (oip->oip_size > OVERLAY_PROP_SIZEMAX)
+		return (EINVAL);
+
+	odd = overlay_hold_by_dlid(oip->oip_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	oip->oip_name[OVERLAY_PROP_NAMELEN-1] = '\0';
+	mac_perim_enter_by_mh(odd->odd_mh, &mph);
+	mutex_enter(&odd->odd_lock);
+	if (odd->odd_flags & OVERLAY_F_ACTIVATED) {
+		mac_perim_exit(mph);
+		mutex_exit(&odd->odd_lock);
+		return (ENOTSUP);
+	}
+	mutex_exit(&odd->odd_lock);
+	if (oip->oip_id == -1) {
+		int i;
+
+		for (i = 0; i < OVERLAY_DEV_NPROPS; i++) {
+			if (strcmp(overlay_dev_props[i], oip->oip_name) == 0)
+				break;
+			if (i == OVERLAY_DEV_NPROPS) {
+				ret = odd->odd_plugin->ovp_ops->ovpo_setprop(
+				    odd->odd_pvoid, oip->oip_name,
+				    oip->oip_value, oip->oip_size);
+				overlay_hold_rele(odd);
+				mac_perim_exit(mph);
+				return (ret);
+			}
+		}
+
+		propid = i;
+	} else if (oip->oip_id >= OVERLAY_DEV_NPROPS) {
+		uint_t id = oip->oip_id - OVERLAY_DEV_NPROPS;
+
+		if (id > odd->odd_plugin->ovp_nprops) {
+			mac_perim_exit(mph);
+			overlay_hold_rele(odd);
+			return (EINVAL);
+		}
+		ret = odd->odd_plugin->ovp_ops->ovpo_setprop(odd->odd_pvoid,
+		    odd->odd_plugin->ovp_props[id], oip->oip_value,
+		    oip->oip_size);
+		mac_perim_exit(mph);
+		overlay_hold_rele(odd);
+		return (ret);
+	} else if (oip->oip_id < -1) {
+		mac_perim_exit(mph);
+		overlay_hold_rele(odd);
+		return (EINVAL);
+	} else {
+		ASSERT(oip->oip_id < OVERLAY_DEV_NPROPS);
+		ASSERT(oip->oip_id >= 0);
+		propid = oip->oip_id;
+	}
+
+	ret = 0;
+	switch (propid) {
+	case OVERLAY_DEV_P_MTU:
+		ret = mac_set_prop(odd->odd_mh, MAC_PROP_MTU, "mtu",
+		    oip->oip_value, oip->oip_size);
+		break;
+	case OVERLAY_DEV_P_VNETID:
+		if (oip->oip_size != sizeof (uint64_t)) {
+			ret = EINVAL;
+			break;
+		}
+		vidp = (uint64_t *)oip->oip_value;
+		ASSERT(odd->odd_plugin->ovp_id_size <= 8);
+		maxid = UINT64_MAX;
+		if (odd->odd_plugin->ovp_id_size != 8)
+			maxid = (1ULL << (odd->odd_plugin->ovp_id_size * 8)) -
+			    1ULL;
+		if (*vidp >= maxid) {
+			ret = EINVAL;
+			break;
+		}
+		overlay_setprop_vnetid(odd, *vidp);
+		break;
+	case OVERLAY_DEV_P_ENCAP:
+	case OVERLAY_DEV_P_VARPDID:
+		ret = EPERM;
+		break;
+	default:
+		ret = ENOENT;
+	}
+
+	mac_perim_exit(mph);
+	overlay_hold_rele(odd);
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+overlay_i_status(void *karg, intptr_t arg, int mode, cred_t *cred,
+    int *rvalp)
+{
+	overlay_dev_t *odd;
+	overlay_ioc_status_t *os = karg;
+
+	odd = overlay_hold_by_dlid(os->ois_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	if ((odd->odd_flags & OVERLAY_F_DEGRADED) != 0) {
+		os->ois_status = OVERLAY_I_DEGRADED;
+		if (odd->odd_fmamsg != NULL) {
+			(void) strlcpy(os->ois_message, odd->odd_fmamsg,
+			    OVERLAY_STATUS_BUFLEN);
+		} else {
+			os->ois_message[0] = '\0';
+		}
+
+	} else {
+		os->ois_status = OVERLAY_I_OK;
+		os->ois_message[0] = '\0';
+	}
+	mutex_exit(&odd->odd_lock);
+	overlay_hold_rele(odd);
+
+	return (0);
+}
+
+static dld_ioc_info_t overlay_ioc_list[] = {
+	{ OVERLAY_IOC_CREATE, DLDCOPYIN, sizeof (overlay_ioc_create_t),
+		overlay_i_create, secpolicy_dl_config },
+	{ OVERLAY_IOC_ACTIVATE, DLDCOPYIN, sizeof (overlay_ioc_activate_t),
+		overlay_i_activate, secpolicy_dl_config },
+	{ OVERLAY_IOC_DELETE, DLDCOPYIN, sizeof (overlay_ioc_delete_t),
+		overlay_i_delete, secpolicy_dl_config },
+	{ OVERLAY_IOC_PROPINFO, DLDCOPYIN | DLDCOPYOUT,
+		sizeof (overlay_ioc_propinfo_t), overlay_i_propinfo,
+		secpolicy_dl_config },
+	{ OVERLAY_IOC_GETPROP, DLDCOPYIN | DLDCOPYOUT,
+		sizeof (overlay_ioc_prop_t), overlay_i_getprop,
+		secpolicy_dl_config },
+	{ OVERLAY_IOC_SETPROP, DLDCOPYIN,
+		sizeof (overlay_ioc_prop_t), overlay_i_setprop,
+		secpolicy_dl_config },
+	{ OVERLAY_IOC_NPROPS, DLDCOPYIN | DLDCOPYOUT,
+		sizeof (overlay_ioc_nprops_t), overlay_i_nprops,
+		secpolicy_dl_config },
+	{ OVERLAY_IOC_STATUS, DLDCOPYIN | DLDCOPYOUT,
+		sizeof (overlay_ioc_status_t), overlay_i_status,
+		NULL }
+};
+
+static int
+overlay_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	int fmcap = DDI_FM_EREPORT_CAPABLE;
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	if (overlay_dip != NULL || ddi_get_instance(dip) != 0)
+		return (DDI_FAILURE);
+
+	ddi_fm_init(dip, &fmcap, NULL);
+
+	if (ddi_create_minor_node(dip, OVERLAY_CTL, S_IFCHR,
+	    ddi_get_instance(dip), DDI_PSEUDO, 0) == DDI_FAILURE)
+		return (DDI_FAILURE);
+
+	if (dld_ioc_register(OVERLAY_IOC, overlay_ioc_list,
+	    DLDIOCCNT(overlay_ioc_list)) != 0) {
+		ddi_remove_minor_node(dip, OVERLAY_CTL);
+		return (DDI_FAILURE);
+	}
+
+	overlay_dip = dip;
+	return (DDI_SUCCESS);
+}
+
+/* ARGSUSED */
+static int
+overlay_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **resp)
+{
+	int error;
+
+	switch (cmd) {
+	case DDI_INFO_DEVT2DEVINFO:
+		*resp = (void *)overlay_dip;
+		error = DDI_SUCCESS;
+		break;
+	case DDI_INFO_DEVT2INSTANCE:
+		*resp = (void *)0;
+		error = DDI_SUCCESS;
+		break;
+	default:
+		error = DDI_FAILURE;
+		break;
+	}
+
+	return (error);
+}
+
+static int
+overlay_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	mutex_enter(&overlay_dev_lock);
+	if (!list_is_empty(&overlay_dev_list) || overlay_target_busy()) {
+		mutex_exit(&overlay_dev_lock);
+		return (EBUSY);
+	}
+	mutex_exit(&overlay_dev_lock);
+
+
+	dld_ioc_unregister(OVERLAY_IOC);
+	ddi_remove_minor_node(dip, OVERLAY_CTL);
+	ddi_fm_fini(dip);
+	overlay_dip = NULL;
+	return (DDI_SUCCESS);
+}
+
+static struct cb_ops overlay_cbops = {
+	overlay_target_open,	/* cb_open */
+	overlay_target_close,	/* cb_close */
+	nodev,			/* cb_strategy */
+	nodev,			/* cb_print */
+	nodev,			/* cb_dump */
+	nodev,			/* cb_read */
+	nodev,			/* cb_write */
+	overlay_target_ioctl,	/* cb_ioctl */
+	nodev,			/* cb_devmap */
+	nodev,			/* cb_mmap */
+	nodev,			/* cb_segmap */
+	nochpoll,		/* cb_chpoll */
+	ddi_prop_op,		/* cb_prop_op */
+	NULL,			/* cb_stream */
+	D_MP,			/* cb_flag */
+	CB_REV,			/* cb_rev */
+	nodev,			/* cb_aread */
+	nodev,			/* cb_awrite */
+};
+
+static struct dev_ops overlay_dev_ops = {
+	DEVO_REV,		/* devo_rev */
+	0,			/* devo_refcnt */
+	overlay_getinfo,	/* devo_getinfo */
+	nulldev,		/* devo_identify */
+	nulldev,		/* devo_probe */
+	overlay_attach,		/* devo_attach */
+	overlay_detach,		/* devo_detach */
+	nulldev,		/* devo_reset */
+	&overlay_cbops,		/* devo_cb_ops */
+	NULL,			/* devo_bus_ops */
+	NULL,			/* devo_power */
+	ddi_quiesce_not_supported	/* devo_quiesce */
+};
+
+static struct modldrv overlay_modldrv = {
+	&mod_driverops,
+	"Overlay Network Driver",
+	&overlay_dev_ops
+};
+
+static struct modlinkage overlay_linkage = {
+	MODREV_1,
+	&overlay_modldrv
+};
+
+static int
+overlay_init(void)
+{
+	mutex_init(&overlay_dev_lock, NULL, MUTEX_DRIVER, NULL);
+	list_create(&overlay_dev_list, sizeof (overlay_dev_t),
+	    offsetof(overlay_dev_t, odd_link));
+	overlay_mux_init();
+	overlay_plugin_init();
+	overlay_target_init();
+
+	return (DDI_SUCCESS);
+}
+
+static void
+overlay_fini(void)
+{
+	overlay_target_fini();
+	overlay_plugin_fini();
+	overlay_mux_fini();
+	mutex_destroy(&overlay_dev_lock);
+	list_destroy(&overlay_dev_list);
+}
+
+int
+_init(void)
+{
+	int err;
+
+	if ((err = overlay_init()) != DDI_SUCCESS)
+		return (err);
+
+	mac_init_ops(NULL, "overlay");
+	err = mod_install(&overlay_linkage);
+	if (err != DDI_SUCCESS) {
+		overlay_fini();
+		return (err);
+	}
+
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&overlay_linkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int err;
+
+	err = mod_remove(&overlay_linkage);
+	if (err != 0)
+		return (err);
+
+	overlay_fini();
+	return (0);
+}
diff --git a/usr/src/uts/common/io/overlay/overlay.conf b/usr/src/uts/common/io/overlay/overlay.conf
new file mode 100644
index 0000000000..4b62fafd94
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay.conf
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015, Joyent, Inc.
+#
+
+name="overlay" parent="pseudo" instance=0;
diff --git a/usr/src/uts/common/io/overlay/overlay.mapfile b/usr/src/uts/common/io/overlay/overlay.mapfile
new file mode 100644
index 0000000000..800d72dc2b
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay.mapfile
@@ -0,0 +1,46 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION ILLUMOSprivate {
+    global:
+	# DDI Interfaces
+	_fini;
+	_init;
+	_info;
+
+	# Encapsualation Plugin interfaces
+	overlay_plugin_alloc;
+	overlay_plugin_free;
+	overlay_plugin_register;
+	overlay_plugin_unregister;
+    local:
+	*;
+};
diff --git a/usr/src/uts/common/io/overlay/overlay_fm.c b/usr/src/uts/common/io/overlay/overlay_fm.c
new file mode 100644
index 0000000000..0701d08e8b
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay_fm.c
@@ -0,0 +1,82 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Overlay device FMA operations.
+ *
+ * For more information, see the big theory statement in
+ * uts/common/io/overlay/overlay.c
+ */
+
+#include <sys/ddifm.h>
+#include <sys/overlay_impl.h>
+
+kmutex_t overlay_fm_lock;
+uint_t overlay_fm_count;
+
+void
+overlay_fm_init(void)
+{
+	overlay_fm_count = 0;
+	mutex_init(&overlay_fm_lock, NULL, MUTEX_DRIVER, NULL);
+}
+
+void
+overlay_fm_fini(void)
+{
+	VERIFY(overlay_fm_count == 0);
+	mutex_destroy(&overlay_fm_lock);
+}
+
+void
+overlay_fm_degrade(overlay_dev_t *odd, const char *msg)
+{
+	mutex_enter(&overlay_fm_lock);
+	mutex_enter(&odd->odd_lock);
+
+	if (msg != NULL)
+		(void) strlcpy(odd->odd_fmamsg, msg, OVERLAY_STATUS_BUFLEN);
+
+	if (odd->odd_flags & OVERLAY_F_DEGRADED)
+		goto out;
+
+	odd->odd_flags |= OVERLAY_F_DEGRADED;
+	overlay_fm_count++;
+	if (overlay_fm_count == 1) {
+		ddi_fm_service_impact(overlay_dip, DDI_SERVICE_DEGRADED);
+	}
+out:
+	mutex_exit(&odd->odd_lock);
+	mutex_exit(&overlay_fm_lock);
+}
+
+void
+overlay_fm_restore(overlay_dev_t *odd)
+{
+	mutex_enter(&overlay_fm_lock);
+	mutex_enter(&odd->odd_lock);
+	if (!(odd->odd_flags & OVERLAY_F_DEGRADED))
+		goto out;
+
+	odd->odd_fmamsg[0] = '\0';
+	odd->odd_flags &= ~OVERLAY_F_DEGRADED;
+	overlay_fm_count--;
+	if (overlay_fm_count == 0) {
+		ddi_fm_service_impact(overlay_dip, DDI_SERVICE_RESTORED);
+	}
+out:
+	mutex_exit(&odd->odd_lock);
+	mutex_exit(&overlay_fm_lock);
+}
diff --git a/usr/src/uts/common/io/overlay/overlay_mux.c b/usr/src/uts/common/io/overlay/overlay_mux.c
new file mode 100644
index 0000000000..9f70e8c83e
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay_mux.c
@@ -0,0 +1,354 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Overlay device ksocket multiplexer.
+ *
+ * For more information, see the big theory statement in
+ * uts/common/io/overlay/overlay.c
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ksynch.h>
+#include <sys/ksocket.h>
+#include <sys/avl.h>
+#include <sys/list.h>
+#include <sys/sysmacros.h>
+#include <sys/strsubr.h>
+#include <sys/strsun.h>
+#include <sys/tihdr.h>
+
+#include <sys/overlay_impl.h>
+
+#include <sys/sdt.h>
+
+#define	OVERLAY_FREEMSG(mp, reason) \
+    DTRACE_PROBE2(overlay__fremsg, mblk_t *, mp, char *, reason)
+
+static list_t overlay_mux_list;
+static kmutex_t overlay_mux_lock;
+
+void
+overlay_mux_init(void)
+{
+	list_create(&overlay_mux_list, sizeof (overlay_mux_t),
+	    offsetof(overlay_mux_t, omux_lnode));
+	mutex_init(&overlay_mux_lock, NULL, MUTEX_DRIVER, NULL);
+}
+
+void
+overlay_mux_fini(void)
+{
+	mutex_destroy(&overlay_mux_lock);
+	list_destroy(&overlay_mux_list);
+}
+
+static int
+overlay_mux_comparator(const void *a, const void *b)
+{
+	const overlay_dev_t *odl, *odr;
+	odl = a;
+	odr = b;
+	if (odl->odd_vid > odr->odd_vid)
+		return (1);
+	else if (odl->odd_vid < odr->odd_vid)
+		return (-1);
+	else
+		return (0);
+}
+
+/*
+ * This is the central receive data path. We need to decode the packet, if we
+ * can, and then deliver it to the appropriate overlay.
+ */
+/* ARGSUSED */
+static boolean_t
+overlay_mux_recv(ksocket_t ks, mblk_t *mpchain, size_t msgsize, int oob,
+    void *arg)
+{
+	mblk_t *mp, *nmp, *fmp;
+	overlay_mux_t *mux = arg;
+
+	/*
+	 * We may have a received a chain of messages. Each messsage in the
+	 * chain will likely have a T_unitdata_ind attached to it as an M_PROTO.
+	 * If we aren't getting that, we should probably drop that for the
+	 * moment.
+	 */
+	for (mp = mpchain; mp != NULL; mp = nmp) {
+		struct T_unitdata_ind *tudi;
+		ovep_encap_info_t infop;
+		overlay_dev_t od, *odd;
+		int ret;
+
+		nmp = mp->b_next;
+		mp->b_next = NULL;
+
+		if (DB_TYPE(mp) != M_PROTO) {
+			OVERLAY_FREEMSG(mp, "first one isn't M_PROTO");
+			freemsg(mp);
+			continue;
+		}
+
+		if (mp->b_cont == NULL) {
+			OVERLAY_FREEMSG(mp, "missing a b_cont");
+			freemsg(mp);
+			continue;
+		}
+
+		tudi = (struct T_unitdata_ind *)mp->b_rptr;
+		if (tudi->PRIM_type != T_UNITDATA_IND) {
+			OVERLAY_FREEMSG(mp, "Not a T_unitdata_ind *");
+			freemsg(mp);
+			continue;
+		}
+
+		/*
+		 * In the future, we'll care about the source information
+		 * for purposes of telling varpd for oob invalidation. But for
+		 * now, just drop that block.
+		 */
+		fmp = mp;
+		mp = fmp->b_cont;
+		fmp->b_cont = NULL;
+		freemsg(fmp);
+
+		/*
+		 * Decap and deliver.
+		 */
+		bzero(&infop, sizeof (ovep_encap_info_t));
+		ret = mux->omux_plugin->ovp_ops->ovpo_decap(NULL, mp, &infop);
+		if (ret != 0) {
+			OVERLAY_FREEMSG(mp, "decap failed");
+			freemsg(mp);
+			continue;
+		}
+		if (MBLKL(mp) > infop.ovdi_hdr_size) {
+			mp->b_rptr += infop.ovdi_hdr_size;
+		} else {
+			while (infop.ovdi_hdr_size != 0) {
+				size_t rem, blkl;
+
+				if (mp == NULL)
+					break;
+
+				blkl = MBLKL(mp);
+				rem = MIN(infop.ovdi_hdr_size, blkl);
+				infop.ovdi_hdr_size -= rem;
+				mp->b_rptr += rem;
+				if (rem == blkl) {
+					fmp = mp;
+					mp = fmp->b_cont;
+					fmp->b_cont = NULL;
+					OVERLAY_FREEMSG(mp,
+					    "freed a fmp block");
+					freemsg(fmp);
+				}
+			}
+			if (mp == NULL) {
+				OVERLAY_FREEMSG(mp, "freed it all...");
+				continue;
+			}
+		}
+
+
+		od.odd_vid = infop.ovdi_id;
+		mutex_enter(&mux->omux_lock);
+		odd = avl_find(&mux->omux_devices, &od, NULL);
+		if (odd == NULL) {
+			mutex_exit(&mux->omux_lock);
+			OVERLAY_FREEMSG(mp, "no matching vid");
+			freemsg(mp);
+			continue;
+		}
+		mutex_enter(&odd->odd_lock);
+		if ((odd->odd_flags & OVERLAY_F_MDDROP) ||
+		    !(odd->odd_flags & OVERLAY_F_IN_MUX)) {
+			mutex_exit(&odd->odd_lock);
+			mutex_exit(&mux->omux_lock);
+			OVERLAY_FREEMSG(mp, "dev dropped");
+			freemsg(mp);
+			continue;
+		}
+		overlay_io_start(odd, OVERLAY_F_IN_RX);
+		mutex_exit(&odd->odd_lock);
+		mutex_exit(&mux->omux_lock);
+
+		mac_rx(odd->odd_mh, NULL, mp);
+
+		mutex_enter(&odd->odd_lock);
+		overlay_io_done(odd, OVERLAY_F_IN_RX);
+		mutex_exit(&odd->odd_lock);
+	}
+
+	return (B_TRUE);
+}
+
+/*
+ * Register a given device with a socket backend. If no such device socket
+ * exists, create a new one.
+ */
+overlay_mux_t *
+overlay_mux_open(overlay_plugin_t *opp, int domain, int family, int protocol,
+    struct sockaddr *addr, socklen_t len, int *errp)
+{
+	int err;
+	overlay_mux_t *mux;
+	ksocket_t ksock;
+
+	if (errp == NULL)
+		errp = &err;
+
+	mutex_enter(&overlay_mux_lock);
+	for (mux = list_head(&overlay_mux_list); mux != NULL;
+	    mux = list_next(&overlay_mux_list, mux)) {
+		if (domain == mux->omux_domain &&
+		    family == mux->omux_family &&
+		    protocol == mux->omux_protocol &&
+		    len == mux->omux_alen &&
+		    bcmp(addr, mux->omux_addr, len) == 0) {
+
+			if (opp != mux->omux_plugin) {
+				*errp = EEXIST;
+				return (NULL);
+			}
+
+			mutex_enter(&mux->omux_lock);
+			mux->omux_count++;
+			mutex_exit(&mux->omux_lock);
+			mutex_exit(&overlay_mux_lock);
+			*errp = 0;
+			return (mux);
+		}
+	}
+
+	/*
+	 * Today we aren't zone-aware and only exist in the global zone. When we
+	 * allow for things to exist in the non-global zone, we'll want to use a
+	 * credential that's actually specific to the zone.
+	 */
+	*errp = ksocket_socket(&ksock, domain, family, protocol, KSOCKET_SLEEP,
+	    kcred);
+	if (*errp != 0) {
+		mutex_exit(&overlay_mux_lock);
+		return (NULL);
+	}
+
+	*errp = ksocket_bind(ksock, addr, len, kcred);
+	if (*errp != 0) {
+		mutex_exit(&overlay_mux_lock);
+		ksocket_close(ksock, kcred);
+		return (NULL);
+	}
+
+	/*
+	 * Ask our lower layer to optionally toggle anything they need on this
+	 * socket. Because a socket is owned by a single type of plugin, we can
+	 * then ask it to perform any additional socket set up it'd like to do.
+	 */
+	if (opp->ovp_ops->ovpo_sockopt != NULL &&
+	    (*errp = opp->ovp_ops->ovpo_sockopt(ksock)) != 0) {
+		mutex_exit(&overlay_mux_lock);
+		ksocket_close(ksock, kcred);
+		return (NULL);
+	}
+
+	mux = kmem_alloc(sizeof (overlay_mux_t), KM_SLEEP);
+	list_link_init(&mux->omux_lnode);
+	mux->omux_ksock = ksock;
+	mux->omux_plugin = opp;
+	mux->omux_domain = domain;
+	mux->omux_family = family;
+	mux->omux_protocol = protocol;
+	mux->omux_addr = kmem_alloc(len, KM_SLEEP);
+	bcopy(addr, mux->omux_addr, len);
+	mux->omux_alen = len;
+	mux->omux_count = 1;
+	avl_create(&mux->omux_devices, overlay_mux_comparator,
+	    sizeof (overlay_dev_t), offsetof(overlay_dev_t, odd_muxnode));
+	mutex_init(&mux->omux_lock, NULL, MUTEX_DRIVER, NULL);
+
+
+	/* Once this is called, we need to expect to rx data */
+	*errp = ksocket_krecv_set(ksock, overlay_mux_recv, mux);
+	if (*errp != 0) {
+		ksocket_close(ksock, kcred);
+		mutex_destroy(&mux->omux_lock);
+		avl_destroy(&mux->omux_devices);
+		kmem_free(mux->omux_addr, len);
+		kmem_free(mux, sizeof (overlay_mux_t));
+		return (NULL);
+	}
+
+	list_insert_tail(&overlay_mux_list, mux);
+	mutex_exit(&overlay_mux_lock);
+
+	*errp = 0;
+	return (mux);
+}
+
+void
+overlay_mux_close(overlay_mux_t *mux)
+{
+	mutex_enter(&overlay_mux_lock);
+	mutex_enter(&mux->omux_lock);
+	mux->omux_count--;
+	if (mux->omux_count != 0) {
+		mutex_exit(&mux->omux_lock);
+		mutex_exit(&overlay_mux_lock);
+		return;
+	}
+	list_remove(&overlay_mux_list, mux);
+	mutex_exit(&mux->omux_lock);
+	mutex_exit(&overlay_mux_lock);
+
+	ksocket_close(mux->omux_ksock, kcred);
+	avl_destroy(&mux->omux_devices);
+	kmem_free(mux->omux_addr, mux->omux_alen);
+	kmem_free(mux, sizeof (overlay_mux_t));
+}
+
+void
+overlay_mux_add_dev(overlay_mux_t *mux, overlay_dev_t *odd)
+{
+	mutex_enter(&mux->omux_lock);
+	avl_add(&mux->omux_devices, odd);
+	mutex_exit(&mux->omux_lock);
+}
+
+void
+overlay_mux_remove_dev(overlay_mux_t *mux, overlay_dev_t *odd)
+{
+	mutex_enter(&mux->omux_lock);
+	avl_remove(&mux->omux_devices, odd);
+	mutex_exit(&mux->omux_lock);
+}
+
+int
+overlay_mux_tx(overlay_mux_t *mux, struct msghdr *hdr, mblk_t *mp)
+{
+	int ret;
+
+	/*
+	 * It'd be nice to be able to use MSG_MBLK_QUICKRELE, unfortunately,
+	 * that isn't actually supported by UDP at this time.
+	 */
+	ret = ksocket_sendmblk(mux->omux_ksock, hdr, 0, &mp, kcred);
+	if (ret != 0)
+		freemsg(mp);
+
+	return (ret);
+}
diff --git a/usr/src/uts/common/io/overlay/overlay_plugin.c b/usr/src/uts/common/io/overlay/overlay_plugin.c
new file mode 100644
index 0000000000..348ddb92a2
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay_plugin.c
@@ -0,0 +1,281 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * Overlay device encapsulation plugin management
+ *
+ * For more information, see the big theory statement in
+ * uts/common/io/overlay/overlay.c
+ */
+
+#include <sys/types.h>
+#include <sys/kmem.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/errno.h>
+#include <sys/sysmacros.h>
+#include <sys/modctl.h>
+
+#include <sys/overlay_impl.h>
+
+static kmem_cache_t *overlay_plugin_cache;
+static kmutex_t overlay_plugin_lock;
+static list_t overlay_plugin_list;
+
+#define	OVERLAY_MODDIR	"overlay"
+
+/* ARGSUSED */
+static int
+overlay_plugin_cache_constructor(void *buf, void *arg, int kmflags)
+{
+	overlay_plugin_t *opp = buf;
+
+	mutex_init(&opp->ovp_mutex, NULL, MUTEX_DRIVER, NULL);
+	list_link_init(&opp->ovp_link);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+overlay_plugin_cache_destructor(void *buf, void *arg)
+{
+	overlay_plugin_t *opp = buf;
+	ASSERT(list_link_active(&opp->ovp_link) == 0);
+	mutex_destroy(&opp->ovp_mutex);
+}
+
+void
+overlay_plugin_init(void)
+{
+	mutex_init(&overlay_plugin_lock, NULL, MUTEX_DRIVER, 0);
+
+	/*
+	 * In the future we may want to have a reaper to unload unused modules
+	 * to help the kernel be able to reclaim memory.
+	 */
+	overlay_plugin_cache = kmem_cache_create("overlay_plugin_cache",
+	    sizeof (overlay_plugin_t), 0, overlay_plugin_cache_constructor,
+	    overlay_plugin_cache_destructor, NULL, NULL, NULL, 0);
+	list_create(&overlay_plugin_list, sizeof (overlay_plugin_t),
+	    offsetof(overlay_plugin_t, ovp_link));
+}
+
+void
+overlay_plugin_fini(void)
+{
+	mutex_enter(&overlay_plugin_lock);
+	VERIFY(list_is_empty(&overlay_plugin_list));
+	mutex_exit(&overlay_plugin_lock);
+
+	list_destroy(&overlay_plugin_list);
+	kmem_cache_destroy(overlay_plugin_cache);
+	mutex_destroy(&overlay_plugin_lock);
+}
+
+overlay_plugin_register_t *
+overlay_plugin_alloc(uint_t version)
+{
+	overlay_plugin_register_t *ovrp;
+	/* Version 1 is the only one that exists */
+	if (version != OVEP_VERSION_ONE)
+		return (NULL);
+
+	ovrp = kmem_zalloc(sizeof (overlay_plugin_register_t), KM_SLEEP);
+	ovrp->ovep_version = version;
+	return (ovrp);
+}
+
+void
+overlay_plugin_free(overlay_plugin_register_t *ovrp)
+{
+	kmem_free(ovrp, sizeof (overlay_plugin_register_t));
+}
+
+int
+overlay_plugin_register(overlay_plugin_register_t *ovrp)
+{
+	overlay_plugin_t *opp, *ipp;
+
+	/* Sanity check parameters of the registration */
+	if (ovrp->ovep_version != OVEP_VERSION_ONE)
+		return (EINVAL);
+
+	if (ovrp->ovep_name == NULL || ovrp->ovep_ops == NULL)
+		return (EINVAL);
+
+	if ((ovrp->ovep_flags & ~(OVEP_F_VLAN_TAG)) != 0)
+		return (EINVAL);
+
+	if (ovrp->ovep_id_size < 1)
+		return (EINVAL);
+
+	/* Don't support anything that has an id size larger than 8 bytes */
+	if (ovrp->ovep_id_size > 8)
+		return (ENOTSUP);
+
+	if (ovrp->ovep_dest == OVERLAY_PLUGIN_D_INVALID)
+		return (EINVAL);
+
+	if ((ovrp->ovep_dest & ~OVERLAY_PLUGIN_D_MASK) != 0)
+		return (EINVAL);
+
+	if (ovrp->ovep_ops->ovpo_callbacks != 0)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_init == NULL)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_fini == NULL)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_encap == NULL)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_decap == NULL)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_socket == NULL)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_getprop == NULL)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_setprop == NULL)
+		return (EINVAL);
+	if (ovrp->ovep_ops->ovpo_propinfo == NULL)
+		return (EINVAL);
+
+
+	opp = kmem_cache_alloc(overlay_plugin_cache, KM_SLEEP);
+	opp->ovp_active = 0;
+	opp->ovp_name = ovrp->ovep_name;
+	opp->ovp_ops = ovrp->ovep_ops;
+	opp->ovp_props = ovrp->ovep_props;
+	opp->ovp_id_size = ovrp->ovep_id_size;
+	opp->ovp_flags = ovrp->ovep_flags;
+	opp->ovp_dest = ovrp->ovep_dest;
+
+	opp->ovp_nprops = 0;
+	if (ovrp->ovep_props != NULL) {
+		while (ovrp->ovep_props[opp->ovp_nprops] != NULL) {
+			if (strlen(ovrp->ovep_props[opp->ovp_nprops]) >=
+			    OVERLAY_PROP_NAMELEN) {
+				mutex_exit(&overlay_plugin_lock);
+				kmem_cache_free(overlay_plugin_cache, opp);
+				return (EINVAL);
+			}
+			opp->ovp_nprops++;
+		}
+	}
+
+	mutex_enter(&overlay_plugin_lock);
+	for (ipp = list_head(&overlay_plugin_list); ipp != NULL;
+	    ipp = list_next(&overlay_plugin_list, ipp)) {
+		if (strcmp(ipp->ovp_name, opp->ovp_name) == 0) {
+			mutex_exit(&overlay_plugin_lock);
+			kmem_cache_free(overlay_plugin_cache, opp);
+			return (EEXIST);
+		}
+	}
+	list_insert_tail(&overlay_plugin_list, opp);
+	mutex_exit(&overlay_plugin_lock);
+
+	return (0);
+}
+
+int
+overlay_plugin_unregister(const char *name)
+{
+	overlay_plugin_t *opp;
+
+	mutex_enter(&overlay_plugin_lock);
+	for (opp = list_head(&overlay_plugin_list); opp != NULL;
+	    opp = list_next(&overlay_plugin_list, opp)) {
+		if (strcmp(opp->ovp_name, name) == 0)
+			break;
+	}
+
+	if (opp == NULL) {
+		mutex_exit(&overlay_plugin_lock);
+		return (ENOENT);
+	}
+
+	mutex_enter(&opp->ovp_mutex);
+	if (opp->ovp_active > 0) {
+		mutex_exit(&opp->ovp_mutex);
+		mutex_exit(&overlay_plugin_lock);
+		return (EBUSY);
+	}
+	mutex_exit(&opp->ovp_mutex);
+
+	list_remove(&overlay_plugin_list, opp);
+	mutex_exit(&overlay_plugin_lock);
+
+	kmem_cache_free(overlay_plugin_cache, opp);
+	return (0);
+}
+
+overlay_plugin_t *
+overlay_plugin_lookup(const char *name)
+{
+	overlay_plugin_t *opp;
+	boolean_t trymodload = B_FALSE;
+
+	for (;;) {
+		mutex_enter(&overlay_plugin_lock);
+		for (opp = list_head(&overlay_plugin_list); opp != NULL;
+		    opp = list_next(&overlay_plugin_list, opp)) {
+			if (strcmp(name, opp->ovp_name) == 0) {
+				mutex_enter(&opp->ovp_mutex);
+				opp->ovp_active++;
+				mutex_exit(&opp->ovp_mutex);
+				mutex_exit(&overlay_plugin_lock);
+				return (opp);
+			}
+		}
+		mutex_exit(&overlay_plugin_lock);
+
+		if (trymodload == B_TRUE)
+			return (NULL);
+
+		/*
+		 * If we didn't find it, it may still exist, but just not have
+		 * been a loaded module. In that case, we'll do one attempt to
+		 * load it.
+		 */
+		if (modload(OVERLAY_MODDIR, (char *)name) == -1)
+			return (NULL);
+		trymodload = B_TRUE;
+	}
+
+}
+
+void
+overlay_plugin_rele(overlay_plugin_t *opp)
+{
+	mutex_enter(&opp->ovp_mutex);
+	ASSERT(opp->ovp_active > 0);
+	opp->ovp_active--;
+	mutex_exit(&opp->ovp_mutex);
+}
+
+void
+overlay_plugin_walk(overlay_plugin_walk_f func, void *arg)
+{
+	overlay_plugin_t *opp;
+	mutex_enter(&overlay_plugin_lock);
+	for (opp = list_head(&overlay_plugin_list); opp != NULL;
+	    opp = list_next(&overlay_plugin_list, opp)) {
+		if (func(opp, arg) != 0) {
+			mutex_exit(&overlay_plugin_lock);
+			return;
+		}
+	}
+	mutex_exit(&overlay_plugin_lock);
+}
diff --git a/usr/src/uts/common/io/overlay/overlay_prop.c b/usr/src/uts/common/io/overlay/overlay_prop.c
new file mode 100644
index 0000000000..ba1ea2a629
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay_prop.c
@@ -0,0 +1,122 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+/*
+ * Routines for manipulating property information structures.
+ *
+ * For more information, see the big theory statement in
+ * uts/common/io/overlay/overlay.c
+ */
+
+#include <sys/overlay_impl.h>
+
+void
+overlay_prop_init(overlay_prop_handle_t phdl)
+{
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+	mac_propval_range_t *rangep = (mac_propval_range_t *)infop->oipi_poss;
+
+	infop->oipi_posssize = sizeof (mac_propval_range_t);
+	bzero(rangep, sizeof (mac_propval_range_t));
+}
+
+void
+overlay_prop_set_name(overlay_prop_handle_t phdl, const char *name)
+{
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+	(void) strlcpy(infop->oipi_name, name, OVERLAY_PROP_NAMELEN);
+}
+
+void
+overlay_prop_set_prot(overlay_prop_handle_t phdl, overlay_prop_prot_t prot)
+{
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+	infop->oipi_prot = prot;
+}
+
+void
+overlay_prop_set_type(overlay_prop_handle_t phdl, overlay_prop_type_t type)
+{
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+	infop->oipi_type = type;
+}
+
+int
+overlay_prop_set_default(overlay_prop_handle_t phdl, void *def, ssize_t len)
+{
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+
+	if (len > OVERLAY_PROP_SIZEMAX)
+		return (E2BIG);
+
+	if (len < 0)
+		return (EOVERFLOW);
+
+	bcopy(def, infop->oipi_default, len);
+	infop->oipi_defsize = (uint32_t)len;
+
+	return (0);
+}
+
+void
+overlay_prop_set_nodefault(overlay_prop_handle_t phdl)
+{
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+	infop->oipi_default[0] = '\0';
+	infop->oipi_defsize = 0;
+}
+
+void
+overlay_prop_set_range_uint32(overlay_prop_handle_t phdl, uint32_t min,
+    uint32_t max)
+{
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+	mac_propval_range_t *rangep = (mac_propval_range_t *)infop->oipi_poss;
+
+	if (rangep->mpr_count != 0 && rangep->mpr_type != MAC_PROPVAL_UINT32)
+		return;
+
+	if (infop->oipi_posssize + sizeof (mac_propval_uint32_range_t) >
+	    sizeof (infop->oipi_poss))
+		return;
+
+	infop->oipi_posssize += sizeof (mac_propval_uint32_range_t);
+	rangep->mpr_count++;
+	rangep->mpr_type = MAC_PROPVAL_UINT32;
+	rangep->u.mpr_uint32[rangep->mpr_count-1].mpur_min = min;
+	rangep->u.mpr_uint32[rangep->mpr_count-1].mpur_max = max;
+}
+
+void
+overlay_prop_set_range_str(overlay_prop_handle_t phdl, const char *str)
+{
+	size_t len = strlen(str) + 1; /* Account for a null terminator */
+	overlay_ioc_propinfo_t *infop = (overlay_ioc_propinfo_t *)phdl;
+	mac_propval_range_t *rangep = (mac_propval_range_t *)infop->oipi_poss;
+	mac_propval_str_range_t *pstr = &rangep->u.mpr_str;
+
+	if (rangep->mpr_count != 0 && rangep->mpr_type != MAC_PROPVAL_STR)
+		return;
+
+	if (infop->oipi_posssize + len > sizeof (infop->oipi_poss))
+		return;
+
+	rangep->mpr_count++;
+	rangep->mpr_type = MAC_PROPVAL_STR;
+	strlcpy((char *)&pstr->mpur_data[pstr->mpur_nextbyte], str,
+	    sizeof (infop->oipi_poss) - infop->oipi_posssize);
+	pstr->mpur_nextbyte += len;
+	infop->oipi_posssize += len;
+}
diff --git a/usr/src/uts/common/io/overlay/overlay_target.c b/usr/src/uts/common/io/overlay/overlay_target.c
new file mode 100644
index 0000000000..f4147b56d1
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/overlay_target.c
@@ -0,0 +1,1651 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Overlay device target cache management
+ *
+ * For more information, see the big theory statement in
+ * uts/common/io/overlay/overlay.c
+ */
+
+#include <sys/types.h>
+#include <sys/ethernet.h>
+#include <sys/kmem.h>
+#include <sys/policy.h>
+#include <sys/sysmacros.h>
+#include <sys/stream.h>
+#include <sys/strsun.h>
+#include <sys/strsubr.h>
+#include <sys/mac_provider.h>
+#include <sys/mac_client.h>
+#include <sys/mac_client_priv.h>
+#include <sys/vlan.h>
+#include <sys/crc32.h>
+#include <sys/cred.h>
+#include <sys/file.h>
+#include <sys/errno.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+
+#include <sys/overlay_impl.h>
+#include <sys/sdt.h>
+
+/*
+ * This is total straw man, but at least it's a prime number. Here we're
+ * going to have to go through and do a lot of evaluation and understanding as
+ * to how these target caches should grow and shrink, as well as, memory
+ * pressure and evictions. This just gives us a starting point that'll be 'good
+ * enough', until it's not.
+ */
+#define	OVERLAY_HSIZE	823
+
+/*
+ * We use this data structure to keep track of what requests have been actively
+ * allocated to a given instance so we know what to put back on the pending
+ * list.
+ */
+typedef struct overlay_target_hdl {
+	minor_t oth_minor;		/* RO */
+	zoneid_t oth_zoneid;		/* RO */
+	int oth_oflags;			/* RO */
+	list_node_t oth_link;		/* overlay_target_lock */
+	kmutex_t oth_lock;
+	list_t	oth_outstanding;	/* oth_lock */
+} overlay_target_hdl_t;
+
+typedef int (*overlay_target_copyin_f)(const void *, void **, size_t *, int);
+typedef int (*overlay_target_ioctl_f)(overlay_target_hdl_t *, void *);
+typedef int (*overlay_target_copyout_f)(void *, void *, size_t, int);
+
+typedef struct overaly_target_ioctl {
+	int		oti_cmd;	/* ioctl id */
+	boolean_t	oti_write;	/* ioctl requires FWRITE */
+	boolean_t	oti_ncopyout;	/* copyout data? */
+	overlay_target_copyin_f oti_copyin;	/* copyin func */
+	overlay_target_ioctl_f oti_func; /* function to call */
+	overlay_target_copyout_f oti_copyout;	/* copyin func */
+	size_t		oti_size;	/* size of user level structure */
+} overlay_target_ioctl_t;
+
+static kmem_cache_t *overlay_target_cache;
+static kmem_cache_t *overlay_entry_cache;
+static id_space_t *overlay_thdl_idspace;
+static void *overlay_thdl_state;
+
+/*
+ * When we support overlay devices in the NGZ, then all of these need to become
+ * zone aware, by plugging into the netstack engine and becoming per-netstack
+ * data.
+ */
+static list_t overlay_thdl_list;
+static kmutex_t overlay_target_lock;
+static kcondvar_t overlay_target_condvar;
+static list_t overlay_target_list;
+static boolean_t overlay_target_excl;
+
+/*
+ * Outstanding data per hash table entry.
+ */
+static int overlay_ent_size = 128 * 1024;
+
+/* ARGSUSED */
+static int
+overlay_target_cache_constructor(void *buf, void *arg, int kmflgs)
+{
+	overlay_target_t *ott = buf;
+
+	mutex_init(&ott->ott_lock, NULL, MUTEX_DRIVER, NULL);
+	cv_init(&ott->ott_cond, NULL, CV_DRIVER, NULL);
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+overlay_target_cache_destructor(void *buf, void *arg)
+{
+	overlay_target_t *ott = buf;
+
+	cv_destroy(&ott->ott_cond);
+	mutex_destroy(&ott->ott_lock);
+}
+
+/* ARGSUSED */
+static int
+overlay_entry_cache_constructor(void *buf, void *arg, int kmflgs)
+{
+	overlay_target_entry_t *ote = buf;
+
+	bzero(ote, sizeof (overlay_target_entry_t));
+	mutex_init(&ote->ote_lock, NULL, MUTEX_DRIVER, NULL);
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+overlay_entry_cache_destructor(void *buf, void *arg)
+{
+	overlay_target_entry_t *ote = buf;
+
+	mutex_destroy(&ote->ote_lock);
+}
+
+static uint64_t
+overlay_mac_hash(const void *v)
+{
+	uint32_t crc;
+	CRC32(crc, v, ETHERADDRL, -1U, crc32_table);
+	return (crc);
+}
+
+static int
+overlay_mac_cmp(const void *a, const void *b)
+{
+	return (bcmp(a, b, ETHERADDRL));
+}
+
+/* ARGSUSED */
+static void
+overlay_target_entry_dtor(void *arg)
+{
+	overlay_target_entry_t *ote = arg;
+
+	ote->ote_flags = 0;
+	bzero(ote->ote_addr, ETHERADDRL);
+	ote->ote_ott = NULL;
+	ote->ote_odd = NULL;
+	freemsgchain(ote->ote_chead);
+	ote->ote_chead = ote->ote_ctail = NULL;
+	ote->ote_mbsize = 0;
+	ote->ote_vtime = 0;
+	kmem_cache_free(overlay_entry_cache, ote);
+}
+
+static int
+overlay_mac_avl(const void *a, const void *b)
+{
+	int i;
+	const overlay_target_entry_t *l, *r;
+	l = a;
+	r = b;
+
+	for (i = 0; i < ETHERADDRL; i++) {
+		if (l->ote_addr[i] > r->ote_addr[i])
+			return (1);
+		else if (l->ote_addr[i] < r->ote_addr[i])
+			return (-1);
+	}
+
+	return (0);
+}
+
+void
+overlay_target_init(void)
+{
+	int ret;
+	ret = ddi_soft_state_init(&overlay_thdl_state,
+	    sizeof (overlay_target_hdl_t), 1);
+	VERIFY(ret == 0);
+	overlay_target_cache = kmem_cache_create("overlay_target",
+	    sizeof (overlay_target_t), 0, overlay_target_cache_constructor,
+	    overlay_target_cache_destructor, NULL, NULL, NULL, 0);
+	overlay_entry_cache = kmem_cache_create("overlay_entry",
+	    sizeof (overlay_target_entry_t), 0, overlay_entry_cache_constructor,
+	    overlay_entry_cache_destructor, NULL, NULL, NULL, 0);
+	mutex_init(&overlay_target_lock, NULL, MUTEX_DRIVER, NULL);
+	cv_init(&overlay_target_condvar, NULL, CV_DRIVER, NULL);
+	list_create(&overlay_target_list, sizeof (overlay_target_entry_t),
+	    offsetof(overlay_target_entry_t, ote_qlink));
+	list_create(&overlay_thdl_list, sizeof (overlay_target_hdl_t),
+	    offsetof(overlay_target_hdl_t, oth_link));
+	overlay_thdl_idspace = id_space_create("overlay_target_minors",
+	    1, INT32_MAX);
+}
+
+void
+overlay_target_fini(void)
+{
+	id_space_destroy(overlay_thdl_idspace);
+	list_destroy(&overlay_thdl_list);
+	list_destroy(&overlay_target_list);
+	cv_destroy(&overlay_target_condvar);
+	mutex_destroy(&overlay_target_lock);
+	kmem_cache_destroy(overlay_entry_cache);
+	kmem_cache_destroy(overlay_target_cache);
+	ddi_soft_state_fini(&overlay_thdl_state);
+}
+
+void
+overlay_target_free(overlay_dev_t *odd)
+{
+	if (odd->odd_target == NULL)
+		return;
+
+	if (odd->odd_target->ott_mode == OVERLAY_TARGET_DYNAMIC) {
+		refhash_t *rp = odd->odd_target->ott_u.ott_dyn.ott_dhash;
+		avl_tree_t *ap = &odd->odd_target->ott_u.ott_dyn.ott_tree;
+		overlay_target_entry_t *ote;
+
+		/*
+		 * Our AVL tree and hashtable contain the same elements,
+		 * therefore we should just remove it from the tree, but then
+		 * delete the entries when we remove them from the hash table
+		 * (which happens through the refhash dtor).
+		 */
+		while ((ote = avl_first(ap)) != NULL)
+			avl_remove(ap, ote);
+
+		avl_destroy(ap);
+		for (ote = refhash_first(rp); ote != NULL;
+		    ote = refhash_next(rp, ote)) {
+			refhash_remove(rp, ote);
+		}
+		refhash_destroy(rp);
+	}
+
+	ASSERT(odd->odd_target->ott_ocount == 0);
+	kmem_cache_free(overlay_target_cache, odd->odd_target);
+}
+
+int
+overlay_target_busy()
+{
+	int ret;
+
+	mutex_enter(&overlay_target_lock);
+	ret = !list_is_empty(&overlay_thdl_list);
+	mutex_exit(&overlay_target_lock);
+
+	return (ret);
+}
+
+static void
+overlay_target_queue(overlay_target_entry_t *entry)
+{
+	mutex_enter(&overlay_target_lock);
+	mutex_enter(&entry->ote_ott->ott_lock);
+	if (entry->ote_ott->ott_flags & OVERLAY_T_TEARDOWN) {
+		mutex_exit(&entry->ote_ott->ott_lock);
+		mutex_exit(&overlay_target_lock);
+		return;
+	}
+	entry->ote_ott->ott_ocount++;
+	mutex_exit(&entry->ote_ott->ott_lock);
+	list_insert_tail(&overlay_target_list, entry);
+	cv_signal(&overlay_target_condvar);
+	mutex_exit(&overlay_target_lock);
+}
+
+void
+overlay_target_quiesce(overlay_target_t *ott)
+{
+	if (ott == NULL)
+		return;
+	mutex_enter(&ott->ott_lock);
+	ott->ott_flags |= OVERLAY_T_TEARDOWN;
+	while (ott->ott_ocount != 0)
+		cv_wait(&ott->ott_cond, &ott->ott_lock);
+	mutex_exit(&ott->ott_lock);
+}
+
+/*
+ * This functions assumes that the destination mode is OVERLAY_PLUGIN_D_IP |
+ * OVERLAY_PLUGIN_D_PORT. As we don't have an implementation of anything else at
+ * this time, say for NVGRE, we drop all packets that mcuh this.
+ */
+int
+overlay_target_lookup(overlay_dev_t *odd, mblk_t *mp, struct sockaddr *sock,
+    socklen_t *slenp)
+{
+	int ret;
+	struct sockaddr_in6 *v6;
+	overlay_target_t *ott;
+	mac_header_info_t mhi;
+	overlay_target_entry_t *entry;
+
+	ASSERT(odd->odd_target != NULL);
+
+	/*
+	 * At this point, the overlay device is in a mux which means that it's
+	 * been activated. At this point, parts of the target, such as the mode
+	 * and the destination are now read-only and we don't have to worry
+	 * about synchronization for them.
+	 */
+	ott = odd->odd_target;
+	if (ott->ott_dest != (OVERLAY_PLUGIN_D_IP | OVERLAY_PLUGIN_D_PORT))
+		return (OVERLAY_TARGET_DROP);
+
+	v6 = (struct sockaddr_in6 *)sock;
+	bzero(v6, sizeof (struct sockaddr_in6));
+	v6->sin6_family = AF_INET6;
+
+	if (ott->ott_mode == OVERLAY_TARGET_POINT) {
+		mutex_enter(&ott->ott_lock);
+		bcopy(&ott->ott_u.ott_point.otp_ip, &v6->sin6_addr,
+		    sizeof (struct in6_addr));
+		v6->sin6_port = htons(ott->ott_u.ott_point.otp_port);
+		mutex_exit(&ott->ott_lock);
+		*slenp = sizeof (struct sockaddr_in6);
+
+		return (OVERLAY_TARGET_OK);
+	}
+
+	ASSERT(ott->ott_mode == OVERLAY_TARGET_DYNAMIC);
+
+	/*
+	 * Note we only want the MAC address here, therefore we won't bother
+	 * using mac_vlan_header_info(). If any caller needs the vlan info at
+	 * this point, this should change to a call to mac_vlan_header_info().
+	 */
+	if (mac_header_info(odd->odd_mh, mp, &mhi) != 0)
+		return (OVERLAY_TARGET_DROP);
+	mutex_enter(&ott->ott_lock);
+	entry = refhash_lookup(ott->ott_u.ott_dyn.ott_dhash,
+	    mhi.mhi_daddr);
+	if (entry == NULL) {
+		entry = kmem_cache_alloc(overlay_entry_cache,
+		    KM_NOSLEEP | KM_NORMALPRI);
+		if (entry == NULL) {
+			mutex_exit(&ott->ott_lock);
+			return (OVERLAY_TARGET_DROP);
+		}
+		bcopy(mhi.mhi_daddr, entry->ote_addr, ETHERADDRL);
+		entry->ote_chead = entry->ote_ctail = mp;
+		entry->ote_mbsize = msgsize(mp);
+		entry->ote_flags |= OVERLAY_ENTRY_F_PENDING;
+		entry->ote_ott = ott;
+		entry->ote_odd = odd;
+		refhash_insert(ott->ott_u.ott_dyn.ott_dhash, entry);
+		avl_add(&ott->ott_u.ott_dyn.ott_tree, entry);
+		mutex_exit(&ott->ott_lock);
+		overlay_target_queue(entry);
+		return (OVERLAY_TARGET_ASYNC);
+	}
+	refhash_hold(ott->ott_u.ott_dyn.ott_dhash, entry);
+	mutex_exit(&ott->ott_lock);
+
+	mutex_enter(&entry->ote_lock);
+	if (entry->ote_flags & OVERLAY_ENTRY_F_DROP) {
+		ret = OVERLAY_TARGET_DROP;
+	} else if (entry->ote_flags & OVERLAY_ENTRY_F_VALID) {
+		bcopy(&entry->ote_dest.otp_ip, &v6->sin6_addr,
+		    sizeof (struct in6_addr));
+		v6->sin6_port = htons(entry->ote_dest.otp_port);
+		*slenp = sizeof (struct sockaddr_in6);
+		ret = OVERLAY_TARGET_OK;
+	} else {
+		size_t mlen = msgsize(mp);
+
+		if (mlen + entry->ote_mbsize > overlay_ent_size) {
+			ret = OVERLAY_TARGET_DROP;
+		} else {
+			if (entry->ote_ctail != NULL) {
+				ASSERT(entry->ote_ctail->b_next ==
+				    NULL);
+				entry->ote_ctail->b_next = mp;
+				entry->ote_ctail = mp;
+			} else {
+				entry->ote_chead = mp;
+				entry->ote_ctail = mp;
+			}
+			entry->ote_mbsize += mlen;
+			if ((entry->ote_flags &
+			    OVERLAY_ENTRY_F_PENDING) == 0) {
+				entry->ote_flags |=
+				    OVERLAY_ENTRY_F_PENDING;
+				overlay_target_queue(entry);
+			}
+			ret = OVERLAY_TARGET_ASYNC;
+		}
+	}
+	mutex_exit(&entry->ote_lock);
+
+	mutex_enter(&ott->ott_lock);
+	refhash_rele(ott->ott_u.ott_dyn.ott_dhash, entry);
+	mutex_exit(&ott->ott_lock);
+
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_info(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_t *odd;
+	overlay_targ_info_t *oti = arg;
+
+	odd = overlay_hold_by_dlid(oti->oti_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	oti->oti_flags = 0;
+	oti->oti_needs = odd->odd_plugin->ovp_dest;
+	if (odd->odd_flags & OVERLAY_F_DEGRADED)
+		oti->oti_flags |= OVERLAY_TARG_INFO_F_DEGRADED;
+	if (odd->odd_flags & OVERLAY_F_ACTIVATED)
+		oti->oti_flags |= OVERLAY_TARG_INFO_F_ACTIVE;
+	oti->oti_vnetid = odd->odd_vid;
+	mutex_exit(&odd->odd_lock);
+	overlay_hold_rele(odd);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_associate(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_t *odd;
+	overlay_target_t *ott;
+	overlay_targ_associate_t *ota = arg;
+
+	odd = overlay_hold_by_dlid(ota->ota_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	if (ota->ota_id == 0) {
+		overlay_hold_rele(odd);
+		return (EINVAL);
+	}
+
+	if (ota->ota_mode != OVERLAY_TARGET_POINT &&
+	    ota->ota_mode != OVERLAY_TARGET_DYNAMIC) {
+		overlay_hold_rele(odd);
+		return (EINVAL);
+	}
+
+	if (ota->ota_provides != odd->odd_plugin->ovp_dest) {
+		overlay_hold_rele(odd);
+		return (EINVAL);
+	}
+
+	if (ota->ota_mode == OVERLAY_TARGET_POINT) {
+		if (ota->ota_provides & OVERLAY_PLUGIN_D_IP) {
+			if (IN6_IS_ADDR_UNSPECIFIED(&ota->ota_point.otp_ip) ||
+			    IN6_IS_ADDR_V4COMPAT(&ota->ota_point.otp_ip) ||
+			    IN6_IS_ADDR_V4MAPPED_ANY(&ota->ota_point.otp_ip)) {
+				overlay_hold_rele(odd);
+				return (EINVAL);
+			}
+		}
+
+		if (ota->ota_provides & OVERLAY_PLUGIN_D_PORT) {
+			if (ota->ota_point.otp_port == 0) {
+				overlay_hold_rele(odd);
+				return (EINVAL);
+			}
+		}
+	}
+
+	ott = kmem_cache_alloc(overlay_target_cache, KM_SLEEP);
+	ott->ott_flags = 0;
+	ott->ott_ocount = 0;
+	ott->ott_mode = ota->ota_mode;
+	ott->ott_dest = ota->ota_provides;
+	ott->ott_id = ota->ota_id;
+
+	if (ott->ott_mode == OVERLAY_TARGET_POINT) {
+		bcopy(&ota->ota_point, &ott->ott_u.ott_point,
+		    sizeof (overlay_target_point_t));
+	} else {
+		ott->ott_u.ott_dyn.ott_dhash = refhash_create(OVERLAY_HSIZE,
+		    overlay_mac_hash, overlay_mac_cmp,
+		    overlay_target_entry_dtor, sizeof (overlay_target_entry_t),
+		    offsetof(overlay_target_entry_t, ote_reflink),
+		    offsetof(overlay_target_entry_t, ote_addr), KM_SLEEP);
+		avl_create(&ott->ott_u.ott_dyn.ott_tree, overlay_mac_avl,
+		    sizeof (overlay_target_entry_t),
+		    offsetof(overlay_target_entry_t, ote_avllink));
+	}
+	mutex_enter(&odd->odd_lock);
+	if (odd->odd_flags & OVERLAY_F_VARPD) {
+		mutex_exit(&odd->odd_lock);
+		kmem_cache_free(overlay_target_cache, ott);
+		overlay_hold_rele(odd);
+		return (EEXIST);
+	}
+
+	odd->odd_flags |= OVERLAY_F_VARPD;
+	odd->odd_target = ott;
+	mutex_exit(&odd->odd_lock);
+
+	overlay_hold_rele(odd);
+
+
+	return (0);
+}
+
+
+/* ARGSUSED */
+static int
+overlay_target_degrade(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_t *odd;
+	overlay_targ_degrade_t *otd = arg;
+
+	odd = overlay_hold_by_dlid(otd->otd_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	overlay_fm_degrade(odd, otd->otd_buf);
+	overlay_hold_rele(odd);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_restore(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_t *odd;
+	overlay_targ_id_t *otid = arg;
+
+	odd = overlay_hold_by_dlid(otid->otid_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	overlay_fm_restore(odd);
+	overlay_hold_rele(odd);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_disassociate(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_t *odd;
+	overlay_targ_id_t *otid = arg;
+
+	odd = overlay_hold_by_dlid(otid->otid_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	odd->odd_flags &= ~OVERLAY_F_VARPD;
+	mutex_exit(&odd->odd_lock);
+
+	overlay_hold_rele(odd);
+	return (0);
+
+}
+
+static int
+overlay_target_lookup_request(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_targ_lookup_t *otl = arg;
+	overlay_target_entry_t *entry;
+	clock_t ret, timeout;
+	mac_header_info_t mhi;
+
+	timeout = ddi_get_lbolt() + drv_usectohz(MICROSEC);
+again:
+	mutex_enter(&overlay_target_lock);
+	while (list_is_empty(&overlay_target_list)) {
+		ret = cv_timedwait(&overlay_target_condvar,
+		    &overlay_target_lock, timeout);
+		if (ret == -1) {
+			mutex_exit(&overlay_target_lock);
+			return (ETIME);
+		}
+	}
+	entry = list_remove_head(&overlay_target_list);
+	mutex_exit(&overlay_target_lock);
+	mutex_enter(&entry->ote_lock);
+	if (entry->ote_flags & OVERLAY_ENTRY_F_VALID) {
+		ASSERT(entry->ote_chead == NULL);
+		mutex_exit(&entry->ote_lock);
+		goto again;
+	}
+	ASSERT(entry->ote_chead != NULL);
+
+	/*
+	 * If we have a bogon that doesn't have a valid mac header, drop it and
+	 * try again.
+	 */
+	if (mac_vlan_header_info(entry->ote_odd->odd_mh, entry->ote_chead,
+	    &mhi) != 0) {
+		boolean_t queue = B_FALSE;
+		mblk_t *mp = entry->ote_chead;
+		entry->ote_chead = mp->b_next;
+		mp->b_next = NULL;
+		if (entry->ote_ctail == mp)
+			entry->ote_ctail = entry->ote_chead;
+		entry->ote_mbsize -= msgsize(mp);
+		if (entry->ote_chead != NULL)
+			queue = B_TRUE;
+		mutex_exit(&entry->ote_lock);
+		if (queue == B_TRUE)
+			overlay_target_queue(entry);
+		freemsg(mp);
+		goto again;
+	}
+
+	otl->otl_dlid = entry->ote_odd->odd_linkid;
+	otl->otl_reqid = (uintptr_t)entry;
+	otl->otl_varpdid = entry->ote_ott->ott_id;
+	otl->otl_vnetid = entry->ote_odd->odd_vid;
+
+	otl->otl_hdrsize = mhi.mhi_hdrsize;
+	otl->otl_pktsize = msgsize(entry->ote_chead) - otl->otl_hdrsize;
+	bcopy(mhi.mhi_daddr, otl->otl_dstaddr, ETHERADDRL);
+	bcopy(mhi.mhi_saddr, otl->otl_srcaddr, ETHERADDRL);
+	otl->otl_dsttype = mhi.mhi_dsttype;
+	otl->otl_sap = mhi.mhi_bindsap;
+	otl->otl_vlan = VLAN_ID(mhi.mhi_tci);
+	mutex_exit(&entry->ote_lock);
+
+	mutex_enter(&thdl->oth_lock);
+	list_insert_tail(&thdl->oth_outstanding, entry);
+	mutex_exit(&thdl->oth_lock);
+
+	return (0);
+}
+
+static int
+overlay_target_lookup_respond(overlay_target_hdl_t *thdl, void *arg)
+{
+	const overlay_targ_resp_t *otr = arg;
+	overlay_target_entry_t *entry;
+	mblk_t *mp;
+
+	mutex_enter(&thdl->oth_lock);
+	for (entry = list_head(&thdl->oth_outstanding); entry != NULL;
+	    entry = list_next(&thdl->oth_outstanding, entry)) {
+		if ((uintptr_t)entry == otr->otr_reqid)
+			break;
+	}
+
+	if (entry == NULL) {
+		mutex_exit(&thdl->oth_lock);
+		return (EINVAL);
+	}
+	list_remove(&thdl->oth_outstanding, entry);
+	mutex_exit(&thdl->oth_lock);
+
+	mutex_enter(&entry->ote_lock);
+	bcopy(&otr->otr_answer, &entry->ote_dest,
+	    sizeof (overlay_target_point_t));
+	entry->ote_flags &= ~OVERLAY_ENTRY_F_PENDING;
+	entry->ote_flags |= OVERLAY_ENTRY_F_VALID;
+	mp = entry->ote_chead;
+	entry->ote_chead = NULL;
+	entry->ote_ctail = NULL;
+	entry->ote_mbsize = 0;
+	entry->ote_vtime = gethrtime();
+	mutex_exit(&entry->ote_lock);
+
+	/*
+	 * For now do an in-situ drain.
+	 */
+	mp = overlay_m_tx(entry->ote_odd, mp);
+	freemsgchain(mp);
+
+	mutex_enter(&entry->ote_ott->ott_lock);
+	entry->ote_ott->ott_ocount--;
+	cv_signal(&entry->ote_ott->ott_cond);
+	mutex_exit(&entry->ote_ott->ott_lock);
+
+	return (0);
+}
+
+static int
+overlay_target_lookup_drop(overlay_target_hdl_t *thdl, void *arg)
+{
+	const overlay_targ_resp_t *otr = arg;
+	overlay_target_entry_t *entry;
+	mblk_t *mp;
+	boolean_t queue = B_FALSE;
+
+	mutex_enter(&thdl->oth_lock);
+	for (entry = list_head(&thdl->oth_outstanding); entry != NULL;
+	    entry = list_next(&thdl->oth_outstanding, entry)) {
+		if ((uintptr_t)entry == otr->otr_reqid)
+			break;
+	}
+
+	if (entry == NULL) {
+		mutex_exit(&thdl->oth_lock);
+		return (EINVAL);
+	}
+	list_remove(&thdl->oth_outstanding, entry);
+	mutex_exit(&thdl->oth_lock);
+
+	mutex_enter(&entry->ote_lock);
+
+	/* Safeguard against a confused varpd */
+	if (entry->ote_flags & OVERLAY_ENTRY_F_VALID) {
+		entry->ote_flags &= ~OVERLAY_ENTRY_F_PENDING;
+		DTRACE_PROBE1(overlay__target__valid__drop,
+		    overlay_target_entry_t *, entry);
+		mutex_exit(&entry->ote_lock);
+		goto done;
+	}
+
+	mp = entry->ote_chead;
+	if (mp != NULL) {
+		entry->ote_chead = mp->b_next;
+		mp->b_next = NULL;
+		if (entry->ote_ctail == mp)
+			entry->ote_ctail = entry->ote_chead;
+		entry->ote_mbsize -= msgsize(mp);
+	}
+	if (entry->ote_chead != NULL) {
+		queue = B_TRUE;
+		entry->ote_flags |= OVERLAY_ENTRY_F_PENDING;
+	} else {
+		entry->ote_flags &= ~OVERLAY_ENTRY_F_PENDING;
+	}
+	mutex_exit(&entry->ote_lock);
+
+	if (queue == B_TRUE)
+		overlay_target_queue(entry);
+	freemsg(mp);
+
+done:
+	mutex_enter(&entry->ote_ott->ott_lock);
+	entry->ote_ott->ott_ocount--;
+	cv_signal(&entry->ote_ott->ott_cond);
+	mutex_exit(&entry->ote_ott->ott_lock);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_pkt_copyin(const void *ubuf, void **outp, size_t *bsize,
+    int flags)
+{
+	overlay_targ_pkt_t *pkt;
+	overlay_targ_pkt32_t *pkt32;
+
+	pkt = kmem_alloc(sizeof (overlay_targ_pkt_t), KM_SLEEP);
+	*outp = pkt;
+	*bsize = sizeof (overlay_targ_pkt_t);
+	if (ddi_model_convert_from(flags & FMODELS) == DDI_MODEL_ILP32) {
+		uintptr_t addr;
+
+		if (ddi_copyin(ubuf, pkt, sizeof (overlay_targ_pkt32_t),
+		    flags & FKIOCTL) != 0) {
+			kmem_free(pkt, *bsize);
+			return (EFAULT);
+		}
+		pkt32 = (overlay_targ_pkt32_t *)pkt;
+		addr = pkt32->otp_buf;
+		pkt->otp_buf = (void *)addr;
+	} else {
+		if (ddi_copyin(ubuf, pkt, *bsize, flags & FKIOCTL) != 0) {
+			kmem_free(pkt, *bsize);
+			return (EFAULT);
+		}
+	}
+	return (0);
+}
+
+static int
+overlay_target_pkt_copyout(void *ubuf, void *buf, size_t bufsize,
+    int flags)
+{
+	if (ddi_model_convert_from(flags & FMODELS) == DDI_MODEL_ILP32) {
+		overlay_targ_pkt_t *pkt = buf;
+		overlay_targ_pkt32_t *pkt32 = buf;
+		uintptr_t addr = (uintptr_t)pkt->otp_buf;
+		pkt32->otp_buf = (caddr32_t)addr;
+		if (ddi_copyout(buf, ubuf, sizeof (overlay_targ_pkt32_t),
+		    flags & FKIOCTL) != 0)
+			return (EFAULT);
+	} else {
+		if (ddi_copyout(buf, ubuf, bufsize, flags & FKIOCTL) != 0)
+			return (EFAULT);
+	}
+	return (0);
+}
+
+static int
+overlay_target_packet(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_targ_pkt_t *pkt = arg;
+	overlay_target_entry_t *entry;
+	mblk_t *mp;
+	size_t mlen;
+	size_t boff;
+
+	mutex_enter(&thdl->oth_lock);
+	for (entry = list_head(&thdl->oth_outstanding); entry != NULL;
+	    entry = list_next(&thdl->oth_outstanding, entry)) {
+		if ((uintptr_t)entry == pkt->otp_reqid)
+			break;
+	}
+
+	if (entry == NULL) {
+		mutex_exit(&thdl->oth_lock);
+		return (EINVAL);
+	}
+	mutex_enter(&entry->ote_lock);
+	mutex_exit(&thdl->oth_lock);
+	mp = entry->ote_chead;
+	/* Protect against a rogue varpd */
+	if (mp == NULL) {
+		mutex_exit(&entry->ote_lock);
+		return (EINVAL);
+	}
+	mlen = MIN(msgsize(mp), pkt->otp_size);
+	pkt->otp_size = mlen;
+	boff = 0;
+	while (mlen > 0) {
+		size_t wlen = MIN(MBLKL(mp), mlen);
+		if (ddi_copyout(mp->b_rptr,
+		    (void *)((uintptr_t)pkt->otp_buf + boff),
+		    wlen, 0) != 0) {
+			mutex_exit(&entry->ote_lock);
+			return (EFAULT);
+		}
+		mlen -= wlen;
+		boff += wlen;
+		mp = mp->b_cont;
+	}
+	mutex_exit(&entry->ote_lock);
+	return (0);
+}
+
+static int
+overlay_target_inject(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_targ_pkt_t *pkt = arg;
+	overlay_target_entry_t *entry;
+	overlay_dev_t *odd;
+	mblk_t *mp;
+
+	if (pkt->otp_size > ETHERMAX + VLAN_TAGSZ)
+		return (EINVAL);
+
+	mp = allocb(pkt->otp_size, 0);
+	if (mp == NULL)
+		return (ENOMEM);
+
+	if (ddi_copyin(pkt->otp_buf, mp->b_rptr, pkt->otp_size, 0) != 0) {
+		freeb(mp);
+		return (EFAULT);
+	}
+	mp->b_wptr += pkt->otp_size;
+
+	if (pkt->otp_linkid != UINT64_MAX) {
+		odd = overlay_hold_by_dlid(pkt->otp_linkid);
+		if (odd == NULL) {
+			freeb(mp);
+			return (ENOENT);
+		}
+	} else {
+		mutex_enter(&thdl->oth_lock);
+		for (entry = list_head(&thdl->oth_outstanding); entry != NULL;
+		    entry = list_next(&thdl->oth_outstanding, entry)) {
+			if ((uintptr_t)entry == pkt->otp_reqid)
+				break;
+		}
+
+		if (entry == NULL) {
+			mutex_exit(&thdl->oth_lock);
+			freeb(mp);
+			return (ENOENT);
+		}
+		odd = entry->ote_odd;
+		mutex_exit(&thdl->oth_lock);
+	}
+
+	mutex_enter(&odd->odd_lock);
+	overlay_io_start(odd, OVERLAY_F_IN_RX);
+	mutex_exit(&odd->odd_lock);
+
+	mac_rx(odd->odd_mh, NULL, mp);
+
+	mutex_enter(&odd->odd_lock);
+	overlay_io_done(odd, OVERLAY_F_IN_RX);
+	mutex_exit(&odd->odd_lock);
+
+	return (0);
+}
+
+static int
+overlay_target_resend(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_targ_pkt_t *pkt = arg;
+	overlay_target_entry_t *entry;
+	overlay_dev_t *odd;
+	mblk_t *mp;
+
+	if (pkt->otp_size > ETHERMAX + VLAN_TAGSZ)
+		return (EINVAL);
+
+	mp = allocb(pkt->otp_size, 0);
+	if (mp == NULL)
+		return (ENOMEM);
+
+	if (ddi_copyin(pkt->otp_buf, mp->b_rptr, pkt->otp_size, 0) != 0) {
+		freeb(mp);
+		return (EFAULT);
+	}
+	mp->b_wptr += pkt->otp_size;
+
+	if (pkt->otp_linkid != UINT64_MAX) {
+		odd = overlay_hold_by_dlid(pkt->otp_linkid);
+		if (odd == NULL) {
+			freeb(mp);
+			return (ENOENT);
+		}
+	} else {
+		mutex_enter(&thdl->oth_lock);
+		for (entry = list_head(&thdl->oth_outstanding); entry != NULL;
+		    entry = list_next(&thdl->oth_outstanding, entry)) {
+			if ((uintptr_t)entry == pkt->otp_reqid)
+				break;
+		}
+
+		if (entry == NULL) {
+			mutex_exit(&thdl->oth_lock);
+			freeb(mp);
+			return (ENOENT);
+		}
+		odd = entry->ote_odd;
+		mutex_exit(&thdl->oth_lock);
+	}
+
+	mp = overlay_m_tx(odd, mp);
+	freemsgchain(mp);
+
+	return (0);
+}
+
+typedef struct overlay_targ_list_int {
+	boolean_t	otli_count;
+	uint32_t	otli_cur;
+	uint32_t	otli_nents;
+	uint32_t	otli_ents[];
+} overlay_targ_list_int_t;
+
+static int
+overlay_target_list_copyin(const void *ubuf, void **outp, size_t *bsize,
+    int flags)
+{
+	overlay_targ_list_t n;
+	overlay_targ_list_int_t *otl;
+
+	if (ddi_copyin(ubuf, &n, sizeof (overlay_targ_list_t),
+	    flags & FKIOCTL) != 0)
+		return (EFAULT);
+
+	/*
+	 */
+	if (n.otl_nents >= INT32_MAX / sizeof (uint32_t))
+		return (EINVAL);
+	*bsize = sizeof (overlay_targ_list_int_t) +
+	    sizeof (uint32_t) * n.otl_nents;
+	otl = kmem_zalloc(*bsize, KM_SLEEP);
+	otl->otli_cur = 0;
+	otl->otli_nents = n.otl_nents;
+	if (otl->otli_nents != 0) {
+		otl->otli_count = B_FALSE;
+		if (ddi_copyin((void *)((uintptr_t)ubuf +
+		    offsetof(overlay_targ_list_t, otl_ents)),
+		    otl->otli_ents, n.otl_nents * sizeof (uint32_t),
+		    flags & FKIOCTL) != 0) {
+			kmem_free(otl, *bsize);
+			return (EFAULT);
+		}
+	} else {
+		otl->otli_count = B_TRUE;
+	}
+
+	*outp = otl;
+	return (0);
+}
+
+static int
+overlay_target_ioctl_list_cb(overlay_dev_t *odd, void *arg)
+{
+	overlay_targ_list_int_t *otl = arg;
+
+	if (otl->otli_cur < otl->otli_nents)
+		otl->otli_ents[otl->otli_cur] = odd->odd_linkid;
+	otl->otli_cur++;
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_ioctl_list(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_iter(overlay_target_ioctl_list_cb, arg);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_list_copyout(void *ubuf, void *buf, size_t bufsize, int flags)
+{
+	overlay_targ_list_int_t *otl = buf;
+
+	if (ddi_copyout(&otl->otli_cur, ubuf, sizeof (uint32_t),
+	    flags & FKIOCTL) != 0)
+		return (EFAULT);
+
+	if (otl->otli_count == B_FALSE) {
+		if (ddi_copyout(otl->otli_ents,
+		    (void *)((uintptr_t)ubuf +
+		    offsetof(overlay_targ_list_t, otl_ents)),
+		    sizeof (uint32_t) * otl->otli_nents,
+		    flags & FKIOCTL) != 0)
+			return (EFAULT);
+	}
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_cache_get(overlay_target_hdl_t *thdl, void *arg)
+{
+	int ret = 0;
+	overlay_dev_t *odd;
+	overlay_target_t *ott;
+	overlay_targ_cache_t *otc = arg;
+
+	odd = overlay_hold_by_dlid(otc->otc_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	if (!(odd->odd_flags & OVERLAY_F_VARPD)) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENXIO);
+	}
+	ott = odd->odd_target;
+	if (ott->ott_mode != OVERLAY_TARGET_POINT &&
+	    ott->ott_mode != OVERLAY_TARGET_DYNAMIC) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENOTSUP);
+	}
+	mutex_enter(&ott->ott_lock);
+	mutex_exit(&odd->odd_lock);
+
+	if (ott->ott_mode == OVERLAY_TARGET_POINT) {
+		otc->otc_entry.otce_flags = 0;
+		bcopy(&ott->ott_u.ott_point, &otc->otc_entry.otce_dest,
+		    sizeof (overlay_target_point_t));
+	} else {
+		overlay_target_entry_t *ote;
+		ote = refhash_lookup(ott->ott_u.ott_dyn.ott_dhash,
+		    otc->otc_entry.otce_mac);
+		if (ote != NULL) {
+			mutex_enter(&ote->ote_lock);
+			if ((ote->ote_flags &
+			    OVERLAY_ENTRY_F_VALID_MASK) != 0) {
+				if (ote->ote_flags & OVERLAY_ENTRY_F_DROP) {
+					otc->otc_entry.otce_flags =
+					    OVERLAY_TARGET_CACHE_DROP;
+				} else {
+					otc->otc_entry.otce_flags = 0;
+					bcopy(&ote->ote_dest,
+					    &otc->otc_entry.otce_dest,
+					    sizeof (overlay_target_point_t));
+				}
+				ret = 0;
+			} else {
+				ret = ENOENT;
+			}
+			mutex_exit(&ote->ote_lock);
+		} else {
+			ret = ENOENT;
+		}
+	}
+
+	mutex_exit(&ott->ott_lock);
+	overlay_hold_rele(odd);
+
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_cache_set(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_t *odd;
+	overlay_target_t *ott;
+	overlay_target_entry_t *ote;
+	overlay_targ_cache_t *otc = arg;
+	mblk_t *mp = NULL;
+
+	if (otc->otc_entry.otce_flags & ~OVERLAY_TARGET_CACHE_DROP)
+		return (EINVAL);
+
+	odd = overlay_hold_by_dlid(otc->otc_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	if (!(odd->odd_flags & OVERLAY_F_VARPD)) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENXIO);
+	}
+	ott = odd->odd_target;
+	if (ott->ott_mode != OVERLAY_TARGET_DYNAMIC) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENOTSUP);
+	}
+	mutex_enter(&ott->ott_lock);
+	mutex_exit(&odd->odd_lock);
+
+	ote = refhash_lookup(ott->ott_u.ott_dyn.ott_dhash,
+	    otc->otc_entry.otce_mac);
+	if (ote == NULL) {
+		ote = kmem_cache_alloc(overlay_entry_cache, KM_SLEEP);
+		bcopy(otc->otc_entry.otce_mac, ote->ote_addr, ETHERADDRL);
+		ote->ote_chead = ote->ote_ctail = NULL;
+		ote->ote_mbsize = 0;
+		ote->ote_ott = ott;
+		ote->ote_odd = odd;
+		mutex_enter(&ote->ote_lock);
+		refhash_insert(ott->ott_u.ott_dyn.ott_dhash, ote);
+		avl_add(&ott->ott_u.ott_dyn.ott_tree, ote);
+	} else {
+		mutex_enter(&ote->ote_lock);
+	}
+
+	if (otc->otc_entry.otce_flags & OVERLAY_TARGET_CACHE_DROP) {
+		ote->ote_flags |= OVERLAY_ENTRY_F_DROP;
+	} else {
+		ote->ote_flags |= OVERLAY_ENTRY_F_VALID;
+		bcopy(&otc->otc_entry.otce_dest, &ote->ote_dest,
+		    sizeof (overlay_target_point_t));
+		mp = ote->ote_chead;
+		ote->ote_chead = NULL;
+		ote->ote_ctail = NULL;
+		ote->ote_mbsize = 0;
+		ote->ote_vtime = gethrtime();
+	}
+
+	mutex_exit(&ote->ote_lock);
+	mutex_exit(&ott->ott_lock);
+
+	if (mp != NULL) {
+		mp = overlay_m_tx(ote->ote_odd, mp);
+		freemsgchain(mp);
+	}
+
+	overlay_hold_rele(odd);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_cache_remove(overlay_target_hdl_t *thdl, void *arg)
+{
+	int ret = 0;
+	overlay_dev_t *odd;
+	overlay_target_t *ott;
+	overlay_target_entry_t *ote;
+	overlay_targ_cache_t *otc = arg;
+
+	odd = overlay_hold_by_dlid(otc->otc_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	if (!(odd->odd_flags & OVERLAY_F_VARPD)) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENXIO);
+	}
+	ott = odd->odd_target;
+	if (ott->ott_mode != OVERLAY_TARGET_DYNAMIC) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENOTSUP);
+	}
+	mutex_enter(&ott->ott_lock);
+	mutex_exit(&odd->odd_lock);
+
+	ote = refhash_lookup(ott->ott_u.ott_dyn.ott_dhash,
+	    otc->otc_entry.otce_mac);
+	if (ote != NULL) {
+		mutex_enter(&ote->ote_lock);
+		ote->ote_flags &= ~OVERLAY_ENTRY_F_VALID_MASK;
+		mutex_exit(&ote->ote_lock);
+		ret = 0;
+	} else {
+		ret = ENOENT;
+	}
+
+	mutex_exit(&ott->ott_lock);
+	overlay_hold_rele(odd);
+
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_cache_flush(overlay_target_hdl_t *thdl, void *arg)
+{
+	avl_tree_t *avl;
+	overlay_dev_t *odd;
+	overlay_target_t *ott;
+	overlay_target_entry_t *ote;
+	overlay_targ_cache_t *otc = arg;
+
+	odd = overlay_hold_by_dlid(otc->otc_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	if (!(odd->odd_flags & OVERLAY_F_VARPD)) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENXIO);
+	}
+	ott = odd->odd_target;
+	if (ott->ott_mode != OVERLAY_TARGET_DYNAMIC) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENOTSUP);
+	}
+	mutex_enter(&ott->ott_lock);
+	mutex_exit(&odd->odd_lock);
+	avl = &ott->ott_u.ott_dyn.ott_tree;
+
+	for (ote = avl_first(avl); ote != NULL; ote = AVL_NEXT(avl, ote)) {
+		mutex_enter(&ote->ote_lock);
+		ote->ote_flags &= ~OVERLAY_ENTRY_F_VALID_MASK;
+		mutex_exit(&ote->ote_lock);
+	}
+	ote = refhash_lookup(ott->ott_u.ott_dyn.ott_dhash,
+	    otc->otc_entry.otce_mac);
+
+	mutex_exit(&ott->ott_lock);
+	overlay_hold_rele(odd);
+
+	return (0);
+}
+
+static int
+overlay_target_cache_iter_copyin(const void *ubuf, void **outp, size_t *bsize,
+    int flags)
+{
+	overlay_targ_cache_iter_t base, *iter;
+
+	if (ddi_copyin(ubuf, &base, sizeof (overlay_targ_cache_iter_t),
+	    flags & FKIOCTL) != 0)
+		return (EFAULT);
+
+	if (base.otci_count > OVERLAY_TARGET_ITER_MAX)
+		return (E2BIG);
+
+	if (base.otci_count == 0)
+		return (EINVAL);
+
+	*bsize = sizeof (overlay_targ_cache_iter_t) +
+	    base.otci_count * sizeof (overlay_targ_cache_entry_t);
+	iter = kmem_alloc(*bsize, KM_SLEEP);
+	bcopy(&base, iter, sizeof (overlay_targ_cache_iter_t));
+	*outp = iter;
+
+	return (0);
+}
+
+typedef struct overlay_targ_cache_marker {
+	uint8_t		otcm_mac[ETHERADDRL];
+	uint16_t	otcm_done;
+} overlay_targ_cache_marker_t;
+
+/* ARGSUSED */
+static int
+overlay_target_cache_iter(overlay_target_hdl_t *thdl, void *arg)
+{
+	overlay_dev_t *odd;
+	overlay_target_t *ott;
+	overlay_target_entry_t lookup, *ent;
+	overlay_targ_cache_marker_t *mark;
+	avl_index_t where;
+	avl_tree_t *avl;
+	uint16_t written = 0;
+
+	overlay_targ_cache_iter_t *iter = arg;
+	mark = (void *)&iter->otci_marker;
+
+	if (mark->otcm_done != 0) {
+		iter->otci_count = 0;
+		return (0);
+	}
+
+	odd = overlay_hold_by_dlid(iter->otci_linkid);
+	if (odd == NULL)
+		return (ENOENT);
+
+	mutex_enter(&odd->odd_lock);
+	if (!(odd->odd_flags & OVERLAY_F_VARPD)) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENXIO);
+	}
+	ott = odd->odd_target;
+	if (ott->ott_mode != OVERLAY_TARGET_DYNAMIC &&
+	    ott->ott_mode != OVERLAY_TARGET_POINT) {
+		mutex_exit(&odd->odd_lock);
+		overlay_hold_rele(odd);
+		return (ENOTSUP);
+	}
+
+	/*
+	 * Holding this lock across the entire iteration probably isn't very
+	 * good. We should perhaps add an r/w lock for the avl tree. But we'll
+	 * wait until we now it's necessary before we do more.
+	 */
+	mutex_enter(&ott->ott_lock);
+	mutex_exit(&odd->odd_lock);
+
+	if (ott->ott_mode == OVERLAY_TARGET_POINT) {
+		overlay_targ_cache_entry_t *out = &iter->otci_ents[0];
+		bzero(out->otce_mac, ETHERADDRL);
+		out->otce_flags = 0;
+		bcopy(&ott->ott_u.ott_point, &out->otce_dest,
+		    sizeof (overlay_target_point_t));
+		written++;
+		mark->otcm_done = 1;
+	}
+
+	avl = &ott->ott_u.ott_dyn.ott_tree;
+	bcopy(mark->otcm_mac, lookup.ote_addr, ETHERADDRL);
+	ent = avl_find(avl, &lookup, &where);
+
+	/*
+	 * NULL ent means that the entry does not exist, so we want to start
+	 * with the closest node in the tree. This means that we implicitly rely
+	 * on the tree's order and the first node will be the mac 00:00:00:00:00
+	 * and the last will be ff:ff:ff:ff:ff:ff.
+	 */
+	if (ent == NULL) {
+		ent = avl_nearest(avl, where, AVL_AFTER);
+		if (ent == NULL) {
+			mark->otcm_done = 1;
+			goto done;
+		}
+	}
+
+	for (; ent != NULL && written < iter->otci_count;
+	    ent = AVL_NEXT(avl, ent)) {
+		overlay_targ_cache_entry_t *out = &iter->otci_ents[written];
+		mutex_enter(&ent->ote_lock);
+		if ((ent->ote_flags & OVERLAY_ENTRY_F_VALID_MASK) == 0) {
+			mutex_exit(&ent->ote_lock);
+			continue;
+		}
+		bcopy(ent->ote_addr, out->otce_mac, ETHERADDRL);
+		out->otce_flags = 0;
+		if (ent->ote_flags & OVERLAY_ENTRY_F_DROP)
+			out->otce_flags |= OVERLAY_TARGET_CACHE_DROP;
+		if (ent->ote_flags & OVERLAY_ENTRY_F_VALID)
+			bcopy(&ent->ote_dest, &out->otce_dest,
+			    sizeof (overlay_target_point_t));
+		written++;
+		mutex_exit(&ent->ote_lock);
+	}
+
+	if (ent != NULL) {
+		bcopy(ent->ote_addr, mark->otcm_mac, ETHERADDRL);
+	} else {
+		mark->otcm_done = 1;
+	}
+
+done:
+	iter->otci_count = written;
+	mutex_exit(&ott->ott_lock);
+	overlay_hold_rele(odd);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+overlay_target_cache_iter_copyout(void *ubuf, void *buf, size_t bufsize,
+    int flags)
+{
+	size_t outsize;
+	const overlay_targ_cache_iter_t *iter = buf;
+
+	outsize = sizeof (overlay_targ_cache_iter_t) +
+	    iter->otci_count * sizeof (overlay_targ_cache_entry_t);
+
+	if (ddi_copyout(buf, ubuf, outsize, flags & FKIOCTL) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static overlay_target_ioctl_t overlay_target_ioctab[] = {
+	{ OVERLAY_TARG_INFO, B_TRUE, B_TRUE,
+		NULL, overlay_target_info,
+		NULL, sizeof (overlay_targ_info_t)	},
+	{ OVERLAY_TARG_ASSOCIATE, B_TRUE, B_FALSE,
+		NULL, overlay_target_associate,
+		NULL, sizeof (overlay_targ_associate_t)	},
+	{ OVERLAY_TARG_DISASSOCIATE, B_TRUE, B_FALSE,
+		NULL, overlay_target_disassociate,
+		NULL, sizeof (overlay_targ_id_t)	},
+	{ OVERLAY_TARG_DEGRADE, B_TRUE, B_FALSE,
+		NULL, overlay_target_degrade,
+		NULL, sizeof (overlay_targ_degrade_t)	},
+	{ OVERLAY_TARG_RESTORE, B_TRUE, B_FALSE,
+		NULL, overlay_target_restore,
+		NULL, sizeof (overlay_targ_id_t)	},
+	{ OVERLAY_TARG_LOOKUP, B_FALSE, B_TRUE,
+		NULL, overlay_target_lookup_request,
+		NULL, sizeof (overlay_targ_lookup_t)	},
+	{ OVERLAY_TARG_RESPOND, B_TRUE, B_FALSE,
+		NULL, overlay_target_lookup_respond,
+		NULL, sizeof (overlay_targ_resp_t)	},
+	{ OVERLAY_TARG_DROP, B_TRUE, B_FALSE,
+		NULL, overlay_target_lookup_drop,
+		NULL, sizeof (overlay_targ_resp_t)	},
+	{ OVERLAY_TARG_PKT, B_TRUE, B_TRUE,
+		overlay_target_pkt_copyin,
+		overlay_target_packet,
+		overlay_target_pkt_copyout,
+		sizeof (overlay_targ_pkt_t)		},
+	{ OVERLAY_TARG_INJECT, B_TRUE, B_FALSE,
+		overlay_target_pkt_copyin,
+		overlay_target_inject,
+		NULL, sizeof (overlay_targ_pkt_t)	},
+	{ OVERLAY_TARG_RESEND, B_TRUE, B_FALSE,
+		overlay_target_pkt_copyin,
+		overlay_target_resend,
+		NULL, sizeof (overlay_targ_pkt_t)	},
+	{ OVERLAY_TARG_LIST, B_FALSE, B_TRUE,
+		overlay_target_list_copyin,
+		overlay_target_ioctl_list,
+		overlay_target_list_copyout,
+		sizeof (overlay_targ_list_t)		},
+	{ OVERLAY_TARG_CACHE_GET, B_FALSE, B_TRUE,
+		NULL, overlay_target_cache_get,
+		NULL, sizeof (overlay_targ_cache_t)	},
+	{ OVERLAY_TARG_CACHE_SET, B_TRUE, B_TRUE,
+		NULL, overlay_target_cache_set,
+		NULL, sizeof (overlay_targ_cache_t)	},
+	{ OVERLAY_TARG_CACHE_REMOVE, B_TRUE, B_TRUE,
+		NULL, overlay_target_cache_remove,
+		NULL, sizeof (overlay_targ_cache_t)	},
+	{ OVERLAY_TARG_CACHE_FLUSH, B_TRUE, B_TRUE,
+		NULL, overlay_target_cache_flush,
+		NULL, sizeof (overlay_targ_cache_t)	},
+	{ OVERLAY_TARG_CACHE_ITER, B_FALSE, B_TRUE,
+		overlay_target_cache_iter_copyin,
+		overlay_target_cache_iter,
+		overlay_target_cache_iter_copyout,
+		sizeof (overlay_targ_cache_iter_t)		},
+	{ 0 }
+};
+
+int
+overlay_target_open(dev_t *devp, int flags, int otype, cred_t *credp)
+{
+	minor_t mid;
+	overlay_target_hdl_t *thdl;
+
+	if (secpolicy_dl_config(credp) != 0)
+		return (EPERM);
+
+	if (getminor(*devp) != 0)
+		return (ENXIO);
+
+	if (otype & OTYP_BLK)
+		return (EINVAL);
+
+	if (flags & ~(FREAD | FWRITE | FEXCL))
+		return (EINVAL);
+
+	if ((flags & FWRITE) &&
+	    !(flags & FEXCL))
+		return (EINVAL);
+
+	if (!(flags & FREAD) && !(flags & FWRITE))
+		return (EINVAL);
+
+	if (crgetzoneid(credp) != GLOBAL_ZONEID)
+		return (EPERM);
+
+	mid = id_alloc(overlay_thdl_idspace);
+	if (ddi_soft_state_zalloc(overlay_thdl_state, mid) != 0) {
+		id_free(overlay_thdl_idspace, mid);
+		return (ENXIO);
+	}
+
+	thdl = ddi_get_soft_state(overlay_thdl_state, mid);
+	VERIFY(thdl != NULL);
+	thdl->oth_minor = mid;
+	thdl->oth_zoneid = crgetzoneid(credp);
+	thdl->oth_oflags = flags;
+	mutex_init(&thdl->oth_lock, NULL, MUTEX_DRIVER, NULL);
+	list_create(&thdl->oth_outstanding, sizeof (overlay_target_entry_t),
+	    offsetof(overlay_target_entry_t, ote_qlink));
+	*devp = makedevice(getmajor(*devp), mid);
+
+	mutex_enter(&overlay_target_lock);
+	if ((flags & FEXCL) && overlay_target_excl == B_TRUE) {
+		mutex_exit(&overlay_target_lock);
+		list_destroy(&thdl->oth_outstanding);
+		mutex_destroy(&thdl->oth_lock);
+		ddi_soft_state_free(overlay_thdl_state, mid);
+		id_free(overlay_thdl_idspace, mid);
+		return (EEXIST);
+	} else if ((flags & FEXCL) != 0) {
+		VERIFY(overlay_target_excl == B_FALSE);
+		overlay_target_excl = B_TRUE;
+	}
+	list_insert_tail(&overlay_thdl_list, thdl);
+	mutex_exit(&overlay_target_lock);
+
+	return (0);
+}
+
+/* ARGSUSED */
+int
+overlay_target_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rvalp)
+{
+	overlay_target_ioctl_t *ioc;
+	overlay_target_hdl_t *thdl;
+
+	if (secpolicy_dl_config(credp) != 0)
+		return (EPERM);
+
+	if ((thdl = ddi_get_soft_state(overlay_thdl_state,
+	    getminor(dev))) == NULL)
+		return (ENXIO);
+
+	for (ioc = &overlay_target_ioctab[0]; ioc->oti_cmd != 0; ioc++) {
+		int ret;
+		caddr_t buf;
+		size_t bufsize;
+
+		if (ioc->oti_cmd != cmd)
+			continue;
+
+		if (ioc->oti_write == B_TRUE && !(mode & FWRITE))
+			return (EBADF);
+
+		if (ioc->oti_copyin == NULL) {
+			bufsize = ioc->oti_size;
+			buf = kmem_alloc(bufsize, KM_SLEEP);
+			if (ddi_copyin((void *)(uintptr_t)arg, buf, bufsize,
+			    mode & FKIOCTL) != 0) {
+				kmem_free(buf, bufsize);
+				return (EFAULT);
+			}
+		} else {
+			if ((ret = ioc->oti_copyin((void *)(uintptr_t)arg,
+			    (void **)&buf, &bufsize, mode)) != 0)
+				return (ret);
+		}
+
+		ret = ioc->oti_func(thdl, buf);
+		if (ret == 0 && ioc->oti_size != 0 &&
+		    ioc->oti_ncopyout == B_TRUE) {
+			if (ioc->oti_copyout == NULL) {
+				if (ddi_copyout(buf, (void *)(uintptr_t)arg,
+				    bufsize, mode & FKIOCTL) != 0)
+					ret = EFAULT;
+			} else {
+				ret = ioc->oti_copyout((void *)(uintptr_t)arg,
+				    buf, bufsize, mode);
+			}
+		}
+
+		kmem_free(buf, bufsize);
+		return (ret);
+	}
+
+	return (ENOTTY);
+}
+
+/* ARGSUSED */
+int
+overlay_target_close(dev_t dev, int flags, int otype, cred_t *credp)
+{
+	overlay_target_hdl_t *thdl;
+	overlay_target_entry_t *entry;
+	minor_t mid = getminor(dev);
+
+	if ((thdl = ddi_get_soft_state(overlay_thdl_state, mid)) == NULL)
+		return (ENXIO);
+
+	mutex_enter(&overlay_target_lock);
+	list_remove(&overlay_thdl_list, thdl);
+	mutex_enter(&thdl->oth_lock);
+	while ((entry = list_remove_head(&thdl->oth_outstanding)) != NULL)
+		list_insert_tail(&overlay_target_list, entry);
+	cv_signal(&overlay_target_condvar);
+	mutex_exit(&thdl->oth_lock);
+	if ((thdl->oth_oflags & FEXCL) != 0) {
+		VERIFY(overlay_target_excl == B_TRUE);
+		overlay_target_excl = B_FALSE;
+	}
+	mutex_exit(&overlay_target_lock);
+
+	list_destroy(&thdl->oth_outstanding);
+	mutex_destroy(&thdl->oth_lock);
+	mid = thdl->oth_minor;
+	ddi_soft_state_free(overlay_thdl_state, mid);
+	id_free(overlay_thdl_idspace, mid);
+
+	return (0);
+}
diff --git a/usr/src/uts/common/io/overlay/plugins/overlay_vxlan.c b/usr/src/uts/common/io/overlay/plugins/overlay_vxlan.c
new file mode 100644
index 0000000000..8b4e4ecb42
--- /dev/null
+++ b/usr/src/uts/common/io/overlay/plugins/overlay_vxlan.c
@@ -0,0 +1,372 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+/*
+ * VXLAN encapsulation module
+ *
+ *
+ * The VXLAN header looks as follows in network byte order:
+ *
+ * |0        3| 4 |5                     31|
+ * +----------+---+------------------------+
+ * | Reserved | I | Reserved               |
+ * +---------------------------------------+
+ * | Virtual Network ID         | Reserved |
+ * +----------------------------+----------+
+ * |0                         23|24      31|
+ *
+ * All reserved values must be 0. The I bit must be 1. We call the top
+ * word the VXLAN magic field for the time being. The second word is
+ * definitely not the most friendly way to operate. Specifically, the ID
+ * is a 24-bit big endian value, but we have to make sure not to use the
+ * reserved byte.
+ *
+ * For us, VXLAN encapsulation is a fairly straightforward implementation. It
+ * only has two properties, a listen_ip and a listen_port. These determine on
+ * what address we should be listening on. While we do not have a default
+ * address to listen upon, we do have a default port, which is the IANA assigned
+ * port for VXLAN -- 4789.
+ */
+
+#include <sys/overlay_plugin.h>
+#include <sys/modctl.h>
+#include <sys/errno.h>
+#include <sys/byteorder.h>
+#include <sys/vxlan.h>
+#include <inet/ip.h>
+#include <netinet/in.h>
+#include <sys/strsun.h>
+#include <netinet/udp.h>
+
+static const char *vxlan_ident = "vxlan";
+static uint16_t vxlan_defport = IPPORT_VXLAN;
+
+/*
+ * Should we enable UDP source port hashing for fanout.
+ */
+boolean_t vxlan_fanout = B_TRUE;
+
+static const char *vxlan_props[] = {
+	"vxlan/listen_ip",
+	"vxlan/listen_port",
+	NULL
+};
+
+typedef struct vxlan {
+	kmutex_t vxl_lock;
+	overlay_handle_t vxl_oh;
+	uint16_t vxl_lport;
+	boolean_t vxl_hladdr;
+	struct in6_addr vxl_laddr;
+} vxlan_t;
+
+static int
+vxlan_o_init(overlay_handle_t oh, void **outp)
+{
+	vxlan_t *vxl;
+
+	vxl = kmem_alloc(sizeof (vxlan_t), KM_SLEEP);
+	*outp = vxl;
+	mutex_init(&vxl->vxl_lock, NULL, MUTEX_DRIVER, NULL);
+	vxl->vxl_oh = oh;
+	vxl->vxl_lport = vxlan_defport;
+	vxl->vxl_hladdr = B_FALSE;
+
+	return (0);
+}
+
+static void
+vxlan_o_fini(void *arg)
+{
+	vxlan_t *vxl = arg;
+
+	mutex_destroy(&vxl->vxl_lock);
+	kmem_free(arg, sizeof (vxlan_t));
+}
+
+static int
+vxlan_o_socket(void *arg, int *dp, int *fp, int *pp, struct sockaddr *addr,
+    socklen_t *slenp)
+{
+	vxlan_t *vxl = arg;
+	struct sockaddr_in6 *in;
+
+	in = (struct sockaddr_in6 *)addr;
+	*dp = AF_INET6;
+	*fp = SOCK_DGRAM;
+	*pp = 0;
+	bzero(in, sizeof (struct sockaddr_in6));
+	in->sin6_family = AF_INET6;
+
+	/*
+	 * We should consider a more expressive private errno set that
+	 * provider's can use.
+	 */
+	mutex_enter(&vxl->vxl_lock);
+	if (vxl->vxl_hladdr == B_FALSE) {
+		mutex_exit(&vxl->vxl_lock);
+		return (EINVAL);
+	}
+	in->sin6_port = htons(vxl->vxl_lport);
+	in->sin6_addr = vxl->vxl_laddr;
+	mutex_exit(&vxl->vxl_lock);
+	*slenp = sizeof (struct sockaddr_in6);
+
+	return (0);
+}
+
+static int
+vxlan_o_sockopt(ksocket_t ksock)
+{
+	int val, err;
+	if (vxlan_fanout == B_FALSE)
+		return (0);
+
+	val = UDP_HASH_VXLAN;
+	err = ksocket_setsockopt(ksock, IPPROTO_UDP, UDP_SRCPORT_HASH, &val,
+	    sizeof (val), kcred);
+	return (err);
+}
+
+/* ARGSUSED */
+static int
+vxlan_o_encap(void *arg, mblk_t *mp, ovep_encap_info_t *einfop,
+    mblk_t **outp)
+{
+	mblk_t *ob;
+	vxlan_hdr_t *vxh;
+
+	ASSERT(einfop->ovdi_id < (1 << 24));
+
+	/*
+	 * This allocation could get hot. We may want to have a good way to
+	 * cache and handle this allocation the same way that IP does with
+	 * keeping around a message block per entry, or basically treating this
+	 * as an immutable message block in the system. Basically freemsg() will
+	 * be a nop, but we'll do the right thing with respect to the rest of
+	 * the chain.
+	 */
+	ob = allocb(VXLAN_HDR_LEN, 0);
+	if (ob == NULL)
+		return (ENOMEM);
+
+	vxh = (vxlan_hdr_t *)ob->b_rptr;
+	vxh->vxlan_flags = ntohl(VXLAN_F_VDI);
+	vxh->vxlan_id = htonl((uint32_t)einfop->ovdi_id << VXLAN_ID_SHIFT);
+	ob->b_wptr += VXLAN_HDR_LEN;
+	*outp = ob;
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+vxlan_o_decap(void *arg, mblk_t *mp, ovep_encap_info_t *dinfop)
+{
+	vxlan_hdr_t *vxh;
+
+	if (MBLKL(mp) < sizeof (vxlan_hdr_t))
+		return (EINVAL);
+	vxh = (vxlan_hdr_t *)mp->b_rptr;
+	if ((ntohl(vxh->vxlan_flags) & VXLAN_F_VDI) == 0)
+		return (EINVAL);
+
+	dinfop->ovdi_id = ntohl(vxh->vxlan_id) >> VXLAN_ID_SHIFT;
+	dinfop->ovdi_hdr_size = VXLAN_HDR_LEN;
+
+	return (0);
+}
+
+static int
+vxlan_o_getprop(void *arg, const char *pr_name, void *buf, uint32_t *bufsize)
+{
+	vxlan_t *vxl = arg;
+
+	/* vxlan/listen_ip */
+	if (strcmp(pr_name, vxlan_props[0]) == 0) {
+		if (*bufsize < sizeof (struct in6_addr))
+			return (EOVERFLOW);
+
+		mutex_enter(&vxl->vxl_lock);
+		if (vxl->vxl_hladdr == B_FALSE) {
+			*bufsize = 0;
+		} else {
+			bcopy(&vxl->vxl_laddr, buf, sizeof (struct in6_addr));
+			*bufsize = sizeof (struct in6_addr);
+		}
+		mutex_exit(&vxl->vxl_lock);
+		return (0);
+	}
+
+	/* vxlan/listen_port */
+	if (strcmp(pr_name, vxlan_props[1]) == 0) {
+		uint64_t val;
+		if (*bufsize < sizeof (uint64_t))
+			return (EOVERFLOW);
+
+		mutex_enter(&vxl->vxl_lock);
+		val = vxl->vxl_lport;
+		bcopy(&val, buf, sizeof (uint64_t));
+		*bufsize = sizeof (uint64_t);
+		mutex_exit(&vxl->vxl_lock);
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+static int
+vxlan_o_setprop(void *arg, const char *pr_name, const void *buf,
+    uint32_t bufsize)
+{
+	vxlan_t *vxl = arg;
+
+	/* vxlan/listen_ip */
+	if (strcmp(pr_name, vxlan_props[0]) == 0) {
+		const struct in6_addr *ipv6 = buf;
+		if (bufsize != sizeof (struct in6_addr))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_V4COMPAT(ipv6))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_MULTICAST(ipv6))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_6TO4(ipv6))
+			return (EINVAL);
+
+		if (IN6_IS_ADDR_V4MAPPED(ipv6)) {
+			ipaddr_t v4;
+			IN6_V4MAPPED_TO_IPADDR(ipv6, v4);
+			if (IN_MULTICAST(v4))
+				return (EINVAL);
+		}
+
+		mutex_enter(&vxl->vxl_lock);
+		vxl->vxl_hladdr = B_TRUE;
+		bcopy(ipv6, &vxl->vxl_laddr, sizeof (struct in6_addr));
+		mutex_exit(&vxl->vxl_lock);
+
+		return (0);
+	}
+
+	/* vxlan/listen_port */
+	if (strcmp(pr_name, vxlan_props[1]) == 0) {
+		const uint64_t *valp = buf;
+		if (bufsize != 8)
+			return (EINVAL);
+
+		if (*valp == 0 || *valp > UINT16_MAX)
+			return (EINVAL);
+
+		mutex_enter(&vxl->vxl_lock);
+		vxl->vxl_lport = *valp;
+		mutex_exit(&vxl->vxl_lock);
+		return (0);
+	}
+	return (EINVAL);
+}
+
+static int
+vxlan_o_propinfo(const char *pr_name, overlay_prop_handle_t phdl)
+{
+	/* vxlan/listen_ip */
+	if (strcmp(pr_name, vxlan_props[0]) == 0) {
+		overlay_prop_set_name(phdl, vxlan_props[0]);
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_RRW);
+		overlay_prop_set_type(phdl, OVERLAY_PROP_T_IP);
+		overlay_prop_set_nodefault(phdl);
+		return (0);
+	}
+
+	if (strcmp(pr_name, vxlan_props[1]) == 0) {
+		overlay_prop_set_name(phdl, vxlan_props[1]);
+		overlay_prop_set_prot(phdl, OVERLAY_PROP_PERM_RRW);
+		overlay_prop_set_type(phdl, OVERLAY_PROP_T_UINT);
+		(void) overlay_prop_set_default(phdl, &vxlan_defport,
+		    sizeof (vxlan_defport));
+		overlay_prop_set_range_uint32(phdl, 1, UINT16_MAX);
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+static struct overlay_plugin_ops vxlan_o_ops = {
+	0,
+	vxlan_o_init,
+	vxlan_o_fini,
+	vxlan_o_encap,
+	vxlan_o_decap,
+	vxlan_o_socket,
+	vxlan_o_sockopt,
+	vxlan_o_getprop,
+	vxlan_o_setprop,
+	vxlan_o_propinfo
+};
+
+static struct modlmisc vxlan_modlmisc = {
+	&mod_miscops,
+	"VXLAN encap plugin"
+};
+
+static struct modlinkage vxlan_modlinkage = {
+	MODREV_1,
+	&vxlan_modlmisc
+};
+
+int
+_init(void)
+{
+	int err;
+	overlay_plugin_register_t *ovrp;
+
+	ovrp = overlay_plugin_alloc(OVEP_VERSION);
+	if (ovrp == NULL)
+		return (ENOTSUP);
+	ovrp->ovep_name = vxlan_ident;
+	ovrp->ovep_ops = &vxlan_o_ops;
+	ovrp->ovep_id_size = VXLAN_ID_LEN;
+	ovrp->ovep_flags = OVEP_F_VLAN_TAG;
+	ovrp->ovep_dest = OVERLAY_PLUGIN_D_IP | OVERLAY_PLUGIN_D_PORT;
+	ovrp->ovep_props = vxlan_props;
+
+	if ((err = overlay_plugin_register(ovrp)) == 0) {
+		if ((err = mod_install(&vxlan_modlinkage)) != 0) {
+			(void) overlay_plugin_unregister(vxlan_ident);
+		}
+	}
+
+	overlay_plugin_free(ovrp);
+	return (err);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&vxlan_modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int err;
+
+	if ((err = overlay_plugin_unregister(vxlan_ident)) != 0)
+		return (err);
+
+	return (mod_remove(&vxlan_modlinkage));
+}
diff --git a/usr/src/uts/common/io/pciex/pcie.c b/usr/src/uts/common/io/pciex/pcie.c
index 95eaa5837f..2f424321f1 100644
--- a/usr/src/uts/common/io/pciex/pcie.c
+++ b/usr/src/uts/common/io/pciex/pcie.c
@@ -684,6 +684,7 @@ pcie_init_pfd(dev_info_t *dip)
 
 	pfd_p->pe_bus_p = bus_p;
 	pfd_p->pe_severity_flags = 0;
+	pfd_p->pe_severity_mask = 0;
 	pfd_p->pe_orig_severity_flags = 0;
 	pfd_p->pe_lock = B_FALSE;
 	pfd_p->pe_valid = B_FALSE;
@@ -840,6 +841,7 @@ pcie_rc_init_pfd(dev_info_t *dip, pf_data_t *pfd_p)
 {
 	pfd_p->pe_bus_p = PCIE_DIP2DOWNBUS(dip);
 	pfd_p->pe_severity_flags = 0;
+	pfd_p->pe_severity_mask = 0;
 	pfd_p->pe_orig_severity_flags = 0;
 	pfd_p->pe_lock = B_FALSE;
 	pfd_p->pe_valid = B_FALSE;
@@ -921,7 +923,7 @@ pcie_rc_init_bus(dev_info_t *dip)
 	bus_p->bus_aer_off = (uint16_t)-1;
 
 	/* Needed only for handle lookup */
-	bus_p->bus_fm_flags |= PF_FM_READY;
+	atomic_or_uint(&bus_p->bus_fm_flags, PF_FM_READY);
 
 	ndi_set_bus_private(dip, B_FALSE, DEVI_PORT_TYPE_PCI, bus_p);
 
@@ -938,6 +940,172 @@ pcie_rc_fini_bus(dev_info_t *dip)
 }
 
 /*
+ * We need to capture the supported, maximum, and current device speed and
+ * width. The way that this has been done has changed over time.
+ *
+ * Prior to PCIe Gen 3, there were only current and supported speed fields.
+ * These were found in the link status and link capabilities registers of the
+ * PCI express capability. With the change to PCIe Gen 3, the information in the
+ * link capabilities changed to the maximum value. The supported speeds vector
+ * was moved to the link capabilities 2 register.
+ *
+ * Now, a device may not implement some of these registers. To determine whether
+ * or not it's here, we have to do the following. First, we need to check the
+ * revision of the PCI express capability. The link capabilities 2 register did
+ * not exist prior to version 2 of this register.
+ */
+static void
+pcie_capture_speeds(pcie_bus_t *bus_p, pcie_req_id_t bdf, dev_info_t *rcdip)
+{
+	uint16_t	vers, status;
+	uint32_t	val, cap, cap2;
+
+	if (!PCIE_IS_PCIE(bus_p))
+		return;
+
+	vers = pci_cfgacc_get16(rcdip, bdf, bus_p->bus_pcie_off + PCIE_PCIECAP);
+	if (vers == PCI_EINVAL16)
+		return;
+	vers &= PCIE_PCIECAP_VER_MASK;
+
+	/*
+	 * Verify the capability's version.
+	 */
+	switch (vers) {
+	case PCIE_PCIECAP_VER_1_0:
+		cap2 = 0;
+		break;
+	case PCIE_PCIECAP_VER_2_0:
+		cap2 = pci_cfgacc_get32(rcdip, bdf, bus_p->bus_pcie_off +
+		    PCIE_LINKCAP2);
+		if (cap2 == PCI_EINVAL32)
+			cap2 = 0;
+		break;
+	default:
+		/* Don't try and handle an unknown version */
+		return;
+	}
+
+	status = pci_cfgacc_get16(rcdip, bdf, bus_p->bus_pcie_off +
+	    PCIE_LINKSTS);
+	cap = pci_cfgacc_get32(rcdip, bdf, bus_p->bus_pcie_off + PCIE_LINKCAP);
+	if (status == PCI_EINVAL16 || cap == PCI_EINVAL32)
+		return;
+
+	switch (status & PCIE_LINKSTS_SPEED_MASK) {
+	case PCIE_LINKSTS_SPEED_2_5:
+		bus_p->bus_cur_speed = PCIE_LINK_SPEED_2_5;
+		break;
+	case PCIE_LINKSTS_SPEED_5:
+		bus_p->bus_cur_speed = PCIE_LINK_SPEED_5;
+		break;
+	case PCIE_LINKSTS_SPEED_8:
+		bus_p->bus_cur_speed = PCIE_LINK_SPEED_8;
+		break;
+	default:
+		bus_p->bus_cur_speed = PCIE_LINK_SPEED_UNKNOWN;
+		break;
+	}
+
+	switch (status & PCIE_LINKSTS_NEG_WIDTH_MASK) {
+	case PCIE_LINKSTS_NEG_WIDTH_X1:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_X1;
+		break;
+	case PCIE_LINKSTS_NEG_WIDTH_X2:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_X2;
+		break;
+	case PCIE_LINKSTS_NEG_WIDTH_X4:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_X4;
+		break;
+	case PCIE_LINKSTS_NEG_WIDTH_X8:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_X8;
+		break;
+	case PCIE_LINKSTS_NEG_WIDTH_X12:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_X12;
+		break;
+	case PCIE_LINKSTS_NEG_WIDTH_X16:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_X16;
+		break;
+	case PCIE_LINKSTS_NEG_WIDTH_X32:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_X32;
+		break;
+	default:
+		bus_p->bus_cur_width = PCIE_LINK_WIDTH_UNKNOWN;
+		break;
+	}
+
+	switch (cap & PCIE_LINKCAP_MAX_WIDTH_MASK) {
+	case PCIE_LINKCAP_MAX_WIDTH_X1:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_X1;
+		break;
+	case PCIE_LINKCAP_MAX_WIDTH_X2:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_X2;
+		break;
+	case PCIE_LINKCAP_MAX_WIDTH_X4:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_X4;
+		break;
+	case PCIE_LINKCAP_MAX_WIDTH_X8:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_X8;
+		break;
+	case PCIE_LINKCAP_MAX_WIDTH_X12:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_X12;
+		break;
+	case PCIE_LINKCAP_MAX_WIDTH_X16:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_X16;
+		break;
+	case PCIE_LINKCAP_MAX_WIDTH_X32:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_X32;
+		break;
+	default:
+		bus_p->bus_max_width = PCIE_LINK_WIDTH_UNKNOWN;
+		break;
+	}
+
+	/*
+	 * If we have the Link Capabilities 2, then we can get the supported
+	 * speeds from it and treat the bits in Link Capabilities 1 as the
+	 * maximum. If we don't, then we need to follow the Implementation Note
+	 * in the standard under Link Capabilities 2. Effectively, this means
+	 * that if the value of 10b is set in Link Capabilities register, that
+	 * it supports both 2.5 and 5 GT/s speeds.
+	 */
+	if (cap2 != 0) {
+		if (cap2 & PCIE_LINKCAP2_SPEED_2_5)
+			bus_p->bus_sup_speed |= PCIE_LINK_SPEED_2_5;
+		if (cap2 & PCIE_LINKCAP2_SPEED_5)
+			bus_p->bus_sup_speed |= PCIE_LINK_SPEED_5;
+		if (cap2 & PCIE_LINKCAP2_SPEED_8)
+			bus_p->bus_sup_speed |= PCIE_LINK_SPEED_8;
+
+		switch (cap & PCIE_LINKCAP_MAX_SPEED_MASK) {
+		case PCIE_LINKCAP_MAX_SPEED_2_5:
+			bus_p->bus_max_speed = PCIE_LINK_SPEED_2_5;
+			break;
+		case PCIE_LINKCAP_MAX_SPEED_5:
+			bus_p->bus_max_speed = PCIE_LINK_SPEED_5;
+			break;
+		case PCIE_LINKCAP_MAX_SPEED_8:
+			bus_p->bus_max_speed = PCIE_LINK_SPEED_8;
+			break;
+		default:
+			bus_p->bus_max_speed = PCIE_LINK_SPEED_UNKNOWN;
+			break;
+		}
+	} else {
+		if (cap & PCIE_LINKCAP_MAX_SPEED_5) {
+			bus_p->bus_max_speed = PCIE_LINK_SPEED_5;
+			bus_p->bus_sup_speed = PCIE_LINK_SPEED_2_5 |
+			    PCIE_LINK_SPEED_5;
+		}
+
+		if (cap & PCIE_LINKCAP_MAX_SPEED_2_5) {
+			bus_p->bus_max_speed = PCIE_LINK_SPEED_2_5;
+			bus_p->bus_sup_speed = PCIE_LINK_SPEED_2_5;
+		}
+	}
+}
+
+/*
  * partially init pcie_bus_t for device (dip,bdf) for accessing pci
  * config space
  *
@@ -1134,6 +1302,10 @@ pcie_init_bus(dev_info_t *dip, pcie_req_id_t bdf, uint8_t flags)
 		}
 	}
 
+	/*
+	 * Save and record speed information about the device.
+	 */
+
 caps_done:
 	/* save RP dip and RP bdf */
 	if (PCIE_IS_RP(bus_p)) {
@@ -1170,7 +1342,7 @@ caps_done:
 	}
 
 	bus_p->bus_soft_state = PCI_SOFT_STATE_CLOSED;
-	bus_p->bus_fm_flags = 0;
+	(void) atomic_swap_uint(&bus_p->bus_fm_flags, 0);
 	bus_p->bus_mps = 0;
 
 	ndi_set_bus_private(dip, B_TRUE, DEVI_PORT_TYPE_PCI, (void *)bus_p);
@@ -1226,6 +1398,8 @@ initial_done:
 
 	pcie_init_plat(dip);
 
+	pcie_capture_speeds(bus_p, bdf, rcdip);
+
 final_done:
 
 	PCIE_DBG("Add %s(dip 0x%p, bdf 0x%x, secbus 0x%x)\n",
@@ -1318,14 +1492,15 @@ pcie_get_rc_dip(dev_info_t *dip)
 	return (rcdip);
 }
 
-static boolean_t
+boolean_t
 pcie_is_pci_device(dev_info_t *dip)
 {
 	dev_info_t	*pdip;
 	char		*device_type;
 
 	pdip = ddi_get_parent(dip);
-	ASSERT(pdip);
+	if (pdip == NULL)
+		return (B_FALSE);
 
 	if (ddi_prop_lookup_string(DDI_DEV_T_ANY, pdip, DDI_PROP_DONTPASS,
 	    "device_type", &device_type) != DDI_PROP_SUCCESS)
diff --git a/usr/src/uts/common/io/pciex/pcie_fault.c b/usr/src/uts/common/io/pciex/pcie_fault.c
index f4a2e9190e..61271d674b 100644
--- a/usr/src/uts/common/io/pciex/pcie_fault.c
+++ b/usr/src/uts/common/io/pciex/pcie_fault.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 #include <sys/sysmacros.h>
@@ -164,8 +165,8 @@ int pcie_disable_scan = 0;		/* Disable fabric scan */
 /* Inform interested parties that error handling is about to begin. */
 /* ARGSUSED */
 void
-pf_eh_enter(pcie_bus_t *bus_p) {
-}
+pf_eh_enter(pcie_bus_t *bus_p)
+{}
 
 /* Inform interested parties that error handling has ended. */
 void
@@ -304,7 +305,8 @@ done:
 }
 
 void
-pcie_force_fullscan() {
+pcie_force_fullscan()
+{
 	pcie_full_scan = B_TRUE;
 }
 
@@ -917,10 +919,18 @@ pf_default_hdl(dev_info_t *dip, pf_impl_t *impl)
 	}
 
 	/*
-	 * Read vendor/device ID and check with cached data, if it doesn't match
-	 * could very well be a device that isn't responding anymore.  Just
-	 * stop.  Save the basic info in the error q for post mortem debugging
-	 * purposes.
+	 * If this is a device used for PCI passthrough into a virtual machine,
+	 * don't let any error it caused panic the system.
+	 */
+	if (bus_p->bus_fm_flags & PF_FM_IS_PASSTHRU)
+		pfd_p->pe_severity_mask |= PF_ERR_PANIC;
+
+	/*
+	 * Read vendor/device ID and check with cached data; if it doesn't
+	 * match, it could very well mean that the device is no longer
+	 * responding.  In this case, we return PF_SCAN_BAD_RESPONSE; should
+	 * the caller choose to panic in this case, we will have the basic
+	 * info in the error queue for the purposes of postmortem debugging.
 	 */
 	if (PCIE_GET(32, bus_p, PCI_CONF_VENID) != bus_p->bus_dev_ven_id) {
 		char buf[FM_MAX_CLASS];
@@ -931,12 +941,12 @@ pf_default_hdl(dev_info_t *dip, pf_impl_t *impl)
 		    DDI_NOSLEEP, FM_VERSION, DATA_TYPE_UINT8, 0, NULL);
 
 		/*
-		 * For IOV/Hotplug purposes skip gathering info fo this device,
+		 * For IOV/Hotplug purposes skip gathering info for this device,
 		 * but populate affected info and severity.  Clear out any data
 		 * that maybe been saved in the last fabric scan.
 		 */
 		pf_reset_pfd(pfd_p);
-		pfd_p->pe_severity_flags = PF_ERR_PANIC_BAD_RESPONSE;
+		pfd_p->pe_severity_flags = PF_ERR_BAD_RESPONSE;
 		PFD_AFFECTED_DEV(pfd_p)->pe_affected_flags = PF_AFFECTED_SELF;
 
 		/* Add the snapshot to the error q */
@@ -948,6 +958,7 @@ pf_default_hdl(dev_info_t *dip, pf_impl_t *impl)
 
 	pf_pci_regs_gather(pfd_p, bus_p);
 	pf_pci_regs_clear(pfd_p, bus_p);
+
 	if (PCIE_IS_RP(bus_p))
 		pf_pci_find_rp_fault(pfd_p, bus_p);
 
@@ -982,6 +993,22 @@ done:
 }
 
 /*
+ * Set the passthru flag on a device bus_p. Called by passthru drivers to
+ * indicate when a device is or is no longer under passthru control.
+ */
+void
+pf_set_passthru(dev_info_t *dip, boolean_t is_passthru)
+{
+	pcie_bus_t *bus_p = PCIE_DIP2BUS(dip);
+
+	if (is_passthru) {
+		atomic_or_uint(&bus_p->bus_fm_flags, PF_FM_IS_PASSTHRU);
+	} else {
+		atomic_and_uint(&bus_p->bus_fm_flags, ~PF_FM_IS_PASSTHRU);
+	}
+}
+
+/*
  * Called during postattach to initialize a device's error handling
  * capabilities.  If the devices has already been hardened, then there isn't
  * much needed.  Otherwise initialize the device's default FMA capabilities.
@@ -1024,7 +1051,7 @@ pf_init(dev_info_t *dip, ddi_iblock_cookie_t ibc, ddi_attach_cmd_t cmd)
 		    DDI_FM_EREPORT_CAPABLE | DDI_FM_ERRCB_CAPABLE);
 		cap &= (DDI_FM_EREPORT_CAPABLE | DDI_FM_ERRCB_CAPABLE);
 
-		bus_p->bus_fm_flags |= PF_FM_IS_NH;
+		atomic_or_uint(&bus_p->bus_fm_flags, PF_FM_IS_NH);
 
 		if (cmd == DDI_ATTACH) {
 			ddi_fm_init(dip, &cap, &ibc);
@@ -1039,7 +1066,7 @@ pf_init(dev_info_t *dip, ddi_iblock_cookie_t ibc, ddi_attach_cmd_t cmd)
 
 	/* If ddi_fm_init fails for any reason RETURN */
 	if (!fmhdl) {
-		bus_p->bus_fm_flags = 0;
+		(void) atomic_swap_uint(&bus_p->bus_fm_flags, 0);
 		return;
 	}
 
@@ -1049,7 +1076,7 @@ pf_init(dev_info_t *dip, ddi_iblock_cookie_t ibc, ddi_attach_cmd_t cmd)
 			ddi_fm_handler_register(dip, pf_dummy_cb, NULL);
 	}
 
-	bus_p->bus_fm_flags |= PF_FM_READY;
+	atomic_or_uint(&bus_p->bus_fm_flags, PF_FM_READY);
 }
 
 /* undo FMA lock, called at predetach */
@@ -1066,7 +1093,7 @@ pf_fini(dev_info_t *dip, ddi_detach_cmd_t cmd)
 		return;
 
 	/* no other code should set the flag to false */
-	bus_p->bus_fm_flags &= ~PF_FM_READY;
+	atomic_and_uint(&bus_p->bus_fm_flags, ~PF_FM_READY);
 
 	/*
 	 * Grab the mutex to make sure device isn't in the middle of
@@ -1080,7 +1107,7 @@ pf_fini(dev_info_t *dip, ddi_detach_cmd_t cmd)
 	/* undo non-hardened drivers */
 	if (bus_p->bus_fm_flags & PF_FM_IS_NH) {
 		if (cmd == DDI_DETACH) {
-			bus_p->bus_fm_flags &= ~PF_FM_IS_NH;
+			atomic_and_uint(&bus_p->bus_fm_flags, ~PF_FM_IS_NH);
 			pci_ereport_teardown(dip);
 			/*
 			 * ddi_fini itself calls ddi_handler_unregister,
@@ -1377,7 +1404,7 @@ pf_analyse_error(ddi_fm_error_t *derr, pf_impl_t *impl)
 		sts_flags = 0;
 
 		/* skip analysing error when no error info is gathered */
-		if (pfd_p->pe_severity_flags == PF_ERR_PANIC_BAD_RESPONSE)
+		if (pfd_p->pe_severity_flags == PF_ERR_BAD_RESPONSE)
 			goto done;
 
 		switch (PCIE_PFD2BUS(pfd_p)->bus_dev_type) {
@@ -1455,6 +1482,8 @@ done:
 		/* Have pciev_eh adjust the severity */
 		pfd_p->pe_severity_flags = pciev_eh(pfd_p, impl);
 
+		pfd_p->pe_severity_flags &= ~pfd_p->pe_severity_mask;
+
 		error_flags |= pfd_p->pe_severity_flags;
 	}
 
@@ -2165,7 +2194,8 @@ pf_matched_in_rc(pf_data_t *dq_head_p, pf_data_t *pfd_p,
  */
 static void
 pf_pci_find_trans_type(pf_data_t *pfd_p, uint64_t *addr, uint32_t *trans_type,
-    pcie_req_id_t *bdf) {
+    pcie_req_id_t *bdf)
+{
 	pf_data_t *rc_pfd_p;
 
 	/* Could be DMA or PIO.  Find out by look at error type. */
@@ -2216,7 +2246,8 @@ pf_pci_find_trans_type(pf_data_t *pfd_p, uint64_t *addr, uint32_t *trans_type,
  */
 /* ARGSUSED */
 int
-pf_pci_decode(pf_data_t *pfd_p, uint16_t *cmd) {
+pf_pci_decode(pf_data_t *pfd_p, uint16_t *cmd)
+{
 	pcix_attr_t	*attr;
 	uint64_t	addr;
 	uint32_t	trans_type;
@@ -2415,7 +2446,8 @@ done:
 
 static int
 pf_hdl_compare(dev_info_t *dip, ddi_fm_error_t *derr, uint32_t flag,
-    uint64_t addr, pcie_req_id_t bdf, ndi_fmc_t *fcp) {
+    uint64_t addr, pcie_req_id_t bdf, ndi_fmc_t *fcp)
+{
 	ndi_fmcentry_t	*fep;
 	int		found = 0;
 	int		status;
@@ -2490,7 +2522,7 @@ pf_hdl_compare(dev_info_t *dip, ddi_fm_error_t *derr, uint32_t flag,
 /* ARGSUSED */
 static int
 pf_log_hdl_lookup(dev_info_t *rpdip, ddi_fm_error_t *derr, pf_data_t *pfd_p,
-	boolean_t is_primary)
+    boolean_t is_primary)
 {
 	/*
 	 * Disabling this function temporarily until errors can be handled
@@ -2537,7 +2569,8 @@ pf_log_hdl_lookup(dev_info_t *rpdip, ddi_fm_error_t *derr, pf_data_t *pfd_p,
  * accessed via the bus_p.
  */
 int
-pf_tlp_decode(pcie_bus_t *bus_p, pf_pcie_adv_err_regs_t *adv_reg_p) {
+pf_tlp_decode(pcie_bus_t *bus_p, pf_pcie_adv_err_regs_t *adv_reg_p)
+{
 	pcie_tlp_hdr_t	*tlp_hdr = (pcie_tlp_hdr_t *)adv_reg_p->pcie_ue_hdr;
 	pcie_req_id_t	my_bdf, tlp_bdf, flt_bdf = PCIE_INVALID_BDF;
 	uint64_t	flt_addr = 0;
@@ -3050,6 +3083,7 @@ pf_reset_pfd(pf_data_t *pfd_p)
 	pcie_bus_t	*bus_p = PCIE_PFD2BUS(pfd_p);
 
 	pfd_p->pe_severity_flags = 0;
+	pfd_p->pe_severity_mask = 0;
 	pfd_p->pe_orig_severity_flags = 0;
 	/* pe_lock and pe_valid were reset in pf_send_ereport */
 
diff --git a/usr/src/uts/common/io/pciex/pciev.c b/usr/src/uts/common/io/pciex/pciev.c
index b442aae5b5..c8b2cfdda7 100644
--- a/usr/src/uts/common/io/pciex/pciev.c
+++ b/usr/src/uts/common/io/pciex/pciev.c
@@ -23,6 +23,10 @@
  * Use is subject to license terms.
  */
 
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
 #include <sys/types.h>
 #include <sys/ddi.h>
 #include <sys/dditypes.h>
@@ -302,7 +306,7 @@ pciev_eh(pf_data_t *pfd_p, pf_impl_t *impl)
 		pcie_faulty_all = B_TRUE;
 
 	} else if (severity & (PF_ERR_NO_PANIC | PF_ERR_MATCHED_DEVICE |
-	    PF_ERR_PANIC | PF_ERR_PANIC_BAD_RESPONSE)) {
+	    PF_ERR_PANIC | PF_ERR_BAD_RESPONSE)) {
 
 		uint16_t affected_flag, dev_affected_flags;
 		uint_t is_panic = 0, is_aff_dev_found = 0;
diff --git a/usr/src/uts/common/io/physmem.c b/usr/src/uts/common/io/physmem.c
index 39d5003b02..c48fecd133 100644
--- a/usr/src/uts/common/io/physmem.c
+++ b/usr/src/uts/common/io/physmem.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 
@@ -807,6 +808,13 @@ physmem_open(dev_t *devp, int flag, int otyp, cred_t *credp)
 	int ret;
 	static int msg_printed = 0;
 
+	/*
+	 * This device should never be visible in a zone, but if it somehow
+	 * does get created we refuse to allow the zone to use it.
+	 */
+	if (crgetzoneid(credp) != GLOBAL_ZONEID)
+		return (EACCES);
+
 	if ((flag & (FWRITE | FREAD)) != (FWRITE | FREAD)) {
 		return (EINVAL);
 	}
diff --git a/usr/src/uts/common/io/pseudo.conf b/usr/src/uts/common/io/pseudo.conf
index 42248e93d6..08affec609 100644
--- a/usr/src/uts/common/io/pseudo.conf
+++ b/usr/src/uts/common/io/pseudo.conf
@@ -22,8 +22,7 @@
 #
 # Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
-#
-# ident	"%Z%%M%	%I%	%E% SMI"
+# Copyright 2014 Joyent, Inc.  All rights reserved.
 #
 # This file is private to the pseudonex driver.  It should not be edited.
 #
@@ -38,3 +37,9 @@ name="pseudo" class="root" instance=0;
 # /pseudo; it has as its children the zone console pseudo nodes.
 #
 name="zconsnex" parent="/pseudo" instance=1 valid-children="zcons";
+
+#
+# zfdnex is an alias for pseudo; this node is instantiated as a child of
+# /pseudo; it has as its children the zone fd pseudo nodes.
+#
+name="zfdnex" parent="/pseudo" instance=2 valid-children="zfd";
diff --git a/usr/src/uts/common/io/pseudonex.c b/usr/src/uts/common/io/pseudonex.c
index f83b0abf39..0ae06f88cc 100644
--- a/usr/src/uts/common/io/pseudonex.c
+++ b/usr/src/uts/common/io/pseudonex.c
@@ -83,6 +83,8 @@ static int pseudonex_detach(dev_info_t *, ddi_detach_cmd_t);
 static int pseudonex_open(dev_t *, int, int, cred_t *);
 static int pseudonex_close(dev_t, int, int, cred_t *);
 static int pseudonex_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
+static int pseudonex_fm_init(dev_info_t *, dev_info_t *, int,
+    ddi_iblock_cookie_t *);
 static int pseudonex_ctl(dev_info_t *, dev_info_t *, ddi_ctl_enum_t, void *,
     void *);
 
@@ -90,6 +92,8 @@ static void *pseudonex_state;
 
 typedef struct pseudonex_state {
 	dev_info_t *pnx_devi;
+	int pnx_fmcap;
+	ddi_iblock_cookie_t pnx_fm_ibc;
 } pseudonex_state_t;
 
 static struct bus_ops pseudonex_bus_ops = {
@@ -116,7 +120,7 @@ static struct bus_ops pseudonex_bus_ops = {
 	NULL,			/* bus_intr_ctl */
 	NULL,			/* bus_config */
 	NULL,			/* bus_unconfig */
-	NULL,			/* bus_fm_init */
+	pseudonex_fm_init,	/* bus_fm_init */
 	NULL,			/* bus_fm_fini */
 	NULL,			/* bus_fm_access_enter */
 	NULL,			/* bus_fm_access_exit */
@@ -228,6 +232,9 @@ pseudonex_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
 	pnx_state = ddi_get_soft_state(pseudonex_state, instance);
 	pnx_state->pnx_devi = devi;
 
+	pnx_state->pnx_fmcap = DDI_FM_EREPORT_CAPABLE;
+	ddi_fm_init(devi, &pnx_state->pnx_fmcap, &pnx_state->pnx_fm_ibc);
+
 	if (ddi_create_minor_node(devi, "devctl", S_IFCHR, instance,
 	    DDI_NT_NEXUS, 0) != DDI_SUCCESS) {
 		ddi_remove_minor_node(devi, NULL);
@@ -247,6 +254,10 @@ pseudonex_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
 	if (cmd == DDI_SUSPEND)
 		return (DDI_SUCCESS);
 
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	ddi_fm_fini(devi);
 	ddi_remove_minor_node(devi, NULL);
 	ddi_soft_state_free(pseudonex_state, instance);
 	return (DDI_SUCCESS);
@@ -375,6 +386,19 @@ pseudonex_auto_assign(dev_info_t *child)
 }
 
 static int
+pseudonex_fm_init(dev_info_t *dip, dev_info_t *tdip, int cap,
+    ddi_iblock_cookie_t *ibc)
+{
+	pseudonex_state_t *pnx_state;
+
+	pnx_state = ddi_get_soft_state(pseudonex_state, ddi_get_instance(dip));
+	ASSERT(pnx_state != NULL);
+	ASSERT(ibc != NULL);
+	*ibc = pnx_state->pnx_fm_ibc;
+	return (pnx_state->pnx_fmcap & cap);
+}
+
+static int
 pseudonex_ctl(dev_info_t *dip, dev_info_t *rdip, ddi_ctl_enum_t ctlop,
     void *arg, void *result)
 {
diff --git a/usr/src/uts/common/io/ptm.c b/usr/src/uts/common/io/ptm.c
index d9ec6cc585..dc6c4e64ad 100644
--- a/usr/src/uts/common/io/ptm.c
+++ b/usr/src/uts/common/io/ptm.c
@@ -447,6 +447,18 @@ ptmclose(queue_t *rqp, int flag, cred_t *credp)
 	return (0);
 }
 
+static boolean_t
+ptmptsopencb(ptmptsopencb_arg_t arg)
+{
+	struct pt_ttys	*ptmp = (struct pt_ttys *)arg;
+	boolean_t rval;
+
+	PT_ENTER_READ(ptmp);
+	rval = (ptmp->pt_nullmsg != NULL);
+	PT_EXIT_READ(ptmp);
+	return (rval);
+}
+
 /*
  * The wput procedure will only handle ioctl and flush messages.
  */
@@ -574,6 +586,41 @@ ptmwput(queue_t *qp, mblk_t *mp)
 			miocack(qp, mp, 0, 0);
 			break;
 		}
+		case PTMPTSOPENCB:
+		{
+			mblk_t		*dp;	/* ioctl reply data */
+			ptmptsopencb_t	*ppocb;
+
+			/* only allow the kernel to invoke this ioctl */
+			if (iocp->ioc_cr != kcred) {
+				miocnak(qp, mp, 0, EINVAL);
+				break;
+			}
+
+			/* we don't support transparent ioctls */
+			ASSERT(iocp->ioc_count != TRANSPARENT);
+			if (iocp->ioc_count == TRANSPARENT) {
+				miocnak(qp, mp, 0, EINVAL);
+				break;
+			}
+
+			/* allocate a response message */
+			dp = allocb(sizeof (ptmptsopencb_t), BPRI_MED);
+			if (dp == NULL) {
+				miocnak(qp, mp, 0, EAGAIN);
+				break;
+			}
+
+			/* initialize the ioctl results */
+			ppocb = (ptmptsopencb_t *)dp->b_rptr;
+			ppocb->ppocb_func = ptmptsopencb;
+			ppocb->ppocb_arg = (ptmptsopencb_arg_t)ptmp;
+
+			/* send the reply data */
+			mioc2ack(mp, dp, sizeof (ptmptsopencb_t), 0);
+			qreply(qp, mp);
+			break;
+		}
 		}
 		break;
 
diff --git a/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/iwarp_sm.jpg b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/iwarp_sm.jpg
new file mode 100644
index 0000000000..b932ffaa7c
--- /dev/null
+++ b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/iwarp_sm.jpg
diff --git a/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-full-36.jpg b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-full-36.jpg
new file mode 100644
index 0000000000..9421ecc0db
--- /dev/null
+++ b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-full-36.jpg
diff --git a/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-full.png b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-full.png
new file mode 100644
index 0000000000..4b8a66761a
--- /dev/null
+++ b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-full.png
diff --git a/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-logo.png b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-logo.png
new file mode 100644
index 0000000000..3254fbdc3b
--- /dev/null
+++ b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/qlogic-logo.png
diff --git a/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/reg_access.jpg b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/reg_access.jpg
new file mode 100644
index 0000000000..7bb0dbf21b
--- /dev/null
+++ b/usr/src/uts/common/io/qede/579xx/drivers/ecore/documentation/pictures/reg_access.jpg
diff --git a/usr/src/uts/common/io/qede/579xx/drivers/ecore/ecore_init_values.bin b/usr/src/uts/common/io/qede/579xx/drivers/ecore/ecore_init_values.bin
new file mode 100644
index 0000000000..43014fd8ea
--- /dev/null
+++ b/usr/src/uts/common/io/qede/579xx/drivers/ecore/ecore_init_values.bin
diff --git a/usr/src/uts/common/io/qede/579xx/drivers/ecore/ecore_init_values_zipped.bin b/usr/src/uts/common/io/qede/579xx/drivers/ecore/ecore_init_values_zipped.bin
new file mode 100644
index 0000000000..9524eb4a63
--- /dev/null
+++ b/usr/src/uts/common/io/qede/579xx/drivers/ecore/ecore_init_values_zipped.bin
diff --git a/usr/src/uts/common/io/qede/qede_fp.c b/usr/src/uts/common/io/qede/qede_fp.c
index 5b6177963e..fe7cb7a6cd 100644
--- a/usr/src/uts/common/io/qede/qede_fp.c
+++ b/usr/src/uts/common/io/qede/qede_fp.c
@@ -1848,8 +1848,6 @@ qede_ring_tx(void *arg, mblk_t *mp)
 	}
 
 	if (!qede->params.link_state) {
-		qede_print_err("!%s(%d): Link !up for xmit",
-		    __func__, qede->instance);
 		goto exit;
 	}
 
diff --git a/usr/src/uts/common/io/qede/qede_list.h b/usr/src/uts/common/io/qede/qede_list.h
index 2350cb4117..656d2a915f 100644
--- a/usr/src/uts/common/io/qede/qede_list.h
+++ b/usr/src/uts/common/io/qede/qede_list.h
@@ -176,4 +176,3 @@ qede_list_splice_tail(qede_list_t *list,
 #define	QEDE_LIST_FOR_EACH_ENTRY_SAFE	OSAL_LIST_FOR_EACH_ENTRY_SAFE
 
 #endif  /* !_QEDE_LIST_H */
-
diff --git a/usr/src/uts/common/io/qede/qede_version.h b/usr/src/uts/common/io/qede/qede_version.h
index ebf2624268..54678600c9 100644
--- a/usr/src/uts/common/io/qede/qede_version.h
+++ b/usr/src/uts/common/io/qede/qede_version.h
@@ -42,4 +42,3 @@
 #define REVVERSION 23
 
 #endif  /* !_QEDE_VERSION_H */
-
diff --git a/usr/src/uts/common/io/random.c b/usr/src/uts/common/io/random.c
index d79b86362c..a50bbcceec 100644
--- a/usr/src/uts/common/io/random.c
+++ b/usr/src/uts/common/io/random.c
@@ -291,6 +291,9 @@ rnd_write(dev_t dev, struct uio *uiop, cred_t *credp)
 		if ((error = uiomove(buf, bytes, UIO_WRITE, uiop)) != 0)
 			return (error);
 
+		if (crgetzone(credp) != global_zone)
+			continue;
+
 		switch (devno) {
 		case DEVRANDOM:
 			if ((error = random_add_entropy(buf, bytes, 0)) != 0)
diff --git a/usr/src/uts/common/io/rsm/rsm.c b/usr/src/uts/common/io/rsm/rsm.c
index 4ec7d34b92..4c5489b039 100644
--- a/usr/src/uts/common/io/rsm/rsm.c
+++ b/usr/src/uts/common/io/rsm/rsm.c
@@ -22,8 +22,8 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright 2012 Milan Jurik. All rights reserved.
- * Copyright (c) 2016 by Delphix. All rights reserved.
  * Copyright 2017 Joyent, Inc.
+ * Copyright (c) 2016 by Delphix. All rights reserved.
  */
 
 
diff --git a/usr/src/uts/common/io/sata/adapters/ahci/ahci.c b/usr/src/uts/common/io/sata/adapters/ahci/ahci.c
index 10e71db3b9..07466f8c77 100644
--- a/usr/src/uts/common/io/sata/adapters/ahci/ahci.c
+++ b/usr/src/uts/common/io/sata/adapters/ahci/ahci.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -41,6 +42,42 @@
  * handled these conditions, and blocked these requests. For the detailed
  * information, please check with sdopen, sdclose and sdioctl routines.
  *
+ *
+ * Enclosure Management Support
+ * ----------------------------
+ *
+ * The ahci driver has basic support for AHCI Enclosure Management (EM)
+ * services. The AHCI specification provides an area in the primary ahci BAR for
+ * posting data to send out to the enclosure management and provides a register
+ * that provides both information and control about this. While the
+ * specification allows for multiple forms of enclosure management, the only
+ * supported, and commonly found form, is the AHCI specified LED format. The LED
+ * format is often implemented as a one-way communication mechanism. Software
+ * can write out what it cares about into the aforementioned data buffer and
+ * then we wait for the transmission to be sent.
+ *
+ * This has some drawbacks. It means that we cannot know whether or not it has
+ * succeeded. This means we cannot ask hardware what it thinks the LEDs are
+ * set to. There's also the added unfortunate reality that firmware on the
+ * microcontroller driving this will often not show the LEDs if no drive is
+ * present and that actions taken may potentially cause this to get out of sync
+ * with what we expect it to be. For example, the specification does not
+ * describe what should happen if a drive is removed from the enclosure while
+ * this is set and what should happen when it returns. We can only infer that it
+ * should be the same.
+ *
+ * Because only a single command can be sent at any time and we don't want to
+ * interfere with controller I/O, we create a taskq dedicated to this that has a
+ * single thread. Both resets (which occur on attach and resume) and normal
+ * changes to the LED state will be driven through this taskq. Because the taskq
+ * has a single thread, this guarantees serial processing.
+ *
+ * Each userland-submitted task (basically not resets) has a reference counted
+ * task structure. This allows the thread that called it to be cancelled and
+ * have the system clean itself up. The user thread in ioctl blocks on a CV that
+ * can receive signals as it waits for completion.  Note, there is no guarantee
+ * provided by the kernel that the first thread to enter the kernel will be the
+ * first one to change state.
  */
 
 #include <sys/note.h>
@@ -60,6 +97,17 @@
 #include <sys/fm/io/ddi.h>
 
 /*
+ * EM Control header files
+ */
+#include <sys/types.h>
+#include <sys/file.h>
+#include <sys/errno.h>
+#include <sys/open.h>
+#include <sys/cred.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+
+/*
  * This is the string displayed by modinfo, etc.
  */
 static char ahci_ident[] = "ahci driver";
@@ -221,6 +269,12 @@ static	void ahci_log_serror_message(ahci_ctl_t *, uint8_t, uint32_t, int);
 static	void ahci_log(ahci_ctl_t *, uint_t, char *, ...);
 #endif
 
+static	boolean_t ahci_em_init(ahci_ctl_t *);
+static	void ahci_em_fini(ahci_ctl_t *);
+static	void ahci_em_suspend(ahci_ctl_t *);
+static	void ahci_em_resume(ahci_ctl_t *);
+static	int ahci_em_ioctl(dev_info_t *, int, intptr_t);
+
 
 /*
  * DMA attributes for the data buffer
@@ -315,7 +369,6 @@ static ddi_device_acc_attr_t accattr = {
 	DDI_DEFAULT_ACC
 };
 
-
 static struct dev_ops ahcictl_dev_ops = {
 	DEVO_REV,		/* devo_rev */
 	0,			/* refcnt  */
@@ -325,7 +378,7 @@ static struct dev_ops ahcictl_dev_ops = {
 	ahci_attach,		/* attach */
 	ahci_detach,		/* detach */
 	nodev,			/* no reset */
-	(struct cb_ops *)0,	/* driver operations */
+	NULL,			/* driver operations */
 	NULL,			/* bus operations */
 	NULL,			/* power */
 	ahci_quiesce,		/* quiesce */
@@ -410,6 +463,15 @@ boolean_t sb600_buf_64bit_dma_disable = B_TRUE;
  */
 boolean_t sbxxx_commu_64bit_dma_disable = B_TRUE;
 
+/*
+ * These values control the default delay and default number of times to wait
+ * for an enclosure message to complete.
+ */
+uint_t	ahci_em_reset_delay_ms = 1;
+uint_t	ahci_em_reset_delay_count = 1000;
+uint_t	ahci_em_tx_delay_ms = 1;
+uint_t	ahci_em_tx_delay_count = 1000;
+
 
 /*
  * End of global tunable variable definition
@@ -580,6 +642,11 @@ ahci_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
 			return (DDI_FAILURE);
 		}
 
+		/*
+		 * Reset the enclosure services.
+		 */
+		ahci_em_resume(ahci_ctlp);
+
 		mutex_enter(&ahci_ctlp->ahcictl_mutex);
 		ahci_ctlp->ahcictl_flags &= ~AHCI_SUSPEND;
 		mutex_exit(&ahci_ctlp->ahcictl_mutex);
@@ -714,6 +781,16 @@ ahci_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
 		    "hba capabilities extended = 0x%x", cap2_status);
 	}
 
+	if (cap_status & AHCI_HBA_CAP_EMS) {
+		ahci_ctlp->ahcictl_cap |= AHCI_CAP_EMS;
+		ahci_ctlp->ahcictl_em_loc =
+		    ddi_get32(ahci_ctlp->ahcictl_ahci_acc_handle,
+		    (uint32_t *)AHCI_GLOBAL_EM_LOC(ahci_ctlp));
+		ahci_ctlp->ahcictl_em_ctl =
+		    ddi_get32(ahci_ctlp->ahcictl_ahci_acc_handle,
+		    (uint32_t *)AHCI_GLOBAL_EM_CTL(ahci_ctlp));
+	}
+
 #if AHCI_DEBUG
 	/* Get the interface speed supported by the HBA */
 	speed = (cap_status & AHCI_HBA_CAP_ISS) >> AHCI_HBA_CAP_ISS_SHIFT;
@@ -965,6 +1042,13 @@ intr_done:
 
 	attach_state |= AHCI_ATTACH_STATE_TIMEOUT_ENABLED;
 
+	if (!ahci_em_init(ahci_ctlp)) {
+		cmn_err(CE_WARN, "!ahci%d: failed to initialize enclosure "
+		    "services", instance);
+		goto err_out;
+	}
+	attach_state |= AHCI_ATTACH_STATE_ENCLOSURE;
+
 	if (ahci_register_sata_hba_tran(ahci_ctlp, cap_status)) {
 		cmn_err(CE_WARN, "!ahci%d: sata hba tran registration failed",
 		    instance);
@@ -989,6 +1073,10 @@ err_out:
 	ahci_fm_ereport(ahci_ctlp, DDI_FM_DEVICE_NO_RESPONSE);
 	ddi_fm_service_impact(ahci_ctlp->ahcictl_dip, DDI_SERVICE_LOST);
 
+	if (attach_state & AHCI_ATTACH_STATE_ENCLOSURE) {
+		ahci_em_fini(ahci_ctlp);
+	}
+
 	if (attach_state & AHCI_ATTACH_STATE_TIMEOUT_ENABLED) {
 		mutex_enter(&ahci_ctlp->ahcictl_mutex);
 		(void) untimeout(ahci_ctlp->ahcictl_timeout_id);
@@ -1063,6 +1151,8 @@ ahci_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
 			return (DDI_FAILURE);
 		}
 
+		ahci_em_fini(ahci_ctlp);
+
 		mutex_enter(&ahci_ctlp->ahcictl_mutex);
 
 		/* stop the watchdog handler */
@@ -1112,6 +1202,8 @@ ahci_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
 
 		ahci_ctlp->ahcictl_flags |= AHCI_SUSPEND;
 
+		ahci_em_suspend(ahci_ctlp);
+
 		/* stop the watchdog handler */
 		if (ahci_ctlp->ahcictl_timeout_id) {
 			(void) untimeout(ahci_ctlp->ahcictl_timeout_id);
@@ -1262,7 +1354,7 @@ ahci_register_sata_hba_tran(ahci_ctl_t *ahci_ctlp, uint32_t cap_status)
 	 * pwrmgt_ops needs to be updated
 	 */
 	sata_hba_tran->sata_tran_pwrmgt_ops = NULL;
-	sata_hba_tran->sata_tran_ioctl = NULL;
+	sata_hba_tran->sata_tran_ioctl = ahci_em_ioctl;
 
 	ahci_ctlp->ahcictl_sata_hba_tran = sata_hba_tran;
 
@@ -10209,7 +10301,10 @@ ahci_log(ahci_ctl_t *ahci_ctlp, uint_t level, char *fmt, ...)
  *
  * This function is called when the system is single-threaded at high
  * PIL with preemption disabled. Therefore, this function must not be
- * blocked.
+ * blocked. Because no taskqs are running, there is no need for us to
+ * take any action for enclosure services which are running in the
+ * taskq context, especially as no interrupts are generated by it nor
+ * are any messages expected to come in.
  *
  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
  * DDI_FAILURE indicates an error condition and should almost never happen.
@@ -10327,3 +10422,465 @@ ahci_flush_doneq(ahci_port_t *ahci_portp)
 		mutex_enter(&ahci_portp->ahciport_mutex);
 	}
 }
+
+/*
+ * Sets the state for the specified port on the controller to desired state.
+ * This must be run in the context of the enclosure taskq which ensures that
+ * only one event is outstanding at any time.
+ */
+static boolean_t
+ahci_em_set_led(ahci_ctl_t *ahci_ctlp, uint8_t port, ahci_em_led_state_t desire)
+{
+	ahci_em_led_msg_t msg;
+	ahci_em_msg_hdr_t hdr;
+	uint32_t msgval, hdrval;
+	uint_t i, max_delay = ahci_em_tx_delay_count;
+
+	msg.alm_hba = port;
+	msg.alm_pminfo = 0;
+	msg.alm_value = 0;
+
+	if (desire & AHCI_EM_LED_IDENT_ENABLE) {
+		msg.alm_value |= AHCI_LED_ON << AHCI_LED_IDENT_OFF;
+	}
+
+	if (desire & AHCI_EM_LED_FAULT_ENABLE) {
+		msg.alm_value |= AHCI_LED_ON << AHCI_LED_FAULT_OFF;
+	}
+
+	if ((ahci_ctlp->ahcictl_em_ctl & AHCI_HBA_EM_CTL_ATTR_ALHD) == 0 &&
+	    (desire & AHCI_EM_LED_ACTIVITY_DISABLE) == 0) {
+		msg.alm_value |= AHCI_LED_ON << AHCI_LED_ACTIVITY_OFF;
+	}
+
+	hdr.aemh_rsvd = 0;
+	hdr.aemh_mlen = sizeof (ahci_em_led_msg_t);
+	hdr.aemh_dlen = 0;
+	hdr.aemh_mtype = AHCI_EM_MSG_TYPE_LED;
+
+	bcopy(&msg, &msgval, sizeof (msgval));
+	bcopy(&hdr, &hdrval, sizeof (hdrval));
+
+	/*
+	 * First, make sure we can transmit. We should not have been placed in a
+	 * situation where an outstanding transmission is going on.
+	 */
+	for (i = 0; i < max_delay; i++) {
+		uint32_t val;
+
+		val = ddi_get32(ahci_ctlp->ahcictl_ahci_acc_handle,
+		    (uint32_t *)AHCI_GLOBAL_EM_CTL(ahci_ctlp));
+		if ((val & AHCI_HBA_EM_CTL_CTL_TM) == 0)
+			break;
+
+		delay(drv_usectohz(ahci_em_tx_delay_ms * 1000));
+	}
+
+	if (i == max_delay)
+		return (B_FALSE);
+
+	ddi_put32(ahci_ctlp->ahcictl_ahci_acc_handle,
+	    (uint32_t *)ahci_ctlp->ahcictl_em_tx_off, hdrval);
+	ddi_put32(ahci_ctlp->ahcictl_ahci_acc_handle,
+	    (uint32_t *)(ahci_ctlp->ahcictl_em_tx_off + 4), msgval);
+	ddi_put32(ahci_ctlp->ahcictl_ahci_acc_handle,
+	    (uint32_t *)AHCI_GLOBAL_EM_CTL(ahci_ctlp), AHCI_HBA_EM_CTL_CTL_TM);
+
+	for (i = 0; i < max_delay; i++) {
+		uint32_t val;
+
+		val = ddi_get32(ahci_ctlp->ahcictl_ahci_acc_handle,
+		    (uint32_t *)AHCI_GLOBAL_EM_CTL(ahci_ctlp));
+		if ((val & AHCI_HBA_EM_CTL_CTL_TM) == 0)
+			break;
+
+		delay(drv_usectohz(ahci_em_tx_delay_ms * 1000));
+	}
+
+	if (i == max_delay)
+		return (B_FALSE);
+
+	return (B_TRUE);
+}
+
+typedef struct ahci_em_led_task_arg {
+	ahci_ctl_t		*aelta_ctl;
+	uint8_t			aelta_port;
+	uint_t			aelta_op;
+	ahci_em_led_state_t	aelta_state;
+	uint_t			aelta_ret;
+	kcondvar_t		aelta_cv;
+	uint_t			aelta_ref;
+} ahci_em_led_task_arg_t;
+
+static void
+ahci_em_led_task_free(ahci_em_led_task_arg_t *task)
+{
+	ASSERT3U(task->aelta_ref, ==, 0);
+	cv_destroy(&task->aelta_cv);
+	kmem_free(task, sizeof (*task));
+}
+
+static void
+ahci_em_led_task(void *arg)
+{
+	boolean_t ret, cleanup = B_FALSE;
+	ahci_em_led_task_arg_t *led = arg;
+	ahci_em_led_state_t state;
+
+	mutex_enter(&led->aelta_ctl->ahcictl_mutex);
+	if (led->aelta_ctl->ahcictl_em_flags != AHCI_EM_USABLE) {
+		led->aelta_ret = EIO;
+		mutex_exit(&led->aelta_ctl->ahcictl_mutex);
+		return;
+	}
+
+	state = led->aelta_ctl->ahcictl_em_state[led->aelta_port];
+	mutex_exit(&led->aelta_ctl->ahcictl_mutex);
+
+	switch (led->aelta_op) {
+	case AHCI_EM_IOC_SET_OP_ADD:
+		state |= led->aelta_state;
+		break;
+	case AHCI_EM_IOC_SET_OP_REM:
+		state &= ~led->aelta_state;
+		break;
+	case AHCI_EM_IOC_SET_OP_SET:
+		state = led->aelta_state;
+		break;
+	default:
+		led->aelta_ret = ENOTSUP;
+		return;
+	}
+
+	ret = ahci_em_set_led(led->aelta_ctl, led->aelta_port, state);
+
+	mutex_enter(&led->aelta_ctl->ahcictl_mutex);
+	if (ret) {
+		led->aelta_ctl->ahcictl_em_state[led->aelta_port] =
+		    led->aelta_state;
+		led->aelta_ret = 0;
+	} else {
+		led->aelta_ret = EIO;
+		led->aelta_ctl->ahcictl_em_flags |= AHCI_EM_TIMEOUT;
+	}
+	led->aelta_ref--;
+	if (led->aelta_ref > 0) {
+		cv_signal(&led->aelta_cv);
+	} else {
+		cleanup = B_TRUE;
+	}
+	mutex_exit(&led->aelta_ctl->ahcictl_mutex);
+
+	if (cleanup) {
+		ahci_em_led_task_free(led);
+	}
+}
+
+static void
+ahci_em_reset(void *arg)
+{
+	uint_t i, max_delay = ahci_em_reset_delay_count;
+	ahci_ctl_t *ahci_ctlp = arg;
+
+	/*
+	 * We've been asked to reset the device. The caller should have set the
+	 * resetting flag. Make sure that we don't have a request to quiesce.
+	 */
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	ASSERT(ahci_ctlp->ahcictl_em_flags & AHCI_EM_RESETTING);
+	if (ahci_ctlp->ahcictl_em_flags & AHCI_EM_QUIESCE) {
+		ahci_ctlp->ahcictl_em_flags &= ~AHCI_EM_RESETTING;
+		mutex_exit(&ahci_ctlp->ahcictl_mutex);
+		return;
+	}
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+
+	ddi_put32(ahci_ctlp->ahcictl_ahci_acc_handle,
+	    (uint32_t *)AHCI_GLOBAL_EM_CTL(ahci_ctlp), AHCI_HBA_EM_CTL_CTL_RST);
+	for (i = 0; i < max_delay; i++) {
+		uint32_t val;
+
+		val = ddi_get32(ahci_ctlp->ahcictl_ahci_acc_handle,
+		    (uint32_t *)AHCI_GLOBAL_EM_CTL(ahci_ctlp));
+		if ((val & AHCI_HBA_EM_CTL_CTL_RST) == 0)
+			break;
+
+		delay(drv_usectohz(ahci_em_reset_delay_ms * 1000));
+	}
+
+	if (i == max_delay) {
+		mutex_enter(&ahci_ctlp->ahcictl_mutex);
+		ahci_ctlp->ahcictl_em_flags &= ~AHCI_EM_RESETTING;
+		ahci_ctlp->ahcictl_em_flags |= AHCI_EM_TIMEOUT;
+		mutex_exit(&ahci_ctlp->ahcictl_mutex);
+		cmn_err(CE_WARN, "!ahci%d: enclosure timed out resetting",
+		    ddi_get_instance(ahci_ctlp->ahcictl_dip));
+		return;
+	}
+
+	for (i = 0; i < ahci_ctlp->ahcictl_num_ports; i++) {
+
+		if (!AHCI_PORT_IMPLEMENTED(ahci_ctlp, i))
+			continue;
+
+		/*
+		 * Try to flush all the LEDs as part of reset. If it fails,
+		 * drive on.
+		 */
+		if (!ahci_em_set_led(ahci_ctlp, i,
+		    ahci_ctlp->ahcictl_em_state[i])) {
+			mutex_enter(&ahci_ctlp->ahcictl_mutex);
+			ahci_ctlp->ahcictl_em_flags &= ~AHCI_EM_RESETTING;
+			ahci_ctlp->ahcictl_em_flags |= AHCI_EM_TIMEOUT;
+			mutex_exit(&ahci_ctlp->ahcictl_mutex);
+			cmn_err(CE_WARN, "!ahci%d: enclosure timed out "
+			    "setting port %u",
+			    ddi_get_instance(ahci_ctlp->ahcictl_dip), i);
+			return;
+		}
+	}
+
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	ahci_ctlp->ahcictl_em_flags &= ~AHCI_EM_RESETTING;
+	ahci_ctlp->ahcictl_em_flags |= AHCI_EM_READY;
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+}
+
+static boolean_t
+ahci_em_init(ahci_ctl_t *ahci_ctlp)
+{
+	char name[128];
+
+	/*
+	 * First make sure we actually have enclosure services and if so, that
+	 * we have the hardware support that we care about for this.
+	 */
+	if (ahci_ctlp->ahcictl_em_loc == 0 ||
+	    (ahci_ctlp->ahcictl_em_ctl & AHCI_HBA_EM_CTL_SUPP_LED) == 0)
+		return (B_TRUE);
+
+	/*
+	 * Next, make sure that the buffer is large enough for us. We need two
+	 * dwords or 8 bytes. The location register is stored in dwords.
+	 */
+	if ((ahci_ctlp->ahcictl_em_loc & AHCI_HBA_EM_LOC_SZ_MASK) <
+	    AHCI_EM_BUFFER_MIN) {
+		return (B_TRUE);
+	}
+
+	ahci_ctlp->ahcictl_em_flags |= AHCI_EM_PRESENT;
+
+	ahci_ctlp->ahcictl_em_tx_off = ((ahci_ctlp->ahcictl_em_loc &
+	    AHCI_HBA_EM_LOC_OFST_MASK) >> AHCI_HBA_EM_LOC_OFST_SHIFT) * 4;
+	ahci_ctlp->ahcictl_em_tx_off += ahci_ctlp->ahcictl_ahci_addr;
+
+	bzero(ahci_ctlp->ahcictl_em_state,
+	    sizeof (ahci_ctlp->ahcictl_em_state));
+
+	(void) snprintf(name, sizeof (name), "ahcti_em_taskq%d",
+	    ddi_get_instance(ahci_ctlp->ahcictl_dip));
+	if ((ahci_ctlp->ahcictl_em_taskq =
+	    ddi_taskq_create(ahci_ctlp->ahcictl_dip, name, 1,
+	    TASKQ_DEFAULTPRI, 0)) == NULL) {
+		cmn_err(CE_WARN, "!ahci%d: ddi_tasq_create failed for em "
+		    "services", ddi_get_instance(ahci_ctlp->ahcictl_dip));
+		return (B_FALSE);
+	}
+
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	ahci_ctlp->ahcictl_em_flags |= AHCI_EM_RESETTING;
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+	(void) ddi_taskq_dispatch(ahci_ctlp->ahcictl_em_taskq, ahci_em_reset,
+	    ahci_ctlp, DDI_SLEEP);
+
+	return (B_TRUE);
+}
+
+static int
+ahci_em_ioctl_get(ahci_ctl_t *ahci_ctlp, intptr_t arg)
+{
+	int i;
+	ahci_ioc_em_get_t get;
+
+	bzero(&get, sizeof (get));
+	get.aiemg_nports = ahci_ctlp->ahcictl_ports_implemented;
+	if ((ahci_ctlp->ahcictl_em_ctl & AHCI_HBA_EM_CTL_ATTR_ALHD) == 0) {
+		get.aiemg_flags |= AHCI_EM_FLAG_CONTROL_ACTIVITY;
+	}
+
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	for (i = 0; i < ahci_ctlp->ahcictl_num_ports; i++) {
+		if (!AHCI_PORT_IMPLEMENTED(ahci_ctlp, i)) {
+			continue;
+		}
+		get.aiemg_status[i] = ahci_ctlp->ahcictl_em_state[i];
+	}
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+
+	if (ddi_copyout(&get, (void *)arg, sizeof (get), 0) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static int
+ahci_em_ioctl_set(ahci_ctl_t *ahci_ctlp, intptr_t arg)
+{
+	int ret;
+	ahci_ioc_em_set_t set;
+	ahci_em_led_task_arg_t *task;
+	boolean_t signal, cleanup;
+
+	if (ddi_copyin((void *)arg, &set, sizeof (set), 0) != 0)
+		return (EFAULT);
+
+	if (set.aiems_port > ahci_ctlp->ahcictl_num_ports)
+		return (EINVAL);
+
+	if (!AHCI_PORT_IMPLEMENTED(ahci_ctlp, set.aiems_port)) {
+		return (EINVAL);
+	}
+
+	if ((set.aiems_leds & ~(AHCI_EM_LED_IDENT_ENABLE |
+	    AHCI_EM_LED_FAULT_ENABLE |
+	    AHCI_EM_LED_ACTIVITY_DISABLE)) != 0) {
+		return (EINVAL);
+	}
+
+	switch (set.aiems_op) {
+	case AHCI_EM_IOC_SET_OP_ADD:
+	case AHCI_EM_IOC_SET_OP_REM:
+	case AHCI_EM_IOC_SET_OP_SET:
+		break;
+	default:
+		return (EINVAL);
+	}
+
+	if ((set.aiems_leds & AHCI_EM_LED_ACTIVITY_DISABLE) != 0 &&
+	    ((ahci_ctlp->ahcictl_em_ctl & AHCI_HBA_EM_CTL_ATTR_ALHD) != 0)) {
+		return (ENOTSUP);
+	}
+
+	task = kmem_alloc(sizeof (*task), KM_NOSLEEP | KM_NORMALPRI);
+	if (task == NULL) {
+		return (ENOMEM);
+	}
+
+	task->aelta_ctl = ahci_ctlp;
+	task->aelta_port = set.aiems_port;
+	task->aelta_op = set.aiems_op;
+	task->aelta_state = set.aiems_leds;
+
+	cv_init(&task->aelta_cv, NULL, CV_DRIVER, NULL);
+
+	/*
+	 * Initialize the reference count to two. One for us and one for the
+	 * taskq. This will be used in case we get canceled.
+	 */
+	task->aelta_ref = 2;
+
+	/*
+	 * Once dispatched, the task state is protected by our global mutex.
+	 */
+	(void) ddi_taskq_dispatch(ahci_ctlp->ahcictl_em_taskq,
+	    ahci_em_led_task, task, DDI_SLEEP);
+
+	signal = B_FALSE;
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	while (task->aelta_ref > 1) {
+		if (cv_wait_sig(&task->aelta_cv, &ahci_ctlp->ahcictl_mutex) ==
+		    0) {
+			signal = B_TRUE;
+			break;
+		}
+	}
+
+	/*
+	 * Remove our reference count. If we were woken up because of a signal
+	 * then the taskq may still be dispatched. In which case we shouldn't
+	 * free this memory until it is done. In that case, the taskq will take
+	 * care of it.
+	 */
+	task->aelta_ref--;
+	cleanup = (task->aelta_ref == 0);
+	if (signal) {
+		ret = EINTR;
+	} else {
+		ret = task->aelta_ret;
+	}
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+
+	if (cleanup) {
+		ahci_em_led_task_free(task);
+	}
+
+	return (ret);
+}
+
+static int
+ahci_em_ioctl(dev_info_t *dip, int cmd, intptr_t arg)
+{
+	int inst;
+	ahci_ctl_t *ahci_ctlp;
+
+	inst = ddi_get_instance(dip);
+	if ((ahci_ctlp = ddi_get_soft_state(ahci_statep, inst)) == NULL) {
+		return (ENXIO);
+	}
+
+	switch (cmd) {
+	case AHCI_EM_IOC_GET:
+		return (ahci_em_ioctl_get(ahci_ctlp, arg));
+	case AHCI_EM_IOC_SET:
+		return (ahci_em_ioctl_set(ahci_ctlp, arg));
+	default:
+		return (ENOTTY);
+	}
+
+}
+
+static void
+ahci_em_quiesce(ahci_ctl_t *ahci_ctlp)
+{
+	ASSERT(ahci_ctlp->ahcictl_em_flags & AHCI_EM_PRESENT);
+
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	ahci_ctlp->ahcictl_em_flags |= AHCI_EM_QUIESCE;
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+
+	ddi_taskq_wait(ahci_ctlp->ahcictl_em_taskq);
+}
+
+static void
+ahci_em_suspend(ahci_ctl_t *ahci_ctlp)
+{
+	ahci_em_quiesce(ahci_ctlp);
+
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	ahci_ctlp->ahcictl_em_flags &= ~AHCI_EM_READY;
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+}
+
+static void
+ahci_em_resume(ahci_ctl_t *ahci_ctlp)
+{
+	mutex_enter(&ahci_ctlp->ahcictl_mutex);
+	ahci_ctlp->ahcictl_em_flags |= AHCI_EM_RESETTING;
+	mutex_exit(&ahci_ctlp->ahcictl_mutex);
+
+	(void) ddi_taskq_dispatch(ahci_ctlp->ahcictl_em_taskq, ahci_em_reset,
+	    ahci_ctlp, DDI_SLEEP);
+}
+
+static void
+ahci_em_fini(ahci_ctl_t *ahci_ctlp)
+{
+	if ((ahci_ctlp->ahcictl_em_flags & AHCI_EM_PRESENT) == 0) {
+		return;
+	}
+
+	ahci_em_quiesce(ahci_ctlp);
+	ddi_taskq_destroy(ahci_ctlp->ahcictl_em_taskq);
+	ahci_ctlp->ahcictl_em_taskq = NULL;
+}
diff --git a/usr/src/uts/common/io/sata/impl/sata.c b/usr/src/uts/common/io/sata/impl/sata.c
index c4013d0efd..17c6da2813 100644
--- a/usr/src/uts/common/io/sata/impl/sata.c
+++ b/usr/src/uts/common/io/sata/impl/sata.c
@@ -25,6 +25,7 @@
 /*
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2016 Argo Technologies SA
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -1349,7 +1350,8 @@ sata_hba_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
 	}
 
 	/* read devctl ioctl data */
-	if (cmd != DEVCTL_AP_CONTROL) {
+	if (cmd != DEVCTL_AP_CONTROL && cmd >= DEVCTL_IOC &&
+	    cmd <= DEVCTL_IOC_MAX) {
 		if (ndi_dc_allochdl((void *)arg, &dcp) != NDI_SUCCESS)
 			return (EFAULT);
 
@@ -1677,9 +1679,13 @@ sata_hba_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
 	if (dcp) {
 		ndi_dc_freehdl(dcp);
 	}
-	mutex_enter(&SATA_CPORT_INFO(sata_hba_inst, cport)->cport_mutex);
-	cportinfo->cport_event_flags &= ~SATA_APCTL_LOCK_PORT_BUSY;
-	mutex_exit(&SATA_CPORT_INFO(sata_hba_inst, cport)->cport_mutex);
+
+	if (cmd >= DEVCTL_IOC && cmd <= DEVCTL_IOC_MAX) {
+		mutex_enter(&SATA_CPORT_INFO(sata_hba_inst,
+		    cport)->cport_mutex);
+		cportinfo->cport_event_flags &= ~SATA_APCTL_LOCK_PORT_BUSY;
+		mutex_exit(&SATA_CPORT_INFO(sata_hba_inst, cport)->cport_mutex);
+	}
 
 	return (rv);
 }
@@ -9214,7 +9220,7 @@ sata_build_lsense_page_30(
  */
 static	int
 sata_build_lsense_page_0e(sata_drive_info_t *sdinfo, uint8_t *buf,
-	sata_pkt_txlate_t *spx)
+    sata_pkt_txlate_t *spx)
 {
 	struct start_stop_cycle_counter_log *log_page;
 	int i, rval, index;
@@ -10907,7 +10913,7 @@ sata_offline_device(sata_hba_inst_t *sata_hba_inst,
 
 static dev_info_t *
 sata_create_target_node(dev_info_t *dip, sata_hba_inst_t *sata_hba_inst,
-			sata_address_t *sata_addr)
+    sata_address_t *sata_addr)
 {
 	dev_info_t *cdip = NULL;
 	int rval;
@@ -11095,7 +11101,7 @@ fail:
  */
 static void
 sata_remove_target_node(sata_hba_inst_t *sata_hba_inst,
-			sata_address_t *sata_addr)
+    sata_address_t *sata_addr)
 {
 	dev_info_t *tdip;
 	uint8_t cport = sata_addr->cport;
@@ -12237,7 +12243,7 @@ sata_init_write_cache_mode(sata_drive_info_t *sdinfo)
  */
 static int
 sata_validate_sata_address(sata_hba_inst_t *sata_hba_inst, int cport,
-	int pmport, int qual)
+    int pmport, int qual)
 {
 	if (qual == SATA_ADDR_DCPORT && pmport != 0)
 		goto invalid_address;
@@ -12270,7 +12276,7 @@ invalid_address:
  */
 static int
 sata_validate_scsi_address(sata_hba_inst_t *sata_hba_inst,
-	struct scsi_address *ap, sata_device_t *sata_device)
+    struct scsi_address *ap, sata_device_t *sata_device)
 {
 	int cport, pmport, qual, rval;
 
diff --git a/usr/src/uts/common/io/scsi/adapters/mpt_sas/mptsas.c b/usr/src/uts/common/io/scsi/adapters/mpt_sas/mptsas.c
index b49db2f526..b0d07ac1ec 100644
--- a/usr/src/uts/common/io/scsi/adapters/mpt_sas/mptsas.c
+++ b/usr/src/uts/common/io/scsi/adapters/mpt_sas/mptsas.c
@@ -72,6 +72,7 @@
 #include <sys/file.h>
 #include <sys/policy.h>
 #include <sys/model.h>
+#include <sys/refhash.h>
 #include <sys/sysevent.h>
 #include <sys/sysevent/eventdefs.h>
 #include <sys/sysevent/dr.h>
@@ -99,7 +100,6 @@
 #include <sys/scsi/adapters/mpt_sas/mptsas_var.h>
 #include <sys/scsi/adapters/mpt_sas/mptsas_ioctl.h>
 #include <sys/scsi/adapters/mpt_sas/mptsas_smhba.h>
-#include <sys/scsi/adapters/mpt_sas/mptsas_hash.h>
 #include <sys/raidioctl.h>
 
 #include <sys/fs/dv_node.h>	/* devfs_clean */
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.c
new file mode 100644
index 0000000000..a7ef2b69d7
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.c
@@ -0,0 +1,565 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static int smrt_attach(dev_info_t *, ddi_attach_cmd_t);
+static int smrt_detach(dev_info_t *, ddi_detach_cmd_t);
+static int smrt_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
+static void smrt_cleanup(smrt_t *);
+static int smrt_command_comparator(const void *, const void *);
+
+/*
+ * Controller soft state.  Each entry is an object of type "smrt_t".
+ */
+void *smrt_state;
+
+/*
+ * DMA attributes template.  Each controller will make a copy of this template
+ * with appropriate customisations; e.g., the Scatter/Gather List Length.
+ */
+static ddi_dma_attr_t smrt_dma_attr_template = {
+	.dma_attr_version =		DMA_ATTR_V0,
+	.dma_attr_addr_lo =		0x0000000000000000,
+	.dma_attr_addr_hi =		0xFFFFFFFFFFFFFFFF,
+	.dma_attr_count_max =		0x00FFFFFF,
+	.dma_attr_align =		0x20,
+	.dma_attr_burstsizes =		0x20,
+	.dma_attr_minxfer =		DMA_UNIT_8,
+	.dma_attr_maxxfer =		0xFFFFFFFF,
+	/*
+	 * There is some suggestion that at least some, possibly older, Smart
+	 * Array controllers cannot tolerate a DMA segment that straddles a 4GB
+	 * boundary.
+	 */
+	.dma_attr_seg =			0xFFFFFFFF,
+	.dma_attr_sgllen =		1,
+	.dma_attr_granular =		512,
+	.dma_attr_flags =		0
+};
+
+/*
+ * Device memory access attributes for device control registers.
+ */
+ddi_device_acc_attr_t smrt_dev_attributes = {
+	.devacc_attr_version =		DDI_DEVICE_ATTR_V0,
+	.devacc_attr_endian_flags =	DDI_STRUCTURE_LE_ACC,
+	.devacc_attr_dataorder =	DDI_STRICTORDER_ACC,
+	.devacc_attr_access =		0
+};
+
+/*
+ * Character/Block Operations Structure
+ */
+static struct cb_ops smrt_cb_ops = {
+	.cb_rev =			CB_REV,
+	.cb_flag =			D_NEW | D_MP,
+
+	.cb_open =			scsi_hba_open,
+	.cb_close =			scsi_hba_close,
+
+	.cb_ioctl =			smrt_ioctl,
+
+	.cb_strategy =			nodev,
+	.cb_print =			nodev,
+	.cb_dump =			nodev,
+	.cb_read =			nodev,
+	.cb_write =			nodev,
+	.cb_devmap =			nodev,
+	.cb_mmap =			nodev,
+	.cb_segmap =			nodev,
+	.cb_chpoll =			nochpoll,
+	.cb_prop_op =			ddi_prop_op,
+	.cb_str =			NULL,
+	.cb_aread =			nodev,
+	.cb_awrite =			nodev
+};
+
+/*
+ * Device Operations Structure
+ */
+static struct dev_ops smrt_dev_ops = {
+	.devo_rev =			DEVO_REV,
+	.devo_refcnt =			0,
+
+	.devo_attach =			smrt_attach,
+	.devo_detach =			smrt_detach,
+
+	.devo_cb_ops =			&smrt_cb_ops,
+
+	.devo_getinfo =			nodev,
+	.devo_identify =		nulldev,
+	.devo_probe =			nulldev,
+	.devo_reset =			nodev,
+	.devo_bus_ops =			NULL,
+	.devo_power =			nodev,
+	.devo_quiesce =			nodev
+};
+
+/*
+ * Linkage structures
+ */
+static struct modldrv smrt_modldrv = {
+	.drv_modops =			&mod_driverops,
+	.drv_linkinfo =			"HP Smart Array",
+	.drv_dev_ops =			&smrt_dev_ops
+};
+
+static struct modlinkage smrt_modlinkage = {
+	.ml_rev =			MODREV_1,
+	.ml_linkage =			{ &smrt_modldrv, NULL }
+};
+
+
+int
+_init()
+{
+	int r;
+
+	VERIFY0(ddi_soft_state_init(&smrt_state, sizeof (smrt_t), 0));
+
+	if ((r = scsi_hba_init(&smrt_modlinkage)) != 0) {
+		goto fail;
+	}
+
+	if ((r = mod_install(&smrt_modlinkage)) != 0) {
+		scsi_hba_fini(&smrt_modlinkage);
+		goto fail;
+	}
+
+	return (r);
+
+fail:
+	ddi_soft_state_fini(&smrt_state);
+	return (r);
+}
+
+int
+_fini()
+{
+	int r;
+
+	if ((r = mod_remove(&smrt_modlinkage)) == 0) {
+		scsi_hba_fini(&smrt_modlinkage);
+		ddi_soft_state_fini(&smrt_state);
+	}
+
+	return (r);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&smrt_modlinkage, modinfop));
+}
+
+static int
+smrt_iport_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	const char *addr;
+	dev_info_t *pdip;
+	int instance;
+	smrt_t *smrt;
+
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	/*
+	 * Note, we cannot get to our parent via the tran's tran_hba_private
+	 * member.  This pointer is reset to NULL when the scsi_hba_tran_t
+	 * structure is duplicated.
+	 */
+	addr = scsi_hba_iport_unit_address(dip);
+	VERIFY(addr != NULL);
+	pdip = ddi_get_parent(dip);
+	instance = ddi_get_instance(pdip);
+	smrt = ddi_get_soft_state(smrt_state, instance);
+	VERIFY(smrt != NULL);
+
+	if (strcmp(addr, SMRT_IPORT_VIRT) == 0) {
+		if (smrt_logvol_hba_setup(smrt, dip) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+		smrt->smrt_virt_iport = dip;
+	} else if (strcmp(addr, SMRT_IPORT_PHYS) == 0) {
+		if (smrt_phys_hba_setup(smrt, dip) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+		smrt->smrt_phys_iport = dip;
+	} else {
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_iport_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	const char *addr;
+	scsi_hba_tran_t *tran;
+	smrt_t *smrt;
+
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	tran = ddi_get_driver_private(dip);
+	VERIFY(tran != NULL);
+	smrt = tran->tran_hba_private;
+	VERIFY(smrt != NULL);
+
+	addr = scsi_hba_iport_unit_address(dip);
+	VERIFY(addr != NULL);
+
+	if (strcmp(addr, SMRT_IPORT_VIRT) == 0) {
+		smrt_logvol_hba_teardown(smrt, dip);
+		smrt->smrt_virt_iport = NULL;
+	} else if (strcmp(addr, SMRT_IPORT_PHYS) == 0) {
+		smrt_phys_hba_teardown(smrt, dip);
+		smrt->smrt_phys_iport = NULL;
+	} else {
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	uint32_t instance;
+	smrt_t *smrt;
+	boolean_t check_for_interrupts = B_FALSE;
+	int r;
+	char taskq_name[64];
+
+	if (scsi_hba_iport_unit_address(dip) != NULL)
+		return (smrt_iport_attach(dip, cmd));
+
+	if (cmd != DDI_ATTACH) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Allocate the per-controller soft state object and get
+	 * a pointer to it.
+	 */
+	instance = ddi_get_instance(dip);
+	if (ddi_soft_state_zalloc(smrt_state, instance) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not allocate soft state");
+		return (DDI_FAILURE);
+	}
+	if ((smrt = ddi_get_soft_state(smrt_state, instance)) == NULL) {
+		dev_err(dip, CE_WARN, "could not get soft state");
+		ddi_soft_state_free(smrt_state, instance);
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Initialise per-controller state object.
+	 */
+	smrt->smrt_dip = dip;
+	smrt->smrt_instance = instance;
+	smrt->smrt_next_tag = SMRT_MIN_TAG_NUMBER;
+	list_create(&smrt->smrt_commands, sizeof (smrt_command_t),
+	    offsetof(smrt_command_t, smcm_link));
+	list_create(&smrt->smrt_finishq, sizeof (smrt_command_t),
+	    offsetof(smrt_command_t, smcm_link_finish));
+	list_create(&smrt->smrt_abortq, sizeof (smrt_command_t),
+	    offsetof(smrt_command_t, smcm_link_abort));
+	list_create(&smrt->smrt_volumes, sizeof (smrt_volume_t),
+	    offsetof(smrt_volume_t, smlv_link));
+	list_create(&smrt->smrt_physicals, sizeof (smrt_physical_t),
+	    offsetof(smrt_physical_t, smpt_link));
+	list_create(&smrt->smrt_targets, sizeof (smrt_target_t),
+	    offsetof(smrt_target_t, smtg_link_ctlr));
+	avl_create(&smrt->smrt_inflight, smrt_command_comparator,
+	    sizeof (smrt_command_t), offsetof(smrt_command_t,
+	    smcm_node));
+	cv_init(&smrt->smrt_cv_finishq, NULL, CV_DRIVER, NULL);
+
+	smrt->smrt_init_level |= SMRT_INITLEVEL_BASIC;
+
+	/*
+	 * Perform basic device setup, including identifying the board, mapping
+	 * the I2O registers and the Configuration Table.
+	 */
+	if (smrt_device_setup(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "device setup failed");
+		goto fail;
+	}
+
+	/*
+	 * Select a Transport Method (e.g. Simple or Performant) and update
+	 * the Configuration Table.  This function also waits for the
+	 * controller to become ready.
+	 */
+	if (smrt_ctlr_init(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "controller initialisation failed");
+		goto fail;
+	}
+
+	/*
+	 * Each controller may have a different Scatter/Gather Element count.
+	 * Configure a per-controller set of DMA attributes with the
+	 * appropriate S/G size.
+	 */
+	VERIFY(smrt->smrt_sg_cnt > 0);
+	smrt->smrt_dma_attr = smrt_dma_attr_template;
+	smrt->smrt_dma_attr.dma_attr_sgllen = smrt->smrt_sg_cnt;
+
+	/*
+	 * Now that we have selected a Transport Method, we can configure
+	 * the appropriate interrupt handlers.
+	 */
+	if (smrt_interrupts_setup(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "interrupt handler setup failed");
+		goto fail;
+	}
+
+	/*
+	 * Now that we have the correct interrupt priority, we can initialise
+	 * the mutex.  This must be done before the interrupt handler is
+	 * enabled.
+	 */
+	mutex_init(&smrt->smrt_mutex, NULL, MUTEX_DRIVER,
+	    DDI_INTR_PRI(smrt->smrt_interrupt_pri));
+	smrt->smrt_init_level |= SMRT_INITLEVEL_MUTEX;
+
+	/*
+	 * From this point forward, the controller is able to accept commands
+	 * and (at least by polling) return command submissions.  Setting this
+	 * flag allows the rest of the driver to interact with the device.
+	 */
+	smrt->smrt_status |= SMRT_CTLR_STATUS_RUNNING;
+
+	if (smrt_interrupts_enable(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "interrupt handler could not be enabled");
+		goto fail;
+	}
+
+	if (smrt_ctrl_hba_setup(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "SCSI framework setup failed");
+		goto fail;
+	}
+
+	/*
+	 * Set the appropriate Interrupt Mask Register bits to start
+	 * command completion interrupts from the controller.
+	 */
+	smrt_intr_set(smrt, B_TRUE);
+	check_for_interrupts = B_TRUE;
+
+	/*
+	 * Register the maintenance routine for periodic execution:
+	 */
+	smrt->smrt_periodic = ddi_periodic_add(smrt_periodic, smrt,
+	    SMRT_PERIODIC_RATE * NANOSEC, DDI_IPL_0);
+	smrt->smrt_init_level |= SMRT_INITLEVEL_PERIODIC;
+
+	(void) snprintf(taskq_name, sizeof (taskq_name), "smrt_discover_%u",
+	    instance);
+	smrt->smrt_discover_taskq = ddi_taskq_create(smrt->smrt_dip, taskq_name,
+	    1, TASKQ_DEFAULTPRI, 0);
+	if (smrt->smrt_discover_taskq == NULL) {
+		dev_err(dip, CE_WARN, "failed to create discovery task queue");
+		goto fail;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_TASKQ;
+
+	if ((r = smrt_event_init(smrt)) != 0) {
+		dev_err(dip, CE_WARN, "could not initialize event subsystem "
+		    "(%d)", r);
+		goto fail;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_ASYNC_EVENT;
+
+	if (scsi_hba_iport_register(dip, SMRT_IPORT_VIRT) != DDI_SUCCESS)
+		goto fail;
+
+	if (scsi_hba_iport_register(dip, SMRT_IPORT_PHYS) != DDI_SUCCESS)
+		goto fail;
+
+	/*
+	 * Announce the attachment of this controller.
+	 */
+	ddi_report_dev(dip);
+
+	return (DDI_SUCCESS);
+
+fail:
+	if (check_for_interrupts) {
+		if (smrt->smrt_stats.smrts_claimed_interrupts == 0) {
+			dev_err(dip, CE_WARN, "controller did not interrupt "
+			    "during attach");
+		}
+	}
+	smrt_cleanup(smrt);
+	return (DDI_FAILURE);
+}
+
+static int
+smrt_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	scsi_hba_tran_t *tran = (scsi_hba_tran_t *)ddi_get_driver_private(dip);
+	smrt_t *smrt = (smrt_t *)tran->tran_hba_private;
+
+	if (scsi_hba_iport_unit_address(dip) != NULL)
+		return (smrt_iport_detach(dip, cmd));
+
+	if (cmd != DDI_DETACH) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * First, check to make sure that all SCSI framework targets have
+	 * detached.
+	 */
+	mutex_enter(&smrt->smrt_mutex);
+	if (!list_is_empty(&smrt->smrt_targets)) {
+		mutex_exit(&smrt->smrt_mutex);
+		dev_err(smrt->smrt_dip, CE_WARN, "cannot detach; targets still "
+		    "using HBA");
+		return (DDI_FAILURE);
+	}
+
+	if (smrt->smrt_virt_iport != NULL || smrt->smrt_phys_iport != NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		dev_err(smrt->smrt_dip, CE_WARN, "cannot detach: iports still "
+		    "attached");
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Prevent new targets from attaching now:
+	 */
+	smrt->smrt_status |= SMRT_CTLR_STATUS_DETACHING;
+	mutex_exit(&smrt->smrt_mutex);
+
+	/*
+	 * Clean up all remaining resources.
+	 */
+	smrt_cleanup(smrt);
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rval)
+{
+	int inst = MINOR2INST(getminor(dev));
+	int status;
+
+	if (secpolicy_sys_config(credp, B_FALSE) != 0) {
+		return (EPERM);
+	}
+
+	/*
+	 * Ensure that we have a soft state object for this instance.
+	 */
+	if (ddi_get_soft_state(smrt_state, inst) == NULL) {
+		return (ENXIO);
+	}
+
+	switch (cmd) {
+	default:
+		status = scsi_hba_ioctl(dev, cmd, arg, mode, credp, rval);
+		break;
+	}
+
+	return (status);
+}
+
+static void
+smrt_cleanup(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_ASYNC_EVENT) {
+		smrt_event_fini(smrt);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_ASYNC_EVENT;
+	}
+
+	smrt_interrupts_teardown(smrt);
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_TASKQ) {
+		ddi_taskq_destroy(smrt->smrt_discover_taskq);
+		smrt->smrt_discover_taskq = NULL;
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_TASKQ;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_PERIODIC) {
+		ddi_periodic_delete(smrt->smrt_periodic);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_PERIODIC;
+	}
+
+	smrt_ctrl_hba_teardown(smrt);
+
+	smrt_ctlr_teardown(smrt);
+
+	smrt_device_teardown(smrt);
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_BASIC) {
+		smrt_logvol_teardown(smrt);
+		smrt_phys_teardown(smrt);
+
+		cv_destroy(&smrt->smrt_cv_finishq);
+
+		VERIFY(list_is_empty(&smrt->smrt_commands));
+		list_destroy(&smrt->smrt_commands);
+		list_destroy(&smrt->smrt_finishq);
+		list_destroy(&smrt->smrt_abortq);
+
+		VERIFY(list_is_empty(&smrt->smrt_volumes));
+		list_destroy(&smrt->smrt_volumes);
+
+		VERIFY(list_is_empty(&smrt->smrt_physicals));
+		list_destroy(&smrt->smrt_physicals);
+
+		VERIFY(list_is_empty(&smrt->smrt_targets));
+		list_destroy(&smrt->smrt_targets);
+
+		VERIFY(avl_is_empty(&smrt->smrt_inflight));
+		avl_destroy(&smrt->smrt_inflight);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_BASIC;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_MUTEX) {
+		mutex_destroy(&smrt->smrt_mutex);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_MUTEX;
+	}
+
+	VERIFY0(smrt->smrt_init_level);
+
+	ddi_soft_state_free(smrt_state, ddi_get_instance(smrt->smrt_dip));
+}
+
+/*
+ * Comparator for the "smrt_inflight" AVL tree in a "smrt_t".  This AVL tree
+ * allows a tag ID to be mapped back to the relevant "smrt_command_t".
+ */
+static int
+smrt_command_comparator(const void *lp, const void *rp)
+{
+	const smrt_command_t *l = lp;
+	const smrt_command_t *r = rp;
+
+	if (l->smcm_tag > r->smcm_tag) {
+		return (1);
+	} else if (l->smcm_tag < r->smcm_tag) {
+		return (-1);
+	} else {
+		return (0);
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt.conf b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.conf
new file mode 100644
index 0000000000..758ecd0779
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.conf
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+scsi-no-quiesce=1;
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss.c
new file mode 100644
index 0000000000..b4cdd5607e
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss.c
@@ -0,0 +1,2023 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * Discovery, Resets, Periodics, and Events
+ * ----------------------------------------
+ *
+ * Discovery is the act of figuring out what logical and physical volumes exist
+ * under the controller.  Discovery happens in response to the following events:
+ *
+ *   o iports for virtual and physical devices being attached
+ *   o Controller event notifications indicating potential topology changes
+ *   o After a reset of the controller, before we can perform I/O again
+ *
+ * Because we have to perform discovery after a reset, which can happen during
+ * panic(), that also means that discovery may be run in panic context.  We
+ * also need to emphasize the need for discovery to happen after a controller
+ * reset.  Once a reset is initiated, we cannot be certain about the addresses
+ * of any of the existing targets until the reset has completed.  The driver
+ * performs I/Os to addresses that the controller provides.  The controller
+ * specification says that these addresses may change after a controller reset.
+ *
+ * Unfortunately, all of this combined means that making sure we can correctly
+ * run discovery is somewhat complicated.  In non-panic contexts, discovery is
+ * always run from a taskq.  We'll kick off the discovery in the taskq if
+ * nothing is pending at that time.  The state is managed by bits in the
+ * smrt_status member of the smrt_t.  There are four bits at this time:
+ *
+ *	SMRT_CTLR_DISCOVERY_REQUESTED	This flag indicates that something has
+ *					requested that a discovery be performed.
+ *					If no flags are set when this is set,
+ *					then we will kick off discovery.  All
+ *					discovery requests are initiated via the
+ *					smrt_discover_request() function.
+ *
+ *	SMRT_CTLR_DISCOVERY_RUNNING	This flag is set at the start of us
+ *					running a discovery.  It is removed when
+ *					discovery finishes.
+ *
+ *	SMRT_CTLR_DISCOVERY_PERIODIC	This flag is set in a number of
+ *					circumstances, which will be described
+ *					in a subsequent section.  This indicates
+ *					that the periodic must kick off the
+ *					discovery process.
+ *
+ *	SMRT_CTLR_DISCOVERY_REQUIRED	This flag indicates that at some point a
+ *					controller reset occurred and we need to
+ *					have a successful discovery to finish
+ *					the act of resetting and allowing I/O to
+ *					continue.
+ *
+ * In general, a request to discover kicks off the taskq to discover entries, if
+ * it hasn't already been requested or started.  This also allows us to coalesce
+ * multiple requests, if needed.  Note that if a request comes in when a
+ * discovery is ongoing, we do not kick off discovery again.  Instead, we set
+ * the SMRT_CTLR_DISCOVERY_REQUESTED flag which will rerun discovery after the
+ * initial pass has completed.
+ *
+ * When a discovery starts, the first thing it does is clear the
+ * SMRT_CTLR_DISCOVERY_REQUESTED flag.  This is important, because any
+ * additional requests for discovery that come in after this has started likely
+ * indicate that we've missed something.  As such, when the discovery process
+ * finishes, if it sees the REQUESTED flag, then it will need to set the
+ * PERIODIC flag.  The PERIODIC flag is used to indicate that we should run
+ * discovery again, but not kick if off immediately.  Instead, it should be
+ * driven by the normal periodic behavior.
+ *
+ * If for some reason the act of discovery fails, or we fail to dispatch
+ * discovery due to a transient error, then we will flag PERIODIC so that the
+ * periodic tick will try and run things again.
+ *
+ * Now, we need to talk about SMRT_CTLR_DISCOVERY_REQUIRED.  This flag is set
+ * after a reset occurs.  The reset thread will be blocked on this.
+ * Importantly, none of the code in the discovery path can ask for a controller
+ * reset at this time.  If at the end of a discovery, this flag is set, then we
+ * will signal the reset thread that it should check on its status by
+ * broadcasting on the smrt_cv_finishq.  At that point, the reset thread will
+ * continue.
+ *
+ * Panic Context
+ * -------------
+ *
+ * All of this talk of threads and taskqs is well and good, but as an HBA
+ * driver, we have a serious responsibility to try and deal with panic sanely.
+ * In panic context, we will directly call the discovery functions and not poll
+ * for them to occur.
+ *
+ * However, because our discovery relies on the target maps, which aren't safe
+ * for panic context at this time, we have to take a different approach.  We
+ * leverage the fact that we have a generation number stored with every
+ * discovery.  If we try to do an I/O to a device where the generation doesn't
+ * match, then we know that it disappeared and should not be used.  We also
+ * sanity check the model, serial numbers, and WWNs to make sure that these are
+ * the same devices.  If they are, then we'll end up updating the address
+ * structures.
+ *
+ * Now, it is possible that when we were panicking, we had a thread that was in
+ * the process of running a discovery or even resetting the system.  Once we're
+ * in panic, those threads aren't running, so if they didn't end up producing a
+ * new view of the world that the SCSI framework is using, then it shouldn't
+ * really matter, as we won't have updated the list of devices.  Importantly,
+ * once we're in that context, we're not going to be attaching or detaching
+ * targets.  If we get a request for one of these targets which has disappeared,
+ * we're going to have to end up giving up.
+ *
+ * Request Attributes
+ * ------------------
+ *
+ * The CISS specification allows for three different kinds of attributes that
+ * describe how requests are queued to the controller.  These are:
+ *
+ * 	HEAD OF QUEUE		The request should go to the head of the
+ * 				controller queue.  This is used for resets and
+ * 				aborts to ensure that they're not blocked behind
+ * 				additional I/O.
+ *
+ * 	SIMPLE			This queues the request for normal processing.
+ * 				Commands queued this way are not special with
+ * 				respect to one another.  We use this for all I/O
+ * 				and discovery commands.
+ *
+ *	ORDERED			This attribute is used to indicate that commands
+ *				should be submitted and processed in some order.
+ *				This is used primarily for the event
+ *				notification bits so we can ensure that at the
+ *				return of a cancellation of the event
+ *				notification, that any outstanding request has
+ *				been honored.
+ */
+
+static int smrt_ctlr_versions(smrt_t *, uint16_t, smrt_versions_t *);
+static void smrt_discover(void *);
+
+/*
+ * The maximum number of seconds to wait for the controller to come online.
+ */
+unsigned smrt_ciss_init_time = 90;
+
+/*
+ * A tunable that determines the number of events per tick that we'll process
+ * via asynchronous event notification.  If this rate is very high, then we will
+ * not submit the event and it will be picked up at the next tick of the
+ * periodic.
+ */
+uint_t smrt_event_intervention_threshold = 1000;
+
+/*
+ * Converts a LUN Address to a BMIC Identifier.  The BMIC Identifier is used
+ * when performing various physical commands and generally should stay the same
+ * for a given device across inserts and removals; however, not across
+ * controller resets.  These are calculated based on what the CISS specification
+ * calls the 'Level 2' target and bus, which don't have a real meaning in the
+ * SAS world otherwise.
+ */
+uint16_t
+smrt_lun_addr_to_bmic(PhysDevAddr_t *paddr)
+{
+	uint16_t id;
+
+	id = (paddr->Target[1].PeripDev.Bus - 1) << 8;
+	id += paddr->Target[1].PeripDev.Dev;
+
+	return (id);
+}
+
+void
+smrt_write_lun_addr_phys(LUNAddr_t *lun, boolean_t masked, unsigned bus,
+    unsigned target)
+{
+	lun->PhysDev.Mode = masked ? MASK_PERIPHERIAL_DEV_ADDR :
+	    PERIPHERIAL_DEV_ADDR;
+
+	lun->PhysDev.TargetId = target;
+	lun->PhysDev.Bus = bus;
+
+	bzero(&lun->PhysDev.Target, sizeof (lun->PhysDev.Target));
+}
+
+/*
+ * According to the CISS Specification, the controller is always addressed in
+ * Mask Perhiperhal mode with a bus and target ID of zero.  This is used by
+ * commands that need to write to the controller itself, which is generally
+ * discovery and other commands.
+ */
+void
+smrt_write_controller_lun_addr(LUNAddr_t *lun)
+{
+	smrt_write_lun_addr_phys(lun, B_TRUE, 0, 0);
+}
+
+void
+smrt_write_message_common(smrt_command_t *smcm, uint8_t type, int timeout_secs)
+{
+	switch (type) {
+	case CISS_MSG_ABORT:
+	case CISS_MSG_RESET:
+	case CISS_MSG_NOP:
+		break;
+
+	default:
+		panic("unknown message type");
+	}
+
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_MSG;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_HEADOFQUEUE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_NONE;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout_secs);
+	smcm->smcm_va_cmd->Request.CDBLen = CISS_CDBLEN;
+	smcm->smcm_va_cmd->Request.CDB[0] = type;
+}
+
+void
+smrt_write_message_abort_one(smrt_command_t *smcm, uint32_t tag)
+{
+	smrt_tag_t cisstag;
+
+	/*
+	 * When aborting a particular command, the request is addressed
+	 * to the controller.
+	 */
+	smrt_write_lun_addr_phys(&smcm->smcm_va_cmd->Header.LUN,
+	    B_TRUE, 0, 0);
+
+	smrt_write_message_common(smcm, CISS_MSG_ABORT, 0);
+
+	/*
+	 * Abort a single command.
+	 */
+	smcm->smcm_va_cmd->Request.CDB[1] = CISS_ABORT_TASK;
+
+	/*
+	 * The CISS Specification says that the tag value for a task-level
+	 * abort should be in the CDB in bytes 4-11.
+	 */
+	bzero(&cisstag, sizeof (cisstag));
+	cisstag.tag_value = tag;
+	bcopy(&cisstag, &smcm->smcm_va_cmd->Request.CDB[4],
+	    sizeof (cisstag));
+}
+
+void
+smrt_write_message_abort_all(smrt_command_t *smcm, LUNAddr_t *addr)
+{
+	/*
+	 * When aborting all tasks for a particular Logical Volume,
+	 * the command is addressed not to the controller but to
+	 * the Volume itself.
+	 */
+	smcm->smcm_va_cmd->Header.LUN = *addr;
+
+	smrt_write_message_common(smcm, CISS_MSG_ABORT, 0);
+
+	/*
+	 * Abort all commands for a particular Logical Volume.
+	 */
+	smcm->smcm_va_cmd->Request.CDB[1] = CISS_ABORT_TASKSET;
+}
+
+void
+smrt_write_message_event_notify(smrt_command_t *smcm)
+{
+	smrt_event_notify_req_t senr;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_ORDERED;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+	smcm->smcm_va_cmd->Request.Timeout = 0;
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (senr);
+
+	bzero(&senr, sizeof (senr));
+	senr.senr_opcode = CISS_SCMD_READ;
+	senr.senr_subcode = CISS_BMIC_NOTIFY_ON_EVENT;
+	senr.senr_flags = BE_32(0);
+	senr.senr_size = BE_32(SMRT_EVENT_NOTIFY_BUFLEN);
+
+	bcopy(&senr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (senr)));
+}
+
+void
+smrt_write_message_cancel_event_notify(smrt_command_t *smcm)
+{
+	smrt_event_notify_req_t senr;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_ORDERED;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_WRITE;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(SMRT_ASYNC_CANCEL_TIMEOUT);
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (senr);
+
+	bzero(&senr, sizeof (senr));
+	senr.senr_opcode = CISS_SCMD_WRITE;
+	senr.senr_subcode = CISS_BMIC_NOTIFY_ON_EVENT_CANCEL;
+	senr.senr_size = BE_32(SMRT_EVENT_NOTIFY_BUFLEN);
+
+	bcopy(&senr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (senr)));
+}
+
+void
+smrt_write_message_reset_ctlr(smrt_command_t *smcm)
+{
+	smrt_write_lun_addr_phys(&smcm->smcm_va_cmd->Header.LUN,
+	    B_TRUE, 0, 0);
+
+	smrt_write_message_common(smcm, CISS_MSG_RESET, 0);
+
+	smcm->smcm_va_cmd->Request.CDB[1] = CISS_RESET_CTLR;
+}
+
+void
+smrt_write_message_nop(smrt_command_t *smcm, int timeout_secs)
+{
+	/*
+	 * No-op messages are always sent to the controller.
+	 */
+	smrt_write_lun_addr_phys(&smcm->smcm_va_cmd->Header.LUN,
+	    B_TRUE, 0, 0);
+
+	smrt_write_message_common(smcm, CISS_MSG_NOP, timeout_secs);
+}
+
+/*
+ * This routine is executed regularly by ddi_periodic_add(9F).  It checks the
+ * health of the controller and looks for submitted commands that have timed
+ * out.
+ */
+void
+smrt_periodic(void *arg)
+{
+	smrt_t *smrt = arg;
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Before we even check if the controller is running to process
+	 * everything else, we must first check if we had a request to kick off
+	 * discovery.  We do this before the check if the controller is running,
+	 * as this may be required to finish a discovery.
+	 */
+	if ((smrt->smrt_status & SMRT_CTLR_DISCOVERY_PERIODIC) != 0 &&
+	    (smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING) == 0 &&
+	    (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) == 0) {
+		if (ddi_taskq_dispatch(smrt->smrt_discover_taskq,
+		    smrt_discover, smrt, DDI_NOSLEEP) != DDI_SUCCESS) {
+			smrt->smrt_stats.smrts_discovery_tq_errors++;
+		} else {
+			smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_PERIODIC;
+		}
+	}
+
+	if (!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING)) {
+		/*
+		 * The device is currently not active, e.g. due to an
+		 * in-progress controller reset.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		return;
+	}
+
+	/*
+	 * Check on the health of the controller firmware.  Note that if the
+	 * controller has locked up, this routine will panic the system.
+	 */
+	smrt_lockup_check(smrt);
+
+	/*
+	 * Reset the event notification threshold counter.
+	 */
+	smrt->smrt_event_count = 0;
+
+	/*
+	 * Check inflight commands to see if they have timed out.
+	 */
+	for (smrt_command_t *smcm = avl_first(&smrt->smrt_inflight);
+	    smcm != NULL; smcm = AVL_NEXT(&smrt->smrt_inflight, smcm)) {
+		if (smcm->smcm_status & SMRT_CMD_STATUS_POLLED) {
+			/*
+			 * Polled commands are timed out by the polling
+			 * routine.
+			 */
+			continue;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABORT_SENT) {
+			/*
+			 * This command has been aborted; either it will
+			 * complete or the controller will be reset.
+			 */
+			continue;
+		}
+
+		if (list_link_active(&smcm->smcm_link_abort)) {
+			/*
+			 * Already on the abort queue.
+			 */
+			continue;
+		}
+
+		if (smcm->smcm_expiry == 0) {
+			/*
+			 * This command has no expiry time.
+			 */
+			continue;
+		}
+
+		if (gethrtime() > smcm->smcm_expiry) {
+			list_insert_tail(&smrt->smrt_abortq, smcm);
+			smcm->smcm_status |= SMRT_CMD_STATUS_TIMEOUT;
+		}
+	}
+
+	/*
+	 * Process the abort queue.
+	 */
+	(void) smrt_process_abortq(smrt);
+
+	/*
+	 * Check if we have an outstanding event intervention request.  Note,
+	 * the command in question should always be in a state such that it is
+	 * usable by the system here.  The command is always prepared again by
+	 * the normal event notification path, even if a reset has occurred.
+	 * The reset will be processed before we'd ever consider running an
+	 * event again.  Note, if we fail to submit this, then we leave this for
+	 * the next occurrence of the periodic.
+	 */
+	if (smrt->smrt_status & SMRT_CTLR_ASYNC_INTERVENTION) {
+		smrt->smrt_stats.smrts_events_intervened++;
+
+		if (smrt_submit(smrt, smrt->smrt_event_cmd) == 0) {
+			smrt->smrt_status &= ~SMRT_CTLR_ASYNC_INTERVENTION;
+		}
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+int
+smrt_retrieve(smrt_t *smrt)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		smrt_retrieve_simple(smrt);
+		return (DDI_SUCCESS);
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		break;
+	}
+
+	panic("unknown controller mode");
+	/* LINTED: E_FUNC_NO_RET_VAL */
+}
+
+/*
+ * Grab a new tag number for this command.  We aim to avoid reusing tag numbers
+ * as much as possible, so as to avoid spurious double completion from the
+ * controller.
+ */
+static void
+smrt_set_new_tag(smrt_t *smrt, smrt_command_t *smcm)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	/*
+	 * Loop until we find a tag that is not in use.  The tag space is
+	 * very large (~30 bits) and the maximum number of inflight commands
+	 * is comparatively small (~1024 in current controllers).
+	 */
+	for (;;) {
+		uint32_t new_tag = smrt->smrt_next_tag;
+
+		if (++smrt->smrt_next_tag > SMRT_MAX_TAG_NUMBER) {
+			smrt->smrt_next_tag = SMRT_MIN_TAG_NUMBER;
+		}
+
+		if (smrt_lookup_inflight(smrt, new_tag) != NULL) {
+			/*
+			 * This tag is already used on an inflight command.
+			 * Choose another.
+			 */
+			continue;
+		}
+
+		/*
+		 * Set the tag for the command and also write it into the
+		 * appropriate part of the request block.
+		 */
+		smcm->smcm_tag = new_tag;
+		smcm->smcm_va_cmd->Header.Tag.tag_value = new_tag;
+		return;
+	}
+}
+
+/*
+ * Submit a command to the controller.
+ */
+int
+smrt_submit(smrt_t *smrt, smrt_command_t *smcm)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+	VERIFY(smcm->smcm_type != SMRT_CMDTYPE_PREINIT);
+
+	/*
+	 * Anything that asks us to ignore the running state of the controller
+	 * must be wired up to poll for completion.
+	 */
+	if (smcm->smcm_status & SMRT_CMD_IGNORE_RUNNING) {
+		VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_POLLED);
+	}
+
+	/*
+	 * If the controller is currently being reset, do not allow command
+	 * submission.  However, if this is one of the commands needed to finish
+	 * reset, as indicated on the command structure, allow it.
+	 */
+	if (!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING) &&
+	    !(smcm->smcm_status & SMRT_CMD_IGNORE_RUNNING)) {
+		return (EIO);
+	}
+
+	/*
+	 * Do not allow submission of more concurrent commands than the
+	 * controller supports.
+	 */
+	if (avl_numnodes(&smrt->smrt_inflight) >= smrt->smrt_maxcmds) {
+		return (EAGAIN);
+	}
+
+	/*
+	 * Synchronise the Command Block DMA resources to ensure that the
+	 * device has a consistent view before we pass it the command.
+	 */
+	if (ddi_dma_sync(smcm->smcm_contig.smdma_dma_handle, 0, 0,
+	    DDI_DMA_SYNC_FORDEV) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "DMA sync failure");
+		return (EIO);
+	}
+
+	/*
+	 * Ensure that this command is not re-used without issuing a new
+	 * tag number and performing any appropriate cleanup.
+	 */
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_USED));
+	smcm->smcm_status |= SMRT_CMD_STATUS_USED;
+
+	/*
+	 * Assign a tag that is not currently in use
+	 */
+	smrt_set_new_tag(smrt, smcm);
+
+	/*
+	 * Insert this command into the inflight AVL.
+	 */
+	avl_index_t where;
+	if (avl_find(&smrt->smrt_inflight, smcm, &where) != NULL) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "duplicate submit tag %x",
+		    smcm->smcm_tag);
+	}
+	avl_insert(&smrt->smrt_inflight, smcm, where);
+	if (smrt->smrt_stats.smrts_max_inflight <
+	    avl_numnodes(&smrt->smrt_inflight)) {
+		smrt->smrt_stats.smrts_max_inflight =
+		    avl_numnodes(&smrt->smrt_inflight);
+	}
+
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT));
+	smcm->smcm_status |= SMRT_CMD_STATUS_INFLIGHT;
+
+	smcm->smcm_time_submit = gethrtime();
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		smrt_submit_simple(smrt, smcm);
+		return (0);
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		break;
+	}
+	panic("unknown controller mode");
+	/* LINTED: E_FUNC_NO_RET_VAL */
+}
+
+static void
+smrt_process_finishq_sync(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	if (ddi_dma_sync(smcm->smcm_contig.smdma_dma_handle, 0, 0,
+	    DDI_DMA_SYNC_FORCPU) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "finishq DMA sync failure");
+	}
+}
+
+static void
+smrt_process_finishq_one(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_COMPLETE));
+	smcm->smcm_status |= SMRT_CMD_STATUS_COMPLETE;
+
+	switch (smcm->smcm_type) {
+	case SMRT_CMDTYPE_INTERNAL:
+		cv_broadcast(&smcm->smcm_ctlr->smrt_cv_finishq);
+		return;
+
+	case SMRT_CMDTYPE_SCSA:
+		smrt_hba_complete(smcm);
+		return;
+
+	case SMRT_CMDTYPE_EVENT:
+		smrt_event_complete(smcm);
+		return;
+
+	case SMRT_CMDTYPE_ABORTQ:
+		/*
+		 * Abort messages sent as part of abort queue processing
+		 * do not require any completion activity.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		mutex_enter(&smrt->smrt_mutex);
+		return;
+
+	case SMRT_CMDTYPE_PREINIT:
+		dev_err(smrt->smrt_dip, CE_PANIC, "preinit command "
+		    "completed after initialisation");
+		return;
+	}
+
+	panic("unknown command type");
+}
+
+/*
+ * Process commands in the completion queue.
+ */
+void
+smrt_process_finishq(smrt_t *smrt)
+{
+	smrt_command_t *smcm;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	while ((smcm = list_remove_head(&smrt->smrt_finishq)) != NULL) {
+		/*
+		 * Synchronise the Command Block before we read from it or
+		 * free it, to ensure that any writes from the controller are
+		 * visible.
+		 */
+		smrt_process_finishq_sync(smcm);
+
+		/*
+		 * Check if this command was in line to be aborted.
+		 */
+		if (list_link_active(&smcm->smcm_link_abort)) {
+			/*
+			 * This command was in line, but the controller
+			 * subsequently completed the command before we
+			 * were able to do so.
+			 */
+			list_remove(&smrt->smrt_abortq, smcm);
+			smcm->smcm_status &= ~SMRT_CMD_STATUS_TIMEOUT;
+		}
+
+		/*
+		 * Check if this command has been abandoned by the original
+		 * submitter.  If it has, free it now to avoid a leak.
+		 */
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABANDONED) {
+			mutex_exit(&smrt->smrt_mutex);
+			smrt_command_free(smcm);
+			mutex_enter(&smrt->smrt_mutex);
+			continue;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_POLLED) {
+			/*
+			 * This command will be picked up and processed
+			 * by "smrt_poll_for()" once the CV is triggered
+			 * at the end of processing.
+			 */
+			smcm->smcm_status |= SMRT_CMD_STATUS_POLL_COMPLETE;
+			continue;
+		}
+
+		smrt_process_finishq_one(smcm);
+	}
+
+	cv_broadcast(&smrt->smrt_cv_finishq);
+}
+
+/*
+ * Process commands in the abort queue.
+ */
+void
+smrt_process_abortq(smrt_t *smrt)
+{
+	smrt_command_t *smcm;
+	smrt_command_t *abort_smcm = NULL;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (list_is_empty(&smrt->smrt_abortq)) {
+		goto out;
+	}
+
+another:
+	mutex_exit(&smrt->smrt_mutex);
+	if ((abort_smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_ABORTQ,
+	    KM_NOSLEEP)) == NULL) {
+		/*
+		 * No resources available to send abort messages.  We will
+		 * try again the next time around.
+		 */
+		mutex_enter(&smrt->smrt_mutex);
+		goto out;
+	}
+	mutex_enter(&smrt->smrt_mutex);
+
+	while ((smcm = list_remove_head(&smrt->smrt_abortq)) != NULL) {
+		if (!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT)) {
+			/*
+			 * This message is not currently inflight, so
+			 * no abort is needed.
+			 */
+			continue;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABORT_SENT) {
+			/*
+			 * An abort message has already been sent for
+			 * this command.
+			 */
+			continue;
+		}
+
+		/*
+		 * Send an abort message for the command.
+		 */
+		smrt_write_message_abort_one(abort_smcm, smcm->smcm_tag);
+		if (smrt_submit(smrt, abort_smcm) != 0) {
+			/*
+			 * The command could not be submitted to the
+			 * controller.  Put it back in the abort queue
+			 * and give up for now.
+			 */
+			list_insert_head(&smrt->smrt_abortq, smcm);
+			goto out;
+		}
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABORT_SENT;
+
+		/*
+		 * Record some debugging information about the abort we
+		 * sent:
+		 */
+		smcm->smcm_abort_time = gethrtime();
+		smcm->smcm_abort_tag = abort_smcm->smcm_tag;
+
+		/*
+		 * The abort message was sent.  Release it and
+		 * allocate another command.
+		 */
+		abort_smcm = NULL;
+		goto another;
+	}
+
+out:
+	cv_broadcast(&smrt->smrt_cv_finishq);
+	if (abort_smcm != NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(abort_smcm);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+}
+
+int
+smrt_poll_for(smrt_t *smrt, smrt_command_t *smcm)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+	VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_POLLED);
+
+	while (!(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE)) {
+		if (smcm->smcm_expiry != 0) {
+			/*
+			 * This command has an expiry time.  Check to see
+			 * if it has already passed:
+			 */
+			if (smcm->smcm_expiry < gethrtime()) {
+				return (ETIMEDOUT);
+			}
+		}
+
+		if (ddi_in_panic()) {
+			/*
+			 * When the system is panicking, there are no
+			 * interrupts or other threads.  Drive the polling loop
+			 * on our own, but with a small delay to avoid
+			 * aggrevating the controller while we're trying to
+			 * dump.
+			 */
+			(void) smrt_retrieve(smrt);
+			smrt_process_finishq(smrt);
+			drv_usecwait(100);
+			continue;
+		}
+
+		/*
+		 * Wait for command completion to return through the regular
+		 * interrupt handling path.
+		 */
+		if (smcm->smcm_expiry == 0) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		} else {
+			/*
+			 * Wait only until the expiry time for this command.
+			 */
+			(void) cv_timedwait_sig_hrtime(&smrt->smrt_cv_finishq,
+			    &smrt->smrt_mutex, smcm->smcm_expiry);
+		}
+	}
+
+	/*
+	 * Fire the completion callback for this command.  The callback
+	 * is responsible for freeing the command, so it may not be
+	 * referenced again once this call returns.
+	 */
+	smrt_process_finishq_one(smcm);
+
+	return (0);
+}
+
+void
+smrt_intr_set(smrt_t *smrt, boolean_t enabled)
+{
+	/*
+	 * Read the Interrupt Mask Register.
+	 */
+	uint32_t imr = smrt_get32(smrt, CISS_I2O_INTERRUPT_MASK);
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		if (enabled) {
+			imr &= ~CISS_IMR_BIT_SIMPLE_INTR_DISABLE;
+		} else {
+			imr |= CISS_IMR_BIT_SIMPLE_INTR_DISABLE;
+		}
+		smrt_put32(smrt, CISS_I2O_INTERRUPT_MASK, imr);
+		return;
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		break;
+	}
+	panic("unknown controller mode");
+}
+
+/*
+ * Signal to the controller that we have updated the Configuration Table by
+ * writing to the Inbound Doorbell Register.  The controller will, after some
+ * number of seconds, acknowledge this by clearing the bit.
+ *
+ * If successful, return DDI_SUCCESS.  If the controller takes too long to
+ * acknowledge, return DDI_FAILURE.
+ */
+int
+smrt_cfgtbl_flush(smrt_t *smrt)
+{
+	/*
+	 * Read the current value of the Inbound Doorbell Register.
+	 */
+	uint32_t idr = smrt_get32(smrt, CISS_I2O_INBOUND_DOORBELL);
+
+	/*
+	 * Signal the Configuration Table change to the controller.
+	 */
+	idr |= CISS_IDR_BIT_CFGTBL_CHANGE;
+	smrt_put32(smrt, CISS_I2O_INBOUND_DOORBELL, idr);
+
+	/*
+	 * Wait for the controller to acknowledge the change.
+	 */
+	for (unsigned i = 0; i < smrt_ciss_init_time; i++) {
+		idr = smrt_get32(smrt, CISS_I2O_INBOUND_DOORBELL);
+
+		if ((idr & CISS_IDR_BIT_CFGTBL_CHANGE) == 0) {
+			return (DDI_SUCCESS);
+		}
+
+		/*
+		 * Wait for one second before trying again.
+		 */
+		delay(drv_usectohz(1000000));
+	}
+
+	dev_err(smrt->smrt_dip, CE_WARN, "time out expired before controller "
+	    "configuration completed");
+	return (DDI_FAILURE);
+}
+
+int
+smrt_cfgtbl_transport_has_support(smrt_t *smrt, int xport)
+{
+	VERIFY(xport == CISS_CFGTBL_XPORT_SIMPLE);
+
+	/*
+	 * Read the current value of the "Supported Transport Methods" field in
+	 * the Configuration Table.
+	 */
+	uint32_t xport_active = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->TransportSupport);
+
+	/*
+	 * Check that the desired transport method is supported by the
+	 * controller:
+	 */
+	if ((xport_active & xport) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller does not support "
+		    "method \"%s\"", xport == CISS_CFGTBL_XPORT_SIMPLE ?
+		    "simple" : "performant");
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_cfgtbl_transport_set(smrt_t *smrt, int xport)
+{
+	VERIFY(xport == CISS_CFGTBL_XPORT_SIMPLE);
+
+	ddi_put32(smrt->smrt_ct_handle, &smrt->smrt_ct->TransportRequest,
+	    xport);
+}
+
+int
+smrt_cfgtbl_transport_confirm(smrt_t *smrt, int xport)
+{
+	VERIFY(xport == CISS_CFGTBL_XPORT_SIMPLE);
+
+	/*
+	 * Read the current value of the TransportActive field in the
+	 * Configuration Table.
+	 */
+	uint32_t xport_active = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->TransportActive);
+
+	/*
+	 * Check that the desired transport method is now active:
+	 */
+	if ((xport_active & xport) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "failed to enable transport "
+		    "method \"%s\"", xport == CISS_CFGTBL_XPORT_SIMPLE ?
+		    "simple" : "performant");
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Ensure that the controller is now ready to accept commands.
+	 */
+	if ((xport_active & CISS_CFGTBL_READY_FOR_COMMANDS) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller not ready to "
+		    "accept commands");
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+uint32_t
+smrt_ctlr_get_maxsgelements(smrt_t *smrt)
+{
+	return (ddi_get32(smrt->smrt_ct_handle, &smrt->smrt_ct->MaxSGElements));
+}
+
+uint32_t
+smrt_ctlr_get_cmdsoutmax(smrt_t *smrt)
+{
+	return (ddi_get32(smrt->smrt_ct_handle, &smrt->smrt_ct->CmdsOutMax));
+}
+
+static uint32_t
+smrt_ctlr_get_hostdrvsup(smrt_t *smrt)
+{
+	return (ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->HostDrvrSupport));
+}
+
+int
+smrt_ctlr_init(smrt_t *smrt)
+{
+	uint8_t signature[4] = { 'C', 'I', 'S', 'S' };
+	int e;
+
+	if ((e = smrt_ctlr_wait_for_state(smrt,
+	    SMRT_WAIT_STATE_READY)) != DDI_SUCCESS) {
+		return (e);
+	}
+
+	/*
+	 * The configuration table contains an ASCII signature ("CISS") which
+	 * should be checked as we initialise the controller.
+	 * See: "9.1 Configuration Table" in CISS Specification.
+	 */
+	for (unsigned i = 0; i < 4; i++) {
+		if (ddi_get8(smrt->smrt_ct_handle,
+		    &smrt->smrt_ct->Signature[i]) != signature[i]) {
+			dev_err(smrt->smrt_dip, CE_WARN, "invalid signature "
+			    "detected");
+			return (DDI_FAILURE);
+		}
+	}
+
+	/*
+	 * Initialise an appropriate Transport Method.  For now, this driver
+	 * only supports the "Simple" method.
+	 */
+	if ((e = smrt_ctlr_init_simple(smrt)) != DDI_SUCCESS) {
+		return (e);
+	}
+
+	/*
+	 * Save some common feature support bitfields.
+	 */
+	smrt->smrt_host_support = smrt_ctlr_get_hostdrvsup(smrt);
+	smrt->smrt_bus_support = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->BusTypes);
+
+	/*
+	 * Read initial controller heartbeat value and mark the current
+	 * reading time.
+	 */
+	smrt->smrt_last_heartbeat = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->HeartBeat);
+	smrt->smrt_last_heartbeat_time = gethrtime();
+
+	/*
+	 * Determine the firmware version of the controller so that we can
+	 * select which type of interrupts to use.
+	 */
+	if ((e = smrt_ctlr_versions(smrt, SMRT_DISCOVER_TIMEOUT,
+	    &smrt->smrt_versions)) != 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "could not identify "
+		    "controller (%d)", e);
+		return (DDI_FAILURE);
+	}
+
+	dev_err(smrt->smrt_dip, CE_NOTE, "!firmware rev %s",
+	    smrt->smrt_versions.smrtv_firmware_rev);
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_ctlr_teardown(smrt_t *smrt)
+{
+	smrt->smrt_status &= ~SMRT_CTLR_STATUS_RUNNING;
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		smrt_ctlr_teardown_simple(smrt);
+		return;
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		return;
+	}
+
+	panic("unknown controller mode");
+}
+
+int
+smrt_ctlr_wait_for_state(smrt_t *smrt, smrt_wait_state_t state)
+{
+	unsigned wait_usec = 100 * 1000;
+	unsigned wait_count = SMRT_WAIT_DELAY_SECONDS * 1000000 / wait_usec;
+
+	VERIFY(state == SMRT_WAIT_STATE_READY ||
+	    state == SMRT_WAIT_STATE_UNREADY);
+
+	/*
+	 * Read from the Scratchpad Register until the expected ready signature
+	 * is detected.  This behaviour is not described in the CISS
+	 * specification.
+	 *
+	 * If the device is not in the desired state immediately, sleep for a
+	 * second and try again.  If the device has not become ready in 300
+	 * seconds, give up.
+	 */
+	for (unsigned i = 0; i < wait_count; i++) {
+		uint32_t spr = smrt_get32(smrt, CISS_I2O_SCRATCHPAD);
+
+		switch (state) {
+		case SMRT_WAIT_STATE_READY:
+			if (spr == CISS_SCRATCHPAD_INITIALISED) {
+				return (DDI_SUCCESS);
+			}
+			break;
+
+		case SMRT_WAIT_STATE_UNREADY:
+			if (spr != CISS_SCRATCHPAD_INITIALISED) {
+				return (DDI_SUCCESS);
+			}
+			break;
+		}
+
+		if (ddi_in_panic()) {
+			/*
+			 * There is no sleep for the panicking, so we
+			 * must spin wait:
+			 */
+			drv_usecwait(wait_usec);
+		} else {
+			/*
+			 * Wait for a quarter second and try again.
+			 */
+			delay(drv_usectohz(wait_usec));
+		}
+	}
+
+	dev_err(smrt->smrt_dip, CE_WARN, "time out waiting for controller "
+	    "to enter state \"%s\"", state == SMRT_WAIT_STATE_READY ?
+	    "ready": "unready");
+	return (DDI_FAILURE);
+}
+
+void
+smrt_lockup_check(smrt_t *smrt)
+{
+	/*
+	 * Read the current controller heartbeat value.
+	 */
+	uint32_t heartbeat = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->HeartBeat);
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	/*
+	 * Check to see if the value is the same as last time we looked:
+	 */
+	if (heartbeat != smrt->smrt_last_heartbeat) {
+		/*
+		 * The heartbeat value has changed, which suggests that the
+		 * firmware in the controller has not yet come to a complete
+		 * stop.  Record the new value, as well as the current time.
+		 */
+		smrt->smrt_last_heartbeat = heartbeat;
+		smrt->smrt_last_heartbeat_time = gethrtime();
+		return;
+	}
+
+	/*
+	 * The controller _might_ have been able to signal to us that is
+	 * has locked up.  This is a truly unfathomable state of affairs:
+	 * If the firmware can tell it has flown off the rails, why not
+	 * simply reset the controller?
+	 */
+	uint32_t odr = smrt_get32(smrt, CISS_I2O_OUTBOUND_DOORBELL_STATUS);
+	uint32_t spr = smrt_get32(smrt, CISS_I2O_SCRATCHPAD);
+	if ((odr & CISS_ODR_BIT_LOCKUP) != 0) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "HP SmartArray firmware has "
+		    "reported a critical fault (odr %08x spr %08x)",
+		    odr, spr);
+	}
+
+	if (gethrtime() > smrt->smrt_last_heartbeat_time + 60 * NANOSEC) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "HP SmartArray firmware has "
+		    "stopped responding (odr %08x spr %08x)",
+		    odr, spr);
+	}
+}
+
+/*
+ * Probe the controller with the IDENTIFY CONTROLLER request.  This is a BMIC
+ * command, so it must be submitted to the controller and we must poll for its
+ * completion.  This functionality is only presently used during controller
+ * initialisation, so it uses the special pre-initialisation path for command
+ * allocation and submission.
+ */
+static int
+smrt_ctlr_identify(smrt_t *smrt, uint16_t timeout,
+    smrt_identify_controller_t *resp)
+{
+	smrt_command_t *smcm;
+	smrt_identify_controller_req_t smicr;
+	int r;
+	size_t sz;
+
+	/*
+	 * Allocate a command with a data buffer; the controller will fill it
+	 * with identification information.  There is some suggestion in the
+	 * firmware-level specification that the buffer length should be a
+	 * multiple of 512 bytes for some controllers, so we round up.
+	 */
+	sz = P2ROUNDUP_TYPED(sizeof (*resp), 512, size_t);
+	if ((smcm = smrt_command_alloc_preinit(smrt, sz, KM_SLEEP)) == NULL) {
+		return (ENOMEM);
+	}
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (smicr);
+	smcm->smcm_va_cmd->Request.Timeout = timeout;
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * Construct the IDENTIFY CONTROLLER request CDB.  Note that any
+	 * reserved fields in the request must be filled with zeroes.
+	 */
+	bzero(&smicr, sizeof (smicr));
+	smicr.smicr_opcode = CISS_SCMD_BMIC_READ;
+	smicr.smicr_lun = 0;
+	smicr.smicr_command = CISS_BMIC_IDENTIFY_CONTROLLER;
+	bcopy(&smicr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (smicr)));
+
+	/*
+	 * Send the command to the device and poll for its completion.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((r = smrt_preinit_command_simple(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * This command timed out, but the driver is not presently
+		 * initialised to the point where we can try to abort it.
+		 * The command was created with the PREINIT type, so it
+		 * does not appear in the global command tracking list.
+		 * In order to avoid problems with DMA from the controller,
+		 * we have to leak the command allocation.
+		 */
+		smcm = NULL;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to identify
+		 * it.  Report failure.
+		 */
+		r = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "identify "
+			    "controller error: status 0x%x",
+			    ei->CommandStatus);
+			r = EIO;
+			goto out;
+		}
+	}
+
+	if (resp != NULL) {
+		/*
+		 * Copy the identify response out for the caller.
+		 */
+		bcopy(smcm->smcm_internal->smcmi_va, resp, sizeof (*resp));
+	}
+
+	r = 0;
+
+out:
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+	return (r);
+}
+
+/*
+ * The firmware versions in an IDENTIFY CONTROLLER response generally take
+ * the form of a four byte ASCII string containing a dotted decimal version
+ * number; e.g., "8.00".
+ *
+ * This function sanitises the firmware version, replacing unexpected
+ * values with a question mark.
+ */
+static void
+smrt_copy_firmware_version(uint8_t *src, char *dst)
+{
+	for (unsigned i = 0; i < 4; i++) {
+		/*
+		 * Make sure that this is a 7-bit clean ASCII value.
+		 */
+		char c = src[i] <= 0x7f ? (char)(src[i] & 0x7f) : '?';
+
+		if (isalnum(c) || c == '.' || c == ' ') {
+			dst[i] = c;
+		} else {
+			dst[i] = '?';
+		}
+	}
+	dst[4] = '\0';
+}
+
+/*
+ * Using an IDENTIFY CONTROLLER request, determine firmware and controller
+ * version details.  See the comments for "smrt_ctlr_identify()" for more
+ * details about calling context.
+ */
+static int
+smrt_ctlr_versions(smrt_t *smrt, uint16_t timeout, smrt_versions_t *smrtv)
+{
+	smrt_identify_controller_t smic;
+	int r;
+
+	if ((r = smrt_ctlr_identify(smrt, timeout, &smic)) != 0) {
+		return (r);
+	}
+
+	smrtv->smrtv_hardware_version = smic.smic_hardware_version;
+	smrt_copy_firmware_version(smic.smic_firmware_rev,
+	    smrtv->smrtv_firmware_rev);
+	smrt_copy_firmware_version(smic.smic_recovery_rev,
+	    smrtv->smrtv_recovery_rev);
+	smrt_copy_firmware_version(smic.smic_bootblock_rev,
+	    smrtv->smrtv_bootblock_rev);
+
+	return (0);
+}
+
+int
+smrt_ctlr_reset(smrt_t *smrt)
+{
+	smrt_command_t *smcm, *smcm_nop;
+	int r;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (ddi_in_panic()) {
+		goto skip_check;
+	}
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+		/*
+		 * Don't pile on.  One reset is enough.  Wait until
+		 * it's complete, and then return success.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		}
+		return (0);
+	}
+	smrt->smrt_status |= SMRT_CTLR_STATUS_RESETTING;
+	smrt->smrt_last_reset_start = gethrtime();
+	smrt->smrt_stats.smrts_ctlr_resets++;
+
+skip_check:
+	/*
+	 * Allocate two commands: one for the soft reset message, which we
+	 * cannot free until the controller has reset; and one for the ping we
+	 * will use to determine when it is once again functional.
+	 */
+	mutex_exit(&smrt->smrt_mutex);
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		mutex_enter(&smrt->smrt_mutex);
+		return (ENOMEM);
+	}
+	if ((smcm_nop = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		smrt_command_free(smcm);
+		mutex_enter(&smrt->smrt_mutex);
+		return (ENOMEM);
+	}
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send a soft reset command to the controller.  If this command
+	 * succeeds, there will likely be no completion notification.  Instead,
+	 * the device should become unavailable for some period of time and
+	 * then become available again.  Once available again, we know the soft
+	 * reset has completed and should abort all in-flight commands.
+	 */
+	smrt_write_message_reset_ctlr(smcm);
+
+	/*
+	 * Disable interrupts now.
+	 */
+	smrt_intr_set(smrt, B_FALSE);
+
+	dev_err(smrt->smrt_dip, CE_WARN, "attempting controller soft reset");
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "submit failed (%d)", r);
+	}
+
+	/*
+	 * Mark every currently inflight command as being reset, including the
+	 * soft reset command we just sent.  Once we confirm the reset works,
+	 * we can safely report that these commands have failed.
+	 */
+	for (smrt_command_t *t = avl_first(&smrt->smrt_inflight);
+	    t != NULL; t = AVL_NEXT(&smrt->smrt_inflight, t)) {
+		t->smcm_status |= SMRT_CMD_STATUS_RESET_SENT;
+	}
+
+	/*
+	 * Now that we have submitted our soft reset command, prevent
+	 * the rest of the driver from interacting with the controller.
+	 */
+	smrt->smrt_status &= ~SMRT_CTLR_STATUS_RUNNING;
+
+	/*
+	 * We do not expect a completion from the controller for our soft
+	 * reset command, but we also cannot remove it from the inflight
+	 * list until we know the controller has actually reset.  To do
+	 * otherwise would potentially allow the controller to scribble
+	 * on the memory we were using.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+
+	if (smrt_ctlr_wait_for_state(smrt, SMRT_WAIT_STATE_UNREADY) !=
+	    DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "controller did not become unready");
+	}
+	dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: controller unready");
+
+	if (smrt_ctlr_wait_for_state(smrt, SMRT_WAIT_STATE_READY) !=
+	    DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "controller did not come become ready");
+	}
+	dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: controller ready");
+
+	/*
+	 * In at least the Smart Array P420i, the controller can take 30-45
+	 * seconds after the scratchpad register shows it as being available
+	 * before it is ready to receive commands.  In order to avoid hitting
+	 * it too early with our post-reset ping, we will sleep for 10 seconds
+	 * here.
+	 */
+	if (ddi_in_panic()) {
+		drv_usecwait(10 * MICROSEC);
+	} else {
+		delay(drv_usectohz(10 * MICROSEC));
+	}
+
+	smrt_ctlr_teardown(smrt);
+	if (smrt_ctlr_init(smrt) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "controller transport could not be configured");
+	}
+	dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: controller configured");
+
+	smrt_write_message_nop(smcm_nop, 0);
+	smcm_nop->smcm_status |= SMRT_CMD_STATUS_POLLED |
+	    SMRT_CMD_IGNORE_RUNNING;
+	if ((r = smrt_submit(smrt, smcm_nop)) != 0) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "ping could not be submitted (%d)", r);
+	}
+
+	/*
+	 * Interrupts are still masked at this stage.  Poll manually in
+	 * a way that will not trigger regular finish queue processing:
+	 */
+	VERIFY(smcm_nop->smcm_status & SMRT_CMD_STATUS_INFLIGHT);
+	for (unsigned i = 0; i < 600; i++) {
+		smrt_retrieve_simple(smrt);
+
+		if (!(smcm_nop->smcm_status & SMRT_CMD_STATUS_INFLIGHT)) {
+			/*
+			 * Remove the ping command from the finish queue and
+			 * process it manually.  This processing must mirror
+			 * what would have been done in smrt_process_finishq().
+			 */
+			VERIFY(list_link_active(&smcm_nop->smcm_link_finish));
+			list_remove(&smrt->smrt_finishq, smcm_nop);
+			smrt_process_finishq_sync(smcm_nop);
+			smcm_nop->smcm_status |= SMRT_CMD_STATUS_POLL_COMPLETE;
+			smrt_process_finishq_one(smcm_nop);
+			break;
+		}
+
+		if (ddi_in_panic()) {
+			drv_usecwait(100 * 1000);
+		} else {
+			delay(drv_usectohz(100 * 1000));
+		}
+	}
+
+	if (!(smcm_nop->smcm_status & SMRT_CMD_STATUS_COMPLETE)) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "ping did not complete");
+	} else if (smcm_nop->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		dev_err(smrt->smrt_dip, CE_WARN, "soft reset: ping completed "
+		    "in error (status %u)",
+		    (unsigned)smcm_nop->smcm_va_err->CommandStatus);
+	} else {
+		dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: ping completed");
+	}
+
+	/*
+	 * Now that the controller is working again, we can abort any
+	 * commands that were inflight during the reset.
+	 */
+	smrt_command_t *nt;
+	for (smrt_command_t *t = avl_first(&smrt->smrt_inflight);
+	    t != NULL; t = nt) {
+		nt = AVL_NEXT(&smrt->smrt_inflight, t);
+
+		if (t->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+			avl_remove(&smrt->smrt_inflight, t);
+			t->smcm_status &= ~SMRT_CMD_STATUS_INFLIGHT;
+
+			list_insert_tail(&smrt->smrt_finishq, t);
+		}
+	}
+
+	/*
+	 * Quiesce our discovery thread.  Note, because
+	 * SMRT_CTLR_STATUS_RESTARTING is set, nothing can cause it to be
+	 * enabled again.
+	 */
+	if (!ddi_in_panic()) {
+		mutex_exit(&smrt->smrt_mutex);
+		ddi_taskq_wait(smrt->smrt_discover_taskq);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+
+	/*
+	 * Re-enable interrupts.  Now, we must kick off a discovery to make sure
+	 * that the system is in a sane state and that we can perform I/O.
+	 */
+	smrt_intr_set(smrt, B_TRUE);
+	smrt->smrt_status &= ~SMRT_CTLR_STATUS_RESETTING;
+	smrt->smrt_status |= SMRT_CTLR_DISCOVERY_REQUIRED;
+
+	/*
+	 * Attempt a discovery to make sure that the drivers sees a realistic
+	 * view of the world.  If we're not in panic context, spin for the
+	 * asynchronous process to complete, otherwise we're in panic context
+	 * and this is going to happen regardless if we want it to or not.
+	 * Before we kick off the request to run discovery, we reset the
+	 * discovery request flags as we know that nothing else can consider
+	 * running discovery and we don't want to delay until the next smrt
+	 * periodic tick if we can avoid it.  In panic context, if this failed,
+	 * then we won't make it back.
+	 */
+	VERIFY0(smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING);
+	smrt->smrt_status &= ~(SMRT_CTLR_DISCOVERY_MASK);
+	smrt_discover(smrt);
+	if (!ddi_in_panic()) {
+		while (smrt->smrt_status & SMRT_CTLR_DISCOVERY_REQUIRED) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		}
+	}
+
+	smrt->smrt_status |= SMRT_CTLR_STATUS_RUNNING;
+	smrt->smrt_last_reset_finish = gethrtime();
+
+	/*
+	 * Wake anybody that was waiting for the reset to complete.
+	 */
+	cv_broadcast(&smrt->smrt_cv_finishq);
+
+	/*
+	 * Process the completion queue one last time before we let go
+	 * of the mutex.
+	 */
+	smrt_process_finishq(smrt);
+
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_free(smcm_nop);
+	mutex_enter(&smrt->smrt_mutex);
+	return (0);
+}
+
+int
+smrt_event_init(smrt_t *smrt)
+{
+	int ret;
+	smrt_command_t *event, *cancel;
+
+	event = smrt_command_alloc(smrt, SMRT_CMDTYPE_EVENT, KM_NOSLEEP);
+	if (event == NULL)
+		return (ENOMEM);
+	if (smrt_command_attach_internal(smrt, event, SMRT_EVENT_NOTIFY_BUFLEN,
+	    KM_NOSLEEP) != 0) {
+		smrt_command_free(event);
+		return (ENOMEM);
+	}
+	smrt_write_message_event_notify(event);
+
+	cancel = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL, KM_NOSLEEP);
+	if (cancel == NULL) {
+		smrt_command_free(event);
+		return (ENOMEM);
+	}
+	if (smrt_command_attach_internal(smrt, cancel, SMRT_EVENT_NOTIFY_BUFLEN,
+	    KM_NOSLEEP) != 0) {
+		smrt_command_free(event);
+		smrt_command_free(cancel);
+		return (ENOMEM);
+	}
+	smrt_write_message_cancel_event_notify(cancel);
+
+	cv_init(&smrt->smrt_event_queue, NULL, CV_DRIVER, NULL);
+
+	mutex_enter(&smrt->smrt_mutex);
+	if ((ret = smrt_submit(smrt, event)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(event);
+		smrt_command_free(cancel);
+		return (ret);
+	}
+
+	smrt->smrt_event_cmd = event;
+	smrt->smrt_event_cancel_cmd = cancel;
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (0);
+}
+
+void
+smrt_event_complete(smrt_command_t *smcm)
+{
+	smrt_event_notify_t *sen;
+	boolean_t log, rescan;
+
+	boolean_t intervene = B_FALSE;
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+	VERIFY3P(smcm, ==, smrt->smrt_event_cmd);
+	VERIFY0(smrt->smrt_status & SMRT_CTLR_ASYNC_INTERVENTION);
+
+	smrt->smrt_stats.smrts_events_received++;
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		cv_signal(&smrt->smrt_event_queue);
+		return;
+	}
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+		intervene = B_TRUE;
+		goto clean;
+	}
+
+	/*
+	 * The event notification command failed for some reason.  Attempt to
+	 * drive on and try again at the next intervention period.  Because this
+	 * may represent a programmer error (though it's hard to know), we wait
+	 * until the next intervention period and don't panic.
+	 */
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+		intervene = B_TRUE;
+
+		smrt->smrt_stats.smrts_events_errors++;
+		dev_err(smrt->smrt_dip, CE_WARN, "!event notification request "
+		    "error: status 0x%x", ei->CommandStatus);
+		goto clean;
+	}
+
+	sen = smcm->smcm_internal->smcmi_va;
+	log = rescan = B_FALSE;
+	switch (sen->sen_class) {
+	case SMRT_EVENT_CLASS_PROTOCOL:
+		/*
+		 * Most of the event protocol class events aren't really
+		 * actionable.  However, subclass 1 indicates errors.  Today,
+		 * the only error is an event overflow.  If there's an event
+		 * overflow, then we must assume that we need to rescan.
+		 */
+		if (sen->sen_subclass == SMRT_EVENT_PROTOCOL_SUBCLASS_ERROR) {
+			rescan = B_TRUE;
+		}
+		break;
+	case SMRT_EVENT_CLASS_HOTPLUG:
+		/*
+		 * We want to log all hotplug events.  However we only need to
+		 * scan these if the subclass indicates the event is for a disk.
+		 */
+		log = B_TRUE;
+		if (sen->sen_subclass == SMRT_EVENT_HOTPLUG_SUBCLASS_DRIVE) {
+			rescan = B_TRUE;
+		}
+		break;
+	case SMRT_EVENT_CLASS_HWERROR:
+	case SMRT_EVENT_CLASS_ENVIRONMENT:
+		log = B_TRUE;
+		break;
+	case SMRT_EVENT_CLASS_PHYS:
+		log = B_TRUE;
+		/*
+		 * This subclass indicates some change for physical drives.  As
+		 * such, this should trigger a rescan.
+		 */
+		if (sen->sen_subclass == SMRT_EVENT_PHYS_SUBCLASS_STATE) {
+			rescan = B_TRUE;
+		}
+		break;
+	case SMRT_EVENT_CLASS_LOGVOL:
+		rescan = B_TRUE;
+		log = B_TRUE;
+		break;
+	default:
+		/*
+		 * While there are other classes of events, it's hard to say how
+		 * actionable they are for the moment.  If we revamp this such
+		 * that it becomes an ireport based system, then we should just
+		 * always log these.  We opt not to at the moment to try and be
+		 * kind to the system log.
+		 */
+		break;
+	}
+
+	/*
+	 * Ideally, this would be an ireport that we could pass onto
+	 * administrators; however, since we don't have any way to generate
+	 * that, we provide a subset of the event information.
+	 */
+	if (log) {
+		const char *rmsg;
+		if (rescan == B_TRUE) {
+			rmsg = "rescanning";
+		} else {
+			rmsg = "not rescanning";
+		}
+		if (sen->sen_message[0] != '\0') {
+			sen->sen_message[sizeof (sen->sen_message) - 1] = '\0';
+			dev_err(smrt->smrt_dip, CE_NOTE, "!controller event "
+			    "class/sub-class/detail %x, %x, %x: %s; %s devices",
+			    sen->sen_class, sen->sen_subclass, sen->sen_detail,
+			    sen->sen_message, rmsg);
+		} else {
+			dev_err(smrt->smrt_dip, CE_NOTE, "!controller event "
+			    "class/sub-class/detail %x, %x, %x; %s devices",
+			    sen->sen_class, sen->sen_subclass, sen->sen_detail,
+			    rmsg);
+		}
+	}
+
+	if (rescan)
+		smrt_discover_request(smrt);
+
+clean:
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_reuse(smcm);
+	bzero(smcm->smcm_internal->smcmi_va, SMRT_EVENT_NOTIFY_BUFLEN);
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Make sure we're not _now_ detaching or resetting.
+	 */
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		cv_signal(&smrt->smrt_event_queue);
+		return;
+	}
+
+	if ((smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) != 0 ||
+	    intervene == B_TRUE) {
+		smrt->smrt_status |= SMRT_CTLR_ASYNC_INTERVENTION;
+		return;
+	}
+
+	/*
+	 * Check out command count per tick.  If it's too high, leave it for
+	 * intervention to solve.  Likely there is some serious driver or
+	 * firmware error going on.
+	 */
+	smrt->smrt_event_count++;
+	if (smrt->smrt_event_count > smrt_event_intervention_threshold) {
+		smrt->smrt_status |= SMRT_CTLR_ASYNC_INTERVENTION;
+		return;
+	}
+
+	if (smrt_submit(smrt, smcm) != 0) {
+		smrt->smrt_status |= SMRT_CTLR_ASYNC_INTERVENTION;
+	}
+}
+
+void
+smrt_event_fini(smrt_t *smrt)
+{
+	int ret;
+	smrt_command_t *event, *cancel;
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * If intervention has been requested, there is nothing for us to do. We
+	 * clear the flag so nothing else accidentally sees this and takes
+	 * action.  We also don't need to bother sending a cancellation request,
+	 * as there is no outstanding event.
+	 */
+	if (smrt->smrt_status & SMRT_CTLR_ASYNC_INTERVENTION) {
+		smrt->smrt_status &= ~SMRT_CTLR_ASYNC_INTERVENTION;
+		goto free;
+	}
+
+	/*
+	 * Submit a cancel request for the event notification queue.  Because we
+	 * submit both the cancel event and the regular notification event as an
+	 * ordered command, we know that by the time this completes, that the
+	 * existing one will have completed.
+	 */
+	smrt->smrt_event_cancel_cmd->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((ret = smrt_submit(smrt, smrt->smrt_event_cancel_cmd)) != 0) {
+		/*
+		 * This is unfortunate.  We've failed to submit the command.  At
+		 * this point all we can do is reset the device.  If the reset
+		 * succeeds, we're done and we can clear all the memory.  If it
+		 * fails, then all we can do is just leak the command and scream
+		 * to the system, sorry.
+		 */
+		if (smrt_ctlr_reset(smrt) != 0) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to reset "
+			    "device after failure to submit cancellation "
+			    "(%d), abandoning smrt_command_t at address %p",
+			    ret, smrt->smrt_event_cmd);
+			smrt->smrt_event_cmd = NULL;
+			goto free;
+		}
+	}
+
+	smrt->smrt_event_cancel_cmd->smcm_expiry = gethrtime() +
+	    SMRT_ASYNC_CANCEL_TIMEOUT * NANOSEC;
+	if ((ret = smrt_poll_for(smrt, smrt->smrt_event_cancel_cmd)) != 0) {
+		VERIFY3S(ret, ==, ETIMEDOUT);
+		VERIFY0(smrt->smrt_event_cancel_cmd->smcm_status &
+		    SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out.  All we can do is hope a reset will
+		 * work.
+		 */
+		if (smrt_ctlr_reset(smrt) != 0) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to reset "
+			    "device after failure to poll for async "
+			    "cancellation command abandoning smrt_command_t "
+			    "event command at address %p and cancellation "
+			    "command at %p", smrt->smrt_event_cmd,
+			    smrt->smrt_event_cancel_cmd);
+			smrt->smrt_event_cmd = NULL;
+			smrt->smrt_event_cancel_cmd = NULL;
+			goto free;
+		}
+
+	}
+
+	/*
+	 * Well, in the end, it's results that count.
+	 */
+	if (smrt->smrt_event_cancel_cmd->smcm_status &
+	    SMRT_CMD_STATUS_RESET_SENT) {
+		goto free;
+	}
+
+	if (smrt->smrt_event_cancel_cmd->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smrt->smrt_event_cancel_cmd->smcm_va_err;
+
+		/*
+		 * This can return a CISS_CMD_TARGET_STATUS entry when the
+		 * controller doesn't think a command is outstanding.  It is
+		 * possible we raced, so don't think too much about that case.
+		 * Anything else leaves us between a rock and a hard place, the
+		 * only way out is a reset.
+		 */
+		if (ei->CommandStatus != CISS_CMD_TARGET_STATUS &&
+		    smrt_ctlr_reset(smrt) != 0) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to reset  "
+			    "device after receiving an error on the async "
+			    "cancellation command (%d); abandoning "
+			    "smrt_command_t event command at address %p and "
+			    "cancellation command at %p", ei->CommandStatus,
+			    smrt->smrt_event_cmd, smrt->smrt_event_cancel_cmd);
+			smrt->smrt_event_cmd = NULL;
+			smrt->smrt_event_cancel_cmd = NULL;
+			goto free;
+		}
+	}
+
+free:
+	event = smrt->smrt_event_cmd;
+	smrt->smrt_event_cmd = NULL;
+	cancel = smrt->smrt_event_cancel_cmd;
+	smrt->smrt_event_cancel_cmd = NULL;
+	mutex_exit(&smrt->smrt_mutex);
+	if (event != NULL)
+		smrt_command_free(event);
+	if (cancel != NULL)
+		smrt_command_free(cancel);
+	cv_destroy(&smrt->smrt_event_queue);
+}
+
+/*
+ * We've been asked to do a discovery in panic context.  This would have
+ * occurred because there was a device reset.  Because we can't rely on the
+ * target maps, all we can do at the moment is go over all the active targets
+ * and note which ones no longer exist.  If this target was required to dump,
+ * then the dump code will encounter a fatal error.  If not, then we should
+ * count ourselves surprisingly lucky.
+ */
+static void
+smrt_discover_panic_check(smrt_t *smrt)
+{
+	smrt_target_t *smtg;
+
+	ASSERT(MUTEX_HELD(&smrt->smrt_mutex));
+	for (smtg = list_head(&smrt->smrt_targets); smtg != NULL;
+	    smtg = list_next(&smrt->smrt_targets, smtg)) {
+		uint64_t gen;
+
+		if (smtg->smtg_physical) {
+			smrt_physical_t *smpt = smtg->smtg_lun.smtg_phys;
+			/*
+			 * Don't worry about drives that aren't visible.
+			 */
+			if (!smpt->smpt_visible)
+				continue;
+			gen = smpt->smpt_gen;
+		} else {
+			smrt_volume_t *smlv = smtg->smtg_lun.smtg_vol;
+			gen = smlv->smlv_gen;
+		}
+
+		if (gen != smrt->smrt_discover_gen) {
+			dev_err(smrt->smrt_dip, CE_WARN, "target %s "
+			    "disappeared during post-panic discovery",
+			    scsi_device_unit_address(smtg->smtg_scsi_dev));
+			smtg->smtg_gone = B_TRUE;
+		}
+	}
+}
+
+static void
+smrt_discover(void *arg)
+{
+	int log = 0, phys = 0;
+	smrt_t *smrt = arg;
+	uint64_t gen;
+	boolean_t runphys, runvirt;
+
+	mutex_enter(&smrt->smrt_mutex);
+	smrt->smrt_status |= SMRT_CTLR_DISCOVERY_RUNNING;
+	smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_REQUESTED;
+
+	smrt->smrt_discover_gen++;
+	gen = smrt->smrt_discover_gen;
+	runphys = smrt->smrt_phys_tgtmap != NULL;
+	runvirt = smrt->smrt_virt_tgtmap != NULL;
+	mutex_exit(&smrt->smrt_mutex);
+	if (runphys)
+		phys = smrt_phys_discover(smrt, SMRT_DISCOVER_TIMEOUT, gen);
+	if (runvirt)
+		log = smrt_logvol_discover(smrt, SMRT_DISCOVER_TIMEOUT, gen);
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (phys != 0 || log != 0) {
+		if (!ddi_in_panic()) {
+			smrt->smrt_status |= SMRT_CTLR_DISCOVERY_PERIODIC;
+		} else {
+			panic("smrt_t %p failed to perform discovery after "
+			    "a reset in panic context, unable to continue. "
+			    "logvol: %d, phys: %d", smrt, log, phys);
+		}
+	} else {
+		if (!ddi_in_panic() &&
+		    smrt->smrt_status & SMRT_CTLR_DISCOVERY_REQUIRED) {
+			smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_REQUIRED;
+			cv_broadcast(&smrt->smrt_cv_finishq);
+		}
+
+		if (ddi_in_panic()) {
+			smrt_discover_panic_check(smrt);
+		}
+	}
+	smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_RUNNING;
+	if (smrt->smrt_status & SMRT_CTLR_DISCOVERY_REQUESTED)
+		smrt->smrt_status |= SMRT_CTLR_DISCOVERY_PERIODIC;
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+/*
+ * Request discovery, which is always run via a taskq.
+ */
+void
+smrt_discover_request(smrt_t *smrt)
+{
+	boolean_t run;
+	ASSERT(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (ddi_in_panic()) {
+		smrt_discover(smrt);
+		return;
+	}
+
+	run = (smrt->smrt_status & SMRT_CTLR_DISCOVERY_MASK) == 0;
+	smrt->smrt_status |= SMRT_CTLR_DISCOVERY_REQUESTED;
+	if (run && ddi_taskq_dispatch(smrt->smrt_discover_taskq,
+	    smrt_discover, smrt, DDI_NOSLEEP) != DDI_SUCCESS) {
+		smrt->smrt_status |= SMRT_CTLR_DISCOVERY_PERIODIC;
+		smrt->smrt_stats.smrts_discovery_tq_errors++;
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss_simple.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss_simple.c
new file mode 100644
index 0000000000..1b3d7b2602
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss_simple.c
@@ -0,0 +1,282 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+uint_t
+smrt_isr_hw_simple(caddr_t arg1, caddr_t arg2)
+{
+	_NOTE(ARGUNUSED(arg2))
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	smrt_t *smrt = (smrt_t *)arg1;
+	uint32_t isr = smrt_get32(smrt, CISS_I2O_INTERRUPT_STATUS);
+	hrtime_t now = gethrtime();
+
+	mutex_enter(&smrt->smrt_mutex);
+	if (!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING)) {
+		smrt->smrt_stats.smrts_unclaimed_interrupts++;
+		smrt->smrt_last_interrupt_unclaimed = now;
+
+		/*
+		 * We should not be receiving interrupts from the controller
+		 * while the driver is not running.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	/*
+	 * Check to see if this interrupt came from the device:
+	 */
+	if ((isr & CISS_ISR_BIT_SIMPLE_INTR) == 0) {
+		smrt->smrt_stats.smrts_unclaimed_interrupts++;
+		smrt->smrt_last_interrupt_unclaimed = now;
+
+		/*
+		 * Check to see if the firmware has come to rest.  If it has,
+		 * this routine will panic the system.
+		 */
+		smrt_lockup_check(smrt);
+
+		mutex_exit(&smrt->smrt_mutex);
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	smrt->smrt_stats.smrts_claimed_interrupts++;
+	smrt->smrt_last_interrupt_claimed = now;
+
+	/*
+	 * The interrupt was from our controller, so collect any pending
+	 * command completions.
+	 */
+	smrt_retrieve_simple(smrt);
+
+	/*
+	 * Process any commands in the completion queue.
+	 */
+	smrt_process_finishq(smrt);
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (DDI_INTR_CLAIMED);
+}
+
+/*
+ * Read tags and process completion of the associated command until the supply
+ * of tags is exhausted.
+ */
+void
+smrt_retrieve_simple(smrt_t *smrt)
+{
+	uint32_t opq;
+	uint32_t none = 0xffffffff;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	while ((opq = smrt_get32(smrt, CISS_I2O_OUTBOUND_POST_Q)) != none) {
+		uint32_t tag = CISS_OPQ_READ_TAG(opq);
+		smrt_command_t *smcm;
+
+		if ((smcm = smrt_lookup_inflight(smrt, tag)) == NULL) {
+			dev_err(smrt->smrt_dip, CE_WARN, "spurious tag %x",
+			    tag);
+			continue;
+		}
+
+		avl_remove(&smrt->smrt_inflight, smcm);
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_INFLIGHT;
+		if (CISS_OPQ_READ_ERROR(opq) != 0) {
+			smcm->smcm_status |= SMRT_CMD_STATUS_ERROR;
+		}
+		smcm->smcm_time_complete = gethrtime();
+
+		/*
+		 * Push this command onto the completion queue.
+		 */
+		list_insert_tail(&smrt->smrt_finishq, smcm);
+	}
+}
+
+/*
+ * Submit a command to the controller by posting it to the Inbound Post Queue
+ * Register.
+ */
+void
+smrt_submit_simple(smrt_t *smrt, smrt_command_t *smcm)
+{
+	smrt_put32(smrt, CISS_I2O_INBOUND_POST_Q, smcm->smcm_pa_cmd);
+}
+
+/*
+ * Submit a command to the controller by posting it to the Inbound Post Queue
+ * Register.  Immediately begin polling on the completion of that command.
+ *
+ * NOTE: This function is for controller initialisation only.  It discards
+ * completions of commands other than the expected command as spurious, and
+ * will not interact correctly with the rest of the driver once it is running.
+ */
+int
+smrt_preinit_command_simple(smrt_t *smrt, smrt_command_t *smcm)
+{
+	/*
+	 * The controller must be initialised to use the Simple Transport
+	 * Method, but not be marked RUNNING.  The command to process must be a
+	 * PREINIT command with the expected tag number, marked for polling.
+	 */
+	VERIFY(smrt->smrt_ctlr_mode == SMRT_CTLR_MODE_SIMPLE);
+	VERIFY(!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING));
+	VERIFY(smcm->smcm_type == SMRT_CMDTYPE_PREINIT);
+	VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_POLLED);
+	VERIFY3U(smcm->smcm_tag, ==, SMRT_PRE_TAG_NUMBER);
+
+	/*
+	 * Submit this command to the controller.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_INFLIGHT;
+	smrt_put32(smrt, CISS_I2O_INBOUND_POST_Q, smcm->smcm_pa_cmd);
+
+	/*
+	 * Poll the controller for completions until we see the command we just
+	 * sent, or the timeout expires.
+	 */
+	for (;;) {
+		uint32_t none = 0xffffffff;
+		uint32_t opq = smrt_get32(smrt, CISS_I2O_OUTBOUND_POST_Q);
+		uint32_t tag;
+
+		if (smcm->smcm_expiry != 0) {
+			/*
+			 * This command has an expiry time.  Check to see
+			 * if it has already passed:
+			 */
+			if (smcm->smcm_expiry < gethrtime()) {
+				return (ETIMEDOUT);
+			}
+		}
+
+		if (opq == none) {
+			delay(drv_usectohz(10 * 1000));
+			continue;
+		}
+
+		if ((tag = CISS_OPQ_READ_TAG(opq)) != SMRT_PRE_TAG_NUMBER) {
+			dev_err(smrt->smrt_dip, CE_WARN, "unexpected tag 0x%x"
+			    " completed during driver init", tag);
+			delay(drv_usectohz(10 * 1000));
+			continue;
+		}
+
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_INFLIGHT;
+		if (CISS_OPQ_READ_ERROR(opq) != 0) {
+			smcm->smcm_status |= SMRT_CMD_STATUS_ERROR;
+		}
+		smcm->smcm_time_complete = gethrtime();
+		smcm->smcm_status |= SMRT_CMD_STATUS_POLL_COMPLETE;
+
+		return (0);
+	}
+}
+
+int
+smrt_ctlr_init_simple(smrt_t *smrt)
+{
+	VERIFY(smrt->smrt_ctlr_mode == SMRT_CTLR_MODE_UNKNOWN);
+
+	if (smrt_cfgtbl_transport_has_support(smrt,
+	    CISS_CFGTBL_XPORT_SIMPLE) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+	smrt->smrt_ctlr_mode = SMRT_CTLR_MODE_SIMPLE;
+
+	/*
+	 * Disable device interrupts while we are setting up.
+	 */
+	smrt_intr_set(smrt, B_FALSE);
+
+	if ((smrt->smrt_maxcmds = smrt_ctlr_get_cmdsoutmax(smrt)) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "maximum outstanding "
+		    "commands set to zero");
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Determine the number of Scatter/Gather List entries this controller
+	 * supports.  The maximum number we allow is CISS_MAXSGENTRIES: the
+	 * number of elements in the static struct we use for command
+	 * submission.
+	 */
+	if ((smrt->smrt_sg_cnt = smrt_ctlr_get_maxsgelements(smrt)) == 0) {
+		/*
+		 * The CISS specification states that if this value is
+		 * zero, we should assume a value of 31 for compatibility
+		 * with older firmware.
+		 */
+		smrt->smrt_sg_cnt = CISS_SGCNT_FALLBACK;
+
+	} else if (smrt->smrt_sg_cnt > CISS_MAXSGENTRIES) {
+		/*
+		 * If the controller supports more than we have allocated,
+		 * just cap the count at the allocation size.
+		 */
+		smrt->smrt_sg_cnt = CISS_MAXSGENTRIES;
+	}
+
+	/*
+	 * Zero the upper 32 bits of the address in the Controller.
+	 */
+	ddi_put32(smrt->smrt_ct_handle, &smrt->smrt_ct->Upper32Addr, 0);
+
+	/*
+	 * Set the Transport Method and flush the changes to the
+	 * Configuration Table.
+	 */
+	smrt_cfgtbl_transport_set(smrt, CISS_CFGTBL_XPORT_SIMPLE);
+	if (smrt_cfgtbl_flush(smrt) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	if (smrt_cfgtbl_transport_confirm(smrt,
+	    CISS_CFGTBL_XPORT_SIMPLE) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Check the outstanding command cap a second time now that we have
+	 * flushed out the new Transport Method.  This is entirely defensive;
+	 * we do not expect this value to change.
+	 */
+	uint32_t check_again = smrt_ctlr_get_cmdsoutmax(smrt);
+	if (check_again != smrt->smrt_maxcmds) {
+		dev_err(smrt->smrt_dip, CE_WARN, "maximum outstanding commands "
+		    "changed during initialisation (was %u, now %u)",
+		    smrt->smrt_maxcmds, check_again);
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_ctlr_teardown_simple(smrt_t *smrt)
+{
+	VERIFY(smrt->smrt_ctlr_mode == SMRT_CTLR_MODE_SIMPLE);
+
+	/*
+	 * Due to the nominal simplicity of the simple mode, we have no
+	 * particular teardown to perform as we do not allocate anything
+	 * on the way up.
+	 */
+	smrt->smrt_ctlr_mode = SMRT_CTLR_MODE_UNKNOWN;
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_commands.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_commands.c
new file mode 100644
index 0000000000..edcbfa65e2
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_commands.c
@@ -0,0 +1,362 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+
+static ddi_dma_attr_t smrt_command_dma_attr = {
+	.dma_attr_version =		DMA_ATTR_V0,
+	.dma_attr_addr_lo =		0x00000000,
+	.dma_attr_addr_hi =		0xFFFFFFFF,
+	.dma_attr_count_max =		0x00FFFFFF,
+	.dma_attr_align =		0x20,
+	.dma_attr_burstsizes =		0x20,
+	.dma_attr_minxfer =		DMA_UNIT_8,
+	.dma_attr_maxxfer =		0xFFFFFFFF,
+	.dma_attr_seg =			0x0000FFFF,
+	.dma_attr_sgllen =		1,
+	.dma_attr_granular =		512,
+	.dma_attr_flags =		0
+};
+
+/*
+ * These device access attributes are for command block allocation, where we do
+ * not use any of the structured byte swapping facilities.
+ */
+static ddi_device_acc_attr_t smrt_command_dev_attr = {
+	.devacc_attr_version =		DDI_DEVICE_ATTR_V0,
+	.devacc_attr_endian_flags =	DDI_NEVERSWAP_ACC,
+	.devacc_attr_dataorder =	DDI_STRICTORDER_ACC,
+	.devacc_attr_access =		0
+};
+
+
+static void smrt_contig_free(smrt_dma_t *);
+
+
+static int
+smrt_check_command_type(smrt_command_type_t type)
+{
+	/*
+	 * Note that we leave out the default case in order to utilise
+	 * compiler warnings about missed enum values.
+	 */
+	switch (type) {
+	case SMRT_CMDTYPE_ABORTQ:
+	case SMRT_CMDTYPE_SCSA:
+	case SMRT_CMDTYPE_INTERNAL:
+	case SMRT_CMDTYPE_PREINIT:
+	case SMRT_CMDTYPE_EVENT:
+		return (type);
+	}
+
+	panic("unexpected command type");
+	/* LINTED: E_FUNC_NO_RET_VAL */
+}
+
+static int
+smrt_contig_alloc(smrt_t *smrt, smrt_dma_t *smdma, size_t sz, int kmflags,
+    void **vap, uint32_t *pap)
+{
+	caddr_t va;
+	int rv;
+	dev_info_t *dip = smrt->smrt_dip;
+	int (*dma_wait)(caddr_t) = (kmflags == KM_SLEEP) ? DDI_DMA_SLEEP :
+	    DDI_DMA_DONTWAIT;
+
+	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
+
+	/*
+	 * Ensure we don't try to allocate a second time using the same
+	 * tracking object.
+	 */
+	VERIFY0(smdma->smdma_level);
+
+	if ((rv = ddi_dma_alloc_handle(dip, &smrt_command_dma_attr,
+	    dma_wait, NULL, &smdma->smdma_dma_handle)) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "DMA handle allocation failed (%x)",
+		    rv);
+		goto fail;
+	}
+	smdma->smdma_level |= SMRT_DMALEVEL_HANDLE_ALLOC;
+
+	if ((rv = ddi_dma_mem_alloc(smdma->smdma_dma_handle, sz,
+	    &smrt_command_dev_attr, DDI_DMA_CONSISTENT, dma_wait, NULL,
+	    &va, &smdma->smdma_real_size, &smdma->smdma_acc_handle)) !=
+	    DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "DMA memory allocation failed (%x)", rv);
+		goto fail;
+	}
+	smdma->smdma_level |= SMRT_DMALEVEL_MEMORY_ALLOC;
+
+	if ((rv = ddi_dma_addr_bind_handle(smdma->smdma_dma_handle,
+	    NULL, va, smdma->smdma_real_size,
+	    DDI_DMA_CONSISTENT | DDI_DMA_RDWR, dma_wait, NULL,
+	    smdma->smdma_dma_cookies, &smdma->smdma_dma_ncookies)) !=
+	    DDI_DMA_MAPPED) {
+		dev_err(dip, CE_WARN, "DMA handle bind failed (%x)", rv);
+		goto fail;
+	}
+	smdma->smdma_level |= SMRT_DMALEVEL_HANDLE_BOUND;
+
+	VERIFY3U(smdma->smdma_dma_ncookies, ==, 1);
+	*pap = smdma->smdma_dma_cookies[0].dmac_address;
+	*vap = (void *)va;
+	return (DDI_SUCCESS);
+
+fail:
+	*vap = NULL;
+	*pap = 0;
+	smrt_contig_free(smdma);
+	return (DDI_FAILURE);
+}
+
+static void
+smrt_contig_free(smrt_dma_t *smdma)
+{
+	if (smdma->smdma_level & SMRT_DMALEVEL_HANDLE_BOUND) {
+		VERIFY3U(ddi_dma_unbind_handle(smdma->smdma_dma_handle), ==,
+		    DDI_SUCCESS);
+
+		smdma->smdma_level &= ~SMRT_DMALEVEL_HANDLE_BOUND;
+	}
+
+	if (smdma->smdma_level & SMRT_DMALEVEL_MEMORY_ALLOC) {
+		ddi_dma_mem_free(&smdma->smdma_acc_handle);
+
+		smdma->smdma_level &= ~SMRT_DMALEVEL_MEMORY_ALLOC;
+	}
+
+	if (smdma->smdma_level & SMRT_DMALEVEL_HANDLE_ALLOC) {
+		ddi_dma_free_handle(&smdma->smdma_dma_handle);
+
+		smdma->smdma_level &= ~SMRT_DMALEVEL_HANDLE_ALLOC;
+	}
+
+	VERIFY(smdma->smdma_level == 0);
+	bzero(smdma, sizeof (*smdma));
+}
+
+static smrt_command_t *
+smrt_command_alloc_impl(smrt_t *smrt, smrt_command_type_t type, int kmflags)
+{
+	smrt_command_t *smcm;
+
+	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
+
+	if ((smcm = kmem_zalloc(sizeof (*smcm), kmflags)) == NULL) {
+		return (NULL);
+	}
+
+	smcm->smcm_ctlr = smrt;
+	smcm->smcm_type = smrt_check_command_type(type);
+
+	/*
+	 * Allocate a single contiguous chunk of memory for the command block
+	 * (smcm_va_cmd) and the error information block (smcm_va_err).  The
+	 * physical address of each block should be 32-byte aligned.
+	 */
+	size_t contig_size = 0;
+	contig_size += P2ROUNDUP_TYPED(sizeof (CommandList_t), 32, size_t);
+
+	size_t errorinfo_offset = contig_size;
+	contig_size += P2ROUNDUP_TYPED(sizeof (ErrorInfo_t), 32, size_t);
+
+	if (smrt_contig_alloc(smrt, &smcm->smcm_contig, contig_size,
+	    kmflags, (void **)&smcm->smcm_va_cmd, &smcm->smcm_pa_cmd) !=
+	    DDI_SUCCESS) {
+		kmem_free(smcm, sizeof (*smcm));
+		return (NULL);
+	}
+
+	smcm->smcm_va_err = (void *)((caddr_t)smcm->smcm_va_cmd +
+	    errorinfo_offset);
+	smcm->smcm_pa_err = smcm->smcm_pa_cmd + errorinfo_offset;
+
+	/*
+	 * Ensure we asked for, and received, the correct physical alignment:
+	 */
+	VERIFY0(smcm->smcm_pa_cmd & 0x1f);
+	VERIFY0(smcm->smcm_pa_err & 0x1f);
+
+	/*
+	 * Populate Fields.
+	 */
+	bzero(smcm->smcm_va_cmd, contig_size);
+	smcm->smcm_va_cmd->ErrDesc.Addr = smcm->smcm_pa_err;
+	smcm->smcm_va_cmd->ErrDesc.Len = sizeof (ErrorInfo_t);
+
+	return (smcm);
+}
+
+smrt_command_t *
+smrt_command_alloc_preinit(smrt_t *smrt, size_t datasize, int kmflags)
+{
+	smrt_command_t *smcm;
+
+	if ((smcm = smrt_command_alloc_impl(smrt, SMRT_CMDTYPE_PREINIT,
+	    kmflags)) == NULL) {
+		return (NULL);
+	}
+
+	/*
+	 * Note that most driver infrastructure has not been initialised at
+	 * this time.  All commands are submitted to the controller serially,
+	 * using a pre-specified tag, and are not attached to the command
+	 * tracking list.
+	 */
+	smcm->smcm_tag = SMRT_PRE_TAG_NUMBER;
+	smcm->smcm_va_cmd->Header.Tag.tag_value = SMRT_PRE_TAG_NUMBER;
+
+	if (smrt_command_attach_internal(smrt, smcm, datasize, kmflags) != 0) {
+		smrt_command_free(smcm);
+		return (NULL);
+	}
+
+	return (smcm);
+}
+
+smrt_command_t *
+smrt_command_alloc(smrt_t *smrt, smrt_command_type_t type, int kmflags)
+{
+	smrt_command_t *smcm;
+
+	VERIFY(type != SMRT_CMDTYPE_PREINIT);
+
+	if ((smcm = smrt_command_alloc_impl(smrt, type, kmflags)) == NULL) {
+		return (NULL);
+	}
+
+	/*
+	 * Insert into the per-controller command list.
+	 */
+	mutex_enter(&smrt->smrt_mutex);
+	list_insert_tail(&smrt->smrt_commands, smcm);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (smcm);
+}
+
+int
+smrt_command_attach_internal(smrt_t *smrt, smrt_command_t *smcm, size_t len,
+    int kmflags)
+{
+	smrt_command_internal_t *smcmi;
+
+	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
+	VERIFY3U(len, <=, UINT32_MAX);
+
+	if ((smcmi = kmem_zalloc(sizeof (*smcmi), kmflags)) == NULL) {
+		return (ENOMEM);
+	}
+
+	if (smrt_contig_alloc(smrt, &smcmi->smcmi_contig, len, kmflags,
+	    &smcmi->smcmi_va, &smcmi->smcmi_pa) != DDI_SUCCESS) {
+		kmem_free(smcmi, sizeof (*smcmi));
+		return (ENOMEM);
+	}
+
+	bzero(smcmi->smcmi_va, smcmi->smcmi_len);
+
+	smcm->smcm_internal = smcmi;
+
+	smcm->smcm_va_cmd->SG[0].Addr = smcmi->smcmi_pa;
+	smcm->smcm_va_cmd->SG[0].Len = (uint32_t)len;
+	smcm->smcm_va_cmd->Header.SGList = 1;
+	smcm->smcm_va_cmd->Header.SGTotal = 1;
+
+	return (0);
+}
+
+void
+smrt_command_reuse(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Make sure the command is not currently inflight, then
+	 * reset the command status.
+	 */
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT));
+	smcm->smcm_status = SMRT_CMD_STATUS_REUSED;
+
+	/*
+	 * Ensure we are not trying to reuse a command that is in the finish or
+	 * abort queue.
+	 */
+	VERIFY(!list_link_active(&smcm->smcm_link_abort));
+	VERIFY(!list_link_active(&smcm->smcm_link_finish));
+
+	/*
+	 * Clear the previous tag value.
+	 */
+	smcm->smcm_tag = 0;
+	smcm->smcm_va_cmd->Header.Tag.tag_value = 0;
+
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+void
+smrt_command_free(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	/*
+	 * Ensure the object we are about to free is not currently in the
+	 * inflight AVL.
+	 */
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT));
+
+	if (smcm->smcm_internal != NULL) {
+		smrt_command_internal_t *smcmi = smcm->smcm_internal;
+
+		smrt_contig_free(&smcmi->smcmi_contig);
+		kmem_free(smcmi, sizeof (*smcmi));
+	}
+
+	smrt_contig_free(&smcm->smcm_contig);
+
+	if (smcm->smcm_type != SMRT_CMDTYPE_PREINIT) {
+		mutex_enter(&smrt->smrt_mutex);
+
+		/*
+		 * Ensure we are not trying to free a command that is in the
+		 * finish or abort queue.
+		 */
+		VERIFY(!list_link_active(&smcm->smcm_link_abort));
+		VERIFY(!list_link_active(&smcm->smcm_link_finish));
+
+		list_remove(&smrt->smrt_commands, smcm);
+
+		mutex_exit(&smrt->smrt_mutex);
+	}
+
+	kmem_free(smcm, sizeof (*smcm));
+}
+
+smrt_command_t *
+smrt_lookup_inflight(smrt_t *smrt, uint32_t tag)
+{
+	smrt_command_t srch;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	bzero(&srch, sizeof (srch));
+	srch.smcm_tag = tag;
+
+	return (avl_find(&smrt->smrt_inflight, &srch, NULL));
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_device.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_device.c
new file mode 100644
index 0000000000..9e27448b68
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_device.c
@@ -0,0 +1,238 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * We must locate what the CISS specification describes as the "I2O
+ * registers".  The Intelligent I/O (I2O) Architecture Specification describes
+ * this somewhat more coherently as "the memory region specified by the first
+ * base address configuration register indicating memory space (offset 10h,
+ * 14h, and so forth)".
+ */
+static int
+smrt_locate_bar(pci_regspec_t *regs, unsigned nregs,
+    unsigned *i2o_bar)
+{
+	/*
+	 * Locate the first memory-mapped BAR:
+	 */
+	for (unsigned i = 0; i < nregs; i++) {
+		unsigned type = regs[i].pci_phys_hi & PCI_ADDR_MASK;
+
+		if (type == PCI_ADDR_MEM32 || type == PCI_ADDR_MEM64) {
+			*i2o_bar = i;
+			return (DDI_SUCCESS);
+		}
+	}
+
+	return (DDI_FAILURE);
+}
+
+static int
+smrt_locate_cfgtbl(smrt_t *smrt, pci_regspec_t *regs, unsigned nregs,
+    unsigned *ct_bar, uint32_t *baseaddr)
+{
+	uint32_t cfg_offset, mem_offset;
+	unsigned want_type;
+	uint32_t want_bar;
+
+	cfg_offset = smrt_get32(smrt, CISS_I2O_CFGTBL_CFG_OFFSET);
+	mem_offset = smrt_get32(smrt, CISS_I2O_CFGTBL_MEM_OFFSET);
+
+	VERIFY3U(cfg_offset, !=, 0xffffffff);
+	VERIFY3U(mem_offset, !=, 0xffffffff);
+
+	/*
+	 * Locate the Configuration Table.  Three different values read
+	 * from two I2O registers allow us to determine the location:
+	 * 	- the correct PCI BAR offset is in the low 16 bits of
+	 *	  CISS_I2O_CFGTBL_CFG_OFFSET
+	 *	- bit 16 is 0 for a 32-bit space, and 1 for 64-bit
+	 *	- the memory offset from the base of this BAR is
+	 *	  in CISS_I2O_CFGTBL_MEM_OFFSET
+	 */
+	want_bar = (cfg_offset & 0xffff);
+	want_type = (cfg_offset & (1UL << 16)) ? PCI_ADDR_MEM64 :
+	    PCI_ADDR_MEM32;
+
+	DTRACE_PROBE4(locate_cfgtbl, uint32_t, want_bar, unsigned,
+	    want_type, uint32_t, cfg_offset, uint32_t, mem_offset);
+
+	for (unsigned i = 0; i < nregs; i++) {
+		unsigned type = regs[i].pci_phys_hi & PCI_ADDR_MASK;
+		unsigned bar = PCI_REG_REG_G(regs[i].pci_phys_hi);
+
+		if (type != PCI_ADDR_MEM32 && type != PCI_ADDR_MEM64) {
+			continue;
+		}
+
+		if (bar == want_bar) {
+			*ct_bar = i;
+			*baseaddr = mem_offset;
+			return (DDI_SUCCESS);
+		}
+	}
+
+	return (DDI_FAILURE);
+}
+
+/*
+ * Determine the PCI vendor and device ID which is a proxy for which generation
+ * of controller we're working with.
+ */
+static int
+smrt_identify_device(smrt_t *smrt)
+{
+	ddi_acc_handle_t pci_hdl;
+
+	if (pci_config_setup(smrt->smrt_dip, &pci_hdl) != DDI_SUCCESS)
+		return (DDI_FAILURE);
+
+	smrt->smrt_pci_vendor = pci_config_get16(pci_hdl, PCI_CONF_VENID);
+	smrt->smrt_pci_device = pci_config_get16(pci_hdl, PCI_CONF_DEVID);
+
+	pci_config_teardown(&pci_hdl);
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_map_device(smrt_t *smrt)
+{
+	pci_regspec_t *regs;
+	uint_t regslen, nregs;
+	dev_info_t *dip = smrt->smrt_dip;
+	int r = DDI_FAILURE;
+
+	/*
+	 * Get the list of PCI registers from the DDI property "regs":
+	 */
+	if (ddi_prop_lookup_int_array(DDI_DEV_T_ANY, dip, DDI_PROP_DONTPASS,
+	    "reg", (int **)&regs, &regslen) != DDI_PROP_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not load \"reg\" DDI prop");
+		return (DDI_FAILURE);
+	}
+	nregs = regslen * sizeof (int) / sizeof (pci_regspec_t);
+
+	if (smrt_locate_bar(regs, nregs, &smrt->smrt_i2o_bar) !=
+	    DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "did not find any memory BARs");
+		goto out;
+	}
+
+	/*
+	 * Map enough of the I2O memory space to enable us to talk to the
+	 * device.
+	 */
+	if (ddi_regs_map_setup(dip, smrt->smrt_i2o_bar, &smrt->smrt_i2o_space,
+	    CISS_I2O_MAP_BASE, CISS_I2O_MAP_LIMIT - CISS_I2O_MAP_BASE,
+	    &smrt_dev_attributes, &smrt->smrt_i2o_handle) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "failed to map I2O registers");
+		goto out;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_I2O_MAPPED;
+
+	if (smrt_locate_cfgtbl(smrt, regs, nregs, &smrt->smrt_ct_bar,
+	    &smrt->smrt_ct_baseaddr) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not find config table");
+		goto out;
+	}
+
+	/*
+	 * Map the Configuration Table.
+	 */
+	if (ddi_regs_map_setup(dip, smrt->smrt_ct_bar,
+	    (caddr_t *)&smrt->smrt_ct, smrt->smrt_ct_baseaddr,
+	    sizeof (CfgTable_t), &smrt_dev_attributes,
+	    &smrt->smrt_ct_handle) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not map config table");
+		goto out;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_CFGTBL_MAPPED;
+
+	r = DDI_SUCCESS;
+
+out:
+	ddi_prop_free(regs);
+	return (r);
+}
+
+int
+smrt_device_setup(smrt_t *smrt)
+{
+	/*
+	 * Ensure that the controller is installed in such a fashion that it
+	 * may become a DMA master.
+	 */
+	if (ddi_slaveonly(smrt->smrt_dip) == DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_WARN, "device cannot become DMA "
+		    "master");
+		return (DDI_FAILURE);
+	}
+
+	if (smrt_identify_device(smrt) != DDI_SUCCESS)
+		goto fail;
+
+	if (smrt_map_device(smrt) != DDI_SUCCESS) {
+		goto fail;
+	}
+
+	return (DDI_SUCCESS);
+
+fail:
+	smrt_device_teardown(smrt);
+	return (DDI_FAILURE);
+}
+
+void
+smrt_device_teardown(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_CFGTBL_MAPPED) {
+		ddi_regs_map_free(&smrt->smrt_ct_handle);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_CFGTBL_MAPPED;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_I2O_MAPPED) {
+		ddi_regs_map_free(&smrt->smrt_i2o_handle);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_I2O_MAPPED;
+	}
+}
+
+uint32_t
+smrt_get32(smrt_t *smrt, offset_t off)
+{
+	VERIFY3S(off, >=, CISS_I2O_MAP_BASE);
+	VERIFY3S(off, <, CISS_I2O_MAP_BASE + CISS_I2O_MAP_LIMIT);
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	uint32_t *addr = (uint32_t *)(smrt->smrt_i2o_space +
+	    (off - CISS_I2O_MAP_BASE));
+
+	return (ddi_get32(smrt->smrt_i2o_handle, addr));
+}
+
+void
+smrt_put32(smrt_t *smrt, offset_t off, uint32_t val)
+{
+	VERIFY3S(off, >=, CISS_I2O_MAP_BASE);
+	VERIFY3S(off, <, CISS_I2O_MAP_BASE + CISS_I2O_MAP_LIMIT);
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	uint32_t *addr = (uint32_t *)(smrt->smrt_i2o_space +
+	    (off - CISS_I2O_MAP_BASE));
+
+	ddi_put32(smrt->smrt_i2o_handle, addr, val);
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_hba.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_hba.c
new file mode 100644
index 0000000000..8f082ffc9c
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_hba.c
@@ -0,0 +1,1457 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * The controller is not allowed to attach.
+ */
+static int
+smrt_ctrl_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	return (DDI_FAILURE);
+}
+
+/*
+ * The controller is not allowed to send packets.
+ */
+static int
+smrt_ctrl_tran_start(struct scsi_address *sa, struct scsi_pkt *pkt)
+{
+	return (TRAN_BADPKT);
+}
+
+static boolean_t
+smrt_logvol_parse(const char *ua, uint_t *targp)
+{
+	long targ, lun;
+	const char *comma;
+	char *eptr;
+
+	comma = strchr(ua, ',');
+	if (comma == NULL) {
+		return (B_FALSE);
+	}
+
+	/*
+	 * We expect the target number for a logical unit number to be zero for
+	 * a logical volume.
+	 */
+	if (ddi_strtol(comma + 1, &eptr, 16, &lun) != 0 || *eptr != '\0' ||
+	    lun != 0) {
+		return (B_FALSE);
+	}
+
+	if (ddi_strtol(ua, &eptr, 16, &targ) != 0 || eptr != comma ||
+	    targ < 0 || targ >= SMRT_MAX_LOGDRV) {
+		return (B_FALSE);
+	}
+
+	*targp = (uint_t)targ;
+
+	return (B_TRUE);
+}
+
+static int
+smrt_logvol_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip))
+
+	smrt_volume_t *smlv;
+	smrt_target_t *smtg;
+	const char *ua;
+	uint_t targ;
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	dev_info_t *dip = smrt->smrt_dip;
+
+	/*
+	 * The unit address comes in the form of 'target,lun'.  We expect the
+	 * lun to be zero.  The target is what we set when we added it to the
+	 * target map earlier.
+	 */
+	ua = scsi_device_unit_address(sd);
+	if (ua == NULL) {
+		return (DDI_FAILURE);
+	}
+
+	if (!smrt_logvol_parse(ua, &targ)) {
+		return (DDI_FAILURE);
+	}
+
+	if ((smtg = kmem_zalloc(sizeof (*smtg), KM_NOSLEEP)) == NULL) {
+		dev_err(dip, CE_WARN, "could not allocate target object "
+		    "due to memory exhaustion");
+		return (DDI_FAILURE);
+	}
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		/*
+		 * We are detaching.  Do not accept any more requests to
+		 * attach targets from the framework.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Look for a logical volume for the SCSI unit address of this target.
+	 */
+	if ((smlv = smrt_logvol_lookup_by_id(smrt, targ)) == NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+	smtg->smtg_lun.smtg_vol = smlv;
+	smtg->smtg_addr = &smlv->smlv_addr;
+	smtg->smtg_physical = B_FALSE;
+	list_insert_tail(&smlv->smlv_targets, smtg);
+
+	/*
+	 * Link this target object to the controller:
+	 */
+	smtg->smtg_ctlr = smrt;
+	list_insert_tail(&smrt->smrt_targets, smtg);
+
+	smtg->smtg_scsi_dev = sd;
+	VERIFY(sd->sd_dev == tgt_dip);
+
+	scsi_device_hba_private_set(sd, smtg);
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (DDI_SUCCESS);
+}
+
+static void
+smrt_logvol_tran_tgt_free(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip, tgt_dip))
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	smrt_target_t *smtg = scsi_device_hba_private_get(sd);
+	smrt_volume_t *smlv = smtg->smtg_lun.smtg_vol;
+
+	VERIFY(smtg->smtg_scsi_dev == sd);
+	VERIFY(smtg->smtg_physical == B_FALSE);
+
+	mutex_enter(&smrt->smrt_mutex);
+	list_remove(&smlv->smlv_targets, smtg);
+	list_remove(&smrt->smrt_targets, smtg);
+
+	scsi_device_hba_private_set(sd, NULL);
+
+	mutex_exit(&smrt->smrt_mutex);
+
+	kmem_free(smtg, sizeof (*smtg));
+}
+
+static int
+smrt_phys_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip))
+
+	smrt_target_t *smtg;
+	smrt_physical_t *smpt;
+	const char *ua, *comma;
+	char *eptr;
+	long lun;
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	dev_info_t *dip = smrt->smrt_dip;
+
+	/*
+	 * The unit address comes in the form of 'target,lun'.  We expect the
+	 * lun to be zero.  The target is what we set when we added it to the
+	 * target map earlier.
+	 */
+	ua = scsi_device_unit_address(sd);
+	if (ua == NULL)
+		return (DDI_FAILURE);
+
+	comma = strchr(ua, ',');
+	if (comma == NULL) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Confirm the LUN is zero.  We may want to instead check the scsi
+	 * 'lun'/'lun64' property or do so in addition to this logic.
+	 */
+	if (ddi_strtol(comma + 1, &eptr, 16, &lun) != 0 || *eptr != '\0' ||
+	    lun != 0) {
+		return (DDI_FAILURE);
+	}
+
+	if ((smtg = kmem_zalloc(sizeof (*smtg), KM_NOSLEEP)) == NULL) {
+		dev_err(dip, CE_WARN, "could not allocate target object "
+		    "due to memory exhaustion");
+		return (DDI_FAILURE);
+	}
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		/*
+		 * We are detaching.  Do not accept any more requests to
+		 * attach targets from the framework.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+
+	/*
+	 * Look for a physical target based on the unit address of the target
+	 * (which will encode its WWN and LUN).
+	 */
+	smpt = smrt_phys_lookup_by_ua(smrt, ua);
+	if (smpt == NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+	smtg->smtg_scsi_dev = sd;
+	smtg->smtg_physical = B_TRUE;
+	smtg->smtg_lun.smtg_phys = smpt;
+	list_insert_tail(&smpt->smpt_targets, smtg);
+	smtg->smtg_addr = &smpt->smpt_addr;
+
+	/*
+	 * Link this target object to the controller:
+	 */
+	smtg->smtg_ctlr = smrt;
+	list_insert_tail(&smrt->smrt_targets, smtg);
+
+	VERIFY(sd->sd_dev == tgt_dip);
+	smtg->smtg_scsi_dev = sd;
+
+	scsi_device_hba_private_set(sd, smtg);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (DDI_SUCCESS);
+}
+
+static void
+smrt_phys_tran_tgt_free(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip, tgt_dip))
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	smrt_target_t *smtg = scsi_device_hba_private_get(sd);
+	smrt_physical_t *smpt = smtg->smtg_lun.smtg_phys;
+
+	VERIFY(smtg->smtg_scsi_dev == sd);
+	VERIFY(smtg->smtg_physical == B_TRUE);
+
+	mutex_enter(&smrt->smrt_mutex);
+	list_remove(&smpt->smpt_targets, smtg);
+	list_remove(&smrt->smrt_targets, smtg);
+
+	scsi_device_hba_private_set(sd, NULL);
+	mutex_exit(&smrt->smrt_mutex);
+	kmem_free(smtg, sizeof (*smtg));
+}
+
+/*
+ * This function is called when the SCSI framework has allocated a packet and
+ * our private per-packet object.
+ *
+ * We choose not to have the framework pre-allocate memory for the CDB.
+ * Instead, we will make available the CDB area in the controller command block
+ * itself.
+ *
+ * Status block memory is allocated by the framework because we passed
+ * SCSI_HBA_TRAN_SCB to scsi_hba_attach_setup(9F).
+ */
+static int
+smrt_tran_setup_pkt(struct scsi_pkt *pkt, int (*callback)(caddr_t),
+    caddr_t arg)
+{
+	_NOTE(ARGUNUSED(arg))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_t *smcm;
+	smrt_command_scsa_t *smcms;
+	int kmflags = callback == SLEEP_FUNC ? KM_SLEEP : KM_NOSLEEP;
+
+	sd = scsi_address_device(&pkt->pkt_address);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+	smcms = (smrt_command_scsa_t *)pkt->pkt_ha_private;
+
+	/*
+	 * Check that we have enough space in the command object for the
+	 * request from the target driver:
+	 */
+	if (pkt->pkt_cdblen > CISS_CDBLEN) {
+		/*
+		 * The CDB member of the Request Block of a controller
+		 * command is fixed at 16 bytes.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "oversize CDB: had %u, "
+		    "needed %u", CISS_CDBLEN, pkt->pkt_cdblen);
+		return (-1);
+	}
+
+	/*
+	 * Allocate our command block:
+	 */
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_SCSA,
+	    kmflags)) == NULL) {
+		return (-1);
+	}
+	smcm->smcm_scsa = smcms;
+	smcms->smcms_command = smcm;
+	smcms->smcms_pkt = pkt;
+
+	pkt->pkt_cdbp = &smcm->smcm_va_cmd->Request.CDB[0];
+	smcm->smcm_va_cmd->Request.CDBLen = pkt->pkt_cdblen;
+
+	smcm->smcm_target = smtg;
+
+	return (0);
+}
+
+static void
+smrt_tran_teardown_pkt(struct scsi_pkt *pkt)
+{
+	smrt_command_scsa_t *smcms = (smrt_command_scsa_t *)
+	    pkt->pkt_ha_private;
+	smrt_command_t *smcm = smcms->smcms_command;
+
+	smrt_command_free(smcm);
+
+	pkt->pkt_cdbp = NULL;
+}
+
+static void
+smrt_set_arq_data(struct scsi_pkt *pkt, uchar_t key)
+{
+	struct scsi_arq_status *sts;
+
+	VERIFY3U(pkt->pkt_scblen, >=, sizeof (struct scsi_arq_status));
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	sts = (struct scsi_arq_status *)(pkt->pkt_scbp);
+	bzero(sts, sizeof (*sts));
+
+	/*
+	 * Mock up a CHECK CONDITION SCSI status for the original command:
+	 */
+	sts->sts_status.sts_chk = 1;
+
+	/*
+	 * Pretend that we successfully performed REQUEST SENSE:
+	 */
+	sts->sts_rqpkt_reason = CMD_CMPLT;
+	sts->sts_rqpkt_resid = 0;
+	sts->sts_rqpkt_state = STATE_GOT_BUS | STATE_GOT_TARGET |
+	    STATE_SENT_CMD | STATE_XFERRED_DATA;
+	sts->sts_rqpkt_statistics = 0;
+
+	/*
+	 * Return the key value we were provided in the fake sense data:
+	 */
+	sts->sts_sensedata.es_valid = 1;
+	sts->sts_sensedata.es_class = CLASS_EXTENDED_SENSE;
+	sts->sts_sensedata.es_key = key;
+
+	pkt->pkt_state |= STATE_ARQ_DONE;
+}
+
+/*
+ * When faking up a REPORT LUNS data structure, we simply report one LUN, LUN 0.
+ * We need 16 bytes for this, 4 for the size, 4 reserved bytes, and the 8 for
+ * the actual LUN.
+ */
+static void
+smrt_fake_report_lun(smrt_command_t *smcm, struct scsi_pkt *pkt)
+{
+	size_t sz;
+	char resp[16];
+	struct buf *bp;
+
+	pkt->pkt_reason = CMD_CMPLT;
+	pkt->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET | STATE_SENT_CMD |
+	    STATE_GOT_STATUS;
+
+	/*
+	 * Check to make sure this is valid.  If reserved bits are set or if the
+	 * mode is one other than 0x00, 0x01, 0x02, then it's an illegal
+	 * request.
+	 */
+	if (pkt->pkt_cdbp[1] != 0 || pkt->pkt_cdbp[3] != 0 ||
+	    pkt->pkt_cdbp[4] != 0 || pkt->pkt_cdbp[5] != 0 ||
+	    pkt->pkt_cdbp[10] != 0 || pkt->pkt_cdbp[11] != 0 ||
+	    pkt->pkt_cdbp[2] > 0x2) {
+		smrt_set_arq_data(pkt, KEY_ILLEGAL_REQUEST);
+		return;
+	}
+
+	/*
+	 * Construct the actual REPORT LUNS reply.  We need to indicate a single
+	 * LUN of all zeros.  This means that the length needs to be 8 bytes,
+	 * the size of the lun.  Otherwise, the rest of this structure can be
+	 * zeros.
+	 */
+	bzero(resp, sizeof (resp));
+	resp[3] = sizeof (scsi_lun_t);
+
+	bp = scsi_pkt2bp(pkt);
+	sz = MIN(sizeof (resp), bp->b_bcount);
+
+	bp_mapin(bp);
+	bcopy(resp, bp->b_un.b_addr, sz);
+	bp_mapout(bp);
+	pkt->pkt_state |= STATE_XFERRED_DATA;
+	pkt->pkt_resid = bp->b_bcount - sz;
+	if (pkt->pkt_scblen >= 1) {
+		pkt->pkt_scbp[0] = STATUS_GOOD;
+	}
+}
+
+static int
+smrt_tran_start(struct scsi_address *sa, struct scsi_pkt *pkt)
+{
+	_NOTE(ARGUNUSED(sa))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_scsa_t *smcms;
+	smrt_command_t *smcm;
+	int r;
+
+	sd = scsi_address_device(&pkt->pkt_address);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+	smcms = (smrt_command_scsa_t *)pkt->pkt_ha_private;
+	VERIFY(smcms != NULL);
+	smcm = smcms->smcms_command;
+	VERIFY(smcm != NULL);
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_TRAN_START) {
+		/*
+		 * This is a retry of a command that has already been
+		 * used once.  Assign it a new tag number.
+		 */
+		smrt_command_reuse(smcm);
+	}
+	smcm->smcm_status |= SMRT_CMD_STATUS_TRAN_START;
+
+	/*
+	 * The sophisticated firmware in this controller cannot possibly bear
+	 * the following SCSI commands.  It appears to return a response with
+	 * the status STATUS_ACA_ACTIVE (0x30), which is not something we
+	 * expect.  Instead, fake up a failure response.
+	 */
+	switch (pkt->pkt_cdbp[0]) {
+	case SCMD_FORMAT:
+	case SCMD_LOG_SENSE_G1:
+	case SCMD_MODE_SELECT:
+	case SCMD_PERSISTENT_RESERVE_IN:
+		if (smtg->smtg_physical) {
+			break;
+		}
+
+		smrt->smrt_stats.smrts_ignored_scsi_cmds++;
+		smcm->smcm_status |= SMRT_CMD_STATUS_TRAN_IGNORED;
+
+		/*
+		 * Mark the command as completed to the point where we
+		 * received a SCSI status code:
+		 */
+		pkt->pkt_reason = CMD_CMPLT;
+		pkt->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET |
+		    STATE_SENT_CMD | STATE_GOT_STATUS;
+
+		/*
+		 * Mock up sense data for an illegal request:
+		 */
+		smrt_set_arq_data(pkt, KEY_ILLEGAL_REQUEST);
+
+		scsi_hba_pkt_comp(pkt);
+		return (TRAN_ACCEPT);
+	case SCMD_REPORT_LUNS:
+		/*
+		 * The SMRT controller does not accept a REPORT LUNS command for
+		 * logical volumes.  As such, we need to fake up a REPORT LUNS
+		 * response that has a single LUN, LUN 0.
+		 */
+		if (smtg->smtg_physical) {
+			break;
+		}
+
+		smrt_fake_report_lun(smcm, pkt);
+
+		scsi_hba_pkt_comp(pkt);
+		return (TRAN_ACCEPT);
+	default:
+		break;
+	}
+
+	if (pkt->pkt_flags & FLAG_NOINTR) {
+		/*
+		 * We must sleep and wait for the completion of this command.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	}
+
+	/*
+	 * Because we provide a tran_setup_pkt(9E) entrypoint, we must now
+	 * set up the Scatter/Gather List in the Command to reflect any
+	 * DMA resources passed to us by the framework.
+	 */
+	if (pkt->pkt_numcookies > smrt->smrt_sg_cnt) {
+		/*
+		 * More DMA cookies than we are prepared to handle.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "too many DMA cookies (got %u;"
+		    " expected %u)", pkt->pkt_numcookies, smrt->smrt_sg_cnt);
+		return (TRAN_BADPKT);
+	}
+	smcm->smcm_va_cmd->Header.SGList = pkt->pkt_numcookies;
+	smcm->smcm_va_cmd->Header.SGTotal = pkt->pkt_numcookies;
+	for (unsigned i = 0; i < pkt->pkt_numcookies; i++) {
+		smcm->smcm_va_cmd->SG[i].Addr =
+		    LE_64(pkt->pkt_cookies[i].dmac_laddress);
+		smcm->smcm_va_cmd->SG[i].Len =
+		    LE_32(pkt->pkt_cookies[i].dmac_size);
+	}
+
+	/*
+	 * Copy logical volume address from the target object:
+	 */
+	smcm->smcm_va_cmd->Header.LUN = *smcm->smcm_target->smtg_addr;
+
+	/*
+	 * Initialise the command block.
+	 */
+	smcm->smcm_va_cmd->Request.CDBLen = pkt->pkt_cdblen;
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(pkt->pkt_time);
+	if (pkt->pkt_numcookies > 0) {
+		/*
+		 * There are DMA resources; set the transfer direction
+		 * appropriately:
+		 */
+		if (pkt->pkt_dma_flags & DDI_DMA_READ) {
+			smcm->smcm_va_cmd->Request.Type.Direction =
+			    CISS_XFER_READ;
+		} else if (pkt->pkt_dma_flags & DDI_DMA_WRITE) {
+			smcm->smcm_va_cmd->Request.Type.Direction =
+			    CISS_XFER_WRITE;
+		} else {
+			smcm->smcm_va_cmd->Request.Type.Direction =
+			    CISS_XFER_NONE;
+		}
+	} else {
+		/*
+		 * No DMA resources means no transfer.
+		 */
+		smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_NONE;
+	}
+
+	/*
+	 * Initialise the SCSI packet as described in tran_start(9E).  We will
+	 * progressively update these fields as the command moves through the
+	 * submission and completion states.
+	 */
+	pkt->pkt_resid = 0;
+	pkt->pkt_reason = CMD_CMPLT;
+	pkt->pkt_statistics = 0;
+	pkt->pkt_state = 0;
+
+	/*
+	 * If this SCSI packet has a timeout, configure an appropriate
+	 * expiry time:
+	 */
+	if (pkt->pkt_time != 0) {
+		smcm->smcm_expiry = gethrtime() + pkt->pkt_time * NANOSEC;
+	}
+
+	/*
+	 * Submit the command to the controller.
+	 */
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * If we're dumping, there's a chance that the target we're talking to
+	 * could have ended up disappearing during the process of discovery.  If
+	 * this target is part of the dump device, we check here and return that
+	 * we hit a fatal error.
+	 */
+	if (ddi_in_panic() && smtg->smtg_gone) {
+		mutex_exit(&smrt->smrt_mutex);
+
+		dev_err(smrt->smrt_dip, CE_WARN, "smrt_submit failed: target "
+		    "%s is gone, it did not come back after post-panic reset "
+		    "device discovery", scsi_device_unit_address(sd));
+
+		return (TRAN_FATAL_ERROR);
+	}
+
+	smrt->smrt_stats.smrts_tran_starts++;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+
+		dev_err(smrt->smrt_dip, CE_WARN, "smrt_submit failed %d", r);
+
+		/*
+		 * Inform the SCSI framework that we could not submit
+		 * the command.
+		 */
+		return (r == EAGAIN ? TRAN_BUSY : TRAN_FATAL_ERROR);
+	}
+
+	/*
+	 * Update the SCSI packet to reflect submission of the command.
+	 */
+	pkt->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET | STATE_SENT_CMD;
+
+	if (pkt->pkt_flags & FLAG_NOINTR) {
+		/*
+		 * Poll the controller for completion of the command we
+		 * submitted.  Once this routine has returned, the completion
+		 * callback will have been fired with either an active response
+		 * (success or error) or a timeout.  The command is freed by
+		 * the completion callback, so it may not be referenced again
+		 * after this call returns.
+		 */
+		smrt_poll_for(smrt, smcm);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (TRAN_ACCEPT);
+}
+
+static int
+smrt_tran_reset(struct scsi_address *sa, int level)
+{
+	_NOTE(ARGUNUSED(level))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_t *smcm;
+	int r;
+
+	sd = scsi_address_device(sa);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+
+	/*
+	 * The framework has requested some kind of SCSI reset.  A
+	 * controller-level soft reset can take a very long time -- often on
+	 * the order of 30-60 seconds -- but might well be our only option if
+	 * the controller is non-responsive.
+	 *
+	 * First, check if the controller is responding to pings.
+	 */
+again:
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		return (0);
+	}
+
+	smrt_write_message_nop(smcm, SMRT_PING_CHECK_TIMEOUT);
+
+	mutex_enter(&smrt->smrt_mutex);
+	smrt->smrt_stats.smrts_tran_resets++;
+	if (ddi_in_panic()) {
+		goto skip_check;
+	}
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+		/*
+		 * The controller is already resetting.  Wait for that
+		 * to finish.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		}
+	}
+
+skip_check:
+	/*
+	 * Submit our ping to the controller.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	smcm->smcm_expiry = gethrtime() + SMRT_PING_CHECK_TIMEOUT * NANOSEC;
+	if (smrt_submit(smrt, smcm) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (0);
+	}
+
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The ping command timed out.  Abandon it now.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "controller ping timed out");
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+
+	} else if ((smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) ||
+	    (smcm->smcm_status & SMRT_CMD_STATUS_ERROR)) {
+		/*
+		 * The command completed in error, or a controller reset
+		 * was sent while we were trying to ping.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "controller ping error");
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		mutex_enter(&smrt->smrt_mutex);
+
+	} else {
+		VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_COMPLETE);
+
+		/*
+		 * The controller is responsive, and a full soft reset would be
+		 * extremely disruptive to the system.  Given our spotty
+		 * support for some SCSI commands (which can upset the target
+		 * drivers) and the historically lax behaviour of the "smrt"
+		 * driver, we grit our teeth and pretend we were able to
+		 * perform a reset.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (1);
+	}
+
+	/*
+	 * If a reset has been initiated in the last 90 seconds, try
+	 * another ping.
+	 */
+	if (gethrtime() < smrt->smrt_last_reset_start + 90 * NANOSEC) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller ping failed, but "
+		    "was recently reset; retrying ping");
+		mutex_exit(&smrt->smrt_mutex);
+
+		/*
+		 * Sleep for a second first.
+		 */
+		if (ddi_in_panic()) {
+			drv_usecwait(1 * MICROSEC);
+		} else {
+			delay(drv_usectohz(1 * MICROSEC));
+		}
+		goto again;
+	}
+
+	dev_err(smrt->smrt_dip, CE_WARN, "controller ping failed; resetting "
+	    "controller");
+	if (smrt_ctlr_reset(smrt) != 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller reset failure");
+		mutex_exit(&smrt->smrt_mutex);
+		return (0);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (1);
+}
+
+static int
+smrt_tran_abort(struct scsi_address *sa, struct scsi_pkt *pkt)
+{
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_t *smcm = NULL;
+	smrt_command_t *abort_smcm;
+
+	sd = scsi_address_device(sa);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+
+
+	if ((abort_smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		/*
+		 * No resources available to send an abort message.
+		 */
+		return (0);
+	}
+
+	mutex_enter(&smrt->smrt_mutex);
+	smrt->smrt_stats.smrts_tran_aborts++;
+	if (pkt != NULL) {
+		/*
+		 * The framework wants us to abort a specific SCSI packet.
+		 */
+		smrt_command_scsa_t *smcms = (smrt_command_scsa_t *)
+		    pkt->pkt_ha_private;
+		smcm = smcms->smcms_command;
+
+		if (!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT)) {
+			/*
+			 * This message is not currently in flight, so we
+			 * cannot abort it.
+			 */
+			goto fail;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABORT_SENT) {
+			/*
+			 * An abort message for this command has already been
+			 * sent to the controller.  Return failure.
+			 */
+			goto fail;
+		}
+
+		smrt_write_message_abort_one(abort_smcm, smcm->smcm_tag);
+	} else {
+		/*
+		 * The framework wants us to abort every in flight command
+		 * for the target with this address.
+		 */
+		smrt_write_message_abort_all(abort_smcm, smtg->smtg_addr);
+	}
+
+	/*
+	 * Submit the abort message to the controller.
+	 */
+	abort_smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if (smrt_submit(smrt, abort_smcm) != 0) {
+		goto fail;
+	}
+
+	if (pkt != NULL) {
+		/*
+		 * Record some debugging information about the abort we
+		 * sent:
+		 */
+		smcm->smcm_abort_time = gethrtime();
+		smcm->smcm_abort_tag = abort_smcm->smcm_tag;
+
+		/*
+		 * Mark the command as aborted so that we do not send
+		 * a second abort message:
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABORT_SENT;
+	}
+
+	/*
+	 * Poll for completion of the abort message.  Note that this function
+	 * only fails if we set a timeout on the command, which we have not
+	 * done.
+	 */
+	VERIFY0(smrt_poll_for(smrt, abort_smcm));
+
+	if ((abort_smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) ||
+	    (abort_smcm->smcm_status & SMRT_CMD_STATUS_ERROR)) {
+		/*
+		 * Either the controller was reset or the abort command
+		 * failed.
+		 */
+		goto fail;
+	}
+
+	/*
+	 * The command was successfully aborted.
+	 */
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_free(abort_smcm);
+	return (1);
+
+fail:
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_free(abort_smcm);
+	return (0);
+}
+
+static void
+smrt_hba_complete_status(smrt_command_t *smcm)
+{
+	ErrorInfo_t *ei = smcm->smcm_va_err;
+	struct scsi_pkt *pkt = smcm->smcm_scsa->smcms_pkt;
+
+	bzero(pkt->pkt_scbp, pkt->pkt_scblen);
+
+	if (ei->ScsiStatus != STATUS_CHECK) {
+		/*
+		 * If the SCSI status is not CHECK CONDITION, we don't want
+		 * to try and read the sense data buffer.
+		 */
+		goto simple_status;
+	}
+
+	if (pkt->pkt_scblen < sizeof (struct scsi_arq_status)) {
+		/*
+		 * There is not enough room for a request sense structure.
+		 * Fall back to reporting just the SCSI status code.
+		 */
+		goto simple_status;
+	}
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	struct scsi_arq_status *sts = (struct scsi_arq_status *)pkt->pkt_scbp;
+
+	/*
+	 * Copy in the SCSI status from the original command.
+	 */
+	bcopy(&ei->ScsiStatus, &sts->sts_status, sizeof (sts->sts_status));
+
+	/*
+	 * Mock up a successful REQUEST SENSE:
+	 */
+	sts->sts_rqpkt_reason = CMD_CMPLT;
+	sts->sts_rqpkt_resid = 0;
+	sts->sts_rqpkt_state = STATE_GOT_BUS | STATE_GOT_TARGET |
+	    STATE_SENT_CMD | STATE_XFERRED_DATA | STATE_GOT_STATUS;
+	sts->sts_rqpkt_statistics = 0;
+
+	/*
+	 * The sense data from the controller should be copied into place
+	 * starting at the "sts_sensedata" member of the auto request
+	 * sense object.
+	 */
+	size_t sense_len = pkt->pkt_scblen - offsetof(struct scsi_arq_status,
+	    sts_sensedata);
+	if (ei->SenseLen < sense_len) {
+		/*
+		 * Only copy sense data bytes that are within the region
+		 * the controller marked as valid.
+		 */
+		sense_len = ei->SenseLen;
+	}
+	bcopy(ei->SenseInfo, &sts->sts_sensedata, sense_len);
+
+	pkt->pkt_state |= STATE_ARQ_DONE;
+	return;
+
+simple_status:
+	if (pkt->pkt_scblen < sizeof (struct scsi_status)) {
+		/*
+		 * There is not even enough room for the SCSI status byte.
+		 */
+		return;
+	}
+
+	bcopy(&ei->ScsiStatus, pkt->pkt_scbp, sizeof (struct scsi_status));
+}
+
+static void
+smrt_hba_complete_log_error(smrt_command_t *smcm, const char *name)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+	ErrorInfo_t *ei = smcm->smcm_va_err;
+
+	dev_err(smrt->smrt_dip, CE_WARN, "!SCSI command failed: %s: "
+	    "SCSI op %x, CISS status %x, SCSI status %x", name,
+	    (unsigned)smcm->smcm_va_cmd->Request.CDB[0],
+	    (unsigned)ei->CommandStatus, (unsigned)ei->ScsiStatus);
+}
+
+/*
+ * Completion routine for commands submitted to the controller via the SCSI
+ * framework.
+ */
+void
+smrt_hba_complete(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+	ErrorInfo_t *ei = smcm->smcm_va_err;
+	struct scsi_pkt *pkt = smcm->smcm_scsa->smcms_pkt;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	pkt->pkt_resid = ei->ResidualCnt;
+
+	/*
+	 * Check if the controller was reset while this packet was in flight.
+	 */
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		if (pkt->pkt_reason != CMD_CMPLT) {
+			/*
+			 * If another error status has already been written,
+			 * do not overwrite it.
+			 */
+			pkt->pkt_reason = CMD_RESET;
+		}
+		pkt->pkt_statistics |= STAT_BUS_RESET | STAT_DEV_RESET;
+		goto finish;
+	}
+
+	if (!(smcm->smcm_status & SMRT_CMD_STATUS_ERROR)) {
+		/*
+		 * The command was completed without error by the controller.
+		 *
+		 * As per the specification, if an error was not signalled
+		 * by the controller through the CISS transport method,
+		 * the error information (including CommandStatus) has not
+		 * been written and should not be checked.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		goto finish;
+	}
+
+	/*
+	 * Check the completion status to determine what befell this request.
+	 */
+	switch (ei->CommandStatus) {
+	case CISS_CMD_SUCCESS:
+		/*
+		 * In a certain sense, the specification contradicts itself.
+		 * On the one hand, it suggests that a successful command
+		 * will not result in a controller write to the error
+		 * information block; on the other hand, it makes room
+		 * for a status code (0) which denotes a successful
+		 * execution.
+		 *
+		 * To be on the safe side, we check for that condition here.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_DATA_UNDERRUN:
+		/*
+		 * A data underrun occurred.  Ideally this will result in
+		 * an appropriate SCSI status and sense data.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_TARGET_STATUS:
+		/*
+		 * The command completed, but an error occurred.  We need
+		 * to provide the sense data to the SCSI framework.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_DATA_OVERRUN:
+		/*
+		 * Data overrun has occurred.
+		 */
+		smrt_hba_complete_log_error(smcm, "data overrun");
+		pkt->pkt_reason = CMD_DATA_OVR;
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_INVALID:
+		/*
+		 * One or more fields in the command has invalid data.
+		 */
+		smrt_hba_complete_log_error(smcm, "invalid command");
+		pkt->pkt_reason = CMD_BADMSG;
+		pkt->pkt_state |= STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_PROTOCOL_ERR:
+		/*
+		 * An error occurred in communication with the end device.
+		 */
+		smrt_hba_complete_log_error(smcm, "protocol error");
+		pkt->pkt_reason = CMD_BADMSG;
+		pkt->pkt_state |= STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_HARDWARE_ERR:
+		/*
+		 * A hardware error occurred.
+		 */
+		smrt_hba_complete_log_error(smcm, "hardware error");
+		pkt->pkt_reason = CMD_INCOMPLETE;
+		break;
+
+	case CISS_CMD_CONNECTION_LOST:
+		/*
+		 * The connection with the end device cannot be
+		 * re-established.
+		 */
+		smrt_hba_complete_log_error(smcm, "connection lost");
+		pkt->pkt_reason = CMD_INCOMPLETE;
+		break;
+
+	case CISS_CMD_ABORTED:
+	case CISS_CMD_UNSOLICITED_ABORT:
+		if (smcm->smcm_status & SMRT_CMD_STATUS_TIMEOUT) {
+			/*
+			 * This abort was arranged by the periodic routine
+			 * in response to an elapsed timeout.
+			 */
+			pkt->pkt_reason = CMD_TIMEOUT;
+			pkt->pkt_statistics |= STAT_TIMEOUT;
+		} else {
+			pkt->pkt_reason = CMD_ABORTED;
+		}
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		pkt->pkt_statistics |= STAT_ABORTED;
+		break;
+
+	case CISS_CMD_TIMEOUT:
+		smrt_hba_complete_log_error(smcm, "timeout");
+		pkt->pkt_reason = CMD_TIMEOUT;
+		pkt->pkt_statistics |= STAT_TIMEOUT;
+		break;
+
+	default:
+		/*
+		 * This is an error that we were not prepared to handle.
+		 * Signal a generic transport-level error to the framework.
+		 */
+		smrt_hba_complete_log_error(smcm, "unexpected error");
+		pkt->pkt_reason = CMD_TRAN_ERR;
+	}
+
+	/*
+	 * Attempt to read a SCSI status code and any automatic
+	 * request sense data that may exist:
+	 */
+	smrt_hba_complete_status(smcm);
+
+finish:
+	mutex_exit(&smrt->smrt_mutex);
+	scsi_hba_pkt_comp(pkt);
+	mutex_enter(&smrt->smrt_mutex);
+}
+
+static int
+smrt_getcap(struct scsi_address *sa, char *cap, int whom)
+{
+	_NOTE(ARGUNUSED(whom))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	int index;
+
+	sd = scsi_address_device(sa);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+
+	if ((index = scsi_hba_lookup_capstr(cap)) == DDI_FAILURE) {
+		/*
+		 * This capability string could not be translated to an
+		 * ID number, so it must not exist.
+		 */
+		return (-1);
+	}
+
+	switch (index) {
+	case SCSI_CAP_CDB_LEN:
+		/*
+		 * The CDB field in the CISS request block is fixed at 16
+		 * bytes.
+		 */
+		return (CISS_CDBLEN);
+
+	case SCSI_CAP_DMA_MAX:
+		if (smrt->smrt_dma_attr.dma_attr_maxxfer > INT_MAX) {
+			return (INT_MAX);
+		}
+		return ((int)smrt->smrt_dma_attr.dma_attr_maxxfer);
+
+	case SCSI_CAP_SECTOR_SIZE:
+		if (smrt->smrt_dma_attr.dma_attr_granular > INT_MAX) {
+			return (-1);
+		}
+		return ((int)smrt->smrt_dma_attr.dma_attr_granular);
+
+	/*
+	 * If this target corresponds to a physical device, then we always
+	 * indicate that we're on a SAS interconnect.  Otherwise, we default to
+	 * saying that we're on a parallel bus.  We can't use SAS for
+	 * everything, unfortunately.  When you declare yourself to be a SAS
+	 * interconnect, it's expected that you have a full 16-byte WWN as the
+	 * target.  If not, devfsadm will not be able to enumerate the device
+	 * and create /dev/[r]dsk entries.
+	 */
+	case SCSI_CAP_INTERCONNECT_TYPE:
+		if (smtg->smtg_physical) {
+			return (INTERCONNECT_SAS);
+		} else {
+			return (INTERCONNECT_PARALLEL);
+		}
+
+	case SCSI_CAP_DISCONNECT:
+	case SCSI_CAP_SYNCHRONOUS:
+	case SCSI_CAP_WIDE_XFER:
+	case SCSI_CAP_ARQ:
+	case SCSI_CAP_UNTAGGED_QING:
+	case SCSI_CAP_TAGGED_QING:
+		/*
+		 * These capabilities are supported by the driver and the
+		 * controller.  See scsi_ifgetcap(9F) for more information.
+		 */
+		return (1);
+
+	case SCSI_CAP_INITIATOR_ID:
+	case SCSI_CAP_RESET_NOTIFICATION:
+		/*
+		 * These capabilities are not supported.
+		 */
+		return (0);
+
+	default:
+		/*
+		 * The property in question is not known to this driver.
+		 */
+		return (-1);
+	}
+}
+
+/* ARGSUSED */
+static int
+smrt_setcap(struct scsi_address *sa, char *cap, int value, int whom)
+{
+	int index;
+
+	if ((index = scsi_hba_lookup_capstr(cap)) == DDI_FAILURE) {
+		/*
+		 * This capability string could not be translated to an
+		 * ID number, so it must not exist.
+		 */
+		return (-1);
+	}
+
+	if (whom == 0) {
+		/*
+		 * When whom is 0, this is a request to set a capability for
+		 * all targets.  As per the recommendation in tran_setcap(9E),
+		 * we do not support this mode of operation.
+		 */
+		return (-1);
+	}
+
+	switch (index) {
+	case SCSI_CAP_CDB_LEN:
+	case SCSI_CAP_DMA_MAX:
+	case SCSI_CAP_SECTOR_SIZE:
+	case SCSI_CAP_INITIATOR_ID:
+	case SCSI_CAP_DISCONNECT:
+	case SCSI_CAP_SYNCHRONOUS:
+	case SCSI_CAP_WIDE_XFER:
+	case SCSI_CAP_ARQ:
+	case SCSI_CAP_UNTAGGED_QING:
+	case SCSI_CAP_TAGGED_QING:
+	case SCSI_CAP_RESET_NOTIFICATION:
+	case SCSI_CAP_INTERCONNECT_TYPE:
+		/*
+		 * We do not support changing any capabilities at this time.
+		 */
+		return (0);
+
+	default:
+		/*
+		 * The capability in question is not known to this driver.
+		 */
+		return (-1);
+	}
+}
+
+int
+smrt_ctrl_hba_setup(smrt_t *smrt)
+{
+	int flags;
+	dev_info_t *dip = smrt->smrt_dip;
+	scsi_hba_tran_t *tran;
+
+	if ((tran = scsi_hba_tran_alloc(dip, SCSI_HBA_CANSLEEP)) == NULL) {
+		dev_err(dip, CE_WARN, "could not allocate SCSA resources");
+		return (DDI_FAILURE);
+	}
+
+	smrt->smrt_hba_tran = tran;
+	tran->tran_hba_private = smrt;
+
+	tran->tran_tgt_init = smrt_ctrl_tran_tgt_init;
+	tran->tran_tgt_probe = scsi_hba_probe;
+
+	tran->tran_start = smrt_ctrl_tran_start;
+
+	tran->tran_getcap = smrt_getcap;
+	tran->tran_setcap = smrt_setcap;
+
+	tran->tran_setup_pkt = smrt_tran_setup_pkt;
+	tran->tran_teardown_pkt = smrt_tran_teardown_pkt;
+	tran->tran_hba_len = sizeof (smrt_command_scsa_t);
+	tran->tran_interconnect_type = INTERCONNECT_SAS;
+
+	flags = SCSI_HBA_HBA | SCSI_HBA_TRAN_SCB | SCSI_HBA_ADDR_COMPLEX;
+	if (scsi_hba_attach_setup(dip, &smrt->smrt_dma_attr, tran, flags) !=
+	    DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not attach to SCSA framework");
+		scsi_hba_tran_free(tran);
+		return (DDI_FAILURE);
+	}
+
+	smrt->smrt_init_level |= SMRT_INITLEVEL_SCSA;
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_ctrl_hba_teardown(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_SCSA) {
+		VERIFY(scsi_hba_detach(smrt->smrt_dip) != DDI_FAILURE);
+		scsi_hba_tran_free(smrt->smrt_hba_tran);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_SCSA;
+	}
+}
+
+int
+smrt_logvol_hba_setup(smrt_t *smrt, dev_info_t *iport)
+{
+	scsi_hba_tran_t *tran;
+
+	tran = ddi_get_driver_private(iport);
+	if (tran == NULL)
+		return (DDI_FAILURE);
+
+	tran->tran_tgt_init = smrt_logvol_tran_tgt_init;
+	tran->tran_tgt_free = smrt_logvol_tran_tgt_free;
+
+	tran->tran_start = smrt_tran_start;
+	tran->tran_reset = smrt_tran_reset;
+	tran->tran_abort = smrt_tran_abort;
+
+	tran->tran_hba_private = smrt;
+
+	mutex_enter(&smrt->smrt_mutex);
+	if (scsi_hba_tgtmap_create(iport, SCSI_TM_FULLSET, MICROSEC,
+	    2 * MICROSEC, smrt, smrt_logvol_tgtmap_activate,
+	    smrt_logvol_tgtmap_deactivate, &smrt->smrt_virt_tgtmap) !=
+	    DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	smrt_discover_request(smrt);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_logvol_hba_teardown(smrt_t *smrt, dev_info_t *iport)
+{
+	ASSERT(smrt->smrt_virt_iport == iport);
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_virt_tgtmap != NULL) {
+		scsi_hba_tgtmap_t *t;
+
+		/*
+		 * Ensure that we can't be racing with discovery.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING) {
+			mutex_exit(&smrt->smrt_mutex);
+			ddi_taskq_wait(smrt->smrt_discover_taskq);
+			mutex_enter(&smrt->smrt_mutex);
+		}
+
+		t = smrt->smrt_virt_tgtmap;
+		smrt->smrt_virt_tgtmap = NULL;
+		mutex_exit(&smrt->smrt_mutex);
+		scsi_hba_tgtmap_destroy(t);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+int
+smrt_phys_hba_setup(smrt_t *smrt, dev_info_t *iport)
+{
+	scsi_hba_tran_t *tran;
+
+	tran = ddi_get_driver_private(iport);
+	if (tran == NULL)
+		return (DDI_FAILURE);
+
+	tran->tran_tgt_init = smrt_phys_tran_tgt_init;
+	tran->tran_tgt_free = smrt_phys_tran_tgt_free;
+
+	tran->tran_start = smrt_tran_start;
+	tran->tran_reset = smrt_tran_reset;
+	tran->tran_abort = smrt_tran_abort;
+
+	tran->tran_hba_private = smrt;
+
+	mutex_enter(&smrt->smrt_mutex);
+	if (scsi_hba_tgtmap_create(iport, SCSI_TM_FULLSET, MICROSEC,
+	    2 * MICROSEC, smrt, smrt_phys_tgtmap_activate,
+	    smrt_phys_tgtmap_deactivate, &smrt->smrt_phys_tgtmap) !=
+	    DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	smrt_discover_request(smrt);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_phys_hba_teardown(smrt_t *smrt, dev_info_t *iport)
+{
+	ASSERT(smrt->smrt_phys_iport == iport);
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_phys_tgtmap != NULL) {
+		scsi_hba_tgtmap_t *t;
+
+		/*
+		 * Ensure that we can't be racing with discovery.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING) {
+			mutex_exit(&smrt->smrt_mutex);
+			ddi_taskq_wait(smrt->smrt_discover_taskq);
+			mutex_enter(&smrt->smrt_mutex);
+		}
+
+		t = smrt->smrt_phys_tgtmap;
+		smrt->smrt_phys_tgtmap = NULL;
+		mutex_exit(&smrt->smrt_mutex);
+		scsi_hba_tgtmap_destroy(t);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_interrupts.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_interrupts.c
new file mode 100644
index 0000000000..18d5b8e936
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_interrupts.c
@@ -0,0 +1,286 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static char *
+smrt_interrupt_type_name(int type)
+{
+	switch (type) {
+	case DDI_INTR_TYPE_MSIX:
+		return ("MSI-X");
+	case DDI_INTR_TYPE_MSI:
+		return ("MSI");
+	case DDI_INTR_TYPE_FIXED:
+		return ("fixed");
+	default:
+		return ("?");
+	}
+}
+
+static boolean_t
+smrt_try_msix(smrt_t *smrt)
+{
+	char *fwver = smrt->smrt_versions.smrtv_firmware_rev;
+
+	/*
+	 * Generation 9 controllers end up having a different firmware
+	 * versioning scheme than others.  If this is a generation 9 controller,
+	 * which all share the same PCI device ID, then we default to MSI.
+	 */
+	if (smrt->smrt_pci_vendor == SMRT_VENDOR_HP &&
+	    smrt->smrt_pci_device == SMRT_DEVICE_GEN9) {
+		return (B_FALSE);
+	}
+
+	if (fwver[0] == '8' && fwver[1] == '.' && isdigit(fwver[2]) &&
+	    isdigit(fwver[3])) {
+		/*
+		 * Version 8.00 of the Smart Array firmware appears to have
+		 * broken MSI support on at least one controller.  We could
+		 * blindly try MSI-X everywhere, except that on at least some
+		 * 6.XX firmware versions, MSI-X interrupts do not appear
+		 * to be triggered for Simple Transport Method command
+		 * completions.
+		 *
+		 * For now, assume we should try for MSI-X with all 8.XX
+		 * versions of the firmware.
+		 */
+		dev_err(smrt->smrt_dip, CE_NOTE, "!trying MSI-X interrupts "
+		    "to work around 8.XX firmware defect");
+		return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+static int
+smrt_interrupts_disable(smrt_t *smrt)
+{
+	if (smrt->smrt_interrupt_cap & DDI_INTR_FLAG_BLOCK) {
+		return (ddi_intr_block_disable(smrt->smrt_interrupts,
+		    smrt->smrt_ninterrupts));
+	} else {
+		VERIFY3S(smrt->smrt_ninterrupts, ==, 1);
+
+		return (ddi_intr_disable(smrt->smrt_interrupts[0]));
+	}
+}
+
+int
+smrt_interrupts_enable(smrt_t *smrt)
+{
+	int ret;
+
+	VERIFY(!(smrt->smrt_init_level & SMRT_INITLEVEL_INT_ENABLED));
+
+	if (smrt->smrt_interrupt_cap & DDI_INTR_FLAG_BLOCK) {
+		ret = ddi_intr_block_enable(smrt->smrt_interrupts,
+		    smrt->smrt_ninterrupts);
+	} else {
+		VERIFY3S(smrt->smrt_ninterrupts, ==, 1);
+
+		ret = ddi_intr_enable(smrt->smrt_interrupts[0]);
+	}
+
+	if (ret == DDI_SUCCESS) {
+		smrt->smrt_init_level |= SMRT_INITLEVEL_INT_ENABLED;
+	}
+
+	return (ret);
+}
+
+static void
+smrt_interrupts_free(smrt_t *smrt)
+{
+	for (int i = 0; i < smrt->smrt_ninterrupts; i++) {
+		(void) ddi_intr_free(smrt->smrt_interrupts[i]);
+	}
+	smrt->smrt_ninterrupts = 0;
+	smrt->smrt_interrupt_type = 0;
+	smrt->smrt_interrupt_cap = 0;
+	smrt->smrt_interrupt_pri = 0;
+}
+
+static int
+smrt_interrupts_alloc(smrt_t *smrt, int type)
+{
+	dev_info_t *dip = smrt->smrt_dip;
+	int nintrs = 0;
+	int navail = 0;
+
+	if (ddi_intr_get_nintrs(dip, type, &nintrs) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not count %s interrupts",
+		    smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+	if (nintrs < 1) {
+		dev_err(dip, CE_WARN, "no %s interrupts supported",
+		    smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_intr_get_navail(dip, type, &navail) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not count available %s "
+		    "interrupts", smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+	if (navail < 1) {
+		dev_err(dip, CE_WARN, "no %s interrupts available",
+		    smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_intr_alloc(dip, smrt->smrt_interrupts, type, 0, 1,
+	    &smrt->smrt_ninterrupts, DDI_INTR_ALLOC_STRICT) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "%s interrupt allocation failed",
+		    smrt_interrupt_type_name(type));
+		smrt_interrupts_free(smrt);
+		return (DDI_FAILURE);
+	}
+
+	smrt->smrt_init_level |= SMRT_INITLEVEL_INT_ALLOC;
+	smrt->smrt_interrupt_type = type;
+	return (DDI_SUCCESS);
+}
+
+int
+smrt_interrupts_setup(smrt_t *smrt)
+{
+	int types;
+	unsigned ipri;
+	uint_t (*hw_isr)(caddr_t, caddr_t);
+	dev_info_t *dip = smrt->smrt_dip;
+
+	/*
+	 * Select the correct hardware interrupt service routine for the
+	 * Transport Method we have configured:
+	 */
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		hw_isr = smrt_isr_hw_simple;
+		break;
+	default:
+		panic("unknown controller mode");
+	}
+
+	if (ddi_intr_get_supported_types(dip, &types) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not get support interrupts");
+		goto fail;
+	}
+
+	/*
+	 * At least one firmware version has been released for the Smart Array
+	 * line with entirely defective MSI support.  The specification is
+	 * somewhat unclear on the precise nature of MSI-X support with Smart
+	 * Array controllers, particularly with respect to the Simple Transport
+	 * Method, but for those broken firmware versions we need to try
+	 * anyway.
+	 */
+	if (smrt_try_msix(smrt) && (types & DDI_INTR_TYPE_MSIX)) {
+		if (smrt_interrupts_alloc(smrt, DDI_INTR_TYPE_MSIX) ==
+		    DDI_SUCCESS) {
+			goto add_handler;
+		}
+	}
+
+	/*
+	 * If MSI-X is not available, or not expected to work, fall back to
+	 * MSI.
+	 */
+	if (types & DDI_INTR_TYPE_MSI) {
+		if (smrt_interrupts_alloc(smrt, DDI_INTR_TYPE_MSI) ==
+		    DDI_SUCCESS) {
+			goto add_handler;
+		}
+	}
+
+	/*
+	 * If neither MSI-X nor MSI is available, fall back to fixed
+	 * interrupts.  Note that the use of fixed interrupts has been
+	 * observed, with some combination of controllers and systems, to
+	 * result in interrupts stopping completely at random times.
+	 */
+	if (types & DDI_INTR_TYPE_FIXED) {
+		if (smrt_interrupts_alloc(smrt, DDI_INTR_TYPE_FIXED) ==
+		    DDI_SUCCESS) {
+			goto add_handler;
+		}
+	}
+
+	/*
+	 * We were unable to allocate any interrupts.
+	 */
+	dev_err(dip, CE_WARN, "interrupt allocation failed");
+	goto fail;
+
+add_handler:
+	/*
+	 * Ensure that we have not been given a high-level interrupt, as our
+	 * interrupt handlers do not support them.
+	 */
+	if (ddi_intr_get_pri(smrt->smrt_interrupts[0], &ipri) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not determine interrupt priority");
+		goto fail;
+	}
+	if (ipri >= ddi_intr_get_hilevel_pri()) {
+		dev_err(dip, CE_WARN, "high level interrupts not supported");
+		goto fail;
+	}
+	smrt->smrt_interrupt_pri = ipri;
+
+	if (ddi_intr_get_cap(smrt->smrt_interrupts[0],
+	    &smrt->smrt_interrupt_cap) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not get %s interrupt cap",
+		    smrt_interrupt_type_name(smrt->smrt_interrupt_type));
+		goto fail;
+	}
+
+	if (ddi_intr_add_handler(smrt->smrt_interrupts[0], hw_isr,
+	    (caddr_t)smrt, NULL) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "adding %s interrupt failed",
+		    smrt_interrupt_type_name(smrt->smrt_interrupt_type));
+		goto fail;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_INT_ADDED;
+
+	return (DDI_SUCCESS);
+
+fail:
+	smrt_interrupts_teardown(smrt);
+	return (DDI_FAILURE);
+}
+
+void
+smrt_interrupts_teardown(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_INT_ENABLED) {
+		(void) smrt_interrupts_disable(smrt);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_INT_ENABLED;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_INT_ADDED) {
+		(void) ddi_intr_remove_handler(smrt->smrt_interrupts[0]);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_INT_ADDED;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_INT_ALLOC) {
+		smrt_interrupts_free(smrt);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_INT_ALLOC;
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_logvol.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_logvol.c
new file mode 100644
index 0000000000..05963ac2e2
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_logvol.c
@@ -0,0 +1,367 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static void
+smrt_logvol_free(smrt_volume_t *smlv)
+{
+	/*
+	 * By this stage of teardown, all of the SCSI target drivers
+	 * must have been detached from this logical volume.
+	 */
+	VERIFY(list_is_empty(&smlv->smlv_targets));
+	list_destroy(&smlv->smlv_targets);
+
+	kmem_free(smlv, sizeof (*smlv));
+}
+
+smrt_volume_t *
+smrt_logvol_lookup_by_id(smrt_t *smrt, unsigned long id)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	for (smrt_volume_t *smlv = list_head(&smrt->smrt_volumes);
+	    smlv != NULL; smlv = list_next(&smrt->smrt_volumes, smlv)) {
+		if (smlv->smlv_addr.LogDev.VolId == id) {
+			return (smlv);
+		}
+	}
+
+	return (NULL);
+}
+
+static int
+smrt_read_logvols(smrt_t *smrt, smrt_report_logical_lun_t *smrll, uint64_t gen)
+{
+	smrt_report_logical_lun_ent_t *ents = smrll->smrll_data.ents;
+	uint32_t count = BE_32(smrll->smrll_datasize) /
+	    sizeof (smrt_report_logical_lun_ent_t);
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (count > SMRT_MAX_LOGDRV) {
+		count = SMRT_MAX_LOGDRV;
+	}
+
+	for (unsigned i = 0; i < count; i++) {
+		smrt_volume_t *smlv;
+		char id[SCSI_MAXNAMELEN];
+
+		DTRACE_PROBE2(read_logvol, unsigned, i,
+		    smrt_report_logical_lun_ent_t *, &ents[i]);
+
+		if ((smlv = smrt_logvol_lookup_by_id(smrt,
+		    ents[i].smrle_addr.VolId)) == NULL) {
+
+			/*
+			 * This is a new Logical Volume, so add it the the list.
+			 */
+			if ((smlv = kmem_zalloc(sizeof (*smlv), KM_NOSLEEP)) ==
+			    NULL) {
+				return (ENOMEM);
+			}
+
+			list_create(&smlv->smlv_targets,
+			    sizeof (smrt_target_t),
+			    offsetof(smrt_target_t, smtg_link_lun));
+
+			smlv->smlv_ctlr = smrt;
+			list_insert_tail(&smrt->smrt_volumes, smlv);
+		}
+
+		/*
+		 * Always make sure that the address and the generation are up
+		 * to date, regardless of where this came from.
+		 */
+		smlv->smlv_addr.LogDev = ents[i].smrle_addr;
+		smlv->smlv_gen = gen;
+		(void) snprintf(id, sizeof (id), "%x",
+		    smlv->smlv_addr.LogDev.VolId);
+		if (!ddi_in_panic() &&
+		    scsi_hba_tgtmap_set_add(smrt->smrt_virt_tgtmap,
+		    SCSI_TGT_SCSI_DEVICE, id, NULL) != DDI_SUCCESS) {
+			return (EIO);
+		}
+	}
+
+	return (0);
+}
+
+static int
+smrt_read_logvols_ext(smrt_t *smrt, smrt_report_logical_lun_t *smrll,
+    uint64_t gen)
+{
+	smrt_report_logical_lun_extent_t *extents =
+	    smrll->smrll_data.extents;
+	uint32_t count = BE_32(smrll->smrll_datasize) /
+	    sizeof (smrt_report_logical_lun_extent_t);
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (count > SMRT_MAX_LOGDRV) {
+		count = SMRT_MAX_LOGDRV;
+	}
+
+	for (unsigned i = 0; i < count; i++) {
+		smrt_volume_t *smlv;
+		char id[SCSI_MAXNAMELEN];
+
+		DTRACE_PROBE2(read_logvol_ext, unsigned, i,
+		    smrt_report_logical_lun_extent_t *, &extents[i]);
+
+		if ((smlv = smrt_logvol_lookup_by_id(smrt,
+		    extents[i].smrle_addr.VolId)) != NULL) {
+			if ((smlv->smlv_flags & SMRT_VOL_FLAG_WWN) &&
+			    bcmp(extents[i].smrle_wwn, smlv->smlv_wwn,
+			    16) != 0) {
+				dev_err(smrt->smrt_dip, CE_PANIC, "logical "
+				    "volume %u WWN changed unexpectedly", i);
+			}
+		} else {
+			/*
+			 * This is a new Logical Volume, so add it the the list.
+			 */
+			if ((smlv = kmem_zalloc(sizeof (*smlv), KM_NOSLEEP)) ==
+			    NULL) {
+				return (ENOMEM);
+			}
+
+			bcopy(extents[i].smrle_wwn, smlv->smlv_wwn, 16);
+			smlv->smlv_flags |= SMRT_VOL_FLAG_WWN;
+
+			list_create(&smlv->smlv_targets,
+			    sizeof (smrt_target_t),
+			    offsetof(smrt_target_t, smtg_link_lun));
+
+			smlv->smlv_ctlr = smrt;
+			list_insert_tail(&smrt->smrt_volumes, smlv);
+		}
+
+		/*
+		 * Always make sure that the address and the generation are up
+		 * to date.  The address may have changed on a reset.
+		 */
+		smlv->smlv_addr.LogDev = extents[i].smrle_addr;
+		smlv->smlv_gen = gen;
+		(void) snprintf(id, sizeof (id), "%x",
+		    smlv->smlv_addr.LogDev.VolId);
+		if (!ddi_in_panic() &&
+		    scsi_hba_tgtmap_set_add(smrt->smrt_virt_tgtmap,
+		    SCSI_TGT_SCSI_DEVICE, id, NULL) != DDI_SUCCESS) {
+			return (EIO);
+		}
+	}
+
+	return (0);
+}
+
+/*
+ * Discover the currently visible set of Logical Volumes exposed by the
+ * controller.
+ */
+int
+smrt_logvol_discover(smrt_t *smrt, uint16_t timeout, uint64_t gen)
+{
+	smrt_command_t *smcm;
+	smrt_report_logical_lun_t *smrll;
+	smrt_report_logical_lun_req_t smrllr = { 0 };
+	int r;
+
+	/*
+	 * Allocate the command to send to the device, including buffer space
+	 * for the returned list of Logical Volumes.
+	 */
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    sizeof (smrt_report_logical_lun_t), KM_NOSLEEP) != 0) {
+		r = ENOMEM;
+		mutex_enter(&smrt->smrt_mutex);
+		goto out;
+	}
+
+	smrll = smcm->smcm_internal->smcmi_va;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (smrllr);
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * The Report Logical LUNs command is essentially a vendor-specific
+	 * SCSI command, which we assemble into the CDB region of the command
+	 * block.
+	 */
+	bzero(&smrllr, sizeof (smrllr));
+	smrllr.smrllr_opcode = CISS_SCMD_REPORT_LOGICAL_LUNS;
+	smrllr.smrllr_extflag = 1;
+	smrllr.smrllr_datasize = htonl(sizeof (smrt_report_logical_lun_t));
+	bcopy(&smrllr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (smrllr)));
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		goto out;
+	}
+
+	/*
+	 * Poll for completion.
+	 */
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		smcm = NULL;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to discover
+		 * logical volumes.  Report failure.
+		 */
+		r = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "logical volume "
+			    "discovery error: status 0x%x", ei->CommandStatus);
+			r = EIO;
+			goto out;
+		}
+	}
+
+	if (!ddi_in_panic() &&
+	    scsi_hba_tgtmap_set_begin(smrt->smrt_virt_tgtmap) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_WARN, "failed to begin target map "
+		    "observation on %s", SMRT_IPORT_VIRT);
+		r = EIO;
+		goto out;
+	}
+
+	if ((smrll->smrll_extflag & 0x1) != 0) {
+		r = smrt_read_logvols_ext(smrt, smrll, gen);
+	} else {
+		r = smrt_read_logvols(smrt, smrll, gen);
+	}
+
+	if (r == 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_end(smrt->smrt_virt_tgtmap, 0) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_VIRT);
+			r = EIO;
+		}
+	} else if (r != 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_flush(smrt->smrt_virt_tgtmap) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_VIRT);
+			r = EIO;
+		}
+	}
+
+	if (r == 0) {
+		/*
+		 * Update the time of the last successful Logical Volume
+		 * discovery:
+		 */
+		smrt->smrt_last_log_discovery = gethrtime();
+	}
+
+out:
+	mutex_exit(&smrt->smrt_mutex);
+
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+	return (r);
+}
+
+void
+smrt_logvol_tgtmap_activate(void *arg, char *addr, scsi_tgtmap_tgt_type_t type,
+    void **privpp)
+{
+	smrt_t *smrt = arg;
+	unsigned long volume;
+	char *eptr;
+
+	VERIFY(type == SCSI_TGT_SCSI_DEVICE);
+	VERIFY0(ddi_strtoul(addr, &eptr, 16, &volume));
+	VERIFY3S(*eptr, ==, '\0');
+	VERIFY3S(volume, >=, 0);
+	VERIFY3S(volume, <, SMRT_MAX_LOGDRV);
+	mutex_enter(&smrt->smrt_mutex);
+	VERIFY(smrt_logvol_lookup_by_id(smrt, volume) != NULL);
+	mutex_exit(&smrt->smrt_mutex);
+	*privpp = NULL;
+}
+
+boolean_t
+smrt_logvol_tgtmap_deactivate(void *arg, char *addr,
+    scsi_tgtmap_tgt_type_t type, void *priv, scsi_tgtmap_deact_rsn_t reason)
+{
+	smrt_t *smrt = arg;
+	smrt_volume_t *smlv;
+	unsigned long volume;
+	char *eptr;
+
+	VERIFY(type == SCSI_TGT_SCSI_DEVICE);
+	VERIFY(priv == NULL);
+	VERIFY0(ddi_strtoul(addr, &eptr, 16, &volume));
+	VERIFY3S(*eptr, ==, '\0');
+	VERIFY3S(volume, >=, 0);
+	VERIFY3S(volume, <, SMRT_MAX_LOGDRV);
+
+	mutex_enter(&smrt->smrt_mutex);
+	smlv = smrt_logvol_lookup_by_id(smrt, volume);
+	VERIFY(smlv != NULL);
+
+	list_remove(&smrt->smrt_volumes, smlv);
+	smrt_logvol_free(smlv);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (B_FALSE);
+}
+
+void
+smrt_logvol_teardown(smrt_t *smrt)
+{
+	smrt_volume_t *smlv;
+
+	while ((smlv = list_remove_head(&smrt->smrt_volumes)) != NULL) {
+		smrt_logvol_free(smlv);
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_physical.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_physical.c
new file mode 100644
index 0000000000..8ab3927673
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_physical.c
@@ -0,0 +1,613 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017 Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static void
+smrt_physical_free(smrt_physical_t *smpt)
+{
+	VERIFY(list_is_empty(&smpt->smpt_targets));
+	VERIFY(smpt->smpt_info != NULL);
+
+	kmem_free(smpt->smpt_info, sizeof (*smpt->smpt_info));
+	list_destroy(&smpt->smpt_targets);
+	kmem_free(smpt, sizeof (*smpt));
+}
+
+/*
+ * Determine if a physical device enumerated should be shown to the world. There
+ * are three conditions to satisfy for this to be true.
+ *
+ * 1. The device (SAS, SATA, SES, etc.) must not have a masked CISS address.  A
+ * masked CISS address indicates a device that we should not be performing I/O
+ * to.
+ * 2. The drive (SAS or SATA device) must not be marked as a member of a logical
+ * volume.
+ * 3. The drive (SAS or SATA device) must not be marked as a spare.
+ */
+static boolean_t
+smrt_physical_visible(PhysDevAddr_t *addr, smrt_identify_physical_drive_t *info)
+{
+	if (addr->Mode == SMRT_CISS_MODE_MASKED) {
+		return (B_FALSE);
+	}
+
+	if ((info->sipd_more_flags & (SMRT_MORE_FLAGS_LOGVOL |
+	    SMRT_MORE_FLAGS_SPARE)) != 0) {
+		return (B_FALSE);
+	}
+
+	return (B_TRUE);
+}
+
+/*
+ * Note, the caller is responsible for making sure that the unit-address form of
+ * the WWN is pased in.  Any additional information to target a specific LUN
+ * will be ignored.
+ */
+smrt_physical_t *
+smrt_phys_lookup_by_ua(smrt_t *smrt, const char *ua)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	/*
+	 * Sanity check that the caller has provided us enough bytes for a
+	 * properly formed unit-address form of a WWN.
+	 */
+	if (strlen(ua) < SCSI_WWN_UA_STRLEN)
+		return (NULL);
+
+	for (smrt_physical_t *smpt = list_head(&smrt->smrt_physicals);
+	    smpt != NULL; smpt = list_next(&smrt->smrt_physicals, smpt)) {
+		char wwnstr[SCSI_WWN_BUFLEN];
+
+		(void) scsi_wwn_to_wwnstr(smpt->smpt_wwn, 1, wwnstr);
+		if (strncmp(wwnstr, ua, SCSI_WWN_UA_STRLEN) != 0)
+			continue;
+
+		/*
+		 * Verify that the UA string is either a comma or null there.
+		 * We accept the comma in case it's being used as part of a
+		 * normal UA with a LUN.
+		 */
+		if (ua[SCSI_WWN_UA_STRLEN] != '\0' &&
+		    ua[SCSI_WWN_UA_STRLEN] != ',') {
+			continue;
+		}
+
+		return (smpt);
+	}
+
+	return (NULL);
+}
+
+static smrt_physical_t *
+smrt_phys_lookup_by_wwn(smrt_t *smrt, uint64_t wwn)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	for (smrt_physical_t *smpt = list_head(&smrt->smrt_physicals);
+	    smpt != NULL; smpt = list_next(&smrt->smrt_physicals, smpt)) {
+		if (wwn == smpt->smpt_wwn)
+			return (smpt);
+	}
+
+	return (NULL);
+}
+
+static int
+smrt_phys_identify(smrt_t *smrt, smrt_identify_physical_drive_t *info,
+    uint16_t bmic, uint16_t timeout)
+{
+	smrt_command_t *smcm = NULL;
+	smrt_identify_physical_drive_t *sipd;
+	smrt_identify_physical_drive_req_t sipdr;
+	int ret;
+	size_t sz, copysz;
+
+	sz = sizeof (smrt_identify_physical_drive_t);
+	sz = P2ROUNDUP_TYPED(sz, 512, size_t);
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    sizeof (*sipd), KM_NOSLEEP) != 0) {
+		ret = ENOMEM;
+		goto out;
+	}
+
+	sipd = smcm->smcm_internal->smcmi_va;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (sipdr);
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * Construct the IDENTIFY PHYSICAL DEVICE request CDB.  Note that any
+	 * reserved fields in the request must be filled with zeroes.
+	 */
+	bzero(&sipdr, sizeof (sipdr));
+	sipdr.sipdr_opcode = CISS_SCMD_BMIC_READ;
+	sipdr.sipdr_lun = 0;
+	sipdr.sipdr_bmic_index1 = bmic & 0x00ff;
+	sipdr.sipdr_command = CISS_BMIC_IDENTIFY_PHYSICAL_DEVICE;
+	sipdr.sipdr_bmic_index2 = (bmic & 0xff00) >> 8;
+	bcopy(&sipdr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (sipdr)));
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((ret = smrt_submit(smrt, smcm)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		goto out;
+	}
+
+	/*
+	 * Poll for completion.
+	 */
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((ret = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(ret, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		smcm = NULL;
+		mutex_exit(&smrt->smrt_mutex);
+		goto out;
+	}
+	mutex_exit(&smrt->smrt_mutex);
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to discover
+		 * physical volumes.  Report failure.
+		 */
+		ret = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "identify physical "
+			    "device error: status 0x%x", ei->CommandStatus);
+			ret = EIO;
+			goto out;
+		}
+
+		copysz = MIN(sizeof (*sipd), sz - ei->ResidualCnt);
+	} else {
+		copysz = sizeof (*sipd);
+	}
+
+
+	sz = MIN(sizeof (*sipd), copysz);
+	bcopy(sipd, info, sizeof (*sipd));
+
+	ret = 0;
+out:
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+
+	return (ret);
+}
+
+static int
+smrt_read_phys_ext(smrt_t *smrt, smrt_report_physical_lun_t *smrpl,
+    uint16_t timeout, uint64_t gen)
+{
+	smrt_report_physical_lun_extent_t *extents = smrpl->smrpl_data.extents;
+	uint32_t count = BE_32(smrpl->smrpl_datasize) /
+	    sizeof (smrt_report_physical_lun_extent_t);
+	uint32_t i;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (count > SMRT_MAX_PHYSDEV) {
+		count = SMRT_MAX_PHYSDEV;
+	}
+
+	for (i = 0; i < count; i++) {
+		int ret;
+		smrt_physical_t *smpt;
+		smrt_identify_physical_drive_t *info;
+		smrt_report_physical_opdi_t *opdi;
+		uint16_t bmic;
+		uint64_t wwn, satawwn;
+		char name[SCSI_MAXNAMELEN];
+
+		opdi = &extents[i].srple_extdata.srple_opdi;
+
+		mutex_exit(&smrt->smrt_mutex);
+
+		/*
+		 * Get the extended information about this device.
+		 */
+		info = kmem_zalloc(sizeof (*info), KM_NOSLEEP);
+		if (info == NULL) {
+			mutex_enter(&smrt->smrt_mutex);
+			return (ENOMEM);
+		}
+
+		bmic = smrt_lun_addr_to_bmic(&extents[i].srple_addr);
+		ret = smrt_phys_identify(smrt, info, bmic, timeout);
+		if (ret != 0) {
+			mutex_enter(&smrt->smrt_mutex);
+			kmem_free(info, sizeof (*info));
+			return (ret);
+		}
+
+		wwn = *(uint64_t *)opdi->srpo_wwid;
+		wwn = BE_64(wwn);
+
+		/*
+		 * SATA devices may not have a proper WWN returned from firmware
+		 * based on the SATL specification.  Try to fetch the proper id
+		 * for SATA devices, if the drive has one.  If the drive doesn't
+		 * have one or the SATL refuses to give us one, we use whatever
+		 * the controller told us.
+		 */
+		if (opdi->srpo_dtype == SMRT_DTYPE_SATA &&
+		    smrt_sata_determine_wwn(smrt, &extents[i].srple_addr,
+		    &satawwn, timeout) == 0) {
+			wwn = satawwn;
+		}
+
+		mutex_enter(&smrt->smrt_mutex);
+		smpt = smrt_phys_lookup_by_wwn(smrt, wwn);
+		if (smpt != NULL) {
+			/*
+			 * Sanity check that the model and serial number of this
+			 * device is the same for this WWN.  If it's not, the
+			 * controller is probably lying about something.
+			 */
+			if (bcmp(smpt->smpt_info->sipd_model, info->sipd_model,
+			    sizeof (info->sipd_model)) != 0 ||
+			    bcmp(smpt->smpt_info->sipd_serial,
+			    info->sipd_serial, sizeof (info->sipd_serial)) !=
+			    0 || smpt->smpt_dtype != opdi->srpo_dtype) {
+				dev_err(smrt->smrt_dip, CE_PANIC, "physical "
+				    "target with wwn 0x%" PRIx64 " changed "
+				    "model, serial, or type unexpectedly: "
+				    "smrt_physical_t %p, phys info: %p", wwn,
+				    smpt, info);
+			}
+
+			/*
+			 * When panicking, we don't allow a device's visibility
+			 * to change to being invisible and be able to actually
+			 * panic.  We only worry about devices which are used
+			 * for I/O.  We purposefully ignore SES devices.
+			 */
+			if (ddi_in_panic() &&
+			    (opdi->srpo_dtype == SMRT_DTYPE_SATA ||
+			    opdi->srpo_dtype == SMRT_DTYPE_SAS)) {
+				boolean_t visible;
+
+				visible = smrt_physical_visible(
+				    &smpt->smpt_addr.PhysDev, smpt->smpt_info);
+
+				if (visible != smpt->smpt_visible) {
+					dev_err(smrt->smrt_dip, CE_PANIC,
+					    "physical target with wwn 0x%"
+					    PRIx64 " changed visibility status "
+					    "unexpectedly", wwn);
+				}
+			}
+
+			kmem_free(smpt->smpt_info, sizeof (*smpt->smpt_info));
+			smpt->smpt_info = NULL;
+		} else {
+			smpt = kmem_zalloc(sizeof (smrt_physical_t),
+			    KM_NOSLEEP);
+			if (smpt == NULL) {
+				kmem_free(info, sizeof (*info));
+				return (ENOMEM);
+			}
+
+			smpt->smpt_wwn = wwn;
+			smpt->smpt_dtype = opdi->srpo_dtype;
+			list_create(&smpt->smpt_targets, sizeof (smrt_target_t),
+			    offsetof(smrt_target_t, smtg_link_lun));
+			smpt->smpt_ctlr = smrt;
+			list_insert_tail(&smrt->smrt_physicals, smpt);
+		}
+
+		VERIFY3P(smpt->smpt_info, ==, NULL);
+
+		/*
+		 * Determine if this device is supported and if it's visible to
+		 * the system.  Some devices may not be visible to the system
+		 * because they're used in logical volumes or spares.
+		 * Unsupported devices are also not visible.
+		 */
+		switch (smpt->smpt_dtype) {
+		case SMRT_DTYPE_SATA:
+		case SMRT_DTYPE_SAS:
+			smpt->smpt_supported = B_TRUE;
+			smpt->smpt_visible =
+			    smrt_physical_visible(&extents[i].srple_addr, info);
+			break;
+		case SMRT_DTYPE_SES:
+			smpt->smpt_supported = B_TRUE;
+			smpt->smpt_visible =
+			    smrt_physical_visible(&extents[i].srple_addr, info);
+			break;
+		default:
+			smpt->smpt_visible = B_FALSE;
+			smpt->smpt_supported = B_FALSE;
+		}
+
+		smpt->smpt_info = info;
+		smpt->smpt_addr.PhysDev = extents[i].srple_addr;
+		smpt->smpt_bmic = bmic;
+		smpt->smpt_gen = gen;
+		(void) scsi_wwn_to_wwnstr(smpt->smpt_wwn, 1, name);
+		if (!ddi_in_panic() && smpt->smpt_visible &&
+		    scsi_hba_tgtmap_set_add(smrt->smrt_phys_tgtmap,
+		    SCSI_TGT_SCSI_DEVICE, name, NULL) != DDI_SUCCESS) {
+			return (EIO);
+		}
+	}
+
+	return (0);
+}
+
+int
+smrt_phys_discover(smrt_t *smrt, uint16_t timeout, uint64_t gen)
+{
+	smrt_command_t *smcm;
+	smrt_report_physical_lun_t *smrpl;
+	smrt_report_physical_lun_req_t smrplr;
+	int r;
+
+	/*
+	 * Allocate the command to send to the device, including buffer space
+	 * for the returned list of Physical Volumes.
+	 */
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    sizeof (*smrpl), KM_NOSLEEP) != 0) {
+		r = ENOMEM;
+		mutex_enter(&smrt->smrt_mutex);
+		goto out;
+	}
+
+	smrpl = smcm->smcm_internal->smcmi_va;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (smrplr);
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * The Report Physical LUNs command is essentially a vendor-specific
+	 * SCSI command, which we assemble into the CDB region of the command
+	 * block.
+	 */
+	bzero(&smrplr, sizeof (smrplr));
+	smrplr.smrplr_opcode = CISS_SCMD_REPORT_PHYSICAL_LUNS;
+	smrplr.smrplr_extflag = SMRT_REPORT_PHYSICAL_LUN_EXT_OPDI;
+	smrplr.smrplr_datasize = BE_32(sizeof (smrt_report_physical_lun_t));
+	bcopy(&smrplr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (smrplr)));
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		goto out;
+	}
+
+	/*
+	 * Poll for completion.
+	 */
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		smcm = NULL;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 *
+		 * The controller was reset while we were trying to discover
+		 * logical volumes.  Report failure.
+		 */
+		r = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "physical target "
+			    "discovery error: status 0x%x", ei->CommandStatus);
+			r = EIO;
+			goto out;
+		}
+	}
+
+	/*
+	 * If the controller doesn't support extended physical reporting, it
+	 * likely doesn't even support physical devices that we'd care about
+	 * exposing.  As such, we treat this as an OK case.
+	 */
+	if ((smrpl->smrpl_extflag & SMRT_REPORT_PHYSICAL_LUN_EXT_MASK) !=
+	    SMRT_REPORT_PHYSICAL_LUN_EXT_OPDI) {
+		r = 0;
+		goto out;
+	}
+
+	if (!ddi_in_panic() &&
+	    scsi_hba_tgtmap_set_begin(smrt->smrt_phys_tgtmap) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_WARN, "failed to begin target map "
+		    "observation on %s", SMRT_IPORT_PHYS);
+		r = EIO;
+		goto out;
+	}
+
+	r = smrt_read_phys_ext(smrt, smrpl, timeout, gen);
+
+	if (r == 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_end(smrt->smrt_phys_tgtmap, 0) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_PHYS);
+			r = EIO;
+		}
+	} else if (r != 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_flush(smrt->smrt_phys_tgtmap) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_PHYS);
+			r = EIO;
+		}
+	}
+
+	if (r == 0) {
+		smrt_physical_t *smpt, *next;
+
+		/*
+		 * Prune physical devices that do not match the current
+		 * generation and are not marked as visible devices.  Visible
+		 * devices will be dealt with as part of the target map work.
+		 */
+		for (smpt = list_head(&smrt->smrt_physicals), next = NULL;
+		    smpt != NULL; smpt = next) {
+			next = list_next(&smrt->smrt_physicals, smpt);
+			if (smpt->smpt_visible || smpt->smpt_gen == gen)
+				continue;
+			list_remove(&smrt->smrt_physicals, smpt);
+			smrt_physical_free(smpt);
+		}
+
+		/*
+		 * Update the time of the last successful Physical Volume
+		 * discovery:
+		 */
+		smrt->smrt_last_phys_discovery = gethrtime();
+
+		/*
+		 * Now, for each unsupported device that we haven't warned about
+		 * encountering, try and give the administrator some hope of
+		 * knowing about this.
+		 */
+		for (smpt = list_head(&smrt->smrt_physicals), next = NULL;
+		    smpt != NULL; smpt = next) {
+			if (smpt->smpt_supported || smpt->smpt_unsup_warn)
+				continue;
+			smpt->smpt_unsup_warn = B_TRUE;
+			dev_err(smrt->smrt_dip, CE_WARN, "encountered "
+			    "unsupported device with device type %d",
+			    smpt->smpt_dtype);
+		}
+	}
+
+out:
+	mutex_exit(&smrt->smrt_mutex);
+
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+	return (r);
+}
+
+void
+smrt_phys_tgtmap_activate(void *arg, char *addr, scsi_tgtmap_tgt_type_t type,
+    void **privpp)
+{
+	smrt_t *smrt = arg;
+	smrt_physical_t *smpt;
+
+	VERIFY3S(type, ==, SCSI_TGT_SCSI_DEVICE);
+	mutex_enter(&smrt->smrt_mutex);
+	smpt = smrt_phys_lookup_by_ua(smrt, addr);
+	VERIFY(smpt != NULL);
+	VERIFY(smpt->smpt_supported);
+	VERIFY(smpt->smpt_visible);
+	*privpp = NULL;
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+boolean_t
+smrt_phys_tgtmap_deactivate(void *arg, char *addr, scsi_tgtmap_tgt_type_t type,
+    void *priv, scsi_tgtmap_deact_rsn_t reason)
+{
+	smrt_t *smrt = arg;
+	smrt_physical_t *smpt;
+
+	VERIFY3S(type, ==, SCSI_TGT_SCSI_DEVICE);
+	VERIFY3P(priv, ==, NULL);
+
+	mutex_enter(&smrt->smrt_mutex);
+	smpt = smrt_phys_lookup_by_ua(smrt, addr);
+
+	/*
+	 * If the device disappeared or became invisible, then it may have
+	 * already been removed.
+	 */
+	if (smpt == NULL || !smpt->smpt_visible) {
+		mutex_exit(&smrt->smrt_mutex);
+		return (B_FALSE);
+	}
+
+	list_remove(&smrt->smrt_physicals, smpt);
+	smrt_physical_free(smpt);
+	mutex_exit(&smrt->smrt_mutex);
+	return (B_FALSE);
+}
+
+void
+smrt_phys_teardown(smrt_t *smrt)
+{
+	smrt_physical_t *smpt;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+	while ((smpt = list_remove_head(&smrt->smrt_physicals)) != NULL) {
+		smrt_physical_free(smpt);
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_sata.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_sata.c
new file mode 100644
index 0000000000..6224b97732
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_sata.c
@@ -0,0 +1,160 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * Collection of routines specific to SATA devices and attempting to make them
+ * work.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * This is a buffer size that should easily cover all of the data that we need
+ * to properly determine the buffer allocation.
+ */
+#define	SMRT_SATA_INQ83_LEN	256
+
+/*
+ * We need to try and determine if a SATA WWN exists on the device.  SAT-2
+ * defines that the response to the inquiry page 0x83.
+ */
+int
+smrt_sata_determine_wwn(smrt_t *smrt, PhysDevAddr_t *addr, uint64_t *wwnp,
+    uint16_t timeout)
+{
+	smrt_command_t *smcm;
+	int r;
+	uint8_t *inq;
+	uint64_t wwn;
+	size_t resid;
+
+	VERIFY3P(wwnp, !=, NULL);
+
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    SMRT_SATA_INQ83_LEN, KM_NOSLEEP) != 0) {
+		if (smcm != NULL) {
+			smrt_command_free(smcm);
+		}
+		return (ENOMEM);
+	}
+
+	smcm->smcm_va_cmd->Header.LUN.PhysDev = *addr;
+	smcm->smcm_va_cmd->Request.CDBLen = CDB_GROUP0;
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+
+	smcm->smcm_va_cmd->Request.CDB[0] = SCMD_INQUIRY;
+	smcm->smcm_va_cmd->Request.CDB[1] = 1;
+	smcm->smcm_va_cmd->Request.CDB[2] = 0x83;
+	smcm->smcm_va_cmd->Request.CDB[3] = (SMRT_SATA_INQ83_LEN & 0xff00) >> 8;
+	smcm->smcm_va_cmd->Request.CDB[4] = SMRT_SATA_INQ83_LEN & 0x00ff;
+	smcm->smcm_va_cmd->Request.CDB[5] = 0;
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (r);
+	}
+
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		mutex_exit(&smrt->smrt_mutex);
+		return (r);
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to discover
+		 * logical volumes.  Report failure.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (EIO);
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "physical target "
+			    "SATA WWN error: status 0x%x", ei->CommandStatus);
+			mutex_exit(&smrt->smrt_mutex);
+			smrt_command_free(smcm);
+			return (EIO);
+		}
+		resid = ei->ResidualCnt;
+	} else {
+		resid = 0;
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+
+	/*
+	 * We must have at least 12 bytes.  The first four bytes are the header,
+	 * the next four are for the LUN header, and the last 8 are for the
+	 * actual WWN, which according to SAT-2 will always be first.
+	 */
+	if (SMRT_SATA_INQ83_LEN - resid < 16) {
+		smrt_command_free(smcm);
+		return (EINVAL);
+	}
+	inq = smcm->smcm_internal->smcmi_va;
+
+	/*
+	 * Sanity check we have the right page.
+	 */
+	if (inq[1] != 0x83) {
+		smrt_command_free(smcm);
+		return (EINVAL);
+	}
+
+	/*
+	 * Check to see if we have a proper Network Address Authority (NAA)
+	 * based world wide number for this LUN.  It is possible that firmware
+	 * interposes on this and constructs a fake world wide number (WWN).  If
+	 * this is the case, we don't want to actually use it.  We need to
+	 * verify that the WWN declares the correct naming authority and is of
+	 * the proper length.
+	 */
+	if ((inq[5] & 0x30) != 0 || (inq[5] & 0x0f) != 3 || inq[7] != 8) {
+		smrt_command_free(smcm);
+		return (ENOTSUP);
+	}
+
+	bcopy(&inq[8], &wwn, sizeof (uint64_t));
+	*wwnp = BE_64(wwn);
+
+	smrt_command_free(smcm);
+
+	return (0);
+}
diff --git a/usr/src/uts/common/io/scsi/targets/sd.c b/usr/src/uts/common/io/scsi/targets/sd.c
index 64b3b1a6dd..3a3494aa50 100644
--- a/usr/src/uts/common/io/scsi/targets/sd.c
+++ b/usr/src/uts/common/io/scsi/targets/sd.c
@@ -26,6 +26,7 @@
  * Copyright (c) 2011 Bayard G. Bell.  All rights reserved.
  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  * Copyright 2017 Nexenta Systems, Inc.
  */
 /*
@@ -3476,9 +3477,13 @@ sd_set_mmc_caps(sd_ssc_t *ssc)
 		 * according to the successful response to the page
 		 * 0x2A mode sense request.
 		 */
-		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
-		    "sd_set_mmc_caps: Mode Sense returned "
-		    "invalid block descriptor length\n");
+		/*
+		 * The following warning occurs due to the KVM CD-ROM
+		 * mishandling the multi-media commands.  Ignore it.
+		 * scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
+		 *     "sd_set_mmc_caps: Mode Sense returned "
+		 *     "invalid block descriptor length\n");
+		 */
 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
 		return;
 	}
@@ -4423,18 +4428,77 @@ sd_sdconf_id_match(struct sd_lun *un, char *id, int idlen)
 {
 	struct scsi_inquiry	*sd_inq;
 	int 			rval = SD_SUCCESS;
+	char			*p;
+	int			chk_vidlen = 0, chk_pidlen = 0;
+	int			has_tail = 0;
+	static const int	VSZ = sizeof (sd_inq->inq_vid);
+	static const int	PSZ = sizeof (sd_inq->inq_pid);
 
 	ASSERT(un != NULL);
 	sd_inq = un->un_sd->sd_inq;
 	ASSERT(id != NULL);
 
 	/*
-	 * We use the inq_vid as a pointer to a buffer containing the
-	 * vid and pid and use the entire vid/pid length of the table
-	 * entry for the comparison. This works because the inq_pid
-	 * data member follows inq_vid in the scsi_inquiry structure.
+	 * We would like to use the inq_vid as a pointer to a buffer
+	 * containing the vid and pid and use the entire vid/pid length of
+	 * the table entry for the comparison.  However, this does not work
+	 * because, while the inq_pid data member follows inq_vid in the
+	 * scsi_inquiry structure, we do not control the contents of this
+	 * buffer, and some broken devices violate SPC 4.3.1 and return
+	 * fields with null bytes in them.
 	 */
-	if (strncasecmp(sd_inq->inq_vid, id, idlen) != 0) {
+	chk_vidlen = MIN(VSZ, idlen);
+	p = id + chk_vidlen - 1;
+	while (*p == ' ' && chk_vidlen > 0) {
+		--p;
+		--chk_vidlen;
+	}
+
+	/*
+	 * If it's all spaces, check the whole thing.
+	 */
+	if (chk_vidlen == 0)
+		chk_vidlen = MIN(VSZ, idlen);
+
+	if (idlen > VSZ) {
+		chk_pidlen = idlen - VSZ;
+		p = id + idlen - 1;
+		while (*p == ' ' && chk_pidlen > 0) {
+			--p;
+			--chk_pidlen;
+		}
+		if (chk_pidlen == 0)
+			chk_pidlen = MIN(PSZ, idlen - VSZ);
+	}
+
+	/*
+	 * There's one more thing we need to do here.  If the user specified
+	 * an ID with trailing spaces, we need to make sure the inquiry
+	 * vid/pid has only spaces or NULs after the check length; otherwise, it
+	 * can't match.
+	 */
+	if (idlen > chk_vidlen && chk_vidlen < VSZ) {
+		for (p = sd_inq->inq_vid + chk_vidlen;
+		    p < sd_inq->inq_vid + VSZ; ++p) {
+			if (*p != ' ' && *p != '\0') {
+				++has_tail;
+				break;
+			}
+		}
+	}
+	if (idlen > chk_pidlen + VSZ && chk_pidlen < PSZ) {
+		for (p = sd_inq->inq_pid + chk_pidlen;
+		    p < sd_inq->inq_pid + PSZ; ++p) {
+			if (*p != ' ' && *p != '\0') {
+				++has_tail;
+				break;
+			}
+		}
+	}
+
+	if (has_tail || strncasecmp(sd_inq->inq_vid, id, chk_vidlen) != 0 ||
+	    (idlen > VSZ &&
+	    strncasecmp(sd_inq->inq_pid, id + VSZ, chk_pidlen) != 0)) {
 		/*
 		 * The user id string is compared to the inquiry vid/pid
 		 * using a case insensitive comparison and ignoring
@@ -6613,7 +6677,7 @@ sdpower(dev_info_t *devi, int component, int level)
 	time_t		intvlp;
 	struct pm_trans_data	sd_pm_tran_data;
 	uchar_t		save_state = SD_STATE_NORMAL;
-	int		sval;
+	int		sval, tursval = 0;
 	uchar_t		state_before_pm;
 	int		got_semaphore_here;
 	sd_ssc_t	*ssc;
@@ -6930,9 +6994,9 @@ sdpower(dev_info_t *devi, int component, int level)
 	 * a deadlock on un_pm_busy_cv will occur.
 	 */
 	if (SD_PM_IS_IO_CAPABLE(un, level)) {
-		sval = sd_send_scsi_TEST_UNIT_READY(ssc,
+		tursval = sd_send_scsi_TEST_UNIT_READY(ssc,
 		    SD_DONT_RETRY_TUR | SD_BYPASS_PM);
-		if (sval != 0)
+		if (tursval != 0)
 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
 	}
 
@@ -6956,6 +7020,21 @@ sdpower(dev_info_t *devi, int component, int level)
 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
 		else
 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
+
+	}
+
+	/*
+	 * We've encountered certain classes of drives that pass a TUR, but fail
+	 * the START STOP UNIT when using power conditions. Strictly speaking,
+	 * for SPC-4 or greater, no additional actions are required to make the
+	 * drive operational when a TUR passes. If we have something that
+	 * matches this condition, we continue on and presume the drive is
+	 * successfully powered on.
+	 */
+	if (un->un_f_power_condition_supported && sval == ENOTSUP &&
+	    SD_SCSI_VERS_IS_GE_SPC_4(un) && SD_PM_IS_IO_CAPABLE(un, level) &&
+	    level == SD_SPINDLE_ACTIVE && tursval == 0) {
+		sval = 0;
 	}
 
 	/* Command failed, check for media present. */
@@ -14077,15 +14156,21 @@ sd_initpkt_for_uscsi(struct buf *bp, struct scsi_pkt **pktpp)
 
 	/*
 	 * Allocate the scsi_pkt for the command.
+	 *
 	 * Note: If PKT_DMA_PARTIAL flag is set, scsi_vhci binds a path
 	 *	 during scsi_init_pkt time and will continue to use the
 	 *	 same path as long as the same scsi_pkt is used without
-	 *	 intervening scsi_dma_free(). Since uscsi command does
+	 *	 intervening scsi_dmafree(). Since uscsi command does
 	 *	 not call scsi_dmafree() before retry failed command, it
 	 *	 is necessary to make sure PKT_DMA_PARTIAL flag is NOT
 	 *	 set such that scsi_vhci can use other available path for
 	 *	 retry. Besides, ucsci command does not allow DMA breakup,
 	 *	 so there is no need to set PKT_DMA_PARTIAL flag.
+	 *
+	 *	 More fundamentally, we can't support breaking up this DMA into
+	 *	 multiple windows on x86. There is, in general, no guarantee
+	 *	 that arbitrary SCSI commands are idempotent, which is required
+	 *	 if we want to use multiple windows for a given command.
 	 */
 	if (uscmd->uscsi_rqlen > SENSE_LENGTH) {
 		pktp = scsi_init_pkt(SD_ADDRESS(un), NULL,
@@ -22303,6 +22388,7 @@ sdioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cred_p, int *rval_p)
 		case MHIOCGRP_REGISTERANDIGNOREKEY:
 		case CDROMCLOSETRAY:
 		case USCSICMD:
+		case USCSIMAXXFER:
 			goto skip_ready_valid;
 		default:
 			break;
@@ -22739,6 +22825,23 @@ skip_ready_valid:
 		}
 		break;
 
+	case USCSIMAXXFER:
+		SD_TRACE(SD_LOG_IOCTL, un, "USCSIMAXXFER\n");
+		cr = ddi_get_cred();
+		if ((drv_priv(cred_p) != 0) && (drv_priv(cr) != 0)) {
+			err = EPERM;
+		} else {
+			const uscsi_xfer_t xfer = un->un_max_xfer_size;
+
+			if (ddi_copyout(&xfer, (void *)arg, sizeof (xfer),
+			    flag) != 0) {
+				err = EFAULT;
+			} else {
+				err = 0;
+			}
+		}
+		break;
+
 	case CDROMPAUSE:
 	case CDROMRESUME:
 		SD_TRACE(SD_LOG_IOCTL, un, "PAUSE-RESUME\n");
@@ -30904,7 +31007,7 @@ sd_set_unit_attributes(struct sd_lun *un, dev_info_t *devi)
 		if (SD_PM_CAPABLE_IS_UNDEFINED(pm_cap)) {
 			un->un_f_log_sense_supported = TRUE;
 			if (!un->un_f_power_condition_disabled &&
-			    SD_INQUIRY(un)->inq_ansi == 6) {
+			    SD_SCSI_VERS_IS_GE_SPC_4(un)) {
 				un->un_f_power_condition_supported = TRUE;
 			}
 		} else {
@@ -30922,7 +31025,7 @@ sd_set_unit_attributes(struct sd_lun *un, dev_info_t *devi)
 				/* SD_PM_CAPABLE_IS_TRUE case */
 				un->un_f_pm_supported = TRUE;
 				if (!un->un_f_power_condition_disabled &&
-				    SD_PM_CAPABLE_IS_SPC_4(pm_cap)) {
+				    (SD_PM_CAPABLE_IS_GE_SPC_4(pm_cap))) {
 					un->un_f_power_condition_supported =
 					    TRUE;
 				}
diff --git a/usr/src/uts/common/io/signalfd.c b/usr/src/uts/common/io/signalfd.c
index 6416d6d45a..2a1cf25917 100644
--- a/usr/src/uts/common/io/signalfd.c
+++ b/usr/src/uts/common/io/signalfd.c
@@ -107,6 +107,7 @@
 #include <sys/schedctl.h>
 #include <sys/id_space.h>
 #include <sys/sdt.h>
+#include <sys/brand.h>
 #include <sys/disp.h>
 #include <sys/taskq_impl.h>
 
@@ -459,6 +460,9 @@ consume_signal(k_sigset_t set, uio_t *uio, boolean_t block)
 	lwp->lwp_extsig = 0;
 	mutex_exit(&p->p_lock);
 
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_sigfd_translate)
+		BROP(p)->b_sigfd_translate(infop);
+
 	/* Convert k_siginfo into external, datamodel independent, struct. */
 	bzero(ssp, sizeof (*ssp));
 	ssp->ssi_signo = infop->si_signo;
diff --git a/usr/src/uts/common/io/stream.c b/usr/src/uts/common/io/stream.c
index e9af19ca18..994ca8baa8 100644
--- a/usr/src/uts/common/io/stream.c
+++ b/usr/src/uts/common/io/stream.c
@@ -1451,6 +1451,16 @@ copyb(mblk_t *bp)
 	ndp = nbp->b_datap;
 
 	/*
+	 * Copy the various checksum information that came in
+	 * originally.
+	 */
+	ndp->db_cksumstart = dp->db_cksumstart;
+	ndp->db_cksumend = dp->db_cksumend;
+	ndp->db_cksumstuff = dp->db_cksumstuff;
+	bcopy(dp->db_struioun.data, ndp->db_struioun.data,
+	    sizeof (dp->db_struioun.data));
+
+	/*
 	 * Well, here is a potential issue.  If we are trying to
 	 * trace a flow, and we copy the message, we might lose
 	 * information about where this message might have been.
diff --git a/usr/src/uts/common/io/tl.c b/usr/src/uts/common/io/tl.c
index 1bdddf2ecf..8dd64a4b89 100644
--- a/usr/src/uts/common/io/tl.c
+++ b/usr/src/uts/common/io/tl.c
@@ -25,7 +25,7 @@
 /*
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
- * Copyright 2015 Joyent, Inc.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 /*
@@ -1419,8 +1419,9 @@ tl_closeok(tl_endpt_t *tep)
 static int
 tl_open(queue_t	*rq, dev_t *devp, int oflag, int sflag,	cred_t	*credp)
 {
-	tl_endpt_t *tep;
-	minor_t	    minor = getminor(*devp);
+	tl_endpt_t	*tep;
+	minor_t		minor = getminor(*devp);
+	id_t		inst_minor;
 
 	/*
 	 * Driver is called directly. Both CLONEOPEN and MODOPEN
@@ -1440,6 +1441,14 @@ tl_open(queue_t	*rq, dev_t *devp, int oflag, int sflag,	cred_t	*credp)
 		minor |= TL_SOCKET;
 	}
 
+	/*
+	 * Attempt to allocate a unique minor number for this instance.
+	 * Avoid an uninterruptable sleep if none are available.
+	 */
+	if ((inst_minor = id_alloc_nosleep(tl_minors)) == -1) {
+		return (ENOMEM);
+	}
+
 	tep = kmem_cache_alloc(tl_cache, KM_SLEEP);
 	tep->te_refcnt = 1;
 	tep->te_cpid = curproc->p_pid;
@@ -1451,9 +1460,7 @@ tl_open(queue_t	*rq, dev_t *devp, int oflag, int sflag,	cred_t	*credp)
 
 	tep->te_flag = minor & TL_MINOR_MASK;
 	tep->te_transport = &tl_transports[minor];
-
-	/* Allocate a unique minor number for this instance. */
-	tep->te_minor = (minor_t)id_alloc(tl_minors);
+	tep->te_minor = (minor_t)inst_minor;
 
 	/* Reserve hash handle for bind(). */
 	(void) mod_hash_reserve(tep->te_addrhash, &tep->te_hash_hndl);
diff --git a/usr/src/uts/common/io/usb/clients/hid/hid.c b/usr/src/uts/common/io/usb/clients/hid/hid.c
index 084fa7fedc..eccd48bf08 100644
--- a/usr/src/uts/common/io/usb/clients/hid/hid.c
+++ b/usr/src/uts/common/io/usb/clients/hid/hid.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2017 Joyent, Inc.
  */
 
 
@@ -139,6 +139,12 @@ static int	hid_info(dev_info_t *, ddi_info_cmd_t, void *, void **);
 static int	hid_attach(dev_info_t *, ddi_attach_cmd_t);
 static int	hid_detach(dev_info_t *, ddi_detach_cmd_t);
 static int	hid_power(dev_info_t *, int, int);
+/* These are to enable ugen support: */
+static int	hid_chropen(dev_t *, int, int, cred_t *);
+static int	hid_chrclose(dev_t, int, int, cred_t *);
+static int	hid_read(dev_t, struct uio *, cred_t *);
+static int	hid_write(dev_t, struct uio *, cred_t *);
+static int	hid_poll(dev_t, short, int, short *, struct pollhead **);
 
 /*
  * Warlock is not aware of the automatic locking mechanisms for
@@ -198,18 +204,18 @@ struct streamtab hid_streamtab = {
 };
 
 struct cb_ops hid_cb_ops = {
-	nulldev,		/* open  */
-	nulldev,		/* close */
+	hid_chropen,		/* open  */
+	hid_chrclose,		/* close */
 	nulldev,		/* strategy */
 	nulldev,		/* print */
 	nulldev,		/* dump */
-	nulldev,		/* read */
-	nulldev,		/* write */
+	hid_read,		/* read */
+	hid_write,		/* write */
 	nulldev,		/* ioctl */
 	nulldev,		/* devmap */
 	nulldev,		/* mmap */
 	nulldev,		/* segmap */
-	nochpoll,		/* poll */
+	hid_poll,		/* poll */
 	ddi_prop_op,		/* cb_prop_op */
 	&hid_streamtab,		/* streamtab  */
 	D_MP | D_MTPERQ
@@ -349,6 +355,7 @@ hid_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
 	usb_alt_if_data_t	*altif_data;
 	char			minor_name[HID_MINOR_NAME_LEN];
 	usb_ep_data_t		*ep_data;
+	usb_ugen_info_t 	usb_ugen_info;
 
 	switch (cmd) {
 		case DDI_ATTACH:
@@ -491,6 +498,28 @@ hid_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
 	usb_free_dev_data(dip, dev_data);
 	hidp->hid_dev_data = NULL;
 
+	if (usb_owns_device(dip)) {
+		/* Get a ugen handle. */
+		bzero(&usb_ugen_info, sizeof (usb_ugen_info));
+
+		usb_ugen_info.usb_ugen_flags = 0;
+		usb_ugen_info.usb_ugen_minor_node_ugen_bits_mask =
+		    (dev_t)HID_MINOR_UGEN_BITS_MASK;
+		usb_ugen_info.usb_ugen_minor_node_instance_mask =
+		    (dev_t)HID_MINOR_INSTANCE_MASK;
+		hidp->hid_ugen_hdl = usb_ugen_get_hdl(dip, &usb_ugen_info);
+
+		if (usb_ugen_attach(hidp->hid_ugen_hdl, cmd) !=
+		    USB_SUCCESS) {
+			USB_DPRINTF_L2(PRINT_MASK_ATTA,
+			    hidp->hid_log_handle,
+			    "usb_ugen_attach failed");
+
+			usb_ugen_release_hdl(hidp->hid_ugen_hdl);
+			hidp->hid_ugen_hdl = NULL;
+		}
+	}
+
 	/*
 	 * Don't get the report descriptor if parsing hid descriptor earlier
 	 * failed since device probably won't return valid report descriptor
@@ -769,6 +798,149 @@ hid_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
 	return (rval);
 }
 
+static int
+hid_chropen(dev_t *devp, int flag, int sflag, cred_t *credp)
+{
+	int rval;
+	minor_t minor = getminor(*devp);
+	int instance;
+	hid_state_t *hidp;
+
+	instance = HID_MINOR_TO_INSTANCE(minor);
+
+	hidp = ddi_get_soft_state(hid_statep, instance);
+	if (hidp == NULL) {
+		return (ENXIO);
+	}
+
+	if (!HID_IS_UGEN_OPEN(minor)) {
+		return (ENXIO);
+	}
+
+	hid_pm_busy_component(hidp);
+	(void) pm_raise_power(hidp->hid_dip, 0, USB_DEV_OS_FULL_PWR);
+
+	mutex_enter(&hidp->hid_mutex);
+
+	rval = usb_ugen_open(hidp->hid_ugen_hdl, devp, flag,
+	    sflag, credp);
+
+	mutex_exit(&hidp->hid_mutex);
+
+	if (rval != 0) {
+		hid_pm_idle_component(hidp);
+	}
+
+	return (rval);
+}
+
+static int
+hid_chrclose(dev_t dev, int flag, int otyp, cred_t *credp)
+{
+	int rval;
+	minor_t minor = getminor(dev);
+	int instance;
+	hid_state_t *hidp;
+
+	instance = HID_MINOR_TO_INSTANCE(minor);
+
+	hidp = ddi_get_soft_state(hid_statep, instance);
+	if (hidp == NULL) {
+		return (ENXIO);
+	}
+
+	if (!HID_IS_UGEN_OPEN(minor)) {
+		return (ENXIO);
+	}
+
+	mutex_enter(&hidp->hid_mutex);
+
+	rval = usb_ugen_close(hidp->hid_ugen_hdl, dev, flag,
+	    otyp, credp);
+
+	mutex_exit(&hidp->hid_mutex);
+
+	if (rval == 0) {
+		hid_pm_idle_component(hidp);
+	}
+
+	return (rval);
+}
+
+static int
+hid_read(dev_t dev, struct uio *uiop, cred_t *credp)
+{
+	int rval;
+	minor_t minor = getminor(dev);
+	int instance;
+	hid_state_t *hidp;
+
+	instance = HID_MINOR_TO_INSTANCE(minor);
+
+	hidp = ddi_get_soft_state(hid_statep, instance);
+	if (hidp == NULL) {
+		return (ENXIO);
+	}
+
+	if (!HID_IS_UGEN_OPEN(minor)) {
+		return (ENXIO);
+	}
+
+	rval = usb_ugen_read(hidp->hid_ugen_hdl, dev, uiop, credp);
+
+	return (rval);
+}
+
+static int
+hid_write(dev_t dev, struct uio *uiop, cred_t *credp)
+{
+	int rval;
+	minor_t minor = getminor(dev);
+	int instance;
+	hid_state_t *hidp;
+
+	instance = HID_MINOR_TO_INSTANCE(minor);
+
+	hidp = ddi_get_soft_state(hid_statep, instance);
+	if (hidp == NULL) {
+		return (ENXIO);
+	}
+
+	if (!HID_IS_UGEN_OPEN(minor)) {
+		return (ENXIO);
+	}
+
+	rval = usb_ugen_write(hidp->hid_ugen_hdl, dev, uiop, credp);
+
+	return (rval);
+}
+
+static int
+hid_poll(dev_t dev, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp)
+{
+	int rval;
+	minor_t minor = getminor(dev);
+	int instance;
+	hid_state_t *hidp;
+
+	instance = HID_MINOR_TO_INSTANCE(minor);
+
+	hidp = ddi_get_soft_state(hid_statep, instance);
+	if (hidp == NULL) {
+		return (ENXIO);
+	}
+
+	if (!HID_IS_UGEN_OPEN(minor)) {
+		return (ENXIO);
+	}
+
+	rval = usb_ugen_poll(hidp->hid_ugen_hdl, dev, events, anyyet,
+	    reventsp, phpp);
+
+	return (rval);
+}
+
 /*
  * hid_open :
  *	Open entry point: Opens the interrupt pipe.  Sets up queues.
@@ -787,13 +959,21 @@ hid_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
 
 	hidp = ddi_get_soft_state(hid_statep, instance);
 	if (hidp == NULL) {
-
 		return (ENXIO);
 	}
 
 	USB_DPRINTF_L4(PRINT_MASK_OPEN, hidp->hid_log_handle,
 	    "hid_open: Begin");
 
+	/*
+	 * If this is a ugen device, return ENOSTR (no streams). This will
+	 * cause spec_open to try hid_chropen from our regular ops_cb instead
+	 * (and thus treat us as a plain character device).
+	 */
+	if (HID_IS_UGEN_OPEN(minor)) {
+		return (ENOSTR);
+	}
+
 	if (sflag) {
 		/* clone open NOT supported here */
 		return (ENXIO);
@@ -803,6 +983,8 @@ hid_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
 		return (EIO);
 	}
 
+	mutex_enter(&hidp->hid_mutex);
+
 	/*
 	 * This is a workaround:
 	 *	Currently, if we open an already disconnected device, and send
@@ -812,7 +994,6 @@ hid_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
 	 *	The consconfig_dacf module need this interface to detect if the
 	 *	device is already disconnnected.
 	 */
-	mutex_enter(&hidp->hid_mutex);
 	if (HID_IS_INTERNAL_OPEN(minor) &&
 	    (hidp->hid_dev_state == USB_DEV_DISCONNECTED)) {
 		mutex_exit(&hidp->hid_mutex);
@@ -1688,6 +1869,11 @@ hid_cpr_suspend(hid_state_t *hidp)
 	}
 	mutex_exit(&hidp->hid_mutex);
 
+	if ((retval == USB_SUCCESS) && hidp->hid_ugen_hdl != NULL) {
+		retval = usb_ugen_detach(hidp->hid_ugen_hdl,
+		    DDI_SUSPEND);
+	}
+
 	return (retval);
 }
 
@@ -1699,6 +1885,10 @@ hid_cpr_resume(hid_state_t *hidp)
 	    "hid_cpr_resume: dip=0x%p", (void *)hidp->hid_dip);
 
 	hid_restore_device_state(hidp->hid_dip, hidp);
+
+	if (hidp->hid_ugen_hdl != NULL) {
+		(void) usb_ugen_attach(hidp->hid_ugen_hdl, DDI_RESUME);
+	}
 }
 
 
@@ -2136,6 +2326,12 @@ hid_detach_cleanup(dev_info_t *dip, hid_state_t *hidp)
 		hidp->hid_pm = NULL;
 	}
 
+	if (hidp->hid_ugen_hdl != NULL) {
+		rval = usb_ugen_detach(hidp->hid_ugen_hdl, DDI_DETACH);
+		VERIFY0(rval);
+		usb_ugen_release_hdl(hidp->hid_ugen_hdl);
+	}
+
 	mutex_exit(&hidp->hid_mutex);
 
 	if (hidp->hid_report_descr != NULL) {
diff --git a/usr/src/uts/common/io/vioblk/vioblk.c b/usr/src/uts/common/io/vioblk/vioblk.c
index 141a3eddb6..aeabada516 100644
--- a/usr/src/uts/common/io/vioblk/vioblk.c
+++ b/usr/src/uts/common/io/vioblk/vioblk.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2015, Nexenta Systems, Inc. All rights reserved.
  * Copyright (c) 2012, Alexey Zaytsev <alexey.zaytsev@gmail.com>
+ * Copyright 2017, Joyent Inc.
  */
 
 
@@ -829,13 +830,11 @@ vioblk_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
 	case DDI_RESUME:
 	case DDI_PM_RESUME:
 		dev_err(devinfo, CE_WARN, "resume not supported yet");
-		ret = DDI_FAILURE;
-		goto exit;
+		return (DDI_FAILURE);
 
 	default:
 		dev_err(devinfo, CE_WARN, "cmd 0x%x not recognized", cmd);
-		ret = DDI_FAILURE;
-		goto exit;
+		return (DDI_FAILURE);
 	}
 
 	sc = kmem_zalloc(sizeof (struct vioblk_softc), KM_SLEEP);
@@ -1029,8 +1028,7 @@ exit_intrstat:
 	mutex_destroy(&sc->lock_devid);
 	cv_destroy(&sc->cv_devid);
 	kmem_free(sc, sizeof (struct vioblk_softc));
-exit:
-	return (ret);
+	return (DDI_FAILURE);
 }
 
 static int
diff --git a/usr/src/uts/common/io/vioif/vioif.c b/usr/src/uts/common/io/vioif/vioif.c
index e5095a16ad..45fded9b74 100644
--- a/usr/src/uts/common/io/vioif/vioif.c
+++ b/usr/src/uts/common/io/vioif/vioif.c
@@ -11,6 +11,7 @@
 
 /*
  * Copyright 2013 Nexenta Inc.  All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  * Copyright (c) 2014, 2016 by Delphix. All rights reserved.
  */
 
@@ -284,6 +285,13 @@ struct vioif_softc {
 	unsigned int		sc_tx_csum:1;
 	unsigned int		sc_tx_tso4:1;
 
+	/*
+	 * For debugging, it is useful to know whether the MAC address we
+	 * are using came from the host (via VIRTIO_NET_CONFIG_MAC) or
+	 * was otherwise generated or set from within the guest.
+	 */
+	unsigned int		sc_mac_from_host:1;
+
 	int			sc_mtu;
 	uint8_t			sc_mac[ETHERADDRL];
 	/*
@@ -311,7 +319,10 @@ struct vioif_softc {
 	/* Copying small packets turns out to be faster then mapping them. */
 	unsigned long		sc_rxcopy_thresh;
 	unsigned long		sc_txcopy_thresh;
-	/* Some statistic coming here */
+
+	/*
+	 * Statistics visible through mac:
+	 */
 	uint64_t		sc_ipackets;
 	uint64_t		sc_opackets;
 	uint64_t		sc_rbytes;
@@ -324,6 +335,18 @@ struct vioif_softc {
 	uint64_t		sc_notxbuf;
 	uint64_t		sc_ierrors;
 	uint64_t		sc_oerrors;
+
+	/*
+	 * Internal debugging statistics:
+	 */
+	uint64_t		sc_rxfail_dma_handle;
+	uint64_t		sc_rxfail_dma_buffer;
+	uint64_t		sc_rxfail_dma_bind;
+	uint64_t		sc_rxfail_chain_undersize;
+	uint64_t		sc_rxfail_no_descriptors;
+	uint64_t		sc_txfail_dma_handle;
+	uint64_t		sc_txfail_dma_bind;
+	uint64_t		sc_txfail_indirect_limit;
 };
 
 #define	ETHER_HEADER_LEN		sizeof (struct ether_header)
@@ -473,8 +496,7 @@ vioif_rx_construct(void *buffer, void *user_arg, int kmflags)
 
 	if (ddi_dma_alloc_handle(sc->sc_dev, &vioif_mapped_buf_dma_attr,
 	    DDI_DMA_SLEEP, NULL, &buf->rb_mapping.vbm_dmah)) {
-		dev_err(sc->sc_dev, CE_WARN,
-		    "Can't allocate dma handle for rx buffer");
+		sc->sc_rxfail_dma_handle++;
 		goto exit_handle;
 	}
 
@@ -482,8 +504,7 @@ vioif_rx_construct(void *buffer, void *user_arg, int kmflags)
 	    VIOIF_RX_SIZE + sizeof (struct virtio_net_hdr),
 	    &vioif_bufattr, DDI_DMA_STREAMING, DDI_DMA_SLEEP,
 	    NULL, &buf->rb_mapping.vbm_buf, &len, &buf->rb_mapping.vbm_acch)) {
-		dev_err(sc->sc_dev, CE_WARN,
-		    "Can't allocate rx buffer");
+		sc->sc_rxfail_dma_buffer++;
 		goto exit_alloc;
 	}
 	ASSERT(len >= VIOIF_RX_SIZE);
@@ -492,8 +513,7 @@ vioif_rx_construct(void *buffer, void *user_arg, int kmflags)
 	    buf->rb_mapping.vbm_buf, len, DDI_DMA_READ | DDI_DMA_STREAMING,
 	    DDI_DMA_SLEEP, NULL, &buf->rb_mapping.vbm_dmac,
 	    &buf->rb_mapping.vbm_ncookies)) {
-		dev_err(sc->sc_dev, CE_WARN, "Can't bind tx buffer");
-
+		sc->sc_rxfail_dma_bind++;
 		goto exit_bind;
 	}
 
@@ -724,9 +744,7 @@ vioif_add_rx(struct vioif_softc *sc, int kmflag)
 		}
 
 		/* Still nothing? Bye. */
-		if (!buf) {
-			dev_err(sc->sc_dev, CE_WARN,
-			    "Can't allocate rx buffer");
+		if (buf == NULL) {
 			sc->sc_norecvbuf++;
 			vq_free_entry(sc->sc_rx_vq, ve);
 			break;
@@ -800,8 +818,7 @@ vioif_process_rx(struct vioif_softc *sc)
 		ASSERT(buf);
 
 		if (len < sizeof (struct virtio_net_hdr)) {
-			dev_err(sc->sc_dev, CE_WARN, "RX: Cnain too small: %u",
-			    len - (uint32_t)sizeof (struct virtio_net_hdr));
+			sc->sc_rxfail_chain_undersize++;
 			sc->sc_ierrors++;
 			virtio_free_chain(ve);
 			continue;
@@ -815,7 +832,7 @@ vioif_process_rx(struct vioif_softc *sc)
 		 */
 		if (len < sc->sc_rxcopy_thresh) {
 			mp = allocb(len, 0);
-			if (!mp) {
+			if (mp == NULL) {
 				sc->sc_norecvbuf++;
 				sc->sc_ierrors++;
 
@@ -832,7 +849,7 @@ vioif_process_rx(struct vioif_softc *sc)
 			    buf->rb_mapping.vbm_buf +
 			    sizeof (struct virtio_net_hdr) +
 			    VIOIF_IP_ALIGN, len, 0, &buf->rb_frtn);
-			if (!mp) {
+			if (mp == NULL) {
 				sc->sc_norecvbuf++;
 				sc->sc_ierrors++;
 
@@ -892,22 +909,23 @@ vioif_reclaim_used_tx(struct vioif_softc *sc)
 
 	while ((ve = virtio_pull_chain(sc->sc_tx_vq, &len))) {
 		/* We don't chain descriptors for tx, so don't expect any. */
-		ASSERT(!ve->qe_next);
+		ASSERT(ve->qe_next == NULL);
 
 		buf = &sc->sc_txbufs[ve->qe_index];
 		mp = buf->tb_mp;
 		buf->tb_mp = NULL;
 
-		if (mp) {
-			for (int i = 0; i < buf->tb_external_num; i++)
+		if (mp != NULL) {
+			for (int i = 0; i < buf->tb_external_num; i++) {
 				(void) ddi_dma_unbind_handle(
 				    buf->tb_external_mapping[i].vbm_dmah);
+			}
 		}
 
 		virtio_free_chain(ve);
 
 		/* External mapping used, mp was not freed in vioif_send() */
-		if (mp)
+		if (mp != NULL)
 			freemsg(mp);
 		num_reclaimed++;
 	}
@@ -951,8 +969,7 @@ vioif_tx_lazy_handle_alloc(struct vioif_softc *sc, struct vioif_tx_buf *buf,
 		    &vioif_mapped_buf_dma_attr, DDI_DMA_SLEEP, NULL,
 		    &buf->tb_external_mapping[i].vbm_dmah);
 		if (ret != DDI_SUCCESS) {
-			dev_err(sc->sc_dev, CE_WARN,
-			    "Can't allocate dma handle for external tx buffer");
+			sc->sc_txfail_dma_handle++;
 		}
 	}
 
@@ -1006,17 +1023,14 @@ vioif_tx_external(struct vioif_softc *sc, struct vq_entry *ve, mblk_t *mp,
 		    DDI_DMA_SLEEP, NULL, &dmac, &ncookies);
 
 		if (ret != DDI_SUCCESS) {
+			sc->sc_txfail_dma_bind++;
 			sc->sc_oerrors++;
-			dev_err(sc->sc_dev, CE_NOTE,
-			    "TX: Failed to bind external handle");
 			goto exit_bind;
 		}
 
 		/* Check if we still fit into the indirect table. */
 		if (virtio_ve_indirect_available(ve) < ncookies) {
-			dev_err(sc->sc_dev, CE_NOTE,
-			    "TX: Indirect descriptor table limit reached."
-			    " It took %d fragments.", i);
+			sc->sc_txfail_indirect_limit++;
 			sc->sc_notxbuf++;
 			sc->sc_oerrors++;
 
@@ -1075,7 +1089,7 @@ vioif_send(struct vioif_softc *sc, mblk_t *mp)
 
 	ve = vq_alloc_entry(sc->sc_tx_vq);
 
-	if (!ve) {
+	if (ve == NULL) {
 		sc->sc_notxbuf++;
 		/* Out of free descriptors - try later. */
 		return (B_FALSE);
@@ -1127,9 +1141,9 @@ vioif_send(struct vioif_softc *sc, mblk_t *mp)
 	/* meanwhile update the statistic */
 	if (mp->b_rptr[0] & 0x1) {
 		if (bcmp(mp->b_rptr, vioif_broadcast, ETHERADDRL) != 0)
-				sc->sc_multixmt++;
-			else
-				sc->sc_brdcstxmt++;
+			sc->sc_multixmt++;
+		else
+			sc->sc_brdcstxmt++;
 	}
 
 	/*
@@ -1193,8 +1207,7 @@ vioif_start(void *arg)
 	struct vq_entry *ve;
 	uint32_t len;
 
-	mac_link_update(sc->sc_mac_handle,
-	    vioif_link_state(sc));
+	mac_link_update(sc->sc_mac_handle, vioif_link_state(sc));
 
 	virtio_start_vq_intr(sc->sc_rx_vq);
 
@@ -1410,10 +1423,8 @@ vioif_propinfo(void *arg, const char *pr_name, mac_prop_id_t pr_num,
 	case MAC_PROP_PRIVATE:
 		bzero(valstr, sizeof (valstr));
 		if (strcmp(pr_name, vioif_txcopy_thresh) == 0) {
-
 			value = sc->sc_txcopy_thresh;
-		} else	if (strcmp(pr_name,
-		    vioif_rxcopy_thresh) == 0) {
+		} else if (strcmp(pr_name, vioif_rxcopy_thresh) == 0) {
 			value = sc->sc_rxcopy_thresh;
 		} else {
 			return;
@@ -1489,7 +1500,6 @@ vioif_show_features(struct vioif_softc *sc, const char *prefix,
 	bufp += virtio_show_features(features, bufp, bufend - bufp);
 	*bufp = '\0';
 
-
 	/* Using '!' to only CE_NOTE this to the system log. */
 	dev_err(sc->sc_dev, CE_NOTE, "!%s Vioif (%b)", buf, features,
 	    VIRTIO_NET_FEATURE_BITS);
@@ -1518,8 +1528,8 @@ vioif_dev_features(struct vioif_softc *sc)
 	    sc->sc_virtio.sc_features);
 
 	if (!(sc->sc_virtio.sc_features & VIRTIO_F_RING_INDIRECT_DESC)) {
-		dev_err(sc->sc_dev, CE_NOTE,
-		    "Host does not support RING_INDIRECT_DESC, bye.");
+		dev_err(sc->sc_dev, CE_WARN,
+		    "Host does not support RING_INDIRECT_DESC. Cannot attach.");
 		return (DDI_FAILURE);
 	}
 
@@ -1541,6 +1551,7 @@ vioif_set_mac(struct vioif_softc *sc)
 		virtio_write_device_config_1(&sc->sc_virtio,
 		    VIRTIO_NET_CONFIG_MAC + i, sc->sc_mac[i]);
 	}
+	sc->sc_mac_from_host = 0;
 }
 
 /* Get the mac address out of the hardware, or make up one. */
@@ -1554,8 +1565,7 @@ vioif_get_mac(struct vioif_softc *sc)
 			    &sc->sc_virtio,
 			    VIRTIO_NET_CONFIG_MAC + i);
 		}
-		dev_err(sc->sc_dev, CE_NOTE, "Got MAC address from host: %s",
-		    ether_sprintf((struct ether_addr *)sc->sc_mac));
+		sc->sc_mac_from_host = 1;
 	} else {
 		/* Get a few random bytes */
 		(void) random_get_pseudo_bytes(sc->sc_mac, ETHERADDRL);
@@ -1567,7 +1577,7 @@ vioif_get_mac(struct vioif_softc *sc)
 		vioif_set_mac(sc);
 
 		dev_err(sc->sc_dev, CE_NOTE,
-		    "Generated a random MAC address: %s",
+		    "!Generated a random MAC address: %s",
 		    ether_sprintf((struct ether_addr *)sc->sc_mac));
 	}
 }
@@ -1640,7 +1650,7 @@ vioif_check_features(struct vioif_softc *sc)
 		if (!vioif_has_feature(sc, VIRTIO_NET_F_GUEST_CSUM)) {
 			sc->sc_rx_csum = 0;
 		}
-		cmn_err(CE_NOTE, "Csum enabled.");
+		dev_err(sc->sc_dev, CE_NOTE, "!Csum enabled.");
 
 		if (vioif_has_feature(sc, VIRTIO_NET_F_HOST_TSO4)) {
 
@@ -1654,11 +1664,11 @@ vioif_check_features(struct vioif_softc *sc)
 			 */
 			if (!vioif_has_feature(sc, VIRTIO_NET_F_HOST_ECN)) {
 				dev_err(sc->sc_dev, CE_NOTE,
-				    "TSO4 supported, but not ECN. "
+				    "!TSO4 supported, but not ECN. "
 				    "Not using LSO.");
 				sc->sc_tx_tso4 = 0;
 			} else {
-				cmn_err(CE_NOTE, "LSO enabled");
+				dev_err(sc->sc_dev, CE_NOTE, "!LSO enabled");
 			}
 		}
 	}
@@ -1782,7 +1792,7 @@ vioif_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
 
 	vioif_check_features(sc);
 
-	if (vioif_alloc_mems(sc))
+	if (vioif_alloc_mems(sc) != 0)
 		goto exit_alloc_mems;
 
 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
@@ -1870,7 +1880,7 @@ vioif_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
 		return (DDI_FAILURE);
 	}
 
-	if (sc->sc_rxloan) {
+	if (sc->sc_rxloan > 0) {
 		dev_err(devinfo, CE_WARN, "!Some rx buffers are still upstream,"
 		    " not detaching.");
 		return (DDI_FAILURE);
diff --git a/usr/src/uts/common/io/virtio/virtio.c b/usr/src/uts/common/io/virtio/virtio.c
index adcd14f2b5..3a61a80fc4 100644
--- a/usr/src/uts/common/io/virtio/virtio.c
+++ b/usr/src/uts/common/io/virtio/virtio.c
@@ -23,6 +23,7 @@
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2012 Alexey Zaytsev <alexey.zaytsev@gmail.com>
  * Copyright (c) 2016 by Delphix. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /* Based on the NetBSD virtio driver by Minoura Makoto. */
@@ -987,6 +988,7 @@ virtio_register_intx(struct virtio_softc *sc,
 	int config_handler_count = 0;
 	int actual;
 	struct virtio_handler_container *vhc;
+	size_t vhc_sz;
 	int ret = DDI_FAILURE;
 
 	/* Walk the handler table to get the number of handlers. */
@@ -998,8 +1000,9 @@ virtio_register_intx(struct virtio_softc *sc,
 	if (config_handler != NULL)
 		config_handler_count = 1;
 
-	vhc = kmem_zalloc(sizeof (struct virtio_handler_container) +
-	    sizeof (struct virtio_int_handler) * vq_handler_count, KM_SLEEP);
+	vhc_sz = sizeof (struct virtio_handler_container) +
+	    sizeof (struct virtio_int_handler) * vq_handler_count;
+	vhc = kmem_zalloc(vhc_sz, KM_SLEEP);
 
 	vhc->nhandlers = vq_handler_count;
 	(void) memcpy(vhc->vq_handlers, vq_handlers,
@@ -1046,8 +1049,7 @@ out_prio:
 	(void) ddi_intr_free(sc->sc_intr_htable[0]);
 out_int_alloc:
 	kmem_free(sc->sc_intr_htable, sizeof (ddi_intr_handle_t));
-	kmem_free(vhc, sizeof (struct virtio_int_handler) *
-	    (vq_handler_count + config_handler_count));
+	kmem_free(vhc, vhc_sz);
 	return (ret);
 }
 
diff --git a/usr/src/uts/common/io/vnd/frameio.c b/usr/src/uts/common/io/vnd/frameio.c
new file mode 100644
index 0000000000..198c14d4be
--- /dev/null
+++ b/usr/src/uts/common/io/vnd/frameio.c
@@ -0,0 +1,465 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * Frame I/O utility functions
+ */
+
+#include <sys/frameio.h>
+
+#include <sys/file.h>
+#include <sys/types.h>
+#include <sys/kmem.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/stream.h>
+#include <sys/strsun.h>
+#include <sys/sysmacros.h>
+#include <sys/inttypes.h>
+
+static kmem_cache_t *frameio_cache;
+
+int
+frameio_init(void)
+{
+	frameio_cache = kmem_cache_create("frameio_cache",
+	    sizeof (frameio_t) + sizeof (framevec_t) * FRAMEIO_NVECS_MAX,
+	    0, NULL, NULL, NULL, NULL, NULL, 0);
+	if (frameio_cache == NULL)
+		return (1);
+
+	return (0);
+}
+
+void
+frameio_fini(void)
+{
+	if (frameio_cache != NULL)
+		kmem_cache_destroy(frameio_cache);
+}
+
+frameio_t *
+frameio_alloc(int kmflags)
+{
+	return (kmem_cache_alloc(frameio_cache, kmflags));
+}
+
+void
+frameio_free(frameio_t *fio)
+{
+	kmem_cache_free(frameio_cache, fio);
+}
+
+/*
+ * Ensure that we don't see any garbage in the framevecs that we're nominally
+ * supposed to work with. Specifically we want to make sure that the buflen and
+ * the address are not zero.
+ */
+static int
+frameio_hdr_check_vecs(frameio_t *fio)
+{
+	int i;
+	for (i = 0; i < fio->fio_nvecs; i++)
+		if (fio->fio_vecs[i].fv_buf == NULL ||
+		    fio->fio_vecs[i].fv_buflen == 0)
+			return (EINVAL);
+
+	return (0);
+}
+
+/*
+ * We have to copy in framevec32_t's. To work around the data model issues and
+ * trying not to copy memory we first copy in the framevec32_t data into the
+ * standard fio_vec space. Next we work backwards copying a given framevec32_t
+ * to a temporaory framevec_t and then overwrite the frameio_t's data. Note that
+ * it is important that we do this in reverse so as to ensure that we don't
+ * clobber data as the framevec_t is larger than the framevec32_t.
+ */
+static int
+frameio_hdr_copyin_ilp32(frameio_t *fio, const void *addr)
+{
+	framevec32_t *vec32p;
+	framevec_t fv;
+	int i;
+
+	vec32p = (framevec32_t *)&fio->fio_vecs[0];
+
+	if (ddi_copyin(addr, vec32p, sizeof (framevec32_t) * fio->fio_nvecs,
+	    0) != 0)
+		return (EFAULT);
+
+	for (i = fio->fio_nvecs - 1; i >= 0; i--) {
+		fv.fv_buf = (void *)(uintptr_t)vec32p[i].fv_buf;
+		fv.fv_buflen = vec32p[i].fv_buflen;
+		fv.fv_actlen = vec32p[i].fv_actlen;
+		fio->fio_vecs[i].fv_buf = fv.fv_buf;
+		fio->fio_vecs[i].fv_buflen = fv.fv_buflen;
+		fio->fio_vecs[i].fv_actlen = fv.fv_actlen;
+	}
+
+	return (frameio_hdr_check_vecs(fio));
+}
+
+/*
+ * Copy in a frame io header into fio with space for up to nvecs. If the frameio
+ * contains more vectors than specified it will be ignored. mode should contain
+ * information about the datamodel.
+ */
+int
+frameio_hdr_copyin(frameio_t *fio, int max_vecs, const void *addr, uint_t mode)
+{
+	int model = ddi_model_convert_from(mode & FMODELS);
+	int cpf = mode & FKIOCTL ? FKIOCTL : 0;
+	size_t fsize = model == DDI_MODEL_ILP32 ?
+	    sizeof (frameio32_t) : sizeof (frameio_t);
+
+	/*
+	 * The start of the header is the same in all data models for the
+	 * current verison.
+	 */
+	if (ddi_copyin(addr, fio, fsize, cpf) != 0)
+		return (EFAULT);
+
+	if (fio->fio_version != FRAMEIO_VERSION_ONE)
+		return (EINVAL);
+
+	if (fio->fio_nvecs > FRAMEIO_NVECS_MAX || fio->fio_nvecs == 0)
+		return (EINVAL);
+
+	if (fio->fio_nvpf == 0)
+		return (EINVAL);
+
+	if (fio->fio_nvecs % fio->fio_nvpf != 0)
+		return (EINVAL);
+
+	if (fio->fio_nvecs > max_vecs)
+		return (EOVERFLOW);
+
+	addr = (void *)((uintptr_t)addr + fsize);
+	if (model == DDI_MODEL_ILP32) {
+		if (cpf != 0)
+			return (EINVAL);
+		return (frameio_hdr_copyin_ilp32(fio, addr));
+	}
+
+	if (ddi_copyin(addr, &fio->fio_vecs[0],
+	    sizeof (framevec_t) * fio->fio_nvecs, cpf) != 0)
+		return (EFAULT);
+
+	return (frameio_hdr_check_vecs(fio));
+}
+
+static mblk_t *
+frameio_allocb(size_t sz)
+{
+	mblk_t *mp;
+
+	mp = allocb(sz, 0);
+	if (mp == NULL)
+		return (NULL);
+
+	mp->b_datap->db_type = M_DATA;
+	return (mp);
+}
+
+static int
+framevec_mblk_read(framevec_t *fv, mblk_t **mpp, int cpf)
+{
+	mblk_t *mp;
+	cpf = cpf != 0 ? FKIOCTL : 0;
+
+	mp = frameio_allocb(fv->fv_buflen);
+
+	if (mp == NULL) {
+		freemsg(mp);
+		return (EAGAIN);
+	}
+
+	if (ddi_copyin(fv->fv_buf, mp->b_wptr, fv->fv_buflen,
+	    cpf) != 0) {
+		freemsg(mp);
+		return (EFAULT);
+	}
+
+	mp->b_wptr += fv->fv_buflen;
+	*mpp = mp;
+	return (0);
+}
+
+/*
+ * Read a set of frame vectors that make up a single message boundary and return
+ * that as a single message in *mpp that consists of multiple data parts.
+ */
+static int
+frameio_mblk_read(frameio_t *fio, framevec_t *fv, mblk_t **mpp, int cpf)
+{
+	int nparts = fio->fio_nvpf;
+	int part, error;
+	mblk_t *mp;
+
+	*mpp = NULL;
+	cpf = cpf != 0 ? FKIOCTL : 0;
+
+	/*
+	 * Construct the initial frame
+	 */
+	for (part = 0; part < nparts; part++) {
+		error = framevec_mblk_read(fv, &mp, cpf);
+		if (error != 0) {
+			freemsg(*mpp);
+			return (error);
+		}
+
+		if (*mpp == NULL)
+			*mpp = mp;
+		else
+			linkb(*mpp, mp);
+		fv++;
+	}
+
+	return (0);
+}
+
+/*
+ * Read data from a series of frameio vectors into a message block chain. A
+ * given frameio request has a number of discrete messages divided into
+ * individual vectors based on fio->fio_nvcspframe. Each discrete message will
+ * be constructed into a message block chain pointed to by b_next.
+ *
+ * If we get an EAGAIN while trying to construct a given message block what we
+ * return depends on what else we've done so far. If we have succesfully
+ * completed at least one message then we free everything else we've done so
+ * far and return that. If no messages have been completed we return EAGAIN. If
+ * instead we encounter a different error, say EFAULT, then all of the fv_actlen
+ * entries values are undefined.
+ */
+int
+frameio_mblk_chain_read(frameio_t *fio, mblk_t **mpp, int *nvecs, int cpf)
+{
+	int error = ENOTSUP;
+	int nframes = fio->fio_nvecs / fio->fio_nvpf;
+	int frame;
+	framevec_t *fv;
+	mblk_t *mp, *bmp = NULL;
+
+	/*
+	 * Protect against bogus kernel subsystems.
+	 */
+	VERIFY(fio->fio_nvecs > 0);
+	VERIFY(fio->fio_nvecs % fio->fio_nvpf == 0);
+
+	*mpp = NULL;
+	cpf = cpf != 0 ? FKIOCTL : 0;
+
+	fv = &fio->fio_vecs[0];
+	for (frame = 0; frame < nframes; frame++) {
+		error = frameio_mblk_read(fio, fv, &mp, cpf);
+		if (error != 0)
+			goto failed;
+
+		if (bmp != NULL)
+			bmp->b_next = mp;
+		else
+			*mpp = mp;
+		bmp = mp;
+	}
+
+	*nvecs = nframes;
+	return (0);
+failed:
+	/*
+	 * On EAGAIN we've already taken care of making sure that we have no
+	 * leftover messages, eg. they were never linked in.
+	 */
+	if (error == EAGAIN) {
+		if (frame != 0)
+			error = 0;
+		if (*nvecs != NULL)
+			*nvecs = frame;
+		ASSERT(*mpp != NULL);
+	} else {
+		for (mp = *mpp; mp != NULL; mp = bmp) {
+			bmp = mp->b_next;
+			freemsg(mp);
+		}
+		if (nvecs != NULL)
+			*nvecs = 0;
+		*mpp = NULL;
+	}
+	return (error);
+}
+
+size_t
+frameio_frame_length(frameio_t *fio, framevec_t *fv)
+{
+	int i;
+	size_t len = 0;
+
+	for (i = 0; i < fio->fio_nvpf; i++, fv++)
+		len += fv->fv_buflen;
+
+	return (len);
+}
+
+/*
+ * Write a portion of an mblk to the current.
+ */
+static int
+framevec_write_mblk_part(framevec_t *fv, mblk_t *mp, size_t len, size_t moff,
+    size_t foff, int cpf)
+{
+	ASSERT(len <= MBLKL(mp) - moff);
+	ASSERT(len <= fv->fv_buflen - fv->fv_actlen);
+	cpf = cpf != 0 ? FKIOCTL : 0;
+
+	if (ddi_copyout(mp->b_rptr + moff, (caddr_t)fv->fv_buf + foff, len,
+	    cpf) != 0)
+		return (EFAULT);
+	fv->fv_actlen += len;
+
+	return (0);
+}
+
+/*
+ * Because copying this out to the user might fail we don't want to update the
+ * b_rptr in case we need to copy it out again.
+ */
+static int
+framevec_map_blk(frameio_t *fio, framevec_t *fv, mblk_t *mp, int cpf)
+{
+	int err;
+	size_t msize, blksize, len, moff, foff;
+
+	msize = msgsize(mp);
+	if (msize > frameio_frame_length(fio, fv))
+		return (EOVERFLOW);
+
+	moff = 0;
+	foff = 0;
+	blksize = MBLKL(mp);
+	fv->fv_actlen = 0;
+	while (msize != 0) {
+		len = MIN(blksize, fv->fv_buflen - fv->fv_actlen);
+		err = framevec_write_mblk_part(fv, mp, len, moff, foff, cpf);
+		if (err != 0)
+			return (err);
+
+		msize -= len;
+		blksize -= len;
+		moff += len;
+		foff += len;
+
+		if (blksize == 0 && msize != 0) {
+			mp = mp->b_cont;
+			ASSERT(mp != NULL);
+			moff = 0;
+			blksize = MBLKL(mp);
+		}
+
+		if (fv->fv_buflen == fv->fv_actlen && msize != 0) {
+			fv++;
+			fv->fv_actlen = 0;
+			foff = 0;
+		}
+	}
+
+	return (0);
+}
+
+int
+frameio_mblk_chain_write(frameio_t *fio, frameio_write_mblk_map_t map,
+    mblk_t *mp, int *nwrite, int cpf)
+{
+	int mcount = 0;
+	int ret = 0;
+
+	if (map != MAP_BLK_FRAME)
+		return (EINVAL);
+
+	while (mp != NULL && mcount < fio->fio_nvecs) {
+		ret = framevec_map_blk(fio, &fio->fio_vecs[mcount], mp, cpf);
+		if (ret != 0)
+			break;
+		mcount += fio->fio_nvpf;
+		mp = mp->b_next;
+	}
+
+	if (ret != 0 && mcount == 0) {
+		if (nwrite != NULL)
+			*nwrite = 0;
+		return (ret);
+	}
+
+	if (nwrite != NULL)
+		*nwrite = mcount / fio->fio_nvpf;
+
+	return (0);
+}
+
+/*
+ * Copy out nframes worth of frameio header data back to userland.
+ */
+int
+frameio_hdr_copyout(frameio_t *fio, int nframes, void *addr, uint_t mode)
+{
+	int i;
+	int model = ddi_model_convert_from(mode & FMODELS);
+	framevec32_t *vec32p;
+	framevec32_t f;
+
+	if (fio->fio_nvecs / fio->fio_nvpf < nframes)
+		return (EINVAL);
+
+	fio->fio_nvecs = nframes * fio->fio_nvpf;
+
+	if (model == DDI_MODEL_NONE) {
+		if (ddi_copyout(fio, addr,
+		    sizeof (frameio_t) + fio->fio_nvecs * sizeof (framevec_t),
+		    mode & FKIOCTL) != 0)
+			return (EFAULT);
+		return (0);
+	}
+
+	ASSERT(model == DDI_MODEL_ILP32);
+
+	vec32p = (framevec32_t *)&fio->fio_vecs[0];
+	for (i = 0; i < fio->fio_nvecs; i++) {
+		f.fv_buf = (caddr32_t)(uintptr_t)fio->fio_vecs[i].fv_buf;
+		if (fio->fio_vecs[i].fv_buflen > UINT_MAX ||
+		    fio->fio_vecs[i].fv_actlen > UINT_MAX)
+			return (EOVERFLOW);
+		f.fv_buflen = fio->fio_vecs[i].fv_buflen;
+		f.fv_actlen = fio->fio_vecs[i].fv_actlen;
+		vec32p[i].fv_buf = f.fv_buf;
+		vec32p[i].fv_buflen = f.fv_buflen;
+		vec32p[i].fv_actlen = f.fv_actlen;
+	}
+
+	if (ddi_copyout(fio, addr,
+	    sizeof (frameio32_t) + fio->fio_nvecs * sizeof (framevec32_t),
+	    mode & FKIOCTL) != 0)
+		return (EFAULT);
+	return (0);
+}
+
+void
+frameio_mark_consumed(frameio_t *fio, int nframes)
+{
+	int i;
+
+	ASSERT(fio->fio_nvecs / fio->fio_nvpf >= nframes);
+	for (i = 0; i < nframes * fio->fio_nvpf; i++)
+		fio->fio_vecs[i].fv_actlen = fio->fio_vecs[i].fv_buflen;
+}
diff --git a/usr/src/uts/common/io/vnd/vnd.c b/usr/src/uts/common/io/vnd/vnd.c
new file mode 100644
index 0000000000..d03c7ce4ec
--- /dev/null
+++ b/usr/src/uts/common/io/vnd/vnd.c
@@ -0,0 +1,5857 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+/*
+ * vnd - virtual (machine) networking datapath
+ *
+ * vnd's purpose is to provide a highly performant data path for Layer 2 network
+ * traffic and exist side by side an active IP netstack, each servicing
+ * different datalinks. vnd provides many of the same capabilities as the
+ * current TCP/IP stack does and some specific to layer two. Specifically:
+ *
+ * 	o Use of the DLD fastpath
+ * 	o Packet capture hooks
+ * 	o Ability to use hardware capabilities
+ * 	o Useful interfaces for handling multiple frames
+ *
+ * The following image shows where vnd fits into today's networking stack:
+ *
+ *             +---------+----------+----------+
+ *             | libdlpi |  libvnd  | libsocket|
+ *             +---------+----------+----------+
+ *             |         ·          ·    VFS   |
+ *             |   VFS   ·    VFS   +----------+
+ *             |         ·          |  sockfs  |
+ *             +---------+----------+----------+
+ *             |         |    VND   |    IP    |
+ *             |         +----------+----------+
+ *             |            DLD/DLS            |
+ *             +-------------------------------+
+ *             |              MAC              |
+ *             +-------------------------------+
+ *             |             GLDv3             |
+ *             +-------------------------------+
+ *
+ * -----------------------------------------
+ * A Tale of Two Devices - DDI Device Basics
+ * -----------------------------------------
+ *
+ * vnd presents itself to userland as a character device; however, it also is a
+ * STREAMS device so that it can interface with dld and the rest of the
+ * networking stack. Users never interface with the STREAMs devices directly and
+ * they are purely an implementation detail of vnd. Opening the STREAMS device
+ * require kcred and as such userland cannot interact with it or push it onto
+ * the stream head.
+ *
+ * The main vnd character device, /dev/vnd/ctl, is a self-cloning device. Every
+ * clone gets its own minor number; however, minor nodes are not created in the
+ * devices tree for these instances. In this state a user may do two different
+ * things. They may issue ioctls that affect global state or they may issue
+ * ioctls that try to attach it to a given datalink. Once a minor device has
+ * been attached to a datalink, all operations on it are scoped to that context,
+ * therefore subsequent global operations are not permitted.
+ *
+ * A given device can be linked into the /devices and /dev name space via a link
+ * ioctl. That ioctl causes a minor node to be created in /devices and then it
+ * will also appear under /dev/vnd/ due to vnd's sdev plugin. This is similar
+ * to, but simpler than, IP's persistence mechanism.
+ *
+ * ---------------------
+ * Binding to a datalink
+ * ---------------------
+ *
+ * Datalinks are backed by the dld (datalink device) and dls (datalink services)
+ * drivers. These drivers provide a STREAMS device for datalinks on the system
+ * which are exposed through /dev/net. Userland generally manipulates datalinks
+ * through libdlpi. When an IP interface is being plumbed up what actually
+ * happens is that someone does a dlpi_open(3DLPI) of the underlying datalink
+ * and then pushes on the ip STREAMS module with an I_PUSH ioctl.  Modules may
+ * then can negotiate with dld and dls to obtain access to various capabilities
+ * and fast paths via a series of STREAMS messages.
+ *
+ * In vnd, we do the same thing, but we leave our STREAMS module as an
+ * implementation detail of the system. We don't want users to be able to
+ * arbitrarily push vnd STREAMS module onto any stream, so we explicitly require
+ * kcred to manipulate it. Thus, when a user issues a request to attach a
+ * datalink to a minor instance of the character device, that vnd minor instance
+ * itself does a layered open (ldi_open_by_name(9F)) of the specified datalink.
+ * vnd does that open using the passed in credentials from the ioctl, not kcred.
+ * This ensures that users who doesn't have permissions to open the device
+ * cannot. Once that's been opened, we push on the vnd streams module.
+ *
+ * Once the vnd STREAMS instance has been created for this device, eg. the
+ * I_PUSH ioctl returns, we explicitly send a STREAMS ioctl
+ * (VND_STRIOC_ASSOCIATE) to associate the vnd STREAMS and character devices.
+ * This association begins the STREAM device's initialization. We start up an
+ * asynchronous state machine that takes care of all the different aspects of
+ * plumbing up the device with dld and dls and enabling the MAC fast path. We
+ * need to guarantee to consumers of the character device that by the time their
+ * ioctl returns, the data path has been fully initialized.
+ *
+ * The state progression is fairly linear. There are two general steady states.
+ * The first is VND_S_ONLINE, which means that everything is jacked up and good
+ * to go. The alternative is VND_S_ZOMBIE, which means that the streams device
+ * encountered an error or we have finished tearing it down and the character
+ * device can clean it up. The following is our state progression and the
+ * meaning of each state:
+ *
+ *                |
+ *                |
+ *                V
+ *        +---------------+
+ *        | VNS_S_INITIAL |                  This is our initial state. Every
+ *        +---------------+                  vnd STREAMS device starts here.
+ *                |                          While in this state, only dlpi
+ *                |                          M_PROTO and M_IOCTL messages can be
+ *                |                          sent or received. All STREAMS based
+ *                |                          data messages are dropped.
+ *                |                          We transition out of this state by
+ *                |                          sending a DL_INFO_REQ to obtain
+ *                |                          information about the underlying
+ *                |                          link.
+ *                v
+ *        +-----------------+
+ *   +--<-| VNS_S_INFO_SENT |                In this state, we verify and
+ *   |    +-----------------+                record information about the
+ *   |            |                          underlying device. If the device is
+ *   |            |                          not suitable, eg. not of type
+ *   v            |                          DL_ETHER, then we immediately
+ *   |            |                          become a ZOMBIE. To leave this
+ *   |            |                          state we request exclusive active
+ *   |            |                          access to the device via
+ *   v            |                          DL_EXCLUSIVE_REQ.
+ *   |            v
+ *   |    +----------------------+
+ *   +--<-| VNS_S_EXCLUSIVE_SENT |           In this state, we verify whether
+ *   |    +----------------------+           or not we were able to obtain
+ *   |       |             |                 exclusive access to the device. If
+ *   |       |             |                 we were not able to, then we leave,
+ *   v       |             |                 as that means that something like
+ *   |       |             |                 IP is already plumbed up on top of
+ *   |       |             |                 the datalink. We leave this state
+ *   |       |             |                 by progressing through to the
+ *   |       |             |                 appropriate DLPI primitive, either
+ *   v       |             |                 DLPI_ATTACH_REQ or DLPI_BIND_REQ
+ *   |       |             |                 depending on the style of the
+ *   |       |             |                 datalink.
+ *   |       |             v
+ *   |       |    +-------------------+
+ *   +------ |--<-| VNS_S_ATTACH_SENT |      In this state, we verify we were
+ *   |       |    +-------------------+      able to perform a standard DLPI
+ *   |       |          |                    attach and if so, go ahead and
+ *   v       |          |                    send a DLPI_BIND_REQ.
+ *   |       v          v
+ *   |    +-------------------+
+ *   +--<-| VNS_S_BIND_SENT   |              In this state we see the result of
+ *   |    +-------------------+              our attempt to bind to PPA 0 of the
+ *   v             |                         underlying device. Because we're
+ *   |             |                         trying to be a layer two datapath,
+ *   |             |                         the specific attachment point isn't
+ *   |             |                         too important as we're going to
+ *   v             |                         have to enable promiscuous mode. We
+ *   |             |                         transition out of this by sending
+ *   |             |                         our first of three promiscuous mode
+ *   |             |                         requests.
+ *   v             v
+ *   |    +------------------------+
+ *   +--<-| VNS_S_SAP_PROMISC_SENT |         In this state we verify that we
+ *   |    +------------------------+         were able to enable promiscuous
+ *   |             |                         mode at the physical level. We
+ *   |             |                         transition out of this by enabling
+ *   |             |                         multicast and broadcast promiscuous
+ *   v             |                         mode.
+ *   |             v
+ *   |    +--------------------------+
+ *   +--<-| VNS_S_MULTI_PROMISC_SENT |       In this state we verify that we
+ *   |    +--------------------------+       have enabled DL_PROMISC_MULTI and
+ *   v             |                         move onto the second promiscuous
+ *   |             |                         mode request.
+ *   |             v
+ *   |    +----------------------------+
+ *   +--<-| VNS_S_RX_ONLY_PROMISC_SENT |     In this state we verify that we
+ *   |    +----------------------------+     enabled RX_ONLY promiscuous mode.
+ *   |             |                         We specifically do this as we don't
+ *   v             |                         want to receive our own traffic
+ *   |             |                         that we'll send out. We leave this
+ *   |             |                         state by enabling the final flag
+ *   |             |                         DL_PROMISC_FIXUPS.
+ *   |             v
+ *   |    +--------------------------+
+ *   +--<-| VNS_S_FIXUP_PROMISC_SENT |       In this state we verify that we
+ *   |    +--------------------------+       enabled FIXUP promiscuous mode.
+ *   |             |                         We specifically do this as we need
+ *   v             |                         to ensure that traffic which is
+ *   |             |                         received by being looped back to us
+ *   |             |                         correctly has checksums fixed. We
+ *   |             |                         leave this state by requesting the
+ *   |             |                         dld/dls capabilities that we can
+ *   v             |                         process.
+ *   |             v
+ *   |    +--------------------+
+ *   +--<-| VNS_S_CAPAB_Q_SENT |             We loop over the set of
+ *   |    +--------------------+             capabilities that dld advertised
+ *   |             |                         and enable the ones that currently
+ *   v             |                         support for use. See the section
+ *   |             |                         later on regarding capabilities
+ *   |             |                         for more information. We leave this
+ *   |             |                         state by sending an enable request.
+ *   v             v
+ *   |    +--------------------+
+ *   +--<-| VNS_S_CAPAB_E_SENT |             Here we finish all capability
+ *   |    +--------------------+             initialization. Once finished, we
+ *   |             |                         transition to the next state. If
+ *   v             |                         the dld fast path is not available,
+ *   |             |                         we become a zombie.
+ *   |             v
+ *   |    +--------------+
+ *   |    | VNS_S_ONLINE |                   This is a vnd STREAMS device's
+ *   |    +--------------+                   steady state. It will normally
+ *   |             |                         reside in this state while it is in
+ *   |             |                         active use. It will only transition
+ *   v             |                         to the next state when the STREAMS
+ *   |             |                         device is closed by the character
+ *   |             |                         device. In this state, all data
+ *   |             |                         flows over the dld fast path.
+ *   |             v
+ *   |    +---------------------+
+ *   +--->| VNS_S_SHUTTING_DOWN |            This vnd state takes care of
+ *   |    +---------------------+            disabling capabilities and
+ *   |             |                         flushing all data. At this point
+ *   |             |                         any additional data that we receive
+ *   |             |                         will be dropped. We leave this
+ *   v             |                         state by trying to remove multicast
+ *   |             |                         promiscuity.
+ *   |             |
+ *   |             v
+ *   |   +---------------------------------+
+ *   +-->| VNS_S_MULTICAST_PROMISCOFF_SENT | In this state, we check if we have
+ *   |   +---------------------------------+ successfully removed multicast
+ *   |             |                         promiscuous mode. If we have
+ *   |             |                         failed, we still carry on but only
+ *   |             |                         warn. We leave this state by trying
+ *   |             |                         to disable SAP level promiscuous
+ *   |             |                         mode.
+ *   |             v
+ *   |   +---------------------------+
+ *   +-->| VNS_S_SAP_PROMISCOFF_SENT |       In this state, we check if we have
+ *   |   +---------------------------+       successfully removed SAP level
+ *   |             |                         promiscuous mode. If we have
+ *   |             |                         failed, we still carry on but only
+ *   |             |                         warn. Note that we don't worry
+ *   |             |                         about either of
+ *   |             |                         DL_PROMISC_FIXUPS or
+ *   |             |                         DL_PROMISC_RX_ONLY. If these are
+ *   |             |                         the only two entries left, then we
+ *   |             |                         should have anything that MAC is
+ *   |             |                         doing for us at this point,
+ *   |             |                         therefore it's safe for us to
+ *   |             |                         proceed to unbind, which is how we
+ *   |             |                         leave this state via a
+ *   |             v                         DL_UNBIND_REQ.
+ *   |    +-------------------+
+ *   +--->| VNS_S_UNBIND_SENT |              Here, we check how the unbind
+ *   |    +-------------------+              request went. Regardless of its
+ *   |             |                         success, we always transition to
+ *   |             |                         a zombie state.
+ *   |             v
+ *   |    +--------------+
+ *   +--->| VNS_S_ZOMBIE |                   In this state, the vnd STREAMS
+ *        +--------------+                   device is waiting to finish being
+ *                                           reaped. Because we have no more
+ *                                           ways to receive data it should be
+ *                                           safe to destroy all remaining data
+ *                                           structures.
+ *
+ * If the stream association fails for any reason the state machine reaches
+ * VNS_S_ZOMBIE. A more detailed vnd_errno_t will propagate back through the
+ * STREAMS ioctl to the character device. That will fail the user ioctl and
+ * propagate the vnd_errno_t back to userland. If, on the other hand, the
+ * association succeeds, then the vnd STREAMS device will be fully plumbed up
+ * and ready to transmit and receive message blocks. Consumers will be able to
+ * start using the other cbops(9E) entry points once the attach has fully
+ * finished, which will occur after the original user attach ioctl to the
+ * character device returns.
+ *
+ * It's quite important that we end up sending the full series of STREAMS
+ * messages when tearing down. While it's tempting to say that we should just
+ * rely on the STREAMS device being closed to properly ensure that we have no
+ * more additional data, that's not sufficient due to our use of direct
+ * callbacks.  DLS does not ensure that by the time we change the direct
+ * callback (vnd_mac_input) that all callers to it will have been quiesced.
+ * However, it does guarantee that if we disable promiscuous mode ourselves and
+ * we turn off the main data path via DL_UNBIND_REQ that it will work.
+ * Therefore, we make sure to do this ourselves rather than letting DLS/DLD do
+ * it as part of tearing down the STREAMS device. This ensures that we'll
+ * quiesce all data before we destroy our data structures and thus we should
+ * eliminate the race in changing the data function.
+ *
+ * --------------------
+ * General Architecture
+ * --------------------
+ *
+ * There are several different devices and structures in the vnd driver. There
+ * is a per-netstack component, pieces related to the character device that
+ * consumers see, the internal STREAMS device state, and the data queues
+ * themselves. The following ASCII art picture describes their relationships and
+ * some of the major pieces of data that contain them. These are not exhaustive,
+ * e.g. synchronization primitives are left out.
+ *
+ *  +----------------+     +-----------------+
+ *  | global         |     | global          |
+ *  | device list    |     | netstack list   |
+ *  | vnd_dev_list   |     | vnd_nsd_list    |
+ *  +----------------+     +-----------------+
+ *      |                    |
+ *      |                    v
+ *      |    +-------------------+      +-------------------+
+ *      |    | per-netstack data | ---> | per-netstack data | --> ...
+ *      |    | vnd_pnsd_t        |      | vnd_pnsd_t        |
+ *      |    |                   |      +-------------------+
+ *      |    |                   |
+ *      |    | nestackid_t    ---+----> Netstack ID
+ *      |    | vnd_pnsd_flags_t -+----> Status flags
+ *      |    | zoneid_t       ---+----> Zone ID for this netstack
+ *      |    | hook_family_t  ---+----> VND IPv4 Hooks
+ *      |    | hook_family_t  ---+----> VND IPv6 Hooks
+ *      |    | list_t ----+      |
+ *      |    +------------+------+
+ *      |                 |
+ *      |                 v
+ *      |           +------------------+       +------------------+
+ *      |           | character device |  ---> | character device | -> ...
+ *      +---------->| vnd_dev_t        |       | vnd_dev_t        |
+ *                  |                  |       +------------------+
+ *                  |                  |
+ *                  | minor_t       ---+--> device minor number
+ *                  | ldi_handle_t  ---+--> handle to /dev/net/%datalink
+ *                  | vnd_dev_flags_t -+--> device flags, non blocking, etc.
+ *                  | char[]        ---+--> name if linked
+ *                  | vnd_str_t * -+   |
+ *                  +--------------+---+
+ *                                 |
+ *                                 v
+ *          +-------------------------+
+ *          | STREAMS device          |
+ *          | vnd_str_t               |
+ *          |                         |
+ *          | vnd_str_state_t      ---+---> State machine state
+ *          | gsqueue_t *          ---+---> mblk_t Serialization queue
+ *          | vnd_str_stat_t       ---+---> per-device kstats
+ *          | vnd_str_capab_t      ---+----------------------------+
+ *          | vnd_data_queue_t ---+   |                            |
+ *          | vnd_data_queue_t -+ |   |                            v
+ *          +-------------------+-+---+                  +---------------------+
+ *                              | |                      | Stream capabilities |
+ *                              | |                      | vnd_str_capab_t     |
+ *                              | |                      |                     |
+ *                              | |    supported caps <--+-- vnd_capab_flags_t |
+ *                              | |    dld cap handle <--+-- void *            |
+ *                              | |    direct tx func <--+-- vnd_dld_tx_t      |
+ *                              | |                      +---------------------+
+ *                              | |
+ *             +----------------+ +-------------+
+ *             |                                |
+ *             v                                v
+ *  +-------------------+                  +-------------------+
+ *  | Read data queue   |                  | Write data queue  |
+ *  | vnd_data_queue_t  |                  | vnd_data_queue_t  |
+ *  |                   |                  |                   |
+ *  | size_t        ----+--> Current size  | size_t        ----+--> Current size
+ *  | size_t        ----+--> Max size      | size_t        ----+--> Max size
+ *  | mblk_t *      ----+--> Queue head    | mblk_t *      ----+--> Queue head
+ *  | mblk_t *      ----+--> Queue tail    | mblk_t *      ----+--> Queue tail
+ *  +-------------------+                  +-------------------+
+ *
+ *
+ * Globally, we maintain two lists. One list contains all of the character
+ * device soft states. The other maintains a list of all our netstack soft
+ * states. Each netstack maintains a list of active devices that have been
+ * associated with a datalink in its netstack.
+ *
+ * Recall that a given minor instance of the character device exists in one of
+ * two modes. It can either be a cloned open of /dev/vnd/ctl, the control node,
+ * or it can be associated with a given datalink. When minor instances are in
+ * the former state, they do not exist in a given vnd_pnsd_t's list of devices.
+ * As part of attaching to a datalink, the given vnd_dev_t will be inserted into
+ * the appropriate vnd_pnsd_t. In addition, this will cause a STREAMS device, a
+ * vnd_str_t, to be created and associated to a vnd_dev_t.
+ *
+ * The character device, and its vnd_dev_t, is the interface to the rest of the
+ * system. The vnd_dev_t keeps track of various aspects like whether various
+ * operations, such as read, write and the frameio ioctls, are considered
+ * blocking or non-blocking in the O_NONBLOCK sense. It also is responsible for
+ * keeping track of things like the name of the device, if any, in /dev. The
+ * vnd_str_t, on the other hand manages aspects like buffer sizes and the actual
+ * data queues. However, ioctls that manipulate these properties all go through
+ * the vnd_dev_t to its associated vnd_str_t.
+ *
+ * Each of the STREAMS devices, the vnd_str_t, maintains two data queues. One
+ * for frames to transmit (write queue) and one for frames received (read
+ * queue). These data queues have a maximum size and attempting to add data
+ * beyond that maximum size will result in data being dropped. The sizes are
+ * configurable via ioctls VND_IOC_SETTXBUF, VND_IOC_SETRXBUF. Data either sits
+ * in those buffers or has a reservation in those buffers while they are in vnd
+ * and waiting to be consumed by the user or by mac.
+ *
+ * Finally, the vnd_str_t also has a vnd_str_capab_t which we use to manage the
+ * available, negotiated, and currently active features.
+ *
+ * ----------------------
+ * Data Path and gsqueues
+ * ----------------------
+ *
+ * There's a lot of plumbing in vnd to get to the point where we can send data,
+ * but vnd's bread and butter is the data path, so it's worth diving into it in
+ * more detail. Data enters and exits the system from two ends.
+ *
+ * The first end is the vnd consumer. This comes in the form of read and write
+ * system calls as well as the frame I/O ioctls. The read and write system calls
+ * operate on a single frame at a time. Think of a frame as a single message
+ * that has come in off the wire, which may itself comprise multiple mblk_t's
+ * linked together in the kernel. readv(2) and writev(2) have the same
+ * limitations as read(2) and write(2). We enforce this as the system is
+ * required to fill up every uio(9S) buffer before moving onto the next one.
+ * This means that if you have a MTU sized buffer and two frames come in which
+ * are less than half of the MTU they must fill up the given iovec. Even if we
+ * didn't want to do this, we have no way of informing the supplier of the
+ * iovecs that they were only partially filled or where one frame ends and
+ * another begins.  That's life, as such we have frame I/O which solves this
+ * problem. It allows for multiple frames to be consumed as well as for frames
+ * to be broken down into multiple vector components.
+ *
+ * The second end is the mac direct calls. As part of negotiating capabilities
+ * via dld, we give mac a function of ours to call when packets are received
+ * [vnd_mac_input()] and a callback to indicate that flow has been restored
+ * [vnd_mac_flow_control()]. In turn, we also get a function pointer that we can
+ * transmit data with. As part of the contract with mac, mac is allowed to flow
+ * control us by returning a cookie to the transmit function. When that happens,
+ * all outbound traffic is halted until our callback function is called and we
+ * can schedule drains.
+ *
+ * It's worth looking at these in further detail. We'll start with the rx path.
+ *
+ *
+ *                                |
+ *                                * . . . packets from gld
+ *                                |
+ *                                v
+ *                         +-------------+
+ *                         |     mac     |
+ *                         +-------------+
+ *                                |
+ *                                v
+ *                         +-------------+
+ *                         |     dld     |
+ *                         +-------------+
+ *                                |
+ *                                * . . . dld direct callback
+ *                                |
+ *                                v
+ *                        +---------------+
+ *                        | vnd_mac_input |
+ *                        +---------------+
+ *                                |
+ *                                v
+ * +---------+             +-------------+
+ * | dropped |<--*---------|  vnd_hooks  |
+ * |   by    |   .         +-------------+
+ * |  hooks  |   . drop probe     |
+ * +---------+     kstat bump     * . . . Do we have free
+ *                                |         buffer space?
+ *                                |
+ *                          no .  |      . yes
+ *                             .  +      .
+ *                         +---*--+------*-------+
+ *                         |                     |
+ *                         * . . drop probe      * . . recv probe
+ *                         |     kstat bump      |     kstat bump
+ *                         v                     |
+ *                      +---------+              * . . fire pollin
+ *                      | freemsg |              v
+ *                      +---------+   +-----------------------+
+ *                                    | vnd_str_t`vns_dq_read |
+ *                                    +-----------------------+
+ *                                             ^ ^
+ *                             +----------+    | |     +---------+
+ *                             | read(9E) |-->-+ +--<--| frameio |
+ *                             +----------+            +---------+
+ *
+ * The rx path is rather linear. Packets come into us from mac. We always run
+ * them through the various hooks, and if they come out of that, we inspect the
+ * read data queue. If there is not enough space for a packet, we drop it.
+ * Otherwise, we append it to the data queue, and fire read notifications
+ * targetting anyone polling or doing blocking I/O on this device. Those
+ * consumers then drain the head of the data queue.
+ *
+ * The tx path is more complicated due to mac flow control. After any call into
+ * mac, we may have to potentially suspend writes and buffer data for an
+ * arbitrary amount of time. As such, we need to carefully track the total
+ * amount of outstanding data so that we don't waste kernel memory. This is
+ * further complicated by the fact that mac will asynchronously tell us when our
+ * flow has been resumed.
+ *
+ * For data to be able to enter the system, it needs to be able to take a
+ * reservation from the write data queue. Once the reservation has been
+ * obtained, we enter the gsqueue so that we can actually append it. We use
+ * gsqueues (serialization queues) to ensure that packets are manipulated in
+ * order as we deal with the draining and appending packets. We also leverage
+ * its worker thread to help us do draining after mac has restorted our flow.
+ *
+ * The following image describes the flow:
+ *
+ * +-----------+   +--------------+       +-------------------------+   +------+
+ * | write(9E) |-->| Space in the |--*--->| gsqueue_enter_one()     |-->| Done |
+ * | frameio   |   | write queue? |  .    | +->vnd_squeue_tx_append |   +------+
+ * +-----------+   +--------------+  .    +-------------------------+
+ *                         |   ^     .
+ *                         |   |     . reserve space           from gsqueue
+ *                         |   |                                   |
+ *            queue  . . . *   |       space                       v
+ *             full        |   * . . . avail          +------------------------+
+ *                         v   |                      | vnd_squeue_tx_append() |
+ * +--------+          +------------+                 +------------------------+
+ * | EAGAIN |<--*------| Non-block? |<-+                           |
+ * +--------+   .      +------------+  |                           v
+ *              . yes             v    |     wait          +--------------+
+ *                          no . .*    * . . for           | append chain |
+ *                                +----+     space         | to outgoing  |
+ *                                                         |  mblk chain  |
+ *   from gsqueue                                          +--------------+
+ *       |                                                        |
+ *       |      +-------------------------------------------------+
+ *       |      |
+ *       |      |                            yes . . .
+ *       v      v                                    .
+ *  +-----------------------+    +--------------+    .     +------+
+ *  | vnd_squeue_tx_drain() |--->| mac blocked? |----*---->| Done |
+ *  +-----------------------+    +--------------+          +------+
+ *                                       |                     |
+ *     +---------------------------------|---------------------+
+ *     |                                 |           tx        |
+ *     |                          no . . *           queue . . *
+ *     | flow controlled .               |           empty     * . fire pollout
+ *     |                 .               v                     |   if mblk_t's
+ *   +-------------+     .      +---------------------+        |   sent
+ *   | set blocked |<----*------| vnd_squeue_tx_one() |--------^-------+
+ *   | flags       |            +---------------------+                |
+ *   +-------------+    More data       |    |      |      More data   |
+ *                      and limit       ^    v      * . .  and limit   ^
+ *                      not reached . . *    |      |      reached     |
+ *                                      +----+      |                  |
+ *                                                  v                  |
+ *   +----------+          +-------------+    +---------------------------+
+ *   | mac flow |--------->| remove mac  |--->| gsqueue_enter_one() with  |
+ *   | control  |          | block flags |    | vnd_squeue_tx_drain() and |
+ *   | callback |          +-------------+    | GSQUEUE_FILL flag, iff    |
+ *   +----------+                             | not already scheduled     |
+ *                                            +---------------------------+
+ *
+ * The final path taken for a given write(9E)/frameio ioctl depends on whether
+ * or not the vnd_dev_t is non-blocking. That controls the initial path of
+ * trying to take a reservation in write data queue. If the device is in
+ * non-blocking mode, we'll return EAGAIN when there is not enough space
+ * available, otherwise, the calling thread blocks on the data queue.
+ *
+ * Today when we call into vnd_squeue_tx_drain() we will not try to drain the
+ * entire queue, as that could be quite large and we don't want to necessarily
+ * keep the thread that's doing the drain until it's been finished. Not only
+ * could more data be coming in, but the draining thread could be a userland
+ * thread that has more work to do. We have two limits today. There is an upper
+ * bound on the total amount of data and the total number of mblk_t chains. If
+ * we hit either limit, then we will schedule another drain in the gsqueue and
+ * go from there.
+ *
+ * It's worth taking some time to describe how we interact with gsqueues. vnd
+ * has a gsqueue_set_t for itself. It's important that it has its own set, as
+ * the profile of work that vnd does is different from other sub-systems in the
+ * kernel. When we open a STREAMS device in vnd_s_open, we get a random gsqueue.
+ * Unlike TCP/IP which uses an gsqueue for per TCP connection, we end up
+ * maintaining one for a given device. Because of that, we want to use a
+ * pseudo-random one to try and spread out the load, and picking one at random
+ * is likely to be just as good as any fancy algorithm we might come up with,
+ * especially as any two devices could have radically different transmit
+ * profiles.
+ *
+ * While some of the write path may seem complicated, it does allow us to
+ * maintain an important property. Once we have acknowledged a write(9E) or
+ * frameio ioctl, we will not drop the packet, excepting something like ipf via
+ * the firewall hooks.
+ *
+ * There is one other source of flow control that can exist in the system which
+ * is in the form of a barrier. The barrier is an internal mechanism used for
+ * ensuring that an gsqueue is drained for a given device. We use this as part
+ * of tearing down. Specifically we disable the write path so nothing new can be
+ * inserted into the gsqueue and then insert a barrier block. Once the barrier
+ * block comes out of the gsqueue, then we know nothing else in the gsqueue that
+ * could refer to the vnd_str_t, being destroyed, exists.
+ *
+ * ---------------------
+ * vnd, zones, netstacks
+ * ---------------------
+ *
+ * vnd devices are scoped to datalinks and datalinks are scoped to a netstack.
+ * Because of that, vnd is also a netstack module. It registers with the
+ * netstack sub-system and receives callbacks every time a netstack is created,
+ * being shutdown, and destroyed. The netstack callbacks drive the creation and
+ * destruction of the vnd_pnsd_t structures.
+ *
+ * Recall from the earlier architecture diagrams that every vnd device is scoped
+ * to a netstack and known about by a given vnd_pnsd_t. When that netstack is
+ * torn down, we also tear down any vnd devices that are hanging around. When
+ * the netstack is torn down, we know that any zones that are scoped to that
+ * netstack are being shut down and have no processes remaining. This is going
+ * to be the case whether they are shared or exclusive stack zones. We have to
+ * perform a careful dance.
+ *
+ * There are two different callbacks that happen on tear down, the first is a
+ * shutdown callback, the second is a destroy callback. When the shutdown
+ * callback is fired we need to prepare for the netstack to go away and ensure
+ * that nothing can continue to persist itself.
+ *
+ * More specifically, when we get notice of a stack being shutdown we first
+ * remove the netstack from the global netstack list to ensure that no one new
+ * can come in and find the netstack and get a reference to it. After that, we
+ * notify the neti hooks that they're going away. Once that's all done, we get
+ * to the heart of the matter.
+ *
+ * When shutting down there could be any number of outstanding contexts that
+ * have a reference on the vnd_pnsd_t and on the individual links. However, we
+ * know that no one new will be able to find the vnd_pnsd_t. To account for
+ * things that have existing references we mark the vnd_pnsd_t`vpnd_flags with
+ * VND_NS_CONDEMNED. This is checked by code paths that wish to append a device
+ * to the netstack's list. If this is set, then they must not append to it.
+ * Once this is set, we know that the netstack's list of devices can never grow,
+ * only shrink.
+ *
+ * Next, for each device we tag it with VND_D_ZONE_DYING. This indicates that
+ * the container for the device is being destroyed and that we should not allow
+ * additional references to the device to be created, whether via open, or
+ * linking. The presence of this bit also allows things like the list ioctl and
+ * sdev to know not to consider its existence. At the conclusion of this being
+ * set, we know that no one else should be able to obtain a new reference to the
+ * device.
+ *
+ * Once that has been set for all devices, we go through and remove any existing
+ * links that have been established in sdev. Because doing that may cause the
+ * final reference for the device to be dropped, which still has a reference to
+ * the netstack, we have to restart our walk due to dropped locks. We know that
+ * this walk will eventually complete because the device cannot be relinked and
+ * no new devices will be attached in this netstack due to VND_NS_CONDEMNED.
+ * Once that's finished, the shutdown callback returns.
+ *
+ * When we reach the destroy callback, we simply wait for references on the
+ * netstack to disappear. Because the zone has been shut down, all processes in
+ * it that have open references have been terminated and reaped. Any threads
+ * that are newly trying to reference it will fail. However, there is one thing
+ * that can halt this that we have no control over, which is the global zone
+ * holding open a reference to the device. In this case the zone halt will hang
+ * in vnd_stack_destroy. Once the last references is dropped we finish destroy
+ * the netinfo hooks and free the vnd_pnsd_t.
+ *
+ * ----
+ * sdev
+ * ----
+ *
+ * vnd registers a sdev plugin which allows it to dynamically fill out /dev/vnd
+ * for both the global and non-global zones. In any given zone we always supply
+ * a control node via /dev/vnd/ctl. This is the self-cloning node. Each zone
+ * will also have an entry per-link in that zone under /dev/vnd/%datalink, eg.
+ * if a link was named net0, there would be a /dev/vnd/net0. The global zone can
+ * also see every link for every zone, ala /dev/net, under
+ * /dev/vnd/%zonename/%datalink, eg. if a zone named 'turin' had a vnd device
+ * named net0, the global zone would have /dev/vnd/turin/net0.
+ *
+ * The sdev plugin has three interfaces that it supplies back to sdev. One is to
+ * validate that a given node is still valid. The next is a callback from sdev
+ * to say that it is no longer using the node. The third and final one is from
+ * sdev where it asks us to fill a directory. All of the heavy lifting is done
+ * in directory filling and in valiation. We opt not to maintain a reference on
+ * the device while there is an sdev node present. This makes the removal of
+ * nodes much simpler and most of the possible failure modes shouldn't cause any
+ * real problems. For example, the open path has to handle both dev_t's which no
+ * longer exist and which are no longer linked.
+ *
+ * -----
+ * hooks
+ * -----
+ *
+ * Like IP, vnd sends all L3 packets through its firewall hooks. Currently vnd
+ * provides these for L3 IP and IPv6 traffic. Each netstack provides these hooks
+ * in a minimal fashion. While we will allow traffic to be filtered through the
+ * hooks, we do not provide means for packet injection or additional inspection
+ * at this time. There are a total of four different events created:
+ *
+ *   o IPv4 physical in
+ *   o IPv4 physical out
+ *   o IPv6 physical in
+ *   o IPv6 physical out
+ *
+ * ---------------
+ * Synchronization
+ * ---------------
+ *
+ * To make our synchronization simpler, we've put more effort into making the
+ * metadata/setup paths do more work. That work allows the data paths to make
+ * assumptions around synchronization that simplify the general case. Each major
+ * structure, the vnd_pnsd_t, vnd_dev_t, vnd_str_t, and vnd_data_queue_t is
+ * annotated with the protection that its members receives.  The following
+ * annotations are used:
+ *
+ * 	A	Atomics; these values are only modified using atomics values.
+ *		Currently this only applies to kstat values.
+ * 	E	Existence; no lock is needed to access this member, it does not
+ *		change while the structure is valid.
+ * 	GL	Global Lock; these members are protected by the global
+ *		vnd_dev_lock.
+ * 	L	Locked; access to the member is controlled by a lock that is in
+ * 		the structure.
+ * 	NSL	netstack lock; this member is protected by the containing
+ * 		netstack. This only applies to the vnd_dev_t`vdd_nslink.
+ *	X	This member is special, and is discussed in this section.
+ *
+ * In addition to locking, we also have reference counts on the vnd_dev_t and
+ * the vnd_pnsd_t. The reference counts describe the lifetimes of the structure.
+ * With rare exception, once a reference count is decremented, the consumer
+ * should not assume that the data is valid any more. The only exception to this
+ * is the case where we're removing an extant reference count from a link into
+ * /devices or /dev. Reference counts are obtained on these structures as a part
+ * of looking them up.
+ *
+ * 	# Global Lock Ordering
+ * 	######################
+ *
+ * The following is the order that you must take locks in vnd:
+ *
+ * 1) vnd`vnd_dev_lock
+ * 2) vnd_pnsd_t`vpnd_lock
+ * 3) vnd_dev_t`vnd_lock
+ * 4) vnd_str_t`vns_lock
+ * 5) vnd_data_queue_t`vdq_lock
+ *
+ * One must adhere to the following rules:
+ *
+ *   o You must acquire a lower numbered lock before a high numbered lock.
+ *   o It is NOT legal to hold two locks of the same level concurrently, eg. you
+ *     can not hold two different vnd_dev_t's vnd_lock at the same time.
+ *   o You may release locks in any order.
+ *   o If you release a lock, you must honor the locking rules before acquiring
+ *     it again.
+ *   o You should not hold any locks when calling any of the rele functions.
+ *
+ * 	# Special Considerations
+ * 	########################
+ *
+ * While most of the locking is what's expected, it's worth going into the
+ * special nature that a few members hold.  Today, only two structures have
+ * special considerations: the vnd_dev_t and the vnd_str_t. All members with
+ * special considerations have an additional annotation that describes how you
+ * should interact with it.
+ *
+ * vnd_dev_t: The vdd_nsd and vdd_cr are only valid when the minor node is
+ * attached or in the process of attaching. If the code path that goes through
+ * requires an attached vnd_dev_t, eg. the data path and tear down path, then it
+ * is always legal to dereference that member without a lock held. When they are
+ * added to the system, they should be done under the vdd_lock and done as part
+ * of setting the VND_D_ATTACH_INFLIGHT flag. These should not change during the
+ * lifetime of the vnd_dev_t.
+ *
+ * vnd_dev_t: The vdd_ldih is similar to the vdd_nsd and vdd_cr, except that it
+ * always exists as it is a part of the structure. The only time that it's valid
+ * to be using it is during the attach path with the VND_D_ATTACH_INFLIGHT flag
+ * set or during tear down. Outside of those paths which are naturally
+ * serialized, there is no explicit locking around the member.
+ *
+ * vnd_str_t: The vns_dev and vns_nsd work in similar ways. They are not
+ * initially set as part of creating the structure, but are set as part of
+ * responding to the association ioctl. Anything in the data path or metadata
+ * path that requires association may assume that they exist, as we do not kick
+ * off the state machine until they're set.
+ *
+ * vnd_str_t: The vns_drainblk and vns_barrierblk are similarly special. The
+ * members are designed to be used as part of various operations with the
+ * gsqueues. A lock isn't needed to use them, but to work with them, the
+ * appropriate flag in the vnd_str_t`vns_flags must have been set by the current
+ * thread. Otherwise, it is always fair game to refer to their addresses. Their
+ * contents are ignored by vnd, but some members are manipulated by the gsqueue
+ * subsystem.
+ */
+
+#include <sys/conf.h>
+#include <sys/devops.h>
+#include <sys/modctl.h>
+#include <sys/stat.h>
+#include <sys/file.h>
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/open.h>
+#include <sys/ddi.h>
+#include <sys/ethernet.h>
+#include <sys/stropts.h>
+#include <sys/sunddi.h>
+#include <sys/stream.h>
+#include <sys/strsun.h>
+#include <sys/ksynch.h>
+#include <sys/taskq_impl.h>
+#include <sys/sdt.h>
+#include <sys/debug.h>
+#include <sys/sysmacros.h>
+#include <sys/dlpi.h>
+#include <sys/cred.h>
+#include <sys/id_space.h>
+#include <sys/list.h>
+#include <sys/ctype.h>
+#include <sys/policy.h>
+#include <sys/sunldi.h>
+#include <sys/cred.h>
+#include <sys/strsubr.h>
+#include <sys/poll.h>
+#include <sys/neti.h>
+#include <sys/hook.h>
+#include <sys/hook_event.h>
+#include <sys/vlan.h>
+#include <sys/dld.h>
+#include <sys/mac_client.h>
+#include <sys/netstack.h>
+#include <sys/fs/sdev_plugin.h>
+#include <sys/kstat.h>
+#include <sys/atomic.h>
+#include <sys/disp.h>
+#include <sys/random.h>
+#include <sys/gsqueue.h>
+#include <sys/ht.h>
+
+#include <inet/ip.h>
+#include <inet/ip6.h>
+
+#include <sys/vnd.h>
+
+/*
+ * Globals
+ */
+static dev_info_t *vnd_dip;
+static taskq_t *vnd_taskq;
+static kmem_cache_t *vnd_str_cache;
+static kmem_cache_t *vnd_dev_cache;
+static kmem_cache_t *vnd_pnsd_cache;
+static id_space_t *vnd_minors;
+static int vnd_list_init = 0;
+static sdev_plugin_hdl_t vnd_sdev_hdl;
+static gsqueue_set_t *vnd_sqset;
+
+static kmutex_t vnd_dev_lock;
+static list_t vnd_dev_list;	/* Protected by the vnd_dev_lock */
+static list_t vnd_nsd_list;	/* Protected by the vnd_dev_lock */
+
+/*
+ * STREAMs ioctls
+ *
+ * The STREAMs ioctls are internal to vnd. No one should be seeing them, as such
+ * they aren't a part of the header file.
+ */
+#define	VND_STRIOC	(('v' << 24) | ('n' << 16) | ('d' << 8) | 0x80)
+
+/*
+ * Private ioctl to associate a given streams instance with a minor instance of
+ * the character device.
+ */
+#define	VND_STRIOC_ASSOCIATE	(VND_STRIOC | 0x1)
+
+typedef struct vnd_strioc_associate {
+	minor_t	vsa_minor;	/* minor device node */
+	netstackid_t vsa_nsid;	/* netstack id */
+	vnd_errno_t vsa_errno;	/* errno */
+} vnd_strioc_associate_t;
+
+typedef enum vnd_strioc_state {
+	VSS_UNKNOWN = 0,
+	VSS_COPYIN = 1,
+	VSS_COPYOUT = 2,
+} vnd_strioc_state_t;
+
+typedef struct vnd_strioc {
+	vnd_strioc_state_t vs_state;
+	caddr_t vs_addr;
+} vnd_strioc_t;
+
+/*
+ * VND SQUEUE TAGS, start at 0x42 so we don't overlap with extent tags. Though
+ * really, overlap is at the end of the day, inevitable.
+ */
+#define	VND_SQUEUE_TAG_TX_DRAIN		0x42
+#define	VND_SQUEUE_TAG_MAC_FLOW_CONTROL	0x43
+#define	VND_SQUEUE_TAG_VND_WRITE	0x44
+#define	VND_SQUEUE_TAG_ND_FRAMEIO_WRITE	0x45
+#define	VND_SQUEUE_TAG_STRBARRIER	0x46
+
+/*
+ * vnd reserved names. These are names which are reserved by vnd and thus
+ * shouldn't be used by some external program.
+ */
+static char *vnd_reserved_names[] = {
+	"ctl",
+	"zone",
+	NULL
+};
+
+/*
+ * vnd's DTrace probe macros
+ *
+ * DTRACE_VND* are all for a stable provider. We also have an unstable internal
+ * set of probes for reference count manipulation.
+ */
+#define	DTRACE_VND3(name, type1, arg1, type2, arg2, type3, arg3) \
+    DTRACE_PROBE3(__vnd_##name, type1, arg1, type2, arg2, type3, arg3);
+
+#define	DTRACE_VND4(name, type1, arg1, type2, arg2, type3, arg3, type4, arg4) \
+    DTRACE_PROBE4(__vnd_##name, type1, arg1, type2, arg2, type3, arg3, \
+	type4, arg4);
+
+#define	DTRACE_VND5(name, type1, arg1, type2, arg2, type3, arg3,	\
+    type4, arg4, type5, arg5)						\
+    DTRACE_PROBE5(__vnd_##name, type1, arg1, type2, arg2, type3, arg3,	\
+	type4, arg4, type5, arg5);
+
+#define	DTRACE_VND_REFINC(vdp) \
+    DTRACE_PROBE2(vnd__ref__inc, vnd_dev_t *, vdp, int, vdp->vdd_ref);
+#define	DTRACE_VND_REFDEC(vdp) \
+    DTRACE_PROBE2(vnd__ref__dec, vnd_dev_t *, vdp, int, vdp->vdd_ref);
+
+
+/*
+ * Tunables
+ */
+size_t vnd_vdq_default_size = 1024 * 64;	/* 64 KB */
+size_t vnd_vdq_hard_max = 1024 * 1024 * 4;	/* 4 MB */
+
+/*
+ * These numbers are designed as per-device tunables that are applied when a new
+ * vnd device is attached. They're a rough stab at what may be a reasonable
+ * amount of work to do in one burst in an squeue.
+ */
+size_t vnd_flush_burst_size = 1520 * 10;	/* 10 1500 MTU packets */
+size_t vnd_flush_nburst = 10;			/* 10 frames */
+
+/*
+ * Constants related to our sdev plugins
+ */
+#define	VND_SDEV_NAME	"vnd"
+#define	VND_SDEV_ROOT	"/dev/vnd"
+#define	VND_SDEV_ZROOT	"/dev/vnd/zone"
+
+/*
+ * vnd relies on privileges, not mode bits to limit access.  As such, device
+ * files are read-write to everyone.
+ */
+#define	VND_SDEV_MODE	(S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | \
+			S_IROTH | S_IWOTH)
+
+/*
+ * Statistic macros
+ */
+#define	VND_STAT_INC(vsp, field, val) \
+    atomic_add_64(&(vsp)->vns_ksdata.field.value.ui64, val)
+#define	VND_LATENCY_1MS		1000000
+#define	VND_LATENCY_10MS	10000000
+#define	VND_LATENCY_100MS	100000000
+#define	VND_LATENCY_1S		1000000000
+#define	VND_LATENCY_10S		10000000000
+
+/*
+ * Constants for vnd hooks
+ */
+static uint8_t vnd_bcast_addr[6] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
+#define	IPV4_MCAST_LEN	3
+static uint8_t vnd_ipv4_mcast[3] = { 0x01, 0x00, 0x5E };
+#define	IPV6_MCAST_LEN	2
+static uint8_t vnd_ipv6_mcast[2] = { 0x33, 0x33 };
+
+/*
+ * vnd internal data structures and types
+ */
+
+struct vnd_str;
+struct vnd_dev;
+struct vnd_pnsd;
+
+/*
+ * As part of opening the device stream we need to properly communicate with our
+ * underlying stream. This is a bit of an asynchronous dance and we need to
+ * properly work with dld to get everything set up. We have to initiate the
+ * conversation with dld and as such we keep track of our state here.
+ */
+typedef enum vnd_str_state {
+	VNS_S_INITIAL = 0,
+	VNS_S_INFO_SENT,
+	VNS_S_EXCLUSIVE_SENT,
+	VNS_S_ATTACH_SENT,
+	VNS_S_BIND_SENT,
+	VNS_S_SAP_PROMISC_SENT,
+	VNS_S_MULTI_PROMISC_SENT,
+	VNS_S_RX_ONLY_PROMISC_SENT,
+	VNS_S_FIXUP_PROMISC_SENT,
+	VNS_S_CAPAB_Q_SENT,
+	VNS_S_CAPAB_E_SENT,
+	VNS_S_ONLINE,
+	VNS_S_SHUTTING_DOWN,
+	VNS_S_MULTICAST_PROMISCOFF_SENT,
+	VNS_S_SAP_PROMISCOFF_SENT,
+	VNS_S_UNBIND_SENT,
+	VNS_S_ZOMBIE
+} vnd_str_state_t;
+
+typedef enum vnd_str_flags {
+	VNS_F_NEED_ZONE = 0x1,
+	VNS_F_TASKQ_DISPATCHED = 0x2,
+	VNS_F_CONDEMNED = 0x4,
+	VNS_F_FLOW_CONTROLLED = 0x8,
+	VNS_F_DRAIN_SCHEDULED = 0x10,
+	VNS_F_BARRIER = 0x20,
+	VNS_F_BARRIER_DONE = 0x40
+} vnd_str_flags_t;
+
+typedef enum vnd_capab_flags {
+	VNS_C_HCKSUM = 0x1,
+	VNS_C_DLD = 0x2,
+	VNS_C_DIRECT = 0x4,
+	VNS_C_HCKSUM_BADVERS = 0x8
+} vnd_capab_flags_t;
+
+/*
+ * Definitions to interact with direct callbacks
+ */
+typedef void (*vnd_rx_t)(struct vnd_str *, mac_resource_t *, mblk_t *,
+    mac_header_info_t *);
+typedef uintptr_t vnd_mac_cookie_t;
+/* DLD Direct capability function */
+typedef int (*vnd_dld_cap_t)(void *, uint_t, void *, uint_t);
+/* DLD Direct tx function */
+typedef vnd_mac_cookie_t (*vnd_dld_tx_t)(void *, mblk_t *, uint64_t, uint16_t);
+/* DLD Direct function to set flow control callback */
+typedef void *(*vnd_dld_set_fcb_t)(void *, void (*)(void *, vnd_mac_cookie_t),
+    void *);
+/* DLD Direct function to see if flow controlled still */
+typedef int (*vnd_dld_is_fc_t)(void *, vnd_mac_cookie_t);
+
+/*
+ * The vnd_str_capab_t is always protected by the vnd_str_t it's a member of.
+ */
+typedef struct vnd_str_capab {
+	vnd_capab_flags_t vsc_flags;
+	t_uscalar_t vsc_hcksum_opts;
+	vnd_dld_cap_t vsc_capab_f;
+	void *vsc_capab_hdl;
+	vnd_dld_tx_t vsc_tx_f;
+	void *vsc_tx_hdl;
+	vnd_dld_set_fcb_t vsc_set_fcb_f;
+	void *vsc_set_fcb_hdl;
+	vnd_dld_is_fc_t vsc_is_fc_f;
+	void *vsc_is_fc_hdl;
+	vnd_mac_cookie_t vsc_fc_cookie;
+	void *vsc_tx_fc_hdl;
+} vnd_str_capab_t;
+
+/*
+ * The vnd_data_queue is a simple construct for storing a series of messages in
+ * a queue.
+ *
+ * See synchronization section of the big theory statement for member
+ * annotations.
+ */
+typedef struct vnd_data_queue {
+	struct vnd_str *vdq_vns;	/* E */
+	kmutex_t vdq_lock;
+	kcondvar_t vdq_ready;		/* Uses vdq_lock */
+	ssize_t vdq_max;		/* L */
+	ssize_t vdq_cur;		/* L */
+	mblk_t *vdq_head;		/* L */
+	mblk_t *vdq_tail;		/* L */
+} vnd_data_queue_t;
+
+typedef struct vnd_str_stat {
+	kstat_named_t	vks_rbytes;
+	kstat_named_t	vks_rpackets;
+	kstat_named_t	vks_obytes;
+	kstat_named_t	vks_opackets;
+	kstat_named_t	vks_nhookindrops;
+	kstat_named_t	vks_nhookoutdrops;
+	kstat_named_t	vks_ndlpidrops;
+	kstat_named_t	vks_ndataindrops;
+	kstat_named_t	vks_ndataoutdrops;
+	kstat_named_t	vks_tdrops;
+	kstat_named_t	vks_linkname;
+	kstat_named_t	vks_zonename;
+	kstat_named_t	vks_nmacflow;
+	kstat_named_t	vks_tmacflow;
+	kstat_named_t	vks_mac_flow_1ms;
+	kstat_named_t	vks_mac_flow_10ms;
+	kstat_named_t	vks_mac_flow_100ms;
+	kstat_named_t	vks_mac_flow_1s;
+	kstat_named_t	vks_mac_flow_10s;
+} vnd_str_stat_t;
+
+/*
+ * vnd stream structure
+ *
+ * See synchronization section of the big theory statement for member
+ * annotations.
+ */
+typedef struct vnd_str {
+	kmutex_t 	vns_lock;
+	kcondvar_t	vns_cancelcv;		/* Uses vns_lock */
+	kcondvar_t	vns_barriercv;		/* Uses vns_lock */
+	kcondvar_t	vns_stcv;		/* Uses vns_lock */
+	vnd_str_state_t	vns_state;		/* L */
+	vnd_str_state_t	vns_laststate;		/* L */
+	vnd_errno_t	vns_errno;		/* L */
+	vnd_str_flags_t	vns_flags;		/* L */
+	vnd_str_capab_t vns_caps;		/* L */
+	taskq_ent_t	vns_tqe;		/* L */
+	vnd_data_queue_t vns_dq_read;		/* E */
+	vnd_data_queue_t vns_dq_write;		/* E */
+	mblk_t		*vns_dlpi_inc;		/* L */
+	queue_t		*vns_rq;		/* E */
+	queue_t		*vns_wq;		/* E */
+	queue_t		*vns_lrq;		/* E */
+	t_uscalar_t	vns_dlpi_style;		/* L */
+	t_uscalar_t	vns_minwrite;		/* L */
+	t_uscalar_t	vns_maxwrite;		/* L */
+	hrtime_t	vns_fclatch;		/* L */
+	hrtime_t	vns_fcupdate;		/* L */
+	kstat_t		*vns_kstat;		/* E */
+	gsqueue_t	*vns_squeue;		/* E */
+	mblk_t		vns_drainblk;		/* E + X */
+	mblk_t		vns_barrierblk;		/* E + X */
+	vnd_str_stat_t	vns_ksdata;		/* A */
+	size_t		vns_nflush;		/* L */
+	size_t 		vns_bsize;		/* L */
+	struct vnd_dev	*vns_dev;		/* E + X */
+	struct vnd_pnsd	*vns_nsd;		/* E + X */
+} vnd_str_t;
+
+typedef enum vnd_dev_flags {
+	VND_D_ATTACH_INFLIGHT =	0x001,
+	VND_D_ATTACHED =	0x002,
+	VND_D_LINK_INFLIGHT =	0x004,
+	VND_D_LINKED =		0x008,
+	VND_D_CONDEMNED =	0x010,
+	VND_D_ZONE_DYING =	0x020,
+	VND_D_OPENED =		0x040
+} vnd_dev_flags_t;
+
+/*
+ * This represents the data associated with a minor device instance.
+ *
+ * See synchronization section of the big theory statement for member
+ * annotations.
+ */
+typedef struct vnd_dev {
+	kmutex_t	vdd_lock;
+	list_node_t	vdd_link;			/* GL */
+	list_node_t	vdd_nslink;			/* NSL */
+	int		vdd_ref;			/* L */
+	vnd_dev_flags_t	vdd_flags;			/* L */
+	minor_t		vdd_minor;			/* E */
+	dev_t		vdd_devid;			/* E */
+	ldi_ident_t	vdd_ldiid;			/* E */
+	ldi_handle_t	vdd_ldih;			/* X */
+	cred_t		*vdd_cr;			/* X */
+	vnd_str_t	*vdd_str;			/* L */
+	struct pollhead	vdd_ph;				/* E */
+	struct vnd_pnsd *vdd_nsd;			/* E + X */
+	char		vdd_datalink[VND_NAMELEN];	/* L */
+	char		vdd_lname[VND_NAMELEN];		/* L */
+} vnd_dev_t;
+
+typedef enum vnd_pnsd_flags {
+	VND_NS_CONDEMNED = 0x1
+} vnd_pnsd_flags_t;
+
+/*
+ * Per netstack data structure.
+ *
+ * See synchronization section of the big theory statement for member
+ * annotations.
+ */
+typedef struct vnd_pnsd {
+	list_node_t vpnd_link;	/* protected by global dev lock */
+	zoneid_t vpnd_zid;			/* E */
+	netstackid_t vpnd_nsid;			/* E */
+	boolean_t vpnd_hooked;			/* E */
+	net_handle_t vpnd_neti_v4;		/* E */
+	hook_family_t vpnd_family_v4;		/* E */
+	hook_event_t vpnd_event_in_v4;		/* E */
+	hook_event_t vpnd_event_out_v4;		/* E */
+	hook_event_token_t vpnd_token_in_v4;	/* E */
+	hook_event_token_t vpnd_token_out_v4;	/* E */
+	net_handle_t vpnd_neti_v6;		/* E */
+	hook_family_t vpnd_family_v6;		/* E */
+	hook_event_t vpnd_event_in_v6;		/* E */
+	hook_event_t vpnd_event_out_v6;		/* E */
+	hook_event_token_t vpnd_token_in_v6;	/* E */
+	hook_event_token_t vpnd_token_out_v6;	/* E */
+	kmutex_t vpnd_lock;		/* Protects remaining members */
+	kcondvar_t vpnd_ref_change;		/* Uses vpnd_lock */
+	int vpnd_ref;				/* L */
+	vnd_pnsd_flags_t vpnd_flags;		/* L */
+	list_t vpnd_dev_list;			/* L */
+} vnd_pnsd_t;
+
+static void vnd_squeue_tx_drain(void *, mblk_t *, gsqueue_t *, void *);
+
+/*
+ * Drop function signature.
+ */
+typedef void (*vnd_dropper_f)(vnd_str_t *, mblk_t *, const char *);
+
+static void
+vnd_drop_ctl(vnd_str_t *vsp, mblk_t *mp, const char *reason)
+{
+	DTRACE_VND4(drop__ctl, mblk_t *, mp, vnd_str_t *, vsp, mblk_t *,
+	    mp, const char *, reason);
+	if (mp != NULL) {
+		freemsg(mp);
+	}
+	VND_STAT_INC(vsp, vks_ndlpidrops, 1);
+	VND_STAT_INC(vsp, vks_tdrops, 1);
+}
+
+static void
+vnd_drop_in(vnd_str_t *vsp, mblk_t *mp, const char *reason)
+{
+	DTRACE_VND4(drop__in, mblk_t *, mp, vnd_str_t *, vsp, mblk_t *,
+	    mp, const char *, reason);
+	if (mp != NULL) {
+		freemsg(mp);
+	}
+	VND_STAT_INC(vsp, vks_ndataindrops, 1);
+	VND_STAT_INC(vsp, vks_tdrops, 1);
+}
+
+static void
+vnd_drop_out(vnd_str_t *vsp, mblk_t *mp, const char *reason)
+{
+	DTRACE_VND4(drop__out, mblk_t *, mp, vnd_str_t *, vsp, mblk_t *,
+	    mp, const char *, reason);
+	if (mp != NULL) {
+		freemsg(mp);
+	}
+	VND_STAT_INC(vsp, vks_ndataoutdrops, 1);
+	VND_STAT_INC(vsp, vks_tdrops, 1);
+}
+
+static void
+vnd_drop_hook_in(vnd_str_t *vsp, mblk_t *mp, const char *reason)
+{
+	DTRACE_VND4(drop__in, mblk_t *, mp, vnd_str_t *, vsp, mblk_t *,
+	    mp, const char *, reason);
+	if (mp != NULL) {
+		freemsg(mp);
+	}
+	VND_STAT_INC(vsp, vks_nhookindrops, 1);
+	VND_STAT_INC(vsp, vks_tdrops, 1);
+}
+
+static void
+vnd_drop_hook_out(vnd_str_t *vsp, mblk_t *mp, const char *reason)
+{
+	DTRACE_VND4(drop__out, mblk_t *, mp, vnd_str_t *, vsp, mblk_t *,
+	    mp, const char *, reason);
+	if (mp != NULL) {
+		freemsg(mp);
+	}
+	VND_STAT_INC(vsp, vks_nhookoutdrops, 1);
+	VND_STAT_INC(vsp, vks_tdrops, 1);
+}
+
+/* ARGSUSED */
+static void
+vnd_drop_panic(vnd_str_t *vsp, mblk_t *mp, const char *reason)
+{
+	panic("illegal vnd drop");
+}
+
+/* ARGSUSED */
+static void
+vnd_mac_drop_input(vnd_str_t *vsp, mac_resource_t *unused, mblk_t *mp_chain,
+    mac_header_info_t *mhip)
+{
+	mblk_t *mp;
+
+	while (mp_chain != NULL) {
+		mp = mp_chain;
+		mp_chain = mp->b_next;
+		vnd_drop_hook_in(vsp, mp, "stream not associated");
+	}
+}
+
+static vnd_pnsd_t *
+vnd_nsd_lookup(netstackid_t nsid)
+{
+	vnd_pnsd_t *nsp;
+
+	mutex_enter(&vnd_dev_lock);
+	for (nsp = list_head(&vnd_nsd_list); nsp != NULL;
+	    nsp = list_next(&vnd_nsd_list, nsp)) {
+		if (nsp->vpnd_nsid == nsid) {
+			mutex_enter(&nsp->vpnd_lock);
+			VERIFY(nsp->vpnd_ref >= 0);
+			nsp->vpnd_ref++;
+			mutex_exit(&nsp->vpnd_lock);
+			break;
+		}
+	}
+	mutex_exit(&vnd_dev_lock);
+	return (nsp);
+}
+
+static vnd_pnsd_t *
+vnd_nsd_lookup_by_zid(zoneid_t zid)
+{
+	netstack_t *ns;
+	vnd_pnsd_t *nsp;
+	ns = netstack_find_by_zoneid(zid);
+	if (ns == NULL)
+		return (NULL);
+	nsp = vnd_nsd_lookup(ns->netstack_stackid);
+	netstack_rele(ns);
+	return (nsp);
+}
+
+static vnd_pnsd_t *
+vnd_nsd_lookup_by_zonename(char *zname)
+{
+	zone_t *zonep;
+	vnd_pnsd_t *nsp;
+
+	zonep = zone_find_by_name(zname);
+	if (zonep == NULL)
+		return (NULL);
+
+	nsp = vnd_nsd_lookup_by_zid(zonep->zone_id);
+	zone_rele(zonep);
+	return (nsp);
+}
+
+static void
+vnd_nsd_ref(vnd_pnsd_t *nsp)
+{
+	mutex_enter(&nsp->vpnd_lock);
+	/*
+	 * This can only be used on something that has been obtained through
+	 * some other means. As such, the caller should already have a reference
+	 * before adding another one. This function should not be used as a
+	 * means of creating the initial reference.
+	 */
+	VERIFY(nsp->vpnd_ref > 0);
+	nsp->vpnd_ref++;
+	mutex_exit(&nsp->vpnd_lock);
+	cv_broadcast(&nsp->vpnd_ref_change);
+}
+
+static void
+vnd_nsd_rele(vnd_pnsd_t *nsp)
+{
+	mutex_enter(&nsp->vpnd_lock);
+	VERIFY(nsp->vpnd_ref > 0);
+	nsp->vpnd_ref--;
+	mutex_exit(&nsp->vpnd_lock);
+	cv_broadcast(&nsp->vpnd_ref_change);
+}
+
+static vnd_dev_t *
+vnd_dev_lookup(minor_t m)
+{
+	vnd_dev_t *vdp;
+	mutex_enter(&vnd_dev_lock);
+	for (vdp = list_head(&vnd_dev_list); vdp != NULL;
+	    vdp = list_next(&vnd_dev_list, vdp)) {
+		if (vdp->vdd_minor == m) {
+			mutex_enter(&vdp->vdd_lock);
+			VERIFY(vdp->vdd_ref > 0);
+			vdp->vdd_ref++;
+			DTRACE_VND_REFINC(vdp);
+			mutex_exit(&vdp->vdd_lock);
+			break;
+		}
+	}
+	mutex_exit(&vnd_dev_lock);
+	return (vdp);
+}
+
+static void
+vnd_dev_free(vnd_dev_t *vdp)
+{
+	/*
+	 * When the STREAM exists we need to go through and make sure
+	 * communication gets torn down. As part of closing the stream, we
+	 * guarantee that nothing else should be able to enter the stream layer
+	 * at this point. That means no one should be able to call
+	 * read(),write() or one of the frameio ioctls.
+	 */
+	if (vdp->vdd_flags & VND_D_ATTACHED) {
+		(void) ldi_close(vdp->vdd_ldih, FREAD | FWRITE, vdp->vdd_cr);
+		crfree(vdp->vdd_cr);
+		vdp->vdd_cr = NULL;
+
+		/*
+		 * We have to remove ourselves from our parents list now. It is
+		 * really quite important that we have already set the condemend
+		 * flag here so that our containing netstack basically knows
+		 * that we're on the way down and knows not to wait for us. It's
+		 * also important that we do that before we put a rele on the
+		 * the device as that is the point at which it will check again.
+		 */
+		mutex_enter(&vdp->vdd_nsd->vpnd_lock);
+		list_remove(&vdp->vdd_nsd->vpnd_dev_list, vdp);
+		mutex_exit(&vdp->vdd_nsd->vpnd_lock);
+		vnd_nsd_rele(vdp->vdd_nsd);
+		vdp->vdd_nsd = NULL;
+	}
+	ASSERT(vdp->vdd_flags & VND_D_CONDEMNED);
+	id_free(vnd_minors, vdp->vdd_minor);
+	mutex_destroy(&vdp->vdd_lock);
+	kmem_cache_free(vnd_dev_cache, vdp);
+}
+
+static void
+vnd_dev_ref(vnd_dev_t *vdp)
+{
+	mutex_enter(&vdp->vdd_lock);
+	VERIFY(vdp->vdd_ref > 0);
+	vdp->vdd_ref++;
+	DTRACE_VND_REFINC(vdp);
+	mutex_exit(&vdp->vdd_lock);
+}
+
+/*
+ * As part of releasing the hold on this we may tear down a given vnd_dev_t As
+ * such we need to make sure that we grab the list lock first before grabbing
+ * the vnd_dev_t's lock to ensure proper lock ordering.
+ */
+static void
+vnd_dev_rele(vnd_dev_t *vdp)
+{
+	mutex_enter(&vnd_dev_lock);
+	mutex_enter(&vdp->vdd_lock);
+	VERIFY(vdp->vdd_ref > 0);
+	vdp->vdd_ref--;
+	DTRACE_VND_REFDEC(vdp);
+	if (vdp->vdd_ref > 0) {
+		mutex_exit(&vdp->vdd_lock);
+		mutex_exit(&vnd_dev_lock);
+		return;
+	}
+
+	/*
+	 * Now that we've removed this from the list, we can go ahead and
+	 * drop the list lock. No one else can find this device and reference
+	 * it. As its reference count is zero, it by definition does not have
+	 * any remaining entries in /devices that could lead someone back to
+	 * this.
+	 */
+	vdp->vdd_flags |= VND_D_CONDEMNED;
+	list_remove(&vnd_dev_list, vdp);
+	mutex_exit(&vdp->vdd_lock);
+	mutex_exit(&vnd_dev_lock);
+
+	vnd_dev_free(vdp);
+}
+
+/*
+ * Insert a mesage block chain if there's space, otherwise drop it. Return one
+ * so someone who was waiting for data would now end up having found it. eg.
+ * caller should consider a broadcast.
+ */
+static int
+vnd_dq_push(vnd_data_queue_t *vqp, mblk_t *mp, boolean_t reserved,
+    vnd_dropper_f dropf)
+{
+	size_t msize;
+
+	ASSERT(MUTEX_HELD(&vqp->vdq_lock));
+	if (reserved == B_FALSE) {
+		msize = msgsize(mp);
+		if (vqp->vdq_cur + msize > vqp->vdq_max) {
+			dropf(vqp->vdq_vns, mp, "buffer full");
+			return (0);
+		}
+		vqp->vdq_cur += msize;
+	}
+
+	if (vqp->vdq_head == NULL) {
+		ASSERT(vqp->vdq_tail == NULL);
+		vqp->vdq_head = mp;
+		vqp->vdq_tail = mp;
+	} else {
+		vqp->vdq_tail->b_next = mp;
+		vqp->vdq_tail = mp;
+	}
+
+	return (1);
+}
+
+/*
+ * Remove a message message block chain. If the amount of space in the buffer
+ * has changed we return 1. We have no way of knowing whether or not there is
+ * enough space overall for a given writer who is blocked, so we always end up
+ * having to return true and thus tell consumers that they should consider
+ * signalling.
+ */
+static int
+vnd_dq_pop(vnd_data_queue_t *vqp, mblk_t **mpp)
+{
+	size_t msize;
+	mblk_t *mp;
+
+	ASSERT(MUTEX_HELD(&vqp->vdq_lock));
+	ASSERT(mpp != NULL);
+	if (vqp->vdq_head == NULL) {
+		ASSERT(vqp->vdq_tail == NULL);
+		*mpp = NULL;
+		return (0);
+	}
+
+	mp = vqp->vdq_head;
+	msize = msgsize(mp);
+
+	vqp->vdq_cur -= msize;
+	if (mp->b_next == NULL) {
+		vqp->vdq_head = NULL;
+		vqp->vdq_tail = NULL;
+		/*
+		 * We can't be certain that this is always going to be zero.
+		 * Someone may have basically taken a reservation of space on
+		 * the data queue, eg. claimed spae but not yet pushed it on
+		 * yet.
+		 */
+		ASSERT(vqp->vdq_cur >= 0);
+	} else {
+		vqp->vdq_head = mp->b_next;
+		ASSERT(vqp->vdq_cur > 0);
+	}
+	mp->b_next = NULL;
+	*mpp = mp;
+	return (1);
+}
+
+/*
+ * Reserve space in the queue. This will bump up the size of the queue and
+ * entitle the user to push something on later without bumping the space.
+ */
+static int
+vnd_dq_reserve(vnd_data_queue_t *vqp, ssize_t size)
+{
+	ASSERT(MUTEX_HELD(&vqp->vdq_lock));
+	ASSERT(size >= 0);
+
+	if (size == 0)
+		return (0);
+
+	if (size + vqp->vdq_cur > vqp->vdq_max)
+		return (0);
+
+	vqp->vdq_cur += size;
+	return (1);
+}
+
+static void
+vnd_dq_unreserve(vnd_data_queue_t *vqp, ssize_t size)
+{
+	ASSERT(MUTEX_HELD(&vqp->vdq_lock));
+	ASSERT(size > 0);
+	ASSERT(size <= vqp->vdq_cur);
+
+	vqp->vdq_cur -= size;
+}
+
+static void
+vnd_dq_flush(vnd_data_queue_t *vqp, vnd_dropper_f dropf)
+{
+	mblk_t *mp, *next;
+
+	mutex_enter(&vqp->vdq_lock);
+	for (mp = vqp->vdq_head; mp != NULL; mp = next) {
+		next = mp->b_next;
+		mp->b_next = NULL;
+		dropf(vqp->vdq_vns, mp, "vnd_dq_flush");
+	}
+	vqp->vdq_cur = 0;
+	vqp->vdq_head = NULL;
+	vqp->vdq_tail = NULL;
+	mutex_exit(&vqp->vdq_lock);
+}
+
+static boolean_t
+vnd_dq_is_empty(vnd_data_queue_t *vqp)
+{
+	boolean_t ret;
+
+	mutex_enter(&vqp->vdq_lock);
+	if (vqp->vdq_head == NULL)
+		ret = B_TRUE;
+	else
+		ret = B_FALSE;
+	mutex_exit(&vqp->vdq_lock);
+
+	return (ret);
+}
+
+/*
+ * Get a network uint16_t from the message and translate it into something the
+ * host understands.
+ */
+static int
+vnd_mbc_getu16(mblk_t *mp, off_t off, uint16_t *out)
+{
+	size_t mpsize;
+	uint8_t *bp;
+
+	mpsize = msgsize(mp);
+	/* Check for overflow */
+	if (off + sizeof (uint16_t) > mpsize)
+		return (1);
+
+	mpsize = MBLKL(mp);
+	while (off >= mpsize) {
+		mp = mp->b_cont;
+		off -= mpsize;
+		mpsize = MBLKL(mp);
+	}
+
+	/*
+	 * Data is in network order. Note the second byte of data might be in
+	 * the next mp.
+	 */
+	bp = mp->b_rptr + off;
+	*out = *bp << 8;
+	if (off + 1 == mpsize) {
+		mp = mp->b_cont;
+		bp = mp->b_rptr;
+	} else {
+		bp++;
+	}
+
+	*out |= *bp;
+	return (0);
+}
+
+/*
+ * Given an mblk chain find the mblk and address of a particular offset.
+ */
+static int
+vnd_mbc_getoffset(mblk_t *mp, off_t off, mblk_t **mpp, uintptr_t *offp)
+{
+	size_t mpsize;
+
+	if (off >= msgsize(mp))
+		return (1);
+
+	mpsize = MBLKL(mp);
+	while (off >= mpsize) {
+		mp = mp->b_cont;
+		off -= mpsize;
+		mpsize = MBLKL(mp);
+	}
+	*mpp = mp;
+	*offp = (uintptr_t)mp->b_rptr + off;
+
+	return (0);
+}
+
+/*
+ * Fetch the destination mac address. Set *dstp to that mac address. If the data
+ * is not contiguous in the first mblk_t, fill in datap and set *dstp to it.
+ */
+static int
+vnd_mbc_getdstmac(mblk_t *mp, uint8_t **dstpp, uint8_t *datap)
+{
+	int i;
+
+	if (MBLKL(mp) >= ETHERADDRL) {
+		*dstpp = mp->b_rptr;
+		return (0);
+	}
+
+	*dstpp = datap;
+	for (i = 0; i < ETHERADDRL; i += 2, datap += 2) {
+		if (vnd_mbc_getu16(mp, i, (uint16_t *)datap) != 0)
+			return (1);
+	}
+
+	return (0);
+}
+
+static int
+vnd_hook(vnd_str_t *vsp, mblk_t **mpp, net_handle_t netiv4, hook_event_t hev4,
+    hook_event_token_t hetv4, net_handle_t netiv6, hook_event_t hev6,
+    hook_event_token_t hetv6, vnd_dropper_f hdrop, vnd_dropper_f ddrop)
+{
+	uint16_t etype;
+	hook_pkt_event_t info;
+	size_t offset, mblen;
+	uint8_t *dstp;
+	uint8_t dstaddr[6];
+	hook_event_t he;
+	hook_event_token_t het;
+	net_handle_t neti;
+
+	/*
+	 * Before we can ask if we're interested we have to do enough work to
+	 * determine the ethertype.
+	 */
+
+	/* Byte 12 is either the VLAN tag or the ethertype */
+	if (vnd_mbc_getu16(*mpp, 12, &etype) != 0) {
+		ddrop(vsp, *mpp, "packet has incomplete ethernet header");
+		*mpp = NULL;
+		return (1);
+	}
+
+	if (etype == ETHERTYPE_VLAN) {
+		/* Actual ethertype is another four bytes in */
+		if (vnd_mbc_getu16(*mpp, 16, &etype) != 0) {
+			ddrop(vsp, *mpp,
+			    "packet has incomplete ethernet vlan header");
+			*mpp = NULL;
+			return (1);
+		}
+		offset = sizeof (struct ether_vlan_header);
+	} else {
+		offset = sizeof (struct ether_header);
+	}
+
+	/*
+	 * At the moment we only hook on the kinds of things that the IP module
+	 * would normally.
+	 */
+	if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6)
+		return (0);
+
+	if (etype == ETHERTYPE_IP) {
+		neti = netiv4;
+		he = hev4;
+		het = hetv4;
+	} else {
+		neti = netiv6;
+		he = hev6;
+		het = hetv6;
+	}
+
+	if (!he.he_interested)
+		return (0);
+
+
+	if (vnd_mbc_getdstmac(*mpp, &dstp, dstaddr) != 0) {
+		ddrop(vsp, *mpp, "packet has incomplete ethernet header");
+		*mpp = NULL;
+		return (1);
+	}
+
+	/*
+	 * Now that we know we're interested, we have to do some additional
+	 * sanity checking for IPF's sake, ala ip_check_length(). Specifically
+	 * we need to check to make sure that the remaining packet size,
+	 * excluding MAC, is at least the size of an IP header.
+	 */
+	mblen = msgsize(*mpp);
+	if ((etype == ETHERTYPE_IP &&
+	    mblen - offset < IP_SIMPLE_HDR_LENGTH) ||
+	    (etype == ETHERTYPE_IPV6 && mblen - offset < IPV6_HDR_LEN)) {
+		ddrop(vsp, *mpp, "packet has invalid IP header");
+		*mpp = NULL;
+		return (1);
+	}
+
+	info.hpe_protocol = neti;
+	info.hpe_ifp = (phy_if_t)vsp;
+	info.hpe_ofp = (phy_if_t)vsp;
+	info.hpe_mp = mpp;
+	info.hpe_flags = 0;
+
+	if (bcmp(vnd_bcast_addr, dstp, ETHERADDRL) == 0)
+		info.hpe_flags |= HPE_BROADCAST;
+	else if (etype == ETHERTYPE_IP &&
+	    bcmp(vnd_ipv4_mcast, vnd_bcast_addr, IPV4_MCAST_LEN) == 0)
+		info.hpe_flags |= HPE_MULTICAST;
+	else if (etype == ETHERTYPE_IPV6 &&
+	    bcmp(vnd_ipv6_mcast, vnd_bcast_addr, IPV6_MCAST_LEN) == 0)
+		info.hpe_flags |= HPE_MULTICAST;
+
+	if (vnd_mbc_getoffset(*mpp, offset, &info.hpe_mb,
+	    (uintptr_t *)&info.hpe_hdr) != 0) {
+		ddrop(vsp, *mpp, "packet too small -- "
+		    "unable to find payload");
+		*mpp = NULL;
+		return (1);
+	}
+
+	if (hook_run(neti->netd_hooks, het, (hook_data_t)&info) != 0) {
+		hdrop(vsp, *mpp, "drooped by hooks");
+		return (1);
+	}
+
+	return (0);
+}
+
+/*
+ * This should not be used for DL_INFO_REQ.
+ */
+static mblk_t *
+vnd_dlpi_alloc(size_t len, t_uscalar_t prim)
+{
+	mblk_t *mp;
+	mp = allocb(len, BPRI_MED);
+	if (mp == NULL)
+		return (NULL);
+
+	mp->b_datap->db_type = M_PROTO;
+	mp->b_wptr = mp->b_rptr + len;
+	bzero(mp->b_rptr, len);
+	((dl_unitdata_req_t *)mp->b_rptr)->dl_primitive = prim;
+
+	return (mp);
+}
+
+static void
+vnd_dlpi_inc_push(vnd_str_t *vsp, mblk_t *mp)
+{
+	mblk_t **mpp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	ASSERT(mp->b_next == NULL);
+	mpp = &vsp->vns_dlpi_inc;
+	while (*mpp != NULL)
+		mpp = &((*mpp)->b_next);
+	*mpp = mp;
+}
+
+static mblk_t *
+vnd_dlpi_inc_pop(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vsp->vns_dlpi_inc;
+	if (mp != NULL) {
+		VERIFY(mp->b_next == NULL || mp->b_next != mp);
+		vsp->vns_dlpi_inc = mp->b_next;
+		mp->b_next = NULL;
+	}
+	return (mp);
+}
+
+static int
+vnd_st_sinfo(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	dl_info_req_t *dlir;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
+	    BPRI_HI);
+	if (mp == NULL) {
+		vsp->vns_errno = VND_E_NOMEM;
+		return (1);
+	}
+	vsp->vns_state = VNS_S_INFO_SENT;
+	cv_broadcast(&vsp->vns_stcv);
+
+	mp->b_datap->db_type = M_PCPROTO;
+	dlir = (dl_info_req_t *)mp->b_rptr;
+	mp->b_wptr = (uchar_t *)&dlir[1];
+	dlir->dl_primitive = DL_INFO_REQ;
+	putnext(vsp->vns_wq, mp);
+
+	return (0);
+}
+
+static int
+vnd_st_info(vnd_str_t *vsp)
+{
+	dl_info_ack_t *dlia;
+	mblk_t *mp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_inc_pop(vsp);
+	dlia = (dl_info_ack_t *)mp->b_rptr;
+	vsp->vns_dlpi_style = dlia->dl_provider_style;
+	vsp->vns_minwrite = dlia->dl_min_sdu;
+	vsp->vns_maxwrite = dlia->dl_max_sdu;
+
+	/*
+	 * At this time we only support DL_ETHER devices.
+	 */
+	if (dlia->dl_mac_type != DL_ETHER) {
+		freemsg(mp);
+		vsp->vns_errno = VND_E_NOTETHER;
+		return (1);
+	}
+
+	/*
+	 * Because vnd operates on entire packets, we need to manually account
+	 * for the ethernet header information. We add the size of the
+	 * ether_vlan_header to account for this, regardless if it is using
+	 * vlans or not.
+	 */
+	vsp->vns_maxwrite += sizeof (struct ether_vlan_header);
+
+	freemsg(mp);
+	return (0);
+}
+
+static int
+vnd_st_sexclusive(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_alloc(sizeof (dl_attach_req_t), DL_EXCLUSIVE_REQ);
+	if (mp == NULL) {
+		vsp->vns_errno = VND_E_NOMEM;
+		return (1);
+	}
+
+	vsp->vns_state = VNS_S_EXCLUSIVE_SENT;
+	cv_broadcast(&vsp->vns_stcv);
+	putnext(vsp->vns_wq, mp);
+	return (0);
+}
+
+static int
+vnd_st_exclusive(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	t_uscalar_t prim, cprim;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_inc_pop(vsp);
+	prim = ((dl_error_ack_t *)mp->b_rptr)->dl_primitive;
+	cprim = ((dl_ok_ack_t *)mp->b_rptr)->dl_correct_primitive;
+
+	if (prim != DL_OK_ACK && prim != DL_ERROR_ACK) {
+		vnd_drop_ctl(vsp, mp,
+		    "wrong dlpi primitive for vnd_st_exclusive");
+		vsp->vns_errno = VND_E_DLPIINVAL;
+		return (1);
+	}
+
+	if (cprim != DL_EXCLUSIVE_REQ) {
+		vnd_drop_ctl(vsp, mp,
+		    "vnd_st_exclusive: got ack/nack for wrong primitive");
+		vsp->vns_errno = VND_E_DLPIINVAL;
+		return (1);
+	}
+
+	if (prim == DL_ERROR_ACK)
+		vsp->vns_errno = VND_E_DLEXCL;
+
+	freemsg(mp);
+	return (prim == DL_ERROR_ACK);
+}
+
+/*
+ * Send down a DLPI_ATTACH_REQ.
+ */
+static int
+vnd_st_sattach(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_alloc(sizeof (dl_attach_req_t), DL_ATTACH_REQ);
+	if (mp == NULL) {
+		vsp->vns_errno = VND_E_NOMEM;
+		return (1);
+	}
+
+	((dl_attach_req_t *)mp->b_rptr)->dl_ppa = 0;
+	vsp->vns_state = VNS_S_ATTACH_SENT;
+	cv_broadcast(&vsp->vns_stcv);
+	putnext(vsp->vns_wq, mp);
+
+	return (0);
+}
+
+static int
+vnd_st_attach(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	t_uscalar_t prim, cprim;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_inc_pop(vsp);
+	prim = ((dl_ok_ack_t *)mp->b_rptr)->dl_primitive;
+	cprim = ((dl_ok_ack_t *)mp->b_rptr)->dl_correct_primitive;
+
+
+	if (prim != DL_OK_ACK && prim != DL_ERROR_ACK) {
+		vnd_drop_ctl(vsp, mp, "vnd_st_attach: unknown primitive type");
+		vsp->vns_errno = VND_E_DLPIINVAL;
+		return (1);
+	}
+
+	if (cprim != DL_ATTACH_REQ) {
+		vnd_drop_ctl(vsp, mp,
+		    "vnd_st_attach: Got ack/nack for wrong primitive");
+		vsp->vns_errno = VND_E_DLPIINVAL;
+		return (1);
+	}
+
+	if (prim == DL_ERROR_ACK)
+		vsp->vns_errno = VND_E_ATTACHFAIL;
+
+	freemsg(mp);
+	return (prim == DL_ERROR_ACK);
+}
+
+static int
+vnd_st_sbind(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	dl_bind_req_t *dbrp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
+	    DL_BIND_REQ);
+	if (mp == NULL) {
+		vsp->vns_errno = VND_E_NOMEM;
+		return (1);
+	}
+	dbrp = (dl_bind_req_t *)(mp->b_rptr);
+	dbrp->dl_sap = 0;
+	dbrp->dl_service_mode = DL_CLDLS;
+
+	vsp->vns_state = VNS_S_BIND_SENT;
+	cv_broadcast(&vsp->vns_stcv);
+	putnext(vsp->vns_wq, mp);
+
+	return (0);
+}
+
+static int
+vnd_st_bind(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	t_uscalar_t prim;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_inc_pop(vsp);
+	prim = ((dl_error_ack_t *)mp->b_rptr)->dl_primitive;
+
+	if (prim != DL_BIND_ACK && prim != DL_ERROR_ACK) {
+		vnd_drop_ctl(vsp, mp, "wrong dlpi primitive for vnd_st_bind");
+		vsp->vns_errno = VND_E_DLPIINVAL;
+		return (1);
+	}
+
+	if (prim == DL_ERROR_ACK)
+		vsp->vns_errno = VND_E_BINDFAIL;
+
+	freemsg(mp);
+	return (prim == DL_ERROR_ACK);
+}
+
+static int
+vnd_st_spromisc(vnd_str_t *vsp, int type, vnd_str_state_t next)
+{
+	mblk_t *mp;
+	dl_promiscon_req_t *dprp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_alloc(sizeof (dl_promiscon_req_t), DL_PROMISCON_REQ);
+	if (mp == NULL) {
+		vsp->vns_errno = VND_E_NOMEM;
+		return (1);
+	}
+
+	dprp = (dl_promiscon_req_t *)mp->b_rptr;
+	dprp->dl_level = type;
+
+	vsp->vns_state = next;
+	cv_broadcast(&vsp->vns_stcv);
+	putnext(vsp->vns_wq, mp);
+
+	return (0);
+}
+
+static int
+vnd_st_promisc(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	t_uscalar_t prim, cprim;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_inc_pop(vsp);
+	prim = ((dl_ok_ack_t *)mp->b_rptr)->dl_primitive;
+	cprim = ((dl_ok_ack_t *)mp->b_rptr)->dl_correct_primitive;
+
+	if (prim != DL_OK_ACK && prim != DL_ERROR_ACK) {
+		vnd_drop_ctl(vsp, mp,
+		    "wrong dlpi primitive for vnd_st_promisc");
+		vsp->vns_errno = VND_E_DLPIINVAL;
+		return (1);
+	}
+
+	if (cprim != DL_PROMISCON_REQ) {
+		vnd_drop_ctl(vsp, mp,
+		    "vnd_st_promisc: Got ack/nack for wrong primitive");
+		vsp->vns_errno = VND_E_DLPIINVAL;
+		return (1);
+	}
+
+	if (prim == DL_ERROR_ACK)
+		vsp->vns_errno = VND_E_PROMISCFAIL;
+
+	freemsg(mp);
+	return (prim == DL_ERROR_ACK);
+}
+
+static int
+vnd_st_scapabq(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+
+	mp = vnd_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
+	if (mp == NULL) {
+		vsp->vns_errno = VND_E_NOMEM;
+		return (1);
+	}
+
+	vsp->vns_state = VNS_S_CAPAB_Q_SENT;
+	cv_broadcast(&vsp->vns_stcv);
+	putnext(vsp->vns_wq, mp);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+vnd_mac_input(vnd_str_t *vsp, mac_resource_t *unused, mblk_t *mp_chain,
+    mac_header_info_t *mhip)
+{
+	int signal = 0;
+	mblk_t *mp;
+	vnd_pnsd_t *nsp = vsp->vns_nsd;
+
+	ASSERT(vsp != NULL);
+	ASSERT(mp_chain != NULL);
+
+	for (mp = mp_chain; mp != NULL; mp = mp_chain) {
+		uint16_t vid;
+		mp_chain = mp->b_next;
+		mp->b_next = NULL;
+
+		/*
+		 * If we were operating in a traditional dlpi context then we
+		 * would have enabled DLIOCRAW and rather than the fast path, we
+		 * would come through dld_str_rx_raw. That function does two
+		 * things that we have to consider doing ourselves. The first is
+		 * that it adjusts the b_rptr back to account for dld bumping us
+		 * past the mac header. It also tries to account for cases where
+		 * mac provides an illusion of the mac header. Fortunately, dld
+		 * only allows the fastpath when the media type is the same as
+		 * the native type. Therefore all we have to do here is adjust
+		 * the b_rptr.
+		 */
+		ASSERT(mp->b_rptr >= DB_BASE(mp) + mhip->mhi_hdrsize);
+		mp->b_rptr -= mhip->mhi_hdrsize;
+		vid = VLAN_ID(mhip->mhi_tci);
+		if (mhip->mhi_istagged && vid != VLAN_ID_NONE) {
+			/*
+			 * This is an overlapping copy. Do not use bcopy(9F).
+			 */
+			(void) memmove(mp->b_rptr + 4, mp->b_rptr, 12);
+			mp->b_rptr += 4;
+		}
+
+		if (nsp->vpnd_hooked && vnd_hook(vsp, &mp, nsp->vpnd_neti_v4,
+		    nsp->vpnd_event_in_v4, nsp->vpnd_token_in_v4,
+		    nsp->vpnd_neti_v6, nsp->vpnd_event_in_v6,
+		    nsp->vpnd_token_in_v6, vnd_drop_hook_in, vnd_drop_in) != 0)
+			continue;
+
+		VND_STAT_INC(vsp, vks_rpackets, 1);
+		VND_STAT_INC(vsp, vks_rbytes, msgsize(mp));
+		DTRACE_VND5(recv, mblk_t *, mp, void *, NULL, void *, NULL,
+		    vnd_str_t *, vsp, mblk_t *, mp);
+		mutex_enter(&vsp->vns_dq_read.vdq_lock);
+		signal |= vnd_dq_push(&vsp->vns_dq_read, mp, B_FALSE,
+		    vnd_drop_in);
+		mutex_exit(&vsp->vns_dq_read.vdq_lock);
+	}
+
+	if (signal != 0) {
+		cv_broadcast(&vsp->vns_dq_read.vdq_ready);
+		pollwakeup(&vsp->vns_dev->vdd_ph, POLLIN | POLLRDNORM);
+	}
+
+}
+
+static void
+vnd_mac_flow_control_stat(vnd_str_t *vsp, hrtime_t diff)
+{
+	VND_STAT_INC(vsp, vks_nmacflow, 1);
+	VND_STAT_INC(vsp, vks_tmacflow, diff);
+	if (diff >= VND_LATENCY_1MS)
+		VND_STAT_INC(vsp, vks_mac_flow_1ms, 1);
+	if (diff >= VND_LATENCY_10MS)
+		VND_STAT_INC(vsp, vks_mac_flow_10ms, 1);
+	if (diff >= VND_LATENCY_100MS)
+		VND_STAT_INC(vsp, vks_mac_flow_100ms, 1);
+	if (diff >= VND_LATENCY_1S)
+		VND_STAT_INC(vsp, vks_mac_flow_1s, 1);
+	if (diff >= VND_LATENCY_10S)
+		VND_STAT_INC(vsp, vks_mac_flow_10s, 1);
+}
+
+/*
+ * This is a callback from MAC that indicates that we are allowed to send
+ * packets again.
+ */
+static void
+vnd_mac_flow_control(void *arg, vnd_mac_cookie_t cookie)
+{
+	vnd_str_t *vsp = arg;
+	hrtime_t now;
+
+	mutex_enter(&vsp->vns_lock);
+	now = gethrtime();
+
+	/*
+	 * Check for the case that we beat vnd_squeue_tx_one to the punch.
+	 * There's also an additional case here that we got notified because
+	 * we're sharing a device that ran out of tx descriptors, even though it
+	 * wasn't because of us.
+	 */
+	if (!(vsp->vns_flags & VNS_F_FLOW_CONTROLLED)) {
+		vsp->vns_fcupdate = now;
+		mutex_exit(&vsp->vns_lock);
+		return;
+	}
+
+	ASSERT(vsp->vns_flags & VNS_F_FLOW_CONTROLLED);
+	ASSERT(vsp->vns_caps.vsc_fc_cookie == cookie);
+	vsp->vns_flags &= ~VNS_F_FLOW_CONTROLLED;
+	vsp->vns_caps.vsc_fc_cookie = NULL;
+	vsp->vns_fclatch = 0;
+	DTRACE_VND3(flow__resumed, vnd_str_t *, vsp, uint64_t,
+	    vsp->vns_dq_write.vdq_cur, uintptr_t, cookie);
+	/*
+	 * If someone has asked to flush the squeue and thus inserted a barrier,
+	 * than we shouldn't schedule a drain.
+	 */
+	if (!(vsp->vns_flags & (VNS_F_DRAIN_SCHEDULED | VNS_F_BARRIER))) {
+		vsp->vns_flags |= VNS_F_DRAIN_SCHEDULED;
+		gsqueue_enter_one(vsp->vns_squeue, &vsp->vns_drainblk,
+		    vnd_squeue_tx_drain, vsp, GSQUEUE_FILL,
+		    VND_SQUEUE_TAG_MAC_FLOW_CONTROL);
+	}
+	mutex_exit(&vsp->vns_lock);
+}
+
+static void
+vnd_mac_enter(vnd_str_t *vsp, mac_perim_handle_t *mphp)
+{
+	ASSERT(MUTEX_HELD(&vsp->vns_lock));
+	VERIFY(vsp->vns_caps.vsc_capab_f(vsp->vns_caps.vsc_capab_hdl,
+	    DLD_CAPAB_PERIM, mphp, DLD_ENABLE) == 0);
+}
+
+static void
+vnd_mac_exit(vnd_str_t *vsp, mac_perim_handle_t mph)
+{
+	ASSERT(MUTEX_HELD(&vsp->vns_lock));
+	VERIFY(vsp->vns_caps.vsc_capab_f(vsp->vns_caps.vsc_capab_hdl,
+	    DLD_CAPAB_PERIM, mph, DLD_DISABLE) == 0);
+}
+
+static int
+vnd_dld_cap_enable(vnd_str_t *vsp, vnd_rx_t rxfunc)
+{
+	int ret;
+	dld_capab_direct_t d;
+	mac_perim_handle_t mph;
+	vnd_str_capab_t *c = &vsp->vns_caps;
+
+	bzero(&d, sizeof (d));
+	d.di_rx_cf = (uintptr_t)rxfunc;
+	d.di_rx_ch = vsp;
+	d.di_flags = DI_DIRECT_RAW;
+
+	vnd_mac_enter(vsp, &mph);
+
+	/*
+	 * If we're coming in here for a second pass, we need to make sure that
+	 * we remove an existing flow control notification callback, otherwise
+	 * we'll create a duplicate that will remain with garbage data.
+	 */
+	if (c->vsc_tx_fc_hdl != NULL) {
+		ASSERT(c->vsc_set_fcb_hdl != NULL);
+		(void) c->vsc_set_fcb_f(c->vsc_set_fcb_hdl, NULL,
+		    c->vsc_tx_fc_hdl);
+		c->vsc_tx_fc_hdl = NULL;
+	}
+
+	if (vsp->vns_caps.vsc_capab_f(c->vsc_capab_hdl,
+	    DLD_CAPAB_DIRECT, &d, DLD_ENABLE) == 0) {
+		c->vsc_tx_f = (vnd_dld_tx_t)d.di_tx_df;
+		c->vsc_tx_hdl = d.di_tx_dh;
+		c->vsc_set_fcb_f = (vnd_dld_set_fcb_t)d.di_tx_cb_df;
+		c->vsc_set_fcb_hdl = d.di_tx_cb_dh;
+		c->vsc_is_fc_f = (vnd_dld_is_fc_t)d.di_tx_fctl_df;
+		c->vsc_is_fc_hdl = d.di_tx_fctl_dh;
+		c->vsc_tx_fc_hdl = c->vsc_set_fcb_f(c->vsc_set_fcb_hdl,
+		    vnd_mac_flow_control, vsp);
+		c->vsc_flags |= VNS_C_DIRECT;
+		ret = 0;
+	} else {
+		vsp->vns_errno = VND_E_DIRECTFAIL;
+		ret = 1;
+	}
+	vnd_mac_exit(vsp, mph);
+	return (ret);
+}
+
+static int
+vnd_st_capabq(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	dl_capability_ack_t *cap;
+	dl_capability_sub_t *subp;
+	dl_capab_hcksum_t *hck;
+	dl_capab_dld_t *dld;
+	unsigned char *rp;
+	int ret = 0;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_inc_pop(vsp);
+
+	rp = mp->b_rptr;
+	cap = (dl_capability_ack_t *)rp;
+	if (cap->dl_sub_length == 0)
+		goto done;
+
+	/* Don't try to process something too big */
+	if (sizeof (dl_capability_ack_t) + cap->dl_sub_length > MBLKL(mp)) {
+		VND_STAT_INC(vsp, vks_ndlpidrops, 1);
+		VND_STAT_INC(vsp, vks_tdrops, 1);
+		vsp->vns_errno = VND_E_CAPACKINVAL;
+		ret = 1;
+		goto done;
+	}
+
+	rp += cap->dl_sub_offset;
+
+	while (cap->dl_sub_length > 0) {
+		subp = (dl_capability_sub_t *)rp;
+		/* Sanity check something crazy from down below */
+		if (subp->dl_length + sizeof (dl_capability_sub_t) >
+		    cap->dl_sub_length) {
+			VND_STAT_INC(vsp, vks_ndlpidrops, 1);
+			VND_STAT_INC(vsp, vks_tdrops, 1);
+			vsp->vns_errno = VND_E_SUBCAPINVAL;
+			ret = 1;
+			goto done;
+		}
+
+		switch (subp->dl_cap) {
+		case DL_CAPAB_HCKSUM:
+			hck = (dl_capab_hcksum_t *)(rp +
+			    sizeof (dl_capability_sub_t));
+			if (hck->hcksum_version != HCKSUM_CURRENT_VERSION) {
+				vsp->vns_caps.vsc_flags |= VNS_C_HCKSUM_BADVERS;
+				break;
+			}
+			if (dlcapabcheckqid(&hck->hcksum_mid, vsp->vns_lrq) !=
+			    B_TRUE) {
+				vsp->vns_errno = VND_E_CAPABPASS;
+				ret = 1;
+				goto done;
+			}
+			vsp->vns_caps.vsc_flags |= VNS_C_HCKSUM;
+			vsp->vns_caps.vsc_hcksum_opts = hck->hcksum_txflags;
+			break;
+		case DL_CAPAB_DLD:
+			dld = (dl_capab_dld_t *)(rp +
+			    sizeof (dl_capability_sub_t));
+			if (dld->dld_version != DLD_CURRENT_VERSION) {
+				vsp->vns_errno = VND_E_DLDBADVERS;
+				ret = 1;
+				goto done;
+			}
+			if (dlcapabcheckqid(&dld->dld_mid, vsp->vns_lrq) !=
+			    B_TRUE) {
+				vsp->vns_errno = VND_E_CAPABPASS;
+				ret = 1;
+				goto done;
+			}
+			vsp->vns_caps.vsc_flags |= VNS_C_DLD;
+			vsp->vns_caps.vsc_capab_f =
+			    (vnd_dld_cap_t)dld->dld_capab;
+			vsp->vns_caps.vsc_capab_hdl =
+			    (void *)dld->dld_capab_handle;
+			/*
+			 * At this point in time, we have to set up a direct
+			 * function that drops all input. This validates that
+			 * we'll be able to set up direct input and that we can
+			 * easily switch it earlier to the real data function
+			 * when we've plumbed everything up.
+			 */
+			if (vnd_dld_cap_enable(vsp, vnd_mac_drop_input) != 0) {
+				/* vns_errno set by vnd_dld_cap_enable */
+				ret = 1;
+				goto done;
+			}
+			break;
+		default:
+			/* Ignore unsupported cap */
+			break;
+		}
+
+		rp += sizeof (dl_capability_sub_t) + subp->dl_length;
+		cap->dl_sub_length -= sizeof (dl_capability_sub_t) +
+		    subp->dl_length;
+	}
+
+done:
+	/* Make sure we enabled direct callbacks */
+	if (ret == 0 && !(vsp->vns_caps.vsc_flags & VNS_C_DIRECT)) {
+		vsp->vns_errno = VND_E_DIRECTNOTSUP;
+		ret = 1;
+	}
+
+	freemsg(mp);
+	return (ret);
+}
+
+static void
+vnd_st_sonline(vnd_str_t *vsp)
+{
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	vsp->vns_state = VNS_S_ONLINE;
+	cv_broadcast(&vsp->vns_stcv);
+}
+
+static void
+vnd_st_shutdown(vnd_str_t *vsp)
+{
+	mac_perim_handle_t mph;
+	vnd_str_capab_t *vsc = &vsp->vns_caps;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+
+	/*
+	 * At this point in time we know that there is no one transmitting as
+	 * our final reference has been torn down and that vnd_s_close inserted
+	 * a barrier to validate that everything is flushed.
+	 */
+	if (vsc->vsc_flags & VNS_C_DIRECT) {
+		vnd_mac_enter(vsp, &mph);
+		vsc->vsc_flags &= ~VNS_C_DIRECT;
+		(void) vsc->vsc_set_fcb_f(vsc->vsc_set_fcb_hdl, NULL,
+		    vsc->vsc_tx_fc_hdl);
+		vsc->vsc_tx_fc_hdl = NULL;
+		(void) vsc->vsc_capab_f(vsc->vsc_capab_hdl, DLD_CAPAB_DIRECT,
+		    NULL, DLD_DISABLE);
+		vnd_mac_exit(vsp, mph);
+	}
+}
+
+static boolean_t
+vnd_st_spromiscoff(vnd_str_t *vsp, int type, vnd_str_state_t next)
+{
+	boolean_t ret = B_TRUE;
+	mblk_t *mp;
+	dl_promiscoff_req_t *dprp;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+	mp = vnd_dlpi_alloc(sizeof (dl_promiscon_req_t), DL_PROMISCOFF_REQ);
+	if (mp == NULL) {
+		cmn_err(CE_NOTE, "!vnd failed to allocate mblk_t for "
+		    "promiscoff request");
+		ret = B_FALSE;
+		goto next;
+	}
+
+	dprp = (dl_promiscoff_req_t *)mp->b_rptr;
+	dprp->dl_level = type;
+
+	putnext(vsp->vns_wq, mp);
+next:
+	vsp->vns_state = next;
+	cv_broadcast(&vsp->vns_stcv);
+	return (ret);
+}
+
+static void
+vnd_st_promiscoff(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	t_uscalar_t prim, cprim;
+
+	VERIFY(MUTEX_HELD(&vsp->vns_lock));
+
+	/*
+	 * Unlike other cases where we guard against the incoming packet being
+	 * NULL, during tear down we try to keep driving and therefore we may
+	 * have gotten here due to an earlier failure, so there's nothing to do.
+	 */
+	mp = vnd_dlpi_inc_pop(vsp);
+	if (mp == NULL)
+		return;
+
+	prim = ((dl_ok_ack_t *)mp->b_rptr)->dl_primitive;
+	cprim = ((dl_ok_ack_t *)mp->b_rptr)->dl_correct_primitive;
+
+	if (prim != DL_OK_ACK && prim != DL_ERROR_ACK) {
+		vnd_drop_ctl(vsp, mp,
+		    "wrong dlpi primitive for vnd_st_promiscoff");
+		return;
+	}
+
+	if (cprim != DL_PROMISCOFF_REQ) {
+		vnd_drop_ctl(vsp, mp,
+		    "vnd_st_promiscoff: Got ack/nack for wrong primitive");
+		return;
+	}
+
+	if (prim == DL_ERROR_ACK) {
+		cmn_err(CE_WARN, "!failed to disable promiscuos mode during "
+		    "vnd teardown");
+	}
+}
+
+static boolean_t
+vnd_st_sunbind(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	boolean_t ret = B_TRUE;
+
+	mp = vnd_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
+	if (mp == NULL) {
+		cmn_err(CE_NOTE, "!vnd failed to allocate mblk_t for "
+		    "unbind request");
+		ret = B_FALSE;
+		goto next;
+	}
+
+	putnext(vsp->vns_wq, mp);
+next:
+	vsp->vns_state = VNS_S_UNBIND_SENT;
+	cv_broadcast(&vsp->vns_stcv);
+	return (ret);
+}
+
+static void
+vnd_st_unbind(vnd_str_t *vsp)
+{
+	mblk_t *mp;
+	t_uscalar_t prim, cprim;
+
+	/*
+	 * Unlike other cases where we guard against the incoming packet being
+	 * NULL, during tear down we try to keep driving and therefore we may
+	 * have gotten here due to an earlier failure, so there's nothing to do.
+	 */
+	mp = vnd_dlpi_inc_pop(vsp);
+	if (mp == NULL)
+		goto next;
+
+	prim = ((dl_ok_ack_t *)mp->b_rptr)->dl_primitive;
+	cprim = ((dl_ok_ack_t *)mp->b_rptr)->dl_correct_primitive;
+
+	if (prim != DL_OK_ACK && prim != DL_ERROR_ACK) {
+		vnd_drop_ctl(vsp, mp,
+		    "wrong dlpi primitive for vnd_st_unbind");
+		goto next;
+	}
+
+	if (cprim != DL_UNBIND_REQ) {
+		vnd_drop_ctl(vsp, mp,
+		    "vnd_st_unbind: Got ack/nack for wrong primitive");
+		goto next;
+	}
+
+	if (prim == DL_ERROR_ACK) {
+		cmn_err(CE_WARN, "!failed to unbind stream during vnd "
+		    "teardown");
+	}
+
+next:
+	vsp->vns_state = VNS_S_ZOMBIE;
+	cv_broadcast(&vsp->vns_stcv);
+}
+
+/*
+ * Perform state transitions. This is a one way shot down the flow chart
+ * described in the big theory statement.
+ */
+static void
+vnd_str_state_transition(void *arg)
+{
+	boolean_t died = B_FALSE;
+	vnd_str_t *vsp = arg;
+	mblk_t *mp;
+
+	mutex_enter(&vsp->vns_lock);
+	if (vsp->vns_dlpi_inc == NULL && (vsp->vns_state != VNS_S_INITIAL &&
+	    vsp->vns_state != VNS_S_SHUTTING_DOWN)) {
+		mutex_exit(&vsp->vns_lock);
+		return;
+	}
+
+	/*
+	 * When trying to shut down, or unwinding from a failed enabling, rather
+	 * than immediately entering the ZOMBIE state, we may instead opt to try
+	 * and enter the next state in the progression. This is especially
+	 * important when trying to tear everything down.
+	 */
+loop:
+	DTRACE_PROBE2(vnd__state__transition, uintptr_t, vsp,
+	    vnd_str_state_t, vsp->vns_state);
+	switch (vsp->vns_state) {
+	case VNS_S_INITIAL:
+		VERIFY(vsp->vns_dlpi_inc == NULL);
+		if (vnd_st_sinfo(vsp) != 0)
+			died = B_TRUE;
+		break;
+	case VNS_S_INFO_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_info(vsp) == 0) {
+			if (vnd_st_sexclusive(vsp) != 0)
+				died = B_TRUE;
+		} else {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_EXCLUSIVE_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_exclusive(vsp) == 0) {
+			if (vsp->vns_dlpi_style == DL_STYLE2) {
+				if (vnd_st_sattach(vsp) != 0)
+					died = B_TRUE;
+			} else {
+				if (vnd_st_sbind(vsp) != 0)
+					died = B_TRUE;
+			}
+		} else  {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_ATTACH_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_attach(vsp) == 0) {
+			if (vnd_st_sbind(vsp) != 0)
+				died = B_TRUE;
+		} else {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_BIND_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_bind(vsp) == 0) {
+			if (vnd_st_spromisc(vsp, DL_PROMISC_SAP,
+			    VNS_S_SAP_PROMISC_SENT) != 0)
+				died = B_TRUE;
+		} else {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_SAP_PROMISC_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_promisc(vsp) == 0) {
+			if (vnd_st_spromisc(vsp, DL_PROMISC_MULTI,
+			    VNS_S_MULTI_PROMISC_SENT) != 0)
+				died = B_TRUE;
+		} else {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_MULTI_PROMISC_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_promisc(vsp) == 0) {
+			if (vnd_st_spromisc(vsp, DL_PROMISC_RX_ONLY,
+			    VNS_S_RX_ONLY_PROMISC_SENT) != 0)
+				died = B_TRUE;
+		} else {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_RX_ONLY_PROMISC_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_promisc(vsp) == 0) {
+			if (vnd_st_spromisc(vsp, DL_PROMISC_FIXUPS,
+			    VNS_S_FIXUP_PROMISC_SENT) != 0)
+				died = B_TRUE;
+		} else {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_FIXUP_PROMISC_SENT:
+		VERIFY(vsp->vns_dlpi_inc != NULL);
+		if (vnd_st_promisc(vsp) == 0) {
+			if (vnd_st_scapabq(vsp) != 0)
+				died = B_TRUE;
+		} else {
+			died = B_TRUE;
+		}
+		break;
+	case VNS_S_CAPAB_Q_SENT:
+		if (vnd_st_capabq(vsp) != 0)
+			died = B_TRUE;
+		else
+			vnd_st_sonline(vsp);
+		break;
+	case VNS_S_SHUTTING_DOWN:
+		vnd_st_shutdown(vsp);
+		if (vnd_st_spromiscoff(vsp, DL_PROMISC_MULTI,
+		    VNS_S_MULTICAST_PROMISCOFF_SENT) == B_FALSE)
+			goto loop;
+		break;
+	case VNS_S_MULTICAST_PROMISCOFF_SENT:
+		vnd_st_promiscoff(vsp);
+		if (vnd_st_spromiscoff(vsp, DL_PROMISC_SAP,
+		    VNS_S_SAP_PROMISCOFF_SENT) == B_FALSE)
+			goto loop;
+		break;
+	case VNS_S_SAP_PROMISCOFF_SENT:
+		vnd_st_promiscoff(vsp);
+		if (vnd_st_sunbind(vsp) == B_FALSE)
+			goto loop;
+		break;
+	case VNS_S_UNBIND_SENT:
+		vnd_st_unbind(vsp);
+		break;
+	case VNS_S_ZOMBIE:
+		while ((mp = vnd_dlpi_inc_pop(vsp)) != NULL)
+			vnd_drop_ctl(vsp, mp, "vsp received data as a zombie");
+		break;
+	default:
+		panic("vnd_str_t entered an unknown state");
+	}
+
+	if (died == B_TRUE) {
+		ASSERT(vsp->vns_errno != VND_E_SUCCESS);
+		vsp->vns_laststate = vsp->vns_state;
+		vsp->vns_state = VNS_S_ZOMBIE;
+		cv_broadcast(&vsp->vns_stcv);
+	}
+
+	mutex_exit(&vsp->vns_lock);
+}
+
+static void
+vnd_dlpi_taskq_dispatch(void *arg)
+{
+	vnd_str_t *vsp = arg;
+	int run = 1;
+
+	while (run != 0) {
+		vnd_str_state_transition(vsp);
+		mutex_enter(&vsp->vns_lock);
+		if (vsp->vns_flags & VNS_F_CONDEMNED ||
+		    vsp->vns_dlpi_inc == NULL) {
+			run = 0;
+			vsp->vns_flags &= ~VNS_F_TASKQ_DISPATCHED;
+		}
+		if (vsp->vns_flags & VNS_F_CONDEMNED)
+			cv_signal(&vsp->vns_cancelcv);
+		mutex_exit(&vsp->vns_lock);
+	}
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_getifname(net_handle_t neti, phy_if_t phy, char *buf, const size_t len)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_getmtu(net_handle_t neti, phy_if_t phy, lif_if_t ifdata)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_getptmue(net_handle_t neti)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_getlifaddr(net_handle_t neti, phy_if_t phy, lif_if_t ifdata,
+    size_t nelem, net_ifaddr_t type[], void *storage)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_getlifzone(net_handle_t neti, phy_if_t phy, lif_if_t ifdata,
+    zoneid_t *zid)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_getlifflags(net_handle_t neti, phy_if_t phy, lif_if_t ifdata,
+    uint64_t *flags)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static phy_if_t
+vnd_neti_phygetnext(net_handle_t neti, phy_if_t phy)
+{
+	return ((phy_if_t)-1);
+}
+
+/* ARGSUSED */
+static phy_if_t
+vnd_neti_phylookup(net_handle_t neti, const char *name)
+{
+	return ((phy_if_t)-1);
+}
+
+/* ARGSUSED */
+static lif_if_t
+vnd_neti_lifgetnext(net_handle_t neti, phy_if_t phy, lif_if_t ifdata)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_inject(net_handle_t neti, inject_t style, net_inject_t *packet)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static phy_if_t
+vnd_neti_route(net_handle_t neti, struct sockaddr *address,
+    struct sockaddr *next)
+{
+	return ((phy_if_t)-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_ispchksum(net_handle_t neti, mblk_t *mp)
+{
+	return (-1);
+}
+
+/* ARGSUSED */
+static int
+vnd_neti_isvchksum(net_handle_t neti, mblk_t *mp)
+{
+	return (-1);
+}
+
+static net_protocol_t vnd_neti_info_v4 = {
+	NETINFO_VERSION,
+	NHF_VND_INET,
+	vnd_neti_getifname,
+	vnd_neti_getmtu,
+	vnd_neti_getptmue,
+	vnd_neti_getlifaddr,
+	vnd_neti_getlifzone,
+	vnd_neti_getlifflags,
+	vnd_neti_phygetnext,
+	vnd_neti_phylookup,
+	vnd_neti_lifgetnext,
+	vnd_neti_inject,
+	vnd_neti_route,
+	vnd_neti_ispchksum,
+	vnd_neti_isvchksum
+};
+
+static net_protocol_t vnd_neti_info_v6 = {
+	NETINFO_VERSION,
+	NHF_VND_INET6,
+	vnd_neti_getifname,
+	vnd_neti_getmtu,
+	vnd_neti_getptmue,
+	vnd_neti_getlifaddr,
+	vnd_neti_getlifzone,
+	vnd_neti_getlifflags,
+	vnd_neti_phygetnext,
+	vnd_neti_phylookup,
+	vnd_neti_lifgetnext,
+	vnd_neti_inject,
+	vnd_neti_route,
+	vnd_neti_ispchksum,
+	vnd_neti_isvchksum
+};
+
+
+static int
+vnd_netinfo_init(vnd_pnsd_t *nsp)
+{
+	nsp->vpnd_neti_v4 = net_protocol_register(nsp->vpnd_nsid,
+	    &vnd_neti_info_v4);
+	ASSERT(nsp->vpnd_neti_v4 != NULL);
+
+	nsp->vpnd_neti_v6 = net_protocol_register(nsp->vpnd_nsid,
+	    &vnd_neti_info_v6);
+	ASSERT(nsp->vpnd_neti_v6 != NULL);
+
+	nsp->vpnd_family_v4.hf_version = HOOK_VERSION;
+	nsp->vpnd_family_v4.hf_name = "vnd_inet";
+
+	if (net_family_register(nsp->vpnd_neti_v4, &nsp->vpnd_family_v4) != 0) {
+		(void) net_protocol_unregister(nsp->vpnd_neti_v4);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v6);
+		cmn_err(CE_NOTE, "vnd_netinfo_init: net_family_register "
+		    "failed for stack %d", nsp->vpnd_nsid);
+		return (1);
+	}
+
+	nsp->vpnd_family_v6.hf_version = HOOK_VERSION;
+	nsp->vpnd_family_v6.hf_name = "vnd_inet6";
+
+	if (net_family_register(nsp->vpnd_neti_v6, &nsp->vpnd_family_v6) != 0) {
+		(void) net_family_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_family_v4);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v4);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v6);
+		cmn_err(CE_NOTE, "vnd_netinfo_init: net_family_register "
+		    "failed for stack %d", nsp->vpnd_nsid);
+		return (1);
+	}
+
+	nsp->vpnd_event_in_v4.he_version = HOOK_VERSION;
+	nsp->vpnd_event_in_v4.he_name = NH_PHYSICAL_IN;
+	nsp->vpnd_event_in_v4.he_flags = 0;
+	nsp->vpnd_event_in_v4.he_interested = B_FALSE;
+
+	nsp->vpnd_token_in_v4 = net_event_register(nsp->vpnd_neti_v4,
+	    &nsp->vpnd_event_in_v4);
+	if (nsp->vpnd_token_in_v4 == NULL) {
+		(void) net_family_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_family_v4);
+		(void) net_family_unregister(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_family_v6);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v4);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v6);
+		cmn_err(CE_NOTE, "vnd_netinfo_init: net_event_register "
+		    "failed for stack %d", nsp->vpnd_nsid);
+		return (1);
+	}
+
+	nsp->vpnd_event_in_v6.he_version = HOOK_VERSION;
+	nsp->vpnd_event_in_v6.he_name = NH_PHYSICAL_IN;
+	nsp->vpnd_event_in_v6.he_flags = 0;
+	nsp->vpnd_event_in_v6.he_interested = B_FALSE;
+
+	nsp->vpnd_token_in_v6 = net_event_register(nsp->vpnd_neti_v6,
+	    &nsp->vpnd_event_in_v6);
+	if (nsp->vpnd_token_in_v6 == NULL) {
+		(void) net_event_shutdown(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_event_in_v4);
+		(void) net_event_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_event_in_v4);
+		(void) net_family_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_family_v4);
+		(void) net_family_unregister(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_family_v6);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v4);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v6);
+		cmn_err(CE_NOTE, "vnd_netinfo_init: net_event_register "
+		    "failed for stack %d", nsp->vpnd_nsid);
+		return (1);
+	}
+
+	nsp->vpnd_event_out_v4.he_version = HOOK_VERSION;
+	nsp->vpnd_event_out_v4.he_name = NH_PHYSICAL_OUT;
+	nsp->vpnd_event_out_v4.he_flags = 0;
+	nsp->vpnd_event_out_v4.he_interested = B_FALSE;
+
+	nsp->vpnd_token_out_v4 = net_event_register(nsp->vpnd_neti_v4,
+	    &nsp->vpnd_event_out_v4);
+	if (nsp->vpnd_token_out_v4 == NULL) {
+		(void) net_event_shutdown(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_event_in_v6);
+		(void) net_event_unregister(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_event_in_v6);
+		(void) net_event_shutdown(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_event_in_v4);
+		(void) net_event_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_event_in_v4);
+		(void) net_family_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_family_v4);
+		(void) net_family_unregister(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_family_v6);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v4);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v6);
+		cmn_err(CE_NOTE, "vnd_netinfo_init: net_event_register "
+		    "failed for stack %d", nsp->vpnd_nsid);
+		return (1);
+	}
+
+	nsp->vpnd_event_out_v6.he_version = HOOK_VERSION;
+	nsp->vpnd_event_out_v6.he_name = NH_PHYSICAL_OUT;
+	nsp->vpnd_event_out_v6.he_flags = 0;
+	nsp->vpnd_event_out_v6.he_interested = B_FALSE;
+
+	nsp->vpnd_token_out_v6 = net_event_register(nsp->vpnd_neti_v6,
+	    &nsp->vpnd_event_out_v6);
+	if (nsp->vpnd_token_out_v6 == NULL) {
+		(void) net_event_shutdown(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_event_in_v6);
+		(void) net_event_unregister(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_event_in_v6);
+		(void) net_event_shutdown(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_event_in_v6);
+		(void) net_event_unregister(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_event_in_v6);
+		(void) net_event_shutdown(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_event_in_v4);
+		(void) net_event_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_event_in_v4);
+		(void) net_family_unregister(nsp->vpnd_neti_v4,
+		    &nsp->vpnd_family_v4);
+		(void) net_family_unregister(nsp->vpnd_neti_v6,
+		    &nsp->vpnd_family_v6);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v4);
+		(void) net_protocol_unregister(nsp->vpnd_neti_v6);
+		cmn_err(CE_NOTE, "vnd_netinfo_init: net_event_register "
+		    "failed for stack %d", nsp->vpnd_nsid);
+		return (1);
+	}
+
+	return (0);
+}
+
+static void
+vnd_netinfo_shutdown(vnd_pnsd_t *nsp)
+{
+	int ret;
+
+	ret = net_event_shutdown(nsp->vpnd_neti_v4, &nsp->vpnd_event_in_v4);
+	VERIFY(ret == 0);
+	ret = net_event_shutdown(nsp->vpnd_neti_v4, &nsp->vpnd_event_out_v4);
+	VERIFY(ret == 0);
+	ret = net_event_shutdown(nsp->vpnd_neti_v6, &nsp->vpnd_event_in_v6);
+	VERIFY(ret == 0);
+	ret = net_event_shutdown(nsp->vpnd_neti_v6, &nsp->vpnd_event_out_v6);
+	VERIFY(ret == 0);
+}
+
+static void
+vnd_netinfo_fini(vnd_pnsd_t *nsp)
+{
+	int ret;
+
+	ret = net_event_unregister(nsp->vpnd_neti_v4, &nsp->vpnd_event_in_v4);
+	VERIFY(ret == 0);
+	ret = net_event_unregister(nsp->vpnd_neti_v4, &nsp->vpnd_event_out_v4);
+	VERIFY(ret == 0);
+	ret = net_event_unregister(nsp->vpnd_neti_v6, &nsp->vpnd_event_in_v6);
+	VERIFY(ret == 0);
+	ret = net_event_unregister(nsp->vpnd_neti_v6, &nsp->vpnd_event_out_v6);
+	VERIFY(ret == 0);
+	ret = net_family_unregister(nsp->vpnd_neti_v4, &nsp->vpnd_family_v4);
+	VERIFY(ret == 0);
+	ret = net_family_unregister(nsp->vpnd_neti_v6, &nsp->vpnd_family_v6);
+	VERIFY(ret == 0);
+	ret = net_protocol_unregister(nsp->vpnd_neti_v4);
+	VERIFY(ret == 0);
+	ret = net_protocol_unregister(nsp->vpnd_neti_v6);
+	VERIFY(ret == 0);
+}
+
+/* ARGSUSED */
+static void
+vnd_strbarrier_cb(void *arg, mblk_t *bmp, gsqueue_t *gsp, void *dummy)
+{
+	vnd_str_t *vsp = arg;
+
+	VERIFY(bmp == &vsp->vns_barrierblk);
+	mutex_enter(&vsp->vns_lock);
+	VERIFY(vsp->vns_flags & VNS_F_BARRIER);
+	VERIFY(!(vsp->vns_flags & VNS_F_BARRIER_DONE));
+	vsp->vns_flags |= VNS_F_BARRIER_DONE;
+	mutex_exit(&vsp->vns_lock);
+
+	/*
+	 * For better or worse, we have to broadcast here as we could have a
+	 * thread that's blocked for completion as well as one that's blocked
+	 * waiting to do a barrier itself.
+	 */
+	cv_broadcast(&vsp->vns_barriercv);
+}
+
+/*
+ * This is a data barrier for the stream while it is in fastpath mode. It blocks
+ * and ensures that there is nothing else in the squeue.
+ */
+static void
+vnd_strbarrier(vnd_str_t *vsp)
+{
+	mutex_enter(&vsp->vns_lock);
+	while (vsp->vns_flags & VNS_F_BARRIER)
+		cv_wait(&vsp->vns_barriercv, &vsp->vns_lock);
+	vsp->vns_flags |= VNS_F_BARRIER;
+	mutex_exit(&vsp->vns_lock);
+
+	gsqueue_enter_one(vsp->vns_squeue, &vsp->vns_barrierblk,
+	    vnd_strbarrier_cb, vsp, GSQUEUE_PROCESS, VND_SQUEUE_TAG_STRBARRIER);
+
+	mutex_enter(&vsp->vns_lock);
+	while (!(vsp->vns_flags & VNS_F_BARRIER_DONE))
+		cv_wait(&vsp->vns_barriercv, &vsp->vns_lock);
+	vsp->vns_flags &= ~VNS_F_BARRIER;
+	vsp->vns_flags &= ~VNS_F_BARRIER_DONE;
+	mutex_exit(&vsp->vns_lock);
+
+	/*
+	 * We have to broadcast in case anyone is waiting for the barrier
+	 * themselves.
+	 */
+	cv_broadcast(&vsp->vns_barriercv);
+}
+
+/*
+ * Based on the type of message that we're dealing with we're going to want to
+ * do one of several things. Basically if it looks like it's something we know
+ * about, we should probably handle it in one of our transition threads.
+ * Otherwise, we should just simply putnext.
+ */
+static int
+vnd_s_rput(queue_t *q, mblk_t *mp)
+{
+	t_uscalar_t prim;
+	int dispatch = 0;
+	vnd_str_t *vsp = q->q_ptr;
+
+	switch (DB_TYPE(mp)) {
+	case M_PROTO:
+	case M_PCPROTO:
+		if (MBLKL(mp) < sizeof (t_uscalar_t)) {
+			vnd_drop_ctl(vsp, mp, "PROTO message too short");
+			break;
+		}
+
+		prim = ((union DL_primitives *)mp->b_rptr)->dl_primitive;
+		if (prim == DL_UNITDATA_REQ || prim == DL_UNITDATA_IND) {
+			vnd_drop_ctl(vsp, mp,
+			    "recieved an unsupported dlpi DATA req");
+			break;
+		}
+
+		/*
+		 * Enqueue the entry and fire off a taskq dispatch.
+		 */
+		mutex_enter(&vsp->vns_lock);
+		vnd_dlpi_inc_push(vsp, mp);
+		if (!(vsp->vns_flags & VNS_F_TASKQ_DISPATCHED)) {
+			dispatch = 1;
+			vsp->vns_flags |= VNS_F_TASKQ_DISPATCHED;
+		}
+		mutex_exit(&vsp->vns_lock);
+		if (dispatch != 0)
+			taskq_dispatch_ent(vnd_taskq, vnd_dlpi_taskq_dispatch,
+			    vsp, 0, &vsp->vns_tqe);
+		break;
+	case M_DATA:
+		vnd_drop_in(vsp, mp, "M_DATA via put(9E)");
+		break;
+	default:
+		putnext(vsp->vns_rq, mp);
+	}
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+vnd_strioctl(queue_t *q, vnd_str_t *vsp, mblk_t *mp, struct iocblk *iocp)
+{
+	int error;
+	vnd_strioc_t *visp;
+
+	if (iocp->ioc_cmd != VND_STRIOC_ASSOCIATE ||
+	    iocp->ioc_count != TRANSPARENT) {
+		error = EINVAL;
+		goto nak;
+	}
+
+	/*
+	 * All streams ioctls that we support must use kcred as a means to
+	 * distinguish that this is a layered open by the kernel as opposed to
+	 * one by a user who has done an I_PUSH of the module.
+	 */
+	if (iocp->ioc_cr != kcred) {
+		error = EPERM;
+		goto nak;
+	}
+
+	if (mp->b_cont == NULL) {
+		error = EAGAIN;
+		goto nak;
+	}
+
+	visp = kmem_alloc(sizeof (vnd_strioc_t), KM_SLEEP);
+	ASSERT(MBLKL(mp->b_cont) == sizeof (caddr_t));
+	visp->vs_addr = *(caddr_t *)mp->b_cont->b_rptr;
+	visp->vs_state = VSS_COPYIN;
+
+	mcopyin(mp, (void *)visp, sizeof (vnd_strioc_associate_t), NULL);
+	qreply(q, mp);
+
+	return;
+
+nak:
+	if (mp->b_cont != NULL) {
+		freemsg(mp->b_cont);
+		mp->b_cont = NULL;
+	}
+
+	iocp->ioc_error = error;
+	mp->b_datap->db_type = M_IOCNAK;
+	iocp->ioc_count = 0;
+	qreply(q, mp);
+}
+
+static void
+vnd_striocdata(queue_t *q, vnd_str_t *vsp, mblk_t *mp, struct copyresp *csp)
+{
+	vnd_str_state_t state;
+	struct copyreq *crp;
+	vnd_strioc_associate_t *vss;
+	vnd_dev_t *vdp = NULL;
+	vnd_pnsd_t *nsp = NULL;
+	char iname[2*VND_NAMELEN];
+	zone_t *zone;
+	vnd_strioc_t *visp;
+
+	visp = (vnd_strioc_t *)csp->cp_private;
+
+	/* If it's not ours, it's not our problem */
+	if (csp->cp_cmd != VND_STRIOC_ASSOCIATE) {
+		if (q->q_next != NULL) {
+			putnext(q, mp);
+		} else {
+			VND_STAT_INC(vsp, vks_ndlpidrops, 1);
+			VND_STAT_INC(vsp, vks_tdrops, 1);
+			vnd_drop_ctl(vsp, mp, "uknown cmd for M_IOCDATA");
+		}
+		kmem_free(visp, sizeof (vnd_strioc_t));
+		return;
+	}
+
+	/* The nak is already sent for us */
+	if (csp->cp_rval != 0) {
+		vnd_drop_ctl(vsp, mp, "M_COPYIN failed");
+		kmem_free(visp, sizeof (vnd_strioc_t));
+		return;
+	}
+
+	/* Data is sitting for us in b_cont */
+	if (mp->b_cont == NULL ||
+	    MBLKL(mp->b_cont) != sizeof (vnd_strioc_associate_t)) {
+		kmem_free(visp, sizeof (vnd_strioc_t));
+		miocnak(q, mp, 0, EINVAL);
+		return;
+	}
+
+	vss = (vnd_strioc_associate_t *)mp->b_cont->b_rptr;
+	vdp = vnd_dev_lookup(vss->vsa_minor);
+	if (vdp == NULL) {
+		vss->vsa_errno = VND_E_NODEV;
+		goto nak;
+	}
+
+	nsp = vnd_nsd_lookup(vss->vsa_nsid);
+	if (nsp == NULL) {
+		vss->vsa_errno = VND_E_NONETSTACK;
+		goto nak;
+	}
+
+	mutex_enter(&vsp->vns_lock);
+	if (!(vsp->vns_flags & VNS_F_NEED_ZONE)) {
+		mutex_exit(&vsp->vns_lock);
+		vss->vsa_errno = VND_E_ASSOCIATED;
+		goto nak;
+	}
+
+	vsp->vns_nsd = nsp;
+	vsp->vns_flags &= ~VNS_F_NEED_ZONE;
+	vsp->vns_flags |= VNS_F_TASKQ_DISPATCHED;
+	mutex_exit(&vsp->vns_lock);
+
+	taskq_dispatch_ent(vnd_taskq, vnd_dlpi_taskq_dispatch, vsp, 0,
+	    &vsp->vns_tqe);
+
+
+	/* At this point we need to wait until we have transitioned to ONLINE */
+	mutex_enter(&vsp->vns_lock);
+	while (vsp->vns_state != VNS_S_ONLINE && vsp->vns_state != VNS_S_ZOMBIE)
+		cv_wait(&vsp->vns_stcv, &vsp->vns_lock);
+	state = vsp->vns_state;
+	mutex_exit(&vsp->vns_lock);
+
+	if (state == VNS_S_ZOMBIE) {
+		vss->vsa_errno = vsp->vns_errno;
+		goto nak;
+	}
+
+	mutex_enter(&vdp->vdd_lock);
+	mutex_enter(&vsp->vns_lock);
+	VERIFY(vdp->vdd_str == NULL);
+	/*
+	 * Now initialize the remaining kstat properties and let's go ahead and
+	 * create it.
+	 */
+	(void) snprintf(iname, sizeof (iname), "z%d_%d",
+	    vdp->vdd_nsd->vpnd_zid, vdp->vdd_minor);
+	vsp->vns_kstat = kstat_create_zone("vnd", vdp->vdd_minor, iname, "net",
+	    KSTAT_TYPE_NAMED, sizeof (vnd_str_stat_t) / sizeof (kstat_named_t),
+	    KSTAT_FLAG_VIRTUAL, GLOBAL_ZONEID);
+	if (vsp->vns_kstat == NULL) {
+		vss->vsa_errno = VND_E_KSTATCREATE;
+		mutex_exit(&vsp->vns_lock);
+		mutex_exit(&vdp->vdd_lock);
+		goto nak;
+	}
+	vdp->vdd_str = vsp;
+	vsp->vns_dev = vdp;
+
+	/*
+	 * Now, it's time to do the las thing that can fail, changing out the
+	 * input function. After this we know that we can receive data, so we
+	 * should make sure that we're ready.
+	 */
+	if (vnd_dld_cap_enable(vsp, vnd_mac_input) != 0) {
+		vss->vsa_errno = VND_E_DIRECTFAIL;
+		vdp->vdd_str = NULL;
+		vsp->vns_dev = NULL;
+		mutex_exit(&vsp->vns_lock);
+		mutex_exit(&vdp->vdd_lock);
+		goto nak;
+	}
+
+	zone = zone_find_by_id(vdp->vdd_nsd->vpnd_zid);
+	ASSERT(zone != NULL);
+	vsp->vns_kstat->ks_data = &vsp->vns_ksdata;
+	/* Account for zone name */
+	vsp->vns_kstat->ks_data_size += strlen(zone->zone_name) + 1;
+	/* Account for eventual link name */
+	vsp->vns_kstat->ks_data_size += VND_NAMELEN;
+	kstat_named_setstr(&vsp->vns_ksdata.vks_zonename, zone->zone_name);
+	kstat_named_setstr(&vdp->vdd_str->vns_ksdata.vks_linkname,
+	    vdp->vdd_lname);
+	zone_rele(zone);
+	kstat_install(vsp->vns_kstat);
+
+	mutex_exit(&vsp->vns_lock);
+	mutex_exit(&vdp->vdd_lock);
+
+	/*
+	 * Note that the vnd_str_t does not keep a permanent hold on the
+	 * vnd_pnsd_t. We leave that up to the vnd_dev_t as that's also what
+	 * the nestack goes through to take care of everything.
+	 */
+	vss->vsa_errno = VND_E_SUCCESS;
+nak:
+	if (vdp != NULL)
+		vnd_dev_rele(vdp);
+	if (nsp != NULL)
+		vnd_nsd_rele(nsp);
+	/*
+	 * Change the copyin request to a copyout. Note that we can't use
+	 * mcopyout here as it only works when the DB_TYPE is M_IOCTL. That's
+	 * okay, as the copyin vs. copyout is basically the same.
+	 */
+	DB_TYPE(mp) = M_COPYOUT;
+	visp->vs_state = VSS_COPYOUT;
+	crp = (struct copyreq *)mp->b_rptr;
+	crp->cq_private = (void *)visp;
+	crp->cq_addr = visp->vs_addr;
+	crp->cq_size = sizeof (vnd_strioc_associate_t);
+	qreply(q, mp);
+}
+
+static void
+vnd_stroutdata(queue_t *q, vnd_str_t *vsp, mblk_t *mp, struct copyresp *csp)
+{
+	ASSERT(csp->cp_private != NULL);
+	kmem_free(csp->cp_private, sizeof (vnd_strioc_t));
+	if (csp->cp_cmd != VND_STRIOC_ASSOCIATE) {
+		if (q->q_next != NULL) {
+			putnext(q, mp);
+		} else {
+			VND_STAT_INC(vsp, vks_ndlpidrops, 1);
+			VND_STAT_INC(vsp, vks_tdrops, 1);
+			vnd_drop_ctl(vsp, mp, "uknown cmd for M_IOCDATA");
+		}
+		return;
+	}
+
+	/* The nak is already sent for us */
+	if (csp->cp_rval != 0) {
+		vnd_drop_ctl(vsp, mp, "M_COPYOUT failed");
+		return;
+	}
+
+	/* Ack and let's be done with it all */
+	miocack(q, mp, 0, 0);
+}
+
+static int
+vnd_s_wput(queue_t *q, mblk_t *mp)
+{
+	vnd_str_t *vsp = q->q_ptr;
+	struct copyresp *crp;
+	vnd_strioc_state_t vstate;
+	vnd_strioc_t *visp;
+
+	switch (DB_TYPE(mp)) {
+	case M_IOCTL:
+		vnd_strioctl(q, vsp, mp, (struct iocblk *)mp->b_rptr);
+		return (0);
+	case M_IOCDATA:
+		crp = (struct copyresp *)mp->b_rptr;
+		ASSERT(crp->cp_private != NULL);
+		visp = (vnd_strioc_t *)crp->cp_private;
+		vstate = visp->vs_state;
+		ASSERT(vstate == VSS_COPYIN || vstate == VSS_COPYOUT);
+		if (vstate == VSS_COPYIN)
+			vnd_striocdata(q, vsp, mp,
+			    (struct copyresp *)mp->b_rptr);
+		else
+			vnd_stroutdata(q, vsp, mp,
+			    (struct copyresp *)mp->b_rptr);
+		return (0);
+	default:
+		break;
+	}
+	if (q->q_next != NULL)
+		putnext(q, mp);
+	else
+		vnd_drop_ctl(vsp, mp, "!M_IOCTL in wput");
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+vnd_s_open(queue_t *q, dev_t *devp, int oflag, int sflag, cred_t *credp)
+{
+	vnd_str_t *vsp;
+	uint_t rand;
+
+	if (q->q_ptr != NULL)
+		return (EINVAL);
+
+	if (!(sflag & MODOPEN))
+		return (ENXIO);
+
+	if (credp != kcred)
+		return (EPERM);
+
+	vsp = kmem_cache_alloc(vnd_str_cache, KM_SLEEP);
+	bzero(vsp, sizeof (*vsp));
+	mutex_init(&vsp->vns_lock, NULL, MUTEX_DRIVER, NULL);
+	cv_init(&vsp->vns_cancelcv, NULL, CV_DRIVER, NULL);
+	cv_init(&vsp->vns_barriercv, NULL, CV_DRIVER, NULL);
+	cv_init(&vsp->vns_stcv, NULL, CV_DRIVER, NULL);
+	vsp->vns_state = VNS_S_INITIAL;
+
+	mutex_init(&vsp->vns_dq_read.vdq_lock, NULL, MUTEX_DRIVER, NULL);
+	mutex_init(&vsp->vns_dq_write.vdq_lock, NULL, MUTEX_DRIVER, NULL);
+	mutex_enter(&vnd_dev_lock);
+	vsp->vns_dq_read.vdq_max = vnd_vdq_default_size;
+	vsp->vns_dq_read.vdq_vns = vsp;
+	vsp->vns_dq_write.vdq_max = vnd_vdq_default_size;
+	vsp->vns_dq_write.vdq_vns = vsp;
+	mutex_exit(&vnd_dev_lock);
+	vsp->vns_rq = q;
+	vsp->vns_wq = WR(q);
+	q->q_ptr = WR(q)->q_ptr = vsp;
+	vsp->vns_flags = VNS_F_NEED_ZONE;
+	vsp->vns_nflush = vnd_flush_nburst;
+	vsp->vns_bsize = vnd_flush_burst_size;
+
+	(void) random_get_pseudo_bytes((uint8_t *)&rand, sizeof (rand));
+	vsp->vns_squeue = gsqueue_set_get(vnd_sqset, rand);
+
+	/*
+	 * We create our kstat and initialize all of its fields now, but we
+	 * don't install it until we actually do the zone association so we can
+	 * get everything.
+	 */
+	kstat_named_init(&vsp->vns_ksdata.vks_rbytes, "rbytes",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_rpackets, "rpackets",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_obytes, "obytes",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_opackets, "opackets",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_nhookindrops, "nhookindrops",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_nhookoutdrops, "nhookoutdrops",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_ndlpidrops, "ndlpidrops",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_ndataindrops, "ndataindrops",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_ndataoutdrops, "ndataoutdrops",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_tdrops, "total_drops",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_linkname, "linkname",
+	    KSTAT_DATA_STRING);
+	kstat_named_init(&vsp->vns_ksdata.vks_zonename, "zonename",
+	    KSTAT_DATA_STRING);
+	kstat_named_init(&vsp->vns_ksdata.vks_nmacflow, "flowcontrol_events",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_tmacflow, "flowcontrol_time",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_mac_flow_1ms, "flowcontrol_1ms",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_mac_flow_10ms, "flowcontrol_10ms",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_mac_flow_100ms,
+	    "flowcontrol_100ms", KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_mac_flow_1s, "flowcontrol_1s",
+	    KSTAT_DATA_UINT64);
+	kstat_named_init(&vsp->vns_ksdata.vks_mac_flow_10s, "flowcontrol_10s",
+	    KSTAT_DATA_UINT64);
+	qprocson(q);
+	/*
+	 * Now that we've called qprocson, grab the lower module for making sure
+	 * that we don't have any pass through modules.
+	 */
+	vsp->vns_lrq = RD(vsp->vns_wq->q_next);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+vnd_s_close(queue_t *q, int flag, cred_t *credp)
+{
+	vnd_str_t *vsp;
+	mblk_t *mp;
+
+	VERIFY(WR(q)->q_next != NULL);
+
+	vsp = q->q_ptr;
+	ASSERT(vsp != NULL);
+
+	/*
+	 * We need to transition ourselves down.  This means that we have a few
+	 * important different things to do in the process of tearing down our
+	 * input and output buffers, making sure we've drained the current
+	 * squeue, and disabling the fast path. Before we disable the fast path,
+	 * we should make sure the squeue is drained. Because we're in streams
+	 * close, we know that no packets can come into us from userland, but we
+	 * can receive more. As such, the following is the exact order of things
+	 * that we do:
+	 *
+	 * 1) flush the vns_dq_read
+	 * 2) Insert the drain mblk
+	 * 3) When it's been received, tear down the fast path by kicking
+	 * off the state machine.
+	 * 4) One final flush of both the vns_dq_read,vns_dq_write
+	 */
+
+	vnd_dq_flush(&vsp->vns_dq_read, vnd_drop_in);
+	vnd_strbarrier(vsp);
+	mutex_enter(&vsp->vns_lock);
+	vsp->vns_state = VNS_S_SHUTTING_DOWN;
+	if (!(vsp->vns_flags & VNS_F_TASKQ_DISPATCHED)) {
+		vsp->vns_flags |= VNS_F_TASKQ_DISPATCHED;
+		taskq_dispatch_ent(vnd_taskq, vnd_dlpi_taskq_dispatch, vsp,
+		    0, &vsp->vns_tqe);
+	}
+	while (vsp->vns_state != VNS_S_ZOMBIE)
+		cv_wait(&vsp->vns_stcv, &vsp->vns_lock);
+	mutex_exit(&vsp->vns_lock);
+
+	qprocsoff(q);
+	mutex_enter(&vsp->vns_lock);
+	vsp->vns_flags |= VNS_F_CONDEMNED;
+	while (vsp->vns_flags & VNS_F_TASKQ_DISPATCHED)
+		cv_wait(&vsp->vns_cancelcv, &vsp->vns_lock);
+
+	while ((mp = vnd_dlpi_inc_pop(vsp)) != NULL)
+		vnd_drop_ctl(vsp, mp, "vnd_s_close");
+	mutex_exit(&vsp->vns_lock);
+
+	q->q_ptr = NULL;
+	vnd_dq_flush(&vsp->vns_dq_read, vnd_drop_in);
+	vnd_dq_flush(&vsp->vns_dq_write, vnd_drop_out);
+	mutex_destroy(&vsp->vns_dq_read.vdq_lock);
+	mutex_destroy(&vsp->vns_dq_write.vdq_lock);
+
+	if (vsp->vns_kstat != NULL)
+		kstat_delete(vsp->vns_kstat);
+	mutex_destroy(&vsp->vns_lock);
+	cv_destroy(&vsp->vns_stcv);
+	cv_destroy(&vsp->vns_barriercv);
+	cv_destroy(&vsp->vns_cancelcv);
+	kmem_cache_free(vnd_str_cache, vsp);
+
+	return (0);
+}
+
+static vnd_mac_cookie_t
+vnd_squeue_tx_one(vnd_str_t *vsp, mblk_t *mp)
+{
+	hrtime_t txtime;
+	vnd_mac_cookie_t vc;
+
+	VND_STAT_INC(vsp, vks_opackets, 1);
+	VND_STAT_INC(vsp, vks_obytes, msgsize(mp));
+	DTRACE_VND5(send, mblk_t *, mp, void *, NULL, void *, NULL,
+	    vnd_str_t *, vsp, mblk_t *, mp);
+	/* Actually tx now */
+	txtime = gethrtime();
+	vc = vsp->vns_caps.vsc_tx_f(vsp->vns_caps.vsc_tx_hdl,
+	    mp, 0, MAC_DROP_ON_NO_DESC);
+
+	/*
+	 * We need to check two different conditions before we immediately set
+	 * the flow control lock. The first thing that we need to do is verify
+	 * that this is an instance of hard flow control, so to say. The flow
+	 * control callbacks won't always fire in cases where we still get a
+	 * cookie returned. The explicit check for flow control will guarantee
+	 * us that we'll get a subsequent notification callback.
+	 *
+	 * The second case comes about because we do not hold the
+	 * vnd_str_t`vns_lock across calls to tx, we need to determine if a flow
+	 * control notification already came across for us in a different thread
+	 * calling vnd_mac_flow_control(). To deal with this, we record a
+	 * timestamp every time that we change the flow control state. We grab
+	 * txtime here before we transmit because that guarantees that the
+	 * hrtime_t of the call to vnd_mac_flow_control() will be after txtime.
+	 *
+	 * If the flow control notification beat us to the punch, the value of
+	 * vns_fcupdate will be larger than the value of txtime, and we should
+	 * just record the statistics. However, if we didn't beat it to the
+	 * punch (txtime > vns_fcupdate), then we know that it's safe to wait
+	 * for a notification.
+	 */
+	if (vc != NULL) {
+		hrtime_t diff;
+
+		if (vsp->vns_caps.vsc_is_fc_f(vsp->vns_caps.vsc_is_fc_hdl,
+		    vc) == 0)
+			return (NULL);
+		mutex_enter(&vsp->vns_lock);
+		diff = vsp->vns_fcupdate - txtime;
+		if (diff > 0) {
+			mutex_exit(&vsp->vns_lock);
+			vnd_mac_flow_control_stat(vsp, diff);
+			return (NULL);
+		}
+		vsp->vns_flags |= VNS_F_FLOW_CONTROLLED;
+		vsp->vns_caps.vsc_fc_cookie = vc;
+		vsp->vns_fclatch = txtime;
+		vsp->vns_fcupdate = txtime;
+		DTRACE_VND3(flow__blocked, vnd_str_t *, vsp,
+		    uint64_t, vsp->vns_dq_write.vdq_cur, uintptr_t, vc);
+		mutex_exit(&vsp->vns_lock);
+	}
+
+	return (vc);
+}
+
+/* ARGSUSED */
+static void
+vnd_squeue_tx_drain(void *arg, mblk_t *drain_mp, gsqueue_t *gsp, void *dummy)
+{
+	mblk_t *mp;
+	int nmps;
+	size_t mptot, nflush, bsize;
+	boolean_t blocked, empty;
+	vnd_data_queue_t *vqp;
+	vnd_str_t *vsp = arg;
+
+	mutex_enter(&vsp->vns_lock);
+	/*
+	 * We either enter here via an squeue or via vnd_squeue_tx_append(). In
+	 * the former case we need to mark that there is no longer an active
+	 * user of the drain block.
+	 */
+	if (drain_mp != NULL) {
+		VERIFY(drain_mp == &vsp->vns_drainblk);
+		VERIFY(vsp->vns_flags & VNS_F_DRAIN_SCHEDULED);
+		vsp->vns_flags &= ~VNS_F_DRAIN_SCHEDULED;
+	}
+
+	/*
+	 * If we're still flow controlled or under a flush barrier, nothing to
+	 * do.
+	 */
+	if (vsp->vns_flags & (VNS_F_FLOW_CONTROLLED | VNS_F_BARRIER)) {
+		mutex_exit(&vsp->vns_lock);
+		return;
+	}
+
+	nflush = vsp->vns_nflush;
+	bsize = vsp->vns_bsize;
+	mutex_exit(&vsp->vns_lock);
+
+	/*
+	 * We're potentially going deep into the networking layer; make sure the
+	 * guest can't run concurrently.
+	 */
+	ht_begin_unsafe();
+
+	nmps = 0;
+	mptot = 0;
+	blocked = B_FALSE;
+	vqp = &vsp->vns_dq_write;
+	while (nmps < nflush && mptot <= bsize) {
+		mutex_enter(&vqp->vdq_lock);
+		if (vnd_dq_pop(vqp, &mp) == 0) {
+			mutex_exit(&vqp->vdq_lock);
+			break;
+		}
+		mutex_exit(&vqp->vdq_lock);
+
+		nmps++;
+		mptot += msgsize(mp);
+		if (vnd_squeue_tx_one(vsp, mp) != NULL) {
+			blocked = B_TRUE;
+			break;
+		}
+	}
+
+	ht_end_unsafe();
+
+	empty = vnd_dq_is_empty(&vsp->vns_dq_write);
+
+	/*
+	 * If the queue is not empty, we're not blocked, and there isn't a drain
+	 * scheduled, put it into the squeue with the drain block and
+	 * GSQUEUE_FILL.
+	 */
+	if (blocked == B_FALSE && empty == B_FALSE) {
+		mutex_enter(&vsp->vns_lock);
+		if (!(vsp->vns_flags & VNS_F_DRAIN_SCHEDULED)) {
+			mblk_t *mp = &vsp->vns_drainblk;
+			vsp->vns_flags |= VNS_F_DRAIN_SCHEDULED;
+			gsqueue_enter_one(vsp->vns_squeue,
+			    mp, vnd_squeue_tx_drain, vsp,
+			    GSQUEUE_FILL, VND_SQUEUE_TAG_TX_DRAIN);
+		}
+		mutex_exit(&vsp->vns_lock);
+	}
+
+	/*
+	 * If we drained some amount of data, we need to signal the data queue.
+	 */
+	if (nmps > 0) {
+		cv_broadcast(&vsp->vns_dq_write.vdq_ready);
+		pollwakeup(&vsp->vns_dev->vdd_ph, POLLOUT);
+	}
+}
+
+/* ARGSUSED */
+static void
+vnd_squeue_tx_append(void *arg, mblk_t *mp, gsqueue_t *gsp, void *dummy)
+{
+	vnd_str_t *vsp = arg;
+	vnd_data_queue_t *vqp = &vsp->vns_dq_write;
+	vnd_pnsd_t *nsp = vsp->vns_nsd;
+	size_t len = msgsize(mp);
+
+	/*
+	 * Before we append this packet, we should run it through the firewall
+	 * rules.
+	 */
+	if (nsp->vpnd_hooked && vnd_hook(vsp, &mp, nsp->vpnd_neti_v4,
+	    nsp->vpnd_event_out_v4, nsp->vpnd_token_out_v4, nsp->vpnd_neti_v6,
+	    nsp->vpnd_event_out_v6, nsp->vpnd_token_out_v6, vnd_drop_hook_out,
+	    vnd_drop_out) != 0) {
+		/*
+		 * Because we earlier reserved space for this packet and it's
+		 * not making the cut, we need to go through and unreserve that
+		 * space. Also note that the message block will likely be freed
+		 * by the time we return from vnd_hook so we cannot rely on it.
+		 */
+		mutex_enter(&vqp->vdq_lock);
+		vnd_dq_unreserve(vqp, len);
+		mutex_exit(&vqp->vdq_lock);
+		return;
+	}
+
+	/*
+	 * We earlier reserved space for this packet. So for now simply append
+	 * it and call drain. We know that no other drain can be going on right
+	 * now thanks to the squeue.
+	 */
+	mutex_enter(&vqp->vdq_lock);
+	(void) vnd_dq_push(&vsp->vns_dq_write, mp, B_TRUE, vnd_drop_panic);
+	mutex_exit(&vqp->vdq_lock);
+	vnd_squeue_tx_drain(vsp, NULL, NULL, NULL);
+}
+
+/*
+ * We need to see if this is a valid name of sorts for us. That means a few
+ * things. First off, we can't assume that what we've been given has actually
+ * been null terminated. More importantly, that it's a valid name as far as
+ * ddi_create_minor_node is concerned (that means no '@', '/', or ' '). We
+ * further constrain ourselves to simply alphanumeric characters and a few
+ * additional ones, ':', '-', and '_'.
+ */
+static int
+vnd_validate_name(const char *buf, size_t buflen)
+{
+	int i, len;
+
+	/* First make sure a null terminator exists */
+	for (i = 0; i < buflen; i++)
+		if (buf[i] == '\0')
+			break;
+	len = i;
+	if (i == 0 || i == buflen)
+		return (0);
+
+	for (i = 0; i < len; i++)
+		if (!isalnum(buf[i]) && buf[i] != ':' && buf[i] != '-' &&
+		    buf[i] != '_')
+			return (0);
+
+	return (1);
+}
+
+static int
+vnd_ioctl_attach(vnd_dev_t *vdp, uintptr_t arg, cred_t *credp, int cpflag)
+{
+	vnd_ioc_attach_t via;
+	vnd_strioc_associate_t vss;
+	vnd_pnsd_t *nsp;
+	zone_t *zonep;
+	zoneid_t zid;
+	char buf[2*VND_NAMELEN];
+	int ret, rp;
+
+	if (secpolicy_net_config(credp, B_FALSE) != 0)
+		return (EPERM);
+
+	if (secpolicy_net_rawaccess(credp) != 0)
+		return (EPERM);
+
+	if (ddi_copyin((void *)arg, &via, sizeof (via), cpflag) != 0)
+		return (EFAULT);
+	via.via_errno = VND_E_SUCCESS;
+
+	if (vnd_validate_name(via.via_name, VND_NAMELEN) == 0) {
+		via.via_errno = VND_E_BADNAME;
+		ret = EIO;
+		goto errcopyout;
+	}
+
+	/*
+	 * Only the global zone can request to create a device in a different
+	 * zone.
+	 */
+	zid = crgetzoneid(credp);
+	if (zid != GLOBAL_ZONEID && via.via_zoneid != -1 &&
+	    zid != via.via_zoneid) {
+		via.via_errno = VND_E_PERM;
+		ret = EIO;
+		goto errcopyout;
+	}
+
+	if (via.via_zoneid == -1)
+		via.via_zoneid = zid;
+
+	/*
+	 * Establish the name we'll use now. We want to be extra paranoid about
+	 * the device we're opening so check that now.
+	 */
+	if (zid == GLOBAL_ZONEID && via.via_zoneid != zid) {
+		zonep = zone_find_by_id(via.via_zoneid);
+		if (zonep == NULL) {
+			via.via_errno = VND_E_NOZONE;
+			ret = EIO;
+			goto errcopyout;
+		}
+		if (snprintf(NULL, 0, "/dev/net/zone/%s/%s", zonep->zone_name,
+		    via.via_name) >= sizeof (buf)) {
+			zone_rele(zonep);
+			via.via_errno = VND_E_BADNAME;
+			ret = EIO;
+			goto errcopyout;
+		}
+		(void) snprintf(buf, sizeof (buf), "/dev/net/zone/%s/%s",
+		    zonep->zone_name, via.via_name);
+		zone_rele(zonep);
+		zonep = NULL;
+	} else {
+		if (snprintf(NULL, 0, "/dev/net/%s", via.via_name) >=
+		    sizeof (buf)) {
+			via.via_errno = VND_E_BADNAME;
+			ret = EIO;
+			goto errcopyout;
+		}
+		(void) snprintf(buf, sizeof (buf), "/dev/net/%s", via.via_name);
+	}
+
+	/*
+	 * If our zone is dying then the netstack will have been removed from
+	 * this list.
+	 */
+	nsp = vnd_nsd_lookup_by_zid(via.via_zoneid);
+	if (nsp == NULL) {
+		via.via_errno = VND_E_NOZONE;
+		ret = EIO;
+		goto errcopyout;
+	}
+
+	/*
+	 * Note we set the attached handle even though we haven't actually
+	 * finished the process of attaching the ldi handle.
+	 */
+	mutex_enter(&vdp->vdd_lock);
+	if (vdp->vdd_flags & (VND_D_ATTACHED | VND_D_ATTACH_INFLIGHT)) {
+		mutex_exit(&vdp->vdd_lock);
+		vnd_nsd_rele(nsp);
+		via.via_errno = VND_E_ATTACHED;
+		ret = EIO;
+		goto errcopyout;
+	}
+	vdp->vdd_flags |= VND_D_ATTACH_INFLIGHT;
+	ASSERT(vdp->vdd_cr == NULL);
+	crhold(credp);
+	vdp->vdd_cr = credp;
+	ASSERT(vdp->vdd_nsd == NULL);
+	vdp->vdd_nsd = nsp;
+	mutex_exit(&vdp->vdd_lock);
+
+	/*
+	 * Place an additional hold on the vnd_pnsd_t as we go through and do
+	 * all of the rest of our work. This will be the hold that we keep for
+	 * as long as this thing is attached.
+	 */
+	vnd_nsd_ref(nsp);
+
+	ret = ldi_open_by_name(buf, FREAD | FWRITE, vdp->vdd_cr,
+	    &vdp->vdd_ldih, vdp->vdd_ldiid);
+	if (ret != 0) {
+		if (ret == ENODEV)
+			via.via_errno = VND_E_NODATALINK;
+		goto err;
+	}
+
+	/*
+	 * Unfortunately the I_PUSH interface doesn't allow us a way to detect
+	 * whether or not we're coming in from a layered device. We really want
+	 * to make sure that a normal user can't push on our streams module.
+	 * Currently the only idea I have for this is to make sure that the
+	 * credp is kcred which is really terrible.
+	 */
+	ret = ldi_ioctl(vdp->vdd_ldih, I_PUSH, (intptr_t)"vnd", FKIOCTL,
+	    kcred, &rp);
+	if (ret != 0) {
+		rp = ldi_close(vdp->vdd_ldih, FREAD | FWRITE, vdp->vdd_cr);
+		VERIFY(rp == 0);
+		via.via_errno = VND_E_STRINIT;
+		ret = EIO;
+		goto err;
+	}
+
+	vss.vsa_minor = vdp->vdd_minor;
+	vss.vsa_nsid = nsp->vpnd_nsid;
+
+	ret = ldi_ioctl(vdp->vdd_ldih, VND_STRIOC_ASSOCIATE, (intptr_t)&vss,
+	    FKIOCTL, kcred, &rp);
+	if (ret != 0 || vss.vsa_errno != VND_E_SUCCESS) {
+		rp = ldi_close(vdp->vdd_ldih, FREAD | FWRITE, vdp->vdd_cr);
+		VERIFY(rp == 0);
+		if (ret == 0) {
+			via.via_errno = vss.vsa_errno;
+			ret = EIO;
+		}
+		goto err;
+	}
+
+	mutex_enter(&vdp->vdd_nsd->vpnd_lock);
+
+	/*
+	 * There's a chance that our netstack was condemned while we've had a
+	 * hold on it. As such we need to check and if so, error out.
+	 */
+	if (vdp->vdd_nsd->vpnd_flags & VND_NS_CONDEMNED) {
+		mutex_exit(&vdp->vdd_nsd->vpnd_lock);
+		rp = ldi_close(vdp->vdd_ldih, FREAD | FWRITE, vdp->vdd_cr);
+		VERIFY(rp == 0);
+		ret = EIO;
+		via.via_errno = VND_E_NOZONE;
+		goto err;
+	}
+
+	mutex_enter(&vdp->vdd_lock);
+	VERIFY(vdp->vdd_str != NULL);
+	vdp->vdd_flags &= ~VND_D_ATTACH_INFLIGHT;
+	vdp->vdd_flags |= VND_D_ATTACHED;
+	(void) strlcpy(vdp->vdd_datalink, via.via_name,
+	    sizeof (vdp->vdd_datalink));
+	list_insert_tail(&vdp->vdd_nsd->vpnd_dev_list, vdp);
+	mutex_exit(&vdp->vdd_lock);
+	mutex_exit(&vdp->vdd_nsd->vpnd_lock);
+	vnd_nsd_rele(nsp);
+
+	return (0);
+
+err:
+	mutex_enter(&vdp->vdd_lock);
+	vdp->vdd_flags &= ~VND_D_ATTACH_INFLIGHT;
+	crfree(vdp->vdd_cr);
+	vdp->vdd_cr = NULL;
+	vdp->vdd_nsd = NULL;
+	mutex_exit(&vdp->vdd_lock);
+
+	/*
+	 * We have two holds to drop here. One for our original reference and
+	 * one for the hold this operation would have represented.
+	 */
+	vnd_nsd_rele(nsp);
+	vnd_nsd_rele(nsp);
+errcopyout:
+	if (ddi_copyout(&via, (void *)arg, sizeof (via), cpflag) != 0)
+		ret = EFAULT;
+
+	return (ret);
+}
+
+static int
+vnd_ioctl_link(vnd_dev_t *vdp, intptr_t arg, cred_t *credp, int cpflag)
+{
+	int ret = 0;
+	vnd_ioc_link_t vil;
+	char mname[2*VND_NAMELEN];
+	char **c;
+	vnd_dev_t *v;
+	zoneid_t zid;
+
+	/* Not anyone can link something */
+	if (secpolicy_net_config(credp, B_FALSE) != 0)
+		return (EPERM);
+
+	if (ddi_copyin((void *)arg, &vil, sizeof (vil), cpflag) != 0)
+		return (EFAULT);
+
+	if (vnd_validate_name(vil.vil_name, VND_NAMELEN) == 0) {
+		ret = EIO;
+		vil.vil_errno = VND_E_BADNAME;
+		goto errcopyout;
+	}
+
+	c = vnd_reserved_names;
+	while (*c != NULL) {
+		if (strcmp(vil.vil_name, *c) == 0) {
+			ret = EIO;
+			vil.vil_errno = VND_E_BADNAME;
+			goto errcopyout;
+		}
+		c++;
+	}
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		ret = EIO;
+		vil.vil_errno = VND_E_NOTATTACHED;
+		goto errcopyout;
+	}
+
+	if (vdp->vdd_flags & VND_D_ZONE_DYING) {
+		mutex_exit(&vdp->vdd_lock);
+		ret = EIO;
+		vil.vil_errno = VND_E_NOZONE;
+		goto errcopyout;
+	}
+
+	if (vdp->vdd_flags & (VND_D_LINK_INFLIGHT | VND_D_LINKED)) {
+		mutex_exit(&vdp->vdd_lock);
+		ret = EIO;
+		vil.vil_errno = VND_E_LINKED;
+		goto errcopyout;
+	}
+	vdp->vdd_flags |= VND_D_LINK_INFLIGHT;
+	zid = vdp->vdd_nsd->vpnd_zid;
+	mutex_exit(&vdp->vdd_lock);
+
+	if (snprintf(NULL, 0, "z%d:%s", zid, vil.vil_name) >=
+	    sizeof (mname)) {
+		ret = EIO;
+		vil.vil_errno = VND_E_BADNAME;
+		goto errcopyout;
+	}
+
+	mutex_enter(&vnd_dev_lock);
+	for (v = list_head(&vnd_dev_list); v != NULL;
+	    v = list_next(&vnd_dev_list, v)) {
+		if (!(v->vdd_flags & VND_D_LINKED))
+			continue;
+
+		if (v->vdd_nsd->vpnd_zid == zid &&
+		    strcmp(v->vdd_lname, vil.vil_name) == 0) {
+			mutex_exit(&vnd_dev_lock);
+			ret = EIO;
+			vil.vil_errno = VND_E_LINKEXISTS;
+			goto error;
+		}
+	}
+
+	/*
+	 * We set the name and mark ourselves attached while holding the list
+	 * lock to ensure that no other user can mistakingly find our name.
+	 */
+	(void) snprintf(mname, sizeof (mname), "z%d:%s", zid,
+	    vil.vil_name);
+	mutex_enter(&vdp->vdd_lock);
+
+	/*
+	 * Because we dropped our lock, we need to double check whether or not
+	 * the zone was marked as dying while we were here. If it hasn't, then
+	 * it's safe for us to link it in.
+	 */
+	if (vdp->vdd_flags & VND_D_ZONE_DYING) {
+		mutex_exit(&vdp->vdd_lock);
+		mutex_exit(&vnd_dev_lock);
+		ret = EIO;
+		vil.vil_errno = VND_E_NOZONE;
+		goto error;
+	}
+
+	(void) strlcpy(vdp->vdd_lname, vil.vil_name, sizeof (vdp->vdd_lname));
+	if (ddi_create_minor_node(vnd_dip, mname, S_IFCHR, vdp->vdd_minor,
+	    DDI_PSEUDO, 0) != DDI_SUCCESS) {
+		ret = EIO;
+		vil.vil_errno = VND_E_MINORNODE;
+	} else {
+		vdp->vdd_flags &= ~VND_D_LINK_INFLIGHT;
+		vdp->vdd_flags |= VND_D_LINKED;
+		kstat_named_setstr(&vdp->vdd_str->vns_ksdata.vks_linkname,
+		    vdp->vdd_lname);
+		ret = 0;
+	}
+	mutex_exit(&vdp->vdd_lock);
+	mutex_exit(&vnd_dev_lock);
+
+	if (ret == 0) {
+		/*
+		 * Add a reference to represent that this device is linked into
+		 * the file system name space to ensure that it doesn't
+		 * disappear.
+		 */
+		vnd_dev_ref(vdp);
+		return (0);
+	}
+
+error:
+	mutex_enter(&vdp->vdd_lock);
+	vdp->vdd_flags &= ~VND_D_LINK_INFLIGHT;
+	vdp->vdd_lname[0] = '\0';
+	mutex_exit(&vdp->vdd_lock);
+
+errcopyout:
+	if (ddi_copyout(&vil, (void *)arg, sizeof (vil), cpflag) != 0)
+		ret = EFAULT;
+	return (ret);
+}
+
+/*
+ * Common unlink function. This is used both from the ioctl path and from the
+ * netstack shutdown path. The caller is required to hold the mutex on the
+ * vnd_dev_t, but they basically will have it relinquished for them. The only
+ * thing the caller is allowed to do afterward is to potentially rele the
+ * vnd_dev_t if they have their own hold. Note that only the ioctl path has its
+ * own hold.
+ */
+static void
+vnd_dev_unlink(vnd_dev_t *vdp)
+{
+	char mname[2*VND_NAMELEN];
+
+	ASSERT(MUTEX_HELD(&vdp->vdd_lock));
+
+	(void) snprintf(mname, sizeof (mname), "z%d:%s",
+	    vdp->vdd_nsd->vpnd_zid, vdp->vdd_lname);
+	ddi_remove_minor_node(vnd_dip, mname);
+	vdp->vdd_lname[0] = '\0';
+	vdp->vdd_flags &= ~VND_D_LINKED;
+	kstat_named_setstr(&vdp->vdd_str->vns_ksdata.vks_linkname,
+	    vdp->vdd_lname);
+	mutex_exit(&vdp->vdd_lock);
+
+	/*
+	 * This rele corresponds to the reference that we took in
+	 * vnd_ioctl_link.
+	 */
+	vnd_dev_rele(vdp);
+}
+
+static int
+vnd_ioctl_unlink(vnd_dev_t *vdp, intptr_t arg, cred_t *credp, int cpflag)
+{
+	int ret;
+	zoneid_t zid;
+	vnd_ioc_unlink_t viu;
+
+	/* Not anyone can unlink something */
+	if (secpolicy_net_config(credp, B_FALSE) != 0)
+		return (EPERM);
+
+	zid = crgetzoneid(credp);
+
+	if (ddi_copyin((void *)arg, &viu, sizeof (viu), cpflag) != 0)
+		return (EFAULT);
+
+	viu.viu_errno = VND_E_SUCCESS;
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_LINKED)) {
+		mutex_exit(&vdp->vdd_lock);
+		ret = EIO;
+		viu.viu_errno = VND_E_NOTLINKED;
+		goto err;
+	}
+	VERIFY(vdp->vdd_flags & VND_D_ATTACHED);
+
+	if (zid != GLOBAL_ZONEID && zid != vdp->vdd_nsd->vpnd_zid) {
+		mutex_exit(&vdp->vdd_lock);
+		ret = EIO;
+		viu.viu_errno = VND_E_PERM;
+		goto err;
+	}
+
+	/* vnd_dev_unlink releases the vdp mutex for us */
+	vnd_dev_unlink(vdp);
+	ret = 0;
+err:
+	if (ddi_copyout(&viu, (void *)arg, sizeof (viu), cpflag) != 0)
+		return (EFAULT);
+
+	return (ret);
+}
+
+static int
+vnd_ioctl_setrxbuf(vnd_dev_t *vdp, intptr_t arg, int cpflag)
+{
+	int ret;
+	vnd_ioc_buf_t vib;
+
+	if (ddi_copyin((void *)arg, &vib, sizeof (vib), cpflag) != 0)
+		return (EFAULT);
+
+	mutex_enter(&vnd_dev_lock);
+	if (vib.vib_size > vnd_vdq_hard_max) {
+		mutex_exit(&vnd_dev_lock);
+		vib.vib_errno = VND_E_BUFTOOBIG;
+		ret = EIO;
+		goto err;
+	}
+	mutex_exit(&vnd_dev_lock);
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		vib.vib_errno = VND_E_NOTATTACHED;
+		ret = EIO;
+		goto err;
+	}
+
+	mutex_enter(&vdp->vdd_str->vns_lock);
+	if (vib.vib_size < vdp->vdd_str->vns_minwrite) {
+		mutex_exit(&vdp->vdd_str->vns_lock);
+		mutex_exit(&vdp->vdd_lock);
+		vib.vib_errno = VND_E_BUFTOOSMALL;
+		ret = EIO;
+		goto err;
+	}
+
+	mutex_exit(&vdp->vdd_str->vns_lock);
+	mutex_enter(&vdp->vdd_str->vns_dq_read.vdq_lock);
+	vdp->vdd_str->vns_dq_read.vdq_max = (size_t)vib.vib_size;
+	mutex_exit(&vdp->vdd_str->vns_dq_read.vdq_lock);
+	mutex_exit(&vdp->vdd_lock);
+	ret = 0;
+
+err:
+	if (ddi_copyout(&vib, (void *)arg, sizeof (vib), cpflag) != 0)
+		return (EFAULT);
+
+	return (ret);
+}
+
+static int
+vnd_ioctl_getrxbuf(vnd_dev_t *vdp, intptr_t arg, int cpflag)
+{
+	int ret;
+	vnd_ioc_buf_t vib;
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		vib.vib_errno = VND_E_NOTATTACHED;
+		ret = EIO;
+		goto err;
+	}
+
+	mutex_enter(&vdp->vdd_str->vns_dq_read.vdq_lock);
+	vib.vib_size = vdp->vdd_str->vns_dq_read.vdq_max;
+	mutex_exit(&vdp->vdd_str->vns_dq_read.vdq_lock);
+	mutex_exit(&vdp->vdd_lock);
+	ret = 0;
+
+err:
+	if (ddi_copyout(&vib, (void *)arg, sizeof (vib), cpflag) != 0)
+		return (EFAULT);
+
+	return (ret);
+}
+
+/* ARGSUSED */
+static int
+vnd_ioctl_getmaxbuf(vnd_dev_t *vdp, intptr_t arg, int cpflag)
+{
+	vnd_ioc_buf_t vib;
+
+	mutex_enter(&vnd_dev_lock);
+	vib.vib_size = vnd_vdq_hard_max;
+	mutex_exit(&vnd_dev_lock);
+
+	if (ddi_copyout(&vib, (void *)arg, sizeof (vib), cpflag) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static int
+vnd_ioctl_gettxbuf(vnd_dev_t *vdp, intptr_t arg, int cpflag)
+{
+	int ret;
+	vnd_ioc_buf_t vib;
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		vib.vib_errno = VND_E_NOTATTACHED;
+		ret = EIO;
+		goto err;
+	}
+
+	mutex_enter(&vdp->vdd_str->vns_dq_write.vdq_lock);
+	vib.vib_size = vdp->vdd_str->vns_dq_write.vdq_max;
+	mutex_exit(&vdp->vdd_str->vns_dq_write.vdq_lock);
+	mutex_exit(&vdp->vdd_lock);
+	ret = 0;
+
+err:
+	if (ddi_copyout(&vib, (void *)arg, sizeof (vib), cpflag) != 0)
+		return (EFAULT);
+
+	return (ret);
+}
+
+static int
+vnd_ioctl_settxbuf(vnd_dev_t *vdp, intptr_t arg, int cpflag)
+{
+	int ret;
+	vnd_ioc_buf_t vib;
+
+	if (ddi_copyin((void *)arg, &vib, sizeof (vib), cpflag) != 0)
+		return (EFAULT);
+
+	mutex_enter(&vnd_dev_lock);
+	if (vib.vib_size > vnd_vdq_hard_max) {
+		mutex_exit(&vnd_dev_lock);
+		vib.vib_errno = VND_E_BUFTOOBIG;
+		ret = EIO;
+		goto err;
+	}
+	mutex_exit(&vnd_dev_lock);
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		vib.vib_errno = VND_E_NOTATTACHED;
+		ret = EIO;
+		goto err;
+	}
+
+	mutex_enter(&vdp->vdd_str->vns_lock);
+	if (vib.vib_size < vdp->vdd_str->vns_minwrite) {
+		mutex_exit(&vdp->vdd_str->vns_lock);
+		mutex_exit(&vdp->vdd_lock);
+		vib.vib_errno = VND_E_BUFTOOSMALL;
+		ret = EIO;
+		goto err;
+	}
+	mutex_exit(&vdp->vdd_str->vns_lock);
+
+	mutex_enter(&vdp->vdd_str->vns_dq_write.vdq_lock);
+	vdp->vdd_str->vns_dq_write.vdq_max = (size_t)vib.vib_size;
+	mutex_exit(&vdp->vdd_str->vns_dq_write.vdq_lock);
+	mutex_exit(&vdp->vdd_lock);
+	ret = 0;
+
+err:
+	if (ddi_copyout(&vib, (void *)arg, sizeof (vib), cpflag) != 0)
+		return (EFAULT);
+
+	return (ret);
+}
+
+static int
+vnd_ioctl_gettu(vnd_dev_t *vdp, intptr_t arg, int mode, boolean_t min)
+{
+	vnd_ioc_buf_t vib;
+
+	vib.vib_errno = 0;
+	mutex_enter(&vdp->vdd_lock);
+	if (vdp->vdd_flags & VND_D_ATTACHED) {
+		mutex_enter(&vdp->vdd_str->vns_lock);
+		if (min == B_TRUE)
+			vib.vib_size = vdp->vdd_str->vns_minwrite;
+		else
+			vib.vib_size = vdp->vdd_str->vns_maxwrite;
+		mutex_exit(&vdp->vdd_str->vns_lock);
+	} else {
+		vib.vib_errno = VND_E_NOTATTACHED;
+	}
+	mutex_exit(&vdp->vdd_lock);
+
+	if (ddi_copyout(&vib, (void *)arg, sizeof (vib), mode & FKIOCTL) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+static int
+vnd_frameio_read(vnd_dev_t *vdp, intptr_t addr, int mode)
+{
+	int ret, nonblock, nwrite;
+	frameio_t *fio;
+	vnd_data_queue_t *vqp;
+	mblk_t *mp;
+
+	fio = frameio_alloc(KM_NOSLEEP | KM_NORMALPRI);
+	if (fio == NULL)
+		return (EAGAIN);
+
+	ret = frameio_hdr_copyin(fio, FRAMEIO_NVECS_MAX, (const void *)addr,
+	    mode);
+	if (ret != 0) {
+		frameio_free(fio);
+		return (ret);
+	}
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		frameio_free(fio);
+		return (ENXIO);
+	}
+	mutex_exit(&vdp->vdd_lock);
+
+	nonblock = mode & (FNONBLOCK | FNDELAY);
+
+	vqp = &vdp->vdd_str->vns_dq_read;
+	mutex_enter(&vqp->vdq_lock);
+
+	/* Check empty case */
+	if (vqp->vdq_cur == 0) {
+		if (nonblock != 0) {
+			mutex_exit(&vqp->vdq_lock);
+			frameio_free(fio);
+			return (EWOULDBLOCK);
+		}
+		while (vqp->vdq_cur == 0) {
+			if (cv_wait_sig(&vqp->vdq_ready, &vqp->vdq_lock) <= 0) {
+				mutex_exit(&vqp->vdq_lock);
+				frameio_free(fio);
+				return (EINTR);
+			}
+		}
+	}
+
+	ret = frameio_mblk_chain_write(fio, MAP_BLK_FRAME, vqp->vdq_head,
+	    &nwrite, mode & FKIOCTL);
+	if (ret != 0) {
+		mutex_exit(&vqp->vdq_lock);
+		frameio_free(fio);
+		return (ret);
+	}
+
+	ret = frameio_hdr_copyout(fio, nwrite, (void *)addr, mode);
+	if (ret != 0) {
+		mutex_exit(&vqp->vdq_lock);
+		frameio_free(fio);
+		return (ret);
+	}
+
+	while (nwrite > 0) {
+		(void) vnd_dq_pop(vqp, &mp);
+		freemsg(mp);
+		nwrite--;
+	}
+	mutex_exit(&vqp->vdq_lock);
+	frameio_free(fio);
+
+	return (0);
+}
+
+static int
+vnd_frameio_write(vnd_dev_t *vdp, intptr_t addr, int mode)
+{
+	frameio_t *fio;
+	int ret, nonblock, nframes, i, nread;
+	size_t maxwrite, minwrite, total, flen;
+	mblk_t *mp_chain, *mp, *nmp;
+	vnd_data_queue_t *vqp;
+
+	fio = frameio_alloc(KM_NOSLEEP | KM_NORMALPRI);
+	if (fio == NULL)
+		return (EAGAIN);
+
+	ret = frameio_hdr_copyin(fio, FRAMEIO_NVECS_MAX, (void *)addr, mode);
+	if (ret != 0) {
+		frameio_free(fio);
+		return (ret);
+	}
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		frameio_free(fio);
+		return (ENXIO);
+	}
+	mutex_exit(&vdp->vdd_lock);
+
+	nonblock = mode & (FNONBLOCK | FNDELAY);
+
+	/*
+	 * Make sure no single frame is larger than we can accept.
+	 */
+	mutex_enter(&vdp->vdd_str->vns_lock);
+	minwrite = vdp->vdd_str->vns_minwrite;
+	maxwrite = vdp->vdd_str->vns_maxwrite;
+	mutex_exit(&vdp->vdd_str->vns_lock);
+
+	nframes = fio->fio_nvpf / fio->fio_nvecs;
+	total = 0;
+	for (i = 0; i < nframes; i++) {
+		flen = frameio_frame_length(fio,
+		    &fio->fio_vecs[i*fio->fio_nvpf]);
+		if (flen < minwrite || flen > maxwrite) {
+			frameio_free(fio);
+			return (ERANGE);
+		}
+		total += flen;
+	}
+
+	vqp = &vdp->vdd_str->vns_dq_write;
+	mutex_enter(&vqp->vdq_lock);
+	while (vnd_dq_reserve(vqp, total) == 0) {
+		if (nonblock != 0) {
+			frameio_free(fio);
+			mutex_exit(&vqp->vdq_lock);
+			return (EAGAIN);
+		}
+		if (cv_wait_sig(&vqp->vdq_ready, &vqp->vdq_lock) <= 0) {
+			mutex_exit(&vqp->vdq_lock);
+			frameio_free(fio);
+			return (EINTR);
+		}
+	}
+	mutex_exit(&vqp->vdq_lock);
+
+	/*
+	 * We've reserved our space, let's copyin and go from here.
+	 */
+	ret = frameio_mblk_chain_read(fio, &mp_chain, &nread, mode & FKIOCTL);
+	if (ret != 0) {
+		frameio_free(fio);
+		vnd_dq_unreserve(vqp, total);
+		cv_broadcast(&vqp->vdq_ready);
+		pollwakeup(&vdp->vdd_ph, POLLOUT);
+		return (ret);
+	}
+
+	for (mp = mp_chain; mp != NULL; mp = nmp) {
+		nmp = mp->b_next;
+		mp->b_next = NULL;
+		gsqueue_enter_one(vdp->vdd_str->vns_squeue, mp,
+		    vnd_squeue_tx_append, vdp->vdd_str, GSQUEUE_PROCESS,
+		    VND_SQUEUE_TAG_VND_WRITE);
+	}
+
+	/*
+	 * Update the frameio structure to indicate that we wrote those frames.
+	 */
+	frameio_mark_consumed(fio, nread);
+	ret = frameio_hdr_copyout(fio, nread, (void *)addr, mode);
+	frameio_free(fio);
+
+	return (ret);
+}
+
+static int
+vnd_ioctl_list_copy_info(vnd_dev_t *vdp, vnd_ioc_info_t *arg, int mode)
+{
+	const char *link;
+	uint32_t vers = 1;
+	ASSERT(MUTEX_HELD(&vdp->vdd_lock));
+
+	/*
+	 * Copy all of the members out to userland.
+	 */
+	if (ddi_copyout(&vers, &arg->vii_version, sizeof (uint32_t),
+	    mode & FKIOCTL) != 0)
+		return (EFAULT);
+
+	if (vdp->vdd_flags & VND_D_LINKED)
+		link = vdp->vdd_lname;
+	else
+		link = "<anonymous>";
+	if (ddi_copyout(link, arg->vii_name, sizeof (arg->vii_name),
+	    mode & FKIOCTL) != 0)
+		return (EFAULT);
+
+	if (ddi_copyout(vdp->vdd_datalink, arg->vii_datalink,
+	    sizeof (arg->vii_datalink), mode & FKIOCTL) != 0)
+		return (EFAULT);
+
+	if (ddi_copyout(&vdp->vdd_nsd->vpnd_zid, &arg->vii_zone,
+	    sizeof (zoneid_t), mode & FKIOCTL) != 0)
+		return (EFAULT);
+	return (0);
+}
+
+static int
+vnd_ioctl_list(intptr_t arg, cred_t *credp, int mode)
+{
+	vnd_ioc_list_t vl;
+	vnd_ioc_list32_t vl32;
+	zoneid_t zid;
+	vnd_dev_t *vdp;
+	vnd_ioc_info_t *vip;
+	int found, cancopy, ret;
+
+	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
+		if (ddi_copyin((void *)arg, &vl32, sizeof (vnd_ioc_list32_t),
+		    mode & FKIOCTL) != 0)
+			return (EFAULT);
+		vl.vl_nents = vl32.vl_nents;
+		vl.vl_actents = vl32.vl_actents;
+		vl.vl_ents = (void *)(uintptr_t)vl32.vl_ents;
+	} else {
+		if (ddi_copyin((void *)arg, &vl, sizeof (vnd_ioc_list_t),
+		    mode & FKIOCTL) != 0)
+			return (EFAULT);
+	}
+
+	cancopy = vl.vl_nents;
+	vip = vl.vl_ents;
+	found = 0;
+	zid = crgetzoneid(credp);
+	mutex_enter(&vnd_dev_lock);
+	for (vdp = list_head(&vnd_dev_list); vdp != NULL;
+	    vdp = list_next(&vnd_dev_list, vdp)) {
+		mutex_enter(&vdp->vdd_lock);
+		if (vdp->vdd_flags & VND_D_ATTACHED &&
+		    !(vdp->vdd_flags & (VND_D_CONDEMNED | VND_D_ZONE_DYING)) &&
+		    (zid == GLOBAL_ZONEID || zid == vdp->vdd_nsd->vpnd_zid)) {
+			found++;
+			if (cancopy > 0) {
+				ret = vnd_ioctl_list_copy_info(vdp, vip, mode);
+				if (ret != 0) {
+					mutex_exit(&vdp->vdd_lock);
+					mutex_exit(&vnd_dev_lock);
+					return (ret);
+				}
+				cancopy--;
+				vip++;
+			}
+		}
+		mutex_exit(&vdp->vdd_lock);
+	}
+	mutex_exit(&vnd_dev_lock);
+
+	if (ddi_copyout(&found, &((vnd_ioc_list_t *)arg)->vl_actents,
+	    sizeof (uint_t), mode & FKIOCTL) != 0)
+		return (EFAULT);
+
+	return (0);
+}
+
+
+/* ARGSUSED */
+static int
+vnd_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rvalp)
+{
+	int ret;
+	minor_t m;
+	vnd_dev_t *vdp;
+
+	m = getminor(dev);
+	ASSERT(m != 0);
+
+	/*
+	 * Make sure no one has come in on an ioctl from the strioc case.
+	 */
+	if ((cmd & VND_STRIOC) == VND_STRIOC)
+		return (ENOTTY);
+
+	/*
+	 * Like close, seems like if this minor isn't found, it's a programmer
+	 * error somehow.
+	 */
+	vdp = vnd_dev_lookup(m);
+	if (vdp == NULL)
+		return (ENXIO);
+
+	switch (cmd) {
+	case VND_IOC_ATTACH:
+		if (!(mode & FWRITE)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_attach(vdp, arg, credp, mode);
+		break;
+	case VND_IOC_LINK:
+		if (!(mode & FWRITE)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_link(vdp, arg, credp, mode);
+		break;
+	case VND_IOC_UNLINK:
+		if (!(mode & FWRITE)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_unlink(vdp, arg, credp, mode);
+		break;
+	case VND_IOC_GETRXBUF:
+		if (!(mode & FREAD)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_getrxbuf(vdp, arg, mode);
+		break;
+	case VND_IOC_SETRXBUF:
+		if (!(mode & FWRITE)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_setrxbuf(vdp, arg, mode);
+		break;
+	case VND_IOC_GETTXBUF:
+		if (!(mode & FREAD)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_gettxbuf(vdp, arg, mode);
+		break;
+	case VND_IOC_SETTXBUF:
+		if (!(mode & FWRITE)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_settxbuf(vdp, arg, mode);
+		break;
+	case VND_IOC_GETMAXBUF:
+		if (!(mode & FREAD)) {
+			ret = EBADF;
+			break;
+		}
+		if (crgetzoneid(credp) != GLOBAL_ZONEID) {
+			ret = EPERM;
+			break;
+		}
+		ret = vnd_ioctl_getmaxbuf(vdp, arg, mode);
+		break;
+	case VND_IOC_GETMINTU:
+		if (!(mode & FREAD)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_gettu(vdp, arg, mode, B_TRUE);
+		break;
+	case VND_IOC_GETMAXTU:
+		if (!(mode & FREAD)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_gettu(vdp, arg, mode, B_FALSE);
+		break;
+	case VND_IOC_FRAMEIO_READ:
+		if (!(mode & FREAD)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_frameio_read(vdp, arg, mode);
+		break;
+	case VND_IOC_FRAMEIO_WRITE:
+		if (!(mode & FWRITE)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_frameio_write(vdp, arg, mode);
+		break;
+	case VND_IOC_LIST:
+		if (!(mode & FREAD)) {
+			ret = EBADF;
+			break;
+		}
+		ret = vnd_ioctl_list(arg, credp, mode);
+		break;
+	default:
+		ret = ENOTTY;
+		break;
+	}
+
+	vnd_dev_rele(vdp);
+	return (ret);
+}
+
+static int
+vnd_open(dev_t *devp, int flag, int otyp, cred_t *credp)
+{
+	vnd_dev_t *vdp;
+	minor_t m;
+	zoneid_t zid;
+
+	if (flag & (FEXCL | FNDELAY))
+		return (ENOTSUP);
+
+	if (otyp & OTYP_BLK)
+		return (ENOTSUP);
+
+	zid = crgetzoneid(credp);
+	m = getminor(*devp);
+
+	/*
+	 * If we have an open of a non-zero instance then we need to look that
+	 * up in our list of entries.
+	 */
+	if (m != 0) {
+
+		/*
+		 * We don't check for rawaccess globally as a user could be
+		 * doing a list ioctl on the control node which doesn't require
+		 * this privilege.
+		 */
+		if (secpolicy_net_rawaccess(credp) != 0)
+			return (EPERM);
+
+
+		vdp = vnd_dev_lookup(m);
+		if (vdp == NULL)
+			return (ENOENT);
+
+		/*
+		 * We need to check to make sure that the user is allowed to
+		 * open this node. At this point it should be an attached handle
+		 * as that's all we're allowed to access.
+		 */
+		mutex_enter(&vdp->vdd_lock);
+		if (!(vdp->vdd_flags & VND_D_LINKED)) {
+			mutex_exit(&vdp->vdd_lock);
+			vnd_dev_rele(vdp);
+			return (ENOENT);
+		}
+
+		if (vdp->vdd_flags & VND_D_ZONE_DYING) {
+			mutex_exit(&vdp->vdd_lock);
+			vnd_dev_rele(vdp);
+			return (ENOENT);
+		}
+
+		if (zid != GLOBAL_ZONEID && zid != vdp->vdd_nsd->vpnd_zid) {
+			mutex_exit(&vdp->vdd_lock);
+			vnd_dev_rele(vdp);
+			return (ENOENT);
+		}
+
+		if ((flag & FEXCL) && (vdp->vdd_flags & VND_D_OPENED)) {
+			mutex_exit(&vdp->vdd_lock);
+			vnd_dev_rele(vdp);
+			return (EBUSY);
+		}
+
+		if (!(vdp->vdd_flags & VND_D_OPENED)) {
+			vdp->vdd_flags |= VND_D_OPENED;
+			vdp->vdd_ref++;
+			DTRACE_VND_REFINC(vdp);
+		}
+		mutex_exit(&vdp->vdd_lock);
+		vnd_dev_rele(vdp);
+
+		return (0);
+	}
+
+	if (flag & FEXCL)
+		return (ENOTSUP);
+
+	/*
+	 * We need to clone ourselves and set up new a state.
+	 */
+	vdp = kmem_cache_alloc(vnd_dev_cache, KM_SLEEP);
+	bzero(vdp, sizeof (vnd_dev_t));
+
+	if (ldi_ident_from_dev(*devp, &vdp->vdd_ldiid) != 0) {
+		kmem_cache_free(vnd_dev_cache, vdp);
+		return (EINVAL);
+	}
+
+	vdp->vdd_minor = id_alloc(vnd_minors);
+	mutex_init(&vdp->vdd_lock, NULL, MUTEX_DRIVER, NULL);
+	list_link_init(&vdp->vdd_link);
+	vdp->vdd_ref = 1;
+	*devp = makedevice(getmajor(*devp), vdp->vdd_minor);
+	vdp->vdd_devid = *devp;
+	DTRACE_VND_REFINC(vdp);
+	vdp->vdd_flags |= VND_D_OPENED;
+
+	mutex_enter(&vnd_dev_lock);
+	list_insert_head(&vnd_dev_list, vdp);
+	mutex_exit(&vnd_dev_lock);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+vnd_close(dev_t dev, int flag, int otyp, cred_t *credp)
+{
+	minor_t m;
+	vnd_dev_t *vdp;
+
+	m = getminor(dev);
+	if (m == 0)
+		return (ENXIO);
+
+	vdp = vnd_dev_lookup(m);
+	if (vdp == NULL)
+		return (ENXIO);
+
+	mutex_enter(&vdp->vdd_lock);
+	VERIFY(vdp->vdd_flags & VND_D_OPENED);
+	vdp->vdd_flags &= ~VND_D_OPENED;
+	mutex_exit(&vdp->vdd_lock);
+
+	/* Remove the hold from the previous open. */
+	vnd_dev_rele(vdp);
+
+	/* And now from lookup */
+	vnd_dev_rele(vdp);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+vnd_read(dev_t dev, struct uio *uiop, cred_t *credp)
+{
+	int nonblock, error = 0;
+	size_t mpsize;
+	vnd_dev_t *vdp;
+	vnd_data_queue_t *vqp;
+	mblk_t *mp = NULL;
+	offset_t u_loffset;
+
+	/*
+	 * If we have more than one uio we refuse to do anything. That's for
+	 * frameio.
+	 */
+	if (uiop->uio_iovcnt > 1)
+		return (EINVAL);
+
+	vdp = vnd_dev_lookup(getminor(dev));
+	if (vdp == NULL)
+		return (ENXIO);
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		vnd_dev_rele(vdp);
+		return (ENXIO);
+	}
+	mutex_exit(&vdp->vdd_lock);
+	nonblock = uiop->uio_fmode & (FNONBLOCK | FNDELAY);
+
+	vqp = &vdp->vdd_str->vns_dq_read;
+	mutex_enter(&vqp->vdq_lock);
+
+	/* Check empty case */
+	if (vqp->vdq_cur == 0) {
+		if (nonblock != 0) {
+			error = EWOULDBLOCK;
+			goto err;
+		}
+		while (vqp->vdq_cur == 0) {
+			if (cv_wait_sig(&vqp->vdq_ready, &vqp->vdq_lock) <= 0) {
+				error = EINTR;
+				goto err;
+			}
+		}
+	}
+
+	/* Ensure our buffer is big enough */
+	mp = vqp->vdq_head;
+	ASSERT(mp != NULL);
+	mpsize = msgsize(mp);
+	if (mpsize > uiop->uio_resid) {
+		error = EOVERFLOW;
+		goto err;
+	}
+
+	u_loffset = uiop->uio_loffset;
+	while (mp != NULL) {
+		if (uiomove(mp->b_rptr, MBLKL(mp), UIO_READ, uiop) != 0) {
+			error = EFAULT;
+			uiop->uio_loffset = u_loffset;
+			mp = NULL;
+			goto err;
+		}
+		mpsize -= MBLKL(mp);
+		mp = mp->b_cont;
+	}
+	ASSERT(mpsize == 0);
+	(void) vnd_dq_pop(vqp, &mp);
+	freemsg(mp);
+err:
+	mutex_exit(&vqp->vdq_lock);
+	vnd_dev_rele(vdp);
+
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+vnd_write(dev_t dev, struct uio *uiop, cred_t *credp)
+{
+	int nonblock, error;
+	vnd_dev_t *vdp;
+	mblk_t *mp;
+	ssize_t iosize, origsize;
+	vnd_data_queue_t *vqp;
+
+	if (uiop->uio_iovcnt > 1)
+		return (EINVAL);
+
+	vdp = vnd_dev_lookup(getminor(dev));
+	if (vdp == NULL)
+		return (ENXIO);
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		vnd_dev_rele(vdp);
+		return (ENXIO);
+	}
+	mutex_exit(&vdp->vdd_lock);
+	nonblock = uiop->uio_fmode & (FNONBLOCK | FNDELAY);
+
+	mutex_enter(&vdp->vdd_str->vns_lock);
+	if (uiop->uio_resid > vdp->vdd_str->vns_maxwrite ||
+	    uiop->uio_resid < vdp->vdd_str->vns_minwrite) {
+		mutex_exit(&vdp->vdd_str->vns_lock);
+		vnd_dev_rele(vdp);
+		return (ERANGE);
+	}
+	mutex_exit(&vdp->vdd_str->vns_lock);
+	VERIFY(vdp->vdd_str != NULL);
+
+	/*
+	 * Reserve space in the data queue if we can. If we can't, block or
+	 * return EAGAIN. If we can, go and squeue_enter.
+	 */
+	vqp = &vdp->vdd_str->vns_dq_write;
+	mutex_enter(&vqp->vdq_lock);
+	while (vnd_dq_reserve(vqp, uiop->uio_resid) == 0) {
+		if (nonblock != 0) {
+			mutex_exit(&vqp->vdq_lock);
+			vnd_dev_rele(vdp);
+			return (EAGAIN);
+		}
+		if (cv_wait_sig(&vqp->vdq_ready, &vqp->vdq_lock) <= 0) {
+			mutex_exit(&vqp->vdq_lock);
+			vnd_dev_rele(vdp);
+			return (EINTR);
+		}
+	}
+	mutex_exit(&vqp->vdq_lock);
+
+	/*
+	 * Now that we've reserved the space, try to allocate kernel space for
+	 * and copy in the block. To take care of all this we use the
+	 * strmakedata subroutine for now.
+	 */
+	origsize = iosize = uiop->uio_resid;
+	error = strmakedata(&iosize, uiop, vdp->vdd_str->vns_wq->q_stream, 0,
+	    &mp);
+
+	/*
+	 * strmakedata() will return an error or it may only consume a portion
+	 * of the data.
+	 */
+	if (error != 0 || uiop->uio_resid != 0) {
+		vnd_dq_unreserve(vqp, origsize);
+		cv_broadcast(&vqp->vdq_ready);
+		pollwakeup(&vdp->vdd_ph, POLLOUT);
+		vnd_dev_rele(vdp);
+		return (ENOSR);
+	}
+
+	gsqueue_enter_one(vdp->vdd_str->vns_squeue, mp,
+	    vnd_squeue_tx_append, vdp->vdd_str, GSQUEUE_PROCESS,
+	    VND_SQUEUE_TAG_VND_WRITE);
+
+	vnd_dev_rele(vdp);
+	return (0);
+}
+
+static int
+vnd_chpoll(dev_t dev, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp)
+{
+	short ready = 0;
+	vnd_dev_t *vdp;
+	vnd_data_queue_t *vqp;
+
+	vdp = vnd_dev_lookup(getminor(dev));
+	if (vdp == NULL)
+		return (ENXIO);
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_ATTACHED)) {
+		mutex_exit(&vdp->vdd_lock);
+		vnd_dev_rele(vdp);
+		return (ENXIO);
+	}
+	mutex_exit(&vdp->vdd_lock);
+
+	if ((events & POLLIN) || (events & POLLRDNORM)) {
+		vqp = &vdp->vdd_str->vns_dq_read;
+		mutex_enter(&vqp->vdq_lock);
+		if (vqp->vdq_head != NULL)
+			ready |= events & (POLLIN | POLLRDNORM);
+		mutex_exit(&vqp->vdq_lock);
+	}
+
+	if (events & POLLOUT) {
+		vqp = &vdp->vdd_str->vns_dq_write;
+		mutex_enter(&vqp->vdq_lock);
+		if (vqp->vdq_cur != vqp->vdq_max)
+			ready |= POLLOUT;
+		mutex_exit(&vqp->vdq_lock);
+	}
+
+	if ((ready == 0 && !anyyet) || (events & POLLET)) {
+		*phpp = &vdp->vdd_ph;
+	}
+	*reventsp = ready;
+	vnd_dev_rele(vdp);
+	return (0);
+}
+
+/* ARGSUSED */
+static void *
+vnd_stack_init(netstackid_t stackid, netstack_t *ns)
+{
+	vnd_pnsd_t *nsp;
+
+	nsp = kmem_cache_alloc(vnd_pnsd_cache, KM_SLEEP);
+	bzero(nsp, sizeof (*nsp));
+	nsp->vpnd_nsid = stackid;
+	nsp->vpnd_zid = netstackid_to_zoneid(stackid);
+	nsp->vpnd_flags = 0;
+	mutex_init(&nsp->vpnd_lock, NULL, MUTEX_DRIVER, NULL);
+	list_create(&nsp->vpnd_dev_list, sizeof (vnd_dev_t),
+	    offsetof(vnd_dev_t, vdd_nslink));
+	if (vnd_netinfo_init(nsp) == 0)
+		nsp->vpnd_hooked = B_TRUE;
+
+	mutex_enter(&vnd_dev_lock);
+	list_insert_tail(&vnd_nsd_list, nsp);
+	mutex_exit(&vnd_dev_lock);
+
+	return (nsp);
+}
+
+/* ARGSUSED */
+static void
+vnd_stack_shutdown(netstackid_t stackid, void *arg)
+{
+	vnd_pnsd_t *nsp = arg;
+	vnd_dev_t *vdp;
+
+	ASSERT(nsp != NULL);
+	/*
+	 * After shut down no one should be able to find their way to this
+	 * netstack again.
+	 */
+	mutex_enter(&vnd_dev_lock);
+	list_remove(&vnd_nsd_list, nsp);
+	mutex_exit(&vnd_dev_lock);
+
+	/*
+	 * Make sure hooks know that they're going away.
+	 */
+	if (nsp->vpnd_hooked == B_TRUE)
+		vnd_netinfo_shutdown(nsp);
+
+	/*
+	 * Now we need to go through and notify each zone that they are in
+	 * teardown phase.  See the big theory statement section on vnd, zones,
+	 * netstacks, and sdev for more information about this.
+	 */
+	mutex_enter(&nsp->vpnd_lock);
+	nsp->vpnd_flags |= VND_NS_CONDEMNED;
+	for (vdp = list_head(&nsp->vpnd_dev_list); vdp != NULL;
+	    vdp = list_next(&nsp->vpnd_dev_list, vdp)) {
+		mutex_enter(&vdp->vdd_lock);
+		if (!(vdp->vdd_flags & VND_D_CONDEMNED))
+			vdp->vdd_flags |= VND_D_ZONE_DYING;
+		mutex_exit(&vdp->vdd_lock);
+	}
+	mutex_exit(&nsp->vpnd_lock);
+
+	/*
+	 * Next we remove all the links as we know nothing new can be added to
+	 * the list and that none of the extent devices can obtain additional
+	 * links.
+	 */
+restart:
+	mutex_enter(&nsp->vpnd_lock);
+	for (vdp = list_head(&nsp->vpnd_dev_list); vdp != NULL;
+	    vdp = list_next(&nsp->vpnd_dev_list, vdp)) {
+		mutex_enter(&vdp->vdd_lock);
+		if ((vdp->vdd_flags & VND_D_CONDEMNED) ||
+		    !(vdp->vdd_flags & VND_D_LINKED)) {
+			mutex_exit(&vdp->vdd_lock);
+			continue;
+		}
+
+		/*
+		 * We drop our lock here and restart afterwards. Note that as
+		 * part of unlinking we end up doing a rele of the vnd_dev_t. If
+		 * this is the final hold on the vnd_dev_t then it might try and
+		 * remove itself. Our locking rules requires not to be holding
+		 * any locks when we call any of the rele functions.
+		 *
+		 * Note that the unlink function requires holders to call into
+		 * it with the vnd_dev_t->vdd_lock held and will take care of it
+		 * for us. Because we don't have a hold on it, we're done at
+		 * this point.
+		 */
+		mutex_exit(&nsp->vpnd_lock);
+		/* Forcibly unlink */
+		vnd_dev_unlink(vdp);
+		goto restart;
+	}
+	mutex_exit(&nsp->vpnd_lock);
+}
+
+/* ARGSUSED */
+static void
+vnd_stack_destroy(netstackid_t stackid, void *arg)
+{
+	vnd_pnsd_t *nsp = arg;
+
+	ASSERT(nsp != NULL);
+
+	/*
+	 * Now that we've unlinked everything we just have to hang out for
+	 * it to finish exiting. Now that it's no longer the kernel itself
+	 * that's doing this we just need to wait for our reference count to
+	 * equal zero and then we're free. If the global zone is holding open a
+	 * reference to a vnd device for another zone, that's bad, but there's
+	 * nothing much we can do. See the section on 'vnd, zones, netstacks' in
+	 * the big theory statement for more information.
+	 */
+	mutex_enter(&nsp->vpnd_lock);
+	while (nsp->vpnd_ref != 0)
+		cv_wait(&nsp->vpnd_ref_change, &nsp->vpnd_lock);
+	mutex_exit(&nsp->vpnd_lock);
+
+	/*
+	 * During shutdown we removed ourselves from the list and now we have no
+	 * more references so we can safely say that there is nothing left and
+	 * destroy everything that we had sitting around.
+	 */
+	if (nsp->vpnd_hooked == B_TRUE)
+		vnd_netinfo_fini(nsp);
+
+	mutex_destroy(&nsp->vpnd_lock);
+	list_destroy(&nsp->vpnd_dev_list);
+	kmem_cache_free(vnd_pnsd_cache, nsp);
+}
+
+/*
+ * Convert a node with a name of the form /dev/vnd/zone/%zonename and
+ * /dev/vnd/zone/%zonename/%linkname to the corresponding vnd netstack.
+ */
+static vnd_pnsd_t *
+vnd_sdev_ctx_to_ns(sdev_ctx_t ctx)
+{
+	enum vtype vt;
+	const char *path = sdev_ctx_path(ctx);
+	char *zstart, *dup;
+	size_t duplen;
+	vnd_pnsd_t *nsp;
+
+	vt = sdev_ctx_vtype(ctx);
+	ASSERT(strncmp(path, VND_SDEV_ZROOT, strlen(VND_SDEV_ZROOT)) == 0);
+
+	if (vt == VDIR) {
+		zstart = strrchr(path, '/');
+		ASSERT(zstart != NULL);
+		zstart++;
+		return (vnd_nsd_lookup_by_zonename(zstart));
+	}
+
+	ASSERT(vt == VCHR);
+
+	dup = strdup(path);
+	duplen = strlen(dup) + 1;
+	zstart = strrchr(dup, '/');
+	*zstart = '\0';
+	zstart--;
+	zstart = strrchr(dup, '/');
+	zstart++;
+	nsp = vnd_nsd_lookup_by_zonename(zstart);
+	kmem_free(dup, duplen);
+
+	return (nsp);
+}
+
+static sdev_plugin_validate_t
+vnd_sdev_validate_dir(sdev_ctx_t ctx)
+{
+	vnd_pnsd_t *nsp;
+
+	if (strcmp(sdev_ctx_path(ctx), VND_SDEV_ROOT) == 0)
+		return (SDEV_VTOR_VALID);
+
+	if (strcmp(sdev_ctx_path(ctx), VND_SDEV_ZROOT) == 0) {
+		ASSERT(getzoneid() == GLOBAL_ZONEID);
+		ASSERT(sdev_ctx_flags(ctx) & SDEV_CTX_GLOBAL);
+		return (SDEV_VTOR_VALID);
+	}
+
+	nsp = vnd_sdev_ctx_to_ns(ctx);
+	if (nsp == NULL)
+		return (SDEV_VTOR_INVALID);
+	vnd_nsd_rele(nsp);
+
+	return (SDEV_VTOR_VALID);
+}
+
+static sdev_plugin_validate_t
+vnd_sdev_validate(sdev_ctx_t ctx)
+{
+	enum vtype vt;
+	vnd_dev_t *vdp;
+	minor_t minor;
+
+	vt = sdev_ctx_vtype(ctx);
+	if (vt == VDIR)
+		return (vnd_sdev_validate_dir(ctx));
+	ASSERT(vt == VCHR);
+
+	if (strcmp("ctl", sdev_ctx_name(ctx)) == 0)
+		return (SDEV_VTOR_VALID);
+
+	if (sdev_ctx_minor(ctx, &minor) != 0)
+		return (SDEV_VTOR_STALE);
+
+	vdp = vnd_dev_lookup(minor);
+	if (vdp == NULL)
+		return (SDEV_VTOR_STALE);
+
+	mutex_enter(&vdp->vdd_lock);
+	if (!(vdp->vdd_flags & VND_D_LINKED) ||
+	    (vdp->vdd_flags & (VND_D_CONDEMNED | VND_D_ZONE_DYING))) {
+		mutex_exit(&vdp->vdd_lock);
+		vnd_dev_rele(vdp);
+		return (SDEV_VTOR_STALE);
+	}
+
+	if (strcmp(sdev_ctx_name(ctx), vdp->vdd_lname) != 0) {
+		mutex_exit(&vdp->vdd_lock);
+		vnd_dev_rele(vdp);
+		return (SDEV_VTOR_STALE);
+	}
+
+	mutex_exit(&vdp->vdd_lock);
+	vnd_dev_rele(vdp);
+	return (SDEV_VTOR_VALID);
+}
+
+/*
+ * This function is a no-op. sdev never has holds on our devices as they can go
+ * away at any time and specfs has to deal with that fact.
+ */
+/* ARGSUSED */
+static void
+vnd_sdev_inactive(sdev_ctx_t ctx)
+{
+}
+
+static int
+vnd_sdev_fillzone(vnd_pnsd_t *nsp, sdev_ctx_t ctx)
+{
+	int ret;
+	vnd_dev_t *vdp;
+
+	mutex_enter(&nsp->vpnd_lock);
+	for (vdp = list_head(&nsp->vpnd_dev_list); vdp != NULL;
+	    vdp = list_next(&nsp->vpnd_dev_list, vdp)) {
+		mutex_enter(&vdp->vdd_lock);
+		if ((vdp->vdd_flags & VND_D_LINKED) &&
+		    !(vdp->vdd_flags & (VND_D_CONDEMNED | VND_D_ZONE_DYING))) {
+			ret = sdev_plugin_mknod(ctx, vdp->vdd_lname,
+			    VND_SDEV_MODE, vdp->vdd_devid);
+			if (ret != 0 && ret != EEXIST) {
+				mutex_exit(&vdp->vdd_lock);
+				mutex_exit(&nsp->vpnd_lock);
+				vnd_nsd_rele(nsp);
+				return (ret);
+			}
+		}
+		mutex_exit(&vdp->vdd_lock);
+	}
+	mutex_exit(&nsp->vpnd_lock);
+
+	return (0);
+}
+
+static int
+vnd_sdev_filldir_root(sdev_ctx_t ctx)
+{
+	zoneid_t zid;
+	vnd_pnsd_t *nsp;
+	int ret;
+
+	zid = getzoneid();
+	nsp = vnd_nsd_lookup(zoneid_to_netstackid(zid));
+	ASSERT(nsp != NULL);
+	ret = vnd_sdev_fillzone(nsp, ctx);
+	vnd_nsd_rele(nsp);
+	if (ret != 0)
+		return (ret);
+
+	/*
+	 * Checking the zone id is not sufficient as the global zone could be
+	 * reaching down into a non-global zone's mounted /dev.
+	 */
+	if (zid == GLOBAL_ZONEID && (sdev_ctx_flags(ctx) & SDEV_CTX_GLOBAL)) {
+		ret = sdev_plugin_mkdir(ctx, "zone");
+		if (ret != 0 && ret != EEXIST)
+			return (ret);
+	}
+
+	/*
+	 * Always add a reference to the control node. There's no need to
+	 * reference it since it always exists and is always what we clone from.
+	 */
+	ret = sdev_plugin_mknod(ctx, "ctl", VND_SDEV_MODE,
+	    makedevice(ddi_driver_major(vnd_dip), 0));
+	if (ret != 0 && ret != EEXIST)
+		return (ret);
+
+	return (0);
+}
+
+static int
+vnd_sdev_filldir_zroot(sdev_ctx_t ctx)
+{
+	int ret;
+	vnd_pnsd_t *nsp;
+	zone_t *zonep;
+
+	ASSERT(getzoneid() == GLOBAL_ZONEID);
+	ASSERT(sdev_ctx_flags(ctx) & SDEV_CTX_GLOBAL);
+
+	mutex_enter(&vnd_dev_lock);
+	for (nsp = list_head(&vnd_nsd_list); nsp != NULL;
+	    nsp = list_next(&vnd_nsd_list, nsp)) {
+		mutex_enter(&nsp->vpnd_lock);
+		if (list_is_empty(&nsp->vpnd_dev_list)) {
+			mutex_exit(&nsp->vpnd_lock);
+			continue;
+		}
+		mutex_exit(&nsp->vpnd_lock);
+		zonep = zone_find_by_id(nsp->vpnd_zid);
+		/*
+		 * This zone must be being torn down, so skip it.
+		 */
+		if (zonep == NULL)
+			continue;
+		ret = sdev_plugin_mkdir(ctx, zonep->zone_name);
+		zone_rele(zonep);
+		if (ret != 0 && ret != EEXIST) {
+			mutex_exit(&vnd_dev_lock);
+			return (ret);
+		}
+	}
+	mutex_exit(&vnd_dev_lock);
+	return (0);
+}
+
+static int
+vnd_sdev_filldir(sdev_ctx_t ctx)
+{
+	int ret;
+	vnd_pnsd_t *nsp;
+
+	ASSERT(sdev_ctx_vtype(ctx) == VDIR);
+	if (strcmp(VND_SDEV_ROOT, sdev_ctx_path(ctx)) == 0)
+		return (vnd_sdev_filldir_root(ctx));
+
+	if (strcmp(VND_SDEV_ZROOT, sdev_ctx_path(ctx)) == 0)
+		return (vnd_sdev_filldir_zroot(ctx));
+
+	ASSERT(strncmp(VND_SDEV_ZROOT, sdev_ctx_path(ctx),
+	    strlen(VND_SDEV_ZROOT)) == 0);
+	nsp = vnd_sdev_ctx_to_ns(ctx);
+	if (nsp == NULL)
+		return (0);
+
+	ret = vnd_sdev_fillzone(nsp, ctx);
+	vnd_nsd_rele(nsp);
+
+	return (ret);
+}
+
+static sdev_plugin_ops_t vnd_sdev_ops = {
+	SDEV_PLUGIN_VERSION,
+	SDEV_PLUGIN_SUBDIR,
+	vnd_sdev_validate,
+	vnd_sdev_filldir,
+	vnd_sdev_inactive
+};
+
+static int
+vnd_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	int errp = 0;
+
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	/*
+	 * Only allow one instance.
+	 */
+	if (vnd_dip != NULL)
+		return (DDI_FAILURE);
+
+	vnd_dip = dip;
+	if (ddi_create_minor_node(vnd_dip, "vnd", S_IFCHR, 0, DDI_PSEUDO, 0) !=
+	    DDI_SUCCESS) {
+		vnd_dip = NULL;
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_prop_create(DDI_DEV_T_NONE, dip, DDI_PROP_CANSLEEP,
+	    DDI_KERNEL_IOCTL, NULL, 0) != DDI_PROP_SUCCESS) {
+		ddi_remove_minor_node(vnd_dip, NULL);
+		vnd_dip = NULL;
+		return (DDI_FAILURE);
+	}
+
+	vnd_sdev_hdl = sdev_plugin_register(VND_SDEV_NAME, &vnd_sdev_ops,
+	    &errp);
+	if (vnd_sdev_hdl == NULL) {
+		ddi_remove_minor_node(vnd_dip, NULL);
+		ddi_prop_remove_all(vnd_dip);
+		vnd_dip = NULL;
+		return (DDI_FAILURE);
+	}
+
+	vnd_sqset = gsqueue_set_create(GSQUEUE_DEFAULT_PRIORITY);
+
+	return (DDI_SUCCESS);
+}
+
+/* ARGSUSED */
+static int
+vnd_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	mutex_enter(&vnd_dev_lock);
+	if (!list_is_empty(&vnd_dev_list)) {
+		mutex_exit(&vnd_dev_lock);
+		return (DDI_FAILURE);
+	}
+	mutex_exit(&vnd_dev_lock);
+
+	return (DDI_FAILURE);
+}
+
+/* ARGSUSED */
+static int
+vnd_info(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **result)
+{
+	int error;
+
+	switch (cmd) {
+	case DDI_INFO_DEVT2DEVINFO:
+		*result = (void *)vnd_dip;
+		error = DDI_SUCCESS;
+		break;
+	case DDI_INFO_DEVT2INSTANCE:
+		*result = (void *)0;
+		error = DDI_SUCCESS;
+		break;
+	default:
+		error = DDI_FAILURE;
+		break;
+	}
+	return (error);
+}
+
+
+
+static void
+vnd_ddi_fini(void)
+{
+	netstack_unregister(NS_VND);
+	if (vnd_taskq != NULL)
+		taskq_destroy(vnd_taskq);
+	if (vnd_str_cache != NULL)
+		kmem_cache_destroy(vnd_str_cache);
+	if (vnd_dev_cache != NULL)
+		kmem_cache_destroy(vnd_dev_cache);
+	if (vnd_pnsd_cache != NULL)
+		kmem_cache_destroy(vnd_pnsd_cache);
+	if (vnd_minors != NULL)
+		id_space_destroy(vnd_minors);
+	if (vnd_list_init != 0) {
+		list_destroy(&vnd_nsd_list);
+		list_destroy(&vnd_dev_list);
+		mutex_destroy(&vnd_dev_lock);
+		vnd_list_init = 0;
+	}
+	frameio_fini();
+}
+
+static int
+vnd_ddi_init(void)
+{
+	if (frameio_init() != 0)
+		return (DDI_FAILURE);
+
+	vnd_str_cache = kmem_cache_create("vnd_str_cache", sizeof (vnd_str_t),
+	    0, NULL, NULL, NULL, NULL, NULL, 0);
+	if (vnd_str_cache == NULL) {
+		frameio_fini();
+		return (DDI_FAILURE);
+	}
+	vnd_dev_cache = kmem_cache_create("vnd_dev_cache", sizeof (vnd_dev_t),
+	    0, NULL, NULL, NULL, NULL, NULL, 0);
+	if (vnd_dev_cache == NULL) {
+		kmem_cache_destroy(vnd_str_cache);
+		frameio_fini();
+		return (DDI_FAILURE);
+	}
+	vnd_pnsd_cache = kmem_cache_create("vnd_pnsd_cache",
+	    sizeof (vnd_pnsd_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
+	if (vnd_pnsd_cache == NULL) {
+		kmem_cache_destroy(vnd_dev_cache);
+		kmem_cache_destroy(vnd_str_cache);
+		frameio_fini();
+		return (DDI_FAILURE);
+	}
+
+	vnd_taskq = taskq_create_instance("vnd", -1, 1, minclsyspri, 0, 0, 0);
+	if (vnd_taskq == NULL) {
+		kmem_cache_destroy(vnd_pnsd_cache);
+		kmem_cache_destroy(vnd_dev_cache);
+		kmem_cache_destroy(vnd_str_cache);
+		frameio_fini();
+		return (DDI_FAILURE);
+	}
+
+	vnd_minors = id_space_create("vnd_minors", 1, INT32_MAX);
+	if (vnd_minors == NULL) {
+		taskq_destroy(vnd_taskq);
+		kmem_cache_destroy(vnd_pnsd_cache);
+		kmem_cache_destroy(vnd_dev_cache);
+		kmem_cache_destroy(vnd_str_cache);
+		frameio_fini();
+		return (DDI_FAILURE);
+	}
+
+	mutex_init(&vnd_dev_lock, NULL, MUTEX_DRIVER, NULL);
+	list_create(&vnd_dev_list, sizeof (vnd_dev_t),
+	    offsetof(vnd_dev_t, vdd_link));
+	list_create(&vnd_nsd_list, sizeof (vnd_pnsd_t),
+	    offsetof(vnd_pnsd_t, vpnd_link));
+	vnd_list_init = 1;
+
+	netstack_register(NS_VND, vnd_stack_init, vnd_stack_shutdown,
+	    vnd_stack_destroy);
+
+	return (DDI_SUCCESS);
+}
+
+static struct module_info vnd_minfo = {
+	0,		/* module id */
+	"vnd",		/* module name */
+	1,		/* smallest packet size */
+	INFPSZ,		/* largest packet size (infinite) */
+	1,		/* high watermark */
+	0		/* low watermark */
+};
+
+static struct qinit vnd_r_qinit = {
+	vnd_s_rput,
+	NULL,
+	vnd_s_open,
+	vnd_s_close,
+	NULL,
+	&vnd_minfo,
+	NULL
+};
+
+static struct qinit vnd_w_qinit = {
+	vnd_s_wput,
+	NULL,
+	NULL,
+	NULL,
+	NULL,
+	&vnd_minfo,
+	NULL
+};
+
+static struct streamtab vnd_strtab = {
+	&vnd_r_qinit,
+	&vnd_w_qinit,
+	NULL,
+	NULL
+};
+
+
+static struct cb_ops vnd_cb_ops = {
+	vnd_open,		/* open */
+	vnd_close,		/* close */
+	nulldev,		/* strategy */
+	nulldev,		/* print */
+	nodev,			/* dump */
+	vnd_read,		/* read */
+	vnd_write,		/* write */
+	vnd_ioctl,		/* ioctl */
+	nodev,			/* devmap */
+	nodev,			/* mmap */
+	nodev,			/* segmap */
+	vnd_chpoll,		/* poll */
+	ddi_prop_op,		/* cb_prop_op */
+	NULL,			/* streamtab  */
+	D_MP			/* Driver compatibility flag */
+};
+
+static struct dev_ops vnd_dev_ops = {
+	DEVO_REV,		/* devo_rev */
+	0,			/* refcnt */
+	vnd_info,		/* get_dev_info */
+	nulldev,		/* identify */
+	nulldev,		/* probe */
+	vnd_attach,		/* attach */
+	vnd_detach,		/* detach */
+	nodev,			/* reset */
+	&vnd_cb_ops,		/* driver operations */
+	NULL,			/* bus operations */
+	nodev,			/* dev power */
+	ddi_quiesce_not_needed	/* quiesce */
+};
+
+static struct modldrv vnd_modldrv = {
+	&mod_driverops,
+	"Virtual Networking Datapath Driver",
+	&vnd_dev_ops
+};
+
+static struct fmodsw vnd_fmodfsw = {
+	"vnd",
+	&vnd_strtab,
+	D_NEW | D_MP
+};
+
+static struct modlstrmod vnd_modlstrmod = {
+	&mod_strmodops,
+	"Virtual Networking Datapath Driver",
+	&vnd_fmodfsw
+};
+
+static struct modlinkage vnd_modlinkage = {
+	MODREV_1,
+	&vnd_modldrv,
+	&vnd_modlstrmod,
+	NULL
+};
+
+int
+_init(void)
+{
+	int error;
+
+	/*
+	 * We need to do all of our global initialization in init as opposed to
+	 * attach and detach. The problem here is that because vnd can be used
+	 * from a stream context while being detached, we can not rely on having
+	 * run attach to create everything, alas. so it goes in _init, just like
+	 * our friend ip.
+	 */
+	if ((error = vnd_ddi_init()) != DDI_SUCCESS)
+		return (error);
+	error = mod_install((&vnd_modlinkage));
+	if (error != 0)
+		vnd_ddi_fini();
+	return (error);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&vnd_modlinkage, modinfop));
+}
+
+int
+_fini(void)
+{
+	int error;
+
+	error = mod_remove(&vnd_modlinkage);
+	if (error == 0)
+		vnd_ddi_fini();
+	return (error);
+}
diff --git a/usr/src/uts/common/io/vnd/vnd.conf b/usr/src/uts/common/io/vnd/vnd.conf
new file mode 100644
index 0000000000..65872e1ddf
--- /dev/null
+++ b/usr/src/uts/common/io/vnd/vnd.conf
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+#
+
+name="vnd" parent="pseudo" instance=0;
diff --git a/usr/src/uts/common/io/vnic/vnic_dev.c b/usr/src/uts/common/io/vnic/vnic_dev.c
index d671153967..57c02b0808 100644
--- a/usr/src/uts/common/io/vnic/vnic_dev.c
+++ b/usr/src/uts/common/io/vnic/vnic_dev.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
  */
 
@@ -354,7 +354,7 @@ vnic_dev_create(datalink_id_t vnic_id, datalink_id_t linkid,
 
 	rw_enter(&vnic_lock, RW_WRITER);
 
-	/* does a VNIC with the same id already exist? */
+	/* Does a VNIC with the same id already exist? */
 	err = mod_hash_find(vnic_hash, VNIC_HASH_KEY(vnic_id),
 	    (mod_hash_val_t *)&vnic);
 	if (err == 0) {
@@ -370,6 +370,7 @@ vnic_dev_create(datalink_id_t vnic_id, datalink_id_t linkid,
 
 	bzero(vnic, sizeof (*vnic));
 
+	vnic->vn_ls = LINK_STATE_UNKNOWN;
 	vnic->vn_id = vnic_id;
 	vnic->vn_link_id = linkid;
 	vnic->vn_vrid = vrid;
@@ -580,11 +581,12 @@ vnic_dev_create(datalink_id_t vnic_id, datalink_id_t linkid,
 	vnic->vn_enabled = B_TRUE;
 
 	if (is_anchor) {
-		mac_link_update(vnic->vn_mh, LINK_STATE_UP);
+		vnic->vn_ls = LINK_STATE_UP;
 	} else {
-		mac_link_update(vnic->vn_mh,
-		    mac_client_stat_get(vnic->vn_mch, MAC_STAT_LINK_STATE));
+		vnic->vn_ls = mac_client_stat_get(vnic->vn_mch,
+		    MAC_STAT_LINK_STATE);
 	}
+	mac_link_update(vnic->vn_mh, vnic->vn_ls);
 
 	rw_exit(&vnic_lock);
 
@@ -1092,6 +1094,34 @@ vnic_m_setprop(void *m_driver, const char *pr_name, mac_prop_id_t pr_num,
 		err = vnic_set_secondary_macs(vn, &msa);
 		break;
 	}
+	case MAC_PROP_PRIVATE: {
+		long val, i;
+		const char *v;
+
+		if (vn->vn_link_id != DATALINK_INVALID_LINKID ||
+		    strcmp(pr_name, "_linkstate") != 0) {
+			err = ENOTSUP;
+			break;
+		}
+
+		for (v = pr_val, i = 0; i < pr_valsize; i++, v++) {
+			if (*v == '\0')
+				break;
+		}
+		if (i == pr_valsize) {
+			err = EINVAL;
+			break;
+		}
+
+		(void) ddi_strtol(pr_val, (char **)NULL, 0, &val);
+		if (val != LINK_STATE_UP && val != LINK_STATE_DOWN) {
+			err = EINVAL;
+			break;
+		}
+		vn->vn_ls = val;
+		mac_link_update(vn->vn_mh, vn->vn_ls);
+		break;
+	}
 	default:
 		err = ENOTSUP;
 		break;
@@ -1117,6 +1147,18 @@ vnic_m_getprop(void *arg, const char *pr_name, mac_prop_id_t pr_num,
 	case MAC_PROP_SECONDARY_ADDRS:
 		ret = vnic_get_secondary_macs(vn, pr_valsize, pr_val);
 		break;
+	case MAC_PROP_PRIVATE:
+		if (vn->vn_link_id != DATALINK_INVALID_LINKID) {
+			ret = EINVAL;
+			break;
+		}
+
+		if (strcmp(pr_name, "_linkstate") != 0) {
+			ret = EINVAL;
+			break;
+		}
+		(void) snprintf(pr_val, pr_valsize, "%d", vn->vn_ls);
+		break;
 	default:
 		ret = ENOTSUP;
 		break;
@@ -1126,7 +1168,8 @@ vnic_m_getprop(void *arg, const char *pr_name, mac_prop_id_t pr_num,
 }
 
 /* ARGSUSED */
-static void vnic_m_propinfo(void *m_driver, const char *pr_name,
+static void
+vnic_m_propinfo(void *m_driver, const char *pr_name,
     mac_prop_id_t pr_num, mac_prop_info_handle_t prh)
 {
 	vnic_t		*vn = m_driver;
@@ -1169,6 +1212,18 @@ static void vnic_m_propinfo(void *m_driver, const char *pr_name,
 			mac_perim_exit(mph);
 		}
 		break;
+	case MAC_PROP_PRIVATE:
+		if (vn->vn_link_id != DATALINK_INVALID_LINKID)
+			break;
+
+		if (strcmp(pr_name, "_linkstate") == 0) {
+			char buf[16];
+
+			mac_prop_info_set_perm(prh, MAC_PROP_PERM_RW);
+			(void) snprintf(buf, sizeof (buf), "%d", vn->vn_ls);
+			mac_prop_info_set_default_str(prh, buf);
+		}
+		break;
 	}
 }
 
@@ -1241,8 +1296,9 @@ vnic_notify_cb(void *arg, mac_notify_type_t type)
 		break;
 
 	case MAC_NOTE_LINK:
-		mac_link_update(vnic->vn_mh,
-		    mac_client_stat_get(vnic->vn_mch, MAC_STAT_LINK_STATE));
+		vnic->vn_ls = mac_client_stat_get(vnic->vn_mch,
+		    MAC_STAT_LINK_STATE);
+		mac_link_update(vnic->vn_mh, vnic->vn_ls);
 		break;
 
 	default:
diff --git a/usr/src/uts/common/io/zfd.c b/usr/src/uts/common/io/zfd.c
new file mode 100644
index 0000000000..2da310ab8d
--- /dev/null
+++ b/usr/src/uts/common/io/zfd.c
@@ -0,0 +1,1154 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Zone File Descriptor Driver.
+ *
+ * This driver is derived from the zcons driver which is in turn derived from
+ * the pts/ptm drivers. The purpose is to expose file descriptors within the
+ * zone which are connected to zoneadmd and used for logging or an interactive
+ * connection to a process within the zone.
+ *
+ * Its implementation is straightforward. Each instance of the driver
+ * represents a global-zone/local-zone pair. Unlike the zcons device, zoneadmd
+ * uses these devices unidirectionally to provide stdin, stdout and stderr to
+ * the process within the zone.
+ *
+ * Instances of zfd are onlined as children of /pseudo/zfdnex@2/ by zoneadmd,
+ * using the devctl framework; thus the driver does not need to maintain any
+ * sort of "admin" node.
+ *
+ * The driver shuttles I/O from master side to slave side and back.  In a break
+ * from the pts/ptm semantics, if one side is not open, I/O directed towards
+ * it will simply be discarded. This is so that if zoneadmd is not holding the
+ * master side fd open (i.e. it has died somehow), processes in the zone do not
+ * experience any errors and I/O to the fd does not cause the process to hang.
+ *
+ * The driver can also act as a multiplexer so that data written to the
+ * slave side within the zone is also redirected back to another zfd device
+ * inside the zone for consumption (i.e. it can be read). The intention is
+ * that a logging process within the zone can consume data that is being
+ * written by an application onto the primary stream. This is essentially
+ * a tee off of the primary stream into a log stream. This tee can also be
+ * configured to be flow controlled via an ioctl. Flow control happens on the
+ * primary stream and is used to ensure that the log stream receives all of
+ * the messages off the primary stream when consumption of the data off of
+ * the log stream gets behind. Configuring for flow control implies that the
+ * application writing to the primary stream will be blocked when the log
+ * consumer gets behind. Note that closing the log stream (e.g. when the zone
+ * halts) will cause the loss of all messages queued in the stream.
+ *
+ * The zone's zfd device configuration is driven by zoneadmd and a zone mode.
+ * The mode, which is controlled by the zone attribute "zlog-mode" is somewhat
+ * of a misnomer since its purpose has evolved. The attribute can have a
+ * variety of values, but the lowest two positions are used to control how many
+ * zfd devices are created inside the zone and if the primary stream is a tty.
+ *
+ * Here is a summary of how the 4 modes control what zfd devices are created
+ * and how they're used:
+ *
+ *    t-:  1 stdio zdev  (0) configured as a tty
+ *    --:  3 stdio zdevs (0, 1, 2), not configured as a tty
+ *    tn:  1 stdio zdev  (0) configured as a tty, 1 additional zdev (1)
+ *    -n:  3 stdio zdevs (0, 1, 2), not tty, 2 additional zdevs (3, 4)
+ *
+ * With the 't' flag set, stdin/out/err is multiplexed onto a single full-duplex
+ * stream which is configured as a tty. That is, ptem, ldterm and ttycompat are
+ * autopushed onto the stream when the slave side is opened. There is only a
+ * single zfd dev (0) needed for the primary stream.
+ *
+ * When the 'n' flag is set, it is assumed that output logging will be done
+ * within the zone itself. In this configuration 1 or 2 additional zfd devices,
+ * depending on tty mode ('t' flag) are created within the zone. An application
+ * can then configure the zfd streams driver into a multiplexer. Output from
+ * the stdout/stderr zfd(s) will be teed into the correspond logging zfd(s)
+ * within the zone.
+ *
+ * The following is a diagram of how this works for a '-n' configuration:
+ *
+ *
+ *              zoneadmd (for zlogin -I stdout)
+ * GZ:             ^
+ *                 |
+ *     --------------------------
+ *                 ^
+ * NGZ:            |
+ *      app >1 -> zfd1 -> zfd3 -> logger (for logger to consume app's stdout)
+ *
+ * There would be a similar path for the app's stderr into zfd4 for the logger
+ * to consume stderr.
+ */
+
+#include <sys/types.h>
+#include <sys/cmn_err.h>
+#include <sys/conf.h>
+#include <sys/cred.h>
+#include <sys/ddi.h>
+#include <sys/debug.h>
+#include <sys/devops.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/kstr.h>
+#include <sys/modctl.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/stream.h>
+#include <sys/stropts.h>
+#include <sys/strsun.h>
+#include <sys/sunddi.h>
+#include <sys/sysmacros.h>
+#include <sys/systm.h>
+#include <sys/types.h>
+#include <sys/zfd.h>
+#include <sys/vnode.h>
+#include <sys/fs/snode.h>
+#include <sys/zone.h>
+#include <sys/sdt.h>
+
+static kmutex_t zfd_mux_lock;
+
+static int zfd_getinfo(dev_info_t *, ddi_info_cmd_t, void *, void **);
+static int zfd_attach(dev_info_t *, ddi_attach_cmd_t);
+static int zfd_detach(dev_info_t *, ddi_detach_cmd_t);
+
+static int zfd_open(queue_t *, dev_t *, int, int, cred_t *);
+static int zfd_close(queue_t *, int, cred_t *);
+static void zfd_wput(queue_t *, mblk_t *);
+static void zfd_rsrv(queue_t *);
+static void zfd_wsrv(queue_t *);
+
+/*
+ * The instance number is encoded in the dev_t in the minor number; the lowest
+ * bit of the minor number is used to track the master vs. slave side of the
+ * fd. The rest of the bits in the minor number are the instance.
+ */
+#define	ZFD_MASTER_MINOR		0
+#define	ZFD_SLAVE_MINOR		1
+
+#define	ZFD_INSTANCE(x)		(getminor((x)) >> 1)
+#define	ZFD_NODE(x)		(getminor((x)) & 0x01)
+
+/*
+ * This macro converts a zfd_state_t pointer to the associated slave minor
+ * node's dev_t.
+ */
+#define	ZFD_STATE_TO_SLAVEDEV(x)	\
+	(makedevice(ddi_driver_major((x)->zfd_devinfo), \
+	(minor_t)(ddi_get_instance((x)->zfd_devinfo) << 1 | ZFD_SLAVE_MINOR)))
+
+int zfd_debug = 0;
+#define	DBG(a)		if (zfd_debug) cmn_err(CE_NOTE, a)
+#define	DBG1(a, b)	if (zfd_debug) cmn_err(CE_NOTE, a, b)
+
+/*
+ * ZFD Pseudo Terminal Module: stream data structure definitions,
+ * based on zcons.
+ */
+static struct module_info zfd_info = {
+	0x20FD,	/* ZOFD - 8445 */
+	"zfd",
+	0,		/* min packet size */
+	INFPSZ,		/* max packet size - infinity */
+	2048,		/* high water */
+	128		/* low water */
+};
+
+static struct qinit zfd_rinit = {
+	NULL,
+	(int (*)()) zfd_rsrv,
+	zfd_open,
+	zfd_close,
+	NULL,
+	&zfd_info,
+	NULL
+};
+
+static struct qinit zfd_winit = {
+	(int (*)()) zfd_wput,
+	(int (*)()) zfd_wsrv,
+	NULL,
+	NULL,
+	NULL,
+	&zfd_info,
+	NULL
+};
+
+static struct streamtab zfd_tab_info = {
+	&zfd_rinit,
+	&zfd_winit,
+	NULL,
+	NULL
+};
+
+#define	ZFD_CONF_FLAG	(D_MP | D_MTQPAIR | D_MTOUTPERIM | D_MTOCEXCL)
+
+/*
+ * this will define (struct cb_ops cb_zfd_ops) and (struct dev_ops zfd_ops)
+ */
+DDI_DEFINE_STREAM_OPS(zfd_ops, nulldev, nulldev, zfd_attach, zfd_detach, \
+	nodev, zfd_getinfo, ZFD_CONF_FLAG, &zfd_tab_info, \
+	ddi_quiesce_not_needed);
+
+/*
+ * Module linkage information for the kernel.
+ */
+
+static struct modldrv modldrv = {
+	&mod_driverops, 	/* Type of module (this is a pseudo driver) */
+	"Zone FD driver",	/* description of module */
+	&zfd_ops		/* driver ops */
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,
+	&modldrv,
+	NULL
+};
+
+typedef enum {
+	ZFD_NO_MUX,
+	ZFD_PRIMARY_STREAM,
+	ZFD_LOG_STREAM
+} zfd_mux_type_t;
+
+typedef struct zfd_state {
+	dev_info_t *zfd_devinfo;	/* instance info */
+	queue_t *zfd_master_rdq;	/* GZ read queue */
+	queue_t *zfd_slave_rdq;		/* in-zone read queue */
+	int zfd_state;			/* ZFD_STATE_MOPEN, ZFD_STATE_SOPEN */
+	int zfd_tty;			/* ZFD_MAKETTY - strm mods will push */
+	boolean_t zfd_is_flowcon;	/* primary stream flow stopped */
+	boolean_t zfd_allow_flowcon;	/* use flow control */
+	zfd_mux_type_t zfd_muxt;	/* state type: none, primary, log */
+	struct zfd_state *zfd_inst_pri; /* log state's primary ptr */
+	struct zfd_state *zfd_inst_log;	/* primary state's log ptr */
+} zfd_state_t;
+
+#define	ZFD_STATE_MOPEN	0x01
+#define	ZFD_STATE_SOPEN	0x02
+
+static void *zfd_soft_state;
+
+/*
+ * List of STREAMS modules that are autopushed onto a slave instance when its
+ * opened, but only if the ZFD_MAKETTY ioctl has first been received by the
+ * master.
+ */
+static char *zfd_mods[] = {
+	"ptem",
+	"ldterm",
+	"ttcompat",
+	NULL
+};
+
+int
+_init(void)
+{
+	int err;
+
+	if ((err = ddi_soft_state_init(&zfd_soft_state, sizeof (zfd_state_t),
+	    0)) != 0) {
+		return (err);
+	}
+
+	if ((err = mod_install(&modlinkage)) != 0)
+		ddi_soft_state_fini(zfd_soft_state);
+
+	mutex_init(&zfd_mux_lock, NULL, MUTEX_DEFAULT, NULL);
+	return (err);
+}
+
+
+int
+_fini(void)
+{
+	int err;
+
+	if ((err = mod_remove(&modlinkage)) != 0) {
+		return (err);
+	}
+
+	ddi_soft_state_fini(&zfd_soft_state);
+	mutex_destroy(&zfd_mux_lock);
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+static int
+zfd_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	zfd_state_t *zfds;
+	int instance;
+	char masternm[ZFD_NAME_LEN], slavenm[ZFD_NAME_LEN];
+
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	instance = ddi_get_instance(dip);
+	if (ddi_soft_state_zalloc(zfd_soft_state, instance) != DDI_SUCCESS)
+		return (DDI_FAILURE);
+
+	(void) snprintf(masternm, sizeof (masternm), "%s%d", ZFD_MASTER_NAME,
+	    instance);
+	(void) snprintf(slavenm, sizeof (slavenm), "%s%d", ZFD_SLAVE_NAME,
+	    instance);
+
+	/*
+	 * Create the master and slave minor nodes.
+	 */
+	if ((ddi_create_minor_node(dip, slavenm, S_IFCHR,
+	    instance << 1 | ZFD_SLAVE_MINOR, DDI_PSEUDO, 0) == DDI_FAILURE) ||
+	    (ddi_create_minor_node(dip, masternm, S_IFCHR,
+	    instance << 1 | ZFD_MASTER_MINOR, DDI_PSEUDO, 0) == DDI_FAILURE)) {
+		ddi_remove_minor_node(dip, NULL);
+		ddi_soft_state_free(zfd_soft_state, instance);
+		return (DDI_FAILURE);
+	}
+
+	VERIFY((zfds = ddi_get_soft_state(zfd_soft_state, instance)) != NULL);
+	zfds->zfd_devinfo = dip;
+	zfds->zfd_tty = 0;
+	zfds->zfd_muxt = ZFD_NO_MUX;
+	zfds->zfd_inst_log = NULL;
+	return (DDI_SUCCESS);
+}
+
+static int
+zfd_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	zfd_state_t *zfds;
+	int instance;
+
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	instance = ddi_get_instance(dip);
+	if ((zfds = ddi_get_soft_state(zfd_soft_state, instance)) == NULL)
+		return (DDI_FAILURE);
+
+	if ((zfds->zfd_state & ZFD_STATE_MOPEN) ||
+	    (zfds->zfd_state & ZFD_STATE_SOPEN)) {
+		DBG1("zfd_detach: device (dip=%p) still open\n", (void *)dip);
+		return (DDI_FAILURE);
+	}
+
+	ddi_remove_minor_node(dip, NULL);
+	ddi_soft_state_free(zfd_soft_state, instance);
+
+	return (DDI_SUCCESS);
+}
+
+/*
+ * zfd_getinfo()
+ *	getinfo(9e) entrypoint.
+ */
+/*ARGSUSED*/
+static int
+zfd_getinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
+{
+	zfd_state_t *zfds;
+	int instance = ZFD_INSTANCE((dev_t)arg);
+
+	switch (infocmd) {
+	case DDI_INFO_DEVT2DEVINFO:
+		if ((zfds = ddi_get_soft_state(zfd_soft_state,
+		    instance)) == NULL)
+			return (DDI_FAILURE);
+		*result = zfds->zfd_devinfo;
+		return (DDI_SUCCESS);
+	case DDI_INFO_DEVT2INSTANCE:
+		*result = (void *)(uintptr_t)instance;
+		return (DDI_SUCCESS);
+	}
+	return (DDI_FAILURE);
+}
+
+/*
+ * Return the equivalent queue from the other side of the relationship.
+ * e.g.: given the slave's write queue, return the master's write queue.
+ */
+static queue_t *
+zfd_switch(queue_t *qp)
+{
+	zfd_state_t *zfds = qp->q_ptr;
+	ASSERT(zfds != NULL);
+
+	if (qp == zfds->zfd_master_rdq)
+		return (zfds->zfd_slave_rdq);
+	else if (OTHERQ(qp) == zfds->zfd_master_rdq && zfds->zfd_slave_rdq
+	    != NULL)
+		return (OTHERQ(zfds->zfd_slave_rdq));
+	else if (qp == zfds->zfd_slave_rdq)
+		return (zfds->zfd_master_rdq);
+	else if (OTHERQ(qp) == zfds->zfd_slave_rdq && zfds->zfd_master_rdq
+	    != NULL)
+		return (OTHERQ(zfds->zfd_master_rdq));
+	else
+		return (NULL);
+}
+
+/*
+ * For debugging and outputting messages.  Returns the name of the side of
+ * the relationship associated with this queue.
+ */
+static const char *
+zfd_side(queue_t *qp)
+{
+	zfd_state_t *zfds = qp->q_ptr;
+	ASSERT(zfds != NULL);
+
+	if (qp == zfds->zfd_master_rdq ||
+	    OTHERQ(qp) == zfds->zfd_master_rdq) {
+		return ("master");
+	}
+	ASSERT(qp == zfds->zfd_slave_rdq || OTHERQ(qp) == zfds->zfd_slave_rdq);
+	return ("slave");
+}
+
+/*ARGSUSED*/
+static int
+zfd_master_open(zfd_state_t *zfds,
+    queue_t	*rqp,	/* pointer to the read side queue */
+    dev_t	*devp,	/* pointer to stream tail's dev */
+    int		oflag,	/* the user open(2) supplied flags */
+    int		sflag,	/* open state flag */
+    cred_t	*credp)	/* credentials */
+{
+	mblk_t *mop;
+	struct stroptions *sop;
+
+	/*
+	 * Enforce exclusivity on the master side; the only consumer should
+	 * be the zoneadmd for the zone.
+	 */
+	if ((zfds->zfd_state & ZFD_STATE_MOPEN) != 0)
+		return (EBUSY);
+
+	if ((mop = allocb(sizeof (struct stroptions), BPRI_MED)) == NULL) {
+		DBG("zfd_master_open(): mop allocation failed\n");
+		return (ENOMEM);
+	}
+
+	zfds->zfd_state |= ZFD_STATE_MOPEN;
+
+	/*
+	 * q_ptr stores driver private data; stash the soft state data on both
+	 * read and write sides of the queue.
+	 */
+	WR(rqp)->q_ptr = rqp->q_ptr = zfds;
+	qprocson(rqp);
+
+	/*
+	 * Following qprocson(), the master side is fully plumbed into the
+	 * STREAM and may send/receive messages.  Setting zfds->zfd_master_rdq
+	 * will allow the slave to send messages to us (the master).
+	 * This cannot occur before qprocson() because the master is not
+	 * ready to process them until that point.
+	 */
+	zfds->zfd_master_rdq = rqp;
+
+	/*
+	 * set up hi/lo water marks on stream head read queue and add
+	 * controlling tty as needed.
+	 */
+	mop->b_datap->db_type = M_SETOPTS;
+	mop->b_wptr += sizeof (struct stroptions);
+	sop = (struct stroptions *)(void *)mop->b_rptr;
+	if (oflag & FNOCTTY)
+		sop->so_flags = SO_HIWAT | SO_LOWAT;
+	else
+		sop->so_flags = SO_HIWAT | SO_LOWAT | SO_ISTTY;
+	sop->so_hiwat = 512;
+	sop->so_lowat = 256;
+	putnext(rqp, mop);
+
+	return (0);
+}
+
+/*ARGSUSED*/
+static int
+zfd_slave_open(zfd_state_t *zfds,
+    queue_t	*rqp,	/* pointer to the read side queue */
+    dev_t	*devp,	/* pointer to stream tail's dev */
+    int		oflag,	/* the user open(2) supplied flags */
+    int		sflag,	/* open state flag */
+    cred_t	*credp)	/* credentials */
+{
+	mblk_t *mop;
+	struct stroptions *sop;
+	/*
+	 * The slave side can be opened as many times as needed.
+	 */
+	if ((zfds->zfd_state & ZFD_STATE_SOPEN) != 0) {
+		ASSERT((rqp != NULL) && (WR(rqp)->q_ptr == zfds));
+		return (0);
+	}
+
+	/* A log stream is read-only */
+	if (zfds->zfd_muxt == ZFD_LOG_STREAM &&
+	    (oflag & (FREAD | FWRITE)) != FREAD)
+		return (EINVAL);
+
+	if (zfds->zfd_tty == 1) {
+		major_t major;
+		minor_t minor;
+		minor_t lastminor;
+		uint_t anchorindex;
+
+		/*
+		 * Set up sad(7D) so that the necessary STREAMS modules will
+		 * be in place.  A wrinkle is that 'ptem' must be anchored
+		 * in place (see streamio(7i)) because we always want the
+		 * fd to have terminal semantics.
+		 */
+		minor =
+		    ddi_get_instance(zfds->zfd_devinfo) << 1 | ZFD_SLAVE_MINOR;
+		major = ddi_driver_major(zfds->zfd_devinfo);
+		lastminor = 0;
+		anchorindex = 1;
+		if (kstr_autopush(SET_AUTOPUSH, &major, &minor, &lastminor,
+		    &anchorindex, zfd_mods) != 0) {
+			DBG("zfd_slave_open(): kstr_autopush() failed\n");
+			return (EIO);
+		}
+	}
+
+	if ((mop = allocb(sizeof (struct stroptions), BPRI_MED)) == NULL) {
+		DBG("zfd_slave_open(): mop allocation failed\n");
+		return (ENOMEM);
+	}
+
+	zfds->zfd_state |= ZFD_STATE_SOPEN;
+
+	/*
+	 * q_ptr stores driver private data; stash the soft state data on both
+	 * read and write sides of the queue.
+	 */
+	WR(rqp)->q_ptr = rqp->q_ptr = zfds;
+
+	qprocson(rqp);
+
+	/*
+	 * Must follow qprocson(), since we aren't ready to process until then.
+	 */
+	zfds->zfd_slave_rdq = rqp;
+
+	/*
+	 * set up hi/lo water marks on stream head read queue and add
+	 * controlling tty as needed.
+	 */
+	mop->b_datap->db_type = M_SETOPTS;
+	mop->b_wptr += sizeof (struct stroptions);
+	sop = (struct stroptions *)(void *)mop->b_rptr;
+	sop->so_flags = SO_HIWAT | SO_LOWAT | SO_ISTTY;
+	sop->so_hiwat = 512;
+	sop->so_lowat = 256;
+	putnext(rqp, mop);
+
+	return (0);
+}
+
+/*
+ * open(9e) entrypoint; checks sflag, and rejects anything unordinary.
+ */
+static int
+zfd_open(queue_t *rqp,		/* pointer to the read side queue */
+	dev_t   *devp,		/* pointer to stream tail's dev */
+	int	oflag,		/* the user open(2) supplied flags */
+	int	sflag,		/* open state flag */
+	cred_t  *credp)		/* credentials */
+{
+	int instance = ZFD_INSTANCE(*devp);
+	int ret;
+	zfd_state_t *zfds;
+
+	if (sflag != 0)
+		return (EINVAL);
+
+	if ((zfds = ddi_get_soft_state(zfd_soft_state, instance)) == NULL)
+		return (ENXIO);
+
+	switch (ZFD_NODE(*devp)) {
+	case ZFD_MASTER_MINOR:
+		ret = zfd_master_open(zfds, rqp, devp, oflag, sflag, credp);
+		break;
+	case ZFD_SLAVE_MINOR:
+		ret = zfd_slave_open(zfds, rqp, devp, oflag, sflag, credp);
+		/*
+		 * If we just opened the log stream and flow control has
+		 * been enabled, we want to make sure the primary stream can
+		 * start flowing.
+		 */
+		if (ret == 0 && zfds->zfd_muxt == ZFD_LOG_STREAM &&
+		    zfds->zfd_inst_pri->zfd_allow_flowcon) {
+			zfds->zfd_inst_pri->zfd_is_flowcon = B_FALSE;
+			if (zfds->zfd_inst_pri->zfd_master_rdq != NULL)
+				qenable(RD(zfds->zfd_inst_pri->zfd_master_rdq));
+		}
+		break;
+	default:
+		ret = ENXIO;
+		break;
+	}
+
+	return (ret);
+}
+
+/*
+ * close(9e) entrypoint.
+ */
+/*ARGSUSED1*/
+static int
+zfd_close(queue_t *rqp, int flag, cred_t *credp)
+{
+	queue_t *wqp;
+	mblk_t	*bp;
+	zfd_state_t *zfds;
+	major_t major;
+	minor_t minor;
+
+	zfds = (zfd_state_t *)rqp->q_ptr;
+
+	if (rqp == zfds->zfd_master_rdq) {
+		DBG("Closing master side");
+
+		zfds->zfd_master_rdq = NULL;
+		zfds->zfd_state &= ~ZFD_STATE_MOPEN;
+
+		/*
+		 * qenable slave side write queue so that it can flush
+		 * its messages as master's read queue is going away
+		 */
+		if (zfds->zfd_slave_rdq != NULL) {
+			qenable(WR(zfds->zfd_slave_rdq));
+		}
+
+		qprocsoff(rqp);
+		WR(rqp)->q_ptr = rqp->q_ptr = NULL;
+
+	} else if (rqp == zfds->zfd_slave_rdq) {
+
+		DBG("Closing slave side");
+		zfds->zfd_state &= ~ZFD_STATE_SOPEN;
+		zfds->zfd_slave_rdq = NULL;
+
+		wqp = WR(rqp);
+		while ((bp = getq(wqp)) != NULL) {
+			if (zfds->zfd_master_rdq != NULL)
+				putnext(zfds->zfd_master_rdq, bp);
+			else if (bp->b_datap->db_type == M_IOCTL)
+				miocnak(wqp, bp, 0, 0);
+			else
+				freemsg(bp);
+		}
+
+		/*
+		 * Qenable master side write queue so that it can flush its
+		 * messages as slaves's read queue is going away.
+		 */
+		if (zfds->zfd_master_rdq != NULL)
+			qenable(WR(zfds->zfd_master_rdq));
+
+		/*
+		 * Qenable primary stream if necessary.
+		 */
+		if (zfds->zfd_muxt == ZFD_LOG_STREAM &&
+		    zfds->zfd_inst_pri->zfd_allow_flowcon) {
+			zfds->zfd_inst_pri->zfd_is_flowcon = B_FALSE;
+			if (zfds->zfd_inst_pri->zfd_master_rdq != NULL)
+				qenable(RD(zfds->zfd_inst_pri->zfd_master_rdq));
+		}
+
+		qprocsoff(rqp);
+		WR(rqp)->q_ptr = rqp->q_ptr = NULL;
+
+		if (zfds->zfd_tty == 1) {
+			/*
+			 * Clear the sad configuration so that reopening
+			 * doesn't fail to set up sad configuration.
+			 */
+			major = ddi_driver_major(zfds->zfd_devinfo);
+			minor = ddi_get_instance(zfds->zfd_devinfo) << 1 |
+			    ZFD_SLAVE_MINOR;
+			(void) kstr_autopush(CLR_AUTOPUSH, &major, &minor,
+			    NULL, NULL, NULL);
+		}
+	}
+
+	return (0);
+}
+
+static void
+handle_mflush(queue_t *qp, mblk_t *mp)
+{
+	mblk_t *nmp;
+	DBG1("M_FLUSH on %s side", zfd_side(qp));
+
+	if (*mp->b_rptr & FLUSHW) {
+		DBG1("M_FLUSH, FLUSHW, %s side", zfd_side(qp));
+		flushq(qp, FLUSHDATA);
+		*mp->b_rptr &= ~FLUSHW;
+		if ((*mp->b_rptr & FLUSHR) == 0) {
+			/*
+			 * FLUSHW only. Change to FLUSHR and putnext other side,
+			 * then we are done.
+			 */
+			*mp->b_rptr |= FLUSHR;
+			if (zfd_switch(RD(qp)) != NULL) {
+				putnext(zfd_switch(RD(qp)), mp);
+				return;
+			}
+		} else if ((zfd_switch(RD(qp)) != NULL) &&
+		    (nmp = copyb(mp)) != NULL) {
+			/*
+			 * It is a FLUSHRW; we copy the mblk and send
+			 * it to the other side, since we still need to use
+			 * the mblk in FLUSHR processing, below.
+			 */
+			putnext(zfd_switch(RD(qp)), nmp);
+		}
+	}
+
+	if (*mp->b_rptr & FLUSHR) {
+		DBG("qreply(qp) turning FLUSHR around\n");
+		qreply(qp, mp);
+		return;
+	}
+	freemsg(mp);
+}
+
+/*
+ * Evaluate the various conditionals to determine if we're teeing into a log
+ * stream and if the primary stream should be flow controlled. This function
+ * can set the zfd_is_flowcon flag as a side effect.
+ *
+ * When teeing with flow control, we always queue the teed msg here and if
+ * the queue is getting full, we set zfd_is_flowcon. The primary stream will
+ * always queue when zfd_is_flowcon and will also not be served when
+ * zfd_is_flowcon is set. This causes backpressure on the primary stream
+ * until the teed queue can drain.
+ */
+static void
+zfd_tee_handler(zfd_state_t *zfds, unsigned char type, mblk_t *mp)
+{
+	queue_t *log_qp;
+	zfd_state_t *log_zfds;
+	mblk_t *lmp;
+
+	if (zfds->zfd_muxt != ZFD_PRIMARY_STREAM)
+		return;
+
+	if (type != M_DATA)
+		return;
+
+	log_zfds = zfds->zfd_inst_log;
+	if (log_zfds == NULL)
+		return;
+
+	ASSERT(log_zfds->zfd_muxt == ZFD_LOG_STREAM);
+
+	if ((log_zfds->zfd_state & ZFD_STATE_SOPEN) == 0) {
+		if (zfds->zfd_allow_flowcon)
+			zfds->zfd_is_flowcon = B_TRUE;
+		return;
+	}
+
+	/* The zfd_slave_rdq is null until the log dev is opened in the zone */
+	log_qp = RD(log_zfds->zfd_slave_rdq);
+	DTRACE_PROBE2(zfd__tee__check, void *, log_qp, void *, zfds);
+
+	if (!zfds->zfd_allow_flowcon) {
+		/*
+		 * We're not supposed to tee with flow control and the tee is
+		 * full so we skip teeing into the log stream.
+		 */
+		if ((log_qp->q_flag & QFULL) != 0)
+			return;
+	}
+
+	/*
+	 * Tee the message into the log stream.
+	 */
+	lmp = dupmsg(mp);
+	if (lmp == NULL) {
+		if (zfds->zfd_allow_flowcon)
+			zfds->zfd_is_flowcon = B_TRUE;
+		return;
+	}
+
+	if (log_qp->q_first == NULL && bcanputnext(log_qp, lmp->b_band)) {
+		putnext(log_qp, lmp);
+	} else {
+		if (putq(log_qp, lmp) == 0) {
+			/* The logger queue is full, free the msg. */
+			freemsg(lmp);
+		}
+		/*
+		 * If we're supposed to tee with flow control and the tee is
+		 * over the high water mark then we want the primary stream to
+		 * stop flowing. We'll stop queueing the primary stream after
+		 * the log stream has drained.
+		 */
+		if (zfds->zfd_allow_flowcon &&
+		    log_qp->q_count > log_qp->q_hiwat) {
+			zfds->zfd_is_flowcon = B_TRUE;
+		}
+	}
+}
+
+/*
+ * wput(9E) is symmetric for master and slave sides, so this handles both
+ * without splitting the codepath.  (The only exception to this is the
+ * processing of zfd ioctls, which is restricted to the master side.)
+ *
+ * zfd_wput() looks at the other side; if there is no process holding that
+ * side open, it frees the message.  This prevents processes from hanging
+ * if no one is holding open the fd.  Otherwise, it putnext's high
+ * priority messages, putnext's normal messages if possible, and otherwise
+ * enqueues the messages; in the case that something is enqueued, wsrv(9E)
+ * will take care of eventually shuttling I/O to the other side.
+ *
+ * When configured as a multiplexer, then anything written to the stream
+ * from inside the zone is also teed off to the corresponding log stream
+ * for consumption within the zone (i.e. the log stream can be read, but never
+ * written to, by an application inside the zone).
+ */
+static void
+zfd_wput(queue_t *qp, mblk_t *mp)
+{
+	unsigned char type = mp->b_datap->db_type;
+	zfd_state_t *zfds;
+	struct iocblk *iocbp;
+	boolean_t must_queue = B_FALSE;
+
+	ASSERT(qp->q_ptr);
+
+	DBG1("entering zfd_wput, %s side", zfd_side(qp));
+
+	/*
+	 * Process zfd ioctl messages if qp is the master side's write queue.
+	 */
+	zfds = (zfd_state_t *)qp->q_ptr;
+
+	if (type == M_IOCTL) {
+		iocbp = (struct iocblk *)(void *)mp->b_rptr;
+
+		switch (iocbp->ioc_cmd) {
+		case ZFD_MAKETTY:
+			zfds->zfd_tty = 1;
+			miocack(qp, mp, 0, 0);
+			return;
+		case ZFD_EOF:
+			if (zfds->zfd_slave_rdq != NULL)
+				(void) putnextctl(zfds->zfd_slave_rdq,
+				    M_HANGUP);
+			miocack(qp, mp, 0, 0);
+			return;
+		case ZFD_HAS_SLAVE:
+			if ((zfds->zfd_state & ZFD_STATE_SOPEN) != 0) {
+				miocack(qp, mp, 0, 0);
+			} else {
+				miocack(qp, mp, 0, ENOTTY);
+			}
+			return;
+		case ZFD_MUX: {
+			/*
+			 * Setup the multiplexer configuration for the two
+			 * streams.
+			 *
+			 * We expect to be called on the stream that will
+			 * become the log stream and be passed one data block
+			 * with the minor number of the slave side of the
+			 * primary stream.
+			 */
+			int to;
+			int instance;
+			zfd_state_t *prim_zfds;
+
+			if (iocbp->ioc_count != TRANSPARENT ||
+			    mp->b_cont == NULL) {
+				miocack(qp, mp, 0, EINVAL);
+				return;
+			}
+
+			/* Get the primary slave minor device number */
+			to = *(int *)mp->b_cont->b_rptr;
+			instance = ZFD_INSTANCE(to);
+
+			if ((prim_zfds = ddi_get_soft_state(zfd_soft_state,
+			    instance)) == NULL) {
+				miocack(qp, mp, 0, EINVAL);
+				return;
+			}
+
+			/* Disallow changing primary/log once set. */
+			mutex_enter(&zfd_mux_lock);
+			if (zfds->zfd_muxt != ZFD_NO_MUX ||
+			    prim_zfds->zfd_muxt != ZFD_NO_MUX) {
+				mutex_exit(&zfd_mux_lock);
+				miocack(qp, mp, 0, EINVAL);
+				return;
+			}
+
+			zfds->zfd_muxt = ZFD_LOG_STREAM;
+			zfds->zfd_inst_pri = prim_zfds;
+			prim_zfds->zfd_muxt = ZFD_PRIMARY_STREAM;
+			prim_zfds->zfd_inst_log = zfds;
+			mutex_exit(&zfd_mux_lock);
+			DTRACE_PROBE2(zfd__mux__link, void *, prim_zfds,
+			    void *, zfds);
+
+			miocack(qp, mp, 0, 0);
+			return;
+			}
+		case ZFD_MUX_FLOWCON: {
+			/*
+			 * We expect this ioctl to be issued against the
+			 * log stream. We don't use the primary stream since
+			 * there can be other streams modules pushed onto that
+			 * stream which would interfere with the ioctl.
+			 */
+			int val;
+			zfd_state_t *prim_zfds;
+
+			if (iocbp->ioc_count != TRANSPARENT ||
+			    mp->b_cont == NULL) {
+				miocack(qp, mp, 0, EINVAL);
+				return;
+			}
+
+			if (zfds->zfd_muxt != ZFD_LOG_STREAM) {
+				miocack(qp, mp, 0, EINVAL);
+				return;
+			}
+			prim_zfds = zfds->zfd_inst_pri;
+
+			/* Get the flow control setting */
+			val = *(int *)mp->b_cont->b_rptr;
+			if (val != 0 && val != 1) {
+				miocack(qp, mp, 0, EINVAL);
+				return;
+			}
+
+			prim_zfds->zfd_allow_flowcon = (boolean_t)val;
+			if (!prim_zfds->zfd_allow_flowcon)
+				prim_zfds->zfd_is_flowcon = B_FALSE;
+
+			DTRACE_PROBE1(zfd__mux__flowcon, void *, prim_zfds);
+			miocack(qp, mp, 0, 0);
+			return;
+			}
+		default:
+			break;
+		}
+	}
+
+	/* if on the write side, may need to tee */
+	if (zfds->zfd_slave_rdq != NULL && qp == WR(zfds->zfd_slave_rdq)) {
+		/* tee output to any attached log stream */
+		zfd_tee_handler(zfds, type, mp);
+
+		/* high-priority msgs are not subject to flow control */
+		if (zfds->zfd_is_flowcon && type == M_DATA)
+			must_queue = B_TRUE;
+	}
+
+	if (zfd_switch(RD(qp)) == NULL) {
+		DBG1("wput to %s side (no one listening)", zfd_side(qp));
+		switch (type) {
+		case M_FLUSH:
+			handle_mflush(qp, mp);
+			break;
+		case M_IOCTL:
+			miocnak(qp, mp, 0, 0);
+			break;
+		default:
+			freemsg(mp);
+			break;
+		}
+		return;
+	}
+
+	if (type >= QPCTL) {
+		DBG1("(hipri) wput, %s side", zfd_side(qp));
+		switch (type) {
+		case M_READ:		/* supposedly from ldterm? */
+			DBG("zfd_wput: tossing M_READ\n");
+			freemsg(mp);
+			break;
+		case M_FLUSH:
+			handle_mflush(qp, mp);
+			break;
+		default:
+			/*
+			 * Put this to the other side.
+			 */
+			ASSERT(zfd_switch(RD(qp)) != NULL);
+			putnext(zfd_switch(RD(qp)), mp);
+			break;
+		}
+		DBG1("done (hipri) wput, %s side", zfd_side(qp));
+		return;
+	}
+
+	/*
+	 * If the primary stream has been stopped for flow control then
+	 * enqueue the msg, otherwise only putnext if there isn't already
+	 * something in the queue. If we don't do this then things would wind
+	 * up out of order.
+	 */
+	if (!must_queue && qp->q_first == NULL &&
+	    bcanputnext(RD(zfd_switch(qp)), mp->b_band)) {
+		putnext(RD(zfd_switch(qp)), mp);
+	} else {
+		/*
+		 * zfd_wsrv expects msgs queued on the primary queue. Those
+		 * will be handled by zfd_wsrv after zfd_rsrv performs the
+		 * qenable on the proper queue.
+		 */
+		(void) putq(qp, mp);
+	}
+
+	DBG1("done wput, %s side", zfd_side(qp));
+}
+
+/*
+ * Read server
+ *
+ * For primary stream:
+ * Under normal execution rsrv(9E) is symmetric for master and slave, so
+ * zfd_rsrv() can handle both without splitting up the codepath. We do this by
+ * enabling the write side of the partner.  This triggers the partner to send
+ * messages queued on its write side to this queue's read side.
+ *
+ * For log stream:
+ * Internally we've queued up the msgs that we've teed off to the log stream
+ * so when we're invoked we need to pass these along.
+ */
+static void
+zfd_rsrv(queue_t *qp)
+{
+	zfd_state_t *zfds;
+	zfds = (zfd_state_t *)qp->q_ptr;
+
+	/*
+	 * log stream server
+	 */
+	if (zfds->zfd_muxt == ZFD_LOG_STREAM && zfds->zfd_slave_rdq != NULL) {
+		queue_t *log_qp;
+		mblk_t *mp;
+
+		log_qp = RD(zfds->zfd_slave_rdq);
+
+		if ((zfds->zfd_state & ZFD_STATE_SOPEN) != 0) {
+			zfd_state_t *pzfds = zfds->zfd_inst_pri;
+
+			while ((mp = getq(qp)) != NULL) {
+				if (bcanputnext(log_qp, mp->b_band)) {
+					putnext(log_qp, mp);
+				} else {
+					(void) putbq(log_qp, mp);
+					break;
+				}
+			}
+
+			if (log_qp->q_count < log_qp->q_lowat) {
+				DTRACE_PROBE(zfd__flow__on);
+				pzfds->zfd_is_flowcon = B_FALSE;
+				if (pzfds->zfd_master_rdq != NULL)
+					qenable(RD(pzfds->zfd_master_rdq));
+			}
+		} else {
+			/* No longer open, drain the queue */
+			while ((mp = getq(qp)) != NULL) {
+				freemsg(mp);
+			}
+			flushq(qp, FLUSHALL);
+		}
+		return;
+	}
+
+	/*
+	 * Care must be taken here, as either of the master or slave side
+	 * qptr could be NULL.
+	 */
+	ASSERT(qp == zfds->zfd_master_rdq || qp == zfds->zfd_slave_rdq);
+	if (zfd_switch(qp) == NULL) {
+		DBG("zfd_rsrv: other side isn't listening\n");
+		return;
+	}
+	qenable(WR(zfd_switch(qp)));
+}
+
+/*
+ * Write server
+ *
+ * This routine is symmetric for master and slave, so it handles both without
+ * splitting up the codepath.
+ *
+ * If there are messages on this queue that can be sent to the other, send
+ * them via putnext(). Else, if queued messages cannot be sent, leave them
+ * on this queue.
+ */
+static void
+zfd_wsrv(queue_t *qp)
+{
+	queue_t *swq;
+	mblk_t *mp;
+	zfd_state_t *zfds = (zfd_state_t *)qp->q_ptr;
+
+	ASSERT(zfds != NULL);
+
+	/*
+	 * Partner has no read queue, so take the data, and throw it away.
+	 */
+	if (zfd_switch(RD(qp)) == NULL) {
+		DBG("zfd_wsrv: other side isn't listening");
+		while ((mp = getq(qp)) != NULL) {
+			if (mp->b_datap->db_type == M_IOCTL)
+				miocnak(qp, mp, 0, 0);
+			else
+				freemsg(mp);
+		}
+		flushq(qp, FLUSHALL);
+		return;
+	}
+
+	swq = RD(zfd_switch(qp));
+
+	/*
+	 * while there are messages on this write queue...
+	 */
+	while (!zfds->zfd_is_flowcon && (mp = getq(qp)) != NULL) {
+		/*
+		 * Due to the way zfd_wput is implemented, we should never
+		 * see a high priority control message here.
+		 */
+		ASSERT(mp->b_datap->db_type < QPCTL);
+
+		if (bcanputnext(swq, mp->b_band)) {
+			putnext(swq, mp);
+		} else {
+			(void) putbq(qp, mp);
+			break;
+		}
+	}
+}
diff --git a/usr/src/uts/common/klm/klmmod.c b/usr/src/uts/common/klm/klmmod.c
index 51ed43e198..58e0f2d874 100644
--- a/usr/src/uts/common/klm/klmmod.c
+++ b/usr/src/uts/common/klm/klmmod.c
@@ -12,6 +12,7 @@
 /*
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -278,6 +279,10 @@ lm_svc(struct lm_svc_args *args)
 			rfs4_lease_time   = args->grace;
 		}
 
+		if (args->n_v4_only == -1) {
+			g->nlm_v4_only = B_TRUE;
+		}
+
 		mutex_exit(&g->lock);
 		err = nlm_svc_starting(g, fp, netid, &knc);
 		mutex_enter(&g->lock);
diff --git a/usr/src/uts/common/klm/mapfile-mod b/usr/src/uts/common/klm/mapfile-mod
index 0debe6d986..b7789d81fd 100644
--- a/usr/src/uts/common/klm/mapfile-mod
+++ b/usr/src/uts/common/klm/mapfile-mod
@@ -11,6 +11,7 @@
 
 #
 # Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
+# Copyright 2017 Joyent, Inc.
 #
 
 
@@ -49,6 +50,11 @@ SYMBOL_SCOPE {
 		nlm_frlock;
 		nlm_register_lock_locally;
 		nlm_shrlock;
+# These four functions are available for use within a branded zone.
+		nlm_nsm_clnt_init;
+		nlm_netbuf_to_netobj;
+		sm_mon_1;
+		sm_unmon_1;
 
 	local:
 		*;
diff --git a/usr/src/uts/common/klm/nlm_dispatch.c b/usr/src/uts/common/klm/nlm_dispatch.c
index a0ca2a56c4..8fa9940eae 100644
--- a/usr/src/uts/common/klm/nlm_dispatch.c
+++ b/usr/src/uts/common/klm/nlm_dispatch.c
@@ -11,6 +11,7 @@
 
 /*
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -412,13 +413,13 @@ nlm_prog_3_dtable[] = {
 	0,
 	0 },
 
-	{ /* 16: not used */
-	NLM_SVC_FUNC(0),
-	(xdrproc_t)0,
-	(xdrproc_t)0,
+	{ /* 16: Linux NLMPROC_NSM_NOTIFY (same handling as NLM_SM_NOTIFY1) */
+	NLM_SVC_FUNC(nlm_sm_notify1_2_svc),
+	(xdrproc_t)xdr_nlm_sm_status,
+	(xdrproc_t)xdr_void,
 	NULL,
 	0,
-	0 },
+	NLM_DISP_NOREMOTE },
 
 	{ /* 17: NLM_SM_NOTIFY1 */
 	NLM_SVC_FUNC(nlm_sm_notify1_2_svc),
diff --git a/usr/src/uts/common/klm/nlm_impl.c b/usr/src/uts/common/klm/nlm_impl.c
index 1e9033a17c..e787f70ebd 100644
--- a/usr/src/uts/common/klm/nlm_impl.c
+++ b/usr/src/uts/common/klm/nlm_impl.c
@@ -28,6 +28,7 @@
 /*
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -57,6 +58,7 @@
 #include <sys/queue.h>
 #include <sys/bitmap.h>
 #include <sys/sdt.h>
+#include <sys/brand.h>
 #include <netinet/in.h>
 
 #include <rpc/rpc.h>
@@ -202,6 +204,12 @@ static struct nlm_knc nlm_netconfigs[] = { /* (g) */
 };
 
 /*
+ * NLM functions which can be called by a brand hook.
+ */
+void nlm_netbuf_to_netobj(struct netbuf *, int *, netobj *);
+void nlm_nsm_clnt_init(CLIENT *, struct nlm_nsm *);
+
+/*
  * NLM misc. function
  */
 static void nlm_copy_netbuf(struct netbuf *, struct netbuf *);
@@ -210,8 +218,6 @@ static void nlm_kmem_reclaim(void *);
 static void nlm_pool_shutdown(void);
 static void nlm_suspend_zone(struct nlm_globals *);
 static void nlm_resume_zone(struct nlm_globals *);
-static void nlm_nsm_clnt_init(CLIENT *, struct nlm_nsm *);
-static void nlm_netbuf_to_netobj(struct netbuf *, int *, netobj *);
 
 /*
  * NLM thread functions
@@ -1839,6 +1845,12 @@ nlm_host_unmonitor(struct nlm_globals *g, struct nlm_host *host)
 		return;
 
 	host->nh_flags &= ~NLM_NH_MONITORED;
+
+	if (ZONE_IS_BRANDED(curzone) && ZBROP(curzone)->b_rpc_statd != NULL) {
+		ZBROP(curzone)->b_rpc_statd(SM_UNMON, g, host);
+		return;
+	}
+
 	stat = nlm_nsm_unmon(&g->nlm_nsm, host->nh_name);
 	if (stat != RPC_SUCCESS) {
 		NLM_WARN("NLM: Failed to contact statd, stat=%d\n", stat);
@@ -1877,6 +1889,11 @@ nlm_host_monitor(struct nlm_globals *g, struct nlm_host *host, int state)
 	host->nh_flags |= NLM_NH_MONITORED;
 	mutex_exit(&host->nh_lock);
 
+	if (ZONE_IS_BRANDED(curzone) && ZBROP(curzone)->b_rpc_statd != NULL) {
+		ZBROP(curzone)->b_rpc_statd(SM_MON, g, host);
+		return;
+	}
+
 	/*
 	 * Before we begin monitoring the host register the network address
 	 * associated with this hostname.
@@ -2353,6 +2370,13 @@ nlm_svc_starting(struct nlm_globals *g, struct file *fp,
 	VERIFY(g->run_status == NLM_ST_STARTING);
 	VERIFY(g->nlm_gc_thread == NULL);
 
+	if (g->nlm_v4_only) {
+		NLM_WARN("Zone %d has no rpcbind, NLM is v4 only", getzoneid());
+		bzero(&g->nlm_nsm, sizeof (struct nlm_nsm));
+		g->nlm_nsm.ns_addr_handle = (void *)-1;
+		goto v4_only;
+	}
+
 	error = nlm_nsm_init_local(&g->nlm_nsm);
 	if (error != 0) {
 		NLM_ERR("Failed to initialize NSM handler "
@@ -2389,6 +2413,7 @@ nlm_svc_starting(struct nlm_globals *g, struct file *fp,
 		    "(rpcerr=%d)\n", stat);
 		goto shutdown_lm;
 	}
+v4_only:
 
 	g->grace_threshold = ddi_get_lbolt() +
 	    SEC_TO_TICK(g->grace_period);
@@ -2512,7 +2537,9 @@ nlm_svc_stopping(struct nlm_globals *g)
 
 	ASSERT(TAILQ_EMPTY(&g->nlm_slocks));
 
-	nlm_nsm_fini(&g->nlm_nsm);
+	/* If started with rpcbind (the normal case) */
+	if (g->nlm_nsm.ns_addr_handle != (void *)-1)
+		nlm_nsm_fini(&g->nlm_nsm);
 	g->lockd_pid = 0;
 	g->run_status = NLM_ST_DOWN;
 }
@@ -2781,14 +2808,14 @@ nlm_cprresume(void)
 	rw_exit(&lm_lck);
 }
 
-static void
+void
 nlm_nsm_clnt_init(CLIENT *clnt, struct nlm_nsm *nsm)
 {
 	(void) clnt_tli_kinit(clnt, &nsm->ns_knc, &nsm->ns_addr, 0,
 	    NLM_RPC_RETRIES, kcred);
 }
 
-static void
+void
 nlm_netbuf_to_netobj(struct netbuf *addr, int *family, netobj *obj)
 {
 	/* LINTED pointer alignment */
diff --git a/usr/src/uts/common/klm/nlm_impl.h b/usr/src/uts/common/klm/nlm_impl.h
index 6b2df7f8b0..2ac711f3c7 100644
--- a/usr/src/uts/common/klm/nlm_impl.h
+++ b/usr/src/uts/common/klm/nlm_impl.h
@@ -30,6 +30,7 @@
 /*
  * Copyright 2012 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
@@ -459,6 +460,7 @@ struct nlm_globals {
 	int				cn_idle_tmo;		/* (z) */
 	int				grace_period;		/* (z) */
 	int				retrans_tmo;		/* (z) */
+	boolean_t			nlm_v4_only;		/* (z) */
 	kmutex_t			clean_lock;		/* (c) */
 	TAILQ_ENTRY(nlm_globals)	nlm_link;		/* (g) */
 };
diff --git a/usr/src/uts/common/krtld/kobj.c b/usr/src/uts/common/krtld/kobj.c
index 90303d496b..be5b92da29 100644
--- a/usr/src/uts/common/krtld/kobj.c
+++ b/usr/src/uts/common/krtld/kobj.c
@@ -25,6 +25,7 @@
 /*
  * Copyright 2011 Bayard G. Bell <buffer.g.overflow@gmail.com>.
  * All rights reserved. Use is subject to license terms.
+ * Copyright (c) 2017 Joyent, Inc.
  */
 
 /*
@@ -2178,6 +2179,7 @@ static void
 free_module_data(struct module *mp)
 {
 	struct module_list *lp, *tmp;
+	hotinline_desc_t *hid, *next;
 	int ksyms_exported = 0;
 
 	lp = mp->head;
@@ -2187,6 +2189,15 @@ free_module_data(struct module *mp)
 		kobj_free((char *)tmp, sizeof (*tmp));
 	}
 
+	/* release hotinlines */
+	hid = mp->hi_calls;
+	while (hid != NULL) {
+		next = hid->hid_next;
+		kobj_free(hid->hid_symname, strlen(hid->hid_symname) + 1);
+		kobj_free(hid, sizeof (hotinline_desc_t));
+		hid = next;
+	}
+
 	rw_enter(&ksyms_lock, RW_WRITER);
 	if (mp->symspace) {
 		if (vmem_contains(ksyms_arena, mp->symspace, mp->symsize)) {
@@ -3032,8 +3043,18 @@ do_symbols(struct module *mp, Elf64_Addr bss_base)
 		if (sp->st_shndx == SHN_UNDEF) {
 			resolved = 0;
 
+			/*
+			 * Skip over sdt probes and smap calls,
+			 * they're relocated later.
+			 */
 			if (strncmp(name, sdt_prefix, strlen(sdt_prefix)) == 0)
 				continue;
+#if defined(__x86)
+			if (strcmp(name, "smap_enable") == 0 ||
+			    strcmp(name, "smap_disable") == 0)
+				continue;
+#endif /* defined(__x86) */
+
 
 			/*
 			 * If it's not a weak reference and it's
diff --git a/usr/src/uts/common/mapfiles/README b/usr/src/uts/common/mapfiles/README
new file mode 100644
index 0000000000..5b65771325
--- /dev/null
+++ b/usr/src/uts/common/mapfiles/README
@@ -0,0 +1,68 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+Kernel Module Build Time Symbol Verification
+--------------------------------------------
+
+Historically, kernel modules have all been built as relocatable objects.
+They are not dynamic objects and dependency information is always noted
+in individual makefiles. Along with this, there has never been any
+verification of the symbols that are being used. This means that it's
+possible for a kernel module author to refer to a symbol that doesn't
+exist and not find out until they try to install the module.
+
+To help find these problems at build time, we provide an opt-in system
+for modules to use, leveraging the link-editor's '-z defs' option.  This
+option ensures that there are no unknown definitons at link-edit time.
+To supply these definitions we supply a series of mapfiles in this
+directory.
+
+These mapfiles are not the traditional versioning mapfiles like those in
+usr/src/lib/README.mapfiles! Please review the following differences
+closely:
+
+* These mapfiles do not declare any versions!
+* These mapfiles do not use the 'SYMBOL_VERSION' directive, instead they
+  use the 'SYMBOL_SCOPE' directive.
+* These mapfiles do not hide symbols! Library mapfiles always have
+  something to catch all local symbols. That should *never* be used
+  here. These mapfiles should not effect visibility.
+* All symbols in these mapfiles should be marked 'EXTERN' to indicate
+  that they are not provided by the kernel module but by another.
+* These mapfiles do not declare what is or isn't a public interface,
+  though they are often grouped around interfaces, to make it easier for
+  a driver author to get this right.
+
+Mapfiles are organized based on kernel module. For example the GLDv3
+device driver interface is provided by the 'mac' module and thus is
+found in the file 'mac.mapfile'. The DDI is currently in the 'ddi'
+mapfile. Functions that are found in genunix and unix that aren't in
+the DDI should not be put in that mapfile.
+
+Note, the existing files may not be complete. These are intended to only
+have the public interfaces provided by modules and thus should not
+include every symbol in them. As the need arises, add new symbols or
+modules as appropriate.
+
+To opt a module into this, first declare a series of MAPFILES that they
+should check against in the module. This should be a series of one or
+more files, for example:
+
+MAPFILES += ddi mac
+
+Next, you should add an include of Makefile.mapfile right before you
+include Makefile.targ. You can do this with the following line:
+
+include $(UTSBASE)/Makefile.mapfile
diff --git a/usr/src/uts/common/mapfiles/ddi.mapfile b/usr/src/uts/common/mapfiles/ddi.mapfile
new file mode 100644
index 0000000000..1377af5857
--- /dev/null
+++ b/usr/src/uts/common/mapfiles/ddi.mapfile
@@ -0,0 +1,192 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object scoping must comply with the rules detailed in
+#
+#	usr/src/uts/common/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+#
+# This file contains core functions provided by the DDI and also items
+# required as part of the platform's runime ABI (think compiler
+# functions).
+#
+
+$mapfile_version 2
+
+SYMBOL_SCOPE {
+    global:
+	__divdi3			{ FLAGS = EXTERN };
+	__stack_chk_fail		{ FLAGS = EXTERN };
+	__stack_chk_guard		{ FLAGS = EXTERN };
+	allocb				{ FLAGS = EXTERN };
+	assfail				{ FLAGS = EXTERN };
+	assfail3			{ FLAGS = EXTERN };
+	atomic_dec_32_nv		{ FLAGS = EXTERN };
+	bcmp				{ FLAGS = EXTERN };
+	bcopy				{ FLAGS = EXTERN };
+	bzero				{ FLAGS = EXTERN };
+	cmn_err				{ FLAGS = EXTERN };
+	cv_broadcast			{ FLAGS = EXTERN };
+	cv_destroy			{ FLAGS = EXTERN };
+	cv_init				{ FLAGS = EXTERN };
+	cv_reltimedwait			{ FLAGS = EXTERN };
+	ddi_cb_register			{ FLAGS = EXTERN };
+	ddi_cb_unregister		{ FLAGS = EXTERN };
+	ddi_dev_regsize			{ FLAGS = EXTERN };
+	ddi_dma_addr_bind_handle	{ FLAGS = EXTERN };
+	ddi_dma_alloc_handle		{ FLAGS = EXTERN };
+	ddi_dma_free_handle		{ FLAGS = EXTERN };
+	ddi_dma_mem_alloc		{ FLAGS = EXTERN };
+	ddi_dma_mem_free		{ FLAGS = EXTERN };
+	ddi_dma_nextcookie		{ FLAGS = EXTERN };
+	ddi_dma_sync			{ FLAGS = EXTERN };
+	ddi_dma_unbind_handle		{ FLAGS = EXTERN };
+	ddi_fls				{ FLAGS = EXTERN };
+	ddi_fm_acc_err_clear		{ FLAGS = EXTERN };
+	ddi_fm_acc_err_get		{ FLAGS = EXTERN };
+	ddi_fm_dma_err_get		{ FLAGS = EXTERN };
+	ddi_fm_ereport_post		{ FLAGS = EXTERN };
+	ddi_fm_fini			{ FLAGS = EXTERN };
+	ddi_fm_handler_register		{ FLAGS = EXTERN };
+	ddi_fm_handler_unregister	{ FLAGS = EXTERN };
+	ddi_fm_init			{ FLAGS = EXTERN };
+	ddi_fm_service_impact		{ FLAGS = EXTERN };
+	ddi_get_driver_private		{ FLAGS = EXTERN };
+	ddi_get_instance		{ FLAGS = EXTERN };
+	ddi_get_lbolt			{ FLAGS = EXTERN };
+	ddi_get_lbolt64			{ FLAGS = EXTERN };
+	ddi_get_name			{ FLAGS = EXTERN };
+	ddi_get_parent			{ FLAGS = EXTERN };
+	ddi_get16			{ FLAGS = EXTERN };
+	ddi_get32			{ FLAGS = EXTERN };
+	ddi_get64			{ FLAGS = EXTERN };
+	ddi_intr_add_handler		{ FLAGS = EXTERN };
+	ddi_intr_alloc			{ FLAGS = EXTERN };
+	ddi_intr_block_disable		{ FLAGS = EXTERN };
+	ddi_intr_block_enable		{ FLAGS = EXTERN };
+	ddi_intr_disable		{ FLAGS = EXTERN };
+	ddi_intr_enable			{ FLAGS = EXTERN };
+	ddi_intr_free			{ FLAGS = EXTERN };
+	ddi_intr_get_cap		{ FLAGS = EXTERN };
+	ddi_intr_get_navail		{ FLAGS = EXTERN };
+	ddi_intr_get_nintrs		{ FLAGS = EXTERN };
+	ddi_intr_get_pri		{ FLAGS = EXTERN };
+	ddi_intr_get_supported_types	{ FLAGS = EXTERN };
+	ddi_intr_remove_handler		{ FLAGS = EXTERN };
+	ddi_periodic_add		{ FLAGS = EXTERN };
+	ddi_periodic_delete		{ FLAGS = EXTERN };
+	ddi_power			{ FLAGS = EXTERN };
+	ddi_prop_free			{ FLAGS = EXTERN };
+	ddi_prop_get_int		{ FLAGS = EXTERN };
+	ddi_prop_lookup_int_array	{ FLAGS = EXTERN };
+	ddi_prop_op			{ FLAGS = EXTERN };
+	ddi_prop_remove_all		{ FLAGS = EXTERN };
+	ddi_prop_update_int_array	{ FLAGS = EXTERN };
+	ddi_prop_update_string		{ FLAGS = EXTERN };
+	ddi_ptob			{ FLAGS = EXTERN };
+	ddi_put16			{ FLAGS = EXTERN };
+	ddi_put32			{ FLAGS = EXTERN };
+	ddi_quiesce_not_supported	{ FLAGS = EXTERN };
+	ddi_regs_map_free		{ FLAGS = EXTERN };
+	ddi_regs_map_setup		{ FLAGS = EXTERN };
+	ddi_set_driver_private		{ FLAGS = EXTERN };
+	ddi_strtol			{ FLAGS = EXTERN };
+	ddi_taskq_create		{ FLAGS = EXTERN };
+	ddi_taskq_destroy		{ FLAGS = EXTERN };
+	ddi_taskq_dispatch		{ FLAGS = EXTERN };
+	delay				{ FLAGS = EXTERN };
+	desballoc			{ FLAGS = EXTERN };
+	dev_err				{ FLAGS = EXTERN };
+	drv_usectohz			{ FLAGS = EXTERN };
+	drv_usecwait			{ FLAGS = EXTERN };
+	fm_ena_generate			{ FLAGS = EXTERN };
+	freeb				{ FLAGS = EXTERN };
+	freemsg				{ FLAGS = EXTERN };
+	freemsgchain			{ FLAGS = EXTERN };
+	gethrtime			{ FLAGS = EXTERN };
+	kmem_alloc			{ FLAGS = EXTERN };
+	kmem_free			{ FLAGS = EXTERN };
+	kmem_zalloc			{ FLAGS = EXTERN };
+	kstat_create			{ FLAGS = EXTERN };
+	kstat_delete			{ FLAGS = EXTERN };
+	kstat_install			{ FLAGS = EXTERN };
+	kstat_named_init		{ FLAGS = EXTERN };
+	list_create			{ FLAGS = EXTERN };
+	list_destroy			{ FLAGS = EXTERN };
+	list_head			{ FLAGS = EXTERN };
+	list_insert_tail		{ FLAGS = EXTERN };
+	list_next			{ FLAGS = EXTERN };
+	list_remove			{ FLAGS = EXTERN };
+	list_remove_head		{ FLAGS = EXTERN };
+	memcpy				{ FLAGS = EXTERN };
+	memset				{ FLAGS = EXTERN };
+	miocack				{ FLAGS = EXTERN };
+	miocnak				{ FLAGS = EXTERN };
+	mod_driverops			{ FLAGS = EXTERN };
+	mod_info			{ FLAGS = EXTERN };
+	mod_install			{ FLAGS = EXTERN };
+	mod_remove			{ FLAGS = EXTERN };
+	msgpullup			{ FLAGS = EXTERN };
+	msgsize				{ FLAGS = EXTERN };
+	mutex_destroy			{ FLAGS = EXTERN };
+	mutex_enter			{ FLAGS = EXTERN };
+	mutex_exit			{ FLAGS = EXTERN };
+	mutex_init			{ FLAGS = EXTERN };
+	mutex_owned			{ FLAGS = EXTERN };
+	mutex_tryenter			{ FLAGS = EXTERN };
+	nochpoll			{ FLAGS = EXTERN };
+	nodev				{ FLAGS = EXTERN };
+	nulldev				{ FLAGS = EXTERN };
+	panic				{ FLAGS = EXTERN };
+	pci_config_get16		{ FLAGS = EXTERN };
+	pci_config_get32		{ FLAGS = EXTERN };
+	pci_config_get64		{ FLAGS = EXTERN };
+	pci_config_get8			{ FLAGS = EXTERN };
+	pci_config_put16		{ FLAGS = EXTERN };
+	pci_config_put32		{ FLAGS = EXTERN };
+	pci_config_put64		{ FLAGS = EXTERN };
+	pci_config_put8			{ FLAGS = EXTERN };
+	pci_config_setup		{ FLAGS = EXTERN };
+	pci_config_teardown		{ FLAGS = EXTERN };
+	pci_ereport_post		{ FLAGS = EXTERN };
+	pci_ereport_setup		{ FLAGS = EXTERN };
+	pci_ereport_teardown		{ FLAGS = EXTERN };
+	pci_lcap_locate			{ FLAGS = EXTERN };
+	qreply				{ FLAGS = EXTERN };
+	rw_destroy			{ FLAGS = EXTERN };
+	rw_enter			{ FLAGS = EXTERN };
+	rw_exit				{ FLAGS = EXTERN };
+	rw_init				{ FLAGS = EXTERN };
+	snprintf			{ FLAGS = EXTERN };
+	sprintf				{ FLAGS = EXTERN };
+	strcat				{ FLAGS = EXTERN };
+	strcmp				{ FLAGS = EXTERN };
+	strcpy				{ FLAGS = EXTERN };
+	strlen				{ FLAGS = EXTERN };
+	timeout				{ FLAGS = EXTERN };
+	untimeout			{ FLAGS = EXTERN };
+	vsnprintf			{ FLAGS = EXTERN };
+	vsprintf			{ FLAGS = EXTERN };
+};
diff --git a/usr/src/uts/common/mapfiles/dtrace.mapfile.awk b/usr/src/uts/common/mapfiles/dtrace.mapfile.awk
new file mode 100644
index 0000000000..b8a7e2d372
--- /dev/null
+++ b/usr/src/uts/common/mapfiles/dtrace.mapfile.awk
@@ -0,0 +1,34 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# This script is designed to assemble a mapfile for DTrace probes.
+#
+BEGIN {
+	print "#"
+	print "# This file is autogenerated by dtrace.mapfile.awk"
+	print "#"
+	print "$mapfile_version 2"
+	print "SYMBOL_SCOPE {"
+	print "    global:"
+}
+
+/__dtrace_probe_/ {
+	printf "\t%s\t{ FLAGS = EXTERN };\n", $1
+}
+
+END {
+	print "};"
+}
diff --git a/usr/src/uts/common/mapfiles/kernel.mapfile b/usr/src/uts/common/mapfiles/kernel.mapfile
new file mode 100644
index 0000000000..6bddb3c7ef
--- /dev/null
+++ b/usr/src/uts/common/mapfiles/kernel.mapfile
@@ -0,0 +1,41 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object scoping must comply with the rules detailed in
+#
+#	usr/src/uts/common/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+#
+# This file contains functions provided by the kernel that various
+# modules use. This is a combination of things in both unix and genunix.
+#
+
+$mapfile_version 2
+
+SYMBOL_SCOPE {
+    global:
+	bt_getlowbit			{ FLAGS = EXTERN };
+	servicing_interrupt		{ FLAGS = EXTERN };
+};
diff --git a/usr/src/uts/common/mapfiles/mac.mapfile b/usr/src/uts/common/mapfiles/mac.mapfile
new file mode 100644
index 0000000000..d40c09b311
--- /dev/null
+++ b/usr/src/uts/common/mapfiles/mac.mapfile
@@ -0,0 +1,57 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2017, Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object scoping must comply with the rules detailed in
+#
+#	usr/src/uts/common/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_SCOPE {
+    global:
+	mac_alloc				{ FLAGS = EXTERN };
+	mac_fini_ops				{ FLAGS = EXTERN };
+	mac_free				{ FLAGS = EXTERN };
+	mac_hcksum_get				{ FLAGS = EXTERN };
+	mac_hcksum_set				{ FLAGS = EXTERN };
+	mac_init_ops				{ FLAGS = EXTERN };
+	mac_link_update				{ FLAGS = EXTERN };
+	mac_lso_get				{ FLAGS = EXTERN };
+	mac_maxsdu_update			{ FLAGS = EXTERN };
+	mac_prop_info_set_default_link_flowctrl	{ FLAGS = EXTERN };
+	mac_prop_info_set_default_str		{ FLAGS = EXTERN };
+	mac_prop_info_set_default_uint8		{ FLAGS = EXTERN };
+	mac_prop_info_set_perm			{ FLAGS = EXTERN };
+	mac_prop_info_set_range_uint32		{ FLAGS = EXTERN };
+	mac_ring_intr_set			{ FLAGS = EXTERN };
+	mac_register				{ FLAGS = EXTERN };
+	mac_rx					{ FLAGS = EXTERN };
+	mac_rx_ring				{ FLAGS = EXTERN };
+	mac_transceiver_info_set_present	{ FLAGS = EXTERN };
+	mac_transceiver_info_set_usable		{ FLAGS = EXTERN };
+	mac_tx_ring_update			{ FLAGS = EXTERN };
+	mac_tx_update				{ FLAGS = EXTERN };
+	mac_unregister				{ FLAGS = EXTERN };
+};
diff --git a/usr/src/uts/common/mapfiles/random.mapfile b/usr/src/uts/common/mapfiles/random.mapfile
new file mode 100644
index 0000000000..d3d8bc89fa
--- /dev/null
+++ b/usr/src/uts/common/mapfiles/random.mapfile
@@ -0,0 +1,37 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object scoping must comply with the rules detailed in
+#
+#	usr/src/uts/common/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_SCOPE {
+    global:
+	random_get_bytes			{ FLAGS = EXTERN };
+	random_get_blocking_bytes		{ FLAGS = EXTERN };
+	random_get_pseudo_bytes			{ FLAGS = EXTERN };
+};
diff --git a/usr/src/uts/common/netinet/in.h b/usr/src/uts/common/netinet/in.h
index 9ac3066362..6a4f538c97 100644
--- a/usr/src/uts/common/netinet/in.h
+++ b/usr/src/uts/common/netinet/in.h
@@ -3,6 +3,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 /*
  * Copyright (c) 1982, 1986 Regents of the University of California.
@@ -225,6 +226,7 @@ typedef	uint16_t	sa_family_t;
 #define	IPPORT_SLP		427
 #define	IPPORT_MIP		434
 #define	IPPORT_SMB		445		/* a.k.a. microsoft-ds */
+#define	IPPORT_VXLAN		4789
 
 /*
  * Internet Key Exchange (IKE) ports
@@ -268,6 +270,11 @@ typedef	uint16_t	sa_family_t;
 #define	IPPORT_RESERVED		1024
 #define	IPPORT_USERRESERVED	5000
 
+#ifdef _KERNEL
+#define	IPPORT_DYNAMIC_MIN	49152
+#define	IPPORT_DYNAMIC_MAX	65535
+#endif
+
 /*
  * Link numbers
  */
diff --git a/usr/src/uts/common/netinet/udp.h b/usr/src/uts/common/netinet/udp.h
index c65a9bad3a..74cff75d43 100644
--- a/usr/src/uts/common/netinet/udp.h
+++ b/usr/src/uts/common/netinet/udp.h
@@ -1,6 +1,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*
@@ -17,9 +18,6 @@
 #ifndef	_NETINET_UDP_H
 #define	_NETINET_UDP_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-/* udp.h 1.7 88/08/19 SMI; from UCB 7.1 6/5/86	*/
-
 #ifdef	__cplusplus
 extern "C" {
 #endif
@@ -36,6 +34,16 @@ struct udphdr {
 #define	UDP_EXCLBIND		0x0101		/* for internal use only */
 #define	UDP_RCVHDR		0x0102		/* for internal use only */
 #define	UDP_NAT_T_ENDPOINT	0x0103		/* for internal use only */
+#define	UDP_SRCPORT_HASH	0x0104		/* for internal use only */
+#define	UDP_SND_TO_CONNECTED	0x0105		/* for internal use only */
+
+/*
+ * Hash definitions for UDP_SRCPORT_HASH that effectively tell UDP how to go
+ * handle UDP_SRCPORT_HASH.
+ */
+#define	UDP_HASH_DISABLE	0x0000		/* for internal use only */
+#define	UDP_HASH_VXLAN		0x0001		/* for internal use only */
+
 /*
  * Following option in UDP_ namespace required to be exposed through
  * <xti.h> (It also requires exposing options not implemented). The options
diff --git a/usr/src/uts/common/nfs/nfssys.h b/usr/src/uts/common/nfs/nfssys.h
index e9a2746017..7d2401856c 100644
--- a/usr/src/uts/common/nfs/nfssys.h
+++ b/usr/src/uts/common/nfs/nfssys.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -122,13 +123,20 @@ struct nfs_revauth_args32 {
 enum lm_fmly  { LM_INET, LM_INET6, LM_LOOPBACK };
 enum lm_proto { LM_TCP, LM_UDP };
 
+/*
+ * The 'n_v4_only' member was formerly called 'debug'. This member is not used
+ * in the kernel. To avoid a new version of this user/kernel interface
+ * structure, the member was renamed in a binary compatible way. It is now used
+ * by the user-level code to indicate that the zone is not running
+ * rpcbind/rpc.statd and that only NFSv4 locking is needed.
+ */
 struct lm_svc_args {
 	int		version;	/* keep this first */
 	int		fd;
 	enum lm_fmly	n_fmly;		/* protocol family */
 	enum lm_proto	n_proto;	/* protocol */
 	dev_t		n_rdev;		/* device ID */
-	int		debug;		/* debugging level */
+	int		n_v4_only;	/* NFSv4 locking only */
 	time_t		timout;		/* client handle life (asynch RPCs) */
 	int		grace;		/* secs in grace period */
 	time_t	retransmittimeout;	/* retransmission interval */
@@ -141,7 +149,7 @@ struct lm_svc_args32 {
 	enum lm_fmly	n_fmly;		/* protocol family */
 	enum lm_proto	n_proto;	/* protocol */
 	dev32_t		n_rdev;		/* device ID */
-	int32_t		debug;		/* debugging level */
+	int32_t		n_v4_only;	/* NFSv4 locking only */
 	time32_t	timout;		/* client handle life (asynch RPCs) */
 	int32_t		grace;		/* secs in grace period */
 	time32_t	retransmittimeout;	/* retransmission interval */
diff --git a/usr/src/uts/common/os/acct.c b/usr/src/uts/common/os/acct.c
index e598e0d08d..891c4e0836 100644
--- a/usr/src/uts/common/os/acct.c
+++ b/usr/src/uts/common/os/acct.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -47,6 +48,7 @@
 #include <sys/time.h>
 #include <sys/msacct.h>
 #include <sys/zone.h>
+#include <sys/brand.h>
 
 /*
  * Each zone has its own accounting settings (on or off) and associated
@@ -373,7 +375,7 @@ acct_compress(ulong_t t)
  * On exit, write a record on the accounting file.
  */
 void
-acct(char st)
+acct(int st)
 {
 	struct vnode *vp;
 	struct cred *cr;
@@ -402,6 +404,21 @@ acct(char st)
 	 * This only gets called from exit after all lwp's have exited so no
 	 * cred locking is needed.
 	 */
+
+	/* If there is a brand-specific hook, use it instead */
+	if (ZONE_IS_BRANDED(curzone) && ZBROP(curzone)->b_acct_out != NULL) {
+		ZBROP(curzone)->b_acct_out(vp, st);
+		mutex_exit(&ag->aclock);
+		return;
+	}
+
+	/*
+	 * The 'st' status value was traditionally masked this way by our
+	 * caller, but we now accept the unmasked value for brand handling.
+	 * Zones not using the brand hook mask the status here.
+	 */
+	st &= 0xff;
+
 	p = curproc;
 	ua = PTOU(p);
 	bcopy(ua->u_comm, ag->acctbuf.ac_comm, sizeof (ag->acctbuf.ac_comm));
diff --git a/usr/src/uts/common/os/brand.c b/usr/src/uts/common/os/brand.c
index 0af67f5d98..62c3bbe2d6 100644
--- a/usr/src/uts/common/os/brand.c
+++ b/usr/src/uts/common/os/brand.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016, Joyent, Inc.
  */
 
 #include <sys/kmem.h>
@@ -45,7 +46,7 @@ struct brand_mach_ops native_mach_ops  = {
 };
 #else /* !__sparcv9 */
 struct brand_mach_ops native_mach_ops  = {
-		NULL, NULL, NULL, NULL
+		NULL, NULL, NULL, NULL, NULL, NULL, NULL
 };
 #endif /* !__sparcv9 */
 
@@ -53,7 +54,8 @@ brand_t native_brand = {
 		BRAND_VER_1,
 		"native",
 		NULL,
-		&native_mach_ops
+		&native_mach_ops,
+		0
 };
 
 /*
@@ -310,46 +312,115 @@ brand_unregister_zone(struct brand *bp)
 	mutex_exit(&brand_list_lock);
 }
 
-void
-brand_setbrand(proc_t *p)
+int
+brand_setbrand(proc_t *p, boolean_t lwps_ok)
 {
 	brand_t *bp = p->p_zone->zone_brand;
+	void *brand_data = NULL;
 
-	ASSERT(bp != NULL);
-	ASSERT(p->p_brand == &native_brand);
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+	VERIFY(bp != NULL);
 
 	/*
-	 * We should only be called from exec(), when we know the process
-	 * is single-threaded.
+	 * Process branding occurs during fork() and exec().  When it happens
+	 * during fork(), the LWP count will always be 0 since branding is
+	 * performed as part of getproc(), before LWPs have been associated.
+	 * The same is not true during exec(), where a multi-LWP process may
+	 * undergo branding just prior to gexec(). This is to ensure
+	 * exec-related brand hooks are available.  While it may seem
+	 * complicated to brand a multi-LWP process, the two possible outcomes
+	 * simplify things:
+	 *
+	 * 1. The exec() succeeds:  LWPs besides the caller will be killed and
+	 *    any further branding will occur in a single-LWP context.
+	 * 2. The exec() fails: The process will be promptly unbranded since
+	 *    the hooks are no longer needed.
+	 *
+	 * To prevent inconsistent brand state from being encountered during
+	 * the exec(), LWPs beyond the caller which are associated with this
+	 * process must be held temporarily.  They will be released either when
+	 * they are killed in the exec() success, or when the brand is cleared
+	 * after exec() failure.
 	 */
-	ASSERT(p->p_tlist == p->p_tlist->t_forw);
+	if (lwps_ok) {
+		/*
+		 * We've been called from a exec() context tolerating the
+		 * existence of multiple LWPs during branding is necessary.
+		 */
+		VERIFY(p == curproc);
+		VERIFY(p->p_tlist != NULL);
 
+		if (p->p_tlist != p->p_tlist->t_forw) {
+			/*
+			 * Multiple LWPs are present.  Hold all but the caller.
+			 */
+			if (!holdlwps(SHOLDFORK1)) {
+				return (-1);
+			}
+		}
+	} else {
+		/*
+		 * Processes branded during fork() should not have LWPs at all.
+		 */
+		VERIFY(p->p_tlist == NULL);
+	}
+
+	if (bp->b_data_size > 0) {
+		brand_data = kmem_zalloc(bp->b_data_size, KM_SLEEP);
+	}
+
+	mutex_enter(&p->p_lock);
+	ASSERT(!PROC_IS_BRANDED(p));
 	p->p_brand = bp;
+	p->p_brand_data = brand_data;
 	ASSERT(PROC_IS_BRANDED(p));
 	BROP(p)->b_setbrand(p);
+	mutex_exit(&p->p_lock);
+	return (0);
 }
 
 void
-brand_clearbrand(proc_t *p, boolean_t no_lwps)
+brand_clearbrand(proc_t *p, boolean_t lwps_ok)
 {
 	brand_t *bp = p->p_zone->zone_brand;
-	klwp_t *lwp = NULL;
-	ASSERT(bp != NULL);
-	ASSERT(!no_lwps || (p->p_tlist == NULL));
+	void *brand_data;
 
-	/*
-	 * If called from exec_common() or proc_exit(),
-	 * we know the process is single-threaded.
-	 * If called from fork_fail, p_tlist is NULL.
-	 */
-	if (!no_lwps) {
-		ASSERT(p->p_tlist == p->p_tlist->t_forw);
-		lwp = p->p_tlist->t_lwp;
-	}
+	VERIFY(MUTEX_NOT_HELD(&p->p_lock));
+	VERIFY(bp != NULL);
+	VERIFY(PROC_IS_BRANDED(p));
 
-	ASSERT(PROC_IS_BRANDED(p));
-	BROP(p)->b_proc_exit(p, lwp);
+	if (BROP(p)->b_clearbrand != NULL)
+		BROP(p)->b_clearbrand(p, lwps_ok);
+
+	mutex_enter(&p->p_lock);
 	p->p_brand = &native_brand;
+	brand_data = p->p_brand_data;
+	p->p_brand_data = NULL;
+
+	if (lwps_ok) {
+		VERIFY(p == curproc);
+		/*
+		 * A process with multiple LWPs is being de-branded after
+		 * failing an exec.  The other LWPs were held as part of the
+		 * procedure, so they must be resumed now.
+		 */
+		if (p->p_tlist != NULL && p->p_tlist != p->p_tlist->t_forw) {
+			continuelwps(p);
+		}
+	} else {
+		/*
+		 * While clearing the brand, it's ok for one LWP to be present.
+		 * This happens when a native binary is executed inside a
+		 * branded zone, since the brand will be removed during the
+		 * course of a successful exec.
+		 */
+		VERIFY(p->p_tlist == NULL || p->p_tlist == p->p_tlist->t_forw);
+	}
+	mutex_exit(&p->p_lock);
+
+	if (brand_data != NULL) {
+		kmem_free(brand_data, bp->b_data_size);
+	}
 }
 
 #if defined(__sparcv9)
@@ -483,7 +554,7 @@ brand_solaris_cmd(int cmd, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3,
 		return (ENOSYS);
 
 	/* For all other operations this must be a branded process. */
-	if (p->p_brand == &native_brand)
+	if (!PROC_IS_BRANDED(p))
 		return (ENOSYS);
 
 	ASSERT(p->p_brand == pbrand);
@@ -601,15 +672,15 @@ restoreexecenv(struct execenv *ep, stack_t *sp)
 int
 brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
     intpdata_t *idatap, int level, long *execsz, int setid, caddr_t exec_file,
-    cred_t *cred, int brand_action, struct brand *pbrand, char *bname,
-    char *brandlib, char *brandlib32, char *brandlinker, char *brandlinker32)
+    cred_t *cred, int *brand_action, struct brand *pbrand, char *bname,
+    char *brandlib, char *brandlib32)
 {
 
 	vnode_t		*nvp;
 	Ehdr		ehdr;
 	Addr		uphdr_vaddr;
 	intptr_t	voffset;
-	int		interp;
+	char		*interp;
 	int		i, err;
 	struct execenv	env;
 	struct execenv	origenv;
@@ -619,7 +690,6 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 	klwp_t		*lwp = ttolwp(curthread);
 	brand_proc_data_t	*spd;
 	brand_elf_data_t sed, *sedp;
-	char		*linker;
 	uintptr_t	lddata; /* lddata of executable's linker */
 
 	ASSERT(curproc->p_brand == pbrand);
@@ -636,12 +706,10 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 	 */
 	if (args->to_model == DATAMODEL_NATIVE) {
 		args->emulator = brandlib;
-		linker = brandlinker;
 	}
 #if defined(_LP64)
 	else {
 		args->emulator = brandlib32;
-		linker = brandlinker32;
 	}
 #endif  /* _LP64 */
 
@@ -725,7 +793,7 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 	if (args->to_model == DATAMODEL_NATIVE) {
 		err = mapexec_brand(vp, args, &ehdr, &uphdr_vaddr,
 		    &voffset, exec_file, &interp, &env.ex_bssbase,
-		    &env.ex_brkbase, &env.ex_brksize, NULL);
+		    &env.ex_brkbase, &env.ex_brksize, NULL, NULL);
 	}
 #if defined(_LP64)
 	else {
@@ -733,7 +801,7 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 		Elf32_Addr uphdr_vaddr32;
 		err = mapexec32_brand(vp, args, &ehdr32, &uphdr_vaddr32,
 		    &voffset, exec_file, &interp, &env.ex_bssbase,
-		    &env.ex_brkbase, &env.ex_brksize, NULL);
+		    &env.ex_brkbase, &env.ex_brksize, NULL, NULL);
 		Ehdr32to64(&ehdr32, &ehdr);
 
 		if (uphdr_vaddr32 == (Elf32_Addr)-1)
@@ -744,6 +812,10 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 #endif  /* _LP64 */
 	if (err != 0) {
 		restoreexecenv(&origenv, &orig_sigaltstack);
+
+		if (interp != NULL)
+			kmem_free(interp, MAXPATHLEN);
+
 		return (err);
 	}
 
@@ -761,7 +833,7 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 	sedp->sed_phent = ehdr.e_phentsize;
 	sedp->sed_phnum = ehdr.e_phnum;
 
-	if (interp) {
+	if (interp != NULL) {
 		if (ehdr.e_type == ET_DYN) {
 			/*
 			 * This is a shared object executable, so we
@@ -777,16 +849,20 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 		 * it in and store relevant information about it in the
 		 * aux vector, where the brand library can find it.
 		 */
-		if ((err = lookupname(linker, UIO_SYSSPACE,
+		if ((err = lookupname(interp, UIO_SYSSPACE,
 		    FOLLOW, NULLVPP, &nvp)) != 0) {
-			uprintf("%s: not found.", brandlinker);
+			uprintf("%s: not found.", interp);
 			restoreexecenv(&origenv, &orig_sigaltstack);
+			kmem_free(interp, MAXPATHLEN);
 			return (err);
 		}
+
+		kmem_free(interp, MAXPATHLEN);
+
 		if (args->to_model == DATAMODEL_NATIVE) {
 			err = mapexec_brand(nvp, args, &ehdr,
 			    &uphdr_vaddr, &voffset, exec_file, &interp,
-			    NULL, NULL, NULL, &lddata);
+			    NULL, NULL, NULL, &lddata, NULL);
 		}
 #if defined(_LP64)
 		else {
@@ -794,7 +870,7 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 			Elf32_Addr uphdr_vaddr32;
 			err = mapexec32_brand(nvp, args, &ehdr32,
 			    &uphdr_vaddr32, &voffset, exec_file, &interp,
-			    NULL, NULL, NULL, &lddata);
+			    NULL, NULL, NULL, &lddata, NULL);
 			Ehdr32to64(&ehdr32, &ehdr);
 
 			if (uphdr_vaddr32 == (Elf32_Addr)-1)
@@ -934,9 +1010,9 @@ brand_solaris_elfexec(vnode_t *vp, execa_t *uap, uarg_t *args,
 
 	/*
 	 * Third, the /proc aux vectors set up by elfexec() point to
-	 * brand emulation library and it's linker.  Copy these to the
+	 * brand emulation library and its linker.  Copy these to the
 	 * /proc brand specific aux vector, and update the regular
-	 * /proc aux vectors to point to the executable (and it's
+	 * /proc aux vectors to point to the executable (and its
 	 * linker).  This will enable debuggers to access the
 	 * executable via the usual /proc or elf notes aux vectors.
 	 *
@@ -1078,55 +1154,31 @@ brand_solaris_freelwp(klwp_t *l, struct brand *pbrand)
 }
 
 /*ARGSUSED*/
-int
+void
 brand_solaris_initlwp(klwp_t *l, struct brand *pbrand)
 {
 	ASSERT(l->lwp_procp->p_brand == pbrand);
 	ASSERT(l->lwp_procp->p_brand_data != NULL);
 	ASSERT(l->lwp_brand == NULL);
 	l->lwp_brand = (void *)-1;
-	return (0);
 }
 
 /*ARGSUSED*/
 void
 brand_solaris_lwpexit(klwp_t *l, struct brand *pbrand)
 {
-	proc_t  *p = l->lwp_procp;
-
 	ASSERT(l->lwp_procp->p_brand == pbrand);
 	ASSERT(l->lwp_procp->p_brand_data != NULL);
 	ASSERT(l->lwp_brand != NULL);
-
-	/*
-	 * We should never be called for the last thread in a process.
-	 * (That case is handled by brand_solaris_proc_exit().)
-	 * Therefore this lwp must be exiting from a multi-threaded
-	 * process.
-	 */
-	ASSERT(p->p_tlist != p->p_tlist->t_forw);
-
-	l->lwp_brand = NULL;
 }
 
 /*ARGSUSED*/
 void
-brand_solaris_proc_exit(struct proc *p, klwp_t *l, struct brand *pbrand)
+brand_solaris_proc_exit(struct proc *p, struct brand *pbrand)
 {
 	ASSERT(p->p_brand == pbrand);
 	ASSERT(p->p_brand_data != NULL);
 
-	/*
-	 * When called from proc_exit(), we know that process is
-	 * single-threaded and free our lwp brand data.
-	 * otherwise just free p_brand_data and return.
-	 */
-	if (l != NULL) {
-		ASSERT(p->p_tlist == p->p_tlist->t_forw);
-		ASSERT(p->p_tlist->t_lwp == l);
-		(void) brand_solaris_freelwp(l, pbrand);
-	}
-
 	/* upon exit, free our proc brand data */
 	kmem_free(p->p_brand_data, sizeof (brand_proc_data_t));
 	p->p_brand_data = NULL;
@@ -1145,5 +1197,4 @@ brand_solaris_setbrand(proc_t *p, struct brand *pbrand)
 	ASSERT(p->p_tlist == p->p_tlist->t_forw);
 
 	p->p_brand_data = kmem_zalloc(sizeof (brand_proc_data_t), KM_SLEEP);
-	(void) brand_solaris_initlwp(p->p_tlist->t_lwp, pbrand);
 }
diff --git a/usr/src/uts/common/os/clock_highres.c b/usr/src/uts/common/os/clock_highres.c
index 805813037d..1280c8a1b6 100644
--- a/usr/src/uts/common/os/clock_highres.c
+++ b/usr/src/uts/common/os/clock_highres.c
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2015, Joyent Inc. All rights reserved.
+ * Copyright 2016, Joyent Inc.
  */
 
 #include <sys/timer.h>
@@ -41,6 +41,9 @@
 
 static clock_backend_t clock_highres;
 
+/* minimum non-privileged interval (200us) */
+long clock_highres_interval_min = 200000;
+
 /*ARGSUSED*/
 static int
 clock_highres_settime(timespec_t *ts)
@@ -68,17 +71,6 @@ clock_highres_getres(timespec_t *ts)
 static int
 clock_highres_timer_create(itimer_t *it, void (*fire)(itimer_t *))
 {
-	/*
-	 * CLOCK_HIGHRES timers of sufficiently high resolution can deny
-	 * service; only allow privileged users to create such timers.
-	 * Sites that do not wish to have this restriction should
-	 * give users the "proc_clock_highres" privilege.
-	 */
-	if (secpolicy_clock_highres(CRED()) != 0) {
-		it->it_arg = NULL;
-		return (EPERM);
-	}
-
 	it->it_arg = kmem_zalloc(sizeof (cyclic_id_t), KM_SLEEP);
 	it->it_fire = fire;
 
@@ -111,6 +103,49 @@ clock_highres_timer_settime(itimer_t *it, int flags,
 	cpu_t *cpu;
 	cpupart_t *cpupart;
 	int pset;
+	boolean_t value_need_clamp = B_FALSE;
+	boolean_t intval_need_clamp = B_FALSE;
+	cred_t *cr = CRED();
+	struct itimerspec clamped;
+
+	/*
+	 * CLOCK_HIGHRES timers of sufficiently high resolution can deny
+	 * service; only allow privileged users to create such timers.
+	 * Non-privileged users (those without the "proc_clock_highres"
+	 * privilege) can create timers with lower resolution but if they
+	 * attempt to use a very low time value (< 200us) then their
+	 * timer will be clamped at 200us.
+	 */
+	if (when->it_value.tv_sec == 0 &&
+	    when->it_value.tv_nsec > 0 &&
+	    when->it_value.tv_nsec < clock_highres_interval_min)
+		value_need_clamp = B_TRUE;
+
+	if (when->it_interval.tv_sec == 0 &&
+	    when->it_interval.tv_nsec > 0 &&
+	    when->it_interval.tv_nsec < clock_highres_interval_min)
+		intval_need_clamp = B_TRUE;
+
+	if ((value_need_clamp || intval_need_clamp) &&
+	    secpolicy_clock_highres(cr) != 0) {
+		clamped.it_value.tv_sec = when->it_value.tv_sec;
+		clamped.it_interval.tv_sec = when->it_interval.tv_sec;
+
+		if (value_need_clamp) {
+			clamped.it_value.tv_nsec = clock_highres_interval_min;
+		} else {
+			clamped.it_value.tv_nsec = when->it_value.tv_nsec;
+		}
+
+		if (intval_need_clamp) {
+			clamped.it_interval.tv_nsec =
+			    clock_highres_interval_min;
+		} else {
+			clamped.it_interval.tv_nsec = when->it_interval.tv_nsec;
+		}
+
+		when = &clamped;
+	}
 
 	cyctime.cyt_when = ts2hrt(&when->it_value);
 	cyctime.cyt_interval = ts2hrt(&when->it_interval);
diff --git a/usr/src/uts/common/os/contract.c b/usr/src/uts/common/os/contract.c
index 909a6c2860..1a3502a710 100644
--- a/usr/src/uts/common/os/contract.c
+++ b/usr/src/uts/common/os/contract.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 /*
  * Copyright (c) 2017 by Delphix. All rights reserved.
@@ -290,7 +291,10 @@ contract_ctor(contract_t *ct, ct_type_t *type, ct_template_t *tmpl, void *data,
 	avl_index_t where;
 	klwp_t *curlwp = ttolwp(curthread);
 
-	ASSERT(author == curproc);
+	/*
+	 * It's possible that author is not curproc if the zone is creating
+	 * a new process as a child of zsched.
+	 */
 
 	mutex_init(&ct->ct_lock, NULL, MUTEX_DEFAULT, NULL);
 	mutex_init(&ct->ct_reflock, NULL, MUTEX_DEFAULT, NULL);
diff --git a/usr/src/uts/common/os/core.c b/usr/src/uts/common/os/core.c
index d5e272c16a..437f26e6e0 100644
--- a/usr/src/uts/common/os/core.c
+++ b/usr/src/uts/common/os/core.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, Joyent Inc. All rights reserved.
+ * Copyright 2016, Joyent Inc.
  * Copyright (c) 2016 by Delphix. All rights reserved.
  */
 
@@ -125,6 +125,7 @@ remove_core_file(char *fp, enum core_types core_type)
 	/*
 	 * Determine what rootvp to use.
 	 */
+	mutex_enter(&curproc->p_lock);
 	if (core_type == CORE_PROC) {
 		rootvp = (PTOU(curproc)->u_rdir == NULL ?
 		    curproc->p_zone->zone_rootvp : PTOU(curproc)->u_rdir);
@@ -140,6 +141,7 @@ remove_core_file(char *fp, enum core_types core_type)
 	VN_HOLD(startvp);
 	if (rootvp != rootdir)
 		VN_HOLD(rootvp);
+	mutex_exit(&curproc->p_lock);
 	if ((error = lookuppnvp(&pn, NULL, NO_FOLLOW, &dvp, &vp, rootvp,
 	    startvp, CRED())) != 0) {
 		pn_free(&pn);
diff --git a/usr/src/uts/common/os/cpu.c b/usr/src/uts/common/os/cpu.c
index 87c0896814..4648dae9dd 100644
--- a/usr/src/uts/common/os/cpu.c
+++ b/usr/src/uts/common/os/cpu.c
@@ -21,6 +21,7 @@
 /*
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -108,7 +109,8 @@ kmutex_t	cpu_lock;
 cpu_t		*cpu_list;		/* list of all CPUs */
 cpu_t		*clock_cpu_list;	/* used by clock to walk CPUs */
 cpu_t		*cpu_active;		/* list of active CPUs */
-static cpuset_t	cpu_available;		/* set of available CPUs */
+cpuset_t	cpu_active_set;		/* cached set of active CPUs */
+cpuset_t	cpu_available;		/* set of available CPUs */
 cpuset_t	cpu_seqid_inuse;	/* which cpu_seqids are in use */
 
 cpu_t		**cpu_seq;		/* ptrs to CPUs, indexed by seq_id */
@@ -386,36 +388,56 @@ force_thread_migrate(kthread_id_t tp)
 
 /*
  * Set affinity for a specified CPU.
- * A reference count is incremented and the affinity is held until the
- * reference count is decremented to zero by thread_affinity_clear().
- * This is so regions of code requiring affinity can be nested.
- * Caller needs to ensure that cpu_id remains valid, which can be
- * done by holding cpu_lock across this call, unless the caller
- * specifies CPU_CURRENT in which case the cpu_lock will be acquired
- * by thread_affinity_set and CPU->cpu_id will be the target CPU.
+ *
+ * Specifying a cpu_id of CPU_CURRENT, allowed _only_ when setting affinity for
+ * curthread, will set affinity to the CPU on which the thread is currently
+ * running.  For other cpu_id values, the caller must ensure that the
+ * referenced CPU remains valid, which can be done by holding cpu_lock across
+ * this call.
+ *
+ * CPU affinity is guaranteed after return of thread_affinity_set().  If a
+ * caller setting affinity to CPU_CURRENT requires that its thread not migrate
+ * CPUs prior to a successful return, it should take extra precautions (such as
+ * their own call to kpreempt_disable) to ensure that safety.
+ *
+ * CPU_BEST can be used to pick a "best" CPU to migrate to, including
+ * potentially the current CPU.
+ *
+ * A CPU affinity reference count is maintained by thread_affinity_set and
+ * thread_affinity_clear (incrementing and decrementing it, respectively),
+ * maintaining CPU affinity while the count is non-zero, and allowing regions
+ * of code which require affinity to be nested.
  */
 void
 thread_affinity_set(kthread_id_t t, int cpu_id)
 {
-	cpu_t		*cp;
-	int		c;
+	cpu_t *cp;
 
 	ASSERT(!(t == curthread && t->t_weakbound_cpu != NULL));
 
-	if ((c = cpu_id) == CPU_CURRENT) {
-		mutex_enter(&cpu_lock);
-		cpu_id = CPU->cpu_id;
+	if (cpu_id == CPU_CURRENT) {
+		VERIFY3P(t, ==, curthread);
+		kpreempt_disable();
+		cp = CPU;
+	} else if (cpu_id == CPU_BEST) {
+		VERIFY3P(t, ==, curthread);
+		kpreempt_disable();
+		cp = disp_choose_best_cpu();
+	} else {
+		/*
+		 * We should be asserting that cpu_lock is held here, but
+		 * the NCA code doesn't acquire it.  The following assert
+		 * should be uncommented when the NCA code is fixed.
+		 *
+		 * ASSERT(MUTEX_HELD(&cpu_lock));
+		 */
+		VERIFY((cpu_id >= 0) && (cpu_id < NCPU));
+		cp = cpu[cpu_id];
+
+		/* user must provide a good cpu_id */
+		VERIFY(cp != NULL);
 	}
-	/*
-	 * We should be asserting that cpu_lock is held here, but
-	 * the NCA code doesn't acquire it.  The following assert
-	 * should be uncommented when the NCA code is fixed.
-	 *
-	 * ASSERT(MUTEX_HELD(&cpu_lock));
-	 */
-	ASSERT((cpu_id >= 0) && (cpu_id < NCPU));
-	cp = cpu[cpu_id];
-	ASSERT(cp != NULL);		/* user must provide a good cpu_id */
+
 	/*
 	 * If there is already a hard affinity requested, and this affinity
 	 * conflicts with that, panic.
@@ -432,13 +454,14 @@ thread_affinity_set(kthread_id_t t, int cpu_id)
 	 * Make sure we're running on the right CPU.
 	 */
 	if (cp != t->t_cpu || t != curthread) {
+		ASSERT(cpu_id != CPU_CURRENT);
 		force_thread_migrate(t);	/* drops thread lock */
 	} else {
 		thread_unlock(t);
 	}
 
-	if (c == CPU_CURRENT)
-		mutex_exit(&cpu_lock);
+	if (cpu_id == CPU_CURRENT || cpu_id == CPU_BEST)
+		kpreempt_enable();
 }
 
 /*
@@ -1473,8 +1496,8 @@ again:	for (loop_count = 0; (*bound_func)(cp, 0); loop_count++) {
 				 * Update CPU last ran on if it was this CPU
 				 */
 				if (t->t_cpu == cp && t->t_bound_cpu != cp)
-					t->t_cpu = disp_lowpri_cpu(ncp,
-					    t->t_lpl, t->t_pri, NULL);
+					t->t_cpu = disp_lowpri_cpu(ncp, t,
+					    t->t_pri);
 				ASSERT(t->t_cpu != cp || t->t_bound_cpu == cp ||
 				    t->t_weakbound_cpu == cp);
 
@@ -1516,10 +1539,9 @@ again:	for (loop_count = 0; (*bound_func)(cp, 0); loop_count++) {
 			 * Update CPU last ran on if it was this CPU
 			 */
 
-			if (t->t_cpu == cp && t->t_bound_cpu != cp) {
-				t->t_cpu = disp_lowpri_cpu(ncp,
-				    t->t_lpl, t->t_pri, NULL);
-			}
+			if (t->t_cpu == cp && t->t_bound_cpu != cp)
+				t->t_cpu = disp_lowpri_cpu(ncp, t, t->t_pri);
+
 			ASSERT(t->t_cpu != cp || t->t_bound_cpu == cp ||
 			    t->t_weakbound_cpu == cp);
 			t = t->t_next;
@@ -1724,6 +1746,7 @@ cpu_list_init(cpu_t *cp)
 	cp->cpu_part = &cp_default;
 
 	CPUSET_ADD(cpu_available, cp->cpu_id);
+	CPUSET_ADD(cpu_active_set, cp->cpu_id);
 }
 
 /*
@@ -1895,6 +1918,7 @@ cpu_add_active_internal(cpu_t *cp)
 	cp->cpu_prev_onln = cpu_active->cpu_prev_onln;
 	cpu_active->cpu_prev_onln->cpu_next_onln = cp;
 	cpu_active->cpu_prev_onln = cp;
+	CPUSET_ADD(cpu_active_set, cp->cpu_id);
 
 	if (pp->cp_cpulist) {
 		cp->cpu_next_part = pp->cp_cpulist;
@@ -1965,6 +1989,7 @@ cpu_remove_active(cpu_t *cp)
 	}
 	cp->cpu_next_onln = cp;
 	cp->cpu_prev_onln = cp;
+	CPUSET_DEL(cpu_active_set, cp->cpu_id);
 
 	cp->cpu_prev_part->cpu_next_part = cp->cpu_next_part;
 	cp->cpu_next_part->cpu_prev_part = cp->cpu_prev_part;
@@ -2704,13 +2729,18 @@ cpu_bind_thread(kthread_id_t tp, processorid_t bind, processorid_t *obind,
 	return (0);
 }
 
-#if CPUSET_WORDS > 1
 
-/*
- * Functions for implementing cpuset operations when a cpuset is more
- * than one word.  On platforms where a cpuset is a single word these
- * are implemented as macros in cpuvar.h.
- */
+cpuset_t *
+cpuset_alloc(int kmflags)
+{
+	return (kmem_alloc(sizeof (cpuset_t), kmflags));
+}
+
+void
+cpuset_free(cpuset_t *s)
+{
+	kmem_free(s, sizeof (cpuset_t));
+}
 
 void
 cpuset_all(cpuset_t *s)
@@ -2722,38 +2752,61 @@ cpuset_all(cpuset_t *s)
 }
 
 void
-cpuset_all_but(cpuset_t *s, uint_t cpu)
+cpuset_all_but(cpuset_t *s, const uint_t cpu)
 {
 	cpuset_all(s);
 	CPUSET_DEL(*s, cpu);
 }
 
 void
-cpuset_only(cpuset_t *s, uint_t cpu)
+cpuset_only(cpuset_t *s, const uint_t cpu)
 {
 	CPUSET_ZERO(*s);
 	CPUSET_ADD(*s, cpu);
 }
 
+long
+cpu_in_set(cpuset_t *s, const uint_t cpu)
+{
+	VERIFY(cpu < NCPU);
+	return (BT_TEST(s->cpub, cpu));
+}
+
+void
+cpuset_add(cpuset_t *s, const uint_t cpu)
+{
+	VERIFY(cpu < NCPU);
+	BT_SET(s->cpub, cpu);
+}
+
+void
+cpuset_del(cpuset_t *s, const uint_t cpu)
+{
+	VERIFY(cpu < NCPU);
+	BT_CLEAR(s->cpub, cpu);
+}
+
 int
 cpuset_isnull(cpuset_t *s)
 {
 	int i;
 
-	for (i = 0; i < CPUSET_WORDS; i++)
+	for (i = 0; i < CPUSET_WORDS; i++) {
 		if (s->cpub[i] != 0)
 			return (0);
+	}
 	return (1);
 }
 
 int
-cpuset_cmp(cpuset_t *s1, cpuset_t *s2)
+cpuset_isequal(cpuset_t *s1, cpuset_t *s2)
 {
 	int i;
 
-	for (i = 0; i < CPUSET_WORDS; i++)
+	for (i = 0; i < CPUSET_WORDS; i++) {
 		if (s1->cpub[i] != s2->cpub[i])
 			return (0);
+	}
 	return (1);
 }
 
@@ -2822,7 +2875,72 @@ cpuset_bounds(cpuset_t *s, uint_t *smallestid, uint_t *largestid)
 	*smallestid = *largestid = CPUSET_NOTINSET;
 }
 
-#endif	/* CPUSET_WORDS */
+void
+cpuset_atomic_del(cpuset_t *s, const uint_t cpu)
+{
+	VERIFY(cpu < NCPU);
+	BT_ATOMIC_CLEAR(s->cpub, (cpu))
+}
+
+void
+cpuset_atomic_add(cpuset_t *s, const uint_t cpu)
+{
+	VERIFY(cpu < NCPU);
+	BT_ATOMIC_SET(s->cpub, (cpu))
+}
+
+long
+cpuset_atomic_xadd(cpuset_t *s, const uint_t cpu)
+{
+	long res;
+
+	VERIFY(cpu < NCPU);
+	BT_ATOMIC_SET_EXCL(s->cpub, cpu, res);
+	return (res);
+}
+
+long
+cpuset_atomic_xdel(cpuset_t *s, const uint_t cpu)
+{
+	long res;
+
+	VERIFY(cpu < NCPU);
+	BT_ATOMIC_CLEAR_EXCL(s->cpub, cpu, res);
+	return (res);
+}
+
+void
+cpuset_or(cpuset_t *dst, cpuset_t *src)
+{
+	for (int i = 0; i < CPUSET_WORDS; i++) {
+		dst->cpub[i] |= src->cpub[i];
+	}
+}
+
+void
+cpuset_xor(cpuset_t *dst, cpuset_t *src)
+{
+	for (int i = 0; i < CPUSET_WORDS; i++) {
+		dst->cpub[i] ^= src->cpub[i];
+	}
+}
+
+void
+cpuset_and(cpuset_t *dst, cpuset_t *src)
+{
+	for (int i = 0; i < CPUSET_WORDS; i++) {
+		dst->cpub[i] &= src->cpub[i];
+	}
+}
+
+void
+cpuset_zero(cpuset_t *dst)
+{
+	for (int i = 0; i < CPUSET_WORDS; i++) {
+		dst->cpub[i] = 0;
+	}
+}
+
 
 /*
  * Unbind threads bound to specified CPU.
diff --git a/usr/src/uts/common/os/cred.c b/usr/src/uts/common/os/cred.c
index 25727d54c5..0bd6cfd44f 100644
--- a/usr/src/uts/common/os/cred.c
+++ b/usr/src/uts/common/os/cred.c
@@ -729,6 +729,14 @@ crgetzoneid(const cred_t *cr)
 	    cr->cr_zone->zone_id);
 }
 
+zoneid_t
+crgetzonedid(const cred_t *cr)
+{
+	return (cr->cr_zone == NULL ?
+	    (cr->cr_uid == -1 ? (zoneid_t)-1 : GLOBAL_ZONEID) :
+	    cr->cr_zone->zone_did);
+}
+
 projid_t
 crgetprojid(const cred_t *cr)
 {
diff --git a/usr/src/uts/common/os/cyclic.c b/usr/src/uts/common/os/cyclic.c
index 21907b4957..45e13ebeab 100644
--- a/usr/src/uts/common/os/cyclic.c
+++ b/usr/src/uts/common/os/cyclic.c
@@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2012, Joyent Inc. All rights reserved.
+ * Copyright 2018 Joyent Inc.
  */
 
 /*
@@ -112,6 +112,7 @@
  *      cyclic_remove()      <-- Removes a cyclic
  *      cyclic_bind()        <-- Change a cyclic's CPU or partition binding
  *      cyclic_reprogram()   <-- Reprogram a cyclic's expiration
+ *      cyclic_move_here()   <-- Shuffle cyclic to current CPU
  *
  *  Inter-subsystem Interfaces
  *
@@ -3111,6 +3112,61 @@ cyclic_reprogram(cyclic_id_t id, hrtime_t expiration)
 	return (1);
 }
 
+/*
+ *  void cyclic_move_here(cyclic_id_t)
+ *
+ *  Overview
+ *
+ *    cyclic_move_here() attempts to shuffle a cyclic onto the current CPU.
+ *
+ *  Arguments and notes
+ *
+ *    The first argument is a cyclic_id returned from cyclic_add().
+ *    cyclic_move_here() may _not_ be called on a cyclic_id returned from
+ *    cyclic_add_omni() or one bound to a CPU or partition via cyclic_bind().
+ *
+ *    This cyclic shuffling is performed on a best-effort basis.  If for some
+ *    reason the current CPU is unsuitable or the thread migrates between CPUs
+ *    during the call, the function may return with the cyclic residing on some
+ *    other CPU.
+ *
+ *  Return value
+ *
+ *    None; cyclic_move_here() always reports success.
+ *
+ *  Caller's context
+ *
+ *    cpu_lock must be held by the caller, and the caller must not be in
+ *    interrupt context.  The caller may not hold any locks which are also
+ *    grabbed by any cyclic handler.
+ */
+void
+cyclic_move_here(cyclic_id_t id)
+{
+	cyc_id_t *idp = (cyc_id_t *)id;
+	cyc_cpu_t *cc = idp->cyi_cpu;
+	cpu_t *dest = CPU;
+
+	ASSERT(MUTEX_HELD(&cpu_lock));
+	CYC_PTRACE("move_here", idp, dest);
+	VERIFY3P(cc, !=, NULL);
+	VERIFY3U(cc->cyp_cyclics[idp->cyi_ndx].cy_flags &
+	    (CYF_CPU_BOUND|CYF_PART_BOUND), ==, 0);
+
+	if (cc->cyp_cpu == dest) {
+		return;
+	}
+
+	/* Is the destination CPU suitable for a migration target? */
+	if (dest->cpu_cyclic == NULL ||
+	    dest->cpu_cyclic->cyp_state == CYS_OFFLINE ||
+	    (dest->cpu_flags & CPU_ENABLE) == 0) {
+		return;
+	}
+
+	cyclic_juggle_one_to(idp, dest->cpu_cyclic);
+}
+
 hrtime_t
 cyclic_getres()
 {
diff --git a/usr/src/uts/common/os/ddi_intr_irm.c b/usr/src/uts/common/os/ddi_intr_irm.c
index c3c0481e7f..a4b35dcb5b 100644
--- a/usr/src/uts/common/os/ddi_intr_irm.c
+++ b/usr/src/uts/common/os/ddi_intr_irm.c
@@ -1320,7 +1320,7 @@ i_ddi_irm_notify(ddi_irm_pool_t *pool_p, ddi_irm_req_t *req_p)
 
 	/* Log callback errors */
 	if (ret != DDI_SUCCESS) {
-		cmn_err(CE_WARN, "%s%d: failed callback (action=%d, ret=%d)\n",
+		cmn_err(CE_WARN, "!%s%d: failed callback (action=%d, ret=%d)\n",
 		    ddi_driver_name(req_p->ireq_dip),
 		    ddi_get_instance(req_p->ireq_dip), (int)action, ret);
 	}
diff --git a/usr/src/uts/common/os/exec.c b/usr/src/uts/common/os/exec.c
index 53c552f135..96b6081489 100644
--- a/usr/src/uts/common/os/exec.c
+++ b/usr/src/uts/common/os/exec.c
@@ -99,6 +99,7 @@ uint_t auxv_hwcap32_2 = 0;	/* 32-bit version of auxv_hwcap2 */
 #endif
 
 #define	PSUIDFLAGS		(SNOCD|SUGID)
+#define	RANDOM_LEN	16	/* 16 bytes for AT_RANDOM aux entry */
 
 /*
  * These are consumed within the specific exec modules, but are defined here
@@ -265,8 +266,10 @@ exec_common(const char *fname, const char **argp, const char **envp,
 	 * only if the pathname does not contain a "/" the resolved path
 	 * points to a file in the current working (attribute) directory.
 	 */
-	if ((p->p_user.u_cdir->v_flag & V_XATTRDIR) != 0 &&
+	mutex_enter(&p->p_lock);
+	if ((PTOU(p)->u_cdir->v_flag & V_XATTRDIR) != 0 &&
 	    strchr(resolvepn.pn_path, '/') == NULL) {
+		mutex_exit(&p->p_lock);
 		if (dir != NULL)
 			VN_RELE(dir);
 		error = EACCES;
@@ -275,6 +278,7 @@ exec_common(const char *fname, const char **argp, const char **envp,
 		VN_RELE(vp);
 		goto out;
 	}
+	mutex_exit(&p->p_lock);
 
 	bzero(exec_file, MAXCOMLEN+1);
 	(void) strncpy(exec_file, pn.pn_path, MAXCOMLEN);
@@ -322,14 +326,43 @@ exec_common(const char *fname, const char **argp, const char **envp,
 	ua.argp = argp;
 	ua.envp = envp;
 
-	/* If necessary, brand this process before we start the exec. */
-	if (brandme)
-		brand_setbrand(p);
+	/* If necessary, brand this process/lwp before we start the exec. */
+	if (brandme) {
+		void *brand_data = NULL;
+
+		/*
+		 * Process branding may fail if multiple LWPs are present and
+		 * holdlwps() cannot complete successfully.
+		 */
+		error = brand_setbrand(p, B_TRUE);
+
+		if (error == 0 && BROP(p)->b_lwpdata_alloc != NULL) {
+			brand_data = BROP(p)->b_lwpdata_alloc(p);
+			if (brand_data == NULL) {
+				error = 1;
+			}
+		}
+
+		if (error == 0) {
+			mutex_enter(&p->p_lock);
+			BROP(p)->b_initlwp(lwp, brand_data);
+			mutex_exit(&p->p_lock);
+		} else {
+			VN_RELE(vp);
+			if (dir != NULL) {
+				VN_RELE(dir);
+			}
+			pn_free(&resolvepn);
+			goto fail;
+		}
+	}
 
 	if ((error = gexec(&vp, &ua, &args, NULL, 0, &execsz,
-	    exec_file, p->p_cred, brand_action)) != 0) {
-		if (brandme)
-			brand_clearbrand(p, B_FALSE);
+	    exec_file, p->p_cred, &brand_action)) != 0) {
+		if (brandme) {
+			BROP(p)->b_freelwp(lwp);
+			brand_clearbrand(p, B_TRUE);
+		}
 		VN_RELE(vp);
 		if (dir != NULL)
 			VN_RELE(dir);
@@ -361,7 +394,7 @@ exec_common(const char *fname, const char **argp, const char **envp,
 	/*
 	 * Clear contract template state
 	 */
-	lwp_ctmpl_clear(lwp);
+	lwp_ctmpl_clear(lwp, B_TRUE);
 
 	/*
 	 * Save the directory in which we found the executable for expanding
@@ -385,6 +418,8 @@ exec_common(const char *fname, const char **argp, const char **envp,
 	 * pending held signals remain held, so don't clear t_hold.
 	 */
 	mutex_enter(&p->p_lock);
+	DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
+	    uintptr_t, lwp->lwp_oldcontext, uintptr_t, 0);
 	lwp->lwp_oldcontext = 0;
 	lwp->lwp_ustack = 0;
 	lwp->lwp_old_stk_ctl = 0;
@@ -444,8 +479,10 @@ exec_common(const char *fname, const char **argp, const char **envp,
 	TRACE_2(TR_FAC_PROC, TR_PROC_EXEC, "proc_exec:p %p up %p", p, up);
 
 	/* Unbrand ourself if necessary. */
-	if (PROC_IS_BRANDED(p) && (brand_action == EBA_NATIVE))
+	if (PROC_IS_BRANDED(p) && (brand_action == EBA_NATIVE)) {
+		BROP(p)->b_freelwp(lwp);
 		brand_clearbrand(p, B_FALSE);
+	}
 
 	setregs(&args);
 
@@ -569,7 +606,7 @@ gexec(
 	long *execsz,
 	caddr_t exec_file,
 	struct cred *cred,
-	int brand_action)
+	int *brand_action)
 {
 	struct vnode *vp, *execvp = NULL;
 	proc_t *pp = ttoproc(curthread);
@@ -890,8 +927,14 @@ gexec(
 			if (pp->p_plist || (pp->p_proc_flag & P_PR_TRACE))
 				args->traceinval = 1;
 		}
-		if (pp->p_proc_flag & P_PR_PTRACE)
+
+		/*
+		 * If legacy ptrace is enabled, generate the SIGTRAP.
+		 */
+		if (pp->p_proc_flag & P_PR_PTRACE) {
 			psignal(pp, SIGTRAP);
+		}
+
 		if (args->traceinval)
 			prinvalidate(&pp->p_user);
 	}
@@ -1555,6 +1598,27 @@ stk_add(uarg_t *args, const char *sp, enum uio_seg segflg)
 	return (0);
 }
 
+/*
+ * Add a fixed size byte array to the stack (only from kernel space).
+ */
+static int
+stk_byte_add(uarg_t *args, const uint8_t *sp, size_t len)
+{
+	int error;
+
+	if (STK_AVAIL(args) < sizeof (int))
+		return (E2BIG);
+	*--args->stk_offp = args->stk_strp - args->stk_base;
+
+	if (len > STK_AVAIL(args))
+		return (E2BIG);
+	bcopy(sp, args->stk_strp, len);
+
+	args->stk_strp += len;
+
+	return (0);
+}
+
 static int
 stk_getptr(uarg_t *args, char *src, char **dst)
 {
@@ -1591,6 +1655,7 @@ stk_copyin(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
 	size_t size, pad;
 	char *argv = (char *)uap->argp;
 	char *envp = (char *)uap->envp;
+	uint8_t rdata[RANDOM_LEN];
 
 	/*
 	 * Copy interpreter's name and argument to argv[0] and argv[1].
@@ -1673,8 +1738,9 @@ stk_copyin(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
 	args->ne = args->na - argc;
 
 	/*
-	 * Add AT_SUN_PLATFORM, AT_SUN_EXECNAME, AT_SUN_BRANDNAME, and
-	 * AT_SUN_EMULATOR strings to the stack.
+	 * Add AT_SUN_PLATFORM, AT_SUN_EXECNAME, AT_SUN_BRANDNAME,
+	 * AT_SUN_BRAND_NROOT, and AT_SUN_EMULATOR strings, as well as AT_RANDOM
+	 * array, to the stack.
 	 */
 	if (auxvpp != NULL && *auxvpp != NULL) {
 		if ((error = stk_add(args, platform, UIO_SYSSPACE)) != 0)
@@ -1687,6 +1753,20 @@ stk_copyin(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
 		if (args->emulator != NULL &&
 		    (error = stk_add(args, args->emulator, UIO_SYSSPACE)) != 0)
 			return (error);
+
+		/*
+		 * For the AT_RANDOM aux vector we provide 16 bytes of random
+		 * data.
+		 */
+		(void) random_get_pseudo_bytes(rdata, sizeof (rdata));
+
+		if ((error = stk_byte_add(args, rdata, sizeof (rdata))) != 0)
+			return (error);
+
+		if (args->brand_nroot != NULL &&
+		    (error = stk_add(args, args->brand_nroot,
+		    UIO_SYSSPACE)) != 0)
+			return (error);
 	}
 
 	/*
@@ -1793,7 +1873,7 @@ stk_copyout(uarg_t *args, char *usrstack, void **auxvpp, user_t *up)
 	/*
 	 * Fill in the aux vector now that we know the user stack addresses
 	 * for the AT_SUN_PLATFORM, AT_SUN_EXECNAME, AT_SUN_BRANDNAME and
-	 * AT_SUN_EMULATOR strings.
+	 * AT_SUN_EMULATOR strings, as well as the AT_RANDOM array.
 	 */
 	if (auxvpp != NULL && *auxvpp != NULL) {
 		if (args->to_model == DATAMODEL_NATIVE) {
@@ -1806,6 +1886,11 @@ stk_copyout(uarg_t *args, char *usrstack, void **auxvpp, user_t *up)
 			if (args->emulator != NULL)
 				ADDAUX(*a,
 				    AT_SUN_EMULATOR, (long)&ustrp[*--offp])
+			ADDAUX(*a, AT_RANDOM, (long)&ustrp[*--offp])
+			if (args->brand_nroot != NULL) {
+				ADDAUX(*a,
+				    AT_SUN_BRAND_NROOT, (long)&ustrp[*--offp])
+			}
 		} else {
 			auxv32_t **a = (auxv32_t **)auxvpp;
 			ADDAUX(*a,
@@ -1818,6 +1903,11 @@ stk_copyout(uarg_t *args, char *usrstack, void **auxvpp, user_t *up)
 			if (args->emulator != NULL)
 				ADDAUX(*a, AT_SUN_EMULATOR,
 				    (int)(uintptr_t)&ustrp[*--offp])
+			ADDAUX(*a, AT_RANDOM, (int)(uintptr_t)&ustrp[*--offp])
+			if (args->brand_nroot != NULL) {
+				ADDAUX(*a, AT_SUN_BRAND_NROOT,
+				    (int)(uintptr_t)&ustrp[*--offp])
+			}
 		}
 	}
 
@@ -1961,6 +2051,9 @@ exec_args(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
 		usrstack = (char *)USRSTACK32;
 	}
 
+	if (args->maxstack != 0 && (uintptr_t)usrstack > args->maxstack)
+		usrstack = (char *)args->maxstack;
+
 	ASSERT(P2PHASE((uintptr_t)usrstack, args->stk_align) == 0);
 
 #if defined(__sparc)
diff --git a/usr/src/uts/common/os/exit.c b/usr/src/uts/common/os/exit.c
index 1b9359da47..62176e76f0 100644
--- a/usr/src/uts/common/os/exit.c
+++ b/usr/src/uts/common/os/exit.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, Joyent, Inc. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -230,7 +230,7 @@ restart_init(int what, int why)
 		siginfofree(lwp->lwp_curinfo);
 		lwp->lwp_curinfo = NULL;
 	}
-	lwp_ctmpl_clear(lwp);
+	lwp_ctmpl_clear(lwp, B_FALSE);
 
 	/*
 	 * Reset both the process root directory and the current working
@@ -320,6 +320,119 @@ proc_is_exiting(proc_t *p)
 }
 
 /*
+ * Return true if zone's init is restarted, false if exit processing should
+ * proceeed.
+ */
+static boolean_t
+zone_init_exit(zone_t *z, int why, int what)
+{
+	/*
+	 * Typically we don't let the zone's init exit unless zone_start_init()
+	 * failed its exec, or we are shutting down the zone or the machine,
+	 * although the various flags handled within this function will control
+	 * the behavior.
+	 *
+	 * Since we are single threaded, we don't need to lock the following
+	 * accesses to zone_proc_initpid.
+	 */
+	if (z->zone_boot_err != 0 ||
+	    zone_status_get(z) >= ZONE_IS_SHUTTING_DOWN ||
+	    zone_status_get(global_zone) >= ZONE_IS_SHUTTING_DOWN) {
+		/*
+		 * Clear the zone's init pid and proceed with exit processing.
+		 */
+		z->zone_proc_initpid = -1;
+		return (B_FALSE);
+	}
+
+	/*
+	 * There are a variety of configuration flags on the zone to control
+	 * init exit behavior.
+	 *
+	 * If the init process should be restarted, the "zone_restart_init"
+	 * member will be set.
+	 */
+	if (!z->zone_restart_init) {
+		/*
+		 * The zone has been setup to halt when init exits.
+		 */
+		z->zone_init_status = wstat(why, what);
+		(void) zone_kadmin(A_SHUTDOWN, AD_HALT, NULL, zone_kcred());
+		z->zone_proc_initpid = -1;
+		return (B_FALSE);
+	}
+
+	/*
+	 * At this point we know we're configured to restart init, but there
+	 * are various modifiers to that behavior.
+	 */
+
+	if (z->zone_reboot_on_init_exit) {
+		/*
+		 * Some init programs in branded zones do not tolerate a
+		 * restart in the traditional manner; setting
+		 * "zone_reboot_on_init_exit" will cause the entire zone to be
+		 * rebooted instead.
+		 */
+
+		if (z->zone_restart_init_0) {
+			/*
+			 * Some init programs in branded zones only want to
+			 * restart if they exit 0, otherwise the zone should
+			 * shutdown. Setting the "zone_restart_init_0" member
+			 * controls this behavior.
+			 */
+			if (why == CLD_EXITED && what == 0) {
+				/* Trigger a zone reboot */
+				(void) zone_kadmin(A_REBOOT, 0, NULL,
+				    zone_kcred());
+			} else {
+				/* Shutdown instead of reboot */
+				(void) zone_kadmin(A_SHUTDOWN, AD_HALT, NULL,
+				    zone_kcred());
+			}
+		} else {
+			/* Trigger a zone reboot */
+			(void) zone_kadmin(A_REBOOT, 0, NULL, zone_kcred());
+		}
+
+		z->zone_init_status = wstat(why, what);
+		z->zone_proc_initpid = -1;
+		return (B_FALSE);
+	}
+
+	if (z->zone_restart_init_0) {
+		/*
+		 * Some init programs in branded zones only want to restart if
+		 * they exit 0, otherwise the zone should shutdown. Setting the
+		 * "zone_restart_init_0" member controls this behavior.
+		 *
+		 * In this case we only restart init if it exited successfully.
+		 */
+		if (why == CLD_EXITED && what == 0 &&
+		    restart_init(what, why) == 0) {
+			return (B_TRUE);
+		}
+	} else {
+		/*
+		 * No restart modifiers on the zone, attempt to restart init.
+		 */
+		if (restart_init(what, why) == 0) {
+			return (B_TRUE);
+		}
+	}
+
+
+	/*
+	 * The restart failed, the zone will shut down.
+	 */
+	z->zone_init_status = wstat(why, what);
+	(void) zone_kadmin(A_SHUTDOWN, AD_HALT, NULL, zone_kcred());
+	z->zone_proc_initpid = -1;
+	return (B_FALSE);
+}
+
+/*
  * Return value:
  *   1 - exitlwps() failed, call (or continue) lwp_exit()
  *   0 - restarting init.  Return through system call path
@@ -366,45 +479,36 @@ proc_exit(int why, int what)
 	}
 	mutex_exit(&p->p_lock);
 
-	DTRACE_PROC(lwp__exit);
-	DTRACE_PROC1(exit, int, why);
+	if (p->p_pid == z->zone_proc_initpid) {
+		/* If zone's init restarts, we're done here. */
+		if (zone_init_exit(z, why, what))
+			return (0);
+	}
 
 	/*
-	 * Will perform any brand specific proc exit processing, since this
-	 * is always the last lwp, will also perform lwp_exit and free brand
-	 * data
+	 * Delay firing probes (and performing brand cleanup) until after the
+	 * zone_proc_initpid check. Cases which result in zone shutdown or
+	 * restart via zone_kadmin eventually result in a call back to
+	 * proc_exit.
 	 */
-	if (PROC_IS_BRANDED(p)) {
-		lwp_detach_brand_hdlrs(lwp);
-		brand_clearbrand(p, B_FALSE);
-	}
+	DTRACE_PROC(lwp__exit);
+	DTRACE_PROC1(exit, int, why);
 
 	/*
-	 * Don't let init exit unless zone_start_init() failed its exec, or
-	 * we are shutting down the zone or the machine.
-	 *
-	 * Since we are single threaded, we don't need to lock the
-	 * following accesses to zone_proc_initpid.
+	 * Will perform any brand specific proc exit processing. Since this
+	 * is always the last lwp, will also perform lwp exit/free and proc
+	 * exit. Brand data will be freed when the process is reaped.
 	 */
-	if (p->p_pid == z->zone_proc_initpid) {
-		if (z->zone_boot_err == 0 &&
-		    zone_status_get(z) < ZONE_IS_SHUTTING_DOWN &&
-		    zone_status_get(global_zone) < ZONE_IS_SHUTTING_DOWN) {
-			if (z->zone_restart_init == B_TRUE) {
-				if (restart_init(what, why) == 0)
-					return (0);
-			} else {
-				(void) zone_kadmin(A_SHUTDOWN, AD_HALT, NULL,
-				    CRED());
-			}
-		}
-
+	if (PROC_IS_BRANDED(p)) {
+		BROP(p)->b_lwpexit(lwp);
+		BROP(p)->b_proc_exit(p);
 		/*
-		 * Since we didn't or couldn't restart init, we clear
-		 * the zone's init state and proceed with exit
-		 * processing.
+		 * To ensure that b_proc_exit has access to brand-specific data
+		 * contained by the one remaining lwp, call the freelwp hook as
+		 * the last part of this clean-up process.
 		 */
-		z->zone_proc_initpid = -1;
+		BROP(p)->b_freelwp(lwp);
+		lwp_detach_brand_hdlrs(lwp);
 	}
 
 	lwp_pcb_exit();
@@ -565,7 +669,7 @@ proc_exit(int why, int what)
 		semexit(p);
 	rv = wstat(why, what);
 
-	acct(rv & 0xff);
+	acct(rv);
 	exacct_commit_proc(p, rv);
 
 	/*
@@ -658,10 +762,22 @@ proc_exit(int why, int what)
 	if ((q = p->p_child) != NULL && p != proc_init) {
 		struct proc	*np;
 		struct proc	*initp = proc_init;
+		pid_t		zone_initpid = 1;
+		struct proc	*zoneinitp = NULL;
 		boolean_t	setzonetop = B_FALSE;
 
-		if (!INGLOBALZONE(curproc))
-			setzonetop = B_TRUE;
+		if (!INGLOBALZONE(curproc)) {
+			zone_initpid = curproc->p_zone->zone_proc_initpid;
+
+			ASSERT(MUTEX_HELD(&pidlock));
+			zoneinitp = prfind(zone_initpid);
+			if (zoneinitp != NULL) {
+				initp = zoneinitp;
+			} else {
+				zone_initpid = 1;
+				setzonetop = B_TRUE;
+			}
+		}
 
 		pgdetach(p);
 
@@ -673,7 +789,8 @@ proc_exit(int why, int what)
 			 */
 			delete_ns(q->p_parent, q);
 
-			q->p_ppid = 1;
+			q->p_ppid = zone_initpid;
+
 			q->p_pidflag &= ~(CLDNOSIGCHLD | CLDWAITPID);
 			if (setzonetop) {
 				mutex_enter(&q->p_lock);
@@ -847,8 +964,50 @@ proc_exit(int why, int what)
 
 	mutex_exit(&p->p_lock);
 	if (!evaporate) {
-		p->p_pidflag &= ~CLDPEND;
-		sigcld(p, sqp);
+		/*
+		 * The brand specific code only happens when the brand has a
+		 * function to call in place of sigcld and the parent of the
+		 * exiting process is not the global zone init. If the parent
+		 * is the global zone init, then the process was reparented,
+		 * and we don't want brand code delivering possibly strange
+		 * signals to init. Also, init is not branded, so any brand
+		 * specific exit data will not be picked up by init anyway.
+		 */
+		if (PROC_IS_BRANDED(p) &&
+		    BROP(p)->b_exit_with_sig != NULL &&
+		    p->p_ppid != 1) {
+			/*
+			 * The code for _fini that could unload the brand_t
+			 * blocks until the count of zones using the module
+			 * reaches zero. Zones decrement the refcount on their
+			 * brands only after all user tasks in that zone have
+			 * exited and been waited on. The decrement on the
+			 * brand's refcount happen in zone_destroy(). That
+			 * depends on zone_shutdown() having been completed.
+			 * zone_shutdown() includes a call to zone_empty(),
+			 * where the zone waits for itself to reach the state
+			 * ZONE_IS_EMPTY. This state is only set in either
+			 * zone_shutdown(), when there are no user processes as
+			 * the zone enters this function, or in
+			 * zone_task_rele(). zone_task_rele() is called from
+			 * code triggered by waiting on processes, not by the
+			 * processes exiting through proc_exit().  This means
+			 * all the branded processes that could exist for a
+			 * specific brand_t must exit and get reaped before the
+			 * refcount on the brand_t can reach 0. _fini will
+			 * never unload the corresponding brand module before
+			 * proc_exit finishes execution for all processes
+			 * branded with a particular brand_t, which makes the
+			 * operation below safe to do. Brands that wish to use
+			 * this mechanism must wait in _fini as described
+			 * above.
+			 */
+			BROP(p)->b_exit_with_sig(p, sqp);
+		} else {
+			p->p_pidflag &= ~CLDPEND;
+			sigcld(p, sqp);
+		}
+
 	} else {
 		/*
 		 * Do what sigcld() would do if the disposition
@@ -927,10 +1086,9 @@ winfo(proc_t *pp, k_siginfo_t *ip, int waitflag)
 int
 waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
 {
-	int found;
 	proc_t *cp, *pp;
-	int proc_gone;
 	int waitflag = !(options & WNOWAIT);
+	boolean_t have_brand_helper = B_FALSE;
 
 	/*
 	 * Obsolete flag, defined here only for binary compatibility
@@ -958,7 +1116,8 @@ waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
 	pp = ttoproc(curthread);
 
 	/*
-	 * lock parent mutex so that sibling chain can be searched.
+	 * Anytime you are looking for a process, you take pidlock to prevent
+	 * things from changing as you look.
 	 */
 	mutex_enter(&pidlock);
 
@@ -978,10 +1137,37 @@ waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
 		return (ECHILD);
 	}
 
-	while (pp->p_child != NULL) {
+	if (PROC_IS_BRANDED(pp) && BROP(pp)->b_waitid_helper != NULL) {
+		have_brand_helper = B_TRUE;
+	}
 
-		proc_gone = 0;
+	while (pp->p_child != NULL || have_brand_helper) {
+		boolean_t brand_wants_wait = B_FALSE;
+		int proc_gone = 0;
+		int found = 0;
 
+		/*
+		 * Give the brand a chance to return synthetic results from
+		 * this waitid() call before we do the real thing.
+		 */
+		if (have_brand_helper) {
+			int ret;
+
+			if (BROP(pp)->b_waitid_helper(idtype, id, ip, options,
+			    &brand_wants_wait, &ret) == 0) {
+				mutex_exit(&pidlock);
+				return (ret);
+			}
+
+			if (pp->p_child == NULL) {
+				goto no_real_children;
+			}
+		}
+
+		/*
+		 * Look for interesting children in the newstate list.
+		 */
+		VERIFY(pp->p_child != NULL);
 		for (cp = pp->p_child_ns; cp != NULL; cp = cp->p_sibling_ns) {
 			if (idtype != P_PID && (cp->p_pidflag & CLDWAITPID))
 				continue;
@@ -989,6 +1175,11 @@ waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
 				continue;
 			if (idtype == P_PGID && id != cp->p_pgrp)
 				continue;
+			if (PROC_IS_BRANDED(pp)) {
+				if (BROP(pp)->b_wait_filter != NULL &&
+				    BROP(pp)->b_wait_filter(pp, cp) == B_FALSE)
+					continue;
+			}
 
 			switch (cp->p_wcode) {
 
@@ -1033,12 +1224,16 @@ waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
 		 * Wow! None of the threads on the p_sibling_ns list were
 		 * interesting threads. Check all the kids!
 		 */
-		found = 0;
 		for (cp = pp->p_child; cp != NULL; cp = cp->p_sibling) {
 			if (idtype == P_PID && id != cp->p_pid)
 				continue;
 			if (idtype == P_PGID && id != cp->p_pgrp)
 				continue;
+			if (PROC_IS_BRANDED(pp)) {
+				if (BROP(pp)->b_wait_filter != NULL &&
+				    BROP(pp)->b_wait_filter(pp, cp) == B_FALSE)
+					continue;
+			}
 
 			switch (cp->p_wcode) {
 			case CLD_TRAPPED:
@@ -1107,11 +1302,12 @@ waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
 				break;
 		}
 
+no_real_children:
 		/*
 		 * If we found no interesting processes at all,
 		 * break out and return ECHILD.
 		 */
-		if (found + proc_gone == 0)
+		if (!brand_wants_wait && (found + proc_gone == 0))
 			break;
 
 		if (options & WNOHANG) {
@@ -1130,7 +1326,7 @@ waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
 		 * change state while we wait, we don't wait at all.
 		 * Get out with ECHILD according to SVID.
 		 */
-		if (found == proc_gone)
+		if (!brand_wants_wait && (found == proc_gone))
 			break;
 
 		if (!cv_wait_sig_swap(&pp->p_cv, &pidlock)) {
@@ -1226,6 +1422,12 @@ freeproc(proc_t *p)
 		p->p_killsqp = NULL;
 	}
 
+	/* Clear any remaining brand data */
+	if (PROC_IS_BRANDED(p)) {
+		brand_clearbrand(p, B_FALSE);
+	}
+
+
 	prfree(p);	/* inform /proc */
 
 	/*
diff --git a/usr/src/uts/common/os/fio.c b/usr/src/uts/common/os/fio.c
index 76eddd4e50..41e7e63d2b 100644
--- a/usr/src/uts/common/os/fio.c
+++ b/usr/src/uts/common/os/fio.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015, Joyent Inc.
+ * Copyright 2017, Joyent Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -386,6 +386,7 @@ flist_grow(int maxfd)
 		dst->uf_flag = src->uf_flag;
 		dst->uf_busy = src->uf_busy;
 		dst->uf_portfd = src->uf_portfd;
+		dst->uf_gen = src->uf_gen;
 	}
 
 	/*
@@ -487,7 +488,7 @@ free_afd(afd_t *afd)		/* called below and from thread_free() */
 		afd->a_fd[i] = -1;
 }
 
-static void
+void
 set_active_fd(int fd)
 {
 	afd_t *afd = &curthread->t_activefd;
@@ -575,13 +576,12 @@ is_active_fd(kthread_t *t, int fd)
 }
 
 /*
- * Convert a user supplied file descriptor into a pointer to a file
- * structure.  Only task is to check range of the descriptor (soft
- * resource limit was enforced at open time and shouldn't be checked
- * here).
+ * Convert a user supplied file descriptor into a pointer to a file structure.
+ * Only task is to check range of the descriptor (soft resource limit was
+ * enforced at open time and shouldn't be checked here).
  */
 file_t *
-getf(int fd)
+getf_gen(int fd, uf_entry_gen_t *genp)
 {
 	uf_info_t *fip = P_FINFO(curproc);
 	uf_entry_t *ufp;
@@ -607,6 +607,9 @@ getf(int fd)
 		return (NULL);
 	}
 	ufp->uf_refcnt++;
+	if (genp != NULL) {
+		*genp = ufp->uf_gen;
+	}
 
 	set_active_fd(fd);	/* record the active file descriptor */
 
@@ -615,6 +618,12 @@ getf(int fd)
 	return (fp);
 }
 
+file_t *
+getf(int fd)
+{
+	return (getf_gen(fd, NULL));
+}
+
 /*
  * Close whatever file currently occupies the file descriptor slot
  * and install the new file, usually NULL, in the file descriptor slot.
@@ -667,6 +676,7 @@ closeandsetf(int fd, file_t *newfp)
 			ASSERT(ufp->uf_flag == 0);
 			fd_reserve(fip, fd, 1);
 			ufp->uf_file = newfp;
+			ufp->uf_gen++;
 			UF_EXIT(ufp);
 			mutex_exit(&fip->fi_lock);
 			return (0);
@@ -852,7 +862,8 @@ flist_fork(uf_info_t *pfip, uf_info_t *cfip)
 	 */
 	cfip->fi_nfiles = nfiles = flist_minsize(pfip);
 
-	cfip->fi_list = kmem_zalloc(nfiles * sizeof (uf_entry_t), KM_SLEEP);
+	cfip->fi_list = nfiles == 0 ? NULL :
+	    kmem_zalloc(nfiles * sizeof (uf_entry_t), KM_SLEEP);
 
 	for (fd = 0, pufp = pfip->fi_list, cufp = cfip->fi_list; fd < nfiles;
 	    fd++, pufp++, cufp++) {
@@ -860,6 +871,7 @@ flist_fork(uf_info_t *pfip, uf_info_t *cfip)
 		cufp->uf_alloc = pufp->uf_alloc;
 		cufp->uf_flag = pufp->uf_flag;
 		cufp->uf_busy = pufp->uf_busy;
+		cufp->uf_gen = pufp->uf_gen;
 		if (pufp->uf_file == NULL) {
 			ASSERT(pufp->uf_flag == 0);
 			if (pufp->uf_busy) {
@@ -1028,6 +1040,9 @@ ufalloc_file(int start, file_t *fp)
 	fd_reserve(fip, fd, 1);
 	ASSERT(ufp->uf_file == NULL);
 	ufp->uf_file = fp;
+	if (fp != NULL) {
+		ufp->uf_gen++;
+	}
 	UF_EXIT(ufp);
 	mutex_exit(&fip->fi_lock);
 	return (fd);
@@ -1183,6 +1198,7 @@ setf(int fd, file_t *fp)
 	} else {
 		UF_ENTER(ufp, fip, fd);
 		ASSERT(ufp->uf_busy);
+		ufp->uf_gen++;
 	}
 	ASSERT(ufp->uf_fpollinfo == NULL);
 	ASSERT(ufp->uf_flag == 0);
@@ -1212,8 +1228,7 @@ f_getfl(int fd, int *flagp)
 			error = EBADF;
 		else {
 			vnode_t *vp = fp->f_vnode;
-			int flag = fp->f_flag |
-			    ((fp->f_flag2 & ~FEPOLLED) << 16);
+			int flag = fp->f_flag | (fp->f_flag2 << 16);
 
 			/*
 			 * BSD fcntl() FASYNC compatibility.
diff --git a/usr/src/uts/common/os/fork.c b/usr/src/uts/common/os/fork.c
index a63931459f..7e198910b4 100644
--- a/usr/src/uts/common/os/fork.c
+++ b/usr/src/uts/common/os/fork.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2016, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -84,6 +84,7 @@ static int64_t cfork(int, int, int);
 static int getproc(proc_t **, pid_t, uint_t);
 #define	GETPROC_USER	0x0
 #define	GETPROC_KERNEL	0x1
+#define	GETPROC_ZSCHED	0x2
 
 static void fork_fail(proc_t *);
 static void forklwp_fail(proc_t *);
@@ -705,7 +706,7 @@ fork_fail(proc_t *cp)
 	if (PTOU(curproc)->u_cwd)
 		refstr_rele(PTOU(curproc)->u_cwd);
 	if (PROC_IS_BRANDED(cp)) {
-		brand_clearbrand(cp, B_TRUE);
+		brand_clearbrand(cp, B_FALSE);
 	}
 }
 
@@ -754,7 +755,7 @@ forklwp_fail(proc_t *p)
 			kmem_free(t->t_door, sizeof (door_data_t));
 			t->t_door = NULL;
 		}
-		lwp_ctmpl_clear(ttolwp(t));
+		lwp_ctmpl_clear(ttolwp(t), B_FALSE);
 
 		/*
 		 * Remove the thread from the all threads list.
@@ -791,6 +792,9 @@ extern struct as kas;
 
 /*
  * fork a kernel process.
+ *
+ * Passing a pid argument of -1 indicates that the new process should be
+ * launched as a child of 'zsched' within the zone.
  */
 int
 newproc(void (*pc)(), caddr_t arg, id_t cid, int pri, struct contract **ct,
@@ -809,6 +813,7 @@ newproc(void (*pc)(), caddr_t arg, id_t cid, int pri, struct contract **ct,
 		rctl_set_t *init_set;
 
 		ASSERT(pid != 1);
+		ASSERT(pid >= 0);
 
 		if (getproc(&p, pid, GETPROC_KERNEL) < 0)
 			return (EAGAIN);
@@ -852,8 +857,18 @@ newproc(void (*pc)(), caddr_t arg, id_t cid, int pri, struct contract **ct,
 		rctl_set_t *init_set;
 		task_t *tk, *tk_old;
 		klwp_t *lwp;
+		boolean_t pzsched = B_FALSE;
+		int flag = GETPROC_USER;
+
+		/* Handle a new user-level thread as child of zsched. */
+		if (pid < 0) {
+			VERIFY(curzone != global_zone);
+			flag = GETPROC_ZSCHED;
+			pzsched = B_TRUE;
+			pid = 0;
+		}
 
-		if (getproc(&p, pid, GETPROC_USER) < 0)
+		if (getproc(&p, pid, flag) < 0)
 			return (EAGAIN);
 		/*
 		 * init creates a new task, distinct from the task
@@ -914,7 +929,8 @@ newproc(void (*pc)(), caddr_t arg, id_t cid, int pri, struct contract **ct,
 		}
 		t = lwptot(lwp);
 
-		ctp = contract_process_fork(sys_process_tmpl, p, curproc,
+		ctp = contract_process_fork(sys_process_tmpl, p,
+		    (pzsched ? curproc->p_zone->zone_zsched : curproc),
 		    B_FALSE);
 		ASSERT(ctp != NULL);
 		if (ct != NULL)
@@ -955,7 +971,11 @@ getproc(proc_t **cpp, pid_t pid, uint_t flags)
 	if (zone_status_get(curproc->p_zone) >= ZONE_IS_SHUTTING_DOWN)
 		return (-1);	/* no point in starting new processes */
 
-	pp = (flags & GETPROC_KERNEL) ? &p0 : curproc;
+	if (flags & GETPROC_ZSCHED) {
+		pp = curproc->p_zone->zone_zsched;
+	} else {
+		pp = (flags & GETPROC_KERNEL) ? &p0 : curproc;
+	}
 	task = pp->p_task;
 	proj = task->tk_proj;
 	zone = pp->p_zone;
@@ -1016,6 +1036,9 @@ getproc(proc_t **cpp, pid_t pid, uint_t flags)
 	cp->p_t1_lgrpid = LGRP_NONE;
 	cp->p_tr_lgrpid = LGRP_NONE;
 
+	/* Default to native brand initially */
+	cp->p_brand = &native_brand;
+
 	if ((newpid = pid_allocate(cp, pid, PID_ALLOC_PROC)) == -1) {
 		if (nproc == v.v_proc) {
 			CPU_STATS_ADDQ(CPU, sys, procovf, 1);
@@ -1083,9 +1106,6 @@ getproc(proc_t **cpp, pid_t pid, uint_t flags)
 	cp->p_flag = pp->p_flag & (SJCTL|SNOWAIT|SNOCD);
 	cp->p_sessp = pp->p_sessp;
 	sess_hold(pp);
-	cp->p_brand = pp->p_brand;
-	if (PROC_IS_BRANDED(pp))
-		BROP(pp)->b_copy_procdata(cp, pp);
 	cp->p_bssbase = pp->p_bssbase;
 	cp->p_brkbase = pp->p_brkbase;
 	cp->p_brksize = pp->p_brksize;
@@ -1170,6 +1190,18 @@ getproc(proc_t **cpp, pid_t pid, uint_t flags)
 	mutex_exit(&cp->p_lock);
 	mutex_exit(&pidlock);
 
+	if (PROC_IS_BRANDED(pp)) {
+		/*
+		 * The only reason why process branding should fail is when
+		 * the procedure is complicated by multiple LWPs on the scene.
+		 * With an LWP count of 0, this newly allocated process has no
+		 * reason to fail branding.
+		 */
+		VERIFY0(brand_setbrand(cp, B_FALSE));
+
+		BROP(pp)->b_copy_procdata(cp, pp);
+	}
+
 	avl_create(&cp->p_ct_held, contract_compar, sizeof (contract_t),
 	    offsetof(contract_t, ct_ctlist));
 
@@ -1187,6 +1219,7 @@ getproc(proc_t **cpp, pid_t pid, uint_t flags)
 	 */
 	fcnt_add(P_FINFO(pp), 1);
 
+	mutex_enter(&pp->p_lock);
 	if (PTOU(pp)->u_cdir) {
 		VN_HOLD(PTOU(pp)->u_cdir);
 	} else {
@@ -1200,6 +1233,7 @@ getproc(proc_t **cpp, pid_t pid, uint_t flags)
 		VN_HOLD(PTOU(pp)->u_rdir);
 	if (PTOU(pp)->u_cwd)
 		refstr_hold(PTOU(pp)->u_cwd);
+	mutex_exit(&pp->p_lock);
 
 	/*
 	 * copy the parent's uarea.
diff --git a/usr/src/uts/common/os/grow.c b/usr/src/uts/common/os/grow.c
index de2a4f26c4..07fd623a95 100644
--- a/usr/src/uts/common/os/grow.c
+++ b/usr/src/uts/common/os/grow.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright 2013 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -55,6 +55,7 @@
 #include <sys/fcntl.h>
 #include <sys/lwpchan_impl.h>
 #include <sys/nbmlock.h>
+#include <sys/brand.h>
 
 #include <vm/hat.h>
 #include <vm/as.h>
@@ -570,6 +571,20 @@ choose_addr(struct as *as, caddr_t *addrp, size_t len, offset_t off,
 	return (0);
 }
 
+caddr_t
+map_userlimit(proc_t *pp, struct as *as, int flags)
+{
+	if (flags & _MAP_LOW32) {
+		if (PROC_IS_BRANDED(pp) && BROP(pp)->b_map32limit != NULL) {
+			return ((caddr_t)(uintptr_t)BROP(pp)->b_map32limit(pp));
+		} else {
+			return ((caddr_t)_userlimit32);
+		}
+	}
+
+	return (as->a_userlimit);
+}
+
 
 /*
  * Used for MAP_ANON - fast way to get anonymous pages
@@ -585,8 +600,6 @@ zmap(struct as *as, caddr_t *addrp, size_t len, uint_t uprot, int flags,
 		return (EACCES);
 
 	if ((flags & MAP_FIXED) != 0) {
-		caddr_t userlimit;
-
 		/*
 		 * Use the user address.  First verify that
 		 * the address to be used is page aligned.
@@ -595,9 +608,8 @@ zmap(struct as *as, caddr_t *addrp, size_t len, uint_t uprot, int flags,
 		if (((uintptr_t)*addrp & PAGEOFFSET) != 0)
 			return (EINVAL);
 
-		userlimit = flags & _MAP_LOW32 ?
-		    (caddr_t)USERLIMIT32 : as->a_userlimit;
-		switch (valid_usr_range(*addrp, len, uprot, as, userlimit)) {
+		switch (valid_usr_range(*addrp, len, uprot, as,
+		    map_userlimit(as->a_proc, as, flags))) {
 		case RANGE_OKAY:
 			break;
 		case RANGE_BADPROT:
@@ -638,7 +650,7 @@ zmap(struct as *as, caddr_t *addrp, size_t len, uint_t uprot, int flags,
 #define	RANDOMIZABLE_MAPPING(addr, flags) (((flags & MAP_FIXED) == 0) && \
 	!(((flags & MAP_ALIGN) == 0) && (addr != 0) && aslr_respect_mmap_hint))
 
-static int
+int
 smmap_common(caddr_t *addrp, size_t len,
     int prot, int flags, struct file *fp, offset_t pos)
 {
@@ -780,8 +792,6 @@ smmap_common(caddr_t *addrp, size_t len,
 	 * If the user specified an address, do some simple checks here
 	 */
 	if ((flags & MAP_FIXED) != 0) {
-		caddr_t userlimit;
-
 		/*
 		 * Use the user address.  First verify that
 		 * the address to be used is page aligned.
@@ -789,10 +799,8 @@ smmap_common(caddr_t *addrp, size_t len,
 		 */
 		if (((uintptr_t)*addrp & PAGEOFFSET) != 0)
 			return (EINVAL);
-
-		userlimit = flags & _MAP_LOW32 ?
-		    (caddr_t)USERLIMIT32 : as->a_userlimit;
-		switch (valid_usr_range(*addrp, len, uprot, as, userlimit)) {
+		switch (valid_usr_range(*addrp, len, uprot, as,
+		    map_userlimit(curproc, as, flags))) {
 		case RANGE_OKAY:
 			break;
 		case RANGE_BADPROT:
diff --git a/usr/src/uts/common/os/ipc.c b/usr/src/uts/common/os/ipc.c
index 9381019cd1..6a6f5d84ef 100644
--- a/usr/src/uts/common/os/ipc.c
+++ b/usr/src/uts/common/os/ipc.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T		*/
@@ -1217,6 +1218,23 @@ ipc_remove(ipc_service_t *service, kipc_perm_t *perm)
 	    (IPC_ZONE_USAGE(perm, service) == 0)));
 }
 
+/*
+ * Perform actual IPC_RMID, either via ipc_rmid or due to a delayed *_RMID.
+ */
+void
+ipc_rmsvc(ipc_service_t *service, kipc_perm_t *perm)
+{
+	ASSERT(service->ipcs_count > 0);
+	ASSERT(MUTEX_HELD(&service->ipcs_lock));
+
+	ipc_remove(service, perm);
+	mutex_exit(&service->ipcs_lock);
+
+	/* perform any per-service removal actions */
+	service->ipcs_rmid(perm);
+
+	ipc_rele(service, perm);
+}
 
 /*
  * Common code to perform an IPC_RMID.  Returns an errno value on
@@ -1247,13 +1265,7 @@ ipc_rmid(ipc_service_t *service, int id, cred_t *cr)
 	/*
 	 * Nothing can fail from this point on.
 	 */
-	ipc_remove(service, perm);
-	mutex_exit(&service->ipcs_lock);
-
-	/* perform any per-service removal actions */
-	service->ipcs_rmid(perm);
-
-	ipc_rele(service, perm);
+	ipc_rmsvc(service, perm);
 
 	return (0);
 }
diff --git a/usr/src/uts/common/os/kmem.c b/usr/src/uts/common/os/kmem.c
index b41ab8c465..9a3692053d 100644
--- a/usr/src/uts/common/os/kmem.c
+++ b/usr/src/uts/common/os/kmem.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  * Copyright (c) 2012, 2017 by Delphix. All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2018, Joyent, Inc.
@@ -1011,6 +1012,7 @@ size_t kmem_transaction_log_size; /* transaction log size [2% of memory] */
 size_t kmem_content_log_size;	/* content log size [2% of memory] */
 size_t kmem_failure_log_size;	/* failure log [4 pages per CPU] */
 size_t kmem_slab_log_size;	/* slab create log [4 pages per CPU] */
+size_t kmem_zerosized_log_size;	/* zero-sized log [4 pages per CPU] */
 size_t kmem_content_maxsave = 256; /* KMF_CONTENTS max bytes to log */
 size_t kmem_lite_minsize = 0;	/* minimum buffer size for KMF_LITE */
 size_t kmem_lite_maxalign = 1024; /* maximum buffer alignment for KMF_LITE */
@@ -1018,6 +1020,14 @@ int kmem_lite_pcs = 4;		/* number of PCs to store in KMF_LITE mode */
 size_t kmem_maxverify;		/* maximum bytes to inspect in debug routines */
 size_t kmem_minfirewall;	/* hardware-enforced redzone threshold */
 
+#ifdef DEBUG
+int kmem_warn_zerosized = 1;	/* whether to warn on zero-sized KM_SLEEP */
+#else
+int kmem_warn_zerosized = 0;	/* whether to warn on zero-sized KM_SLEEP */
+#endif
+
+int kmem_panic_zerosized = 0;	/* whether to panic on zero-sized KM_SLEEP */
+
 #ifdef _LP64
 size_t	kmem_max_cached = KMEM_BIG_MAXBUF;	/* maximum kmem_alloc cache */
 #else
@@ -1098,6 +1108,7 @@ kmem_log_header_t	*kmem_transaction_log;
 kmem_log_header_t	*kmem_content_log;
 kmem_log_header_t	*kmem_failure_log;
 kmem_log_header_t	*kmem_slab_log;
+kmem_log_header_t	*kmem_zerosized_log;
 
 static int		kmem_lite_count; /* # of PCs in kmem_buftag_lite_t */
 
@@ -2851,8 +2862,33 @@ kmem_alloc(size_t size, int kmflag)
 		/* fall through to kmem_cache_alloc() */
 
 	} else {
-		if (size == 0)
+		if (size == 0) {
+			if (kmflag != KM_SLEEP && !(kmflag & KM_PANIC))
+				return (NULL);
+
+			/*
+			 * If this is a sleeping allocation or one that has
+			 * been specified to panic on allocation failure, we
+			 * consider it to be deprecated behavior to allocate
+			 * 0 bytes.  If we have been configured to panic under
+			 * this condition, we panic; if to warn, we warn -- and
+			 * regardless, we log to the kmem_zerosized_log that
+			 * that this condition has occurred (which gives us
+			 * enough information to be able to debug it).
+			 */
+			if (kmem_panic && kmem_panic_zerosized)
+				panic("attempted to kmem_alloc() size of 0");
+
+			if (kmem_warn_zerosized) {
+				cmn_err(CE_WARN, "kmem_alloc(): sleeping "
+				    "allocation with size of 0; "
+				    "see kmem_zerosized_log for details");
+			}
+
+			kmem_log_event(kmem_zerosized_log, NULL, NULL, NULL);
+
 			return (NULL);
+		}
 
 		buf = vmem_alloc(kmem_oversize_arena, size,
 		    kmflag & KM_VMFLAGS);
@@ -4392,8 +4428,8 @@ kmem_init(void)
 	}
 
 	kmem_failure_log = kmem_log_init(kmem_failure_log_size);
-
 	kmem_slab_log = kmem_log_init(kmem_slab_log_size);
+	kmem_zerosized_log = kmem_log_init(kmem_zerosized_log_size);
 
 	/*
 	 * Initialize STREAMS message caches so allocb() is available.
diff --git a/usr/src/uts/common/os/kstat_fr.c b/usr/src/uts/common/os/kstat_fr.c
index 93c04cff8d..b09b2d3558 100644
--- a/usr/src/uts/common/os/kstat_fr.c
+++ b/usr/src/uts/common/os/kstat_fr.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2014, Joyent, Inc. All rights reserved.
+ * Copyright 2017, Joyent, Inc. All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
  */
 
@@ -198,6 +198,9 @@ struct {
 	kstat_named_t pagesfree;
 	kstat_named_t pageslocked;
 	kstat_named_t pagestotal;
+	kstat_named_t lowmemscan;
+	kstat_named_t zonecapscan;
+	kstat_named_t nthrottle;
 } system_pages_kstat = {
 	{ "physmem",		KSTAT_DATA_ULONG },
 	{ "nalloc",		KSTAT_DATA_ULONG },
@@ -219,6 +222,9 @@ struct {
 	{ "pagesfree", 		KSTAT_DATA_ULONG },
 	{ "pageslocked", 	KSTAT_DATA_ULONG },
 	{ "pagestotal",		KSTAT_DATA_ULONG },
+	{ "low_mem_scan",	KSTAT_DATA_ULONG },
+	{ "zone_cap_scan",	KSTAT_DATA_ULONG },
+	{ "n_throttle",		KSTAT_DATA_ULONG },
 };
 
 static int header_kstat_update(kstat_t *, int);
@@ -912,6 +918,9 @@ system_pages_kstat_update(kstat_t *ksp, int rw)
 	system_pages_kstat.pageslocked.value.ul	= (ulong_t)(availrmem_initial -
 	    availrmem);
 	system_pages_kstat.pagestotal.value.ul	= (ulong_t)total_pages;
+	system_pages_kstat.lowmemscan.value.ul	= (ulong_t)low_mem_scan;
+	system_pages_kstat.zonecapscan.value.ul	= (ulong_t)zone_cap_scan;
+	system_pages_kstat.nthrottle.value.ul	= (ulong_t)n_throttle;
 	/*
 	 * pp_kernel represents total pages used by the kernel since the
 	 * startup. This formula takes into account the boottime kernel
diff --git a/usr/src/uts/common/os/lgrp.c b/usr/src/uts/common/os/lgrp.c
index 6288f47bed..6f6aced619 100644
--- a/usr/src/uts/common/os/lgrp.c
+++ b/usr/src/uts/common/os/lgrp.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -90,6 +91,7 @@
 #include <sys/pg.h>
 #include <sys/promif.h>
 #include <sys/sdt.h>
+#include <sys/ht.h>
 
 lgrp_gen_t	lgrp_gen = 0;		/* generation of lgroup hierarchy */
 lgrp_t *lgrp_table[NLGRPS_MAX]; /* table of all initialized lgrp_t structs */
@@ -520,6 +522,8 @@ lgrp_main_mp_init(void)
 {
 	klgrpset_t changed;
 
+	ht_init();
+
 	/*
 	 * Update lgroup topology (if necessary)
 	 */
diff --git a/usr/src/uts/common/os/logsubr.c b/usr/src/uts/common/os/logsubr.c
index 149f5f8a88..946f9d50ae 100644
--- a/usr/src/uts/common/os/logsubr.c
+++ b/usr/src/uts/common/os/logsubr.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2013 Gary Mills
  * Copyright (c) 1998, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -249,8 +250,7 @@ log_init(void)
 	 */
 	printf("\rSunOS Release %s Version %s %u-bit\n",
 	    utsname.release, utsname.version, NBBY * (uint_t)sizeof (void *));
-	printf("Copyright (c) 1983, 2010, Oracle and/or its affiliates. "
-	    "All rights reserved.\n");
+	printf("Copyright (c) 2010-2018, Joyent Inc. All rights reserved.\n");
 #ifdef DEBUG
 	printf("DEBUG enabled\n");
 #endif
@@ -491,7 +491,7 @@ log_console(log_t *lp, log_ctl_t *lc)
 
 mblk_t *
 log_makemsg(int mid, int sid, int level, int sl, int pri, void *msg,
-	size_t size, int on_intr)
+    size_t size, int on_intr)
 {
 	mblk_t *mp = NULL;
 	mblk_t *mp2;
diff --git a/usr/src/uts/common/os/lwp.c b/usr/src/uts/common/os/lwp.c
index b2adae570f..341e4ae356 100644
--- a/usr/src/uts/common/os/lwp.c
+++ b/usr/src/uts/common/os/lwp.c
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 #include <sys/param.h>
@@ -57,6 +57,8 @@
 #include <sys/lgrp.h>
 #include <sys/rctl.h>
 #include <sys/contract_impl.h>
+#include <sys/contract/process.h>
+#include <sys/contract/process_impl.h>
 #include <sys/cpc_impl.h>
 #include <sys/sdt.h>
 #include <sys/cmn_err.h>
@@ -115,7 +117,7 @@ lwp_create(void (*proc)(), caddr_t arg, size_t len, proc_t *p,
 	ret_tidhash_t *ret_tidhash = NULL;
 	int i;
 	int rctlfail = 0;
-	boolean_t branded = 0;
+	void *brand_data = NULL;
 	struct ctxop *ctx = NULL;
 
 	ASSERT(cid != sysdccid);	/* system threads must start in SYS */
@@ -283,6 +285,19 @@ lwp_create(void (*proc)(), caddr_t arg, size_t len, proc_t *p,
 	 */
 	lep = kmem_zalloc(sizeof (*lep), KM_SLEEP);
 
+	/*
+	 * If necessary, speculatively allocate lwp brand data.  This is done
+	 * ahead of time so p_lock need not be dropped during lwp branding.
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_lwpdata_alloc != NULL) {
+		if ((brand_data = BROP(p)->b_lwpdata_alloc(p)) == NULL) {
+			mutex_enter(&p->p_lock);
+			err = 1;
+			atomic_inc_32(&p->p_zone->zone_ffmisc);
+			goto error;
+		}
+	}
+
 	mutex_enter(&p->p_lock);
 grow:
 	/*
@@ -630,18 +645,6 @@ grow:
 		} while (lwp_hash_lookup(p, t->t_tid) != NULL);
 	}
 
-	/*
-	 * If this is a branded process, let the brand do any necessary lwp
-	 * initialization.
-	 */
-	if (PROC_IS_BRANDED(p)) {
-		if (BROP(p)->b_initlwp(lwp)) {
-			err = 1;
-			atomic_inc_32(&p->p_zone->zone_ffmisc);
-			goto error;
-		}
-		branded = 1;
-	}
 
 	if (t->t_tid == 1) {
 		kpreempt_disable();
@@ -654,7 +657,6 @@ grow:
 		}
 	}
 
-	p->p_lwpcnt++;
 	t->t_waitfor = -1;
 
 	/*
@@ -696,8 +698,27 @@ grow:
 	t->t_post_sys = 1;
 
 	/*
+	 * Perform lwp branding
+	 *
+	 * The b_initlwp hook is _not_ allowed to drop p->p_lock as it must be
+	 * continuously held between when the tidhash is sized and when the lwp
+	 * is inserted into it.  Operations requiring p->p_lock to be
+	 * temporarily dropped can be performed in b_initlwp_post.
+	 */
+	if (PROC_IS_BRANDED(p)) {
+		BROP(p)->b_initlwp(lwp, brand_data);
+		/*
+		 * The b_initlwp hook is expected to consume any preallocated
+		 * brand_data in a way that prepares it for deallocation by the
+		 * b_freelwp hook.
+		 */
+		brand_data = NULL;
+	}
+
+	/*
 	 * Insert the new thread into the list of all threads.
 	 */
+	p->p_lwpcnt++;
 	if ((tx = p->p_tlist) == NULL) {
 		t->t_back = t;
 		t->t_forw = t;
@@ -718,6 +739,13 @@ grow:
 	lep->le_start = t->t_start;
 	lwp_hash_in(p, lep, p->p_tidhash, p->p_tidhash_sz, 1);
 
+	/*
+	 * Complete lwp branding
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_initlwp_post != NULL) {
+		BROP(p)->b_initlwp_post(lwp);
+	}
+
 	lwp_fp_init(lwp);
 
 	if (state == TS_RUN) {
@@ -755,8 +783,9 @@ error:
 		if (cid != NOCLASS && bufp != NULL)
 			CL_FREE(cid, bufp);
 
-		if (branded)
-			BROP(p)->b_freelwp(lwp);
+		if (brand_data != NULL) {
+			BROP(p)->b_lwpdata_free(brand_data);
+		}
 
 		mutex_exit(&p->p_lock);
 		t->t_state = TS_FREE;
@@ -829,8 +858,27 @@ lwp_ctmpl_copy(klwp_t *dst, klwp_t *src)
 	int i;
 
 	for (i = 0; i < ct_ntypes; i++) {
-		dst->lwp_ct_active[i] = ctmpl_dup(src->lwp_ct_active[i]);
+		ct_template_t *tmpl = src->lwp_ct_active[i];
+
+		/*
+		 * If the process contract template is setup to be preserved
+		 * across exec, then if we're forking, perform an implicit
+		 * template_clear now. This ensures that future children of
+		 * this child will remain in the same contract unless they're
+		 * explicitly setup differently. We know we're forking if the
+		 * two LWPs belong to different processes.
+		 */
+		if (i == CTT_PROCESS && tmpl != NULL) {
+			ctmpl_process_t *ctp = tmpl->ctmpl_data;
+
+			if (dst->lwp_procp != src->lwp_procp &&
+			    (ctp->ctp_params & CT_PR_KEEP_EXEC) != 0)
+				tmpl = NULL;
+		}
+
+		dst->lwp_ct_active[i] = ctmpl_dup(tmpl);
 		dst->lwp_ct_latest[i] = NULL;
+
 	}
 }
 
@@ -838,21 +886,33 @@ lwp_ctmpl_copy(klwp_t *dst, klwp_t *src)
  * Clear an LWP's contract template state.
  */
 void
-lwp_ctmpl_clear(klwp_t *lwp)
+lwp_ctmpl_clear(klwp_t *lwp, boolean_t is_exec)
 {
 	ct_template_t *tmpl;
 	int i;
 
 	for (i = 0; i < ct_ntypes; i++) {
-		if ((tmpl = lwp->lwp_ct_active[i]) != NULL) {
-			ctmpl_free(tmpl);
-			lwp->lwp_ct_active[i] = NULL;
-		}
-
 		if (lwp->lwp_ct_latest[i] != NULL) {
 			contract_rele(lwp->lwp_ct_latest[i]);
 			lwp->lwp_ct_latest[i] = NULL;
 		}
+
+		if ((tmpl = lwp->lwp_ct_active[i]) != NULL) {
+			/*
+			 * If we're exec-ing a new program and the process
+			 * contract template is setup to be preserved across
+			 * exec, then don't clear it.
+			 */
+			if (is_exec && i == CTT_PROCESS) {
+				ctmpl_process_t *ctp = tmpl->ctmpl_data;
+
+				if ((ctp->ctp_params & CT_PR_KEEP_EXEC) != 0)
+					continue;
+			}
+
+			ctmpl_free(tmpl);
+			lwp->lwp_ct_active[i] = NULL;
+		}
 	}
 }
 
@@ -893,13 +953,6 @@ lwp_exit(void)
 	if (t->t_upimutex != NULL)
 		upimutex_cleanup();
 
-	/*
-	 * Perform any brand specific exit processing, then release any
-	 * brand data associated with the lwp
-	 */
-	if (PROC_IS_BRANDED(p))
-		BROP(p)->b_lwpexit(lwp);
-
 	lwp_pcb_exit();
 
 	mutex_enter(&p->p_lock);
@@ -943,6 +996,18 @@ lwp_exit(void)
 	DTRACE_PROC(lwp__exit);
 
 	/*
+	 * Perform any brand specific exit processing, then release any
+	 * brand data associated with the lwp
+	 */
+	if (PROC_IS_BRANDED(p)) {
+		mutex_exit(&p->p_lock);
+		BROP(p)->b_lwpexit(lwp);
+		BROP(p)->b_freelwp(lwp);
+		mutex_enter(&p->p_lock);
+		prbarrier(p);
+	}
+
+	/*
 	 * If the lwp is a detached lwp or if the process is exiting,
 	 * remove (lwp_hash_out()) the lwp from the lwp directory.
 	 * Otherwise null out the lwp's le_thread pointer in the lwp
@@ -1103,7 +1168,7 @@ lwp_cleanup(void)
 	}
 	kpreempt_enable();
 
-	lwp_ctmpl_clear(ttolwp(t));
+	lwp_ctmpl_clear(ttolwp(t), B_FALSE);
 }
 
 int
diff --git a/usr/src/uts/common/os/main.c b/usr/src/uts/common/os/main.c
index 7afc1cfe00..db6d74b2c2 100644
--- a/usr/src/uts/common/os/main.c
+++ b/usr/src/uts/common/os/main.c
@@ -24,10 +24,10 @@
  */
 
 /*	Copyright (c) 1988 AT&T	*/
-/*	  All Rights Reserved  	*/
+/*	  All Rights Reserved		*/
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2018, Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -145,19 +145,20 @@ char initargs[BOOTARGS_MAX] = "";		/* also referenced by zone0 */
 int
 exec_init(const char *initpath, const char *args)
 {
-	caddr32_t ucp;
-	caddr32_t *uap;
-	caddr32_t *argv;
-	caddr32_t exec_fnamep;
+	uintptr_t ucp;
+	uintptr_t uap;
+	uintptr_t *argv;
+	uintptr_t exec_fnamep;
 	char *scratchargs;
 	int i, sarg;
 	size_t argvlen, alen;
+	size_t wlen = sizeof (uintptr_t);
 	boolean_t in_arg;
 	int argc = 0;
 	int error = 0, count = 0;
 	proc_t *p = ttoproc(curthread);
 	klwp_t *lwp = ttolwp(curthread);
-	int brand_action;
+	int brand_action = EBA_NONE;
 
 	if (args == NULL)
 		args = "";
@@ -181,7 +182,7 @@ exec_init(const char *initpath, const char *args)
 			in_arg = B_TRUE;
 		}
 	}
-	argvlen = sizeof (caddr32_t) * (argc + 1);
+	argvlen = sizeof (uintptr_t) * (argc + 1);
 	argv = kmem_zalloc(argvlen, KM_SLEEP);
 
 	/*
@@ -199,7 +200,7 @@ exec_init(const char *initpath, const char *args)
 	 *	-0x05 -  <------. |
 	 *	-0x06 \0	| |
 	 *	-0x07 t		| |
-	 *	-0x08 i 	| |
+	 *	-0x08 i		| |
 	 *	-0x09 n		| |
 	 *	-0x0a i  <---.  | |
 	 *	-0x10 NULL   |  | |	(argv[3])
@@ -213,7 +214,7 @@ exec_init(const char *initpath, const char *args)
 	 * stack ptr, and sarg is the string index of the start of the
 	 * argument.
 	 */
-	ucp = (caddr32_t)(uintptr_t)p->p_usrstack;
+	ucp = (uintptr_t)p->p_usrstack;
 
 	argc = 0;
 	in_arg = B_FALSE;
@@ -231,13 +232,33 @@ exec_init(const char *initpath, const char *args)
 			sarg = i;
 		}
 	}
+
+	exec_fnamep = argv[0];
+
 	ucp -= alen;
-	error |= copyout(scratchargs, (caddr_t)(uintptr_t)ucp, alen);
+	error |= copyout(scratchargs, (caddr_t)ucp, alen);
+
+	if (p->p_model == DATAMODEL_ILP32) {
+		uintptr32_t *argv32;
+
+		argv32 = kmem_zalloc(argvlen / 2, KM_SLEEP);
+
+		for (i = 0; i < argc; i++)
+			argv32[i] = (uintptr32_t)argv[i];
+
+		kmem_free(argv, argvlen);
+		argv = (uintptr_t *)argv32;
+		argvlen /= 2;
+
+		wlen = sizeof (uintptr32_t);
+	}
 
-	uap = (caddr32_t *)P2ALIGN((uintptr_t)ucp, sizeof (caddr32_t));
-	uap--;	/* advance to be below the word we're in */
-	uap -= (argc + 1);	/* advance argc words down, plus one for NULL */
-	error |= copyout(argv, uap, argvlen);
+	uap = P2ALIGN(ucp, wlen);
+	/* advance to be below the word we're in */
+	uap -= wlen;
+	/* advance argc words down, plus one for NULL */
+	uap -= (argc + 1) * wlen;
+	error |= copyout(argv, (caddr_t)uap, argvlen);
 
 	if (error != 0) {
 		zcmn_err(p->p_zone->zone_id, CE_WARN,
@@ -247,7 +268,6 @@ exec_init(const char *initpath, const char *args)
 		return (EFAULT);
 	}
 
-	exec_fnamep = argv[0];
 	kmem_free(argv, argvlen);
 	kmem_free(scratchargs, alen);
 
@@ -255,8 +275,8 @@ exec_init(const char *initpath, const char *args)
 	 * Point at the arguments.
 	 */
 	lwp->lwp_ap = lwp->lwp_arg;
-	lwp->lwp_arg[0] = (uintptr_t)exec_fnamep;
-	lwp->lwp_arg[1] = (uintptr_t)uap;
+	lwp->lwp_arg[0] = exec_fnamep;
+	lwp->lwp_arg[1] = uap;
 	lwp->lwp_arg[2] = NULL;
 	curthread->t_post_sys = 1;
 	curthread->t_sysnum = SYS_execve;
@@ -268,10 +288,18 @@ exec_init(const char *initpath, const char *args)
 	 */
 	sigemptyset(&curthread->t_hold);
 
-	brand_action = ZONE_IS_BRANDED(p->p_zone) ? EBA_BRAND : EBA_NONE;
+	/*
+	 * Only instruct exec_common to brand the process if necessary.  It is
+	 * possible that the init process is already properly branded due to the
+	 * proc_exit -> restart_init -> exec_init call chain.
+	 */
+	if (ZONE_IS_BRANDED(p->p_zone) &&
+	    p->p_brand != p->p_zone->zone_brand) {
+		brand_action = EBA_BRAND;
+	}
 again:
-	error = exec_common((const char *)(uintptr_t)exec_fnamep,
-	    (const char **)(uintptr_t)uap, NULL, brand_action);
+	error = exec_common((const char *)exec_fnamep,
+	    (const char **)uap, NULL, brand_action);
 
 	/*
 	 * Normally we would just set lwp_argsaved and t_post_sys and
diff --git a/usr/src/uts/common/os/mem_config.c b/usr/src/uts/common/os/mem_config.c
index 3571747e9c..6be46fa422 100644
--- a/usr/src/uts/common/os/mem_config.c
+++ b/usr/src/uts/common/os/mem_config.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -1638,7 +1639,7 @@ delthr_get_freemem(struct mem_handle *mhp)
 		 * Put pressure on pageout.
 		 */
 		page_needfree(free_get);
-		cv_signal(&proc_pageout->p_cv);
+		WAKE_PAGEOUT_SCANNER();
 
 		mutex_enter(&mhp->mh_mutex);
 		(void) cv_reltimedwait(&mhp->mh_cv, &mhp->mh_mutex,
diff --git a/usr/src/uts/common/os/mmapobj.c b/usr/src/uts/common/os/mmapobj.c
index 142c10754e..0410e6f47b 100644
--- a/usr/src/uts/common/os/mmapobj.c
+++ b/usr/src/uts/common/os/mmapobj.c
@@ -1381,10 +1381,15 @@ calc_loadable(Ehdr *ehdrp, caddr_t phdrbase, int nphdrs, size_t *len,
 			}
 			if (num_segs++ == 0) {
 				/*
-				 * The p_vaddr of the first PT_LOAD segment
-				 * must either be NULL or within the first
-				 * page in order to be interpreted.
-				 * Otherwise, its an invalid file.
+				 * While ELF doesn't specify the meaning of
+				 * p_vaddr for PT_LOAD segments in ET_DYN
+				 * objects, we mandate that is either NULL or
+				 * (to accommodate some historical binaries)
+				 * within the first page.  (Note that there
+				 * exist non-native ET_DYN objects that violate
+				 * this constraint that we nonetheless must be
+				 * able to execute; see the ET_DYN handling in
+				 * mapelfexec() for details.)
 				 */
 				if (e_type == ET_DYN &&
 				    ((caddr_t)((uintptr_t)vaddr &
diff --git a/usr/src/uts/common/os/modctl.c b/usr/src/uts/common/os/modctl.c
index 35162eb558..c6e9d89d0d 100644
--- a/usr/src/uts/common/os/modctl.c
+++ b/usr/src/uts/common/os/modctl.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017 Joyent, Inc.
  */
 
 /*
@@ -3469,6 +3470,11 @@ mod_load(struct modctl *mp, int usepath)
 		retval = install_stubs_by_name(mp, mp->mod_modname);
 
 		/*
+		 * Perform hotinlines before module is started.
+		 */
+		do_hotinlines(mp->mod_mp);
+
+		/*
 		 * Now that the module is loaded, we need to give DTrace
 		 * a chance to notify its providers.  This is done via
 		 * the dtrace_modload function pointer.
diff --git a/usr/src/uts/common/os/modsysfile.c b/usr/src/uts/common/os/modsysfile.c
index 8dca86880f..37ac089edf 100644
--- a/usr/src/uts/common/os/modsysfile.c
+++ b/usr/src/uts/common/os/modsysfile.c
@@ -23,6 +23,7 @@
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright 2016 Nexenta Systems, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -57,10 +58,12 @@ struct hwc_class *hcl_head;	/* head of list of classes */
 static kmutex_t hcl_lock;	/* for accessing list of classes */
 
 #define	DAFILE		"/etc/driver_aliases"
+#define	PPTFILE		"/etc/ppt_aliases"
 #define	CLASSFILE	"/etc/driver_classes"
 #define	DACFFILE	"/etc/dacf.conf"
 
 static char class_file[] = CLASSFILE;
+static char pptfile[] = PPTFILE;
 static char dafile[] = DAFILE;
 static char dacffile[] = DACFFILE;
 
@@ -2136,14 +2139,13 @@ hwc_parse_now(char *fname, struct par_list **pl, ddi_prop_t **props)
 	return (0);	/* always return success */
 }
 
-void
-make_aliases(struct bind **bhash)
+static void
+parse_aliases(struct bind **bhash, struct _buf *file)
 {
 	enum {
 		AL_NEW, AL_DRVNAME, AL_DRVNAME_COMMA, AL_ALIAS, AL_ALIAS_COMMA
 	} state;
 
-	struct _buf *file;
 	char tokbuf[MAXPATHLEN];
 	char drvbuf[MAXPATHLEN];
 	token_t token;
@@ -2152,9 +2154,6 @@ make_aliases(struct bind **bhash)
 	static char dupwarn[] = "!Driver alias \"%s\" conflicts with "
 	    "an existing driver name or alias.";
 
-	if ((file = kobj_open_file(dafile)) == (struct _buf *)-1)
-		return;
-
 	state = AL_NEW;
 	major = DDI_MAJOR_T_NONE;
 	while (!done) {
@@ -2239,8 +2238,22 @@ make_aliases(struct bind **bhash)
 			kobj_file_err(CE_WARN, file, tok_err, tokbuf);
 		}
 	}
+}
 
-	kobj_close_file(file);
+void
+make_aliases(struct bind **bhash)
+{
+	struct _buf *file;
+
+	if ((file = kobj_open_file(pptfile)) != (struct _buf *)-1) {
+		parse_aliases(bhash, file);
+		kobj_close_file(file);
+	}
+
+	if ((file = kobj_open_file(dafile)) != (struct _buf *)-1) {
+		parse_aliases(bhash, file);
+		kobj_close_file(file);
+	}
 }
 
 
diff --git a/usr/src/uts/common/os/pid.c b/usr/src/uts/common/os/pid.c
index b555bb82b7..eba6147fab 100644
--- a/usr/src/uts/common/os/pid.c
+++ b/usr/src/uts/common/os/pid.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -112,6 +113,18 @@ pid_lookup(pid_t pid)
 	return (pidp);
 }
 
+struct pid *
+pid_find(pid_t pid)
+{
+	struct pid *pidp;
+
+	mutex_enter(&pidlinklock);
+	pidp = pid_lookup(pid);
+	mutex_exit(&pidlinklock);
+
+	return (pidp);
+}
+
 void
 pid_setmin(void)
 {
@@ -522,6 +535,20 @@ sprunlock(proc_t *p)
 	THREAD_KPRI_RELEASE();
 }
 
+/*
+ * Undo effects of sprlock but without dropping p->p_lock
+ */
+void
+sprunprlock(proc_t *p)
+{
+	ASSERT(p->p_proc_flag & P_PR_LOCK);
+	ASSERT(MUTEX_HELD(&p->p_lock));
+
+	cv_signal(&pr_pid_cv[p->p_slot]);
+	p->p_proc_flag &= ~P_PR_LOCK;
+	THREAD_KPRI_RELEASE();
+}
+
 void
 pid_init(void)
 {
diff --git a/usr/src/uts/common/os/policy.c b/usr/src/uts/common/os/policy.c
index d6821c83b0..8cc7f009a3 100644
--- a/usr/src/uts/common/os/policy.c
+++ b/usr/src/uts/common/os/policy.c
@@ -56,6 +56,7 @@
 #include <sys/mntent.h>
 #include <sys/contract_impl.h>
 #include <sys/dld_ioc.h>
+#include <sys/brand.h>
 
 /*
  * There are two possible layers of privilege routines and two possible
@@ -1244,6 +1245,22 @@ secpolicy_vnode_owner(const cred_t *cr, uid_t owner)
 void
 secpolicy_setid_clear(vattr_t *vap, cred_t *cr)
 {
+	proc_t *p = curproc;
+
+	/*
+	 * Allow the brand to override this behaviour.
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_setid_clear != NULL) {
+		/*
+		 * This brand hook will return 0 if handling is complete, or
+		 * some other value if the brand would like us to fall back to
+		 * the usual behaviour.
+		 */
+		if (BROP(p)->b_setid_clear(vap, cr) == 0) {
+			return;
+		}
+	}
+
 	if ((vap->va_mode & (S_ISUID | S_ISGID)) != 0 &&
 	    secpolicy_vnode_setid_retain(cr,
 	    (vap->va_mode & S_ISUID) != 0 &&
@@ -2092,6 +2109,13 @@ secpolicy_meminfo(const cred_t *cr)
 }
 
 int
+secpolicy_fs_import(const cred_t *cr)
+{
+	return (PRIV_POLICY(cr, PRIV_SYS_FS_IMPORT, B_FALSE, EPERM, NULL));
+}
+
+
+int
 secpolicy_pfexec_register(const cred_t *cr)
 {
 	return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_TRUE, EPERM, NULL));
@@ -2607,3 +2631,11 @@ secpolicy_ppp_config(const cred_t *cr)
 		return (secpolicy_net_config(cr, B_FALSE));
 	return (PRIV_POLICY(cr, PRIV_SYS_PPP_CONFIG, B_FALSE, EPERM, NULL));
 }
+
+int
+secpolicy_hyprlofs_control(const cred_t *cr)
+{
+	if (PRIV_POLICY(cr, PRIV_HYPRLOFS_CONTROL, B_FALSE, EPERM, NULL))
+		return (EPERM);
+	return (0);
+}
diff --git a/usr/src/uts/common/os/priv_defs b/usr/src/uts/common/os/priv_defs
index bc1787c9ca..854fb602da 100644
--- a/usr/src/uts/common/os/priv_defs
+++ b/usr/src/uts/common/os/priv_defs
@@ -177,6 +177,10 @@ privilege PRIV_GRAPHICS_MAP
 	Allows a process to perform privileged mappings through a
 	graphics device.
 
+privilege PRIV_HYPRLOFS_CONTROL
+
+	Allows a process to manage hyprlofs entries.
+
 privilege PRIV_IPC_DAC_READ
 
 	Allows a process to read a System V IPC
@@ -377,6 +381,10 @@ privilege PRIV_SYS_DEVICES
 	Allows a process to open the real console device directly.
 	Allows a process to open devices that have been exclusively opened.
 
+privilege PRIV_SYS_FS_IMPORT
+
+	Allows a process to import a potentially untrusted file system.
+
 privilege PRIV_SYS_IPC_CONFIG
 
 	Allows a process to increase the size of a System V IPC Message
diff --git a/usr/src/uts/common/os/rctl.c b/usr/src/uts/common/os/rctl.c
index 09b80323d5..e0a1126567 100644
--- a/usr/src/uts/common/os/rctl.c
+++ b/usr/src/uts/common/os/rctl.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 #include <sys/atomic.h>
@@ -194,6 +195,8 @@ id_space_t *rctl_ids;
 kmem_cache_t *rctl_cache;	/* kmem cache for rctl structures */
 kmem_cache_t *rctl_val_cache;	/* kmem cache for rctl values */
 
+extern rctl_hndl_t rc_process_maxlockedmem;
+
 kmutex_t rctl_lists_lock;
 rctl_dict_entry_t *rctl_lists[RC_MAX_ENTITY + 1];
 
@@ -2872,12 +2875,12 @@ rctl_init(void)
  * rctl_incr_locked_mem(proc_t *p, kproject_t *proj, rctl_qty_t inc,
  *     int chargeproc)
  *
- * Increments the amount of locked memory on a project, and
- * zone. If proj is non-NULL the project must be held by the
- * caller; if it is NULL the proj and zone of proc_t p are used.
- * If chargeproc is non-zero, then the charged amount is cached
- * on p->p_locked_mem so that the charge can be migrated when a
- * process changes projects.
+ * Increments the amount of locked memory on a process, project, and
+ * zone. If 'proj' is non-NULL, the project must be held by the
+ * caller; if it is NULL, the project and zone of process 'p' are used.
+ * If 'chargeproc' is non-zero, then the charged amount is added
+ * to p->p_locked_mem. This is also used so that the charge can be
+ * migrated when a process changes projects.
  *
  * Return values
  *    0 - success
@@ -2895,6 +2898,7 @@ rctl_incr_locked_mem(proc_t *p, kproject_t *proj, rctl_qty_t inc,
 
 	ASSERT(p != NULL);
 	ASSERT(MUTEX_HELD(&p->p_lock));
+
 	if (proj != NULL) {
 		projp = proj;
 		zonep = proj->kpj_zone;
@@ -2938,11 +2942,23 @@ rctl_incr_locked_mem(proc_t *p, kproject_t *proj, rctl_qty_t inc,
 		}
 	}
 
-	zonep->zone_locked_mem += inc;
-	projp->kpj_data.kpd_locked_mem += inc;
 	if (chargeproc != 0) {
+		/* Check for overflow */
+		if ((p->p_locked_mem + inc) < p->p_locked_mem) {
+			ret = EAGAIN;
+			goto out;
+		}
+		if (rctl_test_entity(rc_process_maxlockedmem, p->p_rctls, p,
+		    &e, inc, 0) & RCT_DENY) {
+			ret = EAGAIN;
+			goto out;
+		}
+
 		p->p_locked_mem += inc;
 	}
+
+	zonep->zone_locked_mem += inc;
+	projp->kpj_data.kpd_locked_mem += inc;
 out:
 	mutex_exit(&zonep->zone_mem_lock);
 	return (ret);
diff --git a/usr/src/uts/common/os/rctl_proc.c b/usr/src/uts/common/os/rctl_proc.c
index 9b7324fe7b..c62540d2b4 100644
--- a/usr/src/uts/common/os/rctl_proc.c
+++ b/usr/src/uts/common/os/rctl_proc.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -32,6 +33,7 @@
 #include <sys/port_kernel.h>
 #include <sys/signal.h>
 #include <sys/var.h>
+#include <sys/policy.h>
 
 #include <sys/vmparam.h>
 #include <sys/machparam.h>
@@ -66,6 +68,7 @@ rctl_hndl_t rc_process_semmsl;
 rctl_hndl_t rc_process_semopm;
 rctl_hndl_t rc_process_portev;
 rctl_hndl_t rc_process_sigqueue;
+rctl_hndl_t rc_process_maxlockedmem;
 
 /*
  * process.max-cpu-time / RLIMIT_CPU
@@ -212,6 +215,26 @@ static rctl_ops_t proc_vmem_ops = {
 };
 
 /*
+ * process.max-locked-memory
+ */
+/*ARGSUSED*/
+static int
+proc_maxlockedmem_test(struct rctl *r, struct proc *p, rctl_entity_p_t *e,
+    struct rctl_val *rv, rctl_qty_t i, uint_t f)
+{
+	if (secpolicy_lock_memory(CRED()) == 0)
+		return (0);
+	return ((p->p_locked_mem + i) > rv->rcv_value);
+}
+
+static rctl_ops_t proc_maxlockedmem_ops = {
+	rcop_no_action,
+	rcop_no_usage,
+	rcop_no_set,
+	proc_maxlockedmem_test
+};
+
+/*
  * void rctlproc_default_init()
  *
  * Overview
@@ -383,6 +406,11 @@ rctlproc_init(void)
 	rctl_add_default_limit("process.max-sigqueue-size",
 	    _SIGQUEUE_SIZE_PRIVILEGED, RCPRIV_PRIVILEGED, RCTL_LOCAL_DENY);
 
+	rc_process_maxlockedmem = rctl_register("process.max-locked-memory",
+	    RCENTITY_PROCESS, RCTL_GLOBAL_LOWERABLE | RCTL_GLOBAL_DENY_ALWAYS |
+	    RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_BYTES,
+	    ULONG_MAX, UINT32_MAX, &proc_maxlockedmem_ops);
+
 	/*
 	 * Place minimal set of controls on "sched" process for inheritance by
 	 * processes created via newproc().
diff --git a/usr/src/uts/common/os/sched.c b/usr/src/uts/common/os/sched.c
index c1d6569f11..15e77d39f7 100644
--- a/usr/src/uts/common/os/sched.c
+++ b/usr/src/uts/common/os/sched.c
@@ -27,6 +27,10 @@
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
 /*	  All Rights Reserved	*/
 
+/*
+ * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+ */
+
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/sysmacros.h>
@@ -646,16 +650,17 @@ top:
 		klwp_t *lwp = ttolwp(tp);
 
 		/*
-		 * Swapout eligible lwps (specified by the scheduling
-		 * class) which don't have TS_DONT_SWAP set.  Set the
-		 * "intent to swap" flag (TS_SWAPENQ) on threads
-		 * which have TS_DONT_SWAP set so that they can be
+		 * Swapout eligible lwps (specified by the scheduling class)
+		 * which don't have TS_DONT_SWAP set.  Set the "intent to swap"
+		 * flag (TS_SWAPENQ) on threads which have either TS_DONT_SWAP
+		 * set or are currently on a split stack so that they can be
 		 * swapped if and when they reach a safe point.
 		 */
 		thread_lock(tp);
 		thread_pri = CL_SWAPOUT(tp, swapflags);
 		if (thread_pri != -1) {
-			if (tp->t_schedflag & TS_DONT_SWAP) {
+			if ((tp->t_schedflag & TS_DONT_SWAP) ||
+			    (tp->t_flag & T_SPLITSTK)) {
 				tp->t_schedflag |= TS_SWAPENQ;
 				tp->t_trapret = 1;
 				aston(tp);
diff --git a/usr/src/uts/common/os/schedctl.c b/usr/src/uts/common/os/schedctl.c
index 5721083751..18b396a765 100644
--- a/usr/src/uts/common/os/schedctl.c
+++ b/usr/src/uts/common/os/schedctl.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -327,12 +328,17 @@ schedctl_sigblock(kthread_t *t)
 
 
 /*
- * If the sc_sigblock field is set for the specified thread, set
- * its signal mask to block all maskable signals, then clear the
- * sc_sigblock field.  This finishes what user-level code requested
- * to be done when it set tdp->sc_shared->sc_sigblock non-zero.
- * Called from signal-related code either by the current thread for
- * itself or by a thread that holds the process's p_lock (/proc code).
+ * If the sc_sigblock field is set for the specified thread, set its signal
+ * mask to block all maskable signals, then clear the sc_sigblock field.  This
+ * accomplishes what user-level code requested to be done when it set
+ * tdp->sc_shared->sc_sigblock non-zero.
+ *
+ * This is generally called by signal-related code in the current thread.  In
+ * order to call against a thread other than curthread, p_lock for the
+ * containing process must be held.  Even then, the caller is not protected
+ * from races with the thread in question updating its own fields.  It is the
+ * responsibility of the caller to perform additional synchronization.
+ *
  */
 void
 schedctl_finish_sigblock(kthread_t *t)
diff --git a/usr/src/uts/common/os/shm.c b/usr/src/uts/common/os/shm.c
index bacc595f78..5deae96d73 100644
--- a/usr/src/uts/common/os/shm.c
+++ b/usr/src/uts/common/os/shm.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
@@ -319,6 +320,7 @@ shmat(int shmid, caddr_t uaddr, int uflags, uintptr_t *rvp)
 		size_t	share_size;
 		struct	shm_data ssd;
 		uintptr_t align_hint;
+		long	curprot;
 
 		/*
 		 * Pick a share pagesize to use, if (!isspt(sp)).
@@ -453,6 +455,7 @@ shmat(int shmid, caddr_t uaddr, int uflags, uintptr_t *rvp)
 			}
 		}
 
+		curprot = sp->shm_opts & SHM_PROT_MASK;
 		if (!isspt(sp)) {
 			error = sptcreate(size, &segspt, sp->shm_amp, prot,
 			    flags, share_szc);
@@ -462,8 +465,8 @@ shmat(int shmid, caddr_t uaddr, int uflags, uintptr_t *rvp)
 			}
 			sp->shm_sptinfo->sptas = segspt->s_as;
 			sp->shm_sptseg = segspt;
-			sp->shm_sptprot = prot;
-		} else if ((prot & sp->shm_sptprot) != sp->shm_sptprot) {
+			sp->shm_opts = (sp->shm_opts & ~SHM_PROT_MASK) | prot;
+		} else if ((prot & curprot) != curprot) {
 			/*
 			 * Ensure we're attaching to an ISM segment with
 			 * fewer or equal permissions than what we're
@@ -748,6 +751,23 @@ shmctl(int shmid, int cmd, void *arg)
 		}
 		break;
 
+	/* Stage segment for removal, but don't remove until last detach */
+	case SHM_RMID:
+		if ((error = secpolicy_ipc_owner(cr, (kipc_perm_t *)sp)) != 0)
+			break;
+
+		/*
+		 * If attached, just mark it as a pending remove, otherwise
+		 * we must perform the normal ipc_rmid now.
+		 */
+		if ((sp->shm_perm.ipc_ref - 1) > 0) {
+			sp->shm_opts |= SHM_RM_PENDING;
+		} else {
+			mutex_exit(lock);
+			return (ipc_rmid(shm_svc, shmid, cr));
+		}
+		break;
+
 	default:
 		error = EINVAL;
 		break;
@@ -778,6 +798,23 @@ shm_detach(proc_t *pp, segacct_t *sap)
 		sp->shm_ismattch--;
 	sp->shm_dtime = gethrestime_sec();
 	sp->shm_lpid = pp->p_pid;
+	if ((sp->shm_opts & SHM_RM_PENDING) != 0 &&
+	    sp->shm_perm.ipc_ref == 2) {
+		/*
+		 * If this is the last detach of the segment across the whole
+		 * system then now we can perform the delayed IPC_RMID.
+		 * The ipc_ref count has 1 for the original 'get' and one for
+		 * each 'attach' (see 'stat' handling in shmctl).
+		 */
+		sp->shm_opts &= ~SHM_RM_PENDING;
+		mutex_enter(&shm_svc->ipcs_lock);
+		ipc_rmsvc(shm_svc, (kipc_perm_t *)sp);	/* Drops lock */
+		ASSERT(!MUTEX_HELD(&shm_svc->ipcs_lock));
+		ASSERT(((kipc_perm_t *)sp)->ipc_ref > 0);
+
+		/* Lock was dropped, need to retake it for following rele. */
+		(void) ipc_lock(shm_svc, sp->shm_perm.ipc_id);
+	}
 	ipc_rele(shm_svc, (kipc_perm_t *)sp);	/* Drops lock */
 
 	kmem_free(sap, sizeof (segacct_t));
diff --git a/usr/src/uts/common/os/sig.c b/usr/src/uts/common/os/sig.c
index 453b1f22d4..67a93581dd 100644
--- a/usr/src/uts/common/os/sig.c
+++ b/usr/src/uts/common/os/sig.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -60,6 +60,7 @@
 #include <sys/cyclic.h>
 #include <sys/dtrace.h>
 #include <sys/sdt.h>
+#include <sys/brand.h>
 #include <sys/signalfd.h>
 
 const k_sigset_t nullsmask = {0, 0, 0};
@@ -148,6 +149,21 @@ signal_is_blocked(kthread_t *t, int sig)
 }
 
 /*
+ * Return true if the signal can safely be ignored.
+ * That is, if the signal is included in the p_ignore mask and doing so is not
+ * forbidden by any process branding.
+ */
+static int
+sig_ignorable(proc_t *p, klwp_t *lwp, int sig)
+{
+	return (sigismember(&p->p_ignore, sig) &&	/* sig in ignore mask */
+	    !(PROC_IS_BRANDED(p) &&			/* allowed by brand */
+	    BROP(p)->b_sig_ignorable != NULL &&
+	    BROP(p)->b_sig_ignorable(p, lwp, sig) == B_FALSE));
+
+}
+
+/*
  * Return true if the signal can safely be discarded on generation.
  * That is, if there is no need for the signal on the receiving end.
  * The answer is true if the process is a zombie or
@@ -159,12 +175,13 @@ signal_is_blocked(kthread_t *t, int sig)
  *	the signal is not being accepted via sigwait()
  */
 static int
-sig_discardable(proc_t *p, int sig)
+sig_discardable(proc_t *p, kthread_t *tp, int sig)
 {
 	kthread_t *t = p->p_tlist;
+	klwp_t *lwp = (tp == NULL) ? NULL : tp->t_lwp;
 
 	return (t == NULL ||		/* if zombie or ... */
-	    (sigismember(&p->p_ignore, sig) &&	/* signal is ignored */
+	    (sig_ignorable(p, lwp, sig) &&		/* signal is ignored */
 	    t->t_forw == t &&			/* and single-threaded */
 	    !tracing(p, sig) &&			/* and no /proc tracing */
 	    !signal_is_blocked(t, sig) &&	/* and signal not blocked */
@@ -200,7 +217,7 @@ eat_signal(kthread_t *t, int sig)
 		    !(ttoproc(t)->p_proc_flag & P_PR_LOCK)) {
 			ttoproc(t)->p_stopsig = 0;
 			t->t_dtrace_stop = 0;
-			t->t_schedflag |= TS_XSTART | TS_PSTART;
+			t->t_schedflag |= TS_XSTART | TS_PSTART | TS_BSTART;
 			setrun_locked(t);
 		} else if (t != curthread && t->t_state == TS_ONPROC) {
 			aston(t);	/* make it do issig promptly */
@@ -297,7 +314,7 @@ sigtoproc(proc_t *p, kthread_t *t, int sig)
 		}
 	}
 
-	if (sig_discardable(p, sig)) {
+	if (sig_discardable(p, t, sig)) {
 		DTRACE_PROC3(signal__discard, kthread_t *, p->p_tlist,
 		    proc_t *, p, int, sig);
 		return;
@@ -497,7 +514,7 @@ issig_justlooking(void)
 			if (sigismember(&set, sig) &&
 			    (tracing(p, sig) ||
 			    sigismember(&t->t_sigwait, sig) ||
-			    !sigismember(&p->p_ignore, sig))) {
+			    !sig_ignorable(p, lwp, sig))) {
 				/*
 				 * Don't promote a signal that will stop
 				 * the process when lwp_nostop is set.
@@ -623,6 +640,28 @@ issig_forreal(void)
 		}
 
 		/*
+		 * The brand hook name 'b_issig_stop' is a misnomer.
+		 * Allow the brand the chance to alter (or suppress) delivery
+		 * of this signal.
+		 */
+		if (PROC_IS_BRANDED(p) && BROP(p)->b_issig_stop != NULL) {
+			int r;
+
+			/*
+			 * The brand hook will return 0 if it would like
+			 * us to drive on, -1 if we should restart
+			 * the loop to check other conditions, or 1 if we
+			 * should terminate the loop.
+			 */
+			r = BROP(p)->b_issig_stop(p, lwp);
+			if (r < 0) {
+				continue;
+			} else if (r > 0) {
+				break;
+			}
+		}
+
+		/*
 		 * Honor requested stop before dealing with the
 		 * current signal; a debugger may change it.
 		 * Do not want to go back to loop here since this is a special
@@ -656,7 +695,7 @@ issig_forreal(void)
 			lwp->lwp_cursig = 0;
 			lwp->lwp_extsig = 0;
 			if (sigismember(&t->t_sigwait, sig) ||
-			    (!sigismember(&p->p_ignore, sig) &&
+			    (!sig_ignorable(p, lwp, sig) &&
 			    !isjobstop(sig))) {
 				if (p->p_flag & (SEXITLWPS|SKILLED)) {
 					sig = SIGKILL;
@@ -708,7 +747,7 @@ issig_forreal(void)
 				toproc = 0;
 				if (tracing(p, sig) ||
 				    sigismember(&t->t_sigwait, sig) ||
-				    !sigismember(&p->p_ignore, sig)) {
+				    !sig_ignorable(p, lwp, sig)) {
 					if (sigismember(&t->t_extsig, sig))
 						ext = 1;
 					break;
@@ -722,7 +761,7 @@ issig_forreal(void)
 				toproc = 1;
 				if (tracing(p, sig) ||
 				    sigismember(&t->t_sigwait, sig) ||
-				    !sigismember(&p->p_ignore, sig)) {
+				    !sig_ignorable(p, lwp, sig)) {
 					if (sigismember(&p->p_extsig, sig))
 						ext = 1;
 					break;
@@ -954,6 +993,16 @@ stop(int why, int what)
 		}
 		break;
 
+	case PR_BRAND:
+		/*
+		 * We have been stopped by the brand code for a brand-private
+		 * reason.  This is an asynchronous stop affecting only this
+		 * LWP.
+		 */
+		VERIFY(PROC_IS_BRANDED(p));
+		flags &= ~TS_BSTART;
+		break;
+
 	default:	/* /proc stop */
 		flags &= ~TS_PSTART;
 		/*
@@ -1065,7 +1114,7 @@ stop(int why, int what)
 		}
 	}
 
-	if (why != PR_JOBCONTROL && why != PR_CHECKPOINT) {
+	if (why != PR_JOBCONTROL && why != PR_CHECKPOINT && why != PR_BRAND) {
 		/*
 		 * Do process-level notification when all lwps are
 		 * either stopped on events of interest to /proc
@@ -1171,6 +1220,13 @@ stop(int why, int what)
 	if (why == PR_CHECKPOINT)
 		del_one_utstop();
 
+	/*
+	 * Allow the brand to post notification of this stop condition.
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_stop_notify != NULL) {
+		BROP(p)->b_stop_notify(p, lwp, why, what);
+	}
+
 	thread_lock(t);
 	ASSERT((t->t_schedflag & TS_ALLSTART) == 0);
 	t->t_schedflag |= flags;
@@ -1192,7 +1248,7 @@ stop(int why, int what)
 		    (p->p_flag & (SEXITLWPS|SKILLED))) {
 			p->p_stopsig = 0;
 			thread_lock(t);
-			t->t_schedflag |= TS_XSTART | TS_PSTART;
+			t->t_schedflag |= TS_XSTART | TS_PSTART | TS_BSTART;
 			setrun_locked(t);
 			thread_unlock_nopreempt(t);
 		} else if (why == PR_JOBCONTROL) {
@@ -1327,7 +1383,7 @@ psig(void)
 	 * this signal from pending to current (we dropped p->p_lock).
 	 * This can happen only in a multi-threaded process.
 	 */
-	if (sigismember(&p->p_ignore, sig) ||
+	if (sig_ignorable(p, lwp, sig) ||
 	    (func == SIG_DFL && sigismember(&stopdefault, sig))) {
 		lwp->lwp_cursig = 0;
 		lwp->lwp_extsig = 0;
@@ -1771,9 +1827,12 @@ post_sigcld(proc_t *cp, sigqueue_t *sqp)
 			/*
 			 * This can only happen when the parent is init.
 			 * (See call to sigcld(q, NULL) in exit().)
-			 * Use KM_NOSLEEP to avoid deadlock.
+			 * Use KM_NOSLEEP to avoid deadlock. The child procs
+			 * initpid can be 1 for zlogin.
 			 */
-			ASSERT(pp == proc_init);
+			ASSERT(pp->p_pidp->pid_id ==
+			    cp->p_zone->zone_proc_initpid ||
+			    pp->p_pidp->pid_id == 1);
 			winfo(cp, &info, 0);
 			sigaddq(pp, NULL, &info, KM_NOSLEEP);
 		} else {
@@ -1804,6 +1863,15 @@ sigcld_repost()
 
 	sqp = kmem_zalloc(sizeof (sigqueue_t), KM_SLEEP);
 	mutex_enter(&pidlock);
+	if (PROC_IS_BRANDED(pp) && BROP(pp)->b_sigcld_repost != NULL) {
+		/*
+		 * Allow the brand to inject synthetic SIGCLD signals.
+		 */
+		if (BROP(pp)->b_sigcld_repost(pp, sqp) == 0) {
+			mutex_exit(&pidlock);
+			return;
+		}
+	}
 	for (cp = pp->p_child; cp; cp = cp->p_sibling) {
 		if (cp->p_pidflag & CLDPEND) {
 			post_sigcld(cp, sqp);
@@ -2115,7 +2183,7 @@ sigaddqa(proc_t *p, kthread_t *t, sigqueue_t *sigqp)
 	ASSERT(MUTEX_HELD(&p->p_lock));
 	ASSERT(sig >= 1 && sig < NSIG);
 
-	if (sig_discardable(p, sig))
+	if (sig_discardable(p, t, sig))
 		siginfofree(sigqp);
 	else
 		sigaddqins(p, t, sigqp);
@@ -2141,7 +2209,7 @@ sigaddq(proc_t *p, kthread_t *t, k_siginfo_t *infop, int km_flags)
 	 * blocking the signal (it *could* change it's mind while
 	 * the signal is pending) then don't bother creating one.
 	 */
-	if (!sig_discardable(p, sig) &&
+	if (!sig_discardable(p, t, sig) &&
 	    (sigismember(&p->p_siginfo, sig) ||
 	    (curproc->p_ct_process != p->p_ct_process) ||
 	    (sig == SIGCLD && SI_FROMKERNEL(infop))) &&
diff --git a/usr/src/uts/common/os/smb_subr.c b/usr/src/uts/common/os/smb_subr.c
index 6084676b17..6dc7230bed 100644
--- a/usr/src/uts/common/os/smb_subr.c
+++ b/usr/src/uts/common/os/smb_subr.c
@@ -25,7 +25,9 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
+ */
 
 #include <sys/smbios_impl.h>
 #include <sys/cmn_err.h>
@@ -43,13 +45,13 @@ smb_strerror(int err)
 void *
 smb_alloc(size_t len)
 {
-	return (kmem_alloc(len, KM_SLEEP));
+	return (len > 0 ? kmem_alloc(len, KM_SLEEP) : NULL);
 }
 
 void *
 smb_zalloc(size_t len)
 {
-	return (kmem_zalloc(len, KM_SLEEP));
+	return (len > 0 ? kmem_zalloc(len, KM_SLEEP) : NULL);
 }
 
 void
diff --git a/usr/src/uts/common/os/streamio.c b/usr/src/uts/common/os/streamio.c
index 509a3cfd40..8ec67ea76a 100644
--- a/usr/src/uts/common/os/streamio.c
+++ b/usr/src/uts/common/os/streamio.c
@@ -78,6 +78,7 @@
 #include <sys/policy.h>
 #include <sys/dld.h>
 #include <sys/zone.h>
+#include <sys/limits.h>
 #include <c2/audit.h>
 
 /*
@@ -986,12 +987,20 @@ strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
 		 * (registered in sd_wakeq).
 		 */
 		struiod_t uiod;
+		struct iovec buf[IOV_MAX_STACK];
+		int iovlen = 0;
 
 		if (first)
 			stp->sd_wakeq &= ~RSLEEP;
 
-		(void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
-		    sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
+		if (uiop->uio_iovcnt > IOV_MAX_STACK) {
+			iovlen = uiop->uio_iovcnt * sizeof (iovec_t);
+			uiod.d_iov = kmem_alloc(iovlen, KM_SLEEP);
+		} else {
+			uiod.d_iov = buf;
+		}
+
+		(void) uiodup(uiop, &uiod.d_uio, uiod.d_iov, uiop->uio_iovcnt);
 		uiod.d_mp = 0;
 		/*
 		 * Mark that a thread is in rwnext on the read side
@@ -1030,6 +1039,8 @@ strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
 			if ((bp = uiod.d_mp) != NULL) {
 				*errorp = 0;
 				ASSERT(MUTEX_HELD(&stp->sd_lock));
+				if (iovlen != 0)
+					kmem_free(uiod.d_iov, iovlen);
 				return (bp);
 			}
 			error = 0;
@@ -1049,8 +1060,14 @@ strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
 		} else {
 			*errorp = error;
 			ASSERT(MUTEX_HELD(&stp->sd_lock));
+			if (iovlen != 0)
+				kmem_free(uiod.d_iov, iovlen);
 			return (NULL);
 		}
+
+		if (iovlen != 0)
+			kmem_free(uiod.d_iov, iovlen);
+
 		/*
 		 * Try a getq in case a rwnext() generated mblk
 		 * has bubbled up via strrput().
@@ -2545,6 +2562,8 @@ strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
     int b_flag, int pri, int flags)
 {
 	struiod_t uiod;
+	struct iovec buf[IOV_MAX_STACK];
+	int iovlen = 0;
 	mblk_t *mp;
 	queue_t *wqp = stp->sd_wrq;
 	int error = 0;
@@ -2636,13 +2655,21 @@ strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
 	mp->b_flag |= b_flag;
 	mp->b_band = (uchar_t)pri;
 
-	(void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
-	    sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
+	if (uiop->uio_iovcnt > IOV_MAX_STACK) {
+		iovlen = uiop->uio_iovcnt * sizeof (iovec_t);
+		uiod.d_iov = (struct iovec *)kmem_alloc(iovlen, KM_SLEEP);
+	} else {
+		uiod.d_iov = buf;
+	}
+
+	(void) uiodup(uiop, &uiod.d_uio, uiod.d_iov, uiop->uio_iovcnt);
 	uiod.d_uio.uio_offset = 0;
 	uiod.d_mp = mp;
 	error = rwnext(wqp, &uiod);
 	if (! uiod.d_mp) {
 		uioskip(uiop, *iosize);
+		if (iovlen != 0)
+			kmem_free(uiod.d_iov, iovlen);
 		return (error);
 	}
 	ASSERT(mp == uiod.d_mp);
@@ -2660,17 +2687,23 @@ strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
 		error = 0;
 	} else {
 		freemsg(mp);
+		if (iovlen != 0)
+			kmem_free(uiod.d_iov, iovlen);
 		return (error);
 	}
 	/* Have to check canput before consuming data from the uio */
 	if (pri == 0) {
 		if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
 			freemsg(mp);
+			if (iovlen != 0)
+				kmem_free(uiod.d_iov, iovlen);
 			return (EWOULDBLOCK);
 		}
 	} else {
 		if (!bcanputnext(wqp, pri) && !(flags & MSG_IGNFLOW)) {
 			freemsg(mp);
+			if (iovlen != 0)
+				kmem_free(uiod.d_iov, iovlen);
 			return (EWOULDBLOCK);
 		}
 	}
@@ -2678,6 +2711,8 @@ strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
 	/* Copyin data from the uio */
 	if ((error = struioget(wqp, mp, &uiod, 0)) != 0) {
 		freemsg(mp);
+		if (iovlen != 0)
+			kmem_free(uiod.d_iov, iovlen);
 		return (error);
 	}
 	uioskip(uiop, *iosize);
@@ -2694,6 +2729,8 @@ strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
 		putnext(wqp, mp);
 		stream_runservice(stp);
 	}
+	if (iovlen != 0)
+		kmem_free(uiod.d_iov, iovlen);
 	return (0);
 }
 
@@ -3179,6 +3216,7 @@ job_control_type(int cmd)
 	case JAGENT:	/* Obsolete */
 	case JTRUN:	/* Obsolete */
 	case JXTPROTO:	/* Obsolete */
+	case TIOCSETLD:
 		return (JCSETP);
 	}
 
diff --git a/usr/src/uts/common/os/strsubr.c b/usr/src/uts/common/os/strsubr.c
index 8cc27df4eb..959e5576f0 100644
--- a/usr/src/uts/common/os/strsubr.c
+++ b/usr/src/uts/common/os/strsubr.c
@@ -26,6 +26,7 @@
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright (c) 2016 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
  */
 
@@ -8461,6 +8462,12 @@ mblk_copycred(mblk_t *mp, const mblk_t *src)
 		dbp->db_cpid = cpid;
 }
 
+
+/*
+ * Now that NIC drivers are expected to deal only with M_DATA mblks, the
+ * hcksum_assoc and hcksum_retrieve functions are deprecated in favor of their
+ * respective mac_hcksum_set and mac_hcksum_get counterparts.
+ */
 int
 hcksum_assoc(mblk_t *mp,  multidata_t *mmd, pdesc_t *pd,
     uint32_t start, uint32_t stuff, uint32_t end, uint32_t value,
diff --git a/usr/src/uts/common/os/sunddi.c b/usr/src/uts/common/os/sunddi.c
index ede7da413b..b1727729de 100644
--- a/usr/src/uts/common/os/sunddi.c
+++ b/usr/src/uts/common/os/sunddi.c
@@ -5903,6 +5903,12 @@ ddi_ffs(long mask)
 	return (ffs(mask));
 }
 
+int
+ddi_ffsll(long long mask)
+{
+	return (ffs(mask));
+}
+
 /*
  * Find last bit set. Take mask and clear
  * all but the most significant bit, and
@@ -5914,8 +5920,14 @@ ddi_ffs(long mask)
 int
 ddi_fls(long mask)
 {
+	return (ddi_flsll(mask));
+}
+
+int
+ddi_flsll(long long mask)
+{
 	while (mask) {
-		long nx;
+		long long nx;
 
 		if ((nx = (mask & (mask - 1))) == 0)
 			break;
diff --git a/usr/src/uts/common/os/sysent.c b/usr/src/uts/common/os/sysent.c
index b3861dec03..4dd48c7e19 100644
--- a/usr/src/uts/common/os/sysent.c
+++ b/usr/src/uts/common/os/sysent.c
@@ -23,7 +23,7 @@
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2012 Milan Jurik. All rights reserved.
  * Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright (c) 2015, Joyent, Inc.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -61,8 +61,7 @@ struct mmaplf32a;
 int	access(char *, int);
 int	alarm(int);
 int	auditsys(struct auditcalls *, rval_t *);
-int64_t	brandsys(int, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t,
-    uintptr_t);
+int64_t	brandsys(int, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 intptr_t	brk(caddr_t);
 int	chdir(char *);
 int	chmod(char *, int);
@@ -647,7 +646,7 @@ struct sysent sysent[NSYSCALL] =
 			SYSENT_NOSYS(),
 			SYSENT_C("llseek",	llseek32,	4)),
 	/* 176 */ SYSENT_LOADABLE(),		/* inst_sync */
-	/* 177 */ SYSENT_CI("brandsys",		brandsys,	6),
+	/* 177 */ SYSENT_CI("brandsys",		brandsys,	5),
 	/* 178 */ SYSENT_LOADABLE(),		/* kaio */
 	/* 179 */ SYSENT_LOADABLE(),		/* cpc */
 	/* 180 */ SYSENT_CI("lgrpsys",		lgrpsys,	3),
@@ -1002,7 +1001,7 @@ struct sysent sysent32[NSYSCALL] =
 	/* 174 */ SYSENT_CI("pwrite",		pwrite32,		4),
 	/* 175 */ SYSENT_C("llseek",		llseek32,	4),
 	/* 176 */ SYSENT_LOADABLE32(),		/* inst_sync */
-	/* 177 */ SYSENT_CI("brandsys",		brandsys,	6),
+	/* 177 */ SYSENT_CI("brandsys",		brandsys,	5),
 	/* 178 */ SYSENT_LOADABLE32(),		/* kaio */
 	/* 179 */ SYSENT_LOADABLE32(),		/* cpc */
 	/* 180 */ SYSENT_CI("lgrpsys",		lgrpsys,	3),
@@ -1094,18 +1093,20 @@ char **syscallnames;
 
 systrace_sysent_t *systrace_sysent;
 void (*systrace_probe)(dtrace_id_t, uintptr_t, uintptr_t,
-    uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+    uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 
 /*ARGSUSED*/
 void
 systrace_stub(dtrace_id_t id, uintptr_t arg0, uintptr_t arg1,
-    uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5)
+    uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5,
+    uintptr_t arg6, uintptr_t arg7)
 {}
 
 /*ARGSUSED*/
 int64_t
 dtrace_systrace_syscall(uintptr_t arg0, uintptr_t arg1, uintptr_t arg2,
-    uintptr_t arg3, uintptr_t arg4, uintptr_t arg5)
+    uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6,
+    uintptr_t arg7)
 {
 	systrace_sysent_t *sy = &systrace_sysent[curthread->t_sysnum];
 	dtrace_id_t id;
@@ -1113,7 +1114,8 @@ dtrace_systrace_syscall(uintptr_t arg0, uintptr_t arg1, uintptr_t arg2,
 	proc_t *p;
 
 	if ((id = sy->stsy_entry) != DTRACE_IDNONE)
-		(*systrace_probe)(id, arg0, arg1, arg2, arg3, arg4, arg5);
+		(*systrace_probe)(id, arg0, arg1, arg2, arg3, arg4, arg5,
+		    arg6, arg7);
 
 	/*
 	 * We want to explicitly allow DTrace consumers to stop a process
@@ -1127,14 +1129,15 @@ dtrace_systrace_syscall(uintptr_t arg0, uintptr_t arg1, uintptr_t arg2,
 	}
 	mutex_exit(&p->p_lock);
 
-	rval = (*sy->stsy_underlying)(arg0, arg1, arg2, arg3, arg4, arg5);
+	rval = (*sy->stsy_underlying)(arg0, arg1, arg2, arg3, arg4, arg5,
+	    arg6, arg7);
 
 	if (ttolwp(curthread)->lwp_errno != 0)
 		rval = -1;
 
 	if ((id = sy->stsy_return) != DTRACE_IDNONE)
 		(*systrace_probe)(id, (uintptr_t)rval, (uintptr_t)rval,
-		    (uintptr_t)((int64_t)rval >> 32), 0, 0, 0);
+		    (uintptr_t)((int64_t)rval >> 32), 0, 0, 0, 0, 0);
 
 	return (rval);
 }
@@ -1146,7 +1149,8 @@ systrace_sysent_t *systrace_sysent32;
 /*ARGSUSED*/
 int64_t
 dtrace_systrace_syscall32(uintptr_t arg0, uintptr_t arg1, uintptr_t arg2,
-    uintptr_t arg3, uintptr_t arg4, uintptr_t arg5)
+    uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6,
+    uintptr_t arg7)
 {
 	systrace_sysent_t *sy = &systrace_sysent32[curthread->t_sysnum];
 	dtrace_id_t id;
@@ -1154,7 +1158,8 @@ dtrace_systrace_syscall32(uintptr_t arg0, uintptr_t arg1, uintptr_t arg2,
 	proc_t *p;
 
 	if ((id = sy->stsy_entry) != DTRACE_IDNONE)
-		(*systrace_probe)(id, arg0, arg1, arg2, arg3, arg4, arg5);
+		(*systrace_probe)(id, arg0, arg1, arg2, arg3, arg4, arg5, arg6,
+		    arg7);
 
 	/*
 	 * We want to explicitly allow DTrace consumers to stop a process
@@ -1168,14 +1173,15 @@ dtrace_systrace_syscall32(uintptr_t arg0, uintptr_t arg1, uintptr_t arg2,
 	}
 	mutex_exit(&p->p_lock);
 
-	rval = (*sy->stsy_underlying)(arg0, arg1, arg2, arg3, arg4, arg5);
+	rval = (*sy->stsy_underlying)(arg0, arg1, arg2, arg3, arg4, arg5, arg6,
+	    arg7);
 
 	if (ttolwp(curthread)->lwp_errno != 0)
 		rval = -1;
 
 	if ((id = sy->stsy_return) != DTRACE_IDNONE)
 		(*systrace_probe)(id, (uintptr_t)rval, (uintptr_t)rval,
-		    (uintptr_t)((uint64_t)rval >> 32), 0, 0, 0);
+		    (uintptr_t)((uint64_t)rval >> 32), 0, 0, 0, 0, 0);
 
 	return (rval);
 }
@@ -1203,5 +1209,5 @@ dtrace_systrace_rtt(void)
 	}
 
 	if ((id = sy->stsy_return) != DTRACE_IDNONE)
-		(*systrace_probe)(id, 0, 0, 0, 0, 0, 0);
+		(*systrace_probe)(id, 0, 0, 0, 0, 0, 0, 0, 0);
 }
diff --git a/usr/src/uts/common/os/timer.c b/usr/src/uts/common/os/timer.c
index b25a6cbcf1..5453ebf380 100644
--- a/usr/src/uts/common/os/timer.c
+++ b/usr/src/uts/common/os/timer.c
@@ -25,11 +25,12 @@
  */
 
 /*
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/timer.h>
 #include <sys/systm.h>
+#include <sys/sysmacros.h>
 #include <sys/param.h>
 #include <sys/kmem.h>
 #include <sys/debug.h>
@@ -81,6 +82,7 @@ timer_lock(proc_t *p, itimer_t *it)
  * waiters.  p_lock must be held on entry; it will not be dropped by
  * timer_unlock().
  */
+/* ARGSUSED */
 static void
 timer_unlock(proc_t *p, itimer_t *it)
 {
@@ -123,6 +125,7 @@ timer_delete_locked(proc_t *p, timer_t tid, itimer_t *it)
 		timer_lock(p, it);
 	}
 
+	ASSERT(p->p_itimer_sz > tid);
 	ASSERT(p->p_itimer[tid] == it);
 	p->p_itimer[tid] = NULL;
 
@@ -137,7 +140,7 @@ timer_delete_locked(proc_t *p, timer_t tid, itimer_t *it)
 
 	it->it_backend->clk_timer_delete(it);
 
-	if (it->it_portev) {
+	if (it->it_flags & IT_PORT) {
 		mutex_enter(&it->it_mutex);
 		if (it->it_portev) {
 			port_kevent_t	*pev;
@@ -199,18 +202,20 @@ timer_delete_locked(proc_t *p, timer_t tid, itimer_t *it)
 static itimer_t *
 timer_grab(proc_t *p, timer_t tid)
 {
-	itimer_t **itp, *it;
+	itimer_t *it;
 
-	if (tid >= timer_max || tid < 0)
+	if (tid < 0) {
 		return (NULL);
+	}
 
 	mutex_enter(&p->p_lock);
-
-	if ((itp = p->p_itimer) == NULL || (it = itp[tid]) == NULL) {
+	if (p->p_itimer == NULL || tid >= p->p_itimer_sz ||
+	    (it = p->p_itimer[tid]) == NULL) {
 		mutex_exit(&p->p_lock);
 		return (NULL);
 	}
 
+	/* This may drop p_lock temporarily. */
 	timer_lock(p, it);
 
 	if (it->it_lock & ITLK_REMOVE) {
@@ -232,7 +237,7 @@ timer_grab(proc_t *p, timer_t tid)
  * should not be held on entry; timer_release() will acquire p_lock but
  * will drop it before returning.
  */
-static void
+void
 timer_release(proc_t *p, itimer_t *it)
 {
 	mutex_enter(&p->p_lock);
@@ -245,7 +250,7 @@ timer_release(proc_t *p, itimer_t *it)
  * p_lock should not be held on entry; timer_delete_grabbed() will acquire
  * p_lock, but will drop it before returning.
  */
-static void
+void
 timer_delete_grabbed(proc_t *p, timer_t tid, itimer_t *it)
 {
 	mutex_enter(&p->p_lock);
@@ -258,6 +263,13 @@ clock_timer_init()
 {
 	clock_timer_cache = kmem_cache_create("timer_cache",
 	    sizeof (itimer_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
+
+	/*
+	 * Push the timer_max limit up to at least 4 * NCPU.  Due to the way
+	 * NCPU is defined, proper initialization of the timer limit is
+	 * performed at runtime.
+	 */
+	timer_max = MAX(NCPU * 4, timer_max);
 }
 
 void
@@ -453,6 +465,9 @@ timer_fire(itimer_t *it)
 			it->it_pending = 1;
 			port_send_event((port_kevent_t *)it->it_portev);
 			mutex_exit(&it->it_mutex);
+		} else if (it->it_flags & IT_CALLBACK) {
+			it->it_cb_func(it);
+			ASSERT(MUTEX_NOT_HELD(&it->it_mutex));
 		} else if (it->it_flags & IT_SIGNAL) {
 			it->it_pending = 1;
 			mutex_exit(&it->it_mutex);
@@ -466,159 +481,175 @@ timer_fire(itimer_t *it)
 		mutex_exit(&p->p_lock);
 }
 
-int
-timer_create(clockid_t clock, struct sigevent *evp, timer_t *tid)
+/*
+ * Allocate an itimer_t and find and appropriate slot for it in p_itimer.
+ * Acquires p_lock and holds it on return, regardless of success.
+ */
+static itimer_t *
+timer_alloc(proc_t *p, timer_t *id)
 {
-	struct sigevent ev;
-	proc_t *p = curproc;
-	clock_backend_t *backend;
-	itimer_t *it, **itp;
-	sigqueue_t *sigq;
-	cred_t *cr = CRED();
-	int error = 0;
-	timer_t i;
-	port_notify_t tim_pnevp;
-	port_kevent_t *pkevp = NULL;
+	itimer_t *it, **itp = NULL;
+	uint_t i;
 
-	if ((backend = CLOCK_BACKEND(clock)) == NULL)
-		return (set_errno(EINVAL));
+	ASSERT(MUTEX_NOT_HELD(&p->p_lock));
 
-	if (evp != NULL) {
-		/*
-		 * short copyin() for binary compatibility
-		 * fetch oldsigevent to determine how much to copy in.
-		 */
-		if (get_udatamodel() == DATAMODEL_NATIVE) {
-			if (copyin(evp, &ev, sizeof (struct oldsigevent)))
-				return (set_errno(EFAULT));
+	it = kmem_cache_alloc(clock_timer_cache, KM_SLEEP);
+	bzero(it, sizeof (itimer_t));
+	mutex_init(&it->it_mutex, NULL, MUTEX_DEFAULT, NULL);
 
-			if (ev.sigev_notify == SIGEV_PORT ||
-			    ev.sigev_notify == SIGEV_THREAD) {
-				if (copyin(ev.sigev_value.sival_ptr, &tim_pnevp,
-				    sizeof (port_notify_t)))
-					return (set_errno(EFAULT));
+	mutex_enter(&p->p_lock);
+retry:
+	if (p->p_itimer != NULL) {
+		for (i = 0; i < p->p_itimer_sz; i++) {
+			if (p->p_itimer[i] == NULL) {
+				itp = &(p->p_itimer[i]);
+				break;
 			}
-#ifdef	_SYSCALL32_IMPL
-		} else {
-			struct sigevent32 ev32;
-			port_notify32_t tim_pnevp32;
+		}
+	}
 
-			if (copyin(evp, &ev32, sizeof (struct oldsigevent32)))
-				return (set_errno(EFAULT));
-			ev.sigev_notify = ev32.sigev_notify;
-			ev.sigev_signo = ev32.sigev_signo;
+	/*
+	 * A suitable slot was not found.  If possible, allocate (or resize)
+	 * the p_itimer array and try again.
+	 */
+	if (itp == NULL) {
+		uint_t target_sz = _TIMER_ALLOC_INIT;
+		itimer_t **itp_new;
+
+		if (p->p_itimer != NULL) {
+			ASSERT(p->p_itimer_sz != 0);
+
+			target_sz = p->p_itimer_sz * 2;
+		}
+		/*
+		 * Protect against exceeding the max or overflow
+		 */
+		if (target_sz > timer_max || target_sz > INT_MAX ||
+		    target_sz < p->p_itimer_sz) {
+			kmem_cache_free(clock_timer_cache, it);
+			return (NULL);
+		}
+		mutex_exit(&p->p_lock);
+		itp_new = kmem_zalloc(target_sz * sizeof (itimer_t *),
+		    KM_SLEEP);
+		mutex_enter(&p->p_lock);
+		if (target_sz <= p->p_itimer_sz) {
 			/*
-			 * See comment in sigqueue32() on handling of 32-bit
-			 * sigvals in a 64-bit kernel.
+			 * A racing thread performed the resize while we were
+			 * waiting outside p_lock.  Discard our now-useless
+			 * allocation and retry.
 			 */
-			ev.sigev_value.sival_int = ev32.sigev_value.sival_int;
-			if (ev.sigev_notify == SIGEV_PORT ||
-			    ev.sigev_notify == SIGEV_THREAD) {
-				if (copyin((void *)(uintptr_t)
-				    ev32.sigev_value.sival_ptr,
-				    (void *)&tim_pnevp32,
-				    sizeof (port_notify32_t)))
-					return (set_errno(EFAULT));
-				tim_pnevp.portnfy_port =
-				    tim_pnevp32.portnfy_port;
-				tim_pnevp.portnfy_user =
-				    (void *)(uintptr_t)tim_pnevp32.portnfy_user;
+			kmem_free(itp_new, target_sz * sizeof (itimer_t *));
+			goto retry;
+		} else {
+			/*
+			 * Instantiate the larger allocation and select the
+			 * first fresh entry for use.
+			 */
+			if (p->p_itimer != NULL) {
+				uint_t old_sz;
+
+				old_sz = p->p_itimer_sz;
+				bcopy(p->p_itimer, itp_new,
+				    old_sz * sizeof (itimer_t *));
+				kmem_free(p->p_itimer,
+				    old_sz * sizeof (itimer_t *));
+
+				/*
+				 * Short circuit to use the first free entry in
+				 * the new allocation.  It's possible that
+				 * other lower-indexed timers were freed while
+				 * p_lock was dropped, but skipping over them
+				 * is not harmful at all.  In the common case,
+				 * we skip the need to walk over an array
+				 * filled with timers before arriving at the
+				 * slot we know is fresh from the allocation.
+				 */
+				i = old_sz;
+			} else {
+				/*
+				 * For processes lacking any existing timers,
+				 * we can simply select the first entry.
+				 */
+				i = 0;
 			}
-#endif
+			p->p_itimer = itp_new;
+			p->p_itimer_sz = target_sz;
 		}
-		switch (ev.sigev_notify) {
-		case SIGEV_NONE:
-			break;
-		case SIGEV_SIGNAL:
-			if (ev.sigev_signo < 1 || ev.sigev_signo >= NSIG)
-				return (set_errno(EINVAL));
-			break;
-		case SIGEV_THREAD:
-		case SIGEV_PORT:
-			break;
-		default:
-			return (set_errno(EINVAL));
-		}
-	} else {
-		/*
-		 * Use the clock's default sigevent (this is a structure copy).
-		 */
-		ev = backend->clk_default;
 	}
 
+	ASSERT(i <= INT_MAX);
+	*id = (timer_t)i;
+	return (it);
+}
+
+/*
+ * Setup a timer
+ *
+ * This allocates an itimer_t (including a timer_t ID and slot in the process),
+ * wires it up according to the provided sigevent, and associates it with the
+ * desired clock backend.  Upon successful completion, the timer will be
+ * locked, preventing it from being armed via timer_settime() or deleted via
+ * timer_delete().  This gives the caller a chance to perform any last minute
+ * manipulations (such as configuring the IT_CALLBACK functionality and/or
+ * copying the timer_t out to userspace) before using timer_release() to unlock
+ * it or timer_delete_grabbed() to delete it.
+ */
+int
+timer_setup(clock_backend_t *backend, struct sigevent *evp, port_notify_t *pnp,
+    itimer_t **itp, timer_t *tidp)
+{
+	proc_t *p = curproc;
+	int error = 0;
+	itimer_t *it;
+	sigqueue_t *sigq;
+	timer_t tid;
+
 	/*
-	 * We'll allocate our timer and sigqueue now, before we grab p_lock.
-	 * If we can't find an empty slot, we'll free them before returning.
+	 * We'll allocate our sigqueue now, before we grab p_lock.
+	 * If we can't find an empty slot, we'll free it before returning.
 	 */
-	it = kmem_cache_alloc(clock_timer_cache, KM_SLEEP);
-	bzero(it, sizeof (itimer_t));
-	mutex_init(&it->it_mutex, NULL, MUTEX_DEFAULT, NULL);
 	sigq = kmem_zalloc(sizeof (sigqueue_t), KM_SLEEP);
 
-	mutex_enter(&p->p_lock);
-
 	/*
-	 * If this is this process' first timer, we need to attempt to allocate
-	 * an array of timerstr_t pointers.  We drop p_lock to perform the
-	 * allocation; if we return to discover that p_itimer is non-NULL,
-	 * we will free our allocation and drive on.
+	 * Allocate a timer and choose a slot for it. This acquires p_lock.
 	 */
-	if ((itp = p->p_itimer) == NULL) {
-		mutex_exit(&p->p_lock);
-		itp = kmem_zalloc(timer_max * sizeof (itimer_t *), KM_SLEEP);
-		mutex_enter(&p->p_lock);
-
-		if (p->p_itimer == NULL)
-			p->p_itimer = itp;
-		else {
-			kmem_free(itp, timer_max * sizeof (itimer_t *));
-			itp = p->p_itimer;
-		}
-	}
-
-	for (i = 0; i < timer_max && itp[i] != NULL; i++)
-		continue;
+	it = timer_alloc(p, &tid);
+	ASSERT(MUTEX_HELD(&p->p_lock));
 
-	if (i == timer_max) {
-		/*
-		 * We couldn't find a slot.  Drop p_lock, free the preallocated
-		 * timer and sigqueue, and return an error.
-		 */
+	if (it == NULL) {
 		mutex_exit(&p->p_lock);
-		kmem_cache_free(clock_timer_cache, it);
 		kmem_free(sigq, sizeof (sigqueue_t));
-
-		return (set_errno(EAGAIN));
+		return (EAGAIN);
 	}
 
-	ASSERT(i < timer_max && itp[i] == NULL);
+	ASSERT(tid < p->p_itimer_sz && p->p_itimer[tid] == NULL);
+	ASSERT(evp != NULL);
 
 	/*
 	 * If we develop other notification mechanisms, this will need
 	 * to call into (yet another) backend.
 	 */
-	sigq->sq_info.si_signo = ev.sigev_signo;
-	if (evp == NULL)
-		sigq->sq_info.si_value.sival_int = i;
-	else
-		sigq->sq_info.si_value = ev.sigev_value;
+	sigq->sq_info.si_signo = evp->sigev_signo;
+	sigq->sq_info.si_value = evp->sigev_value;
 	sigq->sq_info.si_code = SI_TIMER;
 	sigq->sq_info.si_pid = p->p_pid;
 	sigq->sq_info.si_ctid = PRCTID(p);
 	sigq->sq_info.si_zoneid = getzoneid();
-	sigq->sq_info.si_uid = crgetruid(cr);
+	sigq->sq_info.si_uid = crgetruid(CRED());
 	sigq->sq_func = timer_signal;
 	sigq->sq_next = NULL;
 	sigq->sq_backptr = it;
 	it->it_sigq = sigq;
 	it->it_backend = backend;
 	it->it_lock = ITLK_LOCKED;
-	itp[i] = it;
 
-
-	if (ev.sigev_notify == SIGEV_THREAD ||
-	    ev.sigev_notify == SIGEV_PORT) {
+	if (evp->sigev_notify == SIGEV_THREAD ||
+	    evp->sigev_notify == SIGEV_PORT) {
 		int port;
+		port_kevent_t *pkevp = NULL;
+
+		ASSERT(pnp != NULL);
 
 		/*
 		 * This timer is programmed to use event port notification when
@@ -638,18 +669,17 @@ timer_create(clockid_t clock, struct sigevent *evp, timer_t *tid)
 		 */
 
 		it->it_flags |= IT_PORT;
-		port = tim_pnevp.portnfy_port;
+		port = pnp->portnfy_port;
 
 		/* associate timer as event source with the port */
 		error = port_associate_ksource(port, PORT_SOURCE_TIMER,
 		    (port_source_t **)&it->it_portsrc, timer_close_port,
 		    (void *)it, NULL);
 		if (error) {
-			itp[i] = NULL;		/* clear slot */
 			mutex_exit(&p->p_lock);
 			kmem_cache_free(clock_timer_cache, it);
 			kmem_free(sigq, sizeof (sigqueue_t));
-			return (set_errno(error));
+			return (error);
 		}
 
 		/* allocate an event structure/slot */
@@ -658,23 +688,24 @@ timer_create(clockid_t clock, struct sigevent *evp, timer_t *tid)
 		if (error) {
 			(void) port_dissociate_ksource(port, PORT_SOURCE_TIMER,
 			    (port_source_t *)it->it_portsrc);
-			itp[i] = NULL;		/* clear slot */
 			mutex_exit(&p->p_lock);
 			kmem_cache_free(clock_timer_cache, it);
 			kmem_free(sigq, sizeof (sigqueue_t));
-			return (set_errno(error));
+			return (error);
 		}
 
 		/* initialize event data */
-		port_init_event(pkevp, i, tim_pnevp.portnfy_user,
+		port_init_event(pkevp, tid, pnp->portnfy_user,
 		    timer_port_callback, it);
 		it->it_portev = pkevp;
 		it->it_portfd = port;
 	} else {
-		if (ev.sigev_notify == SIGEV_SIGNAL)
+		if (evp->sigev_notify == SIGEV_SIGNAL)
 			it->it_flags |= IT_SIGNAL;
 	}
 
+	/* Populate the slot now that the timer is prepped. */
+	p->p_itimer[tid] = it;
 	mutex_exit(&p->p_lock);
 
 	/*
@@ -687,17 +718,8 @@ timer_create(clockid_t clock, struct sigevent *evp, timer_t *tid)
 	it->it_lwp = ttolwp(curthread);
 	it->it_proc = p;
 
-	if (copyout(&i, tid, sizeof (timer_t)) != 0) {
-		error = EFAULT;
-		goto err;
-	}
-
-	/*
-	 * If we're here, then we have successfully created the timer; we
-	 * just need to release the timer and return.
-	 */
-	timer_release(p, it);
-
+	*itp = it;
+	*tidp = tid;
 	return (0);
 
 err:
@@ -708,11 +730,115 @@ err:
 	 * impossible for a removal to be pending.
 	 */
 	ASSERT(!(it->it_lock & ITLK_REMOVE));
-	timer_delete_grabbed(p, i, it);
+	timer_delete_grabbed(p, tid, it);
 
-	return (set_errno(error));
+	return (error);
 }
 
+
+int
+timer_create(clockid_t clock, struct sigevent *evp, timer_t *tidp)
+{
+	int error = 0;
+	proc_t *p = curproc;
+	clock_backend_t *backend;
+	struct sigevent ev;
+	itimer_t *it;
+	timer_t tid;
+	port_notify_t tim_pnevp;
+
+	if ((backend = CLOCK_BACKEND(clock)) == NULL)
+		return (set_errno(EINVAL));
+
+	if (evp != NULL) {
+		/*
+		 * short copyin() for binary compatibility
+		 * fetch oldsigevent to determine how much to copy in.
+		 */
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			if (copyin(evp, &ev, sizeof (struct oldsigevent)))
+				return (set_errno(EFAULT));
+
+			if (ev.sigev_notify == SIGEV_PORT ||
+			    ev.sigev_notify == SIGEV_THREAD) {
+				if (copyin(ev.sigev_value.sival_ptr, &tim_pnevp,
+				    sizeof (port_notify_t)))
+					return (set_errno(EFAULT));
+			}
+#ifdef	_SYSCALL32_IMPL
+		} else {
+			struct sigevent32 ev32;
+			port_notify32_t tim_pnevp32;
+
+			if (copyin(evp, &ev32, sizeof (struct oldsigevent32)))
+				return (set_errno(EFAULT));
+			ev.sigev_notify = ev32.sigev_notify;
+			ev.sigev_signo = ev32.sigev_signo;
+			/*
+			 * See comment in sigqueue32() on handling of 32-bit
+			 * sigvals in a 64-bit kernel.
+			 */
+			ev.sigev_value.sival_int = ev32.sigev_value.sival_int;
+			if (ev.sigev_notify == SIGEV_PORT ||
+			    ev.sigev_notify == SIGEV_THREAD) {
+				if (copyin((void *)(uintptr_t)
+				    ev32.sigev_value.sival_ptr,
+				    (void *)&tim_pnevp32,
+				    sizeof (port_notify32_t)))
+					return (set_errno(EFAULT));
+				tim_pnevp.portnfy_port =
+				    tim_pnevp32.portnfy_port;
+				tim_pnevp.portnfy_user =
+				    (void *)(uintptr_t)tim_pnevp32.portnfy_user;
+			}
+#endif
+		}
+		switch (ev.sigev_notify) {
+		case SIGEV_NONE:
+			break;
+		case SIGEV_SIGNAL:
+			if (ev.sigev_signo < 1 || ev.sigev_signo >= NSIG)
+				return (set_errno(EINVAL));
+			break;
+		case SIGEV_THREAD:
+		case SIGEV_PORT:
+			break;
+		default:
+			return (set_errno(EINVAL));
+		}
+	} else {
+		/*
+		 * Use the clock's default sigevent (this is a structure copy).
+		 */
+		ev = backend->clk_default;
+	}
+
+	if ((error = timer_setup(backend, &ev, &tim_pnevp, &it, &tid)) != 0) {
+		return (set_errno(error));
+	}
+
+	/*
+	 * Populate si_value with the timer ID if no sigevent was passed in.
+	 */
+	if (evp == NULL) {
+		it->it_sigq->sq_info.si_value.sival_int = tid;
+	}
+
+	if (copyout(&tid, tidp, sizeof (timer_t)) != 0) {
+		timer_delete_grabbed(p, tid, it);
+		return (set_errno(EFAULT));
+	}
+
+	/*
+	 * If we're here, then we have successfully created the timer; we
+	 * just need to release the timer and return.
+	 */
+	timer_release(p, it);
+
+	return (0);
+}
+
+
 int
 timer_gettime(timer_t tid, itimerspec_t *val)
 {
@@ -832,20 +958,23 @@ timer_getoverrun(timer_t tid)
 void
 timer_lwpexit(void)
 {
-	timer_t i;
+	uint_t i;
 	proc_t *p = curproc;
 	klwp_t *lwp = ttolwp(curthread);
-	itimer_t *it, **itp;
+	itimer_t *it;
 
 	ASSERT(MUTEX_HELD(&p->p_lock));
 
-	if ((itp = p->p_itimer) == NULL)
+	if (p->p_itimer == NULL) {
 		return;
+	}
 
-	for (i = 0; i < timer_max; i++) {
-		if ((it = itp[i]) == NULL)
+	for (i = 0; i < p->p_itimer_sz; i++) {
+		if ((it = p->p_itimer[i]) == NULL) {
 			continue;
+		}
 
+		/* This may drop p_lock temporarily. */
 		timer_lock(p, it);
 
 		if ((it->it_lock & ITLK_REMOVE) || it->it_lwp != lwp) {
@@ -876,20 +1005,22 @@ timer_lwpexit(void)
 void
 timer_lwpbind()
 {
-	timer_t i;
+	uint_t i;
 	proc_t *p = curproc;
 	klwp_t *lwp = ttolwp(curthread);
-	itimer_t *it, **itp;
+	itimer_t *it;
 
 	ASSERT(MUTEX_HELD(&p->p_lock));
 
-	if ((itp = p->p_itimer) == NULL)
+	if (p->p_itimer == NULL) {
 		return;
+	}
 
-	for (i = 0; i < timer_max; i++) {
-		if ((it = itp[i]) == NULL)
+	for (i = 0; i < p->p_itimer_sz; i++) {
+		if ((it = p->p_itimer[i]) == NULL)
 			continue;
 
+		/* This may drop p_lock temporarily. */
 		timer_lock(p, it);
 
 		if (!(it->it_lock & ITLK_REMOVE) && it->it_lwp == lwp) {
@@ -911,16 +1042,19 @@ timer_lwpbind()
 void
 timer_exit(void)
 {
-	timer_t i;
+	uint_t i;
 	proc_t *p = curproc;
 
 	ASSERT(p->p_itimer != NULL);
+	ASSERT(p->p_itimer_sz != 0);
 
-	for (i = 0; i < timer_max; i++)
-		(void) timer_delete(i);
+	for (i = 0; i < p->p_itimer_sz; i++) {
+		(void) timer_delete((timer_t)i);
+	}
 
-	kmem_free(p->p_itimer, timer_max * sizeof (itimer_t *));
+	kmem_free(p->p_itimer, p->p_itimer_sz * sizeof (itimer_t *));
 	p->p_itimer = NULL;
+	p->p_itimer_sz = 0;
 }
 
 /*
@@ -977,7 +1111,7 @@ timer_close_port(void *arg, int port, pid_t pid, int lastclose)
 	for (tid = 0; tid < timer_max; tid++) {
 		if ((it = timer_grab(p, tid)) == NULL)
 			continue;
-		if (it->it_portev) {
+		if (it->it_flags & IT_PORT) {
 			mutex_enter(&it->it_mutex);
 			if (it->it_portfd == port) {
 				port_kevent_t *pev;
diff --git a/usr/src/uts/common/os/timers.c b/usr/src/uts/common/os/timers.c
index 61acc6cf97..53be806026 100644
--- a/usr/src/uts/common/os/timers.c
+++ b/usr/src/uts/common/os/timers.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
@@ -1172,6 +1173,14 @@ timespectohz64(timespec_t *tv)
 void
 hrt2ts(hrtime_t hrt, timestruc_t *tsp)
 {
+#if defined(__amd64)
+	/*
+	 * The cleverness explained above is unecessary on x86_64 CPUs where
+	 * modern compilers are able to optimize down to faster operations.
+	 */
+	tsp->tv_sec = hrt / NANOSEC;
+	tsp->tv_nsec = hrt % NANOSEC;
+#else
 	uint32_t sec, nsec, tmp;
 
 	tmp = (uint32_t)(hrt >> 30);
@@ -1193,20 +1202,28 @@ hrt2ts(hrtime_t hrt, timestruc_t *tsp)
 	}
 	tsp->tv_sec = (time_t)sec;
 	tsp->tv_nsec = nsec;
+#endif /* defined(__amd64) */
 }
 
 /*
  * Convert from timestruc_t to hrtime_t.
- *
- * The code below is equivalent to:
- *
- *	hrt = tsp->tv_sec * NANOSEC + tsp->tv_nsec;
- *
- * but requires no integer multiply.
  */
 hrtime_t
 ts2hrt(const timestruc_t *tsp)
 {
+#if defined(__amd64) || defined(__i386)
+	/*
+	 * On modern x86 CPUs, the simple version is faster.
+	 */
+	return ((tsp->tv_sec * NANOSEC) + tsp->tv_nsec);
+#else
+	/*
+	 * The code below is equivalent to:
+	 *
+	 *	hrt = tsp->tv_sec * NANOSEC + tsp->tv_nsec;
+	 *
+	 * but requires no integer multiply.
+	 */
 	hrtime_t hrt;
 
 	hrt = tsp->tv_sec;
@@ -1215,6 +1232,7 @@ ts2hrt(const timestruc_t *tsp)
 	hrt = (hrt << 7) - hrt - hrt - hrt;
 	hrt = (hrt << 9) + tsp->tv_nsec;
 	return (hrt);
+#endif /* defined(__amd64) || defined(__i386) */
 }
 
 /*
@@ -1246,6 +1264,13 @@ tv2hrt(struct timeval *tvp)
 void
 hrt2tv(hrtime_t hrt, struct timeval *tvp)
 {
+#if defined(__amd64)
+	/*
+	 * Like hrt2ts, the simple version is faster on x86_64.
+	 */
+	tvp->tv_sec = hrt / NANOSEC;
+	tvp->tv_usec = (hrt % NANOSEC) / (NANOSEC / MICROSEC);
+#else
 	uint32_t sec, nsec, tmp;
 	uint32_t q, r, t;
 
@@ -1267,17 +1292,17 @@ hrt2tv(hrtime_t hrt, struct timeval *tvp)
 		sec++;
 	}
 	tvp->tv_sec = (time_t)sec;
-/*
- * this routine is very similar to hr2ts, but requires microseconds
- * instead of nanoseconds, so an interger divide by 1000 routine
- * completes the conversion
- */
+	/*
+	 * this routine is very similar to hr2ts, but requires microseconds
+	 * instead of nanoseconds, so an interger divide by 1000 routine
+	 * completes the conversion
+	 */
 	t = (nsec >> 7) + (nsec >> 8) + (nsec >> 12);
 	q = (nsec >> 1) + t + (nsec >> 15) + (t >> 11) + (t >> 14);
 	q = q >> 9;
 	r = nsec - q*1000;
 	tvp->tv_usec = q + ((r + 24) >> 10);
-
+#endif /* defined(__amd64) */
 }
 
 int
diff --git a/usr/src/uts/common/os/vm_pageout.c b/usr/src/uts/common/os/vm_pageout.c
index 608208bbca..f5ee76a2cb 100644
--- a/usr/src/uts/common/os/vm_pageout.c
+++ b/usr/src/uts/common/os/vm_pageout.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -58,6 +59,7 @@
 #include <sys/tnf_probe.h>
 #include <sys/mem_cage.h>
 #include <sys/time.h>
+#include <sys/zone.h>
 
 #include <vm/hat.h>
 #include <vm/as.h>
@@ -73,7 +75,7 @@ static int checkpage(page_t *, int);
  * algorithm.  They are initialized to 0, and then computed at boot time
  * based on the size of the system.  If they are patched non-zero in
  * a loaded vmunix they are left alone and may thus be changed per system
- * using adb on the loaded system.
+ * using mdb on the loaded system.
  */
 pgcnt_t		slowscan = 0;
 pgcnt_t		fastscan = 0;
@@ -81,6 +83,7 @@ pgcnt_t		fastscan = 0;
 static pgcnt_t	handspreadpages = 0;
 static int	loopfraction = 2;
 static pgcnt_t	looppages;
+/* See comment below describing 4% and 80% */
 static int	min_percent_cpu = 4;
 static int	max_percent_cpu = 80;
 static pgcnt_t	maxfastscan = 0;
@@ -98,14 +101,34 @@ pgcnt_t	deficit;
 pgcnt_t	nscan;
 pgcnt_t	desscan;
 
+/* kstats */
+uint64_t low_mem_scan;
+uint64_t zone_cap_scan;
+uint64_t n_throttle;
+
+clock_t	zone_pageout_ticks;	/* tunable to change zone pagescan ticks */
+
 /*
  * Values for min_pageout_ticks, max_pageout_ticks and pageout_ticks
  * are the number of ticks in each wakeup cycle that gives the
  * equivalent of some underlying %CPU duty cycle.
- * When RATETOSCHEDPAGING is 4,  and hz is 100, pageout_scanner is
- * awakened every 25 clock ticks.  So, converting from %CPU to ticks
- * per wakeup cycle would be x% of 25, that is (x * 100) / 25.
- * So, for example, 4% == 1 tick and 80% == 20 ticks.
+ *
+ * For example, when RATETOSCHEDPAGING is 4 (the default), then schedpaging()
+ * will run 4 times/sec to update pageout scanning parameters and kickoff
+ * the pageout_scanner() thread if necessary.
+ *
+ * Given hz is 100, min_pageout_ticks will be set to 1 (1% of a CPU). When
+ * pageout_ticks is set to min_pageout_ticks, then the total CPU time consumed
+ * by the scanner in a 1 second interval is 4% of a CPU (RATETOSCHEDPAGING * 1).
+ *
+ * Given hz is 100, max_pageout_ticks will be set to 20 (20% of a CPU). When
+ * pageout_ticks is set to max_pageout_ticks, then the total CPU time consumed
+ * by the scanner in a 1 second interval is 80% of a CPU
+ * (RATETOSCHEDPAGING * 20). There is no point making max_pageout_ticks >25
+ * since schedpaging() runs RATETOSCHEDPAGING (4) times/sec.
+ *
+ * If hz is 1000, then min_pageout_ticks will be 10 and max_pageout_ticks
+ * will be 200, so the CPU percentages are the same as when hz is 100.
  *
  * min_pageout_ticks:
  *     ticks/wakeup equivalent of min_percent_cpu.
@@ -117,19 +140,29 @@ pgcnt_t	desscan;
  *     Number of clock ticks budgeted for each wakeup cycle.
  *     Computed each time around by schedpaging().
  *     Varies between min_pageout_ticks .. max_pageout_ticks,
- *     depending on memory pressure.
- *
- * pageout_lbolt:
- *     Timestamp of the last time pageout_scanner woke up and started
- *     (or resumed) scanning for not recently referenced pages.
+ *     depending on memory pressure or zones over their cap.
  */
 
 static clock_t	min_pageout_ticks;
 static clock_t	max_pageout_ticks;
 static clock_t	pageout_ticks;
-static clock_t	pageout_lbolt;
 
-static uint_t	reset_hands;
+#define	MAX_PSCAN_THREADS	16
+static boolean_t reset_hands[MAX_PSCAN_THREADS];
+
+/*
+ * These can be tuned in /etc/system or set with mdb.
+ * 'des_page_scanners' is the desired number of page scanner threads. The
+ * system will bring the actual number of threads into line with the desired
+ * number. If des_page_scanners is set to an invalid value, the system will
+ * correct the setting.
+ */
+uint_t des_page_scanners;
+uint_t pageout_reset_cnt = 64;	/* num. cycles for pageout_scanner hand reset */
+
+uint_t n_page_scanners;
+static pgcnt_t	pscan_region_sz; /* informational only */
+
 
 #define	PAGES_POLL_MASK	1023
 
@@ -145,33 +178,37 @@ static uint_t	reset_hands;
  * pageout_sample_pages:
  *     The accumulated number of pages scanned during sampling.
  *
- * pageout_sample_ticks:
- *     The accumulated clock ticks for the sample.
+ * pageout_sample_etime:
+ *     The accumulated number of nanoseconds for the sample.
  *
  * pageout_rate:
- *     Rate in pages/nanosecond, computed at the end of sampling.
+ *     Rate in pages/second, computed at the end of sampling.
  *
  * pageout_new_spread:
- *     The new value to use for fastscan and handspreadpages.
- *     Calculated after enough samples have been taken.
+ *     The new value to use for maxfastscan and (perhaps) handspreadpages.
+ *     Intended to be the number pages that can be scanned per sec using ~10%
+ *     of a CPU. Calculated after enough samples have been taken.
+ *     pageout_rate / 10
  */
 
 typedef hrtime_t hrrate_t;
 
-static uint64_t	pageout_sample_lim = 4;
-static uint64_t	pageout_sample_cnt = 0;
+static uint_t	pageout_sample_lim = 4;
+static uint_t	pageout_sample_cnt = 0;
 static pgcnt_t	pageout_sample_pages = 0;
 static hrrate_t	pageout_rate = 0;
 static pgcnt_t	pageout_new_spread = 0;
 
-static clock_t	pageout_cycle_ticks;
-static hrtime_t	sample_start, sample_end;
 static hrtime_t	pageout_sample_etime = 0;
 
+/* True if page scanner is first starting up */
+#define	PAGE_SCAN_STARTUP	(pageout_sample_cnt < pageout_sample_lim)
+
 /*
  * Record number of times a pageout_scanner wakeup cycle finished because it
  * timed out (exceeded its CPU budget), rather than because it visited
- * its budgeted number of pages.
+ * its budgeted number of pages. This is only done when scanning under low
+ * free memory conditions, not when scanning for zones over their cap.
  */
 uint64_t pageout_timeouts = 0;
 
@@ -194,25 +231,35 @@ kcondvar_t	memavail_cv;
 #define	LOOPPAGES	total_pages
 
 /*
- * Set up the paging constants for the clock algorithm.
- * Called after the system is initialized and the amount of memory
- * and number of paging devices is known.
+ * Local boolean to control scanning when zones are over their cap. Avoids
+ * accessing the zone_num_over_cap variable except within schedpaging(), which
+ * only runs periodically. This is here only to reduce our access to
+ * zone_num_over_cap, since it is already accessed a lot during paging, and
+ * the page scanner accesses the zones_over variable on each page during a
+ * scan. There is no lock needed for zone_num_over_cap since schedpaging()
+ * doesn't modify the variable, it only cares if the variable is 0 or non-0.
+ */
+static boolean_t zones_over = B_FALSE;
+
+/*
+ * Set up the paging constants for the page scanner clock-hand algorithm.
+ * Called at startup after the system is initialized and the amount of memory
+ * and number of paging devices is known (recalc will be 0). Called again once
+ * PAGE_SCAN_STARTUP is true after the scanner has collected enough samples
+ * (recalc will be 1).
+ *
+ * Will also be called after a memory dynamic reconfiguration operation and
+ * recalc will be 1 in those cases too.
  *
- * lotsfree is 1/64 of memory, but at least 512K.
+ * lotsfree is 1/64 of memory, but at least 512K (ha!).
  * desfree is 1/2 of lotsfree.
  * minfree is 1/2 of desfree.
- *
- * Note: to revert to the paging algorithm of Solaris 2.4/2.5, set:
- *
- *	lotsfree = btop(512K)
- *	desfree = btop(200K)
- *	minfree = btop(100K)
- *	throttlefree = INT_MIN
- *	max_percent_cpu = 4
  */
 void
 setupclock(int recalc)
 {
+	uint_t i;
+	pgcnt_t sz, tmp;
 
 	static spgcnt_t init_lfree, init_dfree, init_mfree;
 	static spgcnt_t init_tfree, init_preserve, init_mpgio;
@@ -221,8 +268,8 @@ setupclock(int recalc)
 	looppages = LOOPPAGES;
 
 	/*
-	 * setupclock can now be called to recalculate the paging
-	 * parameters in the case of dynamic addition of memory.
+	 * setupclock can be called to recalculate the paging
+	 * parameters in the case of dynamic reconfiguration of memory.
 	 * So to make sure we make the proper calculations, if such a
 	 * situation should arise, we save away the initial values
 	 * of each parameter so we can recall them when needed. This
@@ -311,105 +358,98 @@ setupclock(int recalc)
 		maxpgio = init_mpgio;
 
 	/*
-	 * The clock scan rate varies between fastscan and slowscan
-	 * based on the amount of free memory available.  Fastscan
-	 * rate should be set based on the number pages that can be
-	 * scanned per sec using ~10% of processor time.  Since this
-	 * value depends on the processor, MMU, Mhz etc., it is
-	 * difficult to determine it in a generic manner for all
-	 * architectures.
+	 * When the system is in a low memory state, the page scan rate varies
+	 * between fastscan and slowscan based on the amount of free memory
+	 * available. When only zones are over their memory cap, the scan rate
+	 * is always fastscan.
 	 *
-	 * Instead of trying to determine the number of pages scanned
-	 * per sec for every processor, fastscan is set to be the smaller
-	 * of 1/2 of memory or MAXHANDSPREADPAGES and the sampling
-	 * time is limited to ~4% of processor time.
+	 * The fastscan rate should be set based on the number pages that can
+	 * be scanned per sec using ~10% of a CPU. Since this value depends on
+	 * the processor, MMU, Ghz etc., it must be determined dynamically.
 	 *
-	 * Setting fastscan to be 1/2 of memory allows pageout to scan
-	 * all of memory in ~2 secs.  This implies that user pages not
-	 * accessed within 1 sec (assuming, handspreadpages == fastscan)
-	 * can be reclaimed when free memory is very low.  Stealing pages
-	 * not accessed within 1 sec seems reasonable and ensures that
-	 * active user processes don't thrash.
+	 * When the scanner first starts up, fastscan will be set to 0 and
+	 * maxfastscan will be set to MAXHANDSPREADPAGES (64MB, in pages).
+	 * However, once the scanner has collected enough samples, then fastscan
+	 * is set to be the smaller of 1/2 of memory (looppages / loopfraction)
+	 * or maxfastscan (which is set from pageout_new_spread). Thus,
+	 * MAXHANDSPREADPAGES is irrelevant after the scanner is fully
+	 * initialized.
 	 *
-	 * Smaller values of fastscan result in scanning fewer pages
-	 * every second and consequently pageout may not be able to free
-	 * sufficient memory to maintain the minimum threshold.  Larger
-	 * values of fastscan result in scanning a lot more pages which
-	 * could lead to thrashing and higher CPU usage.
+	 * pageout_new_spread is calculated when the scanner first starts
+	 * running. During this initial sampling period the nscan_limit
+	 * is set to the total_pages of system memory. Thus, the scanner could
+	 * theoretically scan all of memory in one pass. However, each sample
+	 * is also limited by the %CPU budget. This is controlled by
+	 * pageout_ticks which is set in schedpaging(). During the sampling
+	 * period, pageout_ticks is set to max_pageout_ticks. This tick value
+	 * is derived from the max_percent_cpu (80%) described above. On a
+	 * system with more than a small amount of memory (~8GB), the scanner's
+	 * %CPU will be the limiting factor in calculating pageout_new_spread.
 	 *
-	 * Fastscan needs to be limited to a maximum value and should not
-	 * scale with memory to prevent pageout from consuming too much
-	 * time for scanning on slow CPU's and avoid thrashing, as a
-	 * result of scanning too many pages, on faster CPU's.
-	 * The value of 64 Meg was chosen for MAXHANDSPREADPAGES
-	 * (the upper bound for fastscan) based on the average number
-	 * of pages that can potentially be scanned in ~1 sec (using ~4%
-	 * of the CPU) on some of the following machines that currently
-	 * run Solaris 2.x:
+	 * At the end of the sampling period, the pageout_rate indicates how
+	 * many pages could be scanned per second. The pageout_new_spread is
+	 * then set to be 1/10th of that (i.e. approximating 10% of a CPU).
+	 * Of course, this value could still be more than the physical memory
+	 * on the system. If so, fastscan is set to 1/2 of memory, as
+	 * mentioned above.
 	 *
-	 *			average memory scanned in ~1 sec
+	 * All of this leads up to the setting of handspreadpages, which is
+	 * set to fastscan. This is the distance, in pages, between the front
+	 * and back hands during scanning. It will dictate which pages will
+	 * be considered "hot" on the backhand and which pages will be "cold"
+	 * and reclaimed
 	 *
-	 *	25 Mhz SS1+:		23 Meg
-	 *	LX:			37 Meg
-	 *	50 Mhz SC2000:		68 Meg
+	 * If the scanner is limited by desscan, then at the highest rate it
+	 * will scan up to fastscan/RATETOSCHEDPAGING pages per cycle. If the
+	 * scanner is limited by the %CPU, then at the highest rate (20% of a
+	 * CPU per cycle) the number of pages scanned could be much less.
 	 *
-	 *	40 Mhz 486:		26 Meg
-	 *	66 Mhz 486:		42 Meg
+	 * Thus, if the scanner is limited by desscan, then the handspreadpages
+	 * setting means 1sec between the front and back hands, but if the
+	 * scanner is limited by %CPU, it could be several seconds between the
+	 * two hands.
 	 *
-	 * When free memory falls just below lotsfree, the scan rate
-	 * goes from 0 to slowscan (i.e., pageout starts running).  This
+	 * The basic assumption is that at the worst case, stealing pages
+	 * not accessed within 1 sec seems reasonable and ensures that active
+	 * user processes don't thrash. This is especially true when the system
+	 * is in a low memory state.
+	 *
+	 * There are some additional factors to consider for the case of
+	 * scanning when zones are over their cap. In this situation it is
+	 * also likely that the machine will have a large physical memory which
+	 * will take many seconds to fully scan (due to the %CPU and desscan
+	 * limits per cycle). It is probable that there will be few (or 0)
+	 * pages attributed to these zones in any single scanning cycle. The
+	 * result is that reclaiming enough pages for these zones might take
+	 * several additional seconds (this is generally not a problem since
+	 * the zone physical cap is just a soft cap).
+	 *
+	 * This is similar to the typical multi-processor situation in which
+	 * pageout is often unable to maintain the minimum paging thresholds
+	 * under heavy load due to the fact that user processes running on
+	 * other CPU's can be dirtying memory at a much faster pace than
+	 * pageout can find pages to free.
+	 *
+	 * One potential approach to address both of these cases is to enable
+	 * more than one CPU to run the page scanner, in such a manner that the
+	 * various clock hands don't overlap. However, this also makes it more
+	 * difficult to determine the values for fastscan, slowscan and
+	 * handspreadpages. This is left as a future enhancement, if necessary.
+	 *
+	 * When free memory falls just below lotsfree, the scan rate goes from
+	 * 0 to slowscan (i.e., the page scanner starts running).  This
 	 * transition needs to be smooth and is achieved by ensuring that
 	 * pageout scans a small number of pages to satisfy the transient
 	 * memory demand.  This is set to not exceed 100 pages/sec (25 per
 	 * wakeup) since scanning that many pages has no noticible impact
 	 * on system performance.
 	 *
-	 * In addition to setting fastscan and slowscan, pageout is
-	 * limited to using ~4% of the CPU.  This results in increasing
-	 * the time taken to scan all of memory, which in turn means that
-	 * user processes have a better opportunity of preventing their
-	 * pages from being stolen.  This has a positive effect on
-	 * interactive and overall system performance when memory demand
-	 * is high.
-	 *
-	 * Thus, the rate at which pages are scanned for replacement will
-	 * vary linearly between slowscan and the number of pages that
-	 * can be scanned using ~4% of processor time instead of varying
-	 * linearly between slowscan and fastscan.
-	 *
-	 * Also, the processor time used by pageout will vary from ~1%
-	 * at slowscan to ~4% at fastscan instead of varying between
-	 * ~1% at slowscan and ~10% at fastscan.
-	 *
-	 * The values chosen for the various VM parameters (fastscan,
-	 * handspreadpages, etc) are not universally true for all machines,
-	 * but appear to be a good rule of thumb for the machines we've
-	 * tested.  They have the following ranges:
-	 *
-	 *	cpu speed:	20 to 70 Mhz
-	 *	page size:	4K to 8K
-	 *	memory size:	16M to 5G
-	 *	page scan rate:	4000 - 17400 4K pages per sec
-	 *
-	 * The values need to be re-examined for machines which don't
-	 * fall into the various ranges (e.g., slower or faster CPUs,
-	 * smaller or larger pagesizes etc) shown above.
-	 *
-	 * On an MP machine, pageout is often unable to maintain the
-	 * minimum paging thresholds under heavy load.  This is due to
-	 * the fact that user processes running on other CPU's can be
-	 * dirtying memory at a much faster pace than pageout can find
-	 * pages to free.  The memory demands could be met by enabling
-	 * more than one CPU to run the clock algorithm in such a manner
-	 * that the various clock hands don't overlap.  This also makes
-	 * it more difficult to determine the values for fastscan, slowscan
-	 * and handspreadpages.
-	 *
-	 * The swapper is currently used to free up memory when pageout
-	 * is unable to meet memory demands by swapping out processes.
-	 * In addition to freeing up memory, swapping also reduces the
-	 * demand for memory by preventing user processes from running
-	 * and thereby consuming memory.
+	 * The swapper is currently used to free up memory when pageout is
+	 * unable to meet memory demands. It does this by swapping out entire
+	 * processes. In addition to freeing up memory, swapping also reduces
+	 * the demand for memory because the swapped out processes cannot
+	 * run, and thereby consume memory. However, this is a pathological
+	 * state and performance will generally be considered unacceptable.
 	 */
 	if (init_mfscan == 0) {
 		if (pageout_new_spread != 0)
@@ -419,12 +459,13 @@ setupclock(int recalc)
 	} else {
 		maxfastscan = init_mfscan;
 	}
-	if (init_fscan == 0)
+	if (init_fscan == 0) {
 		fastscan = MIN(looppages / loopfraction, maxfastscan);
-	else
+	} else {
 		fastscan = init_fscan;
-	if (fastscan > looppages / loopfraction)
-		fastscan = looppages / loopfraction;
+		if (fastscan > looppages / loopfraction)
+			fastscan = looppages / loopfraction;
+	}
 
 	/*
 	 * Set slow scan time to 1/10 the fast scan time, but
@@ -444,12 +485,10 @@ setupclock(int recalc)
 	 * decreases as the scan rate rises. It must be < the amount
 	 * of pageable memory.
 	 *
-	 * Since pageout is limited to ~4% of the CPU, setting handspreadpages
-	 * to be "fastscan" results in the front hand being a few secs
-	 * (varies based on the processor speed) ahead of the back hand
-	 * at fastscan rates.  This distance can be further reduced, if
-	 * necessary, by increasing the processor time used by pageout
-	 * to be more than ~4% and preferrably not more than ~10%.
+	 * Since pageout is limited to the %CPU per cycle, setting
+	 * handspreadpages to be "fastscan" results in the front hand being
+	 * a few secs (varies based on the processor speed) ahead of the back
+	 * hand at fastscan rates.
 	 *
 	 * As a result, user processes have a much better chance of
 	 * referencing their pages before the back hand examines them.
@@ -471,29 +510,78 @@ setupclock(int recalc)
 	if (handspreadpages >= looppages)
 		handspreadpages = looppages - 1;
 
+	if (recalc == 0) {
+		/*
+		 * Setup basic values at initialization.
+		 */
+		pscan_region_sz = total_pages;
+		des_page_scanners = n_page_scanners = 1;
+		reset_hands[0] = B_TRUE;
+		return;
+	}
+
 	/*
-	 * If we have been called to recalculate the parameters,
-	 * set a flag to re-evaluate the clock hand pointers.
+	 * Recalculating
+	 *
+	 * We originally set the number of page scanners to 1. Now that we
+	 * know what the handspreadpages is for a scanner, figure out how many
+	 * scanners we should run. We want to ensure that the regions don't
+	 * overlap and that they are not touching.
+	 *
+	 * A default 64GB region size is used as the initial value to calculate
+	 * how many scanner threads we should create on lower memory systems.
+	 * The idea is to limit the number of threads to a practical value
+	 * (e.g. a 64GB machine really only needs one scanner thread). For very
+	 * large memory systems, we limit ourselves to MAX_PSCAN_THREADS
+	 * threads.
+	 *
+	 * The scanner threads themselves are evenly spread out around the
+	 * memory "clock" in pageout_scanner when we reset the hands, and each
+	 * thread will scan all of memory.
 	 */
-	if (recalc)
-		reset_hands = 1;
+	sz = (btop(64ULL * 0x40000000ULL));
+	if (sz < handspreadpages) {
+		/*
+		 * 64GB is smaller than the separation between the front
+		 * and back hands; use double handspreadpages.
+		 */
+		sz = handspreadpages << 1;
+	}
+	if (sz > total_pages) {
+		sz = total_pages;
+	}
+	/* Record region size for inspection with mdb, otherwise unused */
+	pscan_region_sz = sz;
+
+	tmp = sz;
+	for (i = 1; tmp < total_pages; i++) {
+		tmp += sz;
+	}
+
+	if (i > MAX_PSCAN_THREADS)
+		i = MAX_PSCAN_THREADS;
+
+	des_page_scanners = i;
 }
 
 /*
  * Pageout scheduling.
  *
  * Schedpaging controls the rate at which the page out daemon runs by
- * setting the global variables nscan and desscan RATETOSCHEDPAGING
- * times a second.  Nscan records the number of pages pageout has examined
- * in its current pass; schedpaging resets this value to zero each time
- * it runs.  Desscan records the number of pages pageout should examine
- * in its next pass; schedpaging sets this value based on the amount of
- * currently available memory.
+ * setting the global variables pageout_ticks and desscan RATETOSCHEDPAGING
+ * times a second. The pageout_ticks variable controls the percent of one
+ * CPU that each page scanner thread should consume (see min_percent_cpu
+ * and max_percent_cpu descriptions). The desscan variable records the number
+ * of pages pageout should examine in its next pass; schedpaging sets this
+ * value based on the amount of currently available memory. In addtition, the
+ * nscan variable records the number of pages pageout has examined in its
+ * current pass; schedpaging resets this value to zero each time it runs.
  */
 
-#define	RATETOSCHEDPAGING	4		/* hz that is */
+#define	RATETOSCHEDPAGING	4		/* times/second */
 
-static kmutex_t	pageout_mutex;	/* held while pageout or schedpaging running */
+/* held while pageout_scanner or schedpaging are modifying shared data */
+static kmutex_t	pageout_mutex;
 
 /*
  * Pool of available async pageout putpage requests.
@@ -506,7 +594,7 @@ static kcondvar_t push_cv;
 
 static int async_list_size = 256;	/* number of async request structs */
 
-static void pageout_scanner(void);
+static void pageout_scanner(void *);
 
 /*
  * If a page is being shared more than "po_share" times
@@ -535,67 +623,153 @@ schedpaging(void *arg)
 	if (kcage_on && (kcage_freemem < kcage_desfree || kcage_needfree))
 		kcage_cageout_wakeup();
 
-	if (mutex_tryenter(&pageout_mutex)) {
-		/* pageout() not running */
-		nscan = 0;
-		vavail = freemem - deficit;
-		if (pageout_new_spread != 0)
-			vavail -= needfree;
-		if (vavail < 0)
-			vavail = 0;
-		if (vavail > lotsfree)
-			vavail = lotsfree;
+	(void) atomic_swap_ulong(&nscan, 0);
+	vavail = freemem - deficit;
+	if (pageout_new_spread != 0)
+		vavail -= needfree;
+	if (vavail < 0)
+		vavail = 0;
+	if (vavail > lotsfree)
+		vavail = lotsfree;
 
+	/*
+	 * Fix for 1161438 (CRS SPR# 73922).  All variables
+	 * in the original calculation for desscan were 32 bit signed
+	 * ints.  As freemem approaches 0x0 on a system with 1 Gig or
+	 * more of memory, the calculation can overflow.  When this
+	 * happens, desscan becomes negative and pageout_scanner()
+	 * stops paging out.
+	 */
+	if ((needfree) && (pageout_new_spread == 0)) {
 		/*
-		 * Fix for 1161438 (CRS SPR# 73922).  All variables
-		 * in the original calculation for desscan were 32 bit signed
-		 * ints.  As freemem approaches 0x0 on a system with 1 Gig or
-		 * more of memory, the calculation can overflow.  When this
-		 * happens, desscan becomes negative and pageout_scanner()
-		 * stops paging out.
+		 * If we've not yet collected enough samples to
+		 * calculate a spread, kick into high gear anytime
+		 * needfree is non-zero. Note that desscan will not be
+		 * the limiting factor for systems with larger memory;
+		 * the %CPU will limit the scan. That will also be
+		 * maxed out below.
 		 */
-		if ((needfree) && (pageout_new_spread == 0)) {
-			/*
-			 * If we've not yet collected enough samples to
-			 * calculate a spread, use the old logic of kicking
-			 * into high gear anytime needfree is non-zero.
-			 */
-			desscan = fastscan / RATETOSCHEDPAGING;
-		} else {
-			/*
-			 * Once we've calculated a spread based on system
-			 * memory and usage, just treat needfree as another
-			 * form of deficit.
-			 */
-			spgcnt_t faststmp, slowstmp, result;
+		desscan = fastscan / RATETOSCHEDPAGING;
+	} else {
+		/*
+		 * Once we've calculated a spread based on system
+		 * memory and usage, just treat needfree as another
+		 * form of deficit.
+		 */
+		spgcnt_t faststmp, slowstmp, result;
+
+		slowstmp = slowscan * vavail;
+		faststmp = fastscan * (lotsfree - vavail);
+		result = (slowstmp + faststmp) /
+		    nz(lotsfree) / RATETOSCHEDPAGING;
+		desscan = (pgcnt_t)result;
+	}
+
+	/*
+	 * If we've not yet collected enough samples to calculate a
+	 * spread, also kick %CPU to the max.
+	 */
+	if (pageout_new_spread == 0) {
+		pageout_ticks = max_pageout_ticks;
+	} else {
+		pageout_ticks = min_pageout_ticks +
+		    (lotsfree - vavail) *
+		    (max_pageout_ticks - min_pageout_ticks) /
+		    nz(lotsfree);
+	}
 
-			slowstmp = slowscan * vavail;
-			faststmp = fastscan * (lotsfree - vavail);
-			result = (slowstmp + faststmp) /
-			    nz(lotsfree) / RATETOSCHEDPAGING;
-			desscan = (pgcnt_t)result;
+	if (pageout_new_spread != 0 && des_page_scanners != n_page_scanners) {
+		/*
+		 * We have finished the pagescan initialization and the desired
+		 * number of page scanners has changed, either because
+		 * initialization just finished, because of a memory DR, or
+		 * because des_page_scanners has been modified on the fly (i.e.
+		 * by mdb). If we need more scanners, start them now, otherwise
+		 * the excess scanners will terminate on their own when they
+		 * reset their hands.
+		 */
+		uint_t i;
+		uint_t curr_nscan = n_page_scanners;
+		pgcnt_t max = total_pages / handspreadpages;
+
+		if (des_page_scanners > max)
+			des_page_scanners = max;
+
+		if (des_page_scanners > MAX_PSCAN_THREADS) {
+			des_page_scanners = MAX_PSCAN_THREADS;
+		} else if (des_page_scanners == 0) {
+			des_page_scanners = 1;
 		}
 
-		pageout_ticks = min_pageout_ticks + (lotsfree - vavail) *
-		    (max_pageout_ticks - min_pageout_ticks) / nz(lotsfree);
+		/*
+		 * Each thread has its own entry in the reset_hands array, so
+		 * we don't need any locking in pageout_scanner to check the
+		 * thread's reset_hands entry. Thus, we use a pre-allocated
+		 * fixed size reset_hands array and upper limit on the number
+		 * of pagescan threads.
+		 *
+		 * The reset_hands entries need to be true before we start new
+		 * scanners, but if we're reducing, we don't want a race on the
+		 * recalculation for the existing threads, so we set
+		 * n_page_scanners first.
+		 */
+		n_page_scanners = des_page_scanners;
+		for (i = 0; i < MAX_PSCAN_THREADS; i++) {
+			reset_hands[i] = B_TRUE;
+		}
 
-		if (freemem < lotsfree + needfree ||
-		    pageout_sample_cnt < pageout_sample_lim) {
-			TRACE_1(TR_FAC_VM, TR_PAGEOUT_CV_SIGNAL,
-			    "pageout_cv_signal:freemem %ld", freemem);
-			cv_signal(&proc_pageout->p_cv);
-		} else {
-			/*
-			 * There are enough free pages, no need to
-			 * kick the scanner thread.  And next time
-			 * around, keep more of the `highly shared'
-			 * pages.
-			 */
-			cv_signal_pageout();
-			if (po_share > MIN_PO_SHARE) {
-				po_share >>= 1;
+		if (des_page_scanners > curr_nscan) {
+			/* Create additional pageout scanner threads. */
+			for (i = curr_nscan; i < des_page_scanners; i++) {
+				(void) lwp_kernel_create(proc_pageout,
+				    pageout_scanner, (void *)(uintptr_t)i,
+				    TS_RUN, curthread->t_pri);
 			}
 		}
+	}
+
+	zones_over = B_FALSE;
+
+	if (freemem < lotsfree + needfree || PAGE_SCAN_STARTUP) {
+		if (!PAGE_SCAN_STARTUP)
+			low_mem_scan++;
+		DTRACE_PROBE(schedpage__wake__low);
+		WAKE_PAGEOUT_SCANNER();
+
+	} else if (zone_num_over_cap > 0) {
+		/* One or more zones are over their cap. */
+
+		/* No page limit */
+		desscan = total_pages;
+
+		/*
+		 * Increase the scanning CPU% to the max. This implies
+		 * 80% of one CPU/sec if the scanner can run each
+		 * opportunity. Can also be tuned via setting
+		 * zone_pageout_ticks in /etc/system or with mdb.
+		 */
+		pageout_ticks = (zone_pageout_ticks != 0) ?
+		    zone_pageout_ticks : max_pageout_ticks;
+
+		zones_over = B_TRUE;
+		zone_cap_scan++;
+
+		DTRACE_PROBE(schedpage__wake__zone);
+		WAKE_PAGEOUT_SCANNER();
+
+	} else {
+		/*
+		 * There are enough free pages, no need to
+		 * kick the scanner thread.  And next time
+		 * around, keep more of the `highly shared'
+		 * pages.
+		 */
+		cv_signal_pageout();
+
+		mutex_enter(&pageout_mutex);
+		if (po_share > MIN_PO_SHARE) {
+			po_share >>= 1;
+		}
 		mutex_exit(&pageout_mutex);
 	}
 
@@ -617,36 +791,46 @@ ulong_t		push_list_size;		/* # of requests on pageout queue */
 #define	FRONT	1
 #define	BACK	2
 
-int dopageout = 1;	/* must be non-zero to turn page stealing on */
+int dopageout = 1;	/* /etc/system tunable to disable page reclamation */
 
 /*
  * The page out daemon, which runs as process 2.
  *
- * As long as there are at least lotsfree pages,
- * this process is not run.  When the number of free
- * pages stays in the range desfree to lotsfree,
- * this daemon runs through the pages in the loop
- * at a rate determined in schedpaging().  Pageout manages
- * two hands on the clock.  The front hand moves through
- * memory, clearing the reference bit,
- * and stealing pages from procs that are over maxrss.
- * The back hand travels a distance behind the front hand,
- * freeing the pages that have not been referenced in the time
- * since the front hand passed.  If modified, they are pushed to
- * swap before being freed.
+ * Page out occurs when either:
+ * a) there is less than lotsfree pages,
+ * b) there are one or more zones over their physical memory cap.
+ *
+ * The daemon treats physical memory as a circular array of pages and scans the
+ * pages using a 'two-handed clock' algorithm. The front hand moves through
+ * the pages, clearing the reference bit. The back hand travels a distance
+ * (handspreadpages) behind the front hand, freeing the pages that have not
+ * been referenced in the time since the front hand passed. If modified, they
+ * are first written to their backing store before being freed.
+ *
+ * In order to make page invalidation more responsive on machines with larger
+ * memory, multiple pageout_scanner threads may be created. In this case, the
+ * threads are evenly distributed around the the memory "clock face" so that
+ * memory can be reclaimed more quickly (that is, there can be large regions in
+ * which no pages can be reclaimed by a single thread, leading to lag which
+ * causes undesirable behavior such as htable stealing).
+ *
+ * As long as there are at least lotsfree pages, or no zones over their cap,
+ * then pageout_scanner threads are not run. When pageout_scanner threads are
+ * running for case (a), all pages are considered for pageout. For case (b),
+ * only pages belonging to a zone over its cap will be considered for pageout.
  *
- * There are 2 threads that act on behalf of the pageout process.
- * One thread scans pages (pageout_scanner) and frees them up if
+ * There are multiple threads that act on behalf of the pageout process.
+ * A set of threads scan pages (pageout_scanner) and frees them up if
  * they don't require any VOP_PUTPAGE operation. If a page must be
  * written back to its backing store, the request is put on a list
  * and the other (pageout) thread is signaled. The pageout thread
  * grabs VOP_PUTPAGE requests from the list, and processes them.
  * Some filesystems may require resources for the VOP_PUTPAGE
  * operations (like memory) and hence can block the pageout
- * thread, but the scanner thread can still operate. There is still
+ * thread, but the pageout_scanner threads can still operate. There is still
  * no guarantee that memory deadlocks cannot occur.
  *
- * For now, this thing is in very rough form.
+ * The pageout_scanner parameters are determined in schedpaging().
  */
 void
 pageout()
@@ -684,9 +868,9 @@ pageout()
 
 	pageout_pri = curthread->t_pri;
 
-	/* Create the pageout scanner thread. */
-	(void) lwp_kernel_create(proc_pageout, pageout_scanner, NULL, TS_RUN,
-	    pageout_pri - 1);
+	/* Create the (first) pageout scanner thread. */
+	(void) lwp_kernel_create(proc_pageout, pageout_scanner, (void *) 0,
+	    TS_RUN, pageout_pri - 1);
 
 	/*
 	 * kick off pageout scheduler.
@@ -720,6 +904,7 @@ pageout()
 		arg->a_next = NULL;
 		mutex_exit(&push_lock);
 
+		DTRACE_PROBE(pageout__push);
 		if (VOP_PUTPAGE(arg->a_vp, (offset_t)arg->a_off,
 		    arg->a_len, arg->a_flags, arg->a_cred, NULL) == 0) {
 			pushes++;
@@ -740,32 +925,24 @@ pageout()
  * Kernel thread that scans pages looking for ones to free
  */
 static void
-pageout_scanner(void)
+pageout_scanner(void *a)
 {
 	struct page *fronthand, *backhand;
-	uint_t count;
+	uint_t count, iter = 0;
 	callb_cpr_t cprinfo;
-	pgcnt_t	nscan_limit;
+	pgcnt_t	nscan_cnt, nscan_limit;
 	pgcnt_t	pcount;
+	uint_t inst = (uint_t)(uintptr_t)a;
+	hrtime_t sample_start, sample_end;
+	clock_t pageout_lbolt;
+	kmutex_t pscan_mutex;
 
-	CALLB_CPR_INIT(&cprinfo, &pageout_mutex, callb_generic_cpr, "poscan");
-	mutex_enter(&pageout_mutex);
+	VERIFY3U(inst, <, MAX_PSCAN_THREADS);
 
-	/*
-	 * The restart case does not attempt to point the hands at roughly
-	 * the right point on the assumption that after one circuit things
-	 * will have settled down - and restarts shouldn't be that often.
-	 */
+	mutex_init(&pscan_mutex, NULL, MUTEX_DEFAULT, NULL);
 
-	/*
-	 * Set the two clock hands to be separated by a reasonable amount,
-	 * but no more than 360 degrees apart.
-	 */
-	backhand = page_first();
-	if (handspreadpages >= total_pages)
-		fronthand = page_nextn(backhand, total_pages - 1);
-	else
-		fronthand = page_nextn(backhand, handspreadpages);
+	CALLB_CPR_INIT(&cprinfo, &pscan_mutex, callb_generic_cpr, "poscan");
+	mutex_enter(&pscan_mutex);
 
 	min_pageout_ticks = MAX(1,
 	    ((hz * min_percent_cpu) / 100) / RATETOSCHEDPAGING);
@@ -776,71 +953,116 @@ loop:
 	cv_signal_pageout();
 
 	CALLB_CPR_SAFE_BEGIN(&cprinfo);
-	cv_wait(&proc_pageout->p_cv, &pageout_mutex);
-	CALLB_CPR_SAFE_END(&cprinfo, &pageout_mutex);
+	cv_wait(&proc_pageout->p_cv, &pscan_mutex);
+	CALLB_CPR_SAFE_END(&cprinfo, &pscan_mutex);
 
 	if (!dopageout)
 		goto loop;
 
-	if (reset_hands) {
-		reset_hands = 0;
+	if (reset_hands[inst]) {
+		struct page *first;
+		pgcnt_t offset = total_pages / n_page_scanners;
 
-		backhand = page_first();
-		if (handspreadpages >= total_pages)
+		reset_hands[inst] = B_FALSE;
+		if (inst >= n_page_scanners) {
+			/*
+			 * The desired number of page scanners has been
+			 * reduced and this instance is no longer wanted.
+			 * Exit the lwp.
+			 */
+			VERIFY3U(inst, !=, 0);
+			mutex_exit(&pscan_mutex);
+			mutex_enter(&curproc->p_lock);
+			lwp_exit();
+		}
+
+		/*
+		 * The reset case repositions the hands at the proper place
+		 * on the memory clock face to prevent creep into another
+		 * thread's active region or when the number of threads has
+		 * changed.
+		 *
+		 * Set the two clock hands to be separated by a reasonable
+		 * amount, but no more than 360 degrees apart.
+		 *
+		 * If inst == 0, backhand starts at first page, otherwise
+		 * it is (inst * offset) around the memory "clock face" so that
+		 * we spread out each scanner instance evenly.
+		 */
+		first = page_first();
+		backhand = page_nextn(first, offset * inst);
+		if (handspreadpages >= total_pages) {
 			fronthand = page_nextn(backhand, total_pages - 1);
-		else
+		} else {
 			fronthand = page_nextn(backhand, handspreadpages);
+		}
 	}
 
+	/*
+	 * This CPU kstat is only incremented here and we're obviously on this
+	 * CPU, so no lock.
+	 */
 	CPU_STATS_ADDQ(CPU, vm, pgrrun, 1);
 	count = 0;
 
-	TRACE_4(TR_FAC_VM, TR_PAGEOUT_START,
-	    "pageout_start:freemem %ld lotsfree %ld nscan %ld desscan %ld",
-	    freemem, lotsfree, nscan, desscan);
-
 	/* Kernel probe */
 	TNF_PROBE_2(pageout_scan_start, "vm pagedaemon", /* CSTYLED */,
 	    tnf_ulong, pages_free, freemem, tnf_ulong, pages_needed, needfree);
 
 	pcount = 0;
-	if (pageout_sample_cnt < pageout_sample_lim) {
+	nscan_cnt = 0;
+	if (PAGE_SCAN_STARTUP) {
 		nscan_limit = total_pages;
 	} else {
 		nscan_limit = desscan;
 	}
+
+	DTRACE_PROBE4(pageout__start, pgcnt_t, nscan_limit, uint_t, inst,
+	    page_t *, backhand, page_t *, fronthand);
+
 	pageout_lbolt = ddi_get_lbolt();
 	sample_start = gethrtime();
 
 	/*
 	 * Scan the appropriate number of pages for a single duty cycle.
-	 * However, stop scanning as soon as there is enough free memory.
-	 * For a short while, we will be sampling the performance of the
-	 * scanner and need to keep running just to get sample data, in
-	 * which case we keep going and don't pay attention to whether
-	 * or not there is enough free memory.
+	 * Only scan while at least one of these is true:
+	 * 1) one or more zones is over its cap
+	 * 2) there is not enough free memory
+	 * 3) during page scan startup when determining sample data
 	 */
-
-	while (nscan < nscan_limit && (freemem < lotsfree + needfree ||
-	    pageout_sample_cnt < pageout_sample_lim)) {
+	while (nscan_cnt < nscan_limit &&
+	    (zones_over ||
+	    freemem < lotsfree + needfree ||
+	    PAGE_SCAN_STARTUP)) {
 		int rvfront, rvback;
 
+		DTRACE_PROBE2(pageout__loop, pgcnt_t, pcount, uint_t, inst);
+
 		/*
 		 * Check to see if we have exceeded our %CPU budget
 		 * for this wakeup, but not on every single page visited,
 		 * just every once in a while.
 		 */
 		if ((pcount & PAGES_POLL_MASK) == PAGES_POLL_MASK) {
+			clock_t pageout_cycle_ticks;
+
 			pageout_cycle_ticks = ddi_get_lbolt() - pageout_lbolt;
 			if (pageout_cycle_ticks >= pageout_ticks) {
-				++pageout_timeouts;
+				/*
+				 * This is where we normally break out of the
+				 * loop when scanning zones or sampling.
+				 */
+				if (!zones_over) {
+					atomic_inc_64(&pageout_timeouts);
+				}
+				DTRACE_PROBE1(pageout__timeout, uint_t, inst);
 				break;
 			}
 		}
 
 		/*
 		 * If checkpage manages to add a page to the free list,
-		 * we give ourselves another couple of trips around the loop.
+		 * we give ourselves another couple of trips around memory.
 		 */
 		if ((rvfront = checkpage(fronthand, FRONT)) == 1)
 			count = 0;
@@ -850,7 +1072,8 @@ loop:
 		++pcount;
 
 		/*
-		 * protected by pageout_mutex instead of cpu_stat_lock
+		 * This CPU kstat is only incremented here and we're obviously
+		 * on this CPU, so no lock.
 		 */
 		CPU_STATS_ADDQ(CPU, vm, scan, 1);
 
@@ -858,7 +1081,7 @@ loop:
 		 * Don't include ineligible pages in the number scanned.
 		 */
 		if (rvfront != -1 || rvback != -1)
-			nscan++;
+			nscan_cnt++;
 
 		backhand = page_next(backhand);
 
@@ -868,56 +1091,89 @@ loop:
 		 */
 
 		if ((fronthand = page_next(fronthand)) == page_first())	{
-			TRACE_2(TR_FAC_VM, TR_PAGEOUT_HAND_WRAP,
-			    "pageout_hand_wrap:freemem %ld whichhand %d",
-			    freemem, FRONT);
+			DTRACE_PROBE1(pageout__wrap__front, uint_t, inst);
 
 			/*
-			 * protected by pageout_mutex instead of cpu_stat_lock
+			 * Every 64 wraps we reposition our hands within our
+			 * region to prevent creep into another thread.
+			 */
+			if ((++iter % pageout_reset_cnt) == 0)
+				reset_hands[inst] = B_TRUE;
+
+			/*
+			 * This CPU kstat is only incremented here and we're
+			 * obviously on this CPU, so no lock.
 			 */
 			CPU_STATS_ADDQ(CPU, vm, rev, 1);
-			if (++count > 1) {
+
+			/*
+			 * If scanning because the system is low on memory,
+			 * then when we wraparound memory we want to try to
+			 * reclaim more pages.
+			 * If scanning only because zones are over their cap,
+			 * then wrapping is common and we simply keep going.
+			 */
+			if (freemem < lotsfree + needfree && ++count > 1) {
 				/*
+				 * The system is low on memory.
 				 * Extremely unlikely, but it happens.
-				 * We went around the loop at least once
-				 * and didn't get far enough.
+				 * We went around memory at least once
+				 * and didn't reclaim enough.
 				 * If we are still skipping `highly shared'
 				 * pages, skip fewer of them.  Otherwise,
 				 * give up till the next clock tick.
 				 */
+				mutex_enter(&pageout_mutex);
 				if (po_share < MAX_PO_SHARE) {
 					po_share <<= 1;
+					mutex_exit(&pageout_mutex);
 				} else {
 					/*
-					 * Really a "goto loop", but
-					 * if someone is TRACing or
-					 * TNF_PROBE_ing, at least
-					 * make records to show
-					 * where we are.
+					 * Really a "goto loop", but if someone
+					 * is tracing or TNF_PROBE_ing, hit
+					 * those probes first.
 					 */
+					mutex_exit(&pageout_mutex);
 					break;
 				}
 			}
 		}
 	}
 
+	atomic_add_long(&nscan, nscan_cnt);
+
 	sample_end = gethrtime();
 
-	TRACE_5(TR_FAC_VM, TR_PAGEOUT_END,
-	    "pageout_end:freemem %ld lots %ld nscan %ld des %ld count %u",
-	    freemem, lotsfree, nscan, desscan, count);
+	DTRACE_PROBE3(pageout__loop__end, pgcnt_t, nscan_cnt, pgcnt_t, pcount,
+	    uint_t, inst);
 
 	/* Kernel probe */
 	TNF_PROBE_2(pageout_scan_end, "vm pagedaemon", /* CSTYLED */,
-	    tnf_ulong, pages_scanned, nscan, tnf_ulong, pages_free, freemem);
+	    tnf_ulong, pages_scanned, nscan_cnt, tnf_ulong, pages_free,
+	    freemem);
 
-	if (pageout_sample_cnt < pageout_sample_lim) {
+	/*
+	 * The following two blocks are only relevant when the scanner is
+	 * first started up. After the scanner runs for a while, neither of
+	 * the conditions will ever be true again.
+	 *
+	 * The global variables used below are only modified by this thread and
+	 * only during initial scanning when there is a single page scanner
+	 * thread running. Thus, we don't use any locking.
+	 */
+	if (PAGE_SCAN_STARTUP) {
+		VERIFY3U(inst, ==, 0);
 		pageout_sample_pages += pcount;
 		pageout_sample_etime += sample_end - sample_start;
 		++pageout_sample_cnt;
-	}
-	if (pageout_sample_cnt >= pageout_sample_lim &&
-	    pageout_new_spread == 0) {
+
+	} else if (pageout_new_spread == 0) {
+		uint_t i;
+
+		/*
+		 * We have run enough samples, set the spread.
+		 */
+		VERIFY3U(inst, ==, 0);
 		pageout_rate = (hrrate_t)pageout_sample_pages *
 		    (hrrate_t)(NANOSEC) / pageout_sample_etime;
 		pageout_new_spread = pageout_rate / 10;
@@ -931,9 +1187,8 @@ loop:
  * Look at the page at hand.  If it is locked (e.g., for physical i/o),
  * system (u., page table) or free, then leave it alone.  Otherwise,
  * if we are running the front hand, turn off the page's reference bit.
- * If the proc is over maxrss, we take it.  If running the back hand,
- * check whether the page has been reclaimed.  If not, free the page,
- * pushing it to disk first if necessary.
+ * If running the back hand, check whether the page has been reclaimed.
+ * If not, free the page, pushing it to disk first if necessary.
  *
  * Return values:
  *	-1 if the page is not a candidate at all,
@@ -947,6 +1202,7 @@ checkpage(struct page *pp, int whichhand)
 	int isfs = 0;
 	int isexec = 0;
 	int pagesync_flag;
+	zoneid_t zid = ALL_ZONES;
 
 	/*
 	 * Skip pages:
@@ -989,6 +1245,21 @@ checkpage(struct page *pp, int whichhand)
 		return (-1);
 	}
 
+	if (zones_over) {
+		ASSERT(pp->p_zoneid == ALL_ZONES ||
+		    pp->p_zoneid >= 0 && pp->p_zoneid <= MAX_ZONEID);
+		if (pp->p_zoneid == ALL_ZONES ||
+		    zone_pdata[pp->p_zoneid].zpers_over == 0) {
+			/*
+			 * Cross-zone shared page, or zone not over it's cap.
+			 * Leave the page alone.
+			 */
+			page_unlock(pp);
+			return (-1);
+		}
+		zid = pp->p_zoneid;
+	}
+
 	/*
 	 * Maintain statistics for what we are freeing
 	 */
@@ -1016,31 +1287,24 @@ checkpage(struct page *pp, int whichhand)
 
 recheck:
 	/*
-	 * If page is referenced; make unreferenced but reclaimable.
-	 * If this page is not referenced, then it must be reclaimable
-	 * and we can add it to the free list.
+	 * If page is referenced; fronthand makes unreferenced and reclaimable.
+	 * For the backhand, a process referenced the page since the front hand
+	 * went by, so it's not a candidate for freeing up.
 	 */
 	if (ppattr & P_REF) {
-		TRACE_2(TR_FAC_VM, TR_PAGEOUT_ISREF,
-		    "pageout_isref:pp %p whichhand %d", pp, whichhand);
+		DTRACE_PROBE2(pageout__isref, page_t *, pp, int, whichhand);
 		if (whichhand == FRONT) {
-			/*
-			 * Checking of rss or madvise flags needed here...
-			 *
-			 * If not "well-behaved", fall through into the code
-			 * for not referenced.
-			 */
 			hat_clrref(pp);
 		}
-		/*
-		 * Somebody referenced the page since the front
-		 * hand went by, so it's not a candidate for
-		 * freeing up.
-		 */
 		page_unlock(pp);
 		return (0);
 	}
 
+	/*
+	 * This page is not referenced, so it must be reclaimable and we can
+	 * add it to the free list. This can be done by either hand.
+	 */
+
 	VM_STAT_ADD(pageoutvmstats.checkpage[0]);
 
 	/*
@@ -1073,8 +1337,9 @@ recheck:
 		u_offset_t offset = pp->p_offset;
 
 		/*
-		 * XXX - Test for process being swapped out or about to exit?
-		 * [Can't get back to process(es) using the page.]
+		 * Note: There is no possibility to test for process being
+		 * swapped out or about to exit since we can't get back to
+		 * process(es) from the page.
 		 */
 
 		/*
@@ -1092,6 +1357,11 @@ recheck:
 			VN_RELE(vp);
 			return (0);
 		}
+		if (isfs) {
+			zone_pageout_stat(zid, ZPO_DIRTY);
+		} else {
+			zone_pageout_stat(zid, ZPO_ANONDIRTY);
+		}
 		return (1);
 	}
 
@@ -1102,8 +1372,7 @@ recheck:
 	 * the pagesync but before it was unloaded we catch it
 	 * and handle the page properly.
 	 */
-	TRACE_2(TR_FAC_VM, TR_PAGEOUT_FREE,
-	    "pageout_free:pp %p whichhand %d", pp, whichhand);
+	DTRACE_PROBE2(pageout__free, page_t *, pp, int, whichhand);
 	(void) hat_pageunload(pp, HAT_FORCE_PGUNLOAD);
 	ppattr = hat_page_getattr(pp, P_MOD | P_REF);
 	if ((ppattr & P_REF) || ((ppattr & P_MOD) && pp->p_vnode))
@@ -1120,8 +1389,10 @@ recheck:
 		} else {
 			CPU_STATS_ADD_K(vm, fsfree, 1);
 		}
+		zone_pageout_stat(zid, ZPO_FS);
 	} else {
 		CPU_STATS_ADD_K(vm, anonfree, 1);
+		zone_pageout_stat(zid, ZPO_ANON);
 	}
 
 	return (1);		/* freed a page! */
diff --git a/usr/src/uts/common/os/vmem.c b/usr/src/uts/common/os/vmem.c
index 4664c52e77..1b027b4409 100644
--- a/usr/src/uts/common/os/vmem.c
+++ b/usr/src/uts/common/os/vmem.c
@@ -1621,7 +1621,7 @@ vmem_destroy(vmem_t *vmp)
 
 	leaked = vmem_size(vmp, VMEM_ALLOC);
 	if (leaked != 0)
-		cmn_err(CE_WARN, "vmem_destroy('%s'): leaked %lu %s",
+		cmn_err(CE_WARN, "!vmem_destroy('%s'): leaked %lu %s",
 		    vmp->vm_name, leaked, (vmp->vm_cflags & VMC_IDENTIFIER) ?
 		    "identifiers" : "bytes");
 
diff --git a/usr/src/uts/common/os/zone.c b/usr/src/uts/common/os/zone.c
index 085a9f7e73..a161fb85a2 100644
--- a/usr/src/uts/common/os/zone.c
+++ b/usr/src/uts/common/os/zone.c
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015, Joyent Inc. All rights reserved.
+ * Copyright 2018, Joyent Inc.
  * Copyright (c) 2016 by Delphix. All rights reserved.
  * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
  */
@@ -252,6 +252,8 @@
 #include <sys/cpucaps.h>
 #include <vm/seg.h>
 #include <sys/mac.h>
+#include <sys/rt.h>
+#include <sys/fx.h>
 
 /*
  * This constant specifies the number of seconds that threads waiting for
@@ -312,6 +314,7 @@ static id_space_t *zoneid_space;
  * 'global_zone'.
  */
 zone_t zone0;
+zone_zfs_io_t zone0_zp_zfs;
 zone_t *global_zone = NULL;	/* Set when the global zone is initialized */
 
 /*
@@ -327,8 +330,8 @@ static list_t zone_active;
 static list_t zone_deathrow;
 static kmutex_t zone_deathrow_lock;
 
-/* number of zones is limited by virtual interface limit in IP */
-uint_t maxzones = 8192;
+/* This can be dynamically reduced if various subsystems hit internal limits. */
+uint_t maxzones = MAX_ZONES;
 
 /* Event channel to sent zone state change notifications */
 evchan_t *zone_event_chan;
@@ -372,8 +375,12 @@ static char *zone_ref_subsys_names[] = {
 rctl_hndl_t rc_zone_cpu_shares;
 rctl_hndl_t rc_zone_locked_mem;
 rctl_hndl_t rc_zone_max_swap;
+rctl_hndl_t rc_zone_phys_mem;
 rctl_hndl_t rc_zone_max_lofi;
 rctl_hndl_t rc_zone_cpu_cap;
+rctl_hndl_t rc_zone_cpu_baseline;
+rctl_hndl_t rc_zone_cpu_burst_time;
+rctl_hndl_t rc_zone_zfs_io_pri;
 rctl_hndl_t rc_zone_nlwps;
 rctl_hndl_t rc_zone_nprocs;
 rctl_hndl_t rc_zone_shmmax;
@@ -419,8 +426,72 @@ static boolean_t zsd_wait_for_inprogress(zone_t *, struct zsd_entry *,
  * Version 5 alters the zone_boot system call, and converts its old
  *     bootargs parameter to be set by the zone_setattr API instead.
  * Version 6 adds the flag argument to zone_create.
+ * Version 7 adds the requested zoneid to zone_create.
  */
-static const int ZONE_SYSCALL_API_VERSION = 6;
+static const int ZONE_SYSCALL_API_VERSION = 7;
+
+/*
+ * "zone_pdata" is an array indexed by zoneid. It is used to store "persistent"
+ * data which can be referenced independently of the zone_t structure. This
+ * data falls into two categories;
+ *   1) pages and RSS data associated with processes inside a zone
+ *   2) in-flight ZFS I/O data
+ *
+ * Each member of zone_persist_t stores the zone's current page usage, its page
+ * limit, a flag indicating if the zone is over its physical memory cap and
+ * various page-related statistics. The zpers_over flag is the interface for
+ * the page scanner to use when reclaiming pages for zones that are over their
+ * cap. The zone_persist_t structure also includes a mutex and a reference to a
+ * zone_zfs_io_t structure used for tracking the zone's ZFS I/O data.
+ *
+ * All zone physical memory cap data is stored in this array instead of within
+ * the zone structure itself. This is because zone structures come and go, but
+ * paging-related work can be asynchronous to any particular zone. In,
+ * particular:
+ * 1) Page scanning to reclaim pages occurs from a kernel thread that is not
+ *    associated with any zone.
+ * 2) Freeing segkp pages can occur long after the zone which first
+ *    instantiated those pages has gone away.
+ * We want to be able to account for pages/zone without constantly having to
+ * take extra locks and finding the relevant zone structure, particularly during
+ * page scanning.
+ *
+ * The page scanner can run when "zone_num_over_cap" is non-zero. It can
+ * do a direct lookup of a zoneid into the "zone_pdata" array to determine
+ * if that zone is over its cap.
+ *
+ * There is no locking for the page scanner to perform these two checks.
+ * We cannot have the page scanner blocking normal paging activity for
+ * running processes. Because the physical memory cap is a soft cap, it is
+ * fine for the scanner to simply read the current state of the counter and
+ * the zone's zpers_over entry in the array. The scanner should never modify
+ * either of these items. Internally the entries and the counter are managed
+ * with the "zone_physcap_lock" mutex as we add/remove mappings to pages. We
+ * take care to ensure that we only take the zone_physcap_lock mutex when a
+ * zone is transitioning over/under its physical memory cap.
+ *
+ * The "zone_incr_capped" and "zone_decr_capped" functions are used to manage
+ * the "zone_pdata" array and associated counter.
+ *
+ * The zone_persist_t structure tracks the zone's physical cap and phyiscal
+ * usage in terms of pages. These values are currently defined as uint32. Thus,
+ * the maximum number of pages we can track is a UINT_MAX-1 (4,294,967,295)
+ * since UINT_MAX means the zone's RSS is unlimited. Assuming a 4k page size, a
+ * zone's maximum RSS is limited to 17.5 TB and twice that with an 8k page size.
+ * In the future we may need to expand these counters to 64-bit, but for now
+ * we're using 32-bit to conserve memory, since this array is statically
+ * allocated within the kernel based on the maximum number of zones supported.
+ *
+ * With respect to the zone_zfs_io_t referenced by the zone_persist_t, under
+ * a heavy I/O workload, the "zonehash_lock" would become extremely hot if we
+ * had to continuously find the zone structure associated with an I/O that has
+ * just completed. To avoid that overhead, we track the I/O data within the
+ * zone_zfs_io_t instead. We can directly access that data without having to
+ * lookup the full zone_t structure.
+ */
+uint_t zone_num_over_cap;
+zone_persist_t zone_pdata[MAX_ZONES];
+static kmutex_t zone_physcap_lock;
 
 /*
  * Certain filesystems (such as NFS and autofs) need to know which zone
@@ -1379,6 +1450,127 @@ static rctl_ops_t zone_cpu_cap_ops = {
 
 /*ARGSUSED*/
 static rctl_qty_t
+zone_cpu_base_get(rctl_t *rctl, struct proc *p)
+{
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	return (cpucaps_zone_get_base(p->p_zone));
+}
+
+/*
+ * The zone cpu base is used to set the baseline CPU for the zone
+ * so we can track when the zone is bursting.
+ */
+/*ARGSUSED*/
+static int
+zone_cpu_base_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
+    rctl_qty_t nv)
+{
+	zone_t *zone = e->rcep_p.zone;
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	ASSERT(e->rcep_t == RCENTITY_ZONE);
+
+	if (zone == NULL)
+		return (0);
+
+	return (cpucaps_zone_set_base(zone, nv));
+}
+
+static rctl_ops_t zone_cpu_base_ops = {
+	rcop_no_action,
+	zone_cpu_base_get,
+	zone_cpu_base_set,
+	rcop_no_test
+};
+
+/*ARGSUSED*/
+static rctl_qty_t
+zone_cpu_burst_time_get(rctl_t *rctl, struct proc *p)
+{
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	return (cpucaps_zone_get_burst_time(p->p_zone));
+}
+
+/*
+ * The zone cpu burst time is used to set the amount of time CPU(s) can be
+ * bursting for the zone.
+ */
+/*ARGSUSED*/
+static int
+zone_cpu_burst_time_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
+    rctl_qty_t nv)
+{
+	zone_t *zone = e->rcep_p.zone;
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	ASSERT(e->rcep_t == RCENTITY_ZONE);
+
+	if (zone == NULL)
+		return (0);
+
+	return (cpucaps_zone_set_burst_time(zone, nv));
+}
+
+static rctl_ops_t zone_cpu_burst_time_ops = {
+	rcop_no_action,
+	zone_cpu_burst_time_get,
+	zone_cpu_burst_time_set,
+	rcop_no_test
+};
+
+/*
+ * zone.zfs-io-pri resource control support (IO priority).
+ */
+/*ARGSUSED*/
+static rctl_qty_t
+zone_zfs_io_pri_get(rctl_t *rctl, struct proc *p)
+{
+	zone_persist_t *zp = &zone_pdata[p->p_zone->zone_id];
+	rctl_qty_t r = 0;
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	mutex_enter(&zp->zpers_zfs_lock);
+	if (zp->zpers_zfsp != NULL)
+		r = (rctl_qty_t)zp->zpers_zfsp->zpers_zfs_io_pri;
+	mutex_exit(&zp->zpers_zfs_lock);
+
+	return (r);
+}
+
+/*ARGSUSED*/
+static int
+zone_zfs_io_pri_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
+    rctl_qty_t nv)
+{
+	zone_t *zone = e->rcep_p.zone;
+	zone_persist_t *zp;
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	ASSERT(e->rcep_t == RCENTITY_ZONE);
+
+	if (zone == NULL)
+		return (0);
+
+	/*
+	 * set priority to the new value.
+	 */
+	zp = &zone_pdata[zone->zone_id];
+	mutex_enter(&zp->zpers_zfs_lock);
+	if (zp->zpers_zfsp != NULL)
+		zp->zpers_zfsp->zpers_zfs_io_pri = (uint16_t)nv;
+	mutex_exit(&zp->zpers_zfs_lock);
+	return (0);
+}
+
+static rctl_ops_t zone_zfs_io_pri_ops = {
+	rcop_no_action,
+	zone_zfs_io_pri_get,
+	zone_zfs_io_pri_set,
+	rcop_no_test
+};
+
+/*ARGSUSED*/
+static rctl_qty_t
 zone_lwps_usage(rctl_t *r, proc_t *p)
 {
 	rctl_qty_t nlwps;
@@ -1705,6 +1897,57 @@ static rctl_ops_t zone_max_swap_ops = {
 
 /*ARGSUSED*/
 static rctl_qty_t
+zone_phys_mem_usage(rctl_t *rctl, struct proc *p)
+{
+	rctl_qty_t q;
+	zone_persist_t *zp = &zone_pdata[p->p_zone->zone_id];
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	q = ptob(zp->zpers_pg_cnt);
+	return (q);
+}
+
+/*ARGSUSED*/
+static int
+zone_phys_mem_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
+    rctl_qty_t nv)
+{
+	zoneid_t zid;
+	uint_t pg_val;
+
+	ASSERT(MUTEX_HELD(&p->p_lock));
+	ASSERT(e->rcep_t == RCENTITY_ZONE);
+	if (e->rcep_p.zone == NULL)
+		return (0);
+	zid = e->rcep_p.zone->zone_id;
+	if (nv == UINT64_MAX) {
+		pg_val = UINT32_MAX;
+	} else {
+		uint64_t pages = btop(nv);
+
+		/*
+		 * Return from RCTLOP_SET is always ignored so just clamp an
+		 * out-of-range value to our largest "limited" value.
+		 */
+		if (pages >= UINT32_MAX) {
+			pg_val = UINT32_MAX - 1;
+		} else {
+			pg_val = (uint_t)pages;
+		}
+	}
+	zone_pdata[zid].zpers_pg_limit = pg_val;
+	return (0);
+}
+
+static rctl_ops_t zone_phys_mem_ops = {
+	rcop_no_action,
+	zone_phys_mem_usage,
+	zone_phys_mem_set,
+	rcop_no_test
+};
+
+/*ARGSUSED*/
+static rctl_qty_t
 zone_max_lofi_usage(rctl_t *rctl, struct proc *p)
 {
 	rctl_qty_t q;
@@ -1798,6 +2041,21 @@ zone_lockedmem_kstat_update(kstat_t *ksp, int rw)
 }
 
 static int
+zone_physmem_kstat_update(kstat_t *ksp, int rw)
+{
+	zone_t *zone = ksp->ks_private;
+	zone_kstat_t *zk = ksp->ks_data;
+	zone_persist_t *zp = &zone_pdata[zone->zone_id];
+
+	if (rw == KSTAT_WRITE)
+		return (EACCES);
+
+	zk->zk_usage.value.ui64 = ptob(zp->zpers_pg_cnt);
+	zk->zk_value.value.ui64 = ptob(zp->zpers_pg_limit);
+	return (0);
+}
+
+static int
 zone_nprocs_kstat_update(kstat_t *ksp, int rw)
 {
 	zone_t *zone = ksp->ks_private;
@@ -1826,7 +2084,7 @@ zone_swapresv_kstat_update(kstat_t *ksp, int rw)
 }
 
 static kstat_t *
-zone_kstat_create_common(zone_t *zone, char *name,
+zone_rctl_kstat_create_common(zone_t *zone, char *name,
     int (*updatefunc) (kstat_t *, int))
 {
 	kstat_t *ksp;
@@ -1851,16 +2109,200 @@ zone_kstat_create_common(zone_t *zone, char *name,
 	return (ksp);
 }
 
+static int
+zone_vfs_kstat_update(kstat_t *ksp, int rw)
+{
+	zone_t *zone = ksp->ks_private;
+	zone_vfs_kstat_t *zvp = ksp->ks_data;
+	kstat_io_t *kiop = &zone->zone_vfs_rwstats;
+
+	if (rw == KSTAT_WRITE)
+		return (EACCES);
+
+	/*
+	 * Extract the VFS statistics from the kstat_io_t structure used by
+	 * kstat_runq_enter() and related functions.  Since the slow ops
+	 * counters are updated directly by the VFS layer, there's no need to
+	 * copy those statistics here.
+	 *
+	 * Note that kstat_runq_enter() and the related functions use
+	 * gethrtime_unscaled(), so scale the time here.
+	 */
+	zvp->zv_nread.value.ui64 = kiop->nread;
+	zvp->zv_reads.value.ui64 = kiop->reads;
+	zvp->zv_rtime.value.ui64 = kiop->rtime;
+	zvp->zv_rcnt.value.ui64 = kiop->rcnt;
+	zvp->zv_rlentime.value.ui64 = kiop->rlentime;
+	zvp->zv_nwritten.value.ui64 = kiop->nwritten;
+	zvp->zv_writes.value.ui64 = kiop->writes;
+	zvp->zv_wtime.value.ui64 = kiop->wtime;
+	zvp->zv_wcnt.value.ui64 = kiop->wcnt;
+	zvp->zv_wlentime.value.ui64 = kiop->wlentime;
+
+	scalehrtime((hrtime_t *)&zvp->zv_rtime.value.ui64);
+	scalehrtime((hrtime_t *)&zvp->zv_rlentime.value.ui64);
+	scalehrtime((hrtime_t *)&zvp->zv_wtime.value.ui64);
+	scalehrtime((hrtime_t *)&zvp->zv_wlentime.value.ui64);
+
+	return (0);
+}
+
+static kstat_t *
+zone_vfs_kstat_create(zone_t *zone)
+{
+	kstat_t *ksp;
+	zone_vfs_kstat_t *zvp;
+
+	if ((ksp = kstat_create_zone("zone_vfs", zone->zone_id,
+	    zone->zone_name, "zone_vfs", KSTAT_TYPE_NAMED,
+	    sizeof (zone_vfs_kstat_t) / sizeof (kstat_named_t),
+	    KSTAT_FLAG_VIRTUAL, zone->zone_id)) == NULL)
+		return (NULL);
+
+	if (zone->zone_id != GLOBAL_ZONEID)
+		kstat_zone_add(ksp, GLOBAL_ZONEID);
+
+	zvp = ksp->ks_data = kmem_zalloc(sizeof (zone_vfs_kstat_t), KM_SLEEP);
+	ksp->ks_data_size += strlen(zone->zone_name) + 1;
+	ksp->ks_lock = &zone->zone_vfs_lock;
+	zone->zone_vfs_stats = zvp;
+
+	/* The kstat "name" field is not large enough for a full zonename */
+	kstat_named_init(&zvp->zv_zonename, "zonename", KSTAT_DATA_STRING);
+	kstat_named_setstr(&zvp->zv_zonename, zone->zone_name);
+	kstat_named_init(&zvp->zv_nread, "nread", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_reads, "reads", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_rtime, "rtime", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_rcnt, "rcnt", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_rlentime, "rlentime", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_nwritten, "nwritten", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_writes, "writes", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_wtime, "wtime", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_wcnt, "wcnt", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_wlentime, "wlentime", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_10ms_ops, "10ms_ops", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_100ms_ops, "100ms_ops", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_1s_ops, "1s_ops", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_10s_ops, "10s_ops", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_delay_cnt, "delay_cnt", KSTAT_DATA_UINT64);
+	kstat_named_init(&zvp->zv_delay_time, "delay_time", KSTAT_DATA_UINT64);
+
+	ksp->ks_update = zone_vfs_kstat_update;
+	ksp->ks_private = zone;
+
+	kstat_install(ksp);
+	return (ksp);
+}
+
+static int
+zone_zfs_kstat_update(kstat_t *ksp, int rw)
+{
+	zone_t *zone = ksp->ks_private;
+	zone_zfs_kstat_t *zzp = ksp->ks_data;
+	zone_persist_t *zp = &zone_pdata[zone->zone_id];
+
+	if (rw == KSTAT_WRITE)
+		return (EACCES);
+
+	mutex_enter(&zp->zpers_zfs_lock);
+	if (zp->zpers_zfsp == NULL) {
+		zzp->zz_nread.value.ui64 = 0;
+		zzp->zz_reads.value.ui64 = 0;
+		zzp->zz_rtime.value.ui64 = 0;
+		zzp->zz_rlentime.value.ui64 = 0;
+		zzp->zz_nwritten.value.ui64 = 0;
+		zzp->zz_writes.value.ui64 = 0;
+		zzp->zz_waittime.value.ui64 = 0;
+	} else {
+		kstat_io_t *kiop = &zp->zpers_zfsp->zpers_zfs_rwstats;
+
+		/*
+		 * Extract the ZFS statistics from the kstat_io_t structure
+		 * used by kstat_runq_enter() and related functions. Since the
+		 * I/O throttle counters are updated directly by the ZFS layer,
+		 * there's no need to copy those statistics here.
+		 *
+		 * Note that kstat_runq_enter() and the related functions use
+		 * gethrtime_unscaled(), so scale the time here.
+		 */
+		zzp->zz_nread.value.ui64 = kiop->nread;
+		zzp->zz_reads.value.ui64 = kiop->reads;
+		zzp->zz_rtime.value.ui64 = kiop->rtime;
+		zzp->zz_rlentime.value.ui64 = kiop->rlentime;
+		zzp->zz_nwritten.value.ui64 = kiop->nwritten;
+		zzp->zz_writes.value.ui64 = kiop->writes;
+		zzp->zz_waittime.value.ui64 =
+		    zp->zpers_zfsp->zpers_zfs_rd_waittime;
+	}
+	mutex_exit(&zp->zpers_zfs_lock);
+
+	scalehrtime((hrtime_t *)&zzp->zz_rtime.value.ui64);
+	scalehrtime((hrtime_t *)&zzp->zz_rlentime.value.ui64);
+
+	return (0);
+}
+
+static kstat_t *
+zone_zfs_kstat_create(zone_t *zone)
+{
+	kstat_t *ksp;
+	zone_zfs_kstat_t *zzp;
+
+	if ((ksp = kstat_create_zone("zone_zfs", zone->zone_id,
+	    zone->zone_name, "zone_zfs", KSTAT_TYPE_NAMED,
+	    sizeof (zone_zfs_kstat_t) / sizeof (kstat_named_t),
+	    KSTAT_FLAG_VIRTUAL, zone->zone_id)) == NULL)
+		return (NULL);
+
+	if (zone->zone_id != GLOBAL_ZONEID)
+		kstat_zone_add(ksp, GLOBAL_ZONEID);
+
+	zzp = ksp->ks_data = kmem_zalloc(sizeof (zone_zfs_kstat_t), KM_SLEEP);
+	ksp->ks_data_size += strlen(zone->zone_name) + 1;
+	ksp->ks_lock = &zone->zone_zfs_lock;
+	zone->zone_zfs_stats = zzp;
+
+	/* The kstat "name" field is not large enough for a full zonename */
+	kstat_named_init(&zzp->zz_zonename, "zonename", KSTAT_DATA_STRING);
+	kstat_named_setstr(&zzp->zz_zonename, zone->zone_name);
+	kstat_named_init(&zzp->zz_nread, "nread", KSTAT_DATA_UINT64);
+	kstat_named_init(&zzp->zz_reads, "reads", KSTAT_DATA_UINT64);
+	kstat_named_init(&zzp->zz_rtime, "rtime", KSTAT_DATA_UINT64);
+	kstat_named_init(&zzp->zz_rlentime, "rlentime", KSTAT_DATA_UINT64);
+	kstat_named_init(&zzp->zz_nwritten, "nwritten", KSTAT_DATA_UINT64);
+	kstat_named_init(&zzp->zz_writes, "writes", KSTAT_DATA_UINT64);
+	kstat_named_init(&zzp->zz_waittime, "waittime", KSTAT_DATA_UINT64);
+
+	ksp->ks_update = zone_zfs_kstat_update;
+	ksp->ks_private = zone;
+
+	kstat_install(ksp);
+	return (ksp);
+}
 
 static int
 zone_mcap_kstat_update(kstat_t *ksp, int rw)
 {
 	zone_t *zone = ksp->ks_private;
 	zone_mcap_kstat_t *zmp = ksp->ks_data;
+	zone_persist_t *zp;
 
 	if (rw == KSTAT_WRITE)
 		return (EACCES);
 
+	zp = &zone_pdata[zone->zone_id];
+
+	zmp->zm_rss.value.ui64 = ptob(zp->zpers_pg_cnt);
+	zmp->zm_phys_cap.value.ui64 = ptob(zp->zpers_pg_limit);
+	zmp->zm_swap.value.ui64 = zone->zone_max_swap;
+	zmp->zm_swap_cap.value.ui64 = zone->zone_max_swap_ctl;
+	zmp->zm_nover.value.ui64 = zp->zpers_nover;
+#ifndef DEBUG
+	zmp->zm_pagedout.value.ui64 = ptob(zp->zpers_pg_out);
+#else
+	zmp->zm_pagedout.value.ui64 = ptob(zp->zpers_pg_fsdirty +
+	    zp->zpers_pg_fs + zp->zpers_pg_anon + zp->zpers_pg_anondirty);
+#endif
 	zmp->zm_pgpgin.value.ui64 = zone->zone_pgpgin;
 	zmp->zm_anonpgin.value.ui64 = zone->zone_anonpgin;
 	zmp->zm_execpgin.value.ui64 = zone->zone_execpgin;
@@ -1893,6 +2335,12 @@ zone_mcap_kstat_create(zone_t *zone)
 	/* The kstat "name" field is not large enough for a full zonename */
 	kstat_named_init(&zmp->zm_zonename, "zonename", KSTAT_DATA_STRING);
 	kstat_named_setstr(&zmp->zm_zonename, zone->zone_name);
+	kstat_named_init(&zmp->zm_rss, "rss", KSTAT_DATA_UINT64);
+	kstat_named_init(&zmp->zm_phys_cap, "physcap", KSTAT_DATA_UINT64);
+	kstat_named_init(&zmp->zm_swap, "swap", KSTAT_DATA_UINT64);
+	kstat_named_init(&zmp->zm_swap_cap, "swapcap", KSTAT_DATA_UINT64);
+	kstat_named_init(&zmp->zm_nover, "nover", KSTAT_DATA_UINT64);
+	kstat_named_init(&zmp->zm_pagedout, "pagedout", KSTAT_DATA_UINT64);
 	kstat_named_init(&zmp->zm_pgpgin, "pgpgin", KSTAT_DATA_UINT64);
 	kstat_named_init(&zmp->zm_anonpgin, "anonpgin", KSTAT_DATA_UINT64);
 	kstat_named_init(&zmp->zm_execpgin, "execpgin", KSTAT_DATA_UINT64);
@@ -1936,6 +2384,8 @@ zone_misc_kstat_update(kstat_t *ksp, int rw)
 	zmp->zm_ffnomem.value.ui32 = zone->zone_ffnomem;
 	zmp->zm_ffmisc.value.ui32 = zone->zone_ffmisc;
 
+	zmp->zm_mfseglim.value.ui32 = zone->zone_mfseglim;
+
 	zmp->zm_nested_intp.value.ui32 = zone->zone_nested_intp;
 
 	zmp->zm_init_pid.value.ui32 = zone->zone_proc_initpid;
@@ -1979,6 +2429,8 @@ zone_misc_kstat_create(zone_t *zone)
 	    KSTAT_DATA_UINT32);
 	kstat_named_init(&zmp->zm_ffnomem, "forkfail_nomem", KSTAT_DATA_UINT32);
 	kstat_named_init(&zmp->zm_ffmisc, "forkfail_misc", KSTAT_DATA_UINT32);
+	kstat_named_init(&zmp->zm_mfseglim, "mapfail_seglim",
+	    KSTAT_DATA_UINT32);
 	kstat_named_init(&zmp->zm_nested_intp, "nested_interp",
 	    KSTAT_DATA_UINT32);
 	kstat_named_init(&zmp->zm_init_pid, "init_pid", KSTAT_DATA_UINT32);
@@ -1994,13 +2446,25 @@ zone_misc_kstat_create(zone_t *zone)
 static void
 zone_kstat_create(zone_t *zone)
 {
-	zone->zone_lockedmem_kstat = zone_kstat_create_common(zone,
+	zone->zone_lockedmem_kstat = zone_rctl_kstat_create_common(zone,
 	    "lockedmem", zone_lockedmem_kstat_update);
-	zone->zone_swapresv_kstat = zone_kstat_create_common(zone,
+	zone->zone_swapresv_kstat = zone_rctl_kstat_create_common(zone,
 	    "swapresv", zone_swapresv_kstat_update);
-	zone->zone_nprocs_kstat = zone_kstat_create_common(zone,
+	zone->zone_physmem_kstat = zone_rctl_kstat_create_common(zone,
+	    "physicalmem", zone_physmem_kstat_update);
+	zone->zone_nprocs_kstat = zone_rctl_kstat_create_common(zone,
 	    "nprocs", zone_nprocs_kstat_update);
 
+	if ((zone->zone_vfs_ksp = zone_vfs_kstat_create(zone)) == NULL) {
+		zone->zone_vfs_stats = kmem_zalloc(
+		    sizeof (zone_vfs_kstat_t), KM_SLEEP);
+	}
+
+	if ((zone->zone_zfs_ksp = zone_zfs_kstat_create(zone)) == NULL) {
+		zone->zone_zfs_stats = kmem_zalloc(
+		    sizeof (zone_zfs_kstat_t), KM_SLEEP);
+	}
+
 	if ((zone->zone_mcap_ksp = zone_mcap_kstat_create(zone)) == NULL) {
 		zone->zone_mcap_stats = kmem_zalloc(
 		    sizeof (zone_mcap_kstat_t), KM_SLEEP);
@@ -2032,8 +2496,15 @@ zone_kstat_delete(zone_t *zone)
 	    sizeof (zone_kstat_t));
 	zone_kstat_delete_common(&zone->zone_swapresv_kstat,
 	    sizeof (zone_kstat_t));
+	zone_kstat_delete_common(&zone->zone_physmem_kstat,
+	    sizeof (zone_kstat_t));
 	zone_kstat_delete_common(&zone->zone_nprocs_kstat,
 	    sizeof (zone_kstat_t));
+
+	zone_kstat_delete_common(&zone->zone_vfs_ksp,
+	    sizeof (zone_vfs_kstat_t));
+	zone_kstat_delete_common(&zone->zone_zfs_ksp,
+	    sizeof (zone_zfs_kstat_t));
 	zone_kstat_delete_common(&zone->zone_mcap_ksp,
 	    sizeof (zone_mcap_kstat_t));
 	zone_kstat_delete_common(&zone->zone_misc_ksp,
@@ -2095,12 +2566,15 @@ zone_zsd_init(void)
 	zone0.zone_initname = initname;
 	zone0.zone_lockedmem_kstat = NULL;
 	zone0.zone_swapresv_kstat = NULL;
+	zone0.zone_physmem_kstat = NULL;
 	zone0.zone_nprocs_kstat = NULL;
-
 	zone0.zone_stime = 0;
 	zone0.zone_utime = 0;
 	zone0.zone_wtime = 0;
 
+	zone_pdata[0].zpers_zfsp = &zone0_zp_zfs;
+	zone_pdata[0].zpers_zfsp->zpers_zfs_io_pri = 1;
+
 	list_create(&zone0.zone_ref_list, sizeof (zone_ref_t),
 	    offsetof(zone_ref_t, zref_linkage));
 	list_create(&zone0.zone_zsd, sizeof (struct zsd_entry),
@@ -2207,6 +2681,21 @@ zone_init(void)
 	    RCTL_GLOBAL_INFINITE,
 	    MAXCAP, MAXCAP, &zone_cpu_cap_ops);
 
+	rc_zone_cpu_baseline = rctl_register("zone.cpu-baseline",
+	    RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_NEVER |
+	    RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT | RCTL_GLOBAL_SYSLOG_NEVER,
+	    MAXCAP, MAXCAP, &zone_cpu_base_ops);
+
+	rc_zone_cpu_burst_time = rctl_register("zone.cpu-burst-time",
+	    RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_NEVER |
+	    RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT | RCTL_GLOBAL_SYSLOG_NEVER,
+	    INT_MAX, INT_MAX, &zone_cpu_burst_time_ops);
+
+	rc_zone_zfs_io_pri = rctl_register("zone.zfs-io-priority",
+	    RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_NEVER |
+	    RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT | RCTL_GLOBAL_SYSLOG_NEVER,
+	    16384, 16384, &zone_zfs_io_pri_ops);
+
 	rc_zone_nlwps = rctl_register("zone.max-lwps", RCENTITY_ZONE,
 	    RCTL_GLOBAL_NOACTION | RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT,
 	    INT_MAX, INT_MAX, &zone_lwps_ops);
@@ -2248,6 +2737,20 @@ zone_init(void)
 	rde = rctl_dict_lookup("zone.cpu-shares");
 	(void) rctl_val_list_insert(&rde->rcd_default_value, dval);
 
+	/*
+	 * Create a rctl_val with PRIVILEGED, NOACTION, value = 1.  Then attach
+	 * this at the head of the rctl_dict_entry for ``zone.zfs-io-priority'.
+	 */
+	dval = kmem_cache_alloc(rctl_val_cache, KM_SLEEP);
+	bzero(dval, sizeof (rctl_val_t));
+	dval->rcv_value = 1;
+	dval->rcv_privilege = RCPRIV_PRIVILEGED;
+	dval->rcv_flagaction = RCTL_LOCAL_NOACTION;
+	dval->rcv_action_recip_pid = -1;
+
+	rde = rctl_dict_lookup("zone.zfs-io-priority");
+	(void) rctl_val_list_insert(&rde->rcd_default_value, dval);
+
 	rc_zone_locked_mem = rctl_register("zone.max-locked-memory",
 	    RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_BYTES |
 	    RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
@@ -2258,6 +2761,11 @@ zone_init(void)
 	    RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
 	    &zone_max_swap_ops);
 
+	rc_zone_phys_mem = rctl_register("zone.max-physical-memory",
+	    RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_BYTES |
+	    RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
+	    &zone_phys_mem_ops);
+
 	rc_zone_max_lofi = rctl_register("zone.max-lofi",
 	    RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT |
 	    RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
@@ -2279,6 +2787,9 @@ zone_init(void)
 	zone0.zone_ntasks = 1;
 	mutex_exit(&p0.p_lock);
 	zone0.zone_restart_init = B_TRUE;
+	zone0.zone_reboot_on_init_exit = B_FALSE;
+	zone0.zone_restart_init_0 = B_FALSE;
+	zone0.zone_init_status = -1;
 	zone0.zone_brand = &native_brand;
 	rctl_prealloc_destroy(gp);
 	/*
@@ -2358,6 +2869,8 @@ zone_init(void)
 static void
 zone_free(zone_t *zone)
 {
+	zone_dl_t *zdl;
+
 	ASSERT(zone != global_zone);
 	ASSERT(zone->zone_ntasks == 0);
 	ASSERT(zone->zone_nlwps == 0);
@@ -2373,6 +2886,9 @@ zone_free(zone_t *zone)
 	 */
 	cpucaps_zone_remove(zone);
 
+	/* Clear physical memory capping data. */
+	bzero(&zone_pdata[zone->zone_id], sizeof (zone_persist_t));
+
 	ASSERT(zone->zone_cpucap == NULL);
 
 	/* remove from deathrow list */
@@ -2386,6 +2902,19 @@ zone_free(zone_t *zone)
 	list_destroy(&zone->zone_ref_list);
 	zone_free_zsd(zone);
 	zone_free_datasets(zone);
+
+	/*
+	 * While dlmgmtd should have removed all of these, it could have left
+	 * something behind or crashed. In which case it's not safe for us to
+	 * assume that the list is empty which list_destroy() will ASSERT. We
+	 * clean up for our userland comrades which may have crashed, or worse,
+	 * been disabled by SMF.
+	 */
+	while ((zdl = list_remove_head(&zone->zone_dl_list)) != NULL) {
+		if (zdl->zdl_net != NULL)
+			nvlist_free(zdl->zdl_net);
+		kmem_free(zdl, sizeof (zone_dl_t));
+	}
 	list_destroy(&zone->zone_dl_list);
 
 	if (zone->zone_rootvp != NULL)
@@ -2430,12 +2959,18 @@ zone_free(zone_t *zone)
 static void
 zone_status_set(zone_t *zone, zone_status_t status)
 {
+	timestruc_t now;
+	uint64_t t;
 
 	nvlist_t *nvl = NULL;
 	ASSERT(MUTEX_HELD(&zone_status_lock));
 	ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE &&
 	    status >= zone_status_get(zone));
 
+	/* Current time since Jan 1 1970 but consumers expect NS */
+	gethrestime(&now);
+	t = (now.tv_sec * NANOSEC) + now.tv_nsec;
+
 	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) ||
 	    nvlist_add_string(nvl, ZONE_CB_NAME, zone->zone_name) ||
 	    nvlist_add_string(nvl, ZONE_CB_NEWSTATE,
@@ -2443,7 +2978,7 @@ zone_status_set(zone_t *zone, zone_status_t status)
 	    nvlist_add_string(nvl, ZONE_CB_OLDSTATE,
 	    zone_status_table[zone->zone_status]) ||
 	    nvlist_add_int32(nvl, ZONE_CB_ZONEID, zone->zone_id) ||
-	    nvlist_add_uint64(nvl, ZONE_CB_TIMESTAMP, (uint64_t)gethrtime()) ||
+	    nvlist_add_uint64(nvl, ZONE_CB_TIMESTAMP, t) ||
 	    sysevent_evc_publish(zone_event_chan, ZONE_EVENT_STATUS_CLASS,
 	    ZONE_EVENT_STATUS_SUBCLASS, "sun.com", "kernel", nvl, EVCH_SLEEP)) {
 #ifdef DEBUG
@@ -2521,9 +3056,14 @@ zone_set_brand(zone_t *zone, const char *brand)
 		return (EINVAL);
 	}
 
-	/* set up the brand specific data */
+	/*
+	 * Set up the brand specific data.
+	 * Note that it's possible that the hook has to drop the
+	 * zone_status_lock and reaquire it before returning so we can't
+	 * assume the lock has been held the entire time.
+	 */
 	zone->zone_brand = bp;
-	ZBROP(zone)->b_init_brand_data(zone);
+	ZBROP(zone)->b_init_brand_data(zone, &zone_status_lock);
 
 	mutex_exit(&zone_status_lock);
 	return (0);
@@ -2596,18 +3136,6 @@ zone_set_initname(zone_t *zone, const char *zone_initname)
 }
 
 static int
-zone_set_phys_mcap(zone_t *zone, const uint64_t *zone_mcap)
-{
-	uint64_t mcap;
-	int err = 0;
-
-	if ((err = copyin(zone_mcap, &mcap, sizeof (uint64_t))) == 0)
-		zone->zone_phys_mcap = mcap;
-
-	return (err);
-}
-
-static int
 zone_set_sched_class(zone_t *zone, const char *new_class)
 {
 	char sched_class[PC_CLNMSZ];
@@ -3014,6 +3542,12 @@ getzoneid(void)
 	return (curproc->p_zone->zone_id);
 }
 
+zoneid_t
+getzonedid(void)
+{
+	return (curproc->p_zone->zone_did);
+}
+
 /*
  * Internal versions of zone_find_by_*().  These don't zone_hold() or
  * check the validity of a zone's state.
@@ -3757,6 +4291,17 @@ zone_start_init(void)
 	 */
 	z->zone_proc_initpid = p->p_pid;
 
+	if (z->zone_setup_app_contract == B_TRUE) {
+		/*
+		 * Normally a process cannot modify its own contract, but we're
+		 * just starting the zone's init process and its contract is
+		 * always initialized from the sys_process_tmpl template, so
+		 * this is the simplest way to setup init's contract to kill
+		 * the process if any other process in the contract exits.
+		 */
+		p->p_ct_process->conp_ev_fatal |= CT_PR_EV_EXIT;
+	}
+
 	/*
 	 * We maintain zone_boot_err so that we can return the cause of the
 	 * failure back to the caller of the zone_boot syscall.
@@ -3785,9 +4330,54 @@ zone_start_init(void)
 			lwp_exit();
 		}
 	} else {
+		id_t cid = curthread->t_cid;
+
 		if (zone_status_get(z) == ZONE_IS_BOOTING)
 			zone_status_set(z, ZONE_IS_RUNNING);
 		mutex_exit(&zone_status_lock);
+
+		mutex_enter(&class_lock);
+		ASSERT(cid < loaded_classes);
+		if (strcmp(sclass[cid].cl_name, "FX") == 0 &&
+		    z->zone_fixed_hipri) {
+			/*
+			 * If the zone is using FX then by default all
+			 * processes start at the lowest priority and stay
+			 * there. We provide a mechanism for the zone to
+			 * indicate that it should run at "high priority". In
+			 * this case we setup init to run at the highest FX
+			 * priority (which is one level higher than the
+			 * non-fixed scheduling classes can use).
+			 */
+			pcparms_t pcparms;
+
+			pcparms.pc_cid = cid;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_upri = FXMAXUPRI;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_uprilim =
+			    FXMAXUPRI;
+			((fxkparms_t *)pcparms.pc_clparms)->fx_cflags =
+			    FX_DOUPRILIM | FX_DOUPRI;
+
+			mutex_enter(&pidlock);
+			mutex_enter(&curproc->p_lock);
+
+			(void) parmsset(&pcparms, curthread);
+
+			mutex_exit(&curproc->p_lock);
+			mutex_exit(&pidlock);
+		} else if (strcmp(sclass[cid].cl_name, "RT") == 0) {
+			/*
+			 * zsched always starts the init lwp at priority
+			 * minclsyspri - 1. This priority gets set in t_pri and
+			 * is invalid for RT, but RT never uses t_pri. However
+			 * t_pri is used by procfs, so we always see processes
+			 * within an RT zone with an invalid priority value.
+			 * We fix that up now.
+			 */
+			curthread->t_pri = RTGPPRIO0;
+		}
+		mutex_exit(&class_lock);
+
 		/* cause the process to return to userland. */
 		lwp_rtt();
 	}
@@ -4273,8 +4863,9 @@ parse_rctls(caddr_t ubuf, size_t buflen, nvlist_t **nvlp)
 
 		error = EINVAL;
 		name = nvpair_name(nvp);
-		if (strncmp(nvpair_name(nvp), "zone.", sizeof ("zone.") - 1)
-		    != 0 || nvpair_type(nvp) != DATA_TYPE_NVLIST_ARRAY) {
+		if ((strncmp(name, "zone.", sizeof ("zone.") - 1) != 0 &&
+		    strncmp(name, "project.", sizeof ("project.") - 1) != 0) ||
+		    nvpair_type(nvp) != DATA_TYPE_NVLIST_ARRAY) {
 			goto out;
 		}
 		if ((hndl = rctl_hndl_lookup(name)) == -1) {
@@ -4393,7 +4984,7 @@ zone_create(const char *zone_name, const char *zone_root,
     caddr_t rctlbuf, size_t rctlbufsz,
     caddr_t zfsbuf, size_t zfsbufsz, int *extended_error,
     int match, uint32_t doi, const bslabel_t *label,
-    int flags)
+    int flags, zoneid_t zone_did)
 {
 	struct zsched_arg zarg;
 	nvlist_t *rctls = NULL;
@@ -4465,6 +5056,7 @@ zone_create(const char *zone_name, const char *zone_root,
 
 	zone = kmem_zalloc(sizeof (zone_t), KM_SLEEP);
 	zone->zone_id = zoneid;
+	zone->zone_did = zone_did;
 	zone->zone_status = ZONE_IS_UNINITIALIZED;
 	zone->zone_pool = pool_default;
 	zone->zone_pool_mod = gethrtime();
@@ -4472,6 +5064,9 @@ zone_create(const char *zone_name, const char *zone_root,
 	zone->zone_ncpus = 0;
 	zone->zone_ncpus_online = 0;
 	zone->zone_restart_init = B_TRUE;
+	zone->zone_reboot_on_init_exit = B_FALSE;
+	zone->zone_restart_init_0 = B_FALSE;
+	zone->zone_init_status = -1;
 	zone->zone_brand = &native_brand;
 	zone->zone_initname = NULL;
 	mutex_init(&zone->zone_lock, NULL, MUTEX_DEFAULT, NULL);
@@ -4541,14 +5136,26 @@ zone_create(const char *zone_name, const char *zone_root,
 	zone->zone_max_swap_ctl = UINT64_MAX;
 	zone->zone_max_lofi = 0;
 	zone->zone_max_lofi_ctl = UINT64_MAX;
-	zone0.zone_lockedmem_kstat = NULL;
-	zone0.zone_swapresv_kstat = NULL;
+	zone->zone_lockedmem_kstat = NULL;
+	zone->zone_swapresv_kstat = NULL;
+	zone->zone_physmem_kstat = NULL;
+
+	zone_pdata[zoneid].zpers_zfsp =
+	    kmem_zalloc(sizeof (zone_zfs_io_t), KM_SLEEP);
+	zone_pdata[zoneid].zpers_zfsp->zpers_zfs_io_pri = 1;
 
 	/*
 	 * Zsched initializes the rctls.
 	 */
 	zone->zone_rctls = NULL;
 
+	/*
+	 * Ensure page count is 0 (in case zoneid has wrapped).
+	 * Initialize physical memory cap as unlimited.
+	 */
+	zone_pdata[zoneid].zpers_pg_cnt = 0;
+	zone_pdata[zoneid].zpers_pg_limit = UINT32_MAX;
+
 	if ((error = parse_rctls(rctlbuf, rctlbufsz, &rctls)) != 0) {
 		zone_free(zone);
 		return (zone_create_error(error, 0, extended_error));
@@ -4697,8 +5304,8 @@ zone_create(const char *zone_name, const char *zone_root,
 	/*
 	 * The process, task, and project rctls are probably wrong;
 	 * we need an interface to get the default values of all rctls,
-	 * and initialize zsched appropriately.  I'm not sure that that
-	 * makes much of a difference, though.
+	 * and initialize zsched appropriately. However, we allow zoneadmd
+	 * to pass down both zone and project rctls for the zone's init.
 	 */
 	error = newproc(zsched, (void *)&zarg, syscid, minclsyspri, NULL, 0);
 	if (error != 0) {
@@ -4837,6 +5444,7 @@ zone_boot(zoneid_t zoneid)
 static int
 zone_empty(zone_t *zone)
 {
+	int cnt = 0;
 	int waitstatus;
 
 	/*
@@ -4847,7 +5455,16 @@ zone_empty(zone_t *zone)
 	ASSERT(MUTEX_NOT_HELD(&zonehash_lock));
 	while ((waitstatus = zone_status_timedwait_sig(zone,
 	    ddi_get_lbolt() + hz, ZONE_IS_EMPTY)) == -1) {
-		killall(zone->zone_id);
+		boolean_t force = B_FALSE;
+
+		/* Every 30 seconds, try harder */
+		if (cnt++ >= 30) {
+			cmn_err(CE_WARN, "attempt to force kill zone %d\n",
+			    zone->zone_id);
+			force = B_TRUE;
+			cnt = 0;
+		}
+		killall(zone->zone_id, force);
 	}
 	/*
 	 * return EINTR if we were signaled
@@ -5176,6 +5793,7 @@ zone_destroy(zoneid_t zoneid)
 	zone_status_t status;
 	clock_t wait_time;
 	boolean_t log_refcounts;
+	zone_persist_t *zp;
 
 	if (secpolicy_zone_config(CRED()) != 0)
 		return (set_errno(EPERM));
@@ -5209,6 +5827,12 @@ zone_destroy(zoneid_t zoneid)
 	zone_hold(zone);
 	mutex_exit(&zonehash_lock);
 
+	zp = &zone_pdata[zoneid];
+	mutex_enter(&zp->zpers_zfs_lock);
+	kmem_free(zp->zpers_zfsp, sizeof (zone_zfs_io_t));
+	zp->zpers_zfsp = NULL;
+	mutex_exit(&zp->zpers_zfs_lock);
+
 	/*
 	 * wait for zsched to exit
 	 */
@@ -5598,14 +6222,6 @@ zone_getattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
 				error = EFAULT;
 		}
 		break;
-	case ZONE_ATTR_PHYS_MCAP:
-		size = sizeof (zone->zone_phys_mcap);
-		if (bufsize > size)
-			bufsize = size;
-		if (buf != NULL &&
-		    copyout(&zone->zone_phys_mcap, buf, bufsize) != 0)
-			error = EFAULT;
-		break;
 	case ZONE_ATTR_SCHED_CLASS:
 		mutex_enter(&class_lock);
 
@@ -5669,6 +6285,23 @@ zone_getattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
 		}
 		kmem_free(zbuf, bufsize);
 		break;
+	case ZONE_ATTR_DID:
+		size = sizeof (zoneid_t);
+		if (bufsize > size)
+			bufsize = size;
+
+		if (buf != NULL && copyout(&zone->zone_did, buf, bufsize) != 0)
+			error = EFAULT;
+		break;
+	case ZONE_ATTR_SCHED_FIXEDHI:
+		size = sizeof (boolean_t);
+		if (bufsize > size)
+			bufsize = size;
+
+		if (buf != NULL && copyout(&zone->zone_fixed_hipri, buf,
+		    bufsize) != 0)
+			error = EFAULT;
+		break;
 	default:
 		if ((attr >= ZONE_ATTR_BRAND_ATTRS) && ZONE_IS_BRANDED(zone)) {
 			size = bufsize;
@@ -5700,10 +6333,9 @@ zone_setattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
 		return (set_errno(EPERM));
 
 	/*
-	 * Only the ZONE_ATTR_PHYS_MCAP attribute can be set on the
-	 * global zone.
+	 * No attributes can be set on the global zone.
 	 */
-	if (zoneid == GLOBAL_ZONEID && attr != ZONE_ATTR_PHYS_MCAP) {
+	if (zoneid == GLOBAL_ZONEID) {
 		return (set_errno(EINVAL));
 	}
 
@@ -5716,11 +6348,11 @@ zone_setattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
 	mutex_exit(&zonehash_lock);
 
 	/*
-	 * At present most attributes can only be set on non-running,
+	 * At present attributes can only be set on non-running,
 	 * non-global zones.
 	 */
 	zone_status = zone_status_get(zone);
-	if (attr != ZONE_ATTR_PHYS_MCAP && zone_status > ZONE_IS_READY) {
+	if (zone_status > ZONE_IS_READY) {
 		err = EINVAL;
 		goto done;
 	}
@@ -5733,6 +6365,14 @@ zone_setattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
 		zone->zone_restart_init = B_FALSE;
 		err = 0;
 		break;
+	case ZONE_ATTR_INITRESTART0:
+		zone->zone_restart_init_0 = B_TRUE;
+		err = 0;
+		break;
+	case ZONE_ATTR_INITREBOOT:
+		zone->zone_reboot_on_init_exit = B_TRUE;
+		err = 0;
+		break;
 	case ZONE_ATTR_BOOTARGS:
 		err = zone_set_bootargs(zone, (const char *)buf);
 		break;
@@ -5745,9 +6385,6 @@ zone_setattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
 	case ZONE_ATTR_SECFLAGS:
 		err = zone_set_secflags(zone, (psecflags_t *)buf);
 		break;
-	case ZONE_ATTR_PHYS_MCAP:
-		err = zone_set_phys_mcap(zone, (const uint64_t *)buf);
-		break;
 	case ZONE_ATTR_SCHED_CLASS:
 		err = zone_set_sched_class(zone, (const char *)buf);
 		break;
@@ -5775,6 +6412,22 @@ zone_setattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
 		err = zone_set_network(zoneid, zbuf);
 		kmem_free(zbuf, bufsize);
 		break;
+	case ZONE_ATTR_APP_SVC_CT:
+		if (bufsize != sizeof (boolean_t)) {
+			err = EINVAL;
+		} else {
+			zone->zone_setup_app_contract = (boolean_t)buf;
+			err = 0;
+		}
+		break;
+	case ZONE_ATTR_SCHED_FIXEDHI:
+		if (bufsize != sizeof (boolean_t)) {
+			err = EINVAL;
+		} else {
+			zone->zone_fixed_hipri = (boolean_t)buf;
+			err = 0;
+		}
+		break;
 	default:
 		if ((attr >= ZONE_ATTR_BRAND_ATTRS) && ZONE_IS_BRANDED(zone))
 			err = ZBROP(zone)->b_setattr(zone, attr, buf, bufsize);
@@ -6478,6 +7131,7 @@ zone(int cmd, void *arg1, void *arg2, void *arg3, void *arg4)
 			zs.doi = zs32.doi;
 			zs.label = (const bslabel_t *)(uintptr_t)zs32.label;
 			zs.flags = zs32.flags;
+			zs.zoneid = zs32.zoneid;
 #else
 			panic("get_udatamodel() returned bogus result\n");
 #endif
@@ -6488,7 +7142,7 @@ zone(int cmd, void *arg1, void *arg2, void *arg3, void *arg4)
 		    (caddr_t)zs.rctlbuf, zs.rctlbufsz,
 		    (caddr_t)zs.zfsbuf, zs.zfsbufsz,
 		    zs.extended_error, zs.match, zs.doi,
-		    zs.label, zs.flags));
+		    zs.label, zs.flags, zs.zoneid));
 	case ZONE_BOOT:
 		return (zone_boot((zoneid_t)(uintptr_t)arg1));
 	case ZONE_DESTROY:
@@ -6589,6 +7243,7 @@ zone_ki_call_zoneadmd(struct zarg *zargp)
 	bcopy(zone->zone_name, zone_name, zone_namelen);
 	zoneid = zone->zone_id;
 	uniqid = zone->zone_uniqid;
+	arg.status = zone->zone_init_status;
 	/*
 	 * zoneadmd may be down, but at least we can empty out the zone.
 	 * We can ignore the return value of zone_empty() since we're called
@@ -6766,7 +7421,7 @@ zone_kadmin(int cmd, int fcn, const char *mdep, cred_t *credp)
 	 * zone_ki_call_zoneadmd() will do a more thorough job of this
 	 * later.
 	 */
-	killall(zone->zone_id);
+	killall(zone->zone_id, B_FALSE);
 	/*
 	 * Now, create the thread to contact zoneadmd and do the rest of the
 	 * work.  This thread can't be created in our zone otherwise
@@ -6829,16 +7484,15 @@ zone_shutdown_global(void)
 }
 
 /*
- * Returns true if the named dataset is visible in the current zone.
+ * Returns true if the named dataset is visible in the specified zone.
  * The 'write' parameter is set to 1 if the dataset is also writable.
  */
 int
-zone_dataset_visible(const char *dataset, int *write)
+zone_dataset_visible_inzone(zone_t *zone, const char *dataset, int *write)
 {
 	static int zfstype = -1;
 	zone_dataset_t *zd;
 	size_t len;
-	zone_t *zone = curproc->p_zone;
 	const char *name = NULL;
 	vfs_t *vfsp = NULL;
 
@@ -6906,7 +7560,8 @@ zone_dataset_visible(const char *dataset, int *write)
 	vfs_list_read_lock();
 	vfsp = zone->zone_vfslist;
 	do {
-		ASSERT(vfsp);
+		if (vfsp == NULL)
+			break;
 		if (vfsp->vfs_fstype == zfstype) {
 			name = refstr_value(vfsp->vfs_resource);
 
@@ -6943,6 +7598,18 @@ zone_dataset_visible(const char *dataset, int *write)
 }
 
 /*
+ * Returns true if the named dataset is visible in the current zone.
+ * The 'write' parameter is set to 1 if the dataset is also writable.
+ */
+int
+zone_dataset_visible(const char *dataset, int *write)
+{
+	zone_t *zone = curproc->p_zone;
+
+	return (zone_dataset_visible_inzone(zone, dataset, write));
+}
+
+/*
  * zone_find_by_any_path() -
  *
  * kernel-private routine similar to zone_find_by_path(), but which
@@ -7044,6 +7711,27 @@ zone_add_datalink(zoneid_t zoneid, datalink_id_t linkid)
 	zone_t *zone;
 	zone_t *thiszone;
 
+	/*
+	 * Only the GZ may add a datalink to a zone's list.
+	 */
+	if (getzoneid() != GLOBAL_ZONEID)
+		return (set_errno(EPERM));
+
+	/*
+	 * Only a process with the datalink config priv may add a
+	 * datalink to a zone's list.
+	 */
+	if (secpolicy_dl_config(CRED()) != 0)
+		return (set_errno(EPERM));
+
+	/*
+	 * When links exist in the GZ, they aren't added to the GZ's
+	 * zone_dl_list. We must enforce this because link_activate()
+	 * depends on zone_check_datalink() returning only NGZs.
+	 */
+	if (zoneid == GLOBAL_ZONEID)
+		return (set_errno(EINVAL));
+
 	if ((thiszone = zone_find_by_id(zoneid)) == NULL)
 		return (set_errno(ENXIO));
 
@@ -7076,6 +7764,26 @@ zone_remove_datalink(zoneid_t zoneid, datalink_id_t linkid)
 	zone_t *zone;
 	int err = 0;
 
+	/*
+	 * Only the GZ may remove a datalink from a zone's list.
+	 */
+	if (getzoneid() != GLOBAL_ZONEID)
+		return (set_errno(EPERM));
+
+	/*
+	 * Only a process with the datalink config priv may remove a
+	 * datalink from a zone's list.
+	 */
+	if (secpolicy_dl_config(CRED()) != 0)
+		return (set_errno(EPERM));
+
+	/*
+	 * If we can't add a datalink to the GZ's zone_dl_list then we
+	 * certainly can't remove them either.
+	 */
+	if (zoneid == GLOBAL_ZONEID)
+		return (set_errno(EINVAL));
+
 	if ((zone = zone_find_by_id(zoneid)) == NULL)
 		return (set_errno(EINVAL));
 
@@ -7093,25 +7801,63 @@ zone_remove_datalink(zoneid_t zoneid, datalink_id_t linkid)
 }
 
 /*
- * Using the zoneidp as ALL_ZONES, we can lookup which zone has been assigned
- * the linkid.  Otherwise we just check if the specified zoneidp has been
- * assigned the supplied linkid.
+ *
+ * This function may be used in two ways:
+ *
+ * 1. to get the zoneid of the zone this link is under, or
+ *
+ * 2. to verify that the link is under a specific zone.
+ *
+ * The first use is achieved by passing a zoneid of ALL_ZONES. The
+ * function then iterates the datalink list of every zone on the
+ * system until it finds the linkid. If the linkid is found then the
+ * function returns 0 and zoneidp is updated. Otherwise, ENXIO is
+ * returned and zoneidp is not modified. The use of ALL_ZONES is
+ * limited to callers in the GZ to prevent leaking information to
+ * NGZs. If an NGZ passes ALL_ZONES it's query is implicitly changed
+ * to the second type in the list above.
+ *
+ * The second use is achieved by passing a specific zoneid. The GZ can
+ * use this to verify a link is under a particular zone. An NGZ can
+ * use this to verify a link is under itself. But an NGZ cannot use
+ * this to determine if a link is under some other zone as that would
+ * result in information leakage. If the link exists under the zone
+ * then 0 is returned. Otherwise, ENXIO is returned.
  */
 int
 zone_check_datalink(zoneid_t *zoneidp, datalink_id_t linkid)
 {
 	zone_t *zone;
+	zoneid_t zoneid = *zoneidp;
+	zoneid_t caller = getzoneid();
 	int err = ENXIO;
 
-	if (*zoneidp != ALL_ZONES) {
-		if ((zone = zone_find_by_id(*zoneidp)) != NULL) {
-			if (zone_dl_exists(zone, linkid))
+	/*
+	 * Only the GZ may enquire about all zones; an NGZ may only
+	 * enuqire about itself.
+	 */
+	if (zoneid == ALL_ZONES && caller != GLOBAL_ZONEID)
+		zoneid = caller;
+
+	if (zoneid != caller && caller != GLOBAL_ZONEID)
+		return (err);
+
+	if (zoneid != ALL_ZONES) {
+		if ((zone = zone_find_by_id(zoneid)) != NULL) {
+			if (zone_dl_exists(zone, linkid)) {
+				/*
+				 * We need to set this in case an NGZ
+				 * passes ALL_ZONES.
+				 */
+				*zoneidp = zoneid;
 				err = 0;
+			}
 			zone_rele(zone);
 		}
 		return (err);
 	}
 
+	ASSERT(caller == GLOBAL_ZONEID);
 	mutex_enter(&zonehash_lock);
 	for (zone = list_head(&zone_active); zone != NULL;
 	    zone = list_next(&zone_active, zone)) {
@@ -7122,6 +7868,7 @@ zone_check_datalink(zoneid_t *zoneidp, datalink_id_t linkid)
 		}
 	}
 	mutex_exit(&zonehash_lock);
+
 	return (err);
 }
 
@@ -7142,6 +7889,12 @@ zone_list_datalink(zoneid_t zoneid, int *nump, datalink_id_t *idarray)
 	zone_dl_t *zdl;
 	datalink_id_t *idptr = idarray;
 
+	/*
+	 * Only the GZ or the owning zone may look at the datalink list.
+	 */
+	if ((getzoneid() != GLOBAL_ZONEID) && (getzoneid() != zoneid))
+		return (set_errno(EPERM));
+
 	if (copyin(nump, &dlcount, sizeof (dlcount)) != 0)
 		return (set_errno(EFAULT));
 	if ((zone = zone_find_by_id(zoneid)) == NULL)
@@ -7167,6 +7920,13 @@ zone_list_datalink(zoneid_t zoneid, int *nump, datalink_id_t *idarray)
 	mutex_exit(&zone->zone_lock);
 	zone_rele(zone);
 
+	/*
+	 * Prevent returning negative nump values -- we should never
+	 * have this many links anyways.
+	 */
+	if (num > INT_MAX)
+		return (set_errno(EOVERFLOW));
+
 	/* Increased or decreased, caller should be notified. */
 	if (num != dlcount) {
 		if (copyout(&num, nump, sizeof (num)) != 0)
@@ -7380,3 +8140,231 @@ done:
 	else
 		return (0);
 }
+
+static void
+zone_incr_capped(zoneid_t zid)
+{
+	zone_persist_t *zp = &zone_pdata[zid];
+
+	/* See if over (unlimited is UINT32_MAX), or already marked that way. */
+	if (zp->zpers_pg_cnt <= zp->zpers_pg_limit || zp->zpers_over == 1) {
+		return;
+	}
+
+	mutex_enter(&zone_physcap_lock);
+	/* Recheck setting under mutex */
+	if (zp->zpers_pg_cnt > zp->zpers_pg_limit && zp->zpers_over == 0) {
+		zp->zpers_over = 1;
+		zp->zpers_nover++;
+		zone_num_over_cap++;
+		DTRACE_PROBE1(zone__over__pcap, zoneid_t, zid);
+	}
+	mutex_exit(&zone_physcap_lock);
+}
+
+/*
+ * We want some hysteresis when the zone is going under its cap so that we're
+ * not continuously toggling page scanning back and forth by a single page
+ * around the cap. Using ~1% of the zone's page limit seems to be a good
+ * quantity. This table shows some various zone memory caps and the number of
+ * pages (assuming a 4k page size). Given this, we choose to shift the page
+ * limit by 7 places to get a hysteresis that is slightly less than 1%.
+ *
+ *   cap    pages     pages     1% shift7  shift7
+ *  128M    32768 0x0008000    327    256 0x00100
+ *  512M   131072 0x0020000   1310   1024 0x00400
+ *    1G   262144 0x0040000   2621   2048 0x00800
+ *    4G  1048576 0x0100000  10485   8192 0x02000
+ *    8G  2097152 0x0200000  20971  16384 0x04000
+ *   16G  4194304 0x0400000  41943  32768 0x08000
+ *   32G  8388608 0x0800000  83886  65536 0x10000
+ *   64G 16777216 0x1000000 167772 131072 0x20000
+ */
+static void
+zone_decr_capped(zoneid_t zid)
+{
+	zone_persist_t *zp = &zone_pdata[zid];
+	uint32_t adjusted_limit;
+
+	/*
+	 * See if under, or already marked that way. There is no need to
+	 * check for an unlimited cap (zpers_pg_limit == UINT32_MAX)
+	 * since we'll never set zpers_over in zone_incr_capped().
+	 */
+	if (zp->zpers_over == 0 || zp->zpers_pg_cnt >= zp->zpers_pg_limit) {
+		return;
+	}
+
+	adjusted_limit = zp->zpers_pg_limit - (zp->zpers_pg_limit >> 7);
+
+	/* Recheck, accounting for our hysteresis. */
+	if (zp->zpers_pg_cnt >= adjusted_limit) {
+		return;
+	}
+
+	mutex_enter(&zone_physcap_lock);
+	/* Recheck under mutex. */
+	if (zp->zpers_pg_cnt < adjusted_limit && zp->zpers_over == 1) {
+		zp->zpers_over = 0;
+		ASSERT(zone_num_over_cap > 0);
+		zone_num_over_cap--;
+		DTRACE_PROBE1(zone__under__pcap, zoneid_t, zid);
+	}
+	mutex_exit(&zone_physcap_lock);
+}
+
+/*
+ * For zone_add_page() and zone_rm_page(), access to the page we're touching is
+ * controlled by our caller's locking.
+ * On x86 our callers already did: ASSERT(x86_hm_held(pp))
+ * On SPARC our callers already did: ASSERT(sfmmu_mlist_held(pp))
+ */
+void
+zone_add_page(page_t *pp)
+{
+	uint_t pcnt;
+	zone_persist_t *zp;
+	zoneid_t zid;
+
+	/* Skip pages in segkmem, etc. (KV_KVP, ...) */
+	if (PP_ISKAS(pp))
+		return;
+
+	ASSERT(!PP_ISFREE(pp));
+
+	zid = curzone->zone_id;
+	if (pp->p_zoneid == zid) {
+		/* Another mapping to this page for this zone, do nothing */
+		return;
+	}
+
+	if (pp->p_szc == 0) {
+		pcnt = 1;
+	} else {
+		/* large page */
+		pcnt = page_get_pagecnt(pp->p_szc);
+	}
+
+	if (pp->p_share == 0) {
+		/* First mapping to this page. */
+		pp->p_zoneid = zid;
+		zp = &zone_pdata[zid];
+		ASSERT(zp->zpers_pg_cnt + pcnt < UINT32_MAX);
+		atomic_add_32((uint32_t *)&zp->zpers_pg_cnt, pcnt);
+		zone_incr_capped(zid);
+		return;
+	}
+
+	if (pp->p_zoneid != ALL_ZONES) {
+		/*
+		 * The page is now being shared across a different zone.
+		 * Decrement the original zone's usage.
+		 */
+		zid = pp->p_zoneid;
+		pp->p_zoneid = ALL_ZONES;
+		ASSERT(zid >= 0 && zid <= MAX_ZONEID);
+		zp = &zone_pdata[zid];
+
+		if (zp->zpers_pg_cnt > 0) {
+			atomic_add_32((uint32_t *)&zp->zpers_pg_cnt, -pcnt);
+		}
+		zone_decr_capped(zid);
+	}
+}
+
+void
+zone_rm_page(page_t *pp)
+{
+	uint_t pcnt;
+	zone_persist_t *zp;
+	zoneid_t zid;
+
+	/* Skip pages in segkmem, etc. (KV_KVP, ...) */
+	if (PP_ISKAS(pp))
+		return;
+
+	zid = pp->p_zoneid;
+	if (zid == ALL_ZONES || pp->p_share != 0)
+		return;
+
+	/* This is the last mapping to the page for a zone. */
+	if (pp->p_szc == 0) {
+		pcnt = 1;
+	} else {
+		/* large page */
+		pcnt = (int64_t)page_get_pagecnt(pp->p_szc);
+	}
+
+	ASSERT(zid >= 0 && zid <= MAX_ZONEID);
+	zp = &zone_pdata[zid];
+	if (zp->zpers_pg_cnt > 0) {
+		atomic_add_32((uint32_t *)&zp->zpers_pg_cnt, -pcnt);
+	}
+	zone_decr_capped(zid);
+	pp->p_zoneid = ALL_ZONES;
+}
+
+void
+zone_pageout_stat(int zid, zone_pageout_op_t op)
+{
+	zone_persist_t *zp;
+
+	if (zid == ALL_ZONES)
+		return;
+
+	ASSERT(zid >= 0 && zid <= MAX_ZONEID);
+	zp = &zone_pdata[zid];
+
+#ifndef DEBUG
+	atomic_add_64(&zp->zpers_pg_out, 1);
+#else
+	switch (op) {
+	case ZPO_DIRTY:
+		atomic_add_64(&zp->zpers_pg_fsdirty, 1);
+		break;
+	case ZPO_FS:
+		atomic_add_64(&zp->zpers_pg_fs, 1);
+		break;
+	case ZPO_ANON:
+		atomic_add_64(&zp->zpers_pg_anon, 1);
+		break;
+	case ZPO_ANONDIRTY:
+		atomic_add_64(&zp->zpers_pg_anondirty, 1);
+		break;
+	default:
+		cmn_err(CE_PANIC, "Invalid pageout operator %d", op);
+		break;
+	}
+#endif
+}
+
+/*
+ * Return the zone's physical memory cap and current free memory (in pages).
+ */
+void
+zone_get_physmem_data(int zid, pgcnt_t *memcap, pgcnt_t *free)
+{
+	zone_persist_t *zp;
+
+	ASSERT(zid >= 0 && zid <= MAX_ZONEID);
+	zp = &zone_pdata[zid];
+
+	/*
+	 * If memory or swap limits are set on the zone, use those, otherwise
+	 * use the system values. physmem and freemem are also in pages.
+	 */
+	if (zp->zpers_pg_limit == UINT32_MAX) {
+		*memcap = physmem;
+		*free = freemem;
+	} else {
+		int64_t freemem;
+
+		*memcap = (pgcnt_t)zp->zpers_pg_limit;
+		freemem = zp->zpers_pg_limit - zp->zpers_pg_cnt;
+		if (freemem > 0) {
+			*free = (pgcnt_t)freemem;
+		} else {
+			*free = (pgcnt_t)0;
+		}
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/mpt_sas/mptsas_hash.c b/usr/src/uts/common/refhash/refhash.c
index 8f96c2d9f1..e2de00597e 100644
--- a/usr/src/uts/common/io/scsi/adapters/mpt_sas/mptsas_hash.c
+++ b/usr/src/uts/common/refhash/refhash.c
@@ -10,16 +10,18 @@
  */
 
 /*
- * Copyright 2014 Joyent, Inc.  All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
-#include <sys/scsi/adapters/mpt_sas/mptsas_hash.h>
+#include <sys/refhash.h>
 #include <sys/sysmacros.h>
 #include <sys/types.h>
 #include <sys/kmem.h>
 #include <sys/list.h>
 #include <sys/ddi.h>
 
+#define	RHL_F_DEAD	0x01
+
 #ifdef lint
 extern refhash_link_t *obj_to_link(refhash_t *, void *);
 extern void *link_to_obj(refhash_t *, refhash_link_t *);
diff --git a/usr/src/uts/common/sys/Makefile b/usr/src/uts/common/sys/Makefile
index 368e5fd180..0fa800d39e 100644
--- a/usr/src/uts/common/sys/Makefile
+++ b/usr/src/uts/common/sys/Makefile
@@ -23,6 +23,7 @@
 # Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2014, Joyent, Inc. All rights reserved.
 # Copyright 2013 Garrett D'Amore <garrett@damore.org>
+# Copyright 2015, Joyent, Inc. All rights reserved.
 # Copyright 2013 Saso Kiselkov. All rights reserved.
 # Copyright 2015 Igor Kozhukhov <ikozhukhov@gmail.com>
 # Copyright 2016 Nexenta Systems, Inc.
@@ -255,6 +256,7 @@ CHKHDRS=			\
 	flock.h			\
 	flock_impl.h		\
 	fork.h			\
+	frameio.h		\
 	fss.h			\
 	fsspriocntl.h		\
 	fsid.h			\
@@ -280,6 +282,7 @@ CHKHDRS=			\
 	idmap.h 		\
 	ieeefp.h		\
 	id_space.h		\
+	inotify.h		\
 	instance.h		\
 	int_const.h		\
 	int_fmtio.h		\
@@ -348,6 +351,7 @@ CHKHDRS=			\
 	lgrp.h			\
 	lgrp_user.h		\
 	libc_kernel.h		\
+	limits.h		\
 	link.h			\
 	list.h			\
 	list_impl.h		\
@@ -432,6 +436,9 @@ CHKHDRS=			\
 	ontrap.h		\
 	open.h			\
 	openpromio.h		\
+	overlay.h		\
+	overlay_common.h	\
+	overlay_target.h	\
 	panic.h			\
 	param.h			\
 	pathconf.h		\
@@ -656,6 +663,8 @@ CHKHDRS=			\
 	vmem.h			\
 	vmem_impl.h		\
 	vmsystm.h		\
+	vnd.h			\
+	vnd_errno.h		\
 	vnic.h			\
 	vnic_impl.h		\
 	vnode.h			\
@@ -667,11 +676,13 @@ CHKHDRS=			\
 	vuid_queue.h		\
 	vuid_state.h		\
 	vuid_store.h		\
+	vxlan.h			\
 	wait.h			\
 	waitq.h			\
 	watchpoint.h		\
 	winlockio.h		\
 	zcons.h			\
+	zfd.h			\
 	zone.h			\
 	xti_inet.h		\
 	xti_osi.h		\
@@ -837,13 +848,14 @@ FSHDRS=				\
 	autofs.h		\
 	decomp.h		\
 	dv_node.h		\
-	sdev_impl.h		\
 	fifonode.h		\
 	hsfs_isospec.h		\
 	hsfs_node.h		\
 	hsfs_rrip.h		\
 	hsfs_spec.h		\
 	hsfs_susp.h		\
+	hyprlofs.h		\
+	hyprlofs_info.h		\
 	lofs_info.h		\
 	lofs_node.h		\
 	mntdata.h		\
@@ -853,6 +865,8 @@ FSHDRS=				\
 	pc_label.h		\
 	pc_node.h		\
 	pxfs_ki.h		\
+	sdev_impl.h		\
+	sdev_plugin.h		\
 	snode.h			\
 	swapnode.h		\
 	tmp.h			\
@@ -977,6 +991,7 @@ SATAGENHDRS=		\
 
 SYSEVENTHDRS=		\
 	ap_driver.h     \
+	datalink.h	\
 	dev.h		\
 	domain.h        \
 	dr.h            \
diff --git a/usr/src/uts/common/sys/acct.h b/usr/src/uts/common/sys/acct.h
index f00884681b..e01ad61025 100644
--- a/usr/src/uts/common/sys/acct.h
+++ b/usr/src/uts/common/sys/acct.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -88,7 +89,7 @@ extern int acct(const char *);
 
 #if defined(_KERNEL)
 
-void	acct(char);
+void	acct(int);
 int	sysacct(char *);
 
 struct vnode;
diff --git a/usr/src/uts/common/sys/aggr_impl.h b/usr/src/uts/common/sys/aggr_impl.h
index 547c9cc241..80733aa31e 100644
--- a/usr/src/uts/common/sys/aggr_impl.h
+++ b/usr/src/uts/common/sys/aggr_impl.h
@@ -21,6 +21,8 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012 OmniTI Computer Consulting, Inc  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef	_SYS_AGGR_IMPL_H
@@ -54,25 +56,47 @@ extern "C" {
  */
 #define	MAC_PSEUDO_RING_INUSE	0x01
 
+#define	MAX_GROUPS_PER_PORT	128
+
+/*
+ * VLAN filters placed on the Rx pseudo group.
+ */
+typedef struct aggr_vlan {
+	list_node_t	av_link;
+	uint16_t	av_vid;		/* VLAN ID */
+	uint_t		av_refs;	/* num aggr clients using this VID */
+} aggr_vlan_t;
+
 typedef struct aggr_unicst_addr_s {
 	uint8_t				aua_addr[ETHERADDRL];
 	struct aggr_unicst_addr_s	*aua_next;
 } aggr_unicst_addr_t;
 
 typedef struct aggr_pseudo_rx_ring_s {
-	mac_ring_handle_t	arr_rh;	/* filled in by aggr_fill_ring() */
-	struct aggr_port_s	*arr_port;
-	mac_ring_handle_t	arr_hw_rh;
-	uint_t			arr_flags;
-	uint64_t		arr_gen;
+	mac_ring_handle_t		arr_rh;	/* set by aggr_fill_ring() */
+	struct aggr_port_s		*arr_port;
+	struct aggr_pseudo_rx_group_s	*arr_grp;
+	mac_ring_handle_t		arr_hw_rh;
+	uint_t				arr_flags;
+	uint64_t			arr_gen;
 } aggr_pseudo_rx_ring_t;
 
+/*
+ * An aggr pseudo group abstracts the underlying ports' HW groups. For
+ * example, if each port has 8 groups (mac_group_t), then the aggr
+ * will create 8 pseudo groups. Each pseudo group represents a
+ * collection of HW groups: one group from each port. If you have
+ * three ports then the pseudo group stands in for three HW groups.
+ */
 typedef struct aggr_pseudo_rx_group_s {
+	uint_t			arg_index;
 	struct aggr_grp_s	*arg_grp; /* filled in by aggr_fill_group() */
 	mac_group_handle_t	arg_gh;   /* filled in by aggr_fill_group() */
 	aggr_unicst_addr_t	*arg_macaddr;
 	aggr_pseudo_rx_ring_t	arg_rings[MAX_RINGS_PER_GROUP];
 	uint_t			arg_ring_cnt;
+	uint_t			arg_untagged; /* num clients untagged */
+	list_t			arg_vlans;    /* VLANs on this group */
 } aggr_pseudo_rx_group_t;
 
 typedef struct aggr_pseudo_tx_ring_s {
@@ -106,12 +130,13 @@ typedef struct aggr_port_s {
 			lp_collector_enabled : 1,
 			lp_promisc_on : 1,
 			lp_no_link_update : 1,
-			lp_rx_grp_added : 1,
 			lp_tx_grp_added : 1,
 			lp_closing : 1,
-			lp_pad_bits : 24;
+			lp_pad_bits : 25;
 	mac_handle_t	lp_mh;
-	mac_client_handle_t lp_mch;
+
+	mac_client_handle_t	lp_mch;
+
 	const mac_info_t *lp_mip;
 	mac_notify_handle_t lp_mnh;
 	uint_t		lp_tx_idx;		/* idx in group's tx array */
@@ -123,13 +148,19 @@ typedef struct aggr_port_s {
 	aggr_lacp_port_t lp_lacp;		/* LACP state */
 	lacp_stats_t	lp_lacp_stats;
 	uint32_t	lp_margin;
-	mac_promisc_handle_t lp_mphp;
+
 	mac_unicast_handle_t lp_mah;
 
 	/* List of non-primary addresses that requires promiscous mode set */
 	aggr_unicst_addr_t	*lp_prom_addr;
-	/* handle of the underlying HW RX group */
-	mac_group_handle_t	lp_hwgh;
+
+	/*
+	 * References to the underlying HW Rx groups of this port.
+	 * Used by aggr to program HW classification for the pseudo
+	 * groups.
+	 */
+	mac_group_handle_t	lp_hwghs[MAX_GROUPS_PER_PORT];
+
 	int			lp_tx_ring_cnt;
 	/* handles of the underlying HW TX rings */
 	mac_ring_handle_t	*lp_tx_rings;
@@ -176,7 +207,7 @@ typedef struct aggr_grp_s {
 			lg_lso : 1,
 			lg_pad_bits : 8;
 	aggr_port_t	*lg_ports;		/* list of configured ports */
-	aggr_port_t	*lg_mac_addr_port;
+	aggr_port_t	*lg_mac_addr_port;	/* using address of this port */
 	mac_handle_t	lg_mh;
 	zoneid_t	lg_zoneid;
 	uint_t		lg_nattached_ports;
@@ -186,11 +217,18 @@ typedef struct aggr_grp_s {
 	uint_t		lg_tx_ports_size;	/* size of lg_tx_ports */
 	uint32_t	lg_tx_policy;		/* outbound policy */
 	uint8_t		lg_mac_tx_policy;
-	uint64_t	lg_ifspeed;
 	link_state_t	lg_link_state;
+
+
+	/*
+	 * The lg_stat_lock must be held when accessing these fields.
+	 */
+	kmutex_t	lg_stat_lock;
+	uint64_t	lg_ifspeed;
 	link_duplex_t	lg_link_duplex;
 	uint64_t	lg_stat[MAC_NSTAT];
 	uint64_t	lg_ether_stat[ETHER_NSTAT];
+
 	aggr_lacp_mode_t lg_lacp_mode;		/* off, active, or passive */
 	Agg_t		aggr;			/* 802.3ad data */
 	uint32_t	lg_hcksum_txflags;
@@ -213,7 +251,9 @@ typedef struct aggr_grp_s {
 	kthread_t	*lg_lacp_rx_thread;
 	boolean_t	lg_lacp_done;
 
-	aggr_pseudo_rx_group_t	lg_rx_group;
+	uint_t			lg_rx_group_count;
+	aggr_pseudo_rx_group_t	lg_rx_groups[MAX_GROUPS_PER_PORT];
+
 	aggr_pseudo_tx_group_t	lg_tx_group;
 
 	kmutex_t	lg_tx_flowctl_lock;
@@ -335,8 +375,11 @@ extern void aggr_grp_port_hold(aggr_port_t *);
 extern void aggr_grp_port_rele(aggr_port_t *);
 extern void aggr_grp_port_wait(aggr_grp_t *);
 
-extern int aggr_port_addmac(aggr_port_t *, const uint8_t *);
-extern void aggr_port_remmac(aggr_port_t *, const uint8_t *);
+extern int aggr_port_addmac(aggr_port_t *, uint_t, const uint8_t *);
+extern void aggr_port_remmac(aggr_port_t *, uint_t, const uint8_t *);
+
+extern int aggr_port_addvlan(aggr_port_t *, uint_t, uint16_t);
+extern int aggr_port_remvlan(aggr_port_t *, uint_t, uint16_t);
 
 extern mblk_t *aggr_ring_tx(void *, mblk_t *);
 extern mblk_t *aggr_find_tx_ring(void *, mblk_t *,
diff --git a/usr/src/uts/common/sys/auxv.h b/usr/src/uts/common/sys/auxv.h
index 1fb5011970..b3b2898987 100644
--- a/usr/src/uts/common/sys/auxv.h
+++ b/usr/src/uts/common/sys/auxv.h
@@ -78,6 +78,9 @@ typedef struct {
 #define	AT_FLAGS	8	/* processor flags */
 #define	AT_ENTRY	9	/* a.out entry point */
 
+/* First introduced on Linux */
+#define	AT_RANDOM	25	/* address of 16 random bytes */
+
 /*
  * These relate to the original PPC ABI document; Linux reused
  * the values for other things (see below), so disambiguation of
@@ -90,19 +93,18 @@ typedef struct {
  * These are the values from LSB 1.3, the first five are also described
  * in the draft amd64 ABI.
  *
- * At the time of writing, Solaris doesn't place any of these values into
- * the aux vector, except AT_CLKTCK which is placed on the aux vector for
- * lx branded processes; also, we do similar things via AT_SUN_ values.
+ * At the time of writing, illumos doesn't place any of these values into the
+ * aux vector, except where noted. We do similar things via AT_SUN_ values.
  *
  * AT_NOTELF		10	program is not ELF?
- * AT_UID		11	real user id
- * AT_EUID		12	effective user id
- * AT_GID		13	real group id
- * AT_EGID		14	effective group id
+ * AT_UID		11	real user id (provided in LX)
+ * AT_EUID		12	effective user id (provided in LX)
+ * AT_GID		13	real group id (provided in LX)
+ * AT_EGID		14	effective group id (provided in LX)
  *
  * AT_PLATFORM		15
  * AT_HWCAP		16
- * AT_CLKTCK		17	c.f. _SC_CLK_TCK
+ * AT_CLKTCK		17	c.f. _SC_CLK_TCK (provided in LX)
  * AT_FPUCW		18
  *
  * AT_DCACHEBSIZE	19	(moved from 10)
@@ -110,6 +112,16 @@ typedef struct {
  * AT_UCACHEBSIZE	21	(moved from 12)
  *
  * AT_IGNOREPPC		22
+ *
+ * On Linux:
+ * AT_* values 18 through 22 are reserved
+ * AT_SECURE		23	secure mode boolean (provided in LX)
+ * AT_BASE_PLATFORM	24	string identifying real platform, may
+ *				differ from AT_PLATFORM.
+ * AT_HWCAP2		26	extension of AT_HWCAP
+ * AT_EXECFN		31	filename of program
+ * AT_SYSINFO		32
+ * AT_SYSINFO_EHDR	33	The vDSO location
  */
 
 /*
@@ -186,6 +198,8 @@ extern uint_t getisax(uint32_t *, uint_t);
 #define	AT_SUN_BRAND_AUX1	2020
 #define	AT_SUN_BRAND_AUX2	2021
 #define	AT_SUN_BRAND_AUX3	2022
+#define	AT_SUN_BRAND_AUX4	2025
+#define	AT_SUN_BRAND_NROOT	2024
 
 /*
  * Aux vector for comm page
diff --git a/usr/src/uts/common/sys/brand.h b/usr/src/uts/common/sys/brand.h
index badc3faff8..e33de24757 100644
--- a/usr/src/uts/common/sys/brand.h
+++ b/usr/src/uts/common/sys/brand.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 #ifndef _SYS_BRAND_H
@@ -102,29 +103,107 @@ struct brand_mach_ops;
 struct intpdata;
 struct execa;
 
+/*
+ * Common structure to define hooks for brand operation.
+ *
+ * Required Fields:
+ * b_init_brand_data - Setup zone brand data during zone_setbrand
+ * b_free_brand_data - Free zone brand data during zone_destroy
+ * b_brandsys - Syscall handler for brandsys
+ * b_setbrand - Initialize process brand data
+ * b_getattr - Get brand-custom zone attribute
+ * b_setattr - Set brand-custom zone attribute
+ * b_copy_procdata - Copy process brand data during fork
+ * b_proc_exit - Perform process brand exit processing
+ * b_exec - Reset branded process state on exec
+ * b_lwp_setrval - Set return code for forked child
+ * b_initlwp - Initialize lwp brand data (cannot drop p->p_lock)
+ * b_forklwp - Copy lwp brand data during fork
+ * b_freelwp - Free lwp brand data
+ * b_lwpexit - Perform lwp-specific brand exit processing
+ * b_elfexec - Load and execute ELF binary
+ * b_sigset_native_to_brand - Convert sigset native->brand
+ * b_sigset_brand_to_native - Convert sigset brand->native
+ * b_nsig - Maxiumum signal number
+ * b_sendsig - Update process state after sendsig
+ *
+ * Optional Fields:
+ * b_lwpdata_alloc - Speculatively allocate data for use in b_initlwp
+ * b_lwpdata_free - Free data from allocated by b_lwpdata_alloc if errors occur
+ *                  during lwp creation before b_initlwp could be called.
+ * b_initlwp_post - Complete lwp branding (can temporarily drop p->p_lock)
+ * b_exit_with_sig - Instead of sending SIGCLD, exit with custom behavior
+ * b_psig_to_proc - Custom additional behavior during psig
+ * b_wait_filter - Filter processes from being matched by waitid
+ * b_native_exec - Provide interpreter path prefix for executables
+ * b_ptrace_exectrap - Custom behavior for legacy ptrace traps
+ * b_map32limit - Specify alternate limit for MAP_32BIT mappings
+ * b_stop_notify - Hook process stop events
+ * b_waitid_helper - Generate synthetic results for waitid
+ * b_sigcld_repost - Post synthetic SIGCLD signals
+ * b_issig_stop - Alter/suppress signal delivery during issig
+ * b_sig_ignorable - Disallow discarding of signals
+ * b_savecontext - Alter context during savecontext
+ * b_restorecontext - Alter context during restorecontext
+ * b_sendsig_stack - Override stack used for signal delivery
+ * b_setid_clear - Override setid_clear behavior
+ * b_pagefault - Trap pagefault events
+ * b_intp_parse_arg - Controls interpreter argument handling (allow 1 or all)
+ * b_clearbrand - Perform any actions necessary when clearing the brand.
+ * b_rpc_statd - Upcall to rpc.statd running within the zone
+ * b_acct_out - Output properly formatted accounting record
+ */
 struct brand_ops {
-	void	(*b_init_brand_data)(zone_t *);
+	void	(*b_init_brand_data)(zone_t *, kmutex_t *);
 	void	(*b_free_brand_data)(zone_t *);
 	int	(*b_brandsys)(int, int64_t *, uintptr_t, uintptr_t, uintptr_t,
-		uintptr_t, uintptr_t, uintptr_t);
+		uintptr_t);
 	void	(*b_setbrand)(struct proc *);
 	int	(*b_getattr)(zone_t *, int, void *, size_t *);
 	int	(*b_setattr)(zone_t *, int, void *, size_t);
 	void	(*b_copy_procdata)(struct proc *, struct proc *);
-	void	(*b_proc_exit)(struct proc *, klwp_t *);
+	void	(*b_proc_exit)(struct proc *);
 	void	(*b_exec)();
 	void	(*b_lwp_setrval)(klwp_t *, int, int);
-	int	(*b_initlwp)(klwp_t *);
+	void	*(*b_lwpdata_alloc)(struct proc *);
+	void	(*b_lwpdata_free)(void *);
+	void	(*b_initlwp)(klwp_t *, void *);
+	void	(*b_initlwp_post)(klwp_t *);
 	void	(*b_forklwp)(klwp_t *, klwp_t *);
 	void	(*b_freelwp)(klwp_t *);
 	void	(*b_lwpexit)(klwp_t *);
 	int	(*b_elfexec)(struct vnode *vp, struct execa *uap,
 	    struct uarg *args, struct intpdata *idata, int level,
 	    long *execsz, int setid, caddr_t exec_file,
-	    struct cred *cred, int brand_action);
+	    struct cred *cred, int *brand_action);
 	void	(*b_sigset_native_to_brand)(sigset_t *);
 	void	(*b_sigset_brand_to_native)(sigset_t *);
+	void	(*b_sigfd_translate)(k_siginfo_t *);
 	int	b_nsig;
+	void	(*b_exit_with_sig)(proc_t *, sigqueue_t *);
+	boolean_t (*b_wait_filter)(proc_t *, proc_t *);
+	boolean_t (*b_native_exec)(uint8_t, const char **);
+	uint32_t (*b_map32limit)(proc_t *);
+	void	(*b_stop_notify)(proc_t *, klwp_t *, ushort_t, ushort_t);
+	int	(*b_waitid_helper)(idtype_t, id_t, k_siginfo_t *, int,
+	    boolean_t *, int *);
+	int	(*b_sigcld_repost)(proc_t *, sigqueue_t *);
+	int	(*b_issig_stop)(proc_t *, klwp_t *);
+	boolean_t (*b_sig_ignorable)(proc_t *, klwp_t *, int);
+	void	(*b_savecontext)(ucontext_t *);
+#if defined(_SYSCALL32_IMPL)
+	void	(*b_savecontext32)(ucontext32_t *);
+#endif
+	void	(*b_restorecontext)(ucontext_t *);
+	caddr_t	(*b_sendsig_stack)(int);
+	void	(*b_sendsig)(int);
+	int	(*b_setid_clear)(vattr_t *vap, cred_t *cr);
+	int	(*b_pagefault)(proc_t *, klwp_t *, caddr_t, enum fault_type,
+	    enum seg_rw);
+	boolean_t b_intp_parse_arg;
+	void	(*b_clearbrand)(proc_t *, boolean_t);
+	void	(*b_rpc_statd)(int, void *, void *);
+	void	(*b_acct_out)(struct vnode *, int);
 };
 
 /*
@@ -135,6 +214,7 @@ typedef struct brand {
 	char    		*b_name;
 	struct brand_ops	*b_ops;
 	struct brand_mach_ops	*b_machops;
+	size_t			b_data_size;
 } brand_t;
 
 extern brand_t native_brand;
@@ -165,7 +245,7 @@ extern brand_t	*brand_register_zone(struct brand_attr *);
 extern brand_t	*brand_find_name(char *);
 extern void	brand_unregister_zone(brand_t *);
 extern int	brand_zone_count(brand_t *);
-extern void	brand_setbrand(proc_t *);
+extern int	brand_setbrand(proc_t *, boolean_t);
 extern void	brand_clearbrand(proc_t *, boolean_t);
 
 /*
@@ -178,17 +258,16 @@ extern int	brand_solaris_cmd(int, uintptr_t, uintptr_t, uintptr_t,
 extern void	brand_solaris_copy_procdata(proc_t *, proc_t *,
 		    struct brand *);
 extern int	brand_solaris_elfexec(vnode_t *, execa_t *, uarg_t *,
-		    intpdata_t *, int, long *, int, caddr_t, cred_t *, int,
-		    struct brand *, char *, char *, char *, char *, char *);
+		    intpdata_t *, int, long *, int, caddr_t, cred_t *, int *,
+		    struct brand *, char *, char *, char *);
 extern void	brand_solaris_exec(struct brand *);
 extern int	brand_solaris_fini(char **, struct modlinkage *,
 		    struct brand *);
 extern void	brand_solaris_forklwp(klwp_t *, klwp_t *, struct brand *);
 extern void	brand_solaris_freelwp(klwp_t *, struct brand *);
-extern int	brand_solaris_initlwp(klwp_t *, struct brand *);
+extern void	brand_solaris_initlwp(klwp_t *, struct brand *);
 extern void	brand_solaris_lwpexit(klwp_t *, struct brand *);
-extern void	brand_solaris_proc_exit(struct proc *, klwp_t *,
-		    struct brand *);
+extern void	brand_solaris_proc_exit(struct proc *, struct brand *);
 extern void	brand_solaris_setbrand(proc_t *, struct brand *);
 
 #if defined(_SYSCALL32)
diff --git a/usr/src/uts/common/sys/buf.h b/usr/src/uts/common/sys/buf.h
index e20e0e0c35..b6b5c20e44 100644
--- a/usr/src/uts/common/sys/buf.h
+++ b/usr/src/uts/common/sys/buf.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012 Joyent, Inc.  All rights reserved.
  *
  * Copyright 2017 RackTop Systems.
  */
@@ -188,6 +189,7 @@ struct biostats {
 #define	B_STARTED	0x2000000	/* io:::start probe called for buf */
 #define	B_ABRWRITE	0x4000000	/* Application based recovery active */
 #define	B_PAGE_NOWAIT	0x8000000	/* Skip the page if it is locked */
+#define	B_INVALCURONLY	0x10000000	/* invalidate only for curproc */
 
 /*
  * There is some confusion over the meaning of B_FREE and B_INVAL and what
@@ -200,6 +202,12 @@ struct biostats {
  * between the sole use of these two flags.  In both cases, IO will be done
  * if the page is not yet committed to storage.
  *
+ * The B_INVALCURONLY flag modifies the behavior of the B_INVAL flag and is
+ * intended to be used in conjunction with B_INVAL.  B_INVALCURONLY has no
+ * meaning on its own.  When both B_INVALCURONLY and B_INVAL are set, then
+ * the mapping for the page is only invalidated for the current process.
+ * In this case, the page is not destroyed unless this was the final mapping.
+ *
  * In order to discard pages without writing them back, (B_INVAL | B_TRUNC)
  * should be used.
  *
diff --git a/usr/src/uts/common/sys/contract/process.h b/usr/src/uts/common/sys/contract/process.h
index 21cf94dcf9..2c70d7c9f1 100644
--- a/usr/src/uts/common/sys/contract/process.h
+++ b/usr/src/uts/common/sys/contract/process.h
@@ -21,13 +21,12 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_CONTRACT_PROCESS_H
 #define	_SYS_CONTRACT_PROCESS_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/contract.h>
 #include <sys/time.h>
 
@@ -55,7 +54,8 @@ typedef struct cont_process cont_process_t;
 #define	CT_PR_NOORPHAN	0x2	/* kill when contract is abandoned */
 #define	CT_PR_PGRPONLY	0x4	/* only kill process group on fatal errors */
 #define	CT_PR_REGENT	0x8	/* automatically detach inherited contracts */
-#define	CT_PR_ALLPARAM	0xf
+#define	CT_PR_KEEP_EXEC	0x10	/* preserve template accross exec */
+#define	CT_PR_ALLPARAM	0x1f
 
 /*
  * ctr_ev_* flags
diff --git a/usr/src/uts/common/sys/cpucaps.h b/usr/src/uts/common/sys/cpucaps.h
index 6063ff4380..6bc042108c 100644
--- a/usr/src/uts/common/sys/cpucaps.h
+++ b/usr/src/uts/common/sys/cpucaps.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011, 2012, Joyent, Inc.  All rights reserved.
  */
 
 #ifndef	_SYS_CPUCAPS_H
@@ -84,12 +85,16 @@ extern void cpucaps_zone_remove(zone_t *);
  */
 extern int cpucaps_project_set(kproject_t *, rctl_qty_t);
 extern int cpucaps_zone_set(zone_t *, rctl_qty_t);
+extern int cpucaps_zone_set_base(zone_t *, rctl_qty_t);
+extern int cpucaps_zone_set_burst_time(zone_t *, rctl_qty_t);
 
 /*
  * Get current CPU usage for a project/zone.
  */
 extern rctl_qty_t cpucaps_project_get(kproject_t *);
 extern rctl_qty_t cpucaps_zone_get(zone_t *);
+extern rctl_qty_t cpucaps_zone_get_base(zone_t *);
+extern rctl_qty_t cpucaps_zone_get_burst_time(zone_t *);
 
 /*
  * Scheduling class hooks into CPU caps framework.
diff --git a/usr/src/uts/common/sys/cpucaps_impl.h b/usr/src/uts/common/sys/cpucaps_impl.h
index 95afd21827..2cd4ed644d 100644
--- a/usr/src/uts/common/sys/cpucaps_impl.h
+++ b/usr/src/uts/common/sys/cpucaps_impl.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011, 2012, Joyent, Inc.  All rights reserved.
  */
 
 #ifndef	_SYS_CPUCAPS_IMPL_H
@@ -66,8 +67,12 @@ typedef struct cpucap {
 	waitq_t		cap_waitq;	/* waitq for capped threads	*/
 	kstat_t		*cap_kstat;	/* cpucaps specific kstat	*/
 	int64_t		cap_gen;	/* zone cap specific 		*/
+	hrtime_t	cap_chk_value;	/* effective CPU usage cap	*/
 	hrtime_t	cap_value;	/* scaled CPU usage cap		*/
 	hrtime_t	cap_usage;	/* current CPU usage		*/
+	hrtime_t	cap_base;	/* base CPU for burst		*/
+	u_longlong_t	cap_burst_limit; /* max secs (in tics) for a burst */
+	u_longlong_t	cap_bursting;	/* # of ticks currently bursting */
 	disp_lock_t	cap_usagelock;	/* protects cap_usage above	*/
 	/*
 	 * Per cap statistics.
@@ -75,6 +80,7 @@ typedef struct cpucap {
 	hrtime_t	cap_maxusage;	/* maximum cap usage		*/
 	u_longlong_t	cap_below;	/* # of ticks spend below the cap */
 	u_longlong_t	cap_above;	/* # of ticks spend above the cap */
+	u_longlong_t	cap_above_base;	/* # of ticks spent above the base */
 } cpucap_t;
 
 /*
diff --git a/usr/src/uts/common/sys/cpuvar.h b/usr/src/uts/common/sys/cpuvar.h
index 8565ca053e..2cfe5116d9 100644
--- a/usr/src/uts/common/sys/cpuvar.h
+++ b/usr/src/uts/common/sys/cpuvar.h
@@ -23,6 +23,7 @@
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
  * Copyright 2014 Igor Kozhukhov <ikozhukhov@gmail.com>.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2017 RackTop Systems.
  */
 
@@ -389,7 +390,6 @@ extern cpu_core_t cpu_core[];
 #define	CPU_DISP_HALTED		0x02	/* CPU halted waiting for interrupt */
 
 /* Note: inside ifdef: _KERNEL || _KMEMUSER || _BOOT */
-#if defined(_MACHDEP)
 
 /*
  * Macros for manipulating sets of CPUs as a bitmap.  Note that this
@@ -405,34 +405,60 @@ extern cpu_core_t cpu_core[];
 #define	CPUSET_WORDS	BT_BITOUL(NCPU)
 #define	CPUSET_NOTINSET	((uint_t)-1)
 
-#if	CPUSET_WORDS > 1
-
-typedef struct cpuset {
+#if defined(_MACHDEP)
+struct cpuset {
 	ulong_t	cpub[CPUSET_WORDS];
-} cpuset_t;
+};
+#else
+struct cpuset;
+#endif
+
+typedef struct cpuset cpuset_t;
+
+extern cpuset_t	*cpuset_alloc(int);
+extern void	cpuset_free(cpuset_t *);
 
 /*
- * Private functions for manipulating cpusets that do not fit in a
- * single word.  These should not be used directly; instead the
- * CPUSET_* macros should be used so the code will be portable
- * across different definitions of NCPU.
+ * Functions for manipulating cpusets.  These were previously considered
+ * private when some cpuset_t handling was performed in the CPUSET_* macros.
+ * They are now acceptable to use in non-_MACHDEP code.
  */
 extern	void	cpuset_all(cpuset_t *);
-extern	void	cpuset_all_but(cpuset_t *, uint_t);
+extern	void	cpuset_all_but(cpuset_t *, const uint_t);
 extern	int	cpuset_isnull(cpuset_t *);
-extern	int	cpuset_cmp(cpuset_t *, cpuset_t *);
-extern	void	cpuset_only(cpuset_t *, uint_t);
+extern	int	cpuset_isequal(cpuset_t *, cpuset_t *);
+extern	void	cpuset_only(cpuset_t *, const uint_t);
+extern	long	cpu_in_set(cpuset_t *, const uint_t);
+extern	void	cpuset_add(cpuset_t *, const uint_t);
+extern	void	cpuset_del(cpuset_t *, const uint_t);
 extern	uint_t	cpuset_find(cpuset_t *);
 extern	void	cpuset_bounds(cpuset_t *, uint_t *, uint_t *);
+extern	void	cpuset_atomic_del(cpuset_t *, const uint_t);
+extern	void	cpuset_atomic_add(cpuset_t *, const uint_t);
+extern	long	cpuset_atomic_xadd(cpuset_t *, const uint_t);
+extern	long	cpuset_atomic_xdel(cpuset_t *, const uint_t);
+extern	void	cpuset_or(cpuset_t *, cpuset_t *);
+extern	void	cpuset_xor(cpuset_t *, cpuset_t *);
+extern	void	cpuset_and(cpuset_t *, cpuset_t *);
+extern	void	cpuset_zero(cpuset_t *);
+
+
+#if defined(_MACHDEP)
+
+/*
+ * Prior to the cpuset_t restructuring, the CPUSET_* macros contained
+ * significant logic, rather than directly invoking the backend functions.
+ * They are maintained here so that existing _MACHDEP code can use them.
+ */
 
 #define	CPUSET_ALL(set)			cpuset_all(&(set))
 #define	CPUSET_ALL_BUT(set, cpu)	cpuset_all_but(&(set), cpu)
 #define	CPUSET_ONLY(set, cpu)		cpuset_only(&(set), cpu)
-#define	CPU_IN_SET(set, cpu)		BT_TEST((set).cpub, cpu)
-#define	CPUSET_ADD(set, cpu)		BT_SET((set).cpub, cpu)
-#define	CPUSET_DEL(set, cpu)		BT_CLEAR((set).cpub, cpu)
+#define	CPU_IN_SET(set, cpu)		cpu_in_set(&(set), cpu)
+#define	CPUSET_ADD(set, cpu)		cpuset_add(&(set), cpu)
+#define	CPUSET_DEL(set, cpu)		cpuset_del(&(set), cpu)
 #define	CPUSET_ISNULL(set)		cpuset_isnull(&(set))
-#define	CPUSET_ISEQUAL(set1, set2)	cpuset_cmp(&(set1), &(set2))
+#define	CPUSET_ISEQUAL(set1, set2)	cpuset_isequal(&(set1), &(set2))
 
 /*
  * Find one CPU in the cpuset.
@@ -460,86 +486,24 @@ extern	void	cpuset_bounds(cpuset_t *, uint_t *, uint_t *);
  * deleting a cpu that's not in the cpuset)
  */
 
-#define	CPUSET_ATOMIC_DEL(set, cpu)	BT_ATOMIC_CLEAR((set).cpub, (cpu))
-#define	CPUSET_ATOMIC_ADD(set, cpu)	BT_ATOMIC_SET((set).cpub, (cpu))
-
-#define	CPUSET_ATOMIC_XADD(set, cpu, result) \
-	BT_ATOMIC_SET_EXCL((set).cpub, cpu, result)
-
-#define	CPUSET_ATOMIC_XDEL(set, cpu, result) \
-	BT_ATOMIC_CLEAR_EXCL((set).cpub, cpu, result)
-
-
-#define	CPUSET_OR(set1, set2)		{		\
-	int _i;						\
-	for (_i = 0; _i < CPUSET_WORDS; _i++)		\
-		(set1).cpub[_i] |= (set2).cpub[_i];	\
-}
-
-#define	CPUSET_XOR(set1, set2)		{		\
-	int _i;						\
-	for (_i = 0; _i < CPUSET_WORDS; _i++)		\
-		(set1).cpub[_i] ^= (set2).cpub[_i];	\
-}
-
-#define	CPUSET_AND(set1, set2)		{		\
-	int _i;						\
-	for (_i = 0; _i < CPUSET_WORDS; _i++)		\
-		(set1).cpub[_i] &= (set2).cpub[_i];	\
-}
-
-#define	CPUSET_ZERO(set)		{		\
-	int _i;						\
-	for (_i = 0; _i < CPUSET_WORDS; _i++)		\
-		(set).cpub[_i] = 0;			\
-}
-
-#elif	CPUSET_WORDS == 1
-
-typedef	ulong_t	cpuset_t;	/* a set of CPUs */
-
-#define	CPUSET(cpu)			(1UL << (cpu))
-
-#define	CPUSET_ALL(set)			((void)((set) = ~0UL))
-#define	CPUSET_ALL_BUT(set, cpu)	((void)((set) = ~CPUSET(cpu)))
-#define	CPUSET_ONLY(set, cpu)		((void)((set) = CPUSET(cpu)))
-#define	CPU_IN_SET(set, cpu)		((set) & CPUSET(cpu))
-#define	CPUSET_ADD(set, cpu)		((void)((set) |= CPUSET(cpu)))
-#define	CPUSET_DEL(set, cpu)		((void)((set) &= ~CPUSET(cpu)))
-#define	CPUSET_ISNULL(set)		((set) == 0)
-#define	CPUSET_ISEQUAL(set1, set2)	((set1) == (set2))
-#define	CPUSET_OR(set1, set2)		((void)((set1) |= (set2)))
-#define	CPUSET_XOR(set1, set2)		((void)((set1) ^= (set2)))
-#define	CPUSET_AND(set1, set2)		((void)((set1) &= (set2)))
-#define	CPUSET_ZERO(set)		((void)((set) = 0))
-
-#define	CPUSET_FIND(set, cpu)		{		\
-	cpu = (uint_t)(lowbit(set) - 1);				\
-}
-
-#define	CPUSET_BOUNDS(set, smallest, largest)	{	\
-	smallest = (uint_t)(lowbit(set) - 1);		\
-	largest = (uint_t)(highbit(set) - 1);		\
-}
+#define	CPUSET_ATOMIC_DEL(set, cpu)	cpuset_atomic_del(&(set), cpu)
+#define	CPUSET_ATOMIC_ADD(set, cpu)	cpuset_atomic_add(&(set), cpu)
 
-#define	CPUSET_ATOMIC_DEL(set, cpu)	atomic_and_ulong(&(set), ~CPUSET(cpu))
-#define	CPUSET_ATOMIC_ADD(set, cpu)	atomic_or_ulong(&(set), CPUSET(cpu))
+#define	CPUSET_ATOMIC_XADD(set, cpu, result)	\
+	(result) = cpuset_atomic_xadd(&(set), cpu)
 
-#define	CPUSET_ATOMIC_XADD(set, cpu, result) \
-	{ result = atomic_set_long_excl(&(set), (cpu)); }
+#define	CPUSET_ATOMIC_XDEL(set, cpu, result)	\
+	(result) = cpuset_atomic_xdel(&(set), cpu)
 
-#define	CPUSET_ATOMIC_XDEL(set, cpu, result) \
-	{ result = atomic_clear_long_excl(&(set), (cpu)); }
+#define	CPUSET_OR(set1, set2)	cpuset_or(&(set1), &(set2))
 
-#else	/* CPUSET_WORDS <= 0 */
+#define	CPUSET_XOR(set1, set2)	cpuset_xor(&(set1), &(set2))
 
-#error NCPU is undefined or invalid
+#define	CPUSET_AND(set1, set2)	cpuset_and(&(set1), &(set2))
 
-#endif	/* CPUSET_WORDS	*/
-
-extern cpuset_t cpu_seqid_inuse;
+#define	CPUSET_ZERO(set)	cpuset_zero(&(set))
 
-#endif	/* _MACHDEP */
+#endif /* _MACHDEP */
 #endif /* _KERNEL || _KMEMUSER || _BOOT */
 
 #define	CPU_CPR_OFFLINE		0x0
@@ -550,10 +514,14 @@ extern cpuset_t cpu_seqid_inuse;
 
 #if defined(_KERNEL) || defined(_KMEMUSER)
 
+extern cpuset_t cpu_seqid_inuse;
+
 extern struct cpu	*cpu[];		/* indexed by CPU number */
 extern struct cpu	**cpu_seq;	/* indexed by sequential CPU id */
 extern cpu_t		*cpu_list;	/* list of CPUs */
 extern cpu_t		*cpu_active;	/* list of active CPUs */
+extern cpuset_t		cpu_active_set;	/* cached set of active CPUs */
+extern cpuset_t		cpu_available;	/* cached set of available CPUs */
 extern int		ncpus;		/* number of CPUs present */
 extern int		ncpus_online;	/* number of CPUs not quiesced */
 extern int		max_ncpus;	/* max present before ncpus is known */
@@ -572,13 +540,19 @@ extern struct cpu *curcpup(void);
 #endif
 
 /*
- * CPU_CURRENT indicates to thread_affinity_set to use CPU->cpu_id
- * as the target and to grab cpu_lock instead of requiring the caller
- * to grab it.
+ * CPU_CURRENT indicates to thread_affinity_set() to use whatever curthread's
+ * current CPU is; holding cpu_lock is not required.
  */
 #define	CPU_CURRENT	-3
 
 /*
+ * CPU_BEST can be used by thread_affinity_set() callers to set affinity to a
+ * good CPU (in particular, an ht_acquire()-friendly choice); holding cpu_lock
+ * is not required.
+ */
+#define	CPU_BEST	-4
+
+/*
  * Per-CPU statistics
  *
  * cpu_stats_t contains numerous system and VM-related statistics, in the form
@@ -613,7 +587,7 @@ extern struct cpu *curcpup(void);
  */
 #define	CPU_NEW_GENERATION(cp)	((cp)->cpu_generation++)
 
-#endif /* _KERNEL || _KMEMUSER */
+#endif /* defined(_KERNEL) || defined(_KMEMUSER) */
 
 /*
  * CPU support routines (not for genassym.c)
diff --git a/usr/src/uts/common/sys/cred.h b/usr/src/uts/common/sys/cred.h
index fb79dfecde..1f938132e0 100644
--- a/usr/src/uts/common/sys/cred.h
+++ b/usr/src/uts/common/sys/cred.h
@@ -93,6 +93,7 @@ extern gid_t crgetgid(const cred_t *);
 extern gid_t crgetrgid(const cred_t *);
 extern gid_t crgetsgid(const cred_t *);
 extern zoneid_t crgetzoneid(const cred_t *);
+extern zoneid_t crgetzonedid(const cred_t *);
 extern projid_t crgetprojid(const cred_t *);
 
 extern cred_t *crgetmapped(const cred_t *);
diff --git a/usr/src/uts/common/sys/ctf_api.h b/usr/src/uts/common/sys/ctf_api.h
index 04d73c3181..bc99f67d3f 100644
--- a/usr/src/uts/common/sys/ctf_api.h
+++ b/usr/src/uts/common/sys/ctf_api.h
@@ -24,7 +24,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2015, Joyent, Inc.
  */
 
 /*
@@ -60,6 +60,65 @@ extern "C" {
 typedef struct ctf_file ctf_file_t;
 typedef long ctf_id_t;
 
+#define	ECTF_BASE	1000	/* base value for libctf errnos */
+
+enum {
+	ECTF_FMT = ECTF_BASE,	/* file is not in CTF or ELF format */
+	ECTF_ELFVERS,		/* ELF version is more recent than libctf */
+	ECTF_CTFVERS,		/* CTF version is more recent than libctf */
+	ECTF_ENDIAN,		/* data is different endian-ness than lib */
+	ECTF_SYMTAB,		/* symbol table uses invalid entry size */
+	ECTF_SYMBAD,		/* symbol table data buffer invalid */
+	ECTF_STRBAD,		/* string table data buffer invalid */
+	ECTF_CORRUPT,		/* file data corruption detected */
+	ECTF_NOCTFDATA,		/* ELF file does not contain CTF data */
+	ECTF_NOCTFBUF,		/* buffer does not contain CTF data */
+	ECTF_NOSYMTAB,		/* symbol table data is not available */
+	ECTF_NOPARENT,		/* parent CTF container is not available */
+	ECTF_DMODEL,		/* data model mismatch */
+	ECTF_MMAP,		/* failed to mmap a data section */
+	ECTF_ZMISSING,		/* decompression library not installed */
+	ECTF_ZINIT,		/* failed to initialize decompression library */
+	ECTF_ZALLOC,		/* failed to allocate decompression buffer */
+	ECTF_DECOMPRESS,	/* failed to decompress CTF data */
+	ECTF_STRTAB,		/* string table for this string is missing */
+	ECTF_BADNAME,		/* string offset is corrupt w.r.t. strtab */
+	ECTF_BADID,		/* invalid type ID number */
+	ECTF_NOTSOU,		/* type is not a struct or union */
+	ECTF_NOTENUM,		/* type is not an enum */
+	ECTF_NOTSUE,		/* type is not a struct, union, or enum */
+	ECTF_NOTINTFP,		/* type is not an integer or float */
+	ECTF_NOTARRAY,		/* type is not an array */
+	ECTF_NOTREF,		/* type does not reference another type */
+	ECTF_NAMELEN,		/* buffer is too small to hold type name */
+	ECTF_NOTYPE,		/* no type found corresponding to name */
+	ECTF_SYNTAX,		/* syntax error in type name */
+	ECTF_NOTFUNC,		/* symtab entry does not refer to a function */
+	ECTF_NOFUNCDAT,		/* no func info available for function */
+	ECTF_NOTDATA,		/* symtab entry does not refer to a data obj */
+	ECTF_NOTYPEDAT,		/* no type info available for object */
+	ECTF_NOLABEL,		/* no label found corresponding to name */
+	ECTF_NOLABELDATA,	/* file does not contain any labels */
+	ECTF_NOTSUP,		/* feature not supported */
+	ECTF_NOENUMNAM,		/* enum element name not found */
+	ECTF_NOMEMBNAM,		/* member name not found */
+	ECTF_RDONLY,		/* CTF container is read-only */
+	ECTF_DTFULL,		/* CTF type is full (no more members allowed) */
+	ECTF_FULL,		/* CTF container is full */
+	ECTF_DUPMEMBER,		/* duplicate member name definition */
+	ECTF_CONFLICT,		/* conflicting type definition present */
+	ECTF_REFERENCED,	/* type has outstanding references */
+	ECTF_NOTDYN,		/* type is not a dynamic type */
+	ECTF_ELF,		/* elf library failure */
+	ECTF_MCHILD,		/* cannot merge child container */
+	ECTF_LABELEXISTS,	/* label already exists */
+	ECTF_LCONFLICT,		/* merged labels conflict */
+	ECTF_ZLIB,		/* zlib library failure */
+	ECTF_CONVBKERR,		/* CTF conversion backend error */
+	ECTF_CONVNOCSRC,	/* No C source to convert from */
+	ECTF_NOCONVBKEND	/* No applicable conversion backend */
+};
+
 /*
  * If the debugger needs to provide the CTF library with a set of raw buffers
  * for use as the CTF data, symbol table, and string table, it can do so by
@@ -143,19 +202,24 @@ typedef struct ctf_lblinfo {
 typedef int ctf_visit_f(const char *, ctf_id_t, ulong_t, int, void *);
 typedef int ctf_member_f(const char *, ctf_id_t, ulong_t, void *);
 typedef int ctf_enum_f(const char *, int, void *);
-typedef int ctf_type_f(ctf_id_t, void *);
+typedef int ctf_type_f(ctf_id_t, boolean_t, void *);
 typedef int ctf_label_f(const char *, const ctf_lblinfo_t *, void *);
+typedef int ctf_function_f(const char *, ulong_t, ctf_funcinfo_t *, void *);
+typedef int ctf_object_f(const char *, ctf_id_t, ulong_t, void *);
+typedef int ctf_string_f(const char *, void *);
 
 extern ctf_file_t *ctf_bufopen(const ctf_sect_t *, const ctf_sect_t *,
     const ctf_sect_t *, int *);
 extern ctf_file_t *ctf_fdopen(int, int *);
 extern ctf_file_t *ctf_open(const char *, int *);
 extern ctf_file_t *ctf_create(int *);
+extern ctf_file_t *ctf_fdcreate(int, int *);
 extern ctf_file_t *ctf_dup(ctf_file_t *);
 extern void ctf_close(ctf_file_t *);
 
 extern ctf_file_t *ctf_parent_file(ctf_file_t *);
 extern const char *ctf_parent_name(ctf_file_t *);
+extern const char *ctf_parent_label(ctf_file_t *);
 
 extern int ctf_import(ctf_file_t *, ctf_file_t *);
 extern int ctf_setmodel(ctf_file_t *, int);
@@ -165,15 +229,20 @@ extern void ctf_setspecific(ctf_file_t *, void *);
 extern void *ctf_getspecific(ctf_file_t *);
 
 extern int ctf_errno(ctf_file_t *);
+extern uint_t ctf_flags(ctf_file_t *);
 extern const char *ctf_errmsg(int);
 extern int ctf_version(int);
 
 extern int ctf_func_info(ctf_file_t *, ulong_t, ctf_funcinfo_t *);
+extern int ctf_func_info_by_id(ctf_file_t *, ctf_id_t, ctf_funcinfo_t *);
 extern int ctf_func_args(ctf_file_t *, ulong_t, uint_t, ctf_id_t *);
+extern int ctf_func_args_by_id(ctf_file_t *, ctf_id_t, uint_t, ctf_id_t *);
 
 extern ctf_id_t ctf_lookup_by_name(ctf_file_t *, const char *);
 extern ctf_id_t ctf_lookup_by_symbol(ctf_file_t *, ulong_t);
 
+extern char *ctf_symbol_name(ctf_file_t *, ulong_t, char *, size_t);
+
 extern ctf_id_t ctf_type_resolve(ctf_file_t *, ctf_id_t);
 extern ssize_t ctf_type_lname(ctf_file_t *, ctf_id_t, char *, size_t);
 extern char *ctf_type_name(ctf_file_t *, ctf_id_t, char *, size_t);
@@ -182,6 +251,7 @@ extern char *ctf_type_qname(ctf_file_t *, ctf_id_t, char *, size_t,
 extern ssize_t ctf_type_size(ctf_file_t *, ctf_id_t);
 extern ssize_t ctf_type_align(ctf_file_t *, ctf_id_t);
 extern int ctf_type_kind(ctf_file_t *, ctf_id_t);
+extern const char *ctf_kind_name(ctf_file_t *, int);
 extern ctf_id_t ctf_type_reference(ctf_file_t *, ctf_id_t);
 extern ctf_id_t ctf_type_pointer(ctf_file_t *, ctf_id_t);
 extern int ctf_type_encoding(ctf_file_t *, ctf_id_t, ctf_encoding_t *);
@@ -201,37 +271,50 @@ extern int ctf_label_info(ctf_file_t *, const char *, ctf_lblinfo_t *);
 
 extern int ctf_member_iter(ctf_file_t *, ctf_id_t, ctf_member_f *, void *);
 extern int ctf_enum_iter(ctf_file_t *, ctf_id_t, ctf_enum_f *, void *);
-extern int ctf_type_iter(ctf_file_t *, ctf_type_f *, void *);
+extern int ctf_type_iter(ctf_file_t *, boolean_t, ctf_type_f *, void *);
 extern int ctf_label_iter(ctf_file_t *, ctf_label_f *, void *);
+extern int ctf_function_iter(ctf_file_t *, ctf_function_f *, void *);
+extern int ctf_object_iter(ctf_file_t *, ctf_object_f *, void *);
+extern int ctf_string_iter(ctf_file_t *, ctf_string_f *, void *);
 
 extern ctf_id_t ctf_add_array(ctf_file_t *, uint_t, const ctf_arinfo_t *);
-extern ctf_id_t ctf_add_const(ctf_file_t *, uint_t, ctf_id_t);
+extern ctf_id_t ctf_add_const(ctf_file_t *, uint_t, const char *, ctf_id_t);
 extern ctf_id_t ctf_add_enum(ctf_file_t *, uint_t, const char *);
 extern ctf_id_t ctf_add_float(ctf_file_t *, uint_t,
     const char *, const ctf_encoding_t *);
 extern ctf_id_t ctf_add_forward(ctf_file_t *, uint_t, const char *, uint_t);
-extern ctf_id_t ctf_add_function(ctf_file_t *, uint_t,
-    const ctf_funcinfo_t *, const ctf_id_t *);
+extern ctf_id_t ctf_add_funcptr(ctf_file_t *, uint_t, const ctf_funcinfo_t *,
+    const ctf_id_t *);
 extern ctf_id_t ctf_add_integer(ctf_file_t *, uint_t,
     const char *, const ctf_encoding_t *);
-extern ctf_id_t ctf_add_pointer(ctf_file_t *, uint_t, ctf_id_t);
+extern ctf_id_t ctf_add_pointer(ctf_file_t *, uint_t, const char *, ctf_id_t);
 extern ctf_id_t ctf_add_type(ctf_file_t *, ctf_file_t *, ctf_id_t);
 extern ctf_id_t ctf_add_typedef(ctf_file_t *, uint_t, const char *, ctf_id_t);
-extern ctf_id_t ctf_add_restrict(ctf_file_t *, uint_t, ctf_id_t);
+extern ctf_id_t ctf_add_restrict(ctf_file_t *, uint_t, const char *, ctf_id_t);
 extern ctf_id_t ctf_add_struct(ctf_file_t *, uint_t, const char *);
 extern ctf_id_t ctf_add_union(ctf_file_t *, uint_t, const char *);
-extern ctf_id_t ctf_add_volatile(ctf_file_t *, uint_t, ctf_id_t);
+extern ctf_id_t ctf_add_volatile(ctf_file_t *, uint_t, const char *, ctf_id_t);
 
 extern int ctf_add_enumerator(ctf_file_t *, ctf_id_t, const char *, int);
-extern int ctf_add_member(ctf_file_t *, ctf_id_t, const char *, ctf_id_t);
+extern int ctf_add_member(ctf_file_t *, ctf_id_t, const char *, ctf_id_t,
+    ulong_t);
+
+
+extern int ctf_add_function(ctf_file_t *, ulong_t, const ctf_funcinfo_t *,
+    const ctf_id_t *);
+extern int ctf_add_object(ctf_file_t *, ulong_t, ctf_id_t);
+extern int ctf_add_label(ctf_file_t *, const char *, ctf_id_t, uint_t);
 
 extern int ctf_set_array(ctf_file_t *, ctf_id_t, const ctf_arinfo_t *);
+extern int ctf_set_root(ctf_file_t *, ctf_id_t, const boolean_t);
+extern int ctf_set_size(ctf_file_t *, ctf_id_t, const ulong_t);
 
 extern int ctf_delete_type(ctf_file_t *, ctf_id_t);
 
 extern int ctf_update(ctf_file_t *);
 extern int ctf_discard(ctf_file_t *);
 extern int ctf_write(ctf_file_t *, int);
+extern void ctf_dataptr(ctf_file_t *, const void **, size_t *);
 
 #ifdef _KERNEL
 
diff --git a/usr/src/uts/common/sys/cyclic.h b/usr/src/uts/common/sys/cyclic.h
index 5f28543f9f..270a09449f 100644
--- a/usr/src/uts/common/sys/cyclic.h
+++ b/usr/src/uts/common/sys/cyclic.h
@@ -23,6 +23,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2017 RackTop Systems.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef _SYS_CYCLIC_H
@@ -81,6 +82,7 @@ extern cyclic_id_t cyclic_add_omni(cyc_omni_handler_t *);
 extern void cyclic_remove(cyclic_id_t);
 extern void cyclic_bind(cyclic_id_t, cpu_t *, cpupart_t *);
 extern int cyclic_reprogram(cyclic_id_t, hrtime_t);
+extern void cyclic_move_here(cyclic_id_t);
 extern hrtime_t cyclic_getres();
 
 extern int cyclic_offline(cpu_t *cpu);
diff --git a/usr/src/uts/common/sys/devfm.h b/usr/src/uts/common/sys/devfm.h
index c1bd2ac3a7..1fcfeebcb0 100644
--- a/usr/src/uts/common/sys/devfm.h
+++ b/usr/src/uts/common/sys/devfm.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef	_SYS_DEVFM_H
@@ -120,6 +121,7 @@ typedef struct fm_ioc_data32 {
 #define	FM_PHYSCPU_INFO_CHIP_REV	"chip_rev"
 #define	FM_PHYSCPU_INFO_SOCKET_TYPE	"socket_type"
 #define	FM_PHYSCPU_INFO_CPU_ID		"cpuid"
+#define	FM_PHYSCPU_INFO_CHIP_IDENTSTR	"chip_identstr"
 
 #ifdef	__cplusplus
 }
diff --git a/usr/src/uts/common/sys/disp.h b/usr/src/uts/common/sys/disp.h
index b324f4d323..cb3711edcd 100644
--- a/usr/src/uts/common/sys/disp.h
+++ b/usr/src/uts/common/sys/disp.h
@@ -23,6 +23,8 @@
  * Use is subject to license terms.
  *
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ *
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -63,11 +65,11 @@ typedef struct _disp {
 	/*
 	 * Priorities:
 	 *	disp_maxrunpri is the maximum run priority of runnable threads
-	 * 	on this queue.  It is -1 if nothing is runnable.
+	 *	on this queue.  It is -1 if nothing is runnable.
 	 *
 	 *	disp_max_unbound_pri is the maximum run priority of threads on
 	 *	this dispatch queue but runnable by any CPU.  This may be left
-	 * 	artificially high, then corrected when some CPU tries to take
+	 *	artificially high, then corrected when some CPU tries to take
 	 *	an unbound thread.  It is -1 if nothing is runnable.
 	 */
 	pri_t		disp_maxrunpri;	/* maximum run priority */
@@ -151,8 +153,7 @@ extern void		dq_srundec(kthread_t *);
 extern void		cpu_rechoose(kthread_t *);
 extern void		cpu_surrender(kthread_t *);
 extern void		kpreempt(int);
-extern struct cpu	*disp_lowpri_cpu(struct cpu *, struct lgrp_ld *, pri_t,
-			    struct cpu *);
+extern struct cpu	*disp_lowpri_cpu(struct cpu *, kthread_t *, pri_t);
 extern int		disp_bound_threads(struct cpu *, int);
 extern int		disp_bound_anythreads(struct cpu *, int);
 extern int		disp_bound_partition(struct cpu *, int);
@@ -167,6 +168,8 @@ extern void		resume_from_zombie(kthread_t *)
 extern void		disp_swapped_enq(kthread_t *);
 extern int		disp_anywork(void);
 
+extern struct cpu	*disp_choose_best_cpu(void);
+
 #define	KPREEMPT_SYNC		(-1)
 #define	kpreempt_disable()				\
 	{						\
@@ -183,6 +186,8 @@ extern int		disp_anywork(void);
 
 #endif	/* _KERNEL */
 
+#define	CPU_IDLE_PRI (-1)
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/uts/common/sys/dktp/dadk.h b/usr/src/uts/common/sys/dktp/dadk.h
index f5c990e7c0..2178ad1f0d 100644
--- a/usr/src/uts/common/sys/dktp/dadk.h
+++ b/usr/src/uts/common/sys/dktp/dadk.h
@@ -65,6 +65,8 @@ struct	dadk {
 	kstat_t		*dad_errstats;	/* error stats			*/
 	kmutex_t	dad_cmd_mutex;
 	int		dad_cmd_count;
+	uint32_t	dad_err_cnt;	/* number of recent errors	*/
+	hrtime_t	dad_last_log;	/* time of last error log	*/
 };
 
 #define	DAD_SECSIZ	dad_phyg.g_secsiz
diff --git a/usr/src/uts/common/sys/dld.h b/usr/src/uts/common/sys/dld.h
index 06d74804bd..26d32ab34b 100644
--- a/usr/src/uts/common/sys/dld.h
+++ b/usr/src/uts/common/sys/dld.h
@@ -192,6 +192,7 @@ typedef struct dld_ioc_rename {
 	datalink_id_t	dir_linkid1;
 	datalink_id_t	dir_linkid2;
 	char		dir_link[MAXLINKNAMELEN];
+	boolean_t	dir_zoneinit;
 } dld_ioc_rename_t;
 
 /*
@@ -204,6 +205,7 @@ typedef struct dld_ioc_rename {
 typedef struct dld_ioc_zid {
 	zoneid_t	diz_zid;
 	datalink_id_t	diz_linkid;
+	boolean_t	diz_transient;
 } dld_ioc_zid_t;
 
 /*
@@ -356,6 +358,7 @@ typedef struct dld_ioc_led {
 #define	DLD_CAPAB_POLL		0x00000002
 #define	DLD_CAPAB_PERIM		0x00000003
 #define	DLD_CAPAB_LSO		0x00000004
+#define	DLD_CAPAB_IPCHECK	0x00000005
 
 #define	DLD_ENABLE		0x00000001
 #define	DLD_DISABLE		0x00000002
@@ -382,6 +385,7 @@ typedef struct dld_ioc_led {
  */
 typedef	int	(*dld_capab_func_t)(void *, uint_t, void *, uint_t);
 
+#define	DI_DIRECT_RAW	0x1
 /*
  * Direct Tx/Rx capability.
  */
@@ -406,8 +410,16 @@ typedef struct dld_capab_direct_s {
 	/* flow control "can I put on a ring" callback */
 	uintptr_t	di_tx_fctl_df; /* canput-like callback */
 	void		*di_tx_fctl_dh;
+
+	/* flags that control our behavior */
+	uint_t		di_flags;
 } dld_capab_direct_t;
 
+typedef struct dld_capab_ipcheck_s {
+	uintptr_t	ipc_allowed_df;
+	void		*ipc_allowed_dh;
+} dld_capab_ipcheck_t;
+
 /*
  * Polling/softring capability.
  */
diff --git a/usr/src/uts/common/sys/dld_impl.h b/usr/src/uts/common/sys/dld_impl.h
index a76a927e59..81708aad38 100644
--- a/usr/src/uts/common/sys/dld_impl.h
+++ b/usr/src/uts/common/sys/dld_impl.h
@@ -53,7 +53,8 @@ typedef enum {
 typedef enum {
 	DLD_UNINITIALIZED,
 	DLD_PASSIVE,
-	DLD_ACTIVE
+	DLD_ACTIVE,
+	DLD_EXCLUSIVE
 } dld_passivestate_t;
 
 /*
@@ -256,6 +257,8 @@ extern void		dld_str_rx_unitdata(void *, mac_resource_handle_t,
 extern void		dld_str_notify_ind(dld_str_t *);
 extern mac_tx_cookie_t	str_mdata_fastpath_put(dld_str_t *, mblk_t *,
     uintptr_t, uint16_t);
+extern mac_tx_cookie_t	str_mdata_raw_fastpath_put(dld_str_t *, mblk_t *,
+    uintptr_t, uint16_t);
 extern int		dld_flow_ctl_callb(dld_str_t *, uint64_t,
     int (*func)(), void *);
 
diff --git a/usr/src/uts/common/sys/dld_ioc.h b/usr/src/uts/common/sys/dld_ioc.h
index 2f519a8eda..093a4dc0c3 100644
--- a/usr/src/uts/common/sys/dld_ioc.h
+++ b/usr/src/uts/common/sys/dld_ioc.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_DLD_IOC_H
@@ -59,6 +60,7 @@ extern "C" {
 #define	IPTUN_IOC	0x454A
 #define	BRIDGE_IOC	0xB81D
 #define	IBPART_IOC	0x6171
+#define	OVERLAY_IOC	0x2005
 
 /* GLDv3 modules use these macros to generate unique ioctl commands */
 #define	DLDIOC(cmdid)		DLD_IOC_CMD(DLD_IOC, (cmdid))
@@ -68,6 +70,7 @@ extern "C" {
 #define	IPTUNIOC(cmdid)		DLD_IOC_CMD(IPTUN_IOC, (cmdid))
 #define	BRIDGEIOC(cmdid)	DLD_IOC_CMD(BRIDGE_IOC, (cmdid))
 #define	IBPARTIOC(cmdid)	DLD_IOC_CMD(IBPART_IOC, (cmdid))
+#define	OVERLAYIOC(cmdid)	DLD_IOC_CMD(OVERLAY_IOC, (cmdid))
 
 #ifdef _KERNEL
 
diff --git a/usr/src/uts/common/sys/dlpi.h b/usr/src/uts/common/sys/dlpi.h
index 5bc2bd41c5..d76daffeb7 100644
--- a/usr/src/uts/common/sys/dlpi.h
+++ b/usr/src/uts/common/sys/dlpi.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -107,6 +108,7 @@ typedef struct dl_ipnetinfo {
 #define	DL_PASSIVE_REQ		0x114	/* Allow access to aggregated link */
 #define	DL_INTR_MODE_REQ	0x115	/* Request Rx processing in INTR mode */
 #define	DL_NOTIFY_CONF		0x116	/* Notification from upstream */
+#define	DL_EXCLUSIVE_REQ	0x117	/* Make bind active */
 
 /*
  * Primitives used for Connectionless Service
@@ -388,6 +390,8 @@ typedef struct dl_ipnetinfo {
 #define	DL_PROMISC_PHYS		0x01	/* promiscuous mode at phys level */
 #define	DL_PROMISC_SAP		0x02	/* promiscuous mode at sap level */
 #define	DL_PROMISC_MULTI	0x03	/* promiscuous mode for multicast */
+#define	DL_PROMISC_RX_ONLY	0x04	/* above only enabled for rx */
+#define	DL_PROMISC_FIXUPS	0x05	/* above will be fixed up */
 
 /*
  * DLPI notification codes for DL_NOTIFY_REQ primitives.
@@ -673,11 +677,11 @@ typedef struct {
 #define	HCKSUM_ENABLE		0x01	/* Set to enable hardware checksum */
 					/* capability */
 #define	HCKSUM_INET_PARTIAL	0x02	/* Partial 1's complement checksum */
-					/* ability */
+					/* ability for TCP/UDP packets. */
 #define	HCKSUM_INET_FULL_V4	0x04	/* Full 1's complement checksum */
-					/* ability for IPv4 packets. */
+					/* ability for IPv4 TCP/UDP packets. */
 #define	HCKSUM_INET_FULL_V6	0x08	/* Full 1's complement checksum */
-					/* ability for IPv6 packets. */
+					/* ability for IPv6 TCP/UDP packets. */
 #define	HCKSUM_IPHDRCKSUM	0x10	/* IPv4 Header checksum offload */
 					/* capability */
 #ifdef _KERNEL
@@ -1107,6 +1111,13 @@ typedef struct {
 } dl_intr_mode_req_t;
 
 /*
+ * DL_EXCLUSIVE_REQ, M_PROTO type
+ */
+typedef struct {
+	t_uscalar_t	dl_primitive;
+} dl_exclusive_req_t;
+
+/*
  *	CONNECTION-ORIENTED SERVICE PRIMITIVES
  */
 
@@ -1528,6 +1539,7 @@ union DL_primitives {
 	dl_control_ack_t	control_ack;
 	dl_passive_req_t	passive_req;
 	dl_intr_mode_req_t	intr_mode_req;
+	dl_exclusive_req_t	exclusive_req;
 };
 
 #define	DL_INFO_REQ_SIZE	sizeof (dl_info_req_t)
@@ -1596,6 +1608,7 @@ union DL_primitives {
 #define	DL_CONTROL_ACK_SIZE	sizeof (dl_control_ack_t)
 #define	DL_PASSIVE_REQ_SIZE	sizeof (dl_passive_req_t)
 #define	DL_INTR_MODE_REQ_SIZE	sizeof (dl_intr_mode_req_t)
+#define	DL_EXCLUSIVE_REQ_SIZE	sizeof (dl_exclusive_req_t)
 
 #ifdef	_KERNEL
 /*
diff --git a/usr/src/uts/common/sys/dls.h b/usr/src/uts/common/sys/dls.h
index 6bd2bbe35a..81f9e2abac 100644
--- a/usr/src/uts/common/sys/dls.h
+++ b/usr/src/uts/common/sys/dls.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_DLS_H
@@ -85,6 +86,8 @@ typedef struct dls_link_s	dls_link_t;
 #define	DLS_PROMISC_SAP		0x00000001
 #define	DLS_PROMISC_MULTI	0x00000002
 #define	DLS_PROMISC_PHYS	0x00000004
+#define	DLS_PROMISC_RX_ONLY	0x00000008
+#define	DLS_PROMISC_FIXUPS	0x00000010
 
 extern int	dls_open(dls_link_t *, dls_dl_handle_t, dld_str_t *);
 extern void	dls_close(dld_str_t *);
@@ -106,11 +109,13 @@ extern void	str_notify(void *, mac_notify_type_t);
 
 extern int		dls_devnet_open(const char *,
 			    dls_dl_handle_t *, dev_t *);
+extern int		dls_devnet_open_in_zone(const char *,
+			    dls_dl_handle_t *, dev_t *, zoneid_t);
 extern void		dls_devnet_close(dls_dl_handle_t);
 extern boolean_t	dls_devnet_rebuild();
 
 extern int		dls_devnet_rename(datalink_id_t, datalink_id_t,
-			    const char *);
+			    const char *, boolean_t);
 extern int		dls_devnet_create(mac_handle_t, datalink_id_t,
 			    zoneid_t);
 extern int		dls_devnet_destroy(mac_handle_t, datalink_id_t *,
@@ -122,12 +127,13 @@ extern int		dls_devnet_hold_by_dev(dev_t, dls_dl_handle_t *);
 extern void		dls_devnet_rele(dls_dl_handle_t);
 extern void		dls_devnet_prop_task_wait(dls_dl_handle_t);
 
+extern const char	*dls_devnet_link(dls_dl_handle_t);
 extern const char	*dls_devnet_mac(dls_dl_handle_t);
 extern uint16_t		dls_devnet_vid(dls_dl_handle_t);
 extern datalink_id_t	dls_devnet_linkid(dls_dl_handle_t);
 extern int		dls_devnet_dev2linkid(dev_t, datalink_id_t *);
 extern int		dls_devnet_phydev(datalink_id_t, dev_t *);
-extern int		dls_devnet_setzid(dls_dl_handle_t, zoneid_t);
+extern int		dls_devnet_setzid(dls_dl_handle_t, zoneid_t, boolean_t);
 extern zoneid_t		dls_devnet_getzid(dls_dl_handle_t);
 extern zoneid_t		dls_devnet_getownerzid(dls_dl_handle_t);
 extern boolean_t	dls_devnet_islinkvisible(datalink_id_t, zoneid_t);
@@ -141,6 +147,8 @@ extern int		dls_mgmt_update(const char *, uint32_t, boolean_t,
 extern int		dls_mgmt_get_linkinfo(datalink_id_t, char *,
 			    datalink_class_t *, uint32_t *, uint32_t *);
 extern int		dls_mgmt_get_linkid(const char *, datalink_id_t *);
+extern int		dls_mgmt_get_linkid_in_zone(const char *,
+    datalink_id_t *, zoneid_t);
 extern datalink_id_t	dls_mgmt_get_next(datalink_id_t, datalink_class_t,
 			    datalink_media_t, uint32_t);
 extern int		dls_devnet_macname2linkid(const char *,
diff --git a/usr/src/uts/common/sys/dls_impl.h b/usr/src/uts/common/sys/dls_impl.h
index 60f51c47b5..329f8dd08e 100644
--- a/usr/src/uts/common/sys/dls_impl.h
+++ b/usr/src/uts/common/sys/dls_impl.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_DLS_IMPL_H
@@ -46,11 +47,12 @@ typedef struct dls_multicst_addr_s {
 } dls_multicst_addr_t;
 
 struct dls_link_s {				/* Protected by */
-	char			dl_name[MAXNAMELEN];	/* SL */
+	char			dl_name[MAXNAMELEN];	/* RO */
 	uint_t			dl_ddi_instance;	/* SL */
 	mac_handle_t		dl_mh;			/* SL */
 	mac_client_handle_t	dl_mch;			/* SL */
 	mac_unicast_handle_t	dl_mah;			/* SL */
+	mac_notify_handle_t	dl_mnh;			/* SL */
 	const mac_info_t	*dl_mip;		/* SL */
 	uint_t			dl_ref;			/* SL */
 	mod_hash_t		*dl_str_hash;		/* SL, modhash lock */
@@ -61,6 +63,7 @@ struct dls_link_s {				/* Protected by */
 	uint_t			dl_zone_ref;
 	link_tagmode_t		dl_tagmode;		/* atomic */
 	uint_t			dl_nonip_cnt;		/* SL */
+	uint_t			dl_exclusive;		/* SL */
 };
 
 typedef struct dls_head_s {
@@ -96,13 +99,16 @@ extern void		dls_create_str_kstats(dld_str_t *);
 extern int		dls_stat_update(kstat_t *, dls_link_t *, int);
 extern int		dls_stat_create(const char *, int, const char *,
 			    zoneid_t, int (*)(struct kstat *, int), void *,
-			    kstat_t **);
+			    kstat_t **, zoneid_t);
+extern void	dls_stat_delete(kstat_t *);
 
 extern int		dls_devnet_open_by_dev(dev_t, dls_link_t **,
 			    dls_dl_handle_t *);
 extern int		dls_devnet_hold_link(datalink_id_t, dls_dl_handle_t *,
 			    dls_link_t **);
 extern void		dls_devnet_rele_link(dls_dl_handle_t, dls_link_t *);
+extern int		dls_devnet_hold_tmp_by_link(dls_link_t *,
+			    dls_dl_handle_t *);
 
 extern void		dls_init(void);
 extern int		dls_fini(void);
@@ -126,6 +132,7 @@ extern void		dls_mgmt_init(void);
 extern void		dls_mgmt_fini(void);
 
 extern int		dls_mgmt_get_phydev(datalink_id_t, dev_t *);
+extern int		dls_exclusive_set(dld_str_t *, boolean_t);
 
 #ifdef	__cplusplus
 }
diff --git a/usr/src/uts/common/sys/dls_mgmt.h b/usr/src/uts/common/sys/dls_mgmt.h
index b4032c24d6..6fec277991 100644
--- a/usr/src/uts/common/sys/dls_mgmt.h
+++ b/usr/src/uts/common/sys/dls_mgmt.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef	_DLS_MGMT_H
@@ -46,13 +47,15 @@ typedef enum {
 	DATALINK_CLASS_SIMNET		= 0x20,
 	DATALINK_CLASS_BRIDGE		= 0x40,
 	DATALINK_CLASS_IPTUN		= 0x80,
-	DATALINK_CLASS_PART		= 0x100
+	DATALINK_CLASS_PART		= 0x100,
+	DATALINK_CLASS_OVERLAY		= 0x200
 } datalink_class_t;
 
 #define	DATALINK_CLASS_ALL	(DATALINK_CLASS_PHYS |	\
 	DATALINK_CLASS_VLAN | DATALINK_CLASS_AGGR | DATALINK_CLASS_VNIC | \
 	DATALINK_CLASS_ETHERSTUB | DATALINK_CLASS_SIMNET | \
-	DATALINK_CLASS_BRIDGE | DATALINK_CLASS_IPTUN | DATALINK_CLASS_PART)
+	DATALINK_CLASS_BRIDGE | DATALINK_CLASS_IPTUN | DATALINK_CLASS_PART | \
+	DATALINK_CLASS_OVERLAY)
 
 /*
  * A combination of flags and media.
@@ -111,10 +114,14 @@ typedef uint64_t	datalink_media_t;
 #define	DLMGMT_CMD_BASE			128
 
 /*
- * Indicate the link mapping is active or persistent
+ * Indicate if the link mapping is active, persistent, or transient. A
+ * transient link is an active link with a twist -- it is an active
+ * link which is destroyed along with the zone rather than reassigned
+ * to the GZ.
  */
 #define	DLMGMT_ACTIVE		0x01
 #define	DLMGMT_PERSIST		0x02
+#define	DLMGMT_TRANSIENT	0x04
 
 /* upcall argument */
 typedef struct dlmgmt_door_arg {
@@ -165,6 +172,7 @@ typedef struct dlmgmt_door_getname {
 typedef struct dlmgmt_door_getlinkid {
 	int			ld_cmd;
 	char			ld_link[MAXLINKNAMELEN];
+	zoneid_t		ld_zoneid;
 } dlmgmt_door_getlinkid_t;
 
 typedef struct dlmgmt_door_getnext_s {
@@ -225,6 +233,7 @@ typedef struct dlmgmt_getattr_retval_s {
 	char			lr_attrval[MAXLINKATTRVALLEN];
 } dlmgmt_getattr_retval_t;
 
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/uts/common/sys/dtrace.h b/usr/src/uts/common/sys/dtrace.h
index 4ee1a94510..44ca7d8ae7 100644
--- a/usr/src/uts/common/sys/dtrace.h
+++ b/usr/src/uts/common/sys/dtrace.h
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2017 Joyent, Inc.
  * Copyright (c) 2013 by Delphix. All rights reserved.
  */
 
@@ -189,6 +189,7 @@ typedef enum dtrace_probespec {
 #define	DIF_OP_RLDX	77		/* rldx  [r1], rd */
 #define	DIF_OP_XLATE	78		/* xlate xlrindex, rd */
 #define	DIF_OP_XLARG	79		/* xlarg xlrindex, rd */
+#define	DIF_OP_STGA	80		/* stga var, ri, rd */
 
 #define	DIF_INTOFF_MAX		0xffff	/* highest integer table offset */
 #define	DIF_STROFF_MAX		0xffff	/* highest string table offset */
diff --git a/usr/src/uts/common/sys/dtrace_impl.h b/usr/src/uts/common/sys/dtrace_impl.h
index de7d0d25fb..a55d0d7e1f 100644
--- a/usr/src/uts/common/sys/dtrace_impl.h
+++ b/usr/src/uts/common/sys/dtrace_impl.h
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2017 Joyent, Inc.
  * Copyright (c) 2012 by Delphix. All rights reserved.
  */
 
@@ -1262,6 +1262,7 @@ extern void dtrace_copyoutstr(uintptr_t, uintptr_t, size_t,
     volatile uint16_t *);
 extern void dtrace_getpcstack(pc_t *, int, int, uint32_t *);
 extern ulong_t dtrace_getreg(struct regs *, uint_t);
+extern void dtrace_setreg(struct regs *, uint_t, ulong_t);
 extern uint64_t dtrace_getvmreg(uint_t, volatile uint16_t *);
 extern int dtrace_getstackdepth(int);
 extern void dtrace_getupcstack(uint64_t *, int);
diff --git a/usr/src/uts/common/sys/elf.h b/usr/src/uts/common/sys/elf.h
index 3b7a1e3d7c..0dd4f2d17e 100644
--- a/usr/src/uts/common/sys/elf.h
+++ b/usr/src/uts/common/sys/elf.h
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
@@ -148,30 +148,30 @@ typedef struct {
 #define	ET_LOPROC	0xff00		/* processor specific range */
 #define	ET_HIPROC	0xffff
 
-#define	EM_NONE		0		/* e_machine */
-#define	EM_M32		1		/* AT&T WE 32100 */
-#define	EM_SPARC	2		/* Sun SPARC */
-#define	EM_386		3		/* Intel 80386 */
-#define	EM_68K		4		/* Motorola 68000 */
-#define	EM_88K		5		/* Motorola 88000 */
-#define	EM_486		6		/* Intel 80486 */
-#define	EM_860		7		/* Intel i860 */
-#define	EM_MIPS		8		/* MIPS RS3000 Big-Endian */
-#define	EM_S370		9		/* IBM System/370 Processor */
-#define	EM_MIPS_RS3_LE	10		/* MIPS RS3000 Little-Endian */
-#define	EM_RS6000	11		/* RS6000 */
+#define	EM_NONE		0	/* e_machine */
+#define	EM_M32		1	/* AT&T WE 32100 */
+#define	EM_SPARC	2	/* Sun SPARC */
+#define	EM_386		3	/* Intel 80386 */
+#define	EM_68K		4	/* Motorola 68000 */
+#define	EM_88K		5	/* Motorola 88000 */
+#define	EM_486		6	/* Intel 80486 */
+#define	EM_860		7	/* Intel i860 */
+#define	EM_MIPS		8	/* MIPS RS3000 Big-Endian */
+#define	EM_S370		9	/* IBM System/370 Processor */
+#define	EM_MIPS_RS3_LE	10	/* MIPS RS3000 Little-Endian */
+#define	EM_RS6000	11	/* RS6000 */
 #define	EM_UNKNOWN12	12
 #define	EM_UNKNOWN13	13
 #define	EM_UNKNOWN14	14
-#define	EM_PA_RISC	15		/* PA-RISC */
+#define	EM_PA_RISC	15	/* PA-RISC */
 #define	EM_PARISC	EM_PA_RISC	/* Alias: GNU compatibility */
-#define	EM_nCUBE	16		/* nCUBE */
-#define	EM_VPP500	17		/* Fujitsu VPP500 */
-#define	EM_SPARC32PLUS	18		/* Sun SPARC 32+ */
-#define	EM_960		19		/* Intel 80960 */
-#define	EM_PPC		20		/* PowerPC */
-#define	EM_PPC64	21		/* 64-bit PowerPC */
-#define	EM_S390		22		/* IBM System/390 Processor */
+#define	EM_nCUBE	16	/* nCUBE */
+#define	EM_VPP500	17	/* Fujitsu VPP500 */
+#define	EM_SPARC32PLUS	18	/* Sun SPARC 32+ */
+#define	EM_960		19	/* Intel 80960 */
+#define	EM_PPC		20	/* PowerPC */
+#define	EM_PPC64	21	/* 64-bit PowerPC */
+#define	EM_S390		22	/* IBM System/390 Processor */
 #define	EM_UNKNOWN22	EM_S390		/* Alias: Older published name */
 #define	EM_UNKNOWN23	23
 #define	EM_UNKNOWN24	24
@@ -186,78 +186,226 @@ typedef struct {
 #define	EM_UNKNOWN33	33
 #define	EM_UNKNOWN34	34
 #define	EM_UNKNOWN35	35
-#define	EM_V800		36		/* NEX V800 */
-#define	EM_FR20		37		/* Fujitsu FR20 */
-#define	EM_RH32		38		/* TRW RH-32 */
-#define	EM_RCE		39		/* Motorola RCE */
-#define	EM_ARM		40		/* Advanced RISC Marchines ARM */
-#define	EM_ALPHA	41		/* Digital Alpha */
-#define	EM_SH		42		/* Hitachi SH */
-#define	EM_SPARCV9	43		/* Sun SPARC V9 (64-bit) */
-#define	EM_TRICORE	44		/* Siemens Tricore embedded processor */
-#define	EM_ARC		45		/* Argonaut RISC Core, */
-					/*	Argonaut Technologies Inc. */
-#define	EM_H8_300	46		/* Hitachi H8/300 */
-#define	EM_H8_300H	47		/* Hitachi H8/300H */
-#define	EM_H8S		48		/* Hitachi H8S */
-#define	EM_H8_500	49		/* Hitachi H8/500 */
-#define	EM_IA_64	50		/* Intel IA64 */
-#define	EM_MIPS_X	51		/* Stanford MIPS-X */
-#define	EM_COLDFIRE	52		/* Motorola ColdFire */
-#define	EM_68HC12	53		/* Motorola M68HC12 */
-#define	EM_MMA		54		/* Fujitsu MMA Mulimedia Accelerator */
-#define	EM_PCP		55		/* Siemens PCP */
-#define	EM_NCPU		56		/* Sony nCPU embedded RISC processor */
-#define	EM_NDR1		57		/* Denso NDR1 microprocessor */
-#define	EM_STARCORE	58		/* Motorola Star*Core processor */
-#define	EM_ME16		59		/* Toyota ME16 processor */
-#define	EM_ST100	60		/* STMicroelectronics ST100 processor */
-#define	EM_TINYJ	61		/* Advanced Logic Corp. TinyJ */
-					/*	embedded processor family */
-#define	EM_AMD64	62		/* AMDs x86-64 architecture */
+#define	EM_V800		36	/* NEX V800 */
+#define	EM_FR20		37	/* Fujitsu FR20 */
+#define	EM_RH32		38	/* TRW RH-32 */
+#define	EM_RCE		39	/* Motorola RCE */
+#define	EM_ARM		40	/* Advanced RISC Marchines ARM */
+#define	EM_ALPHA	41	/* Digital Alpha */
+#define	EM_SH		42	/* Hitachi SH */
+#define	EM_SPARCV9	43	/* Sun SPARC V9 (64-bit) */
+#define	EM_TRICORE	44	/* Siemens Tricore embedded processor */
+#define	EM_ARC		45	/* Argonaut RISC Core, */
+				/*	Argonaut Technologies Inc. */
+#define	EM_H8_300	46	/* Hitachi H8/300 */
+#define	EM_H8_300H	47	/* Hitachi H8/300H */
+#define	EM_H8S		48	/* Hitachi H8S */
+#define	EM_H8_500	49	/* Hitachi H8/500 */
+#define	EM_IA_64	50	/* Intel IA64 */
+#define	EM_MIPS_X	51	/* Stanford MIPS-X */
+#define	EM_COLDFIRE	52	/* Motorola ColdFire */
+#define	EM_68HC12	53	/* Motorola M68HC12 */
+#define	EM_MMA		54	/* Fujitsu MMA Mulimedia Accelerator */
+#define	EM_PCP		55	/* Siemens PCP */
+#define	EM_NCPU		56	/* Sony nCPU embedded RISC processor */
+#define	EM_NDR1		57	/* Denso NDR1 microprocessor */
+#define	EM_STARCORE	58	/* Motorola Star*Core processor */
+#define	EM_ME16		59	/* Toyota ME16 processor */
+#define	EM_ST100	60	/* STMicroelectronics ST100 processor */
+#define	EM_TINYJ	61	/* Advanced Logic Corp. TinyJ */
+				/*	embedded processor family */
+#define	EM_AMD64	62	/* AMDs x86-64 architecture */
 #define	EM_X86_64	EM_AMD64	/* (compatibility) */
 
-#define	EM_PDSP		63		/* Sony DSP Processor */
+#define	EM_PDSP		63	/* Sony DSP Processor */
 #define	EM_UNKNOWN64	64
 #define	EM_UNKNOWN65	65
-#define	EM_FX66		66		/* Siemens FX66 microcontroller */
-#define	EM_ST9PLUS	67		/* STMicroelectronics ST9+8/16 bit */
-					/*	microcontroller */
-#define	EM_ST7		68		/* STMicroelectronics ST7 8-bit */
-					/*	microcontroller */
-#define	EM_68HC16	69		/* Motorola MC68HC16 Microcontroller */
-#define	EM_68HC11	70		/* Motorola MC68HC11 Microcontroller */
-#define	EM_68HC08	71		/* Motorola MC68HC08 Microcontroller */
-#define	EM_68HC05	72		/* Motorola MC68HC05 Microcontroller */
-#define	EM_SVX		73		/* Silicon Graphics SVx */
-#define	EM_ST19		74		/* STMicroelectronics ST19 8-bit */
-					/*	microcontroller */
-#define	EM_VAX		75		/* Digital VAX */
-#define	EM_CRIS		76		/* Axis Communications 32-bit */
-					/*	embedded processor */
-#define	EM_JAVELIN	77		/* Infineon Technologies 32-bit */
-					/*	embedded processor */
-#define	EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
-#define	EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
-#define	EM_MMIX		80		/* Donald Knuth's educational */
-					/*	64-bit processor */
-#define	EM_HUANY	81		/* Harvard University */
-					/*	machine-independent */
-					/*	object files */
-#define	EM_PRISM	82		/* SiTera Prism */
-#define	EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
-#define	EM_FR30		84		/* Fujitsu FR30 */
-#define	EM_D10V		85		/* Mitsubishi D10V */
-#define	EM_D30V		86		/* Mitsubishi D30V */
-#define	EM_V850		87		/* NEC v850 */
-#define	EM_M32R		88		/* Mitsubishi M32R */
-#define	EM_MN10300	89		/* Matsushita MN10300 */
-#define	EM_MN10200	90		/* Matsushita MN10200 */
-#define	EM_PJ		91		/* picoJava */
-#define	EM_OPENRISC	92		/* OpenRISC 32-bit embedded processor */
-#define	EM_ARC_A5	93		/* ARC Cores Tangent-A5 */
-#define	EM_XTENSA	94		/* Tensilica Xtensa architecture */
-#define	EM_NUM		95
+#define	EM_FX66		66	/* Siemens FX66 microcontroller */
+#define	EM_ST9PLUS	67	/* STMicroelectronics ST9+8/16 bit */
+				/*	microcontroller */
+#define	EM_ST7		68	/* STMicroelectronics ST7 8-bit */
+				/*	microcontroller */
+#define	EM_68HC16	69	/* Motorola MC68HC16 Microcontroller */
+#define	EM_68HC11	70	/* Motorola MC68HC11 Microcontroller */
+#define	EM_68HC08	71	/* Motorola MC68HC08 Microcontroller */
+#define	EM_68HC05	72	/* Motorola MC68HC05 Microcontroller */
+#define	EM_SVX		73	/* Silicon Graphics SVx */
+#define	EM_ST19		74	/* STMicroelectronics ST19 8-bit */
+				/*	microcontroller */
+#define	EM_VAX		75	/* Digital VAX */
+#define	EM_CRIS		76	/* Axis Communications 32-bit */
+				/*	embedded processor */
+#define	EM_JAVELIN	77	/* Infineon Technologies 32-bit */
+				/*	embedded processor */
+#define	EM_FIREPATH	78	/* Element 14 64-bit DSP Processor */
+#define	EM_ZSP		79	/* LSI Logic 16-bit DSP Processor */
+#define	EM_MMIX		80	/* Donald Knuth's educational */
+				/*	64-bit processor */
+#define	EM_HUANY	81	/* Harvard University */
+				/*	machine-independent */
+				/*	object files */
+#define	EM_PRISM	82	/* SiTera Prism */
+#define	EM_AVR		83	/* Atmel AVR 8-bit microcontroller */
+#define	EM_FR30		84	/* Fujitsu FR30 */
+#define	EM_D10V		85	/* Mitsubishi D10V */
+#define	EM_D30V		86	/* Mitsubishi D30V */
+#define	EM_V850		87	/* NEC v850 */
+#define	EM_M32R		88	/* Mitsubishi M32R */
+#define	EM_MN10300	89	/* Matsushita MN10300 */
+#define	EM_MN10200	90	/* Matsushita MN10200 */
+#define	EM_PJ		91	/* picoJava */
+#define	EM_OPENRISC	92	/* OpenRISC 32-bit embedded processor */
+#define	EM_ARC_A5	93	/* ARC Cores Tangent-A5 */
+#define	EM_XTENSA	94	/* Tensilica Xtensa architecture */
+
+#define	EM_VIDEOCORE	95	/* Alphamosaic VideoCore processor */
+#define	EM_TMM_GPP	96	/* Thompson Multimedia General Purpose */
+				/* Processor */
+#define	EM_NS32K	97	/* National Semiconductor 32000 series */
+#define	EM_TPC		98	/* Tenor Network TPC processor */
+#define	EM_SNP1K	99	/* Trebia SNP 1000 processor */
+#define	EM_ST200	100	/* STMicroelectronics (www.st.com) ST200 */
+				/* microcontroller */
+#define	EM_IP2K		101	/* Ubicom IP2xxx microcontroller family */
+#define	EM_MAX		102	/* MAX Processor */
+#define	EM_CR		103	/* National Semiconductor CompactRISC */
+				/* microprocessor */
+#define	EM_F2MC16	104	/* Fujitsu F2MC16 */
+#define	EM_MSP430	105	/* Texas Instruments embedded microcontroller */
+				/* msp430 */
+#define	EM_BLACKFIN	106	/* Analog Devices Blackfin (DSP) processor */
+#define	EM_SE_C33	107	/* S1C33 Family of Seiko Epson processors */
+#define	EM_SEP		108	/* Sharp embedded microprocessor */
+#define	EM_ARCA		109	/* Arca RISC Microprocessor */
+#define	EM_UNICORE	110	/* Microprocessor series from PKU-Unity Ltd. */
+				/* and MPRC of Peking University */
+#define	EM_EXCESS	111	/* eXcess: 16/32/64-bit configurable embedded */
+				/* CPU */
+#define	EM_DXP		112	/* Icera Semiconductor Inc. Deep Execution */
+				/* Processor */
+#define	EM_ALTERA_NIOS2	113	/* Altera Nios II soft-core processor */
+#define	EM_CRX		114	/* National Semiconductor CompactRISC CRX */
+				/* microprocessor */
+#define	EM_XGATE	115	/* Motorola XGATE embedded processor */
+#define	EM_C166		116	/* Infineon C16x/XC16x processor */
+#define	EM_M16C		117	/* Renesas M16C series microprocessors */
+#define	EM_DSPIC30F	118	/* Microchip Technology dsPIC30F Digital */
+				/* Signal Controller */
+#define	EM_CE		119	/* Freescale Communication Engine RISC core */
+#define	EM_M32C		120	/* Renesas M32C series microprocessors */
+
+#define	EM_TSK3000	131	/* Altium TSK3000 core */
+#define	EM_RS08		132	/* Freescale RS08 embedded processor */
+#define	EM_SHARC	133	/* Analog Devices SHARC family of 32-bit DSP */
+				/* processors */
+#define	EM_ECOG2	134	/* Cyan Technology eCOG2 microprocessor */
+#define	EM_SCORE7	135	/* Sunplus S+core7 RISC processor */
+#define	EM_DSP24	136	/* New Japan Radio (NJR) 24-bit DSP Processor */
+#define	EM_VIDEOCORE3	137	/* Broadcom VideoCore III processor */
+#define	EM_LATTICEMICO32	138	/* RISC processor for Lattice FPGA */
+					/* architecture */
+#define	EM_SE_C17	139	/* Seiko Epson C17 family */
+#define	EM_TI_C6000	140	/* The Texas Instruments TMS320C6000 DSP */
+				/* family */
+#define	EM_TI_C2000	141	/* The Texas Instruments TMS320C2000 DSP */
+				/* family */
+#define	EM_TI_C5500	142	/* The Texas Instruments TMS320C55x DSP */
+				/* family */
+#define	EM_TI_ARP32	143	/* Texas Instruments Application Specific */
+				/* RISC Processor, 32bit fetch */
+#define	EM_TI_PRU	144	/* Texas Instruments Programmable Realtime */
+				/* Unit */
+
+#define	EM_MMDSP_PLUS	160	/* STMicroelectronics 64bit VLIW Data Signal */
+				/* Processor */
+#define	EM_CYPRESS_M8C	161	/* Cypress M8C microprocessor */
+#define	EM_R32C		162	/* Renesas R32C series microprocessors */
+#define	EM_TRIMEDIA	163	/* NXP Semiconductors TriMedia architecture */
+				/* family */
+#define	EM_QDSP6	164	/* QUALCOMM DSP6 Processor */
+#define	EM_8051		165	/* Intel 8051 and variants */
+#define	EM_STXP7X	166	/* STMicroelectronics STxP7x family of */
+				/* configurable and extensible RISC */
+				/* processors */
+#define	EM_NDS32	167	/* Andes Technology compact code size */
+				/* embedded RISC processor family */
+#define	EM_ECOG1	168	/* Cyan Technology eCOG1X family */
+#define	EM_ECOG1X	EM_EC0G1X	/* Cyan Technology eCOG1X family */
+#define	EM_MAXQ30	169	/* Dallas Semiconductor MAXQ30 Core */
+				/* Micro-controllers */
+#define	EM_XIMO16	170	/* New Japan Radio (NJR) 16-bit DSP Processor */
+#define	EM_MANIK	171	/* M2000 Reconfigurable RISC Microprocessor */
+#define	EM_CRAYNV2	172	/* Cray Inc. NV2 vector architecture */
+#define	EM_RX		173	/* Renesas RX family */
+#define	EM_METAG	174	/* Imagination Technologies META processor */
+				/* architecture */
+#define	EM_MCST_ELBRUS	175	/* MCST Elbrus general purpose hardware */
+				/* architecture */
+#define	EM_ECOG16	176	/* Cyan Technology eCOG16 family */
+#define	EM_CR16		177	/* National Semiconductor CompactRISC */
+				/* CR16 16-bit microprocessor */
+#define	EM_ETPU		178	/* Freescale Extended Time Processing Unit */
+#define	EM_SLE9X	179	/* Infineon Technologies SLE9X core */
+#define	EM_L10M		180	/* Intel L10M */
+#define	EM_K10M		181	/* Intel K10M */
+
+#define	EM_AARCH64	183	/* ARM 64-bit architecture (AARCH64) */
+
+#define	EM_AVR32	185	/* Atmel Corporation 32-bit microprocessor */
+				/* family */
+#define	EM_STM8		186	/* STMicroeletronics STM8 8-bit */
+				/* microcontroller */
+#define	EM_TILE64	187	/* Tilera TILE64 multicore architecture */
+				/* family */
+#define	EM_TILEPRO	188	/* Tilera TILEPro multicore architecture */
+				/* family */
+#define	EM_MICROBLAZE	189	/* Xilinx MicroBlaze 32-bit RISC soft */
+				/* processor core */
+#define	EM_CUDA		190	/* NVIDIA CUDA architecture */
+#define	EM_TILEGX	191	/* Tilera TILE-Gx multicore architecture */
+				/* family */
+#define	EM_CLOUDSHIELD	192	/* CloudShield architecture family */
+#define	EM_COREA_1ST	193	/* KIPO-KAIST Core-A 1st generation processor */
+				/* family */
+#define	EM_COREA_2ND	194	/* KIPO-KAIST Core-A 2nd generation processor */
+				/* family */
+#define	EM_ARC_COMPACT2	195	/* Synopsys ARCompact V2 */
+#define	EM_OPEN8	196	/* Open8 8-bit RISC soft processor core */
+#define	EM_RL78		197	/* Renesas RL78 family */
+#define	EM_VIDEOCORE5	198	/* Broadcom VideoCore V processor */
+#define	EM_78KOR	199	/* Renesas 78KOR family */
+#define	EM_56800EX	200	/* Freescale 56800EX Digital Signal */
+				/* Controller (DSC) */
+#define	EM_BA1		201	/* Beyond BA1 CPU architecture */
+#define	EM_BA2		202	/* Beyond BA2 CPU architecture */
+#define	EM_XCORE	203	/* XMOS xCORE processor family */
+#define	EM_MCHP_PIC	204	/* Microchip 8-bit PIC(r) family */
+#define	EM_INTEL205	205	/* Reserved by Intel */
+#define	EM_INTEL206	206	/* Reserved by Intel */
+#define	EM_INTEL207	207	/* Reserved by Intel */
+#define	EM_INTEL208	208	/* Reserved by Intel */
+#define	EM_INTEL209	209	/* Reserved by Intel */
+#define	EM_KM32		210	/* KM211 KM32 32-bit processor */
+#define	EM_KMX32	211	/* KM211 KMX32 32-bit processor */
+#define	EM_KMX16	212	/* KM211 KMX16 16-bit processor */
+#define	EM_KMX8		213	/* KM211 KMX8 8-bit processor */
+#define	EM_KVARC	214	/* KM211 KVARC processor */
+#define	EM_CDP		215	/* Paneve CDP architecture family */
+#define	EM_COGE		216	/* Cognitive Smart Memory Processor */
+#define	EM_COOL		217	/* Bluechip Systems CoolEngine */
+#define	EM_NORC		218	/* Nanoradio Optimized RISC */
+#define	EM_CSR_KALIMBA	219	/* CSR Kalimba architecture family */
+#define	EM_Z80		220	/* Zilog Z80 */
+#define	EM_VISIUM	221	/* Controls and Data Services VISIUMcore */
+				/* processor */
+#define	EM_FT32		222	/* FTDI Chip FT32 high performance 32-bit */
+				/* RISC architecture */
+#define	EM_MOXIE	223	/* Moxie processor family */
+#define	EM_AMDGPU	224	/* AMD GPU architecture */
+
+#define	EM_RISCV	243	/* RISC-V */
+
+#define	EM_NUM		244
 
 #define	EV_NONE		0		/* e_version, EI_VERSION */
 #define	EV_CURRENT	1
@@ -281,6 +429,10 @@ typedef struct {
 #define	ELFOSABI_OPENVMS	13	/* Open VMS */
 #define	ELFOSABI_NSK		14	/* Hewlett-Packard Non-Stop Kernel */
 #define	ELFOSABI_AROS		15	/* Amiga Research OS */
+#define	ELFOSABI_FENIXOS 	16 	/* The FenixOS highly scalable */
+					/* multi-core OS */
+#define	ELFOSABI_CLOUDABI 	17 	/* Nuxi CloudABI */
+#define	ELFOSABI_OPENVOS 	18 	/* Stratus Technologies OpenVOS */
 #define	ELFOSABI_ARM		97	/* ARM */
 #define	ELFOSABI_STANDALONE	255	/* standalone (embedded) application */
 
@@ -348,6 +500,11 @@ typedef struct {
 #define	PT_GNU_STACK	0x6474e551	/* Indicates stack executability */
 #define	PT_GNU_RELRO	0x6474e552	/* Read-only after relocation */
 
+/*
+ * Linux specific program headers not even used by Linux (!!)
+ */
+#define	PT_PAX_FLAGS	0x65041580	/* PaX flags (see below) */
+
 #define	PT_LOSUNW	0x6ffffffa
 #define	PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment (unused) */
 #define	PT_SUNWSTACK	0x6ffffffb	/* describes the stack segment */
@@ -363,6 +520,45 @@ typedef struct {
 #define	PF_W		0x2
 #define	PF_X		0x1
 
+/*
+ * PaX is a regrettable series of never-integrated Linux patches for a
+ * facility to provide additional protections on memory pages for purposes of
+ * increasing security, and for allowing binaries to demand (or refuse) those
+ * protections via the PT_PAX_FLAGS program header.  (Portents of its
+ * rudderless existence, "PaX" is a term of indefinite origin written by an
+ * unknown group of people.)  This facility is unfortunate in any number of
+ * ways, and was largely obviated by the broad adoption of non-executable
+ * stacks at any rate -- but it lives on in binaries that continue to mark
+ * themselves to explicitly refuse the (never-integrated, now-obviated)
+ * facility.  One might cringe that PaX overloads the meaning of the p_flags
+ * to specify protections, but that is the least of its transgressions:
+ * instead of using one p_type constant to explicitly enable a series of
+ * protections and another to explicitly disable others, it insists on
+ * conflating both actions into PT_PAX_FLAGS.  The resulting doubling of
+ * constant definitions (two constant definitions for every protection instead
+ * of merely one) assures that the values can't even fit in the eight
+ * PF_MASKOS bits putatively defined to provide a modicum of cleanliness for
+ * such filthy functionality.  And were all of this not enough, there is one
+ * final nomenclature insult to be added to this semantic injury:  the
+ * constants for the p_flags don't even embed "_PAX_" in their name -- despite
+ * the fact that this is their only purpose!  We resist the temptation to
+ * right this final wrong here; we grit our teeth and provide exactly the
+ * Linux definitions -- or rather, what would have been the Linux definitions
+ * had this belching jalopy ever been permitted to crash itself into mainline.
+ */
+#define	PF_PAGEEXEC	0x00000010	/* PaX: enable PAGEEXEC */
+#define	PF_NOPAGEEXEC	0x00000020	/* PaX: disable PAGEEXEC */
+#define	PF_SEGMEXEC	0x00000040	/* PaX: enable SEGMEXEC */
+#define	PF_NOSEGMEXEC	0x00000080	/* PaX: disable SEGMEXEC */
+#define	PF_MPROTECT	0x00000100	/* PaX: enable MPROTECT */
+#define	PF_NOMPROTECT	0x00000200	/* PaX: disable MPROTECT */
+#define	PF_RANDEXEC	0x00000400	/* PaX: enable RANDEXEC */
+#define	PF_NORANDEXEC	0x00000800	/* PaX: disable RANDEXEC */
+#define	PF_EMUTRAMP	0x00001000	/* PaX: enable EMUTRAMP */
+#define	PF_NOEMUTRAMP	0x00002000	/* PaX: disable EMUTRAMP */
+#define	PF_RANDMMAP	0x00004000	/* PaX: enable RANDMMAP */
+#define	PF_NORANDMMAP	0x00008000	/* PaX: disable RANDMMAP */
+
 #define	PF_MASKOS	0x0ff00000	/* OS specific values */
 #define	PF_MASKPROC	0xf0000000	/* processor specific values */
 
diff --git a/usr/src/uts/common/sys/eventfd.h b/usr/src/uts/common/sys/eventfd.h
index 1b0d961b0b..b64a101348 100644
--- a/usr/src/uts/common/sys/eventfd.h
+++ b/usr/src/uts/common/sys/eventfd.h
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 /*
@@ -47,6 +47,13 @@ typedef uint64_t eventfd_t;
 #define	EVENTFDIOC		(('e' << 24) | ('f' << 16) | ('d' << 8))
 #define	EVENTFDIOC_SEMAPHORE	(EVENTFDIOC | 1)	/* toggle sem state */
 
+/*
+ * Kernel-internal method to write to eventfd while bypassing overflow limits,
+ * therefore avoiding potential to block as well.  This is used to fulfill AIO
+ * behavior in LX related to eventfd notification.
+ */
+#define	EVENTFDIOC_POST		(EVENTFDIOC | 2)
+
 #ifndef _KERNEL
 
 extern int eventfd(unsigned int, int);
@@ -58,6 +65,7 @@ extern int eventfd_write(int, eventfd_t);
 #define	EVENTFDMNRN_EVENTFD	0
 #define	EVENTFDMNRN_CLONE	1
 #define	EVENTFD_VALMAX		(ULLONG_MAX - 1ULL)
+#define	EVENTFD_VALOVERFLOW	ULLONG_MAX
 
 #endif /* _KERNEL */
 
diff --git a/usr/src/uts/common/sys/exec.h b/usr/src/uts/common/sys/exec.h
index 8056f9a8e8..3b7ac5aa7c 100644
--- a/usr/src/uts/common/sys/exec.h
+++ b/usr/src/uts/common/sys/exec.h
@@ -26,6 +26,10 @@
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
 /*	  All Rights Reserved	*/
 
+/*
+ * Copyright 2016, Joyent, Inc.
+ */
+
 #ifndef _SYS_EXEC_H
 #define	_SYS_EXEC_H
 
@@ -102,10 +106,13 @@ typedef struct uarg {
 	vnode_t	*ex_vp;
 	char	*emulator;
 	char	*brandname;
+	const char *brand_nroot;
 	char	*auxp_auxflags; /* addr of auxflags auxv on the user stack */
 	char	*auxp_brand; /* address of first brand auxv on user stack */
 	cred_t	*pfcred;
 	boolean_t scrubenv;
+	uintptr_t maxstack;
+	boolean_t stk_prot_override;
 	uintptr_t commpage;
 } uarg_t;
 
@@ -176,7 +183,7 @@ struct execsw {
 	int	(*exec_func)(struct vnode *vp, struct execa *uap,
 		    struct uarg *args, struct intpdata *idata, int level,
 		    long *execsz, int setid, caddr_t exec_file,
-		    struct cred *cred, int brand_action);
+		    struct cred *cred, int *brand_action);
 	int	(*exec_core)(struct vnode *vp, struct proc *p,
 		    struct cred *cred, rlim64_t rlimit, int sig,
 		    core_content_t content);
@@ -214,7 +221,7 @@ extern int exec_common(const char *fname, const char **argp,
     const char **envp, int brand_action);
 extern int gexec(vnode_t **vp, struct execa *uap, struct uarg *args,
     struct intpdata *idata, int level, long *execsz, caddr_t exec_file,
-    struct cred *cred, int brand_action);
+    struct cred *cred, int *brand_action);
 extern struct execsw *allocate_execsw(char *name, char *magic,
     size_t magic_size);
 extern struct execsw *findexecsw(char *magic);
@@ -239,16 +246,22 @@ extern void exec_set_sp(size_t);
  * when compiling the 32-bit compatability elf code in the elfexec module.
  */
 extern int elfexec(vnode_t *, execa_t *, uarg_t *, intpdata_t *, int,
-    long *, int, caddr_t, cred_t *, int);
+    long *, int, caddr_t, cred_t *, int *);
 extern int mapexec_brand(vnode_t *, uarg_t *, Ehdr *, Addr *,
-    intptr_t *, caddr_t, int *, caddr_t *, caddr_t *, size_t *, uintptr_t *);
+    intptr_t *, caddr_t, char **, caddr_t *, caddr_t *, size_t *,
+    uintptr_t *, uintptr_t *);
+extern int elfreadhdr(vnode_t *, cred_t *, Ehdr *, int *, caddr_t *,
+    ssize_t *);
 #endif /* !_ELF32_COMPAT */
 
 #if defined(_LP64)
 extern int elf32exec(vnode_t *, execa_t *, uarg_t *, intpdata_t *, int,
-    long *, int, caddr_t, cred_t *, int);
+    long *, int, caddr_t, cred_t *, int *);
 extern int mapexec32_brand(vnode_t *, uarg_t *, Elf32_Ehdr *, Elf32_Addr *,
-    intptr_t *, caddr_t, int *, caddr_t *, caddr_t *, size_t *, uintptr_t *);
+    intptr_t *, caddr_t, char **, caddr_t *, caddr_t *, size_t *,
+    uintptr_t *, uintptr_t *);
+extern int elf32readhdr(vnode_t *, cred_t *, Elf32_Ehdr *, int *, caddr_t *,
+    ssize_t *);
 #endif  /* _LP64 */
 
 /*
diff --git a/usr/src/uts/common/sys/file.h b/usr/src/uts/common/sys/file.h
index c2243ef17b..eb1328f38d 100644
--- a/usr/src/uts/common/sys/file.h
+++ b/usr/src/uts/common/sys/file.h
@@ -27,7 +27,7 @@
 /*	  All Rights Reserved	*/
 
 /* Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved. */
-/* Copyright 2015 Joyent, Inc. */
+/* Copyright 2017 Joyent, Inc. */
 
 #ifndef _SYS_FILE_H
 #define	_SYS_FILE_H
@@ -122,11 +122,6 @@ typedef struct fpollinfo {
 #ifdef _KERNEL
 
 /*
- * This is a flag that is set on f_flag2, but is never user-visible
- */
-#define	FEPOLLED	0x8000
-
-/*
  * Fake flags for driver ioctl calls to inform them of the originating
  * process' model.  See <sys/model.h>
  *
@@ -199,6 +194,7 @@ struct vnodeops;
 struct vattr;
 
 extern file_t *getf(int);
+extern file_t *getf_gen(int, uf_entry_gen_t *);
 extern void releasef(int);
 extern void areleasef(int, uf_info_t *);
 #ifndef	_BOOT
@@ -225,6 +221,7 @@ extern void fcnt_add(uf_info_t *, int);
 extern void close_exec(uf_info_t *);
 extern void clear_stale_fd(void);
 extern void clear_active_fd(int);
+extern void set_active_fd(int);
 extern void free_afd(afd_t *afd);
 extern int fgetstartvp(int, char *, struct vnode **);
 extern int fsetattrat(int, char *, int, struct vattr *);
diff --git a/usr/src/uts/common/sys/frameio.h b/usr/src/uts/common/sys/frameio.h
new file mode 100644
index 0000000000..54e6dbeedf
--- /dev/null
+++ b/usr/src/uts/common/sys/frameio.h
@@ -0,0 +1,107 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _SYS_FRAMEIO_H
+#define	_SYS_FRAMEIO_H
+
+/*
+ * Frame I/O definitions
+ */
+
+#include <sys/types.h>
+
+#ifdef _KERNEL
+/* Kernel only headers */
+#include <sys/stream.h>
+#endif	/* _KERNEL */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * An individual frame vector component. Collections of these are used to make
+ * ioctls.
+ */
+typedef struct framevec {
+	void	*fv_buf;	/* Buffer with data */
+	size_t	fv_buflen;	/* Size of the buffer */
+	size_t	fv_actlen;	/* Amount of buffer consumed, ignore on error */
+} framevec_t;
+
+/*
+ * The base unit used with frameio.
+ */
+typedef struct frameio {
+	uint_t	fio_version;	/* Should always be FRAMEIO_CURRENT_VERSION */
+	uint_t	fio_nvpf;	/* How many vectors make up one frame */
+	uint_t	fio_nvecs;	/* The total number of vectors */
+	framevec_t fio_vecs[];	/* C99 VLA */
+} frameio_t;
+
+
+#define	FRAMEIO_VERSION_ONE	1
+#define	FRAMEIO_CURRENT_VERSION	FRAMEIO_VERSION_ONE
+
+#define	FRAMEIO_NVECS_MAX	32
+
+/*
+ * Definitions for kernel modules to include as helpers. These are consolidation
+ * private.
+ */
+#ifdef _KERNEL
+
+/*
+ * 32-bit versions for 64-bit kernels
+ */
+typedef struct framevec32 {
+	caddr32_t fv_buf;
+	size32_t fv_buflen;
+	size32_t fv_actlen;
+} framevec32_t;
+
+typedef struct frameio32 {
+	uint_t fio_version;
+	uint_t fio_vecspframe;
+	uint_t fio_nvecs;
+	framevec32_t fio_vecs[];
+} frameio32_t;
+
+/*
+ * Describe the different ways that vectors should map to frames.
+ */
+typedef enum frameio_write_mblk_map {
+	MAP_BLK_FRAME
+} frameio_write_mblk_map_t;
+
+int frameio_init(void);
+void frameio_fini(void);
+frameio_t *frameio_alloc(int);
+void frameio_free(frameio_t *);
+int frameio_hdr_copyin(frameio_t *, int, const void *, uint_t);
+int frameio_mblk_chain_read(frameio_t *, mblk_t **, int *, int);
+int frameio_mblk_chain_write(frameio_t *, frameio_write_mblk_map_t, mblk_t *,
+    int *, int);
+int frameio_hdr_copyout(frameio_t *, int, void *, uint_t);
+size_t frameio_frame_length(frameio_t *, framevec_t *);
+void frameio_mark_consumed(frameio_t *, int);
+
+#endif /* _KERNEL */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_FRAMEIO_H */
diff --git a/usr/src/uts/common/sys/fs/fifonode.h b/usr/src/uts/common/sys/fs/fifonode.h
index d8b158ce3c..1ea8563e1c 100644
--- a/usr/src/uts/common/sys/fs/fifonode.h
+++ b/usr/src/uts/common/sys/fs/fifonode.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -83,6 +84,7 @@ struct fifonode {
 	struct msgb	*fn_tail;	/* last message to read */
 	fifolock_t	*fn_lock;	/* pointer to per fifo lock */
 	uint_t		fn_count;	/* Number of bytes on fn_mp */
+	uint_t		fn_hiwat;	/* pipe (fifofast) high water */
 	kcondvar_t	fn_wait_cv;	/* fifo conditional variable */
 	ushort_t	fn_wcnt;	/* number of writers */
 	ushort_t	fn_rcnt;	/* number of readers */
@@ -135,6 +137,8 @@ typedef struct fifodata {
 #define	FIFOPOLLRBAND	0x20000
 #define	FIFOSTAYFAST	0x40000	/* don't turn into stream mode */
 #define	FIFOWAITMODE	0x80000	/* waiting for the possibility to change mode */
+/* Data on loan, block reads. Use in conjunction with FIFOSTAYFAST. */
+#define	FIFORDBLOCK	0x100000
 
 #define	FIFOHIWAT	(16 * 1024)
 #define	FIFOLOWAT	(0)
@@ -147,16 +151,6 @@ typedef struct fifodata {
 
 #if defined(_KERNEL)
 
-/*
- * Fifohiwat defined as a variable is to allow tuning of the high
- * water mark if needed. It is not meant to be released.
- */
-#if FIFODEBUG
-extern int Fifohiwat;
-#else /* FIFODEBUG */
-#define	Fifohiwat	FIFOHIWAT
-#endif /* FIFODEBUG */
-
 extern struct vnodeops *fifo_vnodeops;
 extern const struct fs_operation_def fifo_vnodeops_template[];
 extern struct kmem_cache *fnode_cache;
@@ -181,6 +175,8 @@ extern void	fifo_fastoff(fifonode_t *);
 extern struct streamtab *fifo_getinfo();
 extern void	fifo_wakereader(fifonode_t *, fifolock_t *);
 extern void	fifo_wakewriter(fifonode_t *, fifolock_t *);
+extern boolean_t fifo_stayfast_enter(fifonode_t *);
+extern void	fifo_stayfast_exit(fifonode_t *);
 
 #endif /* _KERNEL */
 
diff --git a/usr/src/uts/common/sys/fs/hyprlofs.h b/usr/src/uts/common/sys/fs/hyprlofs.h
new file mode 100644
index 0000000000..b8c4149df2
--- /dev/null
+++ b/usr/src/uts/common/sys/fs/hyprlofs.h
@@ -0,0 +1,91 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2012, Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef	_SYS_FS_HYPRLOFS_H
+#define	_SYS_FS_HYPRLOFS_H
+
+#include <sys/param.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * hyprlofs ioctl numbers.
+ */
+#define	HYPRLOFS_IOC	('H' << 8)
+
+#define	HYPRLOFS_ADD_ENTRIES	(HYPRLOFS_IOC | 1)
+#define	HYPRLOFS_RM_ENTRIES	(HYPRLOFS_IOC | 2)
+#define	HYPRLOFS_RM_ALL		(HYPRLOFS_IOC | 3)
+#define	HYPRLOFS_GET_ENTRIES	(HYPRLOFS_IOC | 4)
+
+typedef struct {
+	char	*hle_path;
+	uint_t	hle_plen;
+	char	*hle_name;
+	uint_t	hle_nlen;
+} hyprlofs_entry_t;
+
+typedef struct {
+	hyprlofs_entry_t	*hle_entries;
+	uint_t			hle_len;
+} hyprlofs_entries_t;
+
+typedef struct {
+	char		hce_path[MAXPATHLEN];
+	char		hce_name[MAXPATHLEN];
+} hyprlofs_curr_entry_t;
+
+typedef struct {
+	hyprlofs_curr_entry_t	*hce_entries;
+	uint_t			hce_cnt;
+} hyprlofs_curr_entries_t;
+
+#ifdef _KERNEL
+typedef struct {
+	caddr32_t	hle_path;
+	uint_t		hle_plen;
+	caddr32_t	hle_name;
+	uint_t		hle_nlen;
+} hyprlofs_entry32_t;
+
+typedef struct {
+	caddr32_t	hle_entries;
+	uint_t		hle_len;
+} hyprlofs_entries32_t;
+
+typedef struct {
+	caddr32_t	hce_entries;
+	uint_t		hce_cnt;
+} hyprlofs_curr_entries32_t;
+
+#endif /* _KERNEL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_FS_HYPRLOFS_H */
diff --git a/usr/src/uts/common/sys/fs/hyprlofs_info.h b/usr/src/uts/common/sys/fs/hyprlofs_info.h
new file mode 100644
index 0000000000..38389f77d9
--- /dev/null
+++ b/usr/src/uts/common/sys/fs/hyprlofs_info.h
@@ -0,0 +1,174 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+/*
+ * Copyright 2012, Joyent, Inc. All rights reserved.
+ */
+
+#ifndef	_SYS_FS_HYPRLOFS_INFO_H
+#define	_SYS_FS_HYPRLOFS_INFO_H
+
+#include <sys/t_lock.h>
+#include <vm/seg.h>
+#include <vm/seg_vn.h>
+#include <sys/vfs_opreg.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * hlnode is the file system dependent node for hyprlofs.
+ * It is modeled on the tmpfs tmpnode.
+ *
+ *	hln_rwlock protects access of the directory list at hln_dir
+ *	as well as syncronizing read/writes to directory hlnodes.
+ *	hln_tlock protects updates to hln_mode and hln_nlink.
+ *	hln_tlock doesn't require any hlnode locks.
+ */
+typedef struct hlnode {
+	struct hlnode	*hln_back;		/* linked list of hlnodes */
+	struct hlnode	*hln_forw;		/* linked list of hlnodes */
+	union {
+		struct {
+			struct hldirent	*un_dirlist; /* dirent list */
+			uint_t	un_dirents;	/* number of dirents */
+		} un_dirstruct;
+		vnode_t	*un_realvp;		/* real vnode */
+	} un_hlnode;
+	vnode_t 	*hln_vnode;		/* vnode for this hlnode */
+	int 		hln_gen;		/* pseudo gen num for hlfid */
+	int 		hln_looped;		/* flag indicating loopback */
+	vattr_t		hln_attr;		/* attributes */
+	krwlock_t	hln_rwlock;		/* rw - serialize mods and */
+						/* directory updates */
+	kmutex_t	hln_tlock;		/* time, flag, and nlink lock */
+} hlnode_t;
+
+/*
+ * hyprlofs per-mount data structure.
+ * All fields are protected by hlm_contents.
+ */
+typedef struct {
+	vfs_t		*hlm_vfsp;	/* filesystem's vfs struct */
+	hlnode_t	*hlm_rootnode;	/* root hlnode */
+	char 		*hlm_mntpath;	/* name of hyprlofs mount point */
+	dev_t		hlm_dev;	/* unique dev # of mounted `device' */
+	uint_t		hlm_gen;	/* pseudo generation number for files */
+	kmutex_t	hlm_contents;	/* lock for hlfsmount structure */
+} hlfsmount_t;
+
+/*
+ * hyprlofs directories are made up of a linked list of hldirent structures
+ * hanging off directory hlnodes.  File names are not fixed length,
+ * but are null terminated.
+ */
+typedef struct hldirent {
+	hlnode_t	*hld_hlnode;		/* hlnode for this file */
+	struct hldirent	*hld_next;		/* next directory entry */
+	struct hldirent	*hld_prev;		/* prev directory entry */
+	uint_t		hld_offset;		/* "offset" of dir entry */
+	uint_t		hld_hash;		/* a hash of td_name */
+	struct hldirent	*hld_link;		/* linked via the hash table */
+	hlnode_t	*hld_parent;		/* parent, dir we are in */
+	char		*hld_name;		/* must be null terminated */
+						/* max length is MAXNAMELEN */
+} hldirent_t;
+
+/*
+ * hlfid overlays the fid structure (for VFS_VGET)
+ */
+typedef struct {
+	uint16_t hlfid_len;
+	ino32_t	hlfid_ino;
+	int32_t	hlfid_gen;
+} hlfid_t;
+
+/*
+ * File system independent to hyprlofs conversion macros
+ */
+#define	VFSTOHLM(vfsp)		((hlfsmount_t *)(vfsp)->vfs_data)
+#define	VTOHLM(vp)		((hlfsmount_t *)(vp)->v_vfsp->vfs_data)
+#define	VTOHLN(vp)		((hlnode_t *)(vp)->v_data)
+#define	HLNTOV(tp)		((tp)->hln_vnode)
+#define	REALVP(vp)		((vnode_t *)VTOHLN(vp)->hln_realvp)
+#define	hlnode_hold(tp)		VN_HOLD(HLNTOV(tp))
+#define	hlnode_rele(tp)		VN_RELE(HLNTOV(tp))
+
+#define	hln_dir		un_hlnode.un_dirstruct.un_dirlist
+#define	hln_dirents	un_hlnode.un_dirstruct.un_dirents
+#define	hln_realvp	un_hlnode.un_realvp
+
+/*
+ * Attributes
+ */
+#define	hln_mask	hln_attr.va_mask
+#define	hln_type	hln_attr.va_type
+#define	hln_mode	hln_attr.va_mode
+#define	hln_uid		hln_attr.va_uid
+#define	hln_gid		hln_attr.va_gid
+#define	hln_fsid	hln_attr.va_fsid
+#define	hln_nodeid	hln_attr.va_nodeid
+#define	hln_nlink	hln_attr.va_nlink
+#define	hln_size	hln_attr.va_size
+#define	hln_atime	hln_attr.va_atime
+#define	hln_mtime	hln_attr.va_mtime
+#define	hln_ctime	hln_attr.va_ctime
+#define	hln_rdev	hln_attr.va_rdev
+#define	hln_blksize	hln_attr.va_blksize
+#define	hln_nblocks	hln_attr.va_nblocks
+#define	hln_seq		hln_attr.va_seq
+
+/*
+ * enums
+ */
+enum de_op	{ DE_CREATE, DE_MKDIR }; /* direnter ops */
+enum dr_op	{ DR_REMOVE, DR_RMDIR }; /* dirremove ops */
+
+/*
+ * hyprlofs_minfree is the amount (in pages) of anonymous memory that hyprlofs
+ * leaves free for the rest of the system. The default value for
+ * hyprlofs_minfree is btopr(HYPRLOFSMINFREE) but it can be patched to a
+ * different number of pages.  Since hyprlofs doesn't actually use much
+ * memory, its unlikely this ever needs to be patched.
+ */
+#define		HYPRLOFSMINFREE 8 * 1024 * 1024 /* 8 Megabytes */
+
+extern size_t  hyprlofs_minfree;		/* Anonymous memory in pages */
+
+extern	void	hyprlofs_node_init(hlfsmount_t *, hlnode_t *, vattr_t *,
+		    cred_t *);
+extern	int	hyprlofs_dirlookup(hlnode_t *, char *, hlnode_t **, cred_t *);
+extern	int	hyprlofs_dirdelete(hlnode_t *, hlnode_t *, char *, enum dr_op,
+		    cred_t *);
+extern	void	hyprlofs_dirinit(hlnode_t *, hlnode_t *);
+extern	void	hyprlofs_dirtrunc(hlnode_t *);
+extern	int	hyprlofs_taccess(void *, int, cred_t *);
+extern	int	hyprlofs_direnter(hlfsmount_t *, hlnode_t *, char *, enum de_op,
+		    vnode_t *, vattr_t *, hlnode_t **, cred_t *);
+
+extern struct vnodeops *hyprlofs_vnodeops;
+extern const struct fs_operation_def hyprlofs_vnodeops_template[];
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_FS_HYPRLOFS_INFO_H */
diff --git a/usr/src/uts/common/sys/fs/sdev_impl.h b/usr/src/uts/common/sys/fs/sdev_impl.h
index 9f9ce5c8c1..d1c5f674f1 100644
--- a/usr/src/uts/common/sys/fs/sdev_impl.h
+++ b/usr/src/uts/common/sys/fs/sdev_impl.h
@@ -37,6 +37,7 @@ extern "C" {
 #include <sys/vfs_opreg.h>
 #include <sys/list.h>
 #include <sys/nvpair.h>
+#include <sys/fs/sdev_plugin.h>
 #include <sys/sunddi.h>
 
 /*
@@ -129,6 +130,21 @@ typedef struct sdev_local_data {
 	struct sdev_dprof sdev_lprof;	/* profile for multi-inst */
 } sdev_local_data_t;
 
+/* sdev_flags */
+typedef enum sdev_flags {
+	SDEV_BUILD =		0x0001,	/* directory cache out-of-date */
+	SDEV_GLOBAL =		0x0002,	/* global /dev nodes */
+	SDEV_PERSIST =		0x0004,	/* backing store persisted node */
+	SDEV_NO_NCACHE = 	0x0008,	/* do not include in neg. cache */
+	SDEV_DYNAMIC =		0x0010,	/* special-purpose vnode ops */
+					/* (ex: pts) */
+	SDEV_VTOR =		0x0020,	/* validate sdev_nodes during search */
+	SDEV_ATTR_INVALID =	0x0040,	/* invalid node attributes, */
+					/* need update */
+	SDEV_SUBDIR =		0x0080,	/* match all subdirs under here */
+	SDEV_ZONED =		0x0100	/* zoned subdir */
+} sdev_flags_t;
+
 /*
  * /dev filesystem sdev_node defines
  */
@@ -151,7 +167,7 @@ typedef struct sdev_node {
 	ino64_t		sdev_ino;	/* inode */
 	uint_t		sdev_nlink;	/* link count */
 	int		sdev_state;	/* state of this node */
-	int		sdev_flags;	/* flags bit */
+	sdev_flags_t	sdev_flags;	/* flags bit */
 
 	kmutex_t	sdev_lookup_lock; /* node creation synch lock */
 	kcondvar_t	sdev_lookup_cv;	/* node creation sync cv */
@@ -162,7 +178,7 @@ typedef struct sdev_node {
 		struct sdev_global_data	sdev_globaldata;
 		struct sdev_local_data	sdev_localdata;
 	} sdev_instance_data;
-
+	list_node_t	sdev_plist;	/* link on plugin list */
 	void		*sdev_private;
 } sdev_node_t;
 
@@ -193,29 +209,11 @@ typedef enum {
 	SDEV_READY
 } sdev_node_state_t;
 
-/* sdev_flags */
-#define	SDEV_BUILD		0x0001	/* directory cache out-of-date */
-#define	SDEV_GLOBAL		0x0002	/* global /dev nodes */
-#define	SDEV_PERSIST		0x0004	/* backing store persisted node */
-#define	SDEV_NO_NCACHE		0x0008	/* do not include in neg. cache */
-#define	SDEV_DYNAMIC		0x0010	/* special-purpose vnode ops */
-					/* (ex: pts) */
-#define	SDEV_VTOR		0x0020	/* validate sdev_nodes during search */
-#define	SDEV_ATTR_INVALID	0x0040	/* invalid node attributes, */
-					/* need update */
-#define	SDEV_SUBDIR		0x0080	/* match all subdirs under here */
-#define	SDEV_ZONED		0x0100  /* zoned subdir */
-
 /* sdev_lookup_flags */
 #define	SDEV_LOOKUP	0x0001	/* node creation in progress */
 #define	SDEV_READDIR	0x0002	/* VDIR readdir in progress */
 #define	SDEV_LGWAITING	0x0004	/* waiting for devfsadm completion */
 
-#define	SDEV_VTOR_INVALID	-1
-#define	SDEV_VTOR_SKIP		0
-#define	SDEV_VTOR_VALID		1
-#define	SDEV_VTOR_STALE		2
-
 /* convenient macros */
 #define	SDEV_IS_GLOBAL(dv)	\
 	(dv->sdev_flags & SDEV_GLOBAL)
@@ -368,8 +366,13 @@ extern void sdev_devfsadmd_thread(struct sdev_node *, struct sdev_node *,
 extern int devname_profile_update(char *, size_t);
 extern struct sdev_data *sdev_find_mntinfo(char *);
 void sdev_mntinfo_rele(struct sdev_data *);
+typedef void (*sdev_mnt_walk_f)(struct sdev_node *, void *);
+void sdev_mnt_walk(sdev_mnt_walk_f, void *);
 extern struct vnodeops *devpts_getvnodeops(void);
 extern struct vnodeops *devvt_getvnodeops(void);
+extern void sdev_plugin_nodeready(struct sdev_node *);
+extern int sdev_plugin_init(void);
+extern int sdev_plugin_fini(void);
 
 /*
  * boot states - warning, the ordering here is significant
@@ -515,6 +518,23 @@ extern void sdev_nc_path_exists(sdev_nc_list_t *, char *);
 extern void sdev_modctl_dump_files(void);
 
 /*
+ * plugin and legacy vtab stuff
+ */
+/* directory dependent vop table */
+typedef struct sdev_vop_table {
+	char *vt_name;				/* subdirectory name */
+	const fs_operation_def_t *vt_service;	/* vnodeops table */
+	struct vnodeops **vt_global_vops;	/* global container for vop */
+	int (*vt_vtor)(struct sdev_node *);	/* validate sdev_node */
+	int vt_flags;
+} sdev_vop_table_t;
+
+extern struct sdev_vop_table vtab[];
+extern struct vnodeops *sdev_get_vop(struct sdev_node *);
+extern void sdev_set_no_negcache(struct sdev_node *);
+extern void *sdev_get_vtor(struct sdev_node *dv);
+
+/*
  * globals
  */
 extern kmutex_t sdev_lock;
@@ -527,6 +547,7 @@ extern struct vnodeops		*devipnet_vnodeops;
 extern struct vnodeops		*devvt_vnodeops;
 extern struct sdev_data *sdev_origins; /* mount info for global /dev instance */
 extern struct vnodeops		*devzvol_vnodeops;
+extern int			sdev_vnodeops_tbl_size;
 
 extern const fs_operation_def_t	sdev_vnodeops_tbl[];
 extern const fs_operation_def_t	devpts_vnodeops_tbl[];
diff --git a/usr/src/uts/common/sys/fs/sdev_plugin.h b/usr/src/uts/common/sys/fs/sdev_plugin.h
new file mode 100644
index 0000000000..f4ed813c1e
--- /dev/null
+++ b/usr/src/uts/common/sys/fs/sdev_plugin.h
@@ -0,0 +1,106 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+#ifndef _SYS_SDEV_PLUGIN_H
+#define	_SYS_SDEV_PLUGIN_H
+
+/*
+ * Kernel sdev plugin interface
+ */
+
+#ifdef _KERNEL
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/vnode.h>
+
+#endif	/* _KERNEL */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef _KERNEL
+
+typedef uintptr_t sdev_plugin_hdl_t;
+typedef uintptr_t sdev_ctx_t;
+
+/*
+ * Valid return values for sdev_plugin_validate_t.
+ */
+typedef enum sdev_plugin_validate {
+	SDEV_VTOR_INVALID = -1,
+	SDEV_VTOR_SKIP = 0,
+	SDEV_VTOR_VALID	= 1,
+	SDEV_VTOR_STALE	= 2
+} sdev_plugin_validate_t;
+
+/*
+ * Valid flags
+ */
+typedef enum sdev_plugin_flags {
+	SDEV_PLUGIN_NO_NCACHE = 0x1,
+	SDEV_PLUGIN_SUBDIR = 0x2
+} sdev_plugin_flags_t;
+
+#define	SDEV_PLUGIN_FLAGS_MASK	0x3
+
+/*
+ * Functions a module must implement
+ */
+typedef sdev_plugin_validate_t (*sp_valid_f)(sdev_ctx_t);
+typedef int (*sp_filldir_f)(sdev_ctx_t);
+typedef void (*sp_inactive_f)(sdev_ctx_t);
+
+#define	SDEV_PLUGIN_VERSION	1
+
+typedef struct sdev_plugin_ops {
+	int spo_version;
+	sdev_plugin_flags_t spo_flags;
+	sp_valid_f spo_validate;
+	sp_filldir_f spo_filldir;
+	sp_inactive_f spo_inactive;
+} sdev_plugin_ops_t;
+
+extern sdev_plugin_hdl_t sdev_plugin_register(const char *, sdev_plugin_ops_t *,
+    int *);
+extern int sdev_plugin_unregister(sdev_plugin_hdl_t);
+
+typedef enum sdev_ctx_flags {
+	SDEV_CTX_GLOBAL = 0x2	/* node belongs to the GZ */
+} sdev_ctx_flags_t;
+
+/*
+ * Context helper functions
+ */
+extern sdev_ctx_flags_t sdev_ctx_flags(sdev_ctx_t);
+extern const char *sdev_ctx_name(sdev_ctx_t);
+extern const char *sdev_ctx_path(sdev_ctx_t);
+extern int sdev_ctx_minor(sdev_ctx_t, minor_t *);
+extern enum vtype sdev_ctx_vtype(sdev_ctx_t);
+
+/*
+ * Callbacks to manipulate nodes
+ */
+extern int sdev_plugin_mkdir(sdev_ctx_t, char *);
+extern int sdev_plugin_mknod(sdev_ctx_t, char *, mode_t, dev_t);
+
+#endif	/* _KERNEL */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_SDEV_PLUGIN_H */
diff --git a/usr/src/uts/common/sys/fs/tmp.h b/usr/src/uts/common/sys/fs/tmp.h
index fb07de6588..f4cee09244 100644
--- a/usr/src/uts/common/sys/fs/tmp.h
+++ b/usr/src/uts/common/sys/fs/tmp.h
@@ -23,7 +23,7 @@
  * All rights reserved.  Use is subject to license terms.
  */
 /*
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef	_SYS_FS_TMP_H
@@ -43,8 +43,10 @@ struct tmount {
 	struct vfs	*tm_vfsp;	/* filesystem's vfs struct */
 	struct tmpnode	*tm_rootnode;	/* root tmpnode */
 	char 		*tm_mntpath;	/* name of tmpfs mount point */
-	ulong_t		tm_anonmax;	/* file system max anon reservation */
-	pgcnt_t		tm_anonmem;	/* pages of reserved anon memory */
+	size_t		tm_anonmax;	/* file system max anon reservation */
+	size_t		tm_anonmem;	/* bytes of reserved anon memory */
+					/* and allocated kmem for the fs */
+	size_t		tm_allocmem;	/* bytes alloced from tmp_kmem_ funcs */
 	dev_t		tm_dev;		/* unique dev # of mounted `device' */
 	uint_t		tm_gen;		/* pseudo generation number for files */
 	kmutex_t	tm_contents;	/* lock for tmount structure */
@@ -58,6 +60,7 @@ struct tmount {
 #define	VTOTM(vp)		((struct tmount *)(vp)->v_vfsp->vfs_data)
 #define	VTOTN(vp)		((struct tmpnode *)(vp)->v_data)
 #define	TNTOV(tp)		((tp)->tn_vnode)
+#define	TNTOTM(tp)		(VTOTM(TNTOV(tp)))
 #define	tmpnode_hold(tp)	VN_HOLD(TNTOV(tp))
 #define	tmpnode_rele(tp)	VN_RELE(TNTOV(tp))
 
@@ -69,41 +72,39 @@ enum dr_op	{ DR_REMOVE, DR_RMDIR, DR_RENAME };	/* dirremove ops */
 
 /*
  * tmpfs_minfree is the amount (in pages) of anonymous memory that tmpfs
- * leaves free for the rest of the system.  E.g. in a system with 32MB of
- * configured swap space, if 16MB were reserved (leaving 16MB free),
- * tmpfs could allocate up to 16MB - tmpfs_minfree.  The default value
- * for tmpfs_minfree is btopr(TMPMINFREE) but it can cautiously patched
- * to a different number of pages.
- * NB: If tmpfs allocates too much swap space, other processes will be
- * unable to execute.
+ * leaves free for the rest of the system.  In antiquity, this number could be
+ * relevant on a system-wide basis, as physical DRAM was routinely exhausted;
+ * however, in more modern times, the relative growth of DRAM with respect to
+ * application footprint means that this number is only likely to become
+ * factor in a virtualized OS environment (e.g., a zone) -- and even then only
+ * when DRAM and swap have both been capped low to allow for maximum tenancy.
+ * TMPMINFREE -- the value from which tmpfs_minfree is derived -- should
+ * therefore be configured to a value that is roughly the smallest practical
+ * value for memory + swap minus the largest reasonable size for tmpfs in such
+ * a configuration.  As of this writing, the smallest practical memory + swap
+ * configuration is 128MB, and it seems reasonable to allow tmpfs to consume
+ * no more than seven-eighths of this, yielding a TMPMINFREE of 16MB.  Care
+ * should be exercised in changing this:  tuning this value too high will
+ * result in spurious ENOSPC errors in tmpfs in small zones (a problem that
+ * can induce cascading failure surprisingly often); tuning this value too low
+ * will result in tmpfs consumption alone to alone induce application-level
+ * memory allocation failure.
  */
-#define	TMPMINFREE	2 * 1024 * 1024	/* 2 Megabytes */
+#define	TMPMINFREE	16 * 1024 * 1024	/* 16 Megabytes */
 
 extern size_t	tmpfs_minfree;		/* Anonymous memory in pages */
 
-/*
- * tmpfs can allocate only a certain percentage of kernel memory,
- * which is used for tmpnodes, directories, file names, etc.
- * This is statically set as TMPMAXFRACKMEM of physical memory.
- * The actual number of allocatable bytes can be patched in tmpfs_maxkmem.
- */
-#define	TMPMAXFRACKMEM	25	/* 1/25 of physical memory */
-
-extern size_t 	tmp_kmemspace;
-extern size_t	tmpfs_maxkmem;	/* Allocatable kernel memory in bytes */
-
 extern	void	tmpnode_init(struct tmount *, struct tmpnode *,
 	struct vattr *, struct cred *);
+extern	void	tmpnode_cleanup(struct tmpnode *tp);
 extern	int	tmpnode_trunc(struct tmount *, struct tmpnode *, ulong_t);
 extern	void	tmpnode_growmap(struct tmpnode *, ulong_t);
 extern	int	tdirlookup(struct tmpnode *, char *, struct tmpnode **,
     struct cred *);
 extern	int	tdirdelete(struct tmpnode *, struct tmpnode *, char *,
 	enum dr_op, struct cred *);
-extern	void	tdirinit(struct tmpnode *, struct tmpnode *);
+extern	int	tdirinit(struct tmpnode *, struct tmpnode *);
 extern	void	tdirtrunc(struct tmpnode *);
-extern	void	*tmp_memalloc(size_t, int);
-extern	void	tmp_memfree(void *, size_t);
 extern	int	tmp_resv(struct tmount *, struct tmpnode *, size_t, int);
 extern	int	tmp_taccess(void *, int, struct cred *);
 extern	int	tmp_sticky_remove_access(struct tmpnode *, struct tmpnode *,
@@ -114,6 +115,9 @@ extern	int	tdirenter(struct tmount *, struct tmpnode *, char *,
 	enum de_op, struct tmpnode *, struct tmpnode *, struct vattr *,
 	struct tmpnode **, struct cred *, caller_context_t *);
 
+extern void	*tmp_kmem_zalloc(struct tmount *, size_t, int);
+extern void	tmp_kmem_free(struct tmount *, void *, size_t);
+
 #define	TMP_MUSTHAVE	0x01
 
 #ifdef	__cplusplus
diff --git a/usr/src/uts/common/sys/fx.h b/usr/src/uts/common/sys/fx.h
index 2d4e1aa7fb..4a48af52a1 100644
--- a/usr/src/uts/common/sys/fx.h
+++ b/usr/src/uts/common/sys/fx.h
@@ -21,13 +21,12 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef _SYS_FX_H
 #define	_SYS_FX_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <sys/thread.h>
 #include <sys/ddi.h>
@@ -145,7 +144,14 @@ typedef struct	fxkparms {
 	uint_t	fx_cflags;
 } fxkparms_t;
 
+/*
+ * control flags (kparms->fx_cflags).
+ */
+#define	FX_DOUPRILIM	0x01	/* change user priority limit */
+#define	FX_DOUPRI	0x02	/* change user priority */
+#define	FX_DOTQ		0x04	/* change FX time quantum */
 
+#define	FXMAXUPRI	60	/* maximum user priority setting */
 
 /*
  * Interface for partner private code. This is not a public interface.
diff --git a/usr/src/uts/common/sys/gsqueue.h b/usr/src/uts/common/sys/gsqueue.h
new file mode 100644
index 0000000000..91ab46fc44
--- /dev/null
+++ b/usr/src/uts/common/sys/gsqueue.h
@@ -0,0 +1,59 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _SYS_GSQUEUE_H
+#define	_SYS_GSQUEUE_H
+
+/*
+ * Standard interfaces to serializaion queues for everyone (except IP).
+ */
+
+#include <sys/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef _KERNEL
+
+typedef struct gsqueue gsqueue_t;
+typedef struct gsqueue_set gsqueue_set_t;
+
+typedef void (*gsqueue_cb_f)(gsqueue_set_t *, gsqueue_t *, void *, boolean_t);
+typedef void (*gsqueue_proc_f)(void *, mblk_t *, gsqueue_t *, void *);
+
+extern gsqueue_set_t *gsqueue_set_create(pri_t);
+extern void gsqueue_set_destroy(gsqueue_set_t *);
+extern gsqueue_t *gsqueue_set_get(gsqueue_set_t *, uint_t);
+
+extern uintptr_t gsqueue_set_cb_add(gsqueue_set_t *, gsqueue_cb_f, void *);
+extern int gsqueue_set_cb_remove(gsqueue_set_t *, uintptr_t);
+
+#define	GSQUEUE_FILL	0x0001
+#define	GSQUEUE_NODRAIN	0x0002
+#define	GSQUEUE_PROCESS	0x0004
+
+extern void gsqueue_enter_one(gsqueue_t *, mblk_t *, gsqueue_proc_f, void *,
+    int, uint8_t);
+
+#define	GSQUEUE_DEFAULT_PRIORITY	MAXCLSYSPRI
+
+#endif	/* _KERNEL */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_GSQUEUE_H */
diff --git a/usr/src/uts/common/sys/id_space.h b/usr/src/uts/common/sys/id_space.h
index d56fcceb5a..46d25f207f 100644
--- a/usr/src/uts/common/sys/id_space.h
+++ b/usr/src/uts/common/sys/id_space.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, Joyent, Inc.  All Rights reserved.
  */
 
 #ifndef	_ID_SPACE_H
@@ -34,8 +35,6 @@ extern "C" {
 #include <sys/mutex.h>
 #include <sys/vmem.h>
 
-#ifdef _KERNEL
-
 typedef vmem_t id_space_t;
 
 id_space_t *id_space_create(const char *, id_t, id_t);
@@ -48,8 +47,6 @@ id_t id_allocff_nosleep(id_space_t *);
 id_t id_alloc_specific_nosleep(id_space_t *, id_t);
 void id_free(id_space_t *, id_t);
 
-#endif /* _KERNEL */
-
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/uts/common/sys/inotify.h b/usr/src/uts/common/sys/inotify.h
new file mode 100644
index 0000000000..8acc1a7280
--- /dev/null
+++ b/usr/src/uts/common/sys/inotify.h
@@ -0,0 +1,153 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+/*
+ * Header file to support for the inotify facility.  Note that this facility
+ * is designed to be binary compatible with the Linux inotify facility; values
+ * for constants here should therefore exactly match those found in Linux, and
+ * this facility shouldn't be extended independently of Linux.
+ */
+
+#ifndef _SYS_INOTIFY_H
+#define	_SYS_INOTIFY_H
+
+#include <sys/types.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Events that can be explicitly requested on any inotify watch.
+ */
+#define	IN_ACCESS		0x00000001
+#define	IN_MODIFY		0x00000002
+#define	IN_ATTRIB		0x00000004
+#define	IN_CLOSE_WRITE		0x00000008
+#define	IN_CLOSE_NOWRITE	0x00000010
+#define	IN_OPEN			0x00000020
+#define	IN_MOVED_FROM		0x00000040
+#define	IN_MOVED_TO		0x00000080
+#define	IN_CREATE		0x00000100
+#define	IN_DELETE		0x00000200
+#define	IN_DELETE_SELF		0x00000400
+#define	IN_MOVE_SELF		0x00000800
+
+/*
+ * Events that can be sent to an inotify watch -- requested or not.
+ */
+#define	IN_UNMOUNT		0x00002000
+#define	IN_Q_OVERFLOW		0x00004000
+#define	IN_IGNORED		0x00008000
+
+/*
+ * Flags that can modify an inotify event.
+ */
+#define	IN_ONLYDIR		0x01000000
+#define	IN_DONT_FOLLOW		0x02000000
+#define	IN_EXCL_UNLINK		0x04000000
+#define	IN_MASK_ADD		0x20000000
+#define	IN_ISDIR		0x40000000
+#define	IN_ONESHOT		0x80000000
+
+/*
+ * Helpful constants.
+ */
+#define	IN_CLOSE		(IN_CLOSE_WRITE | IN_CLOSE_NOWRITE)
+#define	IN_MOVE			(IN_MOVED_FROM | IN_MOVED_TO)
+#define	IN_ALL_EVENTS		\
+	(IN_ACCESS | IN_MODIFY | IN_ATTRIB | IN_CLOSE_WRITE | \
+	IN_CLOSE_NOWRITE | IN_OPEN | IN_MOVED_FROM | IN_MOVED_TO | \
+	IN_DELETE | IN_CREATE | IN_DELETE_SELF | IN_MOVE_SELF)
+
+#define	IN_CHILD_EVENTS		\
+	(IN_ACCESS | IN_MODIFY | IN_ATTRIB | IN_CLOSE_WRITE | \
+	IN_CLOSE_NOWRITE | IN_MODIFY | IN_OPEN)
+
+/*
+ * To assure binary compatibility with Linux, these values are fixed at their
+ * Linux equivalents, not their native ones.
+ */
+#define	IN_CLOEXEC		02000000		/* LX_O_CLOEXEC */
+#define	IN_NONBLOCK		04000			/* LX_O_NONBLOCK */
+
+struct inotify_event {
+	int32_t		wd;		/* watch descriptor */
+	uint32_t	mask;		/* mask of events */
+	uint32_t	cookie;		/* event association cookie, if any */
+	uint32_t	len;		/* size of name field */
+	char		name[];		/* optional NUL-terminated name */
+};
+
+/*
+ * These ioctl values are specific to the native implementation; applications
+ * shouldn't be using them directly, and they should therefore be safe to
+ * change without breaking apps.
+ */
+#define	INOTIFYIOC		(('i' << 24) | ('n' << 16) | ('y' << 8))
+#define	INOTIFYIOC_ADD_WATCH	(INOTIFYIOC | 1)	/* add watch */
+#define	INOTIFYIOC_RM_WATCH	(INOTIFYIOC | 2)	/* remove watch */
+#define	INOTIFYIOC_ADD_CHILD	(INOTIFYIOC | 3)	/* add child watch */
+#define	INOTIFYIOC_ACTIVATE	(INOTIFYIOC | 4)	/* activate watch */
+
+#ifndef _LP64
+#ifndef _LITTLE_ENDIAN
+#define	INOTIFY_PTR(type, name)	uint32_t name##pad; type *name
+#else
+#define	INOTIFY_PTR(type, name)	type *name; uint32_t name##pad
+#endif
+#else
+#define	INOTIFY_PTR(type, name)	type *name
+#endif
+
+typedef struct inotify_addwatch {
+	int inaw_fd;			/* open fd for object */
+	uint32_t inaw_mask;		/* desired mask */
+} inotify_addwatch_t;
+
+typedef struct inotify_addchild {
+	INOTIFY_PTR(char, inac_name);	/* pointer to name */
+	int inac_fd;			/* open fd for parent */
+} inotify_addchild_t;
+
+#ifndef _KERNEL
+
+extern int inotify_init(void);
+extern int inotify_init1(int);
+extern int inotify_add_watch(int, const char *, uint32_t);
+extern int inotify_rm_watch(int, int);
+
+#else
+
+#define	IN_UNMASKABLE \
+	(IN_UNMOUNT | IN_Q_OVERFLOW | IN_IGNORED | IN_ISDIR)
+
+#define	IN_MODIFIERS \
+	(IN_EXCL_UNLINK | IN_ONESHOT)
+
+#define	IN_FLAGS \
+	(IN_ONLYDIR | IN_DONT_FOLLOW | IN_MASK_ADD)
+
+#define	IN_REMOVAL		(1ULL << 32)
+#define	INOTIFYMNRN_INOTIFY	0
+#define	INOTIFYMNRN_CLONE	1
+
+#endif /* _KERNEL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_INOTIFY_H */
diff --git a/usr/src/uts/common/sys/ipc_impl.h b/usr/src/uts/common/sys/ipc_impl.h
index 0569c3e967..d7dc365c09 100644
--- a/usr/src/uts/common/sys/ipc_impl.h
+++ b/usr/src/uts/common/sys/ipc_impl.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016, Joyent, Inc.
  */
 
 #ifndef	_IPC_IMPL_H
@@ -226,6 +227,7 @@ int ipc_commit_begin(ipc_service_t *, key_t, int, kipc_perm_t *);
 kmutex_t *ipc_commit_end(ipc_service_t *, kipc_perm_t *);
 void ipc_cleanup(ipc_service_t *, kipc_perm_t *);
 
+void ipc_rmsvc(ipc_service_t *, kipc_perm_t *);
 int ipc_rmid(ipc_service_t *, int, cred_t *);
 int ipc_ids(ipc_service_t *, int *, uint_t, uint_t *);
 
diff --git a/usr/src/uts/common/sys/ipd.h b/usr/src/uts/common/sys/ipd.h
index bad74f8b81..f21c3fb5af 100644
--- a/usr/src/uts/common/sys/ipd.h
+++ b/usr/src/uts/common/sys/ipd.h
@@ -20,7 +20,7 @@
  */
 
 /*
- * Copyright (c) 2012, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc. All rights reserved.
  */
 
 /*
@@ -35,7 +35,7 @@ extern "C" {
 #endif
 
 #define	IPD_DEV_PATH	"/dev/ipd"
-#define	IPD_MAX_DELAY	10000		/* 10 ms in us */
+#define	IPD_MAX_DELAY	1000000		/* 1 second in microseconds */
 
 typedef struct ipd_ioc_perturb {
 	zoneid_t	ipip_zoneid;
diff --git a/usr/src/uts/common/sys/iso/signal_iso.h b/usr/src/uts/common/sys/iso/signal_iso.h
index bf89ef0d33..0a76ee19a7 100644
--- a/usr/src/uts/common/sys/iso/signal_iso.h
+++ b/usr/src/uts/common/sys/iso/signal_iso.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -95,7 +96,7 @@ extern "C" {
 
 /* insert new signals here, and move _SIGRTM* appropriately */
 #define	_SIGRTMIN 42	/* first (highest-priority) realtime signal */
-#define	_SIGRTMAX 73	/* last (lowest-priority) realtime signal */
+#define	_SIGRTMAX 74	/* last (lowest-priority) realtime signal */
 extern long _sysconf(int);	/* System Private interface to sysconf() */
 #define	SIGRTMIN ((int)_sysconf(_SC_SIGRT_MIN))	/* first realtime signal */
 #define	SIGRTMAX ((int)_sysconf(_SC_SIGRT_MAX))	/* last realtime signal */
diff --git a/usr/src/uts/common/sys/klwp.h b/usr/src/uts/common/sys/klwp.h
index 41b70f6a6e..0ea1a396b9 100644
--- a/usr/src/uts/common/sys/klwp.h
+++ b/usr/src/uts/common/sys/klwp.h
@@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2013, Joyent, Inc. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef	_SYS_KLWP_H
@@ -191,7 +191,14 @@ typedef struct _klwp {
 	struct ct_template *lwp_ct_active[CTT_MAXTYPE]; /* active templates */
 	struct contract	*lwp_ct_latest[CTT_MAXTYPE]; /* last created contract */
 
-	void	*lwp_brand;		/* per-lwp brand data */
+	/*
+	 * Branding:
+	 * lwp_brand			- per-lwp brand data
+	 * lwp_brand_syscall		- brand syscall interposer
+	 */
+	void	*lwp_brand;
+	int	(*lwp_brand_syscall)(void);
+
 	struct psinfo *lwp_spymaster;	/* if an agent LWP, our spymaster */
 } klwp_t;
 
diff --git a/usr/src/uts/common/sys/kobj.h b/usr/src/uts/common/sys/kobj.h
index 2396ef4625..d52a54f6b7 100644
--- a/usr/src/uts/common/sys/kobj.h
+++ b/usr/src/uts/common/sys/kobj.h
@@ -24,6 +24,9 @@
  *
  * Copyright 2017 RackTop Systems.
  */
+/*
+ * Copyright (c) 2017 Joyent, Inc.
+ */
 
 #ifndef _SYS_KOBJ_H
 #define	_SYS_KOBJ_H
@@ -47,6 +50,12 @@ struct module_list {
 	struct module *mp;
 };
 
+typedef struct hotinline_desc {
+	char	*hid_symname;		/* symbol name */
+	uintptr_t hid_instr_offset;	/* offset of call in text */
+	struct hotinline_desc *hid_next;	/* next hotinline */
+} hotinline_desc_t;
+
 typedef unsigned short	symid_t;		/* symbol table index */
 typedef unsigned char	*reloc_dest_t;
 
@@ -99,6 +108,8 @@ struct module {
 	caddr_t textwin;
 	caddr_t textwin_base;
 
+	hotinline_desc_t *hi_calls;
+
 	sdt_probedesc_t *sdt_probes;
 	size_t sdt_nprobes;
 	char *sdt_tab;
@@ -187,6 +198,7 @@ extern int kobj_read_file(struct _buf *, char *, unsigned, unsigned);
 extern int kobj_get_filesize(struct _buf *, uint64_t *size);
 extern uintptr_t kobj_getelfsym(char *, void *, int *);
 extern void kobj_set_ctf(struct module *, caddr_t data, size_t size);
+extern void do_hotinlines(struct module *);
 
 extern int kobj_filbuf(struct _buf *);
 extern void kobj_sync(void);
diff --git a/usr/src/uts/common/sys/ksocket.h b/usr/src/uts/common/sys/ksocket.h
index 5d8827f1ae..d720caa631 100644
--- a/usr/src/uts/common/sys/ksocket.h
+++ b/usr/src/uts/common/sys/ksocket.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #ifndef _SYS_KSOCKET_H_
@@ -122,6 +123,11 @@ extern int 	ksocket_close(ksocket_t, struct cred *);
 extern void	ksocket_hold(ksocket_t);
 extern void	ksocket_rele(ksocket_t);
 
+typedef boolean_t (*ksocket_krecv_f)(ksocket_t, struct msgb *, size_t, int,
+		    void *);
+extern int	ksocket_krecv_set(ksocket_t, ksocket_krecv_f, void *);
+extern void	ksocket_krecv_unblock(ksocket_t);
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/uts/common/sys/limits.h b/usr/src/uts/common/sys/limits.h
new file mode 100644
index 0000000000..88625d1829
--- /dev/null
+++ b/usr/src/uts/common/sys/limits.h
@@ -0,0 +1,32 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+/*
+ * Copyright 2015 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _SYS_LIMITS_H
+#define	_SYS_LIMITS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	IOV_MAX	1024
+
+#ifdef _KERNEL
+#define	IOV_MAX_STACK	16	/* max. IOV on-stack allocation */
+#endif /* _KERNEL */
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_LIMITS_H */
diff --git a/usr/src/uts/common/sys/mac.h b/usr/src/uts/common/sys/mac.h
index f3e22d660c..a1ee3e3c70 100644
--- a/usr/src/uts/common/sys/mac.h
+++ b/usr/src/uts/common/sys/mac.h
@@ -101,6 +101,14 @@ typedef struct mac_propval_uint32_range_s {
 } mac_propval_uint32_range_t;
 
 /*
+ * Defines ranges which are a series of C style strings.
+ */
+typedef struct mac_propval_str_range_s {
+	uint32_t mpur_nextbyte;
+	char mpur_data[1];
+} mac_propval_str_range_t;
+
+/*
  * Data type of property values.
  */
 typedef enum {
@@ -120,6 +128,7 @@ typedef struct mac_propval_range_s {
 	mac_propval_type_t mpr_type;		/* type of value */
 	union {
 		mac_propval_uint32_range_t mpr_uint32[1];
+		mac_propval_str_range_t mpr_str;
 	} u;
 } mac_propval_range_t;
 
diff --git a/usr/src/uts/common/sys/mac_client.h b/usr/src/uts/common/sys/mac_client.h
index 0fc4939503..b6040ad679 100644
--- a/usr/src/uts/common/sys/mac_client.h
+++ b/usr/src/uts/common/sys/mac_client.h
@@ -22,7 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2013 Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -88,6 +88,7 @@ typedef enum {
 } mac_client_promisc_type_t;
 
 /* flags passed to mac_unicast_add() */
+
 #define	MAC_UNICAST_NODUPCHECK			0x0001
 #define	MAC_UNICAST_PRIMARY			0x0002
 #define	MAC_UNICAST_HW				0x0004
@@ -115,6 +116,7 @@ typedef enum {
 #define	MAC_PROMISC_FLAGS_NO_PHYS		0x0002
 #define	MAC_PROMISC_FLAGS_VLAN_TAG_STRIP	0x0004
 #define	MAC_PROMISC_FLAGS_NO_COPY		0x0008
+#define	MAC_PROMISC_FLAGS_DO_FIXUPS		0x0010
 
 /* flags passed to mac_tx() */
 #define	MAC_DROP_ON_NO_DESC	0x01 /* freemsg() if no tx descs */
diff --git a/usr/src/uts/common/sys/mac_client_impl.h b/usr/src/uts/common/sys/mac_client_impl.h
index 9b3b4fe369..d64b895304 100644
--- a/usr/src/uts/common/sys/mac_client_impl.h
+++ b/usr/src/uts/common/sys/mac_client_impl.h
@@ -24,7 +24,7 @@
  * Copyright (c) 2012, Joyent, Inc.  All rights reserved.
  */
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef	_SYS_MAC_CLIENT_IMPL_H
@@ -57,7 +57,7 @@ typedef struct mac_unicast_impl_s {			/* Protected by */
 	uint16_t			mui_vid;	/* SL */
 } mac_unicast_impl_t;
 
-#define	MAC_CLIENT_FLAGS_PRIMARY		0X0001
+#define	MAC_CLIENT_FLAGS_PRIMARY		0x0001
 #define	MAC_CLIENT_FLAGS_VNIC_PRIMARY		0x0002
 #define	MAC_CLIENT_FLAGS_MULTI_PRIMARY		0x0004
 #define	MAC_CLIENT_FLAGS_PASSIVE_PRIMARY	0x0008
@@ -83,6 +83,7 @@ typedef struct mac_promisc_impl_s {			/* Protected by */
 	boolean_t			mpi_no_phys;	/* WO */
 	boolean_t			mpi_strip_vlan_tag;	/* WO */
 	boolean_t			mpi_no_copy;	/* WO */
+	boolean_t			mpi_do_fixups;	/* WO */
 } mac_promisc_impl_t;
 
 typedef union mac_tx_percpu_s {
@@ -131,12 +132,17 @@ struct mac_client_impl_s {			/* Protected by */
 	uint32_t		mci_flags;		/* SL */
 	krwlock_t		mci_rw_lock;
 	mac_unicast_impl_t	*mci_unicast_list;	/* mci_rw_lock */
+
 	/*
 	 * The mac_client_impl_t may be shared by multiple clients, i.e
 	 * multiple VLANs sharing the same MAC client. In this case the
-	 * address/vid tubles differ and are each associated with their
+	 * address/vid tuples differ and are each associated with their
 	 * own flow entry, but the rest underlying components SRS, etc,
 	 * are common.
+	 *
+	 * This is only needed to support sun4v vsw. There are several
+	 * places in MAC we could simplify the code if we removed
+	 * sun4v support.
 	 */
 	flow_entry_t		*mci_flent_list;	/* mci_rw_lock */
 	uint_t			mci_nflents;		/* mci_rw_lock */
@@ -313,6 +319,74 @@ extern	int	mac_tx_percpu_cnt;
 	(((mcip)->mci_state_flags & MCIS_TAG_DISABLE) == 0 &&		\
 	(mcip)->mci_nvids == 1)						\
 
+/*
+ * MAC Client Implementation State (mci_state_flags)
+ *
+ * MCIS_IS_VNIC
+ *
+ *	The client is a VNIC.
+ *
+ * MCIS_EXCLUSIVE
+ *
+ *	The client has exclusive control over the MAC, such that it is
+ *	the sole client of the MAC.
+ *
+ * MCIS_TAG_DISABLE
+ *
+ *	MAC will not add VLAN tags to outgoing traffic. If this flag
+ *	is set it is up to the client to add the correct VLAN tag.
+ *
+ * MCIS_STRIP_DISABLE
+ *
+ *	MAC will not strip the VLAN tags on incoming traffic before
+ *	passing it to mci_rx_fn. This only applies to non-bypass
+ *	traffic.
+ *
+ * MCIS_IS_AGGR_PORT
+ *
+ *	The client represents a port on an aggr.
+ *
+ * MCIS_CLIENT_POLL_CAPABLE
+ *
+ *	The client is capable of polling the Rx TCP/UDP softrings.
+ *
+ * MCIS_DESC_LOGGED
+ *
+ *	This flag is set when the client's link info has been logged
+ *	by the mac_log_linkinfo() timer. This ensures that the
+ *	client's link info is only logged once.
+ *
+ * MCIS_SHARE_BOUND
+ *
+ *	This client has an HIO share bound to it.
+ *
+ * MCIS_DISABLE_TX_VID_CHECK
+ *
+ *	MAC will not check the VID of the client's Tx traffic.
+ *
+ * MCIS_USE_DATALINK_NAME
+ *
+ *	The client is using the same name as its underlying MAC. This
+ *	happens when dlmgmtd is unreachable during client creation.
+ *
+ * MCIS_UNICAST_HW
+ *
+ *	The client requires MAC address hardware classification. This
+ *	is only used by sun4v vsw.
+ *
+ * MCIS_IS_AGGR_CLIENT
+ *
+ *	The client sits atop an aggr.
+ *
+ * MCIS_RX_BYPASS_DISABLE
+ *
+ *	Do not allow the client to enable DLS bypass.
+ *
+ * MCIS_NO_UNICAST_ADDR
+ *
+ *	This client has no MAC unicast addresss associated with it.
+ *
+ */
 /* MCI state flags */
 #define	MCIS_IS_VNIC			0x0001
 #define	MCIS_EXCLUSIVE			0x0002
@@ -325,7 +399,7 @@ extern	int	mac_tx_percpu_cnt;
 #define	MCIS_DISABLE_TX_VID_CHECK	0x0100
 #define	MCIS_USE_DATALINK_NAME		0x0200
 #define	MCIS_UNICAST_HW			0x0400
-#define	MCIS_IS_AGGR			0x0800
+#define	MCIS_IS_AGGR_CLIENT		0x0800
 #define	MCIS_RX_BYPASS_DISABLE		0x1000
 #define	MCIS_NO_UNICAST_ADDR		0x2000
 
@@ -338,7 +412,7 @@ extern void mac_promisc_client_dispatch(mac_client_impl_t *, mblk_t *);
 extern void mac_client_init(void);
 extern void mac_client_fini(void);
 extern void mac_promisc_dispatch(mac_impl_t *, mblk_t *,
-    mac_client_impl_t *);
+    mac_client_impl_t *, boolean_t);
 
 extern int mac_validate_props(mac_impl_t *, mac_resource_props_t *);
 
diff --git a/usr/src/uts/common/sys/mac_client_priv.h b/usr/src/uts/common/sys/mac_client_priv.h
index 6b409513a6..97b3fd685a 100644
--- a/usr/src/uts/common/sys/mac_client_priv.h
+++ b/usr/src/uts/common/sys/mac_client_priv.h
@@ -22,7 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2013 Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -58,6 +58,9 @@ extern const mac_info_t *mac_info(mac_handle_t);
 extern boolean_t mac_info_get(const char *, mac_info_t *);
 extern boolean_t mac_promisc_get(mac_handle_t);
 
+extern boolean_t mac_protect_check_addr(mac_client_handle_t, boolean_t,
+    in6_addr_t *);
+
 extern int mac_start(mac_handle_t);
 extern void mac_stop(mac_handle_t);
 
@@ -121,9 +124,17 @@ extern void mac_tx_client_quiesce(mac_client_handle_t);
 extern void mac_tx_client_condemn(mac_client_handle_t);
 extern void mac_tx_client_restart(mac_client_handle_t);
 extern void mac_srs_perm_quiesce(mac_client_handle_t, boolean_t);
+extern uint_t mac_hwrings_idx_get(mac_handle_t, uint_t, mac_group_handle_t *,
+    mac_ring_handle_t *, mac_ring_type_t);
 extern int mac_hwrings_get(mac_client_handle_t, mac_group_handle_t *,
     mac_ring_handle_t *, mac_ring_type_t);
 extern uint_t mac_hwring_getinfo(mac_ring_handle_t);
+extern void mac_hwring_set_passthru(mac_ring_handle_t, mac_rx_t, void *,
+    mac_resource_handle_t);
+extern void mac_hwring_clear_passthru(mac_ring_handle_t);
+extern void mac_client_set_flow_cb(mac_client_handle_t, mac_rx_t, void *);
+extern void mac_client_clear_flow_cb(mac_client_handle_t);
+
 extern void mac_hwring_setup(mac_ring_handle_t, mac_resource_handle_t,
     mac_ring_handle_t);
 extern void mac_hwring_teardown(mac_ring_handle_t);
@@ -131,6 +142,8 @@ extern int mac_hwring_disable_intr(mac_ring_handle_t);
 extern int mac_hwring_enable_intr(mac_ring_handle_t);
 extern int mac_hwring_start(mac_ring_handle_t);
 extern void mac_hwring_stop(mac_ring_handle_t);
+extern int mac_hwring_activate(mac_ring_handle_t);
+extern void mac_hwring_quiesce(mac_ring_handle_t);
 extern mblk_t *mac_hwring_poll(mac_ring_handle_t, int);
 extern mblk_t *mac_hwring_tx(mac_ring_handle_t, mblk_t *);
 extern int mac_hwring_getstat(mac_ring_handle_t, uint_t, uint64_t *);
@@ -144,6 +157,13 @@ extern void mac_hwring_set_default(mac_handle_t, mac_ring_handle_t);
 
 extern int mac_hwgroup_addmac(mac_group_handle_t, const uint8_t *);
 extern int mac_hwgroup_remmac(mac_group_handle_t, const uint8_t *);
+extern int mac_hwgroup_addvlan(mac_group_handle_t, uint16_t);
+extern int mac_hwgroup_remvlan(mac_group_handle_t, uint16_t);
+
+extern boolean_t mac_has_hw_vlan(mac_handle_t);
+
+extern uint_t mac_get_num_rx_groups(mac_handle_t);
+extern int mac_set_promisc(mac_handle_t, boolean_t);
 
 extern void mac_set_upper_mac(mac_client_handle_t, mac_handle_t,
     mac_resource_props_t *);
@@ -171,6 +191,7 @@ extern void mac_client_set_intr_cpu(void *, mac_client_handle_t, int32_t);
 extern void *mac_get_devinfo(mac_handle_t);
 
 extern boolean_t mac_is_vnic(mac_handle_t);
+extern boolean_t mac_is_overlay(mac_handle_t);
 extern uint32_t mac_no_notification(mac_handle_t);
 
 extern int mac_set_prop(mac_handle_t, mac_prop_id_t, char *, void *, uint_t);
diff --git a/usr/src/uts/common/sys/mac_flow.h b/usr/src/uts/common/sys/mac_flow.h
index e290ba7dbe..d37752ec23 100644
--- a/usr/src/uts/common/sys/mac_flow.h
+++ b/usr/src/uts/common/sys/mac_flow.h
@@ -22,7 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2013 Joyent, Inc.  All rights reserved.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 #ifndef	_MAC_FLOW_H
@@ -155,6 +155,14 @@ typedef enum {
 #define	MPT_MAXIPADDR		MPT_MAXCNT
 #define	MPT_MAXCID		MPT_MAXCNT
 #define	MPT_MAXCIDLEN		256
+#define	MPT_FALSE		0x00000000
+#define	MPT_TRUE		0x00000001
+
+/* Dynamic address detection types */
+#define	MPT_DYN_DHCPV4		0x00000001
+#define	MPT_DYN_DHCPV6		0x00000002
+#define	MPT_DYN_SLAAC		0x00000004
+#define	MPT_DYN_ALL		0x00000007
 
 typedef struct mac_ipaddr_s {
 	uint32_t	ip_version;
@@ -175,11 +183,13 @@ typedef struct mac_dhcpcid_s {
 } mac_dhcpcid_t;
 
 typedef struct mac_protect_s {
-	uint32_t	mp_types;
-	uint32_t	mp_ipaddrcnt;
-	mac_ipaddr_t	mp_ipaddrs[MPT_MAXIPADDR];
-	uint32_t	mp_cidcnt;
-	mac_dhcpcid_t	mp_cids[MPT_MAXCID];
+	uint32_t	mp_types;	/* Enabled protection types */
+	uint32_t	mp_ipaddrcnt;	/* Count of allowed IPs */
+	mac_ipaddr_t	mp_ipaddrs[MPT_MAXIPADDR]; /* Allowed IPs */
+	uint32_t	mp_cidcnt;	/* Count of allowed DHCP CIDs */
+	mac_dhcpcid_t	mp_cids[MPT_MAXCID]; /* Allowed DHCP CIDs */
+	uint32_t	mp_allcids;	/* Whether to allow all CIDs through */
+	uint32_t	mp_dynamic;	/* Enabled dynamic address methods */
 } mac_protect_t;
 
 /* The default priority for links */
diff --git a/usr/src/uts/common/sys/mac_impl.h b/usr/src/uts/common/sys/mac_impl.h
index 774c4fad9a..17aebffc38 100644
--- a/usr/src/uts/common/sys/mac_impl.h
+++ b/usr/src/uts/common/sys/mac_impl.h
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef	_SYS_MAC_IMPL_H
@@ -208,9 +208,18 @@ struct mac_ring_s {
 	mac_ring_t		*mr_next;	/* next ring in the chain */
 	mac_group_handle_t	mr_gh;		/* reference to group */
 
-	mac_classify_type_t	mr_classify_type;	/* HW vs SW */
+	mac_classify_type_t	mr_classify_type;
 	struct mac_soft_ring_set_s *mr_srs;	/* associated SRS */
-	mac_ring_handle_t	mr_prh;		/* associated pseudo ring hdl */
+	mac_ring_handle_t	mr_prh;	/* associated pseudo ring hdl */
+
+	/*
+	 * Ring passthru callback and arguments. See the
+	 * MAC_PASSTHRU_CLASSIFIER comment in mac_provider.h.
+	 */
+	mac_rx_t		mr_pt_fn;
+	void			*mr_pt_arg1;
+	mac_resource_handle_t	mr_pt_arg2;
+
 	uint_t			mr_refcnt;	/* Ring references */
 	/* ring generation no. to guard against drivers using stale rings */
 	uint64_t		mr_gen_num;
@@ -255,8 +264,8 @@ struct mac_ring_s {
 }
 
 /*
- * Per mac client flow information associated with a RX group.
- * The entire structure is SL protected.
+ * Used to attach MAC clients to an Rx group. The members are SL
+ * protected.
  */
 typedef struct mac_grp_client {
 	struct mac_grp_client		*mgc_next;
@@ -270,15 +279,20 @@ typedef struct mac_grp_client {
 	((g)->mrg_clients->mgc_next == NULL)) ?		\
 	(g)->mrg_clients->mgc_client : NULL)
 
+#define	MAC_GROUP_HW_VLAN(g)				\
+	(((g) != NULL) &&				\
+	((g)->mrg_info.mgi_addvlan != NULL) &&		\
+	((g)->mrg_info.mgi_remvlan != NULL))
+
 /*
  * Common ring group data structure for ring control and management.
- * The entire structure is SL protected
+ * The entire structure is SL protected.
  */
 struct mac_group_s {
 	int			mrg_index;	/* index in the list */
 	mac_ring_type_t		mrg_type;	/* ring type */
 	mac_group_state_t	mrg_state;	/* state of the group */
-	mac_group_t		*mrg_next;	/* next ring in the chain */
+	mac_group_t		*mrg_next;	/* next group in the chain */
 	mac_handle_t		mrg_mh;		/* reference to MAC */
 	mac_ring_t		*mrg_rings;	/* grouped rings */
 	uint_t			mrg_cur_count;	/* actual size of group */
@@ -331,7 +345,7 @@ struct mac_group_s {
 	if ((src_mcip)->mci_state_flags & MCIS_SHARE_BOUND)		\
 		rhandle = (mip)->mi_default_tx_ring;			\
 	if (mip->mi_promisc_list != NULL)				\
-		mac_promisc_dispatch(mip, mp, src_mcip);		\
+		mac_promisc_dispatch(mip, mp, src_mcip, B_TRUE);	\
 	/*								\
 	 * Grab the proper transmit pointer and handle. Special 	\
 	 * optimization: we can test mi_bridge_link itself atomically,	\
@@ -360,17 +374,23 @@ typedef struct mac_mcast_addrs_s {
 } mac_mcast_addrs_t;
 
 typedef enum {
-	MAC_ADDRESS_TYPE_UNICAST_CLASSIFIED = 1,	/* hardware steering */
+	MAC_ADDRESS_TYPE_UNICAST_CLASSIFIED = 1,	/* HW classification */
 	MAC_ADDRESS_TYPE_UNICAST_PROMISC		/* promiscuous mode */
 } mac_address_type_t;
 
+typedef struct mac_vlan_s {
+	struct mac_vlan_s	*mv_next;
+	uint16_t		mv_vid;
+} mac_vlan_t;
+
 typedef struct mac_address_s {
 	mac_address_type_t	ma_type;		/* address type */
-	int			ma_nusers;		/* number of users */
-							/* of that address */
+	int			ma_nusers;		/* num users of addr */
 	struct mac_address_s	*ma_next;		/* next address */
 	uint8_t			ma_addr[MAXMACADDRLEN];	/* address value */
 	size_t			ma_len;			/* address length */
+	mac_vlan_t		*ma_vlans;		/* VLANs on this addr */
+	boolean_t		ma_untagged;		/* accept untagged? */
 	mac_group_t		*ma_group;		/* asscociated group */
 	mac_impl_t		*ma_mip;		/* MAC handle */
 } mac_address_t;
@@ -487,7 +507,7 @@ struct mac_impl_s {
 	mac_capab_led_t		mi_led;
 
 	/*
-	 * MAC address list. SL protected.
+	 * MAC address and VLAN lists. SL protected.
 	 */
 	mac_address_t		*mi_addresses;
 
@@ -654,6 +674,7 @@ struct mac_impl_s {
 #define	MIS_LEGACY		0x0040
 #define	MIS_NO_ACTIVE		0x0080
 #define	MIS_POLL_DISABLE	0x0100
+#define	MIS_IS_OVERLAY		0x0200
 
 #define	mi_getstat	mi_callbacks->mc_getstat
 #define	mi_start	mi_callbacks->mc_start
@@ -759,6 +780,8 @@ extern void mac_client_bcast_refresh(mac_client_impl_t *, mac_multicst_t,
  */
 extern int mac_group_addmac(mac_group_t *, const uint8_t *);
 extern int mac_group_remmac(mac_group_t *, const uint8_t *);
+extern int mac_group_addvlan(mac_group_t *, uint16_t);
+extern int mac_group_remvlan(mac_group_t *, uint16_t);
 extern int mac_rx_group_add_flow(mac_client_impl_t *, flow_entry_t *,
     mac_group_t *);
 extern mblk_t *mac_hwring_tx(mac_ring_handle_t, mblk_t *);
@@ -779,6 +802,7 @@ extern void mac_rx_switch_grp_to_sw(mac_group_t *);
  * MAC address functions are used internally by MAC layer.
  */
 extern mac_address_t *mac_find_macaddr(mac_impl_t *, uint8_t *);
+extern mac_address_t *mac_find_macaddr_vlan(mac_impl_t *, uint8_t *, uint16_t);
 extern boolean_t mac_check_macaddr_shared(mac_address_t *);
 extern int mac_update_macaddr(mac_address_t *, uint8_t *);
 extern void mac_freshen_macaddr(mac_address_t *, uint8_t *);
@@ -863,8 +887,9 @@ extern int mac_start_group(mac_group_t *);
 extern void mac_stop_group(mac_group_t *);
 extern int mac_start_ring(mac_ring_t *);
 extern void mac_stop_ring(mac_ring_t *);
-extern int mac_add_macaddr(mac_impl_t *, mac_group_t *, uint8_t *, boolean_t);
-extern int mac_remove_macaddr(mac_address_t *);
+extern int mac_add_macaddr_vlan(mac_impl_t *, mac_group_t *, uint8_t *,
+    uint16_t, boolean_t);
+extern int mac_remove_macaddr_vlan(mac_address_t *, uint16_t);
 
 extern void mac_set_group_state(mac_group_t *, mac_group_state_t);
 extern void mac_group_add_client(mac_group_t *, mac_client_impl_t *);
diff --git a/usr/src/uts/common/sys/mac_provider.h b/usr/src/uts/common/sys/mac_provider.h
index 4c91c03967..2dea3a4758 100644
--- a/usr/src/uts/common/sys/mac_provider.h
+++ b/usr/src/uts/common/sys/mac_provider.h
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef	_SYS_MAC_PROVIDER_H
@@ -108,6 +108,7 @@ typedef enum {
 	MAC_CAPAB_NO_ZCOPY	= 0x00100000, /* boolean only, no data */
 	MAC_CAPAB_LEGACY	= 0x00200000, /* data is mac_capab_legacy_t */
 	MAC_CAPAB_VRRP		= 0x00400000, /* data is mac_capab_vrrp_t */
+	MAC_CAPAB_OVERLAY	= 0x00800000, /* boolean only, no data */
 	MAC_CAPAB_TRANSCEIVER	= 0x01000000, /* mac_capab_transciever_t */
 	MAC_CAPAB_LED		= 0x02000000  /* data is mac_capab_led_t */
 } mac_capab_t;
@@ -242,16 +243,59 @@ typedef struct mac_callbacks_s {
 /*
  * Virtualization Capabilities
  */
+
 /*
- * The ordering of entries below is important. MAC_HW_CLASSIFIER
- * is the cutoff below which are entries which don't depend on
- * H/W. MAC_HW_CLASSIFIER and entries after that are cases where
- * H/W has been updated through add/modify/delete APIs.
+ * The type of ring classification. This is used by MAC to determine
+ * what, if any, processing it has to do upon receiving traffic on a
+ * particular Rx ring.
+ *
+ * MAC_NO_CLASSIFIER
+ *
+ *	No classification has been set. No traffic should cross an Rx
+ *	ring in this state.
+ *
+ * MAC_SW_CLASSIFIER
+ *
+ *	The driver delivers traffic for multiple clients to this ring.
+ *	All traffic must be software classified by MAC to guarantee
+ *	delivery to the correct client. This classification type may
+ *	be chosen for several reasons.
+ *
+ *	o The driver provides only one group and there are multiple
+ *	  clients using the MAC.
+ *
+ *	o The driver provides some hardware filtering but not enough
+ *	  to fully classify the traffic. E.g., a VLAN VNIC requires L2
+ *	  unicast address filtering as well as VLAN filtering, but
+ *	  some drivers may only support the former.
+ *
+ *	o The ring belongs to the default group. The default group
+ *	  acts as a spillover for all clients that can't reserve an
+ *	  exclusive group. It also handles multicast traffic for all
+ *	  clients. For these reasons, the default group's rings are
+ *	  always software classified.
+ *
+ * MAC_HW_CLASSIFIER
+ *
+ *	The driver delivers traffic for a single MAC client across
+ *	this ring. With this guarantee, MAC can simply pass the
+ *	traffic up the stack or even allow polling of the ring.
+ *
+ * MAC_PASSTHRU_CLASSIFIER
+ *
+ *	The ring is in "passthru" mode. In this mode we bypass all of
+ *	the typical MAC processing and pass the traffic directly to
+ *	the mr_pt_fn callback, see mac_rx_common(). This is used in
+ *	cases where there is another module acting as MAC provider on
+ *	behalf of the driver. E.g., link aggregations use this mode to
+ *	take full control of the port's rings; allowing it to enforce
+ *	LACP protocols and aggregate rings across discrete drivers.
  */
 typedef enum {
 	MAC_NO_CLASSIFIER = 0,
 	MAC_SW_CLASSIFIER,
-	MAC_HW_CLASSIFIER
+	MAC_HW_CLASSIFIER,
+	MAC_PASSTHRU_CLASSIFIER
 } mac_classify_type_t;
 
 typedef	void	(*mac_rx_func_t)(void *, mac_resource_handle_t, mblk_t *,
@@ -281,6 +325,28 @@ typedef enum {
 } mac_ring_type_t;
 
 /*
+ * The value VLAN_ID_NONE (VID 0) means a client does not have
+ * membership to any VLAN. However, this statement is true for both
+ * untagged packets and priority tagged packets leading to confusion
+ * over what semantic is intended. To the provider, VID 0 is a valid
+ * VID when priority tagging is in play. To MAC and everything above
+ * VLAN_ID_NONE almost universally implies untagged traffic. Thus, we
+ * convert VLAN_ID_NONE to a sentinel value (MAC_VLAN_UNTAGGED) at the
+ * border between MAC and MAC provider. This informs the provider that
+ * the client is interested in untagged traffic and the provider
+ * should set any relevant bits to receive such traffic.
+ *
+ * Currently, the API between MAC and the provider passes the VID as a
+ * unit16_t. In the future this could actually be the entire TCI mask
+ * (PCP, DEI, and VID). This current scheme is safe in that potential
+ * future world as well; as 0xFFFF is not a valid TCI (the 0xFFF VID
+ * is reserved and never transmitted across networks).
+ */
+#define	MAC_VLAN_UNTAGGED		UINT16_MAX
+#define	MAC_VLAN_UNTAGGED_VID(vid)	\
+	(((vid) == VLAN_ID_NONE) ? MAC_VLAN_UNTAGGED : (vid))
+
+/*
  * Grouping type of a ring group
  *
  * MAC_GROUP_TYPE_STATIC: The ring group can not be re-grouped.
@@ -342,6 +408,7 @@ typedef struct mac_ring_info_s {
 		mac_ring_poll_t	poll;
 	} mrfunion;
 	mac_ring_stat_t		mri_stat;
+
 	/*
 	 * mri_flags will have some bits set to indicate some special
 	 * property/feature of a ring like serialization needed for a
@@ -358,6 +425,8 @@ typedef struct mac_ring_info_s {
  * #defines for mri_flags. The flags are temporary flags that are provided
  * only to workaround issues in specific drivers, and they will be
  * removed in the future.
+ *
+ * These are consumed only by sun4v and neptune (nxge).
  */
 #define	MAC_RING_TX_SERIALIZE		0x1
 #define	MAC_RING_RX_ENQUEUE		0x2
@@ -366,6 +435,8 @@ typedef	int	(*mac_group_start_t)(mac_group_driver_t);
 typedef	void	(*mac_group_stop_t)(mac_group_driver_t);
 typedef	int	(*mac_add_mac_addr_t)(void *, const uint8_t *);
 typedef	int	(*mac_rem_mac_addr_t)(void *, const uint8_t *);
+typedef int	(*mac_add_vlan_filter_t)(mac_group_driver_t, uint16_t);
+typedef int	(*mac_rem_vlan_filter_t)(mac_group_driver_t, uint16_t);
 
 struct mac_group_info_s {
 	mac_group_driver_t	mgi_driver;	/* Driver reference */
@@ -374,9 +445,11 @@ struct mac_group_info_s {
 	uint_t			mgi_count;	/* Count of rings */
 	mac_intr_t		mgi_intr;	/* Optional per-group intr */
 
-	/* Only used for rx groups */
+	/* Only used for Rx groups */
 	mac_add_mac_addr_t	mgi_addmac;	/* Add a MAC address */
 	mac_rem_mac_addr_t	mgi_remmac;	/* Remove a MAC address */
+	mac_add_vlan_filter_t	mgi_addvlan;	/* Add a VLAN filter */
+	mac_rem_vlan_filter_t	mgi_remvlan;	/* Remove a VLAN filter */
 };
 
 /*
@@ -558,11 +631,12 @@ extern void			mac_prop_info_set_range_uint32(
 extern void			mac_prop_info_set_perm(mac_prop_info_handle_t,
 				    uint8_t);
 
-extern void			mac_hcksum_get(mblk_t *, uint32_t *,
+extern void			mac_hcksum_get(const mblk_t *, uint32_t *,
 				    uint32_t *, uint32_t *, uint32_t *,
 				    uint32_t *);
 extern void			mac_hcksum_set(mblk_t *, uint32_t, uint32_t,
 				    uint32_t, uint32_t, uint32_t);
+extern void			mac_hcksum_clone(const mblk_t *, mblk_t *);
 
 extern void			mac_lso_get(mblk_t *, uint32_t *, uint32_t *);
 
diff --git a/usr/src/uts/common/sys/mman.h b/usr/src/uts/common/sys/mman.h
index 0d49a2ff4d..65819c1209 100644
--- a/usr/src/uts/common/sys/mman.h
+++ b/usr/src/uts/common/sys/mman.h
@@ -340,6 +340,7 @@ struct memcntl_mha32 {
 #define	MS_SYNC		0x4		/* wait for msync */
 #define	MS_ASYNC	0x1		/* return immediately */
 #define	MS_INVALIDATE	0x2		/* invalidate caches */
+#define	MS_INVALCURPROC	0x8		/* invalidate cache for curproc only */
 
 #if	(_POSIX_C_SOURCE <= 2) && !defined(_XPG4_2) || defined(__EXTENSIONS__)
 /* functions to mctl */
diff --git a/usr/src/uts/common/sys/mntent.h b/usr/src/uts/common/sys/mntent.h
index 88c98dc5a4..7196f7b3ac 100644
--- a/usr/src/uts/common/sys/mntent.h
+++ b/usr/src/uts/common/sys/mntent.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012, Joyent, Inc.  All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
  *
  *	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T
@@ -47,6 +48,7 @@ extern "C" {
 #define	MNTTYPE_PCFS	"pcfs"		/* PC (MSDOS) file system */
 #define	MNTTYPE_PC	MNTTYPE_PCFS	/* Deprecated name; use MNTTYPE_PCFS */
 #define	MNTTYPE_LOFS	"lofs"		/* Loop back file system */
+#define	MNTTYPE_HYPRLOFS "hyprlofs"	/* Hyperlofs file system */
 #define	MNTTYPE_LO	MNTTYPE_LOFS	/* Deprecated name; use MNTTYPE_LOFS */
 #define	MNTTYPE_HSFS	"hsfs"		/* High Sierra (9660) file system */
 #define	MNTTYPE_SWAP	"swap"		/* Swap file system */
diff --git a/usr/src/uts/common/sys/netconfig.h b/usr/src/uts/common/sys/netconfig.h
index 6407534a3b..658f9f3f6b 100644
--- a/usr/src/uts/common/sys/netconfig.h
+++ b/usr/src/uts/common/sys/netconfig.h
@@ -28,6 +28,7 @@
  *
  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_NETCONFIG_H
diff --git a/usr/src/uts/common/sys/neti.h b/usr/src/uts/common/sys/neti.h
index b21504109c..fe7746fc81 100644
--- a/usr/src/uts/common/sys/neti.h
+++ b/usr/src/uts/common/sys/neti.h
@@ -46,6 +46,8 @@ struct msgb;	/* avoiding sys/stream.h here */
 #define	NHF_INET	"NHF_INET"
 #define	NHF_INET6	"NHF_INET6"
 #define	NHF_ARP		"NHF_ARP"
+#define	NHF_VND_INET	"NHF_VND_INET"
+#define	NHF_VND_INET6	"NHF_VND_INET6"
 
 /*
  * Event identification
diff --git a/usr/src/uts/common/sys/netstack.h b/usr/src/uts/common/sys/netstack.h
index 7ee33318cd..b327e69fad 100644
--- a/usr/src/uts/common/sys/netstack.h
+++ b/usr/src/uts/common/sys/netstack.h
@@ -88,7 +88,8 @@ typedef id_t	netstackid_t;
 #define	NS_IPSECESP	16
 #define	NS_IPNET	17
 #define	NS_ILB		18
-#define	NS_MAX		(NS_ILB+1)
+#define	NS_VND		19
+#define	NS_MAX		(NS_VND+1)
 
 /*
  * State maintained for each module which tracks the state of
diff --git a/usr/src/uts/common/sys/overlay.h b/usr/src/uts/common/sys/overlay.h
new file mode 100644
index 0000000000..12d0dbca51
--- /dev/null
+++ b/usr/src/uts/common/sys/overlay.h
@@ -0,0 +1,96 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015, Joyent, Inc.
+ */
+
+#ifndef _SYS_OVERLAY_H
+#define	_SYS_OVERLAY_H
+
+/*
+ * Overlay device support
+ */
+
+#include <sys/param.h>
+#include <sys/dld_ioc.h>
+#include <sys/mac.h>
+#include <sys/overlay_common.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	OVERLAY_IOC_CREATE	OVERLAYIOC(1)
+#define	OVERLAY_IOC_DELETE	OVERLAYIOC(2)
+#define	OVERLAY_IOC_PROPINFO	OVERLAYIOC(3)
+#define	OVERLAY_IOC_GETPROP	OVERLAYIOC(4)
+#define	OVERLAY_IOC_SETPROP	OVERLAYIOC(5)
+#define	OVERLAY_IOC_NPROPS	OVERLAYIOC(6)
+#define	OVERLAY_IOC_ACTIVATE	OVERLAYIOC(7)
+#define	OVERLAY_IOC_STATUS	OVERLAYIOC(8)
+
+typedef struct overlay_ioc_create {
+	datalink_id_t	oic_linkid;
+	uint32_t	oic_filler;
+	uint64_t	oic_vnetid;
+	char		oic_encap[MAXLINKNAMELEN];
+} overlay_ioc_create_t;
+
+typedef struct overlay_ioc_activate {
+	datalink_id_t	oia_linkid;
+} overlay_ioc_activate_t;
+
+typedef struct overlay_ioc_delete {
+	datalink_id_t	oid_linkid;
+} overlay_ioc_delete_t;
+
+typedef struct overlay_ioc_nprops {
+	datalink_id_t	oipn_linkid;
+	int32_t		oipn_nprops;
+} overlay_ioc_nprops_t;
+
+typedef struct overlay_ioc_propinfo {
+	datalink_id_t	oipi_linkid;
+	int32_t		oipi_id;
+	char		oipi_name[OVERLAY_PROP_NAMELEN];
+	uint_t		oipi_type;
+	uint_t		oipi_prot;
+	uint8_t		oipi_default[OVERLAY_PROP_SIZEMAX];
+	uint32_t	oipi_defsize;
+	uint32_t	oipi_posssize;
+	uint8_t		oipi_poss[OVERLAY_PROP_SIZEMAX];
+} overlay_ioc_propinfo_t;
+
+typedef struct overlay_ioc_prop {
+	datalink_id_t	oip_linkid;
+	int32_t		oip_id;
+	char		oip_name[OVERLAY_PROP_NAMELEN];
+	uint8_t		oip_value[OVERLAY_PROP_SIZEMAX];
+	uint32_t	oip_size;
+} overlay_ioc_prop_t;
+
+typedef enum overlay_status {
+	OVERLAY_I_OK		= 0x00,
+	OVERLAY_I_DEGRADED	= 0x01
+} overlay_status_t;
+
+typedef struct overlay_ioc_status {
+	datalink_id_t	ois_linkid;
+	uint_t		ois_status;
+	char		ois_message[OVERLAY_STATUS_BUFLEN];
+} overlay_ioc_status_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_OVERLAY_H */
diff --git a/usr/src/uts/common/sys/overlay_common.h b/usr/src/uts/common/sys/overlay_common.h
new file mode 100644
index 0000000000..d638096006
--- /dev/null
+++ b/usr/src/uts/common/sys/overlay_common.h
@@ -0,0 +1,65 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_OVERLAY_COMMON_H
+#define	_SYS_OVERLAY_COMMON_H
+
+/*
+ * Common overlay definitions
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum overlay_target_mode {
+	OVERLAY_TARGET_NONE = 0x0,
+	OVERLAY_TARGET_POINT,
+	OVERLAY_TARGET_DYNAMIC
+} overlay_target_mode_t;
+
+typedef enum overlay_plugin_dest {
+	OVERLAY_PLUGIN_D_INVALID	= 0x0,
+	OVERLAY_PLUGIN_D_ETHERNET	= 0x1,
+	OVERLAY_PLUGIN_D_IP		= 0x2,
+	OVERLAY_PLUGIN_D_PORT 		= 0x4,
+	OVERLAY_PLUGIN_D_MASK		= 0x7
+} overlay_plugin_dest_t;
+
+typedef enum overlay_prop_type {
+	OVERLAY_PROP_T_INT = 0x1,	/* signed int */
+	OVERLAY_PROP_T_UINT,		/* unsigned int */
+	OVERLAY_PROP_T_IP,		/* sinaddr6 */
+	OVERLAY_PROP_T_STRING		/* OVERLAY_PROPS_SIZEMAX */
+} overlay_prop_type_t;
+
+typedef enum overlay_prop_prot {
+	OVERLAY_PROP_PERM_REQ	= 0x1,
+	OVERLAY_PROP_PERM_READ	= 0x2,
+	OVERLAY_PROP_PERM_WRITE	= 0x4,
+	OVERLAY_PROP_PERM_RW 	= 0x6,
+	OVERLAY_PROP_PERM_RRW	= 0x7,
+	OVERLAY_PROP_PERM_MASK	= 0x7
+} overlay_prop_prot_t;
+
+#define	OVERLAY_PROP_NAMELEN	64
+#define	OVERLAY_PROP_SIZEMAX	256
+#define	OVERLAY_STATUS_BUFLEN	256
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_OVERLAY_COMMON_H */
diff --git a/usr/src/uts/common/sys/overlay_impl.h b/usr/src/uts/common/sys/overlay_impl.h
new file mode 100644
index 0000000000..7fb8b8da1d
--- /dev/null
+++ b/usr/src/uts/common/sys/overlay_impl.h
@@ -0,0 +1,205 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#ifndef _SYS_OVERLAY_IMPL_H
+#define	_SYS_OVERLAY_IMPL_H
+
+/*
+ * Overlay device support
+ */
+
+#include <sys/overlay.h>
+#include <sys/overlay_common.h>
+#include <sys/overlay_plugin.h>
+#include <sys/overlay_target.h>
+#include <sys/ksynch.h>
+#include <sys/list.h>
+#include <sys/avl.h>
+#include <sys/ksocket.h>
+#include <sys/socket.h>
+#include <sys/refhash.h>
+#include <sys/ethernet.h>
+#include <sys/list.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	OVEP_VERSION_ONE	0x1
+
+typedef struct overlay_plugin {
+	kmutex_t ovp_mutex;
+	list_node_t ovp_link;			/* overlay_plugin_lock */
+	uint_t ovp_active;			/* ovp_mutex */
+	const char *ovp_name;			/* RO */
+	const overlay_plugin_ops_t *ovp_ops;	/* RO */
+	const char *const *ovp_props;		/* RO */
+	uint_t ovp_nprops;			/* RO */
+	uint_t ovp_id_size;			/* RO */
+	overlay_plugin_flags_t ovp_flags;	/* RO */
+	overlay_plugin_dest_t ovp_dest;		/* RO */
+} overlay_plugin_t;
+
+typedef struct overlay_mux {
+	list_node_t		omux_lnode;
+	ksocket_t		omux_ksock;	/* RO */
+	overlay_plugin_t	*omux_plugin;	/* RO: associated encap */
+	int			omux_domain;	/* RO: socket domain */
+	int			omux_family;	/* RO: socket family */
+	int			omux_protocol;	/* RO: socket protocol */
+	struct sockaddr 	*omux_addr;	/* RO: socket address */
+	socklen_t		omux_alen;	/* RO: sockaddr len */
+	kmutex_t		omux_lock;	/* Protects everything below */
+	uint_t			omux_count;	/* Active instances */
+	avl_tree_t		omux_devices;	/* Tree of devices */
+} overlay_mux_t;
+
+typedef enum overlay_target_flag {
+	OVERLAY_T_TEARDOWN	= 0x1
+} overlay_target_flag_t;
+
+typedef struct overlay_target {
+	kmutex_t		ott_lock;
+	kcondvar_t		ott_cond;
+	overlay_target_mode_t	ott_mode;	/* RO */
+	overlay_plugin_dest_t	ott_dest;	/* RO */
+	uint64_t		ott_id;		/* RO */
+	overlay_target_flag_t	ott_flags;	/* ott_lock */
+	uint_t			ott_ocount;	/* ott_lock */
+	union {					/* ott_lock */
+		overlay_target_point_t	ott_point;
+		struct overlay_target_dyn {
+			refhash_t	*ott_dhash;
+			avl_tree_t	ott_tree;
+		} ott_dyn;
+	} ott_u;
+} overlay_target_t;
+
+typedef enum overlay_dev_flag {
+	OVERLAY_F_ACTIVATED	= 0x01, /* Activate ioctl completed */
+	OVERLAY_F_IN_MUX	= 0x02,	/* Currently in a mux */
+	OVERLAY_F_IN_TX		= 0x04,	/* Currently doing tx */
+	OVERLAY_F_IN_RX		= 0x08, /* Currently doing rx */
+	OVERLAY_F_IOMASK	= 0x0c,	/* A mask for rx and tx */
+	OVERLAY_F_MDDROP	= 0x10,	/* Drop traffic for metadata update */
+	OVERLAY_F_STOPMASK	= 0x1e,	/* None set when stopping */
+	OVERLAY_F_VARPD		= 0x20,	/* varpd plugin exists */
+	OVERLAY_F_DEGRADED	= 0x40,	/* device is degraded */
+	OVERLAY_F_MASK		= 0x7f	/* mask of everything */
+} overlay_dev_flag_t;
+
+typedef struct overlay_dev {
+	kmutex_t	odd_lock;
+	kcondvar_t	odd_iowait;
+	list_node_t	odd_link;		/* overlay_dev_lock */
+	mac_handle_t	odd_mh;			/* RO */
+	overlay_plugin_t *odd_plugin;		/* RO */
+	datalink_id_t	odd_linkid;		/* RO */
+	void		*odd_pvoid;		/* RO -- only used by plugin */
+	uint_t		odd_ref;		/* protected by odd_lock */
+	uint_t		odd_mtu;		/* protected by odd_lock */
+	overlay_dev_flag_t odd_flags;		/* protected by odd_lock */
+	uint_t		odd_rxcount;		/* protected by odd_lock */
+	uint_t		odd_txcount;		/* protected by odd_lock */
+	overlay_mux_t	*odd_mux;		/* protected by odd_lock */
+	uint64_t	odd_vid;		/* RO if active else odd_lock */
+	avl_node_t	odd_muxnode;		/* managed by mux */
+	overlay_target_t *odd_target;		/* See big theory statement */
+	char		odd_fmamsg[OVERLAY_STATUS_BUFLEN];	/* odd_lock */
+} overlay_dev_t;
+
+typedef enum overlay_target_entry_flags {
+	OVERLAY_ENTRY_F_PENDING		= 0x01,	/* lookup in progress */
+	OVERLAY_ENTRY_F_VALID		= 0x02,	/* entry is currently valid */
+	OVERLAY_ENTRY_F_DROP		= 0x04,	/* always drop target */
+	OVERLAY_ENTRY_F_VALID_MASK	= 0x06
+} overlay_target_entry_flags_t;
+
+typedef struct overlay_target_entry {
+	kmutex_t		ote_lock;
+	refhash_link_t		ote_reflink;	/* hashtable link */
+	avl_node_t		ote_avllink;	/* iteration link */
+	list_node_t		ote_qlink;
+	overlay_target_entry_flags_t ote_flags;	/* RW: state flags */
+	uint8_t			ote_addr[ETHERADDRL];	/* RO: mac addr */
+	overlay_target_t	*ote_ott;	/* RO */
+	overlay_dev_t		*ote_odd;	/* RO */
+	overlay_target_point_t	ote_dest;	/* RW: destination */
+	mblk_t			*ote_chead;	/* RW: blocked mb chain head */
+	mblk_t			*ote_ctail;	/* RW: blocked mb chain tail */
+	size_t			ote_mbsize;	/* RW: outstanding mblk size */
+	hrtime_t		ote_vtime;	/* RW: valid timestamp */
+} overlay_target_entry_t;
+
+
+#define	OVERLAY_CTL	"overlay"
+
+extern dev_info_t *overlay_dip;
+
+extern mblk_t *overlay_m_tx(void *, mblk_t *);
+
+typedef int (*overlay_dev_iter_f)(overlay_dev_t *, void *);
+extern void overlay_dev_iter(overlay_dev_iter_f, void *);
+
+extern void overlay_plugin_init(void);
+extern overlay_plugin_t *overlay_plugin_lookup(const char *);
+extern void overlay_plugin_rele(overlay_plugin_t *);
+extern void overlay_plugin_fini(void);
+typedef int (*overlay_plugin_walk_f)(overlay_plugin_t *, void *);
+extern void overlay_plugin_walk(overlay_plugin_walk_f, void *);
+
+extern void overlay_io_start(overlay_dev_t *, overlay_dev_flag_t);
+extern void overlay_io_done(overlay_dev_t *, overlay_dev_flag_t);
+
+extern void overlay_mux_init(void);
+extern void overlay_mux_fini(void);
+
+extern overlay_mux_t *overlay_mux_open(overlay_plugin_t *, int, int, int,
+    struct sockaddr *, socklen_t, int *);
+extern void overlay_mux_close(overlay_mux_t *);
+extern void overlay_mux_add_dev(overlay_mux_t *, overlay_dev_t *);
+extern void overlay_mux_remove_dev(overlay_mux_t *, overlay_dev_t *);
+extern int overlay_mux_tx(overlay_mux_t *, struct msghdr *, mblk_t *);
+
+extern void overlay_prop_init(overlay_prop_handle_t);
+
+extern void overlay_target_init(void);
+extern int overlay_target_busy(void);
+extern int overlay_target_open(dev_t *, int, int, cred_t *);
+extern int overlay_target_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
+extern int overlay_target_close(dev_t, int, int, cred_t *);
+extern void overlay_target_free(overlay_dev_t *);
+
+#define	OVERLAY_TARGET_OK	0
+#define	OVERLAY_TARGET_DROP	1
+#define	OVERLAY_TARGET_ASYNC	2
+extern int overlay_target_lookup(overlay_dev_t *, mblk_t *, struct sockaddr *,
+    socklen_t *);
+extern void overlay_target_quiesce(overlay_target_t *);
+extern void overlay_target_fini(void);
+
+extern void overlay_fm_init(void);
+extern void overlay_fm_fini(void);
+extern void overlay_fm_degrade(overlay_dev_t *, const char *);
+extern void overlay_fm_restore(overlay_dev_t *);
+
+extern overlay_dev_t *overlay_hold_by_dlid(datalink_id_t);
+extern void overlay_hold_rele(overlay_dev_t *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_OVERLAY_IMPL_H */
diff --git a/usr/src/uts/common/sys/overlay_plugin.h b/usr/src/uts/common/sys/overlay_plugin.h
new file mode 100644
index 0000000000..07efaa05df
--- /dev/null
+++ b/usr/src/uts/common/sys/overlay_plugin.h
@@ -0,0 +1,324 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_OVERLAY_PLUGIN_H
+#define	_SYS_OVERLAY_PLUGIN_H
+
+/*
+ * overlay plugin interface for encapsulation/decapsulation modules
+ *
+ * This header file defines how encapsulation and decapsulation plugins
+ * interact within the broader system. At this time, these interfaces are
+ * considered private to illumos and therefore are subject to change. As we gain
+ * more experience with a few of the different encapsulation formats, say nvgre
+ * or geneve, then we can move to make this a more-stable interface.
+ *
+ * A plugin is a general kernel module that uses the miscellaneous mod-linkage.
+ *
+ * In it's _init(9E) routine, it must register itself with the overlay
+ * subsystem. To do this, it allocates an overlay_plugin_register_t via
+ * overlay_plugin_alloc(), that it then  * fills out with various required
+ * information and then attempts to register with the system via a call to
+ * overlay_plugin_register(). If that succeeds, it should then call
+ * mod_install(9F). If the mod_install(9F) fails, then it should call
+ * overlay_plugin_unregister(). Regardless of success or failure, it should call
+ * overlay_plugin_free() to ensure that any memory that may be associated with
+ * the registration is freed.
+ *
+ * When the module's _fini(9E) is called, overlay_plugin_unregister() should be
+ * called first. It may return an error, such as EBUSY. In such cases, it should
+ * be returned as the return status of _fini(9E). This is quite necessary, it
+ * ensures that if the module is in use it doesn't get unloaded out from under
+ * us the broader subsystem while it's still in use. A driver can use that to
+ * know that there are no current instances of its private data.
+ *
+ * ------------------
+ * Plugin Definitions
+ * ------------------
+ *
+ * A plugin is required to fill in both an operations vector and a series of
+ * information to the callback routine. Here are the routines and their
+ * purposes. The full signatures are available below.
+ *
+ *   overlay_plugin_init_t
+ *
+ * 	This interface is used to create a new instance of a plugin. An instance
+ * 	of a plugin will be created for each overlay device that is created. For
+ * 	example, if a device is created with VXLAN ID 23 and ID 42, then there
+ * 	will be two different calls to this function.
+ *
+ * 	This function gives the plugin a chance to create a private data
+ * 	structure that will be returned on subsequent calls to the system.
+ *
+ *   overlay_plugin_fini_t
+ *
+ *   	This is the opposite of overlay_plugin_init_t. It will be called when it
+ *   	is safe to remove any private data that is associated with this instance
+ *   	of the plugin.
+ *
+ *   overlay_plugin_propinfo_t
+ *
+ *   	This is called with the name of a property that is registered when the
+ *   	plugin is created. This function will be called with the name of the
+ *   	property that information is being requested about. The plugin is
+ *   	responsible for filling out information such as setting the name, the
+ *   	type of property it is, the protection of the property (can a user
+ *   	update it?), whether the property is required, an optional default value
+ *   	for the property, and an optional set of values or ranges that are
+ *   	allowed.
+ *
+ *   overlay_plugin_getprop_t
+ *
+ *	Return the value of the named property from the current instance of the
+ *	plugin.
+ *
+ *   overlay_plugin_setprop_t
+ *
+ *	Set the value of the named property to the specified value for the
+ *	current instance of the plugin. Note, that it is the plugin's
+ *	responsibility to ensure that the value of the property is valid and to
+ *	update state as appropriate.
+ *
+ *   overlay_plugin_socket_t
+ *
+ *   	Every overlay device has a corresponding socket that it uses to send and
+ *   	receive traffic. This routine is used to get the parameters that should
+ *   	be used to define such a socket. The actual socket may be multiplexed
+ *   	with other uses of it.
+ *
+ *   overlay_plugin_sockopt_t
+ *
+ *   	Allow a plugin to set any necessary socket options that it needs on the
+ *   	kernel socket that is being used by a mux. This will only be called once
+ *   	for a given mux, if additional devices are added to a mux, it will not
+ *   	be called additional times.
+ *
+ *   overlay_plugin_encap_t
+ *
+ *   	In this routine you're given a message block and information about the
+ *   	packet, such as the identifier and are asked to fill out a message block
+ *   	that represents the encapsulation header and optionally manipulate the
+ *   	input message if required.
+ *
+ *   overlay_plugin_decap_t
+ *
+ *   	In this routine, you're given the encapsulated message block. The
+ *   	requirement is to decapsulate it and determine what is the correct
+ *   	overlay identifier for this network and to fill in the header size so
+ *   	the broader system knows how much of this data should be considered
+ *   	consumed.
+ *
+ *   ovpo_callbacks
+ *
+ *   	This should be set to zero, it's reserved for future use.
+ *
+ * Once these properties are defined, the module should define the following
+ * members in the overlay_plugin_register_t.
+ *
+ *   ovep_version
+ *
+ *   	Should be set to the value of the macro OVEP_VERSION.
+ *
+ *   ovep_name
+ *
+ *   	Should be set to a character string that has the name of the module.
+ *   	Generally this should match the name of the kernel module; however, this
+ *   	is the name that users will use to refer to this module when creating
+ *   	devices.
+ *
+ *   overlay_plugin_ops_t
+ *
+ *   	Should be set to the functions as described above.
+ *
+ *   ovep_props
+ *
+ *   	This is an array of character strings that holds the names of the
+ *   	properties of the encapsulation plugin.
+ *
+ *
+ *   ovep_id_size
+ *
+ *   	This is the size in bytes of the valid range for the identifier. The
+ *   	valid identifier range is considered a ovep_id_size byte unsigned
+ *   	integer, [ 0, 1 << (ovep_id_size * 8) ).
+ *
+ *   ovep_flags
+ *
+ *   	A series of flags that indicate optional features that are supported.
+ *   	Valid flags include:
+ *
+ *   		OVEP_F_VLAN_TAG
+ *
+ * 			The encapsulation format allows for the encapsulated
+ * 			packet to maintain a VLAN tag.
+ *
+ *   ovep_dest
+ *
+ *   	Describes the kind of destination that the overlay plugin supports for
+ *   	sending traffic. For example, vxlan uses UDP, therefore it requires both
+ *   	an IP address and a port; however, nvgre uses the gre header and
+ *   	therefore only requires an IP address. The following flags may be
+ *   	combined:
+ *
+ *   		OVERLAY_PLUGIN_D_ETHERNET
+ *
+ *   			Indicates that to send a packet to its destination, we
+ *   			require a link-layer ethernet address.
+ *
+ * 		OVERLAY_PLUGIN_D_IP
+ *
+ * 			Indicates that to send a packet to its destination, we
+ * 			require an IP address. Note, all IP addresses are
+ * 			transmitted as IPv6 addresses and for an IPv4
+ * 			destination, using an IPv4-mapped IPv6 address is the
+ * 			expected way to transmit that.
+ *
+ * 		OVERLAY_PLUGIN_D_PORT
+ *
+ * 			Indicates that to send a packet to its destination, a
+ * 			port is required, this usually indicates that the
+ * 			protocol uses something like TCP or UDP.
+ *
+ *
+ * -------------------------------------------------
+ * Downcalls, Upcalls, and Synchronization Guarantees
+ * -------------------------------------------------
+ *
+ * Every instance of a given module is independent. The kernel only guarantees
+ * that it will probably perform downcalls into different instances in parallel
+ * at some point. No locking is provided by the framework for synchronization
+ * across instances. If a module finds itself needing that, it will be up to it
+ * to provide it.
+ *
+ * In a given instance, the kernel may call into entry points in parallel. If
+ * the instance has private data, it should likely synchronize it. The one
+ * guarantee that we do make, is that calls to getprop and setprop will be done
+ * synchronized by a caller holding the MAC perimeter.
+ *
+ * While servicing a downcall from the general overlay device framework, a
+ * kernel module should not make any upcalls, excepting those functions that are
+ * defined in this header file, eg. the property related callbacks. Improtantly,
+ * it cannot make any assumptions about what locks may or may not be held by the
+ * broader system. The only thing that it is safe for it to use are its own
+ * locks.
+ *
+ * ----------------
+ * Downcall Context
+ * ----------------
+ *
+ * For all of the downcalls, excepting the overlay_plugin_encap_t and
+ * overlay_plugin_decap_t, the calls will be made either in kernel or user
+ * context, the module should not assume either way.
+ *
+ * overlay_plugin_encap_t and overlay_plugin_decap_t may be called in user,
+ * kernel or interrupt context; however, it is guaranteed that the interrupt
+ * will be below LOCK_LEVEL, and therefore it is safe to grab locks.
+ */
+
+#include <sys/stream.h>
+#include <sys/mac_provider.h>
+#include <sys/ksocket.h>
+#include <sys/overlay_common.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	OVEP_VERSION	0x1
+
+typedef enum overlay_plugin_flags {
+	OVEP_F_VLAN_TAG	= 0x01	/* Supports VLAN Tags */
+} overlay_plugin_flags_t;
+
+/*
+ * The ID space could easily be more than a 64-bit number, even
+ * though today it's either a 24-64 bit value. How should we future
+ * proof ourselves here?
+ */
+typedef struct ovep_encap_info {
+	uint64_t	ovdi_id;
+	size_t		ovdi_hdr_size;
+} ovep_encap_info_t;
+
+typedef struct __overlay_prop_handle *overlay_prop_handle_t;
+typedef struct __overlay_handle *overlay_handle_t;
+
+/*
+ * Plugins are guaranteed that calls to setprop are serialized. However, any
+ * number of other calls can be going on in parallel otherwise.
+ */
+typedef int (*overlay_plugin_encap_t)(void *, mblk_t *,
+    ovep_encap_info_t *, mblk_t **);
+typedef int (*overlay_plugin_decap_t)(void *, mblk_t *,
+    ovep_encap_info_t *);
+typedef int (*overlay_plugin_init_t)(overlay_handle_t, void **);
+typedef void (*overlay_plugin_fini_t)(void *);
+typedef int (*overlay_plugin_socket_t)(void *, int *, int *, int *,
+    struct sockaddr *, socklen_t *);
+typedef int (*overlay_plugin_sockopt_t)(ksocket_t);
+typedef int (*overlay_plugin_getprop_t)(void *, const char *, void *,
+    uint32_t *);
+typedef int (*overlay_plugin_setprop_t)(void *, const char *, const void *,
+    uint32_t);
+typedef int (*overlay_plugin_propinfo_t)(const char *, overlay_prop_handle_t);
+
+typedef struct overlay_plugin_ops {
+	uint_t			ovpo_callbacks;
+	overlay_plugin_init_t	ovpo_init;
+	overlay_plugin_fini_t	ovpo_fini;
+	overlay_plugin_encap_t	ovpo_encap;
+	overlay_plugin_decap_t	ovpo_decap;
+	overlay_plugin_socket_t ovpo_socket;
+	overlay_plugin_sockopt_t ovpo_sockopt;
+	overlay_plugin_getprop_t ovpo_getprop;
+	overlay_plugin_setprop_t ovpo_setprop;
+	overlay_plugin_propinfo_t ovpo_propinfo;
+} overlay_plugin_ops_t;
+
+typedef struct overlay_plugin_register {
+	uint_t			ovep_version;
+	const char		*ovep_name;
+	const overlay_plugin_ops_t	*ovep_ops;
+	const char 		**ovep_props;
+	uint_t			ovep_id_size;
+	uint_t			ovep_flags;
+	uint_t			ovep_dest;
+} overlay_plugin_register_t;
+
+/*
+ * Functions that interact with registration
+ */
+extern overlay_plugin_register_t *overlay_plugin_alloc(uint_t);
+extern void overlay_plugin_free(overlay_plugin_register_t *);
+extern int overlay_plugin_register(overlay_plugin_register_t *);
+extern int overlay_plugin_unregister(const char *);
+
+/*
+ * Property information callbacks
+ */
+extern void overlay_prop_set_name(overlay_prop_handle_t, const char *);
+extern void overlay_prop_set_prot(overlay_prop_handle_t, overlay_prop_prot_t);
+extern void overlay_prop_set_type(overlay_prop_handle_t, overlay_prop_type_t);
+extern int overlay_prop_set_default(overlay_prop_handle_t, void *, ssize_t);
+extern void overlay_prop_set_nodefault(overlay_prop_handle_t);
+extern void overlay_prop_set_range_uint32(overlay_prop_handle_t, uint32_t,
+    uint32_t);
+extern void overlay_prop_set_range_str(overlay_prop_handle_t, const char *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_OVERLAY_PLUGIN_H */
diff --git a/usr/src/uts/common/sys/overlay_target.h b/usr/src/uts/common/sys/overlay_target.h
new file mode 100644
index 0000000000..ae92ef3532
--- /dev/null
+++ b/usr/src/uts/common/sys/overlay_target.h
@@ -0,0 +1,293 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2015 Joyent, Inc.
+ */
+
+#ifndef _OVERLAY_TARGET_H
+#define	_OVERLAY_TARGET_H
+
+/*
+ * Overlay device varpd ioctl interface (/dev/overlay)
+ */
+
+#include <sys/types.h>
+#include <sys/ethernet.h>
+#include <netinet/in.h>
+#include <sys/overlay_common.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct overlay_target_point {
+	uint8_t		otp_mac[ETHERADDRL];
+	struct in6_addr	otp_ip;
+	uint16_t	otp_port;
+} overlay_target_point_t;
+
+#define	OVERLAY_TARG_IOCTL	(('o' << 24) | ('v' << 16) | ('t' << 8))
+
+#define	OVERLAY_TARG_INFO	(OVERLAY_TARG_IOCTL | 0x01)
+
+typedef enum overlay_targ_info_flags {
+	OVERLAY_TARG_INFO_F_ACTIVE = 0x01,
+	OVERLAY_TARG_INFO_F_DEGRADED = 0x02
+} overlay_targ_info_flags_t;
+
+/*
+ * Get target information about an overlay device
+ */
+typedef struct overlay_targ_info {
+	datalink_id_t		oti_linkid;
+	uint32_t		oti_needs;
+	uint64_t		oti_flags;
+	uint64_t		oti_vnetid;
+} overlay_targ_info_t;
+
+/*
+ * Declare an association between a given varpd instance and a datalink.
+ */
+#define	OVERLAY_TARG_ASSOCIATE	(OVERLAY_TARG_IOCTL | 0x02)
+
+typedef struct overlay_targ_associate {
+	datalink_id_t		ota_linkid;
+	uint32_t		ota_mode;
+	uint64_t		ota_id;
+	uint32_t		ota_provides;
+	overlay_target_point_t	ota_point;
+} overlay_targ_associate_t;
+
+/*
+ * Remove an association from a device. If the device has already been started,
+ * this implies OVERLAY_TARG_DEGRADE.
+ */
+#define	OVERLAY_TARG_DISASSOCIATE	(OVERLAY_TARG_IOCTL | 0x3)
+
+/*
+ * Tells the kernel that while a varpd instance still exists, it basically isn't
+ * making any forward progress, so the device should consider itself degraded.
+ */
+#define	OVERLAY_TARG_DEGRADE	(OVERLAY_TARG_IOCTL | 0x4)
+
+typedef struct overlay_targ_degrade {
+	datalink_id_t	otd_linkid;
+	uint32_t	otd_pad;
+	char		otd_buf[OVERLAY_STATUS_BUFLEN];
+} overlay_targ_degrade_t;
+
+/*
+ * Tells the kernel to remove the degraded status that it set on a device.
+ */
+#define	OVERLAY_TARG_RESTORE	(OVERLAY_TARG_IOCTL | 0x5)
+
+typedef struct overlay_targ_id {
+	datalink_id_t	otid_linkid;
+} overlay_targ_id_t;
+
+/*
+ * The following ioctls are all used to support dynamic lookups from userland,
+ * generally serviced by varpd.
+ *
+ * The way this is designed to work is that user land will have threads sitting
+ * in OVERLAY_TARG_LOOKUP ioctls waiting to service requests. A thread will sit
+ * waiting for work for up to approximately one second of time before they will
+ * be sent back out to user land to give user land a chance to clean itself up
+ * or more generally, come back into the kernel for work. Once these threads
+ * return, they will have a request with which more action can be done. The
+ * following ioctls can all be used to answer the request.
+ *
+ *	OVERLAY_TARG_RESPOND - overlay_targ_resp_t
+ *
+ *		The overlay_targ_resp_t has the appropriate information from
+ *		which a reply can be generated. The information is filled into
+ *		an overlay_targ_point_t as appropriate based on the
+ *		overlay_plugin_dest_t type.
+ *
+ *
+ *	OVERLAY_TARG_DROP - overlay_targ_resp_t
+ *
+ *		The overlay_targ_resp_t should identify a request for which to
+ *		drop a packet.
+ *
+ *
+ * 	OVERLAY_TARG_INJECT - overlay_targ_pkt_t
+ *
+ * 		The overlay_targ_pkt_t injects a fully formed packet into the
+ * 		virtual network. It may either be identified by its data link id
+ * 		or by the request id. If both are specified, the
+ * 		datalink id will be used. Note, that an injection is not
+ * 		considered a reply and if this corresponds to a requeset, then
+ * 		that individual packet must still be dropped.
+ *
+ *
+ * 	OVERLAY_TARG_PKT - overlay_targ_pkt_t
+ *
+ * 		This ioctl can be used to copy data from a given request into a
+ * 		user buffer. This can be used in combination with
+ * 		OVERLAY_TARG_INJECT to implemnt services such as a proxy-arp.
+ *
+ *
+ * 	OVERLAY_TARG_RESEND - overlay_targ_pkt_t
+ *
+ * 		This ioctl is similar to the OVERLAY_TARG_INJECT, except instead
+ * 		of receiving it on the local mac handle, it queues it for
+ * 		retransmission again. This is useful if you have a packet that
+ * 		was originally destined for some broadcast or multicast address
+ * 		that you now want to send to a unicast address.
+ */
+#define	OVERLAY_TARG_LOOKUP	(OVERLAY_TARG_IOCTL | 0x10)
+#define	OVERLAY_TARG_RESPOND	(OVERLAY_TARG_IOCTL | 0x11)
+#define	OVERLAY_TARG_DROP	(OVERLAY_TARG_IOCTL | 0x12)
+#define	OVERLAY_TARG_INJECT	(OVERLAY_TARG_IOCTL | 0x13)
+#define	OVERLAY_TARG_PKT	(OVERLAY_TARG_IOCTL | 0x14)
+#define	OVERLAY_TARG_RESEND	(OVERLAY_TARG_IOCTL | 0x15)
+
+typedef struct overlay_targ_lookup {
+	uint64_t	otl_dlid;
+	uint64_t	otl_reqid;
+	uint64_t	otl_varpdid;
+	uint64_t	otl_vnetid;
+	uint64_t	otl_hdrsize;
+	uint64_t	otl_pktsize;
+	uint8_t		otl_srcaddr[ETHERADDRL];
+	uint8_t		otl_dstaddr[ETHERADDRL];
+	uint32_t	otl_dsttype;
+	uint32_t	otl_sap;
+	int32_t		otl_vlan;
+} overlay_targ_lookup_t;
+
+typedef struct overlay_targ_resp {
+	uint64_t	otr_reqid;
+	overlay_target_point_t otr_answer;
+} overlay_targ_resp_t;
+
+typedef struct overlay_targ_pkt {
+	uint64_t	otp_linkid;
+	uint64_t	otp_reqid;
+	uint64_t	otp_size;
+	void		*otp_buf;
+} overlay_targ_pkt_t;
+
+#ifdef _KERNEL
+
+typedef struct overlay_targ_pkt32 {
+	uint64_t	otp_linkid;
+	uint64_t	otp_reqid;
+	uint64_t	otp_size;
+	caddr32_t	otp_buf;
+} overlay_targ_pkt32_t;
+
+#endif /* _KERNEL */
+
+/*
+ * This provides a way to get a list of active overlay devices independently
+ * from dlmgmtd. At the end of the day the kernel always knows what will exist
+ * and this allows varpd which is an implementation of libdladm not to end up
+ * needing to call back into dlmgmtd via libdladm and create an unfortunate
+ * dependency cycle.
+ */
+
+#define	OVERLAY_TARG_LIST	(OVERLAY_TARG_IOCTL | 0x20)
+
+typedef struct overlay_targ_list {
+	uint32_t	otl_nents;
+	uint32_t	otl_ents[];
+} overlay_targ_list_t;
+
+/*
+ * The following family of ioctls all manipulate the target cache of a given
+ * device.
+ *
+ * 	OVERLAY_TARG_CACHE_GET - overlay_targ_cache_t
+ *
+ * 		The overlay_targ_cache_t should be have its link identifier and
+ * 		the desired mac address filled in. On return, it will fill in
+ * 		the otc_dest member, if the entry exists in the table.
+ *
+ *
+ * 	OVERLAY_TARG_CACHE_SET - overlay_targ_cache_t
+ *
+ * 		The cache table entry of the mac address referred to by otc_mac
+ * 		and otd_linkid will be filled in with the details provided by in
+ * 		the otc_dest member.
+ *
+ * 	OVERLAY_TARG_CACHE_REMOVE - overlay_targ_cache_t
+ *
+ * 		Removes the cache entry identified by otc_mac from the table.
+ * 		Note that this does not stop any in-flight lookups or deal with
+ * 		any data that is awaiting a lookup.
+ *
+ *
+ * 	OVERLAY_TARG_CACHE_FLUSH - overlay_targ_cache_t
+ *
+ * 		Similar to OVERLAY_TARG_CACHE_REMOVE, but functions on the
+ * 		entire table identified by otc_linkid. All other parameters are
+ * 		ignored.
+ *
+ *
+ * 	OVERLAY_TARG_CACHE_ITER - overlay_targ_cache_iter_t
+ *
+ * 		Iterates over the contents of a target cache identified by
+ * 		otci_linkid. Iteration is guaranteed to be exactly once for
+ * 		items which are in the hashtable at the beginning and end of
+ * 		iteration. For items which are added or removed after iteration
+ * 		has begun, only at most once semantics are guaranteed. Consumers
+ * 		should ensure that otci_marker is zeroed before starting
+ * 		iteration and should preserve its contents across calls.
+ *
+ * 		Before calling in, otci_count should be set to the number of
+ * 		entries that space has been allocated for in otci_ents. The
+ * 		value will be updated to indicate the total number written out.
+ */
+
+#define	OVERLAY_TARG_CACHE_GET		(OVERLAY_TARG_IOCTL | 0x30)
+#define	OVERLAY_TARG_CACHE_SET		(OVERLAY_TARG_IOCTL | 0x31)
+#define	OVERLAY_TARG_CACHE_REMOVE	(OVERLAY_TARG_IOCTL | 0x32)
+#define	OVERLAY_TARG_CACHE_FLUSH	(OVERLAY_TARG_IOCTL | 0x33)
+#define	OVERLAY_TARG_CACHE_ITER		(OVERLAY_TARG_IOCTL | 0x34)
+
+/*
+ * This is a pretty arbitrary number that we're constraining ourselves to
+ * for iteration. Basically the goal is to make sure that we can't have a user
+ * ask us to allocate too much memory on their behalf at any time. A more
+ * dynamic form may be necessary some day.
+ */
+#define	OVERLAY_TARGET_ITER_MAX	500
+
+#define	OVERLAY_TARGET_CACHE_DROP	0x01
+
+typedef struct overlay_targ_cache_entry {
+	uint8_t			otce_mac[ETHERADDRL];
+	uint16_t		otce_flags;
+	overlay_target_point_t	otce_dest;
+} overlay_targ_cache_entry_t;
+
+typedef struct overlay_targ_cache {
+	datalink_id_t			otc_linkid;
+	overlay_targ_cache_entry_t	otc_entry;
+} overlay_targ_cache_t;
+
+typedef struct overlay_targ_cache_iter {
+	datalink_id_t			otci_linkid;
+	uint32_t			otci_pad;
+	uint64_t			otci_marker;
+	uint16_t			otci_count;
+	uint8_t				otci_pad2[3];
+	overlay_targ_cache_entry_t	otci_ents[];
+} overlay_targ_cache_iter_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _OVERLAY_TARGET_H */
diff --git a/usr/src/uts/common/sys/param.h b/usr/src/uts/common/sys/param.h
index 282d84b912..66bd91f76f 100644
--- a/usr/src/uts/common/sys/param.h
+++ b/usr/src/uts/common/sys/param.h
@@ -116,7 +116,7 @@ extern "C" {
 #define	DEFAULT_MAXPID	999999
 #define	DEFAULT_JUMPPID	100000
 #else
-#define	DEFAULT_MAXPID	30000
+#define	DEFAULT_MAXPID	99999
 #define	DEFAULT_JUMPPID	0
 #endif
 
diff --git a/usr/src/uts/common/sys/pci.h b/usr/src/uts/common/sys/pci.h
index 364fd0f37e..5ed82542c2 100644
--- a/usr/src/uts/common/sys/pci.h
+++ b/usr/src/uts/common/sys/pci.h
@@ -582,6 +582,7 @@ extern "C" {
 #define	PCI_BASE_TYPE_M		0x00000006  /* type indicator mask */
 #define	PCI_BASE_PREF_M		0x00000008  /* prefetch mask */
 #define	PCI_BASE_M_ADDR_M	0xfffffff0  /* memory address mask */
+#define	PCI_BASE_M_ADDR64_M	0xfffffffffffffff0ULL /* 64bit mem addr mask */
 #define	PCI_BASE_IO_ADDR_M	0xfffffffe  /* I/O address mask */
 
 #define	PCI_BASE_ROM_ADDR_M	0xfffff800  /* ROM address mask */
diff --git a/usr/src/uts/common/sys/pci_cap.h b/usr/src/uts/common/sys/pci_cap.h
index 730e10d77b..9804913241 100644
--- a/usr/src/uts/common/sys/pci_cap.h
+++ b/usr/src/uts/common/sys/pci_cap.h
@@ -82,12 +82,12 @@ typedef enum {
 #define	PCI_CAP_GET32(h, i, b, o) ((uint32_t) \
 	pci_cap_get(h, PCI_CAP_CFGSZ_32, i, b, o))
 
-#define	PCI_CAP_PUT8(h, i, b, o, d) ((uint8_t) \
-	pci_cap_put(h, PCI_CAP_CFGSZ_8, i, b, o, d))
-#define	PCI_CAP_PUT16(h, i, b, o, d) ((uint16_t) \
-	pci_cap_put(h, PCI_CAP_CFGSZ_16, i, b, o, d))
-#define	PCI_CAP_PUT32(h, i, b, o, d) ((uint32_t) \
-	pci_cap_put(h, PCI_CAP_CFGSZ_32, i, b, o, d))
+#define	PCI_CAP_PUT8(h, i, b, o, d) \
+	pci_cap_put(h, PCI_CAP_CFGSZ_8, i, b, o, d)
+#define	PCI_CAP_PUT16(h, i, b, o, d) \
+	pci_cap_put(h, PCI_CAP_CFGSZ_16, i, b, o, d)
+#define	PCI_CAP_PUT32(h, i, b, o, d) \
+	pci_cap_put(h, PCI_CAP_CFGSZ_32, i, b, o, d)
 
 #define	PCI_XCAP_GET8(h, i, b, o) ((uint8_t) \
 	pci_cap_get(h, PCI_CAP_CFGSZ_8, PCI_CAP_XCFG_SPC(i), b, o))
@@ -96,12 +96,12 @@ typedef enum {
 #define	PCI_XCAP_GET32(h, i, b, o) ((uint32_t) \
 	pci_cap_get(h, PCI_CAP_CFGSZ_32, PCI_CAP_XCFG_SPC(i), b, o))
 
-#define	PCI_XCAP_PUT8(h, i, b, o, d) ((uint8_t) \
-	pci_cap_put(h, PCI_CAP_CFGSZ_8, PCI_CAP_XCFG_SPC(i), b, o, d))
-#define	PCI_XCAP_PUT16(h, i, b, o, d) ((uint16_t) \
-	pci_cap_put(h, PCI_CAP_CFGSZ_16, PCI_CAP_XCFG_SPC(i), b, o, d))
-#define	PCI_XCAP_PUT32(h, i, b, o, d) ((uint32_t) \
-	pci_cap_put(h, PCI_CAP_CFGSZ_32, PCI_CAP_XCFG_SPC(i), b, o, d))
+#define	PCI_XCAP_PUT8(h, i, b, o, d) \
+	pci_cap_put(h, PCI_CAP_CFGSZ_8, PCI_CAP_XCFG_SPC(i), b, o, d)
+#define	PCI_XCAP_PUT16(h, i, b, o, d) \
+	pci_cap_put(h, PCI_CAP_CFGSZ_16, PCI_CAP_XCFG_SPC(i), b, o, d)
+#define	PCI_XCAP_PUT32(h, i, b, o, d) \
+	pci_cap_put(h, PCI_CAP_CFGSZ_32, PCI_CAP_XCFG_SPC(i), b, o, d)
 
 
 extern int pci_cap_probe(ddi_acc_handle_t h, uint16_t index,
diff --git a/usr/src/uts/common/sys/pci_impl.h b/usr/src/uts/common/sys/pci_impl.h
index 429d6860bd..c998accbcb 100644
--- a/usr/src/uts/common/sys/pci_impl.h
+++ b/usr/src/uts/common/sys/pci_impl.h
@@ -107,7 +107,7 @@ struct pci_bus_resource {
 	boolean_t io_reprogram;	/* need io reprog on this bus */
 	boolean_t mem_reprogram;	/* need mem reprog on this bus */
 	boolean_t subtractive;	/* subtractive PPB */
-	uint_t mem_size;	/* existing children required MEM space size */
+	uint64_t mem_size;	/* existing children required MEM space size */
 	uint_t io_size;		/* existing children required I/O space size */
 };
 
diff --git a/usr/src/uts/common/sys/pcie.h b/usr/src/uts/common/sys/pcie.h
index 05b70a56fa..0e5f929164 100644
--- a/usr/src/uts/common/sys/pcie.h
+++ b/usr/src/uts/common/sys/pcie.h
@@ -22,6 +22,9 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
 
 #ifndef	_SYS_PCIE_H
 #define	_SYS_PCIE_H
@@ -140,6 +143,8 @@ extern "C" {
 #define	PCIE_DEVCAP_PLMT_SCL_1_BY_1000	0xC000000	/* 0.001x Scale */
 #define	PCIE_DEVCAP_PLMT_SCL_MASK	0xC000000	/* Power Limit Scale */
 
+#define	PCIE_DEVCAP_FLR			0x10000000 /* Function Level Reset */
+
 /*
  * Device Control Register (2 bytes)
  */
@@ -174,6 +179,8 @@ extern "C" {
 #define	PCIE_DEVCTL_MAX_READ_REQ_MASK	0x7000	/* Max_Read_Request_Size */
 #define	PCIE_DEVCTL_MAX_READ_REQ_SHIFT	0xC
 
+#define	PCIE_DEVCTL_INITIATE_FLR	0x8000
+
 /*
  * Device Status Register (2 bytes)
  */
@@ -187,7 +194,14 @@ extern "C" {
 /*
  * Link Capability Register (4 bytes)
  */
-#define	PCIE_LINKCAP_MAX_SPEED_2_5	0x1	/* 2.5 Gb/s Speed */
+#define	PCIE_LINKCAP_MAX_SPEED_2_5	0x1	/* 2.5 GT/s Speed */
+/*
+ * In version 2 of PCI express, this indicated that both 5.0 GT/s and 2.5 GT/s
+ * speeds were supported. The use of this as the maximum link speed was added
+ * with PCIex v3.
+ */
+#define	PCIE_LINKCAP_MAX_SPEED_5	0x2	/* 5.0 GT/s Speed */
+#define	PCIE_LINKCAP_MAX_SPEED_8	0x3	/* 8.0 GT/s Speed */
 #define	PCIE_LINKCAP_MAX_SPEED_MASK	0xF	/* Maximum Link Speed */
 #define	PCIE_LINKCAP_MAX_WIDTH_X1	0x010
 #define	PCIE_LINKCAP_MAX_WIDTH_X2	0x020
@@ -251,7 +265,9 @@ extern "C" {
 /*
  * Link Status Register (2 bytes)
  */
-#define	PCIE_LINKSTS_SPEED_2_5		0x1	/* Link Speed */
+#define	PCIE_LINKSTS_SPEED_2_5		0x1	/* 2.5 GT/s Link Speed */
+#define	PCIE_LINKSTS_SPEED_5		0x2	/* 5.0 GT/s Link Speed */
+#define	PCIE_LINKSTS_SPEED_8		0x3	/* 8.0 GT/s Link Speed */
 #define	PCIE_LINKSTS_SPEED_MASK		0xF	/* Link Speed */
 
 #define	PCIE_LINKSTS_NEG_WIDTH_X1	0x010
@@ -386,6 +402,7 @@ extern "C" {
 /*
  * Device Control 2 Register (2 bytes)
  */
+#define	PCIE_DEVCTL2_COM_TO_RANGE_MASK	0xf
 #define	PCIE_DEVCTL2_COM_TO_RANGE_0	0x0
 #define	PCIE_DEVCTL2_COM_TO_RANGE_1	0x1
 #define	PCIE_DEVCTL2_COM_TO_RANGE_2	0x2
@@ -405,8 +422,14 @@ extern "C" {
 #define	PCIE_DEVCTL2_END_END_TLP_PREFIX	0x8000
 
 
-
-
+/*
+ * Link Capability 2 Register (4 bytes)
+ */
+#define	PCIE_LINKCAP2_SPEED_2_5		0x02
+#define	PCIE_LINKCAP2_SPEED_5		0x04
+#define	PCIE_LINKCAP2_SPEED_8		0x08
+#define	PCIE_LINKCAP2_SPEED_MASK	0xfe
+#define	PCIE_LINKCAP2_CROSSLINK		0x100
 
 /*
  * PCI-Express Enhanced Capabilities Link Entry Bit Offsets
diff --git a/usr/src/uts/common/sys/pcie_impl.h b/usr/src/uts/common/sys/pcie_impl.h
index 7be80c49f1..584bba2ebe 100644
--- a/usr/src/uts/common/sys/pcie_impl.h
+++ b/usr/src/uts/common/sys/pcie_impl.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 #ifndef	_SYS_PCIE_IMPL_H
@@ -281,6 +282,28 @@ typedef struct pf_root_fault {
 
 typedef struct pf_data pf_data_t;
 
+typedef enum pcie_link_width {
+	PCIE_LINK_WIDTH_UNKNOWN,
+	PCIE_LINK_WIDTH_X1,
+	PCIE_LINK_WIDTH_X2,
+	PCIE_LINK_WIDTH_X4,
+	PCIE_LINK_WIDTH_X8,
+	PCIE_LINK_WIDTH_X12,
+	PCIE_LINK_WIDTH_X16,
+	PCIE_LINK_WIDTH_X32
+} pcie_link_width_t;
+
+/*
+ * Note, this member should always be treated as a bit field, as a device may
+ * support multiple speeds.
+ */
+typedef enum pcie_link_speed {
+	PCIE_LINK_SPEED_UNKNOWN = 0x00,
+	PCIE_LINK_SPEED_2_5	= 0x01,
+	PCIE_LINK_SPEED_5	= 0x02,
+	PCIE_LINK_SPEED_8	= 0x04
+} pcie_link_speed_t;
+
 /*
  * For hot plugged device, these data are init'ed during during probe
  * For non-hotplugged device, these data are init'ed in pci_autoconfig (on x86),
@@ -335,6 +358,15 @@ typedef struct pcie_bus {
 
 	/* workaround for PCI/PCI-X devs behind PCIe2PCI Bridge */
 	pcie_req_id_t   bus_pcie2pci_secbus;
+
+	/*
+	 * Link speed specific fields.
+	 */
+	pcie_link_width_t	bus_max_width;
+	pcie_link_width_t	bus_cur_width;
+	pcie_link_speed_t	bus_sup_speed;
+	pcie_link_speed_t	bus_max_speed;
+	pcie_link_speed_t	bus_cur_speed;
 } pcie_bus_t;
 
 /*
@@ -361,6 +393,7 @@ struct pf_data {
 	boolean_t		pe_lock;
 	boolean_t		pe_valid;
 	uint32_t		pe_severity_flags;	/* Severity of error */
+	uint32_t		pe_severity_mask;
 	uint32_t		pe_orig_severity_flags; /* Original severity */
 	pf_affected_dev_t	*pe_affected_dev;
 	pcie_bus_t		*pe_bus_p;
@@ -389,6 +422,7 @@ typedef struct pf_impl {
 /* bus_fm_flags field */
 #define	PF_FM_READY		(1 << 0)	/* bus_fm_lock initialized */
 #define	PF_FM_IS_NH		(1 << 1)	/* known as non-hardened */
+#define	PF_FM_IS_PASSTHRU	(1 << 2)	/* device is controlled by VM */
 
 /*
  * PCIe fabric handle lookup address flags.  Used to define what type of
@@ -417,11 +451,10 @@ typedef struct pf_impl {
 #define	PF_ERR_MATCHED_PARENT	(1 << 5) /* Error Handled By Parent */
 #define	PF_ERR_PANIC		(1 << 6) /* Error should panic system */
 #define	PF_ERR_PANIC_DEADLOCK	(1 << 7) /* deadlock detected */
-#define	PF_ERR_PANIC_BAD_RESPONSE (1 << 8) /* Device no response */
+#define	PF_ERR_BAD_RESPONSE	(1 << 8) /* Device bad/no response */
 #define	PF_ERR_MATCH_DOM	(1 << 9) /* Error Handled By IO domain */
 
-#define	PF_ERR_FATAL_FLAGS		\
-	(PF_ERR_PANIC | PF_ERR_PANIC_DEADLOCK | PF_ERR_PANIC_BAD_RESPONSE)
+#define	PF_ERR_FATAL_FLAGS		(PF_ERR_PANIC | PF_ERR_PANIC_DEADLOCK)
 
 #define	PF_HDL_FOUND		1
 #define	PF_HDL_NOTFOUND		2
@@ -525,6 +558,7 @@ extern void pcie_enable_errors(dev_info_t *dip);
 extern void pcie_disable_errors(dev_info_t *dip);
 extern int pcie_enable_ce(dev_info_t *dip);
 extern boolean_t pcie_bridge_is_link_disabled(dev_info_t *);
+extern boolean_t pcie_is_pci_device(dev_info_t *dip);
 
 extern pcie_bus_t *pcie_init_bus(dev_info_t *dip, pcie_req_id_t bdf,
     uint8_t flags);
@@ -583,6 +617,7 @@ extern void pf_eh_enter(pcie_bus_t *bus_p);
 extern void pf_eh_exit(pcie_bus_t *bus_p);
 extern int pf_scan_fabric(dev_info_t *rpdip, ddi_fm_error_t *derr,
     pf_data_t *root_pfd_p);
+extern void pf_set_passthru(dev_info_t *, boolean_t);
 extern void pf_init(dev_info_t *, ddi_iblock_cookie_t, ddi_attach_cmd_t);
 extern void pf_fini(dev_info_t *, ddi_detach_cmd_t);
 extern int pf_hdl_lookup(dev_info_t *, uint64_t, uint32_t, uint64_t,
diff --git a/usr/src/uts/common/sys/policy.h b/usr/src/uts/common/sys/policy.h
index de15be4d60..816d6995cf 100644
--- a/usr/src/uts/common/sys/policy.h
+++ b/usr/src/uts/common/sys/policy.h
@@ -108,6 +108,7 @@ int secpolicy_ipc_owner(const cred_t *, const struct kipc_perm *);
 int secpolicy_kmdb(const cred_t *);
 int secpolicy_lock_memory(const cred_t *);
 int secpolicy_meminfo(const cred_t *);
+int secpolicy_fs_import(const cred_t *);
 int secpolicy_modctl(const cred_t *, int);
 int secpolicy_net(const cred_t *, int, boolean_t);
 int secpolicy_net_bindmlp(const cred_t *);
@@ -176,6 +177,7 @@ int secpolicy_setid_setsticky_clear(vnode_t *, vattr_t *,
     const vattr_t *, cred_t *);
 int secpolicy_xvattr(xvattr_t *, uid_t, cred_t *, vtype_t);
 int secpolicy_xvm_control(const cred_t *);
+int secpolicy_hyprlofs_control(const cred_t *);
 
 int secpolicy_basic_exec(const cred_t *, vnode_t *);
 int secpolicy_basic_fork(const cred_t *);
diff --git a/usr/src/uts/common/sys/poll_impl.h b/usr/src/uts/common/sys/poll_impl.h
index 67b47f9a1e..3e0eb3b21f 100644
--- a/usr/src/uts/common/sys/poll_impl.h
+++ b/usr/src/uts/common/sys/poll_impl.h
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright 2015, Joyent, Inc.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #ifndef _SYS_POLL_IMPL_H
@@ -140,6 +140,7 @@ struct pollstate {
 	pollstate_t	*ps_contend_nextp;	/* next in contender list */
 	pollstate_t	**ps_contend_pnextp;	/* pointer-to-previous-next */
 	int		ps_flags;	/* state flags */
+	short		ps_implicit_ev;	/* implicit poll event interest */
 };
 
 /* pollstate flags */
@@ -225,6 +226,7 @@ struct polldat {
 	int		pd_nsets;	/* num of xref sets, used by poll(2) */
 	xref_t		*pd_ref;	/* ptr to xref info, 1 for each set */
 	port_kevent_t	*pd_portev;	/* associated port event struct */
+	uf_entry_gen_t	pd_gen;		/* fd generation at cache time */
 	uint64_t	pd_epolldata;	/* epoll data, if any */
 };
 
@@ -256,6 +258,7 @@ struct pollcache {
 
 /* pc_flag */
 #define	PC_POLLWAKE	0x02	/* pollwakeup() occurred */
+#define	PC_EPOLL	0x04	/* pollcache is epoll-enabled */
 
 #if defined(_KERNEL)
 /*
diff --git a/usr/src/uts/common/sys/proc.h b/usr/src/uts/common/sys/proc.h
index 712bd7cb24..7d2209132d 100644
--- a/usr/src/uts/common/sys/proc.h
+++ b/usr/src/uts/common/sys/proc.h
@@ -315,6 +315,7 @@ typedef struct	proc {
 	size_t p_swrss;			/* resident set size before last swap */
 	struct aio	*p_aio;		/* pointer to async I/O struct */
 	struct itimer	**p_itimer;	/* interval timers */
+	uint_t		p_itimer_sz;	/* max allocated interval timers */
 	timeout_id_t	p_alarmid;	/* alarm's timeout id */
 	caddr_t		p_usrstack;	/* top of the process stack */
 	uint_t		p_stkprot;	/* stack memory protection */
@@ -358,6 +359,7 @@ typedef struct	proc {
 	struct zone	*p_zone;	/* zone in which process lives */
 	struct vnode	*p_execdir;	/* directory that p_exec came from */
 	struct brand	*p_brand;	/* process's brand  */
+
 	void		*p_brand_data;	/* per-process brand state */
 	psecflags_t	p_secflags;	/* per-process security flags */
 
@@ -374,7 +376,6 @@ typedef struct	proc {
 	 */
 	struct user p_user;		/* (see sys/user.h) */
 } proc_t;
-
 #define	PROC_T				/* headers relying on proc_t are OK */
 
 #ifdef _KERNEL
@@ -640,6 +641,7 @@ extern int signal_is_blocked(kthread_t *, int);
 extern int sigcheck(proc_t *, kthread_t *);
 extern void sigdefault(proc_t *);
 
+extern struct pid *pid_find(pid_t pid);
 extern void pid_setmin(void);
 extern pid_t pid_allocate(proc_t *, pid_t, int);
 extern int pid_rele(struct pid *);
@@ -655,6 +657,7 @@ extern int sprtrylock_proc(proc_t *);
 extern void sprwaitlock_proc(proc_t *);
 extern void sprlock_proc(proc_t *);
 extern void sprunlock(proc_t *);
+extern void sprunprlock(proc_t *);
 extern void pid_init(void);
 extern proc_t *pid_entry(int);
 extern int pid_slot(proc_t *);
@@ -729,6 +732,10 @@ extern	kthread_t *thread_unpin(void);
 extern	void	thread_init(void);
 extern	void	thread_load(kthread_t *, void (*)(), caddr_t, size_t);
 
+extern	void	thread_splitstack(void (*)(void *), void *, size_t);
+extern	void	thread_splitstack_run(caddr_t, void (*)(void *), void *);
+extern	void	thread_splitstack_cleanup(void);
+
 extern	void	tsd_create(uint_t *, void (*)(void *));
 extern	void	tsd_destroy(uint_t *);
 extern	void	*tsd_getcreate(uint_t *, void (*)(void *), void *(*)(void));
@@ -770,7 +777,7 @@ extern	void	pokelwps(proc_t *);
 extern	void	continuelwps(proc_t *);
 extern	int	exitlwps(int);
 extern	void	lwp_ctmpl_copy(klwp_t *, klwp_t *);
-extern	void	lwp_ctmpl_clear(klwp_t *);
+extern	void	lwp_ctmpl_clear(klwp_t *, boolean_t);
 extern	klwp_t	*forklwp(klwp_t *, proc_t *, id_t);
 extern	void	lwp_load(klwp_t *, gregset_t, uintptr_t);
 extern	void	lwp_setrval(klwp_t *, int, int);
diff --git a/usr/src/uts/common/sys/procfs.h b/usr/src/uts/common/sys/procfs.h
index 6bf2e4ddb0..427d682d68 100644
--- a/usr/src/uts/common/sys/procfs.h
+++ b/usr/src/uts/common/sys/procfs.h
@@ -25,6 +25,7 @@
  */
 /*
  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
+ * Copyright 2015, Joyent, Inc.
  */
 
 #ifndef _SYS_PROCFS_H
@@ -234,6 +235,7 @@ typedef struct pstatus {
 #define	PR_FAULTED	6
 #define	PR_SUSPENDED	7
 #define	PR_CHECKPOINT	8
+#define	PR_BRAND	9
 
 /*
  * lwp ps(1) information file.  /proc/<pid>/lwp/<lwpid>/lwpsinfo
diff --git a/usr/src/uts/common/sys/ptms.h b/usr/src/uts/common/sys/ptms.h
index 55987fe6d7..8b97fd7e3b 100644
--- a/usr/src/uts/common/sys/ptms.h
+++ b/usr/src/uts/common/sys/ptms.h
@@ -126,6 +126,12 @@ extern void ptms_logp(char *, uintptr_t);
 #define	DDBGP(a, b)
 #endif
 
+typedef struct __ptmptsopencb_arg *ptmptsopencb_arg_t;
+typedef struct ptmptsopencb {
+	boolean_t		(*ppocb_func)(ptmptsopencb_arg_t);
+	ptmptsopencb_arg_t	ppocb_arg;
+} ptmptsopencb_t;
+
 #endif /* _KERNEL */
 
 typedef struct pt_own {
@@ -157,6 +163,19 @@ typedef struct pt_own {
 #define	ZONEPT		(('P'<<8)|4)	/* set zone of master/slave pair */
 #define	OWNERPT		(('P'<<8)|5)	/* set owner/group for slave device */
 
+#ifdef _KERNEL
+/*
+ * kernel ioctl commands
+ *
+ * PTMPTSOPENCB: Returns a callback function pointer and opaque argument.
+ *	      The return value of the callback function when it's invoked
+ *	      with the opaque argument passed to it will indicate if the
+ *	      pts slave device is currently open.
+ */
+#define	PTMPTSOPENCB	(('P'<<8)|6)	/* check if the slave is open */
+
+#endif /* _KERNEL */
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mptsas_hash.h b/usr/src/uts/common/sys/refhash.h
index 2069e6d3f1..b7427a454d 100644
--- a/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mptsas_hash.h
+++ b/usr/src/uts/common/sys/refhash.h
@@ -10,11 +10,11 @@
  */
 
 /*
- * Copyright 2014 Joyent, Inc.  All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
-#ifndef	_SYS_SCSI_ADAPTERS_MPTHASH_H
-#define	_SYS_SCSI_ADAPTERS_MPTHASH_H
+#ifndef	_SYS_REFHASH_H
+#define	_SYS_REFHASH_H
 
 #include <sys/types.h>
 #include <sys/list.h>
@@ -58,4 +58,4 @@ extern void *refhash_first(refhash_t *);
 extern void *refhash_next(refhash_t *, void *);
 extern boolean_t refhash_obj_valid(refhash_t *hp, const void *);
 
-#endif	/* _SYS_SCSI_ADAPTERS_MPTHASH_H */
+#endif	/* _SYS_REFHASH_H */
diff --git a/usr/src/uts/common/sys/resource.h b/usr/src/uts/common/sys/resource.h
index 13166f378d..d65ca00f69 100644
--- a/usr/src/uts/common/sys/resource.h
+++ b/usr/src/uts/common/sys/resource.h
@@ -23,6 +23,7 @@
  *
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
diff --git a/usr/src/uts/common/sys/rt.h b/usr/src/uts/common/sys/rt.h
index d4233aecb5..2ed7320a09 100644
--- a/usr/src/uts/common/sys/rt.h
+++ b/usr/src/uts/common/sys/rt.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -75,6 +76,16 @@ typedef struct	rtkparms {
 	int	rt_tqsig;	/* real-time time quantum signal */
 	uint_t	rt_cflags;	/* real-time control flags */
 } rtkparms_t;
+
+#define	RTGPPRIO0	100	/* Global priority for RT priority 0 */
+
+/*
+ * control flags (kparms->rt_cflags).
+ */
+#define	RT_DOPRI	0x01	/* change priority */
+#define	RT_DOTQ		0x02	/* change RT time quantum */
+#define	RT_DOSIG	0x04	/* change RT time quantum signal */
+
 #endif	/* _KERNEL */
 
 #ifdef	__cplusplus
diff --git a/usr/src/uts/common/sys/sata/adapters/ahci/ahciem.h b/usr/src/uts/common/sys/sata/adapters/ahci/ahciem.h
new file mode 100644
index 0000000000..7d100c882a
--- /dev/null
+++ b/usr/src/uts/common/sys/sata/adapters/ahci/ahciem.h
@@ -0,0 +1,74 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018 Joyent, Inc.
+ */
+
+#ifndef _AHCIEM_H
+#define	_AHCIEM_H
+
+/*
+ * Private interface to AHCI Enclosure services
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <sys/types.h>
+
+#define	AHCI_EM_IOC	(('a' << 24) | ('e' << 16) | ('m' << 8))
+#define	AHCI_EM_IOC_GET	(AHCI_EM_IOC | 0x00)
+#define	AHCI_EM_IOC_SET	(AHCI_EM_IOC | 0x01)
+
+#define	AHCI_EM_IOC_MAX_PORTS	32
+
+/*
+ * The default state for LEDs is to have ident and fault disabled and activity
+ * enabled, if in hardware control.
+ */
+typedef enum ahci_em_led_state {
+	AHCI_EM_LED_IDENT_ENABLE	= 1 << 0,
+	AHCI_EM_LED_FAULT_ENABLE	= 1 << 1,
+	AHCI_EM_LED_ACTIVITY_DISABLE	= 1 << 2
+} ahci_em_led_state_t;
+
+#define	AHCI_EM_FLAG_CONTROL_ACTIVITY	0x01
+
+typedef struct ahci_ioc_em_get {
+	uint_t	aiemg_nports;
+	uint_t	aiemg_flags;
+	uint_t	aiemg_status[AHCI_EM_IOC_MAX_PORTS];
+} ahci_ioc_em_get_t;
+
+
+/*
+ * Values set in aiems_op that control the behavior of the ioctl. If ADD is set,
+ * the listed flags are added to the current set. If, REM is set, then the flags
+ * are removed. If SET is set, then the flags are replaced.
+ */
+#define	AHCI_EM_IOC_SET_OP_ADD		0x01
+#define	AHCI_EM_IOC_SET_OP_REM		0x02
+#define	AHCI_EM_IOC_SET_OP_SET		0x03
+
+typedef struct ahci_ioc_em_set {
+	uint_t	aiems_port;
+	uint_t	aiems_op;
+	uint_t	aiems_leds;
+	uint_t	aiems_pad;
+} ahci_ioc_em_set_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _AHCIEM_H */
diff --git a/usr/src/uts/common/sys/sata/adapters/ahci/ahcivar.h b/usr/src/uts/common/sys/sata/adapters/ahci/ahcivar.h
index 4e55863414..8195242dd3 100644
--- a/usr/src/uts/common/sys/sata/adapters/ahci/ahcivar.h
+++ b/usr/src/uts/common/sys/sata/adapters/ahci/ahcivar.h
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 
@@ -32,6 +33,8 @@
 extern "C" {
 #endif
 
+#include <sys/sata/adapters/ahci/ahciem.h>
+
 /*
  * AHCI address qualifier flags (in qual field of ahci_addr struct).
  */
@@ -364,6 +367,16 @@ _NOTE(MUTEX_PROTECTS_DATA(ahci_port_t::ahciport_mutex,
 	else								\
 		AHCIPORT_PMSTATE(portp, addrp) = state;
 
+typedef enum ahci_em_flags {
+	AHCI_EM_PRESENT		= 1 << 0,
+	AHCI_EM_RESETTING	= 1 << 1,
+	AHCI_EM_TIMEOUT		= 1 << 2,
+	AHCI_EM_QUIESCE		= 1 << 3,
+	AHCI_EM_READY		= 1 << 4,
+} ahci_em_flags_t;
+
+#define	AHCI_EM_USABLE		(AHCI_EM_PRESENT | AHCI_EM_READY)
+
 typedef struct ahci_ctl {
 	dev_info_t		*ahcictl_dip;
 
@@ -440,6 +453,16 @@ typedef struct ahci_ctl {
 
 	/* FMA capabilities */
 	int			ahcictl_fm_cap;
+
+	/*
+	 * Enclosure information
+	 */
+	uint32_t		ahcictl_em_loc;
+	uint32_t		ahcictl_em_ctl;
+	uintptr_t		ahcictl_em_tx_off;
+	ahci_em_flags_t		ahcictl_em_flags;
+	ddi_taskq_t		*ahcictl_em_taskq;
+	ahci_em_led_state_t	ahcictl_em_state[AHCI_MAX_PORTS];
 } ahci_ctl_t;
 
 /* Warlock annotation */
@@ -492,6 +515,8 @@ _NOTE(MUTEX_PROTECTS_DATA(ahci_ctl_t::ahcictl_mutex,
 #define	AHCI_CAP_PMULT_FBSS		0x400
 /* Software Reset FIS cannot set pmport with 0xf for direct access device */
 #define	AHCI_CAP_SRST_NO_HOSTPORT	0x800
+/* Enclosure Management Services available */
+#define	AHCI_CAP_EMS			0x1000
 
 /* Flags controlling the restart port behavior */
 #define	AHCI_PORT_RESET		0x0001	/* Reset the port */
@@ -531,6 +556,7 @@ _NOTE(MUTEX_PROTECTS_DATA(ahci_ctl_t::ahcictl_mutex,
 #define	AHCI_ATTACH_STATE_PORT_ALLOC		(0x1 << 7)
 #define	AHCI_ATTACH_STATE_HW_INIT		(0x1 << 8)
 #define	AHCI_ATTACH_STATE_TIMEOUT_ENABLED	(0x1 << 9)
+#define	AHCI_ATTACH_STATE_ENCLOSURE		(0x1 << 10)
 
 /* Interval used for delay */
 #define	AHCI_10MS_TICKS	(drv_usectohz(10000))	/* ticks in 10 ms */
@@ -610,6 +636,43 @@ extern uint32_t ahci_debug_flags;
 
 #endif /* DEBUG */
 
+/*
+ * Minimum size required for the enclosure message buffer. This value is in
+ * 4-byte quantities. So we need to multiply it by two.
+ */
+#define	AHCI_EM_BUFFER_MIN	2
+
+/*
+ * Enclosure Management LED message format values
+ */
+#define	AHCI_LED_OFF	0
+#define	AHCI_LED_ON	1
+
+#define	AHCI_LED_ACTIVITY_OFF	0
+#define	AHCI_LED_IDENT_OFF	3
+#define	AHCI_LED_FAULT_OFF	6
+
+#define	AHCI_LED_MASK	0x7
+
+#define	AHCI_EM_MSG_TYPE_LED	0
+#define	AHCI_EM_MSG_TYPE_SAFTE	1
+#define	AHCI_EM_MSG_TYPE_SES	2
+#define	AHCI_EM_MSG_TYPE_SGPIO	3
+
+#pragma pack(1)
+typedef struct ahci_em_led_msg {
+	uint8_t		alm_hba;
+	uint8_t		alm_pminfo;
+	uint16_t	alm_value;
+} ahci_em_led_msg_t;
+
+typedef struct ahci_em_msg_hdr {
+	uint8_t		aemh_rsvd;
+	uint8_t		aemh_mlen;
+	uint8_t		aemh_dlen;
+	uint8_t		aemh_mtype;
+} ahci_em_msg_hdr_t;
+#pragma pack()
 
 #ifdef	__cplusplus
 }
diff --git a/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mpi/mpi2_pci.h b/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mpi/mpi2_pci.h
new file mode 100644
index 0000000000..afb7a94c58
--- /dev/null
+++ b/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mpi/mpi2_pci.h
@@ -0,0 +1,147 @@
+/*-
+ * Copyright (c) 2012-2015 LSI Corp.
+ * Copyright (c) 2013-2016 Avago Technologies
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ *  Copyright (c) 2000-2015 LSI Corporation.
+ *  Copyright (c) 2013-2016 Avago Technologies
+ *  All rights reserved.
+ *
+ *
+ *           Name:  mpi2_pci.h
+ *          Title:  MPI PCIe Attached Devices structures and definitions.
+ *  Creation Date:  October 9, 2012
+ *
+ *  mpi2_pci.h Version:  02.00.02
+ *
+ *  NOTE: Names (typedefs, defines, etc.) beginning with an MPI25 or Mpi25
+ *        prefix are for use only on MPI v2.5 products, and must not be used
+ *        with MPI v2.0 products. Unless otherwise noted, names beginning with
+ *        MPI2 or Mpi2 are for use with both MPI v2.0 and MPI v2.5 products.
+ *
+ *  Version History
+ *  ---------------
+ *
+ *  Date      Version   Description
+ *  --------  --------  ------------------------------------------------------
+ *  03-16-15  02.00.00  Initial version.
+ *  02-17-16  02.00.01  Removed AHCI support.
+ *                      Removed SOP support.
+ *  07-01-16  02.00.02  Added MPI26_NVME_FLAGS_FORCE_ADMIN_ERR_RESP to
+ *                      NVME Encapsulated Request.
+ *  --------------------------------------------------------------------------
+ */
+
+#ifndef MPI2_PCI_H
+#define MPI2_PCI_H
+
+
+/*
+ * Values for the PCIe DeviceInfo field used in PCIe Device Status Change Event
+ * data and PCIe Configuration pages.
+ */
+#define MPI26_PCIE_DEVINFO_DIRECT_ATTACH        (0x00000010)
+
+#define MPI26_PCIE_DEVINFO_MASK_DEVICE_TYPE     (0x0000000F)
+#define MPI26_PCIE_DEVINFO_NO_DEVICE            (0x00000000)
+#define MPI26_PCIE_DEVINFO_PCI_SWITCH           (0x00000001)
+#define MPI26_PCIE_DEVINFO_NVME                 (0x00000003)
+
+
+/****************************************************************************
+*  NVMe Encapsulated message
+****************************************************************************/
+
+/* NVME Encapsulated Request Message */
+typedef struct _MPI26_NVME_ENCAPSULATED_REQUEST
+{
+    U16                     DevHandle;                      /* 0x00 */
+    U8                      ChainOffset;                    /* 0x02 */
+    U8                      Function;                       /* 0x03 */
+    U16                     EncapsulatedCommandLength;      /* 0x04 */
+    U8                      Reserved1;                      /* 0x06 */
+    U8                      MsgFlags;                       /* 0x07 */
+    U8                      VP_ID;                          /* 0x08 */
+    U8                      VF_ID;                          /* 0x09 */
+    U16                     Reserved2;                      /* 0x0A */
+    U32                     Reserved3;                      /* 0x0C */
+    U64                     ErrorResponseBaseAddress;       /* 0x10 */
+    U16                     ErrorResponseAllocationLength;  /* 0x18 */
+    U16                     Flags;                          /* 0x1A */
+    U32                     DataLength;                     /* 0x1C */
+    U8                      NVMe_Command[4];                /* 0x20 */ /* variable length */
+
+} MPI26_NVME_ENCAPSULATED_REQUEST, MPI2_POINTER PTR_MPI26_NVME_ENCAPSULATED_REQUEST,
+  Mpi26NVMeEncapsulatedRequest_t, MPI2_POINTER pMpi26NVMeEncapsulatedRequest_t;
+
+/* defines for the Flags field */
+#define MPI26_NVME_FLAGS_FORCE_ADMIN_ERR_RESP       (0x0020)
+/* Submission Queue Type*/
+#define MPI26_NVME_FLAGS_SUBMISSIONQ_MASK           (0x0010)
+#define MPI26_NVME_FLAGS_SUBMISSIONQ_IO             (0x0000)
+#define MPI26_NVME_FLAGS_SUBMISSIONQ_ADMIN          (0x0010)
+/* Error Response Address Space */
+#define MPI26_NVME_FLAGS_MASK_ERROR_RSP_ADDR        (0x000C)
+#define MPI26_NVME_FLAGS_SYSTEM_RSP_ADDR            (0x0000)
+#define MPI26_NVME_FLAGS_IOCPLB_RSP_ADDR            (0x0008)
+#define MPI26_NVME_FLAGS_IOCPLBNTA_RSP_ADDR         (0x000C)
+/* Data Direction*/
+#define MPI26_NVME_FLAGS_DATADIRECTION_MASK         (0x0003)
+#define MPI26_NVME_FLAGS_NODATATRANSFER             (0x0000)
+#define MPI26_NVME_FLAGS_WRITE                      (0x0001)
+#define MPI26_NVME_FLAGS_READ                       (0x0002)
+#define MPI26_NVME_FLAGS_BIDIRECTIONAL              (0x0003)
+
+
+/* NVMe Encapuslated Reply Message */
+typedef struct _MPI26_NVME_ENCAPSULATED_ERROR_REPLY
+{
+    U16                     DevHandle;                      /* 0x00 */
+    U8                      MsgLength;                      /* 0x02 */
+    U8                      Function;                       /* 0x03 */
+    U16                     EncapsulatedCommandLength;      /* 0x04 */
+    U8                      Reserved1;                      /* 0x06 */
+    U8                      MsgFlags;                       /* 0x07 */
+    U8                      VP_ID;                          /* 0x08 */
+    U8                      VF_ID;                          /* 0x09 */
+    U16                     Reserved2;                      /* 0x0A */
+    U16                     Reserved3;                      /* 0x0C */
+    U16                     IOCStatus;                      /* 0x0E */
+    U32                     IOCLogInfo;                     /* 0x10 */
+    U16                     ErrorResponseCount;             /* 0x14 */
+    U16                     Reserved4;                      /* 0x16 */
+} MPI26_NVME_ENCAPSULATED_ERROR_REPLY,
+  MPI2_POINTER PTR_MPI26_NVME_ENCAPSULATED_ERROR_REPLY,
+  Mpi26NVMeEncapsulatedErrorReply_t,
+  MPI2_POINTER pMpi26NVMeEncapsulatedErrorReply_t;
+
+
+#endif
+
+
diff --git a/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mptsas_var.h b/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mptsas_var.h
index 0050c8c00f..be8bf675b8 100644
--- a/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mptsas_var.h
+++ b/usr/src/uts/common/sys/scsi/adapters/mpt_sas/mptsas_var.h
@@ -58,10 +58,10 @@
 
 #include <sys/byteorder.h>
 #include <sys/queue.h>
+#include <sys/refhash.h>
 #include <sys/isa_defs.h>
 #include <sys/sunmdi.h>
 #include <sys/mdi_impldefs.h>
-#include <sys/scsi/adapters/mpt_sas/mptsas_hash.h>
 #include <sys/scsi/adapters/mpt_sas/mptsas_ioctl.h>
 #include <sys/scsi/adapters/mpt_sas/mpi/mpi2_tool.h>
 #include <sys/scsi/adapters/mpt_sas/mpi/mpi2_cnfg.h>
diff --git a/usr/src/uts/common/sys/scsi/adapters/smrt/smrt.h b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt.h
new file mode 100644
index 0000000000..5aba743834
--- /dev/null
+++ b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt.h
@@ -0,0 +1,750 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#ifndef	_SMRT_H
+#define	_SMRT_H
+
+#include <sys/types.h>
+#include <sys/pci.h>
+#include <sys/param.h>
+#include <sys/errno.h>
+#include <sys/conf.h>
+#include <sys/map.h>
+#include <sys/modctl.h>
+#include <sys/kmem.h>
+#include <sys/cmn_err.h>
+#include <sys/stat.h>
+#include <sys/scsi/scsi.h>
+#include <sys/scsi/impl/spc3_types.h>
+#include <sys/devops.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/sdt.h>
+#include <sys/policy.h>
+#include <sys/ctype.h>
+
+#if !defined(_LITTLE_ENDIAN) || !defined(_BIT_FIELDS_LTOH)
+/*
+ * This driver contains a number of multi-byte bit fields and other structs
+ * that are only correct on a system with the same ordering as x86.
+ */
+#error "smrt: driver works only on little endian systems"
+#endif
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Some structures are statically sized based on the expected number of logical
+ * drives and controllers in the system.  These definitions are used throughout
+ * other driver-specific header files, and must appear prior to their
+ * inclusion.
+ */
+#define	SMRT_MAX_LOGDRV		64	/* Maximum number of logical drives */
+#define	SMRT_MAX_PHYSDEV	128	/* Maximum number of physical devices */
+
+#include <sys/scsi/adapters/smrt/smrt_ciss.h>
+#include <sys/scsi/adapters/smrt/smrt_scsi.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+extern ddi_device_acc_attr_t smrt_dev_attributes;
+
+typedef enum smrt_init_level {
+	SMRT_INITLEVEL_BASIC =			(0x1 << 0),
+	SMRT_INITLEVEL_I2O_MAPPED =		(0x1 << 1),
+	SMRT_INITLEVEL_CFGTBL_MAPPED =		(0x1 << 2),
+	SMRT_INITLEVEL_PERIODIC =		(0x1 << 3),
+	SMRT_INITLEVEL_INT_ALLOC =		(0x1 << 4),
+	SMRT_INITLEVEL_INT_ADDED =		(0x1 << 5),
+	SMRT_INITLEVEL_INT_ENABLED =		(0x1 << 6),
+	SMRT_INITLEVEL_SCSA =			(0x1 << 7),
+	SMRT_INITLEVEL_MUTEX =			(0x1 << 8),
+	SMRT_INITLEVEL_TASKQ =			(0x1 << 9),
+	SMRT_INITLEVEL_ASYNC_EVENT =		(0x1 << 10),
+} smrt_init_level_t;
+
+/*
+ * Commands issued to the controller carry a (generally 32-bit, though with
+ * two reserved signalling bits) identifying tag number.  In order to avoid
+ * having the controller confuse us by double-reporting the completion of a
+ * particular tag, we try to reuse them as infrequently as possible.  In
+ * practice, this means looping through a range of values.  The minimum and
+ * maximum value are defined below.  A single command tag value is set aside
+ * for polled commands sent prior to full initialisation of the driver.
+ */
+#define	SMRT_PRE_TAG_NUMBER			0x00000bad
+#define	SMRT_MIN_TAG_NUMBER			0x00001000
+#define	SMRT_MAX_TAG_NUMBER			0x0fffffff
+
+/*
+ * Character strings that represent the names of the iports used for both
+ * physical and virtual volumes.
+ */
+#define	SMRT_IPORT_PHYS				"p0"
+#define	SMRT_IPORT_VIRT				"v0"
+
+/*
+ * Definitions to support waiting for the controller to converge on a
+ * particular state: ready or not ready.  These are used with
+ * smrt_ctlr_wait_for_state().
+ */
+#define	SMRT_WAIT_DELAY_SECONDS			120
+typedef enum smrt_wait_state {
+	SMRT_WAIT_STATE_READY = 1,
+	SMRT_WAIT_STATE_UNREADY
+} smrt_wait_state_t;
+
+typedef enum smrt_ctlr_mode {
+	SMRT_CTLR_MODE_UNKNOWN = 0,
+	SMRT_CTLR_MODE_SIMPLE
+} smrt_ctlr_mode_t;
+
+/*
+ * In addition to Logical Volumes, we also expose the controller at a
+ * pseudo target address on the SCSI bus we are essentially pretending to be.
+ */
+#define	SMRT_CONTROLLER_TARGET			128
+
+/*
+ * When waiting for volume discovery to complete, we wait for a maximum
+ * duration (in seconds) before giving up.
+ */
+#define	SMRT_DISCOVER_TIMEOUT			30
+
+/*
+ * The maintenance routine which checks for controller lockup and aborts
+ * commands that have passed their timeout runs periodically.  The time is
+ * expressed in seconds.
+ */
+#define	SMRT_PERIODIC_RATE			5
+
+/*
+ * At times, we need to check if the controller is still responding.  To do
+ * that, we send a Nop message to the controller and make sure it completes
+ * successfully.  So that we don't wait forever, we set a timeout (in seconds).
+ */
+#define	SMRT_PING_CHECK_TIMEOUT			60
+
+/*
+ * When detaching the device, we may need to have an asynchronous event
+ * cancellation be issued.  While this should be relatively smooth, we don't
+ * want to wait forever for it.  As such we set a timeout in seconds.
+ */
+#define	SMRT_ASYNC_CANCEL_TIMEOUT		60
+
+/*
+ * HP PCI vendor ID and Generation 9 device ID. Used to identify generations of
+ * supported controllers.
+ */
+#define	SMRT_VENDOR_HP				0x103c
+#define	SMRT_DEVICE_GEN9			0x3238
+
+typedef enum smrt_controller_status {
+	/*
+	 * An attempt is being made to detach the controller instance.
+	 */
+	SMRT_CTLR_STATUS_DETACHING =		(0x1 << 0),
+
+	/*
+	 * The controller is believed to be functioning correctly.  The driver
+	 * is to allow command submission, process interrupts, and perform
+	 * periodic background maintenance.
+	 */
+	SMRT_CTLR_STATUS_RUNNING =		(0x1 << 1),
+
+	/*
+	 * The controller is currently being reset.
+	 */
+	SMRT_CTLR_STATUS_RESETTING =		(0x1 << 2),
+
+	/*
+	 * Our async event notification command is currently in need of help
+	 * from the broader driver.  This will be set by smrt_event_complete()
+	 * to indicate that the command is not being processed due to a
+	 * controller reset or because another fatal error occurred.  The
+	 * periodic will have to pick up and recover this for us.  It is only
+	 * safe for the driver to manipulate the event command outside of
+	 * smrt_event_complete() if this flag is set.
+	 */
+	SMRT_CTLR_ASYNC_INTERVENTION =		(0x1 << 3),
+
+	/*
+	 * See the theory statement on discovery and resets in smrt_ciss.c for
+	 * an explanation of these values.
+	 */
+	SMRT_CTLR_DISCOVERY_REQUESTED =		(0x1 << 4),
+	SMRT_CTLR_DISCOVERY_RUNNING =		(0x1 << 5),
+	SMRT_CTLR_DISCOVERY_PERIODIC =		(0x1 << 6),
+	SMRT_CTLR_DISCOVERY_REQUIRED =		(0x1 << 7),
+} smrt_controller_status_t;
+
+#define	SMRT_CTLR_DISCOVERY_MASK	(SMRT_CTLR_DISCOVERY_REQUESTED | \
+    SMRT_CTLR_DISCOVERY_RUNNING | SMRT_CTLR_DISCOVERY_PERIODIC)
+
+typedef struct smrt_stats {
+	uint64_t smrts_tran_aborts;
+	uint64_t smrts_tran_resets;
+	uint64_t smrts_tran_starts;
+	uint64_t smrts_ctlr_resets;
+	unsigned smrts_max_inflight;
+	uint64_t smrts_unclaimed_interrupts;
+	uint64_t smrts_claimed_interrupts;
+	uint64_t smrts_ignored_scsi_cmds;
+	uint64_t smrts_events_received;
+	uint64_t smrts_events_errors;
+	uint64_t smrts_events_intervened;
+	uint64_t smrts_discovery_tq_errors;
+} smrt_stats_t;
+
+typedef struct smrt_versions {
+	uint8_t smrtv_hardware_version;
+
+	/*
+	 * These strings must be large enough to hold the 4 byte version string
+	 * retrieved from an IDENTIFY CONTROLLER response, as well as the
+	 * terminating NUL byte:
+	 */
+	char smrtv_firmware_rev[5];
+	char smrtv_recovery_rev[5];
+	char smrtv_bootblock_rev[5];
+} smrt_versions_t;
+
+typedef struct smrt smrt_t;
+typedef struct smrt_command smrt_command_t;
+typedef struct smrt_command_internal smrt_command_internal_t;
+typedef struct smrt_command_scsa smrt_command_scsa_t;
+typedef struct smrt_pkt smrt_pkt_t;
+
+/*
+ * Per-Controller Structure
+ */
+struct smrt {
+	dev_info_t *smrt_dip;
+	int smrt_instance;
+	smrt_controller_status_t smrt_status;
+	smrt_stats_t smrt_stats;
+
+	/*
+	 * Controller configuration discovered during initialisation.
+	 */
+	uint32_t smrt_host_support;
+	uint32_t smrt_bus_support;
+	uint32_t smrt_maxcmds;
+	uint32_t smrt_sg_cnt;
+	smrt_versions_t smrt_versions;
+	uint16_t smrt_pci_vendor;
+	uint16_t smrt_pci_device;
+
+	/*
+	 * iport specific data
+	 */
+	dev_info_t *smrt_virt_iport;
+	dev_info_t *smrt_phys_iport;
+	scsi_hba_tgtmap_t *smrt_virt_tgtmap;
+	scsi_hba_tgtmap_t *smrt_phys_tgtmap;
+
+	/*
+	 * The transport mode of the controller.
+	 */
+	smrt_ctlr_mode_t smrt_ctlr_mode;
+
+	/*
+	 * The current initialisation level of the driver.  Bits in this field
+	 * are set during initialisation and unset during cleanup of the
+	 * allocated resources.
+	 */
+	smrt_init_level_t smrt_init_level;
+
+	/*
+	 * Essentially everything is protected by "smrt_mutex".  When the
+	 * completion queue is updated, threads sleeping on "smrt_cv_finishq"
+	 * are awoken.
+	 */
+	kmutex_t smrt_mutex;
+	kcondvar_t smrt_cv_finishq;
+
+	/*
+	 * List of enumerated logical volumes (smrt_volume_t).
+	 */
+	list_t smrt_volumes;
+
+	/*
+	 * List of enumerated physical devices (smrt_physical_t).
+	 */
+	list_t smrt_physicals;
+
+	/*
+	 * List of attached SCSA target drivers (smrt_target_t).
+	 */
+	list_t smrt_targets;
+
+	/*
+	 * Controller Heartbeat Tracking
+	 */
+	uint32_t smrt_last_heartbeat;
+	hrtime_t smrt_last_heartbeat_time;
+
+	hrtime_t smrt_last_interrupt_claimed;
+	hrtime_t smrt_last_interrupt_unclaimed;
+	hrtime_t smrt_last_reset_start;
+	hrtime_t smrt_last_reset_finish;
+
+	/*
+	 * Command object tracking.  These lists, and all commands within the
+	 * lists, are protected by "smrt_mutex".
+	 */
+	uint32_t smrt_next_tag;
+	avl_tree_t smrt_inflight;
+	list_t smrt_commands;		/* List of all commands. */
+	list_t smrt_finishq;		/* List of completed commands. */
+	list_t smrt_abortq;		/* List of commands to abort. */
+
+	/*
+	 * Discovery coordination
+	 */
+	ddi_taskq_t *smrt_discover_taskq;
+	hrtime_t smrt_last_phys_discovery;
+	hrtime_t smrt_last_log_discovery;
+	uint64_t smrt_discover_gen;
+
+	/*
+	 * Controller interrupt handler registration.
+	 */
+	int smrt_interrupt_type;
+	int smrt_interrupt_cap;
+	uint_t smrt_interrupt_pri;
+	ddi_intr_handle_t smrt_interrupts[1];
+	int smrt_ninterrupts;
+
+	ddi_periodic_t smrt_periodic;
+
+	scsi_hba_tran_t *smrt_hba_tran;
+
+	ddi_dma_attr_t smrt_dma_attr;
+
+	/*
+	 * Access to the I2O Registers:
+	 */
+	unsigned smrt_i2o_bar;
+	caddr_t smrt_i2o_space;
+	ddi_acc_handle_t smrt_i2o_handle;
+
+	/*
+	 * Access to the Configuration Table:
+	 */
+	unsigned smrt_ct_bar;
+	uint32_t smrt_ct_baseaddr;
+	CfgTable_t *smrt_ct;
+	ddi_acc_handle_t smrt_ct_handle;
+
+	/*
+	 * Asynchronous Event State
+	 */
+	uint32_t smrt_event_count;
+	smrt_command_t *smrt_event_cmd;
+	smrt_command_t *smrt_event_cancel_cmd;
+	kcondvar_t smrt_event_queue;
+};
+
+/*
+ * Logical Volume Structure
+ */
+typedef enum smrt_volume_flags {
+	SMRT_VOL_FLAG_WWN =			(0x1 << 0),
+} smrt_volume_flags_t;
+
+typedef struct smrt_volume {
+	LUNAddr_t smlv_addr;
+	smrt_volume_flags_t smlv_flags;
+
+	uint8_t smlv_wwn[16];
+	uint64_t smlv_gen;
+
+	smrt_t *smlv_ctlr;
+	list_node_t smlv_link;
+
+	/*
+	 * List of SCSA targets currently attached to this Logical Volume:
+	 */
+	list_t smlv_targets;
+} smrt_volume_t;
+
+typedef struct smrt_physical {
+	LUNAddr_t smpt_addr;
+	uint64_t smpt_wwn;
+	uint8_t smpt_dtype;
+	uint16_t smpt_bmic;
+	uint64_t smpt_gen;
+	boolean_t smpt_supported;
+	boolean_t smpt_visible;
+	boolean_t smpt_unsup_warn;
+	list_node_t smpt_link;
+	list_t smpt_targets;
+	smrt_t *smpt_ctlr;
+	smrt_identify_physical_drive_t *smpt_info;
+} smrt_physical_t;
+
+/*
+ * Per-Target Structure
+ */
+typedef struct smrt_target {
+	struct scsi_device *smtg_scsi_dev;
+
+	boolean_t smtg_physical;
+
+	/*
+	 * This is only used when performing discovery during panic, as we need
+	 * a mechanism to determine if the set of drives has shifted.
+	 */
+	boolean_t smtg_gone;
+
+	/*
+	 * Linkage back to the device that this target represents. This may be
+	 * either a smrt_volume_t or a smrt_physical_t. We keep a pointer to the
+	 * address, as that's the one thing we generally care about.
+	 */
+	union {
+		smrt_physical_t *smtg_phys;
+		smrt_volume_t *smtg_vol;
+	} smtg_lun;
+	list_node_t smtg_link_lun;
+	LUNAddr_t *smtg_addr;
+
+	/*
+	 * Linkage back to the controller:
+	 */
+	smrt_t *smtg_ctlr;
+	list_node_t smtg_link_ctlr;
+} smrt_target_t;
+
+/*
+ * DMA Resource Tracking Structure
+ */
+typedef enum smrt_dma_level {
+	SMRT_DMALEVEL_HANDLE_ALLOC =		(0x1 << 0),
+	SMRT_DMALEVEL_MEMORY_ALLOC =		(0x1 << 1),
+	SMRT_DMALEVEL_HANDLE_BOUND =		(0x1 << 2),
+} smrt_dma_level_t;
+
+typedef struct smrt_dma {
+	smrt_dma_level_t smdma_level;
+	size_t smdma_real_size;
+	ddi_dma_handle_t smdma_dma_handle;
+	ddi_acc_handle_t smdma_acc_handle;
+	ddi_dma_cookie_t smdma_dma_cookies[1];
+	uint_t smdma_dma_ncookies;
+} smrt_dma_t;
+
+
+typedef enum smrt_command_status {
+	/*
+	 * When a command is submitted to the controller, it is marked USED
+	 * to avoid accidental reuse of the command without reinitialising
+	 * critical fields.  The submitted command is also marked INFLIGHT
+	 * to reflect its inclusion in the "smrt_inflight" AVL tree.  When
+	 * the command is completed by the controller, INFLIGHT is unset.
+	 */
+	SMRT_CMD_STATUS_USED =			(0x1 << 0),
+	SMRT_CMD_STATUS_INFLIGHT =		(0x1 << 1),
+
+	/*
+	 * This flag is set during abort queue processing to record that this
+	 * command was aborted in response to an expired timeout, and not some
+	 * other cancellation.  If the controller is able to abort the command,
+	 * we use this flag to let the SCSI framework know that the command
+	 * timed out.
+	 */
+	SMRT_CMD_STATUS_TIMEOUT =		(0x1 << 2),
+
+	/*
+	 * The controller set the error bit when completing this command.
+	 * Details of the particular fault may be read from the error
+	 * information written by the controller.
+	 */
+	SMRT_CMD_STATUS_ERROR =			(0x1 << 3),
+
+	/*
+	 * This command has been abandoned by the original submitter.  This
+	 * could happen if the command did not complete in a timely fashion.
+	 * When it reaches the finish queue it will be freed without further
+	 * processing.
+	 */
+	SMRT_CMD_STATUS_ABANDONED =		(0x1 << 4),
+
+	/*
+	 * This command has made it through the completion queue and had final
+	 * processing performed.
+	 */
+	SMRT_CMD_STATUS_COMPLETE =		(0x1 << 5),
+
+	/*
+	 * A polled message will be ignored by the regular processing of the
+	 * completion queue.  The blocking function doing the polling is
+	 * responsible for watching the command on which it has set the POLLED
+	 * flag.  Regular completion queue processing (which might happen in
+	 * the polling function, or it might happen in the interrupt handler)
+	 * will set POLL_COMPLETE once it is out of the finish queue
+	 * altogether.
+	 */
+	SMRT_CMD_STATUS_POLLED =		(0x1 << 6),
+	SMRT_CMD_STATUS_POLL_COMPLETE =		(0x1 << 7),
+
+	/*
+	 * An abort message has been sent to the controller in an attempt to
+	 * cancel this command.
+	 */
+	SMRT_CMD_STATUS_ABORT_SENT =		(0x1 << 8),
+
+	/*
+	 * This command has been passed to our tran_start(9E) handler.
+	 */
+	SMRT_CMD_STATUS_TRAN_START =		(0x1 << 9),
+
+	/*
+	 * This command was for a SCSI command that we are explicitly avoiding
+	 * sending to the controller.
+	 */
+	SMRT_CMD_STATUS_TRAN_IGNORED =		(0x1 << 10),
+
+	/*
+	 * This command has been submitted once, and subsequently passed to
+	 * smrt_command_reuse().
+	 */
+	SMRT_CMD_STATUS_REUSED =		(0x1 << 11),
+
+	/*
+	 * A controller reset has been issued, so a response for this command
+	 * is not expected.  If one arrives before the controller reset has
+	 * taken effect, it likely cannot be trusted.
+	 */
+	SMRT_CMD_STATUS_RESET_SENT =		(0x1 << 12),
+
+	/*
+	 * Certain commands related to discovery and pinging need to be run
+	 * during the context after a reset has occurred, but before the
+	 * controller is considered.  Such commands can use this flag to bypass
+	 * the normal smrt_submit() check.
+	 */
+	SMRT_CMD_IGNORE_RUNNING =		(0x1 << 13),
+} smrt_command_status_t;
+
+typedef enum smrt_command_type {
+	SMRT_CMDTYPE_INTERNAL = 1,
+	SMRT_CMDTYPE_EVENT,
+	SMRT_CMDTYPE_ABORTQ,
+	SMRT_CMDTYPE_SCSA,
+	SMRT_CMDTYPE_PREINIT,
+} smrt_command_type_t;
+
+struct smrt_command {
+	uint32_t smcm_tag;
+	smrt_command_type_t smcm_type;
+	smrt_command_status_t smcm_status;
+
+	smrt_t *smcm_ctlr;
+	smrt_target_t *smcm_target;
+
+	list_node_t smcm_link;		/* Linkage for allocated list. */
+	list_node_t smcm_link_finish;	/* Linkage for completion list. */
+	list_node_t smcm_link_abort;	/* Linkage for abort list. */
+	avl_node_t smcm_node;		/* Inflight AVL membership. */
+
+	hrtime_t smcm_time_submit;
+	hrtime_t smcm_time_complete;
+
+	hrtime_t smcm_expiry;
+
+	/*
+	 * The time at which an abort message was sent to try and terminate
+	 * this command, as well as the tag of the abort message itself:
+	 */
+	hrtime_t smcm_abort_time;
+	uint32_t smcm_abort_tag;
+
+	/*
+	 * Ancillary data objects.  Only one of these will be allocated for any
+	 * given command, but we nonetheless resist the temptation to use a
+	 * union of pointers in order to make incorrect usage obvious.
+	 */
+	smrt_command_scsa_t *smcm_scsa;
+	smrt_command_internal_t *smcm_internal;
+
+	/*
+	 * Physical allocation tracking for the actual command to send to the
+	 * controller.
+	 */
+	smrt_dma_t smcm_contig;
+
+	CommandList_t *smcm_va_cmd;
+	uint32_t smcm_pa_cmd;
+
+	ErrorInfo_t *smcm_va_err;
+	uint32_t smcm_pa_err;
+};
+
+/*
+ * Commands issued internally to the driver (as opposed to by the HBA
+ * framework) generally require a buffer in which to assemble the command body,
+ * and for receiving the response from the controller.  The following object
+ * tracks this (optional) extra buffer.
+ */
+struct smrt_command_internal {
+	smrt_dma_t smcmi_contig;
+
+	void *smcmi_va;
+	uint32_t smcmi_pa;
+	size_t smcmi_len;
+};
+
+/*
+ * Commands issued via the SCSI framework have a number of additional
+ * properties.
+ */
+struct smrt_command_scsa {
+	struct scsi_pkt *smcms_pkt;
+	smrt_command_t *smcms_command;
+};
+
+
+/*
+ * CISS transport routines.
+ */
+void smrt_periodic(void *);
+void smrt_lockup_check(smrt_t *);
+int smrt_submit(smrt_t *, smrt_command_t *);
+void smrt_submit_simple(smrt_t *, smrt_command_t *);
+int smrt_retrieve(smrt_t *);
+void smrt_retrieve_simple(smrt_t *);
+int smrt_poll_for(smrt_t *, smrt_command_t *);
+int smrt_preinit_command_simple(smrt_t *, smrt_command_t *);
+
+/*
+ * Interrupt service routines.
+ */
+int smrt_interrupts_setup(smrt_t *);
+int smrt_interrupts_enable(smrt_t *);
+void smrt_interrupts_teardown(smrt_t *);
+uint32_t smrt_isr_hw_simple(caddr_t, caddr_t);
+
+/*
+ * Interrupt enable/disable routines.
+ */
+void smrt_intr_set(smrt_t *, boolean_t);
+
+/*
+ * Controller initialisation routines.
+ */
+int smrt_ctlr_init(smrt_t *);
+void smrt_ctlr_teardown(smrt_t *);
+int smrt_ctlr_reset(smrt_t *);
+int smrt_ctlr_wait_for_state(smrt_t *, smrt_wait_state_t);
+int smrt_ctlr_init_simple(smrt_t *);
+void smrt_ctlr_teardown_simple(smrt_t *);
+int smrt_cfgtbl_flush(smrt_t *);
+int smrt_cfgtbl_transport_has_support(smrt_t *, int);
+void smrt_cfgtbl_transport_set(smrt_t *, int);
+int smrt_cfgtbl_transport_confirm(smrt_t *, int);
+uint32_t smrt_ctlr_get_cmdsoutmax(smrt_t *);
+uint32_t smrt_ctlr_get_maxsgelements(smrt_t *);
+
+/*
+ * Device enumeration and lookup routines.
+ */
+void smrt_discover_request(smrt_t *);
+
+int smrt_logvol_discover(smrt_t *, uint16_t, uint64_t);
+void smrt_logvol_teardown(smrt_t *);
+smrt_volume_t *smrt_logvol_lookup_by_id(smrt_t *, unsigned long);
+void smrt_logvol_tgtmap_activate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void **);
+boolean_t smrt_logvol_tgtmap_deactivate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void *, scsi_tgtmap_deact_rsn_t);
+
+int smrt_phys_discover(smrt_t *, uint16_t, uint64_t);
+smrt_physical_t *smrt_phys_lookup_by_ua(smrt_t *, const char *);
+void smrt_phys_teardown(smrt_t *);
+void smrt_phys_tgtmap_activate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void **);
+boolean_t smrt_phys_tgtmap_deactivate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void *, scsi_tgtmap_deact_rsn_t);
+
+/*
+ * SCSI framework routines.
+ */
+int smrt_ctrl_hba_setup(smrt_t *);
+void smrt_ctrl_hba_teardown(smrt_t *);
+
+int smrt_logvol_hba_setup(smrt_t *, dev_info_t *);
+void smrt_logvol_hba_teardown(smrt_t *, dev_info_t *);
+int smrt_phys_hba_setup(smrt_t *, dev_info_t *);
+void smrt_phys_hba_teardown(smrt_t *, dev_info_t *);
+
+void smrt_hba_complete(smrt_command_t *);
+
+void smrt_process_finishq(smrt_t *);
+void smrt_process_abortq(smrt_t *);
+
+/*
+ * Command block management.
+ */
+smrt_command_t *smrt_command_alloc(smrt_t *, smrt_command_type_t,
+    int);
+smrt_command_t *smrt_command_alloc_preinit(smrt_t *, size_t, int);
+int smrt_command_attach_internal(smrt_t *, smrt_command_t *, size_t,
+    int);
+void smrt_command_free(smrt_command_t *);
+smrt_command_t *smrt_lookup_inflight(smrt_t *, uint32_t);
+void smrt_command_reuse(smrt_command_t *);
+
+/*
+ * Device message construction routines.
+ */
+void smrt_write_lun_addr_phys(LUNAddr_t *, boolean_t, unsigned, unsigned);
+void smrt_write_controller_lun_addr(LUNAddr_t *);
+uint16_t smrt_lun_addr_to_bmic(PhysDevAddr_t *);
+void smrt_write_message_abort_one(smrt_command_t *, uint32_t);
+void smrt_write_message_abort_all(smrt_command_t *, LUNAddr_t *);
+void smrt_write_message_nop(smrt_command_t *, int);
+void smrt_write_message_event_notify(smrt_command_t *);
+
+/*
+ * Device management routines.
+ */
+int smrt_device_setup(smrt_t *);
+void smrt_device_teardown(smrt_t *);
+uint32_t smrt_get32(smrt_t *, offset_t);
+void smrt_put32(smrt_t *, offset_t, uint32_t);
+
+/*
+ * SATA related routines.
+ */
+int smrt_sata_determine_wwn(smrt_t *, PhysDevAddr_t *, uint64_t *, uint16_t);
+
+/*
+ * Asynchronous Event Notification
+ */
+int smrt_event_init(smrt_t *);
+void smrt_event_fini(smrt_t *);
+void smrt_event_complete(smrt_command_t *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SMRT_H */
diff --git a/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_ciss.h b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_ciss.h
new file mode 100644
index 0000000000..e1f1db68b3
--- /dev/null
+++ b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_ciss.h
@@ -0,0 +1,345 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (C) 2013 Hewlett-Packard Development Company, L.P.
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#ifndef	_SMRT_CISS_H
+#define	_SMRT_CISS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Maximum number of Scatter/Gather List entries.  These entries are statically
+ * allocated for all commands.
+ */
+#define	CISS_MAXSGENTRIES			64
+
+/*
+ * If the controller advertises a value of 0 for the maximum S/G list length it
+ * supports, the specification states that we should assume a value of 31.
+ */
+#define	CISS_SGCNT_FALLBACK			31
+
+/*
+ * The CDB field in the request block is fixed at 16 bytes in length.  (See
+ * "3.2. Request Block" in the CISS specification.)
+ */
+#define	CISS_CDBLEN				16
+
+/*
+ * Command Status Values.  These are listed in "Table 2 Command Status" in "3.3
+ * Error Info" of the CISS specification.
+ */
+#define	CISS_CMD_SUCCESS			0x00
+#define	CISS_CMD_TARGET_STATUS			0x01
+#define	CISS_CMD_DATA_UNDERRUN			0x02
+#define	CISS_CMD_DATA_OVERRUN			0x03
+#define	CISS_CMD_INVALID			0x04
+#define	CISS_CMD_PROTOCOL_ERR			0x05
+#define	CISS_CMD_HARDWARE_ERR			0x06
+#define	CISS_CMD_CONNECTION_LOST		0x07
+#define	CISS_CMD_ABORTED			0x08
+#define	CISS_CMD_ABORT_FAILED			0x09
+#define	CISS_CMD_UNSOLICITED_ABORT		0x0a
+#define	CISS_CMD_TIMEOUT			0x0b
+#define	CISS_CMD_UNABORTABLE			0x0c
+
+/*
+ * Request Transfer Directions, used in "RequestBlock.Type.Direction":
+ */
+#define	CISS_XFER_NONE				0x00
+#define	CISS_XFER_WRITE				0x01
+#define	CISS_XFER_READ				0x02
+#define	CISS_XFER_RSVD				0x03
+
+/*
+ * Request Attributes, used in "RequestBlock.Type.Attribute":
+ */
+#define	CISS_ATTR_UNTAGGED			0x00
+#define	CISS_ATTR_SIMPLE			0x04
+#define	CISS_ATTR_HEADOFQUEUE			0x05
+#define	CISS_ATTR_ORDERED			0x06
+
+/*
+ * Request Type, used in "RequestBlock.Type.Type":
+ */
+#define	CISS_TYPE_CMD				0x00
+#define	CISS_TYPE_MSG				0x01
+
+/*
+ * I2O Space Register Offsets
+ *
+ * The name "I2O", and these register offsets, appear to be amongst the last
+ * vestiges of a long-defunct attempt at standardising mainframe-style I/O
+ * channels in the Intel server space: the Intelligent Input/Output (I2O)
+ * Architecture Specification.
+ *
+ * The draft of version 1.5 of this specification, in section "4.2.1.5.1
+ * Extensions for PCI", suggests that the following are memory offsets into
+ * "the memory region specified by the first base address configuration
+ * register indicating memory space (offset 10h, 14h, and so forth)".  These
+ * match up with the offsets of the first two BARs in a PCI configuration space
+ * type 0 header.
+ *
+ * The specification also calls out the Inbound Post List FIFO, write-only at
+ * offset 40h; the Outbound Post List FIFO, read-only at offset 44h; the
+ * Interrupt Status Register, at offset 30h; and the Interrupt Mask Register,
+ * at offset 34h.
+ *
+ * This ill-fated attempt to increase the proprietary complexity of (and
+ * presumably, thus, the gross margin on) computer systems is all but extinct.
+ * The transport layer of this storage controller is all that's left of their
+ * religion.
+ */
+#define	CISS_I2O_INBOUND_DOORBELL		0x20
+#define	CISS_I2O_INTERRUPT_STATUS		0x30
+#define	CISS_I2O_INTERRUPT_MASK			0x34
+#define	CISS_I2O_INBOUND_POST_Q			0x40
+#define	CISS_I2O_OUTBOUND_POST_Q		0x44
+#define	CISS_I2O_OUTBOUND_DOORBELL_STATUS	0x9c
+#define	CISS_I2O_OUTBOUND_DOORBELL_CLEAR	0xa0
+#define	CISS_I2O_SCRATCHPAD			0xb0
+#define	CISS_I2O_CFGTBL_CFG_OFFSET		0xb4
+#define	CISS_I2O_CFGTBL_MEM_OFFSET		0xb8
+
+/*
+ * Rather than make a lot of small mappings for each part of the address
+ * space we wish to access, we will make one large mapping.  If more
+ * offsets are added to the I2O list above, this space should be extended
+ * appropriately.
+ */
+#define	CISS_I2O_MAP_BASE			0x20
+#define	CISS_I2O_MAP_LIMIT			0x100
+
+/*
+ * The Scratchpad Register (I2O_SCRATCHPAD) is not mentioned in the CISS
+ * specification.  It serves at least two known functions:
+ *	- Signalling controller readiness
+ *	- Exposing a debugging code when the controller firmware locks up
+ */
+#define	CISS_SCRATCHPAD_INITIALISED		0xffff0000
+
+/*
+ * Outbound Doorbell Register Values.
+ *
+ * These are read from the Outbound Doorbell Set/Status Register
+ * (CISS_I2O_OUTBOUND_DOORBELL_STATUS), but cleared by writing to the Clear
+ * Register (CISS_I2O_OUTBOUND_DOORBELL_CLEAR).
+ */
+#define	CISS_ODR_BIT_INTERRUPT			(1UL << 0)
+#define	CISS_ODR_BIT_LOCKUP			(1UL << 1)
+
+/*
+ * Inbound Doorbell Register Values.
+ *
+ * These are written to and read from the Inbound Doorbell Register
+ * (CISS_I2O_INBOUND_DOORBELL).
+ */
+#define	CISS_IDR_BIT_CFGTBL_CHANGE		(1UL << 0)
+
+/*
+ * Interrupt Mask Register Values.
+ *
+ * These are written to and read from the Interrupt Mask Register
+ * (CISS_I2O_INTERRUPT_MASK).  Note that a 1 bit in this register masks or
+ * disables the interrupt in question; to enable the interrupt the bit must be
+ * set to 0.
+ */
+#define	CISS_IMR_BIT_SIMPLE_INTR_DISABLE	(1UL << 3)
+
+/*
+ * Interrupt Status Register Values.
+ *
+ * These are read from the Interrupt Status Register
+ * (CISS_I2O_INTERRUPT_STATUS).
+ */
+#define	CISS_ISR_BIT_SIMPLE_INTR		(1UL << 3)
+
+/*
+ * Transport Methods.
+ *
+ * These bit positions are used in the Configuration Table to detect controller
+ * support for a particular method, via "TransportSupport"; to request that the
+ * controller enable a particular method, via "TransportRequest"; and to detect
+ * whether the controller has acknowledged the request and enabled the desired
+ * method, via "TransportActive".
+ *
+ * See: "9.1 Configuration Table" in the CISS Specification.
+ */
+#define	CISS_CFGTBL_READY_FOR_COMMANDS		(1UL << 0)
+#define	CISS_CFGTBL_XPORT_SIMPLE		(1UL << 1)
+#define	CISS_CFGTBL_XPORT_PERFORMANT		(1UL << 2)
+#define	CISS_CFGTBL_XPORT_MEMQ			(1UL << 4)
+
+/*
+ * In the Simple Transport Method, when the appropriate interrupt status bit is
+ * set (CISS_ISR_BIT_SIMPLE_INTR), the Outbound Post Queue register is
+ * repeatedly read for notifications of the completion of commands previously
+ * submitted to the controller.  These macros help break up the read value into
+ * its component fields: the tag number, and whether or not the command
+ * completed in error.
+ */
+#define	CISS_OPQ_READ_TAG(x)			((x) >> 2)
+#define	CISS_OPQ_READ_ERROR(x)			((x) & (1UL << 1))
+
+/*
+ * Physical devices that are reported may be marked as 'masked'. A masked device
+ * is one that the driver can see, but must not perform any I/O to.
+ */
+#define	SMRT_CISS_MODE_MASKED			3
+
+/*
+ * The following packed structures are used to ease the manipulation of
+ * requests and responses from the controller.
+ */
+#pragma pack(1)
+
+typedef struct smrt_tag {
+	uint32_t reserved:1;
+	uint32_t error:1;
+	uint32_t tag_value:30;
+	uint32_t unused;
+} smrt_tag_t;
+
+typedef union SCSI3Addr {
+	struct {
+		uint8_t Dev;
+		uint8_t Bus:6;
+		uint8_t Mode:2;
+	} PeripDev;
+	struct {
+		uint8_t DevLSB;
+		uint8_t DevMSB:6;
+		uint8_t Mode:2;
+	} LogDev;
+	struct {
+		uint8_t Dev:5;
+		uint8_t Bus:3;
+		uint8_t Targ:6;
+		uint8_t Mode:2;
+	} LogUnit;
+} SCSI3Addr_t;
+
+typedef struct PhysDevAddr {
+	uint32_t TargetId:24;
+	uint32_t Bus:6;
+	uint32_t Mode:2;
+	SCSI3Addr_t Target[2];
+} PhysDevAddr_t;
+
+typedef struct LogDevAddr {
+	uint32_t VolId:30;
+	uint32_t Mode:2;
+	uint8_t reserved[4];
+} LogDevAddr_t;
+
+typedef union LUNAddr {
+	uint8_t LunAddrBytes[8];
+	SCSI3Addr_t SCSI3Lun[4];
+	PhysDevAddr_t PhysDev;
+	LogDevAddr_t LogDev;
+} LUNAddr_t;
+
+typedef struct CommandListHeader {
+	uint8_t ReplyQueue;
+	uint8_t SGList;
+	uint16_t SGTotal;
+	smrt_tag_t Tag;
+	LUNAddr_t LUN;
+} CommandListHeader_t;
+
+typedef struct RequestBlock {
+	uint8_t CDBLen;
+	struct {
+		uint8_t Type:3;
+		uint8_t Attribute:3;
+		uint8_t Direction:2;
+	} Type;
+	uint16_t Timeout;
+	uint8_t CDB[CISS_CDBLEN];
+} RequestBlock_t;
+
+typedef struct ErrDescriptor {
+	uint64_t Addr;
+	uint32_t Len;
+} ErrDescriptor_t;
+
+typedef struct SGDescriptor {
+	uint64_t Addr;
+	uint32_t Len;
+	uint32_t Ext;
+} SGDescriptor_t;
+
+typedef struct CommandList {
+	CommandListHeader_t Header;
+	RequestBlock_t Request;
+	ErrDescriptor_t ErrDesc;
+	SGDescriptor_t SG[CISS_MAXSGENTRIES];
+} CommandList_t;
+
+typedef union MoreErrInfo {
+	struct {
+		uint8_t Reserved[3];
+		uint8_t Type;
+		uint32_t ErrorInfo;
+	} Common_Info;
+	struct {
+		uint8_t Reserved[2];
+		uint8_t offense_size;
+		uint8_t offense_num;
+		uint32_t offense_value;
+	} Invalid_Cmd;
+} MoreErrInfo_t;
+
+typedef struct ErrorInfo {
+	uint8_t ScsiStatus;
+	uint8_t SenseLen;
+	uint16_t CommandStatus;
+	uint32_t ResidualCnt;
+	MoreErrInfo_t MoreErrInfo;
+	uint8_t SenseInfo[MAX_SENSE_LENGTH];
+} ErrorInfo_t;
+
+typedef struct CfgTable {
+	uint8_t Signature[4];
+	uint32_t SpecValence;
+	uint32_t TransportSupport;
+	uint32_t TransportActive;
+	uint32_t TransportRequest;
+	uint32_t Upper32Addr;
+	uint32_t CoalIntDelay;
+	uint32_t CoalIntCount;
+	uint32_t CmdsOutMax;
+	uint32_t BusTypes;
+	uint32_t TransportMethodOffset;
+	uint8_t ServerName[16];
+	uint32_t HeartBeat;
+	uint32_t HostDrvrSupport;
+	uint32_t MaxSGElements;
+	uint32_t MaxLunSupport;
+	uint32_t MaxPhyDevSupport;
+	uint32_t MaxPhyDrvPerLun;
+	uint32_t MaxPerfModeCmdsOutMax;
+	uint32_t MaxBlockFetchCount;
+} CfgTable_t;
+
+#pragma pack()
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _SMRT_CISS_H */
diff --git a/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_scsi.h b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_scsi.h
new file mode 100644
index 0000000000..47ef99b2e0
--- /dev/null
+++ b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_scsi.h
@@ -0,0 +1,371 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (C) 2013 Hewlett-Packard Development Company, L.P.
+ * Copyright (c) 2017 Joyent, Inc.
+ */
+
+#ifndef	_SMRT_SCSI_H
+#define	_SMRT_SCSI_H
+
+#include <sys/types.h>
+
+#include <sys/scsi/adapters/smrt/smrt_ciss.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/* CISS LUN Addressing MODEs */
+#define	PERIPHERIAL_DEV_ADDR 			0x0
+#define	LOGICAL_VOL_ADDR 			0x1
+#define	MASK_PERIPHERIAL_DEV_ADDR 		0x3
+#define	CISS_PHYS_MODE 				0x0
+
+/*
+ * Vendor-specific SCSI Commands
+ *
+ * These command opcodes are for use in the opcode byte of the CDB in a request
+ * of type CISS_TYPE_CMD.  They are custom SCSI commands, using the
+ * vendor-specific part of the opcode space; i.e., 0xC0 through 0xFF.
+ */
+#define	CISS_SCMD_READ				0xC0
+#define	CISS_SCMD_WRITE				0xC1
+#define	CISS_SCMD_REPORT_LOGICAL_LUNS		0xC2
+#define	CISS_SCMD_REPORT_PHYSICAL_LUNS		0xC3
+
+/*
+ * These command opcodes are _not_ in the usual vendor-specific space, but are
+ * nonetheless vendor-specific.  They allow BMIC commands to be written to and
+ * read from the controller.  If a command transfers no data, the specification
+ * suggests that BMIC_WRITE (0x27) is appropriate.
+ */
+#define	CISS_SCMD_BMIC_READ			0x26
+#define	CISS_SCMD_BMIC_WRITE			0x27
+
+/*
+ * CISS Messages
+ *
+ * The CISS specification describes several directives that do not behave like
+ * SCSI commands.  They are sent in requests of type CISS_TYPE_MSG.
+ *
+ * The Abort, Reset, and Nop, messages are defined in "8. Messages" in the CISS
+ * Specification.
+ */
+#define	CISS_MSG_ABORT				0x0
+#define	CISS_ABORT_TASK				0x0
+#define	CISS_ABORT_TASKSET			0x1
+
+#define	CISS_MSG_RESET				0x1
+#define	CISS_RESET_CTLR				0x0
+#define	CISS_RESET_BUS				0x1
+#define	CISS_RESET_TGT				0x3
+#define	CISS_RESET_LUN				0x4
+
+#define	CISS_MSG_NOP				0x3
+
+/*
+ * BMIC Commands
+ *
+ * These commands allow for the use of non-standard facilities specific to the
+ * Smart Array firmware.  They are sent to the controller through a specially
+ * constructed CDB with the CISS_SCMD_BMIC_READ or CISS_SCMD_BMIC_WRITE opcode.
+ */
+#define	CISS_BMIC_IDENTIFY_CONTROLLER		0x11
+#define	CISS_BMIC_IDENTIFY_PHYSICAL_DEVICE	0x15
+#define	CISS_BMIC_NOTIFY_ON_EVENT		0xD0
+#define	CISS_BMIC_NOTIFY_ON_EVENT_CANCEL	0xD1
+
+/*
+ * Device and Phy type codes.  These are used across many commands, including
+ * IDENTIFY PHYSICAL DEVICE and the REPORT PHYSICAL LUN extended reporting.
+ */
+#define	SMRT_DTYPE_PSCSI			0x00
+#define	SMRT_DTYPE_SATA				0x01
+#define	SMRT_DTYPE_SAS				0x02
+#define	SMRT_DTYPE_SATA_BW			0x03
+#define	SMRT_DTYPE_SAS_BW			0x04
+#define	SMRT_DTYPE_EXPANDER			0x05
+#define	SMRT_DTYPE_SES				0x06
+#define	SMRT_DTYPE_CONTROLLER			0x07
+#define	SMRT_DTYPE_SGPIO			0x08
+#define	SMRT_DTYPE_NVME				0x09
+#define	SMRT_DTYPE_NOPHY			0xFF
+
+/*
+ * The following packed structures are used to ease the manipulation of SCSI
+ * and BMIC commands sent to, and status information returned from, the
+ * controller.
+ */
+#pragma pack(1)
+
+typedef struct smrt_report_logical_lun_ent {
+	LogDevAddr_t smrle_addr;
+} smrt_report_logical_lun_ent_t;
+
+typedef struct smrt_report_logical_lun_extent {
+	LogDevAddr_t smrle_addr;
+	uint8_t smrle_wwn[16];
+} smrt_report_logical_lun_extent_t;
+
+typedef struct smrt_report_logical_lun {
+	uint32_t smrll_datasize; /* Big Endian */
+	uint8_t smrll_extflag;
+	uint8_t smrll_reserved1[3];
+	union {
+		smrt_report_logical_lun_ent_t ents[SMRT_MAX_LOGDRV];
+		smrt_report_logical_lun_extent_t extents[SMRT_MAX_LOGDRV];
+	} smrll_data;
+} smrt_report_logical_lun_t;
+
+typedef struct smrt_report_logical_lun_req {
+	uint8_t smrllr_opcode;
+	uint8_t smrllr_extflag;
+	uint8_t smrllr_reserved1[4];
+	uint32_t smrllr_datasize; /* Big Endian */
+	uint8_t smrllr_reserved2;
+	uint8_t smrllr_control;
+} smrt_report_logical_lun_req_t;
+
+typedef struct smrt_report_physical_lun_ent {
+	PhysDevAddr_t srple_addr;
+} smrt_report_physical_lun_ent_t;
+
+/*
+ * This structure represents the 'physical node identifier' extended option for
+ * REPORT PHYSICAL LUNS.  This is triggered when the extended flags is set to
+ * 0x1.  Note that for SAS the other structure should always be used.
+ */
+typedef struct smrt_report_physical_pnid {
+	uint8_t srpp_node[8];
+	uint8_t srpp_port[8];
+} smrt_report_physical_pnid_t;
+
+/*
+ * This structure represents the 'other physical device info' extended option
+ * for report physical luns.  This is triggered when the extended flags is set
+ * to 0x2.
+ */
+typedef struct smrt_report_physical_opdi {
+	uint8_t srpo_wwid[8];
+	uint8_t srpo_dtype;
+	uint8_t srpo_flags;
+	uint8_t srpo_multilun;
+	uint8_t srpo_paths;
+	uint32_t srpo_iohdl;
+} smrt_report_physical_opdi_t;
+
+typedef struct smrt_report_physical_lun_extent {
+	PhysDevAddr_t srple_addr;
+	union {
+		smrt_report_physical_pnid_t srple_pnid;
+		smrt_report_physical_opdi_t srple_opdi;
+	} srple_extdata;
+} smrt_report_physical_lun_extent_t;
+
+/*
+ * Values that can be ORed together into smrllr_extflag. smprl_extflag indicates
+ * if any extended processing was done or not.
+ */
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_NONE	0x00
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_PNID	0x01
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_OPDI	0x02
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_MASK	0x0f
+#define	SMRT_REPORT_PHYSICAL_LUN_CTRL_ONLY	(1 << 6)
+#define	SMRT_REPORT_PHYSICAL_LUN_ALL_PATHS	(1 << 7)
+
+typedef struct smrt_report_physical_lun {
+	uint32_t smrpl_datasize; /* Big Endian */
+	uint8_t smrpl_extflag;
+	uint8_t smrpl_reserved1[3];
+	union {
+		smrt_report_physical_lun_ent_t ents[SMRT_MAX_PHYSDEV];
+		smrt_report_physical_lun_extent_t extents[SMRT_MAX_PHYSDEV];
+	} smrpl_data;
+} smrt_report_physical_lun_t;
+
+
+typedef struct smrt_report_physical_lun_req {
+	uint8_t smrplr_opcode;
+	uint8_t smrplr_extflag;
+	uint8_t smrplr_reserved[1];
+	uint32_t smrplr_datasize; /* Big Endian */
+	uint8_t smrplr_reserved2;
+	uint8_t smrplr_control;
+} smrt_report_physical_lun_req_t;
+
+/*
+ * Request structure for the BMIC command IDENTIFY CONTROLLER.  This structure
+ * is written into the CDB with the CISS_SCMD_BMIC_READ SCSI opcode.  Reserved
+ * fields should be filled with zeroes.
+ */
+typedef struct smrt_identify_controller_req {
+	uint8_t smicr_opcode;
+	uint8_t smicr_lun;
+	uint8_t smicr_reserved1[4];
+	uint8_t smicr_command;
+	uint8_t smicr_reserved2[2];
+	uint8_t smicr_reserved3[1];
+	uint8_t smicr_reserved4[6];
+} smrt_identify_controller_req_t;
+
+/*
+ * Response structure for IDENTIFY CONTROLLER.  This structure is used to
+ * interpret the response the controller will write into the data buffer.
+ */
+typedef struct smrt_identify_controller {
+	uint8_t smic_logical_drive_count;
+	uint32_t smic_config_signature;
+	uint8_t smic_firmware_rev[4];
+	uint8_t smic_recovery_rev[4];
+	uint8_t smic_hardware_version;
+	uint8_t smic_bootblock_rev[4];
+
+	/*
+	 * These are obsolete for SAS controllers:
+	 */
+	uint32_t smic_drive_present_map;
+	uint32_t smic_external_drive_map;
+
+	uint32_t smic_board_id;
+} smrt_identify_controller_t;
+
+/*
+ * Request structure for IDENTIFY PHYSICAL DEVICE.  This structure is written
+ * into the CDB with the CISS_SCMD_BMIC_READ SCSI opcode.  Reserved fields
+ * should be filled with zeroes.  Note, the lower 8 bits of the BMIC ID are in
+ * index1, whereas the upper 8 bites are in index2; however, the controller may
+ * only support 8 bits worth of devices (and this driver does not support that
+ * many devices).
+ */
+typedef struct smrt_identify_physical_drive_req {
+	uint8_t sipdr_opcode;
+	uint8_t sipdr_lun;
+	uint8_t	sipdr_bmic_index1;
+	uint8_t sipdr_reserved1[3];
+	uint8_t sipdr_command;
+	uint8_t sipdr_reserved2[2];
+	uint8_t sipdr_bmic_index2;
+	uint8_t sipdr_reserved4[6];
+} smrt_identify_physical_drive_req_t;
+
+/*
+ * Relevant values for the sipd_more_flags member.
+ */
+#define	SMRT_MORE_FLAGS_LOGVOL	(1 << 5)
+#define	SMRT_MORE_FLAGS_SPARE	(1 << 6)
+
+/*
+ * Response structure for IDENTIFY PHYSICAL DEVICE.  This structure is used to
+ * describe aspects of a physical drive. Note, not all fields are valid in all
+ * firmware revisions.
+ */
+typedef struct smrt_identify_physical_drive {
+	uint8_t		sipd_scsi_bus;	/* Invalid for SAS */
+	uint8_t		sipd_scsi_id;	/* Invalid for SAS */
+	uint16_t	sipd_lblk_size;
+	uint32_t	sipd_nblocks;
+	uint32_t	sipd_rsrvd_blocsk;
+	uint8_t		sipd_model[40];
+	uint8_t		sipd_serial[40];
+	uint8_t		sipd_firmware[8];
+	uint8_t		sipd_scsi_inquiry;
+	uint8_t		sipd_compaq_stamp;
+	uint8_t		sipd_last_failure;
+	uint8_t		sipd_flags;
+	uint8_t		sipd_more_flags;
+	uint8_t		sipd_scsi_lun;	/* Invalid for SAS */
+	uint8_t		sipd_yet_more_flags;
+	uint8_t		sipd_even_more_flags;
+	uint32_t	sipd_spi_speed_rules;
+	uint8_t		sipd_phys_connector[2];
+	uint8_t		sipd_phys_box_on_bus;
+	uint8_t		sipd_phys_bay_in_box;
+	uint32_t	sipd_rpm;
+	uint8_t		sipd_device_type;
+	uint8_t		sipd_sata_version;
+	uint64_t	sipd_big_nblocks;
+	uint64_t	sipd_ris_slba;
+	uint32_t	sipd_ris_size;
+	uint8_t		sipd_wwid[20];
+	uint8_t		sipd_controller_phy_map[32];
+	uint16_t	sipd_phy_count;
+	uint8_t		sipd_phy_connected_dev_type[256];
+	uint8_t		sipd_phy_to_drive_bay[256];
+	uint16_t	sipd_phy_to_attached_dev[256];
+	uint8_t		sipd_box_index;
+	uint8_t		sipd_drive_support;
+	uint16_t	sipd_extra_flags;
+	uint8_t		sipd_neogiated_link_rate[256];
+	uint8_t		sipd_phy_to_phy_map[256];
+	uint8_t		sipd_pad[312];
+} smrt_identify_physical_drive_t;
+
+/*
+ * Note that this structure describes the CISS version of the command. There
+ * also exists a BMIC version, but it has a slightly different structure.  This
+ * structure is also used for the cancellation request; however, in that case,
+ * the senr_flags field is reserved.
+ */
+typedef struct smrt_event_notify_req {
+	uint8_t		senr_opcode;
+	uint8_t		senr_subcode;
+	uint8_t		senr_reserved1[2];
+	uint32_t	senr_flags;	/* Big Endian */
+	uint32_t	senr_size;	/* Big Endian */
+	uint8_t		senr_control;
+} smrt_event_notify_req_t;
+
+/*
+ * When receiving event notifications, the buffer size must be 512 bytes large.
+ * We make sure that we always allocate a buffer of this size, even though we
+ * define a structure that is much shorter and only uses the fields that we end
+ * up caring about.  This size requirement comes from the specification.
+ */
+#define	SMRT_EVENT_NOTIFY_BUFLEN	512
+
+#define	SMRT_EVENT_CLASS_PROTOCOL		0
+#define	SMRT_EVENT_PROTOCOL_SUBCLASS_ERROR	1
+
+#define	SMRT_EVENT_CLASS_HOTPLUG		1
+#define	SMRT_EVENT_HOTPLUG_SUBCLASS_DRIVE	0
+
+#define	SMRT_EVENT_CLASS_HWERROR		2
+#define	SMRT_EVENT_CLASS_ENVIRONMENT		3
+
+#define	SMRT_EVENT_CLASS_PHYS			4
+#define	SMRT_EVENT_PHYS_SUBCLASS_STATE		0
+
+#define	SMRT_EVENT_CLASS_LOGVOL			5
+
+typedef struct smrt_event_notify {
+	uint32_t	sen_timestamp;
+	uint16_t	sen_class;
+	uint16_t	sen_subclass;
+	uint16_t	sen_detail;
+	uint8_t		sen_data[64];
+	char		sen_message[80];
+	uint32_t	sen_tag;
+	uint16_t	sen_date;
+	uint16_t	sen_year;
+	uint32_t	sen_time;
+	uint16_t	sen_pre_power_time;
+	LUNAddr_t	sen_addr;
+} smrt_event_notify_t;
+
+#pragma pack()
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SMRT_SCSI_H */
diff --git a/usr/src/uts/common/sys/scsi/generic/inquiry.h b/usr/src/uts/common/sys/scsi/generic/inquiry.h
index ddfd683169..fcbf00d5dc 100644
--- a/usr/src/uts/common/sys/scsi/generic/inquiry.h
+++ b/usr/src/uts/common/sys/scsi/generic/inquiry.h
@@ -362,7 +362,8 @@ struct scsi_inquiry {
 #define	DTYPE_NOTPRESENT	(DPQ_NEVER | DTYPE_UNKNOWN)
 
 /*
- * Defined Response Data Formats:
+ * Defined Versions for inquiry data. These represent the base version that a
+ * device supports.
  */
 #define	RDF_LEVEL0		0x00	/* no conformance claim (SCSI-1) */
 #define	RDF_CCS			0x01	/* Obsolete (pseudo-spec) */
@@ -370,7 +371,8 @@ struct scsi_inquiry {
 #define	RDF_SCSI_SPC		0x03	/* ANSI INCITS 301-1997 (SPC) */
 #define	RDF_SCSI_SPC2		0x04	/* ANSI INCITS 351-2001 (SPC-2) */
 #define	RDF_SCSI_SPC3		0x05	/* ANSI INCITS 408-2005 (SPC-3) */
-#define	RDF_SCSI_SPC4		0x06	/* t10 (SPC-4) */
+#define	RDF_SCSI_SPC4		0x06	/* ANSI INCITS 513-2015 (SPC-4) */
+#define	RDF_SCSI_SPC5		0x07	/* t10 (SPC-5) */
 
 /*
  * Defined Target Port Group Select values:
@@ -436,6 +438,7 @@ struct vpd_desc {
 #define	PM_CAPABLE_SPC2		RDF_SCSI_SPC2
 #define	PM_CAPABLE_SPC3		RDF_SCSI_SPC3
 #define	PM_CAPABLE_SPC4		RDF_SCSI_SPC4
+#define	PM_CAPABLE_SPC5		RDF_SCSI_SPC5
 #define	PM_CAPABLE_LOG_MASK	0xffff0000	/* use upper 16 bit to */
 						/* indicate log specifics */
 #define	PM_CAPABLE_LOG_SUPPORTED	0x10000	/* Log page 0xE might be */
diff --git a/usr/src/uts/common/sys/scsi/impl/spc3_types.h b/usr/src/uts/common/sys/scsi/impl/spc3_types.h
index 456a0e336b..4b687eb9c6 100644
--- a/usr/src/uts/common/sys/scsi/impl/spc3_types.h
+++ b/usr/src/uts/common/sys/scsi/impl/spc3_types.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef	_SPC3_TYPES_H
@@ -812,6 +813,30 @@ typedef struct spc3_persistent_reserve_in_cdb {
 } spc3_persistent_reserve_in_cdb_t;
 
 /*
+ * SPC-3 6.15 READ BUFFER
+ */
+typedef struct spc3_read_buffer_cdb {
+	uint8_t rbc_opcode;
+	DECL_BITFIELD2(
+	    rbc_mode		:5,
+	    _reserved		:3);
+	uint8_t	rbc_bufferid;
+	uint8_t rbc_buffer_offset[3];
+	uint8_t rbc_allocation_len[3];
+	spc3_control_t rbc_control;
+} spc3_read_buffer_cdb_t;
+
+typedef enum spc3_read_buffer_mode {
+	SPC3_RB_MODE_COMB_HDR_DATA = 0x00,
+	SPC3_RB_MODE_VENDOR_SPECIFIC = 0x01,
+	SPC3_RB_MODE_DATA = 0x02,
+	SPC3_RB_MODE_DESCRIPTOR = 0x03,
+	SPC3_RB_MODE_ECHO_BUF = 0x0a,
+	SPC3_RB_MODE_ECHO_BUF_DESC = 0x0b,
+	SPC3_RB_MODE_ENABLE_EXPANDER_ECHO_BUF = 0x1a
+} spc3_read_buffer_mode_t;
+
+/*
  * SPC-3 6.16 READ MEDIA SERIAL NUMBER
  */
 typedef struct spc3_read_media_serial_number_cdb {
diff --git a/usr/src/uts/common/sys/scsi/impl/uscsi.h b/usr/src/uts/common/sys/scsi/impl/uscsi.h
index afce8ec081..f416b1bb5a 100644
--- a/usr/src/uts/common/sys/scsi/impl/uscsi.h
+++ b/usr/src/uts/common/sys/scsi/impl/uscsi.h
@@ -21,10 +21,12 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
- * Defines for user SCSI commands					*
+ * Defines for user SCSI commands
  */
 
 #ifndef _SYS_SCSI_IMPL_USCSI_H
@@ -186,10 +188,16 @@ struct uscsi_rqs32	{
 #define	RQS_VALID	0x02	/* RQS data is valid */
 
 /*
+ * Structure for USCSIMAXXFER ioctls
+ */
+typedef uint64_t	uscsi_xfer_t;
+
+/*
  * User SCSI io control command
  */
 #define	USCSIIOC	(0x04 << 8)
 #define	USCSICMD	(USCSIIOC|201) 	/* user scsi command */
+#define	USCSIMAXXFER	(USCSIIOC|202)	/* get max transfer size */
 
 #ifdef	_KERNEL
 
diff --git a/usr/src/uts/common/sys/scsi/targets/sddef.h b/usr/src/uts/common/sys/scsi/targets/sddef.h
index 0c5bb508c5..da9f25c4ae 100644
--- a/usr/src/uts/common/sys/scsi/targets/sddef.h
+++ b/usr/src/uts/common/sys/scsi/targets/sddef.h
@@ -737,6 +737,12 @@ _NOTE(MUTEX_PROTECTS_DATA(sd_lun::un_fi_mutex,
 #define	SD_FM_LOG(un)		(((struct sd_fm_internal *)\
 				((un)->un_fm_private))->fm_log_level)
 
+/*
+ * Version Related Macros
+ */
+#define	SD_SCSI_VERS_IS_GE_SPC_4(un)	\
+	(SD_INQUIRY(un)->inq_ansi == RDF_SCSI_SPC4 || \
+	SD_INQUIRY(un)->inq_ansi == RDF_SCSI_SPC5)
 
 /*
  * Values for un_ctype
@@ -1824,6 +1830,10 @@ struct sd_fm_internal {
 #define	SD_PM_CAPABLE_IS_SPC_4(pm_cap)	\
 	((pm_cap & PM_CAPABLE_PM_MASK) == PM_CAPABLE_SPC4)
 
+#define	SD_PM_CAPABLE_IS_GE_SPC_4(pm_cap)	\
+	(((pm_cap & PM_CAPABLE_PM_MASK) == PM_CAPABLE_SPC4) || \
+	((pm_cap & PM_CAPABLE_PM_MASK) == PM_CAPABLE_SPC5))
+
 #define	SD_PM_CAP_LOG_SUPPORTED(pm_cap)	\
 	((pm_cap & PM_CAPABLE_LOG_SUPPORTED) ? TRUE : FALSE)
 
diff --git a/usr/src/uts/common/sys/shm.h b/usr/src/uts/common/sys/shm.h
index 0219fc2cf7..8f530afda2 100644
--- a/usr/src/uts/common/sys/shm.h
+++ b/usr/src/uts/common/sys/shm.h
@@ -21,6 +21,7 @@
  */
 /*
  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
+ * Copyright 2016 Joyent, Inc.
  *
  * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
@@ -120,6 +121,10 @@ struct shmid_ds {
 #define	SHM_LOCK	3	/* Lock segment in core */
 #define	SHM_UNLOCK	4	/* Unlock segment */
 
+#if defined(_KERNEL)
+#define	SHM_RMID	5	/* Private RMID for lx support */
+#endif
+
 #if !defined(_KERNEL)
 int shmget(key_t, size_t, int);
 int shmids(int *, uint_t, uint_t *);
diff --git a/usr/src/uts/common/sys/shm_impl.h b/usr/src/uts/common/sys/shm_impl.h
index 4d8cdcede5..1eae2ca0a4 100644
--- a/usr/src/uts/common/sys/shm_impl.h
+++ b/usr/src/uts/common/sys/shm_impl.h
@@ -21,13 +21,12 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef	_SYS_SHM_IMPL_H
 #define	_SYS_SHM_IMPL_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/ipc_impl.h>
 #if defined(_KERNEL) || defined(_KMEMUSER)
 #include <sys/shm.h>
@@ -70,7 +69,11 @@ typedef struct kshmid {
 	time_t		shm_ctime;	/* last change time */
 	struct sptinfo	*shm_sptinfo;	/* info about ISM segment */
 	struct seg	*shm_sptseg;	/* pointer to ISM segment */
-	long		shm_sptprot;	/* was reserved (still a "long") */
+	ulong_t		shm_opts;
+					/*
+					 * Composed of: sptprot (uchar_t) and
+					 * RM_PENDING flag (1 bit).
+					 */
 } kshmid_t;
 
 /*
@@ -78,6 +81,14 @@ typedef struct kshmid {
  */
 #define	SHMSA_ISM	1	/* uses shared page table */
 
+/*
+ * shm_opts definitions
+ * Low byte in shm_opts is used for sptprot (see PROT_ALL). The upper bits are
+ * used for additional options.
+ */
+#define	SHM_PROT_MASK	0xff
+#define	SHM_RM_PENDING	0x100
+
 typedef struct sptinfo {
 	struct as	*sptas;		/* dummy as ptr. for spt segment */
 } sptinfo_t;
diff --git a/usr/src/uts/common/sys/signal.h b/usr/src/uts/common/sys/signal.h
index 2ff27d7d7f..1818665b45 100644
--- a/usr/src/uts/common/sys/signal.h
+++ b/usr/src/uts/common/sys/signal.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -158,8 +159,8 @@ struct sigaction32 {
  * use of these symbols by applications is injurious
  *	to binary compatibility
  */
-#define	NSIG	74	/* valid signals range from 1 to NSIG-1 */
-#define	MAXSIG	73	/* size of u_signal[], NSIG-1 <= MAXSIG */
+#define	NSIG	75	/* valid signals range from 1 to NSIG-1 */
+#define	MAXSIG	74	/* size of u_signal[], NSIG-1 <= MAXSIG */
 #endif /* defined(__EXTENSIONS__) || !defined(_XPG4_2) */
 
 #define	MINSIGSTKSZ	2048
diff --git a/usr/src/uts/common/sys/smbios.h b/usr/src/uts/common/sys/smbios.h
index 17c8d199ec..d28141e668 100644
--- a/usr/src/uts/common/sys/smbios.h
+++ b/usr/src/uts/common/sys/smbios.h
@@ -21,7 +21,7 @@
 
 /*
  * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
@@ -178,6 +178,7 @@ typedef union {
  */
 #define	SMB_DEFAULT1	"To Be Filled By O.E.M."
 #define	SMB_DEFAULT2	"Not Available"
+#define	SMB_DEFAULT3	"Default string"
 
 /*
  * SMBIOS Common Information.  These structures do not correspond to anything
diff --git a/usr/src/uts/common/sys/socket.h b/usr/src/uts/common/sys/socket.h
index 93b0af97e8..d6e13d4823 100644
--- a/usr/src/uts/common/sys/socket.h
+++ b/usr/src/uts/common/sys/socket.h
@@ -22,6 +22,7 @@
  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
  *
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc. All rights reserved.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -39,6 +40,9 @@
 
 /* Copyright (c) 2013, OmniTI Computer Consulting, Inc. All rights reserved. */
 
+/*
+ * Copyright (c) 2014, Joyent, Inc. All rights reserved.
+ */
 #ifndef	_SYS_SOCKET_H
 #define	_SYS_SOCKET_H
 
@@ -204,6 +208,7 @@ struct so_snd_bufinfo {
 #define	SO_SRCADDR	0x2001		/* Internal: AF_UNIX source address */
 #define	SO_FILEP	0x2002		/* Internal: AF_UNIX file pointer */
 #define	SO_UNIX_CLOSE	0x2003		/* Internal: AF_UNIX peer closed */
+#define	SO_REUSEPORT	0x2004		/* allow simultaneous port reuse */
 #endif	/* _KERNEL */
 
 /*
@@ -303,8 +308,9 @@ struct	linger {
 #define	AF_INET_OFFLOAD	30		/* Sun private; do not use */
 #define	AF_TRILL	31		/* TRILL interface */
 #define	AF_PACKET	32		/* PF_PACKET Linux socket interface */
+#define	AF_LX_NETLINK	33		/* Linux-compatible netlink */
 
-#define	AF_MAX		32
+#define	AF_MAX		33
 
 /*
  * Protocol families, same as address families for now.
@@ -344,6 +350,7 @@ struct	linger {
 #define	PF_INET_OFFLOAD	AF_INET_OFFLOAD	/* Sun private; do not use */
 #define	PF_TRILL	AF_TRILL
 #define	PF_PACKET	AF_PACKET
+#define	PF_LX_NETLINK	AF_LX_NETLINK
 
 #define	PF_MAX		AF_MAX
 
@@ -429,6 +436,7 @@ struct msghdr32 {
 					/* with left over data */
 #define	MSG_XPG4_2	0x8000		/* Private: XPG4.2 flag */
 
+/* Obsolete but kept for compilation compatability. Use IOV_MAX. */
 #define	MSG_MAXIOVLEN	16
 
 #ifdef _KERNEL
diff --git a/usr/src/uts/common/sys/socketvar.h b/usr/src/uts/common/sys/socketvar.h
index ac07bad909..6794b5687b 100644
--- a/usr/src/uts/common/sys/socketvar.h
+++ b/usr/src/uts/common/sys/socketvar.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -102,6 +103,7 @@ struct sockaddr_ux {
 
 typedef struct sonodeops sonodeops_t;
 typedef struct sonode sonode_t;
+typedef boolean_t (*so_krecv_f)(sonode_t *, mblk_t *, size_t, int, void *);
 
 struct sodirect_s;
 
@@ -244,6 +246,10 @@ struct sonode {
 	struct sof_instance	*so_filter_top;		/* top of stack */
 	struct sof_instance	*so_filter_bottom;	/* bottom of stack */
 	clock_t			so_filter_defertime;	/* time when deferred */
+
+	/* Kernel direct receive callbacks */
+	so_krecv_f		so_krecv_cb;		/* recv callback */
+	void			*so_krecv_arg;		/* recv cb arg */
 };
 
 #define	SO_HAVE_DATA(so)						\
@@ -297,15 +303,16 @@ struct sonode {
 #define	SS_OOBPEND		0x00002000 /* OOB pending or present - poll */
 #define	SS_HAVEOOBDATA		0x00004000 /* OOB data present */
 #define	SS_HADOOBDATA		0x00008000 /* OOB data consumed */
-#define	SS_CLOSING		0x00010000 /* in process of closing */
 
+#define	SS_CLOSING		0x00010000 /* in process of closing */
 #define	SS_FIL_DEFER		0x00020000 /* filter deferred notification */
 #define	SS_FILOP_OK		0x00040000 /* socket can attach filters */
 #define	SS_FIL_RCV_FLOWCTRL	0x00080000 /* filter asserted rcv flow ctrl */
+
 #define	SS_FIL_SND_FLOWCTRL	0x00100000 /* filter asserted snd flow ctrl */
 #define	SS_FIL_STOP		0x00200000 /* no more filter actions */
-
 #define	SS_SODIRECT		0x00400000 /* transport supports sodirect */
+#define	SS_FILOP_UNSF		0x00800000 /* block attaching unsafe filters */
 
 #define	SS_SENTLASTREADSIG	0x01000000 /* last rx signal has been sent */
 #define	SS_SENTLASTWRITESIG	0x02000000 /* last tx signal has been sent */
@@ -321,7 +328,8 @@ struct sonode {
 
 /*
  * Sockets that can fall back to TPI must ensure that fall back is not
- * initiated while a thread is using a socket.
+ * initiated while a thread is using a socket. Otherwise this disables all
+ * future filter attachment.
  */
 #define	SO_BLOCK_FALLBACK(so, fn)				\
 	ASSERT(MUTEX_NOT_HELD(&(so)->so_lock));			\
@@ -337,6 +345,24 @@ struct sonode {
 		}						\
 	}
 
+/*
+ * Sockets that can fall back to TPI must ensure that fall back is not
+ * initiated while a thread is using a socket. Otherwise this disables all
+ * future unsafe filter attachment. Safe filters can still attach after
+ * we execute the function in which this macro is used.
+ */
+#define	SO_BLOCK_FALLBACK_SAFE(so, fn)				\
+	ASSERT(MUTEX_NOT_HELD(&(so)->so_lock));			\
+	rw_enter(&(so)->so_fallback_rwlock, RW_READER);		\
+	if ((so)->so_state & SS_FALLBACK_COMP) {		\
+		rw_exit(&(so)->so_fallback_rwlock);		\
+		return (fn);					\
+	} else if (((so)->so_state & SS_FILOP_UNSF) == 0) {	\
+		mutex_enter(&(so)->so_lock);			\
+		(so)->so_state |= SS_FILOP_UNSF;		\
+		mutex_exit(&(so)->so_lock);			\
+	}
+
 #define	SO_UNBLOCK_FALLBACK(so)	{			\
 	rw_exit(&(so)->so_fallback_rwlock);		\
 }
@@ -368,6 +394,7 @@ struct sonode {
 /* The modes below are only for non-streams sockets */
 #define	SM_ACCEPTSUPP		0x400	/* can handle accept() */
 #define	SM_SENDFILESUPP		0x800	/* Private: proto supp sendfile  */
+#define	SM_DEFERERR		0x1000	/* Private: defer so_error delivery */
 
 /*
  * Socket versions. Used by the socket library when calling _so_socket().
@@ -946,6 +973,15 @@ extern struct sonode	*socreate(struct sockparams *, int, int, int, int,
 extern int	so_copyin(const void *, void *, size_t, int);
 extern int	so_copyout(const void *, void *, size_t, int);
 
+/*
+ * Functions to manipulate the use of direct receive callbacks. This should not
+ * be used outside of sockfs and ksocket. These are generally considered a use
+ * once interface for a socket and will cause all outstanding data on the socket
+ * to be flushed.
+ */
+extern int	so_krecv_set(sonode_t *, so_krecv_f, void *);
+extern void	so_krecv_unblock(sonode_t *);
+
 #endif
 
 /*
diff --git a/usr/src/uts/common/sys/sockfilter.h b/usr/src/uts/common/sys/sockfilter.h
index 9f6d8b499b..c4dd6539de 100644
--- a/usr/src/uts/common/sys/sockfilter.h
+++ b/usr/src/uts/common/sys/sockfilter.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_SOCKFILTER_H
@@ -129,6 +130,15 @@ typedef struct sof_ops {
 
 #define	SOF_VERSION	1
 
+/*
+ * Flag indicating that the filter module is safe to attach after bind,
+ * getsockname, getsockopt or setsockopt calls. By default filters are unsafe
+ * so may not be attached after any socket operation. However, a safe filter
+ * can still be attached after one of the above calls. This makes attaching
+ * the filter less dependent on the initial socket setup order.
+ */
+#define	SOF_ATT_SAFE	0x1
+
 extern int	sof_register(int, const char *, const sof_ops_t *, int);
 extern int	sof_unregister(const char *);
 
diff --git a/usr/src/uts/common/sys/squeue.h b/usr/src/uts/common/sys/squeue.h
index f1bd429815..89b355970e 100644
--- a/usr/src/uts/common/sys/squeue.h
+++ b/usr/src/uts/common/sys/squeue.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #ifndef	_SYS_SQUEUE_H
@@ -29,6 +30,17 @@
 extern "C" {
 #endif
 
+/*
+ * Originally in illumos, we had an IP-centric view of the serialization queue
+ * abstraction. While that has useful properties, the implementation of squeues
+ * hardcodes various parts of the implementation of IP into it which makes it
+ * unsuitable for other consumers. To enable them, we created another interface,
+ * but opted not to port all of the functionality that IP uses in the form of
+ * ip_squeue.c As other consumers need the functionality that IP has in squeues,
+ * then we'll come up with more genericized methods and add that functionality
+ * to <sys/gsqueue.h>. Please do not continue to use this header.
+ */
+
 #include <sys/types.h>
 #include <sys/processor.h>
 #include <sys/stream.h>
@@ -76,16 +88,17 @@ typedef enum {
 
 struct ip_recv_attr_s;
 extern void squeue_init(void);
-extern squeue_t *squeue_create(clock_t, pri_t);
+extern squeue_t *squeue_create(pri_t, boolean_t);
 extern void squeue_bind(squeue_t *, processorid_t);
 extern void squeue_unbind(squeue_t *);
 extern void squeue_enter(squeue_t *, mblk_t *, mblk_t *,
     uint32_t, struct ip_recv_attr_s *, int, uint8_t);
 extern uintptr_t *squeue_getprivate(squeue_t *, sqprivate_t);
+extern void squeue_destroy(squeue_t *);
 
 struct conn_s;
 extern int squeue_synch_enter(struct conn_s *, mblk_t *);
-extern void squeue_synch_exit(struct conn_s *);
+extern void squeue_synch_exit(struct conn_s *, int);
 
 #ifdef	__cplusplus
 }
diff --git a/usr/src/uts/common/sys/squeue_impl.h b/usr/src/uts/common/sys/squeue_impl.h
index 22550886eb..2bb717fb52 100644
--- a/usr/src/uts/common/sys/squeue_impl.h
+++ b/usr/src/uts/common/sys/squeue_impl.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #ifndef	_SYS_SQUEUE_IMPL_H
@@ -84,7 +85,6 @@ typedef void (*sq_enter_proc_t)(squeue_t *, mblk_t *, mblk_t *, uint32_t,
 	    struct ip_recv_attr_s *, int, uint8_t);
 typedef void (*sq_drain_proc_t)(squeue_t *, uint_t, hrtime_t);
 
-extern void squeue_worker_wakeup(squeue_t *);
 extern int ip_squeue_flag;
 
 struct squeue_s {
@@ -99,14 +99,11 @@ struct squeue_s {
 	ill_rx_ring_t	*sq_rx_ring;	/* The Rx ring tied to this sq */
 	ill_t		*sq_ill;	/* The ill this squeue is tied to */
 
-	clock_t		sq_curr_time;	/* Current tick (lbolt) */
+	hrtime_t	sq_awoken;	/* time of worker wake req */
 	kcondvar_t	sq_worker_cv;	/* cond var. worker thread blocks on */
 	kcondvar_t	sq_poll_cv;	/* cond variable poll_thr waits on */
 	kcondvar_t	sq_synch_cv;	/* cond var. synch thread waits on */
 	kcondvar_t	sq_ctrlop_done_cv; /* cond variable for ctrl ops */
-	clock_t		sq_wait;	/* lbolts to wait after a fill() */
-	timeout_id_t	sq_tid;		/* timer id of pending timeout() */
-	clock_t		sq_awaken;	/* time async thread was awakened */
 
 	processorid_t	sq_bind;	/* processor to bind to */
 	kthread_t	*sq_worker;	/* kernel thread id */
@@ -117,6 +114,7 @@ struct squeue_s {
 	squeue_set_t	*sq_set;	/* managed by squeue creator */
 
 	pri_t		sq_priority;	/* squeue thread priority */
+	boolean_t	sq_isip;	/* use IP-centric features */
 
 	/* Keep the debug-only fields at the end of the structure */
 #ifdef DEBUG
@@ -140,7 +138,6 @@ struct squeue_s {
 #define	SQS_USER	0x00000010	/* A non interrupt user */
 #define	SQS_BOUND	0x00000020	/* Worker thread is bound */
 #define	SQS_REENTER	0x00000040	/* Re entered thread */
-#define	SQS_TMO_PROG	0x00000080	/* Timeout is being set */
 
 #define	SQS_POLL_CAPAB	0x00000100	/* Squeue can control interrupts */
 #define	SQS_ILL_BOUND	0x00000200	/* Squeue bound to an ill */
@@ -165,6 +162,7 @@ struct squeue_s {
 #define	SQS_POLL_RESTART_DONE	0x01000000
 #define	SQS_POLL_THR_QUIESCE	0x02000000
 #define	SQS_PAUSE		0x04000000 /* The squeue has been paused */
+#define	SQS_EXIT		0x08000000 /* squeue is being torn down */
 
 #define	SQS_WORKER_THR_CONTROL          \
 	(SQS_POLL_QUIESCE | SQS_POLL_RESTART | SQS_POLL_CLEANUP)
diff --git a/usr/src/uts/common/sys/stream.h b/usr/src/uts/common/sys/stream.h
index 7a2f3c9305..33f7f571fb 100644
--- a/usr/src/uts/common/sys/stream.h
+++ b/usr/src/uts/common/sys/stream.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2015 Joyent, Inc.  All rights reserved.
  * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
  */
 
@@ -631,16 +632,11 @@ struct stroptions {
 /*
  * Structure for rw (read/write) procedure calls. A pointer
  * to a struiod_t is passed as a parameter to the rwnext() call.
- *
- * Note: DEF_IOV_MAX is defined and used as it is in "fs/vncalls.c"
- *	 as there isn't a formal definition of IOV_MAX ???
  */
-#define	DEF_IOV_MAX	16
-
 typedef struct struiod {
 	mblk_t		*d_mp;		/* pointer to mblk (chain) */
 	uio_t		d_uio;		/* uio info */
-	iovec_t d_iov[DEF_IOV_MAX];	/* iov referenced by uio */
+	iovec_t 	*d_iov;		/* iov referenced by uio */
 } struiod_t;
 
 /*
diff --git a/usr/src/uts/common/sys/strsubr.h b/usr/src/uts/common/sys/strsubr.h
index 064fdf5b09..0f29dd3675 100644
--- a/usr/src/uts/common/sys/strsubr.h
+++ b/usr/src/uts/common/sys/strsubr.h
@@ -25,6 +25,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef _SYS_STRSUBR_H
@@ -1238,10 +1239,17 @@ extern void strsignal_nolock(stdata_t *, int, uchar_t);
 
 struct multidata_s;
 struct pdesc_s;
+
+/*
+ * Now that NIC drivers are expected to deal only with M_DATA mblks, the
+ * hcksum_assoc and hcksum_retrieve functions are deprecated in favor of their
+ * respective mac_hcksum_set and mac_hcksum_get counterparts.
+ */
 extern int hcksum_assoc(mblk_t *, struct multidata_s *, struct pdesc_s  *,
     uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, int);
 extern void hcksum_retrieve(mblk_t *, struct multidata_s *, struct pdesc_s *,
     uint32_t *, uint32_t *, uint32_t *, uint32_t *, uint32_t *);
+
 extern void lso_info_set(mblk_t *, uint32_t, uint32_t);
 extern void lso_info_cleanup(mblk_t *);
 extern unsigned int bcksum(uchar_t *, int, unsigned int);
diff --git a/usr/src/uts/common/sys/sunddi.h b/usr/src/uts/common/sys/sunddi.h
index 1d94c8fd2c..b260971a89 100644
--- a/usr/src/uts/common/sys/sunddi.h
+++ b/usr/src/uts/common/sys/sunddi.h
@@ -1585,8 +1585,14 @@ int
 ddi_ffs(long mask);
 
 int
+ddi_ffsll(long long mask);
+
+int
 ddi_fls(long mask);
 
+int
+ddi_flsll(long long mask);
+
 /*
  * The ddi_soft_state* routines comprise generic storage management utilities
  * for driver soft state structures.  Two types of soft_state indexes are
diff --git a/usr/src/uts/common/sys/sysconfig.h b/usr/src/uts/common/sys/sysconfig.h
index 3a68d76ebe..d5b65ef78c 100644
--- a/usr/src/uts/common/sys/sysconfig.h
+++ b/usr/src/uts/common/sys/sysconfig.h
@@ -25,6 +25,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef _SYS_SYSCONFIG_H
@@ -101,6 +102,8 @@ extern int	mach_sysconfig(int);
 
 #define	_CONFIG_EPHID_MAX	47	/* maximum ephemeral uid */
 
+#define	_CONFIG_NPROC_NCPU	48	/* NCPU (sometimes > NPROC_MAX) */
+
 #ifdef	__cplusplus
 }
 #endif
diff --git a/usr/src/uts/common/sys/sysevent.h b/usr/src/uts/common/sys/sysevent.h
index 304745ed08..c2be00ad27 100644
--- a/usr/src/uts/common/sys/sysevent.h
+++ b/usr/src/uts/common/sys/sysevent.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_SYSEVENT_H
@@ -67,10 +68,12 @@ extern "C" {
 #define	SE_KERN_PID	0
 
 #define	SUNW_VENDOR	"SUNW"
+#define	ILLUMOS_VENDOR	"ILLUMOS"
 #define	SE_USR_PUB	"usr:"
 #define	SE_KERN_PUB	"kern:"
 #define	SUNW_KERN_PUB	SUNW_VENDOR ":" SE_KERN_PUB
 #define	SUNW_USR_PUB	SUNW_VENDOR ":" SE_USR_PUB
+#define	ILLUMOS_KERN_PUB	ILLUMOS_VENDOR ":" SE_KERN_PUB
 
 /*
  * Event header and attribute value limits
diff --git a/usr/src/uts/common/sys/sysevent/datalink.h b/usr/src/uts/common/sys/sysevent/datalink.h
new file mode 100644
index 0000000000..592ef5bdde
--- /dev/null
+++ b/usr/src/uts/common/sys/sysevent/datalink.h
@@ -0,0 +1,54 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_SYSEVENT_DATALINK_H
+#define	_SYS_SYSEVENT_DATALINK_H
+
+/*
+ * Datalink System Event payloads
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Event schema for EC_DATALINK_LINK_STATE
+ *
+ * 	Event Class	- EC_DATALINK
+ * 	Event Sub-Class	- EC_DATALINK_LINK_STATE
+ *
+ * 	Attribute Name	- DATALINK_EV_LINK_NAME
+ * 	Attribute Type	- SE_DATA_TYPE_STRING
+ * 	Attribute Value	- [Name of the datalink]
+ *
+ * 	Attribute Name	- DATALINK_EV_LINK_ID
+ * 	Attribute Type	- SE_DATA_TYPE_INT32
+ * 	Attribute Value	- [datalink_id_t for the device]
+ *
+ * 	Attribute Name	- DATALINK_EV_ZONE_ID
+ * 	Attribute Type	- SE_DATA_TYPE_INT32
+ * 	Attribute Value	- [zoneid_t of the zone the datalink is in]
+ */
+
+#define	DATALINK_EV_LINK_NAME		"link"
+#define	DATALINK_EV_LINK_ID		"linkid"
+#define	DATALINK_EV_ZONE_ID		"zone"
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_SYSEVENT_DATALINK_H */
diff --git a/usr/src/uts/common/sys/sysevent/eventdefs.h b/usr/src/uts/common/sys/sysevent/eventdefs.h
index cf6e040ee9..8995ba4aa0 100644
--- a/usr/src/uts/common/sys/sysevent/eventdefs.h
+++ b/usr/src/uts/common/sys/sysevent/eventdefs.h
@@ -212,9 +212,11 @@ extern "C" {
 #define	ESC_ZFS_HISTORY_EVENT		"ESC_ZFS_history_event"
 
 /*
- * datalink subclass definitions.
+ * datalink subclass definitions. Supporting attributes for datalink state found
+ * in sys/sysevent/datalink.h.
  */
 #define	ESC_DATALINK_PHYS_ADD	"ESC_datalink_phys_add"	/* new physical link */
+#define	ESC_DATALINK_LINK_STATE	"ESC_datalink_link_state"	/* link state */
 
 /*
  * VRRP subclass definitions. Supporting attributes (name/value paris) are
diff --git a/usr/src/uts/common/sys/systrace.h b/usr/src/uts/common/sys/systrace.h
index d43974451e..17e509d4d8 100644
--- a/usr/src/uts/common/sys/systrace.h
+++ b/usr/src/uts/common/sys/systrace.h
@@ -22,13 +22,12 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
  */
 
 #ifndef _SYS_SYSTRACE_H
 #define	_SYS_SYSTRACE_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/dtrace.h>
 
 #ifdef	__cplusplus
@@ -47,16 +46,18 @@ extern systrace_sysent_t *systrace_sysent;
 extern systrace_sysent_t *systrace_sysent32;
 
 extern void (*systrace_probe)(dtrace_id_t, uintptr_t, uintptr_t,
-    uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+    uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 extern void systrace_stub(dtrace_id_t, uintptr_t, uintptr_t,
-    uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+    uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 
 extern int64_t dtrace_systrace_syscall(uintptr_t arg0, uintptr_t arg1,
-    uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5);
+    uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5,
+    uintptr_t arg6, uintptr_t arg7);
 
 #ifdef _SYSCALL32_IMPL
 extern int64_t dtrace_systrace_syscall32(uintptr_t arg0, uintptr_t arg1,
-    uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5);
+    uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5,
+    uintptr_t arg6, uintptr_t arg7);
 #endif
 
 #endif
diff --git a/usr/src/uts/common/sys/termios.h b/usr/src/uts/common/sys/termios.h
index 0c07623ce6..b955e5f3f2 100644
--- a/usr/src/uts/common/sys/termios.h
+++ b/usr/src/uts/common/sys/termios.h
@@ -363,6 +363,24 @@ extern pid_t tcgetsid(int);
 #define	TCSETSF		(_TIOC|16)
 
 /*
+ * linux terminal ioctls we need to be aware of
+ */
+#define	TIOCSETLD	(_TIOC|123)	/* set line discipline parms */
+#define	TIOCGETLD	(_TIOC|124)	/* get line discipline parms */
+
+/*
+ * The VMIN and VTIME and solaris overlap with VEOF and VEOL - This is
+ * perfectly legal except, linux expects them to be separate. So we keep
+ * them separately.
+ */
+struct lx_cc {
+	unsigned char veof;	/* veof value */
+	unsigned char veol;	/* veol value */
+	unsigned char vmin;	/* vmin value */
+	unsigned char vtime;	/* vtime value */
+};
+
+/*
  * NTP PPS ioctls
  */
 #define	TIOCGPPS	(_TIOC|125)
diff --git a/usr/src/uts/common/sys/thread.h b/usr/src/uts/common/sys/thread.h
index d917944edf..678d356564 100644
--- a/usr/src/uts/common/sys/thread.h
+++ b/usr/src/uts/common/sys/thread.h
@@ -24,6 +24,10 @@
  * Use is subject to license terms.
  */
 
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
 #ifndef	_SYS_THREAD_H
 #define	_SYS_THREAD_H
 
@@ -67,7 +71,10 @@ typedef struct ctxop {
 	void	(*exit_op)(void *);	/* invoked during {thread,lwp}_exit() */
 	void	(*free_op)(void *, int); /* function which frees the context */
 	void	*arg;		/* argument to above functions, ctx pointer */
-	struct ctxop *next;	/* next context ops */
+	struct ctxop *next;		/* next context ops */
+	struct ctxop *prev;		/* previous context ops */
+	hrtime_t save_ts;		/* timestamp of last save */
+	hrtime_t restore_ts;		/* timestamp of last restore */
 } ctxop_t;
 
 /*
@@ -345,6 +352,10 @@ typedef struct _kthread {
 	kmutex_t	t_ctx_lock;	/* protects t_ctx in removectx() */
 	struct waitq	*t_waitq;	/* wait queue */
 	kmutex_t	t_wait_mutex;	/* used in CV wait functions */
+
+	char		*t_name;	/* thread name */
+
+	uint64_t	t_unsafe;	/* unsafe to run with HT VCPU thread */
 } kthread_t;
 
 /*
@@ -366,7 +377,7 @@ typedef struct _kthread {
 #define	T_WOULDBLOCK	0x0020	/* for lockfs */
 #define	T_DONTBLOCK	0x0040	/* for lockfs */
 #define	T_DONTPEND	0x0080	/* for lockfs */
-#define	T_SYS_PROF	0x0100	/* profiling on for duration of system call */
+#define	T_SPLITSTK	0x0100	/* kernel stack is currently split */
 #define	T_WAITCVSEM	0x0200	/* waiting for a lwp_cv or lwp_sema on sleepq */
 #define	T_WATCHPT	0x0400	/* thread undergoing a watchpoint emulation */
 #define	T_PANIC		0x0800	/* thread initiated a system panic */
@@ -395,6 +406,7 @@ typedef struct _kthread {
 #define	TP_CHANGEBIND	0x1000	/* thread has a new cpu/cpupart binding */
 #define	TP_ZTHREAD	0x2000	/* this is a kernel thread for a zone */
 #define	TP_WATCHSTOP	0x4000	/* thread is stopping via holdwatch() */
+#define	TP_KTHREAD	0x8000	/* in-kernel worker thread for a process */
 
 /*
  * Thread scheduler flag (t_schedflag) definitions.
@@ -407,6 +419,7 @@ typedef struct _kthread {
 #define	TS_SIGNALLED	0x0010	/* thread was awakened by cv_signal() */
 #define	TS_PROJWAITQ	0x0020	/* thread is on its project's waitq */
 #define	TS_ZONEWAITQ	0x0040	/* thread is on its zone's waitq */
+#define	TS_VCPU		0x0080	/* thread will enter guest context */
 #define	TS_CSTART	0x0100	/* setrun() by continuelwps() */
 #define	TS_UNPAUSE	0x0200	/* setrun() by unpauselwps() */
 #define	TS_XSTART	0x0400	/* setrun() by SIGCONT */
@@ -414,8 +427,9 @@ typedef struct _kthread {
 #define	TS_RESUME	0x1000	/* setrun() by CPR resume process */
 #define	TS_CREATE	0x2000	/* setrun() by syslwp_create() */
 #define	TS_RUNQMATCH	0x4000	/* exact run queue balancing by setbackdq() */
+#define	TS_BSTART	0x8000	/* setrun() by brand */
 #define	TS_ALLSTART	\
-	(TS_CSTART|TS_UNPAUSE|TS_XSTART|TS_PSTART|TS_RESUME|TS_CREATE)
+	(TS_CSTART|TS_UNPAUSE|TS_XSTART|TS_PSTART|TS_RESUME|TS_CREATE|TS_BSTART)
 #define	TS_ANYWAITQ	(TS_PROJWAITQ|TS_ZONEWAITQ)
 
 /*
@@ -443,6 +457,10 @@ typedef struct _kthread {
 #define	ISTOPPED(t) ((t)->t_state == TS_STOPPED && \
 			!((t)->t_schedflag & TS_PSTART))
 
+/* True if thread is stopped for a brand-specific reason */
+#define	BSTOPPED(t)	((t)->t_state == TS_STOPPED && \
+			    !((t)->t_schedflag & TS_BSTART))
+
 /* True if thread is asleep and wakeable */
 #define	ISWAKEABLE(t) (((t)->t_state == TS_SLEEP && \
 			((t)->t_flag & T_WAKEABLE)))
@@ -589,10 +607,15 @@ extern disp_lock_t stop_lock;		/* lock protecting stopped threads */
 
 caddr_t	thread_stk_init(caddr_t);	/* init thread stack */
 
+void	thread_setname(kthread_t *, const char *);
+
 extern int default_binding_mode;
+extern int default_stksize;
 
 #endif	/* _KERNEL */
 
+#define	THREAD_NAME_MAX	32	/* includes terminating NUL */
+
 /*
  * Macros to indicate that the thread holds resources that could be critical
  * to other kernel threads, so this thread needs to have kernel priority
diff --git a/usr/src/uts/common/sys/time.h b/usr/src/uts/common/sys/time.h
index 81b4753049..318d3898f5 100644
--- a/usr/src/uts/common/sys/time.h
+++ b/usr/src/uts/common/sys/time.h
@@ -15,6 +15,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
@@ -264,6 +265,14 @@ typedef	longlong_t	hrtime_t;
 
 #if defined(_KERNEL) || defined(_FAKE_KERNEL)
 
+/*
+ * Unsigned counterpart to hrtime_t
+ */
+typedef	u_longlong_t	uhrtime_t;
+
+#define	HRTIME_MAX	LLONG_MAX
+#define	UHRTIME_MAX	ULLONG_MAX
+
 #include <sys/time_impl.h>
 #include <sys/mutex.h>
 
diff --git a/usr/src/uts/common/sys/timer.h b/usr/src/uts/common/sys/timer.h
index ec349c962f..748e0c0627 100644
--- a/usr/src/uts/common/sys/timer.h
+++ b/usr/src/uts/common/sys/timer.h
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2015, Joyent, Inc. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef	_SYS_TIMER_H
@@ -34,6 +34,9 @@
 #include <sys/types.h>
 #include <sys/proc.h>
 #include <sys/thread.h>
+#include <sys/param.h>
+#include <sys/siginfo.h>
+#include <sys/port.h>
 
 #ifdef	__cplusplus
 extern "C" {
@@ -42,7 +45,13 @@ extern "C" {
 #ifdef	_KERNEL
 
 #define	_TIMER_MAX	32
-extern	int	timer_max;		/* patchable via /etc/system */
+/*
+ * Max timers per process.  This is patchable via /etc/system and can be
+ * updated via kmdb.  Sticking to positive powers of 2 is recommended.
+ */
+extern	int	timer_max;
+
+#define	_TIMER_ALLOC_INIT	8	/* initial size for p_itimer array */
 
 /*
  * Bit values for the it_lock field.
@@ -56,6 +65,7 @@ extern	int	timer_max;		/* patchable via /etc/system */
  */
 #define	IT_SIGNAL		0x01
 #define	IT_PORT			0x02	/* use event port notification */
+#define	IT_CALLBACK		0x04	/* custom callback function */
 
 struct clock_backend;
 
@@ -83,14 +93,27 @@ struct itimer {
 	struct clock_backend *it_backend;
 	void		(*it_fire)(itimer_t *);
 	kmutex_t	it_mutex;
-	void		*it_portev;	/* port_kevent_t pointer */
-	void		*it_portsrc;	/* port_source_t pointer */
-	int		it_portfd;	/* port file descriptor */
+	union {
+		struct {
+			void	*_it_portev;	/* port_kevent_t pointer */
+			void	*_it_portsrc;	/* port_source_t pointer */
+			int	_it_portfd;	/* port file descriptor */
+		} _it_ev_port;
+		struct {
+			void		(*_it_cb_func)(itimer_t *);
+			uintptr_t	_it_cb_data[2];
+		} _it_ev_cb;
+	} _it_ev_data;
 };
 
 #define	it_sigq		__data.__proc.__it_sigq
 #define	it_lwp		__data.__proc.__it_lwp
 #define	it_frontend	__data.__it_frontend
+#define	it_portev	_it_ev_data._it_ev_port._it_portev
+#define	it_portsrc	_it_ev_data._it_ev_port._it_portsrc
+#define	it_portfd	_it_ev_data._it_ev_port._it_portfd
+#define	it_cb_func	_it_ev_data._it_ev_cb._it_cb_func
+#define	it_cb_data	_it_ev_data._it_ev_cb._it_cb_data
 
 typedef struct clock_backend {
 	struct sigevent clk_default;
@@ -107,7 +130,11 @@ typedef struct clock_backend {
 extern void clock_add_backend(clockid_t clock, clock_backend_t *backend);
 extern clock_backend_t *clock_get_backend(clockid_t clock);
 
+extern void timer_release(struct proc *, itimer_t *);
+extern void timer_delete_grabbed(struct proc *, timer_t tid, itimer_t *it);
 extern void timer_lwpbind();
+extern int timer_setup(clock_backend_t *, struct sigevent *, port_notify_t *,
+    itimer_t **, timer_t *);
 
 extern	void	timer_func(sigqueue_t *);
 extern	void	timer_exit(void);
diff --git a/usr/src/uts/common/sys/uadmin.h b/usr/src/uts/common/sys/uadmin.h
index 904b52cac4..75d000b831 100644
--- a/usr/src/uts/common/sys/uadmin.h
+++ b/usr/src/uts/common/sys/uadmin.h
@@ -23,6 +23,7 @@
  *
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -159,7 +160,7 @@ extern kmutex_t ualock;
 extern void mdboot(int, int, char *, boolean_t);
 extern void mdpreboot(int, int, char *);
 extern int kadmin(int, int, void *, cred_t *);
-extern void killall(zoneid_t);
+extern void killall(zoneid_t, boolean_t);
 #endif
 
 extern int uadmin(int, int, uintptr_t);
diff --git a/usr/src/uts/common/sys/uio.h b/usr/src/uts/common/sys/uio.h
index bca1ed1fa3..9584be559f 100644
--- a/usr/src/uts/common/sys/uio.h
+++ b/usr/src/uts/common/sys/uio.h
@@ -145,7 +145,8 @@ typedef struct uioa_s {
  */
 typedef enum xuio_type {
 	UIOTYPE_ASYNCIO,
-	UIOTYPE_ZEROCOPY
+	UIOTYPE_ZEROCOPY,
+	UIOTYPE_PEEKSIZE
 } xuio_type_t;
 
 typedef struct xuio {
@@ -175,6 +176,15 @@ typedef struct xuio {
 			int xu_zc_rw;	/* read or write buffer */
 			void *xu_zc_priv;	/* fs specific */
 		} xu_zc;
+
+		/*
+		 * Peek Size Support -- facilitate peeking at the size of a
+		 * waiting message on a socket.
+		 */
+		struct {
+			ssize_t xu_ps_size;	/* size of waiting msg */
+			boolean_t xu_ps_set;	/* was size calculated? */
+		} xu_ps;
 	} xu_ext;
 } xuio_t;
 
diff --git a/usr/src/uts/common/sys/usb/clients/hid/hidminor.h b/usr/src/uts/common/sys/usb/clients/hid/hidminor.h
index c96f914a70..f1b209faad 100644
--- a/usr/src/uts/common/sys/usb/clients/hid/hidminor.h
+++ b/usr/src/uts/common/sys/usb/clients/hid/hidminor.h
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #ifndef _SYS_USB_HIDMINOR_H
@@ -44,21 +44,28 @@ extern "C" {
  * transparent.
  *
  * So we change minor node numbering scheme to be:
- *	external node minor num == instance << 1
- *	internal node minor num == instance << 1 | 0x1
+ *	external node minor num == instance << 9
+ *	internal node minor num == instance << 9 | 0x100
  * (There are only internal nodes for keyboard/mouse now.)
+ *
+ * The 8 bits of the LSB are used for ugen minor numbering (hence the use
+ * of the first bit of the next byte for the "internal" flag)
  */
-#define	HID_MINOR_BITS_MASK		0x1
+#define	HID_MINOR_BITS_MASK		0x1ff
+#define	HID_MINOR_UGEN_BITS_MASK	0xff
 #define	HID_MINOR_INSTANCE_MASK		~HID_MINOR_BITS_MASK
-#define	HID_MINOR_INSTANCE_SHIFT	1
+#define	HID_MINOR_INSTANCE_SHIFT	9
 
-#define	HID_MINOR_INTERNAL		0x1
+#define	HID_MINOR_INTERNAL		0x100
 #define	HID_MINOR_MAKE_INTERNAL(minor) \
 		((minor) | HID_MINOR_INTERNAL)
 
 #define	HID_IS_INTERNAL_OPEN(minor) \
 		(((minor) & HID_MINOR_INTERNAL))
 
+#define	HID_IS_UGEN_OPEN(minor) \
+		(((minor) & HID_MINOR_UGEN_BITS_MASK))
+
 #define	HID_MINOR_TO_INSTANCE(minor) \
 		(((minor) & HID_MINOR_INSTANCE_MASK) >> \
 		HID_MINOR_INSTANCE_SHIFT)
diff --git a/usr/src/uts/common/sys/usb/clients/hid/hidvar.h b/usr/src/uts/common/sys/usb/clients/hid/hidvar.h
index e9a25ea894..ee68f0088a 100644
--- a/usr/src/uts/common/sys/usb/clients/hid/hidvar.h
+++ b/usr/src/uts/common/sys/usb/clients/hid/hidvar.h
@@ -21,7 +21,7 @@
 
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #ifndef _SYS_USB_HIDVAR_H
@@ -33,6 +33,7 @@ extern "C" {
 #endif
 
 #include <sys/usb/usba/usbai_private.h>
+#include <sys/usb/usba/usba_ugen.h>
 
 /*
  * HID : This header file contains the internal structures
@@ -222,6 +223,8 @@ typedef struct hid_state {
 	queue_t			*hid_inuse_rq;
 	int			hid_internal_flag;	/* see below */
 	int			hid_external_flag;	/* see below */
+
+	usb_ugen_hdl_t		hid_ugen_hdl;		/* ugen support */
 } hid_state_t;
 
 /* warlock directives, stable data */
diff --git a/usr/src/uts/common/sys/user.h b/usr/src/uts/common/sys/user.h
index 0b997c518c..15b4d0b247 100644
--- a/usr/src/uts/common/sys/user.h
+++ b/usr/src/uts/common/sys/user.h
@@ -82,6 +82,21 @@ extern "C" {
 #endif
 
 /*
+ * File Descriptor assignment generation.
+ *
+ * Certain file descriptor consumers (namely epoll) need to be able to detect
+ * when the resource underlying an fd change due to (re)assignment.  Checks
+ * comparing old and new file_t pointers work OK, but could easily be fooled by
+ * an entry freed-to and reused-from the cache.  To better detect such
+ * assingments, a generation number is kept in the uf_entry.  Whenever a
+ * non-NULL file_t is assigned to the entry, the generation is incremented,
+ * indicating the change.  There is a minute possibility that a rollover of the
+ * value could cause assigments to evade detection by consumers, but it is
+ * considered acceptably small.
+ */
+typedef uint_t uf_entry_gen_t;
+
+/*
  * Entry in the per-process list of open files.
  * Note: only certain fields are copied in flist_grow() and flist_fork().
  * This is indicated in brackets in the structure member comments.
@@ -96,11 +111,13 @@ typedef struct uf_entry {
 	short		uf_busy;	/* file is allocated [grow, fork] */
 	kcondvar_t	uf_wanted_cv;	/* waiting for setf() [never copied] */
 	kcondvar_t	uf_closing_cv;	/* waiting for close() [never copied] */
-	struct portfd 	*uf_portfd;	/* associated with port [grow] */
+	struct portfd	*uf_portfd;	/* associated with port [grow] */
+	uf_entry_gen_t	uf_gen;		/* assigned fd generation [grow,fork] */
 	/* Avoid false sharing - pad to coherency granularity (64 bytes) */
 	char		uf_pad[64 - sizeof (kmutex_t) - 2 * sizeof (void*) -
 		2 * sizeof (int) - 2 * sizeof (short) -
-		2 * sizeof (kcondvar_t) - sizeof (struct portfd *)];
+		2 * sizeof (kcondvar_t) - sizeof (struct portfd *) -
+		sizeof (uf_entry_gen_t)];
 } uf_entry_t;
 
 /*
@@ -185,9 +202,9 @@ typedef struct {		/* kernel syscall set type */
  * This value should not be changed in a patch.
  */
 #if defined(__sparc)
-#define	__KERN_NAUXV_IMPL 20
+#define	__KERN_NAUXV_IMPL 24
 #elif defined(__i386) || defined(__amd64)
-#define	__KERN_NAUXV_IMPL 25
+#define	__KERN_NAUXV_IMPL 28
 #endif
 
 struct execsw;
diff --git a/usr/src/uts/common/sys/vm.h b/usr/src/uts/common/sys/vm.h
index a8ca2ad377..0f7dfa9fd0 100644
--- a/usr/src/uts/common/sys/vm.h
+++ b/usr/src/uts/common/sys/vm.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1983, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -57,6 +58,8 @@ int	queue_io_request(struct vnode *, u_offset_t);
 extern	kmutex_t	memavail_lock;
 extern	kcondvar_t	memavail_cv;
 
+#define	WAKE_PAGEOUT_SCANNER()	cv_broadcast(&proc_pageout->p_cv)
+
 #endif	/* defined(_KERNEL) */
 
 #ifdef	__cplusplus
diff --git a/usr/src/uts/common/sys/vm_usage.h b/usr/src/uts/common/sys/vm_usage.h
index 1aa4a8ee6d..afbf438eff 100644
--- a/usr/src/uts/common/sys/vm_usage.h
+++ b/usr/src/uts/common/sys/vm_usage.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 #ifndef	_SYS_VM_USAGE_H
@@ -79,8 +80,12 @@ extern "C" {
 					/* zoneid */
 #define	VMUSAGE_COL_EUSERS	0x2000	/* same as VMUSAGE_COL_RUSERS, but by */
 					/* euser */
+#define	VMUSAGE_A_ZONE		0x4000	/* rss/swap for a specified zone */
 
-#define	VMUSAGE_MASK		0x3fff  /* all valid flags for getvmusage() */
+#define	VMUSAGE_MASK		0x7fff  /* all valid flags for getvmusage() */
+
+#define	VMUSAGE_ZONE_FLAGS	(VMUSAGE_ZONE | VMUSAGE_ALL_ZONES | \
+				VMUSAGE_A_ZONE)
 
 typedef struct vmusage {
 	id_t	vmu_zoneid;		/* zoneid, or ALL_ZONES for */
diff --git a/usr/src/uts/common/sys/vmsystm.h b/usr/src/uts/common/sys/vmsystm.h
index c274bae805..2292310bda 100644
--- a/usr/src/uts/common/sys/vmsystm.h
+++ b/usr/src/uts/common/sys/vmsystm.h
@@ -19,6 +19,9 @@
  * CDDL HEADER END
  */
 /*
+ * Copyright (c) 2017, Joyent, Inc. All rights reserved.
+ */
+/*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
@@ -58,6 +61,9 @@ extern pgcnt_t	desscan;	/* desired pages scanned per second */
 extern pgcnt_t	slowscan;
 extern pgcnt_t	fastscan;
 extern pgcnt_t	pushes;		/* number of pages pushed to swap device */
+extern uint64_t	low_mem_scan;	/* num times page scan due to low memory */
+extern uint64_t	zone_cap_scan;	/* num times page scan due to zone cap */
+extern uint64_t	n_throttle;	/* num times page create throttled */
 
 /* writable copies of tunables */
 extern pgcnt_t	maxpgio;	/* max paging i/o per sec before start swaps */
@@ -159,6 +165,8 @@ extern	void	*boot_virt_alloc(void *addr, size_t size);
 
 extern	size_t	exec_get_spslew(void);
 
+extern	caddr_t	map_userlimit(proc_t *pp, struct as *as, int flags);
+
 #endif	/* _KERNEL */
 
 #ifdef	__cplusplus
diff --git a/usr/src/uts/common/sys/vnd.h b/usr/src/uts/common/sys/vnd.h
new file mode 100644
index 0000000000..bc7c9c3122
--- /dev/null
+++ b/usr/src/uts/common/sys/vnd.h
@@ -0,0 +1,141 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc. All rights reserved.
+ */
+
+#ifndef _SYS_VND_H
+#define	_SYS_VND_H
+
+#include <sys/types.h>
+#include <sys/vnd_errno.h>
+#include <sys/frameio.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * We distinguish between normal ioctls and private ioctls we issues to out
+ * streams version. Streams ioctls have the upper bit set in the lowest byte.
+ * Note that there are no STREAMs ioctls for userland and all definitions
+ * related to them are not present in this file.
+ */
+#define	VND_IOC		(('v' << 24) | ('n' << 16) | ('d' << 8))
+
+/*
+ * Attach the current minor instance to a given dlpi datalink identified by a
+ * vnd_ioc_name_t argument. This fails if it's already been attached. Note that
+ * unlike the other ioctls, this is passed directly as opposed to every other
+ * function which is passed as a pointer to the value.
+ */
+#define	VND_IOC_ATTACH		(VND_IOC | 0x1)
+
+#define	VND_NAMELEN	32
+
+typedef struct vnd_ioc_attach {
+	char		via_name[VND_NAMELEN];
+	zoneid_t	via_zoneid;
+	uint32_t	via_errno;
+} vnd_ioc_attach_t;
+
+/*
+ * Link the current minor instance into the /devices name space.
+ *
+ * This ioctl adds entries into /devices with a name of the form z%d:%s vil_zid,
+ * vil_name. The device will be namespaced to the zone. The global zone will be
+ * able to see all minor nodes. In the zone, only the /dev entries will exist.
+ * At this time, a given device can only have one link at a time. Note that a
+ * user cannot specify the zone to pass in, rather it is the zone that the
+ * device was attached in.
+ */
+#define	VND_IOC_LINK		(VND_IOC | 0x2)
+
+typedef struct vnd_ioc_link {
+	char		vil_name[VND_NAMELEN];
+	uint32_t	vil_errno;
+} vnd_ioc_link_t;
+
+/*
+ * Unlink the opened minor instance from the /devices name space. A zone may use
+ * this to unlink an extent entry in /dev; however, they will not be able to
+ * link it in again.
+ */
+#define	VND_IOC_UNLINK		(VND_IOC | 0x3)
+typedef struct vnd_ioc_unlink {
+	uint32_t viu_errno;
+} vnd_ioc_unlink_t;
+
+/*
+ * Controls to get and set the current buffer recieve buffer size.
+ */
+typedef struct vnd_ioc_buf {
+	uint64_t	vib_size;
+	uint32_t	vib_filler;
+	uint32_t	vib_errno;
+} vnd_ioc_buf_t;
+
+#define	VND_IOC_GETRXBUF	(VND_IOC | 0x04)
+#define	VND_IOC_SETRXBUF	(VND_IOC | 0x05)
+#define	VND_IOC_GETMAXBUF	(VND_IOC | 0x06)
+#define	VND_IOC_GETTXBUF	(VND_IOC | 0x07)
+#define	VND_IOC_SETTXBUF	(VND_IOC | 0x08)
+#define	VND_IOC_GETMINTU	(VND_IOC | 0x09)
+#define	VND_IOC_GETMAXTU	(VND_IOC | 0x0a)
+
+/*
+ * Information and listing ioctls
+ *
+ * This gets information about all of the active vnd instances. vl_actents is
+ * always updated to the number around and vl_nents is the number of
+ * vnd_ioc_info_t elements are allocated in vl_ents.
+ */
+typedef struct vnd_ioc_info {
+	uint32_t vii_version;
+	zoneid_t vii_zone;
+	char vii_name[VND_NAMELEN];
+	char vii_datalink[VND_NAMELEN];
+} vnd_ioc_info_t;
+
+typedef struct vnd_ioc_list {
+	uint_t vl_nents;
+	uint_t vl_actents;
+	vnd_ioc_info_t *vl_ents;
+} vnd_ioc_list_t;
+
+#ifdef _KERNEL
+
+typedef struct vnd_ioc_list32 {
+	uint_t vl_nents;
+	uint_t vl_actents;
+	caddr32_t vl_ents;
+} vnd_ioc_list32_t;
+
+#endif	/* _KERNEL */
+
+#define	VND_IOC_LIST		(VND_IOC | 0x20)
+
+/*
+ * Framed I/O ioctls
+ *
+ * Users should use the standard frameio_t as opposed to a vnd specific type.
+ * This is a consolidation private ioctl pending futher stability in the form of
+ * specific system work.
+ */
+#define	VND_IOC_FRAMEIO_READ	(VND_IOC | 0x30)
+#define	VND_IOC_FRAMEIO_WRITE	(VND_IOC | 0x31)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_VND_H */
diff --git a/usr/src/uts/common/sys/vnd_errno.h b/usr/src/uts/common/sys/vnd_errno.h
new file mode 100644
index 0000000000..89e5fc2543
--- /dev/null
+++ b/usr/src/uts/common/sys/vnd_errno.h
@@ -0,0 +1,72 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+ */
+
+#ifndef _SYS_VND_ERRNO_H
+#define	_SYS_VND_ERRNO_H
+
+/*
+ * This header contains all of the available vnd errors.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum vnd_errno {
+	VND_E_SUCCESS = 0,		/* no error */
+	VND_E_NOMEM,			/* no memory */
+	VND_E_NODATALINK,		/* no such datalink */
+	VND_E_NOTETHER,			/* not DL_ETHER */
+	VND_E_DLPIINVAL,		/* Unknown DLPI failures */
+	VND_E_ATTACHFAIL,		/* DL_ATTACH_REQ failed */
+	VND_E_BINDFAIL,			/* DL_BIND_REQ failed */
+	VND_E_PROMISCFAIL,		/* DL_PROMISCON_REQ failed */
+	VND_E_DIRECTFAIL,		/* DLD_CAPAB_DIRECT enable failed */
+	VND_E_CAPACKINVAL,		/* bad dl_capability_ack_t */
+	VND_E_SUBCAPINVAL,		/* bad dl_capability_sub_t */
+	VND_E_DLDBADVERS,		/* bad dld version */
+	VND_E_KSTATCREATE,		/* failed to create kstats */
+	VND_E_NODEV,			/* no such vnd link */
+	VND_E_NONETSTACK,		/* netstack doesn't exist */
+	VND_E_ASSOCIATED,		/* device already associated */
+	VND_E_ATTACHED,			/* device already attached */
+	VND_E_LINKED,			/* device already linked */
+	VND_E_BADNAME,			/* invalid name */
+	VND_E_PERM,			/* can't touch this */
+	VND_E_NOZONE,			/* no such zone */
+	VND_E_STRINIT,		/* failed to initialize vnd stream module */
+	VND_E_NOTATTACHED,		/* device not attached */
+	VND_E_NOTLINKED,		/* device not linked */
+	VND_E_LINKEXISTS,	/* another device has the same link name */
+	VND_E_MINORNODE,		/* failed to create minor node */
+	VND_E_BUFTOOBIG,		/* requested buffer size is too large */
+	VND_E_BUFTOOSMALL,		/* requested buffer size is too small */
+	VND_E_DLEXCL,			/* unable to get dlpi excl access */
+	VND_E_DIRECTNOTSUP,
+			/* DLD direct capability not suported over data link */
+	VND_E_BADPROPSIZE,		/* invalid property size */
+	VND_E_BADPROP,			/* invalid property */
+	VND_E_PROPRDONLY,		/* property is read only */
+	VND_E_SYS,			/* unexpected system error */
+	VND_E_CAPABPASS,
+			/* capabilities invalid, pass-through module detected */
+	VND_E_UNKNOWN			/* unknown error */
+} vnd_errno_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_VND_ERRNO_H */
diff --git a/usr/src/uts/common/sys/vnic_impl.h b/usr/src/uts/common/sys/vnic_impl.h
index 7e50091347..1a91158da6 100644
--- a/usr/src/uts/common/sys/vnic_impl.h
+++ b/usr/src/uts/common/sys/vnic_impl.h
@@ -21,7 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2014 Joyent, Inc.  All rights reserved.
+ * Copyright 2015 Joyent, Inc.
  */
 
 #ifndef	_SYS_VNIC_IMPL_H
@@ -65,6 +65,7 @@ typedef struct vnic_s {
 
 	uint32_t		vn_hcksum_txflags;
 	uint32_t		vn_mtu;
+	link_state_t		vn_ls;
 } vnic_t;
 
 #define	vn_mch	vn_mc_handles[0]
diff --git a/usr/src/uts/common/sys/vnode.h b/usr/src/uts/common/sys/vnode.h
index 51b4f7af18..b527558895 100644
--- a/usr/src/uts/common/sys/vnode.h
+++ b/usr/src/uts/common/sys/vnode.h
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2017, Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
  * Copyright 2017 RackTop Systems.
  */
@@ -805,12 +805,14 @@ typedef enum vnevent	{
 	VE_RMDIR	= 4,	/* Remove of directory vnode's name */
 	VE_CREATE	= 5,	/* Create with vnode's name which exists */
 	VE_LINK		= 6, 	/* Link with vnode's name as source */
-	VE_RENAME_DEST_DIR	= 7, 	/* Rename with vnode as target dir */
+	VE_RENAME_DEST_DIR = 7,	/* Rename with vnode as target dir */
 	VE_MOUNTEDOVER	= 8, 	/* File or Filesystem got mounted over vnode */
 	VE_TRUNCATE = 9,	/* Truncate */
 	VE_PRE_RENAME_SRC = 10,	/* Pre-rename, with vnode as source */
 	VE_PRE_RENAME_DEST = 11, /* Pre-rename, with vnode as target/dest. */
-	VE_PRE_RENAME_DEST_DIR = 12 /* Pre-rename with vnode as target dir */
+	VE_PRE_RENAME_DEST_DIR = 12, /* Pre-rename with vnode as target dir */
+	VE_RENAME_SRC_DIR = 13,	/* Rename with vnode as source dir */
+	VE_RESIZE	= 14	/* Resize/truncate to non-zero offset */
 } vnevent_t;
 
 /*
@@ -1370,7 +1372,8 @@ void	vnevent_remove(vnode_t *, vnode_t *, char *, caller_context_t *);
 void	vnevent_rmdir(vnode_t *, vnode_t *, char *, caller_context_t *);
 void	vnevent_create(vnode_t *, caller_context_t *);
 void	vnevent_link(vnode_t *, caller_context_t *);
-void	vnevent_rename_dest_dir(vnode_t *, caller_context_t *ct);
+void	vnevent_rename_dest_dir(vnode_t *, vnode_t *, char *,
+    caller_context_t *ct);
 void	vnevent_mountedover(vnode_t *, caller_context_t *);
 void	vnevent_truncate(vnode_t *, caller_context_t *);
 int	vnevent_support(vnode_t *, caller_context_t *);
@@ -1380,6 +1383,7 @@ void	vnevent_pre_rename_dest(vnode_t *, vnode_t *, char *,
 	    caller_context_t *);
 void	vnevent_pre_rename_dest_dir(vnode_t *, vnode_t *, char *,
 	    caller_context_t *);
+void	vnevent_resize(vnode_t *, caller_context_t *);
 
 /* Vnode specific data */
 void vsd_create(uint_t *, void (*)(void *));
@@ -1482,6 +1486,7 @@ extern struct vnode kvps[];
 typedef enum {
 	KV_KVP,		/* vnode for all segkmem pages */
 	KV_ZVP,		/* vnode for all ZFS pages */
+	KV_VVP,		/* vnode for all VMM pages */
 #if defined(__sparc)
 	KV_MPVP,	/* vnode for all page_t meta-pages */
 	KV_PROMVP,	/* vnode for all PROM pages */
diff --git a/usr/src/uts/common/sys/vxlan.h b/usr/src/uts/common/sys/vxlan.h
new file mode 100644
index 0000000000..d87786b507
--- /dev/null
+++ b/usr/src/uts/common/sys/vxlan.h
@@ -0,0 +1,47 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_VXLAN_H
+#define	_SYS_VXLAN_H
+
+/*
+ * Common VXLAN information
+ */
+
+#include <sys/inttypes.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Sizes in bytes */
+#define	VXLAN_HDR_LEN	8
+#define	VXLAN_ID_LEN	3
+
+#define	VXLAN_F_VDI	0x08000000
+#define	VXLAN_ID_SHIFT	8
+
+#pragma pack(1)
+typedef struct vxlan_hdr {
+	uint32_t vxlan_flags;
+	uint32_t vxlan_id;
+} vxlan_hdr_t;
+#pragma pack()
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_VXLAN_H */
diff --git a/usr/src/uts/common/sys/zfd.h b/usr/src/uts/common/sys/zfd.h
new file mode 100644
index 0000000000..e08d75ecba
--- /dev/null
+++ b/usr/src/uts/common/sys/zfd.h
@@ -0,0 +1,78 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+/*
+ * Copyright 2015 Joyent, Inc.
+ */
+
+#ifndef _SYS_ZFD_H
+#define	_SYS_ZFD_H
+
+#include <sys/types.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Minor node name of the global zone side (often called the "master" side)
+ * of the zfd dev.
+ */
+#define	ZFD_MASTER_NAME	"master"
+
+/*
+ * Minor node name of the non-global zone side (often called the "slave"
+ * side) of the zfd dev.
+ */
+#define	ZFD_SLAVE_NAME	"slave"
+
+#define	ZFD_NAME_LEN	16
+
+/*
+ * ZFD_IOC forms the base for all zfd ioctls.
+ */
+#define	ZFD_IOC		(('Z' << 24) | ('f' << 16) | ('d' << 8))
+
+/*
+ * This ioctl tells the slave side it should push the TTY stream modules
+ * so that the fd looks like a tty.
+ */
+#define	ZFD_MAKETTY		(ZFD_IOC | 0)
+
+/*
+ * This ioctl puts a hangup into the stream so that the slave side sees EOF.
+ */
+#define	ZFD_EOF			(ZFD_IOC | 1)
+
+/*
+ * This ioctl succeeds if the slave side is open.
+ */
+#define	ZFD_HAS_SLAVE		(ZFD_IOC | 2)
+
+/*
+ * This ioctl links two streams into a multiplexer configuration for in-zone
+ * logging.
+ */
+#define	ZFD_MUX			(ZFD_IOC | 3)
+
+/*
+ * This ioctl controls the flow control setting for the log multiplexer stream
+ * (1 = true, 0 = false). The default is false which implies teeing into the
+ * log stream is "best-effort" but data will be discarded if the stream
+ * becomes full. If set and the log stream begins to fill up, the primary
+ * stream will stop flowing.
+ */
+#define	ZFD_MUX_FLOWCON		(ZFD_IOC | 4)
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_ZFD_H */
diff --git a/usr/src/uts/common/sys/zone.h b/usr/src/uts/common/sys/zone.h
index 27f52c57e2..e871689f5f 100644
--- a/usr/src/uts/common/sys/zone.h
+++ b/usr/src/uts/common/sys/zone.h
@@ -20,9 +20,9 @@
  */
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2015 Joyent, Inc. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
  * Copyright 2014 Igor Kozhukhov <ikozhukhov@gmail.com>.
+ * Copyright 2018, Joyent, Inc.
  */
 
 #ifndef _SYS_ZONE_H
@@ -51,15 +51,27 @@ extern "C" {
  * NOTE
  *
  * The contents of this file are private to the implementation of
- * Solaris and are subject to change at any time without notice.
+ * illumos and are subject to change at any time without notice.
  * Applications and drivers using these interfaces may fail to
  * run on future releases.
  */
 
 /* Available both in kernel and for user space */
 
-/* zone id restrictions and special ids */
-#define	MAX_ZONEID	9999
+/*
+ * zone id restrictions and special ids.
+ * See 'maxzones' for run-time zone limit.
+ *
+ * The current 8k value for MAX_ZONES was originally derived from the virtual
+ * interface limit in IP when "shared-stack" was the only supported networking
+ * for zones. The virtual interface limit is the number of addresses allowed
+ * on an interface (see MAX_ADDRS_PER_IF). Even with exclusive stacks, an 8k
+ * zone limit is still a reasonable choice at this time, given other limits
+ * within the kernel. Since we only support 8192 zones (which includes GZ),
+ * there is no point in allowing MAX_ZONEID > 8k.
+ */
+#define	MAX_ZONES	8192
+#define	MAX_ZONEID	(MAX_ZONES - 1)
 #define	MIN_USERZONEID	1	/* lowest user-creatable zone ID */
 #define	MIN_ZONEID	0	/* minimum zone ID on system */
 #define	GLOBAL_ZONEID	0
@@ -98,14 +110,18 @@ extern "C" {
 #define	ZONE_ATTR_INITNAME	9
 #define	ZONE_ATTR_BOOTARGS	10
 #define	ZONE_ATTR_BRAND		11
-#define	ZONE_ATTR_PHYS_MCAP	12
-#define	ZONE_ATTR_SCHED_CLASS	13
-#define	ZONE_ATTR_FLAGS		14
-#define	ZONE_ATTR_HOSTID	15
-#define	ZONE_ATTR_FS_ALLOWED	16
-#define	ZONE_ATTR_NETWORK	17
-#define	ZONE_ATTR_INITNORESTART	20
+#define	ZONE_ATTR_SCHED_CLASS	12
+#define	ZONE_ATTR_FLAGS		13
+#define	ZONE_ATTR_HOSTID	14
+#define	ZONE_ATTR_FS_ALLOWED	15
+#define	ZONE_ATTR_NETWORK	16
+#define	ZONE_ATTR_DID		17
+#define	ZONE_ATTR_INITNORESTART	18
+#define	ZONE_ATTR_APP_SVC_CT	19
+#define	ZONE_ATTR_SCHED_FIXEDHI	20
 #define	ZONE_ATTR_SECFLAGS	21
+#define	ZONE_ATTR_INITRESTART0	22
+#define	ZONE_ATTR_INITREBOOT	23
 
 /* Start of the brand-specific attribute namespace */
 #define	ZONE_ATTR_BRAND_ATTRS	32768
@@ -186,6 +202,7 @@ typedef struct {
 	uint32_t doi;			/* DOI for label */
 	caddr32_t label;		/* label associated with zone */
 	int flags;
+	zoneid_t zoneid;		/* requested zoneid */
 } zone_def32;
 #endif
 typedef struct {
@@ -202,6 +219,7 @@ typedef struct {
 	uint32_t doi;			/* DOI for label */
 	const bslabel_t *label;		/* label associated with zone */
 	int flags;
+	zoneid_t zoneid;		/* requested zoneid */
 } zone_def;
 
 /* extended error information */
@@ -246,9 +264,12 @@ typedef enum zone_cmd {
 typedef struct zone_cmd_arg {
 	uint64_t	uniqid;		/* unique "generation number" */
 	zone_cmd_t	cmd;		/* requested action */
-	uint32_t	_pad;		/* need consistent 32/64 bit alignmt */
+	int		status;		/* init status on shutdown */
+	uint32_t	debug;		/* enable brand hook debug */
 	char locale[MAXPATHLEN];	/* locale in which to render messages */
 	char bootbuf[BOOTARGS_MAX];	/* arguments passed to zone_boot() */
+	/* Needed for 32/64 zoneadm -> zoneadmd door arg size check. */
+	int		pad;
 } zone_cmd_arg_t;
 
 /*
@@ -374,7 +395,7 @@ typedef struct zone_dataset {
 } zone_dataset_t;
 
 /*
- * structure for zone kstats
+ * structure for rctl zone kstats
  */
 typedef struct zone_kstat {
 	kstat_named_t zk_zonename;
@@ -385,12 +406,57 @@ typedef struct zone_kstat {
 struct cpucap;
 
 typedef struct {
+	hrtime_t	cycle_start;
+	uint_t		cycle_cnt;
+	hrtime_t	zone_avg_cnt;
+} sys_zio_cntr_t;
+
+typedef struct {
+	kstat_named_t	zv_zonename;
+	kstat_named_t	zv_nread;
+	kstat_named_t	zv_reads;
+	kstat_named_t	zv_rtime;
+	kstat_named_t	zv_rlentime;
+	kstat_named_t	zv_rcnt;
+	kstat_named_t	zv_nwritten;
+	kstat_named_t	zv_writes;
+	kstat_named_t	zv_wtime;
+	kstat_named_t	zv_wlentime;
+	kstat_named_t	zv_wcnt;
+	kstat_named_t	zv_10ms_ops;
+	kstat_named_t	zv_100ms_ops;
+	kstat_named_t	zv_1s_ops;
+	kstat_named_t	zv_10s_ops;
+	kstat_named_t 	zv_delay_cnt;
+	kstat_named_t	zv_delay_time;
+} zone_vfs_kstat_t;
+
+typedef struct {
+	kstat_named_t	zz_zonename;
+	kstat_named_t	zz_nread;
+	kstat_named_t	zz_reads;
+	kstat_named_t	zz_rtime;
+	kstat_named_t	zz_rlentime;
+	kstat_named_t	zz_nwritten;
+	kstat_named_t	zz_writes;
+	kstat_named_t	zz_waittime;
+} zone_zfs_kstat_t;
+
+typedef struct {
 	kstat_named_t	zm_zonename;
+	kstat_named_t	zm_rss;
+	kstat_named_t	zm_phys_cap;
+	kstat_named_t	zm_swap;
+	kstat_named_t	zm_swap_cap;
+	kstat_named_t	zm_nover;
+	kstat_named_t	zm_pagedout;
 	kstat_named_t	zm_pgpgin;
 	kstat_named_t	zm_anonpgin;
 	kstat_named_t	zm_execpgin;
 	kstat_named_t	zm_fspgin;
 	kstat_named_t	zm_anon_alloc_fail;
+	kstat_named_t	zm_pf_throttle;
+	kstat_named_t	zm_pf_throttle_usec;
 } zone_mcap_kstat_t;
 
 typedef struct {
@@ -405,6 +471,7 @@ typedef struct {
 	kstat_named_t	zm_ffnoproc;
 	kstat_named_t	zm_ffnomem;
 	kstat_named_t	zm_ffmisc;
+	kstat_named_t	zm_mfseglim;
 	kstat_named_t	zm_nested_intp;
 	kstat_named_t	zm_init_pid;
 	kstat_named_t	zm_boot_time;
@@ -449,6 +516,7 @@ typedef struct zone {
 	 */
 	list_node_t	zone_linkage;
 	zoneid_t	zone_id;	/* ID of zone */
+	zoneid_t	zone_did;	/* persistent debug ID of zone */
 	uint_t		zone_ref;	/* count of zone_hold()s on zone */
 	uint_t		zone_cred_ref;	/* count of zone_hold_cred()s on zone */
 	/*
@@ -501,10 +569,10 @@ typedef struct zone {
 	kcondvar_t	zone_cv;	/* used to signal state changes */
 	struct proc	*zone_zsched;	/* Dummy kernel "zsched" process */
 	pid_t		zone_proc_initpid; /* pid of "init" for this zone */
-	char		*zone_initname;	/* fs path to 'init' */
+	char		*zone_initname;		/* fs path to 'init' */
+	int		zone_init_status;	/* init's exit status */
 	int		zone_boot_err;  /* for zone_boot() if boot fails */
 	char		*zone_bootargs;	/* arguments passed via zone_boot() */
-	uint64_t	zone_phys_mcap;	/* physical memory cap */
 	/*
 	 * zone_kthreads is protected by zone_status_lock.
 	 */
@@ -542,9 +610,13 @@ typedef struct zone {
 	tsol_mlp_list_t zone_mlps;	/* MLPs on zone-private addresses */
 
 	boolean_t	zone_restart_init;	/* Restart init if it dies? */
+	boolean_t	zone_reboot_on_init_exit; /* Reboot if init dies? */
+	boolean_t	zone_restart_init_0;	/* Restart only if it exits 0 */
+	boolean_t	zone_setup_app_contract; /* setup contract? */
 	struct brand	*zone_brand;		/* zone's brand */
 	void 		*zone_brand_data;	/* store brand specific data */
 	id_t		zone_defaultcid;	/* dflt scheduling class id */
+	boolean_t	zone_fixed_hipri;	/* fixed sched. hi prio */
 	kstat_t		*zone_swapresv_kstat;
 	kstat_t		*zone_lockedmem_kstat;
 	/*
@@ -553,8 +625,24 @@ typedef struct zone {
 	list_t		zone_dl_list;
 	netstack_t	*zone_netstack;
 	struct cpucap	*zone_cpucap;	/* CPU caps data */
+
 	/*
-	 * Solaris Auditing per-zone audit context
+	 * kstats and counters for VFS ops and bytes.
+	 */
+	kmutex_t	zone_vfs_lock;		/* protects VFS statistics */
+	kstat_t		*zone_vfs_ksp;
+	kstat_io_t	zone_vfs_rwstats;
+	zone_vfs_kstat_t *zone_vfs_stats;
+
+	/*
+	 * kstats for ZFS I/O ops and bytes.
+	 */
+	kmutex_t	zone_zfs_lock;		/* protects ZFS statistics */
+	kstat_t		*zone_zfs_ksp;
+	zone_zfs_kstat_t *zone_zfs_stats;
+
+	/*
+	 * illumos Auditing per-zone audit context
 	 */
 	struct au_kcontext	*zone_audit_kctxt;
 	/*
@@ -571,7 +659,11 @@ typedef struct zone {
 						/* zone_rctls->rcs_lock */
 	kstat_t		*zone_nprocs_kstat;
 
-	kmutex_t	zone_mcap_lock;	/* protects mcap statistics */
+	/*
+	 * kstats and counters for physical memory capping.
+	 */
+	kstat_t		*zone_physmem_kstat;
+	kmutex_t	zone_mcap_lock;		/* protects mcap statistics */
 	kstat_t		*zone_mcap_ksp;
 	zone_mcap_kstat_t *zone_mcap_stats;
 	uint64_t	zone_pgpgin;		/* pages paged in */
@@ -606,6 +698,8 @@ typedef struct zone {
 	uint32_t	zone_ffnomem;		/* as_dup/memory error */
 	uint32_t	zone_ffmisc;		/* misc. other error */
 
+	uint32_t	zone_mfseglim;		/* map failure (# segs limit) */
+
 	uint32_t	zone_nested_intp;	/* nested interp. kstat */
 
 	struct loadavg_s zone_loadavg;		/* loadavg for this zone */
@@ -633,6 +727,53 @@ typedef struct zone {
 } zone_t;
 
 /*
+ * Data and counters used for ZFS fair-share disk IO.
+ */
+typedef struct zone_zfs_io {
+	uint16_t	zpers_zfs_io_pri;	/* ZFS IO priority - 16k max */
+	uint_t		zpers_zfs_queued[2];	/* sync I/O enqueued count */
+	sys_zio_cntr_t	zpers_rd_ops;		/* Counters for ZFS reads, */
+	sys_zio_cntr_t	zpers_wr_ops;		/* writes, and */
+	sys_zio_cntr_t	zpers_lwr_ops;		/* logical writes. */
+	kstat_io_t	zpers_zfs_rwstats;
+	uint64_t	zpers_io_util;		/* IO utilization metric */
+	uint64_t	zpers_zfs_rd_waittime;
+	uint8_t		zpers_io_delay;		/* IO delay on logical r/w */
+	uint8_t		zpers_zfs_weight;	/* used to prevent starvation */
+	uint8_t		zpers_io_util_above_avg; /* IO util percent > avg. */
+} zone_zfs_io_t;
+
+/*
+ * "Persistent" zone data which can be accessed idependently of the zone_t.
+ */
+typedef struct zone_persist {
+	kmutex_t	zpers_zfs_lock;	/* Protects zpers_zfsp references */
+	zone_zfs_io_t	*zpers_zfsp;	/* ZFS fair-share IO data */
+	uint8_t		zpers_over;	/* currently over cap */
+	uint32_t	zpers_pg_cnt;	/* current RSS in pages */
+	uint32_t	zpers_pg_limit;	/* current RRS limit in pages */
+	uint32_t	zpers_nover;	/* # of times over phys. cap */
+#ifndef DEBUG
+	uint64_t	zpers_pg_out;	/* # pages flushed */
+#else
+	/*
+	 * To conserve memory, some detailed kstats are only kept for DEBUG
+	 * builds.
+	 */
+	uint64_t	zpers_zfs_rd_waittime;
+
+	uint64_t	zpers_pg_anon;		/* # clean anon pages flushed */
+	uint64_t	zpers_pg_anondirty;	/* # dirty anon pages flushed */
+	uint64_t	zpers_pg_fs;		/* # clean fs pages flushed */
+	uint64_t	zpers_pg_fsdirty;	/* # dirty fs pages flushed */
+#endif
+} zone_persist_t;
+
+typedef enum zone_pageout_op {
+	ZPO_DIRTY, ZPO_FS, ZPO_ANON, ZPO_ANONDIRTY
+} zone_pageout_op_t;
+
+/*
  * Special value of zone_psetid to indicate that pools are disabled.
  */
 #define	ZONE_PS_INVAL	PS_MYID
@@ -662,6 +803,7 @@ extern zone_t *zone_find_by_name(char *);
 extern zone_t *zone_find_by_any_path(const char *, boolean_t);
 extern zone_t *zone_find_by_path(const char *);
 extern zoneid_t getzoneid(void);
+extern zoneid_t getzonedid(void);
 extern zone_t *zone_find_by_id_nolock(zoneid_t);
 extern int zone_datalink_walk(zoneid_t, int (*)(datalink_id_t, void *), void *);
 extern int zone_check_datalink(zoneid_t *, datalink_id_t);
@@ -842,6 +984,7 @@ extern int zone_ncpus_online_get(zone_t *);
  * Returns true if the named pool/dataset is visible in the current zone.
  */
 extern int zone_dataset_visible(const char *, int *);
+extern int zone_dataset_visible_inzone(zone_t *, const char *, int *);
 
 /*
  * zone version of kadmin()
@@ -854,8 +997,19 @@ extern void mount_completed(zone_t *);
 
 extern int zone_walk(int (*)(zone_t *, void *), void *);
 
+struct page;
+extern void zone_add_page(struct page *);
+extern void zone_rm_page(struct page *);
+extern void zone_pageout_stat(int, zone_pageout_op_t);
+extern void zone_get_physmem_data(int, pgcnt_t *, pgcnt_t *);
+
+/* Interfaces for page scanning */
+extern uint_t zone_num_over_cap;
+extern zone_persist_t zone_pdata[MAX_ZONES];
+
 extern rctl_hndl_t rc_zone_locked_mem;
 extern rctl_hndl_t rc_zone_max_swap;
+extern rctl_hndl_t rc_zone_phys_mem;
 extern rctl_hndl_t rc_zone_max_lofi;
 
 #endif	/* _KERNEL */
diff --git a/usr/src/uts/common/syscall/brandsys.c b/usr/src/uts/common/syscall/brandsys.c
index 9b4bd38baa..245ef9f14f 100644
--- a/usr/src/uts/common/syscall/brandsys.c
+++ b/usr/src/uts/common/syscall/brandsys.c
@@ -23,7 +23,9 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
 
 #include <sys/brand.h>
 #include <sys/systm.h>
@@ -35,7 +37,7 @@
  */
 int64_t
 brandsys(int cmd, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3,
-    uintptr_t arg4, uintptr_t arg5, uintptr_t arg6)
+    uintptr_t arg4)
 {
 	struct proc *p = curthread->t_procp;
 	int64_t rval = 0;
@@ -49,7 +51,7 @@ brandsys(int cmd, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3,
 		return (set_errno(ENOSYS));
 
 	if ((err = ZBROP(p->p_zone)->b_brandsys(cmd, &rval, arg1, arg2, arg3,
-	    arg4, arg5, arg6)) != 0)
+	    arg4)) != 0)
 		return (set_errno(err));
 
 	return (rval);
diff --git a/usr/src/uts/common/syscall/chdir.c b/usr/src/uts/common/syscall/chdir.c
index 84c924f570..deb5532b50 100644
--- a/usr/src/uts/common/syscall/chdir.c
+++ b/usr/src/uts/common/syscall/chdir.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -62,7 +63,7 @@
 /*
  * Change current working directory (".").
  */
-static int	chdirec(vnode_t *, int ischroot, int do_traverse);
+static int	chdirec(vnode_t *, boolean_t ischroot, boolean_t do_traverse);
 
 int
 chdir(char *fname)
@@ -78,7 +79,7 @@ lookup:
 		return (set_errno(error));
 	}
 
-	error = chdirec(vp, 0, 1);
+	error = chdirec(vp, B_FALSE, B_TRUE);
 	if (error) {
 		if ((error == ESTALE) && fs_need_estale_retry(estale_retry++))
 			goto lookup;
@@ -102,7 +103,7 @@ fchdir(int fd)
 	vp = fp->f_vnode;
 	VN_HOLD(vp);
 	releasef(fd);
-	error = chdirec(vp, 0, 0);
+	error = chdirec(vp, B_FALSE, B_FALSE);
 	if (error)
 		return (set_errno(error));
 	return (0);
@@ -125,7 +126,7 @@ lookup:
 		return (set_errno(error));
 	}
 
-	error = chdirec(vp, 1, 1);
+	error = chdirec(vp, B_TRUE, B_TRUE);
 	if (error) {
 		if ((error == ESTALE) && fs_need_estale_retry(estale_retry++))
 			goto lookup;
@@ -152,18 +153,18 @@ fchroot(int fd)
 	vp = fp->f_vnode;
 	VN_HOLD(vp);
 	releasef(fd);
-	error = chdirec(vp, 1, 0);
+	error = chdirec(vp, B_TRUE, B_FALSE);
 	if (error)
 		return (set_errno(error));
 	return (0);
 }
 
 static int
-chdirec(vnode_t *vp, int ischroot, int do_traverse)
+chdirec_common(proc_t *pp, vnode_t *vp, boolean_t ischroot,
+    boolean_t do_traverse)
 {
 	int error;
 	vnode_t *oldvp;
-	proc_t *pp = curproc;
 	vnode_t **vpp;
 	refstr_t *cwd;
 	int newcwd = 1;
@@ -194,7 +195,7 @@ chdirec(vnode_t *vp, int ischroot, int do_traverse)
 	if (ischroot) {
 		struct vattr tattr;
 		struct vattr rattr;
-		vnode_t *zonevp = curproc->p_zone->zone_rootvp;
+		vnode_t *zonevp = pp->p_zone->zone_rootvp;
 
 		tattr.va_mask = AT_FSID|AT_NODEID;
 		if (error = VOP_GETATTR(vp, &tattr, 0, CRED(), NULL))
@@ -243,3 +244,15 @@ bad:
 	VN_RELE(vp);
 	return (error);
 }
+
+int
+chdir_proc(proc_t *pp, vnode_t *vp, boolean_t ischroot, boolean_t do_traverse)
+{
+	return (chdirec_common(pp, vp, ischroot, do_traverse));
+}
+
+static int
+chdirec(vnode_t *vp, boolean_t ischroot, boolean_t do_traverse)
+{
+	return (chdirec_common(curproc, vp, ischroot, do_traverse));
+}
diff --git a/usr/src/uts/common/syscall/fcntl.c b/usr/src/uts/common/syscall/fcntl.c
index 7b787a4acb..b029d92f1b 100644
--- a/usr/src/uts/common/syscall/fcntl.c
+++ b/usr/src/uts/common/syscall/fcntl.c
@@ -54,7 +54,8 @@
 
 #include <sys/cmn_err.h>
 
-static int flock_check(vnode_t *, flock64_t *, offset_t, offset_t);
+/* This is global so that it can be used by brand emulation. */
+int flock_check(vnode_t *, flock64_t *, offset_t, offset_t);
 static int flock_get_start(vnode_t *, flock64_t *, offset_t, u_offset_t *);
 static void fd_too_big(proc_t *);
 
diff --git a/usr/src/uts/common/syscall/memcntl.c b/usr/src/uts/common/syscall/memcntl.c
index 1ee4b6a395..721f884a7e 100644
--- a/usr/src/uts/common/syscall/memcntl.c
+++ b/usr/src/uts/common/syscall/memcntl.c
@@ -115,13 +115,17 @@ memcntl(caddr_t addr, size_t len, int cmd, caddr_t arg, int attr, int mask)
 		 * MS_SYNC used to be defined to be zero but is now non-zero.
 		 * For binary compatibility we still accept zero
 		 * (the absence of MS_ASYNC) to mean the same thing.
+		 * Binary compatibility is not an issue for MS_INVALCURPROC.
 		 */
 		iarg = (uintptr_t)arg;
 		if ((iarg & ~MS_INVALIDATE) == 0)
 			iarg |= MS_SYNC;
 
-		if (((iarg & ~(MS_SYNC|MS_ASYNC|MS_INVALIDATE)) != 0) ||
-		    ((iarg & (MS_SYNC|MS_ASYNC)) == (MS_SYNC|MS_ASYNC))) {
+		if (((iarg &
+		    ~(MS_SYNC|MS_ASYNC|MS_INVALIDATE|MS_INVALCURPROC)) != 0) ||
+		    ((iarg & (MS_SYNC|MS_ASYNC)) == (MS_SYNC|MS_ASYNC)) ||
+		    ((iarg & (MS_INVALIDATE|MS_INVALCURPROC)) ==
+		    (MS_INVALIDATE|MS_INVALCURPROC))) {
 			error = set_errno(EINVAL);
 		} else {
 			error = as_ctl(as, addr, len, cmd, attr, iarg, NULL, 0);
diff --git a/usr/src/uts/common/syscall/open.c b/usr/src/uts/common/syscall/open.c
index edb04c824b..874e31869c 100644
--- a/usr/src/uts/common/syscall/open.c
+++ b/usr/src/uts/common/syscall/open.c
@@ -74,12 +74,12 @@ copen(int startfd, char *fname, int filemode, int createmode)
 
 	if (filemode & (FSEARCH|FEXEC)) {
 		/*
-		 * Must be one or the other and neither FREAD nor FWRITE
+		 * Must be one or the other.
 		 * Must not be any of FAPPEND FCREAT FTRUNC FXATTR FXATTRDIROPEN
-		 * XXX: Should these just be silently ignored?
+		 * XXX: Should these just be silently ignored like we
+		 * silently ignore FREAD|FWRITE?
 		 */
-		if ((filemode & (FREAD|FWRITE)) ||
-		    (filemode & (FSEARCH|FEXEC)) == (FSEARCH|FEXEC) ||
+		if ((filemode & (FSEARCH|FEXEC)) == (FSEARCH|FEXEC) ||
 		    (filemode & (FAPPEND|FCREAT|FTRUNC|FXATTR|FXATTRDIROPEN)))
 			return (set_errno(EINVAL));
 	}
diff --git a/usr/src/uts/common/syscall/poll.c b/usr/src/uts/common/syscall/poll.c
index 6ffef9e3ec..2eb50323a0 100644
--- a/usr/src/uts/common/syscall/poll.c
+++ b/usr/src/uts/common/syscall/poll.c
@@ -29,7 +29,7 @@
 
 /*
  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
- * Copyright 2015, Joyent, Inc.
+ * Copyright (c) 2017, Joyent, Inc.
  */
 
 /*
@@ -317,20 +317,57 @@ polllock(pollhead_t *php, kmutex_t *lp)
 	return (0);
 }
 
-static int
-poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
+int
+poll_copyin(pollstate_t *ps, pollfd_t *fds, nfds_t nfds)
+{
+	pollfd_t *pollfdp;
+	nfds_t old_nfds;
+
+	/*
+	 * NOTE: for performance, buffers are saved across poll() calls.
+	 * The theory is that if a process polls heavily, it tends to poll
+	 * on the same set of descriptors.  Therefore, we only reallocate
+	 * buffers when nfds changes.  There is no hysteresis control,
+	 * because there is no data to suggest that this is necessary;
+	 * the penalty of reallocating is not *that* great in any event.
+	 */
+	old_nfds = ps->ps_nfds;
+	if (nfds != old_nfds) {
+		kmem_free(ps->ps_pollfd, old_nfds * sizeof (pollfd_t));
+		pollfdp = kmem_alloc(nfds * sizeof (pollfd_t), KM_SLEEP);
+		ps->ps_pollfd = pollfdp;
+		ps->ps_nfds = nfds;
+	}
+
+	pollfdp = ps->ps_pollfd;
+	if (copyin(fds, pollfdp, nfds * sizeof (pollfd_t))) {
+		return (EFAULT);
+	}
+
+	if (fds == NULL) {
+		/*
+		 * If the process has page 0 mapped, then the copyin() above
+		 * will succeed even if fds is NULL.  However, our cached
+		 * poll lists are keyed by the address of the passed-in fds
+		 * structure, and we use the value NULL to indicate an unused
+		 * poll cache list entry.  As such, we elect not to support
+		 * NULL as a valid (user) memory address and fail the poll()
+		 * call.
+		 */
+		return (EFAULT);
+	}
+	return (0);
+}
+
+int
+poll_common(pollstate_t *ps, pollfd_t *fds, nfds_t nfds, timespec_t *tsp,
+    int *fdcnt)
 {
 	kthread_t *t = curthread;
-	klwp_t *lwp = ttolwp(t);
-	proc_t *p = ttoproc(t);
-	int fdcnt = 0;
-	int i;
 	hrtime_t deadline; /* hrtime value when we want to return */
 	pollfd_t *pollfdp;
-	pollstate_t *ps;
 	pollcache_t *pcp;
 	int error = 0;
-	nfds_t old_nfds;
 	int cacheindex = 0;	/* which cache set is used */
 
 	/*
@@ -340,33 +377,34 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 		deadline = -1;
 	} else if (tsp->tv_sec == 0 && tsp->tv_nsec == 0) {
 		deadline = 0;
+	} else if (tsp->tv_sec >= HRTIME_MAX/NANOSEC) {
+		/* Use an indefinite timeout if tv_sec would cause overflow */
+		deadline = -1;
 	} else {
+		/*
+		 * The above check, when combined with the protections offered
+		 * by itimerspecfix (ensuring that neither field is negative
+		 * and that tv_nsec represents less than a whole second), will
+		 * prevent overflow during the conversion from timespec_t to
+		 * uhrtime_t.
+		 */
+		uhrtime_t utime = tsp->tv_sec * NANOSEC;
+		utime += tsp->tv_nsec;
+
 		/* They must wait at least a tick. */
-		deadline = ((hrtime_t)tsp->tv_sec * NANOSEC) + tsp->tv_nsec;
-		deadline = MAX(deadline, nsec_per_tick);
-		deadline += gethrtime();
-	}
+		utime = MAX(utime, nsec_per_tick);
 
-	/*
-	 * Reset our signal mask, if requested.
-	 */
-	if (ksetp != NULL) {
-		mutex_enter(&p->p_lock);
-		schedctl_finish_sigblock(t);
-		lwp->lwp_sigoldmask = t->t_hold;
-		t->t_hold = *ksetp;
-		t->t_flag |= T_TOMASK;
 		/*
-		 * Call cv_reltimedwait_sig() just to check for signals.
-		 * We will return immediately with either 0 or -1.
+		 * Since utime has an upper bound of HRTIME_MAX, adding the
+		 * gethrtime() result cannot incur an overflow as the unsigned
+		 * type has an adequate bound.
 		 */
-		if (!cv_reltimedwait_sig(&t->t_delay_cv, &p->p_lock, 0,
-		    TR_CLOCK_TICK)) {
-			mutex_exit(&p->p_lock);
-			error = EINTR;
-			goto pollout;
+		utime += (uhrtime_t)gethrtime();
+		if (utime > HRTIME_MAX) {
+			deadline = -1;
+		} else {
+			deadline = (hrtime_t)utime;
 		}
-		mutex_exit(&p->p_lock);
 	}
 
 	/*
@@ -374,6 +412,7 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 	 * If yes then bypass all the other stuff and make it sleep.
 	 */
 	if (nfds == 0) {
+		*fdcnt = 0;
 		/*
 		 * Sleep until we have passed the requested future
 		 * time or until interrupted by a signal.
@@ -385,66 +424,14 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 			    &t->t_delay_lock, deadline)) > 0)
 				continue;
 			mutex_exit(&t->t_delay_lock);
-			error = (error == 0) ? EINTR : 0;
+			return ((error == 0) ? EINTR : 0);
 		}
-		goto pollout;
-	}
-
-	if (nfds > p->p_fno_ctl) {
-		mutex_enter(&p->p_lock);
-		(void) rctl_action(rctlproc_legacy[RLIMIT_NOFILE],
-		    p->p_rctls, p, RCA_SAFE);
-		mutex_exit(&p->p_lock);
-		error = EINVAL;
-		goto pollout;
-	}
-
-	/*
-	 * Need to allocate memory for pollstate before anything because
-	 * the mutex and cv are created in this space
-	 */
-	ps = pollstate_create();
-
-	if (ps->ps_pcache == NULL)
-		ps->ps_pcache = pcache_alloc();
-	pcp = ps->ps_pcache;
-
-	/*
-	 * NOTE: for performance, buffers are saved across poll() calls.
-	 * The theory is that if a process polls heavily, it tends to poll
-	 * on the same set of descriptors.  Therefore, we only reallocate
-	 * buffers when nfds changes.  There is no hysteresis control,
-	 * because there is no data to suggest that this is necessary;
-	 * the penalty of reallocating is not *that* great in any event.
-	 */
-	old_nfds = ps->ps_nfds;
-	if (nfds != old_nfds) {
-
-		kmem_free(ps->ps_pollfd, old_nfds * sizeof (pollfd_t));
-		pollfdp = kmem_alloc(nfds * sizeof (pollfd_t), KM_SLEEP);
-		ps->ps_pollfd = pollfdp;
-		ps->ps_nfds = nfds;
+		return (0);
 	}
 
+	VERIFY(ps != NULL);
 	pollfdp = ps->ps_pollfd;
-	if (copyin(fds, pollfdp, nfds * sizeof (pollfd_t))) {
-		error = EFAULT;
-		goto pollout;
-	}
-
-	if (fds == NULL) {
-		/*
-		 * If the process has page 0 mapped, then the copyin() above
-		 * will succeed even if fds is NULL.  However, our cached
-		 * poll lists are keyed by the address of the passed-in fds
-		 * structure, and we use the value NULL to indicate an unused
-		 * poll cache list entry.  As such, we elect not to support
-		 * NULL as a valid (user) memory address and fail the poll()
-		 * call.
-		 */
-		error = EINVAL;
-		goto pollout;
-	}
+	VERIFY(pollfdp != NULL);
 
 	/*
 	 * If this thread polls for the first time, allocate ALL poll
@@ -460,10 +447,10 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 		/*
 		 * poll and cache this poll fd list in ps_pcacheset[0].
 		 */
-		error = pcacheset_cache_list(ps, fds, &fdcnt, cacheindex);
-		if (fdcnt || error) {
+		error = pcacheset_cache_list(ps, fds, fdcnt, cacheindex);
+		if (error || *fdcnt) {
 			mutex_exit(&ps->ps_lock);
-			goto pollout;
+			return (error);
 		}
 	} else {
 		pollcacheset_t	*pcset = ps->ps_pcacheset;
@@ -488,11 +475,11 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 				 * the callee will guarantee the consistency
 				 * of cached poll list and cache content.
 				 */
-				error = pcacheset_resolve(ps, nfds, &fdcnt,
+				error = pcacheset_resolve(ps, nfds, fdcnt,
 				    cacheindex);
 				if (error) {
 					mutex_exit(&ps->ps_lock);
-					goto pollout;
+					return (error);
 				}
 				break;
 			}
@@ -509,11 +496,11 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 				 * found an unused entry. Use it to cache
 				 * this poll list.
 				 */
-				error = pcacheset_cache_list(ps, fds, &fdcnt,
+				error = pcacheset_cache_list(ps, fds, fdcnt,
 				    cacheindex);
-				if (fdcnt || error) {
+				if (error || *fdcnt) {
 					mutex_exit(&ps->ps_lock);
-					goto pollout;
+					return (error);
 				}
 				break;
 			}
@@ -527,10 +514,10 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 			cacheindex = pcacheset_replace(ps);
 			ASSERT(cacheindex < ps->ps_nsets);
 			pcset[cacheindex].pcs_usradr = (uintptr_t)fds;
-			error = pcacheset_resolve(ps, nfds, &fdcnt, cacheindex);
+			error = pcacheset_resolve(ps, nfds, fdcnt, cacheindex);
 			if (error) {
 				mutex_exit(&ps->ps_lock);
-				goto pollout;
+				return (error);
 			}
 		}
 	}
@@ -548,8 +535,8 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 	mutex_enter(&pcp->pc_lock);
 	for (;;) {
 		pcp->pc_flag = 0;
-		error = pcache_poll(pollfdp, ps, nfds, &fdcnt, cacheindex);
-		if (fdcnt || error) {
+		error = pcache_poll(pollfdp, ps, nfds, fdcnt, cacheindex);
+		if (error || *fdcnt) {
 			mutex_exit(&pcp->pc_lock);
 			mutex_exit(&ps->ps_lock);
 			break;
@@ -595,13 +582,116 @@ poll_common(pollfd_t *fds, nfds_t nfds, timespec_t *tsp, k_sigset_t *ksetp)
 		mutex_enter(&pcp->pc_lock);
 	}
 
+	return (error);
+}
+
+/*
+ * This is the system call trap that poll(),
+ * select() and pselect() are built upon.
+ * It is a private interface between libc and the kernel.
+ */
+int
+pollsys(pollfd_t *fds, nfds_t nfds, timespec_t *timeoutp, sigset_t *setp)
+{
+	kthread_t *t = curthread;
+	klwp_t *lwp = ttolwp(t);
+	proc_t *p = ttoproc(t);
+	timespec_t ts;
+	timespec_t *tsp;
+	k_sigset_t kset;
+	pollstate_t *ps = NULL;
+	pollfd_t *pollfdp = NULL;
+	int error = 0, fdcnt = 0;
+
+	/*
+	 * Copy in timeout
+	 */
+	if (timeoutp == NULL) {
+		tsp = NULL;
+	} else {
+		if (get_udatamodel() == DATAMODEL_NATIVE) {
+			if (copyin(timeoutp, &ts, sizeof (ts)))
+				return (set_errno(EFAULT));
+		} else {
+			timespec32_t ts32;
+
+			if (copyin(timeoutp, &ts32, sizeof (ts32)))
+				return (set_errno(EFAULT));
+			TIMESPEC32_TO_TIMESPEC(&ts, &ts32)
+		}
+
+		if (itimerspecfix(&ts))
+			return (set_errno(EINVAL));
+		tsp = &ts;
+	}
+
+	/*
+	 * Copy in and reset signal mask, if requested.
+	 */
+	if (setp != NULL) {
+		sigset_t set;
+
+		if (copyin(setp, &set, sizeof (set)))
+			return (set_errno(EFAULT));
+		sigutok(&set, &kset);
+
+		mutex_enter(&p->p_lock);
+		schedctl_finish_sigblock(t);
+		lwp->lwp_sigoldmask = t->t_hold;
+		t->t_hold = kset;
+		t->t_flag |= T_TOMASK;
+		/*
+		 * Call cv_reltimedwait_sig() just to check for signals.
+		 * We will return immediately with either 0 or -1.
+		 */
+		if (!cv_reltimedwait_sig(&t->t_delay_cv, &p->p_lock, 0,
+		    TR_CLOCK_TICK)) {
+			mutex_exit(&p->p_lock);
+			error = EINTR;
+			goto pollout;
+		}
+		mutex_exit(&p->p_lock);
+	}
+
+	/*
+	 * Initialize pollstate and copy in pollfd data if present.
+	 * If nfds == 0, we will skip all of the copying and check steps and
+	 * proceed directly into poll_common to process the supplied timeout.
+	 */
+	if (nfds != 0) {
+		if (nfds > p->p_fno_ctl) {
+			mutex_enter(&p->p_lock);
+			(void) rctl_action(rctlproc_legacy[RLIMIT_NOFILE],
+			    p->p_rctls, p, RCA_SAFE);
+			mutex_exit(&p->p_lock);
+			error = EINVAL;
+			goto pollout;
+		}
+
+		/*
+		 * Need to allocate memory for pollstate before anything
+		 * because the mutex and cv are created in this space
+		 */
+		ps = pollstate_create();
+		if (ps->ps_pcache == NULL)
+			ps->ps_pcache = pcache_alloc();
+
+		if ((error = poll_copyin(ps, fds, nfds)) != 0)
+			goto pollout;
+		pollfdp = ps->ps_pollfd;
+	}
+
+	/*
+	 * Perform the actual poll.
+	 */
+	error = poll_common(ps, fds, nfds, tsp, &fdcnt);
+
 pollout:
 	/*
-	 * If we changed the signal mask but we received
-	 * no signal then restore the signal mask.
-	 * Otherwise psig() will deal with the signal mask.
+	 * If we changed the signal mask but we received no signal then restore
+	 * the signal mask.  Otherwise psig() will deal with the signal mask.
 	 */
-	if (ksetp != NULL) {
+	if (setp != NULL) {
 		mutex_enter(&p->p_lock);
 		if (lwp->lwp_cursig == 0) {
 			t->t_hold = lwp->lwp_sigoldmask;
@@ -612,12 +702,10 @@ pollout:
 
 	if (error)
 		return (set_errno(error));
-
 	/*
 	 * Copy out the events and return the fdcnt to the user.
 	 */
-	if (nfds != 0 &&
-	    copyout(pollfdp, fds, nfds * sizeof (pollfd_t)))
+	if (nfds != 0 && copyout(pollfdp, fds, nfds * sizeof (pollfd_t)))
 		return (set_errno(EFAULT));
 
 #ifdef DEBUG
@@ -625,7 +713,7 @@ pollout:
 	 * Another sanity check:
 	 */
 	if (fdcnt) {
-		int	reventcnt = 0;
+		int i, reventcnt = 0;
 
 		for (i = 0; i < nfds; i++) {
 			if (pollfdp[i].fd < 0) {
@@ -638,6 +726,8 @@ pollout:
 		}
 		ASSERT(fdcnt == reventcnt);
 	} else {
+		int i;
+
 		for (i = 0; i < nfds; i++) {
 			ASSERT(pollfdp[i].revents == 0);
 		}
@@ -648,52 +738,6 @@ pollout:
 }
 
 /*
- * This is the system call trap that poll(),
- * select() and pselect() are built upon.
- * It is a private interface between libc and the kernel.
- */
-int
-pollsys(pollfd_t *fds, nfds_t nfds, timespec_t *timeoutp, sigset_t *setp)
-{
-	timespec_t ts;
-	timespec_t *tsp;
-	sigset_t set;
-	k_sigset_t kset;
-	k_sigset_t *ksetp;
-	model_t datamodel = get_udatamodel();
-
-	if (timeoutp == NULL)
-		tsp = NULL;
-	else {
-		if (datamodel == DATAMODEL_NATIVE) {
-			if (copyin(timeoutp, &ts, sizeof (ts)))
-				return (set_errno(EFAULT));
-		} else {
-			timespec32_t ts32;
-
-			if (copyin(timeoutp, &ts32, sizeof (ts32)))
-				return (set_errno(EFAULT));
-			TIMESPEC32_TO_TIMESPEC(&ts, &ts32)
-		}
-
-		if (itimerspecfix(&ts))
-			return (set_errno(EINVAL));
-		tsp = &ts;
-	}
-
-	if (setp == NULL)
-		ksetp = NULL;
-	else {
-		if (copyin(setp, &set, sizeof (set)))
-			return (set_errno(EFAULT));
-		sigutok(&set, &kset);
-		ksetp = &kset;
-	}
-
-	return (poll_common(fds, nfds, tsp, ksetp));
-}
-
-/*
  * Clean up any state left around by poll(2). Called when a thread exits.
  */
 void
@@ -1277,8 +1321,8 @@ pcache_insert(pollstate_t *ps, file_t *fp, pollfd_t *pollfdp, int *fdcntp,
 	 * be OK too.
 	 */
 	ASSERT(curthread->t_pollcache == NULL);
-	error = VOP_POLL(fp->f_vnode, pollfdp->events, 0, &pollfdp->revents,
-	    &memphp, NULL);
+	error = VOP_POLL(fp->f_vnode, pollfdp->events | ps->ps_implicit_ev, 0,
+	    &pollfdp->revents, &memphp, NULL);
 	if (error) {
 		return (error);
 	}
@@ -1992,7 +2036,8 @@ retry:
 			 * flag.
 			 */
 			ASSERT(curthread->t_pollcache == NULL);
-			error = VOP_POLL(fp->f_vnode, pollfdp[entry].events, 0,
+			error = VOP_POLL(fp->f_vnode,
+			    pollfdp[entry].events | ps->ps_implicit_ev, 0,
 			    &pollfdp[entry].revents, &php, NULL);
 			/*
 			 * releasef after completely done with this cached
@@ -2291,6 +2336,7 @@ pollstate_create()
 	} else {
 		ASSERT(ps->ps_depth == 0);
 		ASSERT(ps->ps_flags == 0);
+		ASSERT(ps->ps_implicit_ev == 0);
 		ASSERT(ps->ps_pc_stack[0] == 0);
 	}
 	return (ps);
@@ -3025,7 +3071,7 @@ plist_chkdupfd(file_t *fp, polldat_t *pdp, pollstate_t *psp, pollfd_t *pollfdp,
 				php = NULL;
 				ASSERT(curthread->t_pollcache == NULL);
 				error = VOP_POLL(fp->f_vnode,
-				    pollfdp[i].events, 0,
+				    pollfdp[i].events | psp->ps_implicit_ev, 0,
 				    &pollfdp[i].revents, &php, NULL);
 				if (error) {
 					return (error);
diff --git a/usr/src/uts/common/syscall/rusagesys.c b/usr/src/uts/common/syscall/rusagesys.c
index 3e0e63f4c0..09f3266ab4 100644
--- a/usr/src/uts/common/syscall/rusagesys.c
+++ b/usr/src/uts/common/syscall/rusagesys.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.  All rights reserved.
  */
 
 /*
diff --git a/usr/src/uts/common/syscall/rw.c b/usr/src/uts/common/syscall/rw.c
index a28894b2c9..23f03e841d 100644
--- a/usr/src/uts/common/syscall/rw.c
+++ b/usr/src/uts/common/syscall/rw.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -50,6 +50,7 @@
 #include <sys/debug.h>
 #include <sys/rctl.h>
 #include <sys/nbmlock.h>
+#include <sys/limits.h>
 
 #define	COPYOUT_MAX_CACHE	(1<<17)		/* 128K */
 
@@ -607,19 +608,12 @@ out:
 	return (bcount);
 }
 
-/*
- * XXX -- The SVID refers to IOV_MAX, but doesn't define it.  Grrrr....
- * XXX -- However, SVVS expects readv() and writev() to fail if
- * XXX -- iovcnt > 16 (yes, it's hard-coded in the SVVS source),
- * XXX -- so I guess that's the "interface".
- */
-#define	DEF_IOV_MAX	16
-
 ssize_t
 readv(int fdes, struct iovec *iovp, int iovcnt)
 {
 	struct uio auio;
-	struct iovec aiov[DEF_IOV_MAX];
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
 	file_t *fp;
 	register vnode_t *vp;
 	struct cpu *cp;
@@ -630,9 +624,14 @@ readv(int fdes, struct iovec *iovp, int iovcnt)
 	u_offset_t fileoff;
 	int in_crit = 0;
 
-	if (iovcnt <= 0 || iovcnt > DEF_IOV_MAX)
+	if (iovcnt <= 0 || iovcnt > IOV_MAX)
 		return (set_errno(EINVAL));
 
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+
 #ifdef _SYSCALL32_IMPL
 	/*
 	 * 32-bit callers need to have their iovec expanded,
@@ -640,36 +639,63 @@ readv(int fdes, struct iovec *iovp, int iovcnt)
 	 * of data in a single call.
 	 */
 	if (get_udatamodel() == DATAMODEL_ILP32) {
-		struct iovec32 aiov32[DEF_IOV_MAX];
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		int aiov32len;
 		ssize32_t count32;
 
-		if (copyin(iovp, aiov32, iovcnt * sizeof (struct iovec32)))
+		aiov32len = iovcnt * sizeof (iovec32_t);
+		if (aiovlen != 0)
+			aiov32 = kmem_alloc(aiov32len, KM_SLEEP);
+
+		if (copyin(iovp, aiov32, aiov32len)) {
+			if (aiovlen != 0) {
+				kmem_free(aiov32, aiov32len);
+				kmem_free(aiov, aiovlen);
+			}
 			return (set_errno(EFAULT));
+		}
 
 		count32 = 0;
 		for (i = 0; i < iovcnt; i++) {
 			ssize32_t iovlen32 = aiov32[i].iov_len;
 			count32 += iovlen32;
-			if (iovlen32 < 0 || count32 < 0)
+			if (iovlen32 < 0 || count32 < 0) {
+				if (aiovlen != 0) {
+					kmem_free(aiov32, aiov32len);
+					kmem_free(aiov, aiovlen);
+				}
 				return (set_errno(EINVAL));
+			}
 			aiov[i].iov_len = iovlen32;
 			aiov[i].iov_base =
 			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
 		}
+
+		if (aiovlen != 0)
+			kmem_free(aiov32, aiov32len);
 	} else
 #endif
-	if (copyin(iovp, aiov, iovcnt * sizeof (struct iovec)))
+	if (copyin(iovp, aiov, iovcnt * sizeof (iovec_t))) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EFAULT));
+	}
 
 	count = 0;
 	for (i = 0; i < iovcnt; i++) {
 		ssize_t iovlen = aiov[i].iov_len;
 		count += iovlen;
-		if (iovlen < 0 || count < 0)
+		if (iovlen < 0 || count < 0) {
+			if (aiovlen != 0)
+				kmem_free(aiov, aiovlen);
 			return (set_errno(EINVAL));
+		}
 	}
-	if ((fp = getf(fdes)) == NULL)
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EBADF));
+	}
 	if (((fflag = fp->f_flag) & FREAD) == 0) {
 		error = EBADF;
 		goto out;
@@ -768,6 +794,8 @@ out:
 	if (in_crit)
 		nbl_end_crit(vp);
 	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
 	if (error)
 		return (set_errno(error));
 	return (count);
@@ -777,7 +805,8 @@ ssize_t
 writev(int fdes, struct iovec *iovp, int iovcnt)
 {
 	struct uio auio;
-	struct iovec aiov[DEF_IOV_MAX];
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
 	file_t *fp;
 	register vnode_t *vp;
 	struct cpu *cp;
@@ -788,9 +817,14 @@ writev(int fdes, struct iovec *iovp, int iovcnt)
 	u_offset_t fileoff;
 	int in_crit = 0;
 
-	if (iovcnt <= 0 || iovcnt > DEF_IOV_MAX)
+	if (iovcnt <= 0 || iovcnt > IOV_MAX)
 		return (set_errno(EINVAL));
 
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+
 #ifdef _SYSCALL32_IMPL
 	/*
 	 * 32-bit callers need to have their iovec expanded,
@@ -798,36 +832,62 @@ writev(int fdes, struct iovec *iovp, int iovcnt)
 	 * of data in a single call.
 	 */
 	if (get_udatamodel() == DATAMODEL_ILP32) {
-		struct iovec32 aiov32[DEF_IOV_MAX];
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		int aiov32len;
 		ssize32_t count32;
 
-		if (copyin(iovp, aiov32, iovcnt * sizeof (struct iovec32)))
+		aiov32len = iovcnt * sizeof (iovec32_t);
+		if (aiovlen != 0)
+			aiov32 = kmem_alloc(aiov32len, KM_SLEEP);
+
+		if (copyin(iovp, aiov32, aiov32len)) {
+			if (aiovlen != 0) {
+				kmem_free(aiov32, aiov32len);
+				kmem_free(aiov, aiovlen);
+			}
 			return (set_errno(EFAULT));
+		}
 
 		count32 = 0;
 		for (i = 0; i < iovcnt; i++) {
 			ssize32_t iovlen = aiov32[i].iov_len;
 			count32 += iovlen;
-			if (iovlen < 0 || count32 < 0)
+			if (iovlen < 0 || count32 < 0) {
+				if (aiovlen != 0) {
+					kmem_free(aiov32, aiov32len);
+					kmem_free(aiov, aiovlen);
+				}
 				return (set_errno(EINVAL));
+			}
 			aiov[i].iov_len = iovlen;
 			aiov[i].iov_base =
 			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
 		}
+		if (aiovlen != 0)
+			kmem_free(aiov32, aiov32len);
 	} else
 #endif
-	if (copyin(iovp, aiov, iovcnt * sizeof (struct iovec)))
+	if (copyin(iovp, aiov, iovcnt * sizeof (iovec_t))) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EFAULT));
+	}
 
 	count = 0;
 	for (i = 0; i < iovcnt; i++) {
 		ssize_t iovlen = aiov[i].iov_len;
 		count += iovlen;
-		if (iovlen < 0 || count < 0)
+		if (iovlen < 0 || count < 0) {
+			if (aiovlen != 0)
+				kmem_free(aiov, aiovlen);
 			return (set_errno(EINVAL));
+		}
 	}
-	if ((fp = getf(fdes)) == NULL)
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EBADF));
+	}
 	if (((fflag = fp->f_flag) & FWRITE) == 0) {
 		error = EBADF;
 		goto out;
@@ -917,6 +977,8 @@ out:
 	if (in_crit)
 		nbl_end_crit(vp);
 	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
 	if (error)
 		return (set_errno(error));
 	return (count);
@@ -927,7 +989,8 @@ preadv(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
     off_t extended_offset)
 {
 	struct uio auio;
-	struct iovec aiov[DEF_IOV_MAX];
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
 	file_t *fp;
 	register vnode_t *vp;
 	struct cpu *cp;
@@ -936,25 +999,35 @@ preadv(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 	int error = 0;
 	int i;
 
+	/*
+	 * In a 64-bit kernel, this interface supports native 64-bit
+	 * applications as well as 32-bit applications using both standard and
+	 * large-file access. For 32-bit large-file aware applications, the
+	 * offset is passed as two parameters which are joined into the actual
+	 * offset used. The 64-bit libc always passes 0 for the extended_offset.
+	 * Note that off_t is a signed value, but the preadv/pwritev API treats
+	 * the offset as a position in the file for the operation, so passing
+	 * a negative value will likely fail the maximum offset checks below
+	 * because we convert it to an unsigned value which will be larger than
+	 * the maximum valid offset.
+	 */
 #if defined(_SYSCALL32_IMPL) || defined(_ILP32)
 	u_offset_t fileoff = ((u_offset_t)extended_offset << 32) |
 	    (u_offset_t)offset;
 #else /* _SYSCALL32_IMPL || _ILP32 */
 	u_offset_t fileoff = (u_offset_t)(ulong_t)offset;
 #endif /* _SYSCALL32_IMPR || _ILP32 */
-#ifdef _SYSCALL32_IMPL
-	const u_offset_t maxoff = get_udatamodel() == DATAMODEL_ILP32 &&
-	    extended_offset == 0?
-	    MAXOFF32_T : MAXOFFSET_T;
-#else /* _SYSCALL32_IMPL */
-	const u_offset_t maxoff = MAXOFF32_T;
-#endif /* _SYSCALL32_IMPL */
 
 	int in_crit = 0;
 
-	if (iovcnt <= 0 || iovcnt > DEF_IOV_MAX)
+	if (iovcnt <= 0 || iovcnt > IOV_MAX)
 		return (set_errno(EINVAL));
 
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+
 #ifdef _SYSCALL32_IMPL
 	/*
 	 * 32-bit callers need to have their iovec expanded,
@@ -962,61 +1035,104 @@ preadv(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 	 * of data in a single call.
 	 */
 	if (get_udatamodel() == DATAMODEL_ILP32) {
-		struct iovec32 aiov32[DEF_IOV_MAX];
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		int aiov32len;
 		ssize32_t count32;
 
-		if (copyin(iovp, aiov32, iovcnt * sizeof (struct iovec32)))
+		aiov32len = iovcnt * sizeof (iovec32_t);
+		if (aiovlen != 0)
+			aiov32 = kmem_alloc(aiov32len, KM_SLEEP);
+
+		if (copyin(iovp, aiov32, aiov32len)) {
+			if (aiovlen != 0) {
+				kmem_free(aiov32, aiov32len);
+				kmem_free(aiov, aiovlen);
+			}
 			return (set_errno(EFAULT));
+		}
 
 		count32 = 0;
 		for (i = 0; i < iovcnt; i++) {
 			ssize32_t iovlen32 = aiov32[i].iov_len;
 			count32 += iovlen32;
-			if (iovlen32 < 0 || count32 < 0)
+			if (iovlen32 < 0 || count32 < 0) {
+				if (aiovlen != 0) {
+					kmem_free(aiov32, aiov32len);
+					kmem_free(aiov, aiovlen);
+				}
 				return (set_errno(EINVAL));
+			}
 			aiov[i].iov_len = iovlen32;
 			aiov[i].iov_base =
 			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
 		}
+		if (aiovlen != 0)
+			kmem_free(aiov32, aiov32len);
 	} else
 #endif /* _SYSCALL32_IMPL */
-		if (copyin(iovp, aiov, iovcnt * sizeof (struct iovec)))
+		if (copyin(iovp, aiov, iovcnt * sizeof (iovec_t))) {
+			if (aiovlen != 0)
+				kmem_free(aiov, aiovlen);
 			return (set_errno(EFAULT));
+		}
 
 	count = 0;
 	for (i = 0; i < iovcnt; i++) {
 		ssize_t iovlen = aiov[i].iov_len;
 		count += iovlen;
-		if (iovlen < 0 || count < 0)
+		if (iovlen < 0 || count < 0) {
+			if (aiovlen != 0)
+				kmem_free(aiov, aiovlen);
 			return (set_errno(EINVAL));
+		}
 	}
 
-	if ((bcount = (ssize_t)count) < 0)
+	if ((bcount = count) < 0) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EINVAL));
-	if ((fp = getf(fdes)) == NULL)
+	}
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EBADF));
+	}
 	if (((fflag = fp->f_flag) & FREAD) == 0) {
 		error = EBADF;
 		goto out;
 	}
 	vp = fp->f_vnode;
 	rwflag = 0;
-	if (vp->v_type == VREG) {
 
+	/*
+	 * Behaviour is same as read(2). Please see comments in read(2).
+	 */
+	if (vp->v_type == VREG) {
 		if (bcount == 0)
 			goto out;
 
-		/*
-		 * return EINVAL for offsets that cannot be
-		 * represented in an off_t.
-		 */
-		if (fileoff > maxoff) {
-			error = EINVAL;
+		/* Handle offset past maximum offset allowed for file. */
+		if (fileoff >= OFFSET_MAX(fp)) {
+			struct vattr va;
+			va.va_mask = AT_SIZE;
+
+			error = VOP_GETATTR(vp, &va, 0, fp->f_cred, NULL);
+			if (error == 0)  {
+				if (fileoff >= va.va_size) {
+					count = 0;
+				} else {
+					error = EOVERFLOW;
+				}
+			}
 			goto out;
 		}
 
-		if (fileoff + bcount > maxoff)
-			bcount = (ssize_t)((u_offset_t)maxoff - fileoff);
+		ASSERT(bcount == count);
+
+		/* Note: modified count used in nbl_conflict() call below. */
+		if ((fileoff + count) > OFFSET_MAX(fp))
+			count = (ssize_t)(OFFSET_MAX(fp) - fileoff);
+
 	} else if (vp->v_type == VFIFO) {
 		error = ESPIPE;
 		goto out;
@@ -1033,8 +1149,7 @@ preadv(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 		error = nbl_svmand(vp, fp->f_cred, &svmand);
 		if (error != 0)
 			goto out;
-		if (nbl_conflict(vp, NBL_WRITE, fileoff, count, svmand,
-		    NULL)) {
+		if (nbl_conflict(vp, NBL_WRITE, fileoff, count, svmand, NULL)) {
 			error = EACCES;
 			goto out;
 		}
@@ -1042,33 +1157,6 @@ preadv(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 
 	(void) VOP_RWLOCK(vp, rwflag, NULL);
 
-	/*
-	 * Behaviour is same as read(2). Please see comments in
-	 * read(2).
-	 */
-
-	if ((vp->v_type == VREG) && (fileoff >= OFFSET_MAX(fp))) {
-		struct vattr va;
-		va.va_mask = AT_SIZE;
-		if ((error =
-		    VOP_GETATTR(vp, &va, 0, fp->f_cred, NULL)))  {
-			VOP_RWUNLOCK(vp, rwflag, NULL);
-			goto out;
-		}
-		if (fileoff >= va.va_size) {
-			VOP_RWUNLOCK(vp, rwflag, NULL);
-			count = 0;
-			goto out;
-		} else {
-			VOP_RWUNLOCK(vp, rwflag, NULL);
-			error = EOVERFLOW;
-			goto out;
-		}
-	}
-	if ((vp->v_type == VREG) &&
-	    (fileoff + count > OFFSET_MAX(fp))) {
-		count = (ssize_t)(OFFSET_MAX(fp) - fileoff);
-	}
 	auio.uio_loffset = fileoff;
 	auio.uio_iov = aiov;
 	auio.uio_iovcnt = iovcnt;
@@ -1099,6 +1187,8 @@ out:
 	if (in_crit)
 		nbl_end_crit(vp);
 	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
 	if (error)
 		return (set_errno(error));
 	return (count);
@@ -1109,7 +1199,8 @@ pwritev(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
     off_t extended_offset)
 {
 	struct uio auio;
-	struct iovec aiov[DEF_IOV_MAX];
+	struct iovec buf[IOV_MAX_STACK], *aiov = buf;
+	int aiovlen = 0;
 	file_t *fp;
 	register vnode_t *vp;
 	struct cpu *cp;
@@ -1118,25 +1209,26 @@ pwritev(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 	int error = 0;
 	int i;
 
+	/*
+	 * See the comment in preadv for how the offset is handled.
+	 */
 #if defined(_SYSCALL32_IMPL) || defined(_ILP32)
 	u_offset_t fileoff = ((u_offset_t)extended_offset << 32) |
 	    (u_offset_t)offset;
 #else /* _SYSCALL32_IMPL || _ILP32 */
 	u_offset_t fileoff = (u_offset_t)(ulong_t)offset;
 #endif /* _SYSCALL32_IMPR || _ILP32 */
-#ifdef _SYSCALL32_IMPL
-	const u_offset_t maxoff = get_udatamodel() == DATAMODEL_ILP32 &&
-	    extended_offset == 0?
-	    MAXOFF32_T : MAXOFFSET_T;
-#else /* _SYSCALL32_IMPL */
-	const u_offset_t maxoff = MAXOFF32_T;
-#endif /* _SYSCALL32_IMPL */
 
 	int in_crit = 0;
 
-	if (iovcnt <= 0 || iovcnt > DEF_IOV_MAX)
+	if (iovcnt <= 0 || iovcnt > IOV_MAX)
 		return (set_errno(EINVAL));
 
+	if (iovcnt > IOV_MAX_STACK) {
+		aiovlen = iovcnt * sizeof (iovec_t);
+		aiov = kmem_alloc(aiovlen, KM_SLEEP);
+	}
+
 #ifdef _SYSCALL32_IMPL
 	/*
 	 * 32-bit callers need to have their iovec expanded,
@@ -1144,58 +1236,92 @@ pwritev(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 	 * of data in a single call.
 	 */
 	if (get_udatamodel() == DATAMODEL_ILP32) {
-		struct iovec32 aiov32[DEF_IOV_MAX];
+		struct iovec32 buf32[IOV_MAX_STACK], *aiov32 = buf32;
+		int aiov32len;
 		ssize32_t count32;
 
-		if (copyin(iovp, aiov32, iovcnt * sizeof (struct iovec32)))
+		aiov32len = iovcnt * sizeof (iovec32_t);
+		if (aiovlen != 0)
+			aiov32 = kmem_alloc(aiov32len, KM_SLEEP);
+
+		if (copyin(iovp, aiov32, aiov32len)) {
+			if (aiovlen != 0) {
+				kmem_free(aiov32, aiov32len);
+				kmem_free(aiov, aiovlen);
+			}
 			return (set_errno(EFAULT));
+		}
 
 		count32 = 0;
 		for (i = 0; i < iovcnt; i++) {
 			ssize32_t iovlen32 = aiov32[i].iov_len;
 			count32 += iovlen32;
-			if (iovlen32 < 0 || count32 < 0)
+			if (iovlen32 < 0 || count32 < 0) {
+				if (aiovlen != 0) {
+					kmem_free(aiov32, aiov32len);
+					kmem_free(aiov, aiovlen);
+				}
 				return (set_errno(EINVAL));
+			}
 			aiov[i].iov_len = iovlen32;
 			aiov[i].iov_base =
 			    (caddr_t)(uintptr_t)aiov32[i].iov_base;
 		}
+		if (aiovlen != 0)
+			kmem_free(aiov32, aiov32len);
 	} else
 #endif /* _SYSCALL32_IMPL */
-		if (copyin(iovp, aiov, iovcnt * sizeof (struct iovec)))
+		if (copyin(iovp, aiov, iovcnt * sizeof (iovec_t))) {
+			if (aiovlen != 0)
+				kmem_free(aiov, aiovlen);
 			return (set_errno(EFAULT));
+		}
 
 	count = 0;
 	for (i = 0; i < iovcnt; i++) {
 		ssize_t iovlen = aiov[i].iov_len;
 		count += iovlen;
-		if (iovlen < 0 || count < 0)
+		if (iovlen < 0 || count < 0) {
+			if (aiovlen != 0)
+				kmem_free(aiov, aiovlen);
 			return (set_errno(EINVAL));
+		}
 	}
 
-	if ((bcount = (ssize_t)count) < 0)
+	if ((bcount = count) < 0) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EINVAL));
-	if ((fp = getf(fdes)) == NULL)
+	}
+	if ((fp = getf(fdes)) == NULL) {
+		if (aiovlen != 0)
+			kmem_free(aiov, aiovlen);
 		return (set_errno(EBADF));
+	}
 	if (((fflag = fp->f_flag) & FWRITE) == 0) {
 		error = EBADF;
 		goto out;
 	}
 	vp = fp->f_vnode;
 	rwflag = 1;
-	if (vp->v_type == VREG) {
 
+	/*
+	 * The kernel's write(2) code checks the rctl & OFFSET_MAX and returns
+	 * EFBIG when fileoff exceeds either limit. We do the same.
+	 */
+	if (vp->v_type == VREG) {
 		if (bcount == 0)
 			goto out;
 
 		/*
-		 * return EINVAL for offsets that cannot be
-		 * represented in an off_t.
+		 * Don't allow pwritev to cause file size to exceed the proper
+		 * offset limit.
 		 */
-		if (fileoff > maxoff) {
-			error = EINVAL;
+		if (fileoff >= OFFSET_MAX(fp)) {
+			error = EFBIG;
 			goto out;
 		}
+
 		/*
 		 * Take appropriate action if we are trying
 		 * to write above the resource limit.
@@ -1218,17 +1344,13 @@ pwritev(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 			error = EFBIG;
 			goto out;
 		}
-		/*
-		 * Don't allow pwritev to cause file sizes to exceed
-		 * maxoff.
-		 */
-		if (fileoff == maxoff) {
-			error = EFBIG;
-			goto out;
-		}
 
-		if (fileoff + bcount > maxoff)
-			bcount = (ssize_t)((u_offset_t)maxoff - fileoff);
+		ASSERT(bcount == count);
+
+		/* Note: modified count used in nbl_conflict() call below. */
+		if ((fileoff + count) > OFFSET_MAX(fp))
+			count = (ssize_t)(OFFSET_MAX(fp) - fileoff);
+
 	} else if (vp->v_type == VFIFO) {
 		error = ESPIPE;
 		goto out;
@@ -1245,8 +1367,7 @@ pwritev(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 		error = nbl_svmand(vp, fp->f_cred, &svmand);
 		if (error != 0)
 			goto out;
-		if (nbl_conflict(vp, NBL_WRITE, fileoff, count, svmand,
-		    NULL)) {
+		if (nbl_conflict(vp, NBL_WRITE, fileoff, count, svmand, NULL)) {
 			error = EACCES;
 			goto out;
 		}
@@ -1254,34 +1375,6 @@ pwritev(int fdes, struct iovec *iovp, int iovcnt, off_t offset,
 
 	(void) VOP_RWLOCK(vp, rwflag, NULL);
 
-
-	/*
-	 * Behaviour is same as write(2). Please see comments for
-	 * write(2).
-	 */
-
-	if (vp->v_type == VREG) {
-		if (fileoff >= curproc->p_fsz_ctl) {
-			VOP_RWUNLOCK(vp, rwflag, NULL);
-			mutex_enter(&curproc->p_lock);
-			/* see above rctl_action comment */
-			(void) rctl_action(
-			    rctlproc_legacy[RLIMIT_FSIZE],
-			    curproc->p_rctls,
-			    curproc, RCA_UNSAFE_SIGINFO);
-			mutex_exit(&curproc->p_lock);
-			error = EFBIG;
-			goto out;
-		}
-		if (fileoff >= OFFSET_MAX(fp)) {
-			VOP_RWUNLOCK(vp, rwflag, NULL);
-			error = EFBIG;
-			goto out;
-		}
-		if (fileoff + count > OFFSET_MAX(fp))
-			count = (ssize_t)(OFFSET_MAX(fp) - fileoff);
-	}
-
 	auio.uio_loffset = fileoff;
 	auio.uio_iov = aiov;
 	auio.uio_iovcnt = iovcnt;
@@ -1308,6 +1401,8 @@ out:
 	if (in_crit)
 		nbl_end_crit(vp);
 	releasef(fdes);
+	if (aiovlen != 0)
+		kmem_free(aiov, aiovlen);
 	if (error)
 		return (set_errno(error));
 	return (count);
diff --git a/usr/src/uts/common/syscall/sendfile.c b/usr/src/uts/common/syscall/sendfile.c
index 0cfafbf13f..16c6fdd27e 100644
--- a/usr/src/uts/common/syscall/sendfile.c
+++ b/usr/src/uts/common/syscall/sendfile.c
@@ -82,7 +82,7 @@ extern sotpi_info_t *sotpi_sototpi(struct sonode *);
  * 64 bit kernel or 32 bit kernel. For 32 bit apps, we can't transfer
  * more than 2GB of data.
  */
-int
+static int
 sendvec_chunk64(file_t *fp, u_offset_t *fileoff, struct ksendfilevec64 *sfv,
     int copy_cnt, ssize32_t *count)
 {
@@ -343,7 +343,7 @@ sendvec_chunk64(file_t *fp, u_offset_t *fileoff, struct ksendfilevec64 *sfv,
 	return (0);
 }
 
-ssize32_t
+static ssize32_t
 sendvec64(file_t *fp, const struct ksendfilevec64 *vec, int sfvcnt,
     size32_t *xferred, int fildes)
 {
@@ -390,7 +390,7 @@ sendvec64(file_t *fp, const struct ksendfilevec64 *vec, int sfvcnt,
 }
 #endif
 
-int
+static int
 sendvec_small_chunk(file_t *fp, u_offset_t *fileoff, struct sendfilevec *sfv,
     int copy_cnt, ssize_t total_size, int maxblk, ssize_t *count)
 {
@@ -680,7 +680,7 @@ sendvec_small_chunk(file_t *fp, u_offset_t *fileoff, struct sendfilevec *sfv,
 }
 
 
-int
+static int
 sendvec_chunk(file_t *fp, u_offset_t *fileoff, struct sendfilevec *sfv,
     int copy_cnt, ssize_t *count)
 {
@@ -1174,6 +1174,17 @@ sendfilev(int opcode, int fildes, const struct sendfilevec *vec, int sfvcnt,
 		} else {
 			maxblk = (int)vp->v_stream->sd_maxblk;
 		}
+
+		/*
+		 * We need to make sure that the socket that we're sending on
+		 * supports sendfile behavior. sockfs doesn't know that the APIs
+		 * we want to use are coming from sendfile, so we can't rely on
+		 * it to check for us.
+		 */
+		if ((so->so_mode & SM_SENDFILESUPP) == 0) {
+			error = EOPNOTSUPP;
+			goto err;
+		}
 		break;
 	case VREG:
 		break;
diff --git a/usr/src/uts/common/syscall/stat.c b/usr/src/uts/common/syscall/stat.c
index 4085104cc7..93f26121bc 100644
--- a/usr/src/uts/common/syscall/stat.c
+++ b/usr/src/uts/common/syscall/stat.c
@@ -61,7 +61,7 @@
  * to VOP_GETATTR
  */
 
-static int
+int
 cstatat_getvp(int fd, char *name, int follow, vnode_t **vp, cred_t **cred)
 {
 	vnode_t *startvp;
diff --git a/usr/src/uts/common/syscall/sysconfig.c b/usr/src/uts/common/syscall/sysconfig.c
index 03f2fabe13..e09f4e85a2 100644
--- a/usr/src/uts/common/syscall/sysconfig.c
+++ b/usr/src/uts/common/syscall/sysconfig.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -111,6 +112,9 @@ sysconfig(int which)
 	case _CONFIG_NPROC_MAX:
 		return (max_ncpus);
 
+	case _CONFIG_NPROC_NCPU:
+		return (NCPU); /* Private sysconfig for direct NCPU access */
+
 	case _CONFIG_STACK_PROT:
 		return (curproc->p_stkprot & ~PROT_USER);
 
@@ -167,44 +171,29 @@ sysconfig(int which)
 		/*
 		 * If the non-global zone has a phys. memory cap, use that.
 		 * We always report the system-wide value for the global zone,
-		 * even though rcapd can be used on the global zone too.
+		 * even though memory capping can be used on the global zone
+		 * too.
 		 */
-		if (!INGLOBALZONE(curproc) &&
-		    curproc->p_zone->zone_phys_mcap != 0)
-			return (MIN(btop(curproc->p_zone->zone_phys_mcap),
-			    physinstalled));
+		if (!INGLOBALZONE(curproc)) {
+			pgcnt_t cap, free;
+
+			zone_get_physmem_data(curzone->zone_id, &cap, &free);
+			return (MIN(cap, physinstalled));
+		}
 
 		return (physinstalled);
 
 	case _CONFIG_AVPHYS_PAGES:
 		/*
-		 * If the non-global zone has a phys. memory cap, use
-		 * the phys. memory cap - zone's current rss.  We always
-		 * report the system-wide value for the global zone, even
-		 * though rcapd can be used on the global zone too.
+		 * If the non-global zone has a phys. memory cap, use its
+		 * free value. We always report the system-wide value for the
+		 * global zone, even though memory capping can be used on the
+		 * global zone too.
 		 */
-		if (!INGLOBALZONE(curproc) &&
-		    curproc->p_zone->zone_phys_mcap != 0) {
-			pgcnt_t cap, rss, free;
-			vmusage_t in_use;
-			size_t cnt = 1;
-
-			cap = btop(curproc->p_zone->zone_phys_mcap);
-			if (cap > physinstalled)
-				return (freemem);
-
-			if (vm_getusage(VMUSAGE_ZONE, 1, &in_use, &cnt,
-			    FKIOCTL) != 0)
-				in_use.vmu_rss_all = 0;
-			rss = btop(in_use.vmu_rss_all);
-			/*
-			 * Because rcapd implements a soft cap, it is possible
-			 * for rss to be temporarily over the cap.
-			 */
-			if (cap > rss)
-				free = cap - rss;
-			else
-				free = 0;
+		if (!INGLOBALZONE(curproc)) {
+			pgcnt_t cap, free;
+
+			zone_get_physmem_data(curzone->zone_id, &cap, &free);
 			return (MIN(free, freemem));
 		}
 
diff --git a/usr/src/uts/common/syscall/uadmin.c b/usr/src/uts/common/syscall/uadmin.c
index 3f261fcda4..bf31c3dcd6 100644
--- a/usr/src/uts/common/syscall/uadmin.c
+++ b/usr/src/uts/common/syscall/uadmin.c
@@ -22,7 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2013 Joyent, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/param.h>
@@ -78,7 +78,7 @@ volatile int fastreboot_dryrun = 0;
  * system with many zones.
  */
 void
-killall(zoneid_t zoneid)
+killall(zoneid_t zoneid, boolean_t force)
 {
 	proc_t *p;
 
@@ -108,7 +108,7 @@ killall(zoneid_t zoneid)
 		    p->p_stat != SIDL &&
 		    p->p_stat != SZOMB) {
 			mutex_enter(&p->p_lock);
-			if (sigismember(&p->p_sig, SIGKILL)) {
+			if (!force && sigismember(&p->p_sig, SIGKILL)) {
 				mutex_exit(&p->p_lock);
 				p = p->p_next;
 			} else {
@@ -245,12 +245,13 @@ kadmin(int cmd, int fcn, void *mdep, cred_t *credp)
 		 */
 		zone_shutdown_global();
 
-		killall(ALL_ZONES);
+		killall(ALL_ZONES, B_FALSE);
 		/*
 		 * If we are calling kadmin() from a kernel context then we
 		 * do not release these resources.
 		 */
 		if (ttoproc(curthread) != &p0) {
+			mutex_enter(&curproc->p_lock);
 			VN_RELE(PTOU(curproc)->u_cdir);
 			if (PTOU(curproc)->u_rdir)
 				VN_RELE(PTOU(curproc)->u_rdir);
@@ -260,6 +261,7 @@ kadmin(int cmd, int fcn, void *mdep, cred_t *credp)
 			PTOU(curproc)->u_cdir = rootdir;
 			PTOU(curproc)->u_rdir = NULL;
 			PTOU(curproc)->u_cwd = NULL;
+			mutex_exit(&curproc->p_lock);
 		}
 
 		/*
diff --git a/usr/src/uts/common/syscall/umount.c b/usr/src/uts/common/syscall/umount.c
index a2deedb163..b25f89b6d5 100644
--- a/usr/src/uts/common/syscall/umount.c
+++ b/usr/src/uts/common/syscall/umount.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
@@ -125,6 +126,7 @@ umount2(char *pathp, int flag)
 	struct pathname pn;
 	struct vfs *vfsp;
 	int error;
+	boolean_t altroot;
 
 	/*
 	 * Some flags are disallowed through the system call interface.
@@ -154,9 +156,12 @@ umount2(char *pathp, int flag)
 	 * isn't in an environment with an alternate root (to the zone's root)
 	 * directory, i.e. chroot(2).
 	 */
-	if (secpolicy_fs_unmount(CRED(), NULL) != 0 ||
-	    (PTOU(curproc)->u_rdir != NULL &&
-	    PTOU(curproc)->u_rdir != curproc->p_zone->zone_rootvp) ||
+	mutex_enter(&curproc->p_lock);
+	altroot = (PTOU(curproc)->u_rdir != NULL &&
+	    PTOU(curproc)->u_rdir != curproc->p_zone->zone_rootvp);
+	mutex_exit(&curproc->p_lock);
+
+	if (secpolicy_fs_unmount(CRED(), NULL) != 0 || altroot ||
 	    (vfsp = vfs_mntpoint2vfsp(pn.pn_path)) == NULL) {
 		vnode_t *fsrootvp;
 
diff --git a/usr/src/uts/common/vm/hat.h b/usr/src/uts/common/vm/hat.h
index a2509e7bb6..3735139068 100644
--- a/usr/src/uts/common/vm/hat.h
+++ b/usr/src/uts/common/vm/hat.h
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -269,7 +270,12 @@ void	hat_kpm_walk(void (*)(void *, void *, size_t), void *);
  *	call.
  *
  * int hat_pageunload(pp, forceflag)
- *	unload all translations attached to pp.
+ *	Unload all translations attached to pp. On x86 the bulk of the work is
+ *	done by hat_page_inval.
+ *
+ * void	hat_page_inval(pp, pgsz, curhat)
+ *	Unload translations attached to pp. If curhat is provided, only the
+ *	translation for that process is unloaded, otherwise all are unloaded.
  *
  * uint_t hat_pagesync(pp, flags)
  *	get hw stats from hardware into page struct and reset hw stats
@@ -291,6 +297,7 @@ void	hat_page_setattr(struct page *, uint_t);
 void	hat_page_clrattr(struct page *, uint_t);
 uint_t	hat_page_getattr(struct page *, uint_t);
 int	hat_pageunload(struct page *, uint_t);
+void	hat_page_inval(struct page *, uint_t, struct hat *);
 uint_t	hat_pagesync(struct page *, uint_t);
 ulong_t	hat_page_getshare(struct page *);
 int	hat_page_checkshare(struct page *, ulong_t);
@@ -460,6 +467,7 @@ void	hat_setstat(struct as *, caddr_t, size_t, uint_t);
  */
 #define	HAT_ADV_PGUNLOAD	0x00
 #define	HAT_FORCE_PGUNLOAD	0x01
+#define	HAT_CURPROC_PGUNLOAD	0x02
 
 /*
  * Attributes for hat_page_*attr, hat_setstats and
diff --git a/usr/src/uts/common/vm/page.h b/usr/src/uts/common/vm/page.h
index 8747b96acc..ae9b0be758 100644
--- a/usr/src/uts/common/vm/page.h
+++ b/usr/src/uts/common/vm/page.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2017, Joyent, Inc.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -229,6 +230,7 @@ struct as;
  *				p_nrm
  *				p_mapping
  *				p_share
+ *				p_zoneid
  *
  * The following field is file system dependent.  How it is used and
  * the locking strategies applied are up to the individual file system
@@ -527,9 +529,8 @@ typedef struct page {
 	pfn_t		p_pagenum;	/* physical page number */
 
 	uint_t		p_share;	/* number of translations */
-#if defined(_LP64)
-	uint_t		p_sharepad;	/* pad for growing p_share */
-#endif
+	short		p_zoneid;	/* zone page use tracking */
+	short		p_pad1;		/* TBD */
 	uint_t		p_slckcnt;	/* number of softlocks */
 #if defined(__sparc)
 	uint_t		p_kpmref;	/* number of kpm mapping sharers */
diff --git a/usr/src/uts/common/vm/page_lock.c b/usr/src/uts/common/vm/page_lock.c
index 7e48602189..7305c9c85a 100644
--- a/usr/src/uts/common/vm/page_lock.c
+++ b/usr/src/uts/common/vm/page_lock.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 
@@ -140,9 +141,8 @@ static pad_mutex_t	pszc_mutex[PSZC_MTX_TABLE_SIZE];
 	    & (VPH_TABLE_SIZE - 1))
 
 /*
- * Two slots after VPH_TABLE_SIZE are reserved in vph_mutex for kernel vnodes.
- * The lock for kvp is VPH_TABLE_SIZE + 0, and the lock for zvp is
- * VPH_TABLE_SIZE + 1.
+ * Two slots after VPH_TABLE_SIZE are reserved in vph_mutex for kernel vnodes,
+ * one for kvps[KV_ZVP], and one for other kvps[] users.
  */
 
 kmutex_t	vph_mutex[VPH_TABLE_SIZE + 2];
@@ -888,10 +888,10 @@ static int page_vnode_mutex_stress = 0;
 kmutex_t *
 page_vnode_mutex(vnode_t *vp)
 {
-	if (vp == &kvp)
+	if (vp == &kvp || vp == &kvps[KV_VVP])
 		return (&vph_mutex[VPH_TABLE_SIZE + 0]);
 
-	if (vp == &zvp)
+	if (vp == &kvps[KV_ZVP])
 		return (&vph_mutex[VPH_TABLE_SIZE + 1]);
 #ifdef DEBUG
 	if (page_vnode_mutex_stress != 0)
diff --git a/usr/src/uts/common/vm/page_retire.c b/usr/src/uts/common/vm/page_retire.c
index 76be970a45..f4e8d0737f 100644
--- a/usr/src/uts/common/vm/page_retire.c
+++ b/usr/src/uts/common/vm/page_retire.c
@@ -22,6 +22,7 @@
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright (c) 2016 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -851,9 +852,8 @@ page_retire_incr_pend_count(void *datap)
 {
 	PR_INCR_KSTAT(pr_pending);
 
-	if ((datap == &kvp) || (datap == &zvp)) {
+	if (datap == &kvp || datap == &kvps[KV_ZVP] || datap == &kvps[KV_VVP])
 		PR_INCR_KSTAT(pr_pending_kas);
-	}
 }
 
 void
@@ -861,9 +861,8 @@ page_retire_decr_pend_count(void *datap)
 {
 	PR_DECR_KSTAT(pr_pending);
 
-	if ((datap == &kvp) || (datap == &zvp)) {
+	if (datap == &kvp || datap == &kvps[KV_ZVP] || datap == &kvps[KV_VVP])
 		PR_DECR_KSTAT(pr_pending_kas);
-	}
 }
 
 /*
diff --git a/usr/src/uts/common/vm/seg_kmem.c b/usr/src/uts/common/vm/seg_kmem.c
index 439c859d96..0b116d6eba 100644
--- a/usr/src/uts/common/vm/seg_kmem.c
+++ b/usr/src/uts/common/vm/seg_kmem.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 1998, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -122,6 +122,11 @@ vmem_t *static_alloc_arena;	/* arena for allocating static memory */
 vmem_t *zio_arena = NULL;	/* arena for allocating zio memory */
 vmem_t *zio_alloc_arena = NULL;	/* arena for allocating zio memory */
 
+#if defined(__amd64)
+vmem_t *kvmm_arena;		/* arena for vmm VA */
+struct seg kvmmseg;		/* Segment for vmm memory */
+#endif
+
 /*
  * seg_kmem driver can map part of the kernel heap with large pages.
  * Currently this functionality is implemented for sparc platforms only.
@@ -440,7 +445,7 @@ segkmem_badop()
 /*ARGSUSED*/
 static faultcode_t
 segkmem_fault(struct hat *hat, struct seg *seg, caddr_t addr, size_t size,
-	enum fault_type type, enum seg_rw rw)
+    enum fault_type type, enum seg_rw rw)
 {
 	pgcnt_t npages;
 	spgcnt_t pg;
@@ -655,13 +660,19 @@ segkmem_dump(struct seg *seg)
 		    segkmem_dump_range, seg->s_as);
 		vmem_walk(heaptext_arena, VMEM_ALLOC | VMEM_REENTRANT,
 		    segkmem_dump_range, seg->s_as);
+	/*
+	 * We don't want to dump pages attached to kzioseg since they
+	 * contain file data from ZFS.  If this page's segment is
+	 * kzioseg return instead of writing it to the dump device.
+	 *
+	 * Same applies to VM memory allocations.
+	 */
 	} else if (seg == &kzioseg) {
-		/*
-		 * We don't want to dump pages attached to kzioseg since they
-		 * contain file data from ZFS.  If this page's segment is
-		 * kzioseg return instead of writing it to the dump device.
-		 */
 		return;
+#if defined(__amd64)
+	} else if (seg == &kvmmseg) {
+		return;
+#endif
 	} else {
 		segkmem_dump_range(seg->s_as, seg->s_base, seg->s_size);
 	}
@@ -677,7 +688,7 @@ segkmem_dump(struct seg *seg)
 /*ARGSUSED*/
 static int
 segkmem_pagelock(struct seg *seg, caddr_t addr, size_t len,
-	page_t ***ppp, enum lock_type type, enum seg_rw rw)
+    page_t ***ppp, enum lock_type type, enum seg_rw rw)
 {
 	page_t **pplist, *pp;
 	pgcnt_t npages;
@@ -802,21 +813,18 @@ struct seg_ops segkmem_ops = {
 };
 
 int
-segkmem_zio_create(struct seg *seg)
-{
-	ASSERT(seg->s_as == &kas && RW_WRITE_HELD(&kas.a_lock));
-	seg->s_ops = &segkmem_ops;
-	seg->s_data = &zvp;
-	kas.a_size += seg->s_size;
-	return (0);
-}
-
-int
 segkmem_create(struct seg *seg)
 {
 	ASSERT(seg->s_as == &kas && RW_WRITE_HELD(&kas.a_lock));
 	seg->s_ops = &segkmem_ops;
-	seg->s_data = &kvp;
+	if (seg == &kzioseg)
+		seg->s_data = &kvps[KV_ZVP];
+#if defined(__amd64)
+	else if (seg == &kvmmseg)
+		seg->s_data = &kvps[KV_VVP];
+#endif
+	else
+		seg->s_data = &kvps[KV_KVP];
 	kas.a_size += seg->s_size;
 	return (0);
 }
@@ -858,7 +866,7 @@ segkmem_page_create(void *addr, size_t size, int vmflag, void *arg)
  */
 void *
 segkmem_xalloc(vmem_t *vmp, void *inaddr, size_t size, int vmflag, uint_t attr,
-	page_t *(*page_create_func)(void *, size_t, int, void *), void *pcarg)
+    page_t *(*page_create_func)(void *, size_t, int, void *), void *pcarg)
 {
 	page_t *ppl;
 	caddr_t addr = inaddr;
@@ -968,10 +976,10 @@ segkmem_alloc(vmem_t *vmp, size_t size, int vmflag)
 	return (segkmem_alloc_vn(vmp, size, vmflag, &kvp));
 }
 
-void *
+static void *
 segkmem_zio_alloc(vmem_t *vmp, size_t size, int vmflag)
 {
-	return (segkmem_alloc_vn(vmp, size, vmflag, &zvp));
+	return (segkmem_alloc_vn(vmp, size, vmflag, &kvps[KV_ZVP]));
 }
 
 /*
@@ -980,8 +988,8 @@ segkmem_zio_alloc(vmem_t *vmp, size_t size, int vmflag)
  * we currently don't have a special kernel segment for non-paged
  * kernel memory that is exported by drivers to user space.
  */
-static void
-segkmem_free_vn(vmem_t *vmp, void *inaddr, size_t size, struct vnode *vp,
+void
+segkmem_xfree(vmem_t *vmp, void *inaddr, size_t size, struct vnode *vp,
     void (*func)(page_t *))
 {
 	page_t *pp;
@@ -1038,21 +1046,15 @@ segkmem_free_vn(vmem_t *vmp, void *inaddr, size_t size, struct vnode *vp,
 }
 
 void
-segkmem_xfree(vmem_t *vmp, void *inaddr, size_t size, void (*func)(page_t *))
-{
-	segkmem_free_vn(vmp, inaddr, size, &kvp, func);
-}
-
-void
 segkmem_free(vmem_t *vmp, void *inaddr, size_t size)
 {
-	segkmem_free_vn(vmp, inaddr, size, &kvp, NULL);
+	segkmem_xfree(vmp, inaddr, size, &kvp, NULL);
 }
 
-void
+static void
 segkmem_zio_free(vmem_t *vmp, void *inaddr, size_t size)
 {
-	segkmem_free_vn(vmp, inaddr, size, &zvp, NULL);
+	segkmem_xfree(vmp, inaddr, size, &kvps[KV_ZVP], NULL);
 }
 
 void
@@ -1534,8 +1536,21 @@ segkmem_zio_init(void *zio_mem_base, size_t zio_mem_size)
 	ASSERT(zio_alloc_arena != NULL);
 }
 
-#ifdef __sparc
+#if defined(__amd64)
+
+void
+segkmem_kvmm_init(void *base, size_t size)
+{
+	ASSERT(base != NULL);
+	ASSERT(size != 0);
+
+	kvmm_arena = vmem_create("kvmm_arena", base, size, 1024 * 1024,
+	    NULL, NULL, NULL, 0, VM_SLEEP);
+
+	ASSERT(kvmm_arena != NULL);
+}
 
+#elif defined(__sparc)
 
 static void *
 segkmem_alloc_ppa(vmem_t *vmp, size_t size, int vmflag)
diff --git a/usr/src/uts/common/vm/seg_kmem.h b/usr/src/uts/common/vm/seg_kmem.h
index 1db85826b1..9a20101670 100644
--- a/usr/src/uts/common/vm/seg_kmem.h
+++ b/usr/src/uts/common/vm/seg_kmem.h
@@ -21,7 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  * Copyright 2017 RackTop Systems.
  */
 
@@ -65,12 +65,18 @@ extern vmem_t *static_arena;	/* arena for caches to import static memory */
 extern vmem_t *static_alloc_arena;	/* arena for allocating static memory */
 extern vmem_t *zio_arena;	/* arena for zio caches */
 extern vmem_t *zio_alloc_arena;	/* arena for zio caches */
+
+#if defined(__amd64)
+extern struct seg kvmmseg;	/* Segment for vmm mappings */
+extern vmem_t *kvmm_arena;	/* arena for vmm VA */
+extern void segkmem_kvmm_init(void *, size_t);
+#endif
+
 extern struct vnode kvps[];
 /*
- * segkmem page vnodes
+ * segkmem page vnodes (please don't add more defines here...)
  */
 #define	kvp		(kvps[KV_KVP])
-#define	zvp		(kvps[KV_ZVP])
 #if defined(__sparc)
 #define	mpvp		(kvps[KV_MPVP])
 #define	promvp		(kvps[KV_PROMVP])
@@ -83,16 +89,14 @@ extern void *segkmem_xalloc(vmem_t *, void *, size_t, int, uint_t,
 extern void *segkmem_alloc(vmem_t *, size_t, int);
 extern void *segkmem_alloc_permanent(vmem_t *, size_t, int);
 extern void segkmem_free(vmem_t *, void *, size_t);
-extern void segkmem_xfree(vmem_t *, void *, size_t, void (*)(page_t *));
+extern void segkmem_xfree(vmem_t *, void *, size_t,
+    struct vnode *, void (*)(page_t *));
 
 extern void *boot_alloc(void *, size_t, uint_t);
 extern void boot_mapin(caddr_t addr, size_t size);
 extern void kernelheap_init(void *, void *, char *, void *, void *);
 extern void segkmem_gc(void);
 
-extern void *segkmem_zio_alloc(vmem_t *, size_t, int);
-extern int segkmem_zio_create(struct seg *);
-extern void segkmem_zio_free(vmem_t *, void *, size_t);
 extern void segkmem_zio_init(void *, size_t);
 
 /*
diff --git a/usr/src/uts/common/vm/seg_vn.c b/usr/src/uts/common/vm/seg_vn.c
index deb08c24e6..6d01642e4c 100644
--- a/usr/src/uts/common/vm/seg_vn.c
+++ b/usr/src/uts/common/vm/seg_vn.c
@@ -7313,7 +7313,8 @@ segvn_sync(struct seg *seg, caddr_t addr, size_t len, int attr, uint_t flags)
 	vpp = svd->vpage;
 	offset = svd->offset + (uintptr_t)(addr - seg->s_base);
 	bflags = ((flags & MS_ASYNC) ? B_ASYNC : 0) |
-	    ((flags & MS_INVALIDATE) ? B_INVAL : 0);
+	    ((flags & MS_INVALIDATE) ? B_INVAL : 0) |
+	    ((flags & MS_INVALCURPROC) ? (B_INVALCURONLY | B_INVAL) : 0);
 
 	if (attr) {
 		pageprot = attr & ~(SHARED|PRIVATE);
@@ -7338,11 +7339,11 @@ segvn_sync(struct seg *seg, caddr_t addr, size_t len, int attr, uint_t flags)
 			vpp = &svd->vpage[seg_page(seg, addr)];
 
 	} else if (svd->vp && svd->amp == NULL &&
-	    (flags & MS_INVALIDATE) == 0) {
+	    (flags & (MS_INVALIDATE | MS_INVALCURPROC)) == 0) {
 
 		/*
-		 * No attributes, no anonymous pages and MS_INVALIDATE flag
-		 * is not on, just use one big request.
+		 * No attributes, no anonymous pages and MS_INVAL* flags
+		 * are not on, just use one big request.
 		 */
 		err = VOP_PUTPAGE(svd->vp, (offset_t)offset, len,
 		    bflags, svd->cred, NULL);
@@ -7394,7 +7395,7 @@ segvn_sync(struct seg *seg, caddr_t addr, size_t len, int attr, uint_t flags)
 		 * might race in and lock the page after we unlock and before
 		 * we do the PUTPAGE, then PUTPAGE simply does nothing.
 		 */
-		if (flags & MS_INVALIDATE) {
+		if (flags & (MS_INVALIDATE | MS_INVALCURPROC)) {
 			if ((pp = page_lookup(vp, off, SE_SHARED)) != NULL) {
 				if (pp->p_lckcnt != 0 || pp->p_cowcnt != 0) {
 					page_unlock(pp);
diff --git a/usr/src/uts/common/vm/vm_as.c b/usr/src/uts/common/vm/vm_as.c
index 853b092e6d..ec6d2b8920 100644
--- a/usr/src/uts/common/vm/vm_as.c
+++ b/usr/src/uts/common/vm/vm_as.c
@@ -58,6 +58,7 @@
 #include <sys/debug.h>
 #include <sys/tnf_probe.h>
 #include <sys/vtrace.h>
+#include <sys/ddi.h>
 
 #include <vm/hat.h>
 #include <vm/as.h>
@@ -72,6 +73,8 @@
 
 clock_t deadlk_wait = 1; /* number of ticks to wait before retrying */
 
+ulong_t as_user_seg_limit = 0xffff; /* max segments in an (non-kas) AS */
+
 static struct kmem_cache *as_cache;
 
 static void as_setwatchprot(struct as *, caddr_t, size_t, uint_t);
@@ -853,8 +856,6 @@ as_fault(struct hat *hat, struct as *as, caddr_t addr, size_t size,
 	int as_lock_held;
 	klwp_t *lwp = ttolwp(curthread);
 
-
-
 retry:
 	/*
 	 * Indicate that the lwp is not to be stopped while waiting for a
@@ -1724,6 +1725,20 @@ as_map_locked(struct as *as, caddr_t addr, size_t size, segcreate_func_t crfp,
 			    p->p_rctls, p, RCA_UNSAFE_ALL);
 			return (ENOMEM);
 		}
+
+		/*
+		 * Keep the number of segments in a userspace AS constrained to
+		 * a reasonable limit.  Linux enforces a value slightly less
+		 * than 64k in order to avoid ELF limits if/when a process
+		 * dumps core.  While SunOS avoids that specific problem with
+		 * other tricks, the limit is still valuable to keep kernel
+		 * memory consumption in check.
+		 */
+		if (avl_numnodes(&as->a_segtree) >= as_user_seg_limit) {
+			AS_LOCK_EXIT(as);
+			atomic_inc_32(&p->p_zone->zone_mfseglim);
+			return (ENOMEM);
+		}
 	}
 
 	if (AS_MAP_CHECK_VNODE_LPOOB(crfp, argsp)) {
diff --git a/usr/src/uts/common/vm/vm_page.c b/usr/src/uts/common/vm/vm_page.c
index 78d1cb1a58..abccf82057 100644
--- a/usr/src/uts/common/vm/vm_page.c
+++ b/usr/src/uts/common/vm/vm_page.c
@@ -22,6 +22,7 @@
  * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2015, Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
  * Copyright (c) 2015, 2016 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989  AT&T	*/
@@ -440,10 +441,26 @@ init_pages_pp_maximum()
 	}
 }
 
+/*
+ * In the past, we limited the maximum pages that could be gotten to essentially
+ * 1/2 of the total pages on the system. However, this is too conservative for
+ * some cases. For example, if we want to host a large virtual machine which
+ * needs to use a significant portion of the system's memory. In practice,
+ * allowing more than 1/2 of the total pages is fine, but becomes problematic
+ * as we approach or exceed 75% of the pages on the system. Thus, we limit the
+ * maximum to 23/32 of the total pages, which is ~72%.
+ */
 void
 set_max_page_get(pgcnt_t target_total_pages)
 {
-	max_page_get = target_total_pages / 2;
+	max_page_get = (target_total_pages >> 5) * 23;
+	ASSERT3U(max_page_get, >, 0);
+}
+
+pgcnt_t
+get_max_page_get()
+{
+	return (max_page_get);
 }
 
 static pgcnt_t pending_delete;
@@ -1460,6 +1477,8 @@ page_create_throttle(pgcnt_t npages, int flags)
 	uint_t	i;
 	pgcnt_t tf;	/* effective value of throttlefree */
 
+	atomic_inc_64(&n_throttle);
+
 	/*
 	 * Normal priority allocations.
 	 */
@@ -1492,7 +1511,7 @@ page_create_throttle(pgcnt_t npages, int flags)
 	tf = throttlefree -
 	    ((flags & PG_PUSHPAGE) ? pageout_reserve : 0);
 
-	cv_signal(&proc_pageout->p_cv);
+	WAKE_PAGEOUT_SCANNER();
 
 	for (;;) {
 		fm = 0;
@@ -1579,7 +1598,7 @@ checkagain:
 	}
 
 	ASSERT(proc_pageout != NULL);
-	cv_signal(&proc_pageout->p_cv);
+	WAKE_PAGEOUT_SCANNER();
 
 	TRACE_2(TR_FAC_VM, TR_PAGE_CREATE_SLEEP_START,
 	    "page_create_sleep_start: freemem %ld needfree %ld",
@@ -2226,7 +2245,7 @@ page_create_va_large(vnode_t *vp, u_offset_t off, size_t bytes, uint_t flags,
 	if (nscan < desscan && freemem < minfree) {
 		TRACE_1(TR_FAC_VM, TR_PAGEOUT_CV_SIGNAL,
 		    "pageout_cv_signal:freemem %ld", freemem);
-		cv_signal(&proc_pageout->p_cv);
+		WAKE_PAGEOUT_SCANNER();
 	}
 
 	pp = rootpp;
@@ -2355,7 +2374,7 @@ page_create_va(vnode_t *vp, u_offset_t off, size_t bytes, uint_t flags,
 	if (nscan < desscan && freemem < minfree) {
 		TRACE_1(TR_FAC_VM, TR_PAGEOUT_CV_SIGNAL,
 		    "pageout_cv_signal:freemem %ld", freemem);
-		cv_signal(&proc_pageout->p_cv);
+		WAKE_PAGEOUT_SCANNER();
 	}
 
 	/*
diff --git a/usr/src/uts/common/vm/vm_pvn.c b/usr/src/uts/common/vm/vm_pvn.c
index 1b8d12eb8d..a206320a30 100644
--- a/usr/src/uts/common/vm/vm_pvn.c
+++ b/usr/src/uts/common/vm/vm_pvn.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  */
 
@@ -432,7 +433,14 @@ pvn_write_done(page_t *plist, int flags)
 				page_io_unlock(pp);
 				page_unlock(pp);
 			}
-		} else if (flags & B_INVAL) {
+		} else if ((flags & (B_INVAL | B_INVALCURONLY)) == B_INVAL) {
+			/*
+			 * If B_INVALCURONLY is set, then we handle that case
+			 * in the next conditional if hat_page_is_mapped()
+			 * indicates that there are no additional mappings
+			 * to the page.
+			 */
+
 			/*
 			 * XXX - Failed writes with B_INVAL set are
 			 * not handled appropriately.
@@ -573,8 +581,9 @@ pvn_write_done(page_t *plist, int flags)
 }
 
 /*
- * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED, B_DELWRI,
- * B_TRUNC, B_FORCE}.  B_DELWRI indicates that this page is part of a kluster
+ * Flags are composed of {B_ASYNC, B_INVAL, B_INVALCURONLY, B_FREE,
+ * B_DONTNEED, B_DELWRI, B_TRUNC, B_FORCE}.
+ * B_DELWRI indicates that this page is part of a kluster
  * operation and is only to be considered if it doesn't involve any
  * waiting here.  B_TRUNC indicates that the file is being truncated
  * and so no i/o needs to be done. B_FORCE indicates that the page
@@ -628,13 +637,17 @@ pvn_getdirty(page_t *pp, int flags)
 	 * If we want to free or invalidate the page then
 	 * we need to unload it so that anyone who wants
 	 * it will have to take a minor fault to get it.
+	 * If we are only invalidating the page for the
+	 * current process, then pass in a different flag.
 	 * Otherwise, we're just writing the page back so we
 	 * need to sync up the hardwre and software mod bit to
 	 * detect any future modifications.  We clear the
 	 * software mod bit when we put the page on the dirty
 	 * list.
 	 */
-	if (flags & (B_INVAL | B_FREE)) {
+	if (flags & B_INVALCURONLY) {
+		(void) hat_pageunload(pp, HAT_CURPROC_PGUNLOAD);
+	} else if (flags & (B_INVAL | B_FREE)) {
 		(void) hat_pageunload(pp, HAT_FORCE_PGUNLOAD);
 	} else {
 		(void) hat_pagesync(pp, HAT_SYNC_ZERORM);
@@ -646,7 +659,7 @@ pvn_getdirty(page_t *pp, int flags)
 		 * list after all.
 		 */
 		page_io_unlock(pp);
-		if (flags & B_INVAL) {
+		if ((flags & (B_INVAL | B_INVALCURONLY)) == B_INVAL) {
 			/*LINTED: constant in conditional context*/
 			VN_DISPOSE(pp, B_INVAL, 0, kcred);
 		} else if (flags & B_FREE) {
@@ -658,6 +671,9 @@ pvn_getdirty(page_t *pp, int flags)
 			 * of VOP_PUTPAGE() who prefer freeing the
 			 * page _only_ if no one else is accessing it.
 			 * E.g. segmap_release()
+			 * We also take this path for B_INVALCURONLY and
+			 * let page_release call VN_DISPOSE if no one else is
+			 * using the page.
 			 *
 			 * The above hat_ismod() check is useless because:
 			 * (1) we may not be holding SE_EXCL lock;
@@ -682,7 +698,7 @@ pvn_getdirty(page_t *pp, int flags)
 	 * We'll detect the fact that they used it when the
 	 * i/o is done and avoid freeing the page.
 	 */
-	if (flags & B_FREE)
+	if (flags & (B_FREE | B_INVALCURONLY))
 		page_downgrade(pp);
 
 
diff --git a/usr/src/uts/common/vm/vm_usage.c b/usr/src/uts/common/vm/vm_usage.c
index e542e8e479..01c2666e91 100644
--- a/usr/src/uts/common/vm/vm_usage.c
+++ b/usr/src/uts/common/vm/vm_usage.c
@@ -25,6 +25,10 @@
  */
 
 /*
+ * Copyright 2018, Joyent, Inc.
+ */
+
+/*
  * vm_usage
  *
  * This file implements the getvmusage() private system call.
@@ -114,7 +118,7 @@
  *	For accurate counting of map-shared and COW-shared pages.
  *
  *    - visited private anons (refcnt > 1) for each collective.
- *	(entity->vme_anon_hash)
+ *	(entity->vme_anon)
  *	For accurate counting of COW-shared pages.
  *
  * The common accounting structure is the vmu_entity_t, which represents
@@ -152,6 +156,7 @@
 #include <sys/vm_usage.h>
 #include <sys/zone.h>
 #include <sys/sunddi.h>
+#include <sys/sysmacros.h>
 #include <sys/avl.h>
 #include <vm/anon.h>
 #include <vm/as.h>
@@ -199,6 +204,14 @@ typedef struct vmu_object {
 } vmu_object_t;
 
 /*
+ * Node for tree of visited COW anons.
+ */
+typedef struct vmu_anon {
+	avl_node_t vma_node;
+	uintptr_t vma_addr;
+} vmu_anon_t;
+
+/*
  * Entity by which to count results.
  *
  * The entity structure keeps the current rss/swap counts for each entity
@@ -221,7 +234,7 @@ typedef struct vmu_entity {
 	struct vmu_entity *vme_next_calc;
 	mod_hash_t	*vme_vnode_hash; /* vnodes visited for entity */
 	mod_hash_t	*vme_amp_hash;	 /* shared amps visited for entity */
-	mod_hash_t	*vme_anon_hash;	 /* COW anons visited for entity */
+	avl_tree_t	vme_anon;	 /* COW anons visited for entity */
 	vmusage_t	vme_result;	 /* identifies entity and results */
 } vmu_entity_t;
 
@@ -324,6 +337,23 @@ bounds_cmp(const void *bnd1, const void *bnd2)
 }
 
 /*
+ * Comparison routine for our AVL tree of anon structures.
+ */
+static int
+vmu_anon_cmp(const void *lhs, const void *rhs)
+{
+	const vmu_anon_t *l = lhs, *r = rhs;
+
+	if (l->vma_addr == r->vma_addr)
+		return (0);
+
+	if (l->vma_addr < r->vma_addr)
+		return (-1);
+
+	return (1);
+}
+
+/*
  * Save a bound on the free list.
  */
 static void
@@ -363,13 +393,18 @@ static void
 vmu_free_entity(mod_hash_val_t val)
 {
 	vmu_entity_t *entity = (vmu_entity_t *)val;
+	vmu_anon_t *anon;
+	void *cookie = NULL;
 
 	if (entity->vme_vnode_hash != NULL)
 		i_mod_hash_clear_nosync(entity->vme_vnode_hash);
 	if (entity->vme_amp_hash != NULL)
 		i_mod_hash_clear_nosync(entity->vme_amp_hash);
-	if (entity->vme_anon_hash != NULL)
-		i_mod_hash_clear_nosync(entity->vme_anon_hash);
+
+	while ((anon = avl_destroy_nodes(&entity->vme_anon, &cookie)) != NULL)
+		kmem_free(anon, sizeof (vmu_anon_t));
+
+	avl_destroy(&entity->vme_anon);
 
 	entity->vme_next = vmu_data.vmu_free_entities;
 	vmu_data.vmu_free_entities = entity;
@@ -485,10 +520,10 @@ vmu_alloc_entity(id_t id, int type, id_t zoneid)
 		    "vmusage amp hash", VMUSAGE_HASH_SIZE, vmu_free_object,
 		    sizeof (struct anon_map));
 
-	if (entity->vme_anon_hash == NULL)
-		entity->vme_anon_hash = mod_hash_create_ptrhash(
-		    "vmusage anon hash", VMUSAGE_HASH_SIZE,
-		    mod_hash_null_valdtor, sizeof (struct anon));
+	VERIFY(avl_first(&entity->vme_anon) == NULL);
+
+	avl_create(&entity->vme_anon, vmu_anon_cmp, sizeof (struct vmu_anon),
+	    offsetof(struct vmu_anon, vma_node));
 
 	entity->vme_next = vmu_data.vmu_entities;
 	vmu_data.vmu_entities = entity;
@@ -518,7 +553,8 @@ vmu_alloc_zone(id_t id)
 
 	zone->vmz_id = id;
 
-	if ((vmu_data.vmu_calc_flags & (VMUSAGE_ZONE | VMUSAGE_ALL_ZONES)) != 0)
+	if ((vmu_data.vmu_calc_flags &
+	    (VMUSAGE_ZONE | VMUSAGE_ALL_ZONES | VMUSAGE_A_ZONE)) != 0)
 		zone->vmz_zone = vmu_alloc_entity(id, VMUSAGE_ZONE, id);
 
 	if ((vmu_data.vmu_calc_flags & (VMUSAGE_PROJECTS |
@@ -613,21 +649,19 @@ vmu_find_insert_object(mod_hash_t *hash, caddr_t key, uint_t type)
 }
 
 static int
-vmu_find_insert_anon(mod_hash_t *hash, caddr_t key)
+vmu_find_insert_anon(vmu_entity_t *entity, void *key)
 {
-	int ret;
-	caddr_t val;
+	vmu_anon_t anon, *ap;
 
-	ret = i_mod_hash_find_nosync(hash, (mod_hash_key_t)key,
-	    (mod_hash_val_t *)&val);
+	anon.vma_addr = (uintptr_t)key;
 
-	if (ret == 0)
+	if (avl_find(&entity->vme_anon, &anon, NULL) != NULL)
 		return (0);
 
-	ret = i_mod_hash_insert_nosync(hash, (mod_hash_key_t)key,
-	    (mod_hash_val_t)key, (mod_hash_hndl_t)0);
+	ap = kmem_alloc(sizeof (vmu_anon_t), KM_SLEEP);
+	ap->vma_addr = (uintptr_t)key;
 
-	ASSERT(ret == 0);
+	avl_add(&entity->vme_anon, ap);
 
 	return (1);
 }
@@ -918,6 +952,8 @@ vmu_amp_update_incore_bounds(avl_tree_t *tree, struct anon_map *amp,
 			next = AVL_NEXT(tree, next);
 			continue;
 		}
+
+		ASSERT(next->vmb_type == VMUSAGE_BOUND_UNKNOWN);
 		bound_type = next->vmb_type;
 		index = next->vmb_start;
 		while (index <= next->vmb_end) {
@@ -937,7 +973,10 @@ vmu_amp_update_incore_bounds(avl_tree_t *tree, struct anon_map *amp,
 
 			if (ap != NULL && vn != NULL && vn->v_pages != NULL &&
 			    (page = page_exists(vn, off)) != NULL) {
-				page_type = VMUSAGE_BOUND_INCORE;
+				if (PP_ISFREE(page))
+					page_type = VMUSAGE_BOUND_NOT_INCORE;
+				else
+					page_type = VMUSAGE_BOUND_INCORE;
 				if (page->p_szc > 0) {
 					pgcnt = page_get_pagecnt(page->p_szc);
 					pgshft = page_get_shift(page->p_szc);
@@ -947,8 +986,10 @@ vmu_amp_update_incore_bounds(avl_tree_t *tree, struct anon_map *amp,
 			} else {
 				page_type = VMUSAGE_BOUND_NOT_INCORE;
 			}
+
 			if (bound_type == VMUSAGE_BOUND_UNKNOWN) {
 				next->vmb_type = page_type;
+				bound_type = page_type;
 			} else if (next->vmb_type != page_type) {
 				/*
 				 * If current bound type does not match page
@@ -1009,6 +1050,7 @@ vmu_vnode_update_incore_bounds(avl_tree_t *tree, vnode_t *vnode,
 			continue;
 		}
 
+		ASSERT(next->vmb_type == VMUSAGE_BOUND_UNKNOWN);
 		bound_type = next->vmb_type;
 		index = next->vmb_start;
 		while (index <= next->vmb_end) {
@@ -1024,7 +1066,10 @@ vmu_vnode_update_incore_bounds(avl_tree_t *tree, vnode_t *vnode,
 
 			if (vnode->v_pages != NULL &&
 			    (page = page_exists(vnode, ptob(index))) != NULL) {
-				page_type = VMUSAGE_BOUND_INCORE;
+				if (PP_ISFREE(page))
+					page_type = VMUSAGE_BOUND_NOT_INCORE;
+				else
+					page_type = VMUSAGE_BOUND_INCORE;
 				if (page->p_szc > 0) {
 					pgcnt = page_get_pagecnt(page->p_szc);
 					pgshft = page_get_shift(page->p_szc);
@@ -1034,8 +1079,10 @@ vmu_vnode_update_incore_bounds(avl_tree_t *tree, vnode_t *vnode,
 			} else {
 				page_type = VMUSAGE_BOUND_NOT_INCORE;
 			}
+
 			if (bound_type == VMUSAGE_BOUND_UNKNOWN) {
 				next->vmb_type = page_type;
+				bound_type = page_type;
 			} else if (next->vmb_type != page_type) {
 				/*
 				 * If current bound type does not match page
@@ -1304,6 +1351,12 @@ vmu_calculate_seg(vmu_entity_t *vmu_entities, struct seg *seg)
 			}
 
 			/*
+			 * Pages on the free list aren't counted for the rss.
+			 */
+			if (PP_ISFREE(page))
+				continue;
+
+			/*
 			 * Assume anon structs with a refcnt
 			 * of 1 are not COW shared, so there
 			 * is no reason to track them per entity.
@@ -1320,8 +1373,7 @@ vmu_calculate_seg(vmu_entity_t *vmu_entities, struct seg *seg)
 				 * Track COW anons per entity so
 				 * they are not double counted.
 				 */
-				if (vmu_find_insert_anon(entity->vme_anon_hash,
-				    (caddr_t)ap) == 0)
+				if (vmu_find_insert_anon(entity, ap) == 0)
 					continue;
 
 				result->vmu_rss_all += (pgcnt << PAGESHIFT);
@@ -1461,8 +1513,9 @@ vmu_calculate_proc(proc_t *p)
 		entities = tmp;
 	}
 	if (vmu_data.vmu_calc_flags &
-	    (VMUSAGE_ZONE | VMUSAGE_ALL_ZONES | VMUSAGE_PROJECTS |
-	    VMUSAGE_ALL_PROJECTS | VMUSAGE_TASKS | VMUSAGE_ALL_TASKS |
+	    (VMUSAGE_ZONE | VMUSAGE_ALL_ZONES | VMUSAGE_A_ZONE |
+	    VMUSAGE_PROJECTS | VMUSAGE_ALL_PROJECTS |
+	    VMUSAGE_TASKS | VMUSAGE_ALL_TASKS |
 	    VMUSAGE_RUSERS | VMUSAGE_ALL_RUSERS | VMUSAGE_EUSERS |
 	    VMUSAGE_ALL_EUSERS)) {
 		ret = i_mod_hash_find_nosync(vmu_data.vmu_zones_hash,
@@ -1595,8 +1648,7 @@ vmu_free_extra()
 			mod_hash_destroy_hash(te->vme_vnode_hash);
 		if (te->vme_amp_hash != NULL)
 			mod_hash_destroy_hash(te->vme_amp_hash);
-		if (te->vme_anon_hash != NULL)
-			mod_hash_destroy_hash(te->vme_anon_hash);
+		VERIFY(avl_first(&te->vme_anon) == NULL);
 		kmem_free(te, sizeof (vmu_entity_t));
 	}
 	while (vmu_data.vmu_free_zones != NULL) {
@@ -1617,13 +1669,42 @@ vmu_free_extra()
 
 extern kcondvar_t *pr_pid_cv;
 
+static void
+vmu_get_zone_rss(zoneid_t zid)
+{
+	vmu_zone_t *zone;
+	zone_t *zp;
+	int ret;
+	uint_t pgcnt;
+
+	if ((zp = zone_find_by_id(zid)) == NULL)
+		return;
+
+	ret = i_mod_hash_find_nosync(vmu_data.vmu_zones_hash,
+	    (mod_hash_key_t)(uintptr_t)zid, (mod_hash_val_t *)&zone);
+	if (ret != 0) {
+		zone = vmu_alloc_zone(zid);
+		ret = i_mod_hash_insert_nosync(vmu_data.vmu_zones_hash,
+		    (mod_hash_key_t)(uintptr_t)zid,
+		    (mod_hash_val_t)zone, (mod_hash_hndl_t)0);
+		ASSERT(ret == 0);
+	}
+
+	ASSERT(zid >= 0 && zid <= MAX_ZONEID);
+	pgcnt = zone_pdata[zid].zpers_pg_cnt;
+	zone->vmz_zone->vme_result.vmu_rss_all = (size_t)ptob(pgcnt);
+	zone->vmz_zone->vme_result.vmu_swap_all = zp->zone_max_swap;
+
+	zone_rele(zp);
+}
+
 /*
  * Determine which entity types are relevant and allocate the hashes to
- * track them.  Then walk the process table and count rss and swap
- * for each process'es address space.  Address space object such as
- * vnodes, amps and anons are tracked per entity, so that they are
- * not double counted in the results.
- *
+ * track them.  First get the zone rss using the data we already have. Then,
+ * if necessary, walk the process table and count rss and swap for each
+ * process'es address space.  Address space object such as vnodes, amps and
+ * anons are tracked per entity, so that they are not double counted in the
+ * results.
  */
 static void
 vmu_calculate()
@@ -1631,6 +1712,7 @@ vmu_calculate()
 	int i = 0;
 	int ret;
 	proc_t *p;
+	uint_t	zone_flags = 0;
 
 	vmu_clear_calc();
 
@@ -1638,9 +1720,34 @@ vmu_calculate()
 		vmu_data.vmu_system = vmu_alloc_entity(0, VMUSAGE_SYSTEM,
 		    ALL_ZONES);
 
+	zone_flags = vmu_data.vmu_calc_flags & VMUSAGE_ZONE_FLAGS;
+	if (zone_flags != 0) {
+		/*
+		 * Use the accurate zone RSS data we already keep track of.
+		 */
+		int i;
+
+		for (i = 0; i <= MAX_ZONEID; i++) {
+			if (zone_pdata[i].zpers_pg_cnt > 0) {
+				vmu_get_zone_rss(i);
+			}
+		}
+	}
+
+	/* If only neeeded zone data, we're done. */
+	if ((vmu_data.vmu_calc_flags & ~VMUSAGE_ZONE_FLAGS) == 0) {
+		return;
+	}
+
+	DTRACE_PROBE(vmu__calculate__all);
+	vmu_data.vmu_calc_flags &= ~VMUSAGE_ZONE_FLAGS;
+
 	/*
 	 * Walk process table and calculate rss of each proc.
 	 *
+	 * Since we already obtained all zone rss above, the following loop
+	 * executes with the VMUSAGE_ZONE_FLAGS cleared.
+	 *
 	 * Pidlock and p_lock cannot be held while doing the rss calculation.
 	 * This is because:
 	 *	1.  The calculation allocates using KM_SLEEP.
@@ -1695,6 +1802,12 @@ again:
 	mutex_exit(&pidlock);
 
 	vmu_free_extra();
+
+	/*
+	 * Restore any caller-supplied zone flags we blocked during
+	 * the process-table walk.
+	 */
+	vmu_data.vmu_calc_flags |= zone_flags;
 }
 
 /*
@@ -1745,7 +1858,7 @@ vmu_cache_rele(vmu_cache_t *cache)
  */
 static int
 vmu_copyout_results(vmu_cache_t *cache, vmusage_t *buf, size_t *nres,
-    uint_t flags, int cpflg)
+    uint_t flags, id_t req_zone_id, int cpflg)
 {
 	vmusage_t *result, *out_result;
 	vmusage_t dummy;
@@ -1764,7 +1877,7 @@ vmu_copyout_results(vmu_cache_t *cache, vmusage_t *buf, size_t *nres,
 	/* figure out what results the caller is interested in. */
 	if ((flags & VMUSAGE_SYSTEM) && curproc->p_zone == global_zone)
 		types |= VMUSAGE_SYSTEM;
-	if (flags & (VMUSAGE_ZONE | VMUSAGE_ALL_ZONES))
+	if (flags & (VMUSAGE_ZONE | VMUSAGE_ALL_ZONES | VMUSAGE_A_ZONE))
 		types |= VMUSAGE_ZONE;
 	if (flags & (VMUSAGE_PROJECTS | VMUSAGE_ALL_PROJECTS |
 	    VMUSAGE_COL_PROJECTS))
@@ -1827,26 +1940,33 @@ vmu_copyout_results(vmu_cache_t *cache, vmusage_t *buf, size_t *nres,
 				continue;
 		}
 
-		/* Skip "other zone" results if not requested */
-		if (result->vmu_zoneid != curproc->p_zone->zone_id) {
-			if (result->vmu_type == VMUSAGE_ZONE &&
-			    (flags & VMUSAGE_ALL_ZONES) == 0)
-				continue;
-			if (result->vmu_type == VMUSAGE_PROJECTS &&
-			    (flags & (VMUSAGE_ALL_PROJECTS |
-			    VMUSAGE_COL_PROJECTS)) == 0)
-				continue;
-			if (result->vmu_type == VMUSAGE_TASKS &&
-			    (flags & VMUSAGE_ALL_TASKS) == 0)
-				continue;
-			if (result->vmu_type == VMUSAGE_RUSERS &&
-			    (flags & (VMUSAGE_ALL_RUSERS |
-			    VMUSAGE_COL_RUSERS)) == 0)
-				continue;
-			if (result->vmu_type == VMUSAGE_EUSERS &&
-			    (flags & (VMUSAGE_ALL_EUSERS |
-			    VMUSAGE_COL_EUSERS)) == 0)
+		if (result->vmu_type == VMUSAGE_ZONE &&
+		    flags & VMUSAGE_A_ZONE) {
+			/* Skip non-requested zone results */
+			if (result->vmu_zoneid != req_zone_id)
 				continue;
+		} else {
+			/* Skip "other zone" results if not requested */
+			if (result->vmu_zoneid != curproc->p_zone->zone_id) {
+				if (result->vmu_type == VMUSAGE_ZONE &&
+				    (flags & VMUSAGE_ALL_ZONES) == 0)
+					continue;
+				if (result->vmu_type == VMUSAGE_PROJECTS &&
+				    (flags & (VMUSAGE_ALL_PROJECTS |
+				    VMUSAGE_COL_PROJECTS)) == 0)
+					continue;
+				if (result->vmu_type == VMUSAGE_TASKS &&
+				    (flags & VMUSAGE_ALL_TASKS) == 0)
+					continue;
+				if (result->vmu_type == VMUSAGE_RUSERS &&
+				    (flags & (VMUSAGE_ALL_RUSERS |
+				    VMUSAGE_COL_RUSERS)) == 0)
+					continue;
+				if (result->vmu_type == VMUSAGE_EUSERS &&
+				    (flags & (VMUSAGE_ALL_EUSERS |
+				    VMUSAGE_COL_EUSERS)) == 0)
+					continue;
+			}
 		}
 		count++;
 		if (out_result != NULL) {
@@ -1902,10 +2022,12 @@ vm_getusage(uint_t flags, time_t age, vmusage_t *buf, size_t *nres, int cpflg)
 	int cacherecent = 0;
 	hrtime_t now;
 	uint_t flags_orig;
+	id_t req_zone_id;
 
 	/*
 	 * Non-global zones cannot request system wide and/or collated
-	 * results, or the system result, so munge the flags accordingly.
+	 * results, or the system result, or usage of another zone, so munge
+	 * the flags accordingly.
 	 */
 	flags_orig = flags;
 	if (curproc->p_zone != global_zone) {
@@ -1925,6 +2047,10 @@ vm_getusage(uint_t flags, time_t age, vmusage_t *buf, size_t *nres, int cpflg)
 			flags &= ~VMUSAGE_SYSTEM;
 			flags |= VMUSAGE_ZONE;
 		}
+		if (flags & VMUSAGE_A_ZONE) {
+			flags &= ~VMUSAGE_A_ZONE;
+			flags |= VMUSAGE_ZONE;
+		}
 	}
 
 	/* Check for unknown flags */
@@ -1935,6 +2061,21 @@ vm_getusage(uint_t flags, time_t age, vmusage_t *buf, size_t *nres, int cpflg)
 	if ((flags & VMUSAGE_MASK) == 0)
 		return (set_errno(EINVAL));
 
+	/* If requesting results for a specific zone, get the zone ID */
+	if (flags & VMUSAGE_A_ZONE) {
+		size_t bufsize;
+		vmusage_t zreq;
+
+		if (ddi_copyin((caddr_t)nres, &bufsize, sizeof (size_t), cpflg))
+			return (set_errno(EFAULT));
+		/* Requested zone ID is passed in buf, so 0 len not allowed */
+		if (bufsize == 0)
+			return (set_errno(EINVAL));
+		if (ddi_copyin((caddr_t)buf, &zreq, sizeof (vmusage_t), cpflg))
+			return (set_errno(EFAULT));
+		req_zone_id = zreq.vmu_id;
+	}
+
 	mutex_enter(&vmu_data.vmu_lock);
 	now = gethrtime();
 
@@ -1954,7 +2095,7 @@ start:
 			mutex_exit(&vmu_data.vmu_lock);
 
 			ret = vmu_copyout_results(cache, buf, nres, flags_orig,
-			    cpflg);
+			    req_zone_id, cpflg);
 			mutex_enter(&vmu_data.vmu_lock);
 			vmu_cache_rele(cache);
 			if (vmu_data.vmu_pending_waiters > 0)
@@ -2011,7 +2152,8 @@ start:
 		mutex_exit(&vmu_data.vmu_lock);
 
 		/* copy cache */
-		ret = vmu_copyout_results(cache, buf, nres, flags_orig, cpflg);
+		ret = vmu_copyout_results(cache, buf, nres, flags_orig,
+		    req_zone_id, cpflg);
 		mutex_enter(&vmu_data.vmu_lock);
 		vmu_cache_rele(cache);
 		mutex_exit(&vmu_data.vmu_lock);
diff --git a/usr/src/uts/i86pc/Makefile.files b/usr/src/uts/i86pc/Makefile.files
index b63d059c06..2a94505acb 100644
--- a/usr/src/uts/i86pc/Makefile.files
+++ b/usr/src/uts/i86pc/Makefile.files
@@ -68,6 +68,7 @@ CORE_OBJS +=			\
 	hment.o			\
 	hold_page.o		\
 	hrtimers.o		\
+	ht.o			\
 	htable.o		\
 	hypercall.o		\
 	hypersubr.o		\
@@ -99,6 +100,7 @@ CORE_OBJS +=			\
 	memscrub.o		\
 	mpcore.o		\
 	notes.o			\
+	pc_hvm.o		\
 	pci_bios.o		\
 	pci_cfgacc.o		\
 	pci_cfgacc_x86.o	\
@@ -111,6 +113,7 @@ CORE_OBJS +=			\
 	pmem.o			\
 	ppage.o			\
 	pwrnow.o		\
+	seg_vmm.o		\
 	speedstep.o		\
 	ssp.o			\
 	startup.o		\
@@ -236,6 +239,45 @@ UPPC_OBJS += uppc.o psm_common.o
 XSVC_OBJS += xsvc.o
 AMD_IOMMU_OBJS +=	amd_iommu.o amd_iommu_impl.o amd_iommu_acpi.o \
 			amd_iommu_cmd.o amd_iommu_log.o amd_iommu_page_tables.o
+VMM_OBJS += vmm.o \
+	vmm_sol_dev.o \
+	vmm_host.o \
+	vmm_instruction_emul.o \
+	vmm_ioport.o \
+	vmm_lapic.o \
+	vmm_mem.o \
+	vmm_stat.o \
+	vmm_util.o \
+	x86.o \
+	iommu.o \
+	vdev.o \
+	vatpic.o \
+	vatpit.o \
+	vhpet.o \
+	vioapic.o \
+	vlapic.o \
+	vrtc.o \
+	vpmtmr.o \
+	ept.o \
+	vmcs.o \
+	vmx_msr.o \
+	vmx.o \
+	vmx_support.o \
+	vtd.o \
+	vtd_sol.o \
+	svm.o \
+	svm_msr.o \
+	npt.o \
+	vmcb.o \
+	svm_support.o \
+	amdv.o \
+	vmm_sol_vm.o \
+	vmm_sol_glue.o \
+	vmm_zsd.o
+
+VIONA_OBJS += viona.o
+
+PPT_OBJS += ppt.o
 
 #
 #	Build up defines and paths.
@@ -252,7 +294,7 @@ INC_PATH	+= -I$(UTSBASE)/i86xpv -I$(UTSBASE)/common/xen
 # since only C headers are included when #defined(__lint) is true.
 #
 
-ASSYM_DEPS      += 		\
+ASSYM_DEPS      +=		\
 	copy.o			\
 	desctbls_asm.o		\
 	ddi_i86_asm.o		\
diff --git a/usr/src/uts/i86pc/Makefile.i86pc b/usr/src/uts/i86pc/Makefile.i86pc
index 02fbe7ce70..02d03c2373 100644
--- a/usr/src/uts/i86pc/Makefile.i86pc
+++ b/usr/src/uts/i86pc/Makefile.i86pc
@@ -24,6 +24,7 @@
 #
 # Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright (c) 2013 Andrew Stormont.  All rights reserved.
+# Copyright 2017 Joyent, Inc.
 #
 #
 #	This makefile contains the common definitions for the i86pc unix
@@ -264,6 +265,9 @@ DRV_KMODS	+= amd_iommu
 DRV_KMODS	+= dr
 DRV_KMODS	+= ioat
 DRV_KMODS	+= fipe
+DRV_KMODS	+= vmm
+DRV_KMODS	+= viona
+DRV_KMODS	+= ppt
 
 DRV_KMODS	+= cpudrv
 
diff --git a/usr/src/uts/i86pc/Makefile.rules b/usr/src/uts/i86pc/Makefile.rules
index 030978fda8..ea723f01be 100644
--- a/usr/src/uts/i86pc/Makefile.rules
+++ b/usr/src/uts/i86pc/Makefile.rules
@@ -22,6 +22,7 @@
 #
 # Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2015 Igor Kozhukhov <ikozhukhov@gmail.com>
+# Copyright 2017 Joyent, Inc.
 #
 
 #	This Makefile defines the build rules for the directory uts/i86pc
@@ -215,6 +216,32 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/dboot/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/io/vmm/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/io/vmm/amd/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/io/vmm/intel/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/io/vmm/io/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/io/vmm/intel/%.s
+	$(COMPILE.s) -o $@ $<
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/io/vmm/amd/%.s
+	$(COMPILE.s) -o $@ $<
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/i86pc/io/viona/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 #
 # dboot stuff is always 32 bit, linked to run with phys_addr == virt_addr
 #
@@ -325,7 +352,8 @@ $(OBJS_DIR)/%.o:		$(SRC)/common/atomic/$(ATOMIC_SUBDIR)/%.s
 #
 
 $(OBJS_DIR)/dtracestubs.s:	$(UNIX_O) $(LIBS)
-	$(NM) -u $(UNIX_O) $(LIBS) | $(GREP) __dtrace_probe_ | $(SORT) | \
+	$(NM) -u $(UNIX_O) $(LIBS) | \
+	$(EGREP) '(__dtrace_probe_|smap_(disable|enable))' | $(SORT) | \
 	    $(UNIQ) | $(AWK) '{ \
 	    printf("\t.globl %s\n\t.type %s,@function\n%s:\n", \
 	    $$1, $$1, $$1); }' > $(OBJS_DIR)/dtracestubs.s
@@ -462,6 +490,24 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/i86pc/io/xsvc/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/xen/os/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/i86pc/io/vmm/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/i86pc/io/vmm/amd/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/i86pc/io/vmm/intel/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/i86pc/io/vmm/io/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/i86pc/io/vmm/intel/%.s
+	@($(LHEAD) $(LINT.s) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/i86pc/io/viona/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 #
 # bios call has a funky name change while building
 #
diff --git a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu.h b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu.h
index 4034fced9d..50e62c2303 100644
--- a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu.h
+++ b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef _GCPU_H
@@ -181,6 +182,8 @@ typedef struct gcpu_mce_status {
  * Flags for gcpu_mca_flags
  */
 #define	GCPU_MCA_F_UNFAULTING		0x1	/* CPU exiting faulted state */
+#define	GCPU_MCA_F_CMCI_CAPABLE		0x2	/* CPU supports CMCI */
+#define	GCPU_MCA_F_CMCI_ENABLE		0x4	/* CPU CMCI enabled */
 
 /*
  * State shared by all cpus on a chip
@@ -190,6 +193,7 @@ struct gcpu_chipshared {
 	kmutex_t gcpus_poll_lock;	/* serialize pollers on the same chip */
 	uint32_t gcpus_actv_banks;	/* MCA bank numbers active on chip */
 	volatile uint32_t gcpus_actv_cnt; /* active cpu count in this chip */
+	char *gcpus_ident;		/* ident string, if available */
 };
 
 struct gcpu_data {
@@ -212,7 +216,8 @@ extern void gcpu_post_mpstartup(cmi_hdl_t);
 extern void gcpu_faulted_enter(cmi_hdl_t);
 extern void gcpu_faulted_exit(cmi_hdl_t);
 extern void gcpu_mca_init(cmi_hdl_t);
-extern void gcpu_mca_fini(cmi_hdl_t hdl);
+extern void gcpu_mca_fini(cmi_hdl_t);
+extern void gcpu_mca_cmci_enable(cmi_hdl_t);
 extern cmi_errno_t gcpu_msrinject(cmi_hdl_t, cmi_mca_regs_t *, uint_t, int);
 #ifndef __xpv
 extern uint64_t gcpu_mca_trap(cmi_hdl_t, struct regs *);
@@ -223,11 +228,6 @@ extern void gcpu_xpv_panic_callback(void);
 #endif
 
 /*
- * CMI global variable
- */
-extern int cmi_enable_cmci;
-
-/*
  * Local functions
  */
 extern void gcpu_mca_poll_init(cmi_hdl_t);
diff --git a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_main.c b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_main.c
index 761d942f27..18462971fb 100644
--- a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_main.c
+++ b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_main.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 /*
  * Copyright (c) 2010, Intel Corporation.
@@ -42,6 +43,7 @@
 #include <sys/kmem.h>
 #include <sys/modctl.h>
 #include <sys/pghw.h>
+#include <sys/x86_archext.h>
 
 #include "gcpu.h"
 
@@ -52,6 +54,115 @@ int gcpu_disable = 0;
 
 #define	GCPU_MAX_CHIPID		32
 static struct gcpu_chipshared *gcpu_shared[GCPU_MAX_CHIPID];
+#ifdef	DEBUG
+int gcpu_id_disable = 0;
+static const char *gcpu_id_override[GCPU_MAX_CHIPID] = { NULL };
+#endif
+
+#ifndef	__xpv
+/*
+ * This should probably be delegated to a CPU specific module. However, as those
+ * haven't been developed as actively for recent CPUs, we should revisit this
+ * when we do have it and move this out of gcpu.
+ *
+ * This method is only supported on Intel Xeon platforms. It relies on a
+ * combination of the PPIN and the cpuid signature. Both are required to form
+ * the synthetic ID. This ID is preceded with iv0-INTC to represent that this is
+ * an Intel synthetic ID. The iv0 is the illumos version zero of the ID for
+ * Intel. If we have a new scheme for a new generation of processors, then that
+ * should rev the version field, otherwise for a given processor, this synthetic
+ * ID should not change. For more information on PPIN and these MSRS, see the
+ * relevant processor external design specification.
+ */
+static char *
+gcpu_init_ident_intc(cmi_hdl_t hdl)
+{
+	uint64_t msr;
+
+	/*
+	 * This list should be extended as new Intel Xeon family processors come
+	 * out.
+	 */
+	switch (cmi_hdl_model(hdl)) {
+	case INTC_MODEL_IVYBRIDGE_XEON:
+	case INTC_MODEL_HASWELL_XEON:
+	case INTC_MODEL_BROADWELL_XEON:
+	case INTC_MODEL_BROADWELL_XEON_D:
+	case INTC_MODEL_SKYLAKE_XEON:
+		break;
+	default:
+		return (NULL);
+	}
+
+	if (cmi_hdl_rdmsr(hdl, MSR_PLATFORM_INFO, &msr) != CMI_SUCCESS) {
+		return (NULL);
+	}
+
+	if ((msr & MSR_PLATFORM_INFO_PPIN) == 0) {
+		return (NULL);
+	}
+
+	if (cmi_hdl_rdmsr(hdl, MSR_PPIN_CTL, &msr) != CMI_SUCCESS) {
+		return (NULL);
+	}
+
+	if ((msr & MSR_PPIN_CTL_ENABLED) == 0) {
+		if ((msr & MSR_PPIN_CTL_LOCKED) != 0) {
+			return (NULL);
+		}
+
+		if (cmi_hdl_wrmsr(hdl, MSR_PPIN_CTL, MSR_PPIN_CTL_ENABLED) !=
+		    CMI_SUCCESS) {
+			return (NULL);
+		}
+	}
+
+	if (cmi_hdl_rdmsr(hdl, MSR_PPIN, &msr) != CMI_SUCCESS) {
+		return (NULL);
+	}
+
+	/*
+	 * Now that we've read data, lock the PPIN. Don't worry about success or
+	 * failure of this part, as we will have gotten everything that we need.
+	 * It is possible that it locked open, for example.
+	 */
+	(void) cmi_hdl_wrmsr(hdl, MSR_PPIN_CTL, MSR_PPIN_CTL_LOCKED);
+
+	return (kmem_asprintf("iv0-INTC-%x-%llx", cmi_hdl_chipsig(hdl), msr));
+}
+#endif	/* __xpv */
+
+static void
+gcpu_init_ident(cmi_hdl_t hdl, struct gcpu_chipshared *sp)
+{
+#ifdef	DEBUG
+	uint_t chipid;
+
+	/*
+	 * On debug, allow a developer to override the string to more
+	 * easily test CPU autoreplace without needing to physically
+	 * replace a CPU.
+	 */
+	if (gcpu_id_disable != 0) {
+		return;
+	}
+
+	chipid = cmi_hdl_chipid(hdl);
+	if (gcpu_id_override[chipid] != NULL) {
+		sp->gcpus_ident = strdup(gcpu_id_override[chipid]);
+		return;
+	}
+#endif
+
+#ifndef __xpv
+	switch (cmi_hdl_vendor(hdl)) {
+	case X86_VENDOR_Intel:
+		sp->gcpus_ident = gcpu_init_ident_intc(hdl);
+	default:
+		break;
+	}
+#endif	/* __xpv */
+}
 
 /*
  * Our cmi_init entry point, called during startup of each cpu instance.
@@ -90,6 +201,8 @@ gcpu_init(cmi_hdl_t hdl, void **datap)
 			mutex_destroy(&sp->gcpus_poll_lock);
 			kmem_free(sp, sizeof (struct gcpu_chipshared));
 			sp = osp;
+		} else {
+			gcpu_init_ident(hdl, sp);
 		}
 	}
 
@@ -145,6 +258,15 @@ gcpu_post_startup(cmi_hdl_t hdl)
 	 * be run on cpu 0 so we can assure that by starting from here.
 	 */
 	gcpu_mca_poll_start(hdl);
+#else
+	/*
+	 * The boot CPU has a bit of a chicken and egg problem for CMCI. Its MCA
+	 * initialization is run before we have initialized the PSM module that
+	 * we would use for enabling CMCI. Therefore, we use this as a chance to
+	 * enable CMCI for the boot CPU. For all other CPUs, this chicken and
+	 * egg problem will have already been solved.
+	 */
+	gcpu_mca_cmci_enable(hdl);
 #endif
 }
 
@@ -165,6 +287,26 @@ gcpu_post_mpstartup(cmi_hdl_t hdl)
 #endif
 }
 
+const char *
+gcpu_ident(cmi_hdl_t hdl)
+{
+	uint_t chipid;
+	struct gcpu_chipshared *sp;
+
+	if (gcpu_disable)
+		return (NULL);
+
+	chipid = cmi_hdl_chipid(hdl);
+	if (chipid >= GCPU_MAX_CHIPID)
+		return (NULL);
+
+	if (cmi_hdl_getcmidata(hdl) == NULL)
+		return (NULL);
+
+	sp = gcpu_shared[cmi_hdl_chipid(hdl)];
+	return (sp->gcpus_ident);
+}
+
 #ifdef __xpv
 #define	GCPU_OP(ntvop, xpvop)	xpvop
 #else
@@ -186,6 +328,7 @@ const cmi_ops_t _cmi_ops = {
 	GCPU_OP(gcpu_hdl_poke, NULL),		/* cmi_hdl_poke */
 	gcpu_fini,				/* cmi_fini */
 	GCPU_OP(NULL, gcpu_xpv_panic_callback),	/* cmi_panic_callback */
+	gcpu_ident				/* cmi_ident */
 };
 
 static struct modlcpu modlcpu = {
diff --git a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_mca.c b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_mca.c
index 1b9e259bd8..348ec93761 100644
--- a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_mca.c
+++ b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_mca.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 /*
  * Copyright (c) 2010, Intel Corporation.
@@ -49,6 +50,7 @@
 #include <sys/fm/smb/fmsmb.h>
 #include <sys/sysevent.h>
 #include <sys/ontrap.h>
+#include <sys/smp_impldefs.h>
 
 #include "gcpu.h"
 
@@ -82,6 +84,12 @@ int gcpu_mca_telemetry_retries = 5;
 #ifndef __xpv
 int gcpu_mca_cmci_throttling_threshold = 10;
 int gcpu_mca_cmci_reenable_threshold = 1000;
+
+/*
+ * This is used to determine whether or not we have registered the CMCI CPU
+ * setup function. This is protected by cpu_lock.
+ */
+static boolean_t gcpu_mca_cpu_registered = B_FALSE;
 #endif
 
 static gcpu_error_disp_t gcpu_errtypes[] = {
@@ -1031,6 +1039,83 @@ gcpu_errorq_init(size_t datasz)
 
 static uint_t global_nbanks;
 
+#ifndef __xpv
+/*ARGSUSED*/
+int
+gcpu_cmci_cpu_setup(cpu_setup_t what, int cpuid, void *arg)
+{
+	/*
+	 * In general, we'd expect that in a multi-socket configuration, either
+	 * all CPUs would support CMCI or none of them would.  Unfortunately,
+	 * that may not be the case in the wild.  While we'd rather check the
+	 * handle's enablement state here, that itself is a bit complicated. We
+	 * don't have a guarantee in a heterogenous situation that the CPU in
+	 * question is using the generic CPU module or not, even though we've
+	 * been registered. As such, we allow the interrupt to be registered and
+	 * written to the local apic anyways. We won't have a CMCI interrupt
+	 * generated anyways because the MCA banks will not be programmed as
+	 * such for that CPU by the polling thread.
+	 */
+	switch (what) {
+	case CPU_ON:
+		psm_cmci_setup(cpuid, B_TRUE);
+		break;
+	case CPU_OFF:
+		psm_cmci_setup(cpuid, B_FALSE);
+		break;
+	default:
+		break;
+	}
+
+	return (0);
+}
+
+void
+gcpu_mca_cmci_enable(cmi_hdl_t hdl)
+{
+	gcpu_data_t *gcpu = cmi_hdl_getcmidata(hdl);
+	gcpu_mca_t *mca = &gcpu->gcpu_mca;
+
+	/*
+	 * If this CPU doesn't support CMCI, don't do anything.
+	 */
+	if ((mca->gcpu_mca_flags & GCPU_MCA_F_CMCI_CAPABLE) == 0)
+		return;
+
+	/*
+	 * If we don't have support from the PSM module, then there's nothing we
+	 * can do. Note that this changes as we start up the system. The only
+	 * case where it may be mistakenly NULL is for the boot CPU. The boot
+	 * CPU will have this taken care of for it in gcpu_post_startup(), once
+	 * we know for certain whether or not the PSM module supports CMCI.
+	 */
+	if (psm_cmci_setup == NULL) {
+		return;
+	}
+
+	mca->gcpu_mca_flags |= GCPU_MCA_F_CMCI_ENABLE;
+	if (MUTEX_HELD(&cpu_lock)) {
+		if (!gcpu_mca_cpu_registered) {
+			register_cpu_setup_func(gcpu_cmci_cpu_setup, NULL);
+			gcpu_mca_cpu_registered = B_TRUE;
+		}
+	} else {
+		mutex_enter(&cpu_lock);
+		if (!gcpu_mca_cpu_registered) {
+			register_cpu_setup_func(gcpu_cmci_cpu_setup, NULL);
+			gcpu_mca_cpu_registered = B_TRUE;
+		}
+		mutex_exit(&cpu_lock);
+	}
+
+	/*
+	 * Call the PSM op to make sure that we initialize things on
+	 * this CPU.
+	 */
+	psm_cmci_setup(cmi_hdl_logical_id(hdl), B_TRUE);
+}
+#endif	/* !__xpv */
+
 void
 gcpu_mca_init(cmi_hdl_t hdl)
 {
@@ -1257,8 +1342,10 @@ gcpu_mca_init(cmi_hdl_t hdl)
 	}
 
 #ifndef __xpv
-	if (cmci_capable)
-		cmi_enable_cmci = 1;
+	if (cmci_capable) {
+		mca->gcpu_mca_flags |= GCPU_MCA_F_CMCI_CAPABLE;
+		gcpu_mca_cmci_enable(hdl);
+	}
 #endif
 
 #ifndef __xpv
diff --git a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_poll_ntv.c b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_poll_ntv.c
index 361d147b56..55cf607aac 100644
--- a/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_poll_ntv.c
+++ b/usr/src/uts/i86pc/cpu/generic_cpu/gcpu_poll_ntv.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 /*
  * Copyright (c) 2010, Intel Corporation.
@@ -94,7 +95,8 @@ gcpu_ntv_mca_poll(cmi_hdl_t hdl, int what)
 	ASSERT(MUTEX_HELD(&gcpu->gcpu_shared->gcpus_poll_lock));
 
 	/* Enable CMCI in first poll if is supported */
-	if (cmi_enable_cmci && (!mca->gcpu_mca_first_poll_cmci_enabled)) {
+	if ((mca->gcpu_mca_flags & GCPU_MCA_F_CMCI_ENABLE) != 0 &&
+	    (!mca->gcpu_mca_first_poll_cmci_enabled)) {
 		int i;
 		uint64_t ctl2;
 
diff --git a/usr/src/uts/i86pc/dboot/dboot_startkern.c b/usr/src/uts/i86pc/dboot/dboot_startkern.c
index 73c8a9fc0f..b9c4bc9051 100644
--- a/usr/src/uts/i86pc/dboot/dboot_startkern.c
+++ b/usr/src/uts/i86pc/dboot/dboot_startkern.c
@@ -23,7 +23,7 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright 2013 Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.  All rights reserved.
  */
 
 
@@ -68,6 +68,15 @@ extern int have_cpuid(void);
 #define	SHA1_ASCII_LENGTH	(SHA1_DIGEST_LENGTH * 2)
 
 /*
+ * Region of memory that may be corrupted by external actors.  This can go away
+ * once the firmware bug RICHMOND-16 is fixed and all systems with the bug are
+ * upgraded.
+ */
+#define	CORRUPT_REGION_START	0xc700000
+#define	CORRUPT_REGION_SIZE	0x100000
+#define	CORRUPT_REGION_END	(CORRUPT_REGION_START + CORRUPT_REGION_SIZE)
+
+/*
  * This file contains code that runs to transition us from either a multiboot
  * compliant loader (32 bit non-paging) or a XPV domain loader to
  * regular kernel execution. Its task is to setup the kernel memory image
@@ -1484,6 +1493,38 @@ dboot_process_mmap(void)
 			case 1:
 				if (end > max_mem)
 					max_mem = end;
+
+				/*
+				 * Well, this is sad.  One some systems, there
+				 * is a region of memory that can be corrupted
+				 * until some number of seconds after we have
+				 * booted.  And the BIOS doesn't tell us that
+				 * this memory is unsafe to use.  And we don't
+				 * know how long it's dangerous.  So we'll
+				 * chop out this range from any memory list
+				 * that would otherwise be usable.  Note that
+				 * any system of this type will give us the
+				 * new-style (0x40) memlist, so we need not
+				 * fix up the other path below.
+				 */
+				if (start < CORRUPT_REGION_START &&
+				    end > CORRUPT_REGION_START) {
+					memlists[memlists_used].addr = start;
+					memlists[memlists_used].size =
+					    CORRUPT_REGION_START - start;
+					++memlists_used;
+					if (end > CORRUPT_REGION_END)
+						start = CORRUPT_REGION_END;
+					else
+						continue;
+				}
+				if (start >= CORRUPT_REGION_START &&
+				    start < CORRUPT_REGION_END) {
+					if (end <= CORRUPT_REGION_END)
+						continue;
+					start = CORRUPT_REGION_END;
+				}
+
 				memlists[memlists_used].addr = start;
 				memlists[memlists_used].size = end - start;
 				++memlists_used;
@@ -2273,11 +2314,7 @@ startup_kernel(void)
 	 * Need correct target_kernel_text value
 	 */
 #if defined(_BOOT_TARGET_amd64)
-	target_kernel_text = KERNEL_TEXT_amd64;
-#elif defined(__xpv)
-	target_kernel_text = KERNEL_TEXT_i386_xpv;
-#else
-	target_kernel_text = KERNEL_TEXT_i386;
+	target_kernel_text = KERNEL_TEXT;
 #endif
 	DBG(target_kernel_text);
 
diff --git a/usr/src/uts/i86pc/io/apix/apix.c b/usr/src/uts/i86pc/io/apix/apix.c
index d02ffe8096..33ade10c44 100644
--- a/usr/src/uts/i86pc/io/apix/apix.c
+++ b/usr/src/uts/i86pc/io/apix/apix.c
@@ -25,9 +25,7 @@
 /*
  * Copyright (c) 2010, Intel Corporation.
  * All rights reserved.
- */
-/*
- * Copyright (c) 2017, Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -167,6 +165,10 @@ static struct	psm_ops apix_ops = {
 	apix_intr_ops,		/* Advanced DDI Interrupt framework */
 	apic_state,		/* save, restore apic state for S3 */
 	apic_cpu_ops,		/* CPU control interface. */
+
+	apic_get_pir_ipivect,
+	apic_send_pir_ipi,
+	apic_cmci_setup
 };
 
 struct psm_ops *psmops = &apix_ops;
@@ -354,7 +356,7 @@ apix_get_intr_handler(int cpu, short vec)
 	apix_vector_t *apix_vector;
 
 	ASSERT(cpu < apic_nproc && vec < APIX_NVECTOR);
-	if (cpu >= apic_nproc)
+	if (cpu >= apic_nproc || vec >= APIX_NVECTOR)
 		return (NULL);
 
 	apix_vector = apixs[cpu]->x_vectbl[vec];
@@ -384,6 +386,8 @@ apix_init()
 		apic_have_32bit_cr8 = 1;
 #endif
 
+	apic_pir_vect = apix_get_ipivect(XC_CPUPOKE_PIL, -1);
+
 	/*
 	 * Initialize IRM pool parameters
 	 */
@@ -543,27 +547,18 @@ apix_init_intr()
 		apic_reg_ops->apic_write(APIC_ERROR_STATUS, 0);
 	}
 
-	/* Enable CMCI interrupt */
-	if (cmi_enable_cmci) {
-		mutex_enter(&cmci_cpu_setup_lock);
-		if (cmci_cpu_setup_registered == 0) {
-			mutex_enter(&cpu_lock);
-			register_cpu_setup_func(cmci_cpu_setup, NULL);
-			mutex_exit(&cpu_lock);
-			cmci_cpu_setup_registered = 1;
-		}
-		mutex_exit(&cmci_cpu_setup_lock);
-
-		if (apic_cmci_vect == 0) {
-			int ipl = 0x2;
-			apic_cmci_vect = apix_get_ipivect(ipl, -1);
-			ASSERT(apic_cmci_vect);
+	/*
+	 * Ensure a CMCI interrupt is allocated, regardless of whether it is
+	 * enabled or not.
+	 */
+	if (apic_cmci_vect == 0) {
+		const int ipl = 0x2;
+		apic_cmci_vect = apix_get_ipivect(ipl, -1);
+		ASSERT(apic_cmci_vect);
 
-			(void) add_avintr(NULL, ipl,
-			    (avfunc)cmi_cmci_trap, "apic cmci intr",
-			    apic_cmci_vect, NULL, NULL, NULL, NULL);
-		}
-		apic_reg_ops->apic_write(APIC_CMCI_VECT, apic_cmci_vect);
+		(void) add_avintr(NULL, ipl,
+		    (avfunc)cmi_cmci_trap, "apic cmci intr",
+		    apic_cmci_vect, NULL, NULL, NULL, NULL);
 	}
 
 	apic_reg_ops->apic_write_task_reg(0);
@@ -1127,9 +1122,11 @@ x2apic_update_psm()
 	 * being apix_foo as opposed to apic_foo and x2apic_foo.
 	 */
 	pops->psm_send_ipi = x2apic_send_ipi;
-
 	send_dirintf = pops->psm_send_ipi;
 
+	pops->psm_send_pir_ipi = x2apic_send_pir_ipi;
+	psm_send_pir_ipi = pops->psm_send_pir_ipi;
+
 	apic_mode = LOCAL_X2APIC;
 	apic_change_ops();
 }
@@ -2588,6 +2585,8 @@ apic_switch_ipi_callback(boolean_t enter)
 		if (apic_poweron_cnt == 0) {
 			pops->psm_send_ipi = apic_common_send_ipi;
 			send_dirintf = pops->psm_send_ipi;
+			pops->psm_send_pir_ipi = apic_common_send_pir_ipi;
+			psm_send_pir_ipi = pops->psm_send_pir_ipi;
 		}
 		apic_poweron_cnt++;
 	} else {
@@ -2596,6 +2595,8 @@ apic_switch_ipi_callback(boolean_t enter)
 		if (apic_poweron_cnt == 0) {
 			pops->psm_send_ipi = x2apic_send_ipi;
 			send_dirintf = pops->psm_send_ipi;
+			pops->psm_send_pir_ipi = x2apic_send_pir_ipi;
+			psm_send_pir_ipi = pops->psm_send_pir_ipi;
 		}
 	}
 	lock_clear(&apic_mode_switch_lock);
diff --git a/usr/src/uts/i86pc/io/apix/apix_intr.c b/usr/src/uts/i86pc/io/apix/apix_intr.c
index 227ce0c991..59d8787839 100644
--- a/usr/src/uts/i86pc/io/apix/apix_intr.c
+++ b/usr/src/uts/i86pc/io/apix/apix_intr.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2018 Western Digital Corporation.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/cpuvar.h>
@@ -68,6 +69,7 @@
 #include <vm/hat_i86.h>
 #include <sys/stack.h>
 #include <sys/apix.h>
+#include <sys/ht.h>
 
 static void apix_post_hardint(int);
 
@@ -280,6 +282,7 @@ apix_do_softint_prolog(struct cpu *cpu, uint_t pil, uint_t oldpil,
 
 	it->t_intr = t;
 	cpu->cpu_thread = it;
+	ht_begin_intr(pil);
 
 	/*
 	 * Set bit for this pil in CPU's interrupt active bitmask.
@@ -350,7 +353,9 @@ apix_do_softint_epilog(struct cpu *cpu, uint_t oldpil)
 	it->t_link = cpu->cpu_intr_thread;
 	cpu->cpu_intr_thread = it;
 	it->t_state = TS_FREE;
+	ht_end_intr();
 	cpu->cpu_thread = t;
+
 	if (t->t_flag & T_INTR_THREAD)
 		t->t_intr_start = now;
 	basespl = cpu->cpu_base_spl;
@@ -466,6 +471,8 @@ apix_hilevel_intr_prolog(struct cpu *cpu, uint_t pil, uint_t oldpil,
 		}
 	}
 
+	ht_begin_intr(pil);
+
 	/* store starting timestamp in CPu structure for this IPL */
 	mcpu->pil_high_start[pil - (LOCK_LEVEL + 1)] = now;
 
@@ -556,6 +563,8 @@ apix_hilevel_intr_epilog(struct cpu *cpu, uint_t oldpil)
 			t->t_intr_start = now;
 	}
 
+	ht_end_intr();
+
 	mcpu->mcpu_pri = oldpil;
 	if (pil < CBE_HIGH_PIL)
 		(void) (*setlvlx)(oldpil, 0);
@@ -668,6 +677,7 @@ apix_intr_thread_prolog(struct cpu *cpu, uint_t pil, caddr_t stackptr)
 	it->t_state = TS_ONPROC;
 
 	cpu->cpu_thread = it;
+	ht_begin_intr(pil);
 
 	/*
 	 * Initialize thread priority level from intr_pri
@@ -756,7 +766,9 @@ apix_intr_thread_epilog(struct cpu *cpu, uint_t oldpil)
 	cpu->cpu_intr_thread = it;
 	it->t_state = TS_FREE;
 
+	ht_end_intr();
 	cpu->cpu_thread = t;
+
 	if (t->t_flag & T_INTR_THREAD)
 		t->t_intr_start = now;
 	basespl = cpu->cpu_base_spl;
diff --git a/usr/src/uts/i86pc/io/apix/apix_regops.c b/usr/src/uts/i86pc/io/apix/apix_regops.c
index 1432b66a81..3c28e829ab 100644
--- a/usr/src/uts/i86pc/io/apix/apix_regops.c
+++ b/usr/src/uts/i86pc/io/apix/apix_regops.c
@@ -25,13 +25,14 @@
 /*
  * Copyright 2014 Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
  * Copyright (c) 2014 by Delphix. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/cpuvar.h>
 #include <sys/psm.h>
 #include <sys/archsystm.h>
 #include <sys/apic.h>
+#include <sys/apic_common.h>
 #include <sys/sunddi.h>
 #include <sys/ddi_impldefs.h>
 #include <sys/mach_intr.h>
@@ -218,6 +219,34 @@ x2apic_send_ipi(int cpun, int ipl)
 	intr_restore(flag);
 }
 
+void
+x2apic_send_pir_ipi(processorid_t cpun)
+{
+	const int vector = apic_pir_vect;
+	ulong_t flag;
+
+	ASSERT(apic_mode == LOCAL_X2APIC);
+	ASSERT((vector >= APIC_BASE_VECT) && (vector <= APIC_SPUR_INTR));
+
+	/* Serialize as described in x2apic_send_ipi() above. */
+	atomic_or_ulong(&flag, 1);
+
+	flag = intr_clear();
+
+	/* Self-IPI for inducing PIR makes no sense. */
+	if ((cpun != psm_get_cpu_id())) {
+#ifdef	DEBUG
+		/* Only for debugging. (again, see: x2apic_send_ipi) */
+		APIC_AV_PENDING_SET();
+#endif	/* DEBUG */
+
+		apic_reg_ops->apic_write_int_cmd(apic_cpus[cpun].aci_local_id,
+		    vector);
+	}
+
+	intr_restore(flag);
+}
+
 /*
  * Generates IPI to another CPU depending on the local APIC mode.
  * apic_send_ipi() and x2apic_send_ipi() depends on the configured
@@ -250,3 +279,16 @@ apic_common_send_ipi(int cpun, int ipl)
 	    vector);
 	intr_restore(flag);
 }
+
+void
+apic_common_send_pir_ipi(processorid_t cpun)
+{
+	const int mode = apic_local_mode();
+
+	if (mode == LOCAL_X2APIC) {
+		x2apic_send_pir_ipi(cpun);
+		return;
+	}
+
+	apic_send_pir_ipi(cpun);
+}
diff --git a/usr/src/uts/i86pc/io/mp_platform_common.c b/usr/src/uts/i86pc/io/mp_platform_common.c
index accb951d51..241171bd8e 100644
--- a/usr/src/uts/i86pc/io/mp_platform_common.c
+++ b/usr/src/uts/i86pc/io/mp_platform_common.c
@@ -21,6 +21,7 @@
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2016 Nexenta Systems, Inc.
+ * Copyright 2017 Joyent, Inc.
  * Copyright (c) 2017 by Delphix. All rights reserved.
  * Copyright 2017 Joyent, Inc.
  */
diff --git a/usr/src/uts/i86pc/io/pcplusmp/apic.c b/usr/src/uts/i86pc/io/pcplusmp/apic.c
index e63544087a..0649afa3f3 100644
--- a/usr/src/uts/i86pc/io/pcplusmp/apic.c
+++ b/usr/src/uts/i86pc/io/pcplusmp/apic.c
@@ -25,9 +25,7 @@
 /*
  * Copyright (c) 2010, Intel Corporation.
  * All rights reserved.
- */
-/*
- * Copyright (c) 2017, Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -202,6 +200,10 @@ static struct	psm_ops apic_ops = {
 	apic_intr_ops,			/* Advanced DDI Interrupt framework */
 	apic_state,			/* save, restore apic state for S3 */
 	apic_cpu_ops,			/* CPU control interface. */
+
+	apic_get_pir_ipivect,
+	apic_send_pir_ipi,
+	apic_cmci_setup,
 };
 
 struct psm_ops *psmops = &apic_ops;
@@ -298,6 +300,8 @@ apic_init(void)
 		apic_ipltopri[j] = (i << APIC_IPL_SHIFT) + APIC_BASE_VECT;
 	apic_init_common();
 
+	apic_pir_vect = apic_get_ipivect(XC_CPUPOKE_PIL, -1);
+
 #if !defined(__amd64)
 	if (cpuid_have_cr8access(CPU))
 		apic_have_32bit_cr8 = 1;
@@ -425,31 +429,21 @@ apic_init_intr(void)
 		apic_reg_ops->apic_write(APIC_ERROR_STATUS, 0);
 	}
 
-	/* Enable CMCI interrupt */
-	if (cmi_enable_cmci) {
-
-		mutex_enter(&cmci_cpu_setup_lock);
-		if (cmci_cpu_setup_registered == 0) {
-			mutex_enter(&cpu_lock);
-			register_cpu_setup_func(cmci_cpu_setup, NULL);
-			mutex_exit(&cpu_lock);
-			cmci_cpu_setup_registered = 1;
-		}
-		mutex_exit(&cmci_cpu_setup_lock);
-
-		if (apic_cmci_vect == 0) {
-			int ipl = 0x2;
-			int irq = apic_get_ipivect(ipl, -1);
+	/*
+	 * Ensure a CMCI interrupt is allocated, regardless of whether it is
+	 * enabled or not.
+	 */
+	if (apic_cmci_vect == 0) {
+		const int ipl = 0x2;
+		int irq = apic_get_ipivect(ipl, -1);
 
-			ASSERT(irq != -1);
-			apic_cmci_vect = apic_irq_table[irq]->airq_vector;
-			ASSERT(apic_cmci_vect);
+		ASSERT(irq != -1);
+		apic_cmci_vect = apic_irq_table[irq]->airq_vector;
+		ASSERT(apic_cmci_vect);
 
-			(void) add_avintr(NULL, ipl,
-			    (avfunc)cmi_cmci_trap,
-			    "apic cmci intr", irq, NULL, NULL, NULL, NULL);
-		}
-		apic_reg_ops->apic_write(APIC_CMCI_VECT, apic_cmci_vect);
+		(void) add_avintr(NULL, ipl,
+		    (avfunc)cmi_cmci_trap,
+		    "apic cmci intr", irq, NULL, NULL, NULL, NULL);
 	}
 }
 
diff --git a/usr/src/uts/i86pc/io/pcplusmp/apic_common.c b/usr/src/uts/i86pc/io/pcplusmp/apic_common.c
index f5f5fcfe1a..b57f978f3b 100644
--- a/usr/src/uts/i86pc/io/pcplusmp/apic_common.c
+++ b/usr/src/uts/i86pc/io/pcplusmp/apic_common.c
@@ -23,7 +23,7 @@
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  */
 /*
- * Copyright (c) 2017, Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  * Copyright (c) 2016, 2017 by Delphix. All rights reserved.
  */
 
@@ -122,14 +122,12 @@ int apic_enable_cpcovf_intr = 1;
 
 /* vector at which CMCI interrupts come in */
 int apic_cmci_vect;
-extern int cmi_enable_cmci;
 extern void cmi_cmci_trap(void);
 
-kmutex_t cmci_cpu_setup_lock;	/* protects cmci_cpu_setup_registered */
-int cmci_cpu_setup_registered;
-
 lock_t apic_mode_switch_lock;
 
+int apic_pir_vect;
+
 /*
  * Patchable global variables.
  */
@@ -380,30 +378,20 @@ apic_cmci_disable(xc_arg_t arg1, xc_arg_t arg2, xc_arg_t arg3)
 	return (0);
 }
 
-/*ARGSUSED*/
-int
-cmci_cpu_setup(cpu_setup_t what, int cpuid, void *arg)
+void
+apic_cmci_setup(processorid_t cpuid, boolean_t enable)
 {
 	cpuset_t	cpu_set;
 
 	CPUSET_ONLY(cpu_set, cpuid);
 
-	switch (what) {
-		case CPU_ON:
-			xc_call(NULL, NULL, NULL, CPUSET2BV(cpu_set),
-			    (xc_func_t)apic_cmci_enable);
-			break;
-
-		case CPU_OFF:
-			xc_call(NULL, NULL, NULL, CPUSET2BV(cpu_set),
-			    (xc_func_t)apic_cmci_disable);
-			break;
-
-		default:
-			break;
+	if (enable) {
+		xc_call(NULL, NULL, NULL, CPUSET2BV(cpu_set),
+		    (xc_func_t)apic_cmci_enable);
+	} else {
+		xc_call(NULL, NULL, NULL, CPUSET2BV(cpu_set),
+		    (xc_func_t)apic_cmci_disable);
 	}
-
-	return (0);
 }
 
 static void
@@ -629,6 +617,31 @@ apic_send_ipi(int cpun, int ipl)
 	intr_restore(flag);
 }
 
+void
+apic_send_pir_ipi(processorid_t cpun)
+{
+	const int vector = apic_pir_vect;
+	ulong_t flag;
+
+	ASSERT((vector >= APIC_BASE_VECT) && (vector <= APIC_SPUR_INTR));
+
+	flag = intr_clear();
+
+	/* Self-IPI for inducing PIR makes no sense. */
+	if ((cpun != psm_get_cpu_id())) {
+		APIC_AV_PENDING_SET();
+		apic_reg_ops->apic_write_int_cmd(apic_cpus[cpun].aci_local_id,
+		    vector);
+	}
+
+	intr_restore(flag);
+}
+
+int
+apic_get_pir_ipivect(void)
+{
+	return (apic_pir_vect);
+}
 
 /*ARGSUSED*/
 void
@@ -1648,6 +1661,7 @@ apic_check_msi_support()
 	dev_info_t *cdip;
 	char dev_type[16];
 	int dev_len;
+	int hwenv = get_hwenv();
 
 	DDI_INTR_IMPLDBG((CE_CONT, "apic_check_msi_support:\n"));
 
@@ -1669,7 +1683,8 @@ apic_check_msi_support()
 			continue;
 		if (strcmp(dev_type, "pciex") == 0)
 			return (PSM_SUCCESS);
-		if (strcmp(dev_type, "pci") == 0 && get_hwenv() == HW_KVM)
+		if (strcmp(dev_type, "pci") == 0 &&
+		    (hwenv == HW_KVM || hwenv == HW_BHYVE))
 			return (PSM_SUCCESS);
 	}
 
diff --git a/usr/src/uts/i86pc/io/psm/psm_common.c b/usr/src/uts/i86pc/io/psm/psm_common.c
index b59d87bdcc..623c6e5617 100644
--- a/usr/src/uts/i86pc/io/psm/psm_common.c
+++ b/usr/src/uts/i86pc/io/psm/psm_common.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016, Joyent, Inc.
  */
 
 #include <sys/types.h>
diff --git a/usr/src/uts/i86pc/io/psm/uppc.c b/usr/src/uts/i86pc/io/psm/uppc.c
index adfd5079a1..23ed56a11b 100644
--- a/usr/src/uts/i86pc/io/psm/uppc.c
+++ b/usr/src/uts/i86pc/io/psm/uppc.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #define	PSMI_1_7
@@ -174,7 +175,11 @@ static struct	psm_ops uppc_ops = {
 	    psm_intr_op_t, int *))NULL,		/* psm_intr_ops		*/
 
 	uppc_state,				/* psm_state		*/
-	(int (*)(psm_cpu_request_t *))NULL	/* psm_cpu_ops		*/
+	(int (*)(psm_cpu_request_t *))NULL,	/* psm_cpu_ops		*/
+
+	(int (*)(void))NULL,			/* psm_get_pir_ipivect	*/
+	(void (*)(processorid_t))NULL,		/* psm_send_pir_ipi	*/
+	(void (*)(processorid_t, boolean_t))NULL	/* psm_cmci_setup */
 };
 
 
diff --git a/usr/src/uts/i86pc/io/viona/viona.c b/usr/src/uts/i86pc/io/viona/viona.c
new file mode 100644
index 0000000000..3c52457a0b
--- /dev/null
+++ b/usr/src/uts/i86pc/io/viona/viona.c
@@ -0,0 +1,2466 @@
+/*
+ * Copyright (c) 2013  Chris Torek <torek @ torek net>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * viona - VirtIO-Net, Accelerated
+ *
+ * The purpose of viona is to provide high performance virtio-net devices to
+ * bhyve guests.  It does so by sitting directly atop MAC, skipping all of the
+ * DLS/DLD stack.
+ *
+ * --------------------
+ * General Architecture
+ * --------------------
+ *
+ * A single viona instance is comprised of a "link" handle and two "rings".
+ * After opening the viona device, it must be associated with a MAC network
+ * interface and a bhyve (vmm) instance to form its link resource.  This is
+ * done with the VNA_IOC_CREATE ioctl, where the datalink ID and vmm fd are
+ * passed in to perform the initialization.  With the MAC client opened, and a
+ * driver handle to the vmm instance established, the device is ready to be
+ * configured by the guest.
+ *
+ * The userspace portion of bhyve, which interfaces with the PCI device
+ * emulation framework, is meant to stay out of the datapath if at all
+ * possible.  Configuration changes made via PCI are mapped to actions which
+ * will steer the operation of the in-kernel logic.
+ *
+ *
+ * -----------
+ * Ring Basics
+ * -----------
+ *
+ * Each viona link has two viona_vring_t entities, RX and TX, for handling data
+ * transfers to and from the guest.  They represent an interface to the
+ * standard virtio ring structures.  When intiailized and active, each ring is
+ * backed by a kernel worker thread (parented to the bhyve process for the
+ * instance) which handles ring events.  The RX worker has the simple task of
+ * watching for ring shutdown conditions.  The TX worker does that in addition
+ * to processing all requests to transmit data.  Data destined for the guest is
+ * delivered directly by MAC to viona_rx() when the ring is active.
+ *
+ *
+ * -----------
+ * Ring States
+ * -----------
+ *
+ * The viona_vring_t instances follow a simple path through the possible state
+ * values represented in virtio_vring_t`vr_state:
+ *
+ *        +<--------------------------------------------+
+ *        |						|
+ *        V						^
+ *  +-----------+	This is the initial state when a link is created or
+ *  | VRS_RESET |	when the ring has been explicitly reset.
+ *  +-----------+
+ *        |						^
+ *        |---* ioctl(VNA_IOC_RING_INIT) issued		|
+ *        |						|
+ *        |						^
+ *        V
+ *  +-----------+	The ring parameters (size, guest physical addresses)
+ *  | VRS_SETUP |	have been set and start-up of the ring worker thread
+ *  +-----------+	has begun.
+ *        |						^
+ *        |						|
+ *        |---* ring worker thread begins execution	|
+ *        |						|
+ *        +-------------------------------------------->+
+ *        |	      |					^
+ *        |	      |
+ *        |	      *	If ring shutdown is requested (by ioctl or impending
+ *        |		bhyve process death) while the worker thread is
+ *        |		starting, the worker will transition the ring to
+ *        |		VRS_RESET and exit.
+ *        |						^
+ *        |						|
+ *        |						^
+ *        V
+ *  +-----------+	The worker thread associated with the ring has started
+ *  | VRS_INIT  |	executing.  It has allocated any extra resources needed
+ *  +-----------+	for the ring to operate.
+ *        |						^
+ *        |						|
+ *        +-------------------------------------------->+
+ *        |	      |					^
+ *        |	      |
+ *        |	      *	If ring shutdown is requested while the worker is
+ *        |		waiting in VRS_INIT, it will free any extra resources
+ *        |		and transition to VRS_RESET.
+ *        |						^
+ *        |						|
+ *        |--* ioctl(VNA_IOC_RING_KICK) issued		|
+ *        |						^
+ *        V
+ *  +-----------+	The worker thread associated with the ring is executing
+ *  | VRS_RUN   |	workload specific to that ring.
+ *  +-----------+
+ *        |						^
+ *        |---* ioctl(VNA_IOC_RING_RESET) issued	|
+ *        |	(or bhyve process begins exit)		|
+ *        V						|
+ *        +-------------------------------------------->+
+ *
+ *
+ * While the worker thread is not running, changes to vr_state are only made by
+ * viona_ioc_ring_init() under vr_lock.  There, it initializes the ring, starts
+ * the worker, and sets the ring state to VRS_SETUP.  Once the worker thread
+ * has been started, only it may perform ring state transitions (still under
+ * the protection of vr_lock), when requested by outside consumers via
+ * vr_state_flags or when the containing bhyve process initiates an exit.
+ *
+ *
+ * ----------------------------
+ * Transmission mblk_t Handling
+ * ----------------------------
+ *
+ * For incoming frames destined for a bhyve guest, the data must first land in
+ * a host OS buffer from the physical NIC before it is copied into the awaiting
+ * guest buffer(s).  Outbound frames transmitted by the guest are not bound by
+ * this limitation and can avoid extra copying before the buffers are accessed
+ * directly by the NIC.  When a guest designates buffers to be transmitted,
+ * viona translates the guest-physical addresses contained in the ring
+ * descriptors to host-virtual addresses via vmm_dr_gpa2kva().  That pointer is
+ * wrapped in an mblk_t using a preallocated viona_desb_t for the desballoc().
+ * Doing so increments vr_xfer_outstanding, preventing the ring from being
+ * reset (allowing the link to drop its vmm handle to the guest) until all
+ * transmit mblks referencing guest memory have been processed.  Allocation of
+ * the viona_desb_t entries is done during the VRS_INIT stage of the ring
+ * worker thread.  The ring size informs that allocation as the number of
+ * concurrent transmissions is limited by the number of descriptors in the
+ * ring.  This minimizes allocation in the transmit hot-path by aqcuiring those
+ * fixed-size resources during initialization.
+ *
+ * This optimization depends on the underlying NIC driver freeing the mblks in
+ * a timely manner after they have been transmitted by the hardware.  Some
+ * drivers have been found to flush TX descriptors only when new transmissions
+ * are initiated.  This means that there is no upper bound to the time needed
+ * for an mblk to be flushed and can stall bhyve guests from shutting down
+ * since their memory must be free of viona TX references prior to clean-up.
+ *
+ * This expectation of deterministic mblk_t processing is likely the reason
+ * behind the notable exception to the zero-copy TX path: systems with 'bnxe'
+ * loaded will copy transmit data into fresh buffers rather than passing up
+ * zero-copy mblks.  It is a hold-over from the original viona sources provided
+ * by Pluribus and its continued necessity has not been confirmed.
+ *
+ *
+ * ----------------------------
+ * Ring Notification Fast-paths
+ * ----------------------------
+ *
+ * Device operation for viona requires that notifications flow to and from the
+ * guest to indicate certain ring conditions.  In order to minimize latency and
+ * processing overhead, the notification procedures are kept in-kernel whenever
+ * possible.
+ *
+ * Guest-to-host notifications, when new available descriptors have been placed
+ * in the ring, are posted via the 'queue notify' address in the virtio BAR.
+ * The vmm_drv_ioport_hook() interface was added to bhyve which allows viona to
+ * install a callback hook on an ioport address.  Guest exits for accesses to
+ * viona-hooked ioport addresses will result in direct calls to notify the
+ * appropriate ring worker without a trip to userland.
+ *
+ * Host-to-guest notifications in the form of interrupts enjoy similar
+ * acceleration.  Each viona ring can be configured to send MSI notifications
+ * to the guest as virtio conditions dictate.  This in-kernel interrupt
+ * configuration is kept synchronized through viona ioctls which are utilized
+ * during writes to the associated PCI config registers or MSI-X BAR.
+ *
+ * Guests which do not utilize MSI-X will result in viona falling back to the
+ * slow path for interrupts.  It will poll(2) the viona handle, receiving
+ * notification when ring events necessitate the assertion of an interrupt.
+ *
+ */
+
+#include <sys/conf.h>
+#include <sys/file.h>
+#include <sys/stat.h>
+#include <sys/ddi.h>
+#include <sys/disp.h>
+#include <sys/sunddi.h>
+#include <sys/sunndi.h>
+#include <sys/sysmacros.h>
+#include <sys/strsubr.h>
+#include <sys/strsun.h>
+#include <vm/seg_kmem.h>
+#include <sys/ht.h>
+
+#include <sys/pattr.h>
+#include <sys/dls.h>
+#include <sys/dlpi.h>
+#include <sys/mac_client.h>
+#include <sys/mac_provider.h>
+#include <sys/mac_client_priv.h>
+#include <sys/vlan.h>
+#include <inet/ip.h>
+
+#include <sys/vmm_drv.h>
+#include <sys/viona_io.h>
+
+/* Min. octets in an ethernet frame minus FCS */
+#define	MIN_BUF_SIZE		60
+#define	NEED_VLAN_PAD_SIZE	(MIN_BUF_SIZE - VLAN_TAGSZ)
+
+#define	VIONA_NAME		"Virtio Network Accelerator"
+#define	VIONA_CTL_MINOR		0
+#define	VIONA_CLI_NAME		"viona"		/* MAC client name */
+
+#define	VTNET_MAXSEGS		32
+
+#define	VRING_ALIGN		4096
+#define	VRING_MAX_LEN		32768
+
+#define	VRING_DESC_F_NEXT	(1 << 0)
+#define	VRING_DESC_F_WRITE	(1 << 1)
+#define	VRING_DESC_F_INDIRECT	(1 << 2)
+
+#define	VIRTIO_NET_HDR_F_NEEDS_CSUM	(1 << 0)
+#define	VIRTIO_NET_HDR_F_DATA_VALID	(1 << 1)
+
+
+#define	VRING_AVAIL_F_NO_INTERRUPT	1
+
+#define	VRING_USED_F_NO_NOTIFY		1
+
+#define	BCM_NIC_DRIVER		"bnxe"
+/*
+ * Host capabilities
+ */
+#define	VIRTIO_NET_F_CSUM	(1 <<  0)
+#define	VIRTIO_NET_F_GUEST_CSUM	(1 <<  1)
+#define	VIRTIO_NET_F_MAC	(1 <<  5) /* host supplies MAC */
+#define	VIRTIO_NET_F_MRG_RXBUF	(1 << 15) /* host can merge RX buffers */
+#define	VIRTIO_NET_F_STATUS	(1 << 16) /* config status field available */
+#define	VIRTIO_F_RING_NOTIFY_ON_EMPTY	(1 << 24)
+#define	VIRTIO_F_RING_INDIRECT_DESC	(1 << 28)
+#define	VIRTIO_F_RING_EVENT_IDX		(1 << 29)
+
+#define	VIONA_S_HOSTCAPS	(	\
+	VIRTIO_NET_F_GUEST_CSUM |	\
+	VIRTIO_NET_F_MAC |		\
+	VIRTIO_NET_F_MRG_RXBUF |	\
+	VIRTIO_NET_F_STATUS |		\
+	VIRTIO_F_RING_NOTIFY_ON_EMPTY |	\
+	VIRTIO_F_RING_INDIRECT_DESC)
+
+/* MAC_CAPAB_HCKSUM specifics of interest */
+#define	VIONA_CAP_HCKSUM_INTEREST	\
+	(HCKSUM_INET_PARTIAL |		\
+	HCKSUM_INET_FULL_V4 |		\
+	HCKSUM_INET_FULL_V6)
+
+
+#define	VIONA_PROBE(name)	DTRACE_PROBE(viona__##name)
+#define	VIONA_PROBE1(name, arg1, arg2)	\
+	DTRACE_PROBE1(viona__##name, arg1, arg2)
+#define	VIONA_PROBE2(name, arg1, arg2, arg3, arg4)	\
+	DTRACE_PROBE2(viona__##name, arg1, arg2, arg3, arg4)
+#define	VIONA_PROBE3(name, arg1, arg2, arg3, arg4, arg5, arg6)	\
+	DTRACE_PROBE3(viona__##name, arg1, arg2, arg3, arg4, arg5, arg6)
+#define	VIONA_PROBE5(name, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, \
+	arg9, arg10) \
+	DTRACE_PROBE5(viona__##name, arg1, arg2, arg3, arg4, arg5, arg6, arg7, \
+	arg8, arg9, arg10)
+#define	VIONA_PROBE_BAD_RING_ADDR(r, a)		\
+	VIONA_PROBE2(bad_ring_addr, viona_vring_t *, r, void *, (void *)(a))
+
+#define	VIONA_RING_STAT_INCR(r, name)	\
+	(((r)->vr_stats.rs_ ## name)++)
+
+#pragma pack(1)
+struct virtio_desc {
+	uint64_t	vd_addr;
+	uint32_t	vd_len;
+	uint16_t	vd_flags;
+	uint16_t	vd_next;
+};
+#pragma pack()
+
+#pragma pack(1)
+struct virtio_used {
+	uint32_t	vu_idx;
+	uint32_t	vu_tlen;
+};
+#pragma pack()
+
+#pragma pack(1)
+struct virtio_net_mrgrxhdr {
+	uint8_t		vrh_flags;
+	uint8_t		vrh_gso_type;
+	uint16_t	vrh_hdr_len;
+	uint16_t	vrh_gso_size;
+	uint16_t	vrh_csum_start;
+	uint16_t	vrh_csum_offset;
+	uint16_t	vrh_bufs;
+};
+struct virtio_net_hdr {
+	uint8_t		vrh_flags;
+	uint8_t		vrh_gso_type;
+	uint16_t	vrh_hdr_len;
+	uint16_t	vrh_gso_size;
+	uint16_t	vrh_csum_start;
+	uint16_t	vrh_csum_offset;
+};
+#pragma pack()
+
+struct viona_link;
+typedef struct viona_link viona_link_t;
+struct viona_desb;
+typedef struct viona_desb viona_desb_t;
+
+enum viona_ring_state {
+	VRS_RESET	= 0x0,	/* just allocated or reset */
+	VRS_SETUP	= 0x1,	/* addrs setup and starting worker thread */
+	VRS_INIT	= 0x2,	/* worker thread started & waiting to run */
+	VRS_RUN		= 0x3,	/* running work routine */
+};
+enum viona_ring_state_flags {
+	VRSF_REQ_START	= 0x1,	/* start running from INIT state */
+	VRSF_REQ_STOP	= 0x2,	/* stop running, clean up, goto RESET state */
+};
+
+#define	VRING_NEED_BAIL(ring, proc)					\
+		(((ring)->vr_state_flags & VRSF_REQ_STOP) != 0 ||	\
+		((proc)->p_flag & SEXITING) != 0)
+
+typedef struct viona_vring {
+	viona_link_t	*vr_link;
+
+	kmutex_t	vr_lock;
+	kcondvar_t	vr_cv;
+	uint16_t	vr_state;
+	uint16_t	vr_state_flags;
+	uint_t		vr_xfer_outstanding;
+	kthread_t	*vr_worker_thread;
+	viona_desb_t	*vr_desb;
+
+	uint_t		vr_intr_enabled;
+	uint64_t	vr_msi_addr;
+	uint64_t	vr_msi_msg;
+
+	/* Internal ring-related state */
+	kmutex_t	vr_a_mutex;	/* sync consumers of 'avail' */
+	kmutex_t	vr_u_mutex;	/* sync consumers of 'used' */
+	uint16_t	vr_size;
+	uint16_t	vr_mask;	/* cached from vr_size */
+	uint16_t	vr_cur_aidx;	/* trails behind 'avail_idx' */
+
+	/* Host-context pointers to the queue */
+	volatile struct virtio_desc	*vr_descr;
+
+	volatile uint16_t		*vr_avail_flags;
+	volatile uint16_t		*vr_avail_idx;
+	volatile uint16_t		*vr_avail_ring;
+	volatile uint16_t		*vr_avail_used_event;
+
+	volatile uint16_t		*vr_used_flags;
+	volatile uint16_t		*vr_used_idx;
+	volatile struct virtio_used	*vr_used_ring;
+	volatile uint16_t		*vr_used_avail_event;
+
+	/* Per-ring error condition statistics */
+	struct viona_ring_stats {
+		uint64_t	rs_ndesc_too_high;
+		uint64_t	rs_bad_idx;
+		uint64_t	rs_indir_bad_len;
+		uint64_t	rs_indir_bad_nest;
+		uint64_t	rs_indir_bad_next;
+		uint64_t	rs_no_space;
+		uint64_t	rs_too_many_desc;
+
+		uint64_t	rs_bad_ring_addr;
+
+		uint64_t	rs_fail_hcksum;
+		uint64_t	rs_fail_hcksum6;
+		uint64_t	rs_fail_hcksum_proto;
+
+		uint64_t	rs_bad_rx_frame;
+		uint64_t	rs_rx_merge_overrun;
+		uint64_t	rs_rx_merge_underrun;
+		uint64_t	rs_rx_pad_short;
+		uint64_t	rs_too_short;
+		uint64_t	rs_tx_absent;
+	} vr_stats;
+} viona_vring_t;
+
+struct viona_link {
+	vmm_hold_t		*l_vm_hold;
+	boolean_t		l_destroyed;
+
+	viona_vring_t		l_vrings[VIONA_VQ_MAX];
+
+	uint32_t		l_features;
+	uint32_t		l_features_hw;
+	uint32_t		l_cap_csum;
+
+	uintptr_t		l_notify_ioport;
+	void			*l_notify_cookie;
+
+	datalink_id_t		l_linkid;
+	mac_handle_t		l_mh;
+	mac_client_handle_t	l_mch;
+
+	pollhead_t		l_pollhead;
+};
+
+struct viona_desb {
+	frtn_t			d_frtn;
+	viona_vring_t		*d_ring;
+	uint_t			d_ref;
+	uint32_t		d_len;
+	uint16_t		d_cookie;
+};
+
+typedef struct viona_soft_state {
+	kmutex_t		ss_lock;
+	viona_link_t		*ss_link;
+} viona_soft_state_t;
+
+typedef struct used_elem {
+	uint16_t	id;
+	uint32_t	len;
+} used_elem_t;
+
+static void			*viona_state;
+static dev_info_t		*viona_dip;
+static id_space_t		*viona_minors;
+static mblk_t			*viona_vlan_pad_mp;
+
+/*
+ * copy tx mbufs from virtio ring to avoid necessitating a wait for packet
+ * transmission to free resources.
+ */
+static boolean_t		viona_force_copy_tx_mblks = B_FALSE;
+
+static int viona_info(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg,
+    void **result);
+static int viona_attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
+static int viona_detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
+static int viona_open(dev_t *devp, int flag, int otype, cred_t *credp);
+static int viona_close(dev_t dev, int flag, int otype, cred_t *credp);
+static int viona_ioctl(dev_t dev, int cmd, intptr_t data, int mode,
+    cred_t *credp, int *rval);
+static int viona_chpoll(dev_t dev, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp);
+
+static int viona_ioc_create(viona_soft_state_t *, void *, int, cred_t *);
+static int viona_ioc_delete(viona_soft_state_t *, boolean_t);
+
+static void *viona_gpa2kva(viona_link_t *link, uint64_t gpa, size_t len);
+
+static void viona_ring_alloc(viona_link_t *, viona_vring_t *);
+static void viona_ring_free(viona_vring_t *);
+static int viona_ring_reset(viona_vring_t *, boolean_t);
+static kthread_t *viona_create_worker(viona_vring_t *);
+
+static int viona_ioc_set_notify_ioport(viona_link_t *, uint_t);
+static int viona_ioc_ring_init(viona_link_t *, void *, int);
+static int viona_ioc_ring_reset(viona_link_t *, uint_t);
+static int viona_ioc_ring_kick(viona_link_t *, uint_t);
+static int viona_ioc_ring_set_msi(viona_link_t *, void *, int);
+static int viona_ioc_ring_intr_clear(viona_link_t *, uint_t);
+static int viona_ioc_intr_poll(viona_link_t *, void *, int, int *);
+
+static void viona_intr_ring(viona_vring_t *);
+
+static void viona_desb_release(viona_desb_t *);
+static void viona_rx(void *, mac_resource_handle_t, mblk_t *, boolean_t);
+static void viona_tx(viona_link_t *, viona_vring_t *);
+
+static struct cb_ops viona_cb_ops = {
+	viona_open,
+	viona_close,
+	nodev,
+	nodev,
+	nodev,
+	nodev,
+	nodev,
+	viona_ioctl,
+	nodev,
+	nodev,
+	nodev,
+	viona_chpoll,
+	ddi_prop_op,
+	0,
+	D_MP | D_NEW | D_HOTPLUG,
+	CB_REV,
+	nodev,
+	nodev
+};
+
+static struct dev_ops viona_ops = {
+	DEVO_REV,
+	0,
+	viona_info,
+	nulldev,
+	nulldev,
+	viona_attach,
+	viona_detach,
+	nodev,
+	&viona_cb_ops,
+	NULL,
+	ddi_power,
+	ddi_quiesce_not_needed
+};
+
+static struct modldrv modldrv = {
+	&mod_driverops,
+	VIONA_NAME,
+	&viona_ops,
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1, &modldrv, NULL
+};
+
+int
+_init(void)
+{
+	int	ret;
+
+	ret = ddi_soft_state_init(&viona_state, sizeof (viona_soft_state_t), 0);
+	if (ret != 0)
+		return (ret);
+
+	ret = mod_install(&modlinkage);
+	if (ret != 0) {
+		ddi_soft_state_fini(&viona_state);
+		return (ret);
+	}
+
+	return (ret);
+}
+
+int
+_fini(void)
+{
+	int	ret;
+
+	ret = mod_remove(&modlinkage);
+	if (ret == 0) {
+		ddi_soft_state_fini(&viona_state);
+	}
+
+	return (ret);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+static void
+set_viona_tx_mode()
+{
+	major_t bcm_nic_major;
+
+	if ((bcm_nic_major = ddi_name_to_major(BCM_NIC_DRIVER))
+	    != DDI_MAJOR_T_NONE) {
+		if (ddi_hold_installed_driver(bcm_nic_major) != NULL) {
+			viona_force_copy_tx_mblks = B_TRUE;
+			ddi_rele_driver(bcm_nic_major);
+			return;
+		}
+	}
+	viona_force_copy_tx_mblks = B_FALSE;
+}
+
+/* ARGSUSED */
+static int
+viona_info(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **result)
+{
+	int error;
+
+	switch (cmd) {
+	case DDI_INFO_DEVT2DEVINFO:
+		*result = (void *)viona_dip;
+		error = DDI_SUCCESS;
+		break;
+	case DDI_INFO_DEVT2INSTANCE:
+		*result = (void *)0;
+		error = DDI_SUCCESS;
+		break;
+	default:
+		error = DDI_FAILURE;
+		break;
+	}
+	return (error);
+}
+
+static int
+viona_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	mblk_t *mp;
+
+	if (cmd != DDI_ATTACH) {
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_create_minor_node(dip, "viona", S_IFCHR, VIONA_CTL_MINOR,
+	    DDI_PSEUDO, 0) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	viona_minors = id_space_create("viona_minors",
+	    VIONA_CTL_MINOR + 1, UINT16_MAX);
+
+	/* Create mblk for padding when VLAN tags are stripped */
+	mp = allocb_wait(VLAN_TAGSZ, BPRI_HI, STR_NOSIG, NULL);
+	bzero(mp->b_rptr, VLAN_TAGSZ);
+	mp->b_wptr += VLAN_TAGSZ;
+	viona_vlan_pad_mp = mp;
+
+	set_viona_tx_mode();
+	viona_dip = dip;
+	ddi_report_dev(viona_dip);
+
+	return (DDI_SUCCESS);
+}
+
+static int
+viona_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	mblk_t *mp;
+
+	if (cmd != DDI_DETACH) {
+		return (DDI_FAILURE);
+	}
+
+	/* Clean up the VLAN padding mblk */
+	mp = viona_vlan_pad_mp;
+	viona_vlan_pad_mp = NULL;
+	VERIFY(mp != NULL && mp->b_cont == NULL);
+	freemsg(mp);
+
+	id_space_destroy(viona_minors);
+	ddi_remove_minor_node(viona_dip, NULL);
+	viona_dip = NULL;
+
+	return (DDI_SUCCESS);
+}
+
+static int
+viona_open(dev_t *devp, int flag, int otype, cred_t *credp)
+{
+	int	minor;
+	viona_soft_state_t *ss;
+
+	if (otype != OTYP_CHR) {
+		return (EINVAL);
+	}
+#if 0
+	/*
+	 * XXX-mg: drv_priv() is wrong, but I'm not sure what is right.
+	 * Should the check be at open() or ioctl()?
+	 */
+	if (drv_priv(credp) != 0) {
+		return (EPERM);
+	}
+#endif
+	if (getminor(*devp) != VIONA_CTL_MINOR) {
+		return (ENXIO);
+	}
+
+	minor = id_alloc_nosleep(viona_minors);
+	if (minor == 0) {
+		/* All minors are busy */
+		return (EBUSY);
+	}
+	if (ddi_soft_state_zalloc(viona_state, minor) != DDI_SUCCESS) {
+		id_free(viona_minors, minor);
+		return (ENOMEM);
+	}
+
+	ss = ddi_get_soft_state(viona_state, minor);
+	mutex_init(&ss->ss_lock, NULL, MUTEX_DEFAULT, NULL);
+	*devp = makedevice(getmajor(*devp), minor);
+
+	return (0);
+}
+
+static int
+viona_close(dev_t dev, int flag, int otype, cred_t *credp)
+{
+	int			minor;
+	viona_soft_state_t	*ss;
+
+	if (otype != OTYP_CHR) {
+		return (EINVAL);
+	}
+
+	minor = getminor(dev);
+
+	ss = ddi_get_soft_state(viona_state, minor);
+	if (ss == NULL) {
+		return (ENXIO);
+	}
+
+	VERIFY0(viona_ioc_delete(ss, B_TRUE));
+	ddi_soft_state_free(viona_state, minor);
+	id_free(viona_minors, minor);
+
+	return (0);
+}
+
+static int
+viona_ioctl(dev_t dev, int cmd, intptr_t data, int md, cred_t *cr, int *rv)
+{
+	viona_soft_state_t *ss;
+	void *dptr = (void *)data;
+	int err = 0, val;
+	viona_link_t *link;
+
+	ss = ddi_get_soft_state(viona_state, getminor(dev));
+	if (ss == NULL) {
+		return (ENXIO);
+	}
+
+	switch (cmd) {
+	case VNA_IOC_CREATE:
+		return (viona_ioc_create(ss, dptr, md, cr));
+	case VNA_IOC_DELETE:
+		return (viona_ioc_delete(ss, B_FALSE));
+	default:
+		break;
+	}
+
+	mutex_enter(&ss->ss_lock);
+	if ((link = ss->ss_link) == NULL || link->l_destroyed ||
+	    vmm_drv_expired(link->l_vm_hold)) {
+		mutex_exit(&ss->ss_lock);
+		return (ENXIO);
+	}
+
+	switch (cmd) {
+	case VNA_IOC_GET_FEATURES:
+		val = VIONA_S_HOSTCAPS | link->l_features_hw;
+		if (ddi_copyout(&val, dptr, sizeof (val), md) != 0) {
+			err = EFAULT;
+		}
+		break;
+	case VNA_IOC_SET_FEATURES:
+		if (ddi_copyin(dptr, &val, sizeof (val), md) != 0) {
+			err = EFAULT;
+			break;
+		}
+		val &= (VIONA_S_HOSTCAPS | link->l_features_hw);
+		link->l_features = val;
+		break;
+	case VNA_IOC_RING_INIT:
+		err = viona_ioc_ring_init(link, dptr, md);
+		break;
+	case VNA_IOC_RING_RESET:
+		err = viona_ioc_ring_reset(link, (uint_t)data);
+		break;
+	case VNA_IOC_RING_KICK:
+		err = viona_ioc_ring_kick(link, (uint_t)data);
+		break;
+	case VNA_IOC_RING_SET_MSI:
+		err = viona_ioc_ring_set_msi(link, dptr, md);
+		break;
+	case VNA_IOC_RING_INTR_CLR:
+		err = viona_ioc_ring_intr_clear(link, (uint_t)data);
+		break;
+	case VNA_IOC_INTR_POLL:
+		err = viona_ioc_intr_poll(link, dptr, md, rv);
+		break;
+	case VNA_IOC_SET_NOTIFY_IOP:
+		err = viona_ioc_set_notify_ioport(link, (uint_t)data);
+		break;
+	default:
+		err = ENOTTY;
+		break;
+	}
+
+	mutex_exit(&ss->ss_lock);
+	return (err);
+}
+
+static int
+viona_chpoll(dev_t dev, short events, int anyyet, short *reventsp,
+    struct pollhead **phpp)
+{
+	viona_soft_state_t *ss;
+	viona_link_t *link;
+
+	ss = ddi_get_soft_state(viona_state, getminor(dev));
+	if (ss == NULL) {
+		return (ENXIO);
+	}
+
+	mutex_enter(&ss->ss_lock);
+	if ((link = ss->ss_link) == NULL || link->l_destroyed) {
+		mutex_exit(&ss->ss_lock);
+		return (ENXIO);
+	}
+
+	*reventsp = 0;
+	if ((events & POLLRDBAND) != 0) {
+		for (uint_t i = 0; i < VIONA_VQ_MAX; i++) {
+			if (link->l_vrings[i].vr_intr_enabled != 0) {
+				*reventsp |= POLLRDBAND;
+				break;
+			}
+		}
+	}
+	if ((*reventsp == 0 && !anyyet) || (events & POLLET)) {
+		*phpp = &link->l_pollhead;
+	}
+	mutex_exit(&ss->ss_lock);
+
+	return (0);
+}
+
+static void
+viona_get_mac_capab(viona_link_t *link)
+{
+	mac_handle_t mh = link->l_mh;
+	uint32_t cap = 0;
+
+	link->l_features_hw = 0;
+	if (mac_capab_get(mh, MAC_CAPAB_HCKSUM, &cap)) {
+		/*
+		 * Only report HW checksum ability if the underlying MAC
+		 * resource is capable of populating the L4 header.
+		 */
+		if ((cap & VIONA_CAP_HCKSUM_INTEREST) != 0) {
+			link->l_features_hw |= VIRTIO_NET_F_CSUM;
+		}
+		link->l_cap_csum = cap;
+	}
+}
+
+static int
+viona_ioc_create(viona_soft_state_t *ss, void *dptr, int md, cred_t *cr)
+{
+	vioc_create_t	kvc;
+	viona_link_t	*link = NULL;
+	char		cli_name[MAXNAMELEN];
+	int		err = 0;
+	file_t		*fp;
+	vmm_hold_t	*hold = NULL;
+
+	ASSERT(MUTEX_NOT_HELD(&ss->ss_lock));
+
+	if (ddi_copyin(dptr, &kvc, sizeof (kvc), md) != 0) {
+		return (EFAULT);
+	}
+
+	mutex_enter(&ss->ss_lock);
+	if (ss->ss_link != NULL) {
+		mutex_exit(&ss->ss_lock);
+		return (EEXIST);
+	}
+
+	if ((fp = getf(kvc.c_vmfd)) == NULL) {
+		err = EBADF;
+		goto bail;
+	}
+	err = vmm_drv_hold(fp, cr, &hold);
+	releasef(kvc.c_vmfd);
+	if (err != 0) {
+		goto bail;
+	}
+
+	link = kmem_zalloc(sizeof (viona_link_t), KM_SLEEP);
+	link->l_linkid = kvc.c_linkid;
+	link->l_vm_hold = hold;
+
+	err = mac_open_by_linkid(link->l_linkid, &link->l_mh);
+	if (err != 0) {
+		goto bail;
+	}
+
+	viona_get_mac_capab(link);
+
+	(void) snprintf(cli_name, sizeof (cli_name), "%s-%d", VIONA_CLI_NAME,
+	    link->l_linkid);
+	err = mac_client_open(link->l_mh, &link->l_mch, cli_name, 0);
+	if (err != 0) {
+		goto bail;
+	}
+
+	viona_ring_alloc(link, &link->l_vrings[VIONA_VQ_RX]);
+	viona_ring_alloc(link, &link->l_vrings[VIONA_VQ_TX]);
+	ss->ss_link = link;
+
+	mutex_exit(&ss->ss_lock);
+	return (0);
+
+bail:
+	if (link != NULL) {
+		if (link->l_mch != NULL) {
+			mac_client_close(link->l_mch, 0);
+		}
+		if (link->l_mh != NULL) {
+			mac_close(link->l_mh);
+		}
+		kmem_free(link, sizeof (viona_link_t));
+	}
+	if (hold != NULL) {
+		vmm_drv_rele(hold);
+	}
+
+	mutex_exit(&ss->ss_lock);
+	return (err);
+}
+
+static int
+viona_ioc_delete(viona_soft_state_t *ss, boolean_t on_close)
+{
+	viona_link_t *link;
+
+	mutex_enter(&ss->ss_lock);
+	if ((link = ss->ss_link) == NULL) {
+		/* Link destruction already complete */
+		mutex_exit(&ss->ss_lock);
+		return (0);
+	}
+
+	if (link->l_destroyed) {
+		/*
+		 * Link destruction has been started by another thread, but has
+		 * not completed.  This condition should be impossible to
+		 * encounter when performing the on-close destroy of the link,
+		 * since racing ioctl accessors must necessarily be absent.
+		 */
+		VERIFY(!on_close);
+		mutex_exit(&ss->ss_lock);
+		return (EAGAIN);
+	}
+	/*
+	 * The link deletion cannot fail after this point, continuing until its
+	 * successful completion is reached.
+	 */
+	link->l_destroyed = B_TRUE;
+	mutex_exit(&ss->ss_lock);
+
+	/*
+	 * Return the rings to their reset state, ignoring any possible
+	 * interruptions from signals.
+	 */
+	VERIFY0(viona_ring_reset(&link->l_vrings[VIONA_VQ_RX], B_FALSE));
+	VERIFY0(viona_ring_reset(&link->l_vrings[VIONA_VQ_TX], B_FALSE));
+
+	mutex_enter(&ss->ss_lock);
+	VERIFY0(viona_ioc_set_notify_ioport(link, 0));
+	if (link->l_mch != NULL) {
+		/*
+		 * The RX ring will have cleared its receive function from the
+		 * mac client handle, so all that is left to do is close it.
+		 */
+		mac_client_close(link->l_mch, 0);
+	}
+	if (link->l_mh != NULL) {
+		mac_close(link->l_mh);
+	}
+	if (link->l_vm_hold != NULL) {
+		vmm_drv_rele(link->l_vm_hold);
+		link->l_vm_hold = NULL;
+	}
+
+	viona_ring_free(&link->l_vrings[VIONA_VQ_RX]);
+	viona_ring_free(&link->l_vrings[VIONA_VQ_TX]);
+	pollhead_clean(&link->l_pollhead);
+	ss->ss_link = NULL;
+	mutex_exit(&ss->ss_lock);
+
+	kmem_free(link, sizeof (viona_link_t));
+	return (0);
+}
+
+/*
+ * Translate a guest physical address into a kernel virtual address.
+ */
+static void *
+viona_gpa2kva(viona_link_t *link, uint64_t gpa, size_t len)
+{
+	return (vmm_drv_gpa2kva(link->l_vm_hold, gpa, len));
+}
+
+static void
+viona_ring_alloc(viona_link_t *link, viona_vring_t *ring)
+{
+	ring->vr_link = link;
+	mutex_init(&ring->vr_lock, NULL, MUTEX_DRIVER, NULL);
+	cv_init(&ring->vr_cv, NULL, CV_DRIVER, NULL);
+	mutex_init(&ring->vr_a_mutex, NULL, MUTEX_DRIVER, NULL);
+	mutex_init(&ring->vr_u_mutex, NULL, MUTEX_DRIVER, NULL);
+}
+
+static void
+viona_ring_free(viona_vring_t *ring)
+{
+	mutex_destroy(&ring->vr_lock);
+	cv_destroy(&ring->vr_cv);
+	mutex_destroy(&ring->vr_a_mutex);
+	mutex_destroy(&ring->vr_u_mutex);
+	ring->vr_link = NULL;
+}
+
+static int
+viona_ring_reset(viona_vring_t *ring, boolean_t heed_signals)
+{
+	mutex_enter(&ring->vr_lock);
+	if (ring->vr_state == VRS_RESET) {
+		mutex_exit(&ring->vr_lock);
+		return (0);
+	}
+
+	if ((ring->vr_state_flags & VRSF_REQ_STOP) == 0) {
+		ring->vr_state_flags |= VRSF_REQ_STOP;
+		cv_broadcast(&ring->vr_cv);
+	}
+	while (ring->vr_state != VRS_RESET) {
+		if (!heed_signals) {
+			cv_wait(&ring->vr_cv, &ring->vr_lock);
+		} else {
+			int rs;
+
+			rs = cv_wait_sig(&ring->vr_cv, &ring->vr_lock);
+			if (rs <= 0 && ring->vr_state != VRS_RESET) {
+				mutex_exit(&ring->vr_lock);
+				return (EINTR);
+			}
+		}
+	}
+	mutex_exit(&ring->vr_lock);
+	return (0);
+}
+
+static int
+viona_ioc_ring_init(viona_link_t *link, void *udata, int md)
+{
+	vioc_ring_init_t kri;
+	viona_vring_t *ring;
+	kthread_t *t;
+	uintptr_t pos;
+	size_t desc_sz, avail_sz, used_sz;
+	uint16_t cnt;
+	int err = 0;
+
+	if (ddi_copyin(udata, &kri, sizeof (kri), md) != 0) {
+		return (EFAULT);
+	}
+
+	if (kri.ri_index >= VIONA_VQ_MAX) {
+		return (EINVAL);
+	}
+	cnt = kri.ri_qsize;
+	if (cnt == 0 || cnt > VRING_MAX_LEN || (1 << (ffs(cnt) - 1)) != cnt) {
+		return (EINVAL);
+	}
+
+	ring = &link->l_vrings[kri.ri_index];
+	mutex_enter(&ring->vr_lock);
+	if (ring->vr_state != VRS_RESET) {
+		mutex_exit(&ring->vr_lock);
+		return (EBUSY);
+	}
+	VERIFY(ring->vr_state_flags == 0);
+
+	pos = kri.ri_qaddr;
+	desc_sz = cnt * sizeof (struct virtio_desc);
+	avail_sz = (cnt + 3) * sizeof (uint16_t);
+	used_sz = (cnt * sizeof (struct virtio_used)) + (sizeof (uint16_t) * 3);
+
+	ring->vr_size = kri.ri_qsize;
+	ring->vr_mask = (ring->vr_size - 1);
+	ring->vr_descr = viona_gpa2kva(link, pos, desc_sz);
+	if (ring->vr_descr == NULL) {
+		err = EINVAL;
+		goto fail;
+	}
+	pos += desc_sz;
+
+	ring->vr_avail_flags = viona_gpa2kva(link, pos, avail_sz);
+	if (ring->vr_avail_flags == NULL) {
+		err = EINVAL;
+		goto fail;
+	}
+	ring->vr_avail_idx = ring->vr_avail_flags + 1;
+	ring->vr_avail_ring = ring->vr_avail_flags + 2;
+	ring->vr_avail_used_event = ring->vr_avail_ring + cnt;
+	pos += avail_sz;
+
+	pos = P2ROUNDUP(pos, VRING_ALIGN);
+	ring->vr_used_flags = viona_gpa2kva(link, pos, used_sz);
+	if (ring->vr_used_flags == NULL) {
+		err = EINVAL;
+		goto fail;
+	}
+	ring->vr_used_idx = ring->vr_used_flags + 1;
+	ring->vr_used_ring = (struct virtio_used *)(ring->vr_used_flags + 2);
+	ring->vr_used_avail_event = (uint16_t *)(ring->vr_used_ring + cnt);
+
+	/* Initialize queue indexes */
+	ring->vr_cur_aidx = 0;
+
+	/* Allocate desb handles for TX ring if packet copying not disabled */
+	if (kri.ri_index == VIONA_VQ_TX && !viona_force_copy_tx_mblks) {
+		viona_desb_t *desb, *dp;
+
+		desb = kmem_zalloc(sizeof (viona_desb_t) * cnt, KM_SLEEP);
+		dp = desb;
+		for (uint_t i = 0; i < cnt; i++, dp++) {
+			dp->d_frtn.free_func = viona_desb_release;
+			dp->d_frtn.free_arg = (void *)dp;
+			dp->d_ring = ring;
+		}
+		ring->vr_desb = desb;
+	}
+
+	/* Zero out MSI-X configuration */
+	ring->vr_msi_addr = 0;
+	ring->vr_msi_msg = 0;
+
+	/* Clear the stats */
+	bzero(&ring->vr_stats, sizeof (ring->vr_stats));
+
+	t = viona_create_worker(ring);
+	if (t == NULL) {
+		err = ENOMEM;
+		goto fail;
+	}
+	ring->vr_worker_thread = t;
+	ring->vr_state = VRS_SETUP;
+	cv_broadcast(&ring->vr_cv);
+	mutex_exit(&ring->vr_lock);
+	return (0);
+
+fail:
+	if (ring->vr_desb != NULL) {
+		kmem_free(ring->vr_desb, sizeof (viona_desb_t) * cnt);
+		ring->vr_desb = NULL;
+	}
+	ring->vr_size = 0;
+	ring->vr_mask = 0;
+	ring->vr_descr = NULL;
+	ring->vr_avail_flags = NULL;
+	ring->vr_avail_idx = NULL;
+	ring->vr_avail_ring = NULL;
+	ring->vr_avail_used_event = NULL;
+	ring->vr_used_flags = NULL;
+	ring->vr_used_idx = NULL;
+	ring->vr_used_ring = NULL;
+	ring->vr_used_avail_event = NULL;
+	mutex_exit(&ring->vr_lock);
+	return (err);
+}
+
+static int
+viona_ioc_ring_reset(viona_link_t *link, uint_t idx)
+{
+	viona_vring_t *ring;
+
+	if (idx >= VIONA_VQ_MAX) {
+		return (EINVAL);
+	}
+	ring = &link->l_vrings[idx];
+
+	return (viona_ring_reset(ring, B_TRUE));
+}
+
+static int
+viona_ioc_ring_kick(viona_link_t *link, uint_t idx)
+{
+	viona_vring_t *ring;
+	int err;
+
+	if (idx >= VIONA_VQ_MAX) {
+		return (EINVAL);
+	}
+	ring = &link->l_vrings[idx];
+
+	mutex_enter(&ring->vr_lock);
+	switch (ring->vr_state) {
+	case VRS_SETUP:
+		/*
+		 * An early kick to a ring which is starting its worker thread
+		 * is fine.  Once that thread is active, it will process the
+		 * start-up request immediately.
+		 */
+		/* FALLTHROUGH */
+	case VRS_INIT:
+		ring->vr_state_flags |= VRSF_REQ_START;
+		/* FALLTHROUGH */
+	case VRS_RUN:
+		cv_broadcast(&ring->vr_cv);
+		err = 0;
+		break;
+	default:
+		err = EBUSY;
+		break;
+	}
+	mutex_exit(&ring->vr_lock);
+
+	return (err);
+}
+
+static int
+viona_ioc_ring_set_msi(viona_link_t *link, void *data, int md)
+{
+	vioc_ring_msi_t vrm;
+	viona_vring_t *ring;
+
+	if (ddi_copyin(data, &vrm, sizeof (vrm), md) != 0) {
+		return (EFAULT);
+	}
+	if (vrm.rm_index >= VIONA_VQ_MAX) {
+		return (EINVAL);
+	}
+
+	ring = &link->l_vrings[vrm.rm_index];
+	mutex_enter(&ring->vr_lock);
+	ring->vr_msi_addr = vrm.rm_addr;
+	ring->vr_msi_msg = vrm.rm_msg;
+	mutex_exit(&ring->vr_lock);
+
+	return (0);
+}
+
+static int
+viona_notify_wcb(void *arg, uintptr_t ioport, uint_t sz, uint64_t val)
+{
+	viona_link_t *link = (viona_link_t *)arg;
+	uint16_t vq = (uint16_t)val;
+
+	if (ioport != link->l_notify_ioport || sz != sizeof (uint16_t)) {
+		return (EINVAL);
+	}
+	return (viona_ioc_ring_kick(link, vq));
+}
+
+static int
+viona_ioc_set_notify_ioport(viona_link_t *link, uint_t ioport)
+{
+	int err = 0;
+
+	if (link->l_notify_ioport != 0) {
+		vmm_drv_ioport_unhook(link->l_vm_hold, &link->l_notify_cookie);
+		link->l_notify_ioport = 0;
+	}
+
+	if (ioport != 0) {
+		err = vmm_drv_ioport_hook(link->l_vm_hold, ioport, NULL,
+		    viona_notify_wcb, (void *)link, &link->l_notify_cookie);
+		if (err == 0) {
+			link->l_notify_ioport = ioport;
+		}
+	}
+	return (err);
+}
+
+/*
+ * Return the number of available descriptors in the vring taking care of the
+ * 16-bit index wraparound.
+ *
+ * Note: If the number of apparently available descriptors is larger than the
+ * ring size (due to guest misbehavior), this check will still report the
+ * positive count of descriptors.
+ */
+static inline int
+viona_vr_num_avail(viona_vring_t *ring)
+{
+	uint16_t ndesc;
+
+	/*
+	 * We're just computing (a-b) in GF(216).
+	 *
+	 * The only glitch here is that in standard C, uint16_t promotes to
+	 * (signed) int when int has more than 16 bits (almost always now).
+	 * A cast back to unsigned is necessary for proper operation.
+	 */
+	ndesc = (unsigned)*ring->vr_avail_idx - (unsigned)ring->vr_cur_aidx;
+
+	return (ndesc);
+}
+
+static void
+viona_worker_rx(viona_vring_t *ring, viona_link_t *link)
+{
+	proc_t *p = ttoproc(curthread);
+
+	ASSERT(MUTEX_HELD(&ring->vr_lock));
+	ASSERT3U(ring->vr_state, ==, VRS_RUN);
+
+	atomic_or_16(ring->vr_used_flags, VRING_USED_F_NO_NOTIFY);
+	mac_rx_set(link->l_mch, viona_rx, link);
+
+	do {
+		/*
+		 * For now, there is little to do in the RX worker as inbound
+		 * data is delivered by MAC via the viona_rx callback.
+		 * If tap-like functionality is added later, this would be a
+		 * convenient place to inject frames into the guest.
+		 */
+		(void) cv_wait_sig(&ring->vr_cv, &ring->vr_lock);
+	} while (!VRING_NEED_BAIL(ring, p));
+
+	mutex_exit(&ring->vr_lock);
+	/*
+	 * Clearing the RX function involves MAC quiescing any flows on that
+	 * client.  If MAC happens to be delivering packets to this ring via
+	 * viona_rx() at the time of worker clean-up, that thread may need to
+	 * acquire vr_lock for tasks such as delivering an interrupt.  In order
+	 * to avoid such deadlocks, vr_lock must temporarily be dropped here.
+	 */
+	mac_rx_clear(link->l_mch);
+	mutex_enter(&ring->vr_lock);
+}
+
+static void
+viona_worker_tx(viona_vring_t *ring, viona_link_t *link)
+{
+	proc_t *p = ttoproc(curthread);
+
+	ASSERT(MUTEX_HELD(&ring->vr_lock));
+	ASSERT3U(ring->vr_state, ==, VRS_RUN);
+
+	mutex_exit(&ring->vr_lock);
+
+	for (;;) {
+		boolean_t bail = B_FALSE;
+		uint_t ntx = 0;
+
+		atomic_or_16(ring->vr_used_flags, VRING_USED_F_NO_NOTIFY);
+		while (viona_vr_num_avail(ring)) {
+			viona_tx(link, ring);
+
+			/*
+			 * It is advantageous for throughput to keep this
+			 * transmission loop tight, but periodic breaks to
+			 * check for other events are of value too.
+			 */
+			if (ntx++ >= ring->vr_size)
+				break;
+		}
+		atomic_and_16(ring->vr_used_flags, ~VRING_USED_F_NO_NOTIFY);
+
+		VIONA_PROBE2(tx, viona_link_t *, link, uint_t, ntx);
+
+		/*
+		 * Check for available descriptors on the ring once more in
+		 * case a late addition raced with the NO_NOTIFY flag toggle.
+		 */
+		bail = VRING_NEED_BAIL(ring, p);
+		if (!bail && viona_vr_num_avail(ring)) {
+			continue;
+		}
+
+		if ((link->l_features & VIRTIO_F_RING_NOTIFY_ON_EMPTY) != 0) {
+			viona_intr_ring(ring);
+		}
+
+		mutex_enter(&ring->vr_lock);
+		while (!bail && !viona_vr_num_avail(ring)) {
+			(void) cv_wait_sig(&ring->vr_cv, &ring->vr_lock);
+			bail = VRING_NEED_BAIL(ring, p);
+		}
+		if (bail) {
+			break;
+		}
+		mutex_exit(&ring->vr_lock);
+	}
+
+	ASSERT(MUTEX_HELD(&ring->vr_lock));
+
+	while (ring->vr_xfer_outstanding != 0) {
+		/*
+		 * Paying heed to signals is counterproductive here.  This is a
+		 * very tight loop if pending transfers take an extended amount
+		 * of time to be reclaimed while the host process is exiting.
+		 */
+		cv_wait(&ring->vr_cv, &ring->vr_lock);
+	}
+
+	/* Free any desb resources before the ring is completely stopped */
+	if (ring->vr_desb != NULL) {
+		kmem_free(ring->vr_desb, sizeof (viona_desb_t) * ring->vr_size);
+		ring->vr_desb = NULL;
+	}
+}
+
+static void
+viona_worker(void *arg)
+{
+	viona_vring_t *ring = (viona_vring_t *)arg;
+	viona_link_t *link = ring->vr_link;
+	proc_t *p = ttoproc(curthread);
+
+	mutex_enter(&ring->vr_lock);
+	VERIFY3U(ring->vr_state, ==, VRS_SETUP);
+
+	/* Bail immediately if ring shutdown or process exit was requested */
+	if (VRING_NEED_BAIL(ring, p)) {
+		goto cleanup;
+	}
+
+	/* Report worker thread as alive and notify creator */
+	ring->vr_state = VRS_INIT;
+	cv_broadcast(&ring->vr_cv);
+
+	while (ring->vr_state_flags == 0) {
+		(void) cv_wait_sig(&ring->vr_cv, &ring->vr_lock);
+
+		if (VRING_NEED_BAIL(ring, p)) {
+			goto cleanup;
+		}
+	}
+
+	ASSERT((ring->vr_state_flags & VRSF_REQ_START) != 0);
+	ring->vr_state = VRS_RUN;
+	ring->vr_state_flags &= ~VRSF_REQ_START;
+
+	/* Process actual work */
+	if (ring == &link->l_vrings[VIONA_VQ_RX]) {
+		viona_worker_rx(ring, link);
+	} else if (ring == &link->l_vrings[VIONA_VQ_TX]) {
+		viona_worker_tx(ring, link);
+	} else {
+		panic("unexpected ring: %p", (void *)ring);
+	}
+
+cleanup:
+	/* Free any desb resources before the ring is completely stopped */
+	if (ring->vr_desb != NULL) {
+		VERIFY(ring->vr_xfer_outstanding == 0);
+		kmem_free(ring->vr_desb, sizeof (viona_desb_t) * ring->vr_size);
+		ring->vr_desb = NULL;
+	}
+
+	ring->vr_cur_aidx = 0;
+	ring->vr_state = VRS_RESET;
+	ring->vr_state_flags = 0;
+	ring->vr_worker_thread = NULL;
+	cv_broadcast(&ring->vr_cv);
+	mutex_exit(&ring->vr_lock);
+
+	mutex_enter(&ttoproc(curthread)->p_lock);
+	lwp_exit();
+}
+
+static kthread_t *
+viona_create_worker(viona_vring_t *ring)
+{
+	k_sigset_t hold_set;
+	proc_t *p = curproc;
+	kthread_t *t;
+	klwp_t *lwp;
+
+	ASSERT(MUTEX_HELD(&ring->vr_lock));
+	ASSERT(ring->vr_state == VRS_RESET);
+
+	sigfillset(&hold_set);
+	lwp = lwp_create(viona_worker, (void *)ring, 0, p, TS_STOPPED,
+	    minclsyspri - 1, &hold_set, curthread->t_cid, 0);
+	if (lwp == NULL) {
+		return (NULL);
+	}
+
+	t = lwptot(lwp);
+	mutex_enter(&p->p_lock);
+	t->t_proc_flag = (t->t_proc_flag & ~TP_HOLDLWP) | TP_KTHREAD;
+	lwp_create_done(t);
+	mutex_exit(&p->p_lock);
+
+	return (t);
+}
+
+static int
+viona_ioc_ring_intr_clear(viona_link_t *link, uint_t idx)
+{
+	if (idx >= VIONA_VQ_MAX) {
+		return (EINVAL);
+	}
+
+	link->l_vrings[idx].vr_intr_enabled = 0;
+	return (0);
+}
+
+static int
+viona_ioc_intr_poll(viona_link_t *link, void *udata, int md, int *rv)
+{
+	uint_t cnt = 0;
+	vioc_intr_poll_t vip;
+
+	for (uint_t i = 0; i < VIONA_VQ_MAX; i++) {
+		uint_t val = link->l_vrings[i].vr_intr_enabled;
+
+		vip.vip_status[i] = val;
+		if (val != 0) {
+			cnt++;
+		}
+	}
+
+	if (ddi_copyout(&vip, udata, sizeof (vip), md) != 0) {
+		return (EFAULT);
+	}
+	*rv = (int)cnt;
+	return (0);
+}
+
+static int
+vq_popchain(viona_vring_t *ring, struct iovec *iov, int niov, uint16_t *cookie)
+{
+	viona_link_t *link = ring->vr_link;
+	uint_t i, ndesc, idx, head, next;
+	struct virtio_desc vdir;
+	void *buf;
+
+	ASSERT(iov != NULL);
+	ASSERT(niov > 0);
+
+	mutex_enter(&ring->vr_a_mutex);
+	idx = ring->vr_cur_aidx;
+	ndesc = (uint16_t)((unsigned)*ring->vr_avail_idx - (unsigned)idx);
+
+	if (ndesc == 0) {
+		mutex_exit(&ring->vr_a_mutex);
+		return (0);
+	}
+	if (ndesc > ring->vr_size) {
+		/*
+		 * Despite the fact that the guest has provided an 'avail_idx'
+		 * which indicates that an impossible number of descriptors are
+		 * available, continue on and attempt to process the next one.
+		 *
+		 * The transgression will not escape the probe or stats though.
+		 */
+		VIONA_PROBE2(ndesc_too_high, viona_vring_t *, ring,
+		    uint16_t, ndesc);
+		VIONA_RING_STAT_INCR(ring, ndesc_too_high);
+	}
+
+	head = ring->vr_avail_ring[idx & ring->vr_mask];
+	next = head;
+
+	for (i = 0; i < niov; next = vdir.vd_next) {
+		if (next >= ring->vr_size) {
+			VIONA_PROBE2(bad_idx, viona_vring_t *, ring,
+			    uint16_t, next);
+			VIONA_RING_STAT_INCR(ring, bad_idx);
+			goto bail;
+		}
+
+		vdir = ring->vr_descr[next];
+		if ((vdir.vd_flags & VRING_DESC_F_INDIRECT) == 0) {
+			buf = viona_gpa2kva(link, vdir.vd_addr, vdir.vd_len);
+			if (buf == NULL) {
+				VIONA_PROBE_BAD_RING_ADDR(ring, vdir.vd_addr);
+				VIONA_RING_STAT_INCR(ring, bad_ring_addr);
+				goto bail;
+			}
+			iov[i].iov_base = buf;
+			iov[i].iov_len = vdir.vd_len;
+			i++;
+		} else {
+			const uint_t nindir = vdir.vd_len / 16;
+			volatile struct virtio_desc *vindir;
+
+			if ((vdir.vd_len & 0xf) || nindir == 0) {
+				VIONA_PROBE2(indir_bad_len,
+				    viona_vring_t *, ring,
+				    uint32_t, vdir.vd_len);
+				VIONA_RING_STAT_INCR(ring, indir_bad_len);
+				goto bail;
+			}
+			vindir = viona_gpa2kva(link, vdir.vd_addr, vdir.vd_len);
+			if (vindir == NULL) {
+				VIONA_PROBE_BAD_RING_ADDR(ring, vdir.vd_addr);
+				VIONA_RING_STAT_INCR(ring, bad_ring_addr);
+				goto bail;
+			}
+			next = 0;
+			for (;;) {
+				struct virtio_desc vp;
+
+				/*
+				 * A copy of the indirect descriptor is made
+				 * here, rather than simply using a reference
+				 * pointer.  This prevents malicious or
+				 * erroneous guest writes to the descriptor
+				 * from fooling the flags/bounds verification
+				 * through a race.
+				 */
+				vp = vindir[next];
+				if (vp.vd_flags & VRING_DESC_F_INDIRECT) {
+					VIONA_PROBE1(indir_bad_nest,
+					    viona_vring_t *, ring);
+					VIONA_RING_STAT_INCR(ring,
+					    indir_bad_nest);
+					goto bail;
+				}
+				buf = viona_gpa2kva(link, vp.vd_addr,
+				    vp.vd_len);
+				if (buf == NULL) {
+					VIONA_PROBE_BAD_RING_ADDR(ring,
+					    vp.vd_addr);
+					VIONA_RING_STAT_INCR(ring,
+					    bad_ring_addr);
+					goto bail;
+				}
+				iov[i].iov_base = buf;
+				iov[i].iov_len = vp.vd_len;
+				i++;
+
+				if ((vp.vd_flags & VRING_DESC_F_NEXT) == 0)
+					break;
+				if (i >= niov) {
+					goto loopy;
+				}
+
+				next = vp.vd_next;
+				if (next >= nindir) {
+					VIONA_PROBE3(indir_bad_next,
+					    viona_vring_t *, ring,
+					    uint16_t, next,
+					    uint_t, nindir);
+					VIONA_RING_STAT_INCR(ring,
+					    indir_bad_next);
+					goto bail;
+				}
+			}
+		}
+		if ((vdir.vd_flags & VRING_DESC_F_NEXT) == 0) {
+			*cookie = head;
+			ring->vr_cur_aidx++;
+			mutex_exit(&ring->vr_a_mutex);
+			return (i);
+		}
+	}
+
+loopy:
+	VIONA_PROBE1(too_many_desc, viona_vring_t *, ring);
+	VIONA_RING_STAT_INCR(ring, too_many_desc);
+bail:
+	mutex_exit(&ring->vr_a_mutex);
+	return (-1);
+}
+
+static void
+vq_pushchain(viona_vring_t *ring, uint32_t len, uint16_t cookie)
+{
+	volatile struct virtio_used *vu;
+	uint_t uidx;
+
+	mutex_enter(&ring->vr_u_mutex);
+
+	uidx = *ring->vr_used_idx;
+	vu = &ring->vr_used_ring[uidx++ & ring->vr_mask];
+	vu->vu_idx = cookie;
+	vu->vu_tlen = len;
+	membar_producer();
+	*ring->vr_used_idx = uidx;
+
+	mutex_exit(&ring->vr_u_mutex);
+}
+
+static void
+vq_pushchain_mrgrx(viona_vring_t *ring, int num_bufs, used_elem_t *elem)
+{
+	volatile struct virtio_used *vu;
+	uint_t uidx, i;
+
+	mutex_enter(&ring->vr_u_mutex);
+
+	uidx = *ring->vr_used_idx;
+	if (num_bufs == 1) {
+		vu = &ring->vr_used_ring[uidx++ & ring->vr_mask];
+		vu->vu_idx = elem[0].id;
+		vu->vu_tlen = elem[0].len;
+	} else {
+		for (i = 0; i < num_bufs; i++) {
+			vu = &ring->vr_used_ring[(uidx + i) & ring->vr_mask];
+			vu->vu_idx = elem[i].id;
+			vu->vu_tlen = elem[i].len;
+		}
+		uidx = uidx + num_bufs;
+	}
+	membar_producer();
+	*ring->vr_used_idx = uidx;
+
+	mutex_exit(&ring->vr_u_mutex);
+}
+
+static void
+viona_intr_ring(viona_vring_t *ring)
+{
+	uint64_t addr;
+
+	mutex_enter(&ring->vr_lock);
+	/* Deliver the interrupt directly, if so configured. */
+	if ((addr = ring->vr_msi_addr) != 0) {
+		uint64_t msg = ring->vr_msi_msg;
+
+		mutex_exit(&ring->vr_lock);
+		(void) vmm_drv_msi(ring->vr_link->l_vm_hold, addr, msg);
+		return;
+	}
+	mutex_exit(&ring->vr_lock);
+
+	if (atomic_cas_uint(&ring->vr_intr_enabled, 0, 1) == 0) {
+		pollwakeup(&ring->vr_link->l_pollhead, POLLRDBAND);
+	}
+}
+
+static size_t
+viona_copy_mblk(const mblk_t *mp, size_t seek, caddr_t buf, size_t len,
+    boolean_t *end)
+{
+	size_t copied = 0;
+	size_t off = 0;
+
+	/* Seek past already-consumed data */
+	while (seek > 0 && mp != NULL) {
+		const size_t chunk = MBLKL(mp);
+
+		if (chunk > seek) {
+			off = seek;
+			break;
+		}
+		mp = mp->b_cont;
+		seek -= chunk;
+	}
+
+	while (mp != NULL) {
+		const size_t chunk = MBLKL(mp) - off;
+		const size_t to_copy = MIN(chunk, len);
+
+		bcopy(mp->b_rptr + off, buf, to_copy);
+		copied += to_copy;
+		buf += to_copy;
+		len -= to_copy;
+
+		/*
+		 * If all the remaining data in the mblk_t was copied, move on
+		 * to the next one in the chain.  Any seek offset applied to
+		 * the first mblk copy is zeroed out for subsequent operations.
+		 */
+		if (chunk == to_copy) {
+			mp = mp->b_cont;
+			off = 0;
+		}
+#ifdef DEBUG
+		else {
+			/*
+			 * The only valid reason for the copy to consume less
+			 * than the entire contents of the mblk_t is because
+			 * the output buffer has been filled.
+			 */
+			ASSERT0(len);
+		}
+#endif
+
+		/* Go no further if the buffer has been filled */
+		if (len == 0) {
+			break;
+		}
+
+	}
+	*end = (mp == NULL);
+	return (copied);
+}
+
+static int
+viona_recv_plain(viona_vring_t *ring, const mblk_t *mp, size_t msz)
+{
+	struct iovec iov[VTNET_MAXSEGS];
+	uint16_t cookie;
+	int n;
+	const size_t hdr_sz = sizeof (struct virtio_net_hdr);
+	struct virtio_net_hdr *hdr;
+	size_t len, copied = 0;
+	caddr_t buf = NULL;
+	boolean_t end = B_FALSE;
+
+	ASSERT(msz >= MIN_BUF_SIZE);
+
+	n = vq_popchain(ring, iov, VTNET_MAXSEGS, &cookie);
+	if (n <= 0) {
+		/* Without available buffers, the frame must be dropped. */
+		return (ENOSPC);
+	}
+	if (iov[0].iov_len < hdr_sz) {
+		/*
+		 * There is little to do if there is not even space available
+		 * for the sole header.  Zero the buffer and bail out as a last
+		 * act of desperation.
+		 */
+		bzero(iov[0].iov_base, iov[0].iov_len);
+		goto bad_frame;
+	}
+
+	/* Grab the address of the header before anything else */
+	hdr = (struct virtio_net_hdr *)iov[0].iov_base;
+
+	/*
+	 * If there is any space remaining in the first buffer after writing
+	 * the header, fill it with frame data.
+	 */
+	if (iov[0].iov_len > hdr_sz) {
+		buf = (caddr_t)iov[0].iov_base + hdr_sz;
+		len = iov[0].iov_len - hdr_sz;
+
+		copied += viona_copy_mblk(mp, copied, buf, len, &end);
+	}
+
+	/* Copy any remaining data into subsequent buffers, if present */
+	for (int i = 1; i < n && !end; i++) {
+		buf = (caddr_t)iov[i].iov_base;
+		len = iov[i].iov_len;
+
+		copied += viona_copy_mblk(mp, copied, buf, len, &end);
+	}
+
+	/* Was the expected amount of data copied? */
+	if (copied != msz) {
+		VIONA_PROBE5(too_short, viona_vring_t *, ring,
+		    uint16_t, cookie, mblk_t *, mp, size_t, copied,
+		    size_t, msz);
+		VIONA_RING_STAT_INCR(ring, too_short);
+		goto bad_frame;
+	}
+
+	/* Populate (read: zero) the header and account for it in the size */
+	bzero(hdr, hdr_sz);
+	copied += hdr_sz;
+
+	/* Add chksum bits, if needed */
+	if ((ring->vr_link->l_features & VIRTIO_NET_F_GUEST_CSUM) != 0) {
+		uint32_t cksum_flags;
+
+		mac_hcksum_get((mblk_t *)mp, NULL, NULL, NULL, NULL,
+		    &cksum_flags);
+		if ((cksum_flags & HCK_FULLCKSUM_OK) != 0) {
+			hdr->vrh_flags |= VIRTIO_NET_HDR_F_DATA_VALID;
+		}
+	}
+
+	/* Release this chain */
+	vq_pushchain(ring, copied, cookie);
+	return (0);
+
+bad_frame:
+	VIONA_PROBE3(bad_rx_frame, viona_vring_t *, ring, uint16_t, cookie,
+	    mblk_t *, mp);
+	VIONA_RING_STAT_INCR(ring, bad_rx_frame);
+
+	vq_pushchain(ring, MAX(copied, MIN_BUF_SIZE + hdr_sz), cookie);
+	return (EINVAL);
+}
+
+static int
+viona_recv_merged(viona_vring_t *ring, const mblk_t *mp, size_t msz)
+{
+	struct iovec iov[VTNET_MAXSEGS];
+	used_elem_t uelem[VTNET_MAXSEGS];
+	int n, i = 0, buf_idx = 0, err = 0;
+	uint16_t cookie;
+	caddr_t buf;
+	size_t len, copied = 0, chunk = 0;
+	struct virtio_net_mrgrxhdr *hdr = NULL;
+	const size_t hdr_sz = sizeof (struct virtio_net_mrgrxhdr);
+	boolean_t end = B_FALSE;
+
+	ASSERT(msz >= MIN_BUF_SIZE);
+
+	n = vq_popchain(ring, iov, VTNET_MAXSEGS, &cookie);
+	if (n <= 0) {
+		/* Without available buffers, the frame must be dropped. */
+		VIONA_PROBE2(no_space, viona_vring_t *, ring, mblk_t *, mp);
+		VIONA_RING_STAT_INCR(ring, no_space);
+		return (ENOSPC);
+	}
+	if (iov[0].iov_len < hdr_sz) {
+		/*
+		 * There is little to do if there is not even space available
+		 * for the sole header.  Zero the buffer and bail out as a last
+		 * act of desperation.
+		 */
+		bzero(iov[0].iov_base, iov[0].iov_len);
+		uelem[0].id = cookie;
+		uelem[0].len = iov[0].iov_len;
+		err = EINVAL;
+		goto done;
+	}
+
+	/* Grab the address of the header and do initial population */
+	hdr = (struct virtio_net_mrgrxhdr *)iov[0].iov_base;
+	bzero(hdr, hdr_sz);
+	hdr->vrh_bufs = 1;
+
+	/*
+	 * If there is any space remaining in the first buffer after writing
+	 * the header, fill it with frame data.
+	 */
+	if (iov[0].iov_len > hdr_sz) {
+		buf = iov[0].iov_base + hdr_sz;
+		len = iov[0].iov_len - hdr_sz;
+
+		chunk += viona_copy_mblk(mp, copied, buf, len, &end);
+		copied += chunk;
+	}
+	i = 1;
+
+	do {
+		while (i < n && !end) {
+			buf = iov[i].iov_base;
+			len = iov[i].iov_len;
+
+			chunk += viona_copy_mblk(mp, copied, buf, len, &end);
+			copied += chunk;
+			i++;
+		}
+
+		uelem[buf_idx].id = cookie;
+		uelem[buf_idx].len = chunk;
+
+		/*
+		 * Try to grab another buffer from the ring if the mblk has not
+		 * yet been entirely copied out.
+		 */
+		if (!end) {
+			if (buf_idx == (VTNET_MAXSEGS - 1)) {
+				/*
+				 * Our arbitrary limit on the number of buffers
+				 * to offer for merge has already been reached.
+				 */
+				err = EOVERFLOW;
+				break;
+			}
+			n = vq_popchain(ring, iov, VTNET_MAXSEGS, &cookie);
+			if (n <= 0) {
+				/*
+				 * Without more immediate space to perform the
+				 * copying, there is little choice left but to
+				 * drop the packet.
+				 */
+				err = EMSGSIZE;
+				break;
+			}
+			chunk = 0;
+			i = 0;
+			buf_idx++;
+			/*
+			 * Keep the header up-to-date with the number of
+			 * buffers, but never reference its value since the
+			 * guest could meddle with it.
+			 */
+			hdr->vrh_bufs++;
+		}
+	} while (!end && copied < msz);
+
+	/* Account for the header size in the first buffer */
+	uelem[0].len += hdr_sz;
+
+	/*
+	 * If no other errors were encounted during the copy, was the expected
+	 * amount of data transfered?
+	 */
+	if (err == 0 && copied != msz) {
+		VIONA_PROBE5(too_short, viona_vring_t *, ring,
+		    uint16_t, cookie, mblk_t *, mp, size_t, copied,
+		    size_t, msz);
+		VIONA_RING_STAT_INCR(ring, too_short);
+		err = EINVAL;
+	}
+
+	/* Add chksum bits, if needed */
+	if ((ring->vr_link->l_features & VIRTIO_NET_F_GUEST_CSUM) != 0) {
+		uint32_t cksum_flags;
+
+		mac_hcksum_get((mblk_t *)mp, NULL, NULL, NULL, NULL,
+		    &cksum_flags);
+		if ((cksum_flags & HCK_FULLCKSUM_OK) != 0) {
+			hdr->vrh_flags |= VIRTIO_NET_HDR_F_DATA_VALID;
+		}
+	}
+
+done:
+	switch (err) {
+	case 0:
+		/* Success can fall right through to ring delivery */
+		break;
+
+	case EMSGSIZE:
+		VIONA_PROBE3(rx_merge_underrun, viona_vring_t *, ring,
+		    uint16_t, cookie, mblk_t *, mp);
+		VIONA_RING_STAT_INCR(ring, rx_merge_underrun);
+		break;
+
+	case EOVERFLOW:
+		VIONA_PROBE3(rx_merge_overrun, viona_vring_t *, ring,
+		    uint16_t, cookie, mblk_t *, mp);
+		VIONA_RING_STAT_INCR(ring, rx_merge_overrun);
+		break;
+
+	default:
+		VIONA_PROBE3(bad_rx_frame, viona_vring_t *, ring,
+		    uint16_t, cookie, mblk_t *, mp);
+		VIONA_RING_STAT_INCR(ring, bad_rx_frame);
+	}
+	vq_pushchain_mrgrx(ring, buf_idx + 1, uelem);
+	return (err);
+}
+
+static void
+viona_rx(void *arg, mac_resource_handle_t mrh, mblk_t *mp, boolean_t loopback)
+{
+	viona_link_t *link = (viona_link_t *)arg;
+	viona_vring_t *ring = &link->l_vrings[VIONA_VQ_RX];
+	mblk_t *mprx = NULL, **mprx_prevp = &mprx;
+	mblk_t *mpdrop = NULL, **mpdrop_prevp = &mpdrop;
+	const boolean_t do_merge =
+	    ((link->l_features & VIRTIO_NET_F_MRG_RXBUF) != 0);
+	size_t nrx = 0, ndrop = 0;
+
+	while (mp != NULL) {
+		mblk_t *next, *pad = NULL;
+		size_t size;
+		int err = 0;
+
+		next = mp->b_next;
+		mp->b_next = NULL;
+		size = msgsize(mp);
+
+		/*
+		 * Ethernet frames are expected to be padded out in order to
+		 * meet the minimum size.
+		 *
+		 * A special case is made for frames which are short by
+		 * VLAN_TAGSZ, having been stripped of their VLAN tag while
+		 * traversing MAC.  A preallocated (and recycled) mblk is used
+		 * for that specific condition.
+		 *
+		 * All other frames that fall short on length will have custom
+		 * zero-padding allocated appended to them.
+		 */
+		if (size == NEED_VLAN_PAD_SIZE) {
+			ASSERT(MBLKL(viona_vlan_pad_mp) == VLAN_TAGSZ);
+			ASSERT(viona_vlan_pad_mp->b_cont == NULL);
+
+			for (pad = mp; pad->b_cont != NULL; pad = pad->b_cont)
+				;
+
+			pad->b_cont = viona_vlan_pad_mp;
+			size += VLAN_TAGSZ;
+		} else if (size < MIN_BUF_SIZE) {
+			const size_t pad_size = MIN_BUF_SIZE - size;
+			mblk_t *zero_mp;
+
+			zero_mp = allocb(pad_size, BPRI_MED);
+			if (zero_mp == NULL) {
+				err = ENOMEM;
+				goto pad_drop;
+			}
+
+			VIONA_PROBE3(rx_pad_short, viona_vring_t *, ring,
+			    mblk_t *, mp, size_t, pad_size);
+			VIONA_RING_STAT_INCR(ring, rx_pad_short);
+			zero_mp->b_wptr += pad_size;
+			bzero(zero_mp->b_rptr, pad_size);
+			linkb(mp, zero_mp);
+			size += pad_size;
+		}
+
+		if (do_merge) {
+			err = viona_recv_merged(ring, mp, size);
+		} else {
+			err = viona_recv_plain(ring, mp, size);
+		}
+
+		/*
+		 * The VLAN padding mblk is meant for continual reuse, so
+		 * remove it from the chain to prevent it from being freed.
+		 *
+		 * Custom allocated padding does not require this treatment and
+		 * is freed normally.
+		 */
+		if (pad != NULL) {
+			pad->b_cont = NULL;
+		}
+
+pad_drop:
+		if (err != 0) {
+			*mpdrop_prevp = mp;
+			mpdrop_prevp = &mp->b_next;
+
+			/*
+			 * If the available ring is empty, do not bother
+			 * attempting to deliver any more frames.  Count the
+			 * rest as dropped too.
+			 */
+			if (err == ENOSPC) {
+				mp->b_next = next;
+				break;
+			}
+		} else {
+			/* Chain successful mblks to be freed later */
+			*mprx_prevp = mp;
+			mprx_prevp = &mp->b_next;
+			nrx++;
+		}
+		mp = next;
+	}
+
+	if ((*ring->vr_avail_flags & VRING_AVAIL_F_NO_INTERRUPT) == 0) {
+		viona_intr_ring(ring);
+	}
+
+	/* Free successfully received frames */
+	if (mprx != NULL) {
+		freemsgchain(mprx);
+	}
+
+	/* Free dropped frames, also tallying them */
+	mp = mpdrop;
+	while (mp != NULL) {
+		mblk_t *next = mp->b_next;
+
+		mp->b_next = NULL;
+		freemsg(mp);
+		mp = next;
+		ndrop++;
+	}
+	VIONA_PROBE3(rx, viona_link_t *, link, size_t, nrx, size_t, ndrop);
+}
+
+static void
+viona_tx_done(viona_vring_t *ring, uint32_t len, uint16_t cookie)
+{
+	vq_pushchain(ring, len, cookie);
+
+	if ((*ring->vr_avail_flags & VRING_AVAIL_F_NO_INTERRUPT) == 0) {
+		viona_intr_ring(ring);
+	}
+}
+
+static void
+viona_desb_release(viona_desb_t *dp)
+{
+	viona_vring_t *ring = dp->d_ring;
+	uint_t ref;
+	uint32_t len;
+	uint16_t cookie;
+
+	ref = atomic_dec_uint_nv(&dp->d_ref);
+	if (ref > 1) {
+		return;
+	}
+
+	/*
+	 * The desb corresponding to this index must be ready for reuse before
+	 * the descriptor is returned to the guest via the 'used' ring.
+	 */
+	len = dp->d_len;
+	cookie = dp->d_cookie;
+	dp->d_len = 0;
+	dp->d_cookie = 0;
+	dp->d_ref = 0;
+
+	viona_tx_done(ring, len, cookie);
+
+	mutex_enter(&ring->vr_lock);
+	if ((--ring->vr_xfer_outstanding) == 0) {
+		cv_broadcast(&ring->vr_cv);
+	}
+	mutex_exit(&ring->vr_lock);
+}
+
+static int
+viona_mb_get_uint8(mblk_t *mp, off_t off, uint8_t *out)
+{
+	size_t mpsize;
+	uint8_t *bp;
+
+	mpsize = msgsize(mp);
+	if (off + sizeof (uint8_t) > mpsize)
+		return (-1);
+
+	mpsize = MBLKL(mp);
+	while (off >= mpsize) {
+		mp = mp->b_cont;
+		off -= mpsize;
+		mpsize = MBLKL(mp);
+	}
+
+	bp = mp->b_rptr + off;
+	*out = *bp;
+	return (0);
+}
+
+static boolean_t
+viona_tx_csum(viona_vring_t *ring, const struct virtio_net_hdr *hdr,
+    mblk_t *mp, uint32_t len)
+{
+	viona_link_t *link = ring->vr_link;
+	const struct ether_header *eth;
+	uint_t eth_len = sizeof (struct ether_header);
+	ushort_t ftype;
+	uint8_t ipproto = IPPROTO_NONE; /* NONE is not exactly right, but ok */
+
+	eth = (const struct ether_header *)mp->b_rptr;
+	if (MBLKL(mp) < sizeof (*eth)) {
+		/* Buffers shorter than an ethernet header are hopeless */
+		return (B_FALSE);
+	}
+
+	ftype = ntohs(eth->ether_type);
+	if (ftype == ETHERTYPE_VLAN) {
+		const struct ether_vlan_header *veth;
+
+		/* punt on QinQ for now */
+		eth_len = sizeof (struct ether_vlan_header);
+		veth = (const struct ether_vlan_header *)eth;
+		ftype = ntohs(veth->ether_type);
+	}
+
+	if (ftype == ETHERTYPE_IP) {
+		const size_t off = offsetof(ipha_t, ipha_protocol) + eth_len;
+
+		(void) viona_mb_get_uint8(mp, off, &ipproto);
+	} else if (ftype == ETHERTYPE_IPV6) {
+		const size_t off = offsetof(ip6_t, ip6_nxt) + eth_len;
+
+		(void) viona_mb_get_uint8(mp, off, &ipproto);
+	}
+
+	/*
+	 * Partial checksum support from the NIC is ideal, since it most
+	 * closely maps to the interface defined by virtio.
+	 */
+	if ((link->l_cap_csum & HCKSUM_INET_PARTIAL) != 0 &&
+	    (ipproto == IPPROTO_TCP || ipproto == IPPROTO_UDP)) {
+		uint_t start, stuff, end;
+
+		/*
+		 * The lower-level driver is expecting these offsets to be
+		 * relative to the start of the L3 header rather than the
+		 * ethernet frame.
+		 */
+		start = hdr->vrh_csum_start - eth_len;
+		stuff = start + hdr->vrh_csum_offset;
+		end = len - eth_len;
+		mac_hcksum_set(mp, start, stuff, end, 0, HCK_PARTIALCKSUM);
+		return (B_TRUE);
+	}
+
+	/*
+	 * Without partial checksum support, look to the L3/L4 protocol
+	 * information to see if the NIC can handle it.  If not, the
+	 * checksum will need to calculated inline.
+	 */
+	if (ftype == ETHERTYPE_IP) {
+		if ((link->l_cap_csum & HCKSUM_INET_FULL_V4) != 0 &&
+		    (ipproto == IPPROTO_TCP || ipproto == IPPROTO_UDP)) {
+			mac_hcksum_set(mp, 0, 0, 0, 0, HCK_FULLCKSUM);
+			return (B_TRUE);
+		}
+
+		/* XXX: Implement manual fallback checksumming? */
+		VIONA_PROBE2(fail_hcksum, viona_link_t *, link, mblk_t *, mp);
+		VIONA_RING_STAT_INCR(ring, fail_hcksum);
+		return (B_FALSE);
+	} else if (ftype == ETHERTYPE_IPV6) {
+		if ((link->l_cap_csum & HCKSUM_INET_FULL_V6) != 0 &&
+		    (ipproto == IPPROTO_TCP || ipproto == IPPROTO_UDP)) {
+			mac_hcksum_set(mp, 0, 0, 0, 0, HCK_FULLCKSUM);
+			return (B_TRUE);
+		}
+
+		/* XXX: Implement manual fallback checksumming? */
+		VIONA_PROBE2(fail_hcksum6, viona_link_t *, link, mblk_t *, mp);
+		VIONA_RING_STAT_INCR(ring, fail_hcksum6);
+		return (B_FALSE);
+	}
+
+	/* Cannot even emulate hcksum for unrecognized protocols */
+	VIONA_PROBE2(fail_hcksum_proto, viona_link_t *, link, mblk_t *, mp);
+	VIONA_RING_STAT_INCR(ring, fail_hcksum_proto);
+	return (B_FALSE);
+}
+
+static void
+viona_tx(viona_link_t *link, viona_vring_t *ring)
+{
+	struct iovec		iov[VTNET_MAXSEGS];
+	uint16_t		cookie;
+	int			n;
+	uint32_t		len;
+	mblk_t			*mp_head, *mp_tail, *mp;
+	viona_desb_t		*dp = NULL;
+	mac_client_handle_t	link_mch = link->l_mch;
+	const struct virtio_net_hdr *hdr;
+
+	mp_head = mp_tail = NULL;
+
+	n = vq_popchain(ring, iov, VTNET_MAXSEGS, &cookie);
+	if (n <= 0) {
+		VIONA_PROBE1(tx_absent, viona_vring_t *, ring);
+		VIONA_RING_STAT_INCR(ring, tx_absent);
+		return;
+	}
+
+	if (ring->vr_desb != NULL) {
+		dp = &ring->vr_desb[cookie];
+
+		/*
+		 * If the guest driver is operating properly, each desb slot
+		 * should be available for use when processing a TX descriptor
+		 * from the 'avail' ring.  In the case of drivers that reuse a
+		 * descriptor before it has been posted to the 'used' ring, the
+		 * data is simply dropped.
+		 */
+		if (atomic_cas_uint(&dp->d_ref, 0, 1) != 0) {
+			dp = NULL;
+			goto drop_fail;
+		}
+		dp->d_cookie = cookie;
+	}
+
+	/* Grab the header and ensure it is of adequate length */
+	hdr = (const struct virtio_net_hdr *)iov[0].iov_base;
+	len = iov[0].iov_len;
+	if (len < sizeof (struct virtio_net_hdr)) {
+		goto drop_fail;
+	}
+
+	for (uint_t i = 1; i < n; i++) {
+		if (dp != NULL) {
+			mp = desballoc((uchar_t *)iov[i].iov_base,
+			    iov[i].iov_len, BPRI_MED, &dp->d_frtn);
+			if (mp == NULL) {
+				goto drop_fail;
+			}
+			dp->d_ref++;
+		} else {
+			mp = allocb(iov[i].iov_len, BPRI_MED);
+			if (mp == NULL) {
+				goto drop_fail;
+			}
+			bcopy((uchar_t *)iov[i].iov_base, mp->b_wptr,
+			    iov[i].iov_len);
+		}
+
+		len += iov[i].iov_len;
+		mp->b_wptr += iov[i].iov_len;
+		if (mp_head == NULL) {
+			ASSERT(mp_tail == NULL);
+			mp_head = mp;
+		} else {
+			ASSERT(mp_tail != NULL);
+			mp_tail->b_cont = mp;
+		}
+		mp_tail = mp;
+	}
+
+	/* Request hardware checksumming, if necessary */
+	if ((link->l_features & VIRTIO_NET_F_CSUM) != 0 &&
+	    (hdr->vrh_flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) != 0) {
+		if (!viona_tx_csum(ring, hdr, mp_head, len - iov[0].iov_len)) {
+			goto drop_fail;
+		}
+	}
+
+	if (dp != NULL) {
+		dp->d_len = len;
+		mutex_enter(&ring->vr_lock);
+		ring->vr_xfer_outstanding++;
+		mutex_exit(&ring->vr_lock);
+	} else {
+		/*
+		 * If the data was cloned out of the ring, the descriptors can
+		 * be marked as 'used' now, rather than deferring that action
+		 * until after successful packet transmission.
+		 */
+		viona_tx_done(ring, len, cookie);
+	}
+
+	/*
+	 * We're potentially going deep into the networking layer; make sure the
+	 * guest can't run concurrently.
+	 */
+	ht_begin_unsafe();
+	mac_tx(link_mch, mp_head, 0, MAC_DROP_ON_NO_DESC, NULL);
+	ht_end_unsafe();
+	return;
+
+drop_fail:
+	/*
+	 * On the off chance that memory is not available via the desballoc or
+	 * allocb calls, there are few options left besides to fail and drop
+	 * the frame on the floor.
+	 */
+
+	if (dp != NULL) {
+		/*
+		 * Take an additional reference on the desb handle (if present)
+		 * so any desballoc-sourced mblks can release their hold on it
+		 * without the handle reaching its final state and executing
+		 * its clean-up logic.
+		 */
+		dp->d_ref++;
+	}
+
+	/*
+	 * Free any already-allocated blocks and sum up the total length of the
+	 * dropped data to be released to the used ring.
+	 */
+	freemsgchain(mp_head);
+	len = 0;
+	for (uint_t i = 0; i < n; i++) {
+		len += iov[i].iov_len;
+	}
+
+	if (dp != NULL) {
+		VERIFY(dp->d_ref == 2);
+
+		/* Clean up the desb handle, releasing the extra hold. */
+		dp->d_len = 0;
+		dp->d_cookie = 0;
+		dp->d_ref = 0;
+	}
+
+	VIONA_PROBE3(tx_drop, viona_vring_t *, ring, uint_t, len,
+	    uint16_t, cookie);
+	viona_tx_done(ring, len, cookie);
+}
diff --git a/usr/src/uts/i86pc/io/viona/viona.conf b/usr/src/uts/i86pc/io/viona/viona.conf
new file mode 100644
index 0000000000..e66488531a
--- /dev/null
+++ b/usr/src/uts/i86pc/io/viona/viona.conf
@@ -0,0 +1,14 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# Copyright 2013 Pluribus Networks Inc.
+#
+
+name="viona" parent="pseudo";
diff --git a/usr/src/uts/i86pc/io/vmm/README.sync b/usr/src/uts/i86pc/io/vmm/README.sync
new file mode 100644
index 0000000000..667f34b9de
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/README.sync
@@ -0,0 +1,22 @@
+The bhyve kernel module and its associated userland consumers have been updated
+to the latest upstream FreeBSD sources as of:
+
+commit 0fac2150fc0f1befa5803ca010ed63a6335847ad
+Author: grehan <grehan@FreeBSD.org>
+Date:   Fri May 4 01:36:49 2018 +0000
+
+    Allow arbitrary numbers of columns for VNC server screen resolution.
+
+    The prior code only allowed multiples of 32 for the
+    numbers of columns. Remove this restriction to allow
+    a forthcoming UEFI firmware update to allow arbitrary
+    x,y resolutions.
+
+    (the code for handling rows already supported non mult-32 values)
+
+    Reviewed by:    Leon Dang (original author)
+    MFC after:      3 weeks
+    Differential Revision:  https://reviews.freebsd.org/D15274
+
+
+Which corresponds to SVN revision: 333235
diff --git a/usr/src/uts/i86pc/io/vmm/amd/amdv.c b/usr/src/uts/i86pc/io/vmm/amd/amdv.c
new file mode 100644
index 0000000000..c34a1e897b
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/amdv.c
@@ -0,0 +1,148 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+
+#include <machine/vmm.h>
+#include "io/iommu.h"
+
+static int
+amd_iommu_init(void)
+{
+
+	printf("amd_iommu_init: not implemented\n");
+	return (ENXIO);
+}
+
+static void
+amd_iommu_cleanup(void)
+{
+
+	printf("amd_iommu_cleanup: not implemented\n");
+}
+
+static void
+amd_iommu_enable(void)
+{
+
+	printf("amd_iommu_enable: not implemented\n");
+}
+
+static void
+amd_iommu_disable(void)
+{
+
+	printf("amd_iommu_disable: not implemented\n");
+}
+
+static void *
+amd_iommu_create_domain(vm_paddr_t maxaddr)
+{
+
+	printf("amd_iommu_create_domain: not implemented\n");
+	return (NULL);
+}
+
+static void
+amd_iommu_destroy_domain(void *domain)
+{
+
+	printf("amd_iommu_destroy_domain: not implemented\n");
+}
+
+static uint64_t
+amd_iommu_create_mapping(void *domain, vm_paddr_t gpa, vm_paddr_t hpa,
+			 uint64_t len)
+{
+
+	printf("amd_iommu_create_mapping: not implemented\n");
+	return (0);
+}
+
+static uint64_t
+amd_iommu_remove_mapping(void *domain, vm_paddr_t gpa, uint64_t len)
+{
+
+	printf("amd_iommu_remove_mapping: not implemented\n");
+	return (0);
+}
+
+static void
+amd_iommu_add_device(void *domain, uint16_t rid)
+{
+
+	printf("amd_iommu_add_device: not implemented\n");
+}
+
+static void
+amd_iommu_remove_device(void *domain, uint16_t rid)
+{
+
+	printf("amd_iommu_remove_device: not implemented\n");
+}
+
+static void
+amd_iommu_invalidate_tlb(void *domain)
+{
+
+	printf("amd_iommu_invalidate_tlb: not implemented\n");
+}
+
+struct iommu_ops iommu_ops_amd = {
+	amd_iommu_init,
+	amd_iommu_cleanup,
+	amd_iommu_enable,
+	amd_iommu_disable,
+	amd_iommu_create_domain,
+	amd_iommu_destroy_domain,
+	amd_iommu_create_mapping,
+	amd_iommu_remove_mapping,
+	amd_iommu_add_device,
+	amd_iommu_remove_device,
+	amd_iommu_invalidate_tlb,
+};
diff --git a/usr/src/uts/i86pc/io/vmm/amd/npt.c b/usr/src/uts/i86pc/io/vmm/amd/npt.c
new file mode 100644
index 0000000000..e1c1b79e1b
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/npt.c
@@ -0,0 +1,85 @@
+/*-
+ * Copyright (c) 2013 Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/systm.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_extern.h>
+
+#include "npt.h"
+
+SYSCTL_DECL(_hw_vmm);
+SYSCTL_NODE(_hw_vmm, OID_AUTO, npt, CTLFLAG_RW, NULL, NULL);
+
+static int npt_flags;
+SYSCTL_INT(_hw_vmm_npt, OID_AUTO, pmap_flags, CTLFLAG_RD,
+	&npt_flags, 0, NULL);
+
+#define NPT_IPIMASK	0xFF
+
+/*
+ * AMD nested page table init.
+ */
+int
+svm_npt_init(int ipinum)
+{
+	int enable_superpage = 1;
+
+	npt_flags = ipinum & NPT_IPIMASK;
+	TUNABLE_INT_FETCH("hw.vmm.npt.enable_superpage", &enable_superpage);
+	if (enable_superpage)
+		npt_flags |= PMAP_PDE_SUPERPAGE; 
+	
+	return (0);
+}
+
+static int
+npt_pinit(pmap_t pmap)
+{
+
+	return (pmap_pinit_type(pmap, PT_RVI, npt_flags));
+}
+
+struct vmspace *
+svm_npt_alloc(vm_offset_t min, vm_offset_t max)
+{
+	
+	return (vmspace_alloc(min, max, npt_pinit));
+}
+
+void
+svm_npt_free(struct vmspace *vmspace)
+{
+
+	vmspace_free(vmspace);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/amd/npt.h b/usr/src/uts/i86pc/io/vmm/amd/npt.h
new file mode 100644
index 0000000000..5966474711
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/npt.h
@@ -0,0 +1,36 @@
+/*-
+ * Copyright (c) 2013 Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _SVM_NPT_H_
+#define _SVM_NPT_H_
+
+int 	svm_npt_init(int ipinum);
+struct	vmspace *svm_npt_alloc(vm_offset_t min, vm_offset_t max);
+void	svm_npt_free(struct vmspace *vmspace);
+
+#endif /* _SVM_NPT_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/amd/offsets.in b/usr/src/uts/i86pc/io/vmm/amd/offsets.in
new file mode 100644
index 0000000000..f8d2a716d7
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/offsets.in
@@ -0,0 +1,36 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+#include <sys/types.h>
+
+#include "amd/svm.h"
+
+svm_regctx
+	sctx_rbx	SCTX_RBX
+	sctx_rcx	SCTX_RCX
+	sctx_rbp	SCTX_RBP
+	sctx_rdx	SCTX_RDX
+	sctx_rdi	SCTX_RDI
+	sctx_rsi	SCTX_RSI
+	sctx_r8		SCTX_R8
+	sctx_r9		SCTX_R9
+	sctx_r10	SCTX_R10
+	sctx_r11	SCTX_R11
+	sctx_r12	SCTX_R12
+	sctx_r13	SCTX_R13
+	sctx_r14	SCTX_R14
+	sctx_r15	SCTX_R15
+
+/* Pull in definition for MSR_GSBASE */
+\#include <machine/specialreg.h>
diff --git a/usr/src/uts/i86pc/io/vmm/amd/svm.c b/usr/src/uts/i86pc/io/vmm/amd/svm.c
new file mode 100644
index 0000000000..f3ce78148b
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/svm.c
@@ -0,0 +1,2321 @@
+/*-
+ * Copyright (c) 2013, Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/smp.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/pcpu.h>
+#include <sys/proc.h>
+#include <sys/sysctl.h>
+
+#ifndef __FreeBSD__
+#include <sys/x86_archext.h>
+#endif
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+
+#include <machine/cpufunc.h>
+#include <machine/psl.h>
+#include <machine/md_var.h>
+#include <machine/specialreg.h>
+#include <machine/smp.h>
+#include <machine/vmm.h>
+#include <machine/vmm_dev.h>
+#include <machine/vmm_instruction_emul.h>
+
+#include "vmm_lapic.h"
+#include "vmm_stat.h"
+#include "vmm_ktr.h"
+#include "vmm_ioport.h"
+#include "vatpic.h"
+#include "vlapic.h"
+#include "vlapic_priv.h"
+
+#include "x86.h"
+#include "vmcb.h"
+#include "svm.h"
+#include "svm_softc.h"
+#include "svm_msr.h"
+#include "npt.h"
+
+SYSCTL_DECL(_hw_vmm);
+SYSCTL_NODE(_hw_vmm, OID_AUTO, svm, CTLFLAG_RW, NULL, NULL);
+
+/*
+ * SVM CPUID function 0x8000_000A, edx bit decoding.
+ */
+#define AMD_CPUID_SVM_NP		BIT(0)  /* Nested paging or RVI */
+#define AMD_CPUID_SVM_LBR		BIT(1)  /* Last branch virtualization */
+#define AMD_CPUID_SVM_SVML		BIT(2)  /* SVM lock */
+#define AMD_CPUID_SVM_NRIP_SAVE		BIT(3)  /* Next RIP is saved */
+#define AMD_CPUID_SVM_TSC_RATE		BIT(4)  /* TSC rate control. */
+#define AMD_CPUID_SVM_VMCB_CLEAN	BIT(5)  /* VMCB state caching */
+#define AMD_CPUID_SVM_FLUSH_BY_ASID	BIT(6)  /* Flush by ASID */
+#define AMD_CPUID_SVM_DECODE_ASSIST	BIT(7)  /* Decode assist */
+#define AMD_CPUID_SVM_PAUSE_INC		BIT(10) /* Pause intercept filter. */
+#define AMD_CPUID_SVM_PAUSE_FTH		BIT(12) /* Pause filter threshold */
+#define	AMD_CPUID_SVM_AVIC		BIT(13)	/* AVIC present */
+
+#define	VMCB_CACHE_DEFAULT	(VMCB_CACHE_ASID 	|	\
+				VMCB_CACHE_IOPM		|	\
+				VMCB_CACHE_I		|	\
+				VMCB_CACHE_TPR		|	\
+				VMCB_CACHE_CR2		|	\
+				VMCB_CACHE_CR		|	\
+				VMCB_CACHE_DR		|	\
+				VMCB_CACHE_DT		|	\
+				VMCB_CACHE_SEG		|	\
+				VMCB_CACHE_NP)
+
+static uint32_t vmcb_clean = VMCB_CACHE_DEFAULT;
+SYSCTL_INT(_hw_vmm_svm, OID_AUTO, vmcb_clean, CTLFLAG_RDTUN, &vmcb_clean,
+    0, NULL);
+
+static MALLOC_DEFINE(M_SVM, "svm", "svm");
+static MALLOC_DEFINE(M_SVM_VLAPIC, "svm-vlapic", "svm-vlapic");
+
+#ifdef __FreeBSD__
+/* Per-CPU context area. */
+extern struct pcpu __pcpu[];
+#endif
+
+static uint32_t svm_feature = ~0U;	/* AMD SVM features. */
+SYSCTL_UINT(_hw_vmm_svm, OID_AUTO, features, CTLFLAG_RDTUN, &svm_feature, 0,
+    "SVM features advertised by CPUID.8000000AH:EDX");
+
+static int disable_npf_assist;
+SYSCTL_INT(_hw_vmm_svm, OID_AUTO, disable_npf_assist, CTLFLAG_RWTUN,
+    &disable_npf_assist, 0, NULL);
+
+/* Maximum ASIDs supported by the processor */
+static uint32_t nasid;
+SYSCTL_UINT(_hw_vmm_svm, OID_AUTO, num_asids, CTLFLAG_RDTUN, &nasid, 0,
+    "Number of ASIDs supported by this processor");
+
+/* Current ASID generation for each host cpu */
+static struct asid asid[MAXCPU];
+
+/* 
+ * SVM host state saved area of size 4KB for each core.
+ */
+static uint8_t hsave[MAXCPU][PAGE_SIZE] __aligned(PAGE_SIZE);
+
+static VMM_STAT_AMD(VCPU_EXITINTINFO, "VM exits during event delivery");
+static VMM_STAT_AMD(VCPU_INTINFO_INJECTED, "Events pending at VM entry");
+static VMM_STAT_AMD(VMEXIT_VINTR, "VM exits due to interrupt window");
+
+static int svm_setreg(void *arg, int vcpu, int ident, uint64_t val);
+
+static __inline int
+flush_by_asid(void)
+{
+
+	return (svm_feature & AMD_CPUID_SVM_FLUSH_BY_ASID);
+}
+
+static __inline int
+decode_assist(void)
+{
+
+	return (svm_feature & AMD_CPUID_SVM_DECODE_ASSIST);
+}
+
+static void
+svm_disable(void *arg __unused)
+{
+	uint64_t efer;
+
+	efer = rdmsr(MSR_EFER);
+	efer &= ~EFER_SVM;
+	wrmsr(MSR_EFER, efer);
+}
+
+/*
+ * Disable SVM on all CPUs.
+ */
+static int
+svm_cleanup(void)
+{
+
+	smp_rendezvous(NULL, svm_disable, NULL, NULL);
+	return (0);
+}
+
+/*
+ * Verify that all the features required by bhyve are available.
+ */
+static int
+check_svm_features(void)
+{
+	u_int regs[4];
+
+	/* CPUID Fn8000_000A is for SVM */
+	do_cpuid(0x8000000A, regs);
+	svm_feature &= regs[3];
+
+	/*
+	 * The number of ASIDs can be configured to be less than what is
+	 * supported by the hardware but not more.
+	 */
+	if (nasid == 0 || nasid > regs[1])
+		nasid = regs[1];
+	KASSERT(nasid > 1, ("Insufficient ASIDs for guests: %#x", nasid));
+
+	/* bhyve requires the Nested Paging feature */
+	if (!(svm_feature & AMD_CPUID_SVM_NP)) {
+		printf("SVM: Nested Paging feature not available.\n");
+		return (ENXIO);
+	}
+
+	/* bhyve requires the NRIP Save feature */
+	if (!(svm_feature & AMD_CPUID_SVM_NRIP_SAVE)) {
+		printf("SVM: NRIP Save feature not available.\n");
+		return (ENXIO);
+	}
+
+	return (0);
+}
+
+static void
+svm_enable(void *arg __unused)
+{
+	uint64_t efer;
+
+	efer = rdmsr(MSR_EFER);
+	efer |= EFER_SVM;
+	wrmsr(MSR_EFER, efer);
+
+	wrmsr(MSR_VM_HSAVE_PA, vtophys(hsave[curcpu]));
+}
+
+/*
+ * Return 1 if SVM is enabled on this processor and 0 otherwise.
+ */
+static int
+svm_available(void)
+{
+	uint64_t msr;
+
+#ifdef __FreeBSD__
+	/* Section 15.4 Enabling SVM from APM2. */
+	if ((amd_feature2 & AMDID2_SVM) == 0) {
+		printf("SVM: not available.\n");
+		return (0);
+	}
+#else
+	if (!is_x86_feature(x86_featureset, X86FSET_SVM)) {
+		cmn_err(CE_WARN, "processor does not support SVM operation\n");
+		return (0);
+	}
+#endif
+
+	msr = rdmsr(MSR_VM_CR);
+	if ((msr & VM_CR_SVMDIS) != 0) {
+#ifdef __FreeBSD__
+		printf("SVM: disabled by BIOS.\n");
+#else
+		cmn_err(CE_WARN, "SVM disabled by BIOS.\n");
+#endif
+		return (0);
+	}
+
+	return (1);
+}
+
+static int
+svm_init(int ipinum)
+{
+	int error, cpu;
+
+	if (!svm_available())
+		return (ENXIO);
+
+	error = check_svm_features();
+	if (error)
+		return (error);
+
+	vmcb_clean &= VMCB_CACHE_DEFAULT;
+
+	for (cpu = 0; cpu < MAXCPU; cpu++) {
+		/*
+		 * Initialize the host ASIDs to their "highest" valid values.
+		 *
+		 * The next ASID allocation will rollover both 'gen' and 'num'
+		 * and start off the sequence at {1,1}.
+		 */
+		asid[cpu].gen = ~0UL;
+		asid[cpu].num = nasid - 1;
+	}
+
+	svm_msr_init();
+	svm_npt_init(ipinum);
+
+	/* Enable SVM on all CPUs */
+	smp_rendezvous(NULL, svm_enable, NULL, NULL);
+
+	return (0);
+}
+
+static void
+svm_restore(void)
+{
+
+	svm_enable(NULL);
+}		
+
+/* Pentium compatible MSRs */
+#define MSR_PENTIUM_START 	0	
+#define MSR_PENTIUM_END 	0x1FFF
+/* AMD 6th generation and Intel compatible MSRs */
+#define MSR_AMD6TH_START 	0xC0000000UL	
+#define MSR_AMD6TH_END 		0xC0001FFFUL	
+/* AMD 7th and 8th generation compatible MSRs */
+#define MSR_AMD7TH_START 	0xC0010000UL	
+#define MSR_AMD7TH_END 		0xC0011FFFUL	
+
+/*
+ * Get the index and bit position for a MSR in permission bitmap.
+ * Two bits are used for each MSR: lower bit for read and higher bit for write.
+ */
+static int
+svm_msr_index(uint64_t msr, int *index, int *bit)
+{
+	uint32_t base, off;
+
+	*index = -1;
+	*bit = (msr % 4) * 2;
+	base = 0;
+
+	if (msr <= MSR_PENTIUM_END) {
+		*index = msr / 4;
+		return (0);
+	}
+
+	base += (MSR_PENTIUM_END - MSR_PENTIUM_START + 1); 
+	if (msr >= MSR_AMD6TH_START && msr <= MSR_AMD6TH_END) {
+		off = (msr - MSR_AMD6TH_START); 
+		*index = (off + base) / 4;
+		return (0);
+	} 
+
+	base += (MSR_AMD6TH_END - MSR_AMD6TH_START + 1);
+	if (msr >= MSR_AMD7TH_START && msr <= MSR_AMD7TH_END) {
+		off = (msr - MSR_AMD7TH_START);
+		*index = (off + base) / 4;
+		return (0);
+	}
+
+	return (EINVAL);
+}
+
+/*
+ * Allow vcpu to read or write the 'msr' without trapping into the hypervisor.
+ */
+static void
+svm_msr_perm(uint8_t *perm_bitmap, uint64_t msr, bool read, bool write)
+{
+	int index, bit, error;
+
+	error = svm_msr_index(msr, &index, &bit);
+	KASSERT(error == 0, ("%s: invalid msr %#lx", __func__, msr));
+	KASSERT(index >= 0 && index < SVM_MSR_BITMAP_SIZE,
+	    ("%s: invalid index %d for msr %#lx", __func__, index, msr));
+	KASSERT(bit >= 0 && bit <= 6, ("%s: invalid bit position %d "
+	    "msr %#lx", __func__, bit, msr));
+
+	if (read)
+		perm_bitmap[index] &= ~(1UL << bit);
+
+	if (write)
+		perm_bitmap[index] &= ~(2UL << bit);
+}
+
+static void
+svm_msr_rw_ok(uint8_t *perm_bitmap, uint64_t msr)
+{
+
+	svm_msr_perm(perm_bitmap, msr, true, true);
+}
+
+static void
+svm_msr_rd_ok(uint8_t *perm_bitmap, uint64_t msr)
+{
+
+	svm_msr_perm(perm_bitmap, msr, true, false);
+}
+
+static __inline int
+svm_get_intercept(struct svm_softc *sc, int vcpu, int idx, uint32_t bitmask)
+{
+	struct vmcb_ctrl *ctrl;
+
+	KASSERT(idx >=0 && idx < 5, ("invalid intercept index %d", idx));
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+	return (ctrl->intercept[idx] & bitmask ? 1 : 0);
+}
+
+static __inline void
+svm_set_intercept(struct svm_softc *sc, int vcpu, int idx, uint32_t bitmask,
+    int enabled)
+{
+	struct vmcb_ctrl *ctrl;
+	uint32_t oldval;
+
+	KASSERT(idx >=0 && idx < 5, ("invalid intercept index %d", idx));
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+	oldval = ctrl->intercept[idx];
+
+	if (enabled)
+		ctrl->intercept[idx] |= bitmask;
+	else
+		ctrl->intercept[idx] &= ~bitmask;
+
+	if (ctrl->intercept[idx] != oldval) {
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_I);
+		VCPU_CTR3(sc->vm, vcpu, "intercept[%d] modified "
+		    "from %#x to %#x", idx, oldval, ctrl->intercept[idx]);
+	}
+}
+
+static __inline void
+svm_disable_intercept(struct svm_softc *sc, int vcpu, int off, uint32_t bitmask)
+{
+
+	svm_set_intercept(sc, vcpu, off, bitmask, 0);
+}
+
+static __inline void
+svm_enable_intercept(struct svm_softc *sc, int vcpu, int off, uint32_t bitmask)
+{
+
+	svm_set_intercept(sc, vcpu, off, bitmask, 1);
+}
+
+static void
+vmcb_init(struct svm_softc *sc, int vcpu, uint64_t iopm_base_pa,
+    uint64_t msrpm_base_pa, uint64_t np_pml4)
+{
+	struct vmcb_ctrl *ctrl;
+	struct vmcb_state *state;
+	uint32_t mask;
+	int n;
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+	state = svm_get_vmcb_state(sc, vcpu);
+
+	ctrl->iopm_base_pa = iopm_base_pa;
+	ctrl->msrpm_base_pa = msrpm_base_pa;
+
+	/* Enable nested paging */
+	ctrl->np_enable = 1;
+	ctrl->n_cr3 = np_pml4;
+
+	/*
+	 * Intercept accesses to the control registers that are not shadowed
+	 * in the VMCB - i.e. all except cr0, cr2, cr3, cr4 and cr8.
+	 */
+	for (n = 0; n < 16; n++) {
+		mask = (BIT(n) << 16) | BIT(n);
+		if (n == 0 || n == 2 || n == 3 || n == 4 || n == 8)
+			svm_disable_intercept(sc, vcpu, VMCB_CR_INTCPT, mask);
+		else
+			svm_enable_intercept(sc, vcpu, VMCB_CR_INTCPT, mask);
+	}
+
+
+	/*
+	 * Intercept everything when tracing guest exceptions otherwise
+	 * just intercept machine check exception.
+	 */
+	if (vcpu_trace_exceptions(sc->vm, vcpu)) {
+		for (n = 0; n < 32; n++) {
+			/*
+			 * Skip unimplemented vectors in the exception bitmap.
+			 */
+			if (n == 2 || n == 9) {
+				continue;
+			}
+			svm_enable_intercept(sc, vcpu, VMCB_EXC_INTCPT, BIT(n));
+		}
+	} else {
+		svm_enable_intercept(sc, vcpu, VMCB_EXC_INTCPT, BIT(IDT_MC));
+	}
+
+	/* Intercept various events (for e.g. I/O, MSR and CPUID accesses) */
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_IO);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_MSR);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_CPUID);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_INTR);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_INIT);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_NMI);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_SMI);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_SHUTDOWN);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT,
+	    VMCB_INTCPT_FERR_FREEZE);
+
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL2_INTCPT, VMCB_INTCPT_MONITOR);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL2_INTCPT, VMCB_INTCPT_MWAIT);
+
+	/*
+	 * From section "Canonicalization and Consistency Checks" in APMv2
+	 * the VMRUN intercept bit must be set to pass the consistency check.
+	 */
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL2_INTCPT, VMCB_INTCPT_VMRUN);
+
+	/*
+	 * The ASID will be set to a non-zero value just before VMRUN.
+	 */
+	ctrl->asid = 0;
+
+	/*
+	 * Section 15.21.1, Interrupt Masking in EFLAGS
+	 * Section 15.21.2, Virtualizing APIC.TPR
+	 *
+	 * This must be set for %rflag and %cr8 isolation of guest and host.
+	 */
+	ctrl->v_intr_masking = 1;
+
+	/* Enable Last Branch Record aka LBR for debugging */
+	ctrl->lbr_virt_en = 1;
+	state->dbgctl = BIT(0);
+
+	/* EFER_SVM must always be set when the guest is executing */
+	state->efer = EFER_SVM;
+
+	/* Set up the PAT to power-on state */
+	state->g_pat = PAT_VALUE(0, PAT_WRITE_BACK)	|
+	    PAT_VALUE(1, PAT_WRITE_THROUGH)	|
+	    PAT_VALUE(2, PAT_UNCACHED)		|
+	    PAT_VALUE(3, PAT_UNCACHEABLE)	|
+	    PAT_VALUE(4, PAT_WRITE_BACK)	|
+	    PAT_VALUE(5, PAT_WRITE_THROUGH)	|
+	    PAT_VALUE(6, PAT_UNCACHED)		|
+	    PAT_VALUE(7, PAT_UNCACHEABLE);
+
+	/* Set up DR6/7 to power-on state */
+	state->dr6 = 0xffff0ff0;
+	state->dr7 = 0x400;
+}
+
+/*
+ * Initialize a virtual machine.
+ */
+static void *
+svm_vminit(struct vm *vm, pmap_t pmap)
+{
+	struct svm_softc *svm_sc;
+	struct svm_vcpu *vcpu;
+	vm_paddr_t msrpm_pa, iopm_pa, pml4_pa;
+	int i;
+
+	svm_sc = malloc(sizeof (*svm_sc), M_SVM, M_WAITOK | M_ZERO);
+	if (((uintptr_t)svm_sc & PAGE_MASK) != 0)
+		panic("malloc of svm_softc not aligned on page boundary");
+
+	svm_sc->msr_bitmap = contigmalloc(SVM_MSR_BITMAP_SIZE, M_SVM,
+	    M_WAITOK, 0, ~(vm_paddr_t)0, PAGE_SIZE, 0);
+	if (svm_sc->msr_bitmap == NULL)
+		panic("contigmalloc of SVM MSR bitmap failed");
+	svm_sc->iopm_bitmap = contigmalloc(SVM_IO_BITMAP_SIZE, M_SVM,
+	    M_WAITOK, 0, ~(vm_paddr_t)0, PAGE_SIZE, 0);
+	if (svm_sc->iopm_bitmap == NULL)
+		panic("contigmalloc of SVM IO bitmap failed");
+
+	svm_sc->vm = vm;
+	svm_sc->nptp = (vm_offset_t)vtophys(pmap->pm_pml4);
+
+	/*
+	 * Intercept read and write accesses to all MSRs.
+	 */
+	memset(svm_sc->msr_bitmap, 0xFF, SVM_MSR_BITMAP_SIZE);
+
+	/*
+	 * Access to the following MSRs is redirected to the VMCB when the
+	 * guest is executing. Therefore it is safe to allow the guest to
+	 * read/write these MSRs directly without hypervisor involvement.
+	 */
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_GSBASE);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_FSBASE);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_KGSBASE);
+
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_STAR);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_LSTAR);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_CSTAR);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_SF_MASK);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_SYSENTER_CS_MSR);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_SYSENTER_ESP_MSR);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_SYSENTER_EIP_MSR);
+	svm_msr_rw_ok(svm_sc->msr_bitmap, MSR_PAT);
+
+	svm_msr_rd_ok(svm_sc->msr_bitmap, MSR_TSC);
+
+	/*
+	 * Intercept writes to make sure that the EFER_SVM bit is not cleared.
+	 */
+	svm_msr_rd_ok(svm_sc->msr_bitmap, MSR_EFER);
+
+	/* Intercept access to all I/O ports. */
+	memset(svm_sc->iopm_bitmap, 0xFF, SVM_IO_BITMAP_SIZE);
+
+	iopm_pa = vtophys(svm_sc->iopm_bitmap);
+	msrpm_pa = vtophys(svm_sc->msr_bitmap);
+	pml4_pa = svm_sc->nptp;
+	for (i = 0; i < VM_MAXCPU; i++) {
+		vcpu = svm_get_vcpu(svm_sc, i);
+		vcpu->nextrip = ~0;
+		vcpu->lastcpu = NOCPU;
+		vcpu->vmcb_pa = vtophys(&vcpu->vmcb);
+		vmcb_init(svm_sc, i, iopm_pa, msrpm_pa, pml4_pa);
+		svm_msr_guest_init(svm_sc, i);
+	}
+	return (svm_sc);
+}
+
+/*
+ * Collateral for a generic SVM VM-exit.
+ */
+static void
+vm_exit_svm(struct vm_exit *vme, uint64_t code, uint64_t info1, uint64_t info2)
+{
+
+	vme->exitcode = VM_EXITCODE_SVM;
+	vme->u.svm.exitcode = code;
+	vme->u.svm.exitinfo1 = info1;
+	vme->u.svm.exitinfo2 = info2;
+}
+
+static int
+svm_cpl(struct vmcb_state *state)
+{
+
+	/*
+	 * From APMv2:
+	 *   "Retrieve the CPL from the CPL field in the VMCB, not
+	 *    from any segment DPL"
+	 */
+	return (state->cpl);
+}
+
+static enum vm_cpu_mode
+svm_vcpu_mode(struct vmcb *vmcb)
+{
+	struct vmcb_segment seg;
+	struct vmcb_state *state;
+	int error;
+
+	state = &vmcb->state;
+
+	if (state->efer & EFER_LMA) {
+		error = vmcb_seg(vmcb, VM_REG_GUEST_CS, &seg);
+		KASSERT(error == 0, ("%s: vmcb_seg(cs) error %d", __func__,
+		    error));
+
+		/*
+		 * Section 4.8.1 for APM2, check if Code Segment has
+		 * Long attribute set in descriptor.
+		 */
+		if (seg.attrib & VMCB_CS_ATTRIB_L)
+			return (CPU_MODE_64BIT);
+		else
+			return (CPU_MODE_COMPATIBILITY);
+	} else  if (state->cr0 & CR0_PE) {
+		return (CPU_MODE_PROTECTED);
+	} else {
+		return (CPU_MODE_REAL);
+	}
+}
+
+static enum vm_paging_mode
+svm_paging_mode(uint64_t cr0, uint64_t cr4, uint64_t efer)
+{
+
+	if ((cr0 & CR0_PG) == 0)
+		return (PAGING_MODE_FLAT);
+	if ((cr4 & CR4_PAE) == 0)
+		return (PAGING_MODE_32);
+	if (efer & EFER_LME)
+		return (PAGING_MODE_64);
+	else
+		return (PAGING_MODE_PAE);
+}
+
+/*
+ * ins/outs utility routines
+ */
+static uint64_t
+svm_inout_str_index(struct svm_regctx *regs, int in)
+{
+	uint64_t val;
+
+	val = in ? regs->sctx_rdi : regs->sctx_rsi;
+
+	return (val);
+}
+
+static uint64_t
+svm_inout_str_count(struct svm_regctx *regs, int rep)
+{
+	uint64_t val;
+
+	val = rep ? regs->sctx_rcx : 1;
+
+	return (val);
+}
+
+static void
+svm_inout_str_seginfo(struct svm_softc *svm_sc, int vcpu, int64_t info1,
+    int in, struct vm_inout_str *vis)
+{
+	int error, s;
+
+	if (in) {
+		vis->seg_name = VM_REG_GUEST_ES;
+	} else {
+		/* The segment field has standard encoding */
+		s = (info1 >> 10) & 0x7;
+		vis->seg_name = vm_segment_name(s);
+	}
+
+	error = vmcb_getdesc(svm_sc, vcpu, vis->seg_name, &vis->seg_desc);
+	KASSERT(error == 0, ("%s: svm_getdesc error %d", __func__, error));
+}
+
+static int
+svm_inout_str_addrsize(uint64_t info1)
+{
+        uint32_t size;
+
+        size = (info1 >> 7) & 0x7;
+        switch (size) {
+        case 1:
+                return (2);     /* 16 bit */
+        case 2:
+                return (4);     /* 32 bit */
+        case 4:
+                return (8);     /* 64 bit */
+        default:
+                panic("%s: invalid size encoding %d", __func__, size);
+        }
+}
+
+static void
+svm_paging_info(struct vmcb *vmcb, struct vm_guest_paging *paging)
+{
+	struct vmcb_state *state;
+
+	state = &vmcb->state;
+	paging->cr3 = state->cr3;
+	paging->cpl = svm_cpl(state);
+	paging->cpu_mode = svm_vcpu_mode(vmcb);
+	paging->paging_mode = svm_paging_mode(state->cr0, state->cr4,
+	    state->efer);
+}
+
+#define	UNHANDLED 0
+
+/*
+ * Handle guest I/O intercept.
+ */
+static int
+svm_handle_io(struct svm_softc *svm_sc, int vcpu, struct vm_exit *vmexit)
+{
+	struct vmcb_ctrl *ctrl;
+	struct vmcb_state *state;
+	struct svm_regctx *regs;
+	struct vm_inout_str *vis;
+	uint64_t info1;
+	int inout_string;
+
+	state = svm_get_vmcb_state(svm_sc, vcpu);
+	ctrl  = svm_get_vmcb_ctrl(svm_sc, vcpu);
+	regs  = svm_get_guest_regctx(svm_sc, vcpu);
+
+	info1 = ctrl->exitinfo1;
+	inout_string = info1 & BIT(2) ? 1 : 0;
+
+	/*
+	 * The effective segment number in EXITINFO1[12:10] is populated
+	 * only if the processor has the DecodeAssist capability.
+	 *
+	 * XXX this is not specified explicitly in APMv2 but can be verified
+	 * empirically.
+	 */
+	if (inout_string && !decode_assist())
+		return (UNHANDLED);
+
+	vmexit->exitcode 	= VM_EXITCODE_INOUT;
+	vmexit->u.inout.in 	= (info1 & BIT(0)) ? 1 : 0;
+	vmexit->u.inout.string 	= inout_string;
+	vmexit->u.inout.rep 	= (info1 & BIT(3)) ? 1 : 0;
+	vmexit->u.inout.bytes 	= (info1 >> 4) & 0x7;
+	vmexit->u.inout.port 	= (uint16_t)(info1 >> 16);
+	vmexit->u.inout.eax 	= (uint32_t)(state->rax);
+
+	if (inout_string) {
+		vmexit->exitcode = VM_EXITCODE_INOUT_STR;
+		vis = &vmexit->u.inout_str;
+		svm_paging_info(svm_get_vmcb(svm_sc, vcpu), &vis->paging);
+		vis->rflags = state->rflags;
+		vis->cr0 = state->cr0;
+		vis->index = svm_inout_str_index(regs, vmexit->u.inout.in);
+		vis->count = svm_inout_str_count(regs, vmexit->u.inout.rep);
+		vis->addrsize = svm_inout_str_addrsize(info1);
+		svm_inout_str_seginfo(svm_sc, vcpu, info1,
+		    vmexit->u.inout.in, vis);
+	}
+
+	return (UNHANDLED);
+}
+
+static int
+npf_fault_type(uint64_t exitinfo1)
+{
+
+	if (exitinfo1 & VMCB_NPF_INFO1_W)
+		return (VM_PROT_WRITE);
+	else if (exitinfo1 & VMCB_NPF_INFO1_ID)
+		return (VM_PROT_EXECUTE);
+	else
+		return (VM_PROT_READ);
+}
+
+static bool
+svm_npf_emul_fault(uint64_t exitinfo1)
+{
+	
+	if (exitinfo1 & VMCB_NPF_INFO1_ID) {
+		return (false);
+	}
+
+	if (exitinfo1 & VMCB_NPF_INFO1_GPT) {
+		return (false);
+	}
+
+	if ((exitinfo1 & VMCB_NPF_INFO1_GPA) == 0) {
+		return (false);
+	}
+
+	return (true);	
+}
+
+static void
+svm_handle_inst_emul(struct vmcb *vmcb, uint64_t gpa, struct vm_exit *vmexit)
+{
+	struct vm_guest_paging *paging;
+	struct vmcb_segment seg;
+	struct vmcb_ctrl *ctrl;
+	char *inst_bytes;
+	int error, inst_len;
+
+	ctrl = &vmcb->ctrl;
+	paging = &vmexit->u.inst_emul.paging;
+
+	vmexit->exitcode = VM_EXITCODE_INST_EMUL;
+	vmexit->u.inst_emul.gpa = gpa;
+	vmexit->u.inst_emul.gla = VIE_INVALID_GLA;
+	svm_paging_info(vmcb, paging);
+
+	error = vmcb_seg(vmcb, VM_REG_GUEST_CS, &seg);
+	KASSERT(error == 0, ("%s: vmcb_seg(CS) error %d", __func__, error));
+
+	switch(paging->cpu_mode) {
+	case CPU_MODE_REAL:
+		vmexit->u.inst_emul.cs_base = seg.base;
+		vmexit->u.inst_emul.cs_d = 0;
+		break;
+	case CPU_MODE_PROTECTED:
+	case CPU_MODE_COMPATIBILITY:
+		vmexit->u.inst_emul.cs_base = seg.base;
+
+		/*
+		 * Section 4.8.1 of APM2, Default Operand Size or D bit.
+		 */
+		vmexit->u.inst_emul.cs_d = (seg.attrib & VMCB_CS_ATTRIB_D) ?
+		    1 : 0;
+		break;
+	default:
+		vmexit->u.inst_emul.cs_base = 0;
+		vmexit->u.inst_emul.cs_d = 0;
+		break;	
+	}
+
+	/*
+	 * Copy the instruction bytes into 'vie' if available.
+	 */
+	if (decode_assist() && !disable_npf_assist) {
+		inst_len = ctrl->inst_len;
+		inst_bytes = (char *)ctrl->inst_bytes;
+	} else {
+		inst_len = 0;
+		inst_bytes = NULL;
+	}
+	vie_init(&vmexit->u.inst_emul.vie, inst_bytes, inst_len);
+}
+
+#ifdef KTR
+static const char *
+intrtype_to_str(int intr_type)
+{
+	switch (intr_type) {
+	case VMCB_EVENTINJ_TYPE_INTR:
+		return ("hwintr");
+	case VMCB_EVENTINJ_TYPE_NMI:
+		return ("nmi");
+	case VMCB_EVENTINJ_TYPE_INTn:
+		return ("swintr");
+	case VMCB_EVENTINJ_TYPE_EXCEPTION:
+		return ("exception");
+	default:
+		panic("%s: unknown intr_type %d", __func__, intr_type);
+	}
+}
+#endif
+
+/*
+ * Inject an event to vcpu as described in section 15.20, "Event injection".
+ */
+static void
+svm_eventinject(struct svm_softc *sc, int vcpu, int intr_type, int vector,
+		 uint32_t error, bool ec_valid)
+{
+	struct vmcb_ctrl *ctrl;
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+
+	KASSERT((ctrl->eventinj & VMCB_EVENTINJ_VALID) == 0,
+	    ("%s: event already pending %#lx", __func__, ctrl->eventinj));
+
+	KASSERT(vector >=0 && vector <= 255, ("%s: invalid vector %d",
+	    __func__, vector));
+
+	switch (intr_type) {
+	case VMCB_EVENTINJ_TYPE_INTR:
+	case VMCB_EVENTINJ_TYPE_NMI:
+	case VMCB_EVENTINJ_TYPE_INTn:
+		break;
+	case VMCB_EVENTINJ_TYPE_EXCEPTION:
+		if (vector >= 0 && vector <= 31 && vector != 2)
+			break;
+		/* FALLTHROUGH */
+	default:
+		panic("%s: invalid intr_type/vector: %d/%d", __func__,
+		    intr_type, vector);
+	}
+	ctrl->eventinj = vector | (intr_type << 8) | VMCB_EVENTINJ_VALID;
+	if (ec_valid) {
+		ctrl->eventinj |= VMCB_EVENTINJ_EC_VALID;
+		ctrl->eventinj |= (uint64_t)error << 32;
+		VCPU_CTR3(sc->vm, vcpu, "Injecting %s at vector %d errcode %#x",
+		    intrtype_to_str(intr_type), vector, error);
+	} else {
+		VCPU_CTR2(sc->vm, vcpu, "Injecting %s at vector %d",
+		    intrtype_to_str(intr_type), vector);
+	}
+}
+
+static void
+svm_update_virqinfo(struct svm_softc *sc, int vcpu)
+{
+	struct vm *vm;
+	struct vlapic *vlapic;
+	struct vmcb_ctrl *ctrl;
+
+	vm = sc->vm;
+	vlapic = vm_lapic(vm, vcpu);
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+
+	/* Update %cr8 in the emulated vlapic */
+	vlapic_set_cr8(vlapic, ctrl->v_tpr);
+
+	/* Virtual interrupt injection is not used. */
+	KASSERT(ctrl->v_intr_vector == 0, ("%s: invalid "
+	    "v_intr_vector %d", __func__, ctrl->v_intr_vector));
+}
+
+static void
+svm_save_intinfo(struct svm_softc *svm_sc, int vcpu)
+{
+	struct vmcb_ctrl *ctrl;
+	uint64_t intinfo;
+
+	ctrl  = svm_get_vmcb_ctrl(svm_sc, vcpu);
+	intinfo = ctrl->exitintinfo;	
+	if (!VMCB_EXITINTINFO_VALID(intinfo))
+		return;
+
+	/*
+	 * From APMv2, Section "Intercepts during IDT interrupt delivery"
+	 *
+	 * If a #VMEXIT happened during event delivery then record the event
+	 * that was being delivered.
+	 */
+	VCPU_CTR2(svm_sc->vm, vcpu, "SVM:Pending INTINFO(0x%lx), vector=%d.\n",
+		intinfo, VMCB_EXITINTINFO_VECTOR(intinfo));
+	vmm_stat_incr(svm_sc->vm, vcpu, VCPU_EXITINTINFO, 1);
+	vm_exit_intinfo(svm_sc->vm, vcpu, intinfo);
+}
+
+static __inline int
+vintr_intercept_enabled(struct svm_softc *sc, int vcpu)
+{
+
+	return (svm_get_intercept(sc, vcpu, VMCB_CTRL1_INTCPT,
+	    VMCB_INTCPT_VINTR));
+}
+
+static __inline void
+enable_intr_window_exiting(struct svm_softc *sc, int vcpu)
+{
+	struct vmcb_ctrl *ctrl;
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+
+	if (ctrl->v_irq && ctrl->v_intr_vector == 0) {
+		KASSERT(ctrl->v_ign_tpr, ("%s: invalid v_ign_tpr", __func__));
+		KASSERT(vintr_intercept_enabled(sc, vcpu),
+		    ("%s: vintr intercept should be enabled", __func__));
+		return;
+	}
+
+	VCPU_CTR0(sc->vm, vcpu, "Enable intr window exiting");
+	ctrl->v_irq = 1;
+	ctrl->v_ign_tpr = 1;
+	ctrl->v_intr_vector = 0;
+	svm_set_dirty(sc, vcpu, VMCB_CACHE_TPR);
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_VINTR);
+}
+
+static __inline void
+disable_intr_window_exiting(struct svm_softc *sc, int vcpu)
+{
+	struct vmcb_ctrl *ctrl;
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+
+	if (!ctrl->v_irq && ctrl->v_intr_vector == 0) {
+		KASSERT(!vintr_intercept_enabled(sc, vcpu),
+		    ("%s: vintr intercept should be disabled", __func__));
+		return;
+	}
+
+	VCPU_CTR0(sc->vm, vcpu, "Disable intr window exiting");
+	ctrl->v_irq = 0;
+	ctrl->v_intr_vector = 0;
+	svm_set_dirty(sc, vcpu, VMCB_CACHE_TPR);
+	svm_disable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_VINTR);
+}
+
+static int
+svm_modify_intr_shadow(struct svm_softc *sc, int vcpu, uint64_t val)
+{
+	struct vmcb_ctrl *ctrl;
+	int oldval, newval;
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+	oldval = ctrl->intr_shadow;
+	newval = val ? 1 : 0;
+	if (newval != oldval) {
+		ctrl->intr_shadow = newval;
+		VCPU_CTR1(sc->vm, vcpu, "Setting intr_shadow to %d", newval);
+	}
+	return (0);
+}
+
+static int
+svm_get_intr_shadow(struct svm_softc *sc, int vcpu, uint64_t *val)
+{
+	struct vmcb_ctrl *ctrl;
+
+	ctrl = svm_get_vmcb_ctrl(sc, vcpu);
+	*val = ctrl->intr_shadow;
+	return (0);
+}
+
+/*
+ * Once an NMI is injected it blocks delivery of further NMIs until the handler
+ * executes an IRET. The IRET intercept is enabled when an NMI is injected to
+ * to track when the vcpu is done handling the NMI.
+ */
+static int
+nmi_blocked(struct svm_softc *sc, int vcpu)
+{
+	int blocked;
+
+	blocked = svm_get_intercept(sc, vcpu, VMCB_CTRL1_INTCPT,
+	    VMCB_INTCPT_IRET);
+	return (blocked);
+}
+
+static void
+enable_nmi_blocking(struct svm_softc *sc, int vcpu)
+{
+
+	KASSERT(!nmi_blocked(sc, vcpu), ("vNMI already blocked"));
+	VCPU_CTR0(sc->vm, vcpu, "vNMI blocking enabled");
+	svm_enable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_IRET);
+}
+
+static void
+clear_nmi_blocking(struct svm_softc *sc, int vcpu)
+{
+	int error;
+
+	KASSERT(nmi_blocked(sc, vcpu), ("vNMI already unblocked"));
+	VCPU_CTR0(sc->vm, vcpu, "vNMI blocking cleared");
+	/*
+	 * When the IRET intercept is cleared the vcpu will attempt to execute
+	 * the "iret" when it runs next. However, it is possible to inject
+	 * another NMI into the vcpu before the "iret" has actually executed.
+	 *
+	 * For e.g. if the "iret" encounters a #NPF when accessing the stack
+	 * it will trap back into the hypervisor. If an NMI is pending for
+	 * the vcpu it will be injected into the guest.
+	 *
+	 * XXX this needs to be fixed
+	 */
+	svm_disable_intercept(sc, vcpu, VMCB_CTRL1_INTCPT, VMCB_INTCPT_IRET);
+
+	/*
+	 * Set 'intr_shadow' to prevent an NMI from being injected on the
+	 * immediate VMRUN.
+	 */
+	error = svm_modify_intr_shadow(sc, vcpu, 1);
+	KASSERT(!error, ("%s: error %d setting intr_shadow", __func__, error));
+}
+
+#define	EFER_MBZ_BITS	0xFFFFFFFFFFFF0200UL
+
+static int
+svm_write_efer(struct svm_softc *sc, int vcpu, uint64_t newval, bool *retu)
+{
+	struct vm_exit *vme;
+	struct vmcb_state *state;
+	uint64_t changed, lma, oldval;
+	int error;
+
+	state = svm_get_vmcb_state(sc, vcpu);
+
+	oldval = state->efer;
+	VCPU_CTR2(sc->vm, vcpu, "wrmsr(efer) %#lx/%#lx", oldval, newval);
+
+	newval &= ~0xFE;		/* clear the Read-As-Zero (RAZ) bits */
+	changed = oldval ^ newval;
+
+	if (newval & EFER_MBZ_BITS)
+		goto gpf;
+
+	/* APMv2 Table 14-5 "Long-Mode Consistency Checks" */
+	if (changed & EFER_LME) {
+		if (state->cr0 & CR0_PG)
+			goto gpf;
+	}
+
+	/* EFER.LMA = EFER.LME & CR0.PG */
+	if ((newval & EFER_LME) != 0 && (state->cr0 & CR0_PG) != 0)
+		lma = EFER_LMA;
+	else
+		lma = 0;
+
+	if ((newval & EFER_LMA) != lma)
+		goto gpf;
+
+	if (newval & EFER_NXE) {
+		if (!vm_cpuid_capability(sc->vm, vcpu, VCC_NO_EXECUTE))
+			goto gpf;
+	}
+
+	/*
+	 * XXX bhyve does not enforce segment limits in 64-bit mode. Until
+	 * this is fixed flag guest attempt to set EFER_LMSLE as an error.
+	 */
+	if (newval & EFER_LMSLE) {
+		vme = vm_exitinfo(sc->vm, vcpu);
+		vm_exit_svm(vme, VMCB_EXIT_MSR, 1, 0);
+		*retu = true;
+		return (0);
+	}
+
+	if (newval & EFER_FFXSR) {
+		if (!vm_cpuid_capability(sc->vm, vcpu, VCC_FFXSR))
+			goto gpf;
+	}
+
+	if (newval & EFER_TCE) {
+		if (!vm_cpuid_capability(sc->vm, vcpu, VCC_TCE))
+			goto gpf;
+	}
+
+	error = svm_setreg(sc, vcpu, VM_REG_GUEST_EFER, newval);
+	KASSERT(error == 0, ("%s: error %d updating efer", __func__, error));
+	return (0);
+gpf:
+	vm_inject_gp(sc->vm, vcpu);
+	return (0);
+}
+
+static int
+emulate_wrmsr(struct svm_softc *sc, int vcpu, u_int num, uint64_t val,
+    bool *retu)
+{
+	int error;
+
+	if (lapic_msr(num))
+		error = lapic_wrmsr(sc->vm, vcpu, num, val, retu);
+	else if (num == MSR_EFER)
+		error = svm_write_efer(sc, vcpu, val, retu);
+	else
+		error = svm_wrmsr(sc, vcpu, num, val, retu);
+
+	return (error);
+}
+
+static int
+emulate_rdmsr(struct svm_softc *sc, int vcpu, u_int num, bool *retu)
+{
+	struct vmcb_state *state;
+	struct svm_regctx *ctx;
+	uint64_t result;
+	int error;
+
+	if (lapic_msr(num))
+		error = lapic_rdmsr(sc->vm, vcpu, num, &result, retu);
+	else
+		error = svm_rdmsr(sc, vcpu, num, &result, retu);
+
+	if (error == 0) {
+		state = svm_get_vmcb_state(sc, vcpu);
+		ctx = svm_get_guest_regctx(sc, vcpu);
+		state->rax = result & 0xffffffff;
+		ctx->sctx_rdx = result >> 32;
+	}
+
+	return (error);
+}
+
+#ifdef KTR
+static const char *
+exit_reason_to_str(uint64_t reason)
+{
+	static char reasonbuf[32];
+
+	switch (reason) {
+	case VMCB_EXIT_INVALID:
+		return ("invalvmcb");
+	case VMCB_EXIT_SHUTDOWN:
+		return ("shutdown");
+	case VMCB_EXIT_NPF:
+		return ("nptfault");
+	case VMCB_EXIT_PAUSE:
+		return ("pause");
+	case VMCB_EXIT_HLT:
+		return ("hlt");
+	case VMCB_EXIT_CPUID:
+		return ("cpuid");
+	case VMCB_EXIT_IO:
+		return ("inout");
+	case VMCB_EXIT_MC:
+		return ("mchk");
+	case VMCB_EXIT_INTR:
+		return ("extintr");
+	case VMCB_EXIT_NMI:
+		return ("nmi");
+	case VMCB_EXIT_VINTR:
+		return ("vintr");
+	case VMCB_EXIT_MSR:
+		return ("msr");
+	case VMCB_EXIT_IRET:
+		return ("iret");
+	case VMCB_EXIT_MONITOR:
+		return ("monitor");
+	case VMCB_EXIT_MWAIT:
+		return ("mwait");
+	default:
+		snprintf(reasonbuf, sizeof(reasonbuf), "%#lx", reason);
+		return (reasonbuf);
+	}
+}
+#endif	/* KTR */
+
+/*
+ * From section "State Saved on Exit" in APMv2: nRIP is saved for all #VMEXITs
+ * that are due to instruction intercepts as well as MSR and IOIO intercepts
+ * and exceptions caused by INT3, INTO and BOUND instructions.
+ *
+ * Return 1 if the nRIP is valid and 0 otherwise.
+ */
+static int
+nrip_valid(uint64_t exitcode)
+{
+	switch (exitcode) {
+	case 0x00 ... 0x0F:	/* read of CR0 through CR15 */
+	case 0x10 ... 0x1F:	/* write of CR0 through CR15 */
+	case 0x20 ... 0x2F:	/* read of DR0 through DR15 */
+	case 0x30 ... 0x3F:	/* write of DR0 through DR15 */
+	case 0x43:		/* INT3 */
+	case 0x44:		/* INTO */
+	case 0x45:		/* BOUND */
+	case 0x65 ... 0x7C:	/* VMEXIT_CR0_SEL_WRITE ... VMEXIT_MSR */
+	case 0x80 ... 0x8D:	/* VMEXIT_VMRUN ... VMEXIT_XSETBV */
+		return (1);
+	default:
+		return (0);
+	}
+}
+
+static int
+svm_vmexit(struct svm_softc *svm_sc, int vcpu, struct vm_exit *vmexit)
+{
+	struct vmcb *vmcb;
+	struct vmcb_state *state;
+	struct vmcb_ctrl *ctrl;
+	struct svm_regctx *ctx;
+	uint64_t code, info1, info2, val;
+	uint32_t eax, ecx, edx;
+	int error, errcode_valid, handled, idtvec, reflect;
+	bool retu;
+
+	ctx = svm_get_guest_regctx(svm_sc, vcpu);
+	vmcb = svm_get_vmcb(svm_sc, vcpu);
+	state = &vmcb->state;
+	ctrl = &vmcb->ctrl;
+
+	handled = 0;
+	code = ctrl->exitcode;
+	info1 = ctrl->exitinfo1;
+	info2 = ctrl->exitinfo2;
+
+	vmexit->exitcode = VM_EXITCODE_BOGUS;
+	vmexit->rip = state->rip;
+	vmexit->inst_length = nrip_valid(code) ? ctrl->nrip - state->rip : 0;
+
+	vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_COUNT, 1);
+
+	/*
+	 * #VMEXIT(INVALID) needs to be handled early because the VMCB is
+	 * in an inconsistent state and can trigger assertions that would
+	 * never happen otherwise.
+	 */
+	if (code == VMCB_EXIT_INVALID) {
+		vm_exit_svm(vmexit, code, info1, info2);
+		return (0);
+	}
+
+	KASSERT((ctrl->eventinj & VMCB_EVENTINJ_VALID) == 0, ("%s: event "
+	    "injection valid bit is set %#lx", __func__, ctrl->eventinj));
+
+	KASSERT(vmexit->inst_length >= 0 && vmexit->inst_length <= 15,
+	    ("invalid inst_length %d: code (%#lx), info1 (%#lx), info2 (%#lx)",
+	    vmexit->inst_length, code, info1, info2));
+
+	svm_update_virqinfo(svm_sc, vcpu);
+	svm_save_intinfo(svm_sc, vcpu);
+
+	switch (code) {
+	case VMCB_EXIT_IRET:
+		/*
+		 * Restart execution at "iret" but with the intercept cleared.
+		 */
+		vmexit->inst_length = 0;
+		clear_nmi_blocking(svm_sc, vcpu);
+		handled = 1;
+		break;
+	case VMCB_EXIT_VINTR:	/* interrupt window exiting */
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_VINTR, 1);
+		handled = 1;
+		break;
+	case VMCB_EXIT_INTR:	/* external interrupt */
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_EXTINT, 1);
+		handled = 1;
+		break;
+	case VMCB_EXIT_NMI:	/* external NMI */
+		handled = 1;
+		break;
+	case 0x40 ... 0x5F:
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_EXCEPTION, 1);
+		reflect = 1;
+		idtvec = code - 0x40;
+		switch (idtvec) {
+		case IDT_MC:
+			/*
+			 * Call the machine check handler by hand. Also don't
+			 * reflect the machine check back into the guest.
+			 */
+			reflect = 0;
+			VCPU_CTR0(svm_sc->vm, vcpu, "Vectoring to MCE handler");
+			__asm __volatile("int $18");
+			break;
+		case IDT_PF:
+			error = svm_setreg(svm_sc, vcpu, VM_REG_GUEST_CR2,
+			    info2);
+			KASSERT(error == 0, ("%s: error %d updating cr2",
+			    __func__, error));
+			/* fallthru */
+		case IDT_NP:
+		case IDT_SS:
+		case IDT_GP:
+		case IDT_AC:
+		case IDT_TS:
+			errcode_valid = 1;
+			break;
+
+		case IDT_DF:
+			errcode_valid = 1;
+			info1 = 0;
+			break;
+
+		case IDT_BP:
+		case IDT_OF:
+		case IDT_BR:
+			/*
+			 * The 'nrip' field is populated for INT3, INTO and
+			 * BOUND exceptions and this also implies that
+			 * 'inst_length' is non-zero.
+			 *
+			 * Reset 'inst_length' to zero so the guest %rip at
+			 * event injection is identical to what it was when
+			 * the exception originally happened.
+			 */
+			VCPU_CTR2(svm_sc->vm, vcpu, "Reset inst_length from %d "
+			    "to zero before injecting exception %d",
+			    vmexit->inst_length, idtvec);
+			vmexit->inst_length = 0;
+			/* fallthru */
+		default:
+			errcode_valid = 0;
+			info1 = 0;
+			break;
+		}
+		KASSERT(vmexit->inst_length == 0, ("invalid inst_length (%d) "
+		    "when reflecting exception %d into guest",
+		    vmexit->inst_length, idtvec));
+
+		if (reflect) {
+			/* Reflect the exception back into the guest */
+			VCPU_CTR2(svm_sc->vm, vcpu, "Reflecting exception "
+			    "%d/%#x into the guest", idtvec, (int)info1);
+			error = vm_inject_exception(svm_sc->vm, vcpu, idtvec,
+			    errcode_valid, info1, 0);
+			KASSERT(error == 0, ("%s: vm_inject_exception error %d",
+			    __func__, error));
+		}
+		handled = 1;
+		break;
+	case VMCB_EXIT_MSR:	/* MSR access. */
+		eax = state->rax;
+		ecx = ctx->sctx_rcx;
+		edx = ctx->sctx_rdx;
+		retu = false;	
+
+		if (info1) {
+			vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_WRMSR, 1);
+			val = (uint64_t)edx << 32 | eax;
+			VCPU_CTR2(svm_sc->vm, vcpu, "wrmsr %#x val %#lx",
+			    ecx, val);
+			if (emulate_wrmsr(svm_sc, vcpu, ecx, val, &retu)) {
+				vmexit->exitcode = VM_EXITCODE_WRMSR;
+				vmexit->u.msr.code = ecx;
+				vmexit->u.msr.wval = val;
+			} else if (!retu) {
+				handled = 1;
+			} else {
+				KASSERT(vmexit->exitcode != VM_EXITCODE_BOGUS,
+				    ("emulate_wrmsr retu with bogus exitcode"));
+			}
+		} else {
+			VCPU_CTR1(svm_sc->vm, vcpu, "rdmsr %#x", ecx);
+			vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_RDMSR, 1);
+			if (emulate_rdmsr(svm_sc, vcpu, ecx, &retu)) {
+				vmexit->exitcode = VM_EXITCODE_RDMSR;
+				vmexit->u.msr.code = ecx;
+			} else if (!retu) {
+				handled = 1;
+			} else {
+				KASSERT(vmexit->exitcode != VM_EXITCODE_BOGUS,
+				    ("emulate_rdmsr retu with bogus exitcode"));
+			}
+		}
+		break;
+	case VMCB_EXIT_IO:
+		handled = svm_handle_io(svm_sc, vcpu, vmexit);
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_INOUT, 1);
+		break;
+	case VMCB_EXIT_CPUID:
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_CPUID, 1);
+		handled = x86_emulate_cpuid(svm_sc->vm, vcpu,
+		    (uint32_t *)&state->rax,
+		    (uint32_t *)&ctx->sctx_rbx,
+		    (uint32_t *)&ctx->sctx_rcx,
+		    (uint32_t *)&ctx->sctx_rdx);
+		break;
+	case VMCB_EXIT_HLT:
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_HLT, 1);
+		vmexit->exitcode = VM_EXITCODE_HLT;
+		vmexit->u.hlt.rflags = state->rflags;
+		break;
+	case VMCB_EXIT_PAUSE:
+		vmexit->exitcode = VM_EXITCODE_PAUSE;
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_PAUSE, 1);
+		break;
+	case VMCB_EXIT_NPF:
+		/* EXITINFO2 contains the faulting guest physical address */
+		if (info1 & VMCB_NPF_INFO1_RSV) {
+			VCPU_CTR2(svm_sc->vm, vcpu, "nested page fault with "
+			    "reserved bits set: info1(%#lx) info2(%#lx)",
+			    info1, info2);
+		} else if (vm_mem_allocated(svm_sc->vm, vcpu, info2)) {
+			vmexit->exitcode = VM_EXITCODE_PAGING;
+			vmexit->u.paging.gpa = info2;
+			vmexit->u.paging.fault_type = npf_fault_type(info1);
+			vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_NESTED_FAULT, 1);
+			VCPU_CTR3(svm_sc->vm, vcpu, "nested page fault "
+			    "on gpa %#lx/%#lx at rip %#lx",
+			    info2, info1, state->rip);
+		} else if (svm_npf_emul_fault(info1)) {
+			svm_handle_inst_emul(vmcb, info2, vmexit);
+			vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_INST_EMUL, 1);
+			VCPU_CTR3(svm_sc->vm, vcpu, "inst_emul fault "
+			    "for gpa %#lx/%#lx at rip %#lx",
+			    info2, info1, state->rip);
+		}
+		break;
+	case VMCB_EXIT_MONITOR:
+		vmexit->exitcode = VM_EXITCODE_MONITOR;
+		break;
+	case VMCB_EXIT_MWAIT:
+		vmexit->exitcode = VM_EXITCODE_MWAIT;
+		break;
+	default:
+		vmm_stat_incr(svm_sc->vm, vcpu, VMEXIT_UNKNOWN, 1);
+		break;
+	}	
+
+	VCPU_CTR4(svm_sc->vm, vcpu, "%s %s vmexit at %#lx/%d",
+	    handled ? "handled" : "unhandled", exit_reason_to_str(code),
+	    vmexit->rip, vmexit->inst_length);
+
+	if (handled) {
+		vmexit->rip += vmexit->inst_length;
+		vmexit->inst_length = 0;
+		state->rip = vmexit->rip;
+	} else {
+		if (vmexit->exitcode == VM_EXITCODE_BOGUS) {
+			/*
+			 * If this VM exit was not claimed by anybody then
+			 * treat it as a generic SVM exit.
+			 */
+			vm_exit_svm(vmexit, code, info1, info2);
+		} else {
+			/*
+			 * The exitcode and collateral have been populated.
+			 * The VM exit will be processed further in userland.
+			 */
+		}
+	}
+	return (handled);
+}
+
+static void
+svm_inj_intinfo(struct svm_softc *svm_sc, int vcpu)
+{
+	uint64_t intinfo;
+
+	if (!vm_entry_intinfo(svm_sc->vm, vcpu, &intinfo))
+		return;
+
+	KASSERT(VMCB_EXITINTINFO_VALID(intinfo), ("%s: entry intinfo is not "
+	    "valid: %#lx", __func__, intinfo));
+
+	svm_eventinject(svm_sc, vcpu, VMCB_EXITINTINFO_TYPE(intinfo),
+		VMCB_EXITINTINFO_VECTOR(intinfo),
+		VMCB_EXITINTINFO_EC(intinfo),
+		VMCB_EXITINTINFO_EC_VALID(intinfo));
+	vmm_stat_incr(svm_sc->vm, vcpu, VCPU_INTINFO_INJECTED, 1);
+	VCPU_CTR1(svm_sc->vm, vcpu, "Injected entry intinfo: %#lx", intinfo);
+}
+
+/*
+ * Inject event to virtual cpu.
+ */
+static void
+svm_inj_interrupts(struct svm_softc *sc, int vcpu, struct vlapic *vlapic)
+{
+	struct vmcb_ctrl *ctrl;
+	struct vmcb_state *state;
+	struct svm_vcpu *vcpustate;
+	uint8_t v_tpr;
+	int vector, need_intr_window;
+	int extint_pending;
+
+	state = svm_get_vmcb_state(sc, vcpu);
+	ctrl  = svm_get_vmcb_ctrl(sc, vcpu);
+	vcpustate = svm_get_vcpu(sc, vcpu);
+
+	need_intr_window = 0;
+
+	if (vcpustate->nextrip != state->rip) {
+		ctrl->intr_shadow = 0;
+		VCPU_CTR2(sc->vm, vcpu, "Guest interrupt blocking "
+		    "cleared due to rip change: %#lx/%#lx",
+		    vcpustate->nextrip, state->rip);
+	}
+
+	/*
+	 * Inject pending events or exceptions for this vcpu.
+	 *
+	 * An event might be pending because the previous #VMEXIT happened
+	 * during event delivery (i.e. ctrl->exitintinfo).
+	 *
+	 * An event might also be pending because an exception was injected
+	 * by the hypervisor (e.g. #PF during instruction emulation).
+	 */
+	svm_inj_intinfo(sc, vcpu);
+
+	/* NMI event has priority over interrupts. */
+	if (vm_nmi_pending(sc->vm, vcpu)) {
+		if (nmi_blocked(sc, vcpu)) {
+			/*
+			 * Can't inject another NMI if the guest has not
+			 * yet executed an "iret" after the last NMI.
+			 */
+			VCPU_CTR0(sc->vm, vcpu, "Cannot inject NMI due "
+			    "to NMI-blocking");
+		} else if (ctrl->intr_shadow) {
+			/*
+			 * Can't inject an NMI if the vcpu is in an intr_shadow.
+			 */
+			VCPU_CTR0(sc->vm, vcpu, "Cannot inject NMI due to "
+			    "interrupt shadow");
+			need_intr_window = 1;
+			goto done;
+		} else if (ctrl->eventinj & VMCB_EVENTINJ_VALID) {
+			/*
+			 * If there is already an exception/interrupt pending
+			 * then defer the NMI until after that.
+			 */
+			VCPU_CTR1(sc->vm, vcpu, "Cannot inject NMI due to "
+			    "eventinj %#lx", ctrl->eventinj);
+
+			/*
+			 * Use self-IPI to trigger a VM-exit as soon as
+			 * possible after the event injection is completed.
+			 *
+			 * This works only if the external interrupt exiting
+			 * is at a lower priority than the event injection.
+			 *
+			 * Although not explicitly specified in APMv2 the
+			 * relative priorities were verified empirically.
+			 */
+			ipi_cpu(curcpu, IPI_AST);	/* XXX vmm_ipinum? */
+		} else {
+			vm_nmi_clear(sc->vm, vcpu);
+
+			/* Inject NMI, vector number is not used */
+			svm_eventinject(sc, vcpu, VMCB_EVENTINJ_TYPE_NMI,
+			    IDT_NMI, 0, false);
+
+			/* virtual NMI blocking is now in effect */
+			enable_nmi_blocking(sc, vcpu);
+
+			VCPU_CTR0(sc->vm, vcpu, "Injecting vNMI");
+		}
+	}
+
+	extint_pending = vm_extint_pending(sc->vm, vcpu);
+	if (!extint_pending) {
+		if (!vlapic_pending_intr(vlapic, &vector))
+			goto done;
+		KASSERT(vector >= 16 && vector <= 255,
+		    ("invalid vector %d from local APIC", vector));
+	} else {
+		/* Ask the legacy pic for a vector to inject */
+		vatpic_pending_intr(sc->vm, &vector);
+		KASSERT(vector >= 0 && vector <= 255,
+		    ("invalid vector %d from INTR", vector));
+	}
+
+	/*
+	 * If the guest has disabled interrupts or is in an interrupt shadow
+	 * then we cannot inject the pending interrupt.
+	 */
+	if ((state->rflags & PSL_I) == 0) {
+		VCPU_CTR2(sc->vm, vcpu, "Cannot inject vector %d due to "
+		    "rflags %#lx", vector, state->rflags);
+		need_intr_window = 1;
+		goto done;
+	}
+
+	if (ctrl->intr_shadow) {
+		VCPU_CTR1(sc->vm, vcpu, "Cannot inject vector %d due to "
+		    "interrupt shadow", vector);
+		need_intr_window = 1;
+		goto done;
+	}
+
+	if (ctrl->eventinj & VMCB_EVENTINJ_VALID) {
+		VCPU_CTR2(sc->vm, vcpu, "Cannot inject vector %d due to "
+		    "eventinj %#lx", vector, ctrl->eventinj);
+		need_intr_window = 1;
+		goto done;
+	}
+
+	svm_eventinject(sc, vcpu, VMCB_EVENTINJ_TYPE_INTR, vector, 0, false);
+
+	if (!extint_pending) {
+		vlapic_intr_accepted(vlapic, vector);
+	} else {
+		vm_extint_clear(sc->vm, vcpu);
+		vatpic_intr_accepted(sc->vm, vector);
+	}
+
+	/*
+	 * Force a VM-exit as soon as the vcpu is ready to accept another
+	 * interrupt. This is done because the PIC might have another vector
+	 * that it wants to inject. Also, if the APIC has a pending interrupt
+	 * that was preempted by the ExtInt then it allows us to inject the
+	 * APIC vector as soon as possible.
+	 */
+	need_intr_window = 1;
+done:
+	/*
+	 * The guest can modify the TPR by writing to %CR8. In guest mode
+	 * the processor reflects this write to V_TPR without hypervisor
+	 * intervention.
+	 *
+	 * The guest can also modify the TPR by writing to it via the memory
+	 * mapped APIC page. In this case, the write will be emulated by the
+	 * hypervisor. For this reason V_TPR must be updated before every
+	 * VMRUN.
+	 */
+	v_tpr = vlapic_get_cr8(vlapic);
+	KASSERT(v_tpr <= 15, ("invalid v_tpr %#x", v_tpr));
+	if (ctrl->v_tpr != v_tpr) {
+		VCPU_CTR2(sc->vm, vcpu, "VMCB V_TPR changed from %#x to %#x",
+		    ctrl->v_tpr, v_tpr);
+		ctrl->v_tpr = v_tpr;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_TPR);
+	}
+
+	if (need_intr_window) {
+		/*
+		 * We use V_IRQ in conjunction with the VINTR intercept to
+		 * trap into the hypervisor as soon as a virtual interrupt
+		 * can be delivered.
+		 *
+		 * Since injected events are not subject to intercept checks
+		 * we need to ensure that the V_IRQ is not actually going to
+		 * be delivered on VM entry. The KASSERT below enforces this.
+		 */
+		KASSERT((ctrl->eventinj & VMCB_EVENTINJ_VALID) != 0 ||
+		    (state->rflags & PSL_I) == 0 || ctrl->intr_shadow,
+		    ("Bogus intr_window_exiting: eventinj (%#lx), "
+		    "intr_shadow (%u), rflags (%#lx)",
+		    ctrl->eventinj, ctrl->intr_shadow, state->rflags));
+		enable_intr_window_exiting(sc, vcpu);
+	} else {
+		disable_intr_window_exiting(sc, vcpu);
+	}
+}
+
+static __inline void
+restore_host_tss(void)
+{
+#ifdef __FreeBSD__
+	struct system_segment_descriptor *tss_sd;
+
+	/*
+	 * The TSS descriptor was in use prior to launching the guest so it
+	 * has been marked busy.
+	 *
+	 * 'ltr' requires the descriptor to be marked available so change the
+	 * type to "64-bit available TSS".
+	 */
+	tss_sd = PCPU_GET(tss);
+	tss_sd->sd_type = SDT_SYSTSS;
+	ltr(GSEL(GPROC0_SEL, SEL_KPL));
+#else
+	/* XXXJOY: Add logic to restore TSS for us */
+	panic("SVM Restore system TSS");
+#endif
+}
+
+static void
+check_asid(struct svm_softc *sc, int vcpuid, pmap_t pmap, u_int thiscpu)
+{
+	struct svm_vcpu *vcpustate;
+	struct vmcb_ctrl *ctrl;
+	long eptgen;
+	bool alloc_asid;
+
+	KASSERT(CPU_ISSET(thiscpu, &pmap->pm_active), ("%s: nested pmap not "
+	    "active on cpu %u", __func__, thiscpu));
+
+	vcpustate = svm_get_vcpu(sc, vcpuid);
+	ctrl = svm_get_vmcb_ctrl(sc, vcpuid);
+
+	/*
+	 * The TLB entries associated with the vcpu's ASID are not valid
+	 * if either of the following conditions is true:
+	 *
+	 * 1. The vcpu's ASID generation is different than the host cpu's
+	 *    ASID generation. This happens when the vcpu migrates to a new
+	 *    host cpu. It can also happen when the number of vcpus executing
+	 *    on a host cpu is greater than the number of ASIDs available.
+	 *
+	 * 2. The pmap generation number is different than the value cached in
+	 *    the 'vcpustate'. This happens when the host invalidates pages
+	 *    belonging to the guest.
+	 *
+	 *	asidgen		eptgen	      Action
+	 *	mismatch	mismatch
+	 *	   0		   0		(a)
+	 *	   0		   1		(b1) or (b2)
+	 *	   1		   0		(c)
+	 *	   1		   1		(d)
+	 *
+	 * (a) There is no mismatch in eptgen or ASID generation and therefore
+	 *     no further action is needed.
+	 *
+	 * (b1) If the cpu supports FlushByAsid then the vcpu's ASID is
+	 *      retained and the TLB entries associated with this ASID
+	 *      are flushed by VMRUN.
+	 *
+	 * (b2) If the cpu does not support FlushByAsid then a new ASID is
+	 *      allocated.
+	 *
+	 * (c) A new ASID is allocated.
+	 *
+	 * (d) A new ASID is allocated.
+	 */
+
+	alloc_asid = false;
+	eptgen = pmap->pm_eptgen;
+	ctrl->tlb_ctrl = VMCB_TLB_FLUSH_NOTHING;
+
+	if (vcpustate->asid.gen != asid[thiscpu].gen) {
+		alloc_asid = true;	/* (c) and (d) */
+	} else if (vcpustate->eptgen != eptgen) {
+		if (flush_by_asid())
+			ctrl->tlb_ctrl = VMCB_TLB_FLUSH_GUEST;	/* (b1) */
+		else
+			alloc_asid = true;			/* (b2) */
+	} else {
+		/*
+		 * This is the common case (a).
+		 */
+		KASSERT(!alloc_asid, ("ASID allocation not necessary"));
+		KASSERT(ctrl->tlb_ctrl == VMCB_TLB_FLUSH_NOTHING,
+		    ("Invalid VMCB tlb_ctrl: %#x", ctrl->tlb_ctrl));
+	}
+
+	if (alloc_asid) {
+		if (++asid[thiscpu].num >= nasid) {
+			asid[thiscpu].num = 1;
+			if (++asid[thiscpu].gen == 0)
+				asid[thiscpu].gen = 1;
+			/*
+			 * If this cpu does not support "flush-by-asid"
+			 * then flush the entire TLB on a generation
+			 * bump. Subsequent ASID allocation in this
+			 * generation can be done without a TLB flush.
+			 */
+			if (!flush_by_asid())
+				ctrl->tlb_ctrl = VMCB_TLB_FLUSH_ALL;
+		}
+		vcpustate->asid.gen = asid[thiscpu].gen;
+		vcpustate->asid.num = asid[thiscpu].num;
+
+		ctrl->asid = vcpustate->asid.num;
+		svm_set_dirty(sc, vcpuid, VMCB_CACHE_ASID);
+		/*
+		 * If this cpu supports "flush-by-asid" then the TLB
+		 * was not flushed after the generation bump. The TLB
+		 * is flushed selectively after every new ASID allocation.
+		 */
+		if (flush_by_asid())
+			ctrl->tlb_ctrl = VMCB_TLB_FLUSH_GUEST;
+	}
+	vcpustate->eptgen = eptgen;
+
+	KASSERT(ctrl->asid != 0, ("Guest ASID must be non-zero"));
+	KASSERT(ctrl->asid == vcpustate->asid.num,
+	    ("ASID mismatch: %u/%u", ctrl->asid, vcpustate->asid.num));
+}
+
+static __inline void
+disable_gintr(void)
+{
+
+	__asm __volatile("clgi");
+}
+
+static __inline void
+enable_gintr(void)
+{
+
+        __asm __volatile("stgi");
+}
+
+static __inline void
+svm_dr_enter_guest(struct svm_regctx *gctx)
+{
+
+	/* Save host control debug registers. */
+	gctx->host_dr7 = rdr7();
+	gctx->host_debugctl = rdmsr(MSR_DEBUGCTLMSR);
+
+	/*
+	 * Disable debugging in DR7 and DEBUGCTL to avoid triggering
+	 * exceptions in the host based on the guest DRx values.  The
+	 * guest DR6, DR7, and DEBUGCTL are saved/restored in the
+	 * VMCB.
+	 */
+	load_dr7(0);
+	wrmsr(MSR_DEBUGCTLMSR, 0);
+
+	/* Save host debug registers. */
+	gctx->host_dr0 = rdr0();
+	gctx->host_dr1 = rdr1();
+	gctx->host_dr2 = rdr2();
+	gctx->host_dr3 = rdr3();
+	gctx->host_dr6 = rdr6();
+
+	/* Restore guest debug registers. */
+	load_dr0(gctx->sctx_dr0);
+	load_dr1(gctx->sctx_dr1);
+	load_dr2(gctx->sctx_dr2);
+	load_dr3(gctx->sctx_dr3);
+}
+
+static __inline void
+svm_dr_leave_guest(struct svm_regctx *gctx)
+{
+
+	/* Save guest debug registers. */
+	gctx->sctx_dr0 = rdr0();
+	gctx->sctx_dr1 = rdr1();
+	gctx->sctx_dr2 = rdr2();
+	gctx->sctx_dr3 = rdr3();
+
+	/*
+	 * Restore host debug registers.  Restore DR7 and DEBUGCTL
+	 * last.
+	 */
+	load_dr0(gctx->host_dr0);
+	load_dr1(gctx->host_dr1);
+	load_dr2(gctx->host_dr2);
+	load_dr3(gctx->host_dr3);
+	load_dr6(gctx->host_dr6);
+	wrmsr(MSR_DEBUGCTLMSR, gctx->host_debugctl);
+	load_dr7(gctx->host_dr7);
+}
+
+/*
+ * Start vcpu with specified RIP.
+ */
+static int
+svm_vmrun(void *arg, int vcpu, register_t rip, pmap_t pmap, 
+	struct vm_eventinfo *evinfo)
+{
+	struct svm_regctx *gctx;
+	struct svm_softc *svm_sc;
+	struct svm_vcpu *vcpustate;
+	struct vmcb_state *state;
+	struct vmcb_ctrl *ctrl;
+	struct vm_exit *vmexit;
+	struct vlapic *vlapic;
+	struct vm *vm;
+	uint64_t vmcb_pa;
+	int handled;
+
+	svm_sc = arg;
+	vm = svm_sc->vm;
+
+	vcpustate = svm_get_vcpu(svm_sc, vcpu);
+	state = svm_get_vmcb_state(svm_sc, vcpu);
+	ctrl = svm_get_vmcb_ctrl(svm_sc, vcpu);
+	vmexit = vm_exitinfo(vm, vcpu);
+	vlapic = vm_lapic(vm, vcpu);
+
+	gctx = svm_get_guest_regctx(svm_sc, vcpu);
+	vmcb_pa = svm_sc->vcpu[vcpu].vmcb_pa;
+
+	if (vcpustate->lastcpu != curcpu) {
+		/*
+		 * Force new ASID allocation by invalidating the generation.
+		 */
+		vcpustate->asid.gen = 0;
+
+		/*
+		 * Invalidate the VMCB state cache by marking all fields dirty.
+		 */
+		svm_set_dirty(svm_sc, vcpu, 0xffffffff);
+
+		/*
+		 * XXX
+		 * Setting 'vcpustate->lastcpu' here is bit premature because
+		 * we may return from this function without actually executing
+		 * the VMRUN  instruction. This could happen if a rendezvous
+		 * or an AST is pending on the first time through the loop.
+		 *
+		 * This works for now but any new side-effects of vcpu
+		 * migration should take this case into account.
+		 */
+		vcpustate->lastcpu = curcpu;
+		vmm_stat_incr(vm, vcpu, VCPU_MIGRATIONS, 1);
+	}
+
+	svm_msr_guest_enter(svm_sc, vcpu);
+
+	/* Update Guest RIP */
+	state->rip = rip;
+
+	do {
+		/*
+		 * Disable global interrupts to guarantee atomicity during
+		 * loading of guest state. This includes not only the state
+		 * loaded by the "vmrun" instruction but also software state
+		 * maintained by the hypervisor: suspended and rendezvous
+		 * state, NPT generation number, vlapic interrupts etc.
+		 */
+		disable_gintr();
+
+		if (vcpu_suspended(evinfo)) {
+			enable_gintr();
+			vm_exit_suspended(vm, vcpu, state->rip);
+			break;
+		}
+
+		if (vcpu_rendezvous_pending(evinfo)) {
+			enable_gintr();
+			vm_exit_rendezvous(vm, vcpu, state->rip);
+			break;
+		}
+
+		if (vcpu_reqidle(evinfo)) {
+			enable_gintr();
+			vm_exit_reqidle(vm, vcpu, state->rip);
+			break;
+		}
+
+		/* We are asked to give the cpu by scheduler. */
+		if (vcpu_should_yield(vm, vcpu)) {
+			enable_gintr();
+			vm_exit_astpending(vm, vcpu, state->rip);
+			break;
+		}
+
+		if (vcpu_debugged(vm, vcpu)) {
+			enable_gintr();
+			vm_exit_debug(vm, vcpu, state->rip);
+			break;
+		}
+
+		svm_inj_interrupts(svm_sc, vcpu, vlapic);
+
+		/* Activate the nested pmap on 'curcpu' */
+		CPU_SET_ATOMIC_ACQ(curcpu, &pmap->pm_active);
+
+		/*
+		 * Check the pmap generation and the ASID generation to
+		 * ensure that the vcpu does not use stale TLB mappings.
+		 */
+		check_asid(svm_sc, vcpu, pmap, curcpu);
+
+		ctrl->vmcb_clean = vmcb_clean & ~vcpustate->dirty;
+		vcpustate->dirty = 0;
+		VCPU_CTR1(vm, vcpu, "vmcb clean %#x", ctrl->vmcb_clean);
+
+		/* Launch Virtual Machine. */
+		VCPU_CTR1(vm, vcpu, "Resume execution at %#lx", state->rip);
+		svm_dr_enter_guest(gctx);
+#ifdef __FreeBSD__
+		svm_launch(vmcb_pa, gctx, &__pcpu[curcpu]);
+#else
+		svm_launch(vmcb_pa, gctx, CPU);
+#endif
+		svm_dr_leave_guest(gctx);
+
+		CPU_CLR_ATOMIC(curcpu, &pmap->pm_active);
+
+		/*
+		 * The host GDTR and IDTR is saved by VMRUN and restored
+		 * automatically on #VMEXIT. However, the host TSS needs
+		 * to be restored explicitly.
+		 */
+		restore_host_tss();
+
+		/* #VMEXIT disables interrupts so re-enable them here. */ 
+		enable_gintr();
+
+		/* Update 'nextrip' */
+		vcpustate->nextrip = state->rip;
+
+		/* Handle #VMEXIT and if required return to user space. */
+		handled = svm_vmexit(svm_sc, vcpu, vmexit);
+	} while (handled);
+
+	svm_msr_guest_exit(svm_sc, vcpu);
+
+	return (0);
+}
+
+static void
+svm_vmcleanup(void *arg)
+{
+	struct svm_softc *sc = arg;
+
+	contigfree(sc->iopm_bitmap, SVM_IO_BITMAP_SIZE, M_SVM);
+	contigfree(sc->msr_bitmap, SVM_MSR_BITMAP_SIZE, M_SVM);
+	free(sc, M_SVM);
+}
+
+static register_t *
+swctx_regptr(struct svm_regctx *regctx, int reg)
+{
+
+	switch (reg) {
+	case VM_REG_GUEST_RBX:
+		return (&regctx->sctx_rbx);
+	case VM_REG_GUEST_RCX:
+		return (&regctx->sctx_rcx);
+	case VM_REG_GUEST_RDX:
+		return (&regctx->sctx_rdx);
+	case VM_REG_GUEST_RDI:
+		return (&regctx->sctx_rdi);
+	case VM_REG_GUEST_RSI:
+		return (&regctx->sctx_rsi);
+	case VM_REG_GUEST_RBP:
+		return (&regctx->sctx_rbp);
+	case VM_REG_GUEST_R8:
+		return (&regctx->sctx_r8);
+	case VM_REG_GUEST_R9:
+		return (&regctx->sctx_r9);
+	case VM_REG_GUEST_R10:
+		return (&regctx->sctx_r10);
+	case VM_REG_GUEST_R11:
+		return (&regctx->sctx_r11);
+	case VM_REG_GUEST_R12:
+		return (&regctx->sctx_r12);
+	case VM_REG_GUEST_R13:
+		return (&regctx->sctx_r13);
+	case VM_REG_GUEST_R14:
+		return (&regctx->sctx_r14);
+	case VM_REG_GUEST_R15:
+		return (&regctx->sctx_r15);
+	case VM_REG_GUEST_DR0:
+		return (&regctx->sctx_dr0);
+	case VM_REG_GUEST_DR1:
+		return (&regctx->sctx_dr1);
+	case VM_REG_GUEST_DR2:
+		return (&regctx->sctx_dr2);
+	case VM_REG_GUEST_DR3:
+		return (&regctx->sctx_dr3);
+	default:
+		return (NULL);
+	}
+}
+
+static int
+svm_getreg(void *arg, int vcpu, int ident, uint64_t *val)
+{
+	struct svm_softc *svm_sc;
+	register_t *reg;
+
+	svm_sc = arg;
+
+	if (ident == VM_REG_GUEST_INTR_SHADOW) {
+		return (svm_get_intr_shadow(svm_sc, vcpu, val));
+	}
+
+	if (vmcb_read(svm_sc, vcpu, ident, val) == 0) {
+		return (0);
+	}
+
+	reg = swctx_regptr(svm_get_guest_regctx(svm_sc, vcpu), ident);
+
+	if (reg != NULL) {
+		*val = *reg;
+		return (0);
+	}
+
+	VCPU_CTR1(svm_sc->vm, vcpu, "svm_getreg: unknown register %#x", ident);
+	return (EINVAL);
+}
+
+static int
+svm_setreg(void *arg, int vcpu, int ident, uint64_t val)
+{
+	struct svm_softc *svm_sc;
+	register_t *reg;
+
+	svm_sc = arg;
+
+	if (ident == VM_REG_GUEST_INTR_SHADOW) {
+		return (svm_modify_intr_shadow(svm_sc, vcpu, val));
+	}
+
+	if (vmcb_write(svm_sc, vcpu, ident, val) == 0) {
+		return (0);
+	}
+
+	reg = swctx_regptr(svm_get_guest_regctx(svm_sc, vcpu), ident);
+
+	if (reg != NULL) {
+		*reg = val;
+		return (0);
+	}
+
+	/*
+	 * XXX deal with CR3 and invalidate TLB entries tagged with the
+	 * vcpu's ASID. This needs to be treated differently depending on
+	 * whether 'running' is true/false.
+	 */
+
+	VCPU_CTR1(svm_sc->vm, vcpu, "svm_setreg: unknown register %#x", ident);
+	return (EINVAL);
+}
+
+static int
+svm_setcap(void *arg, int vcpu, int type, int val)
+{
+	struct svm_softc *sc;
+	int error;
+
+	sc = arg;
+	error = 0;
+	switch (type) {
+	case VM_CAP_HALT_EXIT:
+		svm_set_intercept(sc, vcpu, VMCB_CTRL1_INTCPT,
+		    VMCB_INTCPT_HLT, val);
+		break;
+	case VM_CAP_PAUSE_EXIT:
+		svm_set_intercept(sc, vcpu, VMCB_CTRL1_INTCPT,
+		    VMCB_INTCPT_PAUSE, val);
+		break;
+	case VM_CAP_UNRESTRICTED_GUEST:
+		/* Unrestricted guest execution cannot be disabled in SVM */
+		if (val == 0)
+			error = EINVAL;
+		break;
+	default:
+		error = ENOENT;
+		break;
+	}
+	return (error);
+}
+
+static int
+svm_getcap(void *arg, int vcpu, int type, int *retval)
+{
+	struct svm_softc *sc;
+	int error;
+
+	sc = arg;
+	error = 0;
+
+	switch (type) {
+	case VM_CAP_HALT_EXIT:
+		*retval = svm_get_intercept(sc, vcpu, VMCB_CTRL1_INTCPT,
+		    VMCB_INTCPT_HLT);
+		break;
+	case VM_CAP_PAUSE_EXIT:
+		*retval = svm_get_intercept(sc, vcpu, VMCB_CTRL1_INTCPT,
+		    VMCB_INTCPT_PAUSE);
+		break;
+	case VM_CAP_UNRESTRICTED_GUEST:
+		*retval = 1;	/* unrestricted guest is always enabled */
+		break;
+	default:
+		error = ENOENT;
+		break;
+	}
+	return (error);
+}
+
+static struct vlapic *
+svm_vlapic_init(void *arg, int vcpuid)
+{
+	struct svm_softc *svm_sc;
+	struct vlapic *vlapic;
+
+	svm_sc = arg;
+	vlapic = malloc(sizeof(struct vlapic), M_SVM_VLAPIC, M_WAITOK | M_ZERO);
+	vlapic->vm = svm_sc->vm;
+	vlapic->vcpuid = vcpuid;
+	vlapic->apic_page = (struct LAPIC *)&svm_sc->apic_page[vcpuid];
+
+	vlapic_init(vlapic);
+
+	return (vlapic);
+}
+
+static void
+svm_vlapic_cleanup(void *arg, struct vlapic *vlapic)
+{
+
+        vlapic_cleanup(vlapic);
+        free(vlapic, M_SVM_VLAPIC);
+}
+
+struct vmm_ops vmm_ops_amd = {
+	svm_init,
+	svm_cleanup,
+	svm_restore,
+	svm_vminit,
+	svm_vmrun,
+	svm_vmcleanup,
+	svm_getreg,
+	svm_setreg,
+	vmcb_getdesc,
+	vmcb_setdesc,
+	svm_getcap,
+	svm_setcap,
+	svm_npt_alloc,
+	svm_npt_free,
+	svm_vlapic_init,
+	svm_vlapic_cleanup,
+
+#ifndef __FreeBSD__
+	/*
+	 * When SVM support is wired up and tested, it is likely to require
+	 * savectx/restorectx functions similar to VMX.
+	 */
+	NULL,
+	NULL,
+#endif
+};
diff --git a/usr/src/uts/i86pc/io/vmm/amd/svm.h b/usr/src/uts/i86pc/io/vmm/amd/svm.h
new file mode 100644
index 0000000000..2f4277df2f
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/svm.h
@@ -0,0 +1,72 @@
+/*-
+ * Copyright (c) 2013 Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _SVM_H_
+#define _SVM_H_
+
+/*
+ * Guest register state that is saved outside the VMCB.
+ */
+struct svm_regctx {
+	register_t	sctx_rbp;
+	register_t	sctx_rbx;
+	register_t	sctx_rcx;
+	register_t	sctx_rdx;
+	register_t	sctx_rdi;
+	register_t	sctx_rsi;
+	register_t	sctx_r8;
+	register_t	sctx_r9;
+	register_t	sctx_r10;
+	register_t	sctx_r11;
+	register_t	sctx_r12;
+	register_t	sctx_r13;
+	register_t	sctx_r14;
+	register_t	sctx_r15;
+	register_t	sctx_dr0;
+	register_t	sctx_dr1;
+	register_t	sctx_dr2;
+	register_t	sctx_dr3;
+
+	register_t	host_dr0;
+	register_t	host_dr1;
+	register_t	host_dr2;
+	register_t	host_dr3;
+	register_t	host_dr6;
+	register_t	host_dr7;
+	uint64_t	host_debugctl;
+};
+
+#ifdef __FreeBSD__
+struct pcpu;
+void svm_launch(uint64_t pa, struct svm_regctx *gctx, struct pcpu *pcpu);
+#else
+struct cpu;
+void svm_launch(uint64_t pa, struct svm_regctx *gctx, struct cpu *pcpu);
+#endif
+
+#endif /* _SVM_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/amd/svm_msr.c b/usr/src/uts/i86pc/io/vmm/amd/svm_msr.c
new file mode 100644
index 0000000000..49208a351c
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/svm_msr.c
@@ -0,0 +1,170 @@
+/*-
+ * Copyright (c) 2014, Neel Natu (neel@freebsd.org)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/errno.h>
+#include <sys/systm.h>
+
+#include <machine/cpufunc.h>
+#include <machine/specialreg.h>
+#include <machine/vmm.h>
+
+#include "svm.h"
+#include "vmcb.h"
+#include "svm_softc.h"
+#include "svm_msr.h"
+
+#ifndef MSR_AMDK8_IPM
+#define	MSR_AMDK8_IPM	0xc0010055
+#endif
+
+enum {
+	IDX_MSR_LSTAR,
+	IDX_MSR_CSTAR,
+	IDX_MSR_STAR,
+	IDX_MSR_SF_MASK,
+	HOST_MSR_NUM		/* must be the last enumeration */
+};
+
+static uint64_t host_msrs[HOST_MSR_NUM];
+
+void
+svm_msr_init(void)
+{
+	/* 
+	 * It is safe to cache the values of the following MSRs because they
+	 * don't change based on curcpu, curproc or curthread.
+	 */
+	host_msrs[IDX_MSR_LSTAR] = rdmsr(MSR_LSTAR);
+	host_msrs[IDX_MSR_CSTAR] = rdmsr(MSR_CSTAR);
+	host_msrs[IDX_MSR_STAR] = rdmsr(MSR_STAR);
+	host_msrs[IDX_MSR_SF_MASK] = rdmsr(MSR_SF_MASK);
+}
+
+void
+svm_msr_guest_init(struct svm_softc *sc, int vcpu)
+{
+	/*
+	 * All the MSRs accessible to the guest are either saved/restored by
+	 * hardware on every #VMEXIT/VMRUN (e.g., G_PAT) or are saved/restored
+	 * by VMSAVE/VMLOAD (e.g., MSR_GSBASE).
+	 *
+	 * There are no guest MSRs that are saved/restored "by hand" so nothing
+	 * more to do here.
+	 */
+	return;
+}
+
+void
+svm_msr_guest_enter(struct svm_softc *sc, int vcpu)
+{
+	/*
+	 * Save host MSRs (if any) and restore guest MSRs (if any).
+	 */
+}
+
+void
+svm_msr_guest_exit(struct svm_softc *sc, int vcpu)
+{
+	/*
+	 * Save guest MSRs (if any) and restore host MSRs.
+	 */
+	wrmsr(MSR_LSTAR, host_msrs[IDX_MSR_LSTAR]);
+	wrmsr(MSR_CSTAR, host_msrs[IDX_MSR_CSTAR]);
+	wrmsr(MSR_STAR, host_msrs[IDX_MSR_STAR]);
+	wrmsr(MSR_SF_MASK, host_msrs[IDX_MSR_SF_MASK]);
+
+	/* MSR_KGSBASE will be restored on the way back to userspace */
+}
+
+int
+svm_rdmsr(struct svm_softc *sc, int vcpu, u_int num, uint64_t *result,
+    bool *retu)
+{
+	int error = 0;
+
+	switch (num) {
+	case MSR_MCG_CAP:
+	case MSR_MCG_STATUS:
+		*result = 0;
+		break;
+	case MSR_MTRRcap:
+	case MSR_MTRRdefType:
+	case MSR_MTRR4kBase ... MSR_MTRR4kBase + 8:
+	case MSR_MTRR16kBase ... MSR_MTRR16kBase + 1:
+	case MSR_MTRR64kBase:
+	case MSR_SYSCFG:
+		*result = 0;
+		break;
+	case MSR_AMDK8_IPM:
+		*result = 0;
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	return (error);
+}
+
+int
+svm_wrmsr(struct svm_softc *sc, int vcpu, u_int num, uint64_t val, bool *retu)
+{
+	int error = 0;
+
+	switch (num) {
+	case MSR_MCG_CAP:
+	case MSR_MCG_STATUS:
+		break;		/* ignore writes */
+	case MSR_MTRRcap:
+		vm_inject_gp(sc->vm, vcpu);
+		break;
+	case MSR_MTRRdefType:
+	case MSR_MTRR4kBase ... MSR_MTRR4kBase + 8:
+	case MSR_MTRR16kBase ... MSR_MTRR16kBase + 1:
+	case MSR_MTRR64kBase:
+	case MSR_SYSCFG:
+		break;		/* Ignore writes */
+	case MSR_AMDK8_IPM:
+		/*
+		 * Ignore writes to the "Interrupt Pending Message" MSR.
+		 */
+		break;
+	case MSR_K8_UCODE_UPDATE:
+		/*
+		 * Ignore writes to microcode update register.
+		 */
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	return (error);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/amd/svm_msr.h b/usr/src/uts/i86pc/io/vmm/amd/svm_msr.h
new file mode 100644
index 0000000000..07716c86de
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/svm_msr.h
@@ -0,0 +1,44 @@
+/*-
+ * Copyright (c) 2014 Neel Natu (neel@freebsd.org)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _SVM_MSR_H_
+#define	_SVM_MSR_H_
+
+struct svm_softc;
+
+void svm_msr_init(void);
+void svm_msr_guest_init(struct svm_softc *sc, int vcpu);
+void svm_msr_guest_enter(struct svm_softc *sc, int vcpu);
+void svm_msr_guest_exit(struct svm_softc *sc, int vcpu);
+
+int svm_wrmsr(struct svm_softc *sc, int vcpu, u_int num, uint64_t val,
+    bool *retu);
+int svm_rdmsr(struct svm_softc *sc, int vcpu, u_int num, uint64_t *result,
+    bool *retu);
+
+#endif	/* _SVM_MSR_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/amd/svm_softc.h b/usr/src/uts/i86pc/io/vmm/amd/svm_softc.h
new file mode 100644
index 0000000000..9377bf529a
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/svm_softc.h
@@ -0,0 +1,114 @@
+/*-
+ * Copyright (c) 2013 Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _SVM_SOFTC_H_
+#define _SVM_SOFTC_H_
+
+#define SVM_IO_BITMAP_SIZE	(3 * PAGE_SIZE)
+#define SVM_MSR_BITMAP_SIZE	(2 * PAGE_SIZE)
+
+struct asid {
+	uint64_t	gen;	/* range is [1, ~0UL] */
+	uint32_t	num;	/* range is [1, nasid - 1] */
+};
+
+/*
+ * XXX separate out 'struct vmcb' from 'svm_vcpu' to avoid wasting space
+ * due to VMCB alignment requirements.
+ */
+struct svm_vcpu {
+	struct vmcb	vmcb;	 /* hardware saved vcpu context */
+	struct svm_regctx swctx; /* software saved vcpu context */
+	uint64_t	vmcb_pa; /* VMCB physical address */
+	uint64_t	nextrip; /* next instruction to be executed by guest */
+        int		lastcpu; /* host cpu that the vcpu last ran on */
+	uint32_t	dirty;	 /* state cache bits that must be cleared */
+	long		eptgen;	 /* pmap->pm_eptgen when the vcpu last ran */
+	struct asid	asid;
+} __aligned(PAGE_SIZE);
+
+/*
+ * SVM softc, one per virtual machine.
+ */
+struct svm_softc {
+	uint8_t apic_page[VM_MAXCPU][PAGE_SIZE];
+	struct svm_vcpu vcpu[VM_MAXCPU];
+	vm_offset_t 	nptp;			    /* nested page table */
+	uint8_t		*iopm_bitmap;    /* shared by all vcpus */
+	uint8_t		*msr_bitmap;    /* shared by all vcpus */
+	struct vm	*vm;
+};
+
+CTASSERT((offsetof(struct svm_softc, nptp) & PAGE_MASK) == 0);
+
+static __inline struct svm_vcpu *
+svm_get_vcpu(struct svm_softc *sc, int vcpu)
+{
+
+	return (&(sc->vcpu[vcpu]));
+}
+
+static __inline struct vmcb *
+svm_get_vmcb(struct svm_softc *sc, int vcpu)
+{
+
+	return (&(sc->vcpu[vcpu].vmcb));
+}
+
+static __inline struct vmcb_state *
+svm_get_vmcb_state(struct svm_softc *sc, int vcpu)
+{
+
+	return (&(sc->vcpu[vcpu].vmcb.state));
+}
+
+static __inline struct vmcb_ctrl *
+svm_get_vmcb_ctrl(struct svm_softc *sc, int vcpu)
+{
+
+	return (&(sc->vcpu[vcpu].vmcb.ctrl));
+}
+
+static __inline struct svm_regctx *
+svm_get_guest_regctx(struct svm_softc *sc, int vcpu)
+{
+
+	return (&(sc->vcpu[vcpu].swctx));
+}
+
+static __inline void
+svm_set_dirty(struct svm_softc *sc, int vcpu, uint32_t dirtybits)
+{
+        struct svm_vcpu *vcpustate;
+
+        vcpustate = svm_get_vcpu(sc, vcpu);
+
+        vcpustate->dirty |= dirtybits;
+}
+
+#endif /* _SVM_SOFTC_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/amd/svm_support.s b/usr/src/uts/i86pc/io/vmm/amd/svm_support.s
new file mode 100644
index 0000000000..4258c95d70
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/svm_support.s
@@ -0,0 +1,148 @@
+/*-
+ * Copyright (c) 2013, Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+#include <machine/asmacros.h>
+
+#include "svm_assym.h"
+
+/* Porting note: This is named 'svm_support.S' upstream. */
+
+#if defined(lint)
+
+struct svm_regctx;
+struct pcpu;
+
+/*ARGSUSED*/
+void
+svm_launch(uint64_t pa, struct svm_regctx *gctx, struct pcpu *pcpu)
+{}
+
+#else /* lint */
+
+/*
+ * Be friendly to DTrace FBT's prologue/epilogue pattern matching.
+ *
+ * They are also responsible for saving/restoring the host %rbp across VMRUN.
+ */
+#define	VENTER  push %rbp ; mov %rsp,%rbp
+#define	VLEAVE  pop %rbp
+
+#define	VMLOAD	.byte 0x0f, 0x01, 0xda
+#define	VMRUN	.byte 0x0f, 0x01, 0xd8
+#define	VMSAVE	.byte 0x0f, 0x01, 0xdb
+
+/*
+ * svm_launch(uint64_t vmcb, struct svm_regctx *gctx, struct pcpu *pcpu)
+ * %rdi: physical address of VMCB
+ * %rsi: pointer to guest context
+ * %rdx: pointer to the pcpu data
+ */
+ENTRY(svm_launch)
+	VENTER
+
+	/* save pointer to the pcpu data */
+	push %rdx
+
+	/*
+	 * Host register state saved across a VMRUN.
+	 *
+	 * All "callee saved registers" except:
+	 * %rsp: because it is preserved by the processor across VMRUN.
+	 * %rbp: because it is saved/restored by the function prologue/epilogue.
+	 */
+	push %rbx
+	push %r12
+	push %r13
+	push %r14
+	push %r15
+
+	/* Save the physical address of the VMCB in %rax */
+	movq %rdi, %rax
+
+	push %rsi		/* push guest context pointer on the stack */
+
+	/*
+	 * Restore guest state.
+	 */
+	movq SCTX_R8(%rsi), %r8
+	movq SCTX_R9(%rsi), %r9
+	movq SCTX_R10(%rsi), %r10
+	movq SCTX_R11(%rsi), %r11
+	movq SCTX_R12(%rsi), %r12
+	movq SCTX_R13(%rsi), %r13
+	movq SCTX_R14(%rsi), %r14
+	movq SCTX_R15(%rsi), %r15
+	movq SCTX_RBP(%rsi), %rbp
+	movq SCTX_RBX(%rsi), %rbx
+	movq SCTX_RCX(%rsi), %rcx
+	movq SCTX_RDX(%rsi), %rdx
+	movq SCTX_RDI(%rsi), %rdi
+	movq SCTX_RSI(%rsi), %rsi	/* %rsi must be restored last */
+
+	VMLOAD
+	VMRUN
+	VMSAVE
+
+	pop %rax		/* pop guest context pointer from the stack */
+
+	/*
+	 * Save guest state.
+	 */
+	movq %r8, SCTX_R8(%rax)
+	movq %r9, SCTX_R9(%rax)
+	movq %r10, SCTX_R10(%rax)
+	movq %r11, SCTX_R11(%rax)
+	movq %r12, SCTX_R12(%rax)
+	movq %r13, SCTX_R13(%rax)
+	movq %r14, SCTX_R14(%rax)
+	movq %r15, SCTX_R15(%rax)
+	movq %rbp, SCTX_RBP(%rax)
+	movq %rbx, SCTX_RBX(%rax)
+	movq %rcx, SCTX_RCX(%rax)
+	movq %rdx, SCTX_RDX(%rax)
+	movq %rdi, SCTX_RDI(%rax)
+	movq %rsi, SCTX_RSI(%rax)
+
+	/* Restore host state */
+	pop %r15
+	pop %r14
+	pop %r13
+	pop %r12
+	pop %rbx
+
+	/* Restore %GS.base to point to the host's pcpu data */
+	pop %rdx
+	mov %edx, %eax
+	shr $32, %rdx
+	mov $MSR_GSBASE, %ecx
+	wrmsr
+
+	VLEAVE
+	ret
+END(svm_launch)
+
+#endif /* lint */
diff --git a/usr/src/uts/i86pc/io/vmm/amd/vmcb.c b/usr/src/uts/i86pc/io/vmm/amd/vmcb.c
new file mode 100644
index 0000000000..b1232c713d
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/vmcb.c
@@ -0,0 +1,452 @@
+/*-
+ * Copyright (c) 2013 Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+
+#include <machine/segments.h>
+#include <machine/specialreg.h>
+#include <machine/vmm.h>
+
+#include "vmm_ktr.h"
+
+#include "vmcb.h"
+#include "svm.h"
+#include "svm_softc.h"
+
+/*
+ * The VMCB aka Virtual Machine Control Block is a 4KB aligned page
+ * in memory that describes the virtual machine.
+ *
+ * The VMCB contains:
+ * - instructions or events in the guest to intercept
+ * - control bits that modify execution environment of the guest
+ * - guest processor state (e.g. general purpose registers)
+ */
+
+/*
+ * Return VMCB segment area.
+ */
+static struct vmcb_segment *
+vmcb_segptr(struct vmcb *vmcb, int type)
+{
+	struct vmcb_state *state;
+	struct vmcb_segment *seg;
+
+	state = &vmcb->state;
+
+	switch (type) {
+	case VM_REG_GUEST_CS:
+		seg = &state->cs;
+		break;
+
+	case VM_REG_GUEST_DS:
+		seg = &state->ds;
+		break;
+
+	case VM_REG_GUEST_ES:
+		seg = &state->es;
+		break;
+
+	case VM_REG_GUEST_FS:
+		seg = &state->fs;
+		break;
+
+	case VM_REG_GUEST_GS:
+		seg = &state->gs;
+		break;
+
+	case VM_REG_GUEST_SS:
+		seg = &state->ss;
+		break;
+
+	case VM_REG_GUEST_GDTR:
+		seg = &state->gdt;
+		break;
+
+	case VM_REG_GUEST_IDTR:
+		seg = &state->idt;
+		break;
+
+	case VM_REG_GUEST_LDTR:
+		seg = &state->ldt;
+		break;
+
+	case VM_REG_GUEST_TR:
+		seg = &state->tr;
+		break;
+
+	default:
+		seg = NULL;
+		break;
+	}
+
+	return (seg);
+}
+
+static int
+vmcb_access(struct svm_softc *softc, int vcpu, int write, int ident,
+	uint64_t *val)
+{
+	struct vmcb *vmcb;
+	int off, bytes;
+	char *ptr;
+
+	vmcb	= svm_get_vmcb(softc, vcpu);
+	off	= VMCB_ACCESS_OFFSET(ident);
+	bytes	= VMCB_ACCESS_BYTES(ident);
+
+	if ((off + bytes) >= sizeof (struct vmcb))
+		return (EINVAL);
+
+	ptr = (char *)vmcb;
+
+	if (!write)
+		*val = 0;
+
+	switch (bytes) {
+	case 8:
+	case 4:
+	case 2:
+		if (write)
+			memcpy(ptr + off, val, bytes);
+		else
+			memcpy(val, ptr + off, bytes);
+		break;
+	default:
+		VCPU_CTR1(softc->vm, vcpu,
+		    "Invalid size %d for VMCB access: %d", bytes);
+		return (EINVAL);
+	}
+
+	/* Invalidate all VMCB state cached by h/w. */
+	if (write)
+		svm_set_dirty(softc, vcpu, 0xffffffff);
+
+	return (0);
+}
+
+/*
+ * Read from segment selector, control and general purpose register of VMCB.
+ */
+int
+vmcb_read(struct svm_softc *sc, int vcpu, int ident, uint64_t *retval)
+{
+	struct vmcb *vmcb;
+	struct vmcb_state *state;
+	struct vmcb_segment *seg;
+	int err;
+
+	vmcb = svm_get_vmcb(sc, vcpu);
+	state = &vmcb->state;
+	err = 0;
+
+	if (VMCB_ACCESS_OK(ident))
+		return (vmcb_access(sc, vcpu, 0, ident, retval));
+
+	switch (ident) {
+	case VM_REG_GUEST_CR0:
+		*retval = state->cr0;
+		break;
+
+	case VM_REG_GUEST_CR2:
+		*retval = state->cr2;
+		break;
+
+	case VM_REG_GUEST_CR3:
+		*retval = state->cr3;
+		break;
+
+	case VM_REG_GUEST_CR4:
+		*retval = state->cr4;
+		break;
+
+	case VM_REG_GUEST_DR6:
+		*retval = state->dr6;
+		break;
+
+	case VM_REG_GUEST_DR7:
+		*retval = state->dr7;
+		break;
+
+	case VM_REG_GUEST_EFER:
+		*retval = state->efer;
+		break;
+
+	case VM_REG_GUEST_RAX:
+		*retval = state->rax;
+		break;
+
+	case VM_REG_GUEST_RFLAGS:
+		*retval = state->rflags;
+		break;
+
+	case VM_REG_GUEST_RIP:
+		*retval = state->rip;
+		break;
+
+	case VM_REG_GUEST_RSP:
+		*retval = state->rsp;
+		break;
+
+	case VM_REG_GUEST_CS:
+	case VM_REG_GUEST_DS:
+	case VM_REG_GUEST_ES:
+	case VM_REG_GUEST_FS:
+	case VM_REG_GUEST_GS:
+	case VM_REG_GUEST_SS:
+	case VM_REG_GUEST_LDTR:
+	case VM_REG_GUEST_TR:
+		seg = vmcb_segptr(vmcb, ident);
+		KASSERT(seg != NULL, ("%s: unable to get segment %d from VMCB",
+		    __func__, ident));
+		*retval = seg->selector;
+		break;
+
+	case VM_REG_GUEST_GDTR:
+	case VM_REG_GUEST_IDTR:
+		/* GDTR and IDTR don't have segment selectors */
+		err = EINVAL;
+		break;
+	default:
+		err =  EINVAL;
+		break;
+	}
+
+	return (err);
+}
+
+/*
+ * Write to segment selector, control and general purpose register of VMCB.
+ */
+int
+vmcb_write(struct svm_softc *sc, int vcpu, int ident, uint64_t val)
+{
+	struct vmcb *vmcb;
+	struct vmcb_state *state;
+	struct vmcb_segment *seg;
+	int err, dirtyseg;
+
+	vmcb = svm_get_vmcb(sc, vcpu);
+	state = &vmcb->state;
+	dirtyseg = 0;
+	err = 0;
+
+	if (VMCB_ACCESS_OK(ident))
+		return (vmcb_access(sc, vcpu, 1, ident, &val));
+
+	switch (ident) {
+	case VM_REG_GUEST_CR0:
+		state->cr0 = val;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_CR);
+		break;
+
+	case VM_REG_GUEST_CR2:
+		state->cr2 = val;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_CR2);
+		break;
+
+	case VM_REG_GUEST_CR3:
+		state->cr3 = val;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_CR);
+		break;
+
+	case VM_REG_GUEST_CR4:
+		state->cr4 = val;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_CR);
+		break;
+
+	case VM_REG_GUEST_DR6:
+		state->dr6 = val;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_DR);
+		break;
+
+	case VM_REG_GUEST_DR7:
+		state->dr7 = val;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_DR);
+		break;
+
+	case VM_REG_GUEST_EFER:
+		/* EFER_SVM must always be set when the guest is executing */
+		state->efer = val | EFER_SVM;
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_CR);
+		break;
+
+	case VM_REG_GUEST_RAX:
+		state->rax = val;
+		break;
+
+	case VM_REG_GUEST_RFLAGS:
+		state->rflags = val;
+		break;
+
+	case VM_REG_GUEST_RIP:
+		state->rip = val;
+		break;
+
+	case VM_REG_GUEST_RSP:
+		state->rsp = val;
+		break;
+
+	case VM_REG_GUEST_CS:
+	case VM_REG_GUEST_DS:
+	case VM_REG_GUEST_ES:
+	case VM_REG_GUEST_SS:
+		dirtyseg = 1;		/* FALLTHROUGH */
+	case VM_REG_GUEST_FS:
+	case VM_REG_GUEST_GS:
+	case VM_REG_GUEST_LDTR:
+	case VM_REG_GUEST_TR:
+		seg = vmcb_segptr(vmcb, ident);
+		KASSERT(seg != NULL, ("%s: unable to get segment %d from VMCB",
+		    __func__, ident));
+		seg->selector = val;
+		if (dirtyseg)
+			svm_set_dirty(sc, vcpu, VMCB_CACHE_SEG);
+		break;
+
+	case VM_REG_GUEST_GDTR:
+	case VM_REG_GUEST_IDTR:
+		/* GDTR and IDTR don't have segment selectors */
+		err = EINVAL;
+		break;
+	default:
+		err = EINVAL;
+		break;
+	}
+
+	return (err);
+}
+
+int
+vmcb_seg(struct vmcb *vmcb, int ident, struct vmcb_segment *seg2)
+{
+	struct vmcb_segment *seg;
+
+	seg = vmcb_segptr(vmcb, ident);
+	if (seg != NULL) {
+		bcopy(seg, seg2, sizeof(struct vmcb_segment));
+		return (0);
+	} else {
+		return (EINVAL);
+	}
+}
+
+int
+vmcb_setdesc(void *arg, int vcpu, int reg, struct seg_desc *desc)
+{
+	struct vmcb *vmcb;
+	struct svm_softc *sc;
+	struct vmcb_segment *seg;
+	uint16_t attrib;
+
+	sc = arg;
+	vmcb = svm_get_vmcb(sc, vcpu);
+
+	seg = vmcb_segptr(vmcb, reg);
+	KASSERT(seg != NULL, ("%s: invalid segment descriptor %d",
+	    __func__, reg));
+
+	seg->base = desc->base;
+	seg->limit = desc->limit;
+	if (reg != VM_REG_GUEST_GDTR && reg != VM_REG_GUEST_IDTR) {
+		/*
+		 * Map seg_desc access to VMCB attribute format.
+		 *
+		 * SVM uses the 'P' bit in the segment attributes to indicate a
+		 * NULL segment so clear it if the segment is marked unusable.
+		 */
+		attrib = ((desc->access & 0xF000) >> 4) | (desc->access & 0xFF);
+		if (SEG_DESC_UNUSABLE(desc->access)) {
+			attrib &= ~0x80;
+		}
+		seg->attrib = attrib;
+	}
+
+	VCPU_CTR4(sc->vm, vcpu, "Setting desc %d: base (%#lx), limit (%#x), "
+	    "attrib (%#x)", reg, seg->base, seg->limit, seg->attrib);
+
+	switch (reg) {
+	case VM_REG_GUEST_CS:
+	case VM_REG_GUEST_DS:
+	case VM_REG_GUEST_ES:
+	case VM_REG_GUEST_SS:
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_SEG);
+		break;
+	case VM_REG_GUEST_GDTR:
+	case VM_REG_GUEST_IDTR:
+		svm_set_dirty(sc, vcpu, VMCB_CACHE_DT);
+		break;
+	default:
+		break;
+	}
+
+	return (0);
+}
+
+int
+vmcb_getdesc(void *arg, int vcpu, int reg, struct seg_desc *desc)
+{
+	struct vmcb *vmcb;
+	struct svm_softc *sc;
+	struct vmcb_segment *seg;
+
+	sc = arg;
+	vmcb = svm_get_vmcb(sc, vcpu);
+	seg = vmcb_segptr(vmcb, reg);
+	KASSERT(seg != NULL, ("%s: invalid segment descriptor %d",
+	    __func__, reg));
+
+	desc->base = seg->base;
+	desc->limit = seg->limit;
+	desc->access = 0;
+
+	if (reg != VM_REG_GUEST_GDTR && reg != VM_REG_GUEST_IDTR) {
+		/* Map seg_desc access to VMCB attribute format */
+		desc->access = ((seg->attrib & 0xF00) << 4) |
+		    (seg->attrib & 0xFF);
+
+		/*
+		 * VT-x uses bit 16 to indicate a segment that has been loaded
+		 * with a NULL selector (aka unusable). The 'desc->access'
+		 * field is interpreted in the VT-x format by the
+		 * processor-independent code.
+		 *
+		 * SVM uses the 'P' bit to convey the same information so
+		 * convert it into the VT-x format. For more details refer to
+		 * section "Segment State in the VMCB" in APMv2.
+		 */
+		if (reg != VM_REG_GUEST_CS && reg != VM_REG_GUEST_TR) {
+			if ((desc->access & 0x80) == 0)
+				desc->access |= 0x10000;  /* Unusable segment */
+		}
+	}
+
+	return (0);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/amd/vmcb.h b/usr/src/uts/i86pc/io/vmm/amd/vmcb.h
new file mode 100644
index 0000000000..163f48f010
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/amd/vmcb.h
@@ -0,0 +1,334 @@
+/*-
+ * Copyright (c) 2013 Anish Gupta (akgupt3@gmail.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VMCB_H_
+#define	_VMCB_H_
+
+struct svm_softc;
+
+#define BIT(n)			(1ULL << n)
+
+/*
+ * Secure Virtual Machine: AMD64 Programmer's Manual Vol2, Chapter 15
+ * Layout of VMCB: AMD64 Programmer's Manual Vol2, Appendix B
+ */
+
+/* vmcb_ctrl->intercept[] array indices */
+#define	VMCB_CR_INTCPT		0
+#define	VMCB_DR_INTCPT		1
+#define	VMCB_EXC_INTCPT		2
+#define	VMCB_CTRL1_INTCPT	3
+#define	VMCB_CTRL2_INTCPT	4
+
+/* intercept[VMCB_CTRL1_INTCPT] fields */
+#define	VMCB_INTCPT_INTR		BIT(0)
+#define	VMCB_INTCPT_NMI			BIT(1)
+#define	VMCB_INTCPT_SMI			BIT(2)
+#define	VMCB_INTCPT_INIT		BIT(3)
+#define	VMCB_INTCPT_VINTR		BIT(4)
+#define	VMCB_INTCPT_CR0_WRITE		BIT(5)
+#define	VMCB_INTCPT_IDTR_READ		BIT(6)
+#define	VMCB_INTCPT_GDTR_READ		BIT(7)
+#define	VMCB_INTCPT_LDTR_READ		BIT(8)
+#define	VMCB_INTCPT_TR_READ		BIT(9)
+#define	VMCB_INTCPT_IDTR_WRITE		BIT(10)
+#define	VMCB_INTCPT_GDTR_WRITE		BIT(11)
+#define	VMCB_INTCPT_LDTR_WRITE		BIT(12)
+#define	VMCB_INTCPT_TR_WRITE		BIT(13)
+#define	VMCB_INTCPT_RDTSC		BIT(14)
+#define	VMCB_INTCPT_RDPMC		BIT(15)
+#define	VMCB_INTCPT_PUSHF		BIT(16)
+#define	VMCB_INTCPT_POPF		BIT(17)
+#define	VMCB_INTCPT_CPUID		BIT(18)
+#define	VMCB_INTCPT_RSM			BIT(19)
+#define	VMCB_INTCPT_IRET		BIT(20)
+#define	VMCB_INTCPT_INTn		BIT(21)
+#define	VMCB_INTCPT_INVD		BIT(22)
+#define	VMCB_INTCPT_PAUSE		BIT(23)
+#define	VMCB_INTCPT_HLT			BIT(24)
+#define	VMCB_INTCPT_INVPG		BIT(25)
+#define	VMCB_INTCPT_INVPGA		BIT(26)
+#define	VMCB_INTCPT_IO			BIT(27)
+#define	VMCB_INTCPT_MSR			BIT(28)
+#define	VMCB_INTCPT_TASK_SWITCH		BIT(29)
+#define	VMCB_INTCPT_FERR_FREEZE		BIT(30)
+#define	VMCB_INTCPT_SHUTDOWN		BIT(31)
+
+/* intercept[VMCB_CTRL2_INTCPT] fields */
+#define	VMCB_INTCPT_VMRUN		BIT(0)
+#define	VMCB_INTCPT_VMMCALL		BIT(1)
+#define	VMCB_INTCPT_VMLOAD		BIT(2)
+#define	VMCB_INTCPT_VMSAVE		BIT(3)
+#define	VMCB_INTCPT_STGI		BIT(4)
+#define	VMCB_INTCPT_CLGI		BIT(5)
+#define	VMCB_INTCPT_SKINIT		BIT(6)
+#define	VMCB_INTCPT_RDTSCP		BIT(7)
+#define	VMCB_INTCPT_ICEBP		BIT(8)
+#define	VMCB_INTCPT_WBINVD		BIT(9)
+#define	VMCB_INTCPT_MONITOR		BIT(10)
+#define	VMCB_INTCPT_MWAIT		BIT(11)
+#define	VMCB_INTCPT_MWAIT_ARMED		BIT(12)
+#define	VMCB_INTCPT_XSETBV		BIT(13)
+
+/* VMCB TLB control */
+#define	VMCB_TLB_FLUSH_NOTHING		0	/* Flush nothing */
+#define	VMCB_TLB_FLUSH_ALL		1	/* Flush entire TLB */
+#define	VMCB_TLB_FLUSH_GUEST		3	/* Flush all guest entries */
+#define	VMCB_TLB_FLUSH_GUEST_NONGLOBAL	7	/* Flush guest non-PG entries */
+
+/* VMCB state caching */
+#define	VMCB_CACHE_NONE		0	/* No caching */
+#define	VMCB_CACHE_I		BIT(0)	/* Intercept, TSC off, Pause filter */
+#define	VMCB_CACHE_IOPM		BIT(1)	/* I/O and MSR permission */
+#define	VMCB_CACHE_ASID		BIT(2)	/* ASID */
+#define	VMCB_CACHE_TPR		BIT(3)	/* V_TPR to V_INTR_VECTOR */
+#define	VMCB_CACHE_NP		BIT(4)	/* Nested Paging */
+#define	VMCB_CACHE_CR		BIT(5)	/* CR0, CR3, CR4 & EFER */
+#define	VMCB_CACHE_DR		BIT(6)	/* Debug registers */
+#define	VMCB_CACHE_DT		BIT(7)	/* GDT/IDT */
+#define	VMCB_CACHE_SEG		BIT(8)	/* User segments, CPL */
+#define	VMCB_CACHE_CR2		BIT(9)	/* page fault address */
+#define	VMCB_CACHE_LBR		BIT(10)	/* Last branch */
+
+/* VMCB control event injection */
+#define	VMCB_EVENTINJ_EC_VALID		BIT(11)	/* Error Code valid */
+#define	VMCB_EVENTINJ_VALID		BIT(31)	/* Event valid */
+
+/* Event types that can be injected */
+#define	VMCB_EVENTINJ_TYPE_INTR		0
+#define	VMCB_EVENTINJ_TYPE_NMI		2
+#define	VMCB_EVENTINJ_TYPE_EXCEPTION	3
+#define	VMCB_EVENTINJ_TYPE_INTn		4
+
+/* VMCB exit code, APM vol2 Appendix C */
+#define	VMCB_EXIT_MC			0x52
+#define	VMCB_EXIT_INTR			0x60
+#define	VMCB_EXIT_NMI			0x61
+#define	VMCB_EXIT_VINTR			0x64
+#define	VMCB_EXIT_PUSHF			0x70
+#define	VMCB_EXIT_POPF			0x71
+#define	VMCB_EXIT_CPUID			0x72
+#define	VMCB_EXIT_IRET			0x74
+#define	VMCB_EXIT_PAUSE			0x77
+#define	VMCB_EXIT_HLT			0x78
+#define	VMCB_EXIT_IO			0x7B
+#define	VMCB_EXIT_MSR			0x7C
+#define	VMCB_EXIT_SHUTDOWN		0x7F
+#define	VMCB_EXIT_VMSAVE		0x83
+#define	VMCB_EXIT_MONITOR		0x8A
+#define	VMCB_EXIT_MWAIT			0x8B
+#define	VMCB_EXIT_NPF			0x400
+#define	VMCB_EXIT_INVALID		-1
+
+/*
+ * Nested page fault.
+ * Bit definitions to decode EXITINFO1.
+ */
+#define	VMCB_NPF_INFO1_P		BIT(0) /* Nested page present. */
+#define	VMCB_NPF_INFO1_W		BIT(1) /* Access was write. */
+#define	VMCB_NPF_INFO1_U		BIT(2) /* Access was user access. */
+#define	VMCB_NPF_INFO1_RSV		BIT(3) /* Reserved bits present. */
+#define	VMCB_NPF_INFO1_ID		BIT(4) /* Code read. */
+
+#define	VMCB_NPF_INFO1_GPA		BIT(32) /* Guest physical address. */
+#define	VMCB_NPF_INFO1_GPT		BIT(33) /* Guest page table. */
+
+/*
+ * EXITINTINFO, Interrupt exit info for all intrecepts.
+ * Section 15.7.2, Intercepts during IDT Interrupt Delivery.
+ */
+#define VMCB_EXITINTINFO_VECTOR(x)	((x) & 0xFF)
+#define VMCB_EXITINTINFO_TYPE(x)	(((x) >> 8) & 0x7)
+#define VMCB_EXITINTINFO_EC_VALID(x)	(((x) & BIT(11)) ? 1 : 0)
+#define VMCB_EXITINTINFO_VALID(x)	(((x) & BIT(31)) ? 1 : 0)
+#define VMCB_EXITINTINFO_EC(x)		(((x) >> 32) & 0xFFFFFFFF)
+
+/* Offset of various VMCB fields. */
+#define	VMCB_OFF_CTRL(x)		(x)
+#define	VMCB_OFF_STATE(x)		((x) + 0x400)
+
+#define	VMCB_OFF_CR_INTERCEPT		VMCB_OFF_CTRL(0x0)
+#define	VMCB_OFF_DR_INTERCEPT		VMCB_OFF_CTRL(0x4)
+#define	VMCB_OFF_EXC_INTERCEPT		VMCB_OFF_CTRL(0x8)
+#define	VMCB_OFF_INST1_INTERCEPT	VMCB_OFF_CTRL(0xC)
+#define	VMCB_OFF_INST2_INTERCEPT	VMCB_OFF_CTRL(0x10)
+#define	VMCB_OFF_IO_PERM		VMCB_OFF_CTRL(0x40)
+#define	VMCB_OFF_MSR_PERM		VMCB_OFF_CTRL(0x48)
+#define	VMCB_OFF_TSC_OFFSET		VMCB_OFF_CTRL(0x50)
+#define	VMCB_OFF_ASID			VMCB_OFF_CTRL(0x58)
+#define	VMCB_OFF_TLB_CTRL		VMCB_OFF_CTRL(0x5C)
+#define	VMCB_OFF_VIRQ			VMCB_OFF_CTRL(0x60)
+#define	VMCB_OFF_EXIT_REASON		VMCB_OFF_CTRL(0x70)
+#define	VMCB_OFF_EXITINFO1		VMCB_OFF_CTRL(0x78)
+#define	VMCB_OFF_EXITINFO2		VMCB_OFF_CTRL(0x80)
+#define	VMCB_OFF_EXITINTINFO		VMCB_OFF_CTRL(0x88)
+#define	VMCB_OFF_AVIC_BAR		VMCB_OFF_CTRL(0x98)
+#define	VMCB_OFF_NPT_BASE		VMCB_OFF_CTRL(0xB0)
+#define	VMCB_OFF_AVIC_PAGE		VMCB_OFF_CTRL(0xE0)
+#define	VMCB_OFF_AVIC_LT		VMCB_OFF_CTRL(0xF0)
+#define	VMCB_OFF_AVIC_PT		VMCB_OFF_CTRL(0xF8)
+#define	VMCB_OFF_SYSENTER_CS		VMCB_OFF_STATE(0x228)
+#define	VMCB_OFF_SYSENTER_ESP		VMCB_OFF_STATE(0x230)
+#define	VMCB_OFF_SYSENTER_EIP		VMCB_OFF_STATE(0x238)
+#define	VMCB_OFF_GUEST_PAT		VMCB_OFF_STATE(0x268)
+
+/*
+ * Encode the VMCB offset and bytes that we want to read from VMCB.
+ */
+#define	VMCB_ACCESS(o, w)		(0x80000000 | (((w) & 0xF) << 16) | \
+					((o) & 0xFFF))
+#define	VMCB_ACCESS_OK(v)               ((v) & 0x80000000 )
+#define	VMCB_ACCESS_BYTES(v)            (((v) >> 16) & 0xF)
+#define	VMCB_ACCESS_OFFSET(v)           ((v) & 0xFFF)
+
+#ifdef _KERNEL
+/* VMCB save state area segment format */
+struct vmcb_segment {
+	uint16_t	selector;
+	uint16_t	attrib;
+	uint32_t	limit;
+	uint64_t	base;
+} __attribute__ ((__packed__));
+CTASSERT(sizeof(struct vmcb_segment) == 16);
+
+/* Code segment descriptor attribute in 12 bit format as saved by VMCB. */
+#define	VMCB_CS_ATTRIB_L		BIT(9)	/* Long mode. */
+#define	VMCB_CS_ATTRIB_D		BIT(10)	/* OPerand size bit. */
+
+/*
+ * The VMCB is divided into two areas - the first one contains various
+ * control bits including the intercept vector and the second one contains
+ * the guest state.
+ */
+
+/* VMCB control area - padded up to 1024 bytes */
+struct vmcb_ctrl {
+	uint32_t intercept[5];	/* all intercepts */
+	uint8_t	 pad1[0x28];	/* Offsets 0x14-0x3B are reserved. */
+	uint16_t pause_filthresh; /* Offset 0x3C, PAUSE filter threshold */
+	uint16_t pause_filcnt;  /* Offset 0x3E, PAUSE filter count */
+	uint64_t iopm_base_pa;	/* 0x40: IOPM_BASE_PA */
+	uint64_t msrpm_base_pa; /* 0x48: MSRPM_BASE_PA */
+	uint64_t tsc_offset;	/* 0x50: TSC_OFFSET */
+	uint32_t asid;		/* 0x58: Guest ASID */
+	uint8_t	 tlb_ctrl;	/* 0x5C: TLB_CONTROL */
+	uint8_t  pad2[3];	/* 0x5D-0x5F: Reserved. */
+	uint8_t	 v_tpr;		/* 0x60: V_TPR, guest CR8 */
+	uint8_t	 v_irq:1;	/* Is virtual interrupt pending? */
+	uint8_t	:7; 		/* Padding */
+	uint8_t v_intr_prio:4;	/* 0x62: Priority for virtual interrupt. */
+	uint8_t v_ign_tpr:1;
+	uint8_t :3;
+	uint8_t	v_intr_masking:1; /* Guest and host sharing of RFLAGS. */
+	uint8_t	:7;
+	uint8_t	v_intr_vector;	/* 0x64: Vector for virtual interrupt. */
+	uint8_t pad3[3];	/* 0x65-0x67 Reserved. */
+	uint64_t intr_shadow:1; /* 0x68: Interrupt shadow, section15.2.1 APM2 */
+	uint64_t :63;
+	uint64_t exitcode;	/* 0x70, Exitcode */
+	uint64_t exitinfo1;	/* 0x78, EXITINFO1 */
+	uint64_t exitinfo2;	/* 0x80, EXITINFO2 */
+	uint64_t exitintinfo;	/* 0x88, Interrupt exit value. */
+	uint64_t np_enable:1;   /* 0x90, Nested paging enable. */
+	uint64_t :63;
+	uint8_t  pad4[0x10];	/* 0x98-0xA7 reserved. */
+	uint64_t eventinj;	/* 0xA8, Event injection. */
+	uint64_t n_cr3;		/* B0, Nested page table. */
+	uint64_t lbr_virt_en:1;	/* Enable LBR virtualization. */
+	uint64_t :63;
+	uint32_t vmcb_clean;	/* 0xC0: VMCB clean bits for caching */
+	uint32_t :32;		/* 0xC4: Reserved */
+	uint64_t nrip;		/* 0xC8: Guest next nRIP. */
+	uint8_t	inst_len;	/* 0xD0: #NPF decode assist */
+	uint8_t	inst_bytes[15];
+	uint8_t	padd6[0x320];
+} __attribute__ ((__packed__));
+CTASSERT(sizeof(struct vmcb_ctrl) == 1024);
+
+struct vmcb_state {
+	struct   vmcb_segment es;
+	struct   vmcb_segment cs;
+	struct   vmcb_segment ss;
+	struct   vmcb_segment ds;
+	struct   vmcb_segment fs;
+	struct   vmcb_segment gs;
+	struct   vmcb_segment gdt;
+	struct   vmcb_segment ldt;
+	struct   vmcb_segment idt;
+	struct   vmcb_segment tr;
+	uint8_t	 pad1[0x2b];		/* Reserved: 0xA0-0xCA */
+	uint8_t	 cpl;
+	uint8_t  pad2[4];
+	uint64_t efer;
+	uint8_t	 pad3[0x70];		/* Reserved: 0xd8-0x147 */
+	uint64_t cr4;
+	uint64_t cr3;			/* Guest CR3 */
+	uint64_t cr0;
+	uint64_t dr7;
+	uint64_t dr6;
+	uint64_t rflags;
+	uint64_t rip;
+	uint8_t	 pad4[0x58]; 		/* Reserved: 0x180-0x1D7 */
+	uint64_t rsp;
+	uint8_t	 pad5[0x18]; 		/* Reserved 0x1E0-0x1F7 */
+	uint64_t rax;
+	uint64_t star;
+	uint64_t lstar;
+	uint64_t cstar;
+	uint64_t sfmask;
+	uint64_t kernelgsbase;
+	uint64_t sysenter_cs;
+	uint64_t sysenter_esp;
+	uint64_t sysenter_eip;
+	uint64_t cr2;
+	uint8_t	 pad6[0x20];
+	uint64_t g_pat;
+	uint64_t dbgctl;
+	uint64_t br_from;
+	uint64_t br_to;
+	uint64_t int_from;
+	uint64_t int_to;
+	uint8_t	 pad7[0x968];		/* Reserved up to end of VMCB */
+} __attribute__ ((__packed__));
+CTASSERT(sizeof(struct vmcb_state) == 0xC00);
+
+struct vmcb {
+	struct vmcb_ctrl ctrl;
+	struct vmcb_state state;
+} __attribute__ ((__packed__));
+CTASSERT(sizeof(struct vmcb) == PAGE_SIZE);
+CTASSERT(offsetof(struct vmcb, state) == 0x400);
+
+int	vmcb_read(struct svm_softc *sc, int vcpu, int ident, uint64_t *retval);
+int	vmcb_write(struct svm_softc *sc, int vcpu, int ident, uint64_t val);
+int	vmcb_setdesc(void *arg, int vcpu, int ident, struct seg_desc *desc);
+int	vmcb_getdesc(void *arg, int vcpu, int ident, struct seg_desc *desc);
+int	vmcb_seg(struct vmcb *vmcb, int ident, struct vmcb_segment *seg);
+
+#endif /* _KERNEL */
+#endif /* _VMCB_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/intel/ept.c b/usr/src/uts/i86pc/io/vmm/intel/ept.c
new file mode 100644
index 0000000000..a9838793e5
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/ept.c
@@ -0,0 +1,219 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/smp.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_extern.h>
+
+#include <machine/vmm.h>
+
+#include "vmx_cpufunc.h"
+#include "ept.h"
+
+#define	EPT_SUPPORTS_EXEC_ONLY(cap)	((cap) & (1UL << 0))
+#define	EPT_PWL4(cap)			((cap) & (1UL << 6))
+#define	EPT_MEMORY_TYPE_WB(cap)		((cap) & (1UL << 14))
+#define	EPT_PDE_SUPERPAGE(cap)		((cap) & (1UL << 16))	/* 2MB pages */
+#define	EPT_PDPTE_SUPERPAGE(cap)	((cap) & (1UL << 17))	/* 1GB pages */
+#define	INVEPT_SUPPORTED(cap)		((cap) & (1UL << 20))
+#define	AD_BITS_SUPPORTED(cap)		((cap) & (1UL << 21))
+#define	INVVPID_SUPPORTED(cap)		((cap) & (1UL << 32))
+
+#define	INVVPID_ALL_TYPES_MASK		0xF0000000000UL
+#define	INVVPID_ALL_TYPES_SUPPORTED(cap)	\
+	(((cap) & INVVPID_ALL_TYPES_MASK) == INVVPID_ALL_TYPES_MASK)
+
+#define	INVEPT_ALL_TYPES_MASK		0x6000000UL
+#define	INVEPT_ALL_TYPES_SUPPORTED(cap)		\
+	(((cap) & INVEPT_ALL_TYPES_MASK) == INVEPT_ALL_TYPES_MASK)
+
+#define	EPT_PWLEVELS		4		/* page walk levels */
+#define	EPT_ENABLE_AD_BITS	(1 << 6)
+
+SYSCTL_DECL(_hw_vmm);
+SYSCTL_NODE(_hw_vmm, OID_AUTO, ept, CTLFLAG_RW, NULL, NULL);
+
+static int ept_enable_ad_bits;
+
+static int ept_pmap_flags;
+SYSCTL_INT(_hw_vmm_ept, OID_AUTO, pmap_flags, CTLFLAG_RD,
+    &ept_pmap_flags, 0, NULL);
+
+int
+ept_init(int ipinum)
+{
+	int use_hw_ad_bits, use_superpages, use_exec_only;
+	uint64_t cap;
+
+	cap = rdmsr(MSR_VMX_EPT_VPID_CAP);
+
+	/*
+	 * Verify that:
+	 * - page walk length is 4 steps
+	 * - extended page tables can be laid out in write-back memory
+	 * - invvpid instruction with all possible types is supported
+	 * - invept instruction with all possible types is supported
+	 */
+	if (!EPT_PWL4(cap) ||
+	    !EPT_MEMORY_TYPE_WB(cap) ||
+	    !INVVPID_SUPPORTED(cap) ||
+	    !INVVPID_ALL_TYPES_SUPPORTED(cap) ||
+	    !INVEPT_SUPPORTED(cap) ||
+	    !INVEPT_ALL_TYPES_SUPPORTED(cap))
+		return (EINVAL);
+
+	ept_pmap_flags = ipinum & PMAP_NESTED_IPIMASK;
+
+	use_superpages = 1;
+	TUNABLE_INT_FETCH("hw.vmm.ept.use_superpages", &use_superpages);
+	if (use_superpages && EPT_PDE_SUPERPAGE(cap))
+		ept_pmap_flags |= PMAP_PDE_SUPERPAGE;	/* 2MB superpage */
+
+	use_hw_ad_bits = 1;
+	TUNABLE_INT_FETCH("hw.vmm.ept.use_hw_ad_bits", &use_hw_ad_bits);
+	if (use_hw_ad_bits && AD_BITS_SUPPORTED(cap))
+		ept_enable_ad_bits = 1;
+	else
+		ept_pmap_flags |= PMAP_EMULATE_AD_BITS;
+
+	use_exec_only = 1;
+	TUNABLE_INT_FETCH("hw.vmm.ept.use_exec_only", &use_exec_only);
+	if (use_exec_only && EPT_SUPPORTS_EXEC_ONLY(cap))
+		ept_pmap_flags |= PMAP_SUPPORTS_EXEC_ONLY;
+
+	return (0);
+}
+
+#if 0
+static void
+ept_dump(uint64_t *ptp, int nlevels)
+{
+	int i, t, tabs;
+	uint64_t *ptpnext, ptpval;
+
+	if (--nlevels < 0)
+		return;
+
+	tabs = 3 - nlevels;
+	for (t = 0; t < tabs; t++)
+		printf("\t");
+	printf("PTP = %p\n", ptp);
+
+	for (i = 0; i < 512; i++) {
+		ptpval = ptp[i];
+
+		if (ptpval == 0)
+			continue;
+		
+		for (t = 0; t < tabs; t++)
+			printf("\t");
+		printf("%3d 0x%016lx\n", i, ptpval);
+
+		if (nlevels != 0 && (ptpval & EPT_PG_SUPERPAGE) == 0) {
+			ptpnext = (uint64_t *)
+				  PHYS_TO_DMAP(ptpval & EPT_ADDR_MASK);
+			ept_dump(ptpnext, nlevels);
+		}
+	}
+}
+#endif
+
+static void
+invept_single_context(void *arg)
+{
+	struct invept_desc desc = *(struct invept_desc *)arg;
+
+	invept(INVEPT_TYPE_SINGLE_CONTEXT, desc);
+}
+
+void
+ept_invalidate_mappings(u_long eptp)
+{
+	struct invept_desc invept_desc = { 0 };
+
+	invept_desc.eptp = eptp;
+
+	smp_rendezvous(NULL, invept_single_context, NULL, &invept_desc);
+}
+
+static int
+ept_pinit(pmap_t pmap)
+{
+
+	return (pmap_pinit_type(pmap, PT_EPT, ept_pmap_flags));
+}
+
+struct vmspace *
+ept_vmspace_alloc(vm_offset_t min, vm_offset_t max)
+{
+
+	return (vmspace_alloc(min, max, ept_pinit));
+}
+
+void
+ept_vmspace_free(struct vmspace *vmspace)
+{
+
+	vmspace_free(vmspace);
+}
+
+uint64_t
+eptp(uint64_t pml4)
+{
+	uint64_t eptp_val;
+
+	eptp_val = pml4 | (EPT_PWLEVELS - 1) << 3 | PAT_WRITE_BACK;
+	if (ept_enable_ad_bits)
+		eptp_val |= EPT_ENABLE_AD_BITS;
+
+	return (eptp_val);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/intel/ept.h b/usr/src/uts/i86pc/io/vmm/intel/ept.h
new file mode 100644
index 0000000000..4a029e8b22
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/ept.h
@@ -0,0 +1,41 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_EPT_H_
+#define	_EPT_H_
+
+struct vmx;
+
+int	ept_init(int ipinum);
+void	ept_invalidate_mappings(u_long eptp);
+struct vmspace *ept_vmspace_alloc(vm_offset_t min, vm_offset_t max);
+void	ept_vmspace_free(struct vmspace *vmspace);
+uint64_t eptp(uint64_t pml4);
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/offsets.in b/usr/src/uts/i86pc/io/vmm/intel/offsets.in
new file mode 100644
index 0000000000..d60a2d8f5f
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/offsets.in
@@ -0,0 +1,62 @@
+/*
+ * COPYRIGHT 2014 Pluribus Networks Inc.
+ *
+ * All rights reserved. This copyright notice is Copyright Management
+ * Information under 17 USC 1202 and is included to protect this work and
+ * deter copyright infringement.  Removal or alteration of this Copyright
+ * Management Information without the express written permission from
+ * Pluribus Networks Inc is prohibited, and any such unauthorized removal
+ * or alteration will be a violation of federal law.
+ */
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/cpuvar.h>
+
+#include <machine/pmap.h>
+#include <machine/vmm.h>
+
+#include "intel/vmx_cpufunc.h"
+#include "intel/vmx.h"
+#include "vm/vm_glue.h"
+
+vmxctx
+	guest_rdi		VMXCTX_GUEST_RDI
+	guest_rsi		VMXCTX_GUEST_RSI
+	guest_rdx		VMXCTX_GUEST_RDX
+	guest_rcx		VMXCTX_GUEST_RCX
+	guest_r8		VMXCTX_GUEST_R8
+	guest_r9		VMXCTX_GUEST_R9
+	guest_rax		VMXCTX_GUEST_RAX
+	guest_rbx		VMXCTX_GUEST_RBX
+	guest_rbp		VMXCTX_GUEST_RBP
+	guest_r10		VMXCTX_GUEST_R10
+	guest_r11		VMXCTX_GUEST_R11
+	guest_r12		VMXCTX_GUEST_R12
+	guest_r13		VMXCTX_GUEST_R13
+	guest_r14		VMXCTX_GUEST_R14
+	guest_r15		VMXCTX_GUEST_R15
+	guest_cr2		VMXCTX_GUEST_CR2
+	inst_fail_status	VMXCTX_INST_FAIL_STATUS
+	pmap			VMXCTX_PMAP
+
+vmx
+	eptgen		VMX_EPTGEN
+	eptp		VMX_EPTP
+
+pmap
+	pm_active	PM_ACTIVE
+	pm_eptgen	PM_EPTGEN
+
+cpu
+	cpu_id
+
+\#define	VM_SUCCESS		0
+\#define	VM_FAIL_INVALID		1
+\#define	VM_FAIL_VALID		2
+
+\#define	VMX_GUEST_VMEXIT	0
+\#define	VMX_VMRESUME_ERROR	1
+\#define	VMX_VMLAUNCH_ERROR	2
+\#define	VMX_INVEPT_ERROR	3
+\#define	VMX_VMWRITE_ERROR	4
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmcs.c b/usr/src/uts/i86pc/io/vmm/intel/vmcs.c
new file mode 100644
index 0000000000..d19f6bc262
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmcs.c
@@ -0,0 +1,560 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifdef	__FreeBSD__
+#include "opt_ddb.h"
+#endif
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/sysctl.h>
+#include <sys/systm.h>
+#include <sys/pcpu.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+
+#include <machine/segments.h>
+#include <machine/vmm.h>
+#include "vmm_host.h"
+#include "vmx_cpufunc.h"
+#include "vmcs.h"
+#include "ept.h"
+#include "vmx.h"
+
+#ifdef DDB
+#include <ddb/ddb.h>
+#endif
+
+SYSCTL_DECL(_hw_vmm_vmx);
+
+static int no_flush_rsb;
+SYSCTL_INT(_hw_vmm_vmx, OID_AUTO, no_flush_rsb, CTLFLAG_RW,
+    &no_flush_rsb, 0, "Do not flush RSB upon vmexit");
+
+static uint64_t
+vmcs_fix_regval(uint32_t encoding, uint64_t val)
+{
+
+	switch (encoding) {
+	case VMCS_GUEST_CR0:
+		val = vmx_fix_cr0(val);
+		break;
+	case VMCS_GUEST_CR4:
+		val = vmx_fix_cr4(val);
+		break;
+	default:
+		break;
+	}
+	return (val);
+}
+
+static uint32_t
+vmcs_field_encoding(int ident)
+{
+	switch (ident) {
+	case VM_REG_GUEST_CR0:
+		return (VMCS_GUEST_CR0);
+	case VM_REG_GUEST_CR3:
+		return (VMCS_GUEST_CR3);
+	case VM_REG_GUEST_CR4:
+		return (VMCS_GUEST_CR4);
+	case VM_REG_GUEST_DR7:
+		return (VMCS_GUEST_DR7);
+	case VM_REG_GUEST_RSP:
+		return (VMCS_GUEST_RSP);
+	case VM_REG_GUEST_RIP:
+		return (VMCS_GUEST_RIP);
+	case VM_REG_GUEST_RFLAGS:
+		return (VMCS_GUEST_RFLAGS);
+	case VM_REG_GUEST_ES:
+		return (VMCS_GUEST_ES_SELECTOR);
+	case VM_REG_GUEST_CS:
+		return (VMCS_GUEST_CS_SELECTOR);
+	case VM_REG_GUEST_SS:
+		return (VMCS_GUEST_SS_SELECTOR);
+	case VM_REG_GUEST_DS:
+		return (VMCS_GUEST_DS_SELECTOR);
+	case VM_REG_GUEST_FS:
+		return (VMCS_GUEST_FS_SELECTOR);
+	case VM_REG_GUEST_GS:
+		return (VMCS_GUEST_GS_SELECTOR);
+	case VM_REG_GUEST_TR:
+		return (VMCS_GUEST_TR_SELECTOR);
+	case VM_REG_GUEST_LDTR:
+		return (VMCS_GUEST_LDTR_SELECTOR);
+	case VM_REG_GUEST_EFER:
+		return (VMCS_GUEST_IA32_EFER);
+	case VM_REG_GUEST_PDPTE0:
+		return (VMCS_GUEST_PDPTE0);
+	case VM_REG_GUEST_PDPTE1:
+		return (VMCS_GUEST_PDPTE1);
+	case VM_REG_GUEST_PDPTE2:
+		return (VMCS_GUEST_PDPTE2);
+	case VM_REG_GUEST_PDPTE3:
+		return (VMCS_GUEST_PDPTE3);
+	default:
+		return (-1);
+	}
+
+}
+
+static int
+vmcs_seg_desc_encoding(int seg, uint32_t *base, uint32_t *lim, uint32_t *acc)
+{
+
+	switch (seg) {
+	case VM_REG_GUEST_ES:
+		*base = VMCS_GUEST_ES_BASE;
+		*lim = VMCS_GUEST_ES_LIMIT;
+		*acc = VMCS_GUEST_ES_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_CS:
+		*base = VMCS_GUEST_CS_BASE;
+		*lim = VMCS_GUEST_CS_LIMIT;
+		*acc = VMCS_GUEST_CS_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_SS:
+		*base = VMCS_GUEST_SS_BASE;
+		*lim = VMCS_GUEST_SS_LIMIT;
+		*acc = VMCS_GUEST_SS_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_DS:
+		*base = VMCS_GUEST_DS_BASE;
+		*lim = VMCS_GUEST_DS_LIMIT;
+		*acc = VMCS_GUEST_DS_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_FS:
+		*base = VMCS_GUEST_FS_BASE;
+		*lim = VMCS_GUEST_FS_LIMIT;
+		*acc = VMCS_GUEST_FS_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_GS:
+		*base = VMCS_GUEST_GS_BASE;
+		*lim = VMCS_GUEST_GS_LIMIT;
+		*acc = VMCS_GUEST_GS_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_TR:
+		*base = VMCS_GUEST_TR_BASE;
+		*lim = VMCS_GUEST_TR_LIMIT;
+		*acc = VMCS_GUEST_TR_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_LDTR:
+		*base = VMCS_GUEST_LDTR_BASE;
+		*lim = VMCS_GUEST_LDTR_LIMIT;
+		*acc = VMCS_GUEST_LDTR_ACCESS_RIGHTS;
+		break;
+	case VM_REG_GUEST_IDTR:
+		*base = VMCS_GUEST_IDTR_BASE;
+		*lim = VMCS_GUEST_IDTR_LIMIT;
+		*acc = VMCS_INVALID_ENCODING;
+		break;
+	case VM_REG_GUEST_GDTR:
+		*base = VMCS_GUEST_GDTR_BASE;
+		*lim = VMCS_GUEST_GDTR_LIMIT;
+		*acc = VMCS_INVALID_ENCODING;
+		break;
+	default:
+		return (EINVAL);
+	}
+
+	return (0);
+}
+
+int
+vmcs_getreg(struct vmcs *vmcs, int running, int ident, uint64_t *retval)
+{
+	int error;
+	uint32_t encoding;
+
+	/*
+	 * If we need to get at vmx-specific state in the VMCS we can bypass
+	 * the translation of 'ident' to 'encoding' by simply setting the
+	 * sign bit. As it so happens the upper 16 bits are reserved (i.e
+	 * set to 0) in the encodings for the VMCS so we are free to use the
+	 * sign bit.
+	 */
+	if (ident < 0)
+		encoding = ident & 0x7fffffff;
+	else
+		encoding = vmcs_field_encoding(ident);
+
+	if (encoding == (uint32_t)-1)
+		return (EINVAL);
+
+	if (!running)
+		VMPTRLD(vmcs);
+
+	error = vmread(encoding, retval);
+
+	if (!running)
+		VMCLEAR(vmcs);
+
+	return (error);
+}
+
+int
+vmcs_setreg(struct vmcs *vmcs, int running, int ident, uint64_t val)
+{
+	int error;
+	uint32_t encoding;
+
+	if (ident < 0)
+		encoding = ident & 0x7fffffff;
+	else
+		encoding = vmcs_field_encoding(ident);
+
+	if (encoding == (uint32_t)-1)
+		return (EINVAL);
+
+	val = vmcs_fix_regval(encoding, val);
+
+	if (!running)
+		VMPTRLD(vmcs);
+
+	error = vmwrite(encoding, val);
+
+	if (!running)
+		VMCLEAR(vmcs);
+
+	return (error);
+}
+
+int
+vmcs_setdesc(struct vmcs *vmcs, int running, int seg, struct seg_desc *desc)
+{
+	int error;
+	uint32_t base, limit, access;
+
+	error = vmcs_seg_desc_encoding(seg, &base, &limit, &access);
+	if (error != 0)
+		panic("vmcs_setdesc: invalid segment register %d", seg);
+
+	if (!running)
+		VMPTRLD(vmcs);
+	if ((error = vmwrite(base, desc->base)) != 0)
+		goto done;
+
+	if ((error = vmwrite(limit, desc->limit)) != 0)
+		goto done;
+
+	if (access != VMCS_INVALID_ENCODING) {
+		if ((error = vmwrite(access, desc->access)) != 0)
+			goto done;
+	}
+done:
+	if (!running)
+		VMCLEAR(vmcs);
+	return (error);
+}
+
+int
+vmcs_getdesc(struct vmcs *vmcs, int running, int seg, struct seg_desc *desc)
+{
+	int error;
+	uint32_t base, limit, access;
+	uint64_t u64;
+
+	error = vmcs_seg_desc_encoding(seg, &base, &limit, &access);
+	if (error != 0)
+		panic("vmcs_getdesc: invalid segment register %d", seg);
+
+	if (!running)
+		VMPTRLD(vmcs);
+	if ((error = vmread(base, &u64)) != 0)
+		goto done;
+	desc->base = u64;
+
+	if ((error = vmread(limit, &u64)) != 0)
+		goto done;
+	desc->limit = u64;
+
+	if (access != VMCS_INVALID_ENCODING) {
+		if ((error = vmread(access, &u64)) != 0)
+			goto done;
+		desc->access = u64;
+	}
+done:
+	if (!running)
+		VMCLEAR(vmcs);
+	return (error);
+}
+
+int
+vmcs_set_msr_save(struct vmcs *vmcs, u_long g_area, u_int g_count)
+{
+	int error;
+
+	VMPTRLD(vmcs);
+
+	/*
+	 * Guest MSRs are saved in the VM-exit MSR-store area.
+	 * Guest MSRs are loaded from the VM-entry MSR-load area.
+	 * Both areas point to the same location in memory.
+	 */
+	if ((error = vmwrite(VMCS_EXIT_MSR_STORE, g_area)) != 0)
+		goto done;
+	if ((error = vmwrite(VMCS_EXIT_MSR_STORE_COUNT, g_count)) != 0)
+		goto done;
+
+	if ((error = vmwrite(VMCS_ENTRY_MSR_LOAD, g_area)) != 0)
+		goto done;
+	if ((error = vmwrite(VMCS_ENTRY_MSR_LOAD_COUNT, g_count)) != 0)
+		goto done;
+
+	error = 0;
+done:
+	VMCLEAR(vmcs);
+	return (error);
+}
+
+int
+vmcs_init(struct vmcs *vmcs)
+{
+	int error, codesel, datasel, tsssel;
+	u_long cr0, cr4, efer;
+	uint64_t pat;
+#ifdef	__FreeBSD__
+	uint64_t fsbase, idtrbase;
+#endif
+
+	codesel = vmm_get_host_codesel();
+	datasel = vmm_get_host_datasel();
+	tsssel = vmm_get_host_tsssel();
+
+	/*
+	 * Make sure we have a "current" VMCS to work with.
+	 */
+	VMPTRLD(vmcs);
+
+	/* Host state */
+
+	/* Initialize host IA32_PAT MSR */
+	pat = vmm_get_host_pat();
+	if ((error = vmwrite(VMCS_HOST_IA32_PAT, pat)) != 0)
+		goto done;
+
+	/* Load the IA32_EFER MSR */
+	efer = vmm_get_host_efer();
+	if ((error = vmwrite(VMCS_HOST_IA32_EFER, efer)) != 0)
+		goto done;
+
+	/* Load the control registers */
+
+	cr0 = vmm_get_host_cr0();
+	if ((error = vmwrite(VMCS_HOST_CR0, cr0)) != 0)
+		goto done;
+	
+	cr4 = vmm_get_host_cr4() | CR4_VMXE;
+	if ((error = vmwrite(VMCS_HOST_CR4, cr4)) != 0)
+		goto done;
+
+	/* Load the segment selectors */
+	if ((error = vmwrite(VMCS_HOST_ES_SELECTOR, datasel)) != 0)
+		goto done;
+
+	if ((error = vmwrite(VMCS_HOST_CS_SELECTOR, codesel)) != 0)
+		goto done;
+
+	if ((error = vmwrite(VMCS_HOST_SS_SELECTOR, datasel)) != 0)
+		goto done;
+
+	if ((error = vmwrite(VMCS_HOST_DS_SELECTOR, datasel)) != 0)
+		goto done;
+
+#ifdef	__FreeBSD__
+	if ((error = vmwrite(VMCS_HOST_FS_SELECTOR, datasel)) != 0)
+		goto done;
+
+	if ((error = vmwrite(VMCS_HOST_GS_SELECTOR, datasel)) != 0)
+		goto done;
+#else
+	if ((error = vmwrite(VMCS_HOST_FS_SELECTOR, vmm_get_host_fssel())) != 0)
+		goto done;
+
+	if ((error = vmwrite(VMCS_HOST_GS_SELECTOR, vmm_get_host_gssel())) != 0)
+		goto done;
+#endif
+
+	if ((error = vmwrite(VMCS_HOST_TR_SELECTOR, tsssel)) != 0)
+		goto done;
+
+#ifdef	__FreeBSD__
+	/*
+	 * Load the Base-Address for %fs and idtr.
+	 *
+	 * Note that we exclude %gs, tss and gdtr here because their base
+	 * address is pcpu specific.
+	 */
+	fsbase = vmm_get_host_fsbase();
+	if ((error = vmwrite(VMCS_HOST_FS_BASE, fsbase)) != 0)
+		goto done;
+
+	idtrbase = vmm_get_host_idtrbase();
+	if ((error = vmwrite(VMCS_HOST_IDTR_BASE, idtrbase)) != 0)
+		goto done;
+
+#else /* __FreeBSD__ */
+	/*
+	 * Configure host sysenter MSRs to be restored on VM exit.
+	 * The thread-specific MSR_INTC_SEP_ESP value is loaded in vmx_run.
+	 */
+	if ((error = vmwrite(VMCS_HOST_IA32_SYSENTER_CS, KCS_SEL)) != 0)
+		goto done;
+	/* Natively defined as MSR_INTC_SEP_EIP */
+	if ((error = vmwrite(VMCS_HOST_IA32_SYSENTER_EIP,
+	    rdmsr(MSR_SYSENTER_EIP_MSR))) != 0)
+		goto done;
+
+#endif /* __FreeBSD__ */
+
+	/* instruction pointer */
+	if (no_flush_rsb) {
+		if ((error = vmwrite(VMCS_HOST_RIP,
+		    (u_long)vmx_exit_guest)) != 0)
+			goto done;
+	} else {
+		if ((error = vmwrite(VMCS_HOST_RIP,
+		    (u_long)vmx_exit_guest_flush_rsb)) != 0)
+			goto done;
+	}
+
+	/* link pointer */
+	if ((error = vmwrite(VMCS_LINK_POINTER, ~0)) != 0)
+		goto done;
+done:
+	VMCLEAR(vmcs);
+	return (error);
+}
+
+#ifdef DDB
+extern int vmxon_enabled[];
+
+DB_SHOW_COMMAND(vmcs, db_show_vmcs)
+{
+	uint64_t cur_vmcs, val;
+	uint32_t exit;
+
+	if (!vmxon_enabled[curcpu]) {
+		db_printf("VMX not enabled\n");
+		return;
+	}
+
+	if (have_addr) {
+		db_printf("Only current VMCS supported\n");
+		return;
+	}
+
+	vmptrst(&cur_vmcs);
+	if (cur_vmcs == VMCS_INITIAL) {
+		db_printf("No current VM context\n");
+		return;
+	}
+	db_printf("VMCS: %jx\n", cur_vmcs);
+	db_printf("VPID: %lu\n", vmcs_read(VMCS_VPID));
+	db_printf("Activity: ");
+	val = vmcs_read(VMCS_GUEST_ACTIVITY);
+	switch (val) {
+	case 0:
+		db_printf("Active");
+		break;
+	case 1:
+		db_printf("HLT");
+		break;
+	case 2:
+		db_printf("Shutdown");
+		break;
+	case 3:
+		db_printf("Wait for SIPI");
+		break;
+	default:
+		db_printf("Unknown: %#lx", val);
+	}
+	db_printf("\n");
+	exit = vmcs_read(VMCS_EXIT_REASON);
+	if (exit & 0x80000000)
+		db_printf("Entry Failure Reason: %u\n", exit & 0xffff);
+	else
+		db_printf("Exit Reason: %u\n", exit & 0xffff);
+	db_printf("Qualification: %#lx\n", vmcs_exit_qualification());
+	db_printf("Guest Linear Address: %#lx\n",
+	    vmcs_read(VMCS_GUEST_LINEAR_ADDRESS));
+	switch (exit & 0x8000ffff) {
+	case EXIT_REASON_EXCEPTION:
+	case EXIT_REASON_EXT_INTR:
+		val = vmcs_read(VMCS_EXIT_INTR_INFO);
+		db_printf("Interrupt Type: ");
+		switch (val >> 8 & 0x7) {
+		case 0:
+			db_printf("external");
+			break;
+		case 2:
+			db_printf("NMI");
+			break;
+		case 3:
+			db_printf("HW exception");
+			break;
+		case 4:
+			db_printf("SW exception");
+			break;
+		default:
+			db_printf("?? %lu", val >> 8 & 0x7);
+			break;
+		}
+		db_printf("  Vector: %lu", val & 0xff);
+		if (val & 0x800)
+			db_printf("  Error Code: %lx",
+			    vmcs_read(VMCS_EXIT_INTR_ERRCODE));
+		db_printf("\n");
+		break;
+	case EXIT_REASON_EPT_FAULT:
+	case EXIT_REASON_EPT_MISCONFIG:
+		db_printf("Guest Physical Address: %#lx\n",
+		    vmcs_read(VMCS_GUEST_PHYSICAL_ADDRESS));
+		break;
+	}
+	db_printf("VM-instruction error: %#lx\n", vmcs_instruction_error());
+}
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmcs.h b/usr/src/uts/i86pc/io/vmm/intel/vmcs.h
new file mode 100644
index 0000000000..28c5e6b15b
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmcs.h
@@ -0,0 +1,484 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _VMCS_H_
+#define	_VMCS_H_
+
+#ifdef _KERNEL
+#ifndef _ASM
+struct vmcs {
+	uint32_t	identifier;
+	uint32_t	abort_code;
+	char		_impl_specific[PAGE_SIZE - sizeof(uint32_t) * 2];
+#ifndef __FreeBSD__
+	/*
+	 * Keep the physical address of the VMCS cached adjacent for the
+	 * structure so it can be referenced in contexts which are too delicate
+	 * for a call into the HAT.  For the moment it means wasting a whole
+	 * page on padding for the PA value to maintain alignment, but it
+	 * allows the consumers of 'struct vmcs *' to easily access the value
+	 * without a significant change to the interface.
+	 */
+	uint64_t	vmcs_pa;
+	char		_pa_pad[PAGE_SIZE - sizeof (vm_paddr_t)];
+#endif
+};
+#ifdef __FreeBSD__
+CTASSERT(sizeof(struct vmcs) == PAGE_SIZE);
+#else
+CTASSERT(sizeof(struct vmcs) == (2*PAGE_SIZE));
+#endif
+
+/* MSR save region is composed of an array of 'struct msr_entry' */
+struct msr_entry {
+	uint32_t	index;
+	uint32_t	reserved;
+	uint64_t	val;
+
+};
+
+int vmcs_set_msr_save(struct vmcs *vmcs, u_long g_area, u_int g_count);
+int	vmcs_init(struct vmcs *vmcs);
+int	vmcs_getreg(struct vmcs *vmcs, int running, int ident, uint64_t *rv);
+int	vmcs_setreg(struct vmcs *vmcs, int running, int ident, uint64_t val);
+int	vmcs_getdesc(struct vmcs *vmcs, int running, int ident,
+		     struct seg_desc *desc);
+int	vmcs_setdesc(struct vmcs *vmcs, int running, int ident,
+		     struct seg_desc *desc);
+
+/*
+ * Avoid header pollution caused by inline use of 'vtophys()' in vmx_cpufunc.h
+ */
+#ifdef _VMX_CPUFUNC_H_
+static __inline uint64_t
+vmcs_read(uint32_t encoding)
+{
+	int error;
+	uint64_t val;
+
+	error = vmread(encoding, &val);
+	KASSERT(error == 0, ("vmcs_read(%u) error %d", encoding, error));
+	return (val);
+}
+
+static __inline void
+vmcs_write(uint32_t encoding, uint64_t val)
+{
+	int error;
+
+	error = vmwrite(encoding, val);
+	KASSERT(error == 0, ("vmcs_write(%u) error %d", encoding, error));
+}
+
+#ifndef __FreeBSD__
+/*
+ * Due to header complexity combined with the need to cache the physical
+ * address for the VMCS, these must be defined here rather than vmx_cpufunc.h.
+ */
+static __inline int
+vmclear(struct vmcs *vmcs)
+{
+	int error;
+	uint64_t addr = vmcs->vmcs_pa;
+
+	__asm __volatile("vmclear %[addr];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [addr] "m" (*(uint64_t *)&addr)
+			 : "memory");
+	return (error);
+}
+
+static __inline int
+vmptrld(struct vmcs *vmcs)
+{
+	int error;
+	uint64_t addr = vmcs->vmcs_pa;
+
+	__asm __volatile("vmptrld %[addr];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [addr] "m" (*(uint64_t *)&addr)
+			 : "memory");
+	return (error);
+}
+
+static __inline void
+VMCLEAR(struct vmcs *vmcs)
+{
+	int err;
+
+	err = vmclear(vmcs);
+	if (err != 0)
+		panic("%s: vmclear(%p) error %d", __func__, vmcs, err);
+
+	critical_exit();
+}
+
+static __inline void
+VMPTRLD(struct vmcs *vmcs)
+{
+	int err;
+
+	critical_enter();
+
+	err = vmptrld(vmcs);
+	if (err != 0)
+		panic("%s: vmptrld(%p) error %d", __func__, vmcs, err);
+}
+#endif /* __FreeBSD__ */
+
+#endif	/* _VMX_CPUFUNC_H_ */
+
+#define	vmexit_instruction_length()	vmcs_read(VMCS_EXIT_INSTRUCTION_LENGTH)
+#define	vmcs_guest_rip()		vmcs_read(VMCS_GUEST_RIP)
+#define	vmcs_instruction_error()	vmcs_read(VMCS_INSTRUCTION_ERROR)
+#define	vmcs_exit_reason()		(vmcs_read(VMCS_EXIT_REASON) & 0xffff)
+#define	vmcs_exit_qualification()	vmcs_read(VMCS_EXIT_QUALIFICATION)
+#define	vmcs_guest_cr3()		vmcs_read(VMCS_GUEST_CR3)
+#define	vmcs_gpa()			vmcs_read(VMCS_GUEST_PHYSICAL_ADDRESS)
+#define	vmcs_gla()			vmcs_read(VMCS_GUEST_LINEAR_ADDRESS)
+#define	vmcs_idt_vectoring_info()	vmcs_read(VMCS_IDT_VECTORING_INFO)
+#define	vmcs_idt_vectoring_err()	vmcs_read(VMCS_IDT_VECTORING_ERROR)
+
+#endif	/* _ASM */
+#endif	/* _KERNEL */
+
+#define	VMCS_INITIAL			0xffffffffffffffff
+
+#define	VMCS_IDENT(encoding)		((encoding) | 0x80000000)
+/*
+ * VMCS field encodings from Appendix H, Intel Architecture Manual Vol3B.
+ */
+#define	VMCS_INVALID_ENCODING		0xffffffff
+
+/* 16-bit control fields */
+#define	VMCS_VPID			0x00000000
+#define	VMCS_PIR_VECTOR			0x00000002
+
+/* 16-bit guest-state fields */
+#define	VMCS_GUEST_ES_SELECTOR		0x00000800
+#define	VMCS_GUEST_CS_SELECTOR		0x00000802
+#define	VMCS_GUEST_SS_SELECTOR		0x00000804
+#define	VMCS_GUEST_DS_SELECTOR		0x00000806
+#define	VMCS_GUEST_FS_SELECTOR		0x00000808
+#define	VMCS_GUEST_GS_SELECTOR		0x0000080A
+#define	VMCS_GUEST_LDTR_SELECTOR	0x0000080C
+#define	VMCS_GUEST_TR_SELECTOR		0x0000080E
+#define	VMCS_GUEST_INTR_STATUS		0x00000810
+
+/* 16-bit host-state fields */
+#define	VMCS_HOST_ES_SELECTOR		0x00000C00
+#define	VMCS_HOST_CS_SELECTOR		0x00000C02
+#define	VMCS_HOST_SS_SELECTOR		0x00000C04
+#define	VMCS_HOST_DS_SELECTOR		0x00000C06
+#define	VMCS_HOST_FS_SELECTOR		0x00000C08
+#define	VMCS_HOST_GS_SELECTOR		0x00000C0A
+#define	VMCS_HOST_TR_SELECTOR		0x00000C0C
+
+/* 64-bit control fields */
+#define	VMCS_IO_BITMAP_A		0x00002000
+#define	VMCS_IO_BITMAP_B		0x00002002
+#define	VMCS_MSR_BITMAP			0x00002004
+#define	VMCS_EXIT_MSR_STORE		0x00002006
+#define	VMCS_EXIT_MSR_LOAD		0x00002008
+#define	VMCS_ENTRY_MSR_LOAD		0x0000200A
+#define	VMCS_EXECUTIVE_VMCS		0x0000200C
+#define	VMCS_TSC_OFFSET			0x00002010
+#define	VMCS_VIRTUAL_APIC		0x00002012
+#define	VMCS_APIC_ACCESS		0x00002014
+#define	VMCS_PIR_DESC			0x00002016
+#define	VMCS_EPTP			0x0000201A
+#define	VMCS_EOI_EXIT0			0x0000201C
+#define	VMCS_EOI_EXIT1			0x0000201E
+#define	VMCS_EOI_EXIT2			0x00002020
+#define	VMCS_EOI_EXIT3			0x00002022
+#define	VMCS_EOI_EXIT(vector)		(VMCS_EOI_EXIT0 + ((vector) / 64) * 2)
+
+/* 64-bit read-only fields */
+#define	VMCS_GUEST_PHYSICAL_ADDRESS	0x00002400
+
+/* 64-bit guest-state fields */
+#define	VMCS_LINK_POINTER		0x00002800
+#define	VMCS_GUEST_IA32_DEBUGCTL	0x00002802
+#define	VMCS_GUEST_IA32_PAT		0x00002804
+#define	VMCS_GUEST_IA32_EFER		0x00002806
+#define	VMCS_GUEST_IA32_PERF_GLOBAL_CTRL 0x00002808
+#define	VMCS_GUEST_PDPTE0		0x0000280A
+#define	VMCS_GUEST_PDPTE1		0x0000280C
+#define	VMCS_GUEST_PDPTE2		0x0000280E
+#define	VMCS_GUEST_PDPTE3		0x00002810
+
+/* 64-bit host-state fields */
+#define	VMCS_HOST_IA32_PAT		0x00002C00
+#define	VMCS_HOST_IA32_EFER		0x00002C02
+#define	VMCS_HOST_IA32_PERF_GLOBAL_CTRL	0x00002C04
+
+/* 32-bit control fields */
+#define	VMCS_PIN_BASED_CTLS		0x00004000
+#define	VMCS_PRI_PROC_BASED_CTLS	0x00004002
+#define	VMCS_EXCEPTION_BITMAP		0x00004004
+#define	VMCS_PF_ERROR_MASK		0x00004006
+#define	VMCS_PF_ERROR_MATCH		0x00004008
+#define	VMCS_CR3_TARGET_COUNT		0x0000400A
+#define	VMCS_EXIT_CTLS			0x0000400C
+#define	VMCS_EXIT_MSR_STORE_COUNT	0x0000400E
+#define	VMCS_EXIT_MSR_LOAD_COUNT	0x00004010
+#define	VMCS_ENTRY_CTLS			0x00004012
+#define	VMCS_ENTRY_MSR_LOAD_COUNT	0x00004014
+#define	VMCS_ENTRY_INTR_INFO		0x00004016
+#define	VMCS_ENTRY_EXCEPTION_ERROR	0x00004018
+#define	VMCS_ENTRY_INST_LENGTH		0x0000401A
+#define	VMCS_TPR_THRESHOLD		0x0000401C
+#define	VMCS_SEC_PROC_BASED_CTLS	0x0000401E
+#define	VMCS_PLE_GAP			0x00004020
+#define	VMCS_PLE_WINDOW			0x00004022
+
+/* 32-bit read-only data fields */
+#define	VMCS_INSTRUCTION_ERROR		0x00004400
+#define	VMCS_EXIT_REASON		0x00004402
+#define	VMCS_EXIT_INTR_INFO		0x00004404
+#define	VMCS_EXIT_INTR_ERRCODE		0x00004406
+#define	VMCS_IDT_VECTORING_INFO		0x00004408
+#define	VMCS_IDT_VECTORING_ERROR	0x0000440A
+#define	VMCS_EXIT_INSTRUCTION_LENGTH	0x0000440C
+#define	VMCS_EXIT_INSTRUCTION_INFO	0x0000440E
+
+/* 32-bit guest-state fields */
+#define	VMCS_GUEST_ES_LIMIT		0x00004800
+#define	VMCS_GUEST_CS_LIMIT		0x00004802
+#define	VMCS_GUEST_SS_LIMIT		0x00004804
+#define	VMCS_GUEST_DS_LIMIT		0x00004806
+#define	VMCS_GUEST_FS_LIMIT		0x00004808
+#define	VMCS_GUEST_GS_LIMIT		0x0000480A
+#define	VMCS_GUEST_LDTR_LIMIT		0x0000480C
+#define	VMCS_GUEST_TR_LIMIT		0x0000480E
+#define	VMCS_GUEST_GDTR_LIMIT		0x00004810
+#define	VMCS_GUEST_IDTR_LIMIT		0x00004812
+#define	VMCS_GUEST_ES_ACCESS_RIGHTS	0x00004814
+#define	VMCS_GUEST_CS_ACCESS_RIGHTS	0x00004816
+#define	VMCS_GUEST_SS_ACCESS_RIGHTS	0x00004818
+#define	VMCS_GUEST_DS_ACCESS_RIGHTS	0x0000481A
+#define	VMCS_GUEST_FS_ACCESS_RIGHTS	0x0000481C
+#define	VMCS_GUEST_GS_ACCESS_RIGHTS	0x0000481E
+#define	VMCS_GUEST_LDTR_ACCESS_RIGHTS	0x00004820
+#define	VMCS_GUEST_TR_ACCESS_RIGHTS	0x00004822
+#define	VMCS_GUEST_INTERRUPTIBILITY	0x00004824
+#define	VMCS_GUEST_ACTIVITY		0x00004826
+#define VMCS_GUEST_SMBASE		0x00004828
+#define	VMCS_GUEST_IA32_SYSENTER_CS	0x0000482A
+#define	VMCS_PREEMPTION_TIMER_VALUE	0x0000482E
+
+/* 32-bit host state fields */
+#define	VMCS_HOST_IA32_SYSENTER_CS	0x00004C00
+
+/* Natural Width control fields */
+#define	VMCS_CR0_MASK			0x00006000
+#define	VMCS_CR4_MASK			0x00006002
+#define	VMCS_CR0_SHADOW			0x00006004
+#define	VMCS_CR4_SHADOW			0x00006006
+#define	VMCS_CR3_TARGET0		0x00006008
+#define	VMCS_CR3_TARGET1		0x0000600A
+#define	VMCS_CR3_TARGET2		0x0000600C
+#define	VMCS_CR3_TARGET3		0x0000600E
+
+/* Natural Width read-only fields */
+#define	VMCS_EXIT_QUALIFICATION		0x00006400
+#define	VMCS_IO_RCX			0x00006402
+#define	VMCS_IO_RSI			0x00006404
+#define	VMCS_IO_RDI			0x00006406
+#define	VMCS_IO_RIP			0x00006408
+#define	VMCS_GUEST_LINEAR_ADDRESS	0x0000640A
+
+/* Natural Width guest-state fields */
+#define	VMCS_GUEST_CR0			0x00006800
+#define	VMCS_GUEST_CR3			0x00006802
+#define	VMCS_GUEST_CR4			0x00006804
+#define	VMCS_GUEST_ES_BASE		0x00006806
+#define	VMCS_GUEST_CS_BASE		0x00006808
+#define	VMCS_GUEST_SS_BASE		0x0000680A
+#define	VMCS_GUEST_DS_BASE		0x0000680C
+#define	VMCS_GUEST_FS_BASE		0x0000680E
+#define	VMCS_GUEST_GS_BASE		0x00006810
+#define	VMCS_GUEST_LDTR_BASE		0x00006812
+#define	VMCS_GUEST_TR_BASE		0x00006814
+#define	VMCS_GUEST_GDTR_BASE		0x00006816
+#define	VMCS_GUEST_IDTR_BASE		0x00006818
+#define	VMCS_GUEST_DR7			0x0000681A
+#define	VMCS_GUEST_RSP			0x0000681C
+#define	VMCS_GUEST_RIP			0x0000681E
+#define	VMCS_GUEST_RFLAGS		0x00006820
+#define	VMCS_GUEST_PENDING_DBG_EXCEPTIONS 0x00006822
+#define	VMCS_GUEST_IA32_SYSENTER_ESP	0x00006824
+#define	VMCS_GUEST_IA32_SYSENTER_EIP	0x00006826
+
+/* Natural Width host-state fields */
+#define	VMCS_HOST_CR0			0x00006C00
+#define	VMCS_HOST_CR3			0x00006C02
+#define	VMCS_HOST_CR4			0x00006C04
+#define	VMCS_HOST_FS_BASE		0x00006C06
+#define	VMCS_HOST_GS_BASE		0x00006C08
+#define	VMCS_HOST_TR_BASE		0x00006C0A
+#define	VMCS_HOST_GDTR_BASE		0x00006C0C
+#define	VMCS_HOST_IDTR_BASE		0x00006C0E
+#define	VMCS_HOST_IA32_SYSENTER_ESP	0x00006C10
+#define	VMCS_HOST_IA32_SYSENTER_EIP	0x00006C12
+#define	VMCS_HOST_RSP			0x00006C14
+#define	VMCS_HOST_RIP			0x00006c16
+
+/*
+ * VM instruction error numbers
+ */
+#define	VMRESUME_WITH_NON_LAUNCHED_VMCS	5
+
+/*
+ * VMCS exit reasons
+ */
+#define EXIT_REASON_EXCEPTION		0
+#define EXIT_REASON_EXT_INTR		1
+#define EXIT_REASON_TRIPLE_FAULT	2
+#define EXIT_REASON_INIT		3
+#define EXIT_REASON_SIPI		4
+#define EXIT_REASON_IO_SMI		5
+#define EXIT_REASON_SMI			6
+#define EXIT_REASON_INTR_WINDOW		7
+#define EXIT_REASON_NMI_WINDOW		8
+#define EXIT_REASON_TASK_SWITCH		9
+#define EXIT_REASON_CPUID		10
+#define EXIT_REASON_GETSEC		11
+#define EXIT_REASON_HLT			12
+#define EXIT_REASON_INVD		13
+#define EXIT_REASON_INVLPG		14
+#define EXIT_REASON_RDPMC		15
+#define EXIT_REASON_RDTSC		16
+#define EXIT_REASON_RSM			17
+#define EXIT_REASON_VMCALL		18
+#define EXIT_REASON_VMCLEAR		19
+#define EXIT_REASON_VMLAUNCH		20
+#define EXIT_REASON_VMPTRLD		21
+#define EXIT_REASON_VMPTRST		22
+#define EXIT_REASON_VMREAD		23
+#define EXIT_REASON_VMRESUME		24
+#define EXIT_REASON_VMWRITE		25
+#define EXIT_REASON_VMXOFF		26
+#define EXIT_REASON_VMXON		27
+#define EXIT_REASON_CR_ACCESS		28
+#define EXIT_REASON_DR_ACCESS		29
+#define EXIT_REASON_INOUT		30
+#define EXIT_REASON_RDMSR		31
+#define EXIT_REASON_WRMSR		32
+#define EXIT_REASON_INVAL_VMCS		33
+#define EXIT_REASON_INVAL_MSR		34
+#define EXIT_REASON_MWAIT		36
+#define EXIT_REASON_MTF			37
+#define EXIT_REASON_MONITOR		39
+#define EXIT_REASON_PAUSE		40
+#define EXIT_REASON_MCE_DURING_ENTRY	41
+#define EXIT_REASON_TPR			43
+#define EXIT_REASON_APIC_ACCESS		44
+#define	EXIT_REASON_VIRTUALIZED_EOI	45
+#define EXIT_REASON_GDTR_IDTR		46
+#define EXIT_REASON_LDTR_TR		47
+#define EXIT_REASON_EPT_FAULT		48
+#define EXIT_REASON_EPT_MISCONFIG	49
+#define EXIT_REASON_INVEPT		50
+#define EXIT_REASON_RDTSCP		51
+#define EXIT_REASON_VMX_PREEMPT		52
+#define EXIT_REASON_INVVPID		53
+#define EXIT_REASON_WBINVD		54
+#define EXIT_REASON_XSETBV		55
+#define	EXIT_REASON_APIC_WRITE		56
+
+/*
+ * NMI unblocking due to IRET.
+ *
+ * Applies to VM-exits due to hardware exception or EPT fault.
+ */
+#define	EXIT_QUAL_NMIUDTI	(1 << 12)
+/*
+ * VMCS interrupt information fields
+ */
+#define	VMCS_INTR_VALID		(1U << 31)
+#define	VMCS_INTR_T_MASK	0x700		/* Interruption-info type */
+#define	VMCS_INTR_T_HWINTR	(0 << 8)
+#define	VMCS_INTR_T_NMI		(2 << 8)
+#define	VMCS_INTR_T_HWEXCEPTION	(3 << 8)
+#define	VMCS_INTR_T_SWINTR	(4 << 8)
+#define	VMCS_INTR_T_PRIV_SWEXCEPTION (5 << 8)
+#define	VMCS_INTR_T_SWEXCEPTION	(6 << 8)
+#define	VMCS_INTR_DEL_ERRCODE	(1 << 11)
+
+/*
+ * VMCS IDT-Vectoring information fields
+ */
+#define	VMCS_IDT_VEC_VALID		(1U << 31)
+#define	VMCS_IDT_VEC_ERRCODE_VALID	(1 << 11)
+
+/*
+ * VMCS Guest interruptibility field
+ */
+#define	VMCS_INTERRUPTIBILITY_STI_BLOCKING	(1 << 0)
+#define	VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING	(1 << 1)
+#define	VMCS_INTERRUPTIBILITY_SMI_BLOCKING	(1 << 2)
+#define	VMCS_INTERRUPTIBILITY_NMI_BLOCKING	(1 << 3)
+
+/*
+ * Exit qualification for EXIT_REASON_INVAL_VMCS
+ */
+#define	EXIT_QUAL_NMI_WHILE_STI_BLOCKING	3
+
+/*
+ * Exit qualification for EPT violation
+ */
+#define	EPT_VIOLATION_DATA_READ		(1UL << 0)
+#define	EPT_VIOLATION_DATA_WRITE	(1UL << 1)
+#define	EPT_VIOLATION_INST_FETCH	(1UL << 2)
+#define	EPT_VIOLATION_GPA_READABLE	(1UL << 3)
+#define	EPT_VIOLATION_GPA_WRITEABLE	(1UL << 4)
+#define	EPT_VIOLATION_GPA_EXECUTABLE	(1UL << 5)
+#define	EPT_VIOLATION_GLA_VALID		(1UL << 7)
+#define	EPT_VIOLATION_XLAT_VALID	(1UL << 8)
+
+/*
+ * Exit qualification for APIC-access VM exit
+ */
+#define	APIC_ACCESS_OFFSET(qual)	((qual) & 0xFFF)
+#define	APIC_ACCESS_TYPE(qual)		(((qual) >> 12) & 0xF)
+
+/*
+ * Exit qualification for APIC-write VM exit
+ */
+#define	APIC_WRITE_OFFSET(qual)		((qual) & 0xFFF)
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmx.c b/usr/src/uts/i86pc/io/vmm/intel/vmx.c
new file mode 100644
index 0000000000..e07ee0ea52
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmx.c
@@ -0,0 +1,4097 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/smp.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/pcpu.h>
+#include <sys/proc.h>
+#include <sys/sysctl.h>
+
+#ifndef __FreeBSD__
+#include <sys/x86_archext.h>
+#include <sys/smp_impldefs.h>
+#include <sys/ht.h>
+#endif
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+
+#include <machine/psl.h>
+#include <machine/cpufunc.h>
+#include <machine/md_var.h>
+#include <machine/segments.h>
+#include <machine/smp.h>
+#include <machine/specialreg.h>
+#include <machine/vmparam.h>
+
+#include <machine/vmm.h>
+#include <machine/vmm_dev.h>
+#include <machine/vmm_instruction_emul.h>
+#include "vmm_lapic.h"
+#include "vmm_host.h"
+#include "vmm_ioport.h"
+#include "vmm_ktr.h"
+#include "vmm_stat.h"
+#include "vatpic.h"
+#include "vlapic.h"
+#include "vlapic_priv.h"
+
+#include "ept.h"
+#include "vmx_cpufunc.h"
+#include "vmcs.h"
+#include "vmx.h"
+#include "vmx_msr.h"
+#include "x86.h"
+#include "vmx_controls.h"
+
+#define	PINBASED_CTLS_ONE_SETTING					\
+	(PINBASED_EXTINT_EXITING	|				\
+	 PINBASED_NMI_EXITING		|				\
+	 PINBASED_VIRTUAL_NMI)
+#define	PINBASED_CTLS_ZERO_SETTING	0
+
+#define PROCBASED_CTLS_WINDOW_SETTING					\
+	(PROCBASED_INT_WINDOW_EXITING	|				\
+	 PROCBASED_NMI_WINDOW_EXITING)
+
+#ifdef __FreeBSD__
+#define	PROCBASED_CTLS_ONE_SETTING 					\
+	(PROCBASED_SECONDARY_CONTROLS	|				\
+	 PROCBASED_MWAIT_EXITING	|				\
+	 PROCBASED_MONITOR_EXITING	|				\
+	 PROCBASED_IO_EXITING		|				\
+	 PROCBASED_MSR_BITMAPS		|				\
+	 PROCBASED_CTLS_WINDOW_SETTING	|				\
+	 PROCBASED_CR8_LOAD_EXITING	|				\
+	 PROCBASED_CR8_STORE_EXITING)
+#else
+/* We consider TSC offset a necessity for unsynched TSC handling */
+#define	PROCBASED_CTLS_ONE_SETTING 					\
+	(PROCBASED_SECONDARY_CONTROLS	|				\
+	 PROCBASED_TSC_OFFSET		|				\
+	 PROCBASED_MWAIT_EXITING	|				\
+	 PROCBASED_MONITOR_EXITING	|				\
+	 PROCBASED_IO_EXITING		|				\
+	 PROCBASED_MSR_BITMAPS		|				\
+	 PROCBASED_CTLS_WINDOW_SETTING	|				\
+	 PROCBASED_CR8_LOAD_EXITING	|				\
+	 PROCBASED_CR8_STORE_EXITING)
+#endif /* __FreeBSD__ */
+
+#define	PROCBASED_CTLS_ZERO_SETTING	\
+	(PROCBASED_CR3_LOAD_EXITING |	\
+	PROCBASED_CR3_STORE_EXITING |	\
+	PROCBASED_IO_BITMAPS)
+
+#define	PROCBASED_CTLS2_ONE_SETTING	PROCBASED2_ENABLE_EPT
+#define	PROCBASED_CTLS2_ZERO_SETTING	0
+
+#define	VM_EXIT_CTLS_ONE_SETTING					\
+	(VM_EXIT_SAVE_DEBUG_CONTROLS		|			\
+	VM_EXIT_HOST_LMA			|			\
+	VM_EXIT_LOAD_PAT			|			\
+	VM_EXIT_SAVE_EFER			|			\
+	VM_EXIT_LOAD_EFER			|			\
+	VM_EXIT_ACKNOWLEDGE_INTERRUPT)
+
+#define	VM_EXIT_CTLS_ZERO_SETTING	0
+
+#define	VM_ENTRY_CTLS_ONE_SETTING					\
+	(VM_ENTRY_LOAD_DEBUG_CONTROLS		|			\
+	VM_ENTRY_LOAD_EFER)
+
+#define	VM_ENTRY_CTLS_ZERO_SETTING					\
+	(VM_ENTRY_INTO_SMM			|			\
+	VM_ENTRY_DEACTIVATE_DUAL_MONITOR)
+
+#define	HANDLED		1
+#define	UNHANDLED	0
+
+static MALLOC_DEFINE(M_VMX, "vmx", "vmx");
+static MALLOC_DEFINE(M_VLAPIC, "vlapic", "vlapic");
+
+SYSCTL_DECL(_hw_vmm);
+SYSCTL_NODE(_hw_vmm, OID_AUTO, vmx, CTLFLAG_RW, NULL, NULL);
+
+int vmxon_enabled[MAXCPU];
+static char vmxon_region[MAXCPU][PAGE_SIZE] __aligned(PAGE_SIZE);
+static char *vmxon_region_pa[MAXCPU];
+
+static uint32_t pinbased_ctls, procbased_ctls, procbased_ctls2;
+static uint32_t exit_ctls, entry_ctls;
+
+static uint64_t cr0_ones_mask, cr0_zeros_mask;
+SYSCTL_ULONG(_hw_vmm_vmx, OID_AUTO, cr0_ones_mask, CTLFLAG_RD,
+	     &cr0_ones_mask, 0, NULL);
+SYSCTL_ULONG(_hw_vmm_vmx, OID_AUTO, cr0_zeros_mask, CTLFLAG_RD,
+	     &cr0_zeros_mask, 0, NULL);
+
+static uint64_t cr4_ones_mask, cr4_zeros_mask;
+SYSCTL_ULONG(_hw_vmm_vmx, OID_AUTO, cr4_ones_mask, CTLFLAG_RD,
+	     &cr4_ones_mask, 0, NULL);
+SYSCTL_ULONG(_hw_vmm_vmx, OID_AUTO, cr4_zeros_mask, CTLFLAG_RD,
+	     &cr4_zeros_mask, 0, NULL);
+
+static int vmx_initialized;
+SYSCTL_INT(_hw_vmm_vmx, OID_AUTO, initialized, CTLFLAG_RD,
+	   &vmx_initialized, 0, "Intel VMX initialized");
+
+/*
+ * Optional capabilities
+ */
+SYSCTL_NODE(_hw_vmm_vmx, OID_AUTO, cap, CTLFLAG_RW, NULL, NULL);
+
+static int cap_halt_exit;
+SYSCTL_INT(_hw_vmm_vmx_cap, OID_AUTO, halt_exit, CTLFLAG_RD, &cap_halt_exit, 0,
+    "HLT triggers a VM-exit");
+
+static int cap_pause_exit;
+SYSCTL_INT(_hw_vmm_vmx_cap, OID_AUTO, pause_exit, CTLFLAG_RD, &cap_pause_exit,
+    0, "PAUSE triggers a VM-exit");
+
+static int cap_unrestricted_guest;
+SYSCTL_INT(_hw_vmm_vmx_cap, OID_AUTO, unrestricted_guest, CTLFLAG_RD,
+    &cap_unrestricted_guest, 0, "Unrestricted guests");
+
+static int cap_monitor_trap;
+SYSCTL_INT(_hw_vmm_vmx_cap, OID_AUTO, monitor_trap, CTLFLAG_RD,
+    &cap_monitor_trap, 0, "Monitor trap flag");
+
+static int cap_invpcid;
+SYSCTL_INT(_hw_vmm_vmx_cap, OID_AUTO, invpcid, CTLFLAG_RD, &cap_invpcid,
+    0, "Guests are allowed to use INVPCID");
+
+static int virtual_interrupt_delivery;
+SYSCTL_INT(_hw_vmm_vmx_cap, OID_AUTO, virtual_interrupt_delivery, CTLFLAG_RD,
+    &virtual_interrupt_delivery, 0, "APICv virtual interrupt delivery support");
+
+static int posted_interrupts;
+SYSCTL_INT(_hw_vmm_vmx_cap, OID_AUTO, posted_interrupts, CTLFLAG_RD,
+    &posted_interrupts, 0, "APICv posted interrupt support");
+
+static int pirvec = -1;
+SYSCTL_INT(_hw_vmm_vmx, OID_AUTO, posted_interrupt_vector, CTLFLAG_RD,
+    &pirvec, 0, "APICv posted interrupt vector");
+
+static struct unrhdr *vpid_unr;
+static u_int vpid_alloc_failed;
+SYSCTL_UINT(_hw_vmm_vmx, OID_AUTO, vpid_alloc_failed, CTLFLAG_RD,
+	    &vpid_alloc_failed, 0, NULL);
+
+/*
+ * The definitions of SDT probes for VMX.
+ */
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, entry,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, taskswitch,
+    "struct vmx *", "int", "struct vm_exit *", "struct vm_task_switch *");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, craccess,
+    "struct vmx *", "int", "struct vm_exit *", "uint64_t");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, rdmsr,
+    "struct vmx *", "int", "struct vm_exit *", "uint32_t");
+
+SDT_PROBE_DEFINE5(vmm, vmx, exit, wrmsr,
+    "struct vmx *", "int", "struct vm_exit *", "uint32_t", "uint64_t");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, halt,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, mtrap,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, pause,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, intrwindow,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, interrupt,
+    "struct vmx *", "int", "struct vm_exit *", "uint32_t");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, nmiwindow,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, inout,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, cpuid,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE5(vmm, vmx, exit, exception,
+    "struct vmx *", "int", "struct vm_exit *", "uint32_t", "int");
+
+SDT_PROBE_DEFINE5(vmm, vmx, exit, nestedfault,
+    "struct vmx *", "int", "struct vm_exit *", "uint64_t", "uint64_t");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, mmiofault,
+    "struct vmx *", "int", "struct vm_exit *", "uint64_t");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, eoi,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, apicaccess,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, apicwrite,
+    "struct vmx *", "int", "struct vm_exit *", "struct vlapic *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, xsetbv,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, monitor,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE3(vmm, vmx, exit, mwait,
+    "struct vmx *", "int", "struct vm_exit *");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, unknown,
+    "struct vmx *", "int", "struct vm_exit *", "uint32_t");
+
+SDT_PROBE_DEFINE4(vmm, vmx, exit, return,
+    "struct vmx *", "int", "struct vm_exit *", "int");
+
+/*
+ * Use the last page below 4GB as the APIC access address. This address is
+ * occupied by the boot firmware so it is guaranteed that it will not conflict
+ * with a page in system memory.
+ */
+#define	APIC_ACCESS_ADDRESS	0xFFFFF000
+
+static int vmx_getdesc(void *arg, int vcpu, int reg, struct seg_desc *desc);
+static int vmx_getreg(void *arg, int vcpu, int reg, uint64_t *retval);
+static int vmxctx_setreg(struct vmxctx *vmxctx, int reg, uint64_t val);
+static void vmx_inject_pir(struct vlapic *vlapic);
+static void vmx_flush_pir_prio(struct vlapic *vlapic);
+#ifndef __FreeBSD__
+static int vmx_apply_tsc_adjust(struct vmx *, int);
+#endif /* __FreeBSD__ */
+
+#ifdef KTR
+static const char *
+exit_reason_to_str(int reason)
+{
+	static char reasonbuf[32];
+
+	switch (reason) {
+	case EXIT_REASON_EXCEPTION:
+		return "exception";
+	case EXIT_REASON_EXT_INTR:
+		return "extint";
+	case EXIT_REASON_TRIPLE_FAULT:
+		return "triplefault";
+	case EXIT_REASON_INIT:
+		return "init";
+	case EXIT_REASON_SIPI:
+		return "sipi";
+	case EXIT_REASON_IO_SMI:
+		return "iosmi";
+	case EXIT_REASON_SMI:
+		return "smi";
+	case EXIT_REASON_INTR_WINDOW:
+		return "intrwindow";
+	case EXIT_REASON_NMI_WINDOW:
+		return "nmiwindow";
+	case EXIT_REASON_TASK_SWITCH:
+		return "taskswitch";
+	case EXIT_REASON_CPUID:
+		return "cpuid";
+	case EXIT_REASON_GETSEC:
+		return "getsec";
+	case EXIT_REASON_HLT:
+		return "hlt";
+	case EXIT_REASON_INVD:
+		return "invd";
+	case EXIT_REASON_INVLPG:
+		return "invlpg";
+	case EXIT_REASON_RDPMC:
+		return "rdpmc";
+	case EXIT_REASON_RDTSC:
+		return "rdtsc";
+	case EXIT_REASON_RSM:
+		return "rsm";
+	case EXIT_REASON_VMCALL:
+		return "vmcall";
+	case EXIT_REASON_VMCLEAR:
+		return "vmclear";
+	case EXIT_REASON_VMLAUNCH:
+		return "vmlaunch";
+	case EXIT_REASON_VMPTRLD:
+		return "vmptrld";
+	case EXIT_REASON_VMPTRST:
+		return "vmptrst";
+	case EXIT_REASON_VMREAD:
+		return "vmread";
+	case EXIT_REASON_VMRESUME:
+		return "vmresume";
+	case EXIT_REASON_VMWRITE:
+		return "vmwrite";
+	case EXIT_REASON_VMXOFF:
+		return "vmxoff";
+	case EXIT_REASON_VMXON:
+		return "vmxon";
+	case EXIT_REASON_CR_ACCESS:
+		return "craccess";
+	case EXIT_REASON_DR_ACCESS:
+		return "draccess";
+	case EXIT_REASON_INOUT:
+		return "inout";
+	case EXIT_REASON_RDMSR:
+		return "rdmsr";
+	case EXIT_REASON_WRMSR:
+		return "wrmsr";
+	case EXIT_REASON_INVAL_VMCS:
+		return "invalvmcs";
+	case EXIT_REASON_INVAL_MSR:
+		return "invalmsr";
+	case EXIT_REASON_MWAIT:
+		return "mwait";
+	case EXIT_REASON_MTF:
+		return "mtf";
+	case EXIT_REASON_MONITOR:
+		return "monitor";
+	case EXIT_REASON_PAUSE:
+		return "pause";
+	case EXIT_REASON_MCE_DURING_ENTRY:
+		return "mce-during-entry";
+	case EXIT_REASON_TPR:
+		return "tpr";
+	case EXIT_REASON_APIC_ACCESS:
+		return "apic-access";
+	case EXIT_REASON_GDTR_IDTR:
+		return "gdtridtr";
+	case EXIT_REASON_LDTR_TR:
+		return "ldtrtr";
+	case EXIT_REASON_EPT_FAULT:
+		return "eptfault";
+	case EXIT_REASON_EPT_MISCONFIG:
+		return "eptmisconfig";
+	case EXIT_REASON_INVEPT:
+		return "invept";
+	case EXIT_REASON_RDTSCP:
+		return "rdtscp";
+	case EXIT_REASON_VMX_PREEMPT:
+		return "vmxpreempt";
+	case EXIT_REASON_INVVPID:
+		return "invvpid";
+	case EXIT_REASON_WBINVD:
+		return "wbinvd";
+	case EXIT_REASON_XSETBV:
+		return "xsetbv";
+	case EXIT_REASON_APIC_WRITE:
+		return "apic-write";
+	default:
+		snprintf(reasonbuf, sizeof(reasonbuf), "%d", reason);
+		return (reasonbuf);
+	}
+}
+#endif	/* KTR */
+
+static int
+vmx_allow_x2apic_msrs(struct vmx *vmx)
+{
+	int i, error;
+
+	error = 0;
+
+	/*
+	 * Allow readonly access to the following x2APIC MSRs from the guest.
+	 */
+	error += guest_msr_ro(vmx, MSR_APIC_ID);
+	error += guest_msr_ro(vmx, MSR_APIC_VERSION);
+	error += guest_msr_ro(vmx, MSR_APIC_LDR);
+	error += guest_msr_ro(vmx, MSR_APIC_SVR);
+
+	for (i = 0; i < 8; i++)
+		error += guest_msr_ro(vmx, MSR_APIC_ISR0 + i);
+
+	for (i = 0; i < 8; i++)
+		error += guest_msr_ro(vmx, MSR_APIC_TMR0 + i);
+	
+	for (i = 0; i < 8; i++)
+		error += guest_msr_ro(vmx, MSR_APIC_IRR0 + i);
+
+	error += guest_msr_ro(vmx, MSR_APIC_ESR);
+	error += guest_msr_ro(vmx, MSR_APIC_LVT_TIMER);
+	error += guest_msr_ro(vmx, MSR_APIC_LVT_THERMAL);
+	error += guest_msr_ro(vmx, MSR_APIC_LVT_PCINT);
+	error += guest_msr_ro(vmx, MSR_APIC_LVT_LINT0);
+	error += guest_msr_ro(vmx, MSR_APIC_LVT_LINT1);
+	error += guest_msr_ro(vmx, MSR_APIC_LVT_ERROR);
+	error += guest_msr_ro(vmx, MSR_APIC_ICR_TIMER);
+	error += guest_msr_ro(vmx, MSR_APIC_DCR_TIMER);
+	error += guest_msr_ro(vmx, MSR_APIC_ICR);
+
+	/*
+	 * Allow TPR, EOI and SELF_IPI MSRs to be read and written by the guest.
+	 *
+	 * These registers get special treatment described in the section
+	 * "Virtualizing MSR-Based APIC Accesses".
+	 */
+	error += guest_msr_rw(vmx, MSR_APIC_TPR);
+	error += guest_msr_rw(vmx, MSR_APIC_EOI);
+	error += guest_msr_rw(vmx, MSR_APIC_SELF_IPI);
+
+	return (error);
+}
+
+u_long
+vmx_fix_cr0(u_long cr0)
+{
+
+	return ((cr0 | cr0_ones_mask) & ~cr0_zeros_mask);
+}
+
+u_long
+vmx_fix_cr4(u_long cr4)
+{
+
+	return ((cr4 | cr4_ones_mask) & ~cr4_zeros_mask);
+}
+
+static void
+vpid_free(int vpid)
+{
+	if (vpid < 0 || vpid > 0xffff)
+		panic("vpid_free: invalid vpid %d", vpid);
+
+	/*
+	 * VPIDs [0,VM_MAXCPU] are special and are not allocated from
+	 * the unit number allocator.
+	 */
+
+	if (vpid > VM_MAXCPU)
+		free_unr(vpid_unr, vpid);
+}
+
+static void
+vpid_alloc(uint16_t *vpid, int num)
+{
+	int i, x;
+
+	if (num <= 0 || num > VM_MAXCPU)
+		panic("invalid number of vpids requested: %d", num);
+
+	/*
+	 * If the "enable vpid" execution control is not enabled then the
+	 * VPID is required to be 0 for all vcpus.
+	 */
+	if ((procbased_ctls2 & PROCBASED2_ENABLE_VPID) == 0) {
+		for (i = 0; i < num; i++)
+			vpid[i] = 0;
+		return;
+	}
+
+	/*
+	 * Allocate a unique VPID for each vcpu from the unit number allocator.
+	 */
+	for (i = 0; i < num; i++) {
+		x = alloc_unr(vpid_unr);
+		if (x == -1)
+			break;
+		else
+			vpid[i] = x;
+	}
+
+	if (i < num) {
+		atomic_add_int(&vpid_alloc_failed, 1);
+
+		/*
+		 * If the unit number allocator does not have enough unique
+		 * VPIDs then we need to allocate from the [1,VM_MAXCPU] range.
+		 *
+		 * These VPIDs are not be unique across VMs but this does not
+		 * affect correctness because the combined mappings are also
+		 * tagged with the EP4TA which is unique for each VM.
+		 *
+		 * It is still sub-optimal because the invvpid will invalidate
+		 * combined mappings for a particular VPID across all EP4TAs.
+		 */
+		while (i-- > 0)
+			vpid_free(vpid[i]);
+
+		for (i = 0; i < num; i++)
+			vpid[i] = i + 1;
+	}
+}
+
+static void
+vpid_init(void)
+{
+	/*
+	 * VPID 0 is required when the "enable VPID" execution control is
+	 * disabled.
+	 *
+	 * VPIDs [1,VM_MAXCPU] are used as the "overflow namespace" when the
+	 * unit number allocator does not have sufficient unique VPIDs to
+	 * satisfy the allocation.
+	 *
+	 * The remaining VPIDs are managed by the unit number allocator.
+	 */
+	vpid_unr = new_unrhdr(VM_MAXCPU + 1, 0xffff, NULL);
+}
+
+static void
+vmx_disable(void *arg __unused)
+{
+	struct invvpid_desc invvpid_desc = { 0 };
+	struct invept_desc invept_desc = { 0 };
+
+	if (vmxon_enabled[curcpu]) {
+		/*
+		 * See sections 25.3.3.3 and 25.3.3.4 in Intel Vol 3b.
+		 *
+		 * VMXON or VMXOFF are not required to invalidate any TLB
+		 * caching structures. This prevents potential retention of
+		 * cached information in the TLB between distinct VMX episodes.
+		 */
+		invvpid(INVVPID_TYPE_ALL_CONTEXTS, invvpid_desc);
+		invept(INVEPT_TYPE_ALL_CONTEXTS, invept_desc);
+		vmxoff();
+	}
+	load_cr4(rcr4() & ~CR4_VMXE);
+}
+
+static int
+vmx_cleanup(void)
+{
+#ifdef __FreeBSD__
+	if (pirvec >= 0)
+		lapic_ipi_free(pirvec);
+#endif
+
+	if (vpid_unr != NULL) {
+		delete_unrhdr(vpid_unr);
+		vpid_unr = NULL;
+	}
+
+	smp_rendezvous(NULL, vmx_disable, NULL, NULL);
+
+	return (0);
+}
+
+static void
+vmx_enable(void *arg __unused)
+{
+	int error;
+	uint64_t feature_control;
+
+	feature_control = rdmsr(MSR_IA32_FEATURE_CONTROL);
+	if ((feature_control & IA32_FEATURE_CONTROL_LOCK) == 0 ||
+	    (feature_control & IA32_FEATURE_CONTROL_VMX_EN) == 0) {
+		wrmsr(MSR_IA32_FEATURE_CONTROL,
+		    feature_control | IA32_FEATURE_CONTROL_VMX_EN |
+		    IA32_FEATURE_CONTROL_LOCK);
+	}
+
+	load_cr4(rcr4() | CR4_VMXE);
+
+	*(uint32_t *)vmxon_region[curcpu] = vmx_revision();
+#ifdef __FreeBSD__
+	error = vmxon(vmxon_region[curcpu]);
+#else
+	error = vmxon(vmxon_region_pa[curcpu]);
+#endif
+	if (error == 0)
+		vmxon_enabled[curcpu] = 1;
+}
+
+static void
+vmx_restore(void)
+{
+
+	if (vmxon_enabled[curcpu])
+		vmxon(vmxon_region[curcpu]);
+}
+
+static int
+vmx_init(int ipinum)
+{
+	int error, use_tpr_shadow;
+	uint64_t basic, fixed0, fixed1, feature_control;
+	uint32_t tmp, procbased2_vid_bits;
+
+#ifdef __FreeBSD__
+	/* CPUID.1:ECX[bit 5] must be 1 for processor to support VMX */
+	if (!(cpu_feature2 & CPUID2_VMX)) {
+		printf("vmx_init: processor does not support VMX operation\n");
+		return (ENXIO);
+	}
+#else
+	if (!is_x86_feature(x86_featureset, X86FSET_VMX)) {
+		cmn_err(CE_WARN,
+		    "vmx_init: processor does not support VMX operation\n");
+		return (ENXIO);
+	}
+#endif
+
+	/*
+	 * Verify that MSR_IA32_FEATURE_CONTROL lock and VMXON enable bits
+	 * are set (bits 0 and 2 respectively).
+	 */
+	feature_control = rdmsr(MSR_IA32_FEATURE_CONTROL);
+	if ((feature_control & IA32_FEATURE_CONTROL_LOCK) == 1 &&
+	    (feature_control & IA32_FEATURE_CONTROL_VMX_EN) == 0) {
+		printf("vmx_init: VMX operation disabled by BIOS\n");
+		return (ENXIO);
+	}
+
+	/*
+	 * Verify capabilities MSR_VMX_BASIC:
+	 * - bit 54 indicates support for INS/OUTS decoding
+	 */
+	basic = rdmsr(MSR_VMX_BASIC);
+	if ((basic & (1UL << 54)) == 0) {
+		printf("vmx_init: processor does not support desired basic "
+		    "capabilities\n");
+		return (EINVAL);
+	}
+
+	/* Check support for primary processor-based VM-execution controls */
+	error = vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS,
+			       MSR_VMX_TRUE_PROCBASED_CTLS,
+			       PROCBASED_CTLS_ONE_SETTING,
+			       PROCBASED_CTLS_ZERO_SETTING, &procbased_ctls);
+	if (error) {
+		printf("vmx_init: processor does not support desired primary "
+		       "processor-based controls\n");
+		return (error);
+	}
+
+	/* Clear the processor-based ctl bits that are set on demand */
+	procbased_ctls &= ~PROCBASED_CTLS_WINDOW_SETTING;
+
+	/* Check support for secondary processor-based VM-execution controls */
+	error = vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS2,
+			       MSR_VMX_PROCBASED_CTLS2,
+			       PROCBASED_CTLS2_ONE_SETTING,
+			       PROCBASED_CTLS2_ZERO_SETTING, &procbased_ctls2);
+	if (error) {
+		printf("vmx_init: processor does not support desired secondary "
+		       "processor-based controls\n");
+		return (error);
+	}
+
+	/* Check support for VPID */
+	error = vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS2, MSR_VMX_PROCBASED_CTLS2,
+			       PROCBASED2_ENABLE_VPID, 0, &tmp);
+	if (error == 0)
+		procbased_ctls2 |= PROCBASED2_ENABLE_VPID;
+
+	/* Check support for pin-based VM-execution controls */
+	error = vmx_set_ctlreg(MSR_VMX_PINBASED_CTLS,
+			       MSR_VMX_TRUE_PINBASED_CTLS,
+			       PINBASED_CTLS_ONE_SETTING,
+			       PINBASED_CTLS_ZERO_SETTING, &pinbased_ctls);
+	if (error) {
+		printf("vmx_init: processor does not support desired "
+		       "pin-based controls\n");
+		return (error);
+	}
+
+	/* Check support for VM-exit controls */
+	error = vmx_set_ctlreg(MSR_VMX_EXIT_CTLS, MSR_VMX_TRUE_EXIT_CTLS,
+			       VM_EXIT_CTLS_ONE_SETTING,
+			       VM_EXIT_CTLS_ZERO_SETTING,
+			       &exit_ctls);
+	if (error) {
+		printf("vmx_init: processor does not support desired "
+		    "exit controls\n");
+		return (error);
+	}
+
+	/* Check support for VM-entry controls */
+	error = vmx_set_ctlreg(MSR_VMX_ENTRY_CTLS, MSR_VMX_TRUE_ENTRY_CTLS,
+	    VM_ENTRY_CTLS_ONE_SETTING, VM_ENTRY_CTLS_ZERO_SETTING,
+	    &entry_ctls);
+	if (error) {
+		printf("vmx_init: processor does not support desired "
+		    "entry controls\n");
+		return (error);
+	}
+
+	/*
+	 * Check support for optional features by testing them
+	 * as individual bits
+	 */
+	cap_halt_exit = (vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS,
+					MSR_VMX_TRUE_PROCBASED_CTLS,
+					PROCBASED_HLT_EXITING, 0,
+					&tmp) == 0);
+
+	cap_monitor_trap = (vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS,
+					MSR_VMX_PROCBASED_CTLS,
+					PROCBASED_MTF, 0,
+					&tmp) == 0);
+
+	cap_pause_exit = (vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS,
+					 MSR_VMX_TRUE_PROCBASED_CTLS,
+					 PROCBASED_PAUSE_EXITING, 0,
+					 &tmp) == 0);
+
+	cap_unrestricted_guest = (vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS2,
+					MSR_VMX_PROCBASED_CTLS2,
+					PROCBASED2_UNRESTRICTED_GUEST, 0,
+				        &tmp) == 0);
+
+	cap_invpcid = (vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS2,
+	    MSR_VMX_PROCBASED_CTLS2, PROCBASED2_ENABLE_INVPCID, 0,
+	    &tmp) == 0);
+
+	/*
+	 * Check support for virtual interrupt delivery.
+	 */
+	procbased2_vid_bits = (PROCBASED2_VIRTUALIZE_APIC_ACCESSES |
+	    PROCBASED2_VIRTUALIZE_X2APIC_MODE |
+	    PROCBASED2_APIC_REGISTER_VIRTUALIZATION |
+	    PROCBASED2_VIRTUAL_INTERRUPT_DELIVERY);
+
+	use_tpr_shadow = (vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS,
+	    MSR_VMX_TRUE_PROCBASED_CTLS, PROCBASED_USE_TPR_SHADOW, 0,
+	    &tmp) == 0);
+
+	error = vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS2, MSR_VMX_PROCBASED_CTLS2,
+	    procbased2_vid_bits, 0, &tmp);
+	if (error == 0 && use_tpr_shadow) {
+		virtual_interrupt_delivery = 1;
+		TUNABLE_INT_FETCH("hw.vmm.vmx.use_apic_vid",
+		    &virtual_interrupt_delivery);
+	}
+
+	if (virtual_interrupt_delivery) {
+		procbased_ctls |= PROCBASED_USE_TPR_SHADOW;
+		procbased_ctls2 |= procbased2_vid_bits;
+		procbased_ctls2 &= ~PROCBASED2_VIRTUALIZE_X2APIC_MODE;
+
+		/*
+		 * No need to emulate accesses to %CR8 if virtual
+		 * interrupt delivery is enabled.
+		 */
+		procbased_ctls &= ~PROCBASED_CR8_LOAD_EXITING;
+		procbased_ctls &= ~PROCBASED_CR8_STORE_EXITING;
+
+		/*
+		 * Check for Posted Interrupts only if Virtual Interrupt
+		 * Delivery is enabled.
+		 */
+		error = vmx_set_ctlreg(MSR_VMX_PINBASED_CTLS,
+		    MSR_VMX_TRUE_PINBASED_CTLS, PINBASED_POSTED_INTERRUPT, 0,
+		    &tmp);
+		if (error == 0) {
+#ifdef __FreeBSD__
+			pirvec = lapic_ipi_alloc(pti ? &IDTVEC(justreturn1_pti) :
+			    &IDTVEC(justreturn));
+			if (pirvec < 0) {
+				if (bootverbose) {
+					printf("vmx_init: unable to allocate "
+					    "posted interrupt vector\n");
+				}
+			} else {
+				posted_interrupts = 1;
+				TUNABLE_INT_FETCH("hw.vmm.vmx.use_apic_pir",
+				    &posted_interrupts);
+			}
+#else
+			/*
+			 * If the PSM-provided interfaces for requesting and
+			 * using a PIR IPI vector are present, use them for
+			 * posted interrupts.
+			 */
+			if (psm_get_pir_ipivect != NULL &&
+			    psm_send_pir_ipi != NULL) {
+				pirvec = psm_get_pir_ipivect();
+				posted_interrupts = 1;
+			}
+#endif
+		}
+	}
+
+	if (posted_interrupts)
+		    pinbased_ctls |= PINBASED_POSTED_INTERRUPT;
+
+	/* Initialize EPT */
+	error = ept_init(ipinum);
+	if (error) {
+		printf("vmx_init: ept initialization failed (%d)\n", error);
+		return (error);
+	}
+
+	/*
+	 * Stash the cr0 and cr4 bits that must be fixed to 0 or 1
+	 */
+	fixed0 = rdmsr(MSR_VMX_CR0_FIXED0);
+	fixed1 = rdmsr(MSR_VMX_CR0_FIXED1);
+	cr0_ones_mask = fixed0 & fixed1;
+	cr0_zeros_mask = ~fixed0 & ~fixed1;
+
+	/*
+	 * CR0_PE and CR0_PG can be set to zero in VMX non-root operation
+	 * if unrestricted guest execution is allowed.
+	 */
+	if (cap_unrestricted_guest)
+		cr0_ones_mask &= ~(CR0_PG | CR0_PE);
+
+	/*
+	 * Do not allow the guest to set CR0_NW or CR0_CD.
+	 */
+	cr0_zeros_mask |= (CR0_NW | CR0_CD);
+
+	fixed0 = rdmsr(MSR_VMX_CR4_FIXED0);
+	fixed1 = rdmsr(MSR_VMX_CR4_FIXED1);
+	cr4_ones_mask = fixed0 & fixed1;
+	cr4_zeros_mask = ~fixed0 & ~fixed1;
+
+	vpid_init();
+
+	vmx_msr_init();
+
+#ifndef __FreeBSD__
+	/*
+	 * Since vtophys requires locks to complete, cache the physical
+	 * addresses to the vmxon pages now, rather than attempting the
+	 * translation in the sensitive cross-call context.
+	 */
+	for (uint_t i = 0; i < MAXCPU; i++) {
+		vmxon_region_pa[i] = (char *)vtophys(vmxon_region[i]);
+	}
+#endif /* __FreeBSD__ */
+
+	/* enable VMX operation */
+	smp_rendezvous(NULL, vmx_enable, NULL, NULL);
+
+	vmx_initialized = 1;
+
+	return (0);
+}
+
+static void
+vmx_trigger_hostintr(int vector)
+{
+#ifdef __FreeBSD__
+	uintptr_t func;
+	struct gate_descriptor *gd;
+
+	gd = &idt[vector];
+
+	KASSERT(vector >= 32 && vector <= 255, ("vmx_trigger_hostintr: "
+	    "invalid vector %d", vector));
+	KASSERT(gd->gd_p == 1, ("gate descriptor for vector %d not present",
+	    vector));
+	KASSERT(gd->gd_type == SDT_SYSIGT, ("gate descriptor for vector %d "
+	    "has invalid type %d", vector, gd->gd_type));
+	KASSERT(gd->gd_dpl == SEL_KPL, ("gate descriptor for vector %d "
+	    "has invalid dpl %d", vector, gd->gd_dpl));
+	KASSERT(gd->gd_selector == GSEL(GCODE_SEL, SEL_KPL), ("gate descriptor "
+	    "for vector %d has invalid selector %d", vector, gd->gd_selector));
+	KASSERT(gd->gd_ist == 0, ("gate descriptor for vector %d has invalid "
+	    "IST %d", vector, gd->gd_ist));
+
+	func = ((long)gd->gd_hioffset << 16 | gd->gd_looffset);
+	vmx_call_isr(func);
+#else
+	VERIFY(vector >= 32 && vector <= 255);
+	vmx_call_isr(vector - 32);
+#endif /* __FreeBSD__ */
+}
+
+static int
+vmx_setup_cr_shadow(int which, struct vmcs *vmcs, uint32_t initial)
+{
+	int error, mask_ident, shadow_ident;
+	uint64_t mask_value;
+
+	if (which != 0 && which != 4)
+		panic("vmx_setup_cr_shadow: unknown cr%d", which);
+
+	if (which == 0) {
+		mask_ident = VMCS_CR0_MASK;
+		mask_value = cr0_ones_mask | cr0_zeros_mask;
+		shadow_ident = VMCS_CR0_SHADOW;
+	} else {
+		mask_ident = VMCS_CR4_MASK;
+		mask_value = cr4_ones_mask | cr4_zeros_mask;
+		shadow_ident = VMCS_CR4_SHADOW;
+	}
+
+	error = vmcs_setreg(vmcs, 0, VMCS_IDENT(mask_ident), mask_value);
+	if (error)
+		return (error);
+
+	error = vmcs_setreg(vmcs, 0, VMCS_IDENT(shadow_ident), initial);
+	if (error)
+		return (error);
+
+	return (0);
+}
+#define	vmx_setup_cr0_shadow(vmcs,init)	vmx_setup_cr_shadow(0, (vmcs), (init))
+#define	vmx_setup_cr4_shadow(vmcs,init)	vmx_setup_cr_shadow(4, (vmcs), (init))
+
+static void *
+vmx_vminit(struct vm *vm, pmap_t pmap)
+{
+	uint16_t vpid[VM_MAXCPU];
+	int i, error;
+	struct vmx *vmx;
+	struct vmcs *vmcs;
+	uint32_t exc_bitmap;
+
+	vmx = malloc(sizeof(struct vmx), M_VMX, M_WAITOK | M_ZERO);
+	if ((uintptr_t)vmx & PAGE_MASK) {
+		panic("malloc of struct vmx not aligned on %d byte boundary",
+		      PAGE_SIZE);
+	}
+	vmx->vm = vm;
+
+	vmx->eptp = eptp(vtophys((vm_offset_t)pmap->pm_pml4));
+
+	/*
+	 * Clean up EPTP-tagged guest physical and combined mappings
+	 *
+	 * VMX transitions are not required to invalidate any guest physical
+	 * mappings. So, it may be possible for stale guest physical mappings
+	 * to be present in the processor TLBs.
+	 *
+	 * Combined mappings for this EP4TA are also invalidated for all VPIDs.
+	 */
+	ept_invalidate_mappings(vmx->eptp);
+
+	msr_bitmap_initialize(vmx->msr_bitmap);
+
+	/*
+	 * It is safe to allow direct access to MSR_GSBASE and MSR_FSBASE.
+	 * The guest FSBASE and GSBASE are saved and restored during
+	 * vm-exit and vm-entry respectively. The host FSBASE and GSBASE are
+	 * always restored from the vmcs host state area on vm-exit.
+	 *
+	 * The SYSENTER_CS/ESP/EIP MSRs are identical to FS/GSBASE in
+	 * how they are saved/restored so can be directly accessed by the
+	 * guest.
+	 *
+	 * MSR_EFER is saved and restored in the guest VMCS area on a
+	 * VM exit and entry respectively. It is also restored from the
+	 * host VMCS area on a VM exit.
+	 *
+	 * The TSC MSR is exposed read-only. Writes are disallowed as
+	 * that will impact the host TSC.  If the guest does a write
+	 * the "use TSC offsetting" execution control is enabled and the
+	 * difference between the host TSC and the guest TSC is written
+	 * into the TSC offset in the VMCS.
+	 */
+	if (guest_msr_rw(vmx, MSR_GSBASE) ||
+	    guest_msr_rw(vmx, MSR_FSBASE) ||
+	    guest_msr_rw(vmx, MSR_SYSENTER_CS_MSR) ||
+	    guest_msr_rw(vmx, MSR_SYSENTER_ESP_MSR) ||
+	    guest_msr_rw(vmx, MSR_SYSENTER_EIP_MSR) ||
+	    guest_msr_rw(vmx, MSR_EFER) ||
+	    guest_msr_ro(vmx, MSR_TSC))
+		panic("vmx_vminit: error setting guest msr access");
+
+	vpid_alloc(vpid, VM_MAXCPU);
+
+	if (virtual_interrupt_delivery) {
+		error = vm_map_mmio(vm, DEFAULT_APIC_BASE, PAGE_SIZE,
+		    APIC_ACCESS_ADDRESS);
+		/* XXX this should really return an error to the caller */
+		KASSERT(error == 0, ("vm_map_mmio(apicbase) error %d", error));
+	}
+
+	for (i = 0; i < VM_MAXCPU; i++) {
+#ifndef __FreeBSD__
+		/*
+		 * Cache physical address lookups for various components which
+		 * may be required inside the critical_enter() section implied
+		 * by VMPTRLD() below.
+		 */
+		vm_paddr_t msr_bitmap_pa = vtophys(vmx->msr_bitmap);
+		vm_paddr_t apic_page_pa = vtophys(&vmx->apic_page[i]);
+		vm_paddr_t pir_desc_pa = vtophys(&vmx->pir_desc[i]);
+#endif /* __FreeBSD__ */
+
+		vmcs = &vmx->vmcs[i];
+		vmcs->identifier = vmx_revision();
+#ifndef __FreeBSD__
+		vmcs->vmcs_pa = (uint64_t)vtophys(vmcs);
+#endif
+		error = vmclear(vmcs);
+		if (error != 0) {
+			panic("vmx_vminit: vmclear error %d on vcpu %d\n",
+			      error, i);
+		}
+
+		vmx_msr_guest_init(vmx, i);
+
+		error = vmcs_init(vmcs);
+		KASSERT(error == 0, ("vmcs_init error %d", error));
+
+		VMPTRLD(vmcs);
+		error = 0;
+#ifdef __FreeBSD__
+		/*
+		 * The illumos vmx_enter_guest implementation avoids some of
+		 * the %rsp-manipulation games which are present in the stock
+		 * one from FreeBSD.
+		 */
+		error += vmwrite(VMCS_HOST_RSP, (u_long)&vmx->ctx[i]);
+#endif
+		error += vmwrite(VMCS_EPTP, vmx->eptp);
+		error += vmwrite(VMCS_PIN_BASED_CTLS, pinbased_ctls);
+		error += vmwrite(VMCS_PRI_PROC_BASED_CTLS, procbased_ctls);
+		error += vmwrite(VMCS_SEC_PROC_BASED_CTLS, procbased_ctls2);
+		error += vmwrite(VMCS_EXIT_CTLS, exit_ctls);
+		error += vmwrite(VMCS_ENTRY_CTLS, entry_ctls);
+#ifdef __FreeBSD__
+		error += vmwrite(VMCS_MSR_BITMAP, vtophys(vmx->msr_bitmap));
+#else
+		error += vmwrite(VMCS_MSR_BITMAP, msr_bitmap_pa);
+#endif
+		error += vmwrite(VMCS_VPID, vpid[i]);
+
+		/* exception bitmap */
+		if (vcpu_trace_exceptions(vm, i))
+			exc_bitmap = 0xffffffff;
+		else
+			exc_bitmap = 1 << IDT_MC;
+		error += vmwrite(VMCS_EXCEPTION_BITMAP, exc_bitmap);
+
+		vmx->ctx[i].guest_dr6 = 0xffff0ff0;
+		error += vmwrite(VMCS_GUEST_DR7, 0x400);
+
+		if (virtual_interrupt_delivery) {
+			error += vmwrite(VMCS_APIC_ACCESS, APIC_ACCESS_ADDRESS);
+#ifdef __FreeBSD__
+			error += vmwrite(VMCS_VIRTUAL_APIC,
+			    vtophys(&vmx->apic_page[i]));
+#else
+			error += vmwrite(VMCS_VIRTUAL_APIC, apic_page_pa);
+#endif
+			error += vmwrite(VMCS_EOI_EXIT0, 0);
+			error += vmwrite(VMCS_EOI_EXIT1, 0);
+			error += vmwrite(VMCS_EOI_EXIT2, 0);
+			error += vmwrite(VMCS_EOI_EXIT3, 0);
+		}
+		if (posted_interrupts) {
+			error += vmwrite(VMCS_PIR_VECTOR, pirvec);
+#ifdef __FreeBSD__
+			error += vmwrite(VMCS_PIR_DESC,
+			    vtophys(&vmx->pir_desc[i]));
+#else
+			error += vmwrite(VMCS_PIR_DESC, pir_desc_pa);
+#endif
+		}
+		VMCLEAR(vmcs);
+		KASSERT(error == 0, ("vmx_vminit: error customizing the vmcs"));
+
+		vmx->cap[i].set = 0;
+		vmx->cap[i].proc_ctls = procbased_ctls;
+		vmx->cap[i].proc_ctls2 = procbased_ctls2;
+
+		vmx->state[i].nextrip = ~0;
+		vmx->state[i].lastcpu = NOCPU;
+		vmx->state[i].vpid = vpid[i];
+
+		/*
+		 * Set up the CR0/4 shadows, and init the read shadow
+		 * to the power-on register value from the Intel Sys Arch.
+		 *  CR0 - 0x60000010
+		 *  CR4 - 0
+		 */
+		error = vmx_setup_cr0_shadow(vmcs, 0x60000010);
+		if (error != 0)
+			panic("vmx_setup_cr0_shadow %d", error);
+
+		error = vmx_setup_cr4_shadow(vmcs, 0);
+		if (error != 0)
+			panic("vmx_setup_cr4_shadow %d", error);
+
+		vmx->ctx[i].pmap = pmap;
+	}
+
+	return (vmx);
+}
+
+static int
+vmx_handle_cpuid(struct vm *vm, int vcpu, struct vmxctx *vmxctx)
+{
+	int handled, func;
+	
+	func = vmxctx->guest_rax;
+
+	handled = x86_emulate_cpuid(vm, vcpu,
+				    (uint32_t*)(&vmxctx->guest_rax),
+				    (uint32_t*)(&vmxctx->guest_rbx),
+				    (uint32_t*)(&vmxctx->guest_rcx),
+				    (uint32_t*)(&vmxctx->guest_rdx));
+	return (handled);
+}
+
+static __inline void
+vmx_run_trace(struct vmx *vmx, int vcpu)
+{
+#ifdef KTR
+	VCPU_CTR1(vmx->vm, vcpu, "Resume execution at %#lx", vmcs_guest_rip());
+#endif
+}
+
+static __inline void
+vmx_exit_trace(struct vmx *vmx, int vcpu, uint64_t rip, uint32_t exit_reason,
+	       int handled)
+{
+#ifdef KTR
+	VCPU_CTR3(vmx->vm, vcpu, "%s %s vmexit at 0x%0lx",
+		 handled ? "handled" : "unhandled",
+		 exit_reason_to_str(exit_reason), rip);
+#endif
+	DTRACE_PROBE3(vmm__vexit, int, vcpu, uint64_t, rip,
+	    uint32_t, exit_reason);
+}
+
+static __inline void
+vmx_astpending_trace(struct vmx *vmx, int vcpu, uint64_t rip)
+{
+#ifdef KTR
+	VCPU_CTR1(vmx->vm, vcpu, "astpending vmexit at 0x%0lx", rip);
+#endif
+}
+
+static VMM_STAT_INTEL(VCPU_INVVPID_SAVED, "Number of vpid invalidations saved");
+static VMM_STAT_INTEL(VCPU_INVVPID_DONE, "Number of vpid invalidations done");
+
+/*
+ * Invalidate guest mappings identified by its vpid from the TLB.
+ */
+static __inline void
+vmx_invvpid(struct vmx *vmx, int vcpu, pmap_t pmap, int running)
+{
+	struct vmxstate *vmxstate;
+	struct invvpid_desc invvpid_desc;
+
+	vmxstate = &vmx->state[vcpu];
+	if (vmxstate->vpid == 0)
+		return;
+
+	if (!running) {
+		/*
+		 * Set the 'lastcpu' to an invalid host cpu.
+		 *
+		 * This will invalidate TLB entries tagged with the vcpu's
+		 * vpid the next time it runs via vmx_set_pcpu_defaults().
+		 */
+		vmxstate->lastcpu = NOCPU;
+		return;
+	}
+
+#ifdef __FreeBSD__
+	KASSERT(curthread->td_critnest > 0, ("%s: vcpu %d running outside "
+	    "critical section", __func__, vcpu));
+#endif
+
+	/*
+	 * Invalidate all mappings tagged with 'vpid'
+	 *
+	 * We do this because this vcpu was executing on a different host
+	 * cpu when it last ran. We do not track whether it invalidated
+	 * mappings associated with its 'vpid' during that run. So we must
+	 * assume that the mappings associated with 'vpid' on 'curcpu' are
+	 * stale and invalidate them.
+	 *
+	 * Note that we incur this penalty only when the scheduler chooses to
+	 * move the thread associated with this vcpu between host cpus.
+	 *
+	 * Note also that this will invalidate mappings tagged with 'vpid'
+	 * for "all" EP4TAs.
+	 */
+	if (pmap->pm_eptgen == vmx->eptgen[curcpu]) {
+		invvpid_desc._res1 = 0;
+		invvpid_desc._res2 = 0;
+		invvpid_desc.vpid = vmxstate->vpid;
+		invvpid_desc.linear_addr = 0;
+		invvpid(INVVPID_TYPE_SINGLE_CONTEXT, invvpid_desc);
+		vmm_stat_incr(vmx->vm, vcpu, VCPU_INVVPID_DONE, 1);
+	} else {
+		/*
+		 * The invvpid can be skipped if an invept is going to
+		 * be performed before entering the guest. The invept
+		 * will invalidate combined mappings tagged with
+		 * 'vmx->eptp' for all vpids.
+		 */
+		vmm_stat_incr(vmx->vm, vcpu, VCPU_INVVPID_SAVED, 1);
+	}
+}
+
+static void
+vmx_set_pcpu_defaults(struct vmx *vmx, int vcpu, pmap_t pmap)
+{
+	struct vmxstate *vmxstate;
+
+#ifndef __FreeBSD__
+	/*
+	 * Regardless of whether the VM appears to have migrated between CPUs,
+	 * save the host sysenter stack pointer.  As it points to the kernel
+	 * stack of each thread, the correct value must be maintained for every
+	 * trip into the critical section.
+	 */
+	vmcs_write(VMCS_HOST_IA32_SYSENTER_ESP, rdmsr(MSR_SYSENTER_ESP_MSR));
+
+	/*
+	 * Perform any needed TSC_OFFSET adjustment based on TSC_MSR writes or
+	 * migration between host CPUs with differing TSC values.
+	 */
+	VERIFY0(vmx_apply_tsc_adjust(vmx, vcpu));
+#endif
+
+	vmxstate = &vmx->state[vcpu];
+	if (vmxstate->lastcpu == curcpu)
+		return;
+
+	vmxstate->lastcpu = curcpu;
+
+	vmm_stat_incr(vmx->vm, vcpu, VCPU_MIGRATIONS, 1);
+
+#ifndef __FreeBSD__
+	/* Load the per-CPU IDT address */
+	vmcs_write(VMCS_HOST_IDTR_BASE, vmm_get_host_idtrbase());
+#endif
+	vmcs_write(VMCS_HOST_TR_BASE, vmm_get_host_trbase());
+	vmcs_write(VMCS_HOST_GDTR_BASE, vmm_get_host_gdtrbase());
+	vmcs_write(VMCS_HOST_GS_BASE, vmm_get_host_gsbase());
+	vmx_invvpid(vmx, vcpu, pmap, 1);
+}
+
+/*
+ * We depend on 'procbased_ctls' to have the Interrupt Window Exiting bit set.
+ */
+CTASSERT((PROCBASED_CTLS_ONE_SETTING & PROCBASED_INT_WINDOW_EXITING) != 0);
+
+static __inline void
+vmx_set_int_window_exiting(struct vmx *vmx, int vcpu)
+{
+
+	if ((vmx->cap[vcpu].proc_ctls & PROCBASED_INT_WINDOW_EXITING) == 0) {
+		vmx->cap[vcpu].proc_ctls |= PROCBASED_INT_WINDOW_EXITING;
+		vmcs_write(VMCS_PRI_PROC_BASED_CTLS, vmx->cap[vcpu].proc_ctls);
+		VCPU_CTR0(vmx->vm, vcpu, "Enabling interrupt window exiting");
+	}
+}
+
+static __inline void
+vmx_clear_int_window_exiting(struct vmx *vmx, int vcpu)
+{
+
+	KASSERT((vmx->cap[vcpu].proc_ctls & PROCBASED_INT_WINDOW_EXITING) != 0,
+	    ("intr_window_exiting not set: %#x", vmx->cap[vcpu].proc_ctls));
+	vmx->cap[vcpu].proc_ctls &= ~PROCBASED_INT_WINDOW_EXITING;
+	vmcs_write(VMCS_PRI_PROC_BASED_CTLS, vmx->cap[vcpu].proc_ctls);
+	VCPU_CTR0(vmx->vm, vcpu, "Disabling interrupt window exiting");
+}
+
+static __inline void
+vmx_set_nmi_window_exiting(struct vmx *vmx, int vcpu)
+{
+
+	if ((vmx->cap[vcpu].proc_ctls & PROCBASED_NMI_WINDOW_EXITING) == 0) {
+		vmx->cap[vcpu].proc_ctls |= PROCBASED_NMI_WINDOW_EXITING;
+		vmcs_write(VMCS_PRI_PROC_BASED_CTLS, vmx->cap[vcpu].proc_ctls);
+		VCPU_CTR0(vmx->vm, vcpu, "Enabling NMI window exiting");
+	}
+}
+
+static __inline void
+vmx_clear_nmi_window_exiting(struct vmx *vmx, int vcpu)
+{
+
+	KASSERT((vmx->cap[vcpu].proc_ctls & PROCBASED_NMI_WINDOW_EXITING) != 0,
+	    ("nmi_window_exiting not set %#x", vmx->cap[vcpu].proc_ctls));
+	vmx->cap[vcpu].proc_ctls &= ~PROCBASED_NMI_WINDOW_EXITING;
+	vmcs_write(VMCS_PRI_PROC_BASED_CTLS, vmx->cap[vcpu].proc_ctls);
+	VCPU_CTR0(vmx->vm, vcpu, "Disabling NMI window exiting");
+}
+
+#ifdef __FreeBSD__
+int
+vmx_set_tsc_offset(struct vmx *vmx, int vcpu, uint64_t offset)
+{
+	int error;
+
+	if ((vmx->cap[vcpu].proc_ctls & PROCBASED_TSC_OFFSET) == 0) {
+		vmx->cap[vcpu].proc_ctls |= PROCBASED_TSC_OFFSET;
+		vmcs_write(VMCS_PRI_PROC_BASED_CTLS, vmx->cap[vcpu].proc_ctls);
+		VCPU_CTR0(vmx->vm, vcpu, "Enabling TSC offsetting");
+	}
+
+	error = vmwrite(VMCS_TSC_OFFSET, offset);
+
+	return (error);
+}
+#else /* __FreeBSD__ */
+/*
+ * Set the TSC adjustment, taking into account the offsets measured between
+ * host physical CPUs.  This is required even if the guest has not set a TSC
+ * offset since vCPUs inherit the TSC offset of whatever physical CPU it has
+ * migrated onto.  Without this mitigation, un-synched host TSCs will convey
+ * the appearance of TSC time-travel to the guest as its vCPUs migrate.
+ */
+static int
+vmx_apply_tsc_adjust(struct vmx *vmx, int vcpu)
+{
+	extern hrtime_t tsc_gethrtime_tick_delta(void);
+	const uint64_t target_offset = (vcpu_tsc_offset(vmx->vm, vcpu) +
+	    (uint64_t)tsc_gethrtime_tick_delta());
+	int error = 0;
+
+	ASSERT(vmx->cap[vcpu].proc_ctls & PROCBASED_TSC_OFFSET);
+
+	if (vmx->tsc_offset_active[vcpu] != target_offset) {
+		error = vmwrite(VMCS_TSC_OFFSET, target_offset);
+		vmx->tsc_offset_active[vcpu] = target_offset;
+	}
+
+	return (error);
+}
+#endif /* __FreeBSD__ */
+
+#define	NMI_BLOCKING	(VMCS_INTERRUPTIBILITY_NMI_BLOCKING |		\
+			 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)
+#define	HWINTR_BLOCKING	(VMCS_INTERRUPTIBILITY_STI_BLOCKING |		\
+			 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)
+
+static void
+vmx_inject_nmi(struct vmx *vmx, int vcpu)
+{
+	uint32_t gi, info;
+
+	gi = vmcs_read(VMCS_GUEST_INTERRUPTIBILITY);
+	KASSERT((gi & NMI_BLOCKING) == 0, ("vmx_inject_nmi: invalid guest "
+	    "interruptibility-state %#x", gi));
+
+	info = vmcs_read(VMCS_ENTRY_INTR_INFO);
+	KASSERT((info & VMCS_INTR_VALID) == 0, ("vmx_inject_nmi: invalid "
+	    "VM-entry interruption information %#x", info));
+
+	/*
+	 * Inject the virtual NMI. The vector must be the NMI IDT entry
+	 * or the VMCS entry check will fail.
+	 */
+	info = IDT_NMI | VMCS_INTR_T_NMI | VMCS_INTR_VALID;
+	vmcs_write(VMCS_ENTRY_INTR_INFO, info);
+
+	VCPU_CTR0(vmx->vm, vcpu, "Injecting vNMI");
+
+	/* Clear the request */
+	vm_nmi_clear(vmx->vm, vcpu);
+}
+
+static void
+vmx_inject_interrupts(struct vmx *vmx, int vcpu, struct vlapic *vlapic,
+    uint64_t guestrip)
+{
+	int vector, need_nmi_exiting, extint_pending;
+	uint64_t rflags, entryinfo;
+	uint32_t gi, info;
+
+	if (vmx->state[vcpu].nextrip != guestrip) {
+		gi = vmcs_read(VMCS_GUEST_INTERRUPTIBILITY);
+		if (gi & HWINTR_BLOCKING) {
+			VCPU_CTR2(vmx->vm, vcpu, "Guest interrupt blocking "
+			    "cleared due to rip change: %#lx/%#lx",
+			    vmx->state[vcpu].nextrip, guestrip);
+			gi &= ~HWINTR_BLOCKING;
+			vmcs_write(VMCS_GUEST_INTERRUPTIBILITY, gi);
+		}
+	}
+
+	if (vm_entry_intinfo(vmx->vm, vcpu, &entryinfo)) {
+		KASSERT((entryinfo & VMCS_INTR_VALID) != 0, ("%s: entry "
+		    "intinfo is not valid: %#lx", __func__, entryinfo));
+
+		info = vmcs_read(VMCS_ENTRY_INTR_INFO);
+		KASSERT((info & VMCS_INTR_VALID) == 0, ("%s: cannot inject "
+		     "pending exception: %#lx/%#x", __func__, entryinfo, info));
+
+		info = entryinfo;
+		vector = info & 0xff;
+		if (vector == IDT_BP || vector == IDT_OF) {
+			/*
+			 * VT-x requires #BP and #OF to be injected as software
+			 * exceptions.
+			 */
+			info &= ~VMCS_INTR_T_MASK;
+			info |= VMCS_INTR_T_SWEXCEPTION;
+		}
+
+		if (info & VMCS_INTR_DEL_ERRCODE)
+			vmcs_write(VMCS_ENTRY_EXCEPTION_ERROR, entryinfo >> 32);
+
+		vmcs_write(VMCS_ENTRY_INTR_INFO, info);
+	}
+
+	if (vm_nmi_pending(vmx->vm, vcpu)) {
+		/*
+		 * If there are no conditions blocking NMI injection then
+		 * inject it directly here otherwise enable "NMI window
+		 * exiting" to inject it as soon as we can.
+		 *
+		 * We also check for STI_BLOCKING because some implementations
+		 * don't allow NMI injection in this case. If we are running
+		 * on a processor that doesn't have this restriction it will
+		 * immediately exit and the NMI will be injected in the
+		 * "NMI window exiting" handler.
+		 */
+		need_nmi_exiting = 1;
+		gi = vmcs_read(VMCS_GUEST_INTERRUPTIBILITY);
+		if ((gi & (HWINTR_BLOCKING | NMI_BLOCKING)) == 0) {
+			info = vmcs_read(VMCS_ENTRY_INTR_INFO);
+			if ((info & VMCS_INTR_VALID) == 0) {
+				vmx_inject_nmi(vmx, vcpu);
+				need_nmi_exiting = 0;
+			} else {
+				VCPU_CTR1(vmx->vm, vcpu, "Cannot inject NMI "
+				    "due to VM-entry intr info %#x", info);
+			}
+		} else {
+			VCPU_CTR1(vmx->vm, vcpu, "Cannot inject NMI due to "
+			    "Guest Interruptibility-state %#x", gi);
+		}
+
+		if (need_nmi_exiting)
+			vmx_set_nmi_window_exiting(vmx, vcpu);
+	}
+
+	extint_pending = vm_extint_pending(vmx->vm, vcpu);
+
+	if (!extint_pending && virtual_interrupt_delivery) {
+		vmx_inject_pir(vlapic);
+		return;
+	}
+
+	/*
+	 * If interrupt-window exiting is already in effect then don't bother
+	 * checking for pending interrupts. This is just an optimization and
+	 * not needed for correctness.
+	 */
+	if ((vmx->cap[vcpu].proc_ctls & PROCBASED_INT_WINDOW_EXITING) != 0) {
+		VCPU_CTR0(vmx->vm, vcpu, "Skip interrupt injection due to "
+		    "pending int_window_exiting");
+		return;
+	}
+
+	if (!extint_pending) {
+		/* Ask the local apic for a vector to inject */
+		if (!vlapic_pending_intr(vlapic, &vector))
+			return;
+
+		/*
+		 * From the Intel SDM, Volume 3, Section "Maskable
+		 * Hardware Interrupts":
+		 * - maskable interrupt vectors [16,255] can be delivered
+		 *   through the local APIC.
+		*/
+		KASSERT(vector >= 16 && vector <= 255,
+		    ("invalid vector %d from local APIC", vector));
+	} else {
+		/* Ask the legacy pic for a vector to inject */
+		vatpic_pending_intr(vmx->vm, &vector);
+
+		/*
+		 * From the Intel SDM, Volume 3, Section "Maskable
+		 * Hardware Interrupts":
+		 * - maskable interrupt vectors [0,255] can be delivered
+		 *   through the INTR pin.
+		 */
+		KASSERT(vector >= 0 && vector <= 255,
+		    ("invalid vector %d from INTR", vector));
+	}
+
+	/* Check RFLAGS.IF and the interruptibility state of the guest */
+	rflags = vmcs_read(VMCS_GUEST_RFLAGS);
+	if ((rflags & PSL_I) == 0) {
+		VCPU_CTR2(vmx->vm, vcpu, "Cannot inject vector %d due to "
+		    "rflags %#lx", vector, rflags);
+		goto cantinject;
+	}
+
+	gi = vmcs_read(VMCS_GUEST_INTERRUPTIBILITY);
+	if (gi & HWINTR_BLOCKING) {
+		VCPU_CTR2(vmx->vm, vcpu, "Cannot inject vector %d due to "
+		    "Guest Interruptibility-state %#x", vector, gi);
+		goto cantinject;
+	}
+
+	info = vmcs_read(VMCS_ENTRY_INTR_INFO);
+	if (info & VMCS_INTR_VALID) {
+		/*
+		 * This is expected and could happen for multiple reasons:
+		 * - A vectoring VM-entry was aborted due to astpending
+		 * - A VM-exit happened during event injection.
+		 * - An exception was injected above.
+		 * - An NMI was injected above or after "NMI window exiting"
+		 */
+		VCPU_CTR2(vmx->vm, vcpu, "Cannot inject vector %d due to "
+		    "VM-entry intr info %#x", vector, info);
+		goto cantinject;
+	}
+
+	/* Inject the interrupt */
+	info = VMCS_INTR_T_HWINTR | VMCS_INTR_VALID;
+	info |= vector;
+	vmcs_write(VMCS_ENTRY_INTR_INFO, info);
+
+	if (!extint_pending) {
+		/* Update the Local APIC ISR */
+		vlapic_intr_accepted(vlapic, vector);
+	} else {
+		vm_extint_clear(vmx->vm, vcpu);
+		vatpic_intr_accepted(vmx->vm, vector);
+
+		/*
+		 * After we accepted the current ExtINT the PIC may
+		 * have posted another one.  If that is the case, set
+		 * the Interrupt Window Exiting execution control so
+		 * we can inject that one too.
+		 *
+		 * Also, interrupt window exiting allows us to inject any
+		 * pending APIC vector that was preempted by the ExtINT
+		 * as soon as possible. This applies both for the software
+		 * emulated vlapic and the hardware assisted virtual APIC.
+		 */
+		vmx_set_int_window_exiting(vmx, vcpu);
+	}
+
+	VCPU_CTR1(vmx->vm, vcpu, "Injecting hwintr at vector %d", vector);
+
+	return;
+
+cantinject:
+	/*
+	 * Set the Interrupt Window Exiting execution control so we can inject
+	 * the interrupt as soon as blocking condition goes away.
+	 */
+	vmx_set_int_window_exiting(vmx, vcpu);
+}
+
+/*
+ * If the Virtual NMIs execution control is '1' then the logical processor
+ * tracks virtual-NMI blocking in the Guest Interruptibility-state field of
+ * the VMCS. An IRET instruction in VMX non-root operation will remove any
+ * virtual-NMI blocking.
+ *
+ * This unblocking occurs even if the IRET causes a fault. In this case the
+ * hypervisor needs to restore virtual-NMI blocking before resuming the guest.
+ */
+static void
+vmx_restore_nmi_blocking(struct vmx *vmx, int vcpuid)
+{
+	uint32_t gi;
+
+	VCPU_CTR0(vmx->vm, vcpuid, "Restore Virtual-NMI blocking");
+	gi = vmcs_read(VMCS_GUEST_INTERRUPTIBILITY);
+	gi |= VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
+	vmcs_write(VMCS_GUEST_INTERRUPTIBILITY, gi);
+}
+
+static void
+vmx_clear_nmi_blocking(struct vmx *vmx, int vcpuid)
+{
+	uint32_t gi;
+
+	VCPU_CTR0(vmx->vm, vcpuid, "Clear Virtual-NMI blocking");
+	gi = vmcs_read(VMCS_GUEST_INTERRUPTIBILITY);
+	gi &= ~VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
+	vmcs_write(VMCS_GUEST_INTERRUPTIBILITY, gi);
+}
+
+static void
+vmx_assert_nmi_blocking(struct vmx *vmx, int vcpuid)
+{
+	uint32_t gi;
+
+	gi = vmcs_read(VMCS_GUEST_INTERRUPTIBILITY);
+	KASSERT(gi & VMCS_INTERRUPTIBILITY_NMI_BLOCKING,
+	    ("NMI blocking is not in effect %#x", gi));
+}
+
+static int
+vmx_emulate_xsetbv(struct vmx *vmx, int vcpu, struct vm_exit *vmexit)
+{
+	struct vmxctx *vmxctx;
+	uint64_t xcrval;
+	const struct xsave_limits *limits;
+
+	vmxctx = &vmx->ctx[vcpu];
+	limits = vmm_get_xsave_limits();
+
+	/*
+	 * Note that the processor raises a GP# fault on its own if
+	 * xsetbv is executed for CPL != 0, so we do not have to
+	 * emulate that fault here.
+	 */
+
+	/* Only xcr0 is supported. */
+	if (vmxctx->guest_rcx != 0) {
+		vm_inject_gp(vmx->vm, vcpu);
+		return (HANDLED);
+	}
+
+	/* We only handle xcr0 if both the host and guest have XSAVE enabled. */
+	if (!limits->xsave_enabled || !(vmcs_read(VMCS_GUEST_CR4) & CR4_XSAVE)) {
+		vm_inject_ud(vmx->vm, vcpu);
+		return (HANDLED);
+	}
+
+	xcrval = vmxctx->guest_rdx << 32 | (vmxctx->guest_rax & 0xffffffff);
+	if ((xcrval & ~limits->xcr0_allowed) != 0) {
+		vm_inject_gp(vmx->vm, vcpu);
+		return (HANDLED);
+	}
+
+	if (!(xcrval & XFEATURE_ENABLED_X87)) {
+		vm_inject_gp(vmx->vm, vcpu);
+		return (HANDLED);
+	}
+
+	/* AVX (YMM_Hi128) requires SSE. */
+	if (xcrval & XFEATURE_ENABLED_AVX &&
+	    (xcrval & XFEATURE_AVX) != XFEATURE_AVX) {
+		vm_inject_gp(vmx->vm, vcpu);
+		return (HANDLED);
+	}
+
+	/*
+	 * AVX512 requires base AVX (YMM_Hi128) as well as OpMask,
+	 * ZMM_Hi256, and Hi16_ZMM.
+	 */
+	if (xcrval & XFEATURE_AVX512 &&
+	    (xcrval & (XFEATURE_AVX512 | XFEATURE_AVX)) !=
+	    (XFEATURE_AVX512 | XFEATURE_AVX)) {
+		vm_inject_gp(vmx->vm, vcpu);
+		return (HANDLED);
+	}
+
+	/*
+	 * Intel MPX requires both bound register state flags to be
+	 * set.
+	 */
+	if (((xcrval & XFEATURE_ENABLED_BNDREGS) != 0) !=
+	    ((xcrval & XFEATURE_ENABLED_BNDCSR) != 0)) {
+		vm_inject_gp(vmx->vm, vcpu);
+		return (HANDLED);
+	}
+
+	/*
+	 * This runs "inside" vmrun() with the guest's FPU state, so
+	 * modifying xcr0 directly modifies the guest's xcr0, not the
+	 * host's.
+	 */
+	load_xcr(0, xcrval);
+	return (HANDLED);
+}
+
+static uint64_t
+vmx_get_guest_reg(struct vmx *vmx, int vcpu, int ident)
+{
+	const struct vmxctx *vmxctx;
+
+	vmxctx = &vmx->ctx[vcpu];
+
+	switch (ident) {
+	case 0:
+		return (vmxctx->guest_rax);
+	case 1:
+		return (vmxctx->guest_rcx);
+	case 2:
+		return (vmxctx->guest_rdx);
+	case 3:
+		return (vmxctx->guest_rbx);
+	case 4:
+		return (vmcs_read(VMCS_GUEST_RSP));
+	case 5:
+		return (vmxctx->guest_rbp);
+	case 6:
+		return (vmxctx->guest_rsi);
+	case 7:
+		return (vmxctx->guest_rdi);
+	case 8:
+		return (vmxctx->guest_r8);
+	case 9:
+		return (vmxctx->guest_r9);
+	case 10:
+		return (vmxctx->guest_r10);
+	case 11:
+		return (vmxctx->guest_r11);
+	case 12:
+		return (vmxctx->guest_r12);
+	case 13:
+		return (vmxctx->guest_r13);
+	case 14:
+		return (vmxctx->guest_r14);
+	case 15:
+		return (vmxctx->guest_r15);
+	default:
+		panic("invalid vmx register %d", ident);
+	}
+}
+
+static void
+vmx_set_guest_reg(struct vmx *vmx, int vcpu, int ident, uint64_t regval)
+{
+	struct vmxctx *vmxctx;
+
+	vmxctx = &vmx->ctx[vcpu];
+
+	switch (ident) {
+	case 0:
+		vmxctx->guest_rax = regval;
+		break;
+	case 1:
+		vmxctx->guest_rcx = regval;
+		break;
+	case 2:
+		vmxctx->guest_rdx = regval;
+		break;
+	case 3:
+		vmxctx->guest_rbx = regval;
+		break;
+	case 4:
+		vmcs_write(VMCS_GUEST_RSP, regval);
+		break;
+	case 5:
+		vmxctx->guest_rbp = regval;
+		break;
+	case 6:
+		vmxctx->guest_rsi = regval;
+		break;
+	case 7:
+		vmxctx->guest_rdi = regval;
+		break;
+	case 8:
+		vmxctx->guest_r8 = regval;
+		break;
+	case 9:
+		vmxctx->guest_r9 = regval;
+		break;
+	case 10:
+		vmxctx->guest_r10 = regval;
+		break;
+	case 11:
+		vmxctx->guest_r11 = regval;
+		break;
+	case 12:
+		vmxctx->guest_r12 = regval;
+		break;
+	case 13:
+		vmxctx->guest_r13 = regval;
+		break;
+	case 14:
+		vmxctx->guest_r14 = regval;
+		break;
+	case 15:
+		vmxctx->guest_r15 = regval;
+		break;
+	default:
+		panic("invalid vmx register %d", ident);
+	}
+}
+
+static int
+vmx_emulate_cr0_access(struct vmx *vmx, int vcpu, uint64_t exitqual)
+{
+	uint64_t crval, regval;
+
+	/* We only handle mov to %cr0 at this time */
+	if ((exitqual & 0xf0) != 0x00)
+		return (UNHANDLED);
+
+	regval = vmx_get_guest_reg(vmx, vcpu, (exitqual >> 8) & 0xf);
+
+	vmcs_write(VMCS_CR0_SHADOW, regval);
+
+	crval = regval | cr0_ones_mask;
+	crval &= ~cr0_zeros_mask;
+	vmcs_write(VMCS_GUEST_CR0, crval);
+
+	if (regval & CR0_PG) {
+		uint64_t efer, entry_ctls;
+
+		/*
+		 * If CR0.PG is 1 and EFER.LME is 1 then EFER.LMA and
+		 * the "IA-32e mode guest" bit in VM-entry control must be
+		 * equal.
+		 */
+		efer = vmcs_read(VMCS_GUEST_IA32_EFER);
+		if (efer & EFER_LME) {
+			efer |= EFER_LMA;
+			vmcs_write(VMCS_GUEST_IA32_EFER, efer);
+			entry_ctls = vmcs_read(VMCS_ENTRY_CTLS);
+			entry_ctls |= VM_ENTRY_GUEST_LMA;
+			vmcs_write(VMCS_ENTRY_CTLS, entry_ctls);
+		}
+	}
+
+	return (HANDLED);
+}
+
+static int
+vmx_emulate_cr4_access(struct vmx *vmx, int vcpu, uint64_t exitqual)
+{
+	uint64_t crval, regval;
+
+	/* We only handle mov to %cr4 at this time */
+	if ((exitqual & 0xf0) != 0x00)
+		return (UNHANDLED);
+
+	regval = vmx_get_guest_reg(vmx, vcpu, (exitqual >> 8) & 0xf);
+
+	vmcs_write(VMCS_CR4_SHADOW, regval);
+
+	crval = regval | cr4_ones_mask;
+	crval &= ~cr4_zeros_mask;
+	vmcs_write(VMCS_GUEST_CR4, crval);
+
+	return (HANDLED);
+}
+
+static int
+vmx_emulate_cr8_access(struct vmx *vmx, int vcpu, uint64_t exitqual)
+{
+	struct vlapic *vlapic;
+	uint64_t cr8;
+	int regnum;
+
+	/* We only handle mov %cr8 to/from a register at this time. */
+	if ((exitqual & 0xe0) != 0x00) {
+		return (UNHANDLED);
+	}
+
+	vlapic = vm_lapic(vmx->vm, vcpu);
+	regnum = (exitqual >> 8) & 0xf;
+	if (exitqual & 0x10) {
+		cr8 = vlapic_get_cr8(vlapic);
+		vmx_set_guest_reg(vmx, vcpu, regnum, cr8);
+	} else {
+		cr8 = vmx_get_guest_reg(vmx, vcpu, regnum);
+		vlapic_set_cr8(vlapic, cr8);
+	}
+
+	return (HANDLED);
+}
+
+/*
+ * From section "Guest Register State" in the Intel SDM: CPL = SS.DPL
+ */
+static int
+vmx_cpl(void)
+{
+	uint32_t ssar;
+
+	ssar = vmcs_read(VMCS_GUEST_SS_ACCESS_RIGHTS);
+	return ((ssar >> 5) & 0x3);
+}
+
+static enum vm_cpu_mode
+vmx_cpu_mode(void)
+{
+	uint32_t csar;
+
+	if (vmcs_read(VMCS_GUEST_IA32_EFER) & EFER_LMA) {
+		csar = vmcs_read(VMCS_GUEST_CS_ACCESS_RIGHTS);
+		if (csar & 0x2000)
+			return (CPU_MODE_64BIT);	/* CS.L = 1 */
+		else
+			return (CPU_MODE_COMPATIBILITY);
+	} else if (vmcs_read(VMCS_GUEST_CR0) & CR0_PE) {
+		return (CPU_MODE_PROTECTED);
+	} else {
+		return (CPU_MODE_REAL);
+	}
+}
+
+static enum vm_paging_mode
+vmx_paging_mode(void)
+{
+
+	if (!(vmcs_read(VMCS_GUEST_CR0) & CR0_PG))
+		return (PAGING_MODE_FLAT);
+	if (!(vmcs_read(VMCS_GUEST_CR4) & CR4_PAE))
+		return (PAGING_MODE_32);
+	if (vmcs_read(VMCS_GUEST_IA32_EFER) & EFER_LME)
+		return (PAGING_MODE_64);
+	else
+		return (PAGING_MODE_PAE);
+}
+
+static uint64_t
+inout_str_index(struct vmx *vmx, int vcpuid, int in)
+{
+	uint64_t val;
+	int error;
+	enum vm_reg_name reg;
+
+	reg = in ? VM_REG_GUEST_RDI : VM_REG_GUEST_RSI;
+	error = vmx_getreg(vmx, vcpuid, reg, &val);
+	KASSERT(error == 0, ("%s: vmx_getreg error %d", __func__, error));
+	return (val);
+}
+
+static uint64_t
+inout_str_count(struct vmx *vmx, int vcpuid, int rep)
+{
+	uint64_t val;
+	int error;
+
+	if (rep) {
+		error = vmx_getreg(vmx, vcpuid, VM_REG_GUEST_RCX, &val);
+		KASSERT(!error, ("%s: vmx_getreg error %d", __func__, error));
+	} else {
+		val = 1;
+	}
+	return (val);
+}
+
+static int
+inout_str_addrsize(uint32_t inst_info)
+{
+	uint32_t size;
+
+	size = (inst_info >> 7) & 0x7;
+	switch (size) {
+	case 0:
+		return (2);	/* 16 bit */
+	case 1:
+		return (4);	/* 32 bit */
+	case 2:
+		return (8);	/* 64 bit */
+	default:
+		panic("%s: invalid size encoding %d", __func__, size);
+	}
+}
+
+static void
+inout_str_seginfo(struct vmx *vmx, int vcpuid, uint32_t inst_info, int in,
+    struct vm_inout_str *vis)
+{
+	int error, s;
+
+	if (in) {
+		vis->seg_name = VM_REG_GUEST_ES;
+	} else {
+		s = (inst_info >> 15) & 0x7;
+		vis->seg_name = vm_segment_name(s);
+	}
+
+	error = vmx_getdesc(vmx, vcpuid, vis->seg_name, &vis->seg_desc);
+	KASSERT(error == 0, ("%s: vmx_getdesc error %d", __func__, error));
+}
+
+static void
+vmx_paging_info(struct vm_guest_paging *paging)
+{
+	paging->cr3 = vmcs_guest_cr3();
+	paging->cpl = vmx_cpl();
+	paging->cpu_mode = vmx_cpu_mode();
+	paging->paging_mode = vmx_paging_mode();
+}
+
+static void
+vmexit_inst_emul(struct vm_exit *vmexit, uint64_t gpa, uint64_t gla)
+{
+	struct vm_guest_paging *paging;
+	uint32_t csar;
+
+	paging = &vmexit->u.inst_emul.paging;
+
+	vmexit->exitcode = VM_EXITCODE_INST_EMUL;
+	vmexit->inst_length = 0;
+	vmexit->u.inst_emul.gpa = gpa;
+	vmexit->u.inst_emul.gla = gla;
+	vmx_paging_info(paging);
+	switch (paging->cpu_mode) {
+	case CPU_MODE_REAL:
+		vmexit->u.inst_emul.cs_base = vmcs_read(VMCS_GUEST_CS_BASE);
+		vmexit->u.inst_emul.cs_d = 0;
+		break;
+	case CPU_MODE_PROTECTED:
+	case CPU_MODE_COMPATIBILITY:
+		vmexit->u.inst_emul.cs_base = vmcs_read(VMCS_GUEST_CS_BASE);
+		csar = vmcs_read(VMCS_GUEST_CS_ACCESS_RIGHTS);
+		vmexit->u.inst_emul.cs_d = SEG_DESC_DEF32(csar);
+		break;
+	default:
+		vmexit->u.inst_emul.cs_base = 0;
+		vmexit->u.inst_emul.cs_d = 0;
+		break;
+	}
+	vie_init(&vmexit->u.inst_emul.vie, NULL, 0);
+}
+
+static int
+ept_fault_type(uint64_t ept_qual)
+{
+	int fault_type;
+
+	if (ept_qual & EPT_VIOLATION_DATA_WRITE)
+		fault_type = VM_PROT_WRITE;
+	else if (ept_qual & EPT_VIOLATION_INST_FETCH)
+		fault_type = VM_PROT_EXECUTE;
+	else
+		fault_type= VM_PROT_READ;
+
+	return (fault_type);
+}
+
+static boolean_t
+ept_emulation_fault(uint64_t ept_qual)
+{
+	int read, write;
+
+	/* EPT fault on an instruction fetch doesn't make sense here */
+	if (ept_qual & EPT_VIOLATION_INST_FETCH)
+		return (FALSE);
+
+	/* EPT fault must be a read fault or a write fault */
+	read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
+	write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
+	if ((read | write) == 0)
+		return (FALSE);
+
+	/*
+	 * The EPT violation must have been caused by accessing a
+	 * guest-physical address that is a translation of a guest-linear
+	 * address.
+	 */
+	if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
+	    (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
+		return (FALSE);
+	}
+
+	return (TRUE);
+}
+
+static __inline int
+apic_access_virtualization(struct vmx *vmx, int vcpuid)
+{
+	uint32_t proc_ctls2;
+
+	proc_ctls2 = vmx->cap[vcpuid].proc_ctls2;
+	return ((proc_ctls2 & PROCBASED2_VIRTUALIZE_APIC_ACCESSES) ? 1 : 0);
+}
+
+static __inline int
+x2apic_virtualization(struct vmx *vmx, int vcpuid)
+{
+	uint32_t proc_ctls2;
+
+	proc_ctls2 = vmx->cap[vcpuid].proc_ctls2;
+	return ((proc_ctls2 & PROCBASED2_VIRTUALIZE_X2APIC_MODE) ? 1 : 0);
+}
+
+static int
+vmx_handle_apic_write(struct vmx *vmx, int vcpuid, struct vlapic *vlapic,
+    uint64_t qual)
+{
+	int error, handled, offset;
+	uint32_t *apic_regs, vector;
+	bool retu;
+
+	handled = HANDLED;
+	offset = APIC_WRITE_OFFSET(qual);
+
+	if (!apic_access_virtualization(vmx, vcpuid)) {
+		/*
+		 * In general there should not be any APIC write VM-exits
+		 * unless APIC-access virtualization is enabled.
+		 *
+		 * However self-IPI virtualization can legitimately trigger
+		 * an APIC-write VM-exit so treat it specially.
+		 */
+		if (x2apic_virtualization(vmx, vcpuid) &&
+		    offset == APIC_OFFSET_SELF_IPI) {
+			apic_regs = (uint32_t *)(vlapic->apic_page);
+			vector = apic_regs[APIC_OFFSET_SELF_IPI / 4];
+			vlapic_self_ipi_handler(vlapic, vector);
+			return (HANDLED);
+		} else
+			return (UNHANDLED);
+	}
+
+	switch (offset) {
+	case APIC_OFFSET_ID:
+		vlapic_id_write_handler(vlapic);
+		break;
+	case APIC_OFFSET_LDR:
+		vlapic_ldr_write_handler(vlapic);
+		break;
+	case APIC_OFFSET_DFR:
+		vlapic_dfr_write_handler(vlapic);
+		break;
+	case APIC_OFFSET_SVR:
+		vlapic_svr_write_handler(vlapic);
+		break;
+	case APIC_OFFSET_ESR:
+		vlapic_esr_write_handler(vlapic);
+		break;
+	case APIC_OFFSET_ICR_LOW:
+		retu = false;
+		error = vlapic_icrlo_write_handler(vlapic, &retu);
+		if (error != 0 || retu)
+			handled = UNHANDLED;
+		break;
+	case APIC_OFFSET_CMCI_LVT:
+	case APIC_OFFSET_TIMER_LVT ... APIC_OFFSET_ERROR_LVT:
+		vlapic_lvt_write_handler(vlapic, offset);
+		break;
+	case APIC_OFFSET_TIMER_ICR:
+		vlapic_icrtmr_write_handler(vlapic);
+		break;
+	case APIC_OFFSET_TIMER_DCR:
+		vlapic_dcr_write_handler(vlapic);
+		break;
+	default:
+		handled = UNHANDLED;
+		break;
+	}
+	return (handled);
+}
+
+static bool
+apic_access_fault(struct vmx *vmx, int vcpuid, uint64_t gpa)
+{
+
+	if (apic_access_virtualization(vmx, vcpuid) &&
+	    (gpa >= DEFAULT_APIC_BASE && gpa < DEFAULT_APIC_BASE + PAGE_SIZE))
+		return (true);
+	else
+		return (false);
+}
+
+static int
+vmx_handle_apic_access(struct vmx *vmx, int vcpuid, struct vm_exit *vmexit)
+{
+	uint64_t qual;
+	int access_type, offset, allowed;
+
+	if (!apic_access_virtualization(vmx, vcpuid))
+		return (UNHANDLED);
+
+	qual = vmexit->u.vmx.exit_qualification;
+	access_type = APIC_ACCESS_TYPE(qual);
+	offset = APIC_ACCESS_OFFSET(qual);
+
+	allowed = 0;
+	if (access_type == 0) {
+		/*
+		 * Read data access to the following registers is expected.
+		 */
+		switch (offset) {
+		case APIC_OFFSET_APR:
+		case APIC_OFFSET_PPR:
+		case APIC_OFFSET_RRR:
+		case APIC_OFFSET_CMCI_LVT:
+		case APIC_OFFSET_TIMER_CCR:
+			allowed = 1;
+			break;
+		default:
+			break;
+		}
+	} else if (access_type == 1) {
+		/*
+		 * Write data access to the following registers is expected.
+		 */
+		switch (offset) {
+		case APIC_OFFSET_VER:
+		case APIC_OFFSET_APR:
+		case APIC_OFFSET_PPR:
+		case APIC_OFFSET_RRR:
+		case APIC_OFFSET_ISR0 ... APIC_OFFSET_ISR7:
+		case APIC_OFFSET_TMR0 ... APIC_OFFSET_TMR7:
+		case APIC_OFFSET_IRR0 ... APIC_OFFSET_IRR7:
+		case APIC_OFFSET_CMCI_LVT:
+		case APIC_OFFSET_TIMER_CCR:
+			allowed = 1;
+			break;
+		default:
+			break;
+		}
+	}
+
+	if (allowed) {
+		vmexit_inst_emul(vmexit, DEFAULT_APIC_BASE + offset,
+		    VIE_INVALID_GLA);
+	}
+
+	/*
+	 * Regardless of whether the APIC-access is allowed this handler
+	 * always returns UNHANDLED:
+	 * - if the access is allowed then it is handled by emulating the
+	 *   instruction that caused the VM-exit (outside the critical section)
+	 * - if the access is not allowed then it will be converted to an
+	 *   exitcode of VM_EXITCODE_VMX and will be dealt with in userland.
+	 */
+	return (UNHANDLED);
+}
+
+static enum task_switch_reason
+vmx_task_switch_reason(uint64_t qual)
+{
+	int reason;
+
+	reason = (qual >> 30) & 0x3;
+	switch (reason) {
+	case 0:
+		return (TSR_CALL);
+	case 1:
+		return (TSR_IRET);
+	case 2:
+		return (TSR_JMP);
+	case 3:
+		return (TSR_IDT_GATE);
+	default:
+		panic("%s: invalid reason %d", __func__, reason);
+	}
+}
+
+static int
+emulate_wrmsr(struct vmx *vmx, int vcpuid, u_int num, uint64_t val, bool *retu)
+{
+	int error;
+
+	if (lapic_msr(num))
+		error = lapic_wrmsr(vmx->vm, vcpuid, num, val, retu);
+	else
+		error = vmx_wrmsr(vmx, vcpuid, num, val, retu);
+
+	return (error);
+}
+
+static int
+emulate_rdmsr(struct vmx *vmx, int vcpuid, u_int num, bool *retu)
+{
+	struct vmxctx *vmxctx;
+	uint64_t result;
+	uint32_t eax, edx;
+	int error;
+
+	if (lapic_msr(num))
+		error = lapic_rdmsr(vmx->vm, vcpuid, num, &result, retu);
+	else
+		error = vmx_rdmsr(vmx, vcpuid, num, &result, retu);
+
+	if (error == 0) {
+		eax = result;
+		vmxctx = &vmx->ctx[vcpuid];
+		error = vmxctx_setreg(vmxctx, VM_REG_GUEST_RAX, eax);
+		KASSERT(error == 0, ("vmxctx_setreg(rax) error %d", error));
+
+		edx = result >> 32;
+		error = vmxctx_setreg(vmxctx, VM_REG_GUEST_RDX, edx);
+		KASSERT(error == 0, ("vmxctx_setreg(rdx) error %d", error));
+	}
+
+	return (error);
+}
+
+#ifndef __FreeBSD__
+#define	__predict_false(x)	(x)
+#endif
+
+static int
+vmx_exit_process(struct vmx *vmx, int vcpu, struct vm_exit *vmexit)
+{
+	int error, errcode, errcode_valid, handled, in;
+	struct vmxctx *vmxctx;
+	struct vlapic *vlapic;
+	struct vm_inout_str *vis;
+	struct vm_task_switch *ts;
+	uint32_t eax, ecx, edx, idtvec_info, idtvec_err, intr_info, inst_info;
+	uint32_t intr_type, intr_vec, reason;
+	uint64_t exitintinfo, qual, gpa;
+	bool retu;
+
+	CTASSERT((PINBASED_CTLS_ONE_SETTING & PINBASED_VIRTUAL_NMI) != 0);
+	CTASSERT((PINBASED_CTLS_ONE_SETTING & PINBASED_NMI_EXITING) != 0);
+
+	handled = UNHANDLED;
+	vmxctx = &vmx->ctx[vcpu];
+
+	qual = vmexit->u.vmx.exit_qualification;
+	reason = vmexit->u.vmx.exit_reason;
+	vmexit->exitcode = VM_EXITCODE_BOGUS;
+
+	vmm_stat_incr(vmx->vm, vcpu, VMEXIT_COUNT, 1);
+	SDT_PROBE3(vmm, vmx, exit, entry, vmx, vcpu, vmexit);
+
+	/*
+	 * VM-entry failures during or after loading guest state.
+	 *
+	 * These VM-exits are uncommon but must be handled specially
+	 * as most VM-exit fields are not populated as usual.
+	 */
+	if (__predict_false(reason == EXIT_REASON_MCE_DURING_ENTRY)) {
+		VCPU_CTR0(vmx->vm, vcpu, "Handling MCE during VM-entry");
+#ifdef __FreeBSD__
+		__asm __volatile("int $18");
+#else
+		panic("XXX vector to MCE handler");
+#endif
+		return (1);
+	}
+
+	/*
+	 * VM exits that can be triggered during event delivery need to
+	 * be handled specially by re-injecting the event if the IDT
+	 * vectoring information field's valid bit is set.
+	 *
+	 * See "Information for VM Exits During Event Delivery" in Intel SDM
+	 * for details.
+	 */
+	idtvec_info = vmcs_idt_vectoring_info();
+	if (idtvec_info & VMCS_IDT_VEC_VALID) {
+		idtvec_info &= ~(1 << 12); /* clear undefined bit */
+		exitintinfo = idtvec_info;
+		if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
+			idtvec_err = vmcs_idt_vectoring_err();
+			exitintinfo |= (uint64_t)idtvec_err << 32;
+		}
+		error = vm_exit_intinfo(vmx->vm, vcpu, exitintinfo);
+		KASSERT(error == 0, ("%s: vm_set_intinfo error %d",
+		    __func__, error));
+
+		/*
+		 * If 'virtual NMIs' are being used and the VM-exit
+		 * happened while injecting an NMI during the previous
+		 * VM-entry, then clear "blocking by NMI" in the
+		 * Guest Interruptibility-State so the NMI can be
+		 * reinjected on the subsequent VM-entry.
+		 *
+		 * However, if the NMI was being delivered through a task
+		 * gate, then the new task must start execution with NMIs
+		 * blocked so don't clear NMI blocking in this case.
+		 */
+		intr_type = idtvec_info & VMCS_INTR_T_MASK;
+		if (intr_type == VMCS_INTR_T_NMI) {
+			if (reason != EXIT_REASON_TASK_SWITCH)
+				vmx_clear_nmi_blocking(vmx, vcpu);
+			else
+				vmx_assert_nmi_blocking(vmx, vcpu);
+		}
+
+		/*
+		 * Update VM-entry instruction length if the event being
+		 * delivered was a software interrupt or software exception.
+		 */
+		if (intr_type == VMCS_INTR_T_SWINTR ||
+		    intr_type == VMCS_INTR_T_PRIV_SWEXCEPTION ||
+		    intr_type == VMCS_INTR_T_SWEXCEPTION) {
+			vmcs_write(VMCS_ENTRY_INST_LENGTH, vmexit->inst_length);
+		}
+	}
+
+	switch (reason) {
+	case EXIT_REASON_TASK_SWITCH:
+		ts = &vmexit->u.task_switch;
+		ts->tsssel = qual & 0xffff;
+		ts->reason = vmx_task_switch_reason(qual);
+		ts->ext = 0;
+		ts->errcode_valid = 0;
+		vmx_paging_info(&ts->paging);
+		/*
+		 * If the task switch was due to a CALL, JMP, IRET, software
+		 * interrupt (INT n) or software exception (INT3, INTO),
+		 * then the saved %rip references the instruction that caused
+		 * the task switch. The instruction length field in the VMCS
+		 * is valid in this case.
+		 *
+		 * In all other cases (e.g., NMI, hardware exception) the
+		 * saved %rip is one that would have been saved in the old TSS
+		 * had the task switch completed normally so the instruction
+		 * length field is not needed in this case and is explicitly
+		 * set to 0.
+		 */
+		if (ts->reason == TSR_IDT_GATE) {
+			KASSERT(idtvec_info & VMCS_IDT_VEC_VALID,
+			    ("invalid idtvec_info %#x for IDT task switch",
+			    idtvec_info));
+			intr_type = idtvec_info & VMCS_INTR_T_MASK;
+			if (intr_type != VMCS_INTR_T_SWINTR &&
+			    intr_type != VMCS_INTR_T_SWEXCEPTION &&
+			    intr_type != VMCS_INTR_T_PRIV_SWEXCEPTION) {
+				/* Task switch triggered by external event */
+				ts->ext = 1;
+				vmexit->inst_length = 0;
+				if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
+					ts->errcode_valid = 1;
+					ts->errcode = vmcs_idt_vectoring_err();
+				}
+			}
+		}
+		vmexit->exitcode = VM_EXITCODE_TASK_SWITCH;
+		SDT_PROBE4(vmm, vmx, exit, taskswitch, vmx, vcpu, vmexit, ts);
+		VCPU_CTR4(vmx->vm, vcpu, "task switch reason %d, tss 0x%04x, "
+		    "%s errcode 0x%016lx", ts->reason, ts->tsssel,
+		    ts->ext ? "external" : "internal",
+		    ((uint64_t)ts->errcode << 32) | ts->errcode_valid);
+		break;
+	case EXIT_REASON_CR_ACCESS:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_CR_ACCESS, 1);
+		SDT_PROBE4(vmm, vmx, exit, craccess, vmx, vcpu, vmexit, qual);
+		switch (qual & 0xf) {
+		case 0:
+			handled = vmx_emulate_cr0_access(vmx, vcpu, qual);
+			break;
+		case 4:
+			handled = vmx_emulate_cr4_access(vmx, vcpu, qual);
+			break;
+		case 8:
+			handled = vmx_emulate_cr8_access(vmx, vcpu, qual);
+			break;
+		}
+		break;
+	case EXIT_REASON_RDMSR:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_RDMSR, 1);
+		retu = false;
+		ecx = vmxctx->guest_rcx;
+		VCPU_CTR1(vmx->vm, vcpu, "rdmsr 0x%08x", ecx);
+		SDT_PROBE4(vmm, vmx, exit, rdmsr, vmx, vcpu, vmexit, ecx);
+		error = emulate_rdmsr(vmx, vcpu, ecx, &retu);
+		if (error) {
+			vmexit->exitcode = VM_EXITCODE_RDMSR;
+			vmexit->u.msr.code = ecx;
+		} else if (!retu) {
+			handled = HANDLED;
+		} else {
+			/* Return to userspace with a valid exitcode */
+			KASSERT(vmexit->exitcode != VM_EXITCODE_BOGUS,
+			    ("emulate_rdmsr retu with bogus exitcode"));
+		}
+		break;
+	case EXIT_REASON_WRMSR:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_WRMSR, 1);
+		retu = false;
+		eax = vmxctx->guest_rax;
+		ecx = vmxctx->guest_rcx;
+		edx = vmxctx->guest_rdx;
+		VCPU_CTR2(vmx->vm, vcpu, "wrmsr 0x%08x value 0x%016lx",
+		    ecx, (uint64_t)edx << 32 | eax);
+		SDT_PROBE5(vmm, vmx, exit, wrmsr, vmx, vmexit, vcpu, ecx,
+		    (uint64_t)edx << 32 | eax);
+		error = emulate_wrmsr(vmx, vcpu, ecx,
+		    (uint64_t)edx << 32 | eax, &retu);
+		if (error) {
+			vmexit->exitcode = VM_EXITCODE_WRMSR;
+			vmexit->u.msr.code = ecx;
+			vmexit->u.msr.wval = (uint64_t)edx << 32 | eax;
+		} else if (!retu) {
+			handled = HANDLED;
+		} else {
+			/* Return to userspace with a valid exitcode */
+			KASSERT(vmexit->exitcode != VM_EXITCODE_BOGUS,
+			    ("emulate_wrmsr retu with bogus exitcode"));
+		}
+		break;
+	case EXIT_REASON_HLT:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_HLT, 1);
+		SDT_PROBE3(vmm, vmx, exit, halt, vmx, vcpu, vmexit);
+		vmexit->exitcode = VM_EXITCODE_HLT;
+		vmexit->u.hlt.rflags = vmcs_read(VMCS_GUEST_RFLAGS);
+		if (virtual_interrupt_delivery)
+			vmexit->u.hlt.intr_status =
+			    vmcs_read(VMCS_GUEST_INTR_STATUS);
+		else
+			vmexit->u.hlt.intr_status = 0;
+		break;
+	case EXIT_REASON_MTF:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_MTRAP, 1);
+		SDT_PROBE3(vmm, vmx, exit, mtrap, vmx, vcpu, vmexit);
+		vmexit->exitcode = VM_EXITCODE_MTRAP;
+		vmexit->inst_length = 0;
+		break;
+	case EXIT_REASON_PAUSE:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_PAUSE, 1);
+		SDT_PROBE3(vmm, vmx, exit, pause, vmx, vcpu, vmexit);
+		vmexit->exitcode = VM_EXITCODE_PAUSE;
+		break;
+	case EXIT_REASON_INTR_WINDOW:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_INTR_WINDOW, 1);
+		SDT_PROBE3(vmm, vmx, exit, intrwindow, vmx, vcpu, vmexit);
+		vmx_clear_int_window_exiting(vmx, vcpu);
+		return (1);
+	case EXIT_REASON_EXT_INTR:
+		/*
+		 * External interrupts serve only to cause VM exits and allow
+		 * the host interrupt handler to run.
+		 *
+		 * If this external interrupt triggers a virtual interrupt
+		 * to a VM, then that state will be recorded by the
+		 * host interrupt handler in the VM's softc. We will inject
+		 * this virtual interrupt during the subsequent VM enter.
+		 */
+		intr_info = vmcs_read(VMCS_EXIT_INTR_INFO);
+		SDT_PROBE4(vmm, vmx, exit, interrupt,
+		    vmx, vcpu, vmexit, intr_info);
+
+		/*
+		 * XXX: Ignore this exit if VMCS_INTR_VALID is not set.
+		 * This appears to be a bug in VMware Fusion?
+		 */
+		if (!(intr_info & VMCS_INTR_VALID))
+			return (1);
+		KASSERT((intr_info & VMCS_INTR_VALID) != 0 &&
+		    (intr_info & VMCS_INTR_T_MASK) == VMCS_INTR_T_HWINTR,
+		    ("VM exit interruption info invalid: %#x", intr_info));
+		vmx_trigger_hostintr(intr_info & 0xff);
+
+		/*
+		 * This is special. We want to treat this as an 'handled'
+		 * VM-exit but not increment the instruction pointer.
+		 */
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_EXTINT, 1);
+		return (1);
+	case EXIT_REASON_NMI_WINDOW:
+		SDT_PROBE3(vmm, vmx, exit, nmiwindow, vmx, vcpu, vmexit);
+		/* Exit to allow the pending virtual NMI to be injected */
+		if (vm_nmi_pending(vmx->vm, vcpu))
+			vmx_inject_nmi(vmx, vcpu);
+		vmx_clear_nmi_window_exiting(vmx, vcpu);
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_NMI_WINDOW, 1);
+		return (1);
+	case EXIT_REASON_INOUT:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_INOUT, 1);
+		vmexit->exitcode = VM_EXITCODE_INOUT;
+		vmexit->u.inout.bytes = (qual & 0x7) + 1;
+		vmexit->u.inout.in = in = (qual & 0x8) ? 1 : 0;
+		vmexit->u.inout.string = (qual & 0x10) ? 1 : 0;
+		vmexit->u.inout.rep = (qual & 0x20) ? 1 : 0;
+		vmexit->u.inout.port = (uint16_t)(qual >> 16);
+		vmexit->u.inout.eax = (uint32_t)(vmxctx->guest_rax);
+		if (vmexit->u.inout.string) {
+			inst_info = vmcs_read(VMCS_EXIT_INSTRUCTION_INFO);
+			vmexit->exitcode = VM_EXITCODE_INOUT_STR;
+			vis = &vmexit->u.inout_str;
+			vmx_paging_info(&vis->paging);
+			vis->rflags = vmcs_read(VMCS_GUEST_RFLAGS);
+			vis->cr0 = vmcs_read(VMCS_GUEST_CR0);
+			vis->index = inout_str_index(vmx, vcpu, in);
+			vis->count = inout_str_count(vmx, vcpu, vis->inout.rep);
+			vis->addrsize = inout_str_addrsize(inst_info);
+			inout_str_seginfo(vmx, vcpu, inst_info, in, vis);
+		}
+		SDT_PROBE3(vmm, vmx, exit, inout, vmx, vcpu, vmexit);
+		break;
+	case EXIT_REASON_CPUID:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_CPUID, 1);
+		SDT_PROBE3(vmm, vmx, exit, cpuid, vmx, vcpu, vmexit);
+		handled = vmx_handle_cpuid(vmx->vm, vcpu, vmxctx);
+		break;
+	case EXIT_REASON_EXCEPTION:
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_EXCEPTION, 1);
+		intr_info = vmcs_read(VMCS_EXIT_INTR_INFO);
+		KASSERT((intr_info & VMCS_INTR_VALID) != 0,
+		    ("VM exit interruption info invalid: %#x", intr_info));
+
+		intr_vec = intr_info & 0xff;
+		intr_type = intr_info & VMCS_INTR_T_MASK;
+
+		/*
+		 * If Virtual NMIs control is 1 and the VM-exit is due to a
+		 * fault encountered during the execution of IRET then we must
+		 * restore the state of "virtual-NMI blocking" before resuming
+		 * the guest.
+		 *
+		 * See "Resuming Guest Software after Handling an Exception".
+		 * See "Information for VM Exits Due to Vectored Events".
+		 */
+		if ((idtvec_info & VMCS_IDT_VEC_VALID) == 0 &&
+		    (intr_vec != IDT_DF) &&
+		    (intr_info & EXIT_QUAL_NMIUDTI) != 0)
+			vmx_restore_nmi_blocking(vmx, vcpu);
+
+		/*
+		 * The NMI has already been handled in vmx_exit_handle_nmi().
+		 */
+		if (intr_type == VMCS_INTR_T_NMI)
+			return (1);
+
+		/*
+		 * Call the machine check handler by hand. Also don't reflect
+		 * the machine check back into the guest.
+		 */
+		if (intr_vec == IDT_MC) {
+			VCPU_CTR0(vmx->vm, vcpu, "Vectoring to MCE handler");
+#ifdef __FreeBSD__
+			__asm __volatile("int $18");
+#else
+			panic("XXX vector to MCE handler");
+#endif
+			return (1);
+		}
+
+		if (intr_vec == IDT_PF) {
+			error = vmxctx_setreg(vmxctx, VM_REG_GUEST_CR2, qual);
+			KASSERT(error == 0, ("%s: vmxctx_setreg(cr2) error %d",
+			    __func__, error));
+		}
+
+		/*
+		 * Software exceptions exhibit trap-like behavior. This in
+		 * turn requires populating the VM-entry instruction length
+		 * so that the %rip in the trap frame is past the INT3/INTO
+		 * instruction.
+		 */
+		if (intr_type == VMCS_INTR_T_SWEXCEPTION)
+			vmcs_write(VMCS_ENTRY_INST_LENGTH, vmexit->inst_length);
+
+		/* Reflect all other exceptions back into the guest */
+		errcode_valid = errcode = 0;
+		if (intr_info & VMCS_INTR_DEL_ERRCODE) {
+			errcode_valid = 1;
+			errcode = vmcs_read(VMCS_EXIT_INTR_ERRCODE);
+		}
+		VCPU_CTR2(vmx->vm, vcpu, "Reflecting exception %d/%#x into "
+		    "the guest", intr_vec, errcode);
+		SDT_PROBE5(vmm, vmx, exit, exception,
+		    vmx, vcpu, vmexit, intr_vec, errcode);
+		error = vm_inject_exception(vmx->vm, vcpu, intr_vec,
+		    errcode_valid, errcode, 0);
+		KASSERT(error == 0, ("%s: vm_inject_exception error %d",
+		    __func__, error));
+		return (1);
+
+	case EXIT_REASON_EPT_FAULT:
+		/*
+		 * If 'gpa' lies within the address space allocated to
+		 * memory then this must be a nested page fault otherwise
+		 * this must be an instruction that accesses MMIO space.
+		 */
+		gpa = vmcs_gpa();
+		if (vm_mem_allocated(vmx->vm, vcpu, gpa) ||
+		    apic_access_fault(vmx, vcpu, gpa)) {
+			vmexit->exitcode = VM_EXITCODE_PAGING;
+			vmexit->inst_length = 0;
+			vmexit->u.paging.gpa = gpa;
+			vmexit->u.paging.fault_type = ept_fault_type(qual);
+			vmm_stat_incr(vmx->vm, vcpu, VMEXIT_NESTED_FAULT, 1);
+			SDT_PROBE5(vmm, vmx, exit, nestedfault,
+			    vmx, vcpu, vmexit, gpa, qual);
+		} else if (ept_emulation_fault(qual)) {
+			vmexit_inst_emul(vmexit, gpa, vmcs_gla());
+			vmm_stat_incr(vmx->vm, vcpu, VMEXIT_INST_EMUL, 1);
+			SDT_PROBE4(vmm, vmx, exit, mmiofault,
+			    vmx, vcpu, vmexit, gpa);
+		}
+		/*
+		 * If Virtual NMIs control is 1 and the VM-exit is due to an
+		 * EPT fault during the execution of IRET then we must restore
+		 * the state of "virtual-NMI blocking" before resuming.
+		 *
+		 * See description of "NMI unblocking due to IRET" in
+		 * "Exit Qualification for EPT Violations".
+		 */
+		if ((idtvec_info & VMCS_IDT_VEC_VALID) == 0 &&
+		    (qual & EXIT_QUAL_NMIUDTI) != 0)
+			vmx_restore_nmi_blocking(vmx, vcpu);
+		break;
+	case EXIT_REASON_VIRTUALIZED_EOI:
+		vmexit->exitcode = VM_EXITCODE_IOAPIC_EOI;
+		vmexit->u.ioapic_eoi.vector = qual & 0xFF;
+		SDT_PROBE3(vmm, vmx, exit, eoi, vmx, vcpu, vmexit);
+		vmexit->inst_length = 0;	/* trap-like */
+		break;
+	case EXIT_REASON_APIC_ACCESS:
+		SDT_PROBE3(vmm, vmx, exit, apicaccess, vmx, vcpu, vmexit);
+		handled = vmx_handle_apic_access(vmx, vcpu, vmexit);
+		break;
+	case EXIT_REASON_APIC_WRITE:
+		/*
+		 * APIC-write VM exit is trap-like so the %rip is already
+		 * pointing to the next instruction.
+		 */
+		vmexit->inst_length = 0;
+		vlapic = vm_lapic(vmx->vm, vcpu);
+		SDT_PROBE4(vmm, vmx, exit, apicwrite,
+		    vmx, vcpu, vmexit, vlapic);
+		handled = vmx_handle_apic_write(vmx, vcpu, vlapic, qual);
+		break;
+	case EXIT_REASON_XSETBV:
+		SDT_PROBE3(vmm, vmx, exit, xsetbv, vmx, vcpu, vmexit);
+		handled = vmx_emulate_xsetbv(vmx, vcpu, vmexit);
+		break;
+	case EXIT_REASON_MONITOR:
+		SDT_PROBE3(vmm, vmx, exit, monitor, vmx, vcpu, vmexit);
+		vmexit->exitcode = VM_EXITCODE_MONITOR;
+		break;
+	case EXIT_REASON_MWAIT:
+		SDT_PROBE3(vmm, vmx, exit, mwait, vmx, vcpu, vmexit);
+		vmexit->exitcode = VM_EXITCODE_MWAIT;
+		break;
+	default:
+		SDT_PROBE4(vmm, vmx, exit, unknown,
+		    vmx, vcpu, vmexit, reason);
+		vmm_stat_incr(vmx->vm, vcpu, VMEXIT_UNKNOWN, 1);
+		break;
+	}
+
+	if (handled) {
+		/*
+		 * It is possible that control is returned to userland
+		 * even though we were able to handle the VM exit in the
+		 * kernel.
+		 *
+		 * In such a case we want to make sure that the userland
+		 * restarts guest execution at the instruction *after*
+		 * the one we just processed. Therefore we update the
+		 * guest rip in the VMCS and in 'vmexit'.
+		 */
+		vmexit->rip += vmexit->inst_length;
+		vmexit->inst_length = 0;
+		vmcs_write(VMCS_GUEST_RIP, vmexit->rip);
+	} else {
+		if (vmexit->exitcode == VM_EXITCODE_BOGUS) {
+			/*
+			 * If this VM exit was not claimed by anybody then
+			 * treat it as a generic VMX exit.
+			 */
+			vmexit->exitcode = VM_EXITCODE_VMX;
+			vmexit->u.vmx.status = VM_SUCCESS;
+			vmexit->u.vmx.inst_type = 0;
+			vmexit->u.vmx.inst_error = 0;
+		} else {
+			/*
+			 * The exitcode and collateral have been populated.
+			 * The VM exit will be processed further in userland.
+			 */
+		}
+	}
+
+	SDT_PROBE4(vmm, vmx, exit, return,
+	    vmx, vcpu, vmexit, handled);
+	return (handled);
+}
+
+static void
+vmx_exit_inst_error(struct vmxctx *vmxctx, int rc, struct vm_exit *vmexit)
+{
+
+	KASSERT(vmxctx->inst_fail_status != VM_SUCCESS,
+	    ("vmx_exit_inst_error: invalid inst_fail_status %d",
+	    vmxctx->inst_fail_status));
+
+	vmexit->inst_length = 0;
+	vmexit->exitcode = VM_EXITCODE_VMX;
+	vmexit->u.vmx.status = vmxctx->inst_fail_status;
+	vmexit->u.vmx.inst_error = vmcs_instruction_error();
+	vmexit->u.vmx.exit_reason = ~0;
+	vmexit->u.vmx.exit_qualification = ~0;
+
+	switch (rc) {
+	case VMX_VMRESUME_ERROR:
+	case VMX_VMLAUNCH_ERROR:
+	case VMX_INVEPT_ERROR:
+#ifndef __FreeBSD__
+	case VMX_VMWRITE_ERROR:
+#endif
+		vmexit->u.vmx.inst_type = rc;
+		break;
+	default:
+		panic("vm_exit_inst_error: vmx_enter_guest returned %d", rc);
+	}
+}
+
+/*
+ * If the NMI-exiting VM execution control is set to '1' then an NMI in
+ * non-root operation causes a VM-exit. NMI blocking is in effect so it is
+ * sufficient to simply vector to the NMI handler via a software interrupt.
+ * However, this must be done before maskable interrupts are enabled
+ * otherwise the "iret" issued by an interrupt handler will incorrectly
+ * clear NMI blocking.
+ */
+static __inline void
+vmx_exit_handle_nmi(struct vmx *vmx, int vcpuid, struct vm_exit *vmexit)
+{
+	uint32_t intr_info;
+
+	KASSERT((read_rflags() & PSL_I) == 0, ("interrupts enabled"));
+
+	if (vmexit->u.vmx.exit_reason != EXIT_REASON_EXCEPTION)
+		return;
+
+	intr_info = vmcs_read(VMCS_EXIT_INTR_INFO);
+	KASSERT((intr_info & VMCS_INTR_VALID) != 0,
+	    ("VM exit interruption info invalid: %#x", intr_info));
+
+	if ((intr_info & VMCS_INTR_T_MASK) == VMCS_INTR_T_NMI) {
+		KASSERT((intr_info & 0xff) == IDT_NMI, ("VM exit due "
+		    "to NMI has invalid vector: %#x", intr_info));
+		VCPU_CTR0(vmx->vm, vcpuid, "Vectoring to NMI handler");
+#ifdef __FreeBSD__
+		__asm __volatile("int $2");
+#else
+		panic("XXX vector to NMI handler");
+#endif
+	}
+}
+
+static __inline void
+vmx_dr_enter_guest(struct vmxctx *vmxctx)
+{
+	register_t rflags;
+
+	/* Save host control debug registers. */
+	vmxctx->host_dr7 = rdr7();
+	vmxctx->host_debugctl = rdmsr(MSR_DEBUGCTLMSR);
+
+	/*
+	 * Disable debugging in DR7 and DEBUGCTL to avoid triggering
+	 * exceptions in the host based on the guest DRx values.  The
+	 * guest DR7 and DEBUGCTL are saved/restored in the VMCS.
+	 */
+	load_dr7(0);
+	wrmsr(MSR_DEBUGCTLMSR, 0);
+
+	/*
+	 * Disable single stepping the kernel to avoid corrupting the
+	 * guest DR6.  A debugger might still be able to corrupt the
+	 * guest DR6 by setting a breakpoint after this point and then
+	 * single stepping.
+	 */
+	rflags = read_rflags();
+	vmxctx->host_tf = rflags & PSL_T;
+	write_rflags(rflags & ~PSL_T);
+
+	/* Save host debug registers. */
+	vmxctx->host_dr0 = rdr0();
+	vmxctx->host_dr1 = rdr1();
+	vmxctx->host_dr2 = rdr2();
+	vmxctx->host_dr3 = rdr3();
+	vmxctx->host_dr6 = rdr6();
+
+	/* Restore guest debug registers. */
+	load_dr0(vmxctx->guest_dr0);
+	load_dr1(vmxctx->guest_dr1);
+	load_dr2(vmxctx->guest_dr2);
+	load_dr3(vmxctx->guest_dr3);
+	load_dr6(vmxctx->guest_dr6);
+}
+
+static __inline void
+vmx_dr_leave_guest(struct vmxctx *vmxctx)
+{
+
+	/* Save guest debug registers. */
+	vmxctx->guest_dr0 = rdr0();
+	vmxctx->guest_dr1 = rdr1();
+	vmxctx->guest_dr2 = rdr2();
+	vmxctx->guest_dr3 = rdr3();
+	vmxctx->guest_dr6 = rdr6();
+
+	/*
+	 * Restore host debug registers.  Restore DR7, DEBUGCTL, and
+	 * PSL_T last.
+	 */
+	load_dr0(vmxctx->host_dr0);
+	load_dr1(vmxctx->host_dr1);
+	load_dr2(vmxctx->host_dr2);
+	load_dr3(vmxctx->host_dr3);
+	load_dr6(vmxctx->host_dr6);
+	wrmsr(MSR_DEBUGCTLMSR, vmxctx->host_debugctl);
+	load_dr7(vmxctx->host_dr7);
+	write_rflags(read_rflags() | vmxctx->host_tf);
+}
+
+static int
+vmx_run(void *arg, int vcpu, register_t rip, pmap_t pmap,
+    struct vm_eventinfo *evinfo)
+{
+	int rc, handled, launched;
+	struct vmx *vmx;
+	struct vm *vm;
+	struct vmxctx *vmxctx;
+	struct vmcs *vmcs;
+	struct vm_exit *vmexit;
+	struct vlapic *vlapic;
+	uint32_t exit_reason;
+
+	vmx = arg;
+	vm = vmx->vm;
+	vmcs = &vmx->vmcs[vcpu];
+	vmxctx = &vmx->ctx[vcpu];
+	vlapic = vm_lapic(vm, vcpu);
+	vmexit = vm_exitinfo(vm, vcpu);
+	launched = 0;
+
+	KASSERT(vmxctx->pmap == pmap,
+	    ("pmap %p different than ctx pmap %p", pmap, vmxctx->pmap));
+
+	vmx_msr_guest_enter(vmx, vcpu);
+
+	VMPTRLD(vmcs);
+
+#ifndef __FreeBSD__
+	VERIFY(!vmx->ctx_loaded[vcpu] && curthread->t_preempt != 0);
+	vmx->ctx_loaded[vcpu] = B_TRUE;
+#endif
+
+	/*
+	 * XXX
+	 * We do this every time because we may setup the virtual machine
+	 * from a different process than the one that actually runs it.
+	 *
+	 * If the life of a virtual machine was spent entirely in the context
+	 * of a single process we could do this once in vmx_vminit().
+	 */
+	vmcs_write(VMCS_HOST_CR3, rcr3());
+
+	vmcs_write(VMCS_GUEST_RIP, rip);
+	vmx_set_pcpu_defaults(vmx, vcpu, pmap);
+	do {
+		KASSERT(vmcs_guest_rip() == rip, ("%s: vmcs guest rip mismatch "
+		    "%#lx/%#lx", __func__, vmcs_guest_rip(), rip));
+
+		handled = UNHANDLED;
+		/*
+		 * Interrupts are disabled from this point on until the
+		 * guest starts executing. This is done for the following
+		 * reasons:
+		 *
+		 * If an AST is asserted on this thread after the check below,
+		 * then the IPI_AST notification will not be lost, because it
+		 * will cause a VM exit due to external interrupt as soon as
+		 * the guest state is loaded.
+		 *
+		 * A posted interrupt after 'vmx_inject_interrupts()' will
+		 * not be "lost" because it will be held pending in the host
+		 * APIC because interrupts are disabled. The pending interrupt
+		 * will be recognized as soon as the guest state is loaded.
+		 *
+		 * The same reasoning applies to the IPI generated by
+		 * pmap_invalidate_ept().
+		 */
+		/* XXXJOY: this is _long_ time to keep interrupts disabled */
+		disable_intr();
+		vmx_inject_interrupts(vmx, vcpu, vlapic, rip);
+
+		/*
+		 * Check for vcpu suspension after injecting events because
+		 * vmx_inject_interrupts() can suspend the vcpu due to a
+		 * triple fault.
+		 */
+		if (vcpu_suspended(evinfo)) {
+			enable_intr();
+			vm_exit_suspended(vmx->vm, vcpu, rip);
+			break;
+		}
+
+		if (vcpu_rendezvous_pending(evinfo)) {
+			enable_intr();
+			vm_exit_rendezvous(vmx->vm, vcpu, rip);
+			break;
+		}
+
+		if (vcpu_reqidle(evinfo)) {
+			enable_intr();
+			vm_exit_reqidle(vmx->vm, vcpu, rip);
+			break;
+		}
+
+		if (vcpu_should_yield(vm, vcpu)) {
+			enable_intr();
+			vm_exit_astpending(vmx->vm, vcpu, rip);
+			vmx_astpending_trace(vmx, vcpu, rip);
+			handled = HANDLED;
+			break;
+		}
+
+		if (vcpu_debugged(vm, vcpu)) {
+			enable_intr();
+			vm_exit_debug(vmx->vm, vcpu, rip);
+			break;
+		}
+
+#ifndef __FreeBSD__
+		if ((rc = ht_acquire()) != 1) {
+			enable_intr();
+			vmexit->rip = rip;
+			vmexit->inst_length = 0;
+			if (rc == -1) {
+				vmexit->exitcode = VM_EXITCODE_HT;
+			} else {
+				vmexit->exitcode = VM_EXITCODE_BOGUS;
+				handled = HANDLED;
+			}
+			break;
+		}
+#endif
+
+		vmx_run_trace(vmx, vcpu);
+		vmx_dr_enter_guest(vmxctx);
+		rc = vmx_enter_guest(vmxctx, vmx, launched);
+		vmx_dr_leave_guest(vmxctx);
+
+#ifndef __FreeBSD__
+		ht_release();
+#endif
+
+		/* Collect some information for VM exit processing */
+		vmexit->rip = rip = vmcs_guest_rip();
+		vmexit->inst_length = vmexit_instruction_length();
+		vmexit->u.vmx.exit_reason = exit_reason = vmcs_exit_reason();
+		vmexit->u.vmx.exit_qualification = vmcs_exit_qualification();
+
+		/* Update 'nextrip' */
+		vmx->state[vcpu].nextrip = rip;
+
+		if (rc == VMX_GUEST_VMEXIT) {
+			vmx_exit_handle_nmi(vmx, vcpu, vmexit);
+			enable_intr();
+			handled = vmx_exit_process(vmx, vcpu, vmexit);
+		} else {
+			enable_intr();
+			vmx_exit_inst_error(vmxctx, rc, vmexit);
+		}
+		launched = 1;
+		vmx_exit_trace(vmx, vcpu, rip, exit_reason, handled);
+		rip = vmexit->rip;
+	} while (handled);
+
+	/*
+	 * If a VM exit has been handled then the exitcode must be BOGUS
+	 * If a VM exit is not handled then the exitcode must not be BOGUS
+	 */
+	if ((handled && vmexit->exitcode != VM_EXITCODE_BOGUS) ||
+	    (!handled && vmexit->exitcode == VM_EXITCODE_BOGUS)) {
+		panic("Mismatch between handled (%d) and exitcode (%d)",
+		      handled, vmexit->exitcode);
+	}
+
+	if (!handled)
+		vmm_stat_incr(vm, vcpu, VMEXIT_USERSPACE, 1);
+
+	if (virtual_interrupt_delivery) {
+		vmx_flush_pir_prio(vlapic);
+	}
+
+	VCPU_CTR1(vm, vcpu, "returning from vmx_run: exitcode %d",
+	    vmexit->exitcode);
+
+	VMCLEAR(vmcs);
+	vmx_msr_guest_exit(vmx, vcpu);
+
+#ifndef __FreeBSD__
+	VERIFY(vmx->ctx_loaded[vcpu] && curthread->t_preempt != 0);
+	vmx->ctx_loaded[vcpu] = B_FALSE;
+#endif
+
+	return (0);
+}
+
+static void
+vmx_vmcleanup(void *arg)
+{
+	int i;
+	struct vmx *vmx = arg;
+
+	if (apic_access_virtualization(vmx, 0))
+		vm_unmap_mmio(vmx->vm, DEFAULT_APIC_BASE, PAGE_SIZE);
+
+	for (i = 0; i < VM_MAXCPU; i++)
+		vpid_free(vmx->state[i].vpid);
+
+	free(vmx, M_VMX);
+
+	return;
+}
+
+static register_t *
+vmxctx_regptr(struct vmxctx *vmxctx, int reg)
+{
+
+	switch (reg) {
+	case VM_REG_GUEST_RAX:
+		return (&vmxctx->guest_rax);
+	case VM_REG_GUEST_RBX:
+		return (&vmxctx->guest_rbx);
+	case VM_REG_GUEST_RCX:
+		return (&vmxctx->guest_rcx);
+	case VM_REG_GUEST_RDX:
+		return (&vmxctx->guest_rdx);
+	case VM_REG_GUEST_RSI:
+		return (&vmxctx->guest_rsi);
+	case VM_REG_GUEST_RDI:
+		return (&vmxctx->guest_rdi);
+	case VM_REG_GUEST_RBP:
+		return (&vmxctx->guest_rbp);
+	case VM_REG_GUEST_R8:
+		return (&vmxctx->guest_r8);
+	case VM_REG_GUEST_R9:
+		return (&vmxctx->guest_r9);
+	case VM_REG_GUEST_R10:
+		return (&vmxctx->guest_r10);
+	case VM_REG_GUEST_R11:
+		return (&vmxctx->guest_r11);
+	case VM_REG_GUEST_R12:
+		return (&vmxctx->guest_r12);
+	case VM_REG_GUEST_R13:
+		return (&vmxctx->guest_r13);
+	case VM_REG_GUEST_R14:
+		return (&vmxctx->guest_r14);
+	case VM_REG_GUEST_R15:
+		return (&vmxctx->guest_r15);
+	case VM_REG_GUEST_CR2:
+		return (&vmxctx->guest_cr2);
+	case VM_REG_GUEST_DR0:
+		return (&vmxctx->guest_dr0);
+	case VM_REG_GUEST_DR1:
+		return (&vmxctx->guest_dr1);
+	case VM_REG_GUEST_DR2:
+		return (&vmxctx->guest_dr2);
+	case VM_REG_GUEST_DR3:
+		return (&vmxctx->guest_dr3);
+	case VM_REG_GUEST_DR6:
+		return (&vmxctx->guest_dr6);
+	default:
+		break;
+	}
+	return (NULL);
+}
+
+static int
+vmxctx_getreg(struct vmxctx *vmxctx, int reg, uint64_t *retval)
+{
+	register_t *regp;
+
+	if ((regp = vmxctx_regptr(vmxctx, reg)) != NULL) {
+		*retval = *regp;
+		return (0);
+	} else
+		return (EINVAL);
+}
+
+static int
+vmxctx_setreg(struct vmxctx *vmxctx, int reg, uint64_t val)
+{
+	register_t *regp;
+
+	if ((regp = vmxctx_regptr(vmxctx, reg)) != NULL) {
+		*regp = val;
+		return (0);
+	} else
+		return (EINVAL);
+}
+
+static int
+vmx_get_intr_shadow(struct vmx *vmx, int vcpu, int running, uint64_t *retval)
+{
+	uint64_t gi;
+	int error;
+
+	error = vmcs_getreg(&vmx->vmcs[vcpu], running, 
+	    VMCS_IDENT(VMCS_GUEST_INTERRUPTIBILITY), &gi);
+	*retval = (gi & HWINTR_BLOCKING) ? 1 : 0;
+	return (error);
+}
+
+static int
+vmx_modify_intr_shadow(struct vmx *vmx, int vcpu, int running, uint64_t val)
+{
+	struct vmcs *vmcs;
+	uint64_t gi;
+	int error, ident;
+
+	/*
+	 * Forcing the vcpu into an interrupt shadow is not supported.
+	 */
+	if (val) {
+		error = EINVAL;
+		goto done;
+	}
+
+	vmcs = &vmx->vmcs[vcpu];
+	ident = VMCS_IDENT(VMCS_GUEST_INTERRUPTIBILITY);
+	error = vmcs_getreg(vmcs, running, ident, &gi);
+	if (error == 0) {
+		gi &= ~HWINTR_BLOCKING;
+		error = vmcs_setreg(vmcs, running, ident, gi);
+	}
+done:
+	VCPU_CTR2(vmx->vm, vcpu, "Setting intr_shadow to %#lx %s", val,
+	    error ? "failed" : "succeeded");
+	return (error);
+}
+
+static int
+vmx_shadow_reg(int reg)
+{
+	int shreg;
+
+	shreg = -1;
+
+	switch (reg) {
+	case VM_REG_GUEST_CR0:
+		shreg = VMCS_CR0_SHADOW;
+                break;
+        case VM_REG_GUEST_CR4:
+		shreg = VMCS_CR4_SHADOW;
+		break;
+	default:
+		break;
+	}
+
+	return (shreg);
+}
+
+static int
+vmx_getreg(void *arg, int vcpu, int reg, uint64_t *retval)
+{
+	int running, hostcpu;
+	struct vmx *vmx = arg;
+
+	running = vcpu_is_running(vmx->vm, vcpu, &hostcpu);
+	if (running && hostcpu != curcpu)
+		panic("vmx_getreg: %s%d is running", vm_name(vmx->vm), vcpu);
+
+	if (reg == VM_REG_GUEST_INTR_SHADOW)
+		return (vmx_get_intr_shadow(vmx, vcpu, running, retval));
+
+	if (vmxctx_getreg(&vmx->ctx[vcpu], reg, retval) == 0)
+		return (0);
+
+	return (vmcs_getreg(&vmx->vmcs[vcpu], running, reg, retval));
+}
+
+static int
+vmx_setreg(void *arg, int vcpu, int reg, uint64_t val)
+{
+	int error, hostcpu, running, shadow;
+	uint64_t ctls;
+	pmap_t pmap;
+	struct vmx *vmx = arg;
+
+	running = vcpu_is_running(vmx->vm, vcpu, &hostcpu);
+	if (running && hostcpu != curcpu)
+		panic("vmx_setreg: %s%d is running", vm_name(vmx->vm), vcpu);
+
+	if (reg == VM_REG_GUEST_INTR_SHADOW)
+		return (vmx_modify_intr_shadow(vmx, vcpu, running, val));
+
+	if (vmxctx_setreg(&vmx->ctx[vcpu], reg, val) == 0)
+		return (0);
+
+	error = vmcs_setreg(&vmx->vmcs[vcpu], running, reg, val);
+
+	if (error == 0) {
+		/*
+		 * If the "load EFER" VM-entry control is 1 then the
+		 * value of EFER.LMA must be identical to "IA-32e mode guest"
+		 * bit in the VM-entry control.
+		 */
+		if ((entry_ctls & VM_ENTRY_LOAD_EFER) != 0 &&
+		    (reg == VM_REG_GUEST_EFER)) {
+			vmcs_getreg(&vmx->vmcs[vcpu], running,
+				    VMCS_IDENT(VMCS_ENTRY_CTLS), &ctls);
+			if (val & EFER_LMA)
+				ctls |= VM_ENTRY_GUEST_LMA;
+			else
+				ctls &= ~VM_ENTRY_GUEST_LMA;
+			vmcs_setreg(&vmx->vmcs[vcpu], running,
+				    VMCS_IDENT(VMCS_ENTRY_CTLS), ctls);
+		}
+
+		shadow = vmx_shadow_reg(reg);
+		if (shadow > 0) {
+			/*
+			 * Store the unmodified value in the shadow
+			 */			
+			error = vmcs_setreg(&vmx->vmcs[vcpu], running,
+				    VMCS_IDENT(shadow), val);
+		}
+
+		if (reg == VM_REG_GUEST_CR3) {
+			/*
+			 * Invalidate the guest vcpu's TLB mappings to emulate
+			 * the behavior of updating %cr3.
+			 *
+			 * XXX the processor retains global mappings when %cr3
+			 * is updated but vmx_invvpid() does not.
+			 */
+			pmap = vmx->ctx[vcpu].pmap;
+			vmx_invvpid(vmx, vcpu, pmap, running);
+		}
+	}
+
+	return (error);
+}
+
+static int
+vmx_getdesc(void *arg, int vcpu, int reg, struct seg_desc *desc)
+{
+	int hostcpu, running;
+	struct vmx *vmx = arg;
+
+	running = vcpu_is_running(vmx->vm, vcpu, &hostcpu);
+	if (running && hostcpu != curcpu)
+		panic("vmx_getdesc: %s%d is running", vm_name(vmx->vm), vcpu);
+
+	return (vmcs_getdesc(&vmx->vmcs[vcpu], running, reg, desc));
+}
+
+static int
+vmx_setdesc(void *arg, int vcpu, int reg, struct seg_desc *desc)
+{
+	int hostcpu, running;
+	struct vmx *vmx = arg;
+
+	running = vcpu_is_running(vmx->vm, vcpu, &hostcpu);
+	if (running && hostcpu != curcpu)
+		panic("vmx_setdesc: %s%d is running", vm_name(vmx->vm), vcpu);
+
+	return (vmcs_setdesc(&vmx->vmcs[vcpu], running, reg, desc));
+}
+
+static int
+vmx_getcap(void *arg, int vcpu, int type, int *retval)
+{
+	struct vmx *vmx = arg;
+	int vcap;
+	int ret;
+
+	ret = ENOENT;
+
+	vcap = vmx->cap[vcpu].set;
+
+	switch (type) {
+	case VM_CAP_HALT_EXIT:
+		if (cap_halt_exit)
+			ret = 0;
+		break;
+	case VM_CAP_PAUSE_EXIT:
+		if (cap_pause_exit)
+			ret = 0;
+		break;
+	case VM_CAP_MTRAP_EXIT:
+		if (cap_monitor_trap)
+			ret = 0;
+		break;
+	case VM_CAP_UNRESTRICTED_GUEST:
+		if (cap_unrestricted_guest)
+			ret = 0;
+		break;
+	case VM_CAP_ENABLE_INVPCID:
+		if (cap_invpcid)
+			ret = 0;
+		break;
+	default:
+		break;
+	}
+
+	if (ret == 0)
+		*retval = (vcap & (1 << type)) ? 1 : 0;
+
+	return (ret);
+}
+
+static int
+vmx_setcap(void *arg, int vcpu, int type, int val)
+{
+	struct vmx *vmx = arg;
+	struct vmcs *vmcs = &vmx->vmcs[vcpu];
+	uint32_t baseval;
+	uint32_t *pptr;
+	int error;
+	int flag;
+	int reg;
+	int retval;
+
+	retval = ENOENT;
+	pptr = NULL;
+
+	switch (type) {
+	case VM_CAP_HALT_EXIT:
+		if (cap_halt_exit) {
+			retval = 0;
+			pptr = &vmx->cap[vcpu].proc_ctls;
+			baseval = *pptr;
+			flag = PROCBASED_HLT_EXITING;
+			reg = VMCS_PRI_PROC_BASED_CTLS;
+		}
+		break;
+	case VM_CAP_MTRAP_EXIT:
+		if (cap_monitor_trap) {
+			retval = 0;
+			pptr = &vmx->cap[vcpu].proc_ctls;
+			baseval = *pptr;
+			flag = PROCBASED_MTF;
+			reg = VMCS_PRI_PROC_BASED_CTLS;
+		}
+		break;
+	case VM_CAP_PAUSE_EXIT:
+		if (cap_pause_exit) {
+			retval = 0;
+			pptr = &vmx->cap[vcpu].proc_ctls;
+			baseval = *pptr;
+			flag = PROCBASED_PAUSE_EXITING;
+			reg = VMCS_PRI_PROC_BASED_CTLS;
+		}
+		break;
+	case VM_CAP_UNRESTRICTED_GUEST:
+		if (cap_unrestricted_guest) {
+			retval = 0;
+			pptr = &vmx->cap[vcpu].proc_ctls2;
+			baseval = *pptr;
+			flag = PROCBASED2_UNRESTRICTED_GUEST;
+			reg = VMCS_SEC_PROC_BASED_CTLS;
+		}
+		break;
+	case VM_CAP_ENABLE_INVPCID:
+		if (cap_invpcid) {
+			retval = 0;
+			pptr = &vmx->cap[vcpu].proc_ctls2;
+			baseval = *pptr;
+			flag = PROCBASED2_ENABLE_INVPCID;
+			reg = VMCS_SEC_PROC_BASED_CTLS;
+		}
+		break;
+	default:
+		break;
+	}
+
+	if (retval == 0) {
+		if (val) {
+			baseval |= flag;
+		} else {
+			baseval &= ~flag;
+		}
+		VMPTRLD(vmcs);
+		error = vmwrite(reg, baseval);
+		VMCLEAR(vmcs);
+
+		if (error) {
+			retval = error;
+		} else {
+			/*
+			 * Update optional stored flags, and record
+			 * setting
+			 */
+			if (pptr != NULL) {
+				*pptr = baseval;
+			}
+
+			if (val) {
+				vmx->cap[vcpu].set |= (1 << type);
+			} else {
+				vmx->cap[vcpu].set &= ~(1 << type);
+			}
+		}
+	}
+
+        return (retval);
+}
+
+struct vlapic_vtx {
+	struct vlapic	vlapic;
+	struct pir_desc	*pir_desc;
+	struct vmx	*vmx;
+};
+
+#define	VMX_CTR_PIR(vm, vcpuid, pir_desc, notify, vector, level, msg)	\
+do {									\
+	VCPU_CTR2(vm, vcpuid, msg " assert %s-triggered vector %d",	\
+	    level ? "level" : "edge", vector);				\
+	VCPU_CTR1(vm, vcpuid, msg " pir0 0x%016lx", pir_desc->pir[0]);	\
+	VCPU_CTR1(vm, vcpuid, msg " pir1 0x%016lx", pir_desc->pir[1]);	\
+	VCPU_CTR1(vm, vcpuid, msg " pir2 0x%016lx", pir_desc->pir[2]);	\
+	VCPU_CTR1(vm, vcpuid, msg " pir3 0x%016lx", pir_desc->pir[3]);	\
+	VCPU_CTR1(vm, vcpuid, msg " notify: %s", notify ? "yes" : "no");\
+} while (0)
+
+/*
+ * The least significant bit in the 'pending' field of the PIR descriptor
+ * indicates to the CPU that interrupts are pending in the 'pir' fields.
+ */
+#define	PIR_MASK_PENDING	0x1
+
+/*
+ * vlapic->ops handlers that utilize the APICv hardware assist described in
+ * Chapter 29 of the Intel SDM.
+ */
+static int
+vmx_set_intr_ready(struct vlapic *vlapic, int vector, bool level)
+{
+	struct vlapic_vtx *vlapic_vtx;
+	struct pir_desc *pir_desc;
+	uint64_t mask, old;
+	int idx, notify;
+	const uint_t prio = (vector & 0xf0) >> 4;
+	const uint64_t prio_mask = (1 << prio) | PIR_MASK_PENDING;
+
+#ifndef __FreeBSD__
+	ASSERT(vector >= 0x10 && vector <= 0xff);
+#endif
+
+	vlapic_vtx = (struct vlapic_vtx *)vlapic;
+	pir_desc = vlapic_vtx->pir_desc;
+
+	/*
+	 * Keep track of interrupt requests in the PIR descriptor. This is
+	 * because the virtual APIC page pointed to by the VMCS cannot be
+	 * modified if the vcpu is running.
+	 */
+	idx = vector / 64;
+	mask = 1UL << (vector % 64);
+	atomic_set_long(&pir_desc->pir[idx], mask);
+
+	/*
+	 * Deciding if vCPU notification is required when using PIR is
+	 * complicated by interrupt priorities.  It is not enough to simply
+	 * notify when 'pending' makes the 0->1 transition.  If an interrupt
+	 * with a higher priority class than those already present is queued,
+	 * its arrival necessitates a notification in case the vCPU is blocked
+	 * in HLT with a PPR higher than the existing interrupts.
+	 *
+	 * The priority classes of pending interrupts is cached as a bitfield
+	 * in the higher order bits of the 'pending' field of pir_desc.  The
+	 * Intel manual states those bits are reserved for software and we are
+	 * free to use them.
+	 *
+	 * Those priority bits will be left unchanged, becoming effectively
+	 * stale, when the CPU delivers the posted interrupts to the guest and
+	 * clears the 'pending' bit.  The presence of those stale bits is
+	 * harmless when the CPU is in guest context, since 0->1 transitions of
+	 * the 'pending' bit ensure reliable notifications.  They are cleared
+	 * by vmx_flush_pir_prio() prior to leaving vmx_run(), since accurate
+	 * priority information is necessary to prevent eliding necessary
+	 * wake-ups.
+	 *
+	 * When vmx_inject_pir() is called to inject any interrupts which were
+	 * posted while the CPU was outside VMX context, it will also clear the
+	 * priority bitfield as part of querying the 'pending' field.
+	 */
+	old = pir_desc->pending;
+	if (atomic_cmpset_long(&pir_desc->pending, old, old | prio_mask) != 0) {
+		/*
+		 * If there was no race in updating the pending field
+		 * (including the priority bitfield), then a notification is
+		 * only needed if the incoming priority class is higher than
+		 * any existing ones.
+		 *
+		 * This will also cover the case where the 'pending' bit has
+		 * been cleared by the CPU as it delivered interrupts posted in
+		 * the structure.
+		 */
+		notify = ((old & PIR_MASK_PENDING) == 0 || prio_mask > old);
+	} else {
+		/*
+		 * In the case of racing updates to the pending field, the
+		 * priority and pending bit are atomically set and the
+		 * notification is unconditionally requested.
+		 */
+		atomic_set_long(&pir_desc->pending, prio_mask);
+		notify = 1;
+	}
+
+	VMX_CTR_PIR(vlapic->vm, vlapic->vcpuid, pir_desc, notify, vector,
+	    level, "vmx_set_intr_ready");
+	return (notify);
+}
+
+static int
+vmx_pending_intr(struct vlapic *vlapic, int *vecptr)
+{
+	struct vlapic_vtx *vlapic_vtx;
+	struct pir_desc *pir_desc;
+	struct LAPIC *lapic;
+	uint64_t pending, pirval;
+	uint32_t ppr, vpr;
+	int i;
+
+	/*
+	 * This function is only expected to be called from the 'HLT' exit
+	 * handler which does not care about the vector that is pending.
+	 */
+	KASSERT(vecptr == NULL, ("vmx_pending_intr: vecptr must be NULL"));
+
+	vlapic_vtx = (struct vlapic_vtx *)vlapic;
+	pir_desc = vlapic_vtx->pir_desc;
+
+	pending = pir_desc->pending;
+	if ((pending & PIR_MASK_PENDING) == 0) {
+		/*
+		 * While a virtual interrupt may have already been
+		 * processed the actual delivery maybe pending the
+		 * interruptibility of the guest.  Recognize a pending
+		 * interrupt by reevaluating virtual interrupts
+		 * following Section 29.2.1 in the Intel SDM Volume 3.
+		 */
+		struct vm_exit *vmexit;
+		uint8_t rvi, ppr;
+
+		vmexit = vm_exitinfo(vlapic->vm, vlapic->vcpuid);
+		rvi = vmexit->u.hlt.intr_status & APIC_TPR_INT;
+		lapic = vlapic->apic_page;
+		ppr = lapic->ppr & APIC_TPR_INT;
+		if (rvi > ppr) {
+			return (1);
+		}
+
+		return (0);
+	}
+
+	/*
+	 * If there is an interrupt pending then it will be recognized only
+	 * if its priority is greater than the processor priority.
+	 *
+	 * Special case: if the processor priority is zero then any pending
+	 * interrupt will be recognized.
+	 */
+	lapic = vlapic->apic_page;
+	ppr = lapic->ppr & APIC_TPR_INT;
+	if (ppr == 0)
+		return (1);
+
+	VCPU_CTR1(vlapic->vm, vlapic->vcpuid, "HLT with non-zero PPR %d",
+	    lapic->ppr);
+
+	for (i = 3; i >= 0; i--) {
+		pirval = pir_desc->pir[i];
+		if (pirval != 0) {
+			vpr = (i * 64 + flsl(pirval) - 1) & APIC_TPR_INT;
+			return (vpr > ppr);
+		}
+	}
+	return (0);
+}
+
+static void
+vmx_intr_accepted(struct vlapic *vlapic, int vector)
+{
+
+	panic("vmx_intr_accepted: not expected to be called");
+}
+
+static void
+vmx_set_tmr(struct vlapic *vlapic, int vector, bool level)
+{
+	struct vlapic_vtx *vlapic_vtx;
+	struct vmx *vmx;
+	struct vmcs *vmcs;
+	uint64_t mask, val;
+
+	KASSERT(vector >= 0 && vector <= 255, ("invalid vector %d", vector));
+	KASSERT(!vcpu_is_running(vlapic->vm, vlapic->vcpuid, NULL),
+	    ("vmx_set_tmr: vcpu cannot be running"));
+
+	vlapic_vtx = (struct vlapic_vtx *)vlapic;
+	vmx = vlapic_vtx->vmx;
+	vmcs = &vmx->vmcs[vlapic->vcpuid];
+	mask = 1UL << (vector % 64);
+
+	VMPTRLD(vmcs);
+	val = vmcs_read(VMCS_EOI_EXIT(vector));
+	if (level)
+		val |= mask;
+	else
+		val &= ~mask;
+	vmcs_write(VMCS_EOI_EXIT(vector), val);
+	VMCLEAR(vmcs);
+}
+
+static void
+vmx_enable_x2apic_mode(struct vlapic *vlapic)
+{
+	struct vmx *vmx;
+	struct vmcs *vmcs;
+	uint32_t proc_ctls2;
+	int vcpuid, error;
+
+	vcpuid = vlapic->vcpuid;
+	vmx = ((struct vlapic_vtx *)vlapic)->vmx;
+	vmcs = &vmx->vmcs[vcpuid];
+
+	proc_ctls2 = vmx->cap[vcpuid].proc_ctls2;
+	KASSERT((proc_ctls2 & PROCBASED2_VIRTUALIZE_APIC_ACCESSES) != 0,
+	    ("%s: invalid proc_ctls2 %#x", __func__, proc_ctls2));
+
+	proc_ctls2 &= ~PROCBASED2_VIRTUALIZE_APIC_ACCESSES;
+	proc_ctls2 |= PROCBASED2_VIRTUALIZE_X2APIC_MODE;
+	vmx->cap[vcpuid].proc_ctls2 = proc_ctls2;
+
+	VMPTRLD(vmcs);
+	vmcs_write(VMCS_SEC_PROC_BASED_CTLS, proc_ctls2);
+	VMCLEAR(vmcs);
+
+	if (vlapic->vcpuid == 0) {
+		/*
+		 * The nested page table mappings are shared by all vcpus
+		 * so unmap the APIC access page just once.
+		 */
+		error = vm_unmap_mmio(vmx->vm, DEFAULT_APIC_BASE, PAGE_SIZE);
+		KASSERT(error == 0, ("%s: vm_unmap_mmio error %d",
+		    __func__, error));
+
+		/*
+		 * The MSR bitmap is shared by all vcpus so modify it only
+		 * once in the context of vcpu 0.
+		 */
+		error = vmx_allow_x2apic_msrs(vmx);
+		KASSERT(error == 0, ("%s: vmx_allow_x2apic_msrs error %d",
+		    __func__, error));
+	}
+}
+
+static void
+vmx_post_intr(struct vlapic *vlapic, int hostcpu)
+{
+#ifdef __FreeBSD__
+	ipi_cpu(hostcpu, pirvec);
+#else
+	psm_send_pir_ipi(hostcpu);
+#endif
+}
+
+/*
+ * Transfer the pending interrupts in the PIR descriptor to the IRR
+ * in the virtual APIC page.
+ */
+static void
+vmx_inject_pir(struct vlapic *vlapic)
+{
+	struct vlapic_vtx *vlapic_vtx;
+	struct pir_desc *pir_desc;
+	struct LAPIC *lapic;
+	uint64_t val, pirval, pending;
+	int rvi, pirbase = -1;
+	uint16_t intr_status_old, intr_status_new;
+
+	vlapic_vtx = (struct vlapic_vtx *)vlapic;
+	pir_desc = vlapic_vtx->pir_desc;
+
+	pending = atomic_readandclear_long(&pir_desc->pending);
+	if ((pending & PIR_MASK_PENDING) == 0) {
+		VCPU_CTR0(vlapic->vm, vlapic->vcpuid, "vmx_inject_pir: "
+		    "no posted interrupt pending");
+		return;
+	}
+
+	pirval = 0;
+	pirbase = -1;
+	lapic = vlapic->apic_page;
+
+	val = atomic_readandclear_long(&pir_desc->pir[0]);
+	if (val != 0) {
+		lapic->irr0 |= val;
+		lapic->irr1 |= val >> 32;
+		pirbase = 0;
+		pirval = val;
+	}
+
+	val = atomic_readandclear_long(&pir_desc->pir[1]);
+	if (val != 0) {
+		lapic->irr2 |= val;
+		lapic->irr3 |= val >> 32;
+		pirbase = 64;
+		pirval = val;
+	}
+
+	val = atomic_readandclear_long(&pir_desc->pir[2]);
+	if (val != 0) {
+		lapic->irr4 |= val;
+		lapic->irr5 |= val >> 32;
+		pirbase = 128;
+		pirval = val;
+	}
+
+	val = atomic_readandclear_long(&pir_desc->pir[3]);
+	if (val != 0) {
+		lapic->irr6 |= val;
+		lapic->irr7 |= val >> 32;
+		pirbase = 192;
+		pirval = val;
+	}
+
+	VLAPIC_CTR_IRR(vlapic, "vmx_inject_pir");
+
+	/*
+	 * Update RVI so the processor can evaluate pending virtual
+	 * interrupts on VM-entry.
+	 *
+	 * It is possible for pirval to be 0 here, even though the
+	 * pending bit has been set. The scenario is:
+	 * CPU-Y is sending a posted interrupt to CPU-X, which
+	 * is running a guest and processing posted interrupts in h/w.
+	 * CPU-X will eventually exit and the state seen in s/w is
+	 * the pending bit set, but no PIR bits set.
+	 *
+	 *      CPU-X                      CPU-Y
+	 *   (vm running)                (host running)
+	 *   rx posted interrupt
+	 *   CLEAR pending bit
+	 *				 SET PIR bit
+	 *   READ/CLEAR PIR bits
+	 *				 SET pending bit
+	 *   (vm exit)
+	 *   pending bit set, PIR 0
+	 */
+	if (pirval != 0) {
+		rvi = pirbase + flsl(pirval) - 1;
+		intr_status_old = vmcs_read(VMCS_GUEST_INTR_STATUS);
+		intr_status_new = (intr_status_old & 0xFF00) | rvi;
+		if (intr_status_new > intr_status_old) {
+			vmcs_write(VMCS_GUEST_INTR_STATUS, intr_status_new);
+			VCPU_CTR2(vlapic->vm, vlapic->vcpuid, "vmx_inject_pir: "
+			    "guest_intr_status changed from 0x%04x to 0x%04x",
+			    intr_status_old, intr_status_new);
+		}
+	}
+}
+
+static void
+vmx_flush_pir_prio(struct vlapic *vlapic)
+{
+	struct vlapic_vtx *vlapic_vtx;
+	struct pir_desc *pir_desc;
+
+	vlapic_vtx = (struct vlapic_vtx *)vlapic;
+	pir_desc = vlapic_vtx->pir_desc;
+
+	/*
+	 * Clear all the reserved bits caching interrupt priority, leaving the
+	 * 'pending' bit, from the PIR descriptor.  Stale priority bits
+	 * representing interrupts which were posted to the guest while in the
+	 * VMX context must be cleared to ensure that priority-conditional
+	 * interrupt notification occurs properly until another VMX entry is
+	 * made.
+	 */
+	atomic_clear_long(&pir_desc->pending, ~PIR_MASK_PENDING);
+}
+
+static struct vlapic *
+vmx_vlapic_init(void *arg, int vcpuid)
+{
+	struct vmx *vmx;
+	struct vlapic *vlapic;
+	struct vlapic_vtx *vlapic_vtx;
+	
+	vmx = arg;
+
+	vlapic = malloc(sizeof(struct vlapic_vtx), M_VLAPIC, M_WAITOK | M_ZERO);
+	vlapic->vm = vmx->vm;
+	vlapic->vcpuid = vcpuid;
+	vlapic->apic_page = (struct LAPIC *)&vmx->apic_page[vcpuid];
+
+	vlapic_vtx = (struct vlapic_vtx *)vlapic;
+	vlapic_vtx->pir_desc = &vmx->pir_desc[vcpuid];
+	vlapic_vtx->vmx = vmx;
+
+	if (virtual_interrupt_delivery) {
+		vlapic->ops.set_intr_ready = vmx_set_intr_ready;
+		vlapic->ops.pending_intr = vmx_pending_intr;
+		vlapic->ops.intr_accepted = vmx_intr_accepted;
+		vlapic->ops.set_tmr = vmx_set_tmr;
+		vlapic->ops.enable_x2apic_mode = vmx_enable_x2apic_mode;
+	}
+
+	if (posted_interrupts)
+		vlapic->ops.post_intr = vmx_post_intr;
+
+	vlapic_init(vlapic);
+
+	return (vlapic);
+}
+
+static void
+vmx_vlapic_cleanup(void *arg, struct vlapic *vlapic)
+{
+
+	vlapic_cleanup(vlapic);
+	free(vlapic, M_VLAPIC);
+}
+
+#ifndef __FreeBSD__
+static void
+vmx_savectx(void *arg, int vcpu)
+{
+	struct vmx *vmx = arg;
+	struct vmcs *vmcs = &vmx->vmcs[vcpu];
+
+	if (vmx->ctx_loaded[vcpu]) {
+		VERIFY3U(vmclear(vmcs), ==, 0);
+		vmx_msr_guest_exit(vmx, vcpu);
+	}
+
+	reset_gdtr_limit();
+}
+
+static void
+vmx_restorectx(void *arg, int vcpu)
+{
+	struct vmx *vmx = arg;
+	struct vmcs *vmcs = &vmx->vmcs[vcpu];
+
+	if (vmx->ctx_loaded[vcpu]) {
+		vmx_msr_guest_enter(vmx, vcpu);
+		VERIFY3U(vmptrld(vmcs), ==, 0);
+	}
+}
+#endif /* __FreeBSD__ */
+
+struct vmm_ops vmm_ops_intel = {
+	vmx_init,
+	vmx_cleanup,
+	vmx_restore,
+	vmx_vminit,
+	vmx_run,
+	vmx_vmcleanup,
+	vmx_getreg,
+	vmx_setreg,
+	vmx_getdesc,
+	vmx_setdesc,
+	vmx_getcap,
+	vmx_setcap,
+	ept_vmspace_alloc,
+	ept_vmspace_free,
+	vmx_vlapic_init,
+	vmx_vlapic_cleanup,
+
+#ifndef __FreeBSD__
+	vmx_savectx,
+	vmx_restorectx,
+#endif
+};
+
+#ifndef __FreeBSD__
+/* Side-effect free HW validation derived from checks in vmx_init. */
+int
+vmx_x86_supported(char **msg)
+{
+	int error;
+	uint64_t basic, feature_control;
+	uint32_t tmp;
+
+	if (!is_x86_feature(x86_featureset, X86FSET_VMX)) {
+		*msg = "processor does not support VMX operation";
+		return (ENXIO);
+	}
+
+	/*
+	 * Verify that MSR_IA32_FEATURE_CONTROL lock and VMXON enable bits
+	 * are set (bits 0 and 2 respectively).
+	 */
+	feature_control = rdmsr(MSR_IA32_FEATURE_CONTROL);
+	if ((feature_control & IA32_FEATURE_CONTROL_LOCK) == 1 &&
+	    (feature_control & IA32_FEATURE_CONTROL_VMX_EN) == 0) {
+		*msg = "VMX operation disabled by BIOS";
+		return (ENXIO);
+	}
+
+	/*
+	 * Verify capabilities MSR_VMX_BASIC:
+	 * - bit 54 indicates support for INS/OUTS decoding
+	 */
+	basic = rdmsr(MSR_VMX_BASIC);
+	if ((basic & (1UL << 54)) == 0) {
+		*msg = "processor does not support desired basic capabilities";
+		return (EINVAL);
+	}
+
+	/* Check support for primary processor-based VM-execution controls */
+	error = vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS,
+	    MSR_VMX_TRUE_PROCBASED_CTLS, PROCBASED_CTLS_ONE_SETTING,
+	    PROCBASED_CTLS_ZERO_SETTING, &tmp);
+	if (error) {
+		*msg = "processor does not support desired primary "
+		    "processor-based controls";
+		return (error);
+	}
+
+	/* Check support for secondary processor-based VM-execution controls */
+	error = vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS2,
+	    MSR_VMX_PROCBASED_CTLS2, PROCBASED_CTLS2_ONE_SETTING,
+	    PROCBASED_CTLS2_ZERO_SETTING, &tmp);
+	if (error) {
+		*msg = "processor does not support desired secondary "
+		    "processor-based controls";
+		return (error);
+	}
+
+	/* Check support for pin-based VM-execution controls */
+	error = vmx_set_ctlreg(MSR_VMX_PINBASED_CTLS,
+	    MSR_VMX_TRUE_PINBASED_CTLS, PINBASED_CTLS_ONE_SETTING,
+	    PINBASED_CTLS_ZERO_SETTING, &tmp);
+	if (error) {
+		*msg = "processor does not support desired pin-based controls";
+		return (error);
+	}
+
+	/* Check support for VM-exit controls */
+	error = vmx_set_ctlreg(MSR_VMX_EXIT_CTLS, MSR_VMX_TRUE_EXIT_CTLS,
+	    VM_EXIT_CTLS_ONE_SETTING, VM_EXIT_CTLS_ZERO_SETTING, &tmp);
+	if (error) {
+		*msg = "processor does not support desired exit controls";
+		return (error);
+	}
+
+	/* Check support for VM-entry controls */
+	error = vmx_set_ctlreg(MSR_VMX_ENTRY_CTLS, MSR_VMX_TRUE_ENTRY_CTLS,
+	    VM_ENTRY_CTLS_ONE_SETTING, VM_ENTRY_CTLS_ZERO_SETTING, &tmp);
+	if (error) {
+		*msg = "processor does not support desired entry controls";
+		return (error);
+	}
+
+	/* Unrestricted guest is nominally optional, but not for us. */
+	error = vmx_set_ctlreg(MSR_VMX_PROCBASED_CTLS2, MSR_VMX_PROCBASED_CTLS2,
+	    PROCBASED2_UNRESTRICTED_GUEST, 0, &tmp);
+	if (error) {
+		*msg = "processor does not support desired unrestricted guest "
+		    "controls";
+		return (error);
+	}
+
+	return (0);
+}
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmx.h b/usr/src/uts/i86pc/io/vmm/intel/vmx.h
new file mode 100644
index 0000000000..0ee83fcc81
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmx.h
@@ -0,0 +1,168 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _VMX_H_
+#define	_VMX_H_
+
+#include "vmcs.h"
+
+struct pmap;
+
+struct vmxctx {
+	register_t	guest_rdi;		/* Guest state */
+	register_t	guest_rsi;
+	register_t	guest_rdx;
+	register_t	guest_rcx;
+	register_t	guest_r8;
+	register_t	guest_r9;
+	register_t	guest_rax;
+	register_t	guest_rbx;
+	register_t	guest_rbp;
+	register_t	guest_r10;
+	register_t	guest_r11;
+	register_t	guest_r12;
+	register_t	guest_r13;
+	register_t	guest_r14;
+	register_t	guest_r15;
+	register_t	guest_cr2;
+	register_t	guest_dr0;
+	register_t	guest_dr1;
+	register_t	guest_dr2;
+	register_t	guest_dr3;
+	register_t	guest_dr6;
+
+#ifdef __FreeBSD__
+	register_t	host_r15;		/* Host state */
+	register_t	host_r14;
+	register_t	host_r13;
+	register_t	host_r12;
+	register_t	host_rbp;
+	register_t	host_rsp;
+	register_t	host_rbx;
+#endif /* __FreeBSD__ */
+
+	register_t	host_dr0;
+	register_t	host_dr1;
+	register_t	host_dr2;
+	register_t	host_dr3;
+	register_t	host_dr6;
+	register_t	host_dr7;
+	uint64_t	host_debugctl;
+	int		host_tf;
+
+	int		inst_fail_status;
+
+	/*
+	 * The pmap needs to be deactivated in vmx_enter_guest()
+	 * so keep a copy of the 'pmap' in each vmxctx.
+	 */
+	struct pmap	*pmap;
+};
+
+struct vmxcap {
+	int	set;
+	uint32_t proc_ctls;
+	uint32_t proc_ctls2;
+};
+
+struct vmxstate {
+	uint64_t nextrip;	/* next instruction to be executed by guest */
+	int	lastcpu;	/* host cpu that this 'vcpu' last ran on */
+	uint16_t vpid;
+};
+
+struct apic_page {
+	uint32_t reg[PAGE_SIZE / 4];
+};
+CTASSERT(sizeof(struct apic_page) == PAGE_SIZE);
+
+/* Posted Interrupt Descriptor (described in section 29.6 of the Intel SDM) */
+struct pir_desc {
+	uint64_t	pir[4];
+	uint64_t	pending;
+	uint64_t	unused[3];
+} __aligned(64);
+CTASSERT(sizeof(struct pir_desc) == 64);
+
+/* Index into the 'guest_msrs[]' array */
+enum {
+	IDX_MSR_LSTAR,
+	IDX_MSR_CSTAR,
+	IDX_MSR_STAR,
+	IDX_MSR_SF_MASK,
+	IDX_MSR_KGSBASE,
+	IDX_MSR_PAT,
+	GUEST_MSR_NUM		/* must be the last enumeration */
+};
+
+/* virtual machine softc */
+struct vmx {
+	struct vmcs	vmcs[VM_MAXCPU];	/* one vmcs per virtual cpu */
+	struct apic_page apic_page[VM_MAXCPU];	/* one apic page per vcpu */
+	char		msr_bitmap[PAGE_SIZE];
+	struct pir_desc	pir_desc[VM_MAXCPU];
+	uint64_t	guest_msrs[VM_MAXCPU][GUEST_MSR_NUM];
+#ifndef	__FreeBSD__
+	uint64_t	host_msrs[VM_MAXCPU][GUEST_MSR_NUM];
+	uint64_t	tsc_offset_active[VM_MAXCPU];
+	boolean_t	ctx_loaded[VM_MAXCPU];
+#endif
+	struct vmxctx	ctx[VM_MAXCPU];
+	struct vmxcap	cap[VM_MAXCPU];
+	struct vmxstate	state[VM_MAXCPU];
+	uint64_t	eptp;
+	struct vm	*vm;
+	long		eptgen[MAXCPU];		/* cached pmap->pm_eptgen */
+};
+CTASSERT((offsetof(struct vmx, vmcs) & PAGE_MASK) == 0);
+CTASSERT((offsetof(struct vmx, msr_bitmap) & PAGE_MASK) == 0);
+CTASSERT((offsetof(struct vmx, pir_desc[0]) & 63) == 0);
+
+#define	VMX_GUEST_VMEXIT	0
+#define	VMX_VMRESUME_ERROR	1
+#define	VMX_VMLAUNCH_ERROR	2
+#define	VMX_INVEPT_ERROR	3
+#define	VMX_VMWRITE_ERROR	4
+int	vmx_enter_guest(struct vmxctx *ctx, struct vmx *vmx, int launched);
+void	vmx_call_isr(uintptr_t entry);
+
+u_long	vmx_fix_cr0(u_long cr0);
+u_long	vmx_fix_cr4(u_long cr4);
+
+int	vmx_set_tsc_offset(struct vmx *vmx, int vcpu, uint64_t offset);
+
+extern char	vmx_exit_guest[];
+extern char	vmx_exit_guest_flush_rsb[];
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmx_controls.h b/usr/src/uts/i86pc/io/vmm/intel/vmx_controls.h
new file mode 100644
index 0000000000..5408d129ad
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmx_controls.h
@@ -0,0 +1,98 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VMX_CONTROLS_H_
+#define	_VMX_CONTROLS_H_
+
+/* Pin-Based VM-Execution Controls */
+#define	PINBASED_EXTINT_EXITING		(1 << 0)
+#define	PINBASED_NMI_EXITING		(1 << 3)
+#define	PINBASED_VIRTUAL_NMI		(1 << 5)
+#define	PINBASED_PREMPTION_TIMER	(1 << 6)
+#define	PINBASED_POSTED_INTERRUPT	(1 << 7)
+
+/* Primary Processor-Based VM-Execution Controls */
+#define	PROCBASED_INT_WINDOW_EXITING	(1 << 2)
+#define	PROCBASED_TSC_OFFSET		(1 << 3)
+#define	PROCBASED_HLT_EXITING		(1 << 7)
+#define	PROCBASED_INVLPG_EXITING	(1 << 9)
+#define	PROCBASED_MWAIT_EXITING		(1 << 10)
+#define	PROCBASED_RDPMC_EXITING		(1 << 11)
+#define	PROCBASED_RDTSC_EXITING		(1 << 12)
+#define	PROCBASED_CR3_LOAD_EXITING	(1 << 15)
+#define	PROCBASED_CR3_STORE_EXITING	(1 << 16)
+#define	PROCBASED_CR8_LOAD_EXITING	(1 << 19)
+#define	PROCBASED_CR8_STORE_EXITING	(1 << 20)
+#define	PROCBASED_USE_TPR_SHADOW	(1 << 21)
+#define	PROCBASED_NMI_WINDOW_EXITING	(1 << 22)
+#define PROCBASED_MOV_DR_EXITING	(1 << 23)
+#define	PROCBASED_IO_EXITING		(1 << 24)
+#define	PROCBASED_IO_BITMAPS		(1 << 25)
+#define	PROCBASED_MTF			(1 << 27)
+#define	PROCBASED_MSR_BITMAPS		(1 << 28)
+#define	PROCBASED_MONITOR_EXITING	(1 << 29)
+#define	PROCBASED_PAUSE_EXITING		(1 << 30)
+#define	PROCBASED_SECONDARY_CONTROLS	(1U << 31)
+
+/* Secondary Processor-Based VM-Execution Controls */
+#define	PROCBASED2_VIRTUALIZE_APIC_ACCESSES	(1 << 0)
+#define	PROCBASED2_ENABLE_EPT			(1 << 1)
+#define	PROCBASED2_DESC_TABLE_EXITING		(1 << 2)
+#define	PROCBASED2_ENABLE_RDTSCP		(1 << 3)
+#define	PROCBASED2_VIRTUALIZE_X2APIC_MODE	(1 << 4)
+#define	PROCBASED2_ENABLE_VPID			(1 << 5)
+#define	PROCBASED2_WBINVD_EXITING		(1 << 6)
+#define	PROCBASED2_UNRESTRICTED_GUEST		(1 << 7)
+#define	PROCBASED2_APIC_REGISTER_VIRTUALIZATION	(1 << 8)
+#define	PROCBASED2_VIRTUAL_INTERRUPT_DELIVERY	(1 << 9)
+#define	PROCBASED2_PAUSE_LOOP_EXITING		(1 << 10)
+#define	PROCBASED2_ENABLE_INVPCID		(1 << 12)
+
+/* VM Exit Controls */
+#define	VM_EXIT_SAVE_DEBUG_CONTROLS	(1 << 2)
+#define	VM_EXIT_HOST_LMA		(1 << 9)
+#define	VM_EXIT_LOAD_PERF_GLOBAL_CTRL	(1 << 12)
+#define	VM_EXIT_ACKNOWLEDGE_INTERRUPT	(1 << 15)
+#define	VM_EXIT_SAVE_PAT		(1 << 18)
+#define	VM_EXIT_LOAD_PAT		(1 << 19)
+#define	VM_EXIT_SAVE_EFER		(1 << 20)
+#define	VM_EXIT_LOAD_EFER		(1 << 21)
+#define	VM_EXIT_SAVE_PREEMPTION_TIMER	(1 << 22)
+
+/* VM Entry Controls */
+#define	VM_ENTRY_LOAD_DEBUG_CONTROLS	(1 << 2)
+#define	VM_ENTRY_GUEST_LMA		(1 << 9)
+#define	VM_ENTRY_INTO_SMM		(1 << 10)
+#define	VM_ENTRY_DEACTIVATE_DUAL_MONITOR (1 << 11)
+#define	VM_ENTRY_LOAD_PERF_GLOBAL_CTRL	(1 << 13)
+#define	VM_ENTRY_LOAD_PAT		(1 << 14)
+#define	VM_ENTRY_LOAD_EFER		(1 << 15)
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmx_cpufunc.h b/usr/src/uts/i86pc/io/vmm/intel/vmx_cpufunc.h
new file mode 100644
index 0000000000..f0c5ba7691
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmx_cpufunc.h
@@ -0,0 +1,244 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef	_VMX_CPUFUNC_H_
+#define	_VMX_CPUFUNC_H_
+
+struct vmcs;
+
+/*
+ * Section 5.2 "Conventions" from Intel Architecture Manual 2B.
+ *
+ *			error
+ * VMsucceed		  0
+ * VMFailInvalid	  1
+ * VMFailValid		  2	see also VMCS VM-Instruction Error Field
+ */
+#define	VM_SUCCESS		0
+#define	VM_FAIL_INVALID		1
+#define	VM_FAIL_VALID		2
+#define	VMX_SET_ERROR_CODE \
+	"	jnc 1f;"						\
+	"	mov $1, %[error];"	/* CF: error = 1 */		\
+	"	jmp 3f;"						\
+	"1:	jnz 2f;"						\
+	"	mov $2, %[error];"	/* ZF: error = 2 */		\
+	"	jmp 3f;"						\
+	"2:	mov $0, %[error];"					\
+	"3:"
+
+/* returns 0 on success and non-zero on failure */
+static __inline int
+vmxon(char *region)
+{
+	int error;
+	uint64_t addr;
+
+#ifdef __FreeBSD__
+	addr = vtophys(region);
+#else
+	/* This is pre-translated in illumos */
+	addr = (uint64_t)region;
+#endif
+	__asm __volatile("vmxon %[addr];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [addr] "m" (*(uint64_t *)&addr)
+			 : "memory");
+
+	return (error);
+}
+
+#ifdef __FreeBSD__
+/* returns 0 on success and non-zero on failure */
+static __inline int
+vmclear(struct vmcs *vmcs)
+{
+	int error;
+	uint64_t addr;
+
+	addr = vtophys(vmcs);
+	__asm __volatile("vmclear %[addr];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [addr] "m" (*(uint64_t *)&addr)
+			 : "memory");
+	return (error);
+}
+#endif /* __FreeBSD__ */
+
+static __inline void
+vmxoff(void)
+{
+
+	__asm __volatile("vmxoff");
+}
+
+static __inline void
+vmptrst(uint64_t *addr)
+{
+
+	__asm __volatile("vmptrst %[addr]" :: [addr]"m" (*addr) : "memory");
+}
+
+#ifdef __FreeBSD__
+static __inline int
+vmptrld(struct vmcs *vmcs)
+{
+	int error;
+	uint64_t addr;
+
+	addr = vtophys(vmcs);
+	__asm __volatile("vmptrld %[addr];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [addr] "m" (*(uint64_t *)&addr)
+			 : "memory");
+	return (error);
+}
+#endif /* __FreeBSD__ */
+
+static __inline int
+vmwrite(uint64_t reg, uint64_t val)
+{
+	int error;
+
+	__asm __volatile("vmwrite %[val], %[reg];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [val] "r" (val), [reg] "r" (reg)
+			 : "memory");
+
+	return (error);
+}
+
+static __inline int
+vmread(uint64_t r, uint64_t *addr)
+{
+	int error;
+
+	__asm __volatile("vmread %[r], %[addr];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [r] "r" (r), [addr] "m" (*addr)
+			 : "memory");
+
+	return (error);
+}
+
+#ifdef __FreeBSD__
+static __inline void
+VMCLEAR(struct vmcs *vmcs)
+{
+	int err;
+
+	err = vmclear(vmcs);
+	if (err != 0)
+		panic("%s: vmclear(%p) error %d", __func__, vmcs, err);
+
+	critical_exit();
+}
+
+static __inline void
+VMPTRLD(struct vmcs *vmcs)
+{
+	int err;
+
+	critical_enter();
+
+	err = vmptrld(vmcs);
+	if (err != 0)
+		panic("%s: vmptrld(%p) error %d", __func__, vmcs, err);
+}
+#endif /* __FreeBSD__ */
+
+#define	INVVPID_TYPE_ADDRESS		0UL
+#define	INVVPID_TYPE_SINGLE_CONTEXT	1UL
+#define	INVVPID_TYPE_ALL_CONTEXTS	2UL
+
+struct invvpid_desc {
+	uint16_t	vpid;
+	uint16_t	_res1;
+	uint32_t	_res2;
+	uint64_t	linear_addr;
+};
+CTASSERT(sizeof(struct invvpid_desc) == 16);
+
+static __inline void
+invvpid(uint64_t type, struct invvpid_desc desc)
+{
+	int error;
+
+	__asm __volatile("invvpid %[desc], %[type];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [desc] "m" (desc), [type] "r" (type)
+			 : "memory");
+
+	if (error)
+		panic("invvpid error %d", error);
+}
+
+#define	INVEPT_TYPE_SINGLE_CONTEXT	1UL
+#define	INVEPT_TYPE_ALL_CONTEXTS	2UL
+struct invept_desc {
+	uint64_t	eptp;
+	uint64_t	_res;
+};
+CTASSERT(sizeof(struct invept_desc) == 16);
+
+static __inline void
+invept(uint64_t type, struct invept_desc desc)
+{
+	int error;
+
+	__asm __volatile("invept %[desc], %[type];"
+			 VMX_SET_ERROR_CODE
+			 : [error] "=r" (error)
+			 : [desc] "m" (desc), [type] "r" (type)
+			 : "memory");
+
+	if (error)
+		panic("invept error %d", error);
+}
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmx_msr.c b/usr/src/uts/i86pc/io/vmm/intel/vmx_msr.c
new file mode 100644
index 0000000000..4a1a2cd358
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmx_msr.c
@@ -0,0 +1,516 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/proc.h>
+
+#include <machine/clock.h>
+#include <machine/cpufunc.h>
+#include <machine/md_var.h>
+#include <machine/pcb.h>
+#include <machine/specialreg.h>
+#include <machine/vmm.h>
+
+#include "vmx.h"
+#include "vmx_msr.h"
+
+static boolean_t
+vmx_ctl_allows_one_setting(uint64_t msr_val, int bitpos)
+{
+
+	if (msr_val & (1UL << (bitpos + 32)))
+		return (TRUE);
+	else
+		return (FALSE);
+}
+
+static boolean_t
+vmx_ctl_allows_zero_setting(uint64_t msr_val, int bitpos)
+{
+
+	if ((msr_val & (1UL << bitpos)) == 0)
+		return (TRUE);
+	else
+		return (FALSE);
+}
+
+uint32_t
+vmx_revision(void)
+{
+
+	return (rdmsr(MSR_VMX_BASIC) & 0xffffffff);
+}
+
+/*
+ * Generate a bitmask to be used for the VMCS execution control fields.
+ *
+ * The caller specifies what bits should be set to one in 'ones_mask'
+ * and what bits should be set to zero in 'zeros_mask'. The don't-care
+ * bits are set to the default value. The default values are obtained
+ * based on "Algorithm 3" in Section 27.5.1 "Algorithms for Determining
+ * VMX Capabilities".
+ *
+ * Returns zero on success and non-zero on error.
+ */
+int
+vmx_set_ctlreg(int ctl_reg, int true_ctl_reg, uint32_t ones_mask,
+	       uint32_t zeros_mask, uint32_t *retval)
+{
+	int i;
+	uint64_t val, trueval;
+	boolean_t true_ctls_avail, one_allowed, zero_allowed;
+
+	/* We cannot ask the same bit to be set to both '1' and '0' */
+	if ((ones_mask ^ zeros_mask) != (ones_mask | zeros_mask))
+		return (EINVAL);
+
+	if (rdmsr(MSR_VMX_BASIC) & (1UL << 55))
+		true_ctls_avail = TRUE;
+	else
+		true_ctls_avail = FALSE;
+
+	val = rdmsr(ctl_reg);
+	if (true_ctls_avail)
+		trueval = rdmsr(true_ctl_reg);		/* step c */
+	else
+		trueval = val;				/* step a */
+
+	for (i = 0; i < 32; i++) {
+		one_allowed = vmx_ctl_allows_one_setting(trueval, i);
+		zero_allowed = vmx_ctl_allows_zero_setting(trueval, i);
+
+		KASSERT(one_allowed || zero_allowed,
+			("invalid zero/one setting for bit %d of ctl 0x%0x, "
+			 "truectl 0x%0x\n", i, ctl_reg, true_ctl_reg));
+
+		if (zero_allowed && !one_allowed) {		/* b(i),c(i) */
+			if (ones_mask & (1 << i))
+				return (EINVAL);
+			*retval &= ~(1 << i);
+		} else if (one_allowed && !zero_allowed) {	/* b(i),c(i) */
+			if (zeros_mask & (1 << i))
+				return (EINVAL);
+			*retval |= 1 << i;
+		} else {
+			if (zeros_mask & (1 << i))	/* b(ii),c(ii) */
+				*retval &= ~(1 << i);
+			else if (ones_mask & (1 << i)) /* b(ii), c(ii) */
+				*retval |= 1 << i;
+			else if (!true_ctls_avail)
+				*retval &= ~(1 << i);	/* b(iii) */
+			else if (vmx_ctl_allows_zero_setting(val, i))/* c(iii)*/
+				*retval &= ~(1 << i);
+			else if (vmx_ctl_allows_one_setting(val, i)) /* c(iv) */
+				*retval |= 1 << i;
+			else {
+				panic("vmx_set_ctlreg: unable to determine "
+				      "correct value of ctl bit %d for msr "
+				      "0x%0x and true msr 0x%0x", i, ctl_reg,
+				      true_ctl_reg);
+			}
+		}
+	}
+
+	return (0);
+}
+
+void
+msr_bitmap_initialize(char *bitmap)
+{
+
+	memset(bitmap, 0xff, PAGE_SIZE);
+}
+
+int
+msr_bitmap_change_access(char *bitmap, u_int msr, int access)
+{
+	int byte, bit;
+
+	if (msr <= 0x00001FFF)
+		byte = msr / 8;
+	else if (msr >= 0xC0000000 && msr <= 0xC0001FFF)
+		byte = 1024 + (msr - 0xC0000000) / 8;
+	else
+		return (EINVAL);
+
+	bit = msr & 0x7;
+
+	if (access & MSR_BITMAP_ACCESS_READ)
+		bitmap[byte] &= ~(1 << bit);
+	else
+		bitmap[byte] |= 1 << bit;
+
+	byte += 2048;
+	if (access & MSR_BITMAP_ACCESS_WRITE)
+		bitmap[byte] &= ~(1 << bit);
+	else
+		bitmap[byte] |= 1 << bit;
+
+	return (0);
+}
+
+static uint64_t misc_enable;
+static uint64_t platform_info;
+static uint64_t turbo_ratio_limit;
+#ifdef __FreeBSD__
+static uint64_t host_msrs[GUEST_MSR_NUM];
+#endif /* __FreeBSD__ */
+
+static bool
+nehalem_cpu(void)
+{
+	u_int family, model;
+
+	/*
+	 * The family:model numbers belonging to the Nehalem microarchitecture
+	 * are documented in Section 35.5, Intel SDM dated Feb 2014.
+	 */
+	family = CPUID_TO_FAMILY(cpu_id);
+	model = CPUID_TO_MODEL(cpu_id);
+	if (family == 0x6) {
+		switch (model) {
+		case 0x1A:
+		case 0x1E:
+		case 0x1F:
+		case 0x2E:
+			return (true);
+		default:
+			break;
+		}
+	}
+	return (false);
+}
+
+static bool
+westmere_cpu(void)
+{
+	u_int family, model;
+
+	/*
+	 * The family:model numbers belonging to the Westmere microarchitecture
+	 * are documented in Section 35.6, Intel SDM dated Feb 2014.
+	 */
+	family = CPUID_TO_FAMILY(cpu_id);
+	model = CPUID_TO_MODEL(cpu_id);
+	if (family == 0x6) {
+		switch (model) {
+		case 0x25:
+		case 0x2C:
+			return (true);
+		default:
+			break;
+		}
+	}
+	return (false);
+}
+
+static bool
+pat_valid(uint64_t val)
+{
+	int i, pa;
+
+	/*
+	 * From Intel SDM: Table "Memory Types That Can Be Encoded With PAT"
+	 *
+	 * Extract PA0 through PA7 and validate that each one encodes a
+	 * valid memory type.
+	 */
+	for (i = 0; i < 8; i++) {
+		pa = (val >> (i * 8)) & 0xff;
+		if (pa == 2 || pa == 3 || pa >= 8)
+			return (false);
+	}
+	return (true);
+}
+
+void
+vmx_msr_init(void)
+{
+	uint64_t bus_freq, ratio;
+	int i;
+
+#ifdef __FreeBSD__
+	/* XXXJOY: Do we want to do this caching? */
+	/*
+	 * It is safe to cache the values of the following MSRs because
+	 * they don't change based on curcpu, curproc or curthread.
+	 */
+	host_msrs[IDX_MSR_LSTAR] = rdmsr(MSR_LSTAR);
+	host_msrs[IDX_MSR_CSTAR] = rdmsr(MSR_CSTAR);
+	host_msrs[IDX_MSR_STAR] = rdmsr(MSR_STAR);
+	host_msrs[IDX_MSR_SF_MASK] = rdmsr(MSR_SF_MASK);
+#endif /* __FreeBSD__ */
+
+	/*
+	 * Initialize emulated MSRs
+	 */
+	misc_enable = rdmsr(MSR_IA32_MISC_ENABLE);
+	/*
+	 * Set mandatory bits
+	 *  11:   branch trace disabled
+	 *  12:   PEBS unavailable
+	 * Clear unsupported features
+	 *  16:   SpeedStep enable
+	 *  18:   enable MONITOR FSM
+	 */
+	misc_enable |= (1 << 12) | (1 << 11);
+	misc_enable &= ~((1 << 18) | (1 << 16));
+
+	if (nehalem_cpu() || westmere_cpu())
+		bus_freq = 133330000;		/* 133Mhz */
+	else
+		bus_freq = 100000000;		/* 100Mhz */
+
+	/*
+	 * XXXtime
+	 * The ratio should really be based on the virtual TSC frequency as
+	 * opposed to the host TSC.
+	 */
+	ratio = (tsc_freq / bus_freq) & 0xff;
+
+	/*
+	 * The register definition is based on the micro-architecture
+	 * but the following bits are always the same:
+	 * [15:8]  Maximum Non-Turbo Ratio
+	 * [28]    Programmable Ratio Limit for Turbo Mode
+	 * [29]    Programmable TDC-TDP Limit for Turbo Mode
+	 * [47:40] Maximum Efficiency Ratio
+	 *
+	 * The other bits can be safely set to 0 on all
+	 * micro-architectures up to Haswell.
+	 */
+	platform_info = (ratio << 8) | (ratio << 40);
+
+	/*
+	 * The number of valid bits in the MSR_TURBO_RATIO_LIMITx register is
+	 * dependent on the maximum cores per package supported by the micro-
+	 * architecture. For e.g., Westmere supports 6 cores per package and
+	 * uses the low 48 bits. Sandybridge support 8 cores per package and
+	 * uses up all 64 bits.
+	 *
+	 * However, the unused bits are reserved so we pretend that all bits
+	 * in this MSR are valid.
+	 */
+	for (i = 0; i < 8; i++)
+		turbo_ratio_limit = (turbo_ratio_limit << 8) | ratio;
+}
+
+void
+vmx_msr_guest_init(struct vmx *vmx, int vcpuid)
+{
+	uint64_t *guest_msrs;
+
+	guest_msrs = vmx->guest_msrs[vcpuid];
+
+	/*
+	 * The permissions bitmap is shared between all vcpus so initialize it
+	 * once when initializing the vBSP.
+	 */
+	if (vcpuid == 0) {
+		guest_msr_rw(vmx, MSR_LSTAR);
+		guest_msr_rw(vmx, MSR_CSTAR);
+		guest_msr_rw(vmx, MSR_STAR);
+		guest_msr_rw(vmx, MSR_SF_MASK);
+		guest_msr_rw(vmx, MSR_KGSBASE);
+	}
+
+	/*
+	 * Initialize guest IA32_PAT MSR with default value after reset.
+	 */
+	guest_msrs[IDX_MSR_PAT] = PAT_VALUE(0, PAT_WRITE_BACK) |
+	    PAT_VALUE(1, PAT_WRITE_THROUGH)	|
+	    PAT_VALUE(2, PAT_UNCACHED)		|
+	    PAT_VALUE(3, PAT_UNCACHEABLE)	|
+	    PAT_VALUE(4, PAT_WRITE_BACK)	|
+	    PAT_VALUE(5, PAT_WRITE_THROUGH)	|
+	    PAT_VALUE(6, PAT_UNCACHED)		|
+	    PAT_VALUE(7, PAT_UNCACHEABLE);
+
+	return;
+}
+
+void
+vmx_msr_guest_enter(struct vmx *vmx, int vcpuid)
+{
+	uint64_t *guest_msrs = vmx->guest_msrs[vcpuid];
+
+#ifndef __FreeBSD__
+	uint64_t *host_msrs = vmx->host_msrs[vcpuid];
+
+	/* Save host MSRs */
+	host_msrs[IDX_MSR_LSTAR] = rdmsr(MSR_LSTAR);
+	host_msrs[IDX_MSR_CSTAR] = rdmsr(MSR_CSTAR);
+	host_msrs[IDX_MSR_STAR] = rdmsr(MSR_STAR);
+	host_msrs[IDX_MSR_SF_MASK] = rdmsr(MSR_SF_MASK);
+#endif /* __FreeBSD__ */
+
+	/* Save host MSRs (in particular, KGSBASE) and restore guest MSRs */
+#ifdef __FreeBSD__
+	update_pcb_bases(curpcb);
+#endif
+	wrmsr(MSR_LSTAR, guest_msrs[IDX_MSR_LSTAR]);
+	wrmsr(MSR_CSTAR, guest_msrs[IDX_MSR_CSTAR]);
+	wrmsr(MSR_STAR, guest_msrs[IDX_MSR_STAR]);
+	wrmsr(MSR_SF_MASK, guest_msrs[IDX_MSR_SF_MASK]);
+	wrmsr(MSR_KGSBASE, guest_msrs[IDX_MSR_KGSBASE]);
+}
+
+void
+vmx_msr_guest_exit(struct vmx *vmx, int vcpuid)
+{
+	uint64_t *guest_msrs = vmx->guest_msrs[vcpuid];
+#ifndef __FreeBSD__
+	uint64_t *host_msrs = vmx->host_msrs[vcpuid];
+#endif
+
+	/* Save guest MSRs */
+	guest_msrs[IDX_MSR_LSTAR] = rdmsr(MSR_LSTAR);
+	guest_msrs[IDX_MSR_CSTAR] = rdmsr(MSR_CSTAR);
+	guest_msrs[IDX_MSR_STAR] = rdmsr(MSR_STAR);
+	guest_msrs[IDX_MSR_SF_MASK] = rdmsr(MSR_SF_MASK);
+	guest_msrs[IDX_MSR_KGSBASE] = rdmsr(MSR_KGSBASE);
+
+	/* Restore host MSRs */
+	wrmsr(MSR_LSTAR, host_msrs[IDX_MSR_LSTAR]);
+	wrmsr(MSR_CSTAR, host_msrs[IDX_MSR_CSTAR]);
+	wrmsr(MSR_STAR, host_msrs[IDX_MSR_STAR]);
+	wrmsr(MSR_SF_MASK, host_msrs[IDX_MSR_SF_MASK]);
+
+	/* MSR_KGSBASE will be restored on the way back to userspace */
+}
+
+int
+vmx_rdmsr(struct vmx *vmx, int vcpuid, u_int num, uint64_t *val, bool *retu)
+{
+	const uint64_t *guest_msrs;
+	int error;
+
+	guest_msrs = vmx->guest_msrs[vcpuid];
+	error = 0;
+
+	switch (num) {
+	case MSR_MCG_CAP:
+	case MSR_MCG_STATUS:
+		*val = 0;
+		break;
+	case MSR_MTRRcap:
+	case MSR_MTRRdefType:
+	case MSR_MTRR4kBase ... MSR_MTRR4kBase + 8:
+	case MSR_MTRR16kBase ... MSR_MTRR16kBase + 1:
+	case MSR_MTRR64kBase:
+		*val = 0;
+		break;
+	case MSR_IA32_MISC_ENABLE:
+		*val = misc_enable;
+		break;
+	case MSR_PLATFORM_INFO:
+		*val = platform_info;
+		break;
+	case MSR_TURBO_RATIO_LIMIT:
+	case MSR_TURBO_RATIO_LIMIT1:
+		*val = turbo_ratio_limit;
+		break;
+	case MSR_PAT:
+		*val = guest_msrs[IDX_MSR_PAT];
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+	return (error);
+}
+
+int
+vmx_wrmsr(struct vmx *vmx, int vcpuid, u_int num, uint64_t val, bool *retu)
+{
+	uint64_t *guest_msrs;
+	uint64_t changed;
+	int error;
+	
+	guest_msrs = vmx->guest_msrs[vcpuid];
+	error = 0;
+
+	switch (num) {
+	case MSR_MCG_CAP:
+	case MSR_MCG_STATUS:
+		break;		/* ignore writes */
+	case MSR_MTRRcap:
+		vm_inject_gp(vmx->vm, vcpuid);
+		break;
+	case MSR_MTRRdefType:
+	case MSR_MTRR4kBase ... MSR_MTRR4kBase + 8:
+	case MSR_MTRR16kBase ... MSR_MTRR16kBase + 1:
+	case MSR_MTRR64kBase:
+		break;		/* Ignore writes */
+	case MSR_IA32_MISC_ENABLE:
+		changed = val ^ misc_enable;
+		/*
+		 * If the host has disabled the NX feature then the guest
+		 * also cannot use it. However, a Linux guest will try to
+		 * enable the NX feature by writing to the MISC_ENABLE MSR.
+		 *
+		 * This can be safely ignored because the memory management
+		 * code looks at CPUID.80000001H:EDX.NX to check if the
+		 * functionality is actually enabled.
+		 */
+		changed &= ~(1UL << 34);
+
+		/*
+		 * Punt to userspace if any other bits are being modified.
+		 */
+		if (changed)
+			error = EINVAL;
+
+		break;
+	case MSR_PAT:
+		if (pat_valid(val))
+			guest_msrs[IDX_MSR_PAT] = val;
+		else
+			vm_inject_gp(vmx->vm, vcpuid);
+		break;
+#ifdef __FreeBSD__
+	case MSR_TSC:
+		error = vmx_set_tsc_offset(vmx, vcpuid, val - rdtsc());
+		break;
+#endif /* __FreeBSD__ */
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	return (error);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmx_msr.h b/usr/src/uts/i86pc/io/vmm/intel/vmx_msr.h
new file mode 100644
index 0000000000..ac2adb0dd1
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmx_msr.h
@@ -0,0 +1,72 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VMX_MSR_H_
+#define	_VMX_MSR_H_
+
+struct vmx;
+
+void vmx_msr_init(void);
+void vmx_msr_guest_init(struct vmx *vmx, int vcpuid);
+void vmx_msr_guest_enter(struct vmx *vmx, int vcpuid);
+void vmx_msr_guest_exit(struct vmx *vmx, int vcpuid);
+int vmx_rdmsr(struct vmx *, int vcpuid, u_int num, uint64_t *val, bool *retu);
+int vmx_wrmsr(struct vmx *, int vcpuid, u_int num, uint64_t val, bool *retu);
+
+uint32_t vmx_revision(void);
+
+int vmx_set_ctlreg(int ctl_reg, int true_ctl_reg, uint32_t ones_mask,
+		   uint32_t zeros_mask, uint32_t *retval);
+
+/*
+ * According to Section 21.10.4 "Software Access to Related Structures",
+ * changes to data structures pointed to by the VMCS must be made only when
+ * there is no logical processor with a current VMCS that points to the
+ * data structure.
+ *
+ * This pretty much limits us to configuring the MSR bitmap before VMCS
+ * initialization for SMP VMs. Unless of course we do it the hard way - which
+ * would involve some form of synchronization between the vcpus to vmclear
+ * all VMCSs' that point to the bitmap.
+ */
+#define	MSR_BITMAP_ACCESS_NONE	0x0
+#define	MSR_BITMAP_ACCESS_READ	0x1
+#define	MSR_BITMAP_ACCESS_WRITE	0x2
+#define	MSR_BITMAP_ACCESS_RW	(MSR_BITMAP_ACCESS_READ|MSR_BITMAP_ACCESS_WRITE)
+void	msr_bitmap_initialize(char *bitmap);
+int	msr_bitmap_change_access(char *bitmap, u_int msr, int access);
+
+#define	guest_msr_rw(vmx, msr) \
+    msr_bitmap_change_access((vmx)->msr_bitmap, (msr), MSR_BITMAP_ACCESS_RW)
+
+#define	guest_msr_ro(vmx, msr) \
+    msr_bitmap_change_access((vmx)->msr_bitmap, (msr), MSR_BITMAP_ACCESS_READ)
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vmx_support.s b/usr/src/uts/i86pc/io/vmm/intel/vmx_support.s
new file mode 100644
index 0000000000..48e8847f2f
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vmx_support.s
@@ -0,0 +1,384 @@
+/*-
+ * Copyright (c) 2011 NetApp, Inc.
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/asm_linkage.h>
+#include <sys/segments.h>
+
+/* Porting note: This is named 'vmx_support.S' upstream. */
+
+
+
+#if defined(lint)
+
+struct vmxctx;
+struct vmx;
+
+/*ARGSUSED*/
+void
+vmx_launch(struct vmxctx *ctx)
+{}
+
+void
+vmx_exit_guest()
+{}
+
+/*ARGSUSED*/
+int
+vmx_enter_guest(struct vmxctx *ctx, struct vmx *vmx, int launched)
+{
+	return (0);
+}
+
+#else /* lint */
+
+#include "vmx_assym.h"
+#include "vmcs.h"
+
+/*
+ * Assumes that %rdi holds a pointer to the 'vmxctx'.
+ *
+ * On "return" all registers are updated to reflect guest state. The two
+ * exceptions are %rip and %rsp. These registers are atomically switched
+ * by hardware from the guest area of the vmcs.
+ *
+ * We modify %rsp to point to the 'vmxctx' so we can use it to restore
+ * host context in case of an error with 'vmlaunch' or 'vmresume'.
+ */
+#define	VMX_GUEST_RESTORE						\
+	movq	VMXCTX_GUEST_CR2(%rdi),%rsi;				\
+	movq	%rsi,%cr2;						\
+	movq	VMXCTX_GUEST_RSI(%rdi),%rsi;				\
+	movq	VMXCTX_GUEST_RDX(%rdi),%rdx;				\
+	movq	VMXCTX_GUEST_RCX(%rdi),%rcx;				\
+	movq	VMXCTX_GUEST_R8(%rdi),%r8;				\
+	movq	VMXCTX_GUEST_R9(%rdi),%r9;				\
+	movq	VMXCTX_GUEST_RAX(%rdi),%rax;				\
+	movq	VMXCTX_GUEST_RBX(%rdi),%rbx;				\
+	movq	VMXCTX_GUEST_RBP(%rdi),%rbp;				\
+	movq	VMXCTX_GUEST_R10(%rdi),%r10;				\
+	movq	VMXCTX_GUEST_R11(%rdi),%r11;				\
+	movq	VMXCTX_GUEST_R12(%rdi),%r12;				\
+	movq	VMXCTX_GUEST_R13(%rdi),%r13;				\
+	movq	VMXCTX_GUEST_R14(%rdi),%r14;				\
+	movq	VMXCTX_GUEST_R15(%rdi),%r15;				\
+	movq	VMXCTX_GUEST_RDI(%rdi),%rdi; /* restore rdi the last */
+
+#define	VMX_GUEST_SAVE							\
+	movq	%rdi, VMXSTK_TMPRDI(%rsp);				\
+	movq	VMXSTK_RDI(%rsp), %rdi;					\
+	movq	%rbp, VMXCTX_GUEST_RBP(%rdi);				\
+	leaq	VMXSTK_FP(%rsp), %rbp;					\
+	movq	%rsi, VMXCTX_GUEST_RSI(%rdi);				\
+	movq	%rdx, VMXCTX_GUEST_RDX(%rdi);				\
+	movq	%rcx, VMXCTX_GUEST_RCX(%rdi);				\
+	movq	%r8, VMXCTX_GUEST_R8(%rdi);				\
+	movq	%r9, VMXCTX_GUEST_R9(%rdi);				\
+	movq	%rax, VMXCTX_GUEST_RAX(%rdi);				\
+	movq	%rbx, VMXCTX_GUEST_RBX(%rdi);				\
+	movq	%r10, VMXCTX_GUEST_R10(%rdi);				\
+	movq	%r11, VMXCTX_GUEST_R11(%rdi);				\
+	movq	%r12, VMXCTX_GUEST_R12(%rdi);				\
+	movq	%r13, VMXCTX_GUEST_R13(%rdi);				\
+	movq	%r14, VMXCTX_GUEST_R14(%rdi);				\
+	movq	%r15, VMXCTX_GUEST_R15(%rdi);				\
+	movq	%cr2, %rbx;						\
+	movq	%rbx, VMXCTX_GUEST_CR2(%rdi);				\
+	movq	VMXSTK_TMPRDI(%rsp), %rdx;				\
+	movq	%rdx, VMXCTX_GUEST_RDI(%rdi);
+
+
+/*
+ * Flush scratch registers to avoid lingering guest state being used for
+ * Spectre v1 attacks when returning from guest entry.
+ */
+#define	VMX_GUEST_FLUSH_SCRATCH						\
+	xorl	%edi, %edi;						\
+	xorl	%esi, %esi;						\
+	xorl	%edx, %edx;						\
+	xorl	%ecx, %ecx;						\
+	xorl	%r8d, %r8d;						\
+	xorl	%r9d, %r9d;						\
+	xorl	%r10d, %r10d;						\
+	xorl	%r11d, %r11d;
+
+
+/* Stack layout (offset from %rsp) for vmx_enter_guest */
+#define	VMXSTK_TMPRDI	0x00	/* temp store %rdi on vmexit		*/
+#define	VMXSTK_R15	0x08	/* callee saved %r15			*/
+#define	VMXSTK_R14	0x10	/* callee saved %r14			*/
+#define	VMXSTK_R13	0x18	/* callee saved %r13			*/
+#define	VMXSTK_R12	0x20	/* callee saved %r12			*/
+#define	VMXSTK_RBX	0x28	/* callee saved %rbx			*/
+#define	VMXSTK_RDX	0x30	/* save-args %rdx (int launched)	*/
+#define	VMXSTK_RSI	0x38	/* save-args %rsi (struct vmx *vmx)	*/
+#define	VMXSTK_RDI	0x40	/* save-args %rdi (struct vmxctx *ctx)	*/
+#define	VMXSTK_FP	0x48	/* frame pointer %rbp			*/
+#define	VMXSTKSIZE	VMXSTK_FP
+
+/*
+ * vmx_enter_guest(struct vmxctx *vmxctx, int launched)
+ * Interrupts must be disabled on entry.
+ */
+ENTRY_NP(vmx_enter_guest)
+	pushq	%rbp
+	movq	%rsp, %rbp
+	subq	$VMXSTKSIZE, %rsp
+	movq	%r15, VMXSTK_R15(%rsp)
+	movq	%r14, VMXSTK_R14(%rsp)
+	movq	%r13, VMXSTK_R13(%rsp)
+	movq	%r12, VMXSTK_R12(%rsp)
+	movq	%rbx, VMXSTK_RBX(%rsp)
+	movq	%rdx, VMXSTK_RDX(%rsp)
+	movq	%rsi, VMXSTK_RSI(%rsp)
+	movq	%rdi, VMXSTK_RDI(%rsp)
+
+	movq	%rdi, %r12	/* vmxctx */
+	movq	%rsi, %r13	/* vmx */
+	movl	%edx, %r14d	/* launch state */
+	movq	VMXCTX_PMAP(%rdi), %rbx
+
+	/* Activate guest pmap on this cpu. */
+	leaq	PM_ACTIVE(%rbx), %rdi
+	movl	%gs:CPU_ID, %esi
+	call	cpuset_atomic_add
+	movq	%r12, %rdi
+
+	/*
+	 * If 'vmx->eptgen[curcpu]' is not identical to 'pmap->pm_eptgen'
+	 * then we must invalidate all mappings associated with this EPTP.
+	 */
+	movq	PM_EPTGEN(%rbx), %r10
+	movl	%gs:CPU_ID, %eax
+	cmpq	%r10, VMX_EPTGEN(%r13, %rax, 8)
+	je	guest_restore
+
+	/* Refresh 'vmx->eptgen[curcpu]' */
+	movq	%r10, VMX_EPTGEN(%r13, %rax, 8)
+
+	/* Setup the invept descriptor on the host stack */
+	pushq	$0x0
+	pushq	VMX_EPTP(%r13)
+	movl	$0x1, %eax	/* Single context invalidate */
+	invept	(%rsp), %rax
+	leaq	0x10(%rsp), %rsp
+	jbe	invept_error		/* Check invept instruction error */
+
+guest_restore:
+	/* Write the current %rsp into the VMCS to be restored on vmexit */
+	movl	$VMCS_HOST_RSP, %eax
+	vmwrite	%rsp, %rax
+	jbe	vmwrite_error
+
+	/* Check if vmresume is adequate or a full vmlaunch is required */
+	cmpl	$0, %r14d
+	je	do_launch
+
+	VMX_GUEST_RESTORE
+	vmresume
+	/*
+	 * In the common case, 'vmresume' returns back to the host through
+	 * 'vmx_exit_guest'. If there is an error we return VMX_VMRESUME_ERROR
+	 * to the caller.
+	 */
+	leaq	VMXSTK_FP(%rsp), %rbp
+	movq	VMXSTK_RDI(%rsp), %rdi
+	movl	$VMX_VMRESUME_ERROR, %eax
+	jmp	decode_inst_error
+
+do_launch:
+	VMX_GUEST_RESTORE
+	vmlaunch
+	/*
+	 * In the common case, 'vmlaunch' returns back to the host through
+	 * 'vmx_exit_guest'. If there is an error we return VMX_VMLAUNCH_ERROR
+	 * to the caller.
+	 */
+	leaq	VMXSTK_FP(%rsp), %rbp
+	movq	VMXSTK_RDI(%rsp), %rdi
+	movl	$VMX_VMLAUNCH_ERROR, %eax
+	jmp	decode_inst_error
+
+vmwrite_error:
+	movl	$VMX_VMWRITE_ERROR, %eax
+	jmp	decode_inst_error
+invept_error:
+	movl	$VMX_INVEPT_ERROR, %eax
+	jmp	decode_inst_error
+decode_inst_error:
+	movl	$VM_FAIL_VALID, %r11d
+	jz	inst_error
+	movl	$VM_FAIL_INVALID, %r11d
+inst_error:
+	movl	%r11d, VMXCTX_INST_FAIL_STATUS(%rdi)
+
+	movq	VMXCTX_PMAP(%rdi), %rdi
+	leaq	PM_ACTIVE(%rdi), %rdi
+	movl	%gs:CPU_ID, %esi
+	movq	%rax, %r12
+	call	cpuset_atomic_del
+	movq	%r12, %rax
+
+	movq	VMXSTK_RBX(%rsp), %rbx
+	movq	VMXSTK_R12(%rsp), %r12
+	movq	VMXSTK_R13(%rsp), %r13
+	movq	VMXSTK_R14(%rsp), %r14
+	movq	VMXSTK_R15(%rsp), %r15
+
+	VMX_GUEST_FLUSH_SCRATCH
+
+	addq	$VMXSTKSIZE, %rsp
+	popq	%rbp
+	ret
+
+/*
+ * Non-error VM-exit from the guest. Make this a label so it can
+ * be used by C code when setting up the VMCS.
+ * The VMCS-restored %rsp points to the struct vmxctx
+ */
+.align	ASM_ENTRY_ALIGN;
+ALTENTRY(vmx_exit_guest)
+	/* Save guest state that is not automatically saved in the vmcs. */
+	VMX_GUEST_SAVE
+
+	/* Deactivate guest pmap on this cpu. */
+	movq	VMXCTX_PMAP(%rdi), %rdi
+	leaq	PM_ACTIVE(%rdi), %rdi
+	movl	%gs:CPU_ID, %esi
+	call	cpuset_atomic_del
+
+	/*
+	 * This will return to the caller of 'vmx_enter_guest()' with a return
+	 * value of VMX_GUEST_VMEXIT.
+	 */
+	movl	$VMX_GUEST_VMEXIT, %eax
+	movq	VMXSTK_RBX(%rsp), %rbx
+	movq	VMXSTK_R12(%rsp), %r12
+	movq	VMXSTK_R13(%rsp), %r13
+	movq	VMXSTK_R14(%rsp), %r14
+	movq	VMXSTK_R15(%rsp), %r15
+
+	VMX_GUEST_FLUSH_SCRATCH
+
+	addq	$VMXSTKSIZE, %rsp
+	popq	%rbp
+	ret
+SET_SIZE(vmx_enter_guest)
+
+
+
+.align	ASM_ENTRY_ALIGN;
+ALTENTRY(vmx_exit_guest_flush_rsb)
+	/* Save guest state that is not automatically saved in the vmcs. */
+	VMX_GUEST_SAVE
+
+	/* Deactivate guest pmap on this cpu. */
+	movq	VMXCTX_PMAP(%rdi), %rdi
+	leaq	PM_ACTIVE(%rdi), %rdi
+	movl	%gs:CPU_ID, %esi
+	call	cpuset_atomic_del
+
+	VMX_GUEST_FLUSH_SCRATCH
+
+	/*
+	 * To prevent malicious branch target predictions from affecting the
+	 * host, overwrite all entries in the RSB upon exiting a guest.
+	 */
+	movl	$16, %ecx	/* 16 iterations, two calls per loop */
+	movq	%rsp, %rax
+loop:
+	call	2f		/* create an RSB entry. */
+1:
+	pause
+	call	1b		/* capture rogue speculation. */
+2:
+	call	2f		/* create an RSB entry. */
+1:
+	pause
+	call	1b		/* capture rogue speculation. */
+2:
+	subl	$1, %ecx
+	jnz	loop
+	movq	%rax, %rsp
+
+	/*
+	 * This will return to the caller of 'vmx_enter_guest()' with a return
+	 * value of VMX_GUEST_VMEXIT.
+	 */
+	movl	$VMX_GUEST_VMEXIT, %eax
+	movq	VMXSTK_RBX(%rsp), %rbx
+	movq	VMXSTK_R12(%rsp), %r12
+	movq	VMXSTK_R13(%rsp), %r13
+	movq	VMXSTK_R14(%rsp), %r14
+	movq	VMXSTK_R15(%rsp), %r15
+
+	addq	$VMXSTKSIZE, %rsp
+	popq	%rbp
+	ret
+SET_SIZE(vmx_exit_guest_flush_rsb)
+
+/*
+ * %rdi = trapno
+ *
+ * We need to do enough to convince cmnint - and its iretting tail - that we're
+ * a legit interrupt stack frame.
+ */
+ENTRY_NP(vmx_call_isr)
+	pushq	%rbp
+	movq	%rsp, %rbp
+	movq	%rsp, %r11
+	andq	$~0xf, %rsp	/* align stack */
+	pushq	$KDS_SEL	/* %ss */
+	pushq	%r11		/* %rsp */
+	pushfq			/* %rflags */
+	pushq	$KCS_SEL	/* %cs */
+	leaq	.iret_dest(%rip), %rcx
+	pushq	%rcx		/* %rip */
+	pushq	$0		/* err */
+	pushq	%rdi		/* trapno */
+	cli
+	jmp	cmnint		/* %rip (and call) */
+.iret_dest:
+	popq	%rbp
+	ret
+SET_SIZE(vmx_call_isr)
+
+#endif /* lint */
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vtd.c b/usr/src/uts/i86pc/io/vmm/intel/vtd.c
new file mode 100644
index 0000000000..902080e34c
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vtd.c
@@ -0,0 +1,789 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+
+#include <dev/pci/pcireg.h>
+
+#include <machine/vmparam.h>
+#include <contrib/dev/acpica/include/acpi.h>
+
+#include <sys/sunndi.h>
+
+#include "io/iommu.h"
+
+/*
+ * Documented in the "Intel Virtualization Technology for Directed I/O",
+ * Architecture Spec, September 2008.
+ */
+
+/* Section 10.4 "Register Descriptions" */
+struct vtdmap {
+	volatile uint32_t	version;
+	volatile uint32_t	res0;
+	volatile uint64_t	cap;
+	volatile uint64_t	ext_cap;
+	volatile uint32_t	gcr;
+	volatile uint32_t	gsr;
+	volatile uint64_t	rta;
+	volatile uint64_t	ccr;
+};
+
+#define	VTD_CAP_SAGAW(cap)	(((cap) >> 8) & 0x1F)
+#define	VTD_CAP_ND(cap)		((cap) & 0x7)
+#define	VTD_CAP_CM(cap)		(((cap) >> 7) & 0x1)
+#define	VTD_CAP_SPS(cap)	(((cap) >> 34) & 0xF)
+#define	VTD_CAP_RWBF(cap)	(((cap) >> 4) & 0x1)
+
+#define	VTD_ECAP_DI(ecap)	(((ecap) >> 2) & 0x1)
+#define	VTD_ECAP_COHERENCY(ecap) ((ecap) & 0x1)
+#define	VTD_ECAP_IRO(ecap)	(((ecap) >> 8) & 0x3FF)
+
+#define	VTD_GCR_WBF		(1 << 27)
+#define	VTD_GCR_SRTP		(1 << 30)
+#define	VTD_GCR_TE		(1U << 31)
+
+#define	VTD_GSR_WBFS		(1 << 27)
+#define	VTD_GSR_RTPS		(1 << 30)
+#define	VTD_GSR_TES		(1U << 31)
+
+#define	VTD_CCR_ICC		(1UL << 63)	/* invalidate context cache */
+#define	VTD_CCR_CIRG_GLOBAL	(1UL << 61)	/* global invalidation */
+
+#define	VTD_IIR_IVT		(1UL << 63)	/* invalidation IOTLB */
+#define	VTD_IIR_IIRG_GLOBAL	(1ULL << 60)	/* global IOTLB invalidation */
+#define	VTD_IIR_IIRG_DOMAIN	(2ULL << 60)	/* domain IOTLB invalidation */
+#define	VTD_IIR_IIRG_PAGE	(3ULL << 60)	/* page IOTLB invalidation */
+#define	VTD_IIR_DRAIN_READS	(1ULL << 49)	/* drain pending DMA reads */
+#define	VTD_IIR_DRAIN_WRITES	(1ULL << 48)	/* drain pending DMA writes */
+#define	VTD_IIR_DOMAIN_P	32
+
+#define	VTD_ROOT_PRESENT	0x1
+#define	VTD_CTX_PRESENT		0x1
+#define	VTD_CTX_TT_ALL		(1UL << 2)
+
+#define	VTD_PTE_RD		(1UL << 0)
+#define	VTD_PTE_WR		(1UL << 1)
+#define	VTD_PTE_SUPERPAGE	(1UL << 7)
+#define	VTD_PTE_ADDR_M		(0x000FFFFFFFFFF000UL)
+
+#define VTD_RID2IDX(rid)	(((rid) & 0xff) * 2)
+
+struct domain {
+	uint64_t	*ptp;		/* first level page table page */
+	int		pt_levels;	/* number of page table levels */
+	int		addrwidth;	/* 'AW' field in context entry */
+	int		spsmask;	/* supported super page sizes */
+	u_int		id;		/* domain id */
+	vm_paddr_t	maxaddr;	/* highest address to be mapped */
+	SLIST_ENTRY(domain) next;
+};
+
+static SLIST_HEAD(, domain) domhead;
+
+#define	DRHD_MAX_UNITS	8
+static int		drhd_num;
+static struct vtdmap	*vtdmaps[DRHD_MAX_UNITS];
+static int		max_domains;
+typedef int		(*drhd_ident_func_t)(void);
+#ifndef __FreeBSD__
+static dev_info_t	*vtddips[DRHD_MAX_UNITS];
+#endif
+
+static uint64_t root_table[PAGE_SIZE / sizeof(uint64_t)] __aligned(4096);
+static uint64_t ctx_tables[256][PAGE_SIZE / sizeof(uint64_t)] __aligned(4096);
+
+static MALLOC_DEFINE(M_VTD, "vtd", "vtd");
+
+static int
+vtd_max_domains(struct vtdmap *vtdmap)
+{
+	int nd;
+
+	nd = VTD_CAP_ND(vtdmap->cap);
+
+	switch (nd) {
+	case 0:
+		return (16);
+	case 1:
+		return (64);
+	case 2:
+		return (256);
+	case 3:
+		return (1024);
+	case 4:
+		return (4 * 1024);
+	case 5:
+		return (16 * 1024);
+	case 6:
+		return (64 * 1024);
+	default:
+		panic("vtd_max_domains: invalid value of nd (0x%0x)", nd);
+	}
+}
+
+static u_int
+domain_id(void)
+{
+	u_int id;
+	struct domain *dom;
+
+	/* Skip domain id 0 - it is reserved when Caching Mode field is set */
+	for (id = 1; id < max_domains; id++) {
+		SLIST_FOREACH(dom, &domhead, next) {
+			if (dom->id == id)
+				break;
+		}
+		if (dom == NULL)
+			break;		/* found it */
+	}
+	
+	if (id >= max_domains)
+		panic("domain ids exhausted");
+
+	return (id);
+}
+
+static void
+vtd_wbflush(struct vtdmap *vtdmap)
+{
+
+	if (VTD_ECAP_COHERENCY(vtdmap->ext_cap) == 0)
+		pmap_invalidate_cache();
+
+	if (VTD_CAP_RWBF(vtdmap->cap)) {
+		vtdmap->gcr = VTD_GCR_WBF;
+		while ((vtdmap->gsr & VTD_GSR_WBFS) != 0)
+			;
+	}
+}
+
+static void
+vtd_ctx_global_invalidate(struct vtdmap *vtdmap)
+{
+
+	vtdmap->ccr = VTD_CCR_ICC | VTD_CCR_CIRG_GLOBAL;
+	while ((vtdmap->ccr & VTD_CCR_ICC) != 0)
+		;
+}
+
+static void
+vtd_iotlb_global_invalidate(struct vtdmap *vtdmap)
+{
+	int offset;
+	volatile uint64_t *iotlb_reg, val;
+
+	vtd_wbflush(vtdmap);
+
+	offset = VTD_ECAP_IRO(vtdmap->ext_cap) * 16;
+	iotlb_reg = (volatile uint64_t *)((caddr_t)vtdmap + offset + 8);
+	
+	*iotlb_reg =  VTD_IIR_IVT | VTD_IIR_IIRG_GLOBAL |
+		      VTD_IIR_DRAIN_READS | VTD_IIR_DRAIN_WRITES;
+
+	while (1) {
+		val = *iotlb_reg;
+		if ((val & VTD_IIR_IVT) == 0)
+			break;
+	}
+}
+
+static void
+vtd_translation_enable(struct vtdmap *vtdmap)
+{
+
+	vtdmap->gcr = VTD_GCR_TE;
+	while ((vtdmap->gsr & VTD_GSR_TES) == 0)
+		;
+}
+
+static void
+vtd_translation_disable(struct vtdmap *vtdmap)
+{
+
+	vtdmap->gcr = 0;
+	while ((vtdmap->gsr & VTD_GSR_TES) != 0)
+		;
+}
+
+static void *
+vtd_map(dev_info_t *dip)
+{
+	caddr_t regs;
+	ddi_acc_handle_t hdl;
+	int error;
+
+	static ddi_device_acc_attr_t regs_attr = {
+		DDI_DEVICE_ATTR_V0,
+		DDI_NEVERSWAP_ACC,
+		DDI_STRICTORDER_ACC,
+	};
+
+	error = ddi_regs_map_setup(dip, 0, &regs, 0, PAGE_SIZE, &regs_attr,
+	    &hdl);
+
+	if (error != DDI_SUCCESS)
+		return (NULL);
+
+	ddi_set_driver_private(dip, hdl);
+
+	return (regs);
+}
+
+static void
+vtd_unmap(dev_info_t *dip)
+{
+	ddi_acc_handle_t hdl = ddi_get_driver_private(dip);
+
+	if (hdl != NULL)
+		ddi_regs_map_free(&hdl);
+}
+
+#ifndef __FreeBSD__
+/*
+ * This lives in vtd_sol.c for license reasons.
+ */
+extern dev_info_t *vtd_get_dip(ACPI_DMAR_HARDWARE_UNIT *, int);
+#endif
+
+static int
+vtd_init(void)
+{
+	int i, units, remaining;
+	struct vtdmap *vtdmap;
+	vm_paddr_t ctx_paddr;
+	char *end;
+#ifdef __FreeBSD__
+	char envname[32];
+	unsigned long mapaddr;
+#endif
+	ACPI_STATUS status;
+	ACPI_TABLE_DMAR *dmar;
+	ACPI_DMAR_HEADER *hdr;
+	ACPI_DMAR_HARDWARE_UNIT *drhd;
+
+#ifdef __FreeBSD__
+	/*
+	 * Allow the user to override the ACPI DMAR table by specifying the
+	 * physical address of each remapping unit.
+	 *
+	 * The following example specifies two remapping units at
+	 * physical addresses 0xfed90000 and 0xfeda0000 respectively.
+	 * set vtd.regmap.0.addr=0xfed90000
+	 * set vtd.regmap.1.addr=0xfeda0000
+	 */
+	for (units = 0; units < DRHD_MAX_UNITS; units++) {
+		snprintf(envname, sizeof(envname), "vtd.regmap.%d.addr", units);
+		if (getenv_ulong(envname, &mapaddr) == 0)
+			break;
+		vtdmaps[units] = (struct vtdmap *)PHYS_TO_DMAP(mapaddr);
+	}
+
+	if (units > 0)
+		goto skip_dmar;
+#else
+	units = 0;
+#endif
+	/* Search for DMAR table. */
+	status = AcpiGetTable(ACPI_SIG_DMAR, 0, (ACPI_TABLE_HEADER **)&dmar);
+	if (ACPI_FAILURE(status))
+		return (ENXIO);
+
+	end = (char *)dmar + dmar->Header.Length;
+	remaining = dmar->Header.Length - sizeof(ACPI_TABLE_DMAR);
+	while (remaining > sizeof(ACPI_DMAR_HEADER)) {
+		hdr = (ACPI_DMAR_HEADER *)(end - remaining);
+		if (hdr->Length > remaining)
+			break;
+		/*
+		 * From Intel VT-d arch spec, version 1.3:
+		 * BIOS implementations must report mapping structures
+		 * in numerical order, i.e. All remapping structures of
+		 * type 0 (DRHD) enumerated before remapping structures of
+		 * type 1 (RMRR) and so forth.
+		 */
+		if (hdr->Type != ACPI_DMAR_TYPE_HARDWARE_UNIT)
+			break;
+
+		drhd = (ACPI_DMAR_HARDWARE_UNIT *)hdr;
+#ifdef __FreeBSD__
+		vtdmaps[units++] = (struct vtdmap *)PHYS_TO_DMAP(drhd->Address);
+#else
+		vtddips[units] = vtd_get_dip(drhd, units);
+		vtdmaps[units] = (struct vtdmap *)vtd_map(vtddips[units]);
+		if (vtdmaps[units] == NULL)
+			goto fail;
+		units++;
+#endif
+		if (units >= DRHD_MAX_UNITS)
+			break;
+		remaining -= hdr->Length;
+	}
+
+	if (units <= 0)
+		return (ENXIO);
+
+#ifdef __FreeBSD__
+skip_dmar:
+#endif
+	drhd_num = units;
+	vtdmap = vtdmaps[0];
+
+	if (VTD_CAP_CM(vtdmap->cap) != 0)
+		panic("vtd_init: invalid caching mode");
+
+	max_domains = vtd_max_domains(vtdmap);
+
+	/*
+	 * Set up the root-table to point to the context-entry tables
+	 */
+	for (i = 0; i < 256; i++) {
+		ctx_paddr = vtophys(ctx_tables[i]);
+		if (ctx_paddr & PAGE_MASK)
+			panic("ctx table (0x%0lx) not page aligned", ctx_paddr);
+
+		root_table[i * 2] = ctx_paddr | VTD_ROOT_PRESENT;
+	}
+
+	return (0);
+
+#ifndef __FreeBSD__
+fail:
+	for (i = 0; i <= units; i++)
+		vtd_unmap(vtddips[i]);
+	return (ENXIO);
+#endif
+}
+
+static void
+vtd_cleanup(void)
+{
+#ifndef __FreeBSD__
+	int i;
+
+	KASSERT(SLIST_EMPTY(&domhead), ("domain list not empty"));
+
+	bzero(root_table, sizeof (root_table));
+
+	for (i = 0; i <= drhd_num; i++) {
+		vtdmaps[i] = NULL;
+		/*
+		 * Unmap the vtd registers. Note that the devinfo nodes
+		 * themselves aren't removed, they are considered system state
+		 * and can be reused when the module is reloaded.
+		 */
+		if (vtddips[i] != NULL)
+			vtd_unmap(vtddips[i]);
+	}
+#endif
+}
+
+static void
+vtd_enable(void)
+{
+	int i;
+	struct vtdmap *vtdmap;
+
+	for (i = 0; i < drhd_num; i++) {
+		vtdmap = vtdmaps[i];
+		vtd_wbflush(vtdmap);
+
+		/* Update the root table address */
+		vtdmap->rta = vtophys(root_table);
+		vtdmap->gcr = VTD_GCR_SRTP;
+		while ((vtdmap->gsr & VTD_GSR_RTPS) == 0)
+			;
+
+		vtd_ctx_global_invalidate(vtdmap);
+		vtd_iotlb_global_invalidate(vtdmap);
+
+		vtd_translation_enable(vtdmap);
+	}
+}
+
+static void
+vtd_disable(void)
+{
+	int i;
+	struct vtdmap *vtdmap;
+
+	for (i = 0; i < drhd_num; i++) {
+		vtdmap = vtdmaps[i];
+		vtd_translation_disable(vtdmap);
+	}
+}
+
+static void
+vtd_add_device(void *arg, uint16_t rid)
+{
+	int idx;
+	uint64_t *ctxp;
+	struct domain *dom = arg;
+	vm_paddr_t pt_paddr;
+	struct vtdmap *vtdmap;
+	uint8_t bus;
+
+	vtdmap = vtdmaps[0];
+	bus = PCI_RID2BUS(rid);
+	ctxp = ctx_tables[bus];
+	pt_paddr = vtophys(dom->ptp);
+	idx = VTD_RID2IDX(rid);
+
+	if (ctxp[idx] & VTD_CTX_PRESENT) {
+		panic("vtd_add_device: device %x is already owned by "
+		      "domain %d", rid,
+		      (uint16_t)(ctxp[idx + 1] >> 8));
+	}
+
+	/*
+	 * Order is important. The 'present' bit is set only after all fields
+	 * of the context pointer are initialized.
+	 */
+	ctxp[idx + 1] = dom->addrwidth | (dom->id << 8);
+
+	if (VTD_ECAP_DI(vtdmap->ext_cap))
+		ctxp[idx] = VTD_CTX_TT_ALL;
+	else
+		ctxp[idx] = 0;
+
+	ctxp[idx] |= pt_paddr | VTD_CTX_PRESENT;
+
+	/*
+	 * 'Not Present' entries are not cached in either the Context Cache
+	 * or in the IOTLB, so there is no need to invalidate either of them.
+	 */
+}
+
+static void
+vtd_remove_device(void *arg, uint16_t rid)
+{
+	int i, idx;
+	uint64_t *ctxp;
+	struct vtdmap *vtdmap;
+	uint8_t bus;
+
+	bus = PCI_RID2BUS(rid);
+	ctxp = ctx_tables[bus];
+	idx = VTD_RID2IDX(rid);
+
+	/*
+	 * Order is important. The 'present' bit is must be cleared first.
+	 */
+	ctxp[idx] = 0;
+	ctxp[idx + 1] = 0;
+
+	/*
+	 * Invalidate the Context Cache and the IOTLB.
+	 *
+	 * XXX use device-selective invalidation for Context Cache
+	 * XXX use domain-selective invalidation for IOTLB
+	 */
+	for (i = 0; i < drhd_num; i++) {
+		vtdmap = vtdmaps[i];
+		vtd_ctx_global_invalidate(vtdmap);
+		vtd_iotlb_global_invalidate(vtdmap);
+	}
+}
+
+#define	CREATE_MAPPING	0
+#define	REMOVE_MAPPING	1
+
+static uint64_t
+vtd_update_mapping(void *arg, vm_paddr_t gpa, vm_paddr_t hpa, uint64_t len,
+		   int remove)
+{
+	struct domain *dom;
+	int i, spshift, ptpshift, ptpindex, nlevels;
+	uint64_t spsize, *ptp;
+
+	dom = arg;
+	ptpindex = 0;
+	ptpshift = 0;
+
+	KASSERT(gpa + len > gpa, ("%s: invalid gpa range %#lx/%#lx", __func__,
+	    gpa, len));
+	KASSERT(gpa + len <= dom->maxaddr, ("%s: gpa range %#lx/%#lx beyond "
+	    "domain maxaddr %#lx", __func__, gpa, len, dom->maxaddr));
+
+	if (gpa & PAGE_MASK)
+		panic("vtd_create_mapping: unaligned gpa 0x%0lx", gpa);
+
+	if (hpa & PAGE_MASK)
+		panic("vtd_create_mapping: unaligned hpa 0x%0lx", hpa);
+
+	if (len & PAGE_MASK)
+		panic("vtd_create_mapping: unaligned len 0x%0lx", len);
+
+	/*
+	 * Compute the size of the mapping that we can accommodate.
+	 *
+	 * This is based on three factors:
+	 * - supported super page size
+	 * - alignment of the region starting at 'gpa' and 'hpa'
+	 * - length of the region 'len'
+	 */
+	spshift = 48;
+	for (i = 3; i >= 0; i--) {
+		spsize = 1UL << spshift;
+		if ((dom->spsmask & (1 << i)) != 0 &&
+		    (gpa & (spsize - 1)) == 0 &&
+		    (hpa & (spsize - 1)) == 0 &&
+		    (len >= spsize)) {
+			break;
+		}
+		spshift -= 9;
+	}
+
+	ptp = dom->ptp;
+	nlevels = dom->pt_levels;
+	while (--nlevels >= 0) {
+		ptpshift = 12 + nlevels * 9;
+		ptpindex = (gpa >> ptpshift) & 0x1FF;
+
+		/* We have reached the leaf mapping */
+		if (spshift >= ptpshift) {
+			break;
+		}
+
+		/*
+		 * We are working on a non-leaf page table page.
+		 *
+		 * Create a downstream page table page if necessary and point
+		 * to it from the current page table.
+		 */
+		if (ptp[ptpindex] == 0) {
+			void *nlp = malloc(PAGE_SIZE, M_VTD, M_WAITOK | M_ZERO);
+			ptp[ptpindex] = vtophys(nlp)| VTD_PTE_RD | VTD_PTE_WR;
+		}
+
+		ptp = (uint64_t *)PHYS_TO_DMAP(ptp[ptpindex] & VTD_PTE_ADDR_M);
+	}
+
+	if ((gpa & ((1UL << ptpshift) - 1)) != 0)
+		panic("gpa 0x%lx and ptpshift %d mismatch", gpa, ptpshift);
+
+	/*
+	 * Update the 'gpa' -> 'hpa' mapping
+	 */
+	if (remove) {
+		ptp[ptpindex] = 0;
+	} else {
+		ptp[ptpindex] = hpa | VTD_PTE_RD | VTD_PTE_WR;
+
+		if (nlevels > 0)
+			ptp[ptpindex] |= VTD_PTE_SUPERPAGE;
+	}
+
+	return (1UL << ptpshift);
+}
+
+static uint64_t
+vtd_create_mapping(void *arg, vm_paddr_t gpa, vm_paddr_t hpa, uint64_t len)
+{
+
+	return (vtd_update_mapping(arg, gpa, hpa, len, CREATE_MAPPING));
+}
+
+static uint64_t
+vtd_remove_mapping(void *arg, vm_paddr_t gpa, uint64_t len)
+{
+
+	return (vtd_update_mapping(arg, gpa, 0, len, REMOVE_MAPPING));
+}
+
+static void
+vtd_invalidate_tlb(void *dom)
+{
+	int i;
+	struct vtdmap *vtdmap;
+
+	/*
+	 * Invalidate the IOTLB.
+	 * XXX use domain-selective invalidation for IOTLB
+	 */
+	for (i = 0; i < drhd_num; i++) {
+		vtdmap = vtdmaps[i];
+		vtd_iotlb_global_invalidate(vtdmap);
+	}
+}
+
+static void *
+vtd_create_domain(vm_paddr_t maxaddr)
+{
+	struct domain *dom;
+	vm_paddr_t addr;
+	int tmp, i, gaw, agaw, sagaw, res, pt_levels, addrwidth;
+	struct vtdmap *vtdmap;
+
+	if (drhd_num <= 0)
+		panic("vtd_create_domain: no dma remapping hardware available");
+
+	vtdmap = vtdmaps[0];
+
+	/*
+	 * Calculate AGAW.
+	 * Section 3.4.2 "Adjusted Guest Address Width", Architecture Spec.
+	 */
+	addr = 0;
+	for (gaw = 0; addr < maxaddr; gaw++)
+		addr = 1ULL << gaw;
+
+	res = (gaw - 12) % 9;
+	if (res == 0)
+		agaw = gaw;
+	else
+		agaw = gaw + 9 - res;
+
+	if (agaw > 64)
+		agaw = 64;
+
+	/*
+	 * Select the smallest Supported AGAW and the corresponding number
+	 * of page table levels.
+	 */
+	pt_levels = 2;
+	sagaw = 30;
+	addrwidth = 0;
+	tmp = VTD_CAP_SAGAW(vtdmap->cap);
+	for (i = 0; i < 5; i++) {
+		if ((tmp & (1 << i)) != 0 && sagaw >= agaw)
+			break;
+		pt_levels++;
+		addrwidth++;
+		sagaw += 9;
+		if (sagaw > 64)
+			sagaw = 64;
+	}
+
+	if (i >= 5) {
+		panic("vtd_create_domain: SAGAW 0x%lx does not support AGAW %d",
+		      VTD_CAP_SAGAW(vtdmap->cap), agaw);
+	}
+
+	dom = malloc(sizeof(struct domain), M_VTD, M_ZERO | M_WAITOK);
+	dom->pt_levels = pt_levels;
+	dom->addrwidth = addrwidth;
+	dom->id = domain_id();
+	dom->maxaddr = maxaddr;
+	dom->ptp = malloc(PAGE_SIZE, M_VTD, M_ZERO | M_WAITOK);
+	if ((uintptr_t)dom->ptp & PAGE_MASK)
+		panic("vtd_create_domain: ptp (%p) not page aligned", dom->ptp);
+
+#ifdef __FreeBSD__
+#ifdef notyet
+	/*
+	 * XXX superpage mappings for the iommu do not work correctly.
+	 *
+	 * By default all physical memory is mapped into the host_domain.
+	 * When a VM is allocated wired memory the pages belonging to it
+	 * are removed from the host_domain and added to the vm's domain.
+	 *
+	 * If the page being removed was mapped using a superpage mapping
+	 * in the host_domain then we need to demote the mapping before
+	 * removing the page.
+	 *
+	 * There is not any code to deal with the demotion at the moment
+	 * so we disable superpage mappings altogether.
+	 */
+	dom->spsmask = VTD_CAP_SPS(vtdmap->cap);
+#endif
+#else
+	/*
+	 * On illumos we decidedly do not remove memory mapped to a VM's domain
+	 * from the host_domain, so we don't have to deal with page demotion and
+	 * can just use large pages.
+	 *
+	 * Since VM memory is currently allocated as 4k pages and mapped into
+	 * the VM domain page by page, the use of large pages is essentially
+	 * limited to the host_domain.
+	 */
+	dom->spsmask = VTD_CAP_SPS(vtdmap->cap);
+#endif
+
+	SLIST_INSERT_HEAD(&domhead, dom, next);
+
+	return (dom);
+}
+
+static void
+vtd_free_ptp(uint64_t *ptp, int level)
+{
+	int i;
+	uint64_t *nlp;
+
+	if (level > 1) {
+		for (i = 0; i < 512; i++) {
+			if ((ptp[i] & (VTD_PTE_RD | VTD_PTE_WR)) == 0)
+				continue;
+			if ((ptp[i] & VTD_PTE_SUPERPAGE) != 0)
+				continue;
+			nlp = (uint64_t *)PHYS_TO_DMAP(ptp[i] & VTD_PTE_ADDR_M);
+			vtd_free_ptp(nlp, level - 1);
+		}
+	}
+
+	bzero(ptp, PAGE_SIZE);
+	free(ptp, M_VTD);
+}
+
+static void
+vtd_destroy_domain(void *arg)
+{
+	struct domain *dom;
+	
+	dom = arg;
+
+	SLIST_REMOVE(&domhead, dom, domain, next);
+	vtd_free_ptp(dom->ptp, dom->pt_levels);
+	free(dom, M_VTD);
+}
+
+struct iommu_ops iommu_ops_intel = {
+	vtd_init,
+	vtd_cleanup,
+	vtd_enable,
+	vtd_disable,
+	vtd_create_domain,
+	vtd_destroy_domain,
+	vtd_create_mapping,
+	vtd_remove_mapping,
+	vtd_add_device,
+	vtd_remove_device,
+	vtd_invalidate_tlb,
+};
diff --git a/usr/src/uts/i86pc/io/vmm/intel/vtd_sol.c b/usr/src/uts/i86pc/io/vmm/intel/vtd_sol.c
new file mode 100644
index 0000000000..1dbe8ffa48
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/intel/vtd_sol.c
@@ -0,0 +1,83 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/sunndi.h>
+#include <contrib/dev/acpica/include/acpi.h>
+
+dev_info_t *
+vtd_get_dip(ACPI_DMAR_HARDWARE_UNIT *drhd, int unit)
+{
+	dev_info_t *dip;
+	struct ddi_parent_private_data *pdptr;
+	struct regspec reg;
+	int circ;
+
+	/*
+	 * Try to find an existing devinfo node for this vtd unit.
+	 */
+	ndi_devi_enter(ddi_root_node(), &circ);
+	dip = ddi_find_devinfo("vtd", unit, 0);
+	ndi_devi_exit(ddi_root_node(), circ);
+
+	if (dip != NULL)
+		return (dip);
+
+	/*
+	 * None found, construct a devinfo node for this vtd unit.
+	 */
+	dip = ddi_add_child(ddi_root_node(), "vtd",
+	    DEVI_SID_NODEID, unit);
+
+	reg.regspec_bustype = 0;
+	reg.regspec_addr = drhd->Address;
+	reg.regspec_size = PAGE_SIZE;
+
+	/*
+	 * update the reg properties
+	 *
+	 *   reg property will be used for register
+	 *   set access
+	 *
+	 * refer to the bus_map of root nexus driver
+	 * I/O or memory mapping:
+	 *
+	 * <bustype=0, addr=x, len=x>: memory
+	 * <bustype=1, addr=x, len=x>: i/o
+	 * <bustype>1, addr=0, len=x>: x86-compatibility i/o
+	 */
+	(void) ndi_prop_update_int_array(DDI_DEV_T_NONE,
+	    dip, "reg", (int *)&reg,
+	    sizeof (struct regspec) / sizeof (int));
+
+	/*
+	 * This is an artificially constructed dev_info, and we
+	 * need to set a few more things to be able to use it
+	 * for ddi_dma_alloc_handle/free_handle.
+	 */
+	ddi_set_driver(dip, ddi_get_driver(ddi_root_node()));
+	DEVI(dip)->devi_bus_dma_allochdl =
+	    DEVI(ddi_get_driver((ddi_root_node())));
+
+	pdptr = kmem_zalloc(sizeof (struct ddi_parent_private_data)
+	    + sizeof (struct regspec), KM_SLEEP);
+	pdptr->par_nreg = 1;
+	pdptr->par_reg = (struct regspec *)(pdptr + 1);
+	pdptr->par_reg->regspec_bustype = 0;
+	pdptr->par_reg->regspec_addr = drhd->Address;
+	pdptr->par_reg->regspec_size = PAGE_SIZE;
+	ddi_set_parent_data(dip, pdptr);
+
+	return (dip);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/io/iommu.c b/usr/src/uts/i86pc/io/vmm/io/iommu.c
new file mode 100644
index 0000000000..5f686d3c62
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/iommu.c
@@ -0,0 +1,383 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/bus.h>
+#include <sys/sysctl.h>
+
+#include <dev/pci/pcivar.h>
+#include <dev/pci/pcireg.h>
+
+#include <machine/cpu.h>
+#include <machine/md_var.h>
+
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/pci.h>
+
+#include "vmm_util.h"
+#include "vmm_mem.h"
+#include "iommu.h"
+
+SYSCTL_DECL(_hw_vmm);
+SYSCTL_NODE(_hw_vmm, OID_AUTO, iommu, CTLFLAG_RW, 0, "bhyve iommu parameters");
+
+static int iommu_avail;
+SYSCTL_INT(_hw_vmm_iommu, OID_AUTO, initialized, CTLFLAG_RD, &iommu_avail,
+    0, "bhyve iommu initialized?");
+
+static int iommu_enable = 1;
+SYSCTL_INT(_hw_vmm_iommu, OID_AUTO, enable, CTLFLAG_RDTUN, &iommu_enable, 0,
+    "Enable use of I/O MMU (required for PCI passthrough).");
+
+static struct iommu_ops *ops;
+static void *host_domain;
+#ifdef __FreeBSD__
+static eventhandler_tag add_tag, delete_tag;
+#endif
+
+#ifndef __FreeBSD__
+static volatile u_int iommu_initted;
+#endif
+
+static __inline int
+IOMMU_INIT(void)
+{
+	if (ops != NULL)
+		return ((*ops->init)());
+	else
+		return (ENXIO);
+}
+
+static __inline void
+IOMMU_CLEANUP(void)
+{
+	if (ops != NULL && iommu_avail)
+		(*ops->cleanup)();
+}
+
+static __inline void *
+IOMMU_CREATE_DOMAIN(vm_paddr_t maxaddr)
+{
+
+	if (ops != NULL && iommu_avail)
+		return ((*ops->create_domain)(maxaddr));
+	else
+		return (NULL);
+}
+
+static __inline void
+IOMMU_DESTROY_DOMAIN(void *dom)
+{
+
+	if (ops != NULL && iommu_avail)
+		(*ops->destroy_domain)(dom);
+}
+
+static __inline uint64_t
+IOMMU_CREATE_MAPPING(void *domain, vm_paddr_t gpa, vm_paddr_t hpa, uint64_t len)
+{
+
+	if (ops != NULL && iommu_avail)
+		return ((*ops->create_mapping)(domain, gpa, hpa, len));
+	else
+		return (len);		/* XXX */
+}
+
+static __inline uint64_t
+IOMMU_REMOVE_MAPPING(void *domain, vm_paddr_t gpa, uint64_t len)
+{
+
+	if (ops != NULL && iommu_avail)
+		return ((*ops->remove_mapping)(domain, gpa, len));
+	else
+		return (len);		/* XXX */
+}
+
+static __inline void
+IOMMU_ADD_DEVICE(void *domain, uint16_t rid)
+{
+
+	if (ops != NULL && iommu_avail)
+		(*ops->add_device)(domain, rid);
+}
+
+static __inline void
+IOMMU_REMOVE_DEVICE(void *domain, uint16_t rid)
+{
+
+	if (ops != NULL && iommu_avail)
+		(*ops->remove_device)(domain, rid);
+}
+
+static __inline void
+IOMMU_INVALIDATE_TLB(void *domain)
+{
+
+	if (ops != NULL && iommu_avail)
+		(*ops->invalidate_tlb)(domain);
+}
+
+static __inline void
+IOMMU_ENABLE(void)
+{
+
+	if (ops != NULL && iommu_avail)
+		(*ops->enable)();
+}
+
+static __inline void
+IOMMU_DISABLE(void)
+{
+
+	if (ops != NULL && iommu_avail)
+		(*ops->disable)();
+}
+
+#ifdef __FreeBSD__
+static void
+iommu_pci_add(void *arg, device_t dev)
+{
+
+	/* Add new devices to the host domain. */
+	iommu_add_device(host_domain, pci_get_rid(dev));
+}
+
+static void
+iommu_pci_delete(void *arg, device_t dev)
+{
+
+	iommu_remove_device(host_domain, pci_get_rid(dev));
+}
+#endif
+
+#ifndef __FreeBSD__
+static int
+iommu_find_device(dev_info_t *dip, void *arg)
+{
+	boolean_t add = (boolean_t)arg;
+
+	if (pcie_is_pci_device(dip)) {
+		if (add)
+			iommu_add_device(host_domain, pci_get_rid(dip));
+		else
+			iommu_remove_device(host_domain, pci_get_rid(dip));
+	}
+
+	return (DDI_WALK_CONTINUE);
+}
+#endif
+
+static void
+iommu_init(void)
+{
+	int error, bus, slot, func;
+	vm_paddr_t maxaddr;
+#ifdef __FreeBSD__
+	devclass_t dc;
+#endif
+	device_t dev;
+
+	if (!iommu_enable)
+		return;
+
+	if (vmm_is_intel())
+		ops = &iommu_ops_intel;
+	else if (vmm_is_amd())
+		ops = &iommu_ops_amd;
+	else
+		ops = NULL;
+
+	error = IOMMU_INIT();
+	if (error)
+		return;
+
+	iommu_avail = 1;
+
+	/*
+	 * Create a domain for the devices owned by the host
+	 */
+	maxaddr = vmm_mem_maxaddr();
+	host_domain = IOMMU_CREATE_DOMAIN(maxaddr);
+	if (host_domain == NULL) {
+		printf("iommu_init: unable to create a host domain");
+		IOMMU_CLEANUP();
+		ops = NULL;
+		iommu_avail = 0;
+		return;
+	}
+
+	/*
+	 * Create 1:1 mappings from '0' to 'maxaddr' for devices assigned to
+	 * the host
+	 */
+	iommu_create_mapping(host_domain, 0, 0, maxaddr);
+
+#ifdef __FreeBSD__
+	add_tag = EVENTHANDLER_REGISTER(pci_add_device, iommu_pci_add, NULL, 0);
+	delete_tag = EVENTHANDLER_REGISTER(pci_delete_device, iommu_pci_delete,
+	    NULL, 0);
+	dc = devclass_find("ppt");
+	for (bus = 0; bus <= PCI_BUSMAX; bus++) {
+		for (slot = 0; slot <= PCI_SLOTMAX; slot++) {
+			for (func = 0; func <= PCI_FUNCMAX; func++) {
+				dev = pci_find_dbsf(0, bus, slot, func);
+				if (dev == NULL)
+					continue;
+
+				/* Skip passthrough devices. */
+				if (dc != NULL &&
+				    device_get_devclass(dev) == dc)
+					continue;
+
+				/*
+				 * Everything else belongs to the host
+				 * domain.
+				 */
+				iommu_add_device(host_domain,
+				    pci_get_rid(dev));
+			}
+		}
+	}
+#else
+	ddi_walk_devs(ddi_root_node(), iommu_find_device, (void *)B_TRUE);
+#endif
+	IOMMU_ENABLE();
+
+}
+
+void
+iommu_cleanup(void)
+{
+#ifdef __FreeBSD__
+	if (add_tag != NULL) {
+		EVENTHANDLER_DEREGISTER(pci_add_device, add_tag);
+		add_tag = NULL;
+	}
+	if (delete_tag != NULL) {
+		EVENTHANDLER_DEREGISTER(pci_delete_device, delete_tag);
+		delete_tag = NULL;
+	}
+#else
+	atomic_store_rel_int(&iommu_initted, 0);
+#endif
+	IOMMU_DISABLE();
+#ifndef __FreeBSD__
+	ddi_walk_devs(ddi_root_node(), iommu_find_device, (void *)B_FALSE);
+#endif
+	IOMMU_DESTROY_DOMAIN(host_domain);
+	IOMMU_CLEANUP();
+#ifndef __FreeBSD__
+	ops = NULL;
+#endif
+}
+
+void *
+iommu_create_domain(vm_paddr_t maxaddr)
+{
+	if (iommu_initted < 2) {
+		if (atomic_cmpset_int(&iommu_initted, 0, 1)) {
+			iommu_init();
+			atomic_store_rel_int(&iommu_initted, 2);
+		} else
+			while (iommu_initted == 1)
+				cpu_spinwait();
+	}
+	return (IOMMU_CREATE_DOMAIN(maxaddr));
+}
+
+void
+iommu_destroy_domain(void *dom)
+{
+
+	IOMMU_DESTROY_DOMAIN(dom);
+}
+
+void
+iommu_create_mapping(void *dom, vm_paddr_t gpa, vm_paddr_t hpa, size_t len)
+{
+	uint64_t mapped, remaining;
+
+	remaining = len;
+
+	while (remaining > 0) {
+		mapped = IOMMU_CREATE_MAPPING(dom, gpa, hpa, remaining);
+		gpa += mapped;
+		hpa += mapped;
+		remaining -= mapped;
+	}
+}
+
+void
+iommu_remove_mapping(void *dom, vm_paddr_t gpa, size_t len)
+{
+	uint64_t unmapped, remaining;
+
+	remaining = len;
+
+	while (remaining > 0) {
+		unmapped = IOMMU_REMOVE_MAPPING(dom, gpa, remaining);
+		gpa += unmapped;
+		remaining -= unmapped;
+	}
+}
+
+void *
+iommu_host_domain(void)
+{
+
+	return (host_domain);
+}
+
+void
+iommu_add_device(void *dom, uint16_t rid)
+{
+
+	IOMMU_ADD_DEVICE(dom, rid);
+}
+
+void
+iommu_remove_device(void *dom, uint16_t rid)
+{
+
+	IOMMU_REMOVE_DEVICE(dom, rid);
+}
+
+void
+iommu_invalidate_tlb(void *domain)
+{
+
+	IOMMU_INVALIDATE_TLB(domain);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/io/iommu.h b/usr/src/uts/i86pc/io/vmm/io/iommu.h
new file mode 100644
index 0000000000..f8003a5d45
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/iommu.h
@@ -0,0 +1,76 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _IO_IOMMU_H_
+#define	_IO_IOMMU_H_
+
+typedef int (*iommu_init_func_t)(void);
+typedef void (*iommu_cleanup_func_t)(void);
+typedef void (*iommu_enable_func_t)(void);
+typedef void (*iommu_disable_func_t)(void);
+typedef void *(*iommu_create_domain_t)(vm_paddr_t maxaddr);
+typedef void (*iommu_destroy_domain_t)(void *domain);
+typedef uint64_t (*iommu_create_mapping_t)(void *domain, vm_paddr_t gpa,
+					   vm_paddr_t hpa, uint64_t len);
+typedef uint64_t (*iommu_remove_mapping_t)(void *domain, vm_paddr_t gpa,
+					   uint64_t len);
+typedef void (*iommu_add_device_t)(void *domain, uint16_t rid);
+typedef void (*iommu_remove_device_t)(void *dom, uint16_t rid);
+typedef void (*iommu_invalidate_tlb_t)(void *dom);
+
+struct iommu_ops {
+	iommu_init_func_t	init;		/* module wide */
+	iommu_cleanup_func_t	cleanup;
+	iommu_enable_func_t	enable;
+	iommu_disable_func_t	disable;
+
+	iommu_create_domain_t	create_domain;	/* domain-specific */
+	iommu_destroy_domain_t	destroy_domain;
+	iommu_create_mapping_t	create_mapping;
+	iommu_remove_mapping_t	remove_mapping;
+	iommu_add_device_t	add_device;
+	iommu_remove_device_t	remove_device;
+	iommu_invalidate_tlb_t	invalidate_tlb;
+};
+
+extern struct iommu_ops iommu_ops_intel;
+extern struct iommu_ops iommu_ops_amd;
+
+void	iommu_cleanup(void);
+void	*iommu_host_domain(void);
+void	*iommu_create_domain(vm_paddr_t maxaddr);
+void	iommu_destroy_domain(void *dom);
+void	iommu_create_mapping(void *dom, vm_paddr_t gpa, vm_paddr_t hpa,
+			     size_t len);
+void	iommu_remove_mapping(void *dom, vm_paddr_t gpa, size_t len);
+void	iommu_add_device(void *dom, uint16_t rid);
+void	iommu_remove_device(void *dom, uint16_t rid);
+void	iommu_invalidate_tlb(void *domain);
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/io/ppt.c b/usr/src/uts/i86pc/io/vmm/io/ppt.c
new file mode 100644
index 0000000000..0c5815278e
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/ppt.c
@@ -0,0 +1,1436 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/module.h>
+#include <sys/bus.h>
+#include <sys/pciio.h>
+#include <sys/smp.h>
+#include <sys/sysctl.h>
+
+#include <dev/pci/pcivar.h>
+#include <dev/pci/pcireg.h>
+
+#include <machine/vmm.h>
+#include <machine/vmm_dev.h>
+
+#include <sys/conf.h>
+#include <sys/ddi.h>
+#include <sys/stat.h>
+#include <sys/sunddi.h>
+#include <sys/pci.h>
+#include <sys/pci_cap.h>
+#include <sys/pcie_impl.h>
+#include <sys/ppt_dev.h>
+#include <sys/mkdev.h>
+#include <sys/sysmacros.h>
+
+#include "vmm_lapic.h"
+#include "vmm_ktr.h"
+
+#include "iommu.h"
+#include "ppt.h"
+
+#define	MAX_MSIMSGS	32
+
+/*
+ * If the MSI-X table is located in the middle of a BAR then that MMIO
+ * region gets split into two segments - one segment above the MSI-X table
+ * and the other segment below the MSI-X table - with a hole in place of
+ * the MSI-X table so accesses to it can be trapped and emulated.
+ *
+ * So, allocate a MMIO segment for each BAR register + 1 additional segment.
+ */
+#define	MAX_MMIOSEGS	((PCIR_MAX_BAR_0 + 1) + 1)
+
+struct pptintr_arg {
+	struct pptdev	*pptdev;
+	uint64_t	addr;
+	uint64_t	msg_data;
+};
+
+struct pptseg {
+	vm_paddr_t	gpa;
+	size_t		len;
+	int		wired;
+};
+
+struct pptbar {
+	uint64_t base;
+	uint64_t size;
+	uint_t type;
+	ddi_acc_handle_t io_handle;
+	caddr_t io_ptr;
+};
+
+struct pptdev {
+	dev_info_t		*pptd_dip;
+	list_node_t		pptd_node;
+	ddi_acc_handle_t	pptd_cfg;
+	struct pptbar		pptd_bars[PCI_BASE_NUM];
+	struct vm		*vm;
+	struct pptseg mmio[MAX_MMIOSEGS];
+	struct {
+		int	num_msgs;		/* guest state */
+		boolean_t is_fixed;
+		size_t	inth_sz;
+		ddi_intr_handle_t *inth;
+		struct pptintr_arg arg[MAX_MSIMSGS];
+	} msi;
+
+	struct {
+		int num_msgs;
+		size_t inth_sz;
+		size_t arg_sz;
+		ddi_intr_handle_t *inth;
+		struct pptintr_arg *arg;
+	} msix;
+};
+
+
+static major_t		ppt_major;
+static void		*ppt_state;
+static kmutex_t		pptdev_mtx;
+static list_t		pptdev_list;
+
+#define	PPT_MINOR_NAME	"ppt"
+
+static ddi_device_acc_attr_t ppt_attr = {
+	DDI_DEVICE_ATTR_V0,
+	DDI_NEVERSWAP_ACC,
+	DDI_STORECACHING_OK_ACC,
+	DDI_DEFAULT_ACC
+};
+
+static int
+ppt_open(dev_t *devp, int flag, int otyp, cred_t *cr)
+{
+	/* XXX: require extra privs? */
+	return (0);
+}
+
+#define	BAR_TO_IDX(bar)	(((bar) - PCI_CONF_BASE0) / PCI_BAR_SZ_32)
+#define	BAR_VALID(b)	(			\
+		(b) >= PCI_CONF_BASE0 &&	\
+		(b) <= PCI_CONF_BASE5 &&	\
+		((b) & (PCI_BAR_SZ_32-1)) == 0)
+
+static int
+ppt_ioctl(dev_t dev, int cmd, intptr_t arg, int md, cred_t *cr, int *rv)
+{
+	minor_t minor = getminor(dev);
+	struct pptdev *ppt;
+	void *data = (void *)arg;
+
+	if ((ppt = ddi_get_soft_state(ppt_state, minor)) == NULL) {
+		return (ENOENT);
+	}
+
+	switch (cmd) {
+	case PPT_CFG_READ: {
+		struct ppt_cfg_io cio;
+		ddi_acc_handle_t cfg = ppt->pptd_cfg;
+
+		if (ddi_copyin(data, &cio, sizeof (cio), md) != 0) {
+			return (EFAULT);
+		}
+		switch (cio.pci_width) {
+		case 4:
+			cio.pci_data = pci_config_get32(cfg, cio.pci_off);
+			break;
+		case 2:
+			cio.pci_data = pci_config_get16(cfg, cio.pci_off);
+			break;
+		case 1:
+			cio.pci_data = pci_config_get8(cfg, cio.pci_off);
+			break;
+		default:
+			return (EINVAL);
+		}
+
+		if (ddi_copyout(&cio, data, sizeof (cio), md) != 0) {
+			return (EFAULT);
+		}
+		return (0);
+	}
+	case PPT_CFG_WRITE: {
+		struct ppt_cfg_io cio;
+		ddi_acc_handle_t cfg = ppt->pptd_cfg;
+
+		if (ddi_copyin(data, &cio, sizeof (cio), md) != 0) {
+			return (EFAULT);
+		}
+		switch (cio.pci_width) {
+		case 4:
+			pci_config_put32(cfg, cio.pci_off, cio.pci_data);
+			break;
+		case 2:
+			pci_config_put16(cfg, cio.pci_off, cio.pci_data);
+			break;
+		case 1:
+			pci_config_put8(cfg, cio.pci_off, cio.pci_data);
+			break;
+		default:
+			return (EINVAL);
+		}
+
+		return (0);
+	}
+	case PPT_BAR_QUERY: {
+		struct ppt_bar_query barg;
+		struct pptbar *pbar;
+
+		if (ddi_copyin(data, &barg, sizeof (barg), md) != 0) {
+			return (EFAULT);
+		}
+		if (barg.pbq_baridx >= PCI_BASE_NUM) {
+			return (EINVAL);
+		}
+		pbar = &ppt->pptd_bars[barg.pbq_baridx];
+
+		if (pbar->base == 0 || pbar->size == 0) {
+			return (ENOENT);
+		}
+		barg.pbq_type = pbar->type;
+		barg.pbq_base = pbar->base;
+		barg.pbq_size = pbar->size;
+
+		if (ddi_copyout(&barg, data, sizeof (barg), md) != 0) {
+			return (EFAULT);
+		}
+		return (0);
+	}
+	case PPT_BAR_READ: {
+		struct ppt_bar_io bio;
+		struct pptbar *pbar;
+		void *addr;
+		uint_t rnum;
+		ddi_acc_handle_t cfg;
+
+		if (ddi_copyin(data, &bio, sizeof (bio), md) != 0) {
+			return (EFAULT);
+		}
+		rnum = bio.pbi_bar;
+		if (rnum >= PCI_BASE_NUM) {
+			return (EINVAL);
+		}
+		pbar = &ppt->pptd_bars[rnum];
+		if (pbar->type != PCI_ADDR_IO || pbar->io_handle == NULL) {
+			return (EINVAL);
+		}
+		addr = pbar->io_ptr + bio.pbi_off;
+
+		switch (bio.pbi_width) {
+		case 4:
+			bio.pbi_data = ddi_get32(pbar->io_handle, addr);
+			break;
+		case 2:
+			bio.pbi_data = ddi_get16(pbar->io_handle, addr);
+			break;
+		case 1:
+			bio.pbi_data = ddi_get8(pbar->io_handle, addr);
+			break;
+		default:
+			return (EINVAL);
+		}
+
+		if (ddi_copyout(&bio, data, sizeof (bio), md) != 0) {
+			return (EFAULT);
+		}
+		return (0);
+	}
+	case PPT_BAR_WRITE: {
+		struct ppt_bar_io bio;
+		struct pptbar *pbar;
+		void *addr;
+		uint_t rnum;
+		ddi_acc_handle_t cfg;
+
+		if (ddi_copyin(data, &bio, sizeof (bio), md) != 0) {
+			return (EFAULT);
+		}
+		rnum = bio.pbi_bar;
+		if (rnum >= PCI_BASE_NUM) {
+			return (EINVAL);
+		}
+		pbar = &ppt->pptd_bars[rnum];
+		if (pbar->type != PCI_ADDR_IO || pbar->io_handle == NULL) {
+			return (EINVAL);
+		}
+		addr = pbar->io_ptr + bio.pbi_off;
+
+		switch (bio.pbi_width) {
+		case 4:
+			ddi_put32(pbar->io_handle, addr, bio.pbi_data);
+			break;
+		case 2:
+			ddi_put16(pbar->io_handle, addr, bio.pbi_data);
+			break;
+		case 1:
+			ddi_put8(pbar->io_handle, addr, bio.pbi_data);
+			break;
+		default:
+			return (EINVAL);
+		}
+
+		return (0);
+	}
+
+	default:
+		return (ENOTTY);
+	}
+
+	return (0);
+}
+
+static int
+ppt_find_pba_bar(struct pptdev *ppt)
+{
+	uint16_t base;
+	uint32_t pba_off;
+
+	if (PCI_CAP_LOCATE(ppt->pptd_cfg, PCI_CAP_ID_MSI_X, &base) !=
+	    DDI_SUCCESS)
+		return (-1);
+
+	pba_off = pci_config_get32(ppt->pptd_cfg, base + PCI_MSIX_PBA_OFFSET);
+
+	if (pba_off == PCI_EINVAL32)
+		return (-1);
+
+	return (pba_off & PCI_MSIX_PBA_BIR_MASK);
+}
+
+static int
+ppt_devmap(dev_t dev, devmap_cookie_t dhp, offset_t off, size_t len,
+    size_t *maplen, uint_t model)
+{
+	minor_t minor;
+	struct pptdev *ppt;
+	int err;
+	int bar;
+
+	minor = getminor(dev);
+
+	if ((ppt = ddi_get_soft_state(ppt_state, minor)) == NULL)
+		return (ENXIO);
+
+#ifdef _MULTI_DATAMODEL
+	if (ddi_model_convert_from(model) != DDI_MODEL_NONE)
+		return (ENXIO);
+#endif
+
+	if (off < 0 || off != P2ALIGN(off, PAGESIZE))
+		return (EINVAL);
+
+	if ((bar = ppt_find_pba_bar(ppt)) == -1)
+		return (EINVAL);
+
+	/*
+	 * Add 1 to the BAR number to get the register number used by DDI.
+	 * Register 0 corresponds to PCI config space, the PCI BARs start at 1.
+	 */
+	bar += 1;
+
+	err = devmap_devmem_setup(dhp, ppt->pptd_dip, NULL, bar, off, len,
+	    PROT_USER | PROT_READ | PROT_WRITE, IOMEM_DATA_CACHED, &ppt_attr);
+
+	if (err == DDI_SUCCESS)
+		*maplen = len;
+
+	return (err);
+}
+
+
+static void
+ppt_bar_wipe(struct pptdev *ppt)
+{
+	uint_t i;
+
+	for (i = 0; i < PCI_BASE_NUM; i++) {
+		struct pptbar *pbar = &ppt->pptd_bars[i];
+		if (pbar->type == PCI_ADDR_IO && pbar->io_handle != NULL) {
+			ddi_regs_map_free(&pbar->io_handle);
+		}
+	}
+	bzero(&ppt->pptd_bars, sizeof (ppt->pptd_bars));
+}
+
+static int
+ppt_bar_crawl(struct pptdev *ppt)
+{
+	pci_regspec_t *regs;
+	uint_t rcount, i;
+	int err = 0, rlen;
+
+	if (ddi_getlongprop(DDI_DEV_T_ANY, ppt->pptd_dip, DDI_PROP_DONTPASS,
+	    "assigned-addresses", (caddr_t)&regs, &rlen) != DDI_PROP_SUCCESS) {
+		return (EIO);
+	}
+
+	VERIFY3S(rlen, >, 0);
+	rcount = rlen / sizeof (pci_regspec_t);
+	for (i = 0; i < rcount; i++) {
+		pci_regspec_t *reg = &regs[i];
+		struct pptbar *pbar;
+		uint_t bar, rnum;
+
+		DTRACE_PROBE1(ppt__crawl__reg, pci_regspec_t *, reg);
+		bar = PCI_REG_REG_G(reg->pci_phys_hi);
+		if (!BAR_VALID(bar)) {
+			continue;
+		}
+
+		rnum = BAR_TO_IDX(bar);
+		pbar = &ppt->pptd_bars[rnum];
+		/* is this somehow already populated? */
+		if (pbar->base != 0 || pbar->size != 0) {
+			err = EEXIST;
+			break;
+		}
+
+		pbar->type = reg->pci_phys_hi & PCI_ADDR_MASK;
+		pbar->base = ((uint64_t)reg->pci_phys_mid << 32) |
+		    (uint64_t)reg->pci_phys_low;
+		pbar->size = ((uint64_t)reg->pci_size_hi << 32) |
+		    (uint64_t)reg->pci_size_low;
+		if (pbar->type == PCI_ADDR_IO) {
+			err = ddi_regs_map_setup(ppt->pptd_dip, rnum,
+			    &pbar->io_ptr, 0, 0, &ppt_attr, &pbar->io_handle);
+			if (err != 0) {
+				break;
+			}
+		}
+	}
+	kmem_free(regs, rlen);
+
+	if (err != 0) {
+		ppt_bar_wipe(ppt);
+	}
+	return (err);
+}
+
+static boolean_t
+ppt_bar_verify_mmio(struct pptdev *ppt, uint64_t base, uint64_t size)
+{
+	const uint64_t map_end = base + size;
+
+	/* Zero-length or overflow mappings are not valid */
+	if (map_end <= base) {
+		return (B_FALSE);
+	}
+	/* MMIO bounds should be page-aligned */
+	if ((base & PAGEOFFSET) != 0 || (size & PAGEOFFSET) != 0) {
+		return (B_FALSE);
+	}
+
+	for (uint_t i = 0; i < PCI_BASE_NUM; i++) {
+		const struct pptbar *bar = &ppt->pptd_bars[i];
+		const uint64_t bar_end = bar->base + bar->size;
+
+		/* Only memory BARs can be mapped */
+		if (bar->type != PCI_ADDR_MEM32 &&
+		    bar->type != PCI_ADDR_MEM64) {
+			continue;
+		}
+
+		/* Does the mapping fit within this BAR? */
+		if (base < bar->base || base >= bar_end ||
+		    map_end < bar->base || map_end > bar_end) {
+			continue;
+		}
+
+		/* This BAR satisfies the provided map */
+		return (B_TRUE);
+	}
+	return (B_FALSE);
+}
+
+static int
+ppt_ddi_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	struct pptdev *ppt = NULL;
+	char name[PPT_MAXNAMELEN];
+	int inst;
+
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	inst = ddi_get_instance(dip);
+
+	if (ddi_soft_state_zalloc(ppt_state, inst) != DDI_SUCCESS) {
+		goto fail;
+	}
+	VERIFY(ppt = ddi_get_soft_state(ppt_state, inst));
+	ppt->pptd_dip = dip;
+	ddi_set_driver_private(dip, ppt);
+
+	if (pci_config_setup(dip, &ppt->pptd_cfg) != DDI_SUCCESS) {
+		goto fail;
+	}
+	if (ppt_bar_crawl(ppt) != 0) {
+		goto fail;
+	}
+	if (ddi_create_minor_node(dip, PPT_MINOR_NAME, S_IFCHR, inst,
+	    DDI_PSEUDO, 0) != DDI_SUCCESS) {
+		goto fail;
+	}
+
+	mutex_enter(&pptdev_mtx);
+	list_insert_tail(&pptdev_list, ppt);
+	mutex_exit(&pptdev_mtx);
+
+	return (DDI_SUCCESS);
+
+fail:
+	if (ppt != NULL) {
+		ddi_remove_minor_node(dip, NULL);
+		if (ppt->pptd_cfg != NULL) {
+			pci_config_teardown(&ppt->pptd_cfg);
+		}
+		ppt_bar_wipe(ppt);
+		ddi_soft_state_free(ppt_state, inst);
+	}
+	return (DDI_FAILURE);
+}
+
+static int
+ppt_ddi_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	struct pptdev *ppt;
+	int inst;
+
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	ppt = ddi_get_driver_private(dip);
+	inst = ddi_get_instance(dip);
+
+	ASSERT3P(ddi_get_soft_state(ppt_state, inst), ==, ppt);
+
+	mutex_enter(&pptdev_mtx);
+	if (ppt->vm != NULL) {
+		mutex_exit(&pptdev_mtx);
+		return (DDI_FAILURE);
+	}
+	list_remove(&pptdev_list, ppt);
+	mutex_exit(&pptdev_mtx);
+
+	ddi_remove_minor_node(dip, PPT_MINOR_NAME);
+	ppt_bar_wipe(ppt);
+	pci_config_teardown(&ppt->pptd_cfg);
+	ddi_set_driver_private(dip, NULL);
+	ddi_soft_state_free(ppt_state, inst);
+
+	return (DDI_SUCCESS);
+}
+
+static int
+ppt_ddi_info(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **result)
+{
+	int error = DDI_FAILURE;
+	int inst = getminor((dev_t)arg);
+
+	switch (cmd) {
+	case DDI_INFO_DEVT2DEVINFO: {
+		struct pptdev *ppt = ddi_get_soft_state(ppt_state, inst);
+
+		if (ppt != NULL) {
+			*result = (void *)ppt->pptd_dip;
+			error = DDI_SUCCESS;
+		}
+		break;
+	}
+	case DDI_INFO_DEVT2INSTANCE: {
+		*result = (void *)(uintptr_t)inst;
+		error = DDI_SUCCESS;
+		break;
+	}
+	default:
+		break;
+	}
+	return (error);
+}
+
+static struct cb_ops ppt_cb_ops = {
+	ppt_open,
+	nulldev,	/* close */
+	nodev,		/* strategy */
+	nodev,		/* print */
+	nodev,		/* dump */
+	nodev,		/* read */
+	nodev,		/* write */
+	ppt_ioctl,
+	ppt_devmap,	/* devmap */
+	NULL,		/* mmap */
+	NULL,		/* segmap */
+	nochpoll,	/* poll */
+	ddi_prop_op,
+	NULL,
+	D_NEW | D_MP | D_64BIT | D_DEVMAP,
+	CB_REV
+};
+
+static struct dev_ops ppt_ops = {
+	DEVO_REV,
+	0,
+	ppt_ddi_info,
+	nulldev,	/* identify */
+	nulldev,	/* probe */
+	ppt_ddi_attach,
+	ppt_ddi_detach,
+	nodev,		/* reset */
+	&ppt_cb_ops,
+	(struct bus_ops *)NULL
+};
+
+static struct modldrv modldrv = {
+	&mod_driverops,
+	"ppt",
+	&ppt_ops
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,
+	&modldrv,
+	NULL
+};
+
+int
+_init(void)
+{
+	int error;
+
+	mutex_init(&pptdev_mtx, NULL, MUTEX_DRIVER, NULL);
+	list_create(&pptdev_list, sizeof (struct pptdev),
+	    offsetof(struct pptdev, pptd_node));
+
+	error = ddi_soft_state_init(&ppt_state, sizeof (struct pptdev), 0);
+	if (error) {
+		goto fail;
+	}
+
+	error = mod_install(&modlinkage);
+
+	ppt_major = ddi_name_to_major("ppt");
+fail:
+	if (error) {
+		ddi_soft_state_fini(&ppt_state);
+	}
+	return (error);
+}
+
+int
+_fini(void)
+{
+	int error;
+
+	error = mod_remove(&modlinkage);
+	if (error)
+		return (error);
+	ddi_soft_state_fini(&ppt_state);
+
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
+
+static boolean_t
+ppt_wait_for_pending_txn(dev_info_t *dip, uint_t max_delay_us)
+{
+	uint16_t cap_ptr, devsts;
+	ddi_acc_handle_t hdl;
+
+	if (pci_config_setup(dip, &hdl) != DDI_SUCCESS)
+		return (B_FALSE);
+
+	if (PCI_CAP_LOCATE(hdl, PCI_CAP_ID_PCI_E, &cap_ptr) != DDI_SUCCESS) {
+		pci_config_teardown(&hdl);
+		return (B_FALSE);
+	}
+
+	devsts = PCI_CAP_GET16(hdl, NULL, cap_ptr, PCIE_DEVSTS);
+	while ((devsts & PCIE_DEVSTS_TRANS_PENDING) != 0) {
+		if (max_delay_us == 0) {
+			pci_config_teardown(&hdl);
+			return (B_FALSE);
+		}
+
+		/* Poll once every 100 milliseconds up to the timeout. */
+		if (max_delay_us > 100000) {
+			delay(drv_usectohz(100000));
+			max_delay_us -= 100000;
+		} else {
+			delay(drv_usectohz(max_delay_us));
+			max_delay_us = 0;
+		}
+		devsts = PCI_CAP_GET16(hdl, NULL, cap_ptr, PCIE_DEVSTS);
+	}
+
+	pci_config_teardown(&hdl);
+	return (B_TRUE);
+}
+
+static uint_t
+ppt_max_completion_tmo_us(dev_info_t *dip)
+{
+	uint_t timo = 0;
+	uint16_t cap_ptr;
+	ddi_acc_handle_t hdl;
+	uint_t timo_ranges[] = {	/* timeout ranges */
+		50000,		/* 50ms */
+		100,		/* 100us */
+		10000,		/* 10ms */
+		0,
+		0,
+		55000,		/* 55ms */
+		210000,		/* 210ms */
+		0,
+		0,
+		900000,		/* 900ms */
+		3500000,	/* 3.5s */
+		0,
+		0,
+		13000000,	/* 13s */
+		64000000,	/* 64s */
+		0
+	};
+
+	if (pci_config_setup(dip, &hdl) != DDI_SUCCESS)
+		return (50000); /* default 50ms */
+
+	if (PCI_CAP_LOCATE(hdl, PCI_CAP_ID_PCI_E, &cap_ptr) != DDI_SUCCESS)
+		goto out;
+
+	if ((PCI_CAP_GET16(hdl, NULL, cap_ptr, PCIE_PCIECAP) &
+	    PCIE_PCIECAP_VER_MASK) < PCIE_PCIECAP_VER_2_0)
+		goto out;
+
+	if ((PCI_CAP_GET16(hdl, NULL, cap_ptr, PCIE_DEVCAP2) &
+	    PCIE_DEVCTL2_COM_TO_RANGE_MASK) == 0)
+		goto out;
+
+	timo = timo_ranges[PCI_CAP_GET16(hdl, NULL, cap_ptr, PCIE_DEVCTL2) &
+	    PCIE_DEVCAP2_COM_TO_RANGE_MASK];
+
+out:
+	if (timo == 0)
+		timo = 50000; /* default 50ms */
+
+	pci_config_teardown(&hdl);
+	return (timo);
+}
+
+static boolean_t
+ppt_flr(dev_info_t *dip, boolean_t force)
+{
+	uint16_t cap_ptr, ctl, cmd;
+	ddi_acc_handle_t hdl;
+	uint_t compl_delay = 0, max_delay_us;
+
+	if (pci_config_setup(dip, &hdl) != DDI_SUCCESS)
+		return (B_FALSE);
+
+	if (PCI_CAP_LOCATE(hdl, PCI_CAP_ID_PCI_E, &cap_ptr) != DDI_SUCCESS)
+		goto fail;
+
+	if ((PCI_CAP_GET16(hdl, NULL, cap_ptr, PCIE_DEVCAP) & PCIE_DEVCAP_FLR)
+	    == 0)
+		goto fail;
+
+	max_delay_us = MAX(ppt_max_completion_tmo_us(dip), 10000);
+
+	/*
+	 * Disable busmastering to prevent generation of new transactions while
+	 * waiting for the device to go idle.  If the idle timeout fails, the
+	 * command register is restored which will re-enable busmastering.
+	 */
+	cmd = pci_config_get16(hdl, PCI_CONF_COMM);
+	pci_config_put16(hdl, PCI_CONF_COMM, cmd & ~PCI_COMM_ME);
+	if (!ppt_wait_for_pending_txn(dip, max_delay_us)) {
+		if (!force) {
+			pci_config_put16(hdl, PCI_CONF_COMM, cmd);
+			goto fail;
+		}
+		dev_err(dip, CE_WARN,
+		    "?Resetting with transactions pending after %u us\n",
+		    max_delay_us);
+
+		/*
+		 * Extend the post-FLR delay to cover the maximum Completion
+		 * Timeout delay of anything in flight during the FLR delay.
+		 * Enforce a minimum delay of at least 10ms.
+		 */
+		compl_delay = MAX(10, (ppt_max_completion_tmo_us(dip) / 1000));
+	}
+
+	/* Initiate the reset. */
+	ctl = PCI_CAP_GET16(hdl, NULL, cap_ptr, PCIE_DEVCTL);
+	(void) PCI_CAP_PUT16(hdl, NULL, cap_ptr, PCIE_DEVCTL,
+	    ctl | PCIE_DEVCTL_INITIATE_FLR);
+
+	/* Wait for at least 100ms */
+	delay(drv_usectohz((100 + compl_delay) * 1000));
+
+	pci_config_teardown(&hdl);
+	return (B_TRUE);
+
+fail:
+	/*
+	 * TODO: If the FLR fails for some reason, we should attempt a reset
+	 * using the PCI power management facilities (if possible).
+	 */
+	pci_config_teardown(&hdl);
+	return (B_FALSE);
+}
+
+
+static struct pptdev *
+ppt_findf(int fd)
+{
+	struct pptdev *ppt = NULL;
+	file_t *fp;
+	vattr_t va;
+
+	if ((fp = getf(fd)) == NULL) {
+		return (NULL);
+	}
+
+	va.va_mask = AT_RDEV;
+	if (VOP_GETATTR(fp->f_vnode, &va, NO_FOLLOW, fp->f_cred, NULL) != 0 ||
+	    getmajor(va.va_rdev) != ppt_major)
+		goto fail;
+
+	ppt = ddi_get_soft_state(ppt_state, getminor(va.va_rdev));
+
+	if (ppt != NULL)
+		return (ppt);
+
+fail:
+	releasef(fd);
+	return (NULL);
+}
+
+static void
+ppt_unmap_mmio(struct vm *vm, struct pptdev *ppt)
+{
+	int i;
+	struct pptseg *seg;
+
+	for (i = 0; i < MAX_MMIOSEGS; i++) {
+		seg = &ppt->mmio[i];
+		if (seg->len == 0)
+			continue;
+		(void) vm_unmap_mmio(vm, seg->gpa, seg->len);
+		bzero(seg, sizeof (struct pptseg));
+	}
+}
+
+static void
+ppt_teardown_msi(struct pptdev *ppt)
+{
+	int i;
+
+	if (ppt->msi.num_msgs == 0)
+		return;
+
+	for (i = 0; i < ppt->msi.num_msgs; i++) {
+		int intr_cap;
+
+		(void) ddi_intr_get_cap(ppt->msi.inth[i], &intr_cap);
+		if (intr_cap & DDI_INTR_FLAG_BLOCK)
+			ddi_intr_block_disable(&ppt->msi.inth[i], 1);
+		else
+			ddi_intr_disable(ppt->msi.inth[i]);
+
+		ddi_intr_remove_handler(ppt->msi.inth[i]);
+		ddi_intr_free(ppt->msi.inth[i]);
+
+		ppt->msi.inth[i] = NULL;
+	}
+
+	kmem_free(ppt->msi.inth, ppt->msi.inth_sz);
+	ppt->msi.inth = NULL;
+	ppt->msi.inth_sz = 0;
+	ppt->msi.is_fixed = B_FALSE;
+
+	ppt->msi.num_msgs = 0;
+}
+
+static void
+ppt_teardown_msix_intr(struct pptdev *ppt, int idx)
+{
+	if (ppt->msix.inth != NULL && ppt->msix.inth[idx] != NULL) {
+		int intr_cap;
+
+		(void) ddi_intr_get_cap(ppt->msix.inth[idx], &intr_cap);
+		if (intr_cap & DDI_INTR_FLAG_BLOCK)
+			ddi_intr_block_disable(&ppt->msix.inth[idx], 1);
+		else
+			ddi_intr_disable(ppt->msix.inth[idx]);
+
+		ddi_intr_remove_handler(ppt->msix.inth[idx]);
+	}
+}
+
+static void
+ppt_teardown_msix(struct pptdev *ppt)
+{
+	uint_t i;
+
+	if (ppt->msix.num_msgs == 0)
+		return;
+
+	for (i = 0; i < ppt->msix.num_msgs; i++)
+		ppt_teardown_msix_intr(ppt, i);
+
+	if (ppt->msix.inth) {
+		for (i = 0; i < ppt->msix.num_msgs; i++)
+			ddi_intr_free(ppt->msix.inth[i]);
+		kmem_free(ppt->msix.inth, ppt->msix.inth_sz);
+		ppt->msix.inth = NULL;
+		ppt->msix.inth_sz = 0;
+		kmem_free(ppt->msix.arg, ppt->msix.arg_sz);
+		ppt->msix.arg = NULL;
+		ppt->msix.arg_sz = 0;
+	}
+
+	ppt->msix.num_msgs = 0;
+}
+
+int
+ppt_assigned_devices(struct vm *vm)
+{
+	struct pptdev *ppt;
+	uint_t num = 0;
+
+	mutex_enter(&pptdev_mtx);
+	for (ppt = list_head(&pptdev_list); ppt != NULL;
+	    ppt = list_next(&pptdev_list, ppt)) {
+		if (ppt->vm == vm) {
+			num++;
+		}
+	}
+	mutex_exit(&pptdev_mtx);
+	return (num);
+}
+
+boolean_t
+ppt_is_mmio(struct vm *vm, vm_paddr_t gpa)
+{
+	struct pptdev *ppt = list_head(&pptdev_list);
+
+	/* XXX: this should probably be restructured to avoid the lock */
+	mutex_enter(&pptdev_mtx);
+	for (ppt = list_head(&pptdev_list); ppt != NULL;
+	    ppt = list_next(&pptdev_list, ppt)) {
+		if (ppt->vm != vm) {
+			continue;
+		}
+
+		for (uint_t i = 0; i < MAX_MMIOSEGS; i++) {
+			struct pptseg *seg = &ppt->mmio[i];
+
+			if (seg->len == 0)
+				continue;
+			if (gpa >= seg->gpa && gpa < seg->gpa + seg->len) {
+				mutex_exit(&pptdev_mtx);
+				return (B_TRUE);
+			}
+		}
+	}
+
+	mutex_exit(&pptdev_mtx);
+	return (B_FALSE);
+}
+
+int
+ppt_assign_device(struct vm *vm, int pptfd)
+{
+	struct pptdev *ppt;
+	int err = 0;
+
+	mutex_enter(&pptdev_mtx);
+	ppt = ppt_findf(pptfd);
+	if (ppt == NULL) {
+		mutex_exit(&pptdev_mtx);
+		return (EBADF);
+	}
+
+	/* Only one VM may own a device at any given time */
+	if (ppt->vm != NULL && ppt->vm != vm) {
+		err = EBUSY;
+		goto done;
+	}
+
+	if (pci_save_config_regs(ppt->pptd_dip) != DDI_SUCCESS) {
+		err = EIO;
+		goto done;
+	}
+	ppt_flr(ppt->pptd_dip, B_TRUE);
+
+	/*
+	 * Restore the device state after reset and then perform another save
+	 * so the "pristine" state can be restored when the device is removed
+	 * from the guest.
+	 */
+	if (pci_restore_config_regs(ppt->pptd_dip) != DDI_SUCCESS ||
+	    pci_save_config_regs(ppt->pptd_dip) != DDI_SUCCESS) {
+		err = EIO;
+		goto done;
+	}
+
+	ppt->vm = vm;
+	iommu_remove_device(iommu_host_domain(), pci_get_bdf(ppt->pptd_dip));
+	iommu_add_device(vm_iommu_domain(vm), pci_get_bdf(ppt->pptd_dip));
+	pf_set_passthru(ppt->pptd_dip, B_TRUE);
+
+done:
+	releasef(pptfd);
+	mutex_exit(&pptdev_mtx);
+	return (err);
+}
+
+static void
+ppt_reset_pci_power_state(dev_info_t *dip)
+{
+	ddi_acc_handle_t cfg;
+	uint16_t cap_ptr;
+
+	if (pci_config_setup(dip, &cfg) != DDI_SUCCESS)
+		return;
+
+	if (PCI_CAP_LOCATE(cfg, PCI_CAP_ID_PM, &cap_ptr) == DDI_SUCCESS) {
+		uint16_t val;
+
+		val = PCI_CAP_GET16(cfg, NULL, cap_ptr, PCI_PMCSR);
+		if ((val & PCI_PMCSR_STATE_MASK) != PCI_PMCSR_D0) {
+			val = (val & ~PCI_PMCSR_STATE_MASK) | PCI_PMCSR_D0;
+			(void) PCI_CAP_PUT16(cfg, NULL, cap_ptr, PCI_PMCSR,
+			    val);
+		}
+	}
+
+	pci_config_teardown(&cfg);
+}
+
+static void
+ppt_do_unassign(struct pptdev *ppt)
+{
+	struct vm *vm = ppt->vm;
+
+	ASSERT3P(vm, !=, NULL);
+	ASSERT(MUTEX_HELD(&pptdev_mtx));
+
+
+	ppt_flr(ppt->pptd_dip, B_TRUE);
+
+	/*
+	 * Restore from the state saved during device assignment.
+	 * If the device power state has been altered, that must be remedied
+	 * first, as it will reset register state during the transition.
+	 */
+	ppt_reset_pci_power_state(ppt->pptd_dip);
+	(void) pci_restore_config_regs(ppt->pptd_dip);
+
+	pf_set_passthru(ppt->pptd_dip, B_FALSE);
+
+	ppt_unmap_mmio(vm, ppt);
+	ppt_teardown_msi(ppt);
+	ppt_teardown_msix(ppt);
+	iommu_remove_device(vm_iommu_domain(vm), pci_get_bdf(ppt->pptd_dip));
+	iommu_add_device(iommu_host_domain(), pci_get_bdf(ppt->pptd_dip));
+	ppt->vm = NULL;
+}
+
+int
+ppt_unassign_device(struct vm *vm, int pptfd)
+{
+	struct pptdev *ppt;
+	int err = 0;
+
+	mutex_enter(&pptdev_mtx);
+	ppt = ppt_findf(pptfd);
+	if (ppt == NULL) {
+		mutex_exit(&pptdev_mtx);
+		return (EBADF);
+	}
+
+	/* If this device is not owned by this 'vm' then bail out. */
+	if (ppt->vm != vm) {
+		err = EBUSY;
+		goto done;
+	}
+	ppt_do_unassign(ppt);
+
+done:
+	releasef(pptfd);
+	mutex_exit(&pptdev_mtx);
+	return (err);
+}
+
+int
+ppt_unassign_all(struct vm *vm)
+{
+	struct pptdev *ppt;
+
+	mutex_enter(&pptdev_mtx);
+	for (ppt = list_head(&pptdev_list); ppt != NULL;
+	    ppt = list_next(&pptdev_list, ppt)) {
+		if (ppt->vm == vm) {
+			ppt_do_unassign(ppt);
+		}
+	}
+	mutex_exit(&pptdev_mtx);
+
+	return (0);
+}
+
+int
+ppt_map_mmio(struct vm *vm, int pptfd, vm_paddr_t gpa, size_t len,
+    vm_paddr_t hpa)
+{
+	struct pptdev *ppt;
+	int err = 0;
+
+	mutex_enter(&pptdev_mtx);
+	ppt = ppt_findf(pptfd);
+	if (ppt == NULL) {
+		mutex_exit(&pptdev_mtx);
+		return (EBADF);
+	}
+	if (ppt->vm != vm) {
+		err = EBUSY;
+		goto done;
+	}
+
+	/*
+	 * Ensure that the host-physical range of the requested mapping fits
+	 * within one of the MMIO BARs of the device.
+	 */
+	if (!ppt_bar_verify_mmio(ppt, hpa, len)) {
+		err = EINVAL;
+		goto done;
+	}
+
+	for (uint_t i = 0; i < MAX_MMIOSEGS; i++) {
+		struct pptseg *seg = &ppt->mmio[i];
+
+		if (seg->len == 0) {
+			err = vm_map_mmio(vm, gpa, len, hpa);
+			if (err == 0) {
+				seg->gpa = gpa;
+				seg->len = len;
+			}
+			goto done;
+		}
+	}
+	err = ENOSPC;
+
+done:
+	releasef(pptfd);
+	mutex_exit(&pptdev_mtx);
+	return (err);
+}
+
+static uint_t
+pptintr(caddr_t arg, caddr_t unused)
+{
+	struct pptintr_arg *pptarg = (struct pptintr_arg *)arg;
+	struct pptdev *ppt = pptarg->pptdev;
+
+	if (ppt->vm != NULL) {
+		lapic_intr_msi(ppt->vm, pptarg->addr, pptarg->msg_data);
+	} else {
+		/*
+		 * XXX
+		 * This is not expected to happen - panic?
+		 */
+	}
+
+	/*
+	 * For legacy interrupts give other filters a chance in case
+	 * the interrupt was not generated by the passthrough device.
+	 */
+	return (ppt->msi.is_fixed ? DDI_INTR_UNCLAIMED : DDI_INTR_CLAIMED);
+}
+
+int
+ppt_setup_msi(struct vm *vm, int vcpu, int pptfd, uint64_t addr, uint64_t msg,
+    int numvec)
+{
+	int i, msi_count, intr_type;
+	struct pptdev *ppt;
+	int err = 0;
+
+	if (numvec < 0 || numvec > MAX_MSIMSGS)
+		return (EINVAL);
+
+	mutex_enter(&pptdev_mtx);
+	ppt = ppt_findf(pptfd);
+	if (ppt == NULL) {
+		mutex_exit(&pptdev_mtx);
+		return (EBADF);
+	}
+	if (ppt->vm != vm) {
+		/* Make sure we own this device */
+		err = EBUSY;
+		goto done;
+	}
+
+	/* Free any allocated resources */
+	ppt_teardown_msi(ppt);
+
+	if (numvec == 0) {
+		/* nothing more to do */
+		goto done;
+	}
+
+	if (ddi_intr_get_navail(ppt->pptd_dip, DDI_INTR_TYPE_MSI,
+	    &msi_count) != DDI_SUCCESS) {
+		if (ddi_intr_get_navail(ppt->pptd_dip, DDI_INTR_TYPE_FIXED,
+		    &msi_count) != DDI_SUCCESS) {
+			err = EINVAL;
+			goto done;
+		}
+
+		intr_type = DDI_INTR_TYPE_FIXED;
+		ppt->msi.is_fixed = B_TRUE;
+	} else {
+		intr_type = DDI_INTR_TYPE_MSI;
+	}
+
+	/*
+	 * The device must be capable of supporting the number of vectors
+	 * the guest wants to allocate.
+	 */
+	if (numvec > msi_count) {
+		err = EINVAL;
+		goto done;
+	}
+
+	ppt->msi.inth_sz = numvec * sizeof (ddi_intr_handle_t);
+	ppt->msi.inth = kmem_zalloc(ppt->msi.inth_sz, KM_SLEEP);
+	if (ddi_intr_alloc(ppt->pptd_dip, ppt->msi.inth, intr_type, 0,
+	    numvec, &msi_count, 0) != DDI_SUCCESS) {
+		kmem_free(ppt->msi.inth, ppt->msi.inth_sz);
+		err = EINVAL;
+		goto done;
+	}
+
+	/* Verify that we got as many vectors as the guest requested */
+	if (numvec != msi_count) {
+		ppt_teardown_msi(ppt);
+		err = EINVAL;
+		goto done;
+	}
+
+	/* Set up & enable interrupt handler for each vector. */
+	for (i = 0; i < numvec; i++) {
+		int res, intr_cap = 0;
+
+		ppt->msi.num_msgs = i + 1;
+		ppt->msi.arg[i].pptdev = ppt;
+		ppt->msi.arg[i].addr = addr;
+		ppt->msi.arg[i].msg_data = msg + i;
+
+		if (ddi_intr_add_handler(ppt->msi.inth[i], pptintr,
+		    &ppt->msi.arg[i], NULL) != DDI_SUCCESS)
+			break;
+
+		(void) ddi_intr_get_cap(ppt->msi.inth[i], &intr_cap);
+		if (intr_cap & DDI_INTR_FLAG_BLOCK)
+			res = ddi_intr_block_enable(&ppt->msi.inth[i], 1);
+		else
+			res = ddi_intr_enable(ppt->msi.inth[i]);
+
+		if (res != DDI_SUCCESS)
+			break;
+	}
+	if (i < numvec) {
+		ppt_teardown_msi(ppt);
+		err = ENXIO;
+	}
+
+done:
+	releasef(pptfd);
+	mutex_exit(&pptdev_mtx);
+	return (err);
+}
+
+int
+ppt_setup_msix(struct vm *vm, int vcpu, int pptfd, int idx, uint64_t addr,
+    uint64_t msg, uint32_t vector_control)
+{
+	struct pptdev *ppt;
+	int numvec, alloced;
+	int err = 0;
+
+	mutex_enter(&pptdev_mtx);
+	ppt = ppt_findf(pptfd);
+	if (ppt == NULL) {
+		mutex_exit(&pptdev_mtx);
+		return (EBADF);
+	}
+	/* Make sure we own this device */
+	if (ppt->vm != vm) {
+		err = EBUSY;
+		goto done;
+	}
+
+	/*
+	 * First-time configuration:
+	 * 	Allocate the MSI-X table
+	 *	Allocate the IRQ resources
+	 *	Set up some variables in ppt->msix
+	 */
+	if (ppt->msix.num_msgs == 0) {
+		dev_info_t *dip = ppt->pptd_dip;
+
+		if (ddi_intr_get_navail(dip, DDI_INTR_TYPE_MSIX,
+		    &numvec) != DDI_SUCCESS) {
+			err = EINVAL;
+			goto done;
+		}
+
+		ppt->msix.num_msgs = numvec;
+
+		ppt->msix.arg_sz = numvec * sizeof (ppt->msix.arg[0]);
+		ppt->msix.arg = kmem_zalloc(ppt->msix.arg_sz, KM_SLEEP);
+		ppt->msix.inth_sz = numvec * sizeof (ddi_intr_handle_t);
+		ppt->msix.inth = kmem_zalloc(ppt->msix.inth_sz, KM_SLEEP);
+
+		if (ddi_intr_alloc(dip, ppt->msix.inth, DDI_INTR_TYPE_MSIX, 0,
+		    numvec, &alloced, 0) != DDI_SUCCESS) {
+			kmem_free(ppt->msix.arg, ppt->msix.arg_sz);
+			kmem_free(ppt->msix.inth, ppt->msix.inth_sz);
+			ppt->msix.arg = NULL;
+			ppt->msix.inth = NULL;
+			ppt->msix.arg_sz = ppt->msix.inth_sz = 0;
+			err = EINVAL;
+			goto done;
+		}
+
+		if (numvec != alloced) {
+			ppt_teardown_msix(ppt);
+			err = EINVAL;
+			goto done;
+		}
+	}
+
+	if (idx >= ppt->msix.num_msgs) {
+		err = EINVAL;
+		goto done;
+	}
+
+	if ((vector_control & PCIM_MSIX_VCTRL_MASK) == 0) {
+		int intr_cap, res;
+
+		/* Tear down the IRQ if it's already set up */
+		ppt_teardown_msix_intr(ppt, idx);
+
+		ppt->msix.arg[idx].pptdev = ppt;
+		ppt->msix.arg[idx].addr = addr;
+		ppt->msix.arg[idx].msg_data = msg;
+
+		/* Setup the MSI-X interrupt */
+		if (ddi_intr_add_handler(ppt->msix.inth[idx], pptintr,
+		    &ppt->msix.arg[idx], NULL) != DDI_SUCCESS) {
+			err = ENXIO;
+			goto done;
+		}
+
+		(void) ddi_intr_get_cap(ppt->msix.inth[idx], &intr_cap);
+		if (intr_cap & DDI_INTR_FLAG_BLOCK)
+			res = ddi_intr_block_enable(&ppt->msix.inth[idx], 1);
+		else
+			res = ddi_intr_enable(ppt->msix.inth[idx]);
+
+		if (res != DDI_SUCCESS) {
+			ddi_intr_remove_handler(ppt->msix.inth[idx]);
+			err = ENXIO;
+			goto done;
+		}
+	} else {
+		/* Masked, tear it down if it's already been set up */
+		ppt_teardown_msix_intr(ppt, idx);
+	}
+
+done:
+	releasef(pptfd);
+	mutex_exit(&pptdev_mtx);
+	return (err);
+}
+
+int
+ppt_get_limits(struct vm *vm, int pptfd, int *msilimit, int *msixlimit)
+{
+	struct pptdev *ppt;
+	int err = 0;
+
+	mutex_enter(&pptdev_mtx);
+	ppt = ppt_findf(pptfd);
+	if (ppt == NULL) {
+		mutex_exit(&pptdev_mtx);
+		return (EBADF);
+	}
+	if (ppt->vm != vm) {
+		err = EBUSY;
+		goto done;
+	}
+
+	if (ddi_intr_get_navail(ppt->pptd_dip, DDI_INTR_TYPE_MSI,
+	    msilimit) != DDI_SUCCESS) {
+		*msilimit = -1;
+	}
+	if (ddi_intr_get_navail(ppt->pptd_dip, DDI_INTR_TYPE_MSIX,
+	    msixlimit) != DDI_SUCCESS) {
+		*msixlimit = -1;
+	}
+
+done:
+	releasef(pptfd);
+	mutex_exit(&pptdev_mtx);
+	return (err);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/io/ppt.conf b/usr/src/uts/i86pc/io/vmm/io/ppt.conf
new file mode 100644
index 0000000000..698cecb6f8
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/ppt.conf
@@ -0,0 +1,14 @@
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2017 Joyent, Inc.
+#
+
diff --git a/usr/src/uts/i86pc/io/vmm/io/ppt.h b/usr/src/uts/i86pc/io/vmm/io/ppt.h
new file mode 100644
index 0000000000..979c0e18ac
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/ppt.h
@@ -0,0 +1,51 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _IO_PPT_H_
+#define	_IO_PPT_H_
+
+int ppt_unassign_all(struct vm *vm);
+int ppt_map_mmio(struct vm *vm, int pptfd, vm_paddr_t gpa, size_t len,
+    vm_paddr_t hpa);
+int ppt_setup_msi(struct vm *vm, int vcpu, int pptfd, uint64_t addr,
+    uint64_t msg, int numvec);
+int ppt_setup_msix(struct vm *vm, int vcpu, int pptfd, int idx, uint64_t addr,
+    uint64_t msg, uint32_t vector_control);
+int ppt_assigned_devices(struct vm *vm);
+boolean_t ppt_is_mmio(struct vm *vm, vm_paddr_t gpa);
+int ppt_get_limits(struct vm *vm, int pptfd, int *msilimit, int *msixlimit);
+
+/*
+ * The following functions should never be called directly.
+ * Use 'vm_assign_pptdev()' and 'vm_unassign_pptdev()' instead.
+ */
+int ppt_assign_device(struct vm *vm, int pptfd);
+int ppt_unassign_device(struct vm *vm, int pptfd);
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/io/vatpic.c b/usr/src/uts/i86pc/io/vmm/io/vatpic.c
new file mode 100644
index 0000000000..6e94f5bd9a
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vatpic.c
@@ -0,0 +1,808 @@
+/*-
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/malloc.h>
+#include <sys/mutex.h>
+#include <sys/systm.h>
+
+#include <x86/apicreg.h>
+#include <dev/ic/i8259.h>
+
+#include <machine/vmm.h>
+
+#include "vmm_ktr.h"
+#include "vmm_lapic.h"
+#include "vioapic.h"
+#include "vatpic.h"
+
+static MALLOC_DEFINE(M_VATPIC, "atpic", "bhyve virtual atpic (8259)");
+
+#define	VATPIC_LOCK(vatpic)		mtx_lock_spin(&((vatpic)->mtx))
+#define	VATPIC_UNLOCK(vatpic)		mtx_unlock_spin(&((vatpic)->mtx))
+#define	VATPIC_LOCKED(vatpic)		mtx_owned(&((vatpic)->mtx))
+
+enum irqstate {
+	IRQSTATE_ASSERT,
+	IRQSTATE_DEASSERT,
+	IRQSTATE_PULSE
+};
+
+struct atpic {
+	bool		ready;
+	int		icw_num;
+	int		rd_cmd_reg;
+
+	bool		aeoi;
+	bool		poll;
+	bool		rotate;
+	bool		sfn;		/* special fully-nested mode */
+
+	int		irq_base;
+	uint8_t		request;	/* Interrupt Request Register (IIR) */
+	uint8_t		service;	/* Interrupt Service (ISR) */
+	uint8_t		mask;		/* Interrupt Mask Register (IMR) */
+	uint8_t		smm;		/* special mask mode */
+
+	int		acnt[8];	/* sum of pin asserts and deasserts */
+	int		lowprio;	/* lowest priority irq */
+
+	bool		intr_raised;
+};
+
+struct vatpic {
+	struct vm	*vm;
+	struct mtx	mtx;
+	struct atpic	atpic[2];
+	uint8_t		elc[2];
+};
+
+#define	VATPIC_CTR0(vatpic, fmt)					\
+	VM_CTR0((vatpic)->vm, fmt)
+
+#define	VATPIC_CTR1(vatpic, fmt, a1)					\
+	VM_CTR1((vatpic)->vm, fmt, a1)
+
+#define	VATPIC_CTR2(vatpic, fmt, a1, a2)				\
+	VM_CTR2((vatpic)->vm, fmt, a1, a2)
+
+#define	VATPIC_CTR3(vatpic, fmt, a1, a2, a3)				\
+	VM_CTR3((vatpic)->vm, fmt, a1, a2, a3)
+
+#define	VATPIC_CTR4(vatpic, fmt, a1, a2, a3, a4)			\
+	VM_CTR4((vatpic)->vm, fmt, a1, a2, a3, a4)
+
+/*
+ * Loop over all the pins in priority order from highest to lowest.
+ */
+#define	ATPIC_PIN_FOREACH(pinvar, atpic, tmpvar)			\
+	for (tmpvar = 0, pinvar = (atpic->lowprio + 1) & 0x7;		\
+	    tmpvar < 8;							\
+	    tmpvar++, pinvar = (pinvar + 1) & 0x7)
+
+static void vatpic_set_pinstate(struct vatpic *vatpic, int pin, bool newstate);
+
+static __inline bool
+master_atpic(struct vatpic *vatpic, struct atpic *atpic)
+{
+
+	if (atpic == &vatpic->atpic[0])
+		return (true);
+	else
+		return (false);
+}
+
+static __inline int
+vatpic_get_highest_isrpin(struct atpic *atpic)
+{
+	int bit, pin;
+	int i;
+
+	ATPIC_PIN_FOREACH(pin, atpic, i) {
+                bit = (1 << pin);
+
+		if (atpic->service & bit) {
+			/*
+			 * An IS bit that is masked by an IMR bit will not be
+			 * cleared by a non-specific EOI in Special Mask Mode.
+			 */
+			if (atpic->smm && (atpic->mask & bit) != 0)
+				continue;
+			else
+				return (pin);
+		}
+	}
+
+	return (-1);
+}
+
+static __inline int
+vatpic_get_highest_irrpin(struct atpic *atpic)
+{
+	int serviced;
+	int bit, pin, tmp;
+
+	/*
+	 * In 'Special Fully-Nested Mode' when an interrupt request from
+	 * a slave is in service, the slave is not locked out from the
+	 * master's priority logic.
+	 */
+	serviced = atpic->service;
+	if (atpic->sfn)
+		serviced &= ~(1 << 2);
+
+	/*
+	 * In 'Special Mask Mode', when a mask bit is set in OCW1 it inhibits
+	 * further interrupts at that level and enables interrupts from all
+	 * other levels that are not masked. In other words the ISR has no
+	 * bearing on the levels that can generate interrupts.
+	 */
+	if (atpic->smm)
+		serviced = 0;
+
+	ATPIC_PIN_FOREACH(pin, atpic, tmp) {
+		bit = 1 << pin;
+
+		/*
+		 * If there is already an interrupt in service at the same
+		 * or higher priority then bail.
+		 */
+		if ((serviced & bit) != 0)
+			break;
+
+		/*
+		 * If an interrupt is asserted and not masked then return
+		 * the corresponding 'pin' to the caller.
+		 */
+		if ((atpic->request & bit) != 0 && (atpic->mask & bit) == 0)
+			return (pin);
+	}
+
+	return (-1);
+}
+
+static void
+vatpic_notify_intr(struct vatpic *vatpic)
+{
+	struct atpic *atpic;
+	int pin;
+
+	KASSERT(VATPIC_LOCKED(vatpic), ("vatpic_notify_intr not locked"));
+
+	/*
+	 * First check the slave.
+	 */
+	atpic = &vatpic->atpic[1];
+	if (!atpic->intr_raised &&
+	    (pin = vatpic_get_highest_irrpin(atpic)) != -1) {
+		VATPIC_CTR4(vatpic, "atpic slave notify pin = %d "
+		    "(imr 0x%x irr 0x%x isr 0x%x)", pin,
+		    atpic->mask, atpic->request, atpic->service);
+
+		/*
+		 * Cascade the request from the slave to the master.
+		 */
+		atpic->intr_raised = true;
+		vatpic_set_pinstate(vatpic, 2, true);
+		vatpic_set_pinstate(vatpic, 2, false);
+	} else {
+		VATPIC_CTR3(vatpic, "atpic slave no eligible interrupts "
+		    "(imr 0x%x irr 0x%x isr 0x%x)",
+		    atpic->mask, atpic->request, atpic->service);
+	}
+
+	/*
+	 * Then check the master.
+	 */
+	atpic = &vatpic->atpic[0];
+	if (!atpic->intr_raised &&
+	    (pin = vatpic_get_highest_irrpin(atpic)) != -1) {
+		VATPIC_CTR4(vatpic, "atpic master notify pin = %d "
+		    "(imr 0x%x irr 0x%x isr 0x%x)", pin,
+		    atpic->mask, atpic->request, atpic->service);
+
+		/*
+		 * From Section 3.6.2, "Interrupt Modes", in the
+		 * MPtable Specification, Version 1.4
+		 *
+		 * PIC interrupts are routed to both the Local APIC
+		 * and the I/O APIC to support operation in 1 of 3
+		 * modes.
+		 *
+		 * 1. Legacy PIC Mode: the PIC effectively bypasses
+		 * all APIC components.  In this mode the local APIC is
+		 * disabled and LINT0 is reconfigured as INTR to
+		 * deliver the PIC interrupt directly to the CPU.
+		 *
+		 * 2. Virtual Wire Mode: the APIC is treated as a
+		 * virtual wire which delivers interrupts from the PIC
+		 * to the CPU.  In this mode LINT0 is programmed as
+		 * ExtINT to indicate that the PIC is the source of
+		 * the interrupt.
+		 *
+		 * 3. Virtual Wire Mode via I/O APIC: PIC interrupts are
+		 * fielded by the I/O APIC and delivered to the appropriate
+		 * CPU.  In this mode the I/O APIC input 0 is programmed
+		 * as ExtINT to indicate that the PIC is the source of the
+		 * interrupt.
+		 */
+		atpic->intr_raised = true;
+		lapic_set_local_intr(vatpic->vm, -1, APIC_LVT_LINT0);
+		vioapic_pulse_irq(vatpic->vm, 0);
+	} else {
+		VATPIC_CTR3(vatpic, "atpic master no eligible interrupts "
+		    "(imr 0x%x irr 0x%x isr 0x%x)",
+		    atpic->mask, atpic->request, atpic->service);
+	}
+}
+
+static int
+vatpic_icw1(struct vatpic *vatpic, struct atpic *atpic, uint8_t val)
+{
+	VATPIC_CTR1(vatpic, "atpic icw1 0x%x", val);
+
+	atpic->ready = false;
+
+	atpic->icw_num = 1;
+	atpic->request = 0;
+	atpic->mask = 0;
+	atpic->lowprio = 7;
+	atpic->rd_cmd_reg = 0;
+	atpic->poll = 0;
+	atpic->smm = 0;
+
+	if ((val & ICW1_SNGL) != 0) {
+		VATPIC_CTR0(vatpic, "vatpic cascade mode required");
+		return (-1);
+	}
+
+	if ((val & ICW1_IC4) == 0) {
+		VATPIC_CTR0(vatpic, "vatpic icw4 required");
+		return (-1);
+	}
+
+	atpic->icw_num++;
+
+	return (0);
+}
+
+static int
+vatpic_icw2(struct vatpic *vatpic, struct atpic *atpic, uint8_t val)
+{
+	VATPIC_CTR1(vatpic, "atpic icw2 0x%x", val);
+
+	atpic->irq_base = val & 0xf8;
+
+	atpic->icw_num++;
+
+	return (0);
+}
+
+static int
+vatpic_icw3(struct vatpic *vatpic, struct atpic *atpic, uint8_t val)
+{
+	VATPIC_CTR1(vatpic, "atpic icw3 0x%x", val);
+
+	atpic->icw_num++;
+
+	return (0);
+}
+
+static int
+vatpic_icw4(struct vatpic *vatpic, struct atpic *atpic, uint8_t val)
+{
+	VATPIC_CTR1(vatpic, "atpic icw4 0x%x", val);
+
+	if ((val & ICW4_8086) == 0) {
+		VATPIC_CTR0(vatpic, "vatpic microprocessor mode required");
+		return (-1);
+	}
+
+	if ((val & ICW4_AEOI) != 0)
+		atpic->aeoi = true;
+
+	if ((val & ICW4_SFNM) != 0) {
+		if (master_atpic(vatpic, atpic)) {
+			atpic->sfn = true;
+		} else {
+			VATPIC_CTR1(vatpic, "Ignoring special fully nested "
+			    "mode on slave atpic: %#x", val);
+		}
+	}
+
+	atpic->icw_num = 0;
+	atpic->ready = true;
+
+	return (0);
+}
+
+static int
+vatpic_ocw1(struct vatpic *vatpic, struct atpic *atpic, uint8_t val)
+{
+	VATPIC_CTR1(vatpic, "atpic ocw1 0x%x", val);
+
+	atpic->mask = val & 0xff;
+
+	return (0);
+}
+
+static int
+vatpic_ocw2(struct vatpic *vatpic, struct atpic *atpic, uint8_t val)
+{
+	VATPIC_CTR1(vatpic, "atpic ocw2 0x%x", val);
+
+	atpic->rotate = ((val & OCW2_R) != 0);
+
+	if ((val & OCW2_EOI) != 0) {
+		int isr_bit;
+
+		if ((val & OCW2_SL) != 0) {
+			/* specific EOI */
+			isr_bit = val & 0x7;
+		} else {
+			/* non-specific EOI */
+			isr_bit = vatpic_get_highest_isrpin(atpic);
+		}
+
+		if (isr_bit != -1) {
+			atpic->service &= ~(1 << isr_bit);
+
+			if (atpic->rotate)
+				atpic->lowprio = isr_bit;
+		}
+	} else if ((val & OCW2_SL) != 0 && atpic->rotate == true) {
+		/* specific priority */
+		atpic->lowprio = val & 0x7;
+	}
+
+	return (0);
+}
+
+static int
+vatpic_ocw3(struct vatpic *vatpic, struct atpic *atpic, uint8_t val)
+{
+	VATPIC_CTR1(vatpic, "atpic ocw3 0x%x", val);
+
+	if (val & OCW3_ESMM) {
+		atpic->smm = val & OCW3_SMM ? 1 : 0;
+		VATPIC_CTR2(vatpic, "%s atpic special mask mode %s",
+		    master_atpic(vatpic, atpic) ? "master" : "slave",
+		    atpic->smm ?  "enabled" : "disabled");
+	}
+
+	if (val & OCW3_RR) {
+		/* read register command */
+		atpic->rd_cmd_reg = val & OCW3_RIS;
+
+		/* Polling mode */
+		atpic->poll = ((val & OCW3_P) != 0);
+	}
+
+	return (0);
+}
+
+static void
+vatpic_set_pinstate(struct vatpic *vatpic, int pin, bool newstate)
+{
+	struct atpic *atpic;
+	int oldcnt, newcnt;
+	bool level;
+
+	KASSERT(pin >= 0 && pin < 16,
+	    ("vatpic_set_pinstate: invalid pin number %d", pin));
+	KASSERT(VATPIC_LOCKED(vatpic),
+	    ("vatpic_set_pinstate: vatpic is not locked"));
+
+	atpic = &vatpic->atpic[pin >> 3];
+
+	oldcnt = atpic->acnt[pin & 0x7];
+	if (newstate)
+		atpic->acnt[pin & 0x7]++;
+	else
+		atpic->acnt[pin & 0x7]--;
+	newcnt = atpic->acnt[pin & 0x7];
+
+	if (newcnt < 0) {
+		VATPIC_CTR2(vatpic, "atpic pin%d: bad acnt %d", pin, newcnt);
+	}
+
+	level = ((vatpic->elc[pin >> 3] & (1 << (pin & 0x7))) != 0);
+
+	if ((oldcnt == 0 && newcnt == 1) || (newcnt > 0 && level == true)) {
+		/* rising edge or level */
+		VATPIC_CTR1(vatpic, "atpic pin%d: asserted", pin);
+		atpic->request |= (1 << (pin & 0x7));
+	} else if (oldcnt == 1 && newcnt == 0) {
+		/* falling edge */
+		VATPIC_CTR1(vatpic, "atpic pin%d: deasserted", pin);
+		if (level)
+			atpic->request &= ~(1 << (pin & 0x7));
+	} else {
+		VATPIC_CTR3(vatpic, "atpic pin%d: %s, ignored, acnt %d",
+		    pin, newstate ? "asserted" : "deasserted", newcnt);
+	}
+
+	vatpic_notify_intr(vatpic);
+}
+
+static int
+vatpic_set_irqstate(struct vm *vm, int irq, enum irqstate irqstate)
+{
+	struct vatpic *vatpic;
+	struct atpic *atpic;
+
+	if (irq < 0 || irq > 15)
+		return (EINVAL);
+
+	vatpic = vm_atpic(vm);
+	atpic = &vatpic->atpic[irq >> 3];
+
+	if (atpic->ready == false)
+		return (0);
+
+	VATPIC_LOCK(vatpic);
+	switch (irqstate) {
+	case IRQSTATE_ASSERT:
+		vatpic_set_pinstate(vatpic, irq, true);
+		break;
+	case IRQSTATE_DEASSERT:
+		vatpic_set_pinstate(vatpic, irq, false);
+		break;
+	case IRQSTATE_PULSE:
+		vatpic_set_pinstate(vatpic, irq, true);
+		vatpic_set_pinstate(vatpic, irq, false);
+		break;
+	default:
+		panic("vatpic_set_irqstate: invalid irqstate %d", irqstate);
+	}
+	VATPIC_UNLOCK(vatpic);
+
+	return (0);
+}
+
+int
+vatpic_assert_irq(struct vm *vm, int irq)
+{
+	return (vatpic_set_irqstate(vm, irq, IRQSTATE_ASSERT));
+}
+
+int
+vatpic_deassert_irq(struct vm *vm, int irq)
+{
+	return (vatpic_set_irqstate(vm, irq, IRQSTATE_DEASSERT));
+}
+
+int
+vatpic_pulse_irq(struct vm *vm, int irq)
+{
+	return (vatpic_set_irqstate(vm, irq, IRQSTATE_PULSE));
+}
+
+int
+vatpic_set_irq_trigger(struct vm *vm, int irq, enum vm_intr_trigger trigger)
+{
+	struct vatpic *vatpic;
+
+	if (irq < 0 || irq > 15)
+		return (EINVAL);
+
+	/*
+	 * See comment in vatpic_elc_handler.  These IRQs must be
+	 * edge triggered.
+	 */
+	if (trigger == LEVEL_TRIGGER) {
+		switch (irq) {
+		case 0:
+		case 1:
+		case 2:
+		case 8:
+		case 13:
+			return (EINVAL);
+		}
+	}
+
+	vatpic = vm_atpic(vm);
+
+	VATPIC_LOCK(vatpic);
+
+	if (trigger == LEVEL_TRIGGER)
+		vatpic->elc[irq >> 3] |=  1 << (irq & 0x7);
+	else
+		vatpic->elc[irq >> 3] &=  ~(1 << (irq & 0x7));
+
+	VATPIC_UNLOCK(vatpic);
+
+	return (0);
+}
+
+void
+vatpic_pending_intr(struct vm *vm, int *vecptr)
+{
+	struct vatpic *vatpic;
+	struct atpic *atpic;
+	int pin;
+
+	vatpic = vm_atpic(vm);
+
+	atpic = &vatpic->atpic[0];
+
+	VATPIC_LOCK(vatpic);
+
+	pin = vatpic_get_highest_irrpin(atpic);
+	if (pin == 2) {
+		atpic = &vatpic->atpic[1];
+		pin = vatpic_get_highest_irrpin(atpic);
+	}
+
+	/*
+	 * If there are no pins active at this moment then return the spurious
+	 * interrupt vector instead.
+	 */
+	if (pin == -1)
+		pin = 7;
+
+	KASSERT(pin >= 0 && pin <= 7, ("%s: invalid pin %d", __func__, pin));
+	*vecptr = atpic->irq_base + pin;
+
+	VATPIC_UNLOCK(vatpic);
+}
+
+static void
+vatpic_pin_accepted(struct atpic *atpic, int pin)
+{
+	atpic->intr_raised = false;
+
+	if (atpic->acnt[pin] == 0)
+		atpic->request &= ~(1 << pin);
+
+	if (atpic->aeoi == true) {
+		if (atpic->rotate == true)
+			atpic->lowprio = pin;
+	} else {
+		atpic->service |= (1 << pin);
+	}
+}
+
+void
+vatpic_intr_accepted(struct vm *vm, int vector)
+{
+	struct vatpic *vatpic;
+	int pin;
+
+	vatpic = vm_atpic(vm);
+
+	VATPIC_LOCK(vatpic);
+
+	pin = vector & 0x7;
+
+	if ((vector & ~0x7) == vatpic->atpic[1].irq_base) {
+		vatpic_pin_accepted(&vatpic->atpic[1], pin);
+		/*
+		 * If this vector originated from the slave,
+		 * accept the cascaded interrupt too.
+		 */
+		vatpic_pin_accepted(&vatpic->atpic[0], 2);
+	} else {
+		vatpic_pin_accepted(&vatpic->atpic[0], pin);
+	}
+
+	vatpic_notify_intr(vatpic);
+
+	VATPIC_UNLOCK(vatpic);
+}
+
+static int
+vatpic_read(struct vatpic *vatpic, struct atpic *atpic, bool in, int port,
+	    int bytes, uint32_t *eax)
+{
+	int pin;
+
+	VATPIC_LOCK(vatpic);
+
+	if (atpic->poll) {
+		atpic->poll = 0;
+		pin = vatpic_get_highest_irrpin(atpic);
+		if (pin >= 0) {
+			vatpic_pin_accepted(atpic, pin);
+			*eax = 0x80 | pin;
+		} else {
+			*eax = 0;
+		}
+	} else {
+		if (port & ICU_IMR_OFFSET) {
+			/* read interrrupt mask register */
+			*eax = atpic->mask;
+		} else {
+			if (atpic->rd_cmd_reg == OCW3_RIS) {
+				/* read interrupt service register */
+				*eax = atpic->service;
+			} else {
+				/* read interrupt request register */
+				*eax = atpic->request;
+			}
+		}
+	}
+
+	VATPIC_UNLOCK(vatpic);
+
+	return (0);
+
+}
+
+static int
+vatpic_write(struct vatpic *vatpic, struct atpic *atpic, bool in, int port,
+    int bytes, uint32_t *eax)
+{
+	int error;
+	uint8_t val;
+
+	error = 0;
+	val = *eax;
+
+	VATPIC_LOCK(vatpic);
+
+	if (port & ICU_IMR_OFFSET) {
+		switch (atpic->icw_num) {
+		case 2:
+			error = vatpic_icw2(vatpic, atpic, val);
+			break;
+		case 3:
+			error = vatpic_icw3(vatpic, atpic, val);
+			break;
+		case 4:
+			error = vatpic_icw4(vatpic, atpic, val);
+			break;
+		default:
+			error = vatpic_ocw1(vatpic, atpic, val);
+			break;
+		}
+	} else {
+		if (val & (1 << 4))
+			error = vatpic_icw1(vatpic, atpic, val);
+
+		if (atpic->ready) {
+			if (val & (1 << 3))
+				error = vatpic_ocw3(vatpic, atpic, val);
+			else
+				error = vatpic_ocw2(vatpic, atpic, val);
+		}
+	}
+
+	if (atpic->ready)
+		vatpic_notify_intr(vatpic);
+
+	VATPIC_UNLOCK(vatpic);
+
+	return (error);
+}
+
+int
+vatpic_master_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *eax)
+{
+	struct vatpic *vatpic;
+	struct atpic *atpic;
+
+	vatpic = vm_atpic(vm);
+	atpic = &vatpic->atpic[0];
+
+	if (bytes != 1)
+		return (-1);
+ 
+	if (in) {
+		return (vatpic_read(vatpic, atpic, in, port, bytes, eax));
+	}
+ 
+	return (vatpic_write(vatpic, atpic, in, port, bytes, eax));
+}
+
+int
+vatpic_slave_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *eax)
+{
+	struct vatpic *vatpic;
+	struct atpic *atpic;
+
+	vatpic = vm_atpic(vm);
+	atpic = &vatpic->atpic[1];
+
+	if (bytes != 1)
+		return (-1);
+
+	if (in) {
+		return (vatpic_read(vatpic, atpic, in, port, bytes, eax));
+	}
+
+	return (vatpic_write(vatpic, atpic, in, port, bytes, eax));
+}
+
+int
+vatpic_elc_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *eax)
+{
+	struct vatpic *vatpic;
+	bool is_master;
+
+	vatpic = vm_atpic(vm);
+	is_master = (port == IO_ELCR1);
+
+	if (bytes != 1)
+		return (-1);
+
+	VATPIC_LOCK(vatpic);
+
+	if (in) {
+		if (is_master)
+			*eax = vatpic->elc[0];
+		else
+			*eax = vatpic->elc[1];
+	} else {
+		/*
+		 * For the master PIC the cascade channel (IRQ2), the
+		 * heart beat timer (IRQ0), and the keyboard
+		 * controller (IRQ1) cannot be programmed for level
+		 * mode.
+		 *
+		 * For the slave PIC the real time clock (IRQ8) and
+		 * the floating point error interrupt (IRQ13) cannot
+		 * be programmed for level mode.
+		 */
+		if (is_master)
+			vatpic->elc[0] = (*eax & 0xf8);
+		else
+			vatpic->elc[1] = (*eax & 0xde);
+	}
+
+	VATPIC_UNLOCK(vatpic);
+
+	return (0);
+}
+
+struct vatpic *
+vatpic_init(struct vm *vm)
+{
+	struct vatpic *vatpic;
+
+	vatpic = malloc(sizeof(struct vatpic), M_VATPIC, M_WAITOK | M_ZERO);
+	vatpic->vm = vm;
+
+	mtx_init(&vatpic->mtx, "vatpic lock", NULL, MTX_SPIN);
+
+	return (vatpic);
+}
+
+void
+vatpic_cleanup(struct vatpic *vatpic)
+{
+	free(vatpic, M_VATPIC);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/io/vatpic.h b/usr/src/uts/i86pc/io/vmm/io/vatpic.h
new file mode 100644
index 0000000000..d4a1be1820
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vatpic.h
@@ -0,0 +1,57 @@
+/*-
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VATPIC_H_
+#define	_VATPIC_H_
+
+#include <isa/isareg.h>
+
+#define	ICU_IMR_OFFSET	1
+
+#define	IO_ELCR1	0x4d0
+#define	IO_ELCR2	0x4d1
+
+struct vatpic *vatpic_init(struct vm *vm);
+void vatpic_cleanup(struct vatpic *vatpic);
+
+int vatpic_master_handler(struct vm *vm, int vcpuid, bool in, int port,
+    int bytes, uint32_t *eax);
+int vatpic_slave_handler(struct vm *vm, int vcpuid, bool in, int port,
+    int bytes, uint32_t *eax);
+int vatpic_elc_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *eax);
+
+int vatpic_assert_irq(struct vm *vm, int irq);
+int vatpic_deassert_irq(struct vm *vm, int irq);
+int vatpic_pulse_irq(struct vm *vm, int irq);
+int vatpic_set_irq_trigger(struct vm *vm, int irq, enum vm_intr_trigger trigger);
+
+void vatpic_pending_intr(struct vm *vm, int *vecptr);
+void vatpic_intr_accepted(struct vm *vm, int vector);
+
+#endif	/* _VATPIC_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vatpit.c b/usr/src/uts/i86pc/io/vmm/io/vatpit.c
new file mode 100644
index 0000000000..9b3e7376d5
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vatpit.c
@@ -0,0 +1,487 @@
+/*-
+ * Copyright (c) 2018 Joyent, Inc.
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/malloc.h>
+#include <sys/mutex.h>
+#include <sys/systm.h>
+
+#include <machine/vmm.h>
+
+#include "vmm_ktr.h"
+#include "vatpic.h"
+#include "vioapic.h"
+#include "vatpit.h"
+
+static MALLOC_DEFINE(M_VATPIT, "atpit", "bhyve virtual atpit (8254)");
+
+#define	VATPIT_LOCK(vatpit)		mtx_lock_spin(&((vatpit)->mtx))
+#define	VATPIT_UNLOCK(vatpit)		mtx_unlock_spin(&((vatpit)->mtx))
+#define	VATPIT_LOCKED(vatpit)		mtx_owned(&((vatpit)->mtx))
+
+#define	TIMER_SEL_MASK		0xc0
+#define	TIMER_RW_MASK		0x30
+#define	TIMER_MODE_MASK		0x0f
+#define	TIMER_SEL_READBACK	0xc0
+
+#define	TIMER_STS_OUT		0x80
+#define	TIMER_STS_NULLCNT	0x40
+
+#define	TIMER_RB_LCTR		0x20
+#define	TIMER_RB_LSTATUS	0x10
+#define	TIMER_RB_CTR_2		0x08
+#define	TIMER_RB_CTR_1		0x04
+#define	TIMER_RB_CTR_0		0x02
+
+#define	TMR2_OUT_STS		0x20
+
+#define	PIT_8254_FREQ		1193182
+#define	TIMER_DIV(freq, hz)	(((freq) + (hz) / 2) / (hz))
+
+struct vatpit_callout_arg {
+	struct vatpit	*vatpit;
+	int		channel_num;
+};
+
+
+struct channel {
+	int		mode;
+	uint16_t	initial;	/* initial counter value */
+	struct bintime	now_bt;		/* uptime when counter was loaded */
+	uint8_t		cr[2];
+	uint8_t		ol[2];
+	bool		slatched;	/* status latched */
+	uint8_t		status;
+	int		crbyte;
+	int		olbyte;
+	int		frbyte;
+	struct callout	callout;
+	struct bintime	callout_bt;	/* target time */
+	struct vatpit_callout_arg callout_arg;
+};
+
+struct vatpit {
+	struct vm	*vm;
+	struct mtx	mtx;
+
+	struct bintime	freq_bt;
+
+	struct channel	channel[3];
+};
+
+static void pit_timer_start_cntr0(struct vatpit *vatpit);
+
+static uint64_t
+vatpit_delta_ticks(struct vatpit *vatpit, struct channel *c)
+{
+	struct bintime delta;
+	uint64_t result;
+
+	binuptime(&delta);
+	bintime_sub(&delta, &c->now_bt);
+
+	result = delta.sec * PIT_8254_FREQ;
+	result += delta.frac / vatpit->freq_bt.frac;
+
+	return (result);
+}
+
+static int
+vatpit_get_out(struct vatpit *vatpit, int channel)
+{
+	struct channel *c;
+	uint64_t delta_ticks;
+	int out;
+
+	c = &vatpit->channel[channel];
+
+	switch (c->mode) {
+	case TIMER_INTTC:
+		delta_ticks = vatpit_delta_ticks(vatpit, c);
+		out = (delta_ticks >= c->initial);
+		break;
+	default:
+		out = 0;
+		break;
+	}
+
+	return (out);
+}
+
+static void
+vatpit_callout_handler(void *a)
+{
+	struct vatpit_callout_arg *arg = a;
+	struct vatpit *vatpit;
+	struct callout *callout;
+	struct channel *c;
+
+	vatpit = arg->vatpit;
+	c = &vatpit->channel[arg->channel_num];
+	callout = &c->callout;
+
+	VM_CTR1(vatpit->vm, "atpit t%d fired", arg->channel_num);
+
+	VATPIT_LOCK(vatpit);
+
+	if (callout_pending(callout))		/* callout was reset */
+		goto done;
+
+	if (!callout_active(callout))		/* callout was stopped */
+		goto done;
+
+	callout_deactivate(callout);
+
+	if (c->mode == TIMER_RATEGEN) {
+		pit_timer_start_cntr0(vatpit);
+	}
+
+	vatpic_pulse_irq(vatpit->vm, 0);
+	vioapic_pulse_irq(vatpit->vm, 2);
+
+done:
+	VATPIT_UNLOCK(vatpit);
+	return;
+}
+
+static void
+pit_timer_start_cntr0(struct vatpit *vatpit)
+{
+	struct channel *c;
+
+	c = &vatpit->channel[0];
+	if (c->initial != 0) {
+		sbintime_t precision;
+		struct bintime now, delta;
+
+		delta.sec = 0;
+		delta.frac = vatpit->freq_bt.frac * c->initial;
+		bintime_add(&c->callout_bt, &delta);
+		precision = bttosbt(delta) >> tc_precexp;
+
+		/*
+		 * Reset 'callout_bt' if the time that the callout was supposed
+		 * to fire is more than 'c->initial' ticks in the past.
+		 */
+		binuptime(&now);
+		if (bintime_cmp(&c->callout_bt, &now, <)) {
+			c->callout_bt = now;
+			bintime_add(&c->callout_bt, &delta);
+		}
+
+		callout_reset_sbt(&c->callout, bttosbt(c->callout_bt),
+		    precision, vatpit_callout_handler, &c->callout_arg,
+		    C_ABSOLUTE);
+	}
+}
+
+static uint16_t
+pit_update_counter(struct vatpit *vatpit, struct channel *c, bool latch)
+{
+	uint16_t lval;
+	uint64_t delta_ticks;
+
+	/* cannot latch a new value until the old one has been consumed */
+	if (latch && c->olbyte != 0)
+		return (0);
+
+	if (c->initial == 0) {
+		/*
+		 * This is possibly an o/s bug - reading the value of
+		 * the timer without having set up the initial value.
+		 *
+		 * The original user-space version of this code set
+		 * the timer to 100hz in this condition; do the same
+		 * here.
+		 */
+		c->initial = TIMER_DIV(PIT_8254_FREQ, 100);
+		binuptime(&c->now_bt);
+		c->status &= ~TIMER_STS_NULLCNT;
+	}
+
+	delta_ticks = vatpit_delta_ticks(vatpit, c);
+	lval = c->initial - delta_ticks % c->initial;
+
+	if (latch) {
+		c->olbyte = 2;
+		c->ol[1] = lval;		/* LSB */
+		c->ol[0] = lval >> 8;		/* MSB */
+	}
+
+	return (lval);
+}
+
+static int
+pit_readback1(struct vatpit *vatpit, int channel, uint8_t cmd)
+{
+	struct channel *c;
+
+	c = &vatpit->channel[channel];
+
+	/*
+	 * Latch the count/status of the timer if not already latched.
+	 * N.B. that the count/status latch-select bits are active-low.
+	 */
+	if (!(cmd & TIMER_RB_LCTR) && !c->olbyte) {
+		(void) pit_update_counter(vatpit, c, true);
+	}
+
+	if (!(cmd & TIMER_RB_LSTATUS) && !c->slatched) {
+		c->slatched = true;
+		/*
+		 * For mode 0, see if the elapsed time is greater
+		 * than the initial value - this results in the
+		 * output pin being set to 1 in the status byte.
+		 */
+		if (c->mode == TIMER_INTTC && vatpit_get_out(vatpit, channel))
+			c->status |= TIMER_STS_OUT;
+		else
+			c->status &= ~TIMER_STS_OUT;
+	}
+
+	return (0);
+}
+
+static int
+pit_readback(struct vatpit *vatpit, uint8_t cmd)
+{
+	int error;
+
+	/*
+	 * The readback command can apply to all timers.
+	 */
+	error = 0;
+	if (cmd & TIMER_RB_CTR_0)
+		error = pit_readback1(vatpit, 0, cmd);
+	if (!error && cmd & TIMER_RB_CTR_1)
+		error = pit_readback1(vatpit, 1, cmd);
+	if (!error && cmd & TIMER_RB_CTR_2)
+		error = pit_readback1(vatpit, 2, cmd);
+
+	return (error);
+}
+
+
+static int
+vatpit_update_mode(struct vatpit *vatpit, uint8_t val)
+{
+	struct channel *c;
+	int sel, rw, mode;
+
+	sel = val & TIMER_SEL_MASK;
+	rw = val & TIMER_RW_MASK;
+	mode = val & TIMER_MODE_MASK;
+
+	if (sel == TIMER_SEL_READBACK)
+		return (pit_readback(vatpit, val));
+
+	if (rw != TIMER_LATCH && rw != TIMER_16BIT)
+		return (-1);
+
+	if (rw != TIMER_LATCH) {
+		/*
+		 * Counter mode is not affected when issuing a
+		 * latch command.
+		 */
+		if (mode != TIMER_INTTC &&
+		    mode != TIMER_RATEGEN &&
+		    mode != TIMER_SQWAVE &&
+		    mode != TIMER_SWSTROBE)
+			return (-1);
+	}
+
+	c = &vatpit->channel[sel >> 6];
+	if (rw == TIMER_LATCH)
+		pit_update_counter(vatpit, c, true);
+	else {
+		c->mode = mode;
+		c->olbyte = 0;	/* reset latch after reprogramming */
+		c->status |= TIMER_STS_NULLCNT;
+	}
+
+	return (0);
+}
+
+int
+vatpit_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *eax)
+{
+	struct vatpit *vatpit;
+	struct channel *c;
+	uint8_t val;
+	int error;
+
+	vatpit = vm_atpit(vm);
+
+	if (bytes != 1)
+		return (-1);
+
+	val = *eax;
+
+	if (port == TIMER_MODE) {
+		if (in) {
+			VM_CTR0(vatpit->vm, "vatpit attempt to read mode");
+			return (-1);
+		}
+
+		VATPIT_LOCK(vatpit);
+		error = vatpit_update_mode(vatpit, val);
+		VATPIT_UNLOCK(vatpit);
+
+		return (error);
+	}
+
+	/* counter ports */
+	KASSERT(port >= TIMER_CNTR0 && port <= TIMER_CNTR2,
+	    ("invalid port 0x%x", port));
+	c = &vatpit->channel[port - TIMER_CNTR0];
+
+	VATPIT_LOCK(vatpit);
+	if (in && c->slatched) {
+		/*
+		 * Return the status byte if latched
+		 */
+		*eax = c->status;
+		c->slatched = false;
+		c->status = 0;
+	} else if (in) {
+		/*
+		 * The spec says that once the output latch is completely
+		 * read it should revert to "following" the counter. Use
+		 * the free running counter for this case (i.e. Linux
+		 * TSC calibration). Assuming the access mode is 16-bit,
+		 * toggle the MSB/LSB bit on each read.
+		 */
+		if (c->olbyte == 0) {
+			uint16_t tmp;
+
+			tmp = pit_update_counter(vatpit, c, false);
+			if (c->frbyte)
+				tmp >>= 8;
+			tmp &= 0xff;
+			*eax = tmp;
+			c->frbyte ^= 1;
+		}  else
+			*eax = c->ol[--c->olbyte];
+	} else {
+		c->cr[c->crbyte++] = *eax;
+		if (c->crbyte == 2) {
+			c->status &= ~TIMER_STS_NULLCNT;
+			c->frbyte = 0;
+			c->crbyte = 0;
+			c->initial = c->cr[0] | (uint16_t)c->cr[1] << 8;
+			binuptime(&c->now_bt);
+			/* Start an interval timer for channel 0 */
+			if (port == TIMER_CNTR0) {
+				c->callout_bt = c->now_bt;
+				pit_timer_start_cntr0(vatpit);
+			}
+			if (c->initial == 0)
+				c->initial = 0xffff;
+		}
+	}
+	VATPIT_UNLOCK(vatpit);
+
+	return (0);
+}
+
+int
+vatpit_nmisc_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *eax)
+{
+	struct vatpit *vatpit;
+
+	vatpit = vm_atpit(vm);
+
+	if (in) {
+			VATPIT_LOCK(vatpit);
+			if (vatpit_get_out(vatpit, 2))
+				*eax = TMR2_OUT_STS;
+			else
+				*eax = 0;
+
+			VATPIT_UNLOCK(vatpit);
+	}
+
+	return (0);
+}
+
+struct vatpit *
+vatpit_init(struct vm *vm)
+{
+	struct vatpit *vatpit;
+	struct vatpit_callout_arg *arg;
+	int i;
+
+	vatpit = malloc(sizeof(struct vatpit), M_VATPIT, M_WAITOK | M_ZERO);
+	vatpit->vm = vm;
+
+	mtx_init(&vatpit->mtx, "vatpit lock", NULL, MTX_SPIN);
+
+	FREQ2BT(PIT_8254_FREQ, &vatpit->freq_bt);
+
+	for (i = 0; i < 3; i++) {
+		callout_init(&vatpit->channel[i].callout, 1);
+		arg = &vatpit->channel[i].callout_arg;
+		arg->vatpit = vatpit;
+		arg->channel_num = i;
+	}
+
+	return (vatpit);
+}
+
+void
+vatpit_cleanup(struct vatpit *vatpit)
+{
+	int i;
+
+	for (i = 0; i < 3; i++)
+		callout_drain(&vatpit->channel[i].callout);
+
+	free(vatpit, M_VATPIT);
+}
+
+#ifndef __FreeBSD__
+void
+vatpit_localize_resources(struct vatpit *vatpit)
+{
+	for (uint_t i = 0; i < 3; i++) {
+		/* Only localize channels which might be running */
+		if (vatpit->channel[i].mode != 0) {
+			vmm_glue_callout_localize(&vatpit->channel[i].callout);
+		}
+	}
+}
+#endif /* __FreeBSD */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vatpit.h b/usr/src/uts/i86pc/io/vmm/io/vatpit.h
new file mode 100644
index 0000000000..12f2db2c61
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vatpit.h
@@ -0,0 +1,49 @@
+/*-
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VATPIT_H_
+#define	_VATPIT_H_
+
+#include <machine/timerreg.h>
+
+#define	NMISC_PORT	0x61
+
+struct vatpit *vatpit_init(struct vm *vm);
+void vatpit_cleanup(struct vatpit *vatpit);
+
+int vatpit_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *eax);
+int vatpit_nmisc_handler(struct vm *vm, int vcpuid, bool in, int port,
+    int bytes, uint32_t *eax);
+
+#ifndef __FreeBSD__
+void vatpit_localize_resources(struct vatpit *);
+#endif
+
+#endif	/* _VATPIT_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vdev.c b/usr/src/uts/i86pc/io/vmm/io/vdev.c
new file mode 100644
index 0000000000..0f835625f3
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vdev.c
@@ -0,0 +1,282 @@
+/*-
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: head/sys/amd64/vmm/io/vdev.c 245678 2013-01-20 03:42:49Z neel $
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/amd64/vmm/io/vdev.c 245678 2013-01-20 03:42:49Z neel $");
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+
+#include "vdev.h"
+
+struct vdev {
+	SLIST_ENTRY(vdev) 	 entry;
+	struct vdev_ops 	*ops;
+	void			*dev;
+};
+static SLIST_HEAD(, vdev)	vdev_head;
+static int 		  	vdev_count;
+
+struct vdev_region {
+	SLIST_ENTRY(vdev_region) 	 entry;
+	struct vdev_ops 		*ops;
+	void				*dev;
+	struct io_region		*io;
+};
+static SLIST_HEAD(, vdev_region)	 region_head;
+static int 		  		 region_count;
+
+static MALLOC_DEFINE(M_VDEV, "vdev", "vdev");
+
+#define VDEV_INIT 	(0)
+#define VDEV_RESET	(1)
+#define VDEV_HALT	(2)
+
+// static const char* vdev_event_str[] = {"VDEV_INIT", "VDEV_RESET", "VDEV_HALT"};
+
+static int
+vdev_system_event(int event)
+{
+	struct vdev 	*vd;
+	int		 rc;
+
+	// TODO: locking
+	SLIST_FOREACH(vd, &vdev_head, entry) {
+		// printf("%s : %s Device %s\n", __func__, vdev_event_str[event], vd->ops->name);
+		switch (event) {
+			case VDEV_INIT:
+				rc = vd->ops->init(vd->dev);
+				break;
+			case VDEV_RESET:
+				rc = vd->ops->reset(vd->dev);
+				break;
+			case VDEV_HALT:
+				rc = vd->ops->halt(vd->dev);
+				break;
+			default:
+				break;
+		}
+		if (rc) {
+			printf("vdev %s init failed rc=%d\n",
+			    vd->ops->name, rc);
+			return rc;
+		}
+	}
+	return 0;
+}
+
+int
+vdev_init(void)
+{
+	return vdev_system_event(VDEV_INIT);
+}
+
+int
+vdev_reset(void)
+{
+	return vdev_system_event(VDEV_RESET);
+}
+
+int
+vdev_halt(void)
+{
+	return vdev_system_event(VDEV_HALT);
+}
+
+void
+vdev_vm_init(void)
+{
+	SLIST_INIT(&vdev_head);
+	vdev_count = 0;
+
+	SLIST_INIT(&region_head);
+	region_count = 0;
+}
+void
+vdev_vm_cleanup(void)
+{
+	struct vdev *vd;
+     
+	// TODO: locking
+	while (!SLIST_EMPTY(&vdev_head)) {
+		vd = SLIST_FIRST(&vdev_head);
+		SLIST_REMOVE_HEAD(&vdev_head, entry);
+		free(vd, M_VDEV);
+		vdev_count--;
+	}
+}
+
+int
+vdev_register(struct vdev_ops *ops, void *dev)
+{
+	struct vdev *vd;
+	vd = malloc(sizeof(*vd), M_VDEV, M_WAITOK | M_ZERO); 
+	vd->ops = ops;
+	vd->dev = dev;
+	
+	// TODO: locking
+	SLIST_INSERT_HEAD(&vdev_head, vd, entry); 
+	vdev_count++;
+	return 0;
+}
+
+void
+vdev_unregister(void *dev)
+{
+	struct vdev 	*vd, *found;
+
+	found = NULL;
+	// TODO: locking
+	SLIST_FOREACH(vd, &vdev_head, entry) {
+		if (vd->dev == dev) {
+			found = vd;
+		}
+	}
+
+	if (found) {
+		SLIST_REMOVE(&vdev_head, found, vdev, entry);
+		free(found, M_VDEV);
+	}
+}
+
+#define IN_RANGE(val, start, end)	\
+    (((val) >= (start)) && ((val) < (end)))
+
+static struct vdev_region*
+vdev_find_region(struct io_region *io, void *dev) 
+{
+	struct 		vdev_region *region, *found;
+	uint64_t	region_base;
+	uint64_t	region_end;
+
+	found = NULL;
+
+	// TODO: locking
+	// FIXME: we should verify we are in the context the current
+	// 	  vcpu here as well.
+	SLIST_FOREACH(region, &region_head, entry) {
+		region_base = region->io->base;
+		region_end = region_base + region->io->len;
+		if (IN_RANGE(io->base, region_base, region_end) &&
+		    IN_RANGE(io->base+io->len, region_base, region_end+1) &&
+		    (dev && dev == region->dev)) {
+			found = region;
+			break;
+		}
+	}
+	return found;
+}
+
+int
+vdev_register_region(struct vdev_ops *ops, void *dev, struct io_region *io)
+{
+	struct vdev_region *region;
+
+	region = vdev_find_region(io, dev);
+	if (region) {
+		return -EEXIST;
+	}
+
+	region = malloc(sizeof(*region), M_VDEV, M_WAITOK | M_ZERO);
+	region->io = io;
+	region->ops = ops;
+	region->dev = dev;
+
+	// TODO: locking
+	SLIST_INSERT_HEAD(&region_head, region, entry); 
+	region_count++;
+
+	return 0;
+}
+
+void
+vdev_unregister_region(void *dev, struct io_region *io)
+{
+	struct vdev_region *region;
+
+	region = vdev_find_region(io, dev);
+	
+	if (region) {
+		SLIST_REMOVE(&region_head, region, vdev_region, entry);
+		free(region, M_VDEV);
+		region_count--;
+	}
+}
+
+static int
+vdev_memrw(uint64_t gpa, opsize_t size, uint64_t *data, int read)
+{
+	struct vdev_region 	*region;
+	struct io_region	 io;
+	region_attr_t		 attr;
+	int			 rc;
+
+	io.base = gpa;
+	io.len = size;
+
+	region = vdev_find_region(&io, NULL);
+	if (!region)
+		return -EINVAL;
+	
+	attr = (read) ? MMIO_READ : MMIO_WRITE;
+	if (!(region->io->attr & attr))
+		return -EPERM;
+
+	if (read)
+		rc = region->ops->memread(region->dev, gpa, size, data);
+	else 
+		rc = region->ops->memwrite(region->dev, gpa, size, *data);
+
+	return rc;
+}
+
+int
+vdev_memread(uint64_t gpa, opsize_t size, uint64_t *data)
+{
+	return vdev_memrw(gpa, size, data, 1);
+}
+
+int
+vdev_memwrite(uint64_t gpa, opsize_t size, uint64_t data)
+{
+	return vdev_memrw(gpa, size, &data, 0);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/io/vdev.h b/usr/src/uts/i86pc/io/vmm/io/vdev.h
new file mode 100644
index 0000000000..dd2df75ad8
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vdev.h
@@ -0,0 +1,96 @@
+/*-
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: head/sys/amd64/vmm/io/vdev.h 245678 2013-01-20 03:42:49Z neel $
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef _VDEV_H_
+#define	_VDEV_H_
+
+typedef enum {
+	BYTE	= 1,
+	WORD	= 2,
+	DWORD	= 4,
+	QWORD	= 8,
+} opsize_t;
+
+typedef enum {
+	MMIO_READ = 1,
+	MMIO_WRITE = 2,
+} region_attr_t;
+
+struct io_region {
+	uint64_t	base;
+	uint64_t	len;
+	region_attr_t	attr;
+	int		vcpu;
+};
+
+typedef int (*vdev_init_t)(void* dev);
+typedef int (*vdev_reset_t)(void* dev);
+typedef int (*vdev_halt_t)(void* dev);
+typedef int (*vdev_memread_t)(void* dev, uint64_t gpa, opsize_t size, uint64_t *data);
+typedef int (*vdev_memwrite_t)(void* dev, uint64_t gpa, opsize_t size, uint64_t data);
+
+
+struct vdev_ops {
+	const char	*name;
+	vdev_init_t	init;
+	vdev_reset_t	reset;
+	vdev_halt_t	halt;
+	vdev_memread_t	memread;
+	vdev_memwrite_t	memwrite;
+};
+
+
+void vdev_vm_init(void);
+void vdev_vm_cleanup(void);
+
+int  vdev_register(struct vdev_ops *ops, void *dev);
+void vdev_unregister(void *dev);
+
+int  vdev_register_region(struct vdev_ops *ops, void *dev, struct io_region *io);
+void vdev_unregister_region(void *dev, struct io_region *io);
+
+int vdev_init(void);
+int vdev_reset(void);
+int vdev_halt(void);
+int vdev_memread(uint64_t gpa, opsize_t size, uint64_t *data);
+int vdev_memwrite(uint64_t gpa, opsize_t size, uint64_t data);
+
+#endif	/* _VDEV_H_ */
+
diff --git a/usr/src/uts/i86pc/io/vmm/io/vhpet.c b/usr/src/uts/i86pc/io/vmm/io/vhpet.c
new file mode 100644
index 0000000000..c82b4626bd
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vhpet.c
@@ -0,0 +1,781 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/systm.h>
+
+#include <dev/acpica/acpi_hpet.h>
+
+#include <machine/vmm.h>
+#include <machine/vmm_dev.h>
+
+#include "vmm_lapic.h"
+#include "vatpic.h"
+#include "vioapic.h"
+#include "vhpet.h"
+
+#include "vmm_ktr.h"
+
+static MALLOC_DEFINE(M_VHPET, "vhpet", "bhyve virtual hpet");
+
+#define	HPET_FREQ	16777216		/* 16.7 (2^24) Mhz */
+#define	FS_PER_S	1000000000000000ul
+
+/* Timer N Configuration and Capabilities Register */
+#define	HPET_TCAP_RO_MASK	(HPET_TCAP_INT_ROUTE 	|		\
+				 HPET_TCAP_FSB_INT_DEL	|		\
+				 HPET_TCAP_SIZE		|		\
+				 HPET_TCAP_PER_INT)
+/*
+ * HPET requires at least 3 timers and up to 32 timers per block.
+ */
+#define	VHPET_NUM_TIMERS	8
+CTASSERT(VHPET_NUM_TIMERS >= 3 && VHPET_NUM_TIMERS <= 32);
+
+struct vhpet_callout_arg {
+	struct vhpet *vhpet;
+	int timer_num;
+};
+
+struct vhpet {
+	struct vm	*vm;
+	struct mtx	mtx;
+	sbintime_t	freq_sbt;
+
+	uint64_t	config;		/* Configuration */
+	uint64_t	isr;		/* Interrupt Status */
+	uint32_t	countbase;	/* HPET counter base value */
+	sbintime_t	countbase_sbt;	/* uptime corresponding to base value */
+
+	struct {
+		uint64_t	cap_config;	/* Configuration */
+		uint64_t	msireg;		/* FSB interrupt routing */
+		uint32_t	compval;	/* Comparator */
+		uint32_t	comprate;
+		struct callout	callout;
+		sbintime_t	callout_sbt;	/* time when counter==compval */
+		struct vhpet_callout_arg arg;
+	} timer[VHPET_NUM_TIMERS];
+};
+
+#define	VHPET_LOCK(vhp)		mtx_lock(&((vhp)->mtx))
+#define	VHPET_UNLOCK(vhp)	mtx_unlock(&((vhp)->mtx))
+
+static void vhpet_start_timer(struct vhpet *vhpet, int n, uint32_t counter,
+    sbintime_t now);
+
+static uint64_t
+vhpet_capabilities(void)
+{
+	uint64_t cap = 0;
+
+	cap |= 0x8086 << 16;			/* vendor id */
+	cap |= (VHPET_NUM_TIMERS - 1) << 8;	/* number of timers */
+	cap |= 1;				/* revision */
+	cap &= ~HPET_CAP_COUNT_SIZE;		/* 32-bit timer */
+
+	cap &= 0xffffffff;
+	cap |= (FS_PER_S / HPET_FREQ) << 32;	/* tick period in fs */
+
+	return (cap);
+}
+
+static __inline bool
+vhpet_counter_enabled(struct vhpet *vhpet)
+{
+
+	return ((vhpet->config & HPET_CNF_ENABLE) ? true : false);
+}
+
+static __inline bool
+vhpet_timer_msi_enabled(struct vhpet *vhpet, int n)
+{
+	const uint64_t msi_enable = HPET_TCAP_FSB_INT_DEL | HPET_TCNF_FSB_EN;
+
+	if ((vhpet->timer[n].cap_config & msi_enable) == msi_enable)
+		return (true);
+	else
+		return (false);
+}
+
+static __inline int
+vhpet_timer_ioapic_pin(struct vhpet *vhpet, int n)
+{
+	/*
+	 * If the timer is configured to use MSI then treat it as if the
+	 * timer is not connected to the ioapic.
+	 */
+	if (vhpet_timer_msi_enabled(vhpet, n))
+		return (0);
+
+	return ((vhpet->timer[n].cap_config & HPET_TCNF_INT_ROUTE) >> 9);
+}
+
+static uint32_t
+vhpet_counter(struct vhpet *vhpet, sbintime_t *nowptr)
+{
+	uint32_t val;
+	sbintime_t now, delta;
+
+	val = vhpet->countbase;
+	if (vhpet_counter_enabled(vhpet)) {
+		now = sbinuptime();
+		delta = now - vhpet->countbase_sbt;
+#ifdef	__FreeBSD__
+		KASSERT(delta >= 0, ("vhpet_counter: uptime went backwards: "
+		    "%#lx to %#lx", vhpet->countbase_sbt, now));
+#else
+		KASSERT(delta >= 0, ("vhpet_counter: uptime went backwards: "
+		    "%lx to %lx", vhpet->countbase_sbt, now));
+#endif
+		val += delta / vhpet->freq_sbt;
+		if (nowptr != NULL)
+			*nowptr = now;
+	} else {
+		/*
+		 * The sbinuptime corresponding to the 'countbase' is
+		 * meaningless when the counter is disabled. Make sure
+		 * that the caller doesn't want to use it.
+		 */
+		KASSERT(nowptr == NULL, ("vhpet_counter: nowptr must be NULL"));
+	}
+	return (val);
+}
+
+static void
+vhpet_timer_clear_isr(struct vhpet *vhpet, int n)
+{
+	int pin;
+
+	if (vhpet->isr & (1 << n)) {
+		pin = vhpet_timer_ioapic_pin(vhpet, n);
+		KASSERT(pin != 0, ("vhpet timer %d irq incorrectly routed", n));
+		vioapic_deassert_irq(vhpet->vm, pin);
+		vhpet->isr &= ~(1 << n);
+	}
+}
+
+static __inline bool
+vhpet_periodic_timer(struct vhpet *vhpet, int n)
+{
+
+	return ((vhpet->timer[n].cap_config & HPET_TCNF_TYPE) != 0);
+}
+
+static __inline bool
+vhpet_timer_interrupt_enabled(struct vhpet *vhpet, int n)
+{
+
+	return ((vhpet->timer[n].cap_config & HPET_TCNF_INT_ENB) != 0);
+}
+
+static __inline bool
+vhpet_timer_edge_trig(struct vhpet *vhpet, int n)
+{
+
+	KASSERT(!vhpet_timer_msi_enabled(vhpet, n), ("vhpet_timer_edge_trig: "
+	    "timer %d is using MSI", n));
+
+	if ((vhpet->timer[n].cap_config & HPET_TCNF_INT_TYPE) == 0)
+		return (true);
+	else
+		return (false);
+}
+
+static void
+vhpet_timer_interrupt(struct vhpet *vhpet, int n)
+{
+	int pin;
+
+	/* If interrupts are not enabled for this timer then just return. */
+	if (!vhpet_timer_interrupt_enabled(vhpet, n))
+		return;
+
+	/*
+	 * If a level triggered interrupt is already asserted then just return.
+	 */
+	if ((vhpet->isr & (1 << n)) != 0) {
+		VM_CTR1(vhpet->vm, "hpet t%d intr is already asserted", n);
+		return;
+	}
+
+	if (vhpet_timer_msi_enabled(vhpet, n)) {
+		lapic_intr_msi(vhpet->vm, vhpet->timer[n].msireg >> 32,
+		    vhpet->timer[n].msireg & 0xffffffff);
+		return;
+	}	
+
+	pin = vhpet_timer_ioapic_pin(vhpet, n);
+	if (pin == 0) {
+		VM_CTR1(vhpet->vm, "hpet t%d intr is not routed to ioapic", n);
+		return;
+	}
+
+	if (vhpet_timer_edge_trig(vhpet, n)) {
+		vioapic_pulse_irq(vhpet->vm, pin);
+	} else {
+		vhpet->isr |= 1 << n;
+		vioapic_assert_irq(vhpet->vm, pin);
+	}
+}
+
+static void
+vhpet_adjust_compval(struct vhpet *vhpet, int n, uint32_t counter)
+{
+	uint32_t compval, comprate, compnext;
+
+	KASSERT(vhpet->timer[n].comprate != 0, ("hpet t%d is not periodic", n));
+
+	compval = vhpet->timer[n].compval;
+	comprate = vhpet->timer[n].comprate;
+
+	/*
+	 * Calculate the comparator value to be used for the next periodic
+	 * interrupt.
+	 *
+	 * This function is commonly called from the callout handler.
+	 * In this scenario the 'counter' is ahead of 'compval'. To find
+	 * the next value to program into the accumulator we divide the
+	 * number space between 'compval' and 'counter' into 'comprate'
+	 * sized units. The 'compval' is rounded up such that is "ahead"
+	 * of 'counter'.
+	 */
+	compnext = compval + ((counter - compval) / comprate + 1) * comprate;
+
+	vhpet->timer[n].compval = compnext;
+}
+
+static void
+vhpet_handler(void *a)
+{
+	int n;
+	uint32_t counter;
+	sbintime_t now;
+	struct vhpet *vhpet;
+	struct callout *callout;
+	struct vhpet_callout_arg *arg;
+
+	arg = a;
+	vhpet = arg->vhpet;
+	n = arg->timer_num;
+	callout = &vhpet->timer[n].callout;
+
+	VM_CTR1(vhpet->vm, "hpet t%d fired", n);
+
+	VHPET_LOCK(vhpet);
+
+	if (callout_pending(callout))		/* callout was reset */
+		goto done;
+
+	if (!callout_active(callout))		/* callout was stopped */
+		goto done;
+
+	callout_deactivate(callout);
+
+	if (!vhpet_counter_enabled(vhpet))
+		panic("vhpet(%p) callout with counter disabled", vhpet);
+
+	counter = vhpet_counter(vhpet, &now);
+	vhpet_start_timer(vhpet, n, counter, now);
+	vhpet_timer_interrupt(vhpet, n);
+done:
+	VHPET_UNLOCK(vhpet);
+	return;
+}
+
+static void
+vhpet_stop_timer(struct vhpet *vhpet, int n, sbintime_t now)
+{
+
+	VM_CTR1(vhpet->vm, "hpet t%d stopped", n);
+	callout_stop(&vhpet->timer[n].callout);
+
+	/*
+	 * If the callout was scheduled to expire in the past but hasn't
+	 * had a chance to execute yet then trigger the timer interrupt
+	 * here. Failing to do so will result in a missed timer interrupt
+	 * in the guest. This is especially bad in one-shot mode because
+	 * the next interrupt has to wait for the counter to wrap around.
+	 */
+	if (vhpet->timer[n].callout_sbt < now) {
+		VM_CTR1(vhpet->vm, "hpet t%d interrupt triggered after "
+		    "stopping timer", n);
+		vhpet_timer_interrupt(vhpet, n);
+	}
+}
+
+static void
+vhpet_start_timer(struct vhpet *vhpet, int n, uint32_t counter, sbintime_t now)
+{
+	sbintime_t delta, precision;
+
+	if (vhpet->timer[n].comprate != 0)
+		vhpet_adjust_compval(vhpet, n, counter);
+	else {
+		/*
+		 * In one-shot mode it is the guest's responsibility to make
+		 * sure that the comparator value is not in the "past". The
+		 * hardware doesn't have any belt-and-suspenders to deal with
+		 * this so we don't either.
+		 */
+	}
+
+	delta = (vhpet->timer[n].compval - counter) * vhpet->freq_sbt;
+	precision = delta >> tc_precexp;
+	vhpet->timer[n].callout_sbt = now + delta;
+	callout_reset_sbt(&vhpet->timer[n].callout, vhpet->timer[n].callout_sbt,
+	    precision, vhpet_handler, &vhpet->timer[n].arg, C_ABSOLUTE);
+}
+
+static void
+vhpet_start_counting(struct vhpet *vhpet)
+{
+	int i;
+
+	vhpet->countbase_sbt = sbinuptime();
+	for (i = 0; i < VHPET_NUM_TIMERS; i++) {
+		/*
+		 * Restart the timers based on the value of the main counter
+		 * when it stopped counting.
+		 */
+		vhpet_start_timer(vhpet, i, vhpet->countbase,
+		    vhpet->countbase_sbt);
+	}
+}
+
+static void
+vhpet_stop_counting(struct vhpet *vhpet, uint32_t counter, sbintime_t now)
+{
+	int i;
+
+	vhpet->countbase = counter;
+	for (i = 0; i < VHPET_NUM_TIMERS; i++)
+		vhpet_stop_timer(vhpet, i, now);
+}
+
+static __inline void
+update_register(uint64_t *regptr, uint64_t data, uint64_t mask)
+{
+
+	*regptr &= ~mask;
+	*regptr |= (data & mask);
+}
+
+static void
+vhpet_timer_update_config(struct vhpet *vhpet, int n, uint64_t data,
+    uint64_t mask)
+{
+	bool clear_isr;
+	int old_pin, new_pin;
+	uint32_t allowed_irqs;
+	uint64_t oldval, newval;
+
+	if (vhpet_timer_msi_enabled(vhpet, n) ||
+	    vhpet_timer_edge_trig(vhpet, n)) {
+		if (vhpet->isr & (1 << n))
+			panic("vhpet timer %d isr should not be asserted", n);
+	}
+	old_pin = vhpet_timer_ioapic_pin(vhpet, n);
+	oldval = vhpet->timer[n].cap_config;
+
+	newval = oldval;
+	update_register(&newval, data, mask);
+	newval &= ~(HPET_TCAP_RO_MASK | HPET_TCNF_32MODE);
+	newval |= oldval & HPET_TCAP_RO_MASK;
+
+	if (newval == oldval)
+		return;
+
+	vhpet->timer[n].cap_config = newval;
+	VM_CTR2(vhpet->vm, "hpet t%d cap_config set to 0x%016x", n, newval);
+
+	/*
+	 * Validate the interrupt routing in the HPET_TCNF_INT_ROUTE field.
+	 * If it does not match the bits set in HPET_TCAP_INT_ROUTE then set
+	 * it to the default value of 0.
+	 */
+	allowed_irqs = vhpet->timer[n].cap_config >> 32;
+	new_pin = vhpet_timer_ioapic_pin(vhpet, n);
+	if (new_pin != 0 && (allowed_irqs & (1 << new_pin)) == 0) {
+		VM_CTR3(vhpet->vm, "hpet t%d configured invalid irq %d, "
+		    "allowed_irqs 0x%08x", n, new_pin, allowed_irqs);
+		new_pin = 0;
+		vhpet->timer[n].cap_config &= ~HPET_TCNF_INT_ROUTE;
+	}
+
+	if (!vhpet_periodic_timer(vhpet, n))
+		vhpet->timer[n].comprate = 0;
+
+	/*
+	 * If the timer's ISR bit is set then clear it in the following cases:
+	 * - interrupt is disabled
+	 * - interrupt type is changed from level to edge or fsb.
+	 * - interrupt routing is changed
+	 *
+	 * This is to ensure that this timer's level triggered interrupt does
+	 * not remain asserted forever.
+	 */
+	if (vhpet->isr & (1 << n)) {
+		KASSERT(old_pin != 0, ("timer %d isr asserted to ioapic pin %d",
+		    n, old_pin));
+		if (!vhpet_timer_interrupt_enabled(vhpet, n))
+			clear_isr = true;
+		else if (vhpet_timer_msi_enabled(vhpet, n))
+			clear_isr = true;
+		else if (vhpet_timer_edge_trig(vhpet, n))
+			clear_isr = true;
+		else if (vhpet_timer_ioapic_pin(vhpet, n) != old_pin)
+			clear_isr = true;
+		else
+			clear_isr = false;
+
+		if (clear_isr) {
+			VM_CTR1(vhpet->vm, "hpet t%d isr cleared due to "
+			    "configuration change", n);
+			vioapic_deassert_irq(vhpet->vm, old_pin);
+			vhpet->isr &= ~(1 << n);
+		}
+	}
+}
+
+int
+vhpet_mmio_write(void *vm, int vcpuid, uint64_t gpa, uint64_t val, int size,
+    void *arg)
+{
+	struct vhpet *vhpet;
+	uint64_t data, mask, oldval, val64;
+	uint32_t isr_clear_mask, old_compval, old_comprate, counter;
+	sbintime_t now, *nowptr;
+	int i, offset;
+
+	vhpet = vm_hpet(vm);
+	offset = gpa - VHPET_BASE;
+
+	VHPET_LOCK(vhpet);
+
+	/* Accesses to the HPET should be 4 or 8 bytes wide */
+	switch (size) {
+	case 8:
+		mask = 0xffffffffffffffff;
+		data = val;
+		break;
+	case 4:
+		mask = 0xffffffff;
+		data = val;
+		if ((offset & 0x4) != 0) {
+			mask <<= 32;
+			data <<= 32;
+		} 
+		break;
+	default:
+		VM_CTR2(vhpet->vm, "hpet invalid mmio write: "
+		    "offset 0x%08x, size %d", offset, size);
+		goto done;
+	}
+
+	/* Access to the HPET should be naturally aligned to its width */
+	if (offset & (size - 1)) {
+		VM_CTR2(vhpet->vm, "hpet invalid mmio write: "
+		    "offset 0x%08x, size %d", offset, size);
+		goto done;
+	}
+
+	if (offset == HPET_CONFIG || offset == HPET_CONFIG + 4) {
+		/*
+		 * Get the most recent value of the counter before updating
+		 * the 'config' register. If the HPET is going to be disabled
+		 * then we need to update 'countbase' with the value right
+		 * before it is disabled.
+		 */
+		nowptr = vhpet_counter_enabled(vhpet) ? &now : NULL;
+		counter = vhpet_counter(vhpet, nowptr);
+		oldval = vhpet->config;
+		update_register(&vhpet->config, data, mask);
+
+		/*
+		 * LegacyReplacement Routing is not supported so clear the
+		 * bit explicitly.
+		 */
+		vhpet->config &= ~HPET_CNF_LEG_RT;
+
+		if ((oldval ^ vhpet->config) & HPET_CNF_ENABLE) {
+			if (vhpet_counter_enabled(vhpet)) {
+				vhpet_start_counting(vhpet);
+				VM_CTR0(vhpet->vm, "hpet enabled");
+			} else {
+				vhpet_stop_counting(vhpet, counter, now);
+				VM_CTR0(vhpet->vm, "hpet disabled");
+			}
+		}
+		goto done;
+	}
+
+	if (offset == HPET_ISR || offset == HPET_ISR + 4) {
+		isr_clear_mask = vhpet->isr & data;
+		for (i = 0; i < VHPET_NUM_TIMERS; i++) {
+			if ((isr_clear_mask & (1 << i)) != 0) {
+				VM_CTR1(vhpet->vm, "hpet t%d isr cleared", i);
+				vhpet_timer_clear_isr(vhpet, i);
+			}
+		}
+		goto done;
+	}
+
+	if (offset == HPET_MAIN_COUNTER || offset == HPET_MAIN_COUNTER + 4) {
+		/* Zero-extend the counter to 64-bits before updating it */
+		val64 = vhpet_counter(vhpet, NULL);
+		update_register(&val64, data, mask);
+		vhpet->countbase = val64;
+		if (vhpet_counter_enabled(vhpet))
+			vhpet_start_counting(vhpet);
+		goto done;
+	}
+
+	for (i = 0; i < VHPET_NUM_TIMERS; i++) {
+		if (offset == HPET_TIMER_CAP_CNF(i) ||
+		    offset == HPET_TIMER_CAP_CNF(i) + 4) {
+			vhpet_timer_update_config(vhpet, i, data, mask);
+			break;
+		}
+
+		if (offset == HPET_TIMER_COMPARATOR(i) ||
+		    offset == HPET_TIMER_COMPARATOR(i) + 4) {
+			old_compval = vhpet->timer[i].compval;
+			old_comprate = vhpet->timer[i].comprate;
+			if (vhpet_periodic_timer(vhpet, i)) {
+				/*
+				 * In periodic mode writes to the comparator
+				 * change the 'compval' register only if the
+				 * HPET_TCNF_VAL_SET bit is set in the config
+				 * register.
+				 */
+				val64 = vhpet->timer[i].comprate;
+				update_register(&val64, data, mask);
+				vhpet->timer[i].comprate = val64;
+				if ((vhpet->timer[i].cap_config &
+				    HPET_TCNF_VAL_SET) != 0) {
+					vhpet->timer[i].compval = val64;
+				}
+			} else {
+				KASSERT(vhpet->timer[i].comprate == 0,
+				    ("vhpet one-shot timer %d has invalid "
+				    "rate %u", i, vhpet->timer[i].comprate));
+				val64 = vhpet->timer[i].compval;
+				update_register(&val64, data, mask);
+				vhpet->timer[i].compval = val64;
+			}
+			vhpet->timer[i].cap_config &= ~HPET_TCNF_VAL_SET;
+
+			if (vhpet->timer[i].compval != old_compval ||
+			    vhpet->timer[i].comprate != old_comprate) {
+				if (vhpet_counter_enabled(vhpet)) {
+					counter = vhpet_counter(vhpet, &now);
+					vhpet_start_timer(vhpet, i, counter,
+					    now);
+				}
+			}
+			break;
+		}
+
+		if (offset == HPET_TIMER_FSB_VAL(i) ||
+		    offset == HPET_TIMER_FSB_ADDR(i)) {
+			update_register(&vhpet->timer[i].msireg, data, mask);
+			break;
+		}
+	}
+done:
+	VHPET_UNLOCK(vhpet);
+	return (0);
+}
+
+int
+vhpet_mmio_read(void *vm, int vcpuid, uint64_t gpa, uint64_t *rval, int size,
+    void *arg)
+{
+	int i, offset;
+	struct vhpet *vhpet;
+	uint64_t data;
+
+	vhpet = vm_hpet(vm);
+	offset = gpa - VHPET_BASE;
+
+	VHPET_LOCK(vhpet);
+
+	/* Accesses to the HPET should be 4 or 8 bytes wide */
+	if (size != 4 && size != 8) {
+		VM_CTR2(vhpet->vm, "hpet invalid mmio read: "
+		    "offset 0x%08x, size %d", offset, size);
+		data = 0;
+		goto done;
+	}
+
+	/* Access to the HPET should be naturally aligned to its width */
+	if (offset & (size - 1)) {
+		VM_CTR2(vhpet->vm, "hpet invalid mmio read: "
+		    "offset 0x%08x, size %d", offset, size);
+		data = 0;
+		goto done;
+	}
+
+	if (offset == HPET_CAPABILITIES || offset == HPET_CAPABILITIES + 4) {
+		data = vhpet_capabilities();
+		goto done;	
+	}
+
+	if (offset == HPET_CONFIG || offset == HPET_CONFIG + 4) {
+		data = vhpet->config;
+		goto done;
+	}
+
+	if (offset == HPET_ISR || offset == HPET_ISR + 4) {
+		data = vhpet->isr;
+		goto done;
+	}
+
+	if (offset == HPET_MAIN_COUNTER || offset == HPET_MAIN_COUNTER + 4) {
+		data = vhpet_counter(vhpet, NULL);
+		goto done;
+	}
+
+	for (i = 0; i < VHPET_NUM_TIMERS; i++) {
+		if (offset == HPET_TIMER_CAP_CNF(i) ||
+		    offset == HPET_TIMER_CAP_CNF(i) + 4) {
+			data = vhpet->timer[i].cap_config;
+			break;
+		}
+
+		if (offset == HPET_TIMER_COMPARATOR(i) ||
+		    offset == HPET_TIMER_COMPARATOR(i) + 4) {
+			data = vhpet->timer[i].compval;
+			break;
+		}
+
+		if (offset == HPET_TIMER_FSB_VAL(i) ||
+		    offset == HPET_TIMER_FSB_ADDR(i)) {
+			data = vhpet->timer[i].msireg;
+			break;
+		}
+	}
+
+	if (i >= VHPET_NUM_TIMERS)
+		data = 0;
+done:
+	VHPET_UNLOCK(vhpet);
+
+	if (size == 4) {
+		if (offset & 0x4)
+			data >>= 32;
+	}
+	*rval = data;
+	return (0);
+}
+
+struct vhpet *
+vhpet_init(struct vm *vm)
+{
+	int i, pincount;
+	struct vhpet *vhpet;
+	uint64_t allowed_irqs;
+	struct vhpet_callout_arg *arg;
+	struct bintime bt;
+
+	vhpet = malloc(sizeof(struct vhpet), M_VHPET, M_WAITOK | M_ZERO);
+        vhpet->vm = vm;
+	mtx_init(&vhpet->mtx, "vhpet lock", NULL, MTX_DEF);
+
+	FREQ2BT(HPET_FREQ, &bt);
+	vhpet->freq_sbt = bttosbt(bt);
+
+	pincount = vioapic_pincount(vm);
+	if (pincount >= 32)
+		allowed_irqs = 0xff000000;	/* irqs 24-31 */
+	else if (pincount >= 20)
+		allowed_irqs = 0xf << (pincount - 4);	/* 4 upper irqs */
+	else
+		allowed_irqs = 0;
+
+	/*
+	 * Initialize HPET timer hardware state.
+	 */
+	for (i = 0; i < VHPET_NUM_TIMERS; i++) {
+		vhpet->timer[i].cap_config = allowed_irqs << 32;
+		vhpet->timer[i].cap_config |= HPET_TCAP_PER_INT;
+		vhpet->timer[i].cap_config |= HPET_TCAP_FSB_INT_DEL;
+
+		vhpet->timer[i].compval = 0xffffffff;
+		callout_init(&vhpet->timer[i].callout, 1);
+
+		arg = &vhpet->timer[i].arg;
+		arg->vhpet = vhpet;
+		arg->timer_num = i;
+	}
+
+	return (vhpet);
+}
+
+void
+vhpet_cleanup(struct vhpet *vhpet)
+{
+	int i;
+
+	for (i = 0; i < VHPET_NUM_TIMERS; i++)
+		callout_drain(&vhpet->timer[i].callout);
+
+	free(vhpet, M_VHPET);
+}
+
+int
+vhpet_getcap(struct vm_hpet_cap *cap)
+{
+
+	cap->capabilities = vhpet_capabilities();
+	return (0);
+}
+#ifndef __FreeBSD__
+void
+vhpet_localize_resources(struct vhpet *vhpet)
+{
+	for (uint_t i = 0; i < VHPET_NUM_TIMERS; i++) {
+		vmm_glue_callout_localize(&vhpet->timer[i].callout);
+	}
+}
+#endif /* __FreeBSD */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vhpet.h b/usr/src/uts/i86pc/io/vmm/io/vhpet.h
new file mode 100644
index 0000000000..8e28241b32
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vhpet.h
@@ -0,0 +1,54 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _VHPET_H_
+#define	_VHPET_H_
+
+#define	VHPET_BASE	0xfed00000
+#define	VHPET_SIZE	1024
+
+struct vhpet *vhpet_init(struct vm *vm);
+void 	vhpet_cleanup(struct vhpet *vhpet);
+int	vhpet_mmio_write(void *vm, int vcpuid, uint64_t gpa, uint64_t val,
+	    int size, void *arg);
+int	vhpet_mmio_read(void *vm, int vcpuid, uint64_t gpa, uint64_t *val,
+	    int size, void *arg);
+int	vhpet_getcap(struct vm_hpet_cap *cap);
+
+#ifndef __FreeBSD__
+void vhpet_localize_resources(struct vhpet *vhpet);
+#endif
+
+#endif	/* _VHPET_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vioapic.c b/usr/src/uts/i86pc/io/vmm/io/vioapic.c
new file mode 100644
index 0000000000..c001ffd933
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vioapic.c
@@ -0,0 +1,514 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/queue.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+
+#include <x86/apicreg.h>
+#include <machine/vmm.h>
+
+#include "vmm_ktr.h"
+#include "vmm_lapic.h"
+#include "vlapic.h"
+#include "vioapic.h"
+
+#define	IOREGSEL	0x00
+#define	IOWIN		0x10
+
+#define	REDIR_ENTRIES	32
+#define	RTBL_RO_BITS	((uint64_t)(IOART_REM_IRR | IOART_DELIVS))
+
+struct vioapic {
+	struct vm	*vm;
+	struct mtx	mtx;
+	uint32_t	id;
+	uint32_t	ioregsel;
+	struct {
+		uint64_t reg;
+		int	 acnt;	/* sum of pin asserts (+1) and deasserts (-1) */
+	} rtbl[REDIR_ENTRIES];
+};
+
+#define	VIOAPIC_LOCK(vioapic)		mtx_lock_spin(&((vioapic)->mtx))
+#define	VIOAPIC_UNLOCK(vioapic)		mtx_unlock_spin(&((vioapic)->mtx))
+#define	VIOAPIC_LOCKED(vioapic)		mtx_owned(&((vioapic)->mtx))
+
+static MALLOC_DEFINE(M_VIOAPIC, "vioapic", "bhyve virtual ioapic");
+
+#define	VIOAPIC_CTR1(vioapic, fmt, a1)					\
+	VM_CTR1((vioapic)->vm, fmt, a1)
+
+#define	VIOAPIC_CTR2(vioapic, fmt, a1, a2)				\
+	VM_CTR2((vioapic)->vm, fmt, a1, a2)
+
+#define	VIOAPIC_CTR3(vioapic, fmt, a1, a2, a3)				\
+	VM_CTR3((vioapic)->vm, fmt, a1, a2, a3)
+
+#define	VIOAPIC_CTR4(vioapic, fmt, a1, a2, a3, a4)			\
+	VM_CTR4((vioapic)->vm, fmt, a1, a2, a3, a4)
+
+#ifdef KTR
+static const char *
+pinstate_str(bool asserted)
+{
+
+	if (asserted)
+		return ("asserted");
+	else
+		return ("deasserted");
+}
+#endif
+
+static void
+vioapic_send_intr(struct vioapic *vioapic, int pin)
+{
+	int vector, delmode;
+	uint32_t low, high, dest;
+	bool level, phys;
+
+	KASSERT(pin >= 0 && pin < REDIR_ENTRIES,
+	    ("vioapic_set_pinstate: invalid pin number %d", pin));
+
+	KASSERT(VIOAPIC_LOCKED(vioapic),
+	    ("vioapic_set_pinstate: vioapic is not locked"));
+
+	low = vioapic->rtbl[pin].reg;
+	high = vioapic->rtbl[pin].reg >> 32;
+
+	if ((low & IOART_INTMASK) == IOART_INTMSET) {
+		VIOAPIC_CTR1(vioapic, "ioapic pin%d: masked", pin);
+		return;
+	}
+
+	phys = ((low & IOART_DESTMOD) == IOART_DESTPHY);
+	delmode = low & IOART_DELMOD;
+	level = low & IOART_TRGRLVL ? true : false;
+	if (level)
+		vioapic->rtbl[pin].reg |= IOART_REM_IRR;
+
+	vector = low & IOART_INTVEC;
+	dest = high >> APIC_ID_SHIFT;
+	vlapic_deliver_intr(vioapic->vm, level, dest, phys, delmode, vector);
+}
+
+static void
+vioapic_set_pinstate(struct vioapic *vioapic, int pin, bool newstate)
+{
+	int oldcnt, newcnt;
+	bool needintr;
+
+	KASSERT(pin >= 0 && pin < REDIR_ENTRIES,
+	    ("vioapic_set_pinstate: invalid pin number %d", pin));
+
+	KASSERT(VIOAPIC_LOCKED(vioapic),
+	    ("vioapic_set_pinstate: vioapic is not locked"));
+
+	oldcnt = vioapic->rtbl[pin].acnt;
+	if (newstate)
+		vioapic->rtbl[pin].acnt++;
+	else
+		vioapic->rtbl[pin].acnt--;
+	newcnt = vioapic->rtbl[pin].acnt;
+
+	if (newcnt < 0) {
+		VIOAPIC_CTR2(vioapic, "ioapic pin%d: bad acnt %d",
+		    pin, newcnt);
+	}
+
+	needintr = false;
+	if (oldcnt == 0 && newcnt == 1) {
+		needintr = true;
+		VIOAPIC_CTR1(vioapic, "ioapic pin%d: asserted", pin);
+	} else if (oldcnt == 1 && newcnt == 0) {
+		VIOAPIC_CTR1(vioapic, "ioapic pin%d: deasserted", pin);
+	} else {
+		VIOAPIC_CTR3(vioapic, "ioapic pin%d: %s, ignored, acnt %d",
+		    pin, pinstate_str(newstate), newcnt);
+	}
+
+	if (needintr)
+		vioapic_send_intr(vioapic, pin);
+}
+
+enum irqstate {
+	IRQSTATE_ASSERT,
+	IRQSTATE_DEASSERT,
+	IRQSTATE_PULSE
+};
+
+static int
+vioapic_set_irqstate(struct vm *vm, int irq, enum irqstate irqstate)
+{
+	struct vioapic *vioapic;
+
+	if (irq < 0 || irq >= REDIR_ENTRIES)
+		return (EINVAL);
+
+	vioapic = vm_ioapic(vm);
+
+	VIOAPIC_LOCK(vioapic);
+	switch (irqstate) {
+	case IRQSTATE_ASSERT:
+		vioapic_set_pinstate(vioapic, irq, true);
+		break;
+	case IRQSTATE_DEASSERT:
+		vioapic_set_pinstate(vioapic, irq, false);
+		break;
+	case IRQSTATE_PULSE:
+		vioapic_set_pinstate(vioapic, irq, true);
+		vioapic_set_pinstate(vioapic, irq, false);
+		break;
+	default:
+		panic("vioapic_set_irqstate: invalid irqstate %d", irqstate);
+	}
+	VIOAPIC_UNLOCK(vioapic);
+
+	return (0);
+}
+
+int
+vioapic_assert_irq(struct vm *vm, int irq)
+{
+
+	return (vioapic_set_irqstate(vm, irq, IRQSTATE_ASSERT));
+}
+
+int
+vioapic_deassert_irq(struct vm *vm, int irq)
+{
+
+	return (vioapic_set_irqstate(vm, irq, IRQSTATE_DEASSERT));
+}
+
+int
+vioapic_pulse_irq(struct vm *vm, int irq)
+{
+
+	return (vioapic_set_irqstate(vm, irq, IRQSTATE_PULSE));
+}
+
+/*
+ * Reset the vlapic's trigger-mode register to reflect the ioapic pin
+ * configuration.
+ */
+static void
+vioapic_update_tmr(struct vm *vm, int vcpuid, void *arg)
+{
+	struct vioapic *vioapic;
+	struct vlapic *vlapic;
+	uint32_t low, high, dest;
+	int delmode, pin, vector;
+	bool level, phys;
+
+	vlapic = vm_lapic(vm, vcpuid);
+	vioapic = vm_ioapic(vm);
+
+	VIOAPIC_LOCK(vioapic);
+	/*
+	 * Reset all vectors to be edge-triggered.
+	 */
+	vlapic_reset_tmr(vlapic);
+	for (pin = 0; pin < REDIR_ENTRIES; pin++) {
+		low = vioapic->rtbl[pin].reg;
+		high = vioapic->rtbl[pin].reg >> 32;
+
+		level = low & IOART_TRGRLVL ? true : false;
+		if (!level)
+			continue;
+
+		/*
+		 * For a level-triggered 'pin' let the vlapic figure out if
+		 * an assertion on this 'pin' would result in an interrupt
+		 * being delivered to it. If yes, then it will modify the
+		 * TMR bit associated with this vector to level-triggered.
+		 */
+		phys = ((low & IOART_DESTMOD) == IOART_DESTPHY);
+		delmode = low & IOART_DELMOD;
+		vector = low & IOART_INTVEC;
+		dest = high >> APIC_ID_SHIFT;
+		vlapic_set_tmr_level(vlapic, dest, phys, delmode, vector);
+	}
+	VIOAPIC_UNLOCK(vioapic);
+}
+
+static uint32_t
+vioapic_read(struct vioapic *vioapic, int vcpuid, uint32_t addr)
+{
+	int regnum, pin, rshift;
+
+	regnum = addr & 0xff;
+	switch (regnum) {
+	case IOAPIC_ID:
+		return (vioapic->id);
+		break;
+	case IOAPIC_VER:
+		return (((REDIR_ENTRIES - 1) << MAXREDIRSHIFT) | 0x11);
+		break;
+	case IOAPIC_ARB:
+		return (vioapic->id);
+		break;
+	default:
+		break;
+	}
+
+	/* redirection table entries */
+	if (regnum >= IOAPIC_REDTBL &&
+	    regnum < IOAPIC_REDTBL + REDIR_ENTRIES * 2) {
+		pin = (regnum - IOAPIC_REDTBL) / 2;
+		if ((regnum - IOAPIC_REDTBL) % 2)
+			rshift = 32;
+		else
+			rshift = 0;
+
+		return (vioapic->rtbl[pin].reg >> rshift);
+	}
+
+	return (0);
+}
+
+static void
+vioapic_write(struct vioapic *vioapic, int vcpuid, uint32_t addr, uint32_t data)
+{
+	uint64_t data64, mask64;
+	uint64_t last, changed;
+	int regnum, pin, lshift;
+	cpuset_t allvcpus;
+
+	regnum = addr & 0xff;
+	switch (regnum) {
+	case IOAPIC_ID:
+		vioapic->id = data & APIC_ID_MASK;
+		break;
+	case IOAPIC_VER:
+	case IOAPIC_ARB:
+		/* readonly */
+		break;
+	default:
+		break;
+	}
+
+	/* redirection table entries */
+	if (regnum >= IOAPIC_REDTBL &&
+	    regnum < IOAPIC_REDTBL + REDIR_ENTRIES * 2) {
+		pin = (regnum - IOAPIC_REDTBL) / 2;
+		if ((regnum - IOAPIC_REDTBL) % 2)
+			lshift = 32;
+		else
+			lshift = 0;
+
+		last = vioapic->rtbl[pin].reg;
+
+		data64 = (uint64_t)data << lshift;
+		mask64 = (uint64_t)0xffffffff << lshift;
+		vioapic->rtbl[pin].reg &= ~mask64 | RTBL_RO_BITS;
+		vioapic->rtbl[pin].reg |= data64 & ~RTBL_RO_BITS;
+
+		VIOAPIC_CTR2(vioapic, "ioapic pin%d: redir table entry %#lx",
+		    pin, vioapic->rtbl[pin].reg);
+
+		/*
+		 * If any fields in the redirection table entry (except mask
+		 * or polarity) have changed then rendezvous all the vcpus
+		 * to update their vlapic trigger-mode registers.
+		 */
+		changed = last ^ vioapic->rtbl[pin].reg;
+		if (changed & ~(IOART_INTMASK | IOART_INTPOL)) {
+			VIOAPIC_CTR1(vioapic, "ioapic pin%d: recalculate "
+			    "vlapic trigger-mode register", pin);
+			VIOAPIC_UNLOCK(vioapic);
+			allvcpus = vm_active_cpus(vioapic->vm);
+			vm_smp_rendezvous(vioapic->vm, vcpuid, allvcpus,
+			    vioapic_update_tmr, NULL);
+			VIOAPIC_LOCK(vioapic);
+		}
+
+		/*
+		 * Generate an interrupt if the following conditions are met:
+		 * - pin is not masked
+		 * - previous interrupt has been EOIed
+		 * - pin level is asserted
+		 */
+		if ((vioapic->rtbl[pin].reg & IOART_INTMASK) == IOART_INTMCLR &&
+		    (vioapic->rtbl[pin].reg & IOART_REM_IRR) == 0 &&
+		    (vioapic->rtbl[pin].acnt > 0)) {
+			VIOAPIC_CTR2(vioapic, "ioapic pin%d: asserted at rtbl "
+			    "write, acnt %d", pin, vioapic->rtbl[pin].acnt);
+			vioapic_send_intr(vioapic, pin);
+		}
+	}
+}
+
+static int
+vioapic_mmio_rw(struct vioapic *vioapic, int vcpuid, uint64_t gpa,
+    uint64_t *data, int size, bool doread)
+{
+	uint64_t offset;
+
+	offset = gpa - VIOAPIC_BASE;
+
+	/*
+	 * The IOAPIC specification allows 32-bit wide accesses to the
+	 * IOREGSEL (offset 0) and IOWIN (offset 16) registers.
+	 */
+	if (size != 4 || (offset != IOREGSEL && offset != IOWIN)) {
+		if (doread)
+			*data = 0;
+		return (0);
+	}
+
+	VIOAPIC_LOCK(vioapic);
+	if (offset == IOREGSEL) {
+		if (doread)
+			*data = vioapic->ioregsel;
+		else
+			vioapic->ioregsel = *data;
+	} else {
+		if (doread) {
+			*data = vioapic_read(vioapic, vcpuid,
+			    vioapic->ioregsel);
+		} else {
+			vioapic_write(vioapic, vcpuid, vioapic->ioregsel,
+			    *data);
+		}
+	}
+	VIOAPIC_UNLOCK(vioapic);
+
+	return (0);
+}
+
+int
+vioapic_mmio_read(void *vm, int vcpuid, uint64_t gpa, uint64_t *rval,
+    int size, void *arg)
+{
+	int error;
+	struct vioapic *vioapic;
+
+	vioapic = vm_ioapic(vm);
+	error = vioapic_mmio_rw(vioapic, vcpuid, gpa, rval, size, true);
+	return (error);
+}
+
+int
+vioapic_mmio_write(void *vm, int vcpuid, uint64_t gpa, uint64_t wval,
+    int size, void *arg)
+{
+	int error;
+	struct vioapic *vioapic;
+
+	vioapic = vm_ioapic(vm);
+	error = vioapic_mmio_rw(vioapic, vcpuid, gpa, &wval, size, false);
+	return (error);
+}
+
+void
+vioapic_process_eoi(struct vm *vm, int vcpuid, int vector)
+{
+	struct vioapic *vioapic;
+	int pin;
+
+	KASSERT(vector >= 0 && vector < 256,
+	    ("vioapic_process_eoi: invalid vector %d", vector));
+
+	vioapic = vm_ioapic(vm);
+	VIOAPIC_CTR1(vioapic, "ioapic processing eoi for vector %d", vector);
+
+	/*
+	 * XXX keep track of the pins associated with this vector instead
+	 * of iterating on every single pin each time.
+	 */
+	VIOAPIC_LOCK(vioapic);
+	for (pin = 0; pin < REDIR_ENTRIES; pin++) {
+		if ((vioapic->rtbl[pin].reg & IOART_REM_IRR) == 0)
+			continue;
+		if ((vioapic->rtbl[pin].reg & IOART_INTVEC) != vector)
+			continue;
+		vioapic->rtbl[pin].reg &= ~IOART_REM_IRR;
+		if (vioapic->rtbl[pin].acnt > 0) {
+			VIOAPIC_CTR2(vioapic, "ioapic pin%d: asserted at eoi, "
+			    "acnt %d", pin, vioapic->rtbl[pin].acnt);
+			vioapic_send_intr(vioapic, pin);
+		}
+	}
+	VIOAPIC_UNLOCK(vioapic);
+}
+
+struct vioapic *
+vioapic_init(struct vm *vm)
+{
+	int i;
+	struct vioapic *vioapic;
+
+	vioapic = malloc(sizeof(struct vioapic), M_VIOAPIC, M_WAITOK | M_ZERO);
+
+	vioapic->vm = vm;
+	mtx_init(&vioapic->mtx, "vioapic lock", NULL, MTX_SPIN);
+
+	/* Initialize all redirection entries to mask all interrupts */
+	for (i = 0; i < REDIR_ENTRIES; i++)
+		vioapic->rtbl[i].reg = 0x0001000000010000UL;
+
+	return (vioapic);
+}
+
+void
+vioapic_cleanup(struct vioapic *vioapic)
+{
+
+	free(vioapic, M_VIOAPIC);
+}
+
+int
+vioapic_pincount(struct vm *vm)
+{
+
+	return (REDIR_ENTRIES);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/io/vioapic.h b/usr/src/uts/i86pc/io/vmm/io/vioapic.h
new file mode 100644
index 0000000000..6bf3e80e05
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vioapic.h
@@ -0,0 +1,64 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _VIOAPIC_H_
+#define	_VIOAPIC_H_
+
+#define	VIOAPIC_BASE	0xFEC00000
+#define	VIOAPIC_SIZE	4096
+
+struct vioapic *vioapic_init(struct vm *vm);
+void	vioapic_cleanup(struct vioapic *vioapic);
+
+int	vioapic_assert_irq(struct vm *vm, int irq);
+int	vioapic_deassert_irq(struct vm *vm, int irq);
+int	vioapic_pulse_irq(struct vm *vm, int irq);
+
+int	vioapic_mmio_write(void *vm, int vcpuid, uint64_t gpa,
+	    uint64_t wval, int size, void *arg);
+int	vioapic_mmio_read(void *vm, int vcpuid, uint64_t gpa,
+	    uint64_t *rval, int size, void *arg);
+
+int	vioapic_pincount(struct vm *vm);
+void	vioapic_process_eoi(struct vm *vm, int vcpuid, int vector);
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/io/vlapic.c b/usr/src/uts/i86pc/io/vmm/io/vlapic.c
new file mode 100644
index 0000000000..64e34b7532
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vlapic.c
@@ -0,0 +1,1699 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/mutex.h>
+#include <sys/systm.h>
+#include <sys/smp.h>
+
+#include <x86/specialreg.h>
+#include <x86/apicreg.h>
+
+#include <machine/clock.h>
+#include <machine/smp.h>
+
+#include <machine/vmm.h>
+
+#include "vmm_lapic.h"
+#include "vmm_ktr.h"
+#include "vmm_stat.h"
+
+#include "vlapic.h"
+#include "vlapic_priv.h"
+#include "vioapic.h"
+
+#define	PRIO(x)			((x) >> 4)
+
+#define VLAPIC_VERSION		(16)
+
+#define	x2apic(vlapic)	(((vlapic)->msr_apicbase & APICBASE_X2APIC) ? 1 : 0)
+
+/*
+ * The 'vlapic->timer_mtx' is used to provide mutual exclusion between the
+ * vlapic_callout_handler() and vcpu accesses to:
+ * - timer_freq_bt, timer_period_bt, timer_fire_bt
+ * - timer LVT register
+ */
+#define	VLAPIC_TIMER_LOCK(vlapic)	mtx_lock_spin(&((vlapic)->timer_mtx))
+#define	VLAPIC_TIMER_UNLOCK(vlapic)	mtx_unlock_spin(&((vlapic)->timer_mtx))
+#define	VLAPIC_TIMER_LOCKED(vlapic)	mtx_owned(&((vlapic)->timer_mtx))
+
+/*
+ * APIC timer frequency:
+ * - arbitrary but chosen to be in the ballpark of contemporary hardware.
+ * - power-of-two to avoid loss of precision when converted to a bintime.
+ */
+#define VLAPIC_BUS_FREQ		(128 * 1024 * 1024)
+
+static __inline uint32_t
+vlapic_get_id(struct vlapic *vlapic)
+{
+
+	if (x2apic(vlapic))
+		return (vlapic->vcpuid);
+	else
+		return (vlapic->vcpuid << 24);
+}
+
+static uint32_t
+x2apic_ldr(struct vlapic *vlapic)
+{
+	int apicid;
+	uint32_t ldr;
+
+	apicid = vlapic_get_id(vlapic);
+	ldr = 1 << (apicid & 0xf);
+	ldr |= (apicid & 0xffff0) << 12;
+	return (ldr);
+}
+
+void
+vlapic_dfr_write_handler(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+
+	lapic = vlapic->apic_page;
+	if (x2apic(vlapic)) {
+		VM_CTR1(vlapic->vm, "ignoring write to DFR in x2apic mode: %#x",
+		    lapic->dfr);
+		lapic->dfr = 0;
+		return;
+	}
+
+	lapic->dfr &= APIC_DFR_MODEL_MASK;
+	lapic->dfr |= APIC_DFR_RESERVED;
+
+	if ((lapic->dfr & APIC_DFR_MODEL_MASK) == APIC_DFR_MODEL_FLAT)
+		VLAPIC_CTR0(vlapic, "vlapic DFR in Flat Model");
+	else if ((lapic->dfr & APIC_DFR_MODEL_MASK) == APIC_DFR_MODEL_CLUSTER)
+		VLAPIC_CTR0(vlapic, "vlapic DFR in Cluster Model");
+	else
+		VLAPIC_CTR1(vlapic, "DFR in Unknown Model %#x", lapic->dfr);
+}
+
+void
+vlapic_ldr_write_handler(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+
+	lapic = vlapic->apic_page;
+
+	/* LDR is read-only in x2apic mode */
+	if (x2apic(vlapic)) {
+		VLAPIC_CTR1(vlapic, "ignoring write to LDR in x2apic mode: %#x",
+		    lapic->ldr);
+		lapic->ldr = x2apic_ldr(vlapic);
+	} else {
+		lapic->ldr &= ~APIC_LDR_RESERVED;
+		VLAPIC_CTR1(vlapic, "vlapic LDR set to %#x", lapic->ldr);
+	}
+}
+
+void
+vlapic_id_write_handler(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+	
+	/*
+	 * We don't allow the ID register to be modified so reset it back to
+	 * its default value.
+	 */
+	lapic = vlapic->apic_page;
+	lapic->id = vlapic_get_id(vlapic);
+}
+
+static int
+vlapic_timer_divisor(uint32_t dcr)
+{
+	switch (dcr & 0xB) {
+	case APIC_TDCR_1:
+		return (1);
+	case APIC_TDCR_2:
+		return (2);
+	case APIC_TDCR_4:
+		return (4);
+	case APIC_TDCR_8:
+		return (8);
+	case APIC_TDCR_16:
+		return (16);
+	case APIC_TDCR_32:
+		return (32);
+	case APIC_TDCR_64:
+		return (64);
+	case APIC_TDCR_128:
+		return (128);
+	default:
+		panic("vlapic_timer_divisor: invalid dcr 0x%08x", dcr);
+	}
+}
+
+#if 0
+static inline void
+vlapic_dump_lvt(uint32_t offset, uint32_t *lvt)
+{
+	printf("Offset %x: lvt %08x (V:%02x DS:%x M:%x)\n", offset,
+	    *lvt, *lvt & APIC_LVTT_VECTOR, *lvt & APIC_LVTT_DS,
+	    *lvt & APIC_LVTT_M);
+}
+#endif
+
+static uint32_t
+vlapic_get_ccr(struct vlapic *vlapic)
+{
+	struct bintime bt_now, bt_rem;
+	struct LAPIC *lapic;
+	uint32_t ccr;
+	
+	ccr = 0;
+	lapic = vlapic->apic_page;
+
+	VLAPIC_TIMER_LOCK(vlapic);
+	if (callout_active(&vlapic->callout)) {
+		/*
+		 * If the timer is scheduled to expire in the future then
+		 * compute the value of 'ccr' based on the remaining time.
+		 */
+		binuptime(&bt_now);
+		if (bintime_cmp(&vlapic->timer_fire_bt, &bt_now, >)) {
+			bt_rem = vlapic->timer_fire_bt;
+			bintime_sub(&bt_rem, &bt_now);
+			ccr += bt_rem.sec * BT2FREQ(&vlapic->timer_freq_bt);
+			ccr += bt_rem.frac / vlapic->timer_freq_bt.frac;
+		}
+	}
+#ifdef	__FreeBSD__
+	KASSERT(ccr <= lapic->icr_timer, ("vlapic_get_ccr: invalid ccr %#x, "
+	    "icr_timer is %#x", ccr, lapic->icr_timer));
+#else
+	KASSERT(ccr <= lapic->icr_timer, ("vlapic_get_ccr: invalid ccr %x, "
+	    "icr_timer is %x", ccr, lapic->icr_timer));
+#endif
+	VLAPIC_CTR2(vlapic, "vlapic ccr_timer = %#x, icr_timer = %#x",
+	    ccr, lapic->icr_timer);
+	VLAPIC_TIMER_UNLOCK(vlapic);
+	return (ccr);
+}
+
+void
+vlapic_dcr_write_handler(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+	int divisor;
+	
+	lapic = vlapic->apic_page;
+	VLAPIC_TIMER_LOCK(vlapic);
+
+	divisor = vlapic_timer_divisor(lapic->dcr_timer);
+	VLAPIC_CTR2(vlapic, "vlapic dcr_timer=%#x, divisor=%d",
+	    lapic->dcr_timer, divisor);
+
+	/*
+	 * Update the timer frequency and the timer period.
+	 *
+	 * XXX changes to the frequency divider will not take effect until
+	 * the timer is reloaded.
+	 */
+	FREQ2BT(VLAPIC_BUS_FREQ / divisor, &vlapic->timer_freq_bt);
+	vlapic->timer_period_bt = vlapic->timer_freq_bt;
+	bintime_mul(&vlapic->timer_period_bt, lapic->icr_timer);
+
+	VLAPIC_TIMER_UNLOCK(vlapic);
+}
+
+void
+vlapic_esr_write_handler(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+	
+	lapic = vlapic->apic_page;
+	lapic->esr = vlapic->esr_pending;
+	vlapic->esr_pending = 0;
+}
+
+int
+vlapic_set_intr_ready(struct vlapic *vlapic, int vector, bool level)
+{
+	struct LAPIC *lapic;
+	uint32_t *irrptr, *tmrptr, mask;
+	int idx;
+
+	KASSERT(vector >= 0 && vector < 256, ("invalid vector %d", vector));
+
+	lapic = vlapic->apic_page;
+	if (!(lapic->svr & APIC_SVR_ENABLE)) {
+		VLAPIC_CTR1(vlapic, "vlapic is software disabled, ignoring "
+		    "interrupt %d", vector);
+		return (0);
+	}
+
+	if (vector < 16) {
+		vlapic_set_error(vlapic, APIC_ESR_RECEIVE_ILLEGAL_VECTOR);
+		VLAPIC_CTR1(vlapic, "vlapic ignoring interrupt to vector %d",
+		    vector);
+		return (1);
+	}
+
+	if (vlapic->ops.set_intr_ready)
+		return ((*vlapic->ops.set_intr_ready)(vlapic, vector, level));
+
+	idx = (vector / 32) * 4;
+	mask = 1 << (vector % 32);
+
+	irrptr = &lapic->irr0;
+	atomic_set_int(&irrptr[idx], mask);
+
+	/*
+	 * Verify that the trigger-mode of the interrupt matches with
+	 * the vlapic TMR registers.
+	 */
+	tmrptr = &lapic->tmr0;
+	if ((tmrptr[idx] & mask) != (level ? mask : 0)) {
+		VLAPIC_CTR3(vlapic, "vlapic TMR[%d] is 0x%08x but "
+		    "interrupt is %s-triggered", idx / 4, tmrptr[idx],
+		    level ? "level" : "edge");
+	}
+
+	VLAPIC_CTR_IRR(vlapic, "vlapic_set_intr_ready");
+	return (1);
+}
+
+static __inline uint32_t *
+vlapic_get_lvtptr(struct vlapic *vlapic, uint32_t offset)
+{
+	struct LAPIC	*lapic = vlapic->apic_page;
+	int 		 i;
+
+	switch (offset) {
+	case APIC_OFFSET_CMCI_LVT:
+		return (&lapic->lvt_cmci);
+	case APIC_OFFSET_TIMER_LVT ... APIC_OFFSET_ERROR_LVT:
+		i = (offset - APIC_OFFSET_TIMER_LVT) >> 2;
+		return ((&lapic->lvt_timer) + i);;
+	default:
+		panic("vlapic_get_lvt: invalid LVT\n");
+	}
+}
+
+static __inline int
+lvt_off_to_idx(uint32_t offset)
+{
+	int index;
+
+	switch (offset) {
+	case APIC_OFFSET_CMCI_LVT:
+		index = APIC_LVT_CMCI;
+		break;
+	case APIC_OFFSET_TIMER_LVT:
+		index = APIC_LVT_TIMER;
+		break;
+	case APIC_OFFSET_THERM_LVT:
+		index = APIC_LVT_THERMAL;
+		break;
+	case APIC_OFFSET_PERF_LVT:
+		index = APIC_LVT_PMC;
+		break;
+	case APIC_OFFSET_LINT0_LVT:
+		index = APIC_LVT_LINT0;
+		break;
+	case APIC_OFFSET_LINT1_LVT:
+		index = APIC_LVT_LINT1;
+		break;
+	case APIC_OFFSET_ERROR_LVT:
+		index = APIC_LVT_ERROR;
+		break;
+	default:
+		index = -1;
+		break;
+	}
+#ifdef	__FreeBSD__
+	KASSERT(index >= 0 && index <= VLAPIC_MAXLVT_INDEX, ("lvt_off_to_idx: "
+	    "invalid lvt index %d for offset %#x", index, offset));
+#else
+	KASSERT(index >= 0 && index <= VLAPIC_MAXLVT_INDEX, ("lvt_off_to_idx: "
+	    "invalid lvt index %d for offset %x", index, offset));
+#endif
+
+	return (index);
+}
+
+static __inline uint32_t
+vlapic_get_lvt(struct vlapic *vlapic, uint32_t offset)
+{
+	int idx;
+	uint32_t val;
+
+	idx = lvt_off_to_idx(offset);
+	val = atomic_load_acq_32(&vlapic->lvt_last[idx]);
+	return (val);
+}
+
+void
+vlapic_lvt_write_handler(struct vlapic *vlapic, uint32_t offset)
+{
+	uint32_t *lvtptr, mask, val;
+	struct LAPIC *lapic;
+	int idx;
+	
+	lapic = vlapic->apic_page;
+	lvtptr = vlapic_get_lvtptr(vlapic, offset);	
+	val = *lvtptr;
+	idx = lvt_off_to_idx(offset);
+
+	if (!(lapic->svr & APIC_SVR_ENABLE))
+		val |= APIC_LVT_M;
+	mask = APIC_LVT_M | APIC_LVT_DS | APIC_LVT_VECTOR;
+	switch (offset) {
+	case APIC_OFFSET_TIMER_LVT:
+		mask |= APIC_LVTT_TM;
+		break;
+	case APIC_OFFSET_ERROR_LVT:
+		break;
+	case APIC_OFFSET_LINT0_LVT:
+	case APIC_OFFSET_LINT1_LVT:
+		mask |= APIC_LVT_TM | APIC_LVT_RIRR | APIC_LVT_IIPP;
+		/* FALLTHROUGH */
+	default:
+		mask |= APIC_LVT_DM;
+		break;
+	}
+	val &= mask;
+	*lvtptr = val;
+	atomic_store_rel_32(&vlapic->lvt_last[idx], val);
+}
+
+static void
+vlapic_mask_lvts(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic = vlapic->apic_page;
+
+	lapic->lvt_cmci |= APIC_LVT_M;
+	vlapic_lvt_write_handler(vlapic, APIC_OFFSET_CMCI_LVT);
+
+	lapic->lvt_timer |= APIC_LVT_M;
+	vlapic_lvt_write_handler(vlapic, APIC_OFFSET_TIMER_LVT);
+
+	lapic->lvt_thermal |= APIC_LVT_M;
+	vlapic_lvt_write_handler(vlapic, APIC_OFFSET_THERM_LVT);
+
+	lapic->lvt_pcint |= APIC_LVT_M;
+	vlapic_lvt_write_handler(vlapic, APIC_OFFSET_PERF_LVT);
+
+	lapic->lvt_lint0 |= APIC_LVT_M;
+	vlapic_lvt_write_handler(vlapic, APIC_OFFSET_LINT0_LVT);
+
+	lapic->lvt_lint1 |= APIC_LVT_M;
+	vlapic_lvt_write_handler(vlapic, APIC_OFFSET_LINT1_LVT);
+
+	lapic->lvt_error |= APIC_LVT_M;
+	vlapic_lvt_write_handler(vlapic, APIC_OFFSET_ERROR_LVT);
+}
+
+static int
+vlapic_fire_lvt(struct vlapic *vlapic, uint32_t lvt)
+{
+	uint32_t vec, mode;
+
+	if (lvt & APIC_LVT_M)
+		return (0);
+
+	vec = lvt & APIC_LVT_VECTOR;
+	mode = lvt & APIC_LVT_DM;
+
+	switch (mode) {
+	case APIC_LVT_DM_FIXED:
+		if (vec < 16) {
+			vlapic_set_error(vlapic, APIC_ESR_SEND_ILLEGAL_VECTOR);
+			return (0);
+		}
+		if (vlapic_set_intr_ready(vlapic, vec, false))
+			vcpu_notify_event(vlapic->vm, vlapic->vcpuid, true);
+		break;
+	case APIC_LVT_DM_NMI:
+		vm_inject_nmi(vlapic->vm, vlapic->vcpuid);
+		break;
+	case APIC_LVT_DM_EXTINT:
+		vm_inject_extint(vlapic->vm, vlapic->vcpuid);
+		break;
+	default:
+		// Other modes ignored
+		return (0);
+	}
+	return (1);
+}
+
+#if 1
+static void
+dump_isrvec_stk(struct vlapic *vlapic)
+{
+	int i;
+	uint32_t *isrptr;
+
+	isrptr = &vlapic->apic_page->isr0;
+	for (i = 0; i < 8; i++)
+		printf("ISR%d 0x%08x\n", i, isrptr[i * 4]);
+
+	for (i = 0; i <= vlapic->isrvec_stk_top; i++)
+		printf("isrvec_stk[%d] = %d\n", i, vlapic->isrvec_stk[i]);
+}
+#endif
+
+/*
+ * Algorithm adopted from section "Interrupt, Task and Processor Priority"
+ * in Intel Architecture Manual Vol 3a.
+ */
+static void
+vlapic_update_ppr(struct vlapic *vlapic)
+{
+	int isrvec, tpr, ppr;
+
+	/*
+	 * Note that the value on the stack at index 0 is always 0.
+	 *
+	 * This is a placeholder for the value of ISRV when none of the
+	 * bits is set in the ISRx registers.
+	 */
+	isrvec = vlapic->isrvec_stk[vlapic->isrvec_stk_top];
+	tpr = vlapic->apic_page->tpr;
+
+#if 1
+	{
+		int i, lastprio, curprio, vector, idx;
+		uint32_t *isrptr;
+
+		if (vlapic->isrvec_stk_top == 0 && isrvec != 0)
+			panic("isrvec_stk is corrupted: %d", isrvec);
+
+		/*
+		 * Make sure that the priority of the nested interrupts is
+		 * always increasing.
+		 */
+		lastprio = -1;
+		for (i = 1; i <= vlapic->isrvec_stk_top; i++) {
+			curprio = PRIO(vlapic->isrvec_stk[i]);
+			if (curprio <= lastprio) {
+				dump_isrvec_stk(vlapic);
+				panic("isrvec_stk does not satisfy invariant");
+			}
+			lastprio = curprio;
+		}
+
+		/*
+		 * Make sure that each bit set in the ISRx registers has a
+		 * corresponding entry on the isrvec stack.
+		 */
+		i = 1;
+		isrptr = &vlapic->apic_page->isr0;
+		for (vector = 0; vector < 256; vector++) {
+			idx = (vector / 32) * 4;
+			if (isrptr[idx] & (1 << (vector % 32))) {
+				if (i > vlapic->isrvec_stk_top ||
+				    vlapic->isrvec_stk[i] != vector) {
+					dump_isrvec_stk(vlapic);
+					panic("ISR and isrvec_stk out of sync");
+				}
+				i++;
+			}
+		}
+	}
+#endif
+
+	if (PRIO(tpr) >= PRIO(isrvec))
+		ppr = tpr;
+	else
+		ppr = isrvec & 0xf0;
+
+	vlapic->apic_page->ppr = ppr;
+	VLAPIC_CTR1(vlapic, "vlapic_update_ppr 0x%02x", ppr);
+}
+
+static VMM_STAT(VLAPIC_GRATUITOUS_EOI, "EOI without any in-service interrupt");
+
+static void
+vlapic_process_eoi(struct vlapic *vlapic)
+{
+	struct LAPIC	*lapic = vlapic->apic_page;
+	uint32_t	*isrptr, *tmrptr;
+	int		i, idx, bitpos, vector;
+
+	isrptr = &lapic->isr0;
+	tmrptr = &lapic->tmr0;
+
+	for (i = 7; i >= 0; i--) {
+		idx = i * 4;
+		bitpos = fls(isrptr[idx]);
+		if (bitpos-- != 0) {
+			if (vlapic->isrvec_stk_top <= 0) {
+				panic("invalid vlapic isrvec_stk_top %d",
+				      vlapic->isrvec_stk_top);
+			}
+			isrptr[idx] &= ~(1 << bitpos);
+			vector = i * 32 + bitpos;
+			VCPU_CTR1(vlapic->vm, vlapic->vcpuid, "EOI vector %d",
+			    vector);
+			VLAPIC_CTR_ISR(vlapic, "vlapic_process_eoi");
+			vlapic->isrvec_stk_top--;
+			vlapic_update_ppr(vlapic);
+			if ((tmrptr[idx] & (1 << bitpos)) != 0) {
+				vioapic_process_eoi(vlapic->vm, vlapic->vcpuid,
+				    vector);
+			}
+			return;
+		}
+	}
+	VCPU_CTR0(vlapic->vm, vlapic->vcpuid, "Gratuitous EOI");
+	vmm_stat_incr(vlapic->vm, vlapic->vcpuid, VLAPIC_GRATUITOUS_EOI, 1);
+}
+
+static __inline int
+vlapic_get_lvt_field(uint32_t lvt, uint32_t mask)
+{
+
+	return (lvt & mask);
+}
+
+static __inline int
+vlapic_periodic_timer(struct vlapic *vlapic)
+{
+	uint32_t lvt;
+	
+	lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_TIMER_LVT);
+
+	return (vlapic_get_lvt_field(lvt, APIC_LVTT_TM_PERIODIC));
+}
+
+static VMM_STAT(VLAPIC_INTR_ERROR, "error interrupts generated by vlapic");
+
+void
+vlapic_set_error(struct vlapic *vlapic, uint32_t mask)
+{
+	uint32_t lvt;
+
+	vlapic->esr_pending |= mask;
+	if (vlapic->esr_firing)
+		return;
+	vlapic->esr_firing = 1;
+
+	// The error LVT always uses the fixed delivery mode.
+	lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_ERROR_LVT);
+	if (vlapic_fire_lvt(vlapic, lvt | APIC_LVT_DM_FIXED)) {
+		vmm_stat_incr(vlapic->vm, vlapic->vcpuid, VLAPIC_INTR_ERROR, 1);
+	}
+	vlapic->esr_firing = 0;
+}
+
+static VMM_STAT(VLAPIC_INTR_TIMER, "timer interrupts generated by vlapic");
+
+static void
+vlapic_fire_timer(struct vlapic *vlapic)
+{
+	uint32_t lvt;
+
+	KASSERT(VLAPIC_TIMER_LOCKED(vlapic), ("vlapic_fire_timer not locked"));
+	
+	// The timer LVT always uses the fixed delivery mode.
+	lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_TIMER_LVT);
+	if (vlapic_fire_lvt(vlapic, lvt | APIC_LVT_DM_FIXED)) {
+		VLAPIC_CTR0(vlapic, "vlapic timer fired");
+		vmm_stat_incr(vlapic->vm, vlapic->vcpuid, VLAPIC_INTR_TIMER, 1);
+	}
+}
+
+static VMM_STAT(VLAPIC_INTR_CMC,
+    "corrected machine check interrupts generated by vlapic");
+
+void
+vlapic_fire_cmci(struct vlapic *vlapic)
+{
+	uint32_t lvt;
+
+	lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_CMCI_LVT);
+	if (vlapic_fire_lvt(vlapic, lvt)) {
+		vmm_stat_incr(vlapic->vm, vlapic->vcpuid, VLAPIC_INTR_CMC, 1);
+	}
+}
+
+static VMM_STAT_ARRAY(LVTS_TRIGGERRED, VLAPIC_MAXLVT_INDEX + 1,
+    "lvts triggered");
+
+int
+vlapic_trigger_lvt(struct vlapic *vlapic, int vector)
+{
+	uint32_t lvt;
+
+	if (vlapic_enabled(vlapic) == false) {
+		/*
+		 * When the local APIC is global/hardware disabled,
+		 * LINT[1:0] pins are configured as INTR and NMI pins,
+		 * respectively.
+		*/
+		switch (vector) {
+			case APIC_LVT_LINT0:
+				vm_inject_extint(vlapic->vm, vlapic->vcpuid);
+				break;
+			case APIC_LVT_LINT1:
+				vm_inject_nmi(vlapic->vm, vlapic->vcpuid);
+				break;
+			default:
+				break;
+		}
+		return (0);
+	}
+
+	switch (vector) {
+	case APIC_LVT_LINT0:
+		lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_LINT0_LVT);
+		break;
+	case APIC_LVT_LINT1:
+		lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_LINT1_LVT);
+		break;
+	case APIC_LVT_TIMER:
+		lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_TIMER_LVT);
+		lvt |= APIC_LVT_DM_FIXED;
+		break;
+	case APIC_LVT_ERROR:
+		lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_ERROR_LVT);
+		lvt |= APIC_LVT_DM_FIXED;
+		break;
+	case APIC_LVT_PMC:
+		lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_PERF_LVT);
+		break;
+	case APIC_LVT_THERMAL:
+		lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_THERM_LVT);
+		break;
+	case APIC_LVT_CMCI:
+		lvt = vlapic_get_lvt(vlapic, APIC_OFFSET_CMCI_LVT);
+		break;
+	default:
+		return (EINVAL);
+	}
+	if (vlapic_fire_lvt(vlapic, lvt)) {
+		vmm_stat_array_incr(vlapic->vm, vlapic->vcpuid,
+		    LVTS_TRIGGERRED, vector, 1);
+	}
+	return (0);
+}
+
+static void
+vlapic_callout_handler(void *arg)
+{
+	struct vlapic *vlapic;
+	struct bintime bt, btnow;
+	sbintime_t rem_sbt;
+
+	vlapic = arg;
+
+	VLAPIC_TIMER_LOCK(vlapic);
+	if (callout_pending(&vlapic->callout))	/* callout was reset */
+		goto done;
+
+	if (!callout_active(&vlapic->callout))	/* callout was stopped */
+		goto done;
+
+	callout_deactivate(&vlapic->callout);
+
+	vlapic_fire_timer(vlapic);
+
+	if (vlapic_periodic_timer(vlapic)) {
+		binuptime(&btnow);
+#ifdef	__FreeBSD__
+		KASSERT(bintime_cmp(&btnow, &vlapic->timer_fire_bt, >=),
+		    ("vlapic callout at %#lx.%#lx, expected at %#lx.#%lx",
+		    btnow.sec, btnow.frac, vlapic->timer_fire_bt.sec,
+		    vlapic->timer_fire_bt.frac));
+#else
+		KASSERT(bintime_cmp(&btnow, &vlapic->timer_fire_bt, >=),
+		    ("vlapic callout at %lx.%lx, expected at %lx.%lx",
+		    btnow.sec, btnow.frac, vlapic->timer_fire_bt.sec,
+		    vlapic->timer_fire_bt.frac));
+#endif
+
+		/*
+		 * Compute the delta between when the timer was supposed to
+		 * fire and the present time.
+		 */
+		bt = btnow;
+		bintime_sub(&bt, &vlapic->timer_fire_bt);
+
+		rem_sbt = bttosbt(vlapic->timer_period_bt);
+		if (bintime_cmp(&bt, &vlapic->timer_period_bt, <)) {
+			/*
+			 * Adjust the time until the next countdown downward
+			 * to account for the lost time.
+			 */
+			rem_sbt -= bttosbt(bt);
+		} else {
+			/*
+			 * If the delta is greater than the timer period then
+			 * just reset our time base instead of trying to catch
+			 * up.
+			 */
+			vlapic->timer_fire_bt = btnow;
+			VLAPIC_CTR2(vlapic, "vlapic timer lagging by %lu "
+			    "usecs, period is %lu usecs - resetting time base",
+			    bttosbt(bt) / SBT_1US,
+			    bttosbt(vlapic->timer_period_bt) / SBT_1US);
+		}
+
+		bintime_add(&vlapic->timer_fire_bt, &vlapic->timer_period_bt);
+		callout_reset_sbt(&vlapic->callout, rem_sbt, 0,
+		    vlapic_callout_handler, vlapic, 0);
+	}
+done:
+	VLAPIC_TIMER_UNLOCK(vlapic);
+}
+
+void
+vlapic_icrtmr_write_handler(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+	sbintime_t sbt;
+	uint32_t icr_timer;
+
+	VLAPIC_TIMER_LOCK(vlapic);
+
+	lapic = vlapic->apic_page;
+	icr_timer = lapic->icr_timer;
+
+	vlapic->timer_period_bt = vlapic->timer_freq_bt;
+	bintime_mul(&vlapic->timer_period_bt, icr_timer);
+
+	if (icr_timer != 0) {
+		binuptime(&vlapic->timer_fire_bt);
+		bintime_add(&vlapic->timer_fire_bt, &vlapic->timer_period_bt);
+
+		sbt = bttosbt(vlapic->timer_period_bt);
+		callout_reset_sbt(&vlapic->callout, sbt, 0,
+		    vlapic_callout_handler, vlapic, 0);
+	} else
+		callout_stop(&vlapic->callout);
+
+	VLAPIC_TIMER_UNLOCK(vlapic);
+}
+
+/*
+ * This function populates 'dmask' with the set of vcpus that match the
+ * addressing specified by the (dest, phys, lowprio) tuple.
+ * 
+ * 'x2apic_dest' specifies whether 'dest' is interpreted as x2APIC (32-bit)
+ * or xAPIC (8-bit) destination field.
+ */
+static void
+vlapic_calcdest(struct vm *vm, cpuset_t *dmask, uint32_t dest, bool phys,
+    bool lowprio, bool x2apic_dest)
+{
+	struct vlapic *vlapic;
+	uint32_t dfr, ldr, ldest, cluster;
+	uint32_t mda_flat_ldest, mda_cluster_ldest, mda_ldest, mda_cluster_id;
+	cpuset_t amask;
+	int vcpuid;
+
+	if ((x2apic_dest && dest == 0xffffffff) ||
+	    (!x2apic_dest && dest == 0xff)) {
+		/*
+		 * Broadcast in both logical and physical modes.
+		 */
+		*dmask = vm_active_cpus(vm);
+		return;
+	}
+
+	if (phys) {
+		/*
+		 * Physical mode: destination is APIC ID.
+		 */
+		CPU_ZERO(dmask);
+		vcpuid = vm_apicid2vcpuid(vm, dest);
+		if (vcpuid < VM_MAXCPU)
+			CPU_SET(vcpuid, dmask);
+	} else {
+		/*
+		 * In the "Flat Model" the MDA is interpreted as an 8-bit wide
+		 * bitmask. This model is only available in the xAPIC mode.
+		 */
+		mda_flat_ldest = dest & 0xff;
+
+		/*
+		 * In the "Cluster Model" the MDA is used to identify a
+		 * specific cluster and a set of APICs in that cluster.
+		 */
+		if (x2apic_dest) {
+			mda_cluster_id = dest >> 16;
+			mda_cluster_ldest = dest & 0xffff;
+		} else {
+			mda_cluster_id = (dest >> 4) & 0xf;
+			mda_cluster_ldest = dest & 0xf;
+		}
+
+		/*
+		 * Logical mode: match each APIC that has a bit set
+		 * in its LDR that matches a bit in the ldest.
+		 */
+		CPU_ZERO(dmask);
+		amask = vm_active_cpus(vm);
+		while ((vcpuid = CPU_FFS(&amask)) != 0) {
+			vcpuid--;
+			CPU_CLR(vcpuid, &amask);
+
+			vlapic = vm_lapic(vm, vcpuid);
+			dfr = vlapic->apic_page->dfr;
+			ldr = vlapic->apic_page->ldr;
+
+			if ((dfr & APIC_DFR_MODEL_MASK) ==
+			    APIC_DFR_MODEL_FLAT) {
+				ldest = ldr >> 24;
+				mda_ldest = mda_flat_ldest;
+			} else if ((dfr & APIC_DFR_MODEL_MASK) ==
+			    APIC_DFR_MODEL_CLUSTER) {
+				if (x2apic(vlapic)) {
+					cluster = ldr >> 16;
+					ldest = ldr & 0xffff;
+				} else {
+					cluster = ldr >> 28;
+					ldest = (ldr >> 24) & 0xf;
+				}
+				if (cluster != mda_cluster_id)
+					continue;
+				mda_ldest = mda_cluster_ldest;
+			} else {
+				/*
+				 * Guest has configured a bad logical
+				 * model for this vcpu - skip it.
+				 */
+				VLAPIC_CTR1(vlapic, "vlapic has bad logical "
+				    "model %x - cannot deliver interrupt", dfr);
+				continue;
+			}
+
+			if ((mda_ldest & ldest) != 0) {
+				CPU_SET(vcpuid, dmask);
+				if (lowprio)
+					break;
+			}
+		}
+	}
+}
+
+static VMM_STAT_ARRAY(IPIS_SENT, VM_MAXCPU, "ipis sent to vcpu");
+
+static void
+vlapic_set_tpr(struct vlapic *vlapic, uint8_t val)
+{
+	struct LAPIC *lapic = vlapic->apic_page;
+
+	if (lapic->tpr != val) {
+		VCPU_CTR2(vlapic->vm, vlapic->vcpuid, "vlapic TPR changed "
+		    "from %#x to %#x", lapic->tpr, val);
+		lapic->tpr = val;
+		vlapic_update_ppr(vlapic);
+	}
+}
+
+static uint8_t
+vlapic_get_tpr(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic = vlapic->apic_page;
+
+	return (lapic->tpr);
+}
+
+void
+vlapic_set_cr8(struct vlapic *vlapic, uint64_t val)
+{
+	uint8_t tpr;
+
+	if (val & ~0xf) {
+		vm_inject_gp(vlapic->vm, vlapic->vcpuid);
+		return;
+	}
+
+	tpr = val << 4;
+	vlapic_set_tpr(vlapic, tpr);
+}
+
+uint64_t
+vlapic_get_cr8(struct vlapic *vlapic)
+{
+	uint8_t tpr;
+
+	tpr = vlapic_get_tpr(vlapic);
+	return (tpr >> 4);
+}
+
+int
+vlapic_icrlo_write_handler(struct vlapic *vlapic, bool *retu)
+{
+	int i;
+	bool phys;
+	cpuset_t dmask;
+	uint64_t icrval;
+	uint32_t dest, vec, mode;
+	struct vlapic *vlapic2;
+	struct vm_exit *vmexit;
+	struct LAPIC *lapic;
+
+	lapic = vlapic->apic_page;
+	lapic->icr_lo &= ~APIC_DELSTAT_PEND;
+	icrval = ((uint64_t)lapic->icr_hi << 32) | lapic->icr_lo;
+
+	if (x2apic(vlapic))
+		dest = icrval >> 32;
+	else
+		dest = icrval >> (32 + 24);
+	vec = icrval & APIC_VECTOR_MASK;
+	mode = icrval & APIC_DELMODE_MASK;
+
+	if (mode == APIC_DELMODE_FIXED && vec < 16) {
+		vlapic_set_error(vlapic, APIC_ESR_SEND_ILLEGAL_VECTOR);
+		VLAPIC_CTR1(vlapic, "Ignoring invalid IPI %d", vec);
+		return (0);
+	}
+
+	VLAPIC_CTR2(vlapic, "icrlo 0x%016lx triggered ipi %d", icrval, vec);
+
+	if (mode == APIC_DELMODE_FIXED || mode == APIC_DELMODE_NMI) {
+		switch (icrval & APIC_DEST_MASK) {
+		case APIC_DEST_DESTFLD:
+			phys = ((icrval & APIC_DESTMODE_LOG) == 0);
+			vlapic_calcdest(vlapic->vm, &dmask, dest, phys, false,
+			    x2apic(vlapic));
+			break;
+		case APIC_DEST_SELF:
+			CPU_SETOF(vlapic->vcpuid, &dmask);
+			break;
+		case APIC_DEST_ALLISELF:
+			dmask = vm_active_cpus(vlapic->vm);
+			break;
+		case APIC_DEST_ALLESELF:
+			dmask = vm_active_cpus(vlapic->vm);
+			CPU_CLR(vlapic->vcpuid, &dmask);
+			break;
+		default:
+			CPU_ZERO(&dmask);	/* satisfy gcc */
+			break;
+		}
+
+		while ((i = CPU_FFS(&dmask)) != 0) {
+			i--;
+			CPU_CLR(i, &dmask);
+			if (mode == APIC_DELMODE_FIXED) {
+				lapic_intr_edge(vlapic->vm, i, vec);
+				vmm_stat_array_incr(vlapic->vm, vlapic->vcpuid,
+						    IPIS_SENT, i, 1);
+				VLAPIC_CTR2(vlapic, "vlapic sending ipi %d "
+				    "to vcpuid %d", vec, i);
+			} else {
+				vm_inject_nmi(vlapic->vm, i);
+				VLAPIC_CTR1(vlapic, "vlapic sending ipi nmi "
+				    "to vcpuid %d", i);
+			}
+		}
+
+		return (0);	/* handled completely in the kernel */
+	}
+
+	if (mode == APIC_DELMODE_INIT) {
+		if ((icrval & APIC_LEVEL_MASK) == APIC_LEVEL_DEASSERT)
+			return (0);
+
+		if (vlapic->vcpuid == 0 && dest != 0 && dest < VM_MAXCPU) {
+			vlapic2 = vm_lapic(vlapic->vm, dest);
+
+			/* move from INIT to waiting-for-SIPI state */
+			if (vlapic2->boot_state == BS_INIT) {
+				vlapic2->boot_state = BS_SIPI;
+			}
+
+			return (0);
+		}
+	}
+
+	if (mode == APIC_DELMODE_STARTUP) {
+		if (vlapic->vcpuid == 0 && dest != 0 && dest < VM_MAXCPU) {
+			vlapic2 = vm_lapic(vlapic->vm, dest);
+
+			/*
+			 * Ignore SIPIs in any state other than wait-for-SIPI
+			 */
+			if (vlapic2->boot_state != BS_SIPI)
+				return (0);
+
+			vlapic2->boot_state = BS_RUNNING;
+
+			*retu = true;
+			vmexit = vm_exitinfo(vlapic->vm, vlapic->vcpuid);
+			vmexit->exitcode = VM_EXITCODE_SPINUP_AP;
+			vmexit->u.spinup_ap.vcpu = dest;
+			vmexit->u.spinup_ap.rip = vec << PAGE_SHIFT;
+
+			return (0);
+		}
+	}
+
+	/*
+	 * This will cause a return to userland.
+	 */
+	return (1);
+}
+
+void
+vlapic_self_ipi_handler(struct vlapic *vlapic, uint64_t val)
+{
+	int vec;
+
+	KASSERT(x2apic(vlapic), ("SELF_IPI does not exist in xAPIC mode"));
+
+	vec = val & 0xff;
+	lapic_intr_edge(vlapic->vm, vlapic->vcpuid, vec);
+	vmm_stat_array_incr(vlapic->vm, vlapic->vcpuid, IPIS_SENT,
+	    vlapic->vcpuid, 1);
+	VLAPIC_CTR1(vlapic, "vlapic self-ipi %d", vec);
+}
+
+int
+vlapic_pending_intr(struct vlapic *vlapic, int *vecptr)
+{
+	struct LAPIC	*lapic = vlapic->apic_page;
+	int	  	 idx, i, bitpos, vector;
+	uint32_t	*irrptr, val;
+
+	if (vlapic->ops.pending_intr)
+		return ((*vlapic->ops.pending_intr)(vlapic, vecptr));
+
+	irrptr = &lapic->irr0;
+
+	for (i = 7; i >= 0; i--) {
+		idx = i * 4;
+		val = atomic_load_acq_int(&irrptr[idx]);
+		bitpos = fls(val);
+		if (bitpos != 0) {
+			vector = i * 32 + (bitpos - 1);
+			if (PRIO(vector) > PRIO(lapic->ppr)) {
+				VLAPIC_CTR1(vlapic, "pending intr %d", vector);
+				if (vecptr != NULL)
+					*vecptr = vector;
+				return (1);
+			} else 
+				break;
+		}
+	}
+	return (0);
+}
+
+void
+vlapic_intr_accepted(struct vlapic *vlapic, int vector)
+{
+	struct LAPIC	*lapic = vlapic->apic_page;
+	uint32_t	*irrptr, *isrptr;
+	int		idx, stk_top;
+
+	if (vlapic->ops.intr_accepted)
+		return ((*vlapic->ops.intr_accepted)(vlapic, vector));
+
+	/*
+	 * clear the ready bit for vector being accepted in irr 
+	 * and set the vector as in service in isr.
+	 */
+	idx = (vector / 32) * 4;
+
+	irrptr = &lapic->irr0;
+	atomic_clear_int(&irrptr[idx], 1 << (vector % 32));
+	VLAPIC_CTR_IRR(vlapic, "vlapic_intr_accepted");
+
+	isrptr = &lapic->isr0;
+	isrptr[idx] |= 1 << (vector % 32);
+	VLAPIC_CTR_ISR(vlapic, "vlapic_intr_accepted");
+
+	/*
+	 * Update the PPR
+	 */
+	vlapic->isrvec_stk_top++;
+
+	stk_top = vlapic->isrvec_stk_top;
+	if (stk_top >= ISRVEC_STK_SIZE)
+		panic("isrvec_stk_top overflow %d", stk_top);
+
+	vlapic->isrvec_stk[stk_top] = vector;
+	vlapic_update_ppr(vlapic);
+}
+
+void
+vlapic_svr_write_handler(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+	uint32_t old, new, changed;
+
+	lapic = vlapic->apic_page;
+
+	new = lapic->svr;
+	old = vlapic->svr_last;
+	vlapic->svr_last = new;
+
+	changed = old ^ new;
+	if ((changed & APIC_SVR_ENABLE) != 0) {
+		if ((new & APIC_SVR_ENABLE) == 0) {
+			/*
+			 * The apic is now disabled so stop the apic timer
+			 * and mask all the LVT entries.
+			 */
+			VLAPIC_CTR0(vlapic, "vlapic is software-disabled");
+			VLAPIC_TIMER_LOCK(vlapic);
+			callout_stop(&vlapic->callout);
+			VLAPIC_TIMER_UNLOCK(vlapic);
+			vlapic_mask_lvts(vlapic);
+		} else {
+			/*
+			 * The apic is now enabled so restart the apic timer
+			 * if it is configured in periodic mode.
+			 */
+			VLAPIC_CTR0(vlapic, "vlapic is software-enabled");
+			if (vlapic_periodic_timer(vlapic))
+				vlapic_icrtmr_write_handler(vlapic);
+		}
+	}
+}
+
+int
+vlapic_read(struct vlapic *vlapic, int mmio_access, uint64_t offset,
+    uint64_t *data, bool *retu)
+{
+	struct LAPIC	*lapic = vlapic->apic_page;
+	uint32_t	*reg;
+	int		 i;
+
+	/* Ignore MMIO accesses in x2APIC mode */
+	if (x2apic(vlapic) && mmio_access) {
+		VLAPIC_CTR1(vlapic, "MMIO read from offset %#lx in x2APIC mode",
+		    offset);
+		*data = 0;
+		goto done;
+	}
+
+	if (!x2apic(vlapic) && !mmio_access) {
+		/*
+		 * XXX Generate GP fault for MSR accesses in xAPIC mode
+		 */
+		VLAPIC_CTR1(vlapic, "x2APIC MSR read from offset %#lx in "
+		    "xAPIC mode", offset);
+		*data = 0;
+		goto done;
+	}
+
+	if (offset > sizeof(*lapic)) {
+		*data = 0;
+		goto done;
+	}
+	
+	offset &= ~3;
+	switch(offset)
+	{
+		case APIC_OFFSET_ID:
+			*data = lapic->id;
+			break;
+		case APIC_OFFSET_VER:
+			*data = lapic->version;
+			break;
+		case APIC_OFFSET_TPR:
+			*data = vlapic_get_tpr(vlapic);
+			break;
+		case APIC_OFFSET_APR:
+			*data = lapic->apr;
+			break;
+		case APIC_OFFSET_PPR:
+			*data = lapic->ppr;
+			break;
+		case APIC_OFFSET_EOI:
+			*data = lapic->eoi;
+			break;
+		case APIC_OFFSET_LDR:
+			*data = lapic->ldr;
+			break;
+		case APIC_OFFSET_DFR:
+			*data = lapic->dfr;
+			break;
+		case APIC_OFFSET_SVR:
+			*data = lapic->svr;
+			break;
+		case APIC_OFFSET_ISR0 ... APIC_OFFSET_ISR7:
+			i = (offset - APIC_OFFSET_ISR0) >> 2;
+			reg = &lapic->isr0;
+			*data = *(reg + i);
+			break;
+		case APIC_OFFSET_TMR0 ... APIC_OFFSET_TMR7:
+			i = (offset - APIC_OFFSET_TMR0) >> 2;
+			reg = &lapic->tmr0;
+			*data = *(reg + i);
+			break;
+		case APIC_OFFSET_IRR0 ... APIC_OFFSET_IRR7:
+			i = (offset - APIC_OFFSET_IRR0) >> 2;
+			reg = &lapic->irr0;
+			*data = atomic_load_acq_int(reg + i);
+			break;
+		case APIC_OFFSET_ESR:
+			*data = lapic->esr;
+			break;
+		case APIC_OFFSET_ICR_LOW: 
+			*data = lapic->icr_lo;
+			if (x2apic(vlapic))
+				*data |= (uint64_t)lapic->icr_hi << 32;
+			break;
+		case APIC_OFFSET_ICR_HI: 
+			*data = lapic->icr_hi;
+			break;
+		case APIC_OFFSET_CMCI_LVT:
+		case APIC_OFFSET_TIMER_LVT ... APIC_OFFSET_ERROR_LVT:
+			*data = vlapic_get_lvt(vlapic, offset);	
+#ifdef INVARIANTS
+			reg = vlapic_get_lvtptr(vlapic, offset);
+			KASSERT(*data == *reg, ("inconsistent lvt value at "
+			    "offset %#lx: %#lx/%#x", offset, *data, *reg));
+#endif
+			break;
+		case APIC_OFFSET_TIMER_ICR:
+			*data = lapic->icr_timer;
+			break;
+		case APIC_OFFSET_TIMER_CCR:
+			*data = vlapic_get_ccr(vlapic);
+			break;
+		case APIC_OFFSET_TIMER_DCR:
+			*data = lapic->dcr_timer;
+			break;
+		case APIC_OFFSET_SELF_IPI:
+			/*
+			 * XXX generate a GP fault if vlapic is in x2apic mode
+			 */
+			*data = 0;
+			break;
+		case APIC_OFFSET_RRR:
+		default:
+			*data = 0;
+			break;
+	}
+done:
+	VLAPIC_CTR2(vlapic, "vlapic read offset %#x, data %#lx", offset, *data);
+	return 0;
+}
+
+int
+vlapic_write(struct vlapic *vlapic, int mmio_access, uint64_t offset,
+    uint64_t data, bool *retu)
+{
+	struct LAPIC	*lapic = vlapic->apic_page;
+	uint32_t	*regptr;
+	int		retval;
+
+#ifdef	__FreeBSD__
+	KASSERT((offset & 0xf) == 0 && offset < PAGE_SIZE,
+	    ("vlapic_write: invalid offset %#lx", offset));
+#else
+	KASSERT((offset & 0xf) == 0 && offset < PAGE_SIZE,
+	    ("vlapic_write: invalid offset %lx", offset));
+#endif
+
+	VLAPIC_CTR2(vlapic, "vlapic write offset %#lx, data %#lx",
+	    offset, data);
+
+	if (offset > sizeof(*lapic))
+		return (0);
+
+	/* Ignore MMIO accesses in x2APIC mode */
+	if (x2apic(vlapic) && mmio_access) {
+		VLAPIC_CTR2(vlapic, "MMIO write of %#lx to offset %#lx "
+		    "in x2APIC mode", data, offset);
+		return (0);
+	}
+
+	/*
+	 * XXX Generate GP fault for MSR accesses in xAPIC mode
+	 */
+	if (!x2apic(vlapic) && !mmio_access) {
+		VLAPIC_CTR2(vlapic, "x2APIC MSR write of %#lx to offset %#lx "
+		    "in xAPIC mode", data, offset);
+		return (0);
+	}
+
+	retval = 0;
+	switch(offset)
+	{
+		case APIC_OFFSET_ID:
+			lapic->id = data;
+			vlapic_id_write_handler(vlapic);
+			break;
+		case APIC_OFFSET_TPR:
+			vlapic_set_tpr(vlapic, data & 0xff);
+			break;
+		case APIC_OFFSET_EOI:
+			vlapic_process_eoi(vlapic);
+			break;
+		case APIC_OFFSET_LDR:
+			lapic->ldr = data;
+			vlapic_ldr_write_handler(vlapic);
+			break;
+		case APIC_OFFSET_DFR:
+			lapic->dfr = data;
+			vlapic_dfr_write_handler(vlapic);
+			break;
+		case APIC_OFFSET_SVR:
+			lapic->svr = data;
+			vlapic_svr_write_handler(vlapic);
+			break;
+		case APIC_OFFSET_ICR_LOW: 
+			lapic->icr_lo = data;
+			if (x2apic(vlapic))
+				lapic->icr_hi = data >> 32;
+			retval = vlapic_icrlo_write_handler(vlapic, retu);
+			break;
+		case APIC_OFFSET_ICR_HI:
+			lapic->icr_hi = data;
+			break;
+		case APIC_OFFSET_CMCI_LVT:
+		case APIC_OFFSET_TIMER_LVT ... APIC_OFFSET_ERROR_LVT:
+			regptr = vlapic_get_lvtptr(vlapic, offset);
+			*regptr = data;
+			vlapic_lvt_write_handler(vlapic, offset);
+			break;
+		case APIC_OFFSET_TIMER_ICR:
+			lapic->icr_timer = data;
+			vlapic_icrtmr_write_handler(vlapic);
+			break;
+
+		case APIC_OFFSET_TIMER_DCR:
+			lapic->dcr_timer = data;
+			vlapic_dcr_write_handler(vlapic);
+			break;
+
+		case APIC_OFFSET_ESR:
+			vlapic_esr_write_handler(vlapic);
+			break;
+
+		case APIC_OFFSET_SELF_IPI:
+			if (x2apic(vlapic))
+				vlapic_self_ipi_handler(vlapic, data);
+			break;
+
+		case APIC_OFFSET_VER:
+		case APIC_OFFSET_APR:
+		case APIC_OFFSET_PPR:
+		case APIC_OFFSET_RRR:
+		case APIC_OFFSET_ISR0 ... APIC_OFFSET_ISR7:
+		case APIC_OFFSET_TMR0 ... APIC_OFFSET_TMR7:
+		case APIC_OFFSET_IRR0 ... APIC_OFFSET_IRR7:
+		case APIC_OFFSET_TIMER_CCR:
+		default:
+			// Read only.
+			break;
+	}
+
+	return (retval);
+}
+
+static void
+vlapic_reset(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic;
+	
+	lapic = vlapic->apic_page;
+	bzero(lapic, sizeof(struct LAPIC));
+
+	lapic->id = vlapic_get_id(vlapic);
+	lapic->version = VLAPIC_VERSION;
+	lapic->version |= (VLAPIC_MAXLVT_INDEX << MAXLVTSHIFT);
+	lapic->dfr = 0xffffffff;
+	lapic->svr = APIC_SVR_VECTOR;
+	vlapic_mask_lvts(vlapic);
+	vlapic_reset_tmr(vlapic);
+
+	lapic->dcr_timer = 0;
+	vlapic_dcr_write_handler(vlapic);
+
+	if (vlapic->vcpuid == 0)
+		vlapic->boot_state = BS_RUNNING;	/* BSP */
+	else
+		vlapic->boot_state = BS_INIT;		/* AP */
+
+	vlapic->svr_last = lapic->svr;
+}
+
+void
+vlapic_init(struct vlapic *vlapic)
+{
+	KASSERT(vlapic->vm != NULL, ("vlapic_init: vm is not initialized"));
+	KASSERT(vlapic->vcpuid >= 0 && vlapic->vcpuid < VM_MAXCPU,
+	    ("vlapic_init: vcpuid is not initialized"));
+	KASSERT(vlapic->apic_page != NULL, ("vlapic_init: apic_page is not "
+	    "initialized"));
+
+	/*
+	 * If the vlapic is configured in x2apic mode then it will be
+	 * accessed in the critical section via the MSR emulation code.
+	 *
+	 * Therefore the timer mutex must be a spinlock because blockable
+	 * mutexes cannot be acquired in a critical section.
+	 */
+	mtx_init(&vlapic->timer_mtx, "vlapic timer mtx", NULL, MTX_SPIN);
+	callout_init(&vlapic->callout, 1);
+
+	vlapic->msr_apicbase = DEFAULT_APIC_BASE | APICBASE_ENABLED;
+
+	if (vlapic->vcpuid == 0)
+		vlapic->msr_apicbase |= APICBASE_BSP;
+
+	vlapic_reset(vlapic);
+}
+
+void
+vlapic_cleanup(struct vlapic *vlapic)
+{
+
+	callout_drain(&vlapic->callout);
+}
+
+uint64_t
+vlapic_get_apicbase(struct vlapic *vlapic)
+{
+
+	return (vlapic->msr_apicbase);
+}
+
+int
+vlapic_set_apicbase(struct vlapic *vlapic, uint64_t new)
+{
+
+	if (vlapic->msr_apicbase != new) {
+		VLAPIC_CTR2(vlapic, "Changing APIC_BASE MSR from %#lx to %#lx "
+		    "not supported", vlapic->msr_apicbase, new);
+		return (-1);
+	}
+
+	return (0);
+}
+
+void
+vlapic_set_x2apic_state(struct vm *vm, int vcpuid, enum x2apic_state state)
+{
+	struct vlapic *vlapic;
+	struct LAPIC *lapic;
+
+	vlapic = vm_lapic(vm, vcpuid);
+
+	if (state == X2APIC_DISABLED)
+		vlapic->msr_apicbase &= ~APICBASE_X2APIC;
+	else
+		vlapic->msr_apicbase |= APICBASE_X2APIC;
+
+	/*
+	 * Reset the local APIC registers whose values are mode-dependent.
+	 *
+	 * XXX this works because the APIC mode can be changed only at vcpu
+	 * initialization time.
+	 */
+	lapic = vlapic->apic_page;
+	lapic->id = vlapic_get_id(vlapic);
+	if (x2apic(vlapic)) {
+		lapic->ldr = x2apic_ldr(vlapic);
+		lapic->dfr = 0;
+	} else {
+		lapic->ldr = 0;
+		lapic->dfr = 0xffffffff;
+	}
+
+	if (state == X2APIC_ENABLED) {
+		if (vlapic->ops.enable_x2apic_mode)
+			(*vlapic->ops.enable_x2apic_mode)(vlapic);
+	}
+}
+
+void
+vlapic_deliver_intr(struct vm *vm, bool level, uint32_t dest, bool phys,
+    int delmode, int vec)
+{
+	bool lowprio;
+	int vcpuid;
+	cpuset_t dmask;
+
+	if (delmode != IOART_DELFIXED &&
+	    delmode != IOART_DELLOPRI &&
+	    delmode != IOART_DELEXINT) {
+		VM_CTR1(vm, "vlapic intr invalid delmode %#x", delmode);
+		return;
+	}
+	lowprio = (delmode == IOART_DELLOPRI);
+
+	/*
+	 * We don't provide any virtual interrupt redirection hardware so
+	 * all interrupts originating from the ioapic or MSI specify the
+	 * 'dest' in the legacy xAPIC format.
+	 */
+	vlapic_calcdest(vm, &dmask, dest, phys, lowprio, false);
+
+	while ((vcpuid = CPU_FFS(&dmask)) != 0) {
+		vcpuid--;
+		CPU_CLR(vcpuid, &dmask);
+		if (delmode == IOART_DELEXINT) {
+			vm_inject_extint(vm, vcpuid);
+		} else {
+			lapic_set_intr(vm, vcpuid, vec, level);
+		}
+	}
+}
+
+void
+vlapic_post_intr(struct vlapic *vlapic, int hostcpu, int ipinum)
+{
+	/*
+	 * Post an interrupt to the vcpu currently running on 'hostcpu'.
+	 *
+	 * This is done by leveraging features like Posted Interrupts (Intel)
+	 * Doorbell MSR (AMD AVIC) that avoid a VM exit.
+	 *
+	 * If neither of these features are available then fallback to
+	 * sending an IPI to 'hostcpu'.
+	 */
+	if (vlapic->ops.post_intr)
+		(*vlapic->ops.post_intr)(vlapic, hostcpu);
+	else
+		ipi_cpu(hostcpu, ipinum);
+}
+
+bool
+vlapic_enabled(struct vlapic *vlapic)
+{
+	struct LAPIC *lapic = vlapic->apic_page;
+
+	if ((vlapic->msr_apicbase & APICBASE_ENABLED) != 0 &&
+	    (lapic->svr & APIC_SVR_ENABLE) != 0)
+		return (true);
+	else
+		return (false);
+}
+
+static void
+vlapic_set_tmr(struct vlapic *vlapic, int vector, bool level)
+{
+	struct LAPIC *lapic;
+	uint32_t *tmrptr, mask;
+	int idx;
+
+	lapic = vlapic->apic_page;
+	tmrptr = &lapic->tmr0;
+	idx = (vector / 32) * 4;
+	mask = 1 << (vector % 32);
+	if (level)
+		tmrptr[idx] |= mask;
+	else
+		tmrptr[idx] &= ~mask;
+
+	if (vlapic->ops.set_tmr != NULL)
+		(*vlapic->ops.set_tmr)(vlapic, vector, level);
+}
+
+void
+vlapic_reset_tmr(struct vlapic *vlapic)
+{
+	int vector;
+
+	VLAPIC_CTR0(vlapic, "vlapic resetting all vectors to edge-triggered");
+
+	for (vector = 0; vector <= 255; vector++)
+		vlapic_set_tmr(vlapic, vector, false);
+}
+
+void
+vlapic_set_tmr_level(struct vlapic *vlapic, uint32_t dest, bool phys,
+    int delmode, int vector)
+{
+	cpuset_t dmask;
+	bool lowprio;
+
+	KASSERT(vector >= 0 && vector <= 255, ("invalid vector %d", vector));
+
+	/*
+	 * A level trigger is valid only for fixed and lowprio delivery modes.
+	 */
+	if (delmode != APIC_DELMODE_FIXED && delmode != APIC_DELMODE_LOWPRIO) {
+		VLAPIC_CTR1(vlapic, "Ignoring level trigger-mode for "
+		    "delivery-mode %d", delmode);
+		return;
+	}
+
+	lowprio = (delmode == APIC_DELMODE_LOWPRIO);
+	vlapic_calcdest(vlapic->vm, &dmask, dest, phys, lowprio, false);
+
+	if (!CPU_ISSET(vlapic->vcpuid, &dmask))
+		return;
+
+	VLAPIC_CTR1(vlapic, "vector %d set to level-triggered", vector);
+	vlapic_set_tmr(vlapic, vector, true);
+}
+
+#ifndef __FreeBSD__
+void
+vlapic_localize_resources(struct vlapic *vlapic)
+{
+	vmm_glue_callout_localize(&vlapic->callout);
+}
+#endif /* __FreeBSD */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vlapic.h b/usr/src/uts/i86pc/io/vmm/io/vlapic.h
new file mode 100644
index 0000000000..a177b984ce
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vlapic.h
@@ -0,0 +1,120 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _VLAPIC_H_
+#define	_VLAPIC_H_
+
+struct vm;
+enum x2apic_state;
+
+int vlapic_write(struct vlapic *vlapic, int mmio_access, uint64_t offset,
+    uint64_t data, bool *retu);
+int vlapic_read(struct vlapic *vlapic, int mmio_access, uint64_t offset,
+    uint64_t *data, bool *retu);
+
+/*
+ * Returns 0 if there is no eligible vector that can be delivered to the
+ * guest at this time and non-zero otherwise.
+ *
+ * If an eligible vector number is found and 'vecptr' is not NULL then it will
+ * be stored in the location pointed to by 'vecptr'.
+ *
+ * Note that the vector does not automatically transition to the ISR as a
+ * result of calling this function.
+ */
+int vlapic_pending_intr(struct vlapic *vlapic, int *vecptr);
+
+/*
+ * Transition 'vector' from IRR to ISR. This function is called with the
+ * vector returned by 'vlapic_pending_intr()' when the guest is able to
+ * accept this interrupt (i.e. RFLAGS.IF = 1 and no conditions exist that
+ * block interrupt delivery).
+ */
+void vlapic_intr_accepted(struct vlapic *vlapic, int vector);
+
+/*
+ * Returns 1 if the vcpu needs to be notified of the interrupt and 0 otherwise.
+ */
+int vlapic_set_intr_ready(struct vlapic *vlapic, int vector, bool level);
+
+/*
+ * Post an interrupt to the vcpu running on 'hostcpu'. This will use a
+ * hardware assist if available (e.g. Posted Interrupt) or fall back to
+ * sending an 'ipinum' to interrupt the 'hostcpu'.
+ */
+void vlapic_post_intr(struct vlapic *vlapic, int hostcpu, int ipinum);
+
+void vlapic_set_error(struct vlapic *vlapic, uint32_t mask);
+void vlapic_fire_cmci(struct vlapic *vlapic);
+int vlapic_trigger_lvt(struct vlapic *vlapic, int vector);
+
+uint64_t vlapic_get_apicbase(struct vlapic *vlapic);
+int vlapic_set_apicbase(struct vlapic *vlapic, uint64_t val);
+void vlapic_set_x2apic_state(struct vm *vm, int vcpuid, enum x2apic_state s);
+bool vlapic_enabled(struct vlapic *vlapic);
+
+void vlapic_deliver_intr(struct vm *vm, bool level, uint32_t dest, bool phys,
+    int delmode, int vec);
+
+/* Reset the trigger-mode bits for all vectors to be edge-triggered */
+void vlapic_reset_tmr(struct vlapic *vlapic);
+
+/*
+ * Set the trigger-mode bit associated with 'vector' to level-triggered if
+ * the (dest,phys,delmode) tuple resolves to an interrupt being delivered to
+ * this 'vlapic'.
+ */
+void vlapic_set_tmr_level(struct vlapic *vlapic, uint32_t dest, bool phys,
+    int delmode, int vector);
+
+void vlapic_set_cr8(struct vlapic *vlapic, uint64_t val);
+uint64_t vlapic_get_cr8(struct vlapic *vlapic);
+
+/* APIC write handlers */
+void vlapic_id_write_handler(struct vlapic *vlapic);
+void vlapic_ldr_write_handler(struct vlapic *vlapic);
+void vlapic_dfr_write_handler(struct vlapic *vlapic);
+void vlapic_svr_write_handler(struct vlapic *vlapic);
+void vlapic_esr_write_handler(struct vlapic *vlapic);
+int vlapic_icrlo_write_handler(struct vlapic *vlapic, bool *retu);
+void vlapic_icrtmr_write_handler(struct vlapic *vlapic);
+void vlapic_dcr_write_handler(struct vlapic *vlapic);
+void vlapic_lvt_write_handler(struct vlapic *vlapic, uint32_t offset);
+void vlapic_self_ipi_handler(struct vlapic *vlapic, uint64_t val);
+
+#ifndef __FreeBSD__
+void vlapic_localize_resources(struct vlapic *vlapic);
+#endif
+
+#endif	/* _VLAPIC_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vlapic_priv.h b/usr/src/uts/i86pc/io/vmm/io/vlapic_priv.h
new file mode 100644
index 0000000000..43abd20a0a
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vlapic_priv.h
@@ -0,0 +1,192 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2013 Neel Natu <neel@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VLAPIC_PRIV_H_
+#define	_VLAPIC_PRIV_H_
+
+#include <x86/apicreg.h>
+
+/*
+ * APIC Register:		Offset	   Description
+ */
+#define APIC_OFFSET_ID		0x20	/* Local APIC ID		*/
+#define APIC_OFFSET_VER		0x30	/* Local APIC Version		*/
+#define APIC_OFFSET_TPR		0x80	/* Task Priority Register	*/
+#define APIC_OFFSET_APR		0x90	/* Arbitration Priority		*/
+#define APIC_OFFSET_PPR		0xA0	/* Processor Priority Register	*/
+#define APIC_OFFSET_EOI		0xB0	/* EOI Register			*/
+#define APIC_OFFSET_RRR		0xC0	/* Remote read			*/
+#define APIC_OFFSET_LDR		0xD0	/* Logical Destination		*/
+#define APIC_OFFSET_DFR		0xE0	/* Destination Format Register	*/
+#define APIC_OFFSET_SVR		0xF0	/* Spurious Vector Register	*/
+#define APIC_OFFSET_ISR0	0x100	/* In Service Register		*/
+#define APIC_OFFSET_ISR1	0x110
+#define APIC_OFFSET_ISR2	0x120
+#define APIC_OFFSET_ISR3	0x130
+#define APIC_OFFSET_ISR4	0x140
+#define APIC_OFFSET_ISR5	0x150
+#define APIC_OFFSET_ISR6	0x160
+#define APIC_OFFSET_ISR7	0x170
+#define APIC_OFFSET_TMR0	0x180	/* Trigger Mode Register	*/
+#define APIC_OFFSET_TMR1	0x190
+#define APIC_OFFSET_TMR2	0x1A0
+#define APIC_OFFSET_TMR3	0x1B0
+#define APIC_OFFSET_TMR4	0x1C0
+#define APIC_OFFSET_TMR5	0x1D0
+#define APIC_OFFSET_TMR6	0x1E0
+#define APIC_OFFSET_TMR7	0x1F0
+#define APIC_OFFSET_IRR0	0x200	/* Interrupt Request Register	*/
+#define APIC_OFFSET_IRR1	0x210
+#define APIC_OFFSET_IRR2	0x220
+#define APIC_OFFSET_IRR3	0x230
+#define APIC_OFFSET_IRR4	0x240
+#define APIC_OFFSET_IRR5	0x250
+#define APIC_OFFSET_IRR6	0x260
+#define APIC_OFFSET_IRR7	0x270
+#define APIC_OFFSET_ESR		0x280	/* Error Status Register	*/
+#define APIC_OFFSET_CMCI_LVT	0x2F0	/* Local Vector Table (CMCI)	*/
+#define APIC_OFFSET_ICR_LOW	0x300	/* Interrupt Command Register	*/
+#define APIC_OFFSET_ICR_HI	0x310
+#define APIC_OFFSET_TIMER_LVT	0x320	/* Local Vector Table (Timer)	*/
+#define APIC_OFFSET_THERM_LVT	0x330	/* Local Vector Table (Thermal)	*/
+#define APIC_OFFSET_PERF_LVT	0x340	/* Local Vector Table (PMC)	*/
+#define APIC_OFFSET_LINT0_LVT	0x350	/* Local Vector Table (LINT0)	*/
+#define APIC_OFFSET_LINT1_LVT	0x360	/* Local Vector Table (LINT1)	*/
+#define APIC_OFFSET_ERROR_LVT	0x370	/* Local Vector Table (ERROR)	*/
+#define APIC_OFFSET_TIMER_ICR	0x380	/* Timer's Initial Count	*/
+#define APIC_OFFSET_TIMER_CCR	0x390	/* Timer's Current Count	*/
+#define APIC_OFFSET_TIMER_DCR	0x3E0	/* Timer's Divide Configuration	*/
+#define	APIC_OFFSET_SELF_IPI	0x3F0	/* Self IPI register */
+
+#define	VLAPIC_CTR0(vlapic, format)					\
+	VCPU_CTR0((vlapic)->vm, (vlapic)->vcpuid, format)
+
+#define	VLAPIC_CTR1(vlapic, format, p1)					\
+	VCPU_CTR1((vlapic)->vm, (vlapic)->vcpuid, format, p1)
+
+#define	VLAPIC_CTR2(vlapic, format, p1, p2)				\
+	VCPU_CTR2((vlapic)->vm, (vlapic)->vcpuid, format, p1, p2)
+
+#define	VLAPIC_CTR3(vlapic, format, p1, p2, p3)				\
+	VCPU_CTR3((vlapic)->vm, (vlapic)->vcpuid, format, p1, p2, p3)
+
+#define	VLAPIC_CTR_IRR(vlapic, msg)					\
+do {									\
+	uint32_t *irrptr = &(vlapic)->apic_page->irr0;			\
+	irrptr[0] = irrptr[0];	/* silence compiler */			\
+	VLAPIC_CTR1((vlapic), msg " irr0 0x%08x", irrptr[0 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " irr1 0x%08x", irrptr[1 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " irr2 0x%08x", irrptr[2 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " irr3 0x%08x", irrptr[3 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " irr4 0x%08x", irrptr[4 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " irr5 0x%08x", irrptr[5 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " irr6 0x%08x", irrptr[6 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " irr7 0x%08x", irrptr[7 << 2]);	\
+} while (0)
+
+#define	VLAPIC_CTR_ISR(vlapic, msg)					\
+do {									\
+	uint32_t *isrptr = &(vlapic)->apic_page->isr0;			\
+	isrptr[0] = isrptr[0];	/* silence compiler */			\
+	VLAPIC_CTR1((vlapic), msg " isr0 0x%08x", isrptr[0 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " isr1 0x%08x", isrptr[1 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " isr2 0x%08x", isrptr[2 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " isr3 0x%08x", isrptr[3 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " isr4 0x%08x", isrptr[4 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " isr5 0x%08x", isrptr[5 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " isr6 0x%08x", isrptr[6 << 2]);	\
+	VLAPIC_CTR1((vlapic), msg " isr7 0x%08x", isrptr[7 << 2]);	\
+} while (0)
+
+enum boot_state {
+	BS_INIT,
+	BS_SIPI,
+	BS_RUNNING
+};
+
+/*
+ * 16 priority levels with at most one vector injected per level.
+ */
+#define	ISRVEC_STK_SIZE		(16 + 1)
+
+#define VLAPIC_MAXLVT_INDEX	APIC_LVT_CMCI
+
+struct vlapic;
+
+struct vlapic_ops {
+	int (*set_intr_ready)(struct vlapic *vlapic, int vector, bool level);
+	int (*pending_intr)(struct vlapic *vlapic, int *vecptr);
+	void (*intr_accepted)(struct vlapic *vlapic, int vector);
+	void (*post_intr)(struct vlapic *vlapic, int hostcpu);
+	void (*set_tmr)(struct vlapic *vlapic, int vector, bool level);
+	void (*enable_x2apic_mode)(struct vlapic *vlapic);
+};
+
+struct vlapic {
+	struct vm		*vm;
+	int			vcpuid;
+	struct LAPIC		*apic_page;
+	struct vlapic_ops	ops;
+
+	uint32_t		esr_pending;
+	int			esr_firing;
+
+	struct callout	callout;	/* vlapic timer */
+	struct bintime	timer_fire_bt;	/* callout expiry time */
+	struct bintime	timer_freq_bt;	/* timer frequency */
+	struct bintime	timer_period_bt; /* timer period */
+	struct mtx	timer_mtx;
+
+	/*
+	 * The 'isrvec_stk' is a stack of vectors injected by the local apic.
+	 * A vector is popped from the stack when the processor does an EOI.
+	 * The vector on the top of the stack is used to compute the
+	 * Processor Priority in conjunction with the TPR.
+	 */
+	uint8_t		isrvec_stk[ISRVEC_STK_SIZE];
+	int		isrvec_stk_top;
+
+	uint64_t	msr_apicbase;
+	enum boot_state	boot_state;
+
+	/*
+	 * Copies of some registers in the virtual APIC page. We do this for
+	 * a couple of different reasons:
+	 * - to be able to detect what changed (e.g. svr_last)
+	 * - to maintain a coherent snapshot of the register (e.g. lvt_last)
+	 */
+	uint32_t	svr_last;
+	uint32_t	lvt_last[VLAPIC_MAXLVT_INDEX + 1];
+};
+
+void vlapic_init(struct vlapic *vlapic);
+void vlapic_cleanup(struct vlapic *vlapic);
+
+#endif	/* _VLAPIC_PRIV_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vpmtmr.c b/usr/src/uts/i86pc/io/vmm/io/vpmtmr.c
new file mode 100644
index 0000000000..1e7bb93d7b
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vpmtmr.c
@@ -0,0 +1,103 @@
+/*-
+ * Copyright (c) 2014, Neel Natu (neel@freebsd.org)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/queue.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/systm.h>
+
+#include <machine/vmm.h>
+
+#include "vpmtmr.h"
+
+/*
+ * The ACPI Power Management timer is a free-running 24- or 32-bit
+ * timer with a frequency of 3.579545MHz
+ *
+ * This implementation will be 32-bits
+ */
+
+#define PMTMR_FREQ	3579545  /* 3.579545MHz */
+
+struct vpmtmr {
+	sbintime_t	freq_sbt;
+	sbintime_t	baseuptime;
+	uint32_t	baseval;
+};
+
+static MALLOC_DEFINE(M_VPMTMR, "vpmtmr", "bhyve virtual acpi timer");
+
+struct vpmtmr *
+vpmtmr_init(struct vm *vm)
+{
+	struct vpmtmr *vpmtmr;
+	struct bintime bt;
+
+	vpmtmr = malloc(sizeof(struct vpmtmr), M_VPMTMR, M_WAITOK | M_ZERO);
+	vpmtmr->baseuptime = sbinuptime();
+	vpmtmr->baseval = 0;
+
+	FREQ2BT(PMTMR_FREQ, &bt);
+	vpmtmr->freq_sbt = bttosbt(bt);
+
+	return (vpmtmr);
+}
+
+void
+vpmtmr_cleanup(struct vpmtmr *vpmtmr)
+{
+
+	free(vpmtmr, M_VPMTMR);
+}
+
+int
+vpmtmr_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *val)
+{
+	struct vpmtmr *vpmtmr;
+	sbintime_t now, delta;
+
+	if (!in || bytes != 4)
+		return (-1);
+
+	vpmtmr = vm_pmtmr(vm);
+
+	/*
+	 * No locking needed because 'baseuptime' and 'baseval' are
+	 * written only during initialization.
+	 */
+	now = sbinuptime();
+	delta = now - vpmtmr->baseuptime;
+	KASSERT(delta >= 0, ("vpmtmr_handler: uptime went backwards: "
+	    "%#lx to %#lx", vpmtmr->baseuptime, now));
+	*val = vpmtmr->baseval + delta / vpmtmr->freq_sbt;
+
+	return (0);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/io/vpmtmr.h b/usr/src/uts/i86pc/io/vmm/io/vpmtmr.h
new file mode 100644
index 0000000000..039a28145b
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vpmtmr.h
@@ -0,0 +1,42 @@
+/*-
+ * Copyright (c) 2014 Neel Natu (neel@freebsd.org)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VPMTMR_H_
+#define	_VPMTMR_H_
+
+#define	IO_PMTMR 0x408
+
+struct vpmtmr;
+
+struct vpmtmr *vpmtmr_init(struct vm *vm);
+void vpmtmr_cleanup(struct vpmtmr *pmtmr);
+
+int vpmtmr_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *val);
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/io/vrtc.c b/usr/src/uts/i86pc/io/vmm/io/vrtc.c
new file mode 100644
index 0000000000..8452d28cd2
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vrtc.c
@@ -0,0 +1,1031 @@
+/*-
+ * Copyright (c) 2014, Neel Natu (neel@freebsd.org)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/queue.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/clock.h>
+#include <sys/sysctl.h>
+
+#include <machine/vmm.h>
+
+#include <isa/rtc.h>
+
+#include "vmm_ktr.h"
+#include "vatpic.h"
+#include "vioapic.h"
+#include "vrtc.h"
+
+/* Register layout of the RTC */
+struct rtcdev {
+	uint8_t	sec;
+	uint8_t	alarm_sec;
+	uint8_t	min;
+	uint8_t	alarm_min;
+	uint8_t	hour;
+	uint8_t	alarm_hour;
+	uint8_t	day_of_week;
+	uint8_t	day_of_month;
+	uint8_t	month;
+	uint8_t	year;
+	uint8_t	reg_a;
+	uint8_t	reg_b;
+	uint8_t	reg_c;
+	uint8_t	reg_d;
+	uint8_t	nvram[36];
+	uint8_t	century;
+	uint8_t	nvram2[128 - 51];
+} __packed;
+CTASSERT(sizeof(struct rtcdev) == 128);
+CTASSERT(offsetof(struct rtcdev, century) == RTC_CENTURY);
+
+struct vrtc {
+	struct vm	*vm;
+	struct mtx	mtx;
+	struct callout	callout;
+	u_int		addr;		/* RTC register to read or write */
+	sbintime_t	base_uptime;
+	time_t		base_rtctime;
+	struct rtcdev	rtcdev;
+};
+
+#define	VRTC_LOCK(vrtc)		mtx_lock(&((vrtc)->mtx))
+#define	VRTC_UNLOCK(vrtc)	mtx_unlock(&((vrtc)->mtx))
+#define	VRTC_LOCKED(vrtc)	mtx_owned(&((vrtc)->mtx))
+
+/*
+ * RTC time is considered "broken" if:
+ * - RTC updates are halted by the guest
+ * - RTC date/time fields have invalid values
+ */
+#define	VRTC_BROKEN_TIME	((time_t)-1)
+
+#define	RTC_IRQ			8
+#define	RTCSB_BIN		0x04
+#define	RTCSB_ALL_INTRS		(RTCSB_UINTR | RTCSB_AINTR | RTCSB_PINTR)
+#define	rtc_halted(vrtc)	((vrtc->rtcdev.reg_b & RTCSB_HALT) != 0)
+#define	aintr_enabled(vrtc)	(((vrtc)->rtcdev.reg_b & RTCSB_AINTR) != 0)
+#define	pintr_enabled(vrtc)	(((vrtc)->rtcdev.reg_b & RTCSB_PINTR) != 0)
+#define	uintr_enabled(vrtc)	(((vrtc)->rtcdev.reg_b & RTCSB_UINTR) != 0)
+
+static void vrtc_callout_handler(void *arg);
+static void vrtc_set_reg_c(struct vrtc *vrtc, uint8_t newval);
+
+static MALLOC_DEFINE(M_VRTC, "vrtc", "bhyve virtual rtc");
+
+SYSCTL_DECL(_hw_vmm);
+SYSCTL_NODE(_hw_vmm, OID_AUTO, vrtc, CTLFLAG_RW, NULL, NULL);
+
+static int rtc_flag_broken_time = 1;
+SYSCTL_INT(_hw_vmm_vrtc, OID_AUTO, flag_broken_time, CTLFLAG_RDTUN,
+    &rtc_flag_broken_time, 0, "Stop guest when invalid RTC time is detected");
+
+static __inline bool
+divider_enabled(int reg_a)
+{
+	/*
+	 * The RTC is counting only when dividers are not held in reset.
+	 */
+	return ((reg_a & 0x70) == 0x20);
+}
+
+static __inline bool
+update_enabled(struct vrtc *vrtc)
+{
+	/*
+	 * RTC date/time can be updated only if:
+	 * - divider is not held in reset
+	 * - guest has not disabled updates
+	 * - the date/time fields have valid contents
+	 */
+	if (!divider_enabled(vrtc->rtcdev.reg_a))
+		return (false);
+
+	if (rtc_halted(vrtc))
+		return (false);
+
+	if (vrtc->base_rtctime == VRTC_BROKEN_TIME)
+		return (false);
+
+	return (true);
+}
+
+static time_t
+vrtc_curtime(struct vrtc *vrtc, sbintime_t *basetime)
+{
+	sbintime_t now, delta;
+	time_t t, secs;
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	t = vrtc->base_rtctime;
+	*basetime = vrtc->base_uptime;
+	if (update_enabled(vrtc)) {
+		now = sbinuptime();
+		delta = now - vrtc->base_uptime;
+		KASSERT(delta >= 0, ("vrtc_curtime: uptime went backwards: "
+		    "%#lx to %#lx", vrtc->base_uptime, now));
+		secs = delta / SBT_1S;
+		t += secs;
+		*basetime += secs * SBT_1S;
+	}
+	return (t);
+}
+
+static __inline uint8_t
+rtcset(struct rtcdev *rtc, int val)
+{
+
+	KASSERT(val >= 0 && val < 100, ("%s: invalid bin2bcd index %d",
+	    __func__, val));
+
+	return ((rtc->reg_b & RTCSB_BIN) ? val : bin2bcd_data[val]);
+}
+
+static void
+secs_to_rtc(time_t rtctime, struct vrtc *vrtc, int force_update)
+{
+	struct clocktime ct;
+	struct timespec ts;
+	struct rtcdev *rtc;
+	int hour;
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	if (rtctime < 0) {
+		KASSERT(rtctime == VRTC_BROKEN_TIME,
+		    ("%s: invalid vrtc time %#lx", __func__, rtctime));
+		return;
+	}
+
+	/*
+	 * If the RTC is halted then the guest has "ownership" of the
+	 * date/time fields. Don't update the RTC date/time fields in
+	 * this case (unless forced).
+	 */
+	if (rtc_halted(vrtc) && !force_update)
+		return;
+
+	ts.tv_sec = rtctime;
+	ts.tv_nsec = 0;
+	clock_ts_to_ct(&ts, &ct);
+
+	KASSERT(ct.sec >= 0 && ct.sec <= 59, ("invalid clocktime sec %d",
+	    ct.sec));
+	KASSERT(ct.min >= 0 && ct.min <= 59, ("invalid clocktime min %d",
+	    ct.min));
+	KASSERT(ct.hour >= 0 && ct.hour <= 23, ("invalid clocktime hour %d",
+	    ct.hour));
+	KASSERT(ct.dow >= 0 && ct.dow <= 6, ("invalid clocktime wday %d",
+	    ct.dow));
+	KASSERT(ct.day >= 1 && ct.day <= 31, ("invalid clocktime mday %d",
+	    ct.day));
+	KASSERT(ct.mon >= 1 && ct.mon <= 12, ("invalid clocktime month %d",
+	    ct.mon));
+	KASSERT(ct.year >= POSIX_BASE_YEAR, ("invalid clocktime year %d",
+	    ct.year));
+
+	rtc = &vrtc->rtcdev;
+	rtc->sec = rtcset(rtc, ct.sec);
+	rtc->min = rtcset(rtc, ct.min);
+
+	if (rtc->reg_b & RTCSB_24HR) {
+		hour = ct.hour;
+	} else {
+		/*
+		 * Convert to the 12-hour format.
+		 */
+		switch (ct.hour) {
+		case 0:			/* 12 AM */
+		case 12:		/* 12 PM */
+			hour = 12;
+			break;
+		default:
+			/*
+			 * The remaining 'ct.hour' values are interpreted as:
+			 * [1  - 11] ->  1 - 11 AM
+			 * [13 - 23] ->  1 - 11 PM
+			 */
+			hour = ct.hour % 12;
+			break;
+		}
+	}
+
+	rtc->hour = rtcset(rtc, hour);
+
+	if ((rtc->reg_b & RTCSB_24HR) == 0 && ct.hour >= 12)
+		rtc->hour |= 0x80;	    /* set MSB to indicate PM */
+
+	rtc->day_of_week = rtcset(rtc, ct.dow + 1);
+	rtc->day_of_month = rtcset(rtc, ct.day);
+	rtc->month = rtcset(rtc, ct.mon);
+	rtc->year = rtcset(rtc, ct.year % 100);
+	rtc->century = rtcset(rtc, ct.year / 100);
+}
+
+static int
+rtcget(struct rtcdev *rtc, int val, int *retval)
+{
+	uint8_t upper, lower;
+
+	if (rtc->reg_b & RTCSB_BIN) {
+		*retval = val;
+		return (0);
+	}
+
+	lower = val & 0xf;
+	upper = (val >> 4) & 0xf;
+
+	if (lower > 9 || upper > 9)
+		return (-1);
+
+	*retval = upper * 10 + lower;
+	return (0);
+}
+
+static time_t
+rtc_to_secs(struct vrtc *vrtc)
+{
+	struct clocktime ct;
+	struct timespec ts;
+	struct rtcdev *rtc;
+	struct vm *vm;
+	int century, error, hour, pm, year;
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	vm = vrtc->vm;
+	rtc = &vrtc->rtcdev;
+
+	bzero(&ct, sizeof(struct clocktime));
+
+	error = rtcget(rtc, rtc->sec, &ct.sec);
+	if (error || ct.sec < 0 || ct.sec > 59) {
+		VM_CTR2(vm, "Invalid RTC sec %#x/%d", rtc->sec, ct.sec);
+		goto fail;
+	}
+
+	error = rtcget(rtc, rtc->min, &ct.min);
+	if (error || ct.min < 0 || ct.min > 59) {
+		VM_CTR2(vm, "Invalid RTC min %#x/%d", rtc->min, ct.min);
+		goto fail;
+	}
+
+	pm = 0;
+	hour = rtc->hour;
+	if ((rtc->reg_b & RTCSB_24HR) == 0) {
+		if (hour & 0x80) {
+			hour &= ~0x80;
+			pm = 1;
+		}
+	}
+	error = rtcget(rtc, hour, &ct.hour);
+	if ((rtc->reg_b & RTCSB_24HR) == 0) {
+		if (ct.hour >= 1 && ct.hour <= 12) {
+			/*
+			 * Convert from 12-hour format to internal 24-hour
+			 * representation as follows:
+			 *
+			 *    12-hour format		ct.hour
+			 *	12	AM		0
+			 *	1 - 11	AM		1 - 11
+			 *	12	PM		12
+			 *	1 - 11	PM		13 - 23
+			 */
+			if (ct.hour == 12)
+				ct.hour = 0;
+			if (pm)
+				ct.hour += 12;
+		} else {
+			VM_CTR2(vm, "Invalid RTC 12-hour format %#x/%d",
+			    rtc->hour, ct.hour);
+			goto fail;
+		}
+	}
+
+	if (error || ct.hour < 0 || ct.hour > 23) {
+		VM_CTR2(vm, "Invalid RTC hour %#x/%d", rtc->hour, ct.hour);
+		goto fail;
+	}
+
+	/*
+	 * Ignore 'rtc->dow' because some guests like Linux don't bother
+	 * setting it at all while others like OpenBSD/i386 set it incorrectly. 
+	 *
+	 * clock_ct_to_ts() does not depend on 'ct.dow' anyways so ignore it.
+	 */
+	ct.dow = -1;
+
+	error = rtcget(rtc, rtc->day_of_month, &ct.day);
+	if (error || ct.day < 1 || ct.day > 31) {
+		VM_CTR2(vm, "Invalid RTC mday %#x/%d", rtc->day_of_month,
+		    ct.day);
+		goto fail;
+	}
+
+	error = rtcget(rtc, rtc->month, &ct.mon);
+	if (error || ct.mon < 1 || ct.mon > 12) {
+		VM_CTR2(vm, "Invalid RTC month %#x/%d", rtc->month, ct.mon);
+		goto fail;
+	}
+
+	error = rtcget(rtc, rtc->year, &year);
+	if (error || year < 0 || year > 99) {
+		VM_CTR2(vm, "Invalid RTC year %#x/%d", rtc->year, year);
+		goto fail;
+	}
+
+	error = rtcget(rtc, rtc->century, &century);
+	ct.year = century * 100 + year;
+	if (error || ct.year < POSIX_BASE_YEAR) {
+		VM_CTR2(vm, "Invalid RTC century %#x/%d", rtc->century,
+		    ct.year);
+		goto fail;
+	}
+
+	error = clock_ct_to_ts(&ct, &ts);
+	if (error || ts.tv_sec < 0) {
+		VM_CTR3(vm, "Invalid RTC clocktime.date %04d-%02d-%02d",
+		    ct.year, ct.mon, ct.day);
+		VM_CTR3(vm, "Invalid RTC clocktime.time %02d:%02d:%02d",
+		    ct.hour, ct.min, ct.sec);
+		goto fail;
+	}
+	return (ts.tv_sec);		/* success */
+fail:
+	/*
+	 * Stop updating the RTC if the date/time fields programmed by
+	 * the guest are invalid.
+	 */
+	VM_CTR0(vrtc->vm, "Invalid RTC date/time programming detected");
+	return (VRTC_BROKEN_TIME);
+}
+
+static int
+vrtc_time_update(struct vrtc *vrtc, time_t newtime, sbintime_t newbase)
+{
+	struct rtcdev *rtc;
+	sbintime_t oldbase;
+	time_t oldtime;
+	uint8_t alarm_sec, alarm_min, alarm_hour;
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	rtc = &vrtc->rtcdev;
+	alarm_sec = rtc->alarm_sec;
+	alarm_min = rtc->alarm_min;
+	alarm_hour = rtc->alarm_hour;
+
+	oldtime = vrtc->base_rtctime;
+	VM_CTR2(vrtc->vm, "Updating RTC secs from %#lx to %#lx",
+	    oldtime, newtime);
+
+	oldbase = vrtc->base_uptime;
+	VM_CTR2(vrtc->vm, "Updating RTC base uptime from %#lx to %#lx",
+	    oldbase, newbase);
+	vrtc->base_uptime = newbase;
+
+	if (newtime == oldtime)
+		return (0);
+
+	/*
+	 * If 'newtime' indicates that RTC updates are disabled then just
+	 * record that and return. There is no need to do alarm interrupt
+	 * processing in this case.
+	 */
+	if (newtime == VRTC_BROKEN_TIME) {
+		vrtc->base_rtctime = VRTC_BROKEN_TIME;
+		return (0);
+	}
+
+	/*
+	 * Return an error if RTC updates are halted by the guest.
+	 */
+	if (rtc_halted(vrtc)) {
+		VM_CTR0(vrtc->vm, "RTC update halted by guest");
+		return (EBUSY);
+	}
+
+	do {
+		/*
+		 * If the alarm interrupt is enabled and 'oldtime' is valid
+		 * then visit all the seconds between 'oldtime' and 'newtime'
+		 * to check for the alarm condition.
+		 *
+		 * Otherwise move the RTC time forward directly to 'newtime'.
+		 */
+		if (aintr_enabled(vrtc) && oldtime != VRTC_BROKEN_TIME)
+			vrtc->base_rtctime++;
+		else
+			vrtc->base_rtctime = newtime;
+
+		if (aintr_enabled(vrtc)) {
+			/*
+			 * Update the RTC date/time fields before checking
+			 * if the alarm conditions are satisfied.
+			 */
+			secs_to_rtc(vrtc->base_rtctime, vrtc, 0);
+
+			if ((alarm_sec >= 0xC0 || alarm_sec == rtc->sec) &&
+			    (alarm_min >= 0xC0 || alarm_min == rtc->min) &&
+			    (alarm_hour >= 0xC0 || alarm_hour == rtc->hour)) {
+				vrtc_set_reg_c(vrtc, rtc->reg_c | RTCIR_ALARM);
+			}
+		}
+	} while (vrtc->base_rtctime != newtime);
+
+	if (uintr_enabled(vrtc))
+		vrtc_set_reg_c(vrtc, rtc->reg_c | RTCIR_UPDATE);
+
+	return (0);
+}
+
+static sbintime_t
+vrtc_freq(struct vrtc *vrtc)
+{
+	int ratesel;
+
+	static sbintime_t pf[16] = {
+		0,
+		SBT_1S / 256,
+		SBT_1S / 128,
+		SBT_1S / 8192,
+		SBT_1S / 4096,
+		SBT_1S / 2048,
+		SBT_1S / 1024,
+		SBT_1S / 512,
+		SBT_1S / 256,
+		SBT_1S / 128,
+		SBT_1S / 64,
+		SBT_1S / 32,
+		SBT_1S / 16,
+		SBT_1S / 8,
+		SBT_1S / 4,
+		SBT_1S / 2,
+	};
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	/*
+	 * If both periodic and alarm interrupts are enabled then use the
+	 * periodic frequency to drive the callout. The minimum periodic
+	 * frequency (2 Hz) is higher than the alarm frequency (1 Hz) so
+	 * piggyback the alarm on top of it. The same argument applies to
+	 * the update interrupt.
+	 */
+	if (pintr_enabled(vrtc) && divider_enabled(vrtc->rtcdev.reg_a)) {
+		ratesel = vrtc->rtcdev.reg_a & 0xf;
+		return (pf[ratesel]);
+	} else if (aintr_enabled(vrtc) && update_enabled(vrtc)) {
+		return (SBT_1S);
+	} else if (uintr_enabled(vrtc) && update_enabled(vrtc)) {
+		return (SBT_1S);
+	} else {
+		return (0);
+	}
+}
+
+static void
+vrtc_callout_reset(struct vrtc *vrtc, sbintime_t freqsbt)
+{
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	if (freqsbt == 0) {
+		if (callout_active(&vrtc->callout)) {
+			VM_CTR0(vrtc->vm, "RTC callout stopped");
+			callout_stop(&vrtc->callout);
+		}
+		return;
+	}
+	VM_CTR1(vrtc->vm, "RTC callout frequency %d hz", SBT_1S / freqsbt);
+	callout_reset_sbt(&vrtc->callout, freqsbt, 0, vrtc_callout_handler,
+	    vrtc, 0);
+}
+
+static void
+vrtc_callout_handler(void *arg)
+{
+	struct vrtc *vrtc = arg;
+	sbintime_t freqsbt, basetime;
+	time_t rtctime;
+	int error;
+
+	VM_CTR0(vrtc->vm, "vrtc callout fired");
+
+	VRTC_LOCK(vrtc);
+	if (callout_pending(&vrtc->callout))	/* callout was reset */
+		goto done;
+
+	if (!callout_active(&vrtc->callout))	/* callout was stopped */
+		goto done;
+
+	callout_deactivate(&vrtc->callout);
+
+	KASSERT((vrtc->rtcdev.reg_b & RTCSB_ALL_INTRS) != 0,
+	    ("gratuitous vrtc callout"));
+
+	if (pintr_enabled(vrtc))
+		vrtc_set_reg_c(vrtc, vrtc->rtcdev.reg_c | RTCIR_PERIOD);
+
+	if (aintr_enabled(vrtc) || uintr_enabled(vrtc)) {
+		rtctime = vrtc_curtime(vrtc, &basetime);
+		error = vrtc_time_update(vrtc, rtctime, basetime);
+		KASSERT(error == 0, ("%s: vrtc_time_update error %d",
+		    __func__, error));
+	}
+
+	freqsbt = vrtc_freq(vrtc);
+	KASSERT(freqsbt != 0, ("%s: vrtc frequency cannot be zero", __func__));
+	vrtc_callout_reset(vrtc, freqsbt);
+done:
+	VRTC_UNLOCK(vrtc);
+}
+
+static __inline void
+vrtc_callout_check(struct vrtc *vrtc, sbintime_t freq)
+{
+	int active;
+
+	active = callout_active(&vrtc->callout) ? 1 : 0;
+	KASSERT((freq == 0 && !active) || (freq != 0 && active),
+	    ("vrtc callout %s with frequency %#lx",
+	    active ? "active" : "inactive", freq));
+}
+
+static void
+vrtc_set_reg_c(struct vrtc *vrtc, uint8_t newval)
+{
+	struct rtcdev *rtc;
+	int oldirqf, newirqf;
+	uint8_t oldval, changed;
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	rtc = &vrtc->rtcdev;
+	newval &= RTCIR_ALARM | RTCIR_PERIOD | RTCIR_UPDATE;
+
+	oldirqf = rtc->reg_c & RTCIR_INT;
+	if ((aintr_enabled(vrtc) && (newval & RTCIR_ALARM) != 0) ||
+	    (pintr_enabled(vrtc) && (newval & RTCIR_PERIOD) != 0) ||
+	    (uintr_enabled(vrtc) && (newval & RTCIR_UPDATE) != 0)) {
+		newirqf = RTCIR_INT;
+	} else {
+		newirqf = 0;
+	}
+
+	oldval = rtc->reg_c;
+	rtc->reg_c = newirqf | newval;
+	changed = oldval ^ rtc->reg_c;
+	if (changed) {
+		VM_CTR2(vrtc->vm, "RTC reg_c changed from %#x to %#x",
+		    oldval, rtc->reg_c);
+	}
+
+	if (!oldirqf && newirqf) {
+		VM_CTR1(vrtc->vm, "RTC irq %d asserted", RTC_IRQ);
+		vatpic_pulse_irq(vrtc->vm, RTC_IRQ);
+		vioapic_pulse_irq(vrtc->vm, RTC_IRQ);
+	} else if (oldirqf && !newirqf) {
+		VM_CTR1(vrtc->vm, "RTC irq %d deasserted", RTC_IRQ);
+	}
+}
+
+static int
+vrtc_set_reg_b(struct vrtc *vrtc, uint8_t newval)
+{
+	struct rtcdev *rtc;
+	sbintime_t oldfreq, newfreq, basetime;
+	time_t curtime, rtctime;
+	int error;
+	uint8_t oldval, changed;
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	rtc = &vrtc->rtcdev;
+	oldval = rtc->reg_b;
+	oldfreq = vrtc_freq(vrtc);
+
+	rtc->reg_b = newval;
+	changed = oldval ^ newval;
+	if (changed) {
+		VM_CTR2(vrtc->vm, "RTC reg_b changed from %#x to %#x",
+		    oldval, newval);
+	}
+
+	if (changed & RTCSB_HALT) {
+		if ((newval & RTCSB_HALT) == 0) {
+			rtctime = rtc_to_secs(vrtc);
+			basetime = sbinuptime();
+			if (rtctime == VRTC_BROKEN_TIME) {
+				if (rtc_flag_broken_time)
+					return (-1);
+			}
+		} else {
+			curtime = vrtc_curtime(vrtc, &basetime);
+			KASSERT(curtime == vrtc->base_rtctime, ("%s: mismatch "
+			    "between vrtc basetime (%#lx) and curtime (%#lx)",
+			    __func__, vrtc->base_rtctime, curtime));
+
+			/*
+			 * Force a refresh of the RTC date/time fields so
+			 * they reflect the time right before the guest set
+			 * the HALT bit.
+			 */
+			secs_to_rtc(curtime, vrtc, 1);
+
+			/*
+			 * Updates are halted so mark 'base_rtctime' to denote
+			 * that the RTC date/time is in flux.
+			 */
+			rtctime = VRTC_BROKEN_TIME;
+			rtc->reg_b &= ~RTCSB_UINTR;
+		}
+		error = vrtc_time_update(vrtc, rtctime, basetime);
+		KASSERT(error == 0, ("vrtc_time_update error %d", error));
+	}
+
+	/*
+	 * Side effect of changes to the interrupt enable bits.
+	 */
+	if (changed & RTCSB_ALL_INTRS)
+		vrtc_set_reg_c(vrtc, vrtc->rtcdev.reg_c);
+
+	/*
+	 * Change the callout frequency if it has changed.
+	 */
+	newfreq = vrtc_freq(vrtc);
+	if (newfreq != oldfreq)
+		vrtc_callout_reset(vrtc, newfreq);
+	else
+		vrtc_callout_check(vrtc, newfreq);
+
+	/*
+	 * The side effect of bits that control the RTC date/time format
+	 * is handled lazily when those fields are actually read.
+	 */
+	return (0);
+}
+
+static void
+vrtc_set_reg_a(struct vrtc *vrtc, uint8_t newval)
+{
+	sbintime_t oldfreq, newfreq;
+	uint8_t oldval, changed;
+
+	KASSERT(VRTC_LOCKED(vrtc), ("%s: vrtc not locked", __func__));
+
+	newval &= ~RTCSA_TUP;
+	oldval = vrtc->rtcdev.reg_a;
+	oldfreq = vrtc_freq(vrtc);
+
+	if (divider_enabled(oldval) && !divider_enabled(newval)) {
+		VM_CTR2(vrtc->vm, "RTC divider held in reset at %#lx/%#lx",
+		    vrtc->base_rtctime, vrtc->base_uptime);
+	} else if (!divider_enabled(oldval) && divider_enabled(newval)) {
+		/*
+		 * If the dividers are coming out of reset then update
+		 * 'base_uptime' before this happens. This is done to
+		 * maintain the illusion that the RTC date/time was frozen
+		 * while the dividers were disabled.
+		 */
+		vrtc->base_uptime = sbinuptime();
+		VM_CTR2(vrtc->vm, "RTC divider out of reset at %#lx/%#lx",
+		    vrtc->base_rtctime, vrtc->base_uptime);
+	} else {
+		/* NOTHING */
+	}
+
+	vrtc->rtcdev.reg_a = newval;
+	changed = oldval ^ newval;
+	if (changed) {
+		VM_CTR2(vrtc->vm, "RTC reg_a changed from %#x to %#x",
+		    oldval, newval);
+	}
+
+	/*
+	 * Side effect of changes to rate select and divider enable bits.
+	 */
+	newfreq = vrtc_freq(vrtc);
+	if (newfreq != oldfreq)
+		vrtc_callout_reset(vrtc, newfreq);
+	else
+		vrtc_callout_check(vrtc, newfreq);
+}
+
+int
+vrtc_set_time(struct vm *vm, time_t secs)
+{
+	struct vrtc *vrtc;
+	int error;
+
+	vrtc = vm_rtc(vm);
+	VRTC_LOCK(vrtc);
+	error = vrtc_time_update(vrtc, secs, sbinuptime());
+	VRTC_UNLOCK(vrtc);
+
+	if (error) {
+		VM_CTR2(vrtc->vm, "Error %d setting RTC time to %#lx", error,
+		    secs);
+	} else {
+		VM_CTR1(vrtc->vm, "RTC time set to %#lx", secs);
+	}
+
+	return (error);
+}
+
+time_t
+vrtc_get_time(struct vm *vm)
+{
+	struct vrtc *vrtc;
+	sbintime_t basetime;
+	time_t t;
+
+	vrtc = vm_rtc(vm);
+	VRTC_LOCK(vrtc);
+	t = vrtc_curtime(vrtc, &basetime);
+	VRTC_UNLOCK(vrtc);
+
+	return (t);
+}
+
+int
+vrtc_nvram_write(struct vm *vm, int offset, uint8_t value)
+{
+	struct vrtc *vrtc;
+	uint8_t *ptr;
+
+	vrtc = vm_rtc(vm);
+
+	/*
+	 * Don't allow writes to RTC control registers or the date/time fields.
+	 */
+	if (offset < offsetof(struct rtcdev, nvram[0]) ||
+	    offset == RTC_CENTURY || offset >= sizeof(struct rtcdev)) {
+		VM_CTR1(vrtc->vm, "RTC nvram write to invalid offset %d",
+		    offset);
+		return (EINVAL);
+	}
+
+	VRTC_LOCK(vrtc);
+	ptr = (uint8_t *)(&vrtc->rtcdev);
+	ptr[offset] = value;
+	VM_CTR2(vrtc->vm, "RTC nvram write %#x to offset %#x", value, offset);
+	VRTC_UNLOCK(vrtc);
+
+	return (0);
+}
+
+int
+vrtc_nvram_read(struct vm *vm, int offset, uint8_t *retval)
+{
+	struct vrtc *vrtc;
+	sbintime_t basetime;
+	time_t curtime;
+	uint8_t *ptr;
+
+	/*
+	 * Allow all offsets in the RTC to be read.
+	 */
+	if (offset < 0 || offset >= sizeof(struct rtcdev))
+		return (EINVAL);
+
+	vrtc = vm_rtc(vm);
+	VRTC_LOCK(vrtc);
+
+	/*
+	 * Update RTC date/time fields if necessary.
+	 */
+	if (offset < 10 || offset == RTC_CENTURY) {
+		curtime = vrtc_curtime(vrtc, &basetime);
+		secs_to_rtc(curtime, vrtc, 0);
+	}
+
+	ptr = (uint8_t *)(&vrtc->rtcdev);
+	*retval = ptr[offset];
+
+	VRTC_UNLOCK(vrtc);
+	return (0);
+}
+
+int
+vrtc_addr_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *val)
+{
+	struct vrtc *vrtc;
+
+	vrtc = vm_rtc(vm);
+
+	if (bytes != 1)
+		return (-1);
+
+	if (in) {
+		*val = 0xff;
+		return (0);
+	}
+
+	VRTC_LOCK(vrtc);
+	vrtc->addr = *val & 0x7f;
+	VRTC_UNLOCK(vrtc);
+
+	return (0);
+}
+
+int
+vrtc_data_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *val)
+{
+	struct vrtc *vrtc;
+	struct rtcdev *rtc;
+	sbintime_t basetime;
+	time_t curtime;
+	int error, offset;
+
+	vrtc = vm_rtc(vm);
+	rtc = &vrtc->rtcdev;
+
+	if (bytes != 1)
+		return (-1);
+
+	VRTC_LOCK(vrtc);
+	offset = vrtc->addr;
+	if (offset >= sizeof(struct rtcdev)) {
+		VRTC_UNLOCK(vrtc);
+		return (-1);
+	}
+
+	error = 0;
+	curtime = vrtc_curtime(vrtc, &basetime);
+	vrtc_time_update(vrtc, curtime, basetime);
+
+	/*
+	 * Update RTC date/time fields if necessary.
+	 *
+	 * This is not just for reads of the RTC. The side-effect of writing
+	 * the century byte requires other RTC date/time fields (e.g. sec)
+	 * to be updated here.
+	 */
+	if (offset < 10 || offset == RTC_CENTURY)
+		secs_to_rtc(curtime, vrtc, 0);
+
+	if (in) {
+		if (offset == 12) {
+			/*
+			 * XXX
+			 * reg_c interrupt flags are updated only if the
+			 * corresponding interrupt enable bit in reg_b is set.
+			 */
+			*val = vrtc->rtcdev.reg_c;
+			vrtc_set_reg_c(vrtc, 0);
+		} else {
+			*val = *((uint8_t *)rtc + offset);
+		}
+		VCPU_CTR2(vm, vcpuid, "Read value %#x from RTC offset %#x",
+		    *val, offset);
+	} else {
+		switch (offset) {
+		case 10:
+			VCPU_CTR1(vm, vcpuid, "RTC reg_a set to %#x", *val);
+			vrtc_set_reg_a(vrtc, *val);
+			break;
+		case 11:
+			VCPU_CTR1(vm, vcpuid, "RTC reg_b set to %#x", *val);
+			error = vrtc_set_reg_b(vrtc, *val);
+			break;
+		case 12:
+			VCPU_CTR1(vm, vcpuid, "RTC reg_c set to %#x (ignored)",
+			    *val);
+			break;
+		case 13:
+			VCPU_CTR1(vm, vcpuid, "RTC reg_d set to %#x (ignored)",
+			    *val);
+			break;
+		case 0:
+			/*
+			 * High order bit of 'seconds' is readonly.
+			 */
+			*val &= 0x7f;
+			/* FALLTHRU */
+		default:
+			VCPU_CTR2(vm, vcpuid, "RTC offset %#x set to %#x",
+			    offset, *val);
+			*((uint8_t *)rtc + offset) = *val;
+			break;
+		}
+
+		/*
+		 * XXX some guests (e.g. OpenBSD) write the century byte
+		 * outside of RTCSB_HALT so re-calculate the RTC date/time.
+		 */
+		if (offset == RTC_CENTURY && !rtc_halted(vrtc)) {
+			curtime = rtc_to_secs(vrtc);
+			error = vrtc_time_update(vrtc, curtime, sbinuptime());
+			KASSERT(!error, ("vrtc_time_update error %d", error));
+			if (curtime == VRTC_BROKEN_TIME && rtc_flag_broken_time)
+				error = -1;
+		}
+	}
+	VRTC_UNLOCK(vrtc);
+	return (error);
+}
+
+void
+vrtc_reset(struct vrtc *vrtc)
+{
+	struct rtcdev *rtc;
+
+	VRTC_LOCK(vrtc);
+
+	rtc = &vrtc->rtcdev;
+	vrtc_set_reg_b(vrtc, rtc->reg_b & ~(RTCSB_ALL_INTRS | RTCSB_SQWE));
+	vrtc_set_reg_c(vrtc, 0);
+	KASSERT(!callout_active(&vrtc->callout), ("rtc callout still active"));
+
+	VRTC_UNLOCK(vrtc);
+}
+
+struct vrtc *
+vrtc_init(struct vm *vm)
+{
+	struct vrtc *vrtc;
+	struct rtcdev *rtc;
+	time_t curtime;
+
+	vrtc = malloc(sizeof(struct vrtc), M_VRTC, M_WAITOK | M_ZERO);
+	vrtc->vm = vm;
+	mtx_init(&vrtc->mtx, "vrtc lock", NULL, MTX_DEF);
+	callout_init(&vrtc->callout, 1);
+
+	/* Allow dividers to keep time but disable everything else */
+	rtc = &vrtc->rtcdev;
+	rtc->reg_a = 0x20;
+	rtc->reg_b = RTCSB_24HR;
+	rtc->reg_c = 0;
+	rtc->reg_d = RTCSD_PWR;
+
+	/* Reset the index register to a safe value. */
+	vrtc->addr = RTC_STATUSD;
+
+	/*
+	 * Initialize RTC time to 00:00:00 Jan 1, 1970.
+	 */
+	curtime = 0;
+
+	VRTC_LOCK(vrtc);
+	vrtc->base_rtctime = VRTC_BROKEN_TIME;
+	vrtc_time_update(vrtc, curtime, sbinuptime());
+	secs_to_rtc(curtime, vrtc, 0);
+	VRTC_UNLOCK(vrtc);
+
+	return (vrtc);
+}
+
+void
+vrtc_cleanup(struct vrtc *vrtc)
+{
+
+	callout_drain(&vrtc->callout);
+	free(vrtc, M_VRTC);
+}
+
+#ifndef __FreeBSD__
+void
+vrtc_localize_resources(struct vrtc *vrtc)
+{
+	vmm_glue_callout_localize(&vrtc->callout);
+}
+#endif /* __FreeBSD */
diff --git a/usr/src/uts/i86pc/io/vmm/io/vrtc.h b/usr/src/uts/i86pc/io/vmm/io/vrtc.h
new file mode 100644
index 0000000000..ffab3a5af0
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/io/vrtc.h
@@ -0,0 +1,58 @@
+/*-
+ * Copyright (c) 2014 Neel Natu (neel@freebsd.org)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _VRTC_H_
+#define	_VRTC_H_
+
+#include <isa/isareg.h>
+
+struct vrtc;
+
+struct vrtc *vrtc_init(struct vm *vm);
+void vrtc_cleanup(struct vrtc *vrtc);
+void vrtc_reset(struct vrtc *vrtc);
+
+time_t vrtc_get_time(struct vm *vm);
+int vrtc_set_time(struct vm *vm, time_t secs);
+int vrtc_nvram_write(struct vm *vm, int offset, uint8_t value);
+int vrtc_nvram_read(struct vm *vm, int offset, uint8_t *retval);
+
+int vrtc_addr_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *val);
+int vrtc_data_handler(struct vm *vm, int vcpuid, bool in, int port, int bytes,
+    uint32_t *val);
+
+#ifndef __FreeBSD__
+void vrtc_localize_resources(struct vrtc *);
+#endif
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vm/pmap.h b/usr/src/uts/i86pc/io/vmm/vm/pmap.h
new file mode 100644
index 0000000000..512fc4acee
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vm/pmap.h
@@ -0,0 +1,27 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _PMAP_VM_
+#define	_PMAP_VM_
+
+#include <machine/pmap.h>
+#include "vm_glue.h"
+
+void	pmap_invalidate_cache(void);
+void	pmap_get_mapping(pmap_t pmap, vm_offset_t va, uint64_t *ptr, int *num);
+int	pmap_emulate_accessed_dirty(pmap_t pmap, vm_offset_t va, int ftype);
+long	pmap_wired_count(pmap_t pmap);
+
+#endif /* _PMAP_VM_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vm/vm_extern.h b/usr/src/uts/i86pc/io/vmm/vm/vm_extern.h
new file mode 100644
index 0000000000..92a959960a
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vm/vm_extern.h
@@ -0,0 +1,35 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _VM_EXTERN_H_
+#define	_VM_EXTERN_H_
+
+#include <sys/types.h>
+#include <vm/vm.h>
+
+struct vmspace;
+struct pmap;
+
+typedef int (*pmap_pinit_t)(struct pmap *pmap);
+
+struct vmspace *vmspace_alloc(vm_offset_t, vm_offset_t, pmap_pinit_t);
+void vmspace_free(struct vmspace *);
+
+int vm_fault(vm_map_t, vm_offset_t, vm_prot_t, int);
+int vm_fault_quick_hold_pages(vm_map_t map, vm_offset_t addr, vm_size_t len,
+    vm_prot_t prot, vm_page_t *ma, int max_count);
+
+
+#endif /* _VM_EXTERN_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vm/vm_glue.h b/usr/src/uts/i86pc/io/vmm/vm/vm_glue.h
new file mode 100644
index 0000000000..cb6d4c358e
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vm/vm_glue.h
@@ -0,0 +1,80 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef	_VM_GLUE_
+#define	_VM_GLUE_
+
+#include <vm/pmap.h>
+#include <vm/vm.h>
+#include <sys/cpuvar.h>
+
+struct vmspace;
+struct vm_map;
+struct pmap;
+struct vm_object;
+
+struct vm_map {
+	struct vmspace *vmm_space;
+};
+
+struct pmap {
+	void		*pm_pml4;
+	cpuset_t	pm_active;
+	long		pm_eptgen;
+
+	/* Implementation private */
+	enum pmap_type	pm_type;
+	void		*pm_map;
+};
+
+struct vmspace {
+	struct vm_map vm_map;
+
+	/* Implementation private */
+	kmutex_t	vms_lock;
+	struct pmap	vms_pmap;
+	uintptr_t	vms_size;	/* fixed after creation */
+
+	list_t		vms_maplist;
+};
+
+typedef pfn_t (*vm_pager_fn_t)(vm_object_t, uintptr_t, pfn_t *, uint_t *);
+
+struct vm_object {
+	kmutex_t	vmo_lock;
+	uint_t		vmo_refcnt;
+	objtype_t	vmo_type;
+	size_t		vmo_size;
+	vm_memattr_t	vmo_attr;
+	vm_pager_fn_t	vmo_pager;
+	void		*vmo_data;
+};
+
+struct vm_page {
+	kmutex_t		vmp_lock;
+	pfn_t			vmp_pfn;
+	struct vm_object	*vmp_obj_held;
+};
+
+/* Illumos-specific functions for setup and operation */
+int vm_segmap_obj(struct vmspace *, vm_object_t, struct as *, caddr_t *,
+    uint_t, uint_t, uint_t);
+int vm_segmap_space(struct vmspace *, off_t, struct as *, caddr_t *, off_t,
+    uint_t, uint_t, uint_t);
+void *vmspace_find_kva(struct vmspace *, uintptr_t, size_t);
+void vmm_arena_init(void);
+void vmm_arena_fini(void);
+
+#endif /* _VM_GLUE_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vm/vm_map.h b/usr/src/uts/i86pc/io/vmm/vm/vm_map.h
new file mode 100644
index 0000000000..20b74d4d36
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vm/vm_map.h
@@ -0,0 +1,63 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef	_VM_MAP_
+#define	_VM_MAP_
+
+#include "vm_glue.h"
+
+/*
+ * vm_map_wire and vm_map_unwire option flags
+ */
+#define VM_MAP_WIRE_SYSTEM	0	/* wiring in a kernel map */
+#define VM_MAP_WIRE_USER	1	/* wiring in a user map */
+
+#define VM_MAP_WIRE_NOHOLES	0	/* region must not have holes */
+#define VM_MAP_WIRE_HOLESOK	2	/* region may have holes */
+
+#define VM_MAP_WIRE_WRITE	4	/* Validate writable. */
+
+/*
+ * The following "find_space" options are supported by vm_map_find().
+ *
+ * For VMFS_ALIGNED_SPACE, the desired alignment is specified to
+ * the macro argument as log base 2 of the desired alignment.
+ */
+#define	VMFS_NO_SPACE		0	/* don't find; use the given range */
+#define	VMFS_ANY_SPACE		1	/* find range with any alignment */
+#define	VMFS_OPTIMAL_SPACE	2	/* find range with optimal alignment */
+#define	VMFS_SUPER_SPACE	3	/* find superpage-aligned range */
+#define	VMFS_ALIGNED_SPACE(x) ((x) << 8) /* find range with fixed alignment */
+
+/*
+ * vm_fault option flags
+ */
+#define	VM_FAULT_NORMAL	0	/* Nothing special */
+#define	VM_FAULT_WIRE	1	/* Wire the mapped page */
+#define	VM_FAULT_DIRTY	2	/* Dirty the page; use w/VM_PROT_COPY */
+
+
+
+pmap_t vmspace_pmap(struct vmspace *);
+
+int vm_map_find(vm_map_t, vm_object_t, vm_ooffset_t, vm_offset_t *, vm_size_t,
+    vm_offset_t, int, vm_prot_t, vm_prot_t, int);
+int vm_map_remove(vm_map_t, vm_offset_t, vm_offset_t);
+int vm_map_wire(vm_map_t map, vm_offset_t start, vm_offset_t end, int flags);
+
+long vmspace_resident_count(struct vmspace *vmspace);
+
+
+#endif /* _VM_MAP_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vm/vm_object.h b/usr/src/uts/i86pc/io/vmm/vm/vm_object.h
new file mode 100644
index 0000000000..9aa7d91cf9
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vm/vm_object.h
@@ -0,0 +1,30 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef	_VM_OBJECT_
+#define	_VM_OBJECT_
+
+#include "vm_glue.h"
+
+vm_object_t vm_object_allocate(objtype_t, vm_pindex_t);
+void vm_object_deallocate(vm_object_t);
+void vm_object_reference(vm_object_t);
+int vm_object_set_memattr(vm_object_t, vm_memattr_t);
+
+
+#define	VM_OBJECT_WLOCK(vmo)	mutex_enter(&(vmo)->vmo_lock)
+#define	VM_OBJECT_WUNLOCK(vmo)	mutex_exit(&(vmo)->vmo_lock)
+
+#endif /* _VM_OBJECT_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vm/vm_page.h b/usr/src/uts/i86pc/io/vmm/vm/vm_page.h
new file mode 100644
index 0000000000..4559fe6d4c
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vm/vm_page.h
@@ -0,0 +1,28 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+
+#ifndef	_VM_PAGE_
+#define	_VM_PAGE_
+
+#include "vm_glue.h"
+
+void vm_page_lock(vm_page_t);
+void vm_page_unhold(vm_page_t);
+void vm_page_unlock(vm_page_t);
+
+#define	VM_PAGE_TO_PHYS(page)	(mmu_ptob((uintptr_t)((page)->vmp_pfn)))
+
+#endif /* _VM_PAGE_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vm/vm_pager.h b/usr/src/uts/i86pc/io/vmm/vm/vm_pager.h
new file mode 100644
index 0000000000..11aa344f61
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vm/vm_pager.h
@@ -0,0 +1,23 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef	_VM_PAGER_
+#define	_VM_PAGER_
+
+vm_object_t vm_pager_allocate(objtype_t, void *, vm_ooffset_t, vm_prot_t,
+    vm_ooffset_t, void *);
+
+
+#endif /* _VM_PAGER_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vmm.c b/usr/src/uts/i86pc/io/vmm/vmm.c
new file mode 100644
index 0000000000..164227cc5e
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm.c
@@ -0,0 +1,3257 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/module.h>
+#include <sys/sysctl.h>
+#include <sys/malloc.h>
+#include <sys/pcpu.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/proc.h>
+#include <sys/rwlock.h>
+#include <sys/sched.h>
+#include <sys/smp.h>
+#include <sys/systm.h>
+
+#include <vm/vm.h>
+#include <vm/vm_object.h>
+#include <vm/vm_map.h>
+#include <vm/vm_page.h>
+#include <vm/pmap.h>
+#include <vm/vm_extern.h>
+#include <vm/vm_param.h>
+
+#ifdef __FreeBSD__
+#include <machine/cpu.h>
+#endif
+#include <machine/pcb.h>
+#include <machine/smp.h>
+#include <machine/md_var.h>
+#include <x86/psl.h>
+#include <x86/apicreg.h>
+
+#include <machine/vmm.h>
+#include <machine/vmm_dev.h>
+#include <machine/vmm_instruction_emul.h>
+
+#include "vmm_ioport.h"
+#include "vmm_ktr.h"
+#include "vmm_host.h"
+#include "vmm_mem.h"
+#include "vmm_util.h"
+#include "vatpic.h"
+#include "vatpit.h"
+#include "vhpet.h"
+#include "vioapic.h"
+#include "vlapic.h"
+#include "vpmtmr.h"
+#include "vrtc.h"
+#include "vmm_stat.h"
+#include "vmm_lapic.h"
+
+#include "io/ppt.h"
+#include "io/iommu.h"
+
+struct vlapic;
+
+/*
+ * Initialization:
+ * (a) allocated when vcpu is created
+ * (i) initialized when vcpu is created and when it is reinitialized
+ * (o) initialized the first time the vcpu is created
+ * (x) initialized before use
+ */
+struct vcpu {
+	struct mtx 	mtx;		/* (o) protects 'state' and 'hostcpu' */
+	enum vcpu_state	state;		/* (o) vcpu state */
+#ifndef __FreeBSD__
+	kcondvar_t	vcpu_cv;	/* (o) cpu waiter cv */
+	kcondvar_t	state_cv;	/* (o) IDLE-transition cv */
+#endif /* __FreeBSD__ */
+	int		hostcpu;	/* (o) vcpu's current host cpu */
+#ifndef __FreeBSD__
+	int		lastloccpu;	/* (o) last host cpu localized to */
+#endif
+	int		reqidle;	/* (i) request vcpu to idle */
+	struct vlapic	*vlapic;	/* (i) APIC device model */
+	enum x2apic_state x2apic_state;	/* (i) APIC mode */
+	uint64_t	exitintinfo;	/* (i) events pending at VM exit */
+	int		nmi_pending;	/* (i) NMI pending */
+	int		extint_pending;	/* (i) INTR pending */
+	int	exception_pending;	/* (i) exception pending */
+	int	exc_vector;		/* (x) exception collateral */
+	int	exc_errcode_valid;
+	uint32_t exc_errcode;
+	struct savefpu	*guestfpu;	/* (a,i) guest fpu state */
+	uint64_t	guest_xcr0;	/* (i) guest %xcr0 register */
+	void		*stats;		/* (a,i) statistics */
+	struct vm_exit	exitinfo;	/* (x) exit reason and collateral */
+	uint64_t	nextrip;	/* (x) next instruction to execute */
+#ifndef __FreeBSD__
+	uint64_t	tsc_offset;	/* (x) offset from host TSC */
+#endif
+};
+
+#define	vcpu_lock_initialized(v) mtx_initialized(&((v)->mtx))
+#define	vcpu_lock_init(v)	mtx_init(&((v)->mtx), "vcpu lock", 0, MTX_SPIN)
+#define	vcpu_lock(v)		mtx_lock_spin(&((v)->mtx))
+#define	vcpu_unlock(v)		mtx_unlock_spin(&((v)->mtx))
+#define	vcpu_assert_locked(v)	mtx_assert(&((v)->mtx), MA_OWNED)
+
+struct mem_seg {
+	size_t	len;
+	bool	sysmem;
+	struct vm_object *object;
+};
+#ifdef __FreeBSD__
+#define	VM_MAX_MEMSEGS	3
+#else
+#define	VM_MAX_MEMSEGS	4
+#endif
+
+struct mem_map {
+	vm_paddr_t	gpa;
+	size_t		len;
+	vm_ooffset_t	segoff;
+	int		segid;
+	int		prot;
+	int		flags;
+};
+#define	VM_MAX_MEMMAPS	4
+
+/*
+ * Initialization:
+ * (o) initialized the first time the VM is created
+ * (i) initialized when VM is created and when it is reinitialized
+ * (x) initialized before use
+ */
+struct vm {
+	void		*cookie;		/* (i) cpu-specific data */
+	void		*iommu;			/* (x) iommu-specific data */
+	struct vhpet	*vhpet;			/* (i) virtual HPET */
+	struct vioapic	*vioapic;		/* (i) virtual ioapic */
+	struct vatpic	*vatpic;		/* (i) virtual atpic */
+	struct vatpit	*vatpit;		/* (i) virtual atpit */
+	struct vpmtmr	*vpmtmr;		/* (i) virtual ACPI PM timer */
+	struct vrtc	*vrtc;			/* (o) virtual RTC */
+	volatile cpuset_t active_cpus;		/* (i) active vcpus */
+	volatile cpuset_t debug_cpus;		/* (i) vcpus stopped for debug */
+	int		suspend;		/* (i) stop VM execution */
+	volatile cpuset_t suspended_cpus; 	/* (i) suspended vcpus */
+	volatile cpuset_t halted_cpus;		/* (x) cpus in a hard halt */
+	cpuset_t	rendezvous_req_cpus;	/* (x) rendezvous requested */
+	cpuset_t	rendezvous_done_cpus;	/* (x) rendezvous finished */
+	void		*rendezvous_arg;	/* (x) rendezvous func/arg */
+	vm_rendezvous_func_t rendezvous_func;
+	struct mtx	rendezvous_mtx;		/* (o) rendezvous lock */
+#ifndef __FreeBSD__
+	kcondvar_t	rendezvous_cv;		/* (0) rendezvous condvar */
+#endif
+	struct mem_map	mem_maps[VM_MAX_MEMMAPS]; /* (i) guest address space */
+	struct mem_seg	mem_segs[VM_MAX_MEMSEGS]; /* (o) guest memory regions */
+	struct vmspace	*vmspace;		/* (o) guest's address space */
+	char		name[VM_MAX_NAMELEN];	/* (o) virtual machine name */
+	struct vcpu	vcpu[VM_MAXCPU];	/* (i) guest vcpus */
+	/* The following describe the vm cpu topology */
+	uint16_t	sockets;		/* (o) num of sockets */
+	uint16_t	cores;			/* (o) num of cores/socket */
+	uint16_t	threads;		/* (o) num of threads/core */
+	uint16_t	maxcpus;		/* (o) max pluggable cpus */
+#ifndef __FreeBSD__
+	krwlock_t	ioport_rwlock;
+	list_t		ioport_hooks;
+#endif /* __FreeBSD__ */
+};
+
+static int vmm_initialized;
+
+static struct vmm_ops *ops;
+#define	VMM_INIT(num)	(ops != NULL ? (*ops->init)(num) : 0)
+#define	VMM_CLEANUP()	(ops != NULL ? (*ops->cleanup)() : 0)
+#define	VMM_RESUME()	(ops != NULL ? (*ops->resume)() : 0)
+
+#define	VMINIT(vm, pmap) (ops != NULL ? (*ops->vminit)(vm, pmap): NULL)
+#define	VMRUN(vmi, vcpu, rip, pmap, evinfo) \
+	(ops != NULL ? (*ops->vmrun)(vmi, vcpu, rip, pmap, evinfo) : ENXIO)
+#define	VMCLEANUP(vmi)	(ops != NULL ? (*ops->vmcleanup)(vmi) : NULL)
+#define	VMSPACE_ALLOC(min, max) \
+	(ops != NULL ? (*ops->vmspace_alloc)(min, max) : NULL)
+#define	VMSPACE_FREE(vmspace) \
+	(ops != NULL ? (*ops->vmspace_free)(vmspace) : ENXIO)
+#define	VMGETREG(vmi, vcpu, num, retval)		\
+	(ops != NULL ? (*ops->vmgetreg)(vmi, vcpu, num, retval) : ENXIO)
+#define	VMSETREG(vmi, vcpu, num, val)		\
+	(ops != NULL ? (*ops->vmsetreg)(vmi, vcpu, num, val) : ENXIO)
+#define	VMGETDESC(vmi, vcpu, num, desc)		\
+	(ops != NULL ? (*ops->vmgetdesc)(vmi, vcpu, num, desc) : ENXIO)
+#define	VMSETDESC(vmi, vcpu, num, desc)		\
+	(ops != NULL ? (*ops->vmsetdesc)(vmi, vcpu, num, desc) : ENXIO)
+#define	VMGETCAP(vmi, vcpu, num, retval)	\
+	(ops != NULL ? (*ops->vmgetcap)(vmi, vcpu, num, retval) : ENXIO)
+#define	VMSETCAP(vmi, vcpu, num, val)		\
+	(ops != NULL ? (*ops->vmsetcap)(vmi, vcpu, num, val) : ENXIO)
+#define	VLAPIC_INIT(vmi, vcpu)			\
+	(ops != NULL ? (*ops->vlapic_init)(vmi, vcpu) : NULL)
+#define	VLAPIC_CLEANUP(vmi, vlapic)		\
+	(ops != NULL ? (*ops->vlapic_cleanup)(vmi, vlapic) : NULL)
+
+#define	fpu_start_emulating()	load_cr0(rcr0() | CR0_TS)
+#define	fpu_stop_emulating()	clts()
+
+SDT_PROVIDER_DEFINE(vmm);
+
+static MALLOC_DEFINE(M_VM, "vm", "vm");
+
+/* statistics */
+static VMM_STAT(VCPU_TOTAL_RUNTIME, "vcpu total runtime");
+
+SYSCTL_NODE(_hw, OID_AUTO, vmm, CTLFLAG_RW, NULL, NULL);
+
+/*
+ * Halt the guest if all vcpus are executing a HLT instruction with
+ * interrupts disabled.
+ */
+static int halt_detection_enabled = 1;
+SYSCTL_INT(_hw_vmm, OID_AUTO, halt_detection, CTLFLAG_RDTUN,
+    &halt_detection_enabled, 0,
+    "Halt VM if all vcpus execute HLT with interrupts disabled");
+
+static int vmm_ipinum;
+SYSCTL_INT(_hw_vmm, OID_AUTO, ipinum, CTLFLAG_RD, &vmm_ipinum, 0,
+    "IPI vector used for vcpu notifications");
+
+static int trace_guest_exceptions;
+SYSCTL_INT(_hw_vmm, OID_AUTO, trace_guest_exceptions, CTLFLAG_RDTUN,
+    &trace_guest_exceptions, 0,
+    "Trap into hypervisor on all guest exceptions and reflect them back");
+
+static void vm_free_memmap(struct vm *vm, int ident);
+static bool sysmem_mapping(struct vm *vm, struct mem_map *mm);
+static void vcpu_notify_event_locked(struct vcpu *vcpu, bool lapic_intr);
+
+#ifndef __FreeBSD__
+typedef struct vm_ioport_hook {
+	list_node_t	vmih_node;
+	uint_t		vmih_ioport;
+	void		*vmih_arg;
+	vmm_rmem_cb_t	vmih_rmem_cb;
+	vmm_wmem_cb_t	vmih_wmem_cb;
+} vm_ioport_hook_t;
+
+/* Flags for vtc_status */
+#define	VTCS_FPU_RESTORED	1 /* guest FPU restored, host FPU saved */
+#define	VTCS_FPU_CTX_CRITICAL	2 /* in ctx where FPU restore cannot be lazy */
+
+typedef struct vm_thread_ctx {
+	struct vm	*vtc_vm;
+	int		vtc_vcpuid;
+	uint_t		vtc_status;
+} vm_thread_ctx_t;
+#endif /* __FreeBSD__ */
+
+#ifdef KTR
+static const char *
+vcpu_state2str(enum vcpu_state state)
+{
+
+	switch (state) {
+	case VCPU_IDLE:
+		return ("idle");
+	case VCPU_FROZEN:
+		return ("frozen");
+	case VCPU_RUNNING:
+		return ("running");
+	case VCPU_SLEEPING:
+		return ("sleeping");
+	default:
+		return ("unknown");
+	}
+}
+#endif
+
+static void
+vcpu_cleanup(struct vm *vm, int i, bool destroy)
+{
+	struct vcpu *vcpu = &vm->vcpu[i];
+
+	VLAPIC_CLEANUP(vm->cookie, vcpu->vlapic);
+	if (destroy) {
+		vmm_stat_free(vcpu->stats);
+		fpu_save_area_free(vcpu->guestfpu);
+	}
+}
+
+static void
+vcpu_init(struct vm *vm, int vcpu_id, bool create)
+{
+	struct vcpu *vcpu;
+
+	KASSERT(vcpu_id >= 0 && vcpu_id < VM_MAXCPU,
+	    ("vcpu_init: invalid vcpu %d", vcpu_id));
+
+	vcpu = &vm->vcpu[vcpu_id];
+
+	if (create) {
+#ifdef __FreeBSD__
+		KASSERT(!vcpu_lock_initialized(vcpu), ("vcpu %d already "
+		    "initialized", vcpu_id));
+#endif
+		vcpu_lock_init(vcpu);
+		vcpu->state = VCPU_IDLE;
+		vcpu->hostcpu = NOCPU;
+#ifndef __FreeBSD__
+		vcpu->lastloccpu = NOCPU;
+#endif
+		vcpu->guestfpu = fpu_save_area_alloc();
+		vcpu->stats = vmm_stat_alloc();
+	}
+
+	vcpu->vlapic = VLAPIC_INIT(vm->cookie, vcpu_id);
+	vm_set_x2apic_state(vm, vcpu_id, X2APIC_DISABLED);
+	vcpu->reqidle = 0;
+	vcpu->exitintinfo = 0;
+	vcpu->nmi_pending = 0;
+	vcpu->extint_pending = 0;
+	vcpu->exception_pending = 0;
+	vcpu->guest_xcr0 = XFEATURE_ENABLED_X87;
+	fpu_save_area_reset(vcpu->guestfpu);
+	vmm_stat_init(vcpu->stats);
+}
+
+int
+vcpu_trace_exceptions(struct vm *vm, int vcpuid)
+{
+
+	return (trace_guest_exceptions);
+}
+
+struct vm_exit *
+vm_exitinfo(struct vm *vm, int cpuid)
+{
+	struct vcpu *vcpu;
+
+	if (cpuid < 0 || cpuid >= VM_MAXCPU)
+		panic("vm_exitinfo: invalid cpuid %d", cpuid);
+
+	vcpu = &vm->vcpu[cpuid];
+
+	return (&vcpu->exitinfo);
+}
+
+#ifdef __FreeBSD__
+static void
+vmm_resume(void)
+{
+	VMM_RESUME();
+}
+#endif
+
+static int
+vmm_init(void)
+{
+	int error;
+
+	vmm_host_state_init();
+
+#ifdef __FreeBSD__
+	vmm_ipinum = lapic_ipi_alloc(pti ? &IDTVEC(justreturn1_pti) :
+	    &IDTVEC(justreturn));
+	if (vmm_ipinum < 0)
+		vmm_ipinum = IPI_AST;
+#else
+	/* We use cpu_poke() for IPIs */
+	vmm_ipinum = 0;
+#endif
+
+	error = vmm_mem_init();
+	if (error)
+		return (error);
+
+	if (vmm_is_intel())
+		ops = &vmm_ops_intel;
+	else if (vmm_is_amd())
+		ops = &vmm_ops_amd;
+	else
+		return (ENXIO);
+
+#ifdef __FreeBSD__
+	vmm_resume_p = vmm_resume;
+#endif
+
+	return (VMM_INIT(vmm_ipinum));
+}
+
+#ifdef __FreeBSD__
+
+static int
+vmm_handler(module_t mod, int what, void *arg)
+{
+	int error;
+
+	switch (what) {
+	case MOD_LOAD:
+		vmmdev_init();
+		error = vmm_init();
+		if (error == 0)
+			vmm_initialized = 1;
+		break;
+	case MOD_UNLOAD:
+		error = vmmdev_cleanup();
+		if (error == 0) {
+			vmm_resume_p = NULL;
+			iommu_cleanup();
+#ifdef __FreeBSD__
+			if (vmm_ipinum != IPI_AST)
+				lapic_ipi_free(vmm_ipinum);
+#endif
+			error = VMM_CLEANUP();
+			/*
+			 * Something bad happened - prevent new
+			 * VMs from being created
+			 */
+			if (error)
+				vmm_initialized = 0;
+		}
+		break;
+	default:
+		error = 0;
+		break;
+	}
+	return (error);
+}
+
+static moduledata_t vmm_kmod = {
+	"vmm",
+	vmm_handler,
+	NULL
+};
+
+/*
+ * vmm initialization has the following dependencies:
+ *
+ * - VT-x initialization requires smp_rendezvous() and therefore must happen
+ *   after SMP is fully functional (after SI_SUB_SMP).
+ */
+DECLARE_MODULE(vmm, vmm_kmod, SI_SUB_SMP + 1, SI_ORDER_ANY);
+MODULE_VERSION(vmm, 1);
+
+#else /* __FreeBSD__ */
+
+int
+vmm_mod_load()
+{
+	int	error;
+
+	error = vmm_init();
+	if (error == 0)
+		vmm_initialized = 1;
+
+	return (error);
+}
+
+int
+vmm_mod_unload()
+{
+	int	error;
+
+	iommu_cleanup();
+	error = VMM_CLEANUP();
+	if (error)
+		return (error);
+	vmm_initialized = 0;
+
+	return (0);
+}
+
+#endif /* __FreeBSD__ */
+
+static void
+vm_init(struct vm *vm, bool create)
+{
+	int i;
+#ifndef __FreeBSD__
+	uint64_t tsc_off;
+#endif
+
+	vm->cookie = VMINIT(vm, vmspace_pmap(vm->vmspace));
+	vm->iommu = NULL;
+	vm->vioapic = vioapic_init(vm);
+	vm->vhpet = vhpet_init(vm);
+	vm->vatpic = vatpic_init(vm);
+	vm->vatpit = vatpit_init(vm);
+	vm->vpmtmr = vpmtmr_init(vm);
+	if (create)
+		vm->vrtc = vrtc_init(vm);
+#ifndef __FreeBSD__
+	if (create) {
+		rw_init(&vm->ioport_rwlock, NULL, RW_DEFAULT, NULL);
+		list_create(&vm->ioport_hooks, sizeof (vm_ioport_hook_t),
+		    offsetof (vm_ioport_hook_t, vmih_node));
+	} else {
+		VERIFY(list_is_empty(&vm->ioport_hooks));
+	}
+#endif /* __FreeBSD__ */
+
+	CPU_ZERO(&vm->active_cpus);
+	CPU_ZERO(&vm->debug_cpus);
+
+	vm->suspend = 0;
+	CPU_ZERO(&vm->suspended_cpus);
+
+	for (i = 0; i < VM_MAXCPU; i++)
+		vcpu_init(vm, i, create);
+
+#ifndef __FreeBSD__
+	tsc_off = (uint64_t)(-(int64_t)rdtsc());
+	for (i = 0; i < VM_MAXCPU; i++) {
+		vm->vcpu[i].tsc_offset = tsc_off;
+	}
+#endif /* __FreeBSD__ */
+}
+
+/*
+ * The default CPU topology is a single thread per package.
+ */
+u_int cores_per_package = 1;
+u_int threads_per_core = 1;
+
+int
+vm_create(const char *name, struct vm **retvm)
+{
+	struct vm *vm;
+	struct vmspace *vmspace;
+
+	/*
+	 * If vmm.ko could not be successfully initialized then don't attempt
+	 * to create the virtual machine.
+	 */
+	if (!vmm_initialized)
+		return (ENXIO);
+
+	if (name == NULL || strlen(name) >= VM_MAX_NAMELEN)
+		return (EINVAL);
+
+	vmspace = VMSPACE_ALLOC(0, VM_MAXUSER_ADDRESS);
+	if (vmspace == NULL)
+		return (ENOMEM);
+
+	vm = malloc(sizeof(struct vm), M_VM, M_WAITOK | M_ZERO);
+	strcpy(vm->name, name);
+	vm->vmspace = vmspace;
+	mtx_init(&vm->rendezvous_mtx, "vm rendezvous lock", 0, MTX_DEF);
+
+	vm->sockets = 1;
+	vm->cores = cores_per_package;	/* XXX backwards compatibility */
+	vm->threads = threads_per_core;	/* XXX backwards compatibility */
+	vm->maxcpus = 0;		/* XXX not implemented */
+
+	vm_init(vm, true);
+
+	*retvm = vm;
+	return (0);
+}
+
+void
+vm_get_topology(struct vm *vm, uint16_t *sockets, uint16_t *cores,
+    uint16_t *threads, uint16_t *maxcpus)
+{
+	*sockets = vm->sockets;
+	*cores = vm->cores;
+	*threads = vm->threads;
+	*maxcpus = vm->maxcpus;
+}
+
+int
+vm_set_topology(struct vm *vm, uint16_t sockets, uint16_t cores,
+    uint16_t threads, uint16_t maxcpus)
+{
+	if (maxcpus != 0)
+		return (EINVAL);	/* XXX remove when supported */
+	if ((sockets * cores * threads) > VM_MAXCPU)
+		return (EINVAL);
+	/* XXX need to check sockets * cores * threads == vCPU, how? */
+	vm->sockets = sockets;
+	vm->cores = cores;
+	vm->threads = threads;
+	vm->maxcpus = maxcpus;
+	return(0);
+}
+
+static void
+vm_cleanup(struct vm *vm, bool destroy)
+{
+	struct mem_map *mm;
+	int i;
+
+	ppt_unassign_all(vm);
+
+	if (vm->iommu != NULL)
+		iommu_destroy_domain(vm->iommu);
+
+	if (destroy)
+		vrtc_cleanup(vm->vrtc);
+	else
+		vrtc_reset(vm->vrtc);
+	vpmtmr_cleanup(vm->vpmtmr);
+	vatpit_cleanup(vm->vatpit);
+	vhpet_cleanup(vm->vhpet);
+	vatpic_cleanup(vm->vatpic);
+	vioapic_cleanup(vm->vioapic);
+
+	for (i = 0; i < VM_MAXCPU; i++)
+		vcpu_cleanup(vm, i, destroy);
+
+	VMCLEANUP(vm->cookie);
+
+	/*
+	 * System memory is removed from the guest address space only when
+	 * the VM is destroyed. This is because the mapping remains the same
+	 * across VM reset.
+	 *
+	 * Device memory can be relocated by the guest (e.g. using PCI BARs)
+	 * so those mappings are removed on a VM reset.
+	 */
+	for (i = 0; i < VM_MAX_MEMMAPS; i++) {
+		mm = &vm->mem_maps[i];
+		if (destroy || !sysmem_mapping(vm, mm))
+			vm_free_memmap(vm, i);
+	}
+
+	if (destroy) {
+		for (i = 0; i < VM_MAX_MEMSEGS; i++)
+			vm_free_memseg(vm, i);
+
+		VMSPACE_FREE(vm->vmspace);
+		vm->vmspace = NULL;
+	}
+}
+
+void
+vm_destroy(struct vm *vm)
+{
+	vm_cleanup(vm, true);
+	free(vm, M_VM);
+}
+
+int
+vm_reinit(struct vm *vm)
+{
+	int error;
+
+	/*
+	 * A virtual machine can be reset only if all vcpus are suspended.
+	 */
+	if (CPU_CMP(&vm->suspended_cpus, &vm->active_cpus) == 0) {
+		vm_cleanup(vm, false);
+		vm_init(vm, false);
+		error = 0;
+	} else {
+		error = EBUSY;
+	}
+
+	return (error);
+}
+
+const char *
+vm_name(struct vm *vm)
+{
+	return (vm->name);
+}
+
+int
+vm_map_mmio(struct vm *vm, vm_paddr_t gpa, size_t len, vm_paddr_t hpa)
+{
+	vm_object_t obj;
+
+	if ((obj = vmm_mmio_alloc(vm->vmspace, gpa, len, hpa)) == NULL)
+		return (ENOMEM);
+	else
+		return (0);
+}
+
+int
+vm_unmap_mmio(struct vm *vm, vm_paddr_t gpa, size_t len)
+{
+
+	vmm_mmio_free(vm->vmspace, gpa, len);
+	return (0);
+}
+
+/*
+ * Return 'true' if 'gpa' is allocated in the guest address space.
+ *
+ * This function is called in the context of a running vcpu which acts as
+ * an implicit lock on 'vm->mem_maps[]'.
+ */
+bool
+vm_mem_allocated(struct vm *vm, int vcpuid, vm_paddr_t gpa)
+{
+	struct mem_map *mm;
+	int i;
+
+#ifdef INVARIANTS
+	int hostcpu, state;
+	state = vcpu_get_state(vm, vcpuid, &hostcpu);
+	KASSERT(state == VCPU_RUNNING && hostcpu == curcpu,
+	    ("%s: invalid vcpu state %d/%d", __func__, state, hostcpu));
+#endif
+
+	for (i = 0; i < VM_MAX_MEMMAPS; i++) {
+		mm = &vm->mem_maps[i];
+		if (mm->len != 0 && gpa >= mm->gpa && gpa < mm->gpa + mm->len)
+			return (true);		/* 'gpa' is sysmem or devmem */
+	}
+
+	if (ppt_is_mmio(vm, gpa))
+		return (true);			/* 'gpa' is pci passthru mmio */
+
+	return (false);
+}
+
+int
+vm_alloc_memseg(struct vm *vm, int ident, size_t len, bool sysmem)
+{
+	struct mem_seg *seg;
+	vm_object_t obj;
+
+#ifndef __FreeBSD__
+	extern pgcnt_t get_max_page_get(void);
+#endif
+
+	if (ident < 0 || ident >= VM_MAX_MEMSEGS)
+		return (EINVAL);
+
+	if (len == 0 || (len & PAGE_MASK))
+		return (EINVAL);
+
+#ifndef __FreeBSD__
+	if (len > ptob(get_max_page_get()))
+		return (EINVAL);
+#endif
+
+	seg = &vm->mem_segs[ident];
+	if (seg->object != NULL) {
+		if (seg->len == len && seg->sysmem == sysmem)
+			return (EEXIST);
+		else
+			return (EINVAL);
+	}
+
+	obj = vm_object_allocate(OBJT_DEFAULT, len >> PAGE_SHIFT);
+	if (obj == NULL)
+		return (ENOMEM);
+
+	seg->len = len;
+	seg->object = obj;
+	seg->sysmem = sysmem;
+	return (0);
+}
+
+int
+vm_get_memseg(struct vm *vm, int ident, size_t *len, bool *sysmem,
+    vm_object_t *objptr)
+{
+	struct mem_seg *seg;
+
+	if (ident < 0 || ident >= VM_MAX_MEMSEGS)
+		return (EINVAL);
+
+	seg = &vm->mem_segs[ident];
+	if (len)
+		*len = seg->len;
+	if (sysmem)
+		*sysmem = seg->sysmem;
+	if (objptr)
+		*objptr = seg->object;
+	return (0);
+}
+
+void
+vm_free_memseg(struct vm *vm, int ident)
+{
+	struct mem_seg *seg;
+
+	KASSERT(ident >= 0 && ident < VM_MAX_MEMSEGS,
+	    ("%s: invalid memseg ident %d", __func__, ident));
+
+	seg = &vm->mem_segs[ident];
+	if (seg->object != NULL) {
+		vm_object_deallocate(seg->object);
+		bzero(seg, sizeof(struct mem_seg));
+	}
+}
+
+int
+vm_mmap_memseg(struct vm *vm, vm_paddr_t gpa, int segid, vm_ooffset_t first,
+    size_t len, int prot, int flags)
+{
+	struct mem_seg *seg;
+	struct mem_map *m, *map;
+	vm_ooffset_t last;
+	int i, error;
+
+	if (prot == 0 || (prot & ~(VM_PROT_ALL)) != 0)
+		return (EINVAL);
+
+	if (flags & ~VM_MEMMAP_F_WIRED)
+		return (EINVAL);
+
+	if (segid < 0 || segid >= VM_MAX_MEMSEGS)
+		return (EINVAL);
+
+	seg = &vm->mem_segs[segid];
+	if (seg->object == NULL)
+		return (EINVAL);
+
+	last = first + len;
+	if (first < 0 || first >= last || last > seg->len)
+		return (EINVAL);
+
+	if ((gpa | first | last) & PAGE_MASK)
+		return (EINVAL);
+
+	map = NULL;
+	for (i = 0; i < VM_MAX_MEMMAPS; i++) {
+		m = &vm->mem_maps[i];
+		if (m->len == 0) {
+			map = m;
+			break;
+		}
+	}
+
+	if (map == NULL)
+		return (ENOSPC);
+
+	error = vm_map_find(&vm->vmspace->vm_map, seg->object, first, &gpa,
+	    len, 0, VMFS_NO_SPACE, prot, prot, 0);
+	if (error != KERN_SUCCESS)
+		return (EFAULT);
+
+	vm_object_reference(seg->object);
+
+	if ((flags & VM_MEMMAP_F_WIRED) != 0) {
+		error = vm_map_wire(&vm->vmspace->vm_map, gpa, gpa + len,
+		    VM_MAP_WIRE_USER | VM_MAP_WIRE_NOHOLES);
+		if (error != KERN_SUCCESS) {
+			vm_map_remove(&vm->vmspace->vm_map, gpa, gpa + len);
+			return (EFAULT);
+		}
+	}
+
+	map->gpa = gpa;
+	map->len = len;
+	map->segoff = first;
+	map->segid = segid;
+	map->prot = prot;
+	map->flags = flags;
+	return (0);
+}
+
+int
+vm_mmap_getnext(struct vm *vm, vm_paddr_t *gpa, int *segid,
+    vm_ooffset_t *segoff, size_t *len, int *prot, int *flags)
+{
+	struct mem_map *mm, *mmnext;
+	int i;
+
+	mmnext = NULL;
+	for (i = 0; i < VM_MAX_MEMMAPS; i++) {
+		mm = &vm->mem_maps[i];
+		if (mm->len == 0 || mm->gpa < *gpa)
+			continue;
+		if (mmnext == NULL || mm->gpa < mmnext->gpa)
+			mmnext = mm;
+	}
+
+	if (mmnext != NULL) {
+		*gpa = mmnext->gpa;
+		if (segid)
+			*segid = mmnext->segid;
+		if (segoff)
+			*segoff = mmnext->segoff;
+		if (len)
+			*len = mmnext->len;
+		if (prot)
+			*prot = mmnext->prot;
+		if (flags)
+			*flags = mmnext->flags;
+		return (0);
+	} else {
+		return (ENOENT);
+	}
+}
+
+static void
+vm_free_memmap(struct vm *vm, int ident)
+{
+	struct mem_map *mm;
+	int error;
+
+	mm = &vm->mem_maps[ident];
+	if (mm->len) {
+		error = vm_map_remove(&vm->vmspace->vm_map, mm->gpa,
+		    mm->gpa + mm->len);
+		KASSERT(error == KERN_SUCCESS, ("%s: vm_map_remove error %d",
+		    __func__, error));
+		bzero(mm, sizeof(struct mem_map));
+	}
+}
+
+static __inline bool
+sysmem_mapping(struct vm *vm, struct mem_map *mm)
+{
+
+	if (mm->len != 0 && vm->mem_segs[mm->segid].sysmem)
+		return (true);
+	else
+		return (false);
+}
+
+static vm_paddr_t
+sysmem_maxaddr(struct vm *vm)
+{
+	struct mem_map *mm;
+	vm_paddr_t maxaddr;
+	int i;
+
+	maxaddr = 0;
+	for (i = 0; i < VM_MAX_MEMMAPS; i++) {
+		mm = &vm->mem_maps[i];
+		if (sysmem_mapping(vm, mm)) {
+			if (maxaddr < mm->gpa + mm->len)
+				maxaddr = mm->gpa + mm->len;
+		}
+	}
+	return (maxaddr);
+}
+
+static void
+vm_iommu_modify(struct vm *vm, boolean_t map)
+{
+	int i, sz;
+	vm_paddr_t gpa, hpa;
+	struct mem_map *mm;
+	void *vp, *cookie, *host_domain;
+
+	sz = PAGE_SIZE;
+	host_domain = iommu_host_domain();
+
+	for (i = 0; i < VM_MAX_MEMMAPS; i++) {
+		mm = &vm->mem_maps[i];
+		if (!sysmem_mapping(vm, mm))
+			continue;
+
+		if (map) {
+			KASSERT((mm->flags & VM_MEMMAP_F_IOMMU) == 0,
+			    ("iommu map found invalid memmap %#lx/%#lx/%#x",
+			    mm->gpa, mm->len, mm->flags));
+			if ((mm->flags & VM_MEMMAP_F_WIRED) == 0)
+				continue;
+			mm->flags |= VM_MEMMAP_F_IOMMU;
+		} else {
+			if ((mm->flags & VM_MEMMAP_F_IOMMU) == 0)
+				continue;
+			mm->flags &= ~VM_MEMMAP_F_IOMMU;
+			KASSERT((mm->flags & VM_MEMMAP_F_WIRED) != 0,
+			    ("iommu unmap found invalid memmap %#lx/%#lx/%#x",
+			    mm->gpa, mm->len, mm->flags));
+		}
+
+		gpa = mm->gpa;
+		while (gpa < mm->gpa + mm->len) {
+			vp = vm_gpa_hold(vm, -1, gpa, PAGE_SIZE, VM_PROT_WRITE,
+					 &cookie);
+			KASSERT(vp != NULL, ("vm(%s) could not map gpa %#lx",
+			    vm_name(vm), gpa));
+
+			vm_gpa_release(cookie);
+
+			hpa = DMAP_TO_PHYS((uintptr_t)vp);
+			if (map) {
+				iommu_create_mapping(vm->iommu, gpa, hpa, sz);
+#ifdef __FreeBSD__
+				iommu_remove_mapping(host_domain, hpa, sz);
+#endif
+			} else {
+				iommu_remove_mapping(vm->iommu, gpa, sz);
+#ifdef __FreeBSD__
+				iommu_create_mapping(host_domain, hpa, hpa, sz);
+#endif
+			}
+
+			gpa += PAGE_SIZE;
+		}
+	}
+
+	/*
+	 * Invalidate the cached translations associated with the domain
+	 * from which pages were removed.
+	 */
+#ifdef __FreeBSD__
+	if (map)
+		iommu_invalidate_tlb(host_domain);
+	else
+		iommu_invalidate_tlb(vm->iommu);
+#else
+	iommu_invalidate_tlb(vm->iommu);
+#endif
+}
+
+#define	vm_iommu_unmap(vm)	vm_iommu_modify((vm), FALSE)
+#define	vm_iommu_map(vm)	vm_iommu_modify((vm), TRUE)
+
+#ifdef __FreeBSD__
+int
+vm_unassign_pptdev(struct vm *vm, int bus, int slot, int func)
+#else
+int
+vm_unassign_pptdev(struct vm *vm, int pptfd)
+#endif /* __FreeBSD__ */
+{
+	int error;
+
+#ifdef __FreeBSD__
+	error = ppt_unassign_device(vm, bus, slot, func);
+#else
+	error = ppt_unassign_device(vm, pptfd);
+#endif /* __FreeBSD__ */
+	if (error)
+		return (error);
+
+	if (ppt_assigned_devices(vm) == 0)
+		vm_iommu_unmap(vm);
+
+	return (0);
+}
+
+#ifdef __FreeBSD__
+int
+vm_assign_pptdev(struct vm *vm, int bus, int slot, int func)
+#else
+int
+vm_assign_pptdev(struct vm *vm, int pptfd)
+#endif /* __FreeBSD__ */
+{
+	int error;
+	vm_paddr_t maxaddr;
+
+	/* Set up the IOMMU to do the 'gpa' to 'hpa' translation */
+	if (ppt_assigned_devices(vm) == 0) {
+		KASSERT(vm->iommu == NULL,
+		    ("vm_assign_pptdev: iommu must be NULL"));
+		maxaddr = sysmem_maxaddr(vm);
+		vm->iommu = iommu_create_domain(maxaddr);
+		if (vm->iommu == NULL)
+			return (ENXIO);
+		vm_iommu_map(vm);
+	}
+
+#ifdef __FreeBSD__
+	error = ppt_assign_device(vm, bus, slot, func);
+#else
+	error = ppt_assign_device(vm, pptfd);
+#endif /* __FreeBSD__ */
+	return (error);
+}
+
+void *
+vm_gpa_hold(struct vm *vm, int vcpuid, vm_paddr_t gpa, size_t len, int reqprot,
+	    void **cookie)
+{
+	int i, count, pageoff;
+	struct mem_map *mm;
+	vm_page_t m;
+#ifdef INVARIANTS
+	/*
+	 * All vcpus are frozen by ioctls that modify the memory map
+	 * (e.g. VM_MMAP_MEMSEG). Therefore 'vm->memmap[]' stability is
+	 * guaranteed if at least one vcpu is in the VCPU_FROZEN state.
+	 */
+	int state;
+	KASSERT(vcpuid >= -1 && vcpuid < VM_MAXCPU, ("%s: invalid vcpuid %d",
+	    __func__, vcpuid));
+	for (i = 0; i < VM_MAXCPU; i++) {
+		if (vcpuid != -1 && vcpuid != i)
+			continue;
+		state = vcpu_get_state(vm, i, NULL);
+		KASSERT(state == VCPU_FROZEN, ("%s: invalid vcpu state %d",
+		    __func__, state));
+	}
+#endif
+	pageoff = gpa & PAGE_MASK;
+	if (len > PAGE_SIZE - pageoff)
+		panic("vm_gpa_hold: invalid gpa/len: 0x%016lx/%lu", gpa, len);
+
+	count = 0;
+	for (i = 0; i < VM_MAX_MEMMAPS; i++) {
+		mm = &vm->mem_maps[i];
+		if (sysmem_mapping(vm, mm) && gpa >= mm->gpa &&
+		    gpa < mm->gpa + mm->len) {
+			count = vm_fault_quick_hold_pages(&vm->vmspace->vm_map,
+			    trunc_page(gpa), PAGE_SIZE, reqprot, &m, 1);
+			break;
+		}
+	}
+
+	if (count == 1) {
+		*cookie = m;
+		return ((void *)(PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m)) + pageoff));
+	} else {
+		*cookie = NULL;
+		return (NULL);
+	}
+}
+
+void
+vm_gpa_release(void *cookie)
+{
+	vm_page_t m = cookie;
+
+	vm_page_lock(m);
+	vm_page_unhold(m);
+	vm_page_unlock(m);
+}
+
+int
+vm_get_register(struct vm *vm, int vcpu, int reg, uint64_t *retval)
+{
+
+	if (vcpu < 0 || vcpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (reg >= VM_REG_LAST)
+		return (EINVAL);
+
+	return (VMGETREG(vm->cookie, vcpu, reg, retval));
+}
+
+int
+vm_set_register(struct vm *vm, int vcpuid, int reg, uint64_t val)
+{
+	struct vcpu *vcpu;
+	int error;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (reg >= VM_REG_LAST)
+		return (EINVAL);
+
+	error = VMSETREG(vm->cookie, vcpuid, reg, val);
+	if (error || reg != VM_REG_GUEST_RIP)
+		return (error);
+
+	/* Set 'nextrip' to match the value of %rip */
+	VCPU_CTR1(vm, vcpuid, "Setting nextrip to %#lx", val);
+	vcpu = &vm->vcpu[vcpuid];
+	vcpu->nextrip = val;
+	return (0);
+}
+
+static boolean_t
+is_descriptor_table(int reg)
+{
+
+	switch (reg) {
+	case VM_REG_GUEST_IDTR:
+	case VM_REG_GUEST_GDTR:
+		return (TRUE);
+	default:
+		return (FALSE);
+	}
+}
+
+static boolean_t
+is_segment_register(int reg)
+{
+	
+	switch (reg) {
+	case VM_REG_GUEST_ES:
+	case VM_REG_GUEST_CS:
+	case VM_REG_GUEST_SS:
+	case VM_REG_GUEST_DS:
+	case VM_REG_GUEST_FS:
+	case VM_REG_GUEST_GS:
+	case VM_REG_GUEST_TR:
+	case VM_REG_GUEST_LDTR:
+		return (TRUE);
+	default:
+		return (FALSE);
+	}
+}
+
+int
+vm_get_seg_desc(struct vm *vm, int vcpu, int reg,
+		struct seg_desc *desc)
+{
+
+	if (vcpu < 0 || vcpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (!is_segment_register(reg) && !is_descriptor_table(reg))
+		return (EINVAL);
+
+	return (VMGETDESC(vm->cookie, vcpu, reg, desc));
+}
+
+int
+vm_set_seg_desc(struct vm *vm, int vcpu, int reg,
+		struct seg_desc *desc)
+{
+	if (vcpu < 0 || vcpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (!is_segment_register(reg) && !is_descriptor_table(reg))
+		return (EINVAL);
+
+	return (VMSETDESC(vm->cookie, vcpu, reg, desc));
+}
+
+static void
+restore_guest_fpustate(struct vcpu *vcpu)
+{
+
+	/* flush host state to the pcb */
+	fpuexit(curthread);
+
+	/* restore guest FPU state */
+	fpu_stop_emulating();
+	fpurestore(vcpu->guestfpu);
+
+	/* restore guest XCR0 if XSAVE is enabled in the host */
+	if (rcr4() & CR4_XSAVE)
+		load_xcr(0, vcpu->guest_xcr0);
+
+	/*
+	 * The FPU is now "dirty" with the guest's state so turn on emulation
+	 * to trap any access to the FPU by the host.
+	 */
+	fpu_start_emulating();
+}
+
+static void
+save_guest_fpustate(struct vcpu *vcpu)
+{
+
+	if ((rcr0() & CR0_TS) == 0)
+		panic("fpu emulation not enabled in host!");
+
+	/* save guest XCR0 and restore host XCR0 */
+	if (rcr4() & CR4_XSAVE) {
+		vcpu->guest_xcr0 = rxcr(0);
+		load_xcr(0, vmm_get_host_xcr0());
+	}
+
+	/* save guest FPU state */
+	fpu_stop_emulating();
+	fpusave(vcpu->guestfpu);
+#ifdef __FreeBSD__
+	fpu_start_emulating();
+#else
+	/*
+	 * When the host state has been restored, we should not re-enable
+	 * CR0.TS on illumos for eager FPU.
+	 */
+#endif
+}
+
+static VMM_STAT(VCPU_IDLE_TICKS, "number of ticks vcpu was idle");
+
+static int
+vcpu_set_state_locked(struct vm *vm, int vcpuid, enum vcpu_state newstate,
+    bool from_idle)
+{
+	struct vcpu *vcpu;
+	int error;
+
+	vcpu = &vm->vcpu[vcpuid];
+	vcpu_assert_locked(vcpu);
+
+	/*
+	 * State transitions from the vmmdev_ioctl() must always begin from
+	 * the VCPU_IDLE state. This guarantees that there is only a single
+	 * ioctl() operating on a vcpu at any point.
+	 */
+	if (from_idle) {
+		while (vcpu->state != VCPU_IDLE) {
+			vcpu->reqidle = 1;
+			vcpu_notify_event_locked(vcpu, false);
+			VCPU_CTR1(vm, vcpuid, "vcpu state change from %s to "
+			    "idle requested", vcpu_state2str(vcpu->state));
+#ifdef __FreeBSD__
+			msleep_spin(&vcpu->state, &vcpu->mtx, "vmstat", hz);
+#else
+			cv_wait(&vcpu->state_cv, &vcpu->mtx.m);
+#endif
+		}
+	} else {
+		KASSERT(vcpu->state != VCPU_IDLE, ("invalid transition from "
+		    "vcpu idle state"));
+	}
+
+	if (vcpu->state == VCPU_RUNNING) {
+		KASSERT(vcpu->hostcpu == curcpu, ("curcpu %d and hostcpu %d "
+		    "mismatch for running vcpu", curcpu, vcpu->hostcpu));
+	} else {
+		KASSERT(vcpu->hostcpu == NOCPU, ("Invalid hostcpu %d for a "
+		    "vcpu that is not running", vcpu->hostcpu));
+	}
+
+	/*
+	 * The following state transitions are allowed:
+	 * IDLE -> FROZEN -> IDLE
+	 * FROZEN -> RUNNING -> FROZEN
+	 * FROZEN -> SLEEPING -> FROZEN
+	 */
+	switch (vcpu->state) {
+	case VCPU_IDLE:
+	case VCPU_RUNNING:
+	case VCPU_SLEEPING:
+		error = (newstate != VCPU_FROZEN);
+		break;
+	case VCPU_FROZEN:
+		error = (newstate == VCPU_FROZEN);
+		break;
+	default:
+		error = 1;
+		break;
+	}
+
+	if (error)
+		return (EBUSY);
+
+	VCPU_CTR2(vm, vcpuid, "vcpu state changed from %s to %s",
+	    vcpu_state2str(vcpu->state), vcpu_state2str(newstate));
+
+	vcpu->state = newstate;
+	if (newstate == VCPU_RUNNING)
+		vcpu->hostcpu = curcpu;
+	else
+		vcpu->hostcpu = NOCPU;
+
+	if (newstate == VCPU_IDLE) {
+#ifdef __FreeBSD__
+		wakeup(&vcpu->state);
+#else
+		cv_broadcast(&vcpu->state_cv);
+#endif
+	}
+
+	return (0);
+}
+
+static void
+vcpu_require_state(struct vm *vm, int vcpuid, enum vcpu_state newstate)
+{
+	int error;
+
+	if ((error = vcpu_set_state(vm, vcpuid, newstate, false)) != 0)
+		panic("Error %d setting state to %d\n", error, newstate);
+}
+
+static void
+vcpu_require_state_locked(struct vm *vm, int vcpuid, enum vcpu_state newstate)
+{
+	int error;
+
+	if ((error = vcpu_set_state_locked(vm, vcpuid, newstate, false)) != 0)
+		panic("Error %d setting state to %d", error, newstate);
+}
+
+static void
+vm_set_rendezvous_func(struct vm *vm, vm_rendezvous_func_t func)
+{
+
+	KASSERT(mtx_owned(&vm->rendezvous_mtx), ("rendezvous_mtx not locked"));
+
+	/*
+	 * Update 'rendezvous_func' and execute a write memory barrier to
+	 * ensure that it is visible across all host cpus. This is not needed
+	 * for correctness but it does ensure that all the vcpus will notice
+	 * that the rendezvous is requested immediately.
+	 */
+	vm->rendezvous_func = func;
+#ifdef __FreeBSD__
+	wmb();
+#else
+	membar_producer();
+#endif
+}
+
+#define	RENDEZVOUS_CTR0(vm, vcpuid, fmt)				\
+	do {								\
+		if (vcpuid >= 0)					\
+			VCPU_CTR0(vm, vcpuid, fmt);			\
+		else							\
+			VM_CTR0(vm, fmt);				\
+	} while (0)
+
+static void
+vm_handle_rendezvous(struct vm *vm, int vcpuid)
+{
+
+	KASSERT(vcpuid == -1 || (vcpuid >= 0 && vcpuid < VM_MAXCPU),
+	    ("vm_handle_rendezvous: invalid vcpuid %d", vcpuid));
+
+	mtx_lock(&vm->rendezvous_mtx);
+	while (vm->rendezvous_func != NULL) {
+		/* 'rendezvous_req_cpus' must be a subset of 'active_cpus' */
+		CPU_AND(&vm->rendezvous_req_cpus, &vm->active_cpus);
+
+		if (vcpuid != -1 &&
+		    CPU_ISSET(vcpuid, &vm->rendezvous_req_cpus) &&
+		    !CPU_ISSET(vcpuid, &vm->rendezvous_done_cpus)) {
+			VCPU_CTR0(vm, vcpuid, "Calling rendezvous func");
+			(*vm->rendezvous_func)(vm, vcpuid, vm->rendezvous_arg);
+			CPU_SET(vcpuid, &vm->rendezvous_done_cpus);
+		}
+		if (CPU_CMP(&vm->rendezvous_req_cpus,
+		    &vm->rendezvous_done_cpus) == 0) {
+			VCPU_CTR0(vm, vcpuid, "Rendezvous completed");
+			vm_set_rendezvous_func(vm, NULL);
+#ifdef __FreeBSD__
+			wakeup(&vm->rendezvous_func);
+#else
+			cv_broadcast(&vm->rendezvous_cv);
+#endif
+			break;
+		}
+		RENDEZVOUS_CTR0(vm, vcpuid, "Wait for rendezvous completion");
+#ifdef __FreeBSD__
+		mtx_sleep(&vm->rendezvous_func, &vm->rendezvous_mtx, 0,
+		    "vmrndv", 0);
+#else
+		/*
+		 * A cv_wait() call should be adequate for this, but since the
+		 * bhyve process could be killed in the middle of an unfinished
+		 * vm_smp_rendezvous, rendering its completion impossible, a
+		 * timed wait is necessary.  When bailing out early from a
+		 * rendezvous, the instance may be left in a bizarre state, but
+		 * that is preferable to a thread stuck waiting in the kernel.
+		 */
+		if (cv_reltimedwait_sig(&vm->rendezvous_cv,
+		    &vm->rendezvous_mtx.m, hz, TR_CLOCK_TICK) <= 0) {
+			if ((curproc->p_flag & SEXITING) != 0) {
+				break;
+			}
+		}
+#endif
+	}
+	mtx_unlock(&vm->rendezvous_mtx);
+}
+
+/*
+ * Emulate a guest 'hlt' by sleeping until the vcpu is ready to run.
+ */
+static int
+vm_handle_hlt(struct vm *vm, int vcpuid, bool intr_disabled, bool *retu)
+{
+	struct vcpu *vcpu;
+	const char *wmesg;
+	int t, vcpu_halted, vm_halted;
+
+	KASSERT(!CPU_ISSET(vcpuid, &vm->halted_cpus), ("vcpu already halted"));
+
+	vcpu = &vm->vcpu[vcpuid];
+	vcpu_halted = 0;
+	vm_halted = 0;
+
+	vcpu_lock(vcpu);
+	while (1) {
+		/*
+		 * Do a final check for pending NMI or interrupts before
+		 * really putting this thread to sleep. Also check for
+		 * software events that would cause this vcpu to wakeup.
+		 *
+		 * These interrupts/events could have happened after the
+		 * vcpu returned from VMRUN() and before it acquired the
+		 * vcpu lock above.
+		 */
+		if (vm->rendezvous_func != NULL || vm->suspend || vcpu->reqidle)
+			break;
+		if (vm_nmi_pending(vm, vcpuid))
+			break;
+		if (!intr_disabled) {
+			if (vm_extint_pending(vm, vcpuid) ||
+			    vlapic_pending_intr(vcpu->vlapic, NULL)) {
+				break;
+			}
+		}
+
+		/* Don't go to sleep if the vcpu thread needs to yield */
+		if (vcpu_should_yield(vm, vcpuid))
+			break;
+
+		if (vcpu_debugged(vm, vcpuid))
+			break;
+
+		/*
+		 * Some Linux guests implement "halt" by having all vcpus
+		 * execute HLT with interrupts disabled. 'halted_cpus' keeps
+		 * track of the vcpus that have entered this state. When all
+		 * vcpus enter the halted state the virtual machine is halted.
+		 */
+		if (intr_disabled) {
+			wmesg = "vmhalt";
+			VCPU_CTR0(vm, vcpuid, "Halted");
+			if (!vcpu_halted && halt_detection_enabled) {
+				vcpu_halted = 1;
+				CPU_SET_ATOMIC(vcpuid, &vm->halted_cpus);
+			}
+			if (CPU_CMP(&vm->halted_cpus, &vm->active_cpus) == 0) {
+				vm_halted = 1;
+				break;
+			}
+		} else {
+			wmesg = "vmidle";
+		}
+
+		t = ticks;
+		vcpu_require_state_locked(vm, vcpuid, VCPU_SLEEPING);
+#ifdef __FreeBSD__
+		/*
+		 * XXX msleep_spin() cannot be interrupted by signals so
+		 * wake up periodically to check pending signals.
+		 */
+		msleep_spin(vcpu, &vcpu->mtx, wmesg, hz);
+#else
+		/*
+		 * Fortunately, cv_wait_sig can be interrupted by signals, so
+		 * there is no need to periodically wake up.
+		 */
+		(void) cv_wait_sig(&vcpu->vcpu_cv, &vcpu->mtx.m);
+#endif
+		vcpu_require_state_locked(vm, vcpuid, VCPU_FROZEN);
+		vmm_stat_incr(vm, vcpuid, VCPU_IDLE_TICKS, ticks - t);
+	}
+
+	if (vcpu_halted)
+		CPU_CLR_ATOMIC(vcpuid, &vm->halted_cpus);
+
+	vcpu_unlock(vcpu);
+
+	if (vm_halted)
+		vm_suspend(vm, VM_SUSPEND_HALT);
+
+	return (0);
+}
+
+static int
+vm_handle_paging(struct vm *vm, int vcpuid, bool *retu)
+{
+	int rv, ftype;
+	struct vm_map *map;
+	struct vcpu *vcpu;
+	struct vm_exit *vme;
+
+	vcpu = &vm->vcpu[vcpuid];
+	vme = &vcpu->exitinfo;
+
+	KASSERT(vme->inst_length == 0, ("%s: invalid inst_length %d",
+	    __func__, vme->inst_length));
+
+	ftype = vme->u.paging.fault_type;
+	KASSERT(ftype == VM_PROT_READ ||
+	    ftype == VM_PROT_WRITE || ftype == VM_PROT_EXECUTE,
+	    ("vm_handle_paging: invalid fault_type %d", ftype));
+
+	if (ftype == VM_PROT_READ || ftype == VM_PROT_WRITE) {
+		rv = pmap_emulate_accessed_dirty(vmspace_pmap(vm->vmspace),
+		    vme->u.paging.gpa, ftype);
+		if (rv == 0) {
+			VCPU_CTR2(vm, vcpuid, "%s bit emulation for gpa %#lx",
+			    ftype == VM_PROT_READ ? "accessed" : "dirty",
+			    vme->u.paging.gpa);
+			goto done;
+		}
+	}
+
+	map = &vm->vmspace->vm_map;
+	rv = vm_fault(map, vme->u.paging.gpa, ftype, VM_FAULT_NORMAL);
+
+	VCPU_CTR3(vm, vcpuid, "vm_handle_paging rv = %d, gpa = %#lx, "
+	    "ftype = %d", rv, vme->u.paging.gpa, ftype);
+
+	if (rv != KERN_SUCCESS)
+		return (EFAULT);
+done:
+	return (0);
+}
+
+static int
+vm_handle_inst_emul(struct vm *vm, int vcpuid, bool *retu)
+{
+	struct vie *vie;
+	struct vcpu *vcpu;
+	struct vm_exit *vme;
+	uint64_t gla, gpa, cs_base;
+	struct vm_guest_paging *paging;
+	mem_region_read_t mread;
+	mem_region_write_t mwrite;
+	enum vm_cpu_mode cpu_mode;
+	int cs_d, error, fault;
+
+	vcpu = &vm->vcpu[vcpuid];
+	vme = &vcpu->exitinfo;
+
+	KASSERT(vme->inst_length == 0, ("%s: invalid inst_length %d",
+	    __func__, vme->inst_length));
+
+	gla = vme->u.inst_emul.gla;
+	gpa = vme->u.inst_emul.gpa;
+	cs_base = vme->u.inst_emul.cs_base;
+	cs_d = vme->u.inst_emul.cs_d;
+	vie = &vme->u.inst_emul.vie;
+	paging = &vme->u.inst_emul.paging;
+	cpu_mode = paging->cpu_mode;
+
+	VCPU_CTR1(vm, vcpuid, "inst_emul fault accessing gpa %#lx", gpa);
+
+	/* Fetch, decode and emulate the faulting instruction */
+	if (vie->num_valid == 0) {
+		error = vmm_fetch_instruction(vm, vcpuid, paging, vme->rip +
+		    cs_base, VIE_INST_SIZE, vie, &fault);
+	} else {
+		/*
+		 * The instruction bytes have already been copied into 'vie'
+		 */
+		error = fault = 0;
+	}
+	if (error || fault)
+		return (error);
+
+	if (vmm_decode_instruction(vm, vcpuid, gla, cpu_mode, cs_d, vie) != 0) {
+		VCPU_CTR1(vm, vcpuid, "Error decoding instruction at %#lx",
+		    vme->rip + cs_base);
+		*retu = true;	    /* dump instruction bytes in userspace */
+		return (0);
+	}
+
+	/*
+	 * Update 'nextrip' based on the length of the emulated instruction.
+	 */
+	vme->inst_length = vie->num_processed;
+	vcpu->nextrip += vie->num_processed;
+	VCPU_CTR1(vm, vcpuid, "nextrip updated to %#lx after instruction "
+	    "decoding", vcpu->nextrip);
+ 
+	/* return to userland unless this is an in-kernel emulated device */
+	if (gpa >= DEFAULT_APIC_BASE && gpa < DEFAULT_APIC_BASE + PAGE_SIZE) {
+		mread = lapic_mmio_read;
+		mwrite = lapic_mmio_write;
+	} else if (gpa >= VIOAPIC_BASE && gpa < VIOAPIC_BASE + VIOAPIC_SIZE) {
+		mread = vioapic_mmio_read;
+		mwrite = vioapic_mmio_write;
+	} else if (gpa >= VHPET_BASE && gpa < VHPET_BASE + VHPET_SIZE) {
+		mread = vhpet_mmio_read;
+		mwrite = vhpet_mmio_write;
+	} else {
+		*retu = true;
+		return (0);
+	}
+
+	error = vmm_emulate_instruction(vm, vcpuid, gpa, vie, paging,
+	    mread, mwrite, retu);
+
+	return (error);
+}
+
+static int
+vm_handle_suspend(struct vm *vm, int vcpuid, bool *retu)
+{
+	int i, done;
+	struct vcpu *vcpu;
+
+	done = 0;
+	vcpu = &vm->vcpu[vcpuid];
+
+	CPU_SET_ATOMIC(vcpuid, &vm->suspended_cpus);
+
+	/*
+	 * Wait until all 'active_cpus' have suspended themselves.
+	 *
+	 * Since a VM may be suspended at any time including when one or
+	 * more vcpus are doing a rendezvous we need to call the rendezvous
+	 * handler while we are waiting to prevent a deadlock.
+	 */
+	vcpu_lock(vcpu);
+	while (1) {
+		if (CPU_CMP(&vm->suspended_cpus, &vm->active_cpus) == 0) {
+			VCPU_CTR0(vm, vcpuid, "All vcpus suspended");
+			break;
+		}
+
+		if (vm->rendezvous_func == NULL) {
+			VCPU_CTR0(vm, vcpuid, "Sleeping during suspend");
+			vcpu_require_state_locked(vm, vcpuid, VCPU_SLEEPING);
+#ifdef __FreeBSD__
+			msleep_spin(vcpu, &vcpu->mtx, "vmsusp", hz);
+#else
+			/*
+			 * Like vm_handle_rendezvous, vm_handle_suspend could
+			 * become stuck in the kernel if the bhyve process
+			 * driving its vCPUs is killed.  Offer a bail-out in
+			 * that case, even though not all the vCPUs have
+			 * reached the suspended state.
+			 */
+			if (cv_reltimedwait_sig(&vcpu->vcpu_cv, &vcpu->mtx.m,
+			    hz, TR_CLOCK_TICK) <= 0) {
+				if ((curproc->p_flag & SEXITING) != 0) {
+					vcpu_require_state_locked(vm, vcpuid,
+					    VCPU_FROZEN);
+					break;
+				}
+			}
+#endif
+			vcpu_require_state_locked(vm, vcpuid, VCPU_FROZEN);
+		} else {
+			VCPU_CTR0(vm, vcpuid, "Rendezvous during suspend");
+			vcpu_unlock(vcpu);
+			vm_handle_rendezvous(vm, vcpuid);
+			vcpu_lock(vcpu);
+		}
+	}
+	vcpu_unlock(vcpu);
+
+	/*
+	 * Wakeup the other sleeping vcpus and return to userspace.
+	 */
+	for (i = 0; i < VM_MAXCPU; i++) {
+		if (CPU_ISSET(i, &vm->suspended_cpus)) {
+			vcpu_notify_event(vm, i, false);
+		}
+	}
+
+	*retu = true;
+	return (0);
+}
+
+static int
+vm_handle_reqidle(struct vm *vm, int vcpuid, bool *retu)
+{
+	struct vcpu *vcpu = &vm->vcpu[vcpuid];
+
+	vcpu_lock(vcpu);
+	KASSERT(vcpu->reqidle, ("invalid vcpu reqidle %d", vcpu->reqidle));
+	vcpu->reqidle = 0;
+	vcpu_unlock(vcpu);
+	*retu = true;
+	return (0);
+}
+
+#ifndef __FreeBSD__
+static int
+vm_handle_wrmsr(struct vm *vm, int vcpuid, struct vm_exit *vme)
+{
+	struct vcpu *cpu = &vm->vcpu[vcpuid];
+	const uint32_t code = vme->u.msr.code;
+	const uint64_t val = vme->u.msr.wval;
+
+	switch (code) {
+	case MSR_TSC:
+		cpu->tsc_offset = val - rdtsc();
+		return (0);
+	}
+
+	return (-1);
+}
+#endif /* __FreeBSD__ */
+
+int
+vm_suspend(struct vm *vm, enum vm_suspend_how how)
+{
+	int i;
+
+	if (how <= VM_SUSPEND_NONE || how >= VM_SUSPEND_LAST)
+		return (EINVAL);
+
+	if (atomic_cmpset_int((uint_t *)&vm->suspend, 0, how) == 0) {
+		VM_CTR2(vm, "virtual machine already suspended %d/%d",
+		    vm->suspend, how);
+		return (EALREADY);
+	}
+
+	VM_CTR1(vm, "virtual machine successfully suspended %d", how);
+
+	/*
+	 * Notify all active vcpus that they are now suspended.
+	 */
+	for (i = 0; i < VM_MAXCPU; i++) {
+		if (CPU_ISSET(i, &vm->active_cpus))
+			vcpu_notify_event(vm, i, false);
+	}
+
+	return (0);
+}
+
+void
+vm_exit_suspended(struct vm *vm, int vcpuid, uint64_t rip)
+{
+	struct vm_exit *vmexit;
+
+	KASSERT(vm->suspend > VM_SUSPEND_NONE && vm->suspend < VM_SUSPEND_LAST,
+	    ("vm_exit_suspended: invalid suspend type %d", vm->suspend));
+
+	vmexit = vm_exitinfo(vm, vcpuid);
+	vmexit->rip = rip;
+	vmexit->inst_length = 0;
+	vmexit->exitcode = VM_EXITCODE_SUSPENDED;
+	vmexit->u.suspended.how = vm->suspend;
+}
+
+void
+vm_exit_debug(struct vm *vm, int vcpuid, uint64_t rip)
+{
+	struct vm_exit *vmexit;
+
+	vmexit = vm_exitinfo(vm, vcpuid);
+	vmexit->rip = rip;
+	vmexit->inst_length = 0;
+	vmexit->exitcode = VM_EXITCODE_DEBUG;
+}
+
+void
+vm_exit_rendezvous(struct vm *vm, int vcpuid, uint64_t rip)
+{
+	struct vm_exit *vmexit;
+
+	KASSERT(vm->rendezvous_func != NULL, ("rendezvous not in progress"));
+
+	vmexit = vm_exitinfo(vm, vcpuid);
+	vmexit->rip = rip;
+	vmexit->inst_length = 0;
+	vmexit->exitcode = VM_EXITCODE_RENDEZVOUS;
+	vmm_stat_incr(vm, vcpuid, VMEXIT_RENDEZVOUS, 1);
+}
+
+void
+vm_exit_reqidle(struct vm *vm, int vcpuid, uint64_t rip)
+{
+	struct vm_exit *vmexit;
+
+	vmexit = vm_exitinfo(vm, vcpuid);
+	vmexit->rip = rip;
+	vmexit->inst_length = 0;
+	vmexit->exitcode = VM_EXITCODE_REQIDLE;
+	vmm_stat_incr(vm, vcpuid, VMEXIT_REQIDLE, 1);
+}
+
+void
+vm_exit_astpending(struct vm *vm, int vcpuid, uint64_t rip)
+{
+	struct vm_exit *vmexit;
+
+	vmexit = vm_exitinfo(vm, vcpuid);
+	vmexit->rip = rip;
+	vmexit->inst_length = 0;
+	vmexit->exitcode = VM_EXITCODE_BOGUS;
+	vmm_stat_incr(vm, vcpuid, VMEXIT_ASTPENDING, 1);
+}
+
+#ifndef __FreeBSD__
+/*
+ * Some vmm resources, such as the lapic, may have CPU-specific resources
+ * allocated to them which would benefit from migration onto the host CPU which
+ * is processing the vcpu state.
+ */
+static void
+vm_localize_resources(struct vm *vm, struct vcpu *vcpu)
+{
+	/*
+	 * Localizing cyclic resources requires acquisition of cpu_lock, and
+	 * doing so with kpreempt disabled is a recipe for deadlock disaster.
+	 */
+	VERIFY(curthread->t_preempt == 0);
+
+	/*
+	 * Do not bother with localization if this vCPU is about to return to
+	 * the host CPU it was last localized to.
+	 */
+	if (vcpu->lastloccpu == curcpu)
+		return;
+
+	/*
+	 * Localize system-wide resources to the primary boot vCPU.  While any
+	 * of the other vCPUs may access them, it keeps the potential interrupt
+	 * footprint constrained to CPUs involved with this instance.
+	 */
+	if (vcpu == &vm->vcpu[0]) {
+		vhpet_localize_resources(vm->vhpet);
+		vrtc_localize_resources(vm->vrtc);
+		vatpit_localize_resources(vm->vatpit);
+	}
+
+	vlapic_localize_resources(vcpu->vlapic);
+
+	vcpu->lastloccpu = curcpu;
+}
+
+static void
+vmm_savectx(void *arg)
+{
+	vm_thread_ctx_t *vtc = arg;
+	struct vm *vm = vtc->vtc_vm;
+	const int vcpuid = vtc->vtc_vcpuid;
+
+	if (ops->vmsavectx != NULL) {
+		ops->vmsavectx(vm->cookie, vcpuid);
+	}
+
+	/*
+	 * If the CPU holds the restored guest FPU state, save it and restore
+	 * the host FPU state before this thread goes off-cpu.
+	 */
+	if ((vtc->vtc_status & VTCS_FPU_RESTORED) != 0) {
+		struct vcpu *vcpu = &vm->vcpu[vcpuid];
+
+		save_guest_fpustate(vcpu);
+		vtc->vtc_status &= ~VTCS_FPU_RESTORED;
+	}
+}
+
+static void
+vmm_restorectx(void *arg)
+{
+	vm_thread_ctx_t *vtc = arg;
+	struct vm *vm = vtc->vtc_vm;
+	const int vcpuid = vtc->vtc_vcpuid;
+
+	/*
+	 * When coming back on-cpu, only restore the guest FPU status if the
+	 * thread is in a context marked as requiring it.  This should be rare,
+	 * occurring only when a future logic error results in a voluntary
+	 * sleep during the VMRUN critical section.
+	 *
+	 * The common case will result in elision of the guest FPU state
+	 * restoration, deferring that action until it is clearly necessary
+	 * during vm_run.
+	 */
+	VERIFY((vtc->vtc_status & VTCS_FPU_RESTORED) == 0);
+	if ((vtc->vtc_status & VTCS_FPU_CTX_CRITICAL) != 0) {
+		struct vcpu *vcpu = &vm->vcpu[vcpuid];
+
+		restore_guest_fpustate(vcpu);
+		vtc->vtc_status |= VTCS_FPU_RESTORED;
+	}
+
+	if (ops->vmrestorectx != NULL) {
+		ops->vmrestorectx(vm->cookie, vcpuid);
+	}
+
+}
+
+/*
+ * If we're in removectx(), we might still have state to tidy up.
+ */
+static void
+vmm_freectx(void *arg, int isexec)
+{
+	vmm_savectx(arg);
+}
+
+#endif /* __FreeBSD */
+
+int
+vm_run(struct vm *vm, struct vm_run *vmrun)
+{
+	struct vm_eventinfo evinfo;
+	int error, vcpuid;
+	struct vcpu *vcpu;
+#ifdef	__FreeBSD__
+	struct pcb *pcb;
+#endif
+	uint64_t tscval;
+	struct vm_exit *vme;
+	bool retu, intr_disabled;
+	pmap_t pmap;
+#ifndef	__FreeBSD__
+	vm_thread_ctx_t vtc;
+	int affinity_type = CPU_CURRENT;
+#endif
+
+	vcpuid = vmrun->cpuid;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (!CPU_ISSET(vcpuid, &vm->active_cpus))
+		return (EINVAL);
+
+	if (CPU_ISSET(vcpuid, &vm->suspended_cpus))
+		return (EINVAL);
+
+	pmap = vmspace_pmap(vm->vmspace);
+	vcpu = &vm->vcpu[vcpuid];
+	vme = &vcpu->exitinfo;
+	evinfo.rptr = &vm->rendezvous_func;
+	evinfo.sptr = &vm->suspend;
+	evinfo.iptr = &vcpu->reqidle;
+
+#ifndef	__FreeBSD__
+	vtc.vtc_vm = vm;
+	vtc.vtc_vcpuid = vcpuid;
+	vtc.vtc_status = 0;
+
+	installctx(curthread, &vtc, vmm_savectx, vmm_restorectx, NULL, NULL,
+	    NULL, vmm_freectx);
+#endif
+
+restart:
+#ifndef	__FreeBSD__
+	thread_affinity_set(curthread, affinity_type);
+	/*
+	 * Resource localization should happen after the CPU affinity for the
+	 * thread has been set to ensure that access from restricted contexts,
+	 * such as VMX-accelerated APIC operations, can occur without inducing
+	 * cyclic cross-calls.
+	 *
+	 * This must be done prior to disabling kpreempt via critical_enter().
+	 */
+	vm_localize_resources(vm, vcpu);
+
+	affinity_type = CPU_CURRENT;
+#endif
+
+	critical_enter();
+
+	KASSERT(!CPU_ISSET(curcpu, &pmap->pm_active),
+	    ("vm_run: absurd pm_active"));
+
+	tscval = rdtsc();
+
+#ifdef	__FreeBSD__
+	pcb = PCPU_GET(curpcb);
+	set_pcb_flags(pcb, PCB_FULL_IRET);
+#else
+	/* Force a trip through update_sregs to reload %fs/%gs and friends */
+	PCB_SET_UPDATE_SEGS(&ttolwp(curthread)->lwp_pcb);
+#endif
+
+#ifdef	__FreeBSD__
+	restore_guest_fpustate(vcpu);
+#else
+	if ((vtc.vtc_status & VTCS_FPU_RESTORED) == 0) {
+		restore_guest_fpustate(vcpu);
+		vtc.vtc_status |= VTCS_FPU_RESTORED;
+	}
+	vtc.vtc_status |= VTCS_FPU_CTX_CRITICAL;
+#endif
+
+	vcpu_require_state(vm, vcpuid, VCPU_RUNNING);
+	error = VMRUN(vm->cookie, vcpuid, vcpu->nextrip, pmap, &evinfo);
+	vcpu_require_state(vm, vcpuid, VCPU_FROZEN);
+
+#ifdef	__FreeBSD__
+	save_guest_fpustate(vcpu);
+#else
+	vtc.vtc_status &= ~VTCS_FPU_CTX_CRITICAL;
+#endif
+
+#ifndef	__FreeBSD__
+	/*
+	 * Once clear of the delicate contexts comprising the VM_RUN handler,
+	 * thread CPU affinity can be loosened while other processing occurs.
+	 */
+	thread_affinity_clear(curthread);
+#endif
+
+	vmm_stat_incr(vm, vcpuid, VCPU_TOTAL_RUNTIME, rdtsc() - tscval);
+
+	critical_exit();
+
+	if (error == 0) {
+		retu = false;
+		vcpu->nextrip = vme->rip + vme->inst_length;
+		switch (vme->exitcode) {
+		case VM_EXITCODE_REQIDLE:
+			error = vm_handle_reqidle(vm, vcpuid, &retu);
+			break;
+		case VM_EXITCODE_SUSPENDED:
+			error = vm_handle_suspend(vm, vcpuid, &retu);
+			break;
+		case VM_EXITCODE_IOAPIC_EOI:
+			vioapic_process_eoi(vm, vcpuid,
+			    vme->u.ioapic_eoi.vector);
+			break;
+		case VM_EXITCODE_RENDEZVOUS:
+			vm_handle_rendezvous(vm, vcpuid);
+			error = 0;
+			break;
+		case VM_EXITCODE_HLT:
+			intr_disabled = ((vme->u.hlt.rflags & PSL_I) == 0);
+			error = vm_handle_hlt(vm, vcpuid, intr_disabled, &retu);
+			break;
+		case VM_EXITCODE_PAGING:
+			error = vm_handle_paging(vm, vcpuid, &retu);
+			break;
+		case VM_EXITCODE_INST_EMUL:
+			error = vm_handle_inst_emul(vm, vcpuid, &retu);
+			break;
+		case VM_EXITCODE_INOUT:
+		case VM_EXITCODE_INOUT_STR:
+			error = vm_handle_inout(vm, vcpuid, vme, &retu);
+			break;
+		case VM_EXITCODE_MONITOR:
+		case VM_EXITCODE_MWAIT:
+			vm_inject_ud(vm, vcpuid);
+			break;
+#ifndef __FreeBSD__
+		case VM_EXITCODE_WRMSR:
+			if (vm_handle_wrmsr(vm, vcpuid, vme) != 0) {
+				retu = true;
+			}
+			break;
+
+		case VM_EXITCODE_HT: {
+			affinity_type = CPU_BEST;
+			break;
+		}
+
+#endif
+		default:
+			retu = true;	/* handled in userland */
+			break;
+		}
+	}
+
+	if (error == 0 && retu == false)
+		goto restart;
+
+#ifndef	__FreeBSD__
+	removectx(curthread, &vtc, vmm_savectx, vmm_restorectx, NULL, NULL,
+	    NULL, vmm_freectx);
+#endif
+
+	VCPU_CTR2(vm, vcpuid, "retu %d/%d", error, vme->exitcode);
+
+	/* copy the exit information */
+	bcopy(vme, &vmrun->vm_exit, sizeof (struct vm_exit));
+	return (error);
+}
+
+int
+vm_restart_instruction(void *arg, int vcpuid)
+{
+	struct vm *vm;
+	struct vcpu *vcpu;
+	enum vcpu_state state;
+	uint64_t rip;
+	int error;
+
+	vm = arg;
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	vcpu = &vm->vcpu[vcpuid];
+	state = vcpu_get_state(vm, vcpuid, NULL);
+	if (state == VCPU_RUNNING) {
+		/*
+		 * When a vcpu is "running" the next instruction is determined
+		 * by adding 'rip' and 'inst_length' in the vcpu's 'exitinfo'.
+		 * Thus setting 'inst_length' to zero will cause the current
+		 * instruction to be restarted.
+		 */
+		vcpu->exitinfo.inst_length = 0;
+		VCPU_CTR1(vm, vcpuid, "restarting instruction at %#lx by "
+		    "setting inst_length to zero", vcpu->exitinfo.rip);
+	} else if (state == VCPU_FROZEN) {
+		/*
+		 * When a vcpu is "frozen" it is outside the critical section
+		 * around VMRUN() and 'nextrip' points to the next instruction.
+		 * Thus instruction restart is achieved by setting 'nextrip'
+		 * to the vcpu's %rip.
+		 */
+		error = vm_get_register(vm, vcpuid, VM_REG_GUEST_RIP, &rip);
+		KASSERT(!error, ("%s: error %d getting rip", __func__, error));
+		VCPU_CTR2(vm, vcpuid, "restarting instruction by updating "
+		    "nextrip from %#lx to %#lx", vcpu->nextrip, rip);
+		vcpu->nextrip = rip;
+	} else {
+		panic("%s: invalid state %d", __func__, state);
+	}
+	return (0);
+}
+
+int
+vm_exit_intinfo(struct vm *vm, int vcpuid, uint64_t info)
+{
+	struct vcpu *vcpu;
+	int type, vector;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	if (info & VM_INTINFO_VALID) {
+		type = info & VM_INTINFO_TYPE;
+		vector = info & 0xff;
+		if (type == VM_INTINFO_NMI && vector != IDT_NMI)
+			return (EINVAL);
+		if (type == VM_INTINFO_HWEXCEPTION && vector >= 32)
+			return (EINVAL);
+		if (info & VM_INTINFO_RSVD)
+			return (EINVAL);
+	} else {
+		info = 0;
+	}
+	VCPU_CTR2(vm, vcpuid, "%s: info1(%#lx)", __func__, info);
+	vcpu->exitintinfo = info;
+	return (0);
+}
+
+enum exc_class {
+	EXC_BENIGN,
+	EXC_CONTRIBUTORY,
+	EXC_PAGEFAULT
+};
+
+#define	IDT_VE	20	/* Virtualization Exception (Intel specific) */
+
+static enum exc_class
+exception_class(uint64_t info)
+{
+	int type, vector;
+
+#ifdef	__FreeBSD__
+	KASSERT(info & VM_INTINFO_VALID, ("intinfo must be valid: %#lx", info));
+#else
+	KASSERT(info & VM_INTINFO_VALID, ("intinfo must be valid: %lx", info));
+#endif
+	type = info & VM_INTINFO_TYPE;
+	vector = info & 0xff;
+
+	/* Table 6-4, "Interrupt and Exception Classes", Intel SDM, Vol 3 */
+	switch (type) {
+	case VM_INTINFO_HWINTR:
+	case VM_INTINFO_SWINTR:
+	case VM_INTINFO_NMI:
+		return (EXC_BENIGN);
+	default:
+		/*
+		 * Hardware exception.
+		 *
+		 * SVM and VT-x use identical type values to represent NMI,
+		 * hardware interrupt and software interrupt.
+		 *
+		 * SVM uses type '3' for all exceptions. VT-x uses type '3'
+		 * for exceptions except #BP and #OF. #BP and #OF use a type
+		 * value of '5' or '6'. Therefore we don't check for explicit
+		 * values of 'type' to classify 'intinfo' into a hardware
+		 * exception.
+		 */
+		break;
+	}
+
+	switch (vector) {
+	case IDT_PF:
+	case IDT_VE:
+		return (EXC_PAGEFAULT);
+	case IDT_DE:
+	case IDT_TS:
+	case IDT_NP:
+	case IDT_SS:
+	case IDT_GP:
+		return (EXC_CONTRIBUTORY);
+	default:
+		return (EXC_BENIGN);
+	}
+}
+
+static int
+nested_fault(struct vm *vm, int vcpuid, uint64_t info1, uint64_t info2,
+    uint64_t *retinfo)
+{
+	enum exc_class exc1, exc2;
+	int type1, vector1;
+
+#ifdef	__FreeBSD__
+	KASSERT(info1 & VM_INTINFO_VALID, ("info1 %#lx is not valid", info1));
+	KASSERT(info2 & VM_INTINFO_VALID, ("info2 %#lx is not valid", info2));
+#else
+	KASSERT(info1 & VM_INTINFO_VALID, ("info1 %lx is not valid", info1));
+	KASSERT(info2 & VM_INTINFO_VALID, ("info2 %lx is not valid", info2));
+#endif
+
+	/*
+	 * If an exception occurs while attempting to call the double-fault
+	 * handler the processor enters shutdown mode (aka triple fault).
+	 */
+	type1 = info1 & VM_INTINFO_TYPE;
+	vector1 = info1 & 0xff;
+	if (type1 == VM_INTINFO_HWEXCEPTION && vector1 == IDT_DF) {
+		VCPU_CTR2(vm, vcpuid, "triple fault: info1(%#lx), info2(%#lx)",
+		    info1, info2);
+		vm_suspend(vm, VM_SUSPEND_TRIPLEFAULT);
+		*retinfo = 0;
+		return (0);
+	}
+
+	/*
+	 * Table 6-5 "Conditions for Generating a Double Fault", Intel SDM, Vol3
+	 */
+	exc1 = exception_class(info1);
+	exc2 = exception_class(info2);
+	if ((exc1 == EXC_CONTRIBUTORY && exc2 == EXC_CONTRIBUTORY) ||
+	    (exc1 == EXC_PAGEFAULT && exc2 != EXC_BENIGN)) {
+		/* Convert nested fault into a double fault. */
+		*retinfo = IDT_DF;
+		*retinfo |= VM_INTINFO_VALID | VM_INTINFO_HWEXCEPTION;
+		*retinfo |= VM_INTINFO_DEL_ERRCODE;
+	} else {
+		/* Handle exceptions serially */
+		*retinfo = info2;
+	}
+	return (1);
+}
+
+static uint64_t
+vcpu_exception_intinfo(struct vcpu *vcpu)
+{
+	uint64_t info = 0;
+
+	if (vcpu->exception_pending) {
+		info = vcpu->exc_vector & 0xff;
+		info |= VM_INTINFO_VALID | VM_INTINFO_HWEXCEPTION;
+		if (vcpu->exc_errcode_valid) {
+			info |= VM_INTINFO_DEL_ERRCODE;
+			info |= (uint64_t)vcpu->exc_errcode << 32;
+		}
+	}
+	return (info);
+}
+
+int
+vm_entry_intinfo(struct vm *vm, int vcpuid, uint64_t *retinfo)
+{
+	struct vcpu *vcpu;
+	uint64_t info1, info2;
+	int valid;
+
+	KASSERT(vcpuid >= 0 && vcpuid < VM_MAXCPU, ("invalid vcpu %d", vcpuid));
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	info1 = vcpu->exitintinfo;
+	vcpu->exitintinfo = 0;
+
+	info2 = 0;
+	if (vcpu->exception_pending) {
+		info2 = vcpu_exception_intinfo(vcpu);
+		vcpu->exception_pending = 0;
+		VCPU_CTR2(vm, vcpuid, "Exception %d delivered: %#lx",
+		    vcpu->exc_vector, info2);
+	}
+
+	if ((info1 & VM_INTINFO_VALID) && (info2 & VM_INTINFO_VALID)) {
+		valid = nested_fault(vm, vcpuid, info1, info2, retinfo);
+	} else if (info1 & VM_INTINFO_VALID) {
+		*retinfo = info1;
+		valid = 1;
+	} else if (info2 & VM_INTINFO_VALID) {
+		*retinfo = info2;
+		valid = 1;
+	} else {
+		valid = 0;
+	}
+
+	if (valid) {
+		VCPU_CTR4(vm, vcpuid, "%s: info1(%#lx), info2(%#lx), "
+		    "retinfo(%#lx)", __func__, info1, info2, *retinfo);
+	}
+
+	return (valid);
+}
+
+int
+vm_get_intinfo(struct vm *vm, int vcpuid, uint64_t *info1, uint64_t *info2)
+{
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	vcpu = &vm->vcpu[vcpuid];
+	*info1 = vcpu->exitintinfo;
+	*info2 = vcpu_exception_intinfo(vcpu);
+	return (0);
+}
+
+int
+vm_inject_exception(struct vm *vm, int vcpuid, int vector, int errcode_valid,
+    uint32_t errcode, int restart_instruction)
+{
+	struct vcpu *vcpu;
+	uint64_t regval;
+	int error;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (vector < 0 || vector >= 32)
+		return (EINVAL);
+
+	/*
+	 * A double fault exception should never be injected directly into
+	 * the guest. It is a derived exception that results from specific
+	 * combinations of nested faults.
+	 */
+	if (vector == IDT_DF)
+		return (EINVAL);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	if (vcpu->exception_pending) {
+		VCPU_CTR2(vm, vcpuid, "Unable to inject exception %d due to "
+		    "pending exception %d", vector, vcpu->exc_vector);
+		return (EBUSY);
+	}
+
+	if (errcode_valid) {
+		/*
+		 * Exceptions don't deliver an error code in real mode.
+		 */
+		error = vm_get_register(vm, vcpuid, VM_REG_GUEST_CR0, &regval);
+		KASSERT(!error, ("%s: error %d getting CR0", __func__, error));
+		if (!(regval & CR0_PE))
+			errcode_valid = 0;
+	}
+
+	/*
+	 * From section 26.6.1 "Interruptibility State" in Intel SDM:
+	 *
+	 * Event blocking by "STI" or "MOV SS" is cleared after guest executes
+	 * one instruction or incurs an exception.
+	 */
+	error = vm_set_register(vm, vcpuid, VM_REG_GUEST_INTR_SHADOW, 0);
+	KASSERT(error == 0, ("%s: error %d clearing interrupt shadow",
+	    __func__, error));
+
+	if (restart_instruction)
+		vm_restart_instruction(vm, vcpuid);
+
+	vcpu->exception_pending = 1;
+	vcpu->exc_vector = vector;
+	vcpu->exc_errcode = errcode;
+	vcpu->exc_errcode_valid = errcode_valid;
+	VCPU_CTR1(vm, vcpuid, "Exception %d pending", vector);
+	return (0);
+}
+
+void
+vm_inject_fault(void *vmarg, int vcpuid, int vector, int errcode_valid,
+    int errcode)
+{
+	struct vm *vm;
+	int error, restart_instruction;
+
+	vm = vmarg;
+	restart_instruction = 1;
+
+	error = vm_inject_exception(vm, vcpuid, vector, errcode_valid,
+	    errcode, restart_instruction);
+	KASSERT(error == 0, ("vm_inject_exception error %d", error));
+}
+
+void
+vm_inject_pf(void *vmarg, int vcpuid, int error_code, uint64_t cr2)
+{
+	struct vm *vm;
+	int error;
+
+	vm = vmarg;
+	VCPU_CTR2(vm, vcpuid, "Injecting page fault: error_code %#x, cr2 %#lx",
+	    error_code, cr2);
+
+	error = vm_set_register(vm, vcpuid, VM_REG_GUEST_CR2, cr2);
+	KASSERT(error == 0, ("vm_set_register(cr2) error %d", error));
+
+	vm_inject_fault(vm, vcpuid, IDT_PF, 1, error_code);
+}
+
+static VMM_STAT(VCPU_NMI_COUNT, "number of NMIs delivered to vcpu");
+
+int
+vm_inject_nmi(struct vm *vm, int vcpuid)
+{
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	vcpu->nmi_pending = 1;
+	vcpu_notify_event(vm, vcpuid, false);
+	return (0);
+}
+
+int
+vm_nmi_pending(struct vm *vm, int vcpuid)
+{
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		panic("vm_nmi_pending: invalid vcpuid %d", vcpuid);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	return (vcpu->nmi_pending);
+}
+
+void
+vm_nmi_clear(struct vm *vm, int vcpuid)
+{
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		panic("vm_nmi_pending: invalid vcpuid %d", vcpuid);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	if (vcpu->nmi_pending == 0)
+		panic("vm_nmi_clear: inconsistent nmi_pending state");
+
+	vcpu->nmi_pending = 0;
+	vmm_stat_incr(vm, vcpuid, VCPU_NMI_COUNT, 1);
+}
+
+static VMM_STAT(VCPU_EXTINT_COUNT, "number of ExtINTs delivered to vcpu");
+
+int
+vm_inject_extint(struct vm *vm, int vcpuid)
+{
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	vcpu->extint_pending = 1;
+	vcpu_notify_event(vm, vcpuid, false);
+	return (0);
+}
+
+int
+vm_extint_pending(struct vm *vm, int vcpuid)
+{
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		panic("vm_extint_pending: invalid vcpuid %d", vcpuid);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	return (vcpu->extint_pending);
+}
+
+void
+vm_extint_clear(struct vm *vm, int vcpuid)
+{
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		panic("vm_extint_pending: invalid vcpuid %d", vcpuid);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	if (vcpu->extint_pending == 0)
+		panic("vm_extint_clear: inconsistent extint_pending state");
+
+	vcpu->extint_pending = 0;
+	vmm_stat_incr(vm, vcpuid, VCPU_EXTINT_COUNT, 1);
+}
+
+int
+vm_get_capability(struct vm *vm, int vcpu, int type, int *retval)
+{
+	if (vcpu < 0 || vcpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (type < 0 || type >= VM_CAP_MAX)
+		return (EINVAL);
+
+	return (VMGETCAP(vm->cookie, vcpu, type, retval));
+}
+
+int
+vm_set_capability(struct vm *vm, int vcpu, int type, int val)
+{
+	if (vcpu < 0 || vcpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (type < 0 || type >= VM_CAP_MAX)
+		return (EINVAL);
+
+	return (VMSETCAP(vm->cookie, vcpu, type, val));
+}
+
+struct vlapic *
+vm_lapic(struct vm *vm, int cpu)
+{
+	return (vm->vcpu[cpu].vlapic);
+}
+
+struct vioapic *
+vm_ioapic(struct vm *vm)
+{
+
+	return (vm->vioapic);
+}
+
+struct vhpet *
+vm_hpet(struct vm *vm)
+{
+
+	return (vm->vhpet);
+}
+
+#ifdef	__FreeBSD__
+boolean_t
+vmm_is_pptdev(int bus, int slot, int func)
+{
+	int found, i, n;
+	int b, s, f;
+	char *val, *cp, *cp2;
+
+	/*
+	 * XXX
+	 * The length of an environment variable is limited to 128 bytes which
+	 * puts an upper limit on the number of passthru devices that may be
+	 * specified using a single environment variable.
+	 *
+	 * Work around this by scanning multiple environment variable
+	 * names instead of a single one - yuck!
+	 */
+	const char *names[] = { "pptdevs", "pptdevs2", "pptdevs3", NULL };
+
+	/* set pptdevs="1/2/3 4/5/6 7/8/9 10/11/12" */
+	found = 0;
+	for (i = 0; names[i] != NULL && !found; i++) {
+		cp = val = kern_getenv(names[i]);
+		while (cp != NULL && *cp != '\0') {
+			if ((cp2 = strchr(cp, ' ')) != NULL)
+				*cp2 = '\0';
+
+			n = sscanf(cp, "%d/%d/%d", &b, &s, &f);
+			if (n == 3 && bus == b && slot == s && func == f) {
+				found = 1;
+				break;
+			}
+		
+			if (cp2 != NULL)
+				*cp2++ = ' ';
+
+			cp = cp2;
+		}
+		freeenv(val);
+	}
+	return (found);
+}
+#endif
+
+void *
+vm_iommu_domain(struct vm *vm)
+{
+
+	return (vm->iommu);
+}
+
+int
+vcpu_set_state(struct vm *vm, int vcpuid, enum vcpu_state newstate,
+    bool from_idle)
+{
+	int error;
+	struct vcpu *vcpu;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		panic("vm_set_run_state: invalid vcpuid %d", vcpuid);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	vcpu_lock(vcpu);
+	error = vcpu_set_state_locked(vm, vcpuid, newstate, from_idle);
+	vcpu_unlock(vcpu);
+
+	return (error);
+}
+
+enum vcpu_state
+vcpu_get_state(struct vm *vm, int vcpuid, int *hostcpu)
+{
+	struct vcpu *vcpu;
+	enum vcpu_state state;
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		panic("vm_get_run_state: invalid vcpuid %d", vcpuid);
+
+	vcpu = &vm->vcpu[vcpuid];
+
+	vcpu_lock(vcpu);
+	state = vcpu->state;
+	if (hostcpu != NULL)
+		*hostcpu = vcpu->hostcpu;
+	vcpu_unlock(vcpu);
+
+	return (state);
+}
+
+#ifndef	__FreeBSD__
+uint64_t
+vcpu_tsc_offset(struct vm *vm, int vcpuid)
+{
+	return (vm->vcpu[vcpuid].tsc_offset);
+}
+#endif /* __FreeBSD__ */
+
+int
+vm_activate_cpu(struct vm *vm, int vcpuid)
+{
+
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (CPU_ISSET(vcpuid, &vm->active_cpus))
+		return (EBUSY);
+
+	VCPU_CTR0(vm, vcpuid, "activated");
+	CPU_SET_ATOMIC(vcpuid, &vm->active_cpus);
+	return (0);
+}
+
+int
+vm_suspend_cpu(struct vm *vm, int vcpuid)
+{
+	int i;
+
+	if (vcpuid < -1 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (vcpuid == -1) {
+		vm->debug_cpus = vm->active_cpus;
+		for (i = 0; i < VM_MAXCPU; i++) {
+			if (CPU_ISSET(i, &vm->active_cpus))
+				vcpu_notify_event(vm, i, false);
+		}
+	} else {
+		if (!CPU_ISSET(vcpuid, &vm->active_cpus))
+			return (EINVAL);
+
+		CPU_SET_ATOMIC(vcpuid, &vm->debug_cpus);
+		vcpu_notify_event(vm, vcpuid, false);
+	}
+	return (0);
+}
+
+int
+vm_resume_cpu(struct vm *vm, int vcpuid)
+{
+
+	if (vcpuid < -1 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (vcpuid == -1) {
+		CPU_ZERO(&vm->debug_cpus);
+	} else {
+		if (!CPU_ISSET(vcpuid, &vm->debug_cpus))
+			return (EINVAL);
+
+		CPU_CLR_ATOMIC(vcpuid, &vm->debug_cpus);
+	}
+	return (0);
+}
+
+int
+vcpu_debugged(struct vm *vm, int vcpuid)
+{
+
+	return (CPU_ISSET(vcpuid, &vm->debug_cpus));
+}
+
+cpuset_t
+vm_active_cpus(struct vm *vm)
+{
+
+	return (vm->active_cpus);
+}
+
+cpuset_t
+vm_debug_cpus(struct vm *vm)
+{
+
+	return (vm->debug_cpus);
+}
+
+cpuset_t
+vm_suspended_cpus(struct vm *vm)
+{
+
+	return (vm->suspended_cpus);
+}
+
+void *
+vcpu_stats(struct vm *vm, int vcpuid)
+{
+
+	return (vm->vcpu[vcpuid].stats);
+}
+
+int
+vm_get_x2apic_state(struct vm *vm, int vcpuid, enum x2apic_state *state)
+{
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	*state = vm->vcpu[vcpuid].x2apic_state;
+
+	return (0);
+}
+
+int
+vm_set_x2apic_state(struct vm *vm, int vcpuid, enum x2apic_state state)
+{
+	if (vcpuid < 0 || vcpuid >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (state >= X2APIC_STATE_LAST)
+		return (EINVAL);
+
+	vm->vcpu[vcpuid].x2apic_state = state;
+
+	vlapic_set_x2apic_state(vm, vcpuid, state);
+
+	return (0);
+}
+
+/*
+ * This function is called to ensure that a vcpu "sees" a pending event
+ * as soon as possible:
+ * - If the vcpu thread is sleeping then it is woken up.
+ * - If the vcpu is running on a different host_cpu then an IPI will be directed
+ *   to the host_cpu to cause the vcpu to trap into the hypervisor.
+ */
+static void
+vcpu_notify_event_locked(struct vcpu *vcpu, bool lapic_intr)
+{
+	int hostcpu;
+
+	hostcpu = vcpu->hostcpu;
+	if (vcpu->state == VCPU_RUNNING) {
+		KASSERT(hostcpu != NOCPU, ("vcpu running on invalid hostcpu"));
+		if (hostcpu != curcpu) {
+			if (lapic_intr) {
+				vlapic_post_intr(vcpu->vlapic, hostcpu,
+				    vmm_ipinum);
+			} else {
+				ipi_cpu(hostcpu, vmm_ipinum);
+			}
+		} else {
+			/*
+			 * If the 'vcpu' is running on 'curcpu' then it must
+			 * be sending a notification to itself (e.g. SELF_IPI).
+			 * The pending event will be picked up when the vcpu
+			 * transitions back to guest context.
+			 */
+		}
+	} else {
+		KASSERT(hostcpu == NOCPU, ("vcpu state %d not consistent "
+		    "with hostcpu %d", vcpu->state, hostcpu));
+		if (vcpu->state == VCPU_SLEEPING) {
+#ifdef __FreeBSD__
+			wakeup_one(vcpu);
+#else
+			cv_signal(&vcpu->vcpu_cv);
+#endif
+		}
+	}
+}
+
+void
+vcpu_notify_event(struct vm *vm, int vcpuid, bool lapic_intr)
+{
+	struct vcpu *vcpu = &vm->vcpu[vcpuid];
+
+	vcpu_lock(vcpu);
+	vcpu_notify_event_locked(vcpu, lapic_intr);
+	vcpu_unlock(vcpu);
+}
+
+struct vmspace *
+vm_get_vmspace(struct vm *vm)
+{
+
+	return (vm->vmspace);
+}
+
+int
+vm_apicid2vcpuid(struct vm *vm, int apicid)
+{
+	/*
+	 * XXX apic id is assumed to be numerically identical to vcpu id
+	 */
+	return (apicid);
+}
+
+void
+vm_smp_rendezvous(struct vm *vm, int vcpuid, cpuset_t dest,
+    vm_rendezvous_func_t func, void *arg)
+{
+	int i;
+
+	/*
+	 * Enforce that this function is called without any locks
+	 */
+	WITNESS_WARN(WARN_PANIC, NULL, "vm_smp_rendezvous");
+	KASSERT(vcpuid == -1 || (vcpuid >= 0 && vcpuid < VM_MAXCPU),
+	    ("vm_smp_rendezvous: invalid vcpuid %d", vcpuid));
+
+restart:
+	mtx_lock(&vm->rendezvous_mtx);
+	if (vm->rendezvous_func != NULL) {
+		/*
+		 * If a rendezvous is already in progress then we need to
+		 * call the rendezvous handler in case this 'vcpuid' is one
+		 * of the targets of the rendezvous.
+		 */
+		RENDEZVOUS_CTR0(vm, vcpuid, "Rendezvous already in progress");
+		mtx_unlock(&vm->rendezvous_mtx);
+		vm_handle_rendezvous(vm, vcpuid);
+		goto restart;
+	}
+	KASSERT(vm->rendezvous_func == NULL, ("vm_smp_rendezvous: previous "
+	    "rendezvous is still in progress"));
+
+	RENDEZVOUS_CTR0(vm, vcpuid, "Initiating rendezvous");
+	vm->rendezvous_req_cpus = dest;
+	CPU_ZERO(&vm->rendezvous_done_cpus);
+	vm->rendezvous_arg = arg;
+	vm_set_rendezvous_func(vm, func);
+	mtx_unlock(&vm->rendezvous_mtx);
+
+	/*
+	 * Wake up any sleeping vcpus and trigger a VM-exit in any running
+	 * vcpus so they handle the rendezvous as soon as possible.
+	 */
+	for (i = 0; i < VM_MAXCPU; i++) {
+		if (CPU_ISSET(i, &dest))
+			vcpu_notify_event(vm, i, false);
+	}
+
+	vm_handle_rendezvous(vm, vcpuid);
+}
+
+struct vatpic *
+vm_atpic(struct vm *vm)
+{
+	return (vm->vatpic);
+}
+
+struct vatpit *
+vm_atpit(struct vm *vm)
+{
+	return (vm->vatpit);
+}
+
+struct vpmtmr *
+vm_pmtmr(struct vm *vm)
+{
+
+	return (vm->vpmtmr);
+}
+
+struct vrtc *
+vm_rtc(struct vm *vm)
+{
+
+	return (vm->vrtc);
+}
+
+enum vm_reg_name
+vm_segment_name(int seg)
+{
+	static enum vm_reg_name seg_names[] = {
+		VM_REG_GUEST_ES,
+		VM_REG_GUEST_CS,
+		VM_REG_GUEST_SS,
+		VM_REG_GUEST_DS,
+		VM_REG_GUEST_FS,
+		VM_REG_GUEST_GS
+	};
+
+	KASSERT(seg >= 0 && seg < nitems(seg_names),
+	    ("%s: invalid segment encoding %d", __func__, seg));
+	return (seg_names[seg]);
+}
+
+void
+vm_copy_teardown(struct vm *vm, int vcpuid, struct vm_copyinfo *copyinfo,
+    int num_copyinfo)
+{
+	int idx;
+
+	for (idx = 0; idx < num_copyinfo; idx++) {
+		if (copyinfo[idx].cookie != NULL)
+			vm_gpa_release(copyinfo[idx].cookie);
+	}
+	bzero(copyinfo, num_copyinfo * sizeof(struct vm_copyinfo));
+}
+
+int
+vm_copy_setup(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t gla, size_t len, int prot, struct vm_copyinfo *copyinfo,
+    int num_copyinfo, int *fault)
+{
+	int error, idx, nused;
+	size_t n, off, remaining;
+	void *hva, *cookie;
+	uint64_t gpa;
+
+	bzero(copyinfo, sizeof(struct vm_copyinfo) * num_copyinfo);
+
+	nused = 0;
+	remaining = len;
+	while (remaining > 0) {
+		KASSERT(nused < num_copyinfo, ("insufficient vm_copyinfo"));
+		error = vm_gla2gpa(vm, vcpuid, paging, gla, prot, &gpa, fault);
+		if (error || *fault)
+			return (error);
+		off = gpa & PAGE_MASK;
+		n = min(remaining, PAGE_SIZE - off);
+		copyinfo[nused].gpa = gpa;
+		copyinfo[nused].len = n;
+		remaining -= n;
+		gla += n;
+		nused++;
+	}
+
+	for (idx = 0; idx < nused; idx++) {
+		hva = vm_gpa_hold(vm, vcpuid, copyinfo[idx].gpa,
+		    copyinfo[idx].len, prot, &cookie);
+		if (hva == NULL)
+			break;
+		copyinfo[idx].hva = hva;
+		copyinfo[idx].cookie = cookie;
+	}
+
+	if (idx != nused) {
+		vm_copy_teardown(vm, vcpuid, copyinfo, num_copyinfo);
+		return (EFAULT);
+	} else {
+		*fault = 0;
+		return (0);
+	}
+}
+
+void
+vm_copyin(struct vm *vm, int vcpuid, struct vm_copyinfo *copyinfo, void *kaddr,
+    size_t len)
+{
+	char *dst;
+	int idx;
+	
+	dst = kaddr;
+	idx = 0;
+	while (len > 0) {
+		bcopy(copyinfo[idx].hva, dst, copyinfo[idx].len);
+		len -= copyinfo[idx].len;
+		dst += copyinfo[idx].len;
+		idx++;
+	}
+}
+
+void
+vm_copyout(struct vm *vm, int vcpuid, const void *kaddr,
+    struct vm_copyinfo *copyinfo, size_t len)
+{
+	const char *src;
+	int idx;
+
+	src = kaddr;
+	idx = 0;
+	while (len > 0) {
+		bcopy(src, copyinfo[idx].hva, copyinfo[idx].len);
+		len -= copyinfo[idx].len;
+		src += copyinfo[idx].len;
+		idx++;
+	}
+}
+
+/*
+ * Return the amount of in-use and wired memory for the VM. Since
+ * these are global stats, only return the values with for vCPU 0
+ */
+VMM_STAT_DECLARE(VMM_MEM_RESIDENT);
+VMM_STAT_DECLARE(VMM_MEM_WIRED);
+
+static void
+vm_get_rescnt(struct vm *vm, int vcpu, struct vmm_stat_type *stat)
+{
+
+	if (vcpu == 0) {
+		vmm_stat_set(vm, vcpu, VMM_MEM_RESIDENT,
+	       	    PAGE_SIZE * vmspace_resident_count(vm->vmspace));
+	}	
+}
+
+static void
+vm_get_wiredcnt(struct vm *vm, int vcpu, struct vmm_stat_type *stat)
+{
+
+	if (vcpu == 0) {
+		vmm_stat_set(vm, vcpu, VMM_MEM_WIRED,
+	      	    PAGE_SIZE * pmap_wired_count(vmspace_pmap(vm->vmspace)));
+	}	
+}
+
+VMM_STAT_FUNC(VMM_MEM_RESIDENT, "Resident memory", vm_get_rescnt);
+VMM_STAT_FUNC(VMM_MEM_WIRED, "Wired memory", vm_get_wiredcnt);
+
+#ifndef __FreeBSD__
+int
+vm_ioport_hook(struct vm *vm, uint_t ioport, vmm_rmem_cb_t rfunc,
+    vmm_wmem_cb_t wfunc, void *arg, void **cookie)
+{
+	list_t *ih = &vm->ioport_hooks;
+	vm_ioport_hook_t *hook, *node;
+
+	if (ioport == 0) {
+		return (EINVAL);
+	}
+
+	rw_enter(&vm->ioport_rwlock, RW_WRITER);
+	/*
+	 * Find the node position in the list which this region should be
+	 * inserted behind to maintain sorted order.
+	 */
+	for (node = list_tail(ih); node != NULL; node = list_prev(ih, node)) {
+		if (ioport == node->vmih_ioport) {
+			/* Reject duplicate port hook  */
+			rw_exit(&vm->ioport_rwlock);
+			return (EEXIST);
+		} else if (ioport > node->vmih_ioport) {
+			break;
+		}
+	}
+
+	hook = kmem_alloc(sizeof (*hook), KM_SLEEP);
+	hook->vmih_ioport = ioport;
+	hook->vmih_arg = arg;
+	hook->vmih_rmem_cb = rfunc;
+	hook->vmih_wmem_cb = wfunc;
+	if (node == NULL) {
+		list_insert_head(ih, hook);
+	} else {
+		list_insert_after(ih, node, hook);
+	}
+
+	*cookie = (void *)hook;
+	rw_exit(&vm->ioport_rwlock);
+	return (0);
+}
+
+void
+vm_ioport_unhook(struct vm *vm, void **cookie)
+{
+	vm_ioport_hook_t *hook;
+	list_t *ih = &vm->ioport_hooks;
+
+	rw_enter(&vm->ioport_rwlock, RW_WRITER);
+	hook = *cookie;
+	list_remove(ih, hook);
+	kmem_free(hook, sizeof (*hook));
+	*cookie = NULL;
+	rw_exit(&vm->ioport_rwlock);
+}
+
+int
+vm_ioport_handle_hook(struct vm *vm, int cpuid, bool in, int port, int bytes,
+    uint32_t *val)
+{
+	vm_ioport_hook_t *hook;
+	list_t *ih = &vm->ioport_hooks;
+	int err = 0;
+
+	rw_enter(&vm->ioport_rwlock, RW_READER);
+	for (hook = list_head(ih); hook != NULL; hook = list_next(ih, hook)) {
+		if (hook->vmih_ioport == port) {
+			break;
+		}
+	}
+	if (hook == NULL) {
+		err = ENOENT;
+		goto bail;
+	}
+
+	if (in) {
+		uint64_t tval;
+
+		if (hook->vmih_rmem_cb == NULL) {
+			err = ENOENT;
+			goto bail;
+		}
+		err = hook->vmih_rmem_cb(hook->vmih_arg, (uintptr_t)port,
+		    (uint_t)bytes, &tval);
+		*val = (uint32_t)tval;
+	} else {
+		if (hook->vmih_wmem_cb == NULL) {
+			err = ENOENT;
+			goto bail;
+		}
+		err = hook->vmih_wmem_cb(hook->vmih_arg, (uintptr_t)port,
+		    (uint_t)bytes, (uint64_t)*val);
+	}
+
+bail:
+	rw_exit(&vm->ioport_rwlock);
+	return (err);
+}
+
+
+#endif /* __FreeBSD__ */
diff --git a/usr/src/uts/i86pc/io/vmm/vmm.conf b/usr/src/uts/i86pc/io/vmm/vmm.conf
new file mode 100644
index 0000000000..8833076014
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm.conf
@@ -0,0 +1 @@
+name="vmm" parent="pseudo";
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_host.c b/usr/src/uts/i86pc/io/vmm/vmm_host.c
new file mode 100644
index 0000000000..9e390c93dd
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_host.c
@@ -0,0 +1,207 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/pcpu.h>
+
+#include <machine/cpufunc.h>
+#include <machine/segments.h>
+#include <machine/specialreg.h>
+
+#include "vmm_host.h"
+
+static uint64_t vmm_host_efer, vmm_host_pat, vmm_host_cr0, vmm_host_cr4,
+	vmm_host_xcr0;
+static struct xsave_limits vmm_xsave_limits;
+
+void
+vmm_host_state_init(void)
+{
+	unsigned int regs[4];
+
+	vmm_host_efer = rdmsr(MSR_EFER);
+	vmm_host_pat = rdmsr(MSR_PAT);
+
+	/*
+	 * We always want CR0.TS to be set when the processor does a VM exit.
+	 *
+	 * With emulation turned on unconditionally after a VM exit, we are
+	 * able to trap inadvertent use of the FPU until the guest FPU state
+	 * has been safely squirreled away.
+	 */
+	vmm_host_cr0 = rcr0() | CR0_TS;
+
+	/*
+	 * On non-PCID or PCID but without INVPCID support machines,
+	 * we flush kernel i.e. global TLB entries, by temporary
+	 * clearing the CR4.PGE bit, see invltlb_glob().  If
+	 * preemption occurs at the wrong time, cached vmm_host_cr4
+	 * might store the value with CR4.PGE cleared.  Since FreeBSD
+	 * requires support for PG_G on amd64, just set it
+	 * unconditionally.
+	 */
+	vmm_host_cr4 = rcr4() | CR4_PGE;
+
+	/*
+	 * Only permit a guest to use XSAVE if the host is using
+	 * XSAVE.  Only permit a guest to use XSAVE features supported
+	 * by the host.  This ensures that the FPU state used by the
+	 * guest is always a subset of the saved guest FPU state.
+	 *
+	 * In addition, only permit known XSAVE features where the
+	 * rules for which features depend on other features is known
+	 * to properly emulate xsetbv.
+	 */
+	if (vmm_host_cr4 & CR4_XSAVE) {
+		vmm_xsave_limits.xsave_enabled = 1;
+		vmm_host_xcr0 = rxcr(0);
+		vmm_xsave_limits.xcr0_allowed = vmm_host_xcr0 &
+		    (XFEATURE_AVX | XFEATURE_MPX | XFEATURE_AVX512);
+
+		cpuid_count(0xd, 0x0, regs);
+		vmm_xsave_limits.xsave_max_size = regs[1];
+	}
+}
+
+uint64_t
+vmm_get_host_pat(void)
+{
+
+	return (vmm_host_pat);
+}
+
+uint64_t
+vmm_get_host_efer(void)
+{
+
+	return (vmm_host_efer);
+}
+
+uint64_t
+vmm_get_host_cr0(void)
+{
+
+	return (vmm_host_cr0);
+}
+
+uint64_t
+vmm_get_host_cr4(void)
+{
+
+	return (vmm_host_cr4);
+}
+
+uint64_t
+vmm_get_host_xcr0(void)
+{
+
+	return (vmm_host_xcr0);
+}
+
+uint64_t
+vmm_get_host_datasel(void)
+{
+
+#ifdef	__FreeBSD__
+	return (GSEL(GDATA_SEL, SEL_KPL));
+#else
+	return (SEL_GDT(GDT_KDATA, SEL_KPL));
+#endif
+
+}
+
+uint64_t
+vmm_get_host_codesel(void)
+{
+
+#ifdef	__FreeBSD__
+	return (GSEL(GCODE_SEL, SEL_KPL));
+#else
+	return (SEL_GDT(GDT_KCODE, SEL_KPL));
+#endif
+}
+
+uint64_t
+vmm_get_host_tsssel(void)
+{
+
+#ifdef	__FreeBSD__
+	return (GSEL(GPROC0_SEL, SEL_KPL));
+#else
+	return (SEL_GDT(GDT_KTSS, SEL_KPL));
+#endif
+}
+
+uint64_t
+vmm_get_host_fsbase(void)
+{
+
+#ifdef	__FreeBSD__
+	return (0);
+#else
+	return (rdmsr(MSR_FSBASE));
+#endif
+}
+
+uint64_t
+vmm_get_host_idtrbase(void)
+{
+
+#ifdef	__FreeBSD__
+	return (r_idt.rd_base);
+#else
+	desctbr_t idtr;
+
+	rd_idtr(&idtr);
+	return (idtr.dtr_base);
+#endif
+}
+
+const struct xsave_limits *
+vmm_get_xsave_limits(void)
+{
+
+	return (&vmm_xsave_limits);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_host.h b/usr/src/uts/i86pc/io/vmm/vmm_host.h
new file mode 100644
index 0000000000..f12047819d
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_host.h
@@ -0,0 +1,132 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef	_VMM_HOST_H_
+#define	_VMM_HOST_H_
+
+#ifndef	__FreeBSD__
+#include <sys/cpuvar.h>
+#endif
+
+#ifndef	_KERNEL
+#error "no user-serviceable parts inside"
+#endif
+
+struct xsave_limits {
+	int		xsave_enabled;
+	uint64_t	xcr0_allowed;
+	uint32_t	xsave_max_size;
+};
+
+void vmm_host_state_init(void);
+
+uint64_t vmm_get_host_pat(void);
+uint64_t vmm_get_host_efer(void);
+uint64_t vmm_get_host_cr0(void);
+uint64_t vmm_get_host_cr4(void);
+uint64_t vmm_get_host_xcr0(void);
+uint64_t vmm_get_host_datasel(void);
+uint64_t vmm_get_host_codesel(void);
+uint64_t vmm_get_host_tsssel(void);
+uint64_t vmm_get_host_fsbase(void);
+uint64_t vmm_get_host_idtrbase(void);
+const struct xsave_limits *vmm_get_xsave_limits(void);
+
+/*
+ * Inline access to host state that is used on every VM entry
+ */
+static __inline uint64_t
+vmm_get_host_trbase(void)
+{
+
+#ifdef	__FreeBSD__
+	return ((uint64_t)PCPU_GET(tssp));
+#else
+	return ((u_long)CPU->cpu_tss);
+#endif
+}
+
+static __inline uint64_t
+vmm_get_host_gdtrbase(void)
+{
+
+#ifdef	__FreeBSD__
+	return ((uint64_t)&gdt[NGDT * curcpu]);
+#else
+	desctbr_t gdtr;
+
+	rd_gdtr(&gdtr);
+	return (gdtr.dtr_base);
+#endif
+}
+
+#ifdef	__FreeBSD__
+struct pcpu;
+extern struct pcpu __pcpu[];
+#endif
+
+static __inline uint64_t
+vmm_get_host_gsbase(void)
+{
+
+#ifdef	__FreeBSD__
+	return ((uint64_t)&__pcpu[curcpu]);
+#else
+	return (rdmsr(MSR_GSBASE));
+#endif
+}
+
+#ifndef	__FreeBSD__
+static __inline uint64_t
+vmm_get_host_fssel(void)
+{
+	return (KFS_SEL);
+}
+
+static __inline uint64_t
+vmm_get_host_gssel(void)
+{
+	return (KGS_SEL);
+}
+#endif
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_instruction_emul.c b/usr/src/uts/i86pc/io/vmm/vmm_instruction_emul.c
new file mode 100644
index 0000000000..ccb615cbe0
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_instruction_emul.c
@@ -0,0 +1,2542 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 Sandvine, Inc.
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#ifdef _KERNEL
+#include <sys/param.h>
+#include <sys/pcpu.h>
+#include <sys/systm.h>
+#include <sys/proc.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+
+#include <machine/vmparam.h>
+#include <machine/vmm.h>
+#else	/* !_KERNEL */
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/_iovec.h>
+
+#include <machine/vmm.h>
+
+#include <assert.h>
+#include <vmmapi.h>
+#define	KASSERT(exp,msg)	assert((exp))
+#endif	/* _KERNEL */
+
+#include <machine/vmm_instruction_emul.h>
+#include <x86/psl.h>
+#include <x86/specialreg.h>
+
+/* struct vie_op.op_type */
+enum {
+	VIE_OP_TYPE_NONE = 0,
+	VIE_OP_TYPE_MOV,
+	VIE_OP_TYPE_MOVSX,
+	VIE_OP_TYPE_MOVZX,
+	VIE_OP_TYPE_AND,
+	VIE_OP_TYPE_OR,
+	VIE_OP_TYPE_SUB,
+	VIE_OP_TYPE_TWO_BYTE,
+	VIE_OP_TYPE_PUSH,
+	VIE_OP_TYPE_CMP,
+	VIE_OP_TYPE_POP,
+	VIE_OP_TYPE_MOVS,
+	VIE_OP_TYPE_GROUP1,
+	VIE_OP_TYPE_STOS,
+	VIE_OP_TYPE_BITTEST,
+	VIE_OP_TYPE_LAST
+};
+
+/* struct vie_op.op_flags */
+#define	VIE_OP_F_IMM		(1 << 0)  /* 16/32-bit immediate operand */
+#define	VIE_OP_F_IMM8		(1 << 1)  /* 8-bit immediate operand */
+#define	VIE_OP_F_MOFFSET	(1 << 2)  /* 16/32/64-bit immediate moffset */
+#define	VIE_OP_F_NO_MODRM	(1 << 3)
+#define	VIE_OP_F_NO_GLA_VERIFICATION (1 << 4)
+
+static const struct vie_op two_byte_opcodes[256] = {
+	[0xB6] = {
+		.op_byte = 0xB6,
+		.op_type = VIE_OP_TYPE_MOVZX,
+	},
+	[0xB7] = {
+		.op_byte = 0xB7,
+		.op_type = VIE_OP_TYPE_MOVZX,
+	},
+	[0xBA] = {
+		.op_byte = 0xBA,
+		.op_type = VIE_OP_TYPE_BITTEST,
+		.op_flags = VIE_OP_F_IMM8,
+	},
+	[0xBE] = {
+		.op_byte = 0xBE,
+		.op_type = VIE_OP_TYPE_MOVSX,
+	},
+};
+
+static const struct vie_op one_byte_opcodes[256] = {
+	[0x0F] = {
+		.op_byte = 0x0F,
+		.op_type = VIE_OP_TYPE_TWO_BYTE
+	},
+	[0x0B] = {
+		.op_byte = 0x0B,
+		.op_type = VIE_OP_TYPE_OR,
+	},
+	[0x2B] = {
+		.op_byte = 0x2B,
+		.op_type = VIE_OP_TYPE_SUB,
+	},
+	[0x39] = {
+		.op_byte = 0x39,
+		.op_type = VIE_OP_TYPE_CMP,
+	},
+	[0x3B] = {
+		.op_byte = 0x3B,
+		.op_type = VIE_OP_TYPE_CMP,
+	},
+	[0x88] = {
+		.op_byte = 0x88,
+		.op_type = VIE_OP_TYPE_MOV,
+	},
+	[0x89] = {
+		.op_byte = 0x89,
+		.op_type = VIE_OP_TYPE_MOV,
+	},
+	[0x8A] = {
+		.op_byte = 0x8A,
+		.op_type = VIE_OP_TYPE_MOV,
+	},
+	[0x8B] = {
+		.op_byte = 0x8B,
+		.op_type = VIE_OP_TYPE_MOV,
+	},
+	[0xA1] = {
+		.op_byte = 0xA1,
+		.op_type = VIE_OP_TYPE_MOV,
+		.op_flags = VIE_OP_F_MOFFSET | VIE_OP_F_NO_MODRM,
+	},
+	[0xA3] = {
+		.op_byte = 0xA3,
+		.op_type = VIE_OP_TYPE_MOV,
+		.op_flags = VIE_OP_F_MOFFSET | VIE_OP_F_NO_MODRM,
+	},
+	[0xA4] = {
+		.op_byte = 0xA4,
+		.op_type = VIE_OP_TYPE_MOVS,
+		.op_flags = VIE_OP_F_NO_MODRM | VIE_OP_F_NO_GLA_VERIFICATION
+	},
+	[0xA5] = {
+		.op_byte = 0xA5,
+		.op_type = VIE_OP_TYPE_MOVS,
+		.op_flags = VIE_OP_F_NO_MODRM | VIE_OP_F_NO_GLA_VERIFICATION
+	},
+	[0xAA] = {
+		.op_byte = 0xAA,
+		.op_type = VIE_OP_TYPE_STOS,
+		.op_flags = VIE_OP_F_NO_MODRM | VIE_OP_F_NO_GLA_VERIFICATION
+	},
+	[0xAB] = {
+		.op_byte = 0xAB,
+		.op_type = VIE_OP_TYPE_STOS,
+		.op_flags = VIE_OP_F_NO_MODRM | VIE_OP_F_NO_GLA_VERIFICATION
+	},
+	[0xC6] = {
+		/* XXX Group 11 extended opcode - not just MOV */
+		.op_byte = 0xC6,
+		.op_type = VIE_OP_TYPE_MOV,
+		.op_flags = VIE_OP_F_IMM8,
+	},
+	[0xC7] = {
+		.op_byte = 0xC7,
+		.op_type = VIE_OP_TYPE_MOV,
+		.op_flags = VIE_OP_F_IMM,
+	},
+	[0x23] = {
+		.op_byte = 0x23,
+		.op_type = VIE_OP_TYPE_AND,
+	},
+	[0x80] = {
+		/* Group 1 extended opcode */
+		.op_byte = 0x80,
+		.op_type = VIE_OP_TYPE_GROUP1,
+		.op_flags = VIE_OP_F_IMM8,
+	},
+	[0x81] = {
+		/* Group 1 extended opcode */
+		.op_byte = 0x81,
+		.op_type = VIE_OP_TYPE_GROUP1,
+		.op_flags = VIE_OP_F_IMM,
+	},
+	[0x83] = {
+		/* Group 1 extended opcode */
+		.op_byte = 0x83,
+		.op_type = VIE_OP_TYPE_GROUP1,
+		.op_flags = VIE_OP_F_IMM8,
+	},
+	[0x8F] = {
+		/* XXX Group 1A extended opcode - not just POP */
+		.op_byte = 0x8F,
+		.op_type = VIE_OP_TYPE_POP,
+	},
+	[0xFF] = {
+		/* XXX Group 5 extended opcode - not just PUSH */
+		.op_byte = 0xFF,
+		.op_type = VIE_OP_TYPE_PUSH,
+	}
+};
+
+/* struct vie.mod */
+#define	VIE_MOD_INDIRECT		0
+#define	VIE_MOD_INDIRECT_DISP8		1
+#define	VIE_MOD_INDIRECT_DISP32		2
+#define	VIE_MOD_DIRECT			3
+
+/* struct vie.rm */
+#define	VIE_RM_SIB			4
+#define	VIE_RM_DISP32			5
+
+#define	GB				(1024 * 1024 * 1024)
+
+static enum vm_reg_name gpr_map[16] = {
+	VM_REG_GUEST_RAX,
+	VM_REG_GUEST_RCX,
+	VM_REG_GUEST_RDX,
+	VM_REG_GUEST_RBX,
+	VM_REG_GUEST_RSP,
+	VM_REG_GUEST_RBP,
+	VM_REG_GUEST_RSI,
+	VM_REG_GUEST_RDI,
+	VM_REG_GUEST_R8,
+	VM_REG_GUEST_R9,
+	VM_REG_GUEST_R10,
+	VM_REG_GUEST_R11,
+	VM_REG_GUEST_R12,
+	VM_REG_GUEST_R13,
+	VM_REG_GUEST_R14,
+	VM_REG_GUEST_R15
+};
+
+static uint64_t size2mask[] = {
+	[1] = 0xff,
+	[2] = 0xffff,
+	[4] = 0xffffffff,
+	[8] = 0xffffffffffffffff,
+};
+
+static int
+vie_read_register(void *vm, int vcpuid, enum vm_reg_name reg, uint64_t *rval)
+{
+	int error;
+
+	error = vm_get_register(vm, vcpuid, reg, rval);
+
+	return (error);
+}
+
+static void
+vie_calc_bytereg(struct vie *vie, enum vm_reg_name *reg, int *lhbr)
+{
+	*lhbr = 0;
+	*reg = gpr_map[vie->reg];
+
+	/*
+	 * 64-bit mode imposes limitations on accessing legacy high byte
+	 * registers (lhbr).
+	 *
+	 * The legacy high-byte registers cannot be addressed if the REX
+	 * prefix is present. In this case the values 4, 5, 6 and 7 of the
+	 * 'ModRM:reg' field address %spl, %bpl, %sil and %dil respectively.
+	 *
+	 * If the REX prefix is not present then the values 4, 5, 6 and 7
+	 * of the 'ModRM:reg' field address the legacy high-byte registers,
+	 * %ah, %ch, %dh and %bh respectively.
+	 */
+	if (!vie->rex_present) {
+		if (vie->reg & 0x4) {
+			*lhbr = 1;
+			*reg = gpr_map[vie->reg & 0x3];
+		}
+	}
+}
+
+static int
+vie_read_bytereg(void *vm, int vcpuid, struct vie *vie, uint8_t *rval)
+{
+	uint64_t val;
+	int error, lhbr;
+	enum vm_reg_name reg;
+
+	vie_calc_bytereg(vie, &reg, &lhbr);
+	error = vm_get_register(vm, vcpuid, reg, &val);
+
+	/*
+	 * To obtain the value of a legacy high byte register shift the
+	 * base register right by 8 bits (%ah = %rax >> 8).
+	 */
+	if (lhbr)
+		*rval = val >> 8;
+	else
+		*rval = val;
+	return (error);
+}
+
+static int
+vie_write_bytereg(void *vm, int vcpuid, struct vie *vie, uint8_t byte)
+{
+	uint64_t origval, val, mask;
+	int error, lhbr;
+	enum vm_reg_name reg;
+
+	vie_calc_bytereg(vie, &reg, &lhbr);
+	error = vm_get_register(vm, vcpuid, reg, &origval);
+	if (error == 0) {
+		val = byte;
+		mask = 0xff;
+		if (lhbr) {
+			/*
+			 * Shift left by 8 to store 'byte' in a legacy high
+			 * byte register.
+			 */
+			val <<= 8;
+			mask <<= 8;
+		}
+		val |= origval & ~mask;
+		error = vm_set_register(vm, vcpuid, reg, val);
+	}
+	return (error);
+}
+
+int
+vie_update_register(void *vm, int vcpuid, enum vm_reg_name reg,
+		    uint64_t val, int size)
+{
+	int error;
+	uint64_t origval;
+
+	switch (size) {
+	case 1:
+	case 2:
+		error = vie_read_register(vm, vcpuid, reg, &origval);
+		if (error)
+			return (error);
+		val &= size2mask[size];
+		val |= origval & ~size2mask[size];
+		break;
+	case 4:
+		val &= 0xffffffffUL;
+		break;
+	case 8:
+		break;
+	default:
+		return (EINVAL);
+	}
+
+	error = vm_set_register(vm, vcpuid, reg, val);
+	return (error);
+}
+
+#define	RFLAGS_STATUS_BITS    (PSL_C | PSL_PF | PSL_AF | PSL_Z | PSL_N | PSL_V)
+
+/*
+ * Return the status flags that would result from doing (x - y).
+ */
+#define	GETCC(sz)							\
+static u_long								\
+getcc##sz(uint##sz##_t x, uint##sz##_t y)				\
+{									\
+	u_long rflags;							\
+									\
+	__asm __volatile("sub %2,%1; pushfq; popq %0" :			\
+	    "=r" (rflags), "+r" (x) : "m" (y));				\
+	return (rflags);						\
+} struct __hack
+
+GETCC(8);
+GETCC(16);
+GETCC(32);
+GETCC(64);
+
+static u_long
+getcc(int opsize, uint64_t x, uint64_t y)
+{
+	KASSERT(opsize == 1 || opsize == 2 || opsize == 4 || opsize == 8,
+	    ("getcc: invalid operand size %d", opsize));
+
+	if (opsize == 1)
+		return (getcc8(x, y));
+	else if (opsize == 2)
+		return (getcc16(x, y));
+	else if (opsize == 4)
+		return (getcc32(x, y));
+	else
+		return (getcc64(x, y));
+}
+
+static int
+emulate_mov(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+	    mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
+{
+	int error, size;
+	enum vm_reg_name reg;
+	uint8_t byte;
+	uint64_t val;
+
+	size = vie->opsize;
+	error = EINVAL;
+
+	switch (vie->op.op_byte) {
+	case 0x88:
+		/*
+		 * MOV byte from reg (ModRM:reg) to mem (ModRM:r/m)
+		 * 88/r:	mov r/m8, r8
+		 * REX + 88/r:	mov r/m8, r8 (%ah, %ch, %dh, %bh not available)
+		 */
+		size = 1;	/* override for byte operation */
+		error = vie_read_bytereg(vm, vcpuid, vie, &byte);
+		if (error == 0)
+			error = memwrite(vm, vcpuid, gpa, byte, size, arg);
+		break;
+	case 0x89:
+		/*
+		 * MOV from reg (ModRM:reg) to mem (ModRM:r/m)
+		 * 89/r:	mov r/m16, r16
+		 * 89/r:	mov r/m32, r32
+		 * REX.W + 89/r	mov r/m64, r64
+		 */
+		reg = gpr_map[vie->reg];
+		error = vie_read_register(vm, vcpuid, reg, &val);
+		if (error == 0) {
+			val &= size2mask[size];
+			error = memwrite(vm, vcpuid, gpa, val, size, arg);
+		}
+		break;
+	case 0x8A:
+		/*
+		 * MOV byte from mem (ModRM:r/m) to reg (ModRM:reg)
+		 * 8A/r:	mov r8, r/m8
+		 * REX + 8A/r:	mov r8, r/m8
+		 */
+		size = 1;	/* override for byte operation */
+		error = memread(vm, vcpuid, gpa, &val, size, arg);
+		if (error == 0)
+			error = vie_write_bytereg(vm, vcpuid, vie, val);
+		break;
+	case 0x8B:
+		/*
+		 * MOV from mem (ModRM:r/m) to reg (ModRM:reg)
+		 * 8B/r:	mov r16, r/m16
+		 * 8B/r:	mov r32, r/m32
+		 * REX.W 8B/r:	mov r64, r/m64
+		 */
+		error = memread(vm, vcpuid, gpa, &val, size, arg);
+		if (error == 0) {
+			reg = gpr_map[vie->reg];
+			error = vie_update_register(vm, vcpuid, reg, val, size);
+		}
+		break;
+	case 0xA1:
+		/*
+		 * MOV from seg:moffset to AX/EAX/RAX
+		 * A1:		mov AX, moffs16
+		 * A1:		mov EAX, moffs32
+		 * REX.W + A1:	mov RAX, moffs64
+		 */
+		error = memread(vm, vcpuid, gpa, &val, size, arg);
+		if (error == 0) {
+			reg = VM_REG_GUEST_RAX;
+			error = vie_update_register(vm, vcpuid, reg, val, size);
+		}
+		break;
+	case 0xA3:
+		/*
+		 * MOV from AX/EAX/RAX to seg:moffset
+		 * A3:		mov moffs16, AX
+		 * A3:		mov moffs32, EAX 
+		 * REX.W + A3:	mov moffs64, RAX
+		 */
+		error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RAX, &val);
+		if (error == 0) {
+			val &= size2mask[size];
+			error = memwrite(vm, vcpuid, gpa, val, size, arg);
+		}
+		break;
+	case 0xC6:
+		/*
+		 * MOV from imm8 to mem (ModRM:r/m)
+		 * C6/0		mov r/m8, imm8
+		 * REX + C6/0	mov r/m8, imm8
+		 */
+		size = 1;	/* override for byte operation */
+		error = memwrite(vm, vcpuid, gpa, vie->immediate, size, arg);
+		break;
+	case 0xC7:
+		/*
+		 * MOV from imm16/imm32 to mem (ModRM:r/m)
+		 * C7/0		mov r/m16, imm16
+		 * C7/0		mov r/m32, imm32
+		 * REX.W + C7/0	mov r/m64, imm32 (sign-extended to 64-bits)
+		 */
+		val = vie->immediate & size2mask[size];
+		error = memwrite(vm, vcpuid, gpa, val, size, arg);
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+emulate_movx(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+	     mem_region_read_t memread, mem_region_write_t memwrite,
+	     void *arg)
+{
+	int error, size;
+	enum vm_reg_name reg;
+	uint64_t val;
+
+	size = vie->opsize;
+	error = EINVAL;
+
+	switch (vie->op.op_byte) {
+	case 0xB6:
+		/*
+		 * MOV and zero extend byte from mem (ModRM:r/m) to
+		 * reg (ModRM:reg).
+		 *
+		 * 0F B6/r		movzx r16, r/m8
+		 * 0F B6/r		movzx r32, r/m8
+		 * REX.W + 0F B6/r	movzx r64, r/m8
+		 */
+
+		/* get the first operand */
+		error = memread(vm, vcpuid, gpa, &val, 1, arg);
+		if (error)
+			break;
+
+		/* get the second operand */
+		reg = gpr_map[vie->reg];
+
+		/* zero-extend byte */
+		val = (uint8_t)val;
+
+		/* write the result */
+		error = vie_update_register(vm, vcpuid, reg, val, size);
+		break;
+	case 0xB7:
+		/*
+		 * MOV and zero extend word from mem (ModRM:r/m) to
+		 * reg (ModRM:reg).
+		 *
+		 * 0F B7/r		movzx r32, r/m16
+		 * REX.W + 0F B7/r	movzx r64, r/m16
+		 */
+		error = memread(vm, vcpuid, gpa, &val, 2, arg);
+		if (error)
+			return (error);
+
+		reg = gpr_map[vie->reg];
+
+		/* zero-extend word */
+		val = (uint16_t)val;
+
+		error = vie_update_register(vm, vcpuid, reg, val, size);
+		break;
+	case 0xBE:
+		/*
+		 * MOV and sign extend byte from mem (ModRM:r/m) to
+		 * reg (ModRM:reg).
+		 *
+		 * 0F BE/r		movsx r16, r/m8
+		 * 0F BE/r		movsx r32, r/m8
+		 * REX.W + 0F BE/r	movsx r64, r/m8
+		 */
+
+		/* get the first operand */
+		error = memread(vm, vcpuid, gpa, &val, 1, arg);
+		if (error)
+			break;
+
+		/* get the second operand */
+		reg = gpr_map[vie->reg];
+
+		/* sign extend byte */
+		val = (int8_t)val;
+
+		/* write the result */
+		error = vie_update_register(vm, vcpuid, reg, val, size);
+		break;
+	default:
+		break;
+	}
+	return (error);
+}
+
+/*
+ * Helper function to calculate and validate a linear address.
+ */
+static int
+get_gla(void *vm, int vcpuid, struct vie *vie, struct vm_guest_paging *paging,
+    int opsize, int addrsize, int prot, enum vm_reg_name seg,
+    enum vm_reg_name gpr, uint64_t *gla, int *fault)
+{
+	struct seg_desc desc;
+	uint64_t cr0, val, rflags;
+	int error;
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_CR0, &cr0);
+	KASSERT(error == 0, ("%s: error %d getting cr0", __func__, error));
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	KASSERT(error == 0, ("%s: error %d getting rflags", __func__, error));
+
+	error = vm_get_seg_desc(vm, vcpuid, seg, &desc);
+	KASSERT(error == 0, ("%s: error %d getting segment descriptor %d",
+	    __func__, error, seg));
+
+	error = vie_read_register(vm, vcpuid, gpr, &val);
+	KASSERT(error == 0, ("%s: error %d getting register %d", __func__,
+	    error, gpr));
+
+	if (vie_calculate_gla(paging->cpu_mode, seg, &desc, val, opsize,
+	    addrsize, prot, gla)) {
+		if (seg == VM_REG_GUEST_SS)
+			vm_inject_ss(vm, vcpuid, 0);
+		else
+			vm_inject_gp(vm, vcpuid);
+		goto guest_fault;
+	}
+
+	if (vie_canonical_check(paging->cpu_mode, *gla)) {
+		if (seg == VM_REG_GUEST_SS)
+			vm_inject_ss(vm, vcpuid, 0);
+		else
+			vm_inject_gp(vm, vcpuid);
+		goto guest_fault;
+	}
+
+	if (vie_alignment_check(paging->cpl, opsize, cr0, rflags, *gla)) {
+		vm_inject_ac(vm, vcpuid, 0);
+		goto guest_fault;
+	}
+
+	*fault = 0;
+	return (0);
+
+guest_fault:
+	*fault = 1;
+	return (0);
+}
+
+static int
+emulate_movs(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t memread,
+    mem_region_write_t memwrite, void *arg)
+{
+#ifdef _KERNEL
+	struct vm_copyinfo copyinfo[2];
+#else
+	struct iovec copyinfo[2];
+#endif
+	uint64_t dstaddr, srcaddr, dstgpa, srcgpa, val;
+	uint64_t rcx, rdi, rsi, rflags;
+	int error, fault, opsize, seg, repeat;
+
+	opsize = (vie->op.op_byte == 0xA4) ? 1 : vie->opsize;
+	val = 0;
+	error = 0;
+
+	/*
+	 * XXX although the MOVS instruction is only supposed to be used with
+	 * the "rep" prefix some guests like FreeBSD will use "repnz" instead.
+	 *
+	 * Empirically the "repnz" prefix has identical behavior to "rep"
+	 * and the zero flag does not make a difference.
+	 */
+	repeat = vie->repz_present | vie->repnz_present;
+
+	if (repeat) {
+		error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RCX, &rcx);
+		KASSERT(!error, ("%s: error %d getting rcx", __func__, error));
+
+		/*
+		 * The count register is %rcx, %ecx or %cx depending on the
+		 * address size of the instruction.
+		 */
+		if ((rcx & vie_size2mask(vie->addrsize)) == 0) {
+			error = 0;
+			goto done;
+		}
+	}
+
+	/*
+	 *	Source		Destination	Comments
+	 *	--------------------------------------------
+	 * (1)  memory		memory		n/a
+	 * (2)  memory		mmio		emulated
+	 * (3)  mmio		memory		emulated
+	 * (4)  mmio		mmio		emulated
+	 *
+	 * At this point we don't have sufficient information to distinguish
+	 * between (2), (3) and (4). We use 'vm_copy_setup()' to tease this
+	 * out because it will succeed only when operating on regular memory.
+	 *
+	 * XXX the emulation doesn't properly handle the case where 'gpa'
+	 * is straddling the boundary between the normal memory and MMIO.
+	 */
+
+	seg = vie->segment_override ? vie->segment_register : VM_REG_GUEST_DS;
+	error = get_gla(vm, vcpuid, vie, paging, opsize, vie->addrsize,
+	    PROT_READ, seg, VM_REG_GUEST_RSI, &srcaddr, &fault);
+	if (error || fault)
+		goto done;
+
+	error = vm_copy_setup(vm, vcpuid, paging, srcaddr, opsize, PROT_READ,
+	    copyinfo, nitems(copyinfo), &fault);
+	if (error == 0) {
+		if (fault)
+			goto done;	/* Resume guest to handle fault */
+
+		/*
+		 * case (2): read from system memory and write to mmio.
+		 */
+		vm_copyin(vm, vcpuid, copyinfo, &val, opsize);
+		vm_copy_teardown(vm, vcpuid, copyinfo, nitems(copyinfo));
+		error = memwrite(vm, vcpuid, gpa, val, opsize, arg);
+		if (error)
+			goto done;
+	} else {
+		/*
+		 * 'vm_copy_setup()' is expected to fail for cases (3) and (4)
+		 * if 'srcaddr' is in the mmio space.
+		 */
+
+		error = get_gla(vm, vcpuid, vie, paging, opsize, vie->addrsize,
+		    PROT_WRITE, VM_REG_GUEST_ES, VM_REG_GUEST_RDI, &dstaddr,
+		    &fault);
+		if (error || fault)
+			goto done;
+
+		error = vm_copy_setup(vm, vcpuid, paging, dstaddr, opsize,
+		    PROT_WRITE, copyinfo, nitems(copyinfo), &fault);
+		if (error == 0) {
+			if (fault)
+				goto done;    /* Resume guest to handle fault */
+
+			/*
+			 * case (3): read from MMIO and write to system memory.
+			 *
+			 * A MMIO read can have side-effects so we
+			 * commit to it only after vm_copy_setup() is
+			 * successful. If a page-fault needs to be
+			 * injected into the guest then it will happen
+			 * before the MMIO read is attempted.
+			 */
+			error = memread(vm, vcpuid, gpa, &val, opsize, arg);
+			if (error)
+				goto done;
+
+			vm_copyout(vm, vcpuid, &val, copyinfo, opsize);
+			vm_copy_teardown(vm, vcpuid, copyinfo, nitems(copyinfo));
+		} else {
+			/*
+			 * Case (4): read from and write to mmio.
+			 *
+			 * Commit to the MMIO read/write (with potential
+			 * side-effects) only after we are sure that the
+			 * instruction is not going to be restarted due
+			 * to address translation faults.
+			 */
+			error = vm_gla2gpa(vm, vcpuid, paging, srcaddr,
+			    PROT_READ, &srcgpa, &fault);
+			if (error || fault)
+				goto done;
+
+			error = vm_gla2gpa(vm, vcpuid, paging, dstaddr,
+			   PROT_WRITE, &dstgpa, &fault);
+			if (error || fault)
+				goto done;
+
+			error = memread(vm, vcpuid, srcgpa, &val, opsize, arg);
+			if (error)
+				goto done;
+
+			error = memwrite(vm, vcpuid, dstgpa, val, opsize, arg);
+			if (error)
+				goto done;
+		}
+	}
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RSI, &rsi);
+	KASSERT(error == 0, ("%s: error %d getting rsi", __func__, error));
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RDI, &rdi);
+	KASSERT(error == 0, ("%s: error %d getting rdi", __func__, error));
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	KASSERT(error == 0, ("%s: error %d getting rflags", __func__, error));
+
+	if (rflags & PSL_D) {
+		rsi -= opsize;
+		rdi -= opsize;
+	} else {
+		rsi += opsize;
+		rdi += opsize;
+	}
+
+	error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RSI, rsi,
+	    vie->addrsize);
+	KASSERT(error == 0, ("%s: error %d updating rsi", __func__, error));
+
+	error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RDI, rdi,
+	    vie->addrsize);
+	KASSERT(error == 0, ("%s: error %d updating rdi", __func__, error));
+
+	if (repeat) {
+		rcx = rcx - 1;
+		error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RCX,
+		    rcx, vie->addrsize);
+		KASSERT(!error, ("%s: error %d updating rcx", __func__, error));
+
+		/*
+		 * Repeat the instruction if the count register is not zero.
+		 */
+		if ((rcx & vie_size2mask(vie->addrsize)) != 0)
+			vm_restart_instruction(vm, vcpuid);
+	}
+done:
+	KASSERT(error == 0 || error == EFAULT, ("%s: unexpected error %d",
+	    __func__, error));
+	return (error);
+}
+
+static int
+emulate_stos(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t memread,
+    mem_region_write_t memwrite, void *arg)
+{
+	int error, opsize, repeat;
+	uint64_t val;
+	uint64_t rcx, rdi, rflags;
+
+	opsize = (vie->op.op_byte == 0xAA) ? 1 : vie->opsize;
+	repeat = vie->repz_present | vie->repnz_present;
+
+	if (repeat) {
+		error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RCX, &rcx);
+		KASSERT(!error, ("%s: error %d getting rcx", __func__, error));
+
+		/*
+		 * The count register is %rcx, %ecx or %cx depending on the
+		 * address size of the instruction.
+		 */
+		if ((rcx & vie_size2mask(vie->addrsize)) == 0)
+			return (0);
+	}
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RAX, &val);
+	KASSERT(!error, ("%s: error %d getting rax", __func__, error));
+
+	error = memwrite(vm, vcpuid, gpa, val, opsize, arg);
+	if (error)
+		return (error);
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RDI, &rdi);
+	KASSERT(error == 0, ("%s: error %d getting rdi", __func__, error));
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	KASSERT(error == 0, ("%s: error %d getting rflags", __func__, error));
+
+	if (rflags & PSL_D)
+		rdi -= opsize;
+	else
+		rdi += opsize;
+
+	error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RDI, rdi,
+	    vie->addrsize);
+	KASSERT(error == 0, ("%s: error %d updating rdi", __func__, error));
+
+	if (repeat) {
+		rcx = rcx - 1;
+		error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RCX,
+		    rcx, vie->addrsize);
+		KASSERT(!error, ("%s: error %d updating rcx", __func__, error));
+
+		/*
+		 * Repeat the instruction if the count register is not zero.
+		 */
+		if ((rcx & vie_size2mask(vie->addrsize)) != 0)
+			vm_restart_instruction(vm, vcpuid);
+	}
+
+	return (0);
+}
+
+static int
+emulate_and(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+	    mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
+{
+	int error, size;
+	enum vm_reg_name reg;
+	uint64_t result, rflags, rflags2, val1, val2;
+
+	size = vie->opsize;
+	error = EINVAL;
+
+	switch (vie->op.op_byte) {
+	case 0x23:
+		/*
+		 * AND reg (ModRM:reg) and mem (ModRM:r/m) and store the
+		 * result in reg.
+		 *
+		 * 23/r		and r16, r/m16
+		 * 23/r		and r32, r/m32
+		 * REX.W + 23/r	and r64, r/m64
+		 */
+
+		/* get the first operand */
+		reg = gpr_map[vie->reg];
+		error = vie_read_register(vm, vcpuid, reg, &val1);
+		if (error)
+			break;
+
+		/* get the second operand */
+		error = memread(vm, vcpuid, gpa, &val2, size, arg);
+		if (error)
+			break;
+
+		/* perform the operation and write the result */
+		result = val1 & val2;
+		error = vie_update_register(vm, vcpuid, reg, result, size);
+		break;
+	case 0x81:
+	case 0x83:
+		/*
+		 * AND mem (ModRM:r/m) with immediate and store the
+		 * result in mem.
+		 *
+		 * 81 /4		and r/m16, imm16
+		 * 81 /4		and r/m32, imm32
+		 * REX.W + 81 /4	and r/m64, imm32 sign-extended to 64
+		 *
+		 * 83 /4		and r/m16, imm8 sign-extended to 16
+		 * 83 /4		and r/m32, imm8 sign-extended to 32
+		 * REX.W + 83/4		and r/m64, imm8 sign-extended to 64
+		 */
+
+		/* get the first operand */
+                error = memread(vm, vcpuid, gpa, &val1, size, arg);
+                if (error)
+			break;
+
+                /*
+		 * perform the operation with the pre-fetched immediate
+		 * operand and write the result
+		 */
+                result = val1 & vie->immediate;
+                error = memwrite(vm, vcpuid, gpa, result, size, arg);
+		break;
+	default:
+		break;
+	}
+	if (error)
+		return (error);
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	if (error)
+		return (error);
+
+	/*
+	 * OF and CF are cleared; the SF, ZF and PF flags are set according
+	 * to the result; AF is undefined.
+	 *
+	 * The updated status flags are obtained by subtracting 0 from 'result'.
+	 */
+	rflags2 = getcc(size, result, 0);
+	rflags &= ~RFLAGS_STATUS_BITS;
+	rflags |= rflags2 & (PSL_PF | PSL_Z | PSL_N);
+
+	error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, rflags, 8);
+	return (error);
+}
+
+static int
+emulate_or(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+	    mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
+{
+	int error, size;
+	enum vm_reg_name reg;
+	uint64_t result, rflags, rflags2, val1, val2;
+
+	size = vie->opsize;
+	error = EINVAL;
+
+	switch (vie->op.op_byte) {
+	case 0x0B:
+		/*
+		 * OR reg (ModRM:reg) and mem (ModRM:r/m) and store the
+		 * result in reg.
+		 *
+		 * 0b/r         or r16, r/m16
+		 * 0b/r         or r32, r/m32
+		 * REX.W + 0b/r or r64, r/m64
+		 */
+
+		/* get the first operand */
+		reg = gpr_map[vie->reg];
+		error = vie_read_register(vm, vcpuid, reg, &val1);
+		if (error)
+			break;
+		
+		/* get the second operand */
+		error = memread(vm, vcpuid, gpa, &val2, size, arg);
+		if (error)
+			break;
+
+		/* perform the operation and write the result */
+		result = val1 | val2;
+		error = vie_update_register(vm, vcpuid, reg, result, size);
+		break;
+	case 0x81:
+	case 0x83:
+		/*
+		 * OR mem (ModRM:r/m) with immediate and store the
+		 * result in mem.
+		 *
+		 * 81 /1		or r/m16, imm16
+		 * 81 /1		or r/m32, imm32
+		 * REX.W + 81 /1	or r/m64, imm32 sign-extended to 64
+		 *
+		 * 83 /1		or r/m16, imm8 sign-extended to 16
+		 * 83 /1		or r/m32, imm8 sign-extended to 32
+		 * REX.W + 83/1		or r/m64, imm8 sign-extended to 64
+		 */
+
+		/* get the first operand */
+                error = memread(vm, vcpuid, gpa, &val1, size, arg);
+                if (error)
+			break;
+
+                /*
+		 * perform the operation with the pre-fetched immediate
+		 * operand and write the result
+		 */
+                result = val1 | vie->immediate;
+                error = memwrite(vm, vcpuid, gpa, result, size, arg);
+		break;
+	default:
+		break;
+	}
+	if (error)
+		return (error);
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	if (error)
+		return (error);
+
+	/*
+	 * OF and CF are cleared; the SF, ZF and PF flags are set according
+	 * to the result; AF is undefined.
+	 *
+	 * The updated status flags are obtained by subtracting 0 from 'result'.
+	 */
+	rflags2 = getcc(size, result, 0);
+	rflags &= ~RFLAGS_STATUS_BITS;
+	rflags |= rflags2 & (PSL_PF | PSL_Z | PSL_N);
+
+	error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, rflags, 8);
+	return (error);
+}
+
+static int
+emulate_cmp(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+	    mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
+{
+	int error, size;
+	uint64_t regop, memop, op1, op2, rflags, rflags2;
+	enum vm_reg_name reg;
+
+	size = vie->opsize;
+	switch (vie->op.op_byte) {
+	case 0x39:
+	case 0x3B:
+		/*
+		 * 39/r		CMP r/m16, r16
+		 * 39/r		CMP r/m32, r32
+		 * REX.W 39/r	CMP r/m64, r64
+		 *
+		 * 3B/r		CMP r16, r/m16
+		 * 3B/r		CMP r32, r/m32
+		 * REX.W + 3B/r	CMP r64, r/m64
+		 *
+		 * Compare the first operand with the second operand and
+		 * set status flags in EFLAGS register. The comparison is
+		 * performed by subtracting the second operand from the first
+		 * operand and then setting the status flags.
+		 */
+
+		/* Get the register operand */
+		reg = gpr_map[vie->reg];
+		error = vie_read_register(vm, vcpuid, reg, &regop);
+		if (error)
+			return (error);
+
+		/* Get the memory operand */
+		error = memread(vm, vcpuid, gpa, &memop, size, arg);
+		if (error)
+			return (error);
+
+		if (vie->op.op_byte == 0x3B) {
+			op1 = regop;
+			op2 = memop;
+		} else {
+			op1 = memop;
+			op2 = regop;
+		}
+		rflags2 = getcc(size, op1, op2);
+		break;
+	case 0x80:
+	case 0x81:
+	case 0x83:
+		/*
+		 * 80 /7		cmp r/m8, imm8
+		 * REX + 80 /7		cmp r/m8, imm8
+		 *
+		 * 81 /7		cmp r/m16, imm16
+		 * 81 /7		cmp r/m32, imm32
+		 * REX.W + 81 /7	cmp r/m64, imm32 sign-extended to 64
+		 *
+		 * 83 /7		cmp r/m16, imm8 sign-extended to 16
+		 * 83 /7		cmp r/m32, imm8 sign-extended to 32
+		 * REX.W + 83 /7	cmp r/m64, imm8 sign-extended to 64
+		 *
+		 * Compare mem (ModRM:r/m) with immediate and set
+		 * status flags according to the results.  The
+		 * comparison is performed by subtracting the
+		 * immediate from the first operand and then setting
+		 * the status flags.
+		 *
+		 */
+		if (vie->op.op_byte == 0x80)
+			size = 1;
+
+		/* get the first operand */
+                error = memread(vm, vcpuid, gpa, &op1, size, arg);
+		if (error)
+			return (error);
+
+		rflags2 = getcc(size, op1, vie->immediate);
+		break;
+	default:
+		return (EINVAL);
+	}
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	if (error)
+		return (error);
+	rflags &= ~RFLAGS_STATUS_BITS;
+	rflags |= rflags2 & RFLAGS_STATUS_BITS;
+
+	error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, rflags, 8);
+	return (error);
+}
+
+static int
+emulate_sub(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+	    mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
+{
+	int error, size;
+	uint64_t nval, rflags, rflags2, val1, val2;
+	enum vm_reg_name reg;
+
+	size = vie->opsize;
+	error = EINVAL;
+
+	switch (vie->op.op_byte) {
+	case 0x2B:
+		/*
+		 * SUB r/m from r and store the result in r
+		 * 
+		 * 2B/r            SUB r16, r/m16
+		 * 2B/r            SUB r32, r/m32
+		 * REX.W + 2B/r    SUB r64, r/m64
+		 */
+
+		/* get the first operand */
+		reg = gpr_map[vie->reg];
+		error = vie_read_register(vm, vcpuid, reg, &val1);
+		if (error)
+			break;
+
+		/* get the second operand */
+		error = memread(vm, vcpuid, gpa, &val2, size, arg);
+		if (error)
+			break;
+
+		/* perform the operation and write the result */
+		nval = val1 - val2;
+		error = vie_update_register(vm, vcpuid, reg, nval, size);
+		break;
+	default:
+		break;
+	}
+
+	if (!error) {
+		rflags2 = getcc(size, val1, val2);
+		error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS,
+		    &rflags);
+		if (error)
+			return (error);
+
+		rflags &= ~RFLAGS_STATUS_BITS;
+		rflags |= rflags2 & RFLAGS_STATUS_BITS;
+		error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RFLAGS,
+		    rflags, 8);
+	}
+
+	return (error);
+}
+
+static int
+emulate_stack_op(void *vm, int vcpuid, uint64_t mmio_gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t memread,
+    mem_region_write_t memwrite, void *arg)
+{
+#ifdef _KERNEL
+	struct vm_copyinfo copyinfo[2];
+#else
+	struct iovec copyinfo[2];
+#endif
+	struct seg_desc ss_desc;
+	uint64_t cr0, rflags, rsp, stack_gla, val;
+	int error, fault, size, stackaddrsize, pushop;
+
+	val = 0;
+	size = vie->opsize;
+	pushop = (vie->op.op_type == VIE_OP_TYPE_PUSH) ? 1 : 0;
+
+	/*
+	 * From "Address-Size Attributes for Stack Accesses", Intel SDL, Vol 1
+	 */
+	if (paging->cpu_mode == CPU_MODE_REAL) {
+		stackaddrsize = 2;
+	} else if (paging->cpu_mode == CPU_MODE_64BIT) {
+		/*
+		 * "Stack Manipulation Instructions in 64-bit Mode", SDM, Vol 3
+		 * - Stack pointer size is always 64-bits.
+		 * - PUSH/POP of 32-bit values is not possible in 64-bit mode.
+		 * - 16-bit PUSH/POP is supported by using the operand size
+		 *   override prefix (66H).
+		 */
+		stackaddrsize = 8;
+		size = vie->opsize_override ? 2 : 8;
+	} else {
+		/*
+		 * In protected or compatibility mode the 'B' flag in the
+		 * stack-segment descriptor determines the size of the
+		 * stack pointer.
+		 */
+		error = vm_get_seg_desc(vm, vcpuid, VM_REG_GUEST_SS, &ss_desc);
+		KASSERT(error == 0, ("%s: error %d getting SS descriptor",
+		    __func__, error));
+		if (SEG_DESC_DEF32(ss_desc.access))
+			stackaddrsize = 4;
+		else
+			stackaddrsize = 2;
+	}
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_CR0, &cr0);
+	KASSERT(error == 0, ("%s: error %d getting cr0", __func__, error));
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	KASSERT(error == 0, ("%s: error %d getting rflags", __func__, error));
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RSP, &rsp);
+	KASSERT(error == 0, ("%s: error %d getting rsp", __func__, error));
+	if (pushop) {
+		rsp -= size;
+	}
+
+	if (vie_calculate_gla(paging->cpu_mode, VM_REG_GUEST_SS, &ss_desc,
+	    rsp, size, stackaddrsize, pushop ? PROT_WRITE : PROT_READ,
+	    &stack_gla)) {
+		vm_inject_ss(vm, vcpuid, 0);
+		return (0);
+	}
+
+	if (vie_canonical_check(paging->cpu_mode, stack_gla)) {
+		vm_inject_ss(vm, vcpuid, 0);
+		return (0);
+	}
+
+	if (vie_alignment_check(paging->cpl, size, cr0, rflags, stack_gla)) {
+		vm_inject_ac(vm, vcpuid, 0);
+		return (0);
+	}
+
+	error = vm_copy_setup(vm, vcpuid, paging, stack_gla, size,
+	    pushop ? PROT_WRITE : PROT_READ, copyinfo, nitems(copyinfo),
+	    &fault);
+	if (error || fault)
+		return (error);
+
+	if (pushop) {
+		error = memread(vm, vcpuid, mmio_gpa, &val, size, arg);
+		if (error == 0)
+			vm_copyout(vm, vcpuid, &val, copyinfo, size);
+	} else {
+		vm_copyin(vm, vcpuid, copyinfo, &val, size);
+		error = memwrite(vm, vcpuid, mmio_gpa, val, size, arg);
+		rsp += size;
+	}
+	vm_copy_teardown(vm, vcpuid, copyinfo, nitems(copyinfo));
+
+	if (error == 0) {
+		error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RSP, rsp,
+		    stackaddrsize);
+		KASSERT(error == 0, ("error %d updating rsp", error));
+	}
+	return (error);
+}
+
+static int
+emulate_push(void *vm, int vcpuid, uint64_t mmio_gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t memread,
+    mem_region_write_t memwrite, void *arg)
+{
+	int error;
+
+	/*
+	 * Table A-6, "Opcode Extensions", Intel SDM, Vol 2.
+	 *
+	 * PUSH is part of the group 5 extended opcodes and is identified
+	 * by ModRM:reg = b110.
+	 */
+	if ((vie->reg & 7) != 6)
+		return (EINVAL);
+
+	error = emulate_stack_op(vm, vcpuid, mmio_gpa, vie, paging, memread,
+	    memwrite, arg);
+	return (error);
+}
+
+static int
+emulate_pop(void *vm, int vcpuid, uint64_t mmio_gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t memread,
+    mem_region_write_t memwrite, void *arg)
+{
+	int error;
+
+	/*
+	 * Table A-6, "Opcode Extensions", Intel SDM, Vol 2.
+	 *
+	 * POP is part of the group 1A extended opcodes and is identified
+	 * by ModRM:reg = b000.
+	 */
+	if ((vie->reg & 7) != 0)
+		return (EINVAL);
+
+	error = emulate_stack_op(vm, vcpuid, mmio_gpa, vie, paging, memread,
+	    memwrite, arg);
+	return (error);
+}
+
+static int
+emulate_group1(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t memread,
+    mem_region_write_t memwrite, void *memarg)
+{
+	int error;
+
+	switch (vie->reg & 7) {
+	case 0x1:	/* OR */
+		error = emulate_or(vm, vcpuid, gpa, vie,
+		    memread, memwrite, memarg);
+		break;
+	case 0x4:	/* AND */
+		error = emulate_and(vm, vcpuid, gpa, vie,
+		    memread, memwrite, memarg);
+		break;
+	case 0x7:	/* CMP */
+		error = emulate_cmp(vm, vcpuid, gpa, vie,
+		    memread, memwrite, memarg);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	return (error);
+}
+
+static int
+emulate_bittest(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+    mem_region_read_t memread, mem_region_write_t memwrite, void *memarg)
+{
+	uint64_t val, rflags;
+	int error, bitmask, bitoff;
+
+	/*
+	 * 0F BA is a Group 8 extended opcode.
+	 *
+	 * Currently we only emulate the 'Bit Test' instruction which is
+	 * identified by a ModR/M:reg encoding of 100b.
+	 */
+	if ((vie->reg & 7) != 4)
+		return (EINVAL);
+
+	error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+	KASSERT(error == 0, ("%s: error %d getting rflags", __func__, error));
+
+	error = memread(vm, vcpuid, gpa, &val, vie->opsize, memarg);
+	if (error)
+		return (error);
+
+	/*
+	 * Intel SDM, Vol 2, Table 3-2:
+	 * "Range of Bit Positions Specified by Bit Offset Operands"
+	 */
+	bitmask = vie->opsize * 8 - 1;
+	bitoff = vie->immediate & bitmask;
+
+	/* Copy the bit into the Carry flag in %rflags */
+	if (val & (1UL << bitoff))
+		rflags |= PSL_C;
+	else
+		rflags &= ~PSL_C;
+
+	error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, rflags, 8);
+	KASSERT(error == 0, ("%s: error %d updating rflags", __func__, error));
+
+	return (0);
+}
+
+int
+vmm_emulate_instruction(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t memread,
+    mem_region_write_t memwrite, void *memarg)
+{
+	int error;
+
+	if (!vie->decoded)
+		return (EINVAL);
+
+	switch (vie->op.op_type) {
+	case VIE_OP_TYPE_GROUP1:
+		error = emulate_group1(vm, vcpuid, gpa, vie, paging, memread,
+		    memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_POP:
+		error = emulate_pop(vm, vcpuid, gpa, vie, paging, memread,
+		    memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_PUSH:
+		error = emulate_push(vm, vcpuid, gpa, vie, paging, memread,
+		    memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_CMP:
+		error = emulate_cmp(vm, vcpuid, gpa, vie,
+				    memread, memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_MOV:
+		error = emulate_mov(vm, vcpuid, gpa, vie,
+				    memread, memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_MOVSX:
+	case VIE_OP_TYPE_MOVZX:
+		error = emulate_movx(vm, vcpuid, gpa, vie,
+				     memread, memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_MOVS:
+		error = emulate_movs(vm, vcpuid, gpa, vie, paging, memread,
+		    memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_STOS:
+		error = emulate_stos(vm, vcpuid, gpa, vie, paging, memread,
+		    memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_AND:
+		error = emulate_and(vm, vcpuid, gpa, vie,
+				    memread, memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_OR:
+		error = emulate_or(vm, vcpuid, gpa, vie,
+				    memread, memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_SUB:
+		error = emulate_sub(vm, vcpuid, gpa, vie,
+				    memread, memwrite, memarg);
+		break;
+	case VIE_OP_TYPE_BITTEST:
+		error = emulate_bittest(vm, vcpuid, gpa, vie,
+		    memread, memwrite, memarg);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	return (error);
+}
+
+int
+vie_alignment_check(int cpl, int size, uint64_t cr0, uint64_t rf, uint64_t gla)
+{
+	KASSERT(size == 1 || size == 2 || size == 4 || size == 8,
+	    ("%s: invalid size %d", __func__, size));
+	KASSERT(cpl >= 0 && cpl <= 3, ("%s: invalid cpl %d", __func__, cpl));
+
+	if (cpl != 3 || (cr0 & CR0_AM) == 0 || (rf & PSL_AC) == 0)
+		return (0);
+
+	return ((gla & (size - 1)) ? 1 : 0);
+}
+
+int
+vie_canonical_check(enum vm_cpu_mode cpu_mode, uint64_t gla)
+{
+	uint64_t mask;
+
+	if (cpu_mode != CPU_MODE_64BIT)
+		return (0);
+
+	/*
+	 * The value of the bit 47 in the 'gla' should be replicated in the
+	 * most significant 16 bits.
+	 */
+	mask = ~((1UL << 48) - 1);
+	if (gla & (1UL << 47))
+		return ((gla & mask) != mask);
+	else
+		return ((gla & mask) != 0);
+}
+
+uint64_t
+vie_size2mask(int size)
+{
+	KASSERT(size == 1 || size == 2 || size == 4 || size == 8,
+	    ("vie_size2mask: invalid size %d", size));
+	return (size2mask[size]);
+}
+
+int
+vie_calculate_gla(enum vm_cpu_mode cpu_mode, enum vm_reg_name seg,
+    struct seg_desc *desc, uint64_t offset, int length, int addrsize,
+    int prot, uint64_t *gla)
+{
+	uint64_t firstoff, low_limit, high_limit, segbase;
+	int glasize, type;
+
+	KASSERT(seg >= VM_REG_GUEST_ES && seg <= VM_REG_GUEST_GS,
+	    ("%s: invalid segment %d", __func__, seg));
+	KASSERT(length == 1 || length == 2 || length == 4 || length == 8,
+	    ("%s: invalid operand size %d", __func__, length));
+#ifdef	__FreeBSD__
+	KASSERT((prot & ~(PROT_READ | PROT_WRITE)) == 0,
+	    ("%s: invalid prot %#x", __func__, prot));
+#else
+	KASSERT((prot & ~(PROT_READ | PROT_WRITE)) == 0,
+	    ("%s: invalid prot %x", __func__, prot));
+#endif
+
+	firstoff = offset;
+	if (cpu_mode == CPU_MODE_64BIT) {
+		KASSERT(addrsize == 4 || addrsize == 8, ("%s: invalid address "
+		    "size %d for cpu_mode %d", __func__, addrsize, cpu_mode));
+		glasize = 8;
+	} else {
+		KASSERT(addrsize == 2 || addrsize == 4, ("%s: invalid address "
+		    "size %d for cpu mode %d", __func__, addrsize, cpu_mode));
+		glasize = 4;
+		/*
+		 * If the segment selector is loaded with a NULL selector
+		 * then the descriptor is unusable and attempting to use
+		 * it results in a #GP(0).
+		 */
+		if (SEG_DESC_UNUSABLE(desc->access))
+			return (-1);
+
+		/* 
+		 * The processor generates a #NP exception when a segment
+		 * register is loaded with a selector that points to a
+		 * descriptor that is not present. If this was the case then
+		 * it would have been checked before the VM-exit.
+		 */
+#ifdef	__FreeBSD__
+		KASSERT(SEG_DESC_PRESENT(desc->access),
+		    ("segment %d not present: %#x", seg, desc->access));
+#else
+		KASSERT(SEG_DESC_PRESENT(desc->access),
+		    ("segment %d not present: %x", seg, desc->access));
+#endif
+
+		/*
+		 * The descriptor type must indicate a code/data segment.
+		 */
+		type = SEG_DESC_TYPE(desc->access);
+#ifdef	__FreeBSD__
+		KASSERT(type >= 16 && type <= 31, ("segment %d has invalid "
+		    "descriptor type %#x", seg, type));
+#else
+		KASSERT(type >= 16 && type <= 31, ("segment %d has invalid "
+		    "descriptor type %x", seg, type));
+#endif
+
+		if (prot & PROT_READ) {
+			/* #GP on a read access to a exec-only code segment */
+			if ((type & 0xA) == 0x8)
+				return (-1);
+		}
+
+		if (prot & PROT_WRITE) {
+			/*
+			 * #GP on a write access to a code segment or a
+			 * read-only data segment.
+			 */
+			if (type & 0x8)			/* code segment */
+				return (-1);
+
+			if ((type & 0xA) == 0)		/* read-only data seg */
+				return (-1);
+		}
+
+		/*
+		 * 'desc->limit' is fully expanded taking granularity into
+		 * account.
+		 */
+		if ((type & 0xC) == 0x4) {
+			/* expand-down data segment */
+			low_limit = desc->limit + 1;
+			high_limit = SEG_DESC_DEF32(desc->access) ?
+			    0xffffffff : 0xffff;
+		} else {
+			/* code segment or expand-up data segment */
+			low_limit = 0;
+			high_limit = desc->limit;
+		}
+
+		while (length > 0) {
+			offset &= vie_size2mask(addrsize);
+			if (offset < low_limit || offset > high_limit)
+				return (-1);
+			offset++;
+			length--;
+		}
+	}
+
+	/*
+	 * In 64-bit mode all segments except %fs and %gs have a segment
+	 * base address of 0.
+	 */
+	if (cpu_mode == CPU_MODE_64BIT && seg != VM_REG_GUEST_FS &&
+	    seg != VM_REG_GUEST_GS) {
+		segbase = 0;
+	} else {
+		segbase = desc->base;
+	}
+
+	/*
+	 * Truncate 'firstoff' to the effective address size before adding
+	 * it to the segment base.
+	 */
+	firstoff &= vie_size2mask(addrsize);
+	*gla = (segbase + firstoff) & vie_size2mask(glasize);
+	return (0);
+}
+
+#ifdef _KERNEL
+void
+vie_init(struct vie *vie, const char *inst_bytes, int inst_length)
+{
+	KASSERT(inst_length >= 0 && inst_length <= VIE_INST_SIZE,
+	    ("%s: invalid instruction length (%d)", __func__, inst_length));
+
+	bzero(vie, sizeof(struct vie));
+
+	vie->base_register = VM_REG_LAST;
+	vie->index_register = VM_REG_LAST;
+	vie->segment_register = VM_REG_LAST;
+
+	if (inst_length) {
+		bcopy(inst_bytes, vie->inst, inst_length);
+		vie->num_valid = inst_length;
+	}
+}
+
+static int
+pf_error_code(int usermode, int prot, int rsvd, uint64_t pte)
+{
+	int error_code = 0;
+
+	if (pte & PG_V)
+		error_code |= PGEX_P;
+	if (prot & VM_PROT_WRITE)
+		error_code |= PGEX_W;
+	if (usermode)
+		error_code |= PGEX_U;
+	if (rsvd)
+		error_code |= PGEX_RSV;
+	if (prot & VM_PROT_EXECUTE)
+		error_code |= PGEX_I;
+
+	return (error_code);
+}
+
+static void
+ptp_release(void **cookie)
+{
+	if (*cookie != NULL) {
+		vm_gpa_release(*cookie);
+		*cookie = NULL;
+	}
+}
+
+static void *
+ptp_hold(struct vm *vm, int vcpu, vm_paddr_t ptpphys, size_t len, void **cookie)
+{
+	void *ptr;
+
+	ptp_release(cookie);
+	ptr = vm_gpa_hold(vm, vcpu, ptpphys, len, VM_PROT_RW, cookie);
+	return (ptr);
+}
+
+static int
+_vm_gla2gpa(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t gla, int prot, uint64_t *gpa, int *guest_fault, bool check_only)
+{
+	int nlevels, pfcode, retval, usermode, writable;
+	int ptpshift = 0, ptpindex = 0;
+	uint64_t ptpphys;
+	uint64_t *ptpbase = NULL, pte = 0, pgsize = 0;
+#ifdef	__FreeBSD__
+	u_int retries;
+#endif
+	uint32_t *ptpbase32, pte32;
+	void *cookie;
+
+	*guest_fault = 0;
+
+	usermode = (paging->cpl == 3 ? 1 : 0);
+	writable = prot & VM_PROT_WRITE;
+	cookie = NULL;
+	retval = 0;
+#ifdef	__FreeBSD__
+	retries = 0;
+#endif
+restart:
+	ptpphys = paging->cr3;		/* root of the page tables */
+	ptp_release(&cookie);
+#ifdef	__FreeBSD__
+	if (retries++ > 0)
+		maybe_yield();
+#endif
+
+	if (vie_canonical_check(paging->cpu_mode, gla)) {
+		/*
+		 * XXX assuming a non-stack reference otherwise a stack fault
+		 * should be generated.
+		 */
+		if (!check_only)
+			vm_inject_gp(vm, vcpuid);
+		goto fault;
+	}
+
+	if (paging->paging_mode == PAGING_MODE_FLAT) {
+		*gpa = gla;
+		goto done;
+	}
+
+	if (paging->paging_mode == PAGING_MODE_32) {
+		nlevels = 2;
+		while (--nlevels >= 0) {
+			/* Zero out the lower 12 bits. */
+			ptpphys &= ~0xfff;
+
+			ptpbase32 = ptp_hold(vm, vcpuid, ptpphys, PAGE_SIZE,
+			    &cookie);
+
+			if (ptpbase32 == NULL)
+				goto error;
+
+			ptpshift = PAGE_SHIFT + nlevels * 10;
+			ptpindex = (gla >> ptpshift) & 0x3FF;
+			pgsize = 1UL << ptpshift;
+
+			pte32 = ptpbase32[ptpindex];
+
+			if ((pte32 & PG_V) == 0 ||
+			    (usermode && (pte32 & PG_U) == 0) ||
+			    (writable && (pte32 & PG_RW) == 0)) {
+				if (!check_only) {
+					pfcode = pf_error_code(usermode, prot, 0,
+					    pte32);
+					vm_inject_pf(vm, vcpuid, pfcode, gla);
+				}
+				goto fault;
+			}
+
+			/*
+			 * Emulate the x86 MMU's management of the accessed
+			 * and dirty flags. While the accessed flag is set
+			 * at every level of the page table, the dirty flag
+			 * is only set at the last level providing the guest
+			 * physical address.
+			 */
+			if (!check_only && (pte32 & PG_A) == 0) {
+				if (atomic_cmpset_32(&ptpbase32[ptpindex],
+				    pte32, pte32 | PG_A) == 0) {
+					goto restart;
+				}
+			}
+
+			/* XXX must be ignored if CR4.PSE=0 */
+			if (nlevels > 0 && (pte32 & PG_PS) != 0)
+				break;
+
+			ptpphys = pte32;
+		}
+
+		/* Set the dirty bit in the page table entry if necessary */
+		if (!check_only && writable && (pte32 & PG_M) == 0) {
+			if (atomic_cmpset_32(&ptpbase32[ptpindex],
+			    pte32, pte32 | PG_M) == 0) {
+				goto restart;
+			}
+		}
+
+		/* Zero out the lower 'ptpshift' bits */
+		pte32 >>= ptpshift; pte32 <<= ptpshift;
+		*gpa = pte32 | (gla & (pgsize - 1));
+		goto done;
+	}
+
+	if (paging->paging_mode == PAGING_MODE_PAE) {
+		/* Zero out the lower 5 bits and the upper 32 bits */
+		ptpphys &= 0xffffffe0UL;
+
+		ptpbase = ptp_hold(vm, vcpuid, ptpphys, sizeof(*ptpbase) * 4,
+		    &cookie);
+		if (ptpbase == NULL)
+			goto error;
+
+		ptpindex = (gla >> 30) & 0x3;
+
+		pte = ptpbase[ptpindex];
+
+		if ((pte & PG_V) == 0) {
+			if (!check_only) {
+				pfcode = pf_error_code(usermode, prot, 0, pte);
+				vm_inject_pf(vm, vcpuid, pfcode, gla);
+			}
+			goto fault;
+		}
+
+		ptpphys = pte;
+
+		nlevels = 2;
+	} else
+		nlevels = 4;
+	while (--nlevels >= 0) {
+		/* Zero out the lower 12 bits and the upper 12 bits */
+		ptpphys >>= 12; ptpphys <<= 24; ptpphys >>= 12;
+
+		ptpbase = ptp_hold(vm, vcpuid, ptpphys, PAGE_SIZE, &cookie);
+		if (ptpbase == NULL)
+			goto error;
+
+		ptpshift = PAGE_SHIFT + nlevels * 9;
+		ptpindex = (gla >> ptpshift) & 0x1FF;
+		pgsize = 1UL << ptpshift;
+
+		pte = ptpbase[ptpindex];
+
+		if ((pte & PG_V) == 0 ||
+		    (usermode && (pte & PG_U) == 0) ||
+		    (writable && (pte & PG_RW) == 0)) {
+			if (!check_only) {
+				pfcode = pf_error_code(usermode, prot, 0, pte);
+				vm_inject_pf(vm, vcpuid, pfcode, gla);
+			}
+			goto fault;
+		}
+
+		/* Set the accessed bit in the page table entry */
+		if (!check_only && (pte & PG_A) == 0) {
+			if (atomic_cmpset_64(&ptpbase[ptpindex],
+			    pte, pte | PG_A) == 0) {
+				goto restart;
+			}
+		}
+
+		if (nlevels > 0 && (pte & PG_PS) != 0) {
+			if (pgsize > 1 * GB) {
+				if (!check_only) {
+					pfcode = pf_error_code(usermode, prot, 1,
+					    pte);
+					vm_inject_pf(vm, vcpuid, pfcode, gla);
+				}
+				goto fault;
+			}
+			break;
+		}
+
+		ptpphys = pte;
+	}
+
+	/* Set the dirty bit in the page table entry if necessary */
+	if (!check_only && writable && (pte & PG_M) == 0) {
+		if (atomic_cmpset_64(&ptpbase[ptpindex], pte, pte | PG_M) == 0)
+			goto restart;
+	}
+
+	/* Zero out the lower 'ptpshift' bits and the upper 12 bits */
+	pte >>= ptpshift; pte <<= (ptpshift + 12); pte >>= 12;
+	*gpa = pte | (gla & (pgsize - 1));
+done:
+	ptp_release(&cookie);
+	KASSERT(retval == 0 || retval == EFAULT, ("%s: unexpected retval %d",
+	    __func__, retval));
+	return (retval);
+error:
+	retval = EFAULT;
+	goto done;
+fault:
+	*guest_fault = 1;
+	goto done;
+}
+
+int
+vm_gla2gpa(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t gla, int prot, uint64_t *gpa, int *guest_fault)
+{
+
+	return (_vm_gla2gpa(vm, vcpuid, paging, gla, prot, gpa, guest_fault,
+	    false));
+}
+
+int
+vm_gla2gpa_nofault(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t gla, int prot, uint64_t *gpa, int *guest_fault)
+{
+
+	return (_vm_gla2gpa(vm, vcpuid, paging, gla, prot, gpa, guest_fault,
+	    true));
+}
+
+int
+vmm_fetch_instruction(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t rip, int inst_length, struct vie *vie, int *faultptr)
+{
+	struct vm_copyinfo copyinfo[2];
+	int error, prot;
+
+	if (inst_length > VIE_INST_SIZE)
+		panic("vmm_fetch_instruction: invalid length %d", inst_length);
+
+	prot = PROT_READ | PROT_EXEC;
+	error = vm_copy_setup(vm, vcpuid, paging, rip, inst_length, prot,
+	    copyinfo, nitems(copyinfo), faultptr);
+	if (error || *faultptr)
+		return (error);
+
+	vm_copyin(vm, vcpuid, copyinfo, vie->inst, inst_length);
+	vm_copy_teardown(vm, vcpuid, copyinfo, nitems(copyinfo));
+	vie->num_valid = inst_length;
+	return (0);
+}
+
+static int
+vie_peek(struct vie *vie, uint8_t *x)
+{
+
+	if (vie->num_processed < vie->num_valid) {
+		*x = vie->inst[vie->num_processed];
+		return (0);
+	} else
+		return (-1);
+}
+
+static void
+vie_advance(struct vie *vie)
+{
+
+	vie->num_processed++;
+}
+
+static bool
+segment_override(uint8_t x, int *seg)
+{
+
+	switch (x) {
+	case 0x2E:
+		*seg = VM_REG_GUEST_CS;
+		break;
+	case 0x36:
+		*seg = VM_REG_GUEST_SS;
+		break;
+	case 0x3E:
+		*seg = VM_REG_GUEST_DS;
+		break;
+	case 0x26:
+		*seg = VM_REG_GUEST_ES;
+		break;
+	case 0x64:
+		*seg = VM_REG_GUEST_FS;
+		break;
+	case 0x65:
+		*seg = VM_REG_GUEST_GS;
+		break;
+	default:
+		return (false);
+	}
+	return (true);
+}
+
+static int
+decode_prefixes(struct vie *vie, enum vm_cpu_mode cpu_mode, int cs_d)
+{
+	uint8_t x;
+
+	while (1) {
+		if (vie_peek(vie, &x))
+			return (-1);
+
+		if (x == 0x66)
+			vie->opsize_override = 1;
+		else if (x == 0x67)
+			vie->addrsize_override = 1;
+		else if (x == 0xF3)
+			vie->repz_present = 1;
+		else if (x == 0xF2)
+			vie->repnz_present = 1;
+		else if (segment_override(x, &vie->segment_register))
+			vie->segment_override = 1;
+		else
+			break;
+
+		vie_advance(vie);
+	}
+
+	/*
+	 * From section 2.2.1, "REX Prefixes", Intel SDM Vol 2:
+	 * - Only one REX prefix is allowed per instruction.
+	 * - The REX prefix must immediately precede the opcode byte or the
+	 *   escape opcode byte.
+	 * - If an instruction has a mandatory prefix (0x66, 0xF2 or 0xF3)
+	 *   the mandatory prefix must come before the REX prefix.
+	 */
+	if (cpu_mode == CPU_MODE_64BIT && x >= 0x40 && x <= 0x4F) {
+		vie->rex_present = 1;
+		vie->rex_w = x & 0x8 ? 1 : 0;
+		vie->rex_r = x & 0x4 ? 1 : 0;
+		vie->rex_x = x & 0x2 ? 1 : 0;
+		vie->rex_b = x & 0x1 ? 1 : 0;
+		vie_advance(vie);
+	}
+
+	/*
+	 * Section "Operand-Size And Address-Size Attributes", Intel SDM, Vol 1
+	 */
+	if (cpu_mode == CPU_MODE_64BIT) {
+		/*
+		 * Default address size is 64-bits and default operand size
+		 * is 32-bits.
+		 */
+		vie->addrsize = vie->addrsize_override ? 4 : 8;
+		if (vie->rex_w)
+			vie->opsize = 8;
+		else if (vie->opsize_override)
+			vie->opsize = 2;
+		else
+			vie->opsize = 4;
+	} else if (cs_d) {
+		/* Default address and operand sizes are 32-bits */
+		vie->addrsize = vie->addrsize_override ? 2 : 4;
+		vie->opsize = vie->opsize_override ? 2 : 4;
+	} else {
+		/* Default address and operand sizes are 16-bits */
+		vie->addrsize = vie->addrsize_override ? 4 : 2;
+		vie->opsize = vie->opsize_override ? 4 : 2;
+	}
+	return (0);
+}
+
+static int
+decode_two_byte_opcode(struct vie *vie)
+{
+	uint8_t x;
+
+	if (vie_peek(vie, &x))
+		return (-1);
+
+	vie->op = two_byte_opcodes[x];
+
+	if (vie->op.op_type == VIE_OP_TYPE_NONE)
+		return (-1);
+
+	vie_advance(vie);
+	return (0);
+}
+
+static int
+decode_opcode(struct vie *vie)
+{
+	uint8_t x;
+
+	if (vie_peek(vie, &x))
+		return (-1);
+
+	vie->op = one_byte_opcodes[x];
+
+	if (vie->op.op_type == VIE_OP_TYPE_NONE)
+		return (-1);
+
+	vie_advance(vie);
+
+	if (vie->op.op_type == VIE_OP_TYPE_TWO_BYTE)
+		return (decode_two_byte_opcode(vie));
+
+	return (0);
+}
+
+static int
+decode_modrm(struct vie *vie, enum vm_cpu_mode cpu_mode)
+{
+	uint8_t x;
+
+	if (vie->op.op_flags & VIE_OP_F_NO_MODRM)
+		return (0);
+
+	if (cpu_mode == CPU_MODE_REAL)
+		return (-1);
+
+	if (vie_peek(vie, &x))
+		return (-1);
+
+	vie->mod = (x >> 6) & 0x3;
+	vie->rm =  (x >> 0) & 0x7;
+	vie->reg = (x >> 3) & 0x7;
+
+	/*
+	 * A direct addressing mode makes no sense in the context of an EPT
+	 * fault. There has to be a memory access involved to cause the
+	 * EPT fault.
+	 */
+	if (vie->mod == VIE_MOD_DIRECT)
+		return (-1);
+
+	if ((vie->mod == VIE_MOD_INDIRECT && vie->rm == VIE_RM_DISP32) ||
+	    (vie->mod != VIE_MOD_DIRECT && vie->rm == VIE_RM_SIB)) {
+		/*
+		 * Table 2-5: Special Cases of REX Encodings
+		 *
+		 * mod=0, r/m=5 is used in the compatibility mode to
+		 * indicate a disp32 without a base register.
+		 *
+		 * mod!=3, r/m=4 is used in the compatibility mode to
+		 * indicate that the SIB byte is present.
+		 *
+		 * The 'b' bit in the REX prefix is don't care in
+		 * this case.
+		 */
+	} else {
+		vie->rm |= (vie->rex_b << 3);
+	}
+
+	vie->reg |= (vie->rex_r << 3);
+
+	/* SIB */
+	if (vie->mod != VIE_MOD_DIRECT && vie->rm == VIE_RM_SIB)
+		goto done;
+
+	vie->base_register = gpr_map[vie->rm];
+
+	switch (vie->mod) {
+	case VIE_MOD_INDIRECT_DISP8:
+		vie->disp_bytes = 1;
+		break;
+	case VIE_MOD_INDIRECT_DISP32:
+		vie->disp_bytes = 4;
+		break;
+	case VIE_MOD_INDIRECT:
+		if (vie->rm == VIE_RM_DISP32) {
+			vie->disp_bytes = 4;
+			/*
+			 * Table 2-7. RIP-Relative Addressing
+			 *
+			 * In 64-bit mode mod=00 r/m=101 implies [rip] + disp32
+			 * whereas in compatibility mode it just implies disp32.
+			 */
+
+			if (cpu_mode == CPU_MODE_64BIT)
+				vie->base_register = VM_REG_GUEST_RIP;
+			else
+				vie->base_register = VM_REG_LAST;
+		}
+		break;
+	}
+
+done:
+	vie_advance(vie);
+
+	return (0);
+}
+
+static int
+decode_sib(struct vie *vie)
+{
+	uint8_t x;
+
+	/* Proceed only if SIB byte is present */
+	if (vie->mod == VIE_MOD_DIRECT || vie->rm != VIE_RM_SIB)
+		return (0);
+
+	if (vie_peek(vie, &x))
+		return (-1);
+
+	/* De-construct the SIB byte */
+	vie->ss = (x >> 6) & 0x3;
+	vie->index = (x >> 3) & 0x7;
+	vie->base = (x >> 0) & 0x7;
+
+	/* Apply the REX prefix modifiers */
+	vie->index |= vie->rex_x << 3;
+	vie->base |= vie->rex_b << 3;
+
+	switch (vie->mod) {
+	case VIE_MOD_INDIRECT_DISP8:
+		vie->disp_bytes = 1;
+		break;
+	case VIE_MOD_INDIRECT_DISP32:
+		vie->disp_bytes = 4;
+		break;
+	}
+
+	if (vie->mod == VIE_MOD_INDIRECT &&
+	    (vie->base == 5 || vie->base == 13)) {
+		/*
+		 * Special case when base register is unused if mod = 0
+		 * and base = %rbp or %r13.
+		 *
+		 * Documented in:
+		 * Table 2-3: 32-bit Addressing Forms with the SIB Byte
+		 * Table 2-5: Special Cases of REX Encodings
+		 */
+		vie->disp_bytes = 4;
+	} else {
+		vie->base_register = gpr_map[vie->base];
+	}
+
+	/*
+	 * All encodings of 'index' are valid except for %rsp (4).
+	 *
+	 * Documented in:
+	 * Table 2-3: 32-bit Addressing Forms with the SIB Byte
+	 * Table 2-5: Special Cases of REX Encodings
+	 */
+	if (vie->index != 4)
+		vie->index_register = gpr_map[vie->index];
+
+	/* 'scale' makes sense only in the context of an index register */
+	if (vie->index_register < VM_REG_LAST)
+		vie->scale = 1 << vie->ss;
+
+	vie_advance(vie);
+
+	return (0);
+}
+
+static int
+decode_displacement(struct vie *vie)
+{
+	int n, i;
+	uint8_t x;
+
+	union {
+		char	buf[4];
+		int8_t	signed8;
+		int32_t	signed32;
+	} u;
+
+	if ((n = vie->disp_bytes) == 0)
+		return (0);
+
+	if (n != 1 && n != 4)
+		panic("decode_displacement: invalid disp_bytes %d", n);
+
+	for (i = 0; i < n; i++) {
+		if (vie_peek(vie, &x))
+			return (-1);
+
+		u.buf[i] = x;
+		vie_advance(vie);
+	}
+
+	if (n == 1)
+		vie->displacement = u.signed8;		/* sign-extended */
+	else
+		vie->displacement = u.signed32;		/* sign-extended */
+
+	return (0);
+}
+
+static int
+decode_immediate(struct vie *vie)
+{
+	int i, n;
+	uint8_t x;
+	union {
+		char	buf[4];
+		int8_t	signed8;
+		int16_t	signed16;
+		int32_t	signed32;
+	} u;
+
+	/* Figure out immediate operand size (if any) */
+	if (vie->op.op_flags & VIE_OP_F_IMM) {
+		/*
+		 * Section 2.2.1.5 "Immediates", Intel SDM:
+		 * In 64-bit mode the typical size of immediate operands
+		 * remains 32-bits. When the operand size if 64-bits, the
+		 * processor sign-extends all immediates to 64-bits prior
+		 * to their use.
+		 */
+		if (vie->opsize == 4 || vie->opsize == 8)
+			vie->imm_bytes = 4;
+		else
+			vie->imm_bytes = 2;
+	} else if (vie->op.op_flags & VIE_OP_F_IMM8) {
+		vie->imm_bytes = 1;
+	}
+
+	if ((n = vie->imm_bytes) == 0)
+		return (0);
+
+	KASSERT(n == 1 || n == 2 || n == 4,
+	    ("%s: invalid number of immediate bytes: %d", __func__, n));
+
+	for (i = 0; i < n; i++) {
+		if (vie_peek(vie, &x))
+			return (-1);
+
+		u.buf[i] = x;
+		vie_advance(vie);
+	}
+
+	/* sign-extend the immediate value before use */
+	if (n == 1)
+		vie->immediate = u.signed8;
+	else if (n == 2)
+		vie->immediate = u.signed16;
+	else
+		vie->immediate = u.signed32;
+
+	return (0);
+}
+
+static int
+decode_moffset(struct vie *vie)
+{
+	int i, n;
+	uint8_t x;
+	union {
+		char	buf[8];
+		uint64_t u64;
+	} u;
+
+	if ((vie->op.op_flags & VIE_OP_F_MOFFSET) == 0)
+		return (0);
+
+	/*
+	 * Section 2.2.1.4, "Direct Memory-Offset MOVs", Intel SDM:
+	 * The memory offset size follows the address-size of the instruction.
+	 */
+	n = vie->addrsize;
+	KASSERT(n == 2 || n == 4 || n == 8, ("invalid moffset bytes: %d", n));
+
+	u.u64 = 0;
+	for (i = 0; i < n; i++) {
+		if (vie_peek(vie, &x))
+			return (-1);
+
+		u.buf[i] = x;
+		vie_advance(vie);
+	}
+	vie->displacement = u.u64;
+	return (0);
+}
+
+/*
+ * Verify that the 'guest linear address' provided as collateral of the nested
+ * page table fault matches with our instruction decoding.
+ */
+static int
+verify_gla(struct vm *vm, int cpuid, uint64_t gla, struct vie *vie,
+    enum vm_cpu_mode cpu_mode)
+{
+	int error;
+	uint64_t base, segbase, idx, gla2;
+	enum vm_reg_name seg;
+	struct seg_desc desc;
+
+	/* Skip 'gla' verification */
+	if (gla == VIE_INVALID_GLA)
+		return (0);
+
+	base = 0;
+	if (vie->base_register != VM_REG_LAST) {
+		error = vm_get_register(vm, cpuid, vie->base_register, &base);
+		if (error) {
+			printf("verify_gla: error %d getting base reg %d\n",
+				error, vie->base_register);
+			return (-1);
+		}
+
+		/*
+		 * RIP-relative addressing starts from the following
+		 * instruction
+		 */
+		if (vie->base_register == VM_REG_GUEST_RIP)
+			base += vie->num_processed;
+	}
+
+	idx = 0;
+	if (vie->index_register != VM_REG_LAST) {
+		error = vm_get_register(vm, cpuid, vie->index_register, &idx);
+		if (error) {
+			printf("verify_gla: error %d getting index reg %d\n",
+				error, vie->index_register);
+			return (-1);
+		}
+	}
+
+	/*
+	 * From "Specifying a Segment Selector", Intel SDM, Vol 1
+	 *
+	 * In 64-bit mode, segmentation is generally (but not
+	 * completely) disabled.  The exceptions are the FS and GS
+	 * segments.
+	 *
+	 * In legacy IA-32 mode, when the ESP or EBP register is used
+	 * as the base, the SS segment is the default segment.  For
+	 * other data references, except when relative to stack or
+	 * string destination the DS segment is the default.  These
+	 * can be overridden to allow other segments to be accessed.
+	 */
+	if (vie->segment_override)
+		seg = vie->segment_register;
+	else if (vie->base_register == VM_REG_GUEST_RSP ||
+	    vie->base_register == VM_REG_GUEST_RBP)
+		seg = VM_REG_GUEST_SS;
+	else
+		seg = VM_REG_GUEST_DS;
+	if (cpu_mode == CPU_MODE_64BIT && seg != VM_REG_GUEST_FS &&
+	    seg != VM_REG_GUEST_GS) {
+		segbase = 0;
+	} else {
+		error = vm_get_seg_desc(vm, cpuid, seg, &desc);
+		if (error) {
+			printf("verify_gla: error %d getting segment"
+			       " descriptor %d", error,
+			       vie->segment_register);
+			return (-1);
+		}
+		segbase = desc.base;
+	}
+
+	gla2 = segbase + base + vie->scale * idx + vie->displacement;
+	gla2 &= size2mask[vie->addrsize];
+	if (gla != gla2) {
+		printf("verify_gla mismatch: segbase(0x%0lx)"
+		       "base(0x%0lx), scale(%d), index(0x%0lx), "
+		       "disp(0x%0lx), gla(0x%0lx), gla2(0x%0lx)\n",
+		       segbase, base, vie->scale, idx, vie->displacement,
+		       gla, gla2);
+		return (-1);
+	}
+
+	return (0);
+}
+
+int
+vmm_decode_instruction(struct vm *vm, int cpuid, uint64_t gla,
+		       enum vm_cpu_mode cpu_mode, int cs_d, struct vie *vie)
+{
+
+	if (decode_prefixes(vie, cpu_mode, cs_d))
+		return (-1);
+
+	if (decode_opcode(vie))
+		return (-1);
+
+	if (decode_modrm(vie, cpu_mode))
+		return (-1);
+
+	if (decode_sib(vie))
+		return (-1);
+
+	if (decode_displacement(vie))
+		return (-1);
+
+	if (decode_immediate(vie))
+		return (-1);
+
+	if (decode_moffset(vie))
+		return (-1);
+
+	if ((vie->op.op_flags & VIE_OP_F_NO_GLA_VERIFICATION) == 0) {
+		if (verify_gla(vm, cpuid, gla, vie, cpu_mode))
+			return (-1);
+	}
+
+	vie->decoded = 1;	/* success */
+
+	return (0);
+}
+#endif	/* _KERNEL */
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_ioport.c b/usr/src/uts/i86pc/io/vmm/vmm_ioport.c
new file mode 100644
index 0000000000..934e01a38f
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_ioport.c
@@ -0,0 +1,202 @@
+/*-
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+
+#include <machine/vmm.h>
+#include <machine/vmm_instruction_emul.h>
+
+#include "vatpic.h"
+#include "vatpit.h"
+#include "vpmtmr.h"
+#include "vrtc.h"
+#include "vmm_ioport.h"
+#include "vmm_ktr.h"
+
+#define	MAX_IOPORTS		1280
+
+ioport_handler_func_t ioport_handler[MAX_IOPORTS] = {
+	[TIMER_MODE] = vatpit_handler,
+	[TIMER_CNTR0] = vatpit_handler,
+	[TIMER_CNTR1] = vatpit_handler,
+	[TIMER_CNTR2] = vatpit_handler,
+	[NMISC_PORT] = vatpit_nmisc_handler,
+	[IO_ICU1] = vatpic_master_handler,
+	[IO_ICU1 + ICU_IMR_OFFSET] = vatpic_master_handler,
+	[IO_ICU2] = vatpic_slave_handler,
+	[IO_ICU2 + ICU_IMR_OFFSET] = vatpic_slave_handler,
+	[IO_ELCR1] = vatpic_elc_handler,
+	[IO_ELCR2] = vatpic_elc_handler,
+	[IO_PMTMR] = vpmtmr_handler,
+	[IO_RTC] = vrtc_addr_handler,
+	[IO_RTC + 1] = vrtc_data_handler,
+};
+
+#ifdef KTR
+static const char *
+inout_instruction(struct vm_exit *vmexit)
+{
+	int index;
+
+	static const char *iodesc[] = {
+		"outb", "outw", "outl",
+		"inb", "inw", "inl",
+		"outsb", "outsw", "outsd",
+		"insb", "insw", "insd",
+	};
+
+	switch (vmexit->u.inout.bytes) {
+	case 1:
+		index = 0;
+		break;
+	case 2:
+		index = 1;
+		break;
+	default:
+		index = 2;
+		break;
+	}
+
+	if (vmexit->u.inout.in)
+		index += 3;
+
+	if (vmexit->u.inout.string)
+		index += 6;
+
+	KASSERT(index < nitems(iodesc), ("%s: invalid index %d",
+	    __func__, index));
+
+	return (iodesc[index]);
+}
+#endif	/* KTR */
+
+static int
+emulate_inout_port(struct vm *vm, int vcpuid, struct vm_exit *vmexit,
+    bool *retu)
+{
+	ioport_handler_func_t handler;
+	uint32_t mask, val;
+	int error;
+
+#ifdef __FreeBSD__
+	/*
+	 * If there is no handler for the I/O port then punt to userspace.
+	 */
+	if (vmexit->u.inout.port >= MAX_IOPORTS ||
+	    (handler = ioport_handler[vmexit->u.inout.port]) == NULL) {
+		*retu = true;
+		return (0);
+	}
+#else /* __FreeBSD__ */
+	handler = NULL;
+	if (vmexit->u.inout.port < MAX_IOPORTS) {
+		handler = ioport_handler[vmexit->u.inout.port];
+	}
+	/* Look for hooks, if a standard handler is not present */
+	if (handler == NULL) {
+		mask = vie_size2mask(vmexit->u.inout.bytes);
+		if (!vmexit->u.inout.in) {
+			val = vmexit->u.inout.eax & mask;
+		}
+		error = vm_ioport_handle_hook(vm, vcpuid, vmexit->u.inout.in,
+		    vmexit->u.inout.port, vmexit->u.inout.bytes, &val);
+		if (error == 0) {
+			goto finish;
+		}
+
+		*retu = true;
+		return (0);
+	}
+
+#endif /* __FreeBSD__ */
+
+	mask = vie_size2mask(vmexit->u.inout.bytes);
+
+	if (!vmexit->u.inout.in) {
+		val = vmexit->u.inout.eax & mask;
+	}
+
+	error = (*handler)(vm, vcpuid, vmexit->u.inout.in,
+	    vmexit->u.inout.port, vmexit->u.inout.bytes, &val);
+	if (error) {
+		/*
+		 * The value returned by this function is also the return value
+		 * of vm_run(). This needs to be a positive number otherwise it
+		 * can be interpreted as a "pseudo-error" like ERESTART.
+		 *
+		 * Enforce this by mapping all errors to EIO.
+		 */
+		return (EIO);
+	}
+
+#ifndef __FreeBSD__
+finish:
+#endif /* __FreeBSD__ */
+	if (vmexit->u.inout.in) {
+		vmexit->u.inout.eax &= ~mask;
+		vmexit->u.inout.eax |= val & mask;
+		error = vm_set_register(vm, vcpuid, VM_REG_GUEST_RAX,
+		    vmexit->u.inout.eax);
+		KASSERT(error == 0, ("emulate_ioport: error %d setting guest "
+		    "rax register", error));
+	}
+	*retu = false;
+	return (0);
+}
+
+static int
+emulate_inout_str(struct vm *vm, int vcpuid, struct vm_exit *vmexit, bool *retu)
+{
+	*retu = true;
+	return (0);	/* Return to userspace to finish emulation */
+}
+
+int
+vm_handle_inout(struct vm *vm, int vcpuid, struct vm_exit *vmexit, bool *retu)
+{
+	int bytes, error;
+
+	bytes = vmexit->u.inout.bytes;
+	KASSERT(bytes == 1 || bytes == 2 || bytes == 4,
+	    ("vm_handle_inout: invalid operand size %d", bytes));
+
+	if (vmexit->u.inout.string)
+		error = emulate_inout_str(vm, vcpuid, vmexit, retu);
+	else
+		error = emulate_inout_port(vm, vcpuid, vmexit, retu);
+
+	VCPU_CTR4(vm, vcpuid, "%s%s 0x%04x: %s",
+	    vmexit->u.inout.rep ? "rep " : "",
+	    inout_instruction(vmexit),
+	    vmexit->u.inout.port,
+	    error ? "error" : (*retu ? "userspace" : "handled"));
+
+	return (error);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_ioport.h b/usr/src/uts/i86pc/io/vmm/vmm_ioport.h
new file mode 100644
index 0000000000..ba51989b1a
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_ioport.h
@@ -0,0 +1,37 @@
+/*-
+ * Copyright (c) 2014 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_VMM_IOPORT_H_
+#define	_VMM_IOPORT_H_
+
+typedef int (*ioport_handler_func_t)(struct vm *vm, int vcpuid,
+    bool in, int port, int bytes, uint32_t *val);
+
+int vm_handle_inout(struct vm *vm, int vcpuid, struct vm_exit *vme, bool *retu);
+
+#endif	/* _VMM_IOPORT_H_ */
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_ktr.h b/usr/src/uts/i86pc/io/vmm/vmm_ktr.h
new file mode 100644
index 0000000000..414d0341cc
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_ktr.h
@@ -0,0 +1,71 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VMM_KTR_H_
+#define	_VMM_KTR_H_
+
+#include <sys/ktr.h>
+#include <sys/pcpu.h>
+
+#ifndef KTR_VMM
+#define	KTR_VMM	KTR_GEN
+#endif
+
+#define	VCPU_CTR0(vm, vcpuid, format)					\
+CTR2(KTR_VMM, "vm %s[%d]: " format, vm_name((vm)), (vcpuid))
+
+#define	VCPU_CTR1(vm, vcpuid, format, p1)				\
+CTR3(KTR_VMM, "vm %s[%d]: " format, vm_name((vm)), (vcpuid), (p1))
+
+#define	VCPU_CTR2(vm, vcpuid, format, p1, p2)				\
+CTR4(KTR_VMM, "vm %s[%d]: " format, vm_name((vm)), (vcpuid), (p1), (p2))
+
+#define	VCPU_CTR3(vm, vcpuid, format, p1, p2, p3)			\
+CTR5(KTR_VMM, "vm %s[%d]: " format, vm_name((vm)), (vcpuid), (p1), (p2), (p3))
+
+#define	VCPU_CTR4(vm, vcpuid, format, p1, p2, p3, p4)			\
+CTR6(KTR_VMM, "vm %s[%d]: " format, vm_name((vm)), (vcpuid),		\
+    (p1), (p2), (p3), (p4))
+
+#define	VM_CTR0(vm, format)						\
+CTR1(KTR_VMM, "vm %s: " format, vm_name((vm)))
+
+#define	VM_CTR1(vm, format, p1)						\
+CTR2(KTR_VMM, "vm %s: " format, vm_name((vm)), (p1))
+
+#define	VM_CTR2(vm, format, p1, p2)					\
+CTR3(KTR_VMM, "vm %s: " format, vm_name((vm)), (p1), (p2))
+
+#define	VM_CTR3(vm, format, p1, p2, p3)					\
+CTR4(KTR_VMM, "vm %s: " format, vm_name((vm)), (p1), (p2), (p3))
+
+#define	VM_CTR4(vm, format, p1, p2, p3, p4)				\
+CTR5(KTR_VMM, "vm %s: " format, vm_name((vm)), (p1), (p2), (p3), (p4))
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_lapic.c b/usr/src/uts/i86pc/io/vmm/vmm_lapic.c
new file mode 100644
index 0000000000..7cafc0755e
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_lapic.c
@@ -0,0 +1,261 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/smp.h>
+
+#include <x86/specialreg.h>
+#include <x86/apicreg.h>
+
+#include <machine/vmm.h>
+#include "vmm_ktr.h"
+#include "vmm_lapic.h"
+#include "vlapic.h"
+
+/*
+ * Some MSI message definitions
+ */
+#define	MSI_X86_ADDR_MASK	0xfff00000
+#define	MSI_X86_ADDR_BASE	0xfee00000
+#define	MSI_X86_ADDR_RH		0x00000008	/* Redirection Hint */
+#define	MSI_X86_ADDR_LOG	0x00000004	/* Destination Mode */
+
+int
+lapic_set_intr(struct vm *vm, int cpu, int vector, bool level)
+{
+	struct vlapic *vlapic;
+
+	if (cpu < 0 || cpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	/*
+	 * According to section "Maskable Hardware Interrupts" in Intel SDM
+	 * vectors 16 through 255 can be delivered through the local APIC.
+	 */
+	if (vector < 16 || vector > 255)
+		return (EINVAL);
+
+	vlapic = vm_lapic(vm, cpu);
+	if (vlapic_set_intr_ready(vlapic, vector, level))
+		vcpu_notify_event(vm, cpu, true);
+	return (0);
+}
+
+int
+lapic_set_local_intr(struct vm *vm, int cpu, int vector)
+{
+	struct vlapic *vlapic;
+	cpuset_t dmask;
+	int error;
+
+	if (cpu < -1 || cpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	if (cpu == -1)
+		dmask = vm_active_cpus(vm);
+	else
+		CPU_SETOF(cpu, &dmask);
+	error = 0;
+	while ((cpu = CPU_FFS(&dmask)) != 0) {
+		cpu--;
+		CPU_CLR(cpu, &dmask);
+		vlapic = vm_lapic(vm, cpu);
+		error = vlapic_trigger_lvt(vlapic, vector);
+		if (error)
+			break;
+	}
+
+	return (error);
+}
+
+int
+lapic_intr_msi(struct vm *vm, uint64_t addr, uint64_t msg)
+{
+	int delmode, vec;
+	uint32_t dest;
+	bool phys;
+
+	VM_CTR2(vm, "lapic MSI addr: %#lx msg: %#lx", addr, msg);
+
+	if ((addr & MSI_X86_ADDR_MASK) != MSI_X86_ADDR_BASE) {
+		VM_CTR1(vm, "lapic MSI invalid addr %#lx", addr);
+		return (-1);
+	}
+
+	/*
+	 * Extract the x86-specific fields from the MSI addr/msg
+	 * params according to the Intel Arch spec, Vol3 Ch 10.
+	 *
+	 * The PCI specification does not support level triggered
+	 * MSI/MSI-X so ignore trigger level in 'msg'.
+	 *
+	 * The 'dest' is interpreted as a logical APIC ID if both
+	 * the Redirection Hint and Destination Mode are '1' and
+	 * physical otherwise.
+	 */
+	dest = (addr >> 12) & 0xff;
+	phys = ((addr & (MSI_X86_ADDR_RH | MSI_X86_ADDR_LOG)) !=
+	    (MSI_X86_ADDR_RH | MSI_X86_ADDR_LOG));
+	delmode = msg & APIC_DELMODE_MASK;
+	vec = msg & 0xff;
+
+	VM_CTR3(vm, "lapic MSI %s dest %#x, vec %d",
+	    phys ? "physical" : "logical", dest, vec);
+
+	vlapic_deliver_intr(vm, LAPIC_TRIG_EDGE, dest, phys, delmode, vec);
+	return (0);
+}
+
+static boolean_t
+x2apic_msr(u_int msr)
+{
+	if (msr >= 0x800 && msr <= 0xBFF)
+		return (TRUE);
+	else
+		return (FALSE);
+}
+
+static u_int
+x2apic_msr_to_regoff(u_int msr)
+{
+
+	return ((msr - 0x800) << 4);
+}
+
+boolean_t
+lapic_msr(u_int msr)
+{
+
+	if (x2apic_msr(msr) || (msr == MSR_APICBASE))
+		return (TRUE);
+	else
+		return (FALSE);
+}
+
+int
+lapic_rdmsr(struct vm *vm, int cpu, u_int msr, uint64_t *rval, bool *retu)
+{
+	int error;
+	u_int offset;
+	struct vlapic *vlapic;
+
+	vlapic = vm_lapic(vm, cpu);
+
+	if (msr == MSR_APICBASE) {
+		*rval = vlapic_get_apicbase(vlapic);
+		error = 0;
+	} else {
+		offset = x2apic_msr_to_regoff(msr);
+		error = vlapic_read(vlapic, 0, offset, rval, retu);
+	}
+
+	return (error);
+}
+
+int
+lapic_wrmsr(struct vm *vm, int cpu, u_int msr, uint64_t val, bool *retu)
+{
+	int error;
+	u_int offset;
+	struct vlapic *vlapic;
+
+	vlapic = vm_lapic(vm, cpu);
+
+	if (msr == MSR_APICBASE) {
+		error = vlapic_set_apicbase(vlapic, val);
+	} else {
+		offset = x2apic_msr_to_regoff(msr);
+		error = vlapic_write(vlapic, 0, offset, val, retu);
+	}
+
+	return (error);
+}
+
+int
+lapic_mmio_write(void *vm, int cpu, uint64_t gpa, uint64_t wval, int size,
+		 void *arg)
+{
+	int error;
+	uint64_t off;
+	struct vlapic *vlapic;
+
+	off = gpa - DEFAULT_APIC_BASE;
+
+	/*
+	 * Memory mapped local apic accesses must be 4 bytes wide and
+	 * aligned on a 16-byte boundary.
+	 */
+	if (size != 4 || off & 0xf)
+		return (EINVAL);
+
+	vlapic = vm_lapic(vm, cpu);
+	error = vlapic_write(vlapic, 1, off, wval, arg);
+	return (error);
+}
+
+int
+lapic_mmio_read(void *vm, int cpu, uint64_t gpa, uint64_t *rval, int size,
+		void *arg)
+{
+	int error;
+	uint64_t off;
+	struct vlapic *vlapic;
+
+	off = gpa - DEFAULT_APIC_BASE;
+
+	/*
+	 * Memory mapped local apic accesses should be aligned on a
+	 * 16-byte boundary.  They are also suggested to be 4 bytes
+	 * wide, alas not all OSes follow suggestions.
+	 */
+	off &= ~3;
+	if (off & 0xf)
+		return (EINVAL);
+
+	vlapic = vm_lapic(vm, cpu);
+	error = vlapic_read(vlapic, 1, off, rval, arg);
+	return (error);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_lapic.h b/usr/src/uts/i86pc/io/vmm/vmm_lapic.h
new file mode 100644
index 0000000000..da3b0ff660
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_lapic.h
@@ -0,0 +1,89 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#ifndef _VMM_LAPIC_H_
+#define	_VMM_LAPIC_H_
+
+struct vm;
+
+boolean_t lapic_msr(u_int num);
+int	lapic_rdmsr(struct vm *vm, int cpu, u_int msr, uint64_t *rval,
+	    bool *retu);
+int	lapic_wrmsr(struct vm *vm, int cpu, u_int msr, uint64_t wval,
+	    bool *retu);
+
+int	lapic_mmio_read(void *vm, int cpu, uint64_t gpa,
+			uint64_t *rval, int size, void *arg);
+int	lapic_mmio_write(void *vm, int cpu, uint64_t gpa,
+			 uint64_t wval, int size, void *arg);
+
+/*
+ * Signals to the LAPIC that an interrupt at 'vector' needs to be generated
+ * to the 'cpu', the state is recorded in IRR.
+ */
+int	lapic_set_intr(struct vm *vm, int cpu, int vector, bool trig);
+
+#define	LAPIC_TRIG_LEVEL	true
+#define	LAPIC_TRIG_EDGE		false
+static __inline int
+lapic_intr_level(struct vm *vm, int cpu, int vector)
+{
+
+	return (lapic_set_intr(vm, cpu, vector, LAPIC_TRIG_LEVEL));
+}
+
+static __inline int
+lapic_intr_edge(struct vm *vm, int cpu, int vector)
+{
+
+	return (lapic_set_intr(vm, cpu, vector, LAPIC_TRIG_EDGE));
+}
+
+/*
+ * Triggers the LAPIC local interrupt (LVT) 'vector' on 'cpu'.  'cpu' can
+ * be set to -1 to trigger the interrupt on all CPUs.
+ */
+int	lapic_set_local_intr(struct vm *vm, int cpu, int vector);
+
+int	lapic_intr_msi(struct vm *vm, uint64_t addr, uint64_t msg);
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_mem.c b/usr/src/uts/i86pc/io/vmm/vmm_mem.c
new file mode 100644
index 0000000000..a736d94bba
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_mem.c
@@ -0,0 +1,124 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/sglist.h>
+#include <sys/lock.h>
+#include <sys/rwlock.h>
+
+#include <vm/vm.h>
+#include <vm/vm_param.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+#include <vm/vm_page.h>
+#include <vm/vm_pager.h>
+
+#include <machine/md_var.h>
+
+#include "vmm_mem.h"
+
+int
+vmm_mem_init(void)
+{
+
+	return (0);
+}
+
+vm_object_t
+vmm_mmio_alloc(struct vmspace *vmspace, vm_paddr_t gpa, size_t len,
+	       vm_paddr_t hpa)
+{
+	int error;
+	vm_object_t obj;
+	struct sglist *sg;
+
+	sg = sglist_alloc(1, M_WAITOK);
+	error = sglist_append_phys(sg, hpa, len);
+	KASSERT(error == 0, ("error %d appending physaddr to sglist", error));
+
+	obj = vm_pager_allocate(OBJT_SG, sg, len, VM_PROT_RW, 0, NULL);
+	if (obj != NULL) {
+		/*
+		 * VT-x ignores the MTRR settings when figuring out the
+		 * memory type for translations obtained through EPT.
+		 *
+		 * Therefore we explicitly force the pages provided by
+		 * this object to be mapped as uncacheable.
+		 */
+		VM_OBJECT_WLOCK(obj);
+		error = vm_object_set_memattr(obj, VM_MEMATTR_UNCACHEABLE);
+		VM_OBJECT_WUNLOCK(obj);
+		if (error != KERN_SUCCESS) {
+			panic("vmm_mmio_alloc: vm_object_set_memattr error %d",
+				error);
+		}
+		error = vm_map_find(&vmspace->vm_map, obj, 0, &gpa, len, 0,
+				    VMFS_NO_SPACE, VM_PROT_RW, VM_PROT_RW, 0);
+		if (error != KERN_SUCCESS) {
+			vm_object_deallocate(obj);
+			obj = NULL;
+		}
+	}
+
+	/*
+	 * Drop the reference on the sglist.
+	 *
+	 * If the scatter/gather object was successfully allocated then it
+	 * has incremented the reference count on the sglist. Dropping the
+	 * initial reference count ensures that the sglist will be freed
+	 * when the object is deallocated.
+	 * 
+	 * If the object could not be allocated then we end up freeing the
+	 * sglist.
+	 */
+	sglist_free(sg);
+
+	return (obj);
+}
+
+void
+vmm_mmio_free(struct vmspace *vmspace, vm_paddr_t gpa, size_t len)
+{
+
+	vm_map_remove(&vmspace->vm_map, gpa, gpa + len);
+}
+
+vm_paddr_t
+vmm_mem_maxaddr(void)
+{
+
+	return (ptoa(Maxmem));
+}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_mem.h b/usr/src/uts/i86pc/io/vmm/vmm_mem.h
new file mode 100644
index 0000000000..e6f88fb222
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_mem.h
@@ -0,0 +1,55 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#ifndef	_VMM_MEM_H_
+#define	_VMM_MEM_H_
+
+struct vmspace;
+struct vm_object;
+
+int		vmm_mem_init(void);
+struct vm_object *vmm_mmio_alloc(struct vmspace *, vm_paddr_t gpa, size_t len,
+				 vm_paddr_t hpa);
+void		vmm_mmio_free(struct vmspace *, vm_paddr_t gpa, size_t size);
+vm_paddr_t	vmm_mem_maxaddr(void);
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_sol_dev.c b/usr/src/uts/i86pc/io/vmm/vmm_sol_dev.c
new file mode 100644
index 0000000000..3c0d9beec2
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_sol_dev.c
@@ -0,0 +1,2066 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/conf.h>
+#include <sys/cpuvar.h>
+#include <sys/ioccom.h>
+#include <sys/stat.h>
+#include <sys/vmsystm.h>
+#include <sys/ddi.h>
+#include <sys/mkdev.h>
+#include <sys/sunddi.h>
+#include <sys/fs/dv_node.h>
+#include <sys/pc_hvm.h>
+#include <sys/cpuset.h>
+#include <sys/id_space.h>
+#include <sys/fs/sdev_plugin.h>
+#include <sys/ht.h>
+
+#include <sys/kernel.h>
+
+#include <sys/vmm.h>
+#include <sys/vmm_instruction_emul.h>
+#include <sys/vmm_dev.h>
+#include <sys/vmm_impl.h>
+#include <sys/vmm_drv.h>
+
+#include <vm/vm.h>
+#include <vm/seg_dev.h>
+
+#include "io/ppt.h"
+#include "io/vatpic.h"
+#include "io/vioapic.h"
+#include "io/vrtc.h"
+#include "io/vhpet.h"
+#include "vmm_lapic.h"
+#include "vmm_stat.h"
+#include "vmm_util.h"
+#include "vm/vm_glue.h"
+
+/*
+ * Locking order:
+ *
+ * vmmdev_mtx (driver holds etc.)
+ *  ->sdev_contents (/dev/vmm)
+ *   vmm_mtx (VM list)
+ */
+
+static dev_info_t *vmm_dip;
+static void *vmm_statep;
+
+static kmutex_t		vmmdev_mtx;
+static id_space_t	*vmmdev_minors;
+static uint_t		vmmdev_inst_count = 0;
+static boolean_t	vmmdev_load_failure;
+static kmutex_t		vmm_mtx;
+static list_t		vmmdev_list;
+
+static const char *vmmdev_hvm_name = "bhyve";
+
+/*
+ * For sdev plugin (/dev)
+ */
+#define	VMM_SDEV_ROOT "/dev/vmm"
+static sdev_plugin_hdl_t vmm_sdev_hdl;
+
+/* From uts/i86pc/io/vmm/intel/vmx.c */
+extern int vmx_x86_supported(char **);
+
+/* Holds and hooks from drivers external to vmm */
+struct vmm_hold {
+	list_node_t	vmh_node;
+	vmm_softc_t	*vmh_sc;
+	boolean_t	vmh_expired;
+	uint_t		vmh_ioport_hook_cnt;
+};
+
+static int vmm_drv_block_hook(vmm_softc_t *, boolean_t);
+
+static int
+vmmdev_get_memseg(vmm_softc_t *sc, struct vm_memseg *mseg)
+{
+	int error;
+	bool sysmem;
+
+	error = vm_get_memseg(sc->vmm_vm, mseg->segid, &mseg->len, &sysmem,
+	    NULL);
+	if (error || mseg->len == 0)
+		return (error);
+
+	if (!sysmem) {
+		vmm_devmem_entry_t *de;
+		list_t *dl = &sc->vmm_devmem_list;
+
+		for (de = list_head(dl); de != NULL; de = list_next(dl, de)) {
+			if (de->vde_segid == mseg->segid) {
+				break;
+			}
+		}
+		if (de != NULL) {
+			(void) strlcpy(mseg->name, de->vde_name,
+			    sizeof (mseg->name));
+		}
+	} else {
+		bzero(mseg->name, sizeof (mseg->name));
+	}
+
+	return (error);
+}
+
+/*
+ * The 'devmem' hack:
+ *
+ * On native FreeBSD, bhyve consumers are allowed to create 'devmem' segments
+ * in the vm which appear with their own name related to the vm under /dev.
+ * Since this would be a hassle from an sdev perspective and would require a
+ * new cdev interface (or complicate the existing one), we choose to implement
+ * this in a different manner.  When 'devmem' mappings are created, an
+ * identifying off_t is communicated back out to userspace.  That off_t,
+ * residing above the normal guest memory space, can be used to mmap the
+ * 'devmem' mapping from the already-open vm device.
+ */
+
+static int
+vmmdev_devmem_create(vmm_softc_t *sc, struct vm_memseg *mseg, const char *name)
+{
+	off_t map_offset;
+	vmm_devmem_entry_t *entry;
+
+	if (list_is_empty(&sc->vmm_devmem_list)) {
+		map_offset = VM_DEVMEM_START;
+	} else {
+		entry = list_tail(&sc->vmm_devmem_list);
+		map_offset = entry->vde_off + entry->vde_len;
+		if (map_offset < entry->vde_off) {
+			/* Do not tolerate overflow */
+			return (ERANGE);
+		}
+		/*
+		 * XXXJOY: We could choose to search the list for duplicate
+		 * names and toss an error.  Since we're using the offset
+		 * method for now, it does not make much of a difference.
+		 */
+	}
+
+	entry = kmem_zalloc(sizeof (*entry), KM_SLEEP);
+	entry->vde_segid = mseg->segid;
+	entry->vde_len = mseg->len;
+	entry->vde_off = map_offset;
+	(void) strlcpy(entry->vde_name, name, sizeof (entry->vde_name));
+	list_insert_tail(&sc->vmm_devmem_list, entry);
+
+	return (0);
+}
+
+static boolean_t
+vmmdev_devmem_segid(vmm_softc_t *sc, off_t off, off_t len, int *segidp)
+{
+	list_t *dl = &sc->vmm_devmem_list;
+	vmm_devmem_entry_t *de = NULL;
+
+	VERIFY(off >= VM_DEVMEM_START);
+
+	for (de = list_head(dl); de != NULL; de = list_next(dl, de)) {
+		/* XXX: Only hit on direct offset/length matches for now */
+		if (de->vde_off == off && de->vde_len == len) {
+			break;
+		}
+	}
+	if (de == NULL) {
+		return (B_FALSE);
+	}
+
+	*segidp = de->vde_segid;
+	return (B_TRUE);
+}
+
+static void
+vmmdev_devmem_purge(vmm_softc_t *sc)
+{
+	vmm_devmem_entry_t *entry;
+
+	while ((entry = list_remove_head(&sc->vmm_devmem_list)) != NULL) {
+		kmem_free(entry, sizeof (*entry));
+	}
+}
+
+static int
+vmmdev_alloc_memseg(vmm_softc_t *sc, struct vm_memseg *mseg)
+{
+	int error;
+	bool sysmem = true;
+
+	if (VM_MEMSEG_NAME(mseg)) {
+		sysmem = false;
+	}
+	error = vm_alloc_memseg(sc->vmm_vm, mseg->segid, mseg->len, sysmem);
+
+	if (error == 0 && VM_MEMSEG_NAME(mseg)) {
+		/*
+		 * Rather than create a whole fresh device from which userspace
+		 * can mmap this segment, instead make it available at an
+		 * offset above where the main guest memory resides.
+		 */
+		error = vmmdev_devmem_create(sc, mseg, mseg->name);
+		if (error != 0) {
+			vm_free_memseg(sc->vmm_vm, mseg->segid);
+		}
+	}
+	return (error);
+}
+
+
+static int
+vcpu_lock_one(vmm_softc_t *sc, int vcpu)
+{
+	int error;
+
+	if (vcpu < 0 || vcpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	error = vcpu_set_state(sc->vmm_vm, vcpu, VCPU_FROZEN, true);
+	return (error);
+}
+
+static void
+vcpu_unlock_one(vmm_softc_t *sc, int vcpu)
+{
+	enum vcpu_state state;
+
+	state = vcpu_get_state(sc->vmm_vm, vcpu, NULL);
+	if (state != VCPU_FROZEN) {
+		panic("vcpu %s(%d) has invalid state %d", vm_name(sc->vmm_vm),
+		    vcpu, state);
+	}
+
+	vcpu_set_state(sc->vmm_vm, vcpu, VCPU_IDLE, false);
+}
+
+static int
+vcpu_lock_all(vmm_softc_t *sc)
+{
+	int error, vcpu;
+
+	for (vcpu = 0; vcpu < VM_MAXCPU; vcpu++) {
+		error = vcpu_lock_one(sc, vcpu);
+		if (error)
+			break;
+	}
+
+	if (error) {
+		while (--vcpu >= 0)
+			vcpu_unlock_one(sc, vcpu);
+	}
+
+	return (error);
+}
+
+static void
+vcpu_unlock_all(vmm_softc_t *sc)
+{
+	int vcpu;
+
+	for (vcpu = 0; vcpu < VM_MAXCPU; vcpu++)
+		vcpu_unlock_one(sc, vcpu);
+}
+
+static int
+vmmdev_do_ioctl(vmm_softc_t *sc, int cmd, intptr_t arg, int md,
+    cred_t *credp, int *rvalp)
+{
+	int error = 0, vcpu = -1;
+	void *datap = (void *)arg;
+	boolean_t locked_one = B_FALSE, locked_all = B_FALSE;
+
+	/*
+	 * Some VMM ioctls can operate only on vcpus that are not running.
+	 */
+	switch (cmd) {
+	case VM_RUN:
+	case VM_GET_REGISTER:
+	case VM_SET_REGISTER:
+	case VM_GET_SEGMENT_DESCRIPTOR:
+	case VM_SET_SEGMENT_DESCRIPTOR:
+	case VM_GET_REGISTER_SET:
+	case VM_SET_REGISTER_SET:
+	case VM_INJECT_EXCEPTION:
+	case VM_GET_CAPABILITY:
+	case VM_SET_CAPABILITY:
+	case VM_PPTDEV_MSI:
+	case VM_PPTDEV_MSIX:
+	case VM_SET_X2APIC_STATE:
+	case VM_GLA2GPA:
+	case VM_GLA2GPA_NOFAULT:
+	case VM_ACTIVATE_CPU:
+	case VM_SET_INTINFO:
+	case VM_GET_INTINFO:
+	case VM_RESTART_INSTRUCTION:
+		/*
+		 * Copy in the ID of the vCPU chosen for this operation.
+		 * Since a nefarious caller could update their struct between
+		 * this locking and when the rest of the ioctl data is copied
+		 * in, it is _critical_ that this local 'vcpu' variable be used
+		 * rather than the in-struct one when performing the ioctl.
+		 */
+		if (ddi_copyin(datap, &vcpu, sizeof (vcpu), md)) {
+			return (EFAULT);
+		}
+		if (vcpu < 0 || vcpu >= VM_MAXCPU) {
+			error = EINVAL;
+			goto done;
+		}
+
+		error = vcpu_lock_one(sc, vcpu);
+		if (error)
+			goto done;
+		locked_one = B_TRUE;
+		break;
+
+	case VM_MAP_PPTDEV_MMIO:
+	case VM_BIND_PPTDEV:
+	case VM_UNBIND_PPTDEV:
+	case VM_ALLOC_MEMSEG:
+	case VM_MMAP_MEMSEG:
+	case VM_REINIT:
+		/*
+		 * All vCPUs must be prevented from running when performing
+		 * operations which act upon the entire VM.
+		 */
+		error = vcpu_lock_all(sc);
+		if (error)
+			goto done;
+		locked_all = B_TRUE;
+		break;
+
+	case VM_GET_MEMSEG:
+	case VM_MMAP_GETNEXT:
+#ifndef __FreeBSD__
+	case VM_DEVMEM_GETOFFSET:
+#endif
+		/*
+		 * Lock a vcpu to make sure that the memory map cannot be
+		 * modified while it is being inspected.
+		 */
+		vcpu = VM_MAXCPU - 1;
+		error = vcpu_lock_one(sc, vcpu);
+		if (error)
+			goto done;
+		locked_one = B_TRUE;
+		break;
+
+	default:
+		break;
+	}
+
+	switch (cmd) {
+	case VM_RUN: {
+		struct vm_run vmrun;
+
+		if (ddi_copyin(datap, &vmrun, sizeof (vmrun), md)) {
+			error = EFAULT;
+			break;
+		}
+		vmrun.cpuid = vcpu;
+
+		if (!(curthread->t_schedflag & TS_VCPU))
+			ht_mark_as_vcpu();
+
+		error = vm_run(sc->vmm_vm, &vmrun);
+		/*
+		 * XXXJOY: I think it's necessary to do copyout, even in the
+		 * face of errors, since the exit state is communicated out.
+		 */
+		if (ddi_copyout(&vmrun, datap, sizeof (vmrun), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_SUSPEND: {
+		struct vm_suspend vmsuspend;
+
+		if (ddi_copyin(datap, &vmsuspend, sizeof (vmsuspend), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_suspend(sc->vmm_vm, vmsuspend.how);
+		break;
+	}
+	case VM_REINIT:
+		if ((error = vmm_drv_block_hook(sc, B_TRUE)) != 0) {
+			/*
+			 * The VM instance should be free of driver-attached
+			 * hooks during the reinitialization process.
+			 */
+			break;
+		}
+		error = vm_reinit(sc->vmm_vm);
+		(void) vmm_drv_block_hook(sc, B_FALSE);
+		break;
+	case VM_STAT_DESC: {
+		struct vm_stat_desc statdesc;
+
+		if (ddi_copyin(datap, &statdesc, sizeof (statdesc), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vmm_stat_desc_copy(statdesc.index, statdesc.desc,
+		    sizeof (statdesc.desc));
+		if (error == 0 &&
+		    ddi_copyout(&statdesc, datap, sizeof (statdesc), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_STATS_IOC: {
+		struct vm_stats vmstats;
+
+		CTASSERT(MAX_VM_STATS >= MAX_VMM_STAT_ELEMS);
+		if (ddi_copyin(datap, &vmstats, sizeof (vmstats), md)) {
+			error = EFAULT;
+			break;
+		}
+		hrt2tv(gethrtime(), &vmstats.tv);
+		error = vmm_stat_copy(sc->vmm_vm, vmstats.cpuid,
+		    &vmstats.num_entries, vmstats.statbuf);
+		if (error == 0 &&
+		    ddi_copyout(&vmstats, datap, sizeof (vmstats), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+
+	case VM_PPTDEV_MSI: {
+		struct vm_pptdev_msi pptmsi;
+
+		if (ddi_copyin(datap, &pptmsi, sizeof (pptmsi), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = ppt_setup_msi(sc->vmm_vm, pptmsi.vcpu, pptmsi.pptfd,
+		    pptmsi.addr, pptmsi.msg, pptmsi.numvec);
+		break;
+	}
+	case VM_PPTDEV_MSIX: {
+		struct vm_pptdev_msix pptmsix;
+
+		if (ddi_copyin(datap, &pptmsix, sizeof (pptmsix), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = ppt_setup_msix(sc->vmm_vm, pptmsix.vcpu, pptmsix.pptfd,
+		    pptmsix.idx, pptmsix.addr, pptmsix.msg,
+		    pptmsix.vector_control);
+		break;
+	}
+	case VM_MAP_PPTDEV_MMIO: {
+		struct vm_pptdev_mmio pptmmio;
+
+		if (ddi_copyin(datap, &pptmmio, sizeof (pptmmio), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = ppt_map_mmio(sc->vmm_vm, pptmmio.pptfd, pptmmio.gpa,
+		    pptmmio.len, pptmmio.hpa);
+		break;
+	}
+	case VM_BIND_PPTDEV: {
+		struct vm_pptdev pptdev;
+
+		if (ddi_copyin(datap, &pptdev, sizeof (pptdev), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_assign_pptdev(sc->vmm_vm, pptdev.pptfd);
+		break;
+	}
+	case VM_UNBIND_PPTDEV: {
+		struct vm_pptdev pptdev;
+
+		if (ddi_copyin(datap, &pptdev, sizeof (pptdev), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_unassign_pptdev(sc->vmm_vm, pptdev.pptfd);
+		break;
+	}
+	case VM_GET_PPTDEV_LIMITS: {
+		struct vm_pptdev_limits pptlimits;
+
+		if (ddi_copyin(datap, &pptlimits, sizeof (pptlimits), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = ppt_get_limits(sc->vmm_vm, pptlimits.pptfd,
+		    &pptlimits.msi_limit, &pptlimits.msix_limit);
+		if (error == 0 &&
+		    ddi_copyout(&pptlimits, datap, sizeof (pptlimits), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_INJECT_EXCEPTION: {
+		struct vm_exception vmexc;
+		if (ddi_copyin(datap, &vmexc, sizeof (vmexc), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_inject_exception(sc->vmm_vm, vcpu, vmexc.vector,
+		    vmexc.error_code_valid, vmexc.error_code,
+		    vmexc.restart_instruction);
+		break;
+	}
+	case VM_INJECT_NMI: {
+		struct vm_nmi vmnmi;
+
+		if (ddi_copyin(datap, &vmnmi, sizeof (vmnmi), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_inject_nmi(sc->vmm_vm, vmnmi.cpuid);
+		break;
+	}
+	case VM_LAPIC_IRQ: {
+		struct vm_lapic_irq vmirq;
+
+		if (ddi_copyin(datap, &vmirq, sizeof (vmirq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = lapic_intr_edge(sc->vmm_vm, vmirq.cpuid, vmirq.vector);
+		break;
+	}
+	case VM_LAPIC_LOCAL_IRQ: {
+		struct vm_lapic_irq vmirq;
+
+		if (ddi_copyin(datap, &vmirq, sizeof (vmirq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = lapic_set_local_intr(sc->vmm_vm, vmirq.cpuid,
+		    vmirq.vector);
+		break;
+	}
+	case VM_LAPIC_MSI: {
+		struct vm_lapic_msi vmmsi;
+
+		if (ddi_copyin(datap, &vmmsi, sizeof (vmmsi), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = lapic_intr_msi(sc->vmm_vm, vmmsi.addr, vmmsi.msg);
+		break;
+	}
+
+	case VM_IOAPIC_ASSERT_IRQ: {
+		struct vm_ioapic_irq ioapic_irq;
+
+		if (ddi_copyin(datap, &ioapic_irq, sizeof (ioapic_irq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vioapic_assert_irq(sc->vmm_vm, ioapic_irq.irq);
+		break;
+	}
+	case VM_IOAPIC_DEASSERT_IRQ: {
+		struct vm_ioapic_irq ioapic_irq;
+
+		if (ddi_copyin(datap, &ioapic_irq, sizeof (ioapic_irq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vioapic_deassert_irq(sc->vmm_vm, ioapic_irq.irq);
+		break;
+	}
+	case VM_IOAPIC_PULSE_IRQ: {
+		struct vm_ioapic_irq ioapic_irq;
+
+		if (ddi_copyin(datap, &ioapic_irq, sizeof (ioapic_irq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vioapic_pulse_irq(sc->vmm_vm, ioapic_irq.irq);
+		break;
+	}
+	case VM_IOAPIC_PINCOUNT: {
+		int pincount;
+
+		pincount = vioapic_pincount(sc->vmm_vm);
+		if (ddi_copyout(&pincount, datap, sizeof (int), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+
+	case VM_ISA_ASSERT_IRQ: {
+		struct vm_isa_irq isa_irq;
+
+		if (ddi_copyin(datap, &isa_irq, sizeof (isa_irq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vatpic_assert_irq(sc->vmm_vm, isa_irq.atpic_irq);
+		if (error == 0 && isa_irq.ioapic_irq != -1) {
+			error = vioapic_assert_irq(sc->vmm_vm,
+			    isa_irq.ioapic_irq);
+		}
+		break;
+	}
+	case VM_ISA_DEASSERT_IRQ: {
+		struct vm_isa_irq isa_irq;
+
+		if (ddi_copyin(datap, &isa_irq, sizeof (isa_irq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vatpic_deassert_irq(sc->vmm_vm, isa_irq.atpic_irq);
+		if (error == 0 && isa_irq.ioapic_irq != -1) {
+			error = vioapic_deassert_irq(sc->vmm_vm,
+			    isa_irq.ioapic_irq);
+		}
+		break;
+	}
+	case VM_ISA_PULSE_IRQ: {
+		struct vm_isa_irq isa_irq;
+
+		if (ddi_copyin(datap, &isa_irq, sizeof (isa_irq), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vatpic_pulse_irq(sc->vmm_vm, isa_irq.atpic_irq);
+		if (error == 0 && isa_irq.ioapic_irq != -1) {
+			error = vioapic_pulse_irq(sc->vmm_vm,
+			    isa_irq.ioapic_irq);
+		}
+		break;
+	}
+	case VM_ISA_SET_IRQ_TRIGGER: {
+		struct vm_isa_irq_trigger isa_irq_trigger;
+
+		if (ddi_copyin(datap, &isa_irq_trigger,
+		    sizeof (isa_irq_trigger), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vatpic_set_irq_trigger(sc->vmm_vm,
+		    isa_irq_trigger.atpic_irq, isa_irq_trigger.trigger);
+		break;
+	}
+
+	case VM_MMAP_GETNEXT: {
+		struct vm_memmap mm;
+
+		if (ddi_copyin(datap, &mm, sizeof (mm), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_mmap_getnext(sc->vmm_vm, &mm.gpa, &mm.segid,
+		    &mm.segoff, &mm.len, &mm.prot, &mm.flags);
+		if (error == 0 && ddi_copyout(&mm, datap, sizeof (mm), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_MMAP_MEMSEG: {
+		struct vm_memmap mm;
+
+		if (ddi_copyin(datap, &mm, sizeof (mm), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_mmap_memseg(sc->vmm_vm, mm.gpa, mm.segid, mm.segoff,
+		    mm.len, mm.prot, mm.flags);
+		break;
+	}
+	case VM_ALLOC_MEMSEG: {
+		struct vm_memseg vmseg;
+
+		if (ddi_copyin(datap, &vmseg, sizeof (vmseg), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vmmdev_alloc_memseg(sc, &vmseg);
+		break;
+	}
+	case VM_GET_MEMSEG: {
+		struct vm_memseg vmseg;
+
+		if (ddi_copyin(datap, &vmseg, sizeof (vmseg), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vmmdev_get_memseg(sc, &vmseg);
+		if (error == 0 &&
+		    ddi_copyout(&vmseg, datap, sizeof (vmseg), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_GET_REGISTER: {
+		struct vm_register vmreg;
+
+		if (ddi_copyin(datap, &vmreg, sizeof (vmreg), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_get_register(sc->vmm_vm, vcpu, vmreg.regnum,
+		    &vmreg.regval);
+		if (error == 0 &&
+		    ddi_copyout(&vmreg, datap, sizeof (vmreg), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_SET_REGISTER: {
+		struct vm_register vmreg;
+
+		if (ddi_copyin(datap, &vmreg, sizeof (vmreg), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_set_register(sc->vmm_vm, vcpu, vmreg.regnum,
+		    vmreg.regval);
+		break;
+	}
+	case VM_SET_SEGMENT_DESCRIPTOR: {
+		struct vm_seg_desc vmsegd;
+
+		if (ddi_copyin(datap, &vmsegd, sizeof (vmsegd), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_set_seg_desc(sc->vmm_vm, vcpu, vmsegd.regnum,
+		    &vmsegd.desc);
+		break;
+	}
+	case VM_GET_SEGMENT_DESCRIPTOR: {
+		struct vm_seg_desc vmsegd;
+
+		if (ddi_copyin(datap, &vmsegd, sizeof (vmsegd), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_get_seg_desc(sc->vmm_vm, vcpu, vmsegd.regnum,
+		    &vmsegd.desc);
+		if (error == 0 &&
+		    ddi_copyout(&vmsegd, datap, sizeof (vmsegd), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_GET_REGISTER_SET: {
+		struct vm_register_set vrs;
+		int regnums[VM_REG_LAST];
+		uint64_t regvals[VM_REG_LAST];
+
+		if (ddi_copyin(datap, &vrs, sizeof (vrs), md)) {
+			error = EFAULT;
+			break;
+		}
+		if (vrs.count > VM_REG_LAST || vrs.count == 0) {
+			error = EINVAL;
+			break;
+		}
+		if (ddi_copyin(vrs.regnums, regnums,
+		    sizeof (int) * vrs.count, md)) {
+			error = EFAULT;
+			break;
+		}
+
+		error = 0;
+		for (uint_t i = 0; i < vrs.count && error == 0; i++) {
+			if (regnums[i] < 0) {
+				error = EINVAL;
+				break;
+			}
+			error = vm_get_register(sc->vmm_vm, vcpu, regnums[i],
+			    &regvals[i]);
+		}
+		if (error == 0 && ddi_copyout(regvals, vrs.regvals,
+		    sizeof (uint64_t) * vrs.count, md)) {
+			error = EFAULT;
+		}
+		break;
+	}
+	case VM_SET_REGISTER_SET: {
+		struct vm_register_set vrs;
+		int regnums[VM_REG_LAST];
+		uint64_t regvals[VM_REG_LAST];
+
+		if (ddi_copyin(datap, &vrs, sizeof (vrs), md)) {
+			error = EFAULT;
+			break;
+		}
+		if (vrs.count > VM_REG_LAST || vrs.count == 0) {
+			error = EINVAL;
+			break;
+		}
+		if (ddi_copyin(vrs.regnums, regnums,
+		    sizeof (int) * vrs.count, md)) {
+			error = EFAULT;
+			break;
+		}
+		if (ddi_copyin(vrs.regvals, regvals,
+		    sizeof (uint64_t) * vrs.count, md)) {
+			error = EFAULT;
+			break;
+		}
+
+		error = 0;
+		for (uint_t i = 0; i < vrs.count && error == 0; i++) {
+			/*
+			 * Setting registers in a set is not atomic, since a
+			 * failure in the middle of the set will cause a
+			 * bail-out and inconsistent register state.  Callers
+			 * should be wary of this.
+			 */
+			if (regnums[i] < 0) {
+				error = EINVAL;
+				break;
+			}
+			error = vm_set_register(sc->vmm_vm, vcpu, regnums[i],
+			    regvals[i]);
+		}
+		break;
+	}
+
+	case VM_GET_CAPABILITY: {
+		struct vm_capability vmcap;
+
+		if (ddi_copyin(datap, &vmcap, sizeof (vmcap), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_get_capability(sc->vmm_vm, vcpu, vmcap.captype,
+		    &vmcap.capval);
+		if (error == 0 &&
+		    ddi_copyout(&vmcap, datap, sizeof (vmcap), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_SET_CAPABILITY: {
+		struct vm_capability vmcap;
+
+		if (ddi_copyin(datap, &vmcap, sizeof (vmcap), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_set_capability(sc->vmm_vm, vcpu, vmcap.captype,
+		    vmcap.capval);
+		break;
+	}
+	case VM_SET_X2APIC_STATE: {
+		struct vm_x2apic x2apic;
+
+		if (ddi_copyin(datap, &x2apic, sizeof (x2apic), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_set_x2apic_state(sc->vmm_vm, vcpu, x2apic.state);
+		break;
+	}
+	case VM_GET_X2APIC_STATE: {
+		struct vm_x2apic x2apic;
+
+		if (ddi_copyin(datap, &x2apic, sizeof (x2apic), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_get_x2apic_state(sc->vmm_vm, x2apic.cpuid,
+		    &x2apic.state);
+		if (error == 0 &&
+		    ddi_copyout(&x2apic, datap, sizeof (x2apic), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_GET_GPA_PMAP: {
+		struct vm_gpa_pte gpapte;
+
+		if (ddi_copyin(datap, &gpapte, sizeof (gpapte), md)) {
+			error = EFAULT;
+			break;
+		}
+#ifdef __FreeBSD__
+		/* XXXJOY: add function? */
+		pmap_get_mapping(vmspace_pmap(vm_get_vmspace(sc->vmm_vm)),
+		    gpapte.gpa, gpapte.pte, &gpapte.ptenum);
+#endif
+		error = 0;
+		break;
+	}
+	case VM_GET_HPET_CAPABILITIES: {
+		struct vm_hpet_cap hpetcap;
+
+		error = vhpet_getcap(&hpetcap);
+		if (error == 0 &&
+		    ddi_copyout(&hpetcap, datap, sizeof (hpetcap), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_GLA2GPA: {
+		struct vm_gla2gpa gg;
+
+		CTASSERT(PROT_READ == VM_PROT_READ);
+		CTASSERT(PROT_WRITE == VM_PROT_WRITE);
+		CTASSERT(PROT_EXEC == VM_PROT_EXECUTE);
+
+		if (ddi_copyin(datap, &gg, sizeof (gg), md)) {
+			error = EFAULT;
+			break;
+		}
+		gg.vcpuid = vcpu;
+		error = vm_gla2gpa(sc->vmm_vm, vcpu, &gg.paging, gg.gla,
+		    gg.prot, &gg.gpa, &gg.fault);
+		if (error == 0 && ddi_copyout(&gg, datap, sizeof (gg), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_GLA2GPA_NOFAULT: {
+		struct vm_gla2gpa gg;
+
+		CTASSERT(PROT_READ == VM_PROT_READ);
+		CTASSERT(PROT_WRITE == VM_PROT_WRITE);
+		CTASSERT(PROT_EXEC == VM_PROT_EXECUTE);
+
+		if (ddi_copyin(datap, &gg, sizeof (gg), md)) {
+			error = EFAULT;
+			break;
+		}
+		gg.vcpuid = vcpu;
+		error = vm_gla2gpa_nofault(sc->vmm_vm, vcpu, &gg.paging,
+		    gg.gla, gg.prot, &gg.gpa, &gg.fault);
+		if (error == 0 && ddi_copyout(&gg, datap, sizeof (gg), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+
+	case VM_ACTIVATE_CPU:
+		error = vm_activate_cpu(sc->vmm_vm, vcpu);
+		break;
+	case VM_SUSPEND_CPU:
+		error = vm_suspend_cpu(sc->vmm_vm, vcpu);
+		break;
+	case VM_RESUME_CPU:
+		error = vm_resume_cpu(sc->vmm_vm, vcpu);
+		break;
+
+	case VM_GET_CPUS: {
+		struct vm_cpuset vm_cpuset;
+		cpuset_t tempset;
+		void *srcp = &tempset;
+		int size;
+
+		if (ddi_copyin(datap, &vm_cpuset, sizeof (vm_cpuset), md)) {
+			error = EFAULT;
+			break;
+		}
+
+		/* Be more generous about sizing since our cpuset_t is large. */
+		size = vm_cpuset.cpusetsize;
+		if (size <= 0 || size > sizeof (cpuset_t)) {
+			error = ERANGE;
+		}
+		/*
+		 * If they want a ulong_t or less, make sure they receive the
+		 * low bits with all the useful information.
+		 */
+		if (size <= tempset.cpub[0]) {
+			srcp = &tempset.cpub[0];
+		}
+
+		if (vm_cpuset.which == VM_ACTIVE_CPUS) {
+			tempset = vm_active_cpus(sc->vmm_vm);
+		} else if (vm_cpuset.which == VM_SUSPENDED_CPUS) {
+			tempset = vm_suspended_cpus(sc->vmm_vm);
+		} else if (vm_cpuset.which == VM_DEBUG_CPUS) {
+			tempset = vm_debug_cpus(sc->vmm_vm);
+		} else {
+			error = EINVAL;
+		}
+
+		ASSERT(size > 0 && size <= sizeof (tempset));
+		if (error == 0 &&
+		    ddi_copyout(&tempset, vm_cpuset.cpus, size, md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_SET_INTINFO: {
+		struct vm_intinfo vmii;
+
+		if (ddi_copyin(datap, &vmii, sizeof (vmii), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_exit_intinfo(sc->vmm_vm, vcpu, vmii.info1);
+		break;
+	}
+	case VM_GET_INTINFO: {
+		struct vm_intinfo vmii;
+
+		vmii.vcpuid = vcpu;
+		error = vm_get_intinfo(sc->vmm_vm, vcpu, &vmii.info1,
+		    &vmii.info2);
+		if (error == 0 &&
+		    ddi_copyout(&vmii, datap, sizeof (vmii), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_RTC_WRITE: {
+		struct vm_rtc_data rtcdata;
+
+		if (ddi_copyin(datap, &rtcdata, sizeof (rtcdata), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vrtc_nvram_write(sc->vmm_vm, rtcdata.offset,
+		    rtcdata.value);
+		break;
+	}
+	case VM_RTC_READ: {
+		struct vm_rtc_data rtcdata;
+
+		if (ddi_copyin(datap, &rtcdata, sizeof (rtcdata), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vrtc_nvram_read(sc->vmm_vm, rtcdata.offset,
+		    &rtcdata.value);
+		if (error == 0 &&
+		    ddi_copyout(&rtcdata, datap, sizeof (rtcdata), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+	case VM_RTC_SETTIME: {
+		struct vm_rtc_time rtctime;
+
+		if (ddi_copyin(datap, &rtctime, sizeof (rtctime), md)) {
+			error = EFAULT;
+			break;
+		}
+		error = vrtc_set_time(sc->vmm_vm, rtctime.secs);
+		break;
+	}
+	case VM_RTC_GETTIME: {
+		struct vm_rtc_time rtctime;
+
+		rtctime.secs = vrtc_get_time(sc->vmm_vm);
+		if (ddi_copyout(&rtctime, datap, sizeof (rtctime), md)) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+
+	case VM_RESTART_INSTRUCTION:
+		error = vm_restart_instruction(sc->vmm_vm, vcpu);
+		break;
+
+	case VM_SET_TOPOLOGY: {
+		struct vm_cpu_topology topo;
+
+		if (ddi_copyin(datap, &topo, sizeof (topo), md) != 0) {
+			error = EFAULT;
+			break;
+		}
+		error = vm_set_topology(sc->vmm_vm, topo.sockets, topo.cores,
+		    topo.threads, topo.maxcpus);
+		break;
+	}
+	case VM_GET_TOPOLOGY: {
+		struct vm_cpu_topology topo;
+
+		vm_get_topology(sc->vmm_vm, &topo.sockets, &topo.cores,
+		    &topo.threads, &topo.maxcpus);
+		if (ddi_copyout(&topo, datap, sizeof (topo), md) != 0) {
+			error = EFAULT;
+			break;
+		}
+		break;
+	}
+
+#ifndef __FreeBSD__
+	case VM_DEVMEM_GETOFFSET: {
+		struct vm_devmem_offset vdo;
+		list_t *dl = &sc->vmm_devmem_list;
+		vmm_devmem_entry_t *de = NULL;
+
+		if (ddi_copyin(datap, &vdo, sizeof (vdo), md) != 0) {
+			error = EFAULT;
+			break;
+		}
+
+		for (de = list_head(dl); de != NULL; de = list_next(dl, de)) {
+			if (de->vde_segid == vdo.segid) {
+				break;
+			}
+		}
+		if (de != NULL) {
+			vdo.offset = de->vde_off;
+			if (ddi_copyout(&vdo, datap, sizeof (vdo), md) != 0) {
+				error = EFAULT;
+			}
+		} else {
+			error = ENOENT;
+		}
+		break;
+	}
+#endif
+	default:
+		error = ENOTTY;
+		break;
+	}
+
+	/* Release any vCPUs that were locked for the operation */
+	if (locked_one) {
+		vcpu_unlock_one(sc, vcpu);
+	} else if (locked_all) {
+		vcpu_unlock_all(sc);
+	}
+
+done:
+	/* Make sure that no handler returns a bogus value like ERESTART */
+	KASSERT(error >= 0, ("vmmdev_ioctl: invalid error return %d", error));
+	return (error);
+}
+
+static boolean_t
+vmmdev_mod_incr()
+{
+	ASSERT(MUTEX_HELD(&vmmdev_mtx));
+
+	if (vmmdev_inst_count == 0) {
+		/*
+		 * If the HVM portions of the module failed initialize on a
+		 * previous attempt, do not bother with a retry.  This tracker
+		 * is cleared on module attach, allowing subsequent attempts if
+		 * desired by the user.
+		 */
+		if (vmmdev_load_failure) {
+			return (B_FALSE);
+		}
+
+		if (!hvm_excl_hold(vmmdev_hvm_name)) {
+			return (B_FALSE);
+		}
+		if (vmm_mod_load() != 0) {
+			hvm_excl_rele(vmmdev_hvm_name);
+			vmmdev_load_failure = B_TRUE;
+			return (B_FALSE);
+		}
+	}
+
+	vmmdev_inst_count++;
+	return (B_TRUE);
+}
+
+static void
+vmmdev_mod_decr(void)
+{
+	ASSERT(MUTEX_HELD(&vmmdev_mtx));
+	ASSERT(vmmdev_inst_count > 0);
+
+	vmmdev_inst_count--;
+	if (vmmdev_inst_count == 0) {
+		VERIFY0(vmm_mod_unload());
+		hvm_excl_rele(vmmdev_hvm_name);
+	}
+}
+
+static vmm_softc_t *
+vmm_lookup(const char *name)
+{
+	list_t *vml = &vmmdev_list;
+	vmm_softc_t *sc;
+
+	ASSERT(MUTEX_HELD(&vmm_mtx));
+
+	for (sc = list_head(vml); sc != NULL; sc = list_next(vml, sc)) {
+		if (strcmp(sc->vmm_name, name) == 0) {
+			break;
+		}
+	}
+
+	return (sc);
+}
+
+static int
+vmmdev_do_vm_create(char *name, cred_t *cr)
+{
+	vmm_softc_t	*sc = NULL;
+	minor_t		minor;
+	int		error = ENOMEM;
+
+	if (strnlen(name, VM_MAX_NAMELEN) >= VM_MAX_NAMELEN) {
+		return (EINVAL);
+	}
+
+	mutex_enter(&vmmdev_mtx);
+	if (!vmmdev_mod_incr()) {
+		mutex_exit(&vmmdev_mtx);
+		return (ENXIO);
+	}
+
+	mutex_enter(&vmm_mtx);
+
+	/* Look for duplicates names */
+	if (vmm_lookup(name) != NULL) {
+		mutex_exit(&vmm_mtx);
+		vmmdev_mod_decr();
+		mutex_exit(&vmmdev_mtx);
+		return (EEXIST);
+	}
+
+	/* Allow only one instance per non-global zone. */
+	if (!INGLOBALZONE(curproc)) {
+		for (sc = list_head(&vmmdev_list); sc != NULL;
+		    sc = list_next(&vmmdev_list, sc)) {
+			if (sc->vmm_zone == curzone) {
+				mutex_exit(&vmm_mtx);
+				vmmdev_mod_decr();
+				mutex_exit(&vmmdev_mtx);
+				return (EINVAL);
+			}
+		}
+	}
+
+	minor = id_alloc(vmmdev_minors);
+	if (ddi_soft_state_zalloc(vmm_statep, minor) != DDI_SUCCESS) {
+		goto fail;
+	} else if ((sc = ddi_get_soft_state(vmm_statep, minor)) == NULL) {
+		ddi_soft_state_free(vmm_statep, minor);
+		goto fail;
+	} else if (ddi_create_minor_node(vmm_dip, name, S_IFCHR, minor,
+	    DDI_PSEUDO, 0) != DDI_SUCCESS) {
+		goto fail;
+	}
+
+	error = vm_create(name, &sc->vmm_vm);
+	if (error == 0) {
+		/* Complete VM intialization and report success. */
+		(void) strlcpy(sc->vmm_name, name, sizeof (sc->vmm_name));
+		sc->vmm_minor = minor;
+		list_create(&sc->vmm_devmem_list, sizeof (vmm_devmem_entry_t),
+		    offsetof(vmm_devmem_entry_t, vde_node));
+		list_create(&sc->vmm_holds, sizeof (vmm_hold_t),
+		    offsetof(vmm_hold_t, vmh_node));
+		cv_init(&sc->vmm_cv, NULL, CV_DEFAULT, NULL);
+
+		sc->vmm_zone = crgetzone(cr);
+		zone_hold(sc->vmm_zone);
+		vmm_zsd_add_vm(sc);
+
+		list_insert_tail(&vmmdev_list, sc);
+		mutex_exit(&vmm_mtx);
+		mutex_exit(&vmmdev_mtx);
+		return (0);
+	}
+
+	ddi_remove_minor_node(vmm_dip, name);
+fail:
+	id_free(vmmdev_minors, minor);
+	vmmdev_mod_decr();
+	if (sc != NULL) {
+		ddi_soft_state_free(vmm_statep, minor);
+	}
+
+	mutex_exit(&vmm_mtx);
+	mutex_exit(&vmmdev_mtx);
+	return (error);
+}
+
+int
+vmm_drv_hold(file_t *fp, cred_t *cr, vmm_hold_t **holdp)
+{
+	vnode_t *vp = fp->f_vnode;
+	const dev_t dev = vp->v_rdev;
+	minor_t minor;
+	minor_t major;
+	vmm_softc_t *sc;
+	vmm_hold_t *hold;
+	int err = 0;
+
+	if (vp->v_type != VCHR) {
+		return (ENXIO);
+	}
+	major = getmajor(dev);
+	minor = getminor(dev);
+
+	mutex_enter(&vmmdev_mtx);
+	if (vmm_dip == NULL) {
+		err = ENOENT;
+		goto out;
+	}
+	if (major != ddi_driver_major(vmm_dip) ||
+	    (sc = ddi_get_soft_state(vmm_statep, minor)) == NULL) {
+		err = ENOENT;
+		goto out;
+	}
+	/* XXXJOY: check cred permissions against instance */
+
+	if ((sc->vmm_flags & (VMM_CLEANUP|VMM_PURGED)) != 0) {
+		err = EBUSY;
+		goto out;
+	}
+
+	hold = kmem_zalloc(sizeof (*hold), KM_SLEEP);
+	hold->vmh_sc = sc;
+	hold->vmh_expired = B_FALSE;
+	list_insert_tail(&sc->vmm_holds, hold);
+	sc->vmm_flags |= VMM_HELD;
+	*holdp = hold;
+
+out:
+	mutex_exit(&vmmdev_mtx);
+	return (err);
+}
+
+void
+vmm_drv_rele(vmm_hold_t *hold)
+{
+	vmm_softc_t *sc;
+
+	ASSERT(hold != NULL);
+	ASSERT(hold->vmh_sc != NULL);
+	VERIFY(hold->vmh_ioport_hook_cnt == 0);
+
+	mutex_enter(&vmmdev_mtx);
+	sc = hold->vmh_sc;
+	list_remove(&sc->vmm_holds, hold);
+	if (list_is_empty(&sc->vmm_holds)) {
+		sc->vmm_flags &= ~VMM_HELD;
+		cv_broadcast(&sc->vmm_cv);
+	}
+	mutex_exit(&vmmdev_mtx);
+	kmem_free(hold, sizeof (*hold));
+}
+
+boolean_t
+vmm_drv_expired(vmm_hold_t *hold)
+{
+	ASSERT(hold != NULL);
+
+	return (hold->vmh_expired);
+}
+
+void *
+vmm_drv_gpa2kva(vmm_hold_t *hold, uintptr_t gpa, size_t sz)
+{
+	struct vm *vm;
+	struct vmspace *vmspace;
+
+	ASSERT(hold != NULL);
+
+	vm = hold->vmh_sc->vmm_vm;
+	vmspace = vm_get_vmspace(vm);
+
+	return (vmspace_find_kva(vmspace, gpa, sz));
+}
+
+int
+vmm_drv_ioport_hook(vmm_hold_t *hold, uint_t ioport, vmm_drv_rmem_cb_t rfunc,
+    vmm_drv_wmem_cb_t wfunc, void *arg, void **cookie)
+{
+	vmm_softc_t *sc;
+	int err;
+
+	ASSERT(hold != NULL);
+	ASSERT(cookie != NULL);
+
+	sc = hold->vmh_sc;
+	mutex_enter(&vmmdev_mtx);
+	/* Confirm that hook installation is not blocked */
+	if ((sc->vmm_flags & VMM_BLOCK_HOOK) != 0) {
+		mutex_exit(&vmmdev_mtx);
+		return (EBUSY);
+	}
+	/*
+	 * Optimistically record an installed hook which will prevent a block
+	 * from being asserted while the mutex is dropped.
+	 */
+	hold->vmh_ioport_hook_cnt++;
+	mutex_exit(&vmmdev_mtx);
+
+	err = vm_ioport_hook(sc->vmm_vm, ioport, (vmm_rmem_cb_t)rfunc,
+	    (vmm_wmem_cb_t)wfunc, arg, cookie);
+
+	if (err != 0) {
+		mutex_enter(&vmmdev_mtx);
+		/* Walk back optimism about the hook installation */
+		hold->vmh_ioport_hook_cnt--;
+		mutex_exit(&vmmdev_mtx);
+	}
+	return (err);
+}
+
+void
+vmm_drv_ioport_unhook(vmm_hold_t *hold, void **cookie)
+{
+	vmm_softc_t *sc;
+
+	ASSERT(hold != NULL);
+	ASSERT(cookie != NULL);
+	ASSERT(hold->vmh_ioport_hook_cnt != 0);
+
+	sc = hold->vmh_sc;
+	vm_ioport_unhook(sc->vmm_vm, cookie);
+
+	mutex_enter(&vmmdev_mtx);
+	hold->vmh_ioport_hook_cnt--;
+	mutex_exit(&vmmdev_mtx);
+}
+
+int
+vmm_drv_msi(vmm_hold_t *hold, uint64_t addr, uint64_t msg)
+{
+	struct vm *vm;
+
+	ASSERT(hold != NULL);
+
+	vm = hold->vmh_sc->vmm_vm;
+	return (lapic_intr_msi(vm, addr, msg));
+}
+
+static int
+vmm_drv_purge(vmm_softc_t *sc)
+{
+	ASSERT(MUTEX_HELD(&vmmdev_mtx));
+
+	if ((sc->vmm_flags & VMM_HELD) != 0) {
+		vmm_hold_t *hold;
+
+		sc->vmm_flags |= VMM_CLEANUP;
+		for (hold = list_head(&sc->vmm_holds); hold != NULL;
+		    hold = list_next(&sc->vmm_holds, hold)) {
+			hold->vmh_expired = B_TRUE;
+		}
+		while ((sc->vmm_flags & VMM_HELD) != 0) {
+			if (cv_wait_sig(&sc->vmm_cv, &vmmdev_mtx) <= 0) {
+				return (EINTR);
+			}
+		}
+		sc->vmm_flags &= ~VMM_CLEANUP;
+	}
+
+	VERIFY(list_is_empty(&sc->vmm_holds));
+	sc->vmm_flags |= VMM_PURGED;
+	return (0);
+}
+
+static int
+vmm_drv_block_hook(vmm_softc_t *sc, boolean_t enable_block)
+{
+	int err = 0;
+
+	mutex_enter(&vmmdev_mtx);
+	if (!enable_block) {
+		VERIFY((sc->vmm_flags & VMM_BLOCK_HOOK) != 0);
+
+		sc->vmm_flags &= ~VMM_BLOCK_HOOK;
+		goto done;
+	}
+
+	/* If any holds have hooks installed, the block is a failure */
+	if (!list_is_empty(&sc->vmm_holds)) {
+		vmm_hold_t *hold;
+
+		for (hold = list_head(&sc->vmm_holds); hold != NULL;
+		    hold = list_next(&sc->vmm_holds, hold)) {
+			if (hold->vmh_ioport_hook_cnt != 0) {
+				err = EBUSY;
+				goto done;
+			}
+		}
+	}
+	sc->vmm_flags |= VMM_BLOCK_HOOK;
+
+done:
+	mutex_exit(&vmmdev_mtx);
+	return (err);
+}
+
+static int
+vmm_do_vm_destroy_locked(vmm_softc_t *sc, boolean_t clean_zsd)
+{
+	dev_info_t	*pdip = ddi_get_parent(vmm_dip);
+	minor_t		minor;
+
+	ASSERT(MUTEX_HELD(&vmmdev_mtx));
+	ASSERT(MUTEX_HELD(&vmm_mtx));
+
+	if (sc->vmm_is_open) {
+		return (EBUSY);
+	}
+
+	if (clean_zsd) {
+		vmm_zsd_rem_vm(sc);
+	}
+
+	if (vmm_drv_purge(sc) != 0) {
+		return (EINTR);
+	}
+
+	/* Clean up devmem entries */
+	vmmdev_devmem_purge(sc);
+
+	vm_destroy(sc->vmm_vm);
+	list_remove(&vmmdev_list, sc);
+	ddi_remove_minor_node(vmm_dip, sc->vmm_name);
+	minor = sc->vmm_minor;
+	zone_rele(sc->vmm_zone);
+	ddi_soft_state_free(vmm_statep, minor);
+	id_free(vmmdev_minors, minor);
+	(void) devfs_clean(pdip, NULL, DV_CLEAN_FORCE);
+	vmmdev_mod_decr();
+
+	return (0);
+}
+
+int
+vmm_do_vm_destroy(vmm_softc_t *sc, boolean_t clean_zsd)
+{
+	int		err;
+
+	mutex_enter(&vmmdev_mtx);
+	mutex_enter(&vmm_mtx);
+	err = vmm_do_vm_destroy_locked(sc, clean_zsd);
+	mutex_exit(&vmm_mtx);
+	mutex_exit(&vmmdev_mtx);
+
+	return (err);
+}
+
+/* ARGSUSED */
+static int
+vmmdev_do_vm_destroy(const char *name, cred_t *cr)
+{
+	vmm_softc_t	*sc;
+	int		err;
+
+	if (crgetuid(cr) != 0)
+		return (EPERM);
+
+	mutex_enter(&vmmdev_mtx);
+	mutex_enter(&vmm_mtx);
+
+	if ((sc = vmm_lookup(name)) == NULL) {
+		mutex_exit(&vmm_mtx);
+		mutex_exit(&vmmdev_mtx);
+		return (ENOENT);
+	}
+	/*
+	 * We don't check this in vmm_lookup() since that function is also used
+	 * for validation during create and currently vmm names must be unique.
+	 */
+	if (!INGLOBALZONE(curproc) && sc->vmm_zone != curzone) {
+		mutex_exit(&vmm_mtx);
+		mutex_exit(&vmmdev_mtx);
+		return (EPERM);
+	}
+	err = vmm_do_vm_destroy_locked(sc, B_TRUE);
+
+	mutex_exit(&vmm_mtx);
+	mutex_exit(&vmmdev_mtx);
+
+	return (err);
+}
+
+
+static int
+vmm_open(dev_t *devp, int flag, int otyp, cred_t *credp)
+{
+	minor_t		minor;
+	vmm_softc_t	*sc;
+
+	minor = getminor(*devp);
+	if (minor == VMM_CTL_MINOR) {
+		/*
+		 * Master control device must be opened exclusively.
+		 */
+		if ((flag & FEXCL) != FEXCL || otyp != OTYP_CHR) {
+			return (EINVAL);
+		}
+
+		return (0);
+	}
+
+	mutex_enter(&vmmdev_mtx);
+	sc = ddi_get_soft_state(vmm_statep, minor);
+	if (sc == NULL) {
+		mutex_exit(&vmmdev_mtx);
+		return (ENXIO);
+	}
+
+	sc->vmm_is_open = B_TRUE;
+	mutex_exit(&vmmdev_mtx);
+
+	return (0);
+}
+
+static int
+vmm_close(dev_t dev, int flag, int otyp, cred_t *credp)
+{
+	minor_t		minor;
+	vmm_softc_t	*sc;
+
+	minor = getminor(dev);
+	if (minor == VMM_CTL_MINOR)
+		return (0);
+
+	mutex_enter(&vmmdev_mtx);
+	sc = ddi_get_soft_state(vmm_statep, minor);
+	if (sc == NULL) {
+		mutex_exit(&vmmdev_mtx);
+		return (ENXIO);
+	}
+
+	VERIFY(sc->vmm_is_open);
+	sc->vmm_is_open = B_FALSE;
+	mutex_exit(&vmmdev_mtx);
+
+	return (0);
+}
+
+static int
+vmm_is_supported(intptr_t arg)
+{
+	int r;
+	char *msg;
+
+	if (!vmm_is_intel())
+		return (ENXIO);
+
+	r = vmx_x86_supported(&msg);
+	if (r != 0 && arg != NULL) {
+		if (copyoutstr(msg, (char *)arg, strlen(msg), NULL) != 0)
+			return (EFAULT);
+	}
+	return (r);
+}
+
+static int
+vmm_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rvalp)
+{
+	vmm_softc_t	*sc;
+	minor_t		minor;
+
+	minor = getminor(dev);
+
+	if (minor == VMM_CTL_MINOR) {
+		void *argp = (void *)arg;
+		char name[VM_MAX_NAMELEN] = { 0 };
+		size_t len = 0;
+
+		if ((mode & FKIOCTL) != 0) {
+			len = strlcpy(name, argp, sizeof (name));
+		} else {
+			if (copyinstr(argp, name, sizeof (name), &len) != 0) {
+				return (EFAULT);
+			}
+		}
+		if (len >= VM_MAX_NAMELEN) {
+			return (ENAMETOOLONG);
+		}
+
+		switch (cmd) {
+		case VMM_CREATE_VM:
+			if ((mode & FWRITE) == 0)
+				return (EPERM);
+			return (vmmdev_do_vm_create(name, credp));
+		case VMM_DESTROY_VM:
+			if ((mode & FWRITE) == 0)
+				return (EPERM);
+			return (vmmdev_do_vm_destroy(name, credp));
+		case VMM_VM_SUPPORTED:
+			return (vmm_is_supported(arg));
+		default:
+			/* No other actions are legal on ctl device */
+			return (ENOTTY);
+		}
+	}
+
+	sc = ddi_get_soft_state(vmm_statep, minor);
+	ASSERT(sc);
+
+	return (vmmdev_do_ioctl(sc, cmd, arg, mode, credp, rvalp));
+}
+
+static int
+vmm_segmap(dev_t dev, off_t off, struct as *as, caddr_t *addrp, off_t len,
+    unsigned int prot, unsigned int maxprot, unsigned int flags, cred_t *credp)
+{
+	vmm_softc_t *sc;
+	const minor_t minor = getminor(dev);
+	struct vm *vm;
+	int err;
+	vm_object_t vmo = NULL;
+	struct vmspace *vms;
+
+	if (minor == VMM_CTL_MINOR) {
+		return (ENODEV);
+	}
+	if (off < 0 || (off + len) <= 0) {
+		return (EINVAL);
+	}
+	if ((prot & PROT_USER) == 0) {
+		return (EACCES);
+	}
+
+	sc = ddi_get_soft_state(vmm_statep, minor);
+	ASSERT(sc);
+
+	/* Get a read lock on the guest memory map by freezing any vcpu. */
+	if ((err = vcpu_lock_all(sc)) != 0) {
+		return (err);
+	}
+
+	vm = sc->vmm_vm;
+	vms = vm_get_vmspace(vm);
+	if (off >= VM_DEVMEM_START) {
+		int segid;
+
+		/* Mapping a devmem "device" */
+		if (!vmmdev_devmem_segid(sc, off, len, &segid)) {
+			err = ENODEV;
+			goto out;
+		}
+		err = vm_get_memseg(vm, segid, NULL, NULL, &vmo);
+		if (err != 0) {
+			goto out;
+		}
+		err = vm_segmap_obj(vms, vmo, as, addrp, prot, maxprot, flags);
+	} else {
+		/* Mapping a part of the guest physical space */
+		err = vm_segmap_space(vms, off, as, addrp, len, prot, maxprot,
+		    flags);
+	}
+
+
+out:
+	vcpu_unlock_all(sc);
+	return (err);
+}
+
+static sdev_plugin_validate_t
+vmm_sdev_validate(sdev_ctx_t ctx)
+{
+	const char *name = sdev_ctx_name(ctx);
+	vmm_softc_t *sc;
+	sdev_plugin_validate_t ret;
+	minor_t minor;
+
+	if (sdev_ctx_vtype(ctx) != VCHR)
+		return (SDEV_VTOR_INVALID);
+
+	VERIFY3S(sdev_ctx_minor(ctx, &minor), ==, 0);
+
+	mutex_enter(&vmm_mtx);
+	if ((sc = vmm_lookup(name)) == NULL)
+		ret = SDEV_VTOR_INVALID;
+	else if (sc->vmm_minor != minor)
+		ret = SDEV_VTOR_STALE;
+	else
+		ret = SDEV_VTOR_VALID;
+	mutex_exit(&vmm_mtx);
+
+	return (ret);
+}
+
+static int
+vmm_sdev_filldir(sdev_ctx_t ctx)
+{
+	vmm_softc_t *sc;
+	int ret;
+
+	if (strcmp(sdev_ctx_path(ctx), VMM_SDEV_ROOT) != 0) {
+		cmn_err(CE_WARN, "%s: bad path '%s' != '%s'\n", __func__,
+		    sdev_ctx_path(ctx), VMM_SDEV_ROOT);
+		return (EINVAL);
+	}
+
+	/* Driver not initialized, directory empty. */
+	if (vmm_dip == NULL)
+		return (0);
+
+	mutex_enter(&vmm_mtx);
+
+	for (sc = list_head(&vmmdev_list); sc != NULL;
+	    sc = list_next(&vmmdev_list, sc)) {
+		if (INGLOBALZONE(curproc) || sc->vmm_zone == curzone) {
+			ret = sdev_plugin_mknod(ctx, sc->vmm_name,
+			    S_IFCHR | 0600,
+			    makedevice(ddi_driver_major(vmm_dip),
+			    sc->vmm_minor));
+		} else {
+			continue;
+		}
+		if (ret != 0 && ret != EEXIST)
+			goto out;
+	}
+
+	ret = 0;
+
+out:
+	mutex_exit(&vmm_mtx);
+	return (ret);
+}
+
+/* ARGSUSED */
+static void
+vmm_sdev_inactive(sdev_ctx_t ctx)
+{
+}
+
+static sdev_plugin_ops_t vmm_sdev_ops = {
+	.spo_version = SDEV_PLUGIN_VERSION,
+	.spo_flags = SDEV_PLUGIN_SUBDIR,
+	.spo_validate = vmm_sdev_validate,
+	.spo_filldir = vmm_sdev_filldir,
+	.spo_inactive = vmm_sdev_inactive
+};
+
+/* ARGSUSED */
+static int
+vmm_info(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **result)
+{
+	int error;
+
+	switch (cmd) {
+	case DDI_INFO_DEVT2DEVINFO:
+		*result = (void *)vmm_dip;
+		error = DDI_SUCCESS;
+		break;
+	case DDI_INFO_DEVT2INSTANCE:
+		*result = (void *)0;
+		error = DDI_SUCCESS;
+		break;
+	default:
+		error = DDI_FAILURE;
+		break;
+	}
+	return (error);
+}
+
+static int
+vmm_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	switch (cmd) {
+	case DDI_ATTACH:
+		break;
+	default:
+		return (DDI_FAILURE);
+	}
+
+	vmm_sol_glue_init();
+
+	/*
+	 * Create control node.  Other nodes will be created on demand.
+	 */
+	if (ddi_create_minor_node(dip, "ctl", S_IFCHR,
+	    VMM_CTL_MINOR, DDI_PSEUDO, 0) != 0) {
+		return (DDI_FAILURE);
+	}
+
+	if ((vmm_sdev_hdl = sdev_plugin_register("vmm", &vmm_sdev_ops,
+	    NULL)) == NULL) {
+		ddi_remove_minor_node(dip, NULL);
+		dip = NULL;
+		return (DDI_FAILURE);
+	}
+
+	ddi_report_dev(dip);
+
+	vmm_arena_init();
+
+	vmmdev_load_failure = B_FALSE;
+	vmm_dip = dip;
+
+	return (DDI_SUCCESS);
+}
+
+static int
+vmm_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	switch (cmd) {
+	case DDI_DETACH:
+		break;
+	default:
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Ensure that all resources have been cleaned up.
+	 *
+	 * To prevent a deadlock with iommu_cleanup() we'll fail the detach if
+	 * vmmdev_mtx is already held. We can't wait for vmmdev_mtx with our
+	 * devinfo locked as iommu_cleanup() tries to recursively lock each
+	 * devinfo, including our own, while holding vmmdev_mtx.
+	 */
+	if (mutex_tryenter(&vmmdev_mtx) == 0)
+		return (DDI_FAILURE);
+
+	if (vmmdev_inst_count != 0) {
+		mutex_exit(&vmmdev_mtx);
+		return (DDI_FAILURE);
+	}
+
+	mutex_enter(&vmm_mtx);
+
+	if (!list_is_empty(&vmmdev_list)) {
+		mutex_exit(&vmm_mtx);
+		mutex_exit(&vmmdev_mtx);
+		return (DDI_FAILURE);
+	}
+
+	mutex_exit(&vmm_mtx);
+
+	if (vmm_sdev_hdl != NULL && sdev_plugin_unregister(vmm_sdev_hdl) != 0) {
+		mutex_exit(&vmmdev_mtx);
+		return (DDI_FAILURE);
+	}
+	vmm_sdev_hdl = NULL;
+
+	/* Remove the control node. */
+	ddi_remove_minor_node(dip, "ctl");
+	vmm_dip = NULL;
+	vmm_sol_glue_cleanup();
+	vmm_arena_fini();
+
+	mutex_exit(&vmmdev_mtx);
+
+	return (DDI_SUCCESS);
+}
+
+static struct cb_ops vmm_cb_ops = {
+	vmm_open,
+	vmm_close,
+	nodev,		/* strategy */
+	nodev,		/* print */
+	nodev,		/* dump */
+	nodev,		/* read */
+	nodev,		/* write */
+	vmm_ioctl,
+	nodev,		/* devmap */
+	nodev,		/* mmap */
+	vmm_segmap,
+	nochpoll,	/* poll */
+	ddi_prop_op,
+	NULL,
+	D_NEW | D_MP | D_DEVMAP
+};
+
+static struct dev_ops vmm_ops = {
+	DEVO_REV,
+	0,
+	vmm_info,
+	nulldev,	/* identify */
+	nulldev,	/* probe */
+	vmm_attach,
+	vmm_detach,
+	nodev,		/* reset */
+	&vmm_cb_ops,
+	(struct bus_ops *)NULL
+};
+
+static struct modldrv modldrv = {
+	&mod_driverops,
+	"vmm",
+	&vmm_ops
+};
+
+static struct modlinkage modlinkage = {
+	MODREV_1,
+	&modldrv,
+	NULL
+};
+
+int
+_init(void)
+{
+	int	error;
+
+	sysinit();
+
+	mutex_init(&vmmdev_mtx, NULL, MUTEX_DRIVER, NULL);
+	mutex_init(&vmm_mtx, NULL, MUTEX_DRIVER, NULL);
+	list_create(&vmmdev_list, sizeof (vmm_softc_t),
+	    offsetof(vmm_softc_t, vmm_node));
+	vmmdev_minors = id_space_create("vmm_minors", VMM_CTL_MINOR + 1,
+	    MAXMIN32);
+
+	error = ddi_soft_state_init(&vmm_statep, sizeof (vmm_softc_t), 0);
+	if (error) {
+		return (error);
+	}
+
+	vmm_zsd_init();
+
+	error = mod_install(&modlinkage);
+	if (error) {
+		ddi_soft_state_fini(&vmm_statep);
+		vmm_zsd_fini();
+	}
+
+	return (error);
+}
+
+int
+_fini(void)
+{
+	int	error;
+
+	error = mod_remove(&modlinkage);
+	if (error) {
+		return (error);
+	}
+
+	vmm_zsd_fini();
+
+	ddi_soft_state_fini(&vmm_statep);
+
+	return (0);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&modlinkage, modinfop));
+}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_sol_glue.c b/usr/src/uts/i86pc/io/vmm/vmm_sol_glue.c
new file mode 100644
index 0000000000..b523b69bd9
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_sol_glue.c
@@ -0,0 +1,762 @@
+/*
+ * Copyright (c) 2004 Poul-Henning Kamp
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: head/sys/kern/subr_unit.c 255057 2013-08-30 07:37:45Z kib $
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/types.h>
+#include <sys/archsystm.h>
+#include <sys/cpuset.h>
+#include <sys/fp.h>
+#include <sys/malloc.h>
+#include <sys/queue.h>
+#include <sys/spl.h>
+#include <sys/systm.h>
+#include <sys/ddidmareq.h>
+#include <sys/id_space.h>
+#include <sys/psm_defs.h>
+#include <sys/smp_impldefs.h>
+#include <sys/modhash.h>
+#include <sys/hma.h>
+
+#include <sys/x86_archext.h>
+
+#include <machine/cpufunc.h>
+#include <machine/fpu.h>
+#include <machine/md_var.h>
+#include <machine/pmap.h>
+#include <machine/specialreg.h>
+#include <machine/vmm.h>
+#include <sys/vmm_impl.h>
+#include <sys/kernel.h>
+
+#include <vm/as.h>
+#include <vm/seg_kmem.h>
+
+SET_DECLARE(sysinit_set, struct sysinit);
+
+void
+sysinit(void)
+{
+	struct sysinit **si;
+
+	SET_FOREACH(si, sysinit_set)
+		(*si)->func((*si)->data);
+}
+
+u_char const bin2bcd_data[] = {
+	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19,
+	0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29,
+	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,
+	0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49,
+	0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59,
+	0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69,
+	0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79,
+	0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89,
+	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99
+};
+
+void
+pmap_invalidate_cache(void)
+{
+	cpuset_t cpuset;
+
+	kpreempt_disable();
+	cpuset_all_but(&cpuset, CPU->cpu_id);
+	xc_call(NULL, NULL, NULL, CPUSET2BV(cpuset), (xc_func_t)invalidate_cache);
+	invalidate_cache();
+	kpreempt_enable();
+}
+
+vm_paddr_t
+pmap_kextract(vm_offset_t va)
+{
+	pfn_t	pfn;
+
+	/*
+	 * Since hat_getpfnum() may block on an htable mutex, this is not at
+	 * all safe to run from a critical_enter/kpreempt_disable context.
+	 * The FreeBSD analog does not have the same locking constraints, so
+	 * close attention must be paid wherever this is called.
+	 */
+	ASSERT(curthread->t_preempt == 0);
+
+	pfn = hat_getpfnum(kas.a_hat, (caddr_t)va);
+	ASSERT(pfn != PFN_INVALID);
+	return (pfn << PAGE_SHIFT) | ((uintptr_t)va & PAGE_MASK);
+}
+
+int
+cpusetobj_ffs(const cpuset_t *set)
+{
+#if	CPUSET_WORDS > 1
+	int	i, cbit;
+
+	cbit = 0;
+	for (i = 0; i < CPUSET_WORDS; i++) {
+		if (set->cpub[i] != 0) {
+			cbit = ffsl(set->cpub[i]);
+			cbit += i * sizeof (set->cpub[0]);
+			break;
+		}
+	}
+	return (cbit);
+#else
+	return (ffsl(*set));
+#endif
+}
+
+void
+smp_rendezvous(void (* setup_func)(void *), void (* action_func)(void *),
+    void (* teardown_func)(void *), void *arg)
+{
+	cpuset_t cpuset;
+
+	ASSERT(setup_func == NULL);
+	ASSERT(teardown_func == NULL);
+
+	CPUSET_ALL(cpuset);
+	xc_sync((xc_arg_t)arg, 0, 0, CPUSET2BV(cpuset), (xc_func_t)action_func);
+}
+
+struct kmem_item {
+	void			*addr;
+	size_t			size;
+};
+static kmutex_t kmem_items_lock;
+
+static mod_hash_t *vmm_alloc_hash;
+uint_t vmm_alloc_hash_nchains = 16381;
+uint_t vmm_alloc_hash_size = PAGESIZE;
+
+static void
+vmm_alloc_hash_valdtor(mod_hash_val_t val)
+{
+	struct kmem_item *i = (struct kmem_item *)val;
+
+	kmem_free(i->addr, i->size);
+	kmem_free(i, sizeof (struct kmem_item));
+}
+
+static void
+vmm_alloc_init(void)
+{
+	vmm_alloc_hash = mod_hash_create_ptrhash("vmm_alloc_hash",
+	    vmm_alloc_hash_nchains, vmm_alloc_hash_valdtor,
+	    vmm_alloc_hash_size);
+
+	VERIFY(vmm_alloc_hash != NULL);
+}
+
+static uint_t
+vmm_alloc_check(mod_hash_key_t key, mod_hash_val_t *val, void *unused)
+{
+	struct kmem_item *i = (struct kmem_item *)val;
+
+	cmn_err(CE_PANIC, "!vmm_alloc_check: hash not empty: %p, %d", i->addr,
+	    i->size);
+
+	return (MH_WALK_TERMINATE);
+}
+
+static void
+vmm_alloc_cleanup(void)
+{
+	mod_hash_walk(vmm_alloc_hash, vmm_alloc_check, NULL);
+	mod_hash_destroy_ptrhash(vmm_alloc_hash);
+}
+
+void *
+malloc(unsigned long size, struct malloc_type *mtp, int flags)
+{
+	void			*p;
+	struct kmem_item	*i;
+	int			kmem_flag = KM_SLEEP;
+
+	if (flags & M_NOWAIT)
+		kmem_flag = KM_NOSLEEP;
+
+	if (flags & M_ZERO) {
+		p = kmem_zalloc(size, kmem_flag);
+	} else {
+		p = kmem_alloc(size, kmem_flag);
+	}
+
+	if (p == NULL)
+		return (NULL);
+
+	i = kmem_zalloc(sizeof (struct kmem_item), kmem_flag);
+
+	if (i == NULL) {
+		kmem_free(p, size);
+		return (NULL);
+	}
+
+	mutex_enter(&kmem_items_lock);
+	i->addr = p;
+	i->size = size;
+
+	VERIFY(mod_hash_insert(vmm_alloc_hash,
+	    (mod_hash_key_t)PHYS_TO_DMAP(vtophys(p)), (mod_hash_val_t)i) == 0);
+
+	mutex_exit(&kmem_items_lock);
+
+	return (p);
+}
+
+void
+free(void *addr, struct malloc_type *mtp)
+{
+	mutex_enter(&kmem_items_lock);
+	VERIFY(mod_hash_destroy(vmm_alloc_hash,
+	    (mod_hash_key_t)PHYS_TO_DMAP(vtophys(addr))) == 0);
+	mutex_exit(&kmem_items_lock);
+}
+
+extern void *contig_alloc(size_t, ddi_dma_attr_t *, uintptr_t, int);
+extern void contig_free(void *, size_t);
+
+void *
+contigmalloc(unsigned long size, struct malloc_type *type, int flags,
+    vm_paddr_t low, vm_paddr_t high, unsigned long alignment,
+    vm_paddr_t boundary)
+{
+	ddi_dma_attr_t attr = {
+		/* Using fastboot_dma_attr as a guide... */
+		DMA_ATTR_V0,
+		low,			/* dma_attr_addr_lo */
+		high,			/* dma_attr_addr_hi */
+		0x00000000FFFFFFFFULL,	/* dma_attr_count_max */
+		alignment,		/* dma_attr_align */
+		1,			/* dma_attr_burstsize */
+		1,			/* dma_attr_minxfer */
+		0x00000000FFFFFFFFULL,	/* dma_attr_maxxfer */
+		0x00000000FFFFFFFFULL,	/* dma_attr_seg: any */
+		1,			/* dma_attr_sgllen */
+		alignment,		/* dma_attr_granular */
+		0,			/* dma_attr_flags */
+	};
+	int cansleep = (flags & M_WAITOK);
+	void *result;
+
+	ASSERT(alignment == PAGESIZE);
+
+	result = contig_alloc((size_t)size, &attr, alignment, cansleep);
+
+	if (result != NULL && (flags & M_ZERO) != 0) {
+		bzero(result, size);
+	}
+	return (result);
+}
+
+void
+contigfree(void *addr, unsigned long size, struct malloc_type *type)
+{
+	contig_free(addr, size);
+}
+
+void
+mtx_init(struct mtx *mtx, char *name, const char *type_name, int opts)
+{
+	if (opts & MTX_SPIN) {
+		mutex_init(&mtx->m, name, MUTEX_SPIN,
+		    (ddi_iblock_cookie_t)ipltospl(DISP_LEVEL));
+	} else {
+		mutex_init(&mtx->m, name, MUTEX_DRIVER, NULL);
+	}
+}
+
+void
+mtx_destroy(struct mtx *mtx)
+{
+	mutex_destroy(&mtx->m);
+}
+
+void
+critical_enter(void)
+{
+	kpreempt_disable();
+}
+
+void
+critical_exit(void)
+{
+	kpreempt_enable();
+}
+
+struct unrhdr;
+static kmutex_t unr_lock;
+static uint_t unr_idx;
+
+/*
+ * Allocate a new unrheader set.
+ *
+ * Highest and lowest valid values given as parameters.
+ */
+struct unrhdr *
+new_unrhdr(int low, int high, struct mtx *mtx)
+{
+	id_space_t *ids;
+	char name[] = "vmm_unr_00000000";
+
+	ASSERT(mtx == NULL);
+
+	mutex_enter(&unr_lock);
+	/* Get a unique name for the id space */
+	(void) snprintf(name, sizeof (name), "vmm_unr_%08X", unr_idx);
+	VERIFY(++unr_idx != UINT_MAX);
+	mutex_exit(&unr_lock);
+
+	ids = id_space_create(name, low, high);
+
+	return ((struct unrhdr *)ids);
+}
+
+void
+delete_unrhdr(struct unrhdr *uh)
+{
+	id_space_t *ids = (id_space_t *)uh;
+
+	id_space_destroy(ids);
+}
+
+int
+alloc_unr(struct unrhdr *uh)
+{
+	id_space_t *ids = (id_space_t *)uh;
+
+	return (id_alloc(ids));
+}
+
+void
+free_unr(struct unrhdr *uh, u_int item)
+{
+	id_space_t *ids = (id_space_t *)uh;
+
+	id_free(ids, item);
+}
+
+
+static void
+vmm_glue_callout_handler(void *arg)
+{
+	struct callout *c = arg;
+
+	c->c_flags &= ~CALLOUT_PENDING;
+	if (c->c_flags & CALLOUT_ACTIVE) {
+		(c->c_func)(c->c_arg);
+	}
+}
+
+void
+vmm_glue_callout_init(struct callout *c, int mpsafe)
+{
+	cyc_handler_t	hdlr;
+	cyc_time_t	when;
+
+	hdlr.cyh_level = CY_LOW_LEVEL;
+	hdlr.cyh_func = vmm_glue_callout_handler;
+	hdlr.cyh_arg = c;
+	when.cyt_when = CY_INFINITY;
+	when.cyt_interval = CY_INFINITY;
+
+	mutex_enter(&cpu_lock);
+#if 0
+	/*
+	 * XXXJOY: according to the freebsd sources, callouts do not begin
+	 * their life in the ACTIVE state.
+	 */
+	c->c_flags |= CALLOUT_ACTIVE;
+#else
+	bzero(c, sizeof (*c));
+#endif
+	c->c_cyc_id = cyclic_add(&hdlr, &when);
+	mutex_exit(&cpu_lock);
+}
+
+static __inline hrtime_t
+sbttohrtime(sbintime_t sbt)
+{
+	return (((sbt >> 32) * NANOSEC) +
+	    (((uint64_t)NANOSEC * (uint32_t)sbt) >> 32));
+}
+
+int
+vmm_glue_callout_reset_sbt(struct callout *c, sbintime_t sbt, sbintime_t pr,
+    void (*func)(void *), void *arg, int flags)
+{
+	hrtime_t target = sbttohrtime(sbt);
+
+	ASSERT(c->c_cyc_id != CYCLIC_NONE);
+
+	c->c_func = func;
+	c->c_arg = arg;
+	c->c_flags |= (CALLOUT_ACTIVE | CALLOUT_PENDING);
+
+	if (flags & C_ABSOLUTE) {
+		cyclic_reprogram(c->c_cyc_id, target);
+	} else {
+		cyclic_reprogram(c->c_cyc_id, target + gethrtime());
+	}
+
+	return (0);
+}
+
+int
+vmm_glue_callout_stop(struct callout *c)
+{
+	ASSERT(c->c_cyc_id != CYCLIC_NONE);
+	cyclic_reprogram(c->c_cyc_id, CY_INFINITY);
+	c->c_flags &= ~(CALLOUT_ACTIVE | CALLOUT_PENDING);
+
+	return (0);
+}
+
+int
+vmm_glue_callout_drain(struct callout *c)
+{
+	ASSERT(c->c_cyc_id != CYCLIC_NONE);
+	mutex_enter(&cpu_lock);
+	cyclic_remove(c->c_cyc_id);
+	c->c_cyc_id = CYCLIC_NONE;
+	c->c_flags &= ~(CALLOUT_ACTIVE | CALLOUT_PENDING);
+	mutex_exit(&cpu_lock);
+
+	return (0);
+}
+
+void
+vmm_glue_callout_localize(struct callout *c)
+{
+	mutex_enter(&cpu_lock);
+	cyclic_move_here(c->c_cyc_id);
+	mutex_exit(&cpu_lock);
+}
+
+void
+ipi_cpu(int cpu, u_int ipi)
+{
+	/*
+	 * This was previously implemented as an invocation of asynchronous
+	 * no-op crosscalls to interrupt the target CPU.  Since even nowait
+	 * crosscalls can block in certain circumstances, a direct poke_cpu()
+	 * is safer when called from delicate contexts.
+	 */
+	poke_cpu(cpu);
+}
+
+u_int	cpu_high;		/* Highest arg to CPUID */
+u_int	cpu_exthigh;		/* Highest arg to extended CPUID */
+u_int	cpu_id;			/* Stepping ID */
+char	cpu_vendor[20];		/* CPU Origin code */
+
+static void
+vmm_cpuid_init(void)
+{
+	u_int regs[4];
+
+	do_cpuid(0, regs);
+	cpu_high = regs[0];
+	((u_int *)&cpu_vendor)[0] = regs[1];
+	((u_int *)&cpu_vendor)[1] = regs[3];
+	((u_int *)&cpu_vendor)[2] = regs[2];
+	cpu_vendor[12] = '\0';
+
+	do_cpuid(1, regs);
+	cpu_id = regs[0];
+
+	do_cpuid(0x80000000, regs);
+	cpu_exthigh = regs[0];
+}
+
+/*
+ * FreeBSD uses the struct savefpu for managing the FPU state. That is mimicked
+ * by our hypervisor multiplexor framework structure.
+ */
+struct savefpu *
+fpu_save_area_alloc(void)
+{
+	return ((struct savefpu *)hma_fpu_alloc(KM_SLEEP));
+}
+
+void
+fpu_save_area_free(struct savefpu *fsa)
+{
+	hma_fpu_t *fpu = (hma_fpu_t *)fsa;
+	hma_fpu_free(fpu);
+}
+
+void
+fpu_save_area_reset(struct savefpu *fsa)
+{
+	hma_fpu_t *fpu = (hma_fpu_t *)fsa;
+	hma_fpu_init(fpu);
+}
+
+/*
+ * This glue function is supposed to save the host's FPU state. This is always
+ * paired in the general bhyve code with a call to fpusave. Therefore, we treat
+ * this as a nop and do all the work in fpusave(), which will have the context
+ * argument that we want anyways.
+ */
+void
+fpuexit(kthread_t *td)
+{
+}
+
+/*
+ * This glue function is supposed to restore the guest's FPU state from the save
+ * area back to the host. In FreeBSD, it is assumed that the host state has
+ * already been saved by a call to fpuexit(); however, we do both here.
+ */
+void
+fpurestore(void *arg)
+{
+	hma_fpu_t *fpu = arg;
+
+	hma_fpu_start_guest(fpu);
+}
+
+/*
+ * This glue function is supposed to save the guest's FPU state. The host's FPU
+ * state is not expected to be restored necessarily due to the use of FPU
+ * emulation through CR0.TS. However, we can and do restore it here.
+ */
+void
+fpusave(void *arg)
+{
+	hma_fpu_t *fpu = arg;
+
+	hma_fpu_stop_guest(fpu);
+}
+
+void
+vmm_sol_glue_init(void)
+{
+	vmm_alloc_init();
+	vmm_cpuid_init();
+	unr_idx = 0;
+}
+
+void
+vmm_sol_glue_cleanup(void)
+{
+	vmm_alloc_cleanup();
+}
+
+
+/* From FreeBSD's sys/kern/subr_clock.c */
+
+/*-
+ * Copyright (c) 1988 University of Utah.
+ * Copyright (c) 1982, 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * This code is derived from software contributed to Berkeley by
+ * the Systems Programming Group of the University of Utah Computer
+ * Science Department.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	from: Utah $Hdr: clock.c 1.18 91/01/21$
+ *	from: @(#)clock.c	8.2 (Berkeley) 1/12/94
+ *	from: NetBSD: clock_subr.c,v 1.6 2001/07/07 17:04:02 thorpej Exp
+ *	and
+ *	from: src/sys/i386/isa/clock.c,v 1.176 2001/09/04
+ */
+
+#include <sys/clock.h>
+
+/*--------------------------------------------------------------------*
+ * Generic routines to convert between a POSIX date
+ * (seconds since 1/1/1970) and yr/mo/day/hr/min/sec
+ * Derived from NetBSD arch/hp300/hp300/clock.c
+ */
+
+#define	FEBRUARY	2
+#define	days_in_year(y) 	(leapyear(y) ? 366 : 365)
+#define	days_in_month(y, m) \
+	(month_days[(m) - 1] + (m == FEBRUARY ? leapyear(y) : 0))
+/* Day of week. Days are counted from 1/1/1970, which was a Thursday */
+#define	day_of_week(days)	(((days) + 4) % 7)
+
+static const int month_days[12] = {
+	31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
+};
+
+
+/*
+ * This inline avoids some unnecessary modulo operations
+ * as compared with the usual macro:
+ *   ( ((year % 4) == 0 &&
+ *      (year % 100) != 0) ||
+ *     ((year % 400) == 0) )
+ * It is otherwise equivalent.
+ */
+static int
+leapyear(int year)
+{
+	int rv = 0;
+
+	if ((year & 3) == 0) {
+		rv = 1;
+		if ((year % 100) == 0) {
+			rv = 0;
+			if ((year % 400) == 0)
+				rv = 1;
+		}
+	}
+	return (rv);
+}
+
+int
+clock_ct_to_ts(struct clocktime *ct, struct timespec *ts)
+{
+	int i, year, days;
+
+	year = ct->year;
+
+#ifdef __FreeBSD__
+	if (ct_debug) {
+		printf("ct_to_ts(");
+		print_ct(ct);
+		printf(")");
+	}
+#endif
+
+	/* Sanity checks. */
+	if (ct->mon < 1 || ct->mon > 12 || ct->day < 1 ||
+	    ct->day > days_in_month(year, ct->mon) ||
+	    ct->hour > 23 ||  ct->min > 59 || ct->sec > 59 ||
+	    (sizeof(time_t) == 4 && year > 2037)) {	/* time_t overflow */
+#ifdef __FreeBSD__
+		if (ct_debug)
+			printf(" = EINVAL\n");
+#endif
+		return (EINVAL);
+	}
+
+	/*
+	 * Compute days since start of time
+	 * First from years, then from months.
+	 */
+	days = 0;
+	for (i = POSIX_BASE_YEAR; i < year; i++)
+		days += days_in_year(i);
+
+	/* Months */
+	for (i = 1; i < ct->mon; i++)
+	  	days += days_in_month(year, i);
+	days += (ct->day - 1);
+
+	ts->tv_sec = (((time_t)days * 24 + ct->hour) * 60 + ct->min) * 60 +
+	    ct->sec;
+	ts->tv_nsec = ct->nsec;
+
+#ifdef __FreeBSD__
+	if (ct_debug)
+		printf(" = %ld.%09ld\n", (long)ts->tv_sec, (long)ts->tv_nsec);
+#endif
+	return (0);
+}
+
+void
+clock_ts_to_ct(struct timespec *ts, struct clocktime *ct)
+{
+	int i, year, days;
+	time_t rsec;	/* remainder seconds */
+	time_t secs;
+
+	secs = ts->tv_sec;
+	days = secs / SECDAY;
+	rsec = secs % SECDAY;
+
+	ct->dow = day_of_week(days);
+
+	/* Subtract out whole years, counting them in i. */
+	for (year = POSIX_BASE_YEAR; days >= days_in_year(year); year++)
+		days -= days_in_year(year);
+	ct->year = year;
+
+	/* Subtract out whole months, counting them in i. */
+	for (i = 1; days >= days_in_month(year, i); i++)
+		days -= days_in_month(year, i);
+	ct->mon = i;
+
+	/* Days are what is left over (+1) from all that. */
+	ct->day = days + 1;
+
+	/* Hours, minutes, seconds are easy */
+	ct->hour = rsec / 3600;
+	rsec = rsec % 3600;
+	ct->min  = rsec / 60;
+	rsec = rsec % 60;
+	ct->sec  = rsec;
+	ct->nsec = ts->tv_nsec;
+#ifdef __FreeBSD__
+	if (ct_debug) {
+		printf("ts_to_ct(%ld.%09ld) = ",
+		    (long)ts->tv_sec, (long)ts->tv_nsec);
+		print_ct(ct);
+		printf("\n");
+	}
+#endif
+}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_sol_vm.c b/usr/src/uts/i86pc/io/vmm/vmm_sol_vm.c
new file mode 100644
index 0000000000..11f4c52fd1
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_sol_vm.c
@@ -0,0 +1,1495 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/param.h>
+#include <sys/kmem.h>
+#include <sys/thread.h>
+#include <sys/list.h>
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/ddi.h>
+#include <sys/sysmacros.h>
+#include <sys/machsystm.h>
+#include <sys/vmsystm.h>
+#include <sys/malloc.h>
+#include <vm/as.h>
+#include <vm/seg_vn.h>
+#include <vm/seg_kmem.h>
+#include <vm/seg_vmm.h>
+
+#include <vm/vm_extern.h>
+#include <vm/vm_map.h>
+#include "vm/vm_glue.h"
+
+#define	PMAP_TO_VMMAP(pm)	((vm_map_t)		\
+	((caddr_t)(pm) - offsetof(struct vmspace, vms_pmap)))
+#define	VMMAP_TO_VMSPACE(vmmap)	((struct vmspace *)		\
+	((caddr_t)(vmmap) - offsetof(struct vmspace, vm_map)))
+
+/* Similar to htable, but without the bells and whistles */
+struct eptable {
+	struct eptable	*ept_next;
+	uintptr_t	ept_vaddr;
+	pfn_t		ept_pfn;
+	int16_t		ept_level;
+	int16_t		ept_valid_cnt;
+	uint32_t	_ept_pad2;
+	struct eptable	*ept_prev;
+	struct eptable	*ept_parent;
+	void		*ept_kva;
+};
+typedef struct eptable eptable_t;
+
+struct eptable_map {
+	kmutex_t		em_lock;
+	eptable_t		*em_root;
+	eptable_t		**em_hash;
+	size_t			em_table_cnt;
+	size_t			em_wired;
+
+	/* Protected by eptable_map_lock */
+	struct eptable_map	*em_next;
+	struct eptable_map	*em_prev;
+};
+typedef struct eptable_map eptable_map_t;
+
+#define	EPTABLE_HASH(va, lvl, sz)				\
+	((((va) >> LEVEL_SHIFT(1)) + ((va) >> 28) + (lvl))	\
+	& ((sz) - 1))
+
+#define	EPTABLE_VA2IDX(tbl, va)					\
+	(((va) - (tbl)->ept_vaddr) >>				\
+	LEVEL_SHIFT((tbl)->ept_level))
+
+#define	EPTABLE_IDX2VA(tbl, idx)				\
+	((tbl)->ept_vaddr +					\
+	((idx) << LEVEL_SHIFT((tbl)->ept_level)))
+
+#define	EPT_R		(0x1 << 0)
+#define	EPT_W		(0x1 << 1)
+#define	EPT_X		(0x1 << 2)
+#define	EPT_RWX		(EPT_R|EPT_W|EPT_X)
+#define	EPT_LGPG	(0x1 << 7)
+
+#define	EPT_PAT(attr)	(((attr) & 0x7) << 3)
+
+#define	EPT_PADDR	(0x000ffffffffff000ull)
+
+#define	EPT_IS_ABSENT(pte)	(((pte) & EPT_RWX) == 0)
+#define	EPT_PTE_PFN(pte)	mmu_btop((pte) & EPT_PADDR)
+#define	EPT_PTE_PROT(pte)	((pte) & EPT_RWX)
+#define	EPT_MAPS_PAGE(lvl, pte)				\
+	((lvl) == 0 || ((pte) & EPT_LGPG))
+
+#define	EPT_PTE_ASSIGN_TABLE(pfn)			\
+	((pfn_to_pa(pfn) & EPT_PADDR) | EPT_RWX)
+
+/*
+ * We only assign EPT_LGPG for levels higher than 0: although this bit is
+ * defined as being ignored at level 0, some versions of VMWare fail to honor
+ * this and report such a PTE as an EPT mis-configuration.
+ */
+#define	EPT_PTE_ASSIGN_PAGE(lvl, pfn, prot, attr)	\
+	((pfn_to_pa(pfn) & EPT_PADDR) |			\
+	(((lvl) != 0) ? EPT_LGPG : 0) |			\
+	EPT_PAT(attr) | ((prot) & EPT_RWX))
+
+struct vmspace_mapping {
+	list_node_t	vmsm_node;
+	vm_object_t	vmsm_object;
+	uintptr_t	vmsm_addr;
+	size_t		vmsm_len;
+	off_t		vmsm_offset;
+	uint_t		vmsm_prot;
+};
+typedef struct vmspace_mapping vmspace_mapping_t;
+
+#define	VMSM_OFFSET(vmsm, addr)	(			\
+	    (vmsm)->vmsm_offset +			\
+	    ((addr) - (uintptr_t)(vmsm)->vmsm_addr))
+
+
+/* Private glue interfaces */
+static void pmap_free(pmap_t);
+static eptable_t *eptable_alloc(void);
+static void eptable_free(eptable_t *);
+static void eptable_init(eptable_map_t *);
+static void eptable_fini(eptable_map_t *);
+static eptable_t *eptable_hash_lookup(eptable_map_t *, uintptr_t, level_t);
+static void eptable_hash_insert(eptable_map_t *, eptable_t *);
+static void eptable_hash_remove(eptable_map_t *, eptable_t *);
+static eptable_t *eptable_walk(eptable_map_t *, uintptr_t, level_t, uint_t *,
+    boolean_t);
+static pfn_t eptable_mapin(eptable_map_t *, uintptr_t, pfn_t, uint_t, uint_t,
+    vm_memattr_t);
+static void eptable_mapout(eptable_map_t *, uintptr_t);
+static int eptable_find(eptable_map_t *, uintptr_t, pfn_t *, uint_t *);
+static vmspace_mapping_t *vm_mapping_find(struct vmspace *, uintptr_t, size_t);
+static void vm_mapping_remove(struct vmspace *, vmspace_mapping_t *);
+
+static kmutex_t eptable_map_lock;
+static struct eptable_map *eptable_map_head = NULL;
+
+static vmem_t *vmm_alloc_arena = NULL;
+
+static void *
+vmm_arena_alloc(vmem_t *vmp, size_t size, int vmflag)
+{
+	return (segkmem_xalloc(vmp, NULL, size, vmflag, 0,
+	    segkmem_page_create, &kvps[KV_VVP]));
+}
+
+static void
+vmm_arena_free(vmem_t *vmp, void *inaddr, size_t size)
+{
+	segkmem_xfree(vmp, inaddr, size, &kvps[KV_VVP], NULL);
+}
+
+void
+vmm_arena_init(void)
+{
+	vmm_alloc_arena = vmem_create("vmm_alloc_arena", NULL, 0, 1024 * 1024,
+	    vmm_arena_alloc, vmm_arena_free, kvmm_arena, 0, VM_SLEEP);
+
+	ASSERT(vmm_alloc_arena != NULL);
+}
+
+void
+vmm_arena_fini(void)
+{
+	VERIFY(vmem_size(vmm_alloc_arena, VMEM_ALLOC) == 0);
+	vmem_destroy(vmm_alloc_arena);
+	vmm_alloc_arena = NULL;
+}
+
+struct vmspace *
+vmspace_alloc(vm_offset_t start, vm_offset_t end, pmap_pinit_t pinit)
+{
+	struct vmspace *vms;
+	const uintptr_t size = end + 1;
+
+	/*
+	 * This whole mess is built on the assumption that a 64-bit address
+	 * space is available to work with for the various pagetable tricks.
+	 */
+	VERIFY(ttoproc(curthread)->p_model == DATAMODEL_LP64);
+	VERIFY(start == 0 && size > 0 && (size & PAGEOFFSET) == 0 &&
+	    size <= (uintptr_t)USERLIMIT);
+
+	vms = kmem_zalloc(sizeof (*vms), KM_SLEEP);
+	vms->vms_size = size;
+	list_create(&vms->vms_maplist, sizeof (vmspace_mapping_t),
+	    offsetof(vmspace_mapping_t, vmsm_node));
+
+	if (pinit(&vms->vms_pmap) == 0) {
+		kmem_free(vms, sizeof (*vms));
+		return (NULL);
+	}
+
+	return (vms);
+}
+
+void
+vmspace_free(struct vmspace *vms)
+{
+	VERIFY(list_is_empty(&vms->vms_maplist));
+
+	pmap_free(&vms->vms_pmap);
+	kmem_free(vms, sizeof (*vms));
+}
+
+pmap_t
+vmspace_pmap(struct vmspace *vms)
+{
+	return (&vms->vms_pmap);
+}
+
+long
+vmspace_resident_count(struct vmspace *vms)
+{
+	/* XXXJOY: finish */
+	return (0);
+}
+
+void *
+vmspace_find_kva(struct vmspace *vms, uintptr_t addr, size_t size)
+{
+	vmspace_mapping_t *vmsm;
+	void *result = NULL;
+
+	mutex_enter(&vms->vms_lock);
+	vmsm = vm_mapping_find(vms, addr, size);
+	if (vmsm != NULL) {
+		struct vm_object *vmo = vmsm->vmsm_object;
+
+		switch (vmo->vmo_type) {
+		case OBJT_DEFAULT:
+			result = (void *)((uintptr_t)vmo->vmo_data +
+			    VMSM_OFFSET(vmsm, addr));
+			break;
+		default:
+			break;
+		}
+	}
+	mutex_exit(&vms->vms_lock);
+
+	return (result);
+}
+
+static int
+vmspace_pmap_wire(struct vmspace *vms, uintptr_t addr, pfn_t pfn, uint_t lvl,
+    uint_t prot, vm_memattr_t attr)
+{
+	enum pmap_type type = vms->vms_pmap.pm_type;
+
+	ASSERT(MUTEX_HELD(&vms->vms_lock));
+
+	switch (type) {
+	case PT_EPT: {
+		eptable_map_t *map = (eptable_map_t *)vms->vms_pmap.pm_map;
+
+		(void) eptable_mapin(map, addr, pfn, lvl, prot, attr);
+
+		vms->vms_pmap.pm_eptgen++;
+		return (0);
+	}
+	case PT_RVI:
+		/* RVI support not yet implemented */
+	default:
+		panic("unsupported pmap type: %x", type);
+		/* NOTREACHED */
+		break;
+	}
+	return (0);
+}
+
+static int
+vmspace_pmap_iswired(struct vmspace *vms, uintptr_t addr, uint_t *prot)
+{
+	enum pmap_type type = vms->vms_pmap.pm_type;
+
+	ASSERT(MUTEX_HELD(&vms->vms_lock));
+
+	switch (type) {
+	case PT_EPT: {
+		eptable_map_t *map = (eptable_map_t *)vms->vms_pmap.pm_map;
+		pfn_t pfn;
+
+		return (eptable_find(map, addr, &pfn, prot));
+	}
+	case PT_RVI:
+		/* RVI support not yet implemented */
+	default:
+		panic("unsupported pmap type: %x", type);
+		/* NOTREACHED */
+		break;
+	}
+	return (-1);
+}
+
+static int
+vmspace_pmap_unmap(struct vmspace *vms, uintptr_t addr, size_t size)
+{
+	enum pmap_type type = vms->vms_pmap.pm_type;
+
+	ASSERT(MUTEX_HELD(&vms->vms_lock));
+
+	switch (type) {
+	case PT_EPT: {
+		eptable_map_t *map = (eptable_map_t *)vms->vms_pmap.pm_map;
+		uintptr_t maddr = (uintptr_t)addr;
+		const ulong_t npages = btop(size);
+		ulong_t idx;
+
+		/* XXXJOY: punt on large pages for now */
+		for (idx = 0; idx < npages; idx++, maddr += PAGESIZE) {
+			eptable_mapout(map, maddr);
+		}
+		vms->vms_pmap.pm_eptgen++;
+		return (0);
+	}
+		break;
+	case PT_RVI:
+		/* RVI support not yet implemented */
+	default:
+		panic("unsupported pmap type: %x", type);
+		/* NOTREACHED */
+		break;
+	}
+	return (0);
+}
+
+static void
+pmap_free(pmap_t pmap)
+{
+	switch (pmap->pm_type) {
+	case PT_EPT: {
+		eptable_map_t *map = (eptable_map_t *)pmap->pm_map;
+
+		pmap->pm_pml4 = NULL;
+		pmap->pm_map = NULL;
+
+		eptable_fini(map);
+		kmem_free(map, sizeof (*map));
+		return;
+	}
+	case PT_RVI:
+		/* RVI support not yet implemented */
+	default:
+		panic("unsupported pmap type: %x", pmap->pm_type);
+		/* NOTREACHED */
+		break;
+	}
+}
+
+int
+pmap_pinit_type(pmap_t pmap, enum pmap_type type, int flags)
+{
+	/* For use in vmm only */
+	pmap->pm_type = type;
+	switch (type) {
+	case PT_EPT: {
+		eptable_map_t *map;
+
+		map = kmem_zalloc(sizeof (*map), KM_SLEEP);
+		eptable_init(map);
+
+		pmap->pm_map = map;
+		pmap->pm_pml4 = map->em_root->ept_kva;
+		return (1);
+	}
+	case PT_RVI:
+		/* RVI support not yet implemented */
+		return (0);
+	default:
+		panic("unsupported pmap type: %x", type);
+		/* NOTREACHED */
+		break;
+	}
+
+	/* XXXJOY: finish */
+	return (1);
+}
+
+long
+pmap_wired_count(pmap_t pmap)
+{
+	enum pmap_type type = pmap->pm_type;
+	long val = 0L;
+
+	switch (type) {
+	case PT_EPT:
+		val = ((eptable_map_t *)pmap->pm_map)->em_wired;
+		break;
+	case PT_RVI:
+		/* RVI support not yet implemented */
+	default:
+		panic("unsupported pmap type: %x", type);
+		/* NOTREACHED */
+		break;
+	}
+	return (val);
+}
+
+int
+pmap_emulate_accessed_dirty(pmap_t pmap, vm_offset_t va, int ftype)
+{
+	/* Allow the fallback to vm_fault to handle this */
+	return (-1);
+}
+
+
+static eptable_t *
+eptable_alloc(void)
+{
+	eptable_t *ept;
+	caddr_t page;
+
+	ept = kmem_zalloc(sizeof (*ept), KM_SLEEP);
+	page = kmem_zalloc(PAGESIZE, KM_SLEEP);
+	ept->ept_kva = page;
+	ept->ept_pfn = hat_getpfnum(kas.a_hat, page);
+
+	return (ept);
+}
+
+static void
+eptable_free(eptable_t *ept)
+{
+	void *page = ept->ept_kva;
+
+	ASSERT(ept->ept_pfn != PFN_INVALID);
+	ASSERT(ept->ept_kva != NULL);
+
+	ept->ept_pfn = PFN_INVALID;
+	ept->ept_kva = NULL;
+
+	kmem_free(page, PAGESIZE);
+	kmem_free(ept, sizeof (*ept));
+}
+
+static void
+eptable_init(eptable_map_t *map)
+{
+	eptable_t *root;
+
+	VERIFY0(mmu.hash_cnt & (mmu.hash_cnt - 1));
+
+	map->em_table_cnt = mmu.hash_cnt;
+	map->em_hash = kmem_zalloc(sizeof (eptable_t *) * map->em_table_cnt,
+	    KM_SLEEP);
+
+	root = eptable_alloc();
+	root->ept_level = mmu.max_level;
+	map->em_root = root;
+
+	/* Insert into global tracking list of eptable maps */
+	mutex_enter(&eptable_map_lock);
+	map->em_next = eptable_map_head;
+	map->em_prev = NULL;
+	if (eptable_map_head != NULL) {
+		eptable_map_head->em_prev = map;
+	}
+	eptable_map_head = map;
+	mutex_exit(&eptable_map_lock);
+}
+
+static void
+eptable_fini(eptable_map_t *map)
+{
+	const uint_t cnt = map->em_table_cnt;
+
+	/* Remove from global tracking list of eptable maps */
+	mutex_enter(&eptable_map_lock);
+	if (map->em_next != NULL) {
+		map->em_next->em_prev = map->em_prev;
+	}
+	if (map->em_prev != NULL) {
+		map->em_prev->em_next = map->em_next;
+	} else {
+		eptable_map_head = map->em_next;
+	}
+	mutex_exit(&eptable_map_lock);
+
+	mutex_enter(&map->em_lock);
+	/* XXJOY: Should we expect to need this clean-up? */
+	for (uint_t i = 0; i < cnt; i++) {
+		eptable_t *ept = map->em_hash[i];
+
+		while (ept != NULL) {
+			eptable_t *next = ept->ept_next;
+
+			eptable_hash_remove(map, ept);
+			eptable_free(ept);
+			ept = next;
+		}
+	}
+
+	kmem_free(map->em_hash, sizeof (eptable_t *) * cnt);
+	eptable_free(map->em_root);
+
+	mutex_exit(&map->em_lock);
+	mutex_destroy(&map->em_lock);
+}
+
+static eptable_t *
+eptable_hash_lookup(eptable_map_t *map, uintptr_t va, level_t lvl)
+{
+	const uint_t hash = EPTABLE_HASH(va, lvl, map->em_table_cnt);
+	eptable_t *ept;
+
+	ASSERT(MUTEX_HELD(&map->em_lock));
+
+	for (ept = map->em_hash[hash]; ept != NULL; ept = ept->ept_next) {
+		if (ept->ept_vaddr == va && ept->ept_level == lvl)
+			break;
+	}
+	return (ept);
+}
+
+static void
+eptable_hash_insert(eptable_map_t *map, eptable_t *ept)
+{
+	const uintptr_t va = ept->ept_vaddr;
+	const uint_t lvl = ept->ept_level;
+	const uint_t hash = EPTABLE_HASH(va, lvl, map->em_table_cnt);
+
+	ASSERT(MUTEX_HELD(&map->em_lock));
+	ASSERT(eptable_hash_lookup(map, va, lvl) == NULL);
+
+	ept->ept_prev = NULL;
+	if (map->em_hash[hash] == NULL) {
+		ept->ept_next = NULL;
+	} else {
+		eptable_t *chain = map->em_hash[hash];
+
+		ept->ept_next = chain;
+		chain->ept_prev = ept;
+	}
+	map->em_hash[hash] = ept;
+}
+
+static void
+eptable_hash_remove(eptable_map_t *map, eptable_t *ept)
+{
+	const uintptr_t va = ept->ept_vaddr;
+	const uint_t lvl = ept->ept_level;
+	const uint_t hash = EPTABLE_HASH(va, lvl, map->em_table_cnt);
+
+	ASSERT(MUTEX_HELD(&map->em_lock));
+
+	if (ept->ept_prev == NULL) {
+		ASSERT(map->em_hash[hash] == ept);
+
+		map->em_hash[hash] = ept->ept_next;
+	} else {
+		ept->ept_prev->ept_next = ept->ept_next;
+	}
+	if (ept->ept_next != NULL) {
+		ept->ept_next->ept_prev = ept->ept_prev;
+	}
+	ept->ept_next = NULL;
+	ept->ept_prev = NULL;
+}
+
+static eptable_t *
+eptable_walk(eptable_map_t *map, uintptr_t va, level_t tgtlvl, uint_t *idxp,
+    boolean_t do_create)
+{
+	eptable_t *ept = map->em_root;
+	level_t lvl = ept->ept_level;
+	uint_t idx = UINT_MAX;
+
+	ASSERT(MUTEX_HELD(&map->em_lock));
+
+	while (lvl >= tgtlvl) {
+		x86pte_t *ptes, entry;
+		const uintptr_t masked_va = va & LEVEL_MASK((uint_t)lvl);
+		eptable_t *newept = NULL;
+
+		idx = EPTABLE_VA2IDX(ept, va);
+		if (lvl == tgtlvl || lvl == 0) {
+			break;
+		}
+
+		ptes = (x86pte_t *)ept->ept_kva;
+		entry = ptes[idx];
+		if (EPT_IS_ABSENT(entry)) {
+			if (!do_create) {
+				break;
+			}
+
+			newept = eptable_alloc();
+			newept->ept_level = lvl - 1;
+			newept->ept_vaddr = masked_va;
+			newept->ept_parent = ept;
+
+			eptable_hash_insert(map, newept);
+			entry = EPT_PTE_ASSIGN_TABLE(newept->ept_pfn);
+			ptes[idx] = entry;
+			ept->ept_valid_cnt++;
+		} else if (!EPT_MAPS_PAGE(lvl, entry)) {
+			/* Do lookup in next level of page table */
+			newept = eptable_hash_lookup(map, masked_va, lvl - 1);
+
+			VERIFY(newept);
+			VERIFY3P(pfn_to_pa(newept->ept_pfn), ==,
+			    (entry & EPT_PADDR));
+		} else {
+			/*
+			 * There is a (large) page mapped here.  Since support
+			 * for non-PAGESIZE pages is not yet present, this is a
+			 * surprise.
+			 */
+			panic("unexpected large page in pte %p", &ptes[idx]);
+		}
+		ept = newept;
+		lvl--;
+	}
+
+	VERIFY(lvl >= 0 && idx != UINT_MAX);
+	*idxp = idx;
+	return (ept);
+}
+
+static pfn_t
+eptable_mapin(eptable_map_t *map, uintptr_t va, pfn_t pfn, uint_t lvl,
+    uint_t prot, vm_memattr_t attr)
+{
+	uint_t idx;
+	eptable_t *ept;
+	x86pte_t *ptes, entry;
+	const size_t pgsize = (size_t)LEVEL_SIZE(lvl);
+	pfn_t oldpfn = PFN_INVALID;
+
+	CTASSERT(EPT_R == PROT_READ);
+	CTASSERT(EPT_W == PROT_WRITE);
+	CTASSERT(EPT_X == PROT_EXEC);
+	ASSERT((prot & EPT_RWX) != 0 && (prot & ~EPT_RWX) == 0);
+
+	/* XXXJOY: punt on large pages for now */
+	VERIFY(lvl == 0);
+
+	mutex_enter(&map->em_lock);
+	ept = eptable_walk(map, va, (level_t)lvl, &idx, B_TRUE);
+	ptes = (x86pte_t *)ept->ept_kva;
+	entry = ptes[idx];
+
+	if (!EPT_IS_ABSENT(entry)) {
+		if (!EPT_MAPS_PAGE(lvl, entry)) {
+			panic("unexpected PT link %lx in %p[%d]",
+			    entry, ept, idx);
+		}
+
+		/*
+		 * XXXJOY: Just clean the entry for now. Assume(!) that
+		 * invalidation is going to occur anyways.
+		 */
+		oldpfn = EPT_PTE_PFN(ptes[idx]);
+		ept->ept_valid_cnt--;
+		ptes[idx] = (x86pte_t)0;
+		map->em_wired -= (pgsize >> PAGESHIFT);
+	}
+
+	entry = EPT_PTE_ASSIGN_PAGE(lvl, pfn, prot, attr);
+	ptes[idx] = entry;
+	ept->ept_valid_cnt++;
+	map->em_wired += (pgsize >> PAGESHIFT);
+	mutex_exit(&map->em_lock);
+
+	return (oldpfn);
+}
+
+static void
+eptable_mapout(eptable_map_t *map, uintptr_t va)
+{
+	eptable_t *ept;
+	uint_t idx;
+	x86pte_t *ptes, entry;
+
+	mutex_enter(&map->em_lock);
+	/* Find the lowest level entry at this VA */
+	ept = eptable_walk(map, va, -1, &idx, B_FALSE);
+
+	ptes = (x86pte_t *)ept->ept_kva;
+	entry = ptes[idx];
+
+	if (EPT_IS_ABSENT(entry)) {
+		/*
+		 * There is nothing here to free up.  If this was a sparsely
+		 * wired mapping, the absence is no concern.
+		 */
+		mutex_exit(&map->em_lock);
+		return;
+	} else {
+		pfn_t oldpfn;
+		const size_t pagesize = LEVEL_SIZE((uint_t)ept->ept_level);
+
+		if (!EPT_MAPS_PAGE(ept->ept_level, entry)) {
+			panic("unexpected PT link %lx in %p[%d]",
+			    entry, ept, idx);
+		}
+
+		/*
+		 * XXXJOY: Just clean the entry for now. Assume(!) that
+		 * invalidation is going to occur anyways.
+		 */
+		oldpfn = EPT_PTE_PFN(ptes[idx]);
+		ept->ept_valid_cnt--;
+		ptes[idx] = (x86pte_t)0;
+		map->em_wired -= (pagesize >> PAGESHIFT);
+	}
+
+	while (ept->ept_valid_cnt == 0 && ept->ept_parent != NULL) {
+		eptable_t *next = ept->ept_parent;
+
+		idx = EPTABLE_VA2IDX(next, va);
+		ptes = (x86pte_t *)next->ept_kva;
+
+		entry = ptes[idx];
+		ASSERT(!EPT_MAPS_PAGE(next->ept_level, entry));
+		ASSERT(EPT_PTE_PFN(entry) == ept->ept_pfn);
+
+		ptes[idx] = (x86pte_t)0;
+		next->ept_valid_cnt--;
+		eptable_hash_remove(map, ept);
+		ept->ept_parent = NULL;
+		eptable_free(ept);
+
+		ept = next;
+	}
+	mutex_exit(&map->em_lock);
+}
+
+static int
+eptable_find(eptable_map_t *map, uintptr_t va, pfn_t *pfn, uint_t *prot)
+{
+	eptable_t *ept;
+	uint_t idx;
+	x86pte_t *ptes, entry;
+	int err = -1;
+
+	mutex_enter(&map->em_lock);
+	/* Find the lowest level entry at this VA */
+	ept = eptable_walk(map, va, -1, &idx, B_FALSE);
+
+	/* XXXJOY: Until large pages are supported, this check is easy */
+	if (ept->ept_level != 0) {
+		mutex_exit(&map->em_lock);
+		return (-1);
+	}
+
+	ptes = (x86pte_t *)ept->ept_kva;
+	entry = ptes[idx];
+
+	if (!EPT_IS_ABSENT(entry)) {
+		if (!EPT_MAPS_PAGE(ept->ept_level, entry)) {
+			panic("unexpected PT link %lx in %p[%d]",
+			    entry, ept, idx);
+		}
+
+		*pfn = EPT_PTE_PFN(entry);
+		*prot = EPT_PTE_PROT(entry);
+		err = 0;
+	}
+
+	mutex_exit(&map->em_lock);
+	return (err);
+}
+
+struct sglist_ent {
+	vm_paddr_t	sge_pa;
+	size_t		sge_len;
+};
+struct sglist {
+	kmutex_t		sg_lock;
+	uint_t			sg_refcnt;
+	uint_t			sg_len;
+	uint_t			sg_next;
+	struct sglist_ent	sg_entries[];
+};
+
+#define	SG_SIZE(cnt)	(sizeof (struct sglist) + \
+	(sizeof (struct sglist_ent) * (cnt)))
+
+struct sglist *
+sglist_alloc(int nseg, int flags)
+{
+	const size_t sz = SG_SIZE(nseg);
+	const int flag = (flags & M_WAITOK) ? KM_SLEEP : KM_NOSLEEP;
+	struct sglist *sg;
+
+	ASSERT(nseg > 0);
+
+	sg = kmem_zalloc(sz, flag);
+	if (sg != NULL) {
+		sg->sg_len = nseg;
+		sg->sg_refcnt = 1;
+	}
+	return (sg);
+}
+
+void
+sglist_free(struct sglist *sg)
+{
+	size_t sz;
+
+	mutex_enter(&sg->sg_lock);
+	if (sg->sg_refcnt > 1) {
+		sg->sg_refcnt--;
+		mutex_exit(&sg->sg_lock);
+		return;
+	}
+
+	VERIFY(sg->sg_refcnt == 1);
+	sg->sg_refcnt = 0;
+	sz = SG_SIZE(sg->sg_len);
+	mutex_exit(&sg->sg_lock);
+	kmem_free(sg, sz);
+}
+
+int
+sglist_append_phys(struct sglist *sg, vm_paddr_t pa, size_t len)
+{
+	uint_t idx;
+	struct sglist_ent *ent;
+
+	/* Restrict to page-aligned entries */
+	if ((pa & PAGEOFFSET) != 0 || (len & PAGEOFFSET) != 0 || len == 0) {
+		return (EINVAL);
+	}
+
+	mutex_enter(&sg->sg_lock);
+	idx = sg->sg_next;
+	if (idx >= sg->sg_len) {
+		mutex_exit(&sg->sg_lock);
+		return (ENOSPC);
+	}
+
+	ent = &sg->sg_entries[idx];
+	ASSERT(ent->sge_pa == 0 && ent->sge_len == 0);
+	ent->sge_pa = pa;
+	ent->sge_len = len;
+	sg->sg_next++;
+
+	mutex_exit(&sg->sg_lock);
+	return (0);
+}
+
+
+static pfn_t
+vm_object_pager_none(vm_object_t vmo, uintptr_t off, pfn_t *lpfn, uint_t *lvl)
+{
+	panic("bad vm_object pager");
+	/* NOTREACHED */
+	return (PFN_INVALID);
+}
+
+static pfn_t
+vm_object_pager_heap(vm_object_t vmo, uintptr_t off, pfn_t *lpfn, uint_t *lvl)
+{
+	const uintptr_t kaddr = ALIGN2PAGE((uintptr_t)vmo->vmo_data + off);
+	uint_t idx, level;
+	htable_t *ht;
+	x86pte_t pte;
+	pfn_t top_pfn, pfn;
+
+	ASSERT(vmo->vmo_type == OBJT_DEFAULT);
+	ASSERT(off < vmo->vmo_size);
+
+	ht = htable_getpage(kas.a_hat, kaddr, &idx);
+	if (ht == NULL) {
+		return (PFN_INVALID);
+	}
+	pte = x86pte_get(ht, idx);
+	if (!PTE_ISPAGE(pte, ht->ht_level)) {
+		htable_release(ht);
+		return (PFN_INVALID);
+	}
+
+	pfn = top_pfn = PTE2PFN(pte, ht->ht_level);
+	level = ht->ht_level;
+	if (ht->ht_level > 0) {
+		pfn += mmu_btop(kaddr & LEVEL_OFFSET((uint_t)ht->ht_level));
+	}
+	htable_release(ht);
+
+	if (lpfn != NULL) {
+		*lpfn = top_pfn;
+	}
+	if (lvl != NULL) {
+		*lvl = level;
+	}
+	return (pfn);
+}
+
+static pfn_t
+vm_object_pager_sg(vm_object_t vmo, uintptr_t off, pfn_t *lpfn, uint_t *lvl)
+{
+	const uintptr_t aoff = ALIGN2PAGE(off);
+	uint_t level = 0;
+	uintptr_t pos = 0;
+	struct sglist *sg;
+	struct sglist_ent *ent;
+	pfn_t pfn = PFN_INVALID;
+
+	ASSERT(vmo->vmo_type == OBJT_SG);
+	ASSERT(off < vmo->vmo_size);
+
+	sg = vmo->vmo_data;
+	if (sg == NULL) {
+		return (PFN_INVALID);
+	}
+
+	ent = &sg->sg_entries[0];
+	for (uint_t i = 0; i < sg->sg_next; i++, ent++) {
+		if (aoff >= pos && aoff < (pos + ent->sge_len)) {
+			/* XXXJOY: Punt on large pages for now */
+			level = 0;
+			pfn = mmu_btop(ent->sge_pa + (aoff - pos));
+			break;
+		}
+		pos += ent->sge_len;
+	}
+
+	if (lpfn != 0) {
+		*lpfn = pfn;
+	}
+	if (lvl != 0) {
+		*lvl = level;
+	}
+	return (pfn);
+}
+
+static void
+vm_reserve_pages(size_t npages)
+{
+	uint_t retries = 60;
+	int rc;
+
+	mutex_enter(&freemem_lock);
+	if (availrmem < npages) {
+		mutex_exit(&freemem_lock);
+
+		/*
+		 * Set needfree and wait for the ZFS ARC reap thread to free up
+		 * some memory.
+		 */
+		page_needfree(npages);
+
+		mutex_enter(&freemem_lock);
+		while ((availrmem < npages) && retries-- > 0) {
+			mutex_exit(&freemem_lock);
+			rc = delay_sig(drv_usectohz(1 * MICROSEC));
+			mutex_enter(&freemem_lock);
+
+			if (rc == EINTR)
+				break;
+		}
+		mutex_exit(&freemem_lock);
+
+		page_needfree(-npages);
+	} else {
+		mutex_exit(&freemem_lock);
+	}
+}
+
+vm_object_t
+vm_object_allocate(objtype_t type, vm_pindex_t psize)
+{
+	vm_object_t vmo;
+	const size_t size = ptob((size_t)psize);
+
+	vmo = kmem_alloc(sizeof (*vmo), KM_SLEEP);
+	mutex_init(&vmo->vmo_lock, NULL, MUTEX_DEFAULT, NULL);
+
+	/* For now, these are to stay fixed after allocation */
+	vmo->vmo_type = type;
+	vmo->vmo_size = size;
+	vmo->vmo_attr = VM_MEMATTR_DEFAULT;
+
+	switch (type) {
+	case OBJT_DEFAULT: {
+		vm_reserve_pages(psize);
+
+		/* XXXJOY: opt-in to larger pages? */
+		vmo->vmo_data = vmem_alloc(vmm_alloc_arena, size, KM_NOSLEEP);
+		if (vmo->vmo_data == NULL) {
+			mutex_destroy(&vmo->vmo_lock);
+			kmem_free(vmo, sizeof (*vmo));
+			return (NULL);
+		}
+		/* XXXJOY: Better zeroing approach? */
+		bzero(vmo->vmo_data, size);
+		vmo->vmo_pager = vm_object_pager_heap;
+	}
+		break;
+	case OBJT_SG:
+		vmo->vmo_data = NULL;
+		vmo->vmo_pager = vm_object_pager_sg;
+		break;
+	default:
+		panic("Unsupported vm_object type");
+		break;
+	}
+
+	vmo->vmo_refcnt = 1;
+	return (vmo);
+}
+
+vm_object_t
+vm_pager_allocate(objtype_t type, void *handle, vm_ooffset_t size,
+    vm_prot_t prot, vm_ooffset_t off, void *cred)
+{
+	struct vm_object *vmo;
+	struct sglist *sg = (struct sglist *)handle;
+
+	/* XXXJOY: be very restrictive for now */
+	VERIFY(type == OBJT_SG);
+	VERIFY(off == 0);
+
+	vmo = vm_object_allocate(type, size);
+	vmo->vmo_data = sg;
+
+	mutex_enter(&sg->sg_lock);
+	VERIFY(sg->sg_refcnt++ >= 1);
+	mutex_exit(&sg->sg_lock);
+
+	return (vmo);
+}
+
+void
+vm_object_deallocate(vm_object_t vmo)
+{
+	ASSERT(vmo != NULL);
+
+	mutex_enter(&vmo->vmo_lock);
+	VERIFY(vmo->vmo_refcnt);
+	vmo->vmo_refcnt--;
+	if (vmo->vmo_refcnt != 0) {
+		mutex_exit(&vmo->vmo_lock);
+		return;
+	}
+
+	switch (vmo->vmo_type) {
+	case OBJT_DEFAULT:
+		vmem_free(vmm_alloc_arena, vmo->vmo_data, vmo->vmo_size);
+		break;
+	case OBJT_SG:
+		sglist_free((struct sglist *)vmo->vmo_data);
+		break;
+	default:
+		panic("Unsupported vm_object type");
+		break;
+	}
+
+	vmo->vmo_pager = vm_object_pager_none;
+	vmo->vmo_data = NULL;
+	vmo->vmo_size = 0;
+	mutex_exit(&vmo->vmo_lock);
+	mutex_destroy(&vmo->vmo_lock);
+	kmem_free(vmo, sizeof (*vmo));
+}
+
+int
+vm_object_set_memattr(vm_object_t vmo, vm_memattr_t attr)
+{
+	ASSERT(MUTEX_HELD(&vmo->vmo_lock));
+
+	switch (attr) {
+	case VM_MEMATTR_UNCACHEABLE:
+	case VM_MEMATTR_WRITE_BACK:
+		vmo->vmo_attr = attr;
+		return (0);
+	default:
+		break;
+	}
+	return (EINVAL);
+}
+
+void
+vm_object_reference(vm_object_t vmo)
+{
+	ASSERT(vmo != NULL);
+
+	mutex_enter(&vmo->vmo_lock);
+	vmo->vmo_refcnt++;
+	mutex_exit(&vmo->vmo_lock);
+}
+
+static vmspace_mapping_t *
+vm_mapping_find(struct vmspace *vms, uintptr_t addr, size_t size)
+{
+	vmspace_mapping_t *vmsm;
+	list_t *ml = &vms->vms_maplist;
+	const uintptr_t range_end = addr + size;
+
+	ASSERT(MUTEX_HELD(&vms->vms_lock));
+	ASSERT(addr <= range_end);
+
+	if (addr >= vms->vms_size) {
+		return (NULL);
+	}
+	for (vmsm = list_head(ml); vmsm != NULL; vmsm = list_next(ml, vmsm)) {
+		const uintptr_t seg_end = vmsm->vmsm_addr + vmsm->vmsm_len;
+
+		if (addr >= vmsm->vmsm_addr && addr < seg_end) {
+			if (range_end <= seg_end) {
+				return (vmsm);
+			} else {
+				return (NULL);
+			}
+		}
+	}
+	return (NULL);
+}
+
+static boolean_t
+vm_mapping_gap(struct vmspace *vms, uintptr_t addr, size_t size)
+{
+	vmspace_mapping_t *vmsm;
+	list_t *ml = &vms->vms_maplist;
+	const uintptr_t range_end = addr + size;
+
+	ASSERT(MUTEX_HELD(&vms->vms_lock));
+
+	for (vmsm = list_head(ml); vmsm != NULL; vmsm = list_next(ml, vmsm)) {
+		const uintptr_t seg_end = vmsm->vmsm_addr + vmsm->vmsm_len;
+
+		if ((vmsm->vmsm_addr >= addr && vmsm->vmsm_addr < range_end) ||
+		    (seg_end > addr && seg_end < range_end)) {
+			return (B_FALSE);
+		}
+	}
+	return (B_TRUE);
+}
+
+static void
+vm_mapping_remove(struct vmspace *vms, vmspace_mapping_t *vmsm)
+{
+	list_t *ml = &vms->vms_maplist;
+
+	ASSERT(MUTEX_HELD(&vms->vms_lock));
+
+	list_remove(ml, vmsm);
+	vm_object_deallocate(vmsm->vmsm_object);
+	kmem_free(vmsm, sizeof (*vmsm));
+}
+
+int
+vm_fault(vm_map_t map, vm_offset_t off, vm_prot_t type, int flag)
+{
+	struct vmspace *vms = VMMAP_TO_VMSPACE(map);
+	const uintptr_t addr = off;
+	vmspace_mapping_t *vmsm;
+	struct vm_object *vmo;
+	uint_t prot, map_lvl;
+	pfn_t pfn;
+	uintptr_t map_addr;
+
+	mutex_enter(&vms->vms_lock);
+	if (vmspace_pmap_iswired(vms, addr, &prot) == 0) {
+		int err = 0;
+
+		/*
+		 * It is possible that multiple will vCPUs race to fault-in a
+		 * given address.  In such cases, the race loser(s) will
+		 * encounter the already-mapped page, needing to do nothing
+		 * more than consider it a success.
+		 *
+		 * If the fault exceeds protection, it is an obvious error.
+		 */
+		if ((prot & type) != type) {
+			err = FC_PROT;
+		}
+
+		mutex_exit(&vms->vms_lock);
+		return (err);
+	}
+
+	/* Try to wire up the address */
+	if ((vmsm = vm_mapping_find(vms, addr, 0)) == NULL) {
+		mutex_exit(&vms->vms_lock);
+		return (FC_NOMAP);
+	}
+	vmo = vmsm->vmsm_object;
+	prot = vmsm->vmsm_prot;
+
+	/* XXXJOY: punt on large pages for now */
+	pfn = vmo->vmo_pager(vmo, VMSM_OFFSET(vmsm, addr), NULL, NULL);
+	map_lvl = 0;
+	map_addr = P2ALIGN((uintptr_t)addr, LEVEL_SIZE(map_lvl));
+	VERIFY(pfn != PFN_INVALID);
+
+	/*
+	 * If pmap failure is to be handled, the previously
+	 * acquired page locks would need to be released.
+	 */
+	VERIFY0(vmspace_pmap_wire(vms, map_addr, pfn, map_lvl, prot,
+	    vmo->vmo_attr));
+
+	mutex_exit(&vms->vms_lock);
+	return (0);
+}
+
+int
+vm_fault_quick_hold_pages(vm_map_t map, vm_offset_t addr, vm_size_t len,
+    vm_prot_t prot, vm_page_t *ma, int max_count)
+{
+	struct vmspace *vms = VMMAP_TO_VMSPACE(map);
+	const uintptr_t vaddr = addr;
+	vmspace_mapping_t *vmsm;
+	struct vm_object *vmo;
+	vm_page_t vmp;
+
+	ASSERT0(addr & PAGEOFFSET);
+	ASSERT(len == PAGESIZE);
+	ASSERT(max_count == 1);
+
+	mutex_enter(&vms->vms_lock);
+	if ((vmsm = vm_mapping_find(vms, vaddr, PAGESIZE)) == NULL ||
+	    (prot & ~vmsm->vmsm_prot) != 0) {
+		mutex_exit(&vms->vms_lock);
+		return (-1);
+	}
+
+	vmp = kmem_zalloc(sizeof (struct vm_page), KM_SLEEP);
+
+	vmo = vmsm->vmsm_object;
+	vm_object_reference(vmo);
+	vmp->vmp_obj_held = vmo;
+	vmp->vmp_pfn = vmo->vmo_pager(vmo, VMSM_OFFSET(vmsm, vaddr), NULL,
+	    NULL);
+
+	mutex_exit(&vms->vms_lock);
+	*ma = vmp;
+	return (1);
+}
+
+/*
+ * Find a suitable location for a mapping (and install it).
+ */
+int
+vm_map_find(vm_map_t map, vm_object_t vmo, vm_ooffset_t off, vm_offset_t *addr,
+    vm_size_t len, vm_offset_t max_addr, int find_flags, vm_prot_t prot,
+    vm_prot_t prot_max, int cow)
+{
+	struct vmspace *vms = VMMAP_TO_VMSPACE(map);
+	const size_t size = (size_t)len;
+	const uintptr_t uoff = (uintptr_t)off;
+	uintptr_t base = *addr;
+	vmspace_mapping_t *vmsm;
+	int res = 0;
+
+	/* For use in vmm only */
+	VERIFY(find_flags == VMFS_NO_SPACE); /* essentially MAP_FIXED */
+	VERIFY(max_addr == 0);
+
+	if (size == 0 || off < 0 ||
+	    uoff >= (uoff + size) || vmo->vmo_size < (uoff + size)) {
+		return (EINVAL);
+	}
+
+	if (*addr >= vms->vms_size) {
+		return (ENOMEM);
+	}
+
+	vmsm = kmem_alloc(sizeof (*vmsm), KM_SLEEP);
+
+	mutex_enter(&vms->vms_lock);
+	if (!vm_mapping_gap(vms, base, size)) {
+		res = ENOMEM;
+		goto out;
+	}
+
+	if (res == 0) {
+		vmsm->vmsm_object = vmo;
+		vmsm->vmsm_addr = base;
+		vmsm->vmsm_len = len;
+		vmsm->vmsm_offset = (off_t)uoff;
+		vmsm->vmsm_prot = prot;
+		list_insert_tail(&vms->vms_maplist, vmsm);
+
+		/* Communicate out the chosen address. */
+		*addr = (vm_offset_t)base;
+	}
+out:
+	mutex_exit(&vms->vms_lock);
+	if (res != 0) {
+		kmem_free(vmsm, sizeof (*vmsm));
+	}
+	return (res);
+}
+
+int
+vm_map_remove(vm_map_t map, vm_offset_t start, vm_offset_t end)
+{
+	struct vmspace *vms = VMMAP_TO_VMSPACE(map);
+	const uintptr_t addr = start;
+	const size_t size = (size_t)(end - start);
+	vmspace_mapping_t *vmsm;
+	objtype_t type;
+
+	ASSERT(start < end);
+
+	mutex_enter(&vms->vms_lock);
+	/* expect to match existing mapping exactly */
+	if ((vmsm = vm_mapping_find(vms, addr, size)) == NULL ||
+	    vmsm->vmsm_addr != addr || vmsm->vmsm_len != size) {
+		mutex_exit(&vms->vms_lock);
+		return (ENOENT);
+	}
+
+	type = vmsm->vmsm_object->vmo_type;
+	switch (type) {
+	case OBJT_DEFAULT:
+	case OBJT_SG:
+		VERIFY0(vmspace_pmap_unmap(vms, addr, size));
+		break;
+	default:
+		panic("unsupported object type: %x", type);
+		/* NOTREACHED */
+		break;
+	}
+
+	vm_mapping_remove(vms, vmsm);
+	mutex_exit(&vms->vms_lock);
+	return (0);
+}
+
+int
+vm_map_wire(vm_map_t map, vm_offset_t start, vm_offset_t end, int flags)
+{
+	struct vmspace *vms = VMMAP_TO_VMSPACE(map);
+	const uintptr_t addr = start;
+	const size_t size = end - start;
+	vmspace_mapping_t *vmsm;
+	struct vm_object *vmo;
+	uint_t prot;
+
+	mutex_enter(&vms->vms_lock);
+
+	/* For the time being, only exact-match mappings are expected */
+	if ((vmsm = vm_mapping_find(vms, addr, size)) == NULL) {
+		mutex_exit(&vms->vms_lock);
+		return (FC_NOMAP);
+	}
+	vmo = vmsm->vmsm_object;
+	prot = vmsm->vmsm_prot;
+
+	for (uintptr_t pos = addr; pos < end; ) {
+		pfn_t pfn;
+		uintptr_t pg_size, map_addr;
+		uint_t map_lvl = 0;
+
+		/* XXXJOY: punt on large pages for now */
+		pfn = vmo->vmo_pager(vmo, VMSM_OFFSET(vmsm, pos), NULL, NULL);
+		pg_size = LEVEL_SIZE(map_lvl);
+		map_addr = P2ALIGN(pos, pg_size);
+		VERIFY(pfn != PFN_INVALID);
+
+		VERIFY0(vmspace_pmap_wire(vms, map_addr, pfn, map_lvl, prot,
+		    vmo->vmo_attr));
+		pos += pg_size;
+	}
+
+	mutex_exit(&vms->vms_lock);
+
+	return (0);
+}
+
+/* Provided custom for bhyve 'devmem' segment mapping */
+int
+vm_segmap_obj(struct vmspace *vms, vm_object_t vmo, struct as *as,
+    caddr_t *addrp, uint_t prot, uint_t maxprot, uint_t flags)
+{
+	const size_t size = vmo->vmo_size;
+	int err;
+
+	if (vmo->vmo_type != OBJT_DEFAULT) {
+		/* Only support default objects for now */
+		return (ENOTSUP);
+	}
+
+	as_rangelock(as);
+
+	err = choose_addr(as, addrp, size, 0, ADDR_VACALIGN, flags);
+	if (err == 0) {
+		segvmm_crargs_t svma;
+
+		svma.kaddr = vmo->vmo_data;
+		svma.prot = prot;
+		svma.cookie = vmo;
+		svma.hold = (segvmm_holdfn_t)vm_object_reference;
+		svma.rele = (segvmm_relefn_t)vm_object_deallocate;
+
+		err = as_map(as, *addrp, size, segvmm_create, &svma);
+	}
+
+	as_rangeunlock(as);
+	return (err);
+}
+
+int
+vm_segmap_space(struct vmspace *vms, off_t off, struct as *as, caddr_t *addrp,
+    off_t len, uint_t prot, uint_t maxprot, uint_t flags)
+{
+	const uintptr_t addr = (uintptr_t)off;
+	const size_t size = (uintptr_t)len;
+	vmspace_mapping_t *vmsm;
+	vm_object_t vmo;
+	int err;
+
+	if (off < 0 || len <= 0 ||
+	    (addr & PAGEOFFSET) != 0 || (size & PAGEOFFSET) != 0) {
+		return (EINVAL);
+	}
+
+	mutex_enter(&vms->vms_lock);
+	if ((vmsm = vm_mapping_find(vms, addr, size)) == NULL) {
+		mutex_exit(&vms->vms_lock);
+		return (ENXIO);
+	}
+	if ((prot & ~(vmsm->vmsm_prot | PROT_USER)) != 0) {
+		mutex_exit(&vms->vms_lock);
+		return (EACCES);
+	}
+	vmo = vmsm->vmsm_object;
+	if (vmo->vmo_type != OBJT_DEFAULT) {
+		/* Only support default objects for now */
+		mutex_exit(&vms->vms_lock);
+		return (ENOTSUP);
+	}
+
+	as_rangelock(as);
+
+	err = choose_addr(as, addrp, size, off, ADDR_VACALIGN, flags);
+	if (err == 0) {
+		segvmm_crargs_t svma;
+		const uintptr_t addroff = addr - vmsm->vmsm_addr;
+		const uintptr_t mapoff = addroff + vmsm->vmsm_offset;
+
+		VERIFY(addroff < vmsm->vmsm_len);
+		VERIFY((vmsm->vmsm_len - addroff) >= size);
+		VERIFY(mapoff < vmo->vmo_size);
+		VERIFY((mapoff + size) <= vmo->vmo_size);
+
+		svma.kaddr = (void *)((uintptr_t)vmo->vmo_data + mapoff);
+		svma.prot = prot;
+		svma.cookie = vmo;
+		svma.hold = (segvmm_holdfn_t)vm_object_reference;
+		svma.rele = (segvmm_relefn_t)vm_object_deallocate;
+
+		err = as_map(as, *addrp, len, segvmm_create, &svma);
+	}
+
+	as_rangeunlock(as);
+	mutex_exit(&vms->vms_lock);
+	return (err);
+}
+
+void
+vm_page_lock(vm_page_t vmp)
+{
+	ASSERT(!MUTEX_HELD(&vmp->vmp_lock));
+
+	mutex_enter(&vmp->vmp_lock);
+}
+
+void
+vm_page_unlock(vm_page_t vmp)
+{
+	boolean_t purge = (vmp->vmp_pfn == PFN_INVALID);
+
+	ASSERT(MUTEX_HELD(&vmp->vmp_lock));
+
+	mutex_exit(&vmp->vmp_lock);
+
+	if (purge) {
+		mutex_destroy(&vmp->vmp_lock);
+		kmem_free(vmp, sizeof (*vmp));
+	}
+}
+
+void
+vm_page_unhold(vm_page_t vmp)
+{
+	ASSERT(MUTEX_HELD(&vmp->vmp_lock));
+	VERIFY(vmp->vmp_pfn != PFN_INVALID);
+
+	vm_object_deallocate(vmp->vmp_obj_held);
+	vmp->vmp_obj_held = NULL;
+	vmp->vmp_pfn = PFN_INVALID;
+}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_stat.c b/usr/src/uts/i86pc/io/vmm/vmm_stat.c
new file mode 100644
index 0000000000..c2c2cfe77c
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_stat.c
@@ -0,0 +1,172 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+
+#include <machine/vmm.h>
+#include "vmm_util.h"
+#include "vmm_stat.h"
+
+/*
+ * 'vst_num_elems' is the total number of addressable statistic elements
+ * 'vst_num_types' is the number of unique statistic types
+ *
+ * It is always true that 'vst_num_elems' is greater than or equal to
+ * 'vst_num_types'. This is because a stat type may represent more than
+ * one element (for e.g. VMM_STAT_ARRAY).
+ */
+static int vst_num_elems, vst_num_types;
+static struct vmm_stat_type *vsttab[MAX_VMM_STAT_ELEMS];
+
+static MALLOC_DEFINE(M_VMM_STAT, "vmm stat", "vmm stat");
+
+#define	vst_size	((size_t)vst_num_elems * sizeof(uint64_t))
+
+void
+vmm_stat_register(void *arg)
+{
+	struct vmm_stat_type *vst = arg;
+
+	/* We require all stats to identify themselves with a description */
+	if (vst->desc == NULL)
+		return;
+
+	if (vst->scope == VMM_STAT_SCOPE_INTEL && !vmm_is_intel())
+		return;
+
+	if (vst->scope == VMM_STAT_SCOPE_AMD && !vmm_is_amd())
+		return;
+
+	if (vst_num_elems + vst->nelems >= MAX_VMM_STAT_ELEMS) {
+		printf("Cannot accommodate vmm stat type \"%s\"!\n", vst->desc);
+		return;
+	}
+
+	vst->index = vst_num_elems;
+	vst_num_elems += vst->nelems;
+
+	vsttab[vst_num_types++] = vst;
+}
+
+int
+vmm_stat_copy(struct vm *vm, int vcpu, int *num_stats, uint64_t *buf)
+{
+	struct vmm_stat_type *vst;
+	uint64_t *stats;
+	int i;
+
+	if (vcpu < 0 || vcpu >= VM_MAXCPU)
+		return (EINVAL);
+
+	/* Let stats functions update their counters */
+	for (i = 0; i < vst_num_types; i++) {
+		vst = vsttab[i];
+		if (vst->func != NULL)
+			(*vst->func)(vm, vcpu, vst);
+	}
+
+	/* Copy over the stats */
+	stats = vcpu_stats(vm, vcpu);
+	for (i = 0; i < vst_num_elems; i++)
+		buf[i] = stats[i];
+	*num_stats = vst_num_elems;
+	return (0);
+}
+
+void *
+vmm_stat_alloc(void)
+{
+
+	return (malloc(vst_size, M_VMM_STAT, M_WAITOK));
+}
+
+void
+vmm_stat_init(void *vp)
+{
+
+	bzero(vp, vst_size);
+}
+
+void
+vmm_stat_free(void *vp)
+{
+	free(vp, M_VMM_STAT);
+}
+
+int
+vmm_stat_desc_copy(int index, char *buf, int bufsize)
+{
+	int i;
+	struct vmm_stat_type *vst;
+
+	for (i = 0; i < vst_num_types; i++) {
+		vst = vsttab[i];
+		if (index >= vst->index && index < vst->index + vst->nelems) {
+			if (vst->nelems > 1) {
+				snprintf(buf, bufsize, "%s[%d]",
+					 vst->desc, index - vst->index);
+			} else {
+				strlcpy(buf, vst->desc, bufsize);
+			}
+			return (0);	/* found it */
+		}
+	}
+
+	return (EINVAL);
+}
+
+/* global statistics */
+VMM_STAT(VCPU_MIGRATIONS, "vcpu migration across host cpus");
+VMM_STAT(VMEXIT_COUNT, "total number of vm exits");
+VMM_STAT(VMEXIT_EXTINT, "vm exits due to external interrupt");
+VMM_STAT(VMEXIT_HLT, "number of times hlt was intercepted");
+VMM_STAT(VMEXIT_CR_ACCESS, "number of times %cr access was intercepted");
+VMM_STAT(VMEXIT_RDMSR, "number of times rdmsr was intercepted");
+VMM_STAT(VMEXIT_WRMSR, "number of times wrmsr was intercepted");
+VMM_STAT(VMEXIT_MTRAP, "number of monitor trap exits");
+VMM_STAT(VMEXIT_PAUSE, "number of times pause was intercepted");
+VMM_STAT(VMEXIT_INTR_WINDOW, "vm exits due to interrupt window opening");
+VMM_STAT(VMEXIT_NMI_WINDOW, "vm exits due to nmi window opening");
+VMM_STAT(VMEXIT_INOUT, "number of times in/out was intercepted");
+VMM_STAT(VMEXIT_CPUID, "number of times cpuid was intercepted");
+VMM_STAT(VMEXIT_NESTED_FAULT, "vm exits due to nested page fault");
+VMM_STAT(VMEXIT_INST_EMUL, "vm exits for instruction emulation");
+VMM_STAT(VMEXIT_UNKNOWN, "number of vm exits for unknown reason");
+VMM_STAT(VMEXIT_ASTPENDING, "number of times astpending at exit");
+VMM_STAT(VMEXIT_REQIDLE, "number of times idle requested at exit");
+VMM_STAT(VMEXIT_USERSPACE, "number of vm exits handled in userspace");
+VMM_STAT(VMEXIT_RENDEZVOUS, "number of times rendezvous pending at exit");
+VMM_STAT(VMEXIT_EXCEPTION, "number of vm exits due to exceptions");
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_stat.h b/usr/src/uts/i86pc/io/vmm/vmm_stat.h
new file mode 100644
index 0000000000..1193cea368
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_stat.h
@@ -0,0 +1,172 @@
+/*-
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _VMM_STAT_H_
+#define	_VMM_STAT_H_
+
+#include <machine/vmm.h>
+
+struct vm;
+
+#ifdef __FreeBSD__
+#define	MAX_VMM_STAT_ELEMS	64			/* arbitrary */
+#else
+#define	MAX_VMM_STAT_ELEMS	(64 + VM_MAXCPU)	/* arbitrary */
+#endif
+
+enum vmm_stat_scope {
+	VMM_STAT_SCOPE_ANY,
+	VMM_STAT_SCOPE_INTEL,		/* Intel VMX specific statistic */
+	VMM_STAT_SCOPE_AMD,		/* AMD SVM specific statistic */
+};
+
+struct vmm_stat_type;
+typedef void (*vmm_stat_func_t)(struct vm *vm, int vcpu,
+    struct vmm_stat_type *stat);
+
+struct vmm_stat_type {
+	int	index;			/* position in the stats buffer */
+	int	nelems;			/* standalone or array */
+	const char *desc;		/* description of statistic */
+	vmm_stat_func_t func;
+	enum vmm_stat_scope scope;
+};
+
+void	vmm_stat_register(void *arg);
+
+#define	VMM_STAT_FDEFINE(type, nelems, desc, func, scope)		\
+	struct vmm_stat_type type[1] = {				\
+		{ -1, nelems, desc, func, scope }			\
+	};								\
+	SYSINIT(type##_stat, SI_SUB_KLD, SI_ORDER_ANY, vmm_stat_register, type)
+
+#define VMM_STAT_DEFINE(type, nelems, desc, scope) 			\
+	VMM_STAT_FDEFINE(type, nelems, desc, NULL, scope)
+
+#define	VMM_STAT_DECLARE(type)						\
+	extern struct vmm_stat_type type[1]
+
+#define	VMM_STAT(type, desc)		\
+	VMM_STAT_DEFINE(type, 1, desc, VMM_STAT_SCOPE_ANY)
+#define	VMM_STAT_INTEL(type, desc)	\
+	VMM_STAT_DEFINE(type, 1, desc, VMM_STAT_SCOPE_INTEL)
+#define	VMM_STAT_AMD(type, desc)	\
+	VMM_STAT_DEFINE(type, 1, desc, VMM_STAT_SCOPE_AMD)
+
+#define	VMM_STAT_FUNC(type, desc, func)	\
+	VMM_STAT_FDEFINE(type, 1, desc, func, VMM_STAT_SCOPE_ANY)
+
+#define	VMM_STAT_ARRAY(type, nelems, desc)	\
+	VMM_STAT_DEFINE(type, nelems, desc, VMM_STAT_SCOPE_ANY)
+
+void	*vmm_stat_alloc(void);
+void	vmm_stat_init(void *vp);
+void 	vmm_stat_free(void *vp);
+
+/*
+ * 'buf' should be at least fit 'MAX_VMM_STAT_TYPES' entries
+ */
+int	vmm_stat_copy(struct vm *vm, int vcpu, int *num_stats, uint64_t *buf);
+int	vmm_stat_desc_copy(int index, char *buf, int buflen);
+
+static __inline void
+vmm_stat_array_incr(struct vm *vm, int vcpu, struct vmm_stat_type *vst,
+		    int statidx, uint64_t x)
+{
+#ifdef VMM_KEEP_STATS
+	uint64_t *stats;
+	
+	stats = vcpu_stats(vm, vcpu);
+
+	if (vst->index >= 0 && statidx < vst->nelems)
+		stats[vst->index + statidx] += x;
+#endif
+}
+
+static __inline void
+vmm_stat_array_set(struct vm *vm, int vcpu, struct vmm_stat_type *vst,
+		   int statidx, uint64_t val)
+{
+#ifdef VMM_KEEP_STATS
+	uint64_t *stats;
+	
+	stats = vcpu_stats(vm, vcpu);
+
+	if (vst->index >= 0 && statidx < vst->nelems)
+		stats[vst->index + statidx] = val;
+#endif
+}
+
+static __inline void
+vmm_stat_incr(struct vm *vm, int vcpu, struct vmm_stat_type *vst, uint64_t x)
+{
+
+#ifdef VMM_KEEP_STATS
+	vmm_stat_array_incr(vm, vcpu, vst, 0, x);
+#endif
+}
+
+static __inline void
+vmm_stat_set(struct vm *vm, int vcpu, struct vmm_stat_type *vst, uint64_t val)
+{
+
+#ifdef VMM_KEEP_STATS
+	vmm_stat_array_set(vm, vcpu, vst, 0, val);
+#endif
+}
+
+VMM_STAT_DECLARE(VCPU_MIGRATIONS);
+VMM_STAT_DECLARE(VMEXIT_COUNT);
+VMM_STAT_DECLARE(VMEXIT_EXTINT);
+VMM_STAT_DECLARE(VMEXIT_HLT);
+VMM_STAT_DECLARE(VMEXIT_CR_ACCESS);
+VMM_STAT_DECLARE(VMEXIT_RDMSR);
+VMM_STAT_DECLARE(VMEXIT_WRMSR);
+VMM_STAT_DECLARE(VMEXIT_MTRAP);
+VMM_STAT_DECLARE(VMEXIT_PAUSE);
+VMM_STAT_DECLARE(VMEXIT_INTR_WINDOW);
+VMM_STAT_DECLARE(VMEXIT_NMI_WINDOW);
+VMM_STAT_DECLARE(VMEXIT_INOUT);
+VMM_STAT_DECLARE(VMEXIT_CPUID);
+VMM_STAT_DECLARE(VMEXIT_NESTED_FAULT);
+VMM_STAT_DECLARE(VMEXIT_INST_EMUL);
+VMM_STAT_DECLARE(VMEXIT_UNKNOWN);
+VMM_STAT_DECLARE(VMEXIT_ASTPENDING);
+VMM_STAT_DECLARE(VMEXIT_USERSPACE);
+VMM_STAT_DECLARE(VMEXIT_RENDEZVOUS);
+VMM_STAT_DECLARE(VMEXIT_EXCEPTION);
+VMM_STAT_DECLARE(VMEXIT_REQIDLE);
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_util.c b/usr/src/uts/i86pc/io/vmm/vmm_util.c
new file mode 100644
index 0000000000..3eadfe57e5
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_util.c
@@ -0,0 +1,127 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2013 Pluribus Networks Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/libkern.h>
+
+#include <machine/md_var.h>
+
+#include "vmm_util.h"
+
+boolean_t
+vmm_is_intel(void)
+{
+
+	if (strcmp(cpu_vendor, "GenuineIntel") == 0)
+		return (TRUE);
+	else
+		return (FALSE);
+}
+
+boolean_t
+vmm_is_amd(void)
+{
+	if (strcmp(cpu_vendor, "AuthenticAMD") == 0)
+		return (TRUE);
+	else
+		return (FALSE);
+}
+
+boolean_t
+vmm_supports_1G_pages(void)
+{
+	unsigned int regs[4];
+
+	/*
+	 * CPUID.80000001:EDX[bit 26] = 1 indicates support for 1GB pages
+	 *
+	 * Both Intel and AMD support this bit.
+	 */
+	if (cpu_exthigh >= 0x80000001) {
+		do_cpuid(0x80000001, regs);
+		if (regs[3] & (1 << 26))
+			return (TRUE);
+	}
+	return (FALSE);
+}
+
+#ifdef	__FreeBSD__
+#include <sys/proc.h>
+#include <machine/frame.h>
+#define	DUMP_REG(x)	printf(#x "\t\t0x%016lx\n", (long)(tf->tf_ ## x))
+#define	DUMP_SEG(x)	printf(#x "\t\t0x%04x\n", (unsigned)(tf->tf_ ## x))
+void
+dump_trapframe(struct trapframe *tf)
+{
+	DUMP_REG(rdi);
+	DUMP_REG(rsi);
+	DUMP_REG(rdx);
+	DUMP_REG(rcx);
+	DUMP_REG(r8);
+	DUMP_REG(r9);
+	DUMP_REG(rax);
+	DUMP_REG(rbx);
+	DUMP_REG(rbp);
+	DUMP_REG(r10);
+	DUMP_REG(r11);
+	DUMP_REG(r12);
+	DUMP_REG(r13);
+	DUMP_REG(r14);
+	DUMP_REG(r15);
+	DUMP_REG(trapno);
+	DUMP_REG(addr);
+	DUMP_REG(flags);
+	DUMP_REG(err);
+	DUMP_REG(rip);
+	DUMP_REG(rflags);
+	DUMP_REG(rsp);
+	DUMP_SEG(cs);
+	DUMP_SEG(ss);
+	DUMP_SEG(fs);
+	DUMP_SEG(gs);
+	DUMP_SEG(es);
+	DUMP_SEG(ds);
+}
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_util.h b/usr/src/uts/i86pc/io/vmm/vmm_util.h
new file mode 100644
index 0000000000..fc7e7364c7
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_util.h
@@ -0,0 +1,42 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VMM_UTIL_H_
+#define	_VMM_UTIL_H_
+
+struct trapframe;
+
+boolean_t	vmm_is_intel(void);
+boolean_t	vmm_is_amd(void);
+boolean_t	vmm_supports_1G_pages(void);
+
+void		dump_trapframe(struct trapframe *tf);
+
+#endif
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_zsd.c b/usr/src/uts/i86pc/io/vmm/vmm_zsd.c
new file mode 100644
index 0000000000..8313dfbb50
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/vmm_zsd.c
@@ -0,0 +1,200 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
+
+#include <sys/cpuvar.h>
+#include <sys/debug.h>
+#include <sys/kmem.h>
+#include <sys/ksynch.h>
+#include <sys/list.h>
+#include <sys/types.h>
+#include <sys/vmm.h>
+#include <sys/vmm_impl.h>
+#include <sys/zone.h>
+
+/*
+ * zone specific data
+ *
+ * Zone specific data is used to keep an association between zones and the vmm
+ * instances that may be running in them.  This is used to ensure that vmm
+ * instances do not outlive their parent zone.
+ *
+ * Locking strategy
+ *
+ * The global vmm_zsd_lock is held while modifying vmm_zsd_list.
+ *
+ * The per zone vz_lock in vmm_zsd_t is held while reading or writing anything
+ * within in vmm_zsd_t instance.  This is important to ensure that there's not
+ * an accidental VM creating as a zone is going down.
+ */
+
+/*
+ * One of these per zone.
+ */
+struct vmm_zsd {
+	list_t		vz_vmms;	/* vmm instances in the zone */
+	list_node_t	vz_linkage;	/* link to other zones */
+	boolean_t	vz_active;	/* B_FALSE early in shutdown callback */
+	zoneid_t	vz_zoneid;
+	kmutex_t	vz_lock;
+};
+
+static kmutex_t vmm_zsd_lock;		/* Protects vmm_zsd_list */
+static list_t vmm_zsd_list;		/* Linkage between all zsd instances */
+
+static zone_key_t vmm_zsd_key;
+
+int
+vmm_zsd_add_vm(vmm_softc_t *sc)
+{
+	vmm_zsd_t *zsd;
+
+	ASSERT(sc->vmm_zone != NULL);
+
+	mutex_enter(&vmm_zsd_lock);
+
+	for (zsd = list_head(&vmm_zsd_list); zsd != NULL;
+	    zsd = list_next(&vmm_zsd_list, zsd)) {
+		if (zsd->vz_zoneid == sc->vmm_zone->zone_id) {
+			break;
+		}
+	}
+
+	VERIFY(zsd != NULL);
+	mutex_exit(&vmm_zsd_lock);
+
+	mutex_enter(&zsd->vz_lock);
+	if (!zsd->vz_active) {
+		mutex_exit(&zsd->vz_lock);
+		return (ENOSYS);
+	}
+
+	sc->vmm_zsd = zsd;
+	list_insert_tail(&zsd->vz_vmms, sc);
+
+	mutex_exit(&zsd->vz_lock);
+
+	return (0);
+}
+
+void
+vmm_zsd_rem_vm(vmm_softc_t *sc)
+{
+	vmm_zsd_t *zsd = sc->vmm_zsd;
+
+	mutex_enter(&zsd->vz_lock);
+
+	list_remove(&zsd->vz_vmms, sc);
+	sc->vmm_zsd = NULL;
+
+	mutex_exit(&zsd->vz_lock);
+}
+
+static void *
+vmm_zsd_create(zoneid_t zid)
+{
+	vmm_zsd_t *zsd;
+
+	zsd = kmem_zalloc(sizeof (*zsd), KM_SLEEP);
+
+	list_create(&zsd->vz_vmms, sizeof (vmm_softc_t),
+	    offsetof(vmm_softc_t, vmm_zsd_linkage));
+
+	zsd->vz_zoneid = zid;
+
+	mutex_init(&zsd->vz_lock, NULL, MUTEX_DEFAULT, NULL);
+	zsd->vz_active = B_TRUE;
+
+	mutex_enter(&vmm_zsd_lock);
+	list_insert_tail(&vmm_zsd_list, zsd);
+	mutex_exit(&vmm_zsd_lock);
+
+	return (zsd);
+}
+
+/*
+ * Tells all runing VMs in the zone to poweroff.  This does not reclaim guest
+ * resources (memory, etc.).
+ */
+static void
+vmm_zsd_shutdown(zoneid_t zid, void *data)
+{
+	vmm_zsd_t *zsd = data;
+	vmm_softc_t *sc;
+
+	mutex_enter(&zsd->vz_lock);
+	ASSERT(zsd->vz_active);
+	zsd->vz_active = B_FALSE;
+
+	for (sc = list_head(&zsd->vz_vmms); sc != NULL;
+	    sc = list_next(&zsd->vz_vmms, sc)) {
+		/* Send a poweroff to the VM, whether running or not. */
+		(void) vm_suspend(sc->vmm_vm, VM_SUSPEND_POWEROFF);
+	}
+	mutex_exit(&zsd->vz_lock);
+}
+
+/*
+ * Reap all VMs that remain and free up guest resources.
+ */
+static void
+vmm_zsd_destroy(zoneid_t zid, void *data)
+{
+	vmm_zsd_t *zsd = data;
+	vmm_softc_t *sc;
+
+	mutex_enter(&vmm_zsd_lock);
+	list_remove(&vmm_zsd_list, zsd);
+	mutex_exit(&vmm_zsd_lock);
+
+	mutex_enter(&zsd->vz_lock);
+	ASSERT(!zsd->vz_active);
+
+	while ((sc = list_remove_head(&zsd->vz_vmms)) != NULL) {
+		int err;
+
+		/*
+		 * This frees all resources associated with the vm, including
+		 * sc.
+		 */
+		err = vmm_do_vm_destroy(sc, B_FALSE);
+		ASSERT3S(err, ==, 0);
+	}
+
+	mutex_exit(&zsd->vz_lock);
+	mutex_destroy(&zsd->vz_lock);
+
+	kmem_free(zsd, sizeof (*zsd));
+}
+
+void
+vmm_zsd_init(void)
+{
+	mutex_init(&vmm_zsd_lock, NULL, MUTEX_DEFAULT, NULL);
+	list_create(&vmm_zsd_list, sizeof (vmm_zsd_t),
+	    offsetof(vmm_zsd_t, vz_linkage));
+	zone_key_create(&vmm_zsd_key, vmm_zsd_create, vmm_zsd_shutdown,
+	    vmm_zsd_destroy);
+}
+
+void
+vmm_zsd_fini(void)
+{
+	/* Calls vmm_zsd_destroy() on all zones. */
+	zone_key_delete(vmm_zsd_key);
+	ASSERT(list_is_empty(&vmm_zsd_list));
+
+	list_destroy(&vmm_zsd_list);
+	mutex_destroy(&vmm_zsd_lock);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/x86.c b/usr/src/uts/i86pc/io/vmm/x86.c
new file mode 100644
index 0000000000..d6426bde44
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/x86.c
@@ -0,0 +1,548 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2014 Pluribus Networks Inc.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/pcpu.h>
+#include <sys/systm.h>
+#include <sys/sysctl.h>
+#include <sys/x86_archext.h>
+
+#include <machine/clock.h>
+#include <machine/cpufunc.h>
+#include <machine/md_var.h>
+#include <machine/segments.h>
+#include <machine/specialreg.h>
+
+#include <machine/vmm.h>
+
+#include "vmm_host.h"
+#include "vmm_ktr.h"
+#include "vmm_util.h"
+#include "x86.h"
+
+SYSCTL_DECL(_hw_vmm);
+SYSCTL_NODE(_hw_vmm, OID_AUTO, topology, CTLFLAG_RD, 0, NULL);
+
+#define	CPUID_VM_HIGH		0x40000000
+
+static const char bhyve_id[12] = "bhyve bhyve ";
+
+static uint64_t bhyve_xcpuids;
+SYSCTL_ULONG(_hw_vmm, OID_AUTO, bhyve_xcpuids, CTLFLAG_RW, &bhyve_xcpuids, 0,
+    "Number of times an unknown cpuid leaf was accessed");
+
+static int cpuid_leaf_b = 1;
+SYSCTL_INT(_hw_vmm_topology, OID_AUTO, cpuid_leaf_b, CTLFLAG_RDTUN,
+    &cpuid_leaf_b, 0, NULL);
+
+/*
+ * Round up to the next power of two, if necessary, and then take log2.
+ * Returns -1 if argument is zero.
+ */
+static __inline int
+log2(u_int x)
+{
+
+	return (fls(x << (1 - powerof2(x))) - 1);
+}
+
+int
+x86_emulate_cpuid(struct vm *vm, int vcpu_id,
+		  uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)
+{
+	const struct xsave_limits *limits;
+	uint64_t cr4;
+	int error, enable_invpcid, level, width = 0, x2apic_id = 0;
+	unsigned int func, regs[4], logical_cpus = 0;
+	enum x2apic_state x2apic_state;
+	uint16_t cores, maxcpus, sockets, threads;
+
+	VCPU_CTR2(vm, vcpu_id, "cpuid %#x,%#x", *eax, *ecx);
+
+	/*
+	 * Requests for invalid CPUID levels should map to the highest
+	 * available level instead.
+	 */
+	if (cpu_exthigh != 0 && *eax >= 0x80000000) {
+		if (*eax > cpu_exthigh)
+			*eax = cpu_exthigh;
+	} else if (*eax >= 0x40000000) {
+		if (*eax > CPUID_VM_HIGH)
+			*eax = CPUID_VM_HIGH;
+	} else if (*eax > cpu_high) {
+		*eax = cpu_high;
+	}
+
+	func = *eax;
+
+	/*
+	 * In general the approach used for CPU topology is to
+	 * advertise a flat topology where all CPUs are packages with
+	 * no multi-core or SMT.
+	 */
+	switch (func) {
+		/*
+		 * Pass these through to the guest
+		 */
+		case CPUID_0000_0000:
+		case CPUID_0000_0002:
+		case CPUID_0000_0003:
+		case CPUID_8000_0000:
+		case CPUID_8000_0002:
+		case CPUID_8000_0003:
+		case CPUID_8000_0004:
+		case CPUID_8000_0006:
+			cpuid_count(*eax, *ecx, regs);
+			break;
+		case CPUID_8000_0008:
+			cpuid_count(*eax, *ecx, regs);
+			if (vmm_is_amd()) {
+				/*
+				 * XXX this might appear silly because AMD
+				 * cpus don't have threads.
+				 *
+				 * However this matches the logical cpus as
+				 * advertised by leaf 0x1 and will work even
+				 * if threads is set incorrectly on an AMD host.
+				 */
+				vm_get_topology(vm, &sockets, &cores, &threads,
+				    &maxcpus);
+				logical_cpus = threads * cores;
+				regs[2] = logical_cpus - 1;
+			}
+			break;
+
+		case CPUID_8000_0001:
+			cpuid_count(*eax, *ecx, regs);
+
+			/*
+			 * Hide SVM and Topology Extension features from guest.
+			 */
+			regs[2] &= ~(AMDID2_SVM | AMDID2_TOPOLOGY);
+
+			/*
+			 * Don't advertise extended performance counter MSRs
+			 * to the guest.
+			 */
+			regs[2] &= ~AMDID2_PCXC;
+			regs[2] &= ~AMDID2_PNXC;
+			regs[2] &= ~AMDID2_PTSCEL2I;
+
+			/*
+			 * Don't advertise Instruction Based Sampling feature.
+			 */
+			regs[2] &= ~AMDID2_IBS;
+
+			/* NodeID MSR not available */
+			regs[2] &= ~AMDID2_NODE_ID;
+
+			/* Don't advertise the OS visible workaround feature */
+			regs[2] &= ~AMDID2_OSVW;
+
+			/* Hide mwaitx/monitorx capability from the guest */
+			regs[2] &= ~AMDID2_MWAITX;
+
+			/*
+			 * Hide rdtscp/ia32_tsc_aux until we know how
+			 * to deal with them.
+			 */
+			regs[3] &= ~AMDID_RDTSCP;
+			break;
+
+		case CPUID_8000_0007:
+			/*
+			 * AMD uses this leaf to advertise the processor's
+			 * power monitoring and RAS capabilities. These
+			 * features are hardware-specific and exposing
+			 * them to a guest doesn't make a lot of sense.
+			 *
+			 * Intel uses this leaf only to advertise the
+			 * "Invariant TSC" feature with all other bits
+			 * being reserved (set to zero).
+			 */
+			regs[0] = 0;
+			regs[1] = 0;
+			regs[2] = 0;
+			regs[3] = 0;
+
+			/*
+			 * "Invariant TSC" can be advertised to the guest if:
+			 * - host TSC frequency is invariant
+			 * - host TSCs are synchronized across physical cpus
+			 *
+			 * XXX This still falls short because the vcpu
+			 * can observe the TSC moving backwards as it
+			 * migrates across physical cpus. But at least
+			 * it should discourage the guest from using the
+			 * TSC to keep track of time.
+			 */
+#ifdef __FreeBSD__
+			/* XXXJOY: Wire up with our own TSC logic */
+			if (tsc_is_invariant && smp_tsc)
+				regs[3] |= AMDPM_TSC_INVARIANT;
+			break;
+#endif /* __FreeBSD__ */
+
+		case CPUID_0000_0001:
+			do_cpuid(1, regs);
+
+			error = vm_get_x2apic_state(vm, vcpu_id, &x2apic_state);
+			if (error) {
+				panic("x86_emulate_cpuid: error %d "
+				      "fetching x2apic state", error);
+			}
+
+			/*
+			 * Override the APIC ID only in ebx
+			 */
+			regs[1] &= ~(CPUID_LOCAL_APIC_ID);
+			regs[1] |= (vcpu_id << CPUID_0000_0001_APICID_SHIFT);
+
+			/*
+			 * Don't expose VMX, SpeedStep, TME or SMX capability.
+			 * Advertise x2APIC capability and Hypervisor guest.
+			 */
+			regs[2] &= ~(CPUID2_VMX | CPUID2_EST | CPUID2_TM2);
+			regs[2] &= ~(CPUID2_SMX);
+
+			regs[2] |= CPUID2_HV;
+
+			if (x2apic_state != X2APIC_DISABLED)
+				regs[2] |= CPUID2_X2APIC;
+			else
+				regs[2] &= ~CPUID2_X2APIC;
+
+			/*
+			 * Only advertise CPUID2_XSAVE in the guest if
+			 * the host is using XSAVE.
+			 */
+			if (!(regs[2] & CPUID2_OSXSAVE))
+				regs[2] &= ~CPUID2_XSAVE;
+
+			/*
+			 * If CPUID2_XSAVE is being advertised and the
+			 * guest has set CR4_XSAVE, set
+			 * CPUID2_OSXSAVE.
+			 */
+			regs[2] &= ~CPUID2_OSXSAVE;
+			if (regs[2] & CPUID2_XSAVE) {
+				error = vm_get_register(vm, vcpu_id,
+				    VM_REG_GUEST_CR4, &cr4);
+				if (error)
+					panic("x86_emulate_cpuid: error %d "
+					      "fetching %%cr4", error);
+				if (cr4 & CR4_XSAVE)
+					regs[2] |= CPUID2_OSXSAVE;
+			}
+
+			/*
+			 * Hide monitor/mwait until we know how to deal with
+			 * these instructions.
+			 */
+			regs[2] &= ~CPUID2_MON;
+
+                        /*
+			 * Hide the performance and debug features.
+			 */
+			regs[2] &= ~CPUID2_PDCM;
+
+			/*
+			 * No TSC deadline support in the APIC yet
+			 */
+			regs[2] &= ~CPUID2_TSCDLT;
+
+			/*
+			 * Hide thermal monitoring
+			 */
+			regs[3] &= ~(CPUID_ACPI | CPUID_TM);
+
+			/*
+			 * Hide the debug store capability.
+			 */
+			regs[3] &= ~CPUID_DS;
+
+			/*
+			 * Advertise the Machine Check and MTRR capability.
+			 *
+			 * Some guest OSes (e.g. Windows) will not boot if
+			 * these features are absent.
+			 */
+			regs[3] |= (CPUID_MCA | CPUID_MCE | CPUID_MTRR);
+
+			vm_get_topology(vm, &sockets, &cores, &threads,
+			    &maxcpus);
+			logical_cpus = threads * cores;
+			regs[1] &= ~CPUID_HTT_CORES;
+			regs[1] |= (logical_cpus & 0xff) << 16;
+			regs[3] |= CPUID_HTT;
+			break;
+
+		case CPUID_0000_0004:
+			cpuid_count(*eax, *ecx, regs);
+
+			if (regs[0] || regs[1] || regs[2] || regs[3]) {
+				vm_get_topology(vm, &sockets, &cores, &threads,
+				    &maxcpus);
+				regs[0] &= 0x3ff;
+				regs[0] |= (cores - 1) << 26;
+				/*
+				 * Cache topology:
+				 * - L1 and L2 are shared only by the logical
+				 *   processors in a single core.
+				 * - L3 and above are shared by all logical
+				 *   processors in the package.
+				 */
+				logical_cpus = threads;
+				level = (regs[0] >> 5) & 0x7;
+				if (level >= 3)
+					logical_cpus *= cores;
+				regs[0] |= (logical_cpus - 1) << 14;
+			}
+			break;
+
+		case CPUID_0000_0007:
+			regs[0] = 0;
+			regs[1] = 0;
+			regs[2] = 0;
+			regs[3] = 0;
+
+			/* leaf 0 */
+			if (*ecx == 0) {
+				cpuid_count(*eax, *ecx, regs);
+
+				/* Only leaf 0 is supported */
+				regs[0] = 0;
+
+				/*
+				 * Expose known-safe features.
+				 */
+				regs[1] &= (CPUID_STDEXT_FSGSBASE |
+				    CPUID_STDEXT_BMI1 | CPUID_STDEXT_HLE |
+				    CPUID_STDEXT_AVX2 | CPUID_STDEXT_BMI2 |
+				    CPUID_STDEXT_ERMS | CPUID_STDEXT_RTM |
+				    CPUID_STDEXT_AVX512F |
+				    CPUID_STDEXT_AVX512PF |
+				    CPUID_STDEXT_AVX512ER |
+				    CPUID_STDEXT_AVX512CD);
+				regs[2] = 0;
+				regs[3] = 0;
+
+				/* Advertise INVPCID if it is enabled. */
+				error = vm_get_capability(vm, vcpu_id,
+				    VM_CAP_ENABLE_INVPCID, &enable_invpcid);
+				if (error == 0 && enable_invpcid)
+					regs[1] |= CPUID_STDEXT_INVPCID;
+			}
+			break;
+
+		case CPUID_0000_0006:
+			regs[0] = CPUTPM1_ARAT;
+			regs[1] = 0;
+			regs[2] = 0;
+			regs[3] = 0;
+			break;
+
+		case CPUID_0000_000A:
+			/*
+			 * Handle the access, but report 0 for
+			 * all options
+			 */
+			regs[0] = 0;
+			regs[1] = 0;
+			regs[2] = 0;
+			regs[3] = 0;
+			break;
+
+		case CPUID_0000_000B:
+			/*
+			 * Processor topology enumeration
+			 */
+			vm_get_topology(vm, &sockets, &cores, &threads,
+			    &maxcpus);
+			if (*ecx == 0) {
+				logical_cpus = threads;
+				width = log2(logical_cpus);
+				level = CPUID_TYPE_SMT;
+				x2apic_id = vcpu_id;
+			}
+
+			if (*ecx == 1) {
+				logical_cpus = threads * cores;
+				width = log2(logical_cpus);
+				level = CPUID_TYPE_CORE;
+				x2apic_id = vcpu_id;
+			}
+
+			if (!cpuid_leaf_b || *ecx >= 2) {
+				width = 0;
+				logical_cpus = 0;
+				level = 0;
+				x2apic_id = 0;
+			}
+
+			regs[0] = width & 0x1f;
+			regs[1] = logical_cpus & 0xffff;
+			regs[2] = (level << 8) | (*ecx & 0xff);
+			regs[3] = x2apic_id;
+			break;
+
+		case CPUID_0000_000D:
+			limits = vmm_get_xsave_limits();
+			if (!limits->xsave_enabled) {
+				regs[0] = 0;
+				regs[1] = 0;
+				regs[2] = 0;
+				regs[3] = 0;
+				break;
+			}
+
+			cpuid_count(*eax, *ecx, regs);
+			switch (*ecx) {
+			case 0:
+				/*
+				 * Only permit the guest to use bits
+				 * that are active in the host in
+				 * %xcr0.  Also, claim that the
+				 * maximum save area size is
+				 * equivalent to the host's current
+				 * save area size.  Since this runs
+				 * "inside" of vmrun(), it runs with
+				 * the guest's xcr0, so the current
+				 * save area size is correct as-is.
+				 */
+				regs[0] &= limits->xcr0_allowed;
+				regs[2] = limits->xsave_max_size;
+				regs[3] &= (limits->xcr0_allowed >> 32);
+				break;
+			case 1:
+				/* Only permit XSAVEOPT. */
+				regs[0] &= CPUID_EXTSTATE_XSAVEOPT;
+				regs[1] = 0;
+				regs[2] = 0;
+				regs[3] = 0;
+				break;
+			default:
+				/*
+				 * If the leaf is for a permitted feature,
+				 * pass through as-is, otherwise return
+				 * all zeroes.
+				 */
+				if (!(limits->xcr0_allowed & (1ul << *ecx))) {
+					regs[0] = 0;
+					regs[1] = 0;
+					regs[2] = 0;
+					regs[3] = 0;
+				}
+				break;
+			}
+			break;
+
+		case 0x40000000:
+			regs[0] = CPUID_VM_HIGH;
+			bcopy(bhyve_id, &regs[1], 4);
+			bcopy(bhyve_id + 4, &regs[2], 4);
+			bcopy(bhyve_id + 8, &regs[3], 4);
+			break;
+
+		default:
+			/*
+			 * The leaf value has already been clamped so
+			 * simply pass this through, keeping count of
+			 * how many unhandled leaf values have been seen.
+			 */
+			atomic_add_long(&bhyve_xcpuids, 1);
+			cpuid_count(*eax, *ecx, regs);
+			break;
+	}
+
+	*eax = regs[0];
+	*ebx = regs[1];
+	*ecx = regs[2];
+	*edx = regs[3];
+
+	return (1);
+}
+
+bool
+vm_cpuid_capability(struct vm *vm, int vcpuid, enum vm_cpuid_capability cap)
+{
+	bool rv;
+
+	KASSERT(cap > 0 && cap < VCC_LAST, ("%s: invalid vm_cpu_capability %d",
+	    __func__, cap));
+
+	/*
+	 * Simply passthrough the capabilities of the host cpu for now.
+	 */
+	rv = false;
+	switch (cap) {
+#ifdef __FreeBSD__
+	case VCC_NO_EXECUTE:
+		if (amd_feature & AMDID_NX)
+			rv = true;
+		break;
+	case VCC_FFXSR:
+		if (amd_feature & AMDID_FFXSR)
+			rv = true;
+		break;
+	case VCC_TCE:
+		if (amd_feature2 & AMDID2_TCE)
+			rv = true;
+		break;
+#else
+	case VCC_NO_EXECUTE:
+		if (is_x86_feature(x86_featureset, X86FSET_NX))
+			rv = true;
+		break;
+	/* XXXJOY: No kernel detection for FFXR or TCE at present, so ignore */
+	case VCC_FFXSR:
+	case VCC_TCE:
+		break;
+#endif
+	default:
+		panic("%s: unknown vm_cpu_capability %d", __func__, cap);
+	}
+	return (rv);
+}
diff --git a/usr/src/uts/i86pc/io/vmm/x86.h b/usr/src/uts/i86pc/io/vmm/x86.h
new file mode 100644
index 0000000000..3a8e043852
--- /dev/null
+++ b/usr/src/uts/i86pc/io/vmm/x86.h
@@ -0,0 +1,80 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _X86_H_
+#define	_X86_H_
+
+#define CPUID_0000_0000 (0x0)
+#define CPUID_0000_0001	(0x1)
+#define CPUID_0000_0002 (0x2)
+#define CPUID_0000_0003 (0x3)
+#define CPUID_0000_0004 (0x4)
+#define CPUID_0000_0006 (0x6)
+#define CPUID_0000_0007 (0x7)
+#define	CPUID_0000_000A	(0xA)
+#define	CPUID_0000_000B	(0xB)
+#define	CPUID_0000_000D	(0xD)
+#define CPUID_8000_0000	(0x80000000)
+#define CPUID_8000_0001	(0x80000001)
+#define CPUID_8000_0002	(0x80000002)
+#define CPUID_8000_0003	(0x80000003)
+#define CPUID_8000_0004	(0x80000004)
+#define CPUID_8000_0006	(0x80000006)
+#define CPUID_8000_0007	(0x80000007)
+#define CPUID_8000_0008	(0x80000008)
+
+/*
+ * CPUID instruction Fn0000_0001:
+ */
+#define CPUID_0000_0001_APICID_MASK			(0xff<<24)
+#define CPUID_0000_0001_APICID_SHIFT			24
+
+/*
+ * CPUID instruction Fn0000_0001 ECX
+ */
+#define CPUID_0000_0001_FEAT0_VMX	(1<<5)
+
+int x86_emulate_cpuid(struct vm *vm, int vcpu_id, uint32_t *eax, uint32_t *ebx,
+		      uint32_t *ecx, uint32_t *edx);
+
+enum vm_cpuid_capability {
+	VCC_NONE,
+	VCC_NO_EXECUTE,
+	VCC_FFXSR,
+	VCC_TCE,
+	VCC_LAST
+};
+
+/*
+ * Return 'true' if the capability 'cap' is enabled in this virtual cpu
+ * and 'false' otherwise.
+ */
+bool vm_cpuid_capability(struct vm *vm, int vcpuid, enum vm_cpuid_capability);
+#endif
diff --git a/usr/src/uts/i86pc/ml/kpti_trampolines.s b/usr/src/uts/i86pc/ml/kpti_trampolines.s
index 83cbd69048..6ab3edc3d4 100644
--- a/usr/src/uts/i86pc/ml/kpti_trampolines.s
+++ b/usr/src/uts/i86pc/ml/kpti_trampolines.s
@@ -665,6 +665,8 @@ tr_intr_ret_end:
 	MK_INTR_TRAMPOLINE_NOERR(invaltrap)
 	MK_INTR_TRAMPOLINE_NOERR(fasttrap)
 	MK_INTR_TRAMPOLINE_NOERR(dtrace_ret)
+	MK_INTR_TRAMPOLINE_NOERR(brand_sys_int80)
+	MK_INTR_TRAMPOLINE_NOERR(sys_int80)
 
 	/*
 	 * These are special because they can interrupt other traps, and
diff --git a/usr/src/uts/i86pc/ml/offsets.in b/usr/src/uts/i86pc/ml/offsets.in
index 7e4d2bdec3..8dc6f0f572 100644
--- a/usr/src/uts/i86pc/ml/offsets.in
+++ b/usr/src/uts/i86pc/ml/offsets.in
@@ -128,9 +128,6 @@ _kthread	THREAD_SIZE
 	t_useracc
 #endif
 
-ctxop
-	save_op			CTXOP_SAVE
-
 as
 	a_hat
 
@@ -150,6 +147,7 @@ _klwp
 	lwp_thread
 	lwp_procp
 	lwp_brand
+	lwp_brand_syscall
 	lwp_eosys
 	lwp_regs
 	lwp_arg
diff --git a/usr/src/uts/i86pc/ml/syscall_asm.s b/usr/src/uts/i86pc/ml/syscall_asm.s
index c604d14c08..5bb6bdea31 100644
--- a/usr/src/uts/i86pc/ml/syscall_asm.s
+++ b/usr/src/uts/i86pc/ml/syscall_asm.s
@@ -632,6 +632,36 @@ _sysenter_done:
 	sysexit
 	SET_SIZE(sys_sysenter)
 	SET_SIZE(brand_sys_sysenter)
+#endif	/* __lint */
+
+#if defined(__lint)
+/*
+ * System call via an int80.  This entry point is only used by the Linux
+ * application environment.  Unlike the sysenter path, there is no default
+ * action to take if no callback is registered for this process.
+ */
+void
+sys_int80()
+{}
+
+#else	/* __lint */
+
+	ENTRY_NP(brand_sys_int80)
+	BRAND_CALLBACK(BRAND_CB_INT80)
+
+	ALTENTRY(sys_int80)
+	/*
+	 * We hit an int80, but this process isn't of a brand with an int80
+	 * handler.  Bad process!  Make it look as if the INT failed.
+	 * Modify %eip to point before the INT, push the expected error
+	 * code and fake a GP fault.
+	 * 
+	 */
+	subl	$2, (%esp)	/* int insn 2-bytes */
+	pushl	$_CONST(_MUL(T_INT80, GATE_DESC_SIZE) + 2)
+	jmp	gptrap			/ GP fault
+	SET_SIZE(sys_int80)
+	SET_SIZE(brand_sys_int80)
 
 /*
  * Declare a uintptr_t which covers the entire pc range of syscall
diff --git a/usr/src/uts/i86pc/ml/syscall_asm_amd64.s b/usr/src/uts/i86pc/ml/syscall_asm_amd64.s
index b09b4f1fdc..9727110109 100644
--- a/usr/src/uts/i86pc/ml/syscall_asm_amd64.s
+++ b/usr/src/uts/i86pc/ml/syscall_asm_amd64.s
@@ -543,6 +543,7 @@ noprod_sys_syscall:
 
 	movq	T_LWP(%r15), %r14
 	ASSERT_NO_RUPDATE_PENDING(%r14)
+
 	ENABLE_INTR_FLAGS
 
 	MSTATE_TRANSITION(LMS_USER, LMS_SYSTEM)
@@ -556,6 +557,37 @@ noprod_sys_syscall:
 
 	incq	%gs:CPU_STATS_SYS_SYSCALL
 
+	/*
+	 * If our LWP has an alternate system call handler, run that instead of
+	 * the regular system call path.
+	 */
+	movq	LWP_BRAND_SYSCALL(%r14), %rdi
+	testq	%rdi, %rdi
+	jz	_syscall_no_brand
+
+	pushq	%rax
+	subq	$8, %rsp	/* align stack for call to C */
+	call	*%rdi
+	addq	$8, %rsp
+
+	/*
+	 * If the alternate handler returns non-zero, the normal system call
+	 * processing is resumed.
+	 */
+	testl	%eax, %eax
+	popq	%rax
+	jnz	_syscall_no_brand
+
+	/*
+	 * For branded syscalls which were handled in-kernel, shuffle the
+	 * register state as would be done by the native handler before jumping
+	 * to the post-syscall logic.
+	 */
+	movq	REGOFF_RAX(%rsp), %r12
+	movq	REGOFF_RDX(%rsp), %r13
+	jmp	_syscall_after_brand
+
+_syscall_no_brand:
 	movw	%ax, T_SYSNUM(%r15)
 	movzbl	T_PRE_SYS(%r15), %ebx
 	ORL_SYSCALLTRACE(%ebx)
@@ -590,6 +622,8 @@ _syscall_invoke:
 	shrq	$32, %r13	/* upper 32-bits into %edx */
 	movl	%r12d, %r12d	/* lower 32-bits into %eax */
 5:
+
+_syscall_after_brand:
 	/*
 	 * Optimistically assume that there's no post-syscall
 	 * work to do.  (This is to avoid having to call syscall_mstate()
@@ -853,11 +887,46 @@ _syscall32_save:
 	incq	 %gs:CPU_STATS_SYS_SYSCALL
 
 	/*
+	 * If our lwp has an alternate system call handler, run that instead
+	 * of the regular system call path.
+	 */
+	movq	LWP_BRAND_SYSCALL(%r14), %rax
+	testq	%rax, %rax
+	jz	_syscall32_no_brand
+
+	movb	$LWP_SYS, LWP_STATE(%r14)
+	call	*%rax
+
+	/*
+	 * If the alternate handler returns non-zero, the normal system call
+	 * processing is resumed.
+	 */
+	testl	%eax, %eax
+	jnz	_syscall32_no_brand
+
+	/*
+	 * For branded syscalls which were handled in-kernel, shuffle the
+	 * register state as would be done by the native handler before jumping
+	 * to the post-syscall logic.
+	 */
+	movl	REGOFF_RAX(%rsp), %r12d
+	movl	REGOFF_RDX(%rsp), %r13d
+	jmp	_syscall32_after_brand
+
+_syscall32_no_brand:
+	/*
 	 * Make some space for MAXSYSARGS (currently 8) 32-bit args placed
 	 * into 64-bit (long) arg slots, maintaining 16 byte alignment.  Or
 	 * more succinctly:
 	 *
 	 *	SA(MAXSYSARGS * sizeof (long)) == 64
+	 *
+	 * Note, this space is used both to copy in the arguments from user
+	 * land, but also to as part of the old UNIX style syscall_ap() method.
+	 * syscall_entry expects that we do not change the values of this space
+	 * that we give it. However, this means that when we end up in the more
+	 * recent model of passing the arguments based on the calling
+	 * conventions, we'll need to save an additional 16 bytes of stack.
 	 */
 #define	SYS_DROP	64			/* drop for args */
 	subq	$SYS_DROP, %rsp
@@ -885,12 +954,16 @@ _syscall32_save:
 	 */
 
 	movq	%rax, %rbx
-	movl	0(%rsp), %edi
-	movl	8(%rsp), %esi
-	movl	0x10(%rsp), %edx
-	movl	0x18(%rsp), %ecx
-	movl	0x20(%rsp), %r8d
-	movl	0x28(%rsp), %r9d
+	movl	0x0(%rsp), %edi		/* arg0 */
+	movl	0x8(%rsp), %esi		/* arg1 */
+	movl	0x10(%rsp), %edx	/* arg2 */
+	movl	0x38(%rsp), %eax	/* arg7 load */
+	movl	0x18(%rsp), %ecx	/* arg3 */
+	pushq	%rax			/* arg7 saved to stack */
+	movl	0x28(%rsp), %r8d	/* arg4 */
+	movl	0x38(%rsp), %eax	/* arg6 load */
+	movl	0x30(%rsp), %r9d	/* arg5 */
+	pushq	%rax			/* arg6 saved to stack */
 
 	call	*SY_CALLC(%rbx)
 
@@ -908,6 +981,8 @@ _syscall32_save:
 	shrq	$32, %r13	/* upper 32-bits into %edx */
 	movl	%eax, %r12d	/* lower 32-bits into %eax */
 
+_syscall32_after_brand:
+
 	/*
 	 * Optimistically assume that there's no post-syscall
 	 * work to do.  (This is to avoid having to call syscall_mstate()
@@ -1159,15 +1234,20 @@ sys_sysenter()
 	/*
 	 * Fetch the arguments copied onto the kernel stack and put
 	 * them in the right registers to invoke a C-style syscall handler.
-	 * %rax contains the handler address.
+	 * %rax contains the handler address. For the last two arguments, we
+	 * push them onto the stack -- we can't clobber the old arguments.
 	 */
 	movq	%rax, %rbx
-	movl	0(%rsp), %edi
-	movl	8(%rsp), %esi
-	movl	0x10(%rsp), %edx
-	movl	0x18(%rsp), %ecx
-	movl	0x20(%rsp), %r8d
-	movl	0x28(%rsp), %r9d
+	movl	0x0(%rsp), %edi		/* arg0 */
+	movl	0x8(%rsp), %esi		/* arg1 */
+	movl	0x10(%rsp), %edx	/* arg2 */
+	movl	0x38(%rsp), %eax	/* arg7 load */
+	movl	0x18(%rsp), %ecx	/* arg3 */
+	pushq	%rax			/* arg7 saved to stack */
+	movl	0x28(%rsp), %r8d	/* arg4 */
+	movl	0x38(%rsp), %eax	/* arg6 load */
+	movl	0x30(%rsp), %r9d	/* arg5 */
+	pushq	%rax			/* arg6 saved to stack */
 
 	call	*SY_CALLC(%rbx)
 
@@ -1245,6 +1325,74 @@ sys_sysenter()
 
 #endif	/* __lint */
 
+#if defined(__lint)
+/*
+ * System call via an int80.  This entry point is only used by the Linux
+ * application environment.  Unlike the other entry points, there is no
+ * default action to take if no callback is registered for this process.
+ */
+void
+sys_int80()
+{}
+
+#else	/* __lint */
+
+	ENTRY_NP(brand_sys_int80)
+	SWAPGS				/* kernel gsbase */
+	XPV_TRAP_POP
+	call	smap_enable
+
+	/*
+	 * We first attempt to call the "b_int80" handler from the "struct
+	 * brand_mach_ops" for this brand.  If no handler function is installed
+	 * for this brand, the BRAND_CALLBACK() macro returns here and we
+	 * check the lwp for a "lwp_brand_syscall" handler.
+	 */
+	BRAND_CALLBACK(BRAND_CB_INT80, BRAND_URET_FROM_INTR_STACK())
+
+	/*
+	 * Check to see if this lwp provides "lwp_brand_syscall".  If so, we
+	 * will route this int80 through the regular system call handling path.
+	 */
+	movq	%r15, %gs:CPU_RTMP_R15
+	movq	%gs:CPU_THREAD, %r15
+	movq	T_LWP(%r15), %r15
+	movq	LWP_BRAND_SYSCALL(%r15), %r15
+	testq	%r15, %r15
+	movq	%gs:CPU_RTMP_R15, %r15
+	jnz	nopop_syscall_int
+
+	/*
+	 * The brand provided neither a "b_int80", nor a "lwp_brand_syscall"
+	 * function, and has thus opted out of handling this trap.
+	 */
+	SWAPGS				/* user gsbase */
+	jmp	nopop_int80
+
+	ENTRY_NP(sys_int80)
+	/*
+	 * We hit an int80, but this process isn't of a brand with an int80
+	 * handler.  Bad process!  Make it look as if the INT failed.
+	 * Modify %rip to point before the INT, push the expected error
+	 * code and fake a GP fault. Note on 64-bit hypervisor we need
+	 * to undo the XPV_TRAP_POP and push rcx and r11 back on the stack
+	 * because gptrap will pop them again with its own XPV_TRAP_POP.
+	 */
+	XPV_TRAP_POP
+	call	smap_enable
+nopop_int80:
+	subq	$2, (%rsp)	/* int insn 2-bytes */
+	pushq	$_CONST(_MUL(T_INT80, GATE_DESC_SIZE) + 2)
+#if defined(__xpv)
+	push	%r11
+	push	%rcx
+#endif
+	jmp	gptrap			/ GP fault
+	SET_SIZE(sys_int80)
+	SET_SIZE(brand_sys_int80)
+#endif	/* __lint */
+
+
 /*
  * This is the destination of the "int $T_SYSCALLINT" interrupt gate, used by
  * the generic i386 libc to do system calls. We do a small amount of setup
diff --git a/usr/src/uts/i86pc/os/cmi.c b/usr/src/uts/i86pc/os/cmi.c
index 4d27eb61d3..b3d52c1726 100644
--- a/usr/src/uts/i86pc/os/cmi.c
+++ b/usr/src/uts/i86pc/os/cmi.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 /*
@@ -69,13 +70,6 @@ int cmi_force_generic = 0;
  */
 int cmi_panic_on_uncorrectable_error = 1;
 
-#ifndef __xpv
-/*
- * Set to indicate whether we are able to enable cmci interrupt.
- */
-int cmi_enable_cmci = 0;
-#endif
-
 /*
  * Subdirectory (relative to the module search path) in which we will
  * look for cpu modules.
@@ -967,3 +961,15 @@ cmi_panic_callback(void)
 
 	cmi_hdl_rele(hdl);
 }
+
+
+const char *
+cmi_hdl_chipident(cmi_hdl_t hdl)
+{
+	cmi_t *cmi = cmi_hdl_getcmi(hdl);
+
+	if (!CMI_OP_PRESENT(cmi, cmi_ident))
+		return (NULL);
+
+	return (CMI_OPS(cmi)->cmi_ident(hdl));
+}
diff --git a/usr/src/uts/i86pc/os/cmi_hw.c b/usr/src/uts/i86pc/os/cmi_hw.c
index be119e7046..531be4ce47 100644
--- a/usr/src/uts/i86pc/os/cmi_hw.c
+++ b/usr/src/uts/i86pc/os/cmi_hw.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 /*
  * Copyright (c) 2010, Intel Corporation.
@@ -121,6 +122,7 @@ struct cmi_hdl_ops {
 	const char *(*cmio_chiprevstr)(cmi_hdl_impl_t *);
 	uint32_t (*cmio_getsockettype)(cmi_hdl_impl_t *);
 	const char *(*cmio_getsocketstr)(cmi_hdl_impl_t *);
+	uint_t (*cmio_chipsig)(cmi_hdl_impl_t *);
 
 	id_t (*cmio_logical_id)(cmi_hdl_impl_t *);
 	/*
@@ -684,6 +686,12 @@ ntv_getsocketstr(cmi_hdl_impl_t *hdl)
 	return (cpuid_getsocketstr(HDLPRIV(hdl)));
 }
 
+static uint_t
+ntv_chipsig(cmi_hdl_impl_t *hdl)
+{
+	return (cpuid_getsig(HDLPRIV(hdl)));
+}
+
 static id_t
 ntv_logical_id(cmi_hdl_impl_t *hdl)
 {
@@ -997,6 +1005,12 @@ xpv_getsocketstr(cmi_hdl_impl_t *hdl)
 	    xpv_model(hdl), xpv_stepping(hdl)));
 }
 
+static uint_t
+xpv_chipsig(cmi_hdl_impl_t *hdl)
+{
+	return (0);
+}
+
 static id_t
 xpv_logical_id(cmi_hdl_impl_t *hdl)
 {
@@ -1595,6 +1609,7 @@ cmi_hdl_class(cmi_hdl_t ophdl)
 		    cmio_##what(IMPLHDL(ophdl)));		\
 	}
 
+/* BEGIN CSTYLED */
 CMI_HDL_OPFUNC(vendor, uint_t)
 CMI_HDL_OPFUNC(vendorstr, const char *)
 CMI_HDL_OPFUNC(family, uint_t)
@@ -1614,6 +1629,8 @@ CMI_HDL_OPFUNC(logical_id, id_t)
 CMI_HDL_OPFUNC(smbiosid, uint16_t)
 CMI_HDL_OPFUNC(smb_chipid, uint_t)
 CMI_HDL_OPFUNC(smb_bboard, nvlist_t *)
+CMI_HDL_OPFUNC(chipsig, uint_t)
+/* END CSTYLED */
 
 boolean_t
 cmi_hdl_is_cmt(cmi_hdl_t ophdl)
@@ -1990,6 +2007,7 @@ static const struct cmi_hdl_ops cmi_hdl_ops = {
 	xpv_chiprevstr,		/* cmio_chiprevstr */
 	xpv_getsockettype,	/* cmio_getsockettype */
 	xpv_getsocketstr,	/* cmio_getsocketstr */
+	xpv_chipsig,		/* cmio_chipsig */
 	xpv_logical_id,		/* cmio_logical_id */
 	NULL,			/* cmio_getcr4 */
 	NULL,			/* cmio_setcr4 */
@@ -2022,6 +2040,7 @@ static const struct cmi_hdl_ops cmi_hdl_ops = {
 	ntv_chiprevstr,		/* cmio_chiprevstr */
 	ntv_getsockettype,	/* cmio_getsockettype */
 	ntv_getsocketstr,	/* cmio_getsocketstr */
+	ntv_chipsig,		/* cmio_chipsig */
 	ntv_logical_id,		/* cmio_logical_id */
 	ntv_getcr4,		/* cmio_getcr4 */
 	ntv_setcr4,		/* cmio_setcr4 */
diff --git a/usr/src/uts/i86pc/os/cpr_impl.c b/usr/src/uts/i86pc/os/cpr_impl.c
index 91fb583a01..f173a1dc57 100644
--- a/usr/src/uts/i86pc/os/cpr_impl.c
+++ b/usr/src/uts/i86pc/os/cpr_impl.c
@@ -753,6 +753,20 @@ i_cpr_is_supported(int sleeptype)
 	if (sleeptype != CPR_TORAM)
 		return (0);
 
+        /*
+         * Unfortunately, the x86 resume code was never implemented for GAS.
+         * The only obvious problem is that a trick necessary to appease Sun
+         * Studio does the wrong thing for GAS.  Doubley unfortunate is that
+         * the condition used to detect GAS is incorrect, so we do in fact
+         * compile the Studio path, it just immediately fails in resume.
+         *
+         * Given that, if we were built using GCC, never allow CPR to be
+         * attempted.
+         */
+#ifdef __GNUC__
+        return (0);
+#endif
+
 	/*
 	 * The next statement tests if a specific platform has turned off
 	 * cpr support.
diff --git a/usr/src/uts/i86pc/os/cpuid.c b/usr/src/uts/i86pc/os/cpuid.c
index 55c04b9bde..3f9132ba4e 100644
--- a/usr/src/uts/i86pc/os/cpuid.c
+++ b/usr/src/uts/i86pc/os/cpuid.c
@@ -59,6 +59,7 @@
 #include <sys/pci_cfgspace.h>
 #include <sys/comm_page.h>
 #include <sys/mach_mmu.h>
+#include <sys/ucode.h>
 #include <sys/tsc.h>
 
 #ifdef __xpv
@@ -207,6 +208,18 @@ static char *x86_feature_names[NUM_X86_FEATURES] = {
 	"ospke",
 	"pcid",
 	"invpcid",
+	"ibrs",
+	"ibpb",
+	"stibp",
+	"ssbd",
+	"ssbd_virt",
+	"rdcl_no",
+	"ibrs_all",
+	"rsba",
+	"ssb_no",
+	"stibp_all",
+	"flush_cmd",
+	"l1d_vmentry_no"
 };
 
 boolean_t
@@ -707,6 +720,10 @@ determine_platform(void)
 			platform_type = HW_KVM;
 			return;
 		}
+		if (strcmp(hvstr, HVSIG_BHYVE) == 0) {
+			platform_type = HW_BHYVE;
+			return;
+		}
 		if (strcmp(hvstr, HVSIG_MICROSOFT) == 0)
 			platform_type = HW_MICROSOFT;
 	} else {
@@ -970,6 +987,143 @@ cpuid_amd_getids(cpu_t *cpu)
 	    cpi->cpi_procnodeid / cpi->cpi_procnodes_per_pkg;
 }
 
+static void
+spec_l1d_flush_noop(void)
+{
+}
+
+static void
+spec_l1d_flush_msr(void)
+{
+	wrmsr(MSR_IA32_FLUSH_CMD, IA32_FLUSH_CMD_L1D);
+}
+
+void (*spec_l1d_flush)(void) = spec_l1d_flush_noop;
+
+static void
+cpuid_scan_security(cpu_t *cpu, uchar_t *featureset)
+{
+	struct cpuid_info *cpi = cpu->cpu_m.mcpu_cpi;
+
+	if (cpi->cpi_vendor == X86_VENDOR_AMD &&
+	    cpi->cpi_xmaxeax >= 0x80000008) {
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_IBPB)
+			add_x86_feature(featureset, X86FSET_IBPB);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_IBRS)
+			add_x86_feature(featureset, X86FSET_IBRS);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_STIBP)
+			add_x86_feature(featureset, X86FSET_STIBP);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_IBRS_ALL)
+			add_x86_feature(featureset, X86FSET_IBRS_ALL);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_STIBP_ALL)
+			add_x86_feature(featureset, X86FSET_STIBP_ALL);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_PREFER_IBRS)
+			add_x86_feature(featureset, X86FSET_RSBA);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_SSBD)
+			add_x86_feature(featureset, X86FSET_SSBD);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_VIRT_SSBD)
+			add_x86_feature(featureset, X86FSET_SSBD_VIRT);
+		if (cpi->cpi_extd[8].cp_ebx & CPUID_AMD_EBX_SSB_NO)
+			add_x86_feature(featureset, X86FSET_SSB_NO);
+	} else if (cpi->cpi_vendor == X86_VENDOR_Intel &&
+	    cpi->cpi_maxeax >= 7) {
+		struct cpuid_regs *ecp;
+		ecp = &cpi->cpi_std[7];
+
+		if (ecp->cp_edx & CPUID_INTC_EDX_7_0_SPEC_CTRL) {
+			add_x86_feature(featureset, X86FSET_IBRS);
+			add_x86_feature(featureset, X86FSET_IBPB);
+		}
+
+		if (ecp->cp_edx & CPUID_INTC_EDX_7_0_STIBP) {
+			add_x86_feature(featureset, X86FSET_STIBP);
+		}
+
+		/*
+		 * Don't read the arch caps MSR on xpv where we lack the
+		 * on_trap().
+		 */
+#ifndef __xpv
+		if (ecp->cp_edx & CPUID_INTC_EDX_7_0_ARCH_CAPS) {
+			on_trap_data_t otd;
+
+			/*
+			 * Be paranoid and assume we'll get a #GP.
+			 */
+			if (!on_trap(&otd, OT_DATA_ACCESS)) {
+				uint64_t reg;
+
+				reg = rdmsr(MSR_IA32_ARCH_CAPABILITIES);
+				if (reg & IA32_ARCH_CAP_RDCL_NO) {
+					add_x86_feature(featureset,
+					    X86FSET_RDCL_NO);
+				}
+				if (reg & IA32_ARCH_CAP_IBRS_ALL) {
+					add_x86_feature(featureset,
+					    X86FSET_IBRS_ALL);
+				}
+				if (reg & IA32_ARCH_CAP_RSBA) {
+					add_x86_feature(featureset,
+					    X86FSET_RSBA);
+				}
+				if (reg & IA32_ARCH_CAP_SKIP_L1DFL_VMENTRY) {
+					add_x86_feature(featureset,
+					    X86FSET_L1D_VM_NO);
+				}
+				if (reg & IA32_ARCH_CAP_SSB_NO) {
+					add_x86_feature(featureset,
+					    X86FSET_SSB_NO);
+				}
+			}
+			no_trap();
+		}
+#endif	/* !__xpv */
+
+		if (ecp->cp_edx & CPUID_INTC_EDX_7_0_SSBD)
+			add_x86_feature(featureset, X86FSET_SSBD);
+
+		if (ecp->cp_edx & CPUID_INTC_EDX_7_0_FLUSH_CMD)
+			add_x86_feature(featureset, X86FSET_FLUSH_CMD);
+	}
+
+	if (cpu->cpu_id != 0)
+		return;
+
+	/*
+	 * We're the boot CPU, so let's figure out our L1TF status.
+	 *
+	 * First, if this is a RDCL_NO CPU, then we are not vulnerable: we don't
+	 * need to exclude with ht_acquire(), and we don't need to flush.
+	 */
+	if (is_x86_feature(featureset, X86FSET_RDCL_NO)) {
+		extern int ht_exclusion;
+		ht_exclusion = 0;
+		spec_l1d_flush = spec_l1d_flush_noop;
+		membar_producer();
+		return;
+	}
+
+	/*
+	 * If HT is enabled, we will need HT exclusion, as well as the flush on
+	 * VM entry.  If HT isn't enabled, we still need at least the flush for
+	 * the L1TF sequential case.
+	 *
+	 * However, if X86FSET_L1D_VM_NO is set, we're most likely running
+	 * inside a VM ourselves, and we don't need the flush.
+	 *
+	 * If we don't have the FLUSH_CMD available at all, we'd better just
+	 * hope HT is disabled.
+	 */
+	if (is_x86_feature(featureset, X86FSET_FLUSH_CMD) &&
+	    !is_x86_feature(featureset, X86FSET_L1D_VM_NO)) {
+		spec_l1d_flush = spec_l1d_flush_msr;
+	} else {
+		spec_l1d_flush = spec_l1d_flush_noop;
+	}
+
+	membar_producer();
+}
+
 /*
  * Setup XFeature_Enabled_Mask register. Required by xsave feature.
  */
@@ -1292,6 +1446,7 @@ cpuid_pass1(cpu_t *cpu, uchar_t *featureset)
 		ecp->cp_eax = 7;
 		ecp->cp_ecx = 0;
 		(void) __cpuid_insn(ecp);
+
 		/*
 		 * If XSAVE has been disabled, just ignore all of the
 		 * extended-save-area dependent flags here.
@@ -1914,6 +2069,11 @@ cpuid_pass1(cpu_t *cpu, uchar_t *featureset)
 		}
 	}
 
+	/*
+	 * Check the processor leaves that are used for security features.
+	 */
+	cpuid_scan_security(cpu, featureset);
+
 pass1_done:
 	cpi->cpi_pass = 1;
 }
@@ -1951,6 +2111,12 @@ cpuid_pass2(cpu_t *cpu)
 		cp->cp_eax = n;
 
 		/*
+		 * n == 7 was handled in pass 1
+		 */
+		if (n == 7)
+			continue;
+
+		/*
 		 * CPUID function 4 expects %ecx to be initialized
 		 * with an index which indicates which cache to return
 		 * information about. The OS is expected to call function 4
@@ -1964,10 +2130,8 @@ cpuid_pass2(cpu_t *cpu)
 		 *
 		 * Note: we need to explicitly initialize %ecx here, since
 		 * function 4 may have been previously invoked.
-		 *
-		 * The same is all true for CPUID function 7.
 		 */
-		if (n == 4 || n == 7)
+		if (n == 4)
 			cp->cp_ecx = 0;
 
 		(void) __cpuid_insn(cp);
@@ -3124,6 +3288,13 @@ cpuid_pass4(cpu_t *cpu, uint_t *hwcap_out)
 
 	}
 
+	/* Detect systems with a potential CPUID limit  */
+	if (cpi->cpi_vendor == X86_VENDOR_Intel && cpi->cpi_maxeax < 4) {
+		cmn_err(CE_NOTE, "CPUID limit detected, "
+		    "see the CPUID(7D) man page for details\n");
+	}
+
+
 	if (cpi->cpi_xmaxeax < 0x80000001)
 		goto pass4_done;
 
@@ -3715,7 +3886,7 @@ cpuid_opteron_erratum(cpu_t *cpu, uint_t erratum)
 	eax = cpi->cpi_std[1].cp_eax;
 
 #define	SH_B0(eax)	(eax == 0xf40 || eax == 0xf50)
-#define	SH_B3(eax) 	(eax == 0xf51)
+#define	SH_B3(eax)	(eax == 0xf51)
 #define	B(eax)		(SH_B0(eax) || SH_B3(eax))
 
 #define	SH_C0(eax)	(eax == 0xf48 || eax == 0xf58)
@@ -4019,9 +4190,9 @@ static const char sl3_cache_str[] = "sectored-l3-cache";
 static const char sh_l2_tlb4k_str[] = "shared-l2-tlb-4k";
 
 static const struct cachetab {
-	uint8_t 	ct_code;
+	uint8_t		ct_code;
 	uint8_t		ct_assoc;
-	uint16_t 	ct_line_size;
+	uint16_t	ct_line_size;
 	size_t		ct_size;
 	const char	*ct_label;
 } intel_ctab[] = {
@@ -5244,3 +5415,144 @@ cpuid_get_ext_topo(uint_t vendor, uint_t *core_nbits, uint_t *strand_nbits)
 		}
 	}
 }
+
+void
+cpuid_pass_ucode(cpu_t *cpu, uchar_t *fset)
+{
+	struct cpuid_info *cpi = cpu->cpu_m.mcpu_cpi;
+	struct cpuid_regs cp;
+
+	/*
+	 * Reread the CPUID portions that we need for various security
+	 * information.
+	 */
+	if (cpi->cpi_vendor == X86_VENDOR_Intel) {
+		/*
+		 * Check if we now have leaf 7 available to us.
+		 */
+		if (cpi->cpi_maxeax < 7) {
+			bzero(&cp, sizeof (cp));
+			cp.cp_eax = 0;
+			cpi->cpi_maxeax = __cpuid_insn(&cp);
+			if (cpi->cpi_maxeax < 7)
+				return;
+		}
+
+		bzero(&cp, sizeof (cp));
+		cp.cp_eax = 7;
+		cp.cp_ecx = 0;
+		(void) __cpuid_insn(&cp);
+		cpi->cpi_std[7] = cp;
+	} else if (cpi->cpi_vendor == X86_VENDOR_AMD) {
+		/* No xcpuid support */
+		if (cpi->cpi_family < 5 ||
+		    (cpi->cpi_family == 5 && cpi->cpi_model < 1))
+			return;
+
+		if (cpi->cpi_xmaxeax < 0x80000008) {
+			bzero(&cp, sizeof (cp));
+			cp.cp_eax = 0x80000000;
+			cpi->cpi_xmaxeax = __cpuid_insn(&cp);
+			if (cpi->cpi_xmaxeax < 0x80000008) {
+				return;
+			}
+		}
+
+		bzero(&cp, sizeof (cp));
+		cp.cp_eax = 0x80000008;
+		(void) __cpuid_insn(&cp);
+		platform_cpuid_mangle(cpi->cpi_vendor, 0x80000008, &cp);
+		cpi->cpi_extd[8] = cp;
+	} else {
+		/*
+		 * Nothing to do here. Return an empty set which has already
+		 * been zeroed for us.
+		 */
+		return;
+	}
+	cpuid_scan_security(cpu, fset);
+}
+
+static int
+cpuid_post_ucodeadm_xc(xc_arg_t arg0, xc_arg_t arg1, xc_arg_t arg2)
+{
+	uchar_t *fset;
+
+	fset = (uchar_t *)(arg0 + sizeof (x86_featureset) * CPU->cpu_id);
+	cpuid_pass_ucode(CPU, fset);
+
+	return (0);
+}
+
+/*
+ * After a microcode update where the version has changed, then we need to
+ * rescan CPUID. To do this we check every CPU to make sure that they have the
+ * same microcode. Then we perform a cross call to all such CPUs. It's the
+ * caller's job to make sure that no one else can end up doing an update while
+ * this is going on.
+ *
+ * We assume that the system is microcode capable if we're called.
+ */
+void
+cpuid_post_ucodeadm(void)
+{
+	uint32_t rev;
+	int i;
+	struct cpu *cpu;
+	cpuset_t cpuset;
+	void *argdata;
+	uchar_t *f0;
+
+	argdata = kmem_zalloc(sizeof (x86_featureset) * NCPU, KM_SLEEP);
+
+	mutex_enter(&cpu_lock);
+	cpu = cpu_get(0);
+	rev = cpu->cpu_m.mcpu_ucode_info->cui_rev;
+	CPUSET_ONLY(cpuset, 0);
+	for (i = 1; i < max_ncpus; i++) {
+		if ((cpu = cpu_get(i)) == NULL)
+			continue;
+
+		if (cpu->cpu_m.mcpu_ucode_info->cui_rev != rev) {
+			panic("post microcode update CPU %d has differing "
+			    "microcode revision (%u) from CPU 0 (%u)",
+			    i, cpu->cpu_m.mcpu_ucode_info->cui_rev, rev);
+		}
+		CPUSET_ADD(cpuset, i);
+	}
+
+	kpreempt_disable();
+	xc_sync((xc_arg_t)argdata, 0, 0, CPUSET2BV(cpuset),
+	    cpuid_post_ucodeadm_xc);
+	kpreempt_enable();
+
+	/*
+	 * OK, now look at each CPU and see if their feature sets are equal.
+	 */
+	f0 = argdata;
+	for (i = 1; i < max_ncpus; i++) {
+		uchar_t *fset;
+		if (!CPU_IN_SET(cpuset, i))
+			continue;
+
+		fset = (uchar_t *)((uintptr_t)argdata +
+		    sizeof (x86_featureset) * i);
+
+		if (!compare_x86_featureset(f0, fset)) {
+			panic("Post microcode update CPU %d has "
+			    "differing security feature (%p) set from CPU 0 "
+			    "(%p), not appending to feature set", i, fset, f0);
+		}
+	}
+
+	mutex_exit(&cpu_lock);
+
+	for (i = 0; i < NUM_X86_FEATURES; i++) {
+		cmn_err(CE_CONT, "?post-ucode x86_feature: %s\n",
+		    x86_feature_names[i]);
+		if (is_x86_feature(f0, i)) {
+			add_x86_feature(x86_featureset, i);
+		}
+	}
+	kmem_free(argdata, sizeof (x86_featureset) * NCPU);
+}
diff --git a/usr/src/uts/i86pc/os/ddi_impl.c b/usr/src/uts/i86pc/os/ddi_impl.c
index 0143b20922..b8d7ec952f 100644
--- a/usr/src/uts/i86pc/os/ddi_impl.c
+++ b/usr/src/uts/i86pc/os/ddi_impl.c
@@ -24,6 +24,7 @@
  * Copyright 2012 Garrett D'Amore <garrett@damore.org>
  * Copyright 2014 Pluribus Networks, Inc.
  * Copyright 2016 Nexenta Systems, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -1009,10 +1010,10 @@ page_create_io_wrapper(void *addr, size_t len, int vmflag, void *arg)
 
 #ifdef __xpv
 static void
-segkmem_free_io(vmem_t *vmp, void * ptr, size_t size)
+segkmem_free_io(vmem_t *vmp, void *ptr, size_t size)
 {
 	extern void page_destroy_io(page_t *);
-	segkmem_xfree(vmp, ptr, size, page_destroy_io);
+	segkmem_xfree(vmp, ptr, size, &kvp, page_destroy_io);
 }
 #endif
 
diff --git a/usr/src/uts/i86pc/os/ht.c b/usr/src/uts/i86pc/os/ht.c
new file mode 100644
index 0000000000..f82c51ac08
--- /dev/null
+++ b/usr/src/uts/i86pc/os/ht.c
@@ -0,0 +1,599 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * HT exclusion: prevent a sibling in a hyper-threaded core from running in VMX
+ * non-root guest mode, when certain threads are running on the other sibling.
+ * This avoids speculation-based information leaks such as L1TF being available
+ * to the untrusted guest.  The stance we take is that threads from the same
+ * zone as the guest VPCU thread are considered safe to run alongside, but all
+ * other threads (except the idle thread), and all interrupts, are unsafe.  Note
+ * that due to the implementation here, there are significant sections of e.g.
+ * the dispatcher code that can run concurrently with a guest, until the thread
+ * reaches ht_mark().  This code assumes there are only two HT threads per core.
+ *
+ * The entry points are as follows:
+ *
+ * ht_mark_as_vcpu()
+ *
+ * All threads that enter guest mode (i.e. VCPU threads) need to call this at
+ * least once, which sets TS_VCPU in ->t_schedflag.
+ *
+ * ht_mark()
+ *
+ * A new ->cpu_thread is now curthread (although interrupt threads have their
+ * own separate handling).  After preventing any interrupts, we will take our
+ * own CPU's spinlock and update our own state in mcpu_ht.
+ *
+ * If our sibling is poisoned (i.e. in guest mode or the little bit of code
+ * around it), and we're not compatible (that is, same zone ID, or the idle
+ * thread), then we need to ht_kick() that sibling.  ht_kick() itself waits for
+ * the sibling to call ht_release(), and it will not re-enter guest mode until
+ * allowed.
+ *
+ * Note that we ignore the fact a process can change its zone ID: poisoning
+ * threads never do so, and we can ignore the other cases.
+ *
+ * ht_acquire()
+ *
+ * We are a VCPU thread about to start guest execution.  Interrupts are
+ * disabled.  We must have already run ht_mark() to be in this code, so there's
+ * no need to take our *own* spinlock in order to mark ourselves as CM_POISONED.
+ * Instead, we take our sibling's lock to also mark ourselves as poisoned in the
+ * sibling cpu_ht_t.  This is so ht_mark() will only ever need to look at its
+ * local mcpu_ht.
+ *
+ * We'll loop here for up to ht_acquire_wait_time microseconds; this is mainly
+ * to wait out any sibling interrupt: many of them will complete quicker than
+ * this.
+ *
+ * Finally, if we succeeded in acquiring the core, we'll flush the L1 cache as
+ * mitigation against L1TF: no incompatible thread will now be able to populate
+ * the L1 cache until *we* ht_release().
+ *
+ * ht_release()
+ *
+ * Simply unpoison ourselves similarly to ht_acquire(); ht_kick() will wait for
+ * this to happen if needed.
+ *
+ * ht_begin_intr()
+ *
+ * In an interrupt prolog.  We're either a hilevel interrupt, or a pinning
+ * interrupt.  In both cases, we mark our interrupt depth, and potentially
+ * ht_kick().  This enforces exclusion, but doesn't otherwise modify ->ch_state:
+ * we want the dispatcher code to essentially ignore interrupts.
+ *
+ * ht_end_intr()
+ *
+ * In an interrupt epilogue *or* thread_unpin().  In the first case, we never
+ * slept, and we can simply decrement our counter.  In the second case, we're an
+ * interrupt thread about to sleep: we'll still just decrement our counter, and
+ * henceforth treat the thread as a normal thread when it next gets scheduled,
+ * until it finally gets to its epilogue.
+ *
+ * ht_mark_unsafe() / ht_mark_safe()
+ *
+ * Mark the current thread as temporarily unsafe (guests should not be executing
+ * while a sibling is marked unsafe).  This can be used for a thread that's
+ * otherwise considered safe, if it needs to handle potentially sensitive data.
+ * Right now, this means certain I/O handling operations that reach down into
+ * the networking and ZFS sub-systems.
+ *
+ * ht_should_run(thread, cpu)
+ *
+ * This is used by the dispatcher when making scheduling decisions: if the
+ * sibling is compatible with the given thread, we return B_TRUE. This is
+ * essentially trying to guess if any subsequent ht_acquire() will fail, by
+ * peeking at the sibling CPU's state.  The peek is racy, but if we get things
+ * wrong, the "only" consequence is that ht_acquire() may lose.
+ *
+ * ht_adjust_cpu_score()
+ *
+ * Used when scoring other CPUs in disp_lowpri_cpu().  If we shouldn't run here,
+ * we'll add a small penalty to the score.  This also makes sure a VCPU thread
+ * migration behaves properly.
+ */
+
+#include <sys/archsystm.h>
+#include <sys/disp.h>
+#include <sys/cmt.h>
+#include <sys/systm.h>
+#include <sys/cpu.h>
+#include <sys/var.h>
+#include <sys/xc_levels.h>
+#include <sys/cmn_err.h>
+#include <sys/sysmacros.h>
+#include <sys/x86_archext.h>
+
+#define	CS_SHIFT (8)
+#define	CS_MASK ((1 << CS_SHIFT) - 1)
+#define	CS_MARK(s) ((s) & CS_MASK)
+#define	CS_ZONE(s) ((s) >> CS_SHIFT)
+#define	CS_MK(s, z) ((s) | (z << CS_SHIFT))
+
+typedef enum ch_mark {
+	CM_IDLE = 0,	/* running CPU idle thread */
+	CM_THREAD,	/* running general non-VCPU thread */
+	CM_UNSAFE,	/* running ->t_unsafe thread */
+	CM_VCPU,	/* running VCPU thread */
+	CM_POISONED	/* running in guest */
+} ch_mark_t;
+
+/* Double-check our false-sharing padding. */
+CTASSERT(offsetof(cpu_ht_t, ch_sib) == 64);
+CTASSERT(CM_IDLE == 0);
+CTASSERT(CM_POISONED < (1 << CS_SHIFT));
+CTASSERT(CM_POISONED > CM_VCPU);
+CTASSERT(CM_VCPU > CM_UNSAFE);
+
+/*
+ * If disabled, no HT exclusion is performed, and system is potentially
+ * vulnerable to L1TF if hyper-threading is enabled, and we don't have the "not
+ * vulnerable" CPUID bit.
+ */
+int ht_exclusion = 1;
+
+/*
+ * How long ht_acquire() will spin trying to acquire the core, in micro-seconds.
+ * This is enough time to wait out a significant proportion of interrupts.
+ */
+clock_t ht_acquire_wait_time = 64;
+
+static cpu_t *
+ht_find_sibling(cpu_t *cp)
+{
+	for (uint_t i = 0; i < GROUP_SIZE(&cp->cpu_pg->cmt_pgs); i++) {
+		pg_cmt_t *pg = GROUP_ACCESS(&cp->cpu_pg->cmt_pgs, i);
+		group_t *cg = &pg->cmt_pg.pghw_pg.pg_cpus;
+
+		if (pg->cmt_pg.pghw_hw != PGHW_IPIPE)
+			continue;
+
+		if (GROUP_SIZE(cg) == 1)
+			break;
+
+		VERIFY3U(GROUP_SIZE(cg), ==, 2);
+
+		if (GROUP_ACCESS(cg, 0) != cp)
+			return (GROUP_ACCESS(cg, 0));
+
+		VERIFY3P(GROUP_ACCESS(cg, 1), !=, cp);
+
+		return (GROUP_ACCESS(cg, 1));
+	}
+
+	return (NULL);
+}
+
+/*
+ * Initialize HT links.  We have to be careful here not to race with
+ * ht_begin/end_intr(), which also complicates trying to do this initialization
+ * from a cross-call; hence the slightly odd approach below.
+ */
+void
+ht_init(void)
+{
+	cpu_t *scp = CPU;
+	cpu_t *cp = scp;
+	ulong_t flags;
+
+	if (!ht_exclusion)
+		return;
+
+	mutex_enter(&cpu_lock);
+
+	do {
+		thread_affinity_set(curthread, cp->cpu_id);
+		flags = intr_clear();
+
+		cp->cpu_m.mcpu_ht.ch_intr_depth = 0;
+		cp->cpu_m.mcpu_ht.ch_state = CS_MK(CM_THREAD, GLOBAL_ZONEID);
+		cp->cpu_m.mcpu_ht.ch_sibstate = CS_MK(CM_THREAD, GLOBAL_ZONEID);
+		ASSERT3P(cp->cpu_m.mcpu_ht.ch_sib, ==, NULL);
+		cp->cpu_m.mcpu_ht.ch_sib = ht_find_sibling(cp);
+
+		intr_restore(flags);
+		thread_affinity_clear(curthread);
+	} while ((cp = cp->cpu_next_onln) != scp);
+
+	mutex_exit(&cpu_lock);
+}
+
+/*
+ * If our sibling is also a VCPU thread from a different zone, we need one of
+ * them to give up, otherwise they will just battle each other for exclusion
+ * until they exhaust their quantum.
+ *
+ * We arbitrate between them by dispatch priority: clearly, a higher-priority
+ * thread deserves to win the acquisition.  However, under CPU load, it'll be
+ * very common to see both threads with ->t_pri == 1.  If so, we'll break the
+ * tie by cpu_id (which is hopefully arbitrary enough).
+ *
+ * If we lose, the VMM code will take this as a hint to call
+ * thread_affinity_set(CPU_BEST), which will likely migrate the VCPU thread
+ * somewhere else.
+ *
+ * Note that all of this state examination is racy, as we don't own any locks
+ * here.
+ */
+static boolean_t
+yield_to_vcpu(cpu_t *sib, zoneid_t zoneid)
+{
+	cpu_ht_t *sibht = &sib->cpu_m.mcpu_ht;
+	uint64_t sibstate = sibht->ch_state;
+
+	/*
+	 * If we're likely just waiting for an interrupt, don't yield.
+	 */
+	if (sibht->ch_intr_depth != 0)
+		return (B_FALSE);
+
+	/*
+	 * We're only interested in VCPUs from a different zone.
+	 */
+	if (CS_MARK(sibstate) < CM_VCPU || CS_ZONE(sibstate) == zoneid)
+		return (B_FALSE);
+
+	if (curthread->t_pri < sib->cpu_dispatch_pri)
+		return (B_TRUE);
+
+	if (curthread->t_pri == sib->cpu_dispatch_pri &&
+	    CPU->cpu_id < sib->cpu_id)
+		return (B_TRUE);
+
+	return (B_FALSE);
+}
+
+static inline boolean_t
+sibling_compatible(cpu_ht_t *sibht, zoneid_t zoneid)
+{
+	uint64_t sibstate = sibht->ch_state;
+
+	if (sibht->ch_intr_depth != 0)
+		return (B_FALSE);
+
+	if (CS_MARK(sibstate) == CM_UNSAFE)
+		return (B_FALSE);
+
+	if (CS_MARK(sibstate) == CM_IDLE)
+		return (B_TRUE);
+
+	return (CS_ZONE(sibstate) == zoneid);
+}
+
+int
+ht_acquire(void)
+{
+	clock_t wait = ht_acquire_wait_time;
+	cpu_ht_t *ht = &CPU->cpu_m.mcpu_ht;
+	zoneid_t zoneid = getzoneid();
+	cpu_ht_t *sibht;
+	int ret = 0;
+
+	ASSERT(!interrupts_enabled());
+
+	if (ht->ch_sib == NULL) {
+		/* For the "sequential" L1TF case. */
+		spec_l1d_flush();
+		return (1);
+	}
+
+	sibht = &ht->ch_sib->cpu_m.mcpu_ht;
+
+	/* A VCPU thread should never change zone. */
+	ASSERT3U(CS_ZONE(ht->ch_state), ==, zoneid);
+	ASSERT3U(CS_MARK(ht->ch_state), ==, CM_VCPU);
+	ASSERT3U(zoneid, !=, GLOBAL_ZONEID);
+	ASSERT3U(curthread->t_preempt, >=, 1);
+	ASSERT(curthread->t_schedflag & TS_VCPU);
+
+	while (ret == 0 && wait > 0) {
+
+		if (yield_to_vcpu(ht->ch_sib, zoneid)) {
+			ret = -1;
+			break;
+		}
+
+		if (sibling_compatible(sibht, zoneid)) {
+			lock_set(&sibht->ch_lock);
+
+			if (sibling_compatible(sibht, zoneid)) {
+				ht->ch_state = CS_MK(CM_POISONED, zoneid);
+				sibht->ch_sibstate = CS_MK(CM_POISONED, zoneid);
+				membar_enter();
+				ret = 1;
+			}
+
+			lock_clear(&sibht->ch_lock);
+		} else {
+			drv_usecwait(10);
+			wait -= 10;
+		}
+	}
+
+	DTRACE_PROBE4(ht__acquire, int, ret, uint64_t, sibht->ch_state,
+	    uint64_t, sibht->ch_intr_depth, clock_t, wait);
+
+	if (ret == 1)
+		spec_l1d_flush();
+
+	return (ret);
+}
+
+void
+ht_release(void)
+{
+	cpu_ht_t *ht = &CPU->cpu_m.mcpu_ht;
+	zoneid_t zoneid = getzoneid();
+	cpu_ht_t *sibht;
+
+	ASSERT(!interrupts_enabled());
+
+	if (ht->ch_sib == NULL)
+		return;
+
+	ASSERT3U(zoneid, !=, GLOBAL_ZONEID);
+	ASSERT3U(CS_ZONE(ht->ch_state), ==, zoneid);
+	ASSERT3U(CS_MARK(ht->ch_state), ==, CM_POISONED);
+	ASSERT3U(curthread->t_preempt, >=, 1);
+
+	sibht = &ht->ch_sib->cpu_m.mcpu_ht;
+
+	lock_set(&sibht->ch_lock);
+
+	ht->ch_state = CS_MK(CM_VCPU, zoneid);
+	sibht->ch_sibstate = CS_MK(CM_VCPU, zoneid);
+	membar_producer();
+
+	lock_clear(&sibht->ch_lock);
+}
+
+static void
+ht_kick(cpu_ht_t *ht, zoneid_t zoneid)
+{
+	uint64_t sibstate;
+
+	ASSERT(LOCK_HELD(&ht->ch_lock));
+	ASSERT(!interrupts_enabled());
+
+	poke_cpu(ht->ch_sib->cpu_id);
+
+	for (;;) {
+		membar_consumer();
+		sibstate = ht->ch_sibstate;
+
+		if (CS_MARK(sibstate) != CM_POISONED ||
+		    CS_ZONE(sibstate) == zoneid)
+			return;
+
+		lock_clear(&ht->ch_lock);
+
+		for (;;) {
+			membar_consumer();
+			sibstate = ht->ch_sibstate;
+
+			if (CS_MARK(sibstate) != CM_POISONED ||
+			    CS_ZONE(sibstate) == zoneid) {
+				lock_set(&ht->ch_lock);
+				return;
+			}
+
+			SMT_PAUSE();
+		}
+
+		lock_set(&ht->ch_lock);
+	}
+}
+
+/*
+ * FIXME: do we need a callback in case somebody installs a handler at this PIL
+ * ever?
+ */
+static boolean_t
+pil_needs_kick(uint_t pil)
+{
+	return (pil != XC_CPUPOKE_PIL);
+}
+
+void
+ht_begin_intr(uint_t pil)
+{
+	ulong_t flags;
+	cpu_ht_t *ht;
+
+	flags = intr_clear();
+	ht = &CPU->cpu_m.mcpu_ht;
+
+	if (ht->ch_sib == NULL) {
+		intr_restore(flags);
+		return;
+	}
+
+	if (atomic_inc_64_nv(&ht->ch_intr_depth) == 1 && pil_needs_kick(pil)) {
+		lock_set(&ht->ch_lock);
+
+		membar_consumer();
+
+		if (CS_MARK(ht->ch_sibstate) == CM_POISONED)
+			ht_kick(ht, GLOBAL_ZONEID);
+
+		lock_clear(&ht->ch_lock);
+	}
+
+	intr_restore(flags);
+}
+
+void
+ht_end_intr(void)
+{
+	ulong_t flags;
+	cpu_ht_t *ht;
+
+	flags = intr_clear();
+	ht = &CPU->cpu_m.mcpu_ht;
+
+	if (ht->ch_sib == NULL) {
+		intr_restore(flags);
+		return;
+	}
+
+	ASSERT3U(ht->ch_intr_depth, >, 0);
+	atomic_dec_64(&ht->ch_intr_depth);
+
+	intr_restore(flags);
+}
+
+static inline boolean_t
+ht_need_kick(cpu_ht_t *ht, zoneid_t zoneid)
+{
+	membar_consumer();
+
+	if (CS_MARK(ht->ch_sibstate) != CM_POISONED)
+		return (B_FALSE);
+
+	if (CS_MARK(ht->ch_state) == CM_UNSAFE)
+		return (B_TRUE);
+
+	return (CS_ZONE(ht->ch_sibstate) != zoneid);
+}
+
+void
+ht_mark(void)
+{
+	zoneid_t zoneid = getzoneid();
+	kthread_t *t = curthread;
+	ulong_t flags;
+	cpu_ht_t *ht;
+	cpu_t *cp;
+
+	flags = intr_clear();
+
+	cp = CPU;
+	ht = &cp->cpu_m.mcpu_ht;
+
+	if (ht->ch_sib == NULL) {
+		intr_restore(flags);
+		return;
+	}
+
+	lock_set(&ht->ch_lock);
+
+	/*
+	 * If we were a nested interrupt and went through the resume_from_intr()
+	 * path, we can now be resuming to a pinning interrupt thread; in which
+	 * case, skip marking, until we later resume to a "real" thread.
+	 */
+	if (ht->ch_intr_depth > 0) {
+		ASSERT3P(t->t_intr, !=, NULL);
+
+		if (ht_need_kick(ht, zoneid))
+			ht_kick(ht, zoneid);
+		goto out;
+	}
+
+	if (t == t->t_cpu->cpu_idle_thread) {
+		ASSERT3U(zoneid, ==, GLOBAL_ZONEID);
+		ht->ch_state = CS_MK(CM_IDLE, zoneid);
+	} else {
+		uint64_t state = CM_THREAD;
+
+		if (t->t_unsafe)
+			state = CM_UNSAFE;
+		else if (t->t_schedflag & TS_VCPU)
+			state = CM_VCPU;
+
+		ht->ch_state = CS_MK(state, zoneid);
+
+		if (ht_need_kick(ht, zoneid))
+			ht_kick(ht, zoneid);
+	}
+
+out:
+	membar_producer();
+	lock_clear(&ht->ch_lock);
+	intr_restore(flags);
+}
+
+void
+ht_begin_unsafe(void)
+{
+	curthread->t_unsafe++;
+	ht_mark();
+}
+
+void
+ht_end_unsafe(void)
+{
+	ASSERT3U(curthread->t_unsafe, >, 0);
+	curthread->t_unsafe--;
+	ht_mark();
+}
+
+void
+ht_mark_as_vcpu(void)
+{
+	thread_lock(curthread);
+	curthread->t_schedflag |= TS_VCPU;
+	ht_mark();
+	thread_unlock(curthread);
+}
+
+boolean_t
+ht_should_run(kthread_t *t, cpu_t *cp)
+{
+	uint64_t sibstate;
+	cpu_t *sib;
+
+	if (t == t->t_cpu->cpu_idle_thread)
+		return (B_TRUE);
+
+	if ((sib = cp->cpu_m.mcpu_ht.ch_sib) == NULL)
+		return (B_TRUE);
+
+	sibstate = sib->cpu_m.mcpu_ht.ch_state;
+
+	if ((t->t_schedflag & TS_VCPU)) {
+		if (CS_MARK(sibstate) == CM_IDLE)
+			return (B_TRUE);
+		if (CS_MARK(sibstate) == CM_UNSAFE)
+			return (B_FALSE);
+		return (CS_ZONE(sibstate) == ttozone(t)->zone_id);
+	}
+
+	if (CS_MARK(sibstate) < CM_VCPU)
+		return (B_TRUE);
+
+	return (CS_ZONE(sibstate) == ttozone(t)->zone_id);
+}
+
+pri_t
+ht_adjust_cpu_score(kthread_t *t, struct cpu *cp, pri_t score)
+{
+	cpu_t *sib;
+
+	if (ht_should_run(t, cp))
+		return (score);
+
+	/*
+	 * If we're a VCPU thread scoring our current CPU, we are most likely
+	 * asking to be rescheduled elsewhere after losing ht_acquire().  In
+	 * this case, the current CPU is not a good choice, most likely, and we
+	 * should go elsewhere.
+	 */
+	if ((t->t_schedflag & TS_VCPU) && cp == t->t_cpu && score < 0)
+		return ((v.v_maxsyspri + 1) * 2);
+
+	return (score + 1);
+}
diff --git a/usr/src/uts/i86pc/os/ibft.c b/usr/src/uts/i86pc/os/ibft.c
index d9ed882705..fab1324787 100644
--- a/usr/src/uts/i86pc/os/ibft.c
+++ b/usr/src/uts/i86pc/os/ibft.c
@@ -39,6 +39,7 @@
 #include <sys/kmem.h>
 #include <sys/psm.h>
 #include <sys/bootconf.h>
+#include <sys/reboot.h>
 
 typedef enum ibft_structure_type {
 	Reserved	=	0,
@@ -206,6 +207,7 @@ static ibft_status_t iscsi_parse_ibft_NIC(iscsi_ibft_nic_t *nicp);
 static ibft_status_t iscsi_parse_ibft_target(char *begin_of_ibft,
     iscsi_ibft_tgt_t *tgtp);
 
+extern int boothowto;
 
 /*
  * Return value:
@@ -759,7 +761,9 @@ ld_ib_prop()
 		 * 1) pass "-B ibft-noprobe=1" on kernel command line
 		 * 2) add line "set ibft_noprobe=1" in /etc/system
 		 */
-		cmn_err(CE_NOTE, IBFT_NOPROBE_MSG);
+		if (boothowto & RB_VERBOSE) {
+			cmn_err(CE_NOTE, IBFT_NOPROBE_MSG);
+		}
 		return;
 	}
 
diff --git a/usr/src/uts/i86pc/os/intr.c b/usr/src/uts/i86pc/os/intr.c
index 29fa78109c..0634df1a94 100644
--- a/usr/src/uts/i86pc/os/intr.c
+++ b/usr/src/uts/i86pc/os/intr.c
@@ -466,25 +466,22 @@
 #include <sys/ontrap.h>
 #include <sys/x86_archext.h>
 #include <sys/promif.h>
+#include <sys/ht.h>
 #include <vm/hat_i86.h>
 #if defined(__xpv)
 #include <sys/hypervisor.h>
 #endif
 
-#if defined(__amd64) && !defined(__xpv)
-/* If this fails, then the padding numbers in machcpuvar.h are wrong. */
-CTASSERT((offsetof(cpu_t, cpu_m) + offsetof(struct machcpu, mcpu_pad)) <
-    MMU_PAGESIZE);
-CTASSERT((offsetof(cpu_t, cpu_m) + offsetof(struct machcpu, mcpu_kpti)) >=
-    MMU_PAGESIZE);
-CTASSERT((offsetof(cpu_t, cpu_m) + offsetof(struct machcpu, mcpu_kpti_dbg)) <
-    2 * MMU_PAGESIZE);
-CTASSERT((offsetof(cpu_t, cpu_m) + offsetof(struct machcpu, mcpu_pad2)) <
-    2 * MMU_PAGESIZE);
+/* If these fail, then the padding numbers in machcpuvar.h are wrong. */
+#if !defined(__xpv)
+#define	MCOFF(member)	\
+	(offsetof(cpu_t, cpu_m) + offsetof(struct machcpu, member))
+CTASSERT(MCOFF(mcpu_pad) == MACHCPU_SIZE);
+CTASSERT(MCOFF(mcpu_pad2) == MMU_PAGESIZE);
+CTASSERT((MCOFF(mcpu_kpti) & 0xF) == 0);
 CTASSERT(((sizeof (struct kpti_frame)) & 0xF) == 0);
-CTASSERT(((offsetof(cpu_t, cpu_m) +
-    offsetof(struct machcpu, mcpu_kpti_dbg)) & 0xF) == 0);
 CTASSERT((offsetof(struct kpti_frame, kf_tr_rsp) & 0xF) == 0);
+CTASSERT(MCOFF(mcpu_pad3) < 2 * MMU_PAGESIZE);
 #endif
 
 #if defined(__xpv) && defined(DEBUG)
@@ -600,6 +597,8 @@ hilevel_intr_prolog(struct cpu *cpu, uint_t pil, uint_t oldpil, struct regs *rp)
 		}
 	}
 
+	ht_begin_intr(pil);
+
 	/*
 	 * Store starting timestamp in CPU structure for this PIL.
 	 */
@@ -704,6 +703,8 @@ hilevel_intr_epilog(struct cpu *cpu, uint_t pil, uint_t oldpil, uint_t vecnum)
 			t->t_intr_start = now;
 	}
 
+	ht_end_intr();
+
 	mcpu->mcpu_pri = oldpil;
 	(void) (*setlvlx)(oldpil, vecnum);
 
@@ -766,6 +767,8 @@ intr_thread_prolog(struct cpu *cpu, caddr_t stackptr, uint_t pil)
 	it->t_state = TS_ONPROC;
 
 	cpu->cpu_thread = it;		/* new curthread on this cpu */
+	ht_begin_intr(pil);
+
 	it->t_pil = (uchar_t)pil;
 	it->t_pri = intr_pri + (pri_t)pil;
 	it->t_intr_start = now;
@@ -856,6 +859,7 @@ intr_thread_epilog(struct cpu *cpu, uint_t vec, uint_t oldpil)
 	mcpu->mcpu_pri = pil;
 	(*setlvlx)(pil, vec);
 	t->t_intr_start = now;
+	ht_end_intr();
 	cpu->cpu_thread = t;
 }
 
@@ -1043,6 +1047,7 @@ top:
 
 	it->t_intr = t;
 	cpu->cpu_thread = it;
+	ht_begin_intr(pil);
 
 	/*
 	 * Set bit for this pil in CPU's interrupt active bitmask.
@@ -1103,7 +1108,9 @@ dosoftint_epilog(struct cpu *cpu, uint_t oldpil)
 	it->t_link = cpu->cpu_intr_thread;
 	cpu->cpu_intr_thread = it;
 	it->t_state = TS_FREE;
+	ht_end_intr();
 	cpu->cpu_thread = t;
+
 	if (t->t_flag & T_INTR_THREAD)
 		t->t_intr_start = now;
 	basespl = cpu->cpu_base_spl;
diff --git a/usr/src/uts/i86pc/os/lgrpplat.c b/usr/src/uts/i86pc/os/lgrpplat.c
index 29cea5dcbb..7e5bc36295 100644
--- a/usr/src/uts/i86pc/os/lgrpplat.c
+++ b/usr/src/uts/i86pc/os/lgrpplat.c
@@ -2799,7 +2799,11 @@ lgrp_plat_process_sli(uint32_t domain_id, uchar_t *sli_info,
 /*
  * Read ACPI System Resource Affinity Table (SRAT) to determine which CPUs
  * and memory are local to each other in the same NUMA node and return number
- * of nodes
+ * of nodes.
+ *
+ * The SRAT table pointer is populated during bootup by
+ * build_firmware_properties() in fakebop.c. Several motherboard and BIOS
+ * manufacturers are guilty of not having a SRAT table.
  */
 static int
 lgrp_plat_process_srat(ACPI_TABLE_SRAT *tp, ACPI_TABLE_MSCT *mp,
@@ -2816,9 +2820,15 @@ lgrp_plat_process_srat(ACPI_TABLE_SRAT *tp, ACPI_TABLE_MSCT *mp,
 	/*
 	 * Nothing to do when no SRAT or disabled
 	 */
-	if (tp == NULL || !lgrp_plat_srat_enable)
+	if (!lgrp_plat_srat_enable)
 		return (-1);
 
+	if (tp == NULL) {
+		cmn_err(CE_WARN, "Couldn't read ACPI SRAT table from BIOS. "
+		   "lgrp support will be limited to one group.\n");
+		return (-1);
+	}
+
 	/*
 	 * Try to get domain information from MSCT table.
 	 * ACPI4.0: OSPM will use information provided by the MSCT only
diff --git a/usr/src/uts/i86pc/os/machdep.c b/usr/src/uts/i86pc/os/machdep.c
index 41b5c7a7f6..97b1bf3f45 100644
--- a/usr/src/uts/i86pc/os/machdep.c
+++ b/usr/src/uts/i86pc/os/machdep.c
@@ -190,6 +190,12 @@ extern void pm_cfb_rele(void);
 extern fastboot_info_t newkernel;
 
 /*
+ * Instructions to enable or disable SMAP, respectively.
+ */
+static const uint8_t clac_instr[3] = { 0x0f, 0x01, 0xca };
+static const uint8_t stac_instr[3] = { 0x0f, 0x01, 0xcb };
+
+/*
  * Machine dependent code to reboot.
  * "mdep" is interpreted as a character pointer; if non-null, it is a pointer
  * to a string to be used as the argument string when rebooting.
@@ -1455,3 +1461,45 @@ plat_dr_disable_capability(uint64_t features)
 {
 	atomic_and_64(&plat_dr_options, ~features);
 }
+
+/*
+ * If SMAP is supported, look through hi_calls and inline
+ * calls to smap_enable() to clac and smap_disable() to stac.
+ */
+void
+hotinline_smap(hotinline_desc_t *hid)
+{
+	if (is_x86_feature(x86_featureset, X86FSET_SMAP) == B_FALSE)
+		return;
+
+/*
+ * We should never hit this since SMAP feature detection is behind
+ * an AMD64 header guard.
+ */
+#if defined(__i386)
+	panic("illumos only suppports SMAP on the AMD64 architecture.");
+#endif
+
+	if (strcmp(hid->hid_symname, "smap_enable") == 0) {
+		bcopy(clac_instr, (void *)hid->hid_instr_offset,
+		    sizeof (clac_instr));
+	} else if (strcmp(hid->hid_symname, "smap_disable") == 0) {
+		bcopy(stac_instr, (void *)hid->hid_instr_offset,
+		    sizeof (stac_instr));
+	}
+}
+
+/*
+ * Loop through hi_calls and hand off the inlining to
+ * the appropriate calls.
+ */
+void
+do_hotinlines(struct module *mp)
+{
+	for (hotinline_desc_t *hid = mp->hi_calls; hid != NULL;
+	    hid = hid->hid_next) {
+#if !defined(__xpv)
+		hotinline_smap(hid);
+#endif	/* __xpv */
+	}
+}
diff --git a/usr/src/uts/i86pc/os/microcode.c b/usr/src/uts/i86pc/os/microcode.c
index e59bdb8530..d07a79bf18 100644
--- a/usr/src/uts/i86pc/os/microcode.c
+++ b/usr/src/uts/i86pc/os/microcode.c
@@ -24,6 +24,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #include <sys/asm_linkage.h>
@@ -754,8 +755,15 @@ ucode_write(xc_arg_t arg1, xc_arg_t unused2, xc_arg_t unused3)
 			return (0);
 	}
 
-	if (!on_trap(&otd, OT_DATA_ACCESS))
+	if (!on_trap(&otd, OT_DATA_ACCESS)) {
+		/*
+		 * On some platforms a cache invalidation is required for the
+		 * ucode update to be successful due to the parts of the
+		 * processor that the microcode is updating.
+		 */
+		invalidate_cache();
 		wrmsr(ucode->write_msr, (uintptr_t)uusp->ucodep);
+	}
 
 	no_trap();
 #endif
@@ -849,6 +857,12 @@ ucode_load_intel(ucode_file_t *ufp, cpu_ucode_info_t *uinfop, cpu_t *cp)
 	uus.new_rev = uinfop->cui_rev;
 #else
 	kpreempt_disable();
+	/*
+	 * On some platforms a cache invalidation is required for the
+	 * ucode update to be successful due to the parts of the
+	 * processor that the microcode is updating.
+	 */
+	invalidate_cache();
 	wrmsr(ucode->write_msr, (uintptr_t)ucodefp->uf_body);
 	ucode->read_rev(uinfop);
 	kpreempt_enable();
@@ -1131,8 +1145,11 @@ ucode_update(uint8_t *ucodep, int size)
 
 	mutex_exit(&cpu_lock);
 
-	if (!found)
+	if (!found) {
 		rc = search_rc;
+	} else if (rc == EM_OK) {
+		cpuid_post_ucodeadm();
+	}
 
 	return (rc);
 }
diff --git a/usr/src/uts/i86pc/os/mlsetup.c b/usr/src/uts/i86pc/os/mlsetup.c
index 601c6937fd..7c17aab541 100644
--- a/usr/src/uts/i86pc/os/mlsetup.c
+++ b/usr/src/uts/i86pc/os/mlsetup.c
@@ -490,6 +490,7 @@ mlsetup(struct regs *rp)
 	 * Fill out cpu_ucode_info.  Update microcode if necessary.
 	 */
 	ucode_check(CPU);
+	cpuid_pass_ucode(CPU, x86_featureset);
 
 	if (workaround_errata(CPU) != 0)
 		panic("critical workaround(s) missing for boot cpu");
diff --git a/usr/src/uts/i86pc/os/mp_machdep.c b/usr/src/uts/i86pc/os/mp_machdep.c
index 7062df90ff..69b65d216b 100644
--- a/usr/src/uts/i86pc/os/mp_machdep.c
+++ b/usr/src/uts/i86pc/os/mp_machdep.c
@@ -25,6 +25,7 @@
 /*
  * Copyright (c) 2009-2010, Intel Corporation.
  * All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #define	PSMI_1_7
@@ -148,6 +149,9 @@ int (*psm_get_ipivect)(int, int) = NULL;
 uchar_t (*psm_get_ioapicid)(uchar_t) = NULL;
 uint32_t (*psm_get_localapicid)(uint32_t) = NULL;
 uchar_t (*psm_xlate_vector_by_irq)(uchar_t) = NULL;
+int (*psm_get_pir_ipivect)(void) = NULL;
+void (*psm_send_pir_ipi)(processorid_t) = NULL;
+void (*psm_cmci_setup)(processorid_t, boolean_t) = NULL;
 
 int (*psm_clkinit)(int) = NULL;
 void (*psm_timer_reprogram)(hrtime_t) = NULL;
@@ -1153,6 +1157,10 @@ mach_smpinit(void)
 	}
 
 	psm_get_ipivect = pops->psm_get_ipivect;
+	psm_get_pir_ipivect = pops->psm_get_pir_ipivect;
+	psm_send_pir_ipi = pops->psm_send_pir_ipi;
+	psm_cmci_setup = pops->psm_cmci_setup;
+
 
 	(void) add_avintr((void *)NULL, XC_HI_PIL, xc_serv, "xc_intr",
 	    (*pops->psm_get_ipivect)(XC_HI_PIL, PSM_INTR_IPI_HI),
diff --git a/usr/src/uts/i86pc/os/mp_startup.c b/usr/src/uts/i86pc/os/mp_startup.c
index b1100377eb..fef8f2759d 100644
--- a/usr/src/uts/i86pc/os/mp_startup.c
+++ b/usr/src/uts/i86pc/os/mp_startup.c
@@ -1755,22 +1755,6 @@ mp_startup_common(boolean_t boot)
 	sti();
 
 	/*
-	 * Do a sanity check to make sure this new CPU is a sane thing
-	 * to add to the collection of processors running this system.
-	 *
-	 * XXX	Clearly this needs to get more sophisticated, if x86
-	 * systems start to get built out of heterogenous CPUs; as is
-	 * likely to happen once the number of processors in a configuration
-	 * gets large enough.
-	 */
-	if (compare_x86_featureset(x86_featureset, new_x86_featureset) ==
-	    B_FALSE) {
-		cmn_err(CE_CONT, "cpu%d: featureset\n", cp->cpu_id);
-		print_x86_featureset(new_x86_featureset);
-		cmn_err(CE_WARN, "cpu%d feature mismatch", cp->cpu_id);
-	}
-
-	/*
 	 * There exists a small subset of systems which expose differing
 	 * MWAIT/MONITOR support between CPUs.  If MWAIT support is absent from
 	 * the boot CPU, but is found on a later CPU, the system continues to
@@ -1875,6 +1859,23 @@ mp_startup_common(boolean_t boot)
 	 * Fill out cpu_ucode_info.  Update microcode if necessary.
 	 */
 	ucode_check(cp);
+	cpuid_pass_ucode(cp, new_x86_featureset);
+
+	/*
+	 * Do a sanity check to make sure this new CPU is a sane thing
+	 * to add to the collection of processors running this system.
+	 *
+	 * XXX	Clearly this needs to get more sophisticated, if x86
+	 * systems start to get built out of heterogenous CPUs; as is
+	 * likely to happen once the number of processors in a configuration
+	 * gets large enough.
+	 */
+	if (compare_x86_featureset(x86_featureset, new_x86_featureset) ==
+	    B_FALSE) {
+		cmn_err(CE_CONT, "cpu%d: featureset\n", cp->cpu_id);
+		print_x86_featureset(new_x86_featureset);
+		cmn_err(CE_WARN, "cpu%d feature mismatch", cp->cpu_id);
+	}
 
 #ifndef __xpv
 	{
@@ -1899,6 +1900,8 @@ mp_startup_common(boolean_t boot)
 	if (boothowto & RB_DEBUG)
 		kdi_cpu_init();
 
+	(void) mach_cpu_create_device_node(cp, NULL);
+
 	/*
 	 * Setting the bit in cpu_ready_set must be the last operation in
 	 * processor initialization; the boot CPU will continue to boot once
@@ -1906,8 +1909,6 @@ mp_startup_common(boolean_t boot)
 	 */
 	CPUSET_ATOMIC_ADD(cpu_ready_set, cp->cpu_id);
 
-	(void) mach_cpu_create_device_node(cp, NULL);
-
 	cmn_err(CE_CONT, "?cpu%d: %s\n", cp->cpu_id, cp->cpu_idstr);
 	cmn_err(CE_CONT, "?cpu%d: %s\n", cp->cpu_id, cp->cpu_brandstr);
 	cmn_err(CE_CONT, "?cpu%d initialization complete - online\n",
@@ -2083,6 +2084,8 @@ cpu_sep_enable(void)
 	ASSERT(curthread->t_preempt || getpil() >= LOCK_LEVEL);
 
 	wrmsr(MSR_INTC_SEP_CS, (uint64_t)(uintptr_t)KCS_SEL);
+
+	CPU->cpu_m.mcpu_fast_syscall_state |= FSS_SEP_ENABLED;
 }
 
 static void
@@ -2096,6 +2099,8 @@ cpu_sep_disable(void)
 	 * the sysenter or sysexit instruction to trigger a #gp fault.
 	 */
 	wrmsr(MSR_INTC_SEP_CS, 0);
+
+	CPU->cpu_m.mcpu_fast_syscall_state &= ~FSS_SEP_ENABLED;
 }
 
 static void
@@ -2106,6 +2111,8 @@ cpu_asysc_enable(void)
 
 	wrmsr(MSR_AMD_EFER, rdmsr(MSR_AMD_EFER) |
 	    (uint64_t)(uintptr_t)AMD_EFER_SCE);
+
+	CPU->cpu_m.mcpu_fast_syscall_state |= FSS_ASYSC_ENABLED;
 }
 
 static void
@@ -2120,4 +2127,6 @@ cpu_asysc_disable(void)
 	 */
 	wrmsr(MSR_AMD_EFER, rdmsr(MSR_AMD_EFER) &
 	    ~((uint64_t)(uintptr_t)AMD_EFER_SCE));
+
+	CPU->cpu_m.mcpu_fast_syscall_state &= ~FSS_ASYSC_ENABLED;
 }
diff --git a/usr/src/uts/i86pc/os/pc_hvm.c b/usr/src/uts/i86pc/os/pc_hvm.c
new file mode 100644
index 0000000000..60f8e8d3ca
--- /dev/null
+++ b/usr/src/uts/i86pc/os/pc_hvm.c
@@ -0,0 +1,65 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#include <sys/cmn_err.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/mutex.h>
+#include <sys/debug.h>
+
+static kmutex_t hvm_excl_lock;
+static const char *hvm_excl_holder = NULL;
+
+/*
+ * HVM Exclusion Interface
+ *
+ * To avoid VMX/SVM conflicts from arising when multiple hypervisor providers
+ * (eg. KVM, bhyve) are shipped with the system, this simple advisory locking
+ * system is presented for their use.  Until a proper hypervisor API, like the
+ * one in OSX, is shipped in illumos, this will serve as opt-in regulation to
+ * dictate that only a single hypervisor be allowed to configure the system and
+ * run at any given time.
+ */
+
+boolean_t
+hvm_excl_hold(const char *consumer)
+{
+	boolean_t res;
+
+	mutex_enter(&hvm_excl_lock);
+	if (hvm_excl_holder == NULL) {
+		hvm_excl_holder = consumer;
+		res = B_TRUE;
+	} else {
+		cmn_err(CE_WARN, "zone '%s' cannot take HVM exclusion lock as "
+		    "'%s': held by '%s'", curproc->p_zone->zone_name, consumer,
+		    hvm_excl_holder);
+		res = B_FALSE;
+	}
+	mutex_exit(&hvm_excl_lock);
+
+	return (res);
+}
+
+void
+hvm_excl_rele(const char *consumer)
+{
+	mutex_enter(&hvm_excl_lock);
+	VERIFY(consumer == hvm_excl_holder);
+	hvm_excl_holder = NULL;
+	mutex_exit(&hvm_excl_lock);
+}
diff --git a/usr/src/uts/i86pc/os/startup.c b/usr/src/uts/i86pc/os/startup.c
index 8c1d4e0697..f63973f092 100644
--- a/usr/src/uts/i86pc/os/startup.c
+++ b/usr/src/uts/i86pc/os/startup.c
@@ -319,22 +319,16 @@ static struct seg *segmap = &kmapseg;	/* easier to use name for in here */
 
 struct seg *segkp = &kpseg;	/* Pageable kernel virtual memory segment */
 
-#if defined(__amd64)
 struct seg kvseg_core;		/* Segment used for the core heap */
 struct seg kpmseg;		/* Segment used for physical mapping */
 struct seg *segkpm = &kpmseg;	/* 64bit kernel physical mapping segment */
-#else
-struct seg *segkpm = NULL;	/* Unused on IA32 */
-#endif
 
 caddr_t segkp_base;		/* Base address of segkp */
 caddr_t segzio_base;		/* Base address of segzio */
-#if defined(__amd64)
 pgcnt_t segkpsize = btop(SEGKPDEFSIZE);	/* size of segkp segment in pages */
-#else
-pgcnt_t segkpsize = 0;
-#endif
-pgcnt_t segziosize = 0;		/* size of zio segment in pages */
+caddr_t segkvmm_base;
+pgcnt_t segkvmmsize;
+pgcnt_t segziosize;
 
 /*
  * A static DR page_t VA map is reserved that can map the page structures
@@ -455,23 +449,32 @@ static pgcnt_t kphysm_init(page_t *, pgcnt_t);
  * 0xFFFFFFFF.C0000000  |-----------------------|- core_base / ekernelheap
  *			|	 Kernel		|
  *			|	  heap		|
+ *			|			|
+ *			|			|
  * 0xFFFFFXXX.XXX00000  |-----------------------|- kernelheap (floating)
  *			|	 segmap		|
  * 0xFFFFFXXX.XXX00000  |-----------------------|- segmap_start (floating)
  *			|    device mappings	|
  * 0xFFFFFXXX.XXX00000  |-----------------------|- toxic_addr (floating)
- *			|	  segzio	|
+ *			|	 segzio		|
  * 0xFFFFFXXX.XXX00000  |-----------------------|- segzio_base (floating)
- *			|	  segkp		|
- * ---                  |-----------------------|- segkp_base (floating)
+ *			|        segkvmm	|
+ *			|			|
+ *			|			|
+ *			|			|
+ * 0xFFFFFXXX.XXX00000  |-----------------------|- segkvmm_base (floating)
+ *			|	 segkp		|
+ * 			|-----------------------|- segkp_base (floating)
  *			|   page_t structures	|  valloc_base + valloc_sz
  *			|   memsegs, memlists,	|
  *			|   page hash, etc.	|
- * 0xFFFFFF00.00000000  |-----------------------|- valloc_base (lower if >256GB)
+ * 0xFFFFFE00.00000000  |-----------------------|- valloc_base (lower if >256GB)
  *			|	 segkpm		|
- * 0xFFFFFE00.00000000  |-----------------------|
+ *			|			|
+ * 0xFFFFFD00.00000000  |-----------------------|- SEGKPM_BASE (lower if >256GB)
  *			|	Red Zone	|
- * 0xFFFFFD80.00000000  |-----------------------|- KERNELBASE (lower if >256GB)
+ * 0xFFFFFC80.00000000  |-----------------------|- KERNELBASE (lower if >256GB)
+ * 0xFFFFFC7F.FFE00000  |-----------------------|- USERLIMIT (lower if >256GB)
  *			|     User stack	|- User space memory
  *			|			|
  *			| shared objects, etc	|	(grows downwards)
@@ -697,6 +700,7 @@ startup_smap(void)
 	uint32_t inst;
 	uint8_t *instp;
 	char sym[128];
+	struct modctl *modp;
 
 	extern int _smap_enable_patch_count;
 	extern int _smap_disable_patch_count;
@@ -730,8 +734,15 @@ startup_smap(void)
 		hot_patch_kernel_text((caddr_t)instp, inst, 4);
 	}
 
-	hot_patch_kernel_text((caddr_t)smap_enable, SMAP_CLAC_INSTR, 4);
-	hot_patch_kernel_text((caddr_t)smap_disable, SMAP_STAC_INSTR, 4);
+	/*
+	 * Hotinline calls to smap_enable and smap_disable within
+	 * unix module. Hotinlines in other modules are done on
+	 * mod_load().
+	 */
+	modp = mod_hold_by_name("unix");
+	do_hotinlines(modp->mod_mp);
+	mod_release_mod(modp);
+
 	setcr4(getcr4() | CR4_SMAP);
 	smap_enable();
 }
@@ -1076,22 +1087,9 @@ startup_memlist(void)
 	PRM_DEBUG(memblocks);
 
 	/*
-	 * Compute maximum physical address for memory DR operations.
-	 * Memory DR operations are unsupported on xpv or 32bit OSes.
+	 * We no longer support any form of memory DR.
 	 */
-#ifdef	__amd64
-	if (plat_dr_support_memory()) {
-		if (plat_dr_physmax == 0) {
-			uint_t pabits = UINT_MAX;
-
-			cpuid_get_addrsize(CPU, &pabits, NULL);
-			plat_dr_physmax = btop(1ULL << pabits);
-		}
-		if (plat_dr_physmax > PHYSMEM_MAX64)
-			plat_dr_physmax = PHYSMEM_MAX64;
-	} else
-#endif
-		plat_dr_physmax = 0;
+	plat_dr_physmax = 0;
 
 	/*
 	 * Examine the bios reserved memory to find out:
@@ -1252,68 +1250,55 @@ startup_memlist(void)
 	pse_table_alloc_size = pse_table_size * sizeof (pad_mutex_t);
 	ADD_TO_ALLOCATIONS(pse_mutex, pse_table_alloc_size);
 
-#if defined(__amd64)
 	valloc_sz = ROUND_UP_LPAGE(valloc_sz);
 	valloc_base = VALLOC_BASE;
 
 	/*
-	 * The default values of VALLOC_BASE and SEGKPM_BASE should work
-	 * for values of physmax up to 256GB (1/4 TB). They need adjusting when
-	 * memory is at addresses above 256GB. When adjusted, segkpm_base must
-	 * be aligned on KERNEL_REDZONE_SIZE boundary (span of top level pte).
+	 * The signicant memory-sized regions are roughly sized as follows in
+	 * the default layout with max physmem:
+	 *  segkpm: 1x physmem allocated (but 1Tb room, below VALLOC_BASE)
+	 *  segzio: 1.5x physmem
+	 *  segkvmm: 4x physmem
+	 *  heap: whatever's left up to COREHEAP_BASE, at least 1.5x physmem
 	 *
-	 * In the general case (>256GB), we use (4 * physmem) for the
-	 * kernel's virtual addresses, which is divided approximately
-	 * as follows:
-	 *  - 1 * physmem for segkpm
-	 *  - 1.5 * physmem for segzio
-	 *  - 1.5 * physmem for heap
-	 * Total: 4.0 * physmem
+	 * The idea is that we leave enough room to avoid fragmentation issues,
+	 * so we would like the VA arenas to have some extra.
 	 *
-	 * Note that the segzio and heap sizes are more than physmem so that
-	 * VA fragmentation does not prevent either of them from being
-	 * able to use nearly all of physmem.  The value of 1.5x is determined
-	 * experimentally and may need to change if the workload changes.
+	 * Ignoring the loose change of segkp, valloc, and such, this means that
+	 * as COREHEAP_BASE-VALLOC_BASE=2Tb, we can accommodate a physmem up to
+	 * about (2Tb / 7.0), rounded down to 256Gb in the check below.
+	 *
+	 * Note that KPM lives below VALLOC_BASE, but we want to include it in
+	 * adjustments, hence the 8 below.
+	 *
+	 * Beyond 256Gb, we push segkpm_base (and hence kernelbase and
+	 * _userlimit) down to accommodate the VA requirements above.
 	 */
-	if (physmax + 1 > mmu_btop(TERABYTE / 4) ||
-	    plat_dr_physmax > mmu_btop(TERABYTE / 4)) {
-		uint64_t kpm_resv_amount = mmu_ptob(physmax + 1);
+	if (physmax + 1 > mmu_btop(TERABYTE / 4)) {
+		uint64_t physmem_bytes = mmu_ptob(physmax + 1);
+		uint64_t adjustment = 8 * (physmem_bytes - (TERABYTE / 4));
 
-		if (kpm_resv_amount < mmu_ptob(plat_dr_physmax)) {
-			kpm_resv_amount = mmu_ptob(plat_dr_physmax);
-		}
+		PRM_DEBUG(adjustment);
 
 		/*
-		 * This is what actually controls the KVA : UVA split.
-		 * The kernel uses high VA, and this is lowering the
-		 * boundary, thus increasing the amount of VA for the kernel.
-		 * This gives the kernel 4 * (amount of physical memory) VA.
-		 *
-		 * The maximum VA is UINT64_MAX and we are using
-		 * 64-bit 2's complement math, so e.g. if you have 512GB
-		 * of memory, segkpm_base = -(4 * 512GB) == -2TB ==
-		 * UINT64_MAX - 2TB (approximately).  So the kernel's
-		 * VA is [UINT64_MAX-2TB to UINT64_MAX].
+		 * segkpm_base is always aligned on a L3 PTE boundary.
 		 */
-		segkpm_base = -(P2ROUNDUP((4 * kpm_resv_amount),
-		    KERNEL_REDZONE_SIZE));
+		segkpm_base -= P2ROUNDUP(adjustment, KERNEL_REDZONE_SIZE);
 
-		/* make sure we leave some space for user apps above hole */
+		/*
+		 * But make sure we leave some space for user apps above hole.
+		 */
 		segkpm_base = MAX(segkpm_base, AMD64_VA_HOLE_END + TERABYTE);
-		if (segkpm_base > SEGKPM_BASE)
-			segkpm_base = SEGKPM_BASE;
-		PRM_DEBUG(segkpm_base);
 
-		valloc_base = segkpm_base + P2ROUNDUP(kpm_resv_amount, ONE_GIG);
+		ASSERT(segkpm_base <= SEGKPM_BASE);
+
+		valloc_base = segkpm_base + P2ROUNDUP(physmem_bytes, ONE_GIG);
 		if (valloc_base < segkpm_base)
 			panic("not enough kernel VA to support memory size");
-		PRM_DEBUG(valloc_base);
 	}
-#else	/* __i386 */
-	valloc_base = (uintptr_t)(MISC_VA_BASE - valloc_sz);
-	valloc_base = P2ALIGN(valloc_base, mmu.level_size[1]);
+
+	PRM_DEBUG(segkpm_base);
 	PRM_DEBUG(valloc_base);
-#endif	/* __i386 */
 
 	/*
 	 * do all the initial allocations
@@ -1901,73 +1886,70 @@ protect_boot_range(uintptr_t low, uintptr_t high, int setaside)
 }
 
 /*
- *
+ * Establish the final size of the kernel's heap, size of segmap, segkp, etc.
  */
 static void
 layout_kernel_va(void)
 {
-	PRM_POINT("layout_kernel_va() starting...");
-	/*
-	 * Establish the final size of the kernel's heap, size of segmap,
-	 * segkp, etc.
-	 */
+	const size_t physmem_size = mmu_ptob(physmem);
+	size_t size;
 
-#if defined(__amd64)
+	PRM_POINT("layout_kernel_va() starting...");
 
 	kpm_vbase = (caddr_t)segkpm_base;
-	if (physmax + 1 < plat_dr_physmax) {
-		kpm_size = ROUND_UP_LPAGE(mmu_ptob(plat_dr_physmax));
-	} else {
-		kpm_size = ROUND_UP_LPAGE(mmu_ptob(physmax + 1));
-	}
+	kpm_size = ROUND_UP_LPAGE(mmu_ptob(physmax + 1));
 	if ((uintptr_t)kpm_vbase + kpm_size > (uintptr_t)valloc_base)
 		panic("not enough room for kpm!");
 	PRM_DEBUG(kpm_size);
 	PRM_DEBUG(kpm_vbase);
 
-	/*
-	 * By default we create a seg_kp in 64 bit kernels, it's a little
-	 * faster to access than embedding it in the heap.
-	 */
 	segkp_base = (caddr_t)valloc_base + valloc_sz;
 	if (!segkp_fromheap) {
-		size_t sz = mmu_ptob(segkpsize);
+		size = mmu_ptob(segkpsize);
 
 		/*
 		 * determine size of segkp
 		 */
-		if (sz < SEGKPMINSIZE || sz > SEGKPMAXSIZE) {
-			sz = SEGKPDEFSIZE;
+		if (size < SEGKPMINSIZE || size > SEGKPMAXSIZE) {
+			size = SEGKPDEFSIZE;
 			cmn_err(CE_WARN, "!Illegal value for segkpsize. "
 			    "segkpsize has been reset to %ld pages",
-			    mmu_btop(sz));
+			    mmu_btop(size));
 		}
-		sz = MIN(sz, MAX(SEGKPMINSIZE, mmu_ptob(physmem)));
+		size = MIN(size, MAX(SEGKPMINSIZE, physmem_size));
 
-		segkpsize = mmu_btop(ROUND_UP_LPAGE(sz));
+		segkpsize = mmu_btop(ROUND_UP_LPAGE(size));
 	}
 	PRM_DEBUG(segkp_base);
 	PRM_DEBUG(segkpsize);
 
 	/*
-	 * segzio is used for ZFS cached data. It uses a distinct VA
-	 * segment (from kernel heap) so that we can easily tell not to
-	 * include it in kernel crash dumps on 64 bit kernels. The trick is
-	 * to give it lots of VA, but not constrain the kernel heap.
-	 * We can use 1.5x physmem for segzio, leaving approximately
-	 * another 1.5x physmem for heap.  See also the comment in
-	 * startup_memlist().
+	 * segkvmm: backing for vmm guest memory. Like segzio, we have a
+	 * separate segment for two reasons: it makes it easy to skip our pages
+	 * on kernel crash dumps, and it helps avoid fragmentation.  With this
+	 * segment, we're expecting significantly-sized allocations only; we'll
+	 * default to 4x the size of physmem.
 	 */
-	segzio_base = segkp_base + mmu_ptob(segkpsize);
+	segkvmm_base = segkp_base + mmu_ptob(segkpsize);
+	size = segkvmmsize != 0 ? mmu_ptob(segkvmmsize) : (physmem_size * 4);
+
+	size = MAX(size, SEGVMMMINSIZE);
+	segkvmmsize = mmu_btop(ROUND_UP_LPAGE(size));
+
+	PRM_DEBUG(segkvmmsize);
+	PRM_DEBUG(segkvmm_base);
+
+	/*
+	 * segzio is used for ZFS cached data.  For segzio, we use 1.5x physmem.
+	 */
+	segzio_base = segkvmm_base + mmu_ptob(segkvmmsize);
 	if (segzio_fromheap) {
 		segziosize = 0;
 	} else {
-		size_t physmem_size = mmu_ptob(physmem);
-		size_t size = (segziosize == 0) ?
-		    physmem_size * 3 / 2 : mmu_ptob(segziosize);
+		size = (segziosize != 0) ? mmu_ptob(segziosize) :
+		    (physmem_size * 3) / 2;
 
-		if (size < SEGZIOMINSIZE)
-			size = SEGZIOMINSIZE;
+		size = MAX(size, SEGZIOMINSIZE);
 		segziosize = mmu_btop(ROUND_UP_LPAGE(size));
 	}
 	PRM_DEBUG(segziosize);
@@ -1981,10 +1963,6 @@ layout_kernel_va(void)
 	    ROUND_UP_LPAGE((uintptr_t)segzio_base + mmu_ptob(segziosize));
 	PRM_DEBUG(toxic_addr);
 	segmap_start = ROUND_UP_LPAGE(toxic_addr + toxic_size);
-#else /* __i386 */
-	segmap_start = ROUND_UP_LPAGE(kernelbase);
-#endif /* __i386 */
-	PRM_DEBUG(segmap_start);
 
 	/*
 	 * Users can change segmapsize through eeprom. If the variable
@@ -1993,16 +1971,6 @@ layout_kernel_va(void)
 	 */
 	segmapsize = MAX(ROUND_UP_LPAGE(segmapsize), SEGMAPDEFAULT);
 
-#if defined(__i386)
-	/*
-	 * 32-bit systems don't have segkpm or segkp, so segmap appears at
-	 * the bottom of the kernel's address range.  Set aside space for a
-	 * small red zone just below the start of segmap.
-	 */
-	segmap_start += KERNEL_REDZONE_SIZE;
-	segmapsize -= KERNEL_REDZONE_SIZE;
-#endif
-
 	PRM_DEBUG(segmap_start);
 	PRM_DEBUG(segmapsize);
 	kernelheap = (caddr_t)ROUND_UP_LPAGE(segmap_start + segmapsize);
@@ -2603,6 +2571,7 @@ add_physmem_cb(page_t *pp, pfn_t pnum)
 	pp->p_mapping = NULL;
 	pp->p_embed = 0;
 	pp->p_share = 0;
+	pp->p_zoneid = ALL_ZONES;
 	pp->p_mlentry = 0;
 }
 
@@ -2790,11 +2759,16 @@ kvm_init(void)
 		(void) segkmem_create(&kvseg_core);
 	}
 
+	PRM_POINT("attaching segkvmm");
+	(void) seg_attach(&kas, segkvmm_base, mmu_ptob(segkvmmsize), &kvmmseg);
+	(void) segkmem_create(&kvmmseg);
+	segkmem_kvmm_init(segkvmm_base, mmu_ptob(segkvmmsize));
+
 	if (segziosize > 0) {
 		PRM_POINT("attaching segzio");
 		(void) seg_attach(&kas, segzio_base, mmu_ptob(segziosize),
 		    &kzioseg);
-		(void) segkmem_zio_create(&kzioseg);
+		(void) segkmem_create(&kzioseg);
 
 		/* create zio area covering new segment */
 		segkmem_zio_init(segzio_base, mmu_ptob(segziosize));
diff --git a/usr/src/uts/i86pc/os/trap.c b/usr/src/uts/i86pc/os/trap.c
index be5ad49f0e..0da153355e 100644
--- a/usr/src/uts/i86pc/os/trap.c
+++ b/usr/src/uts/i86pc/os/trap.c
@@ -101,6 +101,7 @@
 #include <sys/hypervisor.h>
 #endif
 #include <sys/contract/process_impl.h>
+#include <sys/brand.h>
 
 #define	USER	0x10000		/* user-mode flag added to trap type */
 
@@ -861,6 +862,17 @@ trap(struct regs *rp, caddr_t addr, processorid_t cpuid)
 			fault_type = F_INVAL;
 		}
 
+		/*
+		 * Allow the brand to interpose on invalid memory accesses
+		 * prior to running the native pagefault handler.  If this
+		 * brand hook returns zero, it was able to handle the fault
+		 * completely.  Otherwise, drive on and call pagefault().
+		 */
+		if (PROC_IS_BRANDED(p) && BROP(p)->b_pagefault != NULL &&
+		    BROP(p)->b_pagefault(p, lwp, addr, fault_type, rw) == 0) {
+			goto out;
+		}
+
 		res = pagefault(addr, fault_type, rw, 0);
 
 		/*
@@ -2068,6 +2080,7 @@ dump_ttrace(void)
 #endif
 	/* Define format for the TYPE and VC fields */
 	const char fmt2[] = "%4s %3x";
+	const char fmt2s[] = "%4s %3s";
 	char data2[9];	/* length of string formatted by fmt2 + 1 */
 	/*
 	 * Define format for the HANDLER field. Width is arbitrary, but should
@@ -2157,6 +2170,14 @@ dump_ttrace(void)
 				break;
 
 			case TT_INTERRUPT:
+				if (rec->ttr_regs.r_trapno == T_SOFTINT) {
+					(void) snprintf(data2, sizeof (data2),
+					    fmt2s, "intr", "-");
+					(void) snprintf(data3, sizeof (data3),
+					    fmt3s, "(fakesoftint)");
+					break;
+				}
+
 				(void) snprintf(data2, sizeof (data2), fmt2,
 				    "intr", rec->ttr_vector);
 				if (get_intr_handler != NULL)
diff --git a/usr/src/uts/i86pc/ppt/Makefile b/usr/src/uts/i86pc/ppt/Makefile
new file mode 100644
index 0000000000..34661bd3f3
--- /dev/null
+++ b/usr/src/uts/i86pc/ppt/Makefile
@@ -0,0 +1,81 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+# Copyright 2017 Joyent, Inc.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= ppt
+OBJECTS		= $(PPT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(PPT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/i86pc/io/vmm/io
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/i86pc/Makefile.i86pc
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+#	Overrides and additions
+#
+ALL_BUILDS	= $(ALL_BUILDSONLY64)
+DEF_BUILDS	= $(DEF_BUILDSONLY64)
+PRE_INC_PATH	= -I$(COMPAT)/freebsd -I$(COMPAT)/freebsd/amd64 \
+	-I$(CONTRIB)/freebsd -I$(CONTRIB)/freebsd/amd64
+INC_PATH	+= -I$(UTSBASE)/i86pc/io/vmm -I$(UTSBASE)/i86pc/io/vmm/io
+AS_INC_PATH	+= -I$(UTSBASE)/i86pc/io/vmm -I$(OBJS_DIR)
+
+LDFLAGS         += -dy -N drv/vmm -N misc/pcie
+
+$(OBJS_DIR)/ppt.o := CERRWARN	+= -_gcc=-Wno-unused-variable
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/i86pc/Makefile.targ
diff --git a/usr/src/uts/i86pc/sys/Makefile b/usr/src/uts/i86pc/sys/Makefile
index 7fa9f8f6ef..e6ea573d0b 100644
--- a/usr/src/uts/i86pc/sys/Makefile
+++ b/usr/src/uts/i86pc/sys/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 # uts/i86pc/sys/Makefile
 #
@@ -36,15 +37,16 @@ include ../Makefile.i86pc
 #
 FILEMODE = 644
 
-HDRS=  \
+CHKHDRS=  \
 	acpidev.h	\
 	amd_iommu.h	\
 	asm_misc.h	\
 	clock.h		\
 	cram.h		\
 	ddi_subrdefs.h	\
-	debug_info.h 	\
+	debug_info.h	\
 	fastboot.h	\
+	ht.h		\
 	mach_mmu.h	\
 	machclock.h	\
 	machcpuvar.h	\
@@ -66,6 +68,16 @@ HDRS=  \
 	xc_levels.h	\
 	xsvc.h
 
+NOCHKHDRS= \
+	vmm.h		\
+	vmm_dev.h	\
+	vmm_impl.h	\
+	vmm_instruction_emul.h
+
+HDRS= \
+	$(CHKHDRS)	\
+	$(NOCHKHDRS)
+
 ROOTHDRS=	$(HDRS:%=$(USR_PSM_ISYS_DIR)/%)
 
 ROOTDIR=	$(ROOT)/usr/share/src
@@ -74,7 +86,7 @@ ROOTDIRS=	$(ROOTDIR)/uts $(ROOTDIR)/uts/$(PLATFORM)
 ROOTLINK=	$(ROOTDIR)/uts/$(PLATFORM)/sys
 LINKDEST=	../../../../platform/$(PLATFORM)/include/sys
 
-CHECKHDRS=	$(HDRS:%.h=%.check)
+CHECKHDRS=	$(CHKHDRS:%.h=%.check)
 
 .KEEP_STATE:
 
diff --git a/usr/src/uts/i86pc/sys/apic.h b/usr/src/uts/i86pc/sys/apic.h
index 0ad325ac49..f2528a632f 100644
--- a/usr/src/uts/i86pc/sys/apic.h
+++ b/usr/src/uts/i86pc/sys/apic.h
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  * Copyright (c) 2017 by Delphix. All rights reserved.
  */
 /*
@@ -386,7 +386,7 @@ struct apic_io_intr {
 /* special or reserve vectors */
 #define	APIC_CHECK_RESERVE_VECTORS(v) \
 	(((v) == T_FASTTRAP) || ((v) == APIC_SPUR_INTR) || \
-	((v) == T_SYSCALLINT) || ((v) == T_DTRACE_RET))
+	((v) == T_SYSCALLINT) || ((v) == T_DTRACE_RET) || ((v) == 0x80))
 
 /* cmos shutdown code for BIOS						*/
 #define	BIOS_SHUTDOWN		0x0a
@@ -832,6 +832,7 @@ extern void apic_change_eoi();
 extern void apic_send_EOI(uint32_t);
 extern void apic_send_directed_EOI(uint32_t);
 extern uint64_t apic_calibrate();
+extern void x2apic_send_pir_ipi(processorid_t);
 
 extern volatile uint32_t *apicadr;	/* virtual addr of local APIC   */
 extern int apic_forceload;
@@ -878,6 +879,7 @@ extern void apic_change_ops();
 extern void apic_common_send_ipi(int, int);
 extern void apic_set_directed_EOI_handler();
 extern int apic_directed_EOI_supported();
+extern void apic_common_send_pir_ipi(processorid_t);
 
 extern apic_intrmap_ops_t *apic_vt_ops;
 
diff --git a/usr/src/uts/i86pc/sys/apic_common.h b/usr/src/uts/i86pc/sys/apic_common.h
index 2eb7bc2597..dc02031ac3 100644
--- a/usr/src/uts/i86pc/sys/apic_common.h
+++ b/usr/src/uts/i86pc/sys/apic_common.h
@@ -23,7 +23,7 @@
  * Copyright (c) 2017 by Delphix. All rights reserved.
  */
 /*
- * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef _SYS_APIC_COMMON_H
@@ -116,6 +116,8 @@ extern int	apic_panic_on_apic_error;
 
 extern int	apic_verbose;
 
+extern int	apic_pir_vect;
+
 #ifdef DEBUG
 extern int	apic_debug;
 extern int	apic_restrict_vector;
@@ -183,10 +185,12 @@ extern void	apic_shutdown(int cmd, int fcn);
 extern void	apic_preshutdown(int cmd, int fcn);
 extern processorid_t	apic_get_next_processorid(processorid_t cpun);
 extern uint64_t	apic_calibrate();
+extern int	apic_get_pir_ipivect(void);
+extern void	apic_send_pir_ipi(processorid_t);
 
 extern int apic_error_intr();
 extern void apic_cpcovf_mask_clear(void);
-extern int cmci_cpu_setup(cpu_setup_t what, int cpuid, void *arg);
+extern void apic_cmci_setup(processorid_t, boolean_t);
 extern void apic_intrmap_init(int apic_mode);
 extern processorid_t apic_find_cpu(int flag);
 extern processorid_t apic_get_next_bind_cpu(void);
diff --git a/usr/src/uts/i86pc/sys/comm_page.h b/usr/src/uts/i86pc/sys/comm_page.h
index 520ad9001d..ea19c856a8 100644
--- a/usr/src/uts/i86pc/sys/comm_page.h
+++ b/usr/src/uts/i86pc/sys/comm_page.h
@@ -27,6 +27,7 @@ extern "C" {
 #endif
 
 #define	COMM_PAGE_SIZE	PAGESIZE
+#define	COMM_PAGE_ALIGN	0x4000
 
 #ifndef _ASM
 
diff --git a/usr/src/uts/i86pc/sys/cpu_module_impl.h b/usr/src/uts/i86pc/sys/cpu_module_impl.h
index 425d819963..6e2de12828 100644
--- a/usr/src/uts/i86pc/sys/cpu_module_impl.h
+++ b/usr/src/uts/i86pc/sys/cpu_module_impl.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef _SYS_CPU_MODULE_IMPL_H
@@ -64,6 +65,7 @@ typedef struct cmi_ops {
 	void (*cmi_hdl_poke)(cmi_hdl_t);
 	void (*cmi_fini)(cmi_hdl_t);
 	void (*cmi_panic_callback)(void);
+	const char *(*cmi_ident)(cmi_hdl_t);
 } cmi_ops_t;
 
 /*
diff --git a/usr/src/uts/i86pc/sys/ht.h b/usr/src/uts/i86pc/sys/ht.h
new file mode 100644
index 0000000000..6b1bfcdd2b
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/ht.h
@@ -0,0 +1,46 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef	_SYS_HT_H
+#define	_SYS_HT_H
+
+#include <sys/types.h>
+#include <sys/thread.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+struct cpu;
+
+extern void ht_init(void);
+
+extern int ht_acquire(void);
+extern void ht_release(void);
+extern void ht_mark(void);
+extern void ht_begin_unsafe(void);
+extern void ht_end_unsafe(void);
+extern void ht_begin_intr(uint_t);
+extern void ht_end_intr(void);
+extern void ht_mark_as_vcpu(void);
+
+extern boolean_t ht_should_run(kthread_t *, struct cpu *);
+extern pri_t ht_adjust_cpu_score(kthread_t *, struct cpu *, pri_t);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_HT_H */
diff --git a/usr/src/uts/i86pc/sys/machcpuvar.h b/usr/src/uts/i86pc/sys/machcpuvar.h
index d3827522e8..3d652316a4 100644
--- a/usr/src/uts/i86pc/sys/machcpuvar.h
+++ b/usr/src/uts/i86pc/sys/machcpuvar.h
@@ -81,6 +81,12 @@ struct xen_evt_data {
 	ulong_t		evt_affinity[sizeof (ulong_t) * 8]; /* service on cpu */
 };
 
+enum fast_syscall_state {
+	FSS_DISABLED		= 0,
+	FSS_ASYSC_ENABLED	= (1 << 0),
+	FSS_SEP_ENABLED		= (1 << 1)
+};
+
 struct kpti_frame {
 	uint64_t	kf_lower_redzone;
 
@@ -134,6 +140,15 @@ struct kpti_frame {
 	uint64_t	kf_upper_redzone;
 };
 
+typedef struct cpu_ht {
+	lock_t ch_lock;
+	char ch_pad[56];
+	struct cpu *ch_sib;
+	volatile uint64_t ch_intr_depth;
+	volatile uint64_t ch_state;
+	volatile uint64_t ch_sibstate;
+} cpu_ht_t;
+
 /*
  * This first value, MACHCPU_SIZE is the size of all the members in the cpu_t
  * AND struct machcpu, before we get to the mcpu_pad and the kpti area.
@@ -141,9 +156,9 @@ struct kpti_frame {
  * page-tables, and hence must be page-aligned and page-sized. See
  * hat_pcp_setup().
  *
- * There is a CTASSERT in os/intr.c that checks these numbers.
+ * There are CTASSERTs in os/intr.c that verify this all works out.
  */
-#define	MACHCPU_SIZE	(572 + 1584)
+#define	MACHCPU_SIZE	(1568 + 688)
 #define	MACHCPU_PAD	(MMU_PAGESIZE - MACHCPU_SIZE)
 #define	MACHCPU_PAD2	(MMU_PAGESIZE - 16 - 3 * sizeof (struct kpti_frame))
 
@@ -204,6 +219,8 @@ struct	machcpu {
 	uint16_t mcpu_idle_type;	/* CPU next idle type */
 	uint16_t max_cstates;		/* supported max cstates */
 
+	enum fast_syscall_state	mcpu_fast_syscall_state;
+
 	struct cpu_ucode_info	*mcpu_ucode_info;
 
 	void			*mcpu_pm_mach_state;
@@ -219,6 +236,8 @@ struct	machcpu {
 	 */
 	volatile uint32_t	mcpu_istamp;
 
+	cpu_ht_t		mcpu_ht;
+
 	char			mcpu_pad[MACHCPU_PAD];
 
 	/* This is the start of the page */
diff --git a/usr/src/uts/i86pc/sys/machparam.h b/usr/src/uts/i86pc/sys/machparam.h
index 51d7559483..f79b582df4 100644
--- a/usr/src/uts/i86pc/sys/machparam.h
+++ b/usr/src/uts/i86pc/sys/machparam.h
@@ -31,14 +31,15 @@
 #ifndef _SYS_MACHPARAM_H
 #define	_SYS_MACHPARAM_H
 
-#if !defined(_ASM)
+#ifndef _ASM
+
 #include <sys/types.h>
 
 #if defined(__xpv)
 #include <sys/xpv_impl.h>
 #endif
 
-#endif
+#endif /* !_ASM */
 
 #ifdef	__cplusplus
 extern "C" {
@@ -54,17 +55,12 @@ extern "C" {
  * Machine dependent parameters and limits.
  */
 
-#if defined(__amd64)
 /*
  * If NCPU grows beyond 256, sizing for the x86 comm page will require
  * adjustment.
  */
 #define	NCPU	256
 #define	NCPU_LOG2	8
-#elif defined(__i386)
-#define	NCPU	32
-#define	NCPU_LOG2	5
-#endif
 
 /* NCPU_P2 is NCPU rounded to a power of 2 */
 #define	NCPU_P2	(1 << NCPU_LOG2)
@@ -116,11 +112,7 @@ extern "C" {
 /*
  * DEFAULT KERNEL THREAD stack size (in pages).
  */
-#if defined(__amd64)
 #define	DEFAULTSTKSZ_NPGS	5
-#elif defined(__i386)
-#define	DEFAULTSTKSZ_NPGS	3
-#endif
 
 #if !defined(_ASM)
 #define	DEFAULTSTKSZ	(DEFAULTSTKSZ_NPGS * PAGESIZE)
@@ -129,43 +121,42 @@ extern "C" {
 #endif	/* !_ASM */
 
 /*
- * KERNELBASE is the virtual address at which the kernel segments start in
- * all contexts.
- *
- * KERNELBASE is not fixed.  The value of KERNELBASE can change with
- * installed memory or on 32 bit systems the eprom variable 'eprom_kernelbase'.
- *
- * common/conf/param.c requires a compile time defined value for KERNELBASE.
- * This value is save in the variable _kernelbase.  _kernelbase may then be
- * modified with to a different value in i86pc/os/startup.c.
- *
- * Most code should be using kernelbase, which resolves to a reference to
- * _kernelbase.
+ * During intial boot we limit heap to the top 4Gig.
  */
-#define	KERNEL_TEXT_amd64	UINT64_C(0xfffffffffb800000)
-
-#ifdef __i386
-
-#define	KERNEL_TEXT_i386	ADDRESS_C(0xfe800000)
+#define	BOOT_KERNELHEAP_BASE	ADDRESS_C(0xffffffff00000000)
 
 /*
- * We don't use HYPERVISOR_VIRT_START, as we need both the PAE and non-PAE
- * versions in our code. We always compile based on the lower PAE address.
+ * VMWare works best if we don't use the top 64Meg of memory for amd64.
+ * Set KERNEL_TEXT to top_o_memory - 64Meg - 8 Meg for 8Meg of nucleus pages.
  */
-#define	KERNEL_TEXT_i386_xpv	\
-	(HYPERVISOR_VIRT_START_PAE - 3 * ADDRESS_C(0x400000))
-
-#endif /* __i386 */
+#define	PROMSTART	ADDRESS_C(0xffc00000)
 
-#if defined(__amd64)
+/*
+ * Virtual address range available to the debugger
+ */
+#define	SEGDEBUGBASE	ADDRESS_C(0xffffffffff800000)
+#define	SEGDEBUGSIZE	ADDRESS_C(0x400000)
 
-#define	KERNELBASE	ADDRESS_C(0xfffffd8000000000)
+#define	KERNEL_TEXT	UINT64_C(0xfffffffffb800000)
 
 /*
- * Size of the unmapped "red zone" at the very bottom of the kernel's
- * address space.  Corresponds to 1 slot in the toplevel pagetable.
+ * Reserve pages just below KERNEL_TEXT for the GDT, IDT, LDT, TSS and debug
+ * info.
+ *
+ * For now, DEBUG_INFO_VA must be first in this list for "xm" initiated dumps
+ * of solaris domUs to be usable with mdb. Relying on a fixed VA is not viable
+ * long term, but it's the best we've got for now.
  */
-#define	KERNEL_REDZONE_SIZE   ((uintptr_t)1 << 39)
+#if !defined(_ASM)
+#define	DEBUG_INFO_VA	(KERNEL_TEXT - MMU_PAGESIZE)
+#define	GDT_VA		(DEBUG_INFO_VA - MMU_PAGESIZE)
+#define	IDT_VA		(GDT_VA - MMU_PAGESIZE)
+#define	LDT_VA		(IDT_VA - (16 * MMU_PAGESIZE))
+#define	KTSS_VA		(LDT_VA - MMU_PAGESIZE)
+#define	DFTSS_VA	(KTSS_VA - MMU_PAGESIZE)
+#define	MISC_VA_BASE	(DFTSS_VA)
+#define	MISC_VA_SIZE	(KERNEL_TEXT - MISC_VA_BASE)
+#endif /* !_ASM */
 
 /*
  * Base of 'core' heap area, which is used for kernel and module text/data
@@ -174,52 +165,47 @@ extern "C" {
 #define	COREHEAP_BASE	ADDRESS_C(0xffffffffc0000000)
 
 /*
- * Beginning of the segkpm window. A lower value than this is used if
- * physical addresses exceed 1TB. See i86pc/os/startup.c
- */
-#define	SEGKPM_BASE	ADDRESS_C(0xfffffe0000000000)
-
-/*
  * This is valloc_base, above seg_kpm, but below everything else.
  * A lower value than this may be used if SEGKPM_BASE is adjusted.
  * See i86pc/os/startup.c
  */
-#define	VALLOC_BASE	ADDRESS_C(0xffffff0000000000)
+#define	VALLOC_BASE	ADDRESS_C(0xfffffe0000000000)
+
+#define	SEGZIOMINSIZE	(400L * 1024 * 1024L)			/* 400M */
+#define	SEGVMMMINSIZE	(4096L * 1024 * 1024L)			/* 4G */
 
-/*
- * default and boundary sizes for segkp
- */
 #define	SEGKPDEFSIZE	(2L * 1024L * 1024L * 1024L)		/*   2G */
 #define	SEGKPMAXSIZE	(8L * 1024L * 1024L * 1024L)		/*   8G */
 #define	SEGKPMINSIZE	(200L * 1024 * 1024L)			/* 200M */
 
-/*
- * minimum size for segzio
- */
-#define	SEGZIOMINSIZE	(400L * 1024 * 1024L)			/* 400M */
-
-/*
- * During intial boot we limit heap to the top 4Gig.
- */
-#define	BOOT_KERNELHEAP_BASE	ADDRESS_C(0xffffffff00000000)
+#define	SEGKPM_BASE	ADDRESS_C(0xfffffd0000000000)
 
 /*
- * VMWare works best if we don't use the top 64Meg of memory for amd64.
- * Set KERNEL_TEXT to top_o_memory - 64Meg - 8 Meg for 8Meg of nucleus pages.
+ * KERNELBASE is the virtual address at which the kernel segments start in
+ * all contexts.
+ *
+ * KERNELBASE is not fixed.  The value of KERNELBASE can change with
+ * installed memory size.
+ *
+ * common/conf/param.c requires a compile time defined value for KERNELBASE.
+ * This value is save in the variable _kernelbase.  _kernelbase may then be
+ * modified with to a different value in i86pc/os/startup.c.
+ *
+ * Most code should be using kernelbase, which resolves to a reference to
+ * _kernelbase.
  */
-#define	PROMSTART	ADDRESS_C(0xffc00000)
-#define	KERNEL_TEXT	KERNEL_TEXT_amd64
+#define	KERNELBASE	ADDRESS_C(0xfffffc8000000000)
 
 /*
- * Virtual address range available to the debugger
+ * Size of the unmapped "red zone" at the very bottom of the kernel's
+ * address space.  Corresponds to 1 slot in the toplevel pagetable.
  */
-#define	SEGDEBUGBASE	ADDRESS_C(0xffffffffff800000)
-#define	SEGDEBUGSIZE	ADDRESS_C(0x400000)
+#define	KERNEL_REDZONE_SIZE   ((uintptr_t)1 << 39)
 
 /*
  * Define upper limit on user address space
  *
- * In amd64, the upper limit on a 64-bit user address space is 1 large page
+ * The upper limit on a 64-bit user address space is 1 large page
  * (2MB) below kernelbase.  The upper limit for a 32-bit user address space
  * is 1 small page (4KB) below the top of the 32-bit range.  The 64-bit
  * limit give dtrace the red zone it needs below kernelbase.  The 32-bit
@@ -232,7 +218,7 @@ extern "C" {
 #if defined(__xpv)
 #define	USERLIMIT	ADDRESS_C(0x00007fffffe00000)
 #else
-#define	USERLIMIT	ADDRESS_C(0xfffffd7fffe00000)
+#define	USERLIMIT	ADDRESS_C(0xfffffc7fffe00000)
 #endif
 
 #ifdef bug_5074717_is_fixed
@@ -241,76 +227,6 @@ extern "C" {
 #define	USERLIMIT32	ADDRESS_C(0xfefff000)
 #endif
 
-#elif defined(__i386)
-
-#ifdef DEBUG
-#define	KERNELBASE	ADDRESS_C(0xc8000000)
-#else
-#define	KERNELBASE	ADDRESS_C(0xd4000000)
-#endif
-
-#define	KERNELBASE_MAX	ADDRESS_C(0xe0000000)
-
-/*
- * The i386 ABI requires that the user address space be at least 3Gb
- * in size.  KERNELBASE_ABI_MIN is used as the default KERNELBASE for
- * physical memory configurations > 4gb.
- */
-#define	KERNELBASE_ABI_MIN	ADDRESS_C(0xc0000000)
-
-/*
- * Size of the unmapped "red zone" at the very bottom of the kernel's
- * address space.  Since segmap start immediately above the red zone, this
- * needs to be MAXBSIZE aligned.
- */
-#define	KERNEL_REDZONE_SIZE   MAXBSIZE
-
-/*
- * This is the last 4MB of the 4G address space. Some psm modules
- * need this region of virtual address space mapped 1-1
- * The top 64MB of the address space is reserved for the hypervisor.
- */
-#define	PROMSTART	ADDRESS_C(0xffc00000)
-#ifdef __xpv
-#define	KERNEL_TEXT	KERNEL_TEXT_i386_xpv
-#else
-#define	KERNEL_TEXT	KERNEL_TEXT_i386
-#endif
-
-/*
- * Virtual address range available to the debugger
- * We place it just above the kernel text (4M) and kernel data (4M).
- */
-#define	SEGDEBUGBASE	(KERNEL_TEXT + ADDRESS_C(0x800000))
-#define	SEGDEBUGSIZE	ADDRESS_C(0x400000)
-
-/*
- * Define upper limit on user address space
- */
-#define	USERLIMIT	KERNELBASE
-#define	USERLIMIT32	USERLIMIT
-
-#endif	/* __i386 */
-
-/*
- * Reserve pages just below KERNEL_TEXT for the GDT, IDT, LDT, TSS and debug
- * info.
- *
- * For now, DEBUG_INFO_VA must be first in this list for "xm" initiated dumps
- * of solaris domUs to be usable with mdb. Relying on a fixed VA is not viable
- * long term, but it's the best we've got for now.
- */
-#if !defined(_ASM)
-#define	DEBUG_INFO_VA	(KERNEL_TEXT - MMU_PAGESIZE)
-#define	GDT_VA		(DEBUG_INFO_VA - MMU_PAGESIZE)
-#define	IDT_VA		(GDT_VA - MMU_PAGESIZE)
-#define	LDT_VA		(IDT_VA - (16 * MMU_PAGESIZE))
-#define	KTSS_VA		(LDT_VA - MMU_PAGESIZE)
-#define	DFTSS_VA	(KTSS_VA - MMU_PAGESIZE)
-#define	MISC_VA_BASE	(DFTSS_VA)
-#define	MISC_VA_SIZE	(KERNEL_TEXT - MISC_VA_BASE)
-#endif /* !_ASM */
-
 #if !defined(_ASM) && !defined(_KMDB)
 extern uintptr_t kernelbase, segmap_start, segmapsize;
 #endif
diff --git a/usr/src/uts/i86pc/sys/pc_hvm.h b/usr/src/uts/i86pc/sys/pc_hvm.h
new file mode 100644
index 0000000000..38acf052e4
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/pc_hvm.h
@@ -0,0 +1,35 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+
+#ifndef _PC_HVM_H
+#define	_PC_HVM_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if defined(_KERNEL)
+
+extern boolean_t hvm_excl_hold(const char *);
+extern void hvm_excl_rele(const char *);
+
+#endif /* defined(_KERNEL) */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _PC_HVM_H */
diff --git a/usr/src/uts/i86pc/sys/ppt_dev.h b/usr/src/uts/i86pc/sys/ppt_dev.h
new file mode 100644
index 0000000000..e25f941f14
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/ppt_dev.h
@@ -0,0 +1,56 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc
+ */
+
+#ifndef _PPT_DEV_H
+#define	_PPT_DEV_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define	PPT_IOC			(('P' << 16)|('T' << 8))
+
+#define	PPT_CFG_READ		(PPT_IOC | 0x01)
+#define	PPT_CFG_WRITE		(PPT_IOC | 0x02)
+#define	PPT_BAR_QUERY		(PPT_IOC | 0x03)
+#define	PPT_BAR_READ		(PPT_IOC | 0x04)
+#define	PPT_BAR_WRITE		(PPT_IOC | 0x05)
+
+#define	PPT_MAXNAMELEN	32
+
+struct ppt_cfg_io {
+	uint64_t pci_off;
+	uint32_t pci_width;
+	uint32_t pci_data;
+};
+struct ppt_bar_io {
+	uint32_t pbi_bar;
+	uint32_t pbi_off;
+	uint32_t pbi_width;
+	uint32_t pbi_data;
+};
+
+struct ppt_bar_query {
+	uint32_t pbq_baridx;
+	uint32_t pbq_type;
+	uint64_t pbq_base;
+	uint64_t pbq_size;
+};
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _PPT_DEV_H */
diff --git a/usr/src/uts/i86pc/sys/psm_types.h b/usr/src/uts/i86pc/sys/psm_types.h
index 24ad7d700f..e79e4c3d75 100644
--- a/usr/src/uts/i86pc/sys/psm_types.h
+++ b/usr/src/uts/i86pc/sys/psm_types.h
@@ -26,6 +26,7 @@
 /*
  * Copyright (c) 2010, Intel Corporation.
  * All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef	_SYS_PSM_TYPES_H
@@ -190,6 +191,10 @@ struct 	psm_ops {
 #endif
 #if defined(PSMI_1_7)
 	int	(*psm_cpu_ops)(psm_cpu_request_t *reqp);
+
+	int	(*psm_get_pir_ipivect)(void);
+	void	(*psm_send_pir_ipi)(processorid_t cpu);
+	void	(*psm_cmci_setup)(processorid_t cpu, boolean_t);
 #endif
 };
 
diff --git a/usr/src/uts/i86pc/sys/smp_impldefs.h b/usr/src/uts/i86pc/sys/smp_impldefs.h
index 77a203042c..cd3a607317 100644
--- a/usr/src/uts/i86pc/sys/smp_impldefs.h
+++ b/usr/src/uts/i86pc/sys/smp_impldefs.h
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef _SYS_SMP_IMPLDEFS_H
@@ -64,6 +65,7 @@ extern void (*psm_enable_intr)(processorid_t); /* enable intr to cpu	*/
 extern int (*psm_get_clockirq)(int); /* get clock vector		*/
 extern int (*psm_get_ipivect)(int, int); /* get interprocessor intr vec */
 extern int (*psm_clkinit)(int);	/* timer init entry point		*/
+extern int (*psm_cached_ipivect)(int, int); /* get cached ipi vec	*/
 extern void (*psm_timer_reprogram)(hrtime_t); /* timer reprogram	*/
 extern void (*psm_timer_enable)(void);		/* timer enable		*/
 extern void (*psm_timer_disable)(void);		/* timer disable	*/
@@ -72,6 +74,9 @@ extern int (*psm_state)(psm_state_request_t *); /* psm state save/restore */
 extern uchar_t (*psm_get_ioapicid)(uchar_t);	/* get io-apic id */
 extern uint32_t (*psm_get_localapicid)(uint32_t);	/* get local-apic id */
 extern uchar_t (*psm_xlate_vector_by_irq)(uchar_t); /* get vector for an irq */
+extern int (*psm_get_pir_ipivect)(void); /* get PIR (for VMM) ipi vect	*/
+extern void (*psm_send_pir_ipi)(processorid_t);	/* send PIR ipi		*/
+extern void (*psm_cmci_setup)(processorid_t, boolean_t); /* Control CPU CMCI */
 
 extern int (*slvltovect)(int);	/* ipl interrupt priority level		*/
 extern int (*setlvl)(int, int *); /* set intr pri represented by vect	*/
diff --git a/usr/src/uts/i86pc/sys/viona_io.h b/usr/src/uts/i86pc/sys/viona_io.h
new file mode 100644
index 0000000000..46cc72eb06
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/viona_io.h
@@ -0,0 +1,63 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2013 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef	_VIONA_IO_H_
+#define	_VIONA_IO_H_
+
+#define	VNA_IOC			(('V' << 16)|('C' << 8))
+#define	VNA_IOC_CREATE		(VNA_IOC | 0x01)
+#define	VNA_IOC_DELETE		(VNA_IOC | 0x02)
+
+#define	VNA_IOC_RING_INIT	(VNA_IOC | 0x10)
+#define	VNA_IOC_RING_RESET	(VNA_IOC | 0x11)
+#define	VNA_IOC_RING_KICK	(VNA_IOC | 0x12)
+#define	VNA_IOC_RING_SET_MSI	(VNA_IOC | 0x13)
+#define	VNA_IOC_RING_INTR_CLR	(VNA_IOC | 0x14)
+
+#define	VNA_IOC_INTR_POLL	(VNA_IOC | 0x20)
+#define	VNA_IOC_SET_FEATURES	(VNA_IOC | 0x21)
+#define	VNA_IOC_GET_FEATURES	(VNA_IOC | 0x22)
+#define	VNA_IOC_SET_NOTIFY_IOP	(VNA_IOC | 0x23)
+
+typedef struct vioc_create {
+	datalink_id_t	c_linkid;
+	int		c_vmfd;
+} vioc_create_t;
+
+typedef struct vioc_ring_init {
+	uint16_t	ri_index;
+	uint16_t	ri_qsize;
+	uint64_t	ri_qaddr;
+} vioc_ring_init_t;
+
+typedef struct vioc_ring_msi {
+	uint16_t	rm_index;
+	uint64_t	rm_addr;
+	uint64_t	rm_msg;
+} vioc_ring_msi_t;
+
+enum viona_vq_id {
+	VIONA_VQ_RX = 0,
+	VIONA_VQ_TX = 1,
+	VIONA_VQ_MAX = 2
+};
+
+typedef struct vioc_intr_poll {
+	uint32_t	vip_status[VIONA_VQ_MAX];
+} vioc_intr_poll_t;
+
+
+#endif	/* _VIONA_IO_H_ */
diff --git a/usr/src/uts/i86pc/sys/vm_machparam.h b/usr/src/uts/i86pc/sys/vm_machparam.h
index 90a5245217..fde81e59ed 100644
--- a/usr/src/uts/i86pc/sys/vm_machparam.h
+++ b/usr/src/uts/i86pc/sys/vm_machparam.h
@@ -23,6 +23,7 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #ifndef _SYS_VM_MACHPARAM_H
@@ -133,7 +134,8 @@ extern "C" {
 
 /*
  * The maximum value for handspreadpages which is the the distance
- * between the two clock hands in pages.
+ * between the two clock hands in pages. This is only used when the page
+ * scanner is first started.
  */
 #define	MAXHANDSPREADPAGES	((64 * 1024 * 1024) / PAGESIZE)
 
diff --git a/usr/src/uts/i86pc/sys/vmm.h b/usr/src/uts/i86pc/sys/vmm.h
new file mode 100644
index 0000000000..c200a5eb33
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/vmm.h
@@ -0,0 +1,757 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _VMM_H_
+#define	_VMM_H_
+
+#include <sys/sdt.h>
+#include <x86/segments.h>
+
+#ifdef _KERNEL
+SDT_PROVIDER_DECLARE(vmm);
+#endif
+
+enum vm_suspend_how {
+	VM_SUSPEND_NONE,
+	VM_SUSPEND_RESET,
+	VM_SUSPEND_POWEROFF,
+	VM_SUSPEND_HALT,
+	VM_SUSPEND_TRIPLEFAULT,
+	VM_SUSPEND_LAST
+};
+
+/*
+ * Identifiers for architecturally defined registers.
+ */
+enum vm_reg_name {
+	VM_REG_GUEST_RAX,
+	VM_REG_GUEST_RBX,
+	VM_REG_GUEST_RCX,
+	VM_REG_GUEST_RDX,
+	VM_REG_GUEST_RSI,
+	VM_REG_GUEST_RDI,
+	VM_REG_GUEST_RBP,
+	VM_REG_GUEST_R8,
+	VM_REG_GUEST_R9,
+	VM_REG_GUEST_R10,
+	VM_REG_GUEST_R11,
+	VM_REG_GUEST_R12,
+	VM_REG_GUEST_R13,
+	VM_REG_GUEST_R14,
+	VM_REG_GUEST_R15,
+	VM_REG_GUEST_CR0,
+	VM_REG_GUEST_CR3,
+	VM_REG_GUEST_CR4,
+	VM_REG_GUEST_DR7,
+	VM_REG_GUEST_RSP,
+	VM_REG_GUEST_RIP,
+	VM_REG_GUEST_RFLAGS,
+	VM_REG_GUEST_ES,
+	VM_REG_GUEST_CS,
+	VM_REG_GUEST_SS,
+	VM_REG_GUEST_DS,
+	VM_REG_GUEST_FS,
+	VM_REG_GUEST_GS,
+	VM_REG_GUEST_LDTR,
+	VM_REG_GUEST_TR,
+	VM_REG_GUEST_IDTR,
+	VM_REG_GUEST_GDTR,
+	VM_REG_GUEST_EFER,
+	VM_REG_GUEST_CR2,
+	VM_REG_GUEST_PDPTE0,
+	VM_REG_GUEST_PDPTE1,
+	VM_REG_GUEST_PDPTE2,
+	VM_REG_GUEST_PDPTE3,
+	VM_REG_GUEST_INTR_SHADOW,
+	VM_REG_GUEST_DR0,
+	VM_REG_GUEST_DR1,
+	VM_REG_GUEST_DR2,
+	VM_REG_GUEST_DR3,
+	VM_REG_GUEST_DR6,
+	VM_REG_LAST
+};
+
+enum x2apic_state {
+	X2APIC_DISABLED,
+	X2APIC_ENABLED,
+	X2APIC_STATE_LAST
+};
+
+#define	VM_INTINFO_VECTOR(info)	((info) & 0xff)
+#define	VM_INTINFO_DEL_ERRCODE	0x800
+#define	VM_INTINFO_RSVD		0x7ffff000
+#define	VM_INTINFO_VALID	0x80000000
+#define	VM_INTINFO_TYPE		0x700
+#define	VM_INTINFO_HWINTR	(0 << 8)
+#define	VM_INTINFO_NMI		(2 << 8)
+#define	VM_INTINFO_HWEXCEPTION	(3 << 8)
+#define	VM_INTINFO_SWINTR	(4 << 8)
+
+
+#define	VM_MAX_NAMELEN	32
+
+#ifdef _KERNEL
+
+struct vm;
+struct vm_exception;
+struct seg_desc;
+struct vm_exit;
+struct vm_run;
+struct vhpet;
+struct vioapic;
+struct vlapic;
+struct vmspace;
+struct vm_object;
+struct vm_guest_paging;
+struct pmap;
+
+struct vm_eventinfo {
+	void	*rptr;		/* rendezvous cookie */
+	int	*sptr;		/* suspend cookie */
+	int	*iptr;		/* reqidle cookie */
+};
+
+typedef int	(*vmm_init_func_t)(int ipinum);
+typedef int	(*vmm_cleanup_func_t)(void);
+typedef void	(*vmm_resume_func_t)(void);
+typedef void *	(*vmi_init_func_t)(struct vm *vm, struct pmap *pmap);
+typedef int	(*vmi_run_func_t)(void *vmi, int vcpu, register_t rip,
+		    struct pmap *pmap, struct vm_eventinfo *info);
+typedef void	(*vmi_cleanup_func_t)(void *vmi);
+typedef int	(*vmi_get_register_t)(void *vmi, int vcpu, int num,
+				      uint64_t *retval);
+typedef int	(*vmi_set_register_t)(void *vmi, int vcpu, int num,
+				      uint64_t val);
+typedef int	(*vmi_get_desc_t)(void *vmi, int vcpu, int num,
+				  struct seg_desc *desc);
+typedef int	(*vmi_set_desc_t)(void *vmi, int vcpu, int num,
+				  struct seg_desc *desc);
+typedef int	(*vmi_get_cap_t)(void *vmi, int vcpu, int num, int *retval);
+typedef int	(*vmi_set_cap_t)(void *vmi, int vcpu, int num, int val);
+typedef struct vmspace * (*vmi_vmspace_alloc)(vm_offset_t min, vm_offset_t max);
+typedef void	(*vmi_vmspace_free)(struct vmspace *vmspace);
+typedef struct vlapic * (*vmi_vlapic_init)(void *vmi, int vcpu);
+typedef void	(*vmi_vlapic_cleanup)(void *vmi, struct vlapic *vlapic);
+#ifndef __FreeBSD__
+typedef void	(*vmi_savectx)(void *vmi, int vcpu);
+typedef void	(*vmi_restorectx)(void *vmi, int vcpu);
+#endif
+
+struct vmm_ops {
+	vmm_init_func_t		init;		/* module wide initialization */
+	vmm_cleanup_func_t	cleanup;
+	vmm_resume_func_t	resume;
+
+	vmi_init_func_t		vminit;		/* vm-specific initialization */
+	vmi_run_func_t		vmrun;
+	vmi_cleanup_func_t	vmcleanup;
+	vmi_get_register_t	vmgetreg;
+	vmi_set_register_t	vmsetreg;
+	vmi_get_desc_t		vmgetdesc;
+	vmi_set_desc_t		vmsetdesc;
+	vmi_get_cap_t		vmgetcap;
+	vmi_set_cap_t		vmsetcap;
+	vmi_vmspace_alloc	vmspace_alloc;
+	vmi_vmspace_free	vmspace_free;
+	vmi_vlapic_init		vlapic_init;
+	vmi_vlapic_cleanup	vlapic_cleanup;
+
+#ifndef __FreeBSD__
+	vmi_savectx		vmsavectx;
+	vmi_restorectx		vmrestorectx;
+#endif
+};
+
+extern struct vmm_ops vmm_ops_intel;
+extern struct vmm_ops vmm_ops_amd;
+
+int vm_create(const char *name, struct vm **retvm);
+void vm_destroy(struct vm *vm);
+int vm_reinit(struct vm *vm);
+const char *vm_name(struct vm *vm);
+void vm_get_topology(struct vm *vm, uint16_t *sockets, uint16_t *cores,
+    uint16_t *threads, uint16_t *maxcpus);
+int vm_set_topology(struct vm *vm, uint16_t sockets, uint16_t cores,
+    uint16_t threads, uint16_t maxcpus);
+
+/*
+ * APIs that modify the guest memory map require all vcpus to be frozen.
+ */
+int vm_mmap_memseg(struct vm *vm, vm_paddr_t gpa, int segid, vm_ooffset_t off,
+    size_t len, int prot, int flags);
+int vm_alloc_memseg(struct vm *vm, int ident, size_t len, bool sysmem);
+void vm_free_memseg(struct vm *vm, int ident);
+int vm_map_mmio(struct vm *vm, vm_paddr_t gpa, size_t len, vm_paddr_t hpa);
+int vm_unmap_mmio(struct vm *vm, vm_paddr_t gpa, size_t len);
+#ifdef __FreeBSD__
+int vm_assign_pptdev(struct vm *vm, int bus, int slot, int func);
+int vm_unassign_pptdev(struct vm *vm, int bus, int slot, int func);
+#else
+int vm_assign_pptdev(struct vm *vm, int pptfd);
+int vm_unassign_pptdev(struct vm *vm, int pptfd);
+#endif /* __FreeBSD__ */
+
+/*
+ * APIs that inspect the guest memory map require only a *single* vcpu to
+ * be frozen. This acts like a read lock on the guest memory map since any
+ * modification requires *all* vcpus to be frozen.
+ */
+int vm_mmap_getnext(struct vm *vm, vm_paddr_t *gpa, int *segid,
+    vm_ooffset_t *segoff, size_t *len, int *prot, int *flags);
+int vm_get_memseg(struct vm *vm, int ident, size_t *len, bool *sysmem,
+    struct vm_object **objptr);
+void *vm_gpa_hold(struct vm *, int vcpuid, vm_paddr_t gpa, size_t len,
+    int prot, void **cookie);
+void vm_gpa_release(void *cookie);
+bool vm_mem_allocated(struct vm *vm, int vcpuid, vm_paddr_t gpa);
+
+int vm_get_register(struct vm *vm, int vcpu, int reg, uint64_t *retval);
+int vm_set_register(struct vm *vm, int vcpu, int reg, uint64_t val);
+int vm_get_seg_desc(struct vm *vm, int vcpu, int reg,
+		    struct seg_desc *ret_desc);
+int vm_set_seg_desc(struct vm *vm, int vcpu, int reg,
+		    struct seg_desc *desc);
+int vm_run(struct vm *vm, struct vm_run *vmrun);
+int vm_suspend(struct vm *vm, enum vm_suspend_how how);
+int vm_inject_nmi(struct vm *vm, int vcpu);
+int vm_nmi_pending(struct vm *vm, int vcpuid);
+void vm_nmi_clear(struct vm *vm, int vcpuid);
+int vm_inject_extint(struct vm *vm, int vcpu);
+int vm_extint_pending(struct vm *vm, int vcpuid);
+void vm_extint_clear(struct vm *vm, int vcpuid);
+struct vlapic *vm_lapic(struct vm *vm, int cpu);
+struct vioapic *vm_ioapic(struct vm *vm);
+struct vhpet *vm_hpet(struct vm *vm);
+int vm_get_capability(struct vm *vm, int vcpu, int type, int *val);
+int vm_set_capability(struct vm *vm, int vcpu, int type, int val);
+int vm_get_x2apic_state(struct vm *vm, int vcpu, enum x2apic_state *state);
+int vm_set_x2apic_state(struct vm *vm, int vcpu, enum x2apic_state state);
+int vm_apicid2vcpuid(struct vm *vm, int apicid);
+int vm_activate_cpu(struct vm *vm, int vcpu);
+int vm_suspend_cpu(struct vm *vm, int vcpu);
+int vm_resume_cpu(struct vm *vm, int vcpu);
+struct vm_exit *vm_exitinfo(struct vm *vm, int vcpuid);
+void vm_exit_suspended(struct vm *vm, int vcpuid, uint64_t rip);
+void vm_exit_debug(struct vm *vm, int vcpuid, uint64_t rip);
+void vm_exit_rendezvous(struct vm *vm, int vcpuid, uint64_t rip);
+void vm_exit_astpending(struct vm *vm, int vcpuid, uint64_t rip);
+void vm_exit_reqidle(struct vm *vm, int vcpuid, uint64_t rip);
+
+#ifdef _SYS__CPUSET_H_
+/*
+ * Rendezvous all vcpus specified in 'dest' and execute 'func(arg)'.
+ * The rendezvous 'func(arg)' is not allowed to do anything that will
+ * cause the thread to be put to sleep.
+ *
+ * If the rendezvous is being initiated from a vcpu context then the
+ * 'vcpuid' must refer to that vcpu, otherwise it should be set to -1.
+ *
+ * The caller cannot hold any locks when initiating the rendezvous.
+ *
+ * The implementation of this API may cause vcpus other than those specified
+ * by 'dest' to be stalled. The caller should not rely on any vcpus making
+ * forward progress when the rendezvous is in progress.
+ */
+typedef void (*vm_rendezvous_func_t)(struct vm *vm, int vcpuid, void *arg);
+void vm_smp_rendezvous(struct vm *vm, int vcpuid, cpuset_t dest,
+    vm_rendezvous_func_t func, void *arg);
+cpuset_t vm_active_cpus(struct vm *vm);
+cpuset_t vm_debug_cpus(struct vm *vm);
+cpuset_t vm_suspended_cpus(struct vm *vm);
+#endif	/* _SYS__CPUSET_H_ */
+
+static __inline int
+vcpu_rendezvous_pending(struct vm_eventinfo *info)
+{
+
+	return (*((uintptr_t *)(info->rptr)) != 0);
+}
+
+static __inline int
+vcpu_suspended(struct vm_eventinfo *info)
+{
+
+	return (*info->sptr);
+}
+
+static __inline int
+vcpu_reqidle(struct vm_eventinfo *info)
+{
+
+	return (*info->iptr);
+}
+
+int vcpu_debugged(struct vm *vm, int vcpuid);
+
+/*
+ * Return 1 if device indicated by bus/slot/func is supposed to be a
+ * pci passthrough device.
+ *
+ * Return 0 otherwise.
+ */
+int vmm_is_pptdev(int bus, int slot, int func);
+
+void *vm_iommu_domain(struct vm *vm);
+
+enum vcpu_state {
+	VCPU_IDLE,
+	VCPU_FROZEN,
+	VCPU_RUNNING,
+	VCPU_SLEEPING,
+};
+
+int vcpu_set_state(struct vm *vm, int vcpu, enum vcpu_state state,
+    bool from_idle);
+enum vcpu_state vcpu_get_state(struct vm *vm, int vcpu, int *hostcpu);
+#ifndef __FreeBSD__
+uint64_t vcpu_tsc_offset(struct vm *vm, int vcpuid);
+#endif
+
+static __inline int
+vcpu_is_running(struct vm *vm, int vcpu, int *hostcpu)
+{
+	return (vcpu_get_state(vm, vcpu, hostcpu) == VCPU_RUNNING);
+}
+
+#ifdef _SYS_THREAD_H
+static __inline int
+vcpu_should_yield(struct vm *vm, int vcpu)
+{
+
+	if (curthread->t_astflag)
+		return (1);
+	else if (CPU->cpu_runrun)
+		return (1);
+	else
+		return (0);
+}
+#endif /* _SYS_THREAD_H */
+
+void *vcpu_stats(struct vm *vm, int vcpu);
+void vcpu_notify_event(struct vm *vm, int vcpuid, bool lapic_intr);
+struct vmspace *vm_get_vmspace(struct vm *vm);
+struct vatpic *vm_atpic(struct vm *vm);
+struct vatpit *vm_atpit(struct vm *vm);
+struct vpmtmr *vm_pmtmr(struct vm *vm);
+struct vrtc *vm_rtc(struct vm *vm);
+
+/*
+ * Inject exception 'vector' into the guest vcpu. This function returns 0 on
+ * success and non-zero on failure.
+ *
+ * Wrapper functions like 'vm_inject_gp()' should be preferred to calling
+ * this function directly because they enforce the trap-like or fault-like
+ * behavior of an exception.
+ *
+ * This function should only be called in the context of the thread that is
+ * executing this vcpu.
+ */
+int vm_inject_exception(struct vm *vm, int vcpuid, int vector, int err_valid,
+    uint32_t errcode, int restart_instruction);
+
+/*
+ * This function is called after a VM-exit that occurred during exception or
+ * interrupt delivery through the IDT. The format of 'intinfo' is described
+ * in Figure 15-1, "EXITINTINFO for All Intercepts", APM, Vol 2.
+ *
+ * If a VM-exit handler completes the event delivery successfully then it
+ * should call vm_exit_intinfo() to extinguish the pending event. For e.g.,
+ * if the task switch emulation is triggered via a task gate then it should
+ * call this function with 'intinfo=0' to indicate that the external event
+ * is not pending anymore.
+ *
+ * Return value is 0 on success and non-zero on failure.
+ */
+int vm_exit_intinfo(struct vm *vm, int vcpuid, uint64_t intinfo);
+
+/*
+ * This function is called before every VM-entry to retrieve a pending
+ * event that should be injected into the guest. This function combines
+ * nested events into a double or triple fault.
+ *
+ * Returns 0 if there are no events that need to be injected into the guest
+ * and non-zero otherwise.
+ */
+int vm_entry_intinfo(struct vm *vm, int vcpuid, uint64_t *info);
+
+int vm_get_intinfo(struct vm *vm, int vcpuid, uint64_t *info1, uint64_t *info2);
+
+enum vm_reg_name vm_segment_name(int seg_encoding);
+
+struct vm_copyinfo {
+	uint64_t	gpa;
+	size_t		len;
+	void		*hva;
+	void		*cookie;
+};
+
+/*
+ * Set up 'copyinfo[]' to copy to/from guest linear address space starting
+ * at 'gla' and 'len' bytes long. The 'prot' should be set to PROT_READ for
+ * a copyin or PROT_WRITE for a copyout. 
+ *
+ * retval	is_fault	Interpretation
+ *   0		   0		Success
+ *   0		   1		An exception was injected into the guest
+ * EFAULT	  N/A		Unrecoverable error
+ *
+ * The 'copyinfo[]' can be passed to 'vm_copyin()' or 'vm_copyout()' only if
+ * the return value is 0. The 'copyinfo[]' resources should be freed by calling
+ * 'vm_copy_teardown()' after the copy is done.
+ */
+int vm_copy_setup(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t gla, size_t len, int prot, struct vm_copyinfo *copyinfo,
+    int num_copyinfo, int *is_fault);
+void vm_copy_teardown(struct vm *vm, int vcpuid, struct vm_copyinfo *copyinfo,
+    int num_copyinfo);
+void vm_copyin(struct vm *vm, int vcpuid, struct vm_copyinfo *copyinfo,
+    void *kaddr, size_t len);
+void vm_copyout(struct vm *vm, int vcpuid, const void *kaddr,
+    struct vm_copyinfo *copyinfo, size_t len);
+
+int vcpu_trace_exceptions(struct vm *vm, int vcpuid);
+#endif	/* KERNEL */
+
+#define	VM_MAXCPU	32			/* maximum virtual cpus */
+
+/*
+ * Identifiers for optional vmm capabilities
+ */
+enum vm_cap_type {
+	VM_CAP_HALT_EXIT,
+	VM_CAP_MTRAP_EXIT,
+	VM_CAP_PAUSE_EXIT,
+	VM_CAP_UNRESTRICTED_GUEST,
+	VM_CAP_ENABLE_INVPCID,
+	VM_CAP_MAX
+};
+
+enum vm_intr_trigger {
+	EDGE_TRIGGER,
+	LEVEL_TRIGGER
+};
+	
+/*
+ * The 'access' field has the format specified in Table 21-2 of the Intel
+ * Architecture Manual vol 3b.
+ *
+ * XXX The contents of the 'access' field are architecturally defined except
+ * bit 16 - Segment Unusable.
+ */
+struct seg_desc {
+	uint64_t	base;
+	uint32_t	limit;
+	uint32_t	access;
+};
+#define	SEG_DESC_TYPE(access)		((access) & 0x001f)
+#define	SEG_DESC_DPL(access)		(((access) >> 5) & 0x3)
+#define	SEG_DESC_PRESENT(access)	(((access) & 0x0080) ? 1 : 0)
+#define	SEG_DESC_DEF32(access)		(((access) & 0x4000) ? 1 : 0)
+#define	SEG_DESC_GRANULARITY(access)	(((access) & 0x8000) ? 1 : 0)
+#define	SEG_DESC_UNUSABLE(access)	(((access) & 0x10000) ? 1 : 0)
+
+enum vm_cpu_mode {
+	CPU_MODE_REAL,
+	CPU_MODE_PROTECTED,
+	CPU_MODE_COMPATIBILITY,		/* IA-32E mode (CS.L = 0) */
+	CPU_MODE_64BIT,			/* IA-32E mode (CS.L = 1) */
+};
+
+enum vm_paging_mode {
+	PAGING_MODE_FLAT,
+	PAGING_MODE_32,
+	PAGING_MODE_PAE,
+	PAGING_MODE_64,
+};
+
+struct vm_guest_paging {
+	uint64_t	cr3;
+	int		cpl;
+	enum vm_cpu_mode cpu_mode;
+	enum vm_paging_mode paging_mode;
+};
+
+/*
+ * The data structures 'vie' and 'vie_op' are meant to be opaque to the
+ * consumers of instruction decoding. The only reason why their contents
+ * need to be exposed is because they are part of the 'vm_exit' structure.
+ */
+struct vie_op {
+	uint8_t		op_byte;	/* actual opcode byte */
+	uint8_t		op_type;	/* type of operation (e.g. MOV) */
+	uint16_t	op_flags;
+};
+
+#define	VIE_INST_SIZE	15
+struct vie {
+	uint8_t		inst[VIE_INST_SIZE];	/* instruction bytes */
+	uint8_t		num_valid;		/* size of the instruction */
+	uint8_t		num_processed;
+
+	uint8_t		addrsize:4, opsize:4;	/* address and operand sizes */
+	uint8_t		rex_w:1,		/* REX prefix */
+			rex_r:1,
+			rex_x:1,
+			rex_b:1,
+			rex_present:1,
+			repz_present:1,		/* REP/REPE/REPZ prefix */
+			repnz_present:1,	/* REPNE/REPNZ prefix */
+			opsize_override:1,	/* Operand size override */
+			addrsize_override:1,	/* Address size override */
+			segment_override:1;	/* Segment override */
+
+	uint8_t		mod:2,			/* ModRM byte */
+			reg:4,
+			rm:4;
+
+	uint8_t		ss:2,			/* SIB byte */
+			index:4,
+			base:4;
+
+	uint8_t		disp_bytes;
+	uint8_t		imm_bytes;
+
+	uint8_t		scale;
+	int		base_register;		/* VM_REG_GUEST_xyz */
+	int		index_register;		/* VM_REG_GUEST_xyz */
+	int		segment_register;	/* VM_REG_GUEST_xyz */
+
+	int64_t		displacement;		/* optional addr displacement */
+	int64_t		immediate;		/* optional immediate operand */
+
+	uint8_t		decoded;	/* set to 1 if successfully decoded */
+
+	struct vie_op	op;			/* opcode description */
+};
+
+enum vm_exitcode {
+	VM_EXITCODE_INOUT,
+	VM_EXITCODE_VMX,
+	VM_EXITCODE_BOGUS,
+	VM_EXITCODE_RDMSR,
+	VM_EXITCODE_WRMSR,
+	VM_EXITCODE_HLT,
+	VM_EXITCODE_MTRAP,
+	VM_EXITCODE_PAUSE,
+	VM_EXITCODE_PAGING,
+	VM_EXITCODE_INST_EMUL,
+	VM_EXITCODE_SPINUP_AP,
+	VM_EXITCODE_DEPRECATED1,	/* used to be SPINDOWN_CPU */
+	VM_EXITCODE_RENDEZVOUS,
+	VM_EXITCODE_IOAPIC_EOI,
+	VM_EXITCODE_SUSPENDED,
+	VM_EXITCODE_INOUT_STR,
+	VM_EXITCODE_TASK_SWITCH,
+	VM_EXITCODE_MONITOR,
+	VM_EXITCODE_MWAIT,
+	VM_EXITCODE_SVM,
+	VM_EXITCODE_REQIDLE,
+	VM_EXITCODE_DEBUG,
+#ifndef	__FreeBSD__
+	VM_EXITCODE_HT,
+#endif
+	VM_EXITCODE_MAX
+};
+
+struct vm_inout {
+	uint16_t	bytes:3;	/* 1 or 2 or 4 */
+	uint16_t	in:1;
+	uint16_t	string:1;
+	uint16_t	rep:1;
+	uint16_t	port;
+	uint32_t	eax;		/* valid for out */
+};
+
+struct vm_inout_str {
+	struct vm_inout	inout;		/* must be the first element */
+	struct vm_guest_paging paging;
+	uint64_t	rflags;
+	uint64_t	cr0;
+	uint64_t	index;
+	uint64_t	count;		/* rep=1 (%rcx), rep=0 (1) */
+	int		addrsize;
+	enum vm_reg_name seg_name;
+	struct seg_desc seg_desc;
+};
+
+enum task_switch_reason {
+	TSR_CALL,
+	TSR_IRET,
+	TSR_JMP,
+	TSR_IDT_GATE,	/* task gate in IDT */
+};
+
+struct vm_task_switch {
+	uint16_t	tsssel;		/* new TSS selector */
+	int		ext;		/* task switch due to external event */
+	uint32_t	errcode;
+	int		errcode_valid;	/* push 'errcode' on the new stack */
+	enum task_switch_reason reason;
+	struct vm_guest_paging paging;
+};
+
+struct vm_exit {
+	enum vm_exitcode	exitcode;
+	int			inst_length;	/* 0 means unknown */
+	uint64_t		rip;
+	union {
+		struct vm_inout	inout;
+		struct vm_inout_str inout_str;
+		struct {
+			uint64_t	gpa;
+			int		fault_type;
+		} paging;
+		struct {
+			uint64_t	gpa;
+			uint64_t	gla;
+			uint64_t	cs_base;
+			int		cs_d;		/* CS.D */
+			struct vm_guest_paging paging;
+			struct vie	vie;
+		} inst_emul;
+		/*
+		 * VMX specific payload. Used when there is no "better"
+		 * exitcode to represent the VM-exit.
+		 */
+		struct {
+			int		status;		/* vmx inst status */
+			/*
+			 * 'exit_reason' and 'exit_qualification' are valid
+			 * only if 'status' is zero.
+			 */
+			uint32_t	exit_reason;
+			uint64_t	exit_qualification;
+			/*
+			 * 'inst_error' and 'inst_type' are valid
+			 * only if 'status' is non-zero.
+			 */
+			int		inst_type;
+			int		inst_error;
+		} vmx;
+		/*
+		 * SVM specific payload.
+		 */
+		struct {
+			uint64_t	exitcode;
+			uint64_t	exitinfo1;
+			uint64_t	exitinfo2;
+		} svm;
+		struct {
+			uint32_t	code;		/* ecx value */
+			uint64_t	wval;
+		} msr;
+		struct {
+			int		vcpu;
+			uint64_t	rip;
+		} spinup_ap;
+		struct {
+			uint64_t	rflags;
+			uint64_t	intr_status;
+		} hlt;
+		struct {
+			int		vector;
+		} ioapic_eoi;
+		struct {
+			enum vm_suspend_how how;
+		} suspended;
+		struct vm_task_switch task_switch;
+	} u;
+};
+
+/* APIs to inject faults into the guest */
+void vm_inject_fault(void *vm, int vcpuid, int vector, int errcode_valid,
+    int errcode);
+
+static __inline void
+vm_inject_ud(void *vm, int vcpuid)
+{
+	vm_inject_fault(vm, vcpuid, IDT_UD, 0, 0);
+}
+
+static __inline void
+vm_inject_gp(void *vm, int vcpuid)
+{
+	vm_inject_fault(vm, vcpuid, IDT_GP, 1, 0);
+}
+
+static __inline void
+vm_inject_ac(void *vm, int vcpuid, int errcode)
+{
+	vm_inject_fault(vm, vcpuid, IDT_AC, 1, errcode);
+}
+
+static __inline void
+vm_inject_ss(void *vm, int vcpuid, int errcode)
+{
+	vm_inject_fault(vm, vcpuid, IDT_SS, 1, errcode);
+}
+
+void vm_inject_pf(void *vm, int vcpuid, int error_code, uint64_t cr2);
+
+int vm_restart_instruction(void *vm, int vcpuid);
+
+#ifndef	__FreeBSD__
+#ifdef	_KERNEL
+
+void vmm_sol_glue_init(void);
+void vmm_sol_glue_cleanup(void);
+
+int vmm_mod_load(void);
+int vmm_mod_unload(void);
+
+/*
+ * Because of tangled headers, these are mirrored by vmm_drv.h to present the
+ * interface to driver consumers.
+ */
+typedef int (*vmm_rmem_cb_t)(void *, uintptr_t, uint_t, uint64_t *);
+typedef int (*vmm_wmem_cb_t)(void *, uintptr_t, uint_t, uint64_t);
+
+int vm_ioport_hook(struct vm *, uint_t, vmm_rmem_cb_t, vmm_wmem_cb_t, void *,
+    void **);
+void vm_ioport_unhook(struct vm *, void **);
+int vm_ioport_handle_hook(struct vm *, int, bool, int, int, uint32_t *);
+
+#endif /* _KERNEL */
+#endif /* __FreeBSD */
+
+#endif	/* _VMM_H_ */
diff --git a/usr/src/uts/i86pc/sys/vmm_dev.h b/usr/src/uts/i86pc/sys/vmm_dev.h
new file mode 100644
index 0000000000..63ccc36dc6
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/vmm_dev.h
@@ -0,0 +1,518 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef	_VMM_DEV_H_
+#define	_VMM_DEV_H_
+
+#include <machine/vmm.h>
+
+struct vm_memmap {
+	vm_paddr_t	gpa;
+	int		segid;		/* memory segment */
+	vm_ooffset_t	segoff;		/* offset into memory segment */
+	size_t		len;		/* mmap length */
+	int		prot;		/* RWX */
+	int		flags;
+};
+#define	VM_MEMMAP_F_WIRED	0x01
+#define	VM_MEMMAP_F_IOMMU	0x02
+
+#define	VM_MEMSEG_NAME(m)	((m)->name[0] != '\0' ? (m)->name : NULL)
+struct vm_memseg {
+	int		segid;
+	size_t		len;
+	char		name[SPECNAMELEN + 1];
+};
+
+struct vm_register {
+	int		cpuid;
+	int		regnum;		/* enum vm_reg_name */
+	uint64_t	regval;
+};
+
+struct vm_seg_desc {			/* data or code segment */
+	int		cpuid;
+	int		regnum;		/* enum vm_reg_name */
+	struct seg_desc desc;
+};
+
+struct vm_register_set {
+	int		cpuid;
+	unsigned int	count;
+	const int	*regnums;	/* enum vm_reg_name */
+	uint64_t	*regvals;
+};
+
+struct vm_run {
+	int		cpuid;
+	struct vm_exit	vm_exit;
+};
+
+struct vm_exception {
+	int		cpuid;
+	int		vector;
+	uint32_t	error_code;
+	int		error_code_valid;
+	int		restart_instruction;
+};
+
+struct vm_lapic_msi {
+	uint64_t	msg;
+	uint64_t	addr;
+};
+
+struct vm_lapic_irq {
+	int		cpuid;
+	int		vector;
+};
+
+struct vm_ioapic_irq {
+	int		irq;
+};
+
+struct vm_isa_irq {
+	int		atpic_irq;
+	int		ioapic_irq;
+};
+
+struct vm_isa_irq_trigger {
+	int		atpic_irq;
+	enum vm_intr_trigger trigger;
+};
+
+struct vm_capability {
+	int		cpuid;
+	enum vm_cap_type captype;
+	int		capval;
+	int		allcpus;
+};
+
+#ifdef __FreeBSD__
+struct vm_pptdev {
+	int		bus;
+	int		slot;
+	int		func;
+};
+
+struct vm_pptdev_mmio {
+	int		bus;
+	int		slot;
+	int		func;
+	vm_paddr_t	gpa;
+	vm_paddr_t	hpa;
+	size_t		len;
+};
+
+struct vm_pptdev_msi {
+	int		vcpu;
+	int		bus;
+	int		slot;
+	int		func;
+	int		numvec;		/* 0 means disabled */
+	uint64_t	msg;
+	uint64_t	addr;
+};
+
+struct vm_pptdev_msix {
+	int		vcpu;
+	int		bus;
+	int		slot;
+	int		func;
+	int		idx;
+	uint64_t	msg;
+	uint32_t	vector_control;
+	uint64_t	addr;
+};
+
+struct vm_pptdev_limits {
+	int		bus;
+	int		slot;
+	int		func;
+	int		msi_limit;
+	int		msix_limit;
+};
+#else /* __FreeBSD__ */
+struct vm_pptdev {
+	int		pptfd;
+};
+
+struct vm_pptdev_mmio {
+	int		pptfd;
+	vm_paddr_t	gpa;
+	vm_paddr_t	hpa;
+	size_t		len;
+};
+
+struct vm_pptdev_msi {
+	int		vcpu;
+	int		pptfd;
+	int		numvec;		/* 0 means disabled */
+	uint64_t	msg;
+	uint64_t	addr;
+};
+
+struct vm_pptdev_msix {
+	int		vcpu;
+	int		pptfd;
+	int		idx;
+	uint64_t	msg;
+	uint32_t	vector_control;
+	uint64_t	addr;
+};
+
+struct vm_pptdev_limits {
+	int		pptfd;
+	int		msi_limit;
+	int		msix_limit;
+};
+#endif /* __FreeBSD__ */
+
+struct vm_nmi {
+	int		cpuid;
+};
+
+#ifdef __FreeBSD__
+#define	MAX_VM_STATS	64
+#else
+#define	MAX_VM_STATS	(64 + VM_MAXCPU)
+#endif
+
+struct vm_stats {
+	int		cpuid;				/* in */
+	int		num_entries;			/* out */
+	struct timeval	tv;
+	uint64_t	statbuf[MAX_VM_STATS];
+};
+
+struct vm_stat_desc {
+	int		index;				/* in */
+	char		desc[128];			/* out */
+};
+
+struct vm_x2apic {
+	int			cpuid;
+	enum x2apic_state	state;
+};
+
+struct vm_gpa_pte {
+	uint64_t	gpa;				/* in */
+	uint64_t	pte[4];				/* out */
+	int		ptenum;
+};
+
+struct vm_hpet_cap {
+	uint32_t	capabilities;	/* lower 32 bits of HPET capabilities */
+};
+
+struct vm_suspend {
+	enum vm_suspend_how how;
+};
+
+struct vm_gla2gpa {
+	int		vcpuid;		/* inputs */
+	int 		prot;		/* PROT_READ or PROT_WRITE */
+	uint64_t	gla;
+	struct vm_guest_paging paging;
+	int		fault;		/* outputs */
+	uint64_t	gpa;
+};
+
+struct vm_activate_cpu {
+	int		vcpuid;
+};
+
+struct vm_cpuset {
+	int		which;
+	int		cpusetsize;
+#ifndef _KERNEL
+	cpuset_t	*cpus;
+#else
+	void		*cpus;
+#endif
+};
+#define	VM_ACTIVE_CPUS		0
+#define	VM_SUSPENDED_CPUS	1
+#define	VM_DEBUG_CPUS		2
+
+struct vm_intinfo {
+	int		vcpuid;
+	uint64_t	info1;
+	uint64_t	info2;
+};
+
+struct vm_rtc_time {
+	time_t		secs;
+};
+
+struct vm_rtc_data {
+	int		offset;
+	uint8_t		value;
+};
+
+#ifndef __FreeBSD__
+struct vm_devmem_offset {
+	int		segid;
+	off_t		offset;
+};
+#endif
+
+struct vm_cpu_topology {
+	uint16_t	sockets;
+	uint16_t	cores;
+	uint16_t	threads;
+	uint16_t	maxcpus;
+};
+
+enum {
+	/* general routines */
+	IOCNUM_ABIVERS = 0,
+	IOCNUM_RUN = 1,
+	IOCNUM_SET_CAPABILITY = 2,
+	IOCNUM_GET_CAPABILITY = 3,
+	IOCNUM_SUSPEND = 4,
+	IOCNUM_REINIT = 5,
+
+	/* memory apis */
+	IOCNUM_MAP_MEMORY = 10,			/* deprecated */
+	IOCNUM_GET_MEMORY_SEG = 11,		/* deprecated */
+	IOCNUM_GET_GPA_PMAP = 12,
+	IOCNUM_GLA2GPA = 13,
+	IOCNUM_ALLOC_MEMSEG = 14,
+	IOCNUM_GET_MEMSEG = 15,
+	IOCNUM_MMAP_MEMSEG = 16,
+	IOCNUM_MMAP_GETNEXT = 17,
+	IOCNUM_GLA2GPA_NOFAULT = 18,
+
+	/* register/state accessors */
+	IOCNUM_SET_REGISTER = 20,
+	IOCNUM_GET_REGISTER = 21,
+	IOCNUM_SET_SEGMENT_DESCRIPTOR = 22,
+	IOCNUM_GET_SEGMENT_DESCRIPTOR = 23,
+	IOCNUM_SET_REGISTER_SET = 24,
+	IOCNUM_GET_REGISTER_SET = 25,
+
+	/* interrupt injection */
+	IOCNUM_GET_INTINFO = 28,
+	IOCNUM_SET_INTINFO = 29,
+	IOCNUM_INJECT_EXCEPTION = 30,
+	IOCNUM_LAPIC_IRQ = 31,
+	IOCNUM_INJECT_NMI = 32,
+	IOCNUM_IOAPIC_ASSERT_IRQ = 33,
+	IOCNUM_IOAPIC_DEASSERT_IRQ = 34,
+	IOCNUM_IOAPIC_PULSE_IRQ = 35,
+	IOCNUM_LAPIC_MSI = 36,
+	IOCNUM_LAPIC_LOCAL_IRQ = 37,
+	IOCNUM_IOAPIC_PINCOUNT = 38,
+	IOCNUM_RESTART_INSTRUCTION = 39,
+
+	/* PCI pass-thru */
+	IOCNUM_BIND_PPTDEV = 40,
+	IOCNUM_UNBIND_PPTDEV = 41,
+	IOCNUM_MAP_PPTDEV_MMIO = 42,
+	IOCNUM_PPTDEV_MSI = 43,
+	IOCNUM_PPTDEV_MSIX = 44,
+	IOCNUM_GET_PPTDEV_LIMITS = 45,
+
+	/* statistics */
+	IOCNUM_VM_STATS = 50, 
+	IOCNUM_VM_STAT_DESC = 51,
+
+	/* kernel device state */
+	IOCNUM_SET_X2APIC_STATE = 60,
+	IOCNUM_GET_X2APIC_STATE = 61,
+	IOCNUM_GET_HPET_CAPABILITIES = 62,
+
+	/* CPU Topology */
+	IOCNUM_SET_TOPOLOGY = 63,
+	IOCNUM_GET_TOPOLOGY = 64,
+
+	/* legacy interrupt injection */
+	IOCNUM_ISA_ASSERT_IRQ = 80,
+	IOCNUM_ISA_DEASSERT_IRQ = 81,
+	IOCNUM_ISA_PULSE_IRQ = 82,
+	IOCNUM_ISA_SET_IRQ_TRIGGER = 83,
+
+	/* vm_cpuset */
+	IOCNUM_ACTIVATE_CPU = 90,
+	IOCNUM_GET_CPUSET = 91,
+	IOCNUM_SUSPEND_CPU = 92,
+	IOCNUM_RESUME_CPU = 93,
+
+	/* RTC */
+	IOCNUM_RTC_READ = 100,
+	IOCNUM_RTC_WRITE = 101,
+	IOCNUM_RTC_SETTIME = 102,
+	IOCNUM_RTC_GETTIME = 103,
+
+#ifndef __FreeBSD__
+	/* illumos-custom ioctls */
+	IOCNUM_DEVMEM_GETOFFSET = 256,
+#endif
+};
+
+#define	VM_RUN		\
+	_IOWR('v', IOCNUM_RUN, struct vm_run)
+#define	VM_SUSPEND	\
+	_IOW('v', IOCNUM_SUSPEND, struct vm_suspend)
+#define	VM_REINIT	\
+	_IO('v', IOCNUM_REINIT)
+#define	VM_ALLOC_MEMSEG	\
+	_IOW('v', IOCNUM_ALLOC_MEMSEG, struct vm_memseg)
+#define	VM_GET_MEMSEG	\
+	_IOWR('v', IOCNUM_GET_MEMSEG, struct vm_memseg)
+#define	VM_MMAP_MEMSEG	\
+	_IOW('v', IOCNUM_MMAP_MEMSEG, struct vm_memmap)
+#define	VM_MMAP_GETNEXT	\
+	_IOWR('v', IOCNUM_MMAP_GETNEXT, struct vm_memmap)
+#define	VM_SET_REGISTER \
+	_IOW('v', IOCNUM_SET_REGISTER, struct vm_register)
+#define	VM_GET_REGISTER \
+	_IOWR('v', IOCNUM_GET_REGISTER, struct vm_register)
+#define	VM_SET_SEGMENT_DESCRIPTOR \
+	_IOW('v', IOCNUM_SET_SEGMENT_DESCRIPTOR, struct vm_seg_desc)
+#define	VM_GET_SEGMENT_DESCRIPTOR \
+	_IOWR('v', IOCNUM_GET_SEGMENT_DESCRIPTOR, struct vm_seg_desc)
+#define	VM_SET_REGISTER_SET \
+	_IOW('v', IOCNUM_SET_REGISTER_SET, struct vm_register_set)
+#define	VM_GET_REGISTER_SET \
+	_IOWR('v', IOCNUM_GET_REGISTER_SET, struct vm_register_set)
+#define	VM_INJECT_EXCEPTION	\
+	_IOW('v', IOCNUM_INJECT_EXCEPTION, struct vm_exception)
+#define	VM_LAPIC_IRQ 		\
+	_IOW('v', IOCNUM_LAPIC_IRQ, struct vm_lapic_irq)
+#define	VM_LAPIC_LOCAL_IRQ 	\
+	_IOW('v', IOCNUM_LAPIC_LOCAL_IRQ, struct vm_lapic_irq)
+#define	VM_LAPIC_MSI		\
+	_IOW('v', IOCNUM_LAPIC_MSI, struct vm_lapic_msi)
+#define	VM_IOAPIC_ASSERT_IRQ	\
+	_IOW('v', IOCNUM_IOAPIC_ASSERT_IRQ, struct vm_ioapic_irq)
+#define	VM_IOAPIC_DEASSERT_IRQ	\
+	_IOW('v', IOCNUM_IOAPIC_DEASSERT_IRQ, struct vm_ioapic_irq)
+#define	VM_IOAPIC_PULSE_IRQ	\
+	_IOW('v', IOCNUM_IOAPIC_PULSE_IRQ, struct vm_ioapic_irq)
+#define	VM_IOAPIC_PINCOUNT	\
+	_IOR('v', IOCNUM_IOAPIC_PINCOUNT, int)
+#define	VM_ISA_ASSERT_IRQ	\
+	_IOW('v', IOCNUM_ISA_ASSERT_IRQ, struct vm_isa_irq)
+#define	VM_ISA_DEASSERT_IRQ	\
+	_IOW('v', IOCNUM_ISA_DEASSERT_IRQ, struct vm_isa_irq)
+#define	VM_ISA_PULSE_IRQ	\
+	_IOW('v', IOCNUM_ISA_PULSE_IRQ, struct vm_isa_irq)
+#define	VM_ISA_SET_IRQ_TRIGGER	\
+	_IOW('v', IOCNUM_ISA_SET_IRQ_TRIGGER, struct vm_isa_irq_trigger)
+#define	VM_SET_CAPABILITY \
+	_IOW('v', IOCNUM_SET_CAPABILITY, struct vm_capability)
+#define	VM_GET_CAPABILITY \
+	_IOWR('v', IOCNUM_GET_CAPABILITY, struct vm_capability)
+#define	VM_BIND_PPTDEV \
+	_IOW('v', IOCNUM_BIND_PPTDEV, struct vm_pptdev)
+#define	VM_UNBIND_PPTDEV \
+	_IOW('v', IOCNUM_UNBIND_PPTDEV, struct vm_pptdev)
+#define	VM_MAP_PPTDEV_MMIO \
+	_IOW('v', IOCNUM_MAP_PPTDEV_MMIO, struct vm_pptdev_mmio)
+#define	VM_PPTDEV_MSI \
+	_IOW('v', IOCNUM_PPTDEV_MSI, struct vm_pptdev_msi)
+#define	VM_PPTDEV_MSIX \
+	_IOW('v', IOCNUM_PPTDEV_MSIX, struct vm_pptdev_msix)
+#define	VM_GET_PPTDEV_LIMITS \
+	_IOR('v', IOCNUM_GET_PPTDEV_LIMITS, struct vm_pptdev_limits)
+#define VM_INJECT_NMI \
+	_IOW('v', IOCNUM_INJECT_NMI, struct vm_nmi)
+#define	VM_STATS_IOC \
+	_IOWR('v', IOCNUM_VM_STATS, struct vm_stats)
+#define	VM_STAT_DESC \
+	_IOWR('v', IOCNUM_VM_STAT_DESC, struct vm_stat_desc)
+#define	VM_SET_X2APIC_STATE \
+	_IOW('v', IOCNUM_SET_X2APIC_STATE, struct vm_x2apic)
+#define	VM_GET_X2APIC_STATE \
+	_IOWR('v', IOCNUM_GET_X2APIC_STATE, struct vm_x2apic)
+#define	VM_GET_HPET_CAPABILITIES \
+	_IOR('v', IOCNUM_GET_HPET_CAPABILITIES, struct vm_hpet_cap)
+#define VM_SET_TOPOLOGY \
+	_IOW('v', IOCNUM_SET_TOPOLOGY, struct vm_cpu_topology)
+#define VM_GET_TOPOLOGY \
+	_IOR('v', IOCNUM_GET_TOPOLOGY, struct vm_cpu_topology)
+#define	VM_GET_GPA_PMAP \
+	_IOWR('v', IOCNUM_GET_GPA_PMAP, struct vm_gpa_pte)
+#define	VM_GLA2GPA	\
+	_IOWR('v', IOCNUM_GLA2GPA, struct vm_gla2gpa)
+#define	VM_GLA2GPA_NOFAULT \
+	_IOWR('v', IOCNUM_GLA2GPA_NOFAULT, struct vm_gla2gpa)
+#define	VM_ACTIVATE_CPU	\
+	_IOW('v', IOCNUM_ACTIVATE_CPU, struct vm_activate_cpu)
+#define	VM_GET_CPUS	\
+	_IOW('v', IOCNUM_GET_CPUSET, struct vm_cpuset)
+#define	VM_SUSPEND_CPU \
+	_IOW('v', IOCNUM_SUSPEND_CPU, struct vm_activate_cpu)
+#define	VM_RESUME_CPU \
+	_IOW('v', IOCNUM_RESUME_CPU, struct vm_activate_cpu)
+#define	VM_SET_INTINFO	\
+	_IOW('v', IOCNUM_SET_INTINFO, struct vm_intinfo)
+#define	VM_GET_INTINFO	\
+	_IOWR('v', IOCNUM_GET_INTINFO, struct vm_intinfo)
+#define VM_RTC_WRITE \
+	_IOW('v', IOCNUM_RTC_WRITE, struct vm_rtc_data)
+#define VM_RTC_READ \
+	_IOWR('v', IOCNUM_RTC_READ, struct vm_rtc_data)
+#define VM_RTC_SETTIME	\
+	_IOW('v', IOCNUM_RTC_SETTIME, struct vm_rtc_time)
+#define VM_RTC_GETTIME	\
+	_IOR('v', IOCNUM_RTC_GETTIME, struct vm_rtc_time)
+#define	VM_RESTART_INSTRUCTION \
+	_IOW('v', IOCNUM_RESTART_INSTRUCTION, int)
+
+#ifndef __FreeBSD__
+#define	VM_DEVMEM_GETOFFSET \
+	_IOW('v', IOCNUM_DEVMEM_GETOFFSET, struct vm_devmem_offset)
+
+/* ioctls used against ctl device for vm create/destroy */
+#define	VMM_IOC_BASE		(('V' << 16) | ('M' << 8))
+#define	VMM_CREATE_VM		(VMM_IOC_BASE | 0x01)
+#define	VMM_DESTROY_VM		(VMM_IOC_BASE | 0x02)
+#define	VMM_VM_SUPPORTED	(VMM_IOC_BASE | 0x03)
+
+#define	VMM_CTL_DEV		"/dev/vmmctl"
+
+#endif
+
+#endif
diff --git a/usr/src/uts/i86pc/sys/vmm_drv.h b/usr/src/uts/i86pc/sys/vmm_drv.h
new file mode 100644
index 0000000000..b883070abf
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/vmm_drv.h
@@ -0,0 +1,40 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+#ifndef _VMM_DRV_H_
+#define	_VMM_DRV_H_
+
+#ifdef	_KERNEL
+struct vmm_hold;
+typedef struct vmm_hold vmm_hold_t;
+
+/*
+ * Because of tangled headers, these definitions mirror their vmm_[rw]mem_cb_t
+ * counterparts in vmm.h.
+ */
+typedef int (*vmm_drv_rmem_cb_t)(void *, uintptr_t, uint_t, uint64_t *);
+typedef int (*vmm_drv_wmem_cb_t)(void *, uintptr_t, uint_t, uint64_t);
+
+extern int vmm_drv_hold(file_t *, cred_t *, vmm_hold_t **);
+extern void vmm_drv_rele(vmm_hold_t *);
+extern boolean_t vmm_drv_expired(vmm_hold_t *);
+extern void *vmm_drv_gpa2kva(vmm_hold_t *, uintptr_t, size_t);
+extern int vmm_drv_ioport_hook(vmm_hold_t *, uint_t, vmm_drv_rmem_cb_t,
+    vmm_drv_wmem_cb_t, void *, void **);
+extern void vmm_drv_ioport_unhook(vmm_hold_t *, void **);
+extern int vmm_drv_msi(vmm_hold_t *, uint64_t, uint64_t);
+#endif /* _KERNEL */
+
+#endif /* _VMM_DRV_H_ */
diff --git a/usr/src/uts/i86pc/sys/vmm_impl.h b/usr/src/uts/i86pc/sys/vmm_impl.h
new file mode 100644
index 0000000000..db2c4ab991
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/vmm_impl.h
@@ -0,0 +1,81 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2014 Pluribus Networks Inc.
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef _VMM_IMPL_H_
+#define	_VMM_IMPL_H_
+
+#include <sys/mutex.h>
+#include <sys/queue.h>
+#include <sys/varargs.h>
+#include <sys/zone.h>
+
+#ifdef	_KERNEL
+
+#define	VMM_CTL_MINOR	0
+
+/*
+ * Rather than creating whole character devices for devmem mappings, they are
+ * available by mmap(2)ing the vmm handle at a specific offset.  These offsets
+ * begin just above the maximum allow guest physical address.
+ */
+#include <vm/vm_param.h>
+#define	VM_DEVMEM_START	(VM_MAXUSER_ADDRESS + 1)
+
+struct vmm_devmem_entry {
+	list_node_t	vde_node;
+	int		vde_segid;
+	char		vde_name[SPECNAMELEN + 1];
+	size_t		vde_len;
+	off_t		vde_off;
+};
+typedef struct vmm_devmem_entry vmm_devmem_entry_t;
+
+typedef struct vmm_zsd vmm_zsd_t;
+
+enum vmm_softc_state {
+	VMM_HELD	= 1,	/* external driver(s) possess hold on VM */
+	VMM_CLEANUP	= 2,	/* request that holds are released */
+	VMM_PURGED	= 4,	/* all hold have been released */
+	VMM_BLOCK_HOOK	= 8	/* mem hook install temporarily blocked */
+};
+
+struct vmm_softc {
+	list_node_t	vmm_node;
+	struct vm	*vmm_vm;
+	minor_t		vmm_minor;
+	char		vmm_name[VM_MAX_NAMELEN];
+	uint_t		vmm_flags;
+	boolean_t	vmm_is_open;
+	list_t		vmm_devmem_list;
+	list_t		vmm_holds;
+	kcondvar_t	vmm_cv;
+
+	/* For zone specific data */
+	list_node_t	vmm_zsd_linkage;
+	zone_t		*vmm_zone;
+	vmm_zsd_t	*vmm_zsd;
+};
+typedef struct vmm_softc vmm_softc_t;
+
+void vmm_zsd_init(void);
+void vmm_zsd_fini(void);
+int vmm_zsd_add_vm(vmm_softc_t *sc);
+void vmm_zsd_rem_vm(vmm_softc_t *sc);
+int vmm_do_vm_destroy(vmm_softc_t *, boolean_t);
+
+#endif /* _KERNEL */
+
+#endif	/* _VMM_IMPL_H_ */
diff --git a/usr/src/uts/i86pc/sys/vmm_instruction_emul.h b/usr/src/uts/i86pc/sys/vmm_instruction_emul.h
new file mode 100644
index 0000000000..f10f407164
--- /dev/null
+++ b/usr/src/uts/i86pc/sys/vmm_instruction_emul.h
@@ -0,0 +1,137 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2012 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ *
+ * Copyright 2015 Pluribus Networks Inc.
+ */
+
+#ifndef	_VMM_INSTRUCTION_EMUL_H_
+#define	_VMM_INSTRUCTION_EMUL_H_
+
+#include <sys/mman.h>
+
+/*
+ * Callback functions to read and write memory regions.
+ */
+typedef int (*mem_region_read_t)(void *vm, int cpuid, uint64_t gpa,
+				 uint64_t *rval, int rsize, void *arg);
+
+typedef int (*mem_region_write_t)(void *vm, int cpuid, uint64_t gpa,
+				  uint64_t wval, int wsize, void *arg);
+
+/*
+ * Emulate the decoded 'vie' instruction.
+ *
+ * The callbacks 'mrr' and 'mrw' emulate reads and writes to the memory region
+ * containing 'gpa'. 'mrarg' is an opaque argument that is passed into the
+ * callback functions.
+ *
+ * 'void *vm' should be 'struct vm *' when called from kernel context and
+ * 'struct vmctx *' when called from user context.
+ * s
+ */
+int vmm_emulate_instruction(void *vm, int cpuid, uint64_t gpa, struct vie *vie,
+    struct vm_guest_paging *paging, mem_region_read_t mrr,
+    mem_region_write_t mrw, void *mrarg);
+
+int vie_update_register(void *vm, int vcpuid, enum vm_reg_name reg,
+    uint64_t val, int size);
+
+/*
+ * Returns 1 if an alignment check exception should be injected and 0 otherwise.
+ */
+int vie_alignment_check(int cpl, int operand_size, uint64_t cr0,
+    uint64_t rflags, uint64_t gla);
+
+/* Returns 1 if the 'gla' is not canonical and 0 otherwise. */
+int vie_canonical_check(enum vm_cpu_mode cpu_mode, uint64_t gla);
+
+uint64_t vie_size2mask(int size);
+
+int vie_calculate_gla(enum vm_cpu_mode cpu_mode, enum vm_reg_name seg,
+    struct seg_desc *desc, uint64_t off, int length, int addrsize, int prot,
+    uint64_t *gla);
+
+#ifdef _KERNEL
+/*
+ * APIs to fetch and decode the instruction from nested page fault handler.
+ *
+ * 'vie' must be initialized before calling 'vmm_fetch_instruction()'
+ */
+int vmm_fetch_instruction(struct vm *vm, int cpuid,
+			  struct vm_guest_paging *guest_paging,
+			  uint64_t rip, int inst_length, struct vie *vie,
+			  int *is_fault);
+
+/*
+ * Translate the guest linear address 'gla' to a guest physical address.
+ *
+ * retval	is_fault	Interpretation
+ *   0		   0		'gpa' contains result of the translation
+ *   0		   1		An exception was injected into the guest
+ * EFAULT	  N/A		An unrecoverable hypervisor error occurred
+ */
+int vm_gla2gpa(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t gla, int prot, uint64_t *gpa, int *is_fault);
+
+/*
+ * Like vm_gla2gpa, but no exceptions are injected into the guest and
+ * PTEs are not changed.
+ */
+int vm_gla2gpa_nofault(struct vm *vm, int vcpuid, struct vm_guest_paging *paging,
+    uint64_t gla, int prot, uint64_t *gpa, int *is_fault);
+
+void vie_init(struct vie *vie, const char *inst_bytes, int inst_length);
+
+/*
+ * Decode the instruction fetched into 'vie' so it can be emulated.
+ *
+ * 'gla' is the guest linear address provided by the hardware assist
+ * that caused the nested page table fault. It is used to verify that
+ * the software instruction decoding is in agreement with the hardware.
+ * 
+ * Some hardware assists do not provide the 'gla' to the hypervisor.
+ * To skip the 'gla' verification for this or any other reason pass
+ * in VIE_INVALID_GLA instead.
+ */
+#define	VIE_INVALID_GLA		(1UL << 63)	/* a non-canonical address */
+int vmm_decode_instruction(struct vm *vm, int cpuid, uint64_t gla,
+			   enum vm_cpu_mode cpu_mode, int csd, struct vie *vie);
+#endif	/* _KERNEL */
+
+#endif	/* _VMM_INSTRUCTION_EMUL_H_ */
diff --git a/usr/src/uts/i86pc/unix/Makefile b/usr/src/uts/i86pc/unix/Makefile
index da1238835b..24dbc2970a 100644
--- a/usr/src/uts/i86pc/unix/Makefile
+++ b/usr/src/uts/i86pc/unix/Makefile
@@ -22,6 +22,7 @@
 #
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2016 Joyent, Inc.
 #
 #	This makefile drives the production of unix (and unix.o).
 #
diff --git a/usr/src/uts/i86pc/viona/Makefile b/usr/src/uts/i86pc/viona/Makefile
new file mode 100644
index 0000000000..cbf0be9539
--- /dev/null
+++ b/usr/src/uts/i86pc/viona/Makefile
@@ -0,0 +1,82 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+# Copyright 2018 Joyent, Inc.
+#
+
+#
+# Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+# Define the module and object file sets.
+#
+MODULE		= viona
+OBJECTS	= $(VIONA_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(VIONA_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/i86pc/io/viona
+
+#
+# Include common rules.
+#
+include $(UTSBASE)/i86pc/Makefile.i86pc
+
+#
+# Define targets
+#
+ALL_TARGET	= $(BINARY) $(SRC_CONFILE)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+# Overrides
+#
+LINTTAGS	+= -erroff=E_ASSIGN_NARROW_CONV
+LINTTAGS	+= -erroff=E_FUNC_ARG_UNUSED
+LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
+LINTTAGS	+= -erroff=E_FUNC_RET_MAYBE_IGNORED2
+LINTTAGS	+= -erroff=E_FUNC_RET_ALWAYS_IGNOR2
+
+ALL_BUILDS	= $(ALL_BUILDSONLY64)
+DEF_BUILDS	= $(DEF_BUILDSONLY64)
+
+CFLAGS		+= $(CCVERBOSE)
+LDFLAGS		+= -dy -Ndrv/dld -Nmisc/mac -Nmisc/dls -Ndrv/vmm
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/i86pc/Makefile.targ
diff --git a/usr/src/uts/i86pc/vm/hat_i86.c b/usr/src/uts/i86pc/vm/hat_i86.c
index 6f296841ea..2bac383b9c 100644
--- a/usr/src/uts/i86pc/vm/hat_i86.c
+++ b/usr/src/uts/i86pc/vm/hat_i86.c
@@ -3917,7 +3917,7 @@ hat_page_getattr(struct page *pp, uint_t flag)
 
 
 /*
- * common code used by hat_pageunload() and hment_steal()
+ * common code used by hat_page_inval() and hment_steal()
  */
 hment_t *
 hati_page_unmap(page_t *pp, htable_t *ht, uint_t entry)
@@ -3973,15 +3973,13 @@ hati_page_unmap(page_t *pp, htable_t *ht, uint_t entry)
 
 extern int	vpm_enable;
 /*
- * Unload all translations to a page. If the page is a subpage of a large
+ * Unload translations to a page. If the page is a subpage of a large
  * page, the large page mappings are also removed.
- *
- * The forceflags are unused.
+ * If curhat is not NULL, then we only unload the translation
+ * for the given process, otherwise all translations are unloaded.
  */
-
-/*ARGSUSED*/
-static int
-hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t forceflag)
+void
+hat_page_inval(struct page *pp, uint_t pg_szcd, struct hat *curhat)
 {
 	page_t		*cur_pp = pp;
 	hment_t		*hm;
@@ -3989,15 +3987,10 @@ hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t forceflag)
 	htable_t	*ht;
 	uint_t		entry;
 	level_t		level;
+	ulong_t		cnt;
 
 	XPV_DISALLOW_MIGRATE();
 
-	/*
-	 * prevent recursion due to kmem_free()
-	 */
-	++curthread->t_hatdepth;
-	ASSERT(curthread->t_hatdepth < 16);
-
 #if defined(__amd64)
 	/*
 	 * clear the vpm ref.
@@ -4010,6 +4003,8 @@ hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t forceflag)
 	 * The loop with next_size handles pages with multiple pagesize mappings
 	 */
 next_size:
+	if (curhat != NULL)
+		cnt = hat_page_getshare(cur_pp);
 	for (;;) {
 
 		/*
@@ -4021,14 +4016,13 @@ next_size:
 			if (hm == NULL) {
 				x86_hm_exit(cur_pp);
 
+curproc_done:
 				/*
 				 * If not part of a larger page, we're done.
 				 */
 				if (cur_pp->p_szc <= pg_szcd) {
-					ASSERT(curthread->t_hatdepth > 0);
-					--curthread->t_hatdepth;
 					XPV_ALLOW_MIGRATE();
-					return (0);
+					return;
 				}
 
 				/*
@@ -4047,8 +4041,20 @@ next_size:
 			 * If this mapping size matches, remove it.
 			 */
 			level = ht->ht_level;
-			if (level == pg_szcd)
-				break;
+			if (level == pg_szcd) {
+				if (curhat == NULL || ht->ht_hat == curhat)
+					break;
+				/*
+				 * Unloading only the given process but it's
+				 * not the hat for the current process. Leave
+				 * entry in place. Also do a safety check to
+				 * ensure we don't get in an infinite loop
+				 */
+				if (cnt-- == 0) {
+					x86_hm_exit(cur_pp);
+					goto curproc_done;
+				}
+			}
 		}
 
 		/*
@@ -4058,14 +4064,44 @@ next_size:
 		hm = hati_page_unmap(cur_pp, ht, entry);
 		if (hm != NULL)
 			hment_free(hm);
+
+		/* Perform check above for being part of a larger page. */
+		if (curhat != NULL)
+			goto curproc_done;
 	}
 }
 
+/*
+ * Unload translations to a page. If unloadflag is HAT_CURPROC_PGUNLOAD, then
+ * we only unload the translation for the current process, otherwise all
+ * translations are unloaded.
+ */
+static int
+hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t unloadflag)
+{
+	struct hat	*curhat = NULL;
+
+	/*
+	 * prevent recursion due to kmem_free()
+	 */
+	++curthread->t_hatdepth;
+	ASSERT(curthread->t_hatdepth < 16);
+
+	if (unloadflag == HAT_CURPROC_PGUNLOAD)
+		curhat = curthread->t_procp->p_as->a_hat;
+
+	hat_page_inval(pp, pg_szcd, curhat);
+
+	ASSERT(curthread->t_hatdepth > 0);
+	--curthread->t_hatdepth;
+	return (0);
+}
+
 int
-hat_pageunload(struct page *pp, uint_t forceflag)
+hat_pageunload(struct page *pp, uint_t unloadflag)
 {
 	ASSERT(PAGE_EXCL(pp));
-	return (hati_pageunload(pp, 0, forceflag));
+	return (hati_pageunload(pp, 0, unloadflag));
 }
 
 /*
diff --git a/usr/src/uts/i86pc/vm/hment.c b/usr/src/uts/i86pc/vm/hment.c
index d00d756828..079f64e92e 100644
--- a/usr/src/uts/i86pc/vm/hment.c
+++ b/usr/src/uts/i86pc/vm/hment.c
@@ -21,10 +21,9 @@
 /*
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2017 Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <sys/sysmacros.h>
 #include <sys/kmem.h>
@@ -37,6 +36,7 @@
 #include <vm/hat_i86.h>
 #include <sys/cmn_err.h>
 #include <sys/avl.h>
+#include <sys/zone.h>
 
 
 /*
@@ -323,6 +323,8 @@ hment_insert(hment_t *hm, page_t *pp)
 		((hment_t *)pp->p_mapping)->hm_prev = hm;
 	pp->p_mapping = hm;
 
+	zone_add_page(pp);
+
 	/*
 	 * Add the hment to the system-wide hash table.
 	 */
@@ -464,6 +466,7 @@ hment_assign(htable_t *htable, uint_t entry, page_t *pp, hment_t *hm)
 		pp->p_embed = 1;
 		pp->p_mapping = htable;
 		pp->p_mlentry = entry;
+		zone_add_page(pp);
 		return;
 	}
 
@@ -545,6 +548,7 @@ hment_remove(page_t *pp, htable_t *ht, uint_t entry)
 		pp->p_mapping = NULL;
 		pp->p_mlentry = 0;
 		pp->p_embed = 0;
+		zone_rm_page(pp);
 		return (NULL);
 	}
 
@@ -580,6 +584,7 @@ hment_remove(page_t *pp, htable_t *ht, uint_t entry)
 	hm->hm_hashlink = null_avl_link;
 	hm->hm_next = NULL;
 	hm->hm_prev = NULL;
+	zone_rm_page(pp);
 
 	return (hm);
 }
diff --git a/usr/src/uts/i86pc/vm/seg_vmm.c b/usr/src/uts/i86pc/vm/seg_vmm.c
new file mode 100644
index 0000000000..beb5e81d53
--- /dev/null
+++ b/usr/src/uts/i86pc/vm/seg_vmm.c
@@ -0,0 +1,471 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * segvmm - Virtual-Machine-Memory segment
+ *
+ * The vmm segment driver was designed for mapping regions of kernel memory
+ * allocated to an HVM instance into userspace for manipulation there.  It
+ * draws direct lineage from the umap segment driver, but meant for larger
+ * mappings with fewer restrictions.
+ *
+ * seg*k*vmm, in contrast, has mappings for every VMM into kas.  We use its
+ * mappings here only to find the relevant PFNs in segvmm_fault_in().
+ */
+
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/errno.h>
+#include <sys/cred.h>
+#include <sys/kmem.h>
+#include <sys/lgrp.h>
+#include <sys/mman.h>
+
+#include <vm/hat.h>
+#include <vm/hat_pte.h>
+#include <vm/htable.h>
+#include <vm/as.h>
+#include <vm/seg.h>
+#include <vm/seg_kmem.h>
+#include <vm/seg_vmm.h>
+
+
+static int segvmm_dup(struct seg *, struct seg *);
+static int segvmm_unmap(struct seg *, caddr_t, size_t);
+static void segvmm_free(struct seg *);
+static faultcode_t segvmm_fault(struct hat *, struct seg *, caddr_t, size_t,
+    enum fault_type, enum seg_rw);
+static faultcode_t segvmm_faulta(struct seg *, caddr_t);
+static int segvmm_setprot(struct seg *, caddr_t, size_t, uint_t);
+static int segvmm_checkprot(struct seg *, caddr_t, size_t, uint_t);
+static int segvmm_sync(struct seg *, caddr_t, size_t, int, uint_t);
+static size_t segvmm_incore(struct seg *, caddr_t, size_t, char *);
+static int segvmm_lockop(struct seg *, caddr_t, size_t, int, int, ulong_t *,
+    size_t);
+static int segvmm_getprot(struct seg *, caddr_t, size_t, uint_t *);
+static u_offset_t segvmm_getoffset(struct seg *, caddr_t);
+static int segvmm_gettype(struct seg *, caddr_t);
+static int segvmm_getvp(struct seg *, caddr_t, struct vnode **);
+static int segvmm_advise(struct seg *, caddr_t, size_t, uint_t);
+static void segvmm_dump(struct seg *);
+static int segvmm_pagelock(struct seg *, caddr_t, size_t, struct page ***,
+    enum lock_type, enum seg_rw);
+static int segvmm_setpagesize(struct seg *, caddr_t, size_t, uint_t);
+static int segvmm_getmemid(struct seg *, caddr_t, memid_t *);
+static int segvmm_capable(struct seg *, segcapability_t);
+
+static struct seg_ops segvmm_ops = {
+	.dup		= segvmm_dup,
+	.unmap		= segvmm_unmap,
+	.free		= segvmm_free,
+	.fault		= segvmm_fault,
+	.faulta		= segvmm_faulta,
+	.setprot	= segvmm_setprot,
+	.checkprot	= segvmm_checkprot,
+	.kluster	= NULL,
+	.swapout	= NULL,
+	.sync		= segvmm_sync,
+	.incore		= segvmm_incore,
+	.lockop		= segvmm_lockop,
+	.getprot	= segvmm_getprot,
+	.getoffset	= segvmm_getoffset,
+	.gettype	= segvmm_gettype,
+	.getvp		= segvmm_getvp,
+	.advise		= segvmm_advise,
+	.dump		= segvmm_dump,
+	.pagelock	= segvmm_pagelock,
+	.setpagesize	= segvmm_setpagesize,
+	.getmemid	= segvmm_getmemid,
+	.getpolicy	= NULL,
+	.capable	= segvmm_capable,
+	.inherit	= seg_inherit_notsup
+};
+
+
+/*
+ * Create a kernel/user-mapped segment.  ->kaddr is the segkvmm mapping.
+ */
+int
+segvmm_create(struct seg **segpp, void *argsp)
+{
+	struct seg *seg = *segpp;
+	segvmm_crargs_t *cra = argsp;
+	segvmm_data_t *data;
+
+	/*
+	 * Check several aspects of the mapping request to ensure validity:
+	 * - kernel pages must reside entirely in kernel space
+	 * - target protection must be user-accessible
+	 * - kernel address must be page-aligned
+	 */
+	if ((uintptr_t)cra->kaddr <= _userlimit ||
+	    ((uintptr_t)cra->kaddr + seg->s_size) < (uintptr_t)cra->kaddr ||
+	    (cra->prot & PROT_USER) == 0 ||
+	    ((uintptr_t)cra->kaddr & PAGEOFFSET) != 0) {
+		return (EINVAL);
+	}
+
+	data = kmem_zalloc(sizeof (*data), KM_SLEEP);
+	rw_init(&data->svmd_lock, NULL, RW_DEFAULT, NULL);
+	data->svmd_kaddr = (uintptr_t)cra->kaddr;
+	data->svmd_prot = cra->prot;
+	data->svmd_cookie = cra->cookie;
+	data->svmd_hold = cra->hold;
+	data->svmd_rele = cra->rele;
+
+	/* Since initial checks have passed, grab a reference on the cookie */
+	if (data->svmd_hold != NULL) {
+		data->svmd_hold(data->svmd_cookie);
+	}
+
+	seg->s_ops = &segvmm_ops;
+	seg->s_data = data;
+	return (0);
+}
+
+static int
+segvmm_dup(struct seg *seg, struct seg *newseg)
+{
+	segvmm_data_t *svmd = seg->s_data;
+	segvmm_data_t *newsvmd;
+
+	ASSERT(seg->s_as && AS_WRITE_HELD(seg->s_as));
+
+	newsvmd = kmem_zalloc(sizeof (segvmm_data_t), KM_SLEEP);
+	rw_init(&newsvmd->svmd_lock, NULL, RW_DEFAULT, NULL);
+	newsvmd->svmd_kaddr = svmd->svmd_kaddr;
+	newsvmd->svmd_prot = svmd->svmd_prot;
+	newsvmd->svmd_cookie = svmd->svmd_cookie;
+	newsvmd->svmd_hold = svmd->svmd_hold;
+	newsvmd->svmd_rele = svmd->svmd_rele;
+
+	/* Grab another hold for the duplicate segment */
+	if (svmd->svmd_hold != NULL) {
+		newsvmd->svmd_hold(newsvmd->svmd_cookie);
+	}
+
+	newseg->s_ops = seg->s_ops;
+	newseg->s_data = newsvmd;
+	return (0);
+}
+
+static int
+segvmm_unmap(struct seg *seg, caddr_t addr, size_t len)
+{
+	segvmm_data_t *svmd = seg->s_data;
+
+	ASSERT(seg->s_as && AS_WRITE_HELD(seg->s_as));
+
+	/* Only allow unmap of entire segment */
+	if (addr != seg->s_base || len != seg->s_size) {
+		return (EINVAL);
+	}
+	if (svmd->svmd_softlockcnt != 0) {
+		return (EAGAIN);
+	}
+
+	/* Unconditionally unload the entire segment range.  */
+	hat_unload(seg->s_as->a_hat, addr, len, HAT_UNLOAD_UNMAP);
+
+	/* Release the hold this segment possessed */
+	if (svmd->svmd_rele != NULL) {
+		svmd->svmd_rele(svmd->svmd_cookie);
+	}
+
+	seg_free(seg);
+	return (0);
+}
+
+static void
+segvmm_free(struct seg *seg)
+{
+	segvmm_data_t *data = seg->s_data;
+
+	ASSERT(data != NULL);
+
+	rw_destroy(&data->svmd_lock);
+	VERIFY(data->svmd_softlockcnt == 0);
+	kmem_free(data, sizeof (*data));
+	seg->s_data = NULL;
+}
+
+static int
+segvmm_fault_in(struct hat *hat, struct seg *seg, uintptr_t va, size_t len)
+{
+	segvmm_data_t *svmd = seg->s_data;
+	const uintptr_t koff = svmd->svmd_kaddr - (uintptr_t)seg->s_base;
+	const uintptr_t end = va + len;
+	const uintptr_t prot = svmd->svmd_prot;
+
+	/* Stick to the simple non-large-page case for now */
+	va &= PAGEMASK;
+
+	do {
+		htable_t *ht;
+		uint_t entry, lvl;
+		size_t psz;
+		pfn_t pfn;
+		const uintptr_t kaddr = va + koff;
+
+		ASSERT(kaddr >= (uintptr_t)svmd->svmd_kaddr);
+		ASSERT(kaddr < ((uintptr_t)svmd->svmd_kaddr + seg->s_size));
+
+		ht = htable_getpage(kas.a_hat, kaddr, &entry);
+		if (ht == NULL) {
+			return (-1);
+		}
+		lvl = ht->ht_level;
+		pfn = PTE2PFN(x86pte_get(ht, entry), lvl);
+		htable_release(ht);
+		if (pfn == PFN_INVALID) {
+			return (-1);
+		}
+
+		/* For the time being, handling for large pages is absent. */
+		psz = PAGESIZE;
+		pfn += mmu_btop(kaddr & LEVEL_OFFSET(lvl));
+
+		hat_devload(hat, (caddr_t)va, psz, pfn, prot, HAT_LOAD);
+
+		va = va + psz;
+	} while (va < end);
+
+	return (0);
+}
+
+/* ARGSUSED */
+static faultcode_t
+segvmm_fault(struct hat *hat, struct seg *seg, caddr_t addr, size_t len,
+    enum fault_type type, enum seg_rw tw)
+{
+	segvmm_data_t *svmd = seg->s_data;
+	int err = 0;
+
+	ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
+
+	if (type == F_PROT) {
+		/*
+		 * Since protection on the segment is fixed, there is nothing
+		 * to do but report an error for protection faults.
+		 */
+		return (FC_PROT);
+	} else if (type == F_SOFTUNLOCK) {
+		size_t plen = btop(len);
+
+		rw_enter(&svmd->svmd_lock, RW_WRITER);
+		VERIFY(svmd->svmd_softlockcnt >= plen);
+		svmd->svmd_softlockcnt -= plen;
+		rw_exit(&svmd->svmd_lock);
+		return (0);
+	}
+
+	VERIFY(type == F_INVAL || type == F_SOFTLOCK);
+	rw_enter(&svmd->svmd_lock, RW_WRITER);
+
+	err = segvmm_fault_in(hat, seg, (uintptr_t)addr, len);
+	if (type == F_SOFTLOCK && err == 0) {
+		size_t nval = svmd->svmd_softlockcnt + btop(len);
+
+		if (svmd->svmd_softlockcnt >= nval) {
+			rw_exit(&svmd->svmd_lock);
+			return (FC_MAKE_ERR(EOVERFLOW));
+		}
+		svmd->svmd_softlockcnt = nval;
+	}
+
+	rw_exit(&svmd->svmd_lock);
+	return (err);
+}
+
+/* ARGSUSED */
+static faultcode_t
+segvmm_faulta(struct seg *seg, caddr_t addr)
+{
+	/* Do nothing since asynch pagefault should not load translation. */
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+segvmm_setprot(struct seg *seg, caddr_t addr, size_t len, uint_t prot)
+{
+	ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
+
+	/* The seg_vmm driver does not yet allow protection to be changed. */
+	return (EACCES);
+}
+
+/* ARGSUSED */
+static int
+segvmm_checkprot(struct seg *seg, caddr_t addr, size_t len, uint_t prot)
+{
+	segvmm_data_t *svmd = seg->s_data;
+	int error = 0;
+
+	ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
+
+	rw_enter(&svmd->svmd_lock, RW_READER);
+	if ((svmd->svmd_prot & prot) != prot) {
+		error = EACCES;
+	}
+	rw_exit(&svmd->svmd_lock);
+	return (error);
+}
+
+/* ARGSUSED */
+static int
+segvmm_sync(struct seg *seg, caddr_t addr, size_t len, int attr, uint_t flags)
+{
+	/* Always succeed since there are no backing store to sync */
+	return (0);
+}
+
+/* ARGSUSED */
+static size_t
+segvmm_incore(struct seg *seg, caddr_t addr, size_t len, char *vec)
+{
+	size_t sz = 0;
+
+	ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
+
+	len = (len + PAGEOFFSET) & PAGEMASK;
+	while (len > 0) {
+		*vec = 1;
+		sz += PAGESIZE;
+		vec++;
+		len -= PAGESIZE;
+	}
+	return (sz);
+}
+
+/* ARGSUSED */
+static int
+segvmm_lockop(struct seg *seg, caddr_t addr, size_t len, int attr, int op,
+    ulong_t *lockmap, size_t pos)
+{
+	/* Report success since kernel pages are always in memory. */
+	return (0);
+}
+
+static int
+segvmm_getprot(struct seg *seg, caddr_t addr, size_t len, uint_t *protv)
+{
+	segvmm_data_t *svmd = seg->s_data;
+	size_t pgno;
+	uint_t prot;
+
+	ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
+
+	rw_enter(&svmd->svmd_lock, RW_READER);
+	prot = svmd->svmd_prot;
+	rw_exit(&svmd->svmd_lock);
+
+	/*
+	 * Reporting protection is simple since it is not tracked per-page.
+	 */
+	pgno = seg_page(seg, addr + len) - seg_page(seg, addr) + 1;
+	while (pgno > 0) {
+		protv[--pgno] = prot;
+	}
+	return (0);
+}
+
+/* ARGSUSED */
+static u_offset_t
+segvmm_getoffset(struct seg *seg, caddr_t addr)
+{
+	/*
+	 * To avoid leaking information about the layout of the kernel address
+	 * space, always report '0' as the offset.
+	 */
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+segvmm_gettype(struct seg *seg, caddr_t addr)
+{
+	/*
+	 * Since already-existing kernel pages are being mapped into userspace,
+	 * always report the segment type as shared.
+	 */
+	return (MAP_SHARED);
+}
+
+/* ARGSUSED */
+static int
+segvmm_getvp(struct seg *seg, caddr_t addr, struct vnode **vpp)
+{
+	ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
+
+	*vpp = NULL;
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+segvmm_advise(struct seg *seg, caddr_t addr, size_t len, uint_t behav)
+{
+	if (behav == MADV_PURGE) {
+		/* Purge does not make sense for this mapping */
+		return (EINVAL);
+	}
+	/* Indicate success for everything else. */
+	return (0);
+}
+
+/* ARGSUSED */
+static void
+segvmm_dump(struct seg *seg)
+{
+	/*
+	 * Since this is a mapping to share kernel data with userspace, nothing
+	 * additional should be dumped.
+	 */
+}
+
+/* ARGSUSED */
+static int
+segvmm_pagelock(struct seg *seg, caddr_t addr, size_t len, struct page ***ppp,
+    enum lock_type type, enum seg_rw rw)
+{
+	return (ENOTSUP);
+}
+
+/* ARGSUSED */
+static int
+segvmm_setpagesize(struct seg *seg, caddr_t addr, size_t len, uint_t szc)
+{
+	return (ENOTSUP);
+}
+
+static int
+segvmm_getmemid(struct seg *seg, caddr_t addr, memid_t *memidp)
+{
+	segvmm_data_t *svmd = seg->s_data;
+
+	memidp->val[0] = (uintptr_t)svmd->svmd_kaddr;
+	memidp->val[1] = (uintptr_t)(addr - seg->s_base);
+	return (0);
+}
+
+/* ARGSUSED */
+static int
+segvmm_capable(struct seg *seg, segcapability_t capability)
+{
+	/* no special capablities */
+	return (0);
+}
diff --git a/usr/src/uts/i86pc/vm/seg_vmm.h b/usr/src/uts/i86pc/vm/seg_vmm.h
new file mode 100644
index 0000000000..f5b95c6a27
--- /dev/null
+++ b/usr/src/uts/i86pc/vm/seg_vmm.h
@@ -0,0 +1,50 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef	_VM_SEG_VMM_H
+#define	_VM_SEG_VMM_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+typedef struct segvmm_crargs {
+	caddr_t	kaddr;
+	uchar_t	prot;			/* protection */
+	void	*cookie;		/* opaque resource backing memory */
+	void	(*hold)(void *);	/* add reference to cookie */
+	void	(*rele)(void *);	/* release reference to cookie */
+} segvmm_crargs_t;
+
+typedef void (*segvmm_holdfn_t)(void *);
+typedef void (*segvmm_relefn_t)(void *);
+
+typedef struct segvmm_data {
+	krwlock_t	svmd_lock;
+	uintptr_t	svmd_kaddr;
+	uchar_t		svmd_prot;
+	void		*svmd_cookie;
+	segvmm_holdfn_t	svmd_hold;
+	segvmm_relefn_t	svmd_rele;
+	size_t		svmd_softlockcnt;
+} segvmm_data_t;
+
+extern int segvmm_create(struct seg **, void *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _VM_SEG_VMM_H */
diff --git a/usr/src/uts/i86pc/vm/vm_machdep.c b/usr/src/uts/i86pc/vm/vm_machdep.c
index cb46bba853..6a94745ade 100644
--- a/usr/src/uts/i86pc/vm/vm_machdep.c
+++ b/usr/src/uts/i86pc/vm/vm_machdep.c
@@ -711,10 +711,8 @@ void
 map_addr(caddr_t *addrp, size_t len, offset_t off, int vacalign, uint_t flags)
 {
 	struct proc *p = curproc;
-	caddr_t userlimit = (flags & _MAP_LOW32) ?
-	    (caddr_t)_userlimit32 : p->p_as->a_userlimit;
-
-	map_addr_proc(addrp, len, off, vacalign, userlimit, curproc, flags);
+	map_addr_proc(addrp, len, off, vacalign,
+	    map_userlimit(p, p->p_as, flags), curproc, flags);
 }
 
 /*ARGSUSED*/
@@ -3582,7 +3580,7 @@ page_create_io(
 	if (nscan < desscan && freemem < minfree) {
 		TRACE_1(TR_FAC_VM, TR_PAGEOUT_CV_SIGNAL,
 		    "pageout_cv_signal:freemem %ld", freemem);
-		cv_signal(&proc_pageout->p_cv);
+		WAKE_PAGEOUT_SCANNER();
 	}
 
 	if (flags & PG_PHYSCONTIG) {
diff --git a/usr/src/uts/i86pc/vmm/Makefile b/usr/src/uts/i86pc/vmm/Makefile
new file mode 100644
index 0000000000..97633d9abb
--- /dev/null
+++ b/usr/src/uts/i86pc/vmm/Makefile
@@ -0,0 +1,147 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2013 Pluribus Networks Inc.
+# Copyright 2018 Joyent, Inc.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= vmm
+OBJECTS		= $(VMM_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(VMM_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/i86pc/io/vmm
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/i86pc/Makefile.i86pc
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+#	Overrides and additions
+#
+LINTTAGS	+= -erroff=E_EMPTY_DECLARATION
+LINTTAGS	+= -erroff=E_OPERANDS_INCOMPATIBLE_TYPES
+LINTTAGS	+= -erroff=E_VOID_CANT_RETURN_VALUE
+LINTTAGS	+= -erroff=E_YACC_ERROR
+LINTTAGS	+= -erroff=E_STATIC_UNUSED
+LINTTAGS	+= -erroff=E_FUNC_RET_MAYBE_IGNORED2
+LINTTAGS	+= -erroff=E_FUNC_RET_ALWAYS_IGNOR2
+LINTTAGS	+= -erroff=E_BAD_FORMAT_ARG_TYPE2
+LINTTAGS	+= -erroff=E_FUNC_ARG_UNUSED
+LINTTAGS	+= -erroff=E_FUNC_SET_NOT_USED
+LINTTAGS	+= -erroff=E_ASSIGN_NARROW_CONV
+LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
+LINTTAGS	+= -erroff=E_CONSTANT_CONDITION
+LINTTAGS	+= -erroff=E_PTR_TO_VOID_IN_ARITHMETIC
+LINTTAGS	+= -erroff=E_CONST_TRUNCATED_BY_ASSIGN
+LINTTAGS	+= -erroff=E_NOP_ELSE_STMT
+LINTTAGS	+= -erroff=E_FUNC_NO_RET_VAL
+LINTTAGS	+= -erroff=E_OLD_STYLE_DECL_OR_BAD_TYPE
+LINTTAGS	+= -erroff=E_VAR_USED_BEFORE_SET
+LINTTAGS	+= -erroff=E_INTEGER_OVERFLOW_DETECTED
+LINTTAGS	+= -erroff=E_STMT_NOT_REACHED
+LINTTAGS	+= -erroff=E_FUNC_NO_RET_VAL
+LINTTAGS	+= -erroff=E_USELESS_DECLARATION
+LINTTAGS	+= -erroff=E_EXPR_NULL_EFFECT
+LINTTAGS	+= -erroff=E_CASE_FALLTHRU
+LINTTAGS	+= -erroff=E_FUNC_DECL_VAR_ARG2
+LINTTAGS	+= -erroff=E_ASM_IMPOSSIBLE_CONSTRAINT
+LINTTAGS	+= -erroff=E_ASM_UNUSED_PARAM
+LINTTAGS	+= -erroff=E_NOP_IF_STMT
+LINTTAGS	+= -erroff=E_ZERO_OR_NEGATIVE_SUBSCRIPT
+
+CERRWARN	+= -_gcc=-Wno-empty-body
+
+# These sources only compile with gcc.  Workaround a confluence of cruft
+# regarding dmake and shadow compilation by neutering the sun compiler.
+#amd64_CC	= $(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
+#CFLAGS		+= -_cc=-xdryrun
+
+ALL_BUILDS	= $(ALL_BUILDSONLY64)
+DEF_BUILDS	= $(DEF_BUILDSONLY64)
+PRE_INC_PATH	= -I$(COMPAT)/freebsd -I$(COMPAT)/freebsd/amd64 \
+	-I$(CONTRIB)/freebsd -I$(CONTRIB)/freebsd/amd64
+INC_PATH	+= -I$(UTSBASE)/i86pc/io/vmm -I$(UTSBASE)/i86pc/io/vmm/io
+AS_INC_PATH	+= -I$(UTSBASE)/i86pc/io/vmm -I$(OBJS_DIR)
+
+CFLAGS		+= -_gcc=-Wimplicit-function-declaration
+# The FreeBSD %# notation makes gcc gripe
+CFLAGS		+= -_gcc=-Wno-format
+# enable collection of VMM statistics
+CFLAGS		+= -DVMM_KEEP_STATS
+
+$(OBJS_DIR)/vmm.o := CERRWARN += -_gcc=-Wno-pointer-sign -_gcc=-Wno-type-limits
+$(OBJS_DIR)/svm.o := CERRWARN += -_gcc=-Wno-pointer-sign -_gcc=-Wno-type-limits
+$(OBJS_DIR)/vmx.o := CERRWARN += -_gcc=-Wno-unused-variable
+$(OBJS_DIR)/iommu.o := CERRWARN += -_gcc=-Wno-unused-variable
+
+LDFLAGS         += -dy -N misc/acpica -N misc/pcie -N fs/dev
+
+OFFSETS_VMX	= $(CONF_SRCDIR)/intel/offsets.in
+OFFSETS_SVM	= $(CONF_SRCDIR)/amd/offsets.in
+ASSYM_VMX	= $(OBJS_DIR)/vmx_assym.h
+ASSYM_SVM	= $(OBJS_DIR)/svm_assym.h
+ASSYM_H		= $(ASSYM_VMX) $(ASSYM_SVM)
+
+CLEANFILES	+= $(ASSYM_H)
+
+# create linker set start/stop symbols, needed by VMM stats
+POST_PROCESS	+= ; $(GENSETDEFS) $@
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/i86pc/Makefile.targ
+
+$(ASSYM_VMX): $(OFFSETS_VMX) $(GENASSYM)
+	$(OFFSETS_CREATE) -I../../i86pc/io/vmm < $(OFFSETS_VMX) >$@
+$(ASSYM_SVM): $(OFFSETS_SVM) $(GENASSYM)
+	$(OFFSETS_CREATE) -I../../i86pc/io/vmm < $(OFFSETS_SVM) >$@
+
+$(OBJS_DIR)/vmx_support.o:  $(ASSYM_VMX)
+$(OBJS_DIR)/svm_support.o:  $(ASSYM_SVM)
diff --git a/usr/src/uts/i86xpv/Makefile.files b/usr/src/uts/i86xpv/Makefile.files
index a576b2f0a8..b4a78cc841 100644
--- a/usr/src/uts/i86xpv/Makefile.files
+++ b/usr/src/uts/i86xpv/Makefile.files
@@ -61,6 +61,7 @@ CORE_OBJS +=			\
 	hment.o			\
 	hold_page.o		\
 	hrtimers.o		\
+	ht.o			\
 	htable.o		\
 	i86_mmu.o		\
 	ibft.o			\
@@ -110,7 +111,7 @@ CORE_OBJS += $(SMBIOS_OBJS)
 
 #
 # These get compiled twice:
-# - once in the dboot (direct boot) identity mapped code 
+# - once in the dboot (direct boot) identity mapped code
 # - once for use during early startup in unix
 #
 BOOT_DRIVER_OBJS =		\
@@ -161,7 +162,7 @@ SPECIAL_OBJS_64 +=		\
 	locore.o		\
 	fast_trap_asm.o		\
 	interrupt.o		\
-	syscall_asm_amd64.o 	\
+	syscall_asm_amd64.o	\
 	kpti_trampolines.o
 
 SPECIAL_OBJS += $(SPECIAL_OBJS_$(CLASS))
@@ -234,7 +235,7 @@ INC_PATH	+= -I$(UTSBASE)/i86xpv -I$(UTSBASE)/i86pc -I$(SRC)/common \
 # since only C headers are included when #defined(__lint) is true.
 #
 
-ASSYM_DEPS      += 		\
+ASSYM_DEPS      +=		\
 	copy.o			\
 	desctbls_asm.o		\
 	ddi_i86_asm.o		\
diff --git a/usr/src/uts/i86xpv/io/psm/xpv_psm.c b/usr/src/uts/i86xpv/io/psm/xpv_psm.c
index c59d1015a0..bc0ab7748d 100644
--- a/usr/src/uts/i86xpv/io/psm/xpv_psm.c
+++ b/usr/src/uts/i86xpv/io/psm/xpv_psm.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #define	PSMI_1_7
@@ -1673,7 +1674,11 @@ static struct psm_ops xen_psm_ops = {
 	(void (*)(int, int))NULL,		/* psm_preshutdown	*/
 	xen_intr_ops,			/* Advanced DDI Interrupt framework */
 	(int (*)(psm_state_request_t *))NULL,	/* psm_state		*/
-	(int (*)(psm_cpu_request_t *))NULL	/* psm_cpu_ops		*/
+	(int (*)(psm_cpu_request_t *))NULL,	/* psm_cpu_ops		*/
+
+	(int (*)(void))NULL,			/* psm_get_pir_ipivect	*/
+	(void (*)(processorid_t))NULL,		/* psm_send_pir_ipi	*/
+	(void (*)(processorid_t, boolean_t))NULL	/* psm_cmci_setup */
 };
 
 static struct psm_info xen_psm_info = {
diff --git a/usr/src/uts/i86xpv/io/psm/xpv_uppc.c b/usr/src/uts/i86xpv/io/psm/xpv_uppc.c
index d50b7f504e..0281a0ca43 100644
--- a/usr/src/uts/i86xpv/io/psm/xpv_uppc.c
+++ b/usr/src/uts/i86xpv/io/psm/xpv_uppc.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #define	PSMI_1_7
@@ -892,7 +893,11 @@ static struct psm_ops xen_uppc_ops = {
 	(int (*)(dev_info_t *, ddi_intr_handle_impl_t *,
 	    psm_intr_op_t, int *))NULL,		/* psm_intr_ops		*/
 	(int (*)(psm_state_request_t *))NULL,	/* psm_state		*/
-	(int (*)(psm_cpu_request_t *))NULL	/* psm_cpu_ops		*/
+	(int (*)(psm_cpu_request_t *))NULL,	/* psm_cpu_ops		*/
+
+	(int (*)(void))NULL,			/* psm_get_pir_ipivect	*/
+	(void (*)(processorid_t))NULL,		/* psm_send_pir_ipi	*/
+	(void (*)(processorid_t, boolean_t))NULL	/* psm_cmci_setup */
 };
 
 static struct psm_info xen_uppc_info = {
diff --git a/usr/src/uts/i86xpv/unix/Makefile b/usr/src/uts/i86xpv/unix/Makefile
index dae214bfa6..b244c02387 100644
--- a/usr/src/uts/i86xpv/unix/Makefile
+++ b/usr/src/uts/i86xpv/unix/Makefile
@@ -23,6 +23,8 @@
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright 2016 Joyent, Inc.
+#
 #	This makefile drives the production of unix (and unix.o).
 #
 #	i86xpv implementation architecture dependent
diff --git a/usr/src/uts/intel/Makefile b/usr/src/uts/intel/Makefile
index 6835ae84fd..1f873651ec 100644
--- a/usr/src/uts/intel/Makefile
+++ b/usr/src/uts/intel/Makefile
@@ -67,7 +67,7 @@ install_h.prereq	:=	TARGET= install_h
 
 .PARALLEL:	$(PARALLEL_KMODS) $(XMODS) config $(LINT_DEPS)
 
-def all install clean clobber modlist: $(KMODS) $(XMODS) config
+def all install clean clobber modlist: genassym $(KMODS) $(XMODS) config
 
 clobber: clobber.targ
 
@@ -109,7 +109,7 @@ CLOBBERFILES += $(PRIVS_C)
 # intel/dtrace depends on i86pc/genassym, so we need to build both
 # i86pc/genassym and intel/genassym.
 #
-all.prereq install.prereq def.prereq: genunix FRC
+all.prereq install.prereq def.prereq: genassym genunix FRC
 	@cd ../i86pc/genassym; pwd; $(MAKE) $(@:%.prereq=%)
 
 #
@@ -127,7 +127,7 @@ genunix: $(PRIVS_C)
 
 modlintlib clean.lint: $(LINT_KMODS) $(XMODS)
 
-$(KMODS) $(SUBDIRS) config:	FRC
+genassym $(KMODS) $(SUBDIRS) config:	FRC
 	@cd $@; pwd; $(MAKE) $(NO_STATE) $(TARGET)
 
 $(XMODS):	FRC
diff --git a/usr/src/uts/intel/Makefile.files b/usr/src/uts/intel/Makefile.files
index 4976e86cca..6fea629961 100644
--- a/usr/src/uts/intel/Makefile.files
+++ b/usr/src/uts/intel/Makefile.files
@@ -21,7 +21,7 @@
 
 #
 # Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
-# Copyright (c) 2013, Joyent, Inc. All rights reserved.
+# Copyright 2018, Joyent, Inc.
 # Copyright 2018 Nexenta Systems, Inc.
 #
 
@@ -101,6 +101,30 @@ GENUNIX_OBJS +=		\
 #
 CORE_OBJS +=		\
 	prmachdep.o
+ 
+LX_CGROUP_OBJS +=	\
+	cgrps_node.o	\
+	cgrps_vfsops.o	\
+	cgrps_vnops.o
+
+LX_DEVFS_OBJS +=	\
+	lxd_attrdb.o	\
+	lxd_node.o	\
+	lxd_vfsops.o	\
+	lxd_vnops.o
+
+LX_PROC_OBJS +=	\
+	lx_prsubr.o	\
+	lx_prvfsops.o	\
+	lx_prvnops.o
+
+LX_SYS_OBJS +=	\
+	lx_syssubr.o	\
+	lx_sysvfsops.o	\
+	lx_sysvnops.o
+
+LX_AUTOFS_OBJS +=	\
+	lx_autofs.o
 
 #
 #	ZFS file system module
@@ -218,8 +242,8 @@ ACPICA_OBJS	+= \
 		   utclib.o utcopy.o utdebug.o utdecode.o utdelete.o \
 		   uterror.o uteval.o utexcep.o utglobal.o uthex.o utids.o \
 		   utinit.o utlock.o utmath.o utmisc.o utmutex.o utnonansi.o \
-		   utobject.o utosi.o utownerid.o utpredef.o utprint.o \
-		   utresrc.o utstate.o utstring.o uttrack.o utuuid.o utxface.o \
+		   utobject.o utosi.o utownerid.o utpredef.o utresrc.o \
+		   utstate.o utstring.o uttrack.o utuuid.o utxface.o \
 		   utxferror.o utxfinit.o utxfmutex.o \
 		   \
 		   acpi_enum.o acpica_ec.o acpica.o ahids.o master_ops.o \
@@ -269,6 +293,74 @@ IOMMULIB_OBJS = iommulib.o
 #
 SN1_BRAND_OBJS	=	sn1_brand.o sn1_brand_asm.o
 S10_BRAND_OBJS	=	s10_brand.o s10_brand_asm.o
+LX_BRAND_OBJS  =		\
+	lx_access.o		\
+	lx_acct.o		\
+	lx_acl.o		\
+	lx_aio.o		\
+	lx_archdep.o		\
+	lx_audit.o		\
+	lx_auxv.o		\
+	lx_brand.o		\
+	lx_brk.o		\
+	lx_chmod.o		\
+	lx_chown.o		\
+	lx_clone.o		\
+	lx_close.o		\
+	lx_cpu.o		\
+	lx_dup.o		\
+	lx_errno.o		\
+	lx_epoll.o		\
+	lx_eventfd.o		\
+	lx_fadvise.o		\
+	lx_fallocate.o		\
+	lx_fcntl.o		\
+	lx_futex.o		\
+	lx_getcwd.o		\
+	lx_getdents.o		\
+	lx_getpid.o		\
+	lx_getrandom.o		\
+	lx_id.o			\
+	lx_ioctl.o		\
+	lx_ioprio.o		\
+	lx_kill.o		\
+	lx_link.o		\
+	lx_lseek.o		\
+	lx_mem.o		\
+	lx_misc.o		\
+	lx_miscsys.o		\
+	lx_mkdir.o		\
+	lx_modify_ldt.o		\
+	lx_mount.o		\
+	lx_lockd.o		\
+	lx_open.o		\
+	lx_personality.o	\
+	lx_pgrp.o		\
+	lx_pid.o		\
+	lx_pipe.o		\
+	lx_poll.o		\
+	lx_prctl.o		\
+	lx_priority.o		\
+	lx_ptrace.o		\
+	lx_rename.o		\
+	lx_rlimit.o		\
+	lx_rw.o			\
+	lx_sched.o		\
+	lx_signal.o		\
+	lx_signum.o		\
+	lx_socket.o		\
+	lx_splice.o		\
+	lx_stat.o		\
+	lx_sync.o		\
+	lx_syscall.o		\
+	lx_sysinfo.o		\
+	lx_thread_area.o	\
+	lx_time.o		\
+	lx_timer.o		\
+	lx_umask.o		\
+	lx_uname.o		\
+	lx_wait.o		\
+	lx_xattr.o
 
 #
 #	special files
diff --git a/usr/src/uts/intel/Makefile.intel b/usr/src/uts/intel/Makefile.intel
index a648a12c41..658c80cd32 100644
--- a/usr/src/uts/intel/Makefile.intel
+++ b/usr/src/uts/intel/Makefile.intel
@@ -46,6 +46,7 @@ PLATFORM	 = i86pc
 #
 UNIX_DIR	 = $(UTSBASE)/i86pc/unix
 GENLIB_DIR	 = $(UTSBASE)/intel/genunix
+GENASSYM_DIR	 = $(UTSBASE)/intel/genassym
 IPDRV_DIR	 = $(UTSBASE)/intel/ip
 MODSTUBS_DIR	 = $(UNIX_DIR)
 DSF_DIR		 = $(UTSBASE)/$(PLATFORM)/genassym
@@ -139,6 +140,7 @@ ASFLAGS_XARCH_64	= $(amd64_ASFLAGS)
 ASFLAGS_XARCH		= $(ASFLAGS_XARCH_$(CLASS))
 
 ASFLAGS			+= $(ASFLAGS_XARCH)
+AS_INC_PATH		+= -I$(GENASSYM_DIR)/$(OBJS_DIR)
 
 #
 #	Define the base directory for installation.
@@ -239,6 +241,7 @@ DRV_KMODS	+= devinfo
 DRV_KMODS	+= dld
 DRV_KMODS	+= dlpistub
 DRV_KMODS	+= dnet
+DRV_KMODS	+= dr_sas
 DRV_KMODS	+= dump
 DRV_KMODS	+= ecpp
 DRV_KMODS	+= emlxs
@@ -252,6 +255,7 @@ DRV_KMODS	+= i8042
 DRV_KMODS	+= i915
 DRV_KMODS	+= icmp
 DRV_KMODS	+= icmp6
+DRV_KMODS	+= inotify
 DRV_KMODS	+= intel_nb5000
 DRV_KMODS	+= intel_nhm
 DRV_KMODS	+= ip
@@ -287,6 +291,7 @@ DRV_KMODS	+= mpt_sas
 DRV_KMODS	+= mr_sas
 DRV_KMODS	+= mwl
 DRV_KMODS	+= nca
+DRV_KMODS	+= nfp
 DRV_KMODS	+= nsmb
 DRV_KMODS	+= nulldriver
 DRV_KMODS	+= nv_sata
@@ -355,6 +360,8 @@ DRV_KMODS	+= ural
 DRV_KMODS	+= uath
 DRV_KMODS	+= urtw
 DRV_KMODS	+= vgatext
+DRV_KMODS	+= vmxnet 
+DRV_KMODS	+= vnd
 DRV_KMODS	+= vnic
 DRV_KMODS	+= vscan
 DRV_KMODS	+= wc
@@ -363,8 +370,10 @@ DRV_KMODS	+= wpi
 DRV_KMODS	+= xge
 DRV_KMODS	+= yge
 DRV_KMODS	+= zcons
+DRV_KMODS	+= zfd
 DRV_KMODS	+= zyd
 DRV_KMODS	+= simnet
+DRV_KMODS	+= smrt
 DRV_KMODS	+= stmf
 DRV_KMODS	+= stmf_sbd
 DRV_KMODS	+= fct
@@ -517,7 +526,8 @@ DRV_KMODS	+= sol_umad
 #
 #	Brand modules
 #
-BRAND_KMODS	+= sn1_brand s10_brand
+BRAND_KMODS	+= sn1_brand s10_brand lx_brand
+DRV_KMODS	+= lx_systrace lx_ptm lx_netlink
 
 #
 #	Exec Class Modules (/kernel/exec):
@@ -532,10 +542,10 @@ SCHED_KMODS	+= IA RT TS RT_DPTBL TS_DPTBL FSS FX FX_DPTBL SDC
 #
 #	File System Modules (/kernel/fs):
 #
-FS_KMODS	+= autofs ctfs dcfs dev devfs fdfs fifofs hsfs lofs
-FS_KMODS	+= mntfs namefs nfs objfs zfs zut
-FS_KMODS	+= pcfs procfs sockfs specfs tmpfs udfs ufs sharefs
-FS_KMODS	+= smbfs bootfs
+FS_KMODS	+= autofs ctfs dcfs dev devfs fdfs fifofs hsfs hyprlofs
+FS_KMODS	+= lofs lxautofs lx_proc lxprocfs mntfs namefs nfs objfs zfs zut
+FS_KMODS	+= pcfs procfs sockfs specfs tmpfs udfs ufs sharefs lx_sysfs
+FS_KMODS	+= smbfs bootfs lx_cgroup lx_devfs
 
 #
 #	Streams Modules (/kernel/strmod):
@@ -595,6 +605,7 @@ MISC_KMODS	+= drm
 MISC_KMODS	+= fssnap_if
 MISC_KMODS	+= gda
 MISC_KMODS	+= gld
+MISC_KMODS	+= gsqueue
 MISC_KMODS	+= hidparser
 MISC_KMODS	+= hook
 MISC_KMODS	+= hpcsvc
@@ -710,6 +721,12 @@ MAC_KMODS	+= mac_wifi
 MAC_KMODS	+= mac_ib
 
 #
+#	Overlay related modules (/kernel/overlay)
+#
+DRV_KMODS	+= overlay
+OVERLAY_KMODS	+= vxlan
+
+#
 # socketmod (kernel/socketmod)
 #
 SOCKET_KMODS	+= sockpfp
@@ -717,6 +734,7 @@ SOCKET_KMODS	+= socksctp
 SOCKET_KMODS    += socksdp
 SOCKET_KMODS	+= sockrds
 SOCKET_KMODS	+= ksslf
+SOCKET_KMODS	+= datafilt
 
 #
 #	kiconv modules (/kernel/kiconv):
diff --git a/usr/src/uts/intel/Makefile.rules b/usr/src/uts/intel/Makefile.rules
index f0820c3ea6..7824f6c03d 100644
--- a/usr/src/uts/intel/Makefile.rules
+++ b/usr/src/uts/intel/Makefile.rules
@@ -102,47 +102,43 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/%.c
 $(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/%.s
 	$(COMPILE.s) -o $@ $<
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/debugger/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/events/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/events/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/hardware/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/hardware/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/dispatcher/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/dispatcher/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/executer/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/executer/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/parser/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/parser/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/namespace/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/namespace/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/resources/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/resources/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/tables/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/tables/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/utilities/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/utilities/%.c
-	$(COMPILE.c) -o $@ $<
-	$(CTFCONVERT_O)
-
-$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/acpica/disassembler/%.c
+$(OBJS_DIR)/%.o:		$(SRC)/common/acpica/disassembler/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
@@ -178,6 +174,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/intel_nb5000/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/vmxnet/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/intel/io/intel_nhm/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -357,37 +357,34 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/%.s
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/debugger/%.c
-	@($(LHEAD) $(LINT.c) $< $(LTAIL))
-
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/events/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/events/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/hardware/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/hardware/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/dispatcher/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/dispatcher/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/executer/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/executer/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/parser/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/parser/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/namespace/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/namespace/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/resources/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/resources/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/tables/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/tables/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/utilities/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/utilities/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
-$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/acpica/disassembler/%.c
+$(LINTS_DIR)/%.ln:		$(SRC)/common/acpica/disassembler/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/agpgart/%.c
@@ -459,6 +456,9 @@ $(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/scsi/targets/%.c
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/vgatext/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/vmxnet/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/io/vmxnet3s/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
diff --git a/usr/src/uts/intel/amd64/krtld/kobj_reloc.c b/usr/src/uts/intel/amd64/krtld/kobj_reloc.c
index 56c8087baa..9d34ec1310 100644
--- a/usr/src/uts/intel/amd64/krtld/kobj_reloc.c
+++ b/usr/src/uts/intel/amd64/krtld/kobj_reloc.c
@@ -23,6 +23,9 @@
  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright (c) 2017 Joyent, Inc.
+ */
 
 #pragma ident	"%Z%%M%	%I%	%E% SMI"
 
@@ -119,6 +122,57 @@ sdt_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
 	return (0);
 }
 
+
+/*
+ * We're relying on the fact that the call we're replacing is
+ * call (e8) plus 4 bytes of address, making a 5 byte instruction
+ */
+#define	NOP_INSTR	0x90
+#define	SMAP_NOPS	5
+
+/*
+ * Currently the only call replaced as a hot inline
+ * is smap_enable() and smap_disable(). If more are needed
+ * we should probably come up with an sdt probe like prefix
+ * and look for those instead of exact call names.
+ */
+static int
+smap_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
+{
+	uint_t symlen;
+	hotinline_desc_t *hid;
+
+	if (strcmp(symname, "smap_enable") == 0 ||
+	    strcmp(symname, "smap_disable") == 0) {
+
+#ifdef	KOBJ_DEBUG
+		if (kobj_debug & D_RELOCATIONS) {
+			_kobj_printf(ops, "smap_reloc_resolve: %s relocating "
+			    "enable/disable_smap\n", mp->filename);
+		}
+#endif
+
+		hid = kobj_alloc(sizeof (hotinline_desc_t), KM_WAIT);
+		symlen = strlen(symname) + 1;
+		hid->hid_symname = kobj_alloc(symlen, KM_WAIT);
+		bcopy(symname, hid->hid_symname, symlen);
+
+		/*
+		 * We backtrack one byte here to consume the call
+		 * instruction itself.
+		 */
+		hid->hid_instr_offset = (uintptr_t)instr - 1;
+		hid->hid_next = mp->hi_calls;
+		mp->hi_calls = hid;
+
+		memset((void *)hid->hid_instr_offset, NOP_INSTR, SMAP_NOPS);
+
+		return (0);
+	}
+
+	return (1);
+}
+
 int
 /* ARGSUSED2 */
 do_relocate(struct module *mp, char *reltbl, Word relshtype, int nreloc,
@@ -223,6 +277,11 @@ do_relocate(struct module *mp, char *reltbl, Word relshtype, int nreloc,
 					continue;
 
 				if (symref->st_shndx == SHN_UNDEF &&
+				    smap_reloc_resolve(mp, mp->strings +
+				    symref->st_name, (uint8_t *)off) == 0)
+					continue;
+
+				if (symref->st_shndx == SHN_UNDEF &&
 				    tnf_reloc_resolve(mp->strings +
 				    symref->st_name, &symref->st_value,
 				    &addend, off, &probelist, &taglist) != 0) {
diff --git a/usr/src/uts/intel/amd64/sys/kdi_regs.h b/usr/src/uts/intel/amd64/sys/kdi_regs.h
index 6fe698551f..80cfbd5150 100644
--- a/usr/src/uts/intel/amd64/sys/kdi_regs.h
+++ b/usr/src/uts/intel/amd64/sys/kdi_regs.h
@@ -29,6 +29,8 @@
 #ifndef _AMD64_SYS_KDI_REGS_H
 #define	_AMD64_SYS_KDI_REGS_H
 
+#include <sys/stddef.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -77,6 +79,53 @@ extern "C" {
 #define	KDIREG_SP	KDIREG_RSP
 #define	KDIREG_FP	KDIREG_RBP
 
+#if !defined(_ASM)
+
+/*
+ * Handy for debugging krs_gregs; keep in sync with the KDIREG_* above.
+ */
+typedef struct {
+	greg_t kr_savfp;
+	greg_t kr_savpc;
+	greg_t kr_rdi;
+	greg_t kr_rsi;
+	greg_t kr_rdx;
+	greg_t kr_rcx;
+	greg_t kr_r8;
+	greg_t kr_r9;
+	greg_t kr_rax;
+	greg_t kr_rbx;
+	greg_t kr_rbp;
+	greg_t r_r10;
+	greg_t r_r11;
+	greg_t r_r12;
+	greg_t r_r13;
+	greg_t r_r14;
+	greg_t r_r15;
+	greg_t kr_fsbase;
+	greg_t kr_gsbase;
+	greg_t kr_kgsbase;
+	greg_t kr_cr2;
+	greg_t kr_cr3;
+	greg_t kr_ds;
+	greg_t kr_es;
+	greg_t kr_fs;
+	greg_t kr_gs;
+	greg_t kr_trapno;
+	greg_t kr_err;
+	greg_t kr_rip;
+	greg_t kr_cs;
+	greg_t kr_rflags;
+	greg_t kr_rsp;
+	greg_t kr_ss;
+} kdiregs_t;
+
+#if defined(_KERNEL)
+CTASSERT(offsetof(kdiregs_t, kr_ss) == ((KDIREG_NGREG - 1) * sizeof (greg_t)));
+#endif
+
+#endif /* !_ASM */
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/usr/src/uts/intel/bpf/Makefile b/usr/src/uts/intel/bpf/Makefile
index b7136e61db..8986871c95 100644
--- a/usr/src/uts/intel/bpf/Makefile
+++ b/usr/src/uts/intel/bpf/Makefile
@@ -60,7 +60,7 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 #
 #
 CFLAGS		+= $(CCVERBOSE)
-LDFLAGS		+= -dy -Nmisc/mac -Nmisc/dls -Ndrv/ipnet -Nmisc/neti
+LDFLAGS		+= -dy -Nmisc/mac -Nmisc/dls -Ndrv/ipnet -Nmisc/neti -Ndrv/ip
 INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
diff --git a/usr/src/uts/intel/brand/lx/lx_archdep.c b/usr/src/uts/intel/brand/lx/lx_archdep.c
new file mode 100644
index 0000000000..24f3d2c446
--- /dev/null
+++ b/usr/src/uts/intel/brand/lx/lx_archdep.c
@@ -0,0 +1,1720 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+/*
+ * LX brand Intel-specific routines.
+ */
+
+#include <sys/types.h>
+#include <sys/sunddi.h>
+#include <sys/ddi.h>
+#include <sys/brand.h>
+#include <sys/lx_brand.h>
+#include <sys/lx_misc.h>
+#include <sys/privregs.h>
+#include <sys/pcb.h>
+#include <sys/archsystm.h>
+#include <sys/stack.h>
+#include <sys/sdt.h>
+#include <sys/sysmacros.h>
+#include <sys/psw.h>
+#include <lx_errno.h>
+
+/*
+ * Argument constants for fix_segreg.
+ * See usr/src/uts/intel/ia32/os/archdep.c for the originals.
+ */
+#define	IS_CS		1
+#define	IS_NOT_CS	0
+
+extern greg_t fix_segreg(greg_t, int, model_t);
+
+
+#define	LX_REG(ucp, r)	((ucp)->uc_mcontext.gregs[(r)])
+
+#define	PSLMERGE(oldval, newval)	\
+	(((oldval) & ~PSL_USERMASK) | ((newval) & PSL_USERMASK))
+
+#ifdef __amd64
+/* 64-bit native user_regs_struct */
+typedef struct lx_user_regs64 {
+	int64_t	lxur_r15;
+	int64_t	lxur_r14;
+	int64_t	lxur_r13;
+	int64_t	lxur_r12;
+	int64_t	lxur_rbp;
+	int64_t	lxur_rbx;
+	int64_t	lxur_r11;
+	int64_t	lxur_r10;
+	int64_t	lxur_r9;
+	int64_t	lxur_r8;
+	int64_t	lxur_rax;
+	int64_t	lxur_rcx;
+	int64_t	lxur_rdx;
+	int64_t	lxur_rsi;
+	int64_t	lxur_rdi;
+	int64_t	lxur_orig_rax;
+	int64_t	lxur_rip;
+	int64_t	lxur_xcs;
+	int64_t	lxur_rflags;
+	int64_t	lxur_rsp;
+	int64_t	lxur_xss;
+	int64_t	lxur_xfs_base;
+	int64_t	lxur_xgs_base;
+	int64_t	lxur_xds;
+	int64_t	lxur_xes;
+	int64_t	lxur_xfs;
+	int64_t	lxur_xgs;
+} lx_user_regs64_t;
+
+/* 64-bit native user_fpregs_struct */
+typedef struct lx_user_fpregs64 {
+	uint16_t	lxufp_cwd;
+	uint16_t	lxufp_swd;
+	uint16_t	lxufp_ftw;
+	uint16_t	lxufp_fop;
+	uint64_t	lxufp_rip;
+	uint64_t	lxufp_rdp;
+	uint32_t	lxufp_mxcsr;
+	uint32_t	lxufp_mxcr_mask;
+	/* 8*16 bytes for each FP-reg = 128 bytes */
+	uint32_t	lxufp_st_space[32];
+	/* 16*16 bytes for each XMM-reg = 256 bytes */
+	uint32_t	lxufp_xmm_space[64];
+	uint32_t	lxufp_padding[24];
+} lx_user_fpregs64_t;
+
+/* 64-bit native user_struct */
+typedef struct lx_user64 {
+	lx_user_regs64_t	lxu_regs;
+	int32_t			lxu_fpvalid;
+	int32_t			lxu_pad0;
+	lx_user_fpregs64_t	lxu_i387;
+	uint64_t		lxu_tsize;
+	uint64_t		lxu_dsize;
+	uint64_t		lxu_ssize;
+	uint64_t		lxu_start_code;
+	uint64_t		lxu_start_stack;
+	int64_t			lxu_signal;
+	int32_t			lxu_reserved;
+	int32_t			lxu_pad1;
+	/* help gdb to locate user_regs structure */
+	caddr_t			lxu_ar0;
+	/* help gdb to locate user_fpregs structure */
+	caddr_t			lxu_fpstate;
+	uint64_t		lxu_magic;
+	char			lxu_comm[32];
+	uint64_t		lxu_debugreg[8];
+	uint64_t		lxu_error_code;
+	uint64_t		lxu_fault_address;
+} lx_user64_t;
+
+#endif /* __amd64 */
+
+/* 32-bit native user_regs_struct */
+typedef struct lx_user_regs32 {
+	int32_t	lxur_ebx;
+	int32_t	lxur_ecx;
+	int32_t	lxur_edx;
+	int32_t	lxur_esi;
+	int32_t	lxur_edi;
+	int32_t	lxur_ebp;
+	int32_t	lxur_eax;
+	int32_t	lxur_xds;
+	int32_t	lxur_xes;
+	int32_t	lxur_xfs;
+	int32_t	lxur_xgs;
+	int32_t	lxur_orig_eax;
+	int32_t	lxur_eip;
+	int32_t	lxur_xcs;
+	int32_t	lxur_eflags;
+	int32_t	lxur_esp;
+	int32_t	lxur_xss;
+} lx_user_regs32_t;
+
+/* 32-bit native user_fpregs_struct */
+typedef struct lx_user_fpregs32 {
+	int32_t		lxufp_cwd;
+	int32_t		lxufp_swd;
+	int32_t		lxufp_twd;
+	int32_t		lxufp_fip;
+	int32_t		lxufp_fcs;
+	int32_t		lxufp_foo;
+	int32_t		lxufp_fos;
+	int32_t		lxufp_st_space[20];
+} lx_user_fpregs32_t;
+
+/* 32-bit native user_fpxregs_struct */
+typedef struct lx_user_fpxregs32 {
+	uint16_t	lxufpx_cwd;
+	uint16_t	lxufpx_swd;
+	uint16_t	lxufpx_twd;
+	uint16_t	lxufpx_fop;
+	int32_t		lxufpx_fip;
+	int32_t		lxufpx_fcs;
+	int32_t		lxufpx_foo;
+	int32_t		lxufpx_fos;
+	int32_t		lxufpx_mxcsr;
+	int32_t		lxufpx_reserved;
+	/* 8*16 bytes for each FP-reg = 128 bytes */
+	int32_t		lxufpx_st_space[32];
+	/* 8*16 bytes for each XMM-reg = 128 bytes */
+	int32_t		lxufpx_xmm_space[32];
+	int32_t		lxufpx_padding[56];
+} lx_user_fpxregs32_t;
+
+/* 32-bit native user_struct */
+typedef struct lx_user32 {
+	lx_user_regs32_t	lxu_regs;
+	int32_t			lxu_fpvalid;
+	lx_user_fpregs32_t	lxu_i387;
+	uint32_t		lxu_tsize;
+	uint32_t		lxu_dsize;
+	uint32_t		lxu_ssize;
+	uint32_t		lxu_start_code;
+	uint32_t		lxu_start_stack;
+	int32_t			lxu_signal;
+	int32_t			lxu_reserved;
+	caddr32_t		lxu_ar0;
+	caddr32_t		lxu_fpstate;
+	uint32_t		lxu_magic;
+	char			lxu_comm[32];
+	int32_t			lxu_debugreg[8];
+} lx_user32_t;
+
+/*
+ * Certain version of strace (on centos6 for example) use the %cs value to
+ * determine what kind of process is being traced. Here is a sample comment:
+ *	Check CS register value. On x86-64 linux it is:
+ *	    0x33	for long mode (64 bit and x32))
+ *	    0x23	for compatibility mode (32 bit)
+ *	%ds = 0x2b for x32 mode (x86-64 in 32 bit)
+ * We can't change the %cs value in the ucp (see setgregs and _sys_rtt) so we
+ * emulate the expected value for ptrace use.
+ */
+#define	LX_CS_64BIT	0x33
+#define	LX_CS_32BIT	0x23
+
+extern int getsetcontext(int, void *);
+#if defined(_SYSCALL32_IMPL)
+extern int getsetcontext32(int, void *);
+#endif
+
+static int
+lx_rw_uc(proc_t *p, void *ucp, void *kucp, size_t ucsz, boolean_t writing)
+{
+	int error = 0;
+	size_t rem = ucsz;
+	off_t pos = 0;
+
+	VERIFY(MUTEX_HELD(&p->p_lock));
+
+	/*
+	 * Grab P_PR_LOCK so that we can drop p_lock while doing I/O.
+	 */
+	sprlock_proc(p);
+
+	/*
+	 * Drop p_lock while we do I/O to avoid deadlock with the clock thread.
+	 */
+	mutex_exit(&p->p_lock);
+	while (rem != 0) {
+		uintptr_t addr = (uintptr_t)ucp + pos;
+		size_t len = MIN(rem, PAGESIZE - (addr & PAGEOFFSET));
+
+		if (writing) {
+			error = uwrite(p, (caddr_t)kucp + pos, len, addr);
+		} else {
+			error = uread(p, (caddr_t)kucp + pos, len, addr);
+		}
+
+		if (error != 0) {
+			break;
+		}
+
+		rem -= len;
+		pos += len;
+	}
+	mutex_enter(&p->p_lock);
+
+	sprunlock(p);
+	mutex_enter(&p->p_lock);
+
+	return (error);
+}
+
+/*
+ * Read a ucontext_t from the target process, which may or may not be
+ * the current process.
+ */
+static int
+lx_read_uc(proc_t *p, void *ucp, void *kucp, size_t ucsz)
+{
+	return (lx_rw_uc(p, ucp, kucp, ucsz, B_FALSE));
+}
+
+/*
+ * Write a ucontext_t to the target process, which may or may not be
+ * the current process.
+ */
+static int
+lx_write_uc(proc_t *p, void *ucp, void *kucp, size_t ucsz)
+{
+	return (lx_rw_uc(p, ucp, kucp, ucsz, B_TRUE));
+}
+
+static void
+lx_getfpregs32(lx_lwp_data_t *lwpd, lx_user_fpregs32_t *lfp)
+{
+#ifdef __amd64
+	fpregset32_t fp;
+	getfpregs32(lwpd->br_lwp, &fp);
+#else /* __i386 */
+	fpregset_t fp;
+	getfpregs(lwpd->br_lwp, &fp);
+#endif /* __amd64 */
+
+	/*
+	 * The fpchip_state.state field should correspond to all 27 fields in
+	 * the 32-bit structure.
+	 */
+	bcopy(&fp.fp_reg_set.fpchip_state.state, lfp, sizeof (*lfp));
+}
+
+static void
+lx_setfpregs32(lx_lwp_data_t *lwpd, lx_user_fpregs32_t *lfp)
+{
+#ifdef __amd64
+	fpregset32_t fp;
+#else /* __i386 */
+	fpregset_t fp;
+#endif /* __amd64 */
+
+	/*
+	 * The fpchip_state field should correspond to all 27 fields in the
+	 * native 32-bit structure.
+	 */
+	bcopy(lfp, &fp.fp_reg_set.fpchip_state.state, sizeof (*lfp));
+
+#ifdef __amd64
+	setfpregs32(lwpd->br_lwp, &fp);
+#else /* __i386 */
+	setfpregs(lwpd->br_lwp, &fp);
+#endif /* __amd64 */
+}
+
+static int
+lx_get_user_regs32_uc(klwp_t *lwp, void *ucp, lx_user_regs32_t *lxrp)
+{
+	proc_t *p = lwptoproc(lwp);
+	ucontext32_t uc;
+
+	if (lx_read_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+		return (-1);
+	}
+
+	lxrp->lxur_ebx = LX_REG(&uc, EBX);
+	lxrp->lxur_ecx = LX_REG(&uc, ECX);
+	lxrp->lxur_edx = LX_REG(&uc, EDX);
+	lxrp->lxur_esi = LX_REG(&uc, ESI);
+	lxrp->lxur_edi = LX_REG(&uc, EDI);
+	lxrp->lxur_ebp = LX_REG(&uc, EBP);
+	lxrp->lxur_eax = LX_REG(&uc, EAX);
+	lxrp->lxur_orig_eax = 0;
+
+	lxrp->lxur_eip = LX_REG(&uc, EIP);
+	lxrp->lxur_eflags = LX_REG(&uc, EFL);
+	lxrp->lxur_esp = LX_REG(&uc, UESP);
+	lxrp->lxur_xss = LX_REG(&uc, SS);
+
+	/* emulated %cs, see defines */
+	lxrp->lxur_xcs = LX_CS_32BIT;
+	lxrp->lxur_xds = LX_REG(&uc, DS);
+	lxrp->lxur_xes = LX_REG(&uc, ES);
+	lxrp->lxur_xfs = LX_REG(&uc, FS);
+	lxrp->lxur_xgs = LX_REG(&uc, GS);
+	return (0);
+}
+
+static int
+lx_get_user_regs32(lx_lwp_data_t *lwpd, lx_user_regs32_t *lxrp)
+{
+	klwp_t *lwp = lwpd->br_lwp;
+	struct regs *rp = lwptoregs(lwp);
+	void *ucp;
+#ifdef __amd64
+	struct pcb *pcb = &lwp->lwp_pcb;
+#endif
+
+	VERIFY(lwp_getdatamodel(lwp) == DATAMODEL_ILP32);
+
+	switch (lx_regs_location(lwpd, &ucp, B_FALSE)) {
+	case LX_REG_LOC_UNAVAIL:
+		return (-1);
+
+	case LX_REG_LOC_UCP:
+		return (lx_get_user_regs32_uc(lwp, ucp, lxrp));
+
+	case LX_REG_LOC_LWP:
+		/* transformation below */
+		break;
+
+	default:
+		VERIFY(0);
+		break;
+	}
+
+#ifdef __amd64
+	lxrp->lxur_ebx = (int32_t)rp->r_rbx;
+	lxrp->lxur_ecx = (int32_t)rp->r_rcx;
+	lxrp->lxur_edx = (int32_t)rp->r_rdx;
+	lxrp->lxur_esi = (int32_t)rp->r_rsi;
+	lxrp->lxur_edi = (int32_t)rp->r_rdi;
+	lxrp->lxur_ebp = (int32_t)rp->r_rbp;
+	lxrp->lxur_eax = (int32_t)rp->r_rax;
+	lxrp->lxur_orig_eax = 0;
+	lxrp->lxur_eip = (int32_t)rp->r_rip;
+	lxrp->lxur_eflags = (int32_t)rp->r_rfl;
+	lxrp->lxur_esp = (int32_t)rp->r_rsp;
+	lxrp->lxur_xss = (int32_t)rp->r_ss;
+
+	kpreempt_disable();
+	if (PCB_NEED_UPDATE_SEGS(pcb)) {
+		lxrp->lxur_xds = pcb->pcb_ds;
+		lxrp->lxur_xes = pcb->pcb_es;
+		lxrp->lxur_xfs = pcb->pcb_fs;
+		lxrp->lxur_xgs = pcb->pcb_gs;
+	} else {
+		lxrp->lxur_xds = rp->r_ds;
+		lxrp->lxur_xes = rp->r_es;
+		lxrp->lxur_xfs = rp->r_fs;
+		lxrp->lxur_xgs = rp->r_gs;
+	}
+	kpreempt_enable();
+#else /* __i386 */
+	lxrp->lxur_ebx = rp->r_ebx;
+	lxrp->lxur_ecx = rp->r_ecx;
+	lxrp->lxur_edx = rp->r_edx;
+	lxrp->lxur_esi = rp->r_esi;
+	lxrp->lxur_edi = rp->r_edi;
+	lxrp->lxur_ebp = rp->r_ebp;
+	lxrp->lxur_eax = rp->r_eax;
+	lxrp->lxur_orig_eax = 0;
+	lxrp->lxur_eip = rp->r_eip;
+	lxrp->lxur_eflags = rp->r_efl;
+	lxrp->lxur_esp = rp->r_esp;
+	lxrp->lxur_xss = rp->r_ss;
+
+	lxrp->lxur_xds = rp->r_ds;
+	lxrp->lxur_xes = rp->r_es;
+	lxrp->lxur_xfs = rp->r_fs;
+	lxrp->lxur_xgs = rp->r_gs;
+#endif /* __amd64 */
+
+	/* emulated %cs, see defines */
+	lxrp->lxur_xcs = LX_CS_32BIT;
+
+	if (lwpd->br_ptrace_whatstop == LX_PR_SYSENTRY) {
+		lxrp->lxur_eax = (int32_t)-lx_errno(ENOTSUP, EINVAL);
+		lxrp->lxur_orig_eax = (int32_t)lwpd->br_syscall_num;
+	} else if (lwpd->br_ptrace_whatstop == LX_PR_SYSEXIT) {
+		lxrp->lxur_orig_eax = (int32_t)lwpd->br_syscall_num;
+	}
+
+	return (0);
+}
+
+static int
+lx_set_user_regs32_uc(klwp_t *lwp, void *ucp, lx_user_regs32_t *lxrp)
+{
+	proc_t *p = lwptoproc(lwp);
+	ucontext32_t uc;
+
+	if (lx_read_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+		return (-1);
+	}
+
+	/*
+	 * Note: we currently ignore "lxur_orig_rax" here since this
+	 * path should not be used for system call stops.
+	 */
+	LX_REG(&uc, EBP) = lxrp->lxur_ebp;
+	LX_REG(&uc, EBX) = lxrp->lxur_ebx;
+	LX_REG(&uc, EAX) = lxrp->lxur_eax;
+	LX_REG(&uc, ECX) = lxrp->lxur_ecx;
+	LX_REG(&uc, EDX) = lxrp->lxur_edx;
+	LX_REG(&uc, ESI) = lxrp->lxur_esi;
+	LX_REG(&uc, EDI) = lxrp->lxur_edi;
+	LX_REG(&uc, EIP) = lxrp->lxur_eip;
+	LX_REG(&uc, EFL) = PSLMERGE(LX_REG(&uc, EFL), lxrp->lxur_eflags);
+	LX_REG(&uc, UESP) = lxrp->lxur_esp;
+	LX_REG(&uc, SS) = fix_segreg(lxrp->lxur_xss, IS_NOT_CS,
+	    DATAMODEL_ILP32);
+
+	/* %cs is ignored because of our lies */
+	LX_REG(&uc, DS) = fix_segreg(lxrp->lxur_xds, IS_NOT_CS,
+	    DATAMODEL_ILP32);
+	LX_REG(&uc, ES) = fix_segreg(lxrp->lxur_xes, IS_NOT_CS,
+	    DATAMODEL_ILP32);
+	LX_REG(&uc, FS) = fix_segreg(lxrp->lxur_xfs, IS_NOT_CS,
+	    DATAMODEL_ILP32);
+	LX_REG(&uc, GS) = fix_segreg(lxrp->lxur_xgs, IS_NOT_CS,
+	    DATAMODEL_ILP32);
+
+	if (lx_write_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+		return (-1);
+	}
+	return (0);
+}
+
+static int
+lx_set_user_regs32(lx_lwp_data_t *lwpd, lx_user_regs32_t *lxrp)
+{
+	klwp_t *lwp = lwpd->br_lwp;
+	struct regs *rp = lwptoregs(lwp);
+	void *ucp;
+#ifdef __amd64
+	struct pcb *pcb = &lwp->lwp_pcb;
+#endif
+
+	VERIFY(lwp_getdatamodel(lwp) == DATAMODEL_ILP32);
+
+	switch (lx_regs_location(lwpd, &ucp, B_TRUE)) {
+	case LX_REG_LOC_UNAVAIL:
+		return (-1);
+
+	case LX_REG_LOC_UCP:
+		return (lx_set_user_regs32_uc(lwp, ucp, lxrp));
+
+	case LX_REG_LOC_LWP:
+		/* transformation below */
+		break;
+
+	default:
+		VERIFY(0);
+		break;
+	}
+
+#ifdef __amd64
+	rp->r_rbx = (int32_t)lxrp->lxur_ebx;
+	rp->r_rcx = (int32_t)lxrp->lxur_ecx;
+	rp->r_rdx = (int32_t)lxrp->lxur_edx;
+	rp->r_rsi = (int32_t)lxrp->lxur_esi;
+	rp->r_rdi = (int32_t)lxrp->lxur_edi;
+	rp->r_rbp = (int32_t)lxrp->lxur_ebp;
+	rp->r_rax = (int32_t)lxrp->lxur_eax;
+	lwpd->br_syscall_num = (int)lxrp->lxur_orig_eax;
+	rp->r_rip = (int32_t)lxrp->lxur_eip;
+	rp->r_rfl = (int32_t)PSLMERGE(rp->r_rfl, lxrp->lxur_eflags);
+	rp->r_rsp = (int32_t)lxrp->lxur_esp;
+	rp->r_ss = (int32_t)fix_segreg(lxrp->lxur_xss, IS_NOT_CS,
+	    DATAMODEL_ILP32);
+
+	kpreempt_disable();
+	PCB_SET_UPDATE_SEGS(pcb);
+	pcb->pcb_ds = fix_segreg(lxrp->lxur_xds, IS_NOT_CS, DATAMODEL_ILP32);
+	pcb->pcb_es = fix_segreg(lxrp->lxur_xes, IS_NOT_CS, DATAMODEL_ILP32);
+	pcb->pcb_fs = fix_segreg(lxrp->lxur_xfs, IS_NOT_CS, DATAMODEL_ILP32);
+	pcb->pcb_gs = fix_segreg(lxrp->lxur_xgs, IS_NOT_CS, DATAMODEL_ILP32);
+	kpreempt_enable();
+#else /* __i386 */
+	rp->r_ebx = lxrp->lxur_ebx;
+	rp->r_ecx = lxrp->lxur_ecx;
+	rp->r_edx = lxrp->lxur_edx;
+	rp->r_esi = lxrp->lxur_esi;
+	rp->r_edi = lxrp->lxur_edi;
+	rp->r_ebp = lxrp->lxur_ebp;
+	rp->r_eax = lxrp->lxur_eax;
+	lwpd->br_syscall_num = (int)lxrp->lxur_orig_eax;
+	rp->r_eip = lxrp->lxur_eip;
+	rp->r_efl = PSLMERGE(rp->r_efl, lxrp->lxur_eflags);
+	rp->r_esp = lxrp->lxur_esp;
+	rp->r_ss = fix_segreg(lxrp->lxur_xss, IS_NOT_CS, DATAMODEL_ILP32);
+
+	rp->r_ds = fix_segreg(lxrp->lxur_xds, IS_NOT_CS, DATAMODEL_ILP32);
+	rp->r_es = fix_segreg(lxrp->lxur_xes, IS_NOT_CS, DATAMODEL_ILP32);
+	rp->r_fs = fix_segreg(lxrp->lxur_xfs, IS_NOT_CS, DATAMODEL_ILP32);
+	rp->r_gs = fix_segreg(lxrp->lxur_xgs, IS_NOT_CS, DATAMODEL_ILP32);
+#endif /* __amd64 */
+
+	return (0);
+}
+
+#ifdef __amd64
+
+static void
+lx_getfpregs64(lx_lwp_data_t *lwpd, lx_user_fpregs64_t *lfp)
+{
+	fpregset_t fp;
+
+	getfpregs(lwpd->br_lwp, &fp);
+	/* Drop the extra illumos status/xstatus fields when copying state */
+	bcopy(&fp.fp_reg_set.fpchip_state, lfp, sizeof (*lfp));
+}
+
+static void
+lx_setfpregs64(lx_lwp_data_t *lwpd, lx_user_fpregs64_t *lfp)
+{
+	fpregset_t fp;
+
+	/*
+	 * Since the Linux fpregs structure does not contain the same
+	 * additional status register which illumos contains, we simply
+	 * preserve the existing values when setting fp state.
+	 */
+	getfpregs(lwpd->br_lwp, &fp);
+
+	/* Copy the identically formatted state */
+	bcopy(lfp, &fp.fp_reg_set.fpchip_state, sizeof (*lfp));
+
+	setfpregs(lwpd->br_lwp, &fp);
+}
+
+static int
+lx_get_user_regs64_uc(klwp_t *lwp, void *ucp, lx_user_regs64_t *lxrp)
+{
+	proc_t *p = lwptoproc(lwp);
+
+	switch (lwp_getdatamodel(lwp)) {
+	case DATAMODEL_LP64: {
+		ucontext_t uc;
+
+		if (lx_read_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+			return (-1);
+		}
+
+		lxrp->lxur_r15 = LX_REG(&uc, REG_R15);
+		lxrp->lxur_r14 = LX_REG(&uc, REG_R14);
+		lxrp->lxur_r13 = LX_REG(&uc, REG_R13);
+		lxrp->lxur_r12 = LX_REG(&uc, REG_R12);
+		lxrp->lxur_rbp = LX_REG(&uc, REG_RBP);
+		lxrp->lxur_rbx = LX_REG(&uc, REG_RBX);
+		lxrp->lxur_r11 = LX_REG(&uc, REG_R11);
+		lxrp->lxur_r10 = LX_REG(&uc, REG_R10);
+		lxrp->lxur_r9 = LX_REG(&uc, REG_R9);
+		lxrp->lxur_r8 = LX_REG(&uc, REG_R8);
+		lxrp->lxur_rax = LX_REG(&uc, REG_RAX);
+		lxrp->lxur_rcx = LX_REG(&uc, REG_RCX);
+		lxrp->lxur_rdx = LX_REG(&uc, REG_RDX);
+		lxrp->lxur_rsi = LX_REG(&uc, REG_RSI);
+		lxrp->lxur_rdi = LX_REG(&uc, REG_RDI);
+		lxrp->lxur_orig_rax = 0;
+		lxrp->lxur_rip = LX_REG(&uc, REG_RIP);
+		lxrp->lxur_rflags = LX_REG(&uc, REG_RFL);
+		lxrp->lxur_rsp = LX_REG(&uc, REG_RSP);
+		lxrp->lxur_xss = LX_REG(&uc, REG_SS);
+		lxrp->lxur_xfs_base = LX_REG(&uc, REG_FSBASE);
+		lxrp->lxur_xgs_base = LX_REG(&uc, REG_GSBASE);
+
+		lxrp->lxur_xds = LX_REG(&uc, REG_DS);
+		lxrp->lxur_xes = LX_REG(&uc, REG_ES);
+		lxrp->lxur_xfs = LX_REG(&uc, REG_FS);
+		lxrp->lxur_xgs = LX_REG(&uc, REG_GS);
+
+		/* emulated %cs, see defines */
+		lxrp->lxur_xcs = LX_CS_64BIT;
+		return (0);
+	}
+
+	case DATAMODEL_ILP32: {
+		ucontext32_t uc;
+
+		if (lx_read_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+			return (-1);
+		}
+
+		lxrp->lxur_r15 = 0;
+		lxrp->lxur_r14 = 0;
+		lxrp->lxur_r13 = 0;
+		lxrp->lxur_r12 = 0;
+		lxrp->lxur_r11 = 0;
+		lxrp->lxur_r10 = 0;
+		lxrp->lxur_r9 = 0;
+		lxrp->lxur_r8 = 0;
+		lxrp->lxur_rbp = LX_REG(&uc, EBP);
+		lxrp->lxur_rbx = LX_REG(&uc, EBX);
+		lxrp->lxur_rax = LX_REG(&uc, EAX);
+		lxrp->lxur_orig_rax = 0;
+		lxrp->lxur_rcx = LX_REG(&uc, ECX);
+		lxrp->lxur_rdx = LX_REG(&uc, EDX);
+		lxrp->lxur_rsi = LX_REG(&uc, ESI);
+		lxrp->lxur_rdi = LX_REG(&uc, EDI);
+		lxrp->lxur_rip = LX_REG(&uc, EIP);
+
+		lxrp->lxur_rflags = LX_REG(&uc, EFL);
+		lxrp->lxur_rsp = LX_REG(&uc, UESP);
+		lxrp->lxur_xss = LX_REG(&uc, SS);
+		lxrp->lxur_xfs_base = 0;
+		lxrp->lxur_xgs_base = 0;
+
+		lxrp->lxur_xds = LX_REG(&uc, DS);
+		lxrp->lxur_xes = LX_REG(&uc, ES);
+		lxrp->lxur_xfs = LX_REG(&uc, FS);
+		lxrp->lxur_xgs = LX_REG(&uc, GS);
+
+		/* See comment above re: %cs register */
+		lxrp->lxur_xcs = LX_CS_32BIT;
+		return (0);
+	}
+
+	default:
+		break;
+	}
+
+	return (-1);
+}
+
+static int
+lx_get_user_regs64(lx_lwp_data_t *lwpd, lx_user_regs64_t *lxrp)
+{
+	klwp_t *lwp = lwpd->br_lwp;
+	struct regs *rp = lwptoregs(lwp);
+	struct pcb *pcb = &lwp->lwp_pcb;
+	void *ucp;
+
+	switch (lx_regs_location(lwpd, &ucp, B_FALSE)) {
+	case LX_REG_LOC_UNAVAIL:
+		return (-1);
+
+	case LX_REG_LOC_UCP:
+		return (lx_get_user_regs64_uc(lwp, ucp, lxrp));
+
+	case LX_REG_LOC_LWP:
+		/* transformation below */
+		break;
+
+	default:
+		VERIFY(0);
+		break;
+	}
+
+	lxrp->lxur_r15 = rp->r_r15;
+	lxrp->lxur_r14 = rp->r_r14;
+	lxrp->lxur_r13 = rp->r_r13;
+	lxrp->lxur_r12 = rp->r_r12;
+	lxrp->lxur_rbp = rp->r_rbp;
+	lxrp->lxur_rbx = rp->r_rbx;
+	lxrp->lxur_r11 = rp->r_r11;
+	lxrp->lxur_r10 = rp->r_r10;
+	lxrp->lxur_r9 = rp->r_r9;
+	lxrp->lxur_r8 = rp->r_r8;
+	lxrp->lxur_rax = rp->r_rax;
+	lxrp->lxur_rcx = rp->r_rcx;
+	lxrp->lxur_rdx = rp->r_rdx;
+	lxrp->lxur_rsi = rp->r_rsi;
+	lxrp->lxur_rdi = rp->r_rdi;
+	lxrp->lxur_orig_rax = 0;
+	lxrp->lxur_rip = rp->r_rip;
+
+	lxrp->lxur_rflags = rp->r_rfl;
+	lxrp->lxur_rsp = rp->r_rsp;
+	lxrp->lxur_xss = rp->r_ss;
+	lxrp->lxur_xfs_base = pcb->pcb_fsbase;
+	lxrp->lxur_xgs_base = pcb->pcb_gsbase;
+
+	/* emulated %cs, see defines */
+	switch (lwp_getdatamodel(lwp)) {
+	case DATAMODEL_LP64:
+		lxrp->lxur_xcs = LX_CS_64BIT;
+		break;
+	case DATAMODEL_ILP32:
+		lxrp->lxur_xcs = LX_CS_32BIT;
+		break;
+	default:
+		VERIFY(0);
+		break;
+	}
+
+	kpreempt_disable();
+	if (PCB_NEED_UPDATE_SEGS(pcb)) {
+		lxrp->lxur_xds = pcb->pcb_ds;
+		lxrp->lxur_xes = pcb->pcb_es;
+		lxrp->lxur_xfs = pcb->pcb_fs;
+		lxrp->lxur_xgs = pcb->pcb_gs;
+	} else {
+		lxrp->lxur_xds = rp->r_ds;
+		lxrp->lxur_xes = rp->r_es;
+		lxrp->lxur_xfs = rp->r_fs;
+		lxrp->lxur_xgs = rp->r_gs;
+	}
+	kpreempt_enable();
+
+	if (lwpd->br_ptrace_whatstop == LX_PR_SYSENTRY) {
+		lxrp->lxur_rax = -lx_errno(ENOTSUP, EINVAL);
+		lxrp->lxur_orig_rax = lwpd->br_syscall_num;
+	} else if (lwpd->br_ptrace_whatstop == LX_PR_SYSEXIT) {
+		lxrp->lxur_orig_rax = lwpd->br_syscall_num;
+	}
+
+	return (0);
+}
+
+static int
+lx_set_user_regs64_uc(klwp_t *lwp, void *ucp, lx_user_regs64_t *lxrp)
+{
+	proc_t *p = lwptoproc(lwp);
+
+	switch (lwp_getdatamodel(lwp)) {
+	case DATAMODEL_LP64: {
+		ucontext_t uc;
+
+		if (lx_read_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+			return (-1);
+		}
+
+		/*
+		 * Note: we currently ignore "lxur_orig_rax" here since this
+		 * path should not be used for system call stops.
+		 */
+		LX_REG(&uc, REG_R15) = lxrp->lxur_r15;
+		LX_REG(&uc, REG_R14) = lxrp->lxur_r14;
+		LX_REG(&uc, REG_R13) = lxrp->lxur_r13;
+		LX_REG(&uc, REG_R12) = lxrp->lxur_r12;
+		LX_REG(&uc, REG_RBP) = lxrp->lxur_rbp;
+		LX_REG(&uc, REG_RBX) = lxrp->lxur_rbx;
+		LX_REG(&uc, REG_R11) = lxrp->lxur_r11;
+		LX_REG(&uc, REG_R10) = lxrp->lxur_r10;
+		LX_REG(&uc, REG_R9) = lxrp->lxur_r9;
+		LX_REG(&uc, REG_R8) = lxrp->lxur_r8;
+		LX_REG(&uc, REG_RAX) = lxrp->lxur_rax;
+		LX_REG(&uc, REG_RCX) = lxrp->lxur_rcx;
+		LX_REG(&uc, REG_RDX) = lxrp->lxur_rdx;
+		LX_REG(&uc, REG_RSI) = lxrp->lxur_rsi;
+		LX_REG(&uc, REG_RDI) = lxrp->lxur_rdi;
+		LX_REG(&uc, REG_RIP) = lxrp->lxur_rip;
+		LX_REG(&uc, REG_RFL) = PSLMERGE(LX_REG(&uc, REG_RFL),
+		    lxrp->lxur_rflags);
+		LX_REG(&uc, REG_RSP) = lxrp->lxur_rsp;
+		LX_REG(&uc, REG_SS) = fix_segreg(lxrp->lxur_xss, IS_NOT_CS,
+		    DATAMODEL_LP64);
+		LX_REG(&uc, REG_FSBASE) = lxrp->lxur_xfs_base;
+		LX_REG(&uc, REG_GSBASE) = lxrp->lxur_xgs_base;
+
+		/* %cs is ignored because of our lies */
+		LX_REG(&uc, REG_DS) = fix_segreg(lxrp->lxur_xds, IS_NOT_CS,
+		    DATAMODEL_LP64);
+		LX_REG(&uc, REG_ES) = fix_segreg(lxrp->lxur_xes, IS_NOT_CS,
+		    DATAMODEL_LP64);
+		LX_REG(&uc, REG_FS) = fix_segreg(lxrp->lxur_xfs, IS_NOT_CS,
+		    DATAMODEL_LP64);
+		LX_REG(&uc, REG_GS) = fix_segreg(lxrp->lxur_xgs, IS_NOT_CS,
+		    DATAMODEL_LP64);
+
+		if (lx_write_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+			return (-1);
+		}
+
+		return (0);
+	}
+
+	case DATAMODEL_ILP32: {
+		ucontext32_t uc;
+
+		if (lx_read_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+			return (-1);
+		}
+
+		/*
+		 * Note: we currently ignore "lxur_orig_rax" here since this
+		 * path should not be used for system call stops.
+		 */
+		LX_REG(&uc, EBP) = (int32_t)lxrp->lxur_rbp;
+		LX_REG(&uc, EBX) = (int32_t)lxrp->lxur_rbx;
+		LX_REG(&uc, EAX) = (int32_t)lxrp->lxur_rax;
+		LX_REG(&uc, ECX) = (int32_t)lxrp->lxur_rcx;
+		LX_REG(&uc, EDX) = (int32_t)lxrp->lxur_rdx;
+		LX_REG(&uc, ESI) = (int32_t)lxrp->lxur_rsi;
+		LX_REG(&uc, EDI) = (int32_t)lxrp->lxur_rdi;
+		LX_REG(&uc, EIP) = (int32_t)lxrp->lxur_rip;
+		LX_REG(&uc, EFL) = (int32_t)PSLMERGE(LX_REG(&uc, EFL),
+		    lxrp->lxur_rflags);
+		LX_REG(&uc, UESP) = (int32_t)lxrp->lxur_rsp;
+		LX_REG(&uc, SS) = (int32_t)fix_segreg(lxrp->lxur_xss,
+		    IS_NOT_CS, DATAMODEL_ILP32);
+
+		/* %cs is ignored because of our lies */
+		LX_REG(&uc, DS) = (int32_t)fix_segreg(lxrp->lxur_xds,
+		    IS_NOT_CS, DATAMODEL_ILP32);
+		LX_REG(&uc, ES) = (int32_t)fix_segreg(lxrp->lxur_xes,
+		    IS_NOT_CS, DATAMODEL_ILP32);
+		LX_REG(&uc, FS) = (int32_t)fix_segreg(lxrp->lxur_xfs,
+		    IS_NOT_CS, DATAMODEL_ILP32);
+		LX_REG(&uc, GS) = (int32_t)fix_segreg(lxrp->lxur_xgs,
+		    IS_NOT_CS, DATAMODEL_ILP32);
+
+		if (lx_write_uc(p, ucp, &uc, sizeof (uc)) != 0) {
+			return (-1);
+		}
+		return (0);
+	}
+
+	default:
+		break;
+	}
+
+	return (-1);
+}
+
+static int
+lx_set_user_regs64(lx_lwp_data_t *lwpd, lx_user_regs64_t *lxrp)
+{
+	klwp_t *lwp = lwpd->br_lwp;
+	struct regs *rp = lwptoregs(lwp);
+	struct pcb *pcb = &lwp->lwp_pcb;
+	void *ucp;
+
+	switch (lx_regs_location(lwpd, &ucp, B_TRUE)) {
+	case LX_REG_LOC_UNAVAIL:
+		return (-1);
+
+	case LX_REG_LOC_UCP:
+		return (lx_set_user_regs64_uc(lwp, ucp, lxrp));
+
+	case LX_REG_LOC_LWP:
+		/* transformation below */
+		break;
+
+	default:
+		VERIFY(0);
+		break;
+	}
+
+	rp->r_r15 = lxrp->lxur_r15;
+	rp->r_r14 = lxrp->lxur_r14;
+	rp->r_r13 = lxrp->lxur_r13;
+	rp->r_r12 = lxrp->lxur_r12;
+	rp->r_rbp = lxrp->lxur_rbp;
+	rp->r_rbx = lxrp->lxur_rbx;
+	rp->r_r11 = lxrp->lxur_r11;
+	rp->r_r10 = lxrp->lxur_r10;
+	rp->r_r9 = lxrp->lxur_r9;
+	rp->r_r8 = lxrp->lxur_r8;
+	rp->r_rax = lxrp->lxur_rax;
+	rp->r_rcx = lxrp->lxur_rcx;
+	rp->r_rdx = lxrp->lxur_rdx;
+	rp->r_rsi = lxrp->lxur_rsi;
+	rp->r_rdi = lxrp->lxur_rdi;
+	lwpd->br_syscall_num = (int)lxrp->lxur_orig_rax;
+	rp->r_rip = lxrp->lxur_rip;
+	rp->r_rfl = PSLMERGE(rp->r_rfl, lxrp->lxur_rflags);
+	rp->r_rsp = lxrp->lxur_rsp;
+	rp->r_ss = fix_segreg(lxrp->lxur_xss, IS_NOT_CS, DATAMODEL_LP64);
+	pcb->pcb_fsbase = lxrp->lxur_xfs_base;
+	pcb->pcb_gsbase = lxrp->lxur_xgs_base;
+
+	kpreempt_disable();
+	PCB_SET_UPDATE_SEGS(pcb);
+	pcb->pcb_ds = fix_segreg(lxrp->lxur_xds, IS_NOT_CS, DATAMODEL_LP64);
+	pcb->pcb_es = fix_segreg(lxrp->lxur_xes, IS_NOT_CS, DATAMODEL_LP64);
+	pcb->pcb_fs = fix_segreg(lxrp->lxur_xfs, IS_NOT_CS, DATAMODEL_LP64);
+	pcb->pcb_gs = fix_segreg(lxrp->lxur_xgs, IS_NOT_CS, DATAMODEL_LP64);
+	kpreempt_enable();
+
+	return (0);
+}
+
+#endif /* __amd64 */
+
+static int
+lx_peekuser32(lx_lwp_data_t *lwpd, uintptr_t offset, uint32_t *res)
+{
+	lx_user32_t lxu;
+	boolean_t valid = B_FALSE;
+
+	bzero(&lxu, sizeof (lxu));
+	if (offset < sizeof (lx_user_regs32_t)) {
+		if (lx_get_user_regs32(lwpd, &lxu.lxu_regs) == 0) {
+			valid = B_TRUE;
+		}
+	}
+	if (valid) {
+		uint32_t *data = (uint32_t *)&lxu;
+		*res = data[offset / sizeof (uint32_t)];
+		return (0);
+	}
+	return (-1);
+}
+
+#ifdef __amd64
+static int
+lx_peekuser64(lx_lwp_data_t *lwpd, uintptr_t offset, uintptr_t *res)
+{
+	lx_user64_t lxu;
+	boolean_t valid = B_FALSE;
+
+	bzero(&lxu, sizeof (lxu));
+	if (offset < sizeof (lx_user_regs64_t)) {
+		if (lx_get_user_regs64(lwpd, &lxu.lxu_regs) == 0) {
+			valid = B_TRUE;
+		}
+	}
+	if (valid) {
+		uintptr_t *data = (uintptr_t *)&lxu;
+		*res = data[offset / sizeof (uintptr_t)];
+		return (0);
+	}
+	return (-1);
+}
+#endif /* __amd64 */
+
+int
+lx_user_regs_copyin(lx_lwp_data_t *lwpd, void *uregsp)
+{
+	model_t target_model = lwp_getdatamodel(lwpd->br_lwp);
+
+	switch (get_udatamodel()) {
+	case DATAMODEL_ILP32:
+		if (target_model == DATAMODEL_ILP32) {
+			lx_user_regs32_t regs;
+
+			if (copyin(uregsp, &regs, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			if (lx_set_user_regs32(lwpd, &regs) != 0) {
+				return (EIO);
+			}
+			return (0);
+		}
+		break;
+
+#ifdef __amd64
+	case DATAMODEL_LP64:
+		if (target_model == DATAMODEL_ILP32 ||
+		    target_model == DATAMODEL_LP64) {
+			lx_user_regs64_t regs;
+
+			if (copyin(uregsp, &regs, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			if (lx_set_user_regs64(lwpd, &regs) != 0) {
+				return (EIO);
+			}
+			return (0);
+		}
+		break;
+#endif /* __amd64 */
+
+	default:
+		break;
+	}
+	return (EIO);
+}
+
+int
+lx_user_regs_copyout(lx_lwp_data_t *lwpd, void *uregsp)
+{
+	model_t target_model = lwp_getdatamodel(lwpd->br_lwp);
+
+	switch (get_udatamodel()) {
+	case DATAMODEL_ILP32:
+		if (target_model == DATAMODEL_ILP32) {
+			lx_user_regs32_t regs;
+
+			if (lx_get_user_regs32(lwpd, &regs) != 0) {
+				return (EIO);
+			}
+			if (copyout(&regs, uregsp, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			return (0);
+		}
+		break;
+
+#ifdef __amd64
+	case DATAMODEL_LP64:
+		if (target_model == DATAMODEL_ILP32 ||
+		    target_model == DATAMODEL_LP64) {
+			lx_user_regs64_t regs;
+
+			if (lx_get_user_regs64(lwpd, &regs) != 0) {
+				return (EIO);
+			}
+			if (copyout(&regs, uregsp, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			return (0);
+		}
+		break;
+#endif /* __amd64 */
+
+	default:
+		break;
+	}
+	return (EIO);
+}
+
+int
+lx_user_fpregs_copyin(lx_lwp_data_t *lwpd, void *uregsp)
+{
+	model_t target_model = lwp_getdatamodel(lwpd->br_lwp);
+
+	switch (get_udatamodel()) {
+	case DATAMODEL_ILP32:
+		if (target_model == DATAMODEL_ILP32) {
+			lx_user_fpregs32_t regs;
+
+			if (copyin(uregsp, &regs, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			lx_setfpregs32(lwpd, &regs);
+			return (0);
+		}
+		break;
+
+#ifdef __amd64
+	case DATAMODEL_LP64:
+		if (target_model == DATAMODEL_ILP32 ||
+		    target_model == DATAMODEL_LP64) {
+			lx_user_fpregs64_t regs;
+
+			if (copyin(uregsp, &regs, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			lx_setfpregs64(lwpd, &regs);
+			return (0);
+		}
+		break;
+#endif /* __amd64 */
+
+	default:
+		break;
+	}
+	return (EIO);
+}
+
+int
+lx_user_fpregs_copyout(lx_lwp_data_t *lwpd, void *uregsp)
+{
+	model_t target_model = lwp_getdatamodel(lwpd->br_lwp);
+
+	switch (get_udatamodel()) {
+	case DATAMODEL_ILP32:
+		if (target_model == DATAMODEL_ILP32) {
+			lx_user_fpregs32_t regs;
+
+			lx_getfpregs32(lwpd, &regs);
+			if (copyout(&regs, uregsp, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			return (0);
+		}
+		break;
+
+#ifdef __amd64
+	case DATAMODEL_LP64:
+		if (target_model == DATAMODEL_ILP32 ||
+		    target_model == DATAMODEL_LP64) {
+			lx_user_fpregs64_t regs;
+
+			lx_getfpregs64(lwpd, &regs);
+			if (copyout(&regs, uregsp, sizeof (regs)) != 0) {
+				return (EFAULT);
+			}
+			return (0);
+		}
+		break;
+#endif /* __amd64 */
+
+	default:
+		break;
+	}
+	return (EIO);
+}
+
+/* ARGSUSED */
+int
+lx_user_fpxregs_copyin(lx_lwp_data_t *lwpd, void *uregsp)
+{
+	/* Punt on fpxregs for now */
+	return (EIO);
+}
+
+/* ARGSUSED */
+int
+lx_user_fpxregs_copyout(lx_lwp_data_t *lwpd, void *uregsp)
+{
+	/* Punt on fpxregs for now */
+	return (EIO);
+}
+
+int
+lx_ptrace_peekuser(lx_lwp_data_t *lwpd, uintptr_t offset, void *uptr)
+{
+	model_t target_model = lwp_getdatamodel(lwpd->br_lwp);
+
+	switch (get_udatamodel()) {
+	case DATAMODEL_ILP32:
+		if ((offset & (sizeof (uint32_t) - 1)) != 0) {
+			/* Must be aligned to 32bit boundary */
+			break;
+		}
+		if (target_model == DATAMODEL_ILP32) {
+			uint32_t res;
+
+			if (lx_peekuser32(lwpd, offset, &res) != 0) {
+				return (EIO);
+			}
+			if (copyout(&res, uptr, sizeof (res)) != 0) {
+				return (EFAULT);
+			}
+			return (0);
+		}
+		break;
+
+#ifdef __amd64
+	case DATAMODEL_LP64:
+		if ((offset & (sizeof (uintptr_t) - 1)) != 0) {
+			/* Must be aligned to 64bit boundary */
+			break;
+		}
+		if (target_model == DATAMODEL_ILP32 ||
+		    target_model == DATAMODEL_LP64) {
+			uintptr_t res;
+
+			if (lx_peekuser64(lwpd, offset, &res) != 0) {
+				return (EIO);
+			}
+			if (copyout(&res, uptr, sizeof (res)) != 0) {
+				return (EFAULT);
+			}
+			return (0);
+		}
+		break;
+#endif /* __amd64 */
+
+	default:
+		break;
+	}
+	return (EIO);
+}
+
+/* ARGSUSED */
+int
+lx_ptrace_pokeuser(lx_lwp_data_t *lwpd, uintptr_t offset, void *uptr)
+{
+	return (EIO);
+}
+
+
+/*
+ * Load registers and repoint the stack and program counter.  This function is
+ * used by the B_JUMP_TO_LINUX brand system call to revector to a Linux
+ * entrypoint.
+ */
+int
+lx_runexe(klwp_t *lwp, void *ucp)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+
+	/*
+	 * We should only make it here when transitioning to Linux from
+	 * the NATIVE or INIT mode.
+	 */
+	VERIFY(lwpd->br_stack_mode == LX_STACK_MODE_NATIVE ||
+	    lwpd->br_stack_mode == LX_STACK_MODE_INIT);
+
+#if defined(__amd64)
+	if (lwp_getdatamodel(lwp) == DATAMODEL_NATIVE) {
+		struct pcb *pcb = &lwp->lwp_pcb;
+
+		/*
+		 * Preserve the %fs/%gsbase value for this LWP, as set and used
+		 * by native illumos code.
+		 */
+		lwpd->br_ntv_fsbase = pcb->pcb_fsbase;
+		lwpd->br_ntv_gsbase = pcb->pcb_gsbase;
+
+		return (getsetcontext(SETCONTEXT, ucp));
+	} else {
+		return (getsetcontext32(SETCONTEXT, ucp));
+	}
+#else
+	return (getsetcontext(SETCONTEXT, ucp));
+#endif
+}
+
+/*
+ * The usermode emulation code is illumos library code.  This routine ensures
+ * the segment registers are set up correctly for native illumos code.  It
+ * should be called _after_ we have stored the outgoing Linux machine state
+ * but _before_ we return from the kernel to any illumos native code; e.g. the
+ * usermode emulation library, or any interposed signal handlers.
+ *
+ * See the comment on lwp_segregs_save() for how we handle the usermode
+ * registers when we come into the kernel and see update_sregs() for how we
+ * restore.
+ */
+void
+lx_switch_to_native(klwp_t *lwp)
+{
+#if defined(__amd64)
+	model_t datamodel = lwp_getdatamodel(lwp);
+
+	switch (datamodel) {
+	case DATAMODEL_ILP32: {
+		struct pcb *pcb = &lwp->lwp_pcb;
+
+		/*
+		 * For 32-bit processes, we ensure that the correct %gs value
+		 * is loaded:
+		 */
+		kpreempt_disable();
+		if (PCB_NEED_UPDATE_SEGS(pcb)) {
+			/*
+			 * If we are already flushing the segment registers,
+			 * then ensure we are flushing the native %gs.
+			 */
+			pcb->pcb_gs = LWPGS_SEL;
+		} else {
+			struct regs *rp = lwptoregs(lwp);
+
+			/*
+			 * If we are not flushing the segment registers yet,
+			 * only do so if %gs is not correct already:
+			 */
+			if (rp->r_gs != LWPGS_SEL) {
+				pcb->pcb_gs = LWPGS_SEL;
+
+				/*
+				 * Ensure we go out via update_sregs.
+				 */
+				PCB_SET_UPDATE_SEGS(pcb);
+			}
+		}
+		kpreempt_enable();
+		break;
+	}
+
+	case DATAMODEL_LP64: {
+		lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+
+		/*
+		 * For 64-bit processes we ensure that the correct %fsbase
+		 * value is loaded:
+		 */
+		if (lwpd->br_ntv_fsbase != 0) {
+			struct pcb *pcb = &lwp->lwp_pcb;
+
+			kpreempt_disable();
+			if (pcb->pcb_fsbase != lwpd->br_ntv_fsbase) {
+				pcb->pcb_fsbase = lwpd->br_ntv_fsbase;
+
+				/*
+				 * Ensure we go out via update_sregs.
+				 */
+				PCB_SET_UPDATE_SEGS(pcb);
+			}
+			kpreempt_enable();
+		}
+		/*
+		 * ... and the correct %gsbase
+		 */
+		if (lwpd->br_ntv_gsbase != 0) {
+			struct pcb *pcb = &lwp->lwp_pcb;
+
+			kpreempt_disable();
+			if (pcb->pcb_gsbase != lwpd->br_ntv_gsbase) {
+				pcb->pcb_gsbase = lwpd->br_ntv_gsbase;
+
+				/*
+				 * Ensure we go out via update_sregs.
+				 */
+				PCB_SET_UPDATE_SEGS(pcb);
+			}
+			kpreempt_enable();
+		}
+		break;
+	}
+
+	default:
+		cmn_err(CE_PANIC, "unknown data model: %d", datamodel);
+	}
+#elif defined(__i386)
+	struct regs *rp = lwptoregs(lwp);
+
+	rp->r_gs = LWPGS_SEL;
+#else
+#error "unknown x86"
+#endif
+}
+
+#if defined(__amd64)
+/*
+ * Call frame for the 64-bit usermode emulation handler:
+ *    lx_emulate(ucontext_t *ucp, int syscall_num, uintptr_t *args)
+ *
+ * old sp: --------------------------------------------------------------
+ *  |      - ucontext_t              (register state for emulation)
+ *  |      - uintptr_t[6]            (system call arguments array)
+ *  V      --------------------------------------------------------------
+ * new sp: - bogus return address
+ *
+ * Arguments are passed in registers, per the AMD64 ABI: %rdi, %rsi and %rdx.
+ */
+void
+lx_emulate_user(klwp_t *lwp, int syscall_num, uintptr_t *args)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	struct regs *rp = lwptoregs(lwp);
+	label_t lab;
+	uintptr_t uc_addr;
+	uintptr_t args_addr;
+	uintptr_t top;
+	/*
+	 * Variables used after on_fault() returns for a fault
+	 * must be volatile.
+	 */
+	volatile size_t frsz;
+	volatile uintptr_t sp;
+	volatile proc_t *p = lwptoproc(lwp);
+	volatile int watched;
+
+	/*
+	 * We should not be able to get here unless we are running Linux
+	 * code for a system call we cannot emulate in the kernel.
+	 */
+	VERIFY(lwpd->br_stack_mode == LX_STACK_MODE_BRAND);
+
+	/*
+	 * The AMD64 ABI requires us to align the return address on the stack
+	 * so that when the called function pushes %rbp, the stack is 16-byte
+	 * aligned.
+	 *
+	 * This routine, like the amd64 version of sendsig(), depends on
+	 * STACK_ALIGN being 16 and STACK_ENTRY_ALIGN being 8.
+	 */
+#if STACK_ALIGN != 16 || STACK_ENTRY_ALIGN != 8
+#error "lx_emulate_user() amd64 did not find the expected stack alignments"
+#endif
+
+	/*
+	 * We begin at the current native stack pointer, and reserve space for
+	 * the ucontext_t we are copying onto the stack, as well as the call
+	 * arguments for the usermode emulation handler.
+	 *
+	 * We 16-byte align the entire frame, and then unalign it again by
+	 * adding space for the return address.
+	 */
+	frsz = SA(sizeof (ucontext_t)) + SA(6 * sizeof (uintptr_t)) +
+	    sizeof (uintptr_t);
+	VERIFY((frsz & (STACK_ALIGN - 1UL)) == 8);
+	VERIFY((frsz & (STACK_ENTRY_ALIGN - 1UL)) == 0);
+
+	if (lwpd->br_ntv_stack == lwpd->br_ntv_stack_current) {
+		/*
+		 * Nobody else is using the stack right now, so start at the
+		 * top.
+		 */
+		top = lwpd->br_ntv_stack_current;
+	} else {
+		/*
+		 * Drop below the 128-byte reserved region of the stack frame
+		 * we are interrupting.
+		 */
+		top = lwpd->br_ntv_stack_current - STACK_RESERVE;
+	}
+	top = top & ~(STACK_ALIGN - 1);
+	sp = top - frsz;
+
+	uc_addr = top - SA(sizeof (ucontext_t));
+	args_addr = uc_addr - SA(6 * sizeof (uintptr_t));
+
+	watched = watch_disable_addr((caddr_t)sp, frsz, S_WRITE);
+
+	/*
+	 * Save the register state we preserved on the way into this brand
+	 * system call and drop it on the native stack.
+	 */
+	{
+		/*
+		 * Note: the amd64 ucontext_t is 864 bytes.
+		 */
+		ucontext_t uc;
+
+		/*
+		 * We do not want to save the signal mask for an emulation
+		 * context.  Some emulated system calls alter the signal mask;
+		 * restoring it when the emulation is complete would clobber
+		 * those intentional side effects.
+		 */
+		savecontext(&uc, NULL);
+
+		if (on_fault(&lab)) {
+			goto badstack;
+		}
+
+		/*
+		 * Mark this as a system call emulation context:
+		 */
+		uc.uc_brand_data[0] = (void *)((uintptr_t)
+		    uc.uc_brand_data[0] | LX_UC_FRAME_IS_SYSCALL);
+
+		copyout_noerr(&uc, (void *)(uintptr_t)uc_addr, sizeof (uc));
+	}
+
+	DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
+	    uintptr_t, lwp->lwp_oldcontext, uintptr_t, uc_addr);
+	lwp->lwp_oldcontext = (uintptr_t)uc_addr;
+
+	/*
+	 * Copy the system call arguments out to userland:
+	 */
+	copyout_noerr(args, (void *)(uintptr_t)args_addr,
+	    6 * sizeof (uintptr_t));
+
+	/*
+	 * Drop the bogus return address on the stack.
+	 */
+	suword64_noerr((void *)sp, 0);
+
+	no_fault();
+	if (watched) {
+		watch_enable_addr((caddr_t)sp, frsz, S_WRITE);
+	}
+
+	/*
+	 * Pass the arguments to lx_emulate() in the appropriate registers.
+	 */
+	rp->r_rdi = uc_addr;
+	rp->r_rsi = syscall_num;
+	rp->r_rdx = args_addr;
+
+	/*
+	 * In order to be able to restore %edx, we need to JUSTRETURN.
+	 */
+	lwp->lwp_eosys = JUSTRETURN;
+	curthread->t_post_sys = 1;
+	aston(curthread);
+
+	/*
+	 * Set stack pointer and return address to the usermode emulation
+	 * handler:
+	 */
+	lwpd->br_stack_mode = LX_STACK_MODE_NATIVE;
+	lx_lwp_set_native_stack_current(lwpd, sp);
+
+	/*
+	 * Divert execution, on our return, to the usermode emulation stack
+	 * and handler:
+	 */
+	rp->r_fp = 0;
+	rp->r_sp = sp;
+	rp->r_pc = ptolxproc(p)->l_handler;
+
+	/*
+	 * Fix up segment registers, etc.
+	 */
+	lx_switch_to_native(lwp);
+
+	return;
+
+badstack:
+	no_fault();
+	if (watched) {
+		watch_enable_addr((caddr_t)sp, frsz, S_WRITE);
+	}
+
+#ifdef DEBUG
+	printf("lx_emulate_user: bad native stack cmd=%s, pid=%d, sp=0x%lx\n",
+	    PTOU(p)->u_comm, p->p_pid, sp);
+#endif
+
+	exit(CLD_KILLED, SIGSEGV);
+}
+
+#if defined(_SYSCALL32_IMPL)
+/*
+ * Call frame for the 32-bit usermode emulation handler:
+ *    lx_emulate(ucontext_t *ucp, int syscall_num, uintptr_t *args)
+ *
+ * old sp: --------------------------------------------------------------
+ *  |      - ucontext_t              (register state for emulation)
+ *  |      - uintptr_t[6]            (system call arguments array)
+ *  |      --------------------------------------------------------------
+ *  |      - arg2: uintptr_t *       (pointer to arguments array above)
+ *  |      - arg1: int               (system call number)
+ *  V      - arg0: ucontext_t *      (pointer to context above)
+ * new sp: - bogus return address
+ */
+struct lx_emu_frame32 {
+	caddr32_t	retaddr;	/* 0 */
+	caddr32_t	ucontextp;	/* 4 */
+	int32_t		syscall_num;	/* 8 */
+	caddr32_t	argsp;		/* c */
+};
+
+/*
+ * This function arranges for the lwp to execute the usermode emulation handler
+ * for this system call.  The mechanism is similar to signal handling, and this
+ * function is modelled on sendsig32().
+ */
+void
+lx_emulate_user32(klwp_t *lwp, int syscall_num, uintptr_t *args)
+{
+	lx_lwp_data_t *lwpd = lwptolxlwp(lwp);
+	struct regs *rp = lwptoregs(lwp);
+	label_t lab;
+	caddr32_t uc_addr;
+	caddr32_t args_addr;
+	caddr32_t top;
+	/*
+	 * Variables used after on_fault() returns for a fault
+	 * must be volatile.
+	 */
+	volatile size_t frsz;
+	volatile caddr32_t sp;
+	volatile proc_t *p = lwptoproc(lwp);
+	volatile int watched;
+
+	/*
+	 * We should not be able to get here unless we are running Linux
+	 * code for a system call we cannot emulate in the kernel.
+	 */
+	VERIFY(lwpd->br_stack_mode == LX_STACK_MODE_BRAND);
+
+	/*
+	 * We begin at the current native stack pointer, and reserve space for
+	 * the ucontext_t we are copying onto the stack, as well as the call
+	 * arguments for the usermode emulation handler.
+	 */
+	frsz = SA32(sizeof (ucontext32_t)) + SA32(6 * sizeof (uint32_t)) +
+	    SA32(sizeof (struct lx_emu_frame32));
+	VERIFY((frsz & (STACK_ALIGN32 - 1)) == 0);
+
+	top = (caddr32_t)(lwpd->br_ntv_stack_current & ~(STACK_ALIGN32 - 1));
+	sp = top - frsz;
+
+	uc_addr = top - SA32(sizeof (ucontext32_t));
+	args_addr = uc_addr - SA32(6 * sizeof (uint32_t));
+
+	watched = watch_disable_addr((caddr_t)(uintptr_t)sp, frsz, S_WRITE);
+
+	/*
+	 * Save the register state we preserved on the way into this brand
+	 * system call and drop it on the native stack.
+	 */
+	{
+		/*
+		 * Note: ucontext32_t is 512 bytes.
+		 */
+		ucontext32_t uc;
+
+		/*
+		 * We do not want to save the signal mask for an emulation
+		 * context.  Some emulated system calls alter the signal mask;
+		 * restoring it when the emulation is complete would clobber
+		 * those intentional side effects.
+		 */
+		savecontext32(&uc, NULL);
+
+		if (on_fault(&lab)) {
+			goto badstack;
+		}
+
+		/*
+		 * Mark this as a system call emulation context:
+		 */
+		uc.uc_brand_data[0] |= LX_UC_FRAME_IS_SYSCALL;
+		copyout_noerr(&uc, (void *)(uintptr_t)uc_addr, sizeof (uc));
+	}
+
+	DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
+	    uintptr_t, lwp->lwp_oldcontext, uintptr_t, uc_addr);
+	lwp->lwp_oldcontext = (uintptr_t)uc_addr;
+
+	/*
+	 * Copy the system call arguments out to userland:
+	 */
+	{
+		uint32_t args32[6];
+
+		args32[0] = args[0];
+		args32[1] = args[1];
+		args32[2] = args[2];
+		args32[3] = args[3];
+		args32[4] = args[4];
+		args32[5] = args[5];
+
+		copyout_noerr(&args32, (void *)(uintptr_t)args_addr,
+		    sizeof (args32));
+	}
+
+	/*
+	 * Assemble the call frame on the stack.
+	 */
+	{
+		struct lx_emu_frame32 frm;
+
+		frm.retaddr = 0;
+		frm.ucontextp = uc_addr;
+		frm.argsp = args_addr;
+		frm.syscall_num = syscall_num;
+
+		copyout_noerr(&frm, (void *)(uintptr_t)sp, sizeof (frm));
+	}
+
+	no_fault();
+	if (watched) {
+		watch_enable_addr((caddr_t)(uintptr_t)sp, frsz, S_WRITE);
+	}
+
+	/*
+	 * Set stack pointer and return address to the usermode emulation
+	 * handler:
+	 */
+	lwpd->br_stack_mode = LX_STACK_MODE_NATIVE;
+	lx_lwp_set_native_stack_current(lwpd, sp);
+
+	/*
+	 * Divert execution, on our return, to the usermode emulation stack
+	 * and handler:
+	 */
+	rp->r_fp = 0;
+	rp->r_sp = sp;
+	rp->r_pc = ptolxproc(p)->l_handler;
+
+	/*
+	 * Fix up segment registers, etc.
+	 */
+	lx_switch_to_native(lwp);
+
+	return;
+
+badstack:
+	no_fault();
+	if (watched) {
+		watch_enable_addr((caddr_t)(uintptr_t)sp, frsz, S_WRITE);
+	}
+
+#ifdef DEBUG
+	printf("lx_emulate_user32: bad native stack cmd=%s, pid=%d, sp=0x%x\n",
+	    PTOU(p)->u_comm, p->p_pid, sp);
+#endif
+
+	exit(CLD_KILLED, SIGSEGV);
+}
+#endif	/* _SYSCALL32_IMPL */
+
+#else	/* !__amd64 (__i386) */
+
+/* ARGSUSED */
+void
+lx_emulate_user(klwp_t *lwp, int syscall_num, uintptr_t *args)
+{
+	cmn_err(CE_WARN, "%s: no 32-bit kernel support", __FUNCTION__);
+	exit(CLD_KILLED, SIGSYS);
+}
+
+#endif	/* __amd64 */
diff --git a/usr/src/uts/intel/chxge/Makefile b/usr/src/uts/intel/chxge/Makefile
index 052bd467d2..dd835a13d2 100644
--- a/usr/src/uts/intel/chxge/Makefile
+++ b/usr/src/uts/intel/chxge/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 
 #
@@ -69,9 +70,9 @@ CFLAGS		+= -DSUN_KSTATS -DHOST_PAUSE -DTX_CKSUM_FIX -DTX_THREAD_RECLAIM
 # CFLAGS		+= -DCH_DEBUG=1 -DPE_DBGOUT_ENABLED=1
 
 #
-#	Driver depends on GLD & IP
+#	Driver depends on GLD, IP, and MAC
 #
-LDFLAGS		+= -dy -N misc/gld -N drv/ip
+LDFLAGS		+= -dy -N misc/gld -N drv/ip -N misc/mac
 
 #	Lint flag
 #
diff --git a/usr/src/uts/intel/core_pcbe/Makefile b/usr/src/uts/intel/core_pcbe/Makefile
index d9d9b02de0..1673cfe252 100644
--- a/usr/src/uts/intel/core_pcbe/Makefile
+++ b/usr/src/uts/intel/core_pcbe/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 #
+# Copyright 2018, Joyent, Inc.
 #
 # This Makefile builds
 # the Intel Core Architecture Performance Counter BackEnd (PCBE).
@@ -34,7 +35,7 @@ UTSBASE = ../..
 MODULE		= pcbe.GenuineIntel.6.15
 OBJECTS		= $(CORE_PCBE_OBJS:%=$(OBJS_DIR)/%)
 LINTS		= $(CORE_PCBE_OBJS:%.o=$(LINTS_DIR)/%.ln)
-ROOTMODULE	= $(USR_PCBE_DIR)/$(MODULE)
+ROOTMODULE	= $(ROOT_PSM_PCBE_DIR)/$(MODULE)
 SOFTLINKS	= pcbe.GenuineIntel.6.23 \
 			pcbe.GenuineIntel.6.26 \
 			pcbe.GenuineIntel.6.28 \
@@ -42,10 +43,23 @@ SOFTLINKS	= pcbe.GenuineIntel.6.23 \
 			pcbe.GenuineIntel.6.30 \
 			pcbe.GenuineIntel.6.31 \
 			pcbe.GenuineIntel.6.37 \
+			pcbe.GenuineIntel.6.42 \
 			pcbe.GenuineIntel.6.44 \
+			pcbe.GenuineIntel.6.45 \
 			pcbe.GenuineIntel.6.46 \
-			pcbe.GenuineIntel.6.47
-ROOTSOFTLINKS	= $(SOFTLINKS:%=$(USR_PCBE_DIR)/%)
+			pcbe.GenuineIntel.6.47 \
+			pcbe.GenuineIntel.6.58 \
+			pcbe.GenuineIntel.6.60 \
+			pcbe.GenuineIntel.6.61 \
+			pcbe.GenuineIntel.6.62 \
+			pcbe.GenuineIntel.6.63 \
+			pcbe.GenuineIntel.6.69 \
+			pcbe.GenuineIntel.6.70 \
+			pcbe.GenuineIntel.6.71 \
+			pcbe.GenuineIntel.6.78 \
+			pcbe.GenuineIntel.6.79 \
+			pcbe.GenuineIntel.6.85
+ROOTSOFTLINKS	= $(SOFTLINKS:%=$(ROOT_PSM_PCBE_DIR)/%)
 
 #
 #	Include common rules.
diff --git a/usr/src/uts/intel/datafilt/Makefile b/usr/src/uts/intel/datafilt/Makefile
new file mode 100644
index 0000000000..bc72416406
--- /dev/null
+++ b/usr/src/uts/intel/datafilt/Makefile
@@ -0,0 +1,74 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2011, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
+#
+
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= datafilt
+OBJECTS		= $(DATAFILT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(DATAFILT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_SOCK_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# lint pass one enforcement and OS version
+#
+CFLAGS += $(CCVERBOSE)
+
+LDFLAGS += -dy -Nfs/sockfs -Ndrv/ip
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/dev/Makefile b/usr/src/uts/intel/dev/Makefile
index c34feb9c18..00c885fc3a 100644
--- a/usr/src/uts/intel/dev/Makefile
+++ b/usr/src/uts/intel/dev/Makefile
@@ -71,6 +71,7 @@ LINTTAGS	+= -erroff=E_STATIC_UNUSED
 CERRWARN	+= -_gcc=-Wno-parentheses
 CERRWARN	+= -_gcc=-Wno-unused-label
 CERRWARN	+= -_gcc=-Wno-uninitialized
+CERRWARN	+= -_gcc=-Wno-unused-function
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/intel/dld/Makefile b/usr/src/uts/intel/dld/Makefile
index e0b736c8d2..beeef419a3 100644
--- a/usr/src/uts/intel/dld/Makefile
+++ b/usr/src/uts/intel/dld/Makefile
@@ -55,7 +55,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -N misc/dls -N misc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 # For now, disable these lint checks; maintainers should endeavor
diff --git a/usr/src/uts/intel/dls/Makefile b/usr/src/uts/intel/dls/Makefile
index dfa1cd74ec..4546ae19e6 100644
--- a/usr/src/uts/intel/dls/Makefile
+++ b/usr/src/uts/intel/dls/Makefile
@@ -53,7 +53,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -N misc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 # For now, disable these lint checks; maintainers should endeavor
diff --git a/usr/src/uts/intel/dr_sas/Makefile b/usr/src/uts/intel/dr_sas/Makefile
new file mode 100644
index 0000000000..f4871b694a
--- /dev/null
+++ b/usr/src/uts/intel/dr_sas/Makefile
@@ -0,0 +1,90 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# uts/intel/dr_sas/Makefile
+#
+#	This makefile drives the production of the dr_sas driver kernel module.
+#
+#	intel implementation architecture dependent
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= dr_sas
+OBJECTS		= $(DR_SAS_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(DR_SAS_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_DRV_DIR)/$(MODULE)
+CONF_SRCDIR     = $(UTSBASE)/common/io/dr_sas
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY) $(CONFMOD)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+# 	Kernel Module Dependencies
+#
+LDFLAGS		+= -dy -Nmisc/scsi
+
+CERRWARN	+= -_gcc=-Wno-unused-label
+CERRWARN	+= -_gcc=-Wno-switch
+CERRWARN	+= -_gcc=-Wno-uninitialized
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/dtrace/dtrace_isa.c b/usr/src/uts/intel/dtrace/dtrace_isa.c
index f649473dfb..f52180b0c0 100644
--- a/usr/src/uts/intel/dtrace/dtrace_isa.c
+++ b/usr/src/uts/intel/dtrace/dtrace_isa.c
@@ -26,6 +26,7 @@
 
 /*
  * Copyright (c) 2013, 2014 by Delphix. All rights reserved.
+ * Copyright (c) 2017 Joyent, Inc.
  */
 
 #include <sys/dtrace_impl.h>
@@ -546,39 +547,42 @@ dtrace_getstackdepth(int aframes)
 	return (depth - aframes);
 }
 
+#if defined(__amd64)
+static const int dtrace_regmap[] = {
+	REG_GS,		/* GS */
+	REG_FS,		/* FS */
+	REG_ES,		/* ES */
+	REG_DS,		/* DS */
+	REG_RDI,	/* EDI */
+	REG_RSI,	/* ESI */
+	REG_RBP,	/* EBP */
+	REG_RSP,	/* ESP */
+	REG_RBX,	/* EBX */
+	REG_RDX,	/* EDX */
+	REG_RCX,	/* ECX */
+	REG_RAX,	/* EAX */
+	REG_TRAPNO,	/* TRAPNO */
+	REG_ERR,	/* ERR */
+	REG_RIP,	/* EIP */
+	REG_CS,		/* CS */
+	REG_RFL,	/* EFL */
+	REG_RSP,	/* UESP */
+	REG_SS		/* SS */
+};
+#endif
+
+
 ulong_t
 dtrace_getreg(struct regs *rp, uint_t reg)
 {
 #if defined(__amd64)
-	int regmap[] = {
-		REG_GS,		/* GS */
-		REG_FS,		/* FS */
-		REG_ES,		/* ES */
-		REG_DS,		/* DS */
-		REG_RDI,	/* EDI */
-		REG_RSI,	/* ESI */
-		REG_RBP,	/* EBP */
-		REG_RSP,	/* ESP */
-		REG_RBX,	/* EBX */
-		REG_RDX,	/* EDX */
-		REG_RCX,	/* ECX */
-		REG_RAX,	/* EAX */
-		REG_TRAPNO,	/* TRAPNO */
-		REG_ERR,	/* ERR */
-		REG_RIP,	/* EIP */
-		REG_CS,		/* CS */
-		REG_RFL,	/* EFL */
-		REG_RSP,	/* UESP */
-		REG_SS		/* SS */
-	};
-
 	if (reg <= SS) {
-		if (reg >= sizeof (regmap) / sizeof (int)) {
+		if (reg >= sizeof (dtrace_regmap) / sizeof (int)) {
 			DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
 			return (0);
 		}
 
-		reg = regmap[reg];
+		reg = dtrace_regmap[reg];
 	} else {
 		reg -= SS + 1;
 	}
@@ -651,6 +655,105 @@ dtrace_getreg(struct regs *rp, uint_t reg)
 #endif
 }
 
+void
+dtrace_setreg(struct regs *rp, uint_t reg, ulong_t val)
+{
+#if defined(__amd64)
+	if (reg <= SS) {
+		ASSERT(reg < (sizeof (dtrace_regmap) / sizeof (int)));
+
+		reg = dtrace_regmap[reg];
+	} else {
+		reg -= SS + 1;
+	}
+
+	switch (reg) {
+	case REG_RDI:
+		rp->r_rdi = val;
+		break;
+	case REG_RSI:
+		rp->r_rsi = val;
+		break;
+	case REG_RDX:
+		rp->r_rdx = val;
+		break;
+	case REG_RCX:
+		rp->r_rcx = val;
+		break;
+	case REG_R8:
+		rp->r_r8 = val;
+		break;
+	case REG_R9:
+		rp->r_r9 = val;
+		break;
+	case REG_RAX:
+		rp->r_rax = val;
+		break;
+	case REG_RBX:
+		rp->r_rbx = val;
+		break;
+	case REG_RBP:
+		rp->r_rbp = val;
+		break;
+	case REG_R10:
+		rp->r_r10 = val;
+		break;
+	case REG_R11:
+		rp->r_r11 = val;
+		break;
+	case REG_R12:
+		rp->r_r12 = val;
+		break;
+	case REG_R13:
+		rp->r_r13 = val;
+		break;
+	case REG_R14:
+		rp->r_r14 = val;
+		break;
+	case REG_R15:
+		rp->r_r15 = val;
+		break;
+	case REG_RSP:
+		rp->r_rsp = val;
+		break;
+	default:
+		DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
+		return;
+	}
+
+#else /* defined(__amd64) */
+	switch (reg) {
+	case EAX:
+		rp->r_eax = val;
+		break;
+	case ECX:
+		rp->r_ecx = val;
+		break;
+	case EDX:
+		rp->r_edx = val;
+		break;
+	case EBX:
+		rp->r_ebx = val;
+		break;
+	case ESP:
+		rp->r_esp = val;
+		break;
+	case EBP:
+		rp->r_ebp = val;
+		break;
+	case ESI:
+		rp->r_esi = val;
+		break;
+	case EDI:
+		rp->r_edi = val;
+		break;
+	default:
+		DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
+		return;
+	}
+#endif /* defined(__amd64) */
+}
+
 static int
 dtrace_copycheck(uintptr_t uaddr, uintptr_t kaddr, size_t size)
 {
diff --git a/usr/src/uts/intel/dtrace/fasttrap_isa.c b/usr/src/uts/intel/dtrace/fasttrap_isa.c
index 1b93869a73..f9eba2876c 100644
--- a/usr/src/uts/intel/dtrace/fasttrap_isa.c
+++ b/usr/src/uts/intel/dtrace/fasttrap_isa.c
@@ -24,7 +24,9 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2015, Joyent, Inc. All rights reserved.
+ */
 
 #include <sys/fasttrap_isa.h>
 #include <sys/fasttrap_impl.h>
@@ -38,6 +40,9 @@
 #include <sys/sysmacros.h>
 #include <sys/trap.h>
 #include <sys/archsystm.h>
+#include <sys/proc.h>
+#include <sys/brand.h>
+#include <sys/machbrand.h>
 
 /*
  * Lossless User-Land Tracing on x86
@@ -1394,6 +1399,14 @@ fasttrap_pid_probe(struct regs *rp)
 #if defined(__amd64)
 		if (p->p_model == DATAMODEL_LP64) {
 			addr = lwp->lwp_pcb.pcb_fsbase;
+
+			/*
+			 * If we're branded, convert the fsbase from the
+			 * brand's fsbase to the native fsbase.
+			 */
+			if (PROC_IS_BRANDED(p) && BRMOP(p)->b_fsbase != NULL)
+				addr = BRMOP(p)->b_fsbase(lwp, addr);
+
 			addr += sizeof (void *);
 		} else {
 			addr = lwp->lwp_pcb.pcb_gsbase;
diff --git a/usr/src/uts/intel/e1000g/Makefile b/usr/src/uts/intel/e1000g/Makefile
index 7492e30935..65aa6b44bb 100644
--- a/usr/src/uts/intel/e1000g/Makefile
+++ b/usr/src/uts/intel/e1000g/Makefile
@@ -84,6 +84,7 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 # Driver depends on MAC
 #
 LDFLAGS		+= -dy -N misc/mac
+MAPFILES	+= ddi mac
 
 #
 #	Default build targets.
@@ -110,4 +111,5 @@ install:	$(INSTALL_DEPS)
 #
 #	Include common targets.
 #
+include $(UTSBASE)/Makefile.mapfile
 include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/elfexec/Makefile b/usr/src/uts/intel/elfexec/Makefile
index b522487e00..a52fc159f5 100644
--- a/usr/src/uts/intel/elfexec/Makefile
+++ b/usr/src/uts/intel/elfexec/Makefile
@@ -105,12 +105,15 @@ include $(UTSBASE)/intel/Makefile.targ
 
 $(OBJS_DIR)/elf32.o:	$(UTSBASE)/common/exec/elf/elf.c
 	$(COMPILE.c) -o $@ -D_ELF32_COMPAT $(UTSBASE)/common/exec/elf/elf.c
+	$(CTFCONVERT_O)
 
 $(OBJS_DIR)/elf32_notes.o: $(UTSBASE)/common/exec/elf/elf_notes.c
 	$(COMPILE.c) -o $@ -D_ELF32_COMPAT $(UTSBASE)/common/exec/elf/elf_notes.c
+	$(CTFCONVERT_O)
 
 $(OBJS_DIR)/old32_notes.o: $(UTSBASE)/common/exec/elf/old_notes.c
 	$(COMPILE.c) -o $@ -D_ELF32_COMPAT $(UTSBASE)/common/exec/elf/old_notes.c
+	$(CTFCONVERT_O)
 
 $(LINTS_DIR)/elf32.ln:	$(UTSBASE)/common/exec/elf/elf.c
 	@($(LHEAD) $(LINT.c) -Celf32 -D_ELF32_COMPAT $(UTSBASE)/common/exec/elf/elf.c $(LTAIL))
diff --git a/usr/src/uts/intel/genassym/Makefile b/usr/src/uts/intel/genassym/Makefile
new file mode 100644
index 0000000000..ce01dc8610
--- /dev/null
+++ b/usr/src/uts/intel/genassym/Makefile
@@ -0,0 +1,85 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+#	This makefile drives the production of genassym.h through
+#	compile time intialized data.
+#
+#	intel architecture dependent
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+GENASSYM_H	= $(GENASSYM_DIR)/$(OBJS_DIR)/genassym.h
+OFFSETS_SRC	= $(GENASSYM_DIR)/offsets.in
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(GENASSYM_H)
+
+INC_PATH	+= -I$(UTSBASE)/common/brand/lx
+
+#
+#	Overrides
+#
+CLEANFILES	= Nothing_to_remove
+CLOBBERFILES	= $(GENASSYM_H) Nothing_to_remove
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+clean.lint:
+
+install:	def
+
+#
+# Create genassym.h
+#
+$(GENASSYM_H): $(OFFSETS_SRC)
+	$(OFFSETS_CREATE) <$(OFFSETS_SRC) >$@
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/genassym/offsets.in b/usr/src/uts/intel/genassym/offsets.in
new file mode 100644
index 0000000000..70221c02f9
--- /dev/null
+++ b/usr/src/uts/intel/genassym/offsets.in
@@ -0,0 +1,43 @@
+\
+\ CDDL HEADER START
+\
+\ The contents of this file are subject to the terms of the
+\ Common Development and Distribution License (the "License").
+\ You may not use this file except in compliance with the License.
+\
+\ You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+\ or http://www.opensolaris.org/os/licensing.
+\ See the License for the specific language governing permissions
+\ and limitations under the License.
+\
+\ When distributing Covered Code, include this CDDL HEADER in each
+\ file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+\ If applicable, add the following below this CDDL HEADER, with the
+\ fields enclosed by brackets "[]" replaced with your own identifying
+\ information: Portions Copyright [yyyy] [name of copyright owner]
+\
+\ CDDL HEADER END
+\
+\
+\ Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
+\ Use is subject to license terms.
+\ Copyright 2015 Joyent, Inc.
+\
+
+\
+\ offsets.in: input file to produce the architecture-dependent genassym.h
+\ using the ctfstabs program
+\
+
+#ifndef	_GENASSYM
+#define	_GENASSYM
+#endif
+
+#include <sys/lx_brand.h>
+
+lx_proc_data
+	l_handler
+
+lx_lwp_data
+	br_lx_fsbase
+	br_ntv_fsbase
diff --git a/usr/src/uts/intel/gsqueue/Makefile b/usr/src/uts/intel/gsqueue/Makefile
new file mode 100644
index 0000000000..411e384309
--- /dev/null
+++ b/usr/src/uts/intel/gsqueue/Makefile
@@ -0,0 +1,49 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+UTSBASE	= ../..
+
+MODULE		= gsqueue
+OBJECTS		= $(GSQUEUE_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(GSQUEUE_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_MISC_DIR)/$(MODULE)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+LDFLAGS 	+= -dy -Ndrv/ip
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/hyprlofs/Makefile b/usr/src/uts/intel/hyprlofs/Makefile
new file mode 100644
index 0000000000..919b045617
--- /dev/null
+++ b/usr/src/uts/intel/hyprlofs/Makefile
@@ -0,0 +1,83 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# uts/intel/hyprlofs/Makefile
+#
+# Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#	This makefile drives the production of the hyprlofs file system
+#	kernel module.
+#
+#	intel architecture dependent
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= hyprlofs
+OBJECTS		= $(HYPRLOFS_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(HYPRLOFS_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_FS_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/i40e/Makefile b/usr/src/uts/intel/i40e/Makefile
index 9d6bf553ec..6c32e5674f 100644
--- a/usr/src/uts/intel/i40e/Makefile
+++ b/usr/src/uts/intel/i40e/Makefile
@@ -45,6 +45,8 @@ CERRWARN   += -_cc=-erroff=E_ENUM_VAL_OVERFLOWS_INT_MAX
 
 LDFLAGS		+= -dy -N misc/mac
 
+MAPFILES	+= ddi mac random
+
 .KEEP_STATE:
 
 def:		$(DEF_DEPS)
@@ -63,4 +65,5 @@ clean.lint:	$(CLEAN_LINT_DEPS)
 
 install:	$(INSTALL_DEPS)
 
+include $(UTSBASE)/Makefile.mapfile
 include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/ia32/krtld/kobj_reloc.c b/usr/src/uts/intel/ia32/krtld/kobj_reloc.c
index befd15853a..46b878e2af 100644
--- a/usr/src/uts/intel/ia32/krtld/kobj_reloc.c
+++ b/usr/src/uts/intel/ia32/krtld/kobj_reloc.c
@@ -117,6 +117,43 @@ sdt_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
 	return (0);
 }
 
+/*
+ * We're relying on the fact that the call we're replacing is
+ * call (e8) plus 4 bytes of address, making a 5 byte instruction
+ */
+#define	NOP_INSTR	0x90
+#define	SMAP_NOPS	5
+
+/*
+ * Note that SMAP is only supported on amd64. In the context of
+ * ia32 this function only serves to NOP out calls to smap_enable() or
+ * smap_disable().
+ */
+static int
+smap_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
+{
+	if (strcmp(symname, "smap_enable") == 0 ||
+	    strcmp(symname, "smap_disable") == 0) {
+
+#ifdef	KOBJ_DEBUG
+		if (kobj_debug & D_RELOCATIONS) {
+			_kobj_printf(ops, "smap_reloc_resolve: %s relocating "
+			    "enable/disable_smap\n", mp->filename);
+		}
+#endif
+
+		/*
+		 * We backtrack one byte here to consume the call
+		 * instruction itself.
+		 */
+		memset((void *)instr - 1, NOP_INSTR, SMAP_NOPS);
+
+		return (0);
+	}
+
+	return (1);
+}
+
 int
 /* ARGSUSED2 */
 do_relocate(struct module *mp, char *reltbl, Word relshtype, int nreloc,
@@ -218,6 +255,11 @@ do_relocate(struct module *mp, char *reltbl, Word relshtype, int nreloc,
 					continue;
 
 				if (symref->st_shndx == SHN_UNDEF &&
+				    smap_reloc_resolve(mp, mp->strings +
+				    symref->st_name, (uint8_t *)off) == 0)
+					continue;
+
+				if (symref->st_shndx == SHN_UNDEF &&
 				    tnf_reloc_resolve(mp->strings +
 				    symref->st_name, &symref->st_value,
 				    off, &probelist, &taglist) != 0) {
diff --git a/usr/src/uts/intel/ia32/ml/copy.s b/usr/src/uts/intel/ia32/ml/copy.s
index 7593de374e..f76a8a43cb 100644
--- a/usr/src/uts/intel/ia32/ml/copy.s
+++ b/usr/src/uts/intel/ia32/ml/copy.s
@@ -36,7 +36,7 @@
 /*         All Rights Reserved						*/
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright (c) 2018 Joyent, Inc.
  */
 
 #include <sys/errno.h>
@@ -866,8 +866,8 @@ bcopy_patch_start:
 bcopy_patch_end:
 
 	.p2align 4
-	.globl bcopy_ck_size
-bcopy_ck_size:
+	ALTENTRY(bcopy_ck_size)
+
 	cmpq	$BCOPY_DFLT_REP, %rdx
 	jae	L(use_rep)
 
@@ -956,6 +956,7 @@ L(use_rep):
 	jnz	L(do_remainder)
 	ret
 #undef	L
+	SET_SIZE(bcopy_ck_size)
 
 #ifdef DEBUG
 	/*
@@ -3138,47 +3139,6 @@ ucopystr(const char *ufrom, char *uto, size_t umaxlength, size_t *lencopied)
 
 #endif	/* __lint */
 
-/*
- * These functions are used for SMAP, supervisor mode access protection. They
- * are hotpatched to become real instructions when the system starts up which is
- * done in mlsetup() as a part of enabling the other CR4 related features.
- *
- * Generally speaking, smap_disable() is a stac instruction and smap_enable is a
- * clac instruction. It's safe to call these any number of times, and in fact,
- * out of paranoia, the kernel will likely call it at several points.
- */
-
-#if defined(__lint)
-
-void
-smap_enable(void)
-{}
-
-void
-smap_disable(void)
-{}
-
-#else
-
-#if defined (__amd64) || defined(__i386)
-	ENTRY(smap_disable)
-	nop
-	nop
-	nop
-	ret
-	SET_SIZE(smap_disable)
-
-	ENTRY(smap_enable)
-	nop
-	nop
-	nop
-	ret
-	SET_SIZE(smap_enable)
-
-#endif /* __amd64 || __i386 */
-
-#endif /* __lint */
-
 #ifndef __lint
 
 .data
diff --git a/usr/src/uts/intel/ia32/ml/modstubs.s b/usr/src/uts/intel/ia32/ml/modstubs.s
index d38b4e87c9..040c5f0ea5 100644
--- a/usr/src/uts/intel/ia32/ml/modstubs.s
+++ b/usr/src/uts/intel/ia32/ml/modstubs.s
@@ -50,7 +50,7 @@ char stubs_base[1], stubs_end[1];
  *	NOTE: Use NO_UNLOAD_STUBs if the module is NOT unloadable once it is
  *	      loaded.
  */
-#define	MAXNARG	10
+#define	MAXNARG	12
 
 /*
  * WARNING: there is no check for forgetting to write END_MODULE,
@@ -184,7 +184,7 @@ fcnname/**/_info:							\
 	pushq	%rcx
 	pushq	%r8
 	pushq	%r9
-	/* (next 4 args, if any, are already on the stack above %rbp) */
+	/* (next 6 args, if any, are already on the stack above %rbp) */
 	movq	%r15, %rdi
 	call	mod_hold_stub		/* mod_hold_stub(mod_stub_info *) */
 	cmpl	$-1, %eax		/* error? */
@@ -195,7 +195,7 @@ fcnname/**/_info:							\
 	jmp	.L2
 .L1:
 	/*
-	 * copy MAXNARG == 10 incoming arguments
+	 * copy MAXNARG == 12 incoming arguments
 	 */
 	popq	%r9
 	popq	%r8
@@ -219,8 +219,10 @@ fcnname/**/_info:							\
 	pushq	(%rsp, %r11, 8)
 	pushq	(%rsp, %r11, 8)
 	pushq	(%rsp, %r11, 8)
+	pushq	(%rsp, %r11, 8)
+	pushq	(%rsp, %r11, 8)
 	call	*(%r15)			/* call the stub fn(arg, ..) */
-	addq	$0x20, %rsp		/* pop off last 4 args */
+	addq	$0x30, %rsp		/* pop off last 6 args */
 	pushq	%rax			/* save any return values */
 	pushq	%rdx
 	movq	%r15, %rdi
@@ -345,6 +347,8 @@ fcnname/**/_info:							\
 	pushl	(%esp, %ecx, 4)
 	pushl	(%esp, %ecx, 4)
 	pushl	(%esp, %ecx, 4)
+	pushl	(%esp, %ecx, 4)
+	pushl	(%esp, %ecx, 4)
 	call	*(%esi)			/ call the stub function(arg1,arg2, ...)
 	add	$_MUL(MAXNARG, 4), %esp	/ pop off MAXNARG arguments
 	pushl	%eax			/ save any return values from the stub
@@ -1425,6 +1429,23 @@ fcnname/**/_info:							\
 	END_MODULE(apix);
 #endif
 
+/*
+ * Stubs for ppt module (bhyve PCI passthrough driver)
+ */
+#ifndef PPT_MODULE
+	MODULE(ppt,drv);
+	WSTUB(ppt, ppt_unassign_all,		nomod_zero);
+	WSTUB(ppt, ppt_map_mmio,		nomod_einval);
+	WSTUB(ppt, ppt_setup_msi,		nomod_einval);
+	WSTUB(ppt, ppt_setup_msix,		nomod_einval);
+	WSTUB(ppt, ppt_assigned_devices,	nomod_zero);
+	WSTUB(ppt, ppt_is_mmio,			nomod_zero);
+	WSTUB(ppt, ppt_assign_device,		nomod_einval);
+	WSTUB(ppt, ppt_unassign_device,		nomod_einval);
+	WSTUB(ppt, ppt_get_limits,		nomod_einval);
+	END_MODULE(ppt);
+#endif
+
 / this is just a marker for the area of text that contains stubs 
 
 	ENTRY_NP(stubs_end)
diff --git a/usr/src/uts/intel/ia32/ml/swtch.s b/usr/src/uts/intel/ia32/ml/swtch.s
index dd0db7b29b..c2c9fd9bd2 100644
--- a/usr/src/uts/intel/ia32/ml/swtch.s
+++ b/usr/src/uts/intel/ia32/ml/swtch.s
@@ -31,14 +31,6 @@
  * Process switching routines.
  */
 
-#if defined(__lint)
-#include <sys/thread.h>
-#include <sys/systm.h>
-#include <sys/time.h>
-#else	/* __lint */
-#include "assym.h"
-#endif	/* __lint */
-
 #include <sys/asm_linkage.h>
 #include <sys/asm_misc.h>
 #include <sys/regset.h>
@@ -47,6 +39,9 @@
 #include <sys/segments.h>
 #include <sys/psw.h>
 
+#if !defined(__lint)
+#include "assym.h"
+
 /*
  * resume(thread_id_t t);
  *
@@ -74,16 +69,10 @@
  * off the stack.
  */
 
-#if !defined(__lint)
-
 #if LWP_PCB_FPU != 0
 #error LWP_PCB_FPU MUST be defined as 0 for code in swtch.s to work
 #endif	/* LWP_PCB_FPU != 0 */
 
-#endif	/* !__lint */
-
-#if defined(__amd64)
-
 /*
  * Save non-volatile regs other than %rsp (%rbx, %rbp, and %r12 - %r15)
  *
@@ -153,88 +142,6 @@
 	jnz	0b;					\
 1:
 
-#elif defined (__i386)
-
-/*
- * Save non-volatile registers (%ebp, %esi, %edi and %ebx)
- *
- * The stack frame must be created before the save of %esp so that tracebacks
- * of swtch()ed-out processes show the process as having last called swtch().
- */
-#define SAVE_REGS(thread_t, retaddr)			\
-	movl	%ebp, T_EBP(thread_t);			\
-	movl	%ebx, T_EBX(thread_t);			\
-	movl	%esi, T_ESI(thread_t);			\
-	movl	%edi, T_EDI(thread_t);			\
-	pushl	%ebp;					\
-	movl	%esp, %ebp;				\
-	movl	%esp, T_SP(thread_t);			\
-	movl	retaddr, T_PC(thread_t);		\
-	movl	8(%ebp), %edi;				\
-	pushl	%edi;					\
-	call	__dtrace_probe___sched_off__cpu;	\
-	addl	$CLONGSIZE, %esp
-
-/*
- * Restore non-volatile registers (%ebp, %esi, %edi and %ebx)
- *
- * We don't do a 'leave,' because reloading %rsp/%rbp from the label_t
- * already has the effect of putting the stack back the way it was when
- * we came in.
- */
-#define RESTORE_REGS(scratch_reg)			\
-	movl	%gs:CPU_THREAD, scratch_reg;		\
-	movl	T_EBP(scratch_reg), %ebp;		\
-	movl	T_EBX(scratch_reg), %ebx;		\
-	movl	T_ESI(scratch_reg), %esi;		\
-	movl	T_EDI(scratch_reg), %edi
-
-/*
- * Get pointer to a thread's hat structure
- */
-#define GET_THREAD_HATP(hatp, thread_t, scratch_reg)	\
-	movl	T_PROCP(thread_t), hatp;		\
-	movl	P_AS(hatp), scratch_reg;		\
-	movl	A_HAT(scratch_reg), hatp
-
-/*
- * If we are resuming an interrupt thread, store a timestamp in the thread
- * structure.  If an interrupt occurs between tsc_read() and its subsequent
- * store, the timestamp will be stale by the time it is stored.  We can detect
- * this by doing a compare-and-swap on the thread's timestamp, since any
- * interrupt occurring in this window will put a new timestamp in the thread's
- * t_intr_start field.
- */
-#define	STORE_INTR_START(thread_t)			\
-	testw	$T_INTR_THREAD, T_FLAGS(thread_t);	\
-	jz	1f;					\
-	pushl	%ecx;					\
-0:							\
-	pushl	T_INTR_START(thread_t);			\
-	pushl	T_INTR_START+4(thread_t);		\
-	call	tsc_read;				\
-	movl	%eax, %ebx;				\
-	movl	%edx, %ecx;				\
-	popl	%edx;					\
-	popl	%eax;					\
-	cmpxchg8b T_INTR_START(thread_t);		\
-	jnz	0b;					\
-	popl	%ecx;					\
-1:
-
-#endif	/* __amd64 */
-
-#if defined(__lint)
-
-/* ARGSUSED */
-void
-resume(kthread_t *t)
-{}
-
-#else	/* __lint */
-
-#if defined(__amd64)
-
 	.global	kpti_enable
 
 	ENTRY(resume)
@@ -436,6 +343,8 @@ resume(kthread_t *t)
 	call	smap_disable
 .nosmap:
 
+	call	ht_mark
+
 	/*
 	 * Restore non-volatile registers, then have spl0 return to the
 	 * resuming thread's PC after first setting the priority as low as
@@ -456,202 +365,6 @@ resume_return:
 	SET_SIZE(_resume_from_idle)
 	SET_SIZE(resume)
 
-#elif defined (__i386)
-
-	ENTRY(resume)
-	movl	%gs:CPU_THREAD, %eax
-	movl	$resume_return, %ecx
-
-	/*
-	 * Save non-volatile registers, and set return address for current
-	 * thread to resume_return.
-	 *
-	 * %edi = t (new thread) when done.
-	 */
-	SAVE_REGS(%eax,  %ecx)
-
-	LOADCPU(%ebx)			/* %ebx = CPU */
-	movl	CPU_THREAD(%ebx), %esi	/* %esi = curthread */
-
-#ifdef DEBUG
-	call	assert_ints_enabled	/* panics if we are cli'd */
-#endif
-	/*
-	 * Call savectx if thread has installed context ops.
-	 *
-	 * Note that if we have floating point context, the save op
-	 * (either fpsave_begin or fpxsave_begin) will issue the
-	 * async save instruction (fnsave or fxsave respectively)
-	 * that we fwait for below.
-	 */
-	movl	T_CTX(%esi), %eax	/* should current thread savectx? */
-	testl	%eax, %eax
-	jz	.nosavectx		/* skip call when zero */
-	pushl	%esi			/* arg = thread pointer */
-	call	savectx			/* call ctx ops */
-	addl	$4, %esp		/* restore stack pointer */
-.nosavectx:
-
-        /*
-         * Call savepctx if process has installed context ops.
-         */
-	movl	T_PROCP(%esi), %eax	/* %eax = proc */
-	cmpl	$0, P_PCTX(%eax)	/* should current thread savectx? */
-	je	.nosavepctx		/* skip call when zero */
-	pushl	%eax			/* arg = proc pointer */
-	call	savepctx		/* call ctx ops */
-	addl	$4, %esp
-.nosavepctx:
-
-	/*
-	 * Temporarily switch to the idle thread's stack
-	 */
-	movl	CPU_IDLE_THREAD(%ebx), %eax 	/* idle thread pointer */
-
-	/*
-	 * Set the idle thread as the current thread
-	 */
-	movl	T_SP(%eax), %esp	/* It is safe to set esp */
-	movl	%eax, CPU_THREAD(%ebx)
-
-	/* switch in the hat context for the new thread */
-	GET_THREAD_HATP(%ecx, %edi, %ecx)
-	pushl	%ecx
-	call	hat_switch
-	addl	$4, %esp
-
-	/*
-	 * Clear and unlock previous thread's t_lock
-	 * to allow it to be dispatched by another processor.
-	 */
-	movb	$0, T_LOCK(%esi)
-
-	/*
-	 * IMPORTANT: Registers at this point must be:
-	 *       %edi = new thread
-	 *
-	 * Here we are in the idle thread, have dropped the old thread.
-	 */
-	ALTENTRY(_resume_from_idle)
-	/*
-	 * spin until dispatched thread's mutex has
-	 * been unlocked. this mutex is unlocked when
-	 * it becomes safe for the thread to run.
-	 */
-.L4:
-	lock
-	btsl	$0, T_LOCK(%edi) /* lock new thread's mutex */
-	jc	.L4_2			/* lock did not succeed */
-
-	/*
-	 * Fix CPU structure to indicate new running thread.
-	 * Set pointer in new thread to the CPU structure.
-	 */
-	LOADCPU(%esi)			/* load current CPU pointer */
-	movl	T_STACK(%edi), %eax	/* here to use v pipeline of */
-					/* Pentium. Used few lines below */
-	cmpl	%esi, T_CPU(%edi)
-	jne	.L5_2
-.L5_1:
-	/*
-	 * Setup esp0 (kernel stack) in TSS to curthread's stack.
-	 * (Note: Since we don't have saved 'regs' structure for all
-	 *	  the threads we can't easily determine if we need to
-	 *	  change esp0. So, we simply change the esp0 to bottom 
-	 *	  of the thread stack and it will work for all cases.)
-	 */
-	movl	CPU_TSS(%esi), %ecx
-	addl	$REGSIZE+MINFRAME, %eax	/* to the bottom of thread stack */
-#if !defined(__xpv)
-	movl	%eax, TSS_ESP0(%ecx)
-#else
-	pushl	%eax
-	pushl	$KDS_SEL
-	call	HYPERVISOR_stack_switch
-	addl	$8, %esp
-#endif	/* __xpv */
-
-	movl	%edi, CPU_THREAD(%esi)	/* set CPU's thread pointer */
-	mfence				/* synchronize with mutex_exit() */
-	xorl	%ebp, %ebp		/* make $<threadlist behave better */
-	movl	T_LWP(%edi), %eax 	/* set associated lwp to  */
-	movl	%eax, CPU_LWP(%esi) 	/* CPU's lwp ptr */
-
-	movl	T_SP(%edi), %esp	/* switch to outgoing thread's stack */
-	movl	T_PC(%edi), %esi	/* saved return addr */
-
-	/*
-	 * Call restorectx if context ops have been installed.
-	 */
-	movl	T_CTX(%edi), %eax	/* should resumed thread restorectx? */
-	testl	%eax, %eax
-	jz	.norestorectx		/* skip call when zero */
-	pushl	%edi			/* arg = thread pointer */
-	call	restorectx		/* call ctx ops */
-	addl	$4, %esp		/* restore stack pointer */
-.norestorectx:
-
-	/*
-	 * Call restorepctx if context ops have been installed for the proc.
-	 */
-	movl	T_PROCP(%edi), %eax
-	cmpl	$0, P_PCTX(%eax)
-	je	.norestorepctx
-	pushl	%eax			/* arg = proc pointer */
-	call	restorepctx
-	addl	$4, %esp		/* restore stack pointer */
-.norestorepctx:
-
-	STORE_INTR_START(%edi)
-
-	/*
-	 * Restore non-volatile registers, then have spl0 return to the
-	 * resuming thread's PC after first setting the priority as low as
-	 * possible and blocking all interrupt threads that may be active.
-	 */
-	movl	%esi, %eax		/* save return address */
-	RESTORE_REGS(%ecx)
-	pushl	%eax			/* push return address for spl0() */
-	call	__dtrace_probe___sched_on__cpu
-	jmp	spl0
-
-resume_return:
-	/*
-	 * Remove stack frame created in SAVE_REGS()
-	 */
-	addl	$CLONGSIZE, %esp
-	ret
-
-.L4_2:
-	pause
-	cmpb	$0, T_LOCK(%edi)
-	je	.L4
-	jmp	.L4_2
-
-.L5_2:
-	/* cp->cpu_stats.sys.cpumigrate++ */
-	addl    $1, CPU_STATS_SYS_CPUMIGRATE(%esi)
-	adcl    $0, CPU_STATS_SYS_CPUMIGRATE+4(%esi)
-	movl	%esi, T_CPU(%edi)	/* set new thread's CPU pointer */
-	jmp	.L5_1
-
-	SET_SIZE(_resume_from_idle)
-	SET_SIZE(resume)
-
-#endif	/* __amd64 */
-#endif	/* __lint */
-
-#if defined(__lint)
-
-/* ARGSUSED */
-void
-resume_from_zombie(kthread_t *t)
-{}
-
-#else	/* __lint */
-
-#if defined(__amd64)
-
 	ENTRY(resume_from_zombie)
 	movq	%gs:CPU_THREAD, %rax
 	leaq	resume_from_zombie_return(%rip), %r11
@@ -726,88 +439,6 @@ resume_from_zombie_return:
 	ret
 	SET_SIZE(resume_from_zombie)
 
-#elif defined (__i386)
-
-	ENTRY(resume_from_zombie)
-	movl	%gs:CPU_THREAD, %eax
-	movl	$resume_from_zombie_return, %ecx
-
-	/*
-	 * Save non-volatile registers, and set return address for current
-	 * thread to resume_from_zombie_return.
-	 *
-	 * %edi = t (new thread) when done.
-	 */
-	SAVE_REGS(%eax, %ecx)
-
-#ifdef DEBUG
-	call	assert_ints_enabled	/* panics if we are cli'd */
-#endif
-	movl	%gs:CPU_THREAD, %esi	/* %esi = curthread */
-
-	/* clean up the fp unit. It might be left enabled */
-
-	movl	%cr0, %eax
-	testl	$CR0_TS, %eax
-	jnz	.zfpu_disabled		/* if TS already set, nothing to do */
-	fninit				/* init fpu & discard pending error */
-	orl	$CR0_TS, %eax
-	movl	%eax, %cr0
-.zfpu_disabled:
-
-	/*
-	 * Temporarily switch to the idle thread's stack so that the zombie
-	 * thread's stack can be reclaimed by the reaper.
-	 */
-	movl	%gs:CPU_IDLE_THREAD, %eax /* idle thread pointer */
-	movl	T_SP(%eax), %esp	/* get onto idle thread stack */
-
-	/*
-	 * Set the idle thread as the current thread.
-	 */
-	movl	%eax, %gs:CPU_THREAD
-
-	/*
-	 * switch in the hat context for the new thread
-	 */
-	GET_THREAD_HATP(%ecx, %edi, %ecx)
-	pushl	%ecx
-	call	hat_switch
-	addl	$4, %esp
-
-	/*
-	 * Put the zombie on death-row.
-	 */
-	pushl	%esi
-	call	reapq_add
-	addl	$4, %esp
-	jmp	_resume_from_idle	/* finish job of resume */
-
-resume_from_zombie_return:
-	RESTORE_REGS(%ecx)		/* restore non-volatile registers */
-	call	__dtrace_probe___sched_on__cpu
-
-	/*
-	 * Remove stack frame created in SAVE_REGS()
-	 */
-	addl	$CLONGSIZE, %esp
-	ret
-	SET_SIZE(resume_from_zombie)
-
-#endif	/* __amd64 */
-#endif	/* __lint */
-
-#if defined(__lint)
-
-/* ARGSUSED */
-void
-resume_from_intr(kthread_t *t)
-{}
-
-#else	/* __lint */
-
-#if defined(__amd64)
-
 	ENTRY(resume_from_intr)
 	movq	%gs:CPU_THREAD, %rax
 	leaq	resume_from_intr_return(%rip), %r11
@@ -834,6 +465,8 @@ resume_from_intr(kthread_t *t)
 
 	STORE_INTR_START(%r12)
 
+	call	ht_mark
+
 	/*
 	 * Restore non-volatile registers, then have spl0 return to the
 	 * resuming thread's PC after first setting the priority as low as
@@ -853,69 +486,6 @@ resume_from_intr_return:
 	ret
 	SET_SIZE(resume_from_intr)
 
-#elif defined (__i386)
-
-	ENTRY(resume_from_intr)
-	movl	%gs:CPU_THREAD, %eax
-	movl	$resume_from_intr_return, %ecx
-
-	/*
-	 * Save non-volatile registers, and set return address for current
-	 * thread to resume_return.
-	 *
-	 * %edi = t (new thread) when done.
-	 */
-	SAVE_REGS(%eax, %ecx)
-
-#ifdef DEBUG
-	call	assert_ints_enabled	/* panics if we are cli'd */
-#endif
-	movl	%gs:CPU_THREAD, %esi	/* %esi = curthread */
-	movl	%edi, %gs:CPU_THREAD	/* set CPU's thread pointer */
-	mfence				/* synchronize with mutex_exit() */
-	movl	T_SP(%edi), %esp	/* restore resuming thread's sp */
-	xorl	%ebp, %ebp		/* make $<threadlist behave better */
-
-	/*
-	 * Unlock outgoing thread's mutex dispatched by another processor.
-	 */
-	xorl	%eax,%eax
-	xchgb	%al, T_LOCK(%esi)
-
-	STORE_INTR_START(%edi)
-
-	/*
-	 * Restore non-volatile registers, then have spl0 return to the
-	 * resuming thread's PC after first setting the priority as low as
-	 * possible and blocking all interrupt threads that may be active.
-	 */
-	movl	T_PC(%edi), %eax	/* saved return addr */
-	RESTORE_REGS(%ecx)
-	pushl	%eax			/* push return address for spl0() */
-	call	__dtrace_probe___sched_on__cpu
-	jmp	spl0
-
-resume_from_intr_return:
-	/*
-	 * Remove stack frame created in SAVE_REGS()
-	 */
-	addl	$CLONGSIZE, %esp
-	ret
-	SET_SIZE(resume_from_intr)
-
-#endif	/* __amd64 */
-#endif /* __lint */
-
-#if defined(__lint)
-
-void
-thread_start(void)
-{}
-
-#else   /* __lint */
-
-#if defined(__amd64)
-
 	ENTRY(thread_start)
 	popq	%rax		/* start() */
 	popq	%rdi		/* arg */
@@ -926,18 +496,42 @@ thread_start(void)
 	/*NOTREACHED*/
 	SET_SIZE(thread_start)
 
-#elif defined(__i386)
-
-	ENTRY(thread_start)
-	popl	%eax
-	movl	%esp, %ebp
-	addl	$8, %ebp
-	call	*%eax
-	addl	$8, %esp
-	call	thread_exit	/* destroy thread if it returns. */
-	/*NOTREACHED*/
-	SET_SIZE(thread_start)
-
-#endif	/* __i386 */
+	ENTRY(thread_splitstack_run)
+	pushq	%rbp			/* push base pointer */
+	movq	%rsp, %rbp		/* construct frame */
+	movq	%rdi, %rsp		/* set stack pinter */
+	movq	%rdx, %rdi		/* load arg */
+	call	*%rsi			/* call specified function */
+	leave				/* pop base pointer */
+	ret
+	SET_SIZE(thread_splitstack_run)
+
+	/*
+	 * Once we're back on our own stack, we need to be sure to set the
+	 * value of rsp0 in the TSS back to our original stack:  if we gave
+	 * up the CPU at all while on our split stack, the rsp0 will point
+	 * to that stack from resume (above); if were to try to return to
+	 * userland in that state, we will die absolutely horribly (namely,
+	 * trying to iretq back to registers in a bunch of freed segkp).  We
+	 * are expecting this to be called after T_STACK has been restored,
+	 * but before we return.  It's okay if we are preempted in this code:
+	 * when the new CPU picks us up, they will automatically set rsp0
+	 * correctly, which is all we're trying to do here.
+	 */
+	ENTRY(thread_splitstack_cleanup)
+	LOADCPU(%r8)
+	movq	CPU_TSS(%r8), %r9
+	cmpq	$1, kpti_enable
+	jne	1f
+	leaq	CPU_KPTI_TR_RSP(%r8), %rax
+	jmp	2f
+1:
+	movq	CPU_THREAD(%r8), %r10
+	movq	T_STACK(%r10), %rax
+	addq	$REGSIZE+MINFRAME, %rax
+2:
+	movq	%rax, TSS_RSP0(%r9)
+	ret
+	SET_SIZE(thread_splitstack_cleanup)
 
-#endif  /* __lint */
+#endif /* !__lint */
diff --git a/usr/src/uts/intel/ia32/os/archdep.c b/usr/src/uts/intel/ia32/os/archdep.c
index 4c8d1acd9f..830daa0af7 100644
--- a/usr/src/uts/intel/ia32/os/archdep.c
+++ b/usr/src/uts/intel/ia32/os/archdep.c
@@ -573,6 +573,13 @@ ucontext_32ton(const ucontext32_t *src, ucontext_t *dst)
 	if (src->uc_flags & UC_FPU)
 		fpregset_32ton(&src->uc_mcontext.fpregs,
 		    &dst->uc_mcontext.fpregs);
+
+	/*
+	 * Copy the brand-private data:
+	 */
+	dst->uc_brand_data[0] = (void *)(uintptr_t)src->uc_brand_data[0];
+	dst->uc_brand_data[1] = (void *)(uintptr_t)src->uc_brand_data[1];
+	dst->uc_brand_data[2] = (void *)(uintptr_t)src->uc_brand_data[2];
 }
 
 #endif	/* _SYSCALL32_IMPL */
@@ -627,9 +634,11 @@ getuserpc()
 #define	IS_NOT_CS	0
 
 /*ARGSUSED*/
-static greg_t
+greg_t
 fix_segreg(greg_t sr, int iscs, model_t datamodel)
 {
+	kthread_t *t = curthread;
+
 	switch (sr &= 0xffff) {
 
 	case 0:
@@ -666,6 +675,19 @@ fix_segreg(greg_t sr, int iscs, model_t datamodel)
 	}
 
 	/*
+	 * Allow this process's brand to do any necessary segment register
+	 * manipulation.
+	 */
+	if (PROC_IS_BRANDED(t->t_procp) && BRMOP(t->t_procp)->b_fixsegreg) {
+		greg_t bsr = BRMOP(t->t_procp)->b_fixsegreg(sr, datamodel);
+
+		if (bsr == 0 && iscs == IS_CS)
+			return (0 | SEL_UPL);
+		else
+			return (bsr);
+	}
+
+	/*
 	 * Force it into the LDT in ring 3 for 32-bit processes, which by
 	 * default do not have an LDT, so that any attempt to use an invalid
 	 * selector will reference the (non-existant) LDT, and cause a #gp
diff --git a/usr/src/uts/intel/ia32/os/comm_page_util.c b/usr/src/uts/intel/ia32/os/comm_page_util.c
index 4150853813..14fcf9ca57 100644
--- a/usr/src/uts/intel/ia32/os/comm_page_util.c
+++ b/usr/src/uts/intel/ia32/os/comm_page_util.c
@@ -39,12 +39,12 @@ comm_page_mapin()
 {
 #if defined(__amd64) && !defined(__xpv)
 	proc_t *p = curproc;
-	caddr_t addr = NULL;
+	caddr_t addr = (caddr_t)COMM_PAGE_ALIGN;
 	size_t len = COMM_PAGE_SIZE;
 	uint_t prot = PROT_USER | PROT_READ;
 	segumap_crargs_t suarg;
 
-	map_addr(&addr, len, (offset_t)0, 1, 0);
+	map_addr(&addr, len, (offset_t)0, 1, MAP_ALIGN);
 	if (addr == NULL || valid_usr_range(addr, len, prot, p->p_as,
 	    p->p_as->a_userlimit) != RANGE_OKAY) {
 		return (NULL);
diff --git a/usr/src/uts/intel/ia32/os/desctbls.c b/usr/src/uts/intel/ia32/os/desctbls.c
index 8a6ae25a70..8e0a4edd61 100644
--- a/usr/src/uts/intel/ia32/os/desctbls.c
+++ b/usr/src/uts/intel/ia32/os/desctbls.c
@@ -167,7 +167,7 @@ struct interposing_handler {
  * The brand infrastructure interposes on two handlers, and we use one as a
  * NULL signpost.
  */
-static struct interposing_handler brand_tbl[2];
+static struct interposing_handler brand_tbl[3];
 
 /*
  * software prototypes for default local descriptor table
@@ -984,6 +984,13 @@ init_idt_common(gate_desc_t *idt)
 	    KCS_SEL, SDT_SYSIGT, TRP_KPL, idt_vector_to_ist(T_SIMDFPE));
 
 	/*
+	 * install "int80" handler at, well, 0x80.
+	 */
+	set_gatesegd(&idt0[T_INT80],
+	    (kpti_enable == 1) ? &tr_sys_int80 : &sys_int80,
+	    KCS_SEL, SDT_SYSIGT, TRP_UPL, idt_vector_to_ist(T_INT80));
+
+	/*
 	 * install fast trap handler at 210.
 	 */
 	set_gatesegd(&idt[T_FASTTRAP],
@@ -1005,18 +1012,25 @@ init_idt_common(gate_desc_t *idt)
 	    KCS_SEL, SDT_SYSIGT, TRP_UPL, idt_vector_to_ist(T_DTRACE_RET));
 
 	/*
-	 * Prepare interposing descriptor for the syscall handler
-	 * and cache copy of the default descriptor.
+	 * Prepare interposing descriptors for the branded "int80"
+	 * and syscall handlers and cache copies of the default
+	 * descriptors.
 	 */
-	brand_tbl[0].ih_inum = T_SYSCALLINT;
-	brand_tbl[0].ih_default_desc = idt0[T_SYSCALLINT];
-
+	brand_tbl[0].ih_inum = T_INT80;
+	brand_tbl[0].ih_default_desc = idt0[T_INT80];
 	set_gatesegd(&(brand_tbl[0].ih_interp_desc),
+	    (kpti_enable == 1) ? &tr_brand_sys_int80 : &brand_sys_int80,
+	    KCS_SEL, SDT_SYSIGT, TRP_UPL, idt_vector_to_ist(T_INT80));
+
+	brand_tbl[1].ih_inum = T_SYSCALLINT;
+	brand_tbl[1].ih_default_desc = idt0[T_SYSCALLINT];
+
+	set_gatesegd(&(brand_tbl[1].ih_interp_desc),
 	    (kpti_enable == 1) ? &tr_brand_sys_syscall_int :
 	    &brand_sys_syscall_int, KCS_SEL, SDT_SYSIGT, TRP_UPL,
 	    idt_vector_to_ist(T_SYSCALLINT));
 
-	brand_tbl[1].ih_inum = 0;
+	brand_tbl[2].ih_inum = 0;
 }
 
 #if defined(__xpv)
diff --git a/usr/src/uts/intel/ia32/os/sendsig.c b/usr/src/uts/intel/ia32/os/sendsig.c
index b7b79f38ca..cf6c623b7a 100644
--- a/usr/src/uts/intel/ia32/os/sendsig.c
+++ b/usr/src/uts/intel/ia32/os/sendsig.c
@@ -20,6 +20,9 @@
  */
 
 /*
+ * Copyright 2015 Joyent, Inc.
+ */
+/*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
@@ -87,6 +90,8 @@
 #include <sys/kdi.h>
 #include <sys/contract_impl.h>
 #include <sys/x86_archext.h>
+#include <sys/brand.h>
+#include <sys/sdt.h>
 
 /*
  * Construct the execution environment for the user's signal
@@ -186,7 +191,18 @@ sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
 	newstack = sigismember(&PTOU(curproc)->u_sigonstack, sig) &&
 	    !(lwp->lwp_sigaltstack.ss_flags & (SS_ONSTACK|SS_DISABLE));
 
-	if (newstack) {
+	/*
+	 * If this is a branded process, the brand may provide an alternate
+	 * stack pointer for signal delivery:
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig_stack != NULL) {
+		/*
+		 * Use the stack pointer value provided by the brand,
+		 * accounting for the 128-byte reserved region.
+		 */
+		newstack = 0;
+		fp = BROP(p)->b_sendsig_stack(sig) - STACK_RESERVE;
+	} else if (newstack) {
 		fp = (caddr_t)(SA((uintptr_t)lwp->lwp_sigaltstack.ss_sp) +
 		    SA(lwp->lwp_sigaltstack.ss_size) - STACK_ALIGN);
 	} else {
@@ -296,6 +312,8 @@ sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
 	kmem_free(tuc, sizeof (*tuc));
 	tuc = NULL;
 
+	DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
+	    uintptr_t, lwp->lwp_oldcontext, uintptr_t, (uintptr_t)uc);
 	lwp->lwp_oldcontext = (uintptr_t)uc;
 
 	if (newstack) {
@@ -345,6 +363,14 @@ sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
 	}
 
 	/*
+	 * Allow the brand to perform additional book-keeping once the signal
+	 * handling frame has been fully assembled:
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig != NULL) {
+		BROP(p)->b_sendsig(sig);
+	}
+
+	/*
 	 * Don't set lwp_eosys here.  sendsig() is called via psig() after
 	 * lwp_eosys is handled, so setting it here would affect the next
 	 * system call.
@@ -420,7 +446,17 @@ sendsig32(int sig, k_siginfo_t *sip, void (*hdlr)())
 	newstack = sigismember(&PTOU(curproc)->u_sigonstack, sig) &&
 	    !(lwp->lwp_sigaltstack.ss_flags & (SS_ONSTACK|SS_DISABLE));
 
-	if (newstack) {
+	/*
+	 * If this is a branded process, the brand may provide an alternate
+	 * stack pointer for signal delivery:
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig_stack != NULL) {
+		/*
+		 * Use the stack pointer value provided by the brand:
+		 */
+		newstack = 0;
+		fp = BROP(p)->b_sendsig_stack(sig);
+	} else if (newstack) {
 		fp = (caddr_t)(SA32((uintptr_t)lwp->lwp_sigaltstack.ss_sp) +
 		    SA32(lwp->lwp_sigaltstack.ss_size) - STACK_ALIGN32);
 	} else if ((rp->r_ss & 0xffff) != UDS_SEL) {
@@ -435,8 +471,9 @@ sendsig32(int sig, k_siginfo_t *sip, void (*hdlr)())
 			    USEGD_GETBASE(&ldt[SELTOIDX(rp->r_ss)]);
 		else
 			fp = (caddr_t)rp->r_sp;
-	} else
+	} else {
 		fp = (caddr_t)rp->r_sp;
+	}
 
 	/*
 	 * Force proper stack pointer alignment, even in the face of a
@@ -517,6 +554,8 @@ sendsig32(int sig, k_siginfo_t *sip, void (*hdlr)())
 	kmem_free(tuc, sizeof (*tuc));
 	tuc = NULL;
 
+	DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
+	    uintptr_t, lwp->lwp_oldcontext, uintptr_t, (uintptr_t)uc);
 	lwp->lwp_oldcontext = (uintptr_t)uc;
 
 	if (newstack) {
@@ -566,6 +605,14 @@ sendsig32(int sig, k_siginfo_t *sip, void (*hdlr)())
 	}
 
 	/*
+	 * Allow the brand to perform additional book-keeping once the signal
+	 * handling frame has been fully assembled:
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig != NULL) {
+		BROP(p)->b_sendsig(sig);
+	}
+
+	/*
 	 * Don't set lwp_eosys here.  sendsig() is called via psig() after
 	 * lwp_eosys is handled, so setting it here would affect the next
 	 * system call.
@@ -643,7 +690,17 @@ sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
 	newstack = sigismember(&PTOU(curproc)->u_sigonstack, sig) &&
 	    !(lwp->lwp_sigaltstack.ss_flags & (SS_ONSTACK|SS_DISABLE));
 
-	if (newstack) {
+	/*
+	 * If this is a branded process, the brand may provide an alternate
+	 * stack pointer for signal delivery:
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig_stack != NULL) {
+		/*
+		 * Use the stack pointer value provided by the brand:
+		 */
+		newstack = 0;
+		fp = BROP(p)->b_sendsig_stack(sig);
+	} else if (newstack) {
 		fp = (caddr_t)(SA((uintptr_t)lwp->lwp_sigaltstack.ss_sp) +
 		    SA(lwp->lwp_sigaltstack.ss_size) - STACK_ALIGN);
 	} else if ((rp->r_ss & 0xffff) != UDS_SEL) {
@@ -658,8 +715,9 @@ sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
 			    USEGD_GETBASE(&ldt[SELTOIDX(rp->r_ss)]);
 		else
 			fp = (caddr_t)rp->r_sp;
-	} else
+	} else {
 		fp = (caddr_t)rp->r_sp;
+	}
 
 	/*
 	 * Force proper stack pointer alignment, even in the face of a
@@ -737,6 +795,8 @@ sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
 	kmem_free(tuc, sizeof (*tuc));
 	tuc = NULL;
 
+	DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
+	    uintptr_t, lwp->lwp_oldcontext, uintptr_t, (uintptr_t)uc);
 	lwp->lwp_oldcontext = (uintptr_t)uc;
 
 	if (newstack) {
@@ -774,6 +834,14 @@ sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
 	}
 
 	/*
+	 * Allow the brand to perform additional book-keeping once the signal
+	 * handling frame has been fully assembled:
+	 */
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig != NULL) {
+		BROP(p)->b_sendsig(sig);
+	}
+
+	/*
 	 * Don't set lwp_eosys here.  sendsig() is called via psig() after
 	 * lwp_eosys is handled, so setting it here would affect the next
 	 * system call.
diff --git a/usr/src/uts/intel/ia32/syscall/getcontext.c b/usr/src/uts/intel/ia32/syscall/getcontext.c
index cb5a5b52ba..8f72b5da72 100644
--- a/usr/src/uts/intel/ia32/syscall/getcontext.c
+++ b/usr/src/uts/intel/ia32/syscall/getcontext.c
@@ -20,6 +20,9 @@
  */
 
 /*
+ * Copyright 2015 Joyent, Inc.
+ */
+/*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
@@ -46,6 +49,7 @@
 #include <sys/schedctl.h>
 #include <sys/debug.h>
 #include <sys/sysmacros.h>
+#include <sys/sdt.h>
 
 /*
  * Save user context.
@@ -125,7 +129,23 @@ savecontext(ucontext_t *ucp, const k_sigset_t *mask)
 	else
 		ucp->uc_flags &= ~UC_FPU;
 
-	sigktou(mask, &ucp->uc_sigmask);
+	if (mask != NULL) {
+		/*
+		 * Save signal mask.
+		 */
+		sigktou(mask, &ucp->uc_sigmask);
+	} else {
+		ucp->uc_flags &= ~UC_SIGMASK;
+		bzero(&ucp->uc_sigmask, sizeof (ucp->uc_sigmask));
+	}
+
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_savecontext != NULL) {
+		/*
+		 * Allow the brand the chance to modify the context we
+		 * saved:
+		 */
+		BROP(p)->b_savecontext(ucp);
+	}
 }
 
 /*
@@ -136,7 +156,19 @@ restorecontext(ucontext_t *ucp)
 {
 	kthread_t *t = curthread;
 	klwp_t *lwp = ttolwp(t);
+	proc_t *p = lwptoproc(lwp);
 
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_restorecontext != NULL) {
+		/*
+		 * Allow the brand the chance to modify the context before
+		 * we restore it:
+		 */
+		BROP(p)->b_restorecontext(ucp);
+	}
+
+	DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
+	    uintptr_t, lwp->lwp_oldcontext,
+	    uintptr_t, (uintptr_t)ucp->uc_link);
 	lwp->lwp_oldcontext = (uintptr_t)ucp->uc_link;
 
 	if (ucp->uc_flags & UC_STACK) {
@@ -184,6 +216,7 @@ getsetcontext(int flag, void *arg)
 	ucontext_t *ucp;
 	klwp_t *lwp = ttolwp(curthread);
 	stack_t dummy_stk;
+	proc_t *p = lwptoproc(lwp);
 
 	/*
 	 * In future releases, when the ucontext structure grows,
@@ -228,6 +261,15 @@ getsetcontext(int flag, void *arg)
 			return (set_errno(EFAULT));
 		}
 
+		/*
+		 * If this is a branded process, copy in the brand-private
+		 * data:
+		 */
+		if (PROC_IS_BRANDED(p) && copyin(&ucp->uc_brand_data,
+		    &uc.uc_brand_data, sizeof (uc.uc_brand_data)) != 0) {
+			return (set_errno(EFAULT));
+		}
+
 		restorecontext(&uc);
 
 		if ((uc.uc_flags & UC_STACK) && (lwp->lwp_ustack != 0))
@@ -311,7 +353,23 @@ savecontext32(ucontext32_t *ucp, const k_sigset_t *mask)
 	else
 		ucp->uc_flags &= ~UC_FPU;
 
-	sigktou(mask, &ucp->uc_sigmask);
+	if (mask != NULL) {
+		/*
+		 * Save signal mask.
+		 */
+		sigktou(mask, &ucp->uc_sigmask);
+	} else {
+		ucp->uc_flags &= ~UC_SIGMASK;
+		bzero(&ucp->uc_sigmask, sizeof (ucp->uc_sigmask));
+	}
+
+	if (PROC_IS_BRANDED(p) && BROP(p)->b_savecontext32 != NULL) {
+		/*
+		 * Allow the brand the chance to modify the context we
+		 * saved:
+		 */
+		BROP(p)->b_savecontext32(ucp);
+	}
 }
 
 int
@@ -323,6 +381,7 @@ getsetcontext32(int flag, void *arg)
 	klwp_t *lwp = ttolwp(curthread);
 	caddr32_t ustack32;
 	stack32_t dummy_stk32;
+	proc_t *p = lwptoproc(lwp);
 
 	switch (flag) {
 	default:
@@ -354,6 +413,15 @@ getsetcontext32(int flag, void *arg)
 			return (set_errno(EFAULT));
 		}
 
+		/*
+		 * If this is a branded process, copy in the brand-private
+		 * data:
+		 */
+		if (PROC_IS_BRANDED(p) && copyin(&ucp->uc_brand_data,
+		    &uc.uc_brand_data, sizeof (uc.uc_brand_data)) != 0) {
+			return (set_errno(EFAULT));
+		}
+
 		ucontext_32ton(&uc, &ucnat);
 		restorecontext(&ucnat);
 
diff --git a/usr/src/uts/intel/icmp/Makefile b/usr/src/uts/intel/icmp/Makefile
index 259530f9dc..b6b1048254 100644
--- a/usr/src/uts/intel/icmp/Makefile
+++ b/usr/src/uts/intel/icmp/Makefile
@@ -23,6 +23,7 @@
 #
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2016 Joyent, Inc.
 #
 #	This makefile drives the production of the icmp IP driver
 #
@@ -63,6 +64,8 @@ ALL_TARGET	= $(BINARY) $(SRC_CONFFILE)
 LINT_TARGET	= $(MODULE).lint
 INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOTLINK) $(ROOT_CONFFILE)
 
+INC_PATH	+= -I$(UTSBASE)/common/io/bpf
+
 #
 #	depends on ip and sockfs
 #
diff --git a/usr/src/uts/intel/igb/Makefile b/usr/src/uts/intel/igb/Makefile
index 2d4a1f3556..b85fc2f5c2 100644
--- a/usr/src/uts/intel/igb/Makefile
+++ b/usr/src/uts/intel/igb/Makefile
@@ -72,6 +72,7 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 # Driver depends on MAC
 #
 LDFLAGS		+= -dy -N misc/mac
+MAPFILES	+= ddi mac random
 
 #
 #	Default build targets.
@@ -97,4 +98,5 @@ install:	$(INSTALL_DEPS)
 #
 #	Include common targets.
 #
+include $(UTSBASE)/Makefile.mapfile
 include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/inotify/Makefile b/usr/src/uts/intel/inotify/Makefile
new file mode 100644
index 0000000000..80e7a80404
--- /dev/null
+++ b/usr/src/uts/intel/inotify/Makefile
@@ -0,0 +1,70 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= inotify
+OBJECTS		= $(INOTIFY_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(INOTIFY_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/common/io
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+LINTTAGS	+= -erroff=E_STRUCT_DERIVED_FROM_FLEX_MBR
+CERRWARN	+= -_gcc=-Wno-parentheses
+LDFLAGS		+= -dy -Nfs/specfs
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY) $(SRC_CONFILE)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/io/acpica/tables/tbprint.c b/usr/src/uts/intel/io/acpica/tables/tbprint.c
deleted file mode 100644
index 9dab6d9d4a..0000000000
--- a/usr/src/uts/intel/io/acpica/tables/tbprint.c
+++ /dev/null
@@ -1,272 +0,0 @@
-/******************************************************************************
- *
- * Module Name: tbprint - Table output utilities
- *
- *****************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#include "acpi.h"
-#include "accommon.h"
-#include "actables.h"
-
-#define _COMPONENT          ACPI_TABLES
-        ACPI_MODULE_NAME    ("tbprint")
-
-
-/* Local prototypes */
-
-static void
-AcpiTbFixString (
-    char                    *String,
-    ACPI_SIZE               Length);
-
-static void
-AcpiTbCleanupTableHeader (
-    ACPI_TABLE_HEADER       *OutHeader,
-    ACPI_TABLE_HEADER       *Header);
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbFixString
- *
- * PARAMETERS:  String              - String to be repaired
- *              Length              - Maximum length
- *
- * RETURN:      None
- *
- * DESCRIPTION: Replace every non-printable or non-ascii byte in the string
- *              with a question mark '?'.
- *
- ******************************************************************************/
-
-static void
-AcpiTbFixString (
-    char                    *String,
-    ACPI_SIZE               Length)
-{
-
-    while (Length && *String)
-    {
-        if (!isprint ((int) *String))
-        {
-            *String = '?';
-        }
-
-        String++;
-        Length--;
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbCleanupTableHeader
- *
- * PARAMETERS:  OutHeader           - Where the cleaned header is returned
- *              Header              - Input ACPI table header
- *
- * RETURN:      Returns the cleaned header in OutHeader
- *
- * DESCRIPTION: Copy the table header and ensure that all "string" fields in
- *              the header consist of printable characters.
- *
- ******************************************************************************/
-
-static void
-AcpiTbCleanupTableHeader (
-    ACPI_TABLE_HEADER       *OutHeader,
-    ACPI_TABLE_HEADER       *Header)
-{
-
-    memcpy (OutHeader, Header, sizeof (ACPI_TABLE_HEADER));
-
-    AcpiTbFixString (OutHeader->Signature, ACPI_NAME_SIZE);
-    AcpiTbFixString (OutHeader->OemId, ACPI_OEM_ID_SIZE);
-    AcpiTbFixString (OutHeader->OemTableId, ACPI_OEM_TABLE_ID_SIZE);
-    AcpiTbFixString (OutHeader->AslCompilerId, ACPI_NAME_SIZE);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbPrintTableHeader
- *
- * PARAMETERS:  Address             - Table physical address
- *              Header              - Table header
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print an ACPI table header. Special cases for FACS and RSDP.
- *
- ******************************************************************************/
-
-void
-AcpiTbPrintTableHeader (
-    ACPI_PHYSICAL_ADDRESS   Address,
-    ACPI_TABLE_HEADER       *Header)
-{
-    ACPI_TABLE_HEADER       LocalHeader;
-
-
-    if (ACPI_COMPARE_NAME (Header->Signature, ACPI_SIG_FACS))
-    {
-        /* FACS only has signature and length fields */
-
-        ACPI_INFO (("%-4.4s 0x%8.8X%8.8X %06X",
-            Header->Signature, ACPI_FORMAT_UINT64 (Address),
-            Header->Length));
-    }
-    else if (ACPI_VALIDATE_RSDP_SIG (Header->Signature))
-    {
-        /* RSDP has no common fields */
-
-        memcpy (LocalHeader.OemId, ACPI_CAST_PTR (ACPI_TABLE_RSDP,
-            Header)->OemId, ACPI_OEM_ID_SIZE);
-        AcpiTbFixString (LocalHeader.OemId, ACPI_OEM_ID_SIZE);
-
-        ACPI_INFO (("RSDP 0x%8.8X%8.8X %06X (v%.2d %-6.6s)",
-            ACPI_FORMAT_UINT64 (Address),
-            (ACPI_CAST_PTR (ACPI_TABLE_RSDP, Header)->Revision > 0) ?
-                ACPI_CAST_PTR (ACPI_TABLE_RSDP, Header)->Length : 20,
-            ACPI_CAST_PTR (ACPI_TABLE_RSDP, Header)->Revision,
-            LocalHeader.OemId));
-    }
-    else
-    {
-        /* Standard ACPI table with full common header */
-
-        AcpiTbCleanupTableHeader (&LocalHeader, Header);
-
-        ACPI_INFO ((
-            "%-4.4s 0x%8.8X%8.8X"
-            " %06X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)",
-            LocalHeader.Signature, ACPI_FORMAT_UINT64 (Address),
-            LocalHeader.Length, LocalHeader.Revision, LocalHeader.OemId,
-            LocalHeader.OemTableId, LocalHeader.OemRevision,
-            LocalHeader.AslCompilerId, LocalHeader.AslCompilerRevision));
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbValidateChecksum
- *
- * PARAMETERS:  Table               - ACPI table to verify
- *              Length              - Length of entire table
- *
- * RETURN:      Status
- *
- * DESCRIPTION: Verifies that the table checksums to zero. Optionally returns
- *              exception on bad checksum.
- *
- ******************************************************************************/
-
-ACPI_STATUS
-AcpiTbVerifyChecksum (
-    ACPI_TABLE_HEADER       *Table,
-    UINT32                  Length)
-{
-    UINT8                   Checksum;
-
-
-    /*
-     * FACS/S3PT:
-     * They are the odd tables, have no standard ACPI header and no checksum
-     */
-
-    if (ACPI_COMPARE_NAME (Table->Signature, ACPI_SIG_S3PT) ||
-        ACPI_COMPARE_NAME (Table->Signature, ACPI_SIG_FACS))
-    {
-        return (AE_OK);
-    }
-
-    /* Compute the checksum on the table */
-
-    Checksum = AcpiTbChecksum (ACPI_CAST_PTR (UINT8, Table), Length);
-
-    /* Checksum ok? (should be zero) */
-
-    if (Checksum)
-    {
-        ACPI_BIOS_WARNING ((AE_INFO,
-            "Incorrect checksum in table [%4.4s] - 0x%2.2X, "
-            "should be 0x%2.2X",
-            Table->Signature, Table->Checksum,
-            (UINT8) (Table->Checksum - Checksum)));
-
-#if (ACPI_CHECKSUM_ABORT)
-        return (AE_BAD_CHECKSUM);
-#endif
-    }
-
-    return (AE_OK);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbChecksum
- *
- * PARAMETERS:  Buffer          - Pointer to memory region to be checked
- *              Length          - Length of this memory region
- *
- * RETURN:      Checksum (UINT8)
- *
- * DESCRIPTION: Calculates circular checksum of memory region.
- *
- ******************************************************************************/
-
-UINT8
-AcpiTbChecksum (
-    UINT8                   *Buffer,
-    UINT32                  Length)
-{
-    UINT8                   Sum = 0;
-    UINT8                   *End = Buffer + Length;
-
-
-    while (Buffer < End)
-    {
-        Sum = (UINT8) (Sum + *(Buffer++));
-    }
-
-    return (Sum);
-}
diff --git a/usr/src/uts/intel/io/acpica/tables/tbxfroot.c b/usr/src/uts/intel/io/acpica/tables/tbxfroot.c
deleted file mode 100644
index aaa24c470f..0000000000
--- a/usr/src/uts/intel/io/acpica/tables/tbxfroot.c
+++ /dev/null
@@ -1,323 +0,0 @@
-/******************************************************************************
- *
- * Module Name: tbxfroot - Find the root ACPI table (RSDT)
- *
- *****************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#include "acpi.h"
-#include "accommon.h"
-#include "actables.h"
-
-
-#define _COMPONENT          ACPI_TABLES
-        ACPI_MODULE_NAME    ("tbxfroot")
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbGetRsdpLength
- *
- * PARAMETERS:  Rsdp                - Pointer to RSDP
- *
- * RETURN:      Table length
- *
- * DESCRIPTION: Get the length of the RSDP
- *
- ******************************************************************************/
-
-UINT32
-AcpiTbGetRsdpLength (
-    ACPI_TABLE_RSDP         *Rsdp)
-{
-
-    if (!ACPI_VALIDATE_RSDP_SIG (Rsdp->Signature))
-    {
-        /* BAD Signature */
-
-        return (0);
-    }
-
-    /* "Length" field is available if table version >= 2 */
-
-    if (Rsdp->Revision >= 2)
-    {
-        return (Rsdp->Length);
-    }
-    else
-    {
-        return (ACPI_RSDP_CHECKSUM_LENGTH);
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbValidateRsdp
- *
- * PARAMETERS:  Rsdp                - Pointer to unvalidated RSDP
- *
- * RETURN:      Status
- *
- * DESCRIPTION: Validate the RSDP (ptr)
- *
- ******************************************************************************/
-
-ACPI_STATUS
-AcpiTbValidateRsdp (
-    ACPI_TABLE_RSDP         *Rsdp)
-{
-
-    /*
-     * The signature and checksum must both be correct
-     *
-     * Note: Sometimes there exists more than one RSDP in memory; the valid
-     * RSDP has a valid checksum, all others have an invalid checksum.
-     */
-    if (!ACPI_VALIDATE_RSDP_SIG (Rsdp->Signature))
-    {
-        /* Nope, BAD Signature */
-
-        return (AE_BAD_SIGNATURE);
-    }
-
-    /* Check the standard checksum */
-
-    if (AcpiTbChecksum ((UINT8 *) Rsdp, ACPI_RSDP_CHECKSUM_LENGTH) != 0)
-    {
-        return (AE_BAD_CHECKSUM);
-    }
-
-    /* Check extended checksum if table version >= 2 */
-
-    if ((Rsdp->Revision >= 2) &&
-        (AcpiTbChecksum ((UINT8 *) Rsdp, ACPI_RSDP_XCHECKSUM_LENGTH) != 0))
-    {
-        return (AE_BAD_CHECKSUM);
-    }
-
-    return (AE_OK);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiFindRootPointer
- *
- * PARAMETERS:  TableAddress            - Where the table pointer is returned
- *
- * RETURN:      Status, RSDP physical address
- *
- * DESCRIPTION: Search lower 1Mbyte of memory for the root system descriptor
- *              pointer structure. If it is found, set *RSDP to point to it.
- *
- * NOTE1:       The RSDP must be either in the first 1K of the Extended
- *              BIOS Data Area or between E0000 and FFFFF (From ACPI Spec.)
- *              Only a 32-bit physical address is necessary.
- *
- * NOTE2:       This function is always available, regardless of the
- *              initialization state of the rest of ACPI.
- *
- ******************************************************************************/
-
-ACPI_STATUS
-AcpiFindRootPointer (
-    ACPI_PHYSICAL_ADDRESS   *TableAddress)
-{
-    UINT8                   *TablePtr;
-    UINT8                   *MemRover;
-    UINT32                  PhysicalAddress;
-
-
-    ACPI_FUNCTION_TRACE (AcpiFindRootPointer);
-
-
-    /* 1a) Get the location of the Extended BIOS Data Area (EBDA) */
-
-    TablePtr = AcpiOsMapMemory (
-        (ACPI_PHYSICAL_ADDRESS) ACPI_EBDA_PTR_LOCATION,
-        ACPI_EBDA_PTR_LENGTH);
-    if (!TablePtr)
-    {
-        ACPI_ERROR ((AE_INFO,
-            "Could not map memory at 0x%8.8X for length %u",
-            ACPI_EBDA_PTR_LOCATION, ACPI_EBDA_PTR_LENGTH));
-
-        return_ACPI_STATUS (AE_NO_MEMORY);
-    }
-
-    ACPI_MOVE_16_TO_32 (&PhysicalAddress, TablePtr);
-
-    /* Convert segment part to physical address */
-
-    PhysicalAddress <<= 4;
-    AcpiOsUnmapMemory (TablePtr, ACPI_EBDA_PTR_LENGTH);
-
-    /* EBDA present? */
-
-    if (PhysicalAddress > 0x400)
-    {
-        /*
-         * 1b) Search EBDA paragraphs (EBDA is required to be a
-         *     minimum of 1K length)
-         */
-        TablePtr = AcpiOsMapMemory (
-            (ACPI_PHYSICAL_ADDRESS) PhysicalAddress,
-            ACPI_EBDA_WINDOW_SIZE);
-        if (!TablePtr)
-        {
-            ACPI_ERROR ((AE_INFO,
-                "Could not map memory at 0x%8.8X for length %u",
-                PhysicalAddress, ACPI_EBDA_WINDOW_SIZE));
-
-            return_ACPI_STATUS (AE_NO_MEMORY);
-        }
-
-        MemRover = AcpiTbScanMemoryForRsdp (
-            TablePtr, ACPI_EBDA_WINDOW_SIZE);
-        AcpiOsUnmapMemory (TablePtr, ACPI_EBDA_WINDOW_SIZE);
-
-        if (MemRover)
-        {
-            /* Return the physical address */
-
-            PhysicalAddress +=
-                (UINT32) ACPI_PTR_DIFF (MemRover, TablePtr);
-
-            *TableAddress = (ACPI_PHYSICAL_ADDRESS) PhysicalAddress;
-            return_ACPI_STATUS (AE_OK);
-        }
-    }
-
-    /*
-     * 2) Search upper memory: 16-byte boundaries in E0000h-FFFFFh
-     */
-    TablePtr = AcpiOsMapMemory (
-        (ACPI_PHYSICAL_ADDRESS) ACPI_HI_RSDP_WINDOW_BASE,
-        ACPI_HI_RSDP_WINDOW_SIZE);
-
-    if (!TablePtr)
-    {
-        ACPI_ERROR ((AE_INFO,
-            "Could not map memory at 0x%8.8X for length %u",
-            ACPI_HI_RSDP_WINDOW_BASE, ACPI_HI_RSDP_WINDOW_SIZE));
-
-        return_ACPI_STATUS (AE_NO_MEMORY);
-    }
-
-    MemRover = AcpiTbScanMemoryForRsdp (
-        TablePtr, ACPI_HI_RSDP_WINDOW_SIZE);
-    AcpiOsUnmapMemory (TablePtr, ACPI_HI_RSDP_WINDOW_SIZE);
-
-    if (MemRover)
-    {
-        /* Return the physical address */
-
-        PhysicalAddress = (UINT32)
-            (ACPI_HI_RSDP_WINDOW_BASE + ACPI_PTR_DIFF (MemRover, TablePtr));
-
-        *TableAddress = (ACPI_PHYSICAL_ADDRESS) PhysicalAddress;
-        return_ACPI_STATUS (AE_OK);
-    }
-
-    /* A valid RSDP was not found */
-
-    ACPI_BIOS_ERROR ((AE_INFO, "A valid RSDP was not found"));
-    return_ACPI_STATUS (AE_NOT_FOUND);
-}
-
-ACPI_EXPORT_SYMBOL (AcpiFindRootPointer)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTbScanMemoryForRsdp
- *
- * PARAMETERS:  StartAddress        - Starting pointer for search
- *              Length              - Maximum length to search
- *
- * RETURN:      Pointer to the RSDP if found, otherwise NULL.
- *
- * DESCRIPTION: Search a block of memory for the RSDP signature
- *
- ******************************************************************************/
-
-UINT8 *
-AcpiTbScanMemoryForRsdp (
-    UINT8                   *StartAddress,
-    UINT32                  Length)
-{
-    ACPI_STATUS             Status;
-    UINT8                   *MemRover;
-    UINT8                   *EndAddress;
-
-
-    ACPI_FUNCTION_TRACE (TbScanMemoryForRsdp);
-
-
-    EndAddress = StartAddress + Length;
-
-    /* Search from given start address for the requested length */
-
-    for (MemRover = StartAddress; MemRover < EndAddress;
-         MemRover += ACPI_RSDP_SCAN_STEP)
-    {
-        /* The RSDP signature and checksum must both be correct */
-
-        Status = AcpiTbValidateRsdp (
-            ACPI_CAST_PTR (ACPI_TABLE_RSDP, MemRover));
-        if (ACPI_SUCCESS (Status))
-        {
-            /* Sig and checksum valid, we have found a real RSDP */
-
-            ACPI_DEBUG_PRINT ((ACPI_DB_INFO,
-                "RSDP located at physical address %p\n", MemRover));
-            return_PTR (MemRover);
-        }
-
-        /* No sig match or bad checksum, keep searching */
-    }
-
-    /* Searched entire block, no RSDP was found */
-
-    ACPI_DEBUG_PRINT ((ACPI_DB_INFO,
-        "Searched entire block from %p, valid RSDP was not found\n",
-        StartAddress));
-    return_PTR (NULL);
-}
diff --git a/usr/src/uts/intel/io/acpica/utilities/utbuffer.c b/usr/src/uts/intel/io/acpica/utilities/utbuffer.c
deleted file mode 100644
index 863055f737..0000000000
--- a/usr/src/uts/intel/io/acpica/utilities/utbuffer.c
+++ /dev/null
@@ -1,362 +0,0 @@
-/******************************************************************************
- *
- * Module Name: utbuffer - Buffer dump routines
- *
- *****************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#include "acpi.h"
-#include "accommon.h"
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utbuffer")
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtDumpBuffer
- *
- * PARAMETERS:  Buffer              - Buffer to dump
- *              Count               - Amount to dump, in bytes
- *              Display             - BYTE, WORD, DWORD, or QWORD display:
- *                                      DB_BYTE_DISPLAY
- *                                      DB_WORD_DISPLAY
- *                                      DB_DWORD_DISPLAY
- *                                      DB_QWORD_DISPLAY
- *              BaseOffset          - Beginning buffer offset (display only)
- *
- * RETURN:      None
- *
- * DESCRIPTION: Generic dump buffer in both hex and ascii.
- *
- ******************************************************************************/
-
-void
-AcpiUtDumpBuffer (
-    UINT8                   *Buffer,
-    UINT32                  Count,
-    UINT32                  Display,
-    UINT32                  BaseOffset)
-{
-    UINT32                  i = 0;
-    UINT32                  j;
-    UINT32                  Temp32;
-    UINT8                   BufChar;
-
-
-    if (!Buffer)
-    {
-        AcpiOsPrintf ("Null Buffer Pointer in DumpBuffer!\n");
-        return;
-    }
-
-    if ((Count < 4) || (Count & 0x01))
-    {
-        Display = DB_BYTE_DISPLAY;
-    }
-
-    /* Nasty little dump buffer routine! */
-
-    while (i < Count)
-    {
-        /* Print current offset */
-
-        AcpiOsPrintf ("%6.4X: ", (BaseOffset + i));
-
-        /* Print 16 hex chars */
-
-        for (j = 0; j < 16;)
-        {
-            if (i + j >= Count)
-            {
-                /* Dump fill spaces */
-
-                AcpiOsPrintf ("%*s", ((Display * 2) + 1), " ");
-                j += Display;
-                continue;
-            }
-
-            switch (Display)
-            {
-            case DB_BYTE_DISPLAY:
-            default:    /* Default is BYTE display */
-
-                AcpiOsPrintf ("%02X ", Buffer[(ACPI_SIZE) i + j]);
-                break;
-
-            case DB_WORD_DISPLAY:
-
-                ACPI_MOVE_16_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j]);
-                AcpiOsPrintf ("%04X ", Temp32);
-                break;
-
-            case DB_DWORD_DISPLAY:
-
-                ACPI_MOVE_32_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j]);
-                AcpiOsPrintf ("%08X ", Temp32);
-                break;
-
-            case DB_QWORD_DISPLAY:
-
-                ACPI_MOVE_32_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j]);
-                AcpiOsPrintf ("%08X", Temp32);
-
-                ACPI_MOVE_32_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j + 4]);
-                AcpiOsPrintf ("%08X ", Temp32);
-                break;
-            }
-
-            j += Display;
-        }
-
-        /*
-         * Print the ASCII equivalent characters but watch out for the bad
-         * unprintable ones (printable chars are 0x20 through 0x7E)
-         */
-        AcpiOsPrintf (" ");
-        for (j = 0; j < 16; j++)
-        {
-            if (i + j >= Count)
-            {
-                AcpiOsPrintf ("\n");
-                return;
-            }
-
-            /*
-             * Add comment characters so rest of line is ignored when
-             * compiled
-             */
-            if (j == 0)
-            {
-                AcpiOsPrintf ("// ");
-            }
-
-            BufChar = Buffer[(ACPI_SIZE) i + j];
-            if (isprint (BufChar))
-            {
-                AcpiOsPrintf ("%c", BufChar);
-            }
-            else
-            {
-                AcpiOsPrintf (".");
-            }
-        }
-
-        /* Done with that line. */
-
-        AcpiOsPrintf ("\n");
-        i += 16;
-    }
-
-    return;
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtDebugDumpBuffer
- *
- * PARAMETERS:  Buffer              - Buffer to dump
- *              Count               - Amount to dump, in bytes
- *              Display             - BYTE, WORD, DWORD, or QWORD display:
- *                                      DB_BYTE_DISPLAY
- *                                      DB_WORD_DISPLAY
- *                                      DB_DWORD_DISPLAY
- *                                      DB_QWORD_DISPLAY
- *              ComponentID         - Caller's component ID
- *
- * RETURN:      None
- *
- * DESCRIPTION: Generic dump buffer in both hex and ascii.
- *
- ******************************************************************************/
-
-void
-AcpiUtDebugDumpBuffer (
-    UINT8                   *Buffer,
-    UINT32                  Count,
-    UINT32                  Display,
-    UINT32                  ComponentId)
-{
-
-    /* Only dump the buffer if tracing is enabled */
-
-    if (!((ACPI_LV_TABLES & AcpiDbgLevel) &&
-        (ComponentId & AcpiDbgLayer)))
-    {
-        return;
-    }
-
-    AcpiUtDumpBuffer (Buffer, Count, Display, 0);
-}
-
-
-#ifdef ACPI_APPLICATION
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtDumpBufferToFile
- *
- * PARAMETERS:  File                - File descriptor
- *              Buffer              - Buffer to dump
- *              Count               - Amount to dump, in bytes
- *              Display             - BYTE, WORD, DWORD, or QWORD display:
- *                                      DB_BYTE_DISPLAY
- *                                      DB_WORD_DISPLAY
- *                                      DB_DWORD_DISPLAY
- *                                      DB_QWORD_DISPLAY
- *              BaseOffset          - Beginning buffer offset (display only)
- *
- * RETURN:      None
- *
- * DESCRIPTION: Generic dump buffer in both hex and ascii to a file.
- *
- ******************************************************************************/
-
-void
-AcpiUtDumpBufferToFile (
-    ACPI_FILE               File,
-    UINT8                   *Buffer,
-    UINT32                  Count,
-    UINT32                  Display,
-    UINT32                  BaseOffset)
-{
-    UINT32                  i = 0;
-    UINT32                  j;
-    UINT32                  Temp32;
-    UINT8                   BufChar;
-
-
-    if (!Buffer)
-    {
-        AcpiUtFilePrintf (File, "Null Buffer Pointer in DumpBuffer!\n");
-        return;
-    }
-
-    if ((Count < 4) || (Count & 0x01))
-    {
-        Display = DB_BYTE_DISPLAY;
-    }
-
-    /* Nasty little dump buffer routine! */
-
-    while (i < Count)
-    {
-        /* Print current offset */
-
-        AcpiUtFilePrintf (File, "%6.4X: ", (BaseOffset + i));
-
-        /* Print 16 hex chars */
-
-        for (j = 0; j < 16;)
-        {
-            if (i + j >= Count)
-            {
-                /* Dump fill spaces */
-
-                AcpiUtFilePrintf (File, "%*s", ((Display * 2) + 1), " ");
-                j += Display;
-                continue;
-            }
-
-            switch (Display)
-            {
-            case DB_BYTE_DISPLAY:
-            default:    /* Default is BYTE display */
-
-                AcpiUtFilePrintf (File, "%02X ", Buffer[(ACPI_SIZE) i + j]);
-                break;
-
-            case DB_WORD_DISPLAY:
-
-                ACPI_MOVE_16_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j]);
-                AcpiUtFilePrintf (File, "%04X ", Temp32);
-                break;
-
-            case DB_DWORD_DISPLAY:
-
-                ACPI_MOVE_32_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j]);
-                AcpiUtFilePrintf (File, "%08X ", Temp32);
-                break;
-
-            case DB_QWORD_DISPLAY:
-
-                ACPI_MOVE_32_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j]);
-                AcpiUtFilePrintf (File, "%08X", Temp32);
-
-                ACPI_MOVE_32_TO_32 (&Temp32, &Buffer[(ACPI_SIZE) i + j + 4]);
-                AcpiUtFilePrintf (File, "%08X ", Temp32);
-                break;
-            }
-
-            j += Display;
-        }
-
-        /*
-         * Print the ASCII equivalent characters but watch out for the bad
-         * unprintable ones (printable chars are 0x20 through 0x7E)
-         */
-        AcpiUtFilePrintf (File, " ");
-        for (j = 0; j < 16; j++)
-        {
-            if (i + j >= Count)
-            {
-                AcpiUtFilePrintf (File, "\n");
-                return;
-            }
-
-            BufChar = Buffer[(ACPI_SIZE) i + j];
-            if (isprint (BufChar))
-            {
-                AcpiUtFilePrintf (File, "%c", BufChar);
-            }
-            else
-            {
-                AcpiUtFilePrintf (File, ".");
-            }
-        }
-
-        /* Done with that line. */
-
-        AcpiUtFilePrintf (File, "\n");
-        i += 16;
-    }
-
-    return;
-}
-#endif
diff --git a/usr/src/uts/intel/io/acpica/utilities/utdebug.c b/usr/src/uts/intel/io/acpica/utilities/utdebug.c
deleted file mode 100644
index 6a298d175b..0000000000
--- a/usr/src/uts/intel/io/acpica/utilities/utdebug.c
+++ /dev/null
@@ -1,740 +0,0 @@
-/******************************************************************************
- *
- * Module Name: utdebug - Debug print/trace routines
- *
- *****************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#define EXPORT_ACPI_INTERFACES
-
-#include "acpi.h"
-#include "accommon.h"
-#include "acinterp.h"
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utdebug")
-
-
-#ifdef ACPI_DEBUG_OUTPUT
-
-static ACPI_THREAD_ID       AcpiGbl_PreviousThreadId = (ACPI_THREAD_ID) 0xFFFFFFFF;
-static const char           *AcpiGbl_FunctionEntryPrefix = "----Entry";
-static const char           *AcpiGbl_FunctionExitPrefix  = "----Exit-";
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtInitStackPtrTrace
- *
- * PARAMETERS:  None
- *
- * RETURN:      None
- *
- * DESCRIPTION: Save the current CPU stack pointer at subsystem startup
- *
- ******************************************************************************/
-
-void
-AcpiUtInitStackPtrTrace (
-    void)
-{
-    ACPI_SIZE               CurrentSp;
-
-
-    AcpiGbl_EntryStackPointer = &CurrentSp;
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtTrackStackPtr
- *
- * PARAMETERS:  None
- *
- * RETURN:      None
- *
- * DESCRIPTION: Save the current CPU stack pointer
- *
- ******************************************************************************/
-
-void
-AcpiUtTrackStackPtr (
-    void)
-{
-    ACPI_SIZE               CurrentSp;
-
-
-    if (&CurrentSp < AcpiGbl_LowestStackPointer)
-    {
-        AcpiGbl_LowestStackPointer = &CurrentSp;
-    }
-
-    if (AcpiGbl_NestingLevel > AcpiGbl_DeepestNesting)
-    {
-        AcpiGbl_DeepestNesting = AcpiGbl_NestingLevel;
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtTrimFunctionName
- *
- * PARAMETERS:  FunctionName        - Ascii string containing a procedure name
- *
- * RETURN:      Updated pointer to the function name
- *
- * DESCRIPTION: Remove the "Acpi" prefix from the function name, if present.
- *              This allows compiler macros such as __FUNCTION__ to be used
- *              with no change to the debug output.
- *
- ******************************************************************************/
-
-static const char *
-AcpiUtTrimFunctionName (
-    const char              *FunctionName)
-{
-
-    /* All Function names are longer than 4 chars, check is safe */
-
-    if (*(ACPI_CAST_PTR (UINT32, FunctionName)) == ACPI_PREFIX_MIXED)
-    {
-        /* This is the case where the original source has not been modified */
-
-        return (FunctionName + 4);
-    }
-
-    if (*(ACPI_CAST_PTR (UINT32, FunctionName)) == ACPI_PREFIX_LOWER)
-    {
-        /* This is the case where the source has been 'linuxized' */
-
-        return (FunctionName + 5);
-    }
-
-    return (FunctionName);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiDebugPrint
- *
- * PARAMETERS:  RequestedDebugLevel - Requested debug print level
- *              LineNumber          - Caller's line number (for error output)
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              Format              - Printf format field
- *              ...                 - Optional printf arguments
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print error message with prefix consisting of the module name,
- *              line number, and component ID.
- *
- ******************************************************************************/
-
-void  ACPI_INTERNAL_VAR_XFACE
-AcpiDebugPrint (
-    UINT32                  RequestedDebugLevel,
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    const char              *Format,
-    ...)
-{
-    ACPI_THREAD_ID          ThreadId;
-    va_list                 args;
-
-
-    /* Check if debug output enabled */
-
-    if (!ACPI_IS_DEBUG_ENABLED (RequestedDebugLevel, ComponentId))
-    {
-        return;
-    }
-
-    /*
-     * Thread tracking and context switch notification
-     */
-    ThreadId = AcpiOsGetThreadId ();
-    if (ThreadId != AcpiGbl_PreviousThreadId)
-    {
-        if (ACPI_LV_THREADS & AcpiDbgLevel)
-        {
-            AcpiOsPrintf (
-                "\n**** Context Switch from TID %u to TID %u ****\n\n",
-                (UINT32) AcpiGbl_PreviousThreadId, (UINT32) ThreadId);
-        }
-
-        AcpiGbl_PreviousThreadId = ThreadId;
-        AcpiGbl_NestingLevel = 0;
-    }
-
-    /*
-     * Display the module name, current line number, thread ID (if requested),
-     * current procedure nesting level, and the current procedure name
-     */
-    AcpiOsPrintf ("%9s-%04ld ", ModuleName, LineNumber);
-
-#ifdef ACPI_APPLICATION
-    /*
-     * For AcpiExec/iASL only, emit the thread ID and nesting level.
-     * Note: nesting level is really only useful during a single-thread
-     * execution. Otherwise, multiple threads will keep resetting the
-     * level.
-     */
-    if (ACPI_LV_THREADS & AcpiDbgLevel)
-    {
-        AcpiOsPrintf ("[%u] ", (UINT32) ThreadId);
-    }
-
-    AcpiOsPrintf ("[%02ld] ", AcpiGbl_NestingLevel);
-#endif
-
-    AcpiOsPrintf ("%-22.22s: ", AcpiUtTrimFunctionName (FunctionName));
-
-    va_start (args, Format);
-    AcpiOsVprintf (Format, args);
-    va_end (args);
-}
-
-ACPI_EXPORT_SYMBOL (AcpiDebugPrint)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiDebugPrintRaw
- *
- * PARAMETERS:  RequestedDebugLevel - Requested debug print level
- *              LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              Format              - Printf format field
- *              ...                 - Optional printf arguments
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print message with no headers. Has same interface as
- *              DebugPrint so that the same macros can be used.
- *
- ******************************************************************************/
-
-void  ACPI_INTERNAL_VAR_XFACE
-AcpiDebugPrintRaw (
-    UINT32                  RequestedDebugLevel,
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    const char              *Format,
-    ...)
-{
-    va_list                 args;
-
-
-    /* Check if debug output enabled */
-
-    if (!ACPI_IS_DEBUG_ENABLED (RequestedDebugLevel, ComponentId))
-    {
-        return;
-    }
-
-    va_start (args, Format);
-    AcpiOsVprintf (Format, args);
-    va_end (args);
-}
-
-ACPI_EXPORT_SYMBOL (AcpiDebugPrintRaw)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtTrace
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function entry trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel
- *
- ******************************************************************************/
-
-void
-AcpiUtTrace (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId)
-{
-
-    AcpiGbl_NestingLevel++;
-    AcpiUtTrackStackPtr ();
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s\n", AcpiGbl_FunctionEntryPrefix);
-    }
-}
-
-ACPI_EXPORT_SYMBOL (AcpiUtTrace)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtTracePtr
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              Pointer             - Pointer to display
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function entry trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel
- *
- ******************************************************************************/
-
-void
-AcpiUtTracePtr (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    const void              *Pointer)
-{
-
-    AcpiGbl_NestingLevel++;
-    AcpiUtTrackStackPtr ();
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s %p\n", AcpiGbl_FunctionEntryPrefix, Pointer);
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtTraceStr
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              String              - Additional string to display
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function entry trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel
- *
- ******************************************************************************/
-
-void
-AcpiUtTraceStr (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    const char              *String)
-{
-
-    AcpiGbl_NestingLevel++;
-    AcpiUtTrackStackPtr ();
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s %s\n", AcpiGbl_FunctionEntryPrefix, String);
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtTraceU32
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              Integer             - Integer to display
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function entry trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel
- *
- ******************************************************************************/
-
-void
-AcpiUtTraceU32 (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    UINT32                  Integer)
-{
-
-    AcpiGbl_NestingLevel++;
-    AcpiUtTrackStackPtr ();
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s %08X\n", AcpiGbl_FunctionEntryPrefix, Integer);
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtExit
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function exit trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel
- *
- ******************************************************************************/
-
-void
-AcpiUtExit (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId)
-{
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s\n", AcpiGbl_FunctionExitPrefix);
-    }
-
-    if (AcpiGbl_NestingLevel)
-    {
-        AcpiGbl_NestingLevel--;
-    }
-}
-
-ACPI_EXPORT_SYMBOL (AcpiUtExit)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtStatusExit
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              Status              - Exit status code
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function exit trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel. Prints exit status also.
- *
- ******************************************************************************/
-
-void
-AcpiUtStatusExit (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    ACPI_STATUS             Status)
-{
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        if (ACPI_SUCCESS (Status))
-        {
-            AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-                LineNumber, FunctionName, ModuleName, ComponentId,
-                "%s %s\n", AcpiGbl_FunctionExitPrefix,
-                AcpiFormatException (Status));
-        }
-        else
-        {
-            AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-                LineNumber, FunctionName, ModuleName, ComponentId,
-                "%s ****Exception****: %s\n", AcpiGbl_FunctionExitPrefix,
-                AcpiFormatException (Status));
-        }
-    }
-
-    if (AcpiGbl_NestingLevel)
-    {
-        AcpiGbl_NestingLevel--;
-    }
-}
-
-ACPI_EXPORT_SYMBOL (AcpiUtStatusExit)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtValueExit
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              Value               - Value to be printed with exit msg
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function exit trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel. Prints exit value also.
- *
- ******************************************************************************/
-
-void
-AcpiUtValueExit (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    UINT64                  Value)
-{
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s %8.8X%8.8X\n", AcpiGbl_FunctionExitPrefix,
-            ACPI_FORMAT_UINT64 (Value));
-    }
-
-    if (AcpiGbl_NestingLevel)
-    {
-        AcpiGbl_NestingLevel--;
-    }
-}
-
-ACPI_EXPORT_SYMBOL (AcpiUtValueExit)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtPtrExit
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              Ptr                 - Pointer to display
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function exit trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel. Prints exit value also.
- *
- ******************************************************************************/
-
-void
-AcpiUtPtrExit (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    UINT8                   *Ptr)
-{
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s %p\n", AcpiGbl_FunctionExitPrefix, Ptr);
-    }
-
-    if (AcpiGbl_NestingLevel)
-    {
-        AcpiGbl_NestingLevel--;
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtStrExit
- *
- * PARAMETERS:  LineNumber          - Caller's line number
- *              FunctionName        - Caller's procedure name
- *              ModuleName          - Caller's module name
- *              ComponentId         - Caller's component ID
- *              String              - String to display
- *
- * RETURN:      None
- *
- * DESCRIPTION: Function exit trace. Prints only if TRACE_FUNCTIONS bit is
- *              set in DebugLevel. Prints exit value also.
- *
- ******************************************************************************/
-
-void
-AcpiUtStrExit (
-    UINT32                  LineNumber,
-    const char              *FunctionName,
-    const char              *ModuleName,
-    UINT32                  ComponentId,
-    const char              *String)
-{
-
-    /* Check if enabled up-front for performance */
-
-    if (ACPI_IS_DEBUG_ENABLED (ACPI_LV_FUNCTIONS, ComponentId))
-    {
-        AcpiDebugPrint (ACPI_LV_FUNCTIONS,
-            LineNumber, FunctionName, ModuleName, ComponentId,
-            "%s %s\n", AcpiGbl_FunctionExitPrefix, String);
-    }
-
-    if (AcpiGbl_NestingLevel)
-    {
-        AcpiGbl_NestingLevel--;
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiTracePoint
- *
- * PARAMETERS:  Type                - Trace event type
- *              Begin               - TRUE if before execution
- *              Aml                 - Executed AML address
- *              Pathname            - Object path
- *              Pointer             - Pointer to the related object
- *
- * RETURN:      None
- *
- * DESCRIPTION: Interpreter execution trace.
- *
- ******************************************************************************/
-
-void
-AcpiTracePoint (
-    ACPI_TRACE_EVENT_TYPE   Type,
-    BOOLEAN                 Begin,
-    UINT8                   *Aml,
-    char                    *Pathname)
-{
-
-    ACPI_FUNCTION_ENTRY ();
-
-    AcpiExTracePoint (Type, Begin, Aml, Pathname);
-
-#ifdef ACPI_USE_SYSTEM_TRACER
-    AcpiOsTracePoint (Type, Begin, Aml, Pathname);
-#endif
-}
-
-ACPI_EXPORT_SYMBOL (AcpiTracePoint)
-
-#endif
-
-
-#ifdef ACPI_APPLICATION
-/*******************************************************************************
- *
- * FUNCTION:    AcpiLogError
- *
- * PARAMETERS:  Format              - Printf format field
- *              ...                 - Optional printf arguments
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print error message to the console, used by applications.
- *
- ******************************************************************************/
-
-void  ACPI_INTERNAL_VAR_XFACE
-AcpiLogError (
-    const char              *Format,
-    ...)
-{
-    va_list                 Args;
-
-    va_start (Args, Format);
-    (void) AcpiUtFileVprintf (ACPI_FILE_ERR, Format, Args);
-    va_end (Args);
-}
-
-ACPI_EXPORT_SYMBOL (AcpiLogError)
-#endif
diff --git a/usr/src/uts/intel/io/acpica/utilities/utexcep.c b/usr/src/uts/intel/io/acpica/utilities/utexcep.c
deleted file mode 100644
index 5be8efd5f2..0000000000
--- a/usr/src/uts/intel/io/acpica/utilities/utexcep.c
+++ /dev/null
@@ -1,179 +0,0 @@
-/*******************************************************************************
- *
- * Module Name: utexcep - Exception code support
- *
- ******************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#define EXPORT_ACPI_INTERFACES
-
-#define ACPI_DEFINE_EXCEPTION_TABLE
-#include "acpi.h"
-#include "accommon.h"
-
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utexcep")
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiFormatException
- *
- * PARAMETERS:  Status              - The ACPI_STATUS code to be formatted
- *
- * RETURN:      A string containing the exception text. A valid pointer is
- *              always returned.
- *
- * DESCRIPTION: This function translates an ACPI exception into an ASCII
- *              string. Returns "unknown status" string for invalid codes.
- *
- ******************************************************************************/
-
-const char *
-AcpiFormatException (
-    ACPI_STATUS             Status)
-{
-    const ACPI_EXCEPTION_INFO   *Exception;
-
-
-    ACPI_FUNCTION_ENTRY ();
-
-
-    Exception = AcpiUtValidateException (Status);
-    if (!Exception)
-    {
-        /* Exception code was not recognized */
-
-        ACPI_ERROR ((AE_INFO,
-            "Unknown exception code: 0x%8.8X", Status));
-
-        return ("UNKNOWN_STATUS_CODE");
-    }
-
-    return (Exception->Name);
-}
-
-ACPI_EXPORT_SYMBOL (AcpiFormatException)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtValidateException
- *
- * PARAMETERS:  Status              - The ACPI_STATUS code to be formatted
- *
- * RETURN:      A string containing the exception text. NULL if exception is
- *              not valid.
- *
- * DESCRIPTION: This function validates and translates an ACPI exception into
- *              an ASCII string.
- *
- ******************************************************************************/
-
-const ACPI_EXCEPTION_INFO *
-AcpiUtValidateException (
-    ACPI_STATUS             Status)
-{
-    UINT32                      SubStatus;
-    const ACPI_EXCEPTION_INFO   *Exception = NULL;
-
-
-    ACPI_FUNCTION_ENTRY ();
-
-
-    /*
-     * Status is composed of two parts, a "type" and an actual code
-     */
-    SubStatus = (Status & ~AE_CODE_MASK);
-
-    switch (Status & AE_CODE_MASK)
-    {
-    case AE_CODE_ENVIRONMENTAL:
-
-        if (SubStatus <= AE_CODE_ENV_MAX)
-        {
-            Exception = &AcpiGbl_ExceptionNames_Env [SubStatus];
-        }
-        break;
-
-    case AE_CODE_PROGRAMMER:
-
-        if (SubStatus <= AE_CODE_PGM_MAX)
-        {
-            Exception = &AcpiGbl_ExceptionNames_Pgm [SubStatus];
-        }
-        break;
-
-    case AE_CODE_ACPI_TABLES:
-
-        if (SubStatus <= AE_CODE_TBL_MAX)
-        {
-            Exception = &AcpiGbl_ExceptionNames_Tbl [SubStatus];
-        }
-        break;
-
-    case AE_CODE_AML:
-
-        if (SubStatus <= AE_CODE_AML_MAX)
-        {
-            Exception = &AcpiGbl_ExceptionNames_Aml [SubStatus];
-        }
-        break;
-
-    case AE_CODE_CONTROL:
-
-        if (SubStatus <= AE_CODE_CTRL_MAX)
-        {
-            Exception = &AcpiGbl_ExceptionNames_Ctrl [SubStatus];
-        }
-        break;
-
-    default:
-
-        break;
-    }
-
-    if (!Exception || !Exception->Name)
-    {
-        return (NULL);
-    }
-
-    return (Exception);
-}
diff --git a/usr/src/uts/intel/io/acpica/utilities/utglobal.c b/usr/src/uts/intel/io/acpica/utilities/utglobal.c
deleted file mode 100644
index 0d8dff88c9..0000000000
--- a/usr/src/uts/intel/io/acpica/utilities/utglobal.c
+++ /dev/null
@@ -1,243 +0,0 @@
-/******************************************************************************
- *
- * Module Name: utglobal - Global variables for the ACPI subsystem
- *
- *****************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#define EXPORT_ACPI_INTERFACES
-#define DEFINE_ACPI_GLOBALS
-
-#include "acpi.h"
-#include "accommon.h"
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utglobal")
-
-
-/*******************************************************************************
- *
- * Static global variable initialization.
- *
- ******************************************************************************/
-
-/* Various state name strings */
-
-const char                  *AcpiGbl_SleepStateNames[ACPI_S_STATE_COUNT] =
-{
-    "\\_S0_",
-    "\\_S1_",
-    "\\_S2_",
-    "\\_S3_",
-    "\\_S4_",
-    "\\_S5_"
-};
-
-const char                  *AcpiGbl_LowestDstateNames[ACPI_NUM_SxW_METHODS] =
-{
-    "_S0W",
-    "_S1W",
-    "_S2W",
-    "_S3W",
-    "_S4W"
-};
-
-const char                  *AcpiGbl_HighestDstateNames[ACPI_NUM_SxD_METHODS] =
-{
-    "_S1D",
-    "_S2D",
-    "_S3D",
-    "_S4D"
-};
-
-
-/* Hex-to-ascii */
-
-const char                  AcpiGbl_LowerHexDigits[] = "0123456789abcdef";
-const char                  AcpiGbl_UpperHexDigits[] = "0123456789ABCDEF";
-
-
-/*******************************************************************************
- *
- * Namespace globals
- *
- ******************************************************************************/
-
-/*
- * Predefined ACPI Names (Built-in to the Interpreter)
- *
- * NOTES:
- * 1) _SB_ is defined to be a device to allow \_SB_._INI to be run
- *    during the initialization sequence.
- * 2) _TZ_ is defined to be a thermal zone in order to allow ASL code to
- *    perform a Notify() operation on it. 09/2010: Changed to type Device.
- *    This still allows notifies, but does not confuse host code that
- *    searches for valid ThermalZone objects.
- */
-const ACPI_PREDEFINED_NAMES     AcpiGbl_PreDefinedNames[] =
-{
-    {"_GPE",    ACPI_TYPE_LOCAL_SCOPE,      NULL},
-    {"_PR_",    ACPI_TYPE_LOCAL_SCOPE,      NULL},
-    {"_SB_",    ACPI_TYPE_DEVICE,           NULL},
-    {"_SI_",    ACPI_TYPE_LOCAL_SCOPE,      NULL},
-    {"_TZ_",    ACPI_TYPE_DEVICE,           NULL},
-    /*
-     * March, 2015:
-     * The _REV object is in the process of being deprecated, because
-     * other ACPI implementations permanently return 2. Thus, it
-     * has little or no value. Return 2 for compatibility with
-     * other ACPI implementations.
-     */
-    {"_REV",    ACPI_TYPE_INTEGER,          ACPI_CAST_PTR (char, 2)},
-    {"_OS_",    ACPI_TYPE_STRING,           ACPI_OS_NAME},
-    {"_GL_",    ACPI_TYPE_MUTEX,            ACPI_CAST_PTR (char, 1)},
-
-#if !defined (ACPI_NO_METHOD_EXECUTION) || defined (ACPI_CONSTANT_EVAL_ONLY)
-    {"_OSI",    ACPI_TYPE_METHOD,           ACPI_CAST_PTR (char, 1)},
-#endif
-
-    /* Table terminator */
-
-    {NULL,      ACPI_TYPE_ANY,              NULL}
-};
-
-
-#if (!ACPI_REDUCED_HARDWARE)
-/******************************************************************************
- *
- * Event and Hardware globals
- *
- ******************************************************************************/
-
-ACPI_BIT_REGISTER_INFO      AcpiGbl_BitRegisterInfo[ACPI_NUM_BITREG] =
-{
-    /* Name                                     Parent Register             Register Bit Position                   Register Bit Mask       */
-
-    /* ACPI_BITREG_TIMER_STATUS         */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_TIMER_STATUS,          ACPI_BITMASK_TIMER_STATUS},
-    /* ACPI_BITREG_BUS_MASTER_STATUS    */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_BUS_MASTER_STATUS,     ACPI_BITMASK_BUS_MASTER_STATUS},
-    /* ACPI_BITREG_GLOBAL_LOCK_STATUS   */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_GLOBAL_LOCK_STATUS,    ACPI_BITMASK_GLOBAL_LOCK_STATUS},
-    /* ACPI_BITREG_POWER_BUTTON_STATUS  */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_POWER_BUTTON_STATUS,   ACPI_BITMASK_POWER_BUTTON_STATUS},
-    /* ACPI_BITREG_SLEEP_BUTTON_STATUS  */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_SLEEP_BUTTON_STATUS,   ACPI_BITMASK_SLEEP_BUTTON_STATUS},
-    /* ACPI_BITREG_RT_CLOCK_STATUS      */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_RT_CLOCK_STATUS,       ACPI_BITMASK_RT_CLOCK_STATUS},
-    /* ACPI_BITREG_WAKE_STATUS          */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_WAKE_STATUS,           ACPI_BITMASK_WAKE_STATUS},
-    /* ACPI_BITREG_PCIEXP_WAKE_STATUS   */   {ACPI_REGISTER_PM1_STATUS,   ACPI_BITPOSITION_PCIEXP_WAKE_STATUS,    ACPI_BITMASK_PCIEXP_WAKE_STATUS},
-
-    /* ACPI_BITREG_TIMER_ENABLE         */   {ACPI_REGISTER_PM1_ENABLE,   ACPI_BITPOSITION_TIMER_ENABLE,          ACPI_BITMASK_TIMER_ENABLE},
-    /* ACPI_BITREG_GLOBAL_LOCK_ENABLE   */   {ACPI_REGISTER_PM1_ENABLE,   ACPI_BITPOSITION_GLOBAL_LOCK_ENABLE,    ACPI_BITMASK_GLOBAL_LOCK_ENABLE},
-    /* ACPI_BITREG_POWER_BUTTON_ENABLE  */   {ACPI_REGISTER_PM1_ENABLE,   ACPI_BITPOSITION_POWER_BUTTON_ENABLE,   ACPI_BITMASK_POWER_BUTTON_ENABLE},
-    /* ACPI_BITREG_SLEEP_BUTTON_ENABLE  */   {ACPI_REGISTER_PM1_ENABLE,   ACPI_BITPOSITION_SLEEP_BUTTON_ENABLE,   ACPI_BITMASK_SLEEP_BUTTON_ENABLE},
-    /* ACPI_BITREG_RT_CLOCK_ENABLE      */   {ACPI_REGISTER_PM1_ENABLE,   ACPI_BITPOSITION_RT_CLOCK_ENABLE,       ACPI_BITMASK_RT_CLOCK_ENABLE},
-    /* ACPI_BITREG_PCIEXP_WAKE_DISABLE  */   {ACPI_REGISTER_PM1_ENABLE,   ACPI_BITPOSITION_PCIEXP_WAKE_DISABLE,   ACPI_BITMASK_PCIEXP_WAKE_DISABLE},
-
-    /* ACPI_BITREG_SCI_ENABLE           */   {ACPI_REGISTER_PM1_CONTROL,  ACPI_BITPOSITION_SCI_ENABLE,            ACPI_BITMASK_SCI_ENABLE},
-    /* ACPI_BITREG_BUS_MASTER_RLD       */   {ACPI_REGISTER_PM1_CONTROL,  ACPI_BITPOSITION_BUS_MASTER_RLD,        ACPI_BITMASK_BUS_MASTER_RLD},
-    /* ACPI_BITREG_GLOBAL_LOCK_RELEASE  */   {ACPI_REGISTER_PM1_CONTROL,  ACPI_BITPOSITION_GLOBAL_LOCK_RELEASE,   ACPI_BITMASK_GLOBAL_LOCK_RELEASE},
-    /* ACPI_BITREG_SLEEP_TYPE           */   {ACPI_REGISTER_PM1_CONTROL,  ACPI_BITPOSITION_SLEEP_TYPE,            ACPI_BITMASK_SLEEP_TYPE},
-    /* ACPI_BITREG_SLEEP_ENABLE         */   {ACPI_REGISTER_PM1_CONTROL,  ACPI_BITPOSITION_SLEEP_ENABLE,          ACPI_BITMASK_SLEEP_ENABLE},
-
-    /* ACPI_BITREG_ARB_DIS              */   {ACPI_REGISTER_PM2_CONTROL,  ACPI_BITPOSITION_ARB_DISABLE,           ACPI_BITMASK_ARB_DISABLE}
-};
-
-
-ACPI_FIXED_EVENT_INFO       AcpiGbl_FixedEventInfo[ACPI_NUM_FIXED_EVENTS] =
-{
-    /* ACPI_EVENT_PMTIMER       */  {ACPI_BITREG_TIMER_STATUS,          ACPI_BITREG_TIMER_ENABLE,        ACPI_BITMASK_TIMER_STATUS,          ACPI_BITMASK_TIMER_ENABLE},
-    /* ACPI_EVENT_GLOBAL        */  {ACPI_BITREG_GLOBAL_LOCK_STATUS,    ACPI_BITREG_GLOBAL_LOCK_ENABLE,  ACPI_BITMASK_GLOBAL_LOCK_STATUS,    ACPI_BITMASK_GLOBAL_LOCK_ENABLE},
-    /* ACPI_EVENT_POWER_BUTTON  */  {ACPI_BITREG_POWER_BUTTON_STATUS,   ACPI_BITREG_POWER_BUTTON_ENABLE, ACPI_BITMASK_POWER_BUTTON_STATUS,   ACPI_BITMASK_POWER_BUTTON_ENABLE},
-    /* ACPI_EVENT_SLEEP_BUTTON  */  {ACPI_BITREG_SLEEP_BUTTON_STATUS,   ACPI_BITREG_SLEEP_BUTTON_ENABLE, ACPI_BITMASK_SLEEP_BUTTON_STATUS,   ACPI_BITMASK_SLEEP_BUTTON_ENABLE},
-    /* ACPI_EVENT_RTC           */  {ACPI_BITREG_RT_CLOCK_STATUS,       ACPI_BITREG_RT_CLOCK_ENABLE,     ACPI_BITMASK_RT_CLOCK_STATUS,       ACPI_BITMASK_RT_CLOCK_ENABLE},
-};
-#endif /* !ACPI_REDUCED_HARDWARE */
-
-
-#if defined (ACPI_DISASSEMBLER) || defined (ACPI_ASL_COMPILER)
-
-/* ToPld macro: compile/disassemble strings */
-
-const char              *AcpiGbl_PldPanelList[] =
-{
-    "TOP",
-    "BOTTOM",
-    "LEFT",
-    "RIGHT",
-    "FRONT",
-    "BACK",
-    "UNKNOWN",
-    NULL
-};
-
-const char              *AcpiGbl_PldVerticalPositionList[] =
-{
-    "UPPER",
-    "CENTER",
-    "LOWER",
-    NULL
-};
-
-const char              *AcpiGbl_PldHorizontalPositionList[] =
-{
-    "LEFT",
-    "CENTER",
-    "RIGHT",
-    NULL
-};
-
-const char              *AcpiGbl_PldShapeList[] =
-{
-    "ROUND",
-    "OVAL",
-    "SQUARE",
-    "VERTICALRECTANGLE",
-    "HORIZONTALRECTANGLE",
-    "VERTICALTRAPEZOID",
-    "HORIZONTALTRAPEZOID",
-    "UNKNOWN",
-    "CHAMFERED",
-    NULL
-};
-#endif
-
-
-/* Public globals */
-
-ACPI_EXPORT_SYMBOL (AcpiGbl_FADT)
-ACPI_EXPORT_SYMBOL (AcpiDbgLevel)
-ACPI_EXPORT_SYMBOL (AcpiDbgLayer)
-ACPI_EXPORT_SYMBOL (AcpiGpeCount)
-ACPI_EXPORT_SYMBOL (AcpiCurrentGpeCount)
diff --git a/usr/src/uts/intel/io/acpica/utilities/utmath.c b/usr/src/uts/intel/io/acpica/utilities/utmath.c
deleted file mode 100644
index aa3d762c0d..0000000000
--- a/usr/src/uts/intel/io/acpica/utilities/utmath.c
+++ /dev/null
@@ -1,375 +0,0 @@
-/*******************************************************************************
- *
- * Module Name: utmath - Integer math support routines
- *
- ******************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#include "acpi.h"
-#include "accommon.h"
-
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utmath")
-
-/*
- * Optional support for 64-bit double-precision integer divide. This code
- * is configurable and is implemented in order to support 32-bit kernel
- * environments where a 64-bit double-precision math library is not available.
- *
- * Support for a more normal 64-bit divide/modulo (with check for a divide-
- * by-zero) appears after this optional section of code.
- */
-#ifndef ACPI_USE_NATIVE_DIVIDE
-
-/* Structures used only for 64-bit divide */
-
-typedef struct uint64_struct
-{
-    UINT32                          Lo;
-    UINT32                          Hi;
-
-} UINT64_STRUCT;
-
-typedef union uint64_overlay
-{
-    UINT64                          Full;
-    UINT64_STRUCT                   Part;
-
-} UINT64_OVERLAY;
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtShortDivide
- *
- * PARAMETERS:  Dividend            - 64-bit dividend
- *              Divisor             - 32-bit divisor
- *              OutQuotient         - Pointer to where the quotient is returned
- *              OutRemainder        - Pointer to where the remainder is returned
- *
- * RETURN:      Status (Checks for divide-by-zero)
- *
- * DESCRIPTION: Perform a short (maximum 64 bits divided by 32 bits)
- *              divide and modulo. The result is a 64-bit quotient and a
- *              32-bit remainder.
- *
- ******************************************************************************/
-
-ACPI_STATUS
-AcpiUtShortDivide (
-    UINT64                  Dividend,
-    UINT32                  Divisor,
-    UINT64                  *OutQuotient,
-    UINT32                  *OutRemainder)
-{
-    UINT64_OVERLAY          DividendOvl;
-    UINT64_OVERLAY          Quotient;
-    UINT32                  Remainder32;
-
-
-    ACPI_FUNCTION_TRACE (UtShortDivide);
-
-
-    /* Always check for a zero divisor */
-
-    if (Divisor == 0)
-    {
-        ACPI_ERROR ((AE_INFO, "Divide by zero"));
-        return_ACPI_STATUS (AE_AML_DIVIDE_BY_ZERO);
-    }
-
-    DividendOvl.Full = Dividend;
-
-    /*
-     * The quotient is 64 bits, the remainder is always 32 bits,
-     * and is generated by the second divide.
-     */
-    ACPI_DIV_64_BY_32 (0, DividendOvl.Part.Hi, Divisor,
-        Quotient.Part.Hi, Remainder32);
-
-    ACPI_DIV_64_BY_32 (Remainder32, DividendOvl.Part.Lo, Divisor,
-        Quotient.Part.Lo, Remainder32);
-
-    /* Return only what was requested */
-
-    if (OutQuotient)
-    {
-        *OutQuotient = Quotient.Full;
-    }
-    if (OutRemainder)
-    {
-        *OutRemainder = Remainder32;
-    }
-
-    return_ACPI_STATUS (AE_OK);
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtDivide
- *
- * PARAMETERS:  InDividend          - Dividend
- *              InDivisor           - Divisor
- *              OutQuotient         - Pointer to where the quotient is returned
- *              OutRemainder        - Pointer to where the remainder is returned
- *
- * RETURN:      Status (Checks for divide-by-zero)
- *
- * DESCRIPTION: Perform a divide and modulo.
- *
- ******************************************************************************/
-
-ACPI_STATUS
-AcpiUtDivide (
-    UINT64                  InDividend,
-    UINT64                  InDivisor,
-    UINT64                  *OutQuotient,
-    UINT64                  *OutRemainder)
-{
-    UINT64_OVERLAY          Dividend;
-    UINT64_OVERLAY          Divisor;
-    UINT64_OVERLAY          Quotient;
-    UINT64_OVERLAY          Remainder;
-    UINT64_OVERLAY          NormalizedDividend;
-    UINT64_OVERLAY          NormalizedDivisor;
-    UINT32                  Partial1;
-    UINT64_OVERLAY          Partial2;
-    UINT64_OVERLAY          Partial3;
-
-
-    ACPI_FUNCTION_TRACE (UtDivide);
-
-
-    /* Always check for a zero divisor */
-
-    if (InDivisor == 0)
-    {
-        ACPI_ERROR ((AE_INFO, "Divide by zero"));
-        return_ACPI_STATUS (AE_AML_DIVIDE_BY_ZERO);
-    }
-
-    Divisor.Full  = InDivisor;
-    Dividend.Full = InDividend;
-    if (Divisor.Part.Hi == 0)
-    {
-        /*
-         * 1) Simplest case is where the divisor is 32 bits, we can
-         * just do two divides
-         */
-        Remainder.Part.Hi = 0;
-
-        /*
-         * The quotient is 64 bits, the remainder is always 32 bits,
-         * and is generated by the second divide.
-         */
-        ACPI_DIV_64_BY_32 (0, Dividend.Part.Hi, Divisor.Part.Lo,
-            Quotient.Part.Hi, Partial1);
-
-        ACPI_DIV_64_BY_32 (Partial1, Dividend.Part.Lo, Divisor.Part.Lo,
-            Quotient.Part.Lo, Remainder.Part.Lo);
-    }
-
-    else
-    {
-        /*
-         * 2) The general case where the divisor is a full 64 bits
-         * is more difficult
-         */
-        Quotient.Part.Hi   = 0;
-        NormalizedDividend = Dividend;
-        NormalizedDivisor  = Divisor;
-
-        /* Normalize the operands (shift until the divisor is < 32 bits) */
-
-        do
-        {
-            ACPI_SHIFT_RIGHT_64 (
-                NormalizedDivisor.Part.Hi, NormalizedDivisor.Part.Lo);
-            ACPI_SHIFT_RIGHT_64 (
-                NormalizedDividend.Part.Hi, NormalizedDividend.Part.Lo);
-
-        } while (NormalizedDivisor.Part.Hi != 0);
-
-        /* Partial divide */
-
-        ACPI_DIV_64_BY_32 (
-            NormalizedDividend.Part.Hi, NormalizedDividend.Part.Lo,
-            NormalizedDivisor.Part.Lo, Quotient.Part.Lo, Partial1);
-
-        /*
-         * The quotient is always 32 bits, and simply requires
-         * adjustment. The 64-bit remainder must be generated.
-         */
-        Partial1 = Quotient.Part.Lo * Divisor.Part.Hi;
-        Partial2.Full = (UINT64) Quotient.Part.Lo * Divisor.Part.Lo;
-        Partial3.Full = (UINT64) Partial2.Part.Hi + Partial1;
-
-        Remainder.Part.Hi = Partial3.Part.Lo;
-        Remainder.Part.Lo = Partial2.Part.Lo;
-
-        if (Partial3.Part.Hi == 0)
-        {
-            if (Partial3.Part.Lo >= Dividend.Part.Hi)
-            {
-                if (Partial3.Part.Lo == Dividend.Part.Hi)
-                {
-                    if (Partial2.Part.Lo > Dividend.Part.Lo)
-                    {
-                        Quotient.Part.Lo--;
-                        Remainder.Full -= Divisor.Full;
-                    }
-                }
-                else
-                {
-                    Quotient.Part.Lo--;
-                    Remainder.Full -= Divisor.Full;
-                }
-            }
-
-            Remainder.Full = Remainder.Full - Dividend.Full;
-            Remainder.Part.Hi = (UINT32) -((INT32) Remainder.Part.Hi);
-            Remainder.Part.Lo = (UINT32) -((INT32) Remainder.Part.Lo);
-
-            if (Remainder.Part.Lo)
-            {
-                Remainder.Part.Hi--;
-            }
-        }
-    }
-
-    /* Return only what was requested */
-
-    if (OutQuotient)
-    {
-        *OutQuotient = Quotient.Full;
-    }
-    if (OutRemainder)
-    {
-        *OutRemainder = Remainder.Full;
-    }
-
-    return_ACPI_STATUS (AE_OK);
-}
-
-#else
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtShortDivide, AcpiUtDivide
- *
- * PARAMETERS:  See function headers above
- *
- * DESCRIPTION: Native versions of the UtDivide functions. Use these if either
- *              1) The target is a 64-bit platform and therefore 64-bit
- *                 integer math is supported directly by the machine.
- *              2) The target is a 32-bit or 16-bit platform, and the
- *                 double-precision integer math library is available to
- *                 perform the divide.
- *
- ******************************************************************************/
-
-ACPI_STATUS
-AcpiUtShortDivide (
-    UINT64                  InDividend,
-    UINT32                  Divisor,
-    UINT64                  *OutQuotient,
-    UINT32                  *OutRemainder)
-{
-
-    ACPI_FUNCTION_TRACE (UtShortDivide);
-
-
-    /* Always check for a zero divisor */
-
-    if (Divisor == 0)
-    {
-        ACPI_ERROR ((AE_INFO, "Divide by zero"));
-        return_ACPI_STATUS (AE_AML_DIVIDE_BY_ZERO);
-    }
-
-    /* Return only what was requested */
-
-    if (OutQuotient)
-    {
-        *OutQuotient = InDividend / Divisor;
-    }
-    if (OutRemainder)
-    {
-        *OutRemainder = (UINT32) (InDividend % Divisor);
-    }
-
-    return_ACPI_STATUS (AE_OK);
-}
-
-ACPI_STATUS
-AcpiUtDivide (
-    UINT64                  InDividend,
-    UINT64                  InDivisor,
-    UINT64                  *OutQuotient,
-    UINT64                  *OutRemainder)
-{
-    ACPI_FUNCTION_TRACE (UtDivide);
-
-
-    /* Always check for a zero divisor */
-
-    if (InDivisor == 0)
-    {
-        ACPI_ERROR ((AE_INFO, "Divide by zero"));
-        return_ACPI_STATUS (AE_AML_DIVIDE_BY_ZERO);
-    }
-
-
-    /* Return only what was requested */
-
-    if (OutQuotient)
-    {
-        *OutQuotient = InDividend / InDivisor;
-    }
-    if (OutRemainder)
-    {
-        *OutRemainder = InDividend % InDivisor;
-    }
-
-    return_ACPI_STATUS (AE_OK);
-}
-
-#endif
diff --git a/usr/src/uts/intel/io/acpica/utilities/utnonansi.c b/usr/src/uts/intel/io/acpica/utilities/utnonansi.c
deleted file mode 100644
index 70fb33e64c..0000000000
--- a/usr/src/uts/intel/io/acpica/utilities/utnonansi.c
+++ /dev/null
@@ -1,667 +0,0 @@
-/*******************************************************************************
- *
- * Module Name: utnonansi - Non-ansi C library functions
- *
- ******************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#include "acpi.h"
-#include "accommon.h"
-
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utnonansi")
-
-
-/*
- * Non-ANSI C library functions - strlwr, strupr, stricmp, and a 64-bit
- * version of strtoul.
- */
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtStrlwr (strlwr)
- *
- * PARAMETERS:  SrcString       - The source string to convert
- *
- * RETURN:      None
- *
- * DESCRIPTION: Convert a string to lowercase
- *
- ******************************************************************************/
-
-void
-AcpiUtStrlwr (
-    char                    *SrcString)
-{
-    char                    *String;
-
-
-    ACPI_FUNCTION_ENTRY ();
-
-
-    if (!SrcString)
-    {
-        return;
-    }
-
-    /* Walk entire string, lowercasing the letters */
-
-    for (String = SrcString; *String; String++)
-    {
-        *String = (char) tolower ((int) *String);
-    }
-}
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtStrupr (strupr)
- *
- * PARAMETERS:  SrcString       - The source string to convert
- *
- * RETURN:      None
- *
- * DESCRIPTION: Convert a string to uppercase
- *
- ******************************************************************************/
-
-void
-AcpiUtStrupr (
-    char                    *SrcString)
-{
-    char                    *String;
-
-
-    ACPI_FUNCTION_ENTRY ();
-
-
-    if (!SrcString)
-    {
-        return;
-    }
-
-    /* Walk entire string, uppercasing the letters */
-
-    for (String = SrcString; *String; String++)
-    {
-        *String = (char) toupper ((int) *String);
-    }
-}
-
-
-/******************************************************************************
- *
- * FUNCTION:    AcpiUtStricmp (stricmp)
- *
- * PARAMETERS:  String1             - first string to compare
- *              String2             - second string to compare
- *
- * RETURN:      int that signifies string relationship. Zero means strings
- *              are equal.
- *
- * DESCRIPTION: Case-insensitive string compare. Implementation of the
- *              non-ANSI stricmp function.
- *
- ******************************************************************************/
-
-int
-AcpiUtStricmp (
-    char                    *String1,
-    char                    *String2)
-{
-    int                     c1;
-    int                     c2;
-
-
-    do
-    {
-        c1 = tolower ((int) *String1);
-        c2 = tolower ((int) *String2);
-
-        String1++;
-        String2++;
-    }
-    while ((c1 == c2) && (c1));
-
-    return (c1 - c2);
-}
-
-
-#if defined (ACPI_DEBUGGER) || defined (ACPI_APPLICATION)
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtSafeStrcpy, AcpiUtSafeStrcat, AcpiUtSafeStrncat
- *
- * PARAMETERS:  Adds a "DestSize" parameter to each of the standard string
- *              functions. This is the size of the Destination buffer.
- *
- * RETURN:      TRUE if the operation would overflow the destination buffer.
- *
- * DESCRIPTION: Safe versions of standard Clib string functions. Ensure that
- *              the result of the operation will not overflow the output string
- *              buffer.
- *
- * NOTE:        These functions are typically only helpful for processing
- *              user input and command lines. For most ACPICA code, the
- *              required buffer length is precisely calculated before buffer
- *              allocation, so the use of these functions is unnecessary.
- *
- ******************************************************************************/
-
-BOOLEAN
-AcpiUtSafeStrcpy (
-    char                    *Dest,
-    ACPI_SIZE               DestSize,
-    char                    *Source)
-{
-
-    if (strlen (Source) >= DestSize)
-    {
-        return (TRUE);
-    }
-
-    strcpy (Dest, Source);
-    return (FALSE);
-}
-
-BOOLEAN
-AcpiUtSafeStrcat (
-    char                    *Dest,
-    ACPI_SIZE               DestSize,
-    char                    *Source)
-{
-
-    if ((strlen (Dest) + strlen (Source)) >= DestSize)
-    {
-        return (TRUE);
-    }
-
-    strcat (Dest, Source);
-    return (FALSE);
-}
-
-BOOLEAN
-AcpiUtSafeStrncat (
-    char                    *Dest,
-    ACPI_SIZE               DestSize,
-    char                    *Source,
-    ACPI_SIZE               MaxTransferLength)
-{
-    ACPI_SIZE               ActualTransferLength;
-
-
-    ActualTransferLength = ACPI_MIN (MaxTransferLength, strlen (Source));
-
-    if ((strlen (Dest) + ActualTransferLength) >= DestSize)
-    {
-        return (TRUE);
-    }
-
-    strncat (Dest, Source, MaxTransferLength);
-    return (FALSE);
-}
-#endif
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiUtStrtoul64
- *
- * PARAMETERS:  String                  - Null terminated string
- *              Base                    - Radix of the string: 16 or 10 or
- *                                        ACPI_ANY_BASE
- *              MaxIntegerByteWidth     - Maximum allowable integer,in bytes:
- *                                        4 or 8 (32 or 64 bits)
- *              RetInteger              - Where the converted integer is
- *                                        returned
- *
- * RETURN:      Status and Converted value
- *
- * DESCRIPTION: Convert a string into an unsigned value. Performs either a
- *              32-bit or 64-bit conversion, depending on the input integer
- *              size (often the current mode of the interpreter).
- *
- * NOTES:       Negative numbers are not supported, as they are not supported
- *              by ACPI.
- *
- *              AcpiGbl_IntegerByteWidth should be set to the proper width.
- *              For the core ACPICA code, this width depends on the DSDT
- *              version. For iASL, the default byte width is always 8 for the
- *              parser, but error checking is performed later to flag cases
- *              where a 64-bit constant is defined in a 32-bit DSDT/SSDT.
- *
- *              Does not support Octal strings, not needed at this time.
- *
- ******************************************************************************/
-
-ACPI_STATUS
-AcpiUtStrtoul64 (
-    char                    *String,
-    UINT32                  Base,
-    UINT32                  MaxIntegerByteWidth,
-    UINT64                  *RetInteger)
-{
-    UINT32                  ThisDigit = 0;
-    UINT64                  ReturnValue = 0;
-    UINT64                  Quotient;
-    UINT64                  Dividend;
-    UINT8                   ValidDigits = 0;
-    UINT8                   SignOf0x = 0;
-    UINT8                   Term = 0;
-
-
-    ACPI_FUNCTION_TRACE_STR (UtStrtoul64, String);
-
-
-    switch (Base)
-    {
-    case ACPI_ANY_BASE:
-    case 10:
-    case 16:
-
-        break;
-
-    default:
-
-        /* Invalid Base */
-
-        return_ACPI_STATUS (AE_BAD_PARAMETER);
-    }
-
-    if (!String)
-    {
-        goto ErrorExit;
-    }
-
-    /* Skip over any white space in the buffer */
-
-    while ((*String) && (isspace ((int) *String) || *String == '\t'))
-    {
-        String++;
-    }
-
-    if (Base == ACPI_ANY_BASE)
-    {
-        /*
-         * Base equal to ACPI_ANY_BASE means 'Either decimal or hex'.
-         * We need to determine if it is decimal or hexadecimal.
-         */
-        if ((*String == '0') && (tolower ((int) *(String + 1)) == 'x'))
-        {
-            SignOf0x = 1;
-            Base = 16;
-
-            /* Skip over the leading '0x' */
-            String += 2;
-        }
-        else
-        {
-            Base = 10;
-        }
-    }
-
-    /* Any string left? Check that '0x' is not followed by white space. */
-
-    if (!(*String) || isspace ((int) *String) || *String == '\t')
-    {
-        if (Base == ACPI_ANY_BASE)
-        {
-            goto ErrorExit;
-        }
-        else
-        {
-            goto AllDone;
-        }
-    }
-
-    /*
-     * Perform a 32-bit or 64-bit conversion, depending upon the input
-     * byte width
-     */
-    Dividend = (MaxIntegerByteWidth <= ACPI_MAX32_BYTE_WIDTH) ?
-        ACPI_UINT32_MAX : ACPI_UINT64_MAX;
-
-    /* Main loop: convert the string to a 32- or 64-bit integer */
-
-    while (*String)
-    {
-        if (isdigit ((int) *String))
-        {
-            /* Convert ASCII 0-9 to Decimal value */
-
-            ThisDigit = ((UINT8) *String) - '0';
-        }
-        else if (Base == 10)
-        {
-            /* Digit is out of range; possible in ToInteger case only */
-
-            Term = 1;
-        }
-        else
-        {
-            ThisDigit = (UINT8) toupper ((int) *String);
-            if (isxdigit ((int) ThisDigit))
-            {
-                /* Convert ASCII Hex char to value */
-
-                ThisDigit = ThisDigit - 'A' + 10;
-            }
-            else
-            {
-                Term = 1;
-            }
-        }
-
-        if (Term)
-        {
-            if (Base == ACPI_ANY_BASE)
-            {
-                goto ErrorExit;
-            }
-            else
-            {
-                break;
-            }
-        }
-        else if ((ValidDigits == 0) && (ThisDigit == 0) && !SignOf0x)
-        {
-            /* Skip zeros */
-            String++;
-            continue;
-        }
-
-        ValidDigits++;
-
-        if (SignOf0x && ((ValidDigits > 16) ||
-            ((ValidDigits > 8) && (MaxIntegerByteWidth <= ACPI_MAX32_BYTE_WIDTH))))
-        {
-            /*
-             * This is ToInteger operation case.
-             * No restrictions for string-to-integer conversion,
-             * see ACPI spec.
-             */
-            goto ErrorExit;
-        }
-
-        /* Divide the digit into the correct position */
-
-        (void) AcpiUtShortDivide (
-            (Dividend - (UINT64) ThisDigit), Base, &Quotient, NULL);
-
-        if (ReturnValue > Quotient)
-        {
-            if (Base == ACPI_ANY_BASE)
-            {
-                goto ErrorExit;
-            }
-            else
-            {
-                break;
-            }
-        }
-
-        ReturnValue *= Base;
-        ReturnValue += ThisDigit;
-        String++;
-    }
-
-    /* All done, normal exit */
-
-AllDone:
-
-    ACPI_DEBUG_PRINT ((ACPI_DB_EXEC, "Converted value: %8.8X%8.8X\n",
-        ACPI_FORMAT_UINT64 (ReturnValue)));
-
-    *RetInteger = ReturnValue;
-    return_ACPI_STATUS (AE_OK);
-
-
-ErrorExit:
-
-    /* Base was set/validated above (10 or 16) */
-
-    if (Base == 10)
-    {
-        return_ACPI_STATUS (AE_BAD_DECIMAL_CONSTANT);
-    }
-    else
-    {
-        return_ACPI_STATUS (AE_BAD_HEX_CONSTANT);
-    }
-}
-
-
-#ifdef _OBSOLETE_FUNCTIONS
-/* Removed: 01/2016 */
-
-/*******************************************************************************
- *
- * FUNCTION:    strtoul64
- *
- * PARAMETERS:  String              - Null terminated string
- *              Terminater          - Where a pointer to the terminating byte
- *                                    is returned
- *              Base                - Radix of the string
- *
- * RETURN:      Converted value
- *
- * DESCRIPTION: Convert a string into an unsigned value.
- *
- ******************************************************************************/
-
-ACPI_STATUS
-strtoul64 (
-    char                    *String,
-    UINT32                  Base,
-    UINT64                  *RetInteger)
-{
-    UINT32                  Index;
-    UINT32                  Sign;
-    UINT64                  ReturnValue = 0;
-    ACPI_STATUS             Status = AE_OK;
-
-
-    *RetInteger = 0;
-
-    switch (Base)
-    {
-    case 0:
-    case 8:
-    case 10:
-    case 16:
-
-        break;
-
-    default:
-        /*
-         * The specified Base parameter is not in the domain of
-         * this function:
-         */
-        return (AE_BAD_PARAMETER);
-    }
-
-    /* Skip over any white space in the buffer: */
-
-    while (isspace ((int) *String) || *String == '\t')
-    {
-        ++String;
-    }
-
-    /*
-     * The buffer may contain an optional plus or minus sign.
-     * If it does, then skip over it but remember what is was:
-     */
-    if (*String == '-')
-    {
-        Sign = ACPI_SIGN_NEGATIVE;
-        ++String;
-    }
-    else if (*String == '+')
-    {
-        ++String;
-        Sign = ACPI_SIGN_POSITIVE;
-    }
-    else
-    {
-        Sign = ACPI_SIGN_POSITIVE;
-    }
-
-    /*
-     * If the input parameter Base is zero, then we need to
-     * determine if it is octal, decimal, or hexadecimal:
-     */
-    if (Base == 0)
-    {
-        if (*String == '0')
-        {
-            if (tolower ((int) *(++String)) == 'x')
-            {
-                Base = 16;
-                ++String;
-            }
-            else
-            {
-                Base = 8;
-            }
-        }
-        else
-        {
-            Base = 10;
-        }
-    }
-
-    /*
-     * For octal and hexadecimal bases, skip over the leading
-     * 0 or 0x, if they are present.
-     */
-    if (Base == 8 && *String == '0')
-    {
-        String++;
-    }
-
-    if (Base == 16 &&
-        *String == '0' &&
-        tolower ((int) *(++String)) == 'x')
-    {
-        String++;
-    }
-
-    /* Main loop: convert the string to an unsigned long */
-
-    while (*String)
-    {
-        if (isdigit ((int) *String))
-        {
-            Index = ((UINT8) *String) - '0';
-        }
-        else
-        {
-            Index = (UINT8) toupper ((int) *String);
-            if (isupper ((int) Index))
-            {
-                Index = Index - 'A' + 10;
-            }
-            else
-            {
-                goto ErrorExit;
-            }
-        }
-
-        if (Index >= Base)
-        {
-            goto ErrorExit;
-        }
-
-        /* Check to see if value is out of range: */
-
-        if (ReturnValue > ((ACPI_UINT64_MAX - (UINT64) Index) /
-            (UINT64) Base))
-        {
-            goto ErrorExit;
-        }
-        else
-        {
-            ReturnValue *= Base;
-            ReturnValue += Index;
-        }
-
-        ++String;
-    }
-
-
-    /* If a minus sign was present, then "the conversion is negated": */
-
-    if (Sign == ACPI_SIGN_NEGATIVE)
-    {
-        ReturnValue = (ACPI_UINT32_MAX - ReturnValue) + 1;
-    }
-
-    *RetInteger = ReturnValue;
-    return (Status);
-
-
-ErrorExit:
-    switch (Base)
-    {
-    case 8:
-
-        Status = AE_BAD_OCTAL_CONSTANT;
-        break;
-
-    case 10:
-
-        Status = AE_BAD_DECIMAL_CONSTANT;
-        break;
-
-    case 16:
-
-        Status = AE_BAD_HEX_CONSTANT;
-        break;
-
-    default:
-
-        /* Base validated above */
-
-        break;
-    }
-
-    return (Status);
-}
-#endif
diff --git a/usr/src/uts/intel/io/acpica/utilities/utxferror.c b/usr/src/uts/intel/io/acpica/utilities/utxferror.c
deleted file mode 100644
index e79ffc94f3..0000000000
--- a/usr/src/uts/intel/io/acpica/utilities/utxferror.c
+++ /dev/null
@@ -1,305 +0,0 @@
-/*******************************************************************************
- *
- * Module Name: utxferror - Various error/warning output functions
- *
- ******************************************************************************/
-
-/*
- * Copyright (C) 2000 - 2016, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
-
-#define EXPORT_ACPI_INTERFACES
-
-#include "acpi.h"
-#include "accommon.h"
-
-
-#define _COMPONENT          ACPI_UTILITIES
-        ACPI_MODULE_NAME    ("utxferror")
-
-/*
- * This module is used for the in-kernel ACPICA as well as the ACPICA
- * tools/applications.
- */
-
-#ifndef ACPI_NO_ERROR_MESSAGES /* Entire module */
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiError
- *
- * PARAMETERS:  ModuleName          - Caller's module name (for error output)
- *              LineNumber          - Caller's line number (for error output)
- *              Format              - Printf format string + additional args
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print "ACPI Error" message with module/line/version info
- *
- ******************************************************************************/
-
-void ACPI_INTERNAL_VAR_XFACE
-AcpiError (
-    const char              *ModuleName,
-    UINT32                  LineNumber,
-    const char              *Format,
-    ...)
-{
-    va_list                 ArgList;
-
-
-    ACPI_MSG_REDIRECT_BEGIN;
-    AcpiOsPrintf (ACPI_MSG_ERROR);
-
-    va_start (ArgList, Format);
-    AcpiOsVprintf (Format, ArgList);
-    ACPI_MSG_SUFFIX;
-    va_end (ArgList);
-
-    ACPI_MSG_REDIRECT_END;
-}
-
-ACPI_EXPORT_SYMBOL (AcpiError)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiException
- *
- * PARAMETERS:  ModuleName          - Caller's module name (for error output)
- *              LineNumber          - Caller's line number (for error output)
- *              Status              - Status to be formatted
- *              Format              - Printf format string + additional args
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print "ACPI Exception" message with module/line/version info
- *              and decoded ACPI_STATUS.
- *
- ******************************************************************************/
-
-void ACPI_INTERNAL_VAR_XFACE
-AcpiException (
-    const char              *ModuleName,
-    UINT32                  LineNumber,
-    ACPI_STATUS             Status,
-    const char              *Format,
-    ...)
-{
-    va_list                 ArgList;
-
-
-    ACPI_MSG_REDIRECT_BEGIN;
-
-    /* For AE_OK, just print the message */
-
-    if (ACPI_SUCCESS (Status))
-    {
-        AcpiOsPrintf (ACPI_MSG_EXCEPTION);
-
-    }
-    else
-    {
-        AcpiOsPrintf (ACPI_MSG_EXCEPTION "%s, ",
-            AcpiFormatException (Status));
-    }
-
-    va_start (ArgList, Format);
-    AcpiOsVprintf (Format, ArgList);
-    ACPI_MSG_SUFFIX;
-    va_end (ArgList);
-
-    ACPI_MSG_REDIRECT_END;
-}
-
-ACPI_EXPORT_SYMBOL (AcpiException)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiWarning
- *
- * PARAMETERS:  ModuleName          - Caller's module name (for error output)
- *              LineNumber          - Caller's line number (for error output)
- *              Format              - Printf format string + additional args
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print "ACPI Warning" message with module/line/version info
- *
- ******************************************************************************/
-
-void ACPI_INTERNAL_VAR_XFACE
-AcpiWarning (
-    const char              *ModuleName,
-    UINT32                  LineNumber,
-    const char              *Format,
-    ...)
-{
-    va_list                 ArgList;
-
-
-    ACPI_MSG_REDIRECT_BEGIN;
-    AcpiOsPrintf (ACPI_MSG_WARNING);
-
-    va_start (ArgList, Format);
-    AcpiOsVprintf (Format, ArgList);
-    ACPI_MSG_SUFFIX;
-    va_end (ArgList);
-
-    ACPI_MSG_REDIRECT_END;
-}
-
-ACPI_EXPORT_SYMBOL (AcpiWarning)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiInfo
- *
- * PARAMETERS:  ModuleName          - Caller's module name (for error output)
- *              LineNumber          - Caller's line number (for error output)
- *              Format              - Printf format string + additional args
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print generic "ACPI:" information message. There is no
- *              module/line/version info in order to keep the message simple.
- *
- * TBD: ModuleName and LineNumber args are not needed, should be removed.
- *
- ******************************************************************************/
-
-void ACPI_INTERNAL_VAR_XFACE
-AcpiInfo (
-    const char              *Format,
-    ...)
-{
-    va_list                 ArgList;
-
-
-    ACPI_MSG_REDIRECT_BEGIN;
-    AcpiOsPrintf (ACPI_MSG_INFO);
-
-    va_start (ArgList, Format);
-    AcpiOsVprintf (Format, ArgList);
-    AcpiOsPrintf ("\n");
-    va_end (ArgList);
-
-    ACPI_MSG_REDIRECT_END;
-}
-
-ACPI_EXPORT_SYMBOL (AcpiInfo)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiBiosError
- *
- * PARAMETERS:  ModuleName          - Caller's module name (for error output)
- *              LineNumber          - Caller's line number (for error output)
- *              Format              - Printf format string + additional args
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print "ACPI Firmware Error" message with module/line/version
- *              info
- *
- ******************************************************************************/
-
-void ACPI_INTERNAL_VAR_XFACE
-AcpiBiosError (
-    const char              *ModuleName,
-    UINT32                  LineNumber,
-    const char              *Format,
-    ...)
-{
-    va_list                 ArgList;
-
-
-    ACPI_MSG_REDIRECT_BEGIN;
-    AcpiOsPrintf (ACPI_MSG_BIOS_ERROR);
-
-    va_start (ArgList, Format);
-    AcpiOsVprintf (Format, ArgList);
-    ACPI_MSG_SUFFIX;
-    va_end (ArgList);
-
-    ACPI_MSG_REDIRECT_END;
-}
-
-ACPI_EXPORT_SYMBOL (AcpiBiosError)
-
-
-/*******************************************************************************
- *
- * FUNCTION:    AcpiBiosWarning
- *
- * PARAMETERS:  ModuleName          - Caller's module name (for error output)
- *              LineNumber          - Caller's line number (for error output)
- *              Format              - Printf format string + additional args
- *
- * RETURN:      None
- *
- * DESCRIPTION: Print "ACPI Firmware Warning" message with module/line/version
- *              info
- *
- ******************************************************************************/
-
-void ACPI_INTERNAL_VAR_XFACE
-AcpiBiosWarning (
-    const char              *ModuleName,
-    UINT32                  LineNumber,
-    const char              *Format,
-    ...)
-{
-    va_list                 ArgList;
-
-
-    ACPI_MSG_REDIRECT_BEGIN;
-    AcpiOsPrintf (ACPI_MSG_BIOS_WARNING);
-
-    va_start (ArgList, Format);
-    AcpiOsVprintf (Format, ArgList);
-    ACPI_MSG_SUFFIX;
-    va_end (ArgList);
-
-    ACPI_MSG_REDIRECT_END;
-}
-
-ACPI_EXPORT_SYMBOL (AcpiBiosWarning)
-
-#endif /* ACPI_NO_ERROR_MESSAGES */
diff --git a/usr/src/uts/intel/io/devfm_machdep.c b/usr/src/uts/intel/io/devfm_machdep.c
index 9209e7a012..1f12e323a2 100644
--- a/usr/src/uts/intel/io/devfm_machdep.c
+++ b/usr/src/uts/intel/io/devfm_machdep.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #include <sys/stat.h>
@@ -150,6 +151,7 @@ populate_cpu(nvlist_t **nvlp, cmi_hdl_t hdl)
 {
 	uint_t	fm_chipid;
 	uint16_t smbios_id;
+	const char *idstr;
 
 	(void) nvlist_alloc(nvlp, NV_UNIQUE_NAME, KM_SLEEP);
 
@@ -203,6 +205,16 @@ populate_cpu(nvlist_t **nvlp, cmi_hdl_t hdl)
 	    FM_PHYSCPU_INFO_CPU_ID, DATA_TYPE_INT32,
 	    (int32_t)cmi_hdl_logical_id(hdl),
 	    NULL);
+
+	/*
+	 * Do this separately so that way if there is no ident string we do not
+	 * trigger an error.
+	 */
+	if ((idstr = cmi_hdl_chipident(hdl)) != NULL) {
+		fm_payload_set(*nvlp,
+		    FM_PHYSCPU_INFO_CHIP_IDENTSTR, DATA_TYPE_STRING, idstr,
+		    NULL);
+	}
 }
 
 /*ARGSUSED*/
diff --git a/usr/src/uts/intel/io/dktp/dcdev/dadk.c b/usr/src/uts/intel/io/dktp/dcdev/dadk.c
index 35f97482b8..f74a0d4137 100644
--- a/usr/src/uts/intel/io/dktp/dcdev/dadk.c
+++ b/usr/src/uts/intel/io/dktp/dcdev/dadk.c
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, Joyent, Inc. All rights reserved.
  */
 
 /*
@@ -170,6 +171,8 @@ static	int	dadk_debug = DGEOM;
 
 #endif	/* DADK_DEBUG */
 
+#define ONE_MIN	((longlong_t)60 * NANOSEC)
+
 static int dadk_check_media_time = 3000000;	/* 3 Second State Check */
 static int dadk_dk_maxphys = 0x80000;
 
@@ -1376,6 +1379,47 @@ static struct dadkio_derr dadk_errtab[] = {
 	{COMMAND_DONE_ERROR, GDA_FATAL},	/* 23 DERR_RESV		*/
 };
 
+/*
+ * A bad disk can result in a large number of errors spewed to the log.
+ * This can in turn lead to /var/adm/messages filling up the file system on
+ * a machine with a small root or /var file system.
+ *
+ * Instead of logging every error, if we're seeing repeated errors on a disk
+ * only log them periodically.
+ */
+static void
+dadk_logerr(struct dadk *dadkp, struct cmpkt *pktp, char *label,
+    int severity, daddr_t blkno, daddr_t err_blkno,
+    char **cmdvec, char **senvec)
+{
+	hrtime_t now;
+
+	now = gethrtime();
+	if ((now - dadkp->dad_last_log) < ONE_MIN) {
+		atomic_add_32(&dadkp->dad_err_cnt, 1);
+		return;
+	}
+
+	if (dadkp->dad_err_cnt > 0) {
+		dev_info_t *dev = dadkp->dad_sd->sd_dev;
+		char name[256], buf[256];
+
+		if (dev)
+			(void) snprintf(name, sizeof (name), "%s (%s%d)",
+                            ddi_pathname(dev, buf), label,
+                            ddi_get_instance(dev));
+		else
+			(void) strlcpy(name, label, sizeof (name));
+		cmn_err(CE_WARN, "%s: %d additional unlogged errors\n",
+		    name, dadkp->dad_err_cnt);
+	}
+
+	gda_errmsg(dadkp->dad_sd, pktp, label, severity, blkno, err_blkno,
+	    cmdvec, senvec);
+	dadkp->dad_err_cnt = 0;
+	dadkp->dad_last_log = now;
+}
+
 static int
 dadk_chkerr(struct cmpkt *pktp)
 {
@@ -1462,7 +1506,7 @@ dadk_chkerr(struct cmpkt *pktp)
 		return (COMMAND_DONE);
 	}
 	if (pktp->cp_passthru == NULL) {
-		gda_errmsg(dadkp->dad_sd, pktp, dadk_name,
+		dadk_logerr(dadkp, pktp, dadk_name,
 		    dadk_errtab[scb].d_severity, pktp->cp_srtsec,
 		    err_blkno, dadk_cmds, dadk_sense);
 	}
@@ -1519,7 +1563,7 @@ dadk_recorderr(struct cmpkt *pktp, struct dadkio_rwcmd *rwcmdp)
 
 	if (rwcmdp->flags & DADKIO_FLAG_SILENT)
 		return;
-	gda_errmsg(dadkp->dad_sd, pktp, dadk_name, dadk_errtab[scb].d_severity,
+	dadk_logerr(dadkp, pktp, dadk_name, dadk_errtab[scb].d_severity,
 	    rwcmdp->blkaddr, rwcmdp->status.failed_blk,
 	    dadk_cmds, dadk_sense);
 }
diff --git a/usr/src/uts/intel/io/ipmi/ipmivars.h b/usr/src/uts/intel/io/ipmi/ipmivars.h
index 7fd819cd3d..f547d6f043 100644
--- a/usr/src/uts/intel/io/ipmi/ipmivars.h
+++ b/usr/src/uts/intel/io/ipmi/ipmivars.h
@@ -78,6 +78,7 @@ struct ipmi_request {
 #define	SMIC_CTL_STS			1
 #define	SMIC_FLAGS			2
 
+struct ipmi_softc;
 #define	IPMI_BUSY	0x1
 #define	IPMI_CLOSING	0x2
 
diff --git a/usr/src/uts/intel/io/pci/pci_boot.c b/usr/src/uts/intel/io/pci/pci_boot.c
index 35d5013072..e7d131d25d 100644
--- a/usr/src/uts/intel/io/pci/pci_boot.c
+++ b/usr/src/uts/intel/io/pci/pci_boot.c
@@ -893,8 +893,9 @@ fix_ppb_res(uchar_t secbus, boolean_t prog_sub)
 {
 	uchar_t bus, dev, func;
 	uchar_t parbus, subbus;
-	uint_t io_base, io_limit, mem_base, mem_limit;
-	uint_t io_size, mem_size, io_align, mem_align;
+	uint_t io_base, io_limit, mem_base;
+	uint_t io_size, io_align;
+	uint64_t mem_size, mem_align, mem_limit;
 	uint64_t addr = 0;
 	int *regp = NULL;
 	uint_t reglen;
@@ -1049,9 +1050,9 @@ fix_ppb_res(uchar_t secbus, boolean_t prog_sub)
 				    pci_bus_res[parbus].io_reprogram;
 
 				cmn_err(CE_NOTE, "!add io-range on subtractive"
-				    " ppb[%x/%x/%x]: 0x%x ~ 0x%x\n",
-				    bus, dev, func, (uint32_t)addr,
-				    (uint32_t)addr + io_size - 1);
+				    " ppb[%x/%x/%x]: "
+				    "0x%"PRIx64" ~ 0x%"PRIx64"\n",
+				    bus, dev, func, addr, addr + io_size - 1);
 			}
 		}
 		/*
@@ -1066,9 +1067,10 @@ fix_ppb_res(uchar_t secbus, boolean_t prog_sub)
 				    pci_bus_res[parbus].mem_reprogram;
 
 				cmn_err(CE_NOTE, "!add mem-range on "
-				    "subtractive ppb[%x/%x/%x]: 0x%x ~ 0x%x\n",
-				    bus, dev, func, (uint32_t)addr,
-				    (uint32_t)addr + mem_size - 1);
+				    "subtractive ppb[%x/%x/%x]: "
+				    "0x%"PRIx64" ~ 0x%"PRIx64"\n",
+				    bus, dev, func,
+				    addr, addr + mem_size - 1);
 			}
 		}
 
@@ -1197,15 +1199,15 @@ fix_ppb_res(uchar_t secbus, boolean_t prog_sub)
 				if (is_vga(list, MEM))
 					continue;
 				if (mem_base == 0) {
-					mem_base = (uint_t)list->ml_address;
+					mem_base = list->ml_address;
 					mem_base = P2ALIGN(mem_base,
 					    PPB_MEM_ALIGNMENT);
-					mem_limit = (uint_t)(list->ml_address +
+					mem_limit = (list->ml_address +
 					    list->ml_size - 1);
 				} else {
 					if ((list->ml_address + list->ml_size) >
 					    mem_limit) {
-						mem_limit = (uint_t)
+						mem_limit =
 						    (list->ml_address +
 						    list->ml_size - 1);
 					}
@@ -1265,7 +1267,7 @@ fix_ppb_res(uchar_t secbus, boolean_t prog_sub)
 			add_ranges_prop(secbus, 1);
 
 			cmn_err(CE_NOTE, "!reprogram mem-range on"
-			    " ppb[%x/%x/%x]: 0x%x ~ 0x%x\n",
+			    " ppb[%x/%x/%x]: 0x%x ~ 0x%"PRIx64"\n",
 			    bus, dev, func, mem_base, mem_limit);
 		}
 	}
@@ -2360,7 +2362,8 @@ add_reg_props(dev_info_t *dip, uchar_t bus, uchar_t dev, uchar_t func,
 {
 	uchar_t baseclass, subclass, progclass, header;
 	ushort_t bar_sz;
-	uint_t value = 0, len, devloc;
+	uint64_t value = 0;
+	uint_t devloc;
 	uint_t base, base_hi, type;
 	ushort_t offset, end;
 	int max_basereg, j, reprogram = 0;
@@ -2444,6 +2447,7 @@ add_reg_props(dev_info_t *dip, uchar_t bus, uchar_t dev, uchar_t func,
 		/* construct phys hi,med.lo, size hi, lo */
 		if ((pciide && j < 4) || (base & PCI_BASE_SPACE_IO)) {
 			int hard_decode = 0;
+			uint_t len;
 
 			/* i/o space */
 			bar_sz = PCI_BAR_SZ_32;
@@ -2528,26 +2532,33 @@ add_reg_props(dev_info_t *dip, uchar_t bus, uchar_t dev, uchar_t func,
 			nreg++, nasgn++;
 
 		} else {
+			uint64_t len;
 			/* memory space */
 			if ((base & PCI_BASE_TYPE_M) == PCI_BASE_TYPE_ALL) {
 				bar_sz = PCI_BAR_SZ_64;
 				base_hi = pci_getl(bus, dev, func, offset + 4);
+				pci_putl(bus, dev, func, offset + 4, 0xffffffff);
+				value |= (uint64_t)pci_getl(bus, dev, func,
+				    offset + 4) << 32;
+				pci_putl(bus, dev, func, offset + 4, base_hi);
 				phys_hi = PCI_ADDR_MEM64;
+				value &= PCI_BASE_M_ADDR64_M;
 			} else {
 				bar_sz = PCI_BAR_SZ_32;
 				base_hi = 0;
 				phys_hi = PCI_ADDR_MEM32;
+				value &= PCI_BASE_M_ADDR_M;
 			}
 
 			/* skip base regs with size of 0 */
-			value &= PCI_BASE_M_ADDR_M;
-
 			if (value == 0)
 				continue;
 
 			len = ((value ^ (value-1)) + 1) >> 1;
 			regs[nreg].pci_size_low =
-			    assigned[nasgn].pci_size_low = len;
+			    assigned[nasgn].pci_size_low = len & 0xffffffff;
+			regs[nreg].pci_size_hi =
+			    assigned[nasgn].pci_size_hi = len >> 32;
 
 			phys_hi |= (devloc | offset);
 			if (base & PCI_BASE_PREF_M)
@@ -2644,7 +2655,7 @@ add_reg_props(dev_info_t *dip, uchar_t bus, uchar_t dev, uchar_t func,
 				} else
 					cmn_err(CE_WARN, "failed to program "
 					    "mem space [%d/%d/%d] BAR@0x%x"
-					    " length 0x%x",
+					    " length 0x%"PRIx64,
 					    bus, dev, func, offset, len);
 			}
 			assigned[nasgn].pci_phys_low = base;
@@ -2677,6 +2688,8 @@ add_reg_props(dev_info_t *dip, uchar_t bus, uchar_t dev, uchar_t func,
 		value = 0;
 
 	if (value != 0) {
+		uint_t len;
+
 		regs[nreg].pci_phys_hi = (PCI_ADDR_MEM32 | devloc) + offset;
 		assigned[nasgn].pci_phys_hi = (PCI_RELOCAT_B |
 		    PCI_ADDR_MEM32 | devloc) + offset;
@@ -2859,7 +2872,7 @@ add_ppb_props(dev_info_t *dip, uchar_t bus, uchar_t dev, uchar_t func,
 	 * If it is unset, we disable i/o and mark it for reconfiguration in
 	 * later passes by setting the base > limit
 	 */
-	val = (uint_t)pci_getw(bus, dev, func, PCI_CONF_COMM);
+	val = (uint64_t)pci_getw(bus, dev, func, PCI_CONF_COMM);
 	if (val & PCI_COMM_IO) {
 		val = (uint_t)pci_getb(bus, dev, func, PCI_BCNF_IO_BASE_LOW);
 		io_range[0] = ((val & PCI_BCNF_IO_MASK) << PCI_BCNF_IO_SHIFT);
diff --git a/usr/src/uts/intel/io/pci/pci_pci.c b/usr/src/uts/intel/io/pci/pci_pci.c
index 9f0ed4d67f..5d781e40b6 100644
--- a/usr/src/uts/intel/io/pci/pci_pci.c
+++ b/usr/src/uts/intel/io/pci/pci_pci.c
@@ -561,12 +561,21 @@ ppb_ctlops(dev_info_t *dip, dev_info_t *rdip,
 	if (ctlop == DDI_CTLOPS_NREGS)
 		*(int *)result = totreg;
 	else if (ctlop == DDI_CTLOPS_REGSIZE) {
+		uint64_t rs;
+
 		rn = *(int *)arg;
 		if (rn >= totreg) {
 			kmem_free(drv_regp, reglen);
 			return (DDI_FAILURE);
 		}
-		*(off_t *)result = drv_regp[rn].pci_size_low;
+
+		rs = drv_regp[rn].pci_size_low |
+		    ((uint64_t)drv_regp[rn].pci_size_hi << 32);
+		if (rs > OFF_MAX) {
+			kmem_free(drv_regp, reglen);
+			return (DDI_FAILURE);
+		}
+		*(off_t *)result = rs;
 	}
 
 	kmem_free(drv_regp, reglen);
diff --git a/usr/src/uts/intel/io/vmxnet/buildNumber.h b/usr/src/uts/intel/io/vmxnet/buildNumber.h
new file mode 100644
index 0000000000..97f18a3cbc
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/buildNumber.h
@@ -0,0 +1,12 @@
+#define BUILD_NUMBER \
+	"build-425873"
+#define BUILD_NUMBER_NUMERIC \
+	425873
+#define BUILD_NUMBER_NUMERIC_STRING \
+	"425873"
+#define PRODUCT_BUILD_NUMBER \
+	"product-build-6261"
+#define PRODUCT_BUILD_NUMBER_NUMERIC \
+	6261
+#define PRODUCT_BUILD_NUMBER_NUMERIC_STRING \
+	"6261"
diff --git a/usr/src/uts/intel/io/vmxnet/includeCheck.h b/usr/src/uts/intel/io/vmxnet/includeCheck.h
new file mode 100644
index 0000000000..c414d6daf5
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/includeCheck.h
@@ -0,0 +1,159 @@
+/*********************************************************
+ * Copyright (C) 1998 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation version 2.1 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the Lesser GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA.
+ *
+ *********************************************************/
+
+/*********************************************************
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of VMware Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission of VMware Inc.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *********************************************************/
+
+/*********************************************************
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+/*
+ * includeCheck.h --
+ *
+ *	Restrict include file use.
+ *
+ * In every .h file, define one or more of these
+ *
+ *	INCLUDE_ALLOW_VMX 
+ *	INCLUDE_ALLOW_USERLEVEL 
+ *	INCLUDE_ALLOW_VMCORE
+ *	INCLUDE_ALLOW_MODULE
+ *	INCLUDE_ALLOW_VMKERNEL 
+ *	INCLUDE_ALLOW_DISTRIBUTE
+ *	INCLUDE_ALLOW_VMK_MODULE
+ *      INCLUDE_ALLOW_VMKDRIVERS
+ *      INCLUDE_ALLOW_VMIROM
+ *
+ * Then include this file.
+ *
+ * Any file that has INCLUDE_ALLOW_DISTRIBUTE defined will potentially
+ * be distributed in source form along with GPLed code.  Ensure
+ * that this is acceptable.
+ */
+
+
+/*
+ * Declare a VMCORE-only variable to help classify object
+ * files.  The variable goes in the common block and does
+ * not create multiple definition link-time conflicts.
+ */
+
+#if defined VMCORE && defined VMX86_DEVEL && defined VMX86_DEBUG && \
+    defined linux && !defined MODULE && \
+    !defined COMPILED_WITH_VMCORE
+#define COMPILED_WITH_VMCORE compiled_with_vmcore
+#ifdef ASM
+        .comm   compiled_with_vmcore, 0
+#else
+        asm(".comm compiled_with_vmcore, 0");
+#endif /* ASM */
+#endif
+
+
+#if defined VMCORE && \
+    !(defined VMX86_VMX || defined VMM || \
+      defined MONITOR_APP || defined VMMON)
+#error "Makefile problem: VMCORE without VMX86_VMX or \
+        VMM or MONITOR_APP or MODULE."
+#endif
+
+#if defined VMCORE && !defined INCLUDE_ALLOW_VMCORE
+#error "The surrounding include file is not allowed in vmcore."
+#endif
+#undef INCLUDE_ALLOW_VMCORE
+
+#if defined VMX86_VMX && !defined VMCORE && \
+    !(defined INCLUDE_ALLOW_VMX || defined INCLUDE_ALLOW_USERLEVEL)
+#error "The surrounding include file is not allowed in the VMX."
+#endif
+#undef INCLUDE_ALLOW_VMX
+
+#if defined USERLEVEL && !defined VMX86_VMX && !defined VMCORE && \
+    !defined INCLUDE_ALLOW_USERLEVEL
+#error "The surrounding include file is not allowed at userlevel."
+#endif
+#undef INCLUDE_ALLOW_USERLEVEL
+
+#if defined MODULE && !defined VMKERNEL_MODULE && \
+    !defined VMMON && !defined INCLUDE_ALLOW_MODULE
+#error "The surrounding include file is not allowed in driver modules."
+#endif
+#undef INCLUDE_ALLOW_MODULE
+
+#if defined VMMON && !defined INCLUDE_ALLOW_VMMON
+#error "The surrounding include file is not allowed in vmmon."
+#endif
+#undef INCLUDE_ALLOW_VMMON
+
+#if defined VMKERNEL && !defined INCLUDE_ALLOW_VMKERNEL
+#error "The surrounding include file is not allowed in the vmkernel."
+#endif
+#undef INCLUDE_ALLOW_VMKERNEL
+
+#if defined GPLED_CODE && !defined INCLUDE_ALLOW_DISTRIBUTE
+#error "The surrounding include file is not allowed in GPL code."
+#endif
+#undef INCLUDE_ALLOW_DISTRIBUTE
+
+#if defined VMKERNEL_MODULE && !defined VMKERNEL && \
+    !defined INCLUDE_ALLOW_VMK_MODULE && !defined INCLUDE_ALLOW_VMKDRIVERS
+#error "The surrounding include file is not allowed in vmkernel modules."
+#endif
+#undef INCLUDE_ALLOW_VMK_MODULE
+#undef INCLUDE_ALLOW_VMKDRIVERS
+
+#if defined VMIROM && ! defined INCLUDE_ALLOW_VMIROM
+#error "The surrounding include file is not allowed in vmirom."
+#endif
+#undef INCLUDE_ALLOW_VMIROM
diff --git a/usr/src/uts/intel/io/vmxnet/net.h b/usr/src/uts/intel/io/vmxnet/net.h
new file mode 100644
index 0000000000..41b6eb1d14
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/net.h
@@ -0,0 +1,220 @@
+/*********************************************************
+ * Copyright (C) 1998 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ *
+ *********************************************************/
+
+/*********************************************************
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+/************************************************************
+ *
+ *   net.h
+ *
+ *   This file should contain all network global defines.
+ *   No vlance/vmxnet/vnet/vmknet specific stuff should be
+ *   put here only defines used/usable by all network code.
+ *   --gustav
+ *
+ ************************************************************/
+
+#ifndef VMWARE_DEVICES_NET_H
+#define VMWARE_DEVICES_NET_H
+
+#define INCLUDE_ALLOW_USERLEVEL
+#define INCLUDE_ALLOW_MODULE
+#define INCLUDE_ALLOW_VMCORE
+
+#include "includeCheck.h"
+#include "vm_device_version.h"
+
+#ifdef VMCORE
+#include "config.h"
+#include "str.h"
+#include "strutil.h"
+#endif
+
+#define ETHERNET_MTU         1518
+#define ETH_MIN_FRAME_LEN      60
+
+#ifndef ETHER_ADDR_LEN
+#define ETHER_ADDR_LEN          6  /* length of MAC address */
+#endif
+#define ETH_HEADER_LEN	       14  /* length of Ethernet header */
+#define IP_ADDR_LEN	        4  /* length of IPv4 address */
+#define IP_HEADER_LEN	       20  /* minimum length of IPv4 header */
+
+#define ETHER_MAX_QUEUED_PACKET 1600
+
+
+/*
+ * State's that a NIC can be in currently we only use this
+ * in VLance but if we implement/emulate new adapters that
+ * we also want to be able to morph a new corresponding
+ * state should be added.
+ */
+
+#define LANCE_CHIP  0x2934
+#define VMXNET_CHIP 0x4392
+
+/*
+ * Size of reserved IO space needed by the LANCE adapter and
+ * the VMXNET adapter. If you add more ports to Vmxnet than
+ * there is reserved space you must bump VMXNET_CHIP_IO_RESV_SIZE.
+ * The sizes must be powers of 2.
+ */
+
+#define LANCE_CHIP_IO_RESV_SIZE  0x20
+#define VMXNET_CHIP_IO_RESV_SIZE 0x40
+
+#define MORPH_PORT_SIZE 4
+
+#ifdef VMCORE
+typedef struct Net_AdapterCount {
+   uint8 vlance;
+   uint8 vmxnet2;
+   uint8 vmxnet3;
+   uint8 e1000;
+   uint8 e1000e;
+} Net_AdapterCount;
+#endif
+
+#ifdef USERLEVEL
+
+/*
+ *----------------------------------------------------------------------------
+ *
+ * Net_AddAddrToLADRF --
+ *
+ *      Given a MAC address, sets the corresponding bit in the LANCE style
+ *      Logical Address Filter 'ladrf'.
+ *      The caller should have initialized the ladrf to all 0's, as this
+ *      function only ORs on a bit in the array.
+ *      'addr' is presumed to be ETHER_ADDR_LEN in size;
+ *      'ladrf' is presumed to point to a 64-bit vector.
+ *
+ *      Derived from a long history of derivations, originally inspired by
+ *      sample code from the AMD "Network Products: Ethernet Controllers 1998
+ *      Data Book, Book 2", pages 1-53..1-55.
+ *
+ * Returns:
+ *      None.
+ *
+ * Side effects:
+ *      Updates 'ladrf'.
+ *
+ *----------------------------------------------------------------------------
+ */
+
+static INLINE void
+Net_AddAddrToLadrf(const uint8 *addr,  // IN: pointer to MAC address
+                   uint8 *ladrf)       // IN/OUT: pointer to ladrf
+{
+#define CRC_POLYNOMIAL_BE 0x04c11db7UL	/* Ethernet CRC, big endian */
+
+   uint16 hashcode;
+   int32 crc = 0xffffffff;		/* init CRC for each address */
+   int32 j;
+   int32 bit;
+   int32 byte;
+
+   ASSERT(addr);
+   ASSERT(ladrf);
+
+   for (byte = 0; byte < ETHER_ADDR_LEN; byte++) {  /* for each address byte */
+      /* process each address bit */
+      for (bit = *addr++, j = 0;
+           j < 8;
+           j++, bit >>= 1) {
+	 crc = (crc << 1) ^ ((((crc < 0 ? 1 : 0) ^ bit) & 0x01) ?
+               CRC_POLYNOMIAL_BE : 0);
+      }
+   }
+   hashcode = (crc & 1);	       /* hashcode is 6 LSb of CRC ... */
+   for (j = 0; j < 5; j++) {	       /* ... in reverse order. */
+      hashcode = (hashcode << 1) | ((crc>>=1) & 1);
+   }
+
+   ladrf[hashcode >> 3] |= 1 << (hashcode & 0x07);
+}
+#endif // USERLEVEL
+
+#ifdef VMCORE
+/*
+ *----------------------------------------------------------------------
+ *
+ * Net_GetNumAdapters --
+ *
+ *      Returns the number of each type of network adapter configured in this 
+ *      VM.
+ *
+ * Results:
+ *      None.
+ *
+ * Side effects:
+ *      None.
+ *
+ *----------------------------------------------------------------------
+ */
+
+static INLINE void
+Net_GetNumAdapters(Net_AdapterCount *counts)
+{
+   uint32 i;
+
+   counts->vlance = 0;
+   counts->vmxnet2 = 0;
+   counts->vmxnet3 = 0;
+   counts->e1000 = 0;
+   counts->e1000e = 0;
+
+   for (i = 0; i < MAX_ETHERNET_CARDS; i++) {
+      char* adapterStr;
+
+      if (!Config_GetBool(FALSE, "ethernet%d.present", i)) {
+	 continue;
+      }
+      adapterStr = Config_GetString("vlance", "ethernet%d.virtualDev", i);
+      if (Str_Strcasecmp(adapterStr, "vmxnet3") == 0) {
+         counts->vmxnet3++;
+      } else if (Str_Strcasecmp(adapterStr, "vlance") == 0) {
+         counts->vlance++;
+      } else if (Str_Strcasecmp(adapterStr, "vmxnet") == 0) {
+         counts->vmxnet2++;
+      } else if (Str_Strcasecmp(adapterStr, "e1000") == 0) {
+         counts->e1000++;
+      } else if (Str_Strcasecmp(adapterStr, "e1000e") == 0) {
+         counts->e1000e++;
+      } else {
+         LOG_ONCE(("%s: unknown adapter: %s\n", __FUNCTION__, adapterStr));
+      }
+      free(adapterStr);      
+   }
+}
+
+#endif // VMCORE
+
+#endif // VMWARE_DEVICES_NET_H
diff --git a/usr/src/uts/intel/io/vmxnet/net_sg.h b/usr/src/uts/intel/io/vmxnet/net_sg.h
new file mode 100644
index 0000000000..f6c30fb2b5
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/net_sg.h
@@ -0,0 +1,84 @@
+/*********************************************************
+ * Copyright (C) 2000 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ *
+ *********************************************************/
+
+/*********************************************************
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+/*
+ * net_sg.h --
+ *
+ *	Network packet scatter gather structure.
+ */
+
+
+#ifndef _NET_SG_H
+#define _NET_SG_H
+
+#define INCLUDE_ALLOW_USERLEVEL
+
+#define INCLUDE_ALLOW_MODULE
+#define INCLUDE_ALLOW_VMK_MODULE
+#define INCLUDE_ALLOW_VMKERNEL
+#define INCLUDE_ALLOW_DISTRIBUTE
+#include "includeCheck.h"
+
+#define NET_SG_DEFAULT_LENGTH	16
+
+/*
+ * A single scatter-gather element for a network packet.
+ * The address is split into low and high to save space.
+ * If we make it 64 bits then Windows pads things out such that
+ * we lose a lot of space for each scatter gather array.
+ * This adds up when you have embedded scatter-gather 
+ * arrays for transmit and receive ring buffers.
+ */
+typedef struct NetSG_Elem {
+   uint32 	addrLow;
+   uint16	addrHi;
+   uint16	length;
+} NetSG_Elem;
+
+typedef enum NetSG_AddrType {
+   NET_SG_MACH_ADDR,
+   NET_SG_PHYS_ADDR,
+   NET_SG_VIRT_ADDR,
+} NetSG_AddrType;
+
+typedef struct NetSG_Array {
+   uint16	addrType;
+   uint16	length;
+   NetSG_Elem	sg[NET_SG_DEFAULT_LENGTH];
+} NetSG_Array;
+
+#define NET_SG_SIZE(len) (sizeof(NetSG_Array) + (len - NET_SG_DEFAULT_LENGTH) * sizeof(NetSG_Elem))
+
+#define NET_SG_MAKE_PA(elem)                 (PA)QWORD(elem.addrHi, elem.addrLow)
+#define NET_SG_MAKE_PTR(elem) (char *)(uintptr_t)QWORD(elem.addrHi, elem.addrLow)
+
+#endif
diff --git a/usr/src/uts/intel/io/vmxnet/vm_basic_types.h b/usr/src/uts/intel/io/vmxnet/vm_basic_types.h
new file mode 100644
index 0000000000..adeac1b708
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/vm_basic_types.h
@@ -0,0 +1,1037 @@
+/*********************************************************
+ * Copyright (C) 1998-2009 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation version 2.1 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the Lesser GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA.
+ *
+ *********************************************************/
+
+/*********************************************************
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of VMware Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission of VMware Inc.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *********************************************************/
+
+/*********************************************************
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+/*
+ *
+ * vm_basic_types.h --
+ *
+ *    basic data types.
+ */
+
+
+#ifndef _VM_BASIC_TYPES_H_
+#define _VM_BASIC_TYPES_H_
+
+#define INCLUDE_ALLOW_USERLEVEL
+
+#define INCLUDE_ALLOW_MODULE
+#define INCLUDE_ALLOW_VMMON
+#define INCLUDE_ALLOW_VMKERNEL
+#define INCLUDE_ALLOW_VMKDRIVERS
+#define INCLUDE_ALLOW_VMK_MODULE
+#define INCLUDE_ALLOW_DISTRIBUTE
+#define INCLUDE_ALLOW_VMCORE
+#define INCLUDE_ALLOW_VMIROM
+#include "includeCheck.h"
+
+/* STRICT ANSI means the Xserver build and X defines Bool differently. */
+#if !defined(_XTYPEDEF_BOOL) && \
+    (!defined(__STRICT_ANSI__) || defined(__FreeBSD__) || defined(__MINGW32__))
+#define _XTYPEDEF_BOOL
+typedef char           Bool;
+#endif
+
+#ifndef FALSE
+#define FALSE          0
+#endif
+
+#ifndef TRUE
+#define TRUE           1
+#endif
+
+#define IsBool(x)      (((x) & ~1) == 0)
+#define IsBool2(x, y)  ((((x) | (y)) & ~1) == 0)
+
+/*
+ * Macros __i386__ and __ia64 are intrinsically defined by GCC
+ */
+#if defined _MSC_VER && defined _M_X64
+#  define __x86_64__
+#elif defined _MSC_VER && defined _M_IX86
+#  define __i386__
+#endif
+
+#ifdef __i386__
+#define VM_I386
+#endif
+
+#ifdef __x86_64__
+#define VM_X86_64
+#define VM_I386
+#define vm_x86_64 (1)
+#else
+#define vm_x86_64 (0)
+#endif
+
+
+#ifdef _MSC_VER
+
+#pragma warning (3 :4505) // unreferenced local function
+#pragma warning (disable :4018) // signed/unsigned mismatch
+#pragma warning (disable :4761) // integral size mismatch in argument; conversion supplied
+#pragma warning (disable :4305) // truncation from 'const int' to 'short'
+#pragma warning (disable :4244) // conversion from 'unsigned short' to 'unsigned char'
+#pragma warning (disable :4267) // truncation of 'size_t'
+#pragma warning (disable :4146) // unary minus operator applied to unsigned type, result still unsigned
+#pragma warning (disable :4142) // benign redefinition of type
+
+#endif
+
+#if defined(__APPLE__) || defined(HAVE_STDINT_H)
+
+/*
+ * TODO: This is a C99 standard header.  We should be able to test for
+ * #if __STDC_VERSION__ >= 199901L, but that breaks the Netware build
+ * (which doesn't have stdint.h).
+ */
+
+#include <stdint.h>
+
+typedef uint64_t    uint64;
+typedef  int64_t     int64;
+typedef uint32_t    uint32;
+typedef  int32_t     int32;
+typedef uint16_t    uint16;
+typedef  int16_t     int16;
+typedef  uint8_t    uint8;
+typedef   int8_t     int8;
+
+/*
+ * Note: C does not specify whether char is signed or unsigned, and
+ * both gcc and msvc implement processor-specific signedness.  With
+ * three types:
+ * typeof(char) != typeof(signed char) != typeof(unsigned char)
+ *
+ * Be careful here, because gcc (4.0.1 and others) likes to warn about
+ * conversions between signed char * and char *.
+ */
+
+#else /* !HAVE_STDINT_H */
+
+#ifdef _MSC_VER
+
+typedef unsigned __int64 uint64;
+typedef signed __int64 int64;
+
+#elif defined(__GNUC__) || defined(__SUNPRO_C)
+/* The Xserver source compiles with -ansi -pendantic */
+#   if !defined(__STRICT_ANSI__) || defined(__FreeBSD__)
+#      if defined(VM_X86_64)
+typedef unsigned long uint64;
+typedef long int64;
+#      else
+typedef unsigned long long uint64;
+typedef long long int64;
+#      endif
+#   endif
+#else
+#   error - Need compiler define for int64/uint64
+#endif /* _MSC_VER */
+
+typedef unsigned int       uint32;
+typedef unsigned short     uint16;
+typedef unsigned char      uint8;
+
+typedef int                int32;
+typedef short              int16;
+typedef signed char        int8;
+
+#endif /* HAVE_STDINT_H */
+
+/*
+ * FreeBSD (for the tools build) unconditionally defines these in
+ * sys/inttypes.h so don't redefine them if this file has already
+ * been included. [greg]
+ *
+ * This applies to Solaris as well.
+ */
+
+/*
+ * Before trying to do the includes based on OS defines, see if we can use
+ * feature-based defines to get as much functionality as possible
+ */
+
+#ifdef HAVE_INTTYPES_H
+#include <inttypes.h>
+#endif
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_INTTYPES_H
+#include <sys/inttypes.h>
+#endif
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
+
+#ifdef __FreeBSD__
+#include <sys/param.h> /* For __FreeBSD_version */
+#endif
+
+#if !defined(USING_AUTOCONF)
+#   if defined(__FreeBSD__) || defined(sun)
+#      ifdef KLD_MODULE
+#         include <sys/types.h>
+#      else
+#         if __FreeBSD_version >= 500043
+#            if !defined(VMKERNEL)
+#               include <inttypes.h>
+#            endif
+#            include <sys/types.h>
+#         else
+#            include <sys/inttypes.h>
+#         endif
+#      endif
+#   elif defined __APPLE__
+#      if KERNEL
+#         include <sys/unistd.h>
+#         include <sys/types.h> /* mostly for size_t */
+#         include <stdint.h>
+#      else
+#         include <unistd.h>
+#         include <inttypes.h>
+#         include <stdlib.h>
+#         include <stdint.h>
+#      endif
+#   else
+#      if !defined(__intptr_t_defined) && !defined(intptr_t)
+#         ifdef VM_I386
+#         define __intptr_t_defined
+#            ifdef VM_X86_64
+typedef int64     intptr_t;
+#            else
+typedef int32     intptr_t;
+#            endif
+#         elif defined(__arm__)
+typedef int32     intptr_t;
+#         endif
+#      endif
+
+#      ifndef _STDINT_H
+#         ifdef VM_I386
+#            ifdef VM_X86_64
+typedef uint64    uintptr_t;
+#            else
+typedef uint32    uintptr_t;
+#            endif
+#         elif defined(__arm__)
+typedef uint32    uintptr_t;
+#         endif
+#      endif
+#   endif
+#endif
+
+
+/*
+ * Time
+ * XXX These should be cleaned up.  -- edward
+ */
+
+typedef int64 VmTimeType;          /* Time in microseconds */
+typedef int64 VmTimeRealClock;     /* Real clock kept in microseconds */
+typedef int64 VmTimeVirtualClock;  /* Virtual Clock kept in CPU cycles */
+
+/*
+ * Printf format specifiers for size_t and 64-bit number.
+ * Use them like this:
+ *    printf("%"FMT64"d\n", big);
+ *
+ * FMTH is for handles/fds.
+ */
+
+#ifdef _MSC_VER
+   #define FMT64      "I64"
+   #ifdef VM_X86_64
+      #define FMTSZ      "I64"
+      #define FMTPD      "I64"
+      #define FMTH       "I64"
+   #else
+      #define FMTSZ      "I"
+      #define FMTPD      "I"
+      #define FMTH       "I"
+   #endif
+#elif defined __APPLE__
+   /* Mac OS hosts use the same formatters for 32- and 64-bit. */
+   #define FMT64 "ll"
+   #if KERNEL
+      #define FMTSZ "l"
+   #else
+      #define FMTSZ "z"
+   #endif
+   #define FMTPD "l"
+   #define FMTH ""
+#elif defined(__GNUC__) || defined(__SUNPRO_C)
+   #define FMTH ""
+   #if defined(N_PLAT_NLM) || defined(sun) || \
+       (defined(__FreeBSD__) && (__FreeBSD__ + 0) && ((__FreeBSD__ + 0) < 5))
+      /*
+       * Why (__FreeBSD__ + 0)?  See bug 141008.
+       * Yes, we really need to test both (__FreeBSD__ + 0) and
+       * ((__FreeBSD__ + 0) < 5).  No, we can't remove "+ 0" from
+       * ((__FreeBSD__ + 0) < 5).
+       */
+      #ifdef VM_X86_64
+         #define FMTSZ  "l"
+         #define FMTPD  "l"
+      #else
+         #define FMTSZ  ""
+         #define FMTPD  ""
+      #endif
+   #elif defined(__linux__) \
+      || (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 200112L) \
+      || (defined(_POSIX_VERSION) && _POSIX_VERSION >= 200112L) \
+      || (defined(_POSIX2_VERSION) && _POSIX2_VERSION >= 200112L)
+      /* BSD, Linux */
+      #define FMTSZ     "z"
+
+      #if defined(VM_X86_64)
+         #define FMTPD  "l"
+      #else
+         #define FMTPD  ""
+      #endif
+   #else
+      /* Systems with a pre-C99 libc */
+      #define FMTSZ     "Z"
+      #ifdef VM_X86_64
+         #define FMTPD  "l"
+      #else
+         #define FMTPD  ""
+      #endif
+   #endif
+   #ifdef VM_X86_64
+      #define FMT64     "l"
+   #elif defined(sun) || defined(__FreeBSD__)
+      #define FMT64     "ll"
+   #else
+      #define FMT64     "L"
+   #endif
+#else
+   #error - Need compiler define for FMT64 and FMTSZ
+#endif
+
+/*
+ * Suffix for 64-bit constants.  Use it like this:
+ *    CONST64(0x7fffffffffffffff) for signed or
+ *    CONST64U(0x7fffffffffffffff) for unsigned.
+ *
+ * 2004.08.30(thutt):
+ *   The vmcore/asm64/gen* programs are compiled as 32-bit
+ *   applications, but must handle 64 bit constants.  If the
+ *   64-bit-constant defining macros are already defined, the
+ *   definition will not be overwritten.
+ */
+
+#if !defined(CONST64) || !defined(CONST64U)
+#ifdef _MSC_VER
+#define CONST64(c) c##I64
+#define CONST64U(c) c##uI64
+#elif defined __APPLE__
+#define CONST64(c) c##LL
+#define CONST64U(c) c##uLL
+#elif defined(__GNUC__) || defined(__SUNPRO_C)
+#ifdef VM_X86_64
+#define CONST64(c) c##L
+#define CONST64U(c) c##uL
+#else
+#define CONST64(c) c##LL
+#define CONST64U(c) c##uLL
+#endif
+#else
+#error - Need compiler define for CONST64
+#endif
+#endif
+
+/*
+ * Use CONST3264/CONST3264U if you want a constant to be
+ * treated as a 32-bit number on 32-bit compiles and
+ * a 64-bit number on 64-bit compiles. Useful in the case
+ * of shifts, like (CONST3264U(1) << x), where x could be
+ * more than 31 on a 64-bit compile.
+ */
+
+#ifdef VM_X86_64
+    #define CONST3264(a) CONST64(a)
+    #define CONST3264U(a) CONST64U(a)
+#else
+    #define CONST3264(a) (a)
+    #define CONST3264U(a) (a)
+#endif
+
+#define MIN_INT8   ((int8)0x80)
+#define MAX_INT8   ((int8)0x7f)
+
+#define MIN_UINT8  ((uint8)0)
+#define MAX_UINT8  ((uint8)0xff)
+
+#define MIN_INT16  ((int16)0x8000)
+#define MAX_INT16  ((int16)0x7fff)
+
+#define MIN_UINT16 ((uint16)0)
+#define MAX_UINT16 ((uint16)0xffff)
+
+#define MIN_INT32  ((int32)0x80000000)
+#define MAX_INT32  ((int32)0x7fffffff)
+
+#define MIN_UINT32 ((uint32)0)
+#define MAX_UINT32 ((uint32)0xffffffff)
+
+#define MIN_INT64  (CONST64(0x8000000000000000))
+#define MAX_INT64  (CONST64(0x7fffffffffffffff))
+
+#define MIN_UINT64 (CONST64U(0))
+#define MAX_UINT64 (CONST64U(0xffffffffffffffff))
+
+typedef uint8 *TCA;  /* Pointer into TC (usually). */
+
+/*
+ * Type big enough to hold an integer between 0..100
+ */
+typedef uint8 Percent;
+#define AsPercent(v)	((Percent)(v))
+#define CHOOSE_PERCENT  AsPercent(101)
+
+
+typedef uintptr_t VA;
+typedef uintptr_t VPN;
+
+typedef uint64    PA;
+typedef uint32    PPN;
+
+typedef uint64    PhysMemOff;
+typedef uint64    PhysMemSize;
+
+/* The Xserver source compiles with -ansi -pendantic */
+#ifndef __STRICT_ANSI__
+typedef uint64    BA;
+#endif
+typedef uint32    BPN;
+typedef uint32    PageNum;
+typedef unsigned  MemHandle;
+typedef int32     World_ID;
+
+/* !! do not alter the definition of INVALID_WORLD_ID without ensuring
+ * that the values defined in both bora/public/vm_basic_types.h and
+ * lib/vprobe/vm_basic_types.h are the same.  Additionally, the definition
+ * of VMK_INVALID_WORLD_ID in vmkapi_world.h also must be defined with
+ * the same value
+ */
+
+#define INVALID_WORLD_ID ((World_ID)0)
+
+typedef World_ID User_CartelID;
+#define INVALID_CARTEL_ID INVALID_WORLD_ID
+
+typedef User_CartelID User_SessionID;
+#define INVALID_SESSION_ID INVALID_CARTEL_ID
+
+typedef User_CartelID User_CartelGroupID;
+#define INVALID_CARTELGROUP_ID INVALID_CARTEL_ID
+
+typedef uint32 Worldlet_ID;
+#define INVALID_WORLDLET_ID ((Worldlet_ID)-1)
+
+/* The Xserver source compiles with -ansi -pendantic */
+#ifndef __STRICT_ANSI__
+typedef uint64 MA;
+typedef uint32 MPN;
+#endif
+
+/*
+ * This type should be used for variables that contain sector
+ * position/quantity.
+ */
+typedef uint64 SectorType;
+
+/*
+ * Linear address
+ */
+
+typedef uintptr_t LA;
+typedef uintptr_t LPN;
+#define LA_2_LPN(_la)     ((_la) >> PAGE_SHIFT)
+#define LPN_2_LA(_lpn)    ((_lpn) << PAGE_SHIFT)
+
+#define LAST_LPN   ((((LA)  1) << (8 * sizeof(LA)   - PAGE_SHIFT)) - 1)
+#define LAST_LPN32 ((((LA32)1) << (8 * sizeof(LA32) - PAGE_SHIFT)) - 1)
+#define LAST_LPN64 ((((LA64)1) << (8 * sizeof(LA64) - PAGE_SHIFT)) - 1)
+
+/* Valid bits in a LPN. */
+#define LPN_MASK   LAST_LPN
+#define LPN_MASK32 LAST_LPN32
+#define LPN_MASK64 LAST_LPN64
+
+/*
+ * On 64 bit platform, address and page number types default
+ * to 64 bit. When we need to represent a 32 bit address, we use
+ * types defined below.
+ *
+ * On 32 bit platform, the following types are the same as the
+ * default types.
+ */
+typedef uint32 VA32;
+typedef uint32 VPN32;
+typedef uint32 LA32;
+typedef uint32 LPN32;
+typedef uint32 PA32;
+typedef uint32 PPN32;
+typedef uint32 MA32;
+typedef uint32 MPN32;
+
+/*
+ * On 64 bit platform, the following types are the same as the
+ * default types.
+ */
+typedef uint64 VA64;
+typedef uint64 VPN64;
+typedef uint64 LA64;
+typedef uint64 LPN64;
+typedef uint64 PA64;
+typedef uint64 PPN64;
+typedef uint64 MA64;
+typedef uint64 MPN64;
+
+/*
+ * VA typedefs for user world apps.
+ */
+typedef VA32 UserVA32;
+typedef VA64 UserVA64;
+typedef UserVA64 UserVAConst; /* Userspace ptr to data that we may only read. */
+typedef UserVA32 UserVA32Const; /* Userspace ptr to data that we may only read. */
+typedef UserVA64 UserVA64Const; /* Used by 64-bit syscalls until conversion is finished. */
+#ifdef VMKERNEL
+typedef UserVA64 UserVA;
+#else
+typedef void * UserVA;
+#endif
+
+
+/*
+ * Maximal possible PPN value (errors too) that PhysMem can handle.
+ * Must be at least as large as MAX_PPN which is the maximum PPN
+ * for any region other than buserror.
+ */
+#define PHYSMEM_MAX_PPN ((PPN)0xffffffff)
+#define MAX_PPN         ((PPN)0x1fffffff)   /* Maximal observable PPN value. */
+#define INVALID_PPN     ((PPN)0xffffffff)
+
+#define INVALID_BPN     ((BPN)0x1fffffff)
+
+#define RESERVED_MPN    ((MPN) 0)
+#define INVALID_MPN     ((MPN)-1)
+#define MEMREF_MPN      ((MPN)-2)
+#define RELEASED_MPN    ((MPN)-3)
+#define MAX_MPN         ((MPN)0x7fffffff)  /* 43 bits of address space. */
+
+#define INVALID_LPN     ((LPN)-1)
+#define INVALID_VPN     ((VPN)-1)
+#define INVALID_LPN64   ((LPN64)-1)
+#define INVALID_PAGENUM ((PageNum)-1)
+
+
+/*
+ * Format modifier for printing VA, LA, and VPN.
+ * Use them like this: Log("%#"FMTLA"x\n", laddr)
+ */
+
+#if defined(VMM) || defined(FROBOS64) || vm_x86_64 || defined __APPLE__
+#   define FMTLA "l"
+#   define FMTVA "l"
+#   define FMTVPN "l"
+#else
+#   define FMTLA ""
+#   define FMTVA ""
+#   define FMTVPN ""
+#endif
+
+#ifndef EXTERN
+#define EXTERN        extern
+#endif
+#define CONST         const
+
+
+#ifndef INLINE
+#   ifdef _MSC_VER
+#      define INLINE        __inline
+#   else
+#      define INLINE        inline
+#   endif
+#endif
+
+
+/*
+ * Annotation for data that may be exported into a DLL and used by other
+ * apps that load that DLL and import the data.
+ */
+#if defined(_WIN32) && defined(VMX86_IMPORT_DLLDATA)
+#  define VMX86_EXTERN_DATA       extern __declspec(dllimport)
+#else // !_WIN32
+#  define VMX86_EXTERN_DATA       extern
+#endif
+
+#if defined(_WIN32) && !defined(VMX86_NO_THREADS)
+#define THREADSPECIFIC __declspec(thread)
+#else
+#define THREADSPECIFIC
+#endif
+
+/*
+ * Due to the wonderful "registry redirection" feature introduced in
+ * 64-bit Windows, if you access any key under HKLM\Software in 64-bit
+ * code, you need to open/create/delete that key with
+ * VMKEY_WOW64_32KEY if you want a consistent view with 32-bit code.
+ */
+
+#ifdef _WIN32
+#ifdef _WIN64
+#define VMW_KEY_WOW64_32KEY KEY_WOW64_32KEY
+#else
+#define VMW_KEY_WOW64_32KEY 0x0
+#endif
+#endif
+
+
+/*
+ * Consider the following reasons functions are inlined:
+ *
+ *  1) inlined for performance reasons
+ *  2) inlined because it's a single-use function
+ *
+ * Functions which meet only condition 2 should be marked with this
+ * inline macro; It is not critical to be inlined (but there is a
+ * code-space & runtime savings by doing so), so when other callers
+ * are added the inline-ness should be removed.
+ */
+
+#if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 3)
+/*
+ * Starting at version 3.3, gcc does not always inline functions marked
+ * 'inline' (it depends on their size). To force gcc to do so, one must use the
+ * extra __always_inline__ attribute.
+ */
+#   define INLINE_SINGLE_CALLER INLINE __attribute__((__always_inline__))
+#else
+#   define INLINE_SINGLE_CALLER INLINE
+#endif
+
+/*
+ * Used when a hard guaranteed of no inlining is needed. Very few
+ * instances need this since the absence of INLINE is a good hint
+ * that gcc will not do inlining.
+ */
+
+#if defined(__GNUC__) && defined(VMM)
+#define ABSOLUTELY_NOINLINE __attribute__((__noinline__))
+#endif
+
+/*
+ * Attributes placed on function declarations to tell the compiler
+ * that the function never returns.
+ */
+
+#ifdef _MSC_VER
+#define NORETURN __declspec(noreturn)
+#elif __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 9)
+#define NORETURN __attribute__((__noreturn__))
+#else
+#define NORETURN
+#endif
+
+/*
+ * GCC 3.2 inline asm needs the + constraint for input/ouput memory operands.
+ * Older GCCs don't know about it --hpreg
+ */
+
+#if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 2)
+#   define VM_ASM_PLUS 1
+#else
+#   define VM_ASM_PLUS 0
+#endif
+
+/*
+ * Branch prediction hints:
+ *     LIKELY(exp)   - Expression exp is likely TRUE.
+ *     UNLIKELY(exp) - Expression exp is likely FALSE.
+ *   Usage example:
+ *        if (LIKELY(excCode == EXC_NONE)) {
+ *               or
+ *        if (UNLIKELY(REAL_MODE(vc))) {
+ *
+ * We know how to predict branches on gcc3 and later (hopefully),
+ * all others we don't so we do nothing.
+ */
+
+#if (__GNUC__ >= 3)
+/*
+ * gcc3 uses __builtin_expect() to inform the compiler of an expected value.
+ * We use this to inform the static branch predictor. The '!!' in LIKELY
+ * will convert any !=0 to a 1.
+ */
+#define LIKELY(_exp)     __builtin_expect(!!(_exp), 1)
+#define UNLIKELY(_exp)   __builtin_expect((_exp), 0)
+#else
+#define LIKELY(_exp)      (_exp)
+#define UNLIKELY(_exp)    (_exp)
+#endif
+
+/*
+ * GCC's argument checking for printf-like functions
+ * This is conditional until we have replaced all `"%x", void *'
+ * with `"0x%08x", (uint32) void *'. Note that %p prints different things
+ * on different platforms.  Argument checking is enabled for the
+ * vmkernel, which has already been cleansed.
+ *
+ * fmtPos is the position of the format string argument, beginning at 1
+ * varPos is the position of the variable argument, beginning at 1
+ */
+
+#if defined(__GNUC__)
+# define PRINTF_DECL(fmtPos, varPos) __attribute__((__format__(__printf__, fmtPos, varPos)))
+#else
+# define PRINTF_DECL(fmtPos, varPos)
+#endif
+
+#if defined(__GNUC__)
+# define SCANF_DECL(fmtPos, varPos) __attribute__((__format__(__scanf__, fmtPos, varPos)))
+#else
+# define SCANF_DECL(fmtPos, varPos)
+#endif
+
+/*
+ * UNUSED_PARAM should surround the parameter name and type declaration,
+ * e.g. "int MyFunction(int var1, UNUSED_PARAM(int var2))"
+ *
+ */
+
+#ifndef UNUSED_PARAM
+# if defined(__GNUC__)
+#  define UNUSED_PARAM(_parm) _parm  __attribute__((__unused__))
+# else
+#  define UNUSED_PARAM(_parm) _parm
+# endif
+#endif
+
+/*
+ * REGPARM defaults to REGPARM3; i.e., a request that gcc
+ * put the first three arguments in registers.  (It is fine
+ * if the function has fewer than three arguments.)  Gcc only.
+ * Syntactically, put REGPARM where you'd put INLINE or NORETURN.
+ *
+ * Note that 64-bit code already puts the first six arguments in
+ * registers, so these attributes are only useful for 32-bit code.
+ */
+
+#if defined(__GNUC__)
+# define REGPARM0 __attribute__((regparm(0)))
+# define REGPARM1 __attribute__((regparm(1)))
+# define REGPARM2 __attribute__((regparm(2)))
+# define REGPARM3 __attribute__((regparm(3)))
+# define REGPARM REGPARM3
+#else
+# define REGPARM0
+# define REGPARM1
+# define REGPARM2
+# define REGPARM3
+# define REGPARM
+#endif
+
+/*
+ * ALIGNED specifies minimum alignment in "n" bytes.
+ */
+
+#ifdef __GNUC__
+#define ALIGNED(n) __attribute__((__aligned__(n)))
+#else
+#define ALIGNED(n)
+#endif
+
+/*
+ * __func__ is a stringified function name that is part of the C99 standard. The block
+ * below defines __func__ on older systems where the compiler does not support that
+ * macro.
+ */
+#if defined(__GNUC__) \
+   && ((__GNUC__ == 2 && __GNUC_MINOR < 96) \
+       || (__GNUC__ < 2))
+#   define __func__ __FUNCTION__
+#endif
+
+/*
+ * Once upon a time, this was used to silence compiler warnings that
+ * get generated when the compiler thinks that a function returns
+ * when it is marked noreturn.  Don't do it.  Use NOT_REACHED().
+ */
+
+#define INFINITE_LOOP()           do { } while (1)
+
+/*
+ * On FreeBSD (for the tools build), size_t is typedef'd if _BSD_SIZE_T_
+ * is defined. Use the same logic here so we don't define it twice. [greg]
+ */
+#ifdef __FreeBSD__
+#   ifdef _BSD_SIZE_T_
+#      undef _BSD_SIZE_T_
+#      ifdef VM_I386
+#         ifdef VM_X86_64
+             typedef uint64 size_t;
+#         else
+             typedef uint32 size_t;
+#         endif
+#      endif /* VM_I386 */
+#   endif
+
+#   ifdef _BSD_SSIZE_T_
+#      undef _BSD_SSIZE_T_
+#      ifdef VM_I386
+#         ifdef VM_X86_64
+             typedef int64 ssize_t;
+#         else
+             typedef int32 ssize_t;
+#         endif
+#      endif /* VM_I386 */
+#   endif
+
+#else
+#   ifndef _SIZE_T
+#      ifdef VM_I386
+#         define _SIZE_T
+#         ifdef VM_X86_64
+             typedef uint64 size_t;
+#         else
+             typedef uint32 size_t;
+#         endif
+#      elif defined(__arm__)
+#         define _SIZE_T
+          typedef uint32 size_t;
+#      endif
+#   endif
+
+#   if !defined(FROBOS) && !defined(_SSIZE_T) && !defined(_SSIZE_T_) && \
+       !defined(ssize_t) && !defined(__ssize_t_defined) && \
+       !defined(_SSIZE_T_DECLARED)
+#      ifdef VM_I386
+#         define _SSIZE_T
+#         define __ssize_t_defined
+#         define _SSIZE_T_DECLARED
+#         ifdef VM_X86_64
+             typedef int64 ssize_t;
+#         else
+             typedef int32 ssize_t;
+#         endif
+#      elif defined(__arm__)
+#         define _SSIZE_T
+#         define __ssize_t_defined
+#         define _SSIZE_T_DECLARED
+          typedef int32 ssize_t;
+#      endif
+#   endif
+
+#endif
+
+/*
+ * Format modifier for printing pid_t.  On sun the pid_t is a ulong, but on
+ * Linux it's an int.
+ * Use this like this: printf("The pid is %"FMTPID".\n", pid);
+ */
+#ifdef sun
+#   ifdef VM_X86_64
+#      define FMTPID "d"
+#   else
+#      define FMTPID "lu"
+#   endif
+#else
+# define FMTPID "d"
+#endif
+
+/*
+ * Format modifier for printing uid_t.  On Solaris 10 and earlier, uid_t
+ * is a ulong, but on other platforms it's an unsigned int.
+ * Use this like this: printf("The uid is %"FMTUID".\n", uid);
+ */
+#if defined(sun) && !defined(SOL11)
+#   ifdef VM_X86_64
+#      define FMTUID "u"
+#   else
+#      define FMTUID "lu"
+#   endif
+#else
+# define FMTUID "u"
+#endif
+
+/*
+ * Format modifier for printing mode_t.  On sun the mode_t is a ulong, but on
+ * Linux it's an int.
+ * Use this like this: printf("The mode is %"FMTMODE".\n", mode);
+ */
+#ifdef sun
+#   ifdef VM_X86_64
+#      define FMTMODE "o"
+#   else
+#      define FMTMODE "lo"
+#   endif
+#else
+# define FMTMODE "o"
+#endif
+
+/*
+ * Format modifier for printing time_t. Most platforms define a time_t to be
+ * a long int, but on FreeBSD (as of 5.0, it seems), the time_t is a signed
+ * size quantity. Refer to the definition of FMTSZ to see why we need silly
+ * preprocessor arithmetic.
+ * Use this like this: printf("The mode is %"FMTTIME".\n", time);
+ */
+#if defined(__FreeBSD__) && (__FreeBSD__ + 0) && ((__FreeBSD__ + 0) >= 5)
+#   define FMTTIME FMTSZ"d"
+#else
+#   if defined(_MSC_VER)
+#      ifndef _SAFETIME_H_
+#         if (_MSC_VER < 1400) || defined(_USE_32BIT_TIME_T)
+#             define FMTTIME "ld"
+#         else
+#             define FMTTIME FMT64"d"
+#         endif
+#      else
+#         ifndef FMTTIME
+#            error "safetime.h did not define FMTTIME"
+#         endif
+#      endif
+#   else
+#      define FMTTIME "ld"
+#   endif
+#endif
+
+#ifdef __APPLE__
+/*
+ * Format specifier for all these annoying types such as {S,U}Int32
+ * which are 'long' in 32-bit builds
+ *       and  'int' in 64-bit builds.
+ */
+#   ifdef __LP64__
+#      define FMTLI ""
+#   else
+#      define FMTLI "l"
+#   endif
+
+/*
+ * Format specifier for all these annoying types such as NS[U]Integer
+ * which are  'int' in 32-bit builds
+ *       and 'long' in 64-bit builds.
+ */
+#   ifdef __LP64__
+#      define FMTIL "l"
+#   else
+#      define FMTIL ""
+#   endif
+#endif
+
+
+/*
+ * Define MXSemaHandle here so both vmmon and vmx see this definition.
+ */
+
+#ifdef _WIN32
+typedef uintptr_t MXSemaHandle;
+#else
+typedef int MXSemaHandle;
+#endif
+
+/*
+ * Define type for poll device handles.
+ */
+
+typedef int64 PollDevHandle;
+
+/*
+ * Define the utf16_t type.
+ */
+
+#if defined(_WIN32) && defined(_NATIVE_WCHAR_T_DEFINED)
+typedef wchar_t utf16_t;
+#else
+typedef uint16 utf16_t;
+#endif
+
+/*
+ * Define for point and rectangle types.  Defined here so they
+ * can be used by other externally facing headers in bora/public.
+ */
+
+typedef struct VMPoint {
+   int x, y;
+} VMPoint;
+
+#if defined _WIN32 && defined USERLEVEL
+struct tagRECT;
+typedef struct tagRECT VMRect;
+#else
+typedef struct VMRect {
+   int left;
+   int top;
+   int right;
+   int bottom;
+} VMRect;
+#endif
+
+/*
+ * ranked locks "everywhere"
+ */
+
+typedef uint32 MX_Rank;
+
+#endif  /* _VM_BASIC_TYPES_H_ */
diff --git a/usr/src/uts/intel/io/vmxnet/vm_device_version.h b/usr/src/uts/intel/io/vmxnet/vm_device_version.h
new file mode 100644
index 0000000000..7046594a6c
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/vm_device_version.h
@@ -0,0 +1,246 @@
+/*********************************************************
+ * Copyright (C) 1998 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation version 2.1 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the Lesser GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA.
+ *
+ *********************************************************/
+
+#ifndef VM_DEVICE_VERSION_H
+#define VM_DEVICE_VERSION_H
+
+#define INCLUDE_ALLOW_USERLEVEL
+
+#define INCLUDE_ALLOW_MODULE
+#define INCLUDE_ALLOW_VMKERNEL
+#define INCLUDE_ALLOW_VMCORE
+#include "includeCheck.h"
+
+#ifdef _WIN32
+#ifdef __MINGW32__
+#include "initguid.h"
+#else
+#include "guiddef.h"
+#endif
+#endif
+
+/* LSILogic 53C1030 Parallel SCSI controller
+ * LSILogic SAS1068 SAS controller
+ */
+#define PCI_VENDOR_ID_LSILOGIC          0x1000
+#define PCI_DEVICE_ID_LSI53C1030        0x0030
+#define PCI_DEVICE_ID_LSISAS1068        0x0054
+
+/* Our own PCI IDs
+ *    VMware SVGA II (Unified VGA)
+ *    VMware SVGA (PCI Accelerator)
+ *    VMware vmxnet (Idealized NIC)
+ *    VMware vmxscsi (Abortive idealized SCSI controller)
+ *    VMware chipset (Subsystem ID for our motherboards)
+ *    VMware e1000 (Subsystem ID)
+ *    VMware vmxnet3 (Uniform Pass Through NIC)
+ *    VMware HD Audio codec
+ *    VMware HD Audio controller
+ */
+#define PCI_VENDOR_ID_VMWARE                    0x15AD
+#define PCI_DEVICE_ID_VMWARE_SVGA2              0x0405
+#define PCI_DEVICE_ID_VMWARE_SVGA               0x0710
+#define PCI_DEVICE_ID_VMWARE_NET                0x0720
+#define PCI_DEVICE_ID_VMWARE_SCSI               0x0730
+#define PCI_DEVICE_ID_VMWARE_VMCI               0x0740
+#define PCI_DEVICE_ID_VMWARE_CHIPSET            0x1976
+#define PCI_DEVICE_ID_VMWARE_82545EM            0x0750 /* single port */
+#define PCI_DEVICE_ID_VMWARE_82546EB            0x0760 /* dual port   */
+#define PCI_DEVICE_ID_VMWARE_EHCI               0x0770
+#define PCI_DEVICE_ID_VMWARE_UHCI               0x0774
+#define PCI_DEVICE_ID_VMWARE_XHCI               0x0778
+#define PCI_DEVICE_ID_VMWARE_1394               0x0780
+#define PCI_DEVICE_ID_VMWARE_BRIDGE             0x0790
+#define PCI_DEVICE_ID_VMWARE_ROOTPORT           0x07A0
+#define PCI_DEVICE_ID_VMWARE_VMXNET3            0x07B0
+#define PCI_DEVICE_ID_VMWARE_VMXWIFI            0x07B8
+#define PCI_DEVICE_ID_VMWARE_PVSCSI             0x07C0
+#define PCI_DEVICE_ID_VMWARE_82574              0x07D0
+#define PCI_DEVICE_ID_VMWARE_HDAUDIO_CODEC      0x1975
+#define PCI_DEVICE_ID_VMWARE_HDAUDIO_CONTROLLER 0x1977
+
+/* The hypervisor device might grow.  Please leave room
+ * for 7 more subfunctions.
+ */
+#define PCI_DEVICE_ID_VMWARE_HYPER      0x0800
+#define PCI_DEVICE_ID_VMWARE_VMI        0x0801
+
+#define PCI_DEVICE_VMI_CLASS            0x05
+#define PCI_DEVICE_VMI_SUBCLASS         0x80
+#define PCI_DEVICE_VMI_INTERFACE        0x00
+#define PCI_DEVICE_VMI_REVISION         0x01
+
+/* From linux/pci_ids.h:
+ *   AMD Lance Ethernet controller
+ *   BusLogic SCSI controller
+ *   Ensoniq ES1371 sound controller
+ */
+#define PCI_VENDOR_ID_AMD               0x1022
+#define PCI_DEVICE_ID_AMD_VLANCE        0x2000
+#define PCI_VENDOR_ID_BUSLOGIC			0x104B
+#define PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER_NC	0x0140
+#define PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER	0x1040
+#define PCI_VENDOR_ID_ENSONIQ           0x1274
+#define PCI_DEVICE_ID_ENSONIQ_ES1371    0x1371
+
+/* From linux/pci_ids.h:
+ *    Intel 82439TX (430 HX North Bridge)
+ *    Intel 82371AB (PIIX4 South Bridge)
+ *    Intel 82443BX (440 BX North Bridge and AGP Bridge)
+ *    Intel 82545EM (e1000, server adapter, single port)
+ *    Intel 82546EB (e1000, server adapter, dual port)
+ *    Intel HECI (as embedded in ich9m)
+ */
+#define PCI_VENDOR_ID_INTEL             0x8086
+#define PCI_DEVICE_ID_INTEL_82439TX     0x7100
+#define PCI_DEVICE_ID_INTEL_82371AB_0   0x7110
+#define PCI_DEVICE_ID_INTEL_82371AB_2   0x7112
+#define PCI_DEVICE_ID_INTEL_82371AB_3   0x7113
+#define PCI_DEVICE_ID_INTEL_82371AB     0x7111
+#define PCI_DEVICE_ID_INTEL_82443BX     0x7190
+#define PCI_DEVICE_ID_INTEL_82443BX_1   0x7191
+#define PCI_DEVICE_ID_INTEL_82443BX_2   0x7192 /* Used when no AGP support */
+#define PCI_DEVICE_ID_INTEL_82545EM     0x100f
+#define PCI_DEVICE_ID_INTEL_82546EB     0x1010
+#define PCI_DEVICE_ID_INTEL_82574       0x10d3
+#define PCI_DEVICE_ID_INTEL_82574_APPLE 0x10f6
+#define PCI_DEVICE_ID_INTEL_HECI        0x2a74
+
+#define E1000E_PCI_DEVICE_ID_CONFIG_STR "e1000e.pci.deviceID"
+#define E1000E_PCI_SUB_VENDOR_ID_CONFIG_STR "e1000e.pci.subVendorID"
+#define E1000E_PCI_SUB_DEVICE_ID_CONFIG_STR "e1000e.pci.subDeviceID"
+
+/*
+ * Intel HD Audio controller and Realtek ALC885 codec.
+ */
+#define PCI_DEVICE_ID_INTEL_631XESB_632XESB  0x269a
+#define PCI_VENDOR_ID_REALTEK                0x10ec
+#define PCI_DEVICE_ID_REALTEK_ALC885         0x0885
+
+
+/*
+ * Fresco Logic xHCI (USB 3.0) Controller
+ */
+#define PCI_VENDOR_ID_FRESCO            0x1B73
+#define PCI_DEVICE_ID_FRESCO_FL1000     0x1000   // Original 1-port chip
+#define PCI_DEVICE_ID_FRESCO_FL1009     0x1009   // New 2-port chip (Driver 3.0.98+)
+#define PCI_DEVICE_ID_FRESCO_FL1400     0x1400   // Unknown (4-port? Dev hardware?)
+
+/*
+ * NEC/Renesas xHCI (USB 3.0) Controller
+ */
+#define PCI_VENDOR_ID_NEC               0x1033
+#define PCI_DEVICE_ID_NEC_UPD720200     0x0194
+#define PCI_REVISION_NEC_UPD720200      0x03
+#define PCI_FIRMWARE_NEC_UPD720200      0x3015
+
+
+/************* Strings for IDE Identity Fields **************************/
+#define VIDE_ID_SERIAL_STR	"00000000000000000001"	/* Must be 20 Bytes */
+#define VIDE_ID_FIRMWARE_STR	"00000001"		/* Must be 8 Bytes */
+
+/* No longer than 40 Bytes */
+#define VIDE_ATA_MODEL_STR PRODUCT_GENERIC_NAME " Virtual IDE Hard Drive"
+#define VIDE_ATAPI_MODEL_STR PRODUCT_GENERIC_NAME " Virtual IDE CDROM Drive"
+
+#define ATAPI_VENDOR_ID	"NECVMWar"		/* Must be 8 Bytes */
+#define ATAPI_PRODUCT_ID PRODUCT_GENERIC_NAME " IDE CDROM"	/* Must be 16 Bytes */
+#define ATAPI_REV_LEVEL	"1.00"			/* Must be 4 Bytes */
+
+#define IDE_NUM_INTERFACES   2	/* support for two interfaces */
+#define IDE_DRIVES_PER_IF    2
+
+/************* Strings for SCSI Identity Fields **************************/
+#define SCSI_DISK_MODEL_STR PRODUCT_GENERIC_NAME " Virtual SCSI Hard Drive"
+#define SCSI_DISK_VENDOR_NAME COMPANY_NAME
+#define SCSI_DISK_REV_LEVEL "1.0"
+#define SCSI_CDROM_MODEL_STR PRODUCT_GENERIC_NAME " Virtual SCSI CDROM Drive"
+#define SCSI_CDROM_VENDOR_NAME COMPANY_NAME
+#define SCSI_CDROM_REV_LEVEL "1.0"
+
+/************* SCSI implementation limits ********************************/
+#define SCSI_MAX_CONTROLLERS	 4	  // Need more than 1 for MSCS clustering
+#define	SCSI_MAX_DEVICES	 16	  // BT-958 emulates only 16
+#define PVSCSI_MAX_DEVICES       255      // 255 (including the controller)
+/*
+ * VSCSI_BV_INTS is the number of uint32's needed for a bit vector 
+ * to cover all scsi devices per target.
+ */
+#define VSCSI_BV_INTS            CEILING(PVSCSI_MAX_DEVICES, 8 * sizeof (uint32))
+#define SCSI_IDE_CHANNEL         SCSI_MAX_CONTROLLERS
+#define SCSI_IDE_HOSTED_CHANNEL  (SCSI_MAX_CONTROLLERS + 1)
+#define SCSI_MAX_CHANNELS        (SCSI_MAX_CONTROLLERS + 2)
+
+/************* Strings for the VESA BIOS Identity Fields *****************/
+#define VBE_OEM_STRING COMPANY_NAME " SVGA"
+#define VBE_VENDOR_NAME COMPANY_NAME
+#define VBE_PRODUCT_NAME PRODUCT_GENERIC_NAME
+
+/************* PCI implementation limits ********************************/
+#define PCI_MAX_BRIDGES         15
+
+/************* Ethernet implementation limits ***************************/
+#define MAX_ETHERNET_CARDS      10
+
+/********************** Floppy limits ***********************************/
+#define MAX_FLOPPY_DRIVES      2
+
+/************* PCI Passthrough implementation limits ********************/
+#define MAX_PCI_PASSTHRU_DEVICES 6
+
+/************* USB implementation limits ********************************/
+#define MAX_USB_DEVICES_PER_HOST_CONTROLLER 127
+
+/************* Strings for Host USB Driver *******************************/
+
+#ifdef _WIN32
+
+/*
+ * Globally unique ID for the VMware device interface. Define INITGUID before including
+ * this header file to instantiate the variable.
+ */
+DEFINE_GUID(GUID_DEVICE_INTERFACE_VMWARE_USB_DEVICES, 
+0x2da1fe75, 0xaab3, 0x4d2c, 0xac, 0xdf, 0x39, 0x8, 0x8c, 0xad, 0xa6, 0x65);
+
+/*
+ * Globally unique ID for the VMware device setup class.
+ */
+DEFINE_GUID(GUID_CLASS_VMWARE_USB_DEVICES, 
+0x3b3e62a5, 0x3556, 0x4d7e, 0xad, 0xad, 0xf5, 0xfa, 0x3a, 0x71, 0x2b, 0x56);
+
+/*
+ * This string defines the device ID string of a VMware USB device.
+ * The format is USB\Vid_XXXX&Pid_YYYY, where XXXX and YYYY are the
+ * hexadecimal representations of the vendor and product ids, respectively.
+ *
+ * The official vendor ID for VMware, Inc. is 0x0E0F.
+ * The product id for USB generic devices is 0x0001.
+ */
+#define USB_VMWARE_DEVICE_ID_WIDE L"USB\\Vid_0E0F&Pid_0001"
+#define USB_DEVICE_ID_LENGTH (sizeof(USB_VMWARE_DEVICE_ID_WIDE) / sizeof(WCHAR))
+
+#ifdef UNICODE
+#define USB_PNP_SETUP_CLASS_NAME L"VMwareUSBDevices"
+#define USB_PNP_DRIVER_NAME L"vmusb"
+#else
+#define USB_PNP_SETUP_CLASS_NAME "VMwareUSBDevices"
+#define USB_PNP_DRIVER_NAME "vmusb"
+#endif
+#endif
+
+#endif /* VM_DEVICE_VERSION_H */
diff --git a/usr/src/uts/intel/io/vmxnet/vmnet_def.h b/usr/src/uts/intel/io/vmxnet/vmnet_def.h
new file mode 100644
index 0000000000..6e44aea2bb
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/vmnet_def.h
@@ -0,0 +1,91 @@
+/*********************************************************
+ * Copyright (C) 2004 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ *
+ *********************************************************/
+
+/*********************************************************
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+/*
+ * vmnet_def.h 
+ *
+ *     - definitions which are (mostly) not vmxnet or vlance specific
+ */
+
+#ifndef _VMNET_DEF_H_
+#define _VMNET_DEF_H_
+
+#define INCLUDE_ALLOW_USERLEVEL
+#define INCLUDE_ALLOW_VMCORE
+
+#define INCLUDE_ALLOW_MODULE
+#define INCLUDE_ALLOW_VMK_MODULE
+#define INCLUDE_ALLOW_VMKERNEL
+#define INCLUDE_ALLOW_DISTRIBUTE
+#include "includeCheck.h"
+
+#define VMNET_NAME_BUFFER_LEN  128 /* Increased for i18n. */
+#define VMNET_COAL_SCHEME_NAME_LEN 16
+
+
+/*
+ * capabilities - not all of these are implemented in the virtual HW
+ *                (eg VLAN support is in the virtual switch)  so even vlance 
+ *                can use them
+ */
+#define VMNET_CAP_SG	        0x0001	/* Can do scatter-gather transmits. */
+#define VMNET_CAP_IP4_CSUM      0x0002	/* Can checksum only TCP/UDP over IPv4. */
+#define VMNET_CAP_HW_CSUM       0x0004	/* Can checksum all packets. */
+#define VMNET_CAP_HIGH_DMA      0x0008	/* Can DMA to high memory. */
+#define VMNET_CAP_TOE	        0x0010	/* Supports TCP/IP offload. */
+#define VMNET_CAP_TSO	        0x0020	/* Supports TCP Segmentation offload */
+#define VMNET_CAP_SW_TSO        0x0040	/* Supports SW TCP Segmentation */
+#define VMNET_CAP_VMXNET_APROM  0x0080	/* Vmxnet APROM support */
+#define VMNET_CAP_HW_TX_VLAN    0x0100  /* Can we do VLAN tagging in HW */
+#define VMNET_CAP_HW_RX_VLAN    0x0200  /* Can we do VLAN untagging in HW */
+#define VMNET_CAP_SW_VLAN       0x0400  /* Can we do VLAN tagging/untagging in SW */
+#define VMNET_CAP_WAKE_PCKT_RCV 0x0800  /* Can wake on network packet recv? */
+#define VMNET_CAP_ENABLE_INT_INLINE 0x1000  /* Enable Interrupt Inline */
+#define VMNET_CAP_ENABLE_HEADER_COPY 0x2000  /* copy header for vmkernel */
+#define VMNET_CAP_TX_CHAIN      0x4000  /* Guest can use multiple tx entries for a pkt */
+#define VMNET_CAP_RX_CHAIN      0x8000  /* a pkt can span multiple rx entries */
+#define VMNET_CAP_LPD           0x10000 /* large pkt delivery */
+#define VMNET_CAP_BPF           0x20000 /* BPF Support in VMXNET Virtual Hardware */
+#define VMNET_CAP_SG_SPAN_PAGES 0x40000	/* Can do scatter-gather span multiple pages transmits. */
+#define VMNET_CAP_IP6_CSUM      0x80000	/* Can do IPv6 csum offload. */
+#define VMNET_CAP_TSO6         0x100000	/* Can do TSO segmentation offload for IPv6 pkts. */
+#define VMNET_CAP_TSO256k      0x200000	/* Can do TSO segmentation offload for pkts up to 256kB. */
+#define VMNET_CAP_UPT          0x400000	/* Support UPT */
+#define VMNET_CAP_RDONLY_INETHDRS 0x800000 /* Modifies inet headers for TSO/CSUm */
+#define VMNET_CAP_NPA         0x1000000	/* Support NPA */
+#define VMNET_CAP_DCB         0x2000000	/* Support DCB */
+#define VMNET_CAP_OFFLOAD_8OFFSET 0x4000000 /* supports 8bit parameterized offsets */ 
+#define VMNET_CAP_OFFLOAD_16OFFSET 0x8000000 /* supports 16bit parameterized offsets */ 
+#define VMNET_CAP_IP6_CSUM_EXT_HDRS 0x10000000 /* support csum of ip6 ext hdrs */
+#define VMNET_CAP_TSO6_EXT_HDRS 0x20000000 /* support TSO for ip6 ext hdrs */
+#define VMNET_CAP_SCHED       0x40000000 /* compliant with network scheduling */
+#endif // _VMNET_DEF_H_
diff --git a/usr/src/uts/intel/io/vmxnet/vmxnet.c b/usr/src/uts/intel/io/vmxnet/vmxnet.c
new file mode 100644
index 0000000000..e0046d8deb
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/vmxnet.c
@@ -0,0 +1,2438 @@
+/*********************************************************
+ * Copyright (C) 2004 VMware, Inc. All rights reserved.
+ *
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+#include <sys/types.h>
+#include <sys/conf.h>
+#include <sys/debug.h>
+#include <sys/stropts.h>
+#include <sys/stream.h>
+#include <sys/strlog.h>
+#include <sys/kmem.h>
+#include <sys/stat.h>
+#include <sys/kstat.h>
+#include <sys/vtrace.h>
+#include <sys/dlpi.h>
+#include <sys/strsun.h>
+#include <sys/ethernet.h>
+#include <sys/modctl.h>
+#include <sys/errno.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/ddi_impldefs.h>
+#include <sys/gld.h>
+#include <sys/pci.h>
+#include <sys/strsubr.h>
+
+/*
+ * This used to be defined in sys/gld.h, but was flagged as private,
+ * and we used it anyway.  Now it no longer exists, and we're stuck
+ * with it for the time being.
+ */
+#ifndef GLD_MAX_MULTICAST
+#define GLD_MAX_MULTICAST 64
+#endif
+
+#define __intptr_t_defined
+#define _STDINT_H
+#include "vm_basic_types.h"
+#include "vmxnet2_def.h"
+#include "vm_device_version.h"
+#include "net.h"
+#include "buildNumber.h"
+
+#define SOLVMXNET_SUCCESS 1
+#define SOLVMXNET_FAILURE 0
+
+#ifdef SOLVMXNET_DEBUG_LEVEL
+static int vxn_debug = SOLVMXNET_DEBUG_LEVEL;
+#define  DPRINTF(n, args)  if (vxn_debug>(n)) cmn_err args
+#else
+#define  DPRINTF(n, args)
+#endif
+
+static char ident[] = "VMware Ethernet Adapter b" BUILD_NUMBER_NUMERIC_STRING;
+char _depends_on[] = {"misc/gld"};
+
+#define MAX_NUM_RECV_BUFFERS            128
+#define DEFAULT_NUM_RECV_BUFFERS        100
+#define MAX_NUM_XMIT_BUFFERS            128
+#define DEFAULT_NUM_XMIT_BUFFERS        100
+#define CRC_POLYNOMIAL_LE               0xedb88320UL
+#define SOLVMXNET_MAXNAME               20
+#define MAX_TX_WAIT_ON_STOP             2000
+
+#define ETHERALIGN  2
+#define SLACKBYTES  4
+#define MAXPKTBUF   (14 + ETHERALIGN + ETHERMTU + SLACKBYTES)
+
+
+#define QHIWATER (MAX_NUM_RECV_BUFFERS*ETHERMTU)
+
+#define OUTB(dp, p, v)  \
+        ddi_put8((dp)->vxnIOHdl, \
+                (uint8_t *)((caddr_t)((dp)->vxnIOp) + (p)), v)
+#define OUTW(dp, p, v)  \
+        ddi_put16((dp)->vxnIOHdl, \
+                (uint16_t *)((caddr_t)((dp)->vxnIOp) + (p)), v)
+#define OUTL(dp, p, v)  \
+        ddi_put32((dp)->vxnIOHdl, \
+                (uint32_t *)((caddr_t)((dp)->vxnIOp) + (p)), v)
+#define INB(dp, p)      \
+        ddi_get8((dp)->vxnIOHdl, \
+                (uint8_t *)(((caddr_t)(dp)->vxnIOp) + (p)))
+#define INW(dp, p)      \
+        ddi_get16((dp)->vxnIOHdl, \
+                (uint16_t *)(((caddr_t)(dp)->vxnIOp) + (p)))
+#define INL(dp, p)      \
+        ddi_get32((dp)->vxnIOHdl, \
+                (uint32_t *)(((caddr_t)(dp)->vxnIOp) + (p)))
+
+#define VMXNET_INC(val, max) \
+   val++; \
+   if (UNLIKELY(val == max)) { \
+      val = 0; \
+   }
+
+#define TX_RINGBUF_MBLK(dp, idx) (dp->txRingBuf[idx].mblk)
+#define TX_RINGBUF_DMAMEM(dp, idx) (dp->txRingBuf[idx].dmaMem)
+
+typedef struct {
+   caddr_t           buf;             /* Virtual address */
+   uint32_t          phyBuf;          /* Physical address */
+   size_t            bufLen;          /* Buffer length */
+   ddi_dma_cookie_t  cookie;          /* Dma cookie */
+   uint_t            cookieCount;     /* Cookie count */
+   ddi_dma_handle_t  dmaHdl;          /* Dma handle */ 
+   ddi_acc_handle_t  dataAccHdl;      /* Dada access handle */
+} dma_buf_t;
+
+typedef struct rx_dma_buf {
+   dma_buf_t           dmaDesc;       /* Dma descriptor */
+   mblk_t              *mblk;         /* Streams message block */
+   frtn_t              freeCB;        /* Free callback */
+   struct vxn_softc    *softc;        /* Back pointer to softc */
+   struct rx_dma_buf   *next;         /* Next one in list */
+} rx_dma_buf_t;
+
+typedef struct vxn_stats {
+   uint32_t    errxmt;               /* Transmit errors */
+   uint32_t    errrcv;               /* Receive errors */
+   uint32_t    runt;                 /* Runt packets */
+   uint32_t    norcvbuf;             /* Buffer alloc errors */
+   uint32_t    interrupts;	     /* Interrupts */
+   uint32_t    defer;		     /* Deferred transmits */
+} vxn_stats_t;
+
+typedef struct tx_ring_buf {
+   mblk_t      *mblk;
+   dma_buf_t   dmaMem;
+} tx_ring_buf_t;
+
+typedef struct vxn_softc {
+   char                    drvName[SOLVMXNET_MAXNAME]; /* Driver name string */
+   int                     unit;               /* Driver instance */
+   vxn_stats_t             stats;              /* Stats */
+
+   dev_info_t              *dip;               /* Info pointer */
+   ddi_iblock_cookie_t     iblockCookie;       /* Interrupt block cookie */
+   gld_mac_info_t          *macInfo;           /* GLD mac info */
+   ddi_acc_handle_t        confHdl;            /* Configuration space handle */
+   ddi_acc_handle_t        vxnIOHdl;           /* I/O space handle */
+   caddr_t                 vxnIOp;             /* I/O space pointer */
+   boolean_t               morphed;            /* Adapter morphed ? */
+
+   kmutex_t                intrlock;           /* Interrupt lock */
+   kmutex_t                xmitlock;           /* Transmit lock */
+   kmutex_t                rxlistlock;         /* Rx free pool lock */
+
+   boolean_t               nicActive;          /* NIC active flag */
+   boolean_t               inIntr;             /* Interrupt processing flag */
+
+   struct ether_addr       devAddr;            /* MAC address */
+
+   uint32_t                vxnNumRxBufs;       /* Number of reveice buffers */
+   uint32_t                vxnNumTxBufs;       /* Number of transmit buffers */
+
+   dma_buf_t               driverDataDmaMem;   /* Driver Data (dma handle) */
+   Vmxnet2_DriverData      *driverData;        /* Driver Data */
+   void                    *driverDataPhy;     /* Driver Data busaddr pointer */
+   Vmxnet2_RxRingEntry     *rxRing;            /* Receive ring */
+   Vmxnet2_TxRingEntry     *txRing;            /* Transmit ring */
+   ddi_dma_handle_t        txDmaHdl;           /* Tx buffers dma handle */
+   rx_dma_buf_t            *rxRingBuffPtr[MAX_NUM_RECV_BUFFERS];
+                                               /* DMA buffers associated with rxRing */
+   tx_ring_buf_t           txRingBuf[MAX_NUM_XMIT_BUFFERS]; /* tx Ring buffers */
+
+   rx_dma_buf_t            *rxFreeBufList;
+   uint32_t                rxNumFreeBufs;      /* current # of buffers in pool */
+   uint32_t                rxMaxFreeBufs;      /* max # of buffers in pool */
+
+   uint32_t                txPending;          /* Pending transmits */
+   uint32_t                maxTxFrags;         /* Max Tx fragments */
+
+   int                     multiCount;         /* Multicast address count */
+   struct ether_addr       multicastList[GLD_MAX_MULTICAST]; /* Multicast list */
+
+   struct vxn_softc        *next;              /* Circular list of instances */
+   struct vxn_softc        *prev;
+} vxn_softc_t;
+
+/* used for rx buffers or buffers allocated by ddi_dma_mem_alloc() */
+static ddi_dma_attr_t vxn_dma_attrs = {
+        DMA_ATTR_V0,            /* dma_attr version */
+        0,                      /* dma_attr_addr_lo */
+        (uint64_t)0xFFFFFFFF,   /* dma_attr_addr_hi */
+        0x7FFFFFFF,             /* dma_attr_count_max */
+        4,                      /* dma_attr_align */
+        0x3F,                   /* dma_attr_burstsizes */
+        1,                      /* dma_attr_minxfer */
+        (uint64_t)0xFFFFFFFF,   /* dma_attr_maxxfer */
+        (uint64_t)0xFFFFFFFF,   /* dma_attr_seg */
+        1,                      /* dma_attr_sgllen */
+        1,                      /* dma_attr_granular */
+        0,                      /* dma_attr_flags */
+};
+
+/* used for tx buffers */
+static ddi_dma_attr_t vxn_dma_attrs_tx = {
+        DMA_ATTR_V0,            /* dma_attr version */
+        0,                      /* dma_attr_addr_lo */
+        (uint64_t)0xFFFFFFFF,   /* dma_attr_addr_hi */
+        0x7FFFFFFF,             /* dma_attr_count_max */
+        1,                      /* dma_attr_align */
+        0x3F,                   /* dma_attr_burstsizes */
+        1,                      /* dma_attr_minxfer */
+        (uint64_t)0xFFFFFFFF,   /* dma_attr_maxxfer */
+        (uint64_t)0xFFFFFFFF,   /* dma_attr_seg */
+        1,                      /* dma_attr_sgllen */
+        1,                      /* dma_attr_granular */
+        0,                      /* dma_attr_flags */
+};
+
+
+static   struct ether_addr etherbroadcastaddr = {
+   {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}
+};
+
+static struct ddi_device_acc_attr vxn_buf_attrs = {
+        DDI_DEVICE_ATTR_V0,
+        DDI_STRUCTURE_LE_ACC,
+        DDI_STRICTORDER_ACC
+};
+
+static struct ddi_device_acc_attr dev_attr = {
+        DDI_DEVICE_ATTR_V0,
+        DDI_STRUCTURE_LE_ACC,
+        DDI_STRICTORDER_ACC
+};
+
+static vxn_softc_t vxnList;		/* for debugging */
+static kmutex_t vxnListLock;
+
+static void *Vxn_Memset(void *s, int c, size_t n);
+static int Vxn_Reset(gld_mac_info_t *macInfo);
+static int Vxn_SetPromiscuous(gld_mac_info_t *macInfo, int flag);
+static int Vxn_GetStats(gld_mac_info_t *macInfo, struct gld_stats *gs);
+static void Vxn_ApplyAddressFilter(vxn_softc_t *dp);
+static int Vxn_SetMulticast(gld_mac_info_t *macinfo, uint8_t *ep, int flag);
+static int Vxn_SetMacAddress(gld_mac_info_t *macInfo, uint8_t *mac);
+static int Vxn_Start(gld_mac_info_t *macInfo);
+static int Vxn_Stop(gld_mac_info_t *macInfo);
+static void Vxn_FreeTxBuf(vxn_softc_t *dp, int idx);
+static int Vxn_EncapTxBuf(vxn_softc_t *dp, mblk_t *mp, Vmxnet2_TxRingEntry *xre,
+                          tx_ring_buf_t *txBuf);
+static int Vxn_Send(gld_mac_info_t *macinfo, mblk_t *mp);
+static boolean_t Vxn_TxComplete(vxn_softc_t *dp, boolean_t *reschedp);
+static boolean_t Vxn_Receive(vxn_softc_t *dp);
+static u_int Vxn_Interrupt(gld_mac_info_t *macInfo);
+static void Vxn_ReclaimRxBuf(rx_dma_buf_t *rxDesc);
+static void Vxn_FreeRxBuf(rx_dma_buf_t *rxDesc);
+static rx_dma_buf_t *Vxn_AllocRxBuf(vxn_softc_t *dp, int cansleep);
+static void Vxn_FreeInitBuffers(vxn_softc_t *dp);
+static int Vxn_AllocInitBuffers(vxn_softc_t *dp);
+static void Vxn_FreeDmaMem(dma_buf_t *dma);
+static int Vxn_AllocDmaMem(vxn_softc_t *dp, int size, int cansleep, dma_buf_t *dma);
+static void Vxn_FreeDriverData(vxn_softc_t *dp);
+static int Vxn_AllocDriverData(vxn_softc_t *dp);
+static int Vxn_Attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
+static int Vxn_Detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
+static int Vxn_AllocRxBufPool(vxn_softc_t *dp);
+static void Vxn_FreeRxBufPool(vxn_softc_t *dp);
+static rx_dma_buf_t * Vxn_AllocRxBufFromPool(vxn_softc_t *dp);
+static void Vxn_FreeRxBufToPool(rx_dma_buf_t *rxDesc);
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Memset --
+ *    memset() (Because bzero does not get resolved by module loader) 
+ *
+ * Results:
+ *    pointer to the memory area s
+ *
+ * Side effects:
+ *    None  
+ *-----------------------------------------------------------------------------
+ */
+static void *
+Vxn_Memset(void *s, int c, size_t n)
+{
+   while (n--) {
+      ((uint8_t *)s)[n] = c;
+   }
+
+   return s;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Reset -- 
+ *    Stub routine to reset hardware. Presently does nothing. Start/Stop should
+ *    take care of resets.
+ *
+ * Results:
+ *    None
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_Reset(gld_mac_info_t *macInfo)
+{
+   return GLD_SUCCESS;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_SetPromiscuous --
+ *    Set/Reset NIC to/from promiscuous mode
+ *
+ * Results:
+ *    GLD_SUCCESS
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_SetPromiscuous(gld_mac_info_t *macInfo, int flag)
+{
+   vxn_softc_t *dp = (vxn_softc_t *)macInfo->gldm_private;
+   Vmxnet2_DriverData *dd = dp->driverData;
+
+   mutex_enter(&dp->intrlock);
+   if (flag == GLD_MAC_PROMISC_PHYS) {
+      dd->ifflags |= VMXNET_IFF_PROMISC;
+   } else if (flag == GLD_MAC_PROMISC_MULTI) {
+     /*
+      * This should really set VMXNET_IFF_ALLMULTI,
+      * but unfortunately it doesn't exist.  The next
+      * best thing would be to set the LADRFs to all
+      * 0xFFs and set VMXNET_IFF_MULTICAST, but that
+      * opens up a whole new set of potential pitfalls,
+      * so this is a reasonable temporary solution.
+      */
+      dd->ifflags |= VMXNET_IFF_PROMISC;
+   } else if (flag == GLD_MAC_PROMISC_NONE) {
+      dd->ifflags &= ~VMXNET_IFF_PROMISC;
+   } else {
+     /* This could be GLD_MAC_PROMISC_NOOP? */
+     mutex_exit(&dp->intrlock);
+     cmn_err(CE_WARN, "%s%d: Vxn_SetPromiscuous: Unexpected mode flag: 0x%x", 
+             dp->drvName, dp->unit, flag);
+
+     return GLD_FAILURE;
+   }
+
+   OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_UPDATE_IFF);
+   mutex_exit(&dp->intrlock);
+
+   return GLD_SUCCESS;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_GetStats --
+ *    Get driver specific stats
+ *
+ * Results:
+ *    GLD_SUCCESS
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_GetStats(gld_mac_info_t *macInfo, struct gld_stats *gs)
+{
+   vxn_softc_t *dp = (vxn_softc_t *)macInfo->gldm_private;
+
+   gs->glds_errxmt    = dp->stats.errxmt;
+   gs->glds_errrcv    = dp->stats.errrcv;
+   gs->glds_short     = dp->stats.runt;
+   gs->glds_norcvbuf  = dp->stats.norcvbuf;
+   gs->glds_intr      = dp->stats.interrupts;
+   gs->glds_defer     = dp->stats.defer;
+
+   return GLD_SUCCESS;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_ApplyAddressFilter --
+ *    Go over multicast list and compute/apply address filter
+ *
+ * Results:
+ *    None
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_ApplyAddressFilter(vxn_softc_t *dp)
+{
+   uint8_t *ep;
+   int i, j, bit, byte;
+   uint32_t crc, poly = CRC_POLYNOMIAL_LE;
+   Vmxnet2_DriverData *dd = dp->driverData;
+   volatile uint16_t *mcastTable = (uint16_t *)dd->LADRF;
+
+   ASSERT(MUTEX_HELD(&dp->intrlock));
+
+   /* clear the multicast filter */
+   dd->LADRF[0] = 0;
+   dd->LADRF[1] = 0;
+
+   for (i = 0; i < dp->multiCount; i++) {
+      crc = 0xffffffff;
+      ep = (uint8_t *)&dp->multicastList[i].ether_addr_octet;
+
+      for (byte = 0; byte < 6; byte++) {
+         for (bit = *ep++, j = 0; j < 8; j++, bit >>= 1) {
+            int test;
+
+            test = ((bit ^ crc) & 0x01);
+            crc >>= 1;
+
+            if (test) {
+               crc = crc ^ poly;
+            }
+         }
+      }
+
+      crc = crc >> 26;
+      mcastTable[crc >> 4] |= 1 << (crc & 0xf);
+   }
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_SetMulticast --
+ *    Add delete entry from multicast list
+ *
+ * Results:
+ *    GLD_FAILURE on failure
+ *    GLD_SUCCESS on success
+ *
+ * Side effects:
+ *    None  
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_SetMulticast(gld_mac_info_t *macinfo, uint8_t *ep, int flag)
+{
+   int i;
+   int copyLen;
+   vxn_softc_t *dp = (vxn_softc_t *)macinfo->gldm_private;
+   Vmxnet2_DriverData *dd = dp->driverData;
+
+   if (flag == GLD_MULTI_ENABLE) {
+      /*
+       * Exceeded multicast address limit
+       */
+      if (dp->multiCount >= GLD_MAX_MULTICAST) {
+         return GLD_FAILURE;
+      }
+
+      /* 
+       * Add mac address to multicast list
+       */
+      bcopy(ep, dp->multicastList[dp->multiCount].ether_addr_octet, 
+                ETHERADDRL);
+      dp->multiCount++;
+   }
+   else {
+      for (i=0; i<dp->multiCount; i++) {
+         if (bcmp(ep, dp->multicastList[i].ether_addr_octet, ETHERADDRL) == 0) {
+            goto found;
+         }
+      }
+      return GLD_FAILURE;
+
+   found:
+      /*
+       * Delete mac address from multicast list
+       */
+      copyLen = (dp->multiCount - (i+1)) * sizeof(struct ether_addr);
+      if (copyLen > 0) {
+        bcopy(&dp->multicastList[i+1], &dp->multicastList[i], copyLen);
+      }
+      dp->multiCount--;
+   }
+
+   /*
+    * Compute address filter from list of addressed and apply it
+    */
+   mutex_enter(&dp->intrlock);
+   Vxn_ApplyAddressFilter(dp);
+
+   if (dp->multiCount) {
+     ASSERT(dd->LADRF[0] || dd->LADRF[1]);
+     dd->ifflags |= VMXNET_IFF_MULTICAST;
+   } else {
+     ASSERT(!(dd->LADRF[0] || dd->LADRF[1]));
+     dd->ifflags &= ~VMXNET_IFF_MULTICAST;
+   }
+
+   OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_UPDATE_IFF);
+   OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_UPDATE_LADRF);
+   mutex_exit(&dp->intrlock);   
+
+   return GLD_SUCCESS;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_SetMacAddress --
+ *    Change device MAC address  
+ *
+ * Results:
+ *    GLD_SUCCESS
+ *    GLD_FAILURE
+ *
+ * Side effects:
+ *    None 
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_SetMacAddress(gld_mac_info_t *macInfo, uint8_t *mac)
+{
+   int i;
+   int err = GLD_SUCCESS;
+   vxn_softc_t * dp = (vxn_softc_t *)macInfo->gldm_private;
+
+   mutex_enter(&dp->intrlock);
+   mutex_enter(&dp->xmitlock);
+
+   /*
+    * Don't change MAC address on a running NIC
+    */
+   if (dp->nicActive) {
+      err = GLD_FAILURE;
+      goto out;
+   }
+
+   /*
+    * Save new MAC address 
+    */
+   for (i = 0; i < 6; i++) {
+      dp->devAddr.ether_addr_octet[i] = mac[i];
+   }
+   
+   /*
+    * Push new MAC address down into hardware
+    */
+   for (i = 0; i < 6; i++) {
+      OUTB(dp, VMXNET_MAC_ADDR + i, mac[i]);
+   }
+
+out:
+   mutex_exit(&dp->xmitlock);
+   mutex_exit(&dp->intrlock);
+   return err;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Start --
+ *    Device start routine. Called on "ifconfig plumb"
+ *
+ * Results:
+ *    GLD_SUCCESS
+ *    GLD_FAILURE
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_Start(gld_mac_info_t *macInfo)
+{
+   int err = GLD_SUCCESS;
+   uint32_t r, capabilities, features;
+   vxn_softc_t * dp = (vxn_softc_t *)macInfo->gldm_private;
+
+   mutex_enter(&dp->intrlock);
+   mutex_enter(&dp->xmitlock);
+
+   if (!dp->nicActive) {
+      /*
+       * Register ring structure with hardware
+       *
+       * This downcast is OK because we requested a 32-bit physical address
+       */
+      OUTL(dp, VMXNET_INIT_ADDR, (uint32_t)(uintptr_t)dp->driverDataPhy);
+      OUTL(dp, VMXNET_INIT_LENGTH, dp->driverData->length);
+
+      /* 
+       * Make sure registeration succeded 
+       */
+      r = INL(dp, VMXNET_INIT_LENGTH);
+      if (!r) {
+         cmn_err(CE_WARN, "%s%d: Vxn_Start: failed to register ring", 
+                          dp->drvName, dp->unit);
+         err = GLD_FAILURE;
+         goto out;
+      }
+
+      /*
+       * Get maximum tx fragments supported
+       */
+      OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_GET_CAPABILITIES);
+      capabilities = INL(dp, VMXNET_COMMAND_ADDR);
+
+      OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_GET_FEATURES);
+      features = INL(dp, VMXNET_COMMAND_ADDR);
+
+      DPRINTF(3, (CE_CONT, "%s%d: chip capabilities=0x%x features=0x%x\n", 
+              dp->drvName, dp->unit, capabilities, features));
+
+      if ((capabilities & VMNET_CAP_SG) &&
+          (features & VMXNET_FEATURE_ZERO_COPY_TX)) {
+         dp->maxTxFrags = VMXNET2_SG_DEFAULT_LENGTH;
+      } else {
+         dp->maxTxFrags = 1;
+      }
+      ASSERT(dp->maxTxFrags >= 1);
+
+      /*
+       * Alloc Tx DMA handle
+       */
+      vxn_dma_attrs_tx.dma_attr_sgllen = dp->maxTxFrags;
+      if (ddi_dma_alloc_handle(dp->dip, &vxn_dma_attrs_tx, DDI_DMA_SLEEP,
+                               NULL, &dp->txDmaHdl) != DDI_SUCCESS)  {
+         cmn_err(CE_WARN, "%s%d: Vxn_Start: failed to alloc tx dma handle", 
+                 dp->drvName, dp->unit);
+         err = GLD_FAILURE;
+         goto out;
+      }
+
+      /*
+       * Enable interrupts on the card
+       */
+      dp->driverData->ifflags |= VMXNET_IFF_BROADCAST | VMXNET_IFF_DIRECTED;
+
+      OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_INTR_ENABLE);
+      OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_UPDATE_IFF);
+      OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_UPDATE_LADRF);
+
+      dp->nicActive = TRUE;
+  }
+
+out:
+   mutex_exit(&dp->xmitlock);
+   mutex_exit(&dp->intrlock);
+   return err;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Stop --
+ *    Device stop routine. Called on "ifconfig unplumb"
+ *
+ * Results:
+ *    GLD_SUCCESS
+ *    GLD_FAILURE
+ *
+ * Side effects:
+ *    None   
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_Stop(gld_mac_info_t *macInfo)
+{
+   int i;
+   int err = GLD_SUCCESS;
+   vxn_softc_t * dp = (vxn_softc_t *)macInfo->gldm_private;
+   boolean_t resched;
+
+   mutex_enter(&dp->intrlock);
+   mutex_enter(&dp->xmitlock);
+
+   if (!dp->nicActive) {
+      goto out;
+   }
+
+   /*
+    * Disable interrupts
+    */
+   OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_INTR_DISABLE);
+
+   /*
+    * Wait for pending transmits
+    */
+   if (dp->txPending) {
+      for (i=0; i < MAX_TX_WAIT_ON_STOP && dp->txPending; i++) {
+         delay(drv_usectohz(1000));
+         OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_CHECK_TX_DONE);
+         (void) Vxn_TxComplete(dp, &resched);
+         /*
+          * Don't worry about rescheduling transmits - GLD handles
+          * this automatically.
+          */
+      }
+   }
+   if (dp->txPending) {
+      cmn_err(CE_WARN, "%s%d: Vxn_Stop: giving up on %d pending transmits", 
+                       dp->drvName, dp->unit, dp->txPending);      
+   }
+
+   OUTL(dp, VMXNET_INIT_ADDR, 0);
+   dp->nicActive = FALSE;
+
+   /*
+    * Free Tx DMA handle
+    *
+    * The ddi_dma_free_handle() man page says that ddi_dma_unbind_handle() must be called
+    * prior to calling ddi_dma_free_handle().
+    * However, call to ddi_dma_unbind_handle() is not required here, because
+    * ddi_dma_addr_bind_handle() and matching ddi_dma_unbind_handle() are called from
+    * Vxn_EncapTxBuf().
+    * xmitlock is held in Vxn_EncapTxBuf() as well as acquired above in Vxn_Stop().
+    */
+   ddi_dma_free_handle(&dp->txDmaHdl);
+   dp->txDmaHdl = NULL;
+
+out:
+   mutex_exit(&dp->xmitlock);
+   mutex_exit(&dp->intrlock);
+   return err;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_FreeTxBuf --
+ *    Free transmit buffer
+ *
+ * Results:
+ *    None
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_FreeTxBuf(vxn_softc_t *dp, int idx)
+{
+   mblk_t **txMblkp = &TX_RINGBUF_MBLK(dp, idx);
+   dma_buf_t *dmaMem = &TX_RINGBUF_DMAMEM(dp, idx);
+
+   if (*txMblkp) {
+      freemsg(*txMblkp);
+      *txMblkp = NULL;
+   }
+
+   if (dmaMem->buf) {
+      Vxn_FreeDmaMem(dmaMem);
+      ASSERT(dmaMem->buf == NULL);
+   }
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_EncapTxBuf -- 
+ *    Go over dma mappings of Tx buffers and drop buffer physical address 
+ *    into ring entry
+ *
+ * Results:
+ *    SOLVMXNET_SUCCESS on success
+ *    SOLVMXNET_FAILURE on failure
+ *
+ * Side effects:
+ *    None  
+ *---------------- -------------------------------------------------------------
+ */
+static int
+Vxn_EncapTxBuf(vxn_softc_t *dp, 
+               mblk_t *mp, 
+               Vmxnet2_TxRingEntry *xre, 
+               tx_ring_buf_t *txBuf)
+{
+   int frag;
+   int fragcount;
+   int rval;
+   mblk_t *tp;
+   mblk_t *mblk;
+   boolean_t needPullup = FALSE;
+   boolean_t dmaMemAlloced = FALSE;
+
+   ASSERT(txBuf);
+   ASSERT(txBuf->mblk == NULL);
+   ASSERT(MUTEX_HELD(&dp->xmitlock));
+
+   xre->sg.length = 0;
+   xre->flags = 0;
+
+   fragcount = 0;
+   for (tp = mp; tp != NULL; tp = tp->b_cont) {
+      fragcount++;
+   }
+   if (fragcount > dp->maxTxFrags) {
+      needPullup = TRUE;
+   }
+
+pullup:
+   frag = 0;
+   if (needPullup) {
+      if (!(mblk = msgpullup(mp, -1))) {
+         cmn_err(CE_WARN, "%s%d: Vxn_EncapTxBuf: msgpullup failed",
+                          dp->drvName, dp->unit);
+         goto err;
+      }
+   } else {
+      mblk = mp;
+   }
+
+   /*
+    * Go through message chain and drop packet pointers into ring
+    * scatter/gather array
+    */
+   for (tp = mblk; tp != NULL; tp = tp->b_cont) {
+
+      uint_t nCookies;
+      ddi_dma_cookie_t dmaCookie;
+      int len = tp->b_wptr - tp->b_rptr;
+
+      if (len) {
+         /*
+          * Associate tx buffer with dma handle
+          */
+         ASSERT(dp->txDmaHdl);
+         if ((rval = ddi_dma_addr_bind_handle(dp->txDmaHdl, NULL, (caddr_t)tp->b_rptr,
+                                      len, DDI_DMA_RDWR | DDI_DMA_STREAMING,
+                                      DDI_DMA_DONTWAIT, NULL,
+                                      &dmaCookie, &nCookies))
+             != DDI_DMA_MAPPED) {
+
+            /*
+             *  Try to handle bind failure caused by a page boundary spill
+             *  by allocating a private dma buffer and copying data into it
+             */
+            if ((rval == DDI_DMA_TOOBIG) && !dmaMemAlloced ) {
+               /*
+                * Force pullup 
+                */
+               if (!needPullup && (dp->maxTxFrags > 1)) {
+                  needPullup = TRUE;
+                  goto pullup;
+               }
+
+               if (Vxn_AllocDmaMem(dp, len, FALSE, &txBuf->dmaMem) 
+                                             != SOLVMXNET_SUCCESS) {
+                  goto err;
+               }
+
+               dmaMemAlloced = TRUE;
+
+               /*
+                * Copy data into DMA capable buffer
+                */
+               bcopy(tp->b_rptr, txBuf->dmaMem.buf, len);
+
+               /*
+                * Stick buffer physical addr in the ring
+                */
+               xre->sg.sg[frag].addrLow = txBuf->dmaMem.phyBuf;
+               xre->sg.sg[frag].length = len;
+               frag++;
+
+               continue;
+
+            } else {
+               cmn_err(CE_WARN, "%s%d: Vxn_EncapTxBuf: failed (%d) to bind dma "
+                                "handle for len %d. [dmaMemAlloced=%d]", 
+                                dp->drvName, dp->unit, rval, len, dmaMemAlloced);
+               goto err;
+            }
+         }
+
+         /*
+          * Extract tx buffer physical addresses from cookie
+          */
+         while (nCookies) {
+            if (UNLIKELY(frag == dp->maxTxFrags)) {
+               (void)ddi_dma_unbind_handle(dp->txDmaHdl);
+
+               if (!needPullup) {
+                  ASSERT(!dmaMemAlloced);
+                  needPullup = TRUE;
+                  goto pullup;
+               } else {
+                  cmn_err(CE_WARN, "%s%d: Vxn_EncapTxBuf: "
+                          "exceeded max (%d) fragments in message",
+                          dp->drvName, dp->unit, dp->maxTxFrags);
+                  goto err;
+               }
+            }
+
+            /*
+             * Stick it in the ring
+             */
+            xre->sg.sg[frag].addrLow = dmaCookie.dmac_address;
+            xre->sg.sg[frag].length = dmaCookie.dmac_size;
+            frag++;
+
+            if (--nCookies) {
+               ddi_dma_nextcookie(dp->txDmaHdl, &dmaCookie);
+            }
+         }
+
+         (void)ddi_dma_unbind_handle(dp->txDmaHdl);
+      }
+   }
+
+   if (frag > 0) {
+      xre->sg.length = frag;
+
+      /* Give ownership to NIC */
+      xre->sg.addrType = NET_SG_PHYS_ADDR;
+      xre->ownership = VMXNET2_OWNERSHIP_NIC;
+      xre->flags |= VMXNET2_TX_CAN_KEEP;
+      txBuf->mblk = mblk;
+
+      /*
+       * If we called msgpullup to concatenate fragments, free
+       * original mblk now since we're going to return success.
+       */
+      if (mblk != mp) {
+         freemsg(mp);
+      }
+
+      return SOLVMXNET_SUCCESS;
+   }
+
+err:
+   if (mblk != NULL && mblk != mp) {
+      /*
+       * Free mblk allocated by msgpullup.
+       */
+      freemsg(mblk);
+   }
+
+   if (dmaMemAlloced) {
+      ASSERT(txBuf->dmaMem.buf);
+      Vxn_FreeDmaMem(&txBuf->dmaMem);
+   }
+
+   return SOLVMXNET_FAILURE;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Send --
+ *    GLD Transmit routine. Starts packet hard tx.
+ *
+ * Results:
+ *    GLD_SUCCESS on success
+ *    GLD_FAILURE on failure
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_Send(gld_mac_info_t *macinfo, mblk_t *mp)
+{
+   Vmxnet2_TxRingEntry *xre;
+   int err = GLD_SUCCESS;
+   vxn_softc_t *dp = (vxn_softc_t *)macinfo->gldm_private;
+   Vmxnet2_DriverData *dd = dp->driverData;
+   boolean_t resched = FALSE;
+
+   mutex_enter(&dp->xmitlock);
+
+   /*
+    * Check if ring entry at drop pointer is available
+    */
+   if (TX_RINGBUF_MBLK(dp, dd->txDriverNext) != NULL) {
+      DPRINTF(3, (CE_NOTE, "%s%d: Vxn_Send: tx ring full",
+                  dp->drvName, dp->unit));
+      err = GLD_NORESOURCES;
+      dd->txStopped = TRUE;
+      dp->stats.defer++;
+      goto out;
+   }
+
+   xre = &dp->txRing[dd->txDriverNext];
+
+   /*
+    * Drop packet into ring entry
+    */
+   if (Vxn_EncapTxBuf(dp, mp, xre, &dp->txRingBuf[dd->txDriverNext])
+       != SOLVMXNET_SUCCESS) {
+      err = GLD_FAILURE;
+      dp->stats.errxmt++;
+      goto out;
+   }
+
+   /*
+    * Increment drop pointer
+    */
+   VMXNET_INC(dd->txDriverNext, dd->txRingLength);
+   dd->txNumDeferred++;
+   dp->txPending++;
+
+   /*
+    * Transmit, if number of pending packets > tx cluster length
+    */
+   if (dd->txNumDeferred >= dd->txClusterLength) {
+      dd->txNumDeferred = 0;
+
+      /* 
+       * Call hardware transmit 
+       */
+      INL(dp, VMXNET_TX_ADDR);
+   }
+
+   /*
+    * Clean up transmit ring. TX completion interrupts are not guaranteed
+    */
+   (void) Vxn_TxComplete(dp, &resched);
+
+out:
+   mutex_exit(&dp->xmitlock);
+   if (resched) {
+      /* Tell GLD to retry any deferred packets */
+      gld_sched(dp->macInfo);
+   }
+   return err;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_TxComplete --
+ *    Scan Tx ring for completed transmits. Reclaim Tx buffers.
+ *
+ * Results:
+ *    Returns TRUE if it found a completed transmit, FALSE otherwise.
+ *    Also sets *reschedp to TRUE if the caller should call gld_sched
+ *    to reschedule transmits (once all locks are dropped).
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static boolean_t
+Vxn_TxComplete(vxn_softc_t *dp, boolean_t *reschedp)
+{
+   Vmxnet2_DriverData *dd = dp->driverData;
+   boolean_t found = FALSE;
+   boolean_t needresched = FALSE;
+
+   ASSERT(MUTEX_HELD(&dp->xmitlock));
+
+   while (1) {
+      Vmxnet2_TxRingEntry *xre = &dp->txRing[dd->txDriverCur];
+
+      if (xre->ownership != VMXNET2_OWNERSHIP_DRIVER || 
+          (TX_RINGBUF_MBLK(dp, dd->txDriverCur) == NULL)) {
+         break;
+      }
+
+      found = TRUE;
+      Vxn_FreeTxBuf(dp, dd->txDriverCur);
+
+      dp->txPending--;
+      VMXNET_INC(dd->txDriverCur, dd->txRingLength);
+      if (dd->txStopped) {
+         needresched = TRUE;
+         dd->txStopped = FALSE;
+      }
+   }
+
+   *reschedp = needresched;
+   return found;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Receive --
+ *    Rx handler. First assembles the packets into a chain of mblks,
+ *    then drops locks and passes them up the stack to GLD.
+ *
+ * Results:
+ *    Returns TRUE if it find a packet ready for processing, FALSE
+ *    otherwise.
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static boolean_t
+Vxn_Receive(vxn_softc_t *dp)
+{
+   int ringnext;
+   short pktlen;
+   Vmxnet2_DriverData *dd = dp->driverData;   
+   rx_dma_buf_t *rxDesc;
+   rx_dma_buf_t *newRxDesc;
+   mblk_t *mblk;
+   mblk_t *head = NULL;
+   mblk_t **tail = &head;
+   mblk_t *next;
+   boolean_t found = FALSE;	/* Did we find at least one packet? */
+
+   ASSERT(MUTEX_HELD(&dp->intrlock));
+
+   /*
+    * Walk receive ring looking for entries with ownership 
+    * reverted back to driver
+    */
+   while (1) {
+      Vmxnet2_RxRingEntry *rre;
+      rx_dma_buf_t **rbuf;
+
+      ringnext = dd->rxDriverNext;
+      rre = &dp->rxRing[ringnext];
+      rbuf = &dp->rxRingBuffPtr[ringnext];
+      
+      if (rre->ownership != VMXNET2_OWNERSHIP_DRIVER) {
+         break;
+      }
+
+      found = TRUE;
+
+      pktlen = rre->actualLength;
+
+      if (pktlen < (60 - 4)) {
+         /*
+          * Ethernet header vlan tags are 4 bytes.  Some vendors generate
+          *  60byte frames including vlan tags.  When vlan tag
+          *  is stripped, such frames become 60 - 4. (PR106153)
+          */
+         dp->stats.errrcv++;
+         if (pktlen != 0) {
+            DPRINTF(3, (CE_CONT, "%s%d: runt packet\n", dp->drvName, dp->unit));
+            dp->stats.runt++;
+         }
+      } else {
+         /*
+          * Alloc new Rx buffer to replace current one
+          */
+         newRxDesc = Vxn_AllocRxBufFromPool(dp);
+
+         if (newRxDesc) {
+            rxDesc = *rbuf;
+            mblk = rxDesc->mblk;
+            
+            *rbuf = newRxDesc;
+            rre->paddr = newRxDesc->dmaDesc.phyBuf + ETHERALIGN;
+            rre->bufferLength = MAXPKTBUF - ETHERALIGN;
+            rre->actualLength = 0;
+
+            /*
+             * Advance write pointer past packet length
+             */
+            mblk->b_wptr = mblk->b_rptr + pktlen;
+            
+            /*
+             * Add to end of chain.
+             */
+            mblk->b_next = NULL;
+            *tail = mblk;
+            tail = &mblk->b_next;
+         } else {
+            dp->stats.errrcv++;
+            dp->stats.norcvbuf++;
+         }
+      }
+
+      /* Give the descriptor back to NIC */
+      rre->ownership = VMXNET2_OWNERSHIP_NIC;
+      VMXNET_INC(dd->rxDriverNext, dd->rxRingLength);
+   }
+
+   /*
+    * Walk chain and pass mblks up to gld_recv one by one.
+    */
+   mutex_exit(&dp->intrlock);
+   for (mblk = head; mblk != NULL; mblk = next) {
+      next = mblk->b_next;
+      mblk->b_next = NULL;
+      gld_recv(dp->macInfo, mblk);
+   }
+   mutex_enter(&dp->intrlock);
+
+   return (found);
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Interrupt --
+ *    GLD interrupt handler. Scan: Rx ring for received packets, Tx ring for
+ *    completed transmits
+ *
+ * Results:
+ *    - DDI_INTR_CLAIMED (if we found something to do)
+ *    - DDI_INTR_UNCLAIMED (if not)
+ *
+ * Side effects:
+ *    None     
+ *-----------------------------------------------------------------------------
+ */
+static u_int
+Vxn_Interrupt(gld_mac_info_t *macInfo)
+{
+   u_int ret = DDI_INTR_UNCLAIMED;
+   vxn_softc_t *dp = (vxn_softc_t *)macInfo->gldm_private;
+   boolean_t foundRx, foundTx;
+   boolean_t resched = FALSE;
+
+   mutex_enter(&dp->intrlock);
+   dp->inIntr = TRUE;
+
+   if (!dp->nicActive) {
+      goto out;
+   }
+
+   /*
+    * Ack interrupt
+    */
+   OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_INTR_ACK);
+
+   foundRx = Vxn_Receive(dp);
+
+   mutex_enter(&dp->xmitlock);
+   foundTx = Vxn_TxComplete(dp, &resched);
+   mutex_exit(&dp->xmitlock);
+
+   if (foundRx || foundTx) {
+      ret = DDI_INTR_CLAIMED;
+      dp->stats.interrupts++;
+   }
+
+out:
+   dp->inIntr = FALSE;
+   mutex_exit(&dp->intrlock);
+
+   if (resched) {
+      gld_sched(dp->macInfo);
+   }
+
+   return ret; 
+}
+
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_ReclaimRxBuf --
+ *    Callback handler invoked by freemsg(). Frees Rx buffer memory and mappings
+ *
+ * Results:
+ *    None
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_ReclaimRxBuf(rx_dma_buf_t *rxDesc)
+{
+   Vxn_FreeRxBufToPool(rxDesc);
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_FreeRxBuf --
+ *    Free allocated Rx buffer
+ *
+ * Results:
+ *    None
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_FreeRxBuf(rx_dma_buf_t *rxDesc)
+{
+   ASSERT(rxDesc);
+
+   if (rxDesc->mblk) {
+      freemsg(rxDesc->mblk);
+   } else {
+      Vxn_FreeDmaMem(&rxDesc->dmaDesc);
+      kmem_free(rxDesc, sizeof(rx_dma_buf_t));
+   }
+}
+
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_AllocRxBuf --
+ *    Allocate Rx buffer
+ *
+ * Results:
+ *    Pointer to Rx buffer descriptor - on success
+ *    NULL - on failure
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static rx_dma_buf_t *
+Vxn_AllocRxBuf(vxn_softc_t *dp, int cansleep)
+{
+   rx_dma_buf_t *rxDesc;
+
+   rxDesc = (rx_dma_buf_t *)kmem_zalloc(sizeof(rx_dma_buf_t), 
+                                  cansleep ? KM_SLEEP : KM_NOSLEEP);
+   if (!rxDesc) {
+      cmn_err(CE_WARN, "%s%d: Vxn_AllocRxBuf: kmem_zalloc failed", 
+                       dp->drvName, dp->unit);
+      return NULL;
+   }
+
+   rxDesc->softc = dp;
+
+   /*
+    * Alloc dma-able packet memory
+    */
+   if (Vxn_AllocDmaMem(dp, MAXPKTBUF, cansleep, &rxDesc->dmaDesc) 
+         != SOLVMXNET_SUCCESS) {
+      kmem_free(rxDesc, sizeof(rx_dma_buf_t));
+      return NULL;
+   }
+
+   /*
+    * Fill in free callback; fired by freemsg()
+    */
+   rxDesc->freeCB.free_func = &Vxn_ReclaimRxBuf;
+   rxDesc->freeCB.free_arg = (caddr_t) rxDesc;
+
+   rxDesc->mblk = NULL;
+   return rxDesc;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_FreeInitBuffers --
+ *    Free allocated Tx and Rx buffers 
+ *
+ * Results:
+ *    None
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_FreeInitBuffers(vxn_softc_t *dp)
+{
+   int i;
+
+   for (i=0; i<dp->vxnNumRxBufs; i++) {
+      if (dp->rxRingBuffPtr[i]) {
+         Vxn_FreeRxBuf(dp->rxRingBuffPtr[i]);
+         dp->rxRingBuffPtr[i] = NULL;
+      }
+   }
+
+   for (i=0; i<dp->vxnNumTxBufs; i++) {
+      if (TX_RINGBUF_MBLK(dp, i)) {
+         Vxn_FreeTxBuf(dp, i);
+      }
+   }
+
+   /*
+    * Rx pool must get freed last. Rx buffers above will
+    * show up on the pool when freemsg callback fires.
+    */
+   Vxn_FreeRxBufPool(dp);
+}
+
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_AllocRxBufPool --
+ *    Allocate pool of rx buffers - 3 * configured Rx buffers
+ *
+ * Results:
+ *    SOLVMXNET_SUCCESS/SOLVMXNET_FAILURE
+ *    
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_AllocRxBufPool(vxn_softc_t *dp)
+{
+   int i;
+
+   dp->rxFreeBufList = NULL;
+
+   // Allow list to double in size if needed.  Any additional buffers
+   // that are allocated on the fly will be freed back to main memory.
+   dp->rxMaxFreeBufs = dp->vxnNumRxBufs * 6;
+
+   for (i = 0; i < dp->vxnNumRxBufs * 3; i++) {
+      rx_dma_buf_t *rxDesc;
+
+      /*
+       * Alloc rx buffer
+       */
+      if (!(rxDesc = Vxn_AllocRxBuf(dp, TRUE))) {
+         cmn_err(CE_WARN, "%s%d: Vxn_AllocRxBufPool: failed to allocate memory",
+                 dp->drvName, dp->unit);
+         dp->rxNumFreeBufs = i;
+         return SOLVMXNET_FAILURE;
+      }
+      /*
+       * Add to free list
+       */
+      rxDesc->next = dp->rxFreeBufList;
+      dp->rxFreeBufList = rxDesc;
+   }
+
+   dp->rxNumFreeBufs = i;
+   return SOLVMXNET_SUCCESS;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_FreeRxBufPool --
+ *    Free rx buffers pool
+ *
+ * Results:
+ *    None    
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_FreeRxBufPool(vxn_softc_t *dp)
+{
+   while (dp->rxFreeBufList) {
+      rx_dma_buf_t *rxDesc = dp->rxFreeBufList;
+
+      /* unlink */
+      dp->rxFreeBufList = rxDesc->next;
+
+      ASSERT(rxDesc->mblk == NULL);
+      Vxn_FreeDmaMem(&rxDesc->dmaDesc);
+      kmem_free(rxDesc, sizeof(rx_dma_buf_t));
+   }
+   dp->rxNumFreeBufs = 0;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_AllocRxBufFromPool --
+ *    Allocate Rx buffer from free pool
+ *
+ * Results:
+ *    Pointer to Rx buffer descriptor - on success
+ *    NULL - on failure
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static rx_dma_buf_t *
+Vxn_AllocRxBufFromPool(vxn_softc_t *dp)
+{
+   rx_dma_buf_t *rxDesc = NULL;
+
+   mutex_enter(&dp->rxlistlock);
+   if (dp->rxFreeBufList) {
+      rxDesc = dp->rxFreeBufList;
+      dp->rxFreeBufList = rxDesc->next;
+      ASSERT(dp->rxNumFreeBufs >= 1);
+      dp->rxNumFreeBufs--;
+   }
+   mutex_exit(&dp->rxlistlock);
+
+   if (!rxDesc) {
+      /*
+       * Try to allocate new descriptor from memory.  Can't block here
+       * since we could be being called from interrupt context.
+       */
+      DPRINTF(5, (CE_NOTE, "%s%d: allocating rx buf from memory",
+                  dp->drvName, dp->unit)); 
+      if (!(rxDesc = Vxn_AllocRxBuf(dp, FALSE))) {
+         cmn_err(CE_WARN,
+                 "%s%d: Vxn_AllocRxBufFromPool : pool rx alloc failed",
+                 dp->drvName, dp->unit);
+         return NULL;
+      }
+   }
+
+   /*
+    * Allocate new message block for this buffer
+    */
+   rxDesc->mblk = desballoc((uchar_t *)rxDesc->dmaDesc.buf + ETHERALIGN,
+                           rxDesc->dmaDesc.bufLen - ETHERALIGN, 
+                           BPRI_MED, &rxDesc->freeCB);
+   if (!rxDesc->mblk) {
+      cmn_err(CE_WARN, "%s%d: Vxn_AllocRxBufFromPool : desballoc failed", 
+                        dp->drvName, dp->unit);
+
+      /* put back on free list */
+      Vxn_FreeRxBufToPool(rxDesc);
+      return NULL;
+   }
+
+   return rxDesc;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_FreeRxBufToPool --
+ *    Return rx buffer to free pool
+ *
+ * Results:
+ *    None   
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_FreeRxBufToPool(rx_dma_buf_t *rxDesc)
+{
+   vxn_softc_t *dp = rxDesc->softc;
+
+   rxDesc->mblk = NULL;
+
+   /*
+    * Insert on free list, or free if the list is full
+    */
+   mutex_enter(&dp->rxlistlock);
+   if (dp->rxNumFreeBufs >= dp->rxMaxFreeBufs) {
+      DPRINTF(5, (CE_NOTE, "%s%d: freeing rx buf to memory", 
+                  dp->drvName, dp->unit));
+      Vxn_FreeRxBuf(rxDesc);
+   } else {
+      rxDesc->next = dp->rxFreeBufList;
+      dp->rxFreeBufList = rxDesc;
+      dp->rxNumFreeBufs++;
+   }
+   mutex_exit(&dp->rxlistlock);
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_AllocInitBuffers --
+ *    Allocated Rx buffers and init ring entries
+ *
+ * Results:
+ *    SOLVMXNET_SUCCESS - on success
+ *    SOLVMXNET_FAILURE - on failure
+ *
+ * Side effects:
+ *    None      
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_AllocInitBuffers(vxn_softc_t *dp)
+{
+   Vmxnet2_DriverData  *dd;
+   uint32_t            i, offset;
+
+   dd = dp->driverData;
+   offset = sizeof(*dd);
+
+   /*
+    * Init shared structures
+    */
+   dd->rxRingLength = dp->vxnNumRxBufs;
+   dd->rxRingOffset = offset;
+   dp->rxRing = (Vmxnet2_RxRingEntry *)((uintptr_t)dd + offset);
+   offset += dp->vxnNumRxBufs * sizeof(Vmxnet2_RxRingEntry);
+
+   dd->rxRingLength2 = 1;
+   dd->rxRingOffset2 = offset;
+   offset += sizeof(Vmxnet2_RxRingEntry);
+
+   dd->txRingLength = dp->vxnNumTxBufs;
+   dd->txRingOffset = offset;
+   dp->txRing = (Vmxnet2_TxRingEntry *)((uintptr_t)dd + offset);
+   offset += dp->vxnNumTxBufs * sizeof(Vmxnet2_TxRingEntry);
+
+   /*
+    * Alloc Rx buffers pool
+    */
+   if ( Vxn_AllocRxBufPool(dp) != SOLVMXNET_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: Vxn_AllocInitBuffers: failed to alloc buf pool", 
+                       dp->drvName, dp->unit);
+      return SOLVMXNET_FAILURE;
+   }
+
+   /*
+    * Allocate receive buffers
+    */
+   for (i = 0; i < dp->vxnNumRxBufs; i++) {
+      rx_dma_buf_t *rxDesc;
+      Vmxnet2_RxRingEntry *rre = &dp->rxRing[i];
+
+      if (!(rxDesc = Vxn_AllocRxBufFromPool(dp))) {
+         cmn_err(CE_WARN, "%s%d: Vxn_AllocInitBuffers: "
+                          "failed to alloc buf from pool", dp->drvName, dp->unit);
+         goto err;
+      }
+
+      /*
+       * Init ring entries
+       */
+      rre->paddr = rxDesc->dmaDesc.phyBuf + ETHERALIGN;
+      rre->bufferLength = MAXPKTBUF - ETHERALIGN;
+      rre->actualLength = 0;
+      dp->rxRingBuffPtr[i] = rxDesc;
+      rre->ownership = VMXNET2_OWNERSHIP_NIC;
+   }
+
+   dp->txDmaHdl = NULL;
+
+   /* 
+    * Dummy recvRing2 tacked on to the end, with a single unusable entry 
+    */
+   dp->rxRing[i].paddr = 0;
+   dp->rxRing[i].bufferLength = 0;
+   dp->rxRing[i].actualLength = 0;
+   dp->rxRingBuffPtr[i] = NULL;
+   dp->rxRing[i].ownership = VMXNET2_OWNERSHIP_DRIVER;
+   
+   dd->rxDriverNext = 0;
+                                                                               
+   /*
+    * Give xmit ring ownership to DRIVER
+    */
+   for (i = 0; i < dp->vxnNumTxBufs; i++) {
+      dp->txRing[i].ownership = VMXNET2_OWNERSHIP_DRIVER;
+      dp->txRingBuf[i].mblk = NULL;
+      dp->txRingBuf[i].dmaMem.buf = NULL;
+      dp->txRing[i].sg.sg[0].addrHi = 0;
+   }
+   
+   dd->txDriverCur = dd->txDriverNext = 0;
+   dd->txStopped = FALSE;
+
+   return SOLVMXNET_SUCCESS;
+
+err:
+   for (i=0; i<dp->vxnNumRxBufs; i++) {
+      if (dp->rxRingBuffPtr[i]) {
+         Vxn_FreeRxBuf(dp->rxRingBuffPtr[i]);
+         dp->rxRingBuffPtr[i] = NULL;
+      }
+   }
+
+   Vxn_FreeRxBufPool(dp);
+   return SOLVMXNET_FAILURE;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_FreeDmaMem --
+ *    Free allocated dma memory
+ *
+ * Results:
+ *    None
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_FreeDmaMem(dma_buf_t *dma)
+{
+   ddi_dma_unbind_handle(dma->dmaHdl);
+   ddi_dma_mem_free(&dma->dataAccHdl);
+   ddi_dma_free_handle(&dma->dmaHdl);
+
+   dma->buf = NULL;
+   dma->phyBuf = NULL;
+   dma->bufLen = 0;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_AllocDmaMem --
+ *    Allocate dma-able memory and fill passed in dma descriptor pointer 
+ *    if successful
+ *
+ * Results:
+ *    SOLVMXNET_SUCCESS on success
+ *    SOLVMXNET_FAILURE on failure
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_AllocDmaMem(vxn_softc_t *dp, int size, int cansleep, dma_buf_t *dma)
+{
+   /* 
+    * Allocate handle
+    */
+   if (ddi_dma_alloc_handle(dp->dip, &vxn_dma_attrs,
+                            cansleep ? DDI_DMA_SLEEP : DDI_DMA_DONTWAIT, 
+                            NULL, &dma->dmaHdl) != DDI_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: Vxn_AllocDmaMem: failed to allocate handle", 
+              dp->drvName, dp->unit);
+      return SOLVMXNET_FAILURE;
+   }
+
+   /* 
+    * Allocate memory 
+    */
+   if (ddi_dma_mem_alloc(dma->dmaHdl, size, &vxn_buf_attrs, DDI_DMA_CONSISTENT,
+                         cansleep ? DDI_DMA_SLEEP : DDI_DMA_DONTWAIT, NULL, 
+                         &dma->buf, &dma->bufLen, &dma->dataAccHdl) 
+       != DDI_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: Vxn_AllocDmaMem: "
+                       "ddi_dma_mem_alloc %d bytes failed", 
+                       dp->drvName, dp->unit, size);
+      ddi_dma_free_handle(&dma->dmaHdl);
+      return SOLVMXNET_FAILURE;
+   }
+
+   /*
+    * Mapin memory
+    */
+   if (ddi_dma_addr_bind_handle(dma->dmaHdl, NULL, dma->buf, dma->bufLen,
+                                DDI_DMA_RDWR | DDI_DMA_STREAMING,
+                                cansleep ? DDI_DMA_SLEEP : DDI_DMA_DONTWAIT, 
+                                NULL, &dma->cookie, &dma->cookieCount) 
+       != DDI_DMA_MAPPED) {
+      cmn_err(CE_WARN, "%s%d: Vxn_AllocDmaMem: failed to bind handle",
+              dp->drvName, dp->unit);
+      ddi_dma_mem_free(&dma->dataAccHdl);
+      ddi_dma_free_handle(&dma->dmaHdl);
+      return SOLVMXNET_FAILURE;
+   }
+
+   if (dma->cookieCount != 1) {
+      cmn_err(CE_WARN, "%s%d: Vxn_AllocDmaMem: too many DMA cookies", 
+                       dp->drvName, dp->unit);
+      Vxn_FreeDmaMem(dma);
+      return SOLVMXNET_FAILURE;
+   }
+
+   /*
+    * Save physical address (for easy use)
+    */
+   dma->phyBuf = dma->cookie.dmac_address;
+
+   return SOLVMXNET_SUCCESS;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_FreeDriverData --
+ *   Free driver data structures and Tx Rx buffers
+ *
+ * Results:
+ *   None
+ *
+ * Side effects:
+ *   None
+ *-----------------------------------------------------------------------------
+ */
+static void
+Vxn_FreeDriverData(vxn_softc_t *dp)
+{
+   Vxn_FreeInitBuffers(dp);
+   Vxn_FreeDmaMem(&dp->driverDataDmaMem);
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_AllocDriverData --
+ *    Allocate driver data structures and Tx Rx buffers on init
+ *
+ * Results:
+ *    SOLVMXNET_SUCCESS on success
+ *    SOLVMXNET_FAILURE on failure
+ *
+ * Side effects:
+ *    None
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_AllocDriverData(vxn_softc_t *dp)
+{
+   uint32_t r, driverDataSize;
+
+   /*
+    * Get configured receive buffers
+    */
+   OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_GET_NUM_RX_BUFFERS);
+   r = INL(dp, VMXNET_COMMAND_ADDR);
+   if (r == 0 || r > MAX_NUM_RECV_BUFFERS) {
+      r = DEFAULT_NUM_RECV_BUFFERS;
+   }
+   dp->vxnNumRxBufs = r;
+
+   /*
+    * Get configured transmit buffers
+    */
+   OUTL(dp, VMXNET_COMMAND_ADDR, VMXNET_CMD_GET_NUM_TX_BUFFERS);
+   r = INL(dp, VMXNET_COMMAND_ADDR);
+   if (r == 0 || r > MAX_NUM_XMIT_BUFFERS) {
+      r = DEFAULT_NUM_XMIT_BUFFERS;
+   }
+   dp->vxnNumTxBufs = r;
+
+   /*
+    * Calculate shared data size and allocate memory for it
+    */
+   driverDataSize =
+      sizeof(Vmxnet2_DriverData) +
+      /* numRecvBuffers + 1 for the dummy recvRing2 (used only by Windows) */
+      (dp->vxnNumRxBufs + 1) * sizeof(Vmxnet2_RxRingEntry) +
+      dp->vxnNumTxBufs * sizeof(Vmxnet2_TxRingEntry);
+
+   if (Vxn_AllocDmaMem(dp, driverDataSize, TRUE, &dp->driverDataDmaMem) 
+        != SOLVMXNET_SUCCESS) {
+      return SOLVMXNET_FAILURE;
+   }
+
+   /*
+    * Clear memory (bzero isn't resolved by module loader for some reason) 
+    */
+   ASSERT(dp->driverDataDmaMem.buf && dp->driverDataDmaMem.bufLen);
+   Vxn_Memset(dp->driverDataDmaMem.buf, 0, dp->driverDataDmaMem.bufLen);
+
+   dp->driverData = (Vmxnet2_DriverData *)dp->driverDataDmaMem.buf;
+   dp->driverDataPhy = (void *)(uintptr_t)dp->driverDataDmaMem.phyBuf;
+
+   /* So that the vmkernel can check it is compatible */
+   dp->driverData->magic = VMXNET2_MAGIC;
+   dp->driverData->length = driverDataSize;
+
+   /*
+    * Alloc rx/tx buffers, init ring, register with hardware etc.
+    */
+   if (Vxn_AllocInitBuffers(dp) != SOLVMXNET_SUCCESS) {
+      Vxn_FreeDmaMem(&dp->driverDataDmaMem);
+      return SOLVMXNET_FAILURE;
+   }
+
+   DPRINTF(3, (CE_CONT, "%s%d: numRxBufs=(%d*%"FMT64"d) numTxBufs=(%d*%"FMT64"d)" 
+               " driverDataSize=%d driverDataPhy=0x%p\n", 
+               dp->drvName, dp->unit, 
+               dp->vxnNumRxBufs, (uint64_t)sizeof(Vmxnet2_RxRingEntry),
+               dp->vxnNumTxBufs, (uint64_t)sizeof(Vmxnet2_TxRingEntry),
+               driverDataSize, dp->driverDataPhy));
+
+   return SOLVMXNET_SUCCESS;
+}
+
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Attach --
+ *    Probe and attach driver to stack
+ *
+ * Results:
+ *    DDI_SUCCESS
+ *    DDI_FAILURE
+ *
+ * Side effects:
+ *    None 
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_Attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+   int                  i, ret, len, unit;
+   const char           *drvName;
+   ddi_acc_handle_t     confHdl;
+   uint16_t             vid, did;
+   uint8_t              revid;
+   struct pci_phys_spec *regs;
+   caddr_t              vxnIOp;
+   ddi_acc_handle_t     vxnIOHdl;
+   uint32_t             vLow, vHigh;
+   gld_mac_info_t       *macInfo;
+   vxn_softc_t          *dp;
+   boolean_t            morphed = FALSE;
+   uint_t               regSpaceSize;
+   uint_t               chip;
+   uint_t               vxnIOSize;
+
+   if (cmd != DDI_ATTACH) {
+      return DDI_FAILURE;
+   }
+
+   unit = ddi_get_instance(dip);
+   drvName = ddi_driver_name(dip);
+
+   /*
+    * Check if chip is supported.
+    */
+   if (pci_config_setup(dip, &confHdl) != DDI_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: pci_config_setup() failed", drvName, unit);
+      return DDI_FAILURE;
+   }
+
+   vid   = pci_config_get16(confHdl, PCI_CONF_VENID);
+   did   = pci_config_get16(confHdl, PCI_CONF_DEVID);
+   revid = pci_config_get8(confHdl, PCI_CONF_REVID);
+
+   if (vid == PCI_VENDOR_ID_VMWARE && did == PCI_DEVICE_ID_VMWARE_NET) {
+      /* Found vmxnet */
+      chip = VMXNET_CHIP;
+   }
+   else if (vid == PCI_VENDOR_ID_AMD && did == PCI_DEVICE_ID_AMD_VLANCE) {
+      /* Found vlance (maybe a vmxnet disguise) */
+      chip = LANCE_CHIP;
+   }
+   else {
+      /* Not Found */
+      DPRINTF(3, (CE_WARN, "%s: Vxn_Attach: wrong PCI venid/devid (0x%x, 0x%x)",
+              drvName, vid, did));
+      goto err;
+   }
+
+   DPRINTF(3, (CE_CONT, "%s%d: (vid: 0x%04x, did: 0x%04x, revid: 0x%02x)\n",
+           drvName, unit, vid, did, revid));
+
+   /* 
+    * Get device properties
+    */
+   regs = NULL;
+   len  = 0;
+   if (ddi_getlongprop(DDI_DEV_T_ANY, dip, DDI_PROP_DONTPASS,
+                       "reg", (caddr_t)&regs, &len) != DDI_PROP_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: Vxn_Attach: failed to get reg property", 
+              drvName, unit);
+      goto err;
+   }
+
+   ASSERT(regs != NULL && len > 0);
+
+   /* 
+    * Search device properties for IO-space 
+    */
+   for (i = 0; i <len / sizeof(struct pci_phys_spec); i++) {
+      if ((regs[i].pci_phys_hi & PCI_REG_ADDR_M) == PCI_ADDR_IO) {
+         regSpaceSize = regs[i].pci_size_low;
+         DPRINTF(5, (CE_CONT, "%s%d: Vxn_Attach: regSpaceSize=%d\n", 
+                     drvName, unit, regSpaceSize));
+         kmem_free(regs, len);
+         goto map_space_found;
+      }
+   }
+
+   cmn_err(CE_WARN, "%s%d: Vxn_Attach: failed to find IO space", drvName, unit);
+   kmem_free(regs, len);
+   goto err;
+
+map_space_found:
+
+   /* 
+    * Ensure we can access registers through IO space. 
+    */
+   ret = pci_config_get16(confHdl, PCI_CONF_COMM);
+   ret |= PCI_COMM_IO | PCI_COMM_ME;
+   pci_config_put16(confHdl, PCI_CONF_COMM, ret);
+
+   if (ddi_regs_map_setup(dip, i, (caddr_t *)&vxnIOp, 0, 0, &dev_attr, 
+                          &vxnIOHdl) != DDI_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: Vxn_Attach: ddi_regs_map_setup failed", 
+              drvName, unit);
+      goto err;
+   }
+
+   if (chip == VMXNET_CHIP) {
+      vxnIOSize = VMXNET_CHIP_IO_RESV_SIZE;
+   }
+   else {
+      /*
+       * Since this is a vlance adapter we can only use it if
+       * its I/0 space is big enough for the adapter to be
+       * capable of morphing. This is the first requirement
+       * for this adapter to potentially be morphable. The
+       * layout of a morphable LANCE adapter is
+       *
+       * I/O space:
+       *
+       * |------------------| 
+       * | LANCE IO PORTS   |
+       * |------------------|
+       * | MORPH PORT       |
+       * |------------------|
+       * | VMXNET IO PORTS  |
+       * |------------------|
+       *
+       * VLance has 8 ports of size 4 bytes, the morph port is 4 bytes, and
+       * Vmxnet has 10 ports of size 4 bytes.
+       *
+       * We shift up the ioaddr with the size of the LANCE I/O space since
+       * we want to access the vmxnet ports. We also shift the ioaddr up by
+       * the MORPH_PORT_SIZE so other port access can be independent of
+       * whether we are Vmxnet or a morphed VLance. This means that when
+       * we want to access the MORPH port we need to subtract the size
+       * from ioaddr to get to it.
+       */
+      vxnIOp += LANCE_CHIP_IO_RESV_SIZE + MORPH_PORT_SIZE;
+      vxnIOSize = LANCE_CHIP_IO_RESV_SIZE + MORPH_PORT_SIZE +
+                  VMXNET_CHIP_IO_RESV_SIZE;
+   }
+
+   /*
+    * Do not attempt to morph non-morphable AMD PCnet
+    */
+   if (vxnIOSize > regSpaceSize) {
+      cmn_err(CE_WARN, "%s%d: Vxn_Attach: "
+              "vlance device is not supported by this driver", drvName, unit);
+      goto err_free_regs_map;
+   }
+
+   /*
+    * Morph, if we found a vlance adapter
+    */
+   if (chip == LANCE_CHIP) {
+      uint16_t magic;
+
+      /* Read morph port to verify that we can morph the adapter */
+      magic = ddi_get16(vxnIOHdl, (uint16_t *)(vxnIOp - MORPH_PORT_SIZE));
+      if (magic != LANCE_CHIP && magic != VMXNET_CHIP) {
+         cmn_err(CE_WARN, "%s%d: Vxn_Attach: Invalid magic, read: 0x%08X",
+                 drvName, unit, magic);
+         goto err_free_regs_map;
+      }
+
+      /* Morph */
+      ddi_put16(vxnIOHdl, (uint16_t *)(vxnIOp - MORPH_PORT_SIZE), VMXNET_CHIP);
+      morphed = TRUE;
+
+      /* Verify that we morphed correctly */
+      magic = ddi_get16(vxnIOHdl, (uint16_t *)(vxnIOp - MORPH_PORT_SIZE));
+      if (magic != VMXNET_CHIP) {
+         cmn_err(CE_WARN, "%s%d: Vxn_Attach: Couldn't morph adapter."
+                 " Invalid magic, read:: 0x%08X", drvName, unit, magic);
+         goto err_morph_back;
+      }
+   }
+
+   /*
+    * Check the version number of the device implementation
+    */ 
+   vLow  = (uint32_t)ddi_get32(vxnIOHdl, 
+                   (uint32_t *)(vxnIOp+VMXNET_LOW_VERSION));
+   vHigh = (uint32_t)ddi_get32(vxnIOHdl, 
+                   (uint32_t *)(vxnIOp+VMXNET_HIGH_VERSION));
+
+   if ((vLow & 0xffff0000) != (VMXNET2_MAGIC & 0xffff0000) || 
+       ((VMXNET2_MAGIC < vLow) || (VMXNET2_MAGIC > vHigh))) {
+      cmn_err(CE_WARN, "%s%d: Vxn_Attach: driver version 0x%08X doesn't "
+                       "match device 0x%08X:0x%08X", 
+              drvName, unit, VMXNET2_MAGIC, vLow, vHigh);
+      goto err_version_mismatch;
+   }
+
+   /*
+    * Alloc soft state
+    */
+   macInfo = gld_mac_alloc(dip);
+   if (!macInfo) {
+      cmn_err(CE_WARN, "%s%d: Vxn_Attach: gld_mac_alloc failed", 
+              drvName, unit);
+      goto err_gld_mac_alloc;
+   }
+
+   dp = (vxn_softc_t *) kmem_zalloc(sizeof(vxn_softc_t), KM_SLEEP);
+   ASSERT(dp);
+
+   /*
+    * Get interrupt cookie
+    */
+   if (ddi_get_iblock_cookie(dip, 0, &dp->iblockCookie) != DDI_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: Vxn_Attach: ddi_get_iblock_cookie failed", 
+              drvName, unit);
+      goto err_get_iblock_cookie;
+   }
+
+   strncpy(dp->drvName, drvName, SOLVMXNET_MAXNAME);
+   dp->unit = unit;
+   dp->dip = dip;
+   dp->macInfo = macInfo;
+   dp->confHdl = confHdl;
+   dp->vxnIOHdl = vxnIOHdl;
+   dp->vxnIOp = vxnIOp;
+   dp->morphed = morphed;
+   dp->nicActive = FALSE;
+   dp->txPending = 0;
+   dp->maxTxFrags = 1;
+
+   /*
+    * Initialize mutexes
+    */
+   mutex_init(&dp->intrlock, NULL, MUTEX_DRIVER, (void *)dp->iblockCookie);
+   mutex_init(&dp->xmitlock, NULL, MUTEX_DRIVER, (void *)dp->iblockCookie);
+   mutex_init(&dp->rxlistlock, NULL, MUTEX_DRIVER, (void *)dp->iblockCookie);
+
+   /* 
+    * Allocate and initialize our private and shared data structures
+    */
+   if (Vxn_AllocDriverData(dp) != SOLVMXNET_SUCCESS) {
+      goto err_alloc_driverdata;
+   }
+
+   /*
+    * Read the MAC address from the device
+    */
+   for (i = 0; i < 6; i++) {
+      dp->devAddr.ether_addr_octet[i] = 
+         (uint8_t)ddi_get8(vxnIOHdl, (uint8_t *)(vxnIOp + VMXNET_MAC_ADDR + i));
+   }
+   macInfo->gldm_vendor_addr = dp->devAddr.ether_addr_octet;
+   macInfo->gldm_broadcast_addr = etherbroadcastaddr.ether_addr_octet;
+
+   DPRINTF(3, (CE_CONT,
+           "MAC address: %02x:%02x:%02x:%02x:%02x:%02x\n",
+           dp->devAddr.ether_addr_octet[0],
+           dp->devAddr.ether_addr_octet[1],
+           dp->devAddr.ether_addr_octet[2],
+           dp->devAddr.ether_addr_octet[3],
+           dp->devAddr.ether_addr_octet[4],
+           dp->devAddr.ether_addr_octet[5]));
+
+   /*
+    * Configure GLD entry points
+    */
+   macInfo->gldm_devinfo      = dip;
+   macInfo->gldm_private      = (caddr_t)dp;
+   macInfo->gldm_cookie       = dp->iblockCookie;
+   macInfo->gldm_reset        = Vxn_Reset;
+   macInfo->gldm_start        = Vxn_Start;
+   macInfo->gldm_stop         = Vxn_Stop;
+   macInfo->gldm_set_mac_addr = Vxn_SetMacAddress;
+   macInfo->gldm_send         = Vxn_Send;
+   macInfo->gldm_set_promiscuous = Vxn_SetPromiscuous;
+   macInfo->gldm_get_stats    = Vxn_GetStats;
+   macInfo->gldm_ioctl        = NULL;
+   macInfo->gldm_set_multicast= Vxn_SetMulticast;
+   macInfo->gldm_intr         = Vxn_Interrupt;
+   macInfo->gldm_mctl         = NULL;
+   
+   macInfo->gldm_ident        = (char *)ddi_driver_name(dip);
+   macInfo->gldm_type         = DL_ETHER;
+   macInfo->gldm_minpkt       = 0;
+   macInfo->gldm_maxpkt       = ETHERMTU;
+   macInfo->gldm_addrlen      = ETHERADDRL;
+   macInfo->gldm_saplen       = -2;
+   macInfo->gldm_ppa          = unit;
+
+   /*
+    * Register with GLD (Generic Lan Driver) framework
+    */
+   if (gld_register(dip,
+            (char *)ddi_driver_name(dip), macInfo) != DDI_SUCCESS) {
+      goto err_gld_register;
+   }
+
+   /*
+    * Add interrupt to system.
+    */
+   if (ddi_add_intr(dip, 0, NULL, NULL, gld_intr,
+                    (caddr_t)macInfo) != DDI_SUCCESS) {
+      cmn_err(CE_WARN, "%s%d: ddi_add_intr failed", drvName, unit);
+      goto err_ddi_add_intr;
+   }
+
+   /*
+    * Add to list of interfaces.
+    */
+   mutex_enter(&vxnListLock);
+   dp->next = &vxnList;
+   dp->prev = vxnList.prev;
+   vxnList.prev->next = dp;
+   vxnList.prev = dp;
+   mutex_exit(&vxnListLock);
+
+   /*
+    * Success
+    */
+   return DDI_SUCCESS;
+
+err_ddi_add_intr:
+   gld_unregister(macInfo);
+
+err_gld_register:
+   Vxn_FreeDriverData(dp);
+
+err_alloc_driverdata:
+   mutex_destroy(&dp->intrlock);
+   mutex_destroy(&dp->xmitlock);
+
+err_get_iblock_cookie:
+   kmem_free(dp, sizeof(*dp));
+   gld_mac_free(macInfo);
+
+err_gld_mac_alloc:
+err_version_mismatch:
+err_morph_back:
+   if (morphed) {
+      ddi_put16(vxnIOHdl, (uint16_t *)(vxnIOp - MORPH_PORT_SIZE), LANCE_CHIP);
+   }
+
+err_free_regs_map:
+   ddi_regs_map_free(&vxnIOHdl);
+
+err:
+   pci_config_teardown(&confHdl);
+   return DDI_FAILURE;
+}
+
+/*
+ *-----------------------------------------------------------------------------
+ * Vxn_Detach --
+ *    Called on module unload
+ *
+ * Results:
+ *    DDI_SUCCESS
+ *    DDI_FAILURE
+ *
+ * Side effects:
+ *    None   
+ *-----------------------------------------------------------------------------
+ */
+static int
+Vxn_Detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+   gld_mac_info_t *macInfo;
+   vxn_softc_t    *dp;
+
+   macInfo = (gld_mac_info_t *)ddi_get_driver_private(dip);
+   dp = (vxn_softc_t *)macInfo->gldm_private;
+
+   if (cmd == DDI_DETACH) {
+      /*
+       * Tear down interrupt
+       */
+      ddi_remove_intr(dip, 0,  macInfo->gldm_cookie);
+      gld_unregister(macInfo);
+
+      /*
+       * Quiesce hardware
+       */
+      Vxn_Stop(macInfo);
+
+      /*
+       * Free driver-data, tx/rx buffers etc
+       */
+      Vxn_FreeDriverData(dp);
+
+      /*
+       * Destroy locks
+       */
+      mutex_destroy(&dp->intrlock);
+      mutex_destroy(&dp->xmitlock);
+
+      /*
+       * Unmorph
+       */
+      if (dp->morphed) {
+         uint16_t magic;
+
+         /* Verify that we had morphed earlier */
+         magic = ddi_get16(dp->vxnIOHdl, 
+                           (uint16_t *)(dp->vxnIOp - MORPH_PORT_SIZE));
+         if (magic != VMXNET_CHIP) {
+            cmn_err(CE_WARN, "%s%d: Vxn_Detach: Adapter not morphed"
+                             " magic=0x%08X", dp->drvName, dp->unit, magic);
+         }
+         else {
+            /* Unmorph */
+            ddi_put16(dp->vxnIOHdl, 
+                      (uint16_t *)(dp->vxnIOp - MORPH_PORT_SIZE), LANCE_CHIP);
+
+            /* Verify */
+            magic = ddi_get16(dp->vxnIOHdl, 
+                              (uint16_t *)(dp->vxnIOp - MORPH_PORT_SIZE));
+            if (magic != LANCE_CHIP) {
+               cmn_err(CE_WARN, "%s%d: Vxn_Detach: Unable to unmorph adapter"
+                             " magic=0x%08X", dp->drvName, dp->unit, magic);
+            }
+         }
+      }
+
+      /*
+       * Release resister mappings
+       */ 
+      ddi_regs_map_free(&dp->vxnIOHdl);
+      pci_config_teardown(&dp->confHdl);
+
+      /*
+       * Remove from list of interfaces.
+       */
+      mutex_enter(&vxnListLock);
+      ASSERT(dp != &vxnList);
+      dp->prev->next = dp->next;
+      dp->next->prev = dp->prev;
+      mutex_exit(&vxnListLock);
+
+      /*
+       * Release memory
+       */
+      kmem_free(dp, sizeof(*dp));
+      gld_mac_free(macInfo);
+
+      return DDI_SUCCESS;
+   }
+   else {
+      return DDI_FAILURE;
+   }
+}
+
+static   struct module_info vxnminfo = {
+  0,                    /* mi_idnum */
+  "vmxnet",             /* mi_idname */
+  0,                    /* mi_minpsz */
+  ETHERMTU,             /* mi_maxpsz */
+  QHIWATER,             /* mi_hiwat */
+  1,                    /* mi_lowat */
+};
+
+static   struct qinit vxnrinit = {
+   NULL,                /* qi_putp */
+   gld_rsrv,            /* qi_srvp */
+   gld_open,            /* qi_qopen */
+   gld_close,           /* qi_qclose */
+   NULL,                /* qi_qadmin */
+   &vxnminfo,           /* qi_minfo */
+   NULL                 /* qi_mstat */
+};
+
+static   struct qinit vxnwinit = {
+   gld_wput,            /* qi_putp */
+   gld_wsrv,            /* qi_srvp */
+   NULL,                /* qi_qopen */
+   NULL,                /* qi_qclose */
+   NULL,                /* qi_qadmin */
+   &vxnminfo,           /* qi_minfo */
+   NULL                 /* qi_mstat */
+};
+
+static struct streamtab vxn_info = {
+   &vxnrinit,           /* st_rdinit */
+   &vxnwinit,           /* st_wrinit */
+   NULL,                /* st_muxrinit */
+   NULL                 /* st_muxwrinit */
+};
+
+static   struct cb_ops cb_vxn_ops = {
+   nulldev,             /* cb_open */
+   nulldev,             /* cb_close */
+   nodev,               /* cb_strategy */
+   nodev,               /* cb_print */
+   nodev,               /* cb_dump */
+   nodev,               /* cb_read */
+   nodev,               /* cb_write */
+   nodev,               /* cb_ioctl */
+   nodev,               /* cb_devmap */
+   nodev,               /* cb_mmap */
+   nodev,               /* cb_segmap */
+   nochpoll,            /* cb_chpoll */
+   ddi_prop_op,         /* cb_prop_op */
+   &vxn_info,           /* cb_stream */
+   D_NEW|D_MP           /* cb_flag */
+};
+
+static   struct dev_ops vxn_ops = {
+   DEVO_REV,            /* devo_rev */
+   0,                   /* devo_refcnt */
+   gld_getinfo,         /* devo_getinfo */
+   nulldev,             /* devo_identify */
+   nulldev,             /* devo_probe */
+   Vxn_Attach,          /* devo_attach */
+   Vxn_Detach,          /* devo_detach */
+   nodev,               /* devo_reset */
+   &cb_vxn_ops,         /* devo_cb_ops */
+   NULL,                /* devo_bus_ops */
+   ddi_power            /* devo_power */
+};
+
+static struct modldrv modldrv = {
+   &mod_driverops,
+   ident,
+   &vxn_ops,
+};
+
+static struct modlinkage modlinkage = {
+   MODREV_1, {&modldrv, NULL,}
+};
+
+
+/*
+ * Module load entry point
+ */
+int
+_init(void)
+{
+   int err;
+
+   DPRINTF(5, (CE_CONT, "vxn: _init:\n"));
+   /* Initialize interface list */
+   vxnList.next = vxnList.prev = &vxnList;
+   mutex_init(&vxnListLock, NULL, MUTEX_DRIVER, NULL);
+   if ((err = mod_install(&modlinkage)) != 0) {
+      mutex_destroy(&vxnListLock);
+   }
+   return err;
+}
+
+/*
+ * Module unload entry point
+ */
+int
+_fini(void)
+{
+   int err;
+
+   DPRINTF(5, (CE_CONT, "vxn: _fini:\n"));
+   if ((err = mod_remove(&modlinkage)) == 0) {
+      mutex_destroy(&vxnListLock);
+   }
+   return err;
+}
+
+/*
+ * Module info entry point
+ */
+int
+_info(struct modinfo *modinfop)
+{
+   return (mod_info(&modlinkage, modinfop));
+}
+
diff --git a/usr/src/uts/intel/io/vmxnet/vmxnet.conf b/usr/src/uts/intel/io/vmxnet/vmxnet.conf
new file mode 100644
index 0000000000..eb3b160412
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/vmxnet.conf
@@ -0,0 +1,24 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright (c) 2012, Joyent, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
diff --git a/usr/src/uts/intel/io/vmxnet/vmxnet2_def.h b/usr/src/uts/intel/io/vmxnet/vmxnet2_def.h
new file mode 100644
index 0000000000..5ea437df72
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/vmxnet2_def.h
@@ -0,0 +1,436 @@
+/*********************************************************
+ * Copyright (C) 2004 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ *
+ *********************************************************/
+
+/*********************************************************
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+#ifndef _VMXNET2_DEF_H_
+#define _VMXNET2_DEF_H_
+
+#define INCLUDE_ALLOW_USERLEVEL
+
+#define INCLUDE_ALLOW_MODULE
+#define INCLUDE_ALLOW_VMK_MODULE
+#define INCLUDE_ALLOW_VMKERNEL
+#define INCLUDE_ALLOW_DISTRIBUTE
+#include "includeCheck.h"
+
+#include "net_sg.h"
+#include "vmxnet_def.h"
+
+
+/*
+ * Magic number that identifies this version of the vmxnet protocol.
+ */
+#define VMXNET2_MAGIC			0xbabe864f
+
+/* size of the rx ring */
+#define VMXNET2_MAX_NUM_RX_BUFFERS		128
+#define VMXNET2_DEFAULT_NUM_RX_BUFFERS	        100
+
+
+/* size of the rx ring when enhanced vmxnet is used */
+#define ENHANCED_VMXNET2_MAX_NUM_RX_BUFFERS     512 
+#define ENHANCED_VMXNET2_DEFAULT_NUM_RX_BUFFERS 150 
+
+/* size of the 2nd rx ring */
+#define VMXNET2_MAX_NUM_RX_BUFFERS2             2048 
+#define VMXNET2_DEFAULT_NUM_RX_BUFFERS2	        512
+
+/* size of the tx ring */
+#define VMXNET2_MAX_NUM_TX_BUFFERS		128
+#define VMXNET2_DEFAULT_NUM_TX_BUFFERS	        100
+
+/* size of the tx ring when tso/jf is used */
+#define VMXNET2_MAX_NUM_TX_BUFFERS_TSO          512
+#define VMXNET2_DEFAULT_NUM_TX_BUFFERS_TSO	256
+
+enum {
+   VMXNET2_OWNERSHIP_DRIVER,
+   VMXNET2_OWNERSHIP_DRIVER_PENDING,
+   VMXNET2_OWNERSHIP_NIC,
+   VMXNET2_OWNERSHIP_NIC_PENDING,
+   VMXNET2_OWNERSHIP_NIC_FRAG,
+   VMXNET2_OWNERSHIP_DRIVER_FRAG,
+};
+
+#define VMXNET2_SG_DEFAULT_LENGTH	6
+
+typedef struct Vmxnet2_SG_Array {
+   uint16	addrType;
+   uint16	length;
+   NetSG_Elem	sg[VMXNET2_SG_DEFAULT_LENGTH];
+} Vmxnet2_SG_Array;
+
+typedef struct Vmxnet2_RxRingEntry {
+   uint64		paddr;		/* Physical address of the packet data. */
+   uint32		bufferLength;	/* The length of the data at paddr. */
+   uint32		actualLength;	/* The actual length of the received data. */
+   uint16               ownership;	/* Who owns the packet. */
+   uint16		flags;		/* Flags as defined below. */
+   uint32               index;          /* 
+                                         * Currently:
+                                         *
+                                         * This is being used as an packet index to
+                                         * rx buffers.
+                                         *
+                                         * Originally: 
+                                         *
+					 * was void* driverData ("Driver specific data.")
+					 * which was used for sk_buf**s in Linux and
+                                         * VmxnetRxBuff*s in Windows.  It could not be
+					 * here because the structure needs to be the
+					 * same size between architectures, and it was
+					 * not used on the device side, anyway.  Look
+					 * for its replacement in
+					 * Vmxnet_Private.rxRingBuffPtr on Linux and
+					 * VmxnetAdapter.rxRingBuffPtr on Windows.
+					 */
+} Vmxnet2_RxRingEntry;
+
+/*
+ * Vmxnet2_RxRingEntry flags:
+ * 
+ * VMXNET2_RX_HW_XSUM_OK       The hardware verified the TCP/UDP checksum.
+ * VMXNET2_RX_WITH_FRAG        More data is in the 2nd ring
+ * VMXNET2_RX_FRAG_EOP         This is the last frag, the only valid flag for
+ *                             2nd ring entry
+ *
+ */
+#define VMXNET2_RX_HW_XSUM_OK  0x01
+#define VMXNET2_RX_WITH_FRAG   0x02
+#define VMXNET2_RX_FRAG_EOP    0x04
+
+typedef struct Vmxnet2_TxRingEntry {
+   uint16		flags;		/* Flags as defined below. */
+   uint16 	        ownership;	/* Who owns this packet. */
+   uint32               extra;          /*
+					 * was void* driverData ("Driver specific data.")
+					 * which was used for sk_buf*s in Linux and
+                                         * VmxnetTxInfo*s in Windows.  It could not be
+					 * here because the structure needs to be the
+					 * same size between architectures, and it was
+					 * not used on the device side, anyway.  Look
+					 * for its replacement in
+					 * Vmxnet_Private.txRingBuffPtr on Linux and
+					 * VmxnetAdapter.txRingBuffPtr on Windows.
+					 */
+   uint32               tsoMss;         /* TSO pkt MSS */
+   Vmxnet2_SG_Array	sg;		/* Packet data. */
+} Vmxnet2_TxRingEntry;
+
+/*
+ * Vmxnet2_TxRingEntry flags:
+ *
+ *   VMXNET2_TX_CAN_KEEP	The implementation can return the tx ring entry 
+ *				to the driver when it is ready as opposed to 
+ *				before the transmit call from the driver completes.
+ *   VMXNET2_TX_RING_LOW	The driver's transmit ring buffer is low on free
+ *				slots.
+ *   VMXNET2_TX_HW_XSUM         The hardware should perform the TCP/UDP checksum
+ *   VMXNET2_TX_TSO             The hardware should do TCP segmentation.
+ *   VMXNET2_TX_PINNED_BUFFER   The driver used one of the preallocated vmkernel
+ *                              buffers *and* it has been pinned with Net_PinTxBuffers.
+ *   VMXNET2_TX_MORE            This is *not* the last tx entry for the pkt.
+ *                              All flags except VMXNET2_TX_MORE are ignored
+ *                              for the subsequent tx entries.
+ */
+#define VMXNET2_TX_CAN_KEEP	     0x0001
+#define VMXNET2_TX_RING_LOW	     0x0002
+#define VMXNET2_TX_HW_XSUM           0x0004
+#define VMXNET2_TX_TSO	             0x0008
+#define VMXNET2_TX_PINNED_BUFFER     0x0010
+#define VMXNET2_TX_MORE              0x0020
+
+/*
+ * Structure used by implementations.  This structure allows the inline
+ * functions below to be used.
+ */
+typedef struct Vmxnet2_RxRingInfo {
+   Vmxnet2_RxRingEntry    *base;       /* starting addr of the ring */
+   uint32                  nicNext;    /* next entry to use in the ring */
+   uint32                  ringLength; /* # of entries in the ring */
+   PA                      startPA;    /* PA of the starting addr of the ring */
+#ifdef VMX86_DEBUG
+   const char             *name;
+#endif
+} Vmxnet2_RxRingInfo;
+
+typedef struct Vmxnet2_TxRingInfo {
+   Vmxnet2_TxRingEntry    *base;       /* starting addr of the ring */
+   uint32                  nicNext;    /* next entry to use in the ring */
+   uint32                  ringLength; /* # of entries in the ring */
+   PA                      startPA;    /* PA of the starting addr of the ring */
+#ifdef VMX86_DEBUG
+   const char             *name;
+#endif
+} Vmxnet2_TxRingInfo;
+
+typedef struct Vmxnet2_ImplData {
+   Vmxnet2_RxRingInfo    rxRing;
+   Vmxnet2_RxRingInfo    rxRing2;
+   Vmxnet2_TxRingInfo    txRing;
+
+   struct PhysMem_Token	  *ddPhysMemToken;
+} Vmxnet2_ImplData;
+
+/* 
+ * Used internally for performance studies. By default this will be off so there 
+ * should be no compatibilty or other interferences.
+ */
+
+/* #define ENABLE_VMXNET2_PROFILING    */
+
+
+#ifdef ENABLE_VMXNET2_PROFILING
+typedef struct Vmxnet2_VmmStats {
+   uint64      vIntTSC;             /* the time that virtual int was posted */
+   uint64      actionsCount;        /* Number of actions received */
+   uint64      numWasteActions;     /* Number of non-productive actions */
+}  Vmxnet2_VmmStats;
+#endif
+
+typedef struct Vmxnet2_DriverStats {
+   uint32	transmits;	   /* # of times that the drivers transmit function */
+				   /*   is called. The driver could transmit more */
+				   /*   than one packet per call. */
+   uint32	pktsTransmitted;   /* # of packets transmitted. */
+   uint32	noCopyTransmits;   /* # of packets that are transmitted without */
+				   /*   copying any data. */
+   uint32	copyTransmits;	   /* # of packets that are transmittted by copying */
+				   /*   the data into a buffer. */
+   uint32	maxTxsPending;	   /* Max # of transmits outstanding. */
+   uint32	txStopped;	   /* # of times that transmits got stopped because */
+				   /*   the tx ring was full. */
+   uint32	txRingOverflow;	   /* # of times that transmits got deferred bc */
+				   /*   the tx ring was full.  This must be >= */
+				   /*   txStopped since there will be one */
+				   /*   txStopped when the ring fills up and then */
+				   /*   one txsRingOverflow for each packet that */
+				   /*   that gets deferred until there is space. */
+   uint32	interrupts;	   /* # of times interrupted. */
+   uint32	pktsReceived;	   /* # of packets received. */
+   uint32	rxBuffersLow;	   /* # of times that the driver was low on */
+				   /*   receive buffers. */
+#ifdef ENABLE_VMXNET2_PROFILING
+    Vmxnet2_VmmStats  vmmStats;     /* vmm related stats for perf study */
+#endif
+} Vmxnet2_DriverStats;
+
+/*
+ * Shared data structure between the vm, the vmm, and the vmkernel.
+ * This structure was originally arranged to try to group common data 
+ * on 32-byte cache lines, but bit rot and the fact that we no longer
+ * run on many CPUs with that cacheline size killed that optimization.
+ * vmxnet3 should target 128 byte sizes and alignments to optimize for
+ * the 64 byte cacheline pairs on P4.
+ */
+typedef struct Vmxnet2_DriverData {
+   /*
+    * Magic must be first.
+    */
+   Vmxnet_DDMagic       magic;
+
+   /*
+    * Receive fields. 
+    */
+   uint32		rxRingLength;		/* Length of the receive ring. */
+   uint32		rxDriverNext;		/* Index of the next packet that will */
+						/*   be filled in by the impl */
+
+   uint32		rxRingLength2;	        /* Length of the 2nd receive ring. */
+   uint32		rxDriverNext2;	        /* Index of the next packet that will */
+						/*   be filled in by the impl */
+
+   uint32		notUsed1;               /* was "irq" */
+
+   /*
+    * Interface flags and multicast filter.
+    */
+   uint32		ifflags;
+   uint32		LADRF[VMXNET_MAX_LADRF];
+
+   /*
+    * Transmit fields
+    */
+   uint32               txDontClusterSize;      /* All packets <= this will be transmitted */
+                                                /* immediately, regardless of clustering */
+                                                /* settings [was fill[1]] */
+   uint32		txRingLength;		/* Length of the transmit ring. */
+   uint32		txDriverCur;		/* Index of the next packet to be */
+						/*   returned by the implementation.*/
+   uint32		txDriverNext;		/* Index of the entry in the ring */
+						/*   buffer to use for the next packet.*/
+   uint32		txStopped;  		/* The driver has stopped transmitting */
+						/*   because its ring buffer is full.*/
+   uint32		txClusterLength;	/* Maximum number of packets to */
+						/*   put in the ring buffer before */
+						/*   asking the implementation to */
+						/*   transmit the packets in the buffer.*/
+   uint32		txNumDeferred;          /* Number of packets that have been */
+						/*   queued in the ring buffer since */
+						/*   the last time the implementation */
+						/*   was asked to transmit. */
+   uint32		notUsed3;               /* This field is deprecated but still used */
+                                                /* as minXmitPhysLength on the escher branch. */
+                                                /* It cannot be used for other purposes */
+                                                /* until escher vms no longer are allowed */
+                                                /* to install this driver. */
+
+   uint32              totalRxBuffers;          /* used by esx for max rx buffers */
+   uint64              rxBufferPhysStart;       /* used by esx for pinng rx buffers */
+   /*
+    * Extra fields for future expansion.
+    */
+   uint32		extra[2];
+
+   uint16               maxFrags;               /* # of frags the driver can handle */
+   uint16               featureCtl;             /* for driver to enable some feature */
+
+   /*
+    * The following fields are used to save the nicNext indexes part
+    * of implData in the vmkernel when disconnecting the adapter, we
+    * need them when we reconnect.  This mechanism is used for
+    * checkpointing as well.
+    */
+   uint32               savedRxNICNext;
+   uint32               savedRxNICNext2;
+   uint32               savedTxNICNext;
+
+   /*
+    * Fields used during initialization or debugging.
+    */
+   uint32		length;
+   uint32		rxRingOffset;
+   uint32		rxRingOffset2;
+   uint32		txRingOffset;   
+   uint32		debugLevel;
+   uint32		txBufferPhysStart;
+   uint32		txBufferPhysLength;
+   uint32		txPktMaxSize;
+
+   /*
+    * Driver statistics.
+    */
+   Vmxnet2_DriverStats	stats;
+} Vmxnet2_DriverData;
+
+/* 
+ * Shared between VMM and Vmkernel part of vmxnet2 to optimize action posting
+ * VMM writes 1 (don't post) or 0 (okay to post) and vmk reads this.
+ */
+typedef struct VmxnetVMKShared {
+   uint32  dontPostActions;  
+} VmxnetVMKShared;
+
+#if defined VMX86_VMX || defined VMKERNEL
+
+/*
+ * Inline functions used to assist the implementation of the vmxnet interface.
+ */
+
+/*
+ * Get the next empty packet out of the receive ring and move to 
+ * the next packet.
+ */
+static INLINE Vmxnet2_RxRingEntry *
+Vmxnet2_GetNextRx(Vmxnet2_RxRingInfo *ri, uint16 ownership)
+{
+   Vmxnet2_RxRingEntry *rre = ri->base + ri->nicNext;
+   if (rre->ownership == ownership) {
+      VMXNET_INC(ri->nicNext, ri->ringLength);
+   } else {
+      rre = NULL;
+   }
+
+   return rre;
+}
+
+/*
+ * Return ownership of a packet in the receive ring to the driver.
+ */
+static INLINE void
+Vmxnet2_PutRx(Vmxnet2_RxRingEntry *rre, uint32 pktLength, uint16 ownership)
+{
+   rre->actualLength = pktLength;
+   COMPILER_MEM_BARRIER();
+   rre->ownership = ownership;
+}
+
+/*
+ * Get the next pending packet out of the transmit ring.
+ */
+static INLINE Vmxnet2_TxRingEntry *
+Vmxnet2_GetNextTx(Vmxnet2_TxRingInfo *ri)
+{
+   Vmxnet2_TxRingEntry *txre = ri->base + ri->nicNext;
+   if (txre->ownership == VMXNET2_OWNERSHIP_NIC) {
+      return txre;
+   } else {
+      return NULL;
+   }
+}
+
+/*
+ * Move to the next entry in the transmit ring.
+ */
+static INLINE unsigned int
+Vmxnet2_IncNextTx(Vmxnet2_TxRingInfo *ri)
+{
+   unsigned int prev = ri->nicNext;
+   Vmxnet2_TxRingEntry *txre = ri->base + ri->nicNext;
+   
+   txre->ownership = VMXNET2_OWNERSHIP_NIC_PENDING;
+
+   VMXNET_INC(ri->nicNext, ri->ringLength);
+   return prev;
+}
+
+/*
+ * Get the indicated entry from transmit ring.
+ */
+static INLINE Vmxnet2_TxRingEntry *
+Vmxnet2_GetTxEntry(Vmxnet2_TxRingInfo *ri, unsigned int idx)
+{
+   return ri->base + idx;
+}
+
+/*
+ * Get the indicated entry from the given rx ring
+ */
+static INLINE Vmxnet2_RxRingEntry *
+Vmxnet2_GetRxEntry(Vmxnet2_RxRingInfo *ri, unsigned int idx)
+{
+   return ri->base + idx;
+}
+
+#endif /* defined VMX86_VMX || defined VMKERNEL */
+
+#endif
+
diff --git a/usr/src/uts/intel/io/vmxnet/vmxnet_def.h b/usr/src/uts/intel/io/vmxnet/vmxnet_def.h
new file mode 100644
index 0000000000..703466c995
--- /dev/null
+++ b/usr/src/uts/intel/io/vmxnet/vmxnet_def.h
@@ -0,0 +1,184 @@
+/*********************************************************
+ * Copyright (C) 1999 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ *
+ *********************************************************/
+
+/*********************************************************
+ * The contents of this file are subject to the terms of the Common
+ * Development and Distribution License (the "License") version 1.0
+ * and no later version.  You may not use this file except in
+ * compliance with the License.
+ *
+ * You can obtain a copy of the License at
+ *         http://www.opensource.org/licenses/cddl1.php
+ *
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ *********************************************************/
+
+#ifndef _VMXNET_DEF_H_
+#define _VMXNET_DEF_H_
+
+#define INCLUDE_ALLOW_USERLEVEL
+
+#define INCLUDE_ALLOW_MODULE
+#define INCLUDE_ALLOW_VMK_MODULE
+#define INCLUDE_ALLOW_VMKERNEL
+#define INCLUDE_ALLOW_DISTRIBUTE
+#include "includeCheck.h"
+
+#include "net_sg.h"
+#include "vmnet_def.h"
+
+
+/*
+ *   Vmxnet I/O ports, used by both the vmxnet driver and 
+ *   the device emulation code.
+ */
+
+#define VMXNET_INIT_ADDR		0x00
+#define VMXNET_INIT_LENGTH		0x04
+#define VMXNET_TX_ADDR		        0x08
+#define VMXNET_COMMAND_ADDR		0x0c
+#define VMXNET_MAC_ADDR			0x10
+#define VMXNET_LOW_VERSION		0x18
+#define VMXNET_HIGH_VERSION		0x1c
+#define VMXNET_STATUS_ADDR		0x20
+#define VMXNET_TOE_INIT_ADDR            0x24
+#define VMXNET_APROM_ADDR               0x28
+#define VMXNET_INT_ENABLE_ADDR          0x30
+#define VMXNET_WAKE_PKT_PATTERNS        0x34
+
+/*
+ * Vmxnet command register values.
+ */
+#define VMXNET_CMD_INTR_ACK		0x0001
+#define VMXNET_CMD_UPDATE_LADRF		0x0002
+#define VMXNET_CMD_UPDATE_IFF		0x0004
+#define VMXNET_CMD_UNUSED 1		0x0008
+#define VMXNET_CMD_UNUSED_2		0x0010
+#define VMXNET_CMD_INTR_DISABLE  	0x0020
+#define VMXNET_CMD_INTR_ENABLE   	0x0040
+#define VMXNET_CMD_UNUSED_3		0x0080
+#define VMXNET_CMD_CHECK_TX_DONE	0x0100
+#define VMXNET_CMD_GET_NUM_RX_BUFFERS	0x0200
+#define VMXNET_CMD_GET_NUM_TX_BUFFERS	0x0400
+#define VMXNET_CMD_PIN_TX_BUFFERS	0x0800
+#define VMXNET_CMD_GET_CAPABILITIES	0x1000
+#define VMXNET_CMD_GET_FEATURES		0x2000
+#define VMXNET_CMD_SET_POWER_FULL       0x4000
+#define VMXNET_CMD_SET_POWER_LOW        0x8000
+
+/*
+ * Vmxnet status register values.
+ */
+#define VMXNET_STATUS_CONNECTED		0x0001
+#define VMXNET_STATUS_ENABLED		0x0002
+#define VMXNET_STATUS_TX_PINNED         0x0004
+
+/*
+ * Values for the interface flags.
+ */
+#define VMXNET_IFF_PROMISC		0x01
+#define VMXNET_IFF_BROADCAST		0x02
+#define VMXNET_IFF_MULTICAST		0x04
+#define VMXNET_IFF_DIRECTED             0x08
+
+/*
+ * Length of the multicast address filter.
+ */
+#define VMXNET_MAX_LADRF		2
+
+/*
+ * Size of Vmxnet APROM. 
+ */
+#define VMXNET_APROM_SIZE 6
+
+/*
+ * An invalid ring index.
+ */
+#define VMXNET_INVALID_RING_INDEX	(-1)
+
+/*
+ * Features that are implemented by the driver.  These are driver
+ * specific so not all features will be listed here.  In addition not all
+ * drivers have to pay attention to these feature flags.
+ *
+ *  VMXNET_FEATURE_ZERO_COPY_TX 	The driver won't do any copies as long as
+ *					the packet length is > 
+ *					Vmxnet_DriverData.minTxPhysLength.
+ * 
+ *  VMXNET_FEATURE_TSO                  The driver will use the TSO capabilities
+ *                                      of the underlying hardware if available 
+ *                                      and enabled.
+ *
+ *  VMXNET_FEATURE_JUMBO_FRAME          The driver can send/rcv jumbo frame 
+ *
+ *  VMXNET_FEATURE_LPD                  The backend can deliver large pkts
+ */
+#define VMXNET_FEATURE_ZERO_COPY_TX             0x01
+#define VMXNET_FEATURE_TSO                      0x02
+#define VMXNET_FEATURE_JUMBO_FRAME              0x04
+#define VMXNET_FEATURE_LPD                      0x08
+
+/*
+ * Define the set of capabilities required by each feature above
+ */
+#define VMXNET_FEATURE_ZERO_COPY_TX_CAPS        VMXNET_CAP_SG
+#define VMXNET_FEATURE_TSO_CAPS                 VMXNET_CAP_TSO
+#define VMXNET_HIGHEST_FEATURE_BIT              VMXNET_FEATURE_TSO
+
+#define VMXNET_INC(val, max)     \
+   val++;                        \
+   if (UNLIKELY(val == max)) {   \
+      val = 0;                   \
+   }
+
+/*
+ * code that just wants to switch on the different versions of the
+ * guest<->implementation protocol can cast driver data to this.
+ */
+typedef uint32 Vmxnet_DDMagic;
+
+/*
+ * Wake packet pattern commands sent through VMXNET_WAKE_PKT_PATTERNS port
+ */
+
+#define VMXNET_PM_OPCODE_START 3 /* args: cnt of wake packet patterns */
+#define VMXNET_PM_OPCODE_LEN   2 /* args: index of wake packet pattern */
+                                 /*       number of pattern byte values */
+#define VMXNET_PM_OPCODE_DATA  1 /* args: index of wake packet pattern */
+                                 /*       offset in pattern byte values list */
+                                 /*       packet byte offset */
+                                 /*       packet byte value */
+#define VMXNET_PM_OPCODE_END   0 /* args: <none> */
+
+typedef union Vmxnet_WakePktCmd {
+   uint32 pktData : 32;
+   struct {
+      unsigned cmd : 2; /* wake packet pattern cmd [from list above] */
+      unsigned cnt : 3; /* cnt wk pkt pttrns 1..MAX_NUM_FILTER_PTTRNS */
+      unsigned ind : 3; /* ind wk pkt pttrn 0..MAX_NUM_FILTER_PTTRNS-1 */
+      unsigned lenOff : 8; /* num pttrn byte vals 1..MAX_PKT_FILTER_SIZE */
+                           /* OR offset in pattern byte values list */
+                           /* 0..MAX_PKT_FILTER_SIZE-1 */
+      unsigned byteOff : 8; /* pkt byte offset 0..MAX_PKT_FILTER_SIZE-1 */
+      unsigned byteVal : 8; /* packet byte value 0..255 */
+   } pktPttrn;
+} Vmxnet_WakePktCmd;
+
+#endif /* _VMXNET_DEF_H_ */
diff --git a/usr/src/uts/intel/io/vmxnet3s/vmxnet3_rx.c b/usr/src/uts/intel/io/vmxnet3s/vmxnet3_rx.c
index 8004a3eb3e..8dd039e8cc 100644
--- a/usr/src/uts/intel/io/vmxnet3s/vmxnet3_rx.c
+++ b/usr/src/uts/intel/io/vmxnet3s/vmxnet3_rx.c
@@ -14,6 +14,7 @@
  */
 /*
  * Copyright (c) 2013, 2016 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <vmxnet3.h>
@@ -322,7 +323,7 @@ vmxnet3_rx_hwcksum(vmxnet3_softc_t *dp, mblk_t *mp,
 
 		VMXNET3_DEBUG(dp, 3, "rx cksum flags = 0x%x\n", flags);
 
-		(void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0, flags, 0);
+		mac_hcksum_set(mp, 0, 0, 0, 0, flags);
 	}
 }
 
diff --git a/usr/src/uts/intel/io/vmxnet3s/vmxnet3_tx.c b/usr/src/uts/intel/io/vmxnet3s/vmxnet3_tx.c
index 8a9f05e690..8769d938ab 100644
--- a/usr/src/uts/intel/io/vmxnet3s/vmxnet3_tx.c
+++ b/usr/src/uts/intel/io/vmxnet3s/vmxnet3_tx.c
@@ -15,6 +15,7 @@
 
 /*
  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <vmxnet3.h>
@@ -79,7 +80,7 @@ vmxnet3_tx_prepare_offload(vmxnet3_softc_t *dp, vmxnet3_offload_t *ol,
 	ol->hlen = 0;
 	ol->msscof = 0;
 
-	hcksum_retrieve(mp, NULL, NULL, &start, &stuff, NULL, &value, &flags);
+	mac_hcksum_get(mp, &start, &stuff, NULL, &value, &flags);
 
 	mac_lso_get(mp, &mss, &lso_flag);
 
diff --git a/usr/src/uts/intel/ip/ip.global-objs.debug64 b/usr/src/uts/intel/ip/ip.global-objs.debug64
index 3098f98265..d189c7a47c 100644
--- a/usr/src/uts/intel/ip/ip.global-objs.debug64
+++ b/usr/src/uts/intel/ip/ip.global-objs.debug64
@@ -21,7 +21,7 @@
 #
 # Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2011 Nexenta Systems, Inc. All rights reserved
-# Copyright 2012 Joyent, Inc. All rights reserved
+# Copyright 2017 Joyent, Inc.
 #
 
 arp_m_tbl
@@ -143,7 +143,6 @@ ip_squeue_create_callback
 ip_squeue_enter
 ip_squeue_fanout
 ip_squeue_flag
-ip_squeue_worker_wait
 ip_thread_data
 ip_thread_list
 ip_thread_rwlock
@@ -255,8 +254,6 @@ squeue_drain_ms
 squeue_drain_ns
 squeue_drain_stack_needed
 squeue_drain_stack_toodeep
-squeue_workerwait_ms
-squeue_workerwait_tick
 tcp_acceptor_rinit
 tcp_acceptor_winit
 tcp_conn_cache
diff --git a/usr/src/uts/intel/ip/ip.global-objs.obj64 b/usr/src/uts/intel/ip/ip.global-objs.obj64
index f182d7198e..e2b81e66a0 100644
--- a/usr/src/uts/intel/ip/ip.global-objs.obj64
+++ b/usr/src/uts/intel/ip/ip.global-objs.obj64
@@ -21,7 +21,7 @@
 #
 # Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2011 Nexenta Systems, Inc. All rights reserved
-# Copyright 2012 Joyent, Inc. All rights reserved
+# Copyright 2017 Joyent, Inc.
 #
 
 arp_m_tbl
@@ -143,7 +143,6 @@ ip_squeue_create_callback
 ip_squeue_enter
 ip_squeue_fanout
 ip_squeue_flag
-ip_squeue_worker_wait
 ip_thread_data
 ip_thread_list
 ip_thread_rwlock
@@ -252,8 +251,6 @@ squeue_drain_ms
 squeue_drain_ns
 squeue_drain_stack_needed
 squeue_drain_stack_toodeep
-squeue_workerwait_ms
-squeue_workerwait_tick
 tcp_acceptor_rinit
 tcp_acceptor_winit
 tcp_conn_cache
diff --git a/usr/src/uts/intel/ipf/Makefile b/usr/src/uts/intel/ipf/Makefile
index 046a6c223d..f033f016c4 100644
--- a/usr/src/uts/intel/ipf/Makefile
+++ b/usr/src/uts/intel/ipf/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 # uts/intel/ipf/Makefile
 #
@@ -58,7 +59,8 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 
 CPPFLAGS += -DIPFILTER_LKM -DIPFILTER_LOG -DIPFILTER_LOOKUP -DUSE_INET6
 CPPFLAGS += -DSUNDDI -DSOLARIS2=$(RELEASE_MINOR) -DIRE_ILL_CN
-LDFLAGS += -dy -Ndrv/ip -Nmisc/md5 -Nmisc/neti -Nmisc/hook -Nmisc/kcf
+LDFLAGS += -dy -Ndrv/ip -Nmisc/md5 -Nmisc/neti -Nmisc/hook -Nmisc/kcf -Ndrv/vnd
+LDFLAGS += -Nmisc/mac
 
 INC_PATH += -I$(UTSBASE)/common/inet/ipf
 
diff --git a/usr/src/uts/intel/ipf/ipf.global-objs.debug64 b/usr/src/uts/intel/ipf/ipf.global-objs.debug64
index 663613cee3..0af6da41fa 100644
--- a/usr/src/uts/intel/ipf/ipf.global-objs.debug64
+++ b/usr/src/uts/intel/ipf/ipf.global-objs.debug64
@@ -39,6 +39,10 @@ hook4_nicevents
 hook4_nicevents_gz
 hook4_out
 hook4_out_gz
+hook4_vnd_in
+hook4_vnd_in_gz
+hook4_vnd_out
+hook4_vnd_out_gz
 hook6_in
 hook6_in_gz
 hook6_loop_in
@@ -49,6 +53,10 @@ hook6_nicevents
 hook6_nicevents_gz
 hook6_out
 hook6_out_gz
+hook6_vnd_in
+hook6_vnd_in_gz
+hook6_vnd_out
+hook6_vnd_out_gz
 icmpreplytype4
 icmpreplytype6
 icmptoicmp6types
diff --git a/usr/src/uts/intel/iptun/Makefile b/usr/src/uts/intel/iptun/Makefile
index 24fb7f9fe8..c71c39f911 100644
--- a/usr/src/uts/intel/iptun/Makefile
+++ b/usr/src/uts/intel/iptun/Makefile
@@ -54,7 +54,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -Ndrv/dld -Nmisc/dls -Nmisc/mac -Ndrv/ip
-INC_PATH        += -I$(UTSBASE)/common/io/bpf
 
 LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
 LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
diff --git a/usr/src/uts/intel/ixgbe/Makefile b/usr/src/uts/intel/ixgbe/Makefile
index c0408d0667..26d0e670f2 100644
--- a/usr/src/uts/intel/ixgbe/Makefile
+++ b/usr/src/uts/intel/ixgbe/Makefile
@@ -71,6 +71,7 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 # Driver depends on MAC
 #
 LDFLAGS		+= -dy -N misc/mac
+MAPFILES	+= ddi mac random kernel
 
 #
 #	Default build targets.
@@ -96,4 +97,5 @@ install:	$(INSTALL_DEPS)
 #
 #	Include common targets.
 #
+include $(UTSBASE)/Makefile.mapfile
 include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/kdi/kdi_asm.s b/usr/src/uts/intel/kdi/kdi_asm.s
index edfbea10c7..f106d643f7 100644
--- a/usr/src/uts/intel/kdi/kdi_asm.s
+++ b/usr/src/uts/intel/kdi/kdi_asm.s
@@ -406,6 +406,7 @@
 	movq	%rax, REG_OFF(KDIREG_CR3)(%rsp)
 
 	movq	REG_OFF(KDIREG_SS)(%rsp), %rax
+	movq	%rax, REG_OFF(KDIREG_SAVPC)(%rsp)
 	xchgq	REG_OFF(KDIREG_RIP)(%rsp), %rax
 	movq	%rax, REG_OFF(KDIREG_SS)(%rsp)
 
@@ -426,6 +427,11 @@
 
 	movq	REG_OFF(KDIREG_RIP)(%rsp), %rcx
 	ADD_CRUMB(%rax, KRM_PC, %rcx, %rdx)
+	movq	REG_OFF(KDIREG_RSP)(%rsp), %rcx
+	ADD_CRUMB(%rax, KRM_SP, %rcx, %rdx)
+	ADD_CRUMB(%rax, KRM_TRAPNO, $-1, %rdx)
+
+	movq    $KDI_CPU_STATE_SLAVE, KRS_CPU_STATE(%rax)
 
 	pushq	%rax
 	jmp	kdi_save_common_state
diff --git a/usr/src/uts/intel/kdi/kdi_idt.c b/usr/src/uts/intel/kdi/kdi_idt.c
index 6ea4681bce..a5520c72c3 100644
--- a/usr/src/uts/intel/kdi/kdi_idt.c
+++ b/usr/src/uts/intel/kdi/kdi_idt.c
@@ -88,6 +88,9 @@
 #define	KDI_IDT_DTYPE_KERNEL	0
 #define	KDI_IDT_DTYPE_BOOT	1
 
+/* Solely to keep kdiregs_t in the CTF, otherwise unused. */
+kdiregs_t kdi_regs;
+
 kdi_cpusave_t *kdi_cpusave;
 int kdi_ncpusave;
 
diff --git a/usr/src/uts/intel/lx_brand/Makefile b/usr/src/uts/intel/lx_brand/Makefile
new file mode 100644
index 0000000000..4eff474a49
--- /dev/null
+++ b/usr/src/uts/intel/lx_brand/Makefile
@@ -0,0 +1,114 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2017 Joyent, Inc.
+#
+#	This makefile drives the production of the kernel component of
+#	the lx brand
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE		= ../..
+
+#
+#	Path to where brand common sources live
+#
+LX_CMN		= $(SRC)/common/brand/lx
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= lx_brand
+OBJECTS		= $(LX_BRAND_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_BRAND_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_BRAND_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+INC_PATH	+= -I$(UTSBASE)/common/brand/lx -I$(LX_CMN) -I$(SRC)/common
+INC_PATH	+= -I$(UTSBASE)/common/inet/sockmods -I$(UTSBASE)/common/io/bpf
+INC_PATH	+= -I$(UTSBASE)/common/fs/sockfs
+INC_PATH	+= -I$(UTSBASE)/common/fs/zfs
+AS_INC_PATH	+= -I$(UTSBASE)/i86pc/genassym/$(OBJS_DIR)
+
+#
+# lint pass one enforcement
+#
+CFLAGS		+= $(CCVERBOSE)
+
+LDFLAGS		+= -dy -Nexec/elfexec -Nfs/fifofs -Nfs/sockfs -Ndrv/ip \
+		    -Nfs/zfs -Nmisc/klmmod -Nsys/sysacct
+
+#
+# For now, disable these lint checks; maintainers should endeavor
+# to investigate and remove these for maximum lint coverage.
+# Please do not carry these forward to new Makefiles.
+#
+LINTTAGS	+= -erroff=E_ASSIGN_NARROW_CONV
+LINTTAGS	+= -erroff=E_SUSPICIOUS_COMPARISON
+# Due to zfs_ioctl.h inlines.  gcc catches non-inline ones during compilation.
+LINTTAGS	+= -erroff=E_STATIC_UNUSED
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
+
+#
+#	Include brand-specific rules
+#
+
+include $(UTSBASE)/intel/lx_brand/Makefile.rules
diff --git a/usr/src/uts/intel/lx_brand/Makefile.rules b/usr/src/uts/intel/lx_brand/Makefile.rules
new file mode 100644
index 0000000000..1f641cea05
--- /dev/null
+++ b/usr/src/uts/intel/lx_brand/Makefile.rules
@@ -0,0 +1,100 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2016 Joyent, Inc.
+#
+#
+
+#
+#	Section 1a: C object build rules
+#
+$(OBJS_DIR_OBJ64)/%.o:		$(UTSBASE)/common/brand/lx/os/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR_DBG64)/%.o:		$(UTSBASE)/common/brand/lx/os/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR_OBJ64)/%.o:		$(UTSBASE)/common/brand/lx/syscall/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR_DBG64)/%.o:		$(UTSBASE)/common/brand/lx/syscall/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR_OBJ64)/%.o:		$(UTSBASE)/intel/brand/lx/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR_DBG64)/%.o:		$(UTSBASE)/intel/brand/lx/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR_OBJ64)/%.o:		$(UTSBASE)/intel/brand/lx/%.s
+	$(COMPILE.s) -I$(UTSBASE)/i86pc -o $@ $<
+
+$(OBJS_DIR_OBJ64)/%.o:		$(LX_CMN)/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR_DBG64)/%.o:		$(UTSBASE)/intel/brand/lx/%.s
+	$(COMPILE.s) -I$(UTSBASE)/i86pc -o $@ $<
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/brand/lx/os/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/brand/lx/syscall/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/brand/lx/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(LX_CMN)/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/intel/brand/lx/%.s
+	$(COMPILE.s) -I$(UTSBASE)/i86pc -o $@ $<
+
+#
+#	Section 1b: Lint `object' build rules.
+#
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/brand/lx/os/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/brand/lx/syscall/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(LX_CMN)/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/brand/lx/%.s
+	@($(LHEAD) $(LINT.s) $< $(LTAIL))
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/intel/brand/lx/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lx_cgroup/Makefile b/usr/src/uts/intel/lx_cgroup/Makefile
new file mode 100644
index 0000000000..6f9116f32a
--- /dev/null
+++ b/usr/src/uts/intel/lx_cgroup/Makefile
@@ -0,0 +1,57 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+UTSBASE	= ../..
+
+LX_CMN		= $(SRC)/common/brand/lx
+
+MODULE		= lx_cgroup
+OBJECTS		= $(LX_CGROUP_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_CGROUP_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_FS_DIR)/$(MODULE)
+
+INC_PATH	+= -I$(UTSBASE)/common/brand/lx -I$(LX_CMN)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+CFLAGS		+= $(CCVERBOSE)
+
+LDFLAGS		+= -dy -Nbrand/lx_brand
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
+
+include $(UTSBASE)/intel/lx_cgroup/Makefile.rules
diff --git a/usr/src/uts/intel/lx_cgroup/Makefile.rules b/usr/src/uts/intel/lx_cgroup/Makefile.rules
new file mode 100644
index 0000000000..6d4c7c4060
--- /dev/null
+++ b/usr/src/uts/intel/lx_cgroup/Makefile.rules
@@ -0,0 +1,21 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.  All rights reserved.
+#
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/brand/lx/cgroups/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/brand/lx/cgroups/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lx_devfs/Makefile b/usr/src/uts/intel/lx_devfs/Makefile
new file mode 100644
index 0000000000..1254f596eb
--- /dev/null
+++ b/usr/src/uts/intel/lx_devfs/Makefile
@@ -0,0 +1,57 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+UTSBASE	= ../..
+
+LX_CMN		= $(SRC)/common/brand/lx
+
+MODULE		= lx_devfs
+OBJECTS		= $(LX_DEVFS_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_DEVFS_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_FS_DIR)/$(MODULE)
+
+INC_PATH	+= -I$(UTSBASE)/common/brand/lx -I$(LX_CMN)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+CFLAGS		+= $(CCVERBOSE)
+
+LDFLAGS		+= -dy -Nbrand/lx_brand
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
+
+include $(UTSBASE)/intel/lx_devfs/Makefile.rules
diff --git a/usr/src/uts/intel/lx_devfs/Makefile.rules b/usr/src/uts/intel/lx_devfs/Makefile.rules
new file mode 100644
index 0000000000..4b9748314c
--- /dev/null
+++ b/usr/src/uts/intel/lx_devfs/Makefile.rules
@@ -0,0 +1,21 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.  All rights reserved.
+#
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/brand/lx/devfs/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/brand/lx/devfs/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lx_netlink/Makefile b/usr/src/uts/intel/lx_netlink/Makefile
new file mode 100644
index 0000000000..2ada8e28a6
--- /dev/null
+++ b/usr/src/uts/intel/lx_netlink/Makefile
@@ -0,0 +1,77 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= lx_netlink
+OBJECTS		= $(LX_NETLINK_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_NETLINK_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_SOCK_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+CPPFLAGS	+= -I$(UTSBASE)/common/brand/lx
+LDFLAGS		+= -dy -Ndrv/ip -Nfs/sockfs -Nbrand/lx_brand
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
+
+$(OBJS_DIR)/%.o:	$(UTSBASE)/common/brand/lx/io/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(LINTS_DIR)/%.ln:	$(UTSBASE)/common/brand/lx/io/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lx_proc/Makefile b/usr/src/uts/intel/lx_proc/Makefile
new file mode 100644
index 0000000000..9ec70e5adb
--- /dev/null
+++ b/usr/src/uts/intel/lx_proc/Makefile
@@ -0,0 +1,117 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# uts/intel/lx_proc/Makefile
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# Copyright 2017 Joyent, Inc.
+#
+#	This makefile drives the production of the lxproc file system
+#	kernel module.
+#
+#	i86 architecture dependent
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Path to where brand common sources live
+#
+LX_CMN		= $(SRC)/common/brand/lx
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= lx_proc
+OBJECTS		= $(LX_PROC_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_PROC_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_FS_DIR)/$(MODULE)
+
+INC_PATH	+= -I$(UTSBASE)/common/brand/lx -I$(LX_CMN)
+INC_PATH	+= -I$(UTSBASE)/common/fs/zfs
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+#	Overrides.
+#
+CFLAGS		+= $(CCVERBOSE)
+
+#
+#	Depends on procfs and lx_brand
+#
+LDFLAGS		+= -dy -Nfs/procfs -Nbrand/lx_brand -Ndrv/inotify -Ndrv/ip
+LDFLAGS		+= -Nfs/sockfs -Ncrypto/swrand
+
+#
+# For now, disable these lint checks; maintainers should endeavor
+# to investigate and remove these for maximum lint coverage.
+# Please do not carry these forward to new Makefiles.
+#
+LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
+LINTTAGS	+= -erroff=E_ASSIGN_NARROW_CONV
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
+
+#
+#	Include brand-specific rules
+#
+
+include $(UTSBASE)/intel/lx_proc/Makefile.rules
diff --git a/usr/src/uts/intel/lx_proc/Makefile.rules b/usr/src/uts/intel/lx_proc/Makefile.rules
new file mode 100644
index 0000000000..b8592d2fdd
--- /dev/null
+++ b/usr/src/uts/intel/lx_proc/Makefile.rules
@@ -0,0 +1,38 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#ident	"%Z%%M%	%I%	%E% SMI"
+
+#
+#	Section 1a: C object build rules
+#
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/brand/lx/procfs/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+#
+#	Section 1b: Lint `object' build rules.
+#
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/brand/lx/procfs/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lx_ptm/Makefile b/usr/src/uts/intel/lx_ptm/Makefile
new file mode 100644
index 0000000000..dcead27da7
--- /dev/null
+++ b/usr/src/uts/intel/lx_ptm/Makefile
@@ -0,0 +1,91 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# uts/intel/lx_ptm/Makefile
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#	This makefile drives the production of the lx_ptm driver
+#
+#	intel architecture dependent
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= lx_ptm
+OBJECTS		= $(LX_PTM_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_PTM_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/common/brand/lx/io
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY) $(SRC_CONFILE)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+CPPFLAGS	+= -I$(UTSBASE)/common/brand/lx
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
+
+$(OBJS_DIR)/%.o:	$(UTSBASE)/common/brand/lx/io/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(LINTS_DIR)/%.ln:	$(UTSBASE)/common/brand/lx/io/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lx_sysfs/Makefile b/usr/src/uts/intel/lx_sysfs/Makefile
new file mode 100644
index 0000000000..14e0603533
--- /dev/null
+++ b/usr/src/uts/intel/lx_sysfs/Makefile
@@ -0,0 +1,66 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+UTSBASE	= ../..
+
+LX_CMN		= $(SRC)/common/brand/lx
+
+MODULE		= lx_sysfs
+OBJECTS		= $(LX_SYS_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_SYS_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_FS_DIR)/$(MODULE)
+
+INC_PATH	+= -I$(UTSBASE)/common/brand/lx -I$(LX_CMN)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+CFLAGS		+= $(CCVERBOSE)
+
+LDFLAGS		+= -dy -Nbrand/lx_brand -Ndrv/ip
+
+#
+# For now, disable these lint checks; maintainers should endeavor
+# to investigate and remove these for maximum lint coverage.
+# Please do not carry these forward to new Makefiles.
+#
+# XXX JJ
+# LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
+# LINTTAGS	+= -erroff=E_ASSIGN_NARROW_CONV
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
+
+include $(UTSBASE)/intel/lx_sysfs/Makefile.rules
diff --git a/usr/src/uts/intel/lx_sysfs/Makefile.rules b/usr/src/uts/intel/lx_sysfs/Makefile.rules
new file mode 100644
index 0000000000..c9d4c28f85
--- /dev/null
+++ b/usr/src/uts/intel/lx_sysfs/Makefile.rules
@@ -0,0 +1,21 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.  All rights reserved.
+#
+
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/brand/lx/sysfs/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/brand/lx/sysfs/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lx_systrace/Makefile b/usr/src/uts/intel/lx_systrace/Makefile
new file mode 100644
index 0000000000..20c4a6a3a3
--- /dev/null
+++ b/usr/src/uts/intel/lx_systrace/Makefile
@@ -0,0 +1,80 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+UTSBASE	= ../..
+
+MODULE		= lx_systrace
+OBJECTS		= $(LX_SYSTRACE_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_SYSTRACE_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+ROOTLINK	= $(USR_DTRACE_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/common/brand/lx/dtrace
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET	= $(BINARY) $(SRC_CONFILE)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOTLINK) $(ROOT_CONFFILE)
+
+CPPFLAGS += -I$(UTSBASE)/common/brand/lx
+
+LDFLAGS         += -dy -Ndrv/dtrace -Nbrand/lx_brand
+
+#
+# For now, disable these lint checks; maintainers should endeavor
+# to investigate and remove these for maximum lint coverage.
+# Please do not carry these forward to new Makefiles.
+#
+LINTTAGS	+= -erroff=E_STATIC_UNUSED
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+$(ROOTLINK):	$(USR_DTRACE_DIR) $(ROOTMODULE)
+	-$(RM) $@; ln $(ROOTMODULE) $@
+
+include $(UTSBASE)/intel/Makefile.targ
+
+$(OBJS_DIR)/%.o:	$(UTSBASE)/common/brand/lx/dtrace/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+$(LINTS_DIR)/%.ln:	$(UTSBASE)/common/brand/lx/dtrace/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lxautofs/Makefile b/usr/src/uts/intel/lxautofs/Makefile
new file mode 100644
index 0000000000..5de66af48f
--- /dev/null
+++ b/usr/src/uts/intel/lxautofs/Makefile
@@ -0,0 +1,114 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+# Copyright 2016 Joyent, Inc.
+#
+
+#
+#	This makefile drives the production of the lxautofs file system
+#	kernel module.
+#
+#	i86 architecture dependent
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+#	Note that the name of the actual filesystem is lxautofs and
+#	not lx_autofs.  This is becase filesystem names are stupidly
+#	limited to 8 characters.
+#
+MODULE		= lxautofs
+OBJECTS		= $(LX_AUTOFS_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LX_AUTOFS_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+ROOTLINK	= $(USR_FS_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/common/brand/lx/autofs
+
+INC_PATH	+= -I$(UTSBASE)/common/brand/lx
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOTLINK) $(ROOT_CONFFILE)
+
+#
+#	Overrides.
+#
+CFLAGS		+= $(CCVERBOSE)
+LDFLAGS		+= -dy -Nfs/nfs
+
+#
+# For now, disable these lint checks; maintainers should endeavor
+# to investigate and remove these for maximum lint coverage.
+# Please do not carry these forward to new Makefiles.
+#
+LINTTAGS	+= -erroff=E_ASSIGN_NARROW_CONV
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+$(ROOTLINK):    $(ROOT_FS_DIR) $(ROOTMODULE)
+	-$(RM) $@; ln $(ROOTMODULE) $@
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
+
+#
+#	Include brand-specific rules
+#
+
+include $(UTSBASE)/intel/lxautofs/Makefile.rules
diff --git a/usr/src/uts/intel/lxautofs/Makefile.rules b/usr/src/uts/intel/lxautofs/Makefile.rules
new file mode 100644
index 0000000000..474743ce9d
--- /dev/null
+++ b/usr/src/uts/intel/lxautofs/Makefile.rules
@@ -0,0 +1,38 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+
+#
+#	Section 1a: C object build rules
+#
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/brand/lx/autofs/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
+#
+#	Section 1b: Lint `object' build rules.
+#
+$(LINTS_DIR)/%.ln:		$(UTSBASE)/common/brand/lx/autofs/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
diff --git a/usr/src/uts/intel/lxprocfs/Makefile b/usr/src/uts/intel/lxprocfs/Makefile
new file mode 100644
index 0000000000..c6ffec0199
--- /dev/null
+++ b/usr/src/uts/intel/lxprocfs/Makefile
@@ -0,0 +1,88 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# uts/intel/lxprocfs/Makefile
+#
+# Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+#	This makefile drives the production of the lxprocfs file system
+#	kernel module.
+#
+#	intel architecture dependent
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= lxprocfs
+OBJECTS		= $(LXPROC_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(LXPROC_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_FS_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# Depends on procfs
+#
+LDFLAGS		+= -dy -Nfs/procfs
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/mac/Makefile b/usr/src/uts/intel/mac/Makefile
index 93d232cad2..327c1adb47 100644
--- a/usr/src/uts/intel/mac/Makefile
+++ b/usr/src/uts/intel/mac/Makefile
@@ -56,7 +56,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
 LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
diff --git a/usr/src/uts/intel/mac_ether/Makefile b/usr/src/uts/intel/mac_ether/Makefile
index 889f7a73de..c58051a7b1 100644
--- a/usr/src/uts/intel/mac_ether/Makefile
+++ b/usr/src/uts/intel/mac_ether/Makefile
@@ -56,7 +56,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -N misc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/intel/mac_ib/Makefile b/usr/src/uts/intel/mac_ib/Makefile
index 5045d1bbbf..ebcef78eaa 100644
--- a/usr/src/uts/intel/mac_ib/Makefile
+++ b/usr/src/uts/intel/mac_ib/Makefile
@@ -56,7 +56,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -N misc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/intel/mac_wifi/Makefile b/usr/src/uts/intel/mac_wifi/Makefile
index 11f22cfca7..b05cb5d627 100644
--- a/usr/src/uts/intel/mac_wifi/Makefile
+++ b/usr/src/uts/intel/mac_wifi/Makefile
@@ -58,7 +58,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -Nmisc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/intel/nfp/Makefile b/usr/src/uts/intel/nfp/Makefile
new file mode 100644
index 0000000000..3acbc6a725
--- /dev/null
+++ b/usr/src/uts/intel/nfp/Makefile
@@ -0,0 +1,82 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014, Joyent, Inc
+#
+
+#
+# uts/intel/nfp/Makefile
+#
+#	This makefile drives the production of the nfp
+#	driver kernel module.
+#
+#	intel architecture dependent
+#
+
+#
+#	Paths to the base of the uts directory trees
+#
+UTSBASE = ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= nfp
+OBJECTS		= $(NFP_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(NFP_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_DRV_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# 	Driver-specific flags
+#
+CPPFLAGS	+= -DCH_KERNELVER=270
+LDFLAGS		+= -dy
+CERRWARN	+= -_gcc=-Wno-unused-variable
+CERRWARN	+= -_gcc=-Wno-unused-function
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/opteron_pcbe/Makefile b/usr/src/uts/intel/opteron_pcbe/Makefile
index aea8e89fbe..7431f50329 100644
--- a/usr/src/uts/intel/opteron_pcbe/Makefile
+++ b/usr/src/uts/intel/opteron_pcbe/Makefile
@@ -34,7 +34,7 @@ UTSBASE = ../..
 MODULE		= pcbe.AuthenticAMD
 OBJECTS		= $(OPTERON_PCBE_OBJS:%=$(OBJS_DIR)/%)
 LINTS		= $(OPTERON_PCBE_OBJS:%.o=$(LINTS_DIR)/%.ln)
-ROOTMODULE	= $(USR_PCBE_DIR)/$(MODULE)
+ROOTMODULE	= $(ROOT_PSM_PCBE_DIR)/$(MODULE)
 
 #
 #	Include common rules.
diff --git a/usr/src/uts/intel/os/driver_aliases b/usr/src/uts/intel/os/driver_aliases
index 3116819932..1cea287121 100644
--- a/usr/src/uts/intel/os/driver_aliases
+++ b/usr/src/uts/intel/os/driver_aliases
@@ -1 +1,2 @@
 asy "pci11c1,480"
+vmxnet "pci15ad,720"
diff --git a/usr/src/uts/intel/os/name_to_major b/usr/src/uts/intel/os/name_to_major
index c5ad4c9bf0..1fb86f9a50 100644
--- a/usr/src/uts/intel/os/name_to_major
+++ b/usr/src/uts/intel/os/name_to_major
@@ -2,3 +2,4 @@ md 85
 devinfo 88
 asy 106
 did 239
+vmxnet 270
diff --git a/usr/src/uts/intel/overlay/Makefile b/usr/src/uts/intel/overlay/Makefile
new file mode 100644
index 0000000000..645b888cbc
--- /dev/null
+++ b/usr/src/uts/intel/overlay/Makefile
@@ -0,0 +1,54 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+UTSBASE = ../..
+
+MODULE          = overlay
+OBJECTS         = $(OVERLAY_OBJS:%=$(OBJS_DIR)/%)
+LINTS           = $(OVERLAY_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE      = $(ROOT_DRV_DIR)/$(MODULE)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET      = $(BINARY) $(SRC_CONFFILE)
+LINT_TARGET     = $(MODULE).lint
+INSTALL_TARGET  = $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+CONF_SRCDIR	= $(UTSBASE)/common/io/overlay
+MAPFILE		= $(UTSBASE)/common/io/overlay/overlay.mapfile
+
+LDFLAGS += -dy -Nmisc/mac -Ndrv/dld -Nmisc/dls -Nmisc/ksocket
+
+LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
+
+
+.KEEP_STATE:
+
+def:            $(DEF_DEPS)
+
+all:            $(ALL_DEPS)
+
+clean:          $(CLEAN_DEPS)
+
+clobber:        $(CLOBBER_DEPS)
+
+lint:           $(LINT_DEPS)
+
+modlintlib:     $(MODLINTLIB_DEPS)
+
+clean.lint:     $(CLEAN_LINT_DEPS)
+
+install:        $(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/p4_pcbe/Makefile b/usr/src/uts/intel/p4_pcbe/Makefile
index 07689646c1..42dc040eee 100644
--- a/usr/src/uts/intel/p4_pcbe/Makefile
+++ b/usr/src/uts/intel/p4_pcbe/Makefile
@@ -35,7 +35,7 @@ UTSBASE = ../..
 MODULE		= pcbe.GenuineIntel.15
 OBJECTS		= $(P4_PCBE_OBJS:%=$(OBJS_DIR)/%)
 LINTS		= $(P4_PCBE_OBJS:%.o=$(LINTS_DIR)/%.ln)
-ROOTMODULE	= $(USR_PCBE_DIR)/$(MODULE)
+ROOTMODULE	= $(ROOT_PSM_PCBE_DIR)/$(MODULE)
 
 #
 #	Include common rules.
diff --git a/usr/src/uts/intel/pcbe/core_pcbe.c b/usr/src/uts/intel/pcbe/core_pcbe.c
index bc571c45e9..b02b6fb2db 100644
--- a/usr/src/uts/intel/pcbe/core_pcbe.c
+++ b/usr/src/uts/intel/pcbe/core_pcbe.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 /*
@@ -1326,9 +1327,26 @@ core_pcbe_init(void)
 			/* Westmere */
 			case 37:
 			case 44:
+			/* Sandy Bridge */
+			case 42:
+			case 45:
 			/* Nehalem-EX */
 			case 46:
 			case 47:
+			/* Ivy Bridge */
+			case 58:
+			case 62:
+			/* Haswell */
+			case 60:
+			case 63:
+			case 69:
+			case 70:
+			/* Broadwell */
+			case 61:
+			case 71:
+			/* Skylake */
+			case 78:
+			case 85:
 				events_table = events_fam6_nhm;
 				break;
 			case 28:
diff --git a/usr/src/uts/intel/promif/prom_emul.c b/usr/src/uts/intel/promif/prom_emul.c
index 5497d9eab8..cdf190ec6a 100644
--- a/usr/src/uts/intel/promif/prom_emul.c
+++ b/usr/src/uts/intel/promif/prom_emul.c
@@ -24,7 +24,9 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright (c) 2015 Joyent, Inc.  All rights reserved.
+ */
 
 #include <sys/promif.h>
 #include <sys/promimpl.h>
@@ -46,7 +48,7 @@ promif_create_prop(prom_node_t *pnp, char *name, void *val, int len, int flags)
 	q = kmem_zalloc(sizeof (*q), KM_SLEEP);
 	q->pp_name = kmem_zalloc(strlen(name) + 1, KM_SLEEP);
 	(void) strcpy(q->pp_name, name);
-	q->pp_val = kmem_alloc(len, KM_SLEEP);
+	q->pp_val = len > 0 ? kmem_alloc(len, KM_SLEEP) : NULL;
 	q->pp_len = len;
 	switch (flags) {
 	case DDI_PROP_TYPE_INT:
diff --git a/usr/src/uts/intel/smrt/Makefile b/usr/src/uts/intel/smrt/Makefile
new file mode 100644
index 0000000000..1d9d8969ed
--- /dev/null
+++ b/usr/src/uts/intel/smrt/Makefile
@@ -0,0 +1,72 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2017, Joyent, Inc.
+#
+
+#
+#	Path to the base of the uts directory tree
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= smrt
+OBJECTS		= $(SMRT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(SMRT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_DRV_DIR)/$(MODULE)
+CONF_SRCDIR     = $(UTSBASE)/common/io/scsi/adapters/smrt
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY) $(CONFMOD)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+# 	Kernel Module Dependencies
+#
+LDFLAGS		+= -dy -Nmisc/scsi
+
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/sockpfp/Makefile b/usr/src/uts/intel/sockpfp/Makefile
index ab2f16a0b3..ac5ca9209d 100644
--- a/usr/src/uts/intel/sockpfp/Makefile
+++ b/usr/src/uts/intel/sockpfp/Makefile
@@ -58,7 +58,7 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS += $(CCVERBOSE)
 
-LDFLAGS += -dy -Nfs/sockfs -Nmisc/dls -Nmisc/mac -Ndrv/bpf -Ndrv/ip
+LDFLAGS += -dy -Nfs/sockfs -Nmisc/dls -Nmisc/mac -Ndrv/ip
 INC_PATH += -I$(UTSBASE)/common/inet/sockmods -I$(UTSBASE)/common/io/bpf
 
 #
diff --git a/usr/src/uts/intel/spdsock/Makefile b/usr/src/uts/intel/spdsock/Makefile
index 8517e4882a..5f980df27f 100644
--- a/usr/src/uts/intel/spdsock/Makefile
+++ b/usr/src/uts/intel/spdsock/Makefile
@@ -60,8 +60,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 #
 LDFLAGS += -dy -Ndrv/ip
 
-INC_PATH += -I$(UTSBASE)/common/io/bpf
-
 #
 # For now, disable these lint checks; maintainers should endeavor
 # to investigate and remove these for maximum lint coverage.
diff --git a/usr/src/uts/intel/sys/acpi/acpica-resync.patch b/usr/src/uts/intel/sys/acpi/acpica-resync.patch
new file mode 100644
index 0000000000..a36a7b51f8
--- /dev/null
+++ b/usr/src/uts/intel/sys/acpi/acpica-resync.patch
@@ -0,0 +1,52 @@
+This file and its contents are supplied under the terms of the
+Common Development and Distribution License ("CDDL"), version 1.0.
+You may only use this file in accordance with the terms of version
+1.0 of the CDDL.
+
+A full copy of the text of the CDDL should have accompanied this
+source.  A copy of the CDDL is also available via the Internet at
+http://www.illumos.org/license/CDDL.
+
+Copyright (c) 2018, Joyent, Inc.
+
+---
+
+Without this patch, debug builds are unhappy about unused functions.
+
+  cc1: warnings being treated as errors
+  ../../intel/sys/acpi/acpixf.h:1203: error: 'AcpiDebugPrint' defined but not used [-Wunused-function]
+  ../../intel/sys/acpi/acpixf.h:1215: error: 'AcpiDebugPrintRaw' defined but not used [-Wunused-function]
+  ../../intel/sys/acpi/acpixf.h:1227: error: 'AcpiTracePoint' defined but not used [-Wunused-function]
+  ../../intel/sys/acpi/acpixf.h:1235: error: 'AcpiLogError' defined but not used [-Wunused-function]
+  *** Error code 1
+  make: Warning: Command failed for target `debug64/psm_common.o'
+  Current working directory
+  .../usr/src/uts/i86pc/apix
+
+
+diff --git b/usr/src/uts/intel/sys/acpi/acpixf.h a/usr/src/uts/intel/sys/acpi/acpixf.h
+index aafac14..81e550a 100644
+--- b/usr/src/uts/intel/sys/acpi/acpixf.h
++++ a/usr/src/uts/intel/sys/acpi/acpixf.h
+@@ -363,9 +361,7 @@ ACPI_GLOBAL (BOOLEAN,               AcpiGbl_SystemAwakeAndRunning);
+     Prototype;
+ 
+ #else
+-#define ACPI_DBG_DEPENDENT_RETURN_VOID(Prototype) \
+-    static ACPI_INLINE Prototype {return;}
+-
++#define ACPI_DBG_DEPENDENT_RETURN_VOID(Prototype)
+ #endif /* ACPI_DEBUG_OUTPUT */
+ 
+ 
+@@ -381,9 +377,7 @@ ACPI_GLOBAL (BOOLEAN,               AcpiGbl_SystemAwakeAndRunning);
+     Prototype;
+ 
+ #else
+-#define ACPI_APP_DEPENDENT_RETURN_VOID(Prototype) \
+-    static ACPI_INLINE Prototype {return;}
+-
++#define ACPI_APP_DEPENDENT_RETURN_VOID(Prototype)
+ #endif /* ACPI_APPLICATION */
+ 
+ 
diff --git a/usr/src/uts/intel/sys/acpi/platform/acsolaris.h b/usr/src/uts/intel/sys/acpi/platform/acsolaris.h
index 207ef4723d..3931916d77 100644
--- a/usr/src/uts/intel/sys/acpi/platform/acsolaris.h
+++ b/usr/src/uts/intel/sys/acpi/platform/acsolaris.h
@@ -74,7 +74,9 @@ uint32_t acpi_strtoul(const char *, char **, int);
 #define	ACPI_USE_NATIVE_DIVIDE
 #define	ACPI_FLUSH_CPU_CACHE()	(__acpi_wbinvd())
 
+#ifndef ACPI_DISASSEMBLER
 #define	ACPI_DISASSEMBLER
+#endif
 #define	ACPI_PACKED_POINTERS_NOT_SUPPORTED
 
 /*
diff --git a/usr/src/uts/intel/sys/archsystm.h b/usr/src/uts/intel/sys/archsystm.h
index 93fed4e87d..0c9ceac7be 100644
--- a/usr/src/uts/intel/sys/archsystm.h
+++ b/usr/src/uts/intel/sys/archsystm.h
@@ -185,13 +185,17 @@ extern void fakesoftint(void);
 extern void *plat_traceback(void *);
 
 /*
- * The following two macros are the four byte instruction sequence of stac, ret
- * and clac, ret. These are used in startup_smap() as a part of properly setting
- * up the valid instructions. For more information on SMAP, see
- * uts/intel/ia32/ml/copy.s.
+ * The following two macros are the four byte instruction sequence of stac, nop
+ * and clac, nop. These are used in startup_smap() and hotinline_smap() as a
+ * part of properly setting up the valid instructions. For more information on
+ * SMAP, see uts/intel/ia32/ml/copy.s, uts/i86pc/os/machdep.c and
+ * uts/common/os/modctl.c.
+ *
+ * Note that smap_disable and smap_enable are resolved to stubs at compile time,
+ * but inlined at runtime by do_hotinlines() in uts/i86pc/os/machdep.c.
  */
-#define	SMAP_CLAC_INSTR	0xc3ca010f
-#define	SMAP_STAC_INSTR	0xc3cb010f
+#define	SMAP_CLAC_INSTR	0x90ca010f
+#define	SMAP_STAC_INSTR	0x90cb010f
 extern void smap_disable(void);
 extern void smap_enable(void);
 
diff --git a/usr/src/uts/intel/sys/cpu_module.h b/usr/src/uts/intel/sys/cpu_module.h
index 8d801b07f5..c227acacd2 100644
--- a/usr/src/uts/intel/sys/cpu_module.h
+++ b/usr/src/uts/intel/sys/cpu_module.h
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 #ifndef _SYS_CPU_MODULE_H
@@ -163,6 +164,8 @@ extern id_t cmi_hdl_logical_id(cmi_hdl_t);
 extern uint16_t cmi_hdl_smbiosid(cmi_hdl_t);
 extern uint_t cmi_hdl_smb_chipid(cmi_hdl_t);
 extern nvlist_t *cmi_hdl_smb_bboard(cmi_hdl_t);
+extern uint_t cmi_hdl_chipsig(cmi_hdl_t);
+extern const char *cmi_hdl_chipident(cmi_hdl_t);
 
 extern int cmi_hdl_online(cmi_hdl_t, int, int *);
 
diff --git a/usr/src/uts/intel/sys/machbrand.h b/usr/src/uts/intel/sys/machbrand.h
index 3f9ebdb6b7..ad7f631649 100644
--- a/usr/src/uts/intel/sys/machbrand.h
+++ b/usr/src/uts/intel/sys/machbrand.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #ifndef _SYS_MACHBRAND_H
@@ -32,20 +33,25 @@ extern "C" {
 #ifndef	_ASM
 
 #include <sys/model.h>
+#include <sys/thread.h>
 
 struct brand_mach_ops {
 	void	(*b_sysenter)(void);
+	void	(*b_int80)(void);
 	void	(*b_int91)(void);
 	void	(*b_syscall)(void);
 	void	(*b_syscall32)(void);
+	greg_t	(*b_fixsegreg)(greg_t, model_t);
+	uintptr_t (*b_fsbase)(klwp_t *, uintptr_t);
 };
 
 #endif	/* _ASM */
 
 #define	BRAND_CB_SYSENTER	0
-#define	BRAND_CB_INT91		1
-#define	BRAND_CB_SYSCALL	2
-#define	BRAND_CB_SYSCALL32	3
+#define	BRAND_CB_INT80		1
+#define	BRAND_CB_INT91		2
+#define	BRAND_CB_SYSCALL	3
+#define	BRAND_CB_SYSCALL32	4
 
 #ifdef	__cplusplus
 }
diff --git a/usr/src/uts/intel/sys/segments.h b/usr/src/uts/intel/sys/segments.h
index fc2f1847cd..6bf18b3082 100644
--- a/usr/src/uts/intel/sys/segments.h
+++ b/usr/src/uts/intel/sys/segments.h
@@ -695,6 +695,8 @@ extern void _start(), cmnint();
 extern void achktrap(), mcetrap();
 extern void xmtrap();
 extern void fasttrap();
+extern void sys_int80();
+extern void brand_sys_int80();
 extern void dtrace_ret();
 
 /* KPTI trampolines */
@@ -710,6 +712,8 @@ extern void tr_overrun(), tr_resvtrap();
 extern void tr_achktrap(), tr_mcetrap();
 extern void tr_xmtrap();
 extern void tr_fasttrap();
+extern void tr_sys_int80();
+extern void tr_brand_sys_int80();
 extern void tr_dtrace_ret();
 
 #if !defined(__amd64)
diff --git a/usr/src/uts/intel/sys/ucontext.h b/usr/src/uts/intel/sys/ucontext.h
index 66300e71a1..2d4e39b3e8 100644
--- a/usr/src/uts/intel/sys/ucontext.h
+++ b/usr/src/uts/intel/sys/ucontext.h
@@ -20,6 +20,7 @@
  */
 
 /*
+ * Copyright 2015 Joyent, Inc.
  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  *
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
@@ -84,9 +85,16 @@ struct	__ucontext {
 	sigset_t   	uc_sigmask;
 	stack_t 	uc_stack;
 	mcontext_t 	uc_mcontext;
-	long		uc_filler[5];	/* see ABI spec for Intel386 */
+	/*
+	 * The Intel386 ABI specification includes a 5-element array of longs
+	 * called "uc_filler", padding the size of the struct to 512 bytes.  To
+	 * allow zone brands to communicate extra data right the way through
+	 * the signal handling process, from sigacthandler to setcontext, we
+	 * steal the first three of these longs as a brand-private member.
+	 */
+	void		*uc_brand_data[3];
+	long		uc_filler[2];
 };
-
 #if defined(_SYSCALL32)
 
 /* Kernel view of user ILP32 ucontext structure */
@@ -97,7 +105,8 @@ typedef struct ucontext32 {
 	sigset_t	uc_sigmask;
 	stack32_t	uc_stack;
 	mcontext32_t	uc_mcontext;
-	int32_t		uc_filler[5];
+	caddr32_t	uc_brand_data[3];
+	int32_t		uc_filler[2];
 } ucontext32_t;
 
 #if defined(_KERNEL)
diff --git a/usr/src/uts/intel/sys/x86_archext.h b/usr/src/uts/intel/sys/x86_archext.h
index e550c1d063..fb6b6f0fdb 100644
--- a/usr/src/uts/intel/sys/x86_archext.h
+++ b/usr/src/uts/intel/sys/x86_archext.h
@@ -187,7 +187,16 @@ extern "C" {
 /*
  * AMD uses %ebx for some of their features (extended function 0x80000008).
  */
-#define	CPUID_AMD_EBX_ERR_PTR_ZERO	0x00000004 /* AMD: FP Err. Ptr. Zero */
+#define	CPUID_AMD_EBX_ERR_PTR_ZERO	0x000000004 /* AMD: FP Err. Ptr. Zero */
+#define	CPUID_AMD_EBX_IBPB		0x000001000 /* AMD: IBPB */
+#define	CPUID_AMD_EBX_IBRS		0x000004000 /* AMD: IBRS */
+#define	CPUID_AMD_EBX_STIBP		0x000008000 /* AMD: STIBP */
+#define	CPUID_AMD_EBX_IBRS_ALL		0x000010000 /* AMD: Enhanced IBRS */
+#define	CPUID_AMD_EBX_STIBP_ALL		0x000020000 /* AMD: STIBP ALL */
+#define	CPUID_AMD_EBX_PREFER_IBRS	0x000040000 /* AMD: Don't retpoline */
+#define	CPUID_AMD_EBX_SSBD		0x001000000 /* AMD: SSBD */
+#define	CPUID_AMD_EBX_VIRT_SSBD		0x002000000 /* AMD: VIRT SSBD */
+#define	CPUID_AMD_EBX_SSB_NO		0x004000000 /* AMD: SSB Fixed */
 
 /*
  * Intel now seems to have claimed part of the "extended" function
@@ -243,6 +252,11 @@ extern "C" {
 
 #define	CPUID_INTC_EDX_7_0_AVX5124NNIW	0x00000004	/* AVX512 4NNIW */
 #define	CPUID_INTC_EDX_7_0_AVX5124FMAPS	0x00000008	/* AVX512 4FMAPS */
+#define	CPUID_INTC_EDX_7_0_SPEC_CTRL	0x04000000	/* Spec, IBPB, IBRS */
+#define	CPUID_INTC_EDX_7_0_STIBP	0x08000000	/* STIBP */
+#define	CPUID_INTC_EDX_7_0_FLUSH_CMD	0x10000000	/* IA32_FLUSH_CMD */
+#define	CPUID_INTC_EDX_7_0_ARCH_CAPS	0x20000000	/* IA32_ARCH_CAPS */
+#define	CPUID_INTC_EDX_7_0_SSBD		0x80000000	/* SSBD */
 
 #define	CPUID_INTC_EDX_7_0_ALL_AVX512 \
 	(CPUID_INTC_EDX_7_0_AVX5124NNIW | CPUID_INTC_EDX_7_0_AVX5124FMAPS)
@@ -334,6 +348,42 @@ extern "C" {
 #define	MSR_PRP4_LBSTK_TO_14	0x6ce
 #define	MSR_PRP4_LBSTK_TO_15	0x6cf
 
+/*
+ * General Xeon based MSRs
+ */
+#define	MSR_PPIN_CTL		0x04e
+#define	MSR_PPIN		0x04f
+#define	MSR_PLATFORM_INFO	0x0ce
+
+#define	MSR_PLATFORM_INFO_PPIN	(1 << 23)
+#define	MSR_PPIN_CTL_MASK	0x03
+#define	MSR_PPIN_CTL_LOCKED	0x01
+#define	MSR_PPIN_CTL_ENABLED	0x02
+
+/*
+ * Intel IA32_ARCH_CAPABILITIES MSR.
+ */
+#define	MSR_IA32_ARCH_CAPABILITIES		0x10a
+#define	IA32_ARCH_CAP_RDCL_NO			0x0001
+#define	IA32_ARCH_CAP_IBRS_ALL			0x0002
+#define	IA32_ARCH_CAP_RSBA			0x0004
+#define	IA32_ARCH_CAP_SKIP_L1DFL_VMENTRY	0x0008
+#define	IA32_ARCH_CAP_SSB_NO			0x0010
+
+/*
+ * Intel Speculation related MSRs
+ */
+#define	MSR_IA32_SPEC_CTRL	0x48
+#define	IA32_SPEC_CTRL_IBRS	0x01
+#define	IA32_SPEC_CTRL_STIBP	0x02
+#define	IA32_SPEC_CTRL_SSBD	0x04
+
+#define	MSR_IA32_PRED_CMD	0x49
+#define	IA32_PRED_CMD_IBPB	0x01
+
+#define	MSR_IA32_FLUSH_CMD	0x10b
+#define	IA32_FLUSH_CMD_L1D	0x01
+
 #define	MCI_CTL_VALUE		0xffffffff
 
 #define	MTRR_TYPE_UC		0
@@ -436,6 +486,18 @@ extern "C" {
 #define	X86FSET_OSPKE		68
 #define	X86FSET_PCID		69
 #define	X86FSET_INVPCID		70
+#define	X86FSET_IBRS		71
+#define	X86FSET_IBPB		72
+#define	X86FSET_STIBP		73
+#define	X86FSET_SSBD		74
+#define	X86FSET_SSBD_VIRT	75
+#define	X86FSET_RDCL_NO		76
+#define	X86FSET_IBRS_ALL	77
+#define	X86FSET_RSBA		78
+#define	X86FSET_SSB_NO		79
+#define	X86FSET_STIBP_ALL	80
+#define	X86FSET_FLUSH_CMD	81
+#define	X86FSET_L1D_VM_NO	82
 
 /*
  * Intel Deep C-State invariant TSC in leaf 0x80000007.
@@ -669,6 +731,19 @@ extern "C" {
 #define	X86_SOCKET_FS1R2	_X86_SOCKET_MKVAL(X86_VENDOR_AMD, 0x100000)
 #define	X86_SOCKET_FM2		_X86_SOCKET_MKVAL(X86_VENDOR_AMD, 0x200000)
 
+
+/*
+ * Definitions for Intel processor models. Note, these model values can overlap
+ * in a given family. Processor models are added here on an as needed basis. The
+ * Xeon extension here is to refer to what has been called the EP/EX lines or
+ * E5/E7, generally multi-socket capable processors.
+ */
+#define	INTC_MODEL_IVYBRIDGE_XEON	0x3E
+#define	INTC_MODEL_HASWELL_XEON		0x3F
+#define	INTC_MODEL_BROADWELL_XEON	0x4F
+#define	INTC_MODEL_BROADWELL_XEON_D	0x56
+#define	INTC_MODEL_SKYLAKE_XEON		0x55
+
 /*
  * xgetbv/xsetbv support
  * See section 13.3 in vol. 1 of the Intel devlopers manual.
@@ -705,7 +780,7 @@ extern "C" {
 
 #if defined(_KERNEL) || defined(_KMEMUSER)
 
-#define	NUM_X86_FEATURES	71
+#define	NUM_X86_FEATURES	83
 extern uchar_t x86_featureset[];
 
 extern void free_x86_featureset(void *featureset);
@@ -724,6 +799,8 @@ extern uint_t pentiumpro_bug4046376;
 
 extern const char CyrixInstead[];
 
+extern void (*spec_l1d_flush)(void);
+
 #endif
 
 #if defined(_KERNEL)
@@ -818,6 +895,8 @@ extern void cpuid_pass3(struct cpu *);
 extern void cpuid_pass4(struct cpu *, uint_t *);
 extern void cpuid_set_cpu_properties(void *, processorid_t,
     struct cpuid_info *);
+extern void cpuid_pass_ucode(struct cpu *, uchar_t *);
+extern void cpuid_post_ucodeadm(void);
 
 extern void cpuid_get_addrsize(struct cpu *, uint_t *, uint_t *);
 extern uint_t cpuid_get_dtlb_nent(struct cpu *, size_t);
@@ -902,6 +981,7 @@ extern void reset_gdtr_limit(void);
 #define	HVSIG_VMWARE	"VMwareVMware"
 #define	HVSIG_KVM	"KVMKVMKVM"
 #define	HVSIG_MICROSOFT	"Microsoft Hv"
+#define	HVSIG_BHYVE	"bhyve bhyve "
 
 /*
  * Defined hardware environments
@@ -913,8 +993,10 @@ extern void reset_gdtr_limit(void);
 #define	HW_VMWARE	(1 << 3)	/* Running on VMware hypervisor */
 #define	HW_KVM		(1 << 4)	/* Running on KVM hypervisor */
 #define	HW_MICROSOFT	(1 << 5)	/* Running on Microsoft hypervisor */
+#define	HW_BHYVE	(1 << 6)	/* Running on bhyve hypervisor */
 
-#define	HW_VIRTUAL	(HW_XEN_HVM | HW_VMWARE | HW_KVM | HW_MICROSOFT)
+#define	HW_VIRTUAL	(HW_XEN_HVM | HW_VMWARE | HW_KVM | HW_MICROSOFT | \
+	    HW_BHYVE)
 
 #endif	/* _KERNEL */
 
diff --git a/usr/src/uts/intel/vmxnet/Makefile b/usr/src/uts/intel/vmxnet/Makefile
new file mode 100644
index 0000000000..4f3ebcf5af
--- /dev/null
+++ b/usr/src/uts/intel/vmxnet/Makefile
@@ -0,0 +1,93 @@
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2012, Joyent, Inc. All rights reserved.
+# Use is subject to license terms.
+#
+
+#
+# VMware Ethernet Adapter b module
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE = ../..
+UTSCLOSED = ../../../../closed/uts
+
+#
+#       Define the module and object file sets.
+#
+MODULE		= vmxnet
+#
+ROOTMODULE      = $(ROOT_DRV_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/intel/io/vmxnet
+
+#
+#       Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+# The list of object files is defined here, rather than in Makefile.files,
+# because the "$(CLOSED_BUILD)" macro has not been defined at the time
+# Makefile.files is processed.
+#
+VMXNET_OBJS += vmxnet.o
+
+OBJECTS		= $(VMXNET_OBJS:%=$(OBJS_DIR)/%)
+LINTS           = $(VMXNET_OBJS:%.o=$(LINTS_DIR)/%.ln)
+
+#
+#       Define targets
+#
+ALL_TARGET      = $(BINARY) $(SRC_CONFFILE)
+LINT_TARGET     = $(LINT_MODULE).lint
+INSTALL_TARGET  = $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+CPPFLAGS +=  -I$(UTSBASE)/i86pc
+LDFLAGS += -dy -N misc/gld
+
+#
+#       Default build targets.
+#
+.KEEP_STATE:
+
+def:            $(DEF_DEPS)
+
+all:            $(ALL_DEPS)
+
+clean:          $(CLEAN_DEPS)
+
+clobber:        $(CLOBBER_DEPS)
+
+#
+# Intentionally don't build lint libraries to minimize divergence with
+# the upstream source.
+#
+lint:
+modlintlib:
+clean.lint:
+
+install:        $(INSTALL_DEPS)
+
+#
+#       Include common targets.
+#
+include ../Makefile.targ
diff --git a/usr/src/uts/intel/vnd/Makefile b/usr/src/uts/intel/vnd/Makefile
new file mode 100644
index 0000000000..b94d014eb7
--- /dev/null
+++ b/usr/src/uts/intel/vnd/Makefile
@@ -0,0 +1,59 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2018 Joyent, Inc.
+#
+
+UTSBASE	= ../..
+
+MODULE		= vnd
+OBJECTS		= $(VND_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(VND_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_DRV_DIR)/$(MODULE)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
+
+ALL_TARGET	= $(BINARY) $(SRC_CONFILE)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+CONF_SRCDIR	= $(UTSBASE)/common/io/vnd
+
+CPPFLAGS	+= -I$(UTSBASE)/i86pc
+LDFLAGS		+= -dy -Nmisc/neti -Nmisch/hook -Nfs/dev -Nmisc/gsqueue
+
+#
+# We use <sys/ctype.h> which causes gcc to think that all of its inline
+# functions are defined and unused.
+#
+CERRWARN	+= -_gcc=-Wno-unused-function
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/vxlan/Makefile b/usr/src/uts/intel/vxlan/Makefile
new file mode 100644
index 0000000000..89a24c17f5
--- /dev/null
+++ b/usr/src/uts/intel/vxlan/Makefile
@@ -0,0 +1,51 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2015 Joyent, Inc.
+#
+
+UTSBASE = ../..
+
+MODULE          = vxlan
+OBJECTS         = $(OVERLAY_VXLAN_OBJS:%=$(OBJS_DIR)/%)
+LINTS           = $(OVERLAY_VXLAN_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE      = $(ROOT_OVERLAY_DIR)/$(MODULE)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET      = $(BINARY)
+LINT_TARGET     = $(MODULE).lint
+INSTALL_TARGET  = $(BINARY) $(ROOTMODULE)
+
+LDFLAGS += -dy -Ndrv/overlay -Ndrv/ip
+
+LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
+
+.KEEP_STATE:
+
+def:            $(DEF_DEPS)
+
+all:            $(ALL_DEPS)
+
+clean:          $(CLEAN_DEPS)
+
+clobber:        $(CLOBBER_DEPS)
+
+lint:           $(LINT_DEPS)
+
+modlintlib:     $(MODLINTLIB_DEPS)
+
+clean.lint:     $(CLEAN_LINT_DEPS)
+
+install:        $(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/zfd/Makefile b/usr/src/uts/intel/zfd/Makefile
new file mode 100644
index 0000000000..c270466d08
--- /dev/null
+++ b/usr/src/uts/intel/zfd/Makefile
@@ -0,0 +1,48 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2014 Joyent, Inc.  All rights reserved.
+#
+# uts/intel/zfd/Makefile
+
+UTSBASE	= ../..
+
+MODULE		= zfd
+OBJECTS		= $(ZFD_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(ZFD_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+
+include $(UTSBASE)/intel/Makefile.intel
+
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+include $(UTSBASE)/intel/Makefile.targ
diff --git a/usr/src/uts/intel/zfs/Makefile b/usr/src/uts/intel/zfs/Makefile
index a4a2f4a561..07d4395c22 100644
--- a/usr/src/uts/intel/zfs/Makefile
+++ b/usr/src/uts/intel/zfs/Makefile
@@ -29,6 +29,7 @@
 #
 # Copyright (c) 2016 by Delphix. All rights reserved.
 #
+# Copyright 2018 Joyent, Inc.
 
 #
 #	Path to the base of the uts directory tree (usually /usr/src/uts).
@@ -72,6 +73,7 @@ INC_PATH	+= -I$(UTSBASE)/common/fs/zfs/lua
 INC_PATH	+= -I$(SRC)/common
 INC_PATH	+= -I$(COMMONBASE)/zfs
 
+CPPFLAGS	+= -I$(UTSBASE)/i86pc
 C99LMODE=	-Xc99=%all
 
 #
diff --git a/usr/src/uts/req.flg b/usr/src/uts/req.flg
index ffbaa3f643..15085a486d 100644
--- a/usr/src/uts/req.flg
+++ b/usr/src/uts/req.flg
@@ -22,6 +22,7 @@
 #
 # Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 
 #
@@ -37,6 +38,7 @@ echo_file usr/src/Makefile
 
 # For full builds (open and closed), we want both etc/certs and
 # etc/keys.  For an open source build, there's no etc/keys directory.
+find_files "s.*" usr/contrib/freebsd
 find_files "s.*" usr/src/cmd/cmd-crypto/etc
 find_files "s.*" usr/src/common/acl
 find_files "s.*" usr/src/common/atomic
@@ -56,4 +58,5 @@ find_files "s.*" usr/src/common/smbios
 find_files "s.*" usr/src/common/tsol
 find_files "s.*" usr/src/common/util
 find_files "s.*" usr/src/common/zfs
+find_files "s.*" usr/src/compat/freebsd
 find_files "s.*" usr/src/psm/promif
diff --git a/usr/src/uts/sfmmu/vm/hat_sfmmu.c b/usr/src/uts/sfmmu/vm/hat_sfmmu.c
index b7539c828c..2ef3ea20e8 100644
--- a/usr/src/uts/sfmmu/vm/hat_sfmmu.c
+++ b/usr/src/uts/sfmmu/vm/hat_sfmmu.c
@@ -24,6 +24,7 @@
 /*
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2016 Gary Mills
+ * Copyright 2017 Joyent, Inc.
  */
 
 /*
@@ -85,6 +86,7 @@
 #include <sys/fpu/fpusystm.h>
 #include <vm/mach_kpm.h>
 #include <sys/callb.h>
+#include <sys/zone.h>
 
 #ifdef	DEBUG
 #define	SFMMU_VALIDATE_HMERID(hat, rid, saddr, len)			\
@@ -933,6 +935,7 @@ static kphysm_setup_vector_t sfmmu_update_vec = {
 	}							\
 	pp->p_mapping = hme;					\
 	pp->p_share++;						\
+	zone_add_page(pp);					\
 }
 
 /*
@@ -953,6 +956,7 @@ static kphysm_setup_vector_t sfmmu_update_vec = {
 								\
 	ASSERT(pp->p_share > 0);				\
 	pp->p_share--;						\
+	zone_rm_page(pp);					\
 								\
 	if (hme->hme_prev) {					\
 		ASSERT(pp->p_mapping != hme);			\
@@ -7350,6 +7354,8 @@ retry:
 	tpp->p_mapping = NULL;
 	dpp->p_share = tpp->p_share;
 	tpp->p_share = 0;
+	dpp->p_zoneid = tpp->p_zoneid;
+	tpp->p_zoneid = ALL_ZONES;
 
 	while (index != 0) {
 		index = index >> 1;
diff --git a/usr/src/uts/sparc/Makefile.sparc b/usr/src/uts/sparc/Makefile.sparc
index 2b193b20f4..31e09fdc78 100644
--- a/usr/src/uts/sparc/Makefile.sparc
+++ b/usr/src/uts/sparc/Makefile.sparc
@@ -220,7 +220,7 @@ DRV_KMODS	+= log logindmux kssl mm nca physmem pm poll pool
 DRV_KMODS	+= pseudo ptc ptm pts ptsl ramdisk random rsm rts sad
 DRV_KMODS	+= simnet softmac sppp sppptun sy sysevent sysmsg
 DRV_KMODS	+= spdsock
-DRV_KMODS	+= tcp tcp6 timerfd tl tnf ttymux udp udp6 wc winlock zcons
+DRV_KMODS	+= tcp tcp6 timerfd tl tnf ttymux udp udp6 wc winlock zcons zfd
 DRV_KMODS	+= ippctl
 DRV_KMODS	+= dld
 DRV_KMODS	+= ipd
@@ -240,8 +240,10 @@ DRV_KMODS	+= nulldriver
 DRV_KMODS	+= bridge trill
 DRV_KMODS	+= bpf
 DRV_KMODS	+= dca
+DRV_KMODS	+= inotify
 DRV_KMODS	+= eventfd
 DRV_KMODS	+= signalfd
+DRV_KMODS	+= timerfd
 
 #
 #       Hardware Drivers in common space
@@ -486,6 +488,7 @@ SOCKET_KMODS	+= socksctp
 SOCKET_KMODS	+= socksdp
 SOCKET_KMODS	+= sockrds
 SOCKET_KMODS	+= ksslf
+SOCKET_KMODS	+= datafilt
 
 #
 #	kiconv modules (/kernel/kiconv):
diff --git a/usr/src/uts/sparc/bpf/Makefile b/usr/src/uts/sparc/bpf/Makefile
index 7fa0e7d76c..8661ccd96e 100644
--- a/usr/src/uts/sparc/bpf/Makefile
+++ b/usr/src/uts/sparc/bpf/Makefile
@@ -60,7 +60,7 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 #
 #
 CFLAGS		+= $(CCVERBOSE)
-LDFLAGS		+= -dy -Nmisc/mac -Nmisc/dls -Ndrv/ipnet -Nmisc/neti
+LDFLAGS		+= -dy -Nmisc/mac -Nmisc/dls -Ndrv/ipnet -Nmisc/neti -Ndrv/ip
 INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
diff --git a/usr/src/uts/sparc/chxge/Makefile b/usr/src/uts/sparc/chxge/Makefile
index 2a19c82e25..da43a14bee 100644
--- a/usr/src/uts/sparc/chxge/Makefile
+++ b/usr/src/uts/sparc/chxge/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 
 #
@@ -69,9 +70,9 @@ CFLAGS		+= -DSUN_KSTATS -DHOST_PAUSE -DTX_CKSUM_FIX -DTX_THREAD_RECLAIM
 # CFLAGS		+= -DCH_DEBUG=1 -DPE_DBGOUT_ENABLED=1
 
 #
-#	Driver depends on GLD & IP
+#	Driver depends on GLD, IP, and MAC
 #
-LDFLAGS		+= -dy -N misc/gld -N drv/ip
+LDFLAGS		+= -dy -N misc/gld -N drv/ip -N misc/mac
 
 #	Lint flag
 #
diff --git a/usr/src/uts/sparc/datafilt/Makefile b/usr/src/uts/sparc/datafilt/Makefile
new file mode 100644
index 0000000000..80969500ef
--- /dev/null
+++ b/usr/src/uts/sparc/datafilt/Makefile
@@ -0,0 +1,73 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2011, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2012, Nexenta Systems, Inc. All rights reserved.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= datafilt
+OBJECTS		= $(DATAFILT_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(DATAFILT_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(ROOT_SOCK_DIR)/$(MODULE)
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/sparc/Makefile.sparc
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+#
+# lint pass one enforcement and OS version
+#
+CFLAGS += $(CCVERBOSE)
+
+LDFLAGS += -dy -Nfs/sockfs -Ndrv/ip
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/sparc/Makefile.targ
diff --git a/usr/src/uts/sparc/dld/Makefile b/usr/src/uts/sparc/dld/Makefile
index b4b1c63377..2e6b29b719 100644
--- a/usr/src/uts/sparc/dld/Makefile
+++ b/usr/src/uts/sparc/dld/Makefile
@@ -57,7 +57,6 @@ CFLAGS				+= $(CCVERBOSE)
 $(RELEASE_BUILD)CFLAGS		+= -xinline=auto -xcrossfile
 $(RELEASE_BUILD)COPTIMIZE	= -xO5
 LDFLAGS				+= -dy -N misc/dls -N misc/mac
-INC_PATH			+= -I$(UTSBASE)/common/io/bpf
 
 #
 # For now, disable these lint checks; maintainers should endeavor
diff --git a/usr/src/uts/sparc/dls/Makefile b/usr/src/uts/sparc/dls/Makefile
index a7c278e543..3f15600549 100644
--- a/usr/src/uts/sparc/dls/Makefile
+++ b/usr/src/uts/sparc/dls/Makefile
@@ -55,7 +55,6 @@ CFLAGS				+= $(CCVERBOSE)
 $(RELEASE_BUILD)CFLAGS		+= -xinline=auto -xcrossfile
 $(RELEASE_BUILD)COPTIMIZE	= -xO5
 LDFLAGS				+= -dy -N misc/mac
-INC_PATH			+= -I$(UTSBASE)/common/io/bpf
 
 #
 # For now, disable these lint checks; maintainers should endeavor
diff --git a/usr/src/uts/sparc/dtrace/dtrace_isa.c b/usr/src/uts/sparc/dtrace/dtrace_isa.c
index 20d9bc420b..541f733b06 100644
--- a/usr/src/uts/sparc/dtrace/dtrace_isa.c
+++ b/usr/src/uts/sparc/dtrace/dtrace_isa.c
@@ -24,7 +24,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright 2011 Joyent, Inc.  All rights reserved.
+ * Copyright 2017 Joyent, Inc.
  */
 
 #include <sys/dtrace_impl.h>
@@ -940,6 +940,15 @@ got_fp:
 	return (value);
 }
 
+/* ARGSUSED */
+int
+dtrace_setreg(struct regs *rp, uint_t reg, ulong_t val)
+{
+	/* Not supported at this time */
+	DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
+	return (0);
+}
+
 /*ARGSUSED*/
 uint64_t
 dtrace_getvmreg(uint_t ndx, volatile uint16_t *flags)
diff --git a/usr/src/uts/sparc/icmp/Makefile b/usr/src/uts/sparc/icmp/Makefile
index 55c11a1ea0..a35e66abd6 100644
--- a/usr/src/uts/sparc/icmp/Makefile
+++ b/usr/src/uts/sparc/icmp/Makefile
@@ -22,6 +22,7 @@
 # uts/sparc/icmp/Makefile
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2016 Joyent, Inc.
 #
 #	This makefile drives the production of the icmp IP driver
 #
@@ -62,6 +63,8 @@ ALL_TARGET	= $(BINARY) $(SRC_CONFFILE)
 LINT_TARGET	= $(MODULE).lint
 INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOTLINK) $(ROOT_CONFFILE)
 
+INC_PATH	+= -I$(UTSBASE)/common/io/bpf
+
 #
 # lint pass one enforcement
 #
diff --git a/usr/src/uts/sparc/inotify/Makefile b/usr/src/uts/sparc/inotify/Makefile
new file mode 100644
index 0000000000..ce2b956955
--- /dev/null
+++ b/usr/src/uts/sparc/inotify/Makefile
@@ -0,0 +1,70 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2014 Joyent, Inc.  All rights reserved.
+#
+
+#
+#	Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= inotify
+OBJECTS		= $(INOTIFY_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(INOTIFY_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+CONF_SRCDIR	= $(UTSBASE)/common/io
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/sparc/Makefile.sparc
+
+LINTTAGS	+= -erroff=E_STRUCT_DERIVED_FROM_FLEX_MBR
+CERRWARN	+= -_gcc=-Wno-parentheses
+LDFLAGS		+= -dy -Nfs/specfs
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY) $(SRC_CONFILE)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/sparc/Makefile.targ
diff --git a/usr/src/uts/sparc/ip/ip.global-objs.debug64 b/usr/src/uts/sparc/ip/ip.global-objs.debug64
index 3098f98265..d189c7a47c 100644
--- a/usr/src/uts/sparc/ip/ip.global-objs.debug64
+++ b/usr/src/uts/sparc/ip/ip.global-objs.debug64
@@ -21,7 +21,7 @@
 #
 # Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2011 Nexenta Systems, Inc. All rights reserved
-# Copyright 2012 Joyent, Inc. All rights reserved
+# Copyright 2017 Joyent, Inc.
 #
 
 arp_m_tbl
@@ -143,7 +143,6 @@ ip_squeue_create_callback
 ip_squeue_enter
 ip_squeue_fanout
 ip_squeue_flag
-ip_squeue_worker_wait
 ip_thread_data
 ip_thread_list
 ip_thread_rwlock
@@ -255,8 +254,6 @@ squeue_drain_ms
 squeue_drain_ns
 squeue_drain_stack_needed
 squeue_drain_stack_toodeep
-squeue_workerwait_ms
-squeue_workerwait_tick
 tcp_acceptor_rinit
 tcp_acceptor_winit
 tcp_conn_cache
diff --git a/usr/src/uts/sparc/ip/ip.global-objs.obj64 b/usr/src/uts/sparc/ip/ip.global-objs.obj64
index f182d7198e..e2b81e66a0 100644
--- a/usr/src/uts/sparc/ip/ip.global-objs.obj64
+++ b/usr/src/uts/sparc/ip/ip.global-objs.obj64
@@ -21,7 +21,7 @@
 #
 # Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2011 Nexenta Systems, Inc. All rights reserved
-# Copyright 2012 Joyent, Inc. All rights reserved
+# Copyright 2017 Joyent, Inc.
 #
 
 arp_m_tbl
@@ -143,7 +143,6 @@ ip_squeue_create_callback
 ip_squeue_enter
 ip_squeue_fanout
 ip_squeue_flag
-ip_squeue_worker_wait
 ip_thread_data
 ip_thread_list
 ip_thread_rwlock
@@ -252,8 +251,6 @@ squeue_drain_ms
 squeue_drain_ns
 squeue_drain_stack_needed
 squeue_drain_stack_toodeep
-squeue_workerwait_ms
-squeue_workerwait_tick
 tcp_acceptor_rinit
 tcp_acceptor_winit
 tcp_conn_cache
diff --git a/usr/src/uts/sparc/ipf/Makefile b/usr/src/uts/sparc/ipf/Makefile
index 5ed794ece5..a8bfc7171a 100644
--- a/usr/src/uts/sparc/ipf/Makefile
+++ b/usr/src/uts/sparc/ipf/Makefile
@@ -21,6 +21,7 @@
 #
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018 Joyent, Inc.
 #
 # uts/sparc/ipf/Makefile
 #
@@ -64,6 +65,7 @@ CFLAGS += $(CCVERBOSE)
 CPPFLAGS += -DIPFILTER_LKM -DIPFILTER_LOG -DIPFILTER_LOOKUP 
 CPPFLAGS += -DSUNDDI -DSOLARIS2=$(RELEASE_MINOR) -DIRE_ILL_CN -DUSE_INET6
 LDFLAGS += -dy -Ndrv/ip -Nmisc/md5 -Nmisc/neti -Nmisc/hook -Nmisc/kcf
+LDFLAGS += -Nmisc/mac
 
 INC_PATH += -I$(UTSBASE)/common/inet/ipf
 
diff --git a/usr/src/uts/sparc/ipf/ipf.global-objs.debug64 b/usr/src/uts/sparc/ipf/ipf.global-objs.debug64
index 663613cee3..cb3e5485b2 100644
--- a/usr/src/uts/sparc/ipf/ipf.global-objs.debug64
+++ b/usr/src/uts/sparc/ipf/ipf.global-objs.debug64
@@ -25,6 +25,10 @@
 # Copyright 2013 Joyent, Inc. All rights reserved
 #
 
+hook4_vnd_in
+hook4_vnd_out
+hook6_vnd_in
+hook6_vnd_out
 fr_availfuncs
 fr_features
 fr_objbytes
diff --git a/usr/src/uts/sparc/iptun/Makefile b/usr/src/uts/sparc/iptun/Makefile
index fc09008ab2..d63689a37a 100644
--- a/usr/src/uts/sparc/iptun/Makefile
+++ b/usr/src/uts/sparc/iptun/Makefile
@@ -54,7 +54,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 #
 CFLAGS 		+= $(CCVERBOSE)
 LDFLAGS 	+= -dy -Ndrv/dld -Nmisc/dls -Nmisc/mac -Ndrv/ip
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
 LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
diff --git a/usr/src/uts/sparc/mac/Makefile b/usr/src/uts/sparc/mac/Makefile
index 0995eaa299..3570c534b0 100644
--- a/usr/src/uts/sparc/mac/Makefile
+++ b/usr/src/uts/sparc/mac/Makefile
@@ -60,7 +60,6 @@ CFLAGS				+= $(CCVERBOSE)
 $(RELEASE_BUILD)CFLAGS		+= -xinline=auto -xcrossfile
 $(RELEASE_BUILD)COPTIMIZE	= -xO5
 LDFLAGS				+= -dy
-INC_PATH			+= -I$(UTSBASE)/common/io/bpf
 
 LINTTAGS			+= -erroff=E_PTRDIFF_OVERFLOW
 LINTTAGS			+= -erroff=E_BAD_PTR_CAST_ALIGN
diff --git a/usr/src/uts/sparc/mac_ether/Makefile b/usr/src/uts/sparc/mac_ether/Makefile
index 3ec066d4c6..b0acd20b30 100644
--- a/usr/src/uts/sparc/mac_ether/Makefile
+++ b/usr/src/uts/sparc/mac_ether/Makefile
@@ -56,7 +56,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -N misc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/sparc/mac_ib/Makefile b/usr/src/uts/sparc/mac_ib/Makefile
index 339b88fb6b..7d4250d54f 100644
--- a/usr/src/uts/sparc/mac_ib/Makefile
+++ b/usr/src/uts/sparc/mac_ib/Makefile
@@ -56,7 +56,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -N misc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/sparc/mac_wifi/Makefile b/usr/src/uts/sparc/mac_wifi/Makefile
index 66dcd3ac3f..0120e8404b 100644
--- a/usr/src/uts/sparc/mac_wifi/Makefile
+++ b/usr/src/uts/sparc/mac_wifi/Makefile
@@ -58,7 +58,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS		+= $(CCVERBOSE)
 LDFLAGS		+= -dy -Nmisc/mac
-INC_PATH	+= -I$(UTSBASE)/common/io/bpf
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/sparc/sockpfp/Makefile b/usr/src/uts/sparc/sockpfp/Makefile
index 007eea8053..d01d241549 100644
--- a/usr/src/uts/sparc/sockpfp/Makefile
+++ b/usr/src/uts/sparc/sockpfp/Makefile
@@ -58,7 +58,7 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 CFLAGS += $(CCVERBOSE)
 
-LDFLAGS += -dy -Nfs/sockfs -Nmisc/dls -Nmisc/mac -Ndrv/bpf -Ndrv/ip
+LDFLAGS += -dy -Nfs/sockfs -Nmisc/dls -Nmisc/mac -Ndrv/ip
 INC_PATH += -I$(UTSBASE)/common/inet/sockmods -I$(UTSBASE)/common/io/bpf
 
 #
diff --git a/usr/src/uts/sparc/spdsock/Makefile b/usr/src/uts/sparc/spdsock/Makefile
index 85adf6a5d3..6ed0ae89d2 100644
--- a/usr/src/uts/sparc/spdsock/Makefile
+++ b/usr/src/uts/sparc/spdsock/Makefile
@@ -61,11 +61,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 LDFLAGS += -dy -Ndrv/ip
 
 #
-# Overrides
-#
-INC_PATH += -I$(UTSBASE)/common/io/bpf
-
-#
 # lint pass one enforcement
 #
 CFLAGS += $(CCVERBOSE)
diff --git a/usr/src/uts/sparc/syscall/getcontext.c b/usr/src/uts/sparc/syscall/getcontext.c
index c9adb54b86..3c8dbf9190 100644
--- a/usr/src/uts/sparc/syscall/getcontext.c
+++ b/usr/src/uts/sparc/syscall/getcontext.c
@@ -20,6 +20,9 @@
  */
 
 /*
+ * Copyright 2015 Joyent, Inc.
+ */
+/*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
@@ -110,10 +113,15 @@ savecontext(ucontext_t *ucp, const k_sigset_t *mask)
 		ucp->uc_flags &= ~UC_FPU;
 	ucp->uc_mcontext.gwins = (gwindows_t *)NULL;
 
-	/*
-	 * Save signal mask.
-	 */
-	sigktou(mask, &ucp->uc_sigmask);
+	if (mask != NULL) {
+		/*
+		 * Save signal mask.
+		 */
+		sigktou(mask, &ucp->uc_sigmask);
+	} else {
+		ucp->uc_flags &= ~UC_SIGMASK;
+		bzero(&ucp->uc_sigmask, sizeof (ucp->uc_sigmask));
+	}
 }
 
 
@@ -412,11 +420,16 @@ savecontext32(ucontext32_t *ucp, const k_sigset_t *mask, struct fq32 *dfq)
 		ucp->uc_flags &= ~UC_FPU;
 	ucp->uc_mcontext.gwins = (caddr32_t)NULL;
 
-	/*
-	 * Save signal mask (the 32- and 64-bit sigset_t structures are
-	 * identical).
-	 */
-	sigktou(mask, (sigset_t *)&ucp->uc_sigmask);
+	if (mask != NULL) {
+		/*
+		 * Save signal mask (the 32- and 64-bit sigset_t structures are
+		 * identical).
+		 */
+		sigktou(mask, (sigset_t *)&ucp->uc_sigmask);
+	} else {
+		ucp->uc_flags &= ~UC_SIGMASK;
+		bzero(&ucp->uc_sigmask, sizeof (ucp->uc_sigmask));
+	}
 }
 
 int
diff --git a/usr/src/uts/sparc/zfd/Makefile b/usr/src/uts/sparc/zfd/Makefile
new file mode 100644
index 0000000000..ebdba686b4
--- /dev/null
+++ b/usr/src/uts/sparc/zfd/Makefile
@@ -0,0 +1,50 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2014 Joyent, Inc.  All rights reserved.
+#
+# uts/intel/zfd/Makefile
+
+UTSBASE	= ../..
+
+MODULE		= zfd
+OBJECTS		= $(ZFD_OBJS:%=$(OBJS_DIR)/%)
+LINTS		= $(ZFD_OBJS:%.o=$(LINTS_DIR)/%.ln)
+ROOTMODULE	= $(USR_DRV_DIR)/$(MODULE)
+
+include $(UTSBASE)/sparc/Makefile.sparc
+
+ALL_TARGET	= $(BINARY)
+LINT_TARGET	= $(MODULE).lint
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
+
+CFLAGS		+= $(CCVERBOSE)
+
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+lint:		$(LINT_DEPS)
+
+modlintlib:	$(MODLINTLIB_DEPS)
+
+clean.lint:	$(CLEAN_LINT_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+include $(UTSBASE)/sparc/Makefile.targ
diff --git a/usr/src/uts/sparc/zfs/Makefile b/usr/src/uts/sparc/zfs/Makefile
index f32b408306..617d495325 100644
--- a/usr/src/uts/sparc/zfs/Makefile
+++ b/usr/src/uts/sparc/zfs/Makefile
@@ -29,6 +29,8 @@
 #
 # Copyright (c) 2016 by Delphix. All rights reserved.
 #
+# Copyright 2018 Joyent, Inc.
+#
 
 #
 #	Path to the base of the uts directory tree (usually /usr/src/uts).
@@ -74,6 +76,7 @@ INC_PATH	+= -I$(UTSBASE)/common/fs/zfs
 INC_PATH	+= -I$(UTSBASE)/common/fs/zfs/lua
 INC_PATH	+= -I$(SRC)/common
 INC_PATH	+= -I$(COMMONBASE)/zfs
+INC_PATH	+= -I$(UTSBASE)/sun4
 
 C99LMODE=	-Xc99=%all
 
diff --git a/usr/src/uts/sun4/io/px/px_fm.c b/usr/src/uts/sun4/io/px/px_fm.c
index fe958d56bd..9db9e7e50a 100644
--- a/usr/src/uts/sun4/io/px/px_fm.c
+++ b/usr/src/uts/sun4/io/px/px_fm.c
@@ -756,6 +756,7 @@ px_get_pfd(px_t *px_p) {
 	}
 
 	pfd_p->pe_severity_flags = 0;
+	pfd_p->pe_severity_mask = 0;
 	pfd_p->pe_orig_severity_flags = 0;
 	pfd_p->pe_valid = B_TRUE;
 
diff --git a/usr/src/uts/sun4/os/machdep.c b/usr/src/uts/sun4/os/machdep.c
index 556dbd71e1..970d5a4125 100644
--- a/usr/src/uts/sun4/os/machdep.c
+++ b/usr/src/uts/sun4/os/machdep.c
@@ -899,3 +899,13 @@ lbolt_softint_post(void)
 {
 	setsoftint(lbolt_softint_inum);
 }
+
+void
+thread_splitstack_run(caddr_t addr, void (*func)(void *), void *)
+{
+	panic("thread_splitstack() not supported on SPARC");
+}
+
+void
+thread_splitstack_cleanup(void)
+{}
diff --git a/usr/src/uts/sun4/os/startup.c b/usr/src/uts/sun4/os/startup.c
index 7cc7074c10..6ebb07412f 100644
--- a/usr/src/uts/sun4/os/startup.c
+++ b/usr/src/uts/sun4/os/startup.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2016 by Delphix. All rights reserved.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/machsystm.h>
@@ -2054,7 +2055,7 @@ startup_vm(void)
 
 		(void) seg_attach(&kas, segzio_base, mmu_ptob(segziosize),
 		    &kzioseg);
-		(void) segkmem_zio_create(&kzioseg);
+		(void) segkmem_create(&kzioseg);
 
 		/* create zio area covering new segment */
 		segkmem_zio_init(segzio_base, mmu_ptob(segziosize));
@@ -2438,7 +2439,7 @@ memlist_new(uint64_t start, uint64_t len, struct memlist **memlistp)
  */
 static void
 memlist_add(uint64_t start, uint64_t len, struct memlist **memlistp,
-	struct memlist **curmemlistp)
+    struct memlist **curmemlistp)
 {
 	struct memlist *new = *memlistp;
 
diff --git a/usr/src/uts/sun4/sys/ht.h b/usr/src/uts/sun4/sys/ht.h
new file mode 100644
index 0000000000..831891979f
--- /dev/null
+++ b/usr/src/uts/sun4/sys/ht.h
@@ -0,0 +1,37 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ */
+
+#ifndef	_SYS_HT_H
+#define	_SYS_HT_H
+
+#include <sys/types.h>
+#include <sys/thread.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	ht_init() {}
+
+#define	ht_should_run(t, c) (B_TRUE)
+#define	ht_adjust_cpu_score(t, c, p) (p)
+#define	ht_mark_safe(void) {}
+#define	ht_mark_unsafe(void) {}
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SYS_HT_H */
diff --git a/usr/src/uts/sun4u/io/pci/pcisch.c b/usr/src/uts/sun4u/io/pci/pcisch.c
index 27916bcc74..2a2bd05970 100644
--- a/usr/src/uts/sun4u/io/pci/pcisch.c
+++ b/usr/src/uts/sun4u/io/pci/pcisch.c
@@ -2973,11 +2973,12 @@ iommu_tlb_scrub(iommu_t *iommu_p, int scrub)
 		"\tContext=%lx %sWritable %sStreamable\n"
 		"\tPCI Page Size=%sk Address in page %lx\n",
 		    ddi_driver_name(dip), ddi_get_instance(dip), errstat, i,
-		    (tag & TLBTAG_CONTEXT_BITS) >> TLBTAG_CONTEXT_SHIFT,
+		    (uint64_t)(tag & TLBTAG_CONTEXT_BITS) >>
+		    TLBTAG_CONTEXT_SHIFT,
 		    (tag & TLBTAG_WRITABLE_BIT) ? "" : neg,
 		    (tag & TLBTAG_STREAM_BIT) ? "" : neg,
 		    (tag & TLBTAG_PGSIZE_BIT) ? "64" : "8",
-		    (tag & TLBTAG_PCIVPN_BITS) << 13);
+		    (uint64_t)(tag & TLBTAG_PCIVPN_BITS) << 13);
 		cmn_err(CE_CONT, "Memory: %sValid %sCacheable Page Frame=%lx\n",
 		    (data & TLBDATA_VALID_BIT) ? "" : neg,
 		    (data & TLBDATA_CACHE_BIT) ? "" : neg, pfn);
diff --git a/usr/src/uts/sun4u/sys/Makefile b/usr/src/uts/sun4u/sys/Makefile
index 8e73425995..a69a2b14f1 100644
--- a/usr/src/uts/sun4u/sys/Makefile
+++ b/usr/src/uts/sun4u/sys/Makefile
@@ -21,7 +21,7 @@
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# uts/sun4u/sys/Makefile
+# Copyright 2018 Joyent, Inc.
 #
 UTSBASE	= ../..
 
@@ -40,18 +40,19 @@ SUN4_HDRS=			\
 	clock.h			\
 	cmp.h			\
 	cpc_ultra.h		\
-	cpu_sgnblk_defs.h 	\
+	cpu_sgnblk_defs.h	\
 	ddi_subrdefs.h		\
 	dvma.h			\
 	eeprom.h		\
 	errclassify.h		\
 	fcode.h			\
 	fc_plat.h		\
+	ht.h			\
 	idprom.h		\
 	intr.h			\
 	intreg.h		\
 	ivintr.h		\
-	memlist_plat.h  	\
+	memlist_plat.h		\
 	memnode.h		\
 	nexusdebug.h		\
 	prom_debug.h		\
diff --git a/usr/src/uts/sun4v/io/vnet.c b/usr/src/uts/sun4v/io/vnet.c
index c9e378f89e..f30ef8e2d4 100644
--- a/usr/src/uts/sun4v/io/vnet.c
+++ b/usr/src/uts/sun4v/io/vnet.c
@@ -22,6 +22,7 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -2405,7 +2406,7 @@ vnet_rx_ring_start(mac_ring_driver_t arg, uint64_t mr_gen_num)
 		return (0);
 	}
 
-	err = mac_hwring_start(rx_ringp->hw_rh);
+	err = mac_hwring_activate(rx_ringp->hw_rh);
 	if (err == 0) {
 		rx_ringp->gen_num = mr_gen_num;
 		rx_ringp->state |= VNET_RXRING_STARTED;
@@ -2443,7 +2444,7 @@ vnet_rx_ring_stop(mac_ring_driver_t arg)
 		return;
 	}
 
-	mac_hwring_stop(rx_ringp->hw_rh);
+	mac_hwring_quiesce(rx_ringp->hw_rh);
 	rx_ringp->state &= ~VNET_RXRING_STARTED;
 }
 
@@ -2846,7 +2847,7 @@ vnet_bind_hwrings(vnet_t *vnetp)
 
 		/* Start the hwring if needed */
 		if (rx_ringp->state & VNET_RXRING_STARTED) {
-			rv = mac_hwring_start(rx_ringp->hw_rh);
+			rv = mac_hwring_activate(rx_ringp->hw_rh);
 			if (rv != 0) {
 				mac_hwring_teardown(rx_ringp->hw_rh);
 				rx_ringp->hw_rh = NULL;
@@ -2920,7 +2921,7 @@ vnet_unbind_hwrings(vnet_t *vnetp)
 		rx_ringp = &rx_grp->rings[i + VNET_HYBRID_RXRING_INDEX];
 		if (rx_ringp->hw_rh != NULL) {
 			/* Stop the hwring */
-			mac_hwring_stop(rx_ringp->hw_rh);
+			mac_hwring_quiesce(rx_ringp->hw_rh);
 
 			/* Teardown the hwring */
 			mac_hwring_teardown(rx_ringp->hw_rh);
diff --git a/usr/src/uts/sun4v/sys/Makefile b/usr/src/uts/sun4v/sys/Makefile
index 2af0d8841b..6c0fbd666c 100644
--- a/usr/src/uts/sun4v/sys/Makefile
+++ b/usr/src/uts/sun4v/sys/Makefile
@@ -22,8 +22,7 @@
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-#
-# uts/sun4v/sys/Makefile
+# Copyright 2018 Joyent, Inc.
 #
 # include global definitions
 UTSBASE	= ../..
@@ -42,16 +41,17 @@ SUN4_HDRS=			\
 	clock.h			\
 	cmp.h			\
 	cpc_ultra.h		\
-	cpu_sgnblk_defs.h 	\
+	cpu_sgnblk_defs.h	\
 	ddi_subrdefs.h		\
 	dvma.h			\
 	eeprom.h		\
 	fcode.h			\
+	ht.h			\
 	idprom.h		\
 	intr.h			\
 	intreg.h		\
 	ivintr.h		\
-	memlist_plat.h	 	\
+	memlist_plat.h		\
 	memnode.h		\
 	nexusdebug.h		\
 	prom_debug.h		\